diff --git a/.cursor/rules/aikido_rules.mdc b/.cursor/rules/aikido_rules.mdc new file mode 100644 index 0000000000..74bf1546f1 --- /dev/null +++ b/.cursor/rules/aikido_rules.mdc @@ -0,0 +1,17 @@ +--- +alwaysApply: true +always_on: true +trigger: always_on +applyTo: "**" +description: Aikido MCP Security Rules +--- + +# Project security best practices + +- Always run **aikido_full_scan** on generated, added and modified first-party code, unless the prompt explicitly says not to. +- Always provide the full file content to the scanner. +- If the scan identifies any security issues in newly generated or modified code, fix the issues using the scan result and remediation provided by **Aikido**. +- After applying fixes, run aikido_full_scan again to verify that the issues were successfully resolved, and no new issues were introduced. +- Repeat the fix-and-rescan cycle until the code passes with zero remaining or newly introduced security issues. +- If the **Aikido MCP server** required to run scans is not installed or not started successfully, inform the user with a message directing them to install it using the official Aikido MCP setup guide at: + **https://help.aikido.dev/ide-plugins/aikido-mcp**. \ No newline at end of file diff --git a/.github/agents/CIPP-Endpoint-Agent.md b/.github/agents/CIPP-Endpoint-Agent.md new file mode 100644 index 0000000000..b574155e43 --- /dev/null +++ b/.github/agents/CIPP-Endpoint-Agent.md @@ -0,0 +1,160 @@ +--- +name: CIPP HTTP Endpoint Builder +description: > + Adds or changes HTTP endpoints in backend/Modules/CIPPHTTP (Invoke-List/Add/Edit/Remove/Exec*) and the + CIPPCore helpers they call, with response shapes and status codes the frontend, MCP and the response cache + depend on. +--- + +# CIPP HTTP Endpoint Builder + +## Mission + +Write or change an HTTP endpoint so that it: + +- returns the body shape the frontend expects, +- returns a status code that tells the truth about what happened, +- documents its request contract through code the OpenAPI generator can read. + +Status codes are not cosmetic in CIPP: + +- **Response cache:** the runtime caches 2xx GET responses (for up to 600 s). An error returned as 200 is cached and served as data. +- **MCP:** the MCP tool layer treats `>= 400` as an error and anything else as a result. +- **Frontend:** the frontend retries and renders based on the status. + +--- + +## Anatomy + +```powershell +function Invoke-ExecThing { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Identity.User.ReadWrite + .DESCRIPTION + Shown in the generated API docs. + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + + if (-not $Request.Body.UserId) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'UserId is required' } + }) + } + + try { + $Result = Set-CIPPThing -UserId $Request.Body.UserId -TenantFilter $TenantFilter -Headers $Headers + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Result = "Failed to update thing: $($ErrorMessage.NormalizedError)" + Write-LogMessage -headers $Headers -API 'ExecThing' -tenant $TenantFilter -message $Result -Sev 'Error' -LogData $ErrorMessage + $StatusCode = Get-CippErrorStatusCode -ErrorRecord $_ + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @{ Results = $Result } + }) +} +``` + +Response bodies: + +- **Action endpoints** (`Add`/`Edit`/`Remove`/`Exec`): `Body = @{ Results = ... }`, where `Results` is a string or + an array of `@{ resultText = '...'; state = 'success' | 'error' }`. Use the same shape for errors. The UI reads + `Results` from error responses too. +- **List endpoints**: return the array itself: `Body = @($Data)`. +- Mark each per-item result with `state`. If `state` is missing, the UI has to guess severity from the text. + +--- + +## Status codes + +| Situation | Status | +| --- | --- | +| Success | `200 OK` (`202 Accepted` when work is queued) | +| Missing or invalid request input, or a request the business rules refuse | `400 BadRequest` | +| A resource the caller named does not exist (template, task, user to act on) | `404 NotFound` | +| A CIPP access check refuses the caller (role, allowed tenants, `Test-CIPPAccess`) | `403 Forbidden` | +| A Graph / Exchange / SharePoint / Azure / table call failed, or anything unexpected | `500 InternalServerError` | +| Several items acted on: all succeeded / some failed / all failed | `200` / `207 MultiStatus` / `500` | + +Rules that follow from the table: + +- **A catch never returns `OK`.** A failure that becomes "Failed ..." text inside a 200 is a bug. + `backend/Tests/Static/CatchBlockStatusCode.Tests.ps1` enforces this, with a short allow-list for deliberate fallbacks. +- **403 is only for CIPP's own access checks.** If Microsoft refuses the CIPP app in a customer tenant, that is an + upstream failure: return 500. +- **Upstream failures return 500, not 400.** The frontend does not retry 4xx, and 400 tells the caller their input was wrong. +- **Validate input before the `try`**, as an early `return` with `BadRequest` (or `NotFound`) inside an `if`. A + validation `throw` inside the `try` lands in the same catch as upstream failures, so it can't be told apart. The + OpenAPI generator marks a field required when an `if` body rejects it with `throw` or `BadRequest`, so keep the + guard as an `if`. +- **Multi-item endpoints** count what they were asked to act on and what failed, then return + `$StatusCode = Get-CippBulkStatusCode -Total $Total -Failed $Failed`. Use `$Failed++`, never `+=`. Only count real item + failures. An optional enrichment step that falls back to a default is not a failure. A List endpoint that loops + tenants follows the same rule: partial data is 207, nothing is 500. +- **Polled status endpoints and protocol endpoints** (JSON-RPC, OAuth token passthrough) can carry an error inside a + 200 when the client depends on that. Leave them that way on purpose, and add them to the guard's allow-list with a reason. + +--- + +## Helpers that endpoints call + +A helper must let its caller tell an input problem apart from an upstream failure: + +- Throw `[System.ArgumentException]::new('')` for invalid input or a refused request. +- Throw `[System.Management.Automation.ItemNotFoundException]::new('')` for a named resource that does not exist. +- Let upstream failures throw as they are. +- In the endpoint catch, `Get-CippErrorStatusCode -ErrorRecord $_` maps these to 400 / 404 / 500. It also looks inside + wrapped exceptions, because a script block run through a .NET method surfaces as + `MethodInvocationException -> RuntimeException -> ArgumentException`. +- A layer between the helper and the endpoint must not catch a typed exception and rethrow it as a string + (`throw "Failed: $($_.Exception.Message)"`). That loses the type. +- A helper that acts on several items returns one `[pscustomobject]@{ resultText = '...'; state = 'success' | 'error' }` + per item instead of swallowing failures into strings, so the caller can count them. +- Before changing what a helper returns or throws, read **every** caller. Scheduled and background callers + (`New-CIPPUserTask`, offboarding tasks, BEC containment, extension syncs) must keep collecting per-step results and + must not start aborting halfway. + +--- + +## Frontend contract + +- `ApiGetCall` / `ApiPostCall` do not retry 4xx (except 408 and 429). They retry 5xx shed responses (503) and do not + retry 500. +- Multi-row table actions (`CippApiDialog` with `multiPost: false`) send one request per row. A row that returns an + error is reported as `{ Results: [{ resultText, state: 'error' }] }` and the rest still run. `onResult` gets + `{ failed: true }` as its second argument for that row. +- `CippApiResults` renders `Results` / `resultText` / `error` from error responses. Axios treats 207 as success, and + each item's `state` decides how it is shown. +- When you change an endpoint's codes, grep `frontend/src` for `/api/`. A page that reads data only on success + needs `isError` handling (`getCippError(x.error)`) if it used to get its error inside a 200. + +--- + +## OpenAPI + +`backend/Config/openapi.json` is generated from the entrypoint AST (`build/tools/build-openapi.ps1`): + +- Status codes are documented from every `[HttpStatusCode]::X` in the file. +- An endpoint that uses `Get-CippBulkStatusCode` gets 200, 207 and 500. +- Codes that only come from `Get-CippErrorStatusCode` are not visible to the generator. Write the 400/404 guards as + explicit `[HttpStatusCode]::BadRequest` / `NotFound` returns where you can. +- Ask the maintainer before regenerating the spec. + +--- + +## Tests + +- If `backend/Tests/Endpoint/Invoke-.Tests.ps1` exists, add a case for each status the change introduces. +- Pin a helper's new contract with `Should -Throw -ExceptionType ([System.ArgumentException])`, or by asserting its + per-item `state` results. +- Always run `Invoke-Pester -Path backend/Tests/Static` (it includes the catch-block guard). diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index faf864265e..2b1b4c89a6 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -38,3 +38,17 @@ fix(graph): handle expired token on retry docs: update authentication model overview refactor(standards)!: rename remediation parameter ``` + +## HTTP endpoint status codes + +Endpoints in `backend/Modules/CIPPHTTP` must return a status code that matches what happened. The full guide is +`.github/agents/CIPP-Endpoint-Agent.md`. + +- `200` success, `400` invalid input or refused request, `404` named resource missing, `403` CIPP access check only, + `500` upstream (Graph/Exchange/SharePoint/Azure/table) or unexpected failure. +- Multi-item endpoints: `$StatusCode = Get-CippBulkStatusCode -Total $Total -Failed $Failed` (200 / 207 / 500). +- A `catch` never returns `[HttpStatusCode]::OK`. Use `$StatusCode = Get-CippErrorStatusCode -ErrorRecord $_`, which + maps `ArgumentException` to 400, `ItemNotFoundException` to 404 and anything else to 500. +- Validate input before the `try`, as an `if` that returns `BadRequest`, so it can't be mistaken for an upstream failure. +- Helpers throw `[System.ArgumentException]` / `[System.Management.Automation.ItemNotFoundException]` for input and + not-found errors, and return per-item `@{ resultText; state }` results rather than swallowing failures into strings. diff --git a/.github/workflows/Assign_Issue_Volunteer.yml b/.github/workflows/Assign_Issue_Volunteer.yml deleted file mode 100644 index fd7c93a7d7..0000000000 --- a/.github/workflows/Assign_Issue_Volunteer.yml +++ /dev/null @@ -1,16 +0,0 @@ ---- -name: "Issue volunteer assignment" -on: - issue_comment: - types: [created] -jobs: - volunteer: - runs-on: ubuntu-slim - # The action only calls the issues API (assign/unassign, add/remove labels, - # create comment), so issues:write is all it needs. - permissions: - issues: write - steps: - - uses: kris6673/issue-volunteer@v0.2.0 - with: - GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" diff --git a/.github/workflows/Close_Stale_Issues.yml b/.github/workflows/Close_Stale_Issues.yml deleted file mode 100644 index 4aff968dad..0000000000 --- a/.github/workflows/Close_Stale_Issues.yml +++ /dev/null @@ -1,24 +0,0 @@ ---- -name: "Close stale issues" -on: - schedule: - - cron: "30 1 * * *" -jobs: - stale: - if: github.repository_owner == 'CyberDrain' - runs-on: ubuntu-slim - # Only issues are processed (days-before-pr-* are -1), so no pull-requests - # scope is needed. contents:write would only be required for delete-branch. - permissions: - issues: write - steps: - - uses: actions/stale@v11 - with: - stale-issue-message: "This issue is stale because it has been open for 10 days with no activity. Please do not bump feature requests unless you are actively working on them, as bumps interfere with our triage process and make it harder to maintain a current list of feature requests. If you want this feature implemented, you can contribute it yourself; see https://docs.cipp.app/dev-documentation/contributing-to-the-code. Please notify the team if you are working on this." - close-issue-message: "This issue was closed because it has been stalled for 14 days without activity. We auto-close inactive feature requests to keep the backlog focused and actionable. If this request is still needed, you may submit it again after 30 days." - stale-issue-label: "no-activity" - exempt-issue-labels: "planned,bug,roadmap" - days-before-stale: 9 - days-before-close: 5 - days-before-pr-stale: -1 - days-before-pr-close: -1 diff --git a/.github/workflows/CodeQL_Analyser.yml b/.github/workflows/CodeQL_Analyser.yml deleted file mode 100644 index 6ceb1e9249..0000000000 --- a/.github/workflows/CodeQL_Analyser.yml +++ /dev/null @@ -1,42 +0,0 @@ -name: "CodeQL" -on: - push: - branches: [main, dev] - paths: - - 'frontend/**' - - '.github/codeql/**' - - '.github/workflows/CodeQL_Analyser.yml' - pull_request: - branches: [main, dev] - paths: - - 'frontend/**' - - '.github/codeql/**' - - '.github/workflows/CodeQL_Analyser.yml' - schedule: - - cron: "26 17 * * 0" -jobs: - analyze: - if: github.repository_owner == 'CyberDrain' - name: Analyze - runs-on: ubuntu-latest - permissions: - actions: read - contents: read - security-events: write - strategy: - fail-fast: false - matrix: - language: ["javascript-typescript"] - steps: - - name: Checkout Repository - uses: actions/checkout@v6 - - name: Initialize CodeQL - uses: github/codeql-action/init@v4.38.2 - with: - languages: ${{ matrix.language }} - queries: security-extended - config-file: ./.github/codeql/codeql-config.yml - - name: Autobuild - uses: github/codeql-action/autobuild@v4.38.2 - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.38.2 diff --git a/.github/workflows/Comment_on_Issues.yml b/.github/workflows/Comment_on_Issues.yml deleted file mode 100644 index e3f379208a..0000000000 --- a/.github/workflows/Comment_on_Issues.yml +++ /dev/null @@ -1,22 +0,0 @@ ---- -name: Add Comment -on: - issues: - types: - - labeled -jobs: - add-comment_bug: - if: github.repository_owner == 'CyberDrain' && github.event.label.name == 'bug' - runs-on: ubuntu-slim - permissions: - issues: write - steps: - - name: Add Comment - uses: peter-evans/create-or-update-comment@v5 - with: - issue-number: ${{ github.event.issue.number }} - body: | - Thank you for reporting a potential bug. If you would like to work on this bug, please comment: - > I would like to work on this please! - - Thank you for helping us maintain the project! diff --git a/.github/workflows/Conventional_Commits.yml b/.github/workflows/Conventional_Commits.yml deleted file mode 100644 index 883d2fcb9c..0000000000 --- a/.github/workflows/Conventional_Commits.yml +++ /dev/null @@ -1,116 +0,0 @@ -name: Conventional Commits Check - -on: - # Using pull_request_target instead of pull_request for secure handling of fork PRs - pull_request_target: - # Re-run on title edits so a corrected title clears the check and reopens the PR - types: [opened, synchronize, reopened, edited] - # Only check PRs targeting the dev branch - branches: - - dev - -permissions: - pull-requests: write - issues: write - -jobs: - conventional-commits: - name: Validate Conventional Commits - runs-on: ubuntu-slim - steps: - - name: Validate PR title - uses: actions/github-script@v9 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - const marker = ''; - const title = context.payload.pull_request.title || ''; - const pattern = /^(feat|fix|docs|style|refactor|perf|test|chore|ci|build|revert)(\(.+\))?!?: .+/i; - const valid = pattern.test(title); - - // Find a previous comment from this workflow so we update instead of piling up. - const comments = await github.paginate(github.rest.issues.listComments, { - ...context.repo, - issue_number: context.issue.number, - per_page: 100, - }); - const existing = comments.find( - (c) => c.user.type === 'Bot' && c.body.includes(marker) - ); - - if (valid) { - console.log(`✓ PR title follows Conventional Commits format: "${title}"`); - - // Nothing was ever wrong — stay quiet. - if (!existing) return; - - await github.rest.issues.updateComment({ - ...context.repo, - comment_id: existing.id, - body: [ - marker, - '### ✅ PR title follows Conventional Commits', - '', - `Received: \`${title}\``, - '', - 'Thanks for fixing it!' - ].join('\n'), - }); - - // We closed this PR for a bad title, so reopen it now that it is corrected. - const pr = context.payload.pull_request; - if (pr.state === 'closed' && !pr.merged) { - await github.rest.pulls.update({ - ...context.repo, - pull_number: context.issue.number, - state: 'open' - }); - console.log('Reopened the PR after the title was corrected.'); - } - return; - } - - console.log(`❌ PR title does not follow Conventional Commits format: "${title}"`); - - const body = [ - marker, - '### ❌ This PR title does not follow the [Conventional Commits](https://www.conventionalcommits.org/) format.', - '', - 'Expected format: `type(scope)?: description`', - '', - 'Allowed types: `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `chore`, `ci`, `build`, `revert`', - '', - 'Examples:', - '- `feat: add tenant filter to the user table`', - '- `fix(auth): handle expired refresh tokens`', - '- `docs: update self-hosting guide`', - '', - `Received: \`${title}\``, - '', - '🔒 This PR has been automatically closed. Edit the title to match the format above and it will reopen automatically.' - ].join('\n'); - - if (existing) { - await github.rest.issues.updateComment({ - ...context.repo, - comment_id: existing.id, - body, - }); - } else { - await github.rest.issues.createComment({ - ...context.repo, - issue_number: context.issue.number, - body, - }); - } - - const pr = context.payload.pull_request; - if (pr.state !== 'closed') { - await github.rest.pulls.update({ - ...context.repo, - pull_number: context.issue.number, - state: 'closed' - }); - } - - core.setFailed(`PR title does not follow Conventional Commits format: "${title}"`); diff --git a/.github/workflows/Label_Issues.yml b/.github/workflows/Label_Issues.yml deleted file mode 100644 index f7878cb2e1..0000000000 --- a/.github/workflows/Label_Issues.yml +++ /dev/null @@ -1,27 +0,0 @@ ---- -name: Label Issues -on: - issues: - types: - - opened -jobs: - label_issues_bugs: - if: github.repository_owner == 'CyberDrain' && contains(github.event.issue.title, 'Bug') - runs-on: ubuntu-slim - permissions: - issues: write - steps: - - name: Label Issues - uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90 - with: - add-labels: "bug" - label_issues_frs: - if: github.repository_owner == 'CyberDrain' && contains(github.event.issue.title, 'Feature') - runs-on: ubuntu-slim - permissions: - issues: write - steps: - - name: Label Issues - uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90 - with: - add-labels: "Feature, no-priority" diff --git a/.github/workflows/Validate_JSON.yml b/.github/workflows/Validate_JSON.yml index a92c2e7040..ad1aa64f83 100644 --- a/.github/workflows/Validate_JSON.yml +++ b/.github/workflows/Validate_JSON.yml @@ -8,7 +8,6 @@ on: types: [opened, synchronize, reopened] branches: - main - - dev paths: - "frontend/public/**/*.json" - "frontend/src/data/**/*.json" @@ -16,7 +15,7 @@ on: - ".github/scripts/validate-json.mjs" push: branches: - - dev + - main paths: - "frontend/public/**/*.json" - "frontend/src/data/**/*.json" @@ -86,7 +85,7 @@ jobs: body = `${marker}\n### ⚠️ Invalid JSON detected\n\n` + `${failures.length} JSON file(s) in this PR could not be parsed. ` + - `These files are loaded directly by CIPP, so a syntax error here breaks the app at runtime.\n\n` + + `These files are loaded directly by Manage365, so a syntax error here breaks the app at runtime.\n\n` + `${list}\n\n` + `Please fix the syntax and push again — this comment will update automatically.`; } else if (existing) { diff --git a/.github/workflows/auto_comments.yml b/.github/workflows/auto_comments.yml deleted file mode 100644 index a93e062f89..0000000000 --- a/.github/workflows/auto_comments.yml +++ /dev/null @@ -1,87 +0,0 @@ -name: "Handle Comment Commands" - -on: - issue_comment: - types: - - created - -jobs: - handle_comment: - runs-on: ubuntu-slim - # We need permissions to modify issue comments. - # 'issues: write' is required for deleting comments. - permissions: - issues: write - - steps: - # 1) If the comment includes '!notasponsor', delete it using GitHub Script - - name: Delete !notasponsor comment - if: contains(github.event.comment.body, '!notasponsor') - uses: actions/github-script@v9 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - await github.rest.issues.deleteComment({ - owner: context.repo.owner, - repo: context.repo.repo, - comment_id: context.payload.comment.id - }); - - # 2) Post a subscriber-specific reply - - name: Reply to !notasponsor - if: contains(github.event.comment.body, '!notasponsor') - uses: peter-evans/create-or-update-comment@v5 - with: - issue-number: ${{ github.event.issue.number }} - body: | - Hello, - - Thank you for your interest in improving CIPP! - To keep our development process focused and manageable, **feature requests are limited to paying users**. This policy helps us prioritise improvements that directly benefit those actively supporting CIPP and ensures we can sustain our development and support. - - When a subscriber makes a feature request, their subscription covers training, development, documentation, and security checks. Allowing requests from non-subscribers could lead to a backlog that slows down updates and stretches resources thin, ultimately affecting the quality and sustainability of CIPP. - - While we’ve closed this request, we appreciate your input. You’re always welcome to participate in ongoing discussions or contribute to open issues. If you are a developer, feel free to open a PR that includes your feature request or comment "**I’d like to work on this!**" to assign the issue to yourself. - - **Already a subscriber?** Subscriptions are available at https://cipp.ms/getcipp. If you subscribed through Stripe, reply with the email address you used to subscribe (or a screenshot of your Stripe receipt) so we can verify your subscription. If your organisation holds the subscription, let us know which organisation so we can match it. - - **Still on a legacy GitHub Sponsors plan?** Make sure your GitHub account is publicly linked to the sponsoring organisation. Go to the organisation page on GitHub, select **People**, and ensure your membership shows as **Public** (not Private). If your membership is private, we won't be able to verify that you're covered by the organisation's plan. - - **Did you get this notification in error?** Reply with a screenshot of your Stripe receipt or GitHub Sponsors payment, or your public organisation membership, and we'll reopen the issue. - - _Thank you for understanding,_ - **The CIPP Team** - - # 3) If the comment includes '!support', classify as a support request - - name: Reply to !support - if: contains(github.event.comment.body, '!support') - uses: peter-evans/create-or-update-comment@v5 - with: - issue-number: ${{ github.event.issue.number }} - body: | - Hello, - - Thank you for reaching out! This report has been classified as a **support request** rather than a bug or feature request. To keep our development process focused, support requests are limited to paying users. This policy allows us to prioritise resources for those actively supporting CIPP, helping us maintain high-quality development and support. - - Subscribers can contact our helpdesk directly via email for assistance with any issues or questions. Subscriptions are available at https://cipp.ms/getcipp. If you do not have a subscription, please refer to our documentation and community discussions—many questions have been answered there. - - **Did you get this notification in error?** Reply with a screenshot of your Stripe receipt or GitHub Sponsors payment, and we’ll gladly reopen the request. - - _Thank you for your understanding,_ - **The CIPP Team** - - # 4) If the comment includes '!incomplete', note the bug or feature request is incomplete - - name: Reply to !incomplete - if: contains(github.event.comment.body, '!incomplete') - uses: peter-evans/create-or-update-comment@v5 - with: - issue-number: ${{ github.event.issue.number }} - body: | - Hello, - - Thank you for your submission! It appears this **bug report or feature request is incomplete**. We need a clear description, steps to reproduce (for bugs), or a comprehensive overview of the requested feature. - - Please submit a new request with all the necessary details. Without sufficient information, it’s difficult for contributors to triage or implement solutions. - - _Thank you!_ - **The CIPP Team** diff --git a/.github/workflows/backend_pester.yml b/.github/workflows/backend_pester.yml index a00fcbe89c..e753ece70a 100644 --- a/.github/workflows/backend_pester.yml +++ b/.github/workflows/backend_pester.yml @@ -4,22 +4,15 @@ on: pull_request: branches: - main - - dev paths: - 'backend/**' - '.github/workflows/backend_pester.yml' - # Commits pushed straight to dev never open a PR, so the trigger above never sees - # them. Runs half an hour ahead of the nightly container build so a red suite - # surfaces before that image is published. - schedule: - - cron: '30 22 * * *' workflow_dispatch: concurrency: group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.ref }} cancel-in-progress: true jobs: pester: - if: github.repository_owner == 'CyberDrain' name: Pester runs-on: ubuntu-latest # Checkout and artifact upload only; nothing is written back to the repo. @@ -27,11 +20,6 @@ jobs: contents: read steps: - uses: actions/checkout@v4 - with: - # GitHub only fires schedules from the default branch, so a scheduled run - # would otherwise test main. dev is where the unreviewed commits land. - # PR and manual runs keep their own ref. - ref: ${{ github.event_name == 'schedule' && 'dev' || github.ref }} # The runner image ships a Pester, but not necessarily 5.x, and the suite uses the # Pester 5 Should -Invoke / -ParameterFilter syntax throughout. - name: Install Pester 5 diff --git a/.github/workflows/backend_psscriptanalyzer.yml b/.github/workflows/backend_psscriptanalyzer.yml index 6033d2ef52..ae1cf3917e 100644 --- a/.github/workflows/backend_psscriptanalyzer.yml +++ b/.github/workflows/backend_psscriptanalyzer.yml @@ -4,7 +4,6 @@ on: pull_request: branches: - main - - dev paths: - 'backend/**/*.ps1' - 'backend/**/*.psm1' @@ -13,7 +12,6 @@ concurrency: cancel-in-progress: true jobs: psscriptanalyzer: - if: github.repository_owner == 'CyberDrain' name: PSScriptAnalyzer runs-on: ubuntu-latest # Checkout and artifact upload only; nothing is written back to the repo. diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000000..c38af9b3f2 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,33 @@ +--- +name: "CodeQL" +on: + pull_request: + branches: [main] + paths: + - 'frontend/**' + schedule: + - cron: "26 17 * * 0" +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + strategy: + fail-fast: false + matrix: + language: ["javascript"] + steps: + - name: Checkout Repository + uses: actions/checkout@v4 + - name: Initialize CodeQL + uses: github/codeql-action/init@v4.37.7 + with: + languages: ${{ matrix.language }} + source-root: frontend + - name: Autobuild + uses: github/codeql-action/autobuild@v4.37.7 + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v4.37.7 diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 76db9c2ea8..89846eb7a8 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -3,7 +3,7 @@ name: Dependency Review on: pull_request: - branches: [main, dev] + branches: [main] permissions: contents: read @@ -11,7 +11,6 @@ permissions: jobs: dependency-review: - if: github.repository_owner == 'CyberDrain' runs-on: ubuntu-latest steps: - name: Checkout repository diff --git a/.github/workflows/dependency_scan.yml b/.github/workflows/dependency_scan.yml index 91268f16b3..89ba71533e 100644 --- a/.github/workflows/dependency_scan.yml +++ b/.github/workflows/dependency_scan.yml @@ -4,7 +4,6 @@ on: pull_request: branches: - main - - dev paths: - 'frontend/package.json' - 'frontend/yarn.lock' @@ -13,7 +12,6 @@ concurrency: cancel-in-progress: true jobs: yarn-audit: - if: github.repository_owner == 'CyberDrain' name: yarn audit runs-on: ubuntu-latest # Checkout and audit only; nothing is written back to the repo. diff --git a/.github/workflows/dev-container.yml b/.github/workflows/dev-container.yml deleted file mode 100644 index b4becc9e22..0000000000 --- a/.github/workflows/dev-container.yml +++ /dev/null @@ -1,124 +0,0 @@ -name: "Build: Dev Container" - -on: - push: - branches: [dev] - paths: - - 'frontend/**' - - 'backend/**' - - 'build/**' - - '!backend/Tests/**' - - '!frontend/tests/**' - workflow_dispatch: - -env: - REGISTRY: ghcr.io - IMAGE_NAME: ${{ github.repository }} - -# Cancel an in-flight dev build when a newer commit is pushed to dev. -concurrency: - group: dev-container - cancel-in-progress: true - -jobs: - build: - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - - steps: - - uses: actions/checkout@v4 - with: - ref: dev - fetch-depth: 0 - fetch-tags: true - - - name: Resolve version from latest release tag - id: version - run: | - TAG=$(git tag --sort=-v:refname | head -1) - TAG=${TAG:-v0.0.0} - BASE="${TAG#v}" - # Use the checked-out tree's SHA, not github.sha — those diverge when - # workflow_dispatch is run from a branch other than dev. - FULL_SHA=$(git rev-parse HEAD) - SHORT_SHA=$(git rev-parse --short=7 HEAD) - echo "app_version=${BASE}+dev.${SHORT_SHA}" >> $GITHUB_OUTPUT - echo "full_sha=${FULL_SHA}" >> $GITHUB_OUTPUT - echo "build_date=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT - - - name: Set lower case image name - run: echo "IMAGE_NAME_LC=${REPO,,}" >> $GITHUB_ENV - env: - REPO: ${{ github.repository }} - - - name: Log in to GHCR - uses: docker/login-action@v3 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Set up Docker Buildx - id: buildx - uses: docker/setup-buildx-action@v3 - - # Persist the Next.js compile cache and yarn cache across runs. These are - # BuildKit cache *mounts* (Dockerfile lines 67/85) — they are NOT exported by - # type=gha, so without this every CI build is a cold Next.js compile. Shared - # key prefix with the nightly workflow (identical Dockerfile/base image). - # The key rotates weekly, not per-run. A github.run_id key can never match, so - # actions/cache missed every build and its post step saved a fresh ~1.7 GB entry - # every time - hundreds of them, of which only the newest was ever read back - # (restore-keys resolves to the most recent prefix match). Keyed on the lockfile - # plus an ISO week, repeat builds hit exactly and save nothing, while the Next.js - # compile cache still refreshes often enough not to go cold. - - name: Compute cache epoch - id: cache-epoch - run: echo "week=$(date -u +%Y-%W)" >> $GITHUB_OUTPUT - - - name: Restore frontend build caches - id: build-cache - uses: actions/cache@v4 - with: - path: | - yarn-cache - next-cache - key: cipp-frontend-cache-dev-${{ hashFiles('frontend/yarn.lock') }}-${{ steps.cache-epoch.outputs.week }} - restore-keys: | - cipp-frontend-cache-dev-${{ hashFiles('frontend/yarn.lock') }}- - cipp-frontend-cache-dev- - - - name: Inject build caches into BuildKit - uses: reproducible-containers/buildkit-cache-dance@v3.4.0 - with: - builder: ${{ steps.buildx.outputs.name }} - cache-map: | - { - "yarn-cache": "/usr/local/share/.cache/yarn", - "next-cache": "/build/.next/cache" - } - skip-extraction: ${{ steps.build-cache.outputs.cache-hit }} - - - name: Build and push - uses: docker/build-push-action@v6 - with: - context: . - file: build/Dockerfile - push: true - cache-from: type=gha,scope=dev - cache-to: type=gha,mode=max,scope=dev - build-args: | - APP_VERSION=${{ steps.version.outputs.app_version }} - COMMIT_SHA=${{ steps.version.outputs.full_sha }} - IMAGE_TAG=dev - BUILD_DATE=${{ steps.version.outputs.build_date }} - DOTNET_REGISTRY=${{ vars.DOTNET_REGISTRY || 'ghcr.io/cyberdrain' }} - tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:dev - labels: | - org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }} - org.opencontainers.image.description=CIPP - Dev Build - org.opencontainers.image.revision=${{ steps.version.outputs.full_sha }} - org.opencontainers.image.version=${{ steps.version.outputs.app_version }} - org.opencontainers.image.created=${{ steps.version.outputs.build_date }} diff --git a/.github/workflows/frontend_vitest.yml b/.github/workflows/frontend_vitest.yml index 65b8c51ad2..8e5d691445 100644 --- a/.github/workflows/frontend_vitest.yml +++ b/.github/workflows/frontend_vitest.yml @@ -4,15 +4,9 @@ on: pull_request: branches: - main - - dev paths: - 'frontend/**' - '.github/workflows/frontend_vitest.yml' - # Commits pushed straight to dev never open a PR, so the trigger above never sees - # them. Runs half an hour ahead of the nightly container build so a red suite - # surfaces before that image is published. - schedule: - - cron: '30 22 * * *' workflow_dispatch: concurrency: group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.ref }} @@ -21,7 +15,6 @@ jobs: # Split from the storybook project deliberately: this one needs no browser, so it is the # fast signal, and a flaky browser run can never mask a failing unit test. unit: - if: github.repository_owner == 'CyberDrain' name: vitest (unit) runs-on: ubuntu-latest # Checkout and test only; nothing is written back to the repo. @@ -38,11 +31,6 @@ jobs: working-directory: frontend steps: - uses: actions/checkout@v4 - with: - # GitHub only fires schedules from the default branch, so a scheduled run - # would otherwise test main. dev is where the unreviewed commits land. - # PR and manual runs keep their own ref. - ref: ${{ github.event_name == 'schedule' && 'dev' || github.ref }} # 22.x, not the 22.13.0 the other workflows pin: jsdom@30 declares # engines.node ^22.22.2, so yarn refuses to install on exactly 22.13.0. # The floating 22.x still satisfies this repo's own engines ^22.13.0. @@ -63,7 +51,6 @@ jobs: run: yarn test:unit --testTimeout=30000 --shard=${{ matrix.shard }}/4 storybook: - if: github.repository_owner == 'CyberDrain' name: vitest (storybook) runs-on: ubuntu-latest # Checkout and test only; nothing is written back to the repo. @@ -81,8 +68,6 @@ jobs: working-directory: frontend steps: - uses: actions/checkout@v4 - with: - ref: ${{ github.event_name == 'schedule' && 'dev' || github.ref }} # See the note on the unit job: jsdom@30 rules out an exact 22.13.0 pin. - name: Use Node.js 22.x uses: actions/setup-node@v4 diff --git a/.github/workflows/manage365-image.yml b/.github/workflows/manage365-image.yml new file mode 100644 index 0000000000..dad519525e --- /dev/null +++ b/.github/workflows/manage365-image.yml @@ -0,0 +1,136 @@ +name: "Build: Manage365 Image" + +# Publishes ghcr.io/celeratec/manage365: from an explicit ref. +# APP_VERSION is the upstream CIPP baseline (out-of-date checks). The Manage365 +# release number lives in frontend/public/manage365-version.json and is chosen +# separately as the image tag. Do not publish this image from a GitHub release: +# release-container.yml strips the v and passes that tag as APP_VERSION, so a +# v6.1.0 release would make the app believe its upstream baseline is 6.1.0. + +on: + workflow_dispatch: + inputs: + ref: + description: Branch, tag, or SHA to build + required: true + default: main + app_version: + description: Upstream CIPP baseline baked in as APP_VERSION + required: true + default: "11.0.2" + image_tag: + description: Image tag. Manage365 release, not the upstream baseline. + required: true + default: v6.1.10 + +env: + REGISTRY: ghcr.io + IMAGE_NAME: ${{ github.repository }} + +concurrency: + group: manage365-image-${{ github.event.inputs.image_tag }} + cancel-in-progress: false + +jobs: + build: + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ github.event.inputs.ref }} + fetch-depth: 0 + persist-credentials: false + + - name: Resolve image identity + id: image + run: | + echo "commit_sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" + echo "build_date=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> "$GITHUB_OUTPUT" + + - name: Set lower case image name + run: echo "IMAGE_NAME_LC=${REPO,,}" >> $GITHUB_ENV + env: + REPO: ${{ github.repository }} + + - name: Log in to GHCR + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Set up Docker Buildx + id: buildx + uses: docker/setup-buildx-action@v3 + + - name: Compute cache epoch + id: cache-epoch + run: echo "week=$(date -u +%Y-%W)" >> $GITHUB_OUTPUT + + - name: Restore frontend build caches + id: build-cache + uses: actions/cache@v4 + with: + path: | + yarn-cache + next-cache + key: cipp-frontend-cache-manage365-${{ hashFiles('frontend/yarn.lock') }}-${{ steps.cache-epoch.outputs.week }} + restore-keys: | + cipp-frontend-cache-manage365-${{ hashFiles('frontend/yarn.lock') }}- + cipp-frontend-cache-release- + + - name: Inject build caches into BuildKit + uses: reproducible-containers/buildkit-cache-dance@5422eac04292c961a382e0f584ea0f03ad9da723 # v3.4.0 + with: + builder: ${{ steps.buildx.outputs.name }} + cache-map: | + { + "yarn-cache": "/usr/local/share/.cache/yarn", + "next-cache": "/build/.next/cache" + } + skip-extraction: ${{ steps.build-cache.outputs.cache-hit }} + + - name: Build and push + id: build + uses: docker/build-push-action@v6 + with: + context: . + file: build/Dockerfile + platforms: linux/amd64 + push: true + cache-from: type=gha,scope=manage365 + cache-to: type=gha,mode=max,scope=manage365 + build-args: | + APP_VERSION=${{ github.event.inputs.app_version }} + COMMIT_SHA=${{ steps.image.outputs.commit_sha }} + IMAGE_TAG=${{ github.event.inputs.image_tag }} + BUILD_DATE=${{ steps.image.outputs.build_date }} + DOTNET_REGISTRY=${{ vars.DOTNET_REGISTRY || 'ghcr.io/cyberdrain' }} + tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:${{ github.event.inputs.image_tag }} + labels: | + org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }} + org.opencontainers.image.description=Manage365 container + org.opencontainers.image.revision=${{ steps.image.outputs.commit_sha }} + org.opencontainers.image.version=${{ github.event.inputs.app_version }} + org.opencontainers.image.created=${{ steps.image.outputs.build_date }} + + - name: Summary + env: + PUBLISHED_IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:${{ github.event.inputs.image_tag }} + PUBLISHED_APP_VERSION: ${{ github.event.inputs.app_version }} + PUBLISHED_DIGEST: ${{ steps.build.outputs.digest }} + run: | + { + echo "### Manage365 image published" + echo + echo '```' + echo "$PUBLISHED_IMAGE" + echo '```' + echo + echo "APP_VERSION \`$PUBLISHED_APP_VERSION\`." + echo "Digest \`$PUBLISHED_DIGEST\`." + } >> "$GITHUB_STEP_SUMMARY" diff --git a/.github/workflows/nightly-container.yml b/.github/workflows/nightly-container.yml deleted file mode 100644 index 0de3748643..0000000000 --- a/.github/workflows/nightly-container.yml +++ /dev/null @@ -1,125 +0,0 @@ -name: "Build: Nightly Container" - -on: - schedule: - - cron: '0 23 * * *' # 11 PM UTC daily - workflow_dispatch: - -env: - REGISTRY: ghcr.io - IMAGE_NAME: ${{ github.repository }} - -jobs: - build: - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - - steps: - - uses: actions/checkout@v4 - with: - ref: dev - fetch-depth: 0 - - - name: Check for recent commits - id: check - run: | - if [ "$(git log --since='24 hours ago' --oneline)" ]; then - echo "has_commits=true" >> $GITHUB_OUTPUT - else - echo "has_commits=false" >> $GITHUB_OUTPUT - fi - - - name: Resolve version from latest release tag - if: steps.check.outputs.has_commits == 'true' || github.event_name == 'workflow_dispatch' - id: version - run: | - TAG=$(git tag --sort=-v:refname | head -1) - TAG=${TAG:-v0.0.0} - BASE="${TAG#v}" - # Use the checked-out tree's SHA, not github.sha — those diverge when - # workflow_dispatch is run from a branch other than dev. - FULL_SHA=$(git rev-parse HEAD) - SHORT_SHA=$(git rev-parse --short=7 HEAD) - echo "app_version=${BASE}+nightly.${SHORT_SHA}" >> $GITHUB_OUTPUT - echo "full_sha=${FULL_SHA}" >> $GITHUB_OUTPUT - echo "build_date=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT - - - name: Set lower case image name - if: steps.check.outputs.has_commits == 'true' || github.event_name == 'workflow_dispatch' - run: echo "IMAGE_NAME_LC=${REPO,,}" >> $GITHUB_ENV - env: - REPO: ${{ github.repository }} - - - name: Log in to GHCR - if: steps.check.outputs.has_commits == 'true' || github.event_name == 'workflow_dispatch' - uses: docker/login-action@v3 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Set up Docker Buildx - id: buildx - if: steps.check.outputs.has_commits == 'true' || github.event_name == 'workflow_dispatch' - uses: docker/setup-buildx-action@v3 - - # Persist the Next.js compile cache and yarn cache across runs (BuildKit - # cache mounts are not exported by type=gha). Shared key prefix and gha - # scope with the dev workflow — they build the identical Dockerfile/base. - # Weekly rotation rather than per-run - see the note in dev-container.yml. This - # shares dev's key prefix, so it must share dev's key shape too or it would go on - # writing a new ~1.7 GB entry into that prefix every night. - - name: Compute cache epoch - id: cache-epoch - if: steps.check.outputs.has_commits == 'true' || github.event_name == 'workflow_dispatch' - run: echo "week=$(date -u +%Y-%W)" >> $GITHUB_OUTPUT - - - name: Restore frontend build caches - id: build-cache - if: steps.check.outputs.has_commits == 'true' || github.event_name == 'workflow_dispatch' - uses: actions/cache@v4 - with: - path: | - yarn-cache - next-cache - key: cipp-frontend-cache-dev-${{ hashFiles('frontend/yarn.lock') }}-${{ steps.cache-epoch.outputs.week }} - restore-keys: | - cipp-frontend-cache-dev-${{ hashFiles('frontend/yarn.lock') }}- - cipp-frontend-cache-dev- - - - name: Inject build caches into BuildKit - if: steps.check.outputs.has_commits == 'true' || github.event_name == 'workflow_dispatch' - uses: reproducible-containers/buildkit-cache-dance@v3.4.0 - with: - builder: ${{ steps.buildx.outputs.name }} - cache-map: | - { - "yarn-cache": "/usr/local/share/.cache/yarn", - "next-cache": "/build/.next/cache" - } - skip-extraction: ${{ steps.build-cache.outputs.cache-hit }} - - - name: Build and push - if: steps.check.outputs.has_commits == 'true' || github.event_name == 'workflow_dispatch' - uses: docker/build-push-action@v6 - with: - context: . - file: build/Dockerfile - push: true - cache-from: type=gha,scope=dev - cache-to: type=gha,mode=max,scope=dev - build-args: | - APP_VERSION=${{ steps.version.outputs.app_version }} - COMMIT_SHA=${{ steps.version.outputs.full_sha }} - IMAGE_TAG=nightly - BUILD_DATE=${{ steps.version.outputs.build_date }} - DOTNET_REGISTRY=${{ vars.DOTNET_REGISTRY || 'ghcr.io/cyberdrain' }} - tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:nightly - labels: | - org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }} - org.opencontainers.image.description=CIPP - Nightly Build - org.opencontainers.image.revision=${{ steps.version.outputs.full_sha }} - org.opencontainers.image.version=${{ steps.version.outputs.app_version }} - org.opencontainers.image.created=${{ steps.version.outputs.build_date }} diff --git a/.github/workflows/openapi_spec.yml b/.github/workflows/openapi_spec.yml index c325c5ee3e..7fe415a556 100644 --- a/.github/workflows/openapi_spec.yml +++ b/.github/workflows/openapi_spec.yml @@ -4,7 +4,6 @@ on: pull_request: branches: - main - - dev paths: - 'backend/Modules/CIPPHTTP/**' # entrypoints hand the body to these, and the generator follows the call @@ -19,7 +18,6 @@ concurrency: cancel-in-progress: true jobs: spec: - if: github.repository_owner == 'CyberDrain' name: Validate and check for drift runs-on: ubuntu-latest # Checkout only; the spec is regenerated in a temp file and compared, never diff --git a/.github/workflows/pr_check.yml b/.github/workflows/pr_check.yml deleted file mode 100644 index 960b142cb6..0000000000 --- a/.github/workflows/pr_check.yml +++ /dev/null @@ -1,86 +0,0 @@ -name: PR Branch Check - -on: - # Using pull_request_target instead of pull_request for secure handling of fork PRs - pull_request_target: - # Only run on these PR events - types: [opened, synchronize, reopened] - # Only check PRs targeting these branches - branches: - - main - - master - -permissions: - pull-requests: write - issues: write - -jobs: - check-branch: - runs-on: ubuntu-slim - steps: - - name: Check and Comment on PR - # Only process fork PRs with specific branch conditions - # Must be a fork AND (source is main/master OR target is main/master) - if: | - github.event.pull_request.head.repo.fork == true && - ((github.event.pull_request.head.ref == 'main' || github.event.pull_request.head.ref == 'master') || - (github.event.pull_request.base.ref == 'main' || github.event.pull_request.base.ref == 'master')) - uses: actions/github-script@v9 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - let message = ''; - - // Check if the fork has open PRs (indicates pull bot or similar is active) - const forkOwner = context.payload.pull_request.head.repo.owner.login; - const forkRepo = context.payload.pull_request.head.repo.name; - const forkPullsUrl = context.payload.pull_request.head.repo.html_url + '/pulls'; - - let openPRs = []; - try { - const { data: prs } = await github.rest.pulls.list({ - owner: forkOwner, - repo: forkRepo, - state: 'open', - per_page: 5 - }); - openPRs = prs; - } catch (e) { - // Can't read fork PRs — skip - } - - message += '🔄 If you are attempting to update your CIPP repo please follow the instructions at: https://docs.cipp.app/setup/self-hosting-guide/updating. Are you a subscriber? Contact the helpdesk for direct assistance with updating to the latest version.'; - - if (openPRs.length > 0) { - message += ` It looks like you may already have a pending update PR on your fork — check your [open pull requests](${forkPullsUrl}) to accept it.`; - } else { - message += ` You can enable [Pull Bot](https://github.com/apps/pull) or [Repo Sync](https://github.com/apps/repo-sync) to automatically keep your fork up to date.`; - } - message += '\n\n'; - - // Check if PR is targeting main/master - if (context.payload.pull_request.base.ref === 'main' || context.payload.pull_request.base.ref === 'master') { - message += '⚠️ PRs cannot target the main branch directly. If you are attempting to contribute code please PR to the dev branch.\n\n'; - } - - // Check if PR is from a fork's main/master branch - if (context.payload.pull_request.head.repo.fork && - (context.payload.pull_request.head.ref === 'main' || context.payload.pull_request.head.ref === 'master')) { - message += '⚠️ This PR cannot be merged because it originates from your fork\'s main/master branch. If you are attempting to contribute code please PR from your dev branch or another non-main/master branch.\n\n'; - } - - message += '🔒 This PR will now be automatically closed due to the above rules.'; - - // Post the comment - await github.rest.issues.createComment({ - ...context.repo, - issue_number: context.issue.number, - body: message - }); - - // Close the PR - await github.rest.pulls.update({ - ...context.repo, - pull_number: context.issue.number, - state: 'closed' - }); diff --git a/.github/workflows/sync-legacy-backend-repository.yml b/.github/workflows/sync-legacy-backend-repository.yml deleted file mode 100644 index 2d6cc336c1..0000000000 --- a/.github/workflows/sync-legacy-backend-repository.yml +++ /dev/null @@ -1,94 +0,0 @@ -name: Sync Legacy Backend Repository - -on: - push: - branches: [dev, main] - paths: - - 'backend/**' - workflow_dispatch: - inputs: - full_sync: - description: 'Copy all of backend/ instead of only the pushed diff' - type: boolean - default: true - -permissions: - contents: read - -concurrency: - group: sync-backend-${{ github.ref }} - cancel-in-progress: false - -jobs: - sync: - if: github.repository == 'CyberDrain/CIPP' - runs-on: ubuntu-latest - env: - TARGET_REF: ${{ github.ref_name == 'main' && 'master' || github.ref_name }} - - steps: - - name: Checkout source (CyberDrain/CIPP) - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - name: Checkout target (KelvinTegelaar/CIPP-API) - uses: actions/checkout@v4 - with: - repository: ${{ vars.CIPP_API_REPO || 'KelvinTegelaar/CIPP-API' }} - ref: ${{ env.TARGET_REF }} - path: _target - token: ${{ secrets.CIPP_SYNC_TOKEN }} - - - name: Apply changes to target - run: | - set -euo pipefail - SRC_PREFIX="backend/" - BEFORE="${{ github.event.before }}" - - # Full copy when manually dispatched, on a brand-new branch, or when - # the previous tip is unreachable (force push). Never deletes target - # files - extra files in the target repo are allowed. - full_sync() { - echo "Performing full sync of ${SRC_PREFIX}" - rsync -a --exclude='.gitignore' "${SRC_PREFIX}" _target/ - } - - if [ "${{ github.event_name }}" = "workflow_dispatch" ] || \ - [ -z "$BEFORE" ] || \ - [ "$BEFORE" = "0000000000000000000000000000000000000000" ] || \ - ! git cat-file -e "$BEFORE" 2>/dev/null; then - full_sync - else - echo "Syncing diff ${BEFORE}..${GITHUB_SHA}" - git diff --no-renames --name-status "$BEFORE" "$GITHUB_SHA" -- "$SRC_PREFIX" | - while IFS=$'\t' read -r status path; do - rel="${path#"$SRC_PREFIX"}" - # The subfolder .gitignore is specific to this repo; the target keeps its own - [ "$rel" = ".gitignore" ] && continue - if [ "$status" = "D" ]; then - echo " delete: $rel" - rm -f "_target/$rel" - else - echo " copy: $rel" - mkdir -p "_target/$(dirname "$rel")" - cp "$path" "_target/$rel" - fi - done - fi - - - name: Commit and push - run: | - set -euo pipefail - cd _target - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" - git add -A - if git diff --cached --quiet; then - echo "No changes to sync" - exit 0 - fi - COMMIT_MSG="$(cd .. && git log -1 --pretty=%B "$GITHUB_SHA")" - git commit -m "$COMMIT_MSG" -m "Synced from CyberDrain/CIPP@${GITHUB_SHA}" - # Retry once in case the target branch moved while we were running - git push || { git pull --rebase && git push; } diff --git a/.github/workflows/sync-legacy-frontend-repository.yml b/.github/workflows/sync-legacy-frontend-repository.yml deleted file mode 100644 index c3c4d12542..0000000000 --- a/.github/workflows/sync-legacy-frontend-repository.yml +++ /dev/null @@ -1,92 +0,0 @@ -name: Sync Legacy Frontend Repository - -on: - push: - branches: [dev, main] - paths: - - 'frontend/**' - workflow_dispatch: - inputs: - full_sync: - description: 'Copy all of frontend/ instead of only the pushed diff' - type: boolean - default: true - -permissions: - contents: read - -concurrency: - group: sync-frontend-${{ github.ref }} - cancel-in-progress: false - -jobs: - sync: - if: github.repository == 'CyberDrain/CIPP' - runs-on: ubuntu-latest - - steps: - - name: Checkout source (CyberDrain/CIPP) - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - name: Checkout target (KelvinTegelaar/CIPP) - uses: actions/checkout@v4 - with: - repository: ${{ vars.CIPP_REPO || 'KelvinTegelaar/CIPP' }} - ref: ${{ github.ref_name }} - path: _target - token: ${{ secrets.CIPP_SYNC_TOKEN }} - - - name: Apply changes to target - run: | - set -euo pipefail - SRC_PREFIX="frontend/" - BEFORE="${{ github.event.before }}" - - # Full copy when manually dispatched, on a brand-new branch, or when - # the previous tip is unreachable (force push). Never deletes target - # files - extra files in the target repo are allowed. - full_sync() { - echo "Performing full sync of ${SRC_PREFIX}" - rsync -a --exclude='.gitignore' "${SRC_PREFIX}" _target/ - } - - if [ "${{ github.event_name }}" = "workflow_dispatch" ] || \ - [ -z "$BEFORE" ] || \ - [ "$BEFORE" = "0000000000000000000000000000000000000000" ] || \ - ! git cat-file -e "$BEFORE" 2>/dev/null; then - full_sync - else - echo "Syncing diff ${BEFORE}..${GITHUB_SHA}" - git diff --no-renames --name-status "$BEFORE" "$GITHUB_SHA" -- "$SRC_PREFIX" | - while IFS=$'\t' read -r status path; do - rel="${path#"$SRC_PREFIX"}" - # The subfolder .gitignore is specific to this repo; the target keeps its own - [ "$rel" = ".gitignore" ] && continue - if [ "$status" = "D" ]; then - echo " delete: $rel" - rm -f "_target/$rel" - else - echo " copy: $rel" - mkdir -p "_target/$(dirname "$rel")" - cp "$path" "_target/$rel" - fi - done - fi - - - name: Commit and push - run: | - set -euo pipefail - cd _target - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" - git add -A - if git diff --cached --quiet; then - echo "No changes to sync" - exit 0 - fi - COMMIT_MSG="$(cd .. && git log -1 --pretty=%B "$GITHUB_SHA")" - git commit -m "$COMMIT_MSG" -m "Synced from CyberDrain/CIPP@${GITHUB_SHA}" - # Retry once in case the target branch moved while we were running - git push || { git pull --rebase && git push; } diff --git a/.github/workflows/update-license-skus.yml b/.github/workflows/update-license-skus.yml deleted file mode 100644 index 67cfa332f9..0000000000 --- a/.github/workflows/update-license-skus.yml +++ /dev/null @@ -1,199 +0,0 @@ -name: Update License SKU Data - -# Refreshes the Microsoft license SKU data (ConversionTable.csv, M365Licenses.json, -# ExcludeSkuList.JSON) from Microsoft's published CSV and opens a PR against dev when -# anything changed. Requires "Allow GitHub Actions to create and approve pull requests" -# in the repository's Actions settings. - -on: - schedule: - - cron: '0 6 * * *' # Daily 06:00 UTC - workflow_dispatch: - -permissions: - contents: write - pull-requests: write - -concurrency: - group: update-license-skus - cancel-in-progress: false - -jobs: - update: - if: github.repository == 'CyberDrain/CIPP' - name: Update license SKUs - # ubuntu on purpose: the generated files are stored with LF line endings, which is - # exactly what PowerShell writes here. A Windows runner would work too, but only - # because autocrlf normalises on commit - this way there is nothing to normalise. - runs-on: ubuntu-latest - env: - BASE_BRANCH: dev - BRANCH_PREFIX: chore/license-sku-update - GH_TOKEN: ${{ github.token }} - - steps: - - name: Checkout - uses: actions/checkout@v4 - with: - ref: dev - # Full history: pushing a new branch from a shallow clone is rejected. - fetch-depth: 0 - - - name: Clean up temp branches from earlier runs - shell: pwsh - run: | - # A prefixed branch with no open PR has been merged, closed, or orphaned. - # Best effort - a failure here must not block today's update. - $Branches = git ls-remote --heads origin | - ForEach-Object { ($_ -split "`t")[1] -replace '^refs/heads/', '' } | - Where-Object { $_ -like "$env:BRANCH_PREFIX-*" } - - foreach ($Branch in $Branches) { - $OpenPrs = @(gh pr list --head $Branch --state open --json number | ConvertFrom-Json) - if ($OpenPrs.Count -eq 0) { - Write-Host "Deleting merged/closed branch $Branch" - git push origin --delete $Branch - if ($LASTEXITCODE -ne 0) { Write-Warning "Could not delete $Branch." } - } else { - Write-Host "Keeping $Branch (PR #$($OpenPrs[0].number) is still open)" - } - } - exit 0 - - - name: Update license SKU files - shell: pwsh - run: | - $ErrorActionPreference = 'Stop' - # Snapshot the current data so the PR body can say what actually changed. - Copy-Item ./backend/Config/ConversionTable.csv "$env:RUNNER_TEMP/ConversionTable.before.csv" - ./build/tools/Update-LicenseSKUFiles.ps1 - - - name: Validate the downloaded data - shell: pwsh - run: | - $ErrorActionPreference = 'Stop' - # That download URL has served error pages and truncated files before now. - # Never open a PR on top of one. - $Csv = Import-Csv -Path ./backend/Config/ConversionTable.csv - if ($Csv.Count -lt 1000) { - throw "ConversionTable.csv has only $($Csv.Count) rows - refusing to continue." - } - $Columns = $Csv[0].PSObject.Properties.Name - foreach ($Column in 'Product_Display_Name', 'String_Id', 'GUID', 'Service_Plan_Name', 'Service_Plan_Id') { - if ($Column -notin $Columns) { throw "ConversionTable.csv is missing the $Column column." } - } - $Json = Get-Content -Path ./frontend/src/data/M365Licenses.json -Raw | ConvertFrom-Json - if ($Json.Count -ne $Csv.Count) { - throw "M365Licenses.json ($($Json.Count) entries) and ConversionTable.csv ($($Csv.Count) rows) disagree." - } - Write-Host "Validated $($Csv.Count) license SKU rows." - - - name: Stage changes - id: stage - shell: pwsh - run: | - $ErrorActionPreference = 'Stop' - git add -- ':(glob)backend/**/*ConversionTable.csv' 'frontend/src/data/M365Licenses.json' 'backend/Config/ExcludeSkuList.JSON' - $Staged = @(git diff --cached --name-only) - if ($Staged.Count -eq 0) { - Write-Host 'License SKU data is already up to date.' - 'changed=false' | Out-File -FilePath $env:GITHUB_OUTPUT -Append - exit 0 - } - Write-Host "Changed files:`n$($Staged -join "`n")" - 'changed=true' | Out-File -FilePath $env:GITHUB_OUTPUT -Append - - - name: Build the PR body - if: steps.stage.outputs.changed == 'true' - shell: pwsh - run: | - $ErrorActionPreference = 'Stop' - $Before = Import-Csv -Path "$env:RUNNER_TEMP/ConversionTable.before.csv" - $After = Import-Csv -Path ./backend/Config/ConversionTable.csv - - # SKUs, not rows: the CSV carries one row per service plan within a SKU. - $BeforeSkus = @{} - foreach ($Row in $Before) { $BeforeSkus[$Row.GUID] = $Row.Product_Display_Name } - $AfterSkus = @{} - foreach ($Row in $After) { $AfterSkus[$Row.GUID] = $Row.Product_Display_Name } - - $Added = $AfterSkus.Keys | Where-Object { -not $BeforeSkus.ContainsKey($_) } | Sort-Object { $AfterSkus[$_] } - $Removed = $BeforeSkus.Keys | Where-Object { -not $AfterSkus.ContainsKey($_) } | Sort-Object { $BeforeSkus[$_] } - $Renamed = $AfterSkus.Keys | - Where-Object { $BeforeSkus.ContainsKey($_) -and $BeforeSkus[$_] -cne $AfterSkus[$_] } | - Sort-Object { $AfterSkus[$_] } - - function Format-SkuList { - param($Guids, $Names, $Heading, $Previous) - $Count = @($Guids).Count - if ($Count -eq 0) { return @() } - $Lines = @('', "### $Heading ($Count)", '') - $Lines += @($Guids) | Select-Object -First 25 | ForEach-Object { - if ($Previous) { '- {0} -> {1} `{2}`' -f $Previous[$_], $Names[$_], $_ } - else { '- {0} `{1}`' -f $Names[$_], $_ } - } - if ($Count -gt 25) { $Lines += '- ...and {0} more' -f ($Count - 25) } - return $Lines - } - - $Body = @( - 'Automated refresh of the Microsoft license SKU data, generated by `build/tools/Update-LicenseSKUFiles.ps1` from [Microsoft''s published product names and service plan identifiers CSV](https://learn.microsoft.com/entra/identity/users/licensing-service-plan-reference).' - '' - '**Service plan rows:** {0:N0} -> {1:N0}' -f $Before.Count, $After.Count - '**Distinct SKUs:** {0:N0} -> {1:N0}' -f $BeforeSkus.Count, $AfterSkus.Count - ) - $Body += Format-SkuList -Guids $Added -Names $AfterSkus -Heading 'New SKUs' - $Body += Format-SkuList -Guids $Removed -Names $BeforeSkus -Heading 'Removed SKUs' - $Body += Format-SkuList -Guids $Renamed -Names $AfterSkus -Previous $BeforeSkus -Heading 'Renamed SKUs' - $Body += @( - '' - '
Files changed' - '' - '```' - (git diff --cached --stat) - '```' - '' - '
' - '' - '---' - '' - '_Opened by the [Update License SKU Data]({0}/{1}/actions/runs/{2}) workflow. The `{3}-*` branch is deleted on the next run once this PR is merged or closed._' -f $env:GITHUB_SERVER_URL, $env:GITHUB_REPOSITORY, $env:GITHUB_RUN_ID, $env:BRANCH_PREFIX - ) - $Body -join "`n" | Set-Content -Path "$env:RUNNER_TEMP/pr-body.md" -Encoding utf8 - - - name: Commit, push and open the PR - if: steps.stage.outputs.changed == 'true' - shell: pwsh - run: | - $ErrorActionPreference = 'Stop' - $PSNativeCommandUseErrorActionPreference = $true - - # Reuse the branch of an already-open PR so a run of daily updates does not - # stack up one PR per day; otherwise cut a fresh dated branch. - $OpenPrs = @(gh pr list --state open --base $env:BASE_BRANCH --limit 100 --json number,headRefName | ConvertFrom-Json) - $Existing = $OpenPrs | Where-Object { $_.headRefName -like "$env:BRANCH_PREFIX-*" } | Select-Object -First 1 - - if ($Existing) { - $Branch = $Existing.headRefName - Write-Host "Updating PR #$($Existing.number) on $Branch" - } else { - $Branch = '{0}-{1}' -f $env:BRANCH_PREFIX, (Get-Date -Format 'yyyyMMdd') - Write-Host "Creating $Branch" - } - - git config user.name 'github-actions[bot]' - git config user.email 'github-actions[bot]@users.noreply.github.com' - git switch -c $Branch - git commit -m 'chore(licenses): update Microsoft license SKU data' - # Force: the branch is disposable and always one commit on top of dev. - git push --force origin $Branch - - if (-not $Existing) { - gh pr create ` - --base $env:BASE_BRANCH ` - --head $Branch ` - --title ('chore(licenses): update Microsoft license SKU data ({0})' -f (Get-Date -Format 'yyyy-MM-dd')) ` - --body-file "$env:RUNNER_TEMP/pr-body.md" - } else { - gh pr edit $Existing.number --body-file "$env:RUNNER_TEMP/pr-body.md" - } diff --git a/.github/workflows/zap-scan.yml b/.github/workflows/zap-scan.yml deleted file mode 100644 index 33d43d6c04..0000000000 --- a/.github/workflows/zap-scan.yml +++ /dev/null @@ -1,55 +0,0 @@ -# DAST: OWASP ZAP scans against the CIPP staging deployment -# ISO 27001:2022 A.8.29 evidence — Dynamic Application Security Testing -# -# Prerequisites: -# - Repo variable STAGING_URL pointing at a staging deployment (test-tenant data only, never production) -# - Optional: .zap/rules.tsv to suppress documented false positives (annotate each with justification) -name: DAST - OWASP ZAP Scan -on: - schedule: - - cron: "0 4 * * 1" # Weekly, Monday 04:00 UTC - workflow_dispatch: # Run on demand before each versioned release - inputs: - full_scan: - description: "Run full (active) scan instead of baseline" - type: boolean - default: false - -permissions: - contents: read - issues: write # ZAP action files findings as GitHub issues - -jobs: - zap_baseline: - if: github.repository_owner == 'CyberDrain' && (github.event_name == 'schedule' || !inputs.full_scan) - name: ZAP Baseline Scan (passive) - runs-on: ubuntu-latest - steps: - - name: Checkout (for .zap rules file) - uses: actions/checkout@v6 - - - name: ZAP baseline scan - uses: zaproxy/action-baseline@v0.15.0 - with: - target: ${{ vars.STAGING_URL }} - rules_file_name: ".zap/rules.tsv" - allow_issue_writing: true - issue_title: "ZAP baseline scan findings" - artifact_name: zap-baseline-report - - zap_full: - if: github.repository_owner == 'CyberDrain' && github.event_name == 'workflow_dispatch' && inputs.full_scan - name: ZAP Full Scan (active, pre-release) - runs-on: ubuntu-latest - steps: - - name: Checkout (for .zap rules file) - uses: actions/checkout@v6 - - - name: ZAP full scan - uses: zaproxy/action-full-scan@v0.13.0 - with: - target: ${{ vars.STAGING_URL }} - rules_file_name: ".zap/rules.tsv" - allow_issue_writing: true - issue_title: "ZAP full scan findings (pre-release)" - artifact_name: zap-full-report diff --git a/DESIGN.json b/DESIGN.json new file mode 100644 index 0000000000..237e341fb0 --- /dev/null +++ b/DESIGN.json @@ -0,0 +1,266 @@ +{ + "schemaVersion": 2, + "generatedAt": "2026-05-09T17:54:00Z", + "title": "Design System: Manage365", + "extensions": { + "colorMeta": { + "dashboard-blue": { + "role": "primary", + "displayName": "Dashboard Blue", + "canonical": "oklch(70% 0.11 230)", + "tonalRamp": [ + "oklch(20% 0.08 230)", + "oklch(30% 0.09 230)", + "oklch(40% 0.10 230)", + "oklch(50% 0.11 230)", + "oklch(60% 0.11 230)", + "oklch(70% 0.11 230)", + "oklch(80% 0.09 230)", + "oklch(90% 0.05 230)" + ] + }, + "success": { + "role": "semantic", + "displayName": "Teal Success", + "canonical": "oklch(72% 0.08 185)", + "tonalRamp": [ + "oklch(25% 0.06 185)", + "oklch(35% 0.07 185)", + "oklch(45% 0.08 185)", + "oklch(55% 0.08 185)", + "oklch(65% 0.08 185)", + "oklch(72% 0.08 185)", + "oklch(82% 0.06 185)", + "oklch(92% 0.03 185)" + ] + }, + "error": { + "role": "semantic", + "displayName": "Muted Rose Error", + "canonical": "oklch(72% 0.10 15)", + "tonalRamp": [ + "oklch(25% 0.08 15)", + "oklch(35% 0.09 15)", + "oklch(45% 0.10 15)", + "oklch(55% 0.10 15)", + "oklch(65% 0.10 15)", + "oklch(72% 0.10 15)", + "oklch(82% 0.07 15)", + "oklch(92% 0.04 15)" + ] + }, + "warning": { + "role": "semantic", + "displayName": "Mint Warning", + "canonical": "oklch(78% 0.12 145)", + "tonalRamp": [ + "oklch(25% 0.08 145)", + "oklch(35% 0.10 145)", + "oklch(45% 0.11 145)", + "oklch(55% 0.12 145)", + "oklch(65% 0.12 145)", + "oklch(78% 0.12 145)", + "oklch(85% 0.08 145)", + "oklch(92% 0.04 145)" + ] + }, + "neutral-900": { + "role": "neutral", + "displayName": "Near Black", + "canonical": "oklch(20% 0 0)", + "tonalRamp": [ + "oklch(20% 0 0)", + "oklch(30% 0 0)", + "oklch(40% 0 0)", + "oklch(50% 0 0)", + "oklch(60% 0 0)", + "oklch(70% 0 0)", + "oklch(85% 0 0)", + "oklch(97% 0 0)" + ] + } + }, + "typographyMeta": { + "display": { + "displayName": "Display", + "purpose": "Page titles, dashboard heroes. Rare." + }, + "headline": { + "displayName": "Headline", + "purpose": "Section headers, modal titles." + }, + "title": { + "displayName": "Title", + "purpose": "Card headers, panel titles." + }, + "body": { + "displayName": "Body", + "purpose": "Primary content, table cells, descriptions. Max line length 75ch." + }, + "label": { + "displayName": "Label", + "purpose": "Form labels, chip text, metadata." + } + }, + "shadows": [ + { + "name": "level-1", + "value": "0px 1px 2px rgba(0, 0, 0, 0.24)", + "purpose": "Subtle lift. Buttons at rest, chips." + }, + { + "name": "level-4", + "value": "0px 1px 5px rgba(0, 0, 0, 0.24)", + "purpose": "Cards on surfaces. Gentle separation." + }, + { + "name": "level-8", + "value": "0px 4px 6px rgba(0, 0, 0, 0.24)", + "purpose": "Dropdown menus, tooltips. Clear float." + }, + { + "name": "level-16", + "value": "0px 10px 15px rgba(0, 0, 0, 0.24)", + "purpose": "Modals, dialogs. Prominent overlay." + }, + { + "name": "level-24", + "value": "0px 25px 50px rgba(0, 0, 0, 0.24)", + "purpose": "Large modals, full-screen overlays." + } + ], + "motion": [ + { + "name": "ease-standard", + "value": "cubic-bezier(0.4, 0, 0.2, 1)", + "purpose": "Default easing for state transitions." + }, + { + "name": "ease-out-quart", + "value": "cubic-bezier(0.25, 1, 0.5, 1)", + "purpose": "Exits and settling animations." + }, + { + "name": "duration-fast", + "value": "150ms", + "purpose": "Hover states, micro-interactions." + }, + { + "name": "duration-normal", + "value": "250ms", + "purpose": "Page transitions, modal opens." + } + ], + "breakpoints": [ + { "name": "xs", "value": "0px" }, + { "name": "sm", "value": "600px" }, + { "name": "md", "value": "900px" }, + { "name": "lg", "value": "1200px" }, + { "name": "xl", "value": "1536px" } + ] + }, + "components": [ + { + "name": "Primary Button", + "kind": "button", + "refersTo": "button-primary", + "description": "Main action button. Dashboard Blue background, white text.", + "html": "", + "css": ".ds-btn-primary { background-color: #53A5DB; color: #FFFFFF; font-family: Inter, sans-serif; font-size: 14px; font-weight: 600; padding: 8px 16px; border: none; border-radius: 6px; cursor: pointer; transition: background-color 150ms cubic-bezier(0.4, 0, 0.2, 1); } .ds-btn-primary:hover { background-color: #2D4A5E; } .ds-btn-primary:focus-visible { outline: none; box-shadow: 0px 0px 0px 2px rgba(83, 165, 219, 0.4); }" + }, + { + "name": "Secondary Button", + "kind": "button", + "refersTo": "button-secondary", + "description": "Lower-emphasis action. Transparent background with blue text.", + "html": "", + "css": ".ds-btn-secondary { background-color: transparent; color: #53A5DB; font-family: Inter, sans-serif; font-size: 14px; font-weight: 600; padding: 8px 16px; border: 1px solid transparent; border-radius: 6px; cursor: pointer; transition: border-color 150ms cubic-bezier(0.4, 0, 0.2, 1), background-color 150ms cubic-bezier(0.4, 0, 0.2, 1); } .ds-btn-secondary:hover { border-color: #53A5DB; background-color: rgba(83, 165, 219, 0.08); } .ds-btn-secondary:focus-visible { outline: none; box-shadow: 0px 0px 0px 2px rgba(83, 165, 219, 0.4); }" + }, + { + "name": "Filled Input", + "kind": "input", + "refersTo": "input-filled", + "description": "Default text input. Filled variant with border.", + "html": "", + "css": ".ds-input-filled { font-family: Inter, sans-serif; font-size: 14px; font-weight: 500; line-height: 1.6; height: 40px; padding: 0 12px; background-color: transparent; border: 1px solid rgba(0, 0, 0, 0.23); border-radius: 6px; outline: none; transition: border-color 150ms cubic-bezier(0.4, 0, 0.2, 1), box-shadow 150ms cubic-bezier(0.4, 0, 0.2, 1); } .ds-input-filled:focus { border-color: #1976d2; box-shadow: 0px 0px 0px 2px rgba(25, 118, 210, 0.25); } .ds-input-filled::placeholder { color: rgba(0, 0, 0, 0.38); }" + }, + { + "name": "Chip", + "kind": "chip", + "refersTo": "chip-default", + "description": "Status tag or filter chip. Neutral background, rounded corners.", + "html": "Active", + "css": ".ds-chip { display: inline-flex; align-items: center; font-family: Inter, sans-serif; font-size: 12px; font-weight: 400; padding: 4px 8px; background-color: #EEEEEE; color: #424242; border-radius: 6px; }" + }, + { + "name": "Card", + "kind": "card", + "refersTo": "card-default", + "description": "Content container with subtle elevation.", + "html": "
Card Title
Card content goes here.
", + "css": ".ds-card { background-color: #FFFFFF; border-radius: 6px; box-shadow: 0px 1px 5px rgba(0, 0, 0, 0.24); } .ds-card-header { padding: 16px 24px; font-family: Inter, sans-serif; font-size: 16px; font-weight: 600; } .ds-card-content { padding: 20px 24px; font-family: Inter, sans-serif; font-size: 14px; line-height: 1.6; }" + }, + { + "name": "Nav Item", + "kind": "nav", + "refersTo": "nav-item", + "description": "Side navigation item. Active state uses Dashboard Blue.", + "html": "Dashboard", + "css": ".ds-nav-item { display: flex; align-items: center; gap: 16px; padding: 8px 16px; font-family: Inter, sans-serif; font-size: 14px; color: #616161; text-decoration: none; border-radius: 6px; transition: background-color 150ms cubic-bezier(0.4, 0, 0.2, 1); } .ds-nav-item:hover { background-color: rgba(0, 0, 0, 0.04); } .ds-nav-item--active { color: #53A5DB; background-color: rgba(83, 165, 219, 0.08); } .ds-nav-icon { flex-shrink: 0; }" + } + ], + "narrative": { + "northStar": "The Control Room", + "overview": "Manage365 is a control room for MSP technicians managing dozens of Microsoft 365 tenants. Every element exists to surface information and enable action. There is no marketing, no onboarding friction, no decorative flourish. The interface assumes expertise and rewards it with density and speed.\n\nThe design philosophy is utilitarian without being ugly. Information is compressed but readable. Actions are discoverable but not intrusive. The system trusts users to know what they're doing and gets out of their way.\n\nThis is not a consumer app. It's not trying to delight first-time visitors or explain itself. It's a daily driver for professionals who will spend hundreds of hours in it. Efficiency compounds. Every pixel counts.", + "keyCharacteristics": [ + "Information-dense — Tables, cards, and dashboards pack data tight. White space is for structure, not aesthetics.", + "Action-oriented — Primary actions are visible and reachable. Bulk operations are first-class citizens.", + "Context-preserving — Tenant switching, navigation, and workflows never lose your place.", + "Quiet confidence — The interface doesn't shout. Status colors are muted. Shadows are structural, not decorative." + ], + "rules": [ + { + "name": "The Dashboard Blue Rule", + "body": "The primary accent is used on interactive elements: buttons, links, active states, focus rings. It does not appear on static informational content. If something is blue, it should be clickable or indicate selection.", + "section": "colors" + }, + { + "name": "The Soft Semantic Rule", + "body": "Status colors are intentionally muted. Errors and warnings appear frequently in admin tools; screaming red and orange cause alarm fatigue. Our semantic colors are visible but calm.", + "section": "colors" + }, + { + "name": "The 14px Body Rule", + "body": "Body text is 14px, not 16px. Admin interfaces benefit from density. Users are close to their screens and focused.", + "section": "typography" + }, + { + "name": "The Structural Shadow Rule", + "body": "Shadows communicate z-index, not decoration. If it floats, it has a shadow. If it's inline, it doesn't. Background tint handles surface layering.", + "section": "elevation" + } + ], + "dos": [ + "Do use Dashboard Blue only for interactive elements. If it's blue, it should do something.", + "Do keep body text at 14px. Density is a feature, not a bug.", + "Do use structural shadows to communicate elevation. Modals float; inline content doesn't.", + "Do respect the neutral scale for non-interactive surfaces. Reserve color for status and actions.", + "Do support both light and dark modes. Dark mode uses elevated surface tints, not just shadows.", + "Do include visible focus indicators. Keyboard navigation is critical for power users.", + "Do truncate long content with ellipsis rather than breaking layouts." + ], + "donts": [ + "Don't mimic Azure Portal. No overwhelming nested menus, no slow page loads, no lost context.", + "Don't add marketing fluff. No gradient hero sections, no stock photography, no \"Get Started\" hand-holding.", + "Don't use 2010s enterprise patterns. No cramped 11px grids, no Windows XP iconography, no gray-on-gray.", + "Don't over-design for aesthetics. No excessive white space that wastes screen real estate.", + "Don't use border-left greater than 1px as a colored accent stripe. Use background tints or icons instead.", + "Don't use gradient text (background-clip: text). Solid colors only.", + "Don't default to glassmorphism or blur effects. They're slow and distracting.", + "Don't animate CSS layout properties. Transitions on color/opacity/transform only.", + "Don't use bounce or elastic easing. Ease-out-quart or similar exponential curves.", + "Don't add loading spinners when data can be prefetched or shown progressively.", + "Don't require confirmation dialogs for reversible actions." + ] + } +} diff --git a/DESIGN.md b/DESIGN.md new file mode 100644 index 0000000000..e98cb83710 --- /dev/null +++ b/DESIGN.md @@ -0,0 +1,254 @@ +--- +name: Manage365 +description: Multi-tenant M365 administration for MSPs who value speed over ceremony +colors: + dashboard-blue: "#53A5DB" + dashboard-blue-deep: "#2D4A5E" + dashboard-blue-light: "#7FC4E8" + navy-primary: "#003049" + orange-accent: "#F77F00" + indigo-accent: "#635dff" + purple-accent: "#9E77ED" + success: "#6BBDC4" + info: "#5BBEDB" + warning: "#8FD19E" + error: "#E09090" + neutral-50: "#FAFAFA" + neutral-100: "#F5F5F5" + neutral-200: "#EEEEEE" + neutral-300: "#E0E0E0" + neutral-400: "#BDBDBD" + neutral-500: "#9E9E9E" + neutral-600: "#757575" + neutral-700: "#616161" + neutral-800: "#424242" + neutral-900: "#212121" + surface-dark: "#181818" + surface-dark-elevated: "#1E1E1E" +typography: + display: + fontFamily: "Inter, sans-serif" + fontSize: "48px" + fontWeight: 600 + lineHeight: 1.5 + headline: + fontFamily: "Inter, sans-serif" + fontSize: "32px" + fontWeight: 600 + lineHeight: 1.5 + title: + fontFamily: "Inter, sans-serif" + fontSize: "24px" + fontWeight: 600 + lineHeight: 1.5 + body: + fontFamily: "Inter, sans-serif" + fontSize: "14px" + fontWeight: 400 + lineHeight: 1.6 + label: + fontFamily: "Inter, sans-serif" + fontSize: "12px" + fontWeight: 500 + lineHeight: 1.75 +rounded: + sm: "4px" + md: "6px" + lg: "8px" + pill: "48px" +spacing: + xs: "4px" + sm: "8px" + md: "16px" + lg: "24px" + xl: "32px" +components: + button-primary: + backgroundColor: "{colors.dashboard-blue}" + textColor: "#FFFFFF" + rounded: "{rounded.md}" + padding: "8px 16px" + button-primary-hover: + backgroundColor: "{colors.dashboard-blue-deep}" + textColor: "#FFFFFF" + input-filled: + backgroundColor: "transparent" + textColor: "{colors.neutral-900}" + rounded: "{rounded.md}" + padding: "0 12px" + chip-default: + backgroundColor: "{colors.neutral-200}" + textColor: "{colors.neutral-800}" + rounded: "{rounded.md}" +--- + +# Design System: Manage365 + +## 1. Overview + +**Creative North Star: "The Control Room"** + +Manage365 is a control room for MSP technicians managing dozens of Microsoft 365 tenants. Every element exists to surface information and enable action. There is no marketing, no onboarding friction, no decorative flourish. The interface assumes expertise and rewards it with density and speed. + +The design philosophy is utilitarian without being ugly. Information is compressed but readable. Actions are discoverable but not intrusive. The system trusts users to know what they're doing and gets out of their way. + +This is not a consumer app. It's not trying to delight first-time visitors or explain itself. It's a daily driver for professionals who will spend hundreds of hours in it. Efficiency compounds. Every pixel counts. + +**Key Characteristics:** + +- **Information-dense** — Tables, cards, and dashboards pack data tight. White space is for structure, not aesthetics. +- **Action-oriented** — Primary actions are visible and reachable. Bulk operations are first-class citizens. +- **Context-preserving** — Tenant switching, navigation, and workflows never lose your place. +- **Quiet confidence** — The interface doesn't shout. Status colors are muted. Shadows are structural, not decorative. + +## 2. Colors + +A restrained palette built around Dashboard Blue with semantic colors for status. The primary accent appears sparingly — mostly on interactive elements and active states. + +### Primary + +- **Dashboard Blue** (#53A5DB / oklch(70% 0.11 230)): Primary actions, links, active nav items, and focus rings. The familiar blue of system interfaces — draws attention without shouting. +- **Dashboard Blue Deep** (#2D4A5E): Hover states for primary buttons. Adds weight when pressed. +- **Dashboard Blue Light** (#7FC4E8): Chip backgrounds, subtle highlights, secondary accents. + +### Secondary (configurable presets) + +- **Navy Primary** (#003049): Alternative preset. Darker, more serious. +- **Orange Accent** (#F77F00): Alternative preset. High energy, action-forward. +- **Indigo Accent** (#635dff): Alternative preset. Modern, slightly playful. +- **Purple Accent** (#9E77ED): Alternative preset. Softer, creative. + +### Semantic + +- **Success** (#6BBDC4): Teal-cyan. Completed actions, healthy status, pass states. +- **Info** (#5BBEDB): Cyan. Informational badges, hints, neutral status. +- **Warning** (#8FD19E): Mint-green. Unusual for warning — intentionally soft to avoid alarm fatigue. +- **Error** (#E09090): Muted rose. Failures, blocked actions, critical status. Soft enough for frequent display. + +### Neutral + +- **Neutral 50–100** (#FAFAFA, #F5F5F5): Light mode backgrounds. Paper surfaces. +- **Neutral 200–400** (#EEEEEE, #E0E0E0, #BDBDBD): Borders, dividers, disabled states. +- **Neutral 500–600** (#9E9E9E, #757575): Secondary text, icons. +- **Neutral 700–900** (#616161, #424242, #212121): Primary text, headings, emphasis. +- **Surface Dark** (#181818): Dark mode default background. +- **Surface Dark Elevated** (#1E1E1E): Dark mode paper/card surfaces. + +### Named Rules + +**The Dashboard Blue Rule.** The primary accent is used on interactive elements: buttons, links, active states, focus rings. It does not appear on static informational content. If something is blue, it should be clickable or indicate selection. + +**The Soft Semantic Rule.** Status colors are intentionally muted. Errors and warnings appear frequently in admin tools; screaming red and orange cause alarm fatigue. Our semantic colors are visible but calm. + +## 3. Typography + +**Display Font:** Inter (with system sans-serif fallback) +**Body Font:** Inter (with system sans-serif fallback) + +**Character:** Inter is the workhorse of modern UI. It's neutral, highly legible at small sizes, and renders crisply on screens. No personality, by design — the content is the personality. + +### Hierarchy + +- **Display** (600, 48px, 1.5): Page titles, dashboard heroes. Rare. +- **Headline** (600, 32px, 1.5): Section headers, modal titles. +- **Title** (600, 24px, 1.5): Card headers, panel titles. +- **Subtitle** (500, 16px, 1.75): Sub-section labels, emphasized body text. +- **Body** (400, 14px, 1.6): Primary content, table cells, descriptions. Max line length 75ch. +- **Label** (500, 12px, 1.75): Form labels, chip text, metadata. +- **Caption** (400, 11px, 1.6): Timestamps, fine print, tertiary information. + +### Named Rules + +**The 14px Body Rule.** Body text is 14px, not 16px. Admin interfaces benefit from density. Users are close to their screens and focused. + +**The 600 Heading Rule.** All headings use weight 600 (semibold), never bold (700). This creates clear hierarchy without shouting. + +## 4. Elevation + +Structural shadows that clearly define what's floating versus grounded. Modals, dropdowns, and popovers cast visible shadows. Cards on flat surfaces use minimal or no shadow. + +### Shadow Vocabulary + +- **Level 1** (`0px 1px 2px rgba(0, 0, 0, 0.24)`): Subtle lift. Buttons at rest, chips. +- **Level 4** (`0px 1px 5px rgba(0, 0, 0, 0.24)`): Cards on surfaces. Gentle separation. +- **Level 8** (`0px 4px 6px rgba(0, 0, 0, 0.24)`): Dropdown menus, tooltips. Clear float. +- **Level 16** (`0px 10px 15px rgba(0, 0, 0, 0.24)`): Modals, dialogs. Prominent overlay. +- **Level 24** (`0px 25px 50px rgba(0, 0, 0, 0.24)`): Large modals, full-screen overlays. + +### Named Rules + +**The Structural Shadow Rule.** Shadows communicate z-index, not decoration. If it floats, it has a shadow. If it's inline, it doesn't. Background tint handles surface layering. + +**The Dark Mode Overlay Rule.** In dark mode, shadows are less visible. Elevated surfaces use lighter backgrounds (#1E1E1E vs #181818) instead of relying solely on shadow. + +## 5. Components + +### Buttons + +- **Shape:** Gently rounded corners (6px radius). Not pill-shaped, not sharp. +- **Primary:** Dashboard Blue background, white text, 8px 16px padding. +- **Hover / Focus:** Background darkens to Dashboard Blue Deep. Focus ring: 2px Dashboard Blue at 25% opacity. +- **Secondary / Ghost:** Transparent background, Dashboard Blue text, subtle border on hover. +- **Ripple:** Disabled. Interaction feedback via color change, not animation. + +### Chips + +- **Style:** 6px radius, neutral background (light: #EEEEEE, dark: surface elevated), neutral text. +- **State:** Selected chips use Dashboard Blue Light background. +- **Delete icon:** Heroicons XCircle outline. + +### Cards / Containers + +- **Corner Style:** 6px radius (consistent with other components). +- **Background:** Paper color (white in light mode, #1E1E1E in dark mode). +- **Shadow Strategy:** Level 4 for cards floating on backgrounds. No shadow for inline containers. +- **Border:** None by default. Optional 1px neutral-300 border for subtle definition. +- **Internal Padding:** 24px horizontal, 20px vertical for content. 16px for headers/actions. + +### Inputs / Fields + +- **Style:** Filled variant with 1px border. 6px radius. Background transparent. +- **Height:** 40px for single-line inputs. Flexible for multiline. +- **Focus:** Border shifts to primary color. Glow: `0px 0px 0px 2px rgba(25, 118, 210, 0.25)`. +- **Error:** Border shifts to error color. No background tint. +- **Disabled:** Reduced opacity (38% text), no interaction. + +### Navigation + +- **Side nav:** Collapsible, pinnable. 14px item text, 8px icon spacing. +- **Active state:** Dashboard Blue text and icon, subtle alpha background. +- **Hover:** Background alpha (8% in light mode, 8% white in dark mode). +- **Top nav:** Tenant selector prominent, account menu right-aligned. + +### Data Tables + +- **Header:** 11px uppercase, 600 weight. Sticky on scroll. +- **Rows:** Alternate background optional. Last row has no bottom border. +- **Cell padding:** Compact. Text truncates with ellipsis. +- **Actions:** Inline action menus, bulk action toolbar on selection. + +## 6. Do's and Don'ts + +### Do: + +- **Do** use Dashboard Blue only for interactive elements. If it's blue, it should do something. +- **Do** keep body text at 14px. Density is a feature, not a bug. +- **Do** use structural shadows to communicate elevation. Modals float; inline content doesn't. +- **Do** respect the neutral scale for non-interactive surfaces. Reserve color for status and actions. +- **Do** support both light and dark modes. Dark mode uses elevated surface tints, not just shadows. +- **Do** include visible focus indicators. Keyboard navigation is critical for power users. +- **Do** truncate long content with ellipsis rather than breaking layouts. + +### Don't: + +- **Don't** mimic Azure Portal. No overwhelming nested menus, no slow page loads, no lost context. +- **Don't** add marketing fluff. No gradient hero sections, no stock photography, no "Get Started" hand-holding. +- **Don't** use 2010s enterprise patterns. No cramped 11px grids, no Windows XP iconography, no gray-on-gray. +- **Don't** over-design for aesthetics. No excessive white space that wastes screen real estate. +- **Don't** use border-left greater than 1px as a colored accent stripe. Use background tints or icons instead. +- **Don't** use gradient text (background-clip: text). Solid colors only. +- **Don't** default to glassmorphism or blur effects. They're slow and distracting. +- **Don't** animate CSS layout properties. Transitions on color/opacity/transform only. +- **Don't** use bounce or elastic easing. Ease-out-quart or similar exponential curves. +- **Don't** add loading spinners when data can be prefetched or shown progressively. +- **Don't** require confirmation dialogs for reversible actions. diff --git a/PRODUCT.md b/PRODUCT.md new file mode 100644 index 0000000000..3763cc2139 --- /dev/null +++ b/PRODUCT.md @@ -0,0 +1,44 @@ +# Product + +## Register + +product + +## Users + +MSP technicians managing multiple client Microsoft 365 tenants daily. They're juggling dozens of clients, context-switching constantly, and often working under time pressure. They know M365 deeply — they don't need training wheels, they need speed. + +## Product Purpose + +Manage365 is a multi-tenant M365 administration portal that lets MSPs manage users, teams, SharePoint, Exchange, security, Intune, and more across all their clients from a single interface. Success looks like: a technician who used to spend 20 minutes clicking through three Microsoft portals now completes the same task in 2 minutes without leaving Manage365. + +## Brand Personality + +Fast, focused, technical. + +The UI should feel like a power tool — responsive, information-dense, keyboard-friendly. No marketing language, no friendly mascots, no "getting started" hand-holding. Assume expertise. + +## Anti-references + +- **Azure Portal** — Overwhelming navigation, deeply nested menus, slow page loads, context constantly lost +- **Generic SaaS** — Gradient hero sections, stock photography, marketing copy masquerading as UI, feature announcements nobody asked for +- **Old-school admin tools** — Cramped data grids, 11px fonts, Windows XP-era iconography, forms that feel like tax software +- **Over-designed apps** — Excessive white space, animations that slow you down, style over substance, pretty but inefficient + +Reference: Raycast — snappy, dark, power-user focused. Every pixel serves a purpose. + +## Design Principles + +1. **Speed over ceremony** — Every interaction should feel instant. Prefetch data, avoid confirmation dialogs for reversible actions, never make users wait for something that can happen in the background. + +2. **Density with clarity** — Pack information tight without cramping. Data tables should be scannable, not endlessly scrollable. Show what matters at a glance; let details expand on demand. + +3. **Expert confidence** — Assume the user knows M365. Provide keyboard shortcuts, bulk actions, and direct paths. Skip the wizards when a single well-designed form will do. + +4. **Multi-tenant fluent** — Every screen acknowledges the user is managing many clients. Tenant switching must be instant. Never lose context when moving between clients. + +5. **Opinionated defaults** — Make the right choice easy. Pre-fill sensible values, surface recommended actions, reduce decisions that don't matter. + +## Accessibility & Inclusion + +Standard best practices: sufficient color contrast, keyboard navigation, screen reader compatibility, and focus indicators. Don't rely on color alone to convey status — pair with icons or text. Support prefers-reduced-motion for users who need it. diff --git a/README.md b/README.md index 66463bd2bb..e0d646a89b 100644 --- a/README.md +++ b/README.md @@ -1,27 +1,752 @@ -![CyberDrain Light](github_assets/img/CIPP.png#gh-dark-mode-only) -![CyberDrain Dark](github_assets/img/CIPP-Light.png#gh-light-mode-only) +

+ Manage365 Logo +

-# What is CIPP? +

Manage365 v2

-The CyberDrain Improved Partner Portal (CIPP) is a multi-tenant management portal for Microsoft Partners. The current Microsoft partner landscape makes it fairly hard to manage multi-tenant situations, with loads of manual work. Microsoft Lighthouse might resolve this in the future, but its development is lagging far behind the needs of the current market for Microsoft Partners. +

+ An enhanced Microsoft 365 multi-tenant management portal based on the CIPP open-source project. +

-CIPP helps you with day-to-day administration across all of your Microsoft 365 tenants from a single pane of glass, including: +

+ v2 (release 6.1.10)  ·  CIPP baseline 11.0.2  ·  successor to Manage365 v1 (v5.33.0) +

-- **Tenant administration** — manage users, groups, mailboxes, devices, and licenses across every tenant you service, without switching portals or juggling GDAP relationships by hand. -- **Standards & best practices** — define your preferred security and configuration standards once, then deploy and continuously enforce them across all tenants. -- **Security & compliance visibility** — review alerts, incidents, and tenant health from one place, and act on them quickly. -- **Automation** — scheduled tasks, alerting, and integrations that remove repetitive work and save several hours per engineer per month. +--- -For detailed documentation about the features of CIPP, please check out our [documentation](https://docs.cipp.app). +> **Manage365 v2** is the monorepo successor to the two-repo v1 forks (`Celeratec/CIPP` + `Celeratec/CIPP-API`). Those forks are end of life. Frontend and backend live in this repository and deploy as a **single Linux container** on the [Craft](https://github.com/CyberDrain/Craft) runtime. Current release is **6.1.10** on CIPP baseline **11.0.2**. The first v2 release was **6.0.0** on CIPP baseline **10.8.5**. Production cutover has been run. Migration notes: [docs/upstream-sync/MONOREPO_MIGRATION_20260815.md](docs/upstream-sync/MONOREPO_MIGRATION_20260815.md). Cutover: [docs/upstream-sync/CUTOVER_RUNBOOK_20260815.md](docs/upstream-sync/CUTOVER_RUNBOOK_20260815.md). +> +> Manage365 is built on top of the [CyberDrain Improved Partner Portal (CIPP)](https://cipp.app). CIPP is actively developed and may implement similar features over time. Upstream changes are merged selectively to preserve Manage365-specific UI and workflows. See [Upstream Integration](#upstream-integration) below. -# How it works +## What is Manage365? -This repository is the monorepo for CIPP, combining the frontend and backend into a single containerized deployment powered by the [Craft](https://github.com/CyberDrain/Craft) runtime: +Manage365 is a Microsoft 365 multi-tenant administration portal designed for Microsoft Partners and IT administrators. It provides a centralized interface for managing users, teams, SharePoint, Exchange, security, compliance, Intune, Dynamics 365, and more across all of your Microsoft 365 tenants. -- **`frontend/`** — the web interface, built with [Next.js](https://nextjs.org/) and React. -- **`backend/`** — the API layer, written in PowerShell and executed by the Craft runtime. -- **`build/`** — Dockerfiles, docker-compose definitions, and tooling used to build and run the containerized deployment. +**v2** inherits the full CIPP feature set and every Manage365 customization from v1, and adds native container hosting: EasyAuth with in-app CIPP Users / SSO, container management, and Craft-bridged orchestration — capabilities that were deferred on v1 because they were incompatible with Azure Static Web Apps + Function App slots. -# Our sponsors +Manage365 extends CIPP with deeper Teams, SharePoint, OneDrive, and Dynamics 365 management, centralized cross-tenant access governance, external collaboration controls, and tenant-level SharePoint and Teams policy management -- areas where day-to-day administration often requires switching between multiple Microsoft portals. -You can find our sponsors [here.](https://docs.cipp.app/#our-sponsors) +For information about the upstream CIPP project, visit [cipp.app](https://cipp.app) and [docs.cipp.app](https://docs.cipp.app). + +## What's new in v2 + +| v1 (5.33.0) | v2 (6.0.0) | +|-------------|------------| +| Two repos (`CIPP` frontend + `CIPP-API` backend) | One monorepo (`frontend/` + `backend/`) | +| Azure Static Web App + Function App slots | Single Linux container (Azure App Service) on Craft | +| SWA role management | EasyAuth + in-app `allowedUsers` / CIPP Users / SSO | +| Processor-slot queues (`Start-CIPPProcessorQueue`) | Craft bridges (`Start-CIPPOrchestrator`, `Add-CippQueueMessage`) | +| Container / worker-health UI deferred | Native Super Admin container management | +| Local: SWA CLI + Azurite + multiple function hosts | `build/docker-compose-all.yml` (Azurite + Craft on :5196) | + +Production cutover reuses the existing storage account and Key Vault — there is no data export/import. See the [cutover runbook](docs/upstream-sync/CUTOVER_RUNBOOK_20260815.md). + +## Release 6.1.10 (October 2026) + +Duplicate menu entries left by the upstream merge are gone, including the second Intune section. The SharePoint sites page loads again. The help menu keeps License and Clear Cache and Reload. Standards alignment shows only the tenants the signed-in role is allowed to see. CIPP baseline stays **11.0.2**. + +## Release 6.1.9 (October 2026) + +Re-enabling ActiveSync, and the other mailbox protocol switches, now reaches Exchange. Those actions send a protocol name, and the API accepts that as well as the direct setting names. CIPP baseline stays **11.0.2**. + +## Release 6.1.8 (October 2026) + +The user Exchange page no longer crashes. Its section icons go through the shared icon registry. CIPP baseline stays **11.0.2**. + +## Release 6.1.7 (October 2026) + +Manage365 Users, Container Management, Custom Domains, Container Logs, and Worker Health stay available on a CIPP-NG container even when the stored super-admin flag is off. The API integration card uses the light and dark wordmarks. CIPP baseline stays **11.0.2**. + +## Release 6.1.6 (October 2026) + +Enabling MCP waits for the new CIPP-MCP app registration to finish replicating in Entra, and ignores a required permission that points at an app which no longer exists. CIPP baseline stays **11.0.2**. + +## Release 6.1.5 (October 2026) + +Two integration pages no longer crash. Sync jobs accept a non-list response, and the API client page imports its tooltip. Includes the 6.1.4 header badge. CIPP baseline stays **11.0.2**. + +## Release 6.1.4 (October 2026) + +Header badge only. The V2 mark is smaller, magenta, and no longer underlined. The logo still links home. CIPP baseline stays **11.0.2**. + +## Release 6.1.3 (October 2026) + +This is the first production release after the v1 forks. It keeps the 11.0.2 baseline and adds the upstream work that landed after that tag, plus the Manage365 fixes that did not survive the monorepo move. + +**Since the two-repo v1 (5.33.0 on CIPP 10.8.5)** + +- One repository and one Linux container replace the Static Web App and Function Apps. Storage, tables, blobs, queues, and Key Vault stayed. +- One Manage365 menu. The sponsor panel is gone. The sign-in screen says Manage365. +- Card and table toggle is back on list pages. +- EasyAuth, in-app users, SSO, and container management are native. + +**In 6.1.3** + +- Light and dark wordmarks, no oval plate. The top bar follows light and dark mode. An orange V2 badge marks the monorepo generation. +- MCP is on unless someone has turned the flag off. Create an API client with MCP Access Allowed, save it to Azure, and connect to `{ApiUrl}/api/ExecMcp?client={AppId}`. The Entra app name stays CIPP-MCP. +- Baselines replace classic Standards and Drift when the flag is on. They never run side by side. A fresh install with no classic Standards turns the flag on. An install that already has Standards keeps the flag off until it is enabled, then uses **Migrate from Standards** as report-only. +- New baseline standards: EISCDA pack, CIS foundation, Global Secure Access, Teams files, external meeting bots, mailbox default audit, Azure MFA push apps, shared mailbox creation, and group reviewer. The SAM app keeps Dynamics, BAP, and Power Platform and gains the two Global Secure Access roles. +- JIT admin approval in a tabbed layout. Open service-health issues on the dashboard. GCC message-trace fallback. Shared-mailbox license warning. Custom OneDrive shortcut names. Optional login hint on portal links. License-price import and export, including decimal prices. SharePoint version policy on existing libraries, and editing locked or classic sites. Vacation defaults that add users to groups for the vacation period. A 30-day BEC lookback for tenants with Entra ID P1 or P2. Failed API calls return a real status code, and a bulk action continues past a failed row. NinjaOne is an MSP vendor app. +- Left out of this intake: Hudu, Halo, CIPPPwPush, the baselines module split, the performance and worker rewrite, Craft live queue, Premium hosting, and frontend dependency bumps. +- Kept as Manage365 behavior: quarantine release, the guest mailbox permission retry, and license privilege messages. + +--- + +## Features from CIPP (Upstream) + +Manage365 includes the complete CIPP feature set: + +### Identity Management +- User administration (create, edit, delete, offboard with orchestrator-based batch processing and scheduler-routed task tracking) +- Schedulable user edits — apply an edit now or schedule it for a future date via the task scheduler +- Policy-aware Temporary Access Pass creation (lifetime/usage options validated against the tenant's TAP policy) +- User form validation with field-level constraints (max length, required, pattern) +- User patching with manager and sponsor property support +- Vacation mode wizard with mailbox permissions, calendar delegation, and out-of-office scheduling with timezone-aware response formatting +- Offboarding wizard with dialog mode, table view for all tenant offboarding tasks, scheduler integration for proper task tracking and alerting, and custom tests +- Bulk guest invitation +- Risky users monitoring +- Group management with templates, group detail page, and deploy group template button +- Device management (Entra ID devices with NinjaOne enrichment, cross-linked to Intune) +- Per-user device view on the View User page (Entra device cards and Intune managed devices in one place) +- Role management and JIT Admin with usage location support and TAP lifetime policy bounds +- Reports: MFA (with role-targeted CA policy detection), inactive users, sign-in logs, Entra Connect, risk detections, BEC remediation +- BEC remediation checks include inbox-rule change auditing, sent-message review, and trusted/blocked sender changes (Manage365 implements the backend data collection for the sender check) +- Copilot & AI management pages + +### Tenant Administration +- Multi-tenant management and configuration +- Upgraded tenant onboarding experience with type selection and Indirect Reseller Link support +- Alert configuration and audit logs (group membership change, Defender severity filtering, inactive users, TAP creation alerts) +- Alert snooze dialog and snoozed alerts management +- Dashboard Alerts card — active and snoozed alert instances at a glance with per-item snooze +- Secure Score monitoring (including AllTenants report via `ListSecureScoreReport`) +- Application management, consent requests, and app management policies +- App registration and enterprise app detail pages with permissions viewer +- GDAP relationship management with GDAP trace and AI Administrator role support +- Tenant group management with usage reporting +- Standards alignment and drift detection (including device registration local admin controls, CIS7 alignment, and CA template package tags) +- **Baselines** (preview) — desired-state engine that replaces classic Standards and Drift when enabled. Off while classic Standards templates exist (see [Baselines](#baselines-manage365-v2) below) +- Standards with custom variable support, requiredCapabilities filtering, and license capability presets +- Group-based licensing for security groups and templates +- Alert-only license exclusions (exclude licenses from alerting without removing them from standards checks) +- New standards: Restrict User Device Registration, AdminSSPR +- Standards dialog with enabled/disabled status filter and severity color mapping +- Best Practice Analyser and Domains Analyser (with DKIM selector rotation) +- Conditional Access policy management, templates, and vacation mode with authentication flow selection +- Licence reporting and management with granular control and dynamic license backfill +- CSP license reporting page for Cloud Solution Provider scenarios +- BitLocker recovery key search and caching +- Feature flags +- Reusable settings standards with templates +- Configuration backup with restore wizard (type-filtered restoration with row count reporting) +- GitHub import/export for templates and cache explorer +- Incident report and attachment options +- Log retention settings +- Dashboard v2: report toolbar, custom dashboards, responsive layout, and inline universal search (legacy Dashboard v1 removed; `/dashboardv1` redirects to v2) +- Report builder with templates and generated reports +- Executive report with menuItem variant support + +### Security & Compliance +- Incident and alert management (including MDO alerts) +- Defender status, deployment, and TVM vulnerabilities +- Defender alerts with severity filtering +- Device compliance reporting +- Customer Lockbox +- eDiscovery case management with legal holds, content searches, and exports (see Manage365 features below) + +### Endpoint Management +- Application management and deployment queue (including Win32/custom apps) +- Application assignment filter options +- Managed device administration with NinjaOne hardware enrichment (CPU, RAM, agent status) +- **BitLocker Key Search** — dedicated Device Management page for key lookup +- **MAA Requests** — Multi Admin Approval request visibility with handoff to Intune (approve/reject stay in-tenant) +- Device detail page with Intune policy setting descriptions (hover to see what each setting does) for both Settings Catalog and Administrative Templates +- DEP sync +- Autopilot device management, profiles, and status pages +- Configuration and compliance policies with templates +- Intune reusable settings deployment and templates with assignment verification +- App protection policies and assignment filters +- Script management +- Reports: device score analytics, work from anywhere, autopilot deployments, discovered apps + +### Email & Exchange +- Mailbox administration (active, deleted, rules, permissions) +- Contact management with templates +- **Quarantine management** -- advanced Defender-style filtering, server-side pagination (default 7 days / 100 rows), bulk actions, CSV/JSON export, lazy detail metadata, and preserved EML preview, message trace, and Threat Explorer deep links (see [Quarantine Portal](#quarantine-portal-manage365-v5130) below) +- Restricted user management +- Tenant Allow/Block Lists +- Retention policies and tags +- Transport rules and connectors with templates +- Safe Links policies and templates +- Spam filter and connection filter management +- SendFromAlias standard (enable/disable) +- Resource management (rooms, equipment, room lists) +- Message trace, mailbox restores, message viewer +- Reports: mailbox statistics, activity, CAS settings, permissions, calendar permissions, mailbox forwarding, anti-phishing, malware filters, safe attachments, GAL +- Queue tracking for report generation + +### Tools +- Graph Explorer with simple filter UI +- Universal Search v2 in the top navigation (Pages default on magnifier; Cmd+K for pages, Cmd+Shift+F for users) plus dashboard inline search +- Application approval workflow +- Tenant and IP lookup +- Domain health checks with AutoDiscover validation +- Dark web breach lookups (tenant and individual) +- Template library and community repositories +- Task scheduler with label-based action filtering +- Custom tests with result mode options (Auto, AlwaysPass, AlwaysInfo, AlwaysInvestigate) +- Guest account disable support with sign-in audit fallback +- Script editor improvements +- Super admin pages at `/cipp/advanced/super-admin/` plus native Authentication (CIPP Users / SSO) and Container Management + +### Settings & Administration +- Application settings and integrations (including PWPush with CloudFlare Tunnel and default passphrase support) +- SIEM settings with SAS token generation for log table access +- SAM service principal lock configuration +- Setup wizard and onboarding +- Enhanced bookmark management with sidebar, drag-and-drop reordering, lock, and sort options +- Compact navigation mode for denser sidebar layout +- Resizable table columns across all data tables, with upstream table virtualization and column-cache optimizations while preserving Manage365 mobile card views +- Tenant selector hotlinks support customerId (GUID) and initialDomainName in addition to defaultDomainName +- PWA support with Chrome install option for desktop app experience +- Logbook with severity color mapping +- Custom data / directory extensions +- Super admin tools (tenant mode, function offloading, time settings, CIPP roles, SAM app roles/permissions, **SSO**, **CIPP Users**, **container management**) +- API client management with MCP access on by default (see [MCP Server](#mcp-server-manage365-v2) below) + +--- + +## Features Unique to Manage365 + +The following capabilities have been developed specifically for Manage365 and are not available in upstream CIPP as of the date shown above. + +### Visual Card Views & Modern UI + +CIPP uses table-only views for listing data. Manage365 adds card view alternatives across every major list page -- Users, Groups, Teams, Mailboxes, Contacts, Devices, Applications, SharePoint Sites, OneDrive, and more. Cards surface key status badges, metadata, and up to 8 quick-action buttons directly on each item, so common tasks are one click away without opening a detail page. Standardized card widths, meaningful icons (OS-aware device icons, entity-type icons), and consistent badge design provide a polished, scannable interface. Card view loading is optimized to only show skeletons during initial data fetch; background refetches do not blank already-loaded cards. + +### Mobile-Responsive Design + +Comprehensive mobile responsiveness throughout the application: responsive data tables that adapt to screen size, mobile-friendly toolbars with compact controls, sticky wizard step buttons, a mobile tenant selector in the top navigation, and card views optimized for touch. The entire interface is usable on tablets and phones without horizontal scrolling. + +### Applied Standards Enhancements + +Manage365 extends upstream Applied Standards with license-aware compliance reporting: + +- **Missing-license visibility** -- standards blocked by licensing show warnings and dedicated filter chips (License available / License not available) +- **Corrected scoring** -- combined compliance score uses ratio-based math (compliant + license-blocked vs scored standards) instead of additive percentages that could exceed 100% +- **Drift integration** -- drift-template types and `createDriftManagementActions` for accepted deviations and customer-specific overrides +- **Fork API compatibility** -- frontend normalizes `{ Results }` template responses so standards load reliably across API versions + +### Enhanced Detail Pages + +Manage365 extends upstream's detail pages with significantly richer, purpose-built interfaces for key entities: + +- **SharePoint Sites** -- storage monitoring, member and administrator management (including non-group-connected sites), guest invitation with domain restriction diagnostics and one-click quick-fix, cross-linking to Teams, Create Team from Site, and direct file browser access +- **Teams** -- member/owner management, channel management (including private/shared channel members with per-channel file browsing), app management, interactive toggle-chip settings for member permissions, guest permissions, messaging, and fun settings, plus guest invitation with Teams-specific diagnostics and direct file browser access at both team and channel level +- **Groups** -- hero overview by group type, member/owner/contact management, editable properties, interactive toggle-chip settings, dynamic membership rule display, on-premises sync awareness, and add member to multiple groups at once from the groups list page (extends upstream's group page) +- **Mailboxes / User Exchange Tab** -- mailbox type identification, aliases, archive status, direct link to Exchange settings, clickable external mail restriction tiles (independently block/allow inbound or outbound external email with confirmation dialogs and consequence warnings), one-click spam block clearing when a mailbox has been flagged by Microsoft for suspected spam activity, and **interactive hold management** -- toggle Litigation Hold and Retention Hold on/off directly from the Exchange info card with confirmation dialogs, data loss warnings, and optional duration (days) for Litigation Hold; read-only holds (eDiscovery, In-Place, Compliance Tag, Purview Retention) display with Purview portal guidance +- **Contacts** -- editable properties form with on-premises sync awareness +- **Users (View User)** -- Entra device cards and Intune managed devices combined on one page (replaces the separate per-user devices tab) +- **Entra Devices** -- OS-aware hero, source presence chips (Entra, Intune, NinjaOne), NinjaOne hardware enrichment, quick actions (enable/disable, BitLocker, delete) +- **MEM Devices** -- compliance-colored hero, NinjaOne hardware enrichment, categorized quick actions (sync, reboot, rename, LAPS, BitLocker, retire, delete), NinjaOne data merged into device listings (extends upstream's device page) +- **Applications** -- assignment details, install experience, detection rules, and assignment quick actions + +### Teams Business Voice Management + +A comprehensive voice management section with dedicated pages for each component of the Teams telephony stack: + +- **Phone Numbers** -- card and table views with assignment status, assigned user displayed prominently, number type, emergency location, and quick actions to assign/unassign users and set emergency locations +- **Call Queues** -- view all call queues with routing method, agent counts, overflow and timeout settings; detailed off-canvas view with agent list, conference mode, and music/greeting configuration +- **Auto Attendants** -- view all auto attendants with voice response status, operator, language, and timezone; detailed off-canvas view with business hours and after-hours call flows, menu options, and holiday schedules +- **Dial Plans** -- view all tenant dial plans with normalization rule counts; detailed off-canvas view with full rule list showing match patterns and translations + +### File Management + +- **Tenant-wide file search** -- search across all SharePoint sites and OneDrive accounts in a tenant using Microsoft's KQL syntax. Filter by file name, type, author, date, path, and more. Results include a copy-link button for sharing direct file URLs with end users, a browse-to-location button to jump into the file browser, and an open-in-SharePoint link. Built-in search tips guide users through KQL operators and combined filters. +- **File browser** for any user's OneDrive or SharePoint site -- navigate folders, download, rename, move, copy, delete files, and create folders without leaving the portal. Includes a location switcher to jump between SharePoint sites or OneDrive users without returning to the landing page. Direct "Browse Files" links are available from Team detail pages, individual channel rows, and SharePoint site detail pages, opening the file browser pre-loaded to the correct site. +- **Cross-drive transfer wizard** -- move or copy files and folders between OneDrive accounts and SharePoint sites with a visual destination browser. Supports single-item and bulk transfers with per-item progress tracking (pending, in progress, done, skipped, failed) displayed in a live status table. +- **Conflict resolution** -- three options when items already exist at the destination: + - **Rename** (default) -- Graph API automatically appends a numeric suffix to avoid conflicts + - **Replace** -- deletes the existing item at the destination before copying, ensuring a clean overwrite for both files and folders + - **Skip duplicates** -- files that already exist at the destination are skipped; folders that already exist are intelligently merged rather than skipped entirely. A recursive comparison checks whether the destination folder's contents fully match the source. Fully matching folders are skipped instantly. Partially-copied folders are merged: only the missing files and subfolders are copied into place while already-existing items are left untouched. This enables resuming a previously interrupted transfer without re-copying everything. +- **Frontend pre-check optimization** -- when skip duplicates is selected, the destination contents are fetched once upfront and duplicate files are marked as skipped immediately in the UI without making individual backend calls, providing instant feedback before the transfer begins +- **Verified transfers** -- cross-drive copy and move operations poll the Graph API monitor URL for completion, then verify the destination item exists and matches the source in size before reporting success. For moves, the source is only deleted after verified copy completion to prevent data loss +- **Folder compare** -- side-by-side recursive comparison of any two folder locations (OneDrive or SharePoint). A two-panel dialog lets users pick a source and destination, then runs a depth-limited diff that returns every difference: items only in the source, items only in the destination, and files with differing sizes. Results are displayed in a flat table with status chips, size columns, and checkbox selection. Users can select any subset of differing items and copy them to the other location in bulk, with per-item progress tracking. Matching file counts are shown in summary chips so users can quickly gauge how much the two locations overlap +- **Temp file cleanup wizard** -- a guided 5-step wizard to find and remove temporary and junk files from SharePoint sites and OneDrive accounts: + - **Flexible scope** -- scan a single SharePoint site, a specific user's OneDrive, all SharePoint sites, or all OneDrives in a tenant + - **Configurable filters** -- select which file types to target: Office temp files (~$*), .TMP/.temp files, zero-byte files, system junk (Thumbs.db, .DS_Store, desktop.ini), and backup files (.bak, .old) + - **Recursive scanning** -- searches all folders up to 10 levels deep with progress feedback + - **File selection** -- review scan results in a searchable table with per-file checkboxes, bulk select/deselect, and type-based filtering + - **Double verification** -- checkbox confirmation plus button click required before any deletion + - **Safe deletion** -- files are moved to the SharePoint/OneDrive recycle bin (93-day recovery) rather than permanently deleted + - **Detailed results** -- per-file success/failure status with actionable error messages + +### SharePoint Admin Dashboard + +A dedicated SharePoint dashboard under Teams & SharePoint > SharePoint > Dashboard providing at-a-glance visibility into tenant storage health and site administration: + +- **Key Metrics** -- tenant storage used/total, total sites, total files, and inactive site count +- **Storage Charts** -- tenant quota donut (used vs free), storage breakdown by site type (Communication, Group-Connected, Classic), and top 10 sites by storage consumption as a bar chart +- **Storage Alerts** -- sites approaching storage limits (>75% and >90%) sorted by severity with colored chips +- **Inactive Sites** -- sites with no activity in 90+ days, sorted by storage used to help identify cleanup candidates +- **Sharing Configuration** -- tenant-level external sharing settings, default link type, resharing policy, and link expiration at a glance +- **Recently Created Sites** -- new sites from the last 30 days + +Data is cached in the CIPP reporting database and refreshed daily during the scheduled cache cycle. A manual "Refresh Data" button triggers an on-demand cache update. The dashboard gracefully handles the first visit before any data is cached with a clear empty state and refresh prompt. + +### SharePoint Recycle Bin + +Manage and recover deleted SharePoint sites with retention tracking, visual expiration warnings, one-click restore, and permanent delete with appropriate safety warnings. + +### Cross-Tenant Access & External Collaboration Governance + +Centralized management of Microsoft Entra cross-tenant access policies, B2B collaboration settings, and external identity controls -- settings that are otherwise only manageable in the Entra portal and difficult to standardize across clients: + +- **Overview Dashboard** with health scoring and policy summary +- **Default Policy Editor** for B2B Collaboration, Direct Connect, Inbound Trust, Tenant Restrictions v2, and Automatic User Consent +- **Partner Organizations** management with per-partner overrides and reverse tenant name lookup +- **External Collaboration Settings** for guest invite restrictions, guest access levels, and domain allow/deny lists +- **Configuration Health & Conflict Detection** -- automated analysis across all cross-tenant settings layers with specific recommendations and direct links to fix issues +- **Security Baseline Templates** -- create, apply, and reuse cross-tenant security configurations across tenants +- **Standards Integration** -- 9 new standards (12 total covering the full cross-tenant surface) enabling drift detection, automated remediation, and alerting through the existing CIPP Standards framework + +### Tenant-Level Policy Management + +Dedicated settings pages for policies that normally require switching between multiple Microsoft admin portals: + +- **SharePoint Sharing Settings** -- external sharing level, domain restrictions, default link type, anonymous link controls, and resharing behavior +- **Teams Tenant Settings** -- federation and external access, guest access, cloud storage providers, meeting policy, messaging policy, and meeting background management, organized in a tabbed interface with per-section save. The meeting backgrounds tab lets administrators enable organization-wide custom backgrounds, view currently configured images, assign branding policies to individual users, and links directly to the Teams Admin Center for image upload (Microsoft does not expose a public API for background image upload). Includes image requirement guidance with dimension warnings. + +### Cross-Service Context Clues + +External access in Microsoft 365 is controlled by multiple independent settings layers (Cross-Tenant Access, Entra External Collaboration, SharePoint Sharing, Teams Federation) -- any one of which can block access. Manage365 adds contextual banners and cross-links throughout these settings pages so administrators can quickly identify which layer is causing an issue and navigate directly to it. + +### Risk Coaching & Settings Safety + +An inline risk coaching system that alerts administrators to potentially dangerous settings as they make changes. Over 30 risk rules across External Collaboration, Cross-Tenant Policy, SharePoint Sharing, Teams Settings, Offboarding Wizard, Transport Rules, and Alert Configuration highlight dangerous options, recommend safer alternatives, and require explicit confirmation before saving high-risk configurations. B2B direct connect settings include dedicated risk coaching that explains the security model -- direct connect users have no directory footprint and are not subject to Conditional Access unless inbound trust is configured -- and recommends partner-specific policies over opening the default. + +### Access Type Coaching: Guest Access vs External Access + +Microsoft 365 has two fundamentally different ways to collaborate with external users -- Guest Access (B2B Collaboration) and External Access (B2B Direct Connect) -- controlled by different settings layers with different capabilities and security implications. Manage365 adds consistent, context-aware coaching throughout the application so administrators understand which access type applies to what they're doing: + +- **Inline chips** with educational tooltips replace generic "Guest" labels on member lists across Teams, SharePoint, and user management pages +- **Contextual banners** in all guest invitation and channel member dialogs explain which access type is being used, what it means, and which email types are supported (organizational vs personal) +- **Expandable info panels** on Teams channel detail, Cross-Tenant Access, and SharePoint pages provide a side-by-side comparison of both access types with characteristics, limitations, and links to the relevant settings pages +- **Standards helpText** for guest-related standards (Guest Invite, Teams Guest Access, External MFA Trust, SP Azure B2B) now clarifies which access type each standard controls +- **Backend messages** tag every success and error result with the access type label (e.g., "Guest Access — B2B Collaboration" or "External Access — B2B Direct Connect") so results are unambiguous +- **Actionable error guidance** when a personal email is entered for a shared channel explains why it's not supported and directs the user to use a private channel instead + +All coaching content is driven by a single shared data layer (`accessTypes.js`) so terminology stays consistent across the entire application and can be updated in one place. + +### Guest Invitation & Channel Member Diagnostics + +Invite external guests directly from SharePoint site and Teams detail pages. Add external members to shared channels via B2B direct connect, or add guests with any email address (including personal emails like Gmail and Outlook.com) to private channels via B2B collaboration with automatic Email One-Time Passcode support. If an operation fails, the system automatically diagnoses the root cause -- checking cross-tenant access policies (B2B direct connect inbound/outbound), B2B domain restrictions, Teams guest access settings, Entra external collaboration settings, and SharePoint permissions -- and provides categorized, structured guidance with direct links to the relevant CIPP settings page. Microsoft internal error codes (e.g., "xTap") are translated to human-readable descriptions. + +### Pre-flight Domain Validation & Email Intelligence + +Real-time validation of guest email addresses before invitation, powered by a reusable domain intelligence API (`ExecValidateExternalDomain`). As administrators type an email address in any guest invitation dialog, the system: + +- **Classifies the email domain** via OIDC discovery as consumer (Gmail, Yahoo, Outlook.com), organizational (another M365 tenant), or unresolvable +- **Checks for existing guest accounts** in the target tenant to avoid duplicate invitations +- **Evaluates tenant policies** across Entra External Collaboration, B2B domain allow/block lists, SharePoint sharing settings, Teams guest access, and Cross-Tenant Access policies +- **Returns a structured verdict** with pass/fail/warning status, recommended access type, and specific fix guidance for any blocking policies + +Consumer domain detection is also integrated into the guest invite drawer and the Add Channel Member dialog for shared channels, where personal emails are blocked with an explanation of why shared channels require work/school accounts and a suggestion to use a private channel instead. + +### Interactive Access Type Decision Tree + +An interactive question-and-answer flow added to the `CippAccessTypeGuide` component (`variant="decision"`) helps administrators choose between Guest Access (B2B Collaboration) and External Access (B2B Direct Connect). Context-specific trees for SharePoint, Teams standard/private/shared channels, and a general-purpose flow guide users to the correct access type based on the external user's email type and the target resource, with clear lists of what is and isn't supported and concrete next steps. + +### External Access Wizard + +A multi-step guided wizard (`/teams-share/external-access`) that unifies the entire external user onboarding flow: + +1. **Who** -- enter one or more guest email addresses with inline domain validation and real-time policy feedback +2. **Where** -- select the target resource (SharePoint site, Teams standard/private/shared channel) with context-aware access type recommendations; shared channel options are automatically hidden for personal email addresses +3. **Review** -- summary of guests, resource, access type, and any policy warnings before execution +4. **Execute** -- sends invitations with per-guest progress tracking and individual success/error results + +### Sharing & Guest Troubleshooter + +A comprehensive diagnostic tool (`/teams-share/troubleshooting/sharing-troubleshooter`) that performs a structured sequence of 10 checks to identify why an external user cannot access a shared resource: + +1. Domain type classification (consumer vs organizational via OIDC) +2. Guest account existence in the tenant +3. Guest account status (enabled, disabled, pending acceptance) +4. Entra External Collaboration invite restrictions +5. Entra B2B domain allow/block lists +6. Email One-Time Passcode authentication method status +7. SharePoint tenant sharing settings and domain restrictions +8. Teams guest access configuration +9. Cross-Tenant Access policies (for organizational domains and shared channels) +10. Site-level membership verification (when a resource URL is provided) + +Results are displayed in a visual timeline with color-coded pass/fail/warning status, detailed explanations, fix recommendations with links to the relevant settings page, and quick presets for common troubleshooting scenarios. The backend (`ExecSharingTroubleshoot`) returns a structured timeline that can be consumed by other components. + +### SharePoint Document Library Sharing Links + +A new backend endpoint (`ExecCreateSharingLink`) enables creation of sharing links for specific SharePoint drive items using the Microsoft Graph `createLink` API. Supports view, edit, and embed link types with anonymous, organization, or specific-people scopes, optional expiration dates, and password protection. + +### Guest Lifecycle Dashboard + +A dedicated guest user management page (`/identity/administration/guest-users`) providing visibility into all guest accounts across a tenant: + +- **Summary cards** showing total guests and counts by status: Active, Stale (no sign-in for 90+ days), Pending Acceptance, Disabled, and Never Signed In +- **Status classification** computed from sign-in activity data via the Graph beta API +- **Filterable table** with one-click status filter buttons to quickly isolate problematic guests +- **Row actions** including re-invite for pending or stale guests + +### Guest-Ready Bulk Configuration + +A "Quick Setup: Guest-Ready Configuration" card on the Cross-Tenant Access page that configures a tenant for external guest collaboration in one click. Applies secure defaults across three services: + +- **Entra:** Guest invite restrictions set to Admins and Guest Inviter role +- **SharePoint:** External sharing enabled for new and existing guests +- **Teams:** Guest access enabled + +Includes a confirmation dialog showing exactly what will be changed and per-step success/error reporting. + +### Enhanced Cross-Tenant Health Checks + +Four new health checks (12-15) added to the Cross-Tenant Health endpoint: + +- **Teams guest access** -- warns if guest access is disabled in Teams client configuration +- **Email OTP status** -- warns if Email One-Time Passcode authentication is not enabled, which blocks personal email guests +- **SharePoint/Entra sharing mismatch** -- detects when Entra allows guests but SharePoint sharing is disabled (or vice versa) +- **Domain restriction divergence** -- detects when Entra and SharePoint have mismatched allowed/blocked domain lists + +### eDiscovery Case Management + +End-to-end eDiscovery workflow for managing legal holds, content searches, and evidence exports directly from the portal -- eliminating the need to switch to the Microsoft Purview compliance portal or write PowerShell scripts for each client: + +- **Case management** -- create, close, reopen, and delete eDiscovery cases per tenant with status tracking, case metadata, and external ID support for correlating with legal matter numbers +- **Legal holds** -- place litigation holds on specific user mailboxes and SharePoint sites with optional KQL content queries to narrow the scope. Supports multiple content sources per hold and displays hold status with content source counts +- **Content searches** -- create KQL-based searches across Exchange, SharePoint, Teams, and OneDrive. Run search estimates to preview result counts and data volume before committing to an export. Status polling auto-refreshes while searches are running +- **Export and production** -- initiate exports from completed searches with configurable export criteria. Export operations track progress percentage and provide download links when complete. Auto-polling updates export status in real time +- **Async operation tracking** -- long-running operations (search estimates, exports) are handled asynchronously with automatic 5-second polling that stops when the operation completes or fails +- **Setup guidance** -- a proactive setup banner on the cases page explains the one-time per-tenant prerequisites (CPV refresh for permissions and eDiscovery Administrator role assignment in Purview), plus reactive error classification that detects 403/permission and license errors and renders structured remediation steps +- **Tier support** -- uses the Microsoft Graph eDiscovery Standard API (September 2025), which works for both E3 and E5 tenants. Phase 2 will add Premium-only features (custodian management, review sets, advanced export options) for E5 tenants + +Built on app-only authentication (`eDiscovery.Read.All` and `eDiscovery.ReadWrite.All`) via SAM, consistent with the rest of the CIPP architecture. Located under Security & Compliance > eDiscovery > Cases. + +### Dynamics 365 Management + +Read-only visibility into Power Platform / Dynamics 365 environments, users, security roles, business units, and solutions -- providing insight without needing the Power Platform Admin Center. + +### NinjaOne Device Enrichment + +When NinjaOne integration is configured, device views across the application are automatically enriched with hardware data (CPU, RAM, OS, agent status, last contact). Works across MEM Devices, Entra Devices, and per-user device views, with graceful degradation when NinjaOne is not available. Backend sync includes Entra-only fallback for non-Intune tenants, O(1) serial number indexing for device matching, and memory-optimized processing. + +### Enhanced Error Messages & Permission Guidance + +Structured error formatting throughout the application. The `FormattedResultText` renderer automatically detects and formats common error patterns: backend `Diagnostics:` sections are parsed into categorized items with `[Category]` chips and `CIPP Settings:` paths become clickable navigation buttons. SharePoint-specific error classification provides targeted diagnostics for token acquisition and access issues without misdirecting users to superadmin settings. + +### Mailbox External Mail Restrictions + +Control external email flow on a per-mailbox basis directly from the user's Exchange tab. Two independent toggles allow administrators to: + +- **Block external inbound** -- sets `RequireSenderAuthenticationEnabled` so only internal (authenticated) senders can email the mailbox; external senders receive an NDR +- **Block external outbound** -- flags the mailbox via `CustomAttribute15` and auto-creates a tenant-wide transport rule that rejects messages sent to external recipients from any flagged mailbox + +Each toggle includes a confirmation dialog with clear warnings about the consequences. Restrictions can be applied independently (inbound only, outbound only, or both) and reversed at any time. The current status is displayed as a visual tile on the Exchange info card alongside other mailbox settings. + +### Email Troubleshooter + +A unified email troubleshooting hub under Email & Exchange > Troubleshooting that combines message trace and quarantine management into a single search-diagnose-act workflow, eliminating the context-switching that previously required technicians to navigate between separate pages in different menus. + +- **Unified search** -- a single search form queries both Exchange message trace and quarantine simultaneously, returning results in a tabbed interface with badge counts showing trace results and unreleased quarantine messages +- **Quick-filter presets** -- one-click chips for common searches: "Quarantined (24h)", "Failed Delivery (48h)", "All Recent (7d)" pre-fill the search form and execute immediately +- **Advanced filtering** -- shared quarantine filter panel with Message ID, subject (partial or exact), sender/recipient, sender/recipient domain, quarantine reason, release status, policy type/name, and message-trace-only sending IP filters +- **Contextual actions on trace results** -- View Delivery Details, View in Security Explorer, Allow Sender, Block Sender, Copy Message ID, and Release from Quarantine (appears only for quarantined messages) without leaving the page +- **Contextual actions on quarantine results** -- View Message (EML preview), View Message Trace, Release, Deny, Delete, Submit to Microsoft, Release & Allow Sender, Release & Add Allow Entry, Allow/Block Sender or Domain, and Copy Message ID +- **Cross-tab linking** -- clicking a "Quarantined" status chip in the trace tab switches to the quarantine tab and filters to the matching message +- **Bulk quarantine operations** -- select multiple quarantine entries and release, deny, release-and-allow, delete, submit to Microsoft, or block unique senders in one aggregated action with tiered confirmation guardrails (10+ and 50+ messages) +- **Delivery timeline visualization** -- an MUI Timeline-based detail panel replaces the plain table, showing color-coded delivery events (green for delivered, red for failed, amber for quarantined) with timestamps, event names, actions, and detail text +- **Partial failure resilience** -- the combined backend endpoint handles permission failures gracefully: if quarantine access is missing but trace works (or vice versa), partial results are shown with a guidance banner explaining which data source failed and how to fix it +- **Guest UPN encoding** -- sender and recipient addresses containing `#EXT#` are automatically encoded for Exchange Online API compatibility + +The navigation is restructured with Troubleshooting as the first submenu under Email & Exchange, placing the most commonly used tools at the top. The standalone [Quarantine Management](#quarantine-portal-manage365-v5130) page remains available for all-tenant bulk monitoring and filtered export. Message Viewer and Mailbox Restores are relocated from Tools to Troubleshooting for better discoverability. + +### Quarantine Portal (Manage365 v5.13.0) + +Manage365 extends the upstream quarantine list with a Defender-style portal experience while preserving all existing quarantine, trace, EML preview, and allow/block workflows. Exchange Online PowerShell (`Get-QuarantineMessage`, `Release-QuarantineMessage`, etc.) is used throughout — not Microsoft Graph or Defender REST quarantine APIs. + +**Quarantine Management page** (`/email/administration/quarantine`): + +- **Server-side filters** mapped to supported `Get-QuarantineMessage` parameters: time range (default last 7 days), sender/recipient, exact subject, quarantine reason, release status, policy type/name, and message ID +- **Post-filters** for partial subject match and sender/recipient domain (applied after EXO returns results, with UI guidance when active) +- **Paginated grid** -- 100 rows per page with auto-pagination; `fetchAll=true` available for API consumers needing legacy full-dump behavior +- **Shared UI module** -- `src/components/CippComponents/quarantine/` provides filter panel, grid columns, detail panel, bulk toolbar, and row actions used by both Quarantine Management and Email Troubleshooter +- **Lazy detail metadata** -- extended message details and authentication summary load on row open via `GetMailQuarantineMessage` (not during initial grid load) +- **Export** -- filtered CSV or JSON download (up to 5,000 raw EXO rows, with truncation warning) +- **Bulk actions** -- release, deny, release & allow, delete, submit to Microsoft, block deduplicated senders, export selected rows +- **Preserved actions** -- EML preview, message trace, Threat Explorer deep link, preset column filters (Not Released / Released / Requested), and all row-level allow/block/release operations + +**Backend:** + +- `Build-CIPPQuarantineQueryParams.ps1` -- shared filter mapper, post-filters, EXO retry/backoff, display normalization +- `ListMailQuarantine`, `GetMailQuarantineMessage`, `ExportMailQuarantine`, extended `ExecQuarantineManagement`, `ExecEmailTroubleshoot` +- `ExecMailboxSafeSender` -- backend endpoint for mailbox safe-sender list (API only; no UI yet) +- AllTenants cache paginates up to 5 × 1,000 rows per tenant (30-day window) +- Feature matrix and API limits: [docs/upstream-sync/QUARANTINE_FEATURES.md](docs/upstream-sync/QUARANTINE_FEATURES.md) + +**Not supported / limitations** (honest API limits, not faked in UI): + +- Sender/recipient display name filtering (EXO list API) +- Sending IP on quarantine list (message trace only) +- Attachment/URL sandbox verdicts in list (EML preview when available) +- Threat Explorer in-app (external deep link only) +- Release to specific users and mailbox safe sender (backend/API only) + +### Reliability & Performance Hardening (Manage365 v5.15.2) + +A full-app reliability audit of both repos (frontend and API) with fixes for the highest-impact bugs found: + +**Quarantine & email troubleshooting:** + +- **Quarantine outage fixed (module export bug)** -- the quarantine helper functions (`Invoke-CippQuarantineExoRequest`, `Get-CippQuarantinePagedResults`, and friends) were co-located in one file, but CIPPCore exports functions by file basename only, so the upstream module split (entrypoints moving to CIPPHTTP/CIPPActivityTriggers) made them invisible to every quarantine endpoint -- breaking quarantine for all tenants with "The term 'Invoke-CippQuarantineExoRequest' is not recognized". Helpers are now one-function-per-file so they export correctly +- **Post-filter pagination no longer drops rows** -- when subject/domain post-filters are active, every match from a scanned Exchange page is kept (previously matches could be silently skipped when a page filled mid-scan), and "more pages" is reported correctly even when the raw-page scan limit is hit. Covered by new Pester regression tests +- **Bulk quarantine actions endpoint repaired** -- fixed a PowerShell parse error (`return switch`) that prevented `ExecQuarantineManagement` from loading at all, and missing message identities now return a clear 400 instead of an opaque failure +- **Accurate HTTP status codes** -- quarantine read endpoints previously returned 403 for every error (including Exchange throttling); only genuine authorization failures return 403 now, everything else is 500 so retries and monitoring behave correctly +- **All-tenants cache dedupe** -- cache rows now use deterministic keys (hash of tenant + quarantine identity) so re-running the sync upserts instead of inserting duplicates +- **Stale dialog data eliminated** -- opening a second message trace or EML preview no longer flashes the previous message's data while the new request loads + +**Frontend:** + +- **API result severity fixed** -- structured API results were almost always rendered as errors in dialogs and wizards due to a truthiness bug in `CippApiResults`; success results now display correctly +- **Wizard crash fixed** -- wizards with conditional steps (`showStepWhen`/`hideStepWhen`) could index past the visible step list and crash; navigation now clamps to the filtered list +- **React Query v5 compliance** -- the removed `keepPreviousData` option (silently ignored) is mapped to `placeholderData`, and is now opt-in to prevent cross-tenant data flashes +- **Tenant-scoped cache keys** -- alert configuration and Dynamics 365 pages now include the tenant in their query keys, eliminating stale cross-tenant data after tenant switches +- **OAuth popup cleanup** -- navigating away mid-authentication now tears down the `BroadcastChannel`, the 10-minute timeout, and device-code polling instead of leaking them +- **Quarantine page render performance** -- the filter form subscribes only to the fields it needs instead of re-rendering the whole page on every keystroke + +**Backend:** + +- **Mailbox details endpoint surfaces failures** -- `ListUserMailboxDetails` returned HTTP 200 with empty data when Exchange/Graph calls failed; it now returns a proper error, and the tenant-wide user list is fetched lazily (only when Send-on-Behalf or internal forwarding resolution needs it) +- **OData injection hardening** -- group lookups in SharePoint guest-invite and member endpoints escape single quotes in user-supplied identifiers +- **Repo hygiene** -- removed 53 stray macOS duplicate files across both repos, including two duplicated live API endpoints + +### Organized Navigation + +Deeply nested navigation menus that group related pages together, reducing menu length and making features easier to find -- External Access with External Access Wizard and Sharing Troubleshooter; Email & Exchange Troubleshooting with Email Troubleshooter, Quarantine, Message Viewer, and Mailbox Restores; Groups with Group Templates; Users with Offboarding Wizard, Risky Users, and Guest Users; Business Voice with Phone Numbers, Call Queues, Auto Attendants, and Dial Plans; File Management with File Search, File Browser, and File Transfer; and more. + +### Bulk Domain Migration + +Migrate users and groups from one domain to another in bulk -- a common need when clients rebrand or consolidate domains. Available from two entry points: + +- **Users page** -- select users, choose "Change Domain" from bulk actions, pick the target domain, and migrate +- **Domains page** -- click "Migrate Users to This Domain" on any verified domain, select a source domain, then pick which users and groups to migrate + +The migration changes each user's UPN and primary email to the new domain while automatically preserving the old email address as an alias so inbound mail delivery is not disrupted. Groups (M365 Groups, Distribution Lists, Mail-Enabled Security Groups) are supported with an opt-in toggle. Conflict detection checks for address collisions before making changes, and per-object results report exactly which items succeeded or failed. + +### Integration Templates + +A template-based system for creating app registrations in client tenants, designed to streamline the setup of third-party integrations like UniFi Identity, Datto, and similar services that require Microsoft Entra app credentials. + +- **Prebuilt templates** -- ships with ready-to-use templates for common integrations (UniFi Identity included) with correct API permissions pre-configured +- **Custom templates** -- create your own templates for any integration, selecting from a curated list of common Microsoft Graph permissions +- **Multi-tenant deployment** -- deploy the same app registration to multiple client tenants in a single operation with orchestrator-based parallel processing +- **Credential display** -- after deployment, credentials (Application ID, Tenant ID, Client Secret) are displayed in a table with individual copy buttons, show/hide toggle for secrets, and a "Copy All" button for bulk export +- **CSV export** -- export all deployment results including credentials for record-keeping and documentation +- **Secret expiration** -- choose secret lifetime (90 days to 2 years) during deployment; longer expirations reduce maintenance overhead +- **Built-in template protection** -- prebuilt templates show a lock icon and can be duplicated but not modified or deleted, ensuring reliable defaults +- **Automatic admin consent** -- app role assignments are created automatically, granting the configured permissions without additional manual steps in the Entra portal + +Located under Tenant Administration > Applications > Integration Templates. + +### MCP Server (Manage365 v2) + +Model Context Protocol (MCP) support for internal team use — expose CIPP's read-only API surface as tools for AI clients. + +- **API client toggle** -- enable **MCP Access Allowed** per API client; warning copy explains the blast radius; table column shows which clients are MCP-enabled +- **MCP URL chip** -- Application Settings / API clients surface `…/api/ExecMcp` for connector configuration +- **Backend** -- `Invoke-ExecMcp` (Streamable-HTTP JSON-RPC), OpenAPI-projected `.Read` tools, `MCPAllowed` check against the ApiClients table, per-call RBAC via `New-CippCoreRequest` +- **Feature flag** -- `MCPServer` ships **on** (`EnabledWhen` `DefaultOn`). A later toggle on the Features page is remembered and wins. Confirm with `tools/list` and one `.Read` tools/call after the image that contains this default is deployed +- **Auth** -- MCP runs on the container EasyAuth path (v1's SWA audience workaround is gone) + +Intake notes: [docs/upstream-sync/history-cipp/MCP_INTAKE_20260803.md](docs/upstream-sync/history-cipp/MCP_INTAKE_20260803.md) (v1 intake; still applies). + +### Baselines (Manage365 v2) + +**Baselines** are the desired-state engine from upstream. When the flag is on they replace classic Standards and Drift: those scheduled runs skip, and their pages hide. The two systems never run side by side. Native on Craft (orchestrator + Azure Tables). + +- **Pages** -- Fleet overview, alignment, and templates under `/tenant/baselines`. **Migrate from Standards** copies existing templates and leaves the originals alone. Import as report-only, then turn on automatic fixing per standard after review. +- **Backend** -- baseline executors in `CIPPCore`, `Start-CIPPBaselineOrchestrator`, HTTP List/Add/Run/Stage/Override/Alignment APIs, and `backend/Config/BaselineStandards/**` definitions +- **Feature flag** -- `Baselines` stays **off** while classic Standards templates exist (`EnabledWhen` `NoClassicStandards`). An install with no classic templates turns it on. Enabling it does not migrate templates by itself. +- **6.1.3 standards** -- EISCDA, CIS foundation, Global Secure Access, Teams files, external meeting bots, mailbox default audit, Azure MFA push apps, shared mailbox creation, and group reviewer + +Intake notes: [docs/upstream-sync/history-cipp/BASELINES_INTAKE_20260814.md](docs/upstream-sync/history-cipp/BASELINES_INTAKE_20260814.md). Checkpoint: [docs/upstream-sync/history-cipp/SYNC_20260814.md](docs/upstream-sync/history-cipp/SYNC_20260814.md). + +### Backend Enhancements + +- **Stack overflow protection** in Intune policy comparison with depth-tracking recursion and O(1) index-based lookups +- **Thorough mailNickname sanitization** in group creation (M365 spec compliance: extracts local part, removes forbidden characters, enforces 64-char limit) +- **Craft orchestration** -- `Start-CIPPOrchestrator` / `Add-CippQueueMessage` replace the v1 processor-slot queue model; fan-out/fan-in for DB cache collection stays on Azure Tables +- **Channel filesFolder batch-fetch** -- Teams detail API returns per-channel SharePoint siteId/driveId via Graph batch requests, enabling direct file browsing for private/shared channels with their own SharePoint sites +- **SharePoint REST auto-elevation** -- when adding members to non-group-connected sites (Communication, classic Team), the delegated token may lack site-level permissions. The endpoint now auto-elevates the SAM user to site collection admin via CSOM `SetSiteAdmin` (app-only admin API) and retries, with a final Graph API `drive/root/invite` fallback if CSOM is unavailable. Eliminates the manual "run CPV Refresh" step for most SharePoint member operations +- **Quarantine portal API (v5.13.0)** -- shared `Build-CIPPQuarantineQueryParams` helper with EXO retry/backoff, post-filter pagination metadata, export cap semantics, and Pester tests for query mapping and endpoint response shapes (`Tests/Tools`, `Tests/Endpoint`) +- **Selective user edit body** -- only sends properties that are explicitly set, preventing accidental field clearing during inline edits +- **License backfill integration** -- missing licenses show formatted names immediately with asynchronous API backfill for accurate display names +- **Applied Standards API hardening** -- `{ Results }` wrappers, `excludedTenants` corruption repair, missing `standards` key auto-init, live `TemplateList-Tags` expansion for Intune and CA partitions, and run-manually standards included in compare +- **Power Platform Administrator** role included in GDAP role sets + +--- + +## Upstream Integration + +Manage365 tracks the [CyberDrain CIPP monorepo](https://github.com/CyberDrain/CIPP) (the successor to the split `KelvinTegelaar/CIPP` and `KelvinTegelaar/CIPP-API` repos, whose intake history is archived under `docs/upstream-sync/history-cipp{,-api}/`). Upstream changes are merged **selectively** (cherry-pick / surgical port), not via wholesale merge or GitHub “Discard commits” sync. + +**Formal process:** [docs/upstream-sync/PROCESS.md](docs/upstream-sync/PROCESS.md) — cadence, triage rules, checkpoint docs, version bump, and deploy checklist. + +| Cadence | When | Focus | +|---------|------|--------| +| **Light delta** | Monthly | Low-risk bugfixes, JSON data, tests | +| **Major cycle** | Quarterly | Full delta inventory + dependency review | +| **Feature intake** | Backlog | New capabilities — design first. MCP ships on unless toggled off. Baselines stay off while classic Standards exist | +| **Hotfix** | As needed | Critical upstream security fixes | + +Start a cycle: `./Tools/Start-UpstreamSyncCycle.ps1` (single repo — frontend and backend move together). + +All intakes are **selective** — upstream fixes and improvements are ported surgically rather than merging whole files, so fork-specific behavior stays intact. + +### Taken from upstream (v11.0.2 — October 2026) + +Selective merge of v10.9.1, v10.10.3, and v11.0.2 onto the 6.0.0 monorepo. Checkpoint: [docs/upstream-sync/UPSTREAM_DELTA_20261005.md](docs/upstream-sync/UPSTREAM_DELTA_20261005.md). + +| Intake | What changed | +|--------|----------------| +| **v10.9.1** | Mobile UI, role simple mode, report data-source controls. Manage365 quarantine portal kept | +| **v10.10.3** | Linux container Web App migration, MUI 9, Graph message trace, JIT/PIM. Cutover deletes file shares; storage account, tables, blobs, queues, and Key Vault stay. Production cutover has been run | +| **v11.0.2** | Baselines public beta and Security Simulator. The Baselines flag stays off while classic Standards exist, so Applied Standards keep running until someone enables Baselines. SAM manifest keeps Dynamics, BAP, and Power Platform | + +### Taken from upstream after 11.0.2 (Manage365 6.1.3 — October 2026) + +Selective intake of `upstream/dev` commits after tag v11.0.2. The baselines module was not split out. Hudu, Halo, CIPPPwPush, the worker rewrite, Craft live queue, and Premium hosting were not taken. + +| Intake | What changed | +|--------|----------------| +| **Baseline standards** | EISCDA, CIS foundation, Global Secure Access, Teams files, meeting bots, mailbox audit, MFA push apps, shared mailbox, group reviewer, plus the small baseline fixes | +| **Identity** | JIT admin approval and a tabbed JIT layout. Vacation defaults and vacation group membership | +| **Dashboard and mail** | Open service-health issues. GCC message-trace fallback. Shared-mailbox license warning. Custom OneDrive shortcut names | +| **Portals and licensing** | Optional login hint. License-price CSV import and export, including decimal prices | +| **SharePoint** | Version policy on existing libraries. Edit locked and classic sites | +| **Security operations** | 30-day BEC lookback for Entra ID P1 or P2 | +| **API** | Accurate status codes. Bulk actions continue past a failed row | +| **NinjaOne** | NinjaOne MSP vendor app | +| **Manage365** | Light and dark logos, V2 badge, light-mode top bar, card/table toggle, MCP default on | + +### Taken from upstream (v10.8.5 — August 2026) + +| Intake | What changed | +|--------|----------------| +| **Major delta 10.8.5** (v5.33.0) | Secure Score report API + AllTenants helpers; Intune MAA requests + BitLocker search page; nested ListRoles / TABL; `ExecSetDefaultMFAMethod` API; ConversionTable / M365Licenses; selective standards hardening | +| **Baselines feature intake** (v5.33.0) | Full baselines engine + FE pages; FeatureFlags timer **off** by default — see [Baselines](#baselines-manage365-v2) | +| **Partial** | Branding list/presets APIs and community template catalog (Manage365 branding UI and full community-repos rewrite deferred) | + +**Still deferred from the last v1 cycle (now mostly native in v2):** Node/jsdom engine bumps; full BEC/user-detail rewrite and Default MFA UI wire-up; Teams V2. SSO, CIPP Users, and container management are **native in v2**. Checkpoint: [docs/upstream-sync/history-cipp/SYNC_20260814.md](docs/upstream-sync/history-cipp/SYNC_20260814.md). + +### Taken from upstream (v10.7.5 + MCP — August 2026) + +| Intake | What changed | +|--------|----------------| +| **Light delta 10.7.5** (v5.31.0) | AzBobbyTables 3.6.2 + large-entity table wrappers; Intune template drift helpers; group `disableNesting`; device Add-to-Group; snooze reason; partner webhook hostname warning; audit log V2; SAM `RoleManagement.Read.Exchange` | +| **MCP feature intake** (v5.32.0) | ExecMcp stack + OpenAPI tool projection; API client `MCPAllowed` UI/API. Flag off by default — see [MCP Server](#mcp-server-manage365-v2) | + +**Still deferred:** Teams V2 module migration. Container management / logs / worker health and instance SSO / CIPP Users are **native in v2**. Checkpoint: [docs/upstream-sync/history-cipp/SYNC_20260803.md](docs/upstream-sync/history-cipp/SYNC_20260803.md), [docs/upstream-sync/history-cipp/MCP_INTAKE_20260803.md](docs/upstream-sync/history-cipp/MCP_INTAKE_20260803.md). + +### Taken from upstream (v10.6.1 intake series — July 2026) + +The July 2026 cycle absorbed the upstream 10.6.x line as a major delta plus nine +dedicated feature intakes (checkpoint docs in `docs/upstream-sync/`): + +| Intake | What changed | +|--------|----------------| +| **Copilot & AI** (v5.18.0) | Copilot & AI management pages and menu section | +| **SAM certificate auth** | Certificate-based SAM authentication support (API) | +| **SharePoint suite** (v5.19.0) | Upstream SharePoint improvements merged into fork's site management | +| **BEC UI family** (v5.20.0) | Compact accordion check cards, inbox-rule change auditing, Sent Messages check, Trusted & Blocked Senders check (fork implemented the missing backend data producer), updated PDF report; fork's rich page states preserved | +| **Exchange/Mailbox family** (v5.21.0) | Mailbox Access card, proxy-address drift (Source column), mail-enabled security groups in permission pickers, SMTP Auth chip on the Exchange info card, report-DB mailbox permissions page; guest-UPN retry logic preserved in `ExecModifyMBPerms` | +| **UserActions + nested groups** (v5.22.0) | Policy-aware TAP creation form, pre-selection + no-op guards on Sign-In State and Source of Authority actions, users-and-groups member picker for group edit (nested group memberships) | +| **MEM devices + component fixes** (v5.23.0) | Shared `CippIntuneDeviceActions` (built from the fork's richer action list) consumed by both device pages; defanged-URL rendering fix; bar-chart tooltip fix; AllTenants tenant-scoping fix on row actions; stale dialog results cleared on reopen | +| **Scheduled edit + dashboard alerts** (v5.24.0) | Dashboard Alerts card (active + snoozed alert instances with per-item snooze), schedulable user edits via new shared `Set-CIPPUser` (API), bulk API results rolled up per action with an X-of-Y summary alert | +| **Odds & ends** (v5.25.0) | Menu section permission fixes (Device Management, Transport, Spam Filter, Resource Management), top-nav tooltips + shortcut hints, Next.js build-trace skip (~67s → ~24s builds), dependency bumps (react-query family, apexcharts, mui-tiptap, reduxjs/toolkit, dompurify as direct dep) | + +**Deferred from that v1 cycle:** Custom Test Alerting overhaul, Purview DLP standard, +Intune policy sync, Sherweb client changes, and assorted small items listed in +the checkpoint docs. The SSO/CIPP-users family and MCP were deferred then; both +are in v2 (SSO native; MCP on unless toggled off). + +### Taken from upstream (v10.5 / v10.5.1 — June 2026) + +| Area | What changed | +|------|----------------| +| **Applied Standards** | Corrected compliance scoring math (ratio-based combined score, capped at 100%); license-missing filter includes `LicenseAvailable: false` standards; template lookup respects `{ Results }` API wrappers; removed debug logging | +| **Policies Deployed** | CA template GUIDs resolve to display names via `ListCATemplates` | +| **Standards API** | Compare includes run-manually templates; `ExecStandardsRun` accepts `templateId` or `TemplateId`; CA `TemplateList-Tags` expand from the `CATemplate` partition | +| **Universal Search** | `CippUniversalSearchV2` in top nav (hybrid — frosted-glass header preserved); legacy `CippCentralSearch` removed | +| **Dashboard** | Dashboard v2 only; v1 and History tab removed with redirect | +| **CippDataTable** | Virtualization, schema-key column cache, regex filter fixes, off-canvas click guard — mobile card view and quick actions preserved | +| **Identity / Email** | Group-based licensing; alert-only license exclusions; quarantine deny fix; dual-schema CAS mailbox endpoint; autocomplete and report-builder `tenantFilter` fixes | +| **Auth / CI** | OAuth broadcast channel for reliable popup completion; superseded SWA deploy cancellation | +| **Dependencies** | Low-risk package bumps aligned with upstream 10.5.1 | + +### Preserved Manage365 customizations + +- Dual **Run Standard** actions and drift-template workflows on Applied Standards (not replaced with upstream single-action tenant selector) +- **LicenseAvailable** warnings and scoring UI on Applied Standards +- `createDriftManagementActions` and fork drift logic on Applied Standards / Policies Deployed +- `{ Results: ... }` API response wrappers and fork hardening in standards endpoints +- **CippDataTable** mobile card view, lazy-load pagination, and `mobileQuickActions` +- Dashboard inline universal search (mobile landing-page search kept alongside top-nav search) +- Fork `excludedTenants` corruption guards and missing `standards` key auto-init in `listStandardTemplates` + +### Deferred (not merged) + +Full-file replacements for Applied Standards, CippDataTable, top-nav, and `package.json` were skipped in v1 where they would remove the items above. In **v2**, worker health / container management and SSO / CIPP Users are native. MCP ships on unless a Features toggle has turned it off. Baselines stay off while classic Standards templates exist. Still deferred: Teams V2, Node engine bumps, full BEC/user UI rewrite, Default MFA UI wire-up, Hudu, Halo, and CIPPPwPush. + +### Version tracking and out-of-date alerts + +Manage365 tracks **two** version numbers: + +| File | Purpose | +|------|---------| +| `frontend/public/manage365-version.json` | Manage365 fork release (shown as the primary version in Application Settings) | +| `frontend/public/version.json` | Upstream CIPP baseline absorbed — used by `GetVersion` / `GetCippAlerts` to suppress false "out of date" toasts. The container image build overwrites the exported copy from the `APP_VERSION` build arg. | + +After each upstream intake, bump both and redeploy: + +```powershell +./Tools/Update-Version.ps1 -UpstreamVersion 11.0.2 -Manage365Version 6.1.10 +``` + +Then **build the container image with `APP_VERSION=` and deploy it** to the App Service container. Until redeployed, the settings page may still show old versions. + +Out-of-date toast notifications compare your deployed `version.json` / `version_latest.txt` against the [CyberDrain CIPP monorepo](https://github.com/CyberDrain/CIPP) releases. They clear once your deployed baseline matches upstream (currently **11.0.2**). + +### GitHub "Sync fork" button + +This is **separate** from in-app version alerts. GitHub compares commit history between `Celeratec/Manage365` and `CyberDrain/CIPP`. Selective cherry-pick intake leaves the fork hundreds of commits "behind" upstream even when you have absorbed the relevant changes — GitHub will keep offering **Sync fork**. + +Options: + +1. **Ignore it** (recommended for day-to-day work) — the badge is cosmetic when you cherry-pick intentionally. +2. **Merge upstream periodically** — `git fetch upstream && git merge upstream/main` (resolve conflicts, preserve fork customizations). Clears the behind count but is a large merge. +3. **Do not use "Sync fork" → Discard commits** — that would overwrite Manage365-specific work. + +--- + +## Technology Stack + +- **Frontend:** React / Next.js 16 with Material-UI (MUI v7), static-exported (`frontend/`) +- **Backend:** PowerShell on the [Craft](https://github.com/CyberDrain/Craft) container runtime (`backend/`) +- **API:** Microsoft Graph API (including eDiscovery API), SharePoint Admin API, SharePoint REST API, Teams PowerShell cmdlets (via `New-TeamsRequest`, including meeting branding policy management), Power Platform BAP API, Dataverse Web API, NinjaOne API (via CIPP extension) +- **Hosting:** single Linux container (Azure App Service) with Azure Storage (tables/queues/blobs); Azurite + Docker Compose for local development (`build/`) +- **Auth:** Azure App Service EasyAuth with in-app user/role management +- **Data:** React Query for caching and state management + +--- + +## Acknowledgments + +Manage365 is built on the [CIPP](https://cipp.app) open-source project created by [Kelvin Tegelaar](https://github.com/KelvinTegelaar) and the CIPP community. We are grateful for their foundational work that makes this project possible. diff --git a/Tools/Start-UpstreamSyncCycle.ps1 b/Tools/Start-UpstreamSyncCycle.ps1 new file mode 100644 index 0000000000..d421945e84 --- /dev/null +++ b/Tools/Start-UpstreamSyncCycle.ps1 @@ -0,0 +1,92 @@ +<# +.SYNOPSIS + Start a Manage365 upstream sync cycle — fetch, tag backup, create sync branch, print delta stats. + +.DESCRIPTION + Monorepo edition. Manage365 tracks the CyberDrain CIPP monorepo (frontend + backend in one + repo) as `upstream`. This replaces the two-repo (CIPP / CIPP-API) cycle script from the + pre-monorepo era; those histories live under docs/upstream-sync/history-cipp{,-api}/. + +.PARAMETER SyncBase + Optional commit SHA to measure delta from (default: current main tip before branch switch) + +.PARAMETER DateStamp + Optional YYYYMMDD (default: today) + +.EXAMPLE + ./Tools/Start-UpstreamSyncCycle.ps1 +#> +[CmdletBinding()] +param( + [string]$SyncBase, + + [string]$DateStamp = (Get-Date -Format 'yyyyMMdd') +) + +$ErrorActionPreference = 'Stop' + +$prod = 'main' +$upstreamRef = 'upstream/main' +$slug = 'manage365' + +Write-Host '=== Manage365 upstream sync: monorepo ===' -ForegroundColor Cyan +Write-Host "Date stamp: $DateStamp" + +if (-not (git rev-parse --git-dir 2>$null)) { + throw 'Not a git repository. Run from the Manage365 repo root.' +} + +$status = git status --porcelain +if ($status) { + Write-Warning 'Working tree is not clean:' + Write-Host $status + throw 'Commit or stash changes before starting a sync cycle.' +} + +Write-Host 'Fetching upstream...' +git fetch upstream 2>&1 | Out-Host + +$tip = (git rev-parse $prod).Trim() +if (-not $SyncBase) { $SyncBase = $tip } + +$backupTag = "backup/pre-upstream-sync-$slug-$DateStamp" +$syncBranch = "manage365/upstream-sync-$DateStamp" + +Write-Host '' +Write-Host "Production branch: $prod @ $tip" +Write-Host "Sync base: $SyncBase" +Write-Host "Upstream: $upstreamRef @ $(git rev-parse $upstreamRef)" + +$counts = (git rev-list --left-right --count "$prod...$upstreamRef").Trim() -split '\s+' +Write-Host "Ahead of upstream: $($counts[0])" +Write-Host "Behind upstream: $($counts[1])" + +$deltaCount = (git rev-list --count "$SyncBase..$upstreamRef").Trim() +Write-Host "Commits to review (since sync base): $deltaCount" + +Write-Host '' +Write-Host "Creating backup tag: $backupTag" +git tag $backupTag $tip 2>$null +if ($LASTEXITCODE -ne 0) { + Write-Warning "Tag may already exist: $backupTag" +} + +$existing = git branch --list $syncBranch +if ($existing) { + Write-Warning "Branch already exists: $syncBranch — checking out" + git checkout $syncBranch +} else { + Write-Host "Creating sync branch: $syncBranch from $prod" + git checkout -b $syncBranch $prod +} + +Write-Host '' +Write-Host 'Next steps:' -ForegroundColor Green +Write-Host ' 1. Read docs/upstream-sync/PROCESS.md' +Write-Host " 2. Generate UPSTREAM_DELTA_$DateStamp.md (git log $SyncBase..$upstreamRef)" +Write-Host ' 3. Triage commits — Apply / Adapt / Defer / Skip' +Write-Host ' 4. Cherry-pick mini-batches on this branch' +Write-Host " 5. Write SYNC_CHECKPOINT_$DateStamp.md when done" +Write-Host '' +Write-Host 'Sample inventory command:' +Write-Host " git log --oneline $SyncBase..$upstreamRef" -ForegroundColor DarkGray diff --git a/Tools/Update-Version.ps1 b/Tools/Update-Version.ps1 new file mode 100644 index 0000000000..6f0a1fc71a --- /dev/null +++ b/Tools/Update-Version.ps1 @@ -0,0 +1,59 @@ +<# +.SYNOPSIS + Bump version tracking files after a Manage365 upstream intake (monorepo edition). + +.DESCRIPTION + Updates the upstream baseline version used by GetVersion / GetCippAlerts out-of-date checks + and the Manage365 fork release shown in Application Settings. + + Files written: + frontend/public/version.json — upstream baseline (dev source; the Docker image + build overwrites out/version.json from the + APP_VERSION build arg, so pass the same value + there when building a release image) + frontend/package.json — upstream baseline + backend/version_latest.txt — upstream baseline + frontend/public/manage365-version.json — Manage365 release + baseline (flows into the + static export untouched) + +.PARAMETER UpstreamVersion + CIPP upstream baseline absorbed (e.g. 10.8.5). + +.PARAMETER Manage365Version + Optional Manage365 fork release (e.g. 5.33.0). + +.EXAMPLE + ./Tools/Update-Version.ps1 -UpstreamVersion 10.8.5 -Manage365Version 5.33.0 +#> +[CmdletBinding()] +param( + [Parameter(Mandatory = $true)] + [string]$UpstreamVersion, + + [string]$Manage365Version +) + +Set-Location (Get-Item $PSScriptRoot).Parent.FullName + +Set-Content 'backend/version_latest.txt' -Value $UpstreamVersion -NoNewline + +$VersionJson = @{ version = $UpstreamVersion } | ConvertTo-Json +Set-Content 'frontend/public/version.json' -Value $VersionJson + +$Package = Get-Content frontend/package.json -Raw | ConvertFrom-Json +$Package.version = $UpstreamVersion +$Package | ConvertTo-Json -Depth 10 | Set-Content frontend/package.json + +if ($Manage365Version) { + $Manage365Json = @{ + version = $Manage365Version + upstreamBaseline = $UpstreamVersion + } | ConvertTo-Json + Set-Content 'frontend/public/manage365-version.json' -Value $Manage365Json +} + +Write-Host "Upstream baseline set to $UpstreamVersion" +if ($Manage365Version) { + Write-Host "Manage365 release set to $Manage365Version" +} +Write-Host "Remember: pass APP_VERSION=$UpstreamVersion when building the container image, then deploy it." diff --git a/backend/AddMSPApp/ninjarmm.app.json b/backend/AddMSPApp/ninja.app.json similarity index 79% rename from backend/AddMSPApp/ninjarmm.app.json rename to backend/AddMSPApp/ninja.app.json index a7ab007870..9096ad8a85 100644 --- a/backend/AddMSPApp/ninjarmm.app.json +++ b/backend/AddMSPApp/ninja.app.json @@ -8,7 +8,7 @@ "owner": " ", "informationUrl": " ", "privacyInformationUrl": " ", - "fileName": "ninjarmm.intunewin", + "fileName": "ninja.intunewin", "@odata.type": "#microsoft.graph.win32LobApp", "applicableArchitectures": "x86, x64", "installExperience": { @@ -18,12 +18,10 @@ }, "detectionRules": [ { - "@odata.type": "#microsoft.graph.win32LobAppFileSystemDetection", - "path": "%ProgramData%\\NinjaRMMAgent", - "fileOrFolderName": "ninjarmm-cli.exe", - "check32BitOn64System": false, - "detectionType": "exists", - "operator": "notConfigured" + "@odata.type": "#microsoft.graph.win32LobAppPowerShellScriptDetection", + "enforceSignatureCheck": false, + "runAs32Bit": false, + "scriptContent": "aWYgKEdldC1TZXJ2aWNlIC1OYW1lICdOaW5qYVJNTUFnZW50JyAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZSkgewogICAgV3JpdGUtT3V0cHV0ICdOaW5qYU9uZSBhZ2VudCBpbnN0YWxsZWQnCiAgICBleGl0IDAKfQpleGl0IDEK" } ], "returnCodes": [ diff --git a/backend/AddMSPApp/ninjarmm.app.xml b/backend/AddMSPApp/ninja.app.xml similarity index 50% rename from backend/AddMSPApp/ninjarmm.app.xml rename to backend/AddMSPApp/ninja.app.xml index 647d26712e..33afed5fac 100644 --- a/backend/AddMSPApp/ninjarmm.app.xml +++ b/backend/AddMSPApp/ninja.app.xml @@ -1,15 +1,15 @@ install.ps1 - 728 - syncro.intunewin + 1295 + ninja.intunewin install.ps1 - XsBprXNg7cPsNS7YfRarT1zcSoL6/EF+c2dAjkhfuwk= - c4xkRYZg/r/h1xUD1172Tmr877nDXIoa3wuQnj0dpLQ= - OE7D78wJtXIpVESqaZAiWw== - 2m0nbXMdYK9dQgtjZraz3VsSxQlbO0jabpTaUjPg8I8= + 8cU5FF59ZzGxtPt25obhe+5XcQhjQr+BWbhidFSx2e4= + unszAX+2cWXFweYI61dhDz40b5QpcBuXptkfrXerQ7g= + TmoXobMA0054z6eBpJGXMw== + kcZjG7mGy+dCzv4l72VCpLdfxzm3nxU0/ez6KPCplWU= ProfileVersion1 - gPccLH2ZAerHl8aYGYTxWmC8mnpJncTKBw5BX4IpH+g= + xCUVblpYRlubJe4Zy2RMv7pJ2vRFMKgmkHD9s5iLuts= SHA256 \ No newline at end of file diff --git a/backend/AddMSPApp/ninja.intunewin b/backend/AddMSPApp/ninja.intunewin new file mode 100644 index 0000000000..7db30466bd Binary files /dev/null and b/backend/AddMSPApp/ninja.intunewin differ diff --git a/backend/Config/BaselineStandards/Entra (AAD) Standards/AuthenticationMethods.json b/backend/Config/BaselineStandards/Entra (AAD) Standards/AuthenticationMethods.json index 78b500a14c..40d316967e 100644 --- a/backend/Config/BaselineStandards/Entra (AAD) Standards/AuthenticationMethods.json +++ b/backend/Config/BaselineStandards/Entra (AAD) Standards/AuthenticationMethods.json @@ -11,10 +11,7 @@ "addedDate": "2026-08-16", "powershellEquivalent": "Set-CIPPAuthenticationPolicy", "recommendedBy": [], - "requiredCapabilities": [ - "AAD_PREMIUM", - "AAD_PREMIUM_P2" - ], + "requiredCapabilities": [], "disabledFeatures": { "report": false, "warn": false, @@ -443,4 +440,4 @@ "remediate": { "executor": "AuthenticationMethods" } -} +} \ No newline at end of file diff --git a/backend/Config/BaselineStandards/Entra (AAD) Standards/ConsentPolicySettings.json b/backend/Config/BaselineStandards/Entra (AAD) Standards/ConsentPolicySettings.json new file mode 100644 index 0000000000..e7c81c3c99 --- /dev/null +++ b/backend/Config/BaselineStandards/Entra (AAD) Standards/ConsentPolicySettings.json @@ -0,0 +1,49 @@ +{ + "name": "ConsentPolicySettings", + "label": "Consent policy settings (risky app consent, admin consent requests)", + "cat": "Entra (AAD) Standards", + "tag": [ + "EIDSCA.CP03", + "EIDSCA.CP04" + ], + "impact": "Low Impact", + "helpText": "Sets the two values on the Consent Policy Settings directory setting: block user consent when Microsoft detects a risky request, and let users request admin consent for apps they cannot consent to themselves. The EIDSCA recommendation is on for both.", + "executiveText": "Stops employees from approving an application that Microsoft has flagged as risky, and gives them a request-to-admin path instead of a dead end, so IT keeps control over which apps get access to company data.", + "docsDescription": "Grades BlockUserConsentForRiskyApps and EnableAdminConsentRequests on the Consent Policy Settings directory setting (template dffd5d46-495d-40a9-8e21-954ff55e198a). Directory setting values are strings on the wire, so both sides grade as strings; a tenant without the setting object grades as drift and remediation instantiates it from the template. Maps to EIDSCA CP03 and CP04. The admin consent workflow itself (reviewers, notifications, request duration) is managed by Enable App Consent Admin Requests. Group owner consent (EIDSCA CP01) is no longer a value on this template; it is governed by the permission grant policies on the authorization policy, which the OAuth consent standards replace.", + "impactColour": "info", + "addedDate": "2026-10-10", + "powershellEquivalent": "Graph: PATCH settings (directory setting dffd5d46)", + "appliesToTest": [ + "EIDSCACP03", + "EIDSCACP04" + ], + "recommendedBy": [ + "CIPP" + ], + "requiredCapabilities": [], + "secureScoreImpact": 0, + "compare": "subset", + "variables": { + "BlockUserConsentForRiskyApps": { + "type": "switch", + "label": "Block user consent for risky apps", + "default": true, + "recommended": true + }, + "EnableAdminConsentRequests": { + "type": "switch", + "label": "Users can request admin consent to apps they are unable to consent to", + "default": true, + "recommended": true + } + }, + "read": { + "cacheType": "Settings" + }, + "prepare": "Get-CIPPBaselineConsentPolicySettingsState", + "remediate": { + "executor": "ConsentPolicySettings", + "blockUserConsentForRiskyApps": "%BlockUserConsentForRiskyApps%", + "enableAdminConsentRequests": "%EnableAdminConsentRequests%" + } +} diff --git a/backend/Config/BaselineStandards/Entra (AAD) Standards/DefaultUserPermissions.json b/backend/Config/BaselineStandards/Entra (AAD) Standards/DefaultUserPermissions.json new file mode 100644 index 0000000000..6d3f48da55 --- /dev/null +++ b/backend/Config/BaselineStandards/Entra (AAD) Standards/DefaultUserPermissions.json @@ -0,0 +1,92 @@ +{ + "name": "DefaultUserPermissions", + "label": "Default user permissions and self sign-up (authorization policy)", + "cat": "Entra (AAD) Standards", + "tag": [ + "EIDSCA.AP05", + "EIDSCA.AP06", + "EIDSCA.AP09", + "EIDSCA.AP14" + ], + "impact": "Low Impact", + "helpText": "Sets four switches on the Microsoft Entra authorization policy: whether users can sign up for email-based subscriptions, whether users with a verified email can join the tenant on their own, whether users may consent to apps that Microsoft flags as risky, and whether members can read other users in the directory. The EIDSCA recommendation is off, off, off and on.", + "executiveText": "Closes the self-service doors into the tenant: nobody can create an account or a subscription just by verifying an email address, and employees cannot grant access to applications that Microsoft has flagged as risky. Members keep the ability to look up colleagues in the directory.", + "docsDescription": "Writes allowedToSignUpEmailBasedSubscriptions, allowEmailVerifiedUsersToJoinOrganization, allowUserConsentForRiskyApps and defaultUserRolePermissions.allowedToReadOtherUsers on the authorization policy (Graph beta). Maps to EIDSCA AP05, AP06, AP09 and AP14. The write is delegated because the authorization policy rejects app-only tokens. Disable Self Service Licensing also writes the email-based subscription switch; use one or the other in a baseline.", + "impactColour": "info", + "addedDate": "2026-10-10", + "powershellEquivalent": "Update-MgBetaPolicyAuthorizationPolicy -AllowedToSignUpEmailBasedSubscriptions:$false -AllowEmailVerifiedUsersToJoinOrganization:$false -AllowUserConsentForRiskyApps:$false", + "appliesToTest": [ + "EIDSCAAP05", + "EIDSCAAP06", + "EIDSCAAP09", + "EIDSCAAP14" + ], + "recommendedBy": [ + "CIPP" + ], + "requiredCapabilities": [], + "secureScoreImpact": 0, + "compare": "subset", + "variables": { + "allowedToSignUpEmailBasedSubscriptions": { + "type": "switch", + "label": "Allow users to sign up for email-based subscriptions", + "default": false, + "recommended": false + }, + "allowEmailVerifiedUsersToJoinOrganization": { + "type": "switch", + "label": "Allow users with a verified email to join the tenant on their own", + "default": false, + "recommended": false + }, + "allowUserConsentForRiskyApps": { + "type": "switch", + "label": "Allow users to consent to apps Microsoft flags as risky", + "default": false, + "recommended": false + }, + "allowedToReadOtherUsers": { + "type": "switch", + "label": "Allow members to read other users in the directory", + "default": true, + "recommended": true + } + }, + "expected": { + "allowedToSignUpEmailBasedSubscriptions": "%allowedToSignUpEmailBasedSubscriptions%", + "allowEmailVerifiedUsersToJoinOrganization": "%allowEmailVerifiedUsersToJoinOrganization%", + "allowUserConsentForRiskyApps": "%allowUserConsentForRiskyApps%", + "defaultUserRolePermissions": { + "allowedToReadOtherUsers": "%allowedToReadOtherUsers%" + } + }, + "read": { + "cacheType": "AuthorizationPolicy" + }, + "writeTarget": "authorizationPolicy", + "writeTargetProperties": { + "allowedToSignUpEmailBasedSubscriptions": "%allowedToSignUpEmailBasedSubscriptions%", + "allowEmailVerifiedUsersToJoinOrganization": "%allowEmailVerifiedUsersToJoinOrganization%", + "allowUserConsentForRiskyApps": "%allowUserConsentForRiskyApps%", + "defaultUserRolePermissions.allowedToReadOtherUsers": "%allowedToReadOtherUsers%" + }, + "remediate": { + "executor": "GraphRequest", + "requests": [ + { + "method": "PATCH", + "asApp": false, + "uri": "policies/authorizationPolicy/authorizationPolicy", + "body": { + "allowedToSignUpEmailBasedSubscriptions": "%allowedToSignUpEmailBasedSubscriptions%", + "allowEmailVerifiedUsersToJoinOrganization": "%allowEmailVerifiedUsersToJoinOrganization%", + "allowUserConsentForRiskyApps": "%allowUserConsentForRiskyApps%", + "defaultUserRolePermissions": { + "allowedToReadOtherUsers": "%allowedToReadOtherUsers%" + } + } + } + ] + } +} diff --git a/backend/Config/BaselineStandards/Entra (AAD) Standards/DisableGuests.json b/backend/Config/BaselineStandards/Entra (AAD) Standards/DisableGuests.json index 1c2bef28ea..426a31b862 100644 --- a/backend/Config/BaselineStandards/Entra (AAD) Standards/DisableGuests.json +++ b/backend/Config/BaselineStandards/Entra (AAD) Standards/DisableGuests.json @@ -67,6 +67,7 @@ { "from": "guestsToDisable", "method": "PATCH", + "asApp": false, "uri": "users/%id%", "body": { "accountEnabled": false @@ -75,6 +76,7 @@ { "from": "guestsToDelete", "method": "DELETE", + "asApp": false, "uri": "users/%id%" } ] diff --git a/backend/Config/BaselineStandards/Entra (AAD) Standards/DisableInactiveUsers.json b/backend/Config/BaselineStandards/Entra (AAD) Standards/DisableInactiveUsers.json index 85b04a3a9e..36e71b6c65 100644 --- a/backend/Config/BaselineStandards/Entra (AAD) Standards/DisableInactiveUsers.json +++ b/backend/Config/BaselineStandards/Entra (AAD) Standards/DisableInactiveUsers.json @@ -59,6 +59,7 @@ "writes": [ { "method": "PATCH", + "asApp": false, "uri": "users/%id%", "body": { "accountEnabled": false diff --git a/backend/Config/BaselineStandards/Entra (AAD) Standards/EnableAppConsentRequests.json b/backend/Config/BaselineStandards/Entra (AAD) Standards/EnableAppConsentRequests.json index 0cf8dcfd7b..7701473c09 100644 --- a/backend/Config/BaselineStandards/Entra (AAD) Standards/EnableAppConsentRequests.json +++ b/backend/Config/BaselineStandards/Entra (AAD) Standards/EnableAppConsentRequests.json @@ -7,9 +7,9 @@ "aad_admin_consent_workflow" ], "impact": "Low Impact", - "helpText": "Enables the admin consent workflow so users can request admin approval for applications instead of being blocked outright. The selected reviewer role receives the requests, and specific users (matched by display name) can be added as reviewers alongside it.", + "helpText": "Enables the admin consent workflow so users can request admin approval for applications instead of being blocked outright. The selected reviewer role receives the requests, and specific users and groups (matched by display name) can be added as reviewers alongside it.", "executiveText": "Lets employees request administrator review when an application needs permissions they cannot grant themselves, routing risky consent decisions to IT instead of blocking work or encouraging shadow consent.", - "docsDescription": "Grades whether the admin consent request policy is enabled and whether the configured roles and users are present among the reviewers. Reviewer users are matched by display name, so a central MSP support account that exists as a guest in each tenant can receive per-request notifications regardless of how the guest was created. Remediation enables the workflow with 30-day requests and reviewer notifications, and MERGES the configured reviewers into the existing list - reviewers added by hand are preserved. No role selected defaults to Global Administrator.", + "docsDescription": "Grades whether the admin consent request policy is enabled and whether the configured roles, users and groups are present among the reviewers. Reviewer users and groups are matched by display name, so a central MSP support account that exists as a guest in each tenant, or one shared 'consent reviewers' group created in every tenant, can receive per-request notifications regardless of how it was created. Group reviewers are the members of the group, including nested groups, matching the Groups option in the Entra admin center. Remediation enables the workflow with 30-day requests and reviewer notifications, and MERGES the configured reviewers into the existing list - reviewers added by hand are preserved. No role selected defaults to Global Administrator.", "impactColour": "info", "addedDate": "2026-08-16", "powershellEquivalent": "Update-MgPolicyAdminConsentRequestPolicy", @@ -38,6 +38,13 @@ "creatable": true, "omitWhenBlank": true, "label": "Additional reviewer users (display names of existing users or guests)" + }, + "ReviewerGroups": { + "type": "autoComplete", + "multiple": true, + "creatable": true, + "omitWhenBlank": true, + "label": "Additional reviewer groups (display names of existing groups)" } }, "read": { @@ -47,6 +54,7 @@ "remediate": { "executor": "EnableAppConsentRequests", "reviewerRoles": "%ReviewerRoles%", - "reviewerUsers": "%ReviewerUsers%" + "reviewerUsers": "%ReviewerUsers%", + "reviewerGroups": "%ReviewerGroups%" } } diff --git a/backend/Config/BaselineStandards/Entra (AAD) Standards/M365GroupGuestSettings.json b/backend/Config/BaselineStandards/Entra (AAD) Standards/M365GroupGuestSettings.json new file mode 100644 index 0000000000..48b7d1e1c1 --- /dev/null +++ b/backend/Config/BaselineStandards/Entra (AAD) Standards/M365GroupGuestSettings.json @@ -0,0 +1,49 @@ +{ + "name": "M365GroupGuestSettings", + "label": "Microsoft 365 group guest settings", + "cat": "Entra (AAD) Standards", + "tag": [ + "EIDSCA.ST08", + "EIDSCA.ST09" + ], + "impact": "Low Impact", + "helpText": "Sets whether guests can become owners of Microsoft 365 groups and whether guests can access group content, on the tenant-wide Group.Unified directory setting. The EIDSCA recommendation is no guest owners, guest access allowed.", + "executiveText": "Keeps external guests from owning Teams and Microsoft 365 groups, which would let them add members and change settings, while still allowing invited guests to collaborate on the content they were given access to.", + "docsDescription": "Grades AllowGuestsToBeGroupOwner and AllowGuestsToAccessGroups on the Group.Unified directory setting (template 62375ab9-6b52-47ed-826b-58e47e0e304b). Values are strings on the wire and grade as strings; a tenant without the setting object grades as drift and remediation instantiates it from the template with Microsoft's defaults before writing. Every other Group.Unified value is resent from the live object, so group creation and naming settings managed by other standards are untouched. Maps to EIDSCA ST08 and ST09.", + "impactColour": "info", + "addedDate": "2026-10-10", + "powershellEquivalent": "Graph: PATCH settings (Group.Unified)", + "appliesToTest": [ + "EIDSCAST08", + "EIDSCAST09" + ], + "recommendedBy": [ + "CIPP" + ], + "requiredCapabilities": [], + "secureScoreImpact": 0, + "compare": "subset", + "variables": { + "AllowGuestsToBeGroupOwner": { + "type": "switch", + "label": "Allow guests to become group owners", + "default": false, + "recommended": false + }, + "AllowGuestsToAccessGroups": { + "type": "switch", + "label": "Allow guests to access group content", + "default": true, + "recommended": true + } + }, + "read": { + "cacheType": "Settings" + }, + "prepare": "Get-CIPPBaselineM365GroupGuestSettingsState", + "remediate": { + "executor": "M365GroupGuestSettings", + "allowGuestsToBeGroupOwner": "%AllowGuestsToBeGroupOwner%", + "allowGuestsToAccessGroups": "%AllowGuestsToAccessGroups%" + } +} diff --git a/backend/Config/BaselineStandards/Entra (AAD) Standards/MFAPushApps.json b/backend/Config/BaselineStandards/Entra (AAD) Standards/MFAPushApps.json new file mode 100644 index 0000000000..4a20f5cff9 --- /dev/null +++ b/backend/Config/BaselineStandards/Entra (AAD) Standards/MFAPushApps.json @@ -0,0 +1,37 @@ +{ + "name": "MFAPushApps", + "label": "Azure MFA push notification apps", + "cat": "Entra (AAD) Standards", + "tag": [], + "impact": "Low Impact", + "helpText": "Enables or disables the Azure Multi-Factor Auth Client and Azure Multi-Factor Auth Connector service principals. CIPP's Send MFA Push and MFA OTP verification need both apps enabled.", + "executiveText": "Keeps the Microsoft apps behind MFA push verification in a known state, so help desk identity checks work when they are needed.", + "docsDescription": "Grades two facts from the ServicePrincipals cache: the Azure Multi-Factor Auth Client (appId 981f26a1-7f43-403b-a875-f8b09b8cd720) and Azure Multi-Factor Auth Connector (appId 1f5530b3-261a-47a9-b357-ded261e17918) service principals match the configured state; a missing principal grades enabled, the platform default. Remediation PATCHes the appId-addressed upsert endpoint for each with Prefer: create-if-missing.", + "impactColour": "info", + "addedDate": "2026-10-06", + "powershellEquivalent": "Update-MgServicePrincipal", + "recommendedBy": [], + "requiredCapabilities": [], + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, + "secureScoreImpact": 0, + "compare": "subset", + "variables": { + "Enabled": { + "label": "Enable the Azure MFA push notification apps", + "type": "switch", + "default": true + } + }, + "read": { + "cacheType": "ServicePrincipals" + }, + "prepare": "Get-CIPPBaselineMFAPushAppsState", + "remediate": { + "executor": "MFAPushApps", + "enabled": "%Enabled%" + } +} diff --git a/backend/Config/BaselineStandards/Entra (AAD) Standards/SmartLockout.json b/backend/Config/BaselineStandards/Entra (AAD) Standards/SmartLockout.json index 28cf48cbb7..c59ed5b2ac 100644 --- a/backend/Config/BaselineStandards/Entra (AAD) Standards/SmartLockout.json +++ b/backend/Config/BaselineStandards/Entra (AAD) Standards/SmartLockout.json @@ -2,11 +2,24 @@ "name": "SmartLockout", "label": "Configure Smart Lockout", "cat": "Entra (AAD) Standards", - "tag": [], + "tag": [ + "EIDSCA.PR01", + "EIDSCA.PR02", + "EIDSCA.PR03", + "EIDSCA.PR05", + "EIDSCA.PR06" + ], "impact": "Medium Impact", - "helpText": "Sets the smart lockout threshold and duration, and optionally on-premises password protection mode.", + "helpText": "Sets the smart lockout threshold and duration, optionally on-premises password protection mode, and optionally enforces that the Microsoft global banned password check stays on.", "executiveText": "Tunes how quickly repeated failed sign-ins lock an account and for how long, balancing brute-force protection against helpdesk load from accidental lockouts.", - "docsDescription": "Grades the four lockout values on the password-rule directory setting. Remediation creates the setting with defaults when absent or patches only the lockout values, leaving the banned-password values to their own standard.", + "docsDescription": "Grades the four lockout values on the password-rule directory setting and, when 'Enforce the global banned password check' is on, that EnableBannedPasswordCheck is True (EIDSCA PR03). Remediation creates the setting with defaults when absent or patches only the values this standard manages, leaving the custom banned-password list to its own standard.", + "appliesToTest": [ + "EIDSCAPR01", + "EIDSCAPR02", + "EIDSCAPR03", + "EIDSCAPR05", + "EIDSCAPR06" + ], "impactColour": "warning", "addedDate": "2026-08-16", "powershellEquivalent": "Graph: PATCH settings (directory setting 5cf42378)", @@ -73,6 +86,11 @@ "label": "Enforce" } ] + }, + "EnableBannedPasswordCheck": { + "label": "Enforce the global banned password check (off = leave as-is)", + "type": "switch", + "default": false } }, "read": { @@ -84,6 +102,7 @@ "lockoutDurationInSeconds": "%LockoutDurationInSeconds%", "lockoutThreshold": "%LockoutThreshold%", "enableBannedPasswordCheckOnPremises": "%EnableBannedPasswordCheckOnPremises%", - "bannedPasswordCheckOnPremisesMode": "%BannedPasswordCheckOnPremisesMode%" + "bannedPasswordCheckOnPremisesMode": "%BannedPasswordCheckOnPremisesMode%", + "enableBannedPasswordCheck": "%EnableBannedPasswordCheck%" } } diff --git a/backend/Config/BaselineStandards/Exchange Standards/CreateSharedMailbox.json b/backend/Config/BaselineStandards/Exchange Standards/CreateSharedMailbox.json new file mode 100644 index 0000000000..4cb5199e46 --- /dev/null +++ b/backend/Config/BaselineStandards/Exchange Standards/CreateSharedMailbox.json @@ -0,0 +1,54 @@ +{ + "name": "CreateSharedMailbox", + "label": "Create Shared Mailbox", + "cat": "Exchange Standards", + "tag": [], + "impact": "Low Impact", + "helpText": "Creates a shared mailbox with the configured display name and primary email address, then blocks sign-in for its Entra account. Add one instance per shared mailbox the baseline should guarantee. Drifts when no mailbox with that address exists in the tenant. Tenant tokens such as %defaultdomain% are supported in the address.", + "executiveText": "Guarantees that the standard shared mailboxes (for example info@ or support@) exist in every tenant, created with sign-in blocked so they can only be reached through delegated access.", + "docsDescription": "One instance per shared mailbox. The standard grades whether a mailbox with the configured primary email address exists, matched case-insensitively against the primary SMTP address and the user principal name in the cached mailbox list. Remediation creates the shared mailbox with New-Mailbox, waits three seconds for the directory object to settle, then disables the mailbox's Entra account through Microsoft Graph. An existing mailbox is never modified.", + "impactColour": "info", + "addedDate": "2026-10-05", + "powershellEquivalent": "New-Mailbox -Shared & Update-MgUser -AccountEnabled:$false", + "recommendedBy": [], + "requiredCapabilities": [ + "EXCHANGE_S_STANDARD", + "EXCHANGE_S_ENTERPRISE", + "EXCHANGE_S_STANDARD_GOV", + "EXCHANGE_S_ENTERPRISE_GOV", + "EXCHANGE_LITE" + ], + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, + "secureScoreImpact": 0, + "compare": "subset", + "multiple": true, + "instanceIdentity": "primarySmtpAddress", + "variables": { + "primarySmtpAddress": { + "type": "textField", + "label": "Primary email address (e.g. info@%defaultdomain%)", + "required": true + }, + "displayName": { + "type": "textField", + "label": "Display name", + "required": true + } + }, + "read": { + "cacheType": "Mailboxes", + "collectorArgs": { + "Types": "None" + } + }, + "prepare": "Get-CIPPBaselineCreateSharedMailboxState", + "remediate": { + "executor": "CreateSharedMailbox", + "primarySmtpAddress": "%primarySmtpAddress%", + "displayName": "%displayName%" + } +} diff --git a/backend/Config/BaselineStandards/Exchange Standards/DisableOWAPersonalAccounts.json b/backend/Config/BaselineStandards/Exchange Standards/DisableOWAPersonalAccounts.json new file mode 100644 index 0000000000..9b73d3b76e --- /dev/null +++ b/backend/Config/BaselineStandards/Exchange Standards/DisableOWAPersonalAccounts.json @@ -0,0 +1,70 @@ +{ + "name": "DisableOWAPersonalAccounts", + "label": "Disable personal email accounts and calendars in Outlook", + "cat": "Exchange Standards", + "tag": [ + "CIS M365 7.0.0 (6.3.2)" + ], + "impact": "Low Impact", + "helpText": "Prevents users from adding personal email accounts (Outlook.com, Gmail, Yahoo) in the new Outlook for Windows and from connecting personal Outlook.com or Google calendars in Outlook on the web. Applies to the default OWA mailbox policy only, so exceptions can be made with a separate policy. Changes can take up to 60 minutes to apply and personal accounts already added are disabled.", + "executiveText": "Keeps personal email and calendar accounts out of the corporate Outlook client, so company data cannot be moved to a personal inbox that sits outside anti-malware scanning, data loss prevention and audit logging.", + "docsDescription": "Sets PersonalAccountsEnabled and PersonalAccountCalendarsEnabled on the default OWA mailbox policy (OwaMailboxPolicy-Default). Neither setting applies to classic Outlook for Windows, Outlook for Mac or Outlook mobile.", + "impactColour": "info", + "addedDate": "2026-10-10", + "powershellEquivalent": "Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -PersonalAccountsEnabled $false -PersonalAccountCalendarsEnabled $false", + "appliesToTest": [ + "CIS_6_3_2" + ], + "recommendedBy": [ + "CIS" + ], + "requiredCapabilities": [ + "EXCHANGE_S_STANDARD", + "EXCHANGE_S_ENTERPRISE", + "EXCHANGE_S_STANDARD_GOV", + "EXCHANGE_S_ENTERPRISE_GOV", + "EXCHANGE_LITE" + ], + "secureScoreImpact": 0, + "compare": "subset", + "variables": { + "personalAccountsEnabled": { + "type": "switch", + "label": "Allow personal email accounts in the new Outlook for Windows", + "default": false, + "recommended": false + }, + "personalAccountCalendarsEnabled": { + "type": "switch", + "label": "Allow personal Outlook.com and Google calendars in Outlook on the web", + "default": false, + "recommended": false + } + }, + "expected": { + "PersonalAccountsEnabled": "%personalAccountsEnabled%", + "PersonalAccountCalendarsEnabled": "%personalAccountCalendarsEnabled%" + }, + "read": { + "cacheType": "OwaMailboxPolicy", + "filter": [ + { + "property": "Identity", + "value": "OwaMailboxPolicy-Default" + } + ] + }, + "remediate": { + "executor": "ExoRequest", + "cmdlets": [ + { + "cmdlet": "Set-OwaMailboxPolicy", + "params": { + "Identity": "OwaMailboxPolicy-Default", + "PersonalAccountsEnabled": "%personalAccountsEnabled%", + "PersonalAccountCalendarsEnabled": "%personalAccountCalendarsEnabled%" + } + } + ] + } +} diff --git a/backend/Config/BaselineStandards/Exchange Standards/DisableResourceMailbox.json b/backend/Config/BaselineStandards/Exchange Standards/DisableResourceMailbox.json index afe04ac324..19de81ea19 100644 --- a/backend/Config/BaselineStandards/Exchange Standards/DisableResourceMailbox.json +++ b/backend/Config/BaselineStandards/Exchange Standards/DisableResourceMailbox.json @@ -48,6 +48,7 @@ "writes": [ { "method": "PATCH", + "asApp": false, "uri": "users/%id%", "body": { "accountEnabled": false diff --git a/backend/Config/BaselineStandards/Exchange Standards/DisableSharedMailbox.json b/backend/Config/BaselineStandards/Exchange Standards/DisableSharedMailbox.json index b38a4c6a02..9583b3ec66 100644 --- a/backend/Config/BaselineStandards/Exchange Standards/DisableSharedMailbox.json +++ b/backend/Config/BaselineStandards/Exchange Standards/DisableSharedMailbox.json @@ -45,6 +45,7 @@ "writes": [ { "method": "PATCH", + "asApp": false, "uri": "users/%id%", "body": { "accountEnabled": false diff --git a/backend/Config/BaselineStandards/Exchange Standards/MailboxDefaultAuditSet.json b/backend/Config/BaselineStandards/Exchange Standards/MailboxDefaultAuditSet.json new file mode 100644 index 0000000000..30edca20b6 --- /dev/null +++ b/backend/Config/BaselineStandards/Exchange Standards/MailboxDefaultAuditSet.json @@ -0,0 +1,37 @@ +{ + "name": "MailboxDefaultAuditSet", + "label": "Reset mailbox audit actions to the Microsoft defaults", + "cat": "Exchange Standards", + "tag": [], + "impact": "Low Impact", + "helpText": "Resets mailboxes with customised audit actions back to the Microsoft-managed default audit set for the Admin, Delegate and Owner sign-in types.", + "executiveText": "Ensures every mailbox records the full set of Microsoft-recommended audit events. Attackers and misconfiguration can trim the actions a mailbox audits, hiding activity during a compromise; this restores the defaults so investigations have complete audit trails.", + "docsDescription": "Finds user, shared and resource mailboxes whose DefaultAuditSet no longer contains Admin, Delegate and Owner - meaning the audited actions for that sign-in type were customised - and runs Set-Mailbox -DefaultAuditSet Admin,Delegate,Owner on them. Microsoft then manages the audited actions, including new actions it adds over time.", + "impactColour": "info", + "addedDate": "2026-10-09", + "powershellEquivalent": "Set-Mailbox -DefaultAuditSet Admin,Delegate,Owner", + "recommendedBy": [], + "requiredCapabilities": [ + "EXCHANGE_S_STANDARD", + "EXCHANGE_S_ENTERPRISE", + "EXCHANGE_S_STANDARD_GOV", + "EXCHANGE_S_ENTERPRISE_GOV", + "EXCHANGE_LITE" + ], + "secureScoreImpact": 0, + "compare": "subset", + "variables": {}, + "expected": { + "offenders": [] + }, + "read": { + "cacheType": "Mailboxes", + "collectorArgs": { + "Types": "None" + } + }, + "prepare": "Get-CIPPBaselineMailboxDefaultAuditSetState", + "remediate": { + "executor": "MailboxDefaultAuditSet" + } +} diff --git a/backend/Config/BaselineStandards/Global Secure Access/GlobalSecureAccessCompliantNetwork.json b/backend/Config/BaselineStandards/Global Secure Access/GlobalSecureAccessCompliantNetwork.json new file mode 100644 index 0000000000..774860fe78 --- /dev/null +++ b/backend/Config/BaselineStandards/Global Secure Access/GlobalSecureAccessCompliantNetwork.json @@ -0,0 +1,150 @@ +{ + "name": "GlobalSecureAccessCompliantNetwork", + "label": "Require a compliant network (Global Secure Access)", + "cat": "Global Secure Access", + "tag": [ + "HighImpact" + ], + "impact": "High Impact", + "helpText": "Makes stolen sign-in tokens useless off company devices using Entra ID P1: onboards the tenant to Global Secure Access, enables the Microsoft 365 traffic profile for all users, deploys the client through Intune (Windows and macOS) and creates a Conditional Access policy that blocks every sign-in not coming from the compliant network. The policy is created in report-only mode until 'Enforce the policy' is switched on. Admin roles, your break-glass accounts, Intune and Explicit Forward Proxy are excluded.", + "executiveText": "Routes staff sign-ins through Microsoft's secure edge, installs Microsoft's network client on company Windows and Mac computers, and blocks every sign-in that does not come from one of those computers, so a stolen password or sign-in token cannot be used from an attacker's machine. Starts in a monitoring mode.", + "docsDescription": "Grades the tenant setup (onboarded, Microsoft 365 profile enabled and assigned to all users, signaling on, compliant network location present), the Intune objects for the selected platforms and the policy (present, state, excluded roles and accounts). The client objects carry a configuration fingerprint and are redeployed only when it changes, so the standard runs checkBeforeRun false. It never disables signaling and refuses to enable the policy when no break-glass exclusion resolves.", + "impactColour": "error", + "addedDate": "2026-10-10", + "powershellEquivalent": "Update-MgBetaNetworkAccessForwardingProfile; Update-MgBetaNetworkAccessSettingConditionalAccess; Add-CIPPW32ScriptApplication; New-CIPPCAPolicy", + "recommendedBy": [ + "CIPP" + ], + "requiredCapabilities": [ + [ + "AAD_PREMIUM", + "AAD_PREMIUM_P2" + ], + [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] + ], + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, + "secureScoreImpact": 0, + "compare": "subset", + "variables": { + "deployWindows": { + "type": "switch", + "label": "Deploy the client to Windows", + "default": true + }, + "deployMacOS": { + "type": "switch", + "label": "Deploy the client to macOS", + "default": true + }, + "assignTo": { + "type": "autoComplete", + "creatable": false, + "label": "Which devices get the client?", + "default": "AllDevices", + "options": [ + { + "value": "AllDevices", + "label": "All devices" + }, + { + "value": "AllUsers", + "label": "All users" + }, + { + "value": "AllDevicesAndUsers", + "label": "All users and devices" + }, + { + "value": "customGroup", + "label": "A custom group (pilot)" + } + ] + }, + "customGroup": { + "type": "textField", + "label": "Custom group name (when 'A custom group' is selected, wildcards allowed)", + "omitWhenBlank": true + }, + "excludeGroup": { + "type": "textField", + "label": "Group name(s) to exclude from the client, comma separated (wildcards allowed)", + "omitWhenBlank": true + }, + "preferIPv4": { + "type": "switch", + "label": "Windows: prefer IPv4 over IPv6 (Microsoft's recommendation; the client tunnels IPv4 only; needs a restart)", + "default": true + }, + "lockDownClient": { + "type": "switch", + "label": "Lock down the client (hide Disable, Pause, Sign out and Disable Private Access; Windows also requires admin rights to disable)", + "default": true + }, + "enforce": { + "type": "switch", + "label": "Enforce the policy (off = report-only mode)", + "default": false, + "recommended": true + }, + "excludeAdminRoles": { + "type": "AdminRolesMultiSelect", + "multiple": true, + "label": "Admin roles to exclude from the policy", + "default": [ + "62e90394-69f5-4237-9190-012177145e10", + "194ae4cb-b126-40b2-bd5b-6091b380977d", + "b1be1c3e-b65d-4f19-8427-f6fa0d97feb9", + "ac434307-12b9-4fa1-a708-88bf58caabc1" + ] + }, + "excludeUsers": { + "type": "autoComplete", + "multiple": true, + "creatable": true, + "label": "Break-glass accounts to exclude (user principal names or display names)", + "omitWhenBlank": true + }, + "excludeGroups": { + "type": "autoComplete", + "multiple": true, + "creatable": true, + "label": "Groups to exclude from the policy (display names)", + "omitWhenBlank": true + }, + "useDetectedBreakGlass": { + "type": "switch", + "label": "Also exclude the break-glass account CIPP detects from your existing policies", + "default": true + } + }, + "read": { + "cacheType": "NetworkAccess" + }, + "prepare": "Get-CIPPBaselineGlobalSecureAccessCompliantNetworkState", + "remediate": { + "executor": "GlobalSecureAccessCompliantNetwork", + "deployWindows": "%deployWindows%", + "deployMacOS": "%deployMacOS%", + "assignTo": "%assignTo%", + "customGroup": "%customGroup%", + "excludeGroup": "%excludeGroup%", + "preferIPv4": "%preferIPv4%", + "lockDownClient": "%lockDownClient%", + "enforce": "%enforce%", + "excludeAdminRoles": "%excludeAdminRoles%", + "excludeUsers": "%excludeUsers%", + "excludeGroups": "%excludeGroups%", + "useDetectedBreakGlass": "%useDetectedBreakGlass%" + }, + "checkBeforeRun": false +} diff --git a/backend/Config/BaselineStandards/SharePoint Standards/OneDriveSharingCapability.json b/backend/Config/BaselineStandards/SharePoint Standards/OneDriveSharingCapability.json new file mode 100644 index 0000000000..04c2e7c8bd --- /dev/null +++ b/backend/Config/BaselineStandards/SharePoint Standards/OneDriveSharingCapability.json @@ -0,0 +1,71 @@ +{ + "name": "OneDriveSharingCapability", + "label": "Set Sharing Level for OneDrive", + "cat": "SharePoint Standards", + "tag": [ + "CIS M365 7.0.0 (7.2.4)" + ], + "impact": "High Impact", + "helpText": "Sets the external sharing level for OneDrive independently of SharePoint. OneDrive can be more restrictive than SharePoint but never more permissive, so set the SharePoint level (the 'Set Sharing Level for OneDrive and SharePoint' standard) at least as open as this one. CIS recommends 'Only people in your organization'.", + "executiveText": "Limits how far employees can share files from their personal OneDrive, which has less oversight than SharePoint sites. Restricting OneDrive sharing pushes external collaboration to SharePoint where site owners and tighter controls apply.", + "docsDescription": "Sets the tenant OneDrive sharing capability (Set-SPOTenant -OneDriveSharingCapability), which SharePoint CSOM exposes as ODBSharingCapability. Numeric CSOM values: 0 Disabled, 1 ExternalUserSharingOnly, 2 ExternalUserAndGuestSharing, 3 ExistingExternalUserSharingOnly.", + "impactColour": "danger", + "addedDate": "2026-10-10", + "powershellEquivalent": "Set-SPOTenant -OneDriveSharingCapability Disabled", + "appliesToTest": [ + "CIS_7_2_4" + ], + "recommendedBy": [ + "CIS" + ], + "requiredCapabilities": [ + "SHAREPOINTWAC", + "SHAREPOINTSTANDARD", + "SHAREPOINTENTERPRISE", + "SHAREPOINTENTERPRISE_EDU", + "ONEDRIVE_BASIC", + "ONEDRIVE_ENTERPRISE" + ], + "secureScoreImpact": 0, + "compare": "subset", + "variables": { + "sharingCapability": { + "type": "autoComplete", + "label": "OneDrive sharing level", + "required": true, + "default": 0, + "recommended": 0, + "options": [ + { + "label": "Only people in your organization. No external sharing is allowed.", + "value": 0 + }, + { + "label": "New and existing guests. Guests must sign in or provide a verification code.", + "value": 1 + }, + { + "label": "Anyone. Links that do not require sign-in.", + "value": 2 + }, + { + "label": "Existing guests only (those already in the directory).", + "value": 3 + } + ] + } + }, + "expected": { + "ODBSharingCapability": "%sharingCapability%" + }, + "read": { + "cacheType": "SPOTenant" + }, + "writeTarget": "spoTenant", + "remediate": { + "executor": "SPOTenant", + "properties": { + "ODBSharingCapability": "%sharingCapability%" + } + } +} diff --git a/backend/Config/BaselineStandards/Teams Standards/TeamsAppPermissionPolicy.json b/backend/Config/BaselineStandards/Teams Standards/TeamsAppPermissionPolicy.json new file mode 100644 index 0000000000..6c7dec9c38 --- /dev/null +++ b/backend/Config/BaselineStandards/Teams Standards/TeamsAppPermissionPolicy.json @@ -0,0 +1,107 @@ +{ + "name": "TeamsAppPermissionPolicy", + "label": "Global app permission policy for Microsoft Teams", + "cat": "Teams Standards", + "tag": [ + "CIS M365 7.0.0 (8.4.1)" + ], + "impact": "Medium Impact", + "helpText": "Sets which class of apps users may install through the Global (Org-wide default) app permission policy: Microsoft apps, third-party apps and custom apps are each either allowed except a block list, or blocked except an allow list. Only the mode is written; the policy's existing allow and block lists are kept. CIS recommends blocking third-party and custom apps by default and approving the apps the organization needs.", + "executiveText": "Prevents employees from installing unvetted third-party or custom apps into Teams, where a malicious app can read chats and files. Approved apps are added individually by IT.", + "docsDescription": "Writes DefaultCatalogAppsType (Microsoft apps), GlobalCatalogAppsType (third-party apps) and PrivateCatalogAppsType (custom apps) on the Global Teams app permission policy. 'AllowedAppList' with no listed apps blocks the whole class, matching 'Let users install and use available apps by default: Off' in the Teams admin center. Tenants that moved to app centric management manage the same outcome under Teams apps > Manage apps > Org-wide app settings.", + "impactColour": "warning", + "addedDate": "2026-10-10", + "powershellEquivalent": "Set-CsTeamsAppPermissionPolicy -Identity Global -GlobalCatalogAppsType AllowedAppList -PrivateCatalogAppsType AllowedAppList", + "appliesToTest": [ + "CIS_8_4_1" + ], + "recommendedBy": [ + "CIS" + ], + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ], + "secureScoreImpact": 0, + "compare": "subset", + "variables": { + "DefaultCatalogAppsType": { + "type": "autoComplete", + "label": "Microsoft apps", + "default": "BlockedAppList", + "recommended": "BlockedAppList", + "options": [ + { + "label": "Allow all apps except the block list", + "value": "BlockedAppList" + }, + { + "label": "Block all apps except the allow list", + "value": "AllowedAppList" + } + ] + }, + "GlobalCatalogAppsType": { + "type": "autoComplete", + "label": "Third-party apps", + "default": "AllowedAppList", + "recommended": "AllowedAppList", + "options": [ + { + "label": "Allow all apps except the block list", + "value": "BlockedAppList" + }, + { + "label": "Block all apps except the allow list", + "value": "AllowedAppList" + } + ] + }, + "PrivateCatalogAppsType": { + "type": "autoComplete", + "label": "Custom apps", + "default": "AllowedAppList", + "recommended": "AllowedAppList", + "options": [ + { + "label": "Allow all apps except the block list", + "value": "BlockedAppList" + }, + { + "label": "Block all apps except the allow list", + "value": "AllowedAppList" + } + ] + } + }, + "expected": { + "DefaultCatalogAppsType": "%DefaultCatalogAppsType%", + "GlobalCatalogAppsType": "%GlobalCatalogAppsType%", + "PrivateCatalogAppsType": "%PrivateCatalogAppsType%" + }, + "read": { + "cacheType": "CsTeamsAppPermissionPolicy", + "filter": [ + { + "property": "Identity", + "value": "Global" + } + ] + }, + "remediate": { + "executor": "TeamsRequest", + "cmdlets": [ + { + "cmdlet": "Set-CsTeamsAppPermissionPolicy", + "params": { + "DefaultCatalogAppsType": "%DefaultCatalogAppsType%", + "GlobalCatalogAppsType": "%GlobalCatalogAppsType%", + "PrivateCatalogAppsType": "%PrivateCatalogAppsType%" + } + } + ] + } +} diff --git a/backend/Config/BaselineStandards/Teams Standards/TeamsBlockTrialTenants.json b/backend/Config/BaselineStandards/Teams Standards/TeamsBlockTrialTenants.json new file mode 100644 index 0000000000..d551ad69c3 --- /dev/null +++ b/backend/Config/BaselineStandards/Teams Standards/TeamsBlockTrialTenants.json @@ -0,0 +1,65 @@ +{ + "name": "TeamsBlockTrialTenants", + "label": "Block communication with trial-only Teams tenants", + "cat": "Teams Standards", + "tag": [ + "CIS M365 7.0.0 (8.2.4)" + ], + "impact": "Low Impact", + "helpText": "Controls whether users can chat, call and meet with accounts in Teams tenants that have no purchased seats (trial-only tenants). Microsoft blocks this by default since July 2024 because threat actors abuse trial tenants; this standard keeps it blocked. When blocked, users from trial-only tenants are removed from existing chats.", + "executiveText": "Stops attackers who spin up free trial Teams tenants from reaching employees through chats, calls and meetings, closing an entry point used for phishing and malware delivery.", + "docsDescription": "Sets ExternalAccessWithTrialTenants on the tenant federation configuration (Teams admin center > External access > Organization settings > 'People in my organization can communicate with accounts in trial Teams tenant').", + "impactColour": "info", + "addedDate": "2026-10-10", + "powershellEquivalent": "Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants Blocked", + "appliesToTest": [ + "CIS_8_2_4" + ], + "recommendedBy": [ + "CIS" + ], + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ], + "secureScoreImpact": 0, + "compare": "subset", + "variables": { + "state": { + "type": "autoComplete", + "label": "Communication with trial-only Teams tenants", + "default": "Blocked", + "recommended": "Blocked", + "options": [ + { + "label": "Blocked", + "value": "Blocked" + }, + { + "label": "Allowed", + "value": "Allowed" + } + ] + } + }, + "expected": { + "ExternalAccessWithTrialTenants": "%state%" + }, + "read": { + "cacheType": "CsTenantFederationConfiguration" + }, + "remediate": { + "executor": "TeamsRequest", + "cmdlets": [ + { + "cmdlet": "Set-CsTenantFederationConfiguration", + "params": { + "ExternalAccessWithTrialTenants": "%state%" + } + } + ] + } +} diff --git a/backend/Config/BaselineStandards/Teams Standards/TeamsDisableResourceAccounts.json b/backend/Config/BaselineStandards/Teams Standards/TeamsDisableResourceAccounts.json index aee7dd06e7..cb5d5821c8 100644 --- a/backend/Config/BaselineStandards/Teams Standards/TeamsDisableResourceAccounts.json +++ b/backend/Config/BaselineStandards/Teams Standards/TeamsDisableResourceAccounts.json @@ -41,6 +41,7 @@ "writes": [ { "method": "PATCH", + "asApp": false, "uri": "users/%id%", "body": { "accountEnabled": false diff --git a/backend/Config/BaselineStandards/Teams Standards/TeamsFilesPolicy.json b/backend/Config/BaselineStandards/Teams Standards/TeamsFilesPolicy.json new file mode 100644 index 0000000000..cc64a5efe9 --- /dev/null +++ b/backend/Config/BaselineStandards/Teams Standards/TeamsFilesPolicy.json @@ -0,0 +1,115 @@ +{ + "name": "TeamsFilesPolicy", + "label": "Global Files Policy for Microsoft Teams", + "cat": "Teams Standards", + "tag": [], + "impact": "Low Impact", + "helpText": "Sets the properties of the Global Teams files policy, including file sharing in external (federated) chats.", + "executiveText": "Controls whether employees can attach files directly in Microsoft Teams chats with people outside the organization. Microsoft is enabling this by default for all tenants, including those that had turned it off, so managing it as a standard keeps the organization's chosen external sharing posture in place.", + "docsDescription": "Sets the properties of the Global Teams files policy. File sharing in external chats controls whether users can attach files in 1:1, group and meeting chats with people from other organizations. Native file entry points controls the OneDrive and SharePoint attach options in chats and channels, and SharePoint channel files tab controls the SharePoint Files tab in channels.", + "impactColour": "info", + "addedDate": "2026-09-28", + "powershellEquivalent": "Set-CsTeamsFilesPolicy -Identity Global -FileSharingInChatsWithExternalUsers Disabled", + "recommendedBy": [ + "CIPP" + ], + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ], + "secureScoreImpact": 0, + "compare": "subset", + "variables": { + "FileSharingInChatsWithExternalUsers": { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "File sharing in external chats", + "omitWhenBlank": true, + "options": [ + { + "label": "Don't change", + "value": "" + }, + { + "label": "Enabled", + "value": "Enabled" + }, + { + "label": "Disabled", + "value": "Disabled" + } + ], + "default": "Disabled", + "recommended": "Disabled" + }, + "NativeFileEntryPoints": { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "OneDrive and SharePoint file entry points", + "omitWhenBlank": true, + "options": [ + { + "label": "Don't change", + "value": "" + }, + { + "label": "Enabled", + "value": "Enabled" + }, + { + "label": "Disabled", + "value": "Disabled" + } + ], + "default": "" + }, + "SPChannelFilesTab": { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "SharePoint channel files tab", + "omitWhenBlank": true, + "options": [ + { + "label": "Don't change", + "value": "" + }, + { + "label": "Enabled", + "value": "Enabled" + }, + { + "label": "Disabled", + "value": "Disabled" + } + ], + "default": "" + } + }, + "expected": { + "FileSharingInChatsWithExternalUsers": "%FileSharingInChatsWithExternalUsers%", + "NativeFileEntryPoints": "%NativeFileEntryPoints%", + "SPChannelFilesTab": "%SPChannelFilesTab%" + }, + "read": { + "cacheType": "CsTeamsFilesPolicy" + }, + "remediate": { + "executor": "TeamsRequest", + "cmdlets": [ + { + "cmdlet": "Set-CsTeamsFilesPolicy", + "params": { + "FileSharingInChatsWithExternalUsers": "%FileSharingInChatsWithExternalUsers%", + "NativeFileEntryPoints": "%NativeFileEntryPoints%", + "SPChannelFilesTab": "%SPChannelFilesTab%" + } + } + ] + } +} diff --git a/backend/Config/BaselineStandards/Teams Standards/TeamsGlobalMeetingPolicy.json b/backend/Config/BaselineStandards/Teams Standards/TeamsGlobalMeetingPolicy.json index abed7caa5e..eeb71091d0 100644 --- a/backend/Config/BaselineStandards/Teams Standards/TeamsGlobalMeetingPolicy.json +++ b/backend/Config/BaselineStandards/Teams Standards/TeamsGlobalMeetingPolicy.json @@ -20,11 +20,11 @@ "meeting_pstnusersbypasslobby_v1" ], "impact": "Low Impact", - "helpText": "Defines the CIS recommended global meeting policy for Teams. This includes AllowAnonymousUsersToJoinMeeting, AllowAnonymousUsersToStartMeeting, AutoAdmittedUsers, AllowPSTNUsersToBypassLobby, MeetingChatEnabledType, DesignatedPresenterRoleMode, AllowExternalParticipantGiveRequestControl, AllowParticipantGiveRequestControl", + "helpText": "Defines the CIS recommended global meeting policy for Teams. This includes AllowAnonymousUsersToJoinMeeting, AllowAnonymousUsersToStartMeeting, AutoAdmittedUsers, AllowPSTNUsersToBypassLobby, MeetingChatEnabledType, DesignatedPresenterRoleMode, AllowExternalParticipantGiveRequestControl, AllowParticipantGiveRequestControl, ExternalBotAccessMode", "executiveText": "Establishes security-focused default settings for Teams meetings, controlling who can join meetings, present content, and participate in chats. These policies balance collaboration needs with security requirements, ensuring meetings remain productive while protecting against unauthorized access and disruption.", "impactColour": "info", "addedDate": "2024-11-12", - "powershellEquivalent": "Set-CsTeamsMeetingPolicy -AllowAnonymousUsersToJoinMeeting $false -AllowAnonymousUsersToStartMeeting $false -AutoAdmittedUsers $AutoAdmittedUsers -AllowPSTNUsersToBypassLobby $false -MeetingChatEnabledType EnabledExceptAnonymous -DesignatedPresenterRoleMode $DesignatedPresenterRoleMode -AllowExternalParticipantGiveRequestControl $false -AllowParticipantGiveRequestControl $false", + "powershellEquivalent": "Set-CsTeamsMeetingPolicy -AllowAnonymousUsersToJoinMeeting $false -AllowAnonymousUsersToStartMeeting $false -AutoAdmittedUsers $AutoAdmittedUsers -AllowPSTNUsersToBypassLobby $false -MeetingChatEnabledType EnabledExceptAnonymous -DesignatedPresenterRoleMode $DesignatedPresenterRoleMode -AllowExternalParticipantGiveRequestControl $false -AllowParticipantGiveRequestControl $false -ExternalBotAccessMode $ExternalBotAccessMode", "appliesToTest": [ "CIS_8_5_1", "CIS_8_5_2", @@ -179,6 +179,19 @@ ], "default": "", "recommended": false + }, + "ExternalBotAccessMode": { + "type": "autoComplete", + "label": "External meeting bots", + "helperText": "Detected external bots and AI note takers either wait in the lobby for approval or are treated like any other participant. Leave blank to keep the tenant's current value.", + "omitWhenBlank": true, + "options": [ + { "label": "Keep the tenant's current value", "value": "" }, + { "label": "Require approval when detected (Microsoft default)", "value": "RequireApprovalWhenDetected" }, + { "label": "Allow all bots", "value": "AllowAllBots" } + ], + "default": "", + "recommended": false } }, "expected": { @@ -191,7 +204,8 @@ "AllowExternalParticipantGiveRequestControl": "%AllowExternalParticipantGiveRequestControl%", "AllowParticipantGiveRequestControl": "%AllowParticipantGiveRequestControl%", "AllowExternalNonTrustedMeetingChat": "%AllowExternalNonTrustedMeetingChat%", - "AllowCloudRecording": "%AllowCloudRecording%" + "AllowCloudRecording": "%AllowCloudRecording%", + "ExternalBotAccessMode": "%ExternalBotAccessMode%" }, "read": { "cacheType": "CsTeamsMeetingPolicy" @@ -211,7 +225,8 @@ "AllowExternalParticipantGiveRequestControl": "%AllowExternalParticipantGiveRequestControl%", "AllowParticipantGiveRequestControl": "%AllowParticipantGiveRequestControl%", "AllowExternalNonTrustedMeetingChat": "%AllowExternalNonTrustedMeetingChat%", - "AllowCloudRecording": "%AllowCloudRecording%" + "AllowCloudRecording": "%AllowCloudRecording%", + "ExternalBotAccessMode": "%ExternalBotAccessMode%" } } ] diff --git a/backend/Config/BaselineStandards/Teams Standards/TeamsMessagingPolicy.json b/backend/Config/BaselineStandards/Teams Standards/TeamsMessagingPolicy.json index 38bc74a5c8..2873cdb969 100644 --- a/backend/Config/BaselineStandards/Teams Standards/TeamsMessagingPolicy.json +++ b/backend/Config/BaselineStandards/Teams Standards/TeamsMessagingPolicy.json @@ -85,6 +85,28 @@ "type": "switch", "label": "Allow reporting message as inappropriate content", "default": true + }, + "AutoShareFilesInExternalChats": { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Automatically share files attached in external chats", + "omitWhenBlank": true, + "options": [ + { + "label": "Don't change", + "value": "" + }, + { + "label": "Enabled", + "value": "Enabled" + }, + { + "label": "Disabled", + "value": "Disabled" + } + ], + "default": "" } }, "expected": { @@ -96,7 +118,8 @@ "CreateCustomEmojis": "%CreateCustomEmojis%", "DeleteCustomEmojis": "%DeleteCustomEmojis%", "AllowSecurityEndUserReporting": "%AllowSecurityEndUserReporting%", - "AllowCommunicationComplianceEndUserReporting": "%AllowCommunicationComplianceEndUserReporting%" + "AllowCommunicationComplianceEndUserReporting": "%AllowCommunicationComplianceEndUserReporting%", + "AutoShareFilesInExternalChats": "%AutoShareFilesInExternalChats%" }, "read": { "cacheType": "CsTeamsMessagingPolicy" @@ -115,7 +138,8 @@ "CreateCustomEmojis": "%CreateCustomEmojis%", "DeleteCustomEmojis": "%DeleteCustomEmojis%", "AllowSecurityEndUserReporting": "%AllowSecurityEndUserReporting%", - "AllowCommunicationComplianceEndUserReporting": "%AllowCommunicationComplianceEndUserReporting%" + "AllowCommunicationComplianceEndUserReporting": "%AllowCommunicationComplianceEndUserReporting%", + "AutoShareFilesInExternalChats": "%AutoShareFilesInExternalChats%" } } ] diff --git a/backend/Config/BecHeuristics.json b/backend/Config/BecHeuristics.json index 72f30d3663..3ed800f9e7 100644 --- a/backend/Config/BecHeuristics.json +++ b/backend/Config/BecHeuristics.json @@ -1,6 +1,7 @@ { "window": { - "days": 7 + "days": 7, + "premiumDays": 30 }, "caps": { "auditLogPages": 10, diff --git a/backend/Config/CIPPDBCacheTypes.json b/backend/Config/CIPPDBCacheTypes.json index bae09a97b5..182e2f7fd5 100644 --- a/backend/Config/CIPPDBCacheTypes.json +++ b/backend/Config/CIPPDBCacheTypes.json @@ -732,6 +732,11 @@ "friendlyName": "Group Usage Sources", "description": "Refreshes every cache type that feeds the group usage report (groups, Conditional Access, Intune, roles, app assignments, licenses, transport rules); writes no rows of its own" }, + { + "type": "NetworkAccess", + "friendlyName": "Global Secure Access", + "description": "Global Secure Access onboarding status, traffic forwarding profiles with their policy groups and assignment, and Conditional Access signaling" + }, { "type": "RolesAndAssignments", "friendlyName": "Roles & Assignments Sources", diff --git a/backend/Config/FeatureFlags.json b/backend/Config/FeatureFlags.json index 506fa9f4f1..3a29398a39 100644 --- a/backend/Config/FeatureFlags.json +++ b/backend/Config/FeatureFlags.json @@ -26,8 +26,9 @@ { "Id": "MCPServer", "Name": "MCP Server", - "Description": "Model Context Protocol (MCP) server endpoint that exposes CIPP's read-only API surface as tools for AI clients. Disabled by default; enable to allow MCP access.", - "Enabled": false, + "Description": "Model Context Protocol (MCP) server endpoint that exposes Manage365's read-only API surface as tools for AI clients.", + "Enabled": true, + "EnabledWhen": "DefaultOn", "AllowUserToggle": true, "Timers": [], "Endpoints": ["ExecMcp"], diff --git a/backend/Config/IntegrationTemplates.json b/backend/Config/IntegrationTemplates.json new file mode 100644 index 0000000000..e8c5881e4e --- /dev/null +++ b/backend/Config/IntegrationTemplates.json @@ -0,0 +1,31 @@ +[ + { + "id": "unifi-identity", + "name": "UniFi Identity", + "description": "Entra ID sync for UniFi Identity Enterprise. Creates an app registration with User.Read.All and Group.Read.All permissions for directory synchronization.", + "appNamePattern": "UniFi Identity - {TenantName}", + "redirectUris": [], + "permissions": [ + { + "resource": "Microsoft Graph", + "resourceAppId": "00000003-0000-0000-c000-000000000000", + "permissions": [ + { + "id": "df021288-bdef-4463-88db-98f22de89214", + "name": "User.Read.All", + "type": "Role" + }, + { + "id": "5b567255-7703-4780-807c-7be8301ae99b", + "name": "Group.Read.All", + "type": "Role" + } + ] + } + ], + "generateSecret": true, + "secretExpirationDays": 730, + "documentationUrl": "https://help.ui.com/hc/en-us/articles/24805196259607-UniFi-Identity-Enterprise-Entra-ID-Setup", + "isBuiltIn": true + } +] diff --git a/backend/Config/MicrosoftFirstPartyApps.json b/backend/Config/MicrosoftFirstPartyApps.json index 87d04ebd17..56c13dc976 100644 --- a/backend/Config/MicrosoftFirstPartyApps.json +++ b/backend/Config/MicrosoftFirstPartyApps.json @@ -42,7 +42,7 @@ "38049638-cc2c-4cde-abe4-4479d721ed44": "Microsoft Approval Management", "65d91a3d-ab74-42e6-8a2f-0add61688c74": "Microsoft Approval Management", "29d9ed98-a469-4536-ade2-f981bc1d605e": "Microsoft Authentication Broker", - "4813382a-8fa7-425e-ab75-3b753aab3abb": "Microsoft Authenticator App", + "4813382a-8fa7-425e-ab75-3b753aab3ab\u0062": "Microsoft Authenticator App", "04b07795-8ddb-461a-bbee-02f9e1bf7b46": "Microsoft Azure CLI", "1950a258-227b-4e31-a9cf-717495945fc2": "Microsoft Azure PowerShell", "1786c5ed-9644-47b2-8aa0-7201292175b6": "Microsoft Bing Default Search Engine", @@ -71,7 +71,7 @@ "d176f6e7-38e5-40c9-8a78-3998aab820e7": "Microsoft Online Syndication Partner Portal", "5d661950-3475-41cd-a2c3-d671a3162bc1": "Microsoft Outlook", "93625bc8-bfe2-437a-97e0-3d0060024faa": "Microsoft password reset service", - "871c010f-5e61-4fb1-83ac-98610a7e9110": "Microsoft Power BI", + "871c010f-5e61-4fb1-83ac-98610a7e911\u0030": "Microsoft Power BI", "a4a365df-50f1-4397-bc59-1a1564b8bb9c": "Microsoft Remote Desktop", "28b567f6-162c-4f54-99a0-6887f387bbcc": "Microsoft Storefronts", "cf53fce8-def6-4aeb-8d30-b158e7b1cf83": "Microsoft Stream Portal", diff --git a/backend/Config/PermissionsTranslator.json b/backend/Config/PermissionsTranslator.json index 2c02810c24..eca104ae09 100644 --- a/backend/Config/PermissionsTranslator.json +++ b/backend/Config/PermissionsTranslator.json @@ -18,7 +18,9 @@ "displayName": "Send emails from mailboxes using SMTP AUTH.", "id": "258f6531-6087-4cc4-bb90-092c5fb3ed3f", "origin": "Delegated (Microsoft Graph)", - "value": "SMTP.Send" + "value": "SMTP.Send", + "userConsentDisplayName": "Access to sending emails from your mailbox.", + "userConsentDescription": "Allows the app to send emails on your behalf from your mailbox." }, { "description": "Allows the app to read your organization's SPIFFE trust domains and child resources on behalf of the user.", @@ -53,21 +55,27 @@ "displayName": "Read subject rights requests", "id": "9c3af74c-fd0f-4db4-b17a-71939e2a9d77", "origin": "Delegated (Microsoft Graph)", - "value": "SubjectRightsRequest.Read.All" + "value": "SubjectRightsRequest.Read.All", + "userConsentDisplayName": "Read data subject requests", + "userConsentDescription": "Allows the app to read subject rights requests on your behalf." }, { "description": "Allows the app to read and write subject rights requests on behalf of the signed-in user", "displayName": "Read and write subject rights requests", "id": "2b8fcc74-bce1-4ae3-a0e8-60c53739299d", "origin": "Delegated (Microsoft Graph)", - "value": "SubjectRightsRequest.ReadWrite.All" + "value": "SubjectRightsRequest.ReadWrite.All", + "userConsentDisplayName": "Read and write data subject requests", + "userConsentDescription": "Allows the app to read and write subject rights requests on your behalf." }, { "description": "Allows the app to read all webhook subscriptions on behalf of the signed-in user.", "displayName": "Read all webhook subscriptions ", "id": "5f88184c-80bb-4d52-9ff2-757288b2e9b7", "origin": "Delegated (Microsoft Graph)", - "value": "Subscription.Read.All" + "value": "Subscription.Read.All", + "userConsentDisplayName": "Read all webhook subscriptions ", + "userConsentDescription": "Allows the app to read all webhook subscriptions on your behalf." }, { "description": "Allows the app to read Azure AD synchronization information, on behalf of the signed-in user.", @@ -95,63 +103,81 @@ "displayName": "Read user's tasks and task lists", "id": "f45671fb-e0fe-4b4b-be20-3d3ce43f1bcb", "origin": "Delegated (Microsoft Graph)", - "value": "Tasks.Read" + "value": "Tasks.Read", + "userConsentDisplayName": "Read your tasks and task lists", + "userConsentDescription": "Allows the app to read your tasks and task lists, including any shared with you. Doesn't include permission to create, delete, or update anything." }, { "description": "Allows the app to read tasks a user has permissions to access, including their own and shared tasks.", "displayName": "Read user and shared tasks", "id": "88d21fd4-8e5a-4c32-b5e2-4a1c95f34f72", "origin": "Delegated (Microsoft Graph)", - "value": "Tasks.Read.Shared" + "value": "Tasks.Read.Shared", + "userConsentDisplayName": "Read your and shared tasks", + "userConsentDescription": "Allows the app to read tasks you have permissions to access, including your own and shared tasks." }, { "description": "Allows the app to create, read, update, and delete the signed-in user's tasks and task lists, including any shared with the user.", "displayName": "Create, read, update, and delete user’s tasks and task lists", "id": "2219042f-cab5-40cc-b0d2-16b1540b4c5f", "origin": "Delegated (Microsoft Graph)", - "value": "Tasks.ReadWrite" + "value": "Tasks.ReadWrite", + "userConsentDisplayName": "Create, read, update, and delete your tasks and task lists", + "userConsentDescription": "Allows the app to create, read, update, and delete your tasks and task lists, including any shared with you." }, { "description": "Allows the app to create, read, update, and delete tasks a user has permissions to, including their own and shared tasks.", "displayName": "Read and write user and shared tasks", "id": "c5ddf11b-c114-4886-8558-8a4e557cd52b", "origin": "Delegated (Microsoft Graph)", - "value": "Tasks.ReadWrite.Shared" + "value": "Tasks.ReadWrite.Shared", + "userConsentDisplayName": "Read and write to your and shared tasks", + "userConsentDescription": "Allows the app to read, update, create, and delete tasks you have permissions to access, including your own and shared tasks." }, { "description": "Allows the app to create teams on behalf of the signed-in user.", "displayName": "Create teams", "id": "7825d5d6-6049-4ce7-bdf6-3b8d53f4bcd0", "origin": "Delegated (Microsoft Graph)", - "value": "Team.Create" + "value": "Team.Create", + "userConsentDisplayName": "Create teams", + "userConsentDescription": "Allows the app to create teams on your behalf. " }, { "description": "Allows the application to edit or delete documents and list items in all site collections on behalf of the signed-in user.", "displayName": "Edit or delete items in all site collections", "id": "89fe6a52-be36-487e-b7d8-d061c450a026", "origin": "Delegated (Microsoft Graph)", - "value": "Sites.ReadWrite.All" + "value": "Sites.ReadWrite.All", + "userConsentDisplayName": "Edit or delete items in all site collections", + "userConsentDescription": "Allow the application to edit or delete documents and list items in all site collections on your behalf." }, { "description": "Read the names and descriptions of teams, on behalf of the signed-in user.", "displayName": "Read the names and descriptions of teams", "id": "485be79e-c497-4b35-9400-0e3fa7f2a5d4", "origin": "Delegated (Microsoft Graph)", - "value": "Team.ReadBasic.All" + "value": "Team.ReadBasic.All", + "userConsentDisplayName": "Read the names and descriptions of teams", + "userConsentDescription": "Read the names and descriptions of teams, on your behalf." }, { "description": "Allows the application to read documents and list items in all site collections on behalf of the signed-in user", "displayName": "Read items in all site collections", "id": "205e70e5-aba6-4c52-a976-6d2d46c48043", "origin": "Delegated (Microsoft Graph)", - "value": "Sites.Read.All" + "value": "Sites.Read.All", + "userConsentDisplayName": "Read items in all site collections", + "userConsentDescription": "Allow the application to read documents and list items in all site collections on your behalf" }, { "description": "Allows the application to have full control of all site collections on behalf of the signed-in user.", "displayName": "Have full control of all site collections", "id": "5a54b8b3-347c-476d-8f8e-42d5c7424d29", "origin": "Delegated (Microsoft Graph)", - "value": "Sites.FullControl.All" + "value": "Sites.FullControl.All", + "userConsentDisplayName": "Have full control of all your site collections", + "userConsentDescription": "Allow the application to have full control of all site collections on your behalf." }, { "description": "Allows the app to read all Microsoft 365 Web service activity, on behalf of the signed-in user.", @@ -179,35 +205,45 @@ "displayName": "Read service health", "id": "55896846-df78-47a7-aa94-8d3d4442ca7f", "origin": "Delegated (Microsoft Graph)", - "value": "ServiceHealth.Read.All" + "value": "ServiceHealth.Read.All", + "userConsentDisplayName": "Read service health", + "userConsentDescription": "Allows the app to read your tenant's service health information on your behalf.Health information may include service issues or service health overviews." }, { "description": "Allows the app to read your tenant's service announcement messages on behalf of the signed-in user. Messages may include information about new or changed features.", "displayName": "Read service announcement messages", "id": "eda39fa6-f8cf-4c3c-a909-432c683e4c9b", "origin": "Delegated (Microsoft Graph)", - "value": "ServiceMessage.Read.All" + "value": "ServiceMessage.Read.All", + "userConsentDisplayName": "Read service messages", + "userConsentDescription": "Allows the app to read your tenant's service announcement messages on your behalf. Messages may include information about new or changed features." }, { "description": "Allows the app to update service announcement messages' user status on behalf of the signed-in user. The message status can be marked as read, archive, or favorite.", "displayName": "Update user status on service announcement messages", "id": "636e1b0b-1cc2-4b1c-9aa9-4eeed9b9761b", "origin": "Delegated (Microsoft Graph)", - "value": "ServiceMessageViewpoint.Write" + "value": "ServiceMessageViewpoint.Write", + "userConsentDisplayName": "Update your user status on service announcement messages", + "userConsentDescription": "Allows the app to update service announcement messages' status on your behalf. Your status for messages can be marked as read, archive, or favorite." }, { "description": "Allows the app to read service principal endpoints", "displayName": "Read service principal endpoints", "id": "9f9ce928-e038-4e3b-8faf-7b59049a8ddc", "origin": "Delegated (Microsoft Graph)", - "value": "ServicePrincipalEndpoint.Read.All" + "value": "ServicePrincipalEndpoint.Read.All", + "userConsentDisplayName": "Read service principal endpoints", + "userConsentDescription": "Allows the app to read service principal endpoints" }, { "description": "Allows the app to update service principal endpoints", "displayName": "Read and update service principal endpoints", "id": "7297d82c-9546-4aed-91df-3d4f0a9b3ff0", "origin": "Delegated (Microsoft Graph)", - "value": "ServicePrincipalEndpoint.ReadWrite.All" + "value": "ServicePrincipalEndpoint.ReadWrite.All", + "userConsentDisplayName": "Read and update service principal endpoints", + "userConsentDescription": "Allows the app to update service principal endpoints" }, { "description": "Allows the app to read, write and manage your tenant's SharePoint Cross-Tenant migration settings and tasks, on behalf of the signed-in user.", @@ -228,28 +264,36 @@ "displayName": "Read SharePoint and OneDrive tenant settings", "id": "2ef70e10-5bfd-4ede-a5f6-67720500b258", "origin": "Delegated (Microsoft Graph)", - "value": "SharePointTenantSettings.Read.All" + "value": "SharePointTenantSettings.Read.All", + "userConsentDisplayName": "Read SharePoint and OneDrive tenant settings", + "userConsentDescription": "Allows the application to read the tenant-level settings in SharePoint and OneDrive on your behalf." }, { "description": "Allows the application to read and change the tenant-level settings of SharePoint and OneDrive on behalf of the signed-in user.", "displayName": "Read and change SharePoint and OneDrive tenant settings", "id": "aa07f155-3612-49b8-a147-6c590df35536", "origin": "Delegated (Microsoft Graph)", - "value": "SharePointTenantSettings.ReadWrite.All" + "value": "SharePointTenantSettings.ReadWrite.All", + "userConsentDisplayName": "Read and change SharePoint and OneDrive tenant settings", + "userConsentDescription": "Allows the application to read and change the tenant-level settings of SharePoint and OneDrive on your behalf." }, { "description": "Allows the app to read all the short notes a sign-in user has access to.", "displayName": "Read short notes of the signed-in user", "id": "50f66e47-eb56-45b7-aaa2-75057d9afe08", "origin": "Delegated (Microsoft Graph)", - "value": "ShortNotes.Read" + "value": "ShortNotes.Read", + "userConsentDisplayName": "Read your short notes", + "userConsentDescription": "Allows the app to read your short notes." }, { "description": "Allows the app to read, create, edit, and delete short notes of a signed-in user.", "displayName": "Read, create, edit, and delete short notes of the signed-in user", "id": "328438b7-4c01-4c07-a840-e625a749bb89", "origin": "Delegated (Microsoft Graph)", - "value": "ShortNotes.ReadWrite" + "value": "ShortNotes.ReadWrite", + "userConsentDisplayName": "Read, create, edit, and delete your short notes", + "userConsentDescription": "Allows the app to read, create, edit, and delete your short notes." }, { "description": "Allows the app to read your organization's sign-in identifiers, on behalf of the signed-in user.", @@ -277,28 +321,36 @@ "displayName": "Create, edit, and delete items and lists in all site collections", "id": "65e50fdc-43b7-4915-933e-e8138f11f40a", "origin": "Delegated (Microsoft Graph)", - "value": "Sites.Manage.All" + "value": "Sites.Manage.All", + "userConsentDisplayName": "Create, edit, and delete items and lists in all your site collections", + "userConsentDescription": "Allow the application to create or delete document libraries and lists in all site collections on your behalf." }, { "description": "Read the members of teams, on behalf of the signed-in user.", "displayName": "Read the members of teams", "id": "2497278c-d82d-46a2-b1ce-39d4cdde5570", "origin": "Delegated (Microsoft Graph)", - "value": "TeamMember.Read.All" + "value": "TeamMember.Read.All", + "userConsentDisplayName": "Read the members of teams", + "userConsentDescription": "Read the members of teams, on your behalf." }, { "description": "Add and remove members from teams, on behalf of the signed-in user. Also allows changing a member's role, for example from owner to non-owner.", "displayName": "Add and remove members from teams", "id": "4a06efd2-f825-4e34-813e-82a57b03d1ee", "origin": "Delegated (Microsoft Graph)", - "value": "TeamMember.ReadWrite.All" + "value": "TeamMember.ReadWrite.All", + "userConsentDisplayName": "Add and remove members from teams and channels", + "userConsentDescription": "Add and remove members from teams, on your behalf. Also allows changing a member's role, for example from owner to non-owner." }, { "description": "Add and remove members from all teams, on behalf of the signed-in user. Does not allow adding or removing a member with the owner role. Additionally, does not allow the app to elevate an existing member to the owner role.", "displayName": "Add and remove members with non-owner role for all teams", "id": "2104a4db-3a2f-4ea0-9dba-143d457dc666", "origin": "Delegated (Microsoft Graph)", - "value": "TeamMember.ReadWriteNonOwnerRole.All" + "value": "TeamMember.ReadWriteNonOwnerRole.All", + "userConsentDisplayName": "Add and remove members with non-owner role for all teams", + "userConsentDescription": "Add and remove members from all teams, on your behalf. Does not allow adding or removing a member with the owner role. Additionally, does not allow the app to elevate an existing member to the owner role." }, { "description": "Allows the app to read, install, upgrade, and uninstall selected Teams apps installed for the signed in user. Does not give the ability to read application-specific settings.", @@ -312,35 +364,45 @@ "displayName": "Allow the Teams app to manage itself in chats", "id": "0ce33576-30e8-43b7-99e5-62f8569a4002", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsAppInstallation.ReadWriteSelfForChat" + "value": "TeamsAppInstallation.ReadWriteSelfForChat", + "userConsentDisplayName": "Allow the Teams app to manage itself in chats", + "userConsentDescription": "Allows a Teams app to read, install, upgrade, and uninstall itself in chats you can access." }, { "description": "Allows a Teams app to read, install, upgrade, and uninstall itself to teams the signed-in user can access.", "displayName": "Allow the app to manage itself in teams", "id": "0f4595f7-64b1-4e13-81bc-11a249df07a9", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsAppInstallation.ReadWriteSelfForTeam" + "value": "TeamsAppInstallation.ReadWriteSelfForTeam", + "userConsentDisplayName": "Allow the Teams app to manage itself in teams", + "userConsentDescription": "Allows a Teams app to read, install, upgrade, and uninstall itself to teams you can access." }, { "description": "Allows a Teams app to read, install, upgrade, and uninstall itself for the signed-in user.", "displayName": "Allow the Teams app to manage itself for a user", "id": "207e0cb1-3ce7-4922-b991-5a760c346ebc", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsAppInstallation.ReadWriteSelfForUser" + "value": "TeamsAppInstallation.ReadWriteSelfForUser", + "userConsentDisplayName": "Allow the Teams app to manage itself for you", + "userConsentDescription": "Allows a Teams app to read, install, upgrade, and uninstall itself for you." }, { "description": "Read all teams' settings, on behalf of the signed-in user.", "displayName": "Read teams' settings", "id": "48638b3c-ad68-4383-8ac4-e6880ee6ca57", "origin": "Delegated (Microsoft Graph)", - "value": "TeamSettings.Read.All" + "value": "TeamSettings.Read.All", + "userConsentDisplayName": "Read teams' settings", + "userConsentDescription": "Read all teams' settings, on your behalf." }, { "description": "Read and change all teams' settings, on behalf of the signed-in user.", "displayName": "Read and change teams' settings", "id": "39d65650-9d3e-4223-80db-a335590d027e", "origin": "Delegated (Microsoft Graph)", - "value": "TeamSettings.ReadWrite.All" + "value": "TeamSettings.ReadWrite.All", + "userConsentDisplayName": "Read and change teams' settings", + "userConsentDescription": "Read and change all teams' settings, on your behalf." }, { "description": "Allow the app to read or write/update the policy assignment and unassigment for Teams users for all policy type categories.", @@ -361,63 +423,81 @@ "displayName": "Create tabs in Microsoft Teams.", "id": "a9ff19c2-f369-4a95-9a25-ba9d460efc8e", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsTab.Create" + "value": "TeamsTab.Create", + "userConsentDisplayName": "Create tabs in Microsoft Teams.", + "userConsentDescription": "Allows the app to create tabs in any team in Microsoft Teams, on your behalf. This does not grant the ability to read, modify or delete tabs after they are created, or give access to the content inside the tabs." }, { "description": "Read the names and settings of tabs inside any team in Microsoft Teams, on behalf of the signed-in user. This does not give access to the content inside the tabs.", "displayName": "Read tabs in Microsoft Teams.", "id": "59dacb05-e88d-4c13-a684-59f1afc8cc98", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsTab.Read.All" + "value": "TeamsTab.Read.All", + "userConsentDisplayName": "Read tabs in Microsoft Teams.", + "userConsentDescription": "Read the names and settings of tabs inside any team in Microsoft Teams, on your behalf. This does not give access to the content inside the tabs." }, { "description": "Read and write tabs in any team in Microsoft Teams, on behalf of the signed-in user. This does not give access to the content inside the tabs.", "displayName": "Read and write tabs in Microsoft Teams.", "id": "b98bfd41-87c6-45cc-b104-e2de4f0dafb9", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsTab.ReadWrite.All" + "value": "TeamsTab.ReadWrite.All", + "userConsentDisplayName": "Read and write tabs in Microsoft Teams.", + "userConsentDescription": "Read and write tabs in any team in Microsoft Teams, on your behalf. This does not give access to the content inside the tabs." }, { "description": "Allows a Teams app to read, install, upgrade, and uninstall all tabs in chats the signed-in user can access.", "displayName": "Allow the Teams app to manage all tabs in chats", "id": "ee928332-e9c2-4747-b4a0-f8c164b68de6", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsTab.ReadWriteForChat" + "value": "TeamsTab.ReadWriteForChat", + "userConsentDisplayName": "Allow the Teams app to manage all tabs in chats", + "userConsentDescription": "Allows a Teams app to read, install, upgrade, and uninstall all tabs in chats you can access." }, { "description": "Allows a Teams app to read, install, upgrade, and uninstall all tabs to teams the signed-in user can access.", "displayName": "Allow the Teams app to manage all tabs in teams", "id": "c975dd04-a06e-4fbb-9704-62daad77bb49", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsTab.ReadWriteForTeam" + "value": "TeamsTab.ReadWriteForTeam", + "userConsentDisplayName": "Allow the app to manage all tabs in teams", + "userConsentDescription": "Allows a Teams app to read, install, upgrade, and uninstall all tabs to teams you can access." }, { "description": "Allows a Teams app to read, install, upgrade, and uninstall all tabs for the signed-in user.", "displayName": "Allow the Teams app to manage all tabs for a user", "id": "c37c9b61-7762-4bff-a156-afc0005847a0", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsTab.ReadWriteForUser" + "value": "TeamsTab.ReadWriteForUser", + "userConsentDisplayName": "Allow the Teams app to manage all tabs for you", + "userConsentDescription": "Allows a Teams app to read, install, upgrade, and uninstall all tabs for you." }, { "description": "Allows a Teams app to read, install, upgrade, and uninstall its own tabs in chats the signed-in user can access.", "displayName": "Allow the Teams app to manage only its own tabs in chats", "id": "0c219d04-3abf-47f7-912d-5cca239e90e6", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsTab.ReadWriteSelfForChat" + "value": "TeamsTab.ReadWriteSelfForChat", + "userConsentDisplayName": "Allow the Teams app to manage only its own tabs in chats", + "userConsentDescription": "Allows a Teams app to read, install, upgrade, and uninstall its own tabs in chats you can access." }, { "description": "Allows a Teams app to read, install, upgrade, and uninstall its own tabs to teams the signed-in user can access.", "displayName": "Allow the Teams app to manage only its own tabs in teams", "id": "f266662f-120a-4314-b26a-99b08617c7ef", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsTab.ReadWriteSelfForTeam" + "value": "TeamsTab.ReadWriteSelfForTeam", + "userConsentDisplayName": "Allow the Teams app to manage only its own tabs in teams", + "userConsentDescription": "Allows a Teams app to read, install, upgrade, and uninstall its own tabs to teams you can access." }, { "description": "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for the signed-in user.", "displayName": "Allow the Teams app to manage only its own tabs for a user", "id": "395dfec1-a0b9-465f-a783-8250a430cb8c", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsTab.ReadWriteSelfForUser" + "value": "TeamsTab.ReadWriteSelfForUser", + "userConsentDisplayName": "Allow the Teams app to manage only its own tabs for you", + "userConsentDescription": "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for you." }, { "description": "Allows the app to read, install, upgrade, and uninstall selected Teams apps in teams the signed-in user can access. Does not give the ability to read application-specific settings.", @@ -438,28 +518,36 @@ "displayName": "Manage user's installed Teams apps", "id": "093f8818-d05f-49b8-95bc-9d2a73e9a43c", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsAppInstallation.ReadWriteForUser" + "value": "TeamsAppInstallation.ReadWriteForUser", + "userConsentDisplayName": "Manage your installed Teams apps", + "userConsentDescription": "Allows the app to read, install, upgrade, and uninstall Teams apps installed for you. Does not give the ability to read application-specific settings." }, { "description": "Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Does not give the ability to read application-specific settings.", "displayName": "Manage installed Teams apps in teams", "id": "2e25a044-2580-450d-8859-42eeb6e996c0", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsAppInstallation.ReadWriteForTeam" + "value": "TeamsAppInstallation.ReadWriteForTeam", + "userConsentDisplayName": "Manage installed Teams apps in teams", + "userConsentDescription": "Allows the app to read, install, upgrade, and uninstall Teams apps in teams you can access. Does not give the ability to read application-specific settings." }, { "description": "Allows the app to read the signed-in user's teamwork activity feed.", "displayName": "Read user's teamwork activity feed", "id": "0e755559-83fb-4b44-91d0-4cc721b9323e", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsActivity.Read" + "value": "TeamsActivity.Read", + "userConsentDisplayName": "Read your teamwork activity feed", + "userConsentDescription": "Allows the app to read your teamwork activity feed." }, { "description": "Allows the app to create new notifications in users' teamwork activity feeds on behalf of the signed in user. These notifications may not be discoverable or be held or governed by compliance policies.", "displayName": "Send a teamwork activity as the user", "id": "7ab1d787-bae7-4d5d-8db6-37ea32df9186", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsActivity.Send" + "value": "TeamsActivity.Send", + "userConsentDisplayName": "Send a teamwork activity", + "userConsentDescription": "Allows the app to create new activities in your teamwork activity feed, and send new activities to other users' activity feed, on your behalf." }, { "description": "Allows the app to read, install, upgrade, and uninstall selected Teams apps in chats the signed-in user can access. Gives the ability to manage permission grants for accessing those specific chats' data.", @@ -487,21 +575,27 @@ "displayName": "Read installed Teams apps in chats", "id": "bf3fbf03-f35f-4e93-963e-47e4d874c37a", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsAppInstallation.ReadForChat" + "value": "TeamsAppInstallation.ReadForChat", + "userConsentDisplayName": "Read installed Teams apps in chats", + "userConsentDescription": "Allows the app to read the Teams apps that are installed in chats that you can access. Does not give the ability to read application-specific settings." }, { "description": "Allows the app to read the Teams apps that are installed in teams the signed-in user can access. Does not give the ability to read application-specific settings.", "displayName": "Read installed Teams apps in teams", "id": "5248dcb1-f83b-4ec3-9f4d-a4428a961a72", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsAppInstallation.ReadForTeam" + "value": "TeamsAppInstallation.ReadForTeam", + "userConsentDisplayName": "Read installed Teams apps in teams", + "userConsentDescription": "Allows the app to read the Teams apps that are installed in teams that you can access. Does not give the ability to read application-specific settings." }, { "description": "Allows the app to read the Teams apps that are installed for the signed-in user. Does not give the ability to read application-specific settings.", "displayName": "Read user's installed Teams apps", "id": "c395395c-ff9a-4dba-bc1f-8372ba9dca84", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsAppInstallation.ReadForUser" + "value": "TeamsAppInstallation.ReadForUser", + "userConsentDisplayName": "Read your installed Teams apps", + "userConsentDescription": "Allows the app to read the Teams apps that are installed for you. Does not give the ability to read application-specific settings." }, { "description": "Allows the app to read all Exchange service activity, on behalf of the signed-in user.", @@ -571,7 +665,9 @@ "displayName": "Manage installed Teams apps in chats", "id": "aa85bf13-d771-4d5d-a9e6-bca04ce44edf", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsAppInstallation.ReadWriteForChat" + "value": "TeamsAppInstallation.ReadWriteForChat", + "userConsentDisplayName": "Manage installed Teams apps in chats", + "userConsentDescription": "Allows the app to read, install, upgrade, and uninstall Teams apps in chats you can access. Does not give the ability to read application-specific settings." }, { "description": "Allows the app to read the selected Teams apps that are installed in teams the signed-in user can access. Does not give the ability to read application-specific settings.", @@ -641,14 +737,18 @@ "displayName": "Read all active role assignments for your company's directory", "id": "344a729c-0285-42c6-9014-f12b9b8d6129", "origin": "Delegated (Microsoft Graph)", - "value": "RoleAssignmentSchedule.Read.Directory" + "value": "RoleAssignmentSchedule.Read.Directory", + "userConsentDisplayName": "Read all active role assignments for your company's directory", + "userConsentDescription": "Allows the app to read the active role-based access control (RBAC) assignments for your company's directory, on your behalf. This includes reading directory role templates, and directory roles." }, { "description": "Allows the app to read and manage the active role-based access control (RBAC) assignments for your company's directory, on behalf of the signed-in user. This includes managing active directory role membership, and reading directory role templates, directory roles and active memberships.", "displayName": "Read, update, and delete all active role assignments for your company's directory", "id": "8c026be3-8e26-4774-9372-8d5d6f21daff", "origin": "Delegated (Microsoft Graph)", - "value": "RoleAssignmentSchedule.ReadWrite.Directory" + "value": "RoleAssignmentSchedule.ReadWrite.Directory", + "userConsentDisplayName": "Read, update, and delete all active role assignments for your company's directory", + "userConsentDescription": "Allows the app to read and manage the active role-based access control (RBAC) assignments for your company's directory, on your behalf. This includes managing active directory role membership, and reading directory role templates, directory roles and active memberships." }, { "description": "Allows the app to delete the active role-based access control (RBAC) assignments for your company's directory, on behalf of the signed-in user.", @@ -662,14 +762,18 @@ "displayName": "Read all eligible role assignments for your company's directory", "id": "eb0788c2-6d4e-4658-8c9e-c0fb8053f03d", "origin": "Delegated (Microsoft Graph)", - "value": "RoleEligibilitySchedule.Read.Directory" + "value": "RoleEligibilitySchedule.Read.Directory", + "userConsentDisplayName": "Read all eligible role assignments for your company's directory", + "userConsentDescription": "Allows the app to read the eligible role-based access control (RBAC) assignments for your company's directory, on your behalf. This includes reading directory role templates, and directory roles." }, { "description": "Allows the app to read and manage the eligible role-based access control (RBAC) assignments for your company's directory, on behalf of the signed-in user. This includes managing eligible directory role membership, and reading directory role templates, directory roles and eligible memberships.", "displayName": "Read, update, and delete all eligible role assignments for your company's directory", "id": "62ade113-f8e0-4bf9-a6ba-5acb31db32fd", "origin": "Delegated (Microsoft Graph)", - "value": "RoleEligibilitySchedule.ReadWrite.Directory" + "value": "RoleEligibilitySchedule.ReadWrite.Directory", + "userConsentDisplayName": "Read, update, and delete all eligible role assignments for your company's directory", + "userConsentDescription": "Allows the app to read and manage the eligible role-based access control (RBAC) assignments for your company's directory, on your behalf. This includes managing eligible directory role membership, and reading directory role templates, directory roles and eligible memberships." }, { "description": "Allows the app to delete the eligible role-based access control (RBAC) assignments for your company's directory, on behalf of the signed-in user.", @@ -683,14 +787,18 @@ "displayName": "Read role management data for all RBAC providers", "id": "48fec646-b2ba-4019-8681-8eb31435aded", "origin": "Delegated (Microsoft Graph)", - "value": "RoleManagement.Read.All" + "value": "RoleManagement.Read.All", + "userConsentDisplayName": "Read role management data for all RBAC providers", + "userConsentDescription": "Allows the app to read the role-based access control (RBAC) settings for all RBAC providers, on your behalf. This includes reading role definitions and role assignments." }, { "description": "Allows the app to read the Cloud PC role-based access control (RBAC) settings, on behalf of the signed-in user. This includes reading Cloud PC role definitions and role assignments.", "displayName": "Read Cloud PC RBAC settings", "id": "9619b88a-8a25-48a7-9571-d23be0337a79", "origin": "Delegated (Microsoft Graph)", - "value": "RoleManagement.Read.CloudPC" + "value": "RoleManagement.Read.CloudPC", + "userConsentDisplayName": "Read Cloud PC RBAC settings", + "userConsentDescription": "Allows the app to read the Cloud PC role-based access control (RBAC) settings, on your behalf.  This includes reading Cloud PC role definitions and role assignments." }, { "description": "Allows the app to read the role-based access control (RBAC) settings for your company's directory, on behalf of the signed-in user. This includes reading M365 Defender role definitions and role assignments.", @@ -704,7 +812,9 @@ "displayName": "Read directory RBAC settings", "id": "741c54c3-0c1e-44a1-818b-3f97ab4e8c83", "origin": "Delegated (Microsoft Graph)", - "value": "RoleManagement.Read.Directory" + "value": "RoleManagement.Read.Directory", + "userConsentDisplayName": "Read directory RBAC settings", + "userConsentDescription": "Allows the app to read the role-based access control (RBAC) settings for your company's directory, on your behalf. This includes reading directory role templates, directory roles and memberships." }, { "description": "Allows the app to read the role-based access control (RBAC) settings for your organization's Exchange Online service, on behalf of the signed-in user. This includes reading Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies.", @@ -718,28 +828,36 @@ "displayName": "Read and write Cloud PC RBAC settings", "id": "501d06f8-07b8-4f18-b5c6-c191a4af7a82", "origin": "Delegated (Microsoft Graph)", - "value": "RoleManagement.ReadWrite.CloudPC" + "value": "RoleManagement.ReadWrite.CloudPC", + "userConsentDisplayName": "Read and write Cloud PC RBAC settings", + "userConsentDescription": "Allows the app to read and manage the Cloud PC role-based access control (RBAC) settings, on your behalf. This includes reading and managing Cloud PC role definitions and memberships." }, { "description": "Allows the app to read and update admin report settings, such as whether to display concealed information in reports, on behalf of the signed-in user.", "displayName": "Read and write admin report settings", "id": "b955410e-7715-4a88-a940-dfd551018df3", "origin": "Delegated (Microsoft Graph)", - "value": "ReportSettings.ReadWrite.All" + "value": "ReportSettings.ReadWrite.All", + "userConsentDisplayName": "Read and write admin report settings", + "userConsentDescription": "Allows the app to read and update admin report settings, such as whether to display concealed information in reports, on your behalf." }, { "description": "Allows the app to read admin report settings, such as whether to display concealed information in reports, on behalf of the signed-in user", "displayName": "Read admin report settings", "id": "84fac5f4-33a9-4100-aa38-a20c6d29e5e7", "origin": "Delegated (Microsoft Graph)", - "value": "ReportSettings.Read.All" + "value": "ReportSettings.Read.All", + "userConsentDisplayName": "Read admin report settings", + "userConsentDescription": "Allows the app to read admin report settings, such as whether to display concealed information in reports, on your behalf." }, { "description": "Allows an app to read all service usage reports on behalf of the signed-in user. Services that provide usage reports include Office 365 and Azure Active Directory.", "displayName": "Read all usage reports", "id": "02e97553-ed7b-43d0-ab3c-f8bace0d040c", "origin": "Delegated (Microsoft Graph)", - "value": "Reports.Read.All" + "value": "Reports.Read.All", + "userConsentDisplayName": "Read all usage reports", + "userConsentDescription": "Allows an app to read all service usage reports on your behalf. Services that provide usage reports include Office 365 and Azure Active Directory." }, { "description": "Allows the app to read available properties of remoteTenantGroups, on behalf of the signed-in user.", @@ -760,7 +878,9 @@ "displayName": "View users' basic profile", "id": "14dad69e-099b-42c9-810b-d002981feec1", "origin": "Delegated (Microsoft Graph)", - "value": "profile" + "value": "profile", + "userConsentDisplayName": "View your basic profile", + "userConsentDescription": "Allows the app to see your basic profile (e.g., name, picture, user name, email address)" }, { "description": "Allows the app to read all profile photos of users and groups, on behalf of the signed-in user.", @@ -781,14 +901,18 @@ "displayName": "Read all programs that user can access", "id": "c492a2e1-2f8f-4caa-b076-99bbf6e40fe4", "origin": "Delegated (Microsoft Graph)", - "value": "ProgramControl.Read.All" + "value": "ProgramControl.Read.All", + "userConsentDisplayName": "Read programs that you can access", + "userConsentDescription": "Allows the app to read information on programs and program controls that you have access to." }, { "description": "Allows the app to read, update, delete and perform actions on programs and program controls that the signed-in user has access to in the organization.", "displayName": "Manage all programs that user can access", "id": "50fd364f-9d93-4ae1-b170-300e87cccf84", "origin": "Delegated (Microsoft Graph)", - "value": "ProgramControl.ReadWrite.All" + "value": "ProgramControl.ReadWrite.All", + "userConsentDisplayName": "Manage programs that you can access", + "userConsentDescription": "Allows the app to read, update and perform action on programs and program controls that you have access to." }, { "description": "Allows the app to identify Purview data protection, compliance and governance policy scopes defined for all users across tenant.", @@ -865,14 +989,18 @@ "displayName": "Read Records Management configuration, labels, and policies", "id": "07f995eb-fc67-4522-ad66-2b8ca8ea3efd", "origin": "Delegated (Microsoft Graph)", - "value": "RecordsManagement.Read.All" + "value": "RecordsManagement.Read.All", + "userConsentDisplayName": "Read Records Management configuration, labels, and policies", + "userConsentDescription": "Allows the application to read any data from Records Management, such as configuration, labels and policies on your behalf." }, { "description": "Allow the application to create, update and delete any data from Records Management, such as configuration, labels, and policies on behalf of the signed-in user.", "displayName": "Read and write Records Management configuration, labels, and policies", "id": "f2833d75-a4e6-40ab-86d4-6dfe73c97605", "origin": "Delegated (Microsoft Graph)", - "value": "RecordsManagement.ReadWrite.All" + "value": "RecordsManagement.ReadWrite.All", + "userConsentDisplayName": "Read and write Records Management configuration, labels, and policies", + "userConsentDescription": "Allow the application to create, update and delete any data from Records Management, such as configuration, labels, and policies on your behalf." }, { "description": "Allows the application to read certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, on behalf of the signed-in user.", @@ -893,7 +1021,9 @@ "displayName": "Read and write directory RBAC settings", "id": "d01b97e9-cbc0-49fe-810a-750afd5527a3", "origin": "Delegated (Microsoft Graph)", - "value": "RoleManagement.ReadWrite.Directory" + "value": "RoleManagement.ReadWrite.Directory", + "userConsentDisplayName": "Read and write directory RBAC settings", + "userConsentDescription": "Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, on your behalf. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships." }, { "description": "Allows the app to read the role-based access control (RBAC) alerts for your company's directory, on behalf of the signed-in user. This includes reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert.", @@ -907,7 +1037,9 @@ "displayName": "Read and update your organization’s security events", "id": "6aedf524-7e1c-45a7-bd76-ded8cab8d0fc", "origin": "Delegated (Microsoft Graph)", - "value": "SecurityEvents.ReadWrite.All" + "value": "SecurityEvents.ReadWrite.All", + "userConsentDisplayName": "Read and update your organization’s security events", + "userConsentDescription": "Allows the app to read your organization’s security events on your behalf. Also allows you to update editable properties in security events." }, { "description": "Allows the app to read all the identity security available identity accounts", @@ -998,14 +1130,18 @@ "displayName": "Read incidents", "id": "b9abcc4f-94fc-4457-9141-d20ce80ec952", "origin": "Delegated (Microsoft Graph)", - "value": "SecurityIncident.Read.All" + "value": "SecurityIncident.Read.All", + "userConsentDisplayName": "Read security incidents", + "userConsentDescription": "Allows the app to read all security incidents that you have access to." }, { "description": "Allows the app to read and write security incidents, on behalf of the signed-in user.", "displayName": "Read and write to incidents", "id": "128ca929-1a19-45e6-a3b8-435ec44a36ba", "origin": "Delegated (Microsoft Graph)", - "value": "SecurityIncident.ReadWrite.All" + "value": "SecurityIncident.ReadWrite.All", + "userConsentDisplayName": "Read and write to security incidents", + "userConsentDescription": "Allows the app to read and write to all security incidents that you have access to." }, { "description": "Allow the app to determine if there is any sensitivity label to be applied automatically to the content or recommended to the user for manual application, on behalf of the signed-in user.", @@ -1026,7 +1162,9 @@ "displayName": "Read your organization’s security events", "id": "64733abd-851e-478a-bffb-e47a14b18235", "origin": "Delegated (Microsoft Graph)", - "value": "SecurityEvents.Read.All" + "value": "SecurityEvents.Read.All", + "userConsentDisplayName": "Read your organization’s security events", + "userConsentDescription": "Allows the app to read your organization’s security events on your behalf." }, { "description": "Allows the app to read and write Security Copilot resources owned by the signed-in user on their behalf.", @@ -1068,7 +1206,9 @@ "displayName": "Read all policies for privileged role assignments of your company's directory", "id": "3de2cdbe-0ff5-47d5-bdee-7f45b4749ead", "origin": "Delegated (Microsoft Graph)", - "value": "RoleManagementPolicy.Read.Directory" + "value": "RoleManagementPolicy.Read.Directory", + "userConsentDisplayName": "Read all policies for privileged role assignments of your company's directory", + "userConsentDescription": "Allows the app to read policies for privileged role-based access control (RBAC) assignments of your company's directory, on your behalf." }, { "description": "Allows the app to read policies in Privileged Identity Management for App Roles, on behalf of the signed-in user.", @@ -1089,7 +1229,9 @@ "displayName": "Read, update, and delete all policies for privileged role assignments of your company's directory", "id": "1ff1be21-34eb-448c-9ac9-ce1f506b2a68", "origin": "Delegated (Microsoft Graph)", - "value": "RoleManagementPolicy.ReadWrite.Directory" + "value": "RoleManagementPolicy.ReadWrite.Directory", + "userConsentDisplayName": "Read, update, and delete all policies for privileged role assignments of your company's directory", + "userConsentDescription": "Allows the app to read, update, and delete policies for privileged role-based access control (RBAC) assignments of your company's directory, on your behalf." }, { "description": "Allows the app to manage policies in Privileged Identity Management for App Roles, on behalf of the signed-in user.", @@ -1103,7 +1245,9 @@ "displayName": "Read user schedule items", "id": "fccf6dd8-5706-49fa-811f-69e2e1b585d0", "origin": "Delegated (Microsoft Graph)", - "value": "Schedule.Read.All" + "value": "Schedule.Read.All", + "userConsentDisplayName": "Read your schedule items", + "userConsentDescription": "Allows the app to read schedule, schedule groups, shifts and associated entities in the Teams or Shifts application on your behalf." }, { "description": "Allows the app to read and manage the role-based access control (RBAC) settings for your organization's Exchange Online service, on behalf of the signed-in user. This includes reading, creating, updating, and deleting Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies.", @@ -1117,35 +1261,45 @@ "displayName": "Read and write user schedule items", "id": "63f27281-c9d9-4f29-94dd-6942f7f1feb0", "origin": "Delegated (Microsoft Graph)", - "value": "Schedule.ReadWrite.All" + "value": "Schedule.ReadWrite.All", + "userConsentDisplayName": "Read and write your schedule items", + "userConsentDescription": "Allows the app to manage schedule, schedule groups, shifts and associated entities in the Teams or Shifts application on your behalf." }, { "description": "Allows the app to read search configuration, on behalf of the signed-in user.", "displayName": "Read your organization's search configuration", "id": "7d307522-aa38-4cd0-bd60-90c6f0ac50bd", "origin": "Delegated (Microsoft Graph)", - "value": "SearchConfiguration.Read.All" + "value": "SearchConfiguration.Read.All", + "userConsentDisplayName": "Read your organization's search configuration", + "userConsentDescription": "Allows the app to read search configuration, on your behalf." }, { "description": "Allows the app to read and write search configuration, on behalf of the signed-in user.", "displayName": "Read and write your organization's search configuration", "id": "b1a7d408-cab0-47d2-a2a5-a74a3733600d", "origin": "Delegated (Microsoft Graph)", - "value": "SearchConfiguration.ReadWrite.All" + "value": "SearchConfiguration.ReadWrite.All", + "userConsentDisplayName": "Read and write your organization's search configuration", + "userConsentDescription": "Allows the app to read and write search configuration, on your behalf." }, { "description": "Allows the app to read security actions, on behalf of the signed-in user.", "displayName": "Read your organization's security actions", "id": "1638cddf-07a4-4de2-8645-69c96cacad73", "origin": "Delegated (Microsoft Graph)", - "value": "SecurityActions.Read.All" + "value": "SecurityActions.Read.All", + "userConsentDisplayName": "Read your organization's security actions", + "userConsentDescription": "Allows the app to read security actions, on your behalf." }, { "description": "Allows the app to read or update security actions, on behalf of the signed-in user.", "displayName": "Read and update your organization's security actions", "id": "dc38509c-b87d-4da0-bd92-6bec988bac4a", "origin": "Delegated (Microsoft Graph)", - "value": "SecurityActions.ReadWrite.All" + "value": "SecurityActions.ReadWrite.All", + "userConsentDisplayName": "Read and update your organization's security actions", + "userConsentDescription": "Allows the app to read and update security actions, on your behalf." }, { "description": "Allows the app to create security alerts, on behalf of the signed-in user.", @@ -1159,14 +1313,18 @@ "displayName": "Read all security alerts", "id": "bc257fb8-46b4-4b15-8713-01e91bfbe4ea", "origin": "Delegated (Microsoft Graph)", - "value": "SecurityAlert.Read.All" + "value": "SecurityAlert.Read.All", + "userConsentDisplayName": "Read all alerts", + "userConsentDescription": "Allows the app to read all security alerts that you have access to." }, { "description": "Allows the app to read and write to all security alerts, on behalf of the signed-in user.", "displayName": "Read and write to all security alerts", "id": "471f2a7f-2a42-4d45-a2bf-594d0838070d", "origin": "Delegated (Microsoft Graph)", - "value": "SecurityAlert.ReadWrite.All" + "value": "SecurityAlert.ReadWrite.All", + "userConsentDisplayName": "Read and write all alerts", + "userConsentDescription": "Allows the app to read and write all alerts that you have access to." }, { "description": "Read email metadata and security detection details on behalf of the signed in user.", @@ -1194,7 +1352,9 @@ "displayName": "Read and Modify Tenant-Acquired Telephone Number Details", "id": "424b07a8-1209-4d17-9fe4-9018a93a1024", "origin": "Delegated (Microsoft Graph)", - "value": "TeamsTelephoneNumber.ReadWrite.All" + "value": "TeamsTelephoneNumber.ReadWrite.All", + "userConsentDisplayName": "Allows the app to read and modify your tenant's acquired telephone number details on behalf of the signed-in admin user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.", + "userConsentDescription": "Allows the app to read and modify your tenant's acquired telephone number details on behalf of the signed-in admin user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc." }, { "description": "Allows the app to read the available Teams templates, on behalf of the signed-in user.", @@ -1236,14 +1396,18 @@ "displayName": "Read all users' lifecycle information", "id": "ed8d2a04-0374-41f1-aefe-da8ac87ccc87", "origin": "Delegated (Microsoft Graph)", - "value": "User-LifeCycleInfo.Read.All" + "value": "User-LifeCycleInfo.Read.All", + "userConsentDisplayName": "Read all users' lifecycle information", + "userConsentDescription": "Allows the app to read the lifecycle information like employeeLeaveDateTime of users in your organization, on behalf of the signed-in user." }, { "description": "Allows the app to read and write the lifecycle information like employeeLeaveDateTime of users in your organization, on behalf of the signed-in user.", "displayName": "Read and write all users' lifecycle information", "id": "7ee7473e-bd4b-4c9f-987c-bd58481f5fa2", "origin": "Delegated (Microsoft Graph)", - "value": "User-LifeCycleInfo.ReadWrite.All" + "value": "User-LifeCycleInfo.ReadWrite.All", + "userConsentDisplayName": "Read and write all users' lifecycle information", + "userConsentDescription": "Allows the app to read and write the lifecycle information like employeeLeaveDateTime of users in your organization, on behalf of the signed-in user." }, { "description": "Allows the app to read and write secondary mail addresses for all users, on behalf of the signed-in user.", @@ -1257,7 +1421,9 @@ "displayName": "Deliver and manage user's notifications", "id": "26e2f3e8-b2a1-47fc-9620-89bb5b042024", "origin": "Delegated (Microsoft Graph)", - "value": "UserNotification.ReadWrite.CreatedByApp" + "value": "UserNotification.ReadWrite.CreatedByApp", + "userConsentDisplayName": "Deliver and manage your notifications", + "userConsentDescription": "Allows the app to send, read, update and delete your app-specific notifications." }, { "description": "Allows the app to read and update the on-premises sync behavior of users on behalf of the signed-in user.", @@ -1292,7 +1458,9 @@ "displayName": "Write app activity to users' timeline", "id": "367492fc-594d-4972-a9b5-0d58c622c91c", "origin": "Delegated (Microsoft Graph)", - "value": "UserTimelineActivity.Write.CreatedByApp" + "value": "UserTimelineActivity.Write.CreatedByApp", + "userConsentDisplayName": "Write app activity to your timeline", + "userConsentDescription": "Allows the app to report your app activity information to Microsoft Timeline." }, { "description": "Allows the app to read a user's windows settings which are stored in cloud and their values on behalf of the signed-in user.", @@ -1649,21 +1817,27 @@ "displayName": "Read and write all Windows update deployment settings", "id": "11776c0c-6138-4db3-a668-ee621bea2555", "origin": "Delegated (Microsoft Graph)", - "value": "WindowsUpdates.ReadWrite.All" + "value": "WindowsUpdates.ReadWrite.All", + "userConsentDisplayName": "Read and write all Windows update deployment settings", + "userConsentDescription": "Allows the app to read and write all Windows update deployment settings for the organization on your behalf." }, { "description": "Allows the app to read workforce integrations, to synchronize data from Microsoft Teams Shifts, on behalf of the signed-in user.", "displayName": "Read workforce integrations", "id": "f1ccd5a7-6383-466a-8db8-1a656f7d06fa", "origin": "Delegated (Microsoft Graph)", - "value": "WorkforceIntegration.Read.All" + "value": "WorkforceIntegration.Read.All", + "userConsentDisplayName": "Read workforce integrations", + "userConsentDescription": "Allows the app to read workforce integrations, to synchronize data from Microsoft Teams Shifts, on your behalf." }, { "description": "Allows the app to manage workforce integrations, to synchronize data from Microsoft Teams Shifts, on behalf of the signed-in user.", "displayName": "Read and write workforce integrations", "id": "08c4b377-0d23-4a8b-be2a-23c1c1d88545", "origin": "Delegated (Microsoft Graph)", - "value": "WorkforceIntegration.ReadWrite.All" + "value": "WorkforceIntegration.ReadWrite.All", + "userConsentDisplayName": "Read and write workforce integrations", + "userConsentDescription": "Allows the app to manage workforce integrations, to synchronize data from Microsoft Teams Shifts, on your behalf." }, { "description": "Allows the current signed-in user to read Content Domain information.", @@ -1796,42 +1970,54 @@ "displayName": "Read term store data", "id": "297f747b-0005-475b-8fef-c890f5152b38", "origin": "Delegated (Microsoft Graph)", - "value": "TermStore.Read.All" + "value": "TermStore.Read.All", + "userConsentDisplayName": "Read term store data", + "userConsentDescription": "Allows the app to read the term store data that you have access to. This includes all sets, groups and terms in the term store." }, { "description": "Allows the app to read or modify data that the signed-in user has access to. This includes all sets, groups and terms in the term store.", "displayName": "Read and write term store data", "id": "6c37c71d-f50f-4bff-8fd3-8a41da390140", "origin": "Delegated (Microsoft Graph)", - "value": "TermStore.ReadWrite.All" + "value": "TermStore.ReadWrite.All", + "userConsentDisplayName": "Read and write term store data", + "userConsentDescription": "Allows the app to read or modify data that you have access to. This includes all sets, groups and terms in the term store." }, { "description": "Allows an app to read your organization's threat assessment requests on behalf of the signed-in user. Also allows the app to create new requests to assess threats received by your organization on behalf of the signed-in user.", "displayName": "Read and write threat assessment requests", "id": "cac97e40-6730-457d-ad8d-4852fddab7ad", "origin": "Delegated (Microsoft Graph)", - "value": "ThreatAssessment.ReadWrite.All" + "value": "ThreatAssessment.ReadWrite.All", + "userConsentDisplayName": "Read and write threat assessment requests", + "userConsentDescription": "Allows an app to read your organization's threat assessment requests on your behalf. Also allows the app to create new requests to assess threats received by your organization on your behalf." }, { "description": "Allows the app to run hunting queries, on behalf of the signed-in user.", "displayName": "Run hunting queries", "id": "b152eca8-ea73-4a48-8c98-1a6742673d99", "origin": "Delegated (Microsoft Graph)", - "value": "ThreatHunting.Read.All" + "value": "ThreatHunting.Read.All", + "userConsentDisplayName": "Run hunting queries", + "userConsentDescription": "Allows the app to run hunting queries that you can execute." }, { "description": "Allows the app to read all the indicators for your organization, on behalf of the signed-in user.", "displayName": "Read all threat indicators", "id": "9cc427b4-2004-41c5-aa22-757b755e9796", "origin": "Delegated (Microsoft Graph)", - "value": "ThreatIndicators.Read.All" + "value": "ThreatIndicators.Read.All", + "userConsentDisplayName": "Read all threat indicators", + "userConsentDescription": "Allows the app to read all the indicators for your organization, on your behalf." }, { "description": "Allows the app to create threat indicators, and fully manage those threat indicators (read, update and delete), on behalf of the signed-in user. It cannot update any threat indicators it does not own.", "displayName": "Manage threat indicators this app creates or owns", "id": "91e7d36d-022a-490f-a748-f8e011357b42", "origin": "Delegated (Microsoft Graph)", - "value": "ThreatIndicators.ReadWrite.OwnedBy" + "value": "ThreatIndicators.ReadWrite.OwnedBy", + "userConsentDisplayName": "Manage threat indicators this app creates or owns", + "userConsentDescription": "Allows the app to create threat indicators, and fully manage those threat indicators (read, update and delete), on your behalf.  It cannot update any threat indicators that it is not an owner of." }, { "description": "Allows the app to read threat intelligence information, such as indicators, observations, and articles, on behalf of the signed-in user.", @@ -1845,35 +2031,45 @@ "displayName": "Read threat submissions", "id": "fd5353c6-26dd-449f-a565-c4e16b9fce78", "origin": "Delegated (Microsoft Graph)", - "value": "ThreatSubmission.Read" + "value": "ThreatSubmission.Read", + "userConsentDisplayName": "Read threat submissions", + "userConsentDescription": "Allows the app to read the threat submissions and threat submission policies that you own on your behalf." }, { "description": "Allows the app to read your organization's threat submissions and threat submission policies on behalf of the signed-in user.", "displayName": "Read all threat submissions", "id": "7083913a-4966-44b6-9886-c5822a5fd910", "origin": "Delegated (Microsoft Graph)", - "value": "ThreatSubmission.Read.All" + "value": "ThreatSubmission.Read.All", + "userConsentDisplayName": "Read all threat submissions", + "userConsentDescription": "Allows the app to read your organization's threat submissions and threat submission policies on your behalf." }, { "description": "Allows the app to read the threat submissions and threat submission policies owned by the signed-in user. Also allows the app to create new threat submissions on behalf of the signed-in user.", "displayName": "Read and write threat submissions", "id": "68a3156e-46c9-443c-b85c-921397f082b5", "origin": "Delegated (Microsoft Graph)", - "value": "ThreatSubmission.ReadWrite" + "value": "ThreatSubmission.ReadWrite", + "userConsentDisplayName": "Read and write threat submissions", + "userConsentDescription": "Allows the app to read the threat submissions and threat submission policies that you own. Also allows the app to create new threat submissions on your behalf." }, { "description": "Allows the app to read your organization's threat submissions and threat submission policies on behalf of the signed-in user. Also allows the app to create new threat submissions on behalf of the signed-in user.", "displayName": "Read and write all threat submissions", "id": "8458e264-4eb9-4922-abe9-768d58f13c7f", "origin": "Delegated (Microsoft Graph)", - "value": "ThreatSubmission.ReadWrite.All" + "value": "ThreatSubmission.ReadWrite.All", + "userConsentDisplayName": "Read and write all threat submissions", + "userConsentDescription": "Allows the app to read your organization's threat submissions and threat submission policies on your behalf. Also allows the app to create new threat submissions on your behalf." }, { "description": "Allows the app to read your organization's threat submission policies on behalf of the signed-in user. Also allows the app to create new threat submission policies on behalf of the signed-in user.", "displayName": "Read and write all threat submission policies", "id": "059e5840-5353-4c68-b1da-666a033fc5e8", "origin": "Delegated (Microsoft Graph)", - "value": "ThreatSubmissionPolicy.ReadWrite.All" + "value": "ThreatSubmissionPolicy.ReadWrite.All", + "userConsentDisplayName": "Read and write all threat submission policies", + "userConsentDescription": "Allows the app to read your organization's threat submission policies on your behalf. Also allows the app to create new threat submission policies on your behalf." }, { "description": "Allows the app to read topics data on behalf of the signed-in user.", @@ -1887,7 +2083,9 @@ "displayName": "Read trust framework key sets", "id": "7ad34336-f5b1-44ce-8682-31d7dfcd9ab9", "origin": "Delegated (Microsoft Graph)", - "value": "TrustFrameworkKeySet.Read.All" + "value": "TrustFrameworkKeySet.Read.All", + "userConsentDisplayName": "Read trust framework key sets", + "userConsentDescription": "Allows the app to read trust framework key sets, on your behalf." }, { "description": "Allows the application to list and read all Tenant Governance requests on behalf of the signed-in user.", @@ -1929,14 +2127,18 @@ "displayName": "Read Teams app settings", "id": "44e060c4-bbdc-4256-a0b9-dcc0396db368", "origin": "Delegated (Microsoft Graph)", - "value": "TeamworkAppSettings.Read.All" + "value": "TeamworkAppSettings.Read.All", + "userConsentDisplayName": "Read Teams app settings", + "userConsentDescription": "Allows the app to read the Teams app settings on your behalf." }, { "description": "Allows the app to read and write the Teams app settings on behalf of the signed-in user.", "displayName": "Read and write Teams app settings", "id": "87c556f0-2bd9-4eed-bd74-5dd8af6eaf7e", "origin": "Delegated (Microsoft Graph)", - "value": "TeamworkAppSettings.ReadWrite.All" + "value": "TeamworkAppSettings.ReadWrite.All", + "userConsentDisplayName": "Read and write Teams app settings", + "userConsentDescription": "Allows the app to read and write the Teams app settings on your behalf." }, { "description": "Create custom emoji on behalf of the signed-in user.", @@ -1957,14 +2159,18 @@ "displayName": "Read Teams devices", "id": "b659488b-9d28-4208-b2be-1c6652b3c970", "origin": "Delegated (Microsoft Graph)", - "value": "TeamworkDevice.Read.All" + "value": "TeamworkDevice.Read.All", + "userConsentDisplayName": "Read Teams devices", + "userConsentDescription": "Allow the app to read the management data for Teams devices on your behalf." }, { "description": "Allow the app to read and write the management data for Teams devices on behalf of the signed-in user.", "displayName": "Read and write Teams devices", "id": "ddd97ecb-5c31-43db-a235-0ee20e635c40", "origin": "Delegated (Microsoft Graph)", - "value": "TeamworkDevice.ReadWrite.All" + "value": "TeamworkDevice.ReadWrite.All", + "userConsentDisplayName": "Read and write Teams devices", + "userConsentDescription": "Allow the app to read and write the management data for Teams devices on your behalf." }, { "description": "Allows the app to read the signed-in user's sections (folders) for organizing chats and channels in Teams.", @@ -1978,7 +2184,9 @@ "displayName": "Read and write trust framework key sets", "id": "39244520-1e7d-4b4a-aee0-57c65826e427", "origin": "Delegated (Microsoft Graph)", - "value": "TrustFrameworkKeySet.ReadWrite.All" + "value": "TrustFrameworkKeySet.ReadWrite.All", + "userConsentDisplayName": "Read and write trust framework key sets", + "userConsentDescription": "Allows the app to read or write trust framework key sets, on your behalf." }, { "description": "Allows the app to read and write the signed-in user's sections (folders) for organizing chats and channels in Teams.", @@ -1992,7 +2200,9 @@ "displayName": "Read and write tags in Teams", "id": "539dabd7-b5b6-4117-b164-d60cd15a8671", "origin": "Delegated (Microsoft Graph)", - "value": "TeamworkTag.ReadWrite" + "value": "TeamworkTag.ReadWrite", + "userConsentDisplayName": "Read and write tags in Teams", + "userConsentDescription": "Allows the app to read and write tags in Teams, on your behalf." }, { "description": "Allows the user to update group chat or channel targeted messages in Microsoft Teams.", @@ -2048,7 +2258,9 @@ "displayName": "Read tags in Teams", "id": "57587d0b-8399-45be-b207-8050cec54575", "origin": "Delegated (Microsoft Graph)", - "value": "TeamworkTag.Read" + "value": "TeamworkTag.Read", + "userConsentDisplayName": "Read tags in Teams", + "userConsentDescription": "Allows the app to read tags in Teams, on your behalf." }, { "description": "Allows the app to read your tenant's user configurations on behalf of the signed-in admin user. User configuration may include attributes related to user, such as telephone number, assigned policies, etc.", @@ -2062,7 +2274,9 @@ "displayName": "Read unified group memberships as guest", "id": "73e75199-7c3e-41bb-9357-167164dbb415", "origin": "Delegated (Microsoft Graph)", - "value": "UnifiedGroupMember.Read.AsGuest" + "value": "UnifiedGroupMember.Read.AsGuest", + "userConsentDisplayName": "Read unified group memberships as guest", + "userConsentDescription": "Allows the app to read basic unified group properties, memberships and owners of the group you are a member of." }, { "description": "Allows the app to delete and restore all users, on behalf of the signed-in user.", @@ -2230,42 +2444,54 @@ "displayName": "Export user's data", "id": "405a51b5-8d8d-430b-9842-8be4b0e9f324", "origin": "Delegated (Microsoft Graph)", - "value": "User.Export.All" + "value": "User.Export.All", + "userConsentDisplayName": "Export user's data", + "userConsentDescription": "Allows the app to export data (e.g. customer content or system-generated logs), associated with any user in your company, when the app is used by a privileged user (e.g. a Company Administrator)." }, { "description": "Allows the app to invite guest users to the organization, on behalf of the signed-in user.", "displayName": "Invite guest users to the organization", "id": "63dd7cd9-b489-4adf-a28c-ac38b9a0f962", "origin": "Delegated (Microsoft Graph)", - "value": "User.Invite.All" + "value": "User.Invite.All", + "userConsentDisplayName": "Invite guest users to the organization", + "userConsentDescription": "Allows the app to invite guest users to the organization, on your behalf." }, { "description": "Allows the app to read, update and delete identities that are associated with a user's account that the signed-in user has access to. This controls the identities users can sign-in with.", "displayName": "Manage user identities", "id": "637d7bec-b31e-4deb-acc9-24275642a2c9", "origin": "Delegated (Microsoft Graph)", - "value": "User.ManageIdentities.All" + "value": "User.ManageIdentities.All", + "userConsentDisplayName": "Manage user identities", + "userConsentDescription": "Allows the app to read, update and delete identities that are associated with a user's account that you have access to. This controls the identities users can sign-in with." }, { "description": "Allows users to sign-in to the app, and allows the app to read the profile of signed-in users. It also allows the app to read basic company information of signed-in users.", "displayName": "Sign in and read user profile", "id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d", "origin": "Delegated (Microsoft Graph)", - "value": "User.Read" + "value": "User.Read", + "userConsentDisplayName": "Sign you in and read your profile", + "userConsentDescription": "Allows you to sign in to the app with your organizational account and let the app read your profile. It also allows the app to read basic company information." }, { "description": "Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user.", "displayName": "Read all users' full profiles", "id": "a154be20-db9c-4678-8ab7-66f6cc099a59", "origin": "Delegated (Microsoft Graph)", - "value": "User.Read.All" + "value": "User.Read.All", + "userConsentDisplayName": "Read all users' full profiles", + "userConsentDescription": "Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on your behalf." }, { "description": "Allows the app to read a basic set of profile properties of other users in your organization on behalf of the signed-in user. This includes display name, first and last name, email address and photo.", "displayName": "Read all users' basic profiles", "id": "b340eb25-3456-403f-be2f-af7a0d370277", "origin": "Delegated (Microsoft Graph)", - "value": "User.ReadBasic.All" + "value": "User.ReadBasic.All", + "userConsentDisplayName": "Read all users' basic profiles", + "userConsentDescription": "Allows the app to read a basic set of profile properties of other users in your organization on your behalf. Includes display name, first and last name, email address and photo." }, { "description": "Allows the app to read and update users, on behalf of the signed-in user.", @@ -2286,7 +2512,9 @@ "displayName": "Read and write access to user profile", "id": "b4e74841-8e56-480b-be8b-910348b18b4c", "origin": "Delegated (Microsoft Graph)", - "value": "User.ReadWrite" + "value": "User.ReadWrite", + "userConsentDisplayName": "Read and update your profile", + "userConsentDescription": "Allows the app to read your profile, and discover your group membership, reports and manager. It also allows the app to update your profile information on your behalf." }, { "description": "Allow the app to revoke all sign in sessions for a user, on behalf of a signed-in user.", @@ -2300,35 +2528,45 @@ "displayName": "Read and write app activity to users' activity feed", "id": "47607519-5fb1-47d9-99c7-da4b48f369b1", "origin": "Delegated (Microsoft Graph)", - "value": "UserActivity.ReadWrite.CreatedByApp" + "value": "UserActivity.ReadWrite.CreatedByApp", + "userConsentDisplayName": "Read and write app activity to your activity feed", + "userConsentDescription": "Allows the app to read and report your activity in the app." }, { "description": "Allows the app to read the signed-in user's authentication methods, including phone numbers and Authenticator app settings. This does not allow the app to see secret information like the signed-in user's passwords, or to sign-in or otherwise use the signed-in user's authentication methods.", "displayName": "Read user authentication methods.", "id": "1f6b61c5-2f65-4135-9c9f-31c0f8d32b52", "origin": "Delegated (Microsoft Graph)", - "value": "UserAuthenticationMethod.Read" + "value": "UserAuthenticationMethod.Read", + "userConsentDisplayName": "Read your authentication methods.", + "userConsentDescription": "Allows the app to read your authentication methods, including phone numbers and Authenticator app settings. This does not allow the app to see secret information like your passwords, or to sign-in or otherwise use your authentication methods." }, { "description": "Allows the app to read authentication methods of all users in your organization that the signed-in user has access to. Authentication methods include things like a user’s phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "displayName": "Read all users' authentication methods", "id": "aec28ec7-4d02-4e8c-b864-50163aea77eb", "origin": "Delegated (Microsoft Graph)", - "value": "UserAuthenticationMethod.Read.All" + "value": "UserAuthenticationMethod.Read.All", + "userConsentDisplayName": "Read all users' authentication methods", + "userConsentDescription": "Allows the app to read authentication methods of all users you have access to in your organization. Authentication methods include things like a user’s phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods." }, { "description": "Allows the app to read and write the signed-in user's authentication methods, including phone numbers and Authenticator app settings. This does not allow the app to see secret information like the signed-in user's passwords, or to sign-in or otherwise use the signed-in user's authentication methods. ", "displayName": "Read and write user authentication methods", "id": "48971fc1-70d7-4245-af77-0beb29b53ee2", "origin": "Delegated (Microsoft Graph)", - "value": "UserAuthenticationMethod.ReadWrite" + "value": "UserAuthenticationMethod.ReadWrite", + "userConsentDisplayName": "Read and write your authentication methods", + "userConsentDescription": "Allows the app to read and write your authentication methods, including phone numbers and Authenticator app settings.This does not allow the app to see secret information like your passwords, or to sign-in or otherwise use your authentication methods." }, { "description": " Allows the app to read and write authentication methods of all users in your organization that the signed-in user has access to. Authentication methods include things like a user's phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", - "displayName": "Read and write all users' authentication methods", + "displayName": "Read and write all users' authentication methods.", "id": "b7887744-6746-4312-813d-72daeaee7e2d", "origin": "Delegated (Microsoft Graph)", - "value": "UserAuthenticationMethod.ReadWrite.All" + "value": "UserAuthenticationMethod.ReadWrite.All", + "userConsentDisplayName": "Read and write all users' authentication methods", + "userConsentDescription": "Allows the app to read and write authentication methods of all users you have access to in your organization. Authentication methods include things like a user’s phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods." }, { "description": "Allows the app to read the signed-in user's email authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", @@ -2349,7 +2587,9 @@ "displayName": "Read and write all users' full profiles", "id": "204e0828-b5ca-4ad8-b9f3-f32a958e7cc4", "origin": "Delegated (Microsoft Graph)", - "value": "User.ReadWrite.All" + "value": "User.ReadWrite.All", + "userConsentDisplayName": "Read and write all users' full profiles", + "userConsentDescription": "Allows the app to read and write the full set of profile properties, reports, and managers of other users in your organization, on your behalf." }, { "description": "Sign in to synthetics service", @@ -2387,18 +2627,22 @@ "value": "Group.ManageProtection.All" }, { - "description": "Allows the app to list groups, and to read their properties and all group memberships on behalf of the signed-in user. Also allows the app to read calendar, conversations, files, and other group content for all groups the signed-in user can access.", + "description": "Allows the app to list groups, and to read their properties and all group memberships on behalf of the signed-in user. Also allows the app to read calendar, conversations, files, and other group content for all groups the signed-in user can access. ", "displayName": "Read all groups", "id": "5f8c59db-677d-491f-a6b8-5f174b11ec1d", "origin": "Delegated (Microsoft Graph)", - "value": "Group.Read.All" + "value": "Group.Read.All", + "userConsentDisplayName": "Read all groups", + "userConsentDescription": "Allows the app to list groups, and to read their properties and all group memberships on your behalf. Also allows the app to read calendar, conversations, files, and other group content for all groups you can access. " }, { "description": "Allows the app to create groups and read all group properties and memberships on behalf of the signed-in user. Additionally allows group owners to manage their groups and allows group members to update group content.", "displayName": "Read and write all groups", "id": "4e46008b-f24c-477d-8fff-7bb4ec7aafe0", "origin": "Delegated (Microsoft Graph)", - "value": "Group.ReadWrite.All" + "value": "Group.ReadWrite.All", + "userConsentDisplayName": "Read and write all groups", + "userConsentDescription": "Allows the app to create groups and read all group properties and memberships on your behalf. Additionally allows the app to manage your groups and to update group content for groups you are a member of." }, { "description": "Allows the app to read group conversations that the signed-in user has access to.", @@ -2419,14 +2663,18 @@ "displayName": "Read group memberships", "id": "bc024368-1153-4739-b217-4326f2e966d0", "origin": "Delegated (Microsoft Graph)", - "value": "GroupMember.Read.All" + "value": "GroupMember.Read.All", + "userConsentDisplayName": "Read group memberships", + "userConsentDescription": "Allows the app to list groups, read basic group properties and read membership of all your groups." }, { "description": "Allows the app to list groups, read basic properties, read and update the membership of the groups the signed-in user has access to. Group properties and owners cannot be updated and groups cannot be deleted.", "displayName": "Read and write group memberships", "id": "f81125ac-d3b7-4573-a3b2-7099cc39df9e", "origin": "Delegated (Microsoft Graph)", - "value": "GroupMember.ReadWrite.All" + "value": "GroupMember.ReadWrite.All", + "userConsentDisplayName": "Read and write group memberships", + "userConsentDescription": "Allows the app to list groups, read basic properties, read and update the membership of your groups. Group properties and owners cannot be updated and groups cannot be deleted." }, { "description": "Allows the app to read and write groups' disableNesting property on behalf of the signed-in user.", @@ -2510,7 +2758,9 @@ "displayName": "Read and write financials data", "id": "f534bf13-55d4-45a9-8f3c-c92fe64d6131", "origin": "Delegated (Microsoft Graph)", - "value": "Financials.ReadWrite.All" + "value": "Financials.ReadWrite.All", + "userConsentDisplayName": "Read and write financials data", + "userConsentDescription": "Allows the app to read and write financials data on your behalf." }, { "description": "Allows the application to manage file storage container type registrations on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin.", @@ -2524,21 +2774,27 @@ "displayName": "Read items in external datasets", "id": "922f9392-b1b7-483c-a4be-0089be7704fb", "origin": "Delegated (Microsoft Graph)", - "value": "ExternalItem.Read.All" + "value": "ExternalItem.Read.All", + "userConsentDisplayName": "Read items in external datasets", + "userConsentDescription": "Allows the app to read external datasets and content that you have access to." }, { "description": "Allows the app to read and write all external items on behalf of a signed-in user. The signed-in user must be an administrator.", "displayName": "Read and write all external items", "id": "b02c54f8-eb48-4c50-a9f0-a149e5a2012f", "origin": "Delegated (Microsoft Graph)", - "value": "ExternalItem.ReadWrite.All" + "value": "ExternalItem.ReadWrite.All", + "userConsentDisplayName": "Read and write all external items", + "userConsentDescription": "Allows the app to read and write all external items on your behalf. The signed-in user must be an administrator." }, { "description": "Allows the app to read and write external items on behalf of a signed-in user. The signed-in user must be an administrator. The app can only read external items of the connection that it is authorized to.", "displayName": "Read and write external items", "id": "4367b9d7-cee7-4995-853c-a0bdfe95c1f9", "origin": "Delegated (Microsoft Graph)", - "value": "ExternalItem.ReadWrite.OwnedBy" + "value": "ExternalItem.ReadWrite.OwnedBy", + "userConsentDisplayName": "Read and write external items", + "userConsentDescription": "Allows the app to read and write external items on your behalf. The signed-in user must be an administrator. The app can only read external items of the connection that it is authorized to." }, { "description": "Allows the app to read available properties of external user profiles, on behalf of the signed-in user.", @@ -2559,56 +2815,72 @@ "displayName": "Read your family info", "id": "3a1e4806-a744-4c70-80fc-223bf8582c46", "origin": "Delegated (Microsoft Graph)", - "value": "Family.Read" + "value": "Family.Read", + "userConsentDisplayName": "Read your family info", + "userConsentDescription": "Allows the app to read your family information, members and their basic profile." }, { "description": "Allows the app to read the signed-in user's files.", "displayName": "Read user files", "id": "10465720-29dd-4523-a11a-6a75c743c9d9", "origin": "Delegated (Microsoft Graph)", - "value": "Files.Read" + "value": "Files.Read", + "userConsentDisplayName": "Read your files", + "userConsentDescription": "Allows the app to read your files." }, { "description": "Allows the app to read all files the signed-in user can access.", "displayName": "Read all files that user can access", "id": "df85f4d6-205c-4ac5-a5ea-6bf408dba283", "origin": "Delegated (Microsoft Graph)", - "value": "Files.Read.All" + "value": "Files.Read.All", + "userConsentDisplayName": "Read all files that you have access to", + "userConsentDescription": "Allows the app to read all files you can access." }, { "description": "(Preview) Allows the app to read files that the user selects. The app has access for several hours after the user selects a file.", "displayName": "Read files that the user selects (preview)", "id": "5447fe39-cb82-4c1a-b977-520e67e724eb", "origin": "Delegated (Microsoft Graph)", - "value": "Files.Read.Selected" + "value": "Files.Read.Selected", + "userConsentDisplayName": "Read selected files", + "userConsentDescription": "(Preview) Allows the app to read files that you select. After you select a file, the app has access to the file for several hours." }, { "description": "Allows the app to read, create, update and delete the signed-in user's files.", "displayName": "Have full access to user files", "id": "5c28f0bf-8a70-41f1-8ab2-9032436ddb65", "origin": "Delegated (Microsoft Graph)", - "value": "Files.ReadWrite" + "value": "Files.ReadWrite", + "userConsentDisplayName": "Have full access to your files", + "userConsentDescription": "Allows the app to read, create, update, and delete your files." }, { "description": "Allows the app to read, create, update and delete all files the signed-in user can access.", "displayName": "Have full access to all files user can access", "id": "863451e7-0667-486c-a5d6-d135439485f0", "origin": "Delegated (Microsoft Graph)", - "value": "Files.ReadWrite.All" + "value": "Files.ReadWrite.All", + "userConsentDisplayName": "Have full access to all files you have access to", + "userConsentDescription": "Allows the app to read, create, update and delete all files that you can access." }, { "description": "(Preview) Allows the app to read, create, update and delete files in the application's folder.", "displayName": "Have full access to the application's folder (preview)", "id": "8019c312-3263-48e6-825e-2b833497195b", "origin": "Delegated (Microsoft Graph)", - "value": "Files.ReadWrite.AppFolder" + "value": "Files.ReadWrite.AppFolder", + "userConsentDisplayName": "Have full access to the application's folder", + "userConsentDescription": "(Preview) Allows the app to read, create, update and delete files in the application's folder." }, { "description": "(Preview) Allows the app to read and write files that the user selects. The app has access for several hours after the user selects a file.", "displayName": "Read and write files that the user selects (preview)", "id": "17dde5bd-8c17-420f-a486-969730c1b827", "origin": "Delegated (Microsoft Graph)", - "value": "Files.ReadWrite.Selected" + "value": "Files.ReadWrite.Selected", + "userConsentDisplayName": "Read and write selected files", + "userConsentDescription": "(Preview) Allows the app to read and write files that you select. After you select a file, the app has access to the file for several hours." }, { "description": "Allow the application to access files explicitly permissioned to the application on behalf of the signed in user. The specific files and the permissions granted will be configured in SharePoint Online or OneDrive.", @@ -2741,7 +3013,9 @@ "displayName": "Read user sensitivity labels and label policies.", "id": "4ad84827-5578-4e18-ad7a-86530b12f884", "origin": "Delegated (Microsoft Graph)", - "value": "InformationProtectionPolicy.Read" + "value": "InformationProtectionPolicy.Read", + "userConsentDisplayName": "Read user sensitivity labels and label policies.", + "userConsentDescription": "Allows an app to read information protection sensitivity labels and label policy settings, on behalf of the signed-in user." }, { "description": "Allows an app to read user metrics insights, such as daily and monthly active users, on behalf of the signed-in user.", @@ -2762,28 +3036,36 @@ "displayName": "Read learning content", "id": "ea4c1fd9-6a9f-4432-8e5d-86e06cc0da77", "origin": "Delegated (Microsoft Graph)", - "value": "LearningContent.Read.All" + "value": "LearningContent.Read.All", + "userConsentDisplayName": "Read learning content", + "userConsentDescription": "Allows the app to read learning content in the organization's directory, on your behalf." }, { "description": "Allows the app to manage learning content in the organization's directory, on behalf of the signed-in user.", "displayName": "Manage learning content", "id": "53cec1c4-a65f-4981-9dc1-ad75dbf1c077", "origin": "Delegated (Microsoft Graph)", - "value": "LearningContent.ReadWrite.All" + "value": "LearningContent.ReadWrite.All", + "userConsentDisplayName": "Manage learning content", + "userConsentDescription": "Allows the app to manage learning content in the organization's directory, on your behalf." }, { "description": "Allows the app to read data for the learning provider in the organization's directory, on behalf of the signed-in user.", "displayName": "Read learning provider", "id": "dd8ce36f-9245-45ea-a99e-8ac398c22861", "origin": "Delegated (Microsoft Graph)", - "value": "LearningProvider.Read" + "value": "LearningProvider.Read", + "userConsentDisplayName": "Read learning provider", + "userConsentDescription": "Allows the app to read data for the learning provider in the organization's directory, on your behalf." }, { "description": "Allows the app to create, update, read, and delete data for the learning provider in the organization's directory, on behalf of the signed-in user.", "displayName": "Manage learning provider", "id": "40c2eb57-abaf-49f5-9331-e90fd01f7130", "origin": "Delegated (Microsoft Graph)", - "value": "LearningProvider.ReadWrite" + "value": "LearningProvider.ReadWrite", + "userConsentDisplayName": "Manage learning provider", + "userConsentDescription": "Allows the app to create, update, read, and delete data for the learning provider in the organization's directory, on your behalf." }, { "description": "Allows the app to read outbound data flows on behalf of the signed-in user.", @@ -2832,28 +3114,36 @@ "displayName": "Read identity providers", "id": "43781733-b5a7-4d1b-98f4-e8edff23e1a9", "origin": "Delegated (Microsoft Graph)", - "value": "IdentityProvider.Read.All" + "value": "IdentityProvider.Read.All", + "userConsentDisplayName": "Read identity providers", + "userConsentDescription": "Allows the app to read your organization’s identity (authentication) providers’ properties on your behalf." }, { "description": "Allows the app to read and write your organization’s identity (authentication) providers’ properties on behalf of the user.", "displayName": "Read and write identity providers", "id": "f13ce604-1677-429f-90bd-8a10b9f01325", "origin": "Delegated (Microsoft Graph)", - "value": "IdentityProvider.ReadWrite.All" + "value": "IdentityProvider.ReadWrite.All", + "userConsentDisplayName": "Read and write identity providers", + "userConsentDescription": "Allows the app to read and write your organization’s identity (authentication) providers’ properties on your behalf." }, { - "description": "Allows the app to read identity risk event information for all users in your organization on behalf of the signed-in user.", + "description": "Allows the app to read identity risk event information for all users in your organization on behalf of the signed-in user. ", "displayName": "Read identity risk event information", "id": "8f6a01e7-0391-4ee5-aa22-a3af122cef27", "origin": "Delegated (Microsoft Graph)", - "value": "IdentityRiskEvent.Read.All" + "value": "IdentityRiskEvent.Read.All", + "userConsentDisplayName": "Read identity risk event information", + "userConsentDescription": "Allows the app to read identity risk event information for all users in your organization on behalf of the signed-in user. " }, { "description": "Allows the app to read and update identity risk event information for all users in your organization on behalf of the signed-in user. Update operations include confirming risk event detections. ", "displayName": "Read and write risk event information", "id": "9e4862a5-b68f-479e-848a-4e07e25c9916", "origin": "Delegated (Microsoft Graph)", - "value": "IdentityRiskEvent.ReadWrite.All" + "value": "IdentityRiskEvent.ReadWrite.All", + "userConsentDisplayName": "Read and write risk event information", + "userConsentDescription": "Allows the app to read and update identity risk event information for all users in your organization on your behalf. Update operations include confirming risk event detections. " }, { "description": "Allows the app to read risky agents information in your organization, on behalf of the signed-in user.", @@ -2874,49 +3164,63 @@ "displayName": "Read and write external connections", "id": "4082ad95-c812-4f02-be92-780c4c4f1830", "origin": "Delegated (Microsoft Graph)", - "value": "ExternalConnection.ReadWrite.OwnedBy" + "value": "ExternalConnection.ReadWrite.OwnedBy", + "userConsentDisplayName": "Read and write external connections", + "userConsentDescription": "Allows the app to read and write external connections on your behalf. The signed-in user must be an administrator. The app can only read and write external connections that it is authorized to, or it can create new external connections. " }, { "description": "Allows the app to read all identity risky service principal information for your organization, on behalf of the signed-in user.", "displayName": "Read all identity risky service principal information", "id": "ea5c4ab0-5a73-4f35-8272-5d5337884e5d", "origin": "Delegated (Microsoft Graph)", - "value": "IdentityRiskyServicePrincipal.Read.All" + "value": "IdentityRiskyServicePrincipal.Read.All", + "userConsentDisplayName": "Read all identity risky service principal information", + "userConsentDescription": "Allows the app to read all identity risky service principal information for your organization, on your behalf." }, { "description": "Allows the app to read identity risky user information for all users in your organization on behalf of the signed-in user.", "displayName": "Read identity risky user information", "id": "d04bb851-cb7c-4146-97c7-ca3e71baf56c", "origin": "Delegated (Microsoft Graph)", - "value": "IdentityRiskyUser.Read.All" + "value": "IdentityRiskyUser.Read.All", + "userConsentDisplayName": "Read identity risky user information", + "userConsentDescription": "Allows the app to read identity risky user information for all users in your organization on behalf of the signed-in user." }, { "description": "Allows the app to read and update identity risky user information for all users in your organization on behalf of the signed-in user. Update operations include dismissing risky users.", "displayName": "Read and write risky user information", "id": "e0a7cdbb-08b0-4697-8264-0069786e9674", "origin": "Delegated (Microsoft Graph)", - "value": "IdentityRiskyUser.ReadWrite.All" + "value": "IdentityRiskyUser.ReadWrite.All", + "userConsentDisplayName": "Read and write identity risky user information", + "userConsentDescription": "Allows the app to read and update identity risky user information for all users in your organization on your behalf. Update operations include dismissing risky users." }, { "description": "Allows the app to read your organization's user flows, on behalf of the signed-in user.", "displayName": "Read all identity user flows", "id": "2903d63d-4611-4d43-99ce-a33f3f52e343", "origin": "Delegated (Microsoft Graph)", - "value": "IdentityUserFlow.Read.All" + "value": "IdentityUserFlow.Read.All", + "userConsentDisplayName": "Read all identity user flows", + "userConsentDescription": "Allows the app to read your organization's user flows, on your behalf." }, { "description": "Allows the app to read or write your organization's user flows, on behalf of the signed-in user.", "displayName": "Read and write all identity user flows", "id": "281892cc-4dbf-4e3a-b6cc-b21029bb4e82", "origin": "Delegated (Microsoft Graph)", - "value": "IdentityUserFlow.ReadWrite.All" + "value": "IdentityUserFlow.ReadWrite.All", + "userConsentDisplayName": "Read and write all identity user flows", + "userConsentDescription": "Allows the app to read or write your organization's user flows, on your behalf." }, { "description": "Allows the app to have the same access to mailboxes as the signed-in user via IMAP protocol.", "displayName": "Read and write access to mailboxes via IMAP.", "id": "652390e4-393a-48de-9484-05f9b1212954", "origin": "Delegated (Microsoft Graph)", - "value": "IMAP.AccessAsUser.All" + "value": "IMAP.AccessAsUser.All", + "userConsentDisplayName": "Read and write access to your mail.", + "userConsentDescription": "Allows the app to read, update, create and delete email in your mailbox. Does not include permission to send mail." }, { "description": "Allows the app to read basic Industry Data service and resource information on behalf of the signed-in user.", @@ -2944,21 +3248,27 @@ "displayName": "Read and write all identity risky service principal information", "id": "bb6f654c-d7fd-4ae3-85c3-fc380934f515", "origin": "Delegated (Microsoft Graph)", - "value": "IdentityRiskyServicePrincipal.ReadWrite.All" + "value": "IdentityRiskyServicePrincipal.ReadWrite.All", + "userConsentDisplayName": "Read and write all identity risky service principal information", + "userConsentDescription": "Allows the app to read and update identity risky service principal information for all service principals in your organization, on your behalf. Update operations include dismissing risky service principals." }, { "description": "Allows the app to read and write all external connections on behalf of a signed-in user. The signed-in user must be an administrator.", "displayName": "Read and write all external connections", "id": "bbbbd9b3-3566-4931-ac37-2b2180d9e334", "origin": "Delegated (Microsoft Graph)", - "value": "ExternalConnection.ReadWrite.All" + "value": "ExternalConnection.ReadWrite.All", + "userConsentDisplayName": "Read and write all external connections", + "userConsentDescription": "Allows the app to read and write all external connections on your behalf. The signed-in user must be an administrator." }, { "description": "Allows the app to read all external connections on behalf of a signed-in user. The signed-in user must be an administrator.", "displayName": "Read all external connections", "id": "a38267a5-26b6-4d76-9493-935b7599116b", "origin": "Delegated (Microsoft Graph)", - "value": "ExternalConnection.Read.All" + "value": "ExternalConnection.Read.All", + "userConsentDisplayName": "Read all external connections", + "userConsentDescription": "Allows the app to read all external connections on your behalf. The signed-in user must be an administrator." }, { "description": "Allows the app to search the email message trace on behalf of the signed-in user.", @@ -2979,14 +3289,18 @@ "displayName": "Read Microsoft Intune apps", "id": "4edf5f54-4666-44af-9de9-0144fb4b6e8c", "origin": "Delegated (Microsoft Graph)", - "value": "DeviceManagementApps.Read.All" + "value": "DeviceManagementApps.Read.All", + "userConsentDisplayName": "Read Microsoft Intune apps", + "userConsentDescription": "Allows the app to read the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune." }, { "description": "Allows the app to read and write the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune.", "displayName": "Read and write Microsoft Intune apps", "id": "7b3f05d5-f68c-4b8d-8c59-a2ecd12f24af", "origin": "Delegated (Microsoft Graph)", - "value": "DeviceManagementApps.ReadWrite.All" + "value": "DeviceManagementApps.ReadWrite.All", + "userConsentDisplayName": "Read and write Microsoft Intune apps", + "userConsentDescription": "Allows the app to read and write the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune." }, { "description": "Allows the app to read certification authority information on behalf of the signed-in user.", @@ -3007,14 +3321,18 @@ "displayName": "Read Microsoft Intune Device Configuration and Policies", "id": "f1493658-876a-4c87-8fa7-edb559b3476a", "origin": "Delegated (Microsoft Graph)", - "value": "DeviceManagementConfiguration.Read.All" + "value": "DeviceManagementConfiguration.Read.All", + "userConsentDisplayName": "Read Microsoft Intune Device Configuration and Policies", + "userConsentDescription": "Allows the app to read properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups." }, { "description": "Allows the app to read and write properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups.", "displayName": "Read and write Microsoft Intune Device Configuration and Policies", "id": "0883f392-0a7a-443d-8c76-16a6d39c7b63", "origin": "Delegated (Microsoft Graph)", - "value": "DeviceManagementConfiguration.ReadWrite.All" + "value": "DeviceManagementConfiguration.ReadWrite.All", + "userConsentDisplayName": "Read and write Microsoft Intune Device Configuration and Policies", + "userConsentDescription": "Allows the app to read and write properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups." }, { "description": "Allows the app to read properties of Microsoft Intune-managed deployment plans and their ring configurations.", @@ -3035,35 +3353,45 @@ "displayName": "Perform user-impacting remote actions on Microsoft Intune devices", "id": "3404d2bf-2b13-457e-a330-c24615765193", "origin": "Delegated (Microsoft Graph)", - "value": "DeviceManagementManagedDevices.PrivilegedOperations.All" + "value": "DeviceManagementManagedDevices.PrivilegedOperations.All", + "userConsentDisplayName": "Perform user-impacting remote actions on Microsoft Intune devices", + "userConsentDescription": "Allows the app to perform remote high impact actions such as wiping the device or resetting the passcode on devices managed by Microsoft Intune." }, { "description": "Allows the app to read the properties of devices managed by Microsoft Intune.", "displayName": "Read Microsoft Intune devices", "id": "314874da-47d6-4978-88dc-cf0d37f0bb82", "origin": "Delegated (Microsoft Graph)", - "value": "DeviceManagementManagedDevices.Read.All" + "value": "DeviceManagementManagedDevices.Read.All", + "userConsentDisplayName": "Read devices Microsoft Intune devices", + "userConsentDescription": "Allows the app to read the properties of devices managed by Microsoft Intune." }, { "description": "Allows the app to read and write the properties of devices managed by Microsoft Intune. Does not allow high impact operations such as remote wipe and password reset on the device’s owner.", "displayName": "Read and write Microsoft Intune devices", "id": "44642bfe-8385-4adc-8fc6-fe3cb2c375c3", "origin": "Delegated (Microsoft Graph)", - "value": "DeviceManagementManagedDevices.ReadWrite.All" + "value": "DeviceManagementManagedDevices.ReadWrite.All", + "userConsentDisplayName": "Read and write Microsoft Intune devices", + "userConsentDescription": "Allows the app to read and write the properties of devices managed by Microsoft Intune. Does not allow high impact operations such as remote wipe and password reset on the device’s owner." }, { "description": "Allows the app to read the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings.", "displayName": "Read Microsoft Intune RBAC settings", "id": "49f0cc30-024c-4dfd-ab3e-82e137ee5431", "origin": "Delegated (Microsoft Graph)", - "value": "DeviceManagementRBAC.Read.All" + "value": "DeviceManagementRBAC.Read.All", + "userConsentDisplayName": "Read Microsoft Intune RBAC settings", + "userConsentDescription": "Allows the app to read the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings." }, { "description": "Allows the app to read and write the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings.", "displayName": "Read and write Microsoft Intune RBAC settings", "id": "0c5e8a55-87a6-4556-93ab-adc52c4d862d", "origin": "Delegated (Microsoft Graph)", - "value": "DeviceManagementRBAC.ReadWrite.All" + "value": "DeviceManagementRBAC.ReadWrite.All", + "userConsentDisplayName": "Read and write Microsoft Intune RBAC settings", + "userConsentDescription": "Allows the app to read and write the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings." }, { "description": "Allows the app to read Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts on behalf of the signed in user.", @@ -3084,28 +3412,36 @@ "displayName": "Read Microsoft Intune configuration", "id": "8696daa5-bce5-4b2e-83f9-51b6defc4e1e", "origin": "Delegated (Microsoft Graph)", - "value": "DeviceManagementServiceConfig.Read.All" + "value": "DeviceManagementServiceConfig.Read.All", + "userConsentDisplayName": "Read Microsoft Intune configuration", + "userConsentDescription": "Allows the app to read Microsoft Intune service properties including device enrollment and third party service connection configuration." }, { "description": "Allows the app to read device local credential properties including passwords, on behalf of the signed-in user.", "displayName": "Read device local credential passwords", "id": "280b3b69-0437-44b1-bc20-3b2fca1ee3e9", "origin": "Delegated (Microsoft Graph)", - "value": "DeviceLocalCredential.Read.All" + "value": "DeviceLocalCredential.Read.All", + "userConsentDisplayName": "Manage LAPS passwords", + "userConsentDescription": "Allows to read the LAPS passwords." }, { "description": "Allows the app to read your organization's devices' configuration information on behalf of the signed-in user.", "displayName": "Read all devices", "id": "951183d1-1a61-466f-a6d1-1fde911bfd95", "origin": "Delegated (Microsoft Graph)", - "value": "Device.Read.All" + "value": "Device.Read.All", + "userConsentDisplayName": "Read all devices", + "userConsentDescription": "Allows the app to read devices' configuration information on your behalf." }, { "description": "Allows the app to read a user's list of devices on behalf of the signed-in user.", "displayName": "Read user devices", "id": "11d4cd79-5ba5-460f-803f-e22c8ab85ccd", "origin": "Delegated (Microsoft Graph)", - "value": "Device.Read" + "value": "Device.Read", + "userConsentDisplayName": "View your list of devices", + "userConsentDescription": "Allows the app to see your list of devices." }, { "description": "Allows the app to create device objects based on device templates owned by the signed-in user, on behalf of the signed in user.", @@ -3119,14 +3455,18 @@ "displayName": "Read your organization's custom authentication extensions", "id": "b2052569-c98c-4f36-a5fb-43e5c111e6d0", "origin": "Delegated (Microsoft Graph)", - "value": "CustomAuthenticationExtension.Read.All" + "value": "CustomAuthenticationExtension.Read.All", + "userConsentDisplayName": "Read your organization's custom authentication extensions", + "userConsentDescription": "Allows the app to read your organization's custom authentication extensions on your behalf." }, { "description": "Allows the app to read or write your organization's custom authentication extensions on behalf of the signed-in user.", "displayName": "Read and write your organization's custom authentication extensions", "id": "8dfcf82f-15d0-43b3-bc78-a958a13a5792", "origin": "Delegated (Microsoft Graph)", - "value": "CustomAuthenticationExtension.ReadWrite.All" + "value": "CustomAuthenticationExtension.ReadWrite.All", + "userConsentDisplayName": "Read and write your organization's custom authentication extensions", + "userConsentDescription": "Allows the app to read or write your organization's custom authentication extensions on your behalf." }, { "description": "Allows the app to read custom detection rules on behalf of the signed-in user.", @@ -3147,14 +3487,18 @@ "displayName": "Read custom security attribute assignments", "id": "b46ffa80-fe3d-4822-9a1a-c200932d54d0", "origin": "Delegated (Microsoft Graph)", - "value": "CustomSecAttributeAssignment.Read.All" + "value": "CustomSecAttributeAssignment.Read.All", + "userConsentDisplayName": "Read custom security attribute assignments", + "userConsentDescription": "Allows the app to read custom security attribute assignments for all principals in the tenant on your behalf." }, { "description": "Allows the app to read and write custom security attribute assignments for all principals in the tenant on behalf of a signed in user.", "displayName": "Read and write custom security attribute assignments", "id": "ca46335e-8453-47cd-a001-8459884efeae", "origin": "Delegated (Microsoft Graph)", - "value": "CustomSecAttributeAssignment.ReadWrite.All" + "value": "CustomSecAttributeAssignment.ReadWrite.All", + "userConsentDisplayName": "Read and write custom security attribute assignments", + "userConsentDescription": "Allows the app to read and write custom security attribute assignments for all principals in the tenant on your behalf." }, { "description": "Allows the app to read audit logs for events that contain information about custom security attributes, on behalf of the signed-in user.", @@ -3168,21 +3512,27 @@ "displayName": "Read custom security attribute definitions", "id": "ce026878-a0ff-4745-a728-d4fedd086c07", "origin": "Delegated (Microsoft Graph)", - "value": "CustomSecAttributeDefinition.Read.All" + "value": "CustomSecAttributeDefinition.Read.All", + "userConsentDisplayName": "Read custom security attribute definitions", + "userConsentDescription": "Allows the app to read custom security attribute definitions for the tenant on your behalf." }, { "description": "Allows the app to read and write Microsoft Intune service properties including device enrollment and third party service connection configuration.", "displayName": "Read and write Microsoft Intune configuration", "id": "662ed50a-ac44-4eef-ad86-62eed9be2a29", "origin": "Delegated (Microsoft Graph)", - "value": "DeviceManagementServiceConfig.ReadWrite.All" + "value": "DeviceManagementServiceConfig.ReadWrite.All", + "userConsentDisplayName": "Read and write Microsoft Intune configuration", + "userConsentDescription": "Allows the app to read and write Microsoft Intune service properties including device enrollment and third party service connection configuration." }, { "description": "Allows the app to read and write custom security attribute definitions for the tenant on behalf of a signed in user.", "displayName": "Read and write custom security attribute definitions", "id": "8b0160d4-5743-482b-bb27-efc0a485ca4a", "origin": "Delegated (Microsoft Graph)", - "value": "CustomSecAttributeDefinition.ReadWrite.All" + "value": "CustomSecAttributeDefinition.ReadWrite.All", + "userConsentDisplayName": "Read and write custom security attribute definitions", + "userConsentDescription": "Allows the app to read and write custom security attribute definitions for the tenant on your behalf." }, { "description": "Allows the app to read and edit the provisioning configuration of all active custom security attributes on behalf of a signed in user.", @@ -3210,14 +3560,18 @@ "displayName": "Read Delegated Admin relationships with customers", "id": "0c0064ea-477b-4130-82a5-4c2cc4ff68aa", "origin": "Delegated (Microsoft Graph)", - "value": "DelegatedAdminRelationship.Read.All" + "value": "DelegatedAdminRelationship.Read.All", + "userConsentDisplayName": "Read Delegated Admin relationships with customers", + "userConsentDescription": "Allows the app to read details of Delegated Admin relationships with customers like access details (that includes roles) and the duration as well as specific role assignments to security groups on your behalf." }, { "description": "Allows the app to manage (create-update-terminate) Delegated Admin relationships with customers as well as role assignments to security groups for active Delegated Admin relationships on behalf of the signed-in user.", "displayName": "Manage Delegated Admin relationships with customers", "id": "885f682f-a990-4bad-a642-36736a74b0c7", "origin": "Delegated (Microsoft Graph)", - "value": "DelegatedAdminRelationship.ReadWrite.All" + "value": "DelegatedAdminRelationship.ReadWrite.All", + "userConsentDisplayName": "Manage Delegated Admin relationships with customers", + "userConsentDescription": "Allows the app to manage (create-update-terminate) Delegated Admin relationships with customers and role assignments to security groups for active Delegated Admin relationships on your behalf." }, { "description": "Allows the app to read delegated permission grants, on behalf of the signed in user.", @@ -3231,14 +3585,18 @@ "displayName": "Manage all delegated permission grants", "id": "41ce6ca6-6826-4807-84f1-1c82854f7ee5", "origin": "Delegated (Microsoft Graph)", - "value": "DelegatedPermissionGrant.ReadWrite.All" + "value": "DelegatedPermissionGrant.ReadWrite.All", + "userConsentDisplayName": "Manage all delegated permission grants", + "userConsentDescription": "Allows the app to manage permission grants for delegated permissions exposed by any API (including Microsoft Graph), on your behalf. " }, { "description": "Allows the app to launch another app or communicate with another app on a user's device on behalf of the signed-in user.", "displayName": "Communicate with user devices", "id": "bac3b9c2-b516-4ef4-bd3b-c2ef73d8d804", "origin": "Delegated (Microsoft Graph)", - "value": "Device.Command" + "value": "Device.Command", + "userConsentDisplayName": "Communicate with your other devices", + "userConsentDescription": "Allows the app to launch another app or communicate with another app on a device that you own." }, { "description": "Allows the app to read the provisioning configuration of all active custom security attributes on behalf of a signed in user.", @@ -3273,14 +3631,18 @@ "displayName": "Read and write users' view of the roster", "id": "359e19a6-e3fa-4d7f-bcab-d28ec592b51e", "origin": "Delegated (Microsoft Graph)", - "value": "EduRoster.ReadWrite" + "value": "EduRoster.ReadWrite", + "userConsentDisplayName": "View and modify your school, class and user information", + "userConsentDescription": "Allows the app to view and modify information about schools and classes in your organization and education-related information about you and other users on your behalf." }, { "description": "Allows the app to read your users' primary email address", "displayName": "View users' email address", "id": "64a6cdd6-aab1-4aaf-94b8-3cc8405e90d0", "origin": "Delegated (Microsoft Graph)", - "value": "email" + "value": "email", + "userConsentDisplayName": "View your email address", + "userConsentDescription": "Allows the app to read your primary email address" }, { "description": "Allows the app to read Viva Engage conversations, and to read their properties on behalf of the signed-in user.", @@ -3329,14 +3691,18 @@ "displayName": "Read all entitlement management resources", "id": "5449aa12-1393-4ea2-a7c7-d0e06c1a56b2", "origin": "Delegated (Microsoft Graph)", - "value": "EntitlementManagement.Read.All" + "value": "EntitlementManagement.Read.All", + "userConsentDisplayName": "Read all entitlement management resources", + "userConsentDescription": "Allows the app to read access packages and related entitlement management resources that you have access to." }, { "description": "Allows the app to request access to and management of access packages and related entitlement management resources on behalf of the signed-in user.", "displayName": "Read and write entitlement management resources", "id": "ae7a573d-81d7-432b-ad44-4ed5c9d89038", "origin": "Delegated (Microsoft Graph)", - "value": "EntitlementManagement.ReadWrite.All" + "value": "EntitlementManagement.ReadWrite.All", + "userConsentDisplayName": "Read and write entitlement management resources", + "userConsentDescription": "Allows the app to request access to and management of access packages and related entitlement management resources that you have access to." }, { "description": "Allows the app to manage self-service entitlement management resources on behalf of the signed-in user. This includes operations such as requesting access and approving access of others.", @@ -3371,35 +3737,45 @@ "displayName": "Read your organization's authentication event listeners", "id": "f7dd3bed-5eec-48da-bc73-1c0ef50bc9a1", "origin": "Delegated (Microsoft Graph)", - "value": "EventListener.Read.All" + "value": "EventListener.Read.All", + "userConsentDisplayName": "Read your organization's authentication event listeners", + "userConsentDescription": "Allows the app to read your organization's authentication event listeners on your behalf." }, { "description": "Allows the app to read or write your organization's authentication event listeners on behalf of the signed-in user.", "displayName": "Read and write your organization's authentication event listeners", "id": "d11625a6-fe21-4fc6-8d3d-063eba5525ad", "origin": "Delegated (Microsoft Graph)", - "value": "EventListener.ReadWrite.All" + "value": "EventListener.ReadWrite.All", + "userConsentDisplayName": "Read and write your organization's authentication event listeners", + "userConsentDescription": "Allows the app to read or write your organization's authentication event listeners on your behalf." }, { "description": "Allows the app to have the same access to mailboxes as the signed-in user via Exchange Web Services.", "displayName": "Access mailboxes as the signed-in user via Exchange Web Services", "id": "9769c687-087d-48ac-9cb3-c37dde652038", "origin": "Delegated (Microsoft Graph)", - "value": "EWS.AccessAsUser.All" + "value": "EWS.AccessAsUser.All", + "userConsentDisplayName": "Access your mailboxes", + "userConsentDescription": "Allows the app full access to your mailboxes on your behalf." }, { "description": "Allows the app to read a limited subset of the properties from the structure of schools and classes in an organization's roster and a limited subset of properties about users to be read on behalf of the user. Includes name, status, education role, email address and photo.", "displayName": "Read a limited subset of users' view of the roster", "id": "5d186531-d1bf-4f07-8cea-7c42119e1bd9", "origin": "Delegated (Microsoft Graph)", - "value": "EduRoster.ReadBasic" + "value": "EduRoster.ReadBasic", + "userConsentDisplayName": "View a limited subset of your school, class and user information", + "userConsentDescription": "Allows the app to view minimal  information about both schools and classes in your organization and education-related information about you and other users on your behalf." }, { "description": "Allows the app to read the structure of schools and classes in an organization's roster and education-specific information about users to be read on behalf of the user.", "displayName": "Read users' view of the roster", "id": "a4389601-22d9-4096-ac18-36a927199112", "origin": "Delegated (Microsoft Graph)", - "value": "EduRoster.Read" + "value": "EduRoster.Read", + "userConsentDisplayName": "View your school, class and user information", + "userConsentDescription": "Allows the app to view information about schools and classes in your organization and education-related information about you and other users on your behalf." }, { "description": "Allows the app to read and write user's modules and resources on behalf of the signed-in user.", @@ -3420,49 +3796,63 @@ "displayName": "Access directory as the signed in user", "id": "0e263e50-5827-48a4-b97c-d940288653c7", "origin": "Delegated (Microsoft Graph)", - "value": "Directory.AccessAsUser.All" + "value": "Directory.AccessAsUser.All", + "userConsentDisplayName": "Access the directory as you", + "userConsentDescription": "Allows the app to have the same access to information in your work or school directory as you do." }, { "description": "Allows the app to read data in your organization's directory, such as users, groups and apps.", "displayName": "Read directory data", "id": "06da0dbc-49e2-44d2-8312-53f166ab848a", "origin": "Delegated (Microsoft Graph)", - "value": "Directory.Read.All" + "value": "Directory.Read.All", + "userConsentDisplayName": "Read directory data", + "userConsentDescription": "Allows the app to read data in your organization's directory." }, { "description": "Allows the app to read and write data in your organization's directory, such as users, and groups. It does not allow the app to delete users or groups, or reset user passwords.", "displayName": "Read and write directory data", "id": "c5366453-9fb0-48a5-a156-24f0c49a4b84", "origin": "Delegated (Microsoft Graph)", - "value": "Directory.ReadWrite.All" + "value": "Directory.ReadWrite.All", + "userConsentDisplayName": "Read and write directory data", + "userConsentDescription": "Allows the app to read and write data in your organization's directory, such as other users, groups. It does not allow the app to delete users or groups, or reset user passwords." }, { "description": "Allows the app to read Azure AD recommendations, on behalf of the signed-in user.", "displayName": "Read Azure AD recommendations", "id": "34d3bd24-f6a6-468c-b67c-0c365c1d6410", "origin": "Delegated (Microsoft Graph)", - "value": "DirectoryRecommendations.Read.All" + "value": "DirectoryRecommendations.Read.All", + "userConsentDisplayName": "Read Azure AD recommendations", + "userConsentDescription": "Allows the app to read Azure AD recommendations, on your behalf." }, { - "description": "Allows the app to read and update Azure AD recommendations, on behalf of the signed-in user.", + "description": "Allows the app to read and update Azure AD recommendations, on behalf of the signed-in user. ", "displayName": "Read and update Azure AD recommendations", "id": "f37235e8-90a0-4189-93e2-e55b53867ccd", "origin": "Delegated (Microsoft Graph)", - "value": "DirectoryRecommendations.ReadWrite.All" + "value": "DirectoryRecommendations.ReadWrite.All", + "userConsentDisplayName": "Read and update Azure AD recommendations", + "userConsentDescription": "Allows the app to read and update Azure AD recommendations, on your behalf." }, { "description": "Allows the app to read all domain properties on behalf of the signed-in user.", "displayName": "Read domains.", "id": "2f9ee017-59c1-4f1d-9472-bd5529a7b311", "origin": "Delegated (Microsoft Graph)", - "value": "Domain.Read.All" + "value": "Domain.Read.All", + "userConsentDisplayName": "Read domains.", + "userConsentDescription": "Allows the app to read all domain properties on your behalf." }, { "description": "Allows the app to read and write all domain properties on behalf of the signed-in user. Also allows the app to add, verify and remove domains.", "displayName": "Read and write domains", "id": "0b5d694c-a244-4bde-86e6-eb5cd07730fe", "origin": "Delegated (Microsoft Graph)", - "value": "Domain.ReadWrite.All" + "value": "Domain.ReadWrite.All", + "userConsentDisplayName": "Read and write domains", + "userConsentDescription": "Allows the app to read and write all domain properties on your behalf. Also allows the app to add, verify and remove domains." }, { "description": "Allows the app to read internal federation configuration for a domain.", @@ -3490,63 +3880,81 @@ "displayName": "Read all eDiscovery objects", "id": "99201db3-7652-4d5a-809a-bdb94f85fe3c", "origin": "Delegated (Microsoft Graph)", - "value": "eDiscovery.Read.All" + "value": "eDiscovery.Read.All", + "userConsentDisplayName": "Read all eDiscovery objects", + "userConsentDescription": "Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects on your behalf." }, { "description": "Allows the app to read and write eDiscovery objects such as cases, custodians, review sets and other related objects on behalf of the signed-in user.", "displayName": "Read and write all eDiscovery objects", "id": "acb8f680-0834-4146-b69e-4ab1b39745ad", "origin": "Delegated (Microsoft Graph)", - "value": "eDiscovery.ReadWrite.All" + "value": "eDiscovery.ReadWrite.All", + "userConsentDisplayName": "Read and write all eDiscovery objects", + "userConsentDescription": "Allows the app to read and write eDiscovery objects such as cases, custodians, review sets and other related objects on your behalf." }, { "description": "Read the state and settings of all Microsoft education apps on behalf of the user.", "displayName": "Read education app settings", "id": "8523895c-6081-45bf-8a5d-f062a2f12c9f", "origin": "Delegated (Microsoft Graph)", - "value": "EduAdministration.Read" + "value": "EduAdministration.Read", + "userConsentDisplayName": "View your education app settings", + "userConsentDescription": "Allows the app to view the state and settings of all Microsoft education apps on your behalf." }, { "description": "Manage the state and settings of all Microsoft education apps on behalf of the user.", "displayName": "Manage education app settings", "id": "63589852-04e3-46b4-bae9-15d5b1050748", "origin": "Delegated (Microsoft Graph)", - "value": "EduAdministration.ReadWrite" + "value": "EduAdministration.ReadWrite", + "userConsentDisplayName": "Manage your education app settings", + "userConsentDescription": "Allows the app to manage the state and settings of all Microsoft education apps on your behalf." }, { "description": "Allows the app to read assignments and their grades on behalf of the user.", "displayName": "Read users' class assignments and their grades", "id": "091460c9-9c4a-49b2-81ef-1f3d852acce2", "origin": "Delegated (Microsoft Graph)", - "value": "EduAssignments.Read" + "value": "EduAssignments.Read", + "userConsentDisplayName": "View your assignments and grades", + "userConsentDescription": "Allows the app to view your assignments on your behalf including grades." }, { "description": "Allows the app to read assignments without grades on behalf of the user.", "displayName": "Read users' class assignments without grades", "id": "c0b0103b-c053-4b2e-9973-9f3a544ec9b8", "origin": "Delegated (Microsoft Graph)", - "value": "EduAssignments.ReadBasic" + "value": "EduAssignments.ReadBasic", + "userConsentDisplayName": "View your assignments without grades", + "userConsentDescription": "Allows the app to view your assignments on your behalf without seeing grades." }, { "description": "Allows the app to read and write assignments and their grades on behalf of the user.", "displayName": "Read and write users' class assignments and their grades", "id": "2f233e90-164b-4501-8bce-31af2559a2d3", "origin": "Delegated (Microsoft Graph)", - "value": "EduAssignments.ReadWrite" + "value": "EduAssignments.ReadWrite", + "userConsentDisplayName": "View and modify your assignments and grades", + "userConsentDescription": "Allows the app to view and modify your assignments on your behalf including  grades." }, { "description": "Allows the app to read and write assignments without grades on behalf of the user.", "displayName": "Read and write users' class assignments without grades", "id": "2ef770a1-622a-47c4-93ee-28d6adbed3a0", "origin": "Delegated (Microsoft Graph)", - "value": "EduAssignments.ReadWriteBasic" + "value": "EduAssignments.ReadWriteBasic", + "userConsentDisplayName": "View and modify your assignments without grades", + "userConsentDescription": "Allows the app to view and modify your assignments on your behalf without seeing grades." }, { "description": "Allows the app to have the same access to mailboxes as the signed-in user via Exchange ActiveSync.", "displayName": "Access mailboxes via Exchange ActiveSync", "id": "ff91d191-45a0-43fd-b837-bd682c4a0b0f", "origin": "Delegated (Microsoft Graph)", - "value": "EAS.AccessAsUser.All" + "value": "EAS.AccessAsUser.All", + "userConsentDisplayName": "Access your mailboxes", + "userConsentDescription": "Allows the app full access to your mailboxes on your behalf." }, { "description": "Allows the app to read time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.", @@ -3574,7 +3982,9 @@ "displayName": "Read consent and permission grant policies", "id": "414de6ea-2d92-462f-b120-6e2a809a6d01", "origin": "Delegated (Microsoft Graph)", - "value": "Policy.Read.PermissionGrant" + "value": "Policy.Read.PermissionGrant", + "userConsentDisplayName": "Read consent and permission grant policies", + "userConsentDescription": "Allows the app to read policies related to consent and permission grants for applications, on your behalf." }, { "description": "Allows the application to read the organization's recovery policy on behalf of the signed-in user.", @@ -3588,35 +3998,45 @@ "displayName": "Read and write your organization's directory access review default policy", "id": "4f5bc9c8-ea54-4772-973a-9ca119cb0409", "origin": "Delegated (Microsoft Graph)", - "value": "Policy.ReadWrite.AccessReview" + "value": "Policy.ReadWrite.AccessReview", + "userConsentDisplayName": "Read and write your organization's directory access review default policy", + "userConsentDescription": "Allows the app to read and write your organization's directory access review default policy on your behalf." }, { "description": "Allows the app to read and write your organization's application configuration policies on behalf of the signed-in user. This includes policies such as activityBasedTimeoutPolicy, claimsMappingPolicy, homeRealmDiscoveryPolicy, tokenIssuancePolicy and tokenLifetimePolicy.", "displayName": "Read and write your organization's application configuration policies", "id": "b27add92-efb2-4f16-84f5-8108ba77985c", "origin": "Delegated (Microsoft Graph)", - "value": "Policy.ReadWrite.ApplicationConfiguration" + "value": "Policy.ReadWrite.ApplicationConfiguration", + "userConsentDisplayName": "Read and write your organization's application configuration policies", + "userConsentDescription": "Allows the app to read and write your organization's application configuration policies on your behalf. This includes policies such as activityBasedTimeoutPolicy, claimsMappingPolicy, homeRealmDiscoveryPolicy, tokenIssuancePolicy and tokenLifetimePolicy." }, { - "description": "Allows the app to read and write the authentication flow policies, on behalf of the signed-in user.", + "description": "Allows the app to read and write the authentication flow policies, on behalf of the signed-in user. ", "displayName": "Read and write authentication flow policies", "id": "edb72de9-4252-4d03-a925-451deef99db7", "origin": "Delegated (Microsoft Graph)", - "value": "Policy.ReadWrite.AuthenticationFlows" + "value": "Policy.ReadWrite.AuthenticationFlows", + "userConsentDisplayName": "Read and write your authentication flow policies", + "userConsentDescription": "Allows the app to read and write the authentication flow policies for your tenant, on your behalf." }, { "description": "Allows the app to read and write the authentication method policies, on behalf of the signed-in user. ", "displayName": "Read and write authentication method policies", "id": "7e823077-d88e-468f-a337-e18f1f0e6c7c", "origin": "Delegated (Microsoft Graph)", - "value": "Policy.ReadWrite.AuthenticationMethod" + "value": "Policy.ReadWrite.AuthenticationMethod", + "userConsentDisplayName": "Read and write your authentication method policies ", + "userConsentDescription": "Allows the app to read and write the authentication method policies for your tenant, on your behalf." }, { "description": "Allows the app to read and write your organization's authorization policy on behalf of the signed-in user. For example, authorization policies can control some of the permissions that the out-of-the-box user role has by default.", "displayName": "Read and write your organization's authorization policy", "id": "edd3c878-b384-41fd-95ad-e7407dd775be", "origin": "Delegated (Microsoft Graph)", - "value": "Policy.ReadWrite.Authorization" + "value": "Policy.ReadWrite.Authorization", + "userConsentDisplayName": "Read and write your organization's authorization policy", + "userConsentDescription": "Allows the app to read and write your organization's authorization policy on your behalf. For example, authorization policies can control some of the permissions that the out-of-the-box user role has by default." }, { "description": "Allows the app to read and write your organization's B2BManagement policies on behalf of the signed-in user.", @@ -3630,21 +4050,27 @@ "displayName": "Read and write your organization's conditional access policies", "id": "ad902697-1014-4ef5-81ef-2b4301988e8c", "origin": "Delegated (Microsoft Graph)", - "value": "Policy.ReadWrite.ConditionalAccess" + "value": "Policy.ReadWrite.ConditionalAccess", + "userConsentDisplayName": "Read and write your organization's conditional access policies", + "userConsentDescription": "Allows the app to read and write your organization's conditional access policies on your behalf." }, { "description": "Allows the app to read and write your organization's consent requests policy on behalf of the signed-in user.", "displayName": "Read and write consent request policy", "id": "4d135e65-66b8-41a8-9f8b-081452c91774", "origin": "Delegated (Microsoft Graph)", - "value": "Policy.ReadWrite.ConsentRequest" + "value": "Policy.ReadWrite.ConsentRequest", + "userConsentDisplayName": "Read and write consent request policy", + "userConsentDescription": "Allows the app to read and write your organization's consent request policy on your behalf." }, { "description": "Allows the app to read and write your organization's cross-tenant access policies and configuration for automatic user consent settings to suppress consent prompts for users of the other tenant on behalf of the signed-in user.", "displayName": "Read and write your organization's cross tenant access policies", "id": "014b43d0-6ed4-4fc6-84dc-4b6f7bae7d85", "origin": "Delegated (Microsoft Graph)", - "value": "Policy.ReadWrite.CrossTenantAccess" + "value": "Policy.ReadWrite.CrossTenantAccess", + "userConsentDisplayName": "Read and write your organization's cross tenant access policies", + "userConsentDescription": "Allows the app to read and write your organization's cross tenant access policies on your behalf." }, { "description": "Allows the app to read and write your organization's M365 cross tenant access capabilities on behalf of the signed-in user.", @@ -3658,7 +4084,9 @@ "displayName": "Read and write your organization's device configuration policies", "id": "40b534c3-9552-4550-901b-23879c90bcf9", "origin": "Delegated (Microsoft Graph)", - "value": "Policy.ReadWrite.DeviceConfiguration" + "value": "Policy.ReadWrite.DeviceConfiguration", + "userConsentDisplayName": "Read and write your organization's device configuration policies", + "userConsentDescription": "Allows the app to read and write your organization's device configuration policies on your behalf. For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks." }, { "description": "Allows the application to read and update the organization's external identities policy on behalf of the signed-in user. For example, external identities policy controls if users invited to access resources in your organization via B2B collaboration or B2B direct connect are allowed to self-service leave.", @@ -3672,7 +4100,9 @@ "displayName": "Read and write your organization's feature rollout policies", "id": "92a38652-f13b-4875-bc77-6e1dbb63e1b2", "origin": "Delegated (Microsoft Graph)", - "value": "Policy.ReadWrite.FeatureRollout" + "value": "Policy.ReadWrite.FeatureRollout", + "userConsentDisplayName": "Read and write your organization's feature rollout policies", + "userConsentDescription": "Allows the app to read and write your organization's feature rollout policies on your behalf. Includes abilities to assign and remove users and groups to rollout of a specific feature." }, { "description": "Allows the application to read and update the organization's federated token validation policy on behalf of the signed-in user.", @@ -3700,7 +4130,9 @@ "displayName": "Read and write your organization's mobility management policies", "id": "a8ead177-1889-4546-9387-f25e658e2a79", "origin": "Delegated (Microsoft Graph)", - "value": "Policy.ReadWrite.MobilityManagement" + "value": "Policy.ReadWrite.MobilityManagement", + "userConsentDisplayName": "Read and write your organization's mobility management policies", + "userConsentDescription": "Allows the app to read and write your organization's mobility management policies on your behalf. For example, a mobility management policy can set the enrollment scope for a given mobility management application." }, { "description": "Allows the app to read your organization's device configuration policies on behalf of the signed-in user. For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks.", @@ -3714,7 +4146,9 @@ "displayName": "Read your organization's conditional access policies", "id": "633e0fce-8c58-4cfb-9495-12bbd5a24f7c", "origin": "Delegated (Microsoft Graph)", - "value": "Policy.Read.ConditionalAccess" + "value": "Policy.Read.ConditionalAccess", + "userConsentDisplayName": "Read your organization's conditional access policies", + "userConsentDescription": "Allows the app to read your organization's conditional access policies on your behalf." }, { "description": "Allows the app to read and write organization-wide Microsoft To Do settings on behalf of the signed-in user.", @@ -3763,14 +4197,18 @@ "displayName": "Read users' relevant people lists", "id": "ba47897c-39ec-4d83-8086-ee8256fa737d", "origin": "Delegated (Microsoft Graph)", - "value": "People.Read" + "value": "People.Read", + "userConsentDisplayName": "Read your relevant people list", + "userConsentDescription": "Allows the app to read a list of people in the order that's most relevant to you. This includes your local contacts, your contacts from social networking, people listed in your organization's directory, and people from recent communications." }, { "description": "Allows the app to read a scored list of relevant people of the signed-in user or other users in the signed-in user's organization. The list can include local contacts, contacts from social networking, your organization's directory, and people from recent communications (such as email and Skype).", "displayName": "Read all users' relevant people lists", "id": "b89f9189-71a5-4e70-b041-9887f0bc7e4a", "origin": "Delegated (Microsoft Graph)", - "value": "People.Read.All" + "value": "People.Read.All", + "userConsentDisplayName": "Read all users’ relevant people lists", + "userConsentDescription": "Allows the app to read a list of people in the order that is most relevant to you. Allows the app to read a list of people in the order that is most relevant to another user in your organization. These can include local contacts, contacts from social networking, people listed in your organization’s directory, and people from recent communications." }, { "description": "Allows the application to read tenant-wide people settings on behalf of the signed-in user.", @@ -3791,14 +4229,18 @@ "displayName": "Read all company places", "id": "cb8f45a0-5c2e-4ea1-b803-84b870a7d7ec", "origin": "Delegated (Microsoft Graph)", - "value": "Place.Read.All" + "value": "Place.Read.All", + "userConsentDisplayName": "Read all company places", + "userConsentDescription": "Allows the app to read your company's places (conference rooms and room lists) for calendar events and other applications, on your behalf." }, { "description": "Allows the app to manage organization places (conference rooms and room lists) for calendar events and other applications, on behalf of the signed-in user.", "displayName": "Read and write organization places", "id": "4c06a06a-098a-4063-868e-5dfee3827264", "origin": "Delegated (Microsoft Graph)", - "value": "Place.ReadWrite.All" + "value": "Place.ReadWrite.All", + "userConsentDisplayName": "Read and write organization places", + "userConsentDescription": "Allows the app to manage organization places (conference rooms and room lists) for calendar events and other applications, on your behalf." }, { "description": "Allows the app to read all workplace devices, on behalf of the signed-in user.", @@ -3819,7 +4261,9 @@ "displayName": "Read your organization's policies", "id": "572fea84-0151-49b2-9301-11cb16974376", "origin": "Delegated (Microsoft Graph)", - "value": "Policy.Read.All" + "value": "Policy.Read.All", + "userConsentDisplayName": "Read your organization's policies", + "userConsentDescription": "Allows the app to read your organization's policies on your behalf." }, { "description": "Allows the app to read the authentication method policies, on behalf of the signed-in user. ", @@ -3847,7 +4291,9 @@ "displayName": "Manage consent and permission grant policies", "id": "2672f8bb-fd5e-42e0-85e1-ec764dd2614e", "origin": "Delegated (Microsoft Graph)", - "value": "Policy.ReadWrite.PermissionGrant" + "value": "Policy.ReadWrite.PermissionGrant", + "userConsentDisplayName": "Manage consent and permission grant policies", + "userConsentDescription": "Allows the app to manage policies related to consent and permission grants for applications, on behalf of the signed-in user." }, { "description": "Allows the application to read and update the organization's recovery policy on behalf of the signed-in user.", @@ -3868,70 +4314,90 @@ "displayName": "Read and write basic information of user's print jobs", "id": "6f2d22f2-1cb6-412c-a17c-3336817eaa82", "origin": "Delegated (Microsoft Graph)", - "value": "PrintJob.ReadWriteBasic" + "value": "PrintJob.ReadWriteBasic", + "userConsentDisplayName": "Read and write basic information of your print jobs", + "userConsentDescription": "Allows the application to read and update the metadata of print jobs that you created. Does not allow access to print job document content." }, { "description": "Allows the application to read and update the metadata of print jobs on behalf of the signed-in user. Does not allow access to print job document content.", "displayName": "Read and write basic information of print jobs", "id": "3a0db2f6-0d2a-4c19-971b-49109b19ad3d", "origin": "Delegated (Microsoft Graph)", - "value": "PrintJob.ReadWriteBasic.All" + "value": "PrintJob.ReadWriteBasic.All", + "userConsentDisplayName": "Read and write basic information of print jobs", + "userConsentDescription": "Allows the application to read and update the metadata of print jobs on your behalf. Does not allow access to print job document content." }, { "description": "Allows the application to read tenant-wide print settings on behalf of the signed-in user.", "displayName": "Read tenant-wide print settings", "id": "490f32fd-d90f-4dd7-a601-ff6cdc1a3f6c", "origin": "Delegated (Microsoft Graph)", - "value": "PrintSettings.Read.All" + "value": "PrintSettings.Read.All", + "userConsentDisplayName": "Read tenant-wide print settings", + "userConsentDescription": "Allows the application to read tenant-wide print settings on your behalf." }, { "description": "Allows the application to read and write tenant-wide print settings on behalf of the signed-in user.", "displayName": "Read and write tenant-wide print settings", "id": "9ccc526a-c51c-4e5c-a1fd-74726ef50b8f", "origin": "Delegated (Microsoft Graph)", - "value": "PrintSettings.ReadWrite.All" + "value": "PrintSettings.ReadWrite.All", + "userConsentDisplayName": "Read and write tenant-wide print settings", + "userConsentDescription": "Allows the application to read and write tenant-wide print settings on your behalf." }, { "description": "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD built-in and custom administrative roles, on behalf of the signed-in user.", "displayName": "Read privileged access to Azure AD", "id": "b3a539c9-59cb-4ad5-825a-041ddbdc2bdb", "origin": "Delegated (Microsoft Graph)", - "value": "PrivilegedAccess.Read.AzureAD" + "value": "PrivilegedAccess.Read.AzureAD", + "userConsentDisplayName": "Read privileged access to Azure AD", + "userConsentDescription": "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD built-in and custom administrative roles, on your behalf." }, { "description": "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups, on behalf of the signed-in user.", "displayName": "Read privileged access to Azure AD groups", "id": "d329c81c-20ad-4772-abf9-3f6fdb7e5988", "origin": "Delegated (Microsoft Graph)", - "value": "PrivilegedAccess.Read.AzureADGroup" + "value": "PrivilegedAccess.Read.AzureADGroup", + "userConsentDisplayName": "Read privileged access to Azure AD groups", + "userConsentDescription": "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups, on your behalf." }, { "description": "Allows the app to read time-based assignment and just-in-time elevation of Azure resources (like your subscriptions, resource groups, storage, compute) on behalf of the signed-in user.", "displayName": "Read privileged access to Azure resources", "id": "1d89d70c-dcac-4248-b214-903c457af83a", "origin": "Delegated (Microsoft Graph)", - "value": "PrivilegedAccess.Read.AzureResources" + "value": "PrivilegedAccess.Read.AzureResources", + "userConsentDisplayName": "Read privileged access to your Azure resources", + "userConsentDescription": "Allows the app to read time-based assignment and just-in-time elevation of Azure resources (like your subscriptions, resource groups, storage, compute) on your behalf." }, { "description": "Allows the app to request and manage just in time elevation (including scheduled elevation) of users to Azure AD built-in administrative roles, on behalf of signed-in users.", "displayName": "Read and write privileged access to Azure AD", "id": "3c3c74f5-cdaa-4a97-b7e0-4e788bfcfb37", "origin": "Delegated (Microsoft Graph)", - "value": "PrivilegedAccess.ReadWrite.AzureAD" + "value": "PrivilegedAccess.ReadWrite.AzureAD", + "userConsentDisplayName": "Read and write privileged access to Azure AD", + "userConsentDescription": "Allows the app to request and manage just in time elevation (including scheduled elevation) of users to Azure AD built-in administrative roles, on your behalf." }, { "description": "Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups, on behalf of the signed-in user.", "displayName": "Read and write privileged access to Azure AD groups", "id": "32531c59-1f32-461f-b8df-6f8a3b89f73b", "origin": "Delegated (Microsoft Graph)", - "value": "PrivilegedAccess.ReadWrite.AzureADGroup" + "value": "PrivilegedAccess.ReadWrite.AzureADGroup", + "userConsentDisplayName": "Read and write privileged access to Azure AD groups", + "userConsentDescription": "Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups, on your behalf." }, { "description": "Allows the app to request and manage time-based assignment and just-in-time elevation of user privileges to manage Azure resources (like subscriptions, resource groups, storage, compute) on behalf of the signed-in users.", "displayName": "Read and write privileged access to Azure resources", "id": "a84a9652-ffd3-496e-a991-22ba5529156a", "origin": "Delegated (Microsoft Graph)", - "value": "PrivilegedAccess.ReadWrite.AzureResources" + "value": "PrivilegedAccess.ReadWrite.AzureResources", + "userConsentDisplayName": "Read and write privileged access to Azure resources", + "userConsentDescription": "Allows the app to request and manage time-based assignment and just-in-time elevation of user privileges to manage  your Azure resources (like your subscriptions, resource groups, storage, compute) on your behalf." }, { "description": "Allows the app to read Privileged Access (PIM) custom extensions for your organization, without a signed-in user.", @@ -3987,42 +4453,54 @@ "displayName": "Read and write print jobs", "id": "036b9544-e8c5-46ef-900a-0646cc42b271", "origin": "Delegated (Microsoft Graph)", - "value": "PrintJob.ReadWrite.All" + "value": "PrintJob.ReadWrite.All", + "userConsentDisplayName": "Read and update print jobs", + "userConsentDescription": "Allows the application to read and update the metadata and document content of print jobs on your behalf. " }, { "description": "Allows the application to read and update the metadata and document content of print jobs that the signed-in user created.", "displayName": "Read and write user's print jobs", "id": "b81dd597-8abb-4b3f-a07a-820b0316ed04", "origin": "Delegated (Microsoft Graph)", - "value": "PrintJob.ReadWrite" + "value": "PrintJob.ReadWrite", + "userConsentDisplayName": "Read and update your print jobs", + "userConsentDescription": "Allows the application to read and update the metadata and document content of print jobs that you created." }, { "description": "Allows the application to read the metadata of print jobs on behalf of the signed-in user. Does not allow access to print job document content.", "displayName": "Read basic information of print jobs", "id": "04ce8d60-72ce-4867-85cf-6d82f36922f3", "origin": "Delegated (Microsoft Graph)", - "value": "PrintJob.ReadBasic.All" + "value": "PrintJob.ReadBasic.All", + "userConsentDisplayName": "Read basic information of print jobs", + "userConsentDescription": "Allows the application to read the metadata of print jobs on your behalf. Does not allow access to print job document content." }, { "description": "Allows the application to read the metadata of print jobs that the signed-in user created. Does not allow access to print job document content.", "displayName": "Read basic information of user's print jobs", "id": "6a71a747-280f-4670-9ca0-a9cbf882b274", "origin": "Delegated (Microsoft Graph)", - "value": "PrintJob.ReadBasic" + "value": "PrintJob.ReadBasic", + "userConsentDisplayName": "Read basic information of your print jobs", + "userConsentDescription": "Allows the application to read the metadata of print jobs that you created. Does not allow access to print job document content." }, { "description": "Allows the app to read and write your organization's trust framework policies on behalf of the signed-in user.", "displayName": "Read and write your organization's trust framework policies", "id": "cefba324-1a70-4a6e-9c1d-fd670b7ae392", "origin": "Delegated (Microsoft Graph)", - "value": "Policy.ReadWrite.TrustFramework" + "value": "Policy.ReadWrite.TrustFramework", + "userConsentDisplayName": "Read and write trust framework policies", + "userConsentDescription": "Allows the app to read and write your organization's trust framework policies on your behalf." }, { "description": "Allows the app to have the same access to mailboxes as the signed-in user via POP protocol.", "displayName": "Read and write access to mailboxes via POP.", "id": "d7b7f2d9-0f45-4ea1-9d42-e50810c06991", "origin": "Delegated (Microsoft Graph)", - "value": "POP.AccessAsUser.All" + "value": "POP.AccessAsUser.All", + "userConsentDisplayName": "Read and write access to your mail.", + "userConsentDescription": "Allows the app to read, update, create and delete email in your mailbox. Does not include permission to send mail." }, { "description": "Allows the app to read preauthorization grants for service principals on behalf of the signed-in user.", @@ -4036,35 +4514,45 @@ "displayName": "Read user's presence information", "id": "76bc735e-aecd-4a1d-8b4c-2b915deabb79", "origin": "Delegated (Microsoft Graph)", - "value": "Presence.Read" + "value": "Presence.Read", + "userConsentDisplayName": "Read your presence information", + "userConsentDescription": "Allows the app to read your presence information on your behalf. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location." }, { "description": "Allows the app to read presence information of all users in the directory on behalf of the signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location.", "displayName": "Read presence information of all users in your organization", "id": "9c7a330d-35b3-4aa1-963d-cb2b9f927841", "origin": "Delegated (Microsoft Graph)", - "value": "Presence.Read.All" + "value": "Presence.Read.All", + "userConsentDisplayName": "Read presence information of all users in your organization", + "userConsentDescription": "Allows the app to read presence information of all users in the directory on your behalf. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location." }, { "description": "Allows the app to read the presence information and write activity and availability on behalf of the signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location.", "displayName": "Read and write a user's presence information", "id": "8d3c54a7-cf58-4773-bf81-c0cd6ad522bb", "origin": "Delegated (Microsoft Graph)", - "value": "Presence.ReadWrite" + "value": "Presence.ReadWrite", + "userConsentDisplayName": "Read and write your presence information", + "userConsentDescription": "Allows the app to read the presence information and write activity and availability on your behalf. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location." }, { "description": "Allows the application to read print connectors on behalf of the signed-in user.", "displayName": "Read print connectors", "id": "d69c2d6d-4f72-4f99-a6b9-663e32f8cf68", "origin": "Delegated (Microsoft Graph)", - "value": "PrintConnector.Read.All" + "value": "PrintConnector.Read.All", + "userConsentDisplayName": "Read print connectors", + "userConsentDescription": "Allows the application to read print connectors on your behalf." }, { - "description": "Allows the application to read and write print connectors on behalf of the signed-in user.", + "description": "Allows the application to read and write print connectors on behalf of the signed-in user. ", "displayName": "Read and write print connectors", "id": "79ef9967-7d59-4213-9c64-4b10687637d8", "origin": "Delegated (Microsoft Graph)", - "value": "PrintConnector.ReadWrite.All" + "value": "PrintConnector.ReadWrite.All", + "userConsentDisplayName": "Read and write print connectors", + "userConsentDescription": "Allows the application to read and write print connectors on your behalf." }, { "description": "Allows the app to read organization-wide Microsoft To Do settings on behalf of the signed-in user.", @@ -4078,70 +4566,90 @@ "displayName": "Register printers ", "id": "90c30bed-6fd1-4279-bf39-714069619721", "origin": "Delegated (Microsoft Graph)", - "value": "Printer.Create" + "value": "Printer.Create", + "userConsentDisplayName": "Register printers  ", + "userConsentDescription": "Allows the application to create (register) printers on your behalf. " }, { "description": "Allows the application to read printers on behalf of the signed-in user. ", "displayName": "Read printers", "id": "3a736c8a-018e-460a-b60c-863b2683e8bf", "origin": "Delegated (Microsoft Graph)", - "value": "Printer.Read.All" + "value": "Printer.Read.All", + "userConsentDisplayName": "Read printers", + "userConsentDescription": "Allows the application to read printers on your behalf. " }, { "description": "Allows the application to read and update printers on behalf of the signed-in user. Does not allow creating (registering) or deleting (unregistering) printers.", "displayName": "Read and update printers", "id": "89f66824-725f-4b8f-928e-e1c5258dc565", "origin": "Delegated (Microsoft Graph)", - "value": "Printer.ReadWrite.All" + "value": "Printer.ReadWrite.All", + "userConsentDisplayName": "Read and update printers", + "userConsentDescription": "Allows the application to read and update printers on your behalf. Does not allow creating (registering) or deleting (unregistering) printers." }, { "description": "Allows the application to read printer shares on behalf of the signed-in user. ", "displayName": "Read printer shares", "id": "ed11134d-2f3f-440d-a2e1-411efada2502", "origin": "Delegated (Microsoft Graph)", - "value": "PrinterShare.Read.All" + "value": "PrinterShare.Read.All", + "userConsentDisplayName": "Read printer shares", + "userConsentDescription": "Allows the application to read printer shares on your behalf. " }, { "description": "Allows the application to read basic information about printer shares on behalf of the signed-in user. Does not allow reading access control information.", "displayName": "Read basic information about printer shares", "id": "5fa075e9-b951-4165-947b-c63396ff0a37", "origin": "Delegated (Microsoft Graph)", - "value": "PrinterShare.ReadBasic.All" + "value": "PrinterShare.ReadBasic.All", + "userConsentDisplayName": "Read basic information about printer shares", + "userConsentDescription": "Allows the application to read basic information about printer shares on your behalf." }, { "description": "Allows the application to read and update printer shares on behalf of the signed-in user. ", "displayName": "Read and write printer shares", "id": "06ceea37-85e2-40d7-bec3-91337a46038f", "origin": "Delegated (Microsoft Graph)", - "value": "PrinterShare.ReadWrite.All" + "value": "PrinterShare.ReadWrite.All", + "userConsentDisplayName": "Read and update printer shares", + "userConsentDescription": "Allows the application to read and update printer shares on your behalf. " }, { "description": "Allows the application to create print jobs on behalf of the signed-in user and upload document content to print jobs that the signed-in user created.", "displayName": "Create print jobs", "id": "21f0d9c0-9f13-48b3-94e0-b6b231c7d320", "origin": "Delegated (Microsoft Graph)", - "value": "PrintJob.Create" + "value": "PrintJob.Create", + "userConsentDisplayName": "Create your print jobs", + "userConsentDescription": "Allows the application to create print jobs on your behalf and upload document content to print jobs that you created." }, { "description": "Allows the application to read the metadata and document content of print jobs that the signed-in user created.", "displayName": "Read user's print jobs", "id": "248f5528-65c0-4c88-8326-876c7236df5e", "origin": "Delegated (Microsoft Graph)", - "value": "PrintJob.Read" + "value": "PrintJob.Read", + "userConsentDisplayName": "Read your print jobs", + "userConsentDescription": "Allows the application to read the metadata and document content of print jobs that you created." }, { "description": "Allows the application to read the metadata and document content of print jobs on behalf of the signed-in user. ", "displayName": "Read print jobs", "id": "afdd6933-a0d8-40f7-bd1a-b5d778e8624b", "origin": "Delegated (Microsoft Graph)", - "value": "PrintJob.Read.All" + "value": "PrintJob.Read.All", + "userConsentDisplayName": "Read print jobs", + "userConsentDescription": "Allows the application to read the metadata and document content of print jobs on your behalf. " }, { "description": "Allows the application to create (register), read, update, and delete (unregister) printers on behalf of the signed-in user. ", "displayName": "Register, read, update, and unregister printers", "id": "93dae4bd-43a1-4a23-9a1a-92957e1d9121", "origin": "Delegated (Microsoft Graph)", - "value": "Printer.FullControl.All" + "value": "Printer.FullControl.All", + "userConsentDisplayName": "Register, read, update, and unregister printers", + "userConsentDescription": "Allows the application to create (register), read, update, and delete (unregister) printers on your behalf.  " }, { "description": "Allows the app to read and write organization-wide Microsoft 365 apps installation settings on behalf of the signed-in user.", @@ -4165,32 +4673,40 @@ "value": "OrgSettings-Forms.ReadWrite.All" }, { - "description": "Allows the app to create, read, update, and delete email in user mailboxes. Does not include permission to send mail.", + "description": "Allows the app to create, read, update, and delete email in user mailboxes. Does not include permission to send mail. ", "displayName": "Read and write access to user mail ", "id": "024d486e-b451-40bb-833d-3e66d98c5c73", "origin": "Delegated (Microsoft Graph)", - "value": "Mail.ReadWrite" + "value": "Mail.ReadWrite", + "userConsentDisplayName": "Read and write access to your mail ", + "userConsentDescription": "Allows the app to read, update, create and delete email in your mailbox. Does not include permission to send mail. " }, { "description": "Allows the app to create, read, update, and delete mail a user has permission to access, including their own and shared mail. Does not include permission to send mail.", "displayName": "Read and write user and shared mail", "id": "5df07973-7d5d-46ed-9847-1271055cbd51", "origin": "Delegated (Microsoft Graph)", - "value": "Mail.ReadWrite.Shared" + "value": "Mail.ReadWrite.Shared", + "userConsentDisplayName": "Read and write mail you can access", + "userConsentDescription": "Allows the app to read, update, create, and delete mail you have permission to access, including your own and shared mail. Does not allow the app to send mail on your behalf." }, { - "description": "Allows the app to send mail as users in the organization.", + "description": "Allows the app to send mail as users in the organization. ", "displayName": "Send mail as a user ", "id": "e383f46e-2787-4529-855e-0e479a3ffac0", "origin": "Delegated (Microsoft Graph)", - "value": "Mail.Send" + "value": "Mail.Send", + "userConsentDisplayName": "Send mail as you ", + "userConsentDescription": "Allows the app to send mail as you. " }, { "description": "Allows the app to send mail as the signed-in user, including sending on-behalf of others.", "displayName": "Send mail on behalf of others", "id": "a367ab51-6b49-43bf-a716-a1fb06d2a174", "origin": "Delegated (Microsoft Graph)", - "value": "Mail.Send.Shared" + "value": "Mail.Send.Shared", + "userConsentDisplayName": "Send mail on behalf of others or yourself", + "userConsentDescription": "Allows the app to send mail as you or on-behalf of someone else." }, { "description": "Allows the app to create, read, update, and delete email, including contents of non-draft emails in user mailboxes, on behalf of the signed-in user. Does not include permission to send mail.", @@ -4267,14 +4783,18 @@ "displayName": "Read user mailbox settings", "id": "87f447af-9fa4-4c32-9dfa-4a57a73d18ce", "origin": "Delegated (Microsoft Graph)", - "value": "MailboxSettings.Read" + "value": "MailboxSettings.Read", + "userConsentDisplayName": "Read your mailbox settings", + "userConsentDescription": "Allows the app to read your mailbox settings." }, { "description": "Allows the app to create, read, update, and delete user's mailbox settings. Does not include permission to send mail.", "displayName": "Read and write user mailbox settings", "id": "818c620a-27a9-40bd-a6a5-d96f7d610b4b", "origin": "Delegated (Microsoft Graph)", - "value": "MailboxSettings.ReadWrite" + "value": "MailboxSettings.ReadWrite", + "userConsentDisplayName": "Read and write to your mailbox settings", + "userConsentDescription": "Allows the app to read, update, create, and delete your mailbox settings." }, { "description": "Allows the app to read mail tips on behalf of the signed-in user for mailboxes they have access to. Mail tips include automatic replies, mailbox status, custom tips, and delivery information.", @@ -4295,21 +4815,27 @@ "displayName": "Read user basic mail", "id": "a4b8392a-d8d1-4954-a029-8e668a39a170", "origin": "Delegated (Microsoft Graph)", - "value": "Mail.ReadBasic" + "value": "Mail.ReadBasic", + "userConsentDisplayName": "Read user basic mail", + "userConsentDescription": "Allows the app to read email in the signed-in user's mailbox except body, previewBody, attachments and any extended properties." }, { "description": "Allows the app to read mail a user can access, including their own and shared mail.", "displayName": "Read user and shared mail", "id": "7b9103a5-4610-446b-9670-80643382c1fa", "origin": "Delegated (Microsoft Graph)", - "value": "Mail.Read.Shared" + "value": "Mail.Read.Shared", + "userConsentDisplayName": "Read mail you can access", + "userConsentDescription": "Allows the app to read mail you can access, including shared mail." }, { "description": "Allows the app to read the signed-in user's mailbox.", "displayName": "Read user mail ", "id": "570282fd-fa5c-430d-a7fd-fc8dc98a9dca", "origin": "Delegated (Microsoft Graph)", - "value": "Mail.Read" + "value": "Mail.Read", + "userConsentDisplayName": "Read your mail ", + "userConsentDescription": "Allows the app to read email in your mailbox. " }, { "description": "Allows the app to read, create, update and delete identity lifecycle policies for agent identities that the signed-in user has access to in the organization.", @@ -4337,14 +4863,18 @@ "displayName": "Read all lifecycle workflows resources", "id": "9bcb9916-765a-42af-bf77-02282e26b01a", "origin": "Delegated (Microsoft Graph)", - "value": "LifecycleWorkflows.Read.All" + "value": "LifecycleWorkflows.Read.All", + "userConsentDisplayName": "Read all lifecycle workflows resources", + "userConsentDescription": "Allows the app to list and read all workflows, tasks and related lifecycle workflows resources on your behalf." }, { "description": "Allows the app to create, update, list, read and delete all workflows, tasks and related lifecycle workflows resources on behalf of the signed-in user.", "displayName": "Read and write all lifecycle workflows resources", "id": "84b9d731-7db8-4454-8c90-fd9e95350179", "origin": "Delegated (Microsoft Graph)", - "value": "LifecycleWorkflows.ReadWrite.All" + "value": "LifecycleWorkflows.ReadWrite.All", + "userConsentDisplayName": "Read and write all lifecycle workflows resources", + "userConsentDescription": "Allows the app to create, update, list, read and delete all workflows, tasks and related lifecycle workflows resources on your behalf." }, { "description": "Allows the app to read all Lifecycle workflows custom task extensions on behalf of a signed-in user.", @@ -4372,7 +4902,9 @@ "displayName": "Read all managed tenant information", "id": "dc34164e-6c4a-41a0-be89-3ae2fbad7cd3", "origin": "Delegated (Microsoft Graph)", - "value": "ManagedTenants.Read.All" + "value": "ManagedTenants.Read.All", + "userConsentDisplayName": "Read all managed tenant information", + "userConsentDescription": "Allows the app to read all managed tenant information on your behalf." }, { "description": "Allows the app to run workflows on-demand on behalf of a signed-in user.", @@ -4449,14 +4981,18 @@ "displayName": "Manage all license assignments", "id": "f55016cc-149c-447e-8f21-7cf3ec1d6350", "origin": "Delegated (Microsoft Graph)", - "value": "LicenseAssignment.ReadWrite.All" + "value": "LicenseAssignment.ReadWrite.All", + "userConsentDisplayName": "Manage all license assignments", + "userConsentDescription": "Allows the app to manage all license assignments, on your behalf." }, { "description": "Allows the app to read and write all managed tenant information on behalf of the signed-in user.", "displayName": "Read and write all managed tenant information", "id": "b31fa710-c9b3-4d9e-8f5e-8036eecddab9", "origin": "Delegated (Microsoft Graph)", - "value": "ManagedTenants.ReadWrite.All" + "value": "ManagedTenants.ReadWrite.All", + "userConsentDisplayName": "Read and write all managed tenant information", + "userConsentDescription": "Allows the app to read and write all managed tenant information on your behalf." }, { "description": "Allows the app to read multi-tenant organization details and tenants on behalf of the signed-in user.", @@ -4470,21 +5006,27 @@ "displayName": "Read user's online meetings", "id": "9be106e1-f4e3-4df5-bdff-e4bc531cbe43", "origin": "Delegated (Microsoft Graph)", - "value": "OnlineMeetings.Read" + "value": "OnlineMeetings.Read", + "userConsentDisplayName": "Read your online meetings", + "userConsentDescription": "Allows the app to read online meeting details on your behalf." }, { "description": "Allows the app to read and create online meetings on behalf of the signed-in user.", "displayName": "Read and create user's online meetings", "id": "a65f2972-a4f8-4f5e-afd7-69ccb046d5dc", "origin": "Delegated (Microsoft Graph)", - "value": "OnlineMeetings.ReadWrite" + "value": "OnlineMeetings.ReadWrite", + "userConsentDisplayName": "Read and create your online meetings", + "userConsentDescription": "Allows the app to read and create online meetings on your behalf." }, { "description": "Allows the app to read all transcripts of online meetings, on behalf of the signed-in user.", - "displayName": "Read all transcripts of online meetings.", + "displayName": "Read all transcripts of online meetings. ", "id": "30b87d18-ebb1-45db-97f8-82ccb1f0190c", "origin": "Delegated (Microsoft Graph)", - "value": "OnlineMeetingTranscript.Read.All" + "value": "OnlineMeetingTranscript.Read.All", + "userConsentDisplayName": "Read all transcripts of online meetings.", + "userConsentDescription": "Allows the app to read all transcripts of online meetings, on your behalf." }, { "description": "Allows the app to read all on-premises directory synchronization information for the organization, on behalf of the signed-in user.", @@ -4498,35 +5040,45 @@ "displayName": "Read and write all on-premises directory synchronization information", "id": "c2d95988-7604-4ba1-aaed-38a5f82a51c7", "origin": "Delegated (Microsoft Graph)", - "value": "OnPremDirectorySynchronization.ReadWrite.All" + "value": "OnPremDirectorySynchronization.ReadWrite.All", + "userConsentDisplayName": "Access Microsoft Teams and Skype for Business data based on the user's role membership", + "userConsentDescription": "Access Microsoft Teams and Skype for Business data as the signed in user" }, { "description": "Allows the app to manage hybrid identity service configuration by creating, viewing, updating and deleting on-premises published resources, on-premises agents and agent groups, on behalf of the signed-in user.", "displayName": "Manage on-premises published resources", "id": "8c4d5184-71c2-4bf8-bb9d-bc3378c9ad42", "origin": "Delegated (Microsoft Graph)", - "value": "OnPremisesPublishingProfiles.ReadWrite.All" + "value": "OnPremisesPublishingProfiles.ReadWrite.All", + "userConsentDisplayName": "Manage on-premises published resources", + "userConsentDescription": "Allows the app to manage hybrid identity service configuration by creating, viewing, updating and deleting on-premises published resources, on-premises agents and agent groups, on your behalf." }, { "description": "Allows users to sign in to the app with their work or school accounts and allows the app to see basic user profile information.", "displayName": "Sign users in", "id": "37f7f235-527c-4136-accd-4a02d197296e", "origin": "Delegated (Microsoft Graph)", - "value": "openid" + "value": "openid", + "userConsentDisplayName": "Sign in as you", + "userConsentDescription": "Allows you to sign in to the app with your work or school account and allows the app to read your basic profile information." }, { "description": "Allows the app to read the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed skus and tenant branding information.", "displayName": "Read organization information", "id": "4908d5b9-3fb2-4b1e-9336-1888b7937185", "origin": "Delegated (Microsoft Graph)", - "value": "Organization.Read.All" + "value": "Organization.Read.All", + "userConsentDisplayName": "Read organization information", + "userConsentDescription": "Allows the app to read the organization and related resources, on your behalf. Related resources include things like subscribed skus and tenant branding information." }, { "description": "Allows the app to read and write the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed skus and tenant branding information.", "displayName": "Read and write organization information", "id": "46ca0847-7e6b-426e-9775-ea810a948356", "origin": "Delegated (Microsoft Graph)", - "value": "Organization.ReadWrite.All" + "value": "Organization.ReadWrite.All", + "userConsentDisplayName": "Read and write organization information", + "userConsentDescription": "Allows the app to read and write the organization and related resources, on your behalf. Related resources include things like subscribed skus and tenant branding information." }, { "description": "Allows the app to read the organizational branding information, on behalf of the signed-in user.", @@ -4547,7 +5099,9 @@ "displayName": "Read organizational contacts", "id": "08432d1b-5911-483c-86df-7980af5cdee0", "origin": "Delegated (Microsoft Graph)", - "value": "OrgContact.Read.All" + "value": "OrgContact.Read.All", + "userConsentDisplayName": "Read organizational contacts", + "userConsentDescription": "Allows the app to read all organizational contacts on your behalf.  These contacts are managed by the organization and are different from your personal contacts." }, { "description": "Allows the app to read organization-wide apps and services settings on behalf of the signed-in user.", @@ -4589,14 +5143,18 @@ "displayName": "Read all recordings of online meetings.", "id": "190c2bb6-1fdd-4fec-9aa2-7d571b5e1fe3", "origin": "Delegated (Microsoft Graph)", - "value": "OnlineMeetingRecording.Read.All" + "value": "OnlineMeetingRecording.Read.All", + "userConsentDisplayName": "Read all recordings of online meetings. ", + "userConsentDescription": "Allows the app to read all recordings of online meetings, on your behalf. " }, { "description": "Allows the app to read online meeting artifacts on behalf of the signed-in user.", "displayName": "Read user's online meeting artifacts", "id": "110e5abb-a10c-4b59-8b55-9b4daa4ef743", "origin": "Delegated (Microsoft Graph)", - "value": "OnlineMeetingArtifact.Read.All" + "value": "OnlineMeetingArtifact.Read.All", + "userConsentDisplayName": "Read user's online meeting artifacts", + "userConsentDescription": "Allows the app to read online meeting artifacts on your behalf." }, { "description": "Allows the app to read all AI Insights for online meetings, on behalf of the signed-in user.", @@ -4610,7 +5168,9 @@ "displayName": "Maintain access to data you have given it access to", "id": "7427e0e9-2fba-42fe-b0c0-848c9e6a8182", "origin": "Delegated (Microsoft Graph)", - "value": "offline_access" + "value": "offline_access", + "userConsentDisplayName": "Maintain access to data you have given it access to", + "userConsentDescription": "Allows the app to see and update the data you gave it access to, even when you are not currently using the app. This does not give the app any additional permissions." }, { "description": "Allows the app to read multi-tenant organization basic details and active tenants on behalf of the signed-in user.", @@ -4673,7 +5233,9 @@ "displayName": "Read hidden memberships", "id": "f6a3db3e-f7e8-4ed2-a414-557c8c9830be", "origin": "Delegated (Microsoft Graph)", - "value": "Member.Read.Hidden" + "value": "Member.Read.Hidden", + "userConsentDisplayName": "Read your hidden memberships", + "userConsentDescription": "Allows the app to read the memberships of hidden groups or administrative units on your behalf, for those hidden groups or adminstrative units that you have access to." }, { "description": "Allows the app to read your organization's security and routing network access policies on behalf of the signed-in user.", @@ -4694,49 +5256,63 @@ "displayName": "Create user OneNote notebooks", "id": "9d822255-d64d-4b7a-afdb-833b9a97ed02", "origin": "Delegated (Microsoft Graph)", - "value": "Notes.Create" + "value": "Notes.Create", + "userConsentDisplayName": "Create your OneNote notebooks", + "userConsentDescription": "Allows the app to view the titles of your OneNote notebooks and sections and to create new pages, notebooks, and sections on your behalf." }, { "description": "Allows the app to read OneNote notebooks on behalf of the signed-in user.", "displayName": "Read user OneNote notebooks", "id": "371361e4-b9e2-4a3f-8315-2a301a3b0a3d", "origin": "Delegated (Microsoft Graph)", - "value": "Notes.Read" + "value": "Notes.Read", + "userConsentDisplayName": "Read your OneNote notebooks", + "userConsentDescription": "Allows the app to read OneNote notebooks on your behalf." }, { "description": "Allows the app to read OneNote notebooks that the signed-in user has access to in the organization.", "displayName": "Read all OneNote notebooks that user can access", "id": "dfabfca6-ee36-4db2-8208-7a28381419b3", "origin": "Delegated (Microsoft Graph)", - "value": "Notes.Read.All" + "value": "Notes.Read.All", + "userConsentDisplayName": "Read all OneNote notebooks that you can access", + "userConsentDescription": "Allows the app to read all the OneNote notebooks that you have access to." }, { "description": "Allows the app to read, share, and modify OneNote notebooks on behalf of the signed-in user.", "displayName": "Read and write user OneNote notebooks", "id": "615e26af-c38a-4150-ae3e-c3b0d4cb1d6a", "origin": "Delegated (Microsoft Graph)", - "value": "Notes.ReadWrite" + "value": "Notes.ReadWrite", + "userConsentDisplayName": "Read and write your OneNote notebooks", + "userConsentDescription": "Allows the app to read, share, and modify OneNote notebooks on your behalf." }, { "description": "Allows the app to read, share, and modify OneNote notebooks that the signed-in user has access to in the organization.", "displayName": "Read and write all OneNote notebooks that user can access", "id": "64ac0503-b4fa-45d9-b544-71a463f05da0", "origin": "Delegated (Microsoft Graph)", - "value": "Notes.ReadWrite.All" + "value": "Notes.ReadWrite.All", + "userConsentDisplayName": "Read and write all OneNote notebooks that you can access", + "userConsentDescription": "Allows the app to read, share, and modify all the OneNote notebooks that you have access to." }, { "description": "This is deprecated! Do not use! This permission no longer has any effect. You can safely consent to it. No additional privileges will be granted to the app.", "displayName": "Limited notebook access (deprecated)", "id": "ed68249d-017c-4df5-9113-e684c7f8760b", "origin": "Delegated (Microsoft Graph)", - "value": "Notes.ReadWrite.CreatedByApp" + "value": "Notes.ReadWrite.CreatedByApp", + "userConsentDisplayName": "Limited access to your OneNote notebooks for this app (preview)", + "userConsentDescription": "This permission no longer has any effect. You can safely consent to it. No additional privileges will be granted to the app." }, { "description": "Allows the app to deliver its notifications on behalf of signed-in users. Also allows the app to read, update, and delete the user's notification items for this app.", "displayName": "Deliver and manage user notifications for this app", "id": "89497502-6e42-46a2-8cb2-427fd3df970a", "origin": "Delegated (Microsoft Graph)", - "value": "Notifications.ReadWrite.CreatedByApp" + "value": "Notifications.ReadWrite.CreatedByApp", + "userConsentDisplayName": "Deliver and manage your notifications for this app", + "userConsentDescription": "Allows the app to deliver its notifications, on your behalf. Also allows the app to read, update, and delete your notification items for this app." }, { "description": "Allows the app to read and write your organization's security and routing network access policies on behalf of the signed-in user.", @@ -4750,7 +5326,9 @@ "displayName": "Read all shared cross-tenant user profiles and export or delete their data", "id": "64dfa325-cbf8-48e3-938d-51224a0cac01", "origin": "Delegated (Microsoft Graph)", - "value": "CrossTenantUserProfileSharing.ReadWrite.All" + "value": "CrossTenantUserProfileSharing.ReadWrite.All", + "userConsentDisplayName": "Read any shared cross-tenant user profiles and export or delete data", + "userConsentDescription": "Allows the application to list and query any shared user profile information associated with the current tenant on your behalf.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant on your behalf." }, { "description": "Allows the Application to read and write the user's data pertaining to itself in the Intune Mobile Application Management service", @@ -6350,10 +6928,12 @@ }, { "description": "Allows the app to read Threat and Vulnerability Management vulnerability information on behalf of the signed-in user", - "displayName": "Read Threat and Vulnerability Management vulnerability information", + "displayName": "Allows the app to read any Threat and Vulnerability Management vulnerability information", "id": "63a677ce-818c-4409-9d12-5c6d2e2a6bfe", "origin": "Delegated (WindowsDefenderATP)", - "value": "Vulnerability.Read" + "value": "Vulnerability.Read", + "userConsentDisplayName": "Allows the app to read any Threat and Vulnerability Management vulnerability information", + "userConsentDescription": "Allows the app to read any Threat and Vulnerability Management vulnerability information" }, { "description": "Allows the app to impersonate the signed-in user to access the Partner Center API.", @@ -6374,7 +6954,9 @@ "displayName": "Manage restricted resources in the directory", "id": "cba5390f-ed6a-4b7f-b657-0efc2210ed20", "origin": "Delegated", - "value": "Directory.Write.Restricted" + "value": "Directory.Write.Restricted", + "userConsentDisplayName": "Manage restricted resources in the directory", + "userConsentDescription": "Allows the app to manage restricted resources based on the other permissions granted to the app, on your behalf." }, { "description": "Allows the app to create machine records and to read or update any machine record that the signed-in user can create, read or update.", @@ -6468,11 +7050,13 @@ "value": "Directory.ReadWrite.All" }, { - "description": "Allows the app to read any Threat and Vulnerability Management vulnerability information", + "description": "Allows the app to read Threat and Vulnerability Management vulnerability information on behalf of the signed-in user", "displayName": "Read Threat and Vulnerability Management vulnerability information", "id": "41269fc5-d04d-4bfd-bce7-43a51cea049a", "origin": "Application (WindowsDefenderATP)", - "value": "Vulnerability.Read.All" + "value": "Vulnerability.Read.All", + "userConsentDisplayName": "Read Threat and Vulnerability Management vulnerability information", + "userConsentDescription": "Allows the app to read Threat and Vulnerability Management vulnerability information on behalf of the signed-in user" }, { "description": "Allows the app to read any alert that the signed in user can access", @@ -7200,7 +7784,9 @@ "displayName": "Read and write user and shared calendars ", "id": "bbd1ca91-75e0-4814-ad94-9c5dbbae3415", "origin": "Delegated (Office 365 Exchange Online)", - "value": "Calendars.ReadWrite.All" + "value": "Calendars.ReadWrite.All", + "userConsentDisplayName": "Read and write to your and shared calendars", + "userConsentDescription": "Allows the app to read, update, create and delete events in all calendars in your organization you have permissions to access. This includes delegate and shared calendars" }, { "description": "Allows the app to create, read, update and delete events in all calendars in the organization user has permissions to access. This includes delegate and shared calendars.", @@ -7309,7 +7895,7 @@ }, { "description": "Allows the app to manage the organization's Exchange environment without any user interaction. This includes mailboxes, groups, and other configuration objects. To enable management actions, an admin must assign the appropriate roles directly to the app.", - "displayName": "Manage Exchange As Application", + "displayName": "Manage Exchange As Application ", "id": "dc50a0fb-09a3-484d-be87-e023b12c6440", "origin": "Application (Office 365 Exchange Online)", "value": "Exchange.ManageAsApp" @@ -7571,7 +8157,9 @@ "displayName": "Manage Exchange configuration", "id": "ab4f2b77-0b06-4fc1-a9de-02113fc2ab7c", "origin": "Delegated (Office 365 Exchange Online)", - "value": "Exchange.Manage" + "value": "Exchange.Manage", + "userConsentDisplayName": "Read Threat and Vulnerability Management vulnerability information", + "userConsentDescription": "Allows the app to read Threat and Vulnerability Management vulnerability information on behalf of the signed-in user" }, { "description": "Allows the app to manage a limited set of Exchange Online configuration objects via the adminapi/v2.0 endpoint. This permission is intended for specific scenarios and requires appropriate Exchange RBAC role assignments.", @@ -7683,7 +8271,9 @@ "displayName": "Read and write user mailbox settings", "id": "2e83d72d-8895-4b66-9eea-abb43449ab8b", "origin": "Delegated (Office 365 Exchange Online)", - "value": "MailboxSettings.ReadWrite" + "value": "MailboxSettings.ReadWrite", + "userConsentDisplayName": "Read and write to your mailbox settings", + "userConsentDescription": "Allows the app to read, update, create, and delete your mailbox settings." }, { "description": "Allows the app to read user notes", @@ -8439,7 +9029,9 @@ "displayName": "Have full control of all site collections", "id": "56680e0d-d2a3-4ae1-80d8-3c4f2100e3d0", "origin": "Delegated (Office 365 SharePoint Online)", - "value": "AllSites.FullControl" + "value": "AllSites.FullControl", + "userConsentDisplayName": "Allows the app to have full control of all site collections on your behalf.", + "userConsentDescription": "Have full control of all site collections" }, { "description": "Read, write and manage Cross-Tenant migration settings and tasks, without a signed-in user", @@ -8548,14 +9140,14 @@ }, { "description": "Allows the app to read user profiles without a signed in user.", - "displayName": "Read user profiles", + "displayName": "Read all users' full profiles", "id": "df021288-bdef-4463-88db-98f22de89214", "origin": "Application (Office 365 SharePoint Online)", "value": "User.Read.All" }, { "description": "Allows the app to read and update user profiles and to read basic site info without a signed in user.", - "displayName": "Read and write user profiles", + "displayName": "Read and write all users' full profiles", "id": "741f803b-c850-494e-b5df-cde7c675a1ca", "origin": "Application (Office 365 SharePoint Online)", "value": "User.ReadWrite.All" @@ -9206,10 +9798,12 @@ }, { "description": "Allows the application to read activity data for your organization.", - "displayName": "Read activity data for your organization", + "displayName": "Allows the application to read activity data for your organization.", "id": "594c1fb6-4f81-4475-ae41-0c394909246c", "origin": "Delegated (Office 365 Management APIs)", - "value": "ActivityFeed.Read" + "value": "ActivityFeed.Read", + "userConsentDisplayName": "Allows the application to read activity data for your organization.", + "userConsentDescription": "Read activity data for your organization" }, { "description": "Allows the application to read DLP policy events, including detected sensitive data, for your organization.", @@ -9377,21 +9971,27 @@ "displayName": "Read shared cross-tenant user profile and export or delete data", "id": "eed0129d-dc60-4f30-8641-daf337a39ffd", "origin": "Delegated (Microsoft Graph)", - "value": "CrossTenantUserProfileSharing.ReadWrite" + "value": "CrossTenantUserProfileSharing.ReadWrite", + "userConsentDisplayName": "Read shared cross-tenant user profile and export or delete data", + "userConsentDescription": "Allows the application to list and query shared user profile information associated with the current tenant on your behalf.  It also permits the application to export and remove your external user data (e.g. customer content or system-generated logs), associated with the current tenant on your behalf." }, { "description": "Allows the application to list and query any shared user profile information associated with the current tenant on behalf of the signed-in user. It also permits the application to export external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant on behalf of the signed-in user.", "displayName": "Read all shared cross-tenant user profiles and export their data", "id": "759dcd16-3c90-463c-937e-abf89f991c18", "origin": "Delegated (Microsoft Graph)", - "value": "CrossTenantUserProfileSharing.Read.All" + "value": "CrossTenantUserProfileSharing.Read.All", + "userConsentDisplayName": "Read any shared cross-tenant user profiles and export data", + "userConsentDescription": "Allows the application to list and query any shared user profile information associated with the current tenant on your behalf.  It also permits the application to export external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant on your behalf." }, { "description": "Allows the application to list and query user profile information associated with the current tenant on behalf of the signed-in user. It also permits the application to export external user data (e.g. customer content or system-generated logs), associated with the current tenant on behalf of the signed-in user.", "displayName": "Read shared cross-tenant user profile and export data", "id": "cb1ba48f-d22b-4325-a07f-74135a62ee41", "origin": "Delegated (Microsoft Graph)", - "value": "CrossTenantUserProfileSharing.Read" + "value": "CrossTenantUserProfileSharing.Read", + "userConsentDisplayName": "Read shared cross-tenant user profile and export data", + "userConsentDescription": "Allows the application to list and query shared user profile information associated with the current tenant on your behalf.  It also permits the application to export your external user data (e.g. customer content or system-generated logs), associated with the current tenant on your behalf." }, { "description": "Manage alerts, activities, policies, and other investigation-related information", @@ -10416,8 +11016,8 @@ "value": "ExternalItem.Read.OwnedBy" }, { - "description": "Allows the app to read and write all external items without a signed-in user.", - "displayName": "ExternalItem.ReadWrite.All", + "description": "Allow the app to read or write items in all external datasets that the app is authorized to access", + "displayName": "Read and write items in external datasets", "id": "38c3d6ee-69ee-422f-b954-e17819665354", "origin": "Application (Graph Connector Service)", "value": "ExternalItem.ReadWrite.All" @@ -10602,7 +11202,9 @@ "displayName": "Read and write Copilot policy settings", "id": "cc147c17-b8e8-4d3f-9f94-aa9e279a079a", "origin": "Application (Microsoft Graph)", - "value": "CopilotPolicySettings.ReadWrite" + "value": "CopilotPolicySettings.ReadWrite", + "userConsentDisplayName": "Read and write Copilot policy settings", + "userConsentDescription": "Allows the app to read and write Copilot policy settings for the organization, without a signed-in user." }, { "description": "Allows the application to obtain basic tenant information about another target tenant within the Azure AD ecosystem without a signed-in user.", @@ -10913,14 +11515,14 @@ "value": "Directory.ReadWrite.All" }, { - "description": "Allows the app to read all Azure AD recommendations, without a signed-in user.", + "description": "Allows the app to read all Azure AD recommendations, without a signed-in user. ", "displayName": "Read all Azure AD recommendations", "id": "ae73097b-cb2a-4447-b064-5d80f6093921", "origin": "Application (Microsoft Graph)", "value": "DirectoryRecommendations.Read.All" }, { - "description": "Allows the app to read and update all Azure AD recommendations, without a signed-in user.", + "description": "Allows the app to read and update all Azure AD recommendations, without a signed-in user. ", "displayName": "Read and update all Azure AD recommendations", "id": "0e9eea12-4f01-45f6-9b8d-3ea4c8144158", "origin": "Application (Microsoft Graph)", @@ -11403,7 +12005,7 @@ "value": "Bookings.Read.All" }, { - "description": "Allows an app to read and write Bookings appointments and customers, and additionally allows reading businesses, services, and staff without a signed-in user.", + "description": "Allows an app to read and write Bookings appointments and customers, and additionally allows reading businesses, services, and staff without a signed-in user. ", "displayName": "Read and write all Bookings related resources.", "id": "9769393e-5a9f-4302-9e3d-7e018ecb64a7", "origin": "Application (Microsoft Graph)", @@ -14014,8 +14616,8 @@ "value": "UserAuthenticationMethod.Delete.All" }, { - "description": "Allows the app to read authentication methods of all users in your organization, without a signed-in user. Authentication methods include things like a user’s phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", - "displayName": "Read all users' authentication methods", + "description": " Allows the app to read authentication methods of all users in your organization, without a signed-in user. Authentication methods include things like a user’s phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", + "displayName": " Read all users' authentication methods", "id": "38d9df27-64da-44fd-b7c5-a6fbac20248f", "origin": "Application (Microsoft Graph)", "value": "UserAuthenticationMethod.Read.All" @@ -14865,7 +15467,9 @@ "displayName": "Read and Modify Tenant-Acquired Telephone Number Details", "id": "0a42382f-155c-4eb1-9bdc-21548ccaa387", "origin": "Application (Microsoft Graph)", - "value": "TeamsTelephoneNumber.ReadWrite.All" + "value": "TeamsTelephoneNumber.ReadWrite.All", + "userConsentDisplayName": "Allows the app to read your tenant's acquired telephone number details, without a signed-in user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.", + "userConsentDescription": "Allows the app to read your tenant's acquired telephone number details, without a signed-in user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc." }, { "description": "Allows the app to read your tenant's user configurations, without a signed-in user. User configuration may include attributes related to user, such as telephone number, assigned policies, etc.", @@ -15099,7 +15703,7 @@ "value": "TeamsTab.Create" }, { - "description": "Read the names and settings of tabs inside any team in Microsoft Teams, without a signed-in user. This does not give access to the content inside the tabs.", + "description": "Read the names and settings of tabs inside any team in Microsoft Teams, without a signed-in user. This does not give access to the content inside the tabs. ", "displayName": "Read tabs in Microsoft Teams.", "id": "46890524-499a-4bb2-ad64-1476b4f3e1cf", "origin": "Application (Microsoft Graph)", @@ -15229,84 +15833,108 @@ "displayName": "Create channels", "id": "101147cf-4178-4455-9d58-02b5c164e759", "origin": "Delegated (Microsoft Graph)", - "value": "Channel.Create" + "value": "Channel.Create", + "userConsentDisplayName": "Create channels", + "userConsentDescription": "Create channels in any team, on your behalf." }, { "description": "Delete channels in any team, on behalf of the signed-in user.", "displayName": "Delete channels", "id": "cc83893a-e232-4723-b5af-bd0b01bcfe65", "origin": "Delegated (Microsoft Graph)", - "value": "Channel.Delete.All" + "value": "Channel.Delete.All", + "userConsentDisplayName": "Delete channels", + "userConsentDescription": "Delete channels in any team, on your behalf." }, { "description": "Read channel names and channel descriptions, on behalf of the signed-in user.", "displayName": "Read the names and descriptions of channels", "id": "9d8982ae-4365-4f57-95e9-d6032a4c0b87", "origin": "Delegated (Microsoft Graph)", - "value": "Channel.ReadBasic.All" + "value": "Channel.ReadBasic.All", + "userConsentDisplayName": "Read the names and descriptions of channels", + "userConsentDescription": "Read channel names and channel descriptions, on your behalf." }, { "description": "Read the members of channels, on behalf of the signed-in user.", "displayName": "Read the members of channels", "id": "2eadaff8-0bce-4198-a6b9-2cfc35a30075", "origin": "Delegated (Microsoft Graph)", - "value": "ChannelMember.Read.All" + "value": "ChannelMember.Read.All", + "userConsentDisplayName": "Read the members of teams and channels", + "userConsentDescription": "Read the members of channels, on your behalf." }, { "description": "Add and remove members from channels, on behalf of the signed-in user. Also allows changing a member's role, for example from owner to non-owner.", "displayName": "Add and remove members from channels", "id": "0c3e411a-ce45-4cd1-8f30-f99a3efa7b11", "origin": "Delegated (Microsoft Graph)", - "value": "ChannelMember.ReadWrite.All" + "value": "ChannelMember.ReadWrite.All", + "userConsentDisplayName": "Add and remove members from teams and channels", + "userConsentDescription": "Add and remove members from channels, on your behalf. Also allows changing a member's role, for example from owner to non-owner." }, { "description": "Allows an app to edit channel messages in Microsoft Teams, on behalf of the signed-in user.", "displayName": "Edit user's channel messages", "id": "2b61aa8a-6d36-4b2f-ac7b-f29867937c53", "origin": "Delegated (Microsoft Graph)", - "value": "ChannelMessage.Edit" + "value": "ChannelMessage.Edit", + "userConsentDisplayName": "Edit your channel messages", + "userConsentDescription": "Allows the app to edit channel messages in Microsoft Teams, on your behalf." }, { "description": "Allows an app to read a channel's messages in Microsoft Teams, on behalf of the signed-in user.", "displayName": "Read user channel messages", "id": "767156cb-16ae-4d10-8f8b-41b657c8c8c8", "origin": "Delegated (Microsoft Graph)", - "value": "ChannelMessage.Read.All" + "value": "ChannelMessage.Read.All", + "userConsentDisplayName": "Read your channel messages", + "userConsentDescription": "Allows the app to read a channel's messages in Microsoft Teams, on your behalf." }, { "description": "Allows the app to read and write channel messages, on behalf of the signed-in user. This doesn't allow the app to edit the policyViolation of a channel message.", "displayName": "Read and write user channel messages", "id": "5922d31f-46c8-4404-9eaf-2117e390a8a4", "origin": "Delegated (Microsoft Graph)", - "value": "ChannelMessage.ReadWrite" + "value": "ChannelMessage.ReadWrite", + "userConsentDisplayName": "Read and write user channel messages", + "userConsentDescription": "Allows the app to read and write channel messages, on your behalf. This doesn't allow the app to edit the policyViolation of a channel message." }, { "description": "Allows the app to create, read, update and delete events in all calendars in the organization user has permissions to access. This includes delegate and shared calendars.", "displayName": "Read and write user and shared calendars", "id": "12466101-c9b8-439a-8589-dd09ee67e8e9", "origin": "Delegated (Microsoft Graph)", - "value": "Calendars.ReadWrite.Shared" + "value": "Calendars.ReadWrite.Shared", + "userConsentDisplayName": "Read and write to your and shared calendars", + "userConsentDescription": "Allows the app to read, update, create and delete events in all calendars in your organization you have permissions to access. This includes delegate and shared calendars." }, { "description": "Allows an app to send channel messages in Microsoft Teams, on behalf of the signed-in user.", "displayName": "Send channel messages", "id": "ebf0f66e-9fb1-49e4-a278-222f76911cf4", "origin": "Delegated (Microsoft Graph)", - "value": "ChannelMessage.Send" + "value": "ChannelMessage.Send", + "userConsentDisplayName": "Send channel messages", + "userConsentDescription": "Allows the app to send channel messages in Microsoft Teams, on your behalf." }, { - "description": "Allows the app to create, read, update, and delete events in user calendars.", + "description": "Allows the app to create, read, update, and delete events in user calendars. ", "displayName": "Have full access to user calendars ", "id": "1ec239c2-d7c9-4623-a91a-a9775856bb36", "origin": "Delegated (Microsoft Graph)", - "value": "Calendars.ReadWrite" + "value": "Calendars.ReadWrite", + "userConsentDisplayName": "Have full access to your calendars ", + "userConsentDescription": "Allows the app to read, update, create and delete events in your calendars. " }, { "description": "Allows the app to read events in all calendars that the user can access, including delegate and shared calendars.", "displayName": "Read user and shared calendars", "id": "2b9c4092-424d-4249-948d-b43879977640", "origin": "Delegated (Microsoft Graph)", - "value": "Calendars.Read.Shared" + "value": "Calendars.Read.Shared", + "userConsentDisplayName": "Read calendars you can access", + "userConsentDescription": "Allows the app to read events in all calendars that you can access, including delegate and shared calendars. " }, { "description": "Allows the app to read and write the billing configuration on all applications on behalf of the signed-in user.", @@ -15320,63 +15948,81 @@ "displayName": "Read BitLocker keys", "id": "b27a61ec-b99c-4d6a-b126-c4375d08ae30", "origin": "Delegated (Microsoft Graph)", - "value": "BitlockerKey.Read.All" + "value": "BitlockerKey.Read.All", + "userConsentDisplayName": "Read your BitLocker keys", + "userConsentDescription": "Allows the app to read BitLocker keys for your owned devices. Allows read of the recovery key." }, { "description": "Allows the app to read basic BitLocker key properties on behalf of the signed-in user, for their owned devices. Does not allow read of the recovery key itself.", "displayName": "Read BitLocker keys basic information", "id": "5a107bfc-4f00-4e1a-b67e-66451267bc68", "origin": "Delegated (Microsoft Graph)", - "value": "BitlockerKey.ReadBasic.All" + "value": "BitlockerKey.ReadBasic.All", + "userConsentDisplayName": "Read your BitLocker keys basic information", + "userConsentDescription": "Allows the app to read basic BitLocker key properties for your owned devices. Does not allow read of the recovery key itself." }, { "description": "Allows an app to read, write and manage bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user.", "displayName": "Manage bookings information", "id": "7f36b48e-542f-4d3b-9bcb-8406f0ab9fdb", "origin": "Delegated (Microsoft Graph)", - "value": "Bookings.Manage.All" + "value": "Bookings.Manage.All", + "userConsentDisplayName": "Manage bookings information", + "userConsentDescription": "Allows an app to read, write and manage bookings appointments, businesses, customers, services, and staff on your behalf." }, { "description": "Allows an app to read bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user.", "displayName": "Read bookings information", "id": "33b1df99-4b29-4548-9339-7a7b83eaeebc", "origin": "Delegated (Microsoft Graph)", - "value": "Bookings.Read.All" + "value": "Bookings.Read.All", + "userConsentDisplayName": "Read bookings information", + "userConsentDescription": "Allows an app to read bookings appointments, businesses, customers, services, and staff on your behalf." }, { "description": "Allows an app to read and write bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user. Does not allow create, delete and publish of booking businesses.", "displayName": "Read and write bookings information", "id": "948eb538-f19d-4ec5-9ccc-f059e1ea4c72", "origin": "Delegated (Microsoft Graph)", - "value": "Bookings.ReadWrite.All" + "value": "Bookings.ReadWrite.All", + "userConsentDisplayName": "Read and write bookings information", + "userConsentDescription": "Allows an app to read and write Bookings appointments, businesses, customers, services, and staff on your behalf. Does not allow create, delete and publish of booking businesses." }, { "description": "Allows an app to read and write bookings appointments and customers, and additionally allows read businesses information, services, and staff on behalf of the signed-in user.", "displayName": "Read and write booking appointments", "id": "02a5a114-36a6-46ff-a102-954d89d9ab02", "origin": "Delegated (Microsoft Graph)", - "value": "BookingsAppointment.ReadWrite.All" + "value": "BookingsAppointment.ReadWrite.All", + "userConsentDisplayName": "Read and write booking appointments", + "userConsentDescription": "Allows an app to read and write bookings appointments and customers, and additionally allows read businesses information, services, and staff on your behalf." }, { "description": "Allows an app to read all bookmarks that the signed-in user can access.", "displayName": "Read all bookmarks that the user can access", "id": "98b17b35-f3b1-4849-a85f-9f13733002f0", "origin": "Delegated (Microsoft Graph)", - "value": "Bookmark.Read.All" + "value": "Bookmark.Read.All", + "userConsentDisplayName": "Read all bookmarks that you have access to", + "userConsentDescription": "Allows the app to read all bookmarks you can access." }, { "description": "Allows an app to read the browser site lists configured for your organization, on behalf of the signed-in user.", "displayName": "Read browser site lists for your organization", "id": "fb9be2b7-a7fc-4182-aec1-eda4597c43d5", "origin": "Delegated (Microsoft Graph)", - "value": "BrowserSiteLists.Read.All" + "value": "BrowserSiteLists.Read.All", + "userConsentDisplayName": "Read browser site lists for your organization", + "userConsentDescription": "Allows an app to read the browser site lists configured for your organization, on your behalf." }, { "description": "Allows an app to read and write the browser site lists configured for your organization, on behalf of the signed-in user.", "displayName": "Read and write browser site lists for your organization", "id": "83b34c85-95bf-497b-a04e-b58eca9d49d0", "origin": "Delegated (Microsoft Graph)", - "value": "BrowserSiteLists.ReadWrite.All" + "value": "BrowserSiteLists.ReadWrite.All", + "userConsentDisplayName": "Read and write browser site lists for your organization", + "userConsentDescription": "Allows an app to read and write the browser site lists configured for your organization, on your behalf." }, { "description": "Allows the app to read the configurations of your organization's business scenarios, on behalf of the signed-in user.", @@ -15421,11 +16067,13 @@ "value": "BusinessScenarioData.ReadWrite.OwnedBy" }, { - "description": "Allows the app to read events in user calendars.", + "description": "Allows the app to read events in user calendars . ", "displayName": "Read user calendars ", "id": "465a38f9-76ea-45b9-9f34-9e8b0d4b0b42", "origin": "Delegated (Microsoft Graph)", - "value": "Calendars.Read" + "value": "Calendars.Read", + "userConsentDisplayName": "Read your calendars ", + "userConsentDescription": "Allows the app to read events in your calendars. " }, { "description": "Allows the app to read events in user calendars, except for properties such as body, attachments, and extensions.", @@ -15439,42 +16087,54 @@ "displayName": "Read the names, descriptions, and settings of channels", "id": "233e0cf1-dd62-48bc-b65b-b38fe87fcf8e", "origin": "Delegated (Microsoft Graph)", - "value": "ChannelSettings.Read.All" + "value": "ChannelSettings.Read.All", + "userConsentDisplayName": "Read the names, descriptions, and settings of channels", + "userConsentDescription": "Read all channel names, channel descriptions, and channel settings, on your behalf." }, { "description": "Read and write the names, descriptions, and settings of all channels, on behalf of the signed-in user.", "displayName": "Read and write the names, descriptions, and settings of channels", "id": "d649fb7c-72b4-4eec-b2b4-b15acf79e378", "origin": "Delegated (Microsoft Graph)", - "value": "ChannelSettings.ReadWrite.All" + "value": "ChannelSettings.ReadWrite.All", + "userConsentDisplayName": "Read and write the names, descriptions, and settings of channels", + "userConsentDescription": "Read and write the names, descriptions, and settings of all channels, on your behalf." }, { "description": "Allows the app to create chats on behalf of the signed-in user.", "displayName": "Create chats", "id": "38826093-1258-4dea-98f0-00003be2b8d0", "origin": "Delegated (Microsoft Graph)", - "value": "Chat.Create" + "value": "Chat.Create", + "userConsentDisplayName": "Create chats", + "userConsentDescription": "Allows the app to create chats on your behalf. " }, { "description": "Allows the app to read contacts a user has permissions to access, including their own and shared contacts.", "displayName": "Read user and shared contacts", "id": "242b9d9e-ed24-4d09-9a52-f43769beb9d4", "origin": "Delegated (Microsoft Graph)", - "value": "Contacts.Read.Shared" + "value": "Contacts.Read.Shared", + "userConsentDisplayName": "Read your and shared contacts", + "userConsentDescription": "Allows the app to read contacts you have permissions to access, including your own and shared contacts." }, { - "description": "Allows the app to create, read, update, and delete user contacts.", + "description": "Allows the app to create, read, update, and delete user contacts. ", "displayName": "Have full access to user contacts ", "id": "d56682ec-c09e-4743-aaf4-1a3aac4caa21", "origin": "Delegated (Microsoft Graph)", - "value": "Contacts.ReadWrite" + "value": "Contacts.ReadWrite", + "userConsentDisplayName": "Have full access of your contacts ", + "userConsentDescription": "Allows the app to read, update, create and delete contacts in your contact folders. " }, { "description": "Allows the app to create, read, update, and delete contacts a user has permissions to, including their own and shared contacts.", "displayName": "Read and write user and shared contacts", "id": "afb6c84b-06be-49af-80bb-8f3f77004eab", "origin": "Delegated (Microsoft Graph)", - "value": "Contacts.ReadWrite.Shared" + "value": "Contacts.ReadWrite.Shared", + "userConsentDisplayName": "Read and write to your and shared contacts", + "userConsentDescription": "Allows the app to read, update, create, and delete contacts you have permissions to access, including your own and shared contacts." }, { "description": "Allows the app to read and update the on-premises sync behavior of contacts a user has permissions to, including their own and shared contacts.", @@ -15551,7 +16211,9 @@ "displayName": "Read and write Copilot policy settings", "id": "e2edbde8-4448-4e49-8ebb-d53ba72df0f3", "origin": "Delegated (Microsoft Graph)", - "value": "CopilotPolicySettings.ReadWrite" + "value": "CopilotPolicySettings.ReadWrite", + "userConsentDisplayName": "Read and write Copilot policy settings", + "userConsentDescription": "Allows the app to read and write Copilot policy settings for the organization, on your behalf." }, { "description": "Allows the app to read organization-wide copilot limited mode setting on behalf of the signed-in user.", @@ -15572,21 +16234,27 @@ "displayName": "Read cross-tenant basic information", "id": "81594d25-e88e-49cf-ac8c-fecbff49f994", "origin": "Delegated (Microsoft Graph)", - "value": "CrossTenantInformation.ReadBasic.All" + "value": "CrossTenantInformation.ReadBasic.All", + "userConsentDisplayName": "Read cross-tenant basic information", + "userConsentDescription": "Allows the application to obtain basic tenant information about another target tenant within the Azure AD ecosystem on your behalf." }, { "description": "Allows the app to read user contacts. ", "displayName": "Read user contacts ", "id": "ff74d97f-43af-4b68-9f2a-b77ee6968c5d", "origin": "Delegated (Microsoft Graph)", - "value": "Contacts.Read" + "value": "Contacts.Read", + "userConsentDisplayName": "Read your contacts ", + "userConsentDescription": "Allows the app to read contacts in your contact folders. " }, { "description": "Allows the app to read app consent requests and approvals, and deny or approve those requests on behalf of the signed-in user.", "displayName": "Read and write consent requests", "id": "497d9dfa-3bd1-481a-baab-90895e54568c", "origin": "Delegated (Microsoft Graph)", - "value": "ConsentRequest.ReadWrite.All" + "value": "ConsentRequest.ReadWrite.All", + "userConsentDisplayName": "Read and write consent requests", + "userConsentDescription": "Allows the app to read app consent requests for your approval, and deny or approve those request on your behalf." }, { "description": "Allows the app to read and approve consent requests on behalf of the signed in user.", @@ -15600,7 +16268,9 @@ "displayName": "Read consent requests", "id": "f3bfad56-966e-4590-a536-82ecf548ac1e", "origin": "Delegated (Microsoft Graph)", - "value": "ConsentRequest.Read.All" + "value": "ConsentRequest.Read.All", + "userConsentDisplayName": "Read consent requests", + "userConsentDescription": "Allows the app to read consent requests and approvals, on your behalf." }, { "description": "Allows the app to delete and recover deleted chats, on behalf of the signed-in user.", @@ -15614,21 +16284,27 @@ "displayName": "Read user chat messages", "id": "f501c180-9344-439a-bca0-6cbf209fd270", "origin": "Delegated (Microsoft Graph)", - "value": "Chat.Read" + "value": "Chat.Read", + "userConsentDisplayName": "Read your chat messages", + "userConsentDescription": "Allows an app to read your 1 on 1 or group chat messages in Microsoft Teams, on your behalf." }, { "description": "Allows an app to read the members and descriptions of one-to-one and group chat threads, on behalf of the signed-in user.", "displayName": "Read names and members of user chat threads", "id": "9547fcb5-d03f-419d-9948-5928bbf71b0f", "origin": "Delegated (Microsoft Graph)", - "value": "Chat.ReadBasic" + "value": "Chat.ReadBasic", + "userConsentDisplayName": "Read names and members of your chat threads", + "userConsentDescription": "Allows an app to read the members and descriptions of one-to-one and group chat threads, on your behalf." }, { "description": "Allows an app to read and write 1 on 1 or group chats threads, on behalf of the signed-in user.", "displayName": "Read and write user chat messages", "id": "9ff7295e-131b-4d94-90e1-69fde507ac11", "origin": "Delegated (Microsoft Graph)", - "value": "Chat.ReadWrite" + "value": "Chat.ReadWrite", + "userConsentDisplayName": "Read and write your chat messages", + "userConsentDescription": "Allows an app to read and write your 1 on 1 or group chat messages in Microsoft Teams, on your behalf." }, { "description": "Allows an app to read and write all one-to-one and group chats in Microsoft Teams, without a signed-in user. Does not allow sending messages.", @@ -15642,21 +16318,27 @@ "displayName": "Read the members of chats", "id": "c5a9e2b1-faf6-41d4-8875-d381aa549b24", "origin": "Delegated (Microsoft Graph)", - "value": "ChatMember.Read" + "value": "ChatMember.Read", + "userConsentDisplayName": "Read the members of chats", + "userConsentDescription": "Read the members of chats, on your behalf." }, { "description": "Add and remove members from chats, on behalf of the signed-in user.", "displayName": "Add and remove members from chats", "id": "dea13482-7ea6-488f-8b98-eb5bbecf033d", "origin": "Delegated (Microsoft Graph)", - "value": "ChatMember.ReadWrite" + "value": "ChatMember.ReadWrite", + "userConsentDisplayName": "Add and remove members from chats", + "userConsentDescription": "Add and remove members from chats, on your behalf." }, { "description": "Allows an app to read one-to-one and group chat messages, on behalf of the signed-in user.", "displayName": "Read user chat messages", "id": "cdcdac3a-fd45-410d-83ef-554db620e5c7", "origin": "Delegated (Microsoft Graph)", - "value": "ChatMessage.Read" + "value": "ChatMessage.Read", + "userConsentDisplayName": "Read user chat messages", + "userConsentDescription": "Allows an app to read one-to-one or group chat messages in Microsoft Teams, on your behalf." }, { "description": "Allows the app to search the backup snapshots for Microsoft 365 resources, on behalf of the signed in user.", @@ -15670,21 +16352,27 @@ "displayName": "Send user chat messages", "id": "116b7235-7cc6-461e-b163-8e55691d839e", "origin": "Delegated (Microsoft Graph)", - "value": "ChatMessage.Send" + "value": "ChatMessage.Send", + "userConsentDisplayName": "Send chat messages", + "userConsentDescription": "Allows an app to send one-to-one and group chat messages in Microsoft Teams, on your behalf." }, { "description": "Allows the app to read the properties of Cloud PCs on behalf of the signed-in user.", "displayName": "Read Cloud PCs", "id": "5252ec4e-fd40-4d92-8c68-89dd1d3c6110", "origin": "Delegated (Microsoft Graph)", - "value": "CloudPC.Read.All" + "value": "CloudPC.Read.All", + "userConsentDisplayName": "Read Cloud PCs", + "userConsentDescription": "Allows the app to read the properties of Cloud PCs, on your behalf." }, { "description": "Allows the app to read and write the properties of Cloud PCs on behalf of the signed-in user.", "displayName": "Read and write Cloud PCs", "id": "9d77138f-f0e2-47ba-ab33-cd246c8b79d1", "origin": "Delegated (Microsoft Graph)", - "value": "CloudPC.ReadWrite.All" + "value": "CloudPC.ReadWrite.All", + "userConsentDisplayName": "Read and write Cloud PCs", + "userConsentDescription": "Allows the app to read and write the properties of Cloud PCs, on your behalf." }, { "description": "Allows the app to list Viva Engage communities, and to read their properties on behalf of the signed-in user.", @@ -15922,42 +16610,54 @@ "displayName": "Read all access reviews that user can access", "id": "ebfcd32b-babb-40f4-a14b-42706e83bd28", "origin": "Delegated (Microsoft Graph)", - "value": "AccessReview.Read.All" + "value": "AccessReview.Read.All", + "userConsentDisplayName": "Read access reviews that you can access", + "userConsentDescription": "Allows the app to read information on access reviews, reviewers, decisions and settings that you have access to." }, { "description": "Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings that the signed-in user has access to in the organization.", "displayName": "Manage all access reviews that user can access", "id": "e4aa47b9-9a69-4109-82ed-36ec70d85ff1", "origin": "Delegated (Microsoft Graph)", - "value": "AccessReview.ReadWrite.All" + "value": "AccessReview.ReadWrite.All", + "userConsentDisplayName": "Manage access reviews that you can access", + "userConsentDescription": "Allows the app to read, update and perform action on access reviews, reviewers, decisions and settings that you have access to." }, { "description": "Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings for group and app memberships that the signed-in user has access to in the organization.", "displayName": "Manage access reviews for group and app memberships", "id": "5af8c3f5-baca-439a-97b0-ea58a435e269", "origin": "Delegated (Microsoft Graph)", - "value": "AccessReview.ReadWrite.Membership" + "value": "AccessReview.ReadWrite.Membership", + "userConsentDisplayName": "Manage access reviews for group and app memberships", + "userConsentDescription": "Allows the app to read, update and perform action on access reviews, reviewers, decisions and settings that you have access to." }, { "description": "Allows an app to read all acronyms that the signed-in user can access.", "displayName": "Read all acronyms that the user can access", "id": "9084c10f-a2d6-4713-8732-348def50fe02", "origin": "Delegated (Microsoft Graph)", - "value": "Acronym.Read.All" + "value": "Acronym.Read.All", + "userConsentDisplayName": "Read all acronyms that you have access to", + "userConsentDescription": "Allows the app to read all acronyms you can access." }, { "description": "Allows the app to read administrative units and administrative unit membership on behalf of the signed-in user.", "displayName": "Read administrative units", "id": "3361d15d-be43-4de6-b441-3c746d05163d", "origin": "Delegated (Microsoft Graph)", - "value": "AdministrativeUnit.Read.All" + "value": "AdministrativeUnit.Read.All", + "userConsentDisplayName": "Read administrative units", + "userConsentDescription": "Allows the app to read administrative units and administrative unit membership on your behalf." }, { "description": "Allows the app to create, read, update, and delete administrative units and manage administrative unit membership on behalf of the signed-in user.", "displayName": "Read and write administrative units", "id": "7b8a2d34-6b3f-4542-a343-54651608ad81", "origin": "Delegated (Microsoft Graph)", - "value": "AdministrativeUnit.ReadWrite.All" + "value": "AdministrativeUnit.ReadWrite.All", + "userConsentDisplayName": "Read and write administrative units", + "userConsentDescription": "Allows the app to create, read, update, and delete administrative units and manage administrative unit membership on your behalf." }, { "description": "Allows the app to read agent instances and their related collections in your organization's Agent Registry on behalf of the signed-in user.", @@ -16083,7 +16783,9 @@ "displayName": "Read audit log data", "id": "e4c9e354-4dc5-45b8-9e7c-e1393b0b1a20", "origin": "Delegated (Microsoft Graph)", - "value": "AuditLog.Read.All" + "value": "AuditLog.Read.All", + "userConsentDisplayName": "Read audit log data", + "userConsentDescription": "Allows the app to read and query your audit log activities, on your behalf." }, { "description": "Allows the app to read and query audit logs from all services, on behalf of a signed-in user", @@ -16139,14 +16841,18 @@ "displayName": "Read all authentication context information", "id": "57b030f1-8c35-469c-b0d9-e4a077debe70", "origin": "Delegated (Microsoft Graph)", - "value": "AuthenticationContext.Read.All" + "value": "AuthenticationContext.Read.All", + "userConsentDisplayName": "Read all authentication context information", + "userConsentDescription": "Allows the app to read all authentication context information in your organization on your behalf." }, { "description": "Allows the app to read and update all authentication context information in your organization on behalf of the signed-in user.", "displayName": "Read and write all authentication context information", "id": "ba6d575a-1344-4516-b777-1404f5593057", "origin": "Delegated (Microsoft Graph)", - "value": "AuthenticationContext.ReadWrite.All" + "value": "AuthenticationContext.ReadWrite.All", + "userConsentDisplayName": "Read and write all authentication context information", + "userConsentDescription": "Allows the app to read and update all authentication context information in your organization on your behalf." }, { "description": "Allows the app to read the backup configuration, and list of Microsoft 365 service resources to be backed-up, on behalf of the signed in user.", @@ -16181,7 +16887,9 @@ "displayName": "Read attack simulation data of an organization", "id": "104a7a4b-ca76-4677-b7e7-2f4bc482f381", "origin": "Delegated (Microsoft Graph)", - "value": "AttackSimulation.Read.All" + "value": "AttackSimulation.Read.All", + "userConsentDisplayName": "Read attack simulation data of an organization", + "userConsentDescription": "Allows the app to read attack simulation and training data for an organization on your behalf." }, { "description": "Allows the app to read and respond to approvals on behalf of the signed-in user.", @@ -16209,28 +16917,36 @@ "displayName": "Read all terms of use agreements", "id": "af2819c9-df71-4dd3-ade7-4d7c9dc653b7", "origin": "Delegated (Microsoft Graph)", - "value": "Agreement.Read.All" + "value": "Agreement.Read.All", + "userConsentDisplayName": "Read all terms of use agreements", + "userConsentDescription": "Allows the app to read terms of use agreements on your behalf." }, { "description": "Allows the app to read and write terms of use agreements on behalf of the signed-in user.", "displayName": "Read and write all terms of use agreements", "id": "ef4b5d93-3104-4664-9053-a5c49ab44218", "origin": "Delegated (Microsoft Graph)", - "value": "Agreement.ReadWrite.All" + "value": "Agreement.ReadWrite.All", + "userConsentDisplayName": "Read and write all terms of use agreements", + "userConsentDescription": "Allows the app to read and write terms of use agreements on your behalf." }, { "description": "Allows the app to read terms of use acceptance statuses on behalf of the signed-in user.", "displayName": "Read user terms of use acceptance statuses", "id": "0b7643bb-5336-476f-80b5-18fbfbc91806", "origin": "Delegated (Microsoft Graph)", - "value": "AgreementAcceptance.Read" + "value": "AgreementAcceptance.Read", + "userConsentDisplayName": "Read your terms of use acceptance statuses", + "userConsentDescription": "Allows the app to read your terms of use acceptance statuses." }, { "description": "Allows the app to read terms of use acceptance statuses on behalf of the signed-in user.", "displayName": "Read terms of use acceptance statuses that user can access", "id": "a66a5341-e66e-4897-9d52-c2df58c2bfb9", "origin": "Delegated (Microsoft Graph)", - "value": "AgreementAcceptance.Read.All" + "value": "AgreementAcceptance.Read.All", + "userConsentDisplayName": "Read all terms of use acceptance statuses", + "userConsentDescription": "Allows the app to read terms of use acceptance statuses on your behalf." }, { "description": "Allows the app to read user AI enterprise interactions, on behalf of the signed-in user.", @@ -16244,21 +16960,27 @@ "displayName": "Read user activity statistics", "id": "e03cf23f-8056-446a-8994-7d93dfc8b50e", "origin": "Delegated (Microsoft Graph)", - "value": "Analytics.Read" + "value": "Analytics.Read", + "userConsentDisplayName": "Read your activity statistics", + "userConsentDescription": "Allows the app to read your activity statistics, such as how much time you've spent on emails, in meetings, or in chat sessions." }, { "description": "Allows the app to read the API connectors used in user authentication flows, on behalf of the signed-in user.", "displayName": "Read API connectors for authentication flows", "id": "1b6ff35f-31df-4332-8571-d31ea5a4893f", "origin": "Delegated (Microsoft Graph)", - "value": "APIConnectors.Read.All" + "value": "APIConnectors.Read.All", + "userConsentDisplayName": "Read API connectors for authentication flows", + "userConsentDescription": "Allows the app to read the API connectors used in user authentication flows, on your behalf." }, { "description": "Allows the app to read, create and manage the API connectors used in user authentication flows, on behalf of the signed-in user.", "displayName": "Read and write API connectors for authentication flows", "id": "c67b52c5-7c69-48b6-9d48-7b3af3ded914", "origin": "Delegated (Microsoft Graph)", - "value": "APIConnectors.ReadWrite.All" + "value": "APIConnectors.ReadWrite.All", + "userConsentDisplayName": "Read and write API connectors for authentication flows", + "userConsentDescription": "Allows the app to read, create and manage the API connectors used in user authentication flows, on your behalf." }, { "description": "Allows the user to read all agent registration information", @@ -16272,14 +16994,18 @@ "displayName": "Read all app catalogs", "id": "88e58d74-d3df-44f3-ad47-e89edf4472e4", "origin": "Delegated (Microsoft Graph)", - "value": "AppCatalog.Read.All" + "value": "AppCatalog.Read.All", + "userConsentDisplayName": "Read all app catalogs", + "userConsentDescription": "Allows the app to read apps in the app catalogs." }, { "description": "Allows the app to submit application packages to the catalog and cancel submissions that are pending review on behalf of the signed-in user.", "displayName": "Submit application packages to the catalog and cancel pending submissions", "id": "3db89e36-7fa6-4012-b281-85f3d9d9fd2e", "origin": "Delegated (Microsoft Graph)", - "value": "AppCatalog.Submit" + "value": "AppCatalog.Submit", + "userConsentDisplayName": "Submit application packages to your organization's catalog and cancel pending submissions", + "userConsentDescription": "Allows the app to submit application packages to the catalog and cancel submissions that are pending review on your behalf." }, { "description": "Allows the app to read the trusted certificate authority configuration which can be used to restrict application certificates based on their issuing authority, on behalf of the signed-in user.", @@ -16300,7 +17026,9 @@ "displayName": "Read applications", "id": "c79f8feb-a9db-4090-85f9-90d820caa0eb", "origin": "Delegated (Microsoft Graph)", - "value": "Application.Read.All" + "value": "Application.Read.All", + "userConsentDisplayName": "Read applications", + "userConsentDescription": "Allows the app to read applications and service principals on your behalf." }, { "description": "Allows the app to read and update all apps in your organization, on behalf of the signed-in user.", @@ -16311,10 +17039,12 @@ }, { "description": "Allows the app to create, read, update and delete applications and service principals on behalf of the signed-in user. Allows management of app role assignments, except those exposed by Microsoft Graph. Does not allow management of delegated permission grants.", - "displayName": "Read and write applications", + "displayName": "Read and write all applications", "id": "bdfbf15f-ee85-4955-8675-146e8e5296b5", "origin": "Delegated (Microsoft Graph)", - "value": "Application.ReadWrite.All" + "value": "Application.ReadWrite.All", + "userConsentDisplayName": "Read and write applications", + "userConsentDescription": "Allows the app to create, read, update and delete applications and service principals on your behalf. Does not allow management of consent grants." }, { "description": "Allows the app to read and write other apps' remote desktop security configuration, on behalf of the signed-in user.", @@ -16328,14 +17058,18 @@ "displayName": "Manage app permission grants and app role assignments", "id": "84bccea3-f856-4a8a-967b-dbe0a3d53a64", "origin": "Delegated (Microsoft Graph)", - "value": "AppRoleAssignment.ReadWrite.All" + "value": "AppRoleAssignment.ReadWrite.All", + "userConsentDisplayName": "Manage app permission grants and app role assignments", + "userConsentDescription": "Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on your behalf." }, { "description": "Allows the app to create, read, update, and delete apps in the app catalogs.", "displayName": "Read and write to all app catalogs", "id": "1ca167d5-1655-44a1-8adf-1414072e1ef9", "origin": "Delegated (Microsoft Graph)", - "value": "AppCatalog.ReadWrite.All" + "value": "AppCatalog.ReadWrite.All", + "userConsentDisplayName": "Read and write to all app catalogs", + "userConsentDescription": "Allows the app to create, read, update, and delete apps in the app catalogs." }, { "description": "Allows the app to read, create, edit, and delete all the short notes without a signed-in user.", @@ -16555,7 +17289,7 @@ "value": "InformationProtectionContent.Sign.All" }, { - "description": "Allows the app to create protected content without a signed-in user.", + "description": "Allows the app to create protected content without a signed-in user. ", "displayName": "Create protected content", "id": "287bd98c-e865-4e8c-bade-1a85523195b9", "origin": "Application (Microsoft Graph)", @@ -16996,7 +17730,7 @@ "value": "ExternalConnection.ReadWrite.All" }, { - "description": "Allows the app to read and write external connections without a signed-in user. The app can only read and write external connections that it is authorized to, or it can create new external connections.", + "description": "Allows the app to read and write external connections without a signed-in user. The app can only read and write external connections that it is authorized to, or it can create new external connections. ", "displayName": "Read and write external connections", "id": "f431331c-49a6-499f-be1c-62af19c34a9d", "origin": "Application (Microsoft Graph)", @@ -17213,7 +17947,7 @@ "value": "OrgSettings-AppsAndServices.Read.All" }, { - "description": "Allows the app to read, create, update and delete all files in all site collections without a signed in user.", + "description": "Allows the app to read, create, update and delete all files in all site collections without a signed in user. ", "displayName": "Read and write files in all site collections", "id": "75359482-378d-4052-8f01-80520e7db3cd", "origin": "Application (Microsoft Graph)", @@ -18011,14 +18745,14 @@ "value": "SecurityAlert.ReadWrite.All" }, { - "description": "Read email metadata and security detection details, without a signed-in user. ", + "description": "Allows the app to read email metadata and security detection details for all emails in your organization, without a signed-in user.", "displayName": "Read metadata and detection details for all emails in your organization", "id": "b48f7ac2-044d-4281-b02f-75db744d6f5f", "origin": "Application (Microsoft Graph)", "value": "SecurityAnalyzedMessage.Read.All" }, { - "description": "Read email metadata and security detection details, and execute remediation actions like deleting an email, without a signed-in user.", + "description": "Allows the app to read email metadata and security detection details, and execute remediation actions like deleting an email, for all emails in your organization, without a signed-in user.", "displayName": "Read metadata, detection details, and execute remediation actions on all emails in your organization", "id": "04c55753-2244-4c25-87fc-704ab82a4f69", "origin": "Application (Microsoft Graph)", @@ -18113,7 +18847,9 @@ "displayName": "Access Microsoft Teams and Skype for Business data based on the user's role membership", "id": "e60370c1-e451-437e-aa6e-d76df38e5f15", "origin": "Delegated (Skype and Teams Tenant Admin API)", - "value": "user_impersonation" + "value": "user_impersonation", + "userConsentDisplayName": "Access Microsoft Teams and Skype for Business data based on the user's role membership", + "userConsentDescription": "Access Microsoft Teams and Skype for Business data as the signed in user" }, { "description": "Allows the application to read certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, without a signed-in user.", @@ -18716,5 +19452,26 @@ "id": "68067c9d-a1be-4603-b095-3eaf54a42510", "origin": "Application (ProjectWorkManagement)", "value": "OrgSettings-Planner.ReadWrite.All" + }, + { + "description": "Allows the app to access Dynamics CRM / Dataverse Web API on behalf of the signed-in user.", + "displayName": "Dynamics CRM user_impersonation", + "id": "78ce3f0f-a1ce-49c2-8cde-64b5c0896db4", + "origin": "Delegated (Dynamics CRM)", + "value": "user_impersonation" + }, + { + "description": "Allows the app to read Power Platform application packages on behalf of the signed-in user.", + "displayName": "Power Platform API - Read Application Packages", + "id": "9dafb9c1-c236-48b1-b142-20dcaab58675", + "origin": "Delegated (Power Platform API)", + "value": "AppManagement.ApplicationPackages.Read" + }, + { + "description": "Allows the app to access Power Apps Service API on behalf of the signed-in user.", + "displayName": "Power Apps Service - User", + "id": "0eb56b90-a7b5-43b5-9402-8137a8083e90", + "origin": "Delegated (Power Apps Service)", + "value": "User" } ] diff --git a/backend/Config/SAMManifest.json b/backend/Config/SAMManifest.json index d9ab966723..27d1b575d7 100644 --- a/backend/Config/SAMManifest.json +++ b/backend/Config/SAMManifest.json @@ -650,6 +650,54 @@ { "id": "3bc15058-7858-4141-b24f-ae43b4e80b52", "type": "Scope" + }, + { + "id": "b10642fc-a6cf-4c46-87f9-e1f96c2a18aa", + "type": "Role" + }, + { + "id": "f0c341be-8348-4989-8e43-660324294538", + "type": "Role" + }, + { + "id": "bdd80a03-d9bc-451d-b7c4-ce7c63fe3c8f", + "type": "Role" + }, + { + "id": "23fc2474-f741-46ce-8465-674744c5c361", + "type": "Role" + }, + { + "id": "6a118a39-1227-45d4-af0c-ea7b40d210bc", + "type": "Role" + }, + { + "id": "243cded2-bd16-4fd6-a953-ff8177894c3d", + "type": "Role" + }, + { + "id": "5dad17ba-f6cc-4954-a5a2-a0dcc95154f0", + "type": "Role" + }, + { + "id": "9492366f-7969-46a4-8d15-ed1a20078fff", + "type": "Role" + }, + { + "id": "01d4889c-1287-42c6-ac1f-5d1e02578ef6", + "type": "Role" + }, + { + "id": "df85f4d6-205c-4ac5-a5ea-6bf408dba283", + "type": "Scope" + }, + { + "id": "50180013-6191-4d1e-a373-e590ff4e66af", + "type": "Role" + }, + { + "id": "b2620db1-3bf7-4c5b-9cb9-576d29eac736", + "type": "Role" } ] }, @@ -756,6 +804,33 @@ } ] }, + { + "resourceAppId": "00000007-0000-0000-c000-000000000000", + "resourceAccess": [ + { + "id": "78ce3f0f-a1ce-49c2-8cde-64b5c0896db4", + "type": "Scope" + } + ] + }, + { + "resourceAppId": "8578e004-a5c6-46e7-913e-12f58912df43", + "resourceAccess": [ + { + "id": "9dafb9c1-c236-48b1-b142-20dcaab58675", + "type": "Scope" + } + ] + }, + { + "resourceAppId": "475226c6-020e-4fb2-8a90-7a972cbfc1d4", + "resourceAccess": [ + { + "id": "0eb56b90-a7b5-43b5-9402-8137a8083e90", + "type": "Scope" + } + ] + }, { "resourceAppId": "09abbdfd-ed23-44ee-a2d9-a627aa1c90f3", "resourceAccess": [ diff --git a/backend/Config/openapi.json b/backend/Config/openapi.json index cc757493c3..be84b59815 100644 --- a/backend/Config/openapi.json +++ b/backend/Config/openapi.json @@ -36,6 +36,9 @@ { "name": "CIPP > Setup" }, + { + "name": "Dynamics" + }, { "name": "Email-Exchange > Administration" }, @@ -87,6 +90,9 @@ { "name": "Identity > Reports" }, + { + "name": "Security" + }, { "name": "Security > Compliance-DLP" }, @@ -120,6 +126,9 @@ { "name": "Tenant > Administration > Domains" }, + { + "name": "Tenant > Administration > Integration Templates" + }, { "name": "Tenant > Administration > Tenant" }, @@ -129,6 +138,9 @@ { "name": "Tenant > Conditional" }, + { + "name": "Tenant > CrossTenant" + }, { "name": "Tenant > GDAP" }, @@ -974,19 +986,6 @@ "conditions": { "type": "object", "properties": { - "applications": { - "type": "object", - "properties": { - "includeAuthenticationContextClassReferences": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Convert authentication context class reference IDs to display names and store full objects" - } - }, - "description": "Convert authentication context class reference IDs to display names and store full objects" - }, "locations": { "type": "object", "properties": { @@ -1699,8 +1698,7 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Tests.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "CIPP.Tests.ReadWrite" } }, "/api/AddDefenderDeployment": { @@ -3570,11 +3568,15 @@ }, "displayName": { "type": "string", - "description": "Regular Distribution Group" + "description": "Use displayName as fallback for groups that don't need email (security groups)" }, "groupType": { - "type": "string", - "description": "Normalize group type for consistent handling (accept camelCase from templates)" + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "Extract groupType value - handle both string and object with .value property" }, "hideFromGAL": { "type": "string" @@ -3614,7 +3616,12 @@ "type": "string" }, "tenantFilter": { - "$ref": "#/components/schemas/LabelValue" + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "Extract tenant filter - check for AllTenants first, then extract value" }, "username": { "type": "string", @@ -3639,6 +3646,9 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -3978,8 +3988,12 @@ "description": "Normalize field names to handle different casing from various forms" }, "groupType": { - "type": "string", - "description": "Normalize group type to match New-CIPPGroup expectations Handle values from ListGroups calculatedGroupType and frontend form values" + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "Extract groupType value - handle both string and object with .value property" }, "GUID": { "type": "string" @@ -6061,11 +6075,44 @@ "schema": { "type": "object", "properties": { + "customSiteDesignId": { + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "Handle custom site design ID" + }, + "hubSiteId": { + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "Handle hub site association" + }, "isPublic": { "type": "boolean" }, + "lcid": { + "allOf": [ + { + "$ref": "#/components/schemas/LabelValueNumber" + } + ], + "description": "Handle language/LCID" + }, "sensitivityLabel": { - "type": "string" + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "Handle sensitivity label" + }, + "shareByEmailEnabled": { + "type": "boolean", + "description": "Handle external sharing" }, "siteDescription": { "type": "string" @@ -6076,20 +6123,42 @@ "$ref": "#/components/schemas/LabelValue" } ], - "description": "Optional. Only applies to the Team and Communication templates; omitted for TeamGroup." + "description": "Handle site design" }, "siteName": { "type": "string" }, "siteOwner": { - "$ref": "#/components/schemas/LabelValue" + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "Handle owner - can be object with value property or direct string" + }, + "storageQuota": { + "type": "integer", + "description": "Handle storage quota" }, "templateName": { - "$ref": "#/components/schemas/LabelValue" + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "Handle template name" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." + }, + "timeZoneId": { + "allOf": [ + { + "$ref": "#/components/schemas/LabelValueNumber" + } + ], + "description": "Handle time zone" } }, "required": [ @@ -6392,6 +6461,10 @@ "createdAt": { "type": "string" }, + "excludedTenants": { + "type": "string", + "description": "Clean up excludedTenants if it contains corrupted data" + }, "GitHub": { "type": "object", "properties": { @@ -6415,7 +6488,8 @@ "type": "string" }, "tenantFilter": { - "type": "string" + "type": "string", + "description": "Clean up corrupted data - tenantFilter should be an array of tenants, not the literal string 'tenantFilter'" } }, "additionalProperties": true, @@ -6570,15 +6644,89 @@ "schema": { "type": "object", "properties": { + "additionalMembers": { + "type": "string" + }, + "allowAddRemoveApps": { + "type": "boolean", + "description": "Add member settings if provided" + }, + "allowChannelMentions": { + "type": "boolean", + "description": "Add messaging settings if provided" + }, + "allowCreatePrivateChannels": { + "type": "boolean", + "description": "Add member settings if provided" + }, + "allowCreateUpdateChannels": { + "type": "boolean", + "description": "Add member settings if provided" + }, + "allowCreateUpdateRemoveConnectors": { + "type": "boolean", + "description": "Add member settings if provided" + }, + "allowCreateUpdateRemoveTabs": { + "type": "boolean", + "description": "Add member settings if provided" + }, + "allowCustomMemes": { + "type": "boolean", + "description": "Add fun settings if provided" + }, + "allowDeleteChannels": { + "type": "boolean", + "description": "Add member settings if provided" + }, + "allowGiphy": { + "type": "boolean", + "description": "Add fun settings if provided" + }, + "allowGuestCreateUpdateChannels": { + "type": "boolean", + "description": "Add guest settings if provided" + }, + "allowGuestDeleteChannels": { + "type": "boolean", + "description": "Add guest settings if provided" + }, + "allowOwnerDeleteMessages": { + "type": "boolean", + "description": "Add messaging settings if provided" + }, + "allowStickersAndMemes": { + "type": "boolean", + "description": "Add fun settings if provided" + }, + "allowTeamMentions": { + "type": "boolean", + "description": "Add messaging settings if provided" + }, + "allowUserDeleteMessages": { + "type": "boolean", + "description": "Add messaging settings if provided" + }, + "allowUserEditMessages": { + "type": "boolean", + "description": "Add messaging settings if provided" + }, "description": { "type": "string" }, "displayName": { "type": "string" }, + "giphyContentRating": { + "type": "string" + }, "owner": { "type": "string" }, + "templateName": { + "type": "string", + "description": "Determine template" + }, "tenantid": { "type": "string" }, @@ -6910,6 +7058,9 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -7286,6 +7437,10 @@ "department": { "type": "string" }, + "disableLegacyProtocols": { + "type": "boolean", + "description": "Disable legacy protocols (IMAP/POP) if requested" + }, "DisplayName": { "type": "string" }, @@ -7510,9 +7665,15 @@ } } }, + "disableLegacyProtocols": { + "type": "string" + }, "licenses": { "$ref": "#/components/schemas/LabelValue" }, + "primDomain": { + "$ref": "#/components/schemas/LabelValue" + }, "tenantFilter": { "type": "string", "description": "Interact with body parameters or the body of the request." @@ -7880,45 +8041,23 @@ "x-cipp-any-tenant": true } }, - "/api/CreateSafeLinksPolicyTemplate": { - "post": { - "summary": "CreateSafeLinksPolicyTemplate", - "operationId": "CreateSafeLinksPolicyTemplate", + "/api/BestPracticeAnalyser_List": { + "get": { + "summary": "BestPracticeAnalyser_List", + "operationId": "BestPracticeAnalyser_List", "tags": [ - "Security > Safe-Links-Policy" + "Tenant > Standards" ], - "description": "This function creates a new Safe Links policy template from scratch.", - "requestBody": { - "required": false, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "TemplateDescription": { - "type": "string" - }, - "TemplateName": { - "type": "string", - "description": "Set name and comments first" - } - } - } - } - } - }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { - "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", - "properties": { - "Results": { - "x-cipp-field-source": "backend" - } + "type": "array", + "items": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } @@ -7936,85 +8075,31 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.SafeLinks.ReadWrite", + "x-cipp-role": "Tenant.BestPracticeAnalyser.Read", "x-cipp-any-tenant": true } }, - "/api/DeleteSharepointSite": { + "/api/CreateSafeLinksPolicyTemplate": { "post": { - "summary": "DeleteSharepointSite", - "operationId": "DeleteSharepointSite", + "summary": "CreateSafeLinksPolicyTemplate", + "operationId": "CreateSafeLinksPolicyTemplate", "tags": [ - "Teams-Sharepoint" + "Security > Safe-Links-Policy" ], + "description": "This function creates a new Safe Links policy template from scratch.", "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { - "SiteId": { + "TemplateDescription": { "type": "string" }, - "tenantFilter": { + "TemplateName": { "type": "string", - "description": "Interact with query parameters or the body of the request." - } - }, - "required": [ - "SiteId", - "tenantFilter" - ] - } - } - } - }, - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/StandardResults" - } - } - } - }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" - }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" - } - }, - "security": [ - { - "bearerAuth": [] - } - ], - "x-cipp-role": "Sharepoint.Site.ReadWrite" - } - }, - "/api/DeleteTestReport": { - "post": { - "summary": "DeleteTestReport", - "operationId": "DeleteTestReport", - "tags": [ - "Tenant > Tests" - ], - "requestBody": { - "required": false, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "ReportId": { - "type": "string" + "description": "Set name and comments first" } } } @@ -8028,64 +8113,16 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "CreatedAt": { - "x-cipp-field-source": "storage" - }, - "CustomTests": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "description": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "DevicesTests": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "IdentityTests": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "name": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" - }, "Results": { "x-cipp-field-source": "backend" - }, - "RowKey": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "UpdatedAt": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "version": { - "x-cipp-field-source": "storage" } } } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -8098,38 +8135,202 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Dashboard.Read" + "x-cipp-role": "Exchange.SafeLinks.ReadWrite", + "x-cipp-any-tenant": true } }, - "/api/DeployContactTemplates": { + "/api/DeleteSharepointSite": { "post": { - "summary": "DeployContactTemplates", - "operationId": "DeployContactTemplates", + "summary": "DeleteSharepointSite", + "operationId": "DeleteSharepointSite", "tags": [ - "Email-Exchange > Administration > Contacts" + "Teams-Sharepoint" ], - "description": "This function deploys contact(s) from template(s) to selected tenants.", "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "selectedTenants": { - "type": "array", - "items": { - "$ref": "#/components/schemas/LabelValue" - } + "DisplayName": { + "type": "string" }, - "TemplateList": { - "type": "array", - "items": { - "$ref": "#/components/schemas/LabelValue" - }, - "description": "Templates are provided in TemplateList format" + "SiteId": { + "type": "string" + }, + "tenantFilter": { + "type": "string" } - } + }, + "required": [ + "SiteId", + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Sharepoint.Site.ReadWrite" + } + }, + "/api/DeleteTestReport": { + "post": { + "summary": "DeleteTestReport", + "operationId": "DeleteTestReport", + "tags": [ + "Tenant > Tests" + ], + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "ReportId": { + "type": "string" + } + } + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "CreatedAt": { + "x-cipp-field-source": "storage" + }, + "CustomTests": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "description": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "DevicesTests": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "IdentityTests": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "name": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "RowKey": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "UpdatedAt": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "version": { + "x-cipp-field-source": "storage" + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "CIPP.Dashboard.Read" + } + }, + "/api/DeployContactTemplates": { + "post": { + "summary": "DeployContactTemplates", + "operationId": "DeployContactTemplates", + "tags": [ + "Email-Exchange > Administration > Contacts" + ], + "description": "This function deploys contact(s) from template(s) to selected tenants.", + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "selectedTenants": { + "type": "array", + "items": { + "$ref": "#/components/schemas/LabelValue" + } + }, + "TemplateList": { + "type": "array", + "items": { + "$ref": "#/components/schemas/LabelValue" + }, + "description": "Templates are provided in TemplateList format" + } + } } } } @@ -8170,11 +8371,11 @@ "tags": [ "Tenant > Standards" ], - "description": "Returns the cached Domain Analyser results: the DNS health of each tenant's domains, covering MX, SPF, DKIM, DMARC and DNSSEC. Populated by a scheduled job, so this reads the last run rather than resolving DNS live. tenantFilter=AllTenants returns every tenant's domains.", "parameters": [ { "name": "tenantFilter", "in": "query", + "description": "Get all the things - always filter by PartitionKey for performance", "required": false, "schema": { "type": "string" @@ -8702,12 +8903,12 @@ "x-cipp-any-tenant": true } }, - "/api/EditDlpCompliancePolicy": { + "/api/EditCrossTenantPartner": { "post": { - "summary": "EditDlpCompliancePolicy", - "operationId": "EditDlpCompliancePolicy", + "summary": "EditCrossTenantPartner", + "operationId": "EditCrossTenantPartner", "tags": [ - "Security > Compliance-DLP" + "Tenant > CrossTenant" ], "requestBody": { "required": true, @@ -8716,17 +8917,25 @@ "schema": { "type": "object", "properties": { - "Identity": { + "automaticUserConsentSettings": { "type": "string" }, - "Name": { + "b2bCollaborationInbound": { "type": "string" }, - "parameters": { - "type": "string", - "description": "Allow passing arbitrary additional params via Body.parameters" + "b2bCollaborationOutbound": { + "type": "string" }, - "State": { + "b2bDirectConnectInbound": { + "type": "string" + }, + "b2bDirectConnectOutbound": { + "type": "string" + }, + "inboundTrust": { + "type": "string" + }, + "partnerTenantId": { "type": "string" }, "tenantFilter": { @@ -8734,44 +8943,85 @@ } }, "required": [ + "partnerTenantId", "tenantFilter" ] } } } }, - "parameters": [ - { - "name": "Identity", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "State", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - } - ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "properties": { + "appServiceConnectInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "automaticUserConsentSettings": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "b2bCollaborationInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "b2bCollaborationOutbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "b2bDirectConnectInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "b2bDirectConnectOutbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "inboundTrust": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "isInMultiTenantOrganization": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isServiceProvider": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "m365CollaborationInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "m365CollaborationOutbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "tenantId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "tenantRestrictions": { + "type": "object", + "x-cipp-field-source": "graph-entity" + } + } } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -8784,39 +9034,51 @@ "bearerAuth": [] } ], - "x-cipp-role": "Security.DlpCompliancePolicy.ReadWrite" + "x-cipp-role": "Tenant.CrossTenant.ReadWrite" } }, - "/api/EditEquipmentMailbox": { + "/api/EditCrossTenantPolicy": { "post": { - "summary": "EditEquipmentMailbox", - "operationId": "EditEquipmentMailbox", + "summary": "EditCrossTenantPolicy", + "operationId": "EditCrossTenantPolicy", "tags": [ - "Email-Exchange > Resources" + "Tenant > CrossTenant" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "displayName": { + "automaticUserConsentSettings": { "type": "string" }, - "equipmentId": { + "b2bCollaborationInbound": { "type": "string" }, - "hiddenFromAddressListsEnabled": { + "b2bCollaborationOutbound": { "type": "string" }, - "tenantID": { + "b2bDirectConnectInbound": { "type": "string" }, - "userPrincipalName": { + "b2bDirectConnectOutbound": { + "type": "string" + }, + "inboundTrust": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + }, + "tenantRestrictions": { "type": "string" } - } + }, + "required": [ + "tenantFilter" + ] } } } @@ -8828,16 +9090,71 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { + "appServiceConnectInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "automaticUserConsentSettings": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "b2bCollaborationInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "b2bCollaborationOutbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "b2bDirectConnectInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "b2bDirectConnectOutbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "inboundTrust": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "invitationRedemptionIdentityProviderConfiguration": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "isServiceDefault": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "m365CollaborationInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "m365CollaborationOutbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, "Results": { "x-cipp-field-source": "backend" + }, + "tenantRestrictions": { + "type": "object", + "x-cipp-field-source": "graph-entity" } } } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -8850,15 +9167,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Equipment.ReadWrite" + "x-cipp-role": "Tenant.CrossTenant.ReadWrite" } }, - "/api/EditExConnector": { + "/api/EditDlpCompliancePolicy": { "post": { - "summary": "EditExConnector", - "operationId": "EditExConnector", + "summary": "EditDlpCompliancePolicy", + "operationId": "EditDlpCompliancePolicy", "tags": [ - "Email-Exchange > Transport" + "Security > Compliance-DLP" ], "requestBody": { "required": true, @@ -8867,16 +9184,20 @@ "schema": { "type": "object", "properties": { - "GUID": { + "Identity": { "type": "string" }, - "State": { + "Name": { "type": "string" }, - "tenantFilter": { + "parameters": { + "type": "string", + "description": "Allow passing arbitrary additional params via Body.parameters" + }, + "State": { "type": "string" }, - "Type": { + "tenantFilter": { "type": "string" } }, @@ -8889,7 +9210,7 @@ }, "parameters": [ { - "name": "GUID", + "name": "Identity", "in": "query", "required": false, "schema": { @@ -8906,14 +9227,161 @@ }, { "$ref": "#/components/parameters/tenantFilter" - }, - { - "name": "Type", - "in": "query", - "required": false, - "schema": { - "type": "string" - } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Security.DlpCompliancePolicy.ReadWrite" + } + }, + "/api/EditEquipmentMailbox": { + "post": { + "summary": "EditEquipmentMailbox", + "operationId": "EditEquipmentMailbox", + "tags": [ + "Email-Exchange > Resources" + ], + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "displayName": { + "type": "string" + }, + "equipmentId": { + "type": "string" + }, + "hiddenFromAddressListsEnabled": { + "type": "string" + }, + "tenantID": { + "type": "string" + }, + "userPrincipalName": { + "type": "string" + } + } + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Results": { + "x-cipp-field-source": "backend" + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.Equipment.ReadWrite" + } + }, + "/api/EditExConnector": { + "post": { + "summary": "EditExConnector", + "operationId": "EditExConnector", + "tags": [ + "Email-Exchange > Transport" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "GUID": { + "type": "string" + }, + "State": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + }, + "Type": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "parameters": [ + { + "name": "GUID", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "State", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "Type", + "in": "query", + "required": false, + "schema": { + "type": "string" + } } ], "responses": { @@ -8942,6 +9410,90 @@ "x-cipp-role": "Exchange.Connector.ReadWrite" } }, + "/api/EditExternalCollaboration": { + "post": { + "summary": "EditExternalCollaboration", + "operationId": "EditExternalCollaboration", + "tags": [ + "Tenant > CrossTenant" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "allowedToSignUpEmailBasedSubscriptions": { + "type": "boolean" + }, + "allowEmailVerifiedUsersToJoinOrganization": { + "type": "boolean" + }, + "allowInvitesFrom": { + "type": "string" + }, + "blockMsnSignIn": { + "type": "boolean" + }, + "domainRestrictions": { + "type": "object", + "properties": { + "InvitationsAllowedAndBlockedDomainsPolicy": { + "type": "string" + } + }, + "description": "Update B2B domain allow/deny lists if provided" + }, + "guestUserRoleId": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Results": { + "x-cipp-field-source": "backend" + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.CrossTenant.ReadWrite" + } + }, "/api/EditGroup": { "post": { "summary": "EditGroup", @@ -9216,6 +9768,76 @@ "x-cipp-role": "Identity.Group.ReadWrite" } }, + "/api/EditGroupAliases": { + "post": { + "summary": "EditGroupAliases", + "operationId": "EditGroupAliases", + "tags": [ + "Identity > Administration > Groups" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "AddedAliases": { + "type": "string" + }, + "GroupType": { + "type": "string" + }, + "id": { + "type": "string" + }, + "MakePrimary": { + "type": "string" + }, + "RemovedAliases": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "id", + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.Group.ReadWrite" + } + }, "/api/EditIntunePolicy": { "post": { "summary": "EditIntunePolicy", @@ -9291,7 +9913,7 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.MEM.ReadWrite" + "x-cipp-role": "Endpoint.MEM.Read" } }, "/api/EditIntuneScript": { @@ -9789,7 +10411,8 @@ "$ref": "#/components/schemas/LabelValue" }, "Identity": { - "type": "string" + "type": "string", + "description": "Built-in policies (e.g. the global settings policy) report an all-zeros Guid that Set-QuarantinePolicy cannot resolve as an objectId, so fall back to the policy name." }, "IncludeMessagesFromBlockedSenderAddress": { "type": "string" @@ -10734,6 +11357,227 @@ "x-cipp-role": "Security.SensitivityLabel.ReadWrite" } }, + "/api/EditSharepointSettings": { + "post": { + "summary": "EditSharepointSettings", + "operationId": "EditSharepointSettings", + "tags": [ + "Teams-Sharepoint" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "defaultLinkPermission": { + "type": "string", + "description": "Default link permission" + }, + "defaultSharingLinkType": { + "type": "string", + "description": "Default sharing link type" + }, + "fileAnonymousLinkType": { + "type": "string", + "description": "File and folder links (anonymous link settings)" + }, + "folderAnonymousLinkType": { + "type": "string" + }, + "isResharingByExternalUsersEnabled": { + "type": "boolean", + "description": "External resharing" + }, + "requireAnonymousLinksExpireInDays": { + "type": "integer", + "description": "Anyone link expiration" + }, + "sharingAllowedDomainList": { + "type": "string" + }, + "sharingBlockedDomainList": { + "type": "string" + }, + "sharingCapability": { + "type": "string", + "description": "Sharing capability (main sharing level)" + }, + "sharingDomainRestrictionMode": { + "type": "string", + "description": "Domain restriction mode", + "x-cipp-observed-values": [ + "allowList", + "blockList" + ] + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "properties": { + "allowedDomainGuidsForSyncApp": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "availableManagedPathsForSiteCreation": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "deletedUserPersonalSiteRetentionPeriodInDays": { + "type": "integer", + "x-cipp-field-source": "graph-entity" + }, + "excludedFileExtensionsForSyncApp": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "idleSessionSignOut": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "imageTaggingOption": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "isCommentingOnSitePagesEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isFileActivityNotificationEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isLegacyAuthProtocolsEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isLoopEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isMacSyncAppEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isRequireAcceptingUserToMatchInvitedUserEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isResharingByExternalUsersEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isSharePointMobileNotificationEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isSharePointNewsfeedEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isSiteCreationEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isSiteCreationUIEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isSitePagesCreationEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isSitesStorageLimitAutomatic": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isSyncButtonHiddenOnPersonalSite": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isUnmanagedSyncAppForTenantRestricted": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "personalSiteDefaultStorageLimitInMB": { + "type": "integer", + "x-cipp-field-source": "graph-entity" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "sharingAllowedDomainList": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "sharingBlockedDomainList": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "sharingCapability": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "sharingDomainRestrictionMode": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "siteCreationDefaultManagedPath": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "siteCreationDefaultStorageLimitInMB": { + "type": "integer", + "x-cipp-field-source": "graph-entity" + }, + "tenantDefaultTimezone": { + "type": "string", + "x-cipp-field-source": "graph-entity" + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Sharepoint.Admin.ReadWrite" + } + }, "/api/EditSpamFilter": { "post": { "summary": "EditSpamFilter", @@ -10798,6 +11642,179 @@ "x-cipp-role": "Exchange.SpamFilter.ReadWrite" } }, + "/api/EditTeamsSettings": { + "post": { + "summary": "EditTeamsSettings", + "operationId": "EditTeamsSettings", + "tags": [ + "Teams-Sharepoint" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "allowAnonymousUsersToJoinMeeting": { + "type": "boolean" + }, + "allowAnonymousUsersToStartMeeting": { + "type": "boolean" + }, + "allowBox": { + "type": "boolean" + }, + "allowCommunicationComplianceEndUserReporting": { + "type": "boolean" + }, + "allowDropBox": { + "type": "boolean" + }, + "allowEgnyte": { + "type": "boolean" + }, + "allowExternalParticipantGiveRequestControl": { + "type": "boolean" + }, + "allowGoogleDrive": { + "type": "boolean" + }, + "allowGuestUser": { + "type": "boolean" + }, + "allowOwnerDeleteMessage": { + "type": "boolean" + }, + "allowPSTNUsersToBypassLobby": { + "type": "boolean" + }, + "allowSecurityEndUserReporting": { + "type": "boolean" + }, + "allowShareFile": { + "type": "boolean" + }, + "allowTeamsConsumer": { + "type": "boolean" + }, + "allowUserDeleteChat": { + "type": "boolean" + }, + "allowUserDeleteMessage": { + "type": "boolean" + }, + "allowUserEditMessage": { + "type": "boolean" + }, + "assignUser": { + "type": "string", + "description": "Assign branding policy to a specific user" + }, + "autoAdmittedUsers": { + "type": "string" + }, + "createCustomEmojis": { + "type": "boolean" + }, + "deleteCustomEmojis": { + "type": "boolean" + }, + "designatedPresenterRoleMode": { + "type": "string" + }, + "enableFederationAccess": { + "type": "boolean" + }, + "enableMeetingBackgroundImages": { + "type": "boolean", + "description": "Update Meeting Branding Policy (background images toggle)" + }, + "enableTeamsConsumerAccess": { + "type": "boolean" + }, + "federationAllowedDomains": { + "type": "string" + }, + "federationBlockedDomains": { + "type": "string" + }, + "federationMode": { + "type": "string", + "enum": [ + "AllowAllExternal", + "AllowSpecificExternal", + "BlockAllExternal", + "BlockSpecificExternal" + ], + "description": "Now build federation configuration parameters" + }, + "meetingChatEnabledType": { + "type": "string" + }, + "policyName": { + "type": "string", + "description": "Assign branding policy to a specific user" + }, + "readReceiptsEnabledType": { + "type": "string" + }, + "section": { + "type": "string", + "enum": [ + "backgrounds", + "client", + "federation", + "meeting", + "messaging" + ] + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Results": { + "x-cipp-field-source": "backend" + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Teams.Group.ReadWrite" + } + }, "/api/EditTenant": { "post": { "summary": "EditTenant", @@ -11089,6 +12106,91 @@ "x-cipp-any-tenant": true } }, + "/api/EditTenantVacationDefaults": { + "post": { + "summary": "EditTenantVacationDefaults", + "operationId": "EditTenantVacationDefaults", + "tags": [ + "Tenant > Administration > Tenant" + ], + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "customerId": { + "type": "string", + "description": "Interact with query parameters or the body of the request." + }, + "defaultDomainName": { + "type": "string" + }, + "vacationDefaults": { + "type": "string" + } + } + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "RowKey": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Value": { + "type": "string", + "x-cipp-field-source": "storage" + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.Config.ReadWrite", + "x-cipp-any-tenant": true + } + }, "/api/EditTransportRule": { "post": { "summary": "EditTransportRule", @@ -11841,6 +12943,267 @@ "x-cipp-role": "Security.Alert.ReadWrite" } }, + "/api/ExecAddCrossTenantPartner": { + "post": { + "summary": "ExecAddCrossTenantPartner", + "operationId": "ExecAddCrossTenantPartner", + "tags": [ + "Tenant > CrossTenant" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "automaticUserConsentSettings": { + "type": "string", + "description": "Add optional automatic user consent" + }, + "b2bCollaborationInbound": { + "type": "string", + "description": "Add optional B2B Collaboration settings" + }, + "b2bCollaborationOutbound": { + "type": "string" + }, + "b2bDirectConnectInbound": { + "type": "string", + "description": "Add optional B2B Direct Connect settings" + }, + "b2bDirectConnectOutbound": { + "type": "string" + }, + "inboundTrust": { + "type": "string", + "description": "Add optional inbound trust settings" + }, + "partnerTenantId": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "partnerTenantId", + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "properties": { + "appServiceConnectInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "automaticUserConsentSettings": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "b2bCollaborationInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "b2bCollaborationOutbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "b2bDirectConnectInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "b2bDirectConnectOutbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "inboundTrust": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "isInMultiTenantOrganization": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isServiceProvider": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "m365CollaborationInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "m365CollaborationOutbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "Metadata": { + "x-cipp-field-source": "backend" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "tenantId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "tenantRestrictions": { + "type": "object", + "x-cipp-field-source": "graph-entity" + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.CrossTenant.ReadWrite" + } + }, + "/api/ExecAddCrossTenantTemplate": { + "post": { + "summary": "ExecAddCrossTenantTemplate", + "operationId": "ExecAddCrossTenantTemplate", + "tags": [ + "Tenant > CrossTenant" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "createdAt": { + "type": "string" + }, + "description": { + "type": "string" + }, + "GUID": { + "type": "string" + }, + "settings": { + "type": "object", + "properties": { + "allowedToSignUpEmailBasedSubscriptions": { + "type": "string" + }, + "allowEmailVerifiedUsersToJoinOrganization": { + "type": "string" + }, + "allowInvitesFrom": { + "type": "string", + "description": "External Collaboration settings" + }, + "automaticUserConsentSettings": { + "type": "string" + }, + "b2bCollaborationInbound": { + "type": "string", + "description": "Cross-Tenant Access Policy defaults" + }, + "b2bCollaborationOutbound": { + "type": "string" + }, + "b2bDirectConnectInbound": { + "type": "string" + }, + "b2bDirectConnectOutbound": { + "type": "string" + }, + "blockMsnSignIn": { + "type": "string" + }, + "domainRestrictions": { + "type": "string", + "description": "Domain restrictions" + }, + "guestUserRoleId": { + "type": "string" + }, + "inboundTrust": { + "type": "string" + }, + "tenantRestrictions": { + "type": "string" + } + }, + "description": "Cross-Tenant Access Policy defaults" + }, + "templateName": { + "type": "string" + } + }, + "required": [ + "templateName" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Metadata": { + "x-cipp-field-source": "backend" + }, + "Results": { + "x-cipp-field-source": "backend" + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.CrossTenant.ReadWrite" + } + }, "/api/ExecAddGDAPRole": { "post": { "summary": "ExecAddGDAPRole", @@ -12549,7 +13912,6 @@ "tags": [ "Security > Incidents" ], - "description": "Lists Microsoft 365 Defender security alerts for a tenant. tenantFilter=AllTenants reads the cached alert table instead of querying each tenant live, so those results are as fresh as the last cache run.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" @@ -12859,7 +14221,7 @@ }, "MCPAllowed": { "type": "string", - "description": "When this client is MCP-enabled it becomes one of the OAuth client apps that AI connectors sign in as. Several MCPAllowed clients may coexist (each with its own role/IP/redirects/CA); the dedicated CIPP-MCP app is the shared protected resource. Configure this client (callbacks, public client flows, resource permissions + consent) and ensure the resource app exists (Set-CIPPMCPClientApp -> New-CIPPMcpResourceApp)." + "description": "When this client is MCP-enabled it becomes one of the OAuth client apps that AI connectors sign in as. Several MCPAllowed clients may coexist (each with its own redirects); the dedicated CIPP-MCP app is the shared protected resource. Configure this client (callbacks, public client flows, resource permissions + consent) and ensure the resource app exists (Set-CIPPMCPClientApp -> New-CIPPMcpResourceApp)." }, "PublicRedirectUris": { "type": "string" @@ -12900,7 +14262,6 @@ "GetMcpAuth", "List", "ListAvailable", - "RepairUri", "ResetSecret", "SaveToAzure", "SetMcpRedirectUris" @@ -13544,6 +14905,116 @@ "x-cipp-role": "Tenant.Application.ReadWrite" } }, + "/api/ExecApplyCrossTenantTemplate": { + "post": { + "summary": "ExecApplyCrossTenantTemplate", + "operationId": "ExecApplyCrossTenantTemplate", + "tags": [ + "Tenant > CrossTenant" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "GUID": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "GUID", + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "ContentHash": { + "x-cipp-field-source": "storage" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "GUID": { + "x-cipp-field-source": "storage" + }, + "JSON": { + "x-cipp-field-source": "storage" + }, + "Package": { + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Permissions": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "SHA": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Source": { + "x-cipp-field-source": "storage" + }, + "SourcePath": { + "x-cipp-field-source": "storage" + }, + "TemplateName": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "UpdatedBy": { + "x-cipp-field-source": "storage" + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.CrossTenant.ReadWrite" + } + }, "/api/ExecAppPermissionTemplate": { "post": { "summary": "ExecAppPermissionTemplate", @@ -15725,12 +17196,18 @@ "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", "properties": { + "Action": { + "x-cipp-field-source": "backend" + }, "resultText": { "x-cipp-field-source": "backend" }, "state": { "type": "string", "x-cipp-field-source": "graph,backend" + }, + "Target": { + "x-cipp-field-source": "backend" } } } @@ -17658,7 +19135,6 @@ "tags": [ "Endpoint > MEM" ], - "description": "Compares an Intune policy against another policy or a stored template and returns the differences setting by setting. Handles device configurations, settings catalog policies, ADMX templates, compliance policies, driver/feature/quality update profiles, intents and app protection policies.", "requestBody": { "required": false, "content": { @@ -18588,6 +20064,165 @@ "x-cipp-any-tenant": true } }, + "/api/ExecCreateSharingLink": { + "post": { + "summary": "ExecCreateSharingLink", + "operationId": "ExecCreateSharingLink", + "tags": [ + "Teams-Sharepoint" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "driveId": { + "type": "string" + }, + "expirationDateTime": { + "type": "string" + }, + "itemId": { + "type": "string" + }, + "linkScope": { + "type": "string", + "enum": [ + "anonymous", + "organization", + "users" + ] + }, + "linkType": { + "type": "string", + "enum": [ + "edit", + "embed", + "view" + ] + }, + "password": { + "type": "string" + }, + "recipients": { + "type": "array", + "items": { + "type": "object", + "properties": { + "email": { + "type": "string" + }, + "value": { + "type": "string" + } + } + } + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "properties": { + "createdBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "createdDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "description": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "driveType": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "eTag": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "lastModifiedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "lastModifiedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "name": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "owner": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "parentReference": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "quota": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "sharePointIds": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "system": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "webUrl": { + "type": "string", + "x-cipp-field-source": "graph-entity" + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Sharepoint.Site.ReadWrite" + } + }, "/api/ExecCreateTAP": { "post": { "summary": "ExecCreateTAP", @@ -19610,6 +21245,67 @@ "x-cipp-any-tenant": true } }, + "/api/ExecDeleteIntegrationApp": { + "post": { + "summary": "ExecDeleteIntegrationApp", + "operationId": "ExecDeleteIntegrationApp", + "tags": [ + "Tenant > Administration > Integration Templates" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "appId": { + "type": "string" + }, + "appObjectId": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.Application.ReadWrite" + } + }, "/api/ExecDeleteSafeLinksPolicy": { "post": { "summary": "ExecDeleteSafeLinksPolicy", @@ -19765,6 +21461,78 @@ "x-cipp-any-tenant": true } }, + "/api/ExecDeployIntegrationApp": { + "post": { + "summary": "ExecDeployIntegrationApp", + "operationId": "ExecDeployIntegrationApp", + "tags": [ + "Tenant > Administration > Integration Templates" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "customizations": { + "type": "object", + "properties": { + "appNamePattern": { + "type": "string" + }, + "secretExpirationDays": { + "type": "string" + } + } + }, + "templateId": { + "type": "string" + }, + "tenants": { + "type": "array", + "items": { + "$ref": "#/components/schemas/LabelValue" + } + } + }, + "required": [ + "templateId" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.Application.ReadWrite" + } + }, "/api/ExecDeviceAction": { "post": { "summary": "ExecDeviceAction", @@ -20258,6 +22026,9 @@ }, "userId": { "type": "string" + }, + "userPrincipalName": { + "type": "string" } }, "required": [ @@ -20286,6 +22057,14 @@ "schema": { "type": "string" } + }, + { + "name": "userPrincipalName", + "in": "query", + "required": false, + "schema": { + "type": "string" + } } ], "responses": { @@ -20420,8 +22199,7 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Domains.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "Tenant.Domains.ReadWrite" } }, "/api/ExecDomainAction": { @@ -20543,12 +22321,12 @@ "x-cipp-any-tenant": true } }, - "/api/ExecDriftClone": { + "/api/ExecDomainMigration": { "post": { - "summary": "ExecDriftClone", - "operationId": "ExecDriftClone", + "summary": "ExecDomainMigration", + "operationId": "ExecDomainMigration", "tags": [ - "Tenant > Standards" + "Identity > Administration > Users" ], "requestBody": { "required": true, @@ -20557,189 +22335,54 @@ "schema": { "type": "object", "properties": { - "id": { - "type": "string" - } - }, - "required": [ - "id" - ] - } - } - } - }, - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", - "properties": { - "Results": { - "x-cipp-field-source": "backend" - }, - "Success": { - "x-cipp-field-source": "backend" - } - } - } - } - } - }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" - }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" - } - }, - "security": [ - { - "bearerAuth": [] - } - ], - "x-cipp-role": "Tenant.Standards.ReadWrite" - } - }, - "/api/ExecDurableFunctions": { - "post": { - "summary": "ExecDurableFunctions", - "operationId": "ExecDurableFunctions", - "tags": [ - "CIPP > Core" - ], - "requestBody": { - "required": false, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": {} - } - } - } - }, - "parameters": [ - { - "name": "Action", - "in": "query", - "required": false, - "schema": { - "type": "string", - "enum": [ - "ListOrchestratorHistory", - "ListOrchestrators", - "ListStats", - "PurgeOrchestrators", - "ResetDurables" - ] - } - }, - { - "name": "PartitionKey", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - } - ], - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", - "properties": { - "Count": { - "x-cipp-field-source": "backend" - }, - "Exception": { - "x-cipp-field-source": "backend" - }, - "Message": { - "x-cipp-field-source": "backend" - }, - "Name": { - "x-cipp-field-source": "backend" - }, - "Orchestrators": { - "x-cipp-field-source": "backend" - }, - "Pending30MinCount": { - "x-cipp-field-source": "backend" - }, - "Queues": { - "x-cipp-field-source": "backend" - }, - "Results": { - "x-cipp-field-source": "backend" + "groups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "displayName": { + "type": "string" + }, + "groupType": { + "type": "string" + }, + "id": { + "type": "string" + }, + "mail": { + "type": "string" + } + } } - } - } - } - } - }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" - }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" - } - }, - "security": [ - { - "bearerAuth": [] - } - ], - "x-cipp-role": "CIPP.AppSettings.ReadWrite" - } - }, - "/api/ExecEditCalendarPermissions": { - "post": { - "summary": "ExecEditCalendarPermissions", - "operationId": "ExecEditCalendarPermissions", - "tags": [ - "Email-Exchange > Administration" - ], - "requestBody": { - "required": true, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "CanViewPrivateItems": { - "type": "string" }, - "FolderName": { + "sourceDomain": { "type": "string" }, - "Permissions": { - "$ref": "#/components/schemas/LabelValue" - }, - "RemoveAccess": { - "$ref": "#/components/schemas/LabelValue" + "targetDomain": { + "type": "string" }, "tenantFilter": { - "type": "string", - "description": "Extract parameters from query or body" - }, - "userid": { "type": "string" }, - "UserToGetPermissions": { - "$ref": "#/components/schemas/LabelValue" + "users": { + "type": "array", + "items": { + "type": "object", + "properties": { + "displayName": { + "type": "string" + }, + "id": { + "type": "string" + }, + "mail": { + "type": "string" + }, + "userPrincipalName": { + "type": "string" + } + } + } } }, "required": [ @@ -20749,59 +22392,6 @@ } } }, - "parameters": [ - { - "name": "CanViewPrivateItems", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "FolderName", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "Permissions", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "RemoveAccess", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - }, - { - "name": "userid", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "UserToGetPermissions", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - } - ], "responses": { "200": { "description": "Success", @@ -20813,6 +22403,9 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -20825,15 +22418,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "Identity.User.ReadWrite" } }, - "/api/ExecEditCAPolicyFull": { + "/api/ExecDriftClone": { "post": { - "summary": "ExecEditCAPolicyFull", - "operationId": "ExecEditCAPolicyFull", + "summary": "ExecDriftClone", + "operationId": "ExecDriftClone", "tags": [ - "Tenant > Conditional" + "Tenant > Standards" ], "requestBody": { "required": true, @@ -20842,49 +22435,33 @@ "schema": { "type": "object", "properties": { - "PolicyBody": { - "type": "object", - "properties": { - "displayName": { - "type": "string" - } - } - }, - "PolicyId": { - "type": "string" - }, - "tenantFilter": { + "id": { "type": "string" } }, "required": [ - "PolicyBody", - "tenantFilter" + "id" ] } } } }, - "parameters": [ - { - "name": "PolicyId", - "in": "query", - "required": true, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - } - ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Results": { + "x-cipp-field-source": "backend" + }, + "Success": { + "x-cipp-field-source": "backend" + } + } } } } @@ -20907,37 +22484,52 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.ConditionalAccess.ReadWrite" + "x-cipp-role": "Tenant.Standards.ReadWrite" } }, - "/api/ExecEditMailboxPermissions": { + "/api/ExecDurableFunctions": { "post": { - "summary": "ExecEditMailboxPermissions", - "operationId": "ExecEditMailboxPermissions", + "summary": "ExecDurableFunctions", + "operationId": "ExecDurableFunctions", "tags": [ - "Email-Exchange > Administration" + "CIPP > Core" ], "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", - "properties": { - "tenantfilter": { - "type": "string" - }, - "userID": { - "type": "string" - } - }, - "required": [ - "tenantfilter" - ] + "properties": {} } } } }, + "parameters": [ + { + "name": "Action", + "in": "query", + "required": false, + "schema": { + "type": "string", + "enum": [ + "ListOrchestratorHistory", + "ListOrchestrators", + "ListStats", + "PurgeOrchestrators", + "ResetDurables" + ] + } + }, + { + "name": "PartitionKey", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], "responses": { "200": { "description": "Success", @@ -20947,6 +22539,27 @@ "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { + "Count": { + "x-cipp-field-source": "backend" + }, + "Exception": { + "x-cipp-field-source": "backend" + }, + "Message": { + "x-cipp-field-source": "backend" + }, + "Name": { + "x-cipp-field-source": "backend" + }, + "Orchestrators": { + "x-cipp-field-source": "backend" + }, + "Pending30MinCount": { + "x-cipp-field-source": "backend" + }, + "Queues": { + "x-cipp-field-source": "backend" + }, "Results": { "x-cipp-field-source": "backend" } @@ -20967,68 +22580,56 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, - "/api/ExecEditTemplate": { + "/api/ExecEdiscoveryCase": { "post": { - "summary": "ExecEditTemplate", - "operationId": "ExecEditTemplate", + "summary": "ExecEdiscoveryCase", + "operationId": "ExecEdiscoveryCase", "tags": [ - "CIPP > Core" + "Security" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "description": { - "type": "string" + "action": { + "type": "string", + "enum": [ + "close", + "create", + "delete", + "reopen", + "update" + ] }, - "displayName": { + "caseId": { "type": "string" }, - "GUID": { + "description": { "type": "string" }, - "id": { + "displayName": { "type": "string" }, - "name": { + "externalId": { "type": "string" }, - "parsedRAWJson": { - "type": "object", - "properties": { - "@odata.type": { - "type": "string" - }, - "settings": { - "type": "string" - } - }, - "description": "Intune identifies a policy and every setting in it by @odata.type, and rejects a policy that is missing them. An editor that rebuilds the body from form state can drop them silently, which stores a template that only fails at deployment time - so refuse the write here rather than let a working template be replaced by one that cannot deploy." - }, - "Type": { + "tenantFilter": { "type": "string" } - } + }, + "required": [ + "tenantFilter" + ] } } } }, - "parameters": [ - { - "name": "Type", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - } - ], "responses": { "200": { "description": "Success", @@ -21036,56 +22637,50 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { - "ContentHash": { - "x-cipp-field-source": "storage" + "closedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "ETag": { + "closedDateTime": { "type": "string", - "x-cipp-field-source": "storage" - }, - "GUID": { - "x-cipp-field-source": "storage" - }, - "JSON": { - "x-cipp-field-source": "storage" - }, - "Package": { - "x-cipp-field-source": "storage" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "Permissions": { + "createdDateTime": { "type": "string", - "x-cipp-field-source": "storage" - }, - "Results": { - "x-cipp-field-source": "backend" + "x-cipp-field-source": "graph-entity" }, - "RowKey": { - "x-cipp-field-source": "storage" + "description": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "SHA": { + "displayName": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "Source": { - "x-cipp-field-source": "storage" + "externalId": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "SourcePath": { - "x-cipp-field-source": "storage" + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "TemplateName": { - "x-cipp-field-source": "storage" + "lastModifiedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "Timestamp": { + "lastModifiedDateTime": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "UpdatedBy": { - "x-cipp-field-source": "storage" + "Results": { + "x-cipp-field-source": "backend" + }, + "status": { + "type": "object", + "x-cipp-field-source": "graph-entity" } } } @@ -21097,6 +22692,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -21104,16 +22702,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "Security.Ediscovery.ReadWrite" } }, - "/api/ExecEmailForward": { + "/api/ExecEdiscoveryCaseExport": { "post": { - "summary": "ExecEmailForward", - "operationId": "ExecEmailForward", + "summary": "ExecEdiscoveryCaseExport", + "operationId": "ExecEdiscoveryCaseExport", "tags": [ - "Email-Exchange > Administration" + "Security" ], "requestBody": { "required": true, @@ -21122,27 +22719,25 @@ "schema": { "type": "object", "properties": { - "ForwardExternal": { + "caseId": { "type": "string" }, - "ForwardInternal": { - "$ref": "#/components/schemas/LabelValue" + "displayName": { + "type": "string" }, - "forwardOption": { - "type": "string", - "enum": [ - "disabled", - "ExternalAddress", - "internalAddress" - ] + "exportCriteria": { + "type": "string" }, - "KeepCopy": { - "type": "boolean" + "exportFormat": { + "type": "string" }, - "tenantFilter": { + "exportLocation": { "type": "string" }, - "userID": { + "searchId": { + "type": "string" + }, + "tenantFilter": { "type": "string" } }, @@ -21159,7 +22754,53 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "properties": { + "closedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "closedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "createdDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "description": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "displayName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "externalId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "lastModifiedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "lastModifiedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "status": { + "type": "object", + "x-cipp-field-source": "graph-entity" + } + } } } } @@ -21179,17 +22820,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "Security.Ediscovery.ReadWrite" } }, - "/api/ExecEmptySiteRecycleBin": { + "/api/ExecEdiscoveryCaseHold": { "post": { - "summary": "ExecEmptySiteRecycleBin", - "operationId": "ExecEmptySiteRecycleBin", + "summary": "ExecEdiscoveryCaseHold", + "operationId": "ExecEdiscoveryCaseHold", "tags": [ - "Teams-Sharepoint" + "Security" ], - "description": "Permanently empty a site recycle bin (first stage, second stage, or both).\nItem ids are used only server-side; the response never includes file names.", "requestBody": { "required": true, "content": { @@ -21197,18 +22837,59 @@ "schema": { "type": "object", "properties": { - "SiteUrl": { + "action": { + "type": "string", + "enum": [ + "create", + "remove", + "update" + ] + }, + "caseId": { "type": "string" }, - "Stage": { + "contentQuery": { + "type": "string" + }, + "description": { + "type": "string" + }, + "displayName": { + "type": "string" + }, + "holdId": { "type": "string" }, + "siteSources": { + "type": "array", + "items": { + "type": "object", + "properties": { + "siteWebUrl": { + "type": "string" + } + } + } + }, "tenantFilter": { "type": "string" + }, + "userSources": { + "type": "array", + "items": { + "type": "object", + "properties": { + "email": { + "type": "string" + }, + "includedSources": { + "type": "string" + } + } + } } }, "required": [ - "SiteUrl", "tenantFilter" ] } @@ -21222,19 +22903,64 @@ "application/json": { "schema": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "properties": { + "closedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "closedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "createdDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "description": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "displayName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "externalId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "lastModifiedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "lastModifiedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "status": { + "type": "object", + "x-cipp-field-source": "graph-entity" + } + } } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -21242,15 +22968,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Sharepoint.SiteRecycleBin.ReadWrite" + "x-cipp-role": "Security.Ediscovery.ReadWrite" } }, - "/api/ExecEnableArchive": { + "/api/ExecEdiscoveryCaseSearch": { "post": { - "summary": "ExecEnableArchive", - "operationId": "ExecEnableArchive", + "summary": "ExecEdiscoveryCaseSearch", + "operationId": "ExecEdiscoveryCaseSearch", "tags": [ - "Email-Exchange > Administration" + "Security" ], "requestBody": { "required": true, @@ -21259,14 +22985,34 @@ "schema": { "type": "object", "properties": { - "id": { + "action": { + "type": "string", + "enum": [ + "create", + "delete", + "estimateStatistics", + "update" + ] + }, + "caseId": { "type": "string" }, - "tenantFilter": { - "type": "string", - "description": "Interact with query parameters or the body of the request." + "contentQuery": { + "type": "string" }, - "username": { + "dataSourceScopes": { + "type": "string" + }, + "description": { + "type": "string" + }, + "displayName": { + "type": "string" + }, + "searchId": { + "type": "string" + }, + "tenantFilter": { "type": "string" } }, @@ -21277,27 +23023,6 @@ } } }, - "parameters": [ - { - "name": "id", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - }, - { - "name": "username", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - } - ], "responses": { "200": { "description": "Success", @@ -21305,10 +23030,50 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { + "closedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "closedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "createdDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "description": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "displayName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "externalId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "lastModifiedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "lastModifiedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, "Results": { "x-cipp-field-source": "backend" + }, + "status": { + "type": "object", + "x-cipp-field-source": "graph-entity" } } } @@ -21330,13 +23095,13 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "Security.Ediscovery.ReadWrite" } }, - "/api/ExecEnableAutoExpandingArchive": { + "/api/ExecEditCalendarPermissions": { "post": { - "summary": "ExecEnableAutoExpandingArchive", - "operationId": "ExecEnableAutoExpandingArchive", + "summary": "ExecEditCalendarPermissions", + "operationId": "ExecEditCalendarPermissions", "tags": [ "Email-Exchange > Administration" ], @@ -21347,15 +23112,27 @@ "schema": { "type": "object", "properties": { - "ID": { - "type": "string", - "description": "Interact with query parameters or the body of the request." + "CanViewPrivateItems": { + "type": "string" }, - "tenantFilter": { + "FolderName": { "type": "string" }, - "username": { + "Permissions": { + "$ref": "#/components/schemas/LabelValue" + }, + "RemoveAccess": { + "$ref": "#/components/schemas/LabelValue" + }, + "tenantFilter": { + "type": "string", + "description": "Extract parameters from query or body" + }, + "userid": { "type": "string" + }, + "UserToGetPermissions": { + "$ref": "#/components/schemas/LabelValue" } }, "required": [ @@ -21365,65 +23142,133 @@ } } }, - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/StandardResults" - } - } + "parameters": [ + { + "name": "CanViewPrivateItems", + "in": "query", + "required": false, + "schema": { + "type": "string" } }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" + { + "name": "FolderName", + "in": "query", + "required": false, + "schema": { + "type": "string" + } }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" + { + "name": "Permissions", + "in": "query", + "required": false, + "schema": { + "type": "string" + } }, - "500": { - "description": "Internal server error" - } - }, - "security": [ { - "bearerAuth": [] - } - ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" - } + "name": "RemoveAccess", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "userid", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "UserToGetPermissions", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.Mailbox.ReadWrite" + } }, - "/api/ExecExchangeRoleRepair": { + "/api/ExecEditCAPolicyFull": { "post": { - "summary": "ExecExchangeRoleRepair", - "operationId": "ExecExchangeRoleRepair", + "summary": "ExecEditCAPolicyFull", + "operationId": "ExecEditCAPolicyFull", "tags": [ - "CIPP > Settings" + "Tenant > Conditional" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "tenantId": { + "PolicyBody": { + "type": "object", + "properties": { + "displayName": { + "type": "string" + } + } + }, + "PolicyId": { + "type": "string" + }, + "tenantFilter": { "type": "string" } - } + }, + "required": [ + "PolicyBody", + "tenantFilter" + ] } } } }, "parameters": [ { - "name": "tenantId", + "name": "PolicyId", "in": "query", - "required": false, + "required": true, "schema": { "type": "string" } + }, + { + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -21432,63 +23277,22 @@ "content": { "application/json": { "schema": { - "type": "object", - "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", - "properties": { - "allowedPrincipalTypes": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "description": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "displayName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "id": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "isBuiltIn": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "isEnabled": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "isPrivileged": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "resourceScopes": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "rolePermissions": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "templateId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "version": { - "type": "string", - "x-cipp-field-source": "graph-entity" - } - } + "$ref": "#/components/schemas/StandardResults" } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -21496,46 +23300,33 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AppSettings.ReadWrite" + "x-cipp-role": "Tenant.ConditionalAccess.ReadWrite" } }, - "/api/ExecExcludeLicenses": { + "/api/ExecEditMailboxPermissions": { "post": { - "summary": "ExecExcludeLicenses", - "operationId": "ExecExcludeLicenses", + "summary": "ExecEditMailboxPermissions", + "operationId": "ExecEditMailboxPermissions", "tags": [ - "CIPP > Settings" + "Email-Exchange > Administration" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "Action": { - "type": "string", - "enum": [ - "AddExclusion", - "AlertOnly", - "RemoveExclusion", - "RestoreDefaults", - "SetShowInDropdown" - ] - }, - "FullReset": { - "type": "boolean" - }, - "GUID": { + "tenantfilter": { "type": "string" }, - "ShowInDropdown": { - "type": "boolean" - }, - "SKUName": { + "userID": { "type": "string" } - } + }, + "required": [ + "tenantfilter" + ] } } } @@ -21547,47 +23338,21 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "ExcludedEverywhere": { - "x-cipp-field-source": "storage" - }, - "GUID": { - "x-cipp-field-source": "storage" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" - }, - "Product_Display_Name": { - "x-cipp-field-source": "storage" - }, - "RowKey": { - "x-cipp-field-source": "storage" - }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" + "Results": { + "x-cipp-field-source": "backend" } } } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -21595,15 +23360,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AppSettings.ReadWrite" + "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecExcludeTenant": { + "/api/ExecEditTemplate": { "post": { - "summary": "ExecExcludeTenant", - "operationId": "ExecExcludeTenant", + "summary": "ExecEditTemplate", + "operationId": "ExecEditTemplate", "tags": [ - "CIPP > Settings" + "CIPP > Core" ], "requestBody": { "required": false, @@ -21612,11 +23377,26 @@ "schema": { "type": "object", "properties": { - "value": { - "type": "array", - "items": { - "type": "string" - } + "description": { + "type": "string" + }, + "displayName": { + "type": "string" + }, + "GUID": { + "type": "string" + }, + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "parsedRAWJson": { + "type": "string" + }, + "Type": { + "type": "string" } } } @@ -21625,39 +23405,12 @@ }, "parameters": [ { - "name": "AddExclusion", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "List", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "ListAll", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "RemoveExclusion", + "name": "Type", "in": "query", "required": false, "schema": { "type": "string" } - }, - { - "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -21667,79 +23420,56 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "customerId": { - "x-cipp-field-source": "storage" - }, - "defaultDomainName": { - "x-cipp-field-source": "storage,frontend" - }, - "delegatedPrivilegeStatus": { - "x-cipp-field-source": "storage,frontend" - }, - "directTenantAuthDate": { - "x-cipp-field-source": "storage" - }, - "directTenantUserPrincipalName": { - "x-cipp-field-source": "storage" - }, - "displayName": { - "x-cipp-field-source": "storage,frontend" - }, - "domains": { + "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, - "Excluded": { - "x-cipp-field-source": "storage,frontend" - }, - "ExcludeDate": { - "x-cipp-field-source": "storage,frontend" - }, - "ExcludeUser": { - "x-cipp-field-source": "storage,frontend" - }, - "hasAutoExtend": { + "GUID": { "x-cipp-field-source": "storage" }, - "initialDomainName": { + "JSON": { "x-cipp-field-source": "storage" }, - "LastGraphError": { + "Package": { "x-cipp-field-source": "storage" }, - "LastGraphTokenError": { + "PartitionKey": { "x-cipp-field-source": "storage" }, - "LastRefresh": { + "Permissions": { + "type": "string", "x-cipp-field-source": "storage" }, - "PartitionKey": { - "x-cipp-field-source": "storage" + "Results": { + "x-cipp-field-source": "backend" }, - "relationshipCount": { + "RowKey": { "x-cipp-field-source": "storage" }, - "relationshipEnd": { + "SHA": { + "type": "string", "x-cipp-field-source": "storage" }, - "RequiresRefresh": { - "type": "boolean", + "Source": { "x-cipp-field-source": "storage" }, - "Results": { - "x-cipp-field-source": "backend" + "SourcePath": { + "x-cipp-field-source": "storage" }, - "RowKey": { + "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" + }, + "UpdatedBy": { + "x-cipp-field-source": "storage" } } } @@ -21758,23 +23488,51 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AppSettings.ReadWrite" + "x-cipp-role": "CIPP.Core.ReadWrite", + "x-cipp-any-tenant": true } }, - "/api/ExecExtensionClearHIBPKey": { + "/api/ExecEmailForward": { "post": { - "summary": "ExecExtensionClearHIBPKey", - "operationId": "ExecExtensionClearHIBPKey", + "summary": "ExecEmailForward", + "operationId": "ExecEmailForward", "tags": [ - "CIPP > Extensions" + "Email-Exchange > Administration" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", - "properties": {} + "properties": { + "ForwardExternal": { + "type": "string" + }, + "ForwardInternal": { + "$ref": "#/components/schemas/LabelValue" + }, + "forwardOption": { + "type": "string", + "enum": [ + "disabled", + "ExternalAddress", + "internalAddress" + ] + }, + "KeepCopy": { + "type": "boolean" + }, + "tenantFilter": { + "type": "string" + }, + "userID": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] } } } @@ -21795,6 +23553,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -21802,132 +23563,81 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Extension.ReadWrite" + "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecExtensionMapping": { + "/api/ExecEmailTroubleshoot": { "post": { - "summary": "ExecExtensionMapping", - "operationId": "ExecExtensionMapping", + "summary": "ExecEmailTroubleshoot", + "operationId": "ExecEmailTroubleshoot", "tags": [ - "CIPP > Extensions" + "Email-Exchange > Tools" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", - "properties": {} - } - } - } - }, - "parameters": [ - { - "name": "AddMapping", - "in": "query", - "description": "AnyTenant: mapping writes wipe and rewrite whole partitions and re-register per-tenant sync tasks, so they require an unrestricted tenant scope", - "required": false, - "schema": { - "type": "string", - "enum": [ - "HaloPSA", - "Hudu", - "HuduFields", - "NinjaOne", - "NinjaOneFields", - "Sherweb" - ] - } - }, - { - "name": "AutoMapping", - "in": "query", - "description": "AnyTenant: mapping writes wipe and rewrite whole partitions and re-register per-tenant sync tasks, so they require an unrestricted tenant scope", - "required": false, - "schema": { - "type": "string", - "enum": [ - "HaloPSA", - "NinjaOne" - ] - } - }, - { - "name": "List", - "in": "query", - "required": false, - "schema": { - "type": "string", - "enum": [ - "HaloPSA", - "HaloPSAFields", - "HaloPSARequestSources", - "Hudu", - "HuduFields", - "NinjaOne", - "NinjaOneFields", - "PWPushFields", - "Sherweb" - ] - } - }, - { - "name": "TicketType", - "in": "query", - "description": "Outcomes and priorities are scoped to a ticket type. The settings page sends the ticket type currently selected in the form so the lists follow the dropdown; without it both fall back to whatever ticket type was last saved. @() on each: PowerShell unrolls single-element output, so a ticket type with one outcome (or a lookup that answers with a single explanatory row) would otherwise serialise as a bare object and break callers that expect a list.", - "required": false, - "schema": { - "type": "string" - } - } - ], - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." - } - } - } - }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" - }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" - } - }, - "security": [ - { - "bearerAuth": [] - } - ], - "x-cipp-role": "CIPP.Extension.ReadWrite", - "x-cipp-any-tenant": true - } - }, - "/api/ExecExtensionNinjaOneQueue": { - "post": { - "summary": "ExecExtensionNinjaOneQueue", - "operationId": "ExecExtensionNinjaOneQueue", - "tags": [ - "CIPP > Extensions" - ], - "requestBody": { - "required": false, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": {} + "properties": { + "days": { + "type": "integer" + }, + "endDate": { + "type": "integer" + }, + "fromIP": { + "type": "string" + }, + "messageId": { + "type": "string" + }, + "policyName": { + "type": "string" + }, + "policyTypes": { + "type": "string" + }, + "quarantineType": { + "type": "string" + }, + "recipient": { + "$ref": "#/components/schemas/LabelValue" + }, + "recipientDomain": { + "type": "string" + }, + "releaseStatus": { + "type": "string" + }, + "sender": { + "$ref": "#/components/schemas/LabelValue" + }, + "senderDomain": { + "type": "string" + }, + "startDate": { + "type": "integer" + }, + "status": { + "$ref": "#/components/schemas/LabelValue" + }, + "subject": { + "type": "string" + }, + "subjectExact": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + }, + "toIP": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] } } } @@ -21941,10 +23651,31 @@ "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "Body": { + "FromIP": { "x-cipp-field-source": "backend" }, - "StatusCode": { + "MessageId": { + "x-cipp-field-source": "backend" + }, + "MessageTraceId": { + "x-cipp-field-source": "backend" + }, + "Received": { + "x-cipp-field-source": "backend" + }, + "RecipientAddress": { + "x-cipp-field-source": "backend" + }, + "SenderAddress": { + "x-cipp-field-source": "backend" + }, + "Status": { + "x-cipp-field-source": "backend" + }, + "Subject": { + "x-cipp-field-source": "backend" + }, + "ToIP": { "x-cipp-field-source": "backend" } } @@ -21964,26 +23695,38 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Extension.ReadWrite" + "x-cipp-role": "Exchange.TransportRule.Read" } }, - "/api/ExecExtensionsConfig": { + "/api/ExecEmptySiteRecycleBin": { "post": { - "summary": "ExecExtensionsConfig", - "operationId": "ExecExtensionsConfig", + "summary": "ExecEmptySiteRecycleBin", + "operationId": "ExecEmptySiteRecycleBin", "tags": [ - "CIPP > Extensions" + "Teams-Sharepoint" ], + "description": "Permanently empty a site recycle bin (first stage, second stage, or both).\nItem ids are used only server-side; the response never includes file names.", "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", - "properties": {}, - "additionalProperties": true, - "x-cipp-passthrough": true, - "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." + "properties": { + "SiteUrl": { + "type": "string" + }, + "Stage": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "SiteUrl", + "tenantFilter" + ] } } } @@ -21994,11 +23737,15 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -22011,46 +23758,55 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Extension.ReadWrite" + "x-cipp-role": "Sharepoint.SiteRecycleBin.ReadWrite" } }, - "/api/ExecExtensionSync": { + "/api/ExecEnableArchive": { "post": { - "summary": "ExecExtensionSync", - "operationId": "ExecExtensionSync", + "summary": "ExecEnableArchive", + "operationId": "ExecEnableArchive", "tags": [ - "CIPP > Extensions" + "Email-Exchange > Administration" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", - "properties": {} + "properties": { + "id": { + "type": "string" + }, + "tenantFilter": { + "type": "string", + "description": "Interact with query parameters or the body of the request." + }, + "username": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] } } } }, "parameters": [ { - "name": "Extension", + "name": "id", "in": "query", "required": false, "schema": { - "type": "string", - "enum": [ - "Gradient", - "Hudu", - "NinjaOne" - ] + "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { - "name": "TenantID", + "name": "username", "in": "query", "required": false, "schema": { @@ -22080,6 +23836,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -22087,35 +23846,99 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Extension.ReadWrite" + "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecExtensionTest": { - "get": { - "summary": "ExecExtensionTest", - "operationId": "ExecExtensionTest", + "/api/ExecEnableAutoExpandingArchive": { + "post": { + "summary": "ExecEnableAutoExpandingArchive", + "operationId": "ExecEnableAutoExpandingArchive", "tags": [ - "CIPP > Extensions" + "Email-Exchange > Administration" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "Interact with query parameters or the body of the request." + }, + "tenantFilter": { + "type": "string" + }, + "username": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.Mailbox.ReadWrite" + } + }, + "/api/ExecExchangeRoleRepair": { + "post": { + "summary": "ExecExchangeRoleRepair", + "operationId": "ExecExchangeRoleRepair", + "tags": [ + "CIPP > Settings" ], - "description": "Tests the stored credentials for a configured third-party integration and reports whether CIPP can connect. extensionName selects which one: HaloPSA, Gradient, NinjaOne, PWPush, Hudu, Sherweb, HIBP or GitHub.", + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "tenantId": { + "type": "string" + } + } + } + } + } + }, "parameters": [ { - "name": "extensionName", + "name": "tenantId", "in": "query", "required": false, "schema": { - "type": "string", - "enum": [ - "CIPP-API", - "GitHub", - "Gradient", - "HaloPSA", - "HIBP", - "Hudu", - "NinjaOne", - "PWPush", - "Sherweb" - ] + "type": "string" } } ], @@ -22126,28 +23949,51 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { - "config": { + "allowedPrincipalTypes": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "description": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "ETag": { + "displayName": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "PartitionKey": { - "x-cipp-field-source": "storage" + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "Results": { - "x-cipp-field-source": "backend" + "isBuiltIn": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" }, - "RowKey": { - "x-cipp-field-source": "storage" + "isEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" }, - "Timestamp": { + "isPrivileged": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "resourceScopes": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "rolePermissions": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "templateId": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" + }, + "version": { + "type": "string", + "x-cipp-field-source": "graph-entity" } } } @@ -22166,19 +24012,18 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Extension.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, - "/api/ExecFeatureFlag": { + "/api/ExecExcludeLicenses": { "post": { - "summary": "ExecFeatureFlag", - "operationId": "ExecFeatureFlag", + "summary": "ExecExcludeLicenses", + "operationId": "ExecExcludeLicenses", "tags": [ - "CIPP > Core" + "CIPP > Settings" ], "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { @@ -22187,21 +24032,26 @@ "Action": { "type": "string", "enum": [ - "Get", - "Set" + "AddExclusion", + "AlertOnly", + "RemoveExclusion", + "RestoreDefaults", + "SetShowInDropdown" ] }, - "Enabled": { + "FullReset": { + "type": "boolean" + }, + "GUID": { "type": "string" }, - "Id": { + "ShowInDropdown": { + "type": "boolean" + }, + "SKUName": { "type": "string" } - }, - "required": [ - "Enabled", - "Id" - ] + } } } } @@ -22213,7 +24063,32 @@ "application/json": { "schema": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "ExcludedEverywhere": { + "x-cipp-field-source": "storage" + }, + "GUID": { + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Product_Display_Name": { + "x-cipp-field-source": "storage" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + } + } } } } @@ -22226,6 +24101,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -22236,12 +24114,12 @@ "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, - "/api/ExecGDAPAccessAssignment": { + "/api/ExecExcludeTenant": { "post": { - "summary": "ExecGDAPAccessAssignment", - "operationId": "ExecGDAPAccessAssignment", + "summary": "ExecExcludeTenant", + "operationId": "ExecExcludeTenant", "tags": [ - "Tenant > GDAP" + "CIPP > Settings" ], "requestBody": { "required": false, @@ -22250,17 +24128,11 @@ "schema": { "type": "object", "properties": { - "Action": { - "type": "string", - "enum": [ - "ResetMappings" - ] - }, - "Id": { - "type": "string" - }, - "RoleTemplateId": { - "type": "string" + "value": { + "type": "array", + "items": { + "type": "string" + } } } } @@ -22269,7 +24141,7 @@ }, "parameters": [ { - "name": "Action", + "name": "AddExclusion", "in": "query", "required": false, "schema": { @@ -22277,12 +24149,31 @@ } }, { - "name": "Id", + "name": "List", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "ListAll", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "RemoveExclusion", "in": "query", "required": false, "schema": { "type": "string" } + }, + { + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -22292,253 +24183,79 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "accessType": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "allowExternalSenders": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" + "customerId": { + "x-cipp-field-source": "storage" }, - "assignedLabels": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "defaultDomainName": { + "x-cipp-field-source": "storage,frontend" }, - "assignedLicenses": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "delegatedPrivilegeStatus": { + "x-cipp-field-source": "storage,frontend" }, - "autoSubscribeNewMembers": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" + "directTenantAuthDate": { + "x-cipp-field-source": "storage" }, - "classification": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "directTenantUserPrincipalName": { + "x-cipp-field-source": "storage" }, - "cloudLicensing": { - "type": "object", - "x-cipp-field-source": "graph-entity" + "displayName": { + "x-cipp-field-source": "storage,frontend" }, - "createdByAppId": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "domains": { + "x-cipp-field-source": "storage" }, - "createdDateTime": { + "ETag": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "storage" }, - "deletedDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "Excluded": { + "x-cipp-field-source": "storage,frontend" }, - "description": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "ExcludeDate": { + "x-cipp-field-source": "storage,frontend" }, - "displayName": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "ExcludeUser": { + "x-cipp-field-source": "storage,frontend" }, - "ETag": { - "type": "string", + "hasAutoExtend": { "x-cipp-field-source": "storage" }, - "expirationDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "groupTypes": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "initialDomainName": { + "x-cipp-field-source": "storage" }, - "hasMembersWithLicenseErrors": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" + "LastGraphError": { + "x-cipp-field-source": "storage" }, - "hideFromAddressLists": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" + "LastGraphTokenError": { + "x-cipp-field-source": "storage" }, - "hideFromOutlookClients": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" + "LastRefresh": { + "x-cipp-field-source": "storage" }, - "id": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "PartitionKey": { + "x-cipp-field-source": "storage" }, - "infoCatalogs": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "relationshipCount": { + "x-cipp-field-source": "storage" }, - "isArchived": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" + "relationshipEnd": { + "x-cipp-field-source": "storage" }, - "isAssignableToRole": { + "RequiresRefresh": { "type": "boolean", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "storage" }, - "isFavorite": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "isManagementRestricted": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "isSubscribedByMail": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "licenseProcessingState": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "mail": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "mailEnabled": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "mailNickname": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "membershipRule": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "membershipRuleProcessingState": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "membershipRuleProcessingStatus": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesDomainName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesExtensionAttributes": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesLastSyncDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesNetBiosName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesProvisioningErrors": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesSamAccountName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesSecurityIdentifier": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesSyncEnabled": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "organizationId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" - }, - "preferredDataLocation": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "preferredLanguage": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "proxyAddresses": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "renewedDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "resourceBehaviorOptions": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "resourceProvisioningOptions": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "RoleMappings": { - "type": "string", - "x-cipp-field-source": "storage" + "Results": { + "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, - "securityEnabled": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "securityIdentifier": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "serviceProvisioningErrors": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "theme": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" - }, - "uniqueName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "unseenConversationsCount": { - "type": "integer", - "x-cipp-field-source": "graph-entity" - }, - "unseenCount": { - "type": "integer", - "x-cipp-field-source": "graph-entity" - }, - "unseenMessagesCount": { - "type": "integer", - "x-cipp-field-source": "graph-entity" - }, - "visibility": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "welcomeMessageEnabled": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "writebackConfiguration": { - "type": "object", - "x-cipp-field-source": "graph-entity" } } } @@ -22557,57 +24274,60 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Relationship.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, - "/api/ExecGDAPInvite": { + "/api/ExecExpirePassword": { "post": { - "summary": "ExecGDAPInvite", - "operationId": "ExecGDAPInvite", + "summary": "ExecExpirePassword", + "operationId": "ExecExpirePassword", "tags": [ - "Tenant > GDAP" + "Identity > Administration > Users" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "Action": { - "type": "string" - }, - "InviteId": { + "displayName": { "type": "string" }, - "Reference": { + "ID": { "type": "string" }, - "roleMappings": { - "type": "object", - "properties": { - "roleDefinitionId": { - "type": "array", - "items": { - "type": "string" - } - } - } + "tenantFilter": { + "type": "string", + "description": "Get parameters from query or body" } - } + }, + "required": [ + "tenantFilter" + ] } } } }, "parameters": [ { - "name": "Action", + "name": "displayName", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } + }, + { + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -22616,58 +24336,14 @@ "content": { "application/json": { "schema": { - "type": "object", - "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", - "properties": { - "accessDetails": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "activatedDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "autoExtendDuration": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "createdDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "customer": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "displayName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "duration": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "endDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "id": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "lastModifiedDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "status": { - "type": "object", - "x-cipp-field-source": "graph-entity" - } - } + "$ref": "#/components/schemas/StandardResults" } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -22680,16 +24356,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Relationship.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "Identity.User.ReadWrite" } }, - "/api/ExecGDAPInviteApproved": { + "/api/ExecExtensionClearHIBPKey": { "post": { - "summary": "ExecGDAPInviteApproved", - "operationId": "ExecGDAPInviteApproved", + "summary": "ExecExtensionClearHIBPKey", + "operationId": "ExecExtensionClearHIBPKey", "tags": [ - "Tenant > GDAP" + "CIPP > Extensions" ], "requestBody": { "required": false, @@ -22708,8 +24383,7 @@ "content": { "application/json": { "schema": { - "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "$ref": "#/components/schemas/StandardResults" } } } @@ -22719,9 +24393,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -22729,16 +24400,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Relationship.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "CIPP.Extension.ReadWrite" } }, - "/api/ExecGDAPRemoveGArole": { + "/api/ExecExtensionMapping": { "post": { - "summary": "ExecGDAPRemoveGArole", - "operationId": "ExecGDAPRemoveGArole", + "summary": "ExecExtensionMapping", + "operationId": "ExecExtensionMapping", "tags": [ - "Tenant > GDAP" + "CIPP > Extensions" ], "requestBody": { "required": false, @@ -22746,19 +24416,62 @@ "application/json": { "schema": { "type": "object", - "properties": { - "GDAPId": { - "type": "string" - } - } + "properties": {} } } } }, "parameters": [ { - "name": "GDAPId", + "name": "AddMapping", + "in": "query", + "description": "AnyTenant: mapping writes wipe and rewrite whole partitions and re-register per-tenant sync tasks, so they require an unrestricted tenant scope", + "required": false, + "schema": { + "type": "string", + "enum": [ + "HaloPSA", + "Hudu", + "HuduFields", + "NinjaOne", + "NinjaOneFields" + ] + } + }, + { + "name": "AutoMapping", + "in": "query", + "description": "AnyTenant: mapping writes wipe and rewrite whole partitions and re-register per-tenant sync tasks, so they require an unrestricted tenant scope", + "required": false, + "schema": { + "type": "string", + "enum": [ + "NinjaOne" + ] + } + }, + { + "name": "List", + "in": "query", + "required": false, + "schema": { + "type": "string", + "enum": [ + "HaloPSA", + "HaloPSAFields", + "HaloPSARequestSources", + "Hudu", + "HuduFields", + "NinjaOne", + "NinjaOneFields", + "PWPushFields" + ] + } + }, + { + "name": "TicketType", "in": "query", + "description": "Outcomes and priorities are scoped to a ticket type. The settings page sends the ticket type currently selected in the form so the lists follow the dropdown; without it both fall back to whatever ticket type was last saved. @() on each: PowerShell unrolls single-element output, so a ticket type with one outcome (or a lookup that answers with a single explanatory row) would otherwise serialise as a bare object and break callers that expect a list.", "required": false, "schema": { "type": "string" @@ -22772,51 +24485,62 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "CIPP.Extension.ReadWrite", + "x-cipp-any-tenant": true + } + }, + "/api/ExecExtensionNinjaOneQueue": { + "post": { + "summary": "ExecExtensionNinjaOneQueue", + "operationId": "ExecExtensionNinjaOneQueue", + "tags": [ + "CIPP > Extensions" + ], + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": {} + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "accessDetails": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "activatedDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "autoExtendDuration": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "createdDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "customer": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "displayName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "duration": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "endDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "id": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "lastModifiedDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "Body": { + "x-cipp-field-source": "backend" }, - "status": { - "type": "object", - "x-cipp-field-source": "graph-entity" + "StatusCode": { + "x-cipp-field-source": "backend" } } } @@ -22835,16 +24559,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Relationship.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "CIPP.Extension.ReadWrite" } }, - "/api/ExecGDAPRepairRoleMappings": { + "/api/ExecExtensionsConfig": { "post": { - "summary": "ExecGDAPRepairRoleMappings", - "operationId": "ExecGDAPRepairRoleMappings", + "summary": "ExecExtensionsConfig", + "operationId": "ExecExtensionsConfig", "tags": [ - "Tenant > GDAP" + "CIPP > Extensions" ], "requestBody": { "required": false, @@ -22852,7 +24575,10 @@ "application/json": { "schema": { "type": "object", - "properties": {} + "properties": {}, + "additionalProperties": true, + "x-cipp-passthrough": true, + "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } @@ -22880,16 +24606,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Relationship.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "CIPP.Extension.ReadWrite" } }, - "/api/ExecGDAPRoleTemplate": { + "/api/ExecExtensionSync": { "post": { - "summary": "ExecGDAPRoleTemplate", - "operationId": "ExecGDAPRoleTemplate", + "summary": "ExecExtensionSync", + "operationId": "ExecExtensionSync", "tags": [ - "Tenant > GDAP" + "CIPP > Extensions" ], "requestBody": { "required": false, @@ -22897,63 +24622,30 @@ "application/json": { "schema": { "type": "object", - "properties": { - "CustomSuffix": { - "type": "string" - }, - "GroupId": { - "type": "string" - }, - "NewRoles": { - "type": "string" - }, - "OriginalTemplateId": { - "type": "string", - "description": "Use OriginalTemplateId if provided (for rename), otherwise use TemplateId" - }, - "RoleMappings": { - "type": "array", - "items": { - "type": "object", - "properties": { - "GroupId": { - "type": "array", - "items": { - "type": "string" - } - }, - "roleDefinitionId": { - "type": "string" - } - } - } - }, - "TemplateId": { - "type": "string", - "description": "Template-first save: creates any group mappings the editor asked for, then writes the full mapping set to the template in one shot." - } - } + "properties": {} } } } }, "parameters": [ { - "name": "Action", + "name": "Extension", "in": "query", "required": false, "schema": { "type": "string", "enum": [ - "Add", - "Delete", - "Edit", - "Save" + "Gradient", + "Hudu", + "NinjaOne" ] } }, { - "name": "TemplateId", + "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "TenantID", "in": "query", "required": false, "schema": { @@ -22968,34 +24660,10 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "GroupMappings": { - "x-cipp-field-source": "frontend" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" - }, - "RoleMappings": { - "type": "string", - "x-cipp-field-source": "storage,backend" - }, - "Roles": { - "x-cipp-field-source": "frontend" - }, - "RowKey": { - "x-cipp-field-source": "storage" - }, - "TemplateId": { - "x-cipp-field-source": "backend,frontend" - }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" + "Results": { + "x-cipp-field-source": "backend" } } } @@ -23014,31 +24682,33 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Relationship.ReadWrite", - "x-cipp-any-tenant": true, - "x-cipp-reads-via": [ - "Add-CIPPGDAPRoleTemplate" - ] + "x-cipp-role": "CIPP.Extension.ReadWrite" } }, - "/api/ExecGDAPTrace": { + "/api/ExecExtensionTest": { "get": { - "summary": "Tests the complete GDAP (Granular Delegated Admin Privileges) access path for a user.\n\nThis function traces the access path from customer tenant → GDAP relationships → mapped security groups → user,\nchecking all 15 standard GDAP roles. It verifies whether a SAM user in the partner tenant has access to each\nrole through direct or nested group memberships across all active GDAP relationships for a customer tenant.\n\nThe function returns a role-centric view showing:\n- For each of the 15 GDAP roles: whether it's assigned, whether the user has access, and the complete path\n- Complete traceability: Role → Relationship → Group → User (including nested group paths)\n- Broken path detection: identifies roles assigned but user not a member of the required groups\n\nThe output is structured as JSON suitable for diagram visualization, showing the complete access chain\nregardless of which relationship provides each role.\n\nVery boilerplate AI code. Needs some simplification and cleanup.\nRidiculous amount of comments to explain the logic so I don't have to explain it to Claude on the frontend. - rvd", - "operationId": "ExecGDAPTrace", + "summary": "ExecExtensionTest", + "operationId": "ExecExtensionTest", "tags": [ - "CIPP > Settings" + "CIPP > Extensions" ], - "description": "GDAP Access Path Testing:\n1. Validates input parameters (TenantFilter and UPN)\n2. Retrieves customer tenant information\n3. Gets all active GDAP relationships for the customer tenant\n4. Locates the UPN in the partner tenant\n5. Gets user's transitive group memberships (handles nested groups automatically)\n6. For each GDAP relationship:\n - Retrieves all access assignments (mapped security groups)\n - For each group: checks user membership (direct or nested) and traces the path\n - Maps roles to relationships and groups\n7. For each of the 15 GDAP roles:\n - Finds all relationships/groups that have this role assigned\n - Checks if user is a member of any group with this role\n - Builds complete access path showing how user gets the role (if they do)\n8. Returns comprehensive JSON with role-centric view and complete path traces", "parameters": [ { - "$ref": "#/components/parameters/tenantFilter" - }, - { - "name": "UPN", + "name": "extensionName", "in": "query", - "required": true, + "required": false, "schema": { - "type": "string" + "type": "string", + "enum": [ + "CIPP-API", + "GitHub", + "Gradient", + "HaloPSA", + "HIBP", + "Hudu", + "NinjaOne", + "PWPush" + ] } } ], @@ -23049,69 +24719,39 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "relationships": { - "x-cipp-field-source": "backend" - }, - "roles": { - "x-cipp-field-source": "backend" - }, - "rolesAssignedButNoAccess": { - "x-cipp-field-source": "backend" - }, - "rolesInRelationshipButNotAssigned": { - "x-cipp-field-source": "backend" - }, - "rolesNotInAnyRelationship": { - "x-cipp-field-source": "backend" - }, - "rolesWithAccess": { - "x-cipp-field-source": "backend" - }, - "summary": { - "x-cipp-field-source": "backend" - }, - "tenantId": { - "x-cipp-field-source": "backend" - }, - "tenantName": { - "x-cipp-field-source": "backend" + "config": { + "type": "string", + "x-cipp-field-source": "storage" }, - "totalRelationships": { - "x-cipp-field-source": "backend" + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" }, - "totalRoles": { - "x-cipp-field-source": "backend" + "PartitionKey": { + "x-cipp-field-source": "storage" }, - "userDisplayName": { + "Results": { "x-cipp-field-source": "backend" }, - "userId": { - "x-cipp-field-source": "backend" + "RowKey": { + "x-cipp-field-source": "storage" }, - "userUPN": { - "x-cipp-field-source": "backend" + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" } } } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "404": { - "description": "Not found" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -23119,15 +24759,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AppSettings.Read" + "x-cipp-role": "CIPP.Extension.Read", + "x-cipp-any-tenant": true } }, - "/api/ExecGenerateReportBuilderReport": { + "/api/ExecFeatureFlag": { "post": { - "summary": "ExecGenerateReportBuilderReport", - "operationId": "ExecGenerateReportBuilderReport", + "summary": "ExecFeatureFlag", + "operationId": "ExecFeatureFlag", "tags": [ - "Tools > Report-Builder" + "CIPP > Core" ], "requestBody": { "required": true, @@ -23137,45 +24778,27 @@ "type": "object", "properties": { "Action": { - "type": "string" - }, - "Blocks": { - "type": "string" - }, - "ReportGUID": { - "type": "string" - }, - "TemplateGUID": { - "type": "string" + "type": "string", + "enum": [ + "Get", + "Set" + ] }, - "TemplateName": { + "Enabled": { "type": "string" }, - "TenantFilter": { + "Id": { "type": "string" } }, "required": [ - "ReportGUID", - "TenantFilter" + "Enabled", + "Id" ] } } } }, - "parameters": [ - { - "name": "TemplateName", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - } - ], "responses": { "200": { "description": "Success", @@ -23203,17 +24826,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.ReportBuilder.ReadWrite" + "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, - "/api/ExecGeoIPLookup": { + "/api/ExecGDAPAccessAssignment": { "post": { - "summary": "ExecGeoIPLookup", - "operationId": "ExecGeoIPLookup", + "summary": "ExecGDAPAccessAssignment", + "operationId": "ExecGDAPAccessAssignment", "tags": [ - "CIPP > Core" + "Tenant > GDAP" ], - "description": "Resolves a single IP address to its geographic location using CIPP's bundled GeoIP database.", "requestBody": { "required": false, "content": { @@ -23221,7 +24843,16 @@ "schema": { "type": "object", "properties": { - "IP": { + "Action": { + "type": "string", + "enum": [ + "ResetMappings" + ] + }, + "Id": { + "type": "string" + }, + "RoleTemplateId": { "type": "string" } } @@ -23231,7 +24862,15 @@ }, "parameters": [ { - "name": "IP", + "name": "Action", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "Id", "in": "query", "required": false, "schema": { @@ -23246,7 +24885,255 @@ "application/json": { "schema": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "properties": { + "accessType": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "allowExternalSenders": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "assignedLabels": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "assignedLicenses": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "autoSubscribeNewMembers": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "classification": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "cloudLicensing": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "createdByAppId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "createdDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "deletedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "description": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "displayName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "expirationDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "groupTypes": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "hasMembersWithLicenseErrors": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "hideFromAddressLists": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "hideFromOutlookClients": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "infoCatalogs": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "isArchived": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isAssignableToRole": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isFavorite": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isManagementRestricted": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isSubscribedByMail": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "licenseProcessingState": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "mail": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "mailEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "mailNickname": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "membershipRule": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "membershipRuleProcessingState": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "membershipRuleProcessingStatus": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesDomainName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesExtensionAttributes": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesLastSyncDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesNetBiosName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesProvisioningErrors": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSamAccountName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSecurityIdentifier": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSyncEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "organizationId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "preferredDataLocation": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "preferredLanguage": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "proxyAddresses": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "renewedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "resourceBehaviorOptions": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "resourceProvisioningOptions": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "RoleMappings": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "securityEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "securityIdentifier": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "serviceProvisioningErrors": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "theme": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "uniqueName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "unseenConversationsCount": { + "type": "integer", + "x-cipp-field-source": "graph-entity" + }, + "unseenCount": { + "type": "integer", + "x-cipp-field-source": "graph-entity" + }, + "unseenMessagesCount": { + "type": "integer", + "x-cipp-field-source": "graph-entity" + }, + "visibility": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "welcomeMessageEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "writebackConfiguration": { + "type": "object", + "x-cipp-field-source": "graph-entity" + } + } } } } @@ -23263,73 +25150,57 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.Read", + "x-cipp-role": "Tenant.Relationship.ReadWrite", "x-cipp-any-tenant": true } }, - "/api/ExecGetBaselineWhatIfReportPdf": { + "/api/ExecGDAPInvite": { "post": { - "summary": "ExecGetBaselineWhatIfReportPdf", - "operationId": "ExecGetBaselineWhatIfReportPdf", + "summary": "ExecGDAPInvite", + "operationId": "ExecGDAPInvite", "tags": [ - "Tenant > Standards" + "Tenant > GDAP" ], - "description": "Server-renders the Security Baseline report for a tenant as application/pdf bytes: where the\nassigned baselines stand today, what is already in place, the Conditional Access and Intune\npolicies and the settings the baseline will change (what each does, its value today, the value\nit will be set to and why), the rollout waves still to come and the agreed exceptions - plus,\noptionally, everything one or more simulated (not yet assigned) baselines would add. Reads the\nsame alignment, baseline and catalog data the Baselines page shows, composes it through the\nshared CIPPSharp component kit (Build-CippBaselineWhatIfReportTree) and returns the finished\nPDF. Nothing is changed by producing it.", "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { - "brandingPresetId": { - "type": "string", - "description": "Optional. The branding preset to render with; an unknown id falls back to the default branding." + "Action": { + "type": "string" }, - "sectionConfig": { + "InviteId": { + "type": "string" + }, + "Reference": { + "type": "string" + }, + "roleMappings": { "type": "object", "properties": { - "alreadyAligned": { - "type": "string", - "description": "Optional. Show the \"What Is Already In Place\" page (deployed policies and enforced settings, with their values). A boolean; defaults to true." - }, - "rolloutStages": { - "type": "string", - "description": "Optional. Show the \"How The Rollout Works\" section (the remaining waves and when they arrive). A boolean; defaults to true." + "roleDefinitionId": { + "type": "array", + "items": { + "type": "string" + } } - }, - "description": "Optional. Show the \"What Is Already In Place\" page (deployed policies and enforced settings, with their values). A boolean; defaults to true." - }, - "simulatedTemplateIds": { - "type": "array", - "items": { - "type": "string" } - }, - "tenantFilter": { - "type": "string", - "description": "Required. The tenant (default domain) to report on." } - }, - "required": [ - "tenantFilter" - ] + } } } } }, "parameters": [ { - "name": "brandingPresetId", + "name": "Action", "in": "query", - "description": "Optional. The branding preset to render with; an unknown id falls back to the default branding.", "required": false, "schema": { "type": "string" } - }, - { - "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -23339,70 +25210,62 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { - "ContentHash": { - "x-cipp-field-source": "storage" + "accessDetails": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "ETag": { + "activatedDateTime": { "type": "string", - "x-cipp-field-source": "storage" - }, - "GUID": { - "x-cipp-field-source": "storage" - }, - "JSON": { - "x-cipp-field-source": "storage" - }, - "Package": { - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "PartitionKey": { - "x-cipp-field-source": "storage" + "autoExtendDuration": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "Permissions": { + "createdDateTime": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "RowKey": { - "x-cipp-field-source": "storage" + "customer": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "SHA": { + "displayName": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "Source": { - "x-cipp-field-source": "storage" + "duration": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "SourcePath": { - "x-cipp-field-source": "storage" + "endDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "TemplateName": { - "x-cipp-field-source": "storage" + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "Timestamp": { + "lastModifiedDateTime": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "UpdatedBy": { - "x-cipp-field-source": "storage" + "status": { + "type": "object", + "x-cipp-field-source": "graph-entity" } } } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -23410,101 +25273,28 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Baselines.Read" + "x-cipp-role": "Tenant.Relationship.ReadWrite", + "x-cipp-any-tenant": true } }, - "/api/ExecGetBecReportPdf": { + "/api/ExecGDAPInviteApproved": { "post": { - "summary": "ExecGetBecReportPdf", - "operationId": "ExecGetBecReportPdf", + "summary": "ExecGDAPInviteApproved", + "operationId": "ExecGDAPInviteApproved", "tags": [ - "Identity > Administration > Users" + "Tenant > GDAP" ], - "description": "Server-renders a stored Business Email Compromise (BEC) run as application/pdf bytes. Reads the\nrun through Get-CIPPBecReport (the BecReports metadata row plus its BecResults payload) and\ncomposes it through the shared CIPPSharp component kit (Build-CippBecReportTree) - the server-side\nreplacement for the client react-pdf BECRemediationReportButton. A run is named by its caseId;\npass userId instead to render the user's newest completed run. The run must have completed - the\nreport reads its stored result, it does not trigger a new investigation.", "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", - "properties": { - "caseId": { - "type": "string", - "description": "The stored run to render. A caseId names it directly; a userId picks the user's newest completed run." - }, - "tenantFilter": { - "type": "string" - }, - "userDisplayName": { - "type": "string", - "description": "The investigated user labels the cover and footer; the run stored who it was for." - }, - "userId": { - "type": "string" - }, - "userName": { - "type": "string" - }, - "variant": { - "type": "string", - "description": "'full' (default) = every page; 'summary' = the executive lead only, for a C-suite reader" - } - }, - "required": [ - "tenantFilter" - ] + "properties": {} } } } }, - "parameters": [ - { - "name": "caseId", - "in": "query", - "description": "The stored run to render. A caseId names it directly; a userId picks the user's newest completed run.", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - }, - { - "name": "userDisplayName", - "in": "query", - "description": "The investigated user labels the cover and footer; the run stored who it was for.", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "userId", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "userName", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "variant", - "in": "query", - "description": "'full' (default) = every page; 'summary' = the executive lead only, for a C-suite reader", - "required": false, - "schema": { - "type": "string" - } - } - ], "responses": { "200": { "description": "Success", @@ -23517,18 +25307,12 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, - "404": { - "description": "Not found" - }, "500": { "description": "Internal server error" } @@ -23538,54 +25322,40 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.Read" + "x-cipp-role": "Tenant.Relationship.ReadWrite", + "x-cipp-any-tenant": true } }, - "/api/ExecGetExecutiveReportPdf": { + "/api/ExecGDAPRemoveGArole": { "post": { - "summary": "ExecGetExecutiveReportPdf", - "operationId": "ExecGetExecutiveReportPdf", + "summary": "ExecGDAPRemoveGArole", + "operationId": "ExecGDAPRemoveGArole", "tags": [ - "Tenant > Standards" + "Tenant > GDAP" ], - "description": "Server-renders the Executive Summary report as application/pdf bytes. Every figure is read from the\nnightly Reporting DB cache via New-CIPPDbRequest (Users/Guests/Roles for the environment overview,\nLicenseOverview, ManagedDevices, ConditionalAccessPolicies and SecureScore) plus the standards\ncomparison from the CippStandardsReports table resolved against the standards catalog - the same\ncached data the rest of CIPP reports from, with no live Graph or cross-endpoint HTTP calls. The\nshaped data is composed through the shared CIPPSharp component kit (Build-CippExecutiveReportTree),\nthe server-side replacement for the client react-pdf ExecutiveReportButton. Each source is gathered\ndefensively: a source with no cached data simply drops its section.", "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { - "brandingPresetId": { - "type": "string", - "description": "The branding preset a caller picked for this render, else the global branding settings." - }, - "sectionConfig": { - "type": "string" - }, - "tenantFilter": { + "GDAPId": { "type": "string" } - }, - "required": [ - "tenantFilter" - ] + } } } } }, "parameters": [ { - "name": "brandingPresetId", + "name": "GDAPId", "in": "query", - "description": "The branding preset a caller picked for this render, else the global branding settings.", "required": false, "schema": { "type": "string" } - }, - { - "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -23595,22 +25365,62 @@ "application/json": { "schema": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "properties": { + "accessDetails": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "activatedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "autoExtendDuration": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "createdDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "customer": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "displayName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "duration": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "endDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "lastModifiedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "status": { + "type": "object", + "x-cipp-field-source": "graph-entity" + } + } } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -23618,183 +25428,44 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Standards.Read" + "x-cipp-role": "Tenant.Relationship.ReadWrite", + "x-cipp-any-tenant": true } }, - "/api/ExecGetLicenseReportPdf": { + "/api/ExecGDAPRepairRoleMappings": { "post": { - "summary": "ExecGetLicenseReportPdf", - "operationId": "ExecGetLicenseReportPdf", + "summary": "ExecGDAPRepairRoleMappings", + "operationId": "ExecGDAPRepairRoleMappings", "tags": [ - "Tenant > Reports" + "Tenant > GDAP" ], - "description": "Server-renders the License Optimisation report as application/pdf bytes. Runs the same license\nrecommendation analysis the License Optimization page reads through ListLicenseRecommendations\n(Get-CIPPLicenseRecommendation, with the page's currency, thresholds and recommendation switches)\nand composes it through the shared CIPPSharp kit (Build-CippLicenseReportTree) - the server-side\nreplacement for the client react-pdf LicenseReportButton.", "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", - "properties": { - "brandingPresetId": { - "type": "string", - "description": "The branding preset to render against (the Licensing Report default from the branding settings), else the global branding." - }, - "currency": { - "type": "string", - "description": "Currency the money figures are resolved in: a three-letter ISO code such as USD or EUR. Defaults to USD." - }, - "inactiveDays": { - "type": "string", - "description": "Days without a sign-in after which a licensed person counts as inactive (1-365). Defaults to 90." - }, - "protectSecurityFeatures": { - "type": "string" - }, - "recommendDowngrades": { - "type": "string" - }, - "recommendTerms": { - "type": "string" - }, - "recommendUpgrades": { - "type": "string" - }, - "sections": { - "type": "object", - "properties": { - "downgrades": { - "type": "boolean" - }, - "method": { - "type": "boolean" - }, - "reclaim": { - "type": "boolean" - }, - "spend": { - "type": "boolean" - }, - "terms": { - "type": "boolean" - }, - "upgrades": { - "type": "boolean" - } - } - }, - "tenantFilter": { - "type": "string", - "description": "The tenant to report on. A single tenant; AllTenants is not supported." - }, - "tenureMonths": { - "type": "string", - "description": "Months a seat must have been held by the same person to count as stable for a yearly commitment (1-36). Defaults to 6." - } - }, - "required": [ - "tenantFilter" - ] + "properties": {} } } } }, - "parameters": [ - { - "name": "brandingPresetId", - "in": "query", - "description": "The branding preset to render against (the Licensing Report default from the branding settings), else the global branding.", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "currency", - "in": "query", - "description": "Currency the money figures are resolved in: a three-letter ISO code such as USD or EUR. Defaults to USD.", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "inactiveDays", - "in": "query", - "description": "Days without a sign-in after which a licensed person counts as inactive (1-365). Defaults to 90.", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "protectSecurityFeatures", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "recommendDowngrades", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "recommendTerms", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "recommendUpgrades", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - }, - { - "name": "tenureMonths", - "in": "query", - "description": "Months a seat must have been held by the same person to count as stable for a yearly commitment (1-36). Defaults to 6.", - "required": false, - "schema": { - "type": "string" - } - } - ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { - "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "$ref": "#/components/schemas/StandardResults" } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -23802,38 +25473,87 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Directory.Read" + "x-cipp-role": "Tenant.Relationship.ReadWrite", + "x-cipp-any-tenant": true } }, - "/api/ExecGetLocalAdminPassword": { + "/api/ExecGDAPRoleTemplate": { "post": { - "summary": "ExecGetLocalAdminPassword", - "operationId": "ExecGetLocalAdminPassword", + "summary": "ExecGDAPRoleTemplate", + "operationId": "ExecGDAPRoleTemplate", "tags": [ - "Endpoint > MEM" + "Tenant > GDAP" ], - "description": "Retrieves the Windows LAPS local administrator password for a device, identified by its Entra device GUID. Returns a live credential in plain text; the retrieval is written to the CIPP audit log.", "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { - "guid": { + "CustomSuffix": { "type": "string" }, - "TenantFilter": { + "GroupId": { "type": "string" + }, + "NewRoles": { + "type": "string" + }, + "OriginalTemplateId": { + "type": "string", + "description": "Use OriginalTemplateId if provided (for rename), otherwise use TemplateId" + }, + "RoleMappings": { + "type": "array", + "items": { + "type": "object", + "properties": { + "GroupId": { + "type": "array", + "items": { + "type": "string" + } + }, + "roleDefinitionId": { + "type": "string" + } + } + } + }, + "TemplateId": { + "type": "string", + "description": "Template-first save: creates any group mappings the editor asked for, then writes the full mapping set to the template in one shot." } - }, - "required": [ - "TenantFilter" - ] + } } } } }, + "parameters": [ + { + "name": "Action", + "in": "query", + "required": false, + "schema": { + "type": "string", + "enum": [ + "Add", + "Delete", + "Edit", + "Save" + ] + } + }, + { + "name": "TemplateId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], "responses": { "200": { "description": "Success", @@ -23841,10 +25561,34 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "Results": { - "x-cipp-field-source": "backend" + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "GroupMappings": { + "x-cipp-field-source": "frontend" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "RoleMappings": { + "type": "string", + "x-cipp-field-source": "storage,backend" + }, + "Roles": { + "x-cipp-field-source": "frontend" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "TemplateId": { + "x-cipp-field-source": "backend,frontend" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" } } } @@ -23863,47 +25607,32 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.Device.Read" + "x-cipp-role": "Tenant.Relationship.ReadWrite", + "x-cipp-any-tenant": true, + "x-cipp-reads-via": [ + "Add-CIPPGDAPRoleTemplate" + ] } }, - "/api/ExecGetMailFlowReportPdf": { - "post": { - "summary": "ExecGetMailFlowReportPdf", - "operationId": "ExecGetMailFlowReportPdf", + "/api/ExecGDAPTrace": { + "get": { + "summary": "Tests the complete GDAP (Granular Delegated Admin Privileges) access path for a user.\n\nThis function traces the access path from customer tenant → GDAP relationships → mapped security groups → user,\nchecking all 15 standard GDAP roles. It verifies whether a SAM user in the partner tenant has access to each\nrole through direct or nested group memberships across all active GDAP relationships for a customer tenant.\n\nThe function returns a role-centric view showing:\n- For each of the 15 GDAP roles: whether it's assigned, whether the user has access, and the complete path\n- Complete traceability: Role → Relationship → Group → User (including nested group paths)\n- Broken path detection: identifies roles assigned but user not a member of the required groups\n\nThe output is structured as JSON suitable for diagram visualization, showing the complete access chain\nregardless of which relationship provides each role.\n\nVery boilerplate AI code. Needs some simplification and cleanup.\nRidiculous amount of comments to explain the logic so I don't have to explain it to Claude on the frontend. - rvd", + "operationId": "ExecGDAPTrace", "tags": [ - "Email-Exchange > Reports" + "CIPP > Settings" ], - "description": "Server-renders the Exchange mail flow report as application/pdf bytes. Reads the same three Exchange\nreports the Mail Flow page uses (Get-MailFlowStatusReport plus the TopMailSender and\nTopSpamRecipient traffic summaries), aggregates the daily disposition rows the way the page does,\nand composes them through the shared CIPPSharp kit (Build-CippMailFlowReportTree) - the server-side\nreplacement for the client react-pdf MailFlowReportButton.", - "requestBody": { - "required": true, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "tenantFilter": { - "type": "string" - } - }, - "required": [ - "tenantFilter" - ] - } - } - } - }, + "description": "GDAP Access Path Testing:\n1. Validates input parameters (TenantFilter and UPN)\n2. Retrieves customer tenant information\n3. Gets all active GDAP relationships for the customer tenant\n4. Locates the UPN in the partner tenant\n5. Gets user's transitive group memberships (handles nested groups automatically)\n6. For each GDAP relationship:\n - Retrieves all access assignments (mapped security groups)\n - For each group: checks user membership (direct or nested) and traces the path\n - Maps roles to relationships and groups\n7. For each of the 15 GDAP roles:\n - Finds all relationships/groups that have this role assigned\n - Checks if user is a member of any group with this role\n - Builds complete access path showing how user gets the role (if they do)\n8. Returns comprehensive JSON with role-centric view and complete path traces", "parameters": [ { - "name": "days", + "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "UPN", "in": "query", - "description": "Reporting window in days (1-90).", - "required": false, + "required": true, "schema": { "type": "string" } - }, - { - "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -23913,7 +25642,51 @@ "application/json": { "schema": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "relationships": { + "x-cipp-field-source": "backend" + }, + "roles": { + "x-cipp-field-source": "backend" + }, + "rolesAssignedButNoAccess": { + "x-cipp-field-source": "backend" + }, + "rolesInRelationshipButNotAssigned": { + "x-cipp-field-source": "backend" + }, + "rolesNotInAnyRelationship": { + "x-cipp-field-source": "backend" + }, + "rolesWithAccess": { + "x-cipp-field-source": "backend" + }, + "summary": { + "x-cipp-field-source": "backend" + }, + "tenantId": { + "x-cipp-field-source": "backend" + }, + "tenantName": { + "x-cipp-field-source": "backend" + }, + "totalRelationships": { + "x-cipp-field-source": "backend" + }, + "totalRoles": { + "x-cipp-field-source": "backend" + }, + "userDisplayName": { + "x-cipp-field-source": "backend" + }, + "userId": { + "x-cipp-field-source": "backend" + }, + "userUPN": { + "x-cipp-field-source": "backend" + } + } } } } @@ -23927,6 +25700,9 @@ "403": { "description": "Forbidden - caller lacks the required RBAC role" }, + "404": { + "description": "Not found" + }, "500": { "description": "Internal server error" } @@ -23936,17 +25712,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.Read" + "x-cipp-role": "CIPP.AppSettings.Read" } }, - "/api/ExecGetPermissionsReportPdf": { + "/api/ExecGenerateReportBuilderReport": { "post": { - "summary": "ExecGetPermissionsReportPdf", - "operationId": "ExecGetPermissionsReportPdf", + "summary": "ExecGenerateReportBuilderReport", + "operationId": "ExecGenerateReportBuilderReport", "tags": [ - "Teams-Sharepoint" + "Tools > Report-Builder" ], - "description": "Server-renders the SharePoint Permissions report as application/pdf bytes. Gathers the same shaped\ndata the Permissions page uses (ListSharePointPermissions, from the CIPP reporting cache), composes\nit through the shared CIPPSharp component kit (Build-CippPermissionsReportTree) and returns the\nfinished PDF - the server-side replacement for the client react-pdf PermissionsReportButton.", "requestBody": { "required": true, "content": { @@ -23954,18 +25729,42 @@ "schema": { "type": "object", "properties": { - "tenantFilter": { + "Action": { + "type": "string" + }, + "Blocks": { + "type": "string" + }, + "ReportGUID": { + "type": "string" + }, + "TemplateGUID": { + "type": "string" + }, + "TemplateName": { + "type": "string" + }, + "TenantFilter": { "type": "string" } }, "required": [ - "tenantFilter" + "ReportGUID", + "TenantFilter" ] } } } }, "parameters": [ + { + "name": "TemplateName", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, { "$ref": "#/components/parameters/tenantFilter" } @@ -23990,9 +25789,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -24000,111 +25796,36 @@ "bearerAuth": [] } ], - "x-cipp-role": "Sharepoint.Site.Read" + "x-cipp-role": "CIPP.ReportBuilder.ReadWrite" } }, - "/api/ExecGetRecoveryKey": { + "/api/ExecGeoIPLookup": { "post": { - "summary": "ExecGetRecoveryKey", - "operationId": "ExecGetRecoveryKey", + "summary": "ExecGeoIPLookup", + "operationId": "ExecGeoIPLookup", "tags": [ - "Endpoint > MEM" + "CIPP > Core" ], - "description": "Retrieves a device's disk encryption recovery key by device GUID. RecoveryKeyType selects BitLocker (the default) or FileVault. Returns a live recovery key in plain text; the retrieval is written to the CIPP audit log.", + "description": "Resolves a single IP address to its geographic location using CIPP's bundled GeoIP database.", "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { - "GUID": { + "IP": { "type": "string" - }, - "RecoveryKeyType": { - "type": "string", - "enum": [ - "BiosPassword", - "BitLocker", - "FileVault" - ] - }, - "tenantFilter": { - "type": "string", - "description": "Interact with query parameters or the body of the request." } - }, - "required": [ - "tenantFilter" - ] - } - } - } - }, - "parameters": [ - { - "name": "GUID", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - } - ], - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/StandardResults" } } } - }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" - }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, - "security": [ - { - "bearerAuth": [] - } - ], - "x-cipp-role": "Endpoint.Device.Read" - } - }, - "/api/ExecGetReportBuilderPdf": { - "get": { - "summary": "ExecGetReportBuilderPdf", - "operationId": "ExecGetReportBuilderPdf", - "tags": [ - "Tools > Report-Builder" - ], - "description": "Returns the server-rendered PDF for a generated Report Builder report as application/pdf bytes.\nBacks both the in-app preview (shown in an iframe) and the download button on the view page.\nA report generated before server-side rendering (or whose render failed) is rendered from its\nstored blocks on first request and cached. 404 when the report does not exist, and also when\nthe report belongs to a tenant the caller cannot access.", "parameters": [ { - "name": "id", - "in": "query", - "description": "The generated report's GUID.", - "required": true, - "schema": { - "type": "string" - } - }, - { - "name": "ReportGUID", + "name": "IP", "in": "query", - "description": "The generated report's GUID.", "required": false, "schema": { "type": "string" @@ -24118,30 +25839,16 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", - "properties": { - "PartitionKey": { - "x-cipp-field-source": "backend" - } - } + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "404": { - "description": "Not found" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -24149,18 +25856,18 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.ReportBuilder.Read", + "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, - "/api/ExecGetShadowAIReportPdf": { + "/api/ExecGetBaselineWhatIfReportPdf": { "post": { - "summary": "ExecGetShadowAIReportPdf", - "operationId": "ExecGetShadowAIReportPdf", + "summary": "ExecGetBaselineWhatIfReportPdf", + "operationId": "ExecGetBaselineWhatIfReportPdf", "tags": [ - "Tenant > AI" + "Tenant > Standards" ], - "description": "Server-renders the Shadow AI report as application/pdf bytes. Gathers the same shaped data the\nShadow AI page uses (ListShadowAI) and composes it through the shared CIPPSharp component kit\n(Build-CippShadowAIReportTree) - the server-side replacement for the client react-pdf\nShadowAIReportButton.", + "description": "Server-renders the Security Baseline report for a tenant as application/pdf bytes: where the\nassigned baselines stand today, what is already in place, the Conditional Access and Intune\npolicies and the settings the baseline will change (what each does, its value today, the value\nit will be set to and why), the rollout waves still to come and the agreed exceptions - plus,\noptionally, everything one or more simulated (not yet assigned) baselines would add. Reads the\nsame alignment, baseline and catalog data the Baselines page shows, composes it through the\nshared CIPPSharp component kit (Build-CippBaselineWhatIfReportTree) and returns the finished\nPDF. Nothing is changed by producing it.", "requestBody": { "required": true, "content": { @@ -24168,14 +25875,33 @@ "schema": { "type": "object", "properties": { + "brandingPresetId": { + "type": "string", + "description": "Optional. The branding preset to render with; an unknown id falls back to the default branding." + }, "sectionConfig": { + "type": "object", + "properties": { + "alreadyAligned": { + "type": "string", + "description": "Optional. Show the \"What Is Already In Place\" page (deployed policies and enforced settings, with their values). A boolean; defaults to true." + }, + "rolloutStages": { + "type": "string", + "description": "Optional. Show the \"How The Rollout Works\" section (the remaining waves and when they arrive). A boolean; defaults to true." + } + }, + "description": "Optional. Show the \"What Is Already In Place\" page (deployed policies and enforced settings, with their values). A boolean; defaults to true." + }, + "simulatedTemplateIds": { "type": "array", "items": { "type": "string" } }, "tenantFilter": { - "type": "string" + "type": "string", + "description": "Required. The tenant (default domain) to report on." } }, "required": [ @@ -24186,6 +25912,15 @@ } }, "parameters": [ + { + "name": "brandingPresetId", + "in": "query", + "description": "Optional. The branding preset to render with; an unknown id falls back to the default branding.", + "required": false, + "schema": { + "type": "string" + } + }, { "$ref": "#/components/parameters/tenantFilter" } @@ -24197,7 +25932,55 @@ "application/json": { "schema": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "ContentHash": { + "x-cipp-field-source": "storage" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "GUID": { + "x-cipp-field-source": "storage" + }, + "JSON": { + "x-cipp-field-source": "storage" + }, + "Package": { + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Permissions": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "SHA": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Source": { + "x-cipp-field-source": "storage" + }, + "SourcePath": { + "x-cipp-field-source": "storage" + }, + "TemplateName": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "UpdatedBy": { + "x-cipp-field-source": "storage" + } + } } } } @@ -24220,17 +26003,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.AI.Read" + "x-cipp-role": "Tenant.Baselines.Read" } }, - "/api/ExecGetSharingReportPdf": { + "/api/ExecGetBecReportPdf": { "post": { - "summary": "ExecGetSharingReportPdf", - "operationId": "ExecGetSharingReportPdf", + "summary": "ExecGetBecReportPdf", + "operationId": "ExecGetBecReportPdf", "tags": [ - "Teams-Sharepoint" + "Identity > Administration > Users" ], - "description": "Server-renders the SharePoint & OneDrive Sharing report as application/pdf bytes. Gathers the same\nshaped data the Sharing page uses (ListSharePointSharing, from the CIPP reporting cache), composes\nit through the shared CIPPSharp component kit (Build-CippSharingReportTree) and returns the finished\nPDF - the server-side replacement for the client react-pdf SharingReportButton.", + "description": "Server-renders a stored Business Email Compromise (BEC) run as application/pdf bytes. Reads the\nrun through Get-CIPPBecReport (the BecReports metadata row plus its BecResults payload) and\ncomposes it through the shared CIPPSharp component kit (Build-CippBecReportTree) - the server-side\nreplacement for the client react-pdf BECRemediationReportButton. A run is named by its caseId;\npass userId instead to render the user's newest completed run. The run must have completed - the\nreport reads its stored result, it does not trigger a new investigation.", "requestBody": { "required": true, "content": { @@ -24238,8 +26021,26 @@ "schema": { "type": "object", "properties": { + "caseId": { + "type": "string", + "description": "The stored run to render. A caseId names it directly; a userId picks the user's newest completed run." + }, "tenantFilter": { "type": "string" + }, + "userDisplayName": { + "type": "string", + "description": "The investigated user labels the cover and footer; the run stored who it was for." + }, + "userId": { + "type": "string" + }, + "userName": { + "type": "string" + }, + "variant": { + "type": "string", + "description": "'full' (default) = every page; 'summary' = the executive lead only, for a C-suite reader" } }, "required": [ @@ -24250,8 +26051,51 @@ } }, "parameters": [ + { + "name": "caseId", + "in": "query", + "description": "The stored run to render. A caseId names it directly; a userId picks the user's newest completed run.", + "required": false, + "schema": { + "type": "string" + } + }, { "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "userDisplayName", + "in": "query", + "description": "The investigated user labels the cover and footer; the run stored who it was for.", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "userId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "userName", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "variant", + "in": "query", + "description": "'full' (default) = every page; 'summary' = the executive lead only, for a C-suite reader", + "required": false, + "schema": { + "type": "string" + } } ], "responses": { @@ -24275,6 +26119,9 @@ "403": { "description": "Forbidden - caller lacks the required RBAC role" }, + "404": { + "description": "Not found" + }, "500": { "description": "Internal server error" } @@ -24284,49 +26131,54 @@ "bearerAuth": [] } ], - "x-cipp-role": "Sharepoint.Site.Read" + "x-cipp-role": "Identity.User.Read" } }, - "/api/ExecGitHubAction": { + "/api/ExecGetExecutiveReportPdf": { "post": { - "summary": "Invoke GitHub Action", - "operationId": "ExecGitHubAction", + "summary": "ExecGetExecutiveReportPdf", + "operationId": "ExecGetExecutiveReportPdf", "tags": [ - "Tools > GitHub" + "Tenant > Standards" ], - "description": "Call GitHub API", + "description": "Server-renders the Executive Summary report as application/pdf bytes. Every figure is read from the\nnightly Reporting DB cache via New-CIPPDbRequest (Users/Guests/Roles for the environment overview,\nLicenseOverview, ManagedDevices, ConditionalAccessPolicies and SecureScore) plus the standards\ncomparison from the CippStandardsReports table resolved against the standards catalog - the same\ncached data the rest of CIPP reports from, with no live Graph or cross-endpoint HTTP calls. The\nshaped data is composed through the shared CIPPSharp component kit (Build-CippExecutiveReportTree),\nthe server-side replacement for the client react-pdf ExecutiveReportButton. Each source is gathered\ndefensively: a source with no cached data simply drops its section.", "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "Action": { + "brandingPresetId": { + "type": "string", + "description": "The branding preset a caller picked for this render, else the global branding settings." + }, + "sectionConfig": { + "type": "string" + }, + "tenantFilter": { "type": "string" } - } + }, + "required": [ + "tenantFilter" + ] } } } }, "parameters": [ { - "name": "Action", + "name": "brandingPresetId", "in": "query", + "description": "The branding preset a caller picked for this render, else the global branding settings.", "required": false, "schema": { - "type": "string", - "enum": [ - "CreateRepo", - "GetBranches", - "GetFileContents", - "GetFileTree", - "GetOrgs", - "ImportTemplate", - "Search" - ] + "type": "string" } + }, + { + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -24341,11 +26193,17 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -24353,95 +26211,117 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Extension.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "Tenant.Standards.Read" } }, - "/api/ExecGraphExplorerPreset": { + "/api/ExecGetLicenseReportPdf": { "post": { - "summary": "ExecGraphExplorerPreset", - "operationId": "ExecGraphExplorerPreset", + "summary": "ExecGetLicenseReportPdf", + "operationId": "ExecGetLicenseReportPdf", "tags": [ - "Tenant > Tools" + "Tenant > Reports" ], - "description": "Manages the caller's saved Graph Explorer presets. The action field selects the operation: Copy duplicates a preset, Save creates or updates one, and Delete removes one. Save and Delete modify stored data despite the Read role on this endpoint, and a caller may only modify presets they own.", + "description": "Server-renders the License Optimisation report as application/pdf bytes. Runs the same license\nrecommendation analysis the License Optimization page reads through ListLicenseRecommendations\n(Get-CIPPLicenseRecommendation, with the page's currency, thresholds and recommendation switches)\nand composes it through the shared CIPPSharp kit (Build-CippLicenseReportTree) - the server-side\nreplacement for the client react-pdf LicenseReportButton.", "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "action": { + "brandingPresetId": { "type": "string", - "enum": [ - "Copy", - "Delete", - "Save" - ] + "description": "The branding preset to render against (the Licensing Report default from the branding settings), else the global branding." }, - "preset": { + "currency": { + "type": "string", + "description": "Currency the money figures are resolved in: a three-letter ISO code such as USD or EUR. Defaults to USD." + }, + "inactiveDays": { + "type": "string", + "description": "Days without a sign-in after which a licensed person counts as inactive (1-365). Defaults to 90." + }, + "protectSecurityFeatures": { + "type": "string" + }, + "recommendDowngrades": { + "type": "string" + }, + "recommendTerms": { + "type": "string" + }, + "recommendUpgrades": { + "type": "string" + }, + "sections": { "type": "object", "properties": { - "endpoint": { - "type": "string" - }, - "id": { - "type": "string" + "downgrades": { + "type": "boolean" }, - "IsShared": { - "type": "string" + "method": { + "type": "boolean" }, - "name": { - "type": "string" + "reclaim": { + "type": "boolean" + }, + "spend": { + "type": "boolean" + }, + "terms": { + "type": "boolean" + }, + "upgrades": { + "type": "boolean" } } + }, + "tenantFilter": { + "type": "string", + "description": "The tenant to report on. A single tenant; AllTenants is not supported." + }, + "tenureMonths": { + "type": "string", + "description": "Months a seat must have been held by the same person to count as stable for a yearly commitment (1-36). Defaults to 6." } - } + }, + "required": [ + "tenantFilter" + ] } } } }, - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/StandardResults" - } - } + "parameters": [ + { + "name": "brandingPresetId", + "in": "query", + "description": "The branding preset to render against (the Licensing Report default from the branding settings), else the global branding.", + "required": false, + "schema": { + "type": "string" } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" + { + "name": "currency", + "in": "query", + "description": "Currency the money figures are resolved in: a three-letter ISO code such as USD or EUR. Defaults to USD.", + "required": false, + "schema": { + "type": "string" + } }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" - } - }, - "security": [ { - "bearerAuth": [] - } - ], - "x-cipp-role": "CIPP.Core.Read" - } - }, - "/api/ExecGraphRequestProfile": { - "get": { - "summary": "ExecGraphRequestProfile", - "operationId": "ExecGraphRequestProfile", - "tags": [ - "CIPP > Core" - ], - "description": "Profiles a Graph request for troubleshooting, timing the call and reporting what it returned. Passing Mode=Diagnostics instead returns a point-in-time snapshot of the CIPPSharp REST client and token cache counters without calling Graph at all, and Reset=true clears those counters after reading them.", - "parameters": [ + "name": "inactiveDays", + "in": "query", + "description": "Days without a sign-in after which a licensed person counts as inactive (1-365). Defaults to 90.", + "required": false, + "schema": { + "type": "string" + } + }, { - "name": "Endpoint", + "name": "protectSecurityFeatures", "in": "query", "required": false, "schema": { @@ -24449,15 +26329,15 @@ } }, { - "name": "manualPagination", + "name": "recommendDowngrades", "in": "query", "required": false, "schema": { - "type": "boolean" + "type": "string" } }, { - "name": "Mode", + "name": "recommendTerms", "in": "query", "required": false, "schema": { @@ -24465,7 +26345,7 @@ } }, { - "name": "Reset", + "name": "recommendUpgrades", "in": "query", "required": false, "schema": { @@ -24476,8 +26356,9 @@ "$ref": "#/components/parameters/tenantFilter" }, { - "name": "Version", + "name": "tenureMonths", "in": "query", + "description": "Months a seat must have been held by the same person to count as stable for a yearly commitment (1-36). Defaults to 6.", "required": false, "schema": { "type": "string" @@ -24491,36 +26372,22 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", - "properties": { - "CoreStateAfter": { - "x-cipp-field-source": "backend" - }, - "CoreStateBefore": { - "x-cipp-field-source": "backend" - }, - "Endpoint": { - "x-cipp-field-source": "backend" - }, - "GraphUrl": { - "x-cipp-field-source": "backend" - }, - "Tenant": { - "x-cipp-field-source": "backend" - }, - "Timings": { - "x-cipp-field-source": "backend" - } - } + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -24528,17 +26395,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.Read" + "x-cipp-role": "Tenant.Directory.Read" } }, - "/api/ExecGroupMembers": { + "/api/ExecGetLocalAdminPassword": { "post": { - "summary": "ExecGroupMembers", - "operationId": "ExecGroupMembers", + "summary": "ExecGetLocalAdminPassword", + "operationId": "ExecGetLocalAdminPassword", "tags": [ - "Identity > Administration > Groups" + "Endpoint > MEM" ], - "description": "Manages group membership (members and owners) via a switch-style action parameter.\nAccepts one or more directory object IDs, UPNs, or mail addresses (users, groups, etc.).\nAutomatically resolves the group type from Graph to route through the correct API (Graph or Exchange).\n\nSupported actions: addMember, removeMember, addOwner, removeOwner", + "description": "Retrieves the Windows LAPS local administrator password for a device, identified by its Entra device GUID. Returns a live credential in plain text; the retrieval is written to the CIPP audit log.", "requestBody": { "required": true, "content": { @@ -24546,28 +26413,15 @@ "schema": { "type": "object", "properties": { - "action": { - "type": "string", - "enum": [ - "addMember", - "addOwner", - "removeMember", - "removeOwner" - ] - }, - "groupId": { + "guid": { "type": "string" }, - "tenantFilter": { + "TenantFilter": { "type": "string" - }, - "users": { - "type": "string", - "description": "Accept a single string or an array of strings (IDs, UPNs, or mail)" } }, "required": [ - "tenantFilter" + "TenantFilter" ] } } @@ -24579,22 +26433,22 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Results": { + "x-cipp-field-source": "backend" + } + } } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -24602,16 +26456,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.Group.ReadWrite" + "x-cipp-role": "Endpoint.Device.Read" } }, - "/api/ExecGroupsDelete": { + "/api/ExecGetMailFlowReportPdf": { "post": { - "summary": "ExecGroupsDelete", - "operationId": "ExecGroupsDelete", + "summary": "ExecGetMailFlowReportPdf", + "operationId": "ExecGetMailFlowReportPdf", "tags": [ - "Email-Exchange > Administration" + "Email-Exchange > Reports" ], + "description": "Server-renders the Exchange mail flow report as application/pdf bytes. Reads the same three Exchange\nreports the Mail Flow page uses (Get-MailFlowStatusReport plus the TopMailSender and\nTopSpamRecipient traffic summaries), aggregates the daily disposition rows the way the page does,\nand composes them through the shared CIPPSharp kit (Build-CippMailFlowReportTree) - the server-side\nreplacement for the client react-pdf MailFlowReportButton.", "requestBody": { "required": true, "content": { @@ -24619,18 +26474,8 @@ "schema": { "type": "object", "properties": { - "displayName": { - "type": "string" - }, - "GroupType": { - "type": "string" - }, - "id": { - "type": "string" - }, "tenantFilter": { - "type": "string", - "description": "Interact with query parameters or the body of the request." + "type": "string" } }, "required": [ @@ -24642,24 +26487,9 @@ }, "parameters": [ { - "name": "displayName", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "GroupType", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "id", + "name": "days", "in": "query", + "description": "Reporting window in days (1-90).", "required": false, "schema": { "type": "string" @@ -24675,11 +26505,15 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -24695,16 +26529,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "Exchange.Mailbox.Read" } }, - "/api/ExecGroupsDeliveryManagement": { + "/api/ExecGetPermissionsReportPdf": { "post": { - "summary": "ExecGroupsDeliveryManagement", - "operationId": "ExecGroupsDeliveryManagement", + "summary": "ExecGetPermissionsReportPdf", + "operationId": "ExecGetPermissionsReportPdf", "tags": [ - "Email-Exchange > Administration" + "Teams-Sharepoint" ], + "description": "Server-renders the SharePoint Permissions report as application/pdf bytes. Gathers the same shaped\ndata the Permissions page uses (ListSharePointPermissions, from the CIPP reporting cache), composes\nit through the shared CIPPSharp component kit (Build-CippPermissionsReportTree) and returns the\nfinished PDF - the server-side replacement for the client react-pdf PermissionsReportButton.", "requestBody": { "required": true, "content": { @@ -24712,18 +26547,8 @@ "schema": { "type": "object", "properties": { - "GroupType": { - "type": "string" - }, - "ID": { - "type": "string" - }, - "OnlyAllowInternal": { - "type": "string" - }, "tenantFilter": { - "type": "string", - "description": "Interact with query parameters or the body of the request." + "type": "string" } }, "required": [ @@ -24734,30 +26559,6 @@ } }, "parameters": [ - { - "name": "GroupType", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "ID", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "OnlyAllowInternal", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, { "$ref": "#/components/parameters/tenantFilter" } @@ -24768,11 +26569,15 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -24788,16 +26593,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Group.ReadWrite" + "x-cipp-role": "Sharepoint.Site.Read" } }, - "/api/ExecGroupsHideFromGAL": { + "/api/ExecGetRecoveryKey": { "post": { - "summary": "ExecGroupsHideFromGAL", - "operationId": "ExecGroupsHideFromGAL", + "summary": "ExecGetRecoveryKey", + "operationId": "ExecGetRecoveryKey", "tags": [ - "Email-Exchange > Administration" + "Endpoint > MEM" ], + "description": "Retrieves a device's disk encryption recovery key by device GUID. RecoveryKeyType selects BitLocker (the default) or FileVault. Returns a live recovery key in plain text; the retrieval is written to the CIPP audit log.", "requestBody": { "required": true, "content": { @@ -24805,14 +26611,16 @@ "schema": { "type": "object", "properties": { - "GroupType": { - "type": "string" - }, - "HideFromGAL": { + "GUID": { "type": "string" }, - "ID": { - "type": "string" + "RecoveryKeyType": { + "type": "string", + "enum": [ + "BiosPassword", + "BitLocker", + "FileVault" + ] }, "tenantFilter": { "type": "string", @@ -24828,23 +26636,7 @@ }, "parameters": [ { - "name": "GroupType", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "HideFromGAL", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "ID", + "name": "GUID", "in": "query", "required": false, "schema": { @@ -24881,27 +26673,37 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Group.ReadWrite" + "x-cipp-role": "Endpoint.Device.Read" } }, - "/api/ExecHaloPSATestTicket": { - "post": { - "summary": "Create a HaloPSA test ticket so admins can check the integration works without waiting\nfor a real alert to fire. Covers auth, tenant mapping, ticket type and default priority.\n\nCalls New-HaloPSATicket directly rather than going through Send-CIPPAlert, so the parts\nthat live in the alert pipeline - the [CIPP] title prefix and per-user ticket linking -\nare not exercised here.", - "operationId": "ExecHaloPSATestTicket", + "/api/ExecGetReportBuilderPdf": { + "get": { + "summary": "ExecGetReportBuilderPdf", + "operationId": "ExecGetReportBuilderPdf", "tags": [ - "CIPP > Extensions" + "Tools > Report-Builder" ], - "requestBody": { - "required": false, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": {} - } + "description": "Returns the server-rendered PDF for a generated Report Builder report as application/pdf bytes.\nBacks both the in-app preview (shown in an iframe) and the download button on the view page.\nA report generated before server-side rendering (or whose render failed) is rendered from its\nstored blocks on first request and cached. 404 when the report does not exist, and also when\nthe report belongs to a tenant the caller cannot access.", + "parameters": [ + { + "name": "id", + "in": "query", + "description": "The generated report's GUID.", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "ReportGUID", + "in": "query", + "description": "The generated report's GUID.", + "required": false, + "schema": { + "type": "string" } } - }, + ], "responses": { "200": { "description": "Success", @@ -24911,7 +26713,7 @@ "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "Results": { + "PartitionKey": { "x-cipp-field-source": "backend" } } @@ -24919,11 +26721,20 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "404": { + "description": "Not found" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -24931,17 +26742,18 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Extension.ReadWrite", + "x-cipp-role": "CIPP.ReportBuilder.Read", "x-cipp-any-tenant": true } }, - "/api/ExecHideFromGAL": { + "/api/ExecGetShadowAIReportPdf": { "post": { - "summary": "ExecHideFromGAL", - "operationId": "ExecHideFromGAL", + "summary": "ExecGetShadowAIReportPdf", + "operationId": "ExecGetShadowAIReportPdf", "tags": [ - "Email-Exchange > Administration" + "Tenant > AI" ], + "description": "Server-renders the Shadow AI report as application/pdf bytes. Gathers the same shaped data the\nShadow AI page uses (ListShadowAI) and composes it through the shared CIPPSharp component kit\n(Build-CippShadowAIReportTree) - the server-side replacement for the client react-pdf\nShadowAIReportButton.", "requestBody": { "required": true, "content": { @@ -24949,12 +26761,11 @@ "schema": { "type": "object", "properties": { - "HideFromGAL": { - "type": "string" - }, - "ID": { - "type": "string", - "description": "Support if the request is a POST or a GET. So to support legacy(GET) and new(POST) requests" + "sectionConfig": { + "type": "array", + "items": { + "type": "string" + } }, "tenantFilter": { "type": "string" @@ -24968,23 +26779,6 @@ } }, "parameters": [ - { - "name": "HideFromGAL", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "ID", - "in": "query", - "description": "Support if the request is a POST or a GET. So to support legacy(GET) and new(POST) requests", - "required": false, - "schema": { - "type": "string" - } - }, { "$ref": "#/components/parameters/tenantFilter" } @@ -24995,16 +26789,23 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -25012,17 +26813,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "Tenant.AI.Read" } }, - "/api/ExecHistoricalSearch": { + "/api/ExecGetSharingReportPdf": { "post": { - "summary": "ExecHistoricalSearch", - "operationId": "ExecHistoricalSearch", + "summary": "ExecGetSharingReportPdf", + "operationId": "ExecGetSharingReportPdf", "tags": [ - "Email-Exchange > Tools" + "Teams-Sharepoint" ], - "description": "Starts or cancels an Exchange Online historical search. Historical searches cover up to 90 days,\ndeliver results as CSV (max 100,000 rows) and are limited to 250 submissions per day per tenant.", + "description": "Server-renders the SharePoint & OneDrive Sharing report as application/pdf bytes. Gathers the same\nshaped data the Sharing page uses (ListSharePointSharing, from the CIPP reporting cache), composes\nit through the shared CIPPSharp component kit (Build-CippSharingReportTree) and returns the finished\nPDF - the server-side replacement for the client react-pdf SharingReportButton.", "requestBody": { "required": true, "content": { @@ -25030,51 +26831,22 @@ "schema": { "type": "object", "properties": { - "Action": { - "type": "string" - }, - "deliveryStatus": { - "$ref": "#/components/schemas/LabelValue" - }, - "direction": { - "$ref": "#/components/schemas/LabelValue" - }, - "jobId": { - "type": "string" - }, - "messageId": { - "type": "string" - }, - "notifyAddress": { - "type": "string" - }, - "originalClientIP": { - "type": "string" - }, - "recipientAddress": { - "type": "string" - }, - "reportTitle": { - "type": "string" - }, - "reportType": { - "$ref": "#/components/schemas/LabelValue" - }, - "senderAddress": { - "type": "string" - }, "tenantFilter": { "type": "string" } }, "required": [ - "jobId", "tenantFilter" ] } } } }, + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], "responses": { "200": { "description": "Success", @@ -25087,6 +26859,9 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -25102,66 +26877,119 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "Sharepoint.Site.Read" } }, - "/api/ExecHVEUser": { + "/api/ExecGitHubAction": { "post": { - "summary": "ExecHVEUser", - "operationId": "ExecHVEUser", + "summary": "Invoke GitHub Action", + "operationId": "ExecGitHubAction", "tags": [ - "Email-Exchange > Administration" + "Tools > GitHub" ], + "description": "Call GitHub API", "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { - "type": "string", - "enum": [ - "AssignBillingPolicy", - "Edit", - "Remove", - "RemoveBillingPolicy" - ] - }, - "BillingPolicyId": { - "$ref": "#/components/schemas/LabelValue" - }, - "DisplayName": { - "type": "string" - }, - "domain": { - "$ref": "#/components/schemas/LabelValue" - }, - "Identity": { - "type": "string" - }, - "password": { - "type": "string" - }, - "PrimarySmtpAddress": { - "type": "string", - "description": "Build PrimarySmtpAddress from username + domain fields, or use direct value" - }, - "ReplyTo": { - "type": "string", - "description": "Set-HVEAccountSettings supports ReplyTo only" - }, - "TenantFilter": { "type": "string" + } + } + } + } + } + }, + "parameters": [ + { + "name": "Action", + "in": "query", + "required": false, + "schema": { + "type": "string", + "enum": [ + "CreateRepo", + "GetBranches", + "GetFileContents", + "GetFileTree", + "GetOrgs", + "ImportTemplate", + "Search" + ] + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "CIPP.Extension.ReadWrite", + "x-cipp-any-tenant": true + } + }, + "/api/ExecGraphExplorerPreset": { + "post": { + "summary": "ExecGraphExplorerPreset", + "operationId": "ExecGraphExplorerPreset", + "tags": [ + "Tenant > Tools" + ], + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "action": { + "type": "string", + "enum": [ + "Copy", + "Delete", + "Save" + ] }, - "username": { - "type": "string" + "preset": { + "type": "object", + "properties": { + "endpoint": { + "type": "string" + }, + "id": { + "type": "string" + }, + "IsShared": { + "type": "string" + }, + "name": { + "type": "string" + } + } } - }, - "required": [ - "Identity", - "TenantFilter" - ] + } } } } @@ -25177,6 +27005,9 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -25189,31 +27020,45 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "CIPP.Core.Read" } }, - "/api/ExecIncidentsList": { + "/api/ExecGraphRequestProfile": { "get": { - "summary": "ExecIncidentsList", - "operationId": "ExecIncidentsList", + "summary": "ExecGraphRequestProfile", + "operationId": "ExecGraphRequestProfile", "tags": [ - "Security > Incidents" + "CIPP > Core" ], - "description": "Lists Microsoft 365 Defender security incidents for a tenant, optionally bounded by StartDate and EndDate (both YYYYMMDD). tenantFilter=AllTenants reads the cached incident table rather than querying each tenant live.", + "description": "Profiles a Graph request for troubleshooting, timing the call and reporting what it returned. Passing Mode=Diagnostics instead returns a point-in-time snapshot of the CIPPSharp REST client and token cache counters without calling Graph at all, and Reset=true clears those counters after reading them.", "parameters": [ { - "name": "EndDate", + "name": "Endpoint", "in": "query", - "description": "YYYYMMDD or null", "required": false, "schema": { "type": "string" } }, { - "name": "StartDate", + "name": "manualPagination", + "in": "query", + "required": false, + "schema": { + "type": "boolean" + } + }, + { + "name": "Mode", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "Reset", "in": "query", - "description": "YYYYMMDD or null", "required": false, "schema": { "type": "string" @@ -25221,6 +27066,14 @@ }, { "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "Version", + "in": "query", + "required": false, + "schema": { + "type": "string" + } } ], "responses": { @@ -25230,141 +27083,25 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "Alert": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "AssignedTo": { - "type": "string", - "x-cipp-field-source": "graph-entity,frontend" - }, - "classification": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "comments": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "Created": { - "x-cipp-field-source": "frontend" - }, - "createdDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "customTags": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "description": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "determination": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "DisplayName": { - "type": "string", - "x-cipp-field-source": "graph-entity,frontend" - }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "id": { - "type": "string", - "x-cipp-field-source": "graph-entity,frontend" - }, - "Incident": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "IncidentUrl": { - "x-cipp-field-source": "frontend" - }, - "incidentWebUrl": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "lastModifiedBy": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "lastUpdateDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "MdoAlert": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "Metadata": { + "CoreStateAfter": { "x-cipp-field-source": "backend" }, - "PartitionKey": { - "x-cipp-field-source": "storage" - }, - "priorityScore": { - "type": "integer", - "x-cipp-field-source": "graph-entity" - }, - "recommendedActions": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "recommendedHuntingQueries": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "redirectIncidentId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "resolvingComment": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "Results": { + "CoreStateBefore": { "x-cipp-field-source": "backend" }, - "RowKey": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "Severity": { - "type": "object", - "x-cipp-field-source": "graph-entity,frontend" - }, - "Status": { - "type": "object", - "x-cipp-field-source": "graph-entity,frontend" - }, - "summary": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "systemTags": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "Endpoint": { + "x-cipp-field-source": "backend" }, - "Tags": { - "x-cipp-field-source": "frontend" + "GraphUrl": { + "x-cipp-field-source": "backend" }, "Tenant": { - "type": "string", - "x-cipp-field-source": "storage,frontend" - }, - "tenantId": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "backend" }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" + "Timings": { + "x-cipp-field-source": "backend" } } } @@ -25383,17 +27120,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Security.Incident.Read" + "x-cipp-role": "CIPP.Core.Read" } }, - "/api/ExecIRMConfiguration": { + "/api/ExecGroupMembers": { "post": { - "summary": "ExecIRMConfiguration", - "operationId": "ExecIRMConfiguration", + "summary": "ExecGroupMembers", + "operationId": "ExecGroupMembers", "tags": [ - "Email-Exchange > Tools" + "Identity > Administration > Groups" ], - "description": "Updates the Microsoft Purview Message Encryption configuration for a tenant (AzureRMSLicensingEnabled, SimplifiedClientAccessEnabled, EnablePdfEncryption, DecryptAttachmentForEncryptOnly, SimplifiedClientAccessDoNotForwardDisabled, SimplifiedClientAccessEncryptOnlyDisabled, TransportDecryptionSetting; only the settings present in the body are changed), or runs Test-IRMConfiguration to verify that encryption and decryption work end to end.", + "description": "Manages group membership (members and owners) via a switch-style action parameter.\nAccepts one or more directory object IDs, UPNs, or mail addresses (users, groups, etc.).\nAutomatically resolves the group type from Graph to route through the correct API (Graph or Exchange).\n\nSupported actions: addMember, removeMember, addOwner, removeOwner", "requestBody": { "required": true, "content": { @@ -25401,24 +27138,24 @@ "schema": { "type": "object", "properties": { - "Action": { + "action": { "type": "string", "enum": [ - "Set", - "Test" + "addMember", + "addOwner", + "removeMember", + "removeOwner" ] }, - "Recipient": { - "type": "string" - }, - "Sender": { + "groupId": { "type": "string" }, "tenantFilter": { "type": "string" }, - "TransportDecryptionSetting": { - "type": "string" + "users": { + "type": "string", + "description": "Accept a single string or an array of strings (IDs, UPNs, or mail)" } }, "required": [ @@ -25439,6 +27176,9 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -25454,17 +27194,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "Identity.Group.ReadWrite" } }, - "/api/ExecJITAdmin": { + "/api/ExecGroupsDelete": { "post": { - "summary": "ExecJITAdmin", - "operationId": "ExecJITAdmin", + "summary": "ExecGroupsDelete", + "operationId": "ExecGroupsDelete", "tags": [ - "Identity > Administration > Users" + "Email-Exchange > Administration" ], - "description": "Just-in-time admin management API endpoint. This function can create users, add roles, remove roles, delete, or disable a user.", "requestBody": { "required": true, "content": { @@ -25472,61 +27211,18 @@ "schema": { "type": "object", "properties": { - "AdminRoles": { - "type": "array", - "items": { - "$ref": "#/components/schemas/LabelValue" - }, - "description": "Enforce the caller's allowed JIT roles (from the JIT Role Template on their custom role). Get-CIPPJITAdminAllowedRoles is authoritative and fails closed for restricted callers, so we trust its result rather than swallowing errors here." - }, - "Domain": { - "$ref": "#/components/schemas/LabelValue" - }, - "EndDate": { - "type": "string" - }, - "existingUser": { - "$ref": "#/components/schemas/LabelValue" - }, - "ExpireAction": { - "$ref": "#/components/schemas/LabelValue" - }, - "FirstName": { - "type": "string" - }, - "GroupMemberships": { - "$ref": "#/components/schemas/LabelValue" - }, - "LastName": { + "displayName": { "type": "string" }, - "PostExecution": { - "type": "boolean" - }, - "reason": { + "GroupType": { "type": "string" }, - "StartDate": { + "id": { "type": "string" }, - "tapLifetimeInMinutes": { - "type": "integer" - }, "tenantFilter": { - "$ref": "#/components/schemas/LabelValue" - }, - "usageLocation": { - "$ref": "#/components/schemas/LabelValue" - }, - "userAction": { - "type": "string" - }, - "Username": { - "type": "string" - }, - "UseTAP": { "type": "string", - "description": "Region TAP creation" + "description": "Interact with query parameters or the body of the request." } }, "required": [ @@ -25536,6 +27232,35 @@ } } }, + "parameters": [ + { + "name": "displayName", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "GroupType", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "id", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], "responses": { "200": { "description": "Success", @@ -25547,14 +27272,14 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -25562,42 +27287,71 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.Role.ReadWrite" + "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecJITAdminSettings": { + "/api/ExecGroupsDeliveryManagement": { "post": { - "summary": "ExecJITAdminSettings", - "operationId": "ExecJITAdminSettings", + "summary": "ExecGroupsDeliveryManagement", + "operationId": "ExecGroupsDeliveryManagement", "tags": [ - "CIPP > Settings" + "Email-Exchange > Administration" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "Action": { + "GroupType": { "type": "string" }, - "MaxDuration": { - "$ref": "#/components/schemas/LabelValue" + "ID": { + "type": "string" + }, + "OnlyAllowInternal": { + "type": "string" + }, + "tenantFilter": { + "type": "string", + "description": "Interact with query parameters or the body of the request." } - } + }, + "required": [ + "tenantFilter" + ] } } } }, "parameters": [ { - "name": "Action", + "name": "GroupType", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "ID", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "OnlyAllowInternal", "in": "query", "required": false, "schema": { "type": "string" } + }, + { + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -25606,117 +27360,11 @@ "content": { "application/json": { "schema": { - "type": "object", - "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", - "properties": { - "ApplicationId": { - "x-cipp-field-source": "storage" - }, - "colour": { - "x-cipp-field-source": "storage" - }, - "coverFooterText": { - "x-cipp-field-source": "storage" - }, - "coverImage": { - "x-cipp-field-source": "storage" - }, - "coverImageId": { - "x-cipp-field-source": "storage" - }, - "coverImageIds": { - "x-cipp-field-source": "storage" - }, - "coverStock": { - "x-cipp-field-source": "storage" - }, - "coverUploads": { - "x-cipp-field-source": "storage" - }, - "Enabled": { - "type": "boolean", - "x-cipp-field-source": "storage" - }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "footerText": { - "x-cipp-field-source": "storage" - }, - "logo": { - "x-cipp-field-source": "storage" - }, - "logoImageId": { - "x-cipp-field-source": "storage" - }, - "logoImageIds": { - "x-cipp-field-source": "storage" - }, - "logoUploads": { - "x-cipp-field-source": "storage" - }, - "MaxDuration": { - "x-cipp-field-source": "storage" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" - }, - "reportDefaults": { - "x-cipp-field-source": "storage" - }, - "Resolver": { - "x-cipp-field-source": "storage" - }, - "RetentionDays": { - "x-cipp-field-source": "storage" - }, - "roleColours": { - "x-cipp-field-source": "storage" - }, - "RowKey": { - "x-cipp-field-source": "storage" - }, - "secondaryColour": { - "x-cipp-field-source": "storage" - }, - "showFooter": { - "x-cipp-field-source": "storage" - }, - "showPageNumbers": { - "x-cipp-field-source": "storage" - }, - "StandardsExcludeAllTenants": { - "x-cipp-field-source": "storage" - }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "Timezone": { - "x-cipp-field-source": "storage" - }, - "TimezoneSource": { - "x-cipp-field-source": "storage" - }, - "Value": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "watermarkEnabled": { - "x-cipp-field-source": "storage" - }, - "watermarkText": { - "x-cipp-field-source": "storage" - } - } + "$ref": "#/components/schemas/StandardResults" } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -25732,18 +27380,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AppSettings.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "Exchange.Group.ReadWrite" } }, - "/api/ExecLicensePricing": { + "/api/ExecGroupsHideFromGAL": { "post": { - "summary": "ExecLicensePricing", - "operationId": "ExecLicensePricing", + "summary": "ExecGroupsHideFromGAL", + "operationId": "ExecGroupsHideFromGAL", "tags": [ - "Tenant > Reports" + "Email-Exchange > Administration" ], - "description": "Manage MSP-global license price overrides used by the license optimization report.\nSetPrice upserts a per-SKU monthly price; RemovePrice deletes an override so the SKU falls\nback to the shipped MSRP estimate.", "requestBody": { "required": true, "content": { @@ -25751,89 +27397,67 @@ "schema": { "type": "object", "properties": { - "Action": { - "type": "string", - "enum": [ - "RemovePrice", - "SetPrice" - ], - "description": "SetPrice or RemovePrice" - }, - "Currency": { - "type": "string", - "description": "Overrides are currency-scoped: one row per (skuId, currency), so an AUD override and a USD override for the same SKU coexist. RowKey = \"{skuId}-{currency}\"." + "GroupType": { + "type": "string" }, - "MonthlyPrice": { - "type": "number", - "description": "Monthly price per seat, in the given currency" + "HideFromGAL": { + "type": "string" }, - "Product_Display_Name": { + "ID": { "type": "string" }, - "skuId": { + "tenantFilter": { "type": "string", - "description": "The SKU GUID (skuId) the price applies to" - }, - "skuPartNumber": { - "type": "string" + "description": "Interact with query parameters or the body of the request." } }, "required": [ - "Action" + "tenantFilter" ] } } } }, + "parameters": [ + { + "name": "GroupType", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "HideFromGAL", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "ID", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { - "type": "object", - "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", - "properties": { - "Currency": { - "x-cipp-field-source": "storage" - }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "MonthlyPrice": { - "type": "number", - "x-cipp-field-source": "storage" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" - }, - "Product_Display_Name": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "RowKey": { - "x-cipp-field-source": "storage" - }, - "skuId": { - "x-cipp-field-source": "storage" - }, - "skuPartNumber": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" - } - } + "$ref": "#/components/schemas/StandardResults" } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -25849,36 +27473,23 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Directory.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "Exchange.Group.ReadWrite" } }, - "/api/ExecLicenseSearch": { + "/api/ExecHaloPSATestTicket": { "post": { - "summary": "ExecLicenseSearch", - "operationId": "ExecLicenseSearch", + "summary": "Create a HaloPSA test ticket so admins can check the integration works without waiting\nfor a real alert to fire. Covers auth, tenant mapping, ticket type and default priority.\n\nCalls New-HaloPSATicket directly rather than going through Send-CIPPAlert, so the parts\nthat live in the alert pipeline - the [CIPP] title prefix and per-user ticket linking -\nare not exercised here.", + "operationId": "ExecHaloPSATestTicket", "tags": [ - "CIPP > Core" + "CIPP > Extensions" ], - "description": "Resolves licence SKU ids to display names from the licence name table, falling back to the given tenant's cached licence overview. Takes an array of skuIds in the body.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", - "properties": { - "skuIds": { - "type": "array", - "items": { - "type": "string" - } - }, - "tenantFilter": { - "type": "string", - "description": "Tenant whose cached licence overview is checked for SKUs the name table does not hold yet" - } - } + "properties": {} } } } @@ -25890,22 +27501,21 @@ "application/json": { "schema": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Results": { + "x-cipp-field-source": "backend" + } + } } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -25913,281 +27523,45 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.Read", + "x-cipp-role": "CIPP.Extension.ReadWrite", "x-cipp-any-tenant": true } }, - "/api/ExecListAppId": { + "/api/ExecHideFromGAL": { "post": { - "summary": "ExecListAppId", - "operationId": "ExecListAppId", + "summary": "ExecHideFromGAL", + "operationId": "ExecHideFromGAL", "tags": [ - "CIPP > Setup" + "Email-Exchange > Administration" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", - "properties": {} - } - } - } - }, - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "type": "object", - "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", - "properties": { - "addIns": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "api": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "APIKey": { - "x-cipp-field-source": "storage" - }, - "appId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "ApplicationId": { - "x-cipp-field-source": "storage" - }, - "ApplicationSecret": { - "x-cipp-field-source": "storage" - }, - "applicationTemplateId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "appRoles": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "authenticationBehaviors": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "certification": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "createdByAppId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "createdDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "defaultRedirectUri": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "deletedDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "description": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "disabledByMicrosoftStatus": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "displayName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "groupMembershipClaims": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "id": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "identifierUris": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "info": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "isDeviceOnlyAuthSupported": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "isDisabled": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "isFallbackPublicClient": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "keyCredentials": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "logo": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "managerApplications": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "nativeAuthenticationApisEnabled": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "notes": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "oauth2RequirePostResponse": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "optionalClaims": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "parentalControlSettings": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" - }, - "passwordCredentials": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "publicClient": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "publisherDomain": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "RefreshToken": { - "x-cipp-field-source": "storage" - }, - "requestSignatureVerification": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "requiredResourceAccess": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "RowKey": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "samlMetadataUrl": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "SASUrl": { - "x-cipp-field-source": "storage" - }, - "SecretValue": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "serviceManagementReference": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "servicePrincipalLockConfiguration": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "signInAudience": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "spa": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "tags": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "TenantId": { - "x-cipp-field-source": "storage" - }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "tokenEncryptionKeyId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "uniqueName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "verifiedPublisher": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "web": { - "type": "object", - "x-cipp-field-source": "graph-entity" - } + "properties": { + "HideFromGAL": { + "type": "string" + }, + "ID": { + "type": "string", + "description": "Support if the request is a POST or a GET. So to support legacy(GET) and new(POST) requests" + }, + "tenantFilter": { + "type": "string" } - } + }, + "required": [ + "tenantFilter" + ] } } - }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" - }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" } }, - "security": [ - { - "bearerAuth": [] - } - ], - "x-cipp-role": "CIPP.Core.ReadWrite" - } - }, - "/api/ExecListBackup": { - "get": { - "summary": "ExecListBackup", - "operationId": "ExecListBackup", - "tags": [ - "CIPP > Core" - ], - "description": "Lists stored CIPP backups, optionally narrowed by Type, tenantFilter or BackupName. NameOnly=true returns just the backup names and the items each one contains, without the backup payload.", "parameters": [ { - "name": "BackupName", + "name": "HideFromGAL", "in": "query", "required": false, "schema": { @@ -26195,23 +27569,16 @@ } }, { - "name": "NameOnly", + "name": "ID", "in": "query", + "description": "Support if the request is a POST or a GET. So to support legacy(GET) and new(POST) requests", "required": false, "schema": { - "type": "boolean" + "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" - }, - { - "name": "Type", - "in": "query", - "required": false, - "schema": { - "type": "string" - } } ], "responses": { @@ -26220,11 +27587,7 @@ "content": { "application/json": { "schema": { - "type": "array", - "items": { - "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." - } + "$ref": "#/components/schemas/StandardResults" } } } @@ -26241,41 +27604,69 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Backup.Read" + "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecLogRetentionConfig": { + "/api/ExecHistoricalSearch": { "post": { - "summary": "ExecLogRetentionConfig", - "operationId": "ExecLogRetentionConfig", + "summary": "ExecHistoricalSearch", + "operationId": "ExecHistoricalSearch", "tags": [ - "CIPP > Settings" + "Email-Exchange > Tools" ], + "description": "Starts or cancels an Exchange Online historical search. Historical searches cover up to 90 days,\ndeliver results as CSV (max 100,000 rows) and are limited to 250 submissions per day per tenant.", "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "RetentionDays": { - "type": "integer" - } - } + "Action": { + "type": "string" + }, + "deliveryStatus": { + "$ref": "#/components/schemas/LabelValue" + }, + "direction": { + "$ref": "#/components/schemas/LabelValue" + }, + "jobId": { + "type": "string" + }, + "messageId": { + "type": "string" + }, + "notifyAddress": { + "type": "string" + }, + "originalClientIP": { + "type": "string" + }, + "recipientAddress": { + "type": "string" + }, + "reportTitle": { + "type": "string" + }, + "reportType": { + "$ref": "#/components/schemas/LabelValue" + }, + "senderAddress": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "jobId", + "tenantFilter" + ] } } } }, - "parameters": [ - { - "name": "List", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - } - ], "responses": { "200": { "description": "Success", @@ -26283,112 +27674,7 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", - "properties": { - "ApplicationId": { - "x-cipp-field-source": "storage" - }, - "colour": { - "x-cipp-field-source": "storage" - }, - "coverFooterText": { - "x-cipp-field-source": "storage" - }, - "coverImage": { - "x-cipp-field-source": "storage" - }, - "coverImageId": { - "x-cipp-field-source": "storage" - }, - "coverImageIds": { - "x-cipp-field-source": "storage" - }, - "coverStock": { - "x-cipp-field-source": "storage" - }, - "coverUploads": { - "x-cipp-field-source": "storage" - }, - "Enabled": { - "type": "boolean", - "x-cipp-field-source": "storage" - }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "footerText": { - "x-cipp-field-source": "storage" - }, - "logo": { - "x-cipp-field-source": "storage" - }, - "logoImageId": { - "x-cipp-field-source": "storage" - }, - "logoImageIds": { - "x-cipp-field-source": "storage" - }, - "logoUploads": { - "x-cipp-field-source": "storage" - }, - "MaxDuration": { - "x-cipp-field-source": "storage" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" - }, - "reportDefaults": { - "x-cipp-field-source": "storage" - }, - "Resolver": { - "x-cipp-field-source": "storage" - }, - "Results": { - "x-cipp-field-source": "backend" - }, - "RetentionDays": { - "x-cipp-field-source": "storage" - }, - "roleColours": { - "x-cipp-field-source": "storage" - }, - "RowKey": { - "x-cipp-field-source": "storage" - }, - "secondaryColour": { - "x-cipp-field-source": "storage" - }, - "showFooter": { - "x-cipp-field-source": "storage" - }, - "showPageNumbers": { - "x-cipp-field-source": "storage" - }, - "StandardsExcludeAllTenants": { - "x-cipp-field-source": "storage" - }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "Timezone": { - "x-cipp-field-source": "storage" - }, - "TimezoneSource": { - "x-cipp-field-source": "storage" - }, - "Value": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "watermarkEnabled": { - "x-cipp-field-source": "storage" - }, - "watermarkText": { - "x-cipp-field-source": "storage" - } - } + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } @@ -26398,6 +27684,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -26405,16 +27694,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AppSettings.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecMailboxMobileDevices": { + "/api/ExecHubSiteAssociation": { "post": { - "summary": "ExecMailboxMobileDevices", - "operationId": "ExecMailboxMobileDevices", + "summary": "ExecHubSiteAssociation", + "operationId": "ExecHubSiteAssociation", "tags": [ - "Email-Exchange > Administration" + "Teams-Sharepoint" ], "requestBody": { "required": true, @@ -26423,92 +27711,38 @@ "schema": { "type": "object", "properties": { - "Delete": { + "Disconnect": { "type": "string" }, - "deviceid": { + "DisplayName": { "type": "string" }, - "guid": { - "type": "string" + "HubSiteId": { + "$ref": "#/components/schemas/LabelValue" }, - "Quarantine": { + "SiteUrl": { "type": "string" }, "tenantFilter": { "type": "string" - }, - "Userid": { - "type": "string", - "description": "Interact with query parameters or the body of the request. This is a state-changing action, so the frontend dispatches it as a POST; keep the query fallback for backwards compatibility." } }, "required": [ + "Disconnect", + "SiteUrl", "tenantFilter" ] } } } }, - "parameters": [ - { - "name": "Delete", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "deviceid", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "guid", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "Quarantine", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - }, - { - "name": "Userid", - "in": "query", - "description": "Interact with query parameters or the body of the request. This is a state-changing action, so the frontend dispatches it as a POST; keep the query fallback for backwards compatibility.", - "required": false, - "schema": { - "type": "string" - } - } - ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { - "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", - "properties": { - "Results": { - "x-cipp-field-source": "backend" - } - } + "$ref": "#/components/schemas/StandardResults" } } } @@ -26518,6 +27752,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -26525,15 +27762,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecMailboxRestore": { + "/api/ExecHVEUser": { "post": { - "summary": "ExecMailboxRestore", - "operationId": "ExecMailboxRestore", + "summary": "ExecHVEUser", + "operationId": "ExecHVEUser", "tags": [ - "Email-Exchange > Tools" + "Email-Exchange > Administration" ], "requestBody": { "required": true, @@ -26543,107 +27780,59 @@ "type": "object", "properties": { "Action": { - "type": "string" - }, - "AssociatedMessagesCopyOption": { - "$ref": "#/components/schemas/LabelValue" - }, - "BadItemLimit": { - "type": "integer" - }, - "BatchName": { - "type": "string" - }, - "CompletedRequestAgeLimit": { - "type": "string" + "type": "string", + "enum": [ + "AssignBillingPolicy", + "Edit", + "Remove", + "RemoveBillingPolicy" + ] }, - "ConflictResolutionOption": { + "BillingPolicyId": { "$ref": "#/components/schemas/LabelValue" }, - "ExcludeDumpster": { + "DisplayName": { "type": "string" }, - "ExcludeFolders": { + "domain": { "$ref": "#/components/schemas/LabelValue" }, "Identity": { "type": "string" }, - "IncludeFolders": { - "$ref": "#/components/schemas/LabelValue" - }, - "LargeItemLimit": { - "type": "integer" - }, - "RequestName": { - "type": "string" - }, - "SourceIsArchive": { - "type": "string" - }, - "SourceMailbox": { - "$ref": "#/components/schemas/LabelValue" - }, - "SourceRootFolder": { + "password": { "type": "string" }, - "TargetIsArchive": { - "type": "string" + "PrimarySmtpAddress": { + "type": "string", + "description": "Build PrimarySmtpAddress from username + domain fields, or use direct value" }, - "TargetMailbox": { - "$ref": "#/components/schemas/LabelValue" + "ReplyTo": { + "type": "string", + "description": "Set-HVEAccountSettings supports ReplyTo only" }, - "TargetRootFolder": { + "TenantFilter": { "type": "string" }, - "TargetType": { - "$ref": "#/components/schemas/LabelValue" - }, - "TenantFilter": { + "username": { "type": "string" } }, "required": [ + "Identity", "TenantFilter" ] } } } }, - "parameters": [ - { - "name": "Action", - "in": "query", - "required": false, - "schema": { - "type": "string", - "enum": [ - "Remove", - "Resume", - "Suspend" - ] - } - }, - { - "name": "Identity", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - } - ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { - "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "$ref": "#/components/schemas/StandardResults" } } } @@ -26663,42 +27852,36 @@ "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecMailQuarantineSubmit": { - "post": { - "summary": "ExecMailQuarantineSubmit", - "operationId": "ExecMailQuarantineSubmit", + "/api/ExecIncidentsList": { + "get": { + "summary": "ExecIncidentsList", + "operationId": "ExecIncidentsList", "tags": [ - "Email-Exchange > Spamfilter" + "Security > Incidents" ], - "description": "Submits a quarantined email message to Microsoft for review (threat submission) via the Graph API.", - "requestBody": { - "required": true, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "category": { - "$ref": "#/components/schemas/LabelValue" - }, - "Identity": { - "type": "string" - }, - "RecipientAddress": { - "type": "string" - }, - "tenantFilter": { - "type": "string" - } - }, - "required": [ - "Identity", - "tenantFilter" - ] - } + "parameters": [ + { + "name": "EndDate", + "in": "query", + "description": "YYYYMMDD or null", + "required": false, + "schema": { + "type": "string" } + }, + { + "name": "StartDate", + "in": "query", + "description": "YYYYMMDD or null", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" } - }, + ], "responses": { "200": { "description": "Success", @@ -26706,93 +27889,144 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { - "adminReview": { - "type": "object", + "Alert": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "assignedTo": { + "type": "string", "x-cipp-field-source": "graph-entity" }, - "attackSimulationInfo": { + "classification": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "category": { - "type": "object", + "comments": { + "type": "array", "x-cipp-field-source": "graph-entity" }, - "clientSource": { - "type": "object", + "Created": { + "x-cipp-field-source": "frontend" + }, + "createdDateTime": { + "type": "string", "x-cipp-field-source": "graph-entity" }, - "contentType": { - "type": "object", + "customTags": { + "type": "array", "x-cipp-field-source": "graph-entity" }, - "createdBy": { + "description": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "determination": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "createdDateTime": { + "DisplayName": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "graph-entity,frontend" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" }, "id": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "graph-entity,frontend" }, - "internetMessageId": { + "Incident": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "IncidentUrl": { + "x-cipp-field-source": "frontend" + }, + "incidentWebUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "originalCategory": { - "type": "object", + "lastModifiedBy": { + "type": "string", "x-cipp-field-source": "graph-entity" }, - "receivedDateTime": { + "lastUpdateDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "recipientEmailAddress": { + "MdoAlert": { "type": "string", + "x-cipp-field-source": "storage" + }, + "Metadata": { + "x-cipp-field-source": "backend" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "priorityScore": { + "type": "integer", "x-cipp-field-source": "graph-entity" }, - "result": { - "type": "object", + "recommendedActions": { + "type": "string", "x-cipp-field-source": "graph-entity" }, - "Results": { - "x-cipp-field-source": "backend" + "recommendedHuntingQueries": { + "type": "array", + "x-cipp-field-source": "graph-entity" }, - "sender": { + "redirectIncidentId": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "senderIP": { + "resolvingComment": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "source": { + "Results": { + "x-cipp-field-source": "backend" + }, + "RowKey": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Severity": { "type": "object", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "graph-entity,frontend" }, - "status": { + "Status": { "type": "object", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "graph-entity,frontend" }, - "subject": { + "summary": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "tenantAllowOrBlockListAction": { - "type": "object", + "systemTags": { + "type": "array", "x-cipp-field-source": "graph-entity" }, + "Tags": { + "x-cipp-field-source": "frontend" + }, + "Tenant": { + "type": "string", + "x-cipp-field-source": "storage,frontend" + }, "tenantId": { "type": "string", "x-cipp-field-source": "graph-entity" - } - } - } + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + } + } + } } } }, @@ -26801,9 +28035,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -26811,27 +28042,86 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.SpamFilter.ReadWrite" + "x-cipp-role": "Security.Incident.Read" } }, - "/api/ExecMailTest": { - "get": { - "summary": "ExecMailTest", - "operationId": "ExecMailTest", + "/api/ExecIntegrationTemplate": { + "post": { + "summary": "ExecIntegrationTemplate", + "operationId": "ExecIntegrationTemplate", "tags": [ - "Email-Exchange > Tools" + "Tenant > Administration > Integration Templates" ], - "description": "Checks the mailbox configuration behind CIPP's message trace tooling. Action=CheckConfig reports whether the CIPP-SAM app holds the delegated Mail.Read permission and which mailbox the current token resolves to.", + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "action": { + "type": "string", + "enum": [ + "delete", + "duplicate", + "save" + ] + }, + "appNamePattern": { + "type": "string" + }, + "description": { + "type": "string" + }, + "documentationUrl": { + "type": "string" + }, + "generateSecret": { + "type": "string" + }, + "id": { + "type": "string" + }, + "name": { + "type": "string", + "description": "Validate required fields" + }, + "permissions": { + "type": "array", + "items": { + "type": "string" + } + }, + "redirectUris": { + "type": "string" + }, + "secretExpirationDays": { + "type": "string" + } + }, + "required": [ + "id", + "name" + ] + } + } + } + }, "parameters": [ { - "name": "Action", + "name": "action", "in": "query", "required": false, "schema": { - "type": "string", - "enum": [ - "CheckConfig" - ] + "type": "string" + } + }, + { + "name": "id", + "in": "query", + "required": false, + "schema": { + "type": "string" } } ], @@ -26842,28 +28132,53 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "Count": { - "x-cipp-field-source": "backend" + "ContentHash": { + "x-cipp-field-source": "storage" }, - "HasMailRead": { - "x-cipp-field-source": "backend" + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" }, - "MailAddresses": { - "x-cipp-field-source": "backend" + "GUID": { + "x-cipp-field-source": "storage" }, - "MailUser": { - "x-cipp-field-source": "backend" + "JSON": { + "x-cipp-field-source": "storage" }, - "Message": { - "x-cipp-field-source": "backend" + "Package": { + "x-cipp-field-source": "storage" }, - "Metadata": { - "x-cipp-field-source": "backend" + "PartitionKey": { + "x-cipp-field-source": "storage" }, - "Results": { - "x-cipp-field-source": "backend" + "Permissions": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "SHA": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Source": { + "x-cipp-field-source": "storage" + }, + "SourcePath": { + "x-cipp-field-source": "storage" + }, + "TemplateName": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "UpdatedBy": { + "x-cipp-field-source": "storage" } } } @@ -26885,43 +28200,59 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.Read" + "x-cipp-role": "Tenant.Application.ReadWrite", + "x-cipp-any-tenant": true } }, - "/api/ExecMaintenanceScripts": { - "get": { - "summary": "ExecMaintenanceScripts", - "operationId": "ExecMaintenanceScripts", + "/api/ExecIRMConfiguration": { + "post": { + "summary": "ExecIRMConfiguration", + "operationId": "ExecIRMConfiguration", "tags": [ - "CIPP > Settings" + "Email-Exchange > Tools" ], - "description": "Returns the maintenance scripts shipped with CIPP. Called without ScriptFile it lists the available scripts; with one it returns that script with the deployment's own tenant, subscription and resource details substituted in. MakeLink stores the result behind a one-time link instead.", - "parameters": [ - { - "name": "MakeLink", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "ScriptFile", - "in": "query", - "required": false, - "schema": { - "type": "string" + "description": "Updates the Microsoft Purview Message Encryption configuration for a tenant (AzureRMSLicensingEnabled, SimplifiedClientAccessEnabled, EnablePdfEncryption, DecryptAttachmentForEncryptOnly, SimplifiedClientAccessDoNotForwardDisabled, SimplifiedClientAccessEncryptOnlyDisabled, TransportDecryptionSetting; only the settings present in the body are changed), or runs Test-IRMConfiguration to verify that encryption and decryption work end to end.", + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "Action": { + "type": "string", + "enum": [ + "Set", + "Test" + ] + }, + "Recipient": { + "type": "string" + }, + "Sender": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + }, + "TransportDecryptionSetting": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] + } } } - ], + }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { - "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "$ref": "#/components/schemas/StandardResults" } } } @@ -26931,6 +28262,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -26938,16 +28272,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AppSettings.Read" + "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecManageAppCredentials": { + "/api/ExecJITAdmin": { "post": { - "summary": "ExecManageAppCredentials", - "operationId": "ExecManageAppCredentials", + "summary": "ExecJITAdmin", + "operationId": "ExecJITAdmin", "tags": [ - "Tenant > Administration > Application Approval" + "Identity > Administration > Users" ], + "description": "Just-in-time admin management API endpoint. This function can create users, add roles, remove roles, delete, or disable a user.", "requestBody": { "required": true, "content": { @@ -26955,45 +28290,61 @@ "schema": { "type": "object", "properties": { - "Action": { - "type": "string", - "enum": [ - "Add", - "Remove", - "Rotate" - ] + "AdminRoles": { + "type": "array", + "items": { + "$ref": "#/components/schemas/LabelValue" + }, + "description": "Enforce the caller's allowed JIT roles (from the JIT Role Template on their custom role). Get-CIPPJITAdminAllowedRoles is authoritative and fails closed for restricted callers, so we trust its result rather than swallowing errors here." }, - "AppId": { + "Domain": { + "$ref": "#/components/schemas/LabelValue" + }, + "EndDate": { "type": "string" }, - "AppType": { - "type": "string", - "description": "applications | servicePrincipals" + "existingUser": { + "$ref": "#/components/schemas/LabelValue" }, - "CredentialType": { - "type": "string", - "description": "password | key" + "ExpireAction": { + "$ref": "#/components/schemas/LabelValue" }, - "DisplayName": { + "FirstName": { "type": "string" }, - "EndDateTime": { - "type": "string" + "GroupMemberships": { + "$ref": "#/components/schemas/LabelValue" }, - "ExpiryDate": { + "LastName": { "type": "string" }, - "ExpiryMonths": { - "$ref": "#/components/schemas/LabelValue" + "PostExecution": { + "type": "boolean" }, - "Id": { + "reason": { "type": "string" }, - "KeyId": { + "StartDate": { "type": "string" }, + "tapLifetimeInMinutes": { + "type": "integer" + }, "tenantFilter": { + "$ref": "#/components/schemas/LabelValue" + }, + "usageLocation": { + "$ref": "#/components/schemas/LabelValue" + }, + "userAction": { + "type": "string" + }, + "Username": { "type": "string" + }, + "UseTAP": { + "type": "string", + "description": "Region TAP creation" } }, "required": [ @@ -27014,14 +28365,14 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -27029,85 +28380,42 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Application.ReadWrite" + "x-cipp-role": "Identity.Role.ReadWrite" } }, - "/api/ExecManageRetentionPolicies": { + "/api/ExecJITAdminSettings": { "post": { - "summary": "ExecManageRetentionPolicies", - "operationId": "ExecManageRetentionPolicies", + "summary": "ExecJITAdminSettings", + "operationId": "ExecJITAdminSettings", "tags": [ - "Email-Exchange > Administration > Mailbox Retention" + "CIPP > Settings" ], "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { - "CreatePolicies": { - "type": "array", - "items": { - "type": "object", - "properties": { - "AddTags": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Handle tag modifications - need to get current policy first for add/remove operations" - }, - "Identity": { - "type": "string" - }, - "Name": { - "type": "string" - }, - "RemoveTags": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Handle tag modifications - need to get current policy first for add/remove operations" - }, - "RetentionPolicyTagLinks": { - "type": "string" - } - } - }, - "description": "Create Retention Policies" - }, - "DeletePolicies": { - "type": "string", - "description": "Delete Retention Policies" - }, - "ModifyPolicies": { - "type": "string", - "description": "Modify Retention Policies" - }, - "tenantFilter": { + "Action": { "type": "string" + }, + "MaxDuration": { + "$ref": "#/components/schemas/LabelValue" } - }, - "required": [ - "tenantFilter" - ] + } } } } }, "parameters": [ { - "name": "name", + "name": "Action", "in": "query", "required": false, "schema": { "type": "string" } - }, - { - "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -27117,7 +28425,109 @@ "application/json": { "schema": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "ApplicationId": { + "x-cipp-field-source": "storage" + }, + "colour": { + "x-cipp-field-source": "storage" + }, + "coverFooterText": { + "x-cipp-field-source": "storage" + }, + "coverImage": { + "x-cipp-field-source": "storage" + }, + "coverImageId": { + "x-cipp-field-source": "storage" + }, + "coverImageIds": { + "x-cipp-field-source": "storage" + }, + "coverStock": { + "x-cipp-field-source": "storage" + }, + "coverUploads": { + "x-cipp-field-source": "storage" + }, + "Enabled": { + "type": "boolean", + "x-cipp-field-source": "storage" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "footerText": { + "x-cipp-field-source": "storage" + }, + "logo": { + "x-cipp-field-source": "storage" + }, + "logoImageId": { + "x-cipp-field-source": "storage" + }, + "logoImageIds": { + "x-cipp-field-source": "storage" + }, + "logoUploads": { + "x-cipp-field-source": "storage" + }, + "MaxDuration": { + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "reportDefaults": { + "x-cipp-field-source": "storage" + }, + "Resolver": { + "x-cipp-field-source": "storage" + }, + "RetentionDays": { + "x-cipp-field-source": "storage" + }, + "roleColours": { + "x-cipp-field-source": "storage" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "secondaryColour": { + "x-cipp-field-source": "storage" + }, + "showFooter": { + "x-cipp-field-source": "storage" + }, + "showPageNumbers": { + "x-cipp-field-source": "storage" + }, + "StandardsExcludeAllTenants": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Timezone": { + "x-cipp-field-source": "storage" + }, + "TimezoneSource": { + "x-cipp-field-source": "storage" + }, + "Value": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "watermarkEnabled": { + "x-cipp-field-source": "storage" + }, + "watermarkText": { + "x-cipp-field-source": "storage" + } + } } } } @@ -27140,16 +28550,18 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.RetentionPolicies.ReadWrite" + "x-cipp-role": "CIPP.AppSettings.ReadWrite", + "x-cipp-any-tenant": true } }, - "/api/ExecManageRetentionTags": { + "/api/ExecLicensePricing": { "post": { - "summary": "ExecManageRetentionTags", - "operationId": "ExecManageRetentionTags", + "summary": "ExecLicensePricing", + "operationId": "ExecLicensePricing", "tags": [ - "Email-Exchange > Administration > Mailbox Retention" + "Tenant > Reports" ], + "description": "Manage MSP-global license price overrides used by the license optimization report.\nSetPrice upserts a per-SKU monthly price; RemovePrice deletes an override so the SKU falls\nback to the shipped MSRP estimate. BulkImport validates or applies a pricing CSV batch.", "requestBody": { "required": true, "content": { @@ -27157,85 +28569,64 @@ "schema": { "type": "object", "properties": { - "CreateTags": { + "Action": { + "type": "string", + "enum": [ + "BulkImport", + "RemovePrice", + "SetPrice" + ], + "description": "SetPrice, RemovePrice, or BulkImport" + }, + "Currency": { + "type": "string", + "description": "Overrides are currency-scoped: one row per (skuId, currency), so an AUD override and a USD override for the same SKU coexist. RowKey = \"{skuId}-{currency}\"." + }, + "MonthlyPrice": { + "type": "number", + "description": "Monthly price per seat, in the given currency" + }, + "Mode": { + "type": "string", + "enum": [ + "Validate", + "Apply" + ], + "description": "BulkImport validation or apply operation" + }, + "Product_Display_Name": { + "type": "string" + }, + "Rows": { "type": "array", "items": { "type": "object", "properties": { - "AgeLimitForRetention": { - "type": "number" - }, - "Comment": { - "type": "string" - }, - "Identity": { - "type": "string" - }, - "LocalizedComment": { - "type": "string" - }, - "LocalizedRetentionPolicyTagName": { - "type": "string" - }, - "Name": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Common validations for both create and modify" - }, - "RetentionAction": { - "type": "string", - "enum": [ - "DeleteAndAllowRecovery", - "MoveToArchive", - "PermanentlyDelete" - ], - "description": "Validate RetentionAction compatibility with Type (only for creation)" - }, - "RetentionEnabled": { - "type": "boolean", - "description": "Validate RetentionEnabled and RetentionAction relationship (only for creation)" - }, - "Type": { - "type": "string" - } - } - }, - "description": "Create Retention Tags" - }, - "DeleteTags": { - "type": "string", - "description": "Delete Retention Tags" + "Currency": { "type": "string" }, + "CurrentPrice": { "type": ["number", "null"] }, + "MonthlyPrice": { "type": ["number", "string", "null"] }, + "Product_Display_Name": { "type": "string" }, + "skuId": { "type": "string" }, + "skuPartNumber": { "type": "string" } + }, + "required": ["Currency", "MonthlyPrice", "Product_Display_Name", "skuId", "skuPartNumber"] + } }, - "ModifyTags": { + "skuId": { "type": "string", - "description": "Modify Retention Tags" + "description": "The SKU GUID (skuId) the price applies to" }, - "tenantFilter": { + "skuPartNumber": { "type": "string" } }, "required": [ - "tenantFilter" + "Action" ] } } } }, - "parameters": [ - { - "name": "name", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - } - ], "responses": { "200": { "description": "Success", @@ -27243,7 +28634,44 @@ "application/json": { "schema": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "Currency": { + "x-cipp-field-source": "storage" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "MonthlyPrice": { + "type": "number", + "x-cipp-field-source": "storage" + }, + "Updated": { "type": "integer" }, + "Unchanged": { "type": "integer" }, + "Failed": { "type": "integer" }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Product_Display_Name": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "skuId": { + "x-cipp-field-source": "storage" + }, + "skuPartNumber": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + } + } } } } @@ -27266,57 +28694,36 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.RetentionPolicies.ReadWrite" + "x-cipp-role": "Tenant.Directory.ReadWrite", + "x-cipp-any-tenant": true } }, - "/api/ExecMcp": { + "/api/ExecLicenseSearch": { "post": { - "summary": "Model Context Protocol (MCP) server endpoint for CIPP.", - "operationId": "ExecMcp", + "summary": "ExecLicenseSearch", + "operationId": "ExecLicenseSearch", "tags": [ - "CIPP > MCP" + "CIPP > Core" ], - "description": "A Streamable-HTTP MCP server running in JSON response mode (no SSE). It exposes\nCIPP's read-only API surface as MCP tools, projected at runtime from openapi.json.\n\nEvery 'tools/call' is re-dispatched through New-CippCoreRequest using the caller's\nown principal headers, so the standard RBAC and tenant scoping in Test-CIPPAccess\nis enforced for each tool exactly as it would be for a normal API request. This\nendpoint's own role (CIPP.Core.Read) is only the floor required to use MCP at all.", + "description": "Resolves licence SKU ids to display names from the licence name table, falling back to the given tenant's cached licence overview. Takes an array of skuIds in the body.", "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { - "id": { - "type": "string" + "skuIds": { + "type": "array", + "items": { + "type": "string" + } }, - "method": { + "tenantFilter": { "type": "string", - "enum": [ - "initialize", - "ping", - "tools/call", - "tools/list" - ] - }, - "params": { - "type": "object", - "properties": { - "arguments": { - "type": "string", - "description": "Craft accounts MCP egress per tool (and per Graph resource) off X-Craft-Endpoint." - }, - "name": { - "type": "string", - "description": "Craft accounts MCP egress per tool (and per Graph resource) off X-Craft-Endpoint." - }, - "protocolVersion": { - "type": "string" - } - }, - "description": "Craft accounts MCP egress per tool (and per Graph resource) off X-Craft-Endpoint." + "description": "Tenant whose cached licence overview is checked for SKUs the name table does not hold yet" } - }, - "required": [ - "method" - ] + } } } } @@ -27333,9 +28740,6 @@ } } }, - "202": { - "description": "Accepted - work was queued and runs asynchronously" - }, "400": { "description": "Bad request - missing required field or invalid input" }, @@ -27345,8 +28749,8 @@ "403": { "description": "Forbidden - caller lacks the required RBAC role" }, - "405": { - "description": "MethodNotAllowed" + "500": { + "description": "Internal server error" } }, "security": [ @@ -27358,19 +28762,24 @@ "x-cipp-any-tenant": true } }, - "/api/ExecMDOAlertsList": { - "get": { - "summary": "ExecMDOAlertsList", - "operationId": "ExecMDOAlertsList", + "/api/ExecListAppId": { + "post": { + "summary": "ExecListAppId", + "operationId": "ExecListAppId", "tags": [ - "Security > Incidents" + "CIPP > Setup" ], - "description": "Lists Microsoft Defender for Office 365 and Defender for Endpoint alerts for a tenant, filtered to those service sources. tenantFilter=AllTenants reads the cached alert table rather than querying each tenant live.", - "parameters": [ - { - "$ref": "#/components/parameters/tenantFilter" + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": {} + } + } } - ], + }, "responses": { "200": { "description": "Success", @@ -27378,84 +28787,78 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { - "actorDisplayName": { - "type": "string", + "addIns": { + "type": "array", "x-cipp-field-source": "graph-entity" }, - "additionalData": { + "api": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "affectedResources": { - "x-cipp-field-source": "frontend" - }, - "Alert": { - "type": "string", + "APIKey": { "x-cipp-field-source": "storage" }, - "alertPolicyId": { + "appId": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "alertWebUrl": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "ApplicationId": { + "x-cipp-field-source": "storage" }, - "assignedTo": { + "ApplicationSecret": { + "x-cipp-field-source": "storage" + }, + "applicationTemplateId": { "type": "string", - "x-cipp-field-source": "graph-entity,frontend" + "x-cipp-field-source": "graph-entity" }, - "categories": { + "appRoles": { "type": "array", "x-cipp-field-source": "graph-entity" }, - "category": { - "type": "string", - "x-cipp-field-source": "graph-entity,frontend" + "authenticationBehaviors": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "classification": { + "certification": { "type": "object", - "x-cipp-field-source": "graph-entity,frontend" + "x-cipp-field-source": "graph-entity" }, - "comments": { - "type": "array", + "createdByAppId": { + "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", - "x-cipp-field-source": "graph-entity,frontend" + "x-cipp-field-source": "graph-entity" }, - "customDetails": { - "type": "object", + "defaultRedirectUri": { + "type": "string", "x-cipp-field-source": "graph-entity" }, - "description": { + "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "detectionSource": { - "type": "object", + "description": { + "type": "string", "x-cipp-field-source": "graph-entity" }, - "detectorId": { + "disabledByMicrosoftStatus": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "determination": { - "type": "object", + "displayName": { + "type": "string", "x-cipp-field-source": "graph-entity" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, - "evidence": { - "type": "array", - "x-cipp-field-source": "graph-entity,frontend" - }, - "firstActivityDateTime": { + "groupMembershipClaims": { "type": "string", "x-cipp-field-source": "graph-entity" }, @@ -27463,106 +28866,141 @@ "type": "string", "x-cipp-field-source": "graph-entity" }, - "Incident": { - "type": "string", - "x-cipp-field-source": "storage" + "identifierUris": { + "type": "array", + "x-cipp-field-source": "graph-entity" }, - "incidentId": { - "type": "string", + "info": { + "type": "object", "x-cipp-field-source": "graph-entity" }, - "incidentWebUrl": { - "type": "string", - "x-cipp-field-source": "graph-entity,frontend" + "isDeviceOnlyAuthSupported": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" }, - "investigationState": { - "type": "object", + "isDisabled": { + "type": "boolean", "x-cipp-field-source": "graph-entity" }, - "lastActivityDateTime": { - "type": "string", + "isFallbackPublicClient": { + "type": "boolean", "x-cipp-field-source": "graph-entity" }, - "lastUpdateDateTime": { - "type": "string", + "keyCredentials": { + "type": "array", "x-cipp-field-source": "graph-entity" }, - "MdoAlert": { + "logo": { "type": "string", - "x-cipp-field-source": "storage" - }, - "Metadata": { - "x-cipp-field-source": "backend" + "x-cipp-field-source": "graph-entity" }, - "mitreTechniques": { + "managerApplications": { "type": "array", "x-cipp-field-source": "graph-entity" }, - "PartitionKey": { - "x-cipp-field-source": "storage" - }, - "productName": { - "type": "string", + "nativeAuthenticationApisEnabled": { + "type": "object", "x-cipp-field-source": "graph-entity" }, - "providerAlertId": { + "notes": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "recommendedActions": { - "type": "string", + "oauth2RequirePostResponse": { + "type": "boolean", "x-cipp-field-source": "graph-entity" }, - "resolvedDateTime": { - "type": "string", + "optionalClaims": { + "type": "object", "x-cipp-field-source": "graph-entity" }, - "Results": { - "x-cipp-field-source": "backend" + "parentalControlSettings": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "RowKey": { - "type": "string", + "PartitionKey": { "x-cipp-field-source": "storage" }, - "serviceSource": { - "type": "object", - "x-cipp-field-source": "graph-entity,frontend" + "passwordCredentials": { + "type": "array", + "x-cipp-field-source": "graph-entity" }, - "severity": { + "publicClient": { "type": "object", - "x-cipp-field-source": "graph-entity,frontend" + "x-cipp-field-source": "graph-entity" }, - "status": { + "publisherDomain": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "RefreshToken": { + "x-cipp-field-source": "storage" + }, + "requestSignatureVerification": { "type": "object", - "x-cipp-field-source": "graph-entity,frontend" + "x-cipp-field-source": "graph-entity" }, - "systemTags": { + "requiredResourceAccess": { "type": "array", "x-cipp-field-source": "graph-entity" }, - "Tenant": { + "RowKey": { "type": "string", - "x-cipp-field-source": "storage,frontend" + "x-cipp-field-source": "storage" }, - "tenantId": { + "samlMetadataUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "threatDisplayName": { + "SASUrl": { + "x-cipp-field-source": "storage" + }, + "SecretValue": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "serviceManagementReference": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "threatFamilyName": { + "servicePrincipalLockConfiguration": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "signInAudience": { "type": "string", "x-cipp-field-source": "graph-entity" }, + "spa": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "tags": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "TenantId": { + "x-cipp-field-source": "storage" + }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, - "title": { + "tokenEncryptionKeyId": { "type": "string", - "x-cipp-field-source": "graph-entity,frontend" + "x-cipp-field-source": "graph-entity" + }, + "uniqueName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "verifiedPublisher": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "web": { + "type": "object", + "x-cipp-field-source": "graph-entity" } } } @@ -27581,47 +29019,56 @@ "bearerAuth": [] } ], - "x-cipp-role": "Security.Alert.Read" + "x-cipp-role": "CIPP.Core.ReadWrite" } }, - "/api/ExecMigrateOneDriveShortCuts": { - "post": { - "summary": "ExecMigrateOneDriveShortCuts", - "operationId": "ExecMigrateOneDriveShortCuts", + "/api/ExecListBackup": { + "get": { + "summary": "ExecListBackup", + "operationId": "ExecListBackup", "tags": [ - "Identity > Administration > Users" + "CIPP > Core" ], - "requestBody": { - "required": true, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "id": { - "$ref": "#/components/schemas/LabelValue" - }, - "tenantFilter": { - "type": "string" - }, - "username": { - "$ref": "#/components/schemas/LabelValue" - } - }, - "required": [ - "tenantFilter" - ] - } + "parameters": [ + { + "name": "BackupName", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "NameOnly", + "in": "query", + "required": false, + "schema": { + "type": "boolean" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "Type", + "in": "query", + "required": false, + "schema": { + "type": "string" } } - }, + ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "array", + "items": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } } } } @@ -27641,73 +29088,41 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.ReadWrite" + "x-cipp-role": "CIPP.Backup.Read" } }, - "/api/ExecModifyCalPerms": { + "/api/ExecLogRetentionConfig": { "post": { - "summary": "ExecModifyCalPerms", - "operationId": "ExecModifyCalPerms", + "summary": "ExecLogRetentionConfig", + "operationId": "ExecLogRetentionConfig", "tags": [ - "Email-Exchange > Administration" + "CIPP > Settings" ], "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { - "permissions": { - "type": "array", - "items": { - "type": "object", - "properties": { - "CanViewPrivateItems": { - "type": "string" - }, - "DisplayName": { - "type": "string", - "description": "TargetUser may be a recipient id, so log the display name the caller saw" - }, - "FolderName": { - "type": "string" - }, - "Modification": { - "type": "string" - }, - "PermissionLevel": { - "$ref": "#/components/schemas/LabelValue" - }, - "SendNotificationToUser": { - "type": "string" - }, - "UserID": { - "type": "array", - "items": { - "$ref": "#/components/schemas/LabelValue" - }, - "description": "Handle UserID as array or single value" - } - } - } - }, - "tenantFilter": { - "type": "string" - }, - "userID": { - "type": "string", - "description": "UPN of the mailbox to modify calendar permissions for" + "RetentionDays": { + "type": "integer" } - }, - "required": [ - "tenantFilter", - "userID" - ] + } } } } }, + "parameters": [ + { + "name": "List", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], "responses": { "200": { "description": "Success", @@ -27715,383 +29130,121 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "aboutMe": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "ApplicationId": { + "x-cipp-field-source": "storage" }, - "accountEnabled": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "ageGroup": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "assignedLicenses": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "assignedPlans": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "authorizationInfo": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "birthday": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "businessPhones": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "city": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "cloudLicensing": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "cloudRealtimeCommunicationInfo": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "companyName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "consentProvidedForMinor": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "country": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "createdDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "creationType": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "customSecurityAttributes": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "deletedDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "department": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "deviceEnrollmentLimit": { - "type": "integer", - "x-cipp-field-source": "graph-entity" - }, - "deviceKeys": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "displayName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "employeeHireDate": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "employeeId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "employeeLeaveDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "employeeOrgData": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "employeeType": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "externalUserState": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "externalUserStateChangeDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "faxNumber": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "givenName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "hireDate": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "id": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "identities": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "identityGovernance": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "identityParentId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "imAddresses": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "infoCatalogs": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "interests": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "isLicenseReconciliationNeeded": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "isManagementRestricted": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "isResourceAccount": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "jobTitle": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "lastPasswordChangeDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "legalAgeGroupClassification": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "licenseAssignmentStates": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "mail": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "mailboxSettings": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "mailNickname": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "mobilePhone": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "mySite": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "officeLocation": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesDistinguishedName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesDomainName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesExtensionAttributes": { - "type": "object", - "x-cipp-field-source": "graph-entity" + "colour": { + "x-cipp-field-source": "storage" }, - "onPremisesImmutableId": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "coverFooterText": { + "x-cipp-field-source": "storage" }, - "onPremisesLastSyncDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "coverImage": { + "x-cipp-field-source": "storage" }, - "onPremisesProvisioningErrors": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "coverImageId": { + "x-cipp-field-source": "storage" }, - "onPremisesSamAccountName": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "coverImageIds": { + "x-cipp-field-source": "storage" }, - "onPremisesSecurityIdentifier": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "coverStock": { + "x-cipp-field-source": "storage" }, - "onPremisesSipInfo": { - "type": "object", - "x-cipp-field-source": "graph-entity" + "coverUploads": { + "x-cipp-field-source": "storage" }, - "onPremisesSyncEnabled": { + "Enabled": { "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesUserPrincipalName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "otherMails": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "storage" }, - "passwordPolicies": { + "ETag": { "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "passwordProfile": { - "type": "object", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "storage" }, - "pastProjects": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "footerText": { + "x-cipp-field-source": "storage" }, - "postalCode": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "logo": { + "x-cipp-field-source": "storage" }, - "preferredDataLocation": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "logoImageId": { + "x-cipp-field-source": "storage" }, - "preferredLanguage": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "logoImageIds": { + "x-cipp-field-source": "storage" }, - "preferredName": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "logoUploads": { + "x-cipp-field-source": "storage" }, - "print": { - "type": "object", - "x-cipp-field-source": "graph-entity" + "MaxDuration": { + "x-cipp-field-source": "storage" }, - "provisionedPlans": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "PartitionKey": { + "x-cipp-field-source": "storage" }, - "proxyAddresses": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "reportDefaults": { + "x-cipp-field-source": "storage" }, - "refreshTokensValidFromDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "Resolver": { + "x-cipp-field-source": "storage" }, - "responsibilities": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "Results": { + "x-cipp-field-source": "backend" }, - "schools": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "RetentionDays": { + "x-cipp-field-source": "storage" }, - "securityIdentifier": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "roleColours": { + "x-cipp-field-source": "storage" }, - "serviceProvisioningErrors": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "RowKey": { + "x-cipp-field-source": "storage" }, - "showInAddressList": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" + "secondaryColour": { + "x-cipp-field-source": "storage" }, - "signInActivity": { - "type": "object", - "x-cipp-field-source": "graph-entity" + "showFooter": { + "x-cipp-field-source": "storage" }, - "signInSessionsValidFromDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "showPageNumbers": { + "x-cipp-field-source": "storage" }, - "skills": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "StandardsExcludeAllTenants": { + "x-cipp-field-source": "storage" }, - "state": { + "Timestamp": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "storage" }, - "streetAddress": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "Timezone": { + "x-cipp-field-source": "storage" }, - "surname": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "TimezoneSource": { + "x-cipp-field-source": "storage" }, - "usageLocation": { + "Value": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "storage" }, - "userPrincipalName": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "watermarkEnabled": { + "x-cipp-field-source": "storage" }, - "userType": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "watermarkText": { + "x-cipp-field-source": "storage" } } } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "404": { - "description": "Not found" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -28099,13 +29252,14 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "CIPP.AppSettings.ReadWrite", + "x-cipp-any-tenant": true } }, - "/api/ExecModifyContactPerms": { + "/api/ExecMailboxMobileDevices": { "post": { - "summary": "ExecModifyContactPerms", - "operationId": "ExecModifyContactPerms", + "summary": "ExecMailboxMobileDevices", + "operationId": "ExecMailboxMobileDevices", "tags": [ "Email-Exchange > Administration" ], @@ -28116,56 +29270,79 @@ "schema": { "type": "object", "properties": { - "permissions": { - "type": "array", - "items": { - "type": "object", - "properties": { - "CanViewPrivateItems": { - "type": "string" - }, - "DisplayName": { - "type": "string", - "description": "TargetUser may be a recipient id, so log the display name the caller saw" - }, - "FolderName": { - "type": "string" - }, - "Modification": { - "type": "string" - }, - "PermissionLevel": { - "$ref": "#/components/schemas/LabelValue" - }, - "SendNotificationToUser": { - "type": "string" - }, - "UserID": { - "type": "array", - "items": { - "$ref": "#/components/schemas/LabelValue" - }, - "description": "Handle UserID as array or single value" - } - } - } + "Delete": { + "type": "string" + }, + "deviceid": { + "type": "string" + }, + "guid": { + "type": "string" + }, + "Quarantine": { + "type": "string" }, "tenantFilter": { "type": "string" }, - "userID": { + "Userid": { "type": "string", - "description": "UPN of the mailbox to modify contact permissions for" + "description": "Interact with query parameters or the body of the request. This is a state-changing action, so the frontend dispatches it as a POST; keep the query fallback for backwards compatibility." } }, "required": [ - "tenantFilter", - "userID" + "tenantFilter" ] } } } }, + "parameters": [ + { + "name": "Delete", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "deviceid", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "guid", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "Quarantine", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "Userid", + "in": "query", + "description": "Interact with query parameters or the body of the request. This is a state-changing action, so the frontend dispatches it as a POST; keep the query fallback for backwards compatibility.", + "required": false, + "schema": { + "type": "string" + } + } + ], "responses": { "200": { "description": "Success", @@ -28173,133 +29350,295 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "aboutMe": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "accountEnabled": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "ageGroup": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "assignedLicenses": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "assignedPlans": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "authorizationInfo": { + "Results": { + "x-cipp-field-source": "backend" + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.Mailbox.ReadWrite" + } + }, + "/api/ExecMailboxRestore": { + "post": { + "summary": "ExecMailboxRestore", + "operationId": "ExecMailboxRestore", + "tags": [ + "Email-Exchange > Tools" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "Action": { + "type": "string" + }, + "AssociatedMessagesCopyOption": { + "$ref": "#/components/schemas/LabelValue" + }, + "BadItemLimit": { + "type": "integer" + }, + "BatchName": { + "type": "string" + }, + "CompletedRequestAgeLimit": { + "type": "string" + }, + "ConflictResolutionOption": { + "$ref": "#/components/schemas/LabelValue" + }, + "ExcludeDumpster": { + "type": "string" + }, + "ExcludeFolders": { + "$ref": "#/components/schemas/LabelValue" + }, + "Identity": { + "type": "string" + }, + "IncludeFolders": { + "$ref": "#/components/schemas/LabelValue" + }, + "LargeItemLimit": { + "type": "integer" + }, + "RequestName": { + "type": "string" + }, + "SourceIsArchive": { + "type": "string" + }, + "SourceMailbox": { + "$ref": "#/components/schemas/LabelValue" + }, + "SourceRootFolder": { + "type": "string" + }, + "TargetIsArchive": { + "type": "string" + }, + "TargetMailbox": { + "$ref": "#/components/schemas/LabelValue" + }, + "TargetRootFolder": { + "type": "string" + }, + "TargetType": { + "$ref": "#/components/schemas/LabelValue" + }, + "TenantFilter": { + "type": "string" + } + }, + "required": [ + "TenantFilter" + ] + } + } + } + }, + "parameters": [ + { + "name": "Action", + "in": "query", + "required": false, + "schema": { + "type": "string", + "enum": [ + "Remove", + "Resume", + "Suspend" + ] + } + }, + { + "name": "Identity", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.Mailbox.ReadWrite" + } + }, + "/api/ExecMailboxSafeSender": { + "post": { + "summary": "ExecMailboxSafeSender", + "operationId": "ExecMailboxSafeSender", + "tags": [ + "Email-Exchange > Spamfilter" + ], + "description": "Adds a sender to a mailbox trusted/safe senders list via Set-MailboxJunkEmailConfiguration.", + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "mailbox": { + "type": "string" + }, + "sender": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.SpamFilter.ReadWrite" + } + }, + "/api/ExecMailQuarantineSubmit": { + "post": { + "summary": "ExecMailQuarantineSubmit", + "operationId": "ExecMailQuarantineSubmit", + "tags": [ + "Email-Exchange > Spamfilter" + ], + "description": "Submits a quarantined email message to Microsoft for review (threat submission) via the Graph API.", + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "category": { + "$ref": "#/components/schemas/LabelValue" + }, + "Identity": { + "type": "string" + }, + "RecipientAddress": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "Identity", + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "properties": { + "adminReview": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "birthday": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "businessPhones": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "city": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "cloudLicensing": { + "attackSimulationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "cloudRealtimeCommunicationInfo": { + "category": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "companyName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "consentProvidedForMinor": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "country": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "createdDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "creationType": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "customSecurityAttributes": { + "clientSource": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "deletedDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "department": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "deviceEnrollmentLimit": { - "type": "integer", - "x-cipp-field-source": "graph-entity" - }, - "deviceKeys": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "displayName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "employeeHireDate": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "employeeId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "employeeLeaveDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "employeeOrgData": { + "contentType": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "employeeType": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "externalUserState": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "externalUserStateChangeDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "faxNumber": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "givenName": { - "type": "string", + "createdBy": { + "type": "object", "x-cipp-field-source": "graph-entity" }, - "hireDate": { + "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, @@ -28307,229 +29646,130 @@ "type": "string", "x-cipp-field-source": "graph-entity" }, - "identities": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "identityGovernance": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "identityParentId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "imAddresses": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "infoCatalogs": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "interests": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "isLicenseReconciliationNeeded": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "isManagementRestricted": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "isResourceAccount": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "jobTitle": { + "internetMessageId": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "lastPasswordChangeDateTime": { - "type": "string", + "originalCategory": { + "type": "object", "x-cipp-field-source": "graph-entity" }, - "legalAgeGroupClassification": { + "receivedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "licenseAssignmentStates": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "mail": { + "recipientEmailAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "mailboxSettings": { + "result": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "mailNickname": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "Results": { + "x-cipp-field-source": "backend" }, - "mobilePhone": { + "sender": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "mySite": { + "senderIP": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "officeLocation": { - "type": "string", + "source": { + "type": "object", "x-cipp-field-source": "graph-entity" }, - "onPremisesDistinguishedName": { - "type": "string", + "status": { + "type": "object", "x-cipp-field-source": "graph-entity" }, - "onPremisesDomainName": { + "subject": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "onPremisesExtensionAttributes": { + "tenantAllowOrBlockListAction": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "onPremisesImmutableId": { + "tenantId": { "type": "string", "x-cipp-field-source": "graph-entity" + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.SpamFilter.ReadWrite" + } + }, + "/api/ExecMailTest": { + "get": { + "summary": "ExecMailTest", + "operationId": "ExecMailTest", + "tags": [ + "Email-Exchange > Tools" + ], + "description": "Checks the mailbox configuration behind CIPP's message trace tooling. Action=CheckConfig reports whether the CIPP-SAM app holds the delegated Mail.Read permission and which mailbox the current token resolves to.", + "parameters": [ + { + "name": "Action", + "in": "query", + "required": false, + "schema": { + "type": "string", + "enum": [ + "CheckConfig" + ] + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Count": { + "x-cipp-field-source": "backend" }, - "onPremisesLastSyncDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "HasMailRead": { + "x-cipp-field-source": "backend" }, - "onPremisesProvisioningErrors": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "MailAddresses": { + "x-cipp-field-source": "backend" }, - "onPremisesSamAccountName": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "MailUser": { + "x-cipp-field-source": "backend" }, - "onPremisesSecurityIdentifier": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "Message": { + "x-cipp-field-source": "backend" }, - "onPremisesSipInfo": { - "type": "object", - "x-cipp-field-source": "graph-entity" + "Metadata": { + "x-cipp-field-source": "backend" }, - "onPremisesSyncEnabled": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesUserPrincipalName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "otherMails": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "passwordPolicies": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "passwordProfile": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "pastProjects": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "postalCode": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "preferredDataLocation": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "preferredLanguage": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "preferredName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "print": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "provisionedPlans": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "proxyAddresses": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "refreshTokensValidFromDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "responsibilities": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "schools": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "securityIdentifier": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "serviceProvisioningErrors": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "showInAddressList": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "signInActivity": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "signInSessionsValidFromDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "skills": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "state": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "streetAddress": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "surname": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "usageLocation": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "userPrincipalName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "userType": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "Results": { + "x-cipp-field-source": "backend" } } } @@ -28544,9 +29784,147 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "CIPP.Core.Read" + } + }, + "/api/ExecMaintenanceScripts": { + "get": { + "summary": "ExecMaintenanceScripts", + "operationId": "ExecMaintenanceScripts", + "tags": [ + "CIPP > Settings" + ], + "description": "Returns the maintenance scripts shipped with CIPP. Called without ScriptFile it lists the available scripts; with one it returns that script with the deployment's own tenant, subscription and resource details substituted in. MakeLink stores the result behind a one-time link instead.", + "parameters": [ + { + "name": "MakeLink", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "ScriptFile", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "CIPP.AppSettings.Read" + } + }, + "/api/ExecManageAppCredentials": { + "post": { + "summary": "ExecManageAppCredentials", + "operationId": "ExecManageAppCredentials", + "tags": [ + "Tenant > Administration > Application Approval" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "Action": { + "type": "string", + "enum": [ + "Add", + "Remove", + "Rotate" + ] + }, + "AppId": { + "type": "string" + }, + "AppType": { + "type": "string", + "description": "applications | servicePrincipals" + }, + "CredentialType": { + "type": "string", + "description": "password | key" + }, + "DisplayName": { + "type": "string" + }, + "EndDateTime": { + "type": "string" + }, + "ExpiryDate": { + "type": "string" + }, + "ExpiryMonths": { + "$ref": "#/components/schemas/LabelValue" + }, + "Id": { + "type": "string" + }, + "KeyId": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } }, - "404": { - "description": "Not found" + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" @@ -28557,74 +29935,87 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "Tenant.Application.ReadWrite" } }, - "/api/ExecModifyMBPerms": { + "/api/ExecManageRetentionPolicies": { "post": { - "summary": "ExecModifyMBPerms", - "operationId": "ExecModifyMBPerms", + "summary": "ExecManageRetentionPolicies", + "operationId": "ExecManageRetentionPolicies", "tags": [ - "Email-Exchange > Administration" + "Email-Exchange > Administration > Mailbox Retention" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { - "type": "array", - "description": "The request body is a JSON array. Each element has the shape below.", - "items": { - "type": "object", - "properties": { - "mailboxRequests": { - "type": "string", - "description": "Bulk format with mailboxRequests property" - }, - "permissions": { - "type": "array", - "items": { - "type": "object", - "properties": { - "AutoMap": { - "type": "string" - }, - "Modification": { + "type": "object", + "properties": { + "CreatePolicies": { + "type": "array", + "items": { + "type": "object", + "properties": { + "AddTags": { + "type": "array", + "items": { "type": "string" }, - "PermissionLevel": { + "description": "Handle tag modifications - need to get current policy first for add/remove operations" + }, + "Identity": { + "type": "string" + }, + "Name": { + "type": "string" + }, + "RemoveTags": { + "type": "array", + "items": { "type": "string" }, - "UserID": { - "type": "array", - "items": { - "$ref": "#/components/schemas/LabelValue" - }, - "description": "Extract target users from UserID (handle array of objects or single values)" - } + "description": "Handle tag modifications - need to get current policy first for add/remove operations" + }, + "RetentionPolicyTagLinks": { + "type": "string" } - }, - "description": "Legacy single mailbox format" - }, - "tenantFilter": { - "type": "string" + } }, - "userID": { - "type": "string", - "description": "Legacy single mailbox format" - } + "description": "Create Retention Policies" }, - "required": [ - "tenantFilter" - ], - "additionalProperties": true, - "x-cipp-passthrough": true, - "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." - } + "DeletePolicies": { + "type": "string", + "description": "Delete Retention Policies" + }, + "ModifyPolicies": { + "type": "string", + "description": "Modify Retention Policies" + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] } } } }, + "parameters": [ + { + "name": "name", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], "responses": { "200": { "description": "Success", @@ -28632,371 +30023,3969 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", - "properties": { - "aboutMe": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "accountEnabled": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "ageGroup": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "assignedLicenses": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "assignedPlans": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "authorizationInfo": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "birthday": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "businessPhones": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "city": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "cloudLicensing": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "cloudRealtimeCommunicationInfo": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "companyName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "consentProvidedForMinor": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "country": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "createdDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "creationType": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "customSecurityAttributes": { + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.RetentionPolicies.ReadWrite" + } + }, + "/api/ExecManageRetentionTags": { + "post": { + "summary": "ExecManageRetentionTags", + "operationId": "ExecManageRetentionTags", + "tags": [ + "Email-Exchange > Administration > Mailbox Retention" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "CreateTags": { + "type": "array", + "items": { "type": "object", - "x-cipp-field-source": "graph-entity" + "properties": { + "AgeLimitForRetention": { + "type": "number" + }, + "Comment": { + "type": "string" + }, + "Identity": { + "type": "string" + }, + "LocalizedComment": { + "type": "string" + }, + "LocalizedRetentionPolicyTagName": { + "type": "string" + }, + "Name": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Common validations for both create and modify" + }, + "RetentionAction": { + "type": "string", + "enum": [ + "DeleteAndAllowRecovery", + "MoveToArchive", + "PermanentlyDelete" + ], + "description": "Validate RetentionAction compatibility with Type (only for creation)" + }, + "RetentionEnabled": { + "type": "boolean", + "description": "Validate RetentionEnabled and RetentionAction relationship (only for creation)" + }, + "Type": { + "type": "string" + } + } }, - "deletedDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "department": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "deviceEnrollmentLimit": { - "type": "integer", - "x-cipp-field-source": "graph-entity" - }, - "deviceKeys": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "displayName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "employeeHireDate": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "employeeId": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "description": "Create Retention Tags" + }, + "DeleteTags": { + "type": "string", + "description": "Delete Retention Tags" + }, + "ModifyTags": { + "type": "string", + "description": "Modify Retention Tags" + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "parameters": [ + { + "name": "name", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.RetentionPolicies.ReadWrite" + } + }, + "/api/ExecMcp": { + "post": { + "summary": "Model Context Protocol (MCP) server endpoint for CIPP.", + "operationId": "ExecMcp", + "tags": [ + "CIPP > MCP" + ], + "description": "A Streamable-HTTP MCP server running in JSON response mode (no SSE). It exposes\nCIPP's read-only API surface as MCP tools, projected at runtime from openapi.json.\n\nEvery 'tools/call' is re-dispatched through New-CippCoreRequest using the caller's\nown principal headers, so the standard RBAC and tenant scoping in Test-CIPPAccess\nis enforced for each tool exactly as it would be for a normal API request. This\nendpoint's own role (CIPP.Core.Read) is only the floor required to use MCP at all.", + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "method": { + "type": "string", + "enum": [ + "initialize", + "ping", + "tools/call", + "tools/list" + ] + }, + "params": { + "type": "object", + "properties": { + "arguments": { + "type": "string", + "description": "Craft accounts MCP egress per tool (and per Graph resource) off X-Craft-Endpoint." + }, + "name": { + "type": "string", + "description": "Craft accounts MCP egress per tool (and per Graph resource) off X-Craft-Endpoint." + }, + "protocolVersion": { + "type": "string" + } }, - "employeeLeaveDateTime": { + "description": "Craft accounts MCP egress per tool (and per Graph resource) off X-Craft-Endpoint." + } + }, + "required": [ + "method" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + }, + "202": { + "description": "Accepted - work was queued and runs asynchronously" + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "405": { + "description": "MethodNotAllowed" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "CIPP.Core.Read", + "x-cipp-any-tenant": true + } + }, + "/api/ExecMDOAlertsList": { + "get": { + "summary": "ExecMDOAlertsList", + "operationId": "ExecMDOAlertsList", + "tags": [ + "Security > Incidents" + ], + "description": "Lists Microsoft Defender for Office 365 and Defender for Endpoint alerts for a tenant, filtered to those service sources. tenantFilter=AllTenants reads the cached alert table rather than querying each tenant live.", + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "properties": { + "actorDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "employeeOrgData": { + "additionalData": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "employeeType": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "externalUserState": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "externalUserStateChangeDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "affectedResources": { + "x-cipp-field-source": "frontend" }, - "faxNumber": { + "Alert": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "storage" }, - "givenName": { + "alertPolicyId": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "hireDate": { + "alertWebUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "id": { + "assignedTo": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "graph-entity,frontend" }, - "identities": { + "categories": { "type": "array", "x-cipp-field-source": "graph-entity" }, - "identityGovernance": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "identityParentId": { + "category": { "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "imAddresses": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "graph-entity,frontend" }, - "infoCatalogs": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "classification": { + "type": "object", + "x-cipp-field-source": "graph-entity,frontend" }, - "interests": { + "comments": { "type": "array", "x-cipp-field-source": "graph-entity" }, - "isLicenseReconciliationNeeded": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "isManagementRestricted": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "isResourceAccount": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "jobTitle": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "lastPasswordChangeDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "legalAgeGroupClassification": { + "createdDateTime": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "graph-entity,frontend" }, - "licenseAssignmentStates": { - "type": "array", + "customDetails": { + "type": "object", "x-cipp-field-source": "graph-entity" }, - "mail": { + "description": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "mailboxSettings": { + "detectionSource": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "mailNickname": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "mobilePhone": { + "detectorId": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "mySite": { - "type": "string", + "determination": { + "type": "object", "x-cipp-field-source": "graph-entity" }, - "officeLocation": { + "ETag": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "storage" }, - "onPremisesDistinguishedName": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "evidence": { + "type": "array", + "x-cipp-field-source": "graph-entity,frontend" }, - "onPremisesDomainName": { + "firstActivityDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "onPremisesExtensionAttributes": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesImmutableId": { + "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "onPremisesLastSyncDateTime": { + "Incident": { "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesProvisioningErrors": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "storage" }, - "onPremisesSamAccountName": { + "incidentId": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "onPremisesSecurityIdentifier": { + "incidentWebUrl": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "graph-entity,frontend" }, - "onPremisesSipInfo": { + "investigationState": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "onPremisesSyncEnabled": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesUserPrincipalName": { + "lastActivityDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "otherMails": { - "type": "array", + "lastUpdateDateTime": { + "type": "string", "x-cipp-field-source": "graph-entity" }, - "passwordPolicies": { + "MdoAlert": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "storage" }, - "passwordProfile": { - "type": "object", - "x-cipp-field-source": "graph-entity" + "Metadata": { + "x-cipp-field-source": "backend" }, - "pastProjects": { + "mitreTechniques": { "type": "array", "x-cipp-field-source": "graph-entity" }, - "postalCode": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "PartitionKey": { + "x-cipp-field-source": "storage" }, - "preferredDataLocation": { + "productName": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "preferredLanguage": { + "providerAlertId": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "preferredName": { + "recommendedActions": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "print": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "provisionedPlans": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "proxyAddresses": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "refreshTokensValidFromDateTime": { + "resolvedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "responsibilities": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, "Results": { "x-cipp-field-source": "backend" }, - "schools": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "securityIdentifier": { + "RowKey": { "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "serviceProvisioningErrors": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "storage" }, - "showInAddressList": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" + "serviceSource": { + "type": "object", + "x-cipp-field-source": "graph-entity,frontend" }, - "signInActivity": { + "severity": { "type": "object", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "graph-entity,frontend" }, - "signInSessionsValidFromDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "status": { + "type": "object", + "x-cipp-field-source": "graph-entity,frontend" }, - "skills": { + "systemTags": { "type": "array", "x-cipp-field-source": "graph-entity" }, - "state": { + "Tenant": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "storage,frontend" }, - "streetAddress": { + "tenantId": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "surname": { + "threatDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "usageLocation": { + "threatFamilyName": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "userPrincipalName": { + "Timestamp": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "storage" + }, + "title": { + "type": "string", + "x-cipp-field-source": "graph-entity,frontend" + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Security.Alert.Read" + } + }, + "/api/ExecMigrateOneDriveShortCuts": { + "post": { + "summary": "ExecMigrateOneDriveShortCuts", + "operationId": "ExecMigrateOneDriveShortCuts", + "tags": [ + "Identity > Administration > Users" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "id": { + "$ref": "#/components/schemas/LabelValue" + }, + "tenantFilter": { + "type": "string" + }, + "username": { + "$ref": "#/components/schemas/LabelValue" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Identity.User.ReadWrite" + } + }, + "/api/ExecModifyCalPerms": { + "post": { + "summary": "ExecModifyCalPerms", + "operationId": "ExecModifyCalPerms", + "tags": [ + "Email-Exchange > Administration" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "permissions": { + "type": "array", + "items": { + "type": "object", + "properties": { + "AclUserName": { + "type": "string" + }, + "CanViewPrivateItems": { + "type": "string" + }, + "FolderName": { + "type": "string" + }, + "Modification": { + "type": "string" + }, + "PermissionLevel": { + "$ref": "#/components/schemas/LabelValue" + }, + "SendNotificationToUser": { + "type": "string" + }, + "UserAclName": { + "type": "string" + }, + "UserID": { + "type": "array", + "items": { + "$ref": "#/components/schemas/LabelValue" + }, + "description": "Handle UserID as array or single value" + } + } + } + }, + "tenantFilter": { + "type": "string" + }, + "userID": { + "type": "string", + "description": "UPN of the mailbox to modify calendar permissions for" + } + }, + "required": [ + "tenantFilter", + "userID" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "properties": { + "aboutMe": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "accountEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "ageGroup": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "assignedLicenses": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "assignedPlans": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "authorizationInfo": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "birthday": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "businessPhones": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "city": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "cloudLicensing": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "cloudRealtimeCommunicationInfo": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "companyName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "consentProvidedForMinor": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "country": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "createdDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "creationType": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "customSecurityAttributes": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "deletedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "department": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "deviceEnrollmentLimit": { + "type": "integer", + "x-cipp-field-source": "graph-entity" + }, + "deviceKeys": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "displayName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeHireDate": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeLeaveDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeOrgData": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "employeeType": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "externalUserState": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "externalUserStateChangeDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "faxNumber": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "givenName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "hireDate": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "identities": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "identityGovernance": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "identityParentId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "imAddresses": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "infoCatalogs": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "interests": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "isLicenseReconciliationNeeded": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isManagementRestricted": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isResourceAccount": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "jobTitle": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "lastPasswordChangeDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "legalAgeGroupClassification": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "licenseAssignmentStates": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "mail": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "mailboxSettings": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "mailNickname": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "mobilePhone": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "mySite": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "officeLocation": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesDistinguishedName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesDomainName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesExtensionAttributes": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesImmutableId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesLastSyncDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesProvisioningErrors": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSamAccountName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSecurityIdentifier": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSipInfo": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSyncEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesUserPrincipalName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "otherMails": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "passwordPolicies": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "passwordProfile": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "pastProjects": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "postalCode": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "preferredDataLocation": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "preferredLanguage": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "preferredName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "print": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "provisionedPlans": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "proxyAddresses": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "refreshTokensValidFromDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "responsibilities": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "schools": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "securityIdentifier": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "serviceProvisioningErrors": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "showInAddressList": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "signInActivity": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "signInSessionsValidFromDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "skills": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "state": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "streetAddress": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "surname": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "usageLocation": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "userPrincipalName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "userType": { + "type": "string", + "x-cipp-field-source": "graph-entity" + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "404": { + "description": "Not found" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.Mailbox.ReadWrite" + } + }, + "/api/ExecModifyContactPerms": { + "post": { + "summary": "ExecModifyContactPerms", + "operationId": "ExecModifyContactPerms", + "tags": [ + "Email-Exchange > Administration" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "permissions": { + "type": "array", + "items": { + "type": "object", + "properties": { + "AclUserName": { + "type": "string" + }, + "CanViewPrivateItems": { + "type": "string" + }, + "FolderName": { + "type": "string" + }, + "Modification": { + "type": "string" + }, + "PermissionLevel": { + "$ref": "#/components/schemas/LabelValue" + }, + "SendNotificationToUser": { + "type": "string" + }, + "UserAclName": { + "type": "string" + }, + "UserID": { + "type": "array", + "items": { + "$ref": "#/components/schemas/LabelValue" + }, + "description": "Handle UserID as array or single value" + } + } + } + }, + "tenantFilter": { + "type": "string" + }, + "userID": { + "type": "string", + "description": "UPN of the mailbox to modify contact permissions for" + } + }, + "required": [ + "tenantFilter", + "userID" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "properties": { + "aboutMe": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "accountEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "ageGroup": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "assignedLicenses": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "assignedPlans": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "authorizationInfo": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "birthday": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "businessPhones": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "city": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "cloudLicensing": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "cloudRealtimeCommunicationInfo": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "companyName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "consentProvidedForMinor": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "country": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "createdDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "creationType": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "customSecurityAttributes": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "deletedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "department": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "deviceEnrollmentLimit": { + "type": "integer", + "x-cipp-field-source": "graph-entity" + }, + "deviceKeys": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "displayName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeHireDate": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeLeaveDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeOrgData": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "employeeType": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "externalUserState": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "externalUserStateChangeDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "faxNumber": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "givenName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "hireDate": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "identities": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "identityGovernance": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "identityParentId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "imAddresses": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "infoCatalogs": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "interests": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "isLicenseReconciliationNeeded": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isManagementRestricted": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isResourceAccount": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "jobTitle": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "lastPasswordChangeDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "legalAgeGroupClassification": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "licenseAssignmentStates": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "mail": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "mailboxSettings": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "mailNickname": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "mobilePhone": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "mySite": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "officeLocation": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesDistinguishedName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesDomainName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesExtensionAttributes": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesImmutableId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesLastSyncDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesProvisioningErrors": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSamAccountName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSecurityIdentifier": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSipInfo": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSyncEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesUserPrincipalName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "otherMails": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "passwordPolicies": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "passwordProfile": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "pastProjects": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "postalCode": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "preferredDataLocation": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "preferredLanguage": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "preferredName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "print": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "provisionedPlans": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "proxyAddresses": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "refreshTokensValidFromDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "responsibilities": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "schools": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "securityIdentifier": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "serviceProvisioningErrors": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "showInAddressList": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "signInActivity": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "signInSessionsValidFromDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "skills": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "state": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "streetAddress": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "surname": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "usageLocation": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "userPrincipalName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "userType": { + "type": "string", + "x-cipp-field-source": "graph-entity" + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "404": { + "description": "Not found" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.Mailbox.ReadWrite" + } + }, + "/api/ExecModifyMBPerms": { + "post": { + "summary": "ExecModifyMBPerms", + "operationId": "ExecModifyMBPerms", + "tags": [ + "Email-Exchange > Administration" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "array", + "description": "The request body is a JSON array. Each element has the shape below.", + "items": { + "type": "object", + "properties": { + "mailboxRequests": { + "type": "string", + "description": "Bulk format with mailboxRequests property" + }, + "permissions": { + "type": "array", + "items": { + "type": "object", + "properties": { + "AutoMap": { + "type": "string" + }, + "Modification": { + "type": "string" + }, + "PermissionLevel": { + "type": "string" + }, + "UserID": { + "type": "array", + "items": { + "$ref": "#/components/schemas/LabelValue" + }, + "description": "Extract target users from UserID (handle array of objects or single values)" + } + } + }, + "description": "Legacy single mailbox format" + }, + "tenantFilter": { + "type": "string" + }, + "userID": { + "type": "string", + "description": "Legacy single mailbox format" + } + }, + "required": [ + "tenantFilter" + ], + "additionalProperties": true, + "x-cipp-passthrough": true, + "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." + } + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "properties": { + "aboutMe": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "accountEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "ageGroup": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "assignedLicenses": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "assignedPlans": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "authorizationInfo": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "birthday": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "businessPhones": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "city": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "cloudLicensing": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "cloudRealtimeCommunicationInfo": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "companyName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "consentProvidedForMinor": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "country": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "createdDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "creationType": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "customSecurityAttributes": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "deletedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "department": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "deviceEnrollmentLimit": { + "type": "integer", + "x-cipp-field-source": "graph-entity" + }, + "deviceKeys": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "displayName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeHireDate": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeLeaveDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeOrgData": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "employeeType": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "externalUserState": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "externalUserStateChangeDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "faxNumber": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "givenName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "hireDate": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "identities": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "identityGovernance": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "identityParentId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "imAddresses": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "infoCatalogs": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "interests": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "isLicenseReconciliationNeeded": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isManagementRestricted": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isResourceAccount": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "jobTitle": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "lastPasswordChangeDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "legalAgeGroupClassification": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "licenseAssignmentStates": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "mail": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "mailboxSettings": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "mailNickname": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "mobilePhone": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "mySite": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "officeLocation": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesDistinguishedName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesDomainName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesExtensionAttributes": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesImmutableId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesLastSyncDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesProvisioningErrors": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSamAccountName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSecurityIdentifier": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSipInfo": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSyncEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesUserPrincipalName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "otherMails": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "passwordPolicies": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "passwordProfile": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "pastProjects": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "postalCode": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "preferredDataLocation": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "preferredLanguage": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "preferredName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "print": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "provisionedPlans": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "proxyAddresses": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "refreshTokensValidFromDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "responsibilities": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "schools": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "securityIdentifier": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "serviceProvisioningErrors": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "showInAddressList": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "signInActivity": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "signInSessionsValidFromDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "skills": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "state": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "streetAddress": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "surname": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "usageLocation": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "userPrincipalName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "userType": { + "type": "string", + "x-cipp-field-source": "graph-entity" + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.Mailbox.ReadWrite" + } + }, + "/api/ExecNamedLocation": { + "post": { + "summary": "ExecNamedLocation", + "operationId": "ExecNamedLocation", + "tags": [ + "Tenant > Conditional" + ], + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "change": { + "type": "string" + }, + "input": { + "$ref": "#/components/schemas/LabelValue" + }, + "namedLocationId": { + "type": "string" + }, + "tenantFilter": { + "type": "string", + "description": "Interact with query parameters or the body of the request." + } + } + } + } + } + }, + "parameters": [ + { + "name": "change", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "input", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "namedLocationId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "tenantFilter", + "in": "query", + "description": "Interact with query parameters or the body of the request.", + "required": false, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.ConditionalAccess.ReadWrite", + "x-cipp-any-tenant": true + } + }, + "/api/ExecNewSafeLinksPolicy": { + "post": { + "summary": "ExecNewSafeLinksPolicy", + "operationId": "ExecNewSafeLinksPolicy", + "tags": [ + "Security > Safe-Links-Policy" + ], + "description": "This function creates a new Safe Links policy and an associated rule.", + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "AdminDisplayName": { + "type": "string" + }, + "AllowClickThrough": { + "type": "string" + }, + "Comments": { + "type": "string" + }, + "CustomNotificationText": { + "type": "string" + }, + "DeliverMessageAfterScan": { + "type": "string" + }, + "DisableUrlRewrite": { + "type": "string" + }, + "DoNotRewriteUrls": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "userPrincipalName": { + "type": "string" + }, + "value": { + "type": "string", + "description": "Extract value from object" + } + } + } + }, + "EnableForInternalSenders": { + "type": "string" + }, + "EnableOrganizationBranding": { + "type": "string" + }, + "EnableSafeLinksForEmail": { + "type": "string" + }, + "EnableSafeLinksForOffice": { + "type": "string" + }, + "EnableSafeLinksForTeams": { + "type": "string" + }, + "ExceptIfRecipientDomainIs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "userPrincipalName": { + "type": "string" + }, + "value": { + "type": "string", + "description": "Extract value from object" + } + } + } + }, + "ExceptIfSentTo": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "userPrincipalName": { + "type": "string" + }, + "value": { + "type": "string", + "description": "Extract value from object" + } + } + } + }, + "ExceptIfSentToMemberOf": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "userPrincipalName": { + "type": "string" + }, + "value": { + "type": "string", + "description": "Extract value from object" + } + } + } + }, + "PolicyName": { + "type": "string", + "description": "Extract policy settings from body" + }, + "Priority": { + "type": "string", + "description": "Extract rule settings from body" + }, + "RecipientDomainIs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "userPrincipalName": { + "type": "string" + }, + "value": { + "type": "string", + "description": "Extract value from object" + } + } + } + }, + "RuleName": { + "type": "string" + }, + "ScanUrls": { + "type": "string" + }, + "SentTo": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "userPrincipalName": { + "type": "string" + }, + "value": { + "type": "string", + "description": "Extract value from object" + } + } + }, + "description": "Extract recipient fields and handle different input formats" + }, + "SentToMemberOf": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "userPrincipalName": { + "type": "string" + }, + "value": { + "type": "string", + "description": "Extract value from object" + } + } + } + }, + "State": { + "type": "string" + }, + "tenantFilter": { + "type": "string", + "description": "Interact with query parameters or the body of the request." + }, + "TrackClicks": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.SpamFilter.ReadWrite", + "x-cipp-reads-via": [ + "ConvertTo-FieldArray" + ] + } + }, + "/api/ExecNotificationConfig": { + "post": { + "summary": "ExecNotificationConfig", + "operationId": "ExecNotificationConfig", + "tags": [ + "CIPP > Settings" + ], + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "email": { + "type": "string" + }, + "logsToInclude": { + "type": "string" + }, + "onePerTenant": { + "type": "string" + }, + "sendtoIntegration": { + "type": "string" + }, + "Severity": { + "type": "object" + }, + "UseStandardizedSchema": { + "type": "boolean" + }, + "webhook": { + "type": "string" + }, + "webhookAuthHeaderName": { + "type": "string" + }, + "webhookAuthHeaders": { + "type": "string" + }, + "webhookAuthHeaderValue": { + "type": "string" + }, + "webhookAuthPassword": { + "type": "string" + }, + "webhookAuthToken": { + "type": "string" + }, + "webhookAuthType": { + "$ref": "#/components/schemas/LabelValue" + }, + "webhookAuthUsername": { + "type": "string" + } + } + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Results": { + "x-cipp-field-source": "backend" + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "CIPP.AppSettings.ReadWrite" + } + }, + "/api/ExecNotifySiteOwner": { + "post": { + "summary": "ExecNotifySiteOwner", + "operationId": "ExecNotifySiteOwner", + "tags": [ + "Teams-Sharepoint" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "CustomMessage": { + "type": "string" + }, + "DisplayName": { + "type": "string" + }, + "OwnerEmail": { + "type": "string" + }, + "SiteUrl": { + "type": "string" + }, + "StorageAllocatedGB": { + "type": "string" + }, + "StorageUsedGB": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + }, + "Type": { + "type": "string", + "enum": [ + "Custom", + "Inactivity", + "StorageCritical" + ] + } + }, + "required": [ + "OwnerEmail", + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Sharepoint.Site.ReadWrite" + } + }, + "/api/ExecOffboardTenant": { + "post": { + "summary": "ExecOffboardTenant", + "operationId": "ExecOffboardTenant", + "tags": [ + "Tenant > Administration > Tenant" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "RemoveCSPGuestUsers": { + "type": "boolean" + }, + "RemoveCSPnotificationContacts": { + "type": "boolean" + }, + "RemoveDomainAnalyserData": { + "type": "boolean" + }, + "RemoveMultitenantCSPApps": { + "type": "boolean", + "description": "All customer tenant specific actions ALWAYS have to be completed before this action!" + }, + "RemoveQuarantineAlert": { + "type": "boolean" + }, + "TenantFilter": { + "$ref": "#/components/schemas/LabelValue" + }, + "TerminateContract": { + "type": "boolean" + }, + "TerminateGDAP": { + "type": "boolean" + }, + "vendorApplications": { + "type": "array", + "items": { + "$ref": "#/components/schemas/LabelValue" + } + } + }, + "required": [ + "TenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "DkimSelectors": { + "x-cipp-field-source": "storage" + }, + "DomainAnalyser": { + "x-cipp-field-source": "storage" + }, + "Errors": { + "x-cipp-field-source": "backend" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "MailProviders": { + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "TenantDetails": { + "x-cipp-field-source": "storage" + }, + "TenantId": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.Administration.ReadWrite" + } + }, + "/api/ExecOffboardUser": { + "post": { + "summary": "ExecOffboardUser", + "operationId": "ExecOffboardUser", + "tags": [ + "Identity > Administration > Users" + ], + "description": "Runs the offboarding wizard: one scheduled offboarding job per user, immediately or at the\nscheduled time, reporting live progress under one job id. Action=Rerun queues an existing\noffboarding task again; Action=RerunStep queues one step of it, reported to the same progress row.", + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "Action": { + "type": "string" + }, + "forward": { + "$ref": "#/components/schemas/LabelValue" + }, + "OOO": { + "type": "string" + }, + "PostExecution": { + "type": "object", + "properties": { + "email": { + "type": "boolean" + }, + "psa": { + "type": "boolean" + }, + "push": { + "type": "boolean" + }, + "webhook": { + "type": "boolean" + } + } + }, + "PsaTicketId": { + "type": "string" + }, + "reference": { + "type": "string" + }, + "Scheduled": { + "type": "object", + "properties": { + "date": { + "type": "string" + }, + "enabled": { + "type": "string", + "description": "Scheduled: when enabled, date must be a valid Unix timestamp" + } + }, + "description": "Scheduled: when enabled, date must be a valid Unix timestamp" + }, + "StepIndex": { + "type": "integer", + "description": "Zero-based index of the step, as listed in the progress row, to run again" + }, + "StepTitle": { + "type": "string", + "description": "Title of that step, used to name the re-run task" + }, + "TaskId": { + "type": "string", + "description": "RowKey of the offboarding task to run again" + }, + "tenantFilter": { + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "tenantFilter: required, must resolve to a non-empty domain string (accepts a string or { value })" + }, + "user": { + "type": "array", + "items": { + "$ref": "#/components/schemas/LabelValue" + } + } + }, + "required": [ + "tenantFilter" + ], + "additionalProperties": true, + "x-cipp-passthrough": true, + "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." + } + } + } + }, + "parameters": [ + { + "name": "Action", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Identity.User.ReadWrite", + "x-cipp-reads-via": [ + "Test-CIPPOffboardingRequest" + ] + } + }, + "/api/ExecOffloadFunctions": { + "post": { + "summary": "ExecOffloadFunctions", + "operationId": "ExecOffloadFunctions", + "tags": [ + "CIPP > Settings" + ], + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "OffloadFunctions": { + "type": "string" + } + } + } + } + } + }, + "parameters": [ + { + "name": "Action", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "CIPP.SuperAdmin.ReadWrite" + } + }, + "/api/ExecOnboardTenant": { + "post": { + "summary": "ExecOnboardTenant", + "operationId": "ExecOnboardTenant", + "tags": [ + "Tenant > Administration > Tenant" + ], + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "addMissingGroups": { + "type": "string" + }, + "autoMapRoles": { + "type": "string" + }, + "Cancel": { + "type": "boolean" + }, + "gdapRoles": { + "type": "string" + }, + "id": { + "type": "string", + "description": "Interact with query parameters or the body of the request." + }, + "ignoreMissingRoles": { + "type": "string" + }, + "Retry": { + "type": "boolean" + }, + "standardsExcludeAllTenants": { + "type": "boolean" + }, + "tenantGroups": { + "type": "string" + } + } + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "CustomerId": { + "x-cipp-field-source": "storage,backend" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Exception": { + "type": "string", + "x-cipp-field-source": "storage,backend" + }, + "Logs": { + "type": "string", + "x-cipp-field-source": "storage,backend" + }, + "OnboardingSteps": { + "type": "string", + "x-cipp-field-source": "storage,backend" + }, + "PartitionKey": { + "x-cipp-field-source": "storage,backend" + }, + "Relationship": { + "type": "string", + "x-cipp-field-source": "storage,backend" + }, + "RowKey": { + "type": "string", + "x-cipp-field-source": "storage,backend" + }, + "StandardsExcludeAllTenants": { + "x-cipp-field-source": "storage,backend" + }, + "Status": { + "x-cipp-field-source": "storage,backend" + }, + "TenantGroups": { + "x-cipp-field-source": "storage,backend" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "404": { + "description": "Not found" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.Administration.ReadWrite", + "x-cipp-any-tenant": true + } + }, + "/api/ExecOneDriveCompare": { + "post": { + "summary": "ExecOneDriveCompare", + "operationId": "ExecOneDriveCompare", + "tags": [ + "Teams-Sharepoint" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "DestDriveId": { + "type": "string" + }, + "DestFolderId": { + "type": "string" + }, + "DestSiteId": { + "type": "string" + }, + "DestUserId": { + "type": "string" + }, + "MaxDepth": { + "type": "string" + }, + "SourceDriveId": { + "type": "string" + }, + "SourceFolderId": { + "type": "string" + }, + "SourceSiteId": { + "type": "string" + }, + "SourceUserId": { + "type": "string" + }, + "TenantFilter": { + "type": "string" + } + }, + "required": [ + "DestDriveId", + "SourceDriveId", + "TenantFilter" + ] + } + } + } + }, + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Sharepoint.Site.Read" + } + }, + "/api/ExecOneDriveFileAction": { + "post": { + "summary": "ExecOneDriveFileAction", + "operationId": "ExecOneDriveFileAction", + "tags": [ + "Teams-Sharepoint" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "Action": { + "type": "string", + "enum": [ + "Copy", + "CreateFolder", + "CrossCopy", + "CrossMove", + "Delete", + "Download", + "Move", + "Rename" + ] + }, + "ConflictBehavior": { + "type": "string" + }, + "CopyName": { + "type": "string" + }, + "DestinationDriveId": { + "type": "string", + "description": "Cross-drive destination parameters" + }, + "DestinationFolderId": { + "$ref": "#/components/schemas/LabelValue" + }, + "DestinationSiteId": { + "type": "string" + }, + "DestinationUserId": { + "type": "string" + }, + "DriveId": { + "type": "string" + }, + "FolderName": { + "type": "string" + }, + "ItemId": { + "type": "string" + }, + "ItemName": { + "type": "string" + }, + "NewName": { + "type": "string" + }, + "ParentId": { + "type": "string" + }, + "SiteId": { + "type": "string" + }, + "TenantFilter": { + "type": "string" + }, + "UserId": { + "type": "string" + } + }, + "required": [ + "ConflictBehavior", + "DestinationDriveId", + "DestinationFolderId", + "DriveId", + "FolderName", + "ItemId", + "NewName", + "TenantFilter" + ] + } + } + } + }, + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Sharepoint.Site.ReadWrite" + } + }, + "/api/ExecOneDriveProvision": { + "post": { + "summary": "ExecOneDriveProvision", + "operationId": "ExecOneDriveProvision", + "tags": [ + "Identity > Administration > Users" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "tenantFilter": { + "type": "string" + }, + "UserPrincipalName": { + "type": "array", + "items": { + "type": "string" + } + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "UserPrincipalName", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Identity.User.ReadWrite" + } + }, + "/api/ExecOneDriveShortCut": { + "post": { + "summary": "Creates a OneDrive shortcut to a SharePoint library for one or more users.", + "operationId": "ExecOneDriveShortCut", + "tags": [ + "Identity > Administration > Users" + ], + "description": "Accepts one { username, userid, siteUrl, destination, optional shortcutName, tenantFilter } object or an array of them (the Users table bulk action). Every user is attempted: a failure for one user (for example a shortcut that already exists) is reported in its place and does not stop the remaining users, so a bulk rollout never has to be re-run to find out where it got to. The response is one result per user plus a summary line, and only returns an error status when no user succeeded.", + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": {} + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Identity.User.ReadWrite" + } + }, + "/api/ExecPartnerMode": { + "post": { + "summary": "ExecPartnerMode", + "operationId": "ExecPartnerMode", + "tags": [ + "CIPP > Settings" + ], + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "TenantMode": { + "type": "string", + "x-cipp-observed-values": [ + "default", + "PartnerTenantAvailable" + ] + } + } + } + } + } + }, + "parameters": [ + { + "name": "action", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "CIPP.SuperAdmin.ReadWrite" + } + }, + "/api/ExecPartnerWebhook": { + "post": { + "summary": "ExecPartnerWebhook", + "operationId": "ExecPartnerWebhook", + "tags": [ + "CIPP > Core" + ], + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Subscription create/update is logged by New-CIPPGraphSubscription; log the onboarding config write here." + }, + "EventType": { + "$ref": "#/components/schemas/LabelValue" + }, + "standardsExcludeAllTenants": { + "type": "string" + } + } + } + } + } + }, + "parameters": [ + { + "name": "Action", + "in": "query", + "required": false, + "schema": { + "type": "string", + "enum": [ + "CreateSubscription", + "ListEventTypes", + "ListSubscription", + "SendTest", + "ValidateTest" + ] + } + }, + { + "name": "CorrelationId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "Action": { + "x-cipp-field-source": "backend" + }, + "ApplicationId": { + "x-cipp-field-source": "storage" + }, + "colour": { + "x-cipp-field-source": "storage" + }, + "coverFooterText": { + "x-cipp-field-source": "storage" + }, + "coverImage": { + "x-cipp-field-source": "storage" + }, + "coverImageId": { + "x-cipp-field-source": "storage" + }, + "coverImageIds": { + "x-cipp-field-source": "storage" + }, + "coverStock": { + "x-cipp-field-source": "storage" + }, + "coverUploads": { + "x-cipp-field-source": "storage" + }, + "Enabled": { + "type": "boolean", + "x-cipp-field-source": "storage" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "footerText": { + "x-cipp-field-source": "storage" + }, + "logo": { + "x-cipp-field-source": "storage" + }, + "logoImageId": { + "x-cipp-field-source": "storage" + }, + "logoImageIds": { + "x-cipp-field-source": "storage" + }, + "logoUploads": { + "x-cipp-field-source": "storage" + }, + "MaxDuration": { + "x-cipp-field-source": "storage" + }, + "Metadata": { + "x-cipp-field-source": "backend" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "reportDefaults": { + "x-cipp-field-source": "storage" + }, + "Resolver": { + "x-cipp-field-source": "storage" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "RetentionDays": { + "x-cipp-field-source": "storage" + }, + "roleColours": { + "x-cipp-field-source": "storage" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "secondaryColour": { + "x-cipp-field-source": "storage" + }, + "showFooter": { + "x-cipp-field-source": "storage" + }, + "showPageNumbers": { + "x-cipp-field-source": "storage" + }, + "StandardsExcludeAllTenants": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Timezone": { + "x-cipp-field-source": "storage" + }, + "TimezoneSource": { + "x-cipp-field-source": "storage" + }, + "Value": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "watermarkEnabled": { + "x-cipp-field-source": "storage" + }, + "watermarkText": { + "x-cipp-field-source": "storage" + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "CIPP.AppSettings.ReadWrite" + } + }, + "/api/ExecPasswordConfig": { + "post": { + "summary": "ExecPasswordConfig", + "operationId": "ExecPasswordConfig", + "tags": [ + "CIPP > Settings" + ], + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "appendNumber": { + "type": "string" + }, + "appendSpecialChar": { + "type": "string" + }, + "capitalizeWords": { + "type": "string" + }, + "charCount": { + "type": "string", + "description": "Still parse for storage, but don't reject invalid values for the inactive mode" + }, + "includeDigits": { + "type": "string" + }, + "includeLowercase": { + "type": "string" + }, + "includeSpecialChars": { + "type": "string" + }, + "includeUppercase": { + "type": "string" + }, + "passwordType": { + "type": "string", + "description": "Password type validation" + }, + "separator": { + "type": "string", + "description": "Separator validation with enhanced security - allow space or empty" + }, + "specialCharSet": { + "type": "string", + "description": "Special character set validation with enhanced security" + }, + "wordCount": { + "type": "string" + } + } + } + } + } + }, + "parameters": [ + { + "name": "List", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "appendNumber": { + "x-cipp-field-source": "storage" + }, + "appendSpecialChar": { + "x-cipp-field-source": "storage" + }, + "capitalizeWords": { + "x-cipp-field-source": "storage" + }, + "charCount": { + "x-cipp-field-source": "storage" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "includeDigits": { + "x-cipp-field-source": "storage" + }, + "includeLowercase": { + "x-cipp-field-source": "storage" + }, + "includeSpecialChars": { + "x-cipp-field-source": "storage" + }, + "includeUppercase": { + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "passwordType": { + "x-cipp-field-source": "storage" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "separator": { + "x-cipp-field-source": "storage" + }, + "specialCharSet": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "wordCount": { + "x-cipp-field-source": "storage" + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "CIPP.AppSettings.ReadWrite" + } + }, + "/api/ExecPasswordNeverExpires": { + "post": { + "summary": "ExecPasswordNeverExpires", + "operationId": "ExecPasswordNeverExpires", + "tags": [ + "Identity > Administration > Users" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "PasswordPolicy": { + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "Only used for logging" + }, + "tenantFilter": { + "type": "string", + "description": "Interact with query parameters or the body of the request." + }, + "userId": { + "type": "string" + }, + "userPrincipalName": { + "type": "string", + "description": "Only used for logging" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Identity.User.ReadWrite" + } + }, + "/api/ExecPermissionRepair": { + "post": { + "summary": "This endpoint will update the CIPP-SAM app permissions.", + "operationId": "ExecPermissionRepair", + "tags": [ + "CIPP > Settings" + ], + "description": "Merges new permissions from the SAM manifest into the AppPermissions entry for CIPP-SAM.", + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": {} + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "CIPP.AppSettings.ReadWrite" + } + }, + "/api/ExecPerUserMFA": { + "post": { + "summary": "ExecPerUserMFA", + "operationId": "ExecPerUserMFA", + "tags": [ + "Identity > Administration > Users" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "State": { + "$ref": "#/components/schemas/LabelValue" + }, + "tenantFilter": { + "type": "string" + }, + "userId": { + "type": "string", + "description": "Guest user handling" + }, + "userPrincipalName": { + "type": "string", + "description": "Guest user handling" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Identity.User.ReadWrite" + } + }, + "/api/ExecPIMRoleAssignment": { + "post": { + "summary": "Change a directory role assignment through PIM in the secure direction only.", + "operationId": "ExecPIMRoleAssignment", + "tags": [ + "Identity > Administration > Roles" + ], + "description": "Converts a permanent assignment to eligible, grants a time-bound active assignment, extends or renews a time-bound assignment or eligibility, or removes an assignment. Every request must carry an expiration (a duration or an end date); permanent / no-expiration assignments are refused, as are changes to group-inherited rows, the CIPP-SAM application and the last active Global Administrator. Requires Entra ID P2.", + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "Action": { + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "ConvertToEligible | GrantActive | Extend | Renew | Remove" + }, + "AssignmentType": { + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "The row's current assignment type: Permanent | Active | ActivatedFromEligible | Eligible" + }, + "DirectoryScopeId": { + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "'/' for the whole directory or '/administrativeUnits/{id}'." + }, + "Duration": { + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "ISO 8601 lifetime such as PT4H or P1Y. Use either Duration or EndDateTime, not both." + }, + "EndDateTime": { + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "Absolute end (unix seconds or ISO 8601). Use either Duration or EndDateTime, not both." + }, + "Justification": { + "type": "string", + "description": "Reason recorded on the PIM request and in the CIPP logbook." + }, + "PrincipalId": { + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "Object id of the user, group or service principal." + }, + "RoleDefinitionId": { + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "Role template id (roleDefinitionId as PIM reports it)." + }, + "tenantFilter": { + "$ref": "#/components/schemas/LabelValue" + }, + "TimeZone": { + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "IANA time zone of the browser (e.g. Australia/Perth); only used to word the end time in the result." + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Identity.Role.ReadWrite" + } + }, + "/api/ExecPreviewBrandingReportPdf": { + "post": { + "summary": "ExecPreviewBrandingReportPdf", + "operationId": "ExecPreviewBrandingReportPdf", + "tags": [ + "CIPP > Settings" + ], + "description": "Renders a sample report against a branding configuration - normally the unsaved state of the\nbranding editor - and returns it as application/pdf bytes, so a colour, logo, cover, footer or\nwatermark can be judged on every page of a real report before it is saved. Each report type has\na fixed sample of the data its builder needs (Config/ReportSamples/.json); nothing is read\nfrom a tenant.", + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "branding": { + "type": "object", + "properties": { + "tenantLabel": { + "type": "string", + "description": "The sample tenant, named the way the branding under edit would name a real one." + } }, - "userType": { - "type": "string", - "x-cipp-field-source": "graph-entity" - } + "description": "The branding to render against, in the shape Get-CIPPBrandingSettings returns: colours (flat or under roleColours), a data-URL logo and cover or a coverStock path, footer, watermark and tenantLabel. Omitted -> the saved branding settings." + }, + "reportType": { + "type": "string", + "description": "Which report to preview: executive, reportBuilder, shadowAI, bec, becSummary, sharing, permissions, mailFlow, licensing or baseline." + }, + "tenantFilter": { + "type": "string", + "description": "Optional: the tenant whose %variables% (%cippurl%, custom variables) resolve in the footer and cover." } } } } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } }, "400": { "description": "Bad request - missing required field or invalid input" @@ -29006,6 +33995,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -29013,74 +34005,51 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "CIPP.AppSettings.Read", + "x-cipp-any-tenant": true } }, - "/api/ExecNamedLocation": { + "/api/ExecPreviewReportBuilderPdf": { "post": { - "summary": "ExecNamedLocation", - "operationId": "ExecNamedLocation", + "summary": "ExecPreviewReportBuilderPdf", + "operationId": "ExecPreviewReportBuilderPdf", "tags": [ - "Tenant > Conditional" + "Tools > Report-Builder" ], + "description": "Renders the current (unsaved) Report Builder state to a PDF and returns it as application/pdf\nbytes without persisting a generated-report row. Powers the builder's live preview and download.", "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "change": { + "Blocks": { "type": "string" }, - "input": { - "$ref": "#/components/schemas/LabelValue" + "Settings": { + "type": "string" }, - "namedLocationId": { + "TemplateGUID": { "type": "string" }, - "tenantFilter": { - "type": "string", - "description": "Interact with query parameters or the body of the request." + "TemplateName": { + "type": "string" + }, + "TenantFilter": { + "type": "string" } - } + }, + "required": [ + "TenantFilter" + ] } } } }, "parameters": [ { - "name": "change", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "input", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "namedLocationId", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "tenantFilter", - "in": "query", - "description": "Interact with query parameters or the body of the request.", - "required": false, - "schema": { - "type": "string" - } + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -29089,7 +34058,8 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } @@ -29109,222 +34079,177 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.ConditionalAccess.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "CIPP.ReportBuilder.ReadWrite" } }, - "/api/ExecNewSafeLinksPolicy": { + "/api/ExecPushSubscription": { "post": { - "summary": "ExecNewSafeLinksPolicy", - "operationId": "ExecNewSafeLinksPolicy", + "summary": "ExecPushSubscription", + "operationId": "ExecPushSubscription", "tags": [ - "Security > Safe-Links-Policy" + "CIPP > Settings" ], - "description": "This function creates a new Safe Links policy and an associated rule.", + "description": "Registers, removes or tests a Web Push subscription for the signed-in user's device.\nSubscriptions are per user: the row belongs to the principal that sent it and only that\nprincipal can remove it. Refused while impersonating, so a superadmin trying a role never\nbinds their own device to a browser session that is pretending to be someone else.", "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { - "AdminDisplayName": { - "type": "string" - }, - "AllowClickThrough": { - "type": "string" - }, - "Comments": { - "type": "string" - }, - "CustomNotificationText": { - "type": "string" - }, - "DeliverMessageAfterScan": { - "type": "string" - }, - "DisableUrlRewrite": { - "type": "string" - }, - "DoNotRewriteUrls": { - "type": "array", - "items": { - "type": "object", - "properties": { - "id": { - "type": "string" - }, - "userPrincipalName": { - "type": "string" - }, - "value": { - "type": "string", - "description": "Extract value from object" - } - } - } - }, - "EnableForInternalSenders": { - "type": "string" - }, - "EnableOrganizationBranding": { - "type": "string" - }, - "EnableSafeLinksForEmail": { + "Action": { "type": "string" }, - "EnableSafeLinksForOffice": { + "DeviceName": { "type": "string" }, - "EnableSafeLinksForTeams": { + "RowKey": { "type": "string" }, - "ExceptIfRecipientDomainIs": { - "type": "array", - "items": { - "type": "object", - "properties": { - "id": { - "type": "string" - }, - "userPrincipalName": { - "type": "string" - }, - "value": { - "type": "string", - "description": "Extract value from object" - } - } - } - }, - "ExceptIfSentTo": { - "type": "array", - "items": { - "type": "object", - "properties": { - "id": { - "type": "string" - }, - "userPrincipalName": { - "type": "string" - }, - "value": { - "type": "string", - "description": "Extract value from object" - } - } - } - }, - "ExceptIfSentToMemberOf": { - "type": "array", - "items": { - "type": "object", - "properties": { - "id": { - "type": "string" - }, - "userPrincipalName": { - "type": "string" - }, - "value": { - "type": "string", - "description": "Extract value from object" - } + "Subscription": { + "type": "object", + "properties": { + "endpoint": { + "type": "string" } + }, + "additionalProperties": true + } + } + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "CIPP.Core.ReadWrite", + "x-cipp-any-tenant": true + } + }, + "/api/ExecQuarantineManagement": { + "post": { + "summary": "ExecQuarantineManagement", + "operationId": "ExecQuarantineManagement", + "tags": [ + "Email-Exchange > Spamfilter" + ], + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": {}, + "additionalProperties": true, + "x-cipp-passthrough": true, + "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Details": { + "x-cipp-field-source": "backend" + }, + "Results": { + "x-cipp-field-source": "backend" } - }, - "PolicyName": { + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.SpamFilter.ReadWrite" + } + }, + "/api/ExecReactivateSite": { + "post": { + "summary": "Reactivate an archived SharePoint or OneDrive site.", + "operationId": "ExecReactivateSite", + "tags": [ + "Teams-Sharepoint" + ], + "description": "Reactivates (unarchives) a Microsoft 365 Archive site through the Graph beta\nsite: unarchive endpoint (POST /beta/sites/{site-id}/unarchive). Primarily used to\nreactivate archived OneDrive accounts before granting permissions to them.\nReactivation is asynchronous (can take up to 24 hours) and, for fully-archived\naccounts, may incur Microsoft 365 Archive charges and require Unlicensed OneDrive\nbilling to be enabled on the tenant.", + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "SiteId": { "type": "string", - "description": "Extract policy settings from body" + "description": "Site-collection GUID (the row's siteId / sharepointIds.siteId). Used to build the Graph composite site id without touching the locked, archived site." }, - "Priority": { + "SiteUrl": { "type": "string", - "description": "Extract rule settings from body" - }, - "RecipientDomainIs": { - "type": "array", - "items": { - "type": "object", - "properties": { - "id": { - "type": "string" - }, - "userPrincipalName": { - "type": "string" - }, - "value": { - "type": "string", - "description": "Extract value from object" - } - } - } - }, - "RuleName": { - "type": "string" - }, - "ScanUrls": { - "type": "string" - }, - "SentTo": { - "type": "array", - "items": { - "type": "object", - "properties": { - "id": { - "type": "string" - }, - "userPrincipalName": { - "type": "string" - }, - "value": { - "type": "string", - "description": "Extract value from object" - } - } - }, - "description": "Extract recipient fields and handle different input formats" - }, - "SentToMemberOf": { - "type": "array", - "items": { - "type": "object", - "properties": { - "id": { - "type": "string" - }, - "userPrincipalName": { - "type": "string" - }, - "value": { - "type": "string", - "description": "Extract value from object" - } - } - } - }, - "State": { - "type": "string" + "description": "Full web URL of the archived site / OneDrive (the row's webUrl)." }, "tenantFilter": { "type": "string", - "description": "Interact with query parameters or the body of the request." + "description": "Tenant the archived site belongs to." }, - "TrackClicks": { - "type": "string" + "WebId": { + "type": "string", + "description": "Web GUID (the row's webId / sharepointIds.webId)." } }, "required": [ + "SiteUrl", "tenantFilter" ] } } } }, - "parameters": [ - { - "$ref": "#/components/parameters/tenantFilter" - } - ], "responses": { "200": { "description": "Success", @@ -29344,6 +34269,65 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Sharepoint.Site.ReadWrite" + } + }, + "/api/ExecRefreshMyAccess": { + "get": { + "summary": "Re-check the caller's Entra group membership and refresh their CIPP roles", + "operationId": "ExecRefreshMyAccess", + "tags": [ + "CIPP > Settings" + ], + "description": "Clears the caller's cached role resolution and re-checks Entra group membership, so a\njust-activated PIM group grants its mapped CIPP role without waiting out the role cache.\nOnly ever refreshes the calling user's own access.", + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Role": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "RowKey": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "429": { + "description": "Throttled by the upstream Microsoft API" }, "500": { "description": "Internal server error" @@ -29354,69 +34338,61 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.SpamFilter.ReadWrite", - "x-cipp-reads-via": [ - "ConvertTo-FieldArray" - ] + "x-cipp-role": "Public", + "x-cipp-any-tenant": true } }, - "/api/ExecNotificationConfig": { + "/api/ExecRegistrationCampaign": { "post": { - "summary": "ExecNotificationConfig", - "operationId": "ExecNotificationConfig", + "summary": "ExecRegistrationCampaign", + "operationId": "ExecRegistrationCampaign", "tags": [ - "CIPP > Settings" + "Tenant > Administration > Tenant" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "email": { - "type": "string" - }, - "logsToInclude": { - "type": "string" - }, - "onePerTenant": { + "enforceRegistrationAfterAllowedSnoozes": { "type": "string" }, - "sendtoIntegration": { + "excludeGroups": { "type": "string" }, - "Severity": { - "type": "object" - }, - "UseStandardizedSchema": { - "type": "boolean" - }, - "webhook": { + "excludeUsers": { "type": "string" }, - "webhookAuthHeaderName": { - "type": "string" + "includeAllUsers": { + "type": "boolean", + "description": "Build include/exclude target lists; $null means \"keep what is currently configured\"" }, - "webhookAuthHeaders": { - "type": "string" + "includeGroups": { + "type": "string", + "description": "Build include/exclude target lists; $null means \"keep what is currently configured\"" }, - "webhookAuthHeaderValue": { - "type": "string" + "includeUsers": { + "type": "string", + "description": "Build include/exclude target lists; $null means \"keep what is currently configured\"" }, - "webhookAuthPassword": { - "type": "string" + "snoozeDurationInDays": { + "type": "integer" }, - "webhookAuthToken": { - "type": "string" + "state": { + "$ref": "#/components/schemas/LabelValue" }, - "webhookAuthType": { + "targetedAuthenticationMethod": { "$ref": "#/components/schemas/LabelValue" }, - "webhookAuthUsername": { - "type": "string" + "tenantFilter": { + "$ref": "#/components/schemas/LabelValue" } - } + }, + "required": [ + "tenantFilter" + ] } } } @@ -29427,22 +34403,22 @@ "content": { "application/json": { "schema": { - "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", - "properties": { - "Results": { - "x-cipp-field-source": "backend" - } - } + "$ref": "#/components/schemas/StandardResults" } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -29450,16 +34426,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AppSettings.ReadWrite" + "x-cipp-role": "Tenant.Administration.ReadWrite" } }, - "/api/ExecOffboardTenant": { + "/api/ExecRemoveAdminRole": { "post": { - "summary": "ExecOffboardTenant", - "operationId": "ExecOffboardTenant", + "summary": "ExecRemoveAdminRole", + "operationId": "ExecRemoveAdminRole", "tags": [ - "Tenant > Administration > Tenant" + "Identity > Administration > Users" ], + "description": "Removes a user from an assigned Microsoft Entra admin role.", "requestBody": { "required": true, "content": { @@ -29467,40 +34444,24 @@ "schema": { "type": "object", "properties": { - "RemoveCSPGuestUsers": { - "type": "boolean" - }, - "RemoveCSPnotificationContacts": { - "type": "boolean" - }, - "RemoveDomainAnalyserData": { - "type": "boolean" - }, - "RemoveMultitenantCSPApps": { - "type": "boolean", - "description": "All customer tenant specific actions ALWAYS have to be completed before this action!" - }, - "RemoveQuarantineAlert": { - "type": "boolean" + "RoleId": { + "$ref": "#/components/schemas/LabelValue" }, - "TenantFilter": { + "RoleName": { "$ref": "#/components/schemas/LabelValue" }, - "TerminateContract": { - "type": "boolean" + "RoleTemplateId": { + "$ref": "#/components/schemas/LabelValue" }, - "TerminateGDAP": { - "type": "boolean" + "tenantFilter": { + "$ref": "#/components/schemas/LabelValue" }, - "vendorApplications": { - "type": "array", - "items": { - "$ref": "#/components/schemas/LabelValue" - } + "Users": { + "type": "string" } }, "required": [ - "TenantFilter" + "tenantFilter" ] } } @@ -29512,25 +34473,22 @@ "content": { "application/json": { "schema": { - "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", - "properties": { - "Errors": { - "x-cipp-field-source": "backend" - }, - "Results": { - "x-cipp-field-source": "backend" - } - } + "$ref": "#/components/schemas/StandardResults" } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -29538,17 +34496,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Administration.ReadWrite" + "x-cipp-role": "Identity.Role.ReadWrite" } }, - "/api/ExecOffboardUser": { + "/api/ExecRemoveCippCveException": { "post": { - "summary": "ExecOffboardUser", - "operationId": "ExecOffboardUser", + "summary": "ExecRemoveCippCveException", + "operationId": "ExecRemoveCippCveException", "tags": [ - "Identity > Administration > Users" + "Endpoint > MEM" ], - "description": "Runs the offboarding wizard: one scheduled offboarding job per user, immediately or at the\nscheduled time, reporting live progress under one job id. Action=Rerun queues an existing\noffboarding task again; Action=RerunStep queues one step of it, reported to the same progress row.", "requestBody": { "required": true, "content": { @@ -29556,96 +34513,47 @@ "schema": { "type": "object", "properties": { - "Action": { - "type": "string" - }, - "forward": { - "$ref": "#/components/schemas/LabelValue" - }, - "OOO": { - "type": "string" - }, - "PostExecution": { - "type": "object", - "properties": { - "email": { - "type": "boolean" - }, - "psa": { - "type": "boolean" - }, - "push": { - "type": "boolean" - }, - "webhook": { - "type": "boolean" - } - } - }, - "PsaTicketId": { + "cveId": { "type": "string" }, - "reference": { + "removeScope": { "type": "string" }, - "Scheduled": { - "type": "object", - "properties": { - "date": { - "type": "string" - }, - "enabled": { - "type": "string", - "description": "Scheduled: when enabled, date must be a valid Unix timestamp" - } - }, - "description": "Scheduled: when enabled, date must be a valid Unix timestamp" - }, - "StepIndex": { - "type": "integer", - "description": "Zero-based index of the step, as listed in the progress row, to run again" - }, - "StepTitle": { - "type": "string", - "description": "Title of that step, used to name the re-run task" - }, - "TaskId": { - "type": "string", - "description": "RowKey of the offboarding task to run again" - }, "tenantFilter": { - "allOf": [ - { - "$ref": "#/components/schemas/LabelValue" - } - ], - "description": "tenantFilter: required, must resolve to a non-empty domain string (accepts a string or { value })" - }, - "user": { - "type": "array", - "items": { - "$ref": "#/components/schemas/LabelValue" - } + "type": "string" } }, "required": [ "tenantFilter" - ], - "additionalProperties": true, - "x-cipp-passthrough": true, - "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." + ] } } } }, "parameters": [ { - "name": "Action", + "name": "cveId", "in": "query", - "required": false, + "required": true, "schema": { "type": "string" } + }, + { + "name": "removeScope", + "in": "query", + "required": false, + "schema": { + "type": "string", + "enum": [ + "AllAffected", + "CurrentTenant", + "Global" + ] + } + }, + { + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -29667,6 +34575,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -29674,42 +34585,49 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.ReadWrite", - "x-cipp-reads-via": [ - "Test-CIPPOffboardingRequest" - ] + "x-cipp-role": "Security.Alert.ReadWrite" } }, - "/api/ExecOffloadFunctions": { + "/api/ExecRemoveCrossTenantPartner": { "post": { - "summary": "ExecOffloadFunctions", - "operationId": "ExecOffloadFunctions", + "summary": "ExecRemoveCrossTenantPartner", + "operationId": "ExecRemoveCrossTenantPartner", "tags": [ - "CIPP > Settings" + "Tenant > CrossTenant" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "OffloadFunctions": { + "partnerTenantId": { + "type": "string" + }, + "tenantFilter": { "type": "string" } - } + }, + "required": [ + "partnerTenantId", + "tenantFilter" + ] } } } }, "parameters": [ { - "name": "Action", + "name": "partnerTenantId", "in": "query", "required": false, "schema": { "type": "string" } + }, + { + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -29718,11 +34636,72 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "properties": { + "appServiceConnectInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "automaticUserConsentSettings": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "b2bCollaborationInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "b2bCollaborationOutbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "b2bDirectConnectInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "b2bDirectConnectOutbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "inboundTrust": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "isInMultiTenantOrganization": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isServiceProvider": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "m365CollaborationInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "m365CollaborationOutbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "tenantId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "tenantRestrictions": { + "type": "object", + "x-cipp-field-source": "graph-entity" + } + } } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -29735,56 +34714,44 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.SuperAdmin.ReadWrite" + "x-cipp-role": "Tenant.CrossTenant.ReadWrite" } }, - "/api/ExecOnboardTenant": { + "/api/ExecRemoveCrossTenantTemplate": { "post": { - "summary": "ExecOnboardTenant", - "operationId": "ExecOnboardTenant", + "summary": "ExecRemoveCrossTenantTemplate", + "operationId": "ExecRemoveCrossTenantTemplate", "tags": [ - "Tenant > Administration > Tenant" + "Tenant > CrossTenant" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "addMissingGroups": { - "type": "string" - }, - "autoMapRoles": { - "type": "string" - }, - "Cancel": { - "type": "boolean" - }, - "gdapRoles": { - "type": "string" - }, - "id": { - "type": "string", - "description": "Interact with query parameters or the body of the request." - }, - "ignoreMissingRoles": { - "type": "string" - }, - "Retry": { - "type": "boolean" - }, - "standardsExcludeAllTenants": { - "type": "boolean" - }, - "tenantGroups": { + "GUID": { "type": "string" } - } + }, + "required": [ + "GUID" + ] } } } }, + "parameters": [ + { + "name": "GUID", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], "responses": { "200": { "description": "Success", @@ -29794,48 +34761,54 @@ "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "CustomerId": { - "x-cipp-field-source": "storage,backend" + "ContentHash": { + "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, - "Exception": { - "type": "string", - "x-cipp-field-source": "storage,backend" + "GUID": { + "x-cipp-field-source": "storage" }, - "Logs": { - "type": "string", - "x-cipp-field-source": "storage,backend" + "JSON": { + "x-cipp-field-source": "storage" }, - "OnboardingSteps": { - "type": "string", - "x-cipp-field-source": "storage,backend" + "Package": { + "x-cipp-field-source": "storage" }, "PartitionKey": { - "x-cipp-field-source": "storage,backend" + "x-cipp-field-source": "storage" }, - "Relationship": { + "Permissions": { "type": "string", - "x-cipp-field-source": "storage,backend" + "x-cipp-field-source": "storage" + }, + "Results": { + "x-cipp-field-source": "backend" }, "RowKey": { + "x-cipp-field-source": "storage" + }, + "SHA": { "type": "string", - "x-cipp-field-source": "storage,backend" + "x-cipp-field-source": "storage" }, - "StandardsExcludeAllTenants": { - "x-cipp-field-source": "storage,backend" + "Source": { + "x-cipp-field-source": "storage" }, - "Status": { - "x-cipp-field-source": "storage,backend" + "SourcePath": { + "x-cipp-field-source": "storage" }, - "TenantGroups": { - "x-cipp-field-source": "storage,backend" + "TemplateName": { + "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" + }, + "UpdatedBy": { + "x-cipp-field-source": "storage" } } } @@ -29850,9 +34823,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "404": { - "description": "Not found" } }, "security": [ @@ -29860,16 +34830,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Administration.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "Tenant.CrossTenant.ReadWrite" } }, - "/api/ExecOneDriveProvision": { + "/api/ExecRemoveDeletedSite": { "post": { - "summary": "ExecOneDriveProvision", - "operationId": "ExecOneDriveProvision", + "summary": "ExecRemoveDeletedSite", + "operationId": "ExecRemoveDeletedSite", "tags": [ - "Identity > Administration > Users" + "Teams-Sharepoint" ], "requestBody": { "required": true, @@ -29878,36 +34847,24 @@ "schema": { "type": "object", "properties": { - "tenantFilter": { + "DisplayName": { "type": "string" }, - "UserPrincipalName": { - "type": "array", - "items": { - "type": "string" - } + "SiteUrl": { + "type": "string" + }, + "tenantFilter": { + "type": "string" } }, "required": [ + "SiteUrl", "tenantFilter" ] } } } }, - "parameters": [ - { - "$ref": "#/components/parameters/tenantFilter" - }, - { - "name": "UserPrincipalName", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - } - ], "responses": { "200": { "description": "Success", @@ -29934,24 +34891,48 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecOneDriveShortCut": { + "/api/ExecRemoveEnrollmentProfile": { "post": { - "summary": "Creates a OneDrive shortcut to a SharePoint library for one or more users.", - "operationId": "ExecOneDriveShortCut", + "summary": "ExecRemoveEnrollmentProfile", + "operationId": "ExecRemoveEnrollmentProfile", "tags": [ - "Identity > Administration > Users" + "Endpoint > MEM" ], - "description": "Accepts one { username, userid, siteUrl, destination, tenantFilter } object or an array of them (the Users table bulk action). Every user is attempted: a failure for one user (for example a shortcut that already exists) is reported in its place and does not stop the remaining users, so a bulk rollout never has to be re-run to find out where it got to. The response is one result per user plus a summary line, and only returns an error status when no user succeeded.", + "description": "Deletes an Apple ADE or Android Enterprise enrollment profile.", "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", - "properties": {} + "properties": { + "displayName": { + "type": "string" + }, + "id": { + "type": "string" + }, + "profileId": { + "type": "string" + }, + "profileType": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + }, + "tokenId": { + "type": "string" + } + }, + "required": [ + "profileId", + "tenantFilter", + "tokenId" + ] } } } @@ -29967,9 +34948,6 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -29985,45 +34963,58 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.ReadWrite" + "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, - "/api/ExecPartnerMode": { + "/api/ExecRemoveLibraryPermission": { "post": { - "summary": "ExecPartnerMode", - "operationId": "ExecPartnerMode", + "summary": "ExecRemoveLibraryPermission", + "operationId": "ExecRemoveLibraryPermission", "tags": [ - "CIPP > Settings" + "Teams-Sharepoint" ], + "description": "Removes a principal's permission on a document library (ListId) or on the site root web\n(ListId omitted) via the SharePoint REST API. Supplying RoleDefinitionId removes that one\npermission level; omitting it removes every level the principal holds on the scope.\n\nLimited Access is never removed: SharePoint creates and cleans it up itself so a user can\ntraverse to an item they were given access to further down, and deleting it by hand breaks\nthat navigation.\n\nRemoving a permission requires the library to hold its own permissions, so a library that\nstill inherits has its inheritance broken (copying the current permissions) first - the\nremoval then applies to that library only, not to the whole site.", "requestBody": { - "required": false, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "TenantMode": { - "type": "string", - "x-cipp-observed-values": [ - "default", - "PartnerTenantAvailable" - ] + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "LibraryName": { + "type": "string" + }, + "ListId": { + "type": "string" + }, + "PrincipalId": { + "type": "string" + }, + "PrincipalName": { + "type": "string" + }, + "RoleDefinitionId": { + "type": "string" + }, + "SiteUrl": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + }, + "Title": { + "type": "string" } - } + }, + "required": [ + "PrincipalId", + "SiteUrl", + "tenantFilter" + ] } } } }, - "parameters": [ - { - "name": "action", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - } - ], "responses": { "200": { "description": "Success", @@ -30035,6 +35026,9 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -30047,56 +35041,66 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.SuperAdmin.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecPartnerWebhook": { + "/api/ExecRemoveMailboxRule": { "post": { - "summary": "ExecPartnerWebhook", - "operationId": "ExecPartnerWebhook", + "summary": "ExecRemoveMailboxRule", + "operationId": "ExecRemoveMailboxRule", "tags": [ - "CIPP > Core" + "Email-Exchange > Administration" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "enabled": { - "type": "boolean", - "description": "Subscription create/update is logged by New-CIPPGraphSubscription; log the onboarding config write here." + "ruleId": { + "type": "string" }, - "EventType": { - "$ref": "#/components/schemas/LabelValue" + "ruleName": { + "type": "string" }, - "standardsExcludeAllTenants": { + "TenantFilter": { + "type": "string", + "description": "Interact with the query or body of the request" + }, + "userPrincipalName": { "type": "string" } - } + }, + "required": [ + "TenantFilter" + ] } } } }, "parameters": [ { - "name": "Action", + "name": "ruleId", "in": "query", "required": false, "schema": { - "type": "string", - "enum": [ - "CreateSubscription", - "ListEventTypes", - "ListSubscription", - "SendTest", - "ValidateTest" - ] + "type": "string" } }, { - "name": "CorrelationId", + "name": "ruleName", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "userPrincipalName", "in": "query", "required": false, "schema": { @@ -30110,119 +35114,7 @@ "content": { "application/json": { "schema": { - "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", - "properties": { - "Action": { - "x-cipp-field-source": "backend" - }, - "ApplicationId": { - "x-cipp-field-source": "storage" - }, - "colour": { - "x-cipp-field-source": "storage" - }, - "coverFooterText": { - "x-cipp-field-source": "storage" - }, - "coverImage": { - "x-cipp-field-source": "storage" - }, - "coverImageId": { - "x-cipp-field-source": "storage" - }, - "coverImageIds": { - "x-cipp-field-source": "storage" - }, - "coverStock": { - "x-cipp-field-source": "storage" - }, - "coverUploads": { - "x-cipp-field-source": "storage" - }, - "Enabled": { - "type": "boolean", - "x-cipp-field-source": "storage" - }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "footerText": { - "x-cipp-field-source": "storage" - }, - "logo": { - "x-cipp-field-source": "storage" - }, - "logoImageId": { - "x-cipp-field-source": "storage" - }, - "logoImageIds": { - "x-cipp-field-source": "storage" - }, - "logoUploads": { - "x-cipp-field-source": "storage" - }, - "MaxDuration": { - "x-cipp-field-source": "storage" - }, - "Metadata": { - "x-cipp-field-source": "backend" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" - }, - "reportDefaults": { - "x-cipp-field-source": "storage" - }, - "Resolver": { - "x-cipp-field-source": "storage" - }, - "Results": { - "x-cipp-field-source": "backend" - }, - "RetentionDays": { - "x-cipp-field-source": "storage" - }, - "roleColours": { - "x-cipp-field-source": "storage" - }, - "RowKey": { - "x-cipp-field-source": "storage" - }, - "secondaryColour": { - "x-cipp-field-source": "storage" - }, - "showFooter": { - "x-cipp-field-source": "storage" - }, - "showPageNumbers": { - "x-cipp-field-source": "storage" - }, - "StandardsExcludeAllTenants": { - "x-cipp-field-source": "storage" - }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "Timezone": { - "x-cipp-field-source": "storage" - }, - "TimezoneSource": { - "x-cipp-field-source": "storage" - }, - "Value": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "watermarkEnabled": { - "x-cipp-field-source": "storage" - }, - "watermarkText": { - "x-cipp-field-source": "storage" - } - } + "$ref": "#/components/schemas/StandardResults" } } } @@ -30232,6 +35124,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -30239,148 +35134,54 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AppSettings.ReadWrite" + "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecPasswordConfig": { + "/api/ExecRemoveOneDriveShortCut": { "post": { - "summary": "ExecPasswordConfig", - "operationId": "ExecPasswordConfig", + "summary": "ExecRemoveOneDriveShortCut", + "operationId": "ExecRemoveOneDriveShortCut", "tags": [ - "CIPP > Settings" + "Identity > Administration > Users" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "appendNumber": { - "type": "boolean" - }, - "appendSpecialChar": { - "type": "boolean" - }, - "capitalizeWords": { - "type": "boolean" - }, - "charCount": { - "type": "string", - "description": "Still parse for storage, but don't reject invalid values for the inactive mode" - }, - "includeDigits": { - "type": "boolean" - }, - "includeLowercase": { - "type": "boolean" - }, - "includeSpecialChars": { - "type": "boolean" - }, - "includeUppercase": { - "type": "boolean" - }, - "passwordType": { - "type": "string", - "description": "Password type validation" - }, - "separator": { - "type": "string", - "description": "Separator validation with enhanced security - allow space or empty" + "id": { + "$ref": "#/components/schemas/LabelValue" }, - "specialCharSet": { - "type": "string", - "description": "Special character set validation with enhanced security" + "name": { + "$ref": "#/components/schemas/LabelValue" }, - "wordCount": { + "tenantFilter": { "type": "string" + }, + "username": { + "$ref": "#/components/schemas/LabelValue" } - } + }, + "required": [ + "tenantFilter" + ] } } } }, - "parameters": [ - { - "name": "List", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - } - ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { - "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", - "properties": { - "appendNumber": { - "x-cipp-field-source": "storage" - }, - "appendSpecialChar": { - "x-cipp-field-source": "storage" - }, - "capitalizeWords": { - "x-cipp-field-source": "storage" - }, - "charCount": { - "x-cipp-field-source": "storage" - }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "includeDigits": { - "x-cipp-field-source": "storage" - }, - "includeLowercase": { - "x-cipp-field-source": "storage" - }, - "includeSpecialChars": { - "x-cipp-field-source": "storage" - }, - "includeUppercase": { - "x-cipp-field-source": "storage" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" - }, - "passwordType": { - "x-cipp-field-source": "storage" - }, - "Results": { - "x-cipp-field-source": "backend" - }, - "RowKey": { - "x-cipp-field-source": "storage" - }, - "separator": { - "x-cipp-field-source": "storage" - }, - "specialCharSet": { - "x-cipp-field-source": "storage" - }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "wordCount": { - "x-cipp-field-source": "storage" - } - } + "$ref": "#/components/schemas/StandardResults" } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -30396,17 +35197,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AppSettings.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "Identity.User.ReadWrite" } }, - "/api/ExecPasswordNeverExpires": { + "/api/ExecRemoveRestrictedUser": { "post": { - "summary": "ExecPasswordNeverExpires", - "operationId": "ExecPasswordNeverExpires", + "summary": "ExecRemoveRestrictedUser", + "operationId": "ExecRemoveRestrictedUser", "tags": [ - "Identity > Administration > Users" + "Email-Exchange > Administration" ], + "description": "Removes a user from the restricted senders list in Exchange Online.", "requestBody": { "required": true, "content": { @@ -30414,27 +35215,16 @@ "schema": { "type": "object", "properties": { - "PasswordPolicy": { - "allOf": [ - { - "$ref": "#/components/schemas/LabelValue" - } - ], - "description": "Only used for logging" + "SenderAddress": { + "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." - }, - "userId": { - "type": "string" - }, - "userPrincipalName": { - "type": "string", - "description": "Only used for logging" } }, "required": [ + "SenderAddress", "tenantFilter" ] } @@ -30467,24 +35257,42 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.ReadWrite" + "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecPermissionRepair": { + "/api/ExecRemoveRoleMember": { "post": { - "summary": "This endpoint will update the CIPP-SAM app permissions.", - "operationId": "ExecPermissionRepair", + "summary": "ExecRemoveRoleMember", + "operationId": "ExecRemoveRoleMember", "tags": [ - "CIPP > Settings" + "Identity > Administration > Users" ], - "description": "Merges new permissions from the SAM manifest into the AppPermissions entry for CIPP-SAM.", "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", - "properties": {} + "properties": { + "MemberId": { + "type": "string" + }, + "MemberName": { + "type": "string" + }, + "RoleId": { + "type": "string" + }, + "RoleName": { + "type": "string" + }, + "TenantFilter": { + "type": "string" + } + }, + "required": [ + "TenantFilter" + ] } } } @@ -30495,12 +35303,14 @@ "content": { "application/json": { "schema": { - "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "$ref": "#/components/schemas/StandardResults" } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -30513,16 +35323,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AppSettings.ReadWrite" + "x-cipp-role": "Identity.Role.ReadWrite" } }, - "/api/ExecPerUserMFA": { + "/api/ExecRemoveSharingLink": { "post": { - "summary": "ExecPerUserMFA", - "operationId": "ExecPerUserMFA", + "summary": "ExecRemoveSharingLink", + "operationId": "ExecRemoveSharingLink", "tags": [ - "Identity > Administration > Users" + "Teams-Sharepoint" ], + "description": "Revokes a sharing link (or direct sharing grant) on a SharePoint or OneDrive item by\ndeleting the permission from the drive item. Also removes the revoked link from the\nSharePointSharingLinks reporting cache so the sharing report reflects it immediately.", "requestBody": { "required": true, "content": { @@ -30530,19 +35341,23 @@ "schema": { "type": "object", "properties": { - "State": { - "$ref": "#/components/schemas/LabelValue" + "CacheId": { + "type": "string" }, - "tenantFilter": { + "DriveId": { "type": "string" }, - "userId": { - "type": "string", - "description": "Guest user handling" + "FileName": { + "type": "string" }, - "userPrincipalName": { - "type": "string", - "description": "Guest user handling" + "ItemId": { + "type": "string" + }, + "PermissionId": { + "type": "string" + }, + "tenantFilter": { + "type": "string" } }, "required": [ @@ -30563,14 +35378,14 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -30578,17 +35393,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecPIMRoleAssignment": { + "/api/ExecRemoveSiteUser": { "post": { - "summary": "Change a directory role assignment through PIM in the secure direction only.", - "operationId": "ExecPIMRoleAssignment", + "summary": "ExecRemoveSiteUser", + "operationId": "ExecRemoveSiteUser", "tags": [ - "Identity > Administration > Roles" + "Teams-Sharepoint" ], - "description": "Converts a permanent assignment to eligible, grants a time-bound active assignment, extends or renews a time-bound assignment or eligibility, or removes an assignment. Every request must carry an expiration (a duration or an end date); permanent / no-expiration assignments are refused, as are changes to group-inherited rows, the CIPP-SAM application and the last active Global Administrator. Requires Entra ID P2.", + "description": "Removes a user from one or more SharePoint sites entirely: deleting the site user\nremoves them from every site group and direct permission grant at once. Uses the\nSharePoint REST API with certificate authentication. Note this does not revoke\nsharing links the user received by mail; use the sharing link actions for those.", "requestBody": { "required": true, "content": { @@ -30596,76 +35411,42 @@ "schema": { "type": "object", "properties": { - "Action": { - "allOf": [ - { - "$ref": "#/components/schemas/LabelValue" - } - ], - "description": "ConvertToEligible | GrantActive | Extend | Renew | Remove" - }, - "AssignmentType": { - "allOf": [ - { - "$ref": "#/components/schemas/LabelValue" - } - ], - "description": "The row's current assignment type: Permanent | Active | ActivatedFromEligible | Eligible" - }, - "DirectoryScopeId": { - "allOf": [ - { - "$ref": "#/components/schemas/LabelValue" - } - ], - "description": "'/' for the whole directory or '/administrativeUnits/{id}'." - }, - "Duration": { - "allOf": [ - { - "$ref": "#/components/schemas/LabelValue" - } - ], - "description": "ISO 8601 lifetime such as PT4H or P1Y. Use either Duration or EndDateTime, not both." - }, - "EndDateTime": { - "allOf": [ - { - "$ref": "#/components/schemas/LabelValue" - } - ], - "description": "Absolute end (unix seconds or ISO 8601). Use either Duration or EndDateTime, not both." - }, - "Justification": { - "type": "string", - "description": "Reason recorded on the PIM request and in the CIPP logbook." + "DisplayName": { + "type": "string" }, - "PrincipalId": { - "allOf": [ - { - "$ref": "#/components/schemas/LabelValue" - } - ], - "description": "Object id of the user, group or service principal." + "SiteUrl": { + "type": "string", + "description": "Single site (SiteUrl) or several at once (SiteUrls, e.g. from the External Users report)." }, - "RoleDefinitionId": { - "allOf": [ - { - "$ref": "#/components/schemas/LabelValue" - } - ], - "description": "Role template id (roleDefinitionId as PIM reports it)." + "SiteUrls": { + "type": "string", + "description": "Single site (SiteUrl) or several at once (SiteUrls, e.g. from the External Users report)." }, "tenantFilter": { - "$ref": "#/components/schemas/LabelValue" + "type": "string" }, - "TimeZone": { - "allOf": [ - { - "$ref": "#/components/schemas/LabelValue" + "user": { + "type": "object", + "properties": { + "addedFields": { + "type": "object", + "properties": { + "LoginName": { + "type": "string", + "description": "The picker supplies the SP claims login via addedFields; fall back to building it from the UPN." + } + }, + "required": [ + "LoginName" + ], + "description": "The picker supplies the SP claims login via addedFields; fall back to building it from the UPN." + }, + "value": { + "type": "string", + "description": "The picker supplies the SP claims login via addedFields; fall back to building it from the UPN." } - ], - "description": "IANA time zone of the browser (e.g. Australia/Perth); only used to word the end time in the result." + }, + "description": "The picker supplies the SP claims login via addedFields; fall back to building it from the UPN." } }, "required": [ @@ -30701,17 +35482,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.Role.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecPreviewBrandingReportPdf": { + "/api/ExecRemoveSnooze": { "post": { - "summary": "ExecPreviewBrandingReportPdf", - "operationId": "ExecPreviewBrandingReportPdf", + "summary": "ExecRemoveSnooze", + "operationId": "ExecRemoveSnooze", "tags": [ - "CIPP > Settings" + "CIPP > Core" ], - "description": "Renders a sample report against a branding configuration - normally the unsaved state of the\nbranding editor - and returns it as application/pdf bytes, so a colour, logo, cover, footer or\nwatermark can be judged on every page of a real report before it is saved. Each report type has\na fixed sample of the data its builder needs (Config/ReportSamples/.json); nothing is read\nfrom a tenant.", "requestBody": { "required": false, "content": { @@ -30719,37 +35499,42 @@ "schema": { "type": "object", "properties": { - "branding": { - "type": "object", - "properties": { - "tenantLabel": { - "type": "string", - "description": "The sample tenant, named the way the branding under edit would name a real one." - } - }, - "description": "The branding to render against, in the shape Get-CIPPBrandingSettings returns: colours (flat or under roleColours), a data-URL logo and cover or a coverStock path, footer, watermark and tenantLabel. Omitted -> the saved branding settings." - }, - "reportType": { - "type": "string", - "description": "Which report to preview: executive, reportBuilder, shadowAI, bec, becSummary, sharing, permissions, mailFlow, licensing or baseline." + "PartitionKey": { + "type": "string" }, - "tenantFilter": { - "type": "string", - "description": "Optional: the tenant whose %variables% (%cippurl%, custom variables) resolve in the footer and cover." + "RowKey": { + "type": "string" } } } } } }, + "parameters": [ + { + "name": "PartitionKey", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "RowKey", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { - "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "$ref": "#/components/schemas/StandardResults" } } } @@ -30772,18 +35557,18 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AppSettings.Read", + "x-cipp-role": "CIPP.AlertSnooze.ReadWrite", "x-cipp-any-tenant": true } }, - "/api/ExecPreviewReportBuilderPdf": { + "/api/ExecRemoveSPOExternalUser": { "post": { - "summary": "ExecPreviewReportBuilderPdf", - "operationId": "ExecPreviewReportBuilderPdf", + "summary": "ExecRemoveSPOExternalUser", + "operationId": "ExecRemoveSPOExternalUser", "tags": [ - "Tools > Report-Builder" + "Teams-Sharepoint" ], - "description": "Renders the current (unsaved) Report Builder state to a PDF and returns it as application/pdf\nbytes without persisting a generated-report row. Powers the builder's live preview and download.", + "description": "Fully removes an external user's guest access: deletes their Entra guest account (when\none exists) AND removes them from every SharePoint site they hold membership on, in one\npass - so no orphaned accounts or lingering site access are left behind. The inert\nSharePoint external-store entry cannot be deleted (Microsoft deprecated\nRemoveExternalUsers) and ages out on its own; sharing links the user received are\nrevoked separately via the Sharing Report.", "requestBody": { "required": true, "content": { @@ -30791,54 +35576,48 @@ "schema": { "type": "object", "properties": { - "Blocks": { + "DisplayName": { "type": "string" }, - "Settings": { + "EntraUserId": { "type": "string" }, - "TemplateGUID": { + "LoginName": { "type": "string" }, - "TemplateName": { + "SiteUrls": { "type": "string" }, - "TenantFilter": { + "tenantFilter": { "type": "string" } }, "required": [ - "TenantFilter" + "tenantFilter" ] } } } }, - "parameters": [ - { - "$ref": "#/components/parameters/tenantFilter" - } - ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { - "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "$ref": "#/components/schemas/StandardResults" } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -30846,43 +35625,40 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.ReportBuilder.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecPushSubscription": { + "/api/ExecRemoveTeamsVoicePhoneNumberAssignment": { "post": { - "summary": "ExecPushSubscription", - "operationId": "ExecPushSubscription", + "summary": "ExecRemoveTeamsVoicePhoneNumberAssignment", + "operationId": "ExecRemoveTeamsVoicePhoneNumberAssignment", "tags": [ - "CIPP > Settings" + "Teams-Sharepoint" ], - "description": "Registers, removes or tests a Web Push subscription for the signed-in user's device.\nSubscriptions are per user: the row belongs to the principal that sent it and only that\nprincipal can remove it. Refused while impersonating, so a superadmin trying a role never\nbinds their own device to a browser session that is pretending to be someone else.", "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "Action": { + "AssignedTo": { "type": "string" }, - "DeviceName": { - "type": "string" + "PhoneNumber": { + "type": "string", + "description": "Normalize phone number -- the + prefix can be lost during URL encoding (+ becomes space)" }, - "RowKey": { + "PhoneNumberType": { "type": "string" }, - "Subscription": { - "type": "object", - "properties": { - "endpoint": { - "type": "string" - } - }, - "additionalProperties": true + "tenantFilter": { + "type": "string" } - } + }, + "required": [ + "tenantFilter" + ] } } } @@ -30914,49 +35690,27 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "Teams.Voice.ReadWrite" } }, - "/api/ExecQuarantineManagement": { + "/api/ExecRemoveTenant": { "post": { - "summary": "ExecQuarantineManagement", - "operationId": "ExecQuarantineManagement", + "summary": "ExecRemoveTenant", + "operationId": "ExecRemoveTenant", "tags": [ - "Email-Exchange > Spamfilter" + "CIPP > Settings" ], "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { - "AllowSender": { - "type": "boolean" - }, - "Identity": { - "type": "string" - }, - "PolicyName": { - "type": "string" - }, - "RecipientAddress": { - "type": "string" - }, - "SenderAddress": { - "type": "string" - }, - "tenantFilter": { - "type": "string" - }, - "Type": { + "TenantID": { "type": "string" } - }, - "required": [ - "tenantFilter" - ] + } } } } @@ -30968,10 +35722,76 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "Results": { - "x-cipp-field-source": "backend" + "customerId": { + "x-cipp-field-source": "storage" + }, + "defaultDomainName": { + "x-cipp-field-source": "storage" + }, + "delegatedPrivilegeStatus": { + "x-cipp-field-source": "storage" + }, + "directTenantAuthDate": { + "x-cipp-field-source": "storage" + }, + "directTenantUserPrincipalName": { + "x-cipp-field-source": "storage" + }, + "displayName": { + "x-cipp-field-source": "storage" + }, + "domains": { + "x-cipp-field-source": "storage" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Excluded": { + "x-cipp-field-source": "storage" + }, + "ExcludeDate": { + "x-cipp-field-source": "storage" + }, + "ExcludeUser": { + "x-cipp-field-source": "storage" + }, + "hasAutoExtend": { + "x-cipp-field-source": "storage" + }, + "initialDomainName": { + "x-cipp-field-source": "storage" + }, + "LastGraphError": { + "x-cipp-field-source": "storage" + }, + "LastGraphTokenError": { + "x-cipp-field-source": "storage" + }, + "LastRefresh": { + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "relationshipCount": { + "x-cipp-field-source": "storage" + }, + "relationshipEnd": { + "x-cipp-field-source": "storage" + }, + "RequiresRefresh": { + "type": "boolean", + "x-cipp-field-source": "storage" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" } } } @@ -30986,6 +35806,12 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "404": { + "description": "Not found" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -30993,17 +35819,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.SpamFilter.ReadWrite" + "x-cipp-role": "Tenant.Administration.ReadWrite" } }, - "/api/ExecReactivateSite": { + "/api/ExecRenameAPDevice": { "post": { - "summary": "Reactivate an archived SharePoint or OneDrive site.", - "operationId": "ExecReactivateSite", + "summary": "ExecRenameAPDevice", + "operationId": "ExecRenameAPDevice", "tags": [ - "Teams-Sharepoint" + "Endpoint > Autopilot" ], - "description": "Reactivates (unarchives) a Microsoft 365 Archive site through the Graph beta\nsite: unarchive endpoint (POST /beta/sites/{site-id}/unarchive). Primarily used to\nreactivate archived OneDrive accounts before granting permissions to them.\nReactivation is asynchronous (can take up to 24 hours) and, for fully-archived\naccounts, may incur Microsoft 365 Archive charges and require Unlicensed OneDrive\nbilling to be enabled on the tenant.", "requestBody": { "required": true, "content": { @@ -31011,25 +35836,23 @@ "schema": { "type": "object", "properties": { - "SiteId": { - "type": "string", - "description": "Site-collection GUID (the row's siteId / sharepointIds.siteId). Used to build the Graph composite site id without touching the locked, archived site." + "deviceId": { + "type": "string" }, - "SiteUrl": { - "type": "string", - "description": "Full web URL of the archived site / OneDrive (the row's webUrl)." + "displayName": { + "type": "array", + "items": { + "type": "string" + } }, - "tenantFilter": { - "type": "string", - "description": "Tenant the archived site belongs to." + "serialNumber": { + "type": "string" }, - "WebId": { - "type": "string", - "description": "Web GUID (the row's webId / sharepointIds.webId)." + "tenantFilter": { + "type": "string" } }, "required": [ - "SiteUrl", "tenantFilter" ] } @@ -31062,17 +35885,41 @@ "bearerAuth": [] } ], - "x-cipp-role": "Sharepoint.Site.ReadWrite" + "x-cipp-role": "Endpoint.Autopilot.ReadWrite" } }, - "/api/ExecRefreshMyAccess": { - "get": { - "summary": "Re-check the caller's Entra group membership and refresh their CIPP roles", - "operationId": "ExecRefreshMyAccess", + "/api/ExecReportAttachmentRetentionConfig": { + "post": { + "summary": "ExecReportAttachmentRetentionConfig", + "operationId": "ExecReportAttachmentRetentionConfig", "tags": [ "CIPP > Settings" ], - "description": "Clears the caller's cached role resolution and re-checks Entra group membership, so a\njust-activated PIM group grants its mapped CIPP role without waiting out the role cache.\nOnly ever refreshes the calling user's own access.", + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "RetentionDays": { + "type": "integer" + } + } + } + } + } + }, + "parameters": [ + { + "name": "List", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], "responses": { "200": { "description": "Success", @@ -31080,26 +35927,110 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { + "ApplicationId": { + "x-cipp-field-source": "storage" + }, + "colour": { + "x-cipp-field-source": "storage" + }, + "coverFooterText": { + "x-cipp-field-source": "storage" + }, + "coverImage": { + "x-cipp-field-source": "storage" + }, + "coverImageId": { + "x-cipp-field-source": "storage" + }, + "coverImageIds": { + "x-cipp-field-source": "storage" + }, + "coverStock": { + "x-cipp-field-source": "storage" + }, + "coverUploads": { + "x-cipp-field-source": "storage" + }, + "Enabled": { + "type": "boolean", + "x-cipp-field-source": "storage" + }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, + "footerText": { + "x-cipp-field-source": "storage" + }, + "logo": { + "x-cipp-field-source": "storage" + }, + "logoImageId": { + "x-cipp-field-source": "storage" + }, + "logoImageIds": { + "x-cipp-field-source": "storage" + }, + "logoUploads": { + "x-cipp-field-source": "storage" + }, + "MaxDuration": { + "x-cipp-field-source": "storage" + }, "PartitionKey": { "x-cipp-field-source": "storage" }, - "Role": { - "type": "string", + "reportDefaults": { + "x-cipp-field-source": "storage" + }, + "Resolver": { + "x-cipp-field-source": "storage" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "RetentionDays": { + "x-cipp-field-source": "storage" + }, + "roleColours": { "x-cipp-field-source": "storage" }, "RowKey": { - "type": "string", + "x-cipp-field-source": "storage" + }, + "secondaryColour": { + "x-cipp-field-source": "storage" + }, + "showFooter": { + "x-cipp-field-source": "storage" + }, + "showPageNumbers": { + "x-cipp-field-source": "storage" + }, + "StandardsExcludeAllTenants": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" + }, + "Timezone": { + "x-cipp-field-source": "storage" + }, + "TimezoneSource": { + "x-cipp-field-source": "storage" + }, + "Value": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "watermarkEnabled": { + "x-cipp-field-source": "storage" + }, + "watermarkText": { + "x-cipp-field-source": "storage" } } } @@ -31111,12 +36042,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "429": { - "description": "Throttled by the upstream Microsoft API" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -31124,16 +36049,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Public", + "x-cipp-role": "CIPP.AppSettings.ReadWrite", "x-cipp-any-tenant": true } }, - "/api/ExecRegistrationCampaign": { + "/api/ExecReportBuilderTemplate": { "post": { - "summary": "ExecRegistrationCampaign", - "operationId": "ExecRegistrationCampaign", + "summary": "ExecReportBuilderTemplate", + "operationId": "ExecReportBuilderTemplate", "tags": [ - "Tenant > Administration > Tenant" + "Tools > Report-Builder" ], "requestBody": { "required": true, @@ -31142,42 +36067,29 @@ "schema": { "type": "object", "properties": { - "enforceRegistrationAfterAllowedSnoozes": { - "type": "string" + "Action": { + "type": "string", + "enum": [ + "delete", + "save" + ] }, - "excludeGroups": { + "Blocks": { "type": "string" }, - "excludeUsers": { + "GUID": { "type": "string" }, - "includeAllUsers": { - "type": "boolean", - "description": "Build include/exclude target lists; $null means \"keep what is currently configured\"" - }, - "includeGroups": { - "type": "string", - "description": "Build include/exclude target lists; $null means \"keep what is currently configured\"" - }, - "includeUsers": { - "type": "string", - "description": "Build include/exclude target lists; $null means \"keep what is currently configured\"" - }, - "snoozeDurationInDays": { - "type": "integer" - }, - "state": { - "$ref": "#/components/schemas/LabelValue" - }, - "targetedAuthenticationMethod": { - "$ref": "#/components/schemas/LabelValue" - }, - "tenantFilter": { - "$ref": "#/components/schemas/LabelValue" + "Name": { + "type": "array", + "items": { + "type": "string" + } } }, "required": [ - "tenantFilter" + "GUID", + "Name" ] } } @@ -31189,7 +36101,56 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "ContentHash": { + "x-cipp-field-source": "storage" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "GUID": { + "x-cipp-field-source": "storage" + }, + "JSON": { + "x-cipp-field-source": "storage" + }, + "Package": { + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Permissions": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "SHA": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Source": { + "x-cipp-field-source": "storage" + }, + "SourcePath": { + "x-cipp-field-source": "storage" + }, + "TemplateName": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "UpdatedBy": { + "x-cipp-field-source": "storage" + } + } } } } @@ -31202,9 +36163,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -31212,17 +36170,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Administration.ReadWrite" + "x-cipp-role": "CIPP.ReportBuilder.ReadWrite" } }, - "/api/ExecRemoveAdminRole": { + "/api/ExecReprocessUserLicenses": { "post": { - "summary": "ExecRemoveAdminRole", - "operationId": "ExecRemoveAdminRole", + "summary": "ExecReprocessUserLicenses", + "operationId": "ExecReprocessUserLicenses", "tags": [ "Identity > Administration > Users" ], - "description": "Removes a user from an assigned Microsoft Entra admin role.", "requestBody": { "required": true, "content": { @@ -31230,19 +36187,14 @@ "schema": { "type": "object", "properties": { - "RoleId": { - "$ref": "#/components/schemas/LabelValue" - }, - "RoleName": { - "$ref": "#/components/schemas/LabelValue" - }, - "RoleTemplateId": { - "$ref": "#/components/schemas/LabelValue" + "ID": { + "type": "string" }, "tenantFilter": { - "$ref": "#/components/schemas/LabelValue" + "type": "string", + "description": "Interact with query parameters or the body of the request." }, - "Users": { + "userPrincipalName": { "type": "string" } }, @@ -31253,6 +36205,27 @@ } } }, + "parameters": [ + { + "name": "ID", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "userPrincipalName", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], "responses": { "200": { "description": "Success", @@ -31264,9 +36237,6 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -31282,16 +36252,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.Role.ReadWrite" + "x-cipp-role": "Identity.User.ReadWrite" } }, - "/api/ExecRemoveCippCveException": { + "/api/ExecRequirePasswordChange": { "post": { - "summary": "ExecRemoveCippCveException", - "operationId": "ExecRemoveCippCveException", + "summary": "ExecRequirePasswordChange", + "operationId": "ExecRequirePasswordChange", "tags": [ - "Endpoint > MEM" + "Identity > Administration > Users" ], + "description": "Requires password change at next sign-in without resetting the password.\nSets passwordProfile.forceChangePasswordNextSignIn via Graph. Not supported for directory-synced users.", "requestBody": { "required": true, "content": { @@ -31299,10 +36270,7 @@ "schema": { "type": "object", "properties": { - "cveId": { - "type": "string" - }, - "removeScope": { + "ID": { "type": "string" }, "tenantFilter": { @@ -31318,24 +36286,11 @@ }, "parameters": [ { - "name": "cveId", - "in": "query", - "required": true, - "schema": { - "type": "string" - } - }, - { - "name": "removeScope", + "name": "ID", "in": "query", "required": false, "schema": { - "type": "string", - "enum": [ - "AllAffected", - "CurrentTenant", - "Global" - ] + "type": "string" } }, { @@ -31353,9 +36308,6 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -31371,17 +36323,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Security.Alert.ReadWrite" + "x-cipp-role": "Identity.User.ReadWrite" } }, - "/api/ExecRemoveEnrollmentProfile": { + "/api/ExecResetMFA": { "post": { - "summary": "ExecRemoveEnrollmentProfile", - "operationId": "ExecRemoveEnrollmentProfile", + "summary": "ExecResetMFA", + "operationId": "ExecResetMFA", "tags": [ - "Endpoint > MEM" + "Identity > Administration > Users" ], - "description": "Deletes an Apple ADE or Android Enterprise enrollment profile.", "requestBody": { "required": true, "content": { @@ -31389,29 +36340,20 @@ "schema": { "type": "object", "properties": { - "displayName": { - "type": "string" - }, - "id": { - "type": "string" - }, - "profileId": { + "ID": { "type": "string" }, - "profileType": { - "type": "string" + "MethodId": { + "type": "string", + "description": "When supplied, only this single authentication method is removed instead of all of them." }, "tenantFilter": { - "type": "string" - }, - "tokenId": { - "type": "string" + "type": "string", + "description": "Interact with query parameters or the body of the request." } }, "required": [ - "profileId", - "tenantFilter", - "tokenId" + "tenantFilter" ] } } @@ -31443,17 +36385,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.MEM.ReadWrite" + "x-cipp-role": "Identity.User.ReadWrite" } }, - "/api/ExecRemoveLibraryPermission": { + "/api/ExecResetPass": { "post": { - "summary": "ExecRemoveLibraryPermission", - "operationId": "ExecRemoveLibraryPermission", + "summary": "ExecResetPass", + "operationId": "ExecResetPass", "tags": [ - "Teams-Sharepoint" + "Identity > Administration > Users" ], - "description": "Removes a principal's permission on a document library (ListId) or on the site root web\n(ListId omitted) via the SharePoint REST API. Supplying RoleDefinitionId removes that one\npermission level; omitting it removes every level the principal holds on the scope.\n\nLimited Access is never removed: SharePoint creates and cleans it up itself so a user can\ntraverse to an item they were given access to further down, and deleting it by hand breaks\nthat navigation.\n\nRemoving a permission requires the library to hold its own permissions, so a library that\nstill inherits has its inheritance broken (copying the current permissions) first - the\nremoval then applies to that library only, not to the whole site.", "requestBody": { "required": true, "content": { @@ -31461,40 +36402,69 @@ "schema": { "type": "object", "properties": { - "LibraryName": { - "type": "string" - }, - "ListId": { - "type": "string" - }, - "PrincipalId": { + "displayName": { "type": "string" }, - "PrincipalName": { + "ID": { "type": "string" }, - "RoleDefinitionId": { + "MustChange": { "type": "string" }, - "SiteUrl": { + "password": { "type": "string" }, "tenantFilter": { "type": "string" - }, - "Title": { - "type": "string" } }, "required": [ - "PrincipalId", - "SiteUrl", "tenantFilter" - ] + ], + "additionalProperties": true, + "x-cipp-passthrough": true, + "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, + "parameters": [ + { + "name": "displayName", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "ID", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "MustChange", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "password", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], "responses": { "200": { "description": "Success", @@ -31514,6 +36484,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -31521,79 +36494,56 @@ "bearerAuth": [] } ], - "x-cipp-role": "Sharepoint.Site.ReadWrite" + "x-cipp-role": "Identity.User.ReadWrite" } }, - "/api/ExecRemoveMailboxRule": { + "/api/ExecRestoreBackup": { "post": { - "summary": "ExecRemoveMailboxRule", - "operationId": "ExecRemoveMailboxRule", + "summary": "ExecRestoreBackup", + "operationId": "ExecRestoreBackup", "tags": [ - "Email-Exchange > Administration" + "CIPP > Settings" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { - "type": "object", - "properties": { - "ruleId": { - "type": "string" - }, - "ruleName": { - "type": "string" - }, - "TenantFilter": { - "type": "string" - }, - "userPrincipalName": { - "type": "string" + "type": "array", + "description": "The request body is a JSON array. Each element has the shape below.", + "items": { + "type": "object", + "properties": { + "BackupName": { + "type": "string", + "description": "Use Get-CIPPBackup which already handles fetching from blob storage" + }, + "PartitionKey": { + "type": "string" + }, + "SelectedTypes": { + "type": "array", + "items": { + "type": "string" + } + }, + "table": { + "type": "string" + } } - }, - "required": [ - "TenantFilter" - ] + } } } } }, - "parameters": [ - { - "name": "ruleId", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "ruleName", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - }, - { - "name": "userPrincipalName", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - } - ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } @@ -31604,6 +36554,9 @@ "403": { "description": "Forbidden - caller lacks the required RBAC role" }, + "404": { + "description": "Not found" + }, "500": { "description": "Internal server error" } @@ -31613,13 +36566,13 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, - "/api/ExecRemoveOneDriveShortCut": { + "/api/ExecRestoreDeleted": { "post": { - "summary": "ExecRemoveOneDriveShortCut", - "operationId": "ExecRemoveOneDriveShortCut", + "summary": "ExecRestoreDeleted", + "operationId": "ExecRestoreDeleted", "tags": [ "Identity > Administration > Users" ], @@ -31630,17 +36583,18 @@ "schema": { "type": "object", "properties": { - "id": { - "$ref": "#/components/schemas/LabelValue" + "displayName": { + "type": "string" }, - "name": { - "$ref": "#/components/schemas/LabelValue" + "ID": { + "type": "string" }, "tenantFilter": { - "type": "string" + "type": "string", + "description": "Interact with query parameters or the body of the request." }, - "username": { - "$ref": "#/components/schemas/LabelValue" + "userPrincipalName": { + "type": "string" } }, "required": [ @@ -31650,6 +36604,19 @@ } } }, + "parameters": [ + { + "name": "ID", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], "responses": { "200": { "description": "Success", @@ -31676,17 +36643,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.ReadWrite" + "x-cipp-role": "Tenant.Directory.ReadWrite" } }, - "/api/ExecRemoveRestrictedUser": { + "/api/ExecRestoreDeletedSite": { "post": { - "summary": "ExecRemoveRestrictedUser", - "operationId": "ExecRemoveRestrictedUser", + "summary": "ExecRestoreDeletedSite", + "operationId": "ExecRestoreDeletedSite", "tags": [ - "Email-Exchange > Administration" + "Teams-Sharepoint" ], - "description": "Removes a user from the restricted senders list in Exchange Online.", + "description": "Restores a deleted SharePoint site from the tenant recycle bin via the SharePoint\nadmin CSOM API.", "requestBody": { "required": true, "content": { @@ -31694,16 +36661,18 @@ "schema": { "type": "object", "properties": { - "SenderAddress": { + "SiteUrl": { "type": "string" }, "tenantFilter": { - "type": "string", - "description": "Interact with query parameters or the body of the request." + "type": "string" + }, + "Url": { + "type": "string" } }, "required": [ - "SenderAddress", + "SiteUrl", "tenantFilter" ] } @@ -31721,14 +36690,14 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -31736,17 +36705,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecRemoveSharingLink": { + "/api/ExecRestoreRecycleBinItems": { "post": { - "summary": "ExecRemoveSharingLink", - "operationId": "ExecRemoveSharingLink", + "summary": "ExecRestoreRecycleBinItems", + "operationId": "ExecRestoreRecycleBinItems", "tags": [ "Teams-Sharepoint" ], - "description": "Revokes a sharing link (or direct sharing grant) on a SharePoint or OneDrive item by\ndeleting the permission from the drive item. Also removes the revoked link from the\nSharePointSharingLinks reporting cache so the sharing report reflects it immediately.", + "description": "Restores one or more items from a SharePoint site's recycle bin via the SharePoint\nREST API RestoreByIds method with certificate authentication.", "requestBody": { "required": true, "content": { @@ -31754,19 +36723,13 @@ "schema": { "type": "object", "properties": { - "CacheId": { - "type": "string" - }, - "DriveId": { - "type": "string" - }, - "FileName": { + "Ids": { "type": "string" }, - "ItemId": { + "ItemNames": { "type": "string" }, - "PermissionId": { + "SiteUrl": { "type": "string" }, "tenantFilter": { @@ -31774,6 +36737,7 @@ } }, "required": [ + "SiteUrl", "tenantFilter" ] } @@ -31806,17 +36770,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Sharepoint.Site.ReadWrite" + "x-cipp-role": "Sharepoint.SiteRecycleBin.ReadWrite" } }, - "/api/ExecRemoveSiteUser": { + "/api/ExecRevokeOneDriveLink": { "post": { - "summary": "ExecRemoveSiteUser", - "operationId": "ExecRemoveSiteUser", + "summary": "ExecRevokeOneDriveLink", + "operationId": "ExecRevokeOneDriveLink", "tags": [ "Teams-Sharepoint" ], - "description": "Removes a user from one or more SharePoint sites entirely: deleting the site user\nremoves them from every site group and direct permission grant at once. Uses the\nSharePoint REST API with certificate authentication. Note this does not revoke\nsharing links the user received by mail; use the sharing link actions for those.", "requestBody": { "required": true, "content": { @@ -31827,42 +36790,27 @@ "DisplayName": { "type": "string" }, - "SiteUrl": { - "type": "string", - "description": "Single site (SiteUrl) or several at once (SiteUrls, e.g. from the External Users report)." + "DriveId": { + "type": "string" }, - "SiteUrls": { - "type": "string", - "description": "Single site (SiteUrl) or several at once (SiteUrls, e.g. from the External Users report)." + "ItemId": { + "type": "string" }, - "tenantFilter": { + "PermissionId": { "type": "string" }, - "user": { - "type": "object", - "properties": { - "addedFields": { - "type": "object", - "properties": { - "LoginName": { - "type": "string", - "description": "The picker supplies the SP claims login via addedFields; fall back to building it from the UPN." - } - }, - "required": [ - "LoginName" - ], - "description": "The picker supplies the SP claims login via addedFields; fall back to building it from the UPN." - }, - "value": { - "type": "string", - "description": "The picker supplies the SP claims login via addedFields; fall back to building it from the UPN." - } - }, - "description": "The picker supplies the SP claims login via addedFields; fall back to building it from the UPN." + "RevokeAll": { + "type": "string" + }, + "SiteId": { + "type": "string" + }, + "tenantFilter": { + "type": "string" } }, "required": [ + "DriveId", "tenantFilter" ] } @@ -31880,14 +36828,14 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -31898,34 +36846,41 @@ "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecRemoveSnooze": { + "/api/ExecRevokeSessions": { "post": { - "summary": "ExecRemoveSnooze", - "operationId": "ExecRemoveSnooze", + "summary": "ExecRevokeSessions", + "operationId": "ExecRevokeSessions", "tags": [ - "CIPP > Core" + "Identity > Administration > Users" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "PartitionKey": { + "id": { "type": "string" }, - "RowKey": { + "tenantFilter": { + "type": "string", + "description": "Interact with query parameters or the body of the request." + }, + "Username": { "type": "string" } - } + }, + "required": [ + "tenantFilter" + ] } } } }, "parameters": [ { - "name": "PartitionKey", + "name": "id", "in": "query", "required": false, "schema": { @@ -31933,7 +36888,10 @@ } }, { - "name": "RowKey", + "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "Username", "in": "query", "required": false, "schema": { @@ -31952,9 +36910,6 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -31970,18 +36925,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AlertSnooze.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "Identity.User.ReadWrite" } }, - "/api/ExecRemoveSPOExternalUser": { - "post": { - "summary": "ExecRemoveSPOExternalUser", - "operationId": "ExecRemoveSPOExternalUser", + "/api/ExecRoleAssignment": { + "post": { + "summary": "ExecRoleAssignment", + "operationId": "ExecRoleAssignment", "tags": [ - "Teams-Sharepoint" + "Identity > Administration > Users" ], - "description": "Fully removes an external user's guest access: deletes their Entra guest account (when\none exists) AND removes them from every SharePoint site they hold membership on, in one\npass - so no orphaned accounts or lingering site access are left behind. The inert\nSharePoint external-store entry cannot be deleted (Microsoft deprecated\nRemoveExternalUsers) and ages out on its own; sharing links the user received are\nrevoked separately via the Sharing Report.", "requestBody": { "required": true, "content": { @@ -31989,20 +36942,37 @@ "schema": { "type": "object", "properties": { - "DisplayName": { - "type": "string" + "action": { + "type": "string", + "enum": [ + "Add", + "AddTemporary", + "Remove" + ] }, - "EntraUserId": { + "displayName": { "type": "string" }, - "LoginName": { + "expiration": { "type": "string" }, - "SiteUrls": { + "reason": { "type": "string" }, + "roles": { + "type": "array", + "items": { + "$ref": "#/components/schemas/LabelValue" + } + }, "tenantFilter": { "type": "string" + }, + "userId": { + "type": "string" + }, + "userPrincipalName": { + "type": "string" } }, "required": [ @@ -32038,41 +37008,23 @@ "bearerAuth": [] } ], - "x-cipp-role": "Sharepoint.Site.ReadWrite" + "x-cipp-role": "Identity.Role.ReadWrite" } }, - "/api/ExecRemoveTeamsVoicePhoneNumberAssignment": { + "/api/ExecRunBackup": { "post": { - "summary": "ExecRemoveTeamsVoicePhoneNumberAssignment", - "operationId": "ExecRemoveTeamsVoicePhoneNumberAssignment", + "summary": "ExecRunBackup", + "operationId": "ExecRunBackup", "tags": [ - "Teams-Sharepoint" + "CIPP > Settings" ], - "description": "Unassigns a phone number from a user or resource account via the Teams administration Graph API.", "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", - "properties": { - "AssignedTo": { - "type": "string" - }, - "PhoneNumber": { - "type": "string" - }, - "PhoneNumberType": { - "type": "string" - }, - "tenantFilter": { - "type": "string", - "description": "Interact with query parameters or the body of the request." - } - }, - "required": [ - "tenantFilter" - ] + "properties": {} } } } @@ -32083,7 +37035,16 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "backup": { + "x-cipp-field-source": "backend" + }, + "Results": { + "x-cipp-field-source": "backend" + } + } } } } @@ -32103,16 +37064,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Teams.Voice.ReadWrite" + "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, - "/api/ExecRemoveTenant": { + "/api/ExecRunTenantGroupRule": { "post": { - "summary": "ExecRemoveTenant", - "operationId": "ExecRemoveTenant", + "summary": "Execute tenant group dynamic rules immediately", + "operationId": "ExecRunTenantGroupRule", "tags": [ "CIPP > Settings" ], + "description": "This function executes dynamic tenant group rules for immediate membership updates", "requestBody": { "required": false, "content": { @@ -32120,7 +37082,7 @@ "schema": { "type": "object", "properties": { - "TenantID": { + "groupId": { "type": "string" } } @@ -32128,6 +37090,16 @@ } } }, + "parameters": [ + { + "name": "groupId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], "responses": { "200": { "description": "Success", @@ -32137,69 +37109,33 @@ "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "customerId": { - "x-cipp-field-source": "storage" - }, - "defaultDomainName": { - "x-cipp-field-source": "storage" - }, - "delegatedPrivilegeStatus": { - "x-cipp-field-source": "storage" - }, - "directTenantAuthDate": { - "x-cipp-field-source": "storage" - }, - "directTenantUserPrincipalName": { - "x-cipp-field-source": "storage" - }, - "displayName": { + "Description": { "x-cipp-field-source": "storage" }, - "domains": { + "DynamicRules": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, - "Excluded": { - "x-cipp-field-source": "storage" - }, - "ExcludeDate": { - "x-cipp-field-source": "storage" - }, - "ExcludeUser": { - "x-cipp-field-source": "storage" - }, - "hasAutoExtend": { - "x-cipp-field-source": "storage" - }, - "initialDomainName": { - "x-cipp-field-source": "storage" - }, - "LastGraphError": { + "ExcludePartnerTenant": { + "type": "boolean", "x-cipp-field-source": "storage" }, - "LastGraphTokenError": { + "GroupType": { "x-cipp-field-source": "storage" }, - "LastRefresh": { + "Name": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, - "relationshipCount": { - "x-cipp-field-source": "storage" - }, - "relationshipEnd": { - "x-cipp-field-source": "storage" - }, - "RequiresRefresh": { - "type": "boolean", + "RowKey": { "x-cipp-field-source": "storage" }, - "RowKey": { + "RuleLogic": { "x-cipp-field-source": "storage" }, "Timestamp": { @@ -32211,18 +37147,12 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, - "404": { - "description": "Not found" - }, "500": { "description": "Internal server error" } @@ -32232,79 +37162,14 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Administration.ReadWrite" - } - }, - "/api/ExecRenameAPDevice": { - "post": { - "summary": "ExecRenameAPDevice", - "operationId": "ExecRenameAPDevice", - "tags": [ - "Endpoint > Autopilot" - ], - "requestBody": { - "required": true, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "deviceId": { - "type": "string" - }, - "displayName": { - "type": "array", - "items": { - "type": "string" - } - }, - "serialNumber": { - "type": "string" - }, - "tenantFilter": { - "type": "string" - } - }, - "required": [ - "tenantFilter" - ] - } - } - } - }, - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/StandardResults" - } - } - } - }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" - }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" - } - }, - "security": [ - { - "bearerAuth": [] - } - ], - "x-cipp-role": "Endpoint.Autopilot.ReadWrite" + "x-cipp-role": "Tenant.Groups.ReadWrite", + "x-cipp-any-tenant": true } }, - "/api/ExecReportAttachmentRetentionConfig": { + "/api/ExecSAMAppPermissions": { "post": { - "summary": "ExecReportAttachmentRetentionConfig", - "operationId": "ExecReportAttachmentRetentionConfig", + "summary": "ExecSAMAppPermissions", + "operationId": "ExecSAMAppPermissions", "tags": [ "CIPP > Settings" ], @@ -32315,8 +37180,8 @@ "schema": { "type": "object", "properties": { - "RetentionDays": { - "type": "integer" + "Permissions": { + "type": "string" } } } @@ -32325,11 +37190,15 @@ }, "parameters": [ { - "name": "List", + "name": "Action", "in": "query", "required": false, "schema": { - "type": "string" + "type": "string", + "enum": [ + "Reset", + "Update" + ] } } ], @@ -32340,110 +37209,52 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "ApplicationId": { - "x-cipp-field-source": "storage" - }, - "colour": { - "x-cipp-field-source": "storage" - }, - "coverFooterText": { - "x-cipp-field-source": "storage" - }, - "coverImage": { - "x-cipp-field-source": "storage" - }, - "coverImageId": { - "x-cipp-field-source": "storage" - }, - "coverImageIds": { - "x-cipp-field-source": "storage" - }, - "coverStock": { - "x-cipp-field-source": "storage" - }, - "coverUploads": { - "x-cipp-field-source": "storage" - }, - "Enabled": { - "type": "boolean", - "x-cipp-field-source": "storage" - }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, - "footerText": { - "x-cipp-field-source": "storage" - }, - "logo": { - "x-cipp-field-source": "storage" - }, - "logoImageId": { - "x-cipp-field-source": "storage" - }, - "logoImageIds": { + "GUID": { "x-cipp-field-source": "storage" }, - "logoUploads": { + "JSON": { "x-cipp-field-source": "storage" }, - "MaxDuration": { + "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, - "reportDefaults": { - "x-cipp-field-source": "storage" - }, - "Resolver": { - "x-cipp-field-source": "storage" - }, - "Results": { - "x-cipp-field-source": "backend" - }, - "RetentionDays": { - "x-cipp-field-source": "storage" - }, - "roleColours": { + "Permissions": { + "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { + "type": "string", "x-cipp-field-source": "storage" }, - "secondaryColour": { + "SHA": { "x-cipp-field-source": "storage" }, - "showFooter": { + "Source": { "x-cipp-field-source": "storage" }, - "showPageNumbers": { + "SourcePath": { "x-cipp-field-source": "storage" }, - "StandardsExcludeAllTenants": { + "TemplateName": { + "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, - "Timezone": { - "x-cipp-field-source": "storage" - }, - "TimezoneSource": { - "x-cipp-field-source": "storage" - }, - "Value": { + "UpdatedBy": { "type": "string", "x-cipp-field-source": "storage" - }, - "watermarkEnabled": { - "x-cipp-field-source": "storage" - }, - "watermarkText": { - "x-cipp-field-source": "storage" } } } @@ -32462,55 +37273,42 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AppSettings.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "CIPP.SuperAdmin.ReadWrite" } }, - "/api/ExecReportBuilderTemplate": { + "/api/ExecSAMCertificate": { "post": { - "summary": "ExecReportBuilderTemplate", - "operationId": "ExecReportBuilderTemplate", + "summary": "Get SAM certificate status or trigger a renewal", + "operationId": "ExecSAMCertificate", "tags": [ - "Tools > Report-Builder" + "CIPP > Core" ], + "description": "Returns status information about the SAM app certificate (thumbprint, validity,\nregistration state) or forces a renewal via Update-CIPPSAMCertificate. Never\nreturns private key material.", "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { - "type": "string", - "enum": [ - "delete", - "save" - ] - }, - "Blocks": { - "type": "string" - }, - "GUID": { - "type": "string" - }, - "Name": { - "type": "array", - "items": { - "type": "string" - } - }, - "Settings": { "type": "string" } - }, - "required": [ - "GUID", - "Name" - ] + } } } } }, + "parameters": [ + { + "name": "Action", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], "responses": { "200": { "description": "Success", @@ -32518,53 +37316,183 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { - "ContentHash": { - "x-cipp-field-source": "storage" + "addIns": { + "type": "array", + "x-cipp-field-source": "graph-entity" }, - "ETag": { + "api": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "appId": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "GUID": { - "x-cipp-field-source": "storage" + "applicationTemplateId": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "JSON": { - "x-cipp-field-source": "storage" + "appRoles": { + "type": "array", + "x-cipp-field-source": "graph-entity" }, - "Package": { - "x-cipp-field-source": "storage" + "authenticationBehaviors": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "PartitionKey": { - "x-cipp-field-source": "storage" + "certification": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "createdByAppId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "createdDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "defaultRedirectUri": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "deletedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "description": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "disabledByMicrosoftStatus": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "displayName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "groupMembershipClaims": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "identifierUris": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "info": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "isDeviceOnlyAuthSupported": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isDisabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isFallbackPublicClient": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "keyCredentials": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "logo": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "managerApplications": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "nativeAuthenticationApisEnabled": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "notes": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "oauth2RequirePostResponse": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "optionalClaims": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "parentalControlSettings": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "passwordCredentials": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "publicClient": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "publisherDomain": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "requestSignatureVerification": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "requiredResourceAccess": { + "type": "array", + "x-cipp-field-source": "graph-entity" }, - "Permissions": { + "samlMetadataUrl": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "RowKey": { - "x-cipp-field-source": "storage" + "serviceManagementReference": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "SHA": { + "servicePrincipalLockConfiguration": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "signInAudience": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "Source": { - "x-cipp-field-source": "storage" + "spa": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "SourcePath": { - "x-cipp-field-source": "storage" + "tags": { + "type": "array", + "x-cipp-field-source": "graph-entity" }, - "TemplateName": { - "x-cipp-field-source": "storage" + "tokenEncryptionKeyId": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "Timestamp": { + "uniqueName": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "UpdatedBy": { - "x-cipp-field-source": "storage" + "verifiedPublisher": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "web": { + "type": "object", + "x-cipp-field-source": "graph-entity" } } } @@ -32586,59 +37514,44 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.ReportBuilder.ReadWrite" + "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, - "/api/ExecReprocessUserLicenses": { + "/api/ExecSAMRoles": { "post": { - "summary": "ExecReprocessUserLicenses", - "operationId": "ExecReprocessUserLicenses", + "summary": "ExecSAMRoles", + "operationId": "ExecSAMRoles", "tags": [ - "Identity > Administration > Users" + "CIPP > Settings" ], "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { - "ID": { + "Roles": { "type": "string" }, - "tenantFilter": { - "type": "string", - "description": "Interact with query parameters or the body of the request." - }, - "userPrincipalName": { + "Tenants": { "type": "string" } - }, - "required": [ - "tenantFilter" - ] + } } } } }, "parameters": [ { - "name": "ID", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - }, - { - "name": "userPrincipalName", + "name": "Action", "in": "query", "required": false, "schema": { - "type": "string" + "type": "string", + "enum": [ + "Update" + ] } } ], @@ -32648,7 +37561,35 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "Roles": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "Tenants": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + } + } } } } @@ -32658,9 +37599,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -32668,58 +37606,36 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.ReadWrite" + "x-cipp-role": "CIPP.SuperAdmin.ReadWrite" } }, - "/api/ExecRequirePasswordChange": { + "/api/ExecSamSecretStatus": { "post": { - "summary": "ExecRequirePasswordChange", - "operationId": "ExecRequirePasswordChange", + "summary": "Reports whether the stored SAM application secret is usable yet.", + "operationId": "ExecSamSecretStatus", "tags": [ - "Identity > Administration > Users" + "CIPP > Setup" ], - "description": "Requires password change at next sign-in without resetting the password.\nSets passwordProfile.forceChangePasswordNextSignIn via Graph. Not supported for directory-synced users.", + "description": "The setup wizard creates a client secret on one step and uses it on the next, but Entra\ncan take several minutes to replicate a newly created secret. Until it has, every token\nrequest fails with AADSTS7000215 even though the value CIPP holds is correct. This lets\nthe wizard wait on that instead of failing the user after they have already signed in.", "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", - "properties": { - "ID": { - "type": "string" - }, - "tenantFilter": { - "type": "string" - } - }, - "required": [ - "tenantFilter" - ] + "properties": {} } } } }, - "parameters": [ - { - "name": "ID", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - } - ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } @@ -32729,9 +37645,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -32739,16 +37652,18 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.ReadWrite" + "x-cipp-role": "CIPP.AppSettings.ReadWrite", + "x-cipp-any-tenant": true } }, - "/api/ExecResetMFA": { + "/api/ExecScheduleAuditExclusionVacation": { "post": { - "summary": "ExecResetMFA", - "operationId": "ExecResetMFA", + "summary": "Schedule a location alert exclusion for a vacation period", + "operationId": "ExecScheduleAuditExclusionVacation", "tags": [ - "Identity > Administration > Users" + "Tenant > Administration > Alerts" ], + "description": "Adds the selected users to the audit log location alert exclusion list at the start date and removes them again at the end date, so location-based alerts do not fire while they travel. Works on its own and does not require a Conditional Access policy.", "requestBody": { "required": true, "content": { @@ -32756,16 +37671,26 @@ "schema": { "type": "object", "properties": { - "ID": { + "endDate": { + "type": "string", + "description": "Unix timestamp for when the exclusion is removed" + }, + "postExecution": { "type": "string" }, - "MethodId": { + "reference": { + "type": "string" + }, + "startDate": { "type": "string", - "description": "When supplied, only this single authentication method is removed instead of all of them." + "description": "Unix timestamp for when the exclusion is added" }, "tenantFilter": { + "type": "string" + }, + "Users": { "type": "string", - "description": "Interact with query parameters or the body of the request." + "description": "The users going on vacation" } }, "required": [ @@ -32801,15 +37726,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.ReadWrite" + "x-cipp-role": "CIPP.Alert.ReadWrite" } }, - "/api/ExecResetPass": { + "/api/ExecScheduleForwardingVacation": { "post": { - "summary": "ExecResetPass", - "operationId": "ExecResetPass", + "summary": "ExecScheduleForwardingVacation", + "operationId": "ExecScheduleForwardingVacation", "tags": [ - "Identity > Administration > Users" + "Email-Exchange > Administration" ], "requestBody": { "required": true, @@ -32818,56 +37743,49 @@ "schema": { "type": "object", "properties": { - "displayName": { + "endDate": { "type": "string" }, - "ID": { + "ForwardExternal": { "type": "string" }, - "MustChange": { + "ForwardInternal": { + "$ref": "#/components/schemas/LabelValue" + }, + "forwardOption": { + "type": "string", + "enum": [ + "ExternalAddress", + "internalAddress" + ] + }, + "KeepCopy": { + "type": "string" + }, + "postExecution": { + "type": "string" + }, + "reference": { + "type": "string" + }, + "startDate": { "type": "string" }, "tenantFilter": { - "type": "string", - "description": "Interact with query parameters or the body of the request." + "type": "string" + }, + "Users": { + "type": "string" } }, "required": [ + "ForwardExternal", "tenantFilter" ] } } } }, - "parameters": [ - { - "name": "displayName", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "ID", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "MustChange", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - } - ], "responses": { "200": { "description": "Success", @@ -32894,44 +37812,56 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.ReadWrite" + "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecRestoreBackup": { + "/api/ExecScheduleGroupMembershipVacation": { "post": { - "summary": "ExecRestoreBackup", - "operationId": "ExecRestoreBackup", + "summary": "Schedule group membership for a vacation period", + "operationId": "ExecScheduleGroupMembershipVacation", "tags": [ - "CIPP > Settings" + "Identity > Administration > Users" ], + "description": "Adds the selected users to each selected group at the start date and removes them again at the end date. Users who were already members of a group are left untouched.", "requestBody": { "required": true, "content": { "application/json": { "schema": { - "type": "array", - "description": "The request body is a JSON array. Each element has the shape below.", - "items": { - "type": "object", - "properties": { - "BackupName": { - "type": "string", - "description": "Use Get-CIPPBackup which already handles fetching from blob storage" - }, - "PartitionKey": { - "type": "string" - }, - "SelectedTypes": { - "type": "array", - "items": { - "type": "string" - } + "type": "object", + "properties": { + "endDate": { + "type": "string", + "description": "Unix timestamp for when the users are removed" + }, + "Groups": { + "type": "array", + "items": { + "$ref": "#/components/schemas/LabelValue" }, - "table": { - "type": "string" - } + "description": "The groups to add the users to, as { value = group id; label = display name }" + }, + "postExecution": { + "type": "string" + }, + "reference": { + "type": "string" + }, + "startDate": { + "type": "string", + "description": "Unix timestamp for when the users are added" + }, + "tenantFilter": { + "type": "string" + }, + "Users": { + "type": "string", + "description": "The users going on vacation" } - } + }, + "required": [ + "tenantFilter" + ] } } } @@ -32942,13 +37872,7 @@ "content": { "application/json": { "schema": { - "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", - "properties": { - "Results": { - "x-cipp-field-source": "backend" - } - } + "$ref": "#/components/schemas/StandardResults" } } } @@ -32958,6 +37882,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -32965,15 +37892,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AppSettings.ReadWrite" + "x-cipp-role": "Identity.Group.ReadWrite" } }, - "/api/ExecRestoreDeleted": { + "/api/ExecScheduleMailboxVacation": { "post": { - "summary": "ExecRestoreDeleted", - "operationId": "ExecRestoreDeleted", + "summary": "ExecScheduleMailboxVacation", + "operationId": "ExecScheduleMailboxVacation", "tags": [ - "Identity > Administration > Users" + "Email-Exchange > Administration" ], "requestBody": { "required": true, @@ -32982,17 +37909,40 @@ "schema": { "type": "object", "properties": { - "displayName": { + "autoMap": { + "type": "boolean" + }, + "calendarPermission": { + "$ref": "#/components/schemas/LabelValue" + }, + "canViewPrivateItems": { + "type": "boolean" + }, + "delegates": { "type": "string" }, - "ID": { + "endDate": { "type": "string" }, - "tenantFilter": { - "type": "string", - "description": "Interact with query parameters or the body of the request." + "includeCalendar": { + "type": "boolean" }, - "userPrincipalName": { + "mailboxOwners": { + "type": "string" + }, + "permissionTypes": { + "type": "string" + }, + "postExecution": { + "type": "string" + }, + "reference": { + "type": "string" + }, + "startDate": { + "type": "string" + }, + "tenantFilter": { "type": "string" } }, @@ -33003,19 +37953,6 @@ } } }, - "parameters": [ - { - "name": "ID", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - } - ], "responses": { "200": { "description": "Success", @@ -33042,17 +37979,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Directory.ReadWrite" + "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecRestoreDeletedSite": { + "/api/ExecScheduleOOOVacation": { "post": { - "summary": "ExecRestoreDeletedSite", - "operationId": "ExecRestoreDeletedSite", + "summary": "ExecScheduleOOOVacation", + "operationId": "ExecScheduleOOOVacation", "tags": [ - "Teams-Sharepoint" + "Email-Exchange > Administration" ], - "description": "Restores a deleted SharePoint site from the tenant recycle bin via the SharePoint\nadmin CSOM API.", "requestBody": { "required": true, "content": { @@ -33060,18 +37996,48 @@ "schema": { "type": "object", "properties": { - "SiteUrl": { + "AutoDeclineFutureRequestsWhenOOF": { + "type": "string" + }, + "CreateOOFEvent": { + "type": "string", + "description": "Calendar options — conditionally add when truthy in the request body" + }, + "DeclineEventsForScheduledOOF": { + "type": "string" + }, + "DeclineMeetingMessage": { + "type": "string" + }, + "endDate": { + "type": "string" + }, + "externalMessage": { + "type": "string" + }, + "internalMessage": { + "type": "string" + }, + "OOFEventSubject": { + "type": "string" + }, + "postExecution": { + "type": "string" + }, + "reference": { + "type": "string" + }, + "startDate": { "type": "string" }, "tenantFilter": { "type": "string" }, - "Url": { + "Users": { "type": "string" } }, "required": [ - "SiteUrl", "tenantFilter" ] } @@ -33089,14 +38055,14 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -33104,41 +38070,23 @@ "bearerAuth": [] } ], - "x-cipp-role": "Sharepoint.Site.ReadWrite" + "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecRestoreRecycleBinItems": { + "/api/ExecSchedulerBillingRun": { "post": { - "summary": "ExecRestoreRecycleBinItems", - "operationId": "ExecRestoreRecycleBinItems", + "summary": "ExecSchedulerBillingRun", + "operationId": "ExecSchedulerBillingRun", "tags": [ - "Teams-Sharepoint" + "CIPP > Scheduler" ], - "description": "Restores one or more items from a SharePoint site's recycle bin via the SharePoint\nREST API RestoreByIds method with certificate authentication.", "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", - "properties": { - "Ids": { - "type": "string" - }, - "ItemNames": { - "type": "string" - }, - "SiteUrl": { - "type": "string" - }, - "tenantFilter": { - "type": "string" - } - }, - "required": [ - "SiteUrl", - "tenantFilter" - ] + "properties": {} } } } @@ -33149,14 +38097,32 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "config": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + } + } } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -33169,15 +38135,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Sharepoint.SiteRecycleBin.ReadWrite" + "x-cipp-role": "Scheduler.Billing.ReadWrite" } }, - "/api/ExecRevokeSessions": { + "/api/ExecSearchFiles": { "post": { - "summary": "ExecRevokeSessions", - "operationId": "ExecRevokeSessions", + "summary": "ExecSearchFiles", + "operationId": "ExecSearchFiles", "tags": [ - "Identity > Administration > Users" + "Teams-Sharepoint" ], "requestBody": { "required": true, @@ -33186,19 +38152,30 @@ "schema": { "type": "object", "properties": { - "id": { + "FilterDateFrom": { "type": "string" }, - "tenantFilter": { - "type": "string", - "description": "Interact with query parameters or the body of the request." + "FilterDateTo": { + "type": "string" }, - "Username": { + "FilterModifiedBy": { + "type": "string" + }, + "From": { + "type": "string" + }, + "SearchQuery": { + "type": "string" + }, + "Size": { + "type": "string" + }, + "TenantFilter": { "type": "string" } }, "required": [ - "tenantFilter" + "TenantFilter" ] } } @@ -33206,7 +38183,7 @@ }, "parameters": [ { - "name": "id", + "name": "From", "in": "query", "required": false, "schema": { @@ -33214,15 +38191,23 @@ } }, { - "$ref": "#/components/parameters/tenantFilter" + "name": "SearchQuery", + "in": "query", + "required": false, + "schema": { + "type": "string" + } }, { - "name": "Username", + "name": "Size", "in": "query", "required": false, "schema": { "type": "string" } + }, + { + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -33231,11 +38216,77 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "createdBy": { + "x-cipp-field-source": "backend" + }, + "createdDate": { + "x-cipp-field-source": "backend" + }, + "driveId": { + "x-cipp-field-source": "backend" + }, + "driveName": { + "x-cipp-field-source": "backend" + }, + "fileExtension": { + "x-cipp-field-source": "backend" + }, + "folderPath": { + "x-cipp-field-source": "backend" + }, + "id": { + "x-cipp-field-source": "backend" + }, + "isFolder": { + "x-cipp-field-source": "backend" + }, + "lastModified": { + "x-cipp-field-source": "backend" + }, + "lastModifiedBy": { + "x-cipp-field-source": "backend" + }, + "name": { + "x-cipp-field-source": "backend" + }, + "parentId": { + "x-cipp-field-source": "backend" + }, + "rank": { + "x-cipp-field-source": "backend" + }, + "siteId": { + "x-cipp-field-source": "backend" + }, + "siteName": { + "x-cipp-field-source": "backend" + }, + "sizeFormatted": { + "x-cipp-field-source": "backend" + }, + "sizeInBytes": { + "x-cipp-field-source": "backend" + }, + "summary": { + "x-cipp-field-source": "backend" + }, + "type": { + "x-cipp-field-source": "backend" + }, + "webUrl": { + "x-cipp-field-source": "backend" + } + } } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -33251,15 +38302,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.ReadWrite" + "x-cipp-role": "Sharepoint.Site.Read" } }, - "/api/ExecRunBackup": { + "/api/ExecSendOrgMessage": { "post": { - "summary": "ExecRunBackup", - "operationId": "ExecRunBackup", + "summary": "ExecSendOrgMessage", + "operationId": "ExecSendOrgMessage", "tags": [ - "CIPP > Settings" + "Tenant > Administration > Tenant" ], "requestBody": { "required": false, @@ -33272,21 +38323,58 @@ } } }, + "parameters": [ + { + "name": "freq", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "ID", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "type", + "in": "query", + "required": false, + "schema": { + "type": "string", + "enum": [ + "getStarted", + "notification", + "taskbar" + ] + } + }, + { + "name": "URL", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { - "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", - "properties": { - "backup": { - "x-cipp-field-source": "backend" - }, - "Results": { - "x-cipp-field-source": "backend" - } + "type": "array", + "items": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } @@ -33304,42 +38392,42 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AppSettings.ReadWrite" + "x-cipp-role": "Tenant.Directory.ReadWrite" } }, - "/api/ExecRunTenantGroupRule": { + "/api/ExecSendPush": { "post": { - "summary": "Execute tenant group dynamic rules immediately", - "operationId": "ExecRunTenantGroupRule", + "summary": "ExecSendPush", + "operationId": "ExecSendPush", "tags": [ - "CIPP > Settings" + "Identity > Administration > Users" ], - "description": "This function executes dynamic tenant group rules for immediate membership updates", + "description": "Sends a test MFA push notification to a user's authenticator app and reports whether it was approved, or - when an OTP code is supplied - verifies that typed code without sending a push. Used to confirm a user's MFA registration works. The push path causes a real prompt on the user's device.", "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "groupId": { + "OTP": { + "type": "string", + "description": "When an OTP code is supplied we verify that code instead of sending a push notification." + }, + "TenantFilter": { + "type": "string" + }, + "UserEmail": { "type": "string" } - } + }, + "required": [ + "TenantFilter" + ] } } } }, - "parameters": [ - { - "name": "groupId", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - } - ], "responses": { "200": { "description": "Success", @@ -33347,40 +38435,366 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { - "Description": { - "x-cipp-field-source": "storage" + "aboutMe": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "accountEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "ageGroup": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "assignedLicenses": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "assignedPlans": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "authorizationInfo": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "birthday": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "businessPhones": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "city": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "cloudLicensing": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "cloudRealtimeCommunicationInfo": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "companyName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "consentProvidedForMinor": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "country": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "createdDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "creationType": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "customSecurityAttributes": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "deletedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "department": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "deviceEnrollmentLimit": { + "type": "integer", + "x-cipp-field-source": "graph-entity" + }, + "deviceKeys": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "displayName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeHireDate": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeLeaveDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeOrgData": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "employeeType": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "externalUserState": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "externalUserStateChangeDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "faxNumber": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "givenName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "hireDate": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "identities": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "identityGovernance": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "identityParentId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "imAddresses": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "infoCatalogs": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "interests": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "isLicenseReconciliationNeeded": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isManagementRestricted": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isResourceAccount": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "jobTitle": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "lastPasswordChangeDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "legalAgeGroupClassification": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "licenseAssignmentStates": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "mail": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "mailboxSettings": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "mailNickname": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "mobilePhone": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "mySite": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "officeLocation": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesDistinguishedName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesDomainName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesExtensionAttributes": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesImmutableId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesLastSyncDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesProvisioningErrors": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSamAccountName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSecurityIdentifier": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSipInfo": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSyncEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesUserPrincipalName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "otherMails": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "passwordPolicies": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "passwordProfile": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "pastProjects": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "postalCode": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "preferredDataLocation": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "preferredLanguage": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "preferredName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "print": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "provisionedPlans": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "proxyAddresses": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "refreshTokensValidFromDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "responsibilities": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "schools": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "securityIdentifier": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "serviceProvisioningErrors": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "showInAddressList": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" }, - "DynamicRules": { - "x-cipp-field-source": "storage" + "signInActivity": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "ETag": { + "signInSessionsValidFromDateTime": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "ExcludePartnerTenant": { - "type": "boolean", - "x-cipp-field-source": "storage" + "skills": { + "type": "array", + "x-cipp-field-source": "graph-entity" }, - "GroupType": { - "x-cipp-field-source": "storage" + "state": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "Name": { - "x-cipp-field-source": "storage" + "streetAddress": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "PartitionKey": { - "x-cipp-field-source": "storage" + "surname": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "RowKey": { - "x-cipp-field-source": "storage" + "usageLocation": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "RuleLogic": { - "x-cipp-field-source": "storage" + "userPrincipalName": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "Timestamp": { + "userType": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" } } } @@ -33392,9 +38806,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -33402,16 +38813,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Groups.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "Identity.User.Read" } }, - "/api/ExecSAMAppPermissions": { + "/api/ExecServicePrincipals": { "post": { - "summary": "ExecSAMAppPermissions", - "operationId": "ExecSAMAppPermissions", + "summary": "ExecServicePrincipals", + "operationId": "ExecServicePrincipals", "tags": [ - "CIPP > Settings" + "CIPP > Core" ], "requestBody": { "required": false, @@ -33419,11 +38829,7 @@ "application/json": { "schema": { "type": "object", - "properties": { - "Permissions": { - "type": "string" - } - } + "properties": {} } } } @@ -33436,112 +38842,28 @@ "schema": { "type": "string", "enum": [ - "Reset", - "Update" + "Create" ] } - } - ], - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "type": "object", - "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", - "properties": { - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "GUID": { - "x-cipp-field-source": "storage" - }, - "JSON": { - "x-cipp-field-source": "storage" - }, - "Package": { - "x-cipp-field-source": "storage" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" - }, - "Permissions": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "RowKey": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "SHA": { - "x-cipp-field-source": "storage" - }, - "Source": { - "x-cipp-field-source": "storage" - }, - "SourcePath": { - "x-cipp-field-source": "storage" - }, - "TemplateName": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "UpdatedBy": { - "type": "string", - "x-cipp-field-source": "storage" - } - } - } - } - } }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" + { + "name": "AppId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" - } - }, - "security": [ { - "bearerAuth": [] - } - ], - "x-cipp-role": "CIPP.SuperAdmin.ReadWrite" - } - }, - "/api/ExecSAMCertificate": { - "post": { - "summary": "Get SAM certificate status or trigger a renewal", - "operationId": "ExecSAMCertificate", - "tags": [ - "CIPP > Core" - ], - "description": "Returns status information about the SAM app certificate (thumbprint, validity,\nregistration state) or forces a renewal via Update-CIPPSAMCertificate. Never\nreturns private key material.", - "requestBody": { - "required": false, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "Action": { - "type": "string" - } - } - } + "name": "Id", + "in": "query", + "required": false, + "schema": { + "type": "string" } - } - }, - "parameters": [ + }, { - "name": "Action", + "name": "Select", "in": "query", "required": false, "schema": { @@ -33558,12 +38880,24 @@ "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { + "accountEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, "addIns": { "type": "array", "x-cipp-field-source": "graph-entity" }, - "api": { - "type": "object", + "alternativeNames": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "appDescription": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "appDisplayName": { + "type": "string", "x-cipp-field-source": "graph-entity" }, "appId": { @@ -33574,28 +38908,24 @@ "type": "string", "x-cipp-field-source": "graph-entity" }, - "appRoles": { - "type": "array", + "appOwnerOrganizationId": { + "type": "string", "x-cipp-field-source": "graph-entity" }, - "authenticationBehaviors": { - "type": "object", + "appRoleAssignmentRequired": { + "type": "boolean", "x-cipp-field-source": "graph-entity" }, - "certification": { - "type": "object", + "appRoles": { + "type": "array", "x-cipp-field-source": "graph-entity" }, "createdByAppId": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "createdDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "defaultRedirectUri": { - "type": "string", + "customSecurityAttributes": { + "type": "object", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { @@ -33614,83 +38944,75 @@ "type": "string", "x-cipp-field-source": "graph-entity" }, - "groupMembershipClaims": { + "errorUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "id": { + "homepage": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "identifierUris": { - "type": "array", + "id": { + "type": "string", "x-cipp-field-source": "graph-entity" }, "info": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "isDeviceOnlyAuthSupported": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, "isDisabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, - "isFallbackPublicClient": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, "keyCredentials": { "type": "array", "x-cipp-field-source": "graph-entity" }, - "logo": { + "loginUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "managerApplications": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "nativeAuthenticationApisEnabled": { - "type": "object", + "logoutUrl": { + "type": "string", "x-cipp-field-source": "graph-entity" }, "notes": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "oauth2RequirePostResponse": { - "type": "boolean", + "notificationEmailAddresses": { + "type": "array", "x-cipp-field-source": "graph-entity" }, - "optionalClaims": { - "type": "object", + "passwordCredentials": { + "type": "array", "x-cipp-field-source": "graph-entity" }, - "parentalControlSettings": { + "passwordSingleSignOnSettings": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "passwordCredentials": { - "type": "array", + "preferredSingleSignOnMode": { + "type": "string", "x-cipp-field-source": "graph-entity" }, - "publicClient": { - "type": "object", + "preferredTokenSigningKeyEndDateTime": { + "type": "string", "x-cipp-field-source": "graph-entity" }, - "publisherDomain": { + "preferredTokenSigningKeyThumbprint": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "requestSignatureVerification": { - "type": "object", + "publishedPermissionScopes": { + "type": "array", "x-cipp-field-source": "graph-entity" }, - "requiredResourceAccess": { + "publisherName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "replyUrls": { "type": "array", "x-cipp-field-source": "graph-entity" }, @@ -33698,20 +39020,20 @@ "type": "string", "x-cipp-field-source": "graph-entity" }, - "serviceManagementReference": { - "type": "string", + "samlSingleSignOnSettings": { + "type": "object", "x-cipp-field-source": "graph-entity" }, - "servicePrincipalLockConfiguration": { - "type": "object", + "servicePrincipalNames": { + "type": "array", "x-cipp-field-source": "graph-entity" }, - "signInAudience": { + "servicePrincipalType": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "spa": { - "type": "object", + "signInAudience": { + "type": "string", "x-cipp-field-source": "graph-entity" }, "tags": { @@ -33722,23 +39044,248 @@ "type": "string", "x-cipp-field-source": "graph-entity" }, - "uniqueName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, "verifiedPublisher": { "type": "object", "x-cipp-field-source": "graph-entity" - }, - "web": { - "type": "object", - "x-cipp-field-source": "graph-entity" } } } } } }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.Application.ReadWrite", + "x-cipp-any-tenant": true + } + }, + "/api/ExecSetAPDeviceGroupTag": { + "post": { + "summary": "ExecSetAPDeviceGroupTag", + "operationId": "ExecSetAPDeviceGroupTag", + "tags": [ + "Endpoint > Autopilot" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "deviceId": { + "type": "string" + }, + "groupTag": { + "type": "array", + "items": { + "type": "string" + } + }, + "serialNumber": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Endpoint.Autopilot.ReadWrite" + } + }, + "/api/ExecSetCalendarProcessing": { + "post": { + "summary": "ExecSetCalendarProcessing", + "operationId": "ExecSetCalendarProcessing", + "tags": [ + "Email-Exchange > Administration" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "additionalResponse": { + "type": "string" + }, + "addOrganizerToSubject": { + "type": "boolean" + }, + "allowConflicts": { + "type": "boolean" + }, + "allowRecurringMeetings": { + "type": "boolean" + }, + "automaticallyAccept": { + "type": "boolean" + }, + "automaticallyProcess": { + "type": "boolean" + }, + "bookingWindowInDays": { + "type": "integer" + }, + "deleteComments": { + "type": "boolean" + }, + "deleteSubject": { + "type": "boolean" + }, + "maxConflicts": { + "type": "integer", + "description": "Add optional numeric parameters only if they have values" + }, + "maximumDurationInMinutes": { + "type": "integer" + }, + "minimumDurationInMinutes": { + "type": "integer" + }, + "processExternalMeetingMessages": { + "type": "boolean" + }, + "removeCanceledMeetings": { + "type": "boolean" + }, + "removeOldMeetingMessages": { + "type": "boolean" + }, + "removePrivateProperty": { + "type": "boolean" + }, + "scheduleOnlyDuringWorkHours": { + "type": "boolean" + }, + "tenantFilter": { + "type": "string" + }, + "UPN": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.Mailbox.ReadWrite" + } + }, + "/api/ExecSetCASMailbox": { + "post": { + "summary": "ExecSetCASMailbox", + "operationId": "ExecSetCASMailbox", + "tags": [ + "Email-Exchange > Administration" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "DisplayName": { + "type": "string" + }, + "Identity": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, "400": { "description": "Bad request - missing required field or invalid input" }, @@ -33747,6 +39294,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -33754,15 +39304,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AppSettings.ReadWrite" + "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecSAMRoles": { + "/api/ExecSetCIPPAutoBackup": { "post": { - "summary": "ExecSAMRoles", - "operationId": "ExecSAMRoles", + "summary": "ExecSetCIPPAutoBackup", + "operationId": "ExecSetCIPPAutoBackup", "tags": [ - "CIPP > Settings" + "CIPP > Core" ], "requestBody": { "required": false, @@ -33771,30 +39321,14 @@ "schema": { "type": "object", "properties": { - "Roles": { - "type": "string" - }, - "Tenants": { - "type": "string" + "Enabled": { + "type": "boolean" } } } } } }, - "parameters": [ - { - "name": "Action", - "in": "query", - "required": false, - "schema": { - "type": "string", - "enum": [ - "Update" - ] - } - } - ], "responses": { "200": { "description": "Success", @@ -33802,34 +39336,7 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", - "properties": { - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" - }, - "Results": { - "x-cipp-field-source": "backend" - }, - "Roles": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "RowKey": { - "x-cipp-field-source": "storage" - }, - "Tenants": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" - } - } + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } @@ -33839,6 +39346,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -33846,24 +39356,44 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.SuperAdmin.ReadWrite" + "x-cipp-role": "CIPP.Backup.ReadWrite" } }, - "/api/ExecSamSecretStatus": { + "/api/ExecSetCloudManaged": { "post": { - "summary": "Reports whether the stored SAM application secret is usable yet.", - "operationId": "ExecSamSecretStatus", + "summary": "ExecSetCloudManaged", + "operationId": "ExecSetCloudManaged", "tags": [ - "CIPP > Setup" + "Identity > Administration > Users" ], - "description": "The setup wizard creates a client secret on one step and uses it on the next, but Entra\ncan take several minutes to replicate a newly created secret. Until it has, every token\nrequest fails with AADSTS7000215 even though the value CIPP holds is correct. This lets\nthe wizard wait on that instead of failing the user after they have already signed in.", + "description": "Sets the cloud-managed status of a user, group, or contact.", "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", - "properties": {} + "properties": { + "displayName": { + "type": "string" + }, + "ID": { + "type": "string" + }, + "isCloudManaged": { + "type": "string" + }, + "tenantFilter": { + "type": "string", + "description": "Interact with query parameters or the body of the request." + }, + "type": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] } } } @@ -33874,8 +39404,7 @@ "content": { "application/json": { "schema": { - "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "$ref": "#/components/schemas/StandardResults" } } } @@ -33885,6 +39414,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -33892,18 +39424,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AppSettings.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "Identity.DirSync.ReadWrite" } }, - "/api/ExecScheduleAuditExclusionVacation": { + "/api/ExecSetDefaultMFAMethod": { "post": { - "summary": "Schedule a location alert exclusion for a vacation period", - "operationId": "ExecScheduleAuditExclusionVacation", + "summary": "ExecSetDefaultMFAMethod", + "operationId": "ExecSetDefaultMFAMethod", "tags": [ - "Tenant > Administration > Alerts" + "Identity > Administration > Users" ], - "description": "Adds the selected users to the audit log location alert exclusion list at the start date and removes them again at the end date, so location-based alerts do not fire while they travel. Works on its own and does not require a Conditional Access policy.", + "description": "Sets the default second factor a user is prompted with, by patching signInPreferences.\nNote this is ignored at sign-in while system-preferred MFA is enabled for the user.", "requestBody": { "required": true, "content": { @@ -33911,26 +39442,14 @@ "schema": { "type": "object", "properties": { - "endDate": { - "type": "string", - "description": "Unix timestamp for when the exclusion is removed" - }, - "postExecution": { - "type": "string" - }, - "reference": { + "ID": { "type": "string" }, - "startDate": { - "type": "string", - "description": "Unix timestamp for when the exclusion is added" + "MethodType": { + "$ref": "#/components/schemas/LabelValue" }, "tenantFilter": { "type": "string" - }, - "Users": { - "type": "string", - "description": "The users going on vacation" } }, "required": [ @@ -33951,6 +39470,9 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -33966,16 +39488,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Alert.ReadWrite" + "x-cipp-role": "Identity.User.ReadWrite" } }, - "/api/ExecScheduleForwardingVacation": { + "/api/ExecSetLibraryInheritance": { "post": { - "summary": "ExecScheduleForwardingVacation", - "operationId": "ExecScheduleForwardingVacation", + "summary": "ExecSetLibraryInheritance", + "operationId": "ExecSetLibraryInheritance", "tags": [ - "Email-Exchange > Administration" + "Teams-Sharepoint" ], + "description": "Controls whether a document library inherits its permissions from the site, via the\nSharePoint REST API.\n\nAction 'Break' detaches the library so it holds its own permissions. CopyRoleAssignments\n(default true) copies the permissions it currently inherits, so nobody loses access at the\nmoment of the break; with it disabled the library starts with an empty permission set and\nonly site collection admins can reach it. ClearSubscopes (default false) resets any folder\nor item inside the library that has its own unique permissions.\n\nAction 'Reset' puts the library back to inheriting from the site. This discards every\npermission unique to the library and cannot be undone other than by granting them again.", "requestBody": { "required": true, "content": { @@ -33983,43 +39506,32 @@ "schema": { "type": "object", "properties": { - "endDate": { - "type": "string" - }, - "ForwardExternal": { + "Action": { "type": "string" }, - "ForwardInternal": { - "$ref": "#/components/schemas/LabelValue" + "ClearSubscopes": { + "type": "boolean" }, - "forwardOption": { + "CopyRoleAssignments": { "type": "string", - "enum": [ - "ExternalAddress", - "internalAddress" - ] - }, - "KeepCopy": { - "type": "string" + "description": "Default to the safe options: keep current access on a break, leave sub-scopes alone." }, - "postExecution": { + "LibraryName": { "type": "string" }, - "reference": { + "ListId": { "type": "string" }, - "startDate": { + "SiteUrl": { "type": "string" }, "tenantFilter": { "type": "string" - }, - "Users": { - "type": "string" } }, "required": [ - "ForwardExternal", + "ListId", + "SiteUrl", "tenantFilter" ] } @@ -34037,14 +39549,14 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -34052,16 +39564,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecScheduleMailboxVacation": { + "/api/ExecSetLibraryPermission": { "post": { - "summary": "ExecScheduleMailboxVacation", - "operationId": "ExecScheduleMailboxVacation", + "summary": "ExecSetLibraryPermission", + "operationId": "ExecSetLibraryPermission", "tags": [ - "Email-Exchange > Administration" + "Teams-Sharepoint" ], + "description": "Grants users and/or groups a SharePoint permission level on a document library (ListId) or\non the site root web (ListId omitted) via the SharePoint REST API. Principals are resolved\nwith ensureuser unless PrincipalId is supplied, role inheritance on the library is broken\n(copying the existing permissions) when it still inherits, and the role assignment is added\nwith addroleassignment.\n\nMode 'Add' leaves any level the principal already holds in place - SharePoint allows a\nprincipal to hold several at once. Mode 'Replace' removes the levels it already holds on\nthis scope first, so the principal ends up with exactly the requested one.\n\nThe level is taken from RoleDefinitionId when supplied (which is how custom permission\nlevels are addressed), otherwise from the named PermissionLevel.", "requestBody": { "required": true, "content": { @@ -34069,40 +39582,105 @@ "schema": { "type": "object", "properties": { - "autoMap": { - "type": "boolean" + "Groups": { + "type": "string" }, - "calendarPermission": { - "$ref": "#/components/schemas/LabelValue" + "LibraryName": { + "type": "string" }, - "canViewPrivateItems": { - "type": "boolean" + "ListId": { + "type": "string" }, - "delegates": { + "Mode": { "type": "string" }, - "endDate": { + "PermissionLevel": { "type": "string" }, - "includeCalendar": { - "type": "boolean" + "PrincipalId": { + "type": "string" }, - "mailboxOwners": { + "PrincipalName": { "type": "string" }, - "permissionTypes": { + "RoleDefinitionId": { "type": "string" }, - "postExecution": { + "SiteUrl": { "type": "string" }, - "reference": { + "tenantFilter": { "type": "string" }, - "startDate": { + "Users": { + "type": "string" + } + }, + "required": [ + "SiteUrl", + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Sharepoint.Site.ReadWrite" + } + }, + "/api/ExecSetLitigationHold": { + "post": { + "summary": "ExecSetLitigationHold", + "operationId": "ExecSetLitigationHold", + "tags": [ + "Email-Exchange > Administration" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "days": { + "type": "integer" + }, + "disable": { + "type": "string" + }, + "Identity": { "type": "string" }, "tenantFilter": { + "type": "string", + "description": "Interact with the query or body of the request" + }, + "UPN": { "type": "string" } }, @@ -34142,10 +39720,10 @@ "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecScheduleOOOVacation": { + "/api/ExecSetMailboxEmailSize": { "post": { - "summary": "ExecScheduleOOOVacation", - "operationId": "ExecScheduleOOOVacation", + "summary": "ExecSetMailboxEmailSize", + "operationId": "ExecSetMailboxEmailSize", "tags": [ "Email-Exchange > Administration" ], @@ -34156,49 +39734,176 @@ "schema": { "type": "object", "properties": { - "AutoDeclineFutureRequestsWhenOOF": { + "id": { "type": "string" }, - "CreateOOFEvent": { - "type": "string", - "description": "Calendar options — conditionally add when truthy in the request body" - }, - "DeclineEventsForScheduledOOF": { + "maxReceiveSize": { "type": "string" }, - "DeclineMeetingMessage": { + "maxSendSize": { "type": "string" }, - "endDate": { - "type": "string" + "tenantFilter": { + "type": "string", + "description": "Interact with query parameters or the body of the request." }, - "externalMessage": { + "UPN": { "type": "string" - }, - "internalMessage": { + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.Mailbox.ReadWrite" + } + }, + "/api/ExecSetMailboxLocale": { + "post": { + "summary": "ExecSetMailboxLocale", + "operationId": "ExecSetMailboxLocale", + "tags": [ + "Email-Exchange > Administration" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "locale": { "type": "string" }, - "OOFEventSubject": { + "tenantFilter": { + "type": "string", + "description": "Interact with query parameters or the body of the request." + }, + "user": { + "type": "object", + "properties": { + "x-forwarded-for": { + "type": "string" + }, + "x-ms-client-principal": { + "type": "string" + }, + "x-ms-client-principal-idp": { + "type": "string", + "x-cipp-observed-values": [ + "aad", + "azureStaticWebApps" + ] + }, + "x-ms-client-principal-name": { + "type": "string" + } + } + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.Mailbox.ReadWrite", + "x-cipp-reads-via": [ + "Write-LogMessage" + ] + } + }, + "/api/ExecSetMailboxQuota": { + "post": { + "summary": "ExecSetMailboxQuota", + "operationId": "ExecSetMailboxQuota", + "tags": [ + "Email-Exchange > Administration" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "IssueWarningQuota": { "type": "string" }, - "postExecution": { + "ProhibitSendQuota": { "type": "string" }, - "reference": { + "ProhibitSendReceiveQuota": { "type": "string" }, - "startDate": { + "quota": { "type": "string" }, - "tenantFilter": { + "tenantfilter": { "type": "string" }, - "Users": { + "user": { "type": "string" } }, "required": [ - "tenantFilter" + "tenantfilter" ] } } @@ -34210,7 +39915,13 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Results": { + "x-cipp-field-source": "backend" + } + } } } } @@ -34220,9 +39931,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -34233,20 +39941,40 @@ "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecSchedulerBillingRun": { + "/api/ExecSetMailboxRestriction": { "post": { - "summary": "ExecSchedulerBillingRun", - "operationId": "ExecSchedulerBillingRun", + "summary": "ExecSetMailboxRestriction", + "operationId": "ExecSetMailboxRestriction", "tags": [ - "CIPP > Scheduler" + "Email-Exchange > Administration" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", - "properties": {} + "properties": { + "Direction": { + "type": "string", + "enum": [ + "Inbound", + "Outbound" + ] + }, + "Enable": { + "type": "boolean" + }, + "tenantFilter": { + "type": "string" + }, + "UserId": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] } } } @@ -34257,37 +39985,22 @@ "content": { "application/json": { "schema": { - "type": "object", - "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", - "properties": { - "config": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" - }, - "RowKey": { - "x-cipp-field-source": "storage" - }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" - } - } + "$ref": "#/components/schemas/StandardResults" } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -34295,67 +40008,47 @@ "bearerAuth": [] } ], - "x-cipp-role": "Scheduler.Billing.ReadWrite" + "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecSendOrgMessage": { + "/api/ExecSetMailboxRetentionPolicies": { "post": { - "summary": "ExecSendOrgMessage", - "operationId": "ExecSendOrgMessage", + "summary": "ExecSetMailboxRetentionPolicies", + "operationId": "ExecSetMailboxRetentionPolicies", "tags": [ - "Tenant > Administration > Tenant" + "Email-Exchange > Administration > Mailbox Retention" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", - "properties": {} + "properties": { + "Mailboxes": { + "type": "array", + "items": { + "type": "string" + } + }, + "PolicyName": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "PolicyName", + "tenantFilter" + ] } } } }, "parameters": [ - { - "name": "freq", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "ID", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, { "$ref": "#/components/parameters/tenantFilter" - }, - { - "name": "type", - "in": "query", - "required": false, - "schema": { - "type": "string", - "enum": [ - "getStarted", - "notification", - "taskbar" - ] - } - }, - { - "name": "URL", - "in": "query", - "required": false, - "schema": { - "type": "string" - } } ], "responses": { @@ -34364,15 +40057,14 @@ "content": { "application/json": { "schema": { - "type": "array", - "items": { - "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." - } + "$ref": "#/components/schemas/StandardResults" } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -34385,17 +40077,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Directory.ReadWrite" + "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecSendPush": { + "/api/ExecSetMailboxRule": { "post": { - "summary": "ExecSendPush", - "operationId": "ExecSendPush", + "summary": "ExecSetMailboxRule", + "operationId": "ExecSetMailboxRule", "tags": [ - "Identity > Administration > Users" + "Email-Exchange > Administration" ], - "description": "Sends a test MFA push notification to a user's authenticator app and reports whether it was approved, or - when an OTP code is supplied - verifies that typed code without sending a push. Used to confirm a user's MFA registration works. The push path causes a real prompt on the user's device.", "requestBody": { "required": true, "content": { @@ -34403,393 +40094,40 @@ "schema": { "type": "object", "properties": { - "OTP": { - "type": "string", - "description": "When an OTP code is supplied we verify that code instead of sending a push notification." + "Disable": { + "type": "boolean" }, - "TenantFilter": { + "Enable": { + "type": "boolean" + }, + "ruleId": { "type": "string" }, - "UserEmail": { + "ruleName": { + "type": "string" + }, + "TenantFilter": { + "type": "string", + "description": "Interact with the query or body of the request" + }, + "userPrincipalName": { "type": "string" } - }, - "required": [ - "TenantFilter" - ] - } - } - } - }, - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "type": "object", - "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", - "properties": { - "aboutMe": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "accountEnabled": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "ageGroup": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "assignedLicenses": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "assignedPlans": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "authorizationInfo": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "birthday": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "businessPhones": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "city": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "cloudLicensing": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "cloudRealtimeCommunicationInfo": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "companyName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "consentProvidedForMinor": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "country": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "createdDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "creationType": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "customSecurityAttributes": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "deletedDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "department": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "deviceEnrollmentLimit": { - "type": "integer", - "x-cipp-field-source": "graph-entity" - }, - "deviceKeys": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "displayName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "employeeHireDate": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "employeeId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "employeeLeaveDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "employeeOrgData": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "employeeType": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "externalUserState": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "externalUserStateChangeDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "faxNumber": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "givenName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "hireDate": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "id": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "identities": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "identityGovernance": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "identityParentId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "imAddresses": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "infoCatalogs": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "interests": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "isLicenseReconciliationNeeded": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "isManagementRestricted": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "isResourceAccount": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "jobTitle": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "lastPasswordChangeDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "legalAgeGroupClassification": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "licenseAssignmentStates": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "mail": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "mailboxSettings": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "mailNickname": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "mobilePhone": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "mySite": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "officeLocation": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesDistinguishedName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesDomainName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesExtensionAttributes": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesImmutableId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesLastSyncDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesProvisioningErrors": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesSamAccountName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesSecurityIdentifier": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesSipInfo": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesSyncEnabled": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "onPremisesUserPrincipalName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "otherMails": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "passwordPolicies": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "passwordProfile": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "pastProjects": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "postalCode": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "preferredDataLocation": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "preferredLanguage": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "preferredName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "print": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "provisionedPlans": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "proxyAddresses": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "refreshTokensValidFromDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "responsibilities": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "Results": { - "x-cipp-field-source": "backend" - }, - "schools": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "securityIdentifier": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "serviceProvisioningErrors": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "showInAddressList": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "signInActivity": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "signInSessionsValidFromDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "skills": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "state": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "streetAddress": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "surname": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "usageLocation": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "userPrincipalName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "userType": { - "type": "string", - "x-cipp-field-source": "graph-entity" - } - } + }, + "required": [ + "TenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" } } } @@ -34799,6 +40137,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -34806,15 +40147,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.Read" + "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecServicePrincipals": { + "/api/ExecSetManager": { "post": { - "summary": "ExecServicePrincipals", - "operationId": "ExecServicePrincipals", + "summary": "ExecSetManager", + "operationId": "ExecSetManager", "tags": [ - "CIPP > Core" + "Identity > Administration > Users" ], "requestBody": { "required": false, @@ -34822,25 +40163,98 @@ "application/json": { "schema": { "type": "object", - "properties": {} + "properties": {}, + "additionalProperties": true, + "x-cipp-passthrough": true, + "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Identity.User.ReadWrite" + } + }, + "/api/ExecSetMdoAlert": { + "post": { + "summary": "ExecSetMdoAlert", + "operationId": "ExecSetMdoAlert", + "tags": [ + "Security > Incidents" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "Assigned": { + "type": "string" + }, + "Classification": { + "type": "string" + }, + "Determination": { + "type": "string" + }, + "GUID": { + "type": "string" + }, + "Status": { + "type": "string" + }, + "tenantFilter": { + "type": "string", + "description": "Interact with query parameters or the body of the request." + } + }, + "required": [ + "tenantFilter" + ] } } } }, "parameters": [ { - "name": "Action", + "name": "Assigned", "in": "query", "required": false, "schema": { - "type": "string", - "enum": [ - "Create" - ] + "type": "string" } }, { - "name": "AppId", + "name": "Classification", "in": "query", "required": false, "schema": { @@ -34848,7 +40262,15 @@ } }, { - "name": "Id", + "name": "Determination", + "in": "query", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "GUID", "in": "query", "required": false, "schema": { @@ -34856,12 +40278,15 @@ } }, { - "name": "Select", + "name": "Status", "in": "query", "required": false, "schema": { "type": "string" } + }, + { + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -34870,178 +40295,7 @@ "content": { "application/json": { "schema": { - "type": "object", - "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", - "properties": { - "accountEnabled": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "addIns": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "alternativeNames": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "appDescription": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "appDisplayName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "appId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "applicationTemplateId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "appOwnerOrganizationId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "appRoleAssignmentRequired": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "appRoles": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "createdByAppId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "customSecurityAttributes": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "deletedDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "description": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "disabledByMicrosoftStatus": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "displayName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "errorUrl": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "homepage": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "id": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "info": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "isDisabled": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "keyCredentials": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "loginUrl": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "logoutUrl": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "notes": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "notificationEmailAddresses": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "passwordCredentials": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "passwordSingleSignOnSettings": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "preferredSingleSignOnMode": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "preferredTokenSigningKeyEndDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "preferredTokenSigningKeyThumbprint": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "publishedPermissionScopes": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "publisherName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "replyUrls": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "samlMetadataUrl": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "samlSingleSignOnSettings": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "servicePrincipalNames": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "servicePrincipalType": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "signInAudience": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "tags": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "tokenEncryptionKeyId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "verifiedPublisher": { - "type": "object", - "x-cipp-field-source": "graph-entity" - } - } + "$ref": "#/components/schemas/StandardResults" } } } @@ -35051,6 +40305,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -35058,16 +40315,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Application.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "Security.Incident.ReadWrite" } }, - "/api/ExecSetAPDeviceGroupTag": { + "/api/ExecSetOneDriveSharing": { "post": { - "summary": "ExecSetAPDeviceGroupTag", - "operationId": "ExecSetAPDeviceGroupTag", + "summary": "ExecSetOneDriveSharing", + "operationId": "ExecSetOneDriveSharing", "tags": [ - "Endpoint > Autopilot" + "Teams-Sharepoint" ], "requestBody": { "required": true, @@ -35076,19 +40332,13 @@ "schema": { "type": "object", "properties": { - "deviceId": { - "type": "string" - }, - "groupTag": { - "type": "array", - "items": { - "type": "string" - } + "SharingCapability": { + "$ref": "#/components/schemas/LabelValue" }, - "serialNumber": { + "tenantFilter": { "type": "string" }, - "tenantFilter": { + "UPN": { "type": "string" } }, @@ -35105,19 +40355,20 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -35125,13 +40376,13 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.Autopilot.ReadWrite" + "x-cipp-role": "Teams.SharePoint.ReadWrite" } }, - "/api/ExecSetCalendarProcessing": { + "/api/ExecSetOoO": { "post": { - "summary": "ExecSetCalendarProcessing", - "operationId": "ExecSetCalendarProcessing", + "summary": "ExecSetOoO", + "operationId": "ExecSetOoO", "tags": [ "Email-Exchange > Administration" ], @@ -35142,62 +40393,49 @@ "schema": { "type": "object", "properties": { - "additionalResponse": { - "type": "string" - }, - "addOrganizerToSubject": { - "type": "boolean" - }, - "allowConflicts": { - "type": "boolean" - }, - "allowRecurringMeetings": { - "type": "boolean" - }, - "automaticallyAccept": { - "type": "boolean" - }, - "automaticallyProcess": { + "AutoDeclineFutureRequestsWhenOOF": { "type": "boolean" }, - "bookingWindowInDays": { - "type": "integer" + "AutoReplyState": { + "$ref": "#/components/schemas/LabelValue" }, - "deleteComments": { - "type": "boolean" + "CreateOOFEvent": { + "type": "boolean", + "description": "Calendar options — only pass when explicitly provided in the request body" }, - "deleteSubject": { + "DeclineEventsForScheduledOOF": { "type": "boolean" }, - "maxConflicts": { - "type": "integer", - "description": "Add optional numeric parameters only if they have values" - }, - "maximumDurationInMinutes": { - "type": "integer" + "DeclineMeetingMessage": { + "type": "string" }, - "minimumDurationInMinutes": { + "EndTime": { "type": "integer" }, - "processExternalMeetingMessages": { - "type": "boolean" + "ExternalMessage": { + "type": "string" }, - "removeCanceledMeetings": { - "type": "boolean" + "input": { + "type": "string", + "description": "User action uses input, edit exchange uses InternalMessage and ExternalMessage User action disable OoO doesn't send any input" }, - "removeOldMeetingMessages": { - "type": "boolean" + "InternalMessage": { + "type": "string" }, - "removePrivateProperty": { - "type": "boolean" + "OOFEventSubject": { + "type": "string" }, - "scheduleOnlyDuringWorkHours": { - "type": "boolean" + "StartTime": { + "type": "integer", + "description": "If starttime and endtime are a number, they are unix timestamps and need to be converted to datetime, otherwise just use them." }, "tenantFilter": { "type": "string" }, - "UPN": { + "timezone": { + "type": "string" + }, + "userId": { "type": "string" } }, @@ -35237,10 +40475,110 @@ "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecSetCASMailbox": { + "/api/ExecSetPackageTag": { + "post": { + "summary": "ExecSetPackageTag", + "operationId": "ExecSetPackageTag", + "tags": [ + "CIPP > Core" + ], + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": {}, + "additionalProperties": true, + "x-cipp-passthrough": true, + "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "ContentHash": { + "x-cipp-field-source": "storage" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "GUID": { + "x-cipp-field-source": "storage" + }, + "JSON": { + "x-cipp-field-source": "storage" + }, + "Package": { + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Permissions": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "SHA": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Source": { + "x-cipp-field-source": "storage" + }, + "SourcePath": { + "x-cipp-field-source": "storage" + }, + "TemplateName": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "UpdatedBy": { + "x-cipp-field-source": "storage" + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "CIPP.Core.ReadWrite", + "x-cipp-any-tenant": true + } + }, + "/api/ExecSetRecipientLimits": { "post": { - "summary": "ExecSetCASMailbox", - "operationId": "ExecSetCASMailbox", + "summary": "ExecSetRecipientLimits", + "operationId": "ExecSetRecipientLimits", "tags": [ "Email-Exchange > Administration" ], @@ -35251,13 +40589,17 @@ "schema": { "type": "object", "properties": { - "DisplayName": { + "Identity": { "type": "string" }, - "Identity": { + "recipientLimit": { "type": "string" }, "tenantFilter": { + "type": "string", + "description": "Interact with the query or body of the request" + }, + "userid": { "type": "string" } }, @@ -35279,9 +40621,6 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -35300,24 +40639,37 @@ "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecSetCIPPAutoBackup": { + "/api/ExecSetRetentionHold": { "post": { - "summary": "ExecSetCIPPAutoBackup", - "operationId": "ExecSetCIPPAutoBackup", + "summary": "ExecSetRetentionHold", + "operationId": "ExecSetRetentionHold", "tags": [ - "CIPP > Core" + "Email-Exchange > Administration" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "Enabled": { - "type": "boolean" + "disable": { + "type": "string" + }, + "Identity": { + "type": "string" + }, + "tenantFilter": { + "type": "string", + "description": "Interact with the query or body of the request" + }, + "UPN": { + "type": "string" } - } + }, + "required": [ + "tenantFilter" + ] } } } @@ -35328,8 +40680,7 @@ "content": { "application/json": { "schema": { - "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "$ref": "#/components/schemas/StandardResults" } } } @@ -35339,6 +40690,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -35346,17 +40700,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Backup.ReadWrite" + "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, - "/api/ExecSetCloudManaged": { + "/api/ExecSetSecurityAlert": { "post": { - "summary": "ExecSetCloudManaged", - "operationId": "ExecSetCloudManaged", + "summary": "ExecSetSecurityAlert", + "operationId": "ExecSetSecurityAlert", "tags": [ - "Identity > Administration > Users" + "Security > Incidents" ], - "description": "Sets the cloud-managed status of a user, group, or contact.", "requestBody": { "required": true, "content": { @@ -35364,21 +40717,15 @@ "schema": { "type": "object", "properties": { - "displayName": { - "type": "string" - }, - "ID": { + "GUID": { "type": "string" }, - "isCloudManaged": { + "Status": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." - }, - "type": { - "type": "string" } }, "required": [ @@ -35388,6 +40735,27 @@ } } }, + "parameters": [ + { + "name": "GUID", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "Status", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], "responses": { "200": { "description": "Success", @@ -35414,17 +40782,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.DirSync.ReadWrite" + "x-cipp-role": "Security.Alert.ReadWrite" } }, - "/api/ExecSetDefaultMFAMethod": { + "/api/ExecSetSecurityIncident": { "post": { - "summary": "ExecSetDefaultMFAMethod", - "operationId": "ExecSetDefaultMFAMethod", + "summary": "ExecSetSecurityIncident", + "operationId": "ExecSetSecurityIncident", "tags": [ - "Identity > Administration > Users" + "Security > Incidents" ], - "description": "Sets the default second factor a user is prompted with, by patching signInPreferences.\nNote this is ignored at sign-in while system-preferred MFA is enabled for the user.", "requestBody": { "required": true, "content": { @@ -35432,17 +40799,42 @@ "schema": { "type": "object", "properties": { - "ID": { + "AssignToSelf": { "type": "string" }, - "MethodType": { - "$ref": "#/components/schemas/LabelValue" + "Classification": { + "type": "string" }, - "tenantFilter": { + "Comment": { + "type": "string" + }, + "Determination": { + "type": "string" + }, + "GUID": { + "type": "string" + }, + "Redirected": { + "type": "integer" + }, + "Severity": { + "allOf": [ + { + "$ref": "#/components/schemas/LabelValue" + } + ], + "description": "Severity autoComplete submits {label, value}" + }, + "Status": { "type": "string" + }, + "tenantFilter": { + "type": "string", + "description": "Interact with query parameters or the body of the request." } }, "required": [ + "Determination", "tenantFilter" ] } @@ -35460,9 +40852,6 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -35478,17 +40867,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.ReadWrite" + "x-cipp-role": "Security.Incident.ReadWrite" } }, - "/api/ExecSetLibraryInheritance": { + "/api/ExecSetSharePointMember": { "post": { - "summary": "ExecSetLibraryInheritance", - "operationId": "ExecSetLibraryInheritance", + "summary": "ExecSetSharePointMember", + "operationId": "ExecSetSharePointMember", "tags": [ "Teams-Sharepoint" ], - "description": "Controls whether a document library inherits its permissions from the site, via the\nSharePoint REST API.\n\nAction 'Break' detaches the library so it holds its own permissions. CopyRoleAssignments\n(default true) copies the permissions it currently inherits, so nobody loses access at the\nmoment of the break; with it disabled the library starts with an empty permission set and\nonly site collection admins can reach it. ClearSubscopes (default false) resets any folder\nor item inside the library that has its own unique permissions.\n\nAction 'Reset' puts the library back to inheriting from the site. This discards every\npermission unique to the library and cannot be undone other than by granting them again.", + "description": "Adds one or more users to, or removes a user from, a SharePoint site role (Owners, Members or Visitors).\nGroup-connected sites manage Owners/Members through the backing M365 group via Graph;\nVisitors (and classic/communication sites entirely) are managed through the site's\nassociated SharePoint role groups via the SharePoint REST API using certificate\nauthentication. Removals sourced from ListSiteMembers carry the group and type of the\nselected entry, so users directly added to a role group on a group-connected site are\nremoved from that group rather than from the M365 group.", "requestBody": { "required": true, "content": { @@ -35496,32 +40885,45 @@ "schema": { "type": "object", "properties": { - "Action": { - "type": "string" - }, - "ClearSubscopes": { + "Add": { "type": "boolean" }, - "CopyRoleAssignments": { - "type": "string", - "description": "Default to the safe options: keep current access on a break, leave sub-scopes alone." - }, - "LibraryName": { + "GroupID": { "type": "string" }, - "ListId": { + "Role": { "type": "string" }, - "SiteUrl": { + "SharePointType": { "type": "string" }, "tenantFilter": { "type": "string" + }, + "URL": { + "type": "string" + }, + "user": { + "type": "object", + "properties": { + "addedFields": { + "type": "object", + "properties": { + "Group": { + "type": "string" + }, + "Type": { + "type": "string" + } + } + }, + "value": { + "type": "string" + } + } } }, "required": [ - "ListId", - "SiteUrl", "tenantFilter" ] } @@ -35557,14 +40959,14 @@ "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecSetLibraryPermission": { + "/api/ExecSetSiteProperties": { "post": { - "summary": "ExecSetLibraryPermission", - "operationId": "ExecSetLibraryPermission", + "summary": "ExecSetSiteProperties", + "operationId": "ExecSetSiteProperties", "tags": [ "Teams-Sharepoint" ], - "description": "Grants users and/or groups a SharePoint permission level on a document library (ListId) or\non the site root web (ListId omitted) via the SharePoint REST API. Principals are resolved\nwith ensureuser unless PrincipalId is supplied, role inheritance on the library is broken\n(copying the existing permissions) when it still inherits, and the role assignment is added\nwith addroleassignment.\n\nMode 'Add' leaves any level the principal already holds in place - SharePoint allows a\nprincipal to hold several at once. Mode 'Replace' removes the levels it already holds on\nthis scope first, so the principal ends up with exactly the requested one.\n\nThe level is taken from RoleDefinitionId when supplied (which is how custom permission\nlevels are addressed), otherwise from the named PermissionLevel.", + "description": "Sets admin-level properties on a single SharePoint site (sharing, lifecycle, version\npolicy) through Set-CIPPSPOSite. Only whitelisted properties are accepted; enum values\narrive as friendly names (matching Invoke-ListSiteProperties output) and are converted\nto their numeric CSOM values here.", "requestBody": { "required": true, "content": { @@ -35572,38 +40974,14 @@ "schema": { "type": "object", "properties": { - "Groups": { - "type": "string" - }, - "LibraryName": { - "type": "string" - }, - "ListId": { - "type": "string" - }, - "Mode": { - "type": "string" - }, - "PermissionLevel": { - "type": "string" - }, - "PrincipalId": { - "type": "string" - }, - "PrincipalName": { - "type": "string" - }, - "RoleDefinitionId": { - "type": "string" + "LockState": { + "$ref": "#/components/schemas/LabelValue" }, "SiteUrl": { "type": "string" }, "tenantFilter": { "type": "string" - }, - "Users": { - "type": "string" } }, "required": [ @@ -35643,12 +41021,12 @@ "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecSetLitigationHold": { + "/api/ExecSetSiteProperty": { "post": { - "summary": "ExecSetLitigationHold", - "operationId": "ExecSetLitigationHold", + "summary": "ExecSetSiteProperty", + "operationId": "ExecSetSiteProperty", "tags": [ - "Email-Exchange > Administration" + "Teams-Sharepoint" ], "requestBody": { "required": true, @@ -35657,24 +41035,49 @@ "schema": { "type": "object", "properties": { - "days": { - "type": "integer" + "AnonymousLinkExpirationInDays": { + "type": "string", + "description": "Anonymous link expiration (requires override flag)" }, - "disable": { - "type": "string" + "DefaultLinkPermission": { + "type": "string", + "description": "Default Link Permission (0=None/tenant default, 1=View, 2=Edit)" }, - "Identity": { + "DefaultSharingLinkType": { + "type": "string", + "description": "Default Sharing Link Type (0=None/tenant default, 1=Direct, 2=Internal, 3=AnonymousAccess)" + }, + "DisplayName": { "type": "string" }, - "tenantFilter": { + "LockState": { "type": "string", - "description": "Interact with the query or body of the request" + "description": "Lock State" }, - "UPN": { + "RestrictedAccessControl": { + "type": "string", + "description": "Restricted Access Control (requires SharePoint Advanced Management licensing)" + }, + "SharingCapability": { + "type": "string", + "description": "Sharing Capability" + }, + "SiteId": { + "type": "string" + }, + "StorageMaximumLevelGB": { + "type": "number", + "description": "Storage Quota (accepts GB, converts to MB for the API)" + }, + "StorageWarningLevelGB": { + "type": "number" + }, + "tenantFilter": { "type": "string" } }, "required": [ + "SiteId", "tenantFilter" ] } @@ -35707,15 +41110,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecSetMailboxEmailSize": { + "/api/ExecSetUserPhoto": { "post": { - "summary": "ExecSetMailboxEmailSize", - "operationId": "ExecSetMailboxEmailSize", + "summary": "ExecSetUserPhoto", + "operationId": "ExecSetUserPhoto", "tags": [ - "Email-Exchange > Administration" + "Identity > Administration > Users" ], "requestBody": { "required": true, @@ -35724,30 +41127,48 @@ "schema": { "type": "object", "properties": { - "id": { - "type": "string" - }, - "maxReceiveSize": { + "action": { "type": "string" }, - "maxSendSize": { + "photoData": { "type": "string" }, "tenantFilter": { - "type": "string", - "description": "Interact with query parameters or the body of the request." + "type": "string" }, - "UPN": { + "userId": { "type": "string" } }, "required": [ + "photoData", "tenantFilter" ] } } } }, + "parameters": [ + { + "name": "action", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "userId", + "in": "query", + "required": true, + "schema": { + "type": "string" + } + } + ], "responses": { "200": { "description": "Success", @@ -35759,14 +41180,14 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -35774,16 +41195,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "Identity.User.ReadWrite" } }, - "/api/ExecSetMailboxLocale": { + "/api/ExecShadowAISanction": { "post": { - "summary": "ExecSetMailboxLocale", - "operationId": "ExecSetMailboxLocale", + "summary": "ExecShadowAISanction", + "operationId": "ExecShadowAISanction", "tags": [ - "Email-Exchange > Administration" + "Tenant > AI" ], + "description": "Marks an AI tool from the Shadow AI catalog as company sanctioned for a tenant, or removes\nthat status. Sanctioned tools are stored per tenant in the ShadowAIConfig table and are\nreported by ListShadowAI with risk 'Informational' and status 'Sanctioned'; all other\ndetected AI tools report status 'Unsanctioned'.", "requestBody": { "required": true, "content": { @@ -35791,33 +41213,17 @@ "schema": { "type": "object", "properties": { - "locale": { + "Action": { "type": "string" }, "tenantFilter": { - "type": "string", - "description": "Interact with query parameters or the body of the request." + "type": "string" }, - "user": { - "type": "object", - "properties": { - "x-forwarded-for": { - "type": "string" - }, - "x-ms-client-principal": { - "type": "string" - }, - "x-ms-client-principal-idp": { - "type": "string", - "x-cipp-observed-values": [ - "aad", - "azureStaticWebApps" - ] - }, - "x-ms-client-principal-name": { - "type": "string" - } - } + "Tool": { + "type": "string" + }, + "Tools": { + "type": "string" } }, "required": [ @@ -35827,6 +41233,11 @@ } } }, + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], "responses": { "200": { "description": "Success", @@ -35838,14 +41249,14 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -35853,19 +41264,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite", - "x-cipp-reads-via": [ - "Write-LogMessage" - ] + "x-cipp-role": "Tenant.AI.ReadWrite" } }, - "/api/ExecSetMailboxQuota": { + "/api/ExecSharePointImageOptimize": { "post": { - "summary": "ExecSetMailboxQuota", - "operationId": "ExecSetMailboxQuota", + "summary": "Queue a SharePoint Image Optimizer job (audit / compress / compress + cleanup).", + "operationId": "ExecSharePointImageOptimize", "tags": [ - "Email-Exchange > Administration" + "Teams-Sharepoint" ], + "description": "Scanning and compressing a document library can take far longer than the ~230s\nAzure HTTP gateway window, so the work is queued for background processing and the\ncaller polls Invoke-ListImageOptimizerResults (by QueueId) for status and results.\n\nThe Mode and WhatIf flags control how destructive the run is:\n - Mode 'Audit' : read-only discovery.\n - Mode 'Compress' : re-encodes and (when WhatIf=$false) replaces files.\n - Mode 'CompressAndCleanup' : as above, then removes old versions per\n VersionCleanupMode.\nWhatIf defaults to $true; while true NO file is modified and NO version is deleted.\nVersion cleanup runs ONLY when VersionCleanupMode is not 'none'.", "requestBody": { "required": true, "content": { @@ -35873,94 +41282,58 @@ "schema": { "type": "object", "properties": { - "IssueWarningQuota": { + "DriveId": { "type": "string" }, - "ProhibitSendQuota": { + "FolderId": { "type": "string" }, - "ProhibitSendReceiveQuota": { + "FolderPath": { "type": "string" }, - "quota": { + "IncludeSubfolders": { + "type": "boolean" + }, + "JpegQuality": { "type": "string" }, - "tenantfilter": { + "LibraryName": { "type": "string" }, - "user": { + "MaxFiles": { "type": "string" - } - }, - "required": [ - "tenantfilter" - ] - } - } - } - }, - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", - "properties": { - "Results": { - "x-cipp-field-source": "backend" - } - } - } - } - } - }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" - }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" - } - }, - "security": [ - { - "bearerAuth": [] - } - ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" - } - }, - "/api/ExecSetMailboxRetentionPolicies": { - "post": { - "summary": "ExecSetMailboxRetentionPolicies", - "operationId": "ExecSetMailboxRetentionPolicies", - "tags": [ - "Email-Exchange > Administration > Mailbox Retention" - ], - "requestBody": { - "required": true, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "Mailboxes": { - "type": "array", - "items": { - "type": "string" - } }, - "PolicyName": { + "MinimumFileSizeMB": { "type": "string" }, - "tenantFilter": { + "MinimumSavingsPercent": { + "type": "string" + }, + "Mode": { + "type": "string" + }, + "SiteId": { + "type": "string" + }, + "SiteUrl": { + "type": "string" + }, + "StripMetadata": { + "type": "boolean", + "description": "Defaults that must fail safe." + }, + "TenantFilter": { + "type": "string" + }, + "VersionCleanupMode": { "type": "string" + }, + "WhatIf": { + "type": "boolean" } }, "required": [ - "PolicyName", - "tenantFilter" + "TenantFilter" ] } } @@ -35977,7 +41350,8 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } @@ -35990,6 +41364,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -35997,16 +41374,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecSetMailboxRule": { + "/api/ExecSharePointImageVersionCleanup": { "post": { - "summary": "ExecSetMailboxRule", - "operationId": "ExecSetMailboxRule", + "summary": "Standalone version cleanup for one or more SharePoint drive items (destructive).", + "operationId": "ExecSharePointImageVersionCleanup", "tags": [ - "Email-Exchange > Administration" + "Teams-Sharepoint" ], + "description": "Deletes old versions of the supplied drive items, keeping the current version.\nIntended for use after a successful compression run when the admin wants to\nreclaim storage held by version history. WhatIf defaults to $true.\n\nThis is a destructive operation; the caller (UI) must require explicit admin\nselection of a cleanup mode and a confirmation before calling with WhatIf=$false.", "requestBody": { "required": true, "content": { @@ -36014,24 +41392,30 @@ "schema": { "type": "object", "properties": { - "Disable": { - "type": "boolean" - }, - "Enable": { - "type": "boolean" + "CleanupMode": { + "type": "string" }, - "ruleId": { + "DriveId": { "type": "string" }, - "ruleName": { + "DriveItemId": { "type": "string" }, - "TenantFilter": { + "Files": { "type": "string", - "description": "Interact with the query or body of the request" + "description": "Accept a single file or an array of files. Each entry may be a string (DriveItemId) or an object with DriveItemId/DriveId." }, - "userPrincipalName": { + "SiteId": { + "type": "string" + }, + "SiteUrl": { + "type": "string" + }, + "TenantFilter": { "type": "string" + }, + "WhatIf": { + "type": "boolean" } }, "required": [ @@ -36041,6 +41425,11 @@ } } }, + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], "responses": { "200": { "description": "Success", @@ -36052,6 +41441,9 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -36067,15 +41459,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecSetMdoAlert": { + "/api/ExecSharePointInviteGuest": { "post": { - "summary": "ExecSetMdoAlert", - "operationId": "ExecSetMdoAlert", + "summary": "ExecSharePointInviteGuest", + "operationId": "ExecSharePointInviteGuest", "tags": [ - "Security > Incidents" + "Teams-Sharepoint" ], "requestBody": { "required": true, @@ -36084,24 +41476,35 @@ "schema": { "type": "object", "properties": { - "Assigned": { + "displayName": { "type": "string" }, - "Classification": { + "groupId": { "type": "string" }, - "Determination": { + "mail": { "type": "string" }, - "GUID": { - "type": "string" + "redirectUri": { + "type": "string", + "description": "Step 1: Invite the guest user to the tenant" }, - "Status": { + "sendInvite": { + "type": "boolean" + }, + "SharePointType": { "type": "string" }, + "TeamID": { + "type": "string", + "description": "Step 2: Add guest to the target resource" + }, "tenantFilter": { + "type": "string" + }, + "URL": { "type": "string", - "description": "Interact with query parameters or the body of the request." + "description": "Non-group site (Communication, classic Team, etc.): add guest to the site's Members permission group via SharePoint REST API." } }, "required": [ @@ -36111,70 +41514,26 @@ } } }, - "parameters": [ - { - "name": "Assigned", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "Classification", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "Determination", - "in": "query", - "required": true, - "schema": { - "type": "string" - } - }, - { - "name": "GUID", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "Status", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - } - ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -36182,13 +41541,13 @@ "bearerAuth": [] } ], - "x-cipp-role": "Security.Incident.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecSetOneDriveSharing": { + "/api/ExecSharePointMemberAudit": { "post": { - "summary": "ExecSetOneDriveSharing", - "operationId": "ExecSetOneDriveSharing", + "summary": "ExecSharePointMemberAudit", + "operationId": "ExecSharePointMemberAudit", "tags": [ "Teams-Sharepoint" ], @@ -36199,17 +41558,67 @@ "schema": { "type": "object", "properties": { - "SharingCapability": { - "$ref": "#/components/schemas/LabelValue" + "action": { + "type": "string" + }, + "drivePermissionId": { + "type": "string" + }, + "groupId": { + "type": "string" + }, + "issues": { + "type": "array", + "items": { + "type": "object", + "properties": { + "drivePermissionId": { + "type": "string" + }, + "repairAction": { + "type": "string" + }, + "userEmail": { + "type": "string" + }, + "userId": { + "type": "string" + } + } + } + }, + "repairType": { + "type": "string", + "enum": [ + "add_to_group", + "assign_role", + "promote_to_member", + "repair_all", + "sync_to_sp" + ] + }, + "sharePointType": { + "type": "string" + }, + "siteId": { + "type": "string" + }, + "siteUrl": { + "type": "string" }, "tenantFilter": { "type": "string" }, - "UPN": { + "userEmail": { + "type": "string" + }, + "userId": { "type": "string" } }, "required": [ + "groupId", + "siteUrl", "tenantFilter" ] } @@ -36222,12 +41631,14 @@ "content": { "application/json": { "schema": { - "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "$ref": "#/components/schemas/StandardResults" } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -36243,15 +41654,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Teams.SharePoint.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecSetOoO": { + "/api/ExecSharePointPerms": { "post": { - "summary": "ExecSetOoO", - "operationId": "ExecSetOoO", + "summary": "ExecSharePointPerms", + "operationId": "ExecSharePointPerms", "tags": [ - "Email-Exchange > Administration" + "Teams-Sharepoint" ], "requestBody": { "required": true, @@ -36260,50 +41671,26 @@ "schema": { "type": "object", "properties": { - "AutoDeclineFutureRequestsWhenOOF": { - "type": "boolean" - }, - "AutoReplyState": { - "$ref": "#/components/schemas/LabelValue" - }, - "CreateOOFEvent": { - "type": "boolean", - "description": "Calendar options — only pass when explicitly provided in the request body" - }, - "DeclineEventsForScheduledOOF": { - "type": "boolean" - }, - "DeclineMeetingMessage": { - "type": "string" - }, - "EndTime": { - "type": "integer" - }, - "ExternalMessage": { - "type": "string" - }, - "input": { + "onedriveAccessUser": { "type": "string", - "description": "User action uses input, edit exchange uses InternalMessage and ExternalMessage User action disable OoO doesn't send any input" - }, - "InternalMessage": { - "type": "string" + "description": "The UPN(s) of the user(s) we are adding or removing permissions for. Passed through as-is: a plain string, an array of strings, or the { value = ... } objects the frontend autoComplete posts are all accepted, and Set-CIPPSharePointPerms normalises them." }, - "OOFEventSubject": { + "RemovePermission": { "type": "string" }, - "StartTime": { - "type": "integer", - "description": "If starttime and endtime are a number, they are unix timestamps and need to be converted to datetime, otherwise just use them." - }, "tenantFilter": { "type": "string" }, - "timezone": { - "type": "string" + "UPN": { + "type": "string", + "description": "The UPN or ID of the users OneDrive we are changing permissions on" }, - "userId": { + "URL": { "type": "string" + }, + "user": { + "type": "string", + "description": "The UPN(s) of the user(s) we are adding or removing permissions for. Passed through as-is: a plain string, an array of strings, or the { value = ... } objects the frontend autoComplete posts are all accepted, and Set-CIPPSharePointPerms normalises them." } }, "required": [ @@ -36324,14 +41711,14 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -36339,38 +41726,98 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecSetPackageTag": { + "/api/ExecSharePointTemplate": { "post": { - "summary": "ExecSetPackageTag", - "operationId": "ExecSetPackageTag", + "summary": "ExecSharePointTemplate", + "operationId": "ExecSharePointTemplate", "tags": [ - "CIPP > Core" + "Teams-Sharepoint" ], + "description": "Saves, retrieves, deletes and deploys SharePoint provisioning templates. A template holds\none or more site templates, each with its own document libraries and permission grants.", "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "GUID": { + "Action": { + "type": "string" + }, + "DeploymentId": { + "type": "string" + }, + "SiteOwner": { "type": "string" }, - "Package": { + "siteTemplates": { + "type": "array", + "items": { + "type": "object", + "properties": { + "permissions": { + "type": "string", + "description": "Every site template must carry at least one root-level permission object." + } + } + }, + "description": "Every site template must carry at least one root-level permission object." + }, + "TemplateId": { "type": "string", - "description": "Add package tag (existing logic)" + "description": "Frontend sends TemplateId only when editing (add.js). Create/copy omit it." }, - "Remove": { + "templateName": { + "type": "string" + }, + "tenantFilter": { "type": "string" } - } + }, + "required": [ + "SiteOwner", + "tenantFilter" + ] } } } }, + "parameters": [ + { + "name": "Action", + "in": "query", + "required": false, + "schema": { + "type": "string", + "enum": [ + "Delete", + "Deploy", + "DeployStatus", + "Get", + "Save" + ] + } + }, + { + "name": "DeploymentId", + "in": "query", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "TemplateId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], "responses": { "200": { "description": "Success", @@ -36393,6 +41840,9 @@ "JSON": { "x-cipp-field-source": "storage" }, + "Metadata": { + "x-cipp-field-source": "backend" + }, "Package": { "x-cipp-field-source": "storage" }, @@ -36434,11 +41884,17 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -36446,16 +41902,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.ReadWrite", + "x-cipp-role": "Sharepoint.Admin.ReadWrite", "x-cipp-any-tenant": true } }, - "/api/ExecSetRecipientLimits": { + "/api/ExecSharingTroubleshoot": { "post": { - "summary": "ExecSetRecipientLimits", - "operationId": "ExecSetRecipientLimits", + "summary": "ExecSharingTroubleshoot", + "operationId": "ExecSharingTroubleshoot", "tags": [ - "Email-Exchange > Administration" + "Teams-Sharepoint" ], "requestBody": { "required": true, @@ -36464,17 +41920,16 @@ "schema": { "type": "object", "properties": { - "Identity": { + "resourceType": { "type": "string" }, - "recipientLimit": { + "resourceUrl": { "type": "string" }, "tenantFilter": { - "type": "string", - "description": "Interact with the query or body of the request" + "type": "string" }, - "userid": { + "userEmail": { "type": "string" } }, @@ -36491,11 +41946,15 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -36511,16 +41970,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "Sharepoint.Site.Read" } }, - "/api/ExecSetRetentionHold": { + "/api/ExecSiteBrowserActions": { "post": { - "summary": "ExecSetRetentionHold", - "operationId": "ExecSetRetentionHold", + "summary": "ExecSiteBrowserActions", + "operationId": "ExecSiteBrowserActions", "tags": [ - "Email-Exchange > Administration" + "Teams-Sharepoint" ], + "description": "Mutating / operational actions for the SharePoint site browser (non-permissions).\nBody.Action selects the operation. SiteUrl + tenantFilter are always required.\nVersion cleanup: StartVersionCleanup, GetVersionCleanupStatus.\nSite admin properties (incl. version policy): GetSiteProperties.", "requestBody": { "required": true, "content": { @@ -36528,21 +41988,36 @@ "schema": { "type": "object", "properties": { - "disable": { + "Action": { "type": "string" }, - "Identity": { + "BatchDeleteMode": { + "$ref": "#/components/schemas/LabelValueNumber" + }, + "DeleteOlderThanDays": { "type": "string" }, - "tenantFilter": { - "type": "string", - "description": "Interact with the query or body of the request" + "MajorVersionLimit": { + "type": "string" }, - "UPN": { + "MajorWithMinorVersionsLimit": { + "type": "string" + }, + "SiteId": { + "type": "string" + }, + "SiteUrl": { + "type": "string" + }, + "SyncListPolicy": { + "type": "boolean" + }, + "tenantFilter": { "type": "string" } }, "required": [ + "Action", "tenantFilter" ] } @@ -36560,14 +42035,14 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -36575,16 +42050,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecSetSecurityAlert": { + "/api/ExecSiteBrowserLibraryCopy": { "post": { - "summary": "ExecSetSecurityAlert", - "operationId": "ExecSetSecurityAlert", + "summary": "ExecSiteBrowserLibraryCopy", + "operationId": "ExecSiteBrowserLibraryCopy", "tags": [ - "Security > Incidents" + "Teams-Sharepoint" ], + "description": "Starts or preflights a SharePoint document library content copy (CreateCopyJobs + MoveButKeepSource).\nActions: PreflightLibraryCopy, StartLibraryCopy.", "requestBody": { "required": true, "content": { @@ -36592,18 +42068,48 @@ "schema": { "type": "object", "properties": { - "GUID": { + "Action": { "type": "string" }, - "Status": { + "DestLibraryName": { + "type": "string" + }, + "DestListId": { + "type": "string" + }, + "DestSiteId": { + "type": "string" + }, + "DestSiteName": { + "type": "string" + }, + "DestSiteUrl": { + "type": "string" + }, + "NameConflictBehavior": { + "type": "string" + }, + "SourceLibraryName": { + "type": "string" + }, + "SourceListId": { + "type": "string" + }, + "SourceSiteId": { + "type": "string" + }, + "SourceSiteName": { + "type": "string" + }, + "SourceSiteUrl": { "type": "string" }, "tenantFilter": { - "type": "string", - "description": "Interact with query parameters or the body of the request." + "type": "string" } }, "required": [ + "Action", "tenantFilter" ] } @@ -36612,23 +42118,12 @@ }, "parameters": [ { - "name": "GUID", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "Status", + "name": "Action", "in": "query", "required": false, "schema": { "type": "string" } - }, - { - "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -36642,14 +42137,14 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -36657,16 +42152,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Security.Alert.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecSetSecurityIncident": { + "/api/ExecSiteBrowserPermissions": { "post": { - "summary": "ExecSetSecurityIncident", - "operationId": "ExecSetSecurityIncident", + "summary": "ExecSiteBrowserPermissions", + "operationId": "ExecSiteBrowserPermissions", "tags": [ - "Security > Incidents" + "Teams-Sharepoint" ], + "description": "Mutating actions for the SharePoint site browser permissions dialog.\nBody.Action selects the operation. SiteUrl + tenantFilter are always required.\nListId scopes library actions; omit it for the site root web.\nSharing links / Graph drive permissions are out of scope.\nGraph site permissions (Sites.Selected app grants): RemoveGraphSitePermission.", "requestBody": { "required": true, "content": { @@ -36674,42 +42170,74 @@ "schema": { "type": "object", "properties": { - "AssignToSelf": { + "Action": { "type": "string" }, - "Classification": { + "ClearSubscopes": { + "type": "boolean" + }, + "CopyRoleAssignments": { "type": "string" }, - "Comment": { + "GroupId": { "type": "string" }, - "Determination": { + "GroupName": { "type": "string" }, - "GUID": { + "Groups": { "type": "string" }, - "Redirected": { - "type": "integer" + "LibraryName": { + "type": "string" }, - "Severity": { - "allOf": [ - { - "$ref": "#/components/schemas/LabelValue" - } - ], - "description": "Severity autoComplete submits {label, value}" + "ListId": { + "type": "string" }, - "Status": { + "PermissionId": { + "type": "string" + }, + "PermissionLevel": { + "$ref": "#/components/schemas/LabelValue" + }, + "PrincipalId": { + "type": "string" + }, + "PrincipalName": { + "type": "string", + "description": "Allow a single login/UPN from a selected admin row." + }, + "RoleDefinitionId": { + "$ref": "#/components/schemas/LabelValue" + }, + "SiteId": { + "type": "string" + }, + "SiteUrl": { "type": "string" }, "tenantFilter": { + "type": "string" + }, + "Title": { + "type": "string" + }, + "userPrincipalName": { "type": "string", - "description": "Interact with query parameters or the body of the request." + "description": "Allow a single login/UPN from a selected admin row." + }, + "Users": { + "type": "string" } }, "required": [ - "Determination", + "Action", + "GroupId", + "ListId", + "PermissionId", + "PrincipalId", + "SiteId", + "SiteUrl", "tenantFilter" ] } @@ -36727,14 +42255,14 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -36742,17 +42270,19 @@ "bearerAuth": [] } ], - "x-cipp-role": "Security.Incident.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite", + "x-cipp-reads-via": [ + "Resolve-BrowserPermissionRoleDefId" + ] } }, - "/api/ExecSetSharePointMember": { + "/api/ExecSiteRename": { "post": { - "summary": "ExecSetSharePointMember", - "operationId": "ExecSetSharePointMember", + "summary": "ExecSiteRename", + "operationId": "ExecSiteRename", "tags": [ "Teams-Sharepoint" ], - "description": "Adds one or more users to, or removes a user from, a SharePoint site role (Owners, Members or Visitors).\nGroup-connected sites manage Owners/Members through the backing M365 group via Graph;\nVisitors (and classic/communication sites entirely) are managed through the site's\nassociated SharePoint role groups via the SharePoint REST API using certificate\nauthentication. Removals sourced from ListSiteMembers carry the group and type of the\nselected entry, so users directly added to a role group on a group-connected site are\nremoved from that group rather than from the M365 group.", "requestBody": { "required": true, "content": { @@ -36760,45 +42290,28 @@ "schema": { "type": "object", "properties": { - "Add": { - "type": "boolean" + "DisplayName": { + "type": "string" }, - "GroupID": { + "NewTitle": { "type": "string" }, - "Role": { + "NewUrl": { "type": "string" }, - "SharePointType": { + "SiteId": { "type": "string" }, - "tenantFilter": { + "SiteUrl": { "type": "string" }, - "URL": { + "tenantFilter": { "type": "string" - }, - "user": { - "type": "object", - "properties": { - "addedFields": { - "type": "object", - "properties": { - "Group": { - "type": "string" - }, - "Type": { - "type": "string" - } - } - }, - "value": { - "type": "string" - } - } } }, "required": [ + "SiteId", + "SiteUrl", "tenantFilter" ] } @@ -36816,14 +42329,14 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -36834,35 +42347,43 @@ "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecSetSiteProperties": { + "/api/ExecSnoozeAlert": { "post": { - "summary": "ExecSetSiteProperties", - "operationId": "ExecSetSiteProperties", + "summary": "ExecSnoozeAlert", + "operationId": "ExecSnoozeAlert", "tags": [ - "Teams-Sharepoint" + "CIPP > Core" ], - "description": "Sets admin-level properties on a single SharePoint site (sharing, lifecycle, version\npolicy) through Set-CIPPSPOSite. Only whitelisted properties are accepted; enum values\narrive as friendly names (matching Invoke-ListSiteProperties output) and are converted\nto their numeric CSOM values here.", + "description": "Snoozes one alert item so it stops notifying. Body: CmdletName, TenantFilter, AlertItem,\nand either Duration (7, 14, 30 or 90 days) or UntilResolved=true, which keeps the snooze\nuntil the alert stops reporting the item and is then removed automatically. KeepVisible=true\nleaves the item on the dashboard, marked as snoozed, rather than hiding it. Reason is an\noptional note. There is no indefinite snooze.", "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { - "LockState": { - "$ref": "#/components/schemas/LabelValue" + "AlertItem": { + "type": "string" }, - "SiteUrl": { + "CmdletName": { "type": "string" }, - "tenantFilter": { + "Duration": { + "type": "string" + }, + "KeepVisible": { + "type": "string" + }, + "Reason": { + "type": "string" + }, + "TenantFilter": { + "type": "string" + }, + "UntilResolved": { "type": "string" } - }, - "required": [ - "SiteUrl", - "tenantFilter" - ] + } } } } @@ -36886,6 +42407,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -36893,15 +42417,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Sharepoint.Site.ReadWrite" + "x-cipp-role": "CIPP.AlertSnooze.ReadWrite", + "x-cipp-any-tenant": true } }, - "/api/ExecSetUserPhoto": { + "/api/ExecSPOVersionCleanup": { "post": { - "summary": "ExecSetUserPhoto", - "operationId": "ExecSetUserPhoto", + "summary": "ExecSPOVersionCleanup", + "operationId": "ExecSPOVersionCleanup", "tags": [ - "Identity > Administration > Users" + "Teams-Sharepoint" ], "requestBody": { "required": true, @@ -36910,48 +42435,32 @@ "schema": { "type": "object", "properties": { - "action": { + "BatchDeleteMode": { "type": "string" }, - "photoData": { + "DeleteOlderThanDays": { "type": "string" }, - "tenantFilter": { + "MajorVersionLimit": { "type": "string" }, - "userId": { + "MajorWithMinorVersionsLimit": { + "type": "string" + }, + "SiteUrl": { + "type": "string" + }, + "tenantFilter": { "type": "string" } }, "required": [ - "photoData", "tenantFilter" ] } } } }, - "parameters": [ - { - "name": "action", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - }, - { - "name": "userId", - "in": "query", - "required": true, - "schema": { - "type": "string" - } - } - ], "responses": { "200": { "description": "Success", @@ -36963,14 +42472,14 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -36978,17 +42487,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecShadowAISanction": { + "/api/ExecSSOSetup": { "post": { - "summary": "ExecShadowAISanction", - "operationId": "ExecShadowAISanction", + "summary": "ExecSSOSetup", + "operationId": "ExecSSOSetup", "tags": [ - "Tenant > AI" + "CIPP > Setup" ], - "description": "Marks an AI tool from the Shadow AI catalog as company sanctioned for a tenant, or removes\nthat status. Sanctioned tools are stored per tenant in the ShadowAIConfig table and are\nreported by ListShadowAI with risk 'Informational' and status 'Sanctioned'; all other\ndetected AI tools report status 'Unsanctioned'.", "requestBody": { "required": true, "content": { @@ -36999,18 +42507,21 @@ "Action": { "type": "string" }, - "tenantFilter": { + "appId": { "type": "string" }, - "Tool": { + "appSecret": { "type": "string" }, - "Tools": { + "multiTenant": { + "type": "boolean" + }, + "targetUrl": { "type": "string" } }, "required": [ - "tenantFilter" + "appSecret" ] } } @@ -37018,7 +42529,12 @@ }, "parameters": [ { - "$ref": "#/components/parameters/tenantFilter" + "name": "Action", + "in": "query", + "required": false, + "schema": { + "type": "string" + } } ], "responses": { @@ -37027,7 +42543,23 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", + "properties": { + "AppId": { + "type": "string", + "x-cipp-field-source": "graph,backend" + }, + "CreatedAt": { + "x-cipp-field-source": "backend" + }, + "MultiTenant": { + "x-cipp-field-source": "backend" + }, + "Status": { + "x-cipp-field-source": "backend" + } + } } } } @@ -37040,6 +42572,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -37047,48 +42582,24 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.AI.ReadWrite" + "x-cipp-role": "CIPP.AppSettings.ReadWrite", + "x-cipp-any-tenant": true } }, - "/api/ExecSharePointPerms": { + "/api/ExecStandardConvert": { "post": { - "summary": "ExecSharePointPerms", - "operationId": "ExecSharePointPerms", + "summary": "ExecStandardConvert", + "operationId": "ExecStandardConvert", "tags": [ - "Teams-Sharepoint" + "Tenant > Standards" ], "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", - "properties": { - "onedriveAccessUser": { - "type": "string", - "description": "The UPN(s) of the user(s) we are adding or removing permissions for. Passed through as-is: a plain string, an array of strings, or the { value = ... } objects the frontend autoComplete posts are all accepted, and Set-CIPPSharePointPerms normalises them." - }, - "RemovePermission": { - "type": "string" - }, - "tenantFilter": { - "type": "string" - }, - "UPN": { - "type": "string", - "description": "The UPN or ID of the users OneDrive we are changing permissions on" - }, - "URL": { - "type": "string" - }, - "user": { - "type": "string", - "description": "The UPN(s) of the user(s) we are adding or removing permissions for. Passed through as-is: a plain string, an array of strings, or the { value = ... } objects the frontend autoComplete posts are all accepted, and Set-CIPPSharePointPerms normalises them." - } - }, - "required": [ - "tenantFilter" - ] + "properties": {} } } } @@ -37099,14 +42610,12 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -37119,96 +42628,38 @@ "bearerAuth": [] } ], - "x-cipp-role": "Sharepoint.Site.ReadWrite" + "x-cipp-role": "Tenant.Standards.ReadWrite" } }, - "/api/ExecSharePointTemplate": { + "/api/ExecStandardsRun": { "post": { - "summary": "ExecSharePointTemplate", - "operationId": "ExecSharePointTemplate", + "summary": "ExecStandardsRun", + "operationId": "ExecStandardsRun", "tags": [ - "Teams-Sharepoint" + "Tenant > Standards" ], - "description": "Saves, retrieves, deletes and deploys SharePoint provisioning templates. A template holds\none or more site templates, each with its own document libraries and permission grants.", "requestBody": { - "required": true, + "required": false, "content": { "application/json": { "schema": { "type": "object", - "properties": { - "Action": { - "type": "string" - }, - "DeploymentId": { - "type": "string" - }, - "SiteOwner": { - "type": "string" - }, - "siteTemplates": { - "type": "array", - "items": { - "type": "object", - "properties": { - "permissions": { - "type": "string", - "description": "Every site template must carry at least one root-level permission object." - } - } - }, - "description": "Every site template must carry at least one root-level permission object." - }, - "TemplateId": { - "type": "string", - "description": "Frontend sends TemplateId only when editing (add.js). Create/copy omit it." - }, - "templateName": { - "type": "string" - }, - "tenantFilter": { - "type": "string" - } - }, - "required": [ - "SiteOwner", - "tenantFilter" - ] + "properties": {} } } } }, "parameters": [ { - "name": "Action", + "name": "templateId", "in": "query", "required": false, - "schema": { - "type": "string", - "enum": [ - "Delete", - "Deploy", - "DeployStatus", - "Get", - "Save" - ] - } - }, - { - "name": "DeploymentId", - "in": "query", - "required": true, "schema": { "type": "string" } }, { - "name": "TemplateId", - "in": "query", - "required": false, - "schema": { - "type": "string" - } + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -37233,9 +42684,6 @@ "JSON": { "x-cipp-field-source": "storage" }, - "Metadata": { - "x-cipp-field-source": "backend" - }, "Package": { "x-cipp-field-source": "storage" }, @@ -37277,6 +42725,68 @@ } } }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.Standards.ReadWrite" + } + }, + "/api/ExecStandardTemplateSchedule": { + "post": { + "summary": "ExecStandardTemplateSchedule", + "operationId": "ExecStandardTemplateSchedule", + "tags": [ + "Tenant > Standards" + ], + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "runManually": { + "type": "boolean", + "description": "The stored field is runManually: $true means \"do not run on schedule\"." + }, + "TemplateId": { + "type": "string" + } + } + } + } + } + }, + "parameters": [ + { + "name": "TemplateId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, "400": { "description": "Bad request - missing required field or invalid input" }, @@ -37295,18 +42805,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Sharepoint.Admin.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "Tenant.Standards.ReadWrite" } }, - "/api/ExecSiteBrowserActions": { + "/api/ExecStartManagedFolderAssistant": { "post": { - "summary": "ExecSiteBrowserActions", - "operationId": "ExecSiteBrowserActions", + "summary": "ExecStartManagedFolderAssistant", + "operationId": "ExecStartManagedFolderAssistant", "tags": [ - "Teams-Sharepoint" + "Email-Exchange > Administration" ], - "description": "Mutating / operational actions for the SharePoint site browser (non-permissions).\nBody.Action selects the operation. SiteUrl + tenantFilter are always required.\nVersion cleanup: StartVersionCleanup, GetVersionCleanupStatus.\nSite admin properties (incl. version policy): GetSiteProperties.", "requestBody": { "required": true, "content": { @@ -37314,36 +42822,154 @@ "schema": { "type": "object", "properties": { - "Action": { - "type": "string" - }, - "BatchDeleteMode": { - "$ref": "#/components/schemas/LabelValueNumber" - }, - "DeleteOlderThanDays": { - "type": "string" - }, - "MajorVersionLimit": { + "Id": { "type": "string" }, - "MajorWithMinorVersionsLimit": { - "type": "string" + "tenantFilter": { + "type": "string", + "description": "Interact with query parameters or the body of the request." }, - "SiteId": { + "UserPrincipalName": { "type": "string" - }, - "SiteUrl": { + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "parameters": [ + { + "name": "Id", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Results": { + "x-cipp-field-source": "backend" + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.Mailbox.ReadWrite" + } + }, + "/api/ExecSyncAPDevices": { + "post": { + "summary": "ExecSyncAPDevices", + "operationId": "ExecSyncAPDevices", + "tags": [ + "Endpoint > Autopilot" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "tenantFilter": { "type": "string" - }, - "SyncListPolicy": { - "type": "boolean" - }, + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Results": { + "x-cipp-field-source": "backend" + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Endpoint.Autopilot.ReadWrite" + } + }, + "/api/ExecSyncDEP": { + "post": { + "summary": "ExecSyncDEP", + "operationId": "ExecSyncDEP", + "tags": [ + "Endpoint > MEM" + ], + "description": "Syncs devices from Apple Business Manager to Intune", + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { "tenantFilter": { "type": "string" } }, "required": [ - "Action", "tenantFilter" ] } @@ -37361,9 +42987,6 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -37376,17 +42999,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Sharepoint.Site.ReadWrite" + "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, - "/api/ExecSiteBrowserLibraryCopy": { + "/api/ExecSyncVPP": { "post": { - "summary": "ExecSiteBrowserLibraryCopy", - "operationId": "ExecSiteBrowserLibraryCopy", + "summary": "ExecSyncVPP", + "operationId": "ExecSyncVPP", "tags": [ - "Teams-Sharepoint" + "Endpoint > Applications" ], - "description": "Starts or preflights a SharePoint document library content copy (CreateCopyJobs + MoveButKeepSource).\nActions: PreflightLibraryCopy, StartLibraryCopy.", "requestBody": { "required": true, "content": { @@ -37394,64 +43016,17 @@ "schema": { "type": "object", "properties": { - "Action": { - "type": "string" - }, - "DestLibraryName": { - "type": "string" - }, - "DestListId": { - "type": "string" - }, - "DestSiteId": { - "type": "string" - }, - "DestSiteName": { - "type": "string" - }, - "DestSiteUrl": { - "type": "string" - }, - "NameConflictBehavior": { - "type": "string" - }, - "SourceLibraryName": { - "type": "string" - }, - "SourceListId": { - "type": "string" - }, - "SourceSiteId": { - "type": "string" - }, - "SourceSiteName": { - "type": "string" - }, - "SourceSiteUrl": { - "type": "string" - }, "tenantFilter": { "type": "string" } }, "required": [ - "Action", "tenantFilter" ] } } } }, - "parameters": [ - { - "name": "Action", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - } - ], "responses": { "200": { "description": "Success", @@ -37463,9 +43038,6 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -37478,17 +43050,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Sharepoint.Site.ReadWrite" + "x-cipp-role": "Endpoint.Application.ReadWrite" } }, - "/api/ExecSiteBrowserPermissions": { + "/api/ExecTeamAction": { "post": { - "summary": "ExecSiteBrowserPermissions", - "operationId": "ExecSiteBrowserPermissions", + "summary": "ExecTeamAction", + "operationId": "ExecTeamAction", "tags": [ "Teams-Sharepoint" ], - "description": "Mutating actions for the SharePoint site browser permissions dialog.\nBody.Action selects the operation. SiteUrl + tenantFilter are always required.\nListId scopes library actions; omit it for the site root web.\nSharing links / Graph drive permissions are out of scope.\nGraph site permissions (Sites.Selected app grants): RemoveGraphSitePermission.", "requestBody": { "required": true, "content": { @@ -37497,79 +43068,102 @@ "type": "object", "properties": { "Action": { - "type": "string" - }, - "ClearSubscopes": { - "type": "boolean" - }, - "CopyRoleAssignments": { - "type": "string" + "type": "string", + "enum": [ + "AddChannelMember", + "Archive", + "Clone", + "CreateChannel", + "DeleteChannel", + "ListChannelMembers", + "RemoveApp", + "RemoveChannelMember", + "Unarchive", + "UpdateChannelMemberRole" + ] }, - "GroupId": { + "AppInstallationID": { "type": "string" }, - "GroupName": { + "AppName": { "type": "string" }, - "Groups": { + "ChannelDescription": { "type": "string" }, - "LibraryName": { + "ChannelID": { "type": "string" }, - "ListId": { + "ChannelName": { "type": "string" }, - "PermissionId": { - "type": "string" + "ChannelOwnerID": { + "$ref": "#/components/schemas/LabelValue" }, - "PermissionLevel": { + "ChannelRole": { "$ref": "#/components/schemas/LabelValue" }, - "PrincipalId": { + "ChannelType": { "type": "string" }, - "PrincipalName": { - "type": "string", - "description": "Allow a single login/UPN from a selected admin row." + "CloneDescription": { + "type": "string" }, - "RoleDefinitionId": { - "$ref": "#/components/schemas/LabelValue" + "CloneDisplayName": { + "type": "string" }, - "SiteId": { + "CloneVisibility": { "type": "string" }, - "SiteUrl": { + "DisplayName": { "type": "string" }, - "tenantFilter": { + "MemberName": { "type": "string" }, - "Title": { + "MembershipID": { "type": "string" }, - "userPrincipalName": { - "type": "string", - "description": "Allow a single login/UPN from a selected admin row." + "NewRole": { + "type": "string" }, - "Users": { + "TeamID": { + "type": "string" + }, + "TenantFilter": { "type": "string" + }, + "UserID": { + "$ref": "#/components/schemas/LabelValue" } }, "required": [ - "Action", - "GroupId", - "ListId", - "PermissionId", - "PrincipalId", - "SiteId", - "SiteUrl", - "tenantFilter" + "AppInstallationID", + "ChannelID", + "ChannelName", + "ChannelOwnerID", + "MembershipID", + "NewRole", + "TenantFilter", + "UserID" ] } } } }, + "parameters": [ + { + "name": "TeamID", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], "responses": { "200": { "description": "Success", @@ -37581,9 +43175,6 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -37596,53 +43187,54 @@ "bearerAuth": [] } ], - "x-cipp-role": "Sharepoint.Site.ReadWrite", - "x-cipp-reads-via": [ - "Resolve-BrowserPermissionRoleDefId" - ] + "x-cipp-role": "Teams.Group.ReadWrite" } }, - "/api/ExecSnoozeAlert": { + "/api/ExecTeamFromGroup": { "post": { - "summary": "ExecSnoozeAlert", - "operationId": "ExecSnoozeAlert", + "summary": "ExecTeamFromGroup", + "operationId": "ExecTeamFromGroup", "tags": [ - "CIPP > Core" + "Teams-Sharepoint" ], - "description": "Snoozes one alert item so it stops notifying. Body: CmdletName, TenantFilter, AlertItem,\nand either Duration (7, 14, 30 or 90 days) or UntilResolved=true, which keeps the snooze\nuntil the alert stops reporting the item and is then removed automatically. KeepVisible=true\nleaves the item on the dashboard, marked as snoozed, rather than hiding it. Reason is an\noptional note. There is no indefinite snooze.", "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { - "AlertItem": { - "type": "string" - }, - "CmdletName": { - "type": "string" - }, - "Duration": { - "type": "string" - }, - "KeepVisible": { + "DisplayName": { "type": "string" }, - "Reason": { + "SiteId": { "type": "string" }, "TenantFilter": { "type": "string" - }, - "UntilResolved": { - "type": "string" } - } + }, + "required": [ + "SiteId", + "TenantFilter" + ] } } } }, + "parameters": [ + { + "name": "SiteId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], "responses": { "200": { "description": "Success", @@ -37662,9 +43254,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -37672,14 +43261,13 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AlertSnooze.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "Teams.Group.ReadWrite" } }, - "/api/ExecSPOVersionCleanup": { + "/api/ExecTeamMember": { "post": { - "summary": "ExecSPOVersionCleanup", - "operationId": "ExecSPOVersionCleanup", + "summary": "ExecTeamMember", + "operationId": "ExecTeamMember", "tags": [ "Teams-Sharepoint" ], @@ -37690,32 +43278,53 @@ "schema": { "type": "object", "properties": { - "BatchDeleteMode": { - "type": "string" + "Action": { + "type": "string", + "enum": [ + "Add", + "Remove", + "SetRole" + ] }, - "DeleteOlderThanDays": { + "DisplayName": { "type": "string" }, - "MajorVersionLimit": { - "type": "string" + "MembershipID": { + "$ref": "#/components/schemas/LabelValue" }, - "MajorWithMinorVersionsLimit": { + "Role": { "type": "string" }, - "SiteUrl": { + "TeamID": { "type": "string" }, - "tenantFilter": { + "TenantFilter": { "type": "string" + }, + "UserID": { + "$ref": "#/components/schemas/LabelValue" } }, "required": [ - "tenantFilter" + "TenantFilter" ] } } } }, + "parameters": [ + { + "name": "TeamID", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], "responses": { "200": { "description": "Success", @@ -37732,9 +43341,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -37742,15 +43348,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Sharepoint.Site.ReadWrite" + "x-cipp-role": "Teams.Group.ReadWrite" } }, - "/api/ExecSSOSetup": { + "/api/ExecTeamSettings": { "post": { - "summary": "ExecSSOSetup", - "operationId": "ExecSSOSetup", + "summary": "ExecTeamSettings", + "operationId": "ExecTeamSettings", "tags": [ - "CIPP > Setup" + "Teams-Sharepoint" ], "requestBody": { "required": true, @@ -37759,24 +43365,28 @@ "schema": { "type": "object", "properties": { - "Action": { - "type": "string" + "description": { + "type": "string", + "description": "Build patch body from provided settings" }, - "appId": { + "DisplayName": { "type": "string" }, - "appSecret": { - "type": "string" + "giphyContentRating": { + "$ref": "#/components/schemas/LabelValue" }, - "multiTenant": { - "type": "boolean" + "TeamID": { + "type": "string" }, - "targetUrl": { + "TenantFilter": { "type": "string" + }, + "visibility": { + "$ref": "#/components/schemas/LabelValue" } }, "required": [ - "appSecret" + "TenantFilter" ] } } @@ -37784,12 +43394,15 @@ }, "parameters": [ { - "name": "Action", + "name": "TeamID", "in": "query", "required": false, "schema": { "type": "string" } + }, + { + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -37798,38 +43411,16 @@ "content": { "application/json": { "schema": { - "type": "object", - "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", - "properties": { - "AppId": { - "type": "string", - "x-cipp-field-source": "graph,backend" - }, - "CreatedAt": { - "x-cipp-field-source": "backend" - }, - "MultiTenant": { - "x-cipp-field-source": "backend" - }, - "Status": { - "x-cipp-field-source": "backend" - } - } + "$ref": "#/components/schemas/StandardResults" } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -37837,24 +43428,43 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.AppSettings.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "Teams.Group.ReadWrite" } }, - "/api/ExecStandardConvert": { + "/api/ExecTeamsVoicePhoneNumberAssignment": { "post": { - "summary": "ExecStandardConvert", - "operationId": "ExecStandardConvert", + "summary": "ExecTeamsVoicePhoneNumberAssignment", + "operationId": "ExecTeamsVoicePhoneNumberAssignment", "tags": [ - "Tenant > Standards" + "Teams-Sharepoint" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", - "properties": {} + "properties": { + "input": { + "$ref": "#/components/schemas/LabelValue" + }, + "locationOnly": { + "type": "string" + }, + "PhoneNumber": { + "type": "string", + "description": "Normalize phone number -- the + prefix can be lost during URL encoding (+ becomes space)" + }, + "PhoneNumberType": { + "type": "string" + }, + "TenantFilter": { + "type": "string" + } + }, + "required": [ + "TenantFilter" + ] } } } @@ -37866,11 +43476,19 @@ "application/json": { "schema": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Results": { + "x-cipp-field-source": "backend" + } + } } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -37883,40 +43501,37 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Standards.ReadWrite" + "x-cipp-role": "Teams.Voice.ReadWrite" } }, - "/api/ExecStandardsRun": { + "/api/ExecTempFileCleanup": { "post": { - "summary": "ExecStandardsRun", - "operationId": "ExecStandardsRun", + "summary": "ExecTempFileCleanup", + "operationId": "ExecTempFileCleanup", "tags": [ - "Tenant > Standards" + "Teams-Sharepoint" ], "requestBody": { - "required": false, + "required": true, "content": { "application/json": { "schema": { "type": "object", - "properties": {} + "properties": { + "files": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] } } } }, - "parameters": [ - { - "name": "templateId", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - } - ], "responses": { "200": { "description": "Success", @@ -37924,124 +43539,73 @@ "application/json": { "schema": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { - "ContentHash": { - "x-cipp-field-source": "storage" + "createdBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "ETag": { + "createdDateTime": { "type": "string", - "x-cipp-field-source": "storage" - }, - "GUID": { - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "JSON": { - "x-cipp-field-source": "storage" + "description": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "Package": { - "x-cipp-field-source": "storage" + "driveType": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "PartitionKey": { - "x-cipp-field-source": "storage" + "eTag": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "Permissions": { + "id": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "Results": { - "x-cipp-field-source": "backend" + "lastModifiedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "RowKey": { - "x-cipp-field-source": "storage" + "lastModifiedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "SHA": { + "name": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "Source": { - "x-cipp-field-source": "storage" + "owner": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "SourcePath": { - "x-cipp-field-source": "storage" + "parentReference": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "TemplateName": { - "x-cipp-field-source": "storage" + "quota": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" + "sharePointIds": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "UpdatedBy": { - "x-cipp-field-source": "storage" + "system": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "webUrl": { + "type": "string", + "x-cipp-field-source": "graph-entity" } } } } } }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" - }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" - } - }, - "security": [ - { - "bearerAuth": [] - } - ], - "x-cipp-role": "Tenant.Standards.ReadWrite" - } - }, - "/api/ExecStandardTemplateSchedule": { - "post": { - "summary": "ExecStandardTemplateSchedule", - "operationId": "ExecStandardTemplateSchedule", - "tags": [ - "Tenant > Standards" - ], - "requestBody": { - "required": false, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "runManually": { - "type": "boolean", - "description": "The stored field is runManually: $true means \"do not run on schedule\"." - }, - "TemplateId": { - "type": "string" - } - } - } - } - } - }, - "parameters": [ - { - "name": "TemplateId", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - } - ], - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/StandardResults" - } - } - } - }, "400": { "description": "Bad request - missing required field or invalid input" }, @@ -38060,15 +43624,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Standards.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, - "/api/ExecStartManagedFolderAssistant": { + "/api/ExecTempFileScan": { "post": { - "summary": "ExecStartManagedFolderAssistant", - "operationId": "ExecStartManagedFolderAssistant", + "summary": "ExecTempFileScan", + "operationId": "ExecTempFileScan", "tags": [ - "Email-Exchange > Administration" + "Teams-Sharepoint" ], "requestBody": { "required": true, @@ -38077,154 +43641,47 @@ "schema": { "type": "object", "properties": { - "Id": { - "type": "string" + "filters": { + "type": "object", + "properties": { + "backupFiles": { + "type": "boolean" + }, + "officeTemp": { + "type": "boolean" + }, + "systemJunk": { + "type": "boolean" + }, + "tempFiles": { + "type": "boolean" + }, + "zeroByteFiles": { + "type": "boolean" + } + } }, - "tenantFilter": { + "scope": { "type": "string", - "description": "Interact with query parameters or the body of the request." + "enum": [ + "allOneDrives", + "allSites", + "site", + "user" + ] }, - "UserPrincipalName": { + "siteId": { "type": "string" - } - }, - "required": [ - "tenantFilter" - ] - } - } - } - }, - "parameters": [ - { - "name": "Id", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - } - ], - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", - "properties": { - "Results": { - "x-cipp-field-source": "backend" - } - } - } - } - } - }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" - }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" - } - }, - "security": [ - { - "bearerAuth": [] - } - ], - "x-cipp-role": "Exchange.Mailbox.ReadWrite" - } - }, - "/api/ExecSyncAPDevices": { - "post": { - "summary": "ExecSyncAPDevices", - "operationId": "ExecSyncAPDevices", - "tags": [ - "Endpoint > Autopilot" - ], - "requestBody": { - "required": true, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { + }, "tenantFilter": { "type": "string" - } - }, - "required": [ - "tenantFilter" - ] - } - } - } - }, - "parameters": [ - { - "$ref": "#/components/parameters/tenantFilter" - } - ], - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", - "properties": { - "Results": { - "x-cipp-field-source": "backend" - } - } - } - } - } - }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" - }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" - } - }, - "security": [ - { - "bearerAuth": [] - } - ], - "x-cipp-role": "Endpoint.Autopilot.ReadWrite" - } - }, - "/api/ExecSyncDEP": { - "post": { - "summary": "ExecSyncDEP", - "operationId": "ExecSyncDEP", - "tags": [ - "Endpoint > MEM" - ], - "description": "Syncs devices from Apple Business Manager to Intune", - "requestBody": { - "required": true, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "tenantFilter": { + }, + "userId": { "type": "string" } }, "required": [ + "scope", "tenantFilter" ] } @@ -38237,140 +43694,23 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" - }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" - } - }, - "security": [ - { - "bearerAuth": [] - } - ], - "x-cipp-role": "Endpoint.MEM.ReadWrite" - } - }, - "/api/ExecSyncVPP": { - "post": { - "summary": "ExecSyncVPP", - "operationId": "ExecSyncVPP", - "tags": [ - "Endpoint > Applications" - ], - "requestBody": { - "required": true, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "tenantFilter": { - "type": "string" - } - }, - "required": [ - "tenantFilter" - ] - } - } - } - }, - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/StandardResults" - } - } - } + "400": { + "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - } - }, - "security": [ - { - "bearerAuth": [] - } - ], - "x-cipp-role": "Endpoint.Application.ReadWrite" - } - }, - "/api/ExecTeamsVoicePhoneNumberAssignment": { - "post": { - "summary": "ExecTeamsVoicePhoneNumberAssignment", - "operationId": "ExecTeamsVoicePhoneNumberAssignment", - "tags": [ - "Teams-Sharepoint" - ], - "description": "Assigns a phone number to a user or resource account, or sets the emergency location on a\nnumber, via the Teams administration Graph API.", - "requestBody": { - "required": true, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "AssignmentCategory": { - "type": "string" - }, - "input": { - "$ref": "#/components/schemas/LabelValue" - }, - "locationOnly": { - "type": "string" - }, - "PhoneNumber": { - "type": "string" - }, - "PhoneNumberType": { - "type": "string" - }, - "TenantFilter": { - "type": "string" - } - }, - "required": [ - "TenantFilter" - ] - } - } - } - }, - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", - "properties": { - "Results": { - "x-cipp-field-source": "backend" - } - } - } - } - } }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" - }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" + "500": { + "description": "Internal server error" } }, "security": [ @@ -38378,7 +43718,7 @@ "bearerAuth": [] } ], - "x-cipp-role": "Teams.Voice.ReadWrite" + "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/ExecTenantGroup": { @@ -38417,9 +43757,6 @@ } } }, - "excludePartnerTenant": { - "type": "boolean" - }, "groupDescription": { "type": "string" }, @@ -38926,7 +44263,7 @@ "tags": [ "CIPP > Core" ], - "description": "Searches across every tenant the caller can access and returns matches with the tenant each belongs to. type selects what is searched: Users (the default), Groups, Applications or Licenses. Reads the cached report data, so results are as fresh as the last cache run.", + "description": "Searches cached report data the caller can access and returns matches with the tenant each belongs to. type selects what is searched: Users (the default), Groups, Applications or Licenses. An explicit tenantFilter is honored only when that tenant is inside the caller's scope.", "parameters": [ { "name": "limit", @@ -38944,6 +44281,14 @@ "type": "string" } }, + { + "name": "tenantFilter", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, { "name": "type", "in": "query", @@ -39468,6 +44813,91 @@ "x-cipp-role": "CIPP.Core.ReadWrite" } }, + "/api/ExecValidateExternalDomain": { + "post": { + "summary": "ExecValidateExternalDomain", + "operationId": "ExecValidateExternalDomain", + "tags": [ + "Teams-Sharepoint" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "context": { + "type": "string" + }, + "email": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "parameters": [ + { + "name": "context", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "email", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Sharepoint.Site.Read" + } + }, "/api/ExecWebhookSubscriptions": { "post": { "summary": "ExecWebhookSubscriptions", @@ -39539,6 +44969,191 @@ "x-cipp-role": "Tenant.Alert.ReadWrite" } }, + "/api/ExecZipFiles": { + "post": { + "summary": "ExecZipFiles", + "operationId": "ExecZipFiles", + "tags": [ + "Teams-Sharepoint" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "DestinationFolderId": { + "type": "string" + }, + "DestinationSiteId": { + "type": "string" + }, + "DestinationUserId": { + "type": "string" + }, + "Items": { + "type": "array", + "items": { + "type": "object", + "properties": { + "DriveId": { + "type": "string" + }, + "ItemId": { + "type": "string" + }, + "Name": { + "type": "string" + } + } + } + }, + "TenantFilter": { + "type": "string" + }, + "ZipFileName": { + "type": "string" + } + }, + "required": [ + "TenantFilter" + ] + } + } + } + }, + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Sharepoint.Site.ReadWrite" + } + }, + "/api/ExportMailQuarantine": { + "post": { + "summary": "ExportMailQuarantine", + "operationId": "ExportMailQuarantine", + "tags": [ + "Email-Exchange > Spamfilter" + ], + "description": "Exports filtered quarantine results as CSV or JSON for admin download.", + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "format": { + "type": "string" + }, + "tenantFilter": { + "type": "string" + } + }, + "required": [ + "tenantFilter" + ] + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Expires": { + "x-cipp-field-source": "backend" + }, + "Identity": { + "x-cipp-field-source": "backend" + }, + "MessageId": { + "x-cipp-field-source": "backend" + }, + "PolicyName": { + "x-cipp-field-source": "backend" + }, + "PolicyType": { + "x-cipp-field-source": "backend" + }, + "ReceivedTime": { + "x-cipp-field-source": "backend" + }, + "RecipientAddress": { + "x-cipp-field-source": "backend" + }, + "ReleaseStatus": { + "x-cipp-field-source": "backend" + }, + "SenderAddress": { + "x-cipp-field-source": "backend" + }, + "Subject": { + "x-cipp-field-source": "backend" + }, + "Type": { + "x-cipp-field-source": "backend" + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.SpamFilter.Read" + } + }, "/api/GetCippAlerts": { "get": { "summary": "GetCippAlerts", @@ -39585,6 +45200,60 @@ "x-cipp-any-tenant": true } }, + "/api/GetMailQuarantineMessage": { + "get": { + "summary": "GetMailQuarantineMessage", + "operationId": "GetMailQuarantineMessage", + "tags": [ + "Email-Exchange > Spamfilter" + ], + "description": "Returns detailed metadata for a single quarantined message (without exporting EML).", + "parameters": [ + { + "name": "Identity", + "in": "query", + "required": true, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.SpamFilter.Read" + } + }, "/api/GetVersion": { "get": { "summary": "GetVersion", @@ -39594,6 +45263,14 @@ ], "description": "Compares the caller's reported CIPP version against the latest published release and reports whether the frontend or the API is out of date, alongside the hosting shape (hosting type, App Service SKU, runtime stack) and the recorded version-update history.", "parameters": [ + { + "name": "CleanupStale", + "in": "query", + "required": false, + "schema": { + "type": "boolean" + } + }, { "name": "LocalVersion", "in": "query", @@ -40288,7 +45965,6 @@ "tags": [ "Tenant > Administration > Alerts" ], - "description": "Lists configured alert rules including webhook rules and scheduled alert tasks, showing their configuration and tenant scope.", "responses": { "200": { "description": "Success", @@ -40352,7 +46028,6 @@ "tags": [ "Endpoint > Reports" ], - "description": "Lists device compliance summary across all managed tenants using the Lighthouse managedDeviceCompliances API, or for a single tenant via Intune.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" @@ -40591,14 +46266,463 @@ "TargetedUserProtectionAction": { "x-cipp-field-source": "frontend" }, - "TargetedUserQuarantineTag": { - "x-cipp-field-source": "frontend" + "TargetedUserQuarantineTag": { + "x-cipp-field-source": "frontend" + }, + "WhenChanged": { + "x-cipp-field-source": "frontend" + }, + "WhenCreated": { + "x-cipp-field-source": "frontend" + } + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.SpamFilter.Read" + } + }, + "/api/ListAPDevices": { + "get": { + "summary": "ListAPDevices", + "operationId": "ListAPDevices", + "tags": [ + "Endpoint > Autopilot" + ], + "description": "Lists Windows Autopilot device identities registered in a tenant.", + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the Microsoft Graph entity it queries, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "properties": { + "addressableUserName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "azureActiveDirectoryDeviceId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "azureAdDeviceId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "deploymentProfileAssignedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "deploymentProfileAssignmentDetailedStatus": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "deploymentProfileAssignmentStatus": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "deviceAccountPassword": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "deviceAccountUpn": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "deviceFriendlyName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "displayName": { + "type": "string", + "x-cipp-field-source": "graph-entity,frontend" + }, + "enrollmentState": { + "type": "object", + "x-cipp-field-source": "graph-entity,frontend" + }, + "groupTag": { + "type": "string", + "x-cipp-field-source": "graph-entity,frontend" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "lastContactedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "managedDeviceId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "manufacturer": { + "type": "string", + "x-cipp-field-source": "graph-entity,frontend" + }, + "model": { + "type": "string", + "x-cipp-field-source": "graph-entity,frontend" + }, + "productKey": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "purchaseOrderIdentifier": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "remediationState": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "remediationStateLastModifiedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "resourceName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "serialNumber": { + "type": "string", + "x-cipp-field-source": "graph-entity,frontend" + }, + "skuNumber": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "systemFamily": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "userlessEnrollmentStatus": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "userPrincipalName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + } + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Endpoint.Autopilot.Read" + } + }, + "/api/ListApiEgress": { + "get": { + "summary": "ListApiEgress", + "operationId": "ListApiEgress", + "tags": [ + "CIPP > Settings" + ], + "description": "Per-API-client egress usage for this instance against the daily cap. Reads the\nCraftEgressAccounting table that the Craft runtime mirrors its egress accounting into (the same\nstorage account, so this reads it directly): a per-day audit row per client plus an instance\ntotal, and 15-minute buckets for the trend. Returns today's instance summary (used-of-cap,\nenforcing, when the cap was first hit, how many requests were shed), the per-client breakdown,\nthe top endpoints by egress (instance-wide and per client), signed-in user traffic (reported,\nnever capped), and the last-24h instance trend. When the table has no data for today - accounting off, a\nnon-hosted instance, or simply no app-only traffic yet - Enabled is false and the UI hides the\ncard. SuperAdmin only.", + "parameters": [ + { + "name": "Hours", + "in": "query", + "required": false, + "schema": { + "type": "integer" + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "CIPP.SuperAdmin.Read", + "x-cipp-any-tenant": true + } + }, + "/api/ListApiTest": { + "get": { + "summary": "ListApiTest", + "operationId": "ListApiTest", + "tags": [ + "CIPP > Core" + ], + "description": "Returns debug information about the current API request, trigger metadata, and environment variables. Used for CIPP platform diagnostics.", + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "CIPP.Core.Read", + "x-cipp-any-tenant": true + } + }, + "/api/ListAppApprovalTemplates": { + "get": { + "summary": "ListAppApprovalTemplates", + "operationId": "ListAppApprovalTemplates", + "tags": [ + "Tenant > Administration > Application Approval" + ], + "description": "Lists saved application approval templates for standardized app consent configurations.", + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "AppId": { + "x-cipp-field-source": "frontend" + }, + "AppName": { + "x-cipp-field-source": "frontend" + }, + "AppType": { + "x-cipp-field-source": "frontend" + }, + "ContentHash": { + "x-cipp-field-source": "storage" + }, + "Error": { + "x-cipp-field-source": "backend" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "GUID": { + "x-cipp-field-source": "storage" + }, + "JSON": { + "x-cipp-field-source": "storage" + }, + "Package": { + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Permissions": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "PermissionSetName": { + "x-cipp-field-source": "frontend" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "SHA": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Source": { + "x-cipp-field-source": "storage" + }, + "SourcePath": { + "x-cipp-field-source": "storage" + }, + "TemplateId": { + "x-cipp-field-source": "backend" + }, + "TemplateName": { + "x-cipp-field-source": "storage,backend,frontend" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage,backend,frontend" + }, + "UpdatedBy": { + "x-cipp-field-source": "storage,frontend" + } + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.Application.Read", + "x-cipp-any-tenant": true + } + }, + "/api/ListAppConsentRequests": { + "get": { + "summary": "ListAppConsentRequests", + "operationId": "ListAppConsentRequests", + "tags": [ + "Tenant > Administration > Application Approval" + ], + "description": "Lists pending application consent requests in a tenant, filterable by request status.", + "parameters": [ + { + "name": "Filter", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "RequestStatus", + "in": "query", + "required": false, + "schema": { + "type": "string", + "enum": [ + "InProgress" + ] + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "properties": { + "appDisplayName": { + "x-cipp-field-source": "backend,frontend" + }, + "appId": { + "x-cipp-field-source": "backend,frontend" + }, + "consentUrl": { + "x-cipp-field-source": "backend,frontend" + }, + "requestDate": { + "x-cipp-field-source": "backend,frontend" + }, + "requestReason": { + "x-cipp-field-source": "backend,frontend" + }, + "requestStatus": { + "x-cipp-field-source": "backend,frontend" + }, + "requestUser": { + "x-cipp-field-source": "backend,frontend" + }, + "reviewedBy": { + "x-cipp-field-source": "backend,frontend" + }, + "reviewedDate": { + "x-cipp-field-source": "backend" + }, + "reviewedJustification": { + "x-cipp-field-source": "backend,frontend" }, - "WhenChanged": { - "x-cipp-field-source": "frontend" + "reviewedStatus": { + "x-cipp-field-source": "backend" }, - "WhenCreated": { - "x-cipp-field-source": "frontend" + "scopes": { + "x-cipp-field-source": "backend" } } } @@ -40611,6 +46735,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -40618,17 +46745,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.SpamFilter.Read" + "x-cipp-role": "Tenant.Administration.Read" } }, - "/api/ListAPDevices": { + "/api/ListAppleEnrollmentProfiles": { "get": { - "summary": "ListAPDevices", - "operationId": "ListAPDevices", + "summary": "ListAppleEnrollmentProfiles", + "operationId": "ListAppleEnrollmentProfiles", "tags": [ - "Endpoint > Autopilot" + "Endpoint > MEM" ], - "description": "Lists Windows Autopilot device identities registered in a tenant.", + "description": "Lists Apple Automated Device Enrollment tokens and enrollment profiles.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" @@ -40645,113 +46772,117 @@ "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { - "addressableUserName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "azureActiveDirectoryDeviceId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "azureAdDeviceId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "deploymentProfileAssignedDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "deploymentProfileAssignmentDetailedStatus": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "deploymentProfileAssignmentStatus": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "deviceAccountPassword": { + "appleIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "deviceAccountUpn": { - "type": "string", + "dataSharingConsentGranted": { + "type": "boolean", "x-cipp-field-source": "graph-entity" }, - "deviceFriendlyName": { + "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "displayName": { + "lastModifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "enrollmentState": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "groupTag": { + "lastSuccessfulSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "id": { - "type": "string", + "lastSyncErrorCode": { + "type": "integer", "x-cipp-field-source": "graph-entity" }, - "lastContactedDateTime": { + "lastSyncTriggeredDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "managedDeviceId": { - "type": "string", + "roleScopeTagIds": { + "type": "array", "x-cipp-field-source": "graph-entity" }, - "manufacturer": { - "type": "string", + "shareTokenWithSchoolDataSyncService": { + "type": "boolean", "x-cipp-field-source": "graph-entity" }, - "model": { - "type": "string", + "syncedDeviceCount": { + "type": "integer", "x-cipp-field-source": "graph-entity" }, - "productKey": { + "tokenExpirationDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "purchaseOrderIdentifier": { + "tokenName": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "remediationState": { + "tokenType": { "type": "object", "x-cipp-field-source": "graph-entity" + } + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Endpoint.Autopilot.Read" + } + }, + "/api/ListApplicationQueue": { + "get": { + "summary": "ListApplicationQueue", + "operationId": "ListApplicationQueue", + "tags": [ + "Endpoint > Applications" + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "properties": { + "applicationName": { + "x-cipp-field-source": "backend,frontend" }, - "remediationStateLastModifiedDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "resourceName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "serialNumber": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "assignTo": { + "x-cipp-field-source": "backend,frontend" }, - "skuNumber": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "cmdLine": { + "x-cipp-field-source": "backend,frontend" }, - "systemFamily": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "id": { + "x-cipp-field-source": "backend" }, - "userlessEnrollmentStatus": { - "type": "object", - "x-cipp-field-source": "graph-entity" + "status": { + "x-cipp-field-source": "backend" }, - "userPrincipalName": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "tenantName": { + "x-cipp-field-source": "backend,frontend" } } } @@ -40771,24 +46902,28 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.Autopilot.Read" + "x-cipp-role": "Endpoint.Application.Read" } }, - "/api/ListApiEgress": { + "/api/ListAppProtectionPolicies": { "get": { - "summary": "ListApiEgress", - "operationId": "ListApiEgress", + "summary": "ListAppProtectionPolicies", + "operationId": "ListAppProtectionPolicies", "tags": [ - "CIPP > Settings" + "Endpoint > MEM" ], - "description": "Per-API-client egress usage for this instance against the daily cap. Reads the\nCraftEgressAccounting table that the Craft runtime mirrors its egress accounting into (the same\nstorage account, so this reads it directly): a per-day audit row per client plus an instance\ntotal, and 15-minute buckets for the trend. Returns today's instance summary (used-of-cap,\nenforcing, when the cap was first hit, how many requests were shed), the per-client breakdown,\nthe top endpoints by egress (instance-wide and per client), signed-in user traffic (reported,\nnever capped), and the last-24h instance trend. When the table has no data for today - accounting off, a\nnon-hosted instance, or simply no app-only traffic yet - Enabled is false and the UI hides the\ncard. SuperAdmin only.", + "description": "Lists Intune app protection policies for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { - "name": "Hours", + "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "UseReportDB", "in": "query", + "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { - "type": "integer" + "type": "boolean" } } ], @@ -40801,7 +46936,24 @@ "type": "array", "items": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "properties": { + "displayName": { + "x-cipp-field-source": "frontend" + }, + "lastModifiedDateTime": { + "x-cipp-field-source": "frontend" + }, + "PolicyAssignment": { + "x-cipp-field-source": "frontend" + }, + "PolicyExclude": { + "x-cipp-field-source": "frontend" + }, + "PolicyTypeName": { + "x-cipp-field-source": "frontend" + } + } } } } @@ -40822,18 +46974,21 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.SuperAdmin.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "Endpoint.MEM.Read" } }, - "/api/ListApiTest": { + "/api/ListApps": { "get": { - "summary": "ListApiTest", - "operationId": "ListApiTest", + "summary": "ListApps", + "operationId": "ListApps", "tags": [ - "CIPP > Core" + "Endpoint > Applications" + ], + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } ], - "description": "Returns debug information about the current API request, trigger metadata, and environment variables. Used for CIPP platform diagnostics.", "responses": { "200": { "description": "Success", @@ -40843,7 +46998,27 @@ "type": "array", "items": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "properties": { + "AppAssignment": { + "x-cipp-field-source": "frontend" + }, + "AppExclude": { + "x-cipp-field-source": "frontend" + }, + "createdDateTime": { + "x-cipp-field-source": "frontend" + }, + "displayName": { + "x-cipp-field-source": "frontend" + }, + "lastModifiedDateTime": { + "x-cipp-field-source": "frontend" + }, + "publishingState": { + "x-cipp-field-source": "frontend" + } + } } } } @@ -40861,18 +47036,35 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "Endpoint.Application.Read" } }, - "/api/ListAppApprovalTemplates": { - "get": { - "summary": "ListAppApprovalTemplates", - "operationId": "ListAppApprovalTemplates", + "/api/ListAppsRepository": { + "post": { + "summary": "ListAppsRepository", + "operationId": "ListAppsRepository", "tags": [ - "Tenant > Administration > Application Approval" + "Endpoint > Applications" ], - "description": "Lists saved application approval templates for standardized app consent configurations.", + "description": "Searches external application repositories (WinGet, Chocolatey, etc.) for available application packages.", + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "Repository": { + "type": "string" + }, + "Search": { + "type": "string" + } + } + } + } + } + }, "responses": { "200": { "description": "Success", @@ -40882,71 +47074,28 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "AppId": { - "x-cipp-field-source": "frontend" - }, - "AppName": { - "x-cipp-field-source": "frontend" - }, - "AppType": { - "x-cipp-field-source": "frontend" - }, - "ContentHash": { - "x-cipp-field-source": "storage" - }, - "Error": { + "applicationName": { "x-cipp-field-source": "backend" }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "GUID": { - "x-cipp-field-source": "storage" - }, - "JSON": { - "x-cipp-field-source": "storage" - }, - "Package": { - "x-cipp-field-source": "storage" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" - }, - "Permissions": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "PermissionSetName": { - "x-cipp-field-source": "frontend" - }, - "RowKey": { - "x-cipp-field-source": "storage" - }, - "SHA": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "Source": { - "x-cipp-field-source": "storage" + "author": { + "x-cipp-field-source": "backend" }, - "SourcePath": { - "x-cipp-field-source": "storage" + "created": { + "x-cipp-field-source": "backend" }, - "TemplateId": { + "customRepo": { "x-cipp-field-source": "backend" }, - "TemplateName": { - "x-cipp-field-source": "storage,backend,frontend" + "description": { + "x-cipp-field-source": "backend" }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage,backend,frontend" + "packagename": { + "x-cipp-field-source": "backend" }, - "UpdatedBy": { - "x-cipp-field-source": "storage,frontend" + "version": { + "x-cipp-field-source": "backend" } } } @@ -40966,21 +47115,21 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Application.Read", + "x-cipp-role": "Endpoint.Application.Read", "x-cipp-any-tenant": true } }, - "/api/ListAppConsentRequests": { + "/api/ListAppStatus": { "get": { - "summary": "ListAppConsentRequests", - "operationId": "ListAppConsentRequests", + "summary": "ListAppStatus", + "operationId": "ListAppStatus", "tags": [ - "Tenant > Administration > Application Approval" + "Endpoint > Applications" ], - "description": "Lists pending application consent requests in a tenant, filterable by request status.", + "description": "Lists Intune application installation status across devices for a specific application, including install state and error codes.", "parameters": [ { - "name": "Filter", + "name": "AppFilter", "in": "query", "required": false, "schema": { @@ -40988,18 +47137,55 @@ } }, { - "name": "RequestStatus", + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Endpoint.Device.Read" + } + }, + "/api/ListAppTemplates": { + "get": { + "summary": "ListAppTemplates", + "operationId": "ListAppTemplates", + "tags": [ + "Endpoint > Applications" + ], + "description": "Lists the saved application deployment templates, each with its display name, description and the applications it bundles. These are CIPP templates, not a tenant's deployed apps.", + "parameters": [ + { + "name": "ID", "in": "query", "required": false, "schema": { - "type": "string", - "enum": [ - "InProgress" - ] + "type": "string" } - }, - { - "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -41011,43 +47197,71 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "appDisplayName": { + "appCount": { "x-cipp-field-source": "backend,frontend" }, - "appId": { + "appNames": { "x-cipp-field-source": "backend,frontend" }, - "consentUrl": { - "x-cipp-field-source": "backend,frontend" + "Apps": { + "x-cipp-field-source": "backend" }, - "requestDate": { + "appTypes": { "x-cipp-field-source": "backend,frontend" }, - "requestReason": { - "x-cipp-field-source": "backend,frontend" + "ContentHash": { + "x-cipp-field-source": "storage" }, - "requestStatus": { + "description": { "x-cipp-field-source": "backend,frontend" }, - "requestUser": { + "displayName": { "x-cipp-field-source": "backend,frontend" }, - "reviewedBy": { - "x-cipp-field-source": "backend,frontend" + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" }, - "reviewedDate": { - "x-cipp-field-source": "backend" + "GUID": { + "x-cipp-field-source": "storage,backend" }, - "reviewedJustification": { - "x-cipp-field-source": "backend,frontend" + "JSON": { + "x-cipp-field-source": "storage" }, - "reviewedStatus": { - "x-cipp-field-source": "backend" + "Package": { + "x-cipp-field-source": "storage" }, - "scopes": { - "x-cipp-field-source": "backend" + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Permissions": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "SHA": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Source": { + "x-cipp-field-source": "storage" + }, + "SourcePath": { + "x-cipp-field-source": "storage" + }, + "TemplateName": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "UpdatedBy": { + "x-cipp-field-source": "storage" } } } @@ -41060,9 +47274,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -41070,20 +47281,38 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Administration.Read" + "x-cipp-role": "Endpoint.Application.Read", + "x-cipp-any-tenant": true } }, - "/api/ListAppleEnrollmentProfiles": { + "/api/ListAssignmentFilters": { "get": { - "summary": "ListAppleEnrollmentProfiles", - "operationId": "ListAppleEnrollmentProfiles", + "summary": "ListAssignmentFilters", + "operationId": "ListAssignmentFilters", "tags": [ "Endpoint > MEM" ], - "description": "Lists Apple Automated Device Enrollment tokens and enrollment profiles.", + "description": "Lists Intune assignment filters for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ + { + "name": "filterId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, { "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "UseReportDB", + "in": "query", + "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", + "required": false, + "schema": { + "type": "boolean" + } } ], "responses": { @@ -41095,59 +47324,47 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "description": "Derived from the Microsoft Graph entity it queries, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { - "appleIdentifier": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "dataSharingConsentGranted": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" + "assignmentFilterManagementType": { + "type": "object", + "x-cipp-field-source": "graph-entity,frontend" }, - "id": { + "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "lastModifiedDateTime": { + "description": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "graph-entity,frontend" }, - "lastSuccessfulSyncDateTime": { + "displayName": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "graph-entity,frontend" }, - "lastSyncErrorCode": { - "type": "integer", + "id": { + "type": "string", "x-cipp-field-source": "graph-entity" }, - "lastSyncTriggeredDateTime": { + "lastModifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "roleScopeTagIds": { + "payloads": { "type": "array", "x-cipp-field-source": "graph-entity" }, - "shareTokenWithSchoolDataSyncService": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "syncedDeviceCount": { - "type": "integer", - "x-cipp-field-source": "graph-entity" + "platform": { + "type": "object", + "x-cipp-field-source": "graph-entity,frontend" }, - "tokenExpirationDateTime": { - "type": "string", + "roleScopeTags": { + "type": "array", "x-cipp-field-source": "graph-entity" }, - "tokenName": { + "rule": { "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "tokenType": { - "type": "object", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "graph-entity,frontend" } } } @@ -41170,17 +47387,27 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.Autopilot.Read" + "x-cipp-role": "Endpoint.MEM.Read" } }, - "/api/ListApplicationQueue": { + "/api/ListAssignmentFilterTemplates": { "get": { - "summary": "ListApplicationQueue", - "operationId": "ListApplicationQueue", + "summary": "ListAssignmentFilterTemplates", + "operationId": "ListAssignmentFilterTemplates", "tags": [ - "Endpoint > Applications" + "Endpoint > MEM" + ], + "description": "Lists the saved Intune assignment filter templates, each with its platform, filter rule and management type. Pass ID to return a single template. These are CIPP templates, not a tenant's deployed filters.", + "parameters": [ + { + "name": "ID", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } ], - "description": "Lists queued Intune application deployments that are pending assignment to tenants.", "responses": { "200": { "description": "Success", @@ -41190,25 +47417,68 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "applicationName": { + "assignmentFilterManagementType": { + "x-cipp-field-source": "backend" + }, + "ContentHash": { + "x-cipp-field-source": "storage" + }, + "description": { "x-cipp-field-source": "backend,frontend" }, - "assignTo": { + "displayName": { "x-cipp-field-source": "backend,frontend" }, - "cmdLine": { + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "GUID": { + "x-cipp-field-source": "storage,backend,frontend" + }, + "JSON": { + "x-cipp-field-source": "storage" + }, + "Package": { + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Permissions": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "platform": { "x-cipp-field-source": "backend,frontend" }, - "id": { - "x-cipp-field-source": "backend" + "RowKey": { + "x-cipp-field-source": "storage" }, - "status": { + "rule": { "x-cipp-field-source": "backend" }, - "tenantName": { - "x-cipp-field-source": "backend,frontend" + "SHA": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Source": { + "x-cipp-field-source": "storage" + }, + "SourcePath": { + "x-cipp-field-source": "storage" + }, + "TemplateName": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "UpdatedBy": { + "x-cipp-field-source": "storage" } } } @@ -41228,28 +47498,26 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.Application.Read" + "x-cipp-role": "Endpoint.MEM.Read", + "x-cipp-any-tenant": true } }, - "/api/ListAppProtectionPolicies": { + "/api/ListAsyncDeployment": { "get": { - "summary": "ListAppProtectionPolicies", - "operationId": "ListAppProtectionPolicies", + "summary": "Get the live progress of a background job", + "operationId": "ListAsyncDeployment", "tags": [ - "Endpoint > MEM" + "CIPP > Scheduler" ], - "description": "Lists Intune app protection policies for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", + "description": "Returns the status rows of a background job that reports progress while it runs, such as a\nuser offboarding started from the wizard: one row per target (the user) with its overall\nstatus and the status and message of every step.", "parameters": [ { - "$ref": "#/components/parameters/tenantFilter" - }, - { - "name": "UseReportDB", + "name": "DeploymentId", "in": "query", - "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", - "required": false, + "description": "The job id handed back when the work was queued (e.g. DeploymentId from ExecOffboardUser)", + "required": true, "schema": { - "type": "boolean" + "type": "string" } } ], @@ -41262,37 +47530,20 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", - "properties": { - "displayName": { - "x-cipp-field-source": "frontend" - }, - "lastModifiedDateTime": { - "x-cipp-field-source": "frontend" - }, - "PolicyAssignment": { - "x-cipp-field-source": "frontend" - }, - "PolicyExclude": { - "x-cipp-field-source": "frontend" - }, - "PolicyTypeName": { - "x-cipp-field-source": "frontend" - } - } + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -41300,28 +47551,50 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.MEM.Read" + "x-cipp-role": "CIPP.Scheduler.Read", + "x-cipp-any-tenant": true } }, - "/api/ListApps": { + "/api/ListAuditLogCoverage": { "get": { - "summary": "ListApps", - "operationId": "ListApps", + "summary": "ListAuditLogCoverage", + "operationId": "ListAuditLogCoverage", "tags": [ - "Endpoint > Applications" + "Tenant > Administration > Alerts" ], - "description": "Lists Intune managed applications for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", + "description": "Lists the V2 audit-log coverage ledger (AuditLogCoverage) - one row per tenant + 60-minute\nsearch window with its state (Planned / Created / Downloaded / Retry / DeadLetter / Skipped),\nrecord count, attempts and last error. Honours the tenant selector (a specific tenant or\nAllTenants) and CIPP tenant access control. Accepts the same date filters as the Saved Logs\nview: RelativeTime (e.g. 48h, 7d) or StartDate/EndDate. Defaults to the last 48 hours.", "parameters": [ { - "$ref": "#/components/parameters/tenantFilter" + "name": "EndDate", + "in": "query", + "required": false, + "schema": { + "type": "string" + } }, { - "name": "UseReportDB", + "name": "RelativeTime", "in": "query", - "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", + "description": "--- Date range (mirrors Invoke-ListAuditLogs) ---", "required": false, "schema": { - "type": "boolean" + "type": "string" + } + }, + { + "name": "StartDate", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "tenantFilter", + "in": "query", + "required": false, + "schema": { + "type": "string" } } ], @@ -41334,25 +47607,83 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "AppAssignment": { - "x-cipp-field-source": "frontend" + "Attempts": { + "x-cipp-field-source": "storage" }, - "AppExclude": { - "x-cipp-field-source": "frontend" + "CreatedUtc": { + "x-cipp-field-source": "storage" }, - "createdDateTime": { - "x-cipp-field-source": "frontend" + "DownloadedUtc": { + "x-cipp-field-source": "storage" }, - "displayName": { - "x-cipp-field-source": "frontend" + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" }, - "lastModifiedDateTime": { - "x-cipp-field-source": "frontend" + "LastError": { + "x-cipp-field-source": "storage,frontend" }, - "publishingState": { + "LastPolledUtc": { + "x-cipp-field-source": "storage" + }, + "MatchedCount": { + "x-cipp-field-source": "storage,frontend" + }, + "PartitionKey": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "ProcessedUtc": { + "x-cipp-field-source": "storage" + }, + "RecordCount": { + "type": "integer", + "x-cipp-field-source": "storage,frontend" + }, + "RetryCount": { + "x-cipp-field-source": "storage" + }, + "RowKey": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "SearchId": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "SearchStatus": { + "type": "string", + "x-cipp-field-source": "storage,frontend" + }, + "State": { + "x-cipp-field-source": "storage,frontend" + }, + "Tenant": { "x-cipp-field-source": "frontend" + }, + "TenantId": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "ThrottleCount": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Type": { + "x-cipp-field-source": "storage,frontend" + }, + "WindowEnd": { + "type": "string", + "x-cipp-field-source": "storage,frontend" + }, + "WindowStart": { + "type": "string", + "x-cipp-field-source": "storage,frontend" } } } @@ -41365,9 +47696,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -41375,35 +47703,55 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.Application.Read" + "x-cipp-role": "Tenant.Alert.Read", + "x-cipp-any-tenant": true } }, - "/api/ListAppsRepository": { - "post": { - "summary": "ListAppsRepository", - "operationId": "ListAppsRepository", + "/api/ListAuditLogs": { + "get": { + "summary": "ListAuditLogs", + "operationId": "ListAuditLogs", "tags": [ - "Endpoint > Applications" + "Tenant > Administration > Alerts" ], - "description": "Searches external application repositories (WinGet, Chocolatey, etc.) for available application packages.", - "requestBody": { - "required": false, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "Repository": { - "type": "string" - }, - "Search": { - "type": "string" - } - } - } + "description": "Lists audit log entries from the CIPP audit log store, filterable by tenant, date range, and log ID.", + "parameters": [ + { + "name": "EndDate", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "LogId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "RelativeTime", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "StartDate", + "in": "query", + "required": false, + "schema": { + "type": "string" } + }, + { + "$ref": "#/components/parameters/tenantFilter" } - }, + ], "responses": { "200": { "description": "Success", @@ -41413,28 +47761,37 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "applicationName": { - "x-cipp-field-source": "backend" + "Data": { + "type": "string", + "x-cipp-field-source": "storage,backend" }, - "author": { - "x-cipp-field-source": "backend" + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" }, - "created": { - "x-cipp-field-source": "backend" + "EventCreationTime": { + "x-cipp-field-source": "storage" }, - "customRepo": { + "LogId": { "x-cipp-field-source": "backend" }, - "description": { - "x-cipp-field-source": "backend" + "PartitionKey": { + "x-cipp-field-source": "storage" }, - "packagename": { - "x-cipp-field-source": "backend" + "RowKey": { + "x-cipp-field-source": "storage" }, - "version": { - "x-cipp-field-source": "backend" + "Tenant": { + "x-cipp-field-source": "storage,backend" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage,backend" + }, + "Title": { + "x-cipp-field-source": "storage,backend" } } } @@ -41454,21 +47811,20 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.Application.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "CIPP.Alert.Read" } }, - "/api/ListAppStatus": { + "/api/ListAuditLogSearches": { "get": { - "summary": "ListAppStatus", - "operationId": "ListAppStatus", + "summary": "ListAuditLogSearches", + "operationId": "ListAuditLogSearches", "tags": [ - "Endpoint > Applications" + "Tenant > Administration > Alerts" ], - "description": "Lists Intune application installation status across devices for a specific application, including install state and error codes.", + "description": "Lists or creates Microsoft 365 Unified Audit Log searches for a tenant, with support for retrieving search results.", "parameters": [ { - "name": "AppFilter", + "name": "Days", "in": "query", "required": false, "schema": { @@ -41476,54 +47832,26 @@ } }, { - "$ref": "#/components/parameters/tenantFilter" - } - ], - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "type": "array", - "items": { - "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." - } - } - } + "name": "SearchId", + "in": "query", + "required": false, + "schema": { + "type": "string" } }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" - }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" - } - }, - "security": [ { - "bearerAuth": [] - } - ], - "x-cipp-role": "Endpoint.Device.Read" - } - }, - "/api/ListAppTemplates": { - "get": { - "summary": "ListAppTemplates", - "operationId": "ListAppTemplates", - "tags": [ - "Endpoint > Applications" - ], - "description": "Lists the saved application deployment templates, each with its display name, description and the applications it bundles. These are CIPP templates, not a tenant's deployed apps.", - "parameters": [ + "$ref": "#/components/parameters/tenantFilter" + }, { - "name": "ID", + "name": "Type", "in": "query", "required": false, "schema": { - "type": "string" + "type": "string", + "enum": [ + "Searches", + "SearchResults" + ] } } ], @@ -41536,71 +47864,56 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "appCount": { - "x-cipp-field-source": "backend,frontend" - }, - "appNames": { - "x-cipp-field-source": "backend,frontend" - }, - "Apps": { - "x-cipp-field-source": "backend" - }, - "appTypes": { - "x-cipp-field-source": "backend,frontend" - }, - "ContentHash": { + "CippStatus": { + "type": "string", "x-cipp-field-source": "storage" }, - "description": { - "x-cipp-field-source": "backend,frontend" + "DisplayName": { + "type": "string", + "x-cipp-field-source": "storage,frontend" }, - "displayName": { - "x-cipp-field-source": "backend,frontend" + "EndTime": { + "type": "string", + "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, - "GUID": { - "x-cipp-field-source": "storage,backend" - }, - "JSON": { - "x-cipp-field-source": "storage" + "filterEndDateTime": { + "x-cipp-field-source": "frontend" }, - "Package": { - "x-cipp-field-source": "storage" + "filterStartDateTime": { + "x-cipp-field-source": "frontend" }, "PartitionKey": { + "type": "string", "x-cipp-field-source": "storage" }, - "Permissions": { + "Query": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { - "x-cipp-field-source": "storage" - }, - "SHA": { "type": "string", "x-cipp-field-source": "storage" }, - "Source": { + "StartTime": { + "type": "string", "x-cipp-field-source": "storage" }, - "SourcePath": { - "x-cipp-field-source": "storage" + "status": { + "x-cipp-field-source": "frontend" }, - "TemplateName": { + "Tenant": { + "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" - }, - "UpdatedBy": { - "x-cipp-field-source": "storage" } } } @@ -41608,6 +47921,9 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -41620,37 +47936,91 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.Application.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "Tenant.Alert.Read" } }, - "/api/ListAssignmentFilters": { + "/api/ListAuditLogTest": { "get": { - "summary": "ListAssignmentFilters", - "operationId": "ListAssignmentFilters", + "summary": "ListAuditLogTest", + "operationId": "ListAuditLogTest", "tags": [ - "Endpoint > MEM" + "Tenant > Administration > Alerts" ], - "description": "Lists Intune assignment filters for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", + "description": "Tests audit log webhook rules against a specific search to validate rule matching and alert triggering.", "parameters": [ { - "name": "filterId", + "name": "SearchId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "TenantFilter", "in": "query", "required": false, "schema": { "type": "string" } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.Alert.Read", + "x-cipp-any-tenant": true + } + }, + "/api/ListAutopilotconfig": { + "get": { + "summary": "ListAutopilotconfig", + "operationId": "ListAutopilotconfig", + "tags": [ + "Endpoint > Autopilot" + ], + "description": "Lists Windows Autopilot deployment profiles, Enrollment Status Page configurations, or Windows Hello for Business policies for a tenant.", + "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { - "name": "UseReportDB", + "name": "type", "in": "query", - "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { - "type": "boolean" + "type": "string", + "x-cipp-observed-values": [ + "ApProfile", + "ESP" + ] } } ], @@ -41665,10 +48035,6 @@ "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { - "assignmentFilterManagementType": { - "type": "object", - "x-cipp-field-source": "graph-entity,frontend" - }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" @@ -41677,33 +48043,45 @@ "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, + "deviceEnrollmentConfigurationType": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "deviceNameTemplate": { + "x-cipp-field-source": "frontend" + }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, + "extractHardwareHash": { + "x-cipp-field-source": "frontend" + }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, + "language": { + "x-cipp-field-source": "frontend" + }, "lastModifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "payloads": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "PolicyAssignment": { + "x-cipp-field-source": "frontend" }, - "platform": { - "type": "object", - "x-cipp-field-source": "graph-entity,frontend" + "priority": { + "type": "integer", + "x-cipp-field-source": "graph-entity" }, - "roleScopeTags": { + "roleScopeTagIds": { "type": "array", "x-cipp-field-source": "graph-entity" }, - "rule": { - "type": "string", - "x-cipp-field-source": "graph-entity,frontend" + "version": { + "type": "integer", + "x-cipp-field-source": "graph-entity" } } } @@ -41716,9 +48094,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -41726,27 +48101,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.MEM.Read" + "x-cipp-role": "Endpoint.Autopilot.Read" } }, - "/api/ListAssignmentFilterTemplates": { + "/api/ListAvailableTests": { "get": { - "summary": "ListAssignmentFilterTemplates", - "operationId": "ListAssignmentFilterTemplates", + "summary": "ListAvailableTests", + "operationId": "ListAvailableTests", "tags": [ - "Endpoint > MEM" - ], - "description": "Lists the saved Intune assignment filter templates, each with its platform, filter rule and management type. Pass ID to return a single template. These are CIPP templates, not a tenant's deployed filters.", - "parameters": [ - { - "name": "ID", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - } + "Tenant > Tests" ], + "description": "Lists the compliance tests CIPP can run against a tenant, both the built-in framework tests (CIS, CISA, Essential Eight, EIDSCA, ORCA) and any custom PowerShell tests added to this instance. Returns the catalogue of tests, not their results.", "responses": { "200": { "description": "Success", @@ -41756,67 +48121,89 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "assignmentFilterManagementType": { + "AlertOnFailure": { + "x-cipp-field-source": "storage" + }, + "AlertStatuses": { + "x-cipp-field-source": "storage" + }, + "Category": { + "x-cipp-field-source": "storage" + }, + "CreatedBy": { + "x-cipp-field-source": "storage" + }, + "CreatedDate": { + "x-cipp-field-source": "storage" + }, + "CustomTests": { "x-cipp-field-source": "backend" }, - "ContentHash": { + "Description": { "x-cipp-field-source": "storage" }, - "description": { - "x-cipp-field-source": "backend,frontend" + "DevicesTests": { + "x-cipp-field-source": "backend" }, - "displayName": { - "x-cipp-field-source": "backend,frontend" + "Enabled": { + "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, - "GUID": { - "x-cipp-field-source": "storage,backend,frontend" + "IdentityTests": { + "x-cipp-field-source": "backend" }, - "JSON": { + "ImplementationEffort": { "x-cipp-field-source": "storage" }, - "Package": { + "MarkdownTemplate": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, - "Permissions": { - "type": "string", + "Pillar": { "x-cipp-field-source": "storage" }, - "platform": { - "x-cipp-field-source": "backend,frontend" - }, - "RowKey": { + "ResultMode": { "x-cipp-field-source": "storage" }, - "rule": { + "Results": { "x-cipp-field-source": "backend" }, - "SHA": { - "type": "string", + "ResultSchema": { "x-cipp-field-source": "storage" }, - "Source": { + "ReturnType": { "x-cipp-field-source": "storage" }, - "SourcePath": { + "Risk": { "x-cipp-field-source": "storage" }, - "TemplateName": { + "RowKey": { + "x-cipp-field-source": "storage" + }, + "ScriptContent": { + "x-cipp-field-source": "storage" + }, + "ScriptGuid": { + "x-cipp-field-source": "storage" + }, + "ScriptName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, - "UpdatedBy": { + "UserImpact": { + "x-cipp-field-source": "storage" + }, + "Version": { "x-cipp-field-source": "storage" } } @@ -41825,6 +48212,9 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -41837,27 +48227,34 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.MEM.Read", + "x-cipp-role": "CIPP.Dashboard.Read", "x-cipp-any-tenant": true } }, - "/api/ListAsyncDeployment": { + "/api/ListAzureADConnectStatus": { "get": { - "summary": "Get the live progress of a background job", - "operationId": "ListAsyncDeployment", + "summary": "ListAzureADConnectStatus", + "operationId": "ListAzureADConnectStatus", "tags": [ - "CIPP > Scheduler" + "Identity > Reports" ], - "description": "Returns the status rows of a background job that reports progress while it runs, such as a\nuser offboarding started from the wizard: one row per target (the user) with its overall\nstatus and the status and message of every step.", + "description": "Retrieves Entra ID Connect (Azure AD Connect) synchronization status and configuration for a tenant, including sync intervals, password sync, and pass-through authentication settings.", "parameters": [ { - "name": "DeploymentId", + "name": "DataToReturn", "in": "query", - "description": "The job id handed back when the work was queued (e.g. DeploymentId from ExecOffboardUser)", - "required": true, + "description": "Optional. Which section to return: 'AzureADConnectSettings' for the sync status and configuration, or 'AzureADObjectsInError' for objects that failed to sync. Omit to return both.", + "required": false, "schema": { - "type": "string" + "type": "string", + "enum": [ + "AzureADConnectSettings", + "AzureADObjectsInError" + ] } + }, + { + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -41869,7 +48266,45 @@ "type": "array", "items": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", + "properties": { + "AzureADConnectSettings": { + "x-cipp-field-source": "backend" + }, + "createdDateTime": { + "type": "string", + "x-cipp-field-source": "graph,frontend" + }, + "dirSyncEnabled": { + "x-cipp-field-source": "backend" + }, + "displayName": { + "type": "string", + "x-cipp-field-source": "graph,frontend" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph" + }, + "lastSyncDateTime": { + "x-cipp-field-source": "backend" + }, + "numberOfHoursFromLastSync": { + "x-cipp-field-source": "backend" + }, + "ObjectsInError": { + "x-cipp-field-source": "backend" + }, + "ObjectType": { + "x-cipp-field-source": "frontend" + }, + "onPremisesProvisioningErrors": { + "x-cipp-field-source": "frontend" + }, + "raw": { + "x-cipp-field-source": "backend" + } + } } } } @@ -41890,53 +48325,79 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Scheduler.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "Tenant.Directory.Read" } }, - "/api/ListAuditLogCoverage": { + "/api/ListBaselineAlignment": { "get": { - "summary": "ListAuditLogCoverage", - "operationId": "ListAuditLogCoverage", + "summary": "ListBaselineAlignment", + "operationId": "ListBaselineAlignment", "tags": [ - "Tenant > Administration > Alerts" + "Tenant > Standards" ], - "description": "Lists the V2 audit-log coverage ledger (AuditLogCoverage) - one row per tenant + 60-minute\nsearch window with its state (Planned / Created / Downloaded / Retry / DeadLetter / Skipped),\nrecord count, attempts and last error. Honours the tenant selector (a specific tenant or\nAllTenants) and CIPP tenant access control. Accepts the same date filters as the Saved Logs\nview: RelativeTime (e.g. 48h, 7d) or StartDate/EndDate. Defaults to the last 48 hours.", + "description": "Baseline alignment data. With ?tenantFilter= returns the tenant payload (summary,\nresolved rows with history, stage states, deviation feed); with\n?tenantFilter=&history=true returns the flattened run-event history; with\n?byStandard=true returns the aggregate payload (fleet score, per-standard rollups,\ntenant summaries, trend, and the accepted/denied deviation list).", "parameters": [ { - "name": "EndDate", + "name": "byStandard", "in": "query", "required": false, "schema": { - "type": "string" + "type": "boolean" } }, { - "name": "RelativeTime", + "name": "history", "in": "query", - "description": "--- Date range (mirrors Invoke-ListAuditLogs) ---", "required": false, "schema": { - "type": "string" + "type": "boolean" } }, { - "name": "StartDate", - "in": "query", - "required": false, - "schema": { - "type": "string" + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } } }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ { - "name": "tenantFilter", - "in": "query", - "required": false, - "schema": { - "type": "string" - } + "bearerAuth": [] } ], + "x-cipp-role": "Tenant.Baselines.Read" + } + }, + "/api/ListBaselines": { + "get": { + "summary": "ListBaselines", + "operationId": "ListBaselines", + "tags": [ + "Tenant > Standards" + ], + "description": "Lists baselines with their stages, per-stage rollout occupancy, and\nper-tenant stage states.", "responses": { "200": { "description": "Success", @@ -41946,83 +48407,34 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { - "Attempts": { - "x-cipp-field-source": "storage" - }, - "CreatedUtc": { - "x-cipp-field-source": "storage" - }, - "DownloadedUtc": { - "x-cipp-field-source": "storage" - }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "LastError": { - "x-cipp-field-source": "storage,frontend" - }, - "LastPolledUtc": { - "x-cipp-field-source": "storage" - }, - "MatchedCount": { - "x-cipp-field-source": "storage,frontend" - }, - "PartitionKey": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "ProcessedUtc": { - "x-cipp-field-source": "storage" - }, - "RecordCount": { - "type": "integer", - "x-cipp-field-source": "storage,frontend" - }, - "RetryCount": { - "x-cipp-field-source": "storage" - }, - "RowKey": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "SearchId": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "SearchStatus": { - "type": "string", - "x-cipp-field-source": "storage,frontend" + "assignedTenants": { + "x-cipp-field-source": "frontend" }, - "State": { - "x-cipp-field-source": "storage,frontend" + "baselineName": { + "x-cipp-field-source": "frontend" }, - "Tenant": { + "description": { "x-cipp-field-source": "frontend" }, - "TenantId": { - "type": "string", - "x-cipp-field-source": "storage" + "remediationPosture": { + "x-cipp-field-source": "frontend" }, - "ThrottleCount": { - "x-cipp-field-source": "storage" + "source": { + "x-cipp-field-source": "frontend" }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" + "stageNames": { + "x-cipp-field-source": "frontend" }, - "Type": { - "x-cipp-field-source": "storage,frontend" + "standardsCount": { + "x-cipp-field-source": "frontend" }, - "WindowEnd": { - "type": "string", - "x-cipp-field-source": "storage,frontend" + "updatedAt": { + "x-cipp-field-source": "frontend" }, - "WindowStart": { - "type": "string", - "x-cipp-field-source": "storage,frontend" + "updatedBy": { + "x-cipp-field-source": "frontend" } } } @@ -42035,6 +48447,50 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.Baselines.Read" + } + }, + "/api/ListBaselineStandards": { + "get": { + "summary": "ListBaselineStandards", + "operationId": "ListBaselineStandards", + "tags": [ + "Tenant > Standards" + ], + "description": "Lists the Baseline definition catalog: the standards available to add to a baseline,\nincluding their configurable variables and metadata.", + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -42042,51 +48498,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Alert.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "Tenant.Baselines.Read" } }, - "/api/ListAuditLogs": { + "/api/ListBasicAuth": { "get": { - "summary": "ListAuditLogs", - "operationId": "ListAuditLogs", + "summary": "ListBasicAuth", + "operationId": "ListBasicAuth", "tags": [ - "Tenant > Administration > Alerts" + "Identity > Reports" ], - "description": "Lists audit log entries from the CIPP audit log store, filterable by tenant, date range, and log ID.", "parameters": [ - { - "name": "EndDate", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "LogId", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "RelativeTime", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "StartDate", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, { "$ref": "#/components/parameters/tenantFilter" } @@ -42100,20 +48522,17 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", "properties": { - "Data": { + "clientAppUsed": { "type": "string", - "x-cipp-field-source": "storage,backend" + "x-cipp-field-source": "graph,storage,backend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, - "EventCreationTime": { - "x-cipp-field-source": "storage" - }, - "LogId": { + "MetaData": { "x-cipp-field-source": "backend" }, "PartitionKey": { @@ -42122,15 +48541,20 @@ "RowKey": { "x-cipp-field-source": "storage" }, + "Status": { + "type": "object", + "x-cipp-field-source": "graph,backend" + }, "Tenant": { - "x-cipp-field-source": "storage,backend" + "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", - "x-cipp-field-source": "storage,backend" + "x-cipp-field-source": "storage" }, - "Title": { - "x-cipp-field-source": "storage,backend" + "userPrincipalName": { + "type": "string", + "x-cipp-field-source": "graph,storage,backend" } } } @@ -42150,48 +48574,47 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Alert.Read" + "x-cipp-role": "Identity.AuditLog.Read" } }, - "/api/ListAuditLogSearches": { + "/api/ListBECPhishingSpread": { "get": { - "summary": "ListAuditLogSearches", - "operationId": "ListAuditLogSearches", + "summary": "Lists who else received mail from a sender, from message-trace metadata.", + "operationId": "ListBECPhishingSpread", "tags": [ - "Tenant > Administration > Alerts" + "Identity > Administration > Users" ], - "description": "Lists or creates Microsoft 365 Unified Audit Log searches for a tenant, with support for retrieving search results.", + "description": "Given a sender address (and optionally a subject fragment), walks the message trace for the last N days and groups the recipients: address, internal or external, message count, first and last delivery and the subjects seen. Use it to find the spread of a phishing message from a compromised or look-alike sender. Metadata only - no message content is read.", "parameters": [ { - "name": "Days", + "name": "days", "in": "query", + "description": "look-back in days (1-90)", "required": false, "schema": { "type": "string" } }, { - "name": "SearchId", + "name": "sender", "in": "query", + "description": "the sender to trace", "required": false, "schema": { "type": "string" } }, { - "$ref": "#/components/parameters/tenantFilter" - }, - { - "name": "Type", + "name": "subject", "in": "query", + "description": "optional subject fragment to narrow the trace (case-insensitive contains)", "required": false, "schema": { - "type": "string", - "enum": [ - "Searches", - "SearchResults" - ] + "type": "string" } + }, + { + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -42203,56 +48626,28 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "CippStatus": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "DisplayName": { - "type": "string", - "x-cipp-field-source": "storage,frontend" - }, - "EndTime": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "filterEndDateTime": { - "x-cipp-field-source": "frontend" - }, - "filterStartDateTime": { - "x-cipp-field-source": "frontend" - }, - "PartitionKey": { - "type": "string", - "x-cipp-field-source": "storage" + "Complete": { + "x-cipp-field-source": "backend" }, - "Query": { - "type": "string", - "x-cipp-field-source": "storage" + "Days": { + "x-cipp-field-source": "backend" }, - "RowKey": { - "type": "string", - "x-cipp-field-source": "storage" + "ExternalCount": { + "x-cipp-field-source": "backend" }, - "StartTime": { - "type": "string", - "x-cipp-field-source": "storage" + "InternalCount": { + "x-cipp-field-source": "backend" }, - "status": { - "x-cipp-field-source": "frontend" + "Recipients": { + "x-cipp-field-source": "backend" }, - "Tenant": { - "type": "string", - "x-cipp-field-source": "storage" + "Sender": { + "x-cipp-field-source": "backend" }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" + "TotalMessages": { + "x-cipp-field-source": "backend" } } } @@ -42260,14 +48655,14 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -42275,35 +48670,28 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Alert.Read" + "x-cipp-role": "Identity.User.Read" } }, - "/api/ListAuditLogTest": { - "get": { - "summary": "ListAuditLogTest", - "operationId": "ListAuditLogTest", + "/api/ListBECRemediationActions": { + "post": { + "summary": "Lists the available Business Email Compromise containment actions.", + "operationId": "ListBECRemediationActions", "tags": [ - "Tenant > Administration > Alerts" + "Identity > Administration > Users" ], - "description": "Tests audit log webhook rules against a specific search to validate rule matching and alert triggering.", - "parameters": [ - { - "name": "SearchId", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "TenantFilter", - "in": "query", - "required": false, - "schema": { - "type": "string" + "description": "Returns the catalog of containment actions ExecBECRemediate accepts - id, label, description, impact (Low/Medium/High/Critical), whether it is reversible and whether it runs by default (the instance-wide defaults from CIPP settings).", + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": {} + } } } - ], + }, "responses": { "200": { "description": "Success", @@ -42313,7 +48701,36 @@ "type": "array", "items": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "DefaultSelected": { + "x-cipp-field-source": "backend" + }, + "Description": { + "x-cipp-field-source": "backend" + }, + "Id": { + "x-cipp-field-source": "backend" + }, + "Impact": { + "x-cipp-field-source": "backend" + }, + "Label": { + "x-cipp-field-source": "backend" + }, + "Order": { + "x-cipp-field-source": "backend" + }, + "ParameterName": { + "x-cipp-field-source": "backend" + }, + "Reversible": { + "x-cipp-field-source": "backend" + }, + "TargetSource": { + "x-cipp-field-source": "backend" + } + } } } } @@ -42334,32 +48751,34 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Alert.Read", + "x-cipp-role": "Identity.User.ReadWrite", "x-cipp-any-tenant": true } }, - "/api/ListAutopilotconfig": { + "/api/ListBECReports": { "get": { - "summary": "ListAutopilotconfig", - "operationId": "ListAutopilotconfig", + "summary": "Lists Business Email Compromise runs.", + "operationId": "ListBECReports", "tags": [ - "Endpoint > Autopilot" + "Identity > Administration > Users" ], - "description": "Lists Windows Autopilot deployment profiles, Enrollment Status Page configurations, or Windows Hello for Business policies for a tenant.", + "description": "Lists every stored BEC run (case id, user, status, threat level and score, when it was extracted, who requested it) for a tenant, or for every tenant with tenantFilter=AllTenants. Optionally narrowed to one user with userId. Runs are kept until deleted; this list never reads the result payloads.", "parameters": [ { - "$ref": "#/components/parameters/tenantFilter" + "name": "tenantFilter", + "in": "query", + "required": false, + "schema": { + "type": "string" + } }, { - "name": "type", + "name": "userId", "in": "query", + "description": "Narrow the list to one user's run history", "required": false, "schema": { - "type": "string", - "x-cipp-observed-values": [ - "ApProfile", - "ESP" - ] + "type": "string" } } ], @@ -42372,55 +48791,49 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the Microsoft Graph entity it queries, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "createdDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "CaseId": { + "x-cipp-field-source": "backend" }, - "description": { - "type": "string", - "x-cipp-field-source": "graph-entity,frontend" + "ContainmentRuns": { + "x-cipp-field-source": "backend" }, - "deviceEnrollmentConfigurationType": { - "type": "object", - "x-cipp-field-source": "graph-entity" + "DisplayName": { + "x-cipp-field-source": "backend" }, - "deviceNameTemplate": { - "x-cipp-field-source": "frontend" + "ErrorMessage": { + "x-cipp-field-source": "backend" }, - "displayName": { - "type": "string", - "x-cipp-field-source": "graph-entity,frontend" + "ExtractedAt": { + "x-cipp-field-source": "backend" }, - "extractHardwareHash": { - "x-cipp-field-source": "frontend" + "IncompleteCount": { + "x-cipp-field-source": "backend" }, - "id": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "Level": { + "x-cipp-field-source": "backend" }, - "language": { - "x-cipp-field-source": "frontend" + "RequestedAt": { + "x-cipp-field-source": "backend" }, - "lastModifiedDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "RequestedBy": { + "x-cipp-field-source": "backend" }, - "PolicyAssignment": { - "x-cipp-field-source": "frontend" + "Score": { + "x-cipp-field-source": "backend" }, - "priority": { - "type": "integer", - "x-cipp-field-source": "graph-entity" + "Status": { + "x-cipp-field-source": "backend" }, - "roleScopeTagIds": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "Tenant": { + "x-cipp-field-source": "backend" }, - "version": { - "type": "integer", - "x-cipp-field-source": "graph-entity" + "UserId": { + "x-cipp-field-source": "backend" + }, + "UserPrincipalName": { + "x-cipp-field-source": "backend" } } } @@ -42433,6 +48846,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -42440,17 +48856,29 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.Autopilot.Read" + "x-cipp-role": "Identity.User.Read", + "x-cipp-any-tenant": true } }, - "/api/ListAvailableTests": { + "/api/ListBrandingPresets": { "get": { - "summary": "ListAvailableTests", - "operationId": "ListAvailableTests", + "summary": "ListBrandingPresets", + "operationId": "ListBrandingPresets", "tags": [ - "Tenant > Tests" + "Tools > Report-Builder" + ], + "description": "Lists named report branding presets — colours, logo, cover image, footer and watermark —\nthat a report template can be pointed at instead of the default branding.\n\nRead-only and separate from ExecBrandingSettings on purpose: building a report should not\nrequire the app-settings permission that editing branding does.", + "parameters": [ + { + "name": "includeImages", + "in": "query", + "description": "Image payloads are large and a picker only needs names and colours, so callers ask for the artwork explicitly.", + "required": false, + "schema": { + "type": "boolean" + } + } ], - "description": "Lists the compliance tests CIPP can run against a tenant, both the built-in framework tests (CIS, CISA, Essential Eight, EIDSCA, ORCA) and any custom PowerShell tests added to this instance. Returns the catalogue of tests, not their results.", "responses": { "200": { "description": "Success", @@ -42460,92 +48888,7 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", - "properties": { - "AlertOnFailure": { - "x-cipp-field-source": "storage" - }, - "AlertStatuses": { - "x-cipp-field-source": "storage" - }, - "Category": { - "x-cipp-field-source": "storage" - }, - "CreatedBy": { - "x-cipp-field-source": "storage" - }, - "CreatedDate": { - "x-cipp-field-source": "storage" - }, - "CustomTests": { - "x-cipp-field-source": "backend" - }, - "Description": { - "x-cipp-field-source": "storage" - }, - "DevicesTests": { - "x-cipp-field-source": "backend" - }, - "Enabled": { - "x-cipp-field-source": "storage" - }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "IdentityTests": { - "x-cipp-field-source": "backend" - }, - "ImplementationEffort": { - "x-cipp-field-source": "storage" - }, - "MarkdownTemplate": { - "x-cipp-field-source": "storage" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" - }, - "Pillar": { - "x-cipp-field-source": "storage" - }, - "ResultMode": { - "x-cipp-field-source": "storage" - }, - "Results": { - "x-cipp-field-source": "backend" - }, - "ResultSchema": { - "x-cipp-field-source": "storage" - }, - "ReturnType": { - "x-cipp-field-source": "storage" - }, - "Risk": { - "x-cipp-field-source": "storage" - }, - "RowKey": { - "x-cipp-field-source": "storage" - }, - "ScriptContent": { - "x-cipp-field-source": "storage" - }, - "ScriptGuid": { - "x-cipp-field-source": "storage" - }, - "ScriptName": { - "x-cipp-field-source": "storage" - }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "UserImpact": { - "x-cipp-field-source": "storage" - }, - "Version": { - "x-cipp-field-source": "storage" - } - } + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } @@ -42566,92 +48909,43 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Dashboard.Read", + "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, - "/api/ListAzureADConnectStatus": { + "/api/ListBrandingSettings": { "get": { - "summary": "ListAzureADConnectStatus", - "operationId": "ListAzureADConnectStatus", + "summary": "ListBrandingSettings", + "operationId": "ListBrandingSettings", "tags": [ - "Identity > Reports" + "CIPP > Settings" ], - "description": "Retrieves Entra ID Connect (Azure AD Connect) synchronization status and configuration for a tenant, including sync intervals, password sync, and pass-through authentication settings.", + "description": "Returns the report branding: colours, logo and cover images, footer and watermark text.\n\nBranding was previously returned by ListUserSettings, which put every uploaded cover\ninline on every page load and ran the legacy-image migration - a write - on that read\npath. This read never writes; migration belongs to ExecBrandingSettings -Action Get.\n\nThe role matches ListUserSettings rather than the branding write role, since every user\nwho renders a report needs the branding on it.", "parameters": [ { - "name": "DataToReturn", + "name": "includeGallery", "in": "query", - "description": "Optional. Which section to return: 'AzureADConnectSettings' for the sync status and configuration, or 'AzureADObjectsInError' for objects that failed to sync. Omit to return both.", "required": false, "schema": { - "type": "string", - "enum": [ - "AzureADConnectSettings", - "AzureADObjectsInError" - ] + "type": "string" } - }, - { - "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", - "content": { - "application/json": { - "schema": { - "type": "array", - "items": { - "type": "object", - "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", - "properties": { - "AzureADConnectSettings": { - "x-cipp-field-source": "backend" - }, - "createdDateTime": { - "type": "string", - "x-cipp-field-source": "graph,frontend" - }, - "dirSyncEnabled": { - "x-cipp-field-source": "backend" - }, - "displayName": { - "type": "string", - "x-cipp-field-source": "graph,frontend" - }, - "id": { - "type": "string", - "x-cipp-field-source": "graph" - }, - "lastSyncDateTime": { - "x-cipp-field-source": "backend" - }, - "numberOfHoursFromLastSync": { - "x-cipp-field-source": "backend" - }, - "ObjectsInError": { - "x-cipp-field-source": "backend" - }, - "ObjectType": { - "x-cipp-field-source": "frontend" - }, - "onPremisesProvisioningErrors": { - "x-cipp-field-source": "frontend" - }, - "raw": { - "x-cipp-field-source": "backend" - } - } + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -42664,36 +48958,27 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Directory.Read" + "x-cipp-role": "Identity.User.Read", + "x-cipp-any-tenant": true } }, - "/api/ListBaselineAlignment": { + "/api/ListBreachesAccount": { "get": { - "summary": "ListBaselineAlignment", - "operationId": "ListBaselineAlignment", + "summary": "ListBreachesAccount", + "operationId": "ListBreachesAccount", "tags": [ - "Tenant > Standards" + "Tools > Breach-Lookup" ], - "description": "Baseline alignment data. With ?tenantFilter= returns the tenant payload (summary,\nresolved rows with history, stage states, deviation feed); with\n?tenantFilter=&history=true returns the flattened run-event history; with\n?byStandard=true returns the aggregate payload (fleet score, per-standard rollups,\ntenant summaries, trend, and the accepted/denied deviation list).", + "description": "Checks an email account or domain against the Have I Been Pwned (HIBP) breach database.", "parameters": [ { - "name": "byStandard", - "in": "query", - "required": false, - "schema": { - "type": "boolean" - } - }, - { - "name": "history", + "name": "account", "in": "query", + "description": "Interact with query parameters or the body of the request.", "required": false, "schema": { - "type": "boolean" + "type": "string" } - }, - { - "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -42716,9 +49001,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -42726,17 +49008,23 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Baselines.Read" + "x-cipp-role": "CIPP.BreachLookup.Read", + "x-cipp-any-tenant": true } }, - "/api/ListBaselines": { + "/api/ListBreachesTenant": { "get": { - "summary": "ListBaselines", - "operationId": "ListBaselines", + "summary": "ListBreachesTenant", + "operationId": "ListBreachesTenant", "tags": [ - "Tenant > Standards" + "Tools > Breach-Lookup" + ], + "description": "Lists cached data breach results for user accounts in a tenant from the CIPP breach monitoring cache.", + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } ], - "description": "Lists baselines with their stages, per-stage rollout occupancy, and\nper-tenant stage states.", "responses": { "200": { "description": "Success", @@ -42746,34 +49034,36 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "assignedTenants": { - "x-cipp-field-source": "frontend" + "breaches": { + "x-cipp-field-source": "storage" }, - "baselineName": { + "email": { "x-cipp-field-source": "frontend" }, - "description": { - "x-cipp-field-source": "frontend" + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" }, - "remediationPosture": { - "x-cipp-field-source": "frontend" + "PartitionKey": { + "x-cipp-field-source": "storage" }, - "source": { + "password": { "x-cipp-field-source": "frontend" }, - "stageNames": { - "x-cipp-field-source": "frontend" + "RowKey": { + "x-cipp-field-source": "storage" }, - "standardsCount": { + "sources": { "x-cipp-field-source": "frontend" }, - "updatedAt": { - "x-cipp-field-source": "frontend" + "sum": { + "x-cipp-field-source": "storage" }, - "updatedBy": { - "x-cipp-field-source": "frontend" + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" } } } @@ -42786,9 +49076,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -42796,17 +49083,22 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Baselines.Read" + "x-cipp-role": "CIPP.BreachLookup.Read" } }, - "/api/ListBaselineStandards": { + "/api/ListCAGapAnalysis": { "get": { - "summary": "ListBaselineStandards", - "operationId": "ListBaselineStandards", + "summary": "ListCAGapAnalysis", + "operationId": "ListCAGapAnalysis", "tags": [ - "Tenant > Standards" + "Tenant > SecuritySimulations" + ], + "description": "Conditional Access gap analysis for one tenant from the cached policies: findings, the\npersona-by-control coverage matrix and the 1 to 10 posture score.", + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } ], - "description": "Lists the Baseline definition catalog: the standards available to add to a baseline,\nincluding their configurable variables and metadata.", "responses": { "200": { "description": "Success", @@ -42816,7 +49108,21 @@ "type": "array", "items": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "analysis": { + "x-cipp-field-source": "backend" + }, + "analysisError": { + "x-cipp-field-source": "backend" + }, + "licensed": { + "x-cipp-field-source": "backend" + }, + "tenantFilter": { + "x-cipp-field-source": "backend" + } + } } } } @@ -42837,20 +49143,43 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Baselines.Read" + "x-cipp-role": "Tenant.SecuritySimulations.Read" } }, - "/api/ListBasicAuth": { + "/api/ListCalendarPermissions": { "get": { - "summary": "ListBasicAuth", - "operationId": "ListBasicAuth", + "summary": "ListCalendarPermissions", + "operationId": "ListCalendarPermissions", "tags": [ - "Identity > Reports" + "Email-Exchange > Administration" ], - "description": "Lists sign-in events using basic authentication (legacy protocols) for a tenant from the audit logs.", "parameters": [ + { + "name": "ByUser", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, { "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "UseReportDB", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "UserID", + "in": "query", + "required": false, + "schema": { + "type": "string" + } } ], "responses": { @@ -42862,39 +49191,40 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "clientAppUsed": { - "type": "string", - "x-cipp-field-source": "graph,storage,backend" + "AccessRights": { + "x-cipp-field-source": "backend" }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" + "CandidateEmails": { + "x-cipp-field-source": "backend" }, - "MetaData": { + "FolderIdentity": { "x-cipp-field-source": "backend" }, - "PartitionKey": { - "x-cipp-field-source": "storage" + "FolderName": { + "x-cipp-field-source": "backend" }, - "RowKey": { - "x-cipp-field-source": "storage" + "Identity": { + "x-cipp-field-source": "backend" }, - "Status": { - "type": "object", - "x-cipp-field-source": "graph,backend" + "MailboxInfo": { + "x-cipp-field-source": "backend" }, - "Tenant": { - "x-cipp-field-source": "storage" + "User": { + "x-cipp-field-source": "backend" }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" + "UserAmbiguous": { + "x-cipp-field-source": "backend" }, - "userPrincipalName": { - "type": "string", - "x-cipp-field-source": "graph,storage,backend" + "UserEmail": { + "x-cipp-field-source": "backend" + }, + "UserId": { + "x-cipp-field-source": "backend" + }, + "UserType": { + "x-cipp-field-source": "backend" } } } @@ -42907,6 +49237,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -42914,40 +49247,82 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.AuditLog.Read" + "x-cipp-role": "Exchange.Mailbox.Read" } }, - "/api/ListBECPhishingSpread": { + "/api/ListCAPolicyCoverage": { "get": { - "summary": "Lists who else received mail from a sender, from message-trace metadata.", - "operationId": "ListBECPhishingSpread", + "summary": "ListCAPolicyCoverage", + "operationId": "ListCAPolicyCoverage", "tags": [ - "Identity > Administration > Users" + "Tenant > Conditional" ], - "description": "Given a sender address (and optionally a subject fragment), walks the message trace for the last N days and groups the recipients: address, internal or external, message count, first and last delivery and the subjects seen. Use it to find the spread of a phishing message from a compromised or look-alike sender. Metadata only - no message content is read.", + "description": "Resolves identity assignment coverage for a single Conditional Access policy: which users\nare touched by includes or exclusions, their net status (covered or excluded), and why\n(users, transitive groups, roles, guests, special tokens). Does not evaluate apps,\nlocations, or sign-in what-if conditions.", "parameters": [ { - "name": "days", + "name": "GUID", "in": "query", - "description": "look-back in days (1-90)", "required": false, "schema": { "type": "string" } }, { - "name": "sender", + "name": "id", "in": "query", - "description": "the sender to trace", "required": false, "schema": { "type": "string" } }, { - "name": "subject", + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.ConditionalAccess.Read" + } + }, + "/api/ListCASituations": { + "get": { + "summary": "ListCASituations", + "operationId": "ListCASituations", + "tags": [ + "Tenant > SecuritySimulations" + ], + "description": "Evaluates every predefined sign-in situation (admin, user and guest personas under unmanaged\ndevices, foreign locations, legacy clients, device-code flow, risk levels and more) live against the\ntenant's Conditional Access through the What If API, and names the control missing wherever a\nsign-in gets through. Optional adminUserId, userUserId and guestUserId pick the accounts to sign\nin as; country picks where the foreign-country sign-ins come from.", + "parameters": [ + { + "name": "country", "in": "query", - "description": "optional subject fragment to narrow the trace (case-insensitive contains)", "required": false, "schema": { "type": "string" @@ -42968,25 +49343,28 @@ "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "Complete": { + "candidates": { "x-cipp-field-source": "backend" }, - "Days": { + "country": { "x-cipp-field-source": "backend" }, - "ExternalCount": { + "excluded": { "x-cipp-field-source": "backend" }, - "InternalCount": { + "identities": { "x-cipp-field-source": "backend" }, - "Recipients": { + "licensed": { "x-cipp-field-source": "backend" }, - "Sender": { + "situations": { "x-cipp-field-source": "backend" }, - "TotalMessages": { + "summary": { + "x-cipp-field-source": "backend" + }, + "tenantFilter": { "x-cipp-field-source": "backend" } } @@ -43010,28 +49388,21 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.Read" + "x-cipp-role": "Tenant.SecuritySimulations.Read" } }, - "/api/ListBECRemediationActions": { - "post": { - "summary": "Lists the available Business Email Compromise containment actions.", - "operationId": "ListBECRemediationActions", + "/api/ListCASMailboxes": { + "get": { + "summary": "ListCASMailboxes", + "operationId": "ListCASMailboxes", "tags": [ - "Identity > Administration > Users" + "Email-Exchange > Administration" ], - "description": "Returns the catalog of containment actions ExecBECRemediate accepts - id, label, description, impact (Low/Medium/High/Critical), whether it is reversible and whether it runs by default (the instance-wide defaults from CIPP settings).", - "requestBody": { - "required": false, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": {} - } - } + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" } - }, + ], "responses": { "200": { "description": "Success", @@ -43043,31 +49414,16 @@ "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "DefaultSelected": { - "x-cipp-field-source": "backend" - }, - "Description": { - "x-cipp-field-source": "backend" - }, - "Id": { - "x-cipp-field-source": "backend" - }, - "Impact": { - "x-cipp-field-source": "backend" - }, - "Label": { - "x-cipp-field-source": "backend" - }, - "Order": { + "ImapEnabled": { "x-cipp-field-source": "backend" }, - "ParameterName": { + "LegacyProtocolsEnabled": { "x-cipp-field-source": "backend" }, - "Reversible": { + "PopEnabled": { "x-cipp-field-source": "backend" }, - "TargetSource": { + "userPrincipalName": { "x-cipp-field-source": "backend" } } @@ -43081,9 +49437,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -43091,21 +49444,20 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.ReadWrite", - "x-cipp-any-tenant": true + "x-cipp-role": "Exchange.Mailbox.Read" } }, - "/api/ListBECReports": { + "/api/ListCAtemplates": { "get": { - "summary": "Lists Business Email Compromise runs.", - "operationId": "ListBECReports", + "summary": "ListCAtemplates", + "operationId": "ListCAtemplates", "tags": [ - "Identity > Administration > Users" + "Tenant > Conditional" ], - "description": "Lists every stored BEC run (case id, user, status, threat level and score, when it was extracted, who requested it) for a tenant, or for every tenant with tenantFilter=AllTenants. Optionally narrowed to one user with userId. Runs are kept until deleted; this list never reads the result payloads.", + "description": "Lists saved Conditional Access policy templates for deploying standardized CA configurations.", "parameters": [ { - "name": "tenantFilter", + "name": "guid", "in": "query", "required": false, "schema": { @@ -43113,9 +49465,16 @@ } }, { - "name": "userId", + "name": "id", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "mode", "in": "query", - "description": "Narrow the list to one user's run history", "required": false, "schema": { "type": "string" @@ -43131,48 +49490,70 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "CaseId": { - "x-cipp-field-source": "backend" + "ContentHash": { + "x-cipp-field-source": "storage" }, - "ContainmentRuns": { - "x-cipp-field-source": "backend" + "displayName": { + "x-cipp-field-source": "frontend" }, - "DisplayName": { - "x-cipp-field-source": "backend" + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" }, - "ErrorMessage": { - "x-cipp-field-source": "backend" + "GUID": { + "x-cipp-field-source": "storage,frontend" }, - "ExtractedAt": { - "x-cipp-field-source": "backend" + "JSON": { + "x-cipp-field-source": "storage" }, - "IncompleteCount": { + "label": { "x-cipp-field-source": "backend" }, - "Level": { - "x-cipp-field-source": "backend" + "Package": { + "x-cipp-field-source": "storage,frontend" }, - "RequestedAt": { - "x-cipp-field-source": "backend" + "PartitionKey": { + "x-cipp-field-source": "storage" }, - "RequestedBy": { - "x-cipp-field-source": "backend" + "Permissions": { + "type": "string", + "x-cipp-field-source": "storage" }, - "Score": { - "x-cipp-field-source": "backend" + "RowKey": { + "x-cipp-field-source": "storage" }, - "Status": { + "SHA": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Source": { + "x-cipp-field-source": "storage,frontend" + }, + "SourcePath": { + "x-cipp-field-source": "storage" + }, + "templateCount": { "x-cipp-field-source": "backend" }, - "Tenant": { + "TemplateName": { + "x-cipp-field-source": "storage" + }, + "templates": { "x-cipp-field-source": "backend" }, - "UserId": { + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "type": { "x-cipp-field-source": "backend" }, - "UserPrincipalName": { + "UpdatedBy": { + "x-cipp-field-source": "storage" + }, + "value": { "x-cipp-field-source": "backend" } } @@ -43186,9 +49567,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -43196,27 +49574,21 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.Read", + "x-cipp-role": "Tenant.ConditionalAccess.Read", "x-cipp-any-tenant": true } }, - "/api/ListBrandingPresets": { + "/api/ListCheckExtAlerts": { "get": { - "summary": "ListBrandingPresets", - "operationId": "ListBrandingPresets", + "summary": "ListCheckExtAlerts", + "operationId": "ListCheckExtAlerts", "tags": [ - "Tools > Report-Builder" + "Security > Incidents" ], - "description": "Lists named report branding presets — colours, logo, cover image, footer and watermark —\nthat a report template can be pointed at instead of the default branding.\n\nRead-only and separate from ExecBrandingSettings on purpose: building a report should not\nrequire the app-settings permission that editing branding does.", + "description": "Lists extension alert check results from third-party integrations for a tenant.", "parameters": [ { - "name": "includeImages", - "in": "query", - "description": "Image payloads are large and a picker only needs names and colours, so callers ask for the artwork explicitly.", - "required": false, - "schema": { - "type": "boolean" - } + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -43228,15 +49600,71 @@ "type": "array", "items": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "message": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "potentialUserDisplayName": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "potentialUserName": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "rawBody": { + "x-cipp-field-source": "storage" + }, + "reason": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "reportedByIP": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "score": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "tenantFilter": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "threshold": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "type": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "url": { + "type": "string", + "x-cipp-field-source": "storage" + } + } } } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -43249,22 +49677,49 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "CIPP.Core.Read" } }, - "/api/ListBrandingSettings": { + "/api/ListCippDocs": { "get": { - "summary": "ListBrandingSettings", - "operationId": "ListBrandingSettings", + "summary": "Search the CIPP documentation, or fetch one documentation page in full.", + "operationId": "ListCippDocs", "tags": [ - "CIPP > Settings" + "CIPP > Core" ], - "description": "Returns the report branding: colours, logo and cover images, footer and watermark text.\n\nBranding was previously returned by ListUserSettings, which put every uploaded cover\ninline on every page load and ran the legacy-image migration - a write - on that read\npath. This read never writes; migration belongs to ExecBrandingSettings -Action Get.\n\nThe role matches ListUserSettings rather than the branding write role, since every user\nwho renders a report needs the branding on it.", + "description": "Searches the GitBook documentation shipped with this build and returns matching sections,\neach with an excerpt and links back to docs.cipp.app and to the file on GitHub. Pages under\nuser-documentation also report the CIPP route they document, so a screen can be traced to\nits docs and back.\n\nPass path on its own to list the pages under a documentation subtree or a CIPP route, or\nwith full=true to return one page's entire text. This backs the SearchDocs and GetDoc MCP\ntools and is available to the UI and API clients on the same terms.", "parameters": [ { - "name": "includeGallery", + "name": "full", + "in": "query", + "description": "Return the whole page rather than matching sections. Requires path.", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "limit", + "in": "query", + "description": "Maximum results to return (default 8, max 25).", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "path", + "in": "query", + "description": "A documentation subtree ('user-documentation/identity') or a CIPP route ('/identity/administration/users').", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "query", "in": "query", + "description": "Keywords or a plain-language question, e.g. 'how do I set up GDAP'.", "required": false, "schema": { "type": "string" @@ -43291,6 +49746,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -43298,29 +49756,18 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.User.Read", + "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, - "/api/ListBreachesAccount": { + "/api/ListCippQueue": { "get": { - "summary": "ListBreachesAccount", - "operationId": "ListBreachesAccount", + "summary": "ListCippQueue", + "operationId": "ListCippQueue", "tags": [ - "Tools > Breach-Lookup" - ], - "description": "Checks an email account or domain against the Have I Been Pwned (HIBP) breach database.", - "parameters": [ - { - "name": "account", - "in": "query", - "description": "Interact with query parameters or the body of the request.", - "required": false, - "schema": { - "type": "string" - } - } + "CIPP > Core" ], + "description": "Lists active and recent CIPP background processing queue items and their status.", "responses": { "200": { "description": "Success", @@ -43348,21 +49795,26 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.BreachLookup.Read", + "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, - "/api/ListBreachesTenant": { + "/api/ListCippQueues": { "get": { - "summary": "ListBreachesTenant", - "operationId": "ListBreachesTenant", + "summary": "ListCippQueues", + "operationId": "ListCippQueues", "tags": [ - "Tools > Breach-Lookup" + "CIPP > Core" ], - "description": "Lists cached data breach results for user accounts in a tenant from the CIPP breach monitoring cache.", + "description": "Lists several CIPP background queues at once and rolls them up into a single progress\nfigure. ListCippQueue reports one queue; this exists for the actions that start several\nat a time - syncing a report that is compiled from more than one cache, for instance -\nwhere the useful answer is \"how far along is the refresh\" rather than the state of each\nindividual queue.\n\nPass QueueIds as a comma-separated list. Each is resolved through Get-CIPPQueueData, so\nthe same data shape and status derivation applies as for a single queue. Ids that no\nlonger exist are reported in MissingQueueIds rather than silently dropped, because a\ncaller polling for completion needs to know the difference between a queue that finished\nand one that was never found.\n\nThe rolled-up Status is the least complete state across the set: anything still running\nkeeps the whole refresh Running, and a failure anywhere is surfaced rather than averaged\naway.", "parameters": [ { - "$ref": "#/components/parameters/tenantFilter" + "name": "QueueIds", + "in": "query", + "required": false, + "schema": { + "type": "string" + } } ], "responses": { @@ -43374,36 +49826,52 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "breaches": { - "x-cipp-field-source": "storage" + "CompletedQueues": { + "x-cipp-field-source": "backend" }, - "email": { - "x-cipp-field-source": "frontend" + "CompletedTasks": { + "x-cipp-field-source": "backend" }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" + "FailedQueues": { + "x-cipp-field-source": "backend" }, - "PartitionKey": { - "x-cipp-field-source": "storage" + "FailedTasks": { + "x-cipp-field-source": "backend" }, - "password": { - "x-cipp-field-source": "frontend" + "FoundQueues": { + "x-cipp-field-source": "backend" }, - "RowKey": { - "x-cipp-field-source": "storage" + "IsComplete": { + "x-cipp-field-source": "backend" }, - "sources": { - "x-cipp-field-source": "frontend" + "MissingQueueIds": { + "x-cipp-field-source": "backend" }, - "sum": { - "x-cipp-field-source": "storage" + "PercentComplete": { + "x-cipp-field-source": "backend" }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" + "Queues": { + "x-cipp-field-source": "backend" + }, + "RunningQueues": { + "x-cipp-field-source": "backend" + }, + "RunningTasks": { + "x-cipp-field-source": "backend" + }, + "Status": { + "x-cipp-field-source": "backend" + }, + "Summary": { + "x-cipp-field-source": "backend" + }, + "TotalQueues": { + "x-cipp-field-source": "backend" + }, + "TotalTasks": { + "x-cipp-field-source": "backend" } } } @@ -43411,6 +49879,9 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -43423,22 +49894,18 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.BreachLookup.Read" + "x-cipp-role": "CIPP.Core.Read", + "x-cipp-any-tenant": true } }, - "/api/ListCAGapAnalysis": { + "/api/ListCIPPUsers": { "get": { - "summary": "ListCAGapAnalysis", - "operationId": "ListCAGapAnalysis", + "summary": "ListCIPPUsers", + "operationId": "ListCIPPUsers", "tags": [ - "Tenant > SecuritySimulations" - ], - "description": "Conditional Access gap analysis for one tenant from the cached policies: findings, the\npersona-by-control coverage matrix and the 1 to 10 posture score.", - "parameters": [ - { - "$ref": "#/components/parameters/tenantFilter" - } + "CIPP > Settings" ], + "description": "Lists CIPP platform users and their role assignments from the allowedUsers table. Requires SuperAdmin access.", "responses": { "200": { "description": "Success", @@ -43448,21 +49915,7 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", - "properties": { - "analysis": { - "x-cipp-field-source": "backend" - }, - "analysisError": { - "x-cipp-field-source": "backend" - }, - "licensed": { - "x-cipp-field-source": "backend" - }, - "tenantFilter": { - "x-cipp-field-source": "backend" - } - } + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } @@ -43483,45 +49936,26 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.SecuritySimulations.Read" + "x-cipp-role": "CIPP.SuperAdmin.Read", + "x-cipp-any-tenant": true } }, - "/api/ListCalendarPermissions": { + "/api/ListCommunityRepos": { "get": { - "summary": "ListCalendarPermissions", - "operationId": "ListCalendarPermissions", + "summary": "List community repositories in Table Storage", + "operationId": "ListCommunityRepos", "tags": [ - "Email-Exchange > Administration" + "Tools > GitHub" ], - "description": "Lists calendar permissions for mailboxes in a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", + "description": "This function lists community repositories in Table Storage", "parameters": [ { - "name": "ByUser", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - }, - { - "name": "UseReportDB", + "name": "WriteAccess", "in": "query", - "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } - }, - { - "name": "UserID", - "in": "query", - "required": false, - "schema": { - "type": "string" - } } ], "responses": { @@ -43533,25 +49967,74 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "AccessRights": { - "x-cipp-field-source": "backend" + "BuiltIn": { + "x-cipp-field-source": "storage,backend" }, - "FolderName": { - "x-cipp-field-source": "backend" + "DefaultBranch": { + "type": "string", + "x-cipp-field-source": "storage,backend" }, - "Identity": { - "x-cipp-field-source": "backend" + "Description": { + "type": "string", + "x-cipp-field-source": "storage,backend" }, - "MailboxInfo": { - "x-cipp-field-source": "backend" + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" }, - "User": { + "FullName": { + "type": "string", + "x-cipp-field-source": "storage,backend" + }, + "Id": { "x-cipp-field-source": "backend" }, - "UserId": { + "Name": { + "type": "string", + "x-cipp-field-source": "storage,backend,frontend" + }, + "Owner": { + "type": "string", + "x-cipp-field-source": "storage,backend,frontend" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Permissions": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "RepoPermissions": { "x-cipp-field-source": "backend" + }, + "RowKey": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "TemplateTypes": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "UploadBranch": { + "x-cipp-field-source": "storage,backend,frontend" + }, + "URL": { + "type": "string", + "x-cipp-field-source": "storage,backend,frontend" + }, + "Visibility": { + "type": "string", + "x-cipp-field-source": "storage,backend,frontend" + }, + "WriteAccess": { + "type": "boolean", + "x-cipp-field-source": "storage,backend,frontend" } } } @@ -43564,9 +50047,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -43574,20 +50054,21 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.Read" + "x-cipp-role": "CIPP.TemplateLibrary.Read", + "x-cipp-any-tenant": true } }, - "/api/ListCAPolicyCoverage": { + "/api/ListCommunityRepoTemplates": { "get": { - "summary": "ListCAPolicyCoverage", - "operationId": "ListCAPolicyCoverage", + "summary": "List templates available in community repositories", + "operationId": "ListCommunityRepoTemplates", "tags": [ - "Tenant > Conditional" + "Tools > GitHub" ], - "description": "Resolves identity assignment coverage for a single Conditional Access policy: which users\nare touched by includes or exclusions, their net status (covered or excluded), and why\n(users, transitive groups, roles, guests, special tokens). Does not evaluate apps,\nlocations, or sign-in what-if conditions.", + "description": "Builds a catalog of templates across community repositories using a single git tree call\nper repository. Joins against the templates table to flag imported templates and available\nupdates. When a Path is supplied, returns the contents of that single file instead (preview).", "parameters": [ { - "name": "GUID", + "name": "Branch", "in": "query", "required": false, "schema": { @@ -43595,7 +50076,7 @@ } }, { - "name": "id", + "name": "FullName", "in": "query", "required": false, "schema": { @@ -43603,7 +50084,13 @@ } }, { - "$ref": "#/components/parameters/tenantFilter" + "name": "Path", + "in": "query", + "description": "Preview mode: return the contents of a single file", + "required": false, + "schema": { + "type": "string" + } } ], "responses": { @@ -43612,22 +50099,20 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "array", + "items": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -43635,28 +50120,30 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.ConditionalAccess.Read" + "x-cipp-role": "CIPP.TemplateLibrary.Read", + "x-cipp-any-tenant": true } }, - "/api/ListCASituations": { + "/api/ListCompliancePolicies": { "get": { - "summary": "ListCASituations", - "operationId": "ListCASituations", + "summary": "ListCompliancePolicies", + "operationId": "ListCompliancePolicies", "tags": [ - "Tenant > SecuritySimulations" + "Endpoint > MEM" ], - "description": "Evaluates every predefined sign-in situation (admin, user and guest personas under unmanaged\ndevices, foreign locations, legacy clients, device-code flow, risk levels and more) live against the\ntenant's Conditional Access through the What If API, and names the control missing wherever a\nsign-in gets through. Optional adminUserId, userUserId and guestUserId pick the accounts to sign\nin as; country picks where the foreign-country sign-ins come from.", + "description": "Lists Intune device compliance policies for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { - "name": "country", + "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "UseReportDB", "in": "query", + "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { - "type": "string" + "type": "boolean" } - }, - { - "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -43668,31 +50155,25 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { - "candidates": { - "x-cipp-field-source": "backend" - }, - "country": { - "x-cipp-field-source": "backend" - }, - "excluded": { - "x-cipp-field-source": "backend" + "description": { + "x-cipp-field-source": "frontend" }, - "identities": { - "x-cipp-field-source": "backend" + "displayName": { + "x-cipp-field-source": "frontend" }, - "licensed": { - "x-cipp-field-source": "backend" + "lastModifiedDateTime": { + "x-cipp-field-source": "frontend" }, - "situations": { - "x-cipp-field-source": "backend" + "PolicyAssignment": { + "x-cipp-field-source": "frontend" }, - "summary": { - "x-cipp-field-source": "backend" + "PolicyExclude": { + "x-cipp-field-source": "frontend" }, - "tenantFilter": { - "x-cipp-field-source": "backend" + "PolicyTypeName": { + "x-cipp-field-source": "frontend" } } } @@ -43715,41 +50196,46 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.SecuritySimulations.Read" + "x-cipp-role": "Endpoint.MEM.Read" } }, - "/api/ListCAtemplates": { + "/api/ListConditionalAccessPolicies": { "get": { - "summary": "ListCAtemplates", - "operationId": "ListCAtemplates", + "summary": "ListConditionalAccessPolicies", + "operationId": "ListConditionalAccessPolicies", "tags": [ "Tenant > Conditional" ], - "description": "Lists saved Conditional Access policy templates for deploying standardized CA configurations.", + "description": "Lists Conditional Access policies for a tenant with resolved display names for users, groups, applications, and locations. When manualPagination is set on an AllTenants read, one page is returned per request with a continuation token in Metadata.nextLink.", "parameters": [ { - "name": "guid", + "name": "manualPagination", "in": "query", + "description": "Return one page per request with a continuation token in Metadata.nextLink; AllTenants reads only.", "required": false, "schema": { "type": "string" } }, { - "name": "id", + "name": "nextLink", "in": "query", + "description": "Continuation token from the previous page's Metadata.nextLink; opaque to callers.", "required": false, "schema": { "type": "string" } }, { - "name": "mode", + "name": "PageSize", "in": "query", "required": false, "schema": { - "type": "string" + "type": "integer" } + }, + { + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -43763,8 +50249,11 @@ "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "ContentHash": { - "x-cipp-field-source": "storage" + "builtInControls": { + "x-cipp-field-source": "frontend" + }, + "clientAppTypes": { + "x-cipp-field-source": "frontend" }, "displayName": { "x-cipp-field-source": "frontend" @@ -43773,59 +50262,69 @@ "type": "string", "x-cipp-field-source": "storage" }, - "GUID": { - "x-cipp-field-source": "storage,frontend" + "excludeApplications": { + "x-cipp-field-source": "frontend" }, - "JSON": { - "x-cipp-field-source": "storage" + "excludeGroups": { + "x-cipp-field-source": "frontend" }, - "label": { - "x-cipp-field-source": "backend" + "excludeLocations": { + "x-cipp-field-source": "frontend" }, - "Package": { - "x-cipp-field-source": "storage,frontend" + "excludePlatforms": { + "x-cipp-field-source": "frontend" }, - "PartitionKey": { - "x-cipp-field-source": "storage" + "excludeUsers": { + "x-cipp-field-source": "frontend" }, - "Permissions": { - "type": "string", - "x-cipp-field-source": "storage" + "grantControlsOperator": { + "x-cipp-field-source": "frontend" }, - "RowKey": { - "x-cipp-field-source": "storage" + "includeApplications": { + "x-cipp-field-source": "frontend" }, - "SHA": { - "type": "string", - "x-cipp-field-source": "storage" + "includeGroups": { + "x-cipp-field-source": "frontend" }, - "Source": { - "x-cipp-field-source": "storage,frontend" + "includeLocations": { + "x-cipp-field-source": "frontend" }, - "SourcePath": { - "x-cipp-field-source": "storage" + "includePlatforms": { + "x-cipp-field-source": "frontend" }, - "templateCount": { + "includeUsers": { + "x-cipp-field-source": "frontend" + }, + "Metadata": { "x-cipp-field-source": "backend" }, - "TemplateName": { - "x-cipp-field-source": "storage" + "modifiedDateTime": { + "x-cipp-field-source": "frontend" }, - "templates": { - "x-cipp-field-source": "backend" + "PartitionKey": { + "x-cipp-field-source": "storage" }, - "Timestamp": { + "Policy": { "type": "string", "x-cipp-field-source": "storage" }, - "type": { + "Results": { "x-cipp-field-source": "backend" }, - "UpdatedBy": { + "RowKey": { + "type": "string", "x-cipp-field-source": "storage" }, - "value": { - "x-cipp-field-source": "backend" + "state": { + "x-cipp-field-source": "frontend" + }, + "Tenant": { + "type": "string", + "x-cipp-field-source": "storage,frontend" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" } } } @@ -43845,19 +50344,34 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.ConditionalAccess.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "Tenant.ConditionalAccess.Read" } }, - "/api/ListCheckExtAlerts": { + "/api/ListConditionalAccessPolicyChanges": { "get": { - "summary": "ListCheckExtAlerts", - "operationId": "ListCheckExtAlerts", + "summary": "ListConditionalAccessPolicyChanges", + "operationId": "ListConditionalAccessPolicyChanges", "tags": [ - "Security > Incidents" + "Tenant > Conditional" ], - "description": "Lists extension alert check results from third-party integrations for a tenant.", + "description": "Lists audit log entries showing changes to a specific Conditional Access policy, including before/after values.", "parameters": [ + { + "name": "displayName", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "id", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, { "$ref": "#/components/parameters/tenantFilter" } @@ -43871,64 +50385,55 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { - "ETag": { + "activityDateTime": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "message": { + "activityDisplayName": { "type": "string", - "x-cipp-field-source": "storage" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "potentialUserDisplayName": { - "type": "string", - "x-cipp-field-source": "storage" + "additionalDetails": { + "type": "array", + "x-cipp-field-source": "graph-entity" }, - "potentialUserName": { + "category": { "type": "string", - "x-cipp-field-source": "storage" - }, - "rawBody": { - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "reason": { + "correlationId": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "reportedByIP": { + "id": { "type": "string", - "x-cipp-field-source": "storage" - }, - "RowKey": { - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "score": { - "type": "string", - "x-cipp-field-source": "storage" + "initiatedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "tenantFilter": { + "loggedByService": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "threshold": { + "operationType": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" + "result": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "type": { + "resultReason": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "url": { - "type": "string", - "x-cipp-field-source": "storage" + "targetResources": { + "type": "array", + "x-cipp-field-source": "graph-entity" } } } @@ -43936,6 +50441,9 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -43948,53 +50456,20 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.Read" + "x-cipp-role": "Tenant.ConditionalAccess.Read" } }, - "/api/ListCippDocs": { + "/api/ListConnectionFilter": { "get": { - "summary": "Search the CIPP documentation, or fetch one documentation page in full.", - "operationId": "ListCippDocs", + "summary": "ListConnectionFilter", + "operationId": "ListConnectionFilter", "tags": [ - "CIPP > Core" + "Email-Exchange > Spamfilter" ], - "description": "Searches the GitBook documentation shipped with this build and returns matching sections,\neach with an excerpt and links back to docs.cipp.app and to the file on GitHub. Pages under\nuser-documentation also report the CIPP route they document, so a screen can be traced to\nits docs and back.\n\nPass path on its own to list the pages under a documentation subtree or a CIPP route, or\nwith full=true to return one page's entire text. This backs the SearchDocs and GetDoc MCP\ntools and is available to the UI and API clients on the same terms.", + "description": "Lists hosted connection filter policies (IP allow/block lists) in Exchange Online Protection.", "parameters": [ { - "name": "full", - "in": "query", - "description": "Return the whole page rather than matching sections. Requires path.", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "limit", - "in": "query", - "description": "Maximum results to return (default 8, max 25).", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "path", - "in": "query", - "description": "A documentation subtree ('user-documentation/identity') or a CIPP route ('/identity/administration/users').", - "required": true, - "schema": { - "type": "string" - } - }, - { - "name": "query", - "in": "query", - "description": "Keywords or a plain-language question, e.g. 'how do I set up GDAP'.", - "required": false, - "schema": { - "type": "string" - } + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -44006,7 +50481,24 @@ "type": "array", "items": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "properties": { + "EnableSafeList": { + "x-cipp-field-source": "frontend" + }, + "IPAllowList": { + "x-cipp-field-source": "frontend" + }, + "IPBlockList": { + "x-cipp-field-source": "frontend" + }, + "IsDefault": { + "x-cipp-field-source": "frontend" + }, + "Name": { + "x-cipp-field-source": "frontend" + } + } } } } @@ -44017,9 +50509,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -44027,18 +50516,27 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "Exchange.ConnectionFilter.Read" } }, - "/api/ListCippQueue": { + "/api/ListConnectionFilterTemplates": { "get": { - "summary": "ListCippQueue", - "operationId": "ListCippQueue", + "summary": "ListConnectionFilterTemplates", + "operationId": "ListConnectionFilterTemplates", "tags": [ - "CIPP > Core" + "Email-Exchange > Spamfilter" + ], + "description": "Lists saved connection filter policy templates for Exchange Online Protection.", + "parameters": [ + { + "name": "ID", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } ], - "description": "Lists active and recent CIPP background processing queue items and their status.", "responses": { "200": { "description": "Success", @@ -44048,7 +50546,70 @@ "type": "array", "items": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "ContentHash": { + "x-cipp-field-source": "storage" + }, + "EnableSafeList": { + "x-cipp-field-source": "frontend" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "GUID": { + "x-cipp-field-source": "storage,frontend" + }, + "IPAllowList": { + "x-cipp-field-source": "frontend" + }, + "IPBlockList": { + "x-cipp-field-source": "frontend" + }, + "IsDefault": { + "x-cipp-field-source": "frontend" + }, + "JSON": { + "x-cipp-field-source": "storage" + }, + "name": { + "x-cipp-field-source": "frontend" + }, + "Package": { + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Permissions": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "SHA": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Source": { + "x-cipp-field-source": "storage" + }, + "SourcePath": { + "x-cipp-field-source": "storage" + }, + "TemplateName": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "UpdatedBy": { + "x-cipp-field-source": "storage" + } + } } } } @@ -44066,21 +50627,23 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.Read", + "x-cipp-role": "Exchange.ConnectionFilter.Read", "x-cipp-any-tenant": true } }, - "/api/ListCippQueues": { + "/api/ListContactPermissions": { "get": { - "summary": "ListCippQueues", - "operationId": "ListCippQueues", + "summary": "ListContactPermissions", + "operationId": "ListContactPermissions", "tags": [ - "CIPP > Core" + "Email-Exchange > Administration" ], - "description": "Lists several CIPP background queues at once and rolls them up into a single progress\nfigure. ListCippQueue reports one queue; this exists for the actions that start several\nat a time - syncing a report that is compiled from more than one cache, for instance -\nwhere the useful answer is \"how far along is the refresh\" rather than the state of each\nindividual queue.\n\nPass QueueIds as a comma-separated list. Each is resolved through Get-CIPPQueueData, so\nthe same data shape and status derivation applies as for a single queue. Ids that no\nlonger exist are reported in MissingQueueIds rather than silently dropped, because a\ncaller polling for completion needs to know the difference between a queue that finished\nand one that was never found.\n\nThe rolled-up Status is the least complete state across the set: anything still running\nkeeps the whole refresh Running, and a failure anywhere is surfaced rather than averaged\naway.", "parameters": [ { - "name": "QueueIds", + "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "UserID", "in": "query", "required": false, "schema": { @@ -44099,49 +50662,31 @@ "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "CompletedQueues": { - "x-cipp-field-source": "backend" - }, - "CompletedTasks": { - "x-cipp-field-source": "backend" - }, - "FailedQueues": { - "x-cipp-field-source": "backend" - }, - "FailedTasks": { - "x-cipp-field-source": "backend" - }, - "FoundQueues": { - "x-cipp-field-source": "backend" - }, - "IsComplete": { - "x-cipp-field-source": "backend" - }, - "MissingQueueIds": { + "AccessRights": { "x-cipp-field-source": "backend" }, - "PercentComplete": { + "CandidateEmails": { "x-cipp-field-source": "backend" }, - "Queues": { + "FolderName": { "x-cipp-field-source": "backend" }, - "RunningQueues": { + "Identity": { "x-cipp-field-source": "backend" }, - "RunningTasks": { + "MailboxInfo": { "x-cipp-field-source": "backend" }, - "Status": { + "User": { "x-cipp-field-source": "backend" }, - "Summary": { + "UserAmbiguous": { "x-cipp-field-source": "backend" }, - "TotalQueues": { + "UserEmail": { "x-cipp-field-source": "backend" }, - "TotalTasks": { + "UserId": { "x-cipp-field-source": "backend" } } @@ -44150,9 +50695,6 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -44165,18 +50707,30 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "Exchange.Mailbox.Read" } }, - "/api/ListCIPPUsers": { + "/api/ListContacts": { "get": { - "summary": "ListCIPPUsers", - "operationId": "ListCIPPUsers", + "summary": "ListContacts", + "operationId": "ListContacts", "tags": [ - "CIPP > Settings" + "Email-Exchange > Administration > Contacts" + ], + "description": "Lists Exchange Online mail contacts for a tenant, with optional filtering by contact ID for detailed view.", + "parameters": [ + { + "name": "id", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } ], - "description": "Lists CIPP platform users and their role assignments from the allowedUsers table. Requires SuperAdmin access.", "responses": { "200": { "description": "Success", @@ -44186,12 +50740,46 @@ "type": "array", "items": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", + "properties": { + "City": { + "x-cipp-field-source": "backend" + }, + "Company": { + "x-cipp-field-source": "backend,frontend" + }, + "Department": { + "type": "string", + "x-cipp-field-source": "graph,backend" + }, + "DisplayName": { + "type": "string", + "x-cipp-field-source": "graph,backend,frontend" + }, + "FirstName": { + "x-cipp-field-source": "backend" + }, + "Guid": { + "x-cipp-field-source": "backend" + }, + "IsDirSynced": { + "x-cipp-field-source": "backend,frontend" + }, + "LastName": { + "x-cipp-field-source": "backend" + }, + "WindowsEmailAddress": { + "x-cipp-field-source": "backend,frontend" + } + } } } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -44207,25 +50795,25 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.SuperAdmin.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "Exchange.Contact.Read" } }, - "/api/ListCommunityRepos": { + "/api/ListContactTemplates": { "get": { - "summary": "List community repositories in Table Storage", - "operationId": "ListCommunityRepos", + "summary": "ListContactTemplates", + "operationId": "ListContactTemplates", "tags": [ - "Tools > GitHub" + "Email-Exchange > Administration > Contacts" ], - "description": "This function lists community repositories in Table Storage", + "description": "Lists saved mail contact templates used for creating new Exchange contacts.", "parameters": [ { - "name": "WriteAccess", + "name": "ID", "in": "query", + "description": "Check if a specific template ID is requested", "required": false, "schema": { - "type": "boolean" + "type": "string" } } ], @@ -44238,37 +50826,38 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "BuiltIn": { - "x-cipp-field-source": "storage,backend" + "companyName": { + "x-cipp-field-source": "frontend" }, - "DefaultBranch": { - "type": "string", - "x-cipp-field-source": "storage,backend" + "ContentHash": { + "x-cipp-field-source": "storage" }, - "Description": { - "type": "string", - "x-cipp-field-source": "storage,backend" + "displayName": { + "x-cipp-field-source": "frontend" + }, + "email": { + "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, - "FullName": { - "type": "string", - "x-cipp-field-source": "storage,backend" + "GUID": { + "x-cipp-field-source": "storage,frontend" }, - "Id": { - "x-cipp-field-source": "backend" + "hidefromGAL": { + "x-cipp-field-source": "frontend" }, - "Name": { - "type": "string", - "x-cipp-field-source": "storage,backend" + "jobTitle": { + "x-cipp-field-source": "frontend" }, - "Owner": { - "type": "string", - "x-cipp-field-source": "storage,backend" + "JSON": { + "x-cipp-field-source": "storage" + }, + "Package": { + "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" @@ -44277,35 +50866,28 @@ "type": "string", "x-cipp-field-source": "storage" }, - "RepoPermissions": { - "x-cipp-field-source": "backend" - }, "RowKey": { - "type": "string", "x-cipp-field-source": "storage" }, - "TemplateTypes": { + "SHA": { "type": "string", - "x-cipp-field-source": "storage,backend" + "x-cipp-field-source": "storage" }, - "Timestamp": { - "type": "string", + "Source": { "x-cipp-field-source": "storage" }, - "UploadBranch": { - "x-cipp-field-source": "storage,backend" + "SourcePath": { + "x-cipp-field-source": "storage" }, - "URL": { - "type": "string", - "x-cipp-field-source": "storage,backend" + "TemplateName": { + "x-cipp-field-source": "storage" }, - "Visibility": { + "Timestamp": { "type": "string", - "x-cipp-field-source": "storage,backend" + "x-cipp-field-source": "storage" }, - "WriteAccess": { - "type": "boolean", - "x-cipp-field-source": "storage,backend" + "UpdatedBy": { + "x-cipp-field-source": "storage" } } } @@ -44318,6 +50900,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "404": { + "description": "Not found" } }, "security": [ @@ -44325,21 +50910,76 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.TemplateLibrary.Read", + "x-cipp-role": "Exchange.Contact.Read", "x-cipp-any-tenant": true } }, - "/api/ListCommunityRepoTemplates": { + "/api/ListContainerLogs": { "get": { - "summary": "List templates available in community repositories", - "operationId": "ListCommunityRepoTemplates", + "summary": "ListContainerLogs", + "operationId": "ListContainerLogs", "tags": [ - "Tools > GitHub" + "CIPP > Settings" ], - "description": "Builds a catalog of templates across community repositories using a single git tree call\nper repository. Joins against the templates table to flag imported templates and available\nupdates. When a Path is supplied, returns the contents of that single file instead (preview).", + "description": "Retrieves container logs for the CIPP backend process. Requires SuperAdmin access. Supports ReadLog, ListFiles, and snapshot actions.", "parameters": [ { - "name": "Branch", + "name": "Action", + "in": "query", + "required": false, + "schema": { + "type": "string", + "enum": [ + "GetInfo", + "ListFiles", + "Query", + "ReadLog", + "SearchAll" + ] + } + }, + { + "name": "Exclude", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "File", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "From", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "Level", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "Query", + "in": "query", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "Regex", "in": "query", "required": false, "schema": { @@ -44347,7 +50987,7 @@ } }, { - "name": "FullName", + "name": "Search", "in": "query", "required": false, "schema": { @@ -44355,9 +50995,24 @@ } }, { - "name": "Path", + "name": "SortDesc", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "Tail", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "To", "in": "query", - "description": "Preview mode: return the contents of a single file", "required": false, "schema": { "type": "string" @@ -44379,11 +51034,17 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -44391,30 +51052,21 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.TemplateLibrary.Read", + "x-cipp-role": "CIPP.SuperAdmin.Read", "x-cipp-any-tenant": true } }, - "/api/ListCompliancePolicies": { + "/api/ListCopilotSettings": { "get": { - "summary": "ListCompliancePolicies", - "operationId": "ListCompliancePolicies", + "summary": "ListCopilotSettings", + "operationId": "ListCopilotSettings", "tags": [ - "Endpoint > MEM" + "Tenant > AI" ], - "description": "Lists Intune device compliance policies for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", + "description": "Lists the Microsoft 365 Copilot admin policy settings for a tenant, one row per setting,\nwith the current raw value and a friendly state (Enabled / Disabled / Not configured).", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" - }, - { - "name": "UseReportDB", - "in": "query", - "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", - "required": false, - "schema": { - "type": "boolean" - } } ], "responses": { @@ -44426,25 +51078,19 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { - "description": { - "x-cipp-field-source": "frontend" - }, - "displayName": { - "x-cipp-field-source": "frontend" - }, - "lastModifiedDateTime": { - "x-cipp-field-source": "frontend" + "setting": { + "x-cipp-field-source": "backend,frontend" }, - "PolicyAssignment": { - "x-cipp-field-source": "frontend" + "settingId": { + "x-cipp-field-source": "backend" }, - "PolicyExclude": { - "x-cipp-field-source": "frontend" + "state": { + "x-cipp-field-source": "backend,frontend" }, - "PolicyTypeName": { - "x-cipp-field-source": "frontend" + "value": { + "x-cipp-field-source": "backend" } } } @@ -44457,9 +51103,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -44467,46 +51110,37 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.MEM.Read" + "x-cipp-role": "Tenant.AI.Read" } }, - "/api/ListConditionalAccessPolicies": { + "/api/ListCopilotUsage": { "get": { - "summary": "ListConditionalAccessPolicies", - "operationId": "ListConditionalAccessPolicies", + "summary": "ListCopilotUsage", + "operationId": "ListCopilotUsage", "tags": [ - "Tenant > Conditional" + "Tenant > AI" ], - "description": "Lists Conditional Access policies for a tenant with resolved display names for users, groups, applications, and locations. When manualPagination is set on an AllTenants read, one page is returned per request with a continuation token in Metadata.nextLink.", + "description": "Returns Microsoft 365 Copilot usage reports for a tenant, flattened into table rows.\nType=Adoption -> getMicrosoft365CopilotUserCountSummary (per-product enabled vs active users)\nType=Trend -> getMicrosoft365CopilotUserCountTrend (per-date active/enabled users)\nType=UserDetail-> getMicrosoft365CopilotUsageUserDetail (per-user last activity per app)", "parameters": [ { - "name": "manualPagination", + "name": "period", "in": "query", - "description": "Return one page per request with a continuation token in Metadata.nextLink; AllTenants reads only.", + "description": "Prefer D30 (Copilot reports v1). Some tenants are already on v2, which rejects D30 (as RL30) and wants D28 (RL28) instead. Get-CopilotReportPeriod falls back on that Graph error.", "required": false, "schema": { "type": "string" } }, { - "name": "nextLink", - "in": "query", - "description": "Continuation token from the previous page's Metadata.nextLink; opaque to callers.", - "required": false, - "schema": { - "type": "string" - } + "$ref": "#/components/parameters/tenantFilter" }, { - "name": "PageSize", + "name": "Type", "in": "query", "required": false, "schema": { - "type": "integer" + "type": "string" } - }, - { - "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -44518,84 +51152,82 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "builtInControls": { - "x-cipp-field-source": "frontend" + "activeUsers": { + "x-cipp-field-source": "backend" }, - "clientAppTypes": { - "x-cipp-field-source": "frontend" + "anyAppActive": { + "x-cipp-field-source": "backend" }, - "displayName": { - "x-cipp-field-source": "frontend" + "anyAppEnabled": { + "x-cipp-field-source": "backend" }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" + "copilotChat": { + "x-cipp-field-source": "backend" }, - "excludeApplications": { - "x-cipp-field-source": "frontend" + "copilotChatActive": { + "x-cipp-field-source": "backend" }, - "excludeGroups": { - "x-cipp-field-source": "frontend" + "displayName": { + "x-cipp-field-source": "backend" }, - "excludeLocations": { - "x-cipp-field-source": "frontend" + "enabledUsers": { + "x-cipp-field-source": "backend" }, - "excludePlatforms": { - "x-cipp-field-source": "frontend" + "excel": { + "x-cipp-field-source": "backend" }, - "excludeUsers": { - "x-cipp-field-source": "frontend" + "excelActive": { + "x-cipp-field-source": "backend" }, - "grantControlsOperator": { - "x-cipp-field-source": "frontend" + "lastActivityDate": { + "x-cipp-field-source": "backend" }, - "includeApplications": { - "x-cipp-field-source": "frontend" + "loop": { + "x-cipp-field-source": "backend" }, - "includeGroups": { - "x-cipp-field-source": "frontend" + "loopActive": { + "x-cipp-field-source": "backend" }, - "includeLocations": { - "x-cipp-field-source": "frontend" + "oneNote": { + "x-cipp-field-source": "backend" }, - "includePlatforms": { - "x-cipp-field-source": "frontend" + "oneNoteActive": { + "x-cipp-field-source": "backend" }, - "includeUsers": { - "x-cipp-field-source": "frontend" + "outlook": { + "x-cipp-field-source": "backend" }, - "Metadata": { + "outlookActive": { "x-cipp-field-source": "backend" }, - "modifiedDateTime": { - "x-cipp-field-source": "frontend" + "powerPoint": { + "x-cipp-field-source": "backend" }, - "PartitionKey": { - "x-cipp-field-source": "storage" + "powerPointActive": { + "x-cipp-field-source": "backend" }, - "Policy": { - "type": "string", - "x-cipp-field-source": "storage" + "product": { + "x-cipp-field-source": "backend" }, - "Results": { + "reportDate": { "x-cipp-field-source": "backend" }, - "RowKey": { - "type": "string", - "x-cipp-field-source": "storage" + "teams": { + "x-cipp-field-source": "backend" }, - "state": { - "x-cipp-field-source": "frontend" + "teamsActive": { + "x-cipp-field-source": "backend" }, - "Tenant": { - "type": "string", - "x-cipp-field-source": "storage,frontend" + "userPrincipalName": { + "x-cipp-field-source": "backend" }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" + "word": { + "x-cipp-field-source": "backend" + }, + "wordActive": { + "x-cipp-field-source": "backend" } } } @@ -44615,34 +51247,64 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.ConditionalAccess.Read" + "x-cipp-role": "Tenant.AI.Read" } }, - "/api/ListConditionalAccessPolicyChanges": { + "/api/ListCrossTenantHealth": { "get": { - "summary": "ListConditionalAccessPolicyChanges", - "operationId": "ListConditionalAccessPolicyChanges", + "summary": "ListCrossTenantHealth", + "operationId": "ListCrossTenantHealth", "tags": [ - "Tenant > Conditional" + "Tenant > CrossTenant" ], - "description": "Lists audit log entries showing changes to a specific Conditional Access policy, including before/after values.", "parameters": [ { - "name": "displayName", - "in": "query", - "required": false, - "schema": { - "type": "string" + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Results": { + "x-cipp-field-source": "backend" + } + } + } + } + } } }, - { - "name": "id", - "in": "query", - "required": false, - "schema": { - "type": "string" - } + "401": { + "description": "Unauthorized - invalid or missing bearer token" }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.CrossTenant.Read" + } + }, + "/api/ListCrossTenantPartners": { + "get": { + "summary": "ListCrossTenantPartners", + "operationId": "ListCrossTenantPartners", + "tags": [ + "Tenant > CrossTenant" + ], + "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } @@ -44656,54 +51318,61 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { - "activityDateTime": { - "type": "string", + "appServiceConnectInbound": { + "type": "object", "x-cipp-field-source": "graph-entity" }, - "activityDisplayName": { - "type": "string", + "automaticUserConsentSettings": { + "type": "object", "x-cipp-field-source": "graph-entity" }, - "additionalDetails": { - "type": "array", + "b2bCollaborationInbound": { + "type": "object", "x-cipp-field-source": "graph-entity" }, - "category": { - "type": "string", + "b2bCollaborationOutbound": { + "type": "object", "x-cipp-field-source": "graph-entity" }, - "correlationId": { - "type": "string", + "b2bDirectConnectInbound": { + "type": "object", "x-cipp-field-source": "graph-entity" }, - "id": { - "type": "string", + "b2bDirectConnectOutbound": { + "type": "object", "x-cipp-field-source": "graph-entity" }, - "initiatedBy": { + "inboundTrust": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "loggedByService": { - "type": "string", + "isInMultiTenantOrganization": { + "type": "boolean", "x-cipp-field-source": "graph-entity" }, - "operationType": { - "type": "string", + "isServiceProvider": { + "type": "boolean", "x-cipp-field-source": "graph-entity" }, - "result": { + "m365CollaborationInbound": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "resultReason": { + "m365CollaborationOutbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "tenantId": { "type": "string", "x-cipp-field-source": "graph-entity" }, - "targetResources": { - "type": "array", + "tenantRestrictions": { + "type": "object", "x-cipp-field-source": "graph-entity" } } @@ -44712,9 +51381,6 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -44727,17 +51393,16 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.ConditionalAccess.Read" + "x-cipp-role": "Tenant.CrossTenant.Read" } }, - "/api/ListConnectionFilter": { + "/api/ListCrossTenantPolicy": { "get": { - "summary": "ListConnectionFilter", - "operationId": "ListConnectionFilter", + "summary": "ListCrossTenantPolicy", + "operationId": "ListCrossTenantPolicy", "tags": [ - "Email-Exchange > Spamfilter" + "Tenant > CrossTenant" ], - "description": "Lists hosted connection filter policies (IP allow/block lists) in Exchange Online Protection.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" @@ -44752,22 +51417,62 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { - "EnableSafeList": { - "x-cipp-field-source": "frontend" + "appServiceConnectInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "IPAllowList": { - "x-cipp-field-source": "frontend" + "automaticUserConsentSettings": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "IPBlockList": { - "x-cipp-field-source": "frontend" + "b2bCollaborationInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "IsDefault": { - "x-cipp-field-source": "frontend" + "b2bCollaborationOutbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "Name": { - "x-cipp-field-source": "frontend" + "b2bDirectConnectInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "b2bDirectConnectOutbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "inboundTrust": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "invitationRedemptionIdentityProviderConfiguration": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "isServiceDefault": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "m365CollaborationInbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "m365CollaborationOutbound": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "tenantRestrictions": { + "type": "object", + "x-cipp-field-source": "graph-entity" } } } @@ -44787,26 +51492,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.ConnectionFilter.Read" + "x-cipp-role": "Tenant.CrossTenant.Read" } }, - "/api/ListConnectionFilterTemplates": { + "/api/ListCrossTenantTemplates": { "get": { - "summary": "ListConnectionFilterTemplates", - "operationId": "ListConnectionFilterTemplates", + "summary": "ListCrossTenantTemplates", + "operationId": "ListCrossTenantTemplates", "tags": [ - "Email-Exchange > Spamfilter" - ], - "description": "Lists saved connection filter policy templates for Exchange Online Protection.", - "parameters": [ - { - "name": "ID", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - } + "Tenant > CrossTenant" ], "responses": { "200": { @@ -44817,36 +51511,21 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, - "EnableSafeList": { - "x-cipp-field-source": "frontend" - }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { - "x-cipp-field-source": "storage,frontend" - }, - "IPAllowList": { - "x-cipp-field-source": "frontend" - }, - "IPBlockList": { - "x-cipp-field-source": "frontend" - }, - "IsDefault": { - "x-cipp-field-source": "frontend" + "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, - "name": { - "x-cipp-field-source": "frontend" - }, "Package": { "x-cipp-field-source": "storage" }, @@ -44857,6 +51536,9 @@ "type": "string", "x-cipp-field-source": "storage" }, + "Results": { + "x-cipp-field-source": "backend" + }, "RowKey": { "x-cipp-field-source": "storage" }, @@ -44877,8 +51559,116 @@ "type": "string", "x-cipp-field-source": "storage" }, - "UpdatedBy": { - "x-cipp-field-source": "storage" + "UpdatedBy": { + "x-cipp-field-source": "storage" + } + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.CrossTenant.Read" + } + }, + "/api/ListCSPLicenses": { + "get": { + "summary": "ListCSPLicenses", + "operationId": "ListCSPLicenses", + "tags": [ + "Tenant > Reports" + ], + "description": "Lists CSP (Cloud Solution Provider) license subscriptions for a tenant via the Sherweb integration.", + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.Directory.Read" + } + }, + "/api/ListCSPsku": { + "get": { + "summary": "ListCSPsku", + "operationId": "ListCSPsku", + "tags": [ + "Tenant > Reports" + ], + "description": "Lists available CSP SKUs and current subscriptions for a tenant via the Sherweb integration.", + "parameters": [ + { + "name": "currentSkuOnly", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "name": { + "x-cipp-field-source": "backend" + }, + "sku": { + "x-cipp-field-source": "backend" } } } @@ -44891,6 +51681,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -44898,29 +51691,36 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.ConnectionFilter.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "Tenant.Directory.Read" } }, - "/api/ListContactPermissions": { + "/api/ListCustomDataMappings": { "get": { - "summary": "ListContactPermissions", - "operationId": "ListContactPermissions", + "summary": "ListCustomDataMappings", + "operationId": "ListCustomDataMappings", "tags": [ - "Email-Exchange > Administration" + "CIPP > Core" ], - "description": "Lists folder-level permissions on a user's Contacts folder in Exchange Online.", + "description": "Lists custom data mappings that define how external data sources map to CIPP directory objects, filterable by source type, directory object, and tenant.", "parameters": [ { - "$ref": "#/components/parameters/tenantFilter" + "name": "directoryObject", + "in": "query", + "required": false, + "schema": { + "type": "string" + } }, { - "name": "UserID", + "name": "sourceType", "in": "query", "required": false, "schema": { "type": "string" } + }, + { + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -44932,25 +51732,50 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "AccessRights": { + "customDataAttribute": { "x-cipp-field-source": "backend" }, - "FolderName": { + "dataset": { "x-cipp-field-source": "backend" }, - "Identity": { + "directoryObject": { "x-cipp-field-source": "backend" }, - "MailboxInfo": { + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "id": { "x-cipp-field-source": "backend" }, - "User": { + "JSON": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "manualEntryFieldLabel": { "x-cipp-field-source": "backend" }, - "UserId": { + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "RowKey": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "sourceType": { + "x-cipp-field-source": "backend" + }, + "syncProperty": { + "x-cipp-field-source": "backend" + }, + "tenant": { "x-cipp-field-source": "backend" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" } } } @@ -44970,29 +51795,15 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Mailbox.Read" + "x-cipp-role": "CIPP.Core.Read" } }, - "/api/ListContacts": { + "/api/ListCustomRole": { "get": { - "summary": "ListContacts", - "operationId": "ListContacts", + "summary": "ListCustomRole", + "operationId": "ListCustomRole", "tags": [ - "Email-Exchange > Administration > Contacts" - ], - "description": "Lists Exchange Online mail contacts for a tenant, with optional filtering by contact ID for detailed view.", - "parameters": [ - { - "name": "id", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "$ref": "#/components/parameters/tenantFilter" - } + "CIPP > Settings" ], "responses": { "200": { @@ -45003,54 +51814,17 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", - "properties": { - "City": { - "x-cipp-field-source": "backend" - }, - "Company": { - "x-cipp-field-source": "backend,frontend" - }, - "Department": { - "type": "string", - "x-cipp-field-source": "graph,backend" - }, - "DisplayName": { - "type": "string", - "x-cipp-field-source": "graph,backend,frontend" - }, - "FirstName": { - "x-cipp-field-source": "backend" - }, - "Guid": { - "x-cipp-field-source": "backend" - }, - "IsDirSynced": { - "x-cipp-field-source": "backend,frontend" - }, - "LastName": { - "x-cipp-field-source": "backend" - }, - "WindowsEmailAddress": { - "x-cipp-field-source": "backend,frontend" - } - } + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -45058,22 +51832,29 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Contact.Read" + "x-cipp-role": "CIPP.Core.Read" } }, - "/api/ListContactTemplates": { + "/api/ListCustomScripts": { "get": { - "summary": "ListContactTemplates", - "operationId": "ListContactTemplates", + "summary": "ListCustomScripts", + "operationId": "ListCustomScripts", "tags": [ - "Email-Exchange > Administration > Contacts" + "Tools > Custom-Scripts" ], - "description": "Lists saved mail contact templates used for creating new Exchange contacts.", + "description": "Lists custom PowerShell scripts stored in CIPP, with optional filtering by script GUID and version history.", "parameters": [ { - "name": "ID", + "name": "IncludeAllVersions", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "ScriptGuid", "in": "query", - "description": "Check if a specific template ID is requested", "required": false, "schema": { "type": "string" @@ -45089,67 +51870,77 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "companyName": { - "x-cipp-field-source": "frontend" + "AlertOnFailure": { + "x-cipp-field-source": "storage" }, - "ContentHash": { + "AlertStatuses": { "x-cipp-field-source": "storage" }, - "displayName": { - "x-cipp-field-source": "frontend" + "Category": { + "x-cipp-field-source": "storage" }, - "email": { - "x-cipp-field-source": "frontend" + "CreatedBy": { + "x-cipp-field-source": "storage" + }, + "CreatedDate": { + "x-cipp-field-source": "storage" + }, + "Description": { + "x-cipp-field-source": "storage" + }, + "Enabled": { + "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, - "GUID": { - "x-cipp-field-source": "storage,frontend" + "ImplementationEffort": { + "x-cipp-field-source": "storage" }, - "hidefromGAL": { - "x-cipp-field-source": "frontend" + "MarkdownTemplate": { + "x-cipp-field-source": "storage" }, - "jobTitle": { - "x-cipp-field-source": "frontend" + "PartitionKey": { + "x-cipp-field-source": "storage" }, - "JSON": { + "Pillar": { "x-cipp-field-source": "storage" }, - "Package": { + "ResultMode": { "x-cipp-field-source": "storage" }, - "PartitionKey": { + "ResultSchema": { "x-cipp-field-source": "storage" }, - "Permissions": { - "type": "string", + "ReturnType": { "x-cipp-field-source": "storage" }, - "RowKey": { + "Risk": { "x-cipp-field-source": "storage" }, - "SHA": { - "type": "string", + "RowKey": { "x-cipp-field-source": "storage" }, - "Source": { + "ScriptContent": { "x-cipp-field-source": "storage" }, - "SourcePath": { + "ScriptGuid": { "x-cipp-field-source": "storage" }, - "TemplateName": { + "ScriptName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, - "UpdatedBy": { + "UserImpact": { + "x-cipp-field-source": "storage" + }, + "Version": { "x-cipp-field-source": "storage" } } @@ -45158,14 +51949,14 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "404": { - "description": "Not found" } }, "security": [ @@ -45173,161 +51964,45 @@ "bearerAuth": [] } ], - "x-cipp-role": "Exchange.Contact.Read", + "x-cipp-role": "CIPP.Tests.Read", "x-cipp-any-tenant": true } }, - "/api/ListContainerLogs": { + "/api/ListCustomVariables": { "get": { - "summary": "ListContainerLogs", - "operationId": "ListContainerLogs", + "summary": "ListCustomVariables", + "operationId": "ListCustomVariables", "tags": [ "CIPP > Settings" ], - "description": "Retrieves container logs for the CIPP backend process. Requires SuperAdmin access. Supports ReadLog, ListFiles, and snapshot actions.", + "description": "Lists custom variables configured in CIPP for use in templates and automation.", "parameters": [ { - "name": "Action", - "in": "query", - "required": false, - "schema": { - "type": "string", - "enum": [ - "GetInfo", - "ListFiles", - "Query", - "ReadLog", - "SearchAll" - ] - } - }, - { - "name": "Exclude", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "File", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "From", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "Level", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "Query", - "in": "query", - "required": true, - "schema": { - "type": "string" - } - }, - { - "name": "Regex", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "Search", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "SortDesc", + "name": "allTenants", "in": "query", + "description": "A template is not bound to a tenant - the same template deploys to many, and each variable in it resolves against whichever tenant it lands on. So a caller editing one needs every variable *name* that exists anywhere, not the set belonging to whichever tenant happens to be selected. Values are deliberately not returned here: they differ per tenant, so there is no single correct one to show.", "required": false, "schema": { - "type": "string" + "type": "boolean" } }, { - "name": "Tail", + "name": "excludeGlobalReserved", "in": "query", + "description": "Filter out global reserved variables if requested (for tenant group rules) These variables are the same for all tenants so they're not useful for grouping", "required": false, "schema": { - "type": "string" + "type": "boolean" } }, { - "name": "To", + "name": "includeSystem", "in": "query", "required": false, "schema": { - "type": "string" - } - } - ], - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "type": "array", - "items": { - "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." - } - } - } + "type": "boolean" } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" - }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" - } - }, - "security": [ - { - "bearerAuth": [] - } - ], - "x-cipp-role": "CIPP.SuperAdmin.Read", - "x-cipp-any-tenant": true - } - }, - "/api/ListCopilotSettings": { - "get": { - "summary": "ListCopilotSettings", - "operationId": "ListCopilotSettings", - "tags": [ - "Tenant > AI" - ], - "description": "Lists the Microsoft 365 Copilot admin policy settings for a tenant, one row per setting,\nwith the current raw value and a friendly state (Enabled / Disabled / Not configured).", - "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } @@ -45341,19 +52016,30 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "setting": { - "x-cipp-field-source": "backend,frontend" + "Description": { + "x-cipp-field-source": "storage" }, - "settingId": { - "x-cipp-field-source": "backend" + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" }, - "state": { - "x-cipp-field-source": "backend,frontend" + "PartitionKey": { + "x-cipp-field-source": "storage" }, - "value": { - "x-cipp-field-source": "backend" + "RowKey": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Value": { + "x-cipp-field-source": "storage" + }, + "VariableType": { + "x-cipp-field-source": "storage" } } } @@ -45366,6 +52052,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -45373,36 +52062,34 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.AI.Read" + "x-cipp-role": "CIPP.Core.Read" } }, - "/api/ListCopilotUsage": { + "/api/ListCVEManagement": { "get": { - "summary": "ListCopilotUsage", - "operationId": "ListCopilotUsage", + "summary": "ListCVEManagement", + "operationId": "ListCVEManagement", "tags": [ - "Tenant > AI" + "Endpoint > MEM" ], - "description": "Returns Microsoft 365 Copilot usage reports for a tenant, flattened into table rows.\nType=Adoption -> getMicrosoft365CopilotUserCountSummary (per-product enabled vs active users)\nType=Trend -> getMicrosoft365CopilotUserCountTrend (per-date active/enabled users)\nType=UserDetail-> getMicrosoft365CopilotUsageUserDetail (per-user last activity per app)", + "description": "Lists CVEs affecting a tenant's devices, from Defender threat and vulnerability management, along with any exceptions recorded in CIPP. AllTenants and UseReportDB=true read the cached report database instead of Defender directly, because the live path can only query one tenant per request.", "parameters": [ { - "name": "period", + "name": "tenantFilter", "in": "query", - "description": "Prefer D30 (Copilot reports v1). Some tenants are already on v2, which rejects D30 (as RL30) and wants D28 (RL28) instead. Get-CopilotReportPeriod falls back on that Graph error.", + "description": "Interact with query parameters or the body of the request.", "required": false, "schema": { "type": "string" } }, { - "$ref": "#/components/parameters/tenantFilter" - }, - { - "name": "Type", + "name": "UseReportDB", "in": "query", + "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { - "type": "string" + "type": "boolean" } } ], @@ -45415,84 +52102,7 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", - "properties": { - "activeUsers": { - "x-cipp-field-source": "backend" - }, - "anyAppActive": { - "x-cipp-field-source": "backend" - }, - "anyAppEnabled": { - "x-cipp-field-source": "backend" - }, - "copilotChat": { - "x-cipp-field-source": "backend" - }, - "copilotChatActive": { - "x-cipp-field-source": "backend" - }, - "displayName": { - "x-cipp-field-source": "backend" - }, - "enabledUsers": { - "x-cipp-field-source": "backend" - }, - "excel": { - "x-cipp-field-source": "backend" - }, - "excelActive": { - "x-cipp-field-source": "backend" - }, - "lastActivityDate": { - "x-cipp-field-source": "backend" - }, - "loop": { - "x-cipp-field-source": "backend" - }, - "loopActive": { - "x-cipp-field-source": "backend" - }, - "oneNote": { - "x-cipp-field-source": "backend" - }, - "oneNoteActive": { - "x-cipp-field-source": "backend" - }, - "outlook": { - "x-cipp-field-source": "backend" - }, - "outlookActive": { - "x-cipp-field-source": "backend" - }, - "powerPoint": { - "x-cipp-field-source": "backend" - }, - "powerPointActive": { - "x-cipp-field-source": "backend" - }, - "product": { - "x-cipp-field-source": "backend" - }, - "reportDate": { - "x-cipp-field-source": "backend" - }, - "teams": { - "x-cipp-field-source": "backend" - }, - "teamsActive": { - "x-cipp-field-source": "backend" - }, - "userPrincipalName": { - "x-cipp-field-source": "backend" - }, - "word": { - "x-cipp-field-source": "backend" - }, - "wordActive": { - "x-cipp-field-source": "backend" - } - } + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } @@ -45503,6 +52113,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -45510,20 +52123,87 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.AI.Read" + "x-cipp-role": "Endpoint.Security.Read", + "x-cipp-any-tenant": true } }, - "/api/ListCSPLicenses": { + "/api/ListDBCache": { "get": { - "summary": "ListCSPLicenses", - "operationId": "ListCSPLicenses", + "summary": "ListDBCache", + "operationId": "ListDBCache", "tags": [ - "Tenant > Reports" + "CIPP > Core" ], - "description": "Lists CSP (Cloud Solution Provider) license subscriptions for a tenant via the Sherweb integration.", + "description": "Retrieves cached tenant data from the CIPP reporting database (CippReportingDB). This is the fastest\nand most efficient way to query tenant data across single or multiple tenants. The database is populated\nnightly by background cache jobs, so data is typically at most 24 hours old.\n\nRequired query parameters:\n - tenantFilter: The tenant domain or 'AllTenants' to query all managed tenants.\n\nOptional query parameters:\n - type: The cache collection to retrieve (e.g. Users, Groups, Mailboxes, Devices, etc.).\n Omit it (or pass type=_availableTypes) to get the list of collections for the tenant\n instead of records; it is also not needed when countsOnly=true.\n - countsOnly: When 'true', returns one row per tenant per collection containing only the record\n count and the time that collection was last cached. This reads the pre-computed\n '-Count' rows, so it is a single table query regardless of tenant count and\n never materializes the underlying records. Combine with tenantFilter=AllTenants to\n get an estate-wide inventory and per-tenant cache freshness in one call. Pass a\n type alongside it to restrict the result to a single collection.\n - select: Comma-separated list of top-level fields to keep on each record (e.g.\n select=id,displayName,userPrincipalName). Everything else is dropped during parse,\n shrinking the response. A kept field keeps its ENTIRE subtree, so select=conditions\n keeps conditions.users.includeRoles too; projection never reaches inside a kept\n value. The owning Tenant is always stamped on each record regardless of select.\n - top: Return at most this many records. For tenantFilter=AllTenants this is a GLOBAL cap\n across all tenants when ungrouped, so use it to sample rather than to page. When\n groupBy=Tenant is also set, top instead caps the records within each tenant bucket.\n - latestOnly: When 'true', keep only the newest record per tenant, ranked by dateField (or\n an auto-detected date field such as createdDateTime). Collapses per-day\n snapshot types like SecureScore to one current row per tenant.\n - groupBy: Set to 'Tenant' to return one bucket per tenant as\n { Tenant, Count, Records } objects instead of a flat record list.\n - dateField: The record field latestOnly ranks by. Omit to auto-detect.\n\nUse type=_shape for every collection's row count and fields (recorded when the cache was written).\nUse type=_availableTypes to discover which cache collections exist for a given tenant. Omitting the\ntype parameter also returns the available types.\n\nPERFORMANCE GUIDANCE: For AllTenants queries or any bulk/cross-tenant data retrieval, prefer\nListDBCache over calling individual endpoints (e.g. ListUsers, ListGroups, ListMailboxes) directly.\nIndividual endpoints make live API calls per tenant which is significantly slower and may hit\nthrottling limits. ListDBCache reads pre-cached data from Azure Table Storage and returns results\nin seconds regardless of tenant count.\n\nNote that tenantFilter=AllTenants WITH a type performs a cross-partition scan and materializes every\nrecord of that collection across every tenant, so it grows with the size of the estate. Where only\ntotals are needed, countsOnly=true is dramatically cheaper and should always be preferred.\n\nRecommended workflow for MCP tool selection:\n 1. Call ListDBCache with type=_availableTypes to discover available cache collections.\n 2. If the data you need exists as a cache type, use ListDBCache with that type.\n 3. Only fall back to individual List* endpoints when you need real-time data for a single tenant\n or when the data is not available in the cache.\n\nCommon cache types include: Users, Groups, Mailboxes, Devices, ConditionalAccess, Applications,\nIntunePolicy, CompliancePolicy, and many more. The exact set depends on what has been configured.", "parameters": [ { - "$ref": "#/components/parameters/tenantFilter" + "name": "countsOnly", + "in": "query", + "required": false, + "schema": { + "type": "boolean" + } + }, + { + "name": "dateField", + "in": "query", + "description": "The record date field latestOnly ranks by. Omit to auto-detect (createdDateTime, lastRefresh, etc).", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "groupBy", + "in": "query", + "description": "Group the result into one bucket per tenant. Only 'Tenant' is supported.", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "latestOnly", + "in": "query", + "description": "When true, keep only the newest record per tenant (by dateField, or an auto-detected date field). Collapses e.g. SecureScore's per-day snapshots to one current row per tenant.", + "required": false, + "schema": { + "type": "boolean" + } + }, + { + "name": "select", + "in": "query", + "description": "Comma-separated list of top-level fields to keep on each record; everything else is dropped during parse. A kept field keeps its ENTIRE subtree (e.g. select=conditions keeps conditions.users.includeRoles). The Tenant stamp is always preserved. Omit to return all fields.", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "tenantFilter", + "in": "query", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "top", + "in": "query", + "description": "Return at most this many records. For AllTenants this is a global cap across all tenants, unless groupBy=Tenant is set, in which case it caps records within each tenant bucket.", + "required": false, + "schema": { + "type": "integer" + } + }, + { + "name": "type", + "in": "query", + "required": false, + "schema": { + "type": "string" + } } ], "responses": { @@ -45532,31 +52212,7 @@ "content": { "application/json": { "schema": { - "type": "array", - "items": { - "type": "object", - "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", - "properties": { - "commitmentTerm.renewalConfiguration.renewalDate": { - "x-cipp-field-source": "frontend" - }, - "productName": { - "x-cipp-field-source": "frontend" - }, - "purchaseDate": { - "x-cipp-field-source": "frontend" - }, - "quantity": { - "x-cipp-field-source": "frontend" - }, - "sku": { - "x-cipp-field-source": "frontend" - }, - "TermInfo": { - "x-cipp-field-source": "frontend" - } - } - } + "$ref": "#/components/schemas/StandardResults" } } } @@ -45576,20 +52232,21 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Directory.Read" + "x-cipp-role": "CIPP.Core.Read", + "x-cipp-any-tenant": true } }, - "/api/ListCSPsku": { + "/api/ListDefenderState": { "get": { - "summary": "ListCSPsku", - "operationId": "ListCSPsku", + "summary": "ListDefenderState", + "operationId": "ListDefenderState", "tags": [ - "Tenant > Reports" + "Endpoint > MEM" ], - "description": "Lists available CSP SKUs and current subscriptions for a tenant via the Sherweb integration.", + "description": "Lists Microsoft Defender antivirus state and detected threats for Intune-managed devices in a tenant.", "parameters": [ { - "name": "currentSkuOnly", + "name": "DeviceID", "in": "query", "required": false, "schema": { @@ -45609,13 +52266,370 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "description": "Derived from the Microsoft Graph entity it queries, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { - "name": { - "x-cipp-field-source": "backend" + "aadRegistered": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" }, - "sku": { - "x-cipp-field-source": "backend" + "activationLockBypassCode": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "androidSecurityPatchLevel": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "autopilotEnrolled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "azureActiveDirectoryDeviceId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "azureADDeviceId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "azureADRegistered": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "bootstrapTokenEscrowed": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "chassisType": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "chromeOSDeviceInfo": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "cloudPcRemoteActionResults": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "complianceGracePeriodExpirationDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "complianceState": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "configurationManagerClientEnabledFeatures": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "configurationManagerClientHealthState": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "configurationManagerClientInformation": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "deviceActionResults": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "deviceCategoryDisplayName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "deviceEnrollmentType": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "deviceFirmwareConfigurationInterfaceManaged": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "deviceHealthAttestationState": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "deviceName": { + "type": "string", + "x-cipp-field-source": "graph-entity,frontend" + }, + "deviceRegistrationState": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "deviceType": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "easActivated": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "easActivationDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "easDeviceId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "emailAddress": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "enrolledByUserPrincipalName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "enrolledDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "enrollmentProfileName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "ethernetMacAddress": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "exchangeAccessState": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "exchangeAccessStateReason": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "exchangeLastSuccessfulSyncDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "freeStorageSpaceInBytes": { + "type": "integer", + "x-cipp-field-source": "graph-entity" + }, + "hardwareInformation": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "iccid": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "imei": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "isEncrypted": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isSupervised": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "jailBroken": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "joinType": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "lastSyncDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "lostModeState": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "managedDeviceName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "managedDeviceOwnerType": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "managementAgent": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "managementCertificateExpirationDate": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "managementFeatures": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "managementState": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "manufacturer": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "meid": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "model": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "notes": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "operatingSystem": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "osVersion": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "ownerType": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "partnerReportedThreatState": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "phoneNumber": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "physicalMemoryInBytes": { + "type": "integer", + "x-cipp-field-source": "graph-entity" + }, + "preferMdmOverGroupPolicyAppliedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "processorArchitecture": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "remoteAssistanceSessionErrorDetails": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "remoteAssistanceSessionUrl": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "requireUserEnrollmentApproval": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "retireAfterDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "roleScopeTagIds": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "securityPatchLevel": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "serialNumber": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "skuFamily": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "skuNumber": { + "type": "integer", + "x-cipp-field-source": "graph-entity" + }, + "specificationVersion": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "subscriberCarrier": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "totalStorageSpaceInBytes": { + "type": "integer", + "x-cipp-field-source": "graph-entity" + }, + "udid": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "userDisplayName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "userId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "userPrincipalName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "usersLoggedOn": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "wiFiMacAddress": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "windowsActiveMalwareCount": { + "type": "integer", + "x-cipp-field-source": "graph-entity" + }, + "windowsProtectionState.deviceState": { + "x-cipp-field-source": "frontend" + }, + "windowsProtectionState.fullScanOverdue": { + "x-cipp-field-source": "frontend" + }, + "windowsProtectionState.lastReportedDateTime": { + "x-cipp-field-source": "frontend" + }, + "windowsProtectionState.malwareProtectionEnabled": { + "x-cipp-field-source": "frontend" + }, + "windowsProtectionState.networkInspectionSystemEnabled": { + "x-cipp-field-source": "frontend" + }, + "windowsProtectionState.quickScanOverdue": { + "x-cipp-field-source": "frontend" + }, + "windowsProtectionState.realTimeProtectionEnabled": { + "x-cipp-field-source": "frontend" + }, + "windowsProtectionState.rebootRequired": { + "x-cipp-field-source": "frontend" + }, + "windowsProtectionState.signatureUpdateOverdue": { + "x-cipp-field-source": "frontend" + }, + "windowsRemediatedMalwareCount": { + "type": "integer", + "x-cipp-field-source": "graph-entity" } } } @@ -45628,9 +52642,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -45638,34 +52649,18 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Directory.Read" + "x-cipp-role": "Endpoint.MEM.Read" } }, - "/api/ListCustomDataMappings": { + "/api/ListDefenderTVM": { "get": { - "summary": "ListCustomDataMappings", - "operationId": "ListCustomDataMappings", + "summary": "ListDefenderTVM", + "operationId": "ListDefenderTVM", "tags": [ - "CIPP > Core" + "Endpoint > MEM" ], - "description": "Lists custom data mappings that define how external data sources map to CIPP directory objects, filterable by source type, directory object, and tenant.", + "description": "Lists software vulnerabilities from Microsoft Defender Threat and Vulnerability Management (TVM), grouped by CVE ID.", "parameters": [ - { - "name": "directoryObject", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "sourceType", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, { "$ref": "#/components/parameters/tenantFilter" } @@ -45679,50 +52674,37 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { - "customDataAttribute": { - "x-cipp-field-source": "backend" - }, - "dataset": { - "x-cipp-field-source": "backend" - }, - "directoryObject": { - "x-cipp-field-source": "backend" - }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" + "affectedDevices": { + "x-cipp-field-source": "frontend" }, - "id": { - "x-cipp-field-source": "backend" + "affectedDevicesCount": { + "x-cipp-field-source": "frontend" }, - "JSON": { - "type": "string", - "x-cipp-field-source": "storage" + "cveId": { + "x-cipp-field-source": "frontend" }, - "manualEntryFieldLabel": { - "x-cipp-field-source": "backend" + "cvssScore": { + "x-cipp-field-source": "frontend" }, - "PartitionKey": { - "x-cipp-field-source": "storage" + "exploitabilityLevel": { + "x-cipp-field-source": "frontend" }, - "RowKey": { - "type": "string", - "x-cipp-field-source": "storage" + "osPlatform": { + "x-cipp-field-source": "frontend" }, - "sourceType": { - "x-cipp-field-source": "backend" + "securityUpdateAvailable": { + "x-cipp-field-source": "frontend" }, - "syncProperty": { - "x-cipp-field-source": "backend" + "softwareName": { + "x-cipp-field-source": "frontend" }, - "tenant": { - "x-cipp-field-source": "backend" + "softwareVendor": { + "x-cipp-field-source": "frontend" }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" + "vulnerabilitySeverityLevel": { + "x-cipp-field-source": "frontend" } } } @@ -45742,17 +52724,22 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.Read" + "x-cipp-role": "Endpoint.MEM.Read" } }, - "/api/ListCustomRole": { + "/api/ListDeletedItems": { "get": { - "summary": "ListCustomRole", - "operationId": "ListCustomRole", + "summary": "ListDeletedItems", + "operationId": "ListDeletedItems", "tags": [ - "CIPP > Settings" + "Identity > Administration > Users" + ], + "description": "Lists soft-deleted directory objects in Entra ID, including users, groups, applications, service principals, and administrative units.", + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } ], - "description": "Lists custom RBAC roles defined in CIPP, including their permission sets and associated access role groups.", "responses": { "200": { "description": "Success", @@ -45780,33 +52767,20 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.Read" + "x-cipp-role": "Tenant.Directory.Read" } }, - "/api/ListCustomScripts": { + "/api/ListDeletedSites": { "get": { - "summary": "ListCustomScripts", - "operationId": "ListCustomScripts", + "summary": "ListDeletedSites", + "operationId": "ListDeletedSites", "tags": [ - "Tools > Custom-Scripts" + "Teams-Sharepoint" ], - "description": "Lists custom PowerShell scripts stored in CIPP, with optional filtering by script GUID and version history.", + "description": "Lists deleted SharePoint sites still restorable from the tenant recycle bin, via the\nSharePoint admin CSOM API.", "parameters": [ { - "name": "IncludeAllVersions", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "ScriptGuid", - "in": "query", - "required": false, - "schema": { - "type": "string" - } + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -45815,84 +52789,7 @@ "content": { "application/json": { "schema": { - "type": "array", - "items": { - "type": "object", - "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", - "properties": { - "AlertOnFailure": { - "x-cipp-field-source": "storage" - }, - "AlertStatuses": { - "x-cipp-field-source": "storage" - }, - "Category": { - "x-cipp-field-source": "storage" - }, - "CreatedBy": { - "x-cipp-field-source": "storage" - }, - "CreatedDate": { - "x-cipp-field-source": "storage" - }, - "Description": { - "x-cipp-field-source": "storage" - }, - "Enabled": { - "x-cipp-field-source": "storage" - }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "ImplementationEffort": { - "x-cipp-field-source": "storage" - }, - "MarkdownTemplate": { - "x-cipp-field-source": "storage" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" - }, - "Pillar": { - "x-cipp-field-source": "storage" - }, - "ResultMode": { - "x-cipp-field-source": "storage" - }, - "ResultSchema": { - "x-cipp-field-source": "storage" - }, - "ReturnType": { - "x-cipp-field-source": "storage" - }, - "Risk": { - "x-cipp-field-source": "storage" - }, - "RowKey": { - "x-cipp-field-source": "storage" - }, - "ScriptContent": { - "x-cipp-field-source": "storage" - }, - "ScriptGuid": { - "x-cipp-field-source": "storage" - }, - "ScriptName": { - "x-cipp-field-source": "storage" - }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "UserImpact": { - "x-cipp-field-source": "storage" - }, - "Version": { - "x-cipp-field-source": "storage" - } - } - } + "$ref": "#/components/schemas/StandardResults" } } } @@ -45912,43 +52809,24 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Tests.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "Sharepoint.Site.Read" } }, - "/api/ListCustomVariables": { + "/api/ListDetectedAppDevices": { "get": { - "summary": "ListCustomVariables", - "operationId": "ListCustomVariables", + "summary": "ListDetectedAppDevices", + "operationId": "ListDetectedAppDevices", "tags": [ - "CIPP > Settings" + "Endpoint > Applications" ], - "description": "Lists custom variables configured in CIPP for use in templates and automation.", + "description": "Lists Intune-managed devices that have a specific detected application installed, identified by App ID.", "parameters": [ { - "name": "allTenants", - "in": "query", - "description": "A template is not bound to a tenant - the same template deploys to many, and each variable in it resolves against whichever tenant it lands on. So a caller editing one needs every variable *name* that exists anywhere, not the set belonging to whichever tenant happens to be selected. Values are deliberately not returned here: they differ per tenant, so there is no single correct one to show.", - "required": false, - "schema": { - "type": "boolean" - } - }, - { - "name": "excludeGlobalReserved", - "in": "query", - "description": "Filter out global reserved variables if requested (for tenant group rules) These variables are the same for all tenants so they're not useful for grouping", - "required": false, - "schema": { - "type": "boolean" - } - }, - { - "name": "includeSystem", + "name": "AppID", "in": "query", - "required": false, + "required": true, "schema": { - "type": "boolean" + "type": "string" } }, { @@ -45964,30 +52842,35 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { - "Description": { - "x-cipp-field-source": "storage" + "deviceCount": { + "type": "integer", + "x-cipp-field-source": "graph-entity" }, - "ETag": { + "displayName": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "PartitionKey": { - "x-cipp-field-source": "storage" + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "RowKey": { - "x-cipp-field-source": "storage" + "platform": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "Timestamp": { + "publisher": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "Value": { - "x-cipp-field-source": "storage" + "sizeInByte": { + "type": "integer", + "x-cipp-field-source": "graph-entity" }, - "VariableType": { - "x-cipp-field-source": "storage" + "version": { + "type": "string", + "x-cipp-field-source": "graph-entity" } } } @@ -46000,9 +52883,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -46010,35 +52890,37 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.Read" + "x-cipp-role": "Identity.Device.Read" } }, - "/api/ListCVEManagement": { + "/api/ListDetectedApps": { "get": { - "summary": "ListCVEManagement", - "operationId": "ListCVEManagement", + "summary": "ListDetectedApps", + "operationId": "ListDetectedApps", "tags": [ - "Endpoint > MEM" + "Endpoint > Applications" ], - "description": "Lists CVEs affecting a tenant's devices, from Defender threat and vulnerability management, along with any exceptions recorded in CIPP. AllTenants and UseReportDB=true read the cached report database instead of Defender directly, because the live path can only query one tenant per request.", + "description": "Lists applications detected on Intune-managed devices in a tenant, optionally including device associations.", "parameters": [ { - "name": "tenantFilter", + "name": "DeviceID", "in": "query", - "description": "Interact with query parameters or the body of the request.", "required": false, "schema": { "type": "string" } }, { - "name": "UseReportDB", + "name": "includeDevices", "in": "query", - "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", + "description": "Also return the devices each detected app is installed on.", "required": false, "schema": { "type": "boolean" } + }, + { + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -46061,9 +52943,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -46071,87 +52950,44 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.Security.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "Identity.Device.Read" } }, - "/api/ListDBCache": { + "/api/ListDeviceDetails": { "get": { - "summary": "ListDBCache", - "operationId": "ListDBCache", + "summary": "ListDeviceDetails", + "operationId": "ListDeviceDetails", "tags": [ - "CIPP > Core" + "Endpoint > MEM" ], - "description": "Retrieves cached tenant data from the CIPP reporting database (CippReportingDB). This is the fastest\nand most efficient way to query tenant data across single or multiple tenants. The database is populated\nnightly by background cache jobs, so data is typically at most 24 hours old.\n\nRequired query parameters:\n - tenantFilter: The tenant domain or 'AllTenants' to query all managed tenants.\n\nOptional query parameters:\n - type: The cache collection to retrieve (e.g. Users, Groups, Mailboxes, Devices, etc.).\n Omit it (or pass type=_availableTypes) to get the list of collections for the tenant\n instead of records; it is also not needed when countsOnly=true.\n - countsOnly: When 'true', returns one row per tenant per collection containing only the record\n count and the time that collection was last cached. This reads the pre-computed\n '-Count' rows, so it is a single table query regardless of tenant count and\n never materializes the underlying records. Combine with tenantFilter=AllTenants to\n get an estate-wide inventory and per-tenant cache freshness in one call. Pass a\n type alongside it to restrict the result to a single collection.\n - select: Comma-separated list of top-level fields to keep on each record (e.g.\n select=id,displayName,userPrincipalName). Everything else is dropped during parse,\n shrinking the response. A kept field keeps its ENTIRE subtree, so select=conditions\n keeps conditions.users.includeRoles too; projection never reaches inside a kept\n value. The owning Tenant is always stamped on each record regardless of select.\n - top: Return at most this many records. For tenantFilter=AllTenants this is a GLOBAL cap\n across all tenants when ungrouped, so use it to sample rather than to page. When\n groupBy=Tenant is also set, top instead caps the records within each tenant bucket.\n - latestOnly: When 'true', keep only the newest record per tenant, ranked by dateField (or\n an auto-detected date field such as createdDateTime). Collapses per-day\n snapshot types like SecureScore to one current row per tenant.\n - groupBy: Set to 'Tenant' to return one bucket per tenant as\n { Tenant, Count, Records } objects instead of a flat record list.\n - dateField: The record field latestOnly ranks by. Omit to auto-detect.\n\nUse type=_shape for every collection's row count and fields (recorded when the cache was written).\nUse type=_availableTypes to discover which cache collections exist for a given tenant. Omitting the\ntype parameter also returns the available types.\n\nPERFORMANCE GUIDANCE: For AllTenants queries or any bulk/cross-tenant data retrieval, prefer\nListDBCache over calling individual endpoints (e.g. ListUsers, ListGroups, ListMailboxes) directly.\nIndividual endpoints make live API calls per tenant which is significantly slower and may hit\nthrottling limits. ListDBCache reads pre-cached data from Azure Table Storage and returns results\nin seconds regardless of tenant count.\n\nNote that tenantFilter=AllTenants WITH a type performs a cross-partition scan and materializes every\nrecord of that collection across every tenant, so it grows with the size of the estate. Where only\ntotals are needed, countsOnly=true is dramatically cheaper and should always be preferred.\n\nRecommended workflow for MCP tool selection:\n 1. Call ListDBCache with type=_availableTypes to discover available cache collections.\n 2. If the data you need exists as a cache type, use ListDBCache with that type.\n 3. Only fall back to individual List* endpoints when you need real-time data for a single tenant\n or when the data is not available in the cache.\n\nCommon cache types include: Users, Groups, Mailboxes, Devices, ConditionalAccess, Applications,\nIntunePolicy, CompliancePolicy, and many more. The exact set depends on what has been configured.", + "description": "Retrieves detailed information about a specific Intune-managed device by ID, name, or serial number.", "parameters": [ { - "name": "countsOnly", - "in": "query", - "required": false, - "schema": { - "type": "boolean" - } - }, - { - "name": "dateField", + "name": "DeviceID", "in": "query", - "description": "The record date field latestOnly ranks by. Omit to auto-detect (createdDateTime, lastRefresh, etc).", "required": false, "schema": { "type": "string" } }, { - "name": "groupBy", + "name": "DeviceName", "in": "query", - "description": "Group the result into one bucket per tenant. Only 'Tenant' is supported.", "required": false, "schema": { "type": "string" } }, { - "name": "latestOnly", - "in": "query", - "description": "When true, keep only the newest record per tenant (by dateField, or an auto-detected date field). Collapses e.g. SecureScore's per-day snapshots to one current row per tenant.", - "required": false, - "schema": { - "type": "boolean" - } - }, - { - "name": "select", + "name": "DeviceSerial", "in": "query", - "description": "Comma-separated list of top-level fields to keep on each record; everything else is dropped during parse. A kept field keeps its ENTIRE subtree (e.g. select=conditions keeps conditions.users.includeRoles). The Tenant stamp is always preserved. Omit to return all fields.", "required": false, "schema": { "type": "string" } }, { - "name": "tenantFilter", - "in": "query", - "required": true, - "schema": { - "type": "string" - } - }, - { - "name": "top", - "in": "query", - "description": "Return at most this many records. For AllTenants this is a global cap across all tenants, unless groupBy=Tenant is set, in which case it caps records within each tenant bucket.", - "required": false, - "schema": { - "type": "integer" - } - }, - { - "name": "type", - "in": "query", - "required": false, - "schema": { - "type": "string" - } + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -46160,14 +52996,37 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "array", + "items": { + "type": "object", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", + "properties": { + "description": { + "x-cipp-field-source": "backend" + }, + "displayName": { + "x-cipp-field-source": "backend" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph,backend" + }, + "state": { + "x-cipp-field-source": "backend" + }, + "UserPrincipalName": { + "type": "string", + "x-cipp-field-source": "graph,backend" + }, + "version": { + "x-cipp-field-source": "backend" + } + } + } } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -46180,27 +53039,18 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "Identity.Device.Read" } }, - "/api/ListDefenderState": { + "/api/ListDevices": { "get": { - "summary": "ListDefenderState", - "operationId": "ListDefenderState", + "summary": "ListDevices", + "operationId": "ListDevices", "tags": [ - "Endpoint > MEM" + "Endpoint > Reports" ], - "description": "Lists Microsoft Defender antivirus state and detected threats for Intune-managed devices in a tenant.", + "description": "Lists Intune-managed devices for a tenant, including device compliance and configuration status.", "parameters": [ - { - "name": "DeviceID", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, { "$ref": "#/components/parameters/tenantFilter" } @@ -46214,7 +53064,7 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the Microsoft Graph entity it queries, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "aadRegistered": { "type": "boolean", @@ -46302,7 +53152,7 @@ }, "deviceName": { "type": "string", - "x-cipp-field-source": "graph-entity,frontend" + "x-cipp-field-source": "graph-entity" }, "deviceRegistrationState": { "type": "object", @@ -46548,33 +53398,6 @@ "type": "integer", "x-cipp-field-source": "graph-entity" }, - "windowsProtectionState.deviceState": { - "x-cipp-field-source": "frontend" - }, - "windowsProtectionState.fullScanOverdue": { - "x-cipp-field-source": "frontend" - }, - "windowsProtectionState.lastReportedDateTime": { - "x-cipp-field-source": "frontend" - }, - "windowsProtectionState.malwareProtectionEnabled": { - "x-cipp-field-source": "frontend" - }, - "windowsProtectionState.networkInspectionSystemEnabled": { - "x-cipp-field-source": "frontend" - }, - "windowsProtectionState.quickScanOverdue": { - "x-cipp-field-source": "frontend" - }, - "windowsProtectionState.realTimeProtectionEnabled": { - "x-cipp-field-source": "frontend" - }, - "windowsProtectionState.rebootRequired": { - "x-cipp-field-source": "frontend" - }, - "windowsProtectionState.signatureUpdateOverdue": { - "x-cipp-field-source": "frontend" - }, "windowsRemediatedMalwareCount": { "type": "integer", "x-cipp-field-source": "graph-entity" @@ -46597,22 +53420,17 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.MEM.Read" + "x-cipp-role": "Endpoint.Device.Read" } }, - "/api/ListDefenderTVM": { + "/api/ListDiagnosticsPresets": { "get": { - "summary": "ListDefenderTVM", - "operationId": "ListDefenderTVM", + "summary": "ListDiagnosticsPresets", + "operationId": "ListDiagnosticsPresets", "tags": [ - "Endpoint > MEM" - ], - "description": "Lists software vulnerabilities from Microsoft Defender Threat and Vulnerability Management (TVM), grouped by CVE ID.", - "parameters": [ - { - "$ref": "#/components/parameters/tenantFilter" - } + "CIPP > Core" ], + "description": "Lists saved diagnostics presets used for troubleshooting CIPP configuration. Requires SuperAdmin access.", "responses": { "200": { "description": "Success", @@ -46622,37 +53440,36 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "affectedDevices": { - "x-cipp-field-source": "frontend" - }, - "affectedDevicesCount": { - "x-cipp-field-source": "frontend" - }, - "cveId": { - "x-cipp-field-source": "frontend" + "data": { + "type": "string", + "x-cipp-field-source": "storage" }, - "cvssScore": { - "x-cipp-field-source": "frontend" + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" }, - "exploitabilityLevel": { - "x-cipp-field-source": "frontend" + "GUID": { + "x-cipp-field-source": "backend" }, - "osPlatform": { - "x-cipp-field-source": "frontend" + "name": { + "type": "string", + "x-cipp-field-source": "storage,backend" }, - "securityUpdateAvailable": { - "x-cipp-field-source": "frontend" + "PartitionKey": { + "x-cipp-field-source": "storage" }, - "softwareName": { - "x-cipp-field-source": "frontend" + "query": { + "x-cipp-field-source": "backend" }, - "softwareVendor": { - "x-cipp-field-source": "frontend" + "RowKey": { + "type": "string", + "x-cipp-field-source": "storage" }, - "vulnerabilitySeverityLevel": { - "x-cipp-field-source": "frontend" + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" } } } @@ -46665,6 +53482,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -46672,22 +53492,45 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.MEM.Read" + "x-cipp-role": "CIPP.SuperAdmin.Read" } }, - "/api/ListDeletedItems": { - "get": { - "summary": "ListDeletedItems", - "operationId": "ListDeletedItems", + "/api/ListDirectoryObjects": { + "post": { + "summary": "ListDirectoryObjects", + "operationId": "ListDirectoryObjects", "tags": [ - "Identity > Administration > Users" + "CIPP > Core" ], - "description": "Lists soft-deleted directory objects in Entra ID, including users, groups, applications, service principals, and administrative units.", - "parameters": [ - { - "$ref": "#/components/parameters/tenantFilter" + "description": "Resolves Entra ID directory objects by their IDs using the directoryObjects/getByIds batch endpoint. Accepts an array of object IDs in the request body.", + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "$select": { + "type": "string" + }, + "asApp": { + "type": "string" + }, + "ids": { + "type": "string" + }, + "partnerLookup": { + "type": "string", + "description": "AnyTenant: enforce tenant scope here; Get-Tenants is narrowed to the caller's allowed tenants" + }, + "tenantFilter": { + "type": "string" + } + } + } + } } - ], + }, "responses": { "200": { "description": "Success", @@ -46715,17 +53558,18 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Directory.Read" + "x-cipp-role": "CIPP.Core.Read", + "x-cipp-any-tenant": true } }, - "/api/ListDeletedSites": { + "/api/ListDlpCompliancePolicy": { "get": { - "summary": "ListDeletedSites", - "operationId": "ListDeletedSites", + "summary": "ListDlpCompliancePolicy", + "operationId": "ListDlpCompliancePolicy", "tags": [ - "Teams-Sharepoint" + "Security > Compliance-DLP" ], - "description": "Lists deleted SharePoint sites still restorable from the tenant recycle bin, via the\nSharePoint admin CSOM API.", + "description": "Lists Data Loss Prevention (DLP) compliance policies and their associated rules from the Security & Compliance Center.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" @@ -46737,14 +53581,44 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/StandardResults" + "type": "array", + "items": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "properties": { + "AssociatedRules": { + "x-cipp-field-source": "backend" + }, + "CreatedBy": { + "x-cipp-field-source": "frontend" + }, + "Enabled": { + "x-cipp-field-source": "frontend" + }, + "Mode": { + "x-cipp-field-source": "frontend" + }, + "Name": { + "x-cipp-field-source": "frontend" + }, + "RuleCount": { + "x-cipp-field-source": "backend,frontend" + }, + "WhenChangedUTC": { + "x-cipp-field-source": "frontend" + }, + "WhenCreatedUTC": { + "x-cipp-field-source": "frontend" + }, + "Workload": { + "x-cipp-field-source": "frontend" + } + } + } } } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -46757,28 +53631,25 @@ "bearerAuth": [] } ], - "x-cipp-role": "Sharepoint.Site.Read" + "x-cipp-role": "Security.DlpCompliancePolicy.Read" } }, - "/api/ListDetectedAppDevices": { + "/api/ListDlpCompliancePolicyTemplates": { "get": { - "summary": "ListDetectedAppDevices", - "operationId": "ListDetectedAppDevices", + "summary": "ListDlpCompliancePolicyTemplates", + "operationId": "ListDlpCompliancePolicyTemplates", "tags": [ - "Endpoint > Applications" + "Security > Compliance-DLP" ], - "description": "Lists Intune-managed devices that have a specific detected application installed, identified by App ID.", + "description": "Lists saved DLP compliance policy templates for deploying standardized DLP configurations.", "parameters": [ { - "name": "AppID", + "name": "ID", "in": "query", - "required": true, + "required": false, "schema": { "type": "string" } - }, - { - "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -46790,35 +53661,68 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { - "deviceCount": { - "type": "integer", - "x-cipp-field-source": "graph-entity" + "comments": { + "x-cipp-field-source": "frontend" }, - "displayName": { + "ContentHash": { + "x-cipp-field-source": "storage" + }, + "Enabled": { + "x-cipp-field-source": "frontend" + }, + "ETag": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "storage" }, - "id": { + "GUID": { + "x-cipp-field-source": "storage,frontend" + }, + "JSON": { + "x-cipp-field-source": "storage" + }, + "Mode": { + "x-cipp-field-source": "frontend" + }, + "name": { + "x-cipp-field-source": "frontend" + }, + "Package": { + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Permissions": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "storage" }, - "platform": { - "type": "object", - "x-cipp-field-source": "graph-entity" + "RowKey": { + "x-cipp-field-source": "storage" }, - "publisher": { + "SHA": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "storage" }, - "sizeInByte": { - "type": "integer", - "x-cipp-field-source": "graph-entity" + "Source": { + "x-cipp-field-source": "storage" }, - "version": { + "SourcePath": { + "x-cipp-field-source": "storage" + }, + "TemplateName": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "storage" + }, + "UpdatedBy": { + "x-cipp-field-source": "storage" + }, + "Workload": { + "x-cipp-field-source": "frontend" } } } @@ -46838,35 +53742,19 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.Device.Read" + "x-cipp-role": "Security.DlpCompliancePolicy.Read", + "x-cipp-any-tenant": true } }, - "/api/ListDetectedApps": { + "/api/ListDomainAnalyser": { "get": { - "summary": "ListDetectedApps", - "operationId": "ListDetectedApps", + "summary": "ListDomainAnalyser", + "operationId": "ListDomainAnalyser", "tags": [ - "Endpoint > Applications" + "Tenant > Standards" ], - "description": "Lists applications detected on Intune-managed devices in a tenant, optionally including device associations.", + "description": "Lists domain analysis results (SPF, DKIM, DMARC, DNSSEC) for tenant domains.", "parameters": [ - { - "name": "DeviceID", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "includeDevices", - "in": "query", - "description": "Also return the devices each detected app is installed on.", - "required": false, - "schema": { - "type": "boolean" - } - }, { "$ref": "#/components/parameters/tenantFilter" } @@ -46880,7 +53768,45 @@ "type": "array", "items": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "properties": { + "DKIMEnabled": { + "x-cipp-field-source": "frontend" + }, + "DMARCActionPolicy": { + "x-cipp-field-source": "frontend" + }, + "DMARCPercentagePass": { + "x-cipp-field-source": "frontend" + }, + "DMARCPresent": { + "x-cipp-field-source": "frontend" + }, + "DNSSECPresent": { + "x-cipp-field-source": "frontend" + }, + "Domain": { + "x-cipp-field-source": "frontend" + }, + "EnterpriseEnrollment": { + "x-cipp-field-source": "frontend" + }, + "EnterpriseRegistration": { + "x-cipp-field-source": "frontend" + }, + "MailProvider": { + "x-cipp-field-source": "frontend" + }, + "MXPassTest": { + "x-cipp-field-source": "frontend" + }, + "ScorePercentage": { + "x-cipp-field-source": "frontend" + }, + "SPFPassAll": { + "x-cipp-field-source": "frontend" + } + } } } } @@ -46898,28 +53824,52 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.Device.Read" + "x-cipp-role": "Tenant.DomainAnalyser.Read" } }, - "/api/ListDeviceDetails": { + "/api/ListDomainHealth": { "get": { - "summary": "ListDeviceDetails", - "operationId": "ListDeviceDetails", + "summary": "ListDomainHealth", + "operationId": "ListDomainHealth", "tags": [ - "Endpoint > MEM" + "Tenant > Standards" ], - "description": "Retrieves detailed information about a specific Intune-managed device by ID, name, or serial number.", + "description": "Performs real-time DNS health checks (MX, SPF, DMARC, DKIM, DNSSEC, MTA-STS, HTTPS) for a specific domain.", "parameters": [ { - "name": "DeviceID", + "name": "Action", "in": "query", - "required": false, + "description": "The DNS check to run. Without it there is nothing to dispatch on, so reject rather than fall through and return an empty body that reads like \"no findings\".", + "required": true, + "schema": { + "type": "string", + "enum": [ + "GetDkimSelectors", + "ListDomainInfo", + "ReadAutoDiscover", + "ReadDkimRecord", + "ReadDmarcPolicy", + "ReadMXRecord", + "ReadNSRecord", + "ReadSpfRecord", + "ReadWhoisRecord", + "TestDNSSEC", + "TestHttpsCertificate", + "TestMtaSts" + ] + } + }, + { + "name": "Domain", + "in": "query", + "description": "The domain every check resolves against.", + "required": true, "schema": { "type": "string" } }, { - "name": "DeviceName", + "name": "ExpectedInclude", "in": "query", "required": false, "schema": { @@ -46927,7 +53877,7 @@ } }, { - "name": "DeviceSerial", + "name": "ExpectedTarget", "in": "query", "required": false, "schema": { @@ -46935,420 +53885,296 @@ } }, { - "$ref": "#/components/parameters/tenantFilter" - } - ], - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "type": "array", - "items": { - "type": "object", - "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", - "properties": { - "description": { - "x-cipp-field-source": "backend" - }, - "displayName": { - "x-cipp-field-source": "backend" - }, - "id": { - "type": "string", - "x-cipp-field-source": "graph,backend" - }, - "state": { - "x-cipp-field-source": "backend" - }, - "UserPrincipalName": { - "type": "string", - "x-cipp-field-source": "graph,backend" - }, - "version": { - "x-cipp-field-source": "backend" - } - } - } - } - } + "name": "Record", + "in": "query", + "required": false, + "schema": { + "type": "string" } }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" - }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" - } - }, - "security": [ { - "bearerAuth": [] - } - ], - "x-cipp-role": "Identity.Device.Read" - } - }, - "/api/ListDevices": { - "get": { - "summary": "ListDevices", - "operationId": "ListDevices", - "tags": [ - "Endpoint > Reports" - ], - "description": "Lists Intune-managed devices for a tenant, including device compliance and configuration status.", - "parameters": [ + "name": "Selector", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, { - "$ref": "#/components/parameters/tenantFilter" + "name": "Subdomains", + "in": "query", + "required": false, + "schema": { + "type": "string" + } } ], "responses": { "200": { "description": "Success", "content": { - "application/json": { - "schema": { - "type": "array", - "items": { - "type": "object", - "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", - "properties": { - "aadRegistered": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "activationLockBypassCode": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "androidSecurityPatchLevel": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "autopilotEnrolled": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "azureActiveDirectoryDeviceId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "azureADDeviceId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "azureADRegistered": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "bootstrapTokenEscrowed": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "chassisType": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "chromeOSDeviceInfo": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "cloudPcRemoteActionResults": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "complianceGracePeriodExpirationDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "complianceState": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "configurationManagerClientEnabledFeatures": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "configurationManagerClientHealthState": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "configurationManagerClientInformation": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "deviceActionResults": { - "type": "array", - "x-cipp-field-source": "graph-entity" - }, - "deviceCategoryDisplayName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "deviceEnrollmentType": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "deviceFirmwareConfigurationInterfaceManaged": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "deviceHealthAttestationState": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "deviceName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "deviceRegistrationState": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "deviceType": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "easActivated": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "easActivationDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "easDeviceId": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "emailAddress": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "enrolledByUserPrincipalName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "enrolledDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "enrollmentProfileName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "ethernetMacAddress": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "exchangeAccessState": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "exchangeAccessStateReason": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "exchangeLastSuccessfulSyncDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "freeStorageSpaceInBytes": { - "type": "integer", - "x-cipp-field-source": "graph-entity" - }, - "hardwareInformation": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "iccid": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Results": { + "x-cipp-field-source": "backend" + } + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.DomainAnalyser.Read", + "x-cipp-any-tenant": true + } + }, + "/api/ListDomains": { + "get": { + "summary": "ListDomains", + "operationId": "ListDomains", + "tags": [ + "Tenant > Administration > Domains" + ], + "description": "Lists verified domains for a tenant, showing default and initial domain status.", + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", + "properties": { "id": { "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "imei": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "graph,backend" }, - "isEncrypted": { + "isdefault": { "type": "boolean", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "graph,backend" }, - "isSupervised": { + "isinitial": { "type": "boolean", - "x-cipp-field-source": "graph-entity" - }, - "jailBroken": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "joinType": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "lastSyncDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "lostModeState": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "managedDeviceName": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "managedDeviceOwnerType": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "managementAgent": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "managementCertificateExpirationDate": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "managementFeatures": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "managementState": { - "type": "object", - "x-cipp-field-source": "graph-entity" - }, - "manufacturer": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "meid": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "model": { - "type": "string", - "x-cipp-field-source": "graph-entity" - }, - "notes": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "x-cipp-field-source": "graph,backend" + } + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.Administration.Read" + } + }, + "/api/ListDynamicsBusinessUnits": { + "get": { + "summary": "ListDynamicsBusinessUnits", + "operationId": "ListDynamicsBusinessUnits", + "tags": [ + "Dynamics" + ], + "parameters": [ + { + "name": "DynamicsUrl", + "in": "query", + "required": true, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "businessunitid": { + "x-cipp-field-source": "backend" }, - "operatingSystem": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "city": { + "x-cipp-field-source": "backend" }, - "osVersion": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "country": { + "x-cipp-field-source": "backend" }, - "ownerType": { - "type": "object", - "x-cipp-field-source": "graph-entity" + "createdon": { + "x-cipp-field-source": "backend" }, - "partnerReportedThreatState": { - "type": "object", - "x-cipp-field-source": "graph-entity" + "divisionname": { + "x-cipp-field-source": "backend" }, - "phoneNumber": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "emailaddress": { + "x-cipp-field-source": "backend" }, - "physicalMemoryInBytes": { - "type": "integer", - "x-cipp-field-source": "graph-entity" + "isdisabled": { + "x-cipp-field-source": "backend" }, - "preferMdmOverGroupPolicyAppliedDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "isRoot": { + "x-cipp-field-source": "backend" }, - "processorArchitecture": { - "type": "object", - "x-cipp-field-source": "graph-entity" + "modifiedon": { + "x-cipp-field-source": "backend" }, - "remoteAssistanceSessionErrorDetails": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "name": { + "x-cipp-field-source": "backend" }, - "remoteAssistanceSessionUrl": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "parentId": { + "x-cipp-field-source": "backend" }, - "requireUserEnrollmentApproval": { - "type": "boolean", - "x-cipp-field-source": "graph-entity" + "parentName": { + "x-cipp-field-source": "backend" }, - "retireAfterDateTime": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "stateOrProvince": { + "x-cipp-field-source": "backend" }, - "roleScopeTagIds": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "websiteurl": { + "x-cipp-field-source": "backend" + } + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Dynamics.BusinessUnit.Read" + } + }, + "/api/ListDynamicsEnvironments": { + "get": { + "summary": "ListDynamicsEnvironments", + "operationId": "ListDynamicsEnvironments", + "tags": [ + "Dynamics" + ], + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "apiUrl": { + "x-cipp-field-source": "backend" }, - "securityPatchLevel": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "capacityUsed": { + "x-cipp-field-source": "backend" }, - "serialNumber": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "createdTime": { + "x-cipp-field-source": "backend" }, - "skuFamily": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "displayName": { + "x-cipp-field-source": "backend" }, - "skuNumber": { - "type": "integer", - "x-cipp-field-source": "graph-entity" + "domainName": { + "x-cipp-field-source": "backend" }, - "specificationVersion": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "environmentType": { + "x-cipp-field-source": "backend" }, - "subscriberCarrier": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "id": { + "x-cipp-field-source": "backend" }, - "totalStorageSpaceInBytes": { - "type": "integer", - "x-cipp-field-source": "graph-entity" + "isDefault": { + "x-cipp-field-source": "backend" }, - "udid": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "lastModifiedTime": { + "x-cipp-field-source": "backend" }, - "userDisplayName": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "name": { + "x-cipp-field-source": "backend" }, - "userId": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "orgId": { + "x-cipp-field-source": "backend" }, - "userPrincipalName": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "region": { + "x-cipp-field-source": "backend" }, - "usersLoggedOn": { - "type": "array", - "x-cipp-field-source": "graph-entity" + "securityGroupId": { + "x-cipp-field-source": "backend" }, - "wiFiMacAddress": { - "type": "string", - "x-cipp-field-source": "graph-entity" + "state": { + "x-cipp-field-source": "backend" }, - "windowsActiveMalwareCount": { - "type": "integer", - "x-cipp-field-source": "graph-entity" + "url": { + "x-cipp-field-source": "backend" }, - "windowsRemediatedMalwareCount": { - "type": "integer", - "x-cipp-field-source": "graph-entity" + "version": { + "x-cipp-field-source": "backend" } } } @@ -47368,17 +54194,29 @@ "bearerAuth": [] } ], - "x-cipp-role": "Endpoint.Device.Read" + "x-cipp-role": "Dynamics.Environment.Read" } }, - "/api/ListDiagnosticsPresets": { + "/api/ListDynamicsSecurityRoles": { "get": { - "summary": "ListDiagnosticsPresets", - "operationId": "ListDiagnosticsPresets", + "summary": "ListDynamicsSecurityRoles", + "operationId": "ListDynamicsSecurityRoles", "tags": [ - "CIPP > Core" + "Dynamics" + ], + "parameters": [ + { + "name": "DynamicsUrl", + "in": "query", + "required": true, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } ], - "description": "Lists saved diagnostics presets used for troubleshooting CIPP configuration. Requires SuperAdmin access.", "responses": { "200": { "description": "Success", @@ -47388,36 +54226,37 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "data": { - "type": "string", - "x-cipp-field-source": "storage" + "businessUnit": { + "x-cipp-field-source": "backend" }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" + "businessUnitId": { + "x-cipp-field-source": "backend" }, - "GUID": { + "canbedeleted": { "x-cipp-field-source": "backend" }, - "name": { - "type": "string", - "x-cipp-field-source": "storage,backend" + "createdon": { + "x-cipp-field-source": "backend" }, - "PartitionKey": { - "x-cipp-field-source": "storage" + "isinherited": { + "x-cipp-field-source": "backend" }, - "query": { + "ismanaged": { "x-cipp-field-source": "backend" }, - "RowKey": { - "type": "string", - "x-cipp-field-source": "storage" + "modifiedon": { + "x-cipp-field-source": "backend" }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" + "name": { + "x-cipp-field-source": "backend" + }, + "roleid": { + "x-cipp-field-source": "backend" + }, + "roleType": { + "x-cipp-field-source": "backend" } } } @@ -47430,9 +54269,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -47440,45 +54276,29 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.SuperAdmin.Read" + "x-cipp-role": "Dynamics.SecurityRole.Read" } }, - "/api/ListDirectoryObjects": { - "post": { - "summary": "ListDirectoryObjects", - "operationId": "ListDirectoryObjects", + "/api/ListDynamicsSolutions": { + "get": { + "summary": "ListDynamicsSolutions", + "operationId": "ListDynamicsSolutions", "tags": [ - "CIPP > Core" + "Dynamics" ], - "description": "Resolves Entra ID directory objects by their IDs using the directoryObjects/getByIds batch endpoint. Accepts an array of object IDs in the request body.", - "requestBody": { - "required": false, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "$select": { - "type": "string" - }, - "asApp": { - "type": "string" - }, - "ids": { - "type": "string" - }, - "partnerLookup": { - "type": "string", - "description": "AnyTenant: enforce tenant scope here; Get-Tenants is narrowed to the caller's allowed tenants" - }, - "tenantFilter": { - "type": "string" - } - } - } + "parameters": [ + { + "name": "DynamicsUrl", + "in": "query", + "required": true, + "schema": { + "type": "string" } + }, + { + "$ref": "#/components/parameters/tenantFilter" } - }, + ], "responses": { "200": { "description": "Success", @@ -47488,7 +54308,45 @@ "type": "array", "items": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "createdon": { + "x-cipp-field-source": "backend" + }, + "description": { + "x-cipp-field-source": "backend" + }, + "friendlyname": { + "x-cipp-field-source": "backend" + }, + "installedon": { + "x-cipp-field-source": "backend" + }, + "ismanaged": { + "x-cipp-field-source": "backend" + }, + "modifiedon": { + "x-cipp-field-source": "backend" + }, + "publisher": { + "x-cipp-field-source": "backend" + }, + "publisherUnique": { + "x-cipp-field-source": "backend" + }, + "solutionid": { + "x-cipp-field-source": "backend" + }, + "solutionType": { + "x-cipp-field-source": "backend" + }, + "uniquename": { + "x-cipp-field-source": "backend" + }, + "version": { + "x-cipp-field-source": "backend" + } + } } } } @@ -47506,19 +54364,25 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "Dynamics.Solution.Read" } }, - "/api/ListDlpCompliancePolicy": { + "/api/ListDynamicsUsers": { "get": { - "summary": "ListDlpCompliancePolicy", - "operationId": "ListDlpCompliancePolicy", + "summary": "ListDynamicsUsers", + "operationId": "ListDynamicsUsers", "tags": [ - "Security > Compliance-DLP" + "Dynamics" ], - "description": "Lists Data Loss Prevention (DLP) compliance policies and their associated rules from the Security & Compliance Center.", "parameters": [ + { + "name": "DynamicsUrl", + "in": "query", + "required": true, + "schema": { + "type": "string" + } + }, { "$ref": "#/components/parameters/tenantFilter" } @@ -47532,34 +54396,61 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "AssociatedRules": { + "accessmode": { "x-cipp-field-source": "backend" }, - "CreatedBy": { - "x-cipp-field-source": "frontend" + "accessmodeRaw": { + "x-cipp-field-source": "backend" + }, + "azureAdObjectId": { + "x-cipp-field-source": "backend" + }, + "businessUnit": { + "x-cipp-field-source": "backend" + }, + "businessUnitId": { + "x-cipp-field-source": "backend" + }, + "createdon": { + "x-cipp-field-source": "backend" + }, + "domainname": { + "x-cipp-field-source": "backend" + }, + "email": { + "x-cipp-field-source": "backend" + }, + "fullname": { + "x-cipp-field-source": "backend" + }, + "isdisabled": { + "x-cipp-field-source": "backend" + }, + "modifiedon": { + "x-cipp-field-source": "backend" }, - "Enabled": { - "x-cipp-field-source": "frontend" + "name": { + "x-cipp-field-source": "backend" }, - "Mode": { - "x-cipp-field-source": "frontend" + "phone": { + "x-cipp-field-source": "backend" }, - "Name": { - "x-cipp-field-source": "frontend" + "roleid": { + "x-cipp-field-source": "backend" }, - "RuleCount": { - "x-cipp-field-source": "backend,frontend" + "securityRoleList": { + "x-cipp-field-source": "backend" }, - "WhenChangedUTC": { - "x-cipp-field-source": "frontend" + "securityRoles": { + "x-cipp-field-source": "backend" }, - "WhenCreatedUTC": { - "x-cipp-field-source": "frontend" + "systemuserid": { + "x-cipp-field-source": "backend" }, - "Workload": { - "x-cipp-field-source": "frontend" + "title": { + "x-cipp-field-source": "backend" } } } @@ -47579,25 +54470,27 @@ "bearerAuth": [] } ], - "x-cipp-role": "Security.DlpCompliancePolicy.Read" + "x-cipp-role": "Dynamics.User.Read" } }, - "/api/ListDlpCompliancePolicyTemplates": { + "/api/ListEdiscoveryCaseHolds": { "get": { - "summary": "ListDlpCompliancePolicyTemplates", - "operationId": "ListDlpCompliancePolicyTemplates", + "summary": "ListEdiscoveryCaseHolds", + "operationId": "ListEdiscoveryCaseHolds", "tags": [ - "Security > Compliance-DLP" + "Security" ], - "description": "Lists saved DLP compliance policy templates for deploying standardized DLP configurations.", "parameters": [ { - "name": "ID", + "name": "caseId", "in": "query", "required": false, "schema": { "type": "string" } + }, + { + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -47609,68 +54502,50 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { - "comments": { - "x-cipp-field-source": "frontend" - }, - "ContentHash": { - "x-cipp-field-source": "storage" - }, - "Enabled": { - "x-cipp-field-source": "frontend" + "closedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "ETag": { + "closedDateTime": { "type": "string", - "x-cipp-field-source": "storage" - }, - "GUID": { - "x-cipp-field-source": "storage,frontend" - }, - "JSON": { - "x-cipp-field-source": "storage" - }, - "Mode": { - "x-cipp-field-source": "frontend" - }, - "name": { - "x-cipp-field-source": "frontend" - }, - "Package": { - "x-cipp-field-source": "storage" - }, - "PartitionKey": { - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "Permissions": { + "createdDateTime": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "RowKey": { - "x-cipp-field-source": "storage" + "description": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "SHA": { + "displayName": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "Source": { - "x-cipp-field-source": "storage" + "externalId": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "SourcePath": { - "x-cipp-field-source": "storage" + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "TemplateName": { - "x-cipp-field-source": "storage" + "lastModifiedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "Timestamp": { + "lastModifiedDateTime": { "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "graph-entity" }, - "UpdatedBy": { - "x-cipp-field-source": "storage" + "Results": { + "x-cipp-field-source": "backend" }, - "Workload": { - "x-cipp-field-source": "frontend" + "status": { + "type": "object", + "x-cipp-field-source": "graph-entity" } } } @@ -47683,6 +54558,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -47690,19 +54568,25 @@ "bearerAuth": [] } ], - "x-cipp-role": "Security.DlpCompliancePolicy.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "Security.Ediscovery.Read" } }, - "/api/ListDomainAnalyser": { + "/api/ListEdiscoveryCaseOperations": { "get": { - "summary": "ListDomainAnalyser", - "operationId": "ListDomainAnalyser", + "summary": "ListEdiscoveryCaseOperations", + "operationId": "ListEdiscoveryCaseOperations", "tags": [ - "Tenant > Standards" + "Security" ], - "description": "Lists domain analysis results (SPF, DKIM, DMARC, DNSSEC) for tenant domains.", "parameters": [ + { + "name": "caseId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, { "$ref": "#/components/parameters/tenantFilter" } @@ -47716,43 +54600,50 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { - "DKIMEnabled": { - "x-cipp-field-source": "frontend" - }, - "DMARCActionPolicy": { - "x-cipp-field-source": "frontend" + "closedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "DMARCPercentagePass": { - "x-cipp-field-source": "frontend" + "closedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "DMARCPresent": { - "x-cipp-field-source": "frontend" + "createdDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "DNSSECPresent": { - "x-cipp-field-source": "frontend" + "description": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "Domain": { - "x-cipp-field-source": "frontend" + "displayName": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "EnterpriseEnrollment": { - "x-cipp-field-source": "frontend" + "externalId": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "EnterpriseRegistration": { - "x-cipp-field-source": "frontend" + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "MailProvider": { - "x-cipp-field-source": "frontend" + "lastModifiedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "MXPassTest": { - "x-cipp-field-source": "frontend" + "lastModifiedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" }, - "ScorePercentage": { - "x-cipp-field-source": "frontend" + "Results": { + "x-cipp-field-source": "backend" }, - "SPFPassAll": { - "x-cipp-field-source": "frontend" + "status": { + "type": "object", + "x-cipp-field-source": "graph-entity" } } } @@ -47765,6 +54656,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -47772,89 +54666,19 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.DomainAnalyser.Read" + "x-cipp-role": "Security.Ediscovery.Read" } }, - "/api/ListDomainHealth": { + "/api/ListEdiscoveryCases": { "get": { - "summary": "ListDomainHealth", - "operationId": "ListDomainHealth", + "summary": "ListEdiscoveryCases", + "operationId": "ListEdiscoveryCases", "tags": [ - "Tenant > Standards" + "Security" ], - "description": "Performs real-time DNS health checks (MX, SPF, DMARC, DKIM, DNSSEC, MTA-STS, HTTPS) for a specific domain.", "parameters": [ { - "name": "Action", - "in": "query", - "description": "The DNS check to run. Without it there is nothing to dispatch on, so reject rather than fall through and return an empty body that reads like \"no findings\".", - "required": true, - "schema": { - "type": "string", - "enum": [ - "GetDkimSelectors", - "ListDomainInfo", - "ReadAutoDiscover", - "ReadDkimRecord", - "ReadDmarcPolicy", - "ReadMXRecord", - "ReadNSRecord", - "ReadSpfRecord", - "ReadWhoisRecord", - "TestDNSSEC", - "TestHttpsCertificate", - "TestMtaSts" - ] - } - }, - { - "name": "Domain", - "in": "query", - "description": "The domain every check resolves against.", - "required": true, - "schema": { - "type": "string" - } - }, - { - "name": "ExpectedInclude", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "ExpectedTarget", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "Record", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "Selector", - "in": "query", - "required": false, - "schema": { - "type": "string" - } - }, - { - "name": "Subdomains", - "in": "query", - "required": false, - "schema": { - "type": "string" - } + "$ref": "#/components/parameters/tenantFilter" } ], "responses": { @@ -47866,10 +54690,56 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { + "closedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "closedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "createdBy": { + "x-cipp-field-source": "frontend" + }, + "createdDate": { + "x-cipp-field-source": "frontend" + }, + "createdDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "description": { + "type": "string", + "x-cipp-field-source": "graph-entity,frontend" + }, + "displayName": { + "type": "string", + "x-cipp-field-source": "graph-entity,frontend" + }, + "externalId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "lastModifiedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "lastModifiedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, "Results": { "x-cipp-field-source": "backend" + }, + "status": { + "type": "object", + "x-cipp-field-source": "graph-entity,frontend" } } } @@ -47877,9 +54747,6 @@ } } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -47895,19 +54762,25 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.DomainAnalyser.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "Security.Ediscovery.Read" } }, - "/api/ListDomains": { + "/api/ListEdiscoveryCaseSearches": { "get": { - "summary": "ListDomains", - "operationId": "ListDomains", + "summary": "ListEdiscoveryCaseSearches", + "operationId": "ListEdiscoveryCaseSearches", "tags": [ - "Tenant > Administration > Domains" + "Security" ], - "description": "Lists verified domains for a tenant, showing default and initial domain status.", "parameters": [ + { + "name": "caseId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, { "$ref": "#/components/parameters/tenantFilter" } @@ -47921,19 +54794,50 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { + "closedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "closedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "createdDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "description": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "displayName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "externalId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, "id": { "type": "string", - "x-cipp-field-source": "graph,backend" + "x-cipp-field-source": "graph-entity" }, - "isdefault": { - "type": "boolean", - "x-cipp-field-source": "graph,backend" + "lastModifiedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" }, - "isinitial": { - "type": "boolean", - "x-cipp-field-source": "graph,backend" + "lastModifiedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "status": { + "type": "object", + "x-cipp-field-source": "graph-entity" } } } @@ -47956,7 +54860,7 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Administration.Read" + "x-cipp-role": "Security.Ediscovery.Read" } }, "/api/ListEmptyResults": { @@ -48208,7 +55112,6 @@ "tags": [ "CIPP > Settings" ], - "description": "Lists license SKUs that have been excluded from CIPP license counts and reporting.", "responses": { "200": { "description": "Success", @@ -48581,14 +55484,163 @@ "x-cipp-any-tenant": true } }, - "/api/ListExtensionSync": { + "/api/ListExtensionSync": { + "get": { + "summary": "ListExtensionSync", + "operationId": "ListExtensionSync", + "tags": [ + "CIPP > Extensions" + ], + "description": "Lists extension synchronization tasks and their status, including last sync results for configured third-party integrations (Hudu, Halo, NinjaOne, etc.).", + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "AdditionalProperties": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "AlertComment": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Command": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "CustomSubject": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "excludedTenantGroups": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "excludedTenants": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "ExecutedTime": { + "x-cipp-field-source": "storage,frontend" + }, + "Hidden": { + "type": "boolean", + "x-cipp-field-source": "storage" + }, + "Name": { + "type": "string", + "x-cipp-field-source": "storage,frontend" + }, + "Parameters": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "PostExecution": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "PsaTicketId": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "PsaTicketPriority": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "PsaTicketStrategy": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Recurrence": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Reference": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "RepeatsEvery": { + "x-cipp-field-source": "frontend" + }, + "Results": { + "x-cipp-field-source": "storage,frontend" + }, + "RowKey": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "ScheduledTime": { + "type": "string", + "x-cipp-field-source": "storage,frontend" + }, + "SyncType": { + "x-cipp-field-source": "storage,frontend" + }, + "TaskState": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Tenant": { + "type": "string", + "x-cipp-field-source": "storage,frontend" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Trigger": { + "type": "string", + "x-cipp-field-source": "storage" + } + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "CIPP.Extension.Read", + "x-cipp-any-tenant": true + } + }, + "/api/ListExternalCollaboration": { "get": { - "summary": "ListExtensionSync", - "operationId": "ListExtensionSync", + "summary": "ListExternalCollaboration", + "operationId": "ListExternalCollaboration", "tags": [ - "CIPP > Extensions" + "Tenant > CrossTenant" + ], + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } ], - "description": "Lists extension synchronization tasks and their status, including last sync results for configured third-party integrations (Hudu, Halo, NinjaOne, etc.).", "responses": { "200": { "description": "Success", @@ -48598,111 +55650,10 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "AdditionalProperties": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "AlertComment": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "Command": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "CustomSubject": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "ETag": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "excludedTenantGroups": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "excludedTenants": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "ExecutedTime": { - "x-cipp-field-source": "storage,frontend" - }, - "Hidden": { - "type": "boolean", - "x-cipp-field-source": "storage" - }, - "Name": { - "type": "string", - "x-cipp-field-source": "storage,frontend" - }, - "Parameters": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "PartitionKey": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "PostExecution": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "PsaTicketId": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "PsaTicketPriority": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "PsaTicketStrategy": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "Recurrence": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "Reference": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "RepeatsEvery": { - "x-cipp-field-source": "frontend" - }, "Results": { - "x-cipp-field-source": "storage,frontend" - }, - "RowKey": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "ScheduledTime": { - "type": "string", - "x-cipp-field-source": "storage,frontend" - }, - "SyncType": { - "x-cipp-field-source": "storage,frontend" - }, - "TaskState": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "Tenant": { - "type": "string", - "x-cipp-field-source": "storage,frontend" - }, - "Timestamp": { - "type": "string", - "x-cipp-field-source": "storage" - }, - "Trigger": { - "type": "string", - "x-cipp-field-source": "storage" + "x-cipp-field-source": "backend" } } } @@ -48722,8 +55673,7 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Extension.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "Tenant.CrossTenant.Read" } }, "/api/ListExternalTenantInfo": { @@ -48830,8 +55780,7 @@ "bearerAuth": [] } ], - "x-cipp-role": "CIPP.Core.Read", - "x-cipp-any-tenant": true + "x-cipp-role": "CIPP.Core.Read" } }, "/api/ListFunctionParameters": { @@ -49334,37 +56283,31 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the Microsoft Graph entity it queries, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "accessDetails": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "accessDetails.unifiedRoles": { - "x-cipp-field-source": "frontend" - }, "activatedDateTime": { "type": "string", - "x-cipp-field-source": "graph-entity,frontend" + "x-cipp-field-source": "graph-entity" }, "autoExtendDuration": { "type": "string", - "x-cipp-field-source": "graph-entity,frontend" + "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", - "x-cipp-field-source": "graph-entity,frontend" + "x-cipp-field-source": "graph-entity" }, "customer": { "type": "object", "x-cipp-field-source": "graph-entity" }, - "customer.displayName": { - "x-cipp-field-source": "frontend" - }, "displayName": { "type": "string", - "x-cipp-field-source": "graph-entity,frontend" + "x-cipp-field-source": "graph-entity" }, "duration": { "type": "string", @@ -49372,7 +56315,7 @@ }, "endDateTime": { "type": "string", - "x-cipp-field-source": "graph-entity,frontend" + "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", @@ -49384,7 +56327,7 @@ }, "status": { "type": "object", - "x-cipp-field-source": "graph-entity,frontend" + "x-cipp-field-source": "graph-entity" } } } @@ -49711,7 +56654,7 @@ "tags": [ "Tools > GitHub" ], - "description": "Returns release metadata for the provided repository. Results are cached and refreshed\nwhen the cache has no entry for the running version - hotfix releases (e.g. v8.5.2)\npublish their own notes, so a v8.5.0 entry no longer counts as current.", + "description": "Returns release metadata for the provided repository and semantic version. Hotfix\nversions (e.g. v8.5.2) map back to the base release tag (v8.5.0).", "responses": { "200": { "description": "Success", @@ -50384,6 +57327,70 @@ "x-cipp-any-tenant": true } }, + "/api/ListGroupAliases": { + "get": { + "summary": "ListGroupAliases", + "operationId": "ListGroupAliases", + "tags": [ + "Identity > Administration > Groups" + ], + "parameters": [ + { + "name": "groupId", + "in": "query", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "groupType", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Exchange.Groups.Read" + } + }, "/api/ListGroups": { "get": { "summary": "ListGroups", @@ -50709,7 +57716,6 @@ "tags": [ "Identity > Administration > Groups" ], - "description": "Lists the saved group templates, each with its display name, description and group type. Pass id to return a single template. These are CIPP templates, not a tenant's existing groups.", "parameters": [ { "name": "id", @@ -50996,12 +58002,18 @@ "type": "string", "x-cipp-field-source": "graph,backend" }, + "isStale": { + "x-cipp-field-source": "backend" + }, "lastInteractiveSignInDateTime": { "x-cipp-field-source": "backend" }, "lastNonInteractiveSignInDateTime": { "x-cipp-field-source": "backend" }, + "lastSignIn": { + "x-cipp-field-source": "backend" + }, "lastSignInDateTime": { "x-cipp-field-source": "backend,frontend" }, @@ -51012,6 +58024,9 @@ "type": "string", "x-cipp-field-source": "graph,backend,frontend" }, + "neverSignedIn": { + "x-cipp-field-source": "backend" + }, "sourceDomain": { "x-cipp-field-source": "backend,frontend" }, @@ -51031,6 +58046,9 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -51190,6 +58208,47 @@ "x-cipp-role": "Exchange.Mailbox.Read" } }, + "/api/ListHubSites": { + "get": { + "summary": "ListHubSites", + "operationId": "ListHubSites", + "tags": [ + "Teams-Sharepoint" + ], + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Sharepoint.Site.Read" + } + }, "/api/ListHVEAccounts": { "get": { "summary": "ListHVEAccounts", @@ -51311,6 +58370,84 @@ "x-cipp-role": "Exchange.Mailbox.Read" } }, + "/api/ListImageOptimizerResults": { + "post": { + "summary": "Poll for SharePoint Image Optimizer job results by QueueId.", + "operationId": "ListImageOptimizerResults", + "tags": [ + "Teams-Sharepoint" + ], + "description": "Companion to Invoke-ExecSharePointImageOptimize. Returns Status 'Running' while the\nbackground worker is still processing, and the full optimizer result object once the\njob has completed (or an error message if it failed).", + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": {} + } + } + } + }, + "parameters": [ + { + "name": "queueId", + "in": "query", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "Reference", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "404": { + "description": "Not found" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Sharepoint.Site.ReadWrite", + "x-cipp-reads-via": [ + "Get-CIPPQueueData" + ] + } + }, "/api/ListInactiveAccounts": { "get": { "summary": "ListInactiveAccounts", @@ -51541,6 +58678,450 @@ "x-cipp-any-tenant": true } }, + "/api/ListIntegrationAppStatus": { + "get": { + "summary": "ListIntegrationAppStatus", + "operationId": "ListIntegrationAppStatus", + "tags": [ + "Tenant > Administration > Integration Templates" + ], + "parameters": [ + { + "name": "templateId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "ContentHash": { + "x-cipp-field-source": "storage" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "GUID": { + "x-cipp-field-source": "storage" + }, + "JSON": { + "x-cipp-field-source": "storage" + }, + "Package": { + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Permissions": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "SHA": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Source": { + "x-cipp-field-source": "storage" + }, + "SourcePath": { + "x-cipp-field-source": "storage" + }, + "TemplateName": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "UpdatedBy": { + "x-cipp-field-source": "storage" + } + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.Application.Read" + }, + "post": { + "summary": "ListIntegrationAppStatus", + "operationId": "ListIntegrationAppStatusPost", + "tags": [ + "Tenant > Administration > Integration Templates" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "templateId": { + "type": "string" + }, + "tenants": { + "type": "array", + "items": { + "$ref": "#/components/schemas/LabelValue" + } + } + }, + "required": [ + "templateId" + ] + } + } + } + }, + "parameters": [ + { + "name": "templateId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "ContentHash": { + "x-cipp-field-source": "storage" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "GUID": { + "x-cipp-field-source": "storage" + }, + "JSON": { + "x-cipp-field-source": "storage" + }, + "Package": { + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Permissions": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "SHA": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Source": { + "x-cipp-field-source": "storage" + }, + "SourcePath": { + "x-cipp-field-source": "storage" + }, + "TemplateName": { + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "UpdatedBy": { + "x-cipp-field-source": "storage" + } + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.Application.Read" + } + }, + "/api/ListIntegrationDeployments": { + "get": { + "summary": "ListIntegrationDeployments", + "operationId": "ListIntegrationDeployments", + "tags": [ + "Tenant > Administration > Integration Templates" + ], + "parameters": [ + { + "name": "deploymentId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "AppId": { + "x-cipp-field-source": "storage,backend" + }, + "AppName": { + "x-cipp-field-source": "storage,backend" + }, + "ClientSecret": { + "x-cipp-field-source": "storage,backend" + }, + "CompletedAt": { + "x-cipp-field-source": "storage,backend" + }, + "DeploymentId": { + "x-cipp-field-source": "storage,backend" + }, + "DisplayName": { + "x-cipp-field-source": "storage,backend" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Message": { + "x-cipp-field-source": "storage,backend" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "QueueId": { + "x-cipp-field-source": "storage" + }, + "Results": { + "x-cipp-field-source": "storage" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "SecretExpiration": { + "x-cipp-field-source": "storage,backend" + }, + "StartedAt": { + "x-cipp-field-source": "storage,backend" + }, + "StartedBy": { + "x-cipp-field-source": "storage,backend" + }, + "Status": { + "x-cipp-field-source": "storage,backend" + }, + "TemplateId": { + "x-cipp-field-source": "storage,backend" + }, + "TemplateName": { + "x-cipp-field-source": "storage,backend" + }, + "Tenant": { + "x-cipp-field-source": "storage,backend" + }, + "TenantCount": { + "x-cipp-field-source": "storage,backend" + }, + "TenantId": { + "x-cipp-field-source": "storage,backend" + }, + "TenantName": { + "x-cipp-field-source": "storage,backend" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + } + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "404": { + "description": "Not found" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.Application.Read", + "x-cipp-any-tenant": true + } + }, + "/api/ListIntegrationTemplates": { + "get": { + "summary": "ListIntegrationTemplates", + "operationId": "ListIntegrationTemplates", + "tags": [ + "Tenant > Administration > Integration Templates" + ], + "parameters": [ + { + "name": "id", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "properties": { + "ContentHash": { + "x-cipp-field-source": "storage" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "GUID": { + "x-cipp-field-source": "storage" + }, + "JSON": { + "x-cipp-field-source": "storage" + }, + "Package": { + "x-cipp-field-source": "storage" + }, + "PartitionKey": { + "x-cipp-field-source": "storage" + }, + "Permissions": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "RowKey": { + "x-cipp-field-source": "storage" + }, + "SHA": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Source": { + "x-cipp-field-source": "storage" + }, + "SourcePath": { + "x-cipp-field-source": "storage" + }, + "TemplateName": { + "x-cipp-field-source": "storage" + }, + "timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "UpdatedBy": { + "x-cipp-field-source": "storage" + } + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.Application.Read", + "x-cipp-any-tenant": true + } + }, "/api/ListIntuneApprovalRequests": { "get": { "summary": "List Intune multi-admin approval requests", @@ -52024,7 +59605,6 @@ "tags": [ "Endpoint > MEM" ], - "description": "Lists the saved Intune policy templates. On first call the templates shipped with CIPP are imported into the templates table. These are CIPP templates, not a tenant's deployed policies.", "parameters": [ { "name": "ID", @@ -52065,24 +59645,21 @@ "ContentHash": { "x-cipp-field-source": "storage" }, - "corrupt": { - "x-cipp-field-source": "backend" - }, "description": { - "x-cipp-field-source": "backend,frontend" + "x-cipp-field-source": "frontend" }, "displayName": { - "x-cipp-field-source": "backend,frontend" + "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "guid": { - "x-cipp-field-source": "storage,backend" + "x-cipp-field-source": "storage" }, "isSynced": { - "x-cipp-field-source": "backend,frontend" + "x-cipp-field-source": "frontend" }, "JSON": { "x-cipp-field-source": "storage" @@ -52090,8 +59667,8 @@ "label": { "x-cipp-field-source": "backend" }, - "package": { - "x-cipp-field-source": "storage,backend,frontend" + "Package": { + "x-cipp-field-source": "storage,frontend" }, "PartitionKey": { "x-cipp-field-source": "storage" @@ -52108,7 +59685,7 @@ "x-cipp-field-source": "storage" }, "Source": { - "x-cipp-field-source": "storage,backend,frontend" + "x-cipp-field-source": "storage,frontend" }, "SourcePath": { "x-cipp-field-source": "storage" @@ -52332,7 +59909,6 @@ "tags": [ "Identity > Administration > Users" ], - "description": "Lists Just-in-Time admin role templates that define temporary admin role assignments.", "parameters": [ { "name": "GUID", @@ -52917,7 +60493,6 @@ "tags": [ "Tenant > Reports" ], - "description": "Lists Microsoft 365 license SKUs and their assigned/available counts for a tenant. For AllTenants queries, consider using ListDBCache for better performance.", "parameters": [ { "name": "IncludeExcluded", @@ -53270,10 +60845,10 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", + "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "API": { - "x-cipp-field-source": "backend" + "x-cipp-field-source": "backend,frontend" }, "AppId": { "x-cipp-field-source": "backend" @@ -53285,7 +60860,7 @@ "x-cipp-field-source": "backend" }, "DateTime": { - "x-cipp-field-source": "backend" + "x-cipp-field-source": "backend,frontend" }, "ETag": { "type": "string", @@ -53304,7 +60879,7 @@ "x-cipp-field-source": "backend" }, "Message": { - "x-cipp-field-source": "backend" + "x-cipp-field-source": "backend,frontend" }, "Package": { "x-cipp-field-source": "storage" @@ -53320,7 +60895,7 @@ "x-cipp-field-source": "storage,backend" }, "Severity": { - "x-cipp-field-source": "backend" + "x-cipp-field-source": "backend,frontend" }, "SHA": { "type": "string", @@ -53338,11 +60913,23 @@ "StandardInfo": { "x-cipp-field-source": "backend" }, + "StandardInfo.ConditionalAccessPolicy": { + "x-cipp-field-source": "frontend" + }, + "StandardInfo.IntunePolicy": { + "x-cipp-field-source": "frontend" + }, + "StandardInfo.Standard": { + "x-cipp-field-source": "frontend" + }, + "StandardInfo.Template": { + "x-cipp-field-source": "frontend" + }, "TemplateName": { "x-cipp-field-source": "storage" }, "Tenant": { - "x-cipp-field-source": "backend" + "x-cipp-field-source": "backend,frontend" }, "TenantID": { "x-cipp-field-source": "backend" @@ -53355,7 +60942,7 @@ "x-cipp-field-source": "storage" }, "User": { - "x-cipp-field-source": "backend" + "x-cipp-field-source": "backend,frontend" } } } @@ -53386,7 +60973,6 @@ "tags": [ "Email-Exchange > Reports" ], - "description": "Lists Client Access Settings (CAS) for Exchange Online mailboxes, showing which protocols are enabled (OWA, IMAP, POP, MAPI, EWS, ActiveSync).", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" @@ -53412,13 +60998,13 @@ "ECPEnabled": { "x-cipp-field-source": "backend,frontend" }, - "EwsEnabled": { + "EWSEnabled": { "x-cipp-field-source": "backend,frontend" }, "Guid": { "x-cipp-field-source": "backend" }, - "ImapEnabled": { + "IMAPEnabled": { "x-cipp-field-source": "backend,frontend" }, "MAPIEnabled": { @@ -53427,7 +61013,7 @@ "OWAEnabled": { "x-cipp-field-source": "backend,frontend" }, - "PopEnabled": { + "POPEnabled": { "x-cipp-field-source": "backend,frontend" }, "PrimarySmtpAddress": { @@ -53819,7 +61405,6 @@ "tags": [ "Email-Exchange > Administration" ], - "description": "Lists mailbox permissions (Full Access, Send As, Send on Behalf) for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "name": "ByUser", @@ -53843,10 +61428,9 @@ { "name": "UseReportDB", "in": "query", - "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { - "type": "boolean" + "type": "string" } }, { @@ -53990,7 +61574,6 @@ "tags": [ "Email-Exchange > Administration" ], - "description": "Lists inbox rules configured on mailboxes in a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" @@ -53998,10 +61581,9 @@ { "name": "UseReportDB", "in": "query", - "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { - "type": "boolean" + "type": "string" } } ], @@ -54179,12 +61761,11 @@ "tags": [ "Email-Exchange > Spamfilter" ], - "description": "Lists quarantined email messages in Exchange Online Protection for a tenant.", + "description": "Lists quarantined email messages in Exchange Online Protection for a tenant.\nSupports server-side filtering via Get-QuarantineMessage parameters.\nDefault behavior returns one page (100 rows, last 7 days) unless fetchAll=true.", "parameters": [ { - "name": "EntityType", + "name": "fetchAll", "in": "query", - "description": "Entity type: Email (default), SharePointOnline (files) or Teams (Teams messages)", "required": false, "schema": { "type": "string" @@ -54201,10 +61782,25 @@ { "name": "nextLink", "in": "query", - "description": "Manual pagination: return one page per request. The frontend chains requests via Metadata.nextLink, which for this endpoint is the next Get-QuarantineMessage page number.", "required": false, "schema": { - "type": "integer" + "type": "string" + } + }, + { + "name": "page", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "pageSize", + "in": "query", + "required": false, + "schema": { + "type": "string" } }, { @@ -54289,6 +61885,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -55177,7 +62776,6 @@ "tags": [ "Identity > Administration > Users" ], - "description": "Lists default templates for new user creation, including default domain, usage location, and license assignments.", "parameters": [ { "name": "ID", @@ -55286,6 +62884,44 @@ "x-cipp-any-tenant": true } }, + "/api/ListNinjaDeviceInfo": { + "get": { + "summary": "ListNinjaDeviceInfo", + "operationId": "ListNinjaDeviceInfo", + "tags": [ + "Endpoint > Reports" + ], + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Endpoint.Device.Read" + } + }, "/api/ListNotificationConfig": { "get": { "summary": "ListNotificationConfig", @@ -55611,81 +63247,268 @@ "bearerAuth": [] } ], - "x-cipp-role": "Identity.AuditLog.Read" + "x-cipp-role": "Identity.AuditLog.Read" + } + }, + "/api/ListOffboardingProgress": { + "get": { + "summary": "Get the live progress of an offboarding or BEC remediation job", + "operationId": "ListOffboardingProgress", + "tags": [ + "Identity > Administration > Users" + ], + "description": "Returns the progress rows of an offboarding job started from the wizard, or of a background BEC\nremediation (ExecBECRemediate with Async): one row per user with its overall status and the\nstatus and message of every step. Same rows as ListAsyncDeployment.\nThis is a read-only GET, so it carries a read role; an offboarding operator (who holds the\nbroader user write role) can still follow and re-run their jobs.", + "parameters": [ + { + "name": "DeploymentId", + "in": "query", + "description": "The DeploymentId handed back by ExecOffboardUser (also stored on each offboarding task) or ExecBECRemediate", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Identity.User.Read", + "x-cipp-any-tenant": true + } + }, + "/api/ListOffboardTenants": { + "post": { + "summary": "ListOffboardTenants", + "operationId": "ListOffboardTenants", + "tags": [ + "Tenant > Administration > Tenant" + ], + "description": "Lists tenants available for offboarding, including tenants in error state.", + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": {} + } + } + } + }, + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Results": { + "x-cipp-field-source": "backend" + } + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Tenant.Administration.ReadWrite" + } + }, + "/api/ListOneDriveFiles": { + "get": { + "summary": "ListOneDriveFiles", + "operationId": "ListOneDriveFiles", + "tags": [ + "Teams-Sharepoint" + ], + "parameters": [ + { + "name": "DriveId", + "in": "query", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "FolderId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "SiteId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + }, + { + "name": "UserId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "childCount": { + "x-cipp-field-source": "backend" + }, + "createdBy": { + "x-cipp-field-source": "backend" + }, + "driveId": { + "x-cipp-field-source": "backend" + }, + "fileExtension": { + "x-cipp-field-source": "backend" + }, + "id": { + "x-cipp-field-source": "backend" + }, + "isFolder": { + "x-cipp-field-source": "backend" + }, + "lastModified": { + "x-cipp-field-source": "backend" + }, + "name": { + "x-cipp-field-source": "backend" + }, + "parentId": { + "x-cipp-field-source": "backend" + }, + "parentPath": { + "x-cipp-field-source": "backend" + }, + "sizeFormatted": { + "x-cipp-field-source": "backend" + }, + "sizeInBytes": { + "x-cipp-field-source": "backend" + }, + "type": { + "x-cipp-field-source": "backend" + }, + "webUrl": { + "x-cipp-field-source": "backend" + } + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Sharepoint.Site.Read" } }, - "/api/ListOffboardingProgress": { + "/api/ListOneDriveSharing": { "get": { - "summary": "Get the live progress of an offboarding or BEC remediation job", - "operationId": "ListOffboardingProgress", + "summary": "ListOneDriveSharing", + "operationId": "ListOneDriveSharing", "tags": [ - "Identity > Administration > Users" + "Teams-Sharepoint" ], - "description": "Returns the progress rows of an offboarding job started from the wizard, or of a background BEC\nremediation (ExecBECRemediate with Async): one row per user with its overall status and the\nstatus and message of every step. Same rows as ListAsyncDeployment.\nThis is a read-only GET, so it carries a read role; an offboarding operator (who holds the\nbroader user write role) can still follow and re-run their jobs.", "parameters": [ { - "name": "DeploymentId", + "name": "DriveId", "in": "query", - "description": "The DeploymentId handed back by ExecOffboardUser (also stored on each offboarding task) or ExecBECRemediate", "required": true, "schema": { "type": "string" } - } - ], - "responses": { - "200": { - "description": "Success", - "content": { - "application/json": { - "schema": { - "type": "array", - "items": { - "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." - } - } - } - } }, - "400": { - "description": "Bad request - missing required field or invalid input" - }, - "401": { - "description": "Unauthorized - invalid or missing bearer token" + { + "name": "SiteId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } }, - "403": { - "description": "Forbidden - caller lacks the required RBAC role" - } - }, - "security": [ { - "bearerAuth": [] + "$ref": "#/components/parameters/tenantFilter" } ], - "x-cipp-role": "Identity.User.Read", - "x-cipp-any-tenant": true - } - }, - "/api/ListOffboardTenants": { - "post": { - "summary": "ListOffboardTenants", - "operationId": "ListOffboardTenants", - "tags": [ - "Tenant > Administration > Tenant" - ], - "description": "Lists tenants available for offboarding, including tenants in error state.", - "requestBody": { - "required": false, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": {} - } - } - } - }, "responses": { "200": { "description": "Success", @@ -55697,7 +63520,34 @@ "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { - "Results": { + "driveId": { + "x-cipp-field-source": "backend" + }, + "id": { + "x-cipp-field-source": "backend" + }, + "lastModified": { + "x-cipp-field-source": "backend" + }, + "name": { + "x-cipp-field-source": "backend" + }, + "permissionCount": { + "x-cipp-field-source": "backend" + }, + "sharedBy": { + "x-cipp-field-source": "backend" + }, + "sharedDateTime": { + "x-cipp-field-source": "backend" + }, + "sharedWith": { + "x-cipp-field-source": "backend" + }, + "type": { + "x-cipp-field-source": "backend" + }, + "webUrl": { "x-cipp-field-source": "backend" } } @@ -55721,7 +63571,7 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Administration.ReadWrite" + "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListOoO": { @@ -56040,7 +63890,6 @@ "tags": [ "Tenant > Administration > Alerts" ], - "description": "Lists pending incoming webhook events that have not yet been processed by CIPP.", "responses": { "200": { "description": "Success", @@ -56972,6 +64821,120 @@ "x-cipp-any-tenant": true } }, + "/api/ListRiskyUsers": { + "get": { + "summary": "ListRiskyUsers", + "operationId": "ListRiskyUsers", + "tags": [ + "Identity > Administration > Users" + ], + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "properties": { + "DismissedBy": { + "type": "string", + "x-cipp-field-source": "storage,frontend" + }, + "DismissedDateTime": { + "type": "string", + "x-cipp-field-source": "storage,frontend" + }, + "ETag": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "isDeleted": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isProcessing": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "PartitionKey": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "riskDetail": { + "type": "object", + "x-cipp-field-source": "graph-entity,frontend" + }, + "riskLastUpdatedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity,frontend" + }, + "riskLevel": { + "type": "object", + "x-cipp-field-source": "graph-entity,frontend" + }, + "riskState": { + "type": "object", + "x-cipp-field-source": "graph-entity,frontend" + }, + "RowKey": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "Timestamp": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "UserDisplayName": { + "type": "string", + "x-cipp-field-source": "graph-entity,storage,frontend" + }, + "UserId": { + "type": "string", + "x-cipp-field-source": "storage" + }, + "UserPrincipalName": { + "type": "string", + "x-cipp-field-source": "graph-entity,storage,frontend" + } + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Identity.User.Read" + } + }, "/api/ListRoleAssignments": { "get": { "summary": "List Entra directory role assignments with their PIM assignment type.", @@ -57250,7 +65213,6 @@ "tags": [ "Email-Exchange > Resources" ], - "description": "Lists room mailboxes (meeting rooms) in Exchange Online for a tenant, with optional detailed view by room ID.", "parameters": [ { "name": "roomId", @@ -57846,7 +65808,6 @@ "tags": [ "CIPP > Scheduler" ], - "description": "Retrieves detailed information about a specific scheduled task by its RowKey, including execution results and task parameters.", "parameters": [ { "name": "RowKey", @@ -58666,8 +66627,17 @@ "tags": [ "Tenant > Reports" ], - "description": "Lists Microsoft 365 service health issues for a tenant: the incidents and advisories Microsoft has posted about service outages, degradations and their status, impact, affected services and timeline. For AllTenants each issue is returned once with the tenants it affects (Tenants, TenantCount). Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", + "description": "Lists Microsoft 365 service health issues for a tenant: the incidents and advisories Microsoft has posted about service outages, degradations and their status, impact, affected services and timeline. For AllTenants each issue is returned once with the tenants it affects (Tenants, TenantCount). Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants. Pass Open=true to return only unresolved issues.", "parameters": [ + { + "name": "Open", + "in": "query", + "description": "Set to true to return only unresolved issues (open incidents and advisories). Resolved issues carry their full post history, so this keeps the dashboard payload small.", + "required": false, + "schema": { + "type": "boolean" + } + }, { "$ref": "#/components/parameters/tenantFilter" }, @@ -58909,10 +66879,9 @@ { "name": "UseReportDB", "in": "query", - "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { - "type": "boolean" + "type": "string" } } ], @@ -59089,6 +67058,85 @@ "x-cipp-role": "CIPP.Core.Read" } }, + "/api/ListSharePointDocumentLibraries": { + "get": { + "summary": "ListSharePointDocumentLibraries", + "operationId": "ListSharePointDocumentLibraries", + "tags": [ + "Teams-Sharepoint" + ], + "parameters": [ + { + "name": "SiteId", + "in": "query", + "required": true, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", + "properties": { + "driveType": { + "x-cipp-field-source": "backend" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph,backend" + }, + "name": { + "type": "string", + "x-cipp-field-source": "graph,backend" + }, + "totalBytes": { + "x-cipp-field-source": "backend" + }, + "usedBytes": { + "x-cipp-field-source": "backend" + }, + "webUrl": { + "type": "string", + "x-cipp-field-source": "graph,backend" + } + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Sharepoint.Site.Read" + } + }, "/api/ListSharePointExternalUsers": { "get": { "summary": "ListSharePointExternalUsers", @@ -59131,6 +67179,259 @@ "x-cipp-role": "Sharepoint.Site.Read" } }, + "/api/ListSharePointFolders": { + "get": { + "summary": "Lists folders inside a SharePoint document library for the Image Optimizer folder picker.", + "operationId": "ListSharePointFolders", + "tags": [ + "Teams-Sharepoint" + ], + "description": "Accepts a SiteId and optional DriveId (document library). When DriveId is omitted the\ndefault document library for the site is used. Returns folder items with their id and\nlibrary-relative path so callers can scope a scan to a specific folder.", + "parameters": [ + { + "name": "DriveId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "SiteId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "properties": { + "createdBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "createdDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "description": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "displayName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "error": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "eTag": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "isPersonalSite": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "lastModifiedBy": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "lastModifiedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "name": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "parentReference": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "root": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "sharepointIds": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "siteCollection": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "webUrl": { + "type": "string", + "x-cipp-field-source": "graph-entity" + } + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Sharepoint.Site.Read" + } + }, + "/api/ListSharePointImageCandidates": { + "get": { + "summary": "Audits a SharePoint document library for large JPG/JPEG files (read-only).", + "operationId": "ListSharePointImageCandidates", + "tags": [ + "Teams-Sharepoint" + ], + "description": "Returns the SharePoint Image Optimizer result object in Audit mode. No files are\nmodified and no versions are deleted. Accepts parameters from either the query\nstring or the request body so it can be called as a GET (list) or POST.", + "parameters": [ + { + "name": "DriveId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "FolderId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "FolderPath", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "IncludeSubfolders", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "LibraryName", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "MaxFiles", + "in": "query", + "description": "This endpoint scans synchronously inside the HTTP request, which is bound by the ~230s gateway limit. Cap the scan so a large library cannot run past that limit; callers wanting a full library audit should use the queued ExecSharePointImageOptimize.", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "MinimumFileSizeMB", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "SiteId", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "SiteUrl", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Sharepoint.Site.Read" + } + }, "/api/ListSharePointPermissions": { "get": { "summary": "ListSharePointPermissions", @@ -59181,7 +67482,6 @@ "tags": [ "Teams-Sharepoint" ], - "description": "Retrieves SharePoint Online storage quota usage for a tenant, showing used and total storage.", "parameters": [ { "name": "live", @@ -59252,7 +67552,6 @@ "tags": [ "Teams-Sharepoint" ], - "description": "Retrieves SharePoint Online tenant-level settings and configuration.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" @@ -59395,6 +67694,9 @@ } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, @@ -60252,6 +68554,109 @@ "x-cipp-role": "Sharepoint.Site.Read" } }, + "/api/ListSiteLiveStorage": { + "get": { + "summary": "ListSiteLiveStorage", + "operationId": "ListSiteLiveStorage", + "tags": [ + "Teams-Sharepoint" + ], + "parameters": [ + { + "name": "SiteId", + "in": "query", + "required": true, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "displayName": { + "x-cipp-field-source": "backend" + }, + "lastModifiedDateTime": { + "x-cipp-field-source": "backend" + }, + "lockState": { + "x-cipp-field-source": "backend" + }, + "Results": { + "x-cipp-field-source": "backend" + }, + "retrievedAt": { + "x-cipp-field-source": "backend" + }, + "sharingCapability": { + "x-cipp-field-source": "backend" + }, + "siteId": { + "x-cipp-field-source": "backend" + }, + "storageAllocatedInGigabytes": { + "x-cipp-field-source": "backend" + }, + "storageAllocatedInMB": { + "x-cipp-field-source": "backend" + }, + "storagePercentage": { + "x-cipp-field-source": "backend" + }, + "storageUsedInGigabytes": { + "x-cipp-field-source": "backend" + }, + "storageUsedInMB": { + "x-cipp-field-source": "backend" + }, + "storageWarningInGigabytes": { + "x-cipp-field-source": "backend" + }, + "storageWarningInMB": { + "x-cipp-field-source": "backend" + }, + "template": { + "x-cipp-field-source": "backend" + }, + "url": { + "x-cipp-field-source": "backend" + } + } + } + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Sharepoint.Site.Read" + } + }, "/api/ListSiteMembers": { "get": { "summary": "ListSiteMembers", @@ -61338,7 +69743,7 @@ "bearerAuth": [] } ], - "x-cipp-role": "Tenant.Standards.Read" + "x-cipp-role": "Tenant.BestPracticeAnalyser.Read" } }, "/api/ListStandardsCurrentState": { @@ -61464,46 +69869,19 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "displayName": { "x-cipp-field-source": "backend" }, - "excludedTenants": { - "x-cipp-field-source": "frontend" - }, "GUID": { "x-cipp-field-source": "backend" }, "name": { "x-cipp-field-source": "backend" }, - "runManually": { - "x-cipp-field-source": "frontend" - }, - "source": { - "x-cipp-field-source": "frontend" - }, - "standards": { - "x-cipp-field-source": "frontend" - }, - "templateName": { - "x-cipp-field-source": "frontend" - }, "templates": { "x-cipp-field-source": "backend" - }, - "tenantFilter": { - "x-cipp-field-source": "frontend" - }, - "type": { - "x-cipp-field-source": "frontend" - }, - "updatedAt": { - "x-cipp-field-source": "frontend" - }, - "updatedBy": { - "x-cipp-field-source": "frontend" } } } @@ -61606,7 +69984,6 @@ "tags": [ "Teams-Sharepoint" ], - "description": "Lists Microsoft Teams teams for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "name": "ID", @@ -61627,18 +70004,10 @@ "type": "string", "x-cipp-observed-values": [ "List", + "SharedChannels", "Team" ] } - }, - { - "name": "UseReportDB", - "in": "query", - "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", - "required": false, - "schema": { - "type": "boolean" - } } ], "responses": { @@ -61650,25 +70019,28 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "ChannelInfo": { "x-cipp-field-source": "backend" }, "description": { - "x-cipp-field-source": "frontend" + "x-cipp-field-source": "backend" }, "displayName": { - "x-cipp-field-source": "frontend" + "x-cipp-field-source": "backend" }, "id": { - "x-cipp-field-source": "frontend" + "x-cipp-field-source": "backend" }, "InstalledApps": { "x-cipp-field-source": "backend" }, + "isArchived": { + "x-cipp-field-source": "backend" + }, "mailNickname": { - "x-cipp-field-source": "frontend" + "x-cipp-field-source": "backend" }, "Members": { "x-cipp-field-source": "backend" @@ -61679,11 +70051,29 @@ "Owners": { "x-cipp-field-source": "backend" }, + "SharePointCreated": { + "x-cipp-field-source": "backend" + }, + "SharePointName": { + "x-cipp-field-source": "backend" + }, + "SharePointSiteId": { + "x-cipp-field-source": "backend" + }, + "SharePointUrl": { + "x-cipp-field-source": "backend" + }, + "teamId": { + "x-cipp-field-source": "backend" + }, "TeamInfo": { "x-cipp-field-source": "backend" }, + "teamName": { + "x-cipp-field-source": "backend" + }, "visibility": { - "x-cipp-field-source": "frontend" + "x-cipp-field-source": "backend" } } } @@ -61696,9 +70086,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -61716,7 +70103,6 @@ "tags": [ "Teams-Sharepoint" ], - "description": "Lists Microsoft Teams user activity reports for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" @@ -61728,15 +70114,6 @@ "schema": { "type": "string" } - }, - { - "name": "UseReportDB", - "in": "query", - "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", - "required": false, - "schema": { - "type": "boolean" - } } ], "responses": { @@ -61748,22 +70125,67 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { + "AdHocMeetingsAttended": { + "x-cipp-field-source": "backend" + }, + "AdHocMeetingsOrganized": { + "x-cipp-field-source": "backend" + }, + "AudioDuration": { + "x-cipp-field-source": "backend" + }, "CallCount": { - "x-cipp-field-source": "backend,frontend" + "x-cipp-field-source": "backend" + }, + "displayName": { + "x-cipp-field-source": "backend" + }, + "hasOtherAction": { + "x-cipp-field-source": "backend" }, "LastActive": { - "x-cipp-field-source": "backend,frontend" + "x-cipp-field-source": "backend" }, "MeetingCount": { - "x-cipp-field-source": "backend,frontend" + "x-cipp-field-source": "backend" + }, + "MeetingsAttended": { + "x-cipp-field-source": "backend" + }, + "MeetingsOrganized": { + "x-cipp-field-source": "backend" + }, + "PrivateChat": { + "x-cipp-field-source": "backend" + }, + "reportPeriod": { + "x-cipp-field-source": "backend" + }, + "reportRefreshDate": { + "x-cipp-field-source": "backend" + }, + "ScheduledMeetingsAttended": { + "x-cipp-field-source": "backend" + }, + "ScheduledMeetingsOrganized": { + "x-cipp-field-source": "backend" + }, + "ScreenShareDuration": { + "x-cipp-field-source": "backend" }, "TeamsChat": { - "x-cipp-field-source": "backend,frontend" + "x-cipp-field-source": "backend" + }, + "totalActivity": { + "x-cipp-field-source": "backend" }, "UPN": { - "x-cipp-field-source": "backend,frontend" + "x-cipp-field-source": "backend" + }, + "VideoDuration": { + "x-cipp-field-source": "backend" } } } @@ -61776,9 +70198,6 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" - }, - "500": { - "description": "Internal server error" } }, "security": [ @@ -61789,6 +70208,132 @@ "x-cipp-role": "Teams.Activity.Read" } }, + "/api/ListTeamsAutoAttendants": { + "get": { + "summary": "ListTeamsAutoAttendants", + "operationId": "ListTeamsAutoAttendants", + "tags": [ + "Teams-Sharepoint" + ], + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Teams.Voice.Read" + } + }, + "/api/ListTeamsCallQueues": { + "get": { + "summary": "ListTeamsCallQueues", + "operationId": "ListTeamsCallQueues", + "tags": [ + "Teams-Sharepoint" + ], + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Teams.Voice.Read" + } + }, + "/api/ListTeamsDialPlans": { + "get": { + "summary": "ListTeamsDialPlans", + "operationId": "ListTeamsDialPlans", + "tags": [ + "Teams-Sharepoint" + ], + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Teams.Voice.Read" + } + }, "/api/ListTeamsLisLocation": { "get": { "summary": "ListTeamsLisLocation", @@ -61918,6 +70463,53 @@ "x-cipp-role": "Teams.Voice.Read" } }, + "/api/ListTeamsSettings": { + "get": { + "summary": "ListTeamsSettings", + "operationId": "ListTeamsSettings", + "tags": [ + "Teams-Sharepoint" + ], + "parameters": [ + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", + "properties": { + "Results": { + "x-cipp-field-source": "backend" + } + } + } + } + } + } + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Teams.Group.Read" + } + }, "/api/ListTeamsVoice": { "get": { "summary": "ListTeamsVoice", @@ -61949,7 +70541,7 @@ "type": "array", "items": { "type": "object", - "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "aboutMe": { "type": "string", @@ -61959,15 +70551,6 @@ "type": "boolean", "x-cipp-field-source": "graph-entity" }, - "AcquiredCapabilities": { - "x-cipp-field-source": "frontend" - }, - "AcquisitionDate": { - "x-cipp-field-source": "frontend" - }, - "ActivationState": { - "x-cipp-field-source": "frontend" - }, "ageGroup": { "type": "string", "x-cipp-field-source": "graph-entity" @@ -61983,12 +70566,6 @@ "AssignedTo": { "x-cipp-field-source": "backend" }, - "AssignedTo.userPrincipalName": { - "x-cipp-field-source": "frontend" - }, - "AssignmentStatus": { - "x-cipp-field-source": "frontend" - }, "authorizationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" @@ -62058,7 +70635,7 @@ "x-cipp-field-source": "graph-entity" }, "EmergencyLocation": { - "x-cipp-field-source": "backend,frontend" + "x-cipp-field-source": "backend" }, "employeeHireDate": { "type": "string", @@ -62136,12 +70713,6 @@ "type": "boolean", "x-cipp-field-source": "graph-entity" }, - "IsoCountryCode": { - "x-cipp-field-source": "frontend" - }, - "IsOperatorConnect": { - "x-cipp-field-source": "frontend" - }, "isResourceAccount": { "type": "boolean", "x-cipp-field-source": "graph-entity" @@ -62182,9 +70753,6 @@ "type": "string", "x-cipp-field-source": "graph-entity" }, - "NumberType": { - "x-cipp-field-source": "frontend" - }, "officeLocation": { "type": "string", "x-cipp-field-source": "graph-entity" @@ -62249,9 +70817,6 @@ "type": "array", "x-cipp-field-source": "graph-entity" }, - "PlaceName": { - "x-cipp-field-source": "frontend" - }, "postalCode": { "type": "string", "x-cipp-field-source": "graph-entity" @@ -62328,9 +70893,6 @@ "type": "string", "x-cipp-field-source": "graph-entity" }, - "TelephoneNumber": { - "x-cipp-field-source": "frontend" - }, "usageLocation": { "type": "string", "x-cipp-field-source": "graph-entity" @@ -62367,6 +70929,83 @@ "x-cipp-role": "Teams.Voice.Read" } }, + "/api/ListTempFileScanResults": { + "post": { + "summary": "ListTempFileScanResults", + "operationId": "ListTempFileScanResults", + "tags": [ + "Teams-Sharepoint" + ], + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": {} + } + } + } + }, + "parameters": [ + { + "name": "queueId", + "in": "query", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "Reference", + "in": "query", + "required": false, + "schema": { + "type": "string" + } + }, + { + "$ref": "#/components/parameters/tenantFilter" + } + ], + "responses": { + "200": { + "description": "Success", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/StandardResults" + } + } + } + }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, + "401": { + "description": "Unauthorized - invalid or missing bearer token" + }, + "403": { + "description": "Forbidden - caller lacks the required RBAC role" + }, + "404": { + "description": "Not found" + }, + "500": { + "description": "Internal server error" + } + }, + "security": [ + { + "bearerAuth": [] + } + ], + "x-cipp-role": "Sharepoint.Site.ReadWrite", + "x-cipp-reads-via": [ + "Get-CIPPQueueData" + ] + } + }, "/api/ListTenantAlignment": { "get": { "summary": "ListTenantAlignment", @@ -63055,6 +71694,16 @@ { "name": "IncludeOffboardingDefaults", "in": "query", + "description": "IncludeOffboardingDefaults is the pre-rename query parameter and still accepted.", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "IncludeTenantDefaults", + "in": "query", + "description": "IncludeOffboardingDefaults is the pre-rename query parameter and still accepted.", "required": false, "schema": { "type": "string" @@ -63159,6 +71808,16 @@ { "name": "IncludeOffboardingDefaults", "in": "query", + "description": "IncludeOffboardingDefaults is the pre-rename query parameter and still accepted.", + "required": false, + "schema": { + "type": "string" + } + }, + { + "name": "IncludeTenantDefaults", + "in": "query", + "description": "IncludeOffboardingDefaults is the pre-rename query parameter and still accepted.", "required": false, "schema": { "type": "string" @@ -63525,7 +72184,6 @@ "tags": [ "Email-Exchange > Transport" ], - "description": "Lists mail flow (transport) rules configured in Exchange Online, with optional detailed view by rule ID.", "parameters": [ { "name": "id", @@ -63736,7 +72394,6 @@ "tags": [ "Identity > Administration > Users" ], - "description": "Returns summary counts of total users, licensed users, and global administrators for a tenant.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" @@ -63974,7 +72631,6 @@ "tags": [ "Identity > Administration > Users" ], - "description": "Retrieves detailed Exchange Online mailbox properties for a specific user, including quotas, archive status, and protocols.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" @@ -64113,6 +72769,9 @@ }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "500": { + "description": "Internal server error" } }, "security": [ @@ -64615,12 +73274,11 @@ "tags": [ "Identity > Administration > Users" ], - "description": "Retrieves the profile photo for a specific Entra ID user, returned as a base64-encoded image.", + "description": "Retrieves the profile photo for a specific Entra ID user as raw image bytes.", "parameters": [ { "name": "tenantFilter", "in": "query", - "description": "Interact with query parameters or the body of the request.", "required": false, "schema": { "type": "string" @@ -64644,17 +73302,349 @@ "type": "array", "items": { "type": "object", - "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." + "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", + "properties": { + "aboutMe": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "accountEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "ageGroup": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "assignedLicenses": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "assignedPlans": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "authorizationInfo": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "birthday": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "businessPhones": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "city": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "companyName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "consentProvidedForMinor": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "country": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "createdDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "creationType": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "customSecurityAttributes": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "deletedDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "department": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "deviceEnrollmentLimit": { + "type": "integer", + "x-cipp-field-source": "graph-entity" + }, + "displayName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeHireDate": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeLeaveDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "employeeOrgData": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "employeeType": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "externalUserState": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "externalUserStateChangeDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "faxNumber": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "givenName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "hireDate": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "id": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "identities": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "identityParentId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "imAddresses": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "interests": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "isManagementRestricted": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "isResourceAccount": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "jobTitle": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "lastPasswordChangeDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "legalAgeGroupClassification": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "licenseAssignmentStates": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "mail": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "mailboxSettings": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "mailNickname": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "mobilePhone": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "mySite": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "officeLocation": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesDistinguishedName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesDomainName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesExtensionAttributes": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesImmutableId": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesLastSyncDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesProvisioningErrors": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSamAccountName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSecurityIdentifier": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesSyncEnabled": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "onPremisesUserPrincipalName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "otherMails": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "passwordPolicies": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "passwordProfile": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "pastProjects": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "postalCode": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "preferredDataLocation": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "preferredLanguage": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "preferredName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "print": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "provisionedPlans": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "proxyAddresses": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "responsibilities": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "schools": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "securityIdentifier": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "serviceProvisioningErrors": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "showInAddressList": { + "type": "boolean", + "x-cipp-field-source": "graph-entity" + }, + "signInActivity": { + "type": "object", + "x-cipp-field-source": "graph-entity" + }, + "signInSessionsValidFromDateTime": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "skills": { + "type": "array", + "x-cipp-field-source": "graph-entity" + }, + "state": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "streetAddress": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "surname": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "usageLocation": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "userPrincipalName": { + "type": "string", + "x-cipp-field-source": "graph-entity" + }, + "userType": { + "type": "string", + "x-cipp-field-source": "graph-entity" + } + } } } } } }, + "400": { + "description": "Bad request - missing required field or invalid input" + }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" + }, + "404": { + "description": "Not found" } }, "security": [ @@ -65732,7 +74722,6 @@ "tags": [ "Identity > Administration > Users" ], - "description": "Retrieves the current CIPP user's personal settings and preferences.", "responses": { "200": { "description": "Success", @@ -65747,6 +74736,9 @@ "currentTheme": { "x-cipp-field-source": "backend" }, + "customBranding": { + "x-cipp-field-source": "backend" + }, "direction": { "x-cipp-field-source": "backend" }, @@ -68829,7 +77821,17 @@ "in": "query", "required": false, "schema": { - "type": "string" + "type": "string", + "enum": [ + "androidManagedAppProtection", + "iosManagedAppProtection", + "managedAppPolicies", + "mdmWindowsInformationProtectionPolicy", + "mobileAppConfigurations", + "targetedManagedAppConfiguration", + "windowsInformationProtectionPolicy", + "windowsManagedAppProtection" + ] } } ], diff --git a/backend/Config/standards.json b/backend/Config/standards.json index 5dba5122d5..acc7707647 100644 --- a/backend/Config/standards.json +++ b/backend/Config/standards.json @@ -14,9 +14,18 @@ "label": "Pin Microsoft 365 Copilot Chat", "name": "standards.CopilotSettings.copilotChatPinning", "options": [ - { "label": "Do not configure", "value": "donotconfigure" }, - { "label": "Enabled", "value": "1" }, - { "label": "Disabled", "value": "0" } + { + "label": "Do not configure", + "value": "donotconfigure" + }, + { + "label": "Enabled", + "value": "1" + }, + { + "label": "Disabled", + "value": "0" + } ] }, { @@ -26,9 +35,18 @@ "label": "Copilot Access to Open Content", "name": "standards.CopilotSettings.blockAccessToOpenFiles", "options": [ - { "label": "Do not configure", "value": "donotconfigure" }, - { "label": "Block open content", "value": "1" }, - { "label": "Allow open content", "value": "0" } + { + "label": "Do not configure", + "value": "donotconfigure" + }, + { + "label": "Block open content", + "value": "1" + }, + { + "label": "Allow open content", + "value": "0" + } ] }, { @@ -38,9 +56,18 @@ "label": "Designer Image Generation", "name": "standards.CopilotSettings.imageGeneration", "options": [ - { "label": "Do not configure", "value": "donotconfigure" }, - { "label": "Disabled", "value": "1" }, - { "label": "Enabled", "value": "0" } + { + "label": "Do not configure", + "value": "donotconfigure" + }, + { + "label": "Disabled", + "value": "1" + }, + { + "label": "Enabled", + "value": "0" + } ] }, { @@ -50,9 +77,18 @@ "label": "Web Search in Copilot", "name": "standards.CopilotSettings.allowWebSearch", "options": [ - { "label": "Do not configure", "value": "donotconfigure" }, - { "label": "Enabled in Microsoft 365 Copilot and Microsoft 365 Copilot Chat", "value": "0" }, - { "label": "Disabled in Microsoft 365 Copilot and Microsoft 365 Copilot Chat", "value": "1" }, + { + "label": "Do not configure", + "value": "donotconfigure" + }, + { + "label": "Enabled in Microsoft 365 Copilot and Microsoft 365 Copilot Chat", + "value": "0" + }, + { + "label": "Disabled in Microsoft 365 Copilot and Microsoft 365 Copilot Chat", + "value": "1" + }, { "label": "Disabled in Microsoft 365 Copilot Work mode, Enabled in Microsoft 365 Copilot Chat", "value": "2" @@ -66,9 +102,18 @@ "label": "Admin Copilot in Microsoft 365 Admin Center", "name": "standards.CopilotSettings.allowInAdminCenters", "options": [ - { "label": "Do not configure", "value": "donotconfigure" }, - { "label": "Enabled", "value": "1" }, - { "label": "Disabled", "value": "0" } + { + "label": "Do not configure", + "value": "donotconfigure" + }, + { + "label": "Enabled", + "value": "1" + }, + { + "label": "Disabled", + "value": "0" + } ] } ], @@ -190,7 +235,9 @@ "impactColour": "info", "addedDate": "2024-03-19", "powershellEquivalent": "New-MailContact", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -222,12 +269,18 @@ } ], "label": "Deploy Mail Contact Template", - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "Low Impact", "impactColour": "info", "addedDate": "2025-05-31", "powershellEquivalent": "New-MailContact", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -239,8 +292,16 @@ { "name": "standards.AuditLog", "cat": "Global Standards", - "tag": ["CIS M365 7.0.0 (3.1.1)", "mip_search_auditlog", "NIST CSF 2.0 (DE.CM-09)"], - "appliesToTest": ["CISAMSEXO171", "CISAMSEXO173", "CIS_3_1_1"], + "tag": [ + "CIS M365 7.0.0 (3.1.1)", + "mip_search_auditlog", + "NIST CSF 2.0 (DE.CM-09)" + ], + "appliesToTest": [ + "CISAMSEXO171", + "CISAMSEXO173", + "CIS_3_1_1" + ], "helpText": "Enables the Unified Audit Log for tracking and auditing activities. Also runs Enable-OrganizationCustomization if necessary.", "executiveText": "Activates comprehensive activity logging across Microsoft 365 services to track user actions, system changes, and security events. This provides essential audit trails for compliance requirements, security investigations, and regulatory reporting.", "addedComponent": [], @@ -249,7 +310,10 @@ "impactColour": "info", "addedDate": "2021-11-16", "powershellEquivalent": "Enable-OrganizationCustomization", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -261,8 +325,12 @@ { "name": "standards.RestrictThirdPartyStorageServices", "cat": "Global Standards", - "tag": ["CIS M365 7.0.0 (1.3.7)"], - "appliesToTest": ["CIS_1_3_7"], + "tag": [ + "CIS M365 7.0.0 (1.3.7)" + ], + "appliesToTest": [ + "CIS_1_3_7" + ], "helpText": "Restricts third-party storage services in Microsoft 365 on the web by managing the Microsoft 365 on the web service principal. This disables integrations with services like Dropbox, Google Drive, Box, and other third-party storage providers.", "docsDescription": "Third-party storage can be enabled for users in Microsoft 365, allowing them to store and share documents using services such as Dropbox, alongside OneDrive and team sites. This standard ensures Microsoft 365 on the web third-party storage services are restricted by creating and disabling the Microsoft 365 on the web service principal (appId: c1f33bc0-bdb4-4248-ba9b-096807ddb43e). By using external storage services an organization may increase the risk of data breaches and unauthorized access to confidential information. Additionally, third-party services may not adhere to the same security standards as the organization, making it difficult to maintain data privacy and security. Impact is highly dependent upon current practices - if users do not use other storage providers, then minimal impact is likely. However, if users regularly utilize providers outside of the tenant this will affect their ability to continue to do so.", "executiveText": "Prevents employees from using external cloud storage services like Dropbox, Google Drive, and Box within Microsoft 365, reducing data security risks and ensuring all company data remains within controlled corporate systems. This helps maintain data governance and prevents potential data leaks to unauthorized platforms.", @@ -272,7 +340,9 @@ "impactColour": "warning", "addedDate": "2025-06-06", "powershellEquivalent": "New-MgServicePrincipal and Update-MgServicePrincipal", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -297,8 +367,14 @@ "label": "Select value", "name": "standards.ProfilePhotos.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] } ], @@ -327,10 +403,20 @@ "impact": "Low Impact", "impactColour": "info", "addedDate": "2024-01-22", - "disabledFeatures": { "report": true, "warn": true, "remediate": false }, + "disabledFeatures": { + "report": true, + "warn": true, + "remediate": false + }, "powershellEquivalent": "Portal only", - "recommendedBy": ["CIPP"], - "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2", "OFFICE_BUSINESS"] + "recommendedBy": [ + "CIPP" + ], + "requiredCapabilities": [ + "AAD_PREMIUM", + "AAD_PREMIUM_P2", + "OFFICE_BUSINESS" + ] }, { "name": "standards.Branding", @@ -362,12 +448,26 @@ "label": "Visual Template", "name": "standards.Branding.layoutTemplateType", "options": [ - { "label": "Full-screen background", "value": "default" }, - { "label": "Partial-screen background", "value": "verticalSplit" } + { + "label": "Full-screen background", + "value": "default" + }, + { + "label": "Partial-screen background", + "value": "verticalSplit" + } ] }, - { "type": "switch", "name": "standards.Branding.isHeaderShown", "label": "Show header" }, - { "type": "switch", "name": "standards.Branding.isFooterShown", "label": "Show footer" } + { + "type": "switch", + "name": "standards.Branding.isHeaderShown", + "label": "Show header" + }, + { + "type": "switch", + "name": "standards.Branding.isFooterShown", + "label": "Show footer" + } ], "label": "Set branding for the tenant", "impact": "Low Impact", @@ -375,13 +475,22 @@ "addedDate": "2024-05-13", "powershellEquivalent": "Portal only", "recommendedBy": [], - "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2", "OFFICE_BUSINESS"] + "requiredCapabilities": [ + "AAD_PREMIUM", + "AAD_PREMIUM_P2", + "OFFICE_BUSINESS" + ] }, { "name": "standards.EnableCustomerLockbox", "cat": "Global Standards", - "tag": ["CIS M365 7.0.0 (1.3.6)", "CustomerLockBoxEnabled"], - "appliesToTest": ["CIS_1_3_6"], + "tag": [ + "CIS M365 7.0.0 (1.3.6)", + "CustomerLockBoxEnabled" + ], + "appliesToTest": [ + "CIS_1_3_6" + ], "helpText": "**Requires CustomerLockbox (E5, E7, A5, Purview Addon for BP, EDU or FL)** Enables Customer Lockbox that offers an approval process for Microsoft support to access organization data", "docsDescription": "**Requires CustomerLockbox (E5, E7, A5, Purview Addon for BP, EDU or FL)** Customer Lockbox ensures that Microsoft can't access your content to do service operations without your explicit approval. Customer Lockbox ensures only authorized requests allow access to your organizations data.", "executiveText": "Requires explicit organizational approval before Microsoft support staff can access company data for service operations. This provides an additional layer of data protection and ensures the organization maintains control over who can access sensitive business information, even during technical support scenarios.", @@ -391,8 +500,12 @@ "impactColour": "info", "addedDate": "2024-01-08", "powershellEquivalent": "Set-OrganizationConfig -CustomerLockBoxEnabled $true", - "recommendedBy": ["CIS"], - "requiredCapabilities": ["CustomerLockbox"] + "recommendedBy": [ + "CIS" + ], + "requiredCapabilities": [ + "CustomerLockbox" + ] }, { "name": "standards.EnablePronouns", @@ -420,7 +533,9 @@ "impact": "Low Impact", "impactColour": "info", "addedDate": "2025-06-06", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "CIPP" + ] }, { "name": "standards.AnonReportDisable", @@ -435,7 +550,9 @@ "impactColour": "info", "addedDate": "2021-11-16", "powershellEquivalent": "Update-MgBetaAdminReportSetting -BodyParameter @{displayConcealedNames = $true}", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "CIPP" + ] }, { "name": "standards.DisableGuestDirectory", @@ -467,13 +584,22 @@ "impactColour": "info", "addedDate": "2022-05-04", "powershellEquivalent": "Set-AzureADMSAuthorizationPolicy -GuestUserRoleId '2af84b1e-32c8-42b7-82bc-daa82404023b'", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "CIPP" + ] }, { "name": "standards.DisableBasicAuthSMTP", "cat": "Global Standards", - "tag": ["CIS M365 7.0.0 (6.5.4)", "NIST CSF 2.0 (PR.IR-01)"], - "appliesToTest": ["CISAMSEXO51", "CIS_6_5_4", "ZTNA21799"], + "tag": [ + "CIS M365 7.0.0 (6.5.4)", + "NIST CSF 2.0 (PR.IR-01)" + ], + "appliesToTest": [ + "CISAMSEXO51", + "CIS_6_5_4", + "ZTNA21799" + ], "helpText": "Disables SMTP AUTH organization-wide, impacting POP and IMAP clients that rely on SMTP for sending emails. Default for new tenants. For more information, see the [Microsoft documentation](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission)", "docsDescription": "Disables tenant-wide SMTP basic authentication, including for all explicitly enabled users, impacting POP and IMAP clients that rely on SMTP for sending emails. For more information, see the [Microsoft documentation](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission).", "executiveText": "Disables outdated email authentication methods that are vulnerable to security attacks, forcing applications and devices to use modern, more secure authentication protocols. This reduces the risk of email-based security breaches and credential theft.", @@ -483,7 +609,10 @@ "impactColour": "warning", "addedDate": "2021-11-16", "powershellEquivalent": "Set-TransportConfig -SmtpClientAuthenticationDisabled $true", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -495,8 +624,17 @@ { "name": "standards.ActivityBasedTimeout", "cat": "Global Standards", - "tag": ["CIS M365 7.0.0 (1.3.2)", "spo_idle_session_timeout", "NIST CSF 2.0 (PR.AA-03)"], - "appliesToTest": ["CIS_1_3_2", "ZTNA21813", "ZTNA21814", "ZTNA21815"], + "tag": [ + "CIS M365 7.0.0 (1.3.2)", + "spo_idle_session_timeout", + "NIST CSF 2.0 (PR.AA-03)" + ], + "appliesToTest": [ + "CIS_1_3_2", + "ZTNA21813", + "ZTNA21814", + "ZTNA21815" + ], "helpText": "Enables and sets Idle session timeout for Microsoft 365 to 1 hour. This policy affects most M365 web apps", "executiveText": "Automatically logs out inactive users from Microsoft 365 applications after a specified time period to prevent unauthorized access to company data on unattended devices. This security measure protects against data breaches when employees leave workstations unlocked.", "addedComponent": [ @@ -507,11 +645,26 @@ "label": "Select value", "name": "standards.ActivityBasedTimeout.timeout", "options": [ - { "label": "1 Hour", "value": "01:00:00" }, - { "label": "3 Hours", "value": "03:00:00" }, - { "label": "6 Hours", "value": "06:00:00" }, - { "label": "12 Hours", "value": "12:00:00" }, - { "label": "24 Hours", "value": "1.00:00:00" } + { + "label": "1 Hour", + "value": "01:00:00" + }, + { + "label": "3 Hours", + "value": "03:00:00" + }, + { + "label": "6 Hours", + "value": "06:00:00" + }, + { + "label": "12 Hours", + "value": "12:00:00" + }, + { + "label": "24 Hours", + "value": "1.00:00:00" + } ] } ], @@ -520,7 +673,9 @@ "impactColour": "warning", "addedDate": "2022-04-13", "powershellEquivalent": "Portal or Graph API", - "recommendedBy": ["CIS"] + "recommendedBy": [ + "CIS" + ] }, { "name": "standards.AuthMethodsSettings", @@ -552,9 +707,18 @@ "name": "standards.AuthMethodsSettings.ReportSuspiciousActivity", "label": "Report Suspicious Activity Settings", "options": [ - { "label": "Microsoft managed", "value": "default" }, - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Microsoft managed", + "value": "default" + }, + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] }, { @@ -565,9 +729,18 @@ "name": "standards.AuthMethodsSettings.SystemCredential", "label": "System Credential Preferences", "options": [ - { "label": "Microsoft managed", "value": "default" }, - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Microsoft managed", + "value": "default" + }, + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] } ], @@ -595,9 +768,18 @@ "label": "Microsoft Authenticator", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } ] }, { @@ -629,9 +811,18 @@ "label": "Number Matching", "name": "standards.AuthenticationMethods.MicrosoftAuthenticatorNumberMatching", "options": [ - { "label": "Microsoft managed", "value": "default" }, - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Microsoft managed", + "value": "default" + }, + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ], "condition": { "field": "standards.AuthenticationMethods.MicrosoftAuthenticatorEnabled", @@ -646,9 +837,18 @@ "label": "Show Application Name in Push Notifications", "name": "standards.AuthenticationMethods.MicrosoftAuthenticatorDisplayAppInfo", "options": [ - { "label": "Microsoft managed", "value": "default" }, - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Microsoft managed", + "value": "default" + }, + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ], "condition": { "field": "standards.AuthenticationMethods.MicrosoftAuthenticatorEnabled", @@ -663,9 +863,18 @@ "label": "Show Geographic Location in Push Notifications", "name": "standards.AuthenticationMethods.MicrosoftAuthenticatorDisplayLocation", "options": [ - { "label": "Microsoft managed", "value": "default" }, - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Microsoft managed", + "value": "default" + }, + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ], "condition": { "field": "standards.AuthenticationMethods.MicrosoftAuthenticatorEnabled", @@ -680,9 +889,18 @@ "label": "Companion App (Authenticator Lite)", "name": "standards.AuthenticationMethods.MicrosoftAuthenticatorCompanionApp", "options": [ - { "label": "Microsoft managed", "value": "default" }, - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Microsoft managed", + "value": "default" + }, + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ], "condition": { "field": "standards.AuthenticationMethods.MicrosoftAuthenticatorEnabled", @@ -699,9 +917,18 @@ "label": "FIDO2 Security Keys", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } ] }, { @@ -724,9 +951,18 @@ "label": "Temporary Access Pass", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } ] }, { @@ -747,8 +983,14 @@ "label": "TAP Usage Mode", "name": "standards.AuthenticationMethods.TAPUsableOnce", "options": [ - { "label": "Only Once", "value": "true" }, - { "label": "Multiple Logons", "value": "false" } + { + "label": "Only Once", + "value": "true" + }, + { + "label": "Multiple Logons", + "value": "false" + } ], "condition": { "field": "standards.AuthenticationMethods.TAPEnabled", @@ -809,9 +1051,18 @@ "label": "Third-Party Software OATH Tokens", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } ] }, { @@ -834,9 +1085,18 @@ "label": "Hardware OATH Tokens", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } ] }, { @@ -859,9 +1119,18 @@ "label": "SMS", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } ] }, { @@ -884,14 +1153,23 @@ "label": "Voice Call", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } - ] - }, - { - "type": "textField", - "name": "standards.AuthenticationMethods.VoiceGroup", + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } + ] + }, + { + "type": "textField", + "name": "standards.AuthenticationMethods.VoiceGroup", "label": "Target Group Name (wildcard supported, blank = All Users)", "required": false, "condition": { @@ -909,9 +1187,18 @@ "label": "Email OTP", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } ] }, { @@ -934,9 +1221,18 @@ "label": "Certificate-Based Authentication", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } ] }, { @@ -959,9 +1255,18 @@ "label": "QR Code Pin", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } ] }, { @@ -1003,13 +1308,20 @@ "impactColour": "danger", "addedDate": "2026-05-28", "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "CIPP" + ] }, { "name": "standards.AdminSSPR", "cat": "Entra (AAD) Standards", - "tag": ["EIDSCA.AP01"], - "appliesToTest": ["EIDSCAAP01", "ZTNA21842"], + "tag": [ + "EIDSCA.AP01" + ], + "appliesToTest": [ + "EIDSCAAP01", + "ZTNA21842" + ], "helpText": "Controls whether administrators are allowed to use Self-Service Password Reset through the Microsoft Entra authorization policy.", "docsDescription": "Configures the allowedToUseSSPR property on the Microsoft Entra authorization policy. Microsoft documents this property as controlling whether administrators of the tenant can use Self-Service Password Reset. Use this standard to explicitly enable or disable administrator SSPR based on your security policy.", "executiveText": "Controls whether tenant administrators can reset their own passwords through Self-Service Password Reset. Disabling this capability forces privileged accounts through more controlled recovery processes and reduces the risk of self-service recovery being misused on administrative identities.", @@ -1021,8 +1333,14 @@ "label": "Select value", "name": "standards.AdminSSPR.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] } ], @@ -1031,13 +1349,17 @@ "impactColour": "info", "addedDate": "2026-04-21", "powershellEquivalent": "Update-MgBetaPolicyAuthorizationPolicy", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "CIPP" + ] }, { "name": "standards.AuthMethodsPolicyMigration", "cat": "Entra (AAD) Standards", "tag": [], - "appliesToTest": ["EIDSCAAG01"], + "appliesToTest": [ + "EIDSCAAG01" + ], "helpText": "Completes the migration of authentication methods policy to the new format", "docsDescription": "Sets the authentication methods policy migration state to complete. This is required when migrating from legacy authentication policies to the new unified authentication methods policy.", "executiveText": "Completes the transition from legacy authentication policies to Microsoft's modern unified authentication methods policy, ensuring the organization benefits from the latest security features and management capabilities. This migration enables enhanced security controls and simplified policy management.", @@ -1047,7 +1369,9 @@ "impactColour": "warning", "addedDate": "2025-07-07", "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicy", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "CIPP" + ] }, { "name": "standards.AppDeploy", @@ -1064,8 +1388,14 @@ "label": "App Approval Mode", "name": "standards.AppDeploy.mode", "options": [ - { "label": "Template", "value": "template" }, - { "label": "Copy Permissions", "value": "copy" } + { + "label": "Template", + "value": "template" + }, + { + "label": "Copy Permissions", + "value": "copy" + } ] }, { @@ -1079,8 +1409,12 @@ "labelField": "TemplateName", "valueField": "TemplateId", "queryKey": "StdAppApprovalTemplateList", - "addedField": { "AppId": "AppId" }, - "templateView": { "title": "App Approval Template" } + "addedField": { + "AppId": "AppId" + }, + "templateView": { + "title": "App Approval Template" + } }, "condition": { "field": "standards.AppDeploy.mode", @@ -1109,8 +1443,17 @@ { "name": "standards.laps", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (5.1.4.5)", "SMB1001 (2.2)"], - "appliesToTest": ["CIS_5_1_4_5", "SMB1001_2_2", "ZTNA21953", "ZTNA21955", "ZTNA24560"], + "tag": [ + "CIS M365 7.0.0 (5.1.4.5)", + "SMB1001 (2.2)" + ], + "appliesToTest": [ + "CIS_5_1_4_5", + "SMB1001_2_2", + "ZTNA21953", + "ZTNA21955", + "ZTNA24560" + ], "helpText": "Enables the tenant to use LAPS. You must still create a policy for LAPS to be active on all devices. Use the template standards to deploy this by default.", "docsDescription": "Enables the LAPS functionality on the tenant. Prerequisite for using Windows LAPS via Azure AD.", "executiveText": "Enables Local Administrator Password Solution (LAPS) capability, which automatically manages and rotates local administrator passwords on company computers. This significantly improves security by preventing the use of shared or static administrator passwords that could be exploited by attackers.", @@ -1120,7 +1463,9 @@ "impactColour": "info", "addedDate": "2023-04-25", "powershellEquivalent": "Portal or Graph API", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "CIPP" + ] }, { "name": "standards.PWdisplayAppInformationRequiredState", @@ -1154,13 +1499,19 @@ "impactColour": "info", "addedDate": "2021-11-16", "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration", - "recommendedBy": ["CIS"] + "recommendedBy": [ + "CIS" + ] }, { "name": "standards.allowOTPTokens", "cat": "Entra (AAD) Standards", - "tag": ["EIDSCA.AM02"], - "appliesToTest": ["EIDSCAAM02"], + "tag": [ + "EIDSCA.AM02" + ], + "appliesToTest": [ + "EIDSCAAM02" + ], "helpText": "Allows you to use MS authenticator OTP token generator", "docsDescription": "Allows you to use Microsoft Authenticator OTP token generator. Useful for using the NPS extension as MFA on VPN clients.", "executiveText": "Enables one-time password generation through Microsoft Authenticator app, providing an additional secure authentication method for employees. This is particularly useful for secure VPN access and other systems requiring multi-factor authentication.", @@ -1175,8 +1526,14 @@ { "name": "standards.PWcompanionAppAllowedState", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (5.2.3.10)", "EIDSCA.AM01"], - "appliesToTest": ["CIS_5_2_3_10", "EIDSCAAM01"], + "tag": [ + "CIS M365 7.0.0 (5.2.3.10)", + "EIDSCA.AM01" + ], + "appliesToTest": [ + "CIS_5_2_3_10", + "EIDSCAAM01" + ], "helpText": "Sets the state of Authenticator Lite, Authenticator lite is a companion app for passwordless authentication.", "docsDescription": "Sets the Authenticator Lite state to enabled. This allows users to use the Authenticator Lite built into the Outlook app instead of the full Authenticator app.", "executiveText": "Enables a simplified authentication experience by allowing users to authenticate directly through Outlook without requiring a separate authenticator app. This improves user convenience while maintaining security standards for passwordless authentication.", @@ -1188,9 +1545,18 @@ "label": "Select value", "name": "standards.PWcompanionAppAllowedState.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" }, - { "label": "Microsoft managed", "value": "default" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + }, + { + "label": "Microsoft managed", + "value": "default" + } ] } ], @@ -1238,13 +1604,23 @@ "impactColour": "info", "addedDate": "2022-12-08", "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "CIPP" + ] }, { "name": "standards.EnableHardwareOAuth", "cat": "Entra (AAD) Standards", - "tag": ["SMB1001 (2.5)", "SMB1001 (2.6)", "SMB1001 (2.9)"], - "appliesToTest": ["SMB1001_2_5", "SMB1001_2_6", "SMB1001_2_9"], + "tag": [ + "SMB1001 (2.5)", + "SMB1001 (2.6)", + "SMB1001 (2.9)" + ], + "appliesToTest": [ + "SMB1001_2_5", + "SMB1001_2_6", + "SMB1001_2_9" + ], "helpText": "Enables the HardwareOath authenticationMethod for the tenant. This allows you to use hardware tokens for generating 6 digit MFA codes.", "docsDescription": "Enables Hardware OAuth tokens for the tenant. This allows users to use hardware tokens like a Yubikey for authentication.", "executiveText": "Enables physical hardware tokens that generate secure authentication codes, providing an alternative to smartphone-based authentication. This is particularly valuable for employees who cannot use mobile devices or require the highest security standards for accessing sensitive systems.", @@ -1259,8 +1635,14 @@ { "name": "standards.allowOAuthTokens", "cat": "Entra (AAD) Standards", - "tag": ["EIDSCA.AT01", "EIDSCA.AT02"], - "appliesToTest": ["EIDSCAAT01", "EIDSCAAT02"], + "tag": [ + "EIDSCA.AT01", + "EIDSCA.AT02" + ], + "appliesToTest": [ + "EIDSCAAT01", + "EIDSCAAT02" + ], "helpText": "Allows you to use any software OAuth token generator", "docsDescription": "Enables OTP Software OAuth tokens for the tenant. This allows users to use OTP codes generated via software, like a password manager to be used as an authentication method.", "executiveText": "Allows employees to use third-party authentication apps and password managers to generate secure login codes, providing flexibility in authentication methods while maintaining security standards. This accommodates diverse user preferences and existing security tools.", @@ -1275,8 +1657,14 @@ { "name": "standards.FormsPhishingProtection", "cat": "Global Standards", - "tag": ["CIS M365 7.0.0 (1.3.5)", "Security", "PhishingProtection"], - "appliesToTest": ["CIS_1_3_5"], + "tag": [ + "CIS M365 7.0.0 (1.3.5)", + "Security", + "PhishingProtection" + ], + "appliesToTest": [ + "CIS_1_3_5" + ], "helpText": "Enables internal phishing protection for Microsoft Forms to help prevent malicious forms from being created and shared within the organization. This feature scans forms created by internal users for potential phishing content and suspicious patterns.", "docsDescription": "Enables internal phishing protection for Microsoft Forms by setting the isInOrgFormsPhishingScanEnabled property to true. This security feature helps protect organizations from internal phishing attacks through Microsoft Forms by automatically scanning forms created by internal users for potential malicious content, suspicious links, and phishing patterns. When enabled, Forms will analyze form content and block or flag potentially dangerous forms before they can be shared within the organization.", "executiveText": "Automatically scans Microsoft Forms created by employees for malicious content and phishing attempts, preventing the creation and distribution of harmful forms within the organization. This protects against both internal threats and compromised accounts that might be used to distribute malicious content.", @@ -1286,14 +1674,22 @@ "impactColour": "info", "addedDate": "2025-06-06", "powershellEquivalent": "Graph API", - "recommendedBy": ["CIS", "CIPP"] + "recommendedBy": [ + "CIS", + "CIPP" + ] }, { "name": "standards.TAP", "cat": "Entra (AAD) Standards", "tag": [], - "appliesToTest": ["EIDSCAAT01", "EIDSCAAT02", "ZTNA21845", "ZTNA21846"], - "helpText": "Enable TAP with the specified configuration settings.", + "appliesToTest": [ + "EIDSCAAT01", + "EIDSCAAT02", + "ZTNA21845", + "ZTNA21846" + ], + "helpText": "Enables TAP and sets the default TAP lifetime to 1 hour. This configuration also allows you to select if a TAP is single use or multi-logon.", "docsDescription": "Enables Temporary Access Pass generation for the tenant.", "executiveText": "Enables temporary access passes that IT administrators can generate for employees who are locked out or need emergency access to systems. These time-limited passes provide a secure way to restore access without compromising long-term security policies.", "addedComponent": [ @@ -1303,8 +1699,14 @@ "label": "Minimum Lifetime (minutes)", "defaultValue": 60, "validators": { - "min": { "value": 10, "message": "Minimum value is 10" }, - "max": { "value": 43200, "message": "Maximum value is 43200" } + "min": { + "value": 10, + "message": "Minimum value is 10" + }, + "max": { + "value": 43200, + "message": "Maximum value is 43200" + } } }, { @@ -1313,8 +1715,14 @@ "label": "Maximum Lifetime (minutes)", "defaultValue": 480, "validators": { - "min": { "value": 10, "message": "Minimum value is 10" }, - "max": { "value": 43200, "message": "Maximum value is 43200" } + "min": { + "value": 10, + "message": "Minimum value is 10" + }, + "max": { + "value": 43200, + "message": "Maximum value is 43200" + } } }, { @@ -1323,8 +1731,14 @@ "label": "Default Lifetime (minutes)", "defaultValue": 60, "validators": { - "min": { "value": 10, "message": "Minimum value is 10" }, - "max": { "value": 43200, "message": "Maximum value is 43200" } + "min": { + "value": 10, + "message": "Minimum value is 10" + }, + "max": { + "value": 43200, + "message": "Maximum value is 43200" + } } }, { @@ -1333,8 +1747,14 @@ "label": "Length (characters)", "defaultValue": 8, "validators": { - "min": { "value": 8, "message": "Minimum value is 8" }, - "max": { "value": 48, "message": "Maximum value is 48" } + "min": { + "value": 8, + "message": "Minimum value is 8" + }, + "max": { + "value": 48, + "message": "Maximum value is 48" + } } }, { @@ -1344,8 +1764,14 @@ "label": "Number of Times Usable", "name": "standards.TAP.config", "options": [ - { "label": "Only Once", "value": "true" }, - { "label": "Multiple Logons", "value": "false" } + { + "label": "Only Once", + "value": "true" + }, + { + "label": "Multiple Logons", + "value": "false" + } ] } ], @@ -1354,13 +1780,21 @@ "impactColour": "info", "addedDate": "2022-03-15", "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "CIPP" + ] }, { "name": "standards.PasswordExpireDisabled", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (1.3.1)", "PWAgePolicyNew"], - "appliesToTest": ["CIS_1_3_1", "ZTNA21811"], + "tag": [ + "CIS M365 7.0.0 (1.3.1)", + "PWAgePolicyNew" + ], + "appliesToTest": [ + "CIS_1_3_1", + "ZTNA21811" + ], "helpText": "Disables the expiration of passwords for the tenant by setting the password expiration policy to never expire for any user.", "docsDescription": "Sets passwords to never expire for tenant, recommended to use in conjunction with secure password requirements.", "executiveText": "Eliminates mandatory password expiration requirements, allowing employees to keep strong passwords indefinitely rather than forcing frequent changes that often lead to weaker passwords. This modern security approach reduces help desk calls and improves overall password security when combined with multi-factor authentication.", @@ -1370,12 +1804,18 @@ "impactColour": "info", "addedDate": "2021-11-16", "powershellEquivalent": "Update-MgDomain", - "recommendedBy": ["CIS", "CIPP"] + "recommendedBy": [ + "CIS", + "CIPP" + ] }, { "name": "standards.CustomBannedPasswordList", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (5.2.3.2)", "SMB1001 (2.1)"], + "tag": [ + "CIS M365 7.0.0 (5.2.3.2)", + "SMB1001 (2.1)" + ], "appliesToTest": [ "CIS_5_2_3_2", "EIDSCAPR01", @@ -1404,14 +1844,22 @@ "impactColour": "warning", "addedDate": "2025-06-28", "powershellEquivalent": "Get-MgBetaDirectorySetting, New-MgBetaDirectorySetting, Update-MgBetaDirectorySetting", - "recommendedBy": ["CIS"], - "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"] + "recommendedBy": [ + "CIS" + ], + "requiredCapabilities": [ + "AAD_PREMIUM", + "AAD_PREMIUM_P2" + ] }, { "name": "standards.ExternalMFATrusted", "cat": "Entra (AAD) Standards", "tag": [], - "appliesToTest": ["ZTNA21803", "ZTNA21804"], + "appliesToTest": [ + "ZTNA21803", + "ZTNA21804" + ], "helpText": "Sets the state of the Cross-tenant access setting to trust external MFA. This allows guest users to use their home tenant MFA to access your tenant.", "executiveText": "Allows external partners and vendors to use their own organization's multi-factor authentication when accessing company resources, streamlining collaboration while maintaining security standards. This reduces friction for external users while ensuring they still meet authentication requirements.", "addedComponent": [ @@ -1422,8 +1870,14 @@ "label": "Select value", "name": "standards.ExternalMFATrusted.state", "options": [ - { "label": "Enabled", "value": "true" }, - { "label": "Disabled", "value": "false" } + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } ] } ], @@ -1448,8 +1902,14 @@ "label": "Select value", "name": "standards.ExternalComplianceTrusted.state", "options": [ - { "label": "Enabled", "value": "true" }, - { "label": "Disabled", "value": "false" } + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } ] } ], @@ -1463,8 +1923,17 @@ { "name": "standards.DisableTenantCreation", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (5.1.2.3)", "CISA (MS.AAD.6.1v1)", "SMB1001 (2.8)"], - "appliesToTest": ["CIS_5_1_2_3", "SMB1001_2_8", "ZTNA21772", "ZTNA21787"], + "tag": [ + "CIS M365 7.0.0 (5.1.2.3)", + "CISA (MS.AAD.6.1v1)", + "SMB1001 (2.8)" + ], + "appliesToTest": [ + "CIS_5_1_2_3", + "SMB1001_2_8", + "ZTNA21772", + "ZTNA21787" + ], "helpText": "Restricts creation of M365 tenants to the Global Administrator or Tenant Creator roles.", "docsDescription": "Users by default are allowed to create M365 tenants. This disables that so only admins can create new M365 tenants.", "executiveText": "Prevents regular employees from creating new Microsoft 365 organizations, ensuring all new tenants are properly managed and controlled by IT administrators. This prevents unauthorized shadow IT environments and maintains centralized governance over Microsoft 365 resources.", @@ -1474,7 +1943,10 @@ "impactColour": "info", "addedDate": "2022-11-29", "powershellEquivalent": "Update-MgPolicyAuthorizationPolicy", - "recommendedBy": ["CIS", "CIPP"] + "recommendedBy": [ + "CIS", + "CIPP" + ] }, { "name": "standards.EnableAppConsentRequests", @@ -1523,13 +1995,20 @@ "impactColour": "info", "addedDate": "2023-11-27", "powershellEquivalent": "Update-MgPolicyAdminConsentRequestPolicy", - "recommendedBy": ["CIS"] + "recommendedBy": [ + "CIS" + ] }, { "name": "standards.NudgeMFA", "cat": "Entra (AAD) Standards", - "tag": ["SMB1001 (2.5)"], - "appliesToTest": ["SMB1001_2_5", "ZTNA21889"], + "tag": [ + "SMB1001 (2.5)" + ], + "appliesToTest": [ + "SMB1001_2_5", + "ZTNA21889" + ], "helpText": "Sets the state of the registration campaign for the tenant, including the targeted authentication method, snooze settings and include/exclude groups. Leave include/exclude blank to keep the groups currently configured in the tenant, or use 'AllUsers' to target all users.", "docsDescription": "Sets the state of the registration campaign for the tenant. If enabled nudges users to set up the targeted authentication method (Microsoft Authenticator or a Passkey) during sign-in. Supports limiting the number of snoozes, and including or excluding specific groups (by display name).", "executiveText": "Prompts employees to set up multi-factor authentication during login, gradually improving the organization's security posture by encouraging adoption of stronger authentication methods. This helps achieve better security compliance without forcing immediate mandatory changes.", @@ -1541,9 +2020,18 @@ "label": "Registration campaign state", "name": "standards.NudgeMFA.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" }, - { "label": "Microsoft managed", "value": "default" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + }, + { + "label": "Microsoft managed", + "value": "default" + } ] }, { @@ -1554,8 +2042,14 @@ "label": "Authentication method to nudge users to register (default is Microsoft Authenticator)", "name": "standards.NudgeMFA.targetedAuthenticationMethod", "options": [ - { "label": "Microsoft Authenticator", "value": "microsoftAuthenticator" }, - { "label": "Passkey (FIDO2)", "value": "FIDO2" } + { + "label": "Microsoft Authenticator", + "value": "microsoftAuthenticator" + }, + { + "label": "Passkey (FIDO2)", + "value": "FIDO2" + } ], "condition": { "field": "standards.NudgeMFA.state", @@ -1569,8 +2063,14 @@ "label": "Number of days to allow users to skip registering Authenticator (0-14, default is 1)", "defaultValue": 1, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 14, "message": "Maximum value is 14" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 14, + "message": "Maximum value is 14" + } } }, { @@ -1617,8 +2117,14 @@ { "name": "standards.DisableM365GroupUsers", "cat": "Entra (AAD) Standards", - "tag": ["CISA (MS.AAD.21.1v1)", "SMB1001 (2.8)"], - "appliesToTest": ["SMB1001_2_8", "ZTNA21868"], + "tag": [ + "CISA (MS.AAD.21.1v1)", + "SMB1001 (2.8)" + ], + "appliesToTest": [ + "SMB1001_2_8", + "ZTNA21868" + ], "helpText": "Restricts M365 group creation to certain admin roles. This disables the ability to create Teams, SharePoint sites, Planner, etc. Optionally allows members of a specific security group to keep creating groups (GroupCreationAllowedGroupId).", "docsDescription": "Users by default are allowed to create M365 groups. This restricts M365 group creation to certain admin roles. This disables the ability to create Teams, SharePoint sites, Planner, etc. Optionally, a security group can be named whose members remain allowed to create groups; the group is resolved by display name in each tenant and can be created automatically when it does not exist. When no group is named, the existing GroupCreationAllowedGroupId value in the tenant is left untouched.", "executiveText": "Restricts the creation of Microsoft 365 groups, Teams, and SharePoint sites to authorized administrators, preventing uncontrolled proliferation of collaboration spaces. This ensures proper governance, naming conventions, and resource management while maintaining oversight of all collaborative environments. An approved group of designated users can optionally retain the ability to create groups.", @@ -1662,7 +2168,11 @@ "NIST CSF 2.0 (PR.AA-05)", "SMB1001 (2.8)" ], - "appliesToTest": ["CIS_5_1_2_2", "EIDSCAAP10", "SMB1001_2_8"], + "appliesToTest": [ + "CIS_5_1_2_2", + "EIDSCAAP10", + "SMB1001_2_8" + ], "helpText": "Disables the ability for users to create App registrations in the tenant.", "docsDescription": "Disables the ability for users to create applications in Entra. Done to prevent breached accounts from creating an app to maintain access to the tenant, even after the breached account has been secured.", "executiveText": "Prevents regular employees from creating application registrations that could be used to maintain unauthorized access to company systems. This security measure ensures that only authorized IT personnel can create applications, reducing the risk of persistent security breaches through malicious applications.", @@ -1672,13 +2182,21 @@ "impactColour": "info", "addedDate": "2024-03-20", "powershellEquivalent": "Update-MgPolicyAuthorizationPolicy", - "recommendedBy": ["CIS", "CIPP"] + "recommendedBy": [ + "CIS", + "CIPP" + ] }, { "name": "standards.BitLockerKeysForOwnedDevice", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (5.1.4.6)"], - "appliesToTest": ["CIS_5_1_4_6", "ZTNA21954"], + "tag": [ + "CIS M365 7.0.0 (5.1.4.6)" + ], + "appliesToTest": [ + "CIS_5_1_4_6", + "ZTNA21954" + ], "helpText": "Controls whether standard users can recover BitLocker keys for devices they own.", "docsDescription": "Updates the Microsoft Entra authorization policy that controls whether standard users can read BitLocker recovery keys for devices they own. Choose to restrict access for tighter security or allow self-service recovery when operational needs require it.", "executiveText": "Gives administrators centralized control over BitLocker recovery secrets—restrict access to ensure IT-assisted recovery flows, or allow self-service when rapid device unlocks are a priority.", @@ -1690,8 +2208,14 @@ "label": "Select state", "name": "standards.BitLockerKeysForOwnedDevice.state", "options": [ - { "label": "Restrict", "value": "restrict" }, - { "label": "Allow", "value": "allow" } + { + "label": "Restrict", + "value": "restrict" + }, + { + "label": "Allow", + "value": "allow" + } ] } ], @@ -1711,7 +2235,11 @@ "NIST CSF 2.0 (PR.AA-05)", "SMB1001 (2.8)" ], - "appliesToTest": ["CIS_5_1_3_1", "SMB1001_2_8", "ZTNA21868"], + "appliesToTest": [ + "CIS_5_1_3_1", + "SMB1001_2_8", + "ZTNA21868" + ], "helpText": "Completely disables the creation of security groups by users. This also breaks the ability to manage groups themselves, or create Teams", "executiveText": "Restricts the creation of security groups to IT administrators only, preventing employees from creating unauthorized access groups that could bypass security controls. This ensures proper governance of access permissions and maintains centralized control over who can access what resources.", "addedComponent": [], @@ -1739,9 +2267,16 @@ { "name": "standards.DisableSelfServiceLicenses", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (1.3.4)", "SMB1001 (2.8)"], - "appliesToTest": ["CIS_1_3_4", "EIDSCAAP05", "SMB1001_2_8"], - "helpText": "This standard disables all self service licenses and enables all exclusions", + "tag": [ + "CIS M365 7.0.0 (1.3.4)", + "SMB1001 (2.8)" + ], + "appliesToTest": [ + "CIS_1_3_4", + "EIDSCAAP05", + "SMB1001_2_8" + ], + "helpText": "**Requires 'Billing Administrator' GDAP role.** This standard disables all self service licenses and enables all exclusions", "executiveText": "Prevents employees from purchasing Microsoft 365 licenses independently, ensuring all software acquisitions go through proper procurement channels. This maintains budget control, prevents unauthorized spending, and ensures compliance with corporate licensing agreements.", "addedComponent": [ { @@ -1766,8 +2301,13 @@ { "name": "standards.DisableGuests", "cat": "Entra (AAD) Standards", - "tag": ["SMB1001 (2.8)"], - "appliesToTest": ["SMB1001_2_8", "ZTNA21858"], + "tag": [ + "SMB1001 (2.8)" + ], + "appliesToTest": [ + "SMB1001_2_8", + "ZTNA21858" + ], "helpText": "Blocks login for guest users whose most recent sign-in attempt, interactive or non-interactive, is older than the number of days. Optionally soft-deletes already-disabled guests after a configurable grace period past that threshold (0 = never delete). Guests that have never signed in are only included when 'Disable accounts that have not yet signed in' is enabled. Accounts an administrator re-enabled in the last 7 days are left alone. Deleted guests remain recoverable from Deleted Items for about 30 days.", "docsDescription": "Blocks login for guest users whose most recent sign-in attempt, interactive or non-interactive, is older than the number of days. Remediation first disables stale enabled guests, and later soft-deletes guests that are already disabled once they have been inactive for the disable threshold plus the configured grace delta (deletion age = days + deleteGraceDays). The disable-before-delete grace is further guaranteed by never deleting a guest in the same pass it was disabled. Guests that have never signed in are only included when 'Disable accounts that have not yet signed in' is enabled. Accounts an administrator re-enabled in the last 7 days are left alone. Graph user DELETE is a soft-delete (recoverable from Deleted Items for about 30 days), which lets a later re-invite create a clean guest object instead of colliding with a disabled account.", "executiveText": "Automatically disables external guest accounts that haven't been used for a number of days, and can optionally remove already-disabled dormant guests after an additional grace period. This reduces security risks from abandoned external access, keeps the directory clean, and avoids errors when previously disabled guests need to be invited back.", @@ -1785,7 +2325,10 @@ "label": "Grace days after disable before deletion (0 = never delete). Guests are deleted once inactive for the disable threshold plus this many additional days.", "defaultValue": 0, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" } + "min": { + "value": 0, + "message": "Minimum value is 0" + } } }, { @@ -1800,13 +2343,22 @@ "impactColour": "danger", "addedDate": "2022-10-20", "powershellEquivalent": "Graph API", - "recommendedBy": ["CIS", "CIPP"], - "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"] + "recommendedBy": [ + "CIS", + "CIPP" + ], + "requiredCapabilities": [ + "AAD_PREMIUM", + "AAD_PREMIUM_P2" + ] }, { "name": "standards.DisableInactiveUsers", "cat": "Entra (AAD) Standards", - "tag": ["CMMC (IA.L2-3.5.6)", "NIST SP 800-171 (3.5.6)"], + "tag": [ + "CMMC (IA.L2-3.5.6)", + "NIST SP 800-171 (3.5.6)" + ], "helpText": "Blocks login for cloud-only member users that have not signed in for a configurable number of days (minimum 30). Includes accounts that have never signed in when the account is older than the threshold. Hybrid (on-premises synced) users are skipped. Users without sign-in activity data are not disabled.", "docsDescription": "Disables enabled Member user accounts after a defined period of inactivity (minimum 30 days), supporting CMMC IA.L2-3.5.6 / NIST SP 800-171 3.5.6. Inactivity is based on signInActivity.lastSuccessfulSignInDateTime. Accounts that have never signed in (signInActivity present but no successful sign-in) are included when createdDateTime is older than the threshold. Users missing signInActivity entirely are skipped so incomplete Graph data cannot cause accidental disables. Hybrid-synced (onPremisesSyncEnabled) users are skipped because Entra disable often will not stick. Recently re-enabled accounts (last 7 days) are also skipped. Values below 30 days are rejected at runtime.", "executiveText": "Automatically disables unused employee accounts that have not signed in for a configured number of days, reducing risk from dormant accounts and supporting CMMC / NIST inactive-identifier requirements. Hybrid directory-synced accounts are left alone so on-premises identity remains the source of truth for those users.", @@ -1818,7 +2370,10 @@ "defaultValue": 180, "label": "Days of inactivity (minimum 30)", "validators": { - "min": { "value": 30, "message": "Minimum value is 30" } + "min": { + "value": 30, + "message": "Minimum value is 30" + } } } ], @@ -1827,8 +2382,14 @@ "impactColour": "danger", "addedDate": "2026-07-22", "powershellEquivalent": "Get-MgUser -Property SignInActivity & Update-MgUser -AccountEnabled $false", - "recommendedBy": ["CIPP", "CMMC"], - "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"] + "recommendedBy": [ + "CIPP", + "CMMC" + ], + "requiredCapabilities": [ + "AAD_PREMIUM", + "AAD_PREMIUM_P2" + ] }, { "name": "standards.OauthConsent", @@ -1869,12 +2430,17 @@ "impactColour": "warning", "addedDate": "2021-11-16", "powershellEquivalent": "Update-MgPolicyAuthorizationPolicy", - "recommendedBy": ["CIS", "CIPP"] + "recommendedBy": [ + "CIS", + "CIPP" + ] }, { "name": "standards.OauthConsentLowSec", "cat": "Entra (AAD) Standards", - "tag": ["IntegratedApps"], + "tag": [ + "IntegratedApps" + ], "helpText": "Sets the default oauth consent level so users can consent to applications that have low risks. This standard conflicts with the \"Require admin consent for applications\" standard; only one of the two should be assigned per tenant.", "docsDescription": "Allows users to consent to applications with low assigned risk. This standard conflicts with the \"Require admin consent for applications (Prevent OAuth phishing)\" (OauthConsent) standard. Enabling both on the same tenant causes a remediation conflict, so only assign one.", "executiveText": "Allows employees to approve low-risk applications without administrative intervention, balancing security with productivity. This provides a middle ground between complete restriction and open access, enabling business agility while maintaining protection against high-risk applications.", @@ -1888,8 +2454,19 @@ { "name": "standards.GuestInvite", "cat": "Entra (AAD) Standards", - "tag": ["CISA (MS.AAD.18.1v1)", "EIDSCA.AP04", "EIDSCA.AP07", "SMB1001 (2.8)"], - "appliesToTest": ["CIS_5_1_6_3", "EIDSCAAP04", "EIDSCAAP07", "SMB1001_2_8", "ZTNA21791"], + "tag": [ + "CISA (MS.AAD.18.1v1)", + "EIDSCA.AP04", + "EIDSCA.AP07", + "SMB1001 (2.8)" + ], + "appliesToTest": [ + "CIS_5_1_6_3", + "EIDSCAAP04", + "EIDSCAAP07", + "SMB1001_2_8", + "ZTNA21791" + ], "helpText": "This setting controls who can invite guests to your directory to collaborate on resources secured by your company, such as SharePoint sites or Azure resources.", "executiveText": "Controls who within the organization can invite external partners and vendors to access company resources, ensuring proper oversight of external access while enabling necessary business collaboration. This helps maintain security while supporting partnership and vendor relationships.", "addedComponent": [ @@ -1901,13 +2478,22 @@ "label": "Who can send invites?", "name": "standards.GuestInvite.allowInvitesFrom", "options": [ - { "label": "Everyone", "value": "everyone" }, + { + "label": "Everyone", + "value": "everyone" + }, { "label": "Admins, Guest inviters and All Members", "value": "adminsGuestInvitersAndAllMembers" }, - { "label": "Admins and Guest inviters", "value": "adminsAndGuestInviters" }, - { "label": "None", "value": "none" } + { + "label": "Admins and Guest inviters", + "value": "adminsAndGuestInviters" + }, + { + "label": "None", + "value": "none" + } ] } ], @@ -1921,7 +2507,11 @@ { "name": "standards.StaleEntraDevices", "cat": "Entra (AAD) Standards", - "tag": ["Essential 8 (1501)", "NIST CSF 2.0 (ID.AM-08)", "NIST CSF 2.0 (PR.PS-03)"], + "tag": [ + "Essential 8 (1501)", + "NIST CSF 2.0 (ID.AM-08)", + "NIST CSF 2.0 (PR.PS-03)" + ], "helpText": "Cleans up Entra devices that have not connected/signed in for the specified number of days. Remediation first disables stale enabled devices and, on a later run, deletes stale devices that are already disabled. Hybrid-joined, Intune-managed and Autopilot devices are skipped. Deleting a device permanently removes any BitLocker recovery keys stored on it.", "docsDescription": "Cleans up Entra devices that have not connected/signed in for the specified number of days. Remediation first disables stale enabled devices once they pass the disable threshold, and later deletes devices that are already disabled once they have been inactive for the disable threshold plus the configured grace delta (deletion age = disable threshold + grace days). The disable-before-delete grace period is further guaranteed by never deleting a device in the same pass it was disabled. Hybrid-joined (on-premises synced), Intune-managed/compliant, and system-managed Autopilot devices are excluded, in line with the [Microsoft guidance](https://learn.microsoft.com/en-us/entra/identity/devices/manage-stale-devices). **Warning:** deleting a device permanently removes any BitLocker recovery keys stored on that device object.", "executiveText": "Automatically identifies and removes inactive devices that haven't connected to company systems for a specified period, reducing security risks from abandoned or lost devices. This maintains a clean device inventory and prevents potential unauthorized access through dormant device registrations.", @@ -1933,7 +2523,10 @@ "defaultValue": 90, "label": "Days before stale (disables the device after this many days of inactivity, minimum 30)", "validators": { - "min": { "value": 30, "message": "Minimum value is 30" } + "min": { + "value": 30, + "message": "Minimum value is 30" + } } }, { @@ -1942,11 +2535,18 @@ "defaultValue": 0, "label": "Grace days after disable before deletion (0 = never delete). Devices are deleted once inactive for the disable threshold plus this many additional days.", "validators": { - "min": { "value": 0, "message": "Minimum value is 0" } + "min": { + "value": 0, + "message": "Minimum value is 0" + } } } ], - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "label": "Cleanup stale Entra devices", "impact": "High Impact", "impactColour": "danger", @@ -1972,8 +2572,18 @@ { "name": "standards.SecurityDefaults", "cat": "Entra (AAD) Standards", - "tag": ["CISA (MS.AAD.11.1v1)", "SMB1001 (2.5)", "SMB1001 (2.6)", "SMB1001 (2.9)"], - "appliesToTest": ["SMB1001_2_5", "SMB1001_2_6", "SMB1001_2_9", "ZTNA21843"], + "tag": [ + "CISA (MS.AAD.11.1v1)", + "SMB1001 (2.5)", + "SMB1001 (2.6)", + "SMB1001 (2.9)" + ], + "appliesToTest": [ + "SMB1001_2_5", + "SMB1001_2_6", + "SMB1001_2_9", + "ZTNA21843" + ], "helpText": "Enables security defaults for the tenant, for newer tenants this is enabled by default. Do not enable this feature if you use Conditional Access.", "docsDescription": "Enables SD for the tenant, which disables all forms of basic authentication and enforces users to configure MFA. Users are only prompted for MFA when a logon is considered 'suspect' by Microsoft.", "executiveText": "Activates Microsoft's baseline security configuration that requires multi-factor authentication and blocks legacy authentication methods. This provides essential security protection for organizations without complex conditional access policies, significantly improving security posture with minimal configuration.", @@ -2013,7 +2623,9 @@ "impactColour": "danger", "addedDate": "2023-12-18", "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "CIPP" + ] }, { "name": "standards.DisableVoice", @@ -2043,7 +2655,9 @@ "impactColour": "danger", "addedDate": "2023-12-18", "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "CIPP" + ] }, { "name": "standards.DisableEmail", @@ -2055,7 +2669,13 @@ "SMB1001 (2.6)", "SMB1001 (2.9)" ], - "appliesToTest": ["CIS_5_2_3_7", "SMB1001_2_5", "SMB1001_2_5_L4", "SMB1001_2_6", "SMB1001_2_9"], + "appliesToTest": [ + "CIS_5_2_3_7", + "SMB1001_2_5", + "SMB1001_2_5_L4", + "SMB1001_2_6", + "SMB1001_2_9" + ], "helpText": "This blocks users from using email as an MFA method. This disables the email OTP option for guest users, and instead prompts them to create a Microsoft account.", "executiveText": "Disables email-based authentication codes due to security concerns with email interception and account compromise. This forces users to adopt more secure authentication methods, particularly affecting guest users who must use stronger verification methods.", "addedComponent": [], @@ -2086,7 +2706,9 @@ "impactColour": "warning", "addedDate": "2026-06-03", "powershellEquivalent": "Invoke-MgGraphRequest https://graph.microsoft.com/v1.0/policies/homeRealmDiscoveryPolicies/", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "CIPP" + ] }, { "name": "standards.Disablex509Certificate", @@ -2163,7 +2785,11 @@ "creatable": false, "name": "standards.UserPreferredLanguage.preferredLanguage", "label": "Preferred Language", - "api": { "url": "/languageList.json", "labelField": "tag", "valueField": "tag" } + "api": { + "url": "/languageList.json", + "labelField": "tag", + "valueField": "tag" + } } ], "label": "Preferred language for all users", @@ -2248,8 +2874,14 @@ "name": "standards.AppManagementPolicy.passwordCredentialsPasswordAddition", "label": "Disable Password Addition", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] }, { @@ -2260,8 +2892,14 @@ "name": "standards.AppManagementPolicy.passwordCredentialsCustomPasswordAddition", "label": "Disable Custom Password", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] }, { @@ -2287,8 +2925,12 @@ { "name": "standards.OutBoundSpamAlert", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (2.1.6)"], - "appliesToTest": ["CIS_2_1_6"], + "tag": [ + "CIS M365 7.0.0 (2.1.6)" + ], + "appliesToTest": [ + "CIS_2_1_6" + ], "helpText": "Set the Outbound Spam Alert e-mail address", "docsDescription": "Sets the e-mail address to which outbound spam alerts are sent.", "addedComponent": [ @@ -2313,7 +2955,9 @@ "impactColour": "info", "addedDate": "2023-05-03", "powershellEquivalent": "Set-HostedOutboundSpamFilterPolicy", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -2356,9 +3000,18 @@ "label": "Select value", "name": "standards.GlobalQuarantineNotifications.NotificationInterval", "options": [ - { "label": "4 hours", "value": "04:00:00" }, - { "label": "1 day/Daily", "value": "1.00:00:00" }, - { "label": "7 days/Weekly", "value": "7.00:00:00" } + { + "label": "4 hours", + "value": "04:00:00" + }, + { + "label": "1 day/Daily", + "value": "1.00:00:00" + }, + { + "label": "7 days/Weekly", + "value": "7.00:00:00" + } ] } ], @@ -2389,7 +3042,9 @@ "impactColour": "info", "addedDate": "2024-04-26", "powershellEquivalent": "Set-RemoteDomain -Identity 'Default' -TNEFEnabled $false", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -2412,8 +3067,14 @@ "label": "Select value", "name": "standards.FocusedInbox.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] } ], @@ -2445,8 +3106,14 @@ "label": "Select value", "name": "standards.CloudMessageRecall.state", "options": [ - { "label": "Enabled", "value": "true" }, - { "label": "Disabled", "value": "false" } + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } ] } ], @@ -2501,8 +3168,14 @@ "label": "Select value", "name": "standards.TwoClickEmailProtection.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] } ], @@ -2523,8 +3196,14 @@ { "name": "standards.EnableOnlineArchiving", "cat": "Exchange Standards", - "tag": ["Essential 8 (1511)", "NIST CSF 2.0 (PR.DS-11)", "SMB1001 (3.1)"], - "appliesToTest": ["SMB1001_3_1"], + "tag": [ + "Essential 8 (1511)", + "NIST CSF 2.0 (PR.DS-11)", + "SMB1001 (3.1)" + ], + "appliesToTest": [ + "SMB1001_3_1" + ], "helpText": "Enables the In-Place Online Archive for all UserMailboxes with a valid license.", "executiveText": "Automatically enables online email archiving for all licensed employees, providing additional storage for older emails while maintaining easy access. This helps manage mailbox sizes, improves email performance, and supports compliance with data retention requirements.", "addedComponent": [], @@ -2545,8 +3224,12 @@ { "name": "standards.EnableLitigationHold", "cat": "Exchange Standards", - "tag": ["SMB1001 (3.1)"], - "appliesToTest": ["SMB1001_3_1"], + "tag": [ + "SMB1001 (3.1)" + ], + "appliesToTest": [ + "SMB1001_3_1" + ], "helpText": "Enables litigation hold for all UserMailboxes with a valid license.", "executiveText": "Preserves all email content for legal and compliance purposes by preventing permanent deletion of emails, even when users attempt to delete them. This is essential for organizations subject to legal discovery requirements or regulatory compliance mandates.", "addedComponent": [ @@ -2589,17 +3272,50 @@ "label": "Default font name", "helperText": "Font applied to new messages. You can type a font that is not in this list.", "options": [ - { "label": "Aptos", "value": "Aptos" }, - { "label": "Arial", "value": "Arial" }, - { "label": "Calibri", "value": "Calibri" }, - { "label": "Cambria", "value": "Cambria" }, - { "label": "Georgia", "value": "Georgia" }, - { "label": "Helvetica", "value": "Helvetica" }, - { "label": "Segoe UI", "value": "Segoe UI" }, - { "label": "Tahoma", "value": "Tahoma" }, - { "label": "Times New Roman", "value": "Times New Roman" }, - { "label": "Trebuchet MS", "value": "Trebuchet MS" }, - { "label": "Verdana", "value": "Verdana" } + { + "label": "Aptos", + "value": "Aptos" + }, + { + "label": "Arial", + "value": "Arial" + }, + { + "label": "Calibri", + "value": "Calibri" + }, + { + "label": "Cambria", + "value": "Cambria" + }, + { + "label": "Georgia", + "value": "Georgia" + }, + { + "label": "Helvetica", + "value": "Helvetica" + }, + { + "label": "Segoe UI", + "value": "Segoe UI" + }, + { + "label": "Tahoma", + "value": "Tahoma" + }, + { + "label": "Times New Roman", + "value": "Times New Roman" + }, + { + "label": "Trebuchet MS", + "value": "Trebuchet MS" + }, + { + "label": "Verdana", + "value": "Verdana" + } ] }, { @@ -2610,8 +3326,14 @@ "defaultValue": 3, "helperText": "Exchange stores a 1-7 size scale, not a point size. 3 is the Exchange default and corresponds to 12pt; lower is smaller, higher is larger.", "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 7, "message": "Maximum value is 7" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 7, + "message": "Maximum value is 7" + } } }, { @@ -2640,8 +3362,15 @@ { "name": "standards.SpoofWarn", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (6.2.3)"], - "appliesToTest": ["CISAMSEXO71", "CIS_6_2_3", "ORCA111", "ORCA240"], + "tag": [ + "CIS M365 7.0.0 (6.2.3)" + ], + "appliesToTest": [ + "CISAMSEXO71", + "CIS_6_2_3", + "ORCA111", + "ORCA240" + ], "helpText": "Adds or removes indicators to e-mail messages received from external senders in Outlook. Works on all Outlook clients/OWA", "docsDescription": "Adds or removes indicators to e-mail messages received from external senders in Outlook. You can read more about this feature on [Microsoft's Exchange Team Blog.](https://techcommunity.microsoft.com/t5/exchange-team-blog/native-external-sender-callouts-on-email-in-outlook/ba-p/2250098)", "executiveText": "Displays visual warnings in Outlook when emails come from external senders, helping employees identify potentially suspicious messages and reducing the risk of phishing attacks. This security feature makes it easier for staff to distinguish between internal and external communications.", @@ -2652,8 +3381,14 @@ "label": "Select value", "name": "standards.SpoofWarn.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] }, { @@ -2670,7 +3405,10 @@ "impactColour": "info", "addedDate": "2021-11-16", "powershellEquivalent": "Set-ExternalInOutlook –Enabled $true or $false", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -2682,8 +3420,13 @@ { "name": "standards.EnableMailTips", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (6.5.2)", "exo_mailtipsenabled"], - "appliesToTest": ["CIS_6_5_2"], + "tag": [ + "CIS M365 7.0.0 (6.5.2)", + "exo_mailtipsenabled" + ], + "appliesToTest": [ + "CIS_6_5_2" + ], "helpText": "Enables all MailTips in Outlook. MailTips are the notifications Outlook and Outlook on the web shows when an email you create, meets some requirements", "executiveText": "Enables helpful notifications in Outlook that warn users about potential email issues, such as sending to large groups, external recipients, or invalid addresses. This reduces email mistakes and improves communication efficiency by providing real-time guidance to employees.", "addedComponent": [ @@ -2700,7 +3443,10 @@ "impactColour": "info", "addedDate": "2024-01-14", "powershellEquivalent": "Set-OrganizationConfig", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -2723,8 +3469,14 @@ "label": "Select value", "name": "standards.TeamsMeetingsByDefault.state", "options": [ - { "label": "Enabled", "value": "true" }, - { "label": "Disabled", "value": "false" } + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } ] } ], @@ -2760,8 +3512,14 @@ { "name": "standards.RotateDKIM", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (2.1.9)", "SMB1001 (2.12)"], - "appliesToTest": ["CIS_2_1_9", "SMB1001_2_12"], + "tag": [ + "CIS M365 7.0.0 (2.1.9)", + "SMB1001 (2.12)" + ], + "appliesToTest": [ + "CIS_2_1_9", + "SMB1001_2_12" + ], "helpText": "Rotate DKIM keys that are 1024 bit to 2048 bit", "executiveText": "Upgrades email security by replacing older 1024-bit encryption keys with stronger 2048-bit keys for email authentication. This improves the organization's email security posture and helps prevent email spoofing and tampering, maintaining trust with email recipients.", "addedComponent": [], @@ -2770,7 +3528,10 @@ "impactColour": "info", "addedDate": "2023-03-14", "powershellEquivalent": "Rotate-DkimSigningConfig", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -2793,8 +3554,14 @@ "name": "standards.EnableExchangeCloudManagement.state", "label": "Cloud Management State", "options": [ - { "label": "Cloud Management", "value": true }, - { "label": "On-Premises Management", "value": false } + { + "label": "Cloud Management", + "value": true + }, + { + "label": "On-Premises Management", + "value": false + } ] } ], @@ -2803,7 +3570,10 @@ "impactColour": "info", "addedDate": "2026-03-28", "powershellEquivalent": "Set-Mailbox -Identity user@domain.com -IsExchangeCloudManaged $true or $false", - "recommendedBy": ["Microsoft", "CIPP"], + "recommendedBy": [ + "Microsoft", + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -2814,8 +3584,17 @@ { "name": "standards.AddDKIM", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (2.1.9)", "SMB1001 (2.12)"], - "appliesToTest": ["CISAMSEXO31", "CIS_2_1_9", "ORCA108", "ORCA108_1", "SMB1001_2_12"], + "tag": [ + "CIS M365 7.0.0 (2.1.9)", + "SMB1001 (2.12)" + ], + "appliesToTest": [ + "CISAMSEXO31", + "CIS_2_1_9", + "ORCA108", + "ORCA108_1", + "SMB1001_2_12" + ], "helpText": "Enables DKIM for all domains that currently support it", "executiveText": "Enables email authentication technology that digitally signs outgoing emails to verify they actually came from your organization. This prevents email spoofing, improves email deliverability, and protects the company's reputation by ensuring recipients can trust emails from your domains.", "addedComponent": [], @@ -2824,7 +3603,10 @@ "impactColour": "info", "addedDate": "2023-03-14", "powershellEquivalent": "New-DkimSigningConfig and Set-DkimSigningConfig", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -2836,8 +3618,16 @@ { "name": "standards.AddDMARCToMOERA", "cat": "Global Standards", - "tag": ["CIS M365 7.0.0 (2.1.10)", "Security", "PhishingProtection", "SMB1001 (2.12)"], - "appliesToTest": ["CIS_2_1_10", "SMB1001_2_12"], + "tag": [ + "CIS M365 7.0.0 (2.1.10)", + "Security", + "PhishingProtection", + "SMB1001 (2.12)" + ], + "appliesToTest": [ + "CIS_2_1_10", + "SMB1001_2_12" + ], "helpText": "** Remediation is not available ** Note: requires 'Domain Name Administrator' GDAP role. This should be enabled even if the MOERA (onmicrosoft.com) domains is not used for sending. Enabling this prevents email spoofing. The default value is 'v=DMARC1; p=reject;' recommended because the domain is only used within M365 and reporting is not needed. Omitting pct tag default to 100%", "docsDescription": "** Remediation is not available ** Note: requires 'Domain Name Administrator' GDAP role. Adds a DMARC record to MOERA (onmicrosoft.com) domains. This should be enabled even if the MOERA (onmicrosoft.com) domains is not used for sending. Enabling this prevents email spoofing. The default record is 'v=DMARC1; p=reject;' recommended because the domain is only used within M365 and reporting is not needed. Omitting pct tag default to 100%", "executiveText": "Implements advanced email security for Microsoft's default domain names (onmicrosoft.com) to prevent criminals from impersonating your organization. This blocks fraudulent emails that could damage your company's reputation and protects partners and customers from phishing attacks using your domain names.", @@ -2851,7 +3641,10 @@ "label": "Value", "name": "standards.AddDMARCToMOERA.RecordValue", "options": [ - { "label": "v=DMARC1; p=reject; (recommended)", "value": "v=DMARC1; p=reject;" } + { + "label": "v=DMARC1; p=reject; (recommended)", + "value": "v=DMARC1; p=reject;" + } ] } ], @@ -2860,8 +3653,13 @@ "impactColour": "info", "addedDate": "2025-06-16", "powershellEquivalent": "Portal only", - "recommendedBy": ["CIS", "Microsoft"], - "disabledFeatures": { "remediate": true } + "recommendedBy": [ + "CIS", + "Microsoft" + ], + "disabledFeatures": { + "remediate": true + } }, { "name": "standards.EnableMailboxAuditing", @@ -2875,7 +3673,12 @@ "Essential 8 (1683)", "NIST CSF 2.0 (DE.CM-09)" ], - "appliesToTest": ["CISAMSEXO131", "CIS_6_1_1", "CIS_6_1_2", "CIS_6_1_3"], + "appliesToTest": [ + "CISAMSEXO131", + "CIS_6_1_1", + "CIS_6_1_2", + "CIS_6_1_3" + ], "helpText": "Enables Mailbox auditing for all mailboxes and on tenant level. Disables audit bypass on all mailboxes. Unified Audit Log needs to be enabled for this standard to function.", "docsDescription": "Enables mailbox auditing on tenant level and for all mailboxes. Disables audit bypass on all mailboxes. By default Microsoft does not enable mailbox auditing for Resource Mailboxes, Public Folder Mailboxes and DiscoverySearch Mailboxes. Unified Audit Log needs to be enabled for this standard to function.", "executiveText": "Enables comprehensive logging of all email access and modifications across all employee mailboxes, providing detailed audit trails for security investigations and compliance requirements. This helps detect unauthorized access, data breaches, and supports regulatory compliance efforts.", @@ -2885,7 +3688,10 @@ "impactColour": "info", "addedDate": "2024-01-08", "powershellEquivalent": "Set-OrganizationConfig -AuditDisabled $false", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -2908,8 +3714,14 @@ "label": "Auto-Archiving Threshold Percentage (80-100, default 96, 100 disables)", "defaultValue": 96, "validators": { - "min": { "value": 80, "message": "Minimum value is 80" }, - "max": { "value": 100, "message": "Maximum value is 100" } + "min": { + "value": 80, + "message": "Minimum value is 80" + }, + "max": { + "value": 100, + "message": "Maximum value is 100" + } } } ], @@ -2942,8 +3754,14 @@ "label": "Select value", "name": "standards.AutoArchiveMailbox.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] } ], @@ -2974,8 +3792,14 @@ "label": "Send limit in MB (Default is 35)", "defaultValue": 35, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 150, "message": "Maximum value is 150" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 150, + "message": "Maximum value is 150" + } } }, { @@ -2984,8 +3808,14 @@ "label": "Receive Limit in MB (Default is 36)", "defaultValue": 36, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 150, "message": "Maximum value is 150" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 150, + "message": "Maximum value is 150" + } } } ], @@ -3010,7 +3840,11 @@ "helpText": "Sets the default sharing level for the default calendar, for all users", "docsDescription": "Sets the default sharing level for the default calendar for all users in the tenant. You can read about the different sharing levels [here.](https://learn.microsoft.com/en-us/powershell/module/exchange/set-mailboxfolderpermission?view=exchange-ps#-accessrights)", "executiveText": "Configures how much calendar information employees share by default with colleagues, balancing collaboration needs with privacy. This setting determines whether others can see meeting details, free/busy times, or just availability, helping optimize scheduling while protecting sensitive meeting information.", - "disabledFeatures": { "report": true, "warn": true, "remediate": false }, + "disabledFeatures": { + "report": true, + "warn": true, + "remediate": false + }, "addedComponent": [ { "type": "autoComplete", @@ -3042,7 +3876,10 @@ "label": "Non Editing Author - The user has full read access and create items. Can can delete only own items.", "value": "NonEditingAuthor" }, - { "label": "Reviewer - The user can read all items in the folder.", "value": "Reviewer" }, + { + "label": "Reviewer - The user can read all items in the folder.", + "value": "Reviewer" + }, { "label": "Contributor - The user can create items and folders.", "value": "Contributor" @@ -3055,7 +3892,10 @@ "label": "Limited Details - The user can view free/busy time within the calendar and the subject and location of appointments.", "value": "LimitedDetails" }, - { "label": "None - The user has no permissions on the folder.", "value": "none" } + { + "label": "None - The user has no permissions on the folder.", + "value": "none" + } ] } ], @@ -3076,8 +3916,12 @@ { "name": "standards.EXOOutboundSpamLimits", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (2.1.15)"], - "appliesToTest": ["CIS_2_1_15"], + "tag": [ + "CIS M365 7.0.0 (2.1.15)" + ], + "appliesToTest": [ + "CIS_2_1_15" + ], "helpText": "Configures the outbound spam recipient limits (external per hour, internal per hour, per day) and the action to take when a limit is reached. The 'Set Outbound Spam Alert e-mail' standard is recommended to configure together with this one. ", "docsDescription": "Configures the Exchange Online outbound spam recipient limits for external per hour, internal per hour, and per day, along with the action to take (e.g., BlockUser, Alert) when these limits are exceeded. This helps prevent abuse and manage email flow. Microsoft's recommendations can be found [here.](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365#eop-outbound-spam-policy-settings) The 'Set Outbound Spam Alert e-mail' standard is recommended to configure together with this one.", "executiveText": "Sets limits on how many emails employees can send per hour and per day to prevent spam and protect the organization's email reputation. When limits are exceeded, the system can alert administrators or temporarily block the user, helping detect compromised accounts or prevent abuse.", @@ -3088,8 +3932,14 @@ "label": "External Recipient Limit Per Hour", "defaultValue": 400, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 10000, "message": "Maximum value is 10000" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 10000, + "message": "Maximum value is 10000" + } } }, { @@ -3098,8 +3948,14 @@ "label": "Internal Recipient Limit Per Hour", "defaultValue": 800, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 10000, "message": "Maximum value is 10000" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 10000, + "message": "Maximum value is 10000" + } } }, { @@ -3108,8 +3964,14 @@ "label": "Daily Recipient Limit", "defaultValue": 800, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 10000, "message": "Maximum value is 10000" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 10000, + "message": "Maximum value is 10000" + } } }, { @@ -3119,8 +3981,14 @@ "name": "standards.EXOOutboundSpamLimits.ActionWhenThresholdReached", "label": "Action When Threshold Reached", "options": [ - { "label": "Alert", "value": "Alert" }, - { "label": "Block User", "value": "BlockUser" }, + { + "label": "Alert", + "value": "Alert" + }, + { + "label": "Block User", + "value": "BlockUser" + }, { "label": "Block user from sending mail for the rest of the day", "value": "BlockUserForToday" @@ -3133,7 +4001,10 @@ "impactColour": "info", "addedDate": "2025-05-13", "powershellEquivalent": "Set-HostedOutboundSpamFilterPolicy", - "recommendedBy": ["CIPP", "CIS"], + "recommendedBy": [ + "CIPP", + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -3145,8 +4016,15 @@ { "name": "standards.DisableExternalCalendarSharing", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (1.3.3)", "exo_individualsharing"], - "appliesToTest": ["CISAMSEXO62", "CIS_1_3_3", "ZTNA21803"], + "tag": [ + "CIS M365 7.0.0 (1.3.3)", + "exo_individualsharing" + ], + "appliesToTest": [ + "CISAMSEXO62", + "CIS_1_3_3", + "ZTNA21803" + ], "helpText": "Disables the ability for users to share their calendar with external users. Only for the default policy, so exclusions can be made if needed.", "docsDescription": "Disables external calendar sharing for the entire tenant. This is not a widely used feature, and it's therefore unlikely that this will impact users. Only for the default policy, so exclusions can be made if needed by making a new policy and assigning it to users.", "executiveText": "Prevents employees from sharing their calendars with external parties, protecting sensitive meeting information and internal schedules from unauthorized access. This security measure helps maintain confidentiality of business activities while still allowing internal collaboration.", @@ -3156,7 +4034,9 @@ "impactColour": "info", "addedDate": "2024-01-08", "powershellEquivalent": "Get-SharingPolicy | Set-SharingPolicy -Enabled $False", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -3179,13 +4059,23 @@ "addedDate": "2025-02-07", "powershellEquivalent": "Set-Mailbox -EmailAddresses @{add=$EmailAddress}", "recommendedBy": [], - "disabledFeatures": { "report": false, "warn": true, "remediate": false } + "disabledFeatures": { + "report": false, + "warn": true, + "remediate": false + } }, { "name": "standards.DisableAdditionalStorageProviders", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (6.5.3)", "exo_storageproviderrestricted"], - "appliesToTest": ["CIS_6_5_3", "ZTNA21817"], + "tag": [ + "CIS M365 7.0.0 (6.5.3)", + "exo_storageproviderrestricted" + ], + "appliesToTest": [ + "CIS_6_5_3", + "ZTNA21817" + ], "helpText": "Disables the ability for users to open files in Outlook on the Web, from other providers such as Box, Dropbox, Facebook, Google Drive, OneDrive Personal, etc.", "docsDescription": "Disables additional storage providers in OWA. This is to prevent users from using personal storage providers like Dropbox, Google Drive, etc. Usually this has little user impact.", "executiveText": "Prevents employees from accessing personal cloud storage services like Dropbox or Google Drive through Outlook on the web, reducing data security risks and ensuring company information stays within approved corporate systems. This helps maintain data governance and prevents accidental data leaks.", @@ -3195,7 +4085,9 @@ "impactColour": "info", "addedDate": "2024-01-17", "powershellEquivalent": "Get-OwaMailboxPolicy | Set-OwaMailboxPolicy -AdditionalStorageProvidersEnabled $False", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -3207,8 +4099,12 @@ { "name": "standards.AntiSpamSafeList", "cat": "Defender Standards", - "tag": ["CIS M365 7.0.0 (2.1.13)"], - "appliesToTest": ["CIS_2_1_13"], + "tag": [ + "CIS M365 7.0.0 (2.1.13)" + ], + "appliesToTest": [ + "CIS_2_1_13" + ], "helpText": "Sets the anti-spam connection filter policy option 'safe list' in Defender.", "docsDescription": "Sets [Microsoft's built-in 'safe list'](https://learn.microsoft.com/en-us/powershell/module/exchange/set-hostedconnectionfilterpolicy?view=exchange-ps#-enablesafelist) in the anti-spam connection filter policy, rather than setting a custom safe/block list of IPs.", "executiveText": "Enables Microsoft's pre-approved list of trusted email servers to improve email delivery from legitimate sources while maintaining spam protection. This reduces false positives where legitimate emails might be blocked while still protecting against spam and malicious emails.", @@ -3246,19 +4142,34 @@ "label": "Select value", "name": "standards.ShortenMeetings.ShortenEventScopeDefault", "options": [ - { "label": "Disabled/None", "value": "None" }, - { "label": "End early", "value": "EndEarly" }, - { "label": "Start late", "value": "StartLate" } - ] - }, - { - "type": "number", + { + "label": "Disabled/None", + "value": "None" + }, + { + "label": "End early", + "value": "EndEarly" + }, + { + "label": "Start late", + "value": "StartLate" + } + ] + }, + { + "type": "number", "name": "standards.ShortenMeetings.DefaultMinutesToReduceShortEventsBy", "label": "Minutes to reduce short calendar events by (Default is 5)", "defaultValue": 5, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 29, "message": "Maximum value is 29" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 29, + "message": "Maximum value is 29" + } } }, { @@ -3267,8 +4178,14 @@ "label": "Minutes to reduce long calendar events by (Default is 10)", "defaultValue": 10, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 29, "message": "Maximum value is 29" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 29, + "message": "Maximum value is 29" + } } } ], @@ -3289,8 +4206,12 @@ { "name": "standards.Bookings", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (1.3.9)"], - "appliesToTest": ["CIS_1_3_9"], + "tag": [ + "CIS M365 7.0.0 (1.3.9)" + ], + "appliesToTest": [ + "CIS_1_3_9" + ], "helpText": "Sets the state of Bookings on the tenant. Bookings is a scheduling tool that allows users to book appointments with others both internal and external.", "docsDescription": "", "executiveText": "Controls whether employees can use Microsoft Bookings to create online appointment scheduling pages for internal and external clients. This feature can improve customer service and streamline appointment management, but may need to be controlled for security or business process reasons.", @@ -3301,8 +4222,14 @@ "label": "Select value", "name": "standards.Bookings.state", "options": [ - { "label": "Enabled", "value": "true" }, - { "label": "Disabled", "value": "false" } + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } ] } ], @@ -3323,8 +4250,12 @@ { "name": "standards.EXODirectSend", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (6.5.5)"], - "appliesToTest": ["CIS_6_5_5"], + "tag": [ + "CIS M365 7.0.0 (6.5.5)" + ], + "appliesToTest": [ + "CIS_6_5_5" + ], "helpText": "Sets the state of Direct Send in Exchange Online. Direct Send allows applications to send emails directly to Exchange Online mailboxes as the tenants domains, without requiring authentication.", "docsDescription": "Controls whether applications can use Direct Send to send emails directly to Exchange Online mailboxes as the tenants domains, without requiring authentication. A detailed explanation from Microsoft can be found [here.](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365)", "executiveText": "Controls whether business applications and devices (like printers or scanners) can send emails through the company's email system without authentication. While this enables convenient features like scan-to-email, it may pose security risks and should be carefully managed.", @@ -3336,8 +4267,14 @@ "label": "Select value", "name": "standards.EXODirectSend.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] } ], @@ -3357,7 +4294,10 @@ "NIST CSF 2.0 (PR.AA-05)", "NIST CSF 2.0 (PR.PS-05)" ], - "appliesToTest": ["CIS_6_3_1", "ZTNA21817"], + "appliesToTest": [ + "CIS_6_3_1", + "ZTNA21817" + ], "helpText": "Disables the ability for users to install add-ins in Outlook. This is to prevent users from installing malicious add-ins.", "docsDescription": "Disables users from being able to install add-ins in Outlook. Only admins are able to approve add-ins for the users. This is done to reduce the threat surface for data exfiltration.", "executiveText": "Prevents employees from installing third-party add-ins in Outlook without administrative approval, reducing security risks from potentially malicious extensions. This ensures only vetted and approved tools can access company email data while maintaining centralized control over email functionality.", @@ -3367,7 +4307,9 @@ "impactColour": "warning", "addedDate": "2024-02-05", "powershellEquivalent": "Get-ManagementRoleAssignment | Remove-ManagementRoleAssignment", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -3383,13 +4325,19 @@ "helpText": "Loops through all users and removes the Safe Senders list. This is to prevent SPF bypass attacks, as the Safe Senders list is not checked by SPF.", "executiveText": "Removes user-defined safe sender lists to prevent security bypasses where malicious emails could avoid spam filtering. This ensures all emails go through proper security screening, even if users have previously marked senders as 'safe', improving overall email security.", "addedComponent": [], - "disabledFeatures": { "report": true, "warn": true, "remediate": false }, + "disabledFeatures": { + "report": true, + "warn": true, + "remediate": false + }, "label": "Remove Safe Senders to prevent SPF bypass", "impact": "Medium Impact", "impactColour": "warning", "addedDate": "2023-10-26", "powershellEquivalent": "Set-MailboxJunkEmailConfiguration", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -3441,8 +4389,14 @@ "label": "Select value", "name": "standards.SendFromAlias.state", "options": [ - { "label": "Enabled", "value": "true" }, - { "label": "Disabled", "value": "false" } + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } ] } ], @@ -3451,7 +4405,9 @@ "impactColour": "warning", "addedDate": "2022-05-25", "powershellEquivalent": "Set-Mailbox", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -3475,8 +4431,14 @@ "label": "Select value", "name": "standards.DlpViaDcsEnabled.state", "options": [ - { "label": "Enabled", "value": "true" }, - { "label": "Disabled", "value": "false" } + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } ] } ], @@ -3497,8 +4459,12 @@ { "name": "standards.UserSubmissions", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (8.6.1)"], - "appliesToTest": ["CIS_8_6_1"], + "tag": [ + "CIS M365 7.0.0 (8.6.1)" + ], + "appliesToTest": [ + "CIS_8_6_1" + ], "helpText": "Set the state of the spam submission button in Outlook", "docsDescription": "Set the state of the built-in Report button in Outlook. This gives the users the ability to report emails as spam or phish. When a destination email address is set, the 'Send reported items to' setting controls whether reported messages go to Microsoft and the reporting mailbox, or to the reporting mailbox only (for third-party phishing report services).", "executiveText": "Enables employees to easily report suspicious emails directly from Outlook, helping improve the organization's spam and phishing detection systems. This crowdsourced approach to security allows users to contribute to threat detection while providing valuable feedback to enhance email security filters.", @@ -3509,8 +4475,14 @@ "label": "Select value", "name": "standards.UserSubmissions.state", "options": [ - { "label": "Enabled", "value": "enable" }, - { "label": "Disabled", "value": "disable" } + { + "label": "Enabled", + "value": "enable" + }, + { + "label": "Disabled", + "value": "disable" + } ] }, { @@ -3525,8 +4497,14 @@ "label": "Send reported items to (when a destination email address is set)", "name": "standards.UserSubmissions.reportDestination", "options": [ - { "label": "Microsoft and my reporting mailbox", "value": "Both" }, - { "label": "My reporting mailbox only", "value": "Mailbox" } + { + "label": "Microsoft and my reporting mailbox", + "value": "Both" + }, + { + "label": "My reporting mailbox only", + "value": "Mailbox" + } ] } ], @@ -3553,7 +4531,10 @@ "NIST CSF 2.0 (PR.AA-01)", "SMB1001 (2.3)" ], - "appliesToTest": ["CIS_1_2_2", "SMB1001_2_3"], + "appliesToTest": [ + "CIS_1_2_2", + "SMB1001_2_3" + ], "helpText": "Blocks login for all accounts that are marked as a shared mailbox. This is Microsoft best practice to prevent direct logons to shared mailboxes.", "docsDescription": "Shared mailboxes can be directly logged into if the password is reset, this presents a security risk as do all shared login credentials. Microsoft's recommendation is to disable the user account for shared mailboxes. It would be a good idea to review the sign-in reports to establish potential impact.", "executiveText": "Prevents direct login to shared mailbox accounts (like info@company.com), ensuring they can only be accessed through authorized users' accounts. This security measure eliminates the risk of shared passwords and unauthorized access while maintaining proper access control and audit trails.", @@ -3563,12 +4544,17 @@ "impactColour": "warning", "addedDate": "2021-11-16", "powershellEquivalent": "Get-Mailbox & Update-MgUser", - "recommendedBy": ["CIS", "CIPP"] + "recommendedBy": [ + "CIS", + "CIPP" + ] }, { "name": "standards.TeamsDisableResourceAccounts", "cat": "Teams Standards", - "tag": ["NIST CSF 2.0 (PR.AA-01)"], + "tag": [ + "NIST CSF 2.0 (PR.AA-01)" + ], "helpText": "Blocks sign-in for all Teams resource accounts used by Auto Attendants and Call Queues. Microsoft's guidance is to block sign-in for resource accounts as they do not require an interactive login to function.", "docsDescription": "Teams resource accounts (the accounts backing Auto Attendants and Call Queues) do not require interactive sign-in to function. If sign-in is enabled and the password is reset, the account can be logged into directly, which presents a security risk. Microsoft's guidance is to block sign-in for these accounts. Accounts that are synced from on-premises AD are excluded, as account state is managed in the on-premises AD.", "executiveText": "Prevents direct login to the service accounts that power phone system features like Auto Attendants and Call Queues. These accounts work without anyone signing into them, so blocking sign-in removes an unnecessary attack surface while keeping the phone system fully functional.", @@ -3578,13 +4564,21 @@ "impactColour": "warning", "addedDate": "2026-07-17", "powershellEquivalent": "Get-CsOnlineApplicationInstance & Update-MgUser", - "recommendedBy": ["Microsoft", "CIPP"] + "recommendedBy": [ + "Microsoft", + "CIPP" + ] }, { "name": "standards.DisableResourceMailbox", "cat": "Exchange Standards", - "tag": ["NIST CSF 2.0 (PR.AA-01)", "SMB1001 (2.3)"], - "appliesToTest": ["SMB1001_2_3"], + "tag": [ + "NIST CSF 2.0 (PR.AA-01)", + "SMB1001 (2.3)" + ], + "appliesToTest": [ + "SMB1001_2_3" + ], "helpText": "Blocks login for all accounts that are marked as a resource mailbox and does not have a license assigned. Accounts that are synced from on-premises AD are excluded, as account state is managed in the on-premises AD.", "docsDescription": "Resource mailboxes can be directly logged into if the password is reset, this presents a security risk as do all shared login credentials. Microsoft's recommendation is to disable the user account for resource mailboxes. Accounts that are synced from on-premises AD are excluded, as account state is managed in the on-premises AD.", "executiveText": "Prevents direct login to resource mailbox accounts (like conference rooms or equipment), ensuring they can only be managed through proper administrative channels. This security measure eliminates potential unauthorized access to resource scheduling systems while maintaining proper booking functionality.", @@ -3594,7 +4588,10 @@ "impactColour": "warning", "addedDate": "2025-06-01", "powershellEquivalent": "Get-Mailbox & Update-MgUser", - "recommendedBy": ["Microsoft", "CIPP"], + "recommendedBy": [ + "Microsoft", + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -3613,7 +4610,9 @@ "CISA (MS.EXO.4.1v1)", "NIST CSF 2.0 (PR.DS-02)" ], - "appliesToTest": ["CIS_6_2_1"], + "appliesToTest": [ + "CIS_6_2_1" + ], "helpText": "Disables the ability for users to automatically forward e-mails to external recipients.", "docsDescription": "Disables the ability for users to automatically forward e-mails to external recipients. This is to prevent data exfiltration. Please check if there are any legitimate use cases for this feature before implementing, like forwarding invoices and such.", "executiveText": "Prevents employees from automatically forwarding company emails to external addresses, protecting against data leaks and unauthorized information sharing. This security measure helps maintain control over sensitive business communications while preventing both accidental and intentional data exfiltration.", @@ -3623,7 +4622,10 @@ "impactColour": "danger", "addedDate": "2024-07-26", "powershellEquivalent": "Set-HostedOutboundSpamFilterPolicy -AutoForwardingMode 'Off'", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -3635,8 +4637,12 @@ { "name": "standards.RetentionPolicyTag", "cat": "Exchange Standards", - "tag": ["SMB1001 (3.1)"], - "appliesToTest": ["SMB1001_3_1"], + "tag": [ + "SMB1001 (3.1)" + ], + "appliesToTest": [ + "SMB1001_3_1" + ], "helpText": "Creates a CIPP - Deleted Items retention policy tag that permanently deletes items in the Deleted Items folder after X days.", "docsDescription": "Creates a CIPP - Deleted Items retention policy tag that permanently deletes items in the Deleted Items folder after X days.", "executiveText": "Automatically and permanently removes deleted emails after a specified number of days, helping manage storage costs and ensuring compliance with data retention policies. This prevents accumulation of unnecessary deleted items while maintaining a reasonable recovery window for accidentally deleted emails.", @@ -3678,8 +4684,14 @@ "label": "Alert state (blank or Enabled creates the alert, Removed deletes it)", "name": "standards.QuarantineRequestAlert.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Removed", "value": "removed" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Removed", + "value": "removed" + } ] }, { @@ -3689,7 +4701,10 @@ "condition": { "field": "standards.QuarantineRequestAlert.state", "compareType": "isNot", - "compareValue": { "label": "Removed", "value": "removed" } + "compareValue": { + "label": "Removed", + "value": "removed" + } } } ], @@ -3742,14 +4757,20 @@ "addedDate": "2025-04-07", "powershellEquivalent": "New-ProtectionAlert and Set-ProtectionAlert", "recommendedBy": [], - "requiredCapabilities": ["RMS_S_PREMIUM2"] + "requiredCapabilities": [ + "RMS_S_PREMIUM2" + ] }, { "name": "standards.SafeLinksTemplatePolicy", "label": "SafeLinks Policy Template", "cat": "Templates", "multiple": false, - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "Medium Impact", "addedDate": "2025-04-29", "helpText": "Deploy and manage SafeLinks policy templates to protect against malicious URLs in emails and Office documents.", @@ -3845,7 +4866,9 @@ "impactColour": "info", "addedDate": "2024-03-25", "powershellEquivalent": "Set-SafeLinksPolicy or New-SafeLinksPolicy", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -3909,8 +4932,14 @@ "name": "standards.AntiPhishPolicy.PhishThresholdLevel", "defaultValue": 1, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 4, "message": "Maximum value is 4" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 4, + "message": "Maximum value is 4" + } } }, { @@ -3943,8 +4972,14 @@ "label": "If the message is detected as spoof by spoof intelligence", "name": "standards.AntiPhishPolicy.AuthenticationFailAction", "options": [ - { "label": "Quarantine the message", "value": "Quarantine" }, - { "label": "Move to Junk Folder", "value": "MoveToJmf" } + { + "label": "Quarantine the message", + "value": "Quarantine" + }, + { + "label": "Move to Junk Folder", + "value": "MoveToJmf" + } ] }, { @@ -3954,8 +4989,14 @@ "label": "Quarantine policy for Spoof", "name": "standards.AntiPhishPolicy.SpoofQuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" @@ -3968,9 +5009,18 @@ "label": "If a message is detected as user impersonation", "name": "standards.AntiPhishPolicy.TargetedUserProtectionAction", "options": [ - { "label": "Move to Junk Folder", "value": "MoveToJmf" }, - { "label": "Delete the message before its delivered", "value": "Delete" }, - { "label": "Quarantine the message", "value": "Quarantine" } + { + "label": "Move to Junk Folder", + "value": "MoveToJmf" + }, + { + "label": "Delete the message before its delivered", + "value": "Delete" + }, + { + "label": "Quarantine the message", + "value": "Quarantine" + } ] }, { @@ -3980,8 +5030,14 @@ "label": "Quarantine policy for user impersonation", "name": "standards.AntiPhishPolicy.TargetedUserQuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" @@ -3994,9 +5050,18 @@ "label": "If a message is detected as domain impersonation", "name": "standards.AntiPhishPolicy.TargetedDomainProtectionAction", "options": [ - { "label": "Move to Junk Folder", "value": "MoveToJmf" }, - { "label": "Delete the message before its delivered", "value": "Delete" }, - { "label": "Quarantine the message", "value": "Quarantine" } + { + "label": "Move to Junk Folder", + "value": "MoveToJmf" + }, + { + "label": "Delete the message before its delivered", + "value": "Delete" + }, + { + "label": "Quarantine the message", + "value": "Quarantine" + } ] }, { @@ -4010,8 +5075,14 @@ "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" }, - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" } + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + } ] }, { @@ -4020,9 +5091,18 @@ "label": "If Mailbox Intelligence detects an impersonated user", "name": "standards.AntiPhishPolicy.MailboxIntelligenceProtectionAction", "options": [ - { "label": "Move to Junk Folder", "value": "MoveToJmf" }, - { "label": "Delete the message before its delivered", "value": "Delete" }, - { "label": "Quarantine the message", "value": "Quarantine" } + { + "label": "Move to Junk Folder", + "value": "MoveToJmf" + }, + { + "label": "Delete the message before its delivered", + "value": "Delete" + }, + { + "label": "Quarantine the message", + "value": "Quarantine" + } ] }, { @@ -4032,8 +5112,14 @@ "label": "Apply quarantine policy", "name": "standards.AntiPhishPolicy.MailboxIntelligenceQuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" @@ -4046,7 +5132,9 @@ "impactColour": "info", "addedDate": "2024-03-25", "powershellEquivalent": "Set-AntiPhishPolicy or New-AntiPhishPolicy", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -4065,7 +5153,12 @@ "mdo_safeattachmentpolicy", "NIST CSF 2.0 (DE.CM-09)" ], - "appliesToTest": ["CIS_2_1_4", "ORCA158", "ORCA189", "ORCA227"], + "appliesToTest": [ + "CIS_2_1_4", + "ORCA158", + "ORCA189", + "ORCA227" + ], "helpText": "This creates a Safe Attachment policy", "addedComponent": [ { @@ -4081,9 +5174,18 @@ "label": "Safe Attachment Action", "name": "standards.SafeAttachmentPolicy.SafeAttachmentAction", "options": [ - { "label": "Allow", "value": "Allow" }, - { "label": "Block", "value": "Block" }, - { "label": "DynamicDelivery", "value": "DynamicDelivery" } + { + "label": "Allow", + "value": "Allow" + }, + { + "label": "Block", + "value": "Block" + }, + { + "label": "DynamicDelivery", + "value": "DynamicDelivery" + } ] }, { @@ -4093,15 +5195,25 @@ "label": "QuarantineTag", "name": "standards.SafeAttachmentPolicy.QuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" } ] }, - { "type": "switch", "label": "Redirect", "name": "standards.SafeAttachmentPolicy.Redirect" }, + { + "type": "switch", + "label": "Redirect", + "name": "standards.SafeAttachmentPolicy.Redirect" + }, { "type": "textField", "name": "standards.SafeAttachmentPolicy.RedirectAddress", @@ -4119,7 +5231,9 @@ "impactColour": "info", "addedDate": "2024-03-25", "powershellEquivalent": "Set-SafeAttachmentPolicy or New-SafeAttachmentPolicy", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -4131,8 +5245,14 @@ { "name": "standards.AtpPolicyForO365", "cat": "Defender Standards", - "tag": ["CIS M365 7.0.0 (2.1.5)", "NIST CSF 2.0 (DE.CM-09)"], - "appliesToTest": ["CIS_2_1_5", "ORCA225"], + "tag": [ + "CIS M365 7.0.0 (2.1.5)", + "NIST CSF 2.0 (DE.CM-09)" + ], + "appliesToTest": [ + "CIS_2_1_5", + "ORCA225" + ], "helpText": "This creates a Atp policy that enables Defender for Office 365 for SharePoint, OneDrive and Microsoft Teams.", "addedComponent": [ { @@ -4148,7 +5268,9 @@ "impactColour": "info", "addedDate": "2024-03-25", "powershellEquivalent": "Set-AtpPolicyForO365", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -4161,8 +5283,14 @@ { "name": "standards.PhishingSimulations", "cat": "Defender Standards", - "tag": ["SMB1001 (1.11)", "SMB1001 (5.1)"], - "appliesToTest": ["SMB1001_1_11", "SMB1001_5_1"], + "tag": [ + "SMB1001 (1.11)", + "SMB1001 (5.1)" + ], + "appliesToTest": [ + "SMB1001_1_11", + "SMB1001_5_1" + ], "helpText": "This creates a phishing simulation policy that enables phishing simulations for the entire tenant.", "addedComponent": [ { @@ -4254,8 +5382,14 @@ "label": "FileTypeAction", "name": "standards.MalwareFilterPolicy.FileTypeAction", "options": [ - { "label": "Reject", "value": "Reject" }, - { "label": "Quarantine the message", "value": "Quarantine" } + { + "label": "Reject", + "value": "Reject" + }, + { + "label": "Quarantine the message", + "value": "Quarantine" + } ] }, { @@ -4271,8 +5405,14 @@ "label": "QuarantineTag", "name": "standards.MalwareFilterPolicy.QuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" @@ -4319,7 +5459,9 @@ "impactColour": "info", "addedDate": "2024-03-25", "powershellEquivalent": "Set-MalwareFilterPolicy or New-MalwareFilterPolicy", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -4409,8 +5551,14 @@ "name": "standards.SpamFilterPolicy.BulkThreshold", "defaultValue": 7, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 9, "message": "Maximum value is 9" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 9, + "message": "Maximum value is 9" + } } }, { @@ -4421,8 +5569,14 @@ "label": "Spam Action", "name": "standards.SpamFilterPolicy.SpamAction", "options": [ - { "label": "Quarantine the message", "value": "Quarantine" }, - { "label": "Move message to Junk Email folder", "value": "MoveToJmf" } + { + "label": "Quarantine the message", + "value": "Quarantine" + }, + { + "label": "Move message to Junk Email folder", + "value": "MoveToJmf" + } ] }, { @@ -4433,8 +5587,14 @@ "label": "Spam Quarantine Tag", "name": "standards.SpamFilterPolicy.SpamQuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" @@ -4449,8 +5609,14 @@ "label": "High Confidence Spam Action", "name": "standards.SpamFilterPolicy.HighConfidenceSpamAction", "options": [ - { "label": "Quarantine the message", "value": "Quarantine" }, - { "label": "Move message to Junk Email folder", "value": "MoveToJmf" } + { + "label": "Quarantine the message", + "value": "Quarantine" + }, + { + "label": "Move message to Junk Email folder", + "value": "MoveToJmf" + } ] }, { @@ -4461,8 +5627,14 @@ "label": "High Confidence Spam Quarantine Tag", "name": "standards.SpamFilterPolicy.HighConfidenceSpamQuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" @@ -4477,8 +5649,14 @@ "label": "Bulk Spam Action", "name": "standards.SpamFilterPolicy.BulkSpamAction", "options": [ - { "label": "Quarantine the message", "value": "Quarantine" }, - { "label": "Move message to Junk Email folder", "value": "MoveToJmf" } + { + "label": "Quarantine the message", + "value": "Quarantine" + }, + { + "label": "Move message to Junk Email folder", + "value": "MoveToJmf" + } ] }, { @@ -4489,8 +5667,14 @@ "label": "Bulk Quarantine Tag", "name": "standards.SpamFilterPolicy.BulkQuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" @@ -4505,8 +5689,14 @@ "label": "Bulk moves enabled (deliver bulk mail below the threshold to the Promotions folder - Preview)", "name": "standards.SpamFilterPolicy.BulkMovesEnabled", "options": [ - { "label": "On", "value": "On" }, - { "label": "Off", "value": "Off" } + { + "label": "On", + "value": "On" + }, + { + "label": "Off", + "value": "Off" + } ] }, { @@ -4517,8 +5707,14 @@ "label": "Phish Spam Action", "name": "standards.SpamFilterPolicy.PhishSpamAction", "options": [ - { "label": "Quarantine the message", "value": "Quarantine" }, - { "label": "Move message to Junk Email folder", "value": "MoveToJmf" } + { + "label": "Quarantine the message", + "value": "Quarantine" + }, + { + "label": "Move message to Junk Email folder", + "value": "MoveToJmf" + } ] }, { @@ -4529,8 +5725,14 @@ "label": "Phish Quarantine Tag", "name": "standards.SpamFilterPolicy.PhishQuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" @@ -4545,8 +5747,14 @@ "label": "High Confidence Phish Quarantine Tag", "name": "standards.SpamFilterPolicy.HighConfidencePhishQuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" @@ -4661,7 +5869,11 @@ { "name": "standards.QuarantineTemplate", "cat": "Defender Standards", - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "tag": [], "helpText": "This standard creates a Custom Quarantine Policies that can be used in Anti-Spam and all MDO365 policies. Quarantine Policies can be used to specify recipients permissions, enable end-user spam notifications, and specify the release action preference", "executiveText": "Creates standardized quarantine policies that define how employees can interact with quarantined emails, including permissions to release, delete, or preview suspicious messages. This ensures consistent security handling across the organization while providing appropriate user access to manage quarantined content.", @@ -4775,7 +5987,13 @@ "addedDate": "2026-01-27", "powershellEquivalent": "Graph API", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.WindowsBackupRestore", @@ -4792,19 +6010,34 @@ "label": "Select value", "name": "standards.WindowsBackupRestore.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" }, - { "label": "Not Configured", "value": "notConfigured" } - ] - } - ], - "label": "Set Windows Backup and Restore state", - "impact": "Low Impact", - "impactColour": "info", - "addedDate": "2026-02-26", - "powershellEquivalent": "Graph API", + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + }, + { + "label": "Not Configured", + "value": "notConfigured" + } + ] + } + ], + "label": "Set Windows Backup and Restore state", + "impact": "Low Impact", + "impactColour": "info", + "addedDate": "2026-02-26", + "powershellEquivalent": "Graph API", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.intuneDeviceRetirementDays", @@ -4824,8 +6057,16 @@ "impactColour": "info", "addedDate": "2023-05-19", "powershellEquivalent": "Graph API", - "recommendedBy": ["CIPP"], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "recommendedBy": [ + "CIPP" + ], + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.intuneBrandingProfile", @@ -4900,13 +6141,23 @@ "addedDate": "2024-06-20", "powershellEquivalent": "Graph API", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.IntuneComplianceSettings", "cat": "Intune Standards", - "tag": ["CIS M365 7.0.0 (4.1)"], - "appliesToTest": ["CIS_4_1"], + "tag": [ + "CIS M365 7.0.0 (4.1)" + ], + "appliesToTest": [ + "CIS_4_1" + ], "helpText": "Sets the mark devices with no compliance policy assigned as compliance/non compliant and Compliance status validity period.", "executiveText": "Configures how the system treats devices that don't have specific compliance policies and sets how often devices must check in to maintain their compliance status. This ensures proper security oversight of all corporate devices and maintains current compliance information.", "addedComponent": [ @@ -4918,8 +6169,14 @@ "name": "standards.IntuneComplianceSettings.secureByDefault", "label": "Mark devices with no compliance policy as", "options": [ - { "label": "Compliant", "value": "false" }, - { "label": "Non-Compliant", "value": "true" } + { + "label": "Compliant", + "value": "false" + }, + { + "label": "Non-Compliant", + "value": "true" + } ] }, { @@ -4928,8 +6185,14 @@ "label": "Compliance status validity period (days)", "defaultValue": 120, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 120, "message": "Maximum value is 120" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 120, + "message": "Maximum value is 120" + } } } ], @@ -4939,7 +6202,13 @@ "addedDate": "2024-11-12", "powershellEquivalent": "Graph API", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.MDMScope", @@ -4954,9 +6223,18 @@ "label": "MDM User Scope?", "type": "radio", "options": [ - { "label": "All", "value": "all" }, - { "label": "None", "value": "none" }, - { "label": "Custom Group", "value": "selected" } + { + "label": "All", + "value": "all" + }, + { + "label": "None", + "value": "none" + }, + { + "label": "Custom Group", + "value": "selected" + } ] }, { @@ -4972,13 +6250,24 @@ "addedDate": "2025-02-18", "powershellEquivalent": "Graph API", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.DefaultPlatformRestrictions", "cat": "Intune Standards", - "tag": ["CIS M365 7.0.0 (4.2)", "CISA (MS.AAD.19.1v1)"], - "appliesToTest": ["CIS_4_2"], + "tag": [ + "CIS M365 7.0.0 (4.2)", + "CISA (MS.AAD.19.1v1)" + ], + "appliesToTest": [ + "CIS_4_2" + ], "helpText": "Sets the default platform restrictions for enrolling devices into Intune, including optional minimum and maximum OS version limits per platform (Android Enterprise, Android, iOS/iPadOS and Windows). Note: Do not block personally owned if platform is blocked.", "executiveText": "Controls which types of devices (iOS, Android, Windows, macOS) and ownership models (corporate vs. personal) can be enrolled in the company's device management system. This helps maintain security standards while supporting necessary business device types and usage scenarios.", "addedComponent": [ @@ -5105,7 +6394,13 @@ "addedDate": "2025-04-01", "powershellEquivalent": "Graph API", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.MDMEnrollmentDuringRegistration", @@ -5127,7 +6422,13 @@ "addedDate": "2025-12-15", "powershellEquivalent": "Graph API", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.EnrollmentWindowsHelloForBusinessConfiguration", @@ -5142,9 +6443,18 @@ "label": "Configure Windows Hello for Business", "multiple": false, "options": [ - { "label": "Not configured", "value": "notConfigured" }, - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Not configured", + "value": "notConfigured" + }, + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] }, { @@ -5159,8 +6469,14 @@ "label": "Minimum PIN length (4-127)", "default": 4, "validators": { - "min": { "value": 4, "message": "Minimum value is 4" }, - "max": { "value": 127, "message": "Maximum value is 127" } + "min": { + "value": 4, + "message": "Minimum value is 4" + }, + "max": { + "value": 127, + "message": "Maximum value is 127" + } } }, { @@ -5169,8 +6485,14 @@ "label": "Maximum PIN length (4-127)", "default": 127, "validators": { - "min": { "value": 4, "message": "Minimum value is 4" }, - "max": { "value": 127, "message": "Maximum value is 127" } + "min": { + "value": 4, + "message": "Minimum value is 4" + }, + "max": { + "value": 127, + "message": "Maximum value is 127" + } } }, { @@ -5179,9 +6501,18 @@ "label": "Lowercase letters in PIN", "multiple": false, "options": [ - { "label": "Not allowed", "value": "disallowed" }, - { "label": "Allowed", "value": "allowed" }, - { "label": "Required", "value": "required" } + { + "label": "Not allowed", + "value": "disallowed" + }, + { + "label": "Allowed", + "value": "allowed" + }, + { + "label": "Required", + "value": "required" + } ] }, { @@ -5190,9 +6521,18 @@ "label": "Uppercase letters in PIN", "multiple": false, "options": [ - { "label": "Not allowed", "value": "disallowed" }, - { "label": "Allowed", "value": "allowed" }, - { "label": "Required", "value": "required" } + { + "label": "Not allowed", + "value": "disallowed" + }, + { + "label": "Allowed", + "value": "allowed" + }, + { + "label": "Required", + "value": "required" + } ] }, { @@ -5201,9 +6541,18 @@ "label": "Special characters in PIN", "multiple": false, "options": [ - { "label": "Not allowed", "value": "disallowed" }, - { "label": "Allowed", "value": "allowed" }, - { "label": "Required", "value": "required" } + { + "label": "Not allowed", + "value": "disallowed" + }, + { + "label": "Allowed", + "value": "allowed" + }, + { + "label": "Required", + "value": "required" + } ] }, { @@ -5230,9 +6579,18 @@ "label": "Use enhanced anti-spoofing when available", "multiple": false, "options": [ - { "label": "Not configured", "value": "notConfigured" }, - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Not configured", + "value": "notConfigured" + }, + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] }, { @@ -5247,9 +6605,18 @@ "label": "Enable enhanced sign-in security", "multiple": false, "options": [ - { "label": "Not configured", "value": "0" }, - { "label": "Enabled on capable hardware", "value": "1" }, - { "label": "Disabled on all systems", "value": "2" } + { + "label": "Not configured", + "value": "0" + }, + { + "label": "Enabled on capable hardware", + "value": "1" + }, + { + "label": "Disabled on all systems", + "value": "2" + } ] }, { @@ -5258,9 +6625,18 @@ "label": "Use security keys for sign-in", "multiple": false, "options": [ - { "label": "Not configured", "value": "notConfigured" }, - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Not configured", + "value": "notConfigured" + }, + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] } ], @@ -5270,13 +6646,27 @@ "addedDate": "2025-09-25", "powershellEquivalent": "Graph API", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.intuneDeviceReg", "cat": "Intune Standards", - "tag": ["CIS M365 7.0.0 (5.1.4.2)", "CISA (MS.AAD.17.1v1)"], - "appliesToTest": ["CIS_5_1_4_2", "ZTNA21801", "ZTNA21802", "ZTNA21837"], + "tag": [ + "CIS M365 7.0.0 (5.1.4.2)", + "CISA (MS.AAD.17.1v1)" + ], + "appliesToTest": [ + "CIS_5_1_4_2", + "ZTNA21801", + "ZTNA21802", + "ZTNA21837" + ], "helpText": "Sets the maximum number of devices that can be registered by a user. A value of 0 disables device registration by users", "executiveText": "Limits how many devices each employee can register for corporate access, preventing excessive device proliferation while accommodating legitimate business needs. This helps maintain security oversight and prevents potential abuse of device registration privileges.", "addedComponent": [ @@ -5293,13 +6683,27 @@ "addedDate": "2023-03-27", "powershellEquivalent": "Update-MgBetaPolicyDeviceRegistrationPolicy", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.intuneDeviceRegLocalAdmins", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (5.1.4.3)", "CIS M365 7.0.0 (5.1.4.4)", "SMB1001 (2.2)"], - "appliesToTest": ["CIS_5_1_4_3", "CIS_5_1_4_4", "SMB1001_2_2"], + "tag": [ + "CIS M365 7.0.0 (5.1.4.3)", + "CIS M365 7.0.0 (5.1.4.4)", + "SMB1001 (2.2)" + ], + "appliesToTest": [ + "CIS_5_1_4_3", + "CIS_5_1_4_4", + "SMB1001_2_2" + ], "helpText": "Controls whether users who register Microsoft Entra joined devices are granted local administrator rights on those devices and if Global Administrators are added as local admins.", "docsDescription": "Configures the Device Registration Policy local administrator behavior for registering users. When enabled, users who register devices are not granted local administrator rights, you can also configure if Global Administrators are added as local admins.", "executiveText": "Controls whether employees who enroll devices automatically receive local administrator access. Disabling registering-user admin rights follows least-privilege principles and reduces security risk from over-privileged endpoints.", @@ -5350,8 +6754,14 @@ { "name": "standards.intuneRestrictUserDeviceJoin", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (5.1.4.1)", "SMB1001 (2.8)"], - "appliesToTest": ["CIS_5_1_4_1", "SMB1001_2_8"], + "tag": [ + "CIS M365 7.0.0 (5.1.4.1)", + "SMB1001 (2.8)" + ], + "appliesToTest": [ + "CIS_5_1_4_1", + "SMB1001_2_8" + ], "helpText": "Controls whether users can join devices to Entra.", "docsDescription": "Configures whether users can join devices to Entra. When disabled, users are unable to Entra-join devices, which prevents them from creating new Entra-joined (cloud-managed) device identities.", "executiveText": "Controls whether employees can join their devices to the corporate Entra directory. Disabling user device join prevents unauthorized or unmanaged devices from becoming corporate-managed identities, enhancing overall security posture.", @@ -5374,7 +6784,11 @@ "name": "standards.intuneRequireMFA", "cat": "Intune Standards", "tag": [], - "appliesToTest": ["ZTNA21782", "ZTNA21796", "ZTNA21872"], + "appliesToTest": [ + "ZTNA21782", + "ZTNA21796", + "ZTNA21872" + ], "helpText": "Requires MFA for all users to register devices with Intune. This is useful when not using Conditional Access.", "executiveText": "Requires employees to use multi-factor authentication when registering devices for corporate access, adding an extra security layer to prevent unauthorized device enrollment. This helps ensure only legitimate users can connect their devices to company systems.", "label": "Require Multi-factor Authentication to register or join devices with Microsoft Entra", @@ -5387,8 +6801,12 @@ { "name": "standards.DeletedUserRentention", "cat": "SharePoint Standards", - "tag": ["SMB1001 (3.1)"], - "appliesToTest": ["SMB1001_3_1"], + "tag": [ + "SMB1001 (3.1)" + ], + "appliesToTest": [ + "SMB1001_3_1" + ], "helpText": "Sets the retention period for deleted users OneDrive to the specified period of time. The default is 30 days.", "docsDescription": "When a OneDrive user gets deleted, the personal SharePoint site is saved for selected amount of time that data can be retrieved from it.", "executiveText": "Preserves departed employees' OneDrive files for a specified period, allowing time to recover important business documents before permanent deletion. This helps prevent data loss while managing storage costs and maintaining compliance with data retention policies.", @@ -5399,18 +6817,54 @@ "name": "standards.DeletedUserRentention.Days", "label": "Retention time (Default 30 days)", "options": [ - { "label": "30 days", "value": "30" }, - { "label": "90 days", "value": "90" }, - { "label": "1 year", "value": "365" }, - { "label": "2 years", "value": "730" }, - { "label": "3 years", "value": "1095" }, - { "label": "4 years", "value": "1460" }, - { "label": "5 years", "value": "1825" }, - { "label": "6 years", "value": "2190" }, - { "label": "7 years", "value": "2555" }, - { "label": "8 years", "value": "2920" }, - { "label": "9 years", "value": "3285" }, - { "label": "10 years", "value": "3650" } + { + "label": "30 days", + "value": "30" + }, + { + "label": "90 days", + "value": "90" + }, + { + "label": "1 year", + "value": "365" + }, + { + "label": "2 years", + "value": "730" + }, + { + "label": "3 years", + "value": "1095" + }, + { + "label": "4 years", + "value": "1460" + }, + { + "label": "5 years", + "value": "1825" + }, + { + "label": "6 years", + "value": "2190" + }, + { + "label": "7 years", + "value": "2555" + }, + { + "label": "8 years", + "value": "2920" + }, + { + "label": "9 years", + "value": "3285" + }, + { + "label": "10 years", + "value": "3650" + } ] } ], @@ -5477,7 +6931,7 @@ "name": "standards.SPFileRequests", "cat": "SharePoint Standards", "tag": [], - "helpText": "Enables or disables File Requests for SharePoint and OneDrive, allowing users to create secure upload-only links. Optionally sets the maximum number of days for the link to remain active before expiring.", + "helpText": "*Requires 'Sharing Level for OneDrive and SharePoint' to be set to Anyone* Enables or disables File Requests for SharePoint and OneDrive, allowing users to create secure upload-only links. Optionally sets the maximum number of days for the link to remain active before expiring.", "docsDescription": "File Requests allow users to create secure upload-only share links where uploads are hidden from other people using the link. This creates a secure and private way for people to upload files to a folder. This feature is not enabled by default on new tenants and requires PowerShell configuration. This standard enables or disables this feature and optionally configures link expiration settings for both SharePoint and OneDrive.", "executiveText": "Enables secure file upload functionality that allows external users to submit files directly to company folders without seeing other submissions or folder contents. This provides a professional and secure way to collect documents from clients, vendors, and partners while maintaining data privacy and security.", "addedComponent": [ @@ -5492,8 +6946,14 @@ "label": "Link Expiration 1-730 Days (Optional)", "required": false, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 730, "message": "Maximum value is 730" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 730, + "message": "Maximum value is 730" + } } } ], @@ -5502,7 +6962,9 @@ "impactColour": "warning", "addedDate": "2025-07-30", "powershellEquivalent": "Set-SPOTenant -CoreRequestFilesLinkEnabled $true -OneDriveRequestFilesLinkEnabled $true -CoreRequestFilesLinkExpirationInDays 30 -OneDriveRequestFilesLinkExpirationInDays 30", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "CIPP" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5554,8 +7016,14 @@ "label": "Guest People Picker suggestions", "name": "standards.SPGuestPeoplePicker.state", "options": [ - { "label": "Show guests in the People Picker", "value": "true" }, - { "label": "Hide guests in the People Picker", "value": "false" } + { + "label": "Show guests in the People Picker", + "value": "true" + }, + { + "label": "Hide guests in the People Picker", + "value": "false" + } ] } ], @@ -5564,7 +7032,9 @@ "impactColour": "info", "addedDate": "2026-09-03", "powershellEquivalent": "Set-SPOTenant / Set-SPOSite -ShowPeoplePickerSuggestionsForGuestUsers $true or $false", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "CIPP" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5577,8 +7047,12 @@ { "name": "standards.SPAzureB2B", "cat": "SharePoint Standards", - "tag": ["CIS M365 7.0.0 (7.2.2)"], - "appliesToTest": ["CIS_7_2_2"], + "tag": [ + "CIS M365 7.0.0 (7.2.2)" + ], + "appliesToTest": [ + "CIS_7_2_2" + ], "helpText": "Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled", "executiveText": "Enables secure collaboration with external partners through SharePoint and OneDrive by integrating with Azure B2B guest access. This allows controlled sharing with external organizations while maintaining security oversight and proper access management.", "addedComponent": [], @@ -5587,7 +7061,9 @@ "impactColour": "info", "addedDate": "2024-07-09", "powershellEquivalent": "Set-SPOTenant -EnableAzureADB2BIntegration $true", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5600,8 +7076,15 @@ { "name": "standards.SPDisallowInfectedFiles", "cat": "SharePoint Standards", - "tag": ["CIS M365 7.0.0 (7.3.1)", "CISA (MS.SPO.3.1v1)", "NIST CSF 2.0 (DE.CM-09)"], - "appliesToTest": ["CIS_7_3_1", "ZTNA21817"], + "tag": [ + "CIS M365 7.0.0 (7.3.1)", + "CISA (MS.SPO.3.1v1)", + "NIST CSF 2.0 (DE.CM-09)" + ], + "appliesToTest": [ + "CIS_7_3_1", + "ZTNA21817" + ], "helpText": "Ensure Office 365 SharePoint infected files are disallowed for download", "executiveText": "Prevents employees from downloading files that have been identified as containing malware or viruses from SharePoint and OneDrive. This security measure protects against malware distribution through file sharing while maintaining access to clean, safe documents.", "addedComponent": [], @@ -5610,7 +7093,10 @@ "impactColour": "info", "addedDate": "2024-07-09", "powershellEquivalent": "Set-SPOTenant -DisallowInfectedFileDownload $true", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "CIPP" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5655,7 +7141,10 @@ "impactColour": "warning", "addedDate": "2024-07-09", "powershellEquivalent": "Set-SPOTenant -DefaultSharingLinkType Direct", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "CIPP" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5668,8 +7157,16 @@ { "name": "standards.SPExternalUserExpiration", "cat": "SharePoint Standards", - "tag": ["CIS M365 7.0.0 (7.2.9)", "CISA (MS.SPO.1.5v1)"], - "appliesToTest": ["CIS_7_2_9", "ZTNA21803", "ZTNA21804", "ZTNA21858"], + "tag": [ + "CIS M365 7.0.0 (7.2.9)", + "CISA (MS.SPO.1.5v1)" + ], + "appliesToTest": [ + "CIS_7_2_9", + "ZTNA21803", + "ZTNA21804", + "ZTNA21858" + ], "helpText": "Ensure guest access to a site or OneDrive will expire automatically", "executiveText": "Automatically expires external user access to SharePoint sites and OneDrive after a specified period, reducing security risks from forgotten or unnecessary guest accounts. This ensures external access is regularly reviewed and maintained only when actively needed.", "addedComponent": [ @@ -5679,8 +7176,14 @@ "label": "Days until expiration (Default 60)", "defaultValue": 60, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 730, "message": "Maximum value is 730" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 730, + "message": "Maximum value is 730" + } } } ], @@ -5689,7 +7192,9 @@ "impactColour": "warning", "addedDate": "2024-07-09", "powershellEquivalent": "Set-SPOTenant -ExternalUserExpireInDays 30 -ExternalUserExpirationRequired $True", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5702,8 +7207,15 @@ { "name": "standards.SPEmailAttestation", "cat": "SharePoint Standards", - "tag": ["CIS M365 7.0.0 (7.2.10)", "CISA (MS.SPO.1.6v1)"], - "appliesToTest": ["CIS_7_2_10", "ZTNA21803", "ZTNA21804"], + "tag": [ + "CIS M365 7.0.0 (7.2.10)", + "CISA (MS.SPO.1.6v1)" + ], + "appliesToTest": [ + "CIS_7_2_10", + "ZTNA21803", + "ZTNA21804" + ], "helpText": "Ensure re-authentication with verification code is restricted", "executiveText": "Requires external users to periodically re-verify their identity through email verification codes when accessing SharePoint resources, adding an extra security layer for external collaboration. This helps ensure continued legitimacy of external access over time.", "addedComponent": [ @@ -5713,8 +7225,14 @@ "label": "Require re-authentication every X Days (Default 15)", "defaultValue": 15, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 365, "message": "Maximum value is 365" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 365, + "message": "Maximum value is 365" + } } } ], @@ -5723,7 +7241,10 @@ "impactColour": "warning", "addedDate": "2024-07-09", "powershellEquivalent": "Set-SPOTenant -EmailAttestationRequired $true -EmailAttestationReAuthDays 15", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "CIPP" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5736,8 +7257,17 @@ { "name": "standards.DefaultSharingLink", "cat": "SharePoint Standards", - "tag": ["CIS M365 7.0.0 (7.2.7)", "CIS M365 7.0.0 (7.2.11)", "CISA (MS.SPO.1.4v1)"], - "appliesToTest": ["CIS_7_2_11", "CIS_7_2_7", "ZTNA21803", "ZTNA21804"], + "tag": [ + "CIS M365 7.0.0 (7.2.7)", + "CIS M365 7.0.0 (7.2.11)", + "CISA (MS.SPO.1.4v1)" + ], + "appliesToTest": [ + "CIS_7_2_11", + "CIS_7_2_7", + "ZTNA21803", + "ZTNA21804" + ], "helpText": "Configure the SharePoint default sharing link type and permission. This setting controls both the type of sharing link created by default and the permission level assigned to those links.", "docsDescription": "Sets the default sharing link type (Direct or Internal) and permission (View) in SharePoint and OneDrive. Direct sharing means links only work for specific people, while Internal sharing means links work for anyone in the organization. Setting the view permission as the default ensures that users must deliberately select the edit permission when sharing a link, reducing the risk of unintentionally granting edit privileges.", "executiveText": "Configures SharePoint default sharing links to implement the principle of least privilege for document sharing. This security measure reduces the risk of accidental data modification while maintaining collaboration functionality, requiring users to explicitly select Edit permissions when necessary. The sharing type setting controls whether links are restricted to specific recipients or available to the entire organization. This reduces the risk of accidental data exposure through link sharing.", @@ -5750,8 +7280,14 @@ "label": "Default Sharing Link Type", "name": "standards.DefaultSharingLink.SharingLinkType", "options": [ - { "label": "Direct - Only the people the user specifies", "value": "Direct" }, - { "label": "Internal - Only people in your organization", "value": "Internal" } + { + "label": "Direct - Only the people the user specifies", + "value": "Direct" + }, + { + "label": "Internal - Only people in your organization", + "value": "Internal" + } ] } ], @@ -5760,7 +7296,10 @@ "impactColour": "info", "addedDate": "2025-06-13", "powershellEquivalent": "Set-SPOTenant -DefaultSharingLinkType [Direct|Internal] -DefaultLinkPermission View", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "CIPP" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5784,8 +7323,14 @@ "label": "Add Shortcuts To OneDrive button state", "name": "standards.DisableAddShortcutsToOneDrive.state", "options": [ - { "label": "Disabled", "value": "true" }, - { "label": "Enabled", "value": "false" } + { + "label": "Disabled", + "value": "true" + }, + { + "label": "Enabled", + "value": "false" + } ] } ], @@ -5818,8 +7363,14 @@ "label": "SharePoint Sync Button state", "name": "standards.SPSyncButtonState.state", "options": [ - { "label": "Disabled", "value": "true" }, - { "label": "Enabled", "value": "false" } + { + "label": "Disabled", + "value": "true" + }, + { + "label": "Enabled", + "value": "false" + } ] } ], @@ -5847,7 +7398,11 @@ "CISA (MS.AAD.3.1v1)", "NIST CSF 2.0 (PR.IR-01)" ], - "appliesToTest": ["CIS_7_2_1", "ZTNA21776", "ZTNA21797"], + "appliesToTest": [ + "CIS_7_2_1", + "ZTNA21776", + "ZTNA21797" + ], "helpText": "Disables the ability to authenticate with SharePoint using legacy authentication methods. Any applications that use legacy authentication will need to be updated to use modern authentication.", "docsDescription": "Disables the ability for users and applications to access SharePoint via legacy basic authentication. This will likely not have any user impact, but will block systems/applications depending on basic auth or the SharePointOnlineCredentials class.", "executiveText": "Disables outdated authentication methods for SharePoint access, forcing applications and users to use modern, more secure authentication protocols. This significantly improves security by eliminating vulnerable authentication pathways while requiring updates to older applications.", @@ -5857,7 +7412,10 @@ "impactColour": "warning", "addedDate": "2024-02-05", "powershellEquivalent": "Set-SPOTenant -LegacyAuthProtocolsEnabled $false", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "CIPP" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5876,7 +7434,12 @@ "CISA (MS.AAD.14.1v1)", "CISA (MS.SPO.1.1v1)" ], - "appliesToTest": ["CIS_7_2_3", "CIS_7_2_4", "ZTNA21803", "ZTNA21804"], + "appliesToTest": [ + "CIS_7_2_3", + "CIS_7_2_4", + "ZTNA21803", + "ZTNA21804" + ], "helpText": "Sets the default sharing level for OneDrive and SharePoint. This is a tenant wide setting and overrules any settings set on the site level", "executiveText": "Defines the organization's default policy for sharing files and folders in SharePoint and OneDrive, balancing collaboration needs with security requirements. This fundamental setting determines whether employees can share with external users, anonymous links, or only internal colleagues.", "addedComponent": [ @@ -5910,7 +7473,10 @@ "impactColour": "danger", "addedDate": "2022-06-15", "powershellEquivalent": "Update-MgBetaAdminSharePointSetting", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "CIPP" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5923,8 +7489,16 @@ { "name": "standards.DisableReshare", "cat": "SharePoint Standards", - "tag": ["CIS M365 7.0.0 (7.2.5)", "CISA (MS.AAD.14.2v1)", "CISA (MS.SPO.1.2v1)"], - "appliesToTest": ["CIS_7_2_5", "ZTNA21803", "ZTNA21804"], + "tag": [ + "CIS M365 7.0.0 (7.2.5)", + "CISA (MS.AAD.14.2v1)", + "CISA (MS.SPO.1.2v1)" + ], + "appliesToTest": [ + "CIS_7_2_5", + "ZTNA21803", + "ZTNA21804" + ], "helpText": "Disables the ability for external users to share files they don't own. Sharing links can only be made for People with existing access", "docsDescription": "Disables the ability for external users to share files they don't own. Sharing links can only be made for People with existing access. This is a tenant wide setting and overrules any settings set on the site level", "executiveText": "Prevents external users from sharing company documents with additional people, maintaining control over document distribution and preventing unauthorized access expansion. This security measure ensures that external sharing remains within intended boundaries set by internal employees.", @@ -5934,7 +7508,10 @@ "impactColour": "danger", "addedDate": "2022-06-15", "powershellEquivalent": "Update-MgBetaAdminSharePointSetting", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "CIPP" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5947,8 +7524,12 @@ { "name": "standards.DisableUserSiteCreate", "cat": "SharePoint Standards", - "tag": ["SMB1001 (2.8)"], - "appliesToTest": ["SMB1001_2_8"], + "tag": [ + "SMB1001 (2.8)" + ], + "appliesToTest": [ + "SMB1001_2_8" + ], "helpText": "Disables users from creating new SharePoint sites", "docsDescription": "Disables standard users from creating SharePoint sites, also disables the ability to fully create teams", "executiveText": "Restricts the creation of new SharePoint sites to authorized administrators, preventing uncontrolled proliferation of collaboration spaces and ensuring proper governance. This maintains organized information architecture while requiring approval for new collaborative environments.", @@ -6021,12 +7602,17 @@ { "name": "standards.unmanagedSync", "cat": "SharePoint Standards", - "tag": ["CISA (MS.SPO.2.1v1)", "NIST CSF 2.0 (PR.AA-05)"], - "appliesToTest": ["ZTNA24824"], - "helpText": "Entra P1 required. Block or limit access to SharePoint and OneDrive content from unmanaged devices (those not hybrid AD joined or compliant in Intune). These controls rely on Microsoft Entra Conditional Access policies and can take up to 24 hours to take effect.", - "docsDescription": "Entra P1 required. Block or limit access to SharePoint and OneDrive content from unmanaged devices (those not hybrid AD joined or compliant in Intune). These controls rely on Microsoft Entra Conditional Access policies and can take up to 24 hours to take effect. 0 = Allow Access, 1 = Allow limited, web-only access, 2 = Block access. All information about this can be found in Microsofts documentation [here.](https://learn.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices)", - "executiveText": "Restricts access to company files from personal or unmanaged devices, ensuring corporate data can only be accessed from properly secured and monitored devices. This critical security control prevents data leaks while allowing controlled access through web browsers when necessary.", - "addedComponent": [ + "tag": [ + "CISA (MS.SPO.2.1v1)", + "NIST CSF 2.0 (PR.AA-05)" + ], + "appliesToTest": [ + "ZTNA24824" + ], + "helpText": "Entra P1 required. Block or limit access to SharePoint and OneDrive content from unmanaged devices (those not hybrid AD joined or compliant in Intune). These controls rely on Microsoft Entra Conditional Access policies and can take up to 24 hours to take effect.", + "docsDescription": "Entra P1 required. Block or limit access to SharePoint and OneDrive content from unmanaged devices (those not hybrid AD joined or compliant in Intune). These controls rely on Microsoft Entra Conditional Access policies and can take up to 24 hours to take effect. 0 = Allow Access, 1 = Allow limited, web-only access, 2 = Block access. All information about this can be found in Microsofts documentation [here.](https://learn.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices)", + "executiveText": "Restricts access to company files from personal or unmanaged devices, ensuring corporate data can only be accessed from properly secured and monitored devices. This critical security control prevents data leaks while allowing controlled access through web browsers when necessary.", + "addedComponent": [ { "type": "autoComplete", "multiple": false, @@ -6034,8 +7620,14 @@ "name": "standards.unmanagedSync.state", "label": "State", "options": [ - { "label": "Allow limited, web-only access", "value": "1" }, - { "label": "Block access", "value": "2" } + { + "label": "Allow limited, web-only access", + "value": "1" + }, + { + "label": "Block access", + "value": "2" + } ], "required": false } @@ -6045,14 +7637,30 @@ "impactColour": "danger", "addedDate": "2025-06-13", "powershellEquivalent": "Set-SPOTenant -ConditionalAccessPolicy AllowFullAccess | AllowLimitedAccess | BlockAccess", - "recommendedBy": ["CIS"], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "recommendedBy": [ + "CIS" + ], + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.sharingDomainRestriction", "cat": "SharePoint Standards", - "tag": ["CIS M365 7.0.0 (7.2.6)", "CISA (MS.AAD.14.3v1)", "CISA (MS.SPO.1.3v1)"], - "appliesToTest": ["CIS_7_2_6", "ZTNA21803", "ZTNA21804"], + "tag": [ + "CIS M365 7.0.0 (7.2.6)", + "CISA (MS.AAD.14.3v1)", + "CISA (MS.SPO.1.3v1)" + ], + "appliesToTest": [ + "CIS_7_2_6", + "ZTNA21803", + "ZTNA21804" + ], "helpText": "Restricts sharing to only users with the specified domain. This is useful for organizations that only want to share with their own domain.", "executiveText": "Controls which external domains employees can share files with, enabling secure collaboration with trusted partners while blocking sharing with unauthorized organizations. This targeted approach maintains necessary business relationships while preventing data exposure to unknown entities.", "addedComponent": [ @@ -6062,9 +7670,18 @@ "name": "standards.sharingDomainRestriction.Mode", "label": "Limit external sharing by domains", "options": [ - { "label": "Off", "value": "none" }, - { "label": "Restrict sharing to specific domains", "value": "allowList" }, - { "label": "Block sharing to specific domains", "value": "blockList" } + { + "label": "Off", + "value": "none" + }, + { + "label": "Restrict sharing to specific domains", + "value": "allowList" + }, + { + "label": "Block sharing to specific domains", + "value": "blockList" + } ] }, { @@ -6125,9 +7742,18 @@ "name": "standards.TeamsGlobalMeetingPolicy.DesignatedPresenterRoleMode", "label": "Default value of the `Who can present?`", "options": [ - { "label": "Everyone", "value": "EveryoneUserOverride" }, - { "label": "People in my organization", "value": "EveryoneInCompanyUserOverride" }, - { "label": "Only organizer", "value": "OrganizerOnlyUserOverride" } + { + "label": "Everyone", + "value": "EveryoneUserOverride" + }, + { + "label": "People in my organization", + "value": "EveryoneInCompanyUserOverride" + }, + { + "label": "Only organizer", + "value": "OrganizerOnlyUserOverride" + } ] }, { @@ -6149,7 +7775,10 @@ "label": "Who can bypass the lobby?", "helperText": "If left blank, the current value will not be changed.", "options": [ - { "label": "Only organizers and co-organizers", "value": "OrganizerOnly" }, + { + "label": "Only organizers and co-organizers", + "value": "OrganizerOnly" + }, { "label": "People in organization excluding guests", "value": "EveryoneInCompanyExcludingGuests" @@ -6158,8 +7787,14 @@ "label": "People in same or federated organizations", "value": "EveryoneInSameAndFederatedCompany" }, - { "label": "People who were invited", "value": "InvitedUsers" }, - { "label": "Everyone", "value": "Everyone" } + { + "label": "People who were invited", + "value": "InvitedUsers" + }, + { + "label": "Everyone", + "value": "Everyone" + } ] }, { @@ -6175,9 +7810,18 @@ "name": "standards.TeamsGlobalMeetingPolicy.MeetingChatEnabledType", "label": "Meeting chat policy", "options": [ - { "label": "On for everyone", "value": "Enabled" }, - { "label": "On for everyone but anonymous users", "value": "EnabledExceptAnonymous" }, - { "label": "Off for everyone", "value": "Disabled" } + { + "label": "On for everyone", + "value": "Enabled" + }, + { + "label": "On for everyone but anonymous users", + "value": "EnabledExceptAnonymous" + }, + { + "label": "Off for everyone", + "value": "Disabled" + } ] }, { @@ -6199,8 +7843,14 @@ "label": "External meeting chat", "helperText": "CIS 8.5.8 recommends Off. Leave blank to keep the tenant's current value.", "options": [ - { "label": "Off (CIS recommended)", "value": false }, - { "label": "On", "value": true } + { + "label": "Off (CIS recommended)", + "value": false + }, + { + "label": "On", + "value": true + } ] }, { @@ -6212,8 +7862,14 @@ "label": "Meeting cloud recording", "helperText": "CIS 8.5.9 recommends Off. Leave blank to keep the tenant's current value.", "options": [ - { "label": "Off (CIS recommended)", "value": false }, - { "label": "On", "value": true } + { + "label": "Off (CIS recommended)", + "value": false + }, + { + "label": "On", + "value": true + } ] } ], @@ -6222,8 +7878,16 @@ "impactColour": "info", "addedDate": "2024-11-12", "powershellEquivalent": "Set-CsTeamsMeetingPolicy -AllowAnonymousUsersToJoinMeeting $false -AllowAnonymousUsersToStartMeeting $false -AutoAdmittedUsers $AutoAdmittedUsers -AllowPSTNUsersToBypassLobby $false -MeetingChatEnabledType EnabledExceptAnonymous -DesignatedPresenterRoleMode $DesignatedPresenterRoleMode -AllowExternalParticipantGiveRequestControl $false -AllowParticipantGiveRequestControl $false -AllowExternalNonTrustedMeetingChat $false -AllowCloudRecording $false", - "recommendedBy": ["CIS"], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "recommendedBy": [ + "CIS" + ], + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.PlannerBlockTaskDelete", @@ -6284,14 +7948,26 @@ "impactColour": "info", "addedDate": "2025-10-02", "powershellEquivalent": "Set-CsTeamsMessagingConfiguration -FileTypeCheck 'Enabled' -UrlReputationCheck 'Enabled' -ReportIncorrectSecurityDetections 'Enabled'", - "recommendedBy": ["CIPP"], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "recommendedBy": [ + "CIPP" + ], + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsExternalChatWithAnyone", "cat": "Teams Standards", - "tag": ["CIS M365 7.0.0 (8.2.3)"], - "appliesToTest": ["CIS_8_2_3"], + "tag": [ + "CIS M365 7.0.0 (8.2.3)" + ], + "appliesToTest": [ + "CIS_8_2_3" + ], "helpText": "Controls whether users can start Teams chats with any email address, inviting external recipients as guests via email.", "docsDescription": "Manages the Teams messaging policy setting UseB2BInvitesToAddExternalUsers. When enabled, users can start chats with any email address and recipients receive an invitation to join the chat as guests. Disabling the setting prevents these external email chats from being created, keeping conversations limited to internal users and approved guests.", "executiveText": "Allows organizations to decide if employees can launch Microsoft Teams chats with anyone on the internet using just an email address. Disabling the feature keeps conversations inside trusted boundaries and helps prevent accidental data exposure through unexpected external invitations.", @@ -6301,8 +7977,14 @@ "name": "standards.TeamsExternalChatWithAnyone.UseB2BInvitesToAddExternalUsers", "label": "Allow chatting with anyone via email", "options": [ - { "label": "Enabled", "value": "true" }, - { "label": "Disabled", "value": "false" } + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } ], "defaultValue": "Disabled" } @@ -6312,8 +7994,16 @@ "impactColour": "info", "addedDate": "2025-11-03", "powershellEquivalent": "Set-CsTeamsMessagingPolicy -Identity Global -UseB2BInvitesToAddExternalUsers $false/$true", - "recommendedBy": ["CIPP"], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "recommendedBy": [ + "CIPP" + ], + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsEmailIntegration", @@ -6333,10 +8023,22 @@ "impactColour": "info", "addedDate": "2024-07-30", "powershellEquivalent": "Set-CsTeamsClientConfiguration -AllowEmailIntoChannel $false", - "recommendedBy": ["CIS"], - "tag": ["CIS M365 7.0.0 (8.1.2)"], - "appliesToTest": ["CIS_8_1_2"], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "recommendedBy": [ + "CIS" + ], + "tag": [ + "CIS M365 7.0.0 (8.1.2)" + ], + "appliesToTest": [ + "CIS_8_1_2" + ], + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsGuestAccess", @@ -6358,7 +8060,13 @@ "addedDate": "2025-06-03", "powershellEquivalent": "Set-CsTeamsClientConfiguration -AllowGuestUser $true", "recommendedBy": [], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsMeetingVerification", @@ -6375,7 +8083,10 @@ "label": "CAPTCHA Verification Setting", "name": "standards.TeamsMeetingVerification.CaptchaVerificationForMeetingJoin", "options": [ - { "label": "Not Required", "value": "NotRequired" }, + { + "label": "Not Required", + "value": "NotRequired" + }, { "label": "Anonymous Users and Untrusted Organizations", "value": "AnonymousUsersAndUntrustedOrganizations" @@ -6388,14 +8099,26 @@ "impactColour": "info", "addedDate": "2025-06-14", "powershellEquivalent": "Set-CsTeamsMeetingPolicy -CaptchaVerificationForMeetingJoin", - "recommendedBy": ["CIPP"], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "recommendedBy": [ + "CIPP" + ], + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsExternalFileSharing", "cat": "Teams Standards", - "tag": ["CIS M365 7.0.0 (8.1.1)"], - "appliesToTest": ["CIS_8_1_1"], + "tag": [ + "CIS M365 7.0.0 (8.1.1)" + ], + "appliesToTest": [ + "CIS_8_1_1" + ], "helpText": "Ensure external file sharing in Teams is enabled for only approved cloud storage services.", "executiveText": "Controls which external cloud storage services (like Google Drive, Dropbox, Box) employees can access through Teams, ensuring file sharing occurs only through approved and secure platforms. This helps maintain data governance while supporting necessary business integrations.", "addedComponent": [ @@ -6430,8 +8153,16 @@ "impactColour": "info", "addedDate": "2024-07-28", "powershellEquivalent": "Set-CsTeamsClientConfiguration -AllowGoogleDrive $false -AllowShareFile $false -AllowBox $false -AllowDropBox $false -AllowEgnyte $false", - "recommendedBy": ["CIS"], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "recommendedBy": [ + "CIS" + ], + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsEnrollUser", @@ -6449,8 +8180,14 @@ "name": "standards.TeamsEnrollUser.EnrollUserOverride", "label": "Voice and Face Enrollment", "options": [ - { "label": "Disabled", "value": "Disabled" }, - { "label": "Enabled", "value": "Enabled" } + { + "label": "Disabled", + "value": "Disabled" + }, + { + "label": "Enabled", + "value": "Enabled" + } ] } ], @@ -6460,13 +8197,25 @@ "addedDate": "2024-11-12", "powershellEquivalent": "Set-CsTeamsMeetingPolicy -Identity Global -EnrollUserOverride $false", "recommendedBy": [], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsExternalAccessPolicy", "cat": "Teams Standards", - "tag": ["CIS M365 7.0.0 (8.2.1)", "CIS M365 7.0.0 (8.2.2)"], - "appliesToTest": ["CIS_8_2_1", "CIS_8_2_2"], + "tag": [ + "CIS M365 7.0.0 (8.2.1)", + "CIS M365 7.0.0 (8.2.2)" + ], + "appliesToTest": [ + "CIS_8_2_1", + "CIS_8_2_2" + ], "helpText": "Sets the properties of the Global external access policy.", "docsDescription": "Sets the properties of the Global external access policy. External access policies determine whether or not your users can: 1) communicate with users who have Session Initiation Protocol (SIP) accounts with a federated organization; 2) communicate with users who are using custom applications built with Azure Communication Services; 3) access Skype for Business Server over the Internet, without having to log on to your internal network; 4) communicate with users who have SIP accounts with a public instant messaging (IM) provider such as Skype; and, 5) communicate with people who are using Teams with an account that's not managed by an organization.", "executiveText": "Defines the organization's policy for communicating with external users through Teams, including other organizations, Skype users, and unmanaged accounts. This fundamental setting determines the scope of external collaboration while maintaining security boundaries for business communications.", @@ -6498,13 +8247,24 @@ "addedDate": "2024-07-30", "powershellEquivalent": "Set-CsExternalAccessPolicy", "recommendedBy": [], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsFederationConfiguration", "cat": "Teams Standards", - "tag": ["CIS M365 7.0.0 (8.2.1)"], - "appliesToTest": ["CIS_8_2_1", "CIS_8_2_4"], + "tag": [ + "CIS M365 7.0.0 (8.2.1)" + ], + "appliesToTest": [ + "CIS_8_2_1", + "CIS_8_2_4" + ], "helpText": "Sets the properties of the Global federation configuration.", "docsDescription": "Sets the properties of the Global federation configuration. Federation configuration settings determine whether or not your users can communicate with users who have SIP accounts with a federated organization.", "executiveText": "Configures how the organization federates with external organizations for Teams communication, controlling whether employees can communicate with specific external domains or all external organizations. This setting enables secure inter-organizational collaboration while maintaining control over external communications.", @@ -6532,10 +8292,22 @@ "name": "standards.TeamsFederationConfiguration.DomainControl", "label": "Communication Mode", "options": [ - { "label": "Allow all external domains", "value": "AllowAllExternal" }, - { "label": "Block all external domains", "value": "BlockAllExternal" }, - { "label": "Allow specific external domains", "value": "AllowSpecificExternal" }, - { "label": "Block specific external domains", "value": "BlockSpecificExternal" } + { + "label": "Allow all external domains", + "value": "AllowAllExternal" + }, + { + "label": "Block all external domains", + "value": "BlockAllExternal" + }, + { + "label": "Allow specific external domains", + "value": "AllowSpecificExternal" + }, + { + "label": "Block specific external domains", + "value": "BlockSpecificExternal" + } ] }, { @@ -6546,7 +8318,10 @@ "condition": { "field": "standards.TeamsFederationConfiguration.DomainControl.value", "compareType": "isOneOf", - "compareValue": ["AllowSpecificExternal", "BlockSpecificExternal"] + "compareValue": [ + "AllowSpecificExternal", + "BlockSpecificExternal" + ] } } ], @@ -6556,7 +8331,13 @@ "addedDate": "2024-07-31", "powershellEquivalent": "Set-CsTenantFederationConfiguration", "recommendedBy": [], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsMeetingRecordingExpiration", @@ -6573,8 +8354,14 @@ "required": true, "defaultValue": 120, "validators": { - "min": { "value": -1, "message": "Minimum value is -1" }, - "max": { "value": 99999, "message": "Maximum value is 99999" } + "min": { + "value": -1, + "message": "Minimum value is -1" + }, + "max": { + "value": 99999, + "message": "Maximum value is 99999" + } } } ], @@ -6584,13 +8371,23 @@ "addedDate": "2025-04-17", "powershellEquivalent": "Set-CsTeamsMeetingPolicy -Identity Global -MeetingRecordingExpirationDays ", "recommendedBy": [], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsMessagingPolicy", "cat": "Teams Standards", - "tag": ["CIS M365 7.0.0 (8.6.1)"], - "appliesToTest": ["CIS_8_6_1"], + "tag": [ + "CIS M365 7.0.0 (8.6.1)" + ], + "appliesToTest": [ + "CIS_8_6_1" + ], "helpText": "Sets the properties of the Global messaging policy.", "docsDescription": "Sets the properties of the Global messaging policy. Messaging policies control which chat and channel messaging features are available to users in Teams.", "executiveText": "Defines what messaging capabilities employees have in Teams, including the ability to edit or delete messages, create custom emojis, and report inappropriate content. These policies help maintain professional communication standards while enabling necessary collaboration features.", @@ -6627,9 +8424,18 @@ "name": "standards.TeamsMessagingPolicy.ReadReceiptsEnabledType", "label": "Read Receipts Enabled Type", "options": [ - { "label": "User controlled", "value": "UserPreference" }, - { "label": "Turned on for everyone", "value": "Everyone" }, - { "label": "Turned off for everyone", "value": "None" } + { + "label": "User controlled", + "value": "UserPreference" + }, + { + "label": "Turned on for everyone", + "value": "Everyone" + }, + { + "label": "Turned off for everyone", + "value": "None" + } ] }, { @@ -6655,6 +8461,19 @@ "name": "standards.TeamsMessagingPolicy.AllowCommunicationComplianceEndUserReporting", "label": "Allow reporting message as inappropriate content", "defaultValue": true + }, + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "name": "standards.TeamsMessagingPolicy.AutoShareFilesInExternalChats", + "label": "Automatically share files attached in external chats", + "options": [ + { "label": "Don't change", "value": "donotconfigure" }, + { "label": "Enabled", "value": "Enabled" }, + { "label": "Disabled", "value": "Disabled" } + ], + "defaultValue": "donotconfigure" } ], "label": "Global Messaging Policy for Microsoft Teams", @@ -6663,13 +8482,79 @@ "addedDate": "2025-01-10", "powershellEquivalent": "Set-CsTeamsMessagingPolicy", "recommendedBy": [], + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] + }, + { + "name": "standards.TeamsFilesPolicy", + "cat": "Teams Standards", + "tag": [], + "helpText": "Sets the properties of the Global Teams files policy, including file sharing in external (federated) chats.", + "docsDescription": "Sets the properties of the Global Teams files policy. File sharing in external chats controls whether users can attach files in 1:1, group and meeting chats with people from other organizations. Native file entry points controls the OneDrive and SharePoint attach options in chats and channels, and SharePoint channel files tab controls the SharePoint Files tab in channels.", + "executiveText": "Controls whether employees can attach files directly in Microsoft Teams chats with people outside the organization. Microsoft is enabling this by default for all tenants, including those that had turned it off, so managing it as a standard keeps the organization's chosen external sharing posture in place.", + "addedComponent": [ + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "name": "standards.TeamsFilesPolicy.FileSharingInChatsWithExternalUsers", + "label": "File sharing in external chats", + "options": [ + { "label": "Don't change", "value": "donotconfigure" }, + { "label": "Enabled", "value": "Enabled" }, + { "label": "Disabled", "value": "Disabled" } + ], + "defaultValue": "Disabled" + }, + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "name": "standards.TeamsFilesPolicy.NativeFileEntryPoints", + "label": "OneDrive and SharePoint file entry points", + "options": [ + { "label": "Don't change", "value": "donotconfigure" }, + { "label": "Enabled", "value": "Enabled" }, + { "label": "Disabled", "value": "Disabled" } + ], + "defaultValue": "donotconfigure" + }, + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "name": "standards.TeamsFilesPolicy.SPChannelFilesTab", + "label": "SharePoint channel files tab", + "options": [ + { "label": "Don't change", "value": "donotconfigure" }, + { "label": "Enabled", "value": "Enabled" }, + { "label": "Disabled", "value": "Disabled" } + ], + "defaultValue": "donotconfigure" + } + ], + "label": "Global Files Policy for Microsoft Teams", + "impact": "Low Impact", + "impactColour": "info", + "addedDate": "2026-09-28", + "powershellEquivalent": "Set-CsTeamsFilesPolicy -Identity Global -FileSharingInChatsWithExternalUsers Disabled", + "recommendedBy": ["CIPP"], "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] }, { "name": "standards.AutopilotStatusPage", "cat": "Device Management Standards", "tag": [], - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "helpText": "Deploy the Autopilot Status Page, which shows progress during device setup through Autopilot.", "docsDescription": "This standard allows configuration of the Autopilot Status Page, providing users with a visual representation of the progress during device setup. It includes options like timeout, logging, and retry settings.", "executiveText": "Provides employees with a visual progress indicator during automated device setup, improving the user experience when receiving new computers. This reduces IT support calls and helps ensure successful device deployment by guiding users through the setup process.", @@ -6680,8 +8565,14 @@ "label": "Timeout in minutes", "defaultValue": 60, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 1440, "message": "Maximum value is 1440" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 1440, + "message": "Maximum value is 1440" + } } }, { @@ -6738,14 +8629,28 @@ "addedDate": "2023-12-30", "impactColour": "info", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.AutopilotProfile", "cat": "Device Management Standards", - "tag": ["SMB1001 (2.2)"], - "appliesToTest": ["SMB1001_2_2"], - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "tag": [ + "SMB1001 (2.2)" + ], + "appliesToTest": [ + "SMB1001_2_2" + ], + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "helpText": "Assign the appropriate Autopilot profile to streamline device deployment.", "docsDescription": "This standard allows the deployment of Autopilot profiles to devices, including settings such as unique name templates, language options, and local admin privileges.", "addedComponent": [ @@ -6772,7 +8677,11 @@ "required": false, "name": "standards.AutopilotProfile.Languages", "label": "Languages", - "api": { "url": "/languageList.json", "labelField": "languageTag", "valueField": "tag" } + "api": { + "url": "/languageList.json", + "labelField": "languageTag", + "valueField": "tag" + } }, { "type": "switch", @@ -6834,13 +8743,27 @@ "impactColour": "info", "addedDate": "2023-12-30", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.DevicePrepProfile", "cat": "Device Management Standards", - "tag": ["autopilot", "device_prep", "enrollment"], - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "tag": [ + "autopilot", + "device_prep", + "enrollment" + ], + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "helpText": "Creates and manages a Windows Autopilot Device Preparation profile for streamlined device enrollment.", "docsDescription": "Deploys a Windows Autopilot Device Preparation profile through Intune configuration policies. This standard manages deployment mode, join type, account type, timeout, error messages, and optional device security group assignment. Optionally creates a new security group with the Intune Provisioning Client as owner.", "addedComponent": [ @@ -6862,8 +8785,14 @@ "name": "standards.DevicePrepProfile.DeploymentType", "label": "Deployment Type", "options": [ - { "label": "Single user", "value": "0" }, - { "label": "Shared", "value": "1" } + { + "label": "Single user", + "value": "0" + }, + { + "label": "Shared", + "value": "1" + } ] }, { @@ -6872,8 +8801,14 @@ "name": "standards.DevicePrepProfile.JoinType", "label": "Join Type", "options": [ - { "label": "Microsoft Entra join", "value": "0" }, - { "label": "Microsoft Entra hybrid join", "value": "1" } + { + "label": "Microsoft Entra join", + "value": "0" + }, + { + "label": "Microsoft Entra hybrid join", + "value": "1" + } ] }, { @@ -6882,8 +8817,14 @@ "name": "standards.DevicePrepProfile.AccountType", "label": "Account Type", "options": [ - { "label": "Standard user", "value": "1" }, - { "label": "Administrator", "value": "0" } + { + "label": "Standard user", + "value": "1" + }, + { + "label": "Administrator", + "value": "0" + } ] }, { @@ -6927,7 +8868,10 @@ "name": "standards.DevicePrepProfile.AssignTo", "label": "Policy Assignment", "options": [ - { "label": "Do not assign", "value": "none" }, + { + "label": "Do not assign", + "value": "none" + }, { "label": "All users (Device Preparation profiles deploy to the enrolling user, so device targets do not apply)", "value": "AllDevicesAndUsers" @@ -6940,13 +8884,27 @@ "impactColour": "danger", "addedDate": "2026-05-25", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.AppleEnrollmentTypeProfile", "cat": "Intune Standards", - "tag": ["enrollment", "apple", "ios"], - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "tag": [ + "enrollment", + "apple", + "ios" + ], + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "helpText": "Creates and manages an Apple user-initiated enrollment type profile (such as iOS/iPadOS web based device enrollment) and keeps it assigned to the configured groups. The tenant needs an Apple MDM push certificate for the enrollment itself to function.", "executiveText": "Ensures every tenant offers the same enrollment experience for Apple devices, such as web based enrollment for personal iPhones and iPads, without engineers configuring each tenant by hand. This keeps device onboarding consistent and makes it possible to report on which tenants are correctly configured.", "docsDescription": "Deploys an Apple user-initiated enrollment type profile through deviceManagement/appleUserInitiatedEnrollmentProfiles. The profile is matched by display name; the enrollment type (web based device enrollment, account driven user enrollment, or device enrollment with Company Portal), description and group assignments are kept in sync, with a wrong assignment repaired in place. Priority is only applied when the profile is first created, because reordering is relative to the other profiles in each tenant.", @@ -6970,9 +8928,18 @@ "name": "standards.AppleEnrollmentTypeProfile.EnrollmentType", "label": "Enrollment Type", "options": [ - { "label": "Web based device enrollment", "value": "webDeviceEnrollment" }, - { "label": "Account driven user enrollment", "value": "accountDrivenUserEnrollment" }, - { "label": "Device enrollment with Company Portal", "value": "device" } + { + "label": "Web based device enrollment", + "value": "webDeviceEnrollment" + }, + { + "label": "Account driven user enrollment", + "value": "accountDrivenUserEnrollment" + }, + { + "label": "Device enrollment with Company Portal", + "value": "device" + } ] }, { @@ -6986,8 +8953,14 @@ "name": "standards.AppleEnrollmentTypeProfile.AssignTo", "label": "Profile Assignment", "options": [ - { "label": "Do not assign", "value": "none" }, - { "label": "Assign to Custom Group", "value": "customGroup" } + { + "label": "Do not assign", + "value": "none" + }, + { + "label": "Assign to Custom Group", + "value": "customGroup" + } ] }, { @@ -7002,14 +8975,24 @@ "impactColour": "warning", "addedDate": "2026-08-18", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.IntuneTemplate", "cat": "Templates", "label": "Intune Template", "multiple": true, - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "High Impact", "addedDate": "2023-12-30", "tag": [ @@ -7072,7 +9055,11 @@ "labelField": "Displayname", "valueField": "GUID", "showRefresh": true, - "templateView": { "title": "Intune Template", "property": "RAWJson", "type": "intune" } + "templateView": { + "title": "Intune Template", + "property": "RAWJson", + "type": "intune" + } } }, { @@ -7094,11 +9081,26 @@ "label": "Who should this template be assigned to?", "type": "radio", "options": [ - { "label": "Do not assign", "value": "On" }, - { "label": "Assign to all users", "value": "allLicensedUsers" }, - { "label": "Assign to all devices", "value": "AllDevices" }, - { "label": "Assign to all users and devices", "value": "AllDevicesAndUsers" }, - { "label": "Assign to Custom Group", "value": "customGroup" } + { + "label": "Do not assign", + "value": "On" + }, + { + "label": "Assign to all users", + "value": "allLicensedUsers" + }, + { + "label": "Assign to all devices", + "value": "AllDevices" + }, + { + "label": "Assign to all users and devices", + "value": "AllDevicesAndUsers" + }, + { + "label": "Assign to Custom Group", + "value": "customGroup" + } ] }, { @@ -7107,7 +9109,11 @@ "name": "customGroup", "label": "Enter the custom group name if you selected 'Assign to Custom Group'. Wildcards are allowed." }, - { "type": "switch", "name": "verifyAssignments", "label": "Verify policy assignments" }, + { + "type": "switch", + "name": "verifyAssignments", + "label": "Verify policy assignments" + }, { "name": "excludeGroup", "label": "Exclude Groups", @@ -7129,8 +9135,14 @@ "required": false, "helpText": "Choose whether to include or exclude devices matching the filter. Only applies if you specified a filter name above. Defaults to Include if not specified.", "options": [ - { "label": "Include - Assign to devices matching the filter", "value": "include" }, - { "label": "Exclude - Assign to devices NOT matching the filter", "value": "exclude" } + { + "label": "Include - Assign to devices matching the filter", + "value": "include" + }, + { + "label": "Exclude - Assign to devices NOT matching the filter", + "value": "exclude" + } ] }, { @@ -7140,7 +9152,10 @@ "label": "Fuzzy Match Distance (0 = exact name match only, higher values allow replacing policies with similar names based on Levenshtein distance)", "defaultValue": 0, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" } + "min": { + "value": 0, + "message": "Minimum value is 0" + } }, "warningThreshold": 5, "warningMessage": "Warning: values above 5 can match unrelated policies. Use with caution." @@ -7152,7 +9167,11 @@ "cat": "Templates", "label": "Reusable Settings Template", "multiple": true, - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "High Impact", "impactColour": "info", "addedDate": "2026-01-02", @@ -7196,7 +9215,11 @@ "labelField": "displayName", "valueField": "GUID", "showRefresh": true, - "templateView": { "title": "Reusable Settings", "property": "RawJSON", "type": "intune" } + "templateView": { + "title": "Reusable Settings", + "property": "RawJSON", + "type": "intune" + } } } ], @@ -7207,7 +9230,11 @@ "name": "standards.TransportRuleTemplate", "label": "Transport Rule Template", "cat": "Templates", - "disabledFeatures": { "report": true, "warn": true, "remediate": false }, + "disabledFeatures": { + "report": true, + "warn": true, + "remediate": false + }, "impact": "Medium Impact", "addedDate": "2023-12-30", "helpText": "Deploy transport rules to manage email flow.", @@ -7244,7 +9271,11 @@ "label": "Conditional Access Template", "cat": "Templates", "multiple": true, - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "High Impact", "addedDate": "2023-12-30", "tag": [ @@ -7311,7 +9342,9 @@ "valueField": "GUID", "queryKey": "ListCATemplates", "showRefresh": true, - "templateView": { "title": "Conditional Access Policy" } + "templateView": { + "title": "Conditional Access Policy" + } } }, { @@ -7336,10 +9369,22 @@ "label": "What state should we deploy this template in?", "type": "radio", "options": [ - { "value": "donotchange", "label": "Do not change state" }, - { "value": "Enabled", "label": "Set to enabled" }, - { "value": "Disabled", "label": "Set to disabled" }, - { "value": "enabledForReportingButNotEnforced", "label": "Set to report only" } + { + "value": "donotchange", + "label": "Do not change state" + }, + { + "value": "Enabled", + "label": "Set to enabled" + }, + { + "value": "Disabled", + "label": "Set to disabled" + }, + { + "value": "enabledForReportingButNotEnforced", + "label": "Set to report only" + } ] }, { @@ -7347,15 +9392,26 @@ "name": "DisableSD", "label": "Disable Security Defaults when deploying policy" }, - { "type": "switch", "name": "CreateGroups", "label": "Create groups if they do not exist" } + { + "type": "switch", + "name": "CreateGroups", + "label": "Create groups if they do not exist" + } ], - "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"] + "requiredCapabilities": [ + "AAD_PREMIUM", + "AAD_PREMIUM_P2" + ] }, { "name": "standards.ExchangeConnectorTemplate", "label": "Exchange Connector Template", "cat": "Templates", - "disabledFeatures": { "report": true, "warn": true, "remediate": false }, + "disabledFeatures": { + "report": true, + "warn": true, + "remediate": false + }, "impact": "Medium Impact", "addedDate": "2023-12-30", "helpText": "Deploy and manage Exchange connectors.", @@ -7388,7 +9444,11 @@ "cat": "Templates", "tag": [], "appliesToTest": [], - "disabledFeatures": { "report": true, "warn": true, "remediate": false }, + "disabledFeatures": { + "report": true, + "warn": true, + "remediate": false + }, "impact": "Medium Impact", "addedDate": "2023-12-30", "helpText": "Deploy and manage group templates.", @@ -7407,14 +9467,22 @@ } } ], - "requiredCapabilities": ["EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", "EXCHANGE_LITE"] + "requiredCapabilities": [ + "EXCHANGE_S_STANDARD", + "EXCHANGE_S_ENTERPRISE", + "EXCHANGE_LITE" + ] }, { "name": "standards.DlpCompliancePolicyTemplate", "label": "DLP Compliance Policy Template", "multi": true, "cat": "Templates", - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "Medium Impact", "addedDate": "2026-05-10", "helpText": "Deploy Microsoft Purview DLP compliance policies from CIPP templates.", @@ -7440,7 +9508,11 @@ "label": "Retention Compliance Policy Template", "multi": true, "cat": "Templates", - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "Medium Impact", "addedDate": "2026-05-10", "helpText": "Deploy Microsoft Purview retention compliance policies from CIPP templates.", @@ -7466,7 +9538,11 @@ "label": "Sensitivity Label Template", "multi": true, "cat": "Templates", - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "Medium Impact", "addedDate": "2026-05-10", "helpText": "Deploy Microsoft Purview sensitivity labels from CIPP templates.", @@ -7493,7 +9569,11 @@ "label": "Sensitive Information Type Template", "multi": true, "cat": "Templates", - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "Low Impact", "addedDate": "2026-05-10", "helpText": "Deploy custom Microsoft Purview Sensitive Information Types from CIPP templates.", @@ -7519,7 +9599,11 @@ "label": "Assignment Filter Template", "multi": true, "cat": "Templates", - "disabledFeatures": { "report": true, "warn": true, "remediate": false }, + "disabledFeatures": { + "report": true, + "warn": true, + "remediate": false + }, "impact": "Medium Impact", "addedDate": "2025-10-04", "helpText": "Deploy and manage assignment filter templates.", @@ -7538,13 +9622,23 @@ } } ], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.TenantAllowBlockListTemplate", "label": "Tenant Allow/Block List Template", "cat": "Exchange Standards", - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "Medium Impact", "addedDate": "2026-04-02", "helpText": "Deploy tenant allow/block list entries from a saved template.", @@ -7587,8 +9681,14 @@ "label": "Recipient Limit", "defaultValue": 500, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 1000, "message": "Maximum value is 1000" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 1000, + "message": "Maximum value is 1000" + } } } ], @@ -7597,7 +9697,9 @@ "impactColour": "info", "addedDate": "2025-05-28", "powershellEquivalent": "Set-Mailbox -RecipientLimits", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -7609,7 +9711,10 @@ { "name": "standards.DisableExchangeOnlinePowerShell", "cat": "Exchange Standards", - "tag": ["Security", "NIST CSF 2.0 (PR.AA-05)"], + "tag": [ + "Security", + "NIST CSF 2.0 (PR.AA-05)" + ], "helpText": "Disables Exchange Online PowerShell access for non-admin users by setting the RemotePowerShellEnabled property to false for each user. This helps prevent attackers from using PowerShell to run malicious commands, access file systems, registry, and distribute ransomware throughout networks. Users with admin roles are automatically excluded.", "docsDescription": "Disables Exchange Online PowerShell access for non-admin users by setting the RemotePowerShellEnabled property to false for each user. This security measure follows a least privileged access approach, preventing potential attackers from using PowerShell to execute malicious commands, access sensitive systems, or distribute malware. Users with management roles containing 'Admin' are automatically excluded to ensure administrators retain PowerShell access to perform necessary management tasks.", "executiveText": "Restricts PowerShell access to Exchange Online for regular employees while maintaining access for administrators, significantly reducing security risks from compromised accounts. This prevents attackers from using PowerShell to execute malicious commands or distribute ransomware while preserving necessary administrative capabilities.", @@ -7618,7 +9723,10 @@ "impactColour": "warning", "addedDate": "2025-06-19", "powershellEquivalent": "Set-User -Identity $user -RemotePowerShellEnabled $false", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -7630,7 +9738,10 @@ { "name": "standards.OWAAttachmentRestrictions", "cat": "Exchange Standards", - "tag": ["Security", "NIST CSF 2.0 (PR.AA-05)"], + "tag": [ + "Security", + "NIST CSF 2.0 (PR.AA-05)" + ], "helpText": "Restricts how users on unmanaged devices can interact with email attachments in Outlook on the web and new Outlook for Windows. Prevents downloading attachments or blocks viewing them entirely.", "docsDescription": "This standard configures the OWA mailbox policy to restrict access to email attachments on unmanaged devices. Users can be prevented from downloading attachments (but can view/edit via Office Online) or blocked from seeing attachments entirely. This helps prevent data exfiltration through email attachments on devices not managed by the organization.", "executiveText": "Restricts access to email attachments on personal or unmanaged devices while allowing full functionality on corporate-managed devices. This security measure prevents data theft through email attachments while maintaining productivity for employees using approved company devices.", @@ -7640,7 +9751,10 @@ "name": "standards.OWAAttachmentRestrictions.ConditionalAccessPolicy", "label": "Attachment Restriction Policy", "options": [ - { "label": "Read Only (View/Edit via Office Online, no download)", "value": "ReadOnly" }, + { + "label": "Read Only (View/Edit via Office Online, no download)", + "value": "ReadOnly" + }, { "label": "Read Only Plus Attachments Blocked (Cannot see attachments)", "value": "ReadOnlyPlusAttachmentsBlocked" @@ -7654,7 +9768,10 @@ "impactColour": "warning", "addedDate": "2025-08-22", "powershellEquivalent": "Set-OwaMailboxPolicy -Identity \"OwaMailboxPolicy-Default\" -ConditionalAccessPolicy ReadOnlyPlusAttachmentsBlocked", - "recommendedBy": ["Microsoft Zero Trust", "CIPP"], + "recommendedBy": [ + "Microsoft Zero Trust", + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -7675,7 +9792,9 @@ "impactColour": "info", "addedDate": "2025-08-26", "powershellEquivalent": "None", - "recommendedBy": ["Microsoft"] + "recommendedBy": [ + "Microsoft" + ] }, { "name": "standards.DeployCheckChromeExtension", @@ -7835,11 +9954,26 @@ "label": "Who should this app be assigned to?", "type": "radio", "options": [ - { "label": "Do not assign", "value": "On" }, - { "label": "Assign to all users", "value": "allLicensedUsers" }, - { "label": "Assign to all devices", "value": "AllDevices" }, - { "label": "Assign to all users and devices", "value": "AllDevicesAndUsers" }, - { "label": "Assign to Custom Group", "value": "customGroup" } + { + "label": "Do not assign", + "value": "On" + }, + { + "label": "Assign to all users", + "value": "allLicensedUsers" + }, + { + "label": "Assign to all devices", + "value": "AllDevices" + }, + { + "label": "Assign to all users and devices", + "value": "AllDevicesAndUsers" + }, + { + "label": "Assign to Custom Group", + "value": "customGroup" + } ] }, { @@ -7854,13 +9988,23 @@ "impactColour": "info", "addedDate": "2025-09-18", "powershellEquivalent": "Add-CIPPW32ScriptApplication", - "recommendedBy": ["CIPP"], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "recommendedBy": [ + "CIPP" + ], + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.SecureScoreRemediation", "cat": "Global Standards", - "tag": ["lowimpact"], + "tag": [ + "lowimpact" + ], "helpText": "Allows bulk updating of Secure Score control profiles across tenants. Select controls and assign them to different states: Default, Ignored, Third-Party, or Reviewed.", "addedComponent": [ { @@ -7870,7 +10014,11 @@ "required": false, "name": "standards.SecureScoreRemediation.Default", "label": "Controls to set to Default", - "api": { "url": "/secureScore.json", "labelField": "title", "valueField": "id" } + "api": { + "url": "/secureScore.json", + "labelField": "title", + "valueField": "id" + } }, { "type": "autoComplete", @@ -7879,7 +10027,11 @@ "required": false, "name": "standards.SecureScoreRemediation.Ignored", "label": "Controls to set to Ignored", - "api": { "url": "/secureScore.json", "labelField": "title", "valueField": "id" } + "api": { + "url": "/secureScore.json", + "labelField": "title", + "valueField": "id" + } }, { "type": "autoComplete", @@ -7888,7 +10040,11 @@ "required": false, "name": "standards.SecureScoreRemediation.ThirdParty", "label": "Controls to set to Third-Party", - "api": { "url": "/secureScore.json", "labelField": "title", "valueField": "id" } + "api": { + "url": "/secureScore.json", + "labelField": "title", + "valueField": "id" + } }, { "type": "autoComplete", @@ -7897,7 +10053,11 @@ "creatable": true, "name": "standards.SecureScoreRemediation.Reviewed", "label": "Controls to set to Reviewed", - "api": { "url": "/secureScore.json", "labelField": "title", "valueField": "id" } + "api": { + "url": "/secureScore.json", + "labelField": "title", + "valueField": "id" + } } ], "label": "Update Secure Score Control Profiles", @@ -7909,7 +10069,11 @@ { "name": "standards.ColleagueImpersonationAlert", "cat": "Exchange Standards", - "tag": ["Exchange", "Security", "Transport Rules"], + "tag": [ + "Exchange", + "Security", + "Transport Rules" + ], "helpText": "Creates/updates 5x Exchange Online transport rules (A-E, F-J, K-O, P-T, U-Z) that prepend an HTML disclaimer banner to inbound emails where the sender display name matches a mailbox in the organisation. Accepted tenant domains are always exempt automatically. Inactive users are removed and enabled users are added. Any manually configured sender or domain exemptions already present on existing rules are preserved.", "docsDescription": "Creates five Exchange Online transport rules grouped by the first letter of user display names (A-E, F-J, K-O, P-T, U-Z). Each rule fires when an external sender's From header matches a display name in that group, prepends a configurable HTML warning banner, and skips emails from accepted organisational domains. Any manually configured sender or domain exemptions on existing rules are preserved when the standard runs. The disclaimer HTML is fully customisable via the standard settings.", "executiveText": "Protects staff from display-name impersonation attacks by injecting a visible warning banner on emails that appear to come from a colleague but originate externally. Rules are maintained automatically across all letter groups and updated whenever the standard runs.", @@ -7954,7 +10118,10 @@ { "name": "standards.DefenderCompliancePolicy", "cat": "Defender Standards", - "tag": ["defender_mde_connector", "defender_intune_compliance"], + "tag": [ + "defender_mde_connector", + "defender_intune_compliance" + ], "helpText": "Configures the Microsoft Defender for Endpoint connector with Intune, enabling compliance evaluation for mobile and desktop platforms (Android, iOS, macOS, Windows). Controls which platforms connect to MDE and whether devices are blocked when partner data is missing.", "docsDescription": "Configures the Microsoft Defender for Endpoint mobile threat defense connector with Intune. This enables compliance evaluation across platforms (Android, iOS/iPadOS, macOS, Windows) and controls settings like blocking unsupported OS versions, requiring partner data for compliance, and enabling mobile application management. The connector must be enabled before platform-specific compliance policies can evaluate device risk from MDE.", "executiveText": "Establishes the critical link between Microsoft Defender for Endpoint and Intune, enabling security risk data from MDE to be used in device compliance policies. This ensures that only devices meeting your organization's security standards can access corporate resources, providing a foundational layer of Zero Trust security across all platforms.", @@ -8142,7 +10309,9 @@ "impactColour": "danger", "addedDate": "2026-04-28", "powershellEquivalent": "Portal only", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "CIPP" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -8165,7 +10334,9 @@ "impactColour": "info", "addedDate": "2026-04-28", "powershellEquivalent": "Set-SPOTenant -DisableSharePointStoreAccess $true", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "CIPP" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -8188,7 +10359,9 @@ "impactColour": "danger", "addedDate": "2026-04-28", "powershellEquivalent": "Set-OrganizationConfig -EwsEnabled $false", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "CIPP" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -8524,8 +10697,12 @@ { "name": "standards.EnforcePrivateGroups", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (1.2.1)"], - "appliesToTest": ["CIS_1_2_1"], + "tag": [ + "CIS M365 7.0.0 (1.2.1)" + ], + "appliesToTest": [ + "CIS_1_2_1" + ], "helpText": "Sets all public Microsoft 365 groups to private automatically. Groups can be excluded by display name keyword.", "docsDescription": "Ensures only organisation-managed or approved public groups exist by automatically switching public Microsoft 365 (Unified) groups to private visibility. Groups whose display name matches any of the configured exclusion keywords are left unchanged. This aligns with CIS M365 7.0.0 benchmark control 1.2.1.", "executiveText": "Enforces private visibility on all Microsoft 365 groups to prevent unauthorised external access to group resources such as Teams, SharePoint sites, and Planner boards. Approved public groups can be excluded by name, ensuring governance while retaining flexibility for intentionally public collaboration spaces.", @@ -8544,7 +10721,9 @@ "impactColour": "warning", "addedDate": "2026-05-06", "powershellEquivalent": "Update-MgGroup -GroupId -Visibility Private", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -8558,8 +10737,12 @@ { "name": "standards.EmptyFilterIPAllowList", "cat": "Defender Standards", - "tag": ["CIS M365 7.0.0 (2.1.12)"], - "appliesToTest": ["CIS_2_1_12"], + "tag": [ + "CIS M365 7.0.0 (2.1.12)" + ], + "appliesToTest": [ + "CIS_2_1_12" + ], "helpText": "Ensures the connection filter IP allow list is not used. IPs on this list bypass spam, spoof, and authentication checks.", "docsDescription": "IPs on the connection filter allow list bypass spam, spoof, and authentication checks. CIS recommends keeping this list empty to ensure all inbound email is properly scanned. This standard checks that the IPAllowList on the Default hosted connection filter policy is empty and can remediate by clearing it.", "executiveText": "Ensures the Exchange Online connection filter IP allow list is empty, preventing any IP addresses from bypassing spam filtering, spoofing checks, and sender authentication. Keeping this list empty ensures all inbound email undergoes full security scanning, reducing the risk of phishing and malware delivery through trusted-but-compromised sources.", @@ -8569,7 +10752,9 @@ "impactColour": "warning", "addedDate": "2026-05-06", "powershellEquivalent": "Set-HostedConnectionFilterPolicy -Identity Default -IPAllowList @()", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -8581,8 +10766,12 @@ { "name": "standards.TeamsZAP", "cat": "Defender Standards", - "tag": ["CIS M365 7.0.0 (2.4.4)"], - "appliesToTest": ["CIS_2_4_4"], + "tag": [ + "CIS M365 7.0.0 (2.4.4)" + ], + "appliesToTest": [ + "CIS_2_4_4" + ], "helpText": "Ensures Zero-hour auto purge (ZAP) is enabled for Microsoft Teams, automatically removing malicious messages after delivery.", "docsDescription": "Zero-hour auto purge (ZAP) for Microsoft Teams retroactively detects and neutralises malicious messages that have already been delivered in Teams chats. Enabling ZAP ensures that phishing, malware, and high confidence phishing messages are automatically purged even after initial delivery, aligning with CIS M365 7.0.0 benchmark control 2.4.4.", "executiveText": "Enables Zero-hour auto purge for Microsoft Teams to automatically detect and remove malicious messages after delivery. This provides an additional layer of protection against phishing and malware that may bypass initial scanning, ensuring threats are neutralised even after they reach users.", @@ -8592,7 +10781,9 @@ "impactColour": "info", "addedDate": "2026-05-06", "powershellEquivalent": "Set-TeamsProtectionPolicy -Identity 'Teams Protection Policy' -ZapEnabled $true", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -8604,8 +10795,12 @@ { "name": "standards.CollaborationDomainRestriction", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (5.1.6.1)"], - "appliesToTest": ["CIS_5_1_6_1"], + "tag": [ + "CIS M365 7.0.0 (5.1.6.1)" + ], + "appliesToTest": [ + "CIS_5_1_6_1" + ], "helpText": "Restricts B2B collaboration invitations to a specified list of allowed domains. If no domains are provided, the standard will alert and report on whether any domain restrictions are currently configured.", "docsDescription": "By default, Microsoft Entra ID allows collaboration invitations to be sent to any external domain. CIS recommends restricting B2B collaboration invitations to only approved domains to reduce the risk of data exfiltration and unauthorized access. This standard checks the B2B management policy for an allow list of domains and can remediate by setting the allowed domains list.", "executiveText": "Restricts external collaboration invitations to approved domains only, preventing users from sharing data with unapproved external organizations. This reduces the risk of data exfiltration and ensures that collaboration occurs only with trusted business partners.", @@ -8623,7 +10818,9 @@ "impactColour": "warning", "addedDate": "2026-05-06", "powershellEquivalent": "Graph API PATCH https://graph.microsoft.com/beta/policies/b2bManagementPolicies/default", - "recommendedBy": ["CIS"] + "recommendedBy": [ + "CIS" + ] }, { "name": "standards.IntuneAppTemplateDeploy", @@ -8644,7 +10841,9 @@ "labelField": "displayName", "valueField": "GUID", "queryKey": "StdIntuneAppTemplateList", - "templateView": { "title": "Application Template" } + "templateView": { + "title": "Application Template" + } } } ], @@ -8661,7 +10860,11 @@ "tag": [], "beta": true, "deprecated": true, - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "helpText": "Deploys a Windows Autopatch group with configurable deployment ring settings for quality updates, feature updates, Edge, and Office.", "docsDescription": "Creates or updates a Windows Autopatch deployment group with Test and Last deployment rings. Configures quality update deferrals, feature update targeting, Edge and Office update channels per ring. Uses the Autopatch API proxy to manage the group configuration.", "executiveText": "Configures Windows Autopatch deployment groups to manage update delivery across devices. Autopatch automates Windows quality updates, feature updates, Edge, and Office updates using deployment rings with configurable deferrals and deadlines.", @@ -8680,8 +10883,14 @@ "label": "Target OS Version", "required": true, "options": [ - { "label": "Windows 11, version 24H2", "value": "Windows 11, version 24H2" }, - { "label": "Windows 11, version 25H2", "value": "Windows 11, version 25H2" } + { + "label": "Windows 11, version 24H2", + "value": "Windows 11, version 24H2" + }, + { + "label": "Windows 11, version 25H2", + "value": "Windows 11, version 25H2" + } ], "defaultValue": "Windows 11, version 25H2" }, @@ -8703,8 +10912,14 @@ "label": "Test Ring - Quality Update Deferral (days)", "defaultValue": 0, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } }, { @@ -8713,8 +10928,14 @@ "label": "Test Ring - Quality Update Deadline (days)", "defaultValue": 1, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } }, { @@ -8723,8 +10944,14 @@ "label": "Test Ring - Quality Update Grace Period (days)", "defaultValue": 1, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 7, "message": "Maximum value is 7" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 7, + "message": "Maximum value is 7" + } } }, { @@ -8733,8 +10960,14 @@ "label": "Test Ring - Feature Update Deferral (days)", "defaultValue": 0, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 365, "message": "Maximum value is 365" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 365, + "message": "Maximum value is 365" + } } }, { @@ -8743,8 +10976,14 @@ "label": "Test Ring - Feature Update Deadline (days)", "defaultValue": 5, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } }, { @@ -8753,9 +10992,18 @@ "name": "standards.AutopatchGroup.TestEdgeChannel", "label": "Test Ring - Edge Update Channel", "options": [ - { "label": "Stable", "value": "Stable" }, - { "label": "Beta", "value": "Beta" }, - { "label": "Dev", "value": "Dev" } + { + "label": "Stable", + "value": "Stable" + }, + { + "label": "Beta", + "value": "Beta" + }, + { + "label": "Dev", + "value": "Dev" + } ], "defaultValue": "Beta" }, @@ -8765,9 +11013,18 @@ "name": "standards.AutopatchGroup.TestOfficeChannel", "label": "Test Ring - Office Update Channel", "options": [ - { "label": "Current", "value": "Current" }, - { "label": "Monthly Enterprise", "value": "MonthlyEnterprise" }, - { "label": "Semi-Annual Enterprise", "value": "SemiAnnual" } + { + "label": "Current", + "value": "Current" + }, + { + "label": "Monthly Enterprise", + "value": "MonthlyEnterprise" + }, + { + "label": "Semi-Annual Enterprise", + "value": "SemiAnnual" + } ], "defaultValue": "MonthlyEnterprise" }, @@ -8777,8 +11034,14 @@ "label": "Test Ring - Driver & Firmware Deferral (days)", "defaultValue": 0, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } }, { @@ -8787,8 +11050,14 @@ "label": "Last Ring - Quality Update Deferral (days)", "defaultValue": 1, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } }, { @@ -8797,8 +11066,14 @@ "label": "Last Ring - Quality Update Deadline (days)", "defaultValue": 2, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } }, { @@ -8807,8 +11082,14 @@ "label": "Last Ring - Quality Update Grace Period (days)", "defaultValue": 2, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 7, "message": "Maximum value is 7" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 7, + "message": "Maximum value is 7" + } } }, { @@ -8817,8 +11098,14 @@ "label": "Last Ring - Feature Update Deferral (days)", "defaultValue": 0, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 365, "message": "Maximum value is 365" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 365, + "message": "Maximum value is 365" + } } }, { @@ -8827,8 +11114,14 @@ "label": "Last Ring - Feature Update Deadline (days)", "defaultValue": 5, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } }, { @@ -8837,9 +11130,18 @@ "name": "standards.AutopatchGroup.LastEdgeChannel", "label": "Last Ring - Edge Update Channel", "options": [ - { "label": "Stable", "value": "Stable" }, - { "label": "Beta", "value": "Beta" }, - { "label": "Dev", "value": "Dev" } + { + "label": "Stable", + "value": "Stable" + }, + { + "label": "Beta", + "value": "Beta" + }, + { + "label": "Dev", + "value": "Dev" + } ], "defaultValue": "Stable" }, @@ -8849,9 +11151,18 @@ "name": "standards.AutopatchGroup.LastOfficeChannel", "label": "Last Ring - Office Update Channel", "options": [ - { "label": "Current", "value": "Current" }, - { "label": "Monthly Enterprise", "value": "MonthlyEnterprise" }, - { "label": "Semi-Annual Enterprise", "value": "SemiAnnual" } + { + "label": "Current", + "value": "Current" + }, + { + "label": "Monthly Enterprise", + "value": "MonthlyEnterprise" + }, + { + "label": "Semi-Annual Enterprise", + "value": "SemiAnnual" + } ], "defaultValue": "MonthlyEnterprise" }, @@ -8861,8 +11172,14 @@ "label": "Last Ring - Office Update Deferral (days)", "defaultValue": 1, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } }, { @@ -8871,8 +11188,14 @@ "label": "Last Ring - Office Update Deadline (days)", "defaultValue": 2, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } }, { @@ -8881,8 +11204,14 @@ "label": "Last Ring - Driver & Firmware Deferral (days)", "defaultValue": 1, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } } ], @@ -8907,9 +11236,18 @@ "name": "standards.FIDO2PasskeyProfiles.PasskeyTypes", "label": "Allowed Passkey Types", "options": [ - { "label": "Device-bound only", "value": "deviceBound" }, - { "label": "Synced only", "value": "synced" }, - { "label": "Both device-bound and synced", "value": "deviceBound,synced" } + { + "label": "Device-bound only", + "value": "deviceBound" + }, + { + "label": "Synced only", + "value": "synced" + }, + { + "label": "Both device-bound and synced", + "value": "deviceBound,synced" + } ], "required": true }, @@ -8919,8 +11257,14 @@ "name": "standards.FIDO2PasskeyProfiles.AttestationEnforcement", "label": "Attestation Enforcement", "options": [ - { "label": "Disabled (required for synced passkeys)", "value": "disabled" }, - { "label": "Registration only", "value": "registrationOnly" } + { + "label": "Disabled (required for synced passkeys)", + "value": "disabled" + }, + { + "label": "Registration only", + "value": "registrationOnly" + } ], "required": true }, @@ -8935,8 +11279,14 @@ "name": "standards.FIDO2PasskeyProfiles.EnforcementType", "label": "Key Restriction Type", "options": [ - { "label": "Allow listed AAGUIDs only", "value": "allow" }, - { "label": "Block listed AAGUIDs", "value": "block" } + { + "label": "Allow listed AAGUIDs only", + "value": "allow" + }, + { + "label": "Block listed AAGUIDs", + "value": "block" + } ], "required": false }, @@ -8952,13 +11302,21 @@ "impactColour": "warning", "addedDate": "2026-05-25", "powershellEquivalent": "Graph API PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/fido2", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "CIPP" + ] }, { "name": "standards.SmartLockout", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (5.2.3.8)", "CIS M365 7.0.0 (5.2.3.9)"], - "appliesToTest": ["CIS_5_2_3_8", "CIS_5_2_3_9"], + "tag": [ + "CIS M365 7.0.0 (5.2.3.8)", + "CIS M365 7.0.0 (5.2.3.9)" + ], + "appliesToTest": [ + "CIS_5_2_3_8", + "CIS_5_2_3_9" + ], "helpText": "**Requires Entra ID P1.** Configures the Entra ID Smart Lockout settings including lockout duration, lockout threshold, and on-premises integration mode.", "docsDescription": "Configures the Entra ID Smart Lockout policy which protects against brute-force password attacks. Smart Lockout locks out bad actors who try to guess user passwords or use brute-force methods. It recognizes sign-ins from valid users and treats them differently from attackers. Settings include lockout duration (seconds), lockout threshold (failed attempts before lockout), and on-premises password protection mode (Audit or Enforce).", "addedComponent": [ @@ -8986,8 +11344,14 @@ "name": "standards.SmartLockout.BannedPasswordCheckOnPremisesMode", "label": "On-Premises Mode", "options": [ - { "label": "Audit", "value": "Audit" }, - { "label": "Enforce", "value": "Enforce" } + { + "label": "Audit", + "value": "Audit" + }, + { + "label": "Enforce", + "value": "Enforce" + } ] } ], @@ -8996,8 +11360,13 @@ "impactColour": "warning", "addedDate": "2025-05-27", "powershellEquivalent": "Get-MgBetaDirectorySetting, New-MgBetaDirectorySetting, Update-MgBetaDirectorySetting", - "recommendedBy": ["CIS"], - "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"] + "recommendedBy": [ + "CIS" + ], + "requiredCapabilities": [ + "AAD_PREMIUM", + "AAD_PREMIUM_P2" + ] }, { "name": "standards.SPOVersionControl", @@ -9024,8 +11393,14 @@ "label": "Expire Versions After Days (0 = never, otherwise 30-36500, when auto trim is off)", "default": 0, "validators": { - "min": { "value": 0, "message": "Use 0 for never, or 30 or more days" }, - "max": { "value": 36500, "message": "Maximum value is 36500" } + "min": { + "value": 0, + "message": "Use 0 for never, or 30 or more days" + }, + "max": { + "value": 36500, + "message": "Maximum value is 36500" + } } }, { @@ -9046,6 +11421,327 @@ "remediate": false } }, + { + "name": "standards.AutomaticUserConsent", + "cat": "Entra (AAD) Standards", + "tag": [], + "helpText": "Controls whether users automatically redeem invitations when accessing external organizations or when external users access your resources. When enabled, users don't see a consent prompt for first-time access.", + "docsDescription": "Controls the automatic user consent settings in the cross-tenant access policy defaults. Inbound automatic consent means external users will automatically redeem invitations without a consent prompt. Outbound automatic consent means your users will automatically redeem invitations from other organizations. This is commonly used to streamline B2B collaboration and B2B Direct Connect experiences.", + "executiveText": "Controls automatic invitation redemption for cross-tenant collaboration. Enabling automatic consent provides a smoother experience for B2B collaborators by removing the manual invitation acceptance step, while disabling it ensures users explicitly agree before accessing external resources.", + "addedComponent": [ + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Inbound automatic redemption", + "name": "standards.AutomaticUserConsent.inboundAllowed", + "options": [ + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } + ] + }, + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Outbound automatic redemption", + "name": "standards.AutomaticUserConsent.outboundAllowed", + "options": [ + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } + ] + } + ], + "label": "Sets automatic invitation redemption for cross-tenant access", + "impact": "Low Impact", + "impactColour": "info", + "addedDate": "2026-02-13", + "powershellEquivalent": "Update-MgPolicyCrossTenantAccessPolicyDefault", + "recommendedBy": [] + }, + { + "name": "standards.B2BCollaborationInbound", + "cat": "Entra (AAD) Standards", + "tag": [], + "helpText": "Controls whether external users from other organizations can be invited to access your resources through B2B collaboration (guest access) by default. This applies to all external organizations without a partner-specific configuration.", + "docsDescription": "Controls whether external users from other organizations can be invited to access your resources through B2B collaboration (guest access) by default. When set to blocked, no external users can collaborate unless a partner-specific override is configured.", + "executiveText": "Manages the default inbound B2B collaboration policy, controlling whether external users from partner organizations can access company resources as guests. Restricting this to specific organizations reduces the attack surface while allowing necessary business collaboration.", + "addedComponent": [ + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Default inbound B2B collaboration access", + "name": "standards.B2BCollaborationInbound.accessType", + "options": [ + { + "label": "Allow (all external users)", + "value": "allowed" + }, + { + "label": "Block (no external users)", + "value": "blocked" + } + ] + } + ], + "label": "Sets the default inbound B2B collaboration access policy", + "impact": "Medium Impact", + "impactColour": "warning", + "addedDate": "2026-02-13", + "powershellEquivalent": "Update-MgPolicyCrossTenantAccessPolicyDefault", + "recommendedBy": [] + }, + { + "name": "standards.B2BCollaborationOutbound", + "cat": "Entra (AAD) Standards", + "tag": [], + "helpText": "Controls whether your users can be invited to access resources in other organizations through B2B collaboration by default. This applies to all external organizations without a partner-specific configuration.", + "docsDescription": "Controls whether your users can be invited to access resources in other organizations through B2B collaboration by default. When set to blocked, users cannot collaborate externally unless a partner-specific override is configured.", + "executiveText": "Manages the default outbound B2B collaboration policy, controlling whether company employees can accept invitations to collaborate in external organizations. This helps prevent data leakage by controlling where users can share information.", + "addedComponent": [ + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Default outbound B2B collaboration access", + "name": "standards.B2BCollaborationOutbound.accessType", + "options": [ + { + "label": "Allow (all users)", + "value": "allowed" + }, + { + "label": "Block (no users)", + "value": "blocked" + } + ] + } + ], + "label": "Sets the default outbound B2B collaboration access policy", + "impact": "Medium Impact", + "impactColour": "warning", + "addedDate": "2026-02-13", + "powershellEquivalent": "Update-MgPolicyCrossTenantAccessPolicyDefault", + "recommendedBy": [] + }, + { + "name": "standards.B2BDirectConnectInbound", + "cat": "Entra (AAD) Standards", + "tag": [], + "helpText": "Controls whether external users can access your Teams shared channels through B2B Direct Connect by default. Direct Connect enables seamless collaboration without creating guest accounts.", + "docsDescription": "Controls whether external users can access your Teams shared channels through B2B Direct Connect by default. When blocked, no external users can join shared channels unless a partner-specific override is configured. B2B Direct Connect is commonly used for Teams shared channels.", + "executiveText": "Controls whether external users can seamlessly join Teams shared channels through B2B Direct Connect. Blocking this by default and only allowing specific partner organizations reduces unauthorized access to sensitive team collaboration spaces.", + "addedComponent": [ + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Default inbound B2B Direct Connect access", + "name": "standards.B2BDirectConnectInbound.accessType", + "options": [ + { + "label": "Allow (all external users)", + "value": "allowed" + }, + { + "label": "Block (no external users)", + "value": "blocked" + } + ] + } + ], + "label": "Sets the default inbound B2B Direct Connect access policy", + "impact": "Medium Impact", + "impactColour": "warning", + "addedDate": "2026-02-13", + "powershellEquivalent": "Update-MgPolicyCrossTenantAccessPolicyDefault", + "recommendedBy": [] + }, + { + "name": "standards.B2BDirectConnectOutbound", + "cat": "Entra (AAD) Standards", + "tag": [], + "helpText": "Controls whether your users can access external Teams shared channels through B2B Direct Connect by default. This applies to all external organizations without a partner-specific configuration.", + "docsDescription": "Controls whether your users can access external Teams shared channels through B2B Direct Connect by default. When blocked, users cannot join external shared channels unless a partner-specific override is configured.", + "executiveText": "Controls whether employees can join external Teams shared channels through B2B Direct Connect. Blocking outbound Direct Connect by default and only allowing specific partners prevents uncontrolled data sharing through external collaboration channels.", + "addedComponent": [ + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Default outbound B2B Direct Connect access", + "name": "standards.B2BDirectConnectOutbound.accessType", + "options": [ + { + "label": "Allow (all users)", + "value": "allowed" + }, + { + "label": "Block (no users)", + "value": "blocked" + } + ] + } + ], + "label": "Sets the default outbound B2B Direct Connect access policy", + "impact": "Medium Impact", + "impactColour": "warning", + "addedDate": "2026-02-13", + "powershellEquivalent": "Update-MgPolicyCrossTenantAccessPolicyDefault", + "recommendedBy": [] + }, + { + "name": "standards.BlockMSNSignIn", + "cat": "Entra (AAD) Standards", + "tag": [], + "helpText": "Controls whether personal Microsoft accounts (MSN/Outlook.com/Hotmail) can be used to sign in. Blocking MSN sign-in prevents users from using personal accounts to access organizational resources.", + "docsDescription": "Controls whether personal Microsoft accounts (MSN/Outlook.com/Hotmail) can be used to sign in to the tenant. When enabled, users cannot use personal Microsoft accounts to access organizational resources, improving security by ensuring only managed accounts are used.", + "executiveText": "Prevents users from signing in with personal Microsoft accounts (Outlook.com, Hotmail, etc.), ensuring that only organizational or approved external accounts can access company resources. This reduces shadow IT risks and maintains compliance with identity governance policies.", + "addedComponent": [ + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Block MSN sign-in", + "name": "standards.BlockMSNSignIn.state", + "options": [ + { + "label": "Enabled (block personal accounts)", + "value": "true" + }, + { + "label": "Disabled (allow personal accounts)", + "value": "false" + } + ] + } + ], + "label": "Block personal Microsoft account (MSN) sign-in", + "impact": "Low Impact", + "impactColour": "info", + "addedDate": "2026-02-13", + "powershellEquivalent": "Update-MgPolicyAuthorizationPolicy", + "recommendedBy": [] + }, + { + "name": "standards.CrossTenantTrustCompliant", + "cat": "Entra (AAD) Standards", + "tag": [], + "helpText": "Sets the state of the Cross-tenant access setting to trust compliant devices from external organizations. This allows guest users to satisfy your device compliance Conditional Access policies using their home tenant's Intune compliance status.", + "docsDescription": "Sets the state of the Cross-tenant access setting to trust compliant devices from external organizations. When enabled, your Conditional Access policies that require compliant devices will accept device compliance claims from partner organizations managed through Intune.", + "executiveText": "Enables trusting device compliance status from partner organizations, allowing external collaborators with Intune-managed compliant devices to access company resources without additional device enrollment. This streamlines cross-organization collaboration while maintaining device security requirements.", + "addedComponent": [ + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Trust compliant devices from external tenants", + "name": "standards.CrossTenantTrustCompliant.state", + "options": [ + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } + ] + } + ], + "label": "Sets the Cross-tenant access setting to trust compliant devices", + "impact": "Low Impact", + "impactColour": "info", + "addedDate": "2026-02-13", + "powershellEquivalent": "Update-MgPolicyCrossTenantAccessPolicyDefault", + "recommendedBy": [] + }, + { + "name": "standards.CrossTenantTrustHybridJoin", + "cat": "Entra (AAD) Standards", + "tag": [], + "helpText": "Sets the state of the Cross-tenant access setting to trust Microsoft Entra hybrid joined devices from external organizations. This allows guest users to satisfy your Conditional Access policies that require hybrid joined devices using their home tenant's device status.", + "docsDescription": "Sets the state of the Cross-tenant access setting to trust Microsoft Entra hybrid joined devices from external organizations. When enabled, your Conditional Access policies that require hybrid Azure AD joined devices will accept claims from partner organizations.", + "executiveText": "Enables trusting hybrid Azure AD joined device claims from partner organizations, allowing external collaborators with domain-joined devices to access company resources without additional requirements. This supports cross-organization collaboration for enterprises using hybrid identity.", + "addedComponent": [ + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Trust hybrid Azure AD joined devices from external tenants", + "name": "standards.CrossTenantTrustHybridJoin.state", + "options": [ + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } + ] + } + ], + "label": "Sets the Cross-tenant access setting to trust hybrid Azure AD joined devices", + "impact": "Low Impact", + "impactColour": "info", + "addedDate": "2026-02-13", + "powershellEquivalent": "Update-MgPolicyCrossTenantAccessPolicyDefault", + "recommendedBy": [] + }, + { + "name": "standards.GuestUserRole", + "cat": "Entra (AAD) Standards", + "tag": [ + "\"EIDSCA.AP14\"" + ], + "helpText": "Sets the default access level for guest users in the directory. Choose between member-level access, default guest access, or the most restrictive setting that blocks directory enumeration. This is a more flexible alternative to the DisableGuestDirectory standard.", + "docsDescription": "Controls what permissions guest users have in the directory. The most restrictive option prevents guests from enumerating users and group memberships. The default option limits guest access but allows basic directory browsing. The least restrictive option gives guests the same access as member users.", + "executiveText": "Controls the level of directory access granted to external guest users, balancing collaboration needs with security requirements. Setting appropriate guest permissions prevents unauthorized discovery of organizational structure and employee information.", + "addedComponent": [ + { + "type": "autoComplete", + "required": true, + "multiple": false, + "creatable": false, + "label": "Guest user access level", + "name": "standards.GuestUserRole.guestUserRoleId", + "options": [ + { + "label": "Same access as member users (least restrictive)", + "value": "a0b1b346-4d3e-4e8b-98f8-753987be4970" + }, + { + "label": "Limited access - default guest access", + "value": "10dae51f-b6af-4016-8d66-8c2a99b929b3" + }, + { + "label": "Restricted access - cannot enumerate directory (most restrictive)", + "value": "2af84b1e-32c8-42b7-82bc-daa82404023b" + } + ] + } + ], + "label": "Sets the guest user default access level", + "impact": "Medium Impact", + "impactColour": "warning", + "addedDate": "2026-02-13", + "powershellEquivalent": "Update-MgPolicyAuthorizationPolicy", + "recommendedBy": [] + }, { "name": "standards.PIMRoleSettings", "label": "PIM Role Settings Template", diff --git a/backend/Config/words.txt b/backend/Config/words.txt index 6acd4124ca..e22a707f75 100644 --- a/backend/Config/words.txt +++ b/backend/Config/words.txt @@ -1,16914 +1,16914 @@ -Abacus -Abandon -Abandoned -Abatement -Abbey -Abbot -Abdomen -Abdominal -Abide -Abiding -Ability -Ablaze -Able -Abnormal -Abode -Abolish -Abolished -Abolition -Abound -Above -Abrasion -Abrasive -Abreast -Abridge -Abroad -Abrupt -Abruptly -Absence -Absent -Absentee -Absently -Absinthe -Absolute -Absolve -Absorb -Absorbed -Absorbing -Absorbs -Abstain -Abstract -Abstracts -Absurd -Absurdity -Abundance -Abundant -Abyss -Acacia -Academia -Academic -Academics -Academies -Academy -Accent -Accents -Accept -Accepted -Accepting -Accepts -Access -Accessed -Accessing -Accession -Accessory -Accident -Accidents -Acclaim -Acclaimed -Acclimate -Accolades -Accompany -Accord -Accorded -According -Accordion -Accords -Account -Accounted -Accounts -Accretion -Accrual -Accrue -Accrued -Accuracy -Accurate -Accuse -Accused -Accuses -Accusing -Accustom -Acetate -Acetic -Acetone -Achieve -Achieved -Achieves -Achieving -Achiness -Aching -Acid -Acidic -Acidity -Acids -Acne -Acorn -Acoustic -Acquaint -Acquire -Acquired -Acquires -Acquiring -Acquitted -Acre -Acreage -Acrobat -Acronym -Across -Acrylic -Acting -Action -Activate -Activates -Activator -Active -Actively -Activism -Activist -Activists -Activity -Actress -Actresses -Acts -Actuality -Actually -Acuity -Acute -Acutely -Acuteness -Adamant -Adapt -Adaptable -Adapted -Adapter -Adapting -Adaptive -Add -Adding -Addition -Additions -Additive -Additives -Address -Addressed -Addresses -Adds -Adept -Adhere -Adhered -Adherence -Adherents -Adhering -Adhesion -Adhesive -Adjacent -Adjective -Adjoining -Adjunct -Adjust -Adjusted -Adjusting -Admin -Admirable -Admirably -Admiral -Admirals -Admiralty -Admire -Admired -Admirer -Admirers -Admiring -Admission -Admit -Admits -Admitted -Admitting -Adobe -Adopt -Adopted -Adopting -Adoption -Adoptive -Adopts -Adoration -Adored -Adorned -Adrenal -Adult -Adulthood -Adults -Advance -Advanced -Advances -Advancing -Advantage -Advent -Adventure -Adverb -Adverbs -Adversary -Adverse -Adversely -Adversity -Advertise -Advice -Advisable -Advise -Advised -Adviser -Advisers -Advises -Advising -Advisory -Advocacy -Advocate -Advocated -Advocates -Aegis -Aeration -Aerial -Aerobics -Aerosol -Aerospace -Afar -Affair -Affairs -Affect -Affected -Affecting -Affection -Affects -Affidavit -Affiliate -Affinity -Affirm -Affirming -Affirms -Affix -Afflicted -Affluence -Affluent -Afford -Afforded -Affords -Affront -Afghan -Aflame -Afloat -Aflutter -Afoot -Afraid -Afterglow -Afterlife -Aftermath -Aftermost -Afternoon -Afterward -Again -Against -Aged -Ageless -Agencies -Agency -Agenda -Agendas -Agent -Aggregate -Aghast -Agile -Agility -Aging -Agitated -Agitation -Agnostic -Agonize -Agonizing -Agony -Agrarian -Agree -Agreeable -Agreeably -Agreed -Agreeing -Agreement -Agrees -Aground -Ahead -Ahoy -Aide -Aides -Ailments -Aim -Aimed -Aiming -Aims -Airborne -Aircraft -Airfield -Airfields -Airlift -Airline -Airlines -Airmen -Airplane -Airplanes -Airport -Airports -Airship -Airspace -Airstrip -Airways -Aisle -Aisles -Ajar -Akin -Alabaster -Alarm -Alarmed -Alarming -Alarms -Alas -Albatross -Albeit -Album -Albumin -Albums -Alchemy -Alcohol -Alcoholic -Alder -Alderman -Aldermen -Alert -Alerted -Alfalfa -Algae -Algebra -Algebraic -Algebras -Algorithm -Alias -Alibi -Alien -Alienable -Alienate -Alienated -Aliens -Align -Aligned -Alignment -Alike -Alive -Alkali -Alkaline -Alkalize -Alleged -Allegedly -Alleging -Allegory -Allergic -Allergies -Allergy -Alleviate -Alliance -Alliances -Alligator -Allocate -Allocated -Allotment -Allotted -Allowable -Allowance -Allowed -Allowing -Allows -Alloy -Alloys -Alluded -Alludes -Allusion -Allusions -Alluvial -Almanac -Almighty -Almond -Almost -Aloe -Aloft -Aloha -Alone -Along -Alongside -Aloof -Aloud -Alpha -Alphabet -Alpine -Already -Alright -Altar -Altars -Alter -Altered -Altering -Alternate -Alters -Although -Altitude -Altitudes -Alto -Altruism -Aluminum -Alumni -Always -Amalgam -Amaretto -Amassed -Amateur -Amateurs -Amaze -Amazed -Amazement -Amazing -Amazingly -Amazon -Amber -Ambiance -Ambient -Ambiguity -Ambiguous -Ambition -Ambitions -Ambitious -Ambulance -Ambush -Ambushed -Amenable -Amend -Amendable -Amended -Amending -Amendment -Amends -Amenities -Amenity -Amiable -Amicably -Amid -Amidst -Amigo -Amino -Amiss -Ammonia -Ammonium -Amnesia -Amnesty -Amniotic -Among -Amongst -Amorphous -Amount -Amounted -Amounting -Amounts -Amperage -Ample -Amplified -Amplifier -Amplify -Amplitude -Amply -Amuck -Amulet -Amusable -Amuse -Amused -Amusement -Amuser -Amusing -Anaconda -Anaerobic -Anagram -Analog -Analogies -Analogous -Analogy -Analysis -Analyst -Analysts -Analytic -Analyze -Analyzed -Analyzer -Analyzes -Analyzing -Anarchy -Anatomic -Anatomist -Anatomy -Ancestor -Ancestors -Ancestral -Ancestry -Anchor -Anchorage -Anchored -Anchors -Anchovy -Ancient -Ancients -Ancillary -Androgen -Android -Anecdotal -Anecdote -Anecdotes -Anemia -Anemic -Aneurism -Anew -Angelfish -Angelic -Angels -Anger -Angled -Angler -Angles -Angling -Angrily -Angriness -Angry -Anguish -Anguished -Angular -Animal -Animals -Animate -Animated -Animating -Animation -Animator -Anime -Animosity -Anion -Ankle -Ankles -Annals -Annealing -Annex -Annexed -Annotate -Annotated -Announce -Announced -Announcer -Announces -Annoyance -Annoyed -Annoying -Annual -Annually -Annuity -Annulled -Anode -Anointed -Anointer -Anomalies -Anomalous -Anomaly -Anonymity -Anonymous -Another -Answer -Answering -Answers -Antacid -Antarctic -Ante -Anteater -Antelope -Antenna -Antennae -Antennas -Anterior -Anthem -Anthill -Anthology -Antibody -Antics -Antidote -Antigen -Antigens -Antihero -Antique -Antiquely -Antiques -Antiquity -Antirust -Antitoxic -Antitrust -Antiviral -Antivirus -Antler -Antonym -Antsy -Anvil -Anxieties -Anxiety -Anxious -Anxiously -Anybody -Anyhow -Anymore -Anyone -Anyplace -Anything -Anytime -Anyway -Anywhere -Aorta -Apache -Apart -Apartment -Apathy -Aperture -Apex -Apologies -Apologize -Apology -Apostle -Apostles -App -Appalled -Appalling -Apparatus -Apparel -Apparent -Appeal -Appealed -Appealing -Appeals -Appear -Appearing -Appears -Appease -Appeasing -Appellant -Appellate -Appendage -Appended -Appendix -Appetite -Appetites -Appetizer -Applaud -Applauded -Applause -Apple -Apples -Appliance -Applicant -Applied -Applies -Apply -Applying -Appoint -Appointed -Appointee -Appoints -Appraisal -Appraiser -Apprehend -Approach -Approval -Approve -Approved -Approving -Apps -Apricot -April -Apron -Aptitude -Aptly -Aqua -Aquarium -Aquatic -Aquatics -Aqueduct -Aquifer -Arbitrary -Arbitrate -Arboretum -Arc -Arcade -Arcades -Archaic -Archangel -Archduke -Archer -Archers -Archery -Archetype -Architect -Archive -Archived -Archives -Arcs -Ardent -Ardently -Arduous -Area -Areas -Arena -Arenas -Argon -Arguable -Arguably -Argue -Argued -Argues -Arguing -Argument -Arguments -Argyle -Arid -Arise -Arisen -Arises -Arising -Armada -Armadillo -Armament -Armaments -Armband -Armchair -Armed -Armful -Armhole -Armies -Arming -Armistice -Armless -Armoire -Armor -Armored -Armory -Armrest -Army -Aroma -Aromatic -Arose -Around -Arrange -Arranged -Arranger -Arranges -Arranging -Array -Arrays -Arrears -Arrest -Arrested -Arresting -Arrests -Arrival -Arrivals -Arrive -Arrived -Arrives -Arriving -Arrogance -Arrogant -Arroyo -Arsenal -Art -Arteries -Artery -Arthritis -Artifact -Artifacts -Artillery -Artist -Artistic -Artistry -Artists -Artwork -Artworks -Asbestos -Ascend -Ascended -Ascending -Ascension -Ascent -Ascertain -Ascetic -Ascribe -Ascribed -Ashamed -Ashen -Ashes -Ashore -Ashy -Aside -Askew -Asleep -Asparagus -Aspect -Aspects -Aspen -Asphalt -Aspirate -Aspire -Aspirin -Aspiring -Assay -Assays -Assemble -Assembled -Assembly -Assent -Assert -Asserted -Asserting -Assertion -Assertive -Asserts -Assess -Assessed -Assesses -Assessing -Asset -Assets -Assign -Assigning -Assigns -Assistant -Assisted -Assisting -Assists -Associate -Assorted -Assume -Assumed -Assumes -Assuming -Assuredly -Assures -Asteroid -Asteroids -Asthma -Astonish -Astound -Astray -Astride -Astrology -Astronaut -Astronomy -Astute -Asymmetry -Athlete -Athletes -Athletic -Athletics -Atlantic -Atlas -Atoll -Atom -Atoms -Atonable -Atonement -Atop -Atrium -Atrocious -Atrophy -Attach -Attached -Attaching -Attacked -Attacker -Attackers -Attacking -Attacks -Attain -Attained -Attaining -Attains -Attempt -Attempted -Attempts -Attend -Attendant -Attended -Attendee -Attending -Attends -Attention -Attentive -Attest -Attested -Attic -Attire -Attitude -Attitudes -Attorney -Attorneys -Attract -Attracted -Attractor -Attracts -Attribute -Attrition -Attuned -Atypical -Auburn -Auction -Auctioned -Auctions -Audacious -Audacity -Audible -Audibly -Audience -Audiences -Audio -Audit -Auditing -Audition -Auditions -Auditor -Auditors -Auditory -Audits -Augment -Augmented -August -Aura -Auspices -Austere -Austerity -Authentic -Author -Authored -Authority -Authorize -Authors -Auto -Autograph -Automaker -Automated -Automatic -Autonomy -Autopilot -Autumn -Auxiliary -Avail -Available -Avalanche -Avatar -Avenge -Avengers -Avenging -Avenue -Avenues -Average -Averaged -Averages -Averaging -Averse -Aversion -Avert -Averted -Avian -Aviation -Aviator -Avid -Avoid -Avoidance -Avoided -Avoiding -Avoids -Await -Awaited -Awaiting -Awaits -Awake -Awaken -Awakened -Awakening -Awakens -Award -Awarded -Awarding -Awards -Aware -Awareness -Awe -Awesome -Awfully -Awhile -Awkward -Awkwardly -Awning -Awoke -Awry -Axe -Axial -Axiom -Axioms -Axis -Axle -Axles -Axon -Axons -Aye -Azure -Babble -Babbling -Babied -Babies -Baboon -Baby -Bachelor -Backache -Backboard -Backbone -Backboned -Backdrop -Backed -Backer -Backfield -Backfire -Backhand -Backing -Backlands -Backlash -Backless -Backlight -Backlit -Backlog -Backpack -Backpedal -Backrest -Backroom -Backshift -Backside -Backslid -Backspace -Backspin -Backstab -Backstage -Backstory -Backtalk -Backtrack -Backup -Backward -Backwards -Backwash -Backwater -Backyard -Bacon -Bacteria -Bacterial -Bacterium -Bad -Bade -Badge -Badger -Badgers -Badges -Badland -Badly -Badminton -Badness -Baffle -Baffled -Baffling -Bag -Bagel -Bagful -Baggage -Bagged -Baggie -Bagginess -Bagging -Baggy -Bagpipe -Bags -Baguette -Bail -Bait -Bake -Baked -Baker -Bakery -Bakeshop -Baking -Balance -Balancing -Balcony -Bald -Bales -Ballad -Ballads -Ballast -Ballet -Ballets -Ballistic -Balloon -Balloons -Ballot -Ballots -Ballpark -Ballroom -Balmy -Balsamic -Bamboo -Banana -Bananas -Bandage -Banded -Bandit -Bandits -Bands -Bandwidth -Bang -Banish -Banished -Banister -Banjo -Bank -Bankable -Bankbook -Banked -Banker -Bankers -Banking -Banknote -Banknotes -Bankroll -Bankrupt -Banks -Banned -Banner -Banners -Banning -Bannister -Banquet -Bans -Banshee -Bantam -Banter -Barbarian -Barbarous -Barbecue -Barbed -Barbell -Barber -Barcode -Bard -Bare -Barefoot -Barely -Bargain -Barge -Barges -Bargraph -Barista -Baritone -Barium -Barker -Barley -Barmaid -Barman -Barn -Barney -Barns -Barometer -Baron -Baroness -Baronet -Baronets -Barons -Baroque -Barrack -Barracks -Barracuda -Barrage -Barred -Barrel -Barrels -Barren -Barrette -Barricade -Barrier -Barriers -Barring -Barrister -Barrow -Bars -Barstool -Bartender -Barter -Barterer -Basal -Basalt -Baseball -Based -Baseline -Baseman -Basement -Bash -Basic -Basically -Basics -Basil -Basilica -Basin -Basing -Basins -Basis -Basket -Baskets -Bass -Bassist -Bastion -Batboy -Batch -Bath -Bathe -Bathed -Bathing -Bathroom -Bathrooms -Baths -Baton -Bats -Batsmen -Battalion -Batted -Batter -Battered -Batteries -Battering -Batters -Battery -Batting -Battle -Battled -Battles -Battling -Bauble -Bay -Bayou -Bays -Bazaar -Bazooka -Beach -Beaches -Beacon -Bead -Beads -Beak -Beam -Beamed -Beams -Beans -Bear -Beard -Bearded -Bearer -Bearers -Bearings -Bears -Beast -Beasts -Beating -Beats -Beau -Beauties -Beautiful -Beauty -Beaver -Beavers -Became -Beck -Become -Becomes -Becoming -Bedrock -Bedroom -Bedrooms -Beds -Bedside -Bedtime -Bee -Beech -Beef -Beer -Beers -Bees -Beet -Beetle -Beetles -Befriends -Beg -Began -Beggar -Beggars -Begged -Begging -Begin -Beginner -Beginners -Beginning -Begins -Begs -Begun -Behalf -Behave -Behaved -Behaves -Behaving -Behavior -Beheld -Behest -Behind -Behold -Being -Beings -Belief -Beliefs -Believe -Believed -Believer -Believers -Believes -Believing -Bell -Belle -Bells -Belly -Belong -Belonged -Belonging -Belongs -Beloved -Below -Belt -Belts -Bench -Benches -Benchmark -Bend -Bender -Bending -Bends -Beneath -Benefit -Benefited -Benefits -Benign -Bent -Benzene -Berg -Berth -Berths -Beset -Beside -Besides -Besieged -Best -Bestow -Bestowed -Beta -Betray -Betrayal -Betrayed -Bets -Better -Betting -Beverage -Beverages -Beware -Beyond -Bias -Biases -Biathlon -Bicycle -Bicycles -Bidder -Bidding -Bids -Biennial -Big -Bigger -Biggest -Bike -Bikes -Biking -Bikini -Bilateral -Bilingual -Bill -Billboard -Billed -Billiards -Billing -Billings -Billion -Billions -Bills -Binary -Bind -Binder -Binding -Binds -Bingo -Binomial -Biologist -Biology -Biopsy -Biosphere -Biplane -Birch -Bird -Birds -Birthday -Births -Biscuits -Bishopric -Bishops -Bison -Bite -Bites -Bitten -Bitter -Bitterly -Bizarre -Blabber -Black -Blackened -Blackish -Blackness -Blackout -Bladder -Blade -Blades -Blah -Blame -Blamed -Blames -Blaming -Blanching -Bland -Blandness -Blank -Blanket -Blankets -Blanks -Blaspheme -Blasphemy -Blast -Blasted -Blasting -Blatancy -Blatant -Blatantly -Blaze -Blazer -Blazers -Blazing -Bleach -Bleak -Bleep -Blemish -Blend -Blended -Blending -Blends -Bless -Blessed -Blessing -Blessings -Blew -Blight -Blighted -Blimp -Blinding -Blindly -Blinds -Bling -Blink -Blinked -Blinker -Blinking -Blinks -Blip -Bliss -Blissful -Blitz -Blizzard -Bloated -Bloating -Blob -Bloc -Block -Blockade -Blocked -Blocking -Blocks -Blog -Blogger -Blogs -Blond -Blonde -Bloom -Bloomers -Blooming -Blooms -Blooper -Blossom -Blossoms -Blot -Blouse -Blow -Blowing -Blown -Blows -Blubber -Blue -Bluegrass -Blueprint -Blues -Bluff -Bluffs -Bluish -Blunderer -Blunt -Bluntly -Blur -Blurb -Blurred -Blurring -Blurry -Blurt -Blush -Blushed -Blustery -Boa -Boar -Boarded -Boarding -Boardwalk -Boast -Boasted -Boaster -Boastful -Boasting -Boasts -Boat -Boating -Bobbed -Bobbing -Bobble -Bobby -Bobcat -Bobcats -Bobsled -Bobtail -Bodacious -Bodily -Body -Bodyguard -Bog -Bogged -Boggle -Bogus -Bohemian -Boil -Boiled -Boiler -Boilers -Boiling -Bok -Bold -Boldly -Boldness -Bolster -Bolt -Bolted -Bolts -Bonanza -Bond -Bonded -Bonding -Bondless -Bonds -Boned -Bonehead -Boneless -Bonelike -Bones -Boney -Bonfire -Bonnet -Bonsai -Bonus -Bonuses -Bony -Boogeyman -Boogie -Boogieman -Book -Booked -Booking -Booklet -Bookstore -Boom -Booming -Boon -Boondocks -Boost -Boosted -Booster -Boot -Booted -Booth -Bootie -Booting -Bootlace -Bootleg -Boots -Boozy -Borax -Border -Bordered -Bordering -Borders -Bore -Boredom -Boring -Boron -Borough -Boroughs -Borrow -Borrowed -Borrower -Borrowers -Borrowing -Boss -Bosses -Botanical -Botanist -Botany -Botch -Both -Bother -Bothered -Bothering -Bottle -Bottled -Bottles -Bottling -Bottom -Bottoms -Bought -Boulder -Boulders -Boulevard -Bounce -Bounced -Bouncing -Bouncy -Boundary -Bounded -Bounding -Boundless -Bountiful -Bounty -Bouquet -Bourbon -Bout -Boutique -Bouts -Bovine -Bowed -Bower -Bowing -Bowl -Bowled -Bowler -Bowlers -Bowling -Bowls -Bowman -Boxcar -Boxed -Boxer -Boxers -Boxes -Boxing -Boxlike -Boxy -Boycott -Boycotted -Boyfriend -Boyhood -Bracket -Brackets -Braille -Brain -Brains -Brake -Brakes -Braking -Bran -Branch -Branched -Branches -Branching -Brand -Branded -Branding -Brands -Brandy -Brass -Brave -Bravely -Bravery -Braves -Bravo -Brawl -Bray -Breach -Breached -Breaches -Bread -Breadth -Breakdown -Breaker -Breakers -Breakfast -Breakup -Breath -Breathe -Breathed -Breathing -Breaths -Breeches -Breeching -Breed -Breeder -Breeders -Breeding -Breeds -Breeze -Breezy -Brethren -Brevity -Brew -Brewer -Breweries -Brewers -Brewery -Brewing -Briar -Bribe -Bribery -Bribes -Brick -Bricks -Bride -Bridged -Bridges -Bridging -Brief -Briefcase -Briefing -Briefly -Briefs -Brig -Brigade -Brigades -Bright -Brighter -Brightest -Brightly -Brilliant -Brim -Brine -Bring -Brings -Brink -Brisk -Brisket -Briskly -Briskness -Bristle -Brittle -Broadband -Broadcast -Broaden -Broadened -Broader -Broadest -Broadly -Broadness -Broadside -Broadways -Broccoli -Brochure -Brochures -Broiler -Broiling -Broke -Broken -Broker -Brokerage -Brokers -Bromide -Bronchial -Bronco -Broncos -Bronze -Bronzing -Brood -Brooding -Brook -Brooks -Broom -Broth -Brother -Brothers -Brought -Browbeat -Brown -Browning -Brownish -Browns -Browse -Browser -Browsers -Browsing -Bruins -Bruised -Bruises -Bruising -Brunch -Brunette -Brunt -Brush -Brushed -Brushes -Brushing -Brussels -Brute -Brutishly -Bubble -Bubbles -Bubbling -Bubbly -Buccaneer -Buck -Bucked -Bucket -Buckets -Buckeyes -Buckle -Buckling -Bucks -Buckshot -Buckskin -Bucktooth -Buckwheat -Bud -Buddhism -Buddhist -Buddies -Budding -Buddy -Budget -Budgetary -Budgeting -Budgets -Buds -Buff -Buffalo -Buffed -Buffer -Buffers -Buffet -Buffing -Buffoon -Buggy -Bugs -Builder -Builders -Builds -Buildup -Bulb -Bulbs -Bulge -Bulginess -Bulging -Bulgur -Bulk -Bulky -Bull -Bulldog -Bulldogs -Bulldozer -Bulletin -Bullfight -Bullfrog -Bullhorn -Bullion -Bullish -Bullock -Bullpen -Bullring -Bulls -Bullseye -Bullwhip -Bully -Bump -Bumped -Bumper -Bumps -Bun -Bunch -Bundle -Bundled -Bundles -Bungalow -Bungee -Bunion -Bunk -Bunkbed -Bunker -Bunkers -Bunkhouse -Bunkmate -Bunny -Bunt -Burden -Burdened -Burdens -Bureau -Bureaus -Burglary -Burned -Burner -Burning -Burns -Burnt -Burrow -Burrows -Bursting -Bus -Busboy -Bush -Bushes -Busiest -Busily -Business -Busload -Bust -Busy -Busybody -Butcher -Butler -Butter -Butterfly -Button -Buttons -Buy -Buyer -Buyers -Buying -Buyout -Buys -Buzz -Bypass -Bypassed -Bypassing -Byte -Bytes -Cab -Cabana -Cabaret -Cabbage -Cabbie -Cabdriver -Cabin -Cabinet -Cabinets -Cabins -Cable -Cables -Caboose -Cache -Cackle -Cacti -Cactus -Cad -Caddie -Caddy -Cadence -Cadet -Cadets -Cadillac -Cadmium -Cadre -Cadres -Cafeteria -Caffeine -Cage -Cages -Cahoots -Cake -Cakes -Calamari -Calamity -Calcium -Calculate -Calculus -Calendar -Calf -Caliber -Calibrate -Caller -Calm -Calmed -Calmly -Caloric -Calorie -Calories -Calves -Calzone -Camcorder -Camel -Camels -Cameo -Camera -Cameras -Camisole -Camp -Campaign -Campaigns -Camped -Camper -Campfire -Camping -Camps -Campsite -Campus -Campuses -Canal -Canals -Canary -Cancel -Canceled -Candid -Candidacy -Candidate -Candied -Candle -Candles -Candy -Cane -Canine -Canister -Canned -Canning -Cannon -Cannons -Cannot -Canoe -Canoeing -Canoes -Canola -Canon -Canonical -Canons -Canopener -Canopy -Cantata -Canteen -Canto -Canvas -Canyon -Cap -Capable -Capably -Capacitor -Capacity -Cape -Capillary -Capital -Capitals -Capitol -Capped -Capricorn -Caps -Capsize -Capsule -Capsules -Captain -Captaincy -Captained -Captains -Caption -Captivate -Captive -Captives -Captivity -Capture -Captures -Capturing -Caramel -Carat -Caravan -Carbon -Carbonate -Cardboard -Carded -Cardiac -Cardigan -Cardinal -Cardinals -Cardstock -Career -Careers -Careful -Carefully -Caregiver -Careless -Cares -Caress -Caretaker -Cargo -Caribou -Caring -Carless -Carload -Carmaker -Carnation -Carnival -Carnivore -Carol -Carousel -Carp -Carpenter -Carpentry -Carpet -Carpets -Carpool -Carport -Carriage -Carriages -Carried -Carrier -Carriers -Carries -Carrot -Carrots -Carrousel -Carry -Carrying -Cart -Cartel -Cartilage -Cartload -Carton -Cartoon -Cartoons -Cartridge -Carts -Cartwheel -Carve -Carved -Carver -Carving -Carvings -Carwash -Cascade -Cascades -Case -Cash -Casing -Casino -Casinos -Casket -Cassette -Caste -Castes -Castle -Castles -Casual -Casually -Casualty -Catacomb -Catalog -Catalogs -Catalyst -Catalysts -Catalytic -Catalyze -Catalyzed -Catalyzes -Catapult -Cataract -Catatonic -Catcall -Catch -Catchable -Catcher -Catches -Catching -Catchy -Category -Cater -Caterer -Catering -Catfight -Catfish -Cathedral -Catheters -Cathode -Catlike -Catnap -Catnip -Catsup -Cattail -Cattishly -Cattle -Catty -Catwalk -Caucus -Caught -Causal -Causality -Causation -Causative -Cause -Caused -Causes -Causeway -Causing -Caustic -Cauterize -Caution -Cautioned -Cautions -Cautious -Cavalier -Cavaliers -Cavalry -Caveat -Cavern -Caves -Caviar -Cavities -Cavity -Cease -Ceasefire -Ceases -Cedar -Ceiling -Ceilings -Celebrate -Celebrity -Celery -Celestial -Celibacy -Celibate -Cell -Cellar -Cellist -Cello -Cells -Cellular -Cellulose -Celtic -Cement -Cemented -Censor -Censored -Censure -Census -Censuses -Centenary -Center -Centered -Centering -Centers -Central -Centrally -Centuries -Century -Ceramic -Ceramics -Cereal -Cereals -Cerebral -Ceremony -Certainly -Certainty -Certified -Certify -Cesarean -Cessation -Cesspool -Chafe -Chaffing -Chain -Chained -Chains -Chair -Chaired -Chairman -Chairs -Chalice -Chalk -Challenge -Chamber -Chambers -Chamomile -Champ -Champagne -Champion -Champions -Chance -Chancery -Chances -Chandler -Change -Channel -Channels -Chant -Chanting -Chaos -Chaotic -Chap -Chapel -Chapels -Chaperone -Chaplain -Chapped -Chaps -Chapter -Chapters -Char -Character -Charbroil -Charcoal -Charge -Charged -Charger -Chargers -Charges -Charging -Chariot -Charisma -Charities -Charity -Charm -Charmed -Charming -Charms -Charred -Chart -Charted -Charter -Chartered -Charters -Charting -Charts -Chase -Chasing -Chassis -Chaste -Chastise -Chastity -Chat -Chatroom -Chatter -Chatting -Chatty -Cheap -Cheaper -Cheapest -Cheaply -Cheat -Cheated -Cheating -Check -Checked -Checking -Checklist -Checks -Cheddar -Cheek -Cheeks -Cheer -Cheered -Cheerful -Cheering -Cheers -Cheese -Cheesy -Chef -Chefs -Chemical -Chemicals -Chemist -Chemistry -Chemists -Cherish -Cherished -Cherisher -Cherry -Cherub -Chess -Chest -Chestnut -Chests -Chevron -Chevy -Chew -Chewable -Chewed -Chewer -Chewing -Chewy -Chick -Chicken -Chickens -Chicks -Chief -Chiefly -Chiefs -Chieftain -Chihuahua -Child -Childcare -Childhood -Childish -Childless -Childlike -Chile -Chili -Chill -Chilled -Chilling -Chilly -Chimney -Chimneys -Chimp -Chin -China -Chip -Chips -Chirping -Chirpy -Chitchat -Chivalry -Chive -Chloride -Chlorine -Chocolate -Choice -Choices -Choir -Choirs -Choke -Choked -Choking -Chomp -Choose -Chooser -Chooses -Choosing -Choosy -Chop -Chopped -Choral -Chorale -Chord -Chords -Chores -Chorus -Chose -Chosen -Chow -Chowder -Chowtime -Chromatic -Chrome -Chromium -Chronic -Chronicle -Chubby -Chuck -Chuckled -Chug -Chummy -Chump -Chunk -Chunks -Churches -Churn -Chute -Cider -Cigar -Cigarette -Cigars -Cilantro -Cinch -Cinema -Cinemas -Cinematic -Cinnamon -Cipher -Circa -Circadian -Circle -Circles -Circling -Circuit -Circuitry -Circuits -Circular -Circulate -Circus -Citable -Citadel -Citation -Citations -Cites -Cities -Citizen -Citizenry -Citizens -Citric -Citrus -City -Civic -Civil -Civilian -Civilians -Civilized -Clad -Claim -Claimant -Claimants -Clambake -Clammy -Clamor -Clamp -Clamped -Clamshell -Clan -Clang -Clanking -Clans -Clapped -Clapper -Clapping -Clarified -Clarify -Clarinet -Clarity -Clash -Clashed -Clashes -Clasp -Clasped -Class -Classed -Classes -Classic -Classical -Classics -Classify -Classmate -Classroom -Clatter -Clause -Clauses -Clavicle -Claw -Claws -Clay -Clean -Cleaned -Cleaner -Cleaners -Cleaning -Cleansing -Cleanup -Clear -Clearance -Cleared -Clearer -Clearest -Clearing -Clearly -Cleat -Cleaver -Cleft -Clement -Clench -Clenched -Clergy -Clergyman -Clergymen -Cleric -Clerical -Clerics -Clerk -Clerks -Clever -Click -Clicked -Clicker -Clicking -Clicks -Client -Clients -Cliff -Cliffs -Climate -Climates -Climatic -Climb -Climbed -Climber -Climbers -Climbing -Climbs -Clinch -Clinched -Cling -Clinging -Clinic -Clinical -Clinician -Clinics -Clinking -Clip -Clipboard -Clipped -Clipper -Clippers -Clipping -Clips -Clique -Cloak -Clobber -Clock -Clocks -Clockwise -Cloister -Clone -Cloned -Cloning -Closable -Closely -Closeness -Closer -Closes -Closest -Closet -Closure -Clot -Cloth -Clothed -Clothes -Clothing -Cloths -Clotting -Cloud -Clouded -Clouds -Cloudy -Clover -Cloves -Clown -Clubbed -Clubbing -Clubhouse -Clue -Clues -Clump -Clumps -Clumsily -Clumsy -Clung -Clunky -Cluster -Clustered -Clusters -Clutch -Clutched -Clutching -Clutter -Coach -Coached -Coaches -Coaching -Coagulant -Coalition -Coals -Coarse -Coast -Coastal -Coaster -Coasting -Coastland -Coastline -Coasts -Coat -Coated -Coating -Coatings -Coats -Coauthor -Cobalt -Cobbler -Cobra -Cobweb -Cockpit -Cocoa -Coconut -Cod -Codex -Codified -Coeditor -Coerce -Coercion -Coercive -Coexist -Coffee -Cofounder -Cognition -Cognitive -Cogwheel -Coherence -Coherent -Cohesion -Cohesive -Cohort -Cohorts -Coil -Coiled -Coils -Coin -Coinage -Coincide -Coincided -Coincides -Coined -Coins -Coke -Cola -Cold -Colder -Coldest -Coldly -Coleslaw -Coliseum -Collage -Collapse -Collapsed -Collapses -Collar -Colleague -Collected -Collector -Collects -College -Colleges -Collide -Collided -Collie -Collier -Colliery -Collision -Collusion -Cologne -Colon -Colonel -Colonels -Colonial -Colonies -Colonist -Colonists -Colonize -Colonized -Colony -Colorful -Coloring -Colors -Colossal -Colt -Colts -Column -Columnist -Columns -Coma -Combat -Combating -Combine -Combined -Combines -Combining -Combo -Combs -Come -Comeback -Comedian -Comedians -Comedic -Comedies -Comedy -Comet -Comets -Comfort -Comforted -Comforts -Comfy -Comic -Comics -Coming -Comma -Command -Commanded -Commander -Commando -Commandos -Commands -Commas -Commence -Commenced -Commend -Comment -Commented -Comments -Commerce -Commit -Commits -Committed -Commode -Commodity -Commodore -Common -Commonest -Commonly -Commons -Commotion -Communal -Commune -Communes -Community -Commute -Commuted -Commuter -Commuters -Commuting -Compact -Compacted -Compacter -Compactly -Compactor -Companion -Company -Compare -Compared -Compares -Comparing -Compel -Compelled -Compete -Competed -Competes -Competing -Compile -Compiled -Compiler -Compiling -Complain -Complains -Complaint -Completed -Completes -Complex -Complexes -Compliant -Complied -Comply -Complying -Component -Compose -Composed -Composer -Composers -Composing -Composite -Compost -Composure -Compound -Compounds -Compress -Comprise -Comprised -Comprises -Compute -Computed -Computer -Computers -Computing -Comrade -Comrades -Concave -Conceal -Concealed -Concede -Conceded -Conceding -Conceive -Conceived -Concept -Concepts -Concern -Concerned -Concerns -Concert -Concerted -Concerto -Concertos -Concerts -Conch -Concierge -Concise -Conclave -Conclude -Concluded -Concludes -Concord -Concourse -Concrete -Concur -Condemn -Condemned -Condense -Condensed -Condenser -Condiment -Condition -Condone -Condor -Conducive -Conduct -Conducted -Conductor -Conducts -Conduit -Cone -Cones -Confer -Conferred -Confers -Confess -Confessed -Confesses -Confetti -Confidant -Confided -Confident -Confider -Confiding -Configure -Confine -Confined -Confines -Confining -Confirm -Confirmed -Confirms -Conflict -Conflicts -Conform -Conforms -Confound -Confront -Confronts -Confuse -Confused -Confusing -Confusion -Congenial -Congested -Congrats -Congress -Congruent -Conical -Conjoined -Conjugate -Conjure -Conjuror -Connect -Connected -Connector -Connects -Conquer -Conquered -Conqueror -Conquest -Conquests -Consensus -Consent -Consented -Conserve -Conserved -Considers -Consist -Consisted -Consists -Console -Consoles -Consoling -Consonant -Consort -Constable -Constancy -Constant -Constants -Constrain -Constrict -Construct -Construed -Consul -Consular -Consulate -Consult -Consulted -Consume -Consumed -Consumer -Consumers -Consumes -Consuming -Contact -Contacted -Contacts -Contain -Contained -Container -Contains -Contempt -Contend -Contended -Contender -Contends -Content -Contented -Contently -Contents -Contest -Contested -Contests -Context -Contexts -Continual -Continue -Continued -Continues -Continuum -Contort -Contour -Contours -Contract -Contracts -Contrary -Contrast -Contrasts -Contrite -Contrived -Control -Controls -Contusion -Convene -Convened -Convent -Converge -Converse -Convert -Converted -Converter -Converts -Convex -Convey -Conveyed -Conveying -Conveyor -Conveys -Convict -Convicted -Convicts -Convince -Convinced -Convinces -Convoy -Convoys -Cook -Cookbook -Cooked -Cookie -Cookies -Cooking -Cooks -Cool -Cooled -Cooler -Cooling -Cooper -Cooperate -Cop -Copartner -Cope -Copied -Copier -Copies -Copilot -Coping -Copious -Copper -Cops -Copy -Copyright -Coral -Corals -Cordial -Cork -Cornball -Cornbread -Corncob -Cornea -Corneal -Corned -Corner -Corners -Cornfield -Cornflake -Cornhusk -Cornice -Cornmeal -Cornstalk -Corny -Corolla -Corollary -Corona -Coronary -Coroner -Corporal -Corporate -Corporeal -Corps -Corpus -Corral -Correct -Corrected -Correlate -Corridor -Corridors -Corrode -Corroding -Corrosion -Corrosive -Corrupt -Corrupted -Corsage -Corset -Cortex -Cosigner -Cosmetic -Cosmetics -Cosmic -Cosmology -Cosmos -Cosponsor -Cost -Costing -Costly -Costs -Costume -Costumes -Cottage -Cottages -Cotton -Couch -Cougars -Cough -Coughing -Could -Council -Councilor -Councils -Counsel -Counselor -Countable -Countdown -Countess -Counties -Counting -Countless -Countries -Country -County -Coup -Coupe -Couple -Coupled -Couples -Coupling -Coupon -Coupons -Courier -Courses -Court -Courteous -Courtesy -Courtiers -Courtly -Courtroom -Courts -Courtship -Courtyard -Cousin -Cousins -Cove -Covenant -Covenants -Cover -Coverage -Covert -Coveted -Coveting -Cow -Coward -Cowardice -Cowardly -Cowboy -Cowboys -Coworkers -Cows -Coyness -Coyote -Coyotes -Cozily -Coziness -Cozy -Crab -Crabbing -Crabgrass -Crablike -Crabmeat -Crack -Crackdown -Cracked -Crackers -Cracking -Cracks -Cradle -Cradling -Crafted -Crafter -Craftily -Crafts -Craftsman -Craftsmen -Craftwork -Crafty -Crammed -Cramp -Cramped -Cramps -Cranberry -Crane -Cranes -Cranial -Cranium -Crank -Crash -Crashed -Crashes -Crashing -Crate -Crater -Craters -Crave -Craven -Craving -Crawfish -Crawl -Crawled -Crawlers -Crawling -Crayfish -Crayon -Crazed -Crazily -Craziness -Crazy -Creamed -Creamer -Creamlike -Creamy -Crease -Creasing -Creatable -Create -Creates -Creating -Creation -Creations -Creative -Creator -Creators -Creature -Creatures -Credence -Credible -Credibly -Credit -Creditor -Creditors -Credits -Creed -Creek -Creeks -Creep -Creeping -Creme -Creole -Crepe -Crept -Crescent -Crest -Crested -Cresting -Crestless -Crevice -Crewed -Crewless -Crewman -Crewmate -Crib -Cricket -Cricketer -Cried -Crier -Cries -Crime -Crimes -Criminal -Criminals -Crimp -Crimson -Cringe -Cringing -Crinkle -Crinkly -Crises -Crisis -Crisp -Crisped -Crisping -Crisply -Crispness -Crispy -Criteria -Criterion -Critic -Critical -Criticism -Criticize -Critics -Critique -Critiques -Critter -Croak -Crock -Crocodile -Crook -Crooked -Croon -Crop -Cropped -Cropping -Cross -Crossed -Crosses -Crossing -Crossings -Crossover -Crouch -Crouched -Crouton -Crow -Crowbar -Crowd -Crowded -Crowds -Crown -Crowned -Crowns -Crows -Crucial -Crucially -Crucible -Crude -Crudely -Crudeness -Cruel -Cruelly -Cruelness -Cruelty -Cruise -Cruiser -Cruisers -Cruises -Cruising -Crumb -Crumbling -Crumbs -Crummiest -Crummy -Crumpet -Crumpled -Cruncher -Crunching -Crunchy -Crusade -Crusader -Crusaders -Crusades -Crush -Crushable -Crushed -Crusher -Crushing -Crust -Crux -Crying -Cryptic -Crystal -Crystals -Cub -Cubbyhole -Cube -Cubes -Cubic -Cubical -Cubicle -Cubs -Cucumber -Cuddle -Cuddly -Cuff -Cufflink -Cuisine -Culinary -Culminate -Culpable -Culprit -Cultivate -Cultural -Culture -Cultured -Cultures -Cunning -Cup -Cupbearer -Cupboard -Cupcake -Cupid -Cupola -Cupped -Cupping -Cups -Curable -Curative -Curator -Curb -Curdle -Cure -Cures -Curfew -Curing -Curiosity -Curious -Curiously -Curl -Curled -Curler -Curliness -Curling -Curls -Curly -Currents -Curricula -Curry -Curse -Cursed -Curses -Cursing -Cursive -Cursor -Curt -Curtailed -Curtain -Curtains -Curtly -Curtsy -Curvature -Curve -Curved -Curves -Curving -Curvy -Cushion -Cushions -Cushy -Cusp -Cussed -Custard -Custodial -Custodian -Custody -Custom -Customary -Customer -Customers -Customize -Customs -Cut -Cutoff -Cuts -Cutter -Cutting -Cuttings -Cycle -Cyclic -Cyclical -Cycling -Cyclist -Cyclists -Cyclone -Cyclones -Cylinder -Cylinders -Cymbal -Cynical -Cynicism -Cypress -Cytoplasm -Cytoplast -Dab -Dad -Daddy -Daffodil -Dagger -Daily -Daintily -Dainty -Dairy -Daisy -Dale -Dallying -Damage -Damaged -Damages -Damaging -Damp -Dams -Dance -Danced -Dancer -Dancers -Dances -Dancing -Dandelion -Dander -Dandruff -Dandy -Danger -Dangerous -Dangers -Dangle -Dangling -Dare -Dared -Daredevil -Dares -Daring -Daringly -Dark -Darkened -Darkening -Darker -Darkest -Darkish -Darkness -Darkroom -Darling -Darn -Dart -Darted -Darts -Darwinism -Dash -Dashed -Dashing -Dastardly -Data -Database -Databases -Datebook -Dating -Datum -Daughter -Daughters -Daunting -Davenport -Dawdler -Dawn -Dawned -Daybed -Daybreak -Daycare -Daydream -Daylight -Daylong -Dayroom -Daytime -Dazed -Dazzler -Dazzling -Deacon -Deadline -Deadlines -Deadlock -Deafening -Deafness -Dealer -Dealers -Dealing -Dealings -Dealmaker -Dealt -Dean -Dear -Dearest -Dearly -Debatable -Debate -Debated -Debates -Debating -Debit -Debrief -Debris -Debt -Debtless -Debtor -Debtors -Debts -Debug -Debugging -Debunk -Debut -Debuts -Decade -Decades -Decaf -Decal -Decathlon -Decay -Decaying -Deceased -Deceit -Deceive -Deceived -Deceiver -Deceiving -December -Decency -Decent -Deception -Deceptive -Decibel -Decidable -Decide -Decided -Decidedly -Decides -Deciding -Deciduous -Decimal -Decimeter -Decipher -Decision -Decisions -Decisive -Deck -Decks -Declare -Declared -Declares -Declaring -Decline -Declined -Declines -Declining -Decode -Decoding -Decompose -Decor -Decorate -Decorated -Decorator -Decoy -Decrease -Decreased -Decreases -Decree -Decreed -Decrees -Dedicate -Dedicated -Dedicator -Deduce -Deduced -Deduct -Deducted -Deduction -Deductive -Deed -Deeds -Deem -Deep -Deepen -Deepened -Deepening -Deeper -Deepest -Deeply -Deepness -Deface -Defacing -Defame -Default -Defaults -Defeat -Defeating -Defeats -Defect -Defected -Defection -Defective -Defects -Defend -Defendant -Defended -Defender -Defenders -Defending -Defends -Defense -Defenses -Defensive -Defer -Deference -Deferral -Deferred -Defiance -Defiant -Deficient -Deficit -Deficits -Defied -Defile -Defiling -Define -Defines -Defining -Definite -Deflate -Deflation -Deflator -Deflected -Deflector -Defog -Deforest -Defraud -Defrost -Deftly -Defunct -Defuse -Defy -Degrade -Degraded -Degrading -Degrease -Degree -Degrees -Dehydrate -Deities -Deity -Dejected -Delay -Delayed -Delaying -Delays -Delegate -Delegated -Delegates -Delegator -Delete -Deleted -Deleting -Deletion -Delicacy -Delicate -Delicious -Delight -Delighted -Delights -Delineate -Delirious -Delirium -Deliver -Delivered -Deliverer -Delivers -Delivery -Delouse -Delta -Deluge -Delusion -Delusions -Deluxe -Demand -Demanded -Demanding -Demands -Demeaning -Demeanor -Demise -Demo -Democracy -Democrat -Demolish -Demon -Demonic -Demons -Demos -Demote -Demoted -Demotion -Demystify -Denatured -Deniable -Denial -Denied -Denies -Denim -Denote -Denoted -Denotes -Denoting -Denounce -Denounced -Dense -Densely -Densities -Density -Dental -Dentist -Dentistry -Dentists -Denture -Deny -Denying -Deodorant -Deodorize -Depart -Departed -Departing -Departs -Departure -Depend -Depended -Depending -Depends -Depict -Depicted -Depicting -Depiction -Depicts -Deplete -Depleted -Depletion -Deplored -Deploy -Deployed -Deploying -Deport -Deported -Depose -Deposed -Deposit -Deposited -Deposits -Depot -Depots -Depraved -Depravity -Deprecate -Depress -Depressed -Deprive -Deprived -Depriving -Depth -Depths -Deputies -Deputize -Deputy -Derail -Derby -Derelict -Derive -Derived -Derives -Deriving -Derrick -Descend -Descended -Descends -Descent -Describe -Described -Describes -Desecrate -Desert -Deserted -Desertion -Deserts -Deserve -Deserved -Deserves -Deserving -Designate -Designed -Designer -Designers -Designing -Designs -Desire -Desired -Desires -Desiring -Desirous -Desk -Deskbound -Desks -Desktop -Deskwork -Desolate -Despair -Despatch -Desperate -Despise -Despised -Despite -Despotism -Dessert -Destined -Destiny -Destitute -Destroy -Destroyed -Destroyer -Destroys -Destruct -Detached -Detail -Detailed -Detailing -Details -Detained -Detainees -Detect -Detected -Detecting -Detection -Detective -Detector -Detectors -Detects -Detention -Deter -Detergent -Determine -Deterrent -Detest -Detonate -Detonator -Detoxify -Detract -Detriment -Deuce -Devalue -Develop -Developer -Develops -Deviance -Deviancy -Deviant -Deviate -Deviation -Deviator -Device -Devices -Devil -Devils -Devious -Devise -Devised -Devising -Devoid -Devote -Devoted -Devotedly -Devotee -Devotees -Devotion -Devoured -Devourer -Devouring -Devout -Devoutly -Dew -Dexterity -Dexterous -Dharma -Diabolic -Diagnose -Diagnosed -Diagnoses -Diagnosis -Diagonal -Diagram -Diagrams -Dial -Dialect -Dialectic -Dialects -Dialog -Diameter -Diameters -Diamond -Diamonds -Diaper -Diaphragm -Diaries -Diary -Dice -Dichotomy -Dicing -Dictate -Dictated -Dictates -Dictation -Dictator -Dictum -Didactic -Diesel -Diet -Dietary -Diets -Differ -Differed -Differing -Differs -Difficult -Diffuse -Diffused -Diffuser -Diffusion -Diffusive -Dig -Digest -Digested -Digestion -Digestive -Digging -Digit -Digital -Digitally -Digits -Dignified -Dignity -Dilated -Dilation -Dilemma -Dilemmas -Diligence -Diligent -Dill -Dilute -Diluted -Dilution -Dim -Dime -Dimension -Diminish -Dimly -Dimmed -Dimmer -Dimness -Dimple -Din -Dined -Diner -Dingbat -Dinghy -Dinginess -Dingo -Dingy -Dining -Dinner -Dinners -Dinosaur -Dinosaurs -Diocese -Diode -Diodes -Dioxide -Dip -Diploma -Diplomacy -Diplomat -Diplomats -Dipole -Dipped -Dipper -Dipping -Dire -Directed -Directing -Direction -Directive -Directly -Director -Directors -Directory -Directs -Direness -Dirk -Dirt -Dirtiness -Dirty -Disable -Disabled -Disabling -Disagree -Disagreed -Disallow -Disappear -Disarm -Disarray -Disaster -Disasters -Disband -Disbanded -Disbelief -Disburse -Discard -Discarded -Discern -Discerned -Discharge -Disciple -Disciples -Disclose -Disco -Discolor -Discord -Discount -Discounts -Discourse -Discover -Discovers -Discovery -Discredit -Discreet -Discrete -Discuss -Discussed -Discusses -Disdain -Disengage -Disfigure -Disgrace -Disguise -Disguised -Disgust -Disgusted -Dish -Dishes -Dishonest -Disinfect -Disjoin -Disk -Disks -Dislike -Disliked -Disliking -Dislocate -Dislodge -Disloyal -Dismal -Dismantle -Dismay -Dismiss -Dismissal -Dismissed -Dismount -Disobey -Disorder -Disorders -Disown -Disparate -Disparity -Dispatch -Dispel -Dispense -Dispensed -Dispersal -Disperse -Dispersed -Disperser -Displace -Displaced -Display -Displayed -Displays -Displease -Disposal -Dispose -Disposed -Disprove -Dispute -Disputes -Disregard -Disrepair -Disrupt -Disrupted -Diss -Dissent -Dissident -Dissolve -Dissolved -Dissolves -Dissuade -Distance -Distanced -Distances -Distant -Distaste -Distill -Distilled -Distinct -Distort -Distorted -Distract -Distress -District -Districts -Distrust -Disturb -Disused -Ditch -Ditches -Ditto -Ditzy -Diuretics -Diurnal -Diva -Dive -Diver -Diverged -Divergent -Divers -Diverse -Diversion -Diversity -Divert -Diverted -Dives -Dividable -Divide -Divided -Dividend -Dividends -Dividers -Divides -Dividing -Divine -Divinely -Diving -Divinity -Divisible -Divisibly -Division -Divisive -Divorce -Divorced -Divorcee -Dizziness -Dizzy -Doable -Docile -Dock -Docked -Docking -Docks -Dockyard -Doctor -Doctorate -Doctors -Doctrinal -Doctrine -Doctrines -Document -Documents -Dodge -Dodgers -Dodgy -Doe -Dogma -Dogmatic -Doily -Doing -Dole -Doll -Dollar -Dollars -Dollhouse -Dollop -Dolls -Dolly -Dolphin -Dolphins -Domain -Domains -Dome -Domed -Domelike -Domes -Domestic -Dominance -Dominant -Dominate -Dominated -Dominates -Dominion -Dominions -Domino -Dominoes -Donate -Donated -Donating -Donation -Donations -Donator -Donkey -Donor -Donors -Donut -Doodle -Doom -Doomed -Doorbell -Doorframe -Doorknob -Doorman -Doormat -Doornail -Doorpost -Doorstep -Doorstop -Doorway -Doozy -Dork -Dormant -Dormitory -Dorsal -Dosage -Dose -Doses -Dosing -Dot -Doth -Dots -Dotted -Double -Doubled -Doubles -Doubling -Doubly -Doubt -Doubted -Doubtful -Doubting -Doubtless -Doubts -Dough -Dove -Dowager -Down -Downed -Downfall -Downhill -Downing -Download -Downloads -Downright -Downtown -Downturn -Downward -Downwards -Dowry -Doze -Dozen -Dozens -Drab -Draft -Drafted -Drafting -Drafts -Drag -Dragged -Dragging -Dragon -Dragonfly -Dragonish -Dragons -Dragoons -Dragster -Drain -Drainable -Drainage -Drained -Drainer -Draining -Drainpipe -Drains -Drama -Dramas -Dramatic -Dramatist -Dramatize -Drank -Draped -Drapery -Drastic -Draw -Drawback -Drawbacks -Drawer -Drawers -Drawings -Draws -Dread -Dreaded -Dreadful -Dreadlock -Dream -Dreamboat -Dreamed -Dreamer -Dreamily -Dreaming -Dreamland -Dreamless -Dreamlike -Dreams -Dreamt -Dreamy -Drearily -Dreary -Drench -Dress -Dresser -Drew -Dribble -Dried -Drier -Drift -Drifted -Drifting -Drill -Drilled -Driller -Drilling -Drills -Drink -Drinkable -Drinkers -Drinking -Drinks -Drip -Dripping -Drippy -Drivable -Drive -Driven -Driver -Drivers -Drives -Driveway -Driving -Drizzle -Drizzly -Drone -Drones -Drool -Droop -Drop-down -Dropbox -Dropkick -Droplet -Droplets -Dropout -Dropped -Dropper -Dropping -Drops -Drought -Drove -Drown -Drowsily -Drudge -Drum -Drummer -Drummers -Drumming -Drums -Dry -Dryer -Drying -Dual -Dualism -Duality -Dub -Dubbed -Dubbing -Dubious -Dubiously -Duchess -Duck -Duckbill -Ducked -Ducking -Duckling -Ducks -Ducktail -Ducky -Duct -Dude -Duel -Dues -Duet -Duets -Duff -Duffel -Dug -Dugout -Duh -Duke -Dukes -Dull -Duller -Dullness -Duly -Dummies -Dump -Dumped -Dumping -Dumpling -Dumpster -Dun -Dune -Dunes -Dung -Dungeon -Dungeons -Duo -Dupe -Duplex -Duplicate -Duplicity -Durable -Durably -Duration -Duress -During -Dusk -Dust -Dusty -Duties -Dutiful -Duty -Duvet -Dwarf -Dweeb -Dwell -Dwelled -Dweller -Dwellers -Dwelling -Dwellings -Dwells -Dwindle -Dwindling -Dye -Dyed -Dyer -Dyes -Dynamic -Dynamical -Dynamics -Dynamism -Dynamite -Dynamo -Dynastic -Dynasties -Dynasty -Each -Eagerly -Eagerness -Eagle -Eagles -Earache -Eardrum -Earflap -Earful -Earlier -Earliest -Earlobe -Early -Earmark -Earmuff -Earnest -Earnestly -Earnings -Earphone -Earpiece -Earplugs -Earring -Earrings -Earshot -Earthen -Earthlike -Earthling -Earthly -Earthworm -Earthy -Earwig -Easeful -Easel -Easier -Easiest -Easily -Easiness -Easing -Eastbound -Eastcoast -Easter -Eastward -Eastwards -Eatable -Eaten -Eatery -Eating -Eats -Ebay -Ebb -Ebony -Ebook -Ecard -Eccentric -Echelon -Echo -Echoed -Echoes -Echoing -Eclair -Eclectic -Eclipse -Ecologist -Ecology -Economic -Economics -Economies -Economist -Economy -Ecosphere -Ecosystem -Ecstatic -Eddy -Edge -Edged -Edginess -Edging -Edgy -Edible -Edict -Edifice -Edit -Edited -Editing -Edition -Editions -Editor -Editorial -Editors -Educate -Educated -Educating -Education -Educator -Educators -Eel -Eerie -Effect -Effected -Effecting -Effective -Effects -Efficacy -Efficient -Effort -Efforts -Effusion -Egg -Eggbeater -Egging -Eggnog -Eggplant -Eggs -Eggshell -Ego -Egomaniac -Egotism -Egotistic -Eighteen -Eighth -Eighties -Eighty -Either -Eject -Elaborate -Elapsed -Elastic -Elated -Elbow -Elbows -Elder -Eldercare -Elderly -Elders -Eldest -Electable -Election -Elective -Electoral -Electors -Electric -Electrode -Electron -Electrons -Elegance -Elegant -Element -Elemental -Elements -Elephant -Elephants -Elevate -Elevated -Elevating -Elevation -Elevator -Elevators -Eleven -Eleventh -Elf -Elicit -Elicited -Eliciting -Eligible -Eligibly -Eliminate -Elite -Elites -Elitism -Elitist -Elixir -Elk -Ellipse -Elliptic -Elm -Elongated -Elope -Eloquence -Eloquent -Else -Elsewhere -Elucidate -Elude -Elusive -Elves -Email -Emails -Emanating -Embargo -Embark -Embarked -Embarking -Embassies -Embassy -Embattled -Embedded -Embedding -Embellish -Ember -Embezzle -Emblaze -Emblem -Embodied -Embodies -Embody -Embodying -Embolism -Emboss -Embrace -Embraced -Embraces -Embracing -Embroider -Embroiled -Embryo -Embryonic -Embryos -Emcee -Emerald -Emerge -Emerged -Emergence -Emergency -Emergent -Emerges -Emerging -Emeritus -Emery -Emigrants -Emigrate -Emigrated -Eminence -Eminent -Eminently -Emir -Emirates -Emission -Emissions -Emit -Emitted -Emitting -Emote -Emoticon -Emotion -Emotional -Emotions -Empathic -Empathy -Emperor -Emperors -Emphases -Emphasis -Emphasize -Emphatic -Empire -Empires -Empirical -Employ -Employed -Employee -Employees -Employer -Employers -Employing -Employs -Emporium -Empower -Empowered -Empress -Emptied -Emptier -Empties -Emptiness -Empty -Emptying -Emu -Emulate -Emulation -Emulsion -Enable -Enabled -Enables -Enabling -Enact -Enacted -Enacting -Enactment -Enamel -Enchanted -Enchilada -Encircle -Encircled -Enclave -Enclose -Enclosed -Enclosing -Enclosure -Encode -Encoded -Encodes -Encoding -Encompass -Encore -Encounter -Encourage -Encroach -Encrust -Encrypt -Encrypted -Endanger -Endeared -Endearing -Endeavor -Endeavors -Ended -Endemic -Ending -Endings -Endless -Endlessly -Endnote -Endocrine -Endorphin -Endorse -Endorsed -Endowment -Endpoint -Endurable -Endurance -Endure -Endured -Enduring -Enemies -Enemy -Energetic -Energies -Energize -Energy -Enforce -Enforced -Enforcer -Enforcing -Engage -Engaged -Engages -Engaging -Engine -Engineer -Engineers -Engines -Engraved -Engraver -Engraving -Engross -Engulf -Engulfed -Enhance -Enhanced -Enhances -Enhancing -Enigma -Enigmatic -Enjoined -Enjoy -Enjoyable -Enjoyably -Enjoyed -Enjoyer -Enjoying -Enjoyment -Enjoys -Enlarge -Enlarged -Enlarging -Enlighten -Enlist -Enlisted -Enmity -Enormous -Enough -Enquirer -Enquiries -Enquiry -Enrage -Enraged -Enrich -Enriched -Enroll -Enrolled -Enrolling -Ensemble -Ensembles -Enshrined -Ensign -Ensnare -Ensued -Ensues -Ensuing -Ensure -Ensured -Ensures -Ensuring -Entail -Entailed -Entails -Entangled -Entering -Entertain -Enticing -Entire -Entirely -Entirety -Entitle -Entitled -Entity -Entomb -Entourage -Entrance -Entrances -Entrants -Entrap -Entree -Entrench -Entries -Entropy -Entrust -Entrusted -Entryway -Entwine -Enunciate -Envelope -Enveloped -Envelopes -Enviable -Enviably -Envious -Envisaged -Envision -Envoy -Envoys -Envy -Enzyme -Enzymes -Ephemeral -Epic -Epidemic -Epidemics -Epidermal -Epidermis -Epidural -Epilogue -Epiphany -Episode -Episodes -Episodic -Epistle -Epistles -Epithet -Epoch -Epoxy -Epsilon -Equal -Equally -Equals -Equate -Equated -Equation -Equations -Equator -Equinox -Equip -Equipment -Equipped -Equitable -Equity -Equivocal -Eradicate -Erasable -Erase -Erased -Eraser -Erasure -Ergonomic -Eroded -Erosion -Err -Errand -Errant -Erratic -Erroneous -Error -Errors -Erstwhile -Erupt -Erupted -Eruption -Eruptions -Escalate -Escalated -Escalator -Escapable -Escapade -Escape -Escaped -Escapes -Escaping -Escapist -Escargot -Esophagus -Esoteric -Espionage -Espoused -Espresso -Esquire -Essay -Essayist -Essays -Essence -Essential -Establish -Estate -Estates -Esteem -Esteemed -Estimate -Estimates -Estimator -Estranged -Estrogen -Estuary -Etching -Eternal -Eternally -Eternity -Ethanol -Ether -Ethic -Ethically -Ethics -Ethos -Etiquette -Etymology -Euphemism -Euphoria -Eureka -Euro -Euros -Evacuate -Evacuated -Evacuee -Evade -Evaluate -Evaluated -Evaluates -Evaluator -Evaporate -Evasion -Evasive -Even -Evening -Evenings -Evenly -Event -Events -Eventual -Everglade -Evergreen -Every -Everybody -Everyday -Everyone -Evict -Evicted -Eviction -Evidence -Evidenced -Evidences -Evident -Evidently -Evil -Evoke -Evokes -Evolution -Evolve -Evolved -Exact -Exacting -Exactly -Exalted -Exam -Examine -Examined -Examiner -Examiners -Examines -Examining -Example -Examples -Exams -Excavate -Excavated -Excavator -Exceed -Exceeded -Exceeding -Exceeds -Excel -Excelled -Excellent -Except -Excepting -Exception -Excerpt -Excerpts -Excess -Excesses -Excessive -Exchange -Exchanged -Exchanges -Exchequer -Excise -Excised -Excision -Excitable -Excite -Excited -Excitedly -Exciting -Exclaim -Exclaimed -Exclude -Excluded -Excludes -Excluding -Exclusion -Exclusive -Excretion -Excretory -Excursion -Excusable -Excusably -Excuse -Excused -Excuses -Executive -Executor -Exegesis -Exemplary -Exemplify -Exempt -Exempted -Exemption -Exercise -Exercised -Exerciser -Exercises -Exert -Exerted -Exertion -Exerts -Exes -Exfoliate -Exhale -Exhaust -Exhausted -Exhibit -Exhibited -Exhibits -Exhume -Exile -Exiled -Exiles -Existed -Existent -Existing -Exists -Exit -Exited -Exiting -Exits -Exodus -Exonerate -Exorcism -Exorcist -Exotic -Expand -Expanded -Expanding -Expands -Expanse -Expansion -Expansive -Expect -Expectant -Expecting -Expects -Expedient -Expedited -Expediter -Expel -Expelled -Expend -Expended -Expense -Expenses -Expensive -Expert -Expertise -Experts -Expire -Expired -Expiring -Explain -Explains -Expletive -Explicit -Explode -Exploded -Exploding -Exploit -Exploited -Exploits -Explore -Explored -Explorer -Explorers -Explores -Exploring -Explosion -Explosive -Expo -Exponent -Exponents -Export -Exported -Exporter -Exporters -Exporting -Exports -Expos -Exposable -Expose -Exposed -Exposes -Exposing -Exposure -Exposures -Expounded -Express -Expressed -Expresses -Expressly -Expulsion -Exquisite -Extant -Extend -Extended -Extending -Extends -Extension -Extensive -Extent -Extenuate -Exterior -External -Extinct -Extortion -Extra -Extract -Extracted -Extracts -Extradite -Extras -Extreme -Extremely -Extremes -Extremity -Extrinsic -Extrovert -Extrude -Extruding -Extrusion -Exuberant -Eye -Eyebrow -Eyebrows -Eyelid -Eyelids -Fable -Fables -Fabric -Fabrics -Fabulous -Facade -Facades -Facebook -Facecloth -Faced -Facedown -Faceless -Facelift -Faceplate -Facet -Faceted -Facets -Facial -Facility -Facing -Facsimile -Fact -Faction -Factions -Factoid -Factor -Factories -Factors -Facts -Factsheet -Factual -Faculties -Faculty -Fade -Faded -Fades -Fading -Fail -Failed -Failing -Fails -Failure -Failures -Faint -Faintly -Fairies -Fairness -Fairy -Faith -Faithful -Faiths -Fake -Falcon -Falcons -Fall -Fallacy -Fallen -Falling -Fallout -Fallow -False -Falsehood -Falsely -Falsify -Fame -Famed -Familial -Familiar -Families -Family -Famine -Famished -Famously -Fan -Fanatic -Fancied -Fanciful -Fanciness -Fancy -Fanfare -Fang -Fanning -Fans -Fantasies -Fantasize -Fantastic -Fantasy -Farce -Fared -Fares -Farewell -Farm -Farmed -Farmer -Farmers -Farmhouse -Farming -Farmland -Farms -Farther -Farthest -Fashion -Fashioned -Fashions -Fastball -Fastened -Faster -Fastest -Fasting -Fastness -Fated -Fateful -Fathered -Fatigue -Fats -Faucet -Faulty -Fauna -Favor -Favorable -Favorably -Favored -Favoring -Favorite -Favorites -Favors -Fax -Fear -Feared -Fearful -Fearing -Fearless -Fears -Feasible -Feast -Feasts -Feather -Feathers -Feature -Featured -Features -Featuring -Fed -Federal -Federally -Federated -Fedora -Fee -Feeble -Feed -Feedback -Feeder -Feeding -Feeds -Feel -Feeling -Feelings -Feels -Fees -Feet -Feisty -Felicity -Feline -Fell -Fellow -Fellows -Felony -Felt -Felt-tip -Female -Females -Feminine -Feminism -Feminist -Feminize -Femoral -Femur -Fence -Fencer -Fences -Fencing -Fender -Feral -Ferment -Fern -Fernlike -Ferns -Ferocious -Ferocity -Ferret -Ferries -Ferris -Ferrous -Ferry -Fertile -Fervent -Fervor -Fester -Festival -Festivals -Festive -Festivity -Fetal -Fetch -Fetched -Feud -Feudal -Feudalism -Fever -Feverish -Fewer -Fewest -Fiat -Fiber -Fibers -Fibrous -Fiction -Fictional -Fictions -Fiddle -Fiddling -Fidelity -Fidgeting -Fidgety -Fiduciary -Fief -Fielded -Fielding -Fieldwork -Fierce -Fiercely -Fiery -Fiesta -Fife -Fifteen -Fifteenth -Fifth -Fifths -Fifties -Fiftieth -Fifty -Fig -Fight -Fighter -Fighting -Fights -Figment -Figs -Figure -Figures -Figurine -Figurines -Filament -Filaments -Filial -Filing -Filled -Filler -Filling -Fills -Film -Filmed -Filming -Filmmaker -Films -Filter -Filtered -Filtering -Filters -Filth -Filthy -Filtrate -Fin -Finale -Finalist -Finalists -Finality -Finalize -Finalized -Finally -Finance -Financed -Finances -Financial -Financier -Financing -Finch -Find -Finder -Finding -Findings -Finds -Finely -Fineness -Finer -Finest -Finger -Fingers -Finicky -Finish -Finished -Finisher -Finishers -Finishes -Finishing -Finite -Finless -Finlike -Fins -Fir -Fired -Fireplace -Fires -Firewall -Firewood -Fireworks -Firing -Firmly -Firmness -Firsthand -Firstly -Firth -Fiscal -Fiscally -Fished -Fisher -Fisheries -Fisherman -Fishermen -Fishery -Fishes -Fishing -Fission -Fissure -Fist -Fists -Fit -Fitness -Fitted -Fitting -Fittings -Five -Fix -Fixation -Fixed -Fixes -Fixing -Fixture -Fixtures -Fjord -Flaccid -Flag -Flagman -Flagpole -Flags -Flagship -Flagstick -Flagstone -Flail -Flair -Flakes -Flakily -Flaky -Flame -Flamenco -Flames -Flaming -Flammable -Flank -Flanked -Flanking -Flanks -Flannels -Flap -Flaps -Flare -Flared -Flaring -Flash -Flashback -Flashbulb -Flashcard -Flashed -Flashes -Flashily -Flashing -Flashy -Flask -Flat -Flatbed -Flatfoot -Flatly -Flatness -Flats -Flatten -Flattened -Flatter -Flattered -Flatterer -Flattery -Flattop -Flatware -Flatworm -Flavor -Flavored -Flavorful -Flavoring -Flavors -Flaw -Flawed -Flaws -Flax -Flaxseed -Flea -Fled -Fledged -Fledgling -Flee -Fleeing -Flees -Fleet -Fleeting -Fleets -Flesh -Fleshed -Fleshy -Flew -Flick -Flicker -Flier -Flight -Flights -Flinch -Fling -Flint -Flip -Flipped -Flirt -Float -Floated -Floating -Floats -Flock -Flocks -Flogging -Flood -Flooded -Flooding -Floods -Floor -Floors -Flop -Floppy -Flora -Floral -Florist -Floss -Flotilla -Flounder -Flour -Flourish -Flowed -Flowering -Flowers -Flown -Flows -Flu -Fluency -Fluid -Fluidity -Fluids -Flung -Fluoride -Flush -Flushed -Flushing -Flute -Flutter -Fluxes -Flyable -Flyaway -Flyer -Flyers -Flying -Flyover -Flypaper -Flyweight -Foam -Focal -Focus -Focused -Focuses -Focusing -Fodder -Foe -Foes -Fog -Foil -Folder -Folders -Foliage -Folic -Folk -Folklore -Folks -Follicle -Follicles -Follow -Followed -Follower -Followers -Following -Follows -Folly -Fond -Fondly -Fondness -Fondue -Font -Fonts -Foo -Food -Foods -Fool -Fooled -Foolish -Fools -Footage -Football -Footbath -Footboard -Footer -Footgear -Foothill -Foothills -Foothold -Footing -Footless -Footman -Footnote -Footnotes -Footpad -Footpath -Footprint -Footrest -Footsore -Footsteps -Footwear -Footwork -Forage -Foraging -Foray -Forbade -Forbid -Forbidden -Forbids -Forceful -Forceps -Forcibly -Forearm -Forecast -Forecasts -Forefront -Foregoing -Forehead -Foreign -Foreigner -Foreman -Foremost -Forensic -Foresee -Foresight -Forested -Forestry -Forests -Forever -Foreword -Forfeited -Forge -Forged -Forgery -Forget -Forgets -Forging -Forgive -Forgiven -Forgiving -Forgot -Forgotten -Forks -Formalism -Formality -Format -Formats -Formatted -Formerly -Formula -Formulas -Formulate -Forte -Forthwith -Forties -Fortified -Fortnight -Fortress -Fortune -Fortunes -Forty -Forum -Forums -Forwarded -Forwards -Fossil -Fossils -Foster -Fostered -Fostering -Fought -Foul -Founder -Founders -Founding -Foundry -Fountain -Fountains -Four -Fourteen -Fourth -Fowl -Fox -Foxes -Foyer -Fractal -Fraction -Fractions -Fracture -Fractured -Fractures -Fragile -Fragility -Fragment -Fragments -Fragrance -Fragrant -Frail -Frame -Framed -Frames -Framework -Framing -Franchise -Frank -Frankly -Franks -Frantic -Fraternal -Fraud -Fraught -Fray -Frayed -Fraying -Frays -Freak -Freckled -Freckles -Free -Freebee -Freebie -Freed -Freedman -Freedom -Freedoms -Freefall -Freehand -Freeing -Freelance -Freeload -Freely -Freeman -Freemason -Freeness -Freer -Freestyle -Freeware -Freeway -Freewill -Freezable -Freeze -Freezer -Freezing -Freight -Freighter -French -Frenzied -Frenzy -Frequency -Frequent -Fresco -Frescoes -Fresh -Freshly -Freshman -Freshmen -Freshness -Fretful -Fretted -Friar -Friars -Friction -Friday -Fridge -Fried -Friend -Fries -Frieze -Frigate -Frigates -Fright -Frighten -Frightful -Frigidity -Frigidly -Frill -Fringe -Fringes -Frisbee -Frisk -Fritter -Frivolous -Frog -Frogs -Frolic -From -Front -Frontage -Frontal -Frontier -Frontiers -Frost -Frostbite -Frosted -Frostily -Frosting -Frostlike -Frosty -Froth -Frown -Frowned -Frowning -Froze -Frozen -Fructose -Frugality -Frugally -Fruit -Fruitful -Fruition -Fruitless -Fruits -Frustrate -Fry -Frying -Fuel -Fueled -Fuels -Fugitive -Fulfill -Fulfilled -Full -Fuller -Fullest -Fullness -Fumble -Fumbles -Fumes -Fun -Function -Functions -Funded -Funding -Funds -Fungal -Fungi -Fungus -Funk -Funky -Funnel -Funny -Furious -Furiously -Furlongs -Furnace -Furnaces -Furnish -Furnished -Furniture -Furs -Further -Fury -Fuselage -Fuss -Futile -Futility -Future -Futures -Fuzzy -Gab -Gable -Gables -Gaffe -Gag -Gainfully -Gaining -Gains -Gait -Gala -Galactic -Galaxies -Galaxy -Gale -Gall -Gallant -Gallantly -Gallantry -Galleria -Galleries -Gallery -Galley -Gallon -Gallons -Gallop -Gallstone -Galore -Galvanize -Gamble -Gambling -Game -Gamer -Games -Gaming -Gamma -Gander -Gang -Gangly -Gangrene -Gangs -Gangster -Gangway -Gap -Gaping -Gaps -Garage -Garb -Garbage -Garden -Gardener -Gardeners -Gardening -Gardens -Gargle -Garland -Garlic -Garment -Garments -Garner -Garnered -Garnering -Garnet -Garnish -Garrison -Garrisons -Garter -Gas -Gaseous -Gasoline -Gasp -Gasped -Gasping -Gastric -Gate -Gates -Gateway -Gather -Gathered -Gatherer -Gathering -Gathers -Gating -Gauge -Gauging -Gaunt -Gauntlet -Gauze -Gave -Gawk -Gaze -Gazed -Gazette -Gazetted -Gazing -Gear -Gearbox -Geared -Gears -Gecko -Geek -Geese -Geiger -Gelatin -Gem -Gems -Gender -Gene -Genealogy -Genera -General -Generally -Generals -Generated -Generates -Generator -Generic -Generous -Genes -Genesis -Genetic -Genetics -Genie -Genius -Genome -Genomes -Genre -Genres -Gentile -Gentle -Gentleman -Gentlemen -Gently -Gentry -Gents -Genuine -Genuinely -Genus -Geography -Geologic -Geologist -Geology -Geometric -Geometry -Geranium -Gerbil -Geriatric -Germ -Germicide -Germinate -Germless -Germproof -Germs -Gestate -Gestation -Gesture -Gestured -Gestures -Getaway -Getting -Getup -Ghastly -Ghost -Ghostly -Ghosts -Giant -Giants -Gibberish -Gibbon -Gibbons -Giblet -Giddily -Giddiness -Giddy -Gift -Gifted -Gifts -Gig -Gigabyte -Gigahertz -Gigantic -Giggle -Giggled -Giggling -Giggly -Gigs -Gilded -Gill -Gilled -Gills -Gimmick -Ginger -Girdle -Girl -Girls -Give -Giveaway -Given -Giver -Gives -Giving -Gizmo -Gizzard -Glacial -Glacier -Glaciers -Glad -Glade -Gladiator -Gladly -Glamorous -Glamour -Glance -Glanced -Glances -Glancing -Gland -Glands -Glandular -Glare -Glared -Glaring -Glass -Glasses -Glaucoma -Glaze -Glazed -Glazing -Gleam -Gleaming -Gleaned -Glee -Gleeful -Glen -Glide -Glider -Gliders -Gliding -Glimmer -Glimpse -Glimpses -Glisten -Glitch -Glitter -Glitzy -Gloater -Gloating -Global -Globally -Globe -Gloom -Gloomily -Gloomy -Glorified -Glorifier -Glorify -Glorious -Glory -Gloss -Glossary -Glossy -Glove -Gloves -Glow -Glowed -Glowing -Glowworm -Glucose -Glue -Glued -Gluten -Glutinous -Glutton -Gnarly -Gnat -Goal -Goals -Goat -Goats -Goatskin -God -Goddess -Goddesses -Godfather -Godly -Gods -Goes -Goggles -Going -Gold -Golden -Goldfish -Goldmine -Goldsmith -Golf -Golfer -Goliath -Gondola -Gone -Gong -Good -Goodbye -Goodness -Goods -Goodwill -Gooey -Goofball -Goofiness -Goofy -Google -Goon -Goose -Gopher -Gorge -Gorged -Gorgeous -Gorilla -Gosling -Gospel -Gospels -Gossip -Gothic -Gotten -Gout -Govern -Governed -Governing -Governor -Governors -Governs -Gown -Gowns -Grab -Grabbed -Grabbing -Grabs -Grace -Graceful -Graceless -Graces -Gracious -Gradation -Graded -Grader -Graders -Gradient -Gradients -Grading -Gradual -Gradually -Graduate -Graduated -Graffiti -Graft -Grafted -Grafting -Grafts -Grail -Grain -Grains -Grammar -Grammars -Grand -Granddad -Grandeur -Grandiose -Grandkid -Grandly -Grandma -Grandpa -Grandson -Grange -Granite -Granny -Granola -Grant -Granted -Granting -Granular -Granules -Grape -Grapes -Graph -Graphical -Graphite -Grapple -Grappling -Grasp -Grasped -Grasping -Grass -Grasses -Grassland -Grassy -Grateful -Gratified -Gratify -Grating -Gratitude -Gratuity -Gravel -Graveness -Graves -Graveyard -Gravitate -Gravity -Gravy -Gray -Grays -Grazing -Grease -Greasily -Greasy -Great -Greater -Greatest -Greatly -Greatness -Greedily -Greedless -Greedy -Green -Greenish -Greens -Greet -Greeted -Greeter -Greeting -Greetings -Grenadier -Grew -Greyhound -Grid -Grids -Grief -Grievance -Grieve -Grieving -Grievous -Griffin -Grill -Grille -Grilled -Grim -Grimace -Grimacing -Grime -Grimes -Griminess -Grimly -Grimy -Grin -Grinch -Grind -Grinding -Grinned -Grinning -Grip -Gripped -Gripping -Grips -Gristle -Grit -Grizzlies -Groan -Groaned -Groceries -Grocery -Groggily -Groggy -Groom -Grooming -Groove -Grooves -Grooving -Groovy -Gross -Grossed -Grossing -Grossly -Grotesque -Ground -Grounded -Grounding -Grouped -Grouping -Groupings -Grout -Grove -Groves -Grow -Grower -Growers -Growing -Growl -Growled -Grown -Grows -Growth -Grub -Grudge -Grudging -Grueling -Gruffly -Grumble -Grumbling -Grumbly -Grumpily -Grunge -Grunt -Grunted -Guacamole -Guarantee -Guarded -Guardian -Guardians -Guarding -Guerrilla -Guess -Guessed -Guessing -Guest -Guests -Guidable -Guidance -Guide -Guided -Guideline -Guides -Guiding -Guild -Guilds -Guileless -Guilt -Guilty -Guinea -Guise -Guitar -Guitarist -Guitars -Gulf -Gull -Gullible -Gully -Gulp -Gum -Gumball -Gumdrop -Gumminess -Gumming -Gummy -Gums -Gunboat -Gunboats -Gunner -Gunners -Gunnery -Gunpowder -Gurgle -Gurgling -Guru -Gush -Gusto -Gusty -Gut -Gutless -Guts -Gutter -Guy -Guys -Guzzler -Gym -Gymnasium -Gymnast -Gypsum -Gyration -Habitable -Habitant -Habitat -Habitats -Habitual -Hacked -Hacker -Hacking -Hackney -Hacksaw -Had -Haggler -Haiku -Hail -Hailed -Hails -Hairy -Half -Halftime -Halfway -Hallmark -Halls -Hallway -Halo -Halogen -Halt -Halted -Halting -Halved -Halves -Hamburger -Hamlet -Hamlets -Hammer -Hammered -Hammock -Hamper -Hampered -Hamster -Hamstring -Handbag -Handball -Handbook -Handbrake -Handcart -Handclap -Handclasp -Handcraft -Handcuff -Handed -Handful -Handgrip -Handgun -Handheld -Handiness -Handing -Handiwork -Handle -Handlebar -Handled -Handler -Handles -Handling -Handmade -Handoff -Handpick -Handprint -Handrail -Hands -Handsaw -Handset -Handsfree -Handshake -Handsome -Handstand -Handwash -Handwork -Handwoven -Handwrite -Handy -Handyman -Hang -Hangar -Hangnail -Hangout -Hangover -Hangs -Hangup -Hankering -Hankie -Hanky -Haphazard -Happen -Happened -Happening -Happens -Happier -Happiest -Happily -Happiness -Happy -Harbor -Hard -Hardcopy -Hardcover -Harddisk -Harden -Hardened -Hardener -Hardening -Harder -Hardest -Hardhat -Hardhead -Hardiness -Hardly -Hardness -Hardship -Hardships -Hardware -Hardwired -Hardwood -Hardy -Harmful -Harmless -Harmonic -Harmonica -Harmonics -Harmonies -Harmonize -Harmony -Harness -Harpist -Harrow -Harry -Harsh -Harshly -Harvest -Harvested -Harvests -Hash -Hassle -Haste -Hasten -Hastened -Hastily -Hastiness -Hasty -Hatbox -Hatch -Hatchback -Hatched -Hatchery -Hatchet -Hatching -Hatchling -Hate -Hated -Hates -Hatless -Hatred -Hats -Hauled -Hauling -Haunt -Haunted -Haunting -Haunts -Haven -Havoc -Hawk -Hawker -Hawks -Hawthorn -Hay -Hays -Hazard -Hazardous -Hazards -Haze -Hazel -Hazelnut -Hazily -Haziness -Hazing -Hazy -Headache -Headaches -Headband -Headboard -Headcount -Headdress -Headed -Header -Headers -Headfirst -Headgear -Heading -Headings -Headlamp -Headless -Headline -Headlined -Headlines -Headlock -Headphone -Headpiece -Headrest -Headroom -Heads -Headscarf -Headset -Headsman -Headstand -Headstone -Headway -Headwear -Heal -Healed -Healer -Healers -Healing -Health -Healthier -Heap -Heaped -Heaps -Hearer -Hearings -Hears -Hearsay -Heartbeat -Hearth -Heartily -Heartland -Hearts -Hearty -Heat -Heather -Heats -Heave -Heaven -Heavenly -Heavens -Heavier -Heaviest -Heavily -Heaviness -Heaving -Heavy -Hectare -Hectares -Hector -Hedge -Hedgehog -Hedges -Hedging -Heed -Heftiness -Hefty -Hegemony -Height -Heights -Heir -Heiress -Heirs -Helium -Helix -Hello -Helm -Helmet -Helmets -Help -Helped -Helper -Helpers -Helpful -Helping -Helpless -Helpline -Helps -Hemlock -Hemp -Hemstitch -Hence -Henchman -Henchmen -Henna -Hens -Herald -Heralded -Heraldic -Herb -Herbal -Herbicide -Herbs -Herd -Herder -Herds -Hereafter -Heredity -Heritage -Hermit -Hermitage -Hero -Heroes -Heroic -Heroics -Heroine -Heroism -Heron -Herring -Herself -Hertz -Hesitancy -Hesitant -Hesitate -Hesitated -Heuristic -Hexagon -Hexagonal -Hexagram -Heyday -Hiatus -Hickory -Hid -Hidden -Hide -Hideous -Hideout -Hides -Hiding -Hierarchy -Higher -Highest -Highland -Highlands -Highlight -Highly -Highness -Highway -Highways -Hike -Hiking -Hillside -Hilltop -Hinder -Hindered -Hindrance -Hindsight -Hinge -Hinges -Hint -Hinted -Hints -Hired -Hires -Hiring -Hiss -Hissed -Histamine -Histogram -Historian -Historic -Histories -History -Hit -Hitch -Hitherto -Hits -Hitter -Hitting -Hoard -Hoarse -Hoax -Hobbies -Hobby -Hockey -Hogan -Holdings -Holes -Holiday -Holidays -Holiness -Holistic -Hollow -Holy -Homage -Home -Homeland -Homemade -Homer -Homes -Homestead -Hometown -Homework -Honest -Honestly -Honesty -Honey -Honeycomb -Honeymoon -Honor -Honorable -Honorary -Honored -Honorific -Honoring -Honors -Hooked -Hooks -Hoop -Hope -Hoped -Hopeful -Hopefully -Hopeless -Hopes -Hoping -Horde -Horizon -Horizons -Hormonal -Hormone -Hormones -Horned -Hornet -Hornets -Horrible -Horrid -Horrified -Horror -Horrors -Horseback -Horsemen -Horses -Horseshoe -Hospital -Hospitals -Hosted -Hostel -Hostess -Hostile -Hostility -Hosting -Hotel -Hotels -Hottest -Hound -Hounds -Hour -Hourly -Hours -Housed -Household -Housewife -Housework -Housing -Hovered -Hovering -However -Howitzer -Howitzers -Howl -Howling -Hub -Hubcap -Hubs -Huddle -Huddled -Huddling -Hue -Huff -Hug -Huge -Hugely -Hugged -Hugging -Huh -Hula -Hulk -Hull -Hum -Human -Humane -Humanism -Humanist -Humanity -Humankind -Humans -Humble -Humbling -Humbly -Humid -Humidity -Humiliate -Humility -Humming -Hummus -Humongous -Humor -Humorist -Humorless -Humorous -Humpback -Humped -Humvee -Hundred -Hundreds -Hundredth -Hung -Hunger -Hungrily -Hungry -Hunk -Hunted -Hunter -Hunters -Hunting -Huntress -Hunts -Huntsman -Hurdle -Hurdles -Hurled -Hurler -Hurling -Hurray -Hurricane -Hurried -Hurriedly -Hurry -Hurrying -Hurt -Hurting -Hurts -Husband -Husbandry -Husbands -Hush -Hushed -Husked -Huskies -Huskiness -Hussars -Hut -Huts -Hybrid -Hybrids -Hydra -Hydrant -Hydrated -Hydration -Hydraulic -Hydrogen -Hydroxide -Hygiene -Hymn -Hymns -Hyper -Hyperlink -Hypertext -Hyphen -Hypnoses -Hypnosis -Hypnotic -Hypnotism -Hypnotist -Hypnotize -Hypocrisy -Hypocrite -Hysteria -Ibuprofen -Ice -Iciness -Icing -Icky -Icon -Icons -Icy -Idea -Ideal -Idealism -Idealist -Idealize -Idealized -Ideally -Idealness -Ideals -Ideas -Identical -Identify -Identity -Ideology -Idiocy -Idiom -Idle -Idleness -Idly -Idol -Idols -Igloo -Igneous -Ignited -Ignition -Ignorance -Ignorant -Ignore -Ignored -Ignores -Ignoring -Iguana -Illegal -Illegally -Illicit -Illicitly -Illnesses -Illusion -Illusions -Illusive -Illusory -Image -Imagery -Images -Imaginary -Imagine -Imagined -Imagines -Imaging -Imagining -Imam -Imbalance -Imbued -Imitate -Imitated -Imitating -Imitation -Immanent -Immature -Immediacy -Immediate -Immense -Immensely -Immerse -Immersed -Immersion -Imminent -Immobile -Immodest -Immoral -Immorally -Immortal -Immovable -Immovably -Immunity -Immunize -Immutable -Impact -Impacted -Impacts -Impair -Impaired -Impart -Imparted -Impartial -Impasse -Impatient -Impeach -Impedance -Impede -Impeded -Impeding -Impelled -Impending -Imperfect -Imperial -Impetus -Impish -Implant -Implanted -Implants -Implement -Implicate -Implicit -Implied -Implies -Implode -Implosion -Implosive -Imply -Implying -Impolite -Import -Important -Imported -Importer -Importing -Imports -Impose -Imposes -Imposing -Impound -Imprecise -Impress -Impressed -Imprint -Imprison -Impromptu -Improper -Improve -Improved -Improves -Improving -Improvise -Imprudent -Impulse -Impulses -Impulsive -Impure -Impurity -Imputed -Inability -Inaction -Inactive -Inanimate -Inasmuch -Inaugural -Incapable -Incarnate -Incense -Incentive -Inception -Incessant -Inches -Incident -Incidents -Incipient -Incised -Incision -Incline -Inclined -Include -Included -Includes -Including -Inclusion -Inclusive -Income -Incomes -Incoming -Incorrect -Increase -Increased -Increases -Increment -Incubated -Incumbent -Incur -Incurred -Indebted -Indeed -Indemnity -Index -Indexed -Indexes -Indexing -Indicate -Indicated -Indicates -Indicator -Indices -Indicted -Indignant -Indigo -Indirect -Indoor -Indoors -Induce -Induced -Induces -Inducing -Inducted -Induction -Inductive -Indulge -Indulged -Industry -Inelastic -Inert -Inertia -Inertial -Infamous -Infancy -Infant -Infantile -Infantry -Infants -Infect -Infected -Infection -Infer -Inference -Inferior -Inferno -Inferred -Infested -Infinite -Infinity -Infirmary -Inflamed -Inflated -Inflation -Inflict -Inflicted -Inflow -Influence -Influenza -Influx -Info -Inform -Informal -Informant -Informed -Informing -Informs -Infrared -Infused -Infusion -Ingenious -Ingenuity -Ingested -Ingestion -Ingrained -Inhabit -Inhabits -Inhaled -Inherent -Inherit -Inherited -Inhibit -Inhibited -Inhibits -Inhuman -Initial -Initially -Initials -Initiate -Initiated -Initiates -Inject -Injected -Injecting -Injection -Injure -Injured -Injuries -Injuring -Injurious -Injury -Injustice -Inlet -Inmate -Inmates -Inn -Innate -Innermost -Innocence -Innocent -Inns -Inorganic -Inpatient -Input -Inputs -Inquest -Inquire -Inquired -Inquiries -Inquiring -Inquiry -Inscribed -Insect -Insects -Insecure -Insert -Inserted -Inserting -Insertion -Inserts -Inset -Inside -Insider -Insiders -Insidious -Insight -Insights -Insignia -Insist -Insisted -Insistent -Insisting -Insists -Insoluble -Insomnia -Inspect -Inspected -Inspector -Inspire -Inspired -Inspires -Inspiring -Install -Installed -Instance -Instances -Instant -Instantly -Instead -Instinct -Instincts -Institute -Instruct -Insulated -Insulin -Insult -Insulted -Insulting -Insults -Insurance -Insure -Insured -Insurer -Insurers -Intact -Intake -Integer -Integers -Integral -Integrate -Integrity -Intel -Intellect -Intend -Intending -Intends -Intense -Intensely -Intensify -Intensity -Intensive -Intent -Intention -Intently -Interact -Interacts -Intercept -Interest -Interests -Interface -Interfere -Interim -Interior -Interiors -Intern -Internal -Interned -Internet -Interplay -Interpret -Interred -Interrupt -Intersect -Interval -Intervals -Intervene -Interview -Intestine -Intricate -Intrigue -Intrigued -Intrinsic -Intro -Introduce -Intruder -Intrusion -Intrusive -Intuition -Intuitive -Invade -Invaded -Invaders -Invading -Invalid -Invariant -Invasion -Invasions -Invasive -Invent -Invented -Inventing -Invention -Inventive -Inventor -Inventors -Inventory -Inverse -Inversely -Inversion -Inverted -Invest -Invested -Investing -Investor -Investors -Invisible -Invite -Invited -Invites -Inviting -Invoice -Invoke -Invoked -Invokes -Invoking -Involve -Involved -Involves -Involving -Inward -Inwardly -Iodine -Iodize -Ion -Ionized -Ipad -Iphone -Ipod -Irate -Iris -Irk -Iron -Ironic -Irons -Irony -Irregular -Irrigate -Irrigated -Irritable -Irritably -Irritant -Irritate -Irritated -Island -Islander -Islanders -Islands -Islet -Isolate -Isolated -Isolates -Isolating -Isolation -Isotope -Isotopes -Isotopic -Isotropic -Issue -Issuing -Isthmus -Italicize -Italics -Item -Items -Iteration -Iterative -Itinerant -Itinerary -Itunes -Ivory -Ivy -Jab -Jack -Jackal -Jacket -Jackets -Jackknife -Jackpot -Jade -Jagged -Jaguar -Jaguars -Jail -Jailbird -Jailbreak -Jailed -Jailer -Jailhouse -Jalapeno -Jam -Jammed -Jams -Janitor -January -Japan -Jar -Jargon -Jarring -Jars -Jasmine -Jasper -Jaundice -Jaunt -Java -Javelin -Jaw -Jawed -Jawless -Jawline -Jaws -Jaybird -Jays -Jaywalker -Jazz -Jealous -Jealousy -Jeans -Jeep -Jeeringly -Jellied -Jelly -Jeopardy -Jersey -Jerseys -Jest -Jester -Jet -Jets -Jewel -Jewelry -Jewels -Jiffy -Jigsaw -Jimmy -Jingle -Jingling -Jinx -Jitters -Jittery -Job -Jobs -Jock -Jockey -Jockstrap -Jogger -Jogging -John -Joining -Joins -Joint -Jointly -Joints -Joke -Joker -Jokes -Jokester -Joking -Jokingly -Jolliness -Jolly -Jolt -Josh -Jot -Journal -Journals -Journey -Journeys -Jovial -Joyful -Joyfully -Joylessly -Joyous -Joyride -Joystick -Jubilance -Jubilant -Jubilee -Judge -Judged -Judges -Judging -Judgingly -Judgment -Judgments -Judicial -Judiciary -Judicious -Judo -Jug -Juggle -Juggling -Jugular -Juice -Juices -Juiciness -Juicy -Jujitsu -Jukebox -July -Jumble -Jumbo -Jump -Jumped -Jumper -Jumping -Jumps -Junction -Juncture -June -Jungle -Junior -Juniors -Juniper -Junk -Junkman -Junkyard -Junta -Juridical -Jurist -Jurists -Juror -Jurors -Jury -Justice -Justified -Justifier -Justifies -Justify -Justly -Justness -Juvenile -Juveniles -Kabob -Kangaroo -Karaoke -Karate -Karma -Kebab -Keel -Keen -Keenly -Keenness -Keep -Keeps -Keg -Kelp -Kennel -Kept -Kerchief -Kernel -Kerosene -Kettle -Keyboard -Keyboards -Keynote -Keystone -Keyword -Keywords -Kibbutz -Kick -Kicked -Kicker -Kicking -Kickoff -Kicks -Kid -Kidding -Kidney -Kidneys -Kids -Kiln -Kilobyte -Kilogram -Kilograms -Kilometer -Kilowatt -Kilt -Kimono -Kindle -Kindling -Kindly -Kindness -Kindred -Kinds -Kinetic -Kinfolk -King -Kingdom -Kingdoms -Kingship -Kinship -Kinsman -Kinswoman -Kissable -Kisser -Kissing -Kit -Kitchen -Kitchens -Kite -Kits -Kitten -Kitty -Kiwi -Kleenex -Knapsack -Knee -Kneeling -Knees -Knelt -Knew -Knickers -Knife -Knight -Knighted -Knights -Knit -Knitting -Knives -Knock -Knocked -Knocking -Knockout -Knocks -Knoll -Knot -Knots -Knowing -Knowingly -Knows -Knuckles -Koala -Kooky -Kosher -Krypton -Kudos -Kung -Label -Labeled -Labeling -Labels -Labor -Labored -Laborer -Laborers -Laboring -Laborious -Labors -Labrador -Labyrinth -Lacked -Lacking -Lacks -Lacrosse -Lactate -Lactose -Lacy -Ladder -Laden -Ladies -Ladle -Lady -Ladybug -Ladylike -Lagged -Lagging -Lagoon -Laid -Lair -Lake -Lamb -Lambda -Lambs -Lament -Lamented -Lamps -Lance -Lancers -Lancet -Landed -Landfall -Landfill -Landing -Landings -Landlady -Landless -Landline -Landlord -Landlords -Landmark -Landmarks -Landmass -Landmine -Landowner -Landscape -Landside -Landslide -Language -Languages -Lankiness -Lanky -Lantern -Lapdog -Lapel -Lapped -Lapping -Laptop -Lard -Large -Largely -Larger -Largest -Lark -Larva -Larvae -Larval -Larynx -Laser -Lasers -Lash -Lasso -Last -Lastly -Lasts -Latch -Late -Lately -Latency -Latent -Later -Laterally -Latest -Latex -Lather -Latitude -Latitudes -Latrine -Latter -Lattice -Latticed -Laugh -Laughed -Laughing -Laughs -Launch -Launched -Launcher -Launchers -Launches -Launching -Launder -Laundry -Laureate -Laurel -Lava -Lavender -Lavish -Lawmakers -Lawn -Lawns -Lawsuit -Lawsuits -Lawyer -Lawyers -Laxative -Layered -Layman -Layout -Lazily -Laziness -Lazy -Leach -Leaching -Leader -Leaders -Leads -Leaf -Leaflet -Leaflets -Leafs -Leafy -League -Leagues -Leakage -Leaked -Leaking -Leaks -Leans -Leap -Leaped -Leaping -Leaps -Leapt -Learn -Learned -Learner -Learners -Learning -Learns -Learnt -Least -Leather -Leave -Leaves -Leaving -Lecture -Lectured -Lecturer -Lectures -Lecturing -Ledger -Left -Leg -Legacy -Legal -Legality -Legend -Legendary -Legends -Legged -Leggings -Legible -Legibly -Legion -Legions -Legislate -Lego -Legroom -Legs -Legume -Legumes -Legwarmer -Legwork -Leisure -Leisurely -Lemma -Lemon -Lend -Lenders -Length -Lengthy -Lens -Lenses -Lent -Leopard -Leopards -Leotard -Lessee -Lessen -Lessened -Lesser -Lesson -Lessons -Lessor -Letdown -Lethargic -Lethargy -Letter -Lettering -Letters -Letting -Lettuce -Level -Leveled -Levels -Leverage -Levers -Levied -Levitate -Levitator -Levy -Lexical -Lexicon -Liability -Liable -Liaison -Liar -Libel -Liberated -Liberties -Liberty -Librarian -Libraries -Library -Libretto -License -Licensed -Licensee -Licenses -Licensing -Lichen -Licking -Licorice -Lid -Life -Lifeboat -Lifeless -Lifelong -Lifespan -Lifestyle -Lifetime -Lifetimes -Lifted -Lifter -Lifting -Liftoff -Lifts -Ligament -Ligaments -Lighter -Lightness -Lightning -Liked -Likely -Likened -Likeness -Likes -Likewise -Liking -Lilac -Lilies -Lilly -Lily -Limb -Limeade -Limelight -Limerick -Limes -Limestone -Limit -Limiting -Limitless -Limits -Limping -Limpness -Line -Lineage -Lineages -Linearly -Linen -Liner -Lineup -Linger -Lingered -Lingering -Lingo -Lingual -Linguini -Linguist -Linguists -Lining -Linkage -Linkages -Linked -Links -Linoleum -Linseed -Lint -Lion -Lip -Lipid -Lipids -Lipstick -Liquefy -Liqueur -Liquid -Liquidity -Liquids -Liquor -Lisp -List -Listen -Listened -Listener -Listeners -Listens -Listing -Listings -Lists -Liter -Literal -Literally -Literary -Liters -Lithium -Litigate -Litigator -Litmus -Litter -Little -Littoral -Liturgy -Livable -Lived -Lively -Liver -Livestock -Lividly -Living -Lizard -Lizards -Loaf -Loan -Loaned -Loans -Lobbied -Lobby -Lobbying -Lobes -Lobster -Local -Locale -Locality -Localized -Locally -Locals -Locates -Locker -Loco -Locus -Locust -Lodge -Lodged -Lodges -Lodging -Lodgings -Lofty -Logged -Logging -Logic -Login -Logistic -Logistics -Logo -Logos -Lonely -Longer -Longest -Longevity -Longhorns -Longitude -Longtime -Lookout -Loomed -Loops -Loose -Loosely -Loosen -Loosened -Loosening -Loot -Looted -Looting -Lopes -Lordship -Losers -Losses -Lost -Lottery -Lotus -Louder -Loudly -Lounge -Lovely -Lovers -Loving -Lovingly -Lowered -Lowest -Lowland -Lowlands -Loyal -Loyalist -Loyalists -Loyalties -Loyalty -Lubricant -Lubricate -Lucid -Luck -Luckily -Luckiness -Luckless -Lucrative -Ludicrous -Luggage -Lugged -Lukewarm -Lull -Lullaby -Lumbar -Lumber -Luminance -Luminous -Lumpiness -Lumping -Lumpish -Lunacy -Lunar -Lunch -Lunchbox -Luncheon -Lunchroom -Lunchtime -Lung -Lungs -Lurch -Lure -Lured -Luridness -Lurk -Lurking -Lushly -Lushness -Luster -Lustrous -Luxuries -Luxurious -Luxury -Lyceum -Lying -Lymph -Lymphatic -Lynx -Lyric -Lyrical -Lyrically -Lyricism -Lyricist -Lyrics -Macarena -Macaroni -Macaw -Mace -Machine -Machinery -Machines -Machining -Machinist -Macintosh -Macro -Macros -Mad -Madam -Madame -Madden -Madness -Maestro -Magazine -Magazines -Magenta -Maggot -Magic -Magical -Magician -Magma -Magnate -Magnesium -Magnet -Magnetic -Magnetism -Magnetize -Magnets -Magnified -Magnifier -Magnify -Magnitude -Magnolia -Magnum -Mahatma -Mahogany -Maiden -Maids -Mailbox -Mailed -Mailing -Mainframe -Mainland -Mainline -Mainly -Mainstay -Maintain -Maintains -Maize -Majestic -Majesty -Major -Majored -Majorette -Majoring -Majority -Majors -Makeover -Maker -Makes -Makeshift -Makeup -Making -Malaise -Malformed -Malice -Malicious -Malls -Malt -Mama -Mamma -Mammal -Mammalian -Mammals -Mammogram -Mammoth -Manage -Managed -Manager -Managers -Manages -Managing -Manatee -Mandarin -Mandate -Mandated -Mandates -Mandatory -Mandible -Mandolin -Maneuver -Maneuvers -Manga -Manganese -Manger -Mangle -Mango -Mangrove -Mangy -Manhandle -Manhole -Manhood -Manhunt -Mania -Manic -Manicotti -Manicure -Manifest -Manifesto -Manifests -Manifold -Manila -Mankind -Manlike -Manliness -Manly -Manmade -Manned -Manner -Manners -Manning -Mannish -Manor -Manors -Manpower -Mansion -Mansions -Mantis -Mantle -Mantra -Manual -Manually -Manuals -Manure -Many -Map -Maple -Mapped -Mapping -Maps -Marathon -Marauding -Marble -Marbled -Marbles -Marbling -March -Marched -Marches -Marching -Mardi -Margarine -Margarita -Margin -Marginal -Margins -Maria -Marigold -Marina -Marine -Mariner -Mariners -Marital -Maritime -Markedly -Marker -Markers -Marketed -Marketers -Marketing -Markings -Markup -Marlin -Marlins -Marmalade -Maroon -Maroons -Marquess -Marred -Marriage -Marriages -Married -Marries -Marrow -Marry -Marrying -Marsh -Marshal -Marshals -Marshes -Marshland -Marshy -Marsupial -Martial -Martian -Martini -Martins -Marvel -Marvelous -Marxism -Mascot -Masculine -Mashed -Mashing -Mask -Masked -Masking -Masks -Mason -Masonic -Masonry -Masons -Mass -Massage -Massager -Masses -Massive -Mast -Mastered -Mastering -Masters -Mastery -Mastiff -Masts -Mat -Matador -Matchbook -Matchbox -Matched -Matcher -Matches -Matching -Matchless -Material -Materials -Maternal -Maternity -Math -Matriarch -Matrices -Matrimony -Matrix -Matron -Mats -Matted -Matter -Mattered -Matters -Mattress -Matured -Maturely -Maturing -Maturity -Mauve -Maverick -Mavericks -Max -Maxillary -Maxim -Maxima -Maximal -Maximize -Maxims -Maximum -Maybe -Mayday -Mayflower -Mayhem -Mayo -Mayor -Mayoral -Mayors -Maze -Mead -Meadow -Meadows -Meager -Meals -Mean -Meaning -Meanings -Means -Meant -Meantime -Meanwhile -Measles -Measure -Measured -Measures -Measuring -Meat -Meats -Mechanic -Mechanics -Mechanism -Medal -Medalists -Medallion -Medals -Mediated -Mediating -Mediation -Mediator -Mediators -Medical -Medically -Medicinal -Medicine -Medicines -Medieval -Mediocre -Meditate -Medium -Medley -Meek -Meet -Meeting -Meetings -Meets -Melodic -Melodies -Melodrama -Melody -Melt -Melted -Melting -Melts -Membrane -Membranes -Memo -Memoir -Memoirs -Memorable -Memoranda -Memorial -Memorials -Memories -Memory -Menace -Menacing -Mentality -Mention -Mentions -Mentor -Mentored -Mentoring -Mentors -Menu -Menus -Mercenary -Merchant -Merchants -Merciful -Mercury -Mercy -Mere -Merely -Merger -Mergers -Meridian -Merit -Merits -Mermaid -Merry -Mesa -Mesh -Mess -Message -Messages -Messenger -Messy -Meta -Metabolic -Metal -Metallic -Metals -Metaphor -Metaphors -Meteor -Meteorite -Methane -Methanol -Method -Methods -Metric -Metrics -Metro -Mezzanine -Mica -Mice -Mickey -Microbes -Microfilm -Microwave -Midday -Middle -Midland -Midlands -Midnight -Midpoint -Midsummer -Midtown -Midway -Midwife -Midwives -Might -Migraine -Migrating -Migratory -Mild -Milder -Mildly -Mileage -Milestone -Milieu -Military -Militia -Militias -Milk -Milky -Millennia -Miller -Millet -Milling -Million -Millions -Mills -Mime -Mimic -Minced -Mindful -Miner -Mineral -Minerals -Miners -Mingled -Mini -Miniature -Minimal -Minimally -Minimize -Minimized -Minimizes -Minimum -Ministry -Minor -Minority -Minors -Mint -Minted -Minuscule -Minute -Minutes -Miracle -Miracles -Mirage -Mirror -Mirrored -Mirrors -Mischief -Miserable -Misery -Misguided -Misled -Mismatch -Misplaced -Miss -Missed -Misses -Missing -Mistake -Mistaken -Mistakes -Mister -Mistrust -Misty -Misuse -Mitigate -Mix -Mixed -Mixer -Mixes -Mixing -Mixture -Mixtures -Moat -Mob -Mobile -Mobility -Mobilize -Mobster -Mocha -Mock -Mocked -Mocker -Mockery -Mocking -Mockup -Mod -Modal -Mode -Model -Models -Modem -Moderate -Moderator -Modernism -Modernist -Modernity -Modes -Modest -Modestly -Modesty -Modified -Modifier -Modifiers -Modifies -Modify -Modifying -Modular -Modulated -Modulator -Module -Modules -Modulus -Moist -Moisten -Moistness -Moisture -Molar -Molasses -Mold -Molded -Molding -Molds -Mole -Molecular -Molecule -Molecules -Molehill -Mollusk -Mollusks -Molten -Mom -Moment -Momentary -Momentous -Moments -Momentum -Mommy -Monarch -Monarchs -Monarchy -Monastery -Monastic -Monday -Monetary -Monetize -Money -Moneybags -Moneyless -Moneywise -Mongoose -Moniker -Monitor -Monitored -Monitors -Monk -Monkey -Monkeys -Monkhood -Monks -Mono -Monogamy -Monogram -Monograph -Monologue -Monopoly -Monorail -Monotone -Monotype -Monoxide -Monsieur -Monsoon -Monster -Monsters -Monstrous -Month -Monthly -Months -Monument -Monuments -Moocher -Mood -Moodiness -Moods -Moody -Mooing -Moonbeam -Mooned -Moonlight -Moonlike -Moonlit -Moonrise -Moons -Moonscape -Moonshine -Moonstone -Moonwalk -Moors -Moose -Mop -Morale -Morality -Morally -Morals -Moray -Morbid -Morbidity -Morbidly -Moreover -Mores -Morning -Mornings -Morocco -Morphing -Morse -Mortality -Mortally -Mortals -Mortar -Mortars -Mortgage -Mortgages -Mortician -Mortified -Mortify -Mortuary -Mosaic -Mosaics -Mosque -Mosques -Mosquito -Moss -Mossy -Most -Mostly -Motel -Mothball -Mothers -Mothproof -Moths -Motif -Motifs -Motion -Motioned -Motivate -Motivated -Motivator -Motive -Motocross -Motor -Motorized -Motors -Motorway -Motto -Mound -Mounds -Mountable -Mountain -Mountains -Mounted -Mounting -Mourn -Mourner -Mournful -Mourning -Mouse -Mousiness -Moustache -Mousy -Mouth -Mouths -Movable -Move -Movement -Movements -Mover -Movie -Movies -Moving -Mower -Mowing -Much -Muck -Mud -Muddy -Muffled -Mug -Mulberry -Mulch -Mule -Mules -Mulled -Mullets -Multi -Multiple -Multiples -Multiply -Multitask -Multitude -Mumble -Mumbled -Mumbling -Mumbo -Mummified -Mummify -Mummy -Mumps -Munchkin -Mundane -Municipal -Munitions -Muppet -Mural -Murals -Murkiness -Murky -Murmur -Murmured -Murmuring -Muscle -Muscles -Muscular -Museum -Museums -Mushily -Mushiness -Mushroom -Mushrooms -Mushy -Music -Musical -Musically -Musicals -Musician -Musicians -Musk -Musket -Muskiness -Musky -Mustache -Mustang -Mustangs -Mustard -Muster -Mustered -Mustiness -Musty -Mutable -Mutant -Mutants -Mutate -Mutation -Mutations -Mute -Mutiny -Mutt -Muttered -Muttering -Mutual -Mutually -Muzzle -Myriad -Myself -Myspace -Mysteries -Mystery -Mystic -Mystical -Mysticism -Mystics -Mystified -Mystify -Myth -Mythic -Mythical -Mythology -Myths -Nacho -Nag -Nail -Naive -Name -Namely -Names -Namesake -Naming -Nanny -Nanometer -Nape -Napkin -Napped -Napping -Nappy -Narrated -Narrates -Narration -Narrative -Narrator -Narrow -Narrowed -Narrower -Narrowly -Narrows -Nasal -Nastily -Nastiness -National -Native -Nativity -Natural -Naturally -Nature -Nausea -Nautical -Naval -Navigable -Navigate -Navigator -Navy -Nearby -Nearer -Nearest -Nearing -Nearly -Nearness -Neatly -Neatness -Nebula -Nebulizer -Necessity -Neck -Necklace -Necks -Nectar -Need -Needed -Needing -Needle -Needles -Needs -Negate -Negation -Negative -Neglect -Neglected -Neglector -Negligent -Negotiate -Neighbor -Neighbors -Neither -Nemeses -Nemesis -Neon -Nephew -Nephews -Nerd -Nerve -Nerves -Nervous -Nervy -Nest -Nesting -Nests -Net -Netted -Netting -Network -Networks -Neurology -Neuron -Neurons -Neurosis -Neurotic -Neuter -Neutral -Neutron -Neutrons -Never -Newborn -Newcomer -Newcomers -Newer -Newest -Newly -News -Newscast -Newscasts -Newspaper -Next -Nibble -Niche -Niches -Nickel -Nickname -Nicknamed -Nicknames -Nicotine -Niece -Nifty -Nightclub -Nightly -Nightmare -Nighttime -Nimble -Nimbly -Nineteen -Ninetieth -Ninety -Ninja -Nintendo -Ninth -Nirvana -Nitrate -Nitrogen -Nobility -Noble -Nobleman -Nobles -Nobody -Nocturnal -Nodes -Noise -Noises -Noisy -Nomadic -Nomads -Nominal -Nominally -Nominate -Nominated -Nominee -Nominees -None -Nonlinear -Nonprofit -Nonsense -Nonstop -Noodles -Norm -Norms -North -Northeast -Northerly -Northern -Northward -Northwest -Nose -Nostalgia -Notable -Notably -Notch -Notebook -Nothing -Notice -Notices -Notified -Notion -Notions -Notoriety -Notorious -Novel -Novelist -Novella -Novels -Novelty -Novice -Nowadays -Nowhere -Nuclear -Nuclei -Nucleus -Nugget -Nuggets -Null -Nullify -Number -Numbering -Numbers -Numbing -Numbly -Numbness -Numeral -Numerals -Numerate -Numerator -Numeric -Numerical -Numerous -Nun -Nuns -Nuptials -Nurse -Nursery -Nurses -Nursing -Nurture -Nutlike -Nutmeg -Nutrient -Nutrients -Nutshell -Nuttiness -Nutty -Nuzzle -Nylon -Oaf -Oak -Oaks -Oasis -Oat -Oath -Oaths -Obedience -Obedient -Obelisk -Obey -Obeyed -Obeying -Obituary -Object -Objected -Objection -Objective -Objects -Obligate -Obligated -Oblige -Obliged -Oblique -Oblivion -Oblivious -Oblong -Obnoxious -Oboe -Obscure -Obscured -Obscurity -Observant -Observe -Observed -Observer -Observers -Observes -Observing -Obsessed -Obsession -Obsessive -Obsolete -Obstacle -Obstacles -Obstinate -Obstruct -Obtain -Obtained -Obtaining -Obtains -Obtrusive -Obtuse -Obvious -Obviously -Occasion -Occasions -Occlusion -Occult -Occultist -Occupancy -Occupant -Occupants -Occupied -Occupier -Occupies -Occupy -Occupying -Occur -Occurred -Occurring -Occurs -Ocean -Oceanic -Oceans -Ocelot -Octagon -Octagonal -Octane -Octave -October -Octopus -Ocular -Odd -Oddly -Odds -Odor -Odors -Odyssey -Offend -Offended -Offender -Offenders -Offending -Offense -Offenses -Offensive -Offer -Offered -Offering -Offerings -Offers -Office -Officer -Officers -Offices -Officials -Offline -Offset -Offshoot -Offshore -Offspring -Ogle -Oil -Oily -Oink -Ointment -Okay -Old -Oldies -Olfactory -Olive -Olives -Olympics -Ombudsman -Omega -Omen -Ominous -Omission -Omissions -Omit -Omitted -Omitting -Omnibus -Omnivore -Onboard -Oncoming -Oneness -Oneself -Ongoing -Onion -Onions -Online -Onlooker -Only -Onscreen -Onset -Onshore -Onslaught -Onstage -Onto -Onward -Onwards -Onyx -Oops -Ooze -Oozy -Opacity -Opal -Opaque -Open -Opener -Openings -Openly -Openness -Opens -Opera -Operable -Operand -Operas -Operate -Operates -Operatic -Operating -Operation -Operative -Operator -Operators -Opined -Opinion -Opinions -Opossum -Opponent -Opponents -Oppose -Opposes -Opposing -Opposite -Opposites -Oppressed -Oppressor -Opt -Optic -Optical -Optics -Optimal -Optimism -Optimize -Optimized -Optimum -Optional -Optioned -Options -Opulently -Opus -Oracle -Orange -Oranges -Orator -Orbit -Orbital -Orbitals -Orbiting -Orbits -Orchard -Orchards -Orchestra -Orchid -Orchids -Ordained -Ordeal -Orderly -Ordinal -Ordinance -Ordnance -Organ -Organism -Organisms -Organist -Organize -Organizer -Organizes -Organs -Orient -Oriented -Origin -Originals -Originate -Origins -Orioles -Ornament -Ornaments -Ornate -Orphan -Orphanage -Orphaned -Orphans -Orthodoxy -Osmosis -Osmotic -Other -Otherwise -Otter -Ottoman -Ottomans -Ouch -Ought -Ounce -Ounces -Ourselves -Ousted -Outage -Outback -Outbid -Outboard -Outbound -Outbreak -Outbreaks -Outburst -Outbursts -Outcast -Outclass -Outcome -Outcomes -Outcrops -Outcry -Outdated -Outdoor -Outdoors -Outer -Outfield -Outfit -Outfits -Outflank -Outgoing -Outgrow -Outhouse -Outing -Outlast -Outlaw -Outlawed -Outlaws -Outlay -Outlays -Outlet -Outlets -Outline -Outlined -Outlines -Outlining -Outlook -Outlying -Outmatch -Outmost -Outnumber -Outplayed -Outpost -Outposts -Outpour -Output -Outputs -Outrage -Outraged -Outrank -Outreach -Outright -Outscore -Outsell -Outset -Outshine -Outshoot -Outside -Outsider -Outsiders -Outskirts -Outsmart -Outsource -Outspoken -Outtakes -Outthink -Outward -Outwardly -Outweigh -Outwit -Oval -Ovary -Oven -Overact -Overall -Overarch -Overbid -Overbill -Overbite -Overblown -Overboard -Overbook -Overbuilt -Overcame -Overcast -Overcoat -Overcome -Overcook -Overcrowd -Overdraft -Overdrawn -Overdress -Overdrive -Overdue -Overeager -Overeater -Overexert -Overfed -Overfeed -Overfill -Overflow -Overfull -Overgrown -Overhand -Overhang -Overhaul -Overhead -Overhear -Overheard -Overheat -Overhung -Overjoyed -Overkill -Overlabor -Overlaid -Overland -Overlap -Overlaps -Overlay -Overload -Overlook -Overlooks -Overlord -Overly -Overlying -Overnight -Overpass -Overpay -Overplant -Overplay -Overpower -Overprice -Overrate -Overreach -Overreact -Override -Overripe -Overrule -Overrun -Oversaw -Overseas -Oversee -Overseen -Oversees -Overshoot -Overshot -Oversight -Oversized -Oversleep -Oversold -Overspend -Overstate -Overstay -Overstep -Overstock -Overstuff -Oversweet -Overtake -Overtaken -Overthrow -Overtime -Overtly -Overtone -Overtones -Overtook -Overture -Overturn -Overuse -Overvalue -Overview -Overwhelm -Overwrite -Owe -Owes -Owl -Ownership -Oxen -Oxford -Oxidant -Oxidation -Oxides -Oxidize -Oxidized -Oxidizing -Oxygen -Oxymoron -Oyster -Oysters -Ozone -Paced -Pacemaker -Pacific -Pacifier -Pacifism -Pacifist -Pacify -Pack -Package -Packaged -Packages -Packaging -Packed -Packer -Packers -Packet -Packets -Packing -Packs -Pad -Padded -Padding -Paddle -Paddling -Padlock -Padre -Padres -Pads -Pagan -Pageant -Pager -Pages -Paging -Pagoda -Pain -Painful -Painfully -Pains -Paint -Painted -Painter -Painters -Painting -Paintings -Paints -Paisley -Pajamas -Palace -Palaces -Palatable -Palazzo -Pale -Paler -Palette -Palladium -Palm -Palms -Palpable -Palpitate -Paltry -Pampered -Pamperer -Pampers -Pamphlet -Pamphlets -Panama -Pancake -Pancreas -Panda -Pandemic -Pane -Panel -Panels -Pang -Panhandle -Panic -Panning -Panorama -Panoramic -Pantheon -Panther -Panthers -Panting -Pantomime -Pantry -Pants -Pantyhose -Pap -Papa -Papacy -Papal -Paparazzi -Papaya -Paper -Paperback -Paperwork -Paprika -Papyrus -Par -Parables -Parabola -Parachute -Parade -Parades -Paradigm -Paradigms -Paradise -Paradox -Paradoxes -Paragraph -Parakeet -Paralegal -Parallax -Parallel -Parallels -Paralyses -Paralysis -Paralyze -Paramedic -Parameter -Paramount -Parapet -Parasail -Parasite -Parasites -Parasitic -Parcel -Parcels -Parched -Parchment -Pardon -Pardoned -Parental -Parenting -Parish -Parishes -Parity -Parka -Parking -Parkway -Parlor -Parmesan -Parochial -Parodies -Parody -Parole -Parrot -Parry -Pars -Parsley -Parsnip -Parson -Parsons -Partake -Parted -Partially -Particle -Particles -Parties -Parting -Partisan -Partisans -Partition -Partizan -Partly -Partner -Partnered -Partners -Partridge -Party -Passable -Passably -Passage -Passages -Passcode -Passenger -Passerby -Passes -Passing -Passion -Passions -Passive -Passively -Passivism -Passivity -Passover -Passport -Passports -Password -Passwords -Past -Pasta -Paste -Pasted -Pastel -Pastime -Pastor -Pastoral -Pastors -Pastrami -Pastry -Pasture -Pastures -Pasty -Patches -Patchwork -Patchy -Patent -Patented -Patents -Paternal -Paternity -Path -Pathetic -Pathogen -Pathogens -Pathology -Pathos -Paths -Pathway -Pathways -Patience -Patient -Patients -Patio -Patriarch -Patriot -Patriotic -Patriots -Patrol -Patrolled -Patrols -Patron -Patronage -Patronize -Patrons -Patsy -Patted -Pattern -Patterned -Patterns -Patty -Paucity -Pauper -Pause -Paused -Pauses -Pausing -Paved -Pavement -Paver -Pavestone -Pavilion -Pavilions -Paving -Paw -Pawing -Paws -Payable -Payback -Paycheck -Payday -Payee -Payer -Paying -Payload -Payment -Payments -Payoff -Payphone -Payroll -Pays -Pea -Peace -Peaceful -Peacetime -Peach -Peaches -Peacock -Peaked -Peanut -Peanuts -Pearl -Pearls -Peas -Peasant -Peasantry -Peasants -Pebble -Pebbles -Pebbly -Pecan -Pectin -Pectoral -Peculiar -Pecuniary -Pedagogy -Pedal -Peddling -Pedestal -Pediatric -Pedicure -Pedigree -Pedometer -Peek -Peel -Peeled -Peeling -Peep -Peer -Peerage -Peered -Peering -Peers -Peg -Pegboard -Pelican -Pellet -Pellets -Pelt -Pelvic -Pelvis -Penalize -Penalties -Penalty -Penance -Pence -Pencil -Pencils -Pendant -Pending -Pendulum -Penguin -Penguins -Penholder -Peninsula -Penknife -Pennant -Penned -Penniless -Penny -Penpal -Pension -Pentagon -Pentagram -Peoples -Pep -Pepper -Peppers -Perceive -Perceived -Perceives -Percent -Perch -Perched -Percolate -Perennial -Perfected -Perfectly -Perform -Performed -Performer -Performs -Perfume -Perhaps -Peril -Perilous -Perils -Perimeter -Period -Periodic -Periods -Periphery -Periscope -Perish -Perished -Perjurer -Perjury -Perkiness -Perky -Perm -Permanent -Permeable -Permeated -Permit -Permits -Permitted -Peroxide -Perpetual -Perplexed -Persecute -Persevere -Persist -Persisted -Persists -Persona -Personnel -Persons -Persuade -Persuaded -Persuader -Persuades -Pertain -Pertains -Pertinent -Pervasive -Pesky -Peso -Pesos -Pessimism -Pessimist -Pester -Pesticide -Pests -Petal -Petals -Petite -Petition -Petri -Petrol -Petroleum -Petted -Petticoat -Pettiness -Petty -Petunia -Pew -Phage -Phantom -Pharaoh -Pharmacy -Phase -Phased -Phases -Phenomena -Phenotype -Philology -Phobia -Phoebe -Phoenix -Phonebook -Phoned -Phonetic -Phoney -Phonics -Phoniness -Phonology -Phony -Phosphate -Photo -Photocopy -Photon -Photons -Photos -Phrase -Phrases -Phrasing -Physician -Physicist -Physique -Pianist -Piano -Pianos -Piazza -Pick -Picked -Picket -Picking -Picks -Pickup -Picnic -Pictorial -Picture -Pictured -Pictures -Pie -Piecemeal -Pieces -Pierce -Pierced -Piercing -Piers -Piety -Pig -Pigeon -Pigeons -Pigment -Pigments -Pigs -Pilasters -Piles -Pilgrim -Pilgrims -Pillars -Pillow -Pillows -Pilot -Piloted -Pilots -Pinch -Pinched -Pineapple -Pink -Pinnacle -Pinned -Pinpoint -Pint -Pinto -Pioneer -Pioneered -Pioneers -Pipe -Pipeline -Pipelines -Piper -Pipes -Piping -Pirate -Pirates -Piston -Pistons -Pitch -Pitched -Pitcher -Pitchers -Pitches -Pitchfork -Pitching -Pitfalls -Pitiful -Pits -Pitted -Pituitary -Pity -Pivot -Pivotal -Pixel -Pixels -Pizza -Placard -Placate -Placebo -Placidly -Plainly -Plaintiff -Plan -Planar -Planet -Planetary -Planets -Plank -Planks -Planned -Planner -Planners -Planning -Plans -Plant -Planter -Planters -Planting -Plaque -Plaques -Plasma -Plaster -Plastic -Plastics -Plateau -Plated -Platelet -Platelets -Platform -Platforms -Plating -Platinum -Platonic -Platoon -Platter -Platypus -Plausible -Plausibly -Playable -Playback -Played -Player -Players -Playful -Playgroup -Playhouse -Playing -Playlist -Playmaker -Playmate -Playoff -Playoffs -Playpen -Playroom -Plays -Playset -Plaything -Playtime -Plaza -Plea -Plead -Pleaded -Pleading -Pleas -Pleased -Pleases -Pleasing -Pleasure -Pleasures -Pleat -Pledge -Pledged -Pledges -Plenary -Plentiful -Plenty -Plethora -Plexiglas -Plexus -Pliable -Plight -Plod -Plop -Plot -Plots -Plotted -Plotting -Plow -Ploy -Pluck -Plucked -Plug -Plugged -Plugs -Plum -Plumage -Plumbing -Plume -Plump -Plunder -Plundered -Plunge -Plunged -Plunging -Plural -Pluralism -Plurality -Plus -Plutonium -Plywood -Pneumatic -Poach -Pocket -Pockets -Pod -Podcast -Podcasts -Podium -Pods -Poem -Poems -Poet -Poetic -Poetical -Poetry -Poets -Pogo -Poignant -Pointed -Pointer -Pointers -Pointing -Pointless -Pointy -Poise -Poised -Poison -Poked -Poker -Poking -Polar -Polarity -Polarized -Pole -Poles -Police -Policeman -Policemen -Policies -Policing -Policy -Polio -Polish -Polished -Polishing -Polite -Politely -Politic -Political -Politics -Polity -Polka -Poll -Polled -Pollen -Polling -Polls -Pollutant -Polluted -Pollution -Polo -Polyester -Polygon -Polygraph -Polymer -Polymeric -Polymers -Poncho -Pond -Ponder -Pondered -Pony -Pool -Pooled -Pooling -Pools -Poor -Poorer -Poorest -Poorly -Pop -Popcorn -Pope -Popes -Poplar -Popped -Popper -Popping -Poppy -Pops -Popsicle -Populace -Popular -Popularly -Populate -Populated -Populist -Populous -Porcelain -Porch -Porcupine -Pore -Pork -Porous -Porridge -Portable -Portage -Portal -Portals -Portfolio -Porthole -Portico -Portion -Portly -Portrait -Portraits -Portray -Portrayal -Portrayed -Portrays -Portside -Poser -Posh -Posing -Positive -Positron -Posse -Possess -Possessed -Possesses -Possessor -Possible -Possibly -Possum -Postage -Postal -Postbox -Postcard -Postcards -Posted -Poster -Posterior -Posterity -Posters -Posting -Postnasal -Postnatal -Postpone -Postponed -Postulate -Posture -Postures -Postwar -Potassium -Potato -Potatoes -Potency -Potential -Potter -Pottery -Pouch -Poultry -Pounce -Pouncing -Pound -Pour -Poured -Pouring -Pout -Poverty -Powdered -Powdering -Powders -Powdery -Power -Powerful -Powerless -Powers -Powwow -Pox -Practiced -Practices -Pragmatic -Prairie -Praise -Praised -Praises -Praising -Prance -Prancing -Pranker -Prankish -Prankster -Prayer -Prayers -Praying -Preach -Preached -Preacher -Preachers -Preaching -Preachy -Preamble -Precede -Preceded -Precedent -Precedes -Preceding -Precepts -Precinct -Precious -Precise -Precisely -Precision -Preclude -Precluded -Precludes -Precook -Precursor -Precut -Predator -Predators -Predatory -Predefine -Predicate -Predict -Predicted -Predictor -Predicts -Preface -Prefect -Prefer -Preferred -Prefers -Prefix -Prefixes -Preflight -Preformed -Pregame -Pregnancy -Pregnant -Preheat -Preheated -Prejudice -Prelate -Prelaunch -Prelaw -Prelude -Premier -Premiere -Premiered -Premieres -Premiers -Premise -Premises -Premium -Premiums -Prenatal -Preoccupy -Preorder -Prep -Prepaid -Prepare -Prepares -Preparing -Prepay -Preplan -Preppy -Prequel -Preschool -Prescribe -Preseason -Presence -Presenter -Presently -Preserve -Preserved -Preserves -Preset -Preshow -Presided -President -Presiding -Presoak -Press -Pressure -Pressured -Pressures -Prestige -Presume -Presumed -Presuming -Pretend -Pretended -Pretender -Pretense -Pretext -Pretty -Pretzel -Prevail -Prevailed -Prevails -Prevalent -Prevent -Prevented -Prevents -Preview -Previews -Previous -Prewar -Prewashed -Prey -Price -Priced -Prices -Pricing -Pride -Prideful -Pried -Priest -Priestly -Priests -Primacy -Primal -Primaries -Primarily -Primary -Primate -Primates -Prime -Primer -Primers -Priming -Primitive -Primp -Prince -Princely -Princes -Princess -Principal -Principle -Print -Printers -Printing -Prior -Priority -Priory -Prism -Prison -Prisoner -Prisoners -Prisons -Prissy -Pristine -Privacy -Private -Privateer -Privately -Privatize -Privilege -Privy -Prize -Prized -Prizes -Pro -Proactive -Probable -Probably -Probate -Probation -Probe -Probed -Probes -Probing -Probiotic -Problem -Problems -Procedure -Proceed -Proceeded -Proceeds -Process -Processed -Processes -Processor -Proclaim -Proclaims -Proctor -Procure -Procured -Prod -Prodigal -Prodigy -Produce -Producer -Producers -Product -Products -Profane -Profanity -Profess -Professed -Professor -Profile -Profiled -Profiles -Profiling -Profits -Profound -Profusely -Profusion -Progeny -Prognosis -Program -Programs -Progress -Prohibit -Prohibits -Project -Projected -Projector -Projects -Prolific -Prologue -Prolong -Prolonged -Prom -Promenade -Prominent -Promo -Promote -Promoted -Promoter -Promoters -Promotes -Promoting -Promotion -Prompt -Prompted -Prompter -Prompting -Promptly -Prompts -Prone -Prong -Pronoun -Pronounce -Pronouns -Pronto -Proof -Proofing -Proofread -Proofs -Prop -Propagate -Propelled -Propeller -Properly -Property -Prophecy -Prophet -Prophetic -Prophets -Proponent -Proposal -Proposals -Propose -Proposed -Proposes -Proposing -Propped -Propriety -Props -Prorate -Prose -Prosecute -Prospect -Prospects -Prosper -Prospered -Protect -Protector -Protects -Protegee -Protein -Proteins -Protest -Protested -Protests -Protocol -Protocols -Proton -Protons -Prototype -Protozoan -Protract -Protrude -Proud -Proudly -Provable -Proved -Proven -Proverb -Proverbs -Provide -Provided -Provider -Providers -Provides -Providing -Province -Provinces -Proving -Provision -Provoke -Provoked -Provoking -Provolone -Provost -Prowess -Prowler -Prowling -Proximity -Proxy -Prude -Prudence -Prudent -Prudishly -Prune -Pruning -Pry -Psalm -Psalms -Pseudo -Pseudonym -Psyche -Psychic -Pub -Public -Publicity -Publicly -Publish -Publisher -Publishes -Pubs -Puck -Pucker -Pudding -Pueblo -Puff -Pug -Pull -Pulled -Pulling -Pulls -Pulmonary -Pulp -Pulpit -Pulsate -Pulse -Pulverize -Puma -Pumice -Pummel -Pump -Pumped -Pumping -Pumpkin -Pumps -Punch -Punched -Punches -Punctual -Punctuate -Puncture -Punctured -Pungent -Punish -Punished -Punisher -Punishing -Punitive -Punk -Punt -Pupil -Pupils -Puppet -Puppets -Puppy -Purchase -Purchased -Purchaser -Purchases -Purebred -Purely -Pureness -Purest -Purgatory -Purge -Purging -Purified -Purifier -Purify -Purist -Puritan -Puritans -Purity -Purple -Purplish -Purported -Purpose -Purposely -Purposes -Purr -Purse -Pursuable -Pursuant -Pursue -Pursued -Pursues -Pursuing -Pursuit -Pursuits -Purveyor -Push -Pushcart -Pushchair -Pushed -Pusher -Pushes -Pushiness -Pushing -Pushover -Pushpin -Pushup -Pushy -Putative -Putdown -Putt -Putting -Puzzle -Puzzled -Puzzles -Puzzling -Pyramid -Pyramidal -Pyramids -Pyromania -Python -Quack -Quadrant -Quadratic -Quadruple -Quail -Quaint -Quaintly -Quake -Quaking -Qualified -Qualifier -Qualifies -Qualify -Quality -Qualm -Quantify -Quantity -Quantum -Quark -Quarrel -Quarrels -Quarries -Quarry -Quart -Quartered -Quarterly -Quarters -Quartet -Quartz -Quasi -Quay -Queen -Queens -Quench -Quenching -Queries -Query -Question -Questions -Queue -Quick -Quicken -Quicker -Quickly -Quickness -Quicksand -Quickstep -Quiet -Quietly -Quill -Quilt -Quintet -Quintuple -Quirk -Quit -Quite -Quitting -Quiver -Quivering -Quiz -Quizzical -Quorum -Quota -Quotable -Quotas -Quotation -Quote -Quoted -Quotes -Quotient -Quoting -Rabbis -Rabbit -Rabbits -Rabid -Race -Racehorse -Racers -Racetrack -Racing -Rack -Racoon -Radar -Radars -Radial -Radiance -Radiant -Radiantly -Radiated -Radiating -Radiation -Radiator -Radical -Radically -Radicals -Radio -Radiology -Radios -Radish -Radius -Raffle -Raft -Rage -Ragged -Raging -Rags -Ragweed -Raided -Raider -Raiders -Raiding -Raids -Railcar -Railing -Railroad -Railroads -Railway -Railways -Rainbow -Rainfall -Rainy -Raisin -Rake -Raking -Rallied -Rallies -Rally -Rallying -Ramble -Rambling -Ramp -Rampage -Rampant -Ramrod -Ranch -Rancidity -Random -Randomly -Ranged -Ranger -Ranging -Ranked -Ranking -Rankings -Ransack -Ransom -Ranting -Rants -Rapid -Rapidity -Rapidly -Rapids -Rapper -Rappers -Rapport -Rapture -Rare -Rarely -Rarity -Rascal -Rash -Rasping -Rat -Rather -Ratings -Ratio -Rationale -Rationing -Ratios -Rats -Rattle -Rattled -Rattling -Ravage -Ravaged -Raven -Ravens -Ravine -Raving -Ravioli -Ravishing -Rayon -Razed -Razor -Reabsorb -Reach -Reacquire -React -Reacted -Reacting -Reaction -Reactions -Reactive -Reactor -Reactors -Reacts -Readable -Reader -Readers -Readily -Readiness -Readings -Reaffirm -Reagent -Reagents -Realism -Realist -Realities -Reality -Realize -Realized -Realizes -Realizing -Realm -Realms -Ream -Reanalyze -Reap -Reappear -Reapply -Reappoint -Reapprove -Rear -Reared -Rearing -Rearrange -Rearview -Reason -Reasoned -Reasoning -Reasons -Reassign -Reassure -Reassured -Reattach -Reawake -Rebalance -Rebate -Rebel -Rebelled -Rebellion -Rebels -Rebirth -Reboot -Reborn -Rebound -Rebounds -Rebuff -Rebuild -Rebuilt -Rebuke -Reburial -Rebuttal -Recall -Recalled -Recalling -Recalls -Recant -Recapture -Recast -Recede -Receipt -Receipts -Receive -Received -Receiver -Receivers -Receives -Receiving -Recent -Recently -Reception -Receptive -Receptor -Receptors -Recess -Recessed -Recession -Recessive -Recharger -Recipe -Recipes -Recipient -Recital -Recitals -Recite -Recited -Reciting -Reckless -Reckon -Reckoned -Reckoning -Reclaim -Reclaimed -Recliner -Reclining -Recluse -Reclusive -Recognize -Recoil -Recollect -Recolor -Recommend -Reconcile -Reconfirm -Reconvene -Recopy -Record -Recorded -Recorder -Recorders -Recording -Records -Recount -Recounted -Recounts -Recoup -Recourse -Recover -Recovered -Recovers -Recovery -Recreate -Recreated -Recruit -Recruited -Recruits -Rectangle -Rectified -Rectify -Rector -Rectory -Recur -Recurrent -Recurring -Recursive -Recycle -Recycled -Recycler -Recycling -Reddish -Redeem -Redeemed -Redefine -Redesign -Redress -Reds -Reduce -Reduced -Reduces -Reducing -Reduction -Redundant -Redwood -Reef -Reefs -Reel -Reelected -Reemerge -Reenact -Reenter -Reentry -Reeve -Reexamine -Referable -Referee -Referees -Reference -Referral -Referrals -Refill -Refinance -Refine -Refined -Refinery -Refining -Refinish -Reflect -Reflected -Reflector -Reflects -Reflex -Reflexes -Reflexive -Reflux -Refocus -Refold -Reforest -Reform -Reformat -Reformed -Reformer -Reformers -Reforming -Reformist -Reforms -Refract -Refrain -Refreeze -Refresh -Refried -Refs -Refueling -Refuge -Refugee -Refugees -Refund -Refurbish -Refurnish -Refusal -Refuse -Refused -Refuses -Refusing -Refutable -Refute -Regain -Regained -Regaining -Regal -Regalia -Regally -Regard -Regarded -Regarding -Regards -Regatta -Regency -Regent -Regents -Reggae -Regime -Regimen -Regimens -Regiment -Regiments -Regimes -Region -Regional -Regions -Register -Registers -Registrar -Registry -Regress -Regret -Regretful -Regrets -Regretted -Regroup -Regular -Regulars -Regulate -Regulated -Regulates -Regulator -Rehab -Rehearsal -Rehearsed -Reheat -Rehire -Rehydrate -Reigned -Reigning -Reigns -Reimburse -Reindeer -Reinforce -Reins -Reissue -Reissued -Reiterate -Reject -Rejected -Rejecting -Rejection -Rejects -Rejoice -Rejoiced -Rejoicing -Rejoin -Rejoined -Rekindle -Relapse -Relapsing -Relatable -Related -Relating -Relation -Relative -Relatives -Relax -Relaxed -Relaxing -Relay -Relays -Relearn -Release -Releases -Releasing -Relegated -Relenting -Relevance -Reliable -Reliably -Reliance -Reliant -Relic -Relics -Relied -Relief -Reliefs -Relies -Relieve -Relieved -Relieving -Relight -Religion -Religions -Religious -Relish -Relive -Reload -Relocate -Relocated -Relock -Reluctant -Rely -Relying -Remade -Remain -Remainder -Remained -Remaining -Remains -Remake -Remark -Remarked -Remarking -Remarks -Remarried -Remarry -Rematch -Remedial -Remedies -Remedy -Remember -Remembers -Remind -Reminded -Reminder -Reminders -Remindful -Reminding -Reminds -Remission -Remix -Remnant -Remnants -Remodeled -Remodeler -Remold -Remorse -Remote -Remotely -Removable -Removal -Remove -Removed -Remover -Removes -Removing -Rename -Renamed -Renaming -Render -Rendered -Renderer -Rendering -Renders -Rendition -Renegade -Renew -Renewable -Renewably -Renewal -Renewed -Renewing -Renounce -Renounced -Renovate -Renovated -Renovator -Renown -Renowned -Rentable -Rental -Rentals -Rented -Renter -Reoccupy -Reoccur -Reopen -Reopened -Reopening -Reorder -Repackage -Repacking -Repaint -Repair -Repaired -Repairing -Repairs -Repave -Repay -Repaying -Repayment -Repeal -Repealed -Repeat -Repeated -Repeater -Repeating -Repeats -Repelled -Repent -Repertory -Rephrase -Replace -Replaced -Replaces -Replacing -Replay -Replete -Replica -Replicas -Replicate -Replied -Replies -Reply -Report -Reported -Reporter -Reporters -Reporting -Reports -Repose -Repossess -Repost -Represent -Repressed -Reprimand -Reprint -Reprinted -Reprints -Reprise -Reprising -Reproach -Reprocess -Reproduce -Reprogram -Reps -Reptile -Reptiles -Reptilian -Republic -Republics -Repugnant -Repulsed -Repulsion -Repulsive -Repurpose -Reputable -Reputably -Reputed -Request -Requested -Requests -Requiem -Require -Required -Requires -Requiring -Requisite -Reread -Reroute -Rerouted -Rerun -Reruns -Resale -Resample -Rescinded -Rescue -Rescued -Rescuer -Rescues -Rescuing -Reseal -Research -Reselect -Reseller -Resemble -Resembled -Resembles -Resend -Resent -Resentful -Reservoir -Reset -Resettled -Reshape -Reshoot -Reshuffle -Reside -Residence -Residency -Resident -Resides -Residual -Residuals -Residue -Residues -Resign -Resigned -Resigning -Resilient -Resin -Resins -Resist -Resistant -Resisted -Resisting -Resistor -Resistors -Resists -Resize -Resolute -Resolve -Resolved -Resolves -Resolving -Resonance -Resonant -Resonate -Resort -Resorted -Resorting -Resorts -Resource -Resources -Respect -Respected -Respects -Respite -Response -Responses -Restart -Restarted -Restless -Restore -Restored -Restoring -Restrain -Restraint -Restrict -Restricts -Resubmit -Result -Resultant -Resulted -Resulting -Results -Resume -Resumes -Resuming -Resupply -Resurface -Resurrect -Retail -Retailer -Retailers -Retailing -Retain -Retained -Retainer -Retaining -Retains -Retake -Retaliate -Retention -Rethink -Retina -Retinal -Retire -Retired -Retiree -Retiring -Retold -Retool -Retorted -Retouch -Retrace -Retract -Retracted -Retrain -Retread -Retreat -Retreated -Retreats -Retrial -Retrieval -Retrieve -Retrieved -Retriever -Retry -Return -Returned -Returning -Returns -Retying -Retype -Reunion -Reunite -Reunited -Reuniting -Reusable -Reuse -Reused -Revamped -Reveal -Revealed -Revealing -Reveals -Reveler -Revenge -Revenue -Revenues -Reverb -Revered -Reverence -Reverend -Reversal -Reverse -Reversed -Reverses -Reversing -Reversion -Revert -Reverted -Reviewed -Reviewer -Reviewers -Reviewing -Revisable -Revise -Revised -Revising -Revision -Revisions -Revisit -Revisited -Revivable -Revival -Revive -Revived -Reviver -Reviving -Revocable -Revoke -Revoked -Revolt -Revolts -Revolve -Revolver -Revolves -Revolving -Reward -Rewarded -Rewarding -Rewards -Rewash -Rewind -Rewire -Reword -Rework -Reworked -Rewrap -Rewrite -Rewriting -Rewritten -Rhetoric -Rheumatic -Rhino -Rhinos -Rhyme -Rhymes -Rhythm -Rhythmic -Rhythms -Ribbon -Ribbons -Ribcage -Ribs -Rice -Richer -Riches -Richest -Richly -Richness -Rickety -Ricotta -Riddance -Ridden -Riddle -Ride -Rider -Riders -Ridicule -Ridiculed -Riding -Rifling -Rift -Rigging -Righteous -Rights -Rigid -Rigidity -Rigidly -Rigor -Rigorous -Rimless -Rimmed -Rind -Rink -Rinse -Rinsing -Riot -Rioting -Ripcord -Ripeness -Ripening -Ripping -Ripple -Rippling -Riptide -Rise -Rising -Risk -Risked -Risking -Risks -Risky -Risotto -Ritual -Rituals -Ritzy -Rival -Rivalries -Rivalry -Riverbank -Riverbed -Riverboat -Riverside -Riveter -Riveting -Roadside -Roadway -Roadways -Roam -Roamer -Roaming -Roar -Roared -Roaring -Roast -Roasted -Rob -Robbed -Robber -Robbers -Robbery -Robbing -Robe -Robin -Robins -Robot -Robotic -Robotics -Robots -Robust -Rockband -Rocked -Rocker -Rocket -Rockets -Rockfish -Rockiness -Rocking -Rocklike -Rocks -Rockslide -Rockstar -Rocky -Rodent -Rodents -Rodeo -Rods -Roe -Rogue -Roles -Roller -Rollers -Rolls -Roman -Romance -Romances -Romantic -Romp -Rooftop -Rookie -Roommate -Rooster -Roosters -Root -Rooted -Roots -Rope -Ropes -Roping -Rosary -Rosemary -Roses -Roster -Rosters -Rosy -Rotary -Rotate -Rotated -Rotates -Rotating -Rotation -Rotations -Rotor -Rotten -Rotting -Rotunda -Rouge -Roughly -Roughness -Roulette -Rounding -Roundish -Roundness -Roundup -Roundworm -Roused -Route -Router -Routes -Routine -Routinely -Routines -Routing -Rover -Rovers -Roving -Royal -Royalist -Royalists -Royals -Royalties -Royalty -Rubbed -Rubber -Rubbing -Rubbish -Rubble -Rubdown -Rubles -Rubric -Ruby -Ruckus -Rudder -Rug -Rugby -Ruin -Ruined -Rule -Ruled -Ruler -Rulers -Rules -Ruling -Rulings -Rumble -Rumbling -Rummage -Rumor -Rumored -Rumors -Runaround -Runaway -Rundown -Runner -Runners -Running -Runny -Runoff -Runt -Runway -Runways -Rupees -Rupture -Ruptured -Rural -Ruse -Rush -Rust -Rustic -Rusty -Rut -Ruthless -Rye -Sabbath -Sabotage -Sack -Sacked -Sacking -Sacks -Sacrament -Sacred -Sacrifice -Sad -Sadden -Saddle -Saddlebag -Saddled -Saddling -Sadly -Sadness -Safari -Safeguard -Safehouse -Safely -Safeness -Safer -Safest -Safety -Saffron -Saga -Sage -Sagging -Saggy -Said -Sail -Sailed -Sailing -Sailor -Sailors -Sails -Saint -Saints -Saith -Sake -Salad -Salads -Salami -Salaried -Salaries -Salary -Sales -Salesman -Salience -Salient -Saline -Salinity -Saliva -Sally -Salmon -Salon -Saloon -Salsa -Salt -Salts -Salty -Salutary -Salute -Salvage -Salvaged -Salvaging -Salvation -Samba -Same -Sample -Sampled -Samples -Sampling -Samurai -Sanction -Sanctions -Sanctity -Sanctuary -Sand -Sandal -Sandals -Sandbag -Sandbank -Sandbar -Sandblast -Sandbox -Sanded -Sanders -Sandfish -Sanding -Sandlot -Sandpaper -Sandpit -Sands -Sandstone -Sandstorm -Sandwich -Sandworm -Sandy -Sang -Sanitary -Sanitizer -Sank -Sans -Santa -Sap -Sapling -Sapphire -Sappiness -Sappy -Sarcasm -Sarcastic -Sardine -Sash -Sasquatch -Sassy -Sat -Satchel -Satellite -Satiable -Satin -Satire -Satirical -Satisfied -Satisfies -Satisfy -Saturate -Saturday -Sauce -Saucepan -Sauciness -Saucy -Sauna -Sausage -Savage -Savanna -Savannah -Save -Saved -Saves -Saving -Savings -Savior -Savor -Sawmill -Sawyer -Sax -Saxophone -Say -Saying -Sayings -Scabbed -Scabby -Scalar -Scalded -Scalding -Scale -Scaled -Scales -Scaling -Scallion -Scallop -Scalp -Scalping -Scam -Scan -Scandal -Scandals -Scanned -Scanner -Scanning -Scans -Scant -Scapegoat -Scar -Scarce -Scarcely -Scarcity -Scare -Scarecrow -Scared -Scarf -Scarily -Scariness -Scarlet -Scarred -Scarring -Scars -Scary -Scatter -Scattered -Scavenger -Scenario -Scenarios -Scenery -Scenes -Scenic -Scented -Schedule -Schedules -Schema -Schematic -Scheme -Schemes -Scheming -Schilling -Schism -Schnapps -Scholar -Scholarly -Scholars -School -Schoolboy -Schooling -Schools -Schooner -Science -Sciences -Scientist -Scion -Scissors -Scoff -Scolding -Scone -Scoop -Scooter -Scope -Scorch -Scorebook -Scorecard -Scored -Scoreless -Scorer -Scorers -Scoring -Scorn -Scorpion -Scotch -Scoundrel -Scoured -Scouring -Scout -Scouting -Scouts -Scowling -Scrabble -Scraggly -Scramble -Scrambled -Scrambler -Scrap -Scrape -Scraped -Scraping -Scrapped -Scrapping -Scraps -Scratch -Scratched -Scrawny -Scream -Screamed -Screaming -Screams -Screen -Screened -Screening -Screens -Screw -Screws -Scribble -Scribe -Scribing -Scrimmage -Script -Scripted -Scripture -Scroll -Scrolls -Scrooge -Scrounger -Scrub -Scrubbed -Scrubber -Scruffy -Scrunch -Scrutiny -Scuba -Scuff -Sculls -Sculpted -Sculptor -Sculptors -Sculpture -Scurvy -Scuttle -Sea -Seaboard -Seafood -Seal -Sealed -Sealing -Seals -Seam -Seaman -Seamen -Seams -Seaplane -Seaport -Sears -Seaside -Season -Seasonal -Seasoned -Seasons -Seat -Seated -Seating -Seats -Secession -Secluded -Secluding -Seclusion -Second -Secondary -Seconded -Secondly -Seconds -Secrecy -Secret -Secretary -Secrete -Secreted -Secretion -Secretly -Secrets -Sectarian -Sectional -Sector -Sectors -Secular -Secured -Securely -Securing -Security -Sedan -Sedate -Sedation -Sedative -Sedentary -Sedge -Sediment -Sediments -Seed -Seeded -Seeding -Seedlings -Seeds -Seek -Seeker -Seekers -Seeking -Seeks -Seem -Seemed -Seeming -Seemingly -Seems -Seer -Segment -Segmented -Segments -Seismic -Seize -Seized -Seizing -Seldom -Select -Selected -Selecting -Selection -Selective -Selector -Selects -Selenium -Self -Selfish -Sell -Sellers -Selling -Sells -Seltzer -Semantic -Semantics -Semester -Semi -Semicolon -Semifinal -Seminar -Seminars -Seminary -Semiotics -Semisoft -Semisweet -Senate -Senator -Senators -Send -Sender -Sending -Sends -Senior -Seniority -Seniors -Senorita -Sensation -Sensed -Senseless -Senses -Sensible -Sensing -Sensitive -Sensitize -Sensor -Sensors -Sensory -Sentence -Sentenced -Sentences -Sentiment -Sentinel -Sepals -Separate -Separated -Separates -Sepia -Septa -September -Septic -Septum -Sequel -Sequels -Sequence -Sequester -Serene -Serenity -Serge -Sergeant -Serial -Serials -Series -Serious -Seriously -Sermon -Sermons -Serotonin -Serpent -Serrated -Serum -Servant -Servants -Serve -Service -Serviced -Services -Servicing -Serving -Servings -Sesame -Sessions -Setback -Setbacks -Setting -Settings -Settle -Settler -Settlers -Settles -Settling -Setup -Seven -Sevenfold -Sevens -Seventeen -Seventh -Seventies -Seventy -Several -Severe -Severed -Severely -Severity -Sew -Sewage -Sewer -Sewing -Sewn -Shabby -Shack -Shade -Shaded -Shades -Shadily -Shadiness -Shading -Shadow -Shadows -Shadowy -Shady -Shaft -Shafts -Shakable -Shake -Shaken -Shaker -Shakes -Shakily -Shakiness -Shaking -Shaky -Shale -Shall -Shallot -Shallow -Shalt -Sham -Shaman -Shame -Shameful -Shampoo -Shamrock -Shanghai -Shank -Shanty -Shape -Shaped -Shapes -Shaping -Share -Shared -Shares -Sharing -Shark -Sharks -Sharp -Sharpened -Sharpener -Sharper -Sharpie -Sharply -Sharpness -Shattered -Shave -Shaved -Shaving -Shawl -Shear -Shearing -Sheath -Shed -Shedding -Sheds -Sheen -Sheep -Sheer -Sheet -Sheets -Shelf -Shell -Shellfish -Shelling -Shells -Shelter -Sheltered -Shelters -Shelve -Shelved -Shelves -Shelving -Shepherd -Shepherds -Sheriff -Sherry -Shield -Shielded -Shielding -Shields -Shifted -Shifter -Shifting -Shiftless -Shifts -Shifty -Shillings -Shimmer -Shimmy -Shin -Shindig -Shine -Shines -Shingle -Shininess -Shining -Shiny -Ship -Shipment -Shipments -Shipped -Shipping -Shipwreck -Shipyard -Shipyards -Shire -Shirt -Shirts -Shiver -Shivered -Shivering -Shoals -Shock -Shocked -Shocking -Shocks -Shoemaker -Shoes -Shone -Shook -Shootout -Shoots -Shoplift -Shopper -Shoppers -Shopping -Shoptalk -Shore -Shoreline -Shores -Short -Shortage -Shortages -Shortcake -Shortcut -Shorten -Shortened -Shorter -Shortest -Shorthand -Shortlist -Shortly -Shortness -Shorts -Shortstop -Shortwave -Shorty -Shots -Shoulder -Shoulders -Shout -Shouted -Shouting -Shouts -Shove -Shoved -Shovel -Show -Showbiz -Showcase -Showcased -Showcases -Showdown -Showed -Shower -Showers -Showgirl -Showing -Showman -Shown -Showoff -Showpiece -Showplace -Showroom -Shows -Showy -Shrank -Shrapnel -Shredded -Shredder -Shredding -Shrew -Shrewd -Shrewdly -Shriek -Shrill -Shrimp -Shrine -Shrines -Shrink -Shrinkage -Shrinking -Shrivel -Shrouded -Shrub -Shrubbery -Shrubs -Shrug -Shrugged -Shrunk -Shucking -Shudder -Shuddered -Shuffle -Shuffled -Shuffling -Shun -Shunt -Shush -Shut -Shutdown -Shutout -Shutouts -Shutter -Shutters -Shutting -Shuttle -Shy -Siamese -Siberian -Sibling -Siblings -Sick -Sickle -Sickly -Sickness -Sideline -Sidelined -Sidewalk -Sideways -Siding -Sidings -Siege -Sierra -Siesta -Sieve -Sift -Sigh -Sighed -Sighing -Sighs -Sighted -Sighting -Sightings -Sigma -Signal -Signaled -Signaling -Signals -Signature -Signified -Signifies -Signify -Signings -Silence -Silenced -Silencer -Silent -Silently -Silica -Silicate -Silicon -Silicone -Silk -Sill -Silliness -Silly -Silo -Silt -Silver -Similar -Similarly -Simile -Simmer -Simmering -Simple -Simpler -Simplest -Simplex -Simplify -Simply -Sims -Simulate -Simulated -Simulator -Simulcast -Since -Sincere -Sincerely -Sincerity -Sinful -Singer -Singers -Singing -Single -Singled -Singles -Singleton -Singly -Singular -Sinister -Sink -Sinking -Sinks -Sinless -Sinner -Sinners -Sinuous -Sinus -Sinuses -Sip -Sipped -Sipping -Sir -Siren -Sister -Sisters -Sitcom -Sitter -Sitting -Situated -Situation -Six -Sixfold -Sixteen -Sixteenth -Sixth -Sixties -Sixtieth -Sixty -Sixtyfold -Sizable -Sizably -Size -Sizeable -Sized -Sizes -Sizing -Sizzle -Sizzling -Skate -Skater -Skaters -Skating -Skedaddle -Skeletal -Skeleton -Skeletons -Skeptic -Skeptical -Sketch -Sketched -Sketches -Skewed -Skewer -Ski -Skid -Skied -Skier -Skies -Skiing -Skill -Skilled -Skillet -Skillful -Skills -Skim -Skimmed -Skimmer -Skimming -Skimpily -Skin -Skincare -Skinless -Skinned -Skinning -Skinny -Skins -Skintight -Skip -Skipped -Skipper -Skipping -Skirmish -Skirt -Skittle -Skull -Skulls -Sky -Skydiver -Skylight -Skyline -Skype -Skyrocket -Skyward -Slab -Slabs -Slack -Slacked -Slacker -Slacking -Slackness -Slacks -Slam -Slammed -Slander -Slang -Slant -Slap -Slapped -Slapping -Slapstick -Slash -Slashed -Slashing -Slate -Slather -Slaw -Slayer -Sled -Sleek -Sleep -Sleeper -Sleeping -Sleeps -Sleepy -Sleet -Sleeve -Sleeves -Slender -Slept -Slice -Sliceable -Sliced -Slicer -Slices -Slicing -Slick -Slid -Slider -Slideshow -Sliding -Slight -Slighted -Slightest -Slighting -Slightly -Slim -Slimness -Slimy -Sling -Slinging -Slingshot -Slinky -Slip -Slipped -Slippers -Slippery -Slipping -Slips -Slit -Sliver -Slobbery -Slogan -Slogans -Sloop -Slope -Sloped -Sloping -Sloppily -Sloppy -Slot -Slots -Slouching -Slouchy -Slough -Slow -Slowed -Slower -Slowing -Slowly -Slows -Sludge -Slug -Sluggish -Slum -Slump -Slumped -Slums -Slung -Slurp -Slush -Sly -Small -Smaller -Smallest -Smart -Smartly -Smartness -Smash -Smashed -Smasher -Smashing -Smashup -Smear -Smell -Smelled -Smelling -Smells -Smelting -Smile -Smiled -Smiles -Smiling -Smilingly -Smirk -Smite -Smith -Smitten -Smock -Smog -Smoke -Smoked -Smokeless -Smokers -Smokiness -Smoking -Smoky -Smolder -Smooth -Smoothed -Smoothing -Smoothly -Smother -Smudge -Smudgy -Smuggled -Smuggler -Smuggling -Smugly -Smugness -Snack -Snacks -Snagged -Snail -Snails -Snake -Snakes -Snaking -Snap -Snapped -Snapping -Snapshot -Snare -Snarl -Snatched -Snazzy -Sneak -Sneer -Sneeze -Sneezing -Snide -Sniff -Sniffed -Snippet -Snipping -Snitch -Snooker -Snooper -Snooze -Snore -Snoring -Snorkel -Snort -Snorted -Snout -Snow -Snowbird -Snowboard -Snowbound -Snowcap -Snowdrift -Snowdrop -Snowfall -Snowfield -Snowflake -Snowiness -Snowless -Snowman -Snowplow -Snowshoe -Snowstorm -Snowsuit -Snowy -Snub -Snuff -Snuggle -Snugly -Snugness -Soak -Soaked -Soaking -Soap -Soared -Soaring -Sob -Sobbing -Sober -Sobs -Soccer -Social -Socially -Societal -Societies -Society -Sociology -Socket -Sockets -Socks -Sod -Soda -Sodium -Sofa -Soft -Softball -Soften -Softened -Softening -Softer -Softly -Softness -Software -Soil -Soils -Sojourn -Solace -Solar -Sold -Solder -Soldier -Soldiers -Solely -Solemn -Solemnly -Solicit -Solicited -Solicitor -Solid -Solidly -Solids -Solitary -Solitude -Solo -Soloist -Soloists -Solos -Solvent -Solvents -Somber -Somebody -Someday -Somehow -Someone -Something -Sometime -Sometimes -Somewhat -Somewhere -Sonar -Sonata -Song -Songs -Sonnet -Sonnets -Sonny -Sooner -Soot -Soothe -Soothing -Sophomore -Soprano -Sore -Sores -Sorghum -Sorority -Sorrow -Sorrows -Sorry -Sorties -Sought -Soul -Souls -Sounded -Sounding -Sounds -Soup -Sour -Sourced -South -Southeast -Southern -Southward -Southwest -Souvenir -Sovereign -Soviet -Soviets -Sow -Sowing -Sown -Soy -Soybean -Spa -Spaced -Spaces -Spaceship -Spacing -Spacious -Spade -Spaghetti -Spanned -Spanning -Spans -Spare -Spared -Sparing -Spark -Sparked -Sparkling -Sparks -Sparrow -Sparse -Sparsely -Spartan -Spasm -Spat -Spatial -Spatially -Spawn -Spawned -Spawning -Speak -Speaker -Speakers -Speaking -Speaks -Spear -Spearfish -Spearhead -Spearman -Spearmint -Spears -Spec -Special -Specials -Specialty -Species -Specific -Specifics -Specifies -Specify -Specimen -Specimens -Specked -Speckled -Specks -Spectacle -Spectator -Spectra -Spectral -Spectrum -Speculate -Speech -Speeches -Speed -Speedily -Speeding -Speeds -Speedway -Speedy -Spell -Spellbind -Spelled -Speller -Spelling -Spellings -Spells -Spelt -Spend -Spendable -Spender -Spending -Spends -Spent -Spew -Sphere -Spheres -Spherical -Sphinx -Spicy -Spider -Spiders -Spied -Spies -Spiffy -Spike -Spikes -Spill -Spilled -Spilling -Spills -Spilt -Spin -Spinach -Spinal -Spindle -Spine -Spines -Spinner -Spinning -Spinout -Spins -Spinster -Spiny -Spiral -Spirit -Spirited -Spiritism -Spirits -Spiritual -Spit -Spitfire -Splash -Splashed -Splashing -Splashy -Splatter -Spleen -Splendid -Splendor -Splice -Splicing -Splinter -Split -Splits -Splitting -Splotchy -Splurge -Spoil -Spoilage -Spoiled -Spoiler -Spoiling -Spoils -Spoke -Spoken -Spokesman -Sponge -Spongy -Sponsor -Sponsored -Sponsors -Spoof -Spookily -Spooky -Spool -Spoon -Sporadic -Spore -Spores -Sporting -Sports -Sportsman -Sporty -Spot -Spotless -Spotlight -Spots -Spotted -Spotter -Spotting -Spotty -Spousal -Spouse -Spouses -Spout -Sprain -Sprang -Sprawl -Sprawling -Spray -Sprayed -Spraying -Spreading -Spreads -Spree -Sprig -Spring -Springing -Springs -Sprinkle -Sprinkled -Sprinkler -Sprint -Sprinter -Sprite -Sprout -Spruce -Sprung -Spry -Spud -Spun -Spur -Spurious -Spurred -Spurs -Sputter -Spy -Spyglass -Squabble -Squad -Squadron -Squadrons -Squads -Squall -Squander -Square -Squared -Squarely -Squares -Squash -Squat -Squatted -Squatter -Squatting -Squeak -Squealer -Squealing -Squeamish -Squeegee -Squeeze -Squeezed -Squeezing -Squid -Squiggle -Squiggly -Squint -Squire -Squirrel -Squirrels -Squirt -Squishier -Squishy -Stability -Stabilize -Stable -Stables -Stack -Stacked -Stacking -Stacks -Stadium -Stadiums -Staff -Staffed -Staffing -Staffs -Stage -Staged -Staggered -Staging -Stagnant -Stagnate -Stainable -Stained -Staining -Stainless -Stains -Stair -Staircase -Stairway -Stale -Stalemate -Staleness -Stalk -Stalks -Stalling -Stallion -Stalls -Stamens -Stamina -Stammer -Stamp -Stamped -Stampede -Stamping -Stamps -Stand -Standard -Standards -Standby -Standout -Stank -Stanza -Stanzas -Staple -Staples -Stapling -Starboard -Starch -Stardom -Stardust -Stare -Stared -Stares -Starfish -Stargazer -Staring -Stark -Starless -Starlet -Starlight -Starlit -Starred -Starring -Starry -Stars -Starship -Starter -Starters -Starting -Startle -Startled -Startling -Starts -Startup -Starve -Starved -Starving -Stash -Stat -State -Statehood -Stately -Statesman -Statesmen -Statewide -Static -Stating -Stationed -Statistic -Stats -Statue -Statues -Stature -Status -Statute -Statutes -Statutory -Staunch -Stayed -Staying -Stays -Steadfast -Steadier -Steadily -Steadying -Steak -Steal -Stealing -Steals -Stealth -Steam -Steamboat -Steamed -Steamer -Steamers -Steaming -Steamship -Steed -Steel -Steels -Steep -Steeply -Steer -Steerable -Steered -Steering -Steersman -Stegosaur -Stein -Stellar -Stem -Stemmed -Stemming -Stench -Stencil -Stent -Step -Steppe -Stepped -Stepping -Stereo -Sterile -Sterility -Sterilize -Sterling -Sternly -Sternness -Sternum -Stew -Steward -Stick -Sticking -Sticks -Sticky -Stiff -Stiffen -Stiffened -Stiffly -Stiffness -Stifle -Stifling -Stigma -Still -Stillness -Stills -Stilt -Stimulant -Stimulate -Stimuli -Stimulus -Stinger -Stingily -Stinging -Stingray -Stingy -Stinking -Stinky -Stint -Stints -Stipend -Stipulate -Stir -Stirred -Stirring -Stitch -Stitches -Stock -Stocked -Stocking -Stockings -Stocks -Stoic -Stoke -Stokes -Stole -Stolen -Stomach -Stomp -Stonewall -Stoneware -Stonework -Stoning -Stony -Stood -Stooge -Stool -Stools -Stoop -Stoplight -Stoppable -Stoppage -Stopped -Stopper -Stopping -Stops -Stopwatch -Storable -Storage -Storeroom -Stores -Storewide -Stories -Storm -Stormed -Stormy -Stout -Stove -Stowaway -Stowing -Straddle -Straggler -Straight -Strained -Strainer -Straining -Strains -Strait -Straits -Strand -Stranded -Strands -Strange -Strangely -Stranger -Strangers -Strap -Strapped -Straps -Strata -Strategic -Strategy -Stratum -Stratus -Straw -Stray -Streak -Streaks -Stream -Streamed -Streaming -Streams -Street -Streetcar -Streets -Strength -Strengths -Strenuous -Strep -Stress -Stressed -Stresses -Stressful -Stressing -Stretch -Stretches -Strewn -Stricken -Strict -Stricter -Strictly -Stride -Strides -Strife -Strike -Striker -Strikers -Strikes -Striking -Stringent -Strings -Stripe -Striped -Stripes -Stripped -Stripping -Strips -Strive -Strives -Striving -Strobe -Strode -Stroked -Strokes -Stroll -Strolled -Stroller -Strong -Strongbox -Stronger -Strongest -Strongly -Strongman -Strove -Struck -Structure -Strudel -Struggle -Struggled -Struggles -Strum -Strung -Strut -Stubbed -Stubble -Stubbly -Stubborn -Stucco -Stuck -Stud -Student -Students -Studied -Studies -Studio -Studios -Study -Studying -Stuff -Stuffed -Stuffing -Stuffy -Stumble -Stumbled -Stumbling -Stump -Stung -Stunned -Stunner -Stunning -Stunt -Stunts -Stupor -Sturdily -Sturdy -Sturgeon -Styled -Styling -Stylishly -Stylist -Stylistic -Stylized -Stylus -Suave -Sub -Subarctic -Subatomic -Subdivide -Subdued -Subduing -Subfloor -Subgroup -Subgroups -Subheader -Subject -Subjected -Subjects -Sublease -Sublet -Sublevel -Sublime -Submarine -Submerge -Submerged -Submersed -Submit -Submitted -Submitter -Subpanel -Subpar -Subplot -Subprime -Subscribe -Subscript -Subsector -Subset -Subsets -Subside -Subsided -Subsidies -Subsiding -Subsidize -Subsidy -Subsoil -Subsonic -Substance -Substrate -Subsumed -Subsystem -Subtext -Subtitle -Subtitled -Subtitles -Subtle -Subtlety -Subtly -Subtotal -Subtract -Subtype -Suburb -Suburban -Suburbs -Subway -Subwoofer -Subzero -Succeed -Succeeded -Succeeds -Success -Successes -Successor -Succulent -Succumb -Succumbed -Such -Sucrose -Suction -Sudden -Suddenly -Sudoku -Suds -Suffer -Suffered -Sufferer -Suffering -Suffers -Suffice -Suffix -Suffixes -Suffragan -Suffrage -Sugar -Sugarcane -Sugars -Suggest -Suggested -Suggests -Suing -Suitable -Suitably -Suitcase -Suite -Suited -Suites -Suitor -Sulfate -Sulfide -Sulfite -Sulfur -Sulk -Sullen -Sulphate -Sulphuric -Sultan -Sultanate -Sultry -Sum -Summaries -Summarize -Summary -Summed -Summers -Summing -Summit -Summits -Summon -Summoned -Summons -Sumo -Sums -Sun -Sundry -Sunflower -Sung -Sunk -Sunken -Sunlight -Sunny -Sunrise -Suns -Sunset -Sunshine -Sup -Super -Superb -Superbowl -Superglue -Superhero -Superior -Superiors -Superjet -Superman -Supermom -Supernova -Superstar -Supervise -Supine -Supper -Supplied -Supplier -Suppliers -Supplies -Supply -Supplying -Support -Supported -Supporter -Supports -Suppose -Supposed -Supposing -Suppress -Supreme -Surcharge -Surely -Sureness -Surf -Surface -Surfaced -Surfaces -Surfacing -Surfboard -Surfer -Surfing -Surge -Surgeon -Surgeons -Surgeries -Surgery -Surgical -Surging -Surname -Surnames -Surpass -Surpassed -Surplus -Surpluses -Surprise -Surprised -Surprises -Surreal -Surrender -Surrey -Surrogate -Surround -Surrounds -Survey -Surveyed -Surveying -Surveyor -Surveys -Survival -Survive -Survived -Survives -Surviving -Survivor -Survivors -Sushi -Suspect -Suspected -Suspects -Suspend -Suspended -Suspense -Suspicion -Sustain -Sustained -Sustainer -Sustains -Suture -Sutures -Swab -Swaddling -Swagger -Swallow -Swallowed -Swam -Swamp -Swampland -Swamps -Swan -Swans -Swap -Swapped -Swapping -Swarm -Sway -Swayed -Swaying -Swear -Swearing -Sweat -Sweater -Sweating -Sweep -Sweeping -Sweeps -Sweet -Sweetly -Sweets -Swell -Swelled -Swelling -Swept -Swerve -Swift -Swifter -Swiftly -Swiftness -Swim -Swimmable -Swimmer -Swimmers -Swimming -Swimsuit -Swimwear -Swine -Swing -Swinging -Swings -Swipe -Swirl -Swirling -Switch -Switched -Switches -Switching -Swivel -Swizzle -Swollen -Swooned -Swoop -Swoosh -Sword -Swords -Swore -Sworn -Swung -Sycamore -Syllable -Syllables -Syllabus -Symbiotic -Symbol -Symbolic -Symbolism -Symbolize -Symbols -Sympathy -Symphonic -Symphony -Symposium -Symptom -Symptoms -Synagogue -Synapse -Synapses -Sync -Syndicate -Syndrome -Syndromes -Synergy -Synod -Synonym -Synonyms -Synopses -Synopsis -Syntactic -Syntax -Synthesis -Synthetic -Syringe -Syrup -System -Systemic -T-shirt -Tabasco -Tabby -Tableful -Tables -Tablet -Tablets -Tableware -Tabloid -Taboos -Tabs -Tabulated -Tacit -Tackiness -Tacking -Tackle -Tackled -Tackles -Tackling -Tacky -Taco -Tactful -Tactic -Tactical -Tactics -Tactile -Tactless -Tadpole -Taekwondo -Tag -Tagged -Tags -Tailor -Tailored -Tainted -Take -Takeoff -Takeover -Taking -Talcum -Talent -Talented -Talents -Tales -Talisman -Talked -Talking -Tall -Taller -Tallest -Talon -Tamale -Tame -Tameness -Tamer -Tamper -Tandem -Tangent -Tangle -Tango -Tank -Tanker -Tankers -Tanks -Tanned -Tanner -Tannery -Tanning -Tantrum -Tap -Taped -Tapeless -Taper -Tapered -Tapering -Tapes -Tapestry -Tapioca -Tapped -Tapping -Taps -Tarantula -Target -Targeted -Targeting -Targets -Tariff -Tariffs -Tarmac -Tarnish -Tarot -Tartar -Tartly -Tartness -Task -Tasked -Tasks -Tassel -Taste -Tasted -Tastes -Tastiness -Tasting -Tasty -Tattered -Tattle -Tattling -Tattoo -Taught -Taunt -Taut -Tavern -Tax -Taxable -Taxation -Taxed -Taxes -Taxi -Taxing -Taxis -Taxonomic -Taxonomy -Taxpayer -Taxpayers -Tea -Teach -Teachers -Teaches -Teaching -Teachings -Teammate -Teammates -Teams -Teamwork -Tear -Tearing -Tears -Tease -Teased -Teaser -Teasing -Teaspoon -Teaspoons -Technical -Technique -Techno -Tedious -Teenage -Teenager -Teenagers -Teens -Teeth -Telegram -Telegraph -Telephone -Telescope -Televised -Telex -Tell -Telling -Tells -Temp -Temper -Temperate -Tempered -Tempest -Templates -Temple -Temples -Tempo -Temporal -Temps -Tendency -Tenderly -Tendon -Tendons -Tenets -Tennis -Tenor -Tens -Tensile -Tensor -Tentacles -Tentative -Tenth -Tenuous -Tenure -Term -Termed -Terminal -Terminals -Terminus -Terms -Terrace -Terraces -Terrain -Terrible -Terribly -Terrific -Terrified -Territory -Terry -Tertiary -Testament -Testified -Testifies -Testify -Testimony -Textbook -Textbooks -Textile -Textiles -Texture -Textured -Textures -Thank -Thanked -Thankful -Thanking -Thanks -That -Thatcher -Thaw -Theater -Theaters -Theatrics -Thee -Theft -Thematic -Theme -Themes -Thence -Theology -Theorem -Theorems -Theoretic -Theories -Theorist -Theorists -Theorize -Theorized -Theory -Therapies -Therapist -Therein -Thereupon -Thermal -Thermos -Thesaurus -These -Theses -Thesis -Thespian -Thick -Thicken -Thickened -Thicker -Thicket -Thickly -Thickness -Thief -Thieves -Thieving -Thievish -Thigh -Thighs -Thimble -Thin -Thing -Things -Think -Thinker -Thinkers -Thinks -Thinly -Thinner -Thinness -Thinning -Third -Thirdly -Thirds -Thirst -Thirstily -Thirsting -Thirsty -Thirteen -Thirties -Thirty -Thistle -Thorn -Thorns -Thorough -Those -Thought -Thoughts -Thousand -Thousands -Thrash -Thread -Threaded -Threads -Threat -Threaten -Threatens -Threats -Three -Threefold -Threshold -Threw -Thrift -Thrill -Thrilled -Thriller -Thrilling -Thrive -Thriving -Throat -Throats -Throne -Throng -Throttle -Throwaway -Throwback -Thrower -Throwing -Throws -Thud -Thumb -Thumbs -Thumping -Thunder -Thursday -Thus -Thwarted -Thwarting -Thyroid -Thyself -Tiara -Tibia -Ticket -Tickets -Tidal -Tidbit -Tide -Tides -Tidiness -Tidings -Tidy -Tie -Tier -Tiers -Tiger -Tigers -Tight -Tighten -Tightened -Tighter -Tightly -Tightness -Tightrope -Tightwad -Tigress -Tile -Tiling -Till -Tilt -Tilted -Tilting -Timber -Timbers -Timed -Timeless -Timeline -Timely -Timer -Timers -Timetable -Timid -Timing -Timothy -Tinderbox -Tinfoil -Tingle -Tingling -Tingly -Tinker -Tinkling -Tinsel -Tinsmith -Tint -Tinwork -Tiny -Tip -Tipoff -Tipped -Tipper -Tipping -Tiptoeing -Tiptop -Tires -Tiring -Tissue -Tissues -Titan -Titanic -Titanium -Titans -Title -Titular -Toad -Toast -Tobacco -Today -Toddler -Toddlers -Toe -Toes -Toil -Toilet -Toilets -Token -Tokens -Told -Tolerant -Tolerate -Tolerated -Tolls -Tomato -Tomatoes -Tomorrow -Tonal -Tong -Tongue -Tongues -Tonic -Tonight -Tonnage -Toolbar -Tooth -Topic -Topical -Topics -Topology -Torch -Torment -Tormented -Torn -Tornado -Tornadoes -Torpedo -Torpedoed -Torpedoes -Torque -Torrent -Torsion -Torso -Tort -Tortoise -Torts -Toss -Tossed -Tossing -Tot -Total -Totaled -Totaling -Totality -Totalling -Totally -Totals -Touch -Touchdown -Touches -Touching -Tough -Tougher -Toughness -Toured -Touring -Tourism -Tourist -Tourists -Touted -Toward -Towards -Towel -Towels -Tower -Towering -Towers -Towing -Towns -Township -Townships -Toxic -Toxicity -Toxin -Toxins -Toy -Toys -Trace -Traced -Tracer -Traces -Trachea -Tracing -Track -Tracked -Tracking -Traction -Tractor -Trade -Traded -Trademark -Trader -Traders -Trades -Trading -Tradition -Traffic -Tragedies -Tragedy -Tragic -Trail -Trailed -Trailer -Trailers -Trailing -Trails -Trailside -Train -Trainee -Trainees -Trainer -Trainers -Traitor -Traitors -Tram -Trams -Trance -Tranquil -Transcend -Transept -Transfer -Transfers -Transform -Transient -Transit -Translate -Transmit -Transmits -Transpire -Transport -Transpose -Trapdoor -Trapeze -Trapezoid -Trapped -Trapper -Trapping -Traps -Trash -Trauma -Traumatic -Travail -Travel -Traveled -Traveler -Travelers -Traveling -Travels -Traverse -Traversed -Traverses -Travesty -Tray -Treachery -Tread -Treading -Treadmill -Treason -Treasure -Treasurer -Treasures -Treasury -Treat -Treaties -Treatise -Treatises -Treatment -Treaty -Treble -Tree -Trees -Trek -Trekker -Tremble -Trembled -Trembling -Tremor -Trench -Trenches -Trend -Trends -Trespass -Triad -Triage -Trial -Trials -Triangle -Triangles -Triathlon -Tribal -Tribe -Tribes -Tribesman -Tribunal -Tribunals -Tribune -Tributary -Tribute -Triceps -Trick -Trickery -Trickily -Tricking -Trickle -Tricks -Trickster -Tricky -Tricolor -Tricycle -Trident -Tried -Trifle -Trifocals -Trigger -Triggered -Triggers -Trillion -Trilogy -Trim -Trimester -Trimmed -Trimmer -Trimming -Trimness -Trinity -Trio -Triple -Triples -Triplet -Tripod -Tripping -Triumph -Triumphs -Trivia -Trivial -Trodden -Trolley -Trolling -Trombone -Troop -Troopers -Troops -Trophies -Trophy -Tropical -Tropics -Trot -Trouble -Troubled -Troubles -Troubling -Trough -Troupe -Trousers -Trout -Trowel -Truce -Truck -Trucks -Truffle -Truly -Trump -Trumpet -Trumpeter -Trumpets -Truncated -Trunk -Trunks -Truss -Trust -Trustable -Trustee -Trustees -Trustful -Trusting -Trustless -Trusts -Truth -Truthful -Truths -Try -Trying -Tsar -Tsunami -Tub -Tubby -Tube -Tubeless -Tubes -Tubing -Tubular -Tucked -Tucker -Tucking -Tuesday -Tufts -Tug -Tugged -Tuition -Tulip -Tumble -Tumbling -Tummy -Tuna -Tundra -Tune -Tunes -Tungsten -Tunic -Tuning -Tunnel -Tunneling -Tunnels -Turban -Turbine -Turbines -Turbofan -Turbojet -Turbulent -Turf -Turkey -Turmoil -Turner -Turnout -Turnover -Turnpike -Turret -Turrets -Turtle -Turtles -Tusk -Tutelage -Tutor -Tutorial -Tutoring -Tutors -Tutu -Tux -Tweak -Tweed -Tweet -Tweeted -Tweezers -Twelfth -Twelve -Twenties -Twentieth -Twenty -Twerp -Twice -Twiddle -Twiddling -Twig -Twigs -Twilight -Twin -Twine -Twinned -Twins -Twirl -Twist -Twistable -Twisted -Twister -Twisting -Twists -Twisty -Twitch -Twitter -Twofold -Tycoon -Tying -Tyke -Typeface -Typhoon -Typically -Tyranny -Tyrant -Udder -Ulcer -Ulcers -Ultimate -Ultimatum -Ultra -Umbilical -Umbrella -Umpire -Umpires -Unabashed -Unable -Unadorned -Unadvised -Unafraid -Unaired -Unaligned -Unaltered -Unanimity -Unanimous -Unarmed -Unarmored -Unashamed -Unaudited -Unawake -Unaware -Unbaked -Unbalance -Unbeaten -Unbend -Unbent -Unbiased -Unbitten -Unblended -Unblessed -Unblock -Unbolted -Unbounded -Unboxed -Unbraided -Unbridle -Unbroken -Unbuckled -Unbundle -Unburned -Unbutton -Uncanny -Uncapped -Uncaring -Uncertain -Unchain -Unchanged -Uncharted -Uncheck -Uncivil -Unclad -Unclaimed -Unclamped -Unclasp -Uncle -Unclean -Unclear -Uncles -Unclip -Uncloak -Unclog -Unclothed -Uncoated -Uncoiled -Uncolored -Uncombed -Uncommon -Uncooked -Uncork -Uncorrupt -Uncounted -Uncouple -Uncouth -Uncover -Uncovered -Uncross -Uncrown -Uncrushed -Uncured -Uncurious -Uncurled -Uncut -Undamaged -Undated -Undaunted -Undead -Undecided -Undefined -Underarm -Undercoat -Undercook -Undercut -Underdog -Underdone -Underfed -Underfeed -Underfoot -Undergo -Undergoes -Undergone -Undergrad -Underhand -Underlie -Underlies -Underline -Underling -Undermine -Undermost -Underpaid -Underpass -Underpay -Underrate -Underside -Undertake -Undertone -Undertook -Undertow -Underuse -Underwear -Underwent -Underwire -Undesired -Undiluted -Undivided -Undo -Undocked -Undoing -Undone -Undrafted -Undress -Undrilled -Undue -Unduly -Undusted -Undying -Unearned -Unearth -Unearthed -Unease -Uneasily -Uneasy -Uneatable -Uneaten -Unedited -Unelected -Unending -Unengaged -Unenvied -Unequal -Unethical -Uneven -Unexpired -Unexposed -Unfailing -Unfair -Unfairly -Unfasten -Unfazed -Unfeeling -Unfiled -Unfilled -Unfit -Unfitted -Unfitting -Unfixable -Unfixed -Unflawed -Unfocused -Unfold -Unfolded -Unfolding -Unfolds -Unfounded -Unframed -Unfreeze -Unfrosted -Unfrozen -Unfunded -Unglazed -Ungloved -Unglue -Ungodly -Ungraded -Ungreased -Unguarded -Unguided -Unhappily -Unhappy -Unharmed -Unhealthy -Unheard -Unhearing -Unheated -Unhelpful -Unhidden -Unhinge -Unhitched -Unholy -Unhook -Unicorn -Unicycle -Unified -Unifier -Uniform -Uniformed -Uniformly -Uniforms -Unify -Unifying -Unimpeded -Uninjured -Uninstall -Uninsured -Uninvited -Union -Unions -Unique -Uniquely -Unisexual -Unison -Unissued -Unit -Unitary -Unites -Units -Universal -Universe -Unjust -Unjustly -Unkempt -Unkind -Unknotted -Unknowing -Unknown -Unlaced -Unlatch -Unlawful -Unleaded -Unlearned -Unleash -Unleashed -Unless -Unleveled -Unlighted -Unlikable -Unlike -Unlikely -Unlimited -Unlined -Unlinked -Unlisted -Unlit -Unlivable -Unloaded -Unloader -Unloading -Unlock -Unlocked -Unlocking -Unlovable -Unloved -Unlovely -Unloving -Unluckily -Unlucky -Unmade -Unmanaged -Unmanned -Unmapped -Unmarked -Unmarried -Unmasked -Unmasking -Unmatched -Unmindful -Unmixable -Unmixed -Unmolded -Unmoral -Unmovable -Unmoved -Unmoving -Unnamable -Unnamed -Unnatural -Unneeded -Unnerve -Unnerving -Unnoticed -Unopened -Unopposed -Unpack -Unpadded -Unpaid -Unpainted -Unpaired -Unpaved -Unpeeled -Unpicked -Unpiloted -Unpinned -Unplanned -Unplanted -Unpleased -Unpledged -Unplowed -Unplug -Unpopular -Unproven -Unquote -Unranked -Unrated -Unraveled -Unreached -Unread -Unreal -Unreeling -Unrefined -Unrelated -Unrented -Unrest -Unretired -Unrevised -Unrigged -Unripe -Unrivaled -Unroasted -Unrobed -Unroll -Unruffled -Unruly -Unrushed -Unsaddle -Unsafe -Unsaid -Unsalted -Unsaved -Unsavory -Unscathed -Unscented -Unscrew -Unsealed -Unseated -Unsecured -Unseeing -Unseemly -Unseen -Unselect -Unselfish -Unsent -Unsettled -Unshackle -Unshaken -Unshaved -Unshaven -Unsheathe -Unshipped -Unsightly -Unsigned -Unskilled -Unsliced -Unsmooth -Unsnap -Unsocial -Unsoiled -Unsold -Unsolved -Unsorted -Unspoiled -Unspoken -Unstable -Unstaffed -Unstamped -Unsteady -Unsterile -Unstirred -Unstitch -Unstopped -Unstuck -Unstuffed -Unstylish -Unsubtle -Unsubtly -Unsuited -Unsure -Unsworn -Untagged -Untainted -Untaken -Untamed -Untangled -Untapped -Untaxed -Untenable -Unthawed -Unthread -Untidy -Untie -Until -Untimed -Untimely -Untitled -Untoasted -Untold -Untouched -Untracked -Untrained -Untreated -Untried -Untrimmed -Untrue -Untruth -Unturned -Untwist -Untying -Unusable -Unused -Unusual -Unusually -Unvalued -Unvaried -Unvarying -Unveiled -Unveiling -Unvented -Unviable -Unvisited -Unvocal -Unwanted -Unwarlike -Unwary -Unwashed -Unwatched -Unweave -Unwed -Unwelcome -Unwell -Unwieldy -Unwilling -Unwind -Unwired -Unwise -Unwitting -Unwomanly -Unworldly -Unworn -Unworried -Unworthy -Unwound -Unwoven -Unwrapped -Unwritten -Unzip -Upbeat -Upchuck -Upcoming -Upcountry -Update -Updated -Updates -Updating -Upfront -Upgrade -Upgraded -Upgrades -Upgrading -Upheaval -Upheld -Uphill -Uphold -Upholding -Upkeep -Upland -Uplands -Uplift -Uplifted -Uplifting -Upload -Uploaded -Upon -Upper -Uppermost -Upright -Uprising -Uprisings -Upriver -Uproar -Uproot -Upscale -Upset -Upsetting -Upside -Upstage -Upstairs -Upstart -Upstate -Upstream -Upstroke -Upswing -Uptake -Uptight -Uptown -Upturned -Upward -Upwards -Upwind -Uranium -Urban -Urchin -Urea -Urethane -Urged -Urgency -Urgent -Urgently -Urges -Urging -Urologist -Urology -Usability -Usable -Usage -Usages -Useable -Used -Useful -Usefully -Useless -Uselessly -User -Usher -Ushered -Usual -Utensil -Utensils -Utilities -Utility -Utilize -Utilized -Utilizes -Utilizing -Utmost -Utopia -Utopian -Utter -Utterance -Utterly -Vacancies -Vacancy -Vacant -Vacate -Vacated -Vacation -Vacations -Vaccine -Vaccines -Vacuum -Vagabond -Vagrancy -Vagrantly -Vague -Vaguely -Vagueness -Vain -Valentine -Valiant -Valid -Validate -Validated -Validity -Valley -Valleys -Valor -Valuables -Value -Valued -Values -Valuing -Valve -Valves -Vampire -Vampires -Van -Vandalism -Vandals -Vanguard -Vanilla -Vanish -Vanished -Vanishes -Vanishing -Vanity -Vanquish -Vans -Vantage -Vapor -Vaporizer -Variable -Variables -Variably -Variance -Variances -Variants -Variation -Varied -Varieties -Variety -Various -Variously -Varmint -Varnish -Varsity -Varying -Vascular -Vase -Vaseline -Vases -Vassal -Vassals -Vast -Vastly -Vastness -Vat -Vault -Vaulted -Vaults -Veal -Vector -Vectors -Vegan -Vegetable -Veggie -Vehicle -Vehicles -Vehicular -Veil -Vein -Veins -Velcro -Velocity -Velvet -Vendetta -Vending -Vendor -Vendors -Veneer -Veneering -Venerable -Venerated -Vengeance -Vengeful -Venom -Venomous -Venous -Ventral -Ventricle -Venture -Ventured -Venue -Venus -Verbal -Verbalize -Verbally -Verbatim -Verbose -Verdict -Verified -Verify -Verifying -Veritable -Versatile -Verse -Version -Versus -Vertebrae -Vertebral -Vertex -Vertical -Vertices -Vertigo -Very -Vessel -Vessels -Vest -Veteran -Veterans -Veto -Vetoed -Vexingly -Via -Viability -Viable -Viaduct -Vibe -Vibes -Vibrant -Vibrating -Vibration -Vicar -Vicarious -Vice -Viceroy -Vicinity -Vicious -Victim -Victims -Victor -Victories -Victory -Video -Videos -Videotape -Viewable -Viewer -Viewing -Viewless -Viewpoint -Vigil -Vigilance -Vigilant -Vigor -Vigorous -Vile -Villa -Village -Villagers -Villages -Villain -Villains -Villas -Vindicate -Vinegar -Vines -Vineyard -Vineyards -Vintage -Vinyl -Viola -Violate -Violated -Violates -Violating -Violation -Violator -Violet -Violin -Violinist -Violins -Viper -Viral -Virtual -Virtually -Virtue -Virtues -Virtuous -Virulent -Virus -Viruses -Visa -Visas -Visceral -Viscosity -Viscount -Viscous -Viselike -Visible -Visibly -Vision -Visionary -Visit -Visiting -Visitor -Visitors -Visits -Visor -Vista -Visual -Visualize -Visually -Visuals -Vital -Vitality -Vitalize -Vitally -Vitamin -Vitamins -Vivacious -Vivid -Vividly -Vividness -Vixen -Vocal -Vocalist -Vocalists -Vocalize -Vocally -Vocals -Vocation -Vodka -Vogue -Voice -Voiced -Voices -Voicing -Void -Volatile -Volcanic -Volcano -Volcanoes -Volition -Volley -Vols -Voltage -Voltages -Volume -Volumes -Volunteer -Vortex -Voter -Voters -Votes -Voting -Voucher -Vow -Vowed -Vowel -Vowels -Vows -Voyage -Voyager -Voyages -Vulture -Wackiness -Wad -Wade -Wafer -Waffle -Waged -Wager -Wages -Waggle -Wagon -Wagons -Wailing -Waist -Waiter -Waitress -Waived -Waiver -Waivers -Wake -Wakes -Waking -Waldo -Wales -Walk -Walked -Walker -Walkers -Walking -Walks -Walkway -Walled -Wallet -Wallpaper -Walls -Walmart -Walnut -Walrus -Waltz -Wand -Wander -Wandered -Wanderers -Wandering -Waning -Wannabe -Wanted -Wanting -Wants -Warbler -Warden -Wardrobe -Warehouse -Wares -Warfare -Warlord -Warmed -Warmer -Warming -Warmly -Warmth -Warn -Warned -Warning -Warnings -Warns -Warp -Warrant -Warrants -Warranty -Warren -Warring -Warrior -Warriors -Wars -Warship -Warships -Wartime -Wary -Wasabi -Wash -Washable -Washbasin -Washboard -Washbowl -Washcloth -Washday -Washed -Washer -Washes -Washhouse -Washing -Washout -Washroom -Washstand -Washtub -Wasp -Wasps -Waste -Wasted -Wasteful -Wastes -Wasting -Watch -Watched -Watches -Watchful -Watching -Water -Watered -Waterfall -Watering -Watershed -Waterway -Waterways -Watery -Watt -Watts -Wave -Waved -Waveform -Waves -Waviness -Waving -Wavy -Wax -Weak -Weaken -Weakened -Weakening -Weaker -Weakest -Weakly -Weakness -Wealthy -Weariness -Wears -Weary -Weather -Weathered -Weave -Weaver -Weavers -Weaving -Web -Webs -Website -Websites -Wedding -Weddings -Wedge -Weeds -Week -Weekday -Weekdays -Weekend -Weekends -Weekly -Weeks -Weighed -Weighing -Weighs -Weighted -Weighting -Weights -Weird -Welcomed -Welcoming -Weld -Welded -Welding -Welfare -Welsh -Welt -Westbound -Westward -Westwards -Wet -Wetland -Wetlands -Wettest -Wetting -Whacking -Whacky -Whale -Whalers -Whales -Whaling -Wham -Wharf -Whatever -Wheat -Wheel -Wheelbase -Wheeled -Wheeler -Wheels -Whence -Whenever -Whereas -Wherefore -Wherein -Whereupon -Wherever -Whether -Whichever -Whiff -Whilst -Whim -Whimsical -Whinny -Whiny -Whip -Whipped -Whipping -Whirled -Whirling -Whiskey -Whisking -Whisper -Whispered -Whispers -Whistle -Whistler -Whistling -White -Whiteness -Whither -Whiting -Whitish -Whoever -Whole -Wholeness -Wholesale -Wholesome -Wholly -Whomever -Whoopee -Whooping -Whoops -Whorl -Why -Wick -Wicked -Wicket -Wickets -Widely -Widen -Widened -Widening -Wider -Widest -Widget -Widow -Widowed -Widows -Width -Widths -Wieldable -Wielder -Wife -Wifi -Wig -Wight -Wikipedia -Wild -Wildcard -Wildcat -Wildcats -Wilder -Wildfire -Wildfowl -Wildland -Wildlife -Wildly -Wildness -Willed -Willful -Willfully -Willing -Willingly -Willow -Willpower -Wills -Wilt -Wimp -Wince -Wincing -Wind -Winding -Windmill -Window -Windows -Winds -Windy -Winery -Wines -Wing -Winged -Winger -Wingspan -Wink -Winked -Winking -Winner -Winners -Winning -Winnings -Winter -Winters -Wipe -Wiped -Wiping -Wire -Wired -Wireless -Wires -Wiring -Wiry -Wisdom -Wise -Wisely -Wiser -Wish -Wished -Wishes -Wishing -Wisplike -Wispy -Wistful -Wit -Withdraw -Withdrawn -Withdrew -Withered -Withheld -Withhold -Withstand -Witnessed -Witnesses -Wits -Witty -Wizard -Wizards -Wobble -Wobbling -Wobbly -Woe -Wok -Wolf -Wolverine -Wolves -Womanhood -Womankind -Womanless -Womanlike -Womanly -Womb -Women -Won -Wonder -Wondered -Wonderful -Wondering -Wonders -Wondrous -Woo -Wooded -Wooden -Woodland -Woodlands -Woods -Woof -Wooing -Wool -Woozy -Word -Wording -Work -Workable -Workbook -Worker -Workflow -Workforce -Workings -Workload -Workman -Workmen -Workout -Workplace -Worksheet -Workshop -Workshops -Worldly -Worlds -Worldwide -Worm -Worms -Worried -Worrier -Worries -Worrisome -Worry -Worrying -Worse -Worsened -Worsening -Worship -Worshiper -Worst -Worth -Worthless -Wound -Wounded -Wounding -Wounds -Woven -Wow -Wrangle -Wrap -Wrapped -Wrapping -Wrath -Wreath -Wreckage -Wrecked -Wrecker -Wrecking -Wren -Wrench -Wrestle -Wrestled -Wrestler -Wrestlers -Wrestling -Wretched -Wriggle -Wriggly -Wrinkle -Wrinkled -Wrinkles -Wrinkly -Wrist -Wrists -Writ -Writes -Writing -Writings -Written -Wrong -Wrongdoer -Wronged -Wrongful -Wrongly -Wrongness -Wrongs -Wrote -Wrought -Xbox -Xerox -Yacht -Yachts -Yahoo -Yam -Yanked -Yanking -Yapping -Yard -Yarn -Yeah -Year -Yearbook -Yearling -Yearly -Yearning -Years -Yeast -Yell -Yelled -Yelling -Yellow -Yellowish -Yelp -Yen -Yesterday -Yet -Yiddish -Yield -Yielded -Yielding -Yields -Yin -Yippee -Yo-yo -Yodel -Yoga -Yogurt -Yoke -Yolk -Yonder -Young -Younger -Youngest -Youngster -Youth -Youthful -Youths -Yoyo -Yummy -Zap -Zeal -Zealous -Zebra -Zen -Zenith -Zeppelin -Zero -Zeros -Zestfully -Zesty -Zeta -Zigzagged -Zinc -Zip -Zipfile -Zipping -Zippy -Zips -Zit -Zodiac -Zombie -Zombies -Zone -Zoned -Zones -Zoning -Zoo -Zookeeper -Zoologist -Zoology +Abacus +Abandon +Abandoned +Abatement +Abbey +Abbot +Abdomen +Abdominal +Abide +Abiding +Ability +Ablaze +Able +Abnormal +Abode +Abolish +Abolished +Abolition +Abound +Above +Abrasion +Abrasive +Abreast +Abridge +Abroad +Abrupt +Abruptly +Absence +Absent +Absentee +Absently +Absinthe +Absolute +Absolve +Absorb +Absorbed +Absorbing +Absorbs +Abstain +Abstract +Abstracts +Absurd +Absurdity +Abundance +Abundant +Abyss +Acacia +Academia +Academic +Academics +Academies +Academy +Accent +Accents +Accept +Accepted +Accepting +Accepts +Access +Accessed +Accessing +Accession +Accessory +Accident +Accidents +Acclaim +Acclaimed +Acclimate +Accolades +Accompany +Accord +Accorded +According +Accordion +Accords +Account +Accounted +Accounts +Accretion +Accrual +Accrue +Accrued +Accuracy +Accurate +Accuse +Accused +Accuses +Accusing +Accustom +Acetate +Acetic +Acetone +Achieve +Achieved +Achieves +Achieving +Achiness +Aching +Acid +Acidic +Acidity +Acids +Acne +Acorn +Acoustic +Acquaint +Acquire +Acquired +Acquires +Acquiring +Acquitted +Acre +Acreage +Acrobat +Acronym +Across +Acrylic +Acting +Action +Activate +Activates +Activator +Active +Actively +Activism +Activist +Activists +Activity +Actress +Actresses +Acts +Actuality +Actually +Acuity +Acute +Acutely +Acuteness +Adamant +Adapt +Adaptable +Adapted +Adapter +Adapting +Adaptive +Add +Adding +Addition +Additions +Additive +Additives +Address +Addressed +Addresses +Adds +Adept +Adhere +Adhered +Adherence +Adherents +Adhering +Adhesion +Adhesive +Adjacent +Adjective +Adjoining +Adjunct +Adjust +Adjusted +Adjusting +Admin +Admirable +Admirably +Admiral +Admirals +Admiralty +Admire +Admired +Admirer +Admirers +Admiring +Admission +Admit +Admits +Admitted +Admitting +Adobe +Adopt +Adopted +Adopting +Adoption +Adoptive +Adopts +Adoration +Adored +Adorned +Adrenal +Adult +Adulthood +Adults +Advance +Advanced +Advances +Advancing +Advantage +Advent +Adventure +Adverb +Adverbs +Adversary +Adverse +Adversely +Adversity +Advertise +Advice +Advisable +Advise +Advised +Adviser +Advisers +Advises +Advising +Advisory +Advocacy +Advocate +Advocated +Advocates +Aegis +Aeration +Aerial +Aerobics +Aerosol +Aerospace +Afar +Affair +Affairs +Affect +Affected +Affecting +Affection +Affects +Affidavit +Affiliate +Affinity +Affirm +Affirming +Affirms +Affix +Afflicted +Affluence +Affluent +Afford +Afforded +Affords +Affront +Afghan +Aflame +Afloat +Aflutter +Afoot +Afraid +Afterglow +Afterlife +Aftermath +Aftermost +Afternoon +Afterward +Again +Against +Aged +Ageless +Agencies +Agency +Agenda +Agendas +Agent +Aggregate +Aghast +Agile +Agility +Aging +Agitated +Agitation +Agnostic +Agonize +Agonizing +Agony +Agrarian +Agree +Agreeable +Agreeably +Agreed +Agreeing +Agreement +Agrees +Aground +Ahead +Ahoy +Aide +Aides +Ailments +Aim +Aimed +Aiming +Aims +Airborne +Aircraft +Airfield +Airfields +Airlift +Airline +Airlines +Airmen +Airplane +Airplanes +Airport +Airports +Airship +Airspace +Airstrip +Airways +Aisle +Aisles +Ajar +Akin +Alabaster +Alarm +Alarmed +Alarming +Alarms +Alas +Albatross +Albeit +Album +Albumin +Albums +Alchemy +Alcohol +Alcoholic +Alder +Alderman +Aldermen +Alert +Alerted +Alfalfa +Algae +Algebra +Algebraic +Algebras +Algorithm +Alias +Alibi +Alien +Alienable +Alienate +Alienated +Aliens +Align +Aligned +Alignment +Alike +Alive +Alkali +Alkaline +Alkalize +Alleged +Allegedly +Alleging +Allegory +Allergic +Allergies +Allergy +Alleviate +Alliance +Alliances +Alligator +Allocate +Allocated +Allotment +Allotted +Allowable +Allowance +Allowed +Allowing +Allows +Alloy +Alloys +Alluded +Alludes +Allusion +Allusions +Alluvial +Almanac +Almighty +Almond +Almost +Aloe +Aloft +Aloha +Alone +Along +Alongside +Aloof +Aloud +Alpha +Alphabet +Alpine +Already +Alright +Altar +Altars +Alter +Altered +Altering +Alternate +Alters +Although +Altitude +Altitudes +Alto +Altruism +Aluminum +Alumni +Always +Amalgam +Amaretto +Amassed +Amateur +Amateurs +Amaze +Amazed +Amazement +Amazing +Amazingly +Amazon +Amber +Ambiance +Ambient +Ambiguity +Ambiguous +Ambition +Ambitions +Ambitious +Ambulance +Ambush +Ambushed +Amenable +Amend +Amendable +Amended +Amending +Amendment +Amends +Amenities +Amenity +Amiable +Amicably +Amid +Amidst +Amigo +Amino +Amiss +Ammonia +Ammonium +Amnesia +Amnesty +Amniotic +Among +Amongst +Amorphous +Amount +Amounted +Amounting +Amounts +Amperage +Ample +Amplified +Amplifier +Amplify +Amplitude +Amply +Amuck +Amulet +Amusable +Amuse +Amused +Amusement +Amuser +Amusing +Anaconda +Anaerobic +Anagram +Analog +Analogies +Analogous +Analogy +Analysis +Analyst +Analysts +Analytic +Analyze +Analyzed +Analyzer +Analyzes +Analyzing +Anarchy +Anatomic +Anatomist +Anatomy +Ancestor +Ancestors +Ancestral +Ancestry +Anchor +Anchorage +Anchored +Anchors +Anchovy +Ancient +Ancients +Ancillary +Androgen +Android +Anecdotal +Anecdote +Anecdotes +Anemia +Anemic +Aneurism +Anew +Angelfish +Angelic +Angels +Anger +Angled +Angler +Angles +Angling +Angrily +Angriness +Angry +Anguish +Anguished +Angular +Animal +Animals +Animate +Animated +Animating +Animation +Animator +Anime +Animosity +Anion +Ankle +Ankles +Annals +Annealing +Annex +Annexed +Annotate +Annotated +Announce +Announced +Announcer +Announces +Annoyance +Annoyed +Annoying +Annual +Annually +Annuity +Annulled +Anode +Anointed +Anointer +Anomalies +Anomalous +Anomaly +Anonymity +Anonymous +Another +Answer +Answering +Answers +Antacid +Antarctic +Ante +Anteater +Antelope +Antenna +Antennae +Antennas +Anterior +Anthem +Anthill +Anthology +Antibody +Antics +Antidote +Antigen +Antigens +Antihero +Antique +Antiquely +Antiques +Antiquity +Antirust +Antitoxic +Antitrust +Antiviral +Antivirus +Antler +Antonym +Antsy +Anvil +Anxieties +Anxiety +Anxious +Anxiously +Anybody +Anyhow +Anymore +Anyone +Anyplace +Anything +Anytime +Anyway +Anywhere +Aorta +Apache +Apart +Apartment +Apathy +Aperture +Apex +Apologies +Apologize +Apology +Apostle +Apostles +App +Appalled +Appalling +Apparatus +Apparel +Apparent +Appeal +Appealed +Appealing +Appeals +Appear +Appearing +Appears +Appease +Appeasing +Appellant +Appellate +Appendage +Appended +Appendix +Appetite +Appetites +Appetizer +Applaud +Applauded +Applause +Apple +Apples +Appliance +Applicant +Applied +Applies +Apply +Applying +Appoint +Appointed +Appointee +Appoints +Appraisal +Appraiser +Apprehend +Approach +Approval +Approve +Approved +Approving +Apps +Apricot +April +Apron +Aptitude +Aptly +Aqua +Aquarium +Aquatic +Aquatics +Aqueduct +Aquifer +Arbitrary +Arbitrate +Arboretum +Arc +Arcade +Arcades +Archaic +Archangel +Archduke +Archer +Archers +Archery +Archetype +Architect +Archive +Archived +Archives +Arcs +Ardent +Ardently +Arduous +Area +Areas +Arena +Arenas +Argon +Arguable +Arguably +Argue +Argued +Argues +Arguing +Argument +Arguments +Argyle +Arid +Arise +Arisen +Arises +Arising +Armada +Armadillo +Armament +Armaments +Armband +Armchair +Armed +Armful +Armhole +Armies +Arming +Armistice +Armless +Armoire +Armor +Armored +Armory +Armrest +Army +Aroma +Aromatic +Arose +Around +Arrange +Arranged +Arranger +Arranges +Arranging +Array +Arrays +Arrears +Arrest +Arrested +Arresting +Arrests +Arrival +Arrivals +Arrive +Arrived +Arrives +Arriving +Arrogance +Arrogant +Arroyo +Arsenal +Art +Arteries +Artery +Arthritis +Artifact +Artifacts +Artillery +Artist +Artistic +Artistry +Artists +Artwork +Artworks +Asbestos +Ascend +Ascended +Ascending +Ascension +Ascent +Ascertain +Ascetic +Ascribe +Ascribed +Ashamed +Ashen +Ashes +Ashore +Ashy +Aside +Askew +Asleep +Asparagus +Aspect +Aspects +Aspen +Asphalt +Aspirate +Aspire +Aspirin +Aspiring +Assay +Assays +Assemble +Assembled +Assembly +Assent +Assert +Asserted +Asserting +Assertion +Assertive +Asserts +Assess +Assessed +Assesses +Assessing +Asset +Assets +Assign +Assigning +Assigns +Assistant +Assisted +Assisting +Assists +Associate +Assorted +Assume +Assumed +Assumes +Assuming +Assuredly +Assures +Asteroid +Asteroids +Asthma +Astonish +Astound +Astray +Astride +Astrology +Astronaut +Astronomy +Astute +Asymmetry +Athlete +Athletes +Athletic +Athletics +Atlantic +Atlas +Atoll +Atom +Atoms +Atonable +Atonement +Atop +Atrium +Atrocious +Atrophy +Attach +Attached +Attaching +Attacked +Attacker +Attackers +Attacking +Attacks +Attain +Attained +Attaining +Attains +Attempt +Attempted +Attempts +Attend +Attendant +Attended +Attendee +Attending +Attends +Attention +Attentive +Attest +Attested +Attic +Attire +Attitude +Attitudes +Attorney +Attorneys +Attract +Attracted +Attractor +Attracts +Attribute +Attrition +Attuned +Atypical +Auburn +Auction +Auctioned +Auctions +Audacious +Audacity +Audible +Audibly +Audience +Audiences +Audio +Audit +Auditing +Audition +Auditions +Auditor +Auditors +Auditory +Audits +Augment +Augmented +August +Aura +Auspices +Austere +Austerity +Authentic +Author +Authored +Authority +Authorize +Authors +Auto +Autograph +Automaker +Automated +Automatic +Autonomy +Autopilot +Autumn +Auxiliary +Avail +Available +Avalanche +Avatar +Avenge +Avengers +Avenging +Avenue +Avenues +Average +Averaged +Averages +Averaging +Averse +Aversion +Avert +Averted +Avian +Aviation +Aviator +Avid +Avoid +Avoidance +Avoided +Avoiding +Avoids +Await +Awaited +Awaiting +Awaits +Awake +Awaken +Awakened +Awakening +Awakens +Award +Awarded +Awarding +Awards +Aware +Awareness +Awe +Awesome +Awfully +Awhile +Awkward +Awkwardly +Awning +Awoke +Awry +Axe +Axial +Axiom +Axioms +Axis +Axle +Axles +Axon +Axons +Aye +Azure +Babble +Babbling +Babied +Babies +Baboon +Baby +Bachelor +Backache +Backboard +Backbone +Backboned +Backdrop +Backed +Backer +Backfield +Backfire +Backhand +Backing +Backlands +Backlash +Backless +Backlight +Backlit +Backlog +Backpack +Backpedal +Backrest +Backroom +Backshift +Backside +Backslid +Backspace +Backspin +Backstab +Backstage +Backstory +Backtalk +Backtrack +Backup +Backward +Backwards +Backwash +Backwater +Backyard +Bacon +Bacteria +Bacterial +Bacterium +Bad +Bade +Badge +Badger +Badgers +Badges +Badland +Badly +Badminton +Badness +Baffle +Baffled +Baffling +Bag +Bagel +Bagful +Baggage +Bagged +Baggie +Bagginess +Bagging +Baggy +Bagpipe +Bags +Baguette +Bail +Bait +Bake +Baked +Baker +Bakery +Bakeshop +Baking +Balance +Balancing +Balcony +Bald +Bales +Ballad +Ballads +Ballast +Ballet +Ballets +Ballistic +Balloon +Balloons +Ballot +Ballots +Ballpark +Ballroom +Balmy +Balsamic +Bamboo +Banana +Bananas +Bandage +Banded +Bandit +Bandits +Bands +Bandwidth +Bang +Banish +Banished +Banister +Banjo +Bank +Bankable +Bankbook +Banked +Banker +Bankers +Banking +Banknote +Banknotes +Bankroll +Bankrupt +Banks +Banned +Banner +Banners +Banning +Bannister +Banquet +Bans +Banshee +Bantam +Banter +Barbarian +Barbarous +Barbecue +Barbed +Barbell +Barber +Barcode +Bard +Bare +Barefoot +Barely +Bargain +Barge +Barges +Bargraph +Barista +Baritone +Barium +Barker +Barley +Barmaid +Barman +Barn +Barney +Barns +Barometer +Baron +Baroness +Baronet +Baronets +Barons +Baroque +Barrack +Barracks +Barracuda +Barrage +Barred +Barrel +Barrels +Barren +Barrette +Barricade +Barrier +Barriers +Barring +Barrister +Barrow +Bars +Barstool +Bartender +Barter +Barterer +Basal +Basalt +Baseball +Based +Baseline +Baseman +Basement +Bash +Basic +Basically +Basics +Basil +Basilica +Basin +Basing +Basins +Basis +Basket +Baskets +Bass +Bassist +Bastion +Batboy +Batch +Bath +Bathe +Bathed +Bathing +Bathroom +Bathrooms +Baths +Baton +Bats +Batsmen +Battalion +Batted +Batter +Battered +Batteries +Battering +Batters +Battery +Batting +Battle +Battled +Battles +Battling +Bauble +Bay +Bayou +Bays +Bazaar +Bazooka +Beach +Beaches +Beacon +Bead +Beads +Beak +Beam +Beamed +Beams +Beans +Bear +Beard +Bearded +Bearer +Bearers +Bearings +Bears +Beast +Beasts +Beating +Beats +Beau +Beauties +Beautiful +Beauty +Beaver +Beavers +Became +Beck +Become +Becomes +Becoming +Bedrock +Bedroom +Bedrooms +Beds +Bedside +Bedtime +Bee +Beech +Beef +Beer +Beers +Bees +Beet +Beetle +Beetles +Befriends +Beg +Began +Beggar +Beggars +Begged +Begging +Begin +Beginner +Beginners +Beginning +Begins +Begs +Begun +Behalf +Behave +Behaved +Behaves +Behaving +Behavior +Beheld +Behest +Behind +Behold +Being +Beings +Belief +Beliefs +Believe +Believed +Believer +Believers +Believes +Believing +Bell +Belle +Bells +Belly +Belong +Belonged +Belonging +Belongs +Beloved +Below +Belt +Belts +Bench +Benches +Benchmark +Bend +Bender +Bending +Bends +Beneath +Benefit +Benefited +Benefits +Benign +Bent +Benzene +Berg +Berth +Berths +Beset +Beside +Besides +Besieged +Best +Bestow +Bestowed +Beta +Betray +Betrayal +Betrayed +Bets +Better +Betting +Beverage +Beverages +Beware +Beyond +Bias +Biases +Biathlon +Bicycle +Bicycles +Bidder +Bidding +Bids +Biennial +Big +Bigger +Biggest +Bike +Bikes +Biking +Bikini +Bilateral +Bilingual +Bill +Billboard +Billed +Billiards +Billing +Billings +Billion +Billions +Bills +Binary +Bind +Binder +Binding +Binds +Bingo +Binomial +Biologist +Biology +Biopsy +Biosphere +Biplane +Birch +Bird +Birds +Birthday +Births +Biscuits +Bishopric +Bishops +Bison +Bite +Bites +Bitten +Bitter +Bitterly +Bizarre +Blabber +Black +Blackened +Blackish +Blackness +Blackout +Bladder +Blade +Blades +Blah +Blame +Blamed +Blames +Blaming +Blanching +Bland +Blandness +Blank +Blanket +Blankets +Blanks +Blaspheme +Blasphemy +Blast +Blasted +Blasting +Blatancy +Blatant +Blatantly +Blaze +Blazer +Blazers +Blazing +Bleach +Bleak +Bleep +Blemish +Blend +Blended +Blending +Blends +Bless +Blessed +Blessing +Blessings +Blew +Blight +Blighted +Blimp +Blinding +Blindly +Blinds +Bling +Blink +Blinked +Blinker +Blinking +Blinks +Blip +Bliss +Blissful +Blitz +Blizzard +Bloated +Bloating +Blob +Bloc +Block +Blockade +Blocked +Blocking +Blocks +Blog +Blogger +Blogs +Blond +Blonde +Bloom +Bloomers +Blooming +Blooms +Blooper +Blossom +Blossoms +Blot +Blouse +Blow +Blowing +Blown +Blows +Blubber +Blue +Bluegrass +Blueprint +Blues +Bluff +Bluffs +Bluish +Blunderer +Blunt +Bluntly +Blur +Blurb +Blurred +Blurring +Blurry +Blurt +Blush +Blushed +Blustery +Boa +Boar +Boarded +Boarding +Boardwalk +Boast +Boasted +Boaster +Boastful +Boasting +Boasts +Boat +Boating +Bobbed +Bobbing +Bobble +Bobby +Bobcat +Bobcats +Bobsled +Bobtail +Bodacious +Bodily +Body +Bodyguard +Bog +Bogged +Boggle +Bogus +Bohemian +Boil +Boiled +Boiler +Boilers +Boiling +Bok +Bold +Boldly +Boldness +Bolster +Bolt +Bolted +Bolts +Bonanza +Bond +Bonded +Bonding +Bondless +Bonds +Boned +Bonehead +Boneless +Bonelike +Bones +Boney +Bonfire +Bonnet +Bonsai +Bonus +Bonuses +Bony +Boogeyman +Boogie +Boogieman +Book +Booked +Booking +Booklet +Bookstore +Boom +Booming +Boon +Boondocks +Boost +Boosted +Booster +Boot +Booted +Booth +Bootie +Booting +Bootlace +Bootleg +Boots +Boozy +Borax +Border +Bordered +Bordering +Borders +Bore +Boredom +Boring +Boron +Borough +Boroughs +Borrow +Borrowed +Borrower +Borrowers +Borrowing +Boss +Bosses +Botanical +Botanist +Botany +Botch +Both +Bother +Bothered +Bothering +Bottle +Bottled +Bottles +Bottling +Bottom +Bottoms +Bought +Boulder +Boulders +Boulevard +Bounce +Bounced +Bouncing +Bouncy +Boundary +Bounded +Bounding +Boundless +Bountiful +Bounty +Bouquet +Bourbon +Bout +Boutique +Bouts +Bovine +Bowed +Bower +Bowing +Bowl +Bowled +Bowler +Bowlers +Bowling +Bowls +Bowman +Boxcar +Boxed +Boxer +Boxers +Boxes +Boxing +Boxlike +Boxy +Boycott +Boycotted +Boyfriend +Boyhood +Bracket +Brackets +Braille +Brain +Brains +Brake +Brakes +Braking +Bran +Branch +Branched +Branches +Branching +Brand +Branded +Branding +Brands +Brandy +Brass +Brave +Bravely +Bravery +Braves +Bravo +Brawl +Bray +Breach +Breached +Breaches +Bread +Breadth +Breakdown +Breaker +Breakers +Breakfast +Breakup +Breath +Breathe +Breathed +Breathing +Breaths +Breeches +Breeching +Breed +Breeder +Breeders +Breeding +Breeds +Breeze +Breezy +Brethren +Brevity +Brew +Brewer +Breweries +Brewers +Brewery +Brewing +Briar +Bribe +Bribery +Bribes +Brick +Bricks +Bride +Bridged +Bridges +Bridging +Brief +Briefcase +Briefing +Briefly +Briefs +Brig +Brigade +Brigades +Bright +Brighter +Brightest +Brightly +Brilliant +Brim +Brine +Bring +Brings +Brink +Brisk +Brisket +Briskly +Briskness +Bristle +Brittle +Broadband +Broadcast +Broaden +Broadened +Broader +Broadest +Broadly +Broadness +Broadside +Broadways +Broccoli +Brochure +Brochures +Broiler +Broiling +Broke +Broken +Broker +Brokerage +Brokers +Bromide +Bronchial +Bronco +Broncos +Bronze +Bronzing +Brood +Brooding +Brook +Brooks +Broom +Broth +Brother +Brothers +Brought +Browbeat +Brown +Browning +Brownish +Browns +Browse +Browser +Browsers +Browsing +Bruins +Bruised +Bruises +Bruising +Brunch +Brunette +Brunt +Brush +Brushed +Brushes +Brushing +Brussels +Brute +Brutishly +Bubble +Bubbles +Bubbling +Bubbly +Buccaneer +Buck +Bucked +Bucket +Buckets +Buckeyes +Buckle +Buckling +Bucks +Buckshot +Buckskin +Bucktooth +Buckwheat +Bud +Buddhism +Buddhist +Buddies +Budding +Buddy +Budget +Budgetary +Budgeting +Budgets +Buds +Buff +Buffalo +Buffed +Buffer +Buffers +Buffet +Buffing +Buffoon +Buggy +Bugs +Builder +Builders +Builds +Buildup +Bulb +Bulbs +Bulge +Bulginess +Bulging +Bulgur +Bulk +Bulky +Bull +Bulldog +Bulldogs +Bulldozer +Bulletin +Bullfight +Bullfrog +Bullhorn +Bullion +Bullish +Bullock +Bullpen +Bullring +Bulls +Bullseye +Bullwhip +Bully +Bump +Bumped +Bumper +Bumps +Bun +Bunch +Bundle +Bundled +Bundles +Bungalow +Bungee +Bunion +Bunk +Bunkbed +Bunker +Bunkers +Bunkhouse +Bunkmate +Bunny +Bunt +Burden +Burdened +Burdens +Bureau +Bureaus +Burglary +Burned +Burner +Burning +Burns +Burnt +Burrow +Burrows +Bursting +Bus +Busboy +Bush +Bushes +Busiest +Busily +Business +Busload +Bust +Busy +Busybody +Butcher +Butler +Butter +Butterfly +Button +Buttons +Buy +Buyer +Buyers +Buying +Buyout +Buys +Buzz +Bypass +Bypassed +Bypassing +Byte +Bytes +Cab +Cabana +Cabaret +Cabbage +Cabbie +Cabdriver +Cabin +Cabinet +Cabinets +Cabins +Cable +Cables +Caboose +Cache +Cackle +Cacti +Cactus +Cad +Caddie +Caddy +Cadence +Cadet +Cadets +Cadillac +Cadmium +Cadre +Cadres +Cafeteria +Caffeine +Cage +Cages +Cahoots +Cake +Cakes +Calamari +Calamity +Calcium +Calculate +Calculus +Calendar +Calf +Caliber +Calibrate +Caller +Calm +Calmed +Calmly +Caloric +Calorie +Calories +Calves +Calzone +Camcorder +Camel +Camels +Cameo +Camera +Cameras +Camisole +Camp +Campaign +Campaigns +Camped +Camper +Campfire +Camping +Camps +Campsite +Campus +Campuses +Canal +Canals +Canary +Cancel +Canceled +Candid +Candidacy +Candidate +Candied +Candle +Candles +Candy +Cane +Canine +Canister +Canned +Canning +Cannon +Cannons +Cannot +Canoe +Canoeing +Canoes +Canola +Canon +Canonical +Canons +Canopener +Canopy +Cantata +Canteen +Canto +Canvas +Canyon +Cap +Capable +Capably +Capacitor +Capacity +Cape +Capillary +Capital +Capitals +Capitol +Capped +Capricorn +Caps +Capsize +Capsule +Capsules +Captain +Captaincy +Captained +Captains +Caption +Captivate +Captive +Captives +Captivity +Capture +Captures +Capturing +Caramel +Carat +Caravan +Carbon +Carbonate +Cardboard +Carded +Cardiac +Cardigan +Cardinal +Cardinals +Cardstock +Career +Careers +Careful +Carefully +Caregiver +Careless +Cares +Caress +Caretaker +Cargo +Caribou +Caring +Carless +Carload +Carmaker +Carnation +Carnival +Carnivore +Carol +Carousel +Carp +Carpenter +Carpentry +Carpet +Carpets +Carpool +Carport +Carriage +Carriages +Carried +Carrier +Carriers +Carries +Carrot +Carrots +Carrousel +Carry +Carrying +Cart +Cartel +Cartilage +Cartload +Carton +Cartoon +Cartoons +Cartridge +Carts +Cartwheel +Carve +Carved +Carver +Carving +Carvings +Carwash +Cascade +Cascades +Case +Cash +Casing +Casino +Casinos +Casket +Cassette +Caste +Castes +Castle +Castles +Casual +Casually +Casualty +Catacomb +Catalog +Catalogs +Catalyst +Catalysts +Catalytic +Catalyze +Catalyzed +Catalyzes +Catapult +Cataract +Catatonic +Catcall +Catch +Catchable +Catcher +Catches +Catching +Catchy +Category +Cater +Caterer +Catering +Catfight +Catfish +Cathedral +Catheters +Cathode +Catlike +Catnap +Catnip +Catsup +Cattail +Cattishly +Cattle +Catty +Catwalk +Caucus +Caught +Causal +Causality +Causation +Causative +Cause +Caused +Causes +Causeway +Causing +Caustic +Cauterize +Caution +Cautioned +Cautions +Cautious +Cavalier +Cavaliers +Cavalry +Caveat +Cavern +Caves +Caviar +Cavities +Cavity +Cease +Ceasefire +Ceases +Cedar +Ceiling +Ceilings +Celebrate +Celebrity +Celery +Celestial +Celibacy +Celibate +Cell +Cellar +Cellist +Cello +Cells +Cellular +Cellulose +Celtic +Cement +Cemented +Censor +Censored +Censure +Census +Censuses +Centenary +Center +Centered +Centering +Centers +Central +Centrally +Centuries +Century +Ceramic +Ceramics +Cereal +Cereals +Cerebral +Ceremony +Certainly +Certainty +Certified +Certify +Cesarean +Cessation +Cesspool +Chafe +Chaffing +Chain +Chained +Chains +Chair +Chaired +Chairman +Chairs +Chalice +Chalk +Challenge +Chamber +Chambers +Chamomile +Champ +Champagne +Champion +Champions +Chance +Chancery +Chances +Chandler +Change +Channel +Channels +Chant +Chanting +Chaos +Chaotic +Chap +Chapel +Chapels +Chaperone +Chaplain +Chapped +Chaps +Chapter +Chapters +Char +Character +Charbroil +Charcoal +Charge +Charged +Charger +Chargers +Charges +Charging +Chariot +Charisma +Charities +Charity +Charm +Charmed +Charming +Charms +Charred +Chart +Charted +Charter +Chartered +Charters +Charting +Charts +Chase +Chasing +Chassis +Chaste +Chastise +Chastity +Chat +Chatroom +Chatter +Chatting +Chatty +Cheap +Cheaper +Cheapest +Cheaply +Cheat +Cheated +Cheating +Check +Checked +Checking +Checklist +Checks +Cheddar +Cheek +Cheeks +Cheer +Cheered +Cheerful +Cheering +Cheers +Cheese +Cheesy +Chef +Chefs +Chemical +Chemicals +Chemist +Chemistry +Chemists +Cherish +Cherished +Cherisher +Cherry +Cherub +Chess +Chest +Chestnut +Chests +Chevron +Chevy +Chew +Chewable +Chewed +Chewer +Chewing +Chewy +Chick +Chicken +Chickens +Chicks +Chief +Chiefly +Chiefs +Chieftain +Chihuahua +Child +Childcare +Childhood +Childish +Childless +Childlike +Chile +Chili +Chill +Chilled +Chilling +Chilly +Chimney +Chimneys +Chimp +Chin +China +Chip +Chips +Chirping +Chirpy +Chitchat +Chivalry +Chive +Chloride +Chlorine +Chocolate +Choice +Choices +Choir +Choirs +Choke +Choked +Choking +Chomp +Choose +Chooser +Chooses +Choosing +Choosy +Chop +Chopped +Choral +Chorale +Chord +Chords +Chores +Chorus +Chose +Chosen +Chow +Chowder +Chowtime +Chromatic +Chrome +Chromium +Chronic +Chronicle +Chubby +Chuck +Chuckled +Chug +Chummy +Chump +Chunk +Chunks +Churches +Churn +Chute +Cider +Cigar +Cigarette +Cigars +Cilantro +Cinch +Cinema +Cinemas +Cinematic +Cinnamon +Cipher +Circa +Circadian +Circle +Circles +Circling +Circuit +Circuitry +Circuits +Circular +Circulate +Circus +Citable +Citadel +Citation +Citations +Cites +Cities +Citizen +Citizenry +Citizens +Citric +Citrus +City +Civic +Civil +Civilian +Civilians +Civilized +Clad +Claim +Claimant +Claimants +Clambake +Clammy +Clamor +Clamp +Clamped +Clamshell +Clan +Clang +Clanking +Clans +Clapped +Clapper +Clapping +Clarified +Clarify +Clarinet +Clarity +Clash +Clashed +Clashes +Clasp +Clasped +Class +Classed +Classes +Classic +Classical +Classics +Classify +Classmate +Classroom +Clatter +Clause +Clauses +Clavicle +Claw +Claws +Clay +Clean +Cleaned +Cleaner +Cleaners +Cleaning +Cleansing +Cleanup +Clear +Clearance +Cleared +Clearer +Clearest +Clearing +Clearly +Cleat +Cleaver +Cleft +Clement +Clench +Clenched +Clergy +Clergyman +Clergymen +Cleric +Clerical +Clerics +Clerk +Clerks +Clever +Click +Clicked +Clicker +Clicking +Clicks +Client +Clients +Cliff +Cliffs +Climate +Climates +Climatic +Climb +Climbed +Climber +Climbers +Climbing +Climbs +Clinch +Clinched +Cling +Clinging +Clinic +Clinical +Clinician +Clinics +Clinking +Clip +Clipboard +Clipped +Clipper +Clippers +Clipping +Clips +Clique +Cloak +Clobber +Clock +Clocks +Clockwise +Cloister +Clone +Cloned +Cloning +Closable +Closely +Closeness +Closer +Closes +Closest +Closet +Closure +Clot +Cloth +Clothed +Clothes +Clothing +Cloths +Clotting +Cloud +Clouded +Clouds +Cloudy +Clover +Cloves +Clown +Clubbed +Clubbing +Clubhouse +Clue +Clues +Clump +Clumps +Clumsily +Clumsy +Clung +Clunky +Cluster +Clustered +Clusters +Clutch +Clutched +Clutching +Clutter +Coach +Coached +Coaches +Coaching +Coagulant +Coalition +Coals +Coarse +Coast +Coastal +Coaster +Coasting +Coastland +Coastline +Coasts +Coat +Coated +Coating +Coatings +Coats +Coauthor +Cobalt +Cobbler +Cobra +Cobweb +Cockpit +Cocoa +Coconut +Cod +Codex +Codified +Coeditor +Coerce +Coercion +Coercive +Coexist +Coffee +Cofounder +Cognition +Cognitive +Cogwheel +Coherence +Coherent +Cohesion +Cohesive +Cohort +Cohorts +Coil +Coiled +Coils +Coin +Coinage +Coincide +Coincided +Coincides +Coined +Coins +Coke +Cola +Cold +Colder +Coldest +Coldly +Coleslaw +Coliseum +Collage +Collapse +Collapsed +Collapses +Collar +Colleague +Collected +Collector +Collects +College +Colleges +Collide +Collided +Collie +Collier +Colliery +Collision +Collusion +Cologne +Colon +Colonel +Colonels +Colonial +Colonies +Colonist +Colonists +Colonize +Colonized +Colony +Colorful +Coloring +Colors +Colossal +Colt +Colts +Column +Columnist +Columns +Coma +Combat +Combating +Combine +Combined +Combines +Combining +Combo +Combs +Come +Comeback +Comedian +Comedians +Comedic +Comedies +Comedy +Comet +Comets +Comfort +Comforted +Comforts +Comfy +Comic +Comics +Coming +Comma +Command +Commanded +Commander +Commando +Commandos +Commands +Commas +Commence +Commenced +Commend +Comment +Commented +Comments +Commerce +Commit +Commits +Committed +Commode +Commodity +Commodore +Common +Commonest +Commonly +Commons +Commotion +Communal +Commune +Communes +Community +Commute +Commuted +Commuter +Commuters +Commuting +Compact +Compacted +Compacter +Compactly +Compactor +Companion +Company +Compare +Compared +Compares +Comparing +Compel +Compelled +Compete +Competed +Competes +Competing +Compile +Compiled +Compiler +Compiling +Complain +Complains +Complaint +Completed +Completes +Complex +Complexes +Compliant +Complied +Comply +Complying +Component +Compose +Composed +Composer +Composers +Composing +Composite +Compost +Composure +Compound +Compounds +Compress +Comprise +Comprised +Comprises +Compute +Computed +Computer +Computers +Computing +Comrade +Comrades +Concave +Conceal +Concealed +Concede +Conceded +Conceding +Conceive +Conceived +Concept +Concepts +Concern +Concerned +Concerns +Concert +Concerted +Concerto +Concertos +Concerts +Conch +Concierge +Concise +Conclave +Conclude +Concluded +Concludes +Concord +Concourse +Concrete +Concur +Condemn +Condemned +Condense +Condensed +Condenser +Condiment +Condition +Condone +Condor +Conducive +Conduct +Conducted +Conductor +Conducts +Conduit +Cone +Cones +Confer +Conferred +Confers +Confess +Confessed +Confesses +Confetti +Confidant +Confided +Confident +Confider +Confiding +Configure +Confine +Confined +Confines +Confining +Confirm +Confirmed +Confirms +Conflict +Conflicts +Conform +Conforms +Confound +Confront +Confronts +Confuse +Confused +Confusing +Confusion +Congenial +Congested +Congrats +Congress +Congruent +Conical +Conjoined +Conjugate +Conjure +Conjuror +Connect +Connected +Connector +Connects +Conquer +Conquered +Conqueror +Conquest +Conquests +Consensus +Consent +Consented +Conserve +Conserved +Considers +Consist +Consisted +Consists +Console +Consoles +Consoling +Consonant +Consort +Constable +Constancy +Constant +Constants +Constrain +Constrict +Construct +Construed +Consul +Consular +Consulate +Consult +Consulted +Consume +Consumed +Consumer +Consumers +Consumes +Consuming +Contact +Contacted +Contacts +Contain +Contained +Container +Contains +Contempt +Contend +Contended +Contender +Contends +Content +Contented +Contently +Contents +Contest +Contested +Contests +Context +Contexts +Continual +Continue +Continued +Continues +Continuum +Contort +Contour +Contours +Contract +Contracts +Contrary +Contrast +Contrasts +Contrite +Contrived +Control +Controls +Contusion +Convene +Convened +Convent +Converge +Converse +Convert +Converted +Converter +Converts +Convex +Convey +Conveyed +Conveying +Conveyor +Conveys +Convict +Convicted +Convicts +Convince +Convinced +Convinces +Convoy +Convoys +Cook +Cookbook +Cooked +Cookie +Cookies +Cooking +Cooks +Cool +Cooled +Cooler +Cooling +Cooper +Cooperate +Cop +Copartner +Cope +Copied +Copier +Copies +Copilot +Coping +Copious +Copper +Cops +Copy +Copyright +Coral +Corals +Cordial +Cork +Cornball +Cornbread +Corncob +Cornea +Corneal +Corned +Corner +Corners +Cornfield +Cornflake +Cornhusk +Cornice +Cornmeal +Cornstalk +Corny +Corolla +Corollary +Corona +Coronary +Coroner +Corporal +Corporate +Corporeal +Corps +Corpus +Corral +Correct +Corrected +Correlate +Corridor +Corridors +Corrode +Corroding +Corrosion +Corrosive +Corrupt +Corrupted +Corsage +Corset +Cortex +Cosigner +Cosmetic +Cosmetics +Cosmic +Cosmology +Cosmos +Cosponsor +Cost +Costing +Costly +Costs +Costume +Costumes +Cottage +Cottages +Cotton +Couch +Cougars +Cough +Coughing +Could +Council +Councilor +Councils +Counsel +Counselor +Countable +Countdown +Countess +Counties +Counting +Countless +Countries +Country +County +Coup +Coupe +Couple +Coupled +Couples +Coupling +Coupon +Coupons +Courier +Courses +Court +Courteous +Courtesy +Courtiers +Courtly +Courtroom +Courts +Courtship +Courtyard +Cousin +Cousins +Cove +Covenant +Covenants +Cover +Coverage +Covert +Coveted +Coveting +Cow +Coward +Cowardice +Cowardly +Cowboy +Cowboys +Coworkers +Cows +Coyness +Coyote +Coyotes +Cozily +Coziness +Cozy +Crab +Crabbing +Crabgrass +Crablike +Crabmeat +Crack +Crackdown +Cracked +Crackers +Cracking +Cracks +Cradle +Cradling +Crafted +Crafter +Craftily +Crafts +Craftsman +Craftsmen +Craftwork +Crafty +Crammed +Cramp +Cramped +Cramps +Cranberry +Crane +Cranes +Cranial +Cranium +Crank +Crash +Crashed +Crashes +Crashing +Crate +Crater +Craters +Crave +Craven +Craving +Crawfish +Crawl +Crawled +Crawlers +Crawling +Crayfish +Crayon +Crazed +Crazily +Craziness +Crazy +Creamed +Creamer +Creamlike +Creamy +Crease +Creasing +Creatable +Create +Creates +Creating +Creation +Creations +Creative +Creator +Creators +Creature +Creatures +Credence +Credible +Credibly +Credit +Creditor +Creditors +Credits +Creed +Creek +Creeks +Creep +Creeping +Creme +Creole +Crepe +Crept +Crescent +Crest +Crested +Cresting +Crestless +Crevice +Crewed +Crewless +Crewman +Crewmate +Crib +Cricket +Cricketer +Cried +Crier +Cries +Crime +Crimes +Criminal +Criminals +Crimp +Crimson +Cringe +Cringing +Crinkle +Crinkly +Crises +Crisis +Crisp +Crisped +Crisping +Crisply +Crispness +Crispy +Criteria +Criterion +Critic +Critical +Criticism +Criticize +Critics +Critique +Critiques +Critter +Croak +Crock +Crocodile +Crook +Crooked +Croon +Crop +Cropped +Cropping +Cross +Crossed +Crosses +Crossing +Crossings +Crossover +Crouch +Crouched +Crouton +Crow +Crowbar +Crowd +Crowded +Crowds +Crown +Crowned +Crowns +Crows +Crucial +Crucially +Crucible +Crude +Crudely +Crudeness +Cruel +Cruelly +Cruelness +Cruelty +Cruise +Cruiser +Cruisers +Cruises +Cruising +Crumb +Crumbling +Crumbs +Crummiest +Crummy +Crumpet +Crumpled +Cruncher +Crunching +Crunchy +Crusade +Crusader +Crusaders +Crusades +Crush +Crushable +Crushed +Crusher +Crushing +Crust +Crux +Crying +Cryptic +Crystal +Crystals +Cub +Cubbyhole +Cube +Cubes +Cubic +Cubical +Cubicle +Cubs +Cucumber +Cuddle +Cuddly +Cuff +Cufflink +Cuisine +Culinary +Culminate +Culpable +Culprit +Cultivate +Cultural +Culture +Cultured +Cultures +Cunning +Cup +Cupbearer +Cupboard +Cupcake +Cupid +Cupola +Cupped +Cupping +Cups +Curable +Curative +Curator +Curb +Curdle +Cure +Cures +Curfew +Curing +Curiosity +Curious +Curiously +Curl +Curled +Curler +Curliness +Curling +Curls +Curly +Currents +Curricula +Curry +Curse +Cursed +Curses +Cursing +Cursive +Cursor +Curt +Curtailed +Curtain +Curtains +Curtly +Curtsy +Curvature +Curve +Curved +Curves +Curving +Curvy +Cushion +Cushions +Cushy +Cusp +Cussed +Custard +Custodial +Custodian +Custody +Custom +Customary +Customer +Customers +Customize +Customs +Cut +Cutoff +Cuts +Cutter +Cutting +Cuttings +Cycle +Cyclic +Cyclical +Cycling +Cyclist +Cyclists +Cyclone +Cyclones +Cylinder +Cylinders +Cymbal +Cynical +Cynicism +Cypress +Cytoplasm +Cytoplast +Dab +Dad +Daddy +Daffodil +Dagger +Daily +Daintily +Dainty +Dairy +Daisy +Dale +Dallying +Damage +Damaged +Damages +Damaging +Damp +Dams +Dance +Danced +Dancer +Dancers +Dances +Dancing +Dandelion +Dander +Dandruff +Dandy +Danger +Dangerous +Dangers +Dangle +Dangling +Dare +Dared +Daredevil +Dares +Daring +Daringly +Dark +Darkened +Darkening +Darker +Darkest +Darkish +Darkness +Darkroom +Darling +Darn +Dart +Darted +Darts +Darwinism +Dash +Dashed +Dashing +Dastardly +Data +Database +Databases +Datebook +Dating +Datum +Daughter +Daughters +Daunting +Davenport +Dawdler +Dawn +Dawned +Daybed +Daybreak +Daycare +Daydream +Daylight +Daylong +Dayroom +Daytime +Dazed +Dazzler +Dazzling +Deacon +Deadline +Deadlines +Deadlock +Deafening +Deafness +Dealer +Dealers +Dealing +Dealings +Dealmaker +Dealt +Dean +Dear +Dearest +Dearly +Debatable +Debate +Debated +Debates +Debating +Debit +Debrief +Debris +Debt +Debtless +Debtor +Debtors +Debts +Debug +Debugging +Debunk +Debut +Debuts +Decade +Decades +Decaf +Decal +Decathlon +Decay +Decaying +Deceased +Deceit +Deceive +Deceived +Deceiver +Deceiving +December +Decency +Decent +Deception +Deceptive +Decibel +Decidable +Decide +Decided +Decidedly +Decides +Deciding +Deciduous +Decimal +Decimeter +Decipher +Decision +Decisions +Decisive +Deck +Decks +Declare +Declared +Declares +Declaring +Decline +Declined +Declines +Declining +Decode +Decoding +Decompose +Decor +Decorate +Decorated +Decorator +Decoy +Decrease +Decreased +Decreases +Decree +Decreed +Decrees +Dedicate +Dedicated +Dedicator +Deduce +Deduced +Deduct +Deducted +Deduction +Deductive +Deed +Deeds +Deem +Deep +Deepen +Deepened +Deepening +Deeper +Deepest +Deeply +Deepness +Deface +Defacing +Defame +Default +Defaults +Defeat +Defeating +Defeats +Defect +Defected +Defection +Defective +Defects +Defend +Defendant +Defended +Defender +Defenders +Defending +Defends +Defense +Defenses +Defensive +Defer +Deference +Deferral +Deferred +Defiance +Defiant +Deficient +Deficit +Deficits +Defied +Defile +Defiling +Define +Defines +Defining +Definite +Deflate +Deflation +Deflator +Deflected +Deflector +Defog +Deforest +Defraud +Defrost +Deftly +Defunct +Defuse +Defy +Degrade +Degraded +Degrading +Degrease +Degree +Degrees +Dehydrate +Deities +Deity +Dejected +Delay +Delayed +Delaying +Delays +Delegate +Delegated +Delegates +Delegator +Delete +Deleted +Deleting +Deletion +Delicacy +Delicate +Delicious +Delight +Delighted +Delights +Delineate +Delirious +Delirium +Deliver +Delivered +Deliverer +Delivers +Delivery +Delouse +Delta +Deluge +Delusion +Delusions +Deluxe +Demand +Demanded +Demanding +Demands +Demeaning +Demeanor +Demise +Demo +Democracy +Democrat +Demolish +Demon +Demonic +Demons +Demos +Demote +Demoted +Demotion +Demystify +Denatured +Deniable +Denial +Denied +Denies +Denim +Denote +Denoted +Denotes +Denoting +Denounce +Denounced +Dense +Densely +Densities +Density +Dental +Dentist +Dentistry +Dentists +Denture +Deny +Denying +Deodorant +Deodorize +Depart +Departed +Departing +Departs +Departure +Depend +Depended +Depending +Depends +Depict +Depicted +Depicting +Depiction +Depicts +Deplete +Depleted +Depletion +Deplored +Deploy +Deployed +Deploying +Deport +Deported +Depose +Deposed +Deposit +Deposited +Deposits +Depot +Depots +Depraved +Depravity +Deprecate +Depress +Depressed +Deprive +Deprived +Depriving +Depth +Depths +Deputies +Deputize +Deputy +Derail +Derby +Derelict +Derive +Derived +Derives +Deriving +Derrick +Descend +Descended +Descends +Descent +Describe +Described +Describes +Desecrate +Desert +Deserted +Desertion +Deserts +Deserve +Deserved +Deserves +Deserving +Designate +Designed +Designer +Designers +Designing +Designs +Desire +Desired +Desires +Desiring +Desirous +Desk +Deskbound +Desks +Desktop +Deskwork +Desolate +Despair +Despatch +Desperate +Despise +Despised +Despite +Despotism +Dessert +Destined +Destiny +Destitute +Destroy +Destroyed +Destroyer +Destroys +Destruct +Detached +Detail +Detailed +Detailing +Details +Detained +Detainees +Detect +Detected +Detecting +Detection +Detective +Detector +Detectors +Detects +Detention +Deter +Detergent +Determine +Deterrent +Detest +Detonate +Detonator +Detoxify +Detract +Detriment +Deuce +Devalue +Develop +Developer +Develops +Deviance +Deviancy +Deviant +Deviate +Deviation +Deviator +Device +Devices +Devil +Devils +Devious +Devise +Devised +Devising +Devoid +Devote +Devoted +Devotedly +Devotee +Devotees +Devotion +Devoured +Devourer +Devouring +Devout +Devoutly +Dew +Dexterity +Dexterous +Dharma +Diabolic +Diagnose +Diagnosed +Diagnoses +Diagnosis +Diagonal +Diagram +Diagrams +Dial +Dialect +Dialectic +Dialects +Dialog +Diameter +Diameters +Diamond +Diamonds +Diaper +Diaphragm +Diaries +Diary +Dice +Dichotomy +Dicing +Dictate +Dictated +Dictates +Dictation +Dictator +Dictum +Didactic +Diesel +Diet +Dietary +Diets +Differ +Differed +Differing +Differs +Difficult +Diffuse +Diffused +Diffuser +Diffusion +Diffusive +Dig +Digest +Digested +Digestion +Digestive +Digging +Digit +Digital +Digitally +Digits +Dignified +Dignity +Dilated +Dilation +Dilemma +Dilemmas +Diligence +Diligent +Dill +Dilute +Diluted +Dilution +Dim +Dime +Dimension +Diminish +Dimly +Dimmed +Dimmer +Dimness +Dimple +Din +Dined +Diner +Dingbat +Dinghy +Dinginess +Dingo +Dingy +Dining +Dinner +Dinners +Dinosaur +Dinosaurs +Diocese +Diode +Diodes +Dioxide +Dip +Diploma +Diplomacy +Diplomat +Diplomats +Dipole +Dipped +Dipper +Dipping +Dire +Directed +Directing +Direction +Directive +Directly +Director +Directors +Directory +Directs +Direness +Dirk +Dirt +Dirtiness +Dirty +Disable +Disabled +Disabling +Disagree +Disagreed +Disallow +Disappear +Disarm +Disarray +Disaster +Disasters +Disband +Disbanded +Disbelief +Disburse +Discard +Discarded +Discern +Discerned +Discharge +Disciple +Disciples +Disclose +Disco +Discolor +Discord +Discount +Discounts +Discourse +Discover +Discovers +Discovery +Discredit +Discreet +Discrete +Discuss +Discussed +Discusses +Disdain +Disengage +Disfigure +Disgrace +Disguise +Disguised +Disgust +Disgusted +Dish +Dishes +Dishonest +Disinfect +Disjoin +Disk +Disks +Dislike +Disliked +Disliking +Dislocate +Dislodge +Disloyal +Dismal +Dismantle +Dismay +Dismiss +Dismissal +Dismissed +Dismount +Disobey +Disorder +Disorders +Disown +Disparate +Disparity +Dispatch +Dispel +Dispense +Dispensed +Dispersal +Disperse +Dispersed +Disperser +Displace +Displaced +Display +Displayed +Displays +Displease +Disposal +Dispose +Disposed +Disprove +Dispute +Disputes +Disregard +Disrepair +Disrupt +Disrupted +Diss +Dissent +Dissident +Dissolve +Dissolved +Dissolves +Dissuade +Distance +Distanced +Distances +Distant +Distaste +Distill +Distilled +Distinct +Distort +Distorted +Distract +Distress +District +Districts +Distrust +Disturb +Disused +Ditch +Ditches +Ditto +Ditzy +Diuretics +Diurnal +Diva +Dive +Diver +Diverged +Divergent +Divers +Diverse +Diversion +Diversity +Divert +Diverted +Dives +Dividable +Divide +Divided +Dividend +Dividends +Dividers +Divides +Dividing +Divine +Divinely +Diving +Divinity +Divisible +Divisibly +Division +Divisive +Divorce +Divorced +Divorcee +Dizziness +Dizzy +Doable +Docile +Dock +Docked +Docking +Docks +Dockyard +Doctor +Doctorate +Doctors +Doctrinal +Doctrine +Doctrines +Document +Documents +Dodge +Dodgers +Dodgy +Doe +Dogma +Dogmatic +Doily +Doing +Dole +Doll +Dollar +Dollars +Dollhouse +Dollop +Dolls +Dolly +Dolphin +Dolphins +Domain +Domains +Dome +Domed +Domelike +Domes +Domestic +Dominance +Dominant +Dominate +Dominated +Dominates +Dominion +Dominions +Domino +Dominoes +Donate +Donated +Donating +Donation +Donations +Donator +Donkey +Donor +Donors +Donut +Doodle +Doom +Doomed +Doorbell +Doorframe +Doorknob +Doorman +Doormat +Doornail +Doorpost +Doorstep +Doorstop +Doorway +Doozy +Dork +Dormant +Dormitory +Dorsal +Dosage +Dose +Doses +Dosing +Dot +Doth +Dots +Dotted +Double +Doubled +Doubles +Doubling +Doubly +Doubt +Doubted +Doubtful +Doubting +Doubtless +Doubts +Dough +Dove +Dowager +Down +Downed +Downfall +Downhill +Downing +Download +Downloads +Downright +Downtown +Downturn +Downward +Downwards +Dowry +Doze +Dozen +Dozens +Drab +Draft +Drafted +Drafting +Drafts +Drag +Dragged +Dragging +Dragon +Dragonfly +Dragonish +Dragons +Dragoons +Dragster +Drain +Drainable +Drainage +Drained +Drainer +Draining +Drainpipe +Drains +Drama +Dramas +Dramatic +Dramatist +Dramatize +Drank +Draped +Drapery +Drastic +Draw +Drawback +Drawbacks +Drawer +Drawers +Drawings +Draws +Dread +Dreaded +Dreadful +Dreadlock +Dream +Dreamboat +Dreamed +Dreamer +Dreamily +Dreaming +Dreamland +Dreamless +Dreamlike +Dreams +Dreamt +Dreamy +Drearily +Dreary +Drench +Dress +Dresser +Drew +Dribble +Dried +Drier +Drift +Drifted +Drifting +Drill +Drilled +Driller +Drilling +Drills +Drink +Drinkable +Drinkers +Drinking +Drinks +Drip +Dripping +Drippy +Drivable +Drive +Driven +Driver +Drivers +Drives +Driveway +Driving +Drizzle +Drizzly +Drone +Drones +Drool +Droop +Drop-down +Dropbox +Dropkick +Droplet +Droplets +Dropout +Dropped +Dropper +Dropping +Drops +Drought +Drove +Drown +Drowsily +Drudge +Drum +Drummer +Drummers +Drumming +Drums +Dry +Dryer +Drying +Dual +Dualism +Duality +Dub +Dubbed +Dubbing +Dubious +Dubiously +Duchess +Duck +Duckbill +Ducked +Ducking +Duckling +Ducks +Ducktail +Ducky +Duct +Dude +Duel +Dues +Duet +Duets +Duff +Duffel +Dug +Dugout +Duh +Duke +Dukes +Dull +Duller +Dullness +Duly +Dummies +Dump +Dumped +Dumping +Dumpling +Dumpster +Dun +Dune +Dunes +Dung +Dungeon +Dungeons +Duo +Dupe +Duplex +Duplicate +Duplicity +Durable +Durably +Duration +Duress +During +Dusk +Dust +Dusty +Duties +Dutiful +Duty +Duvet +Dwarf +Dweeb +Dwell +Dwelled +Dweller +Dwellers +Dwelling +Dwellings +Dwells +Dwindle +Dwindling +Dye +Dyed +Dyer +Dyes +Dynamic +Dynamical +Dynamics +Dynamism +Dynamite +Dynamo +Dynastic +Dynasties +Dynasty +Each +Eagerly +Eagerness +Eagle +Eagles +Earache +Eardrum +Earflap +Earful +Earlier +Earliest +Earlobe +Early +Earmark +Earmuff +Earnest +Earnestly +Earnings +Earphone +Earpiece +Earplugs +Earring +Earrings +Earshot +Earthen +Earthlike +Earthling +Earthly +Earthworm +Earthy +Earwig +Easeful +Easel +Easier +Easiest +Easily +Easiness +Easing +Eastbound +Eastcoast +Easter +Eastward +Eastwards +Eatable +Eaten +Eatery +Eating +Eats +Ebay +Ebb +Ebony +Ebook +Ecard +Eccentric +Echelon +Echo +Echoed +Echoes +Echoing +Eclair +Eclectic +Eclipse +Ecologist +Ecology +Economic +Economics +Economies +Economist +Economy +Ecosphere +Ecosystem +Ecstatic +Eddy +Edge +Edged +Edginess +Edging +Edgy +Edible +Edict +Edifice +Edit +Edited +Editing +Edition +Editions +Editor +Editorial +Editors +Educate +Educated +Educating +Education +Educator +Educators +Eel +Eerie +Effect +Effected +Effecting +Effective +Effects +Efficacy +Efficient +Effort +Efforts +Effusion +Egg +Eggbeater +Egging +Eggnog +Eggplant +Eggs +Eggshell +Ego +Egomaniac +Egotism +Egotistic +Eighteen +Eighth +Eighties +Eighty +Either +Eject +Elaborate +Elapsed +Elastic +Elated +Elbow +Elbows +Elder +Eldercare +Elderly +Elders +Eldest +Electable +Election +Elective +Electoral +Electors +Electric +Electrode +Electron +Electrons +Elegance +Elegant +Element +Elemental +Elements +Elephant +Elephants +Elevate +Elevated +Elevating +Elevation +Elevator +Elevators +Eleven +Eleventh +Elf +Elicit +Elicited +Eliciting +Eligible +Eligibly +Eliminate +Elite +Elites +Elitism +Elitist +Elixir +Elk +Ellipse +Elliptic +Elm +Elongated +Elope +Eloquence +Eloquent +Else +Elsewhere +Elucidate +Elude +Elusive +Elves +Email +Emails +Emanating +Embargo +Embark +Embarked +Embarking +Embassies +Embassy +Embattled +Embedded +Embedding +Embellish +Ember +Embezzle +Emblaze +Emblem +Embodied +Embodies +Embody +Embodying +Embolism +Emboss +Embrace +Embraced +Embraces +Embracing +Embroider +Embroiled +Embryo +Embryonic +Embryos +Emcee +Emerald +Emerge +Emerged +Emergence +Emergency +Emergent +Emerges +Emerging +Emeritus +Emery +Emigrants +Emigrate +Emigrated +Eminence +Eminent +Eminently +Emir +Emirates +Emission +Emissions +Emit +Emitted +Emitting +Emote +Emoticon +Emotion +Emotional +Emotions +Empathic +Empathy +Emperor +Emperors +Emphases +Emphasis +Emphasize +Emphatic +Empire +Empires +Empirical +Employ +Employed +Employee +Employees +Employer +Employers +Employing +Employs +Emporium +Empower +Empowered +Empress +Emptied +Emptier +Empties +Emptiness +Empty +Emptying +Emu +Emulate +Emulation +Emulsion +Enable +Enabled +Enables +Enabling +Enact +Enacted +Enacting +Enactment +Enamel +Enchanted +Enchilada +Encircle +Encircled +Enclave +Enclose +Enclosed +Enclosing +Enclosure +Encode +Encoded +Encodes +Encoding +Encompass +Encore +Encounter +Encourage +Encroach +Encrust +Encrypt +Encrypted +Endanger +Endeared +Endearing +Endeavor +Endeavors +Ended +Endemic +Ending +Endings +Endless +Endlessly +Endnote +Endocrine +Endorphin +Endorse +Endorsed +Endowment +Endpoint +Endurable +Endurance +Endure +Endured +Enduring +Enemies +Enemy +Energetic +Energies +Energize +Energy +Enforce +Enforced +Enforcer +Enforcing +Engage +Engaged +Engages +Engaging +Engine +Engineer +Engineers +Engines +Engraved +Engraver +Engraving +Engross +Engulf +Engulfed +Enhance +Enhanced +Enhances +Enhancing +Enigma +Enigmatic +Enjoined +Enjoy +Enjoyable +Enjoyably +Enjoyed +Enjoyer +Enjoying +Enjoyment +Enjoys +Enlarge +Enlarged +Enlarging +Enlighten +Enlist +Enlisted +Enmity +Enormous +Enough +Enquirer +Enquiries +Enquiry +Enrage +Enraged +Enrich +Enriched +Enroll +Enrolled +Enrolling +Ensemble +Ensembles +Enshrined +Ensign +Ensnare +Ensued +Ensues +Ensuing +Ensure +Ensured +Ensures +Ensuring +Entail +Entailed +Entails +Entangled +Entering +Entertain +Enticing +Entire +Entirely +Entirety +Entitle +Entitled +Entity +Entomb +Entourage +Entrance +Entrances +Entrants +Entrap +Entree +Entrench +Entries +Entropy +Entrust +Entrusted +Entryway +Entwine +Enunciate +Envelope +Enveloped +Envelopes +Enviable +Enviably +Envious +Envisaged +Envision +Envoy +Envoys +Envy +Enzyme +Enzymes +Ephemeral +Epic +Epidemic +Epidemics +Epidermal +Epidermis +Epidural +Epilogue +Epiphany +Episode +Episodes +Episodic +Epistle +Epistles +Epithet +Epoch +Epoxy +Epsilon +Equal +Equally +Equals +Equate +Equated +Equation +Equations +Equator +Equinox +Equip +Equipment +Equipped +Equitable +Equity +Equivocal +Eradicate +Erasable +Erase +Erased +Eraser +Erasure +Ergonomic +Eroded +Erosion +Err +Errand +Errant +Erratic +Erroneous +Error +Errors +Erstwhile +Erupt +Erupted +Eruption +Eruptions +Escalate +Escalated +Escalator +Escapable +Escapade +Escape +Escaped +Escapes +Escaping +Escapist +Escargot +Esophagus +Esoteric +Espionage +Espoused +Espresso +Esquire +Essay +Essayist +Essays +Essence +Essential +Establish +Estate +Estates +Esteem +Esteemed +Estimate +Estimates +Estimator +Estranged +Estrogen +Estuary +Etching +Eternal +Eternally +Eternity +Ethanol +Ether +Ethic +Ethically +Ethics +Ethos +Etiquette +Etymology +Euphemism +Euphoria +Eureka +Euro +Euros +Evacuate +Evacuated +Evacuee +Evade +Evaluate +Evaluated +Evaluates +Evaluator +Evaporate +Evasion +Evasive +Even +Evening +Evenings +Evenly +Event +Events +Eventual +Everglade +Evergreen +Every +Everybody +Everyday +Everyone +Evict +Evicted +Eviction +Evidence +Evidenced +Evidences +Evident +Evidently +Evil +Evoke +Evokes +Evolution +Evolve +Evolved +Exact +Exacting +Exactly +Exalted +Exam +Examine +Examined +Examiner +Examiners +Examines +Examining +Example +Examples +Exams +Excavate +Excavated +Excavator +Exceed +Exceeded +Exceeding +Exceeds +Excel +Excelled +Excellent +Except +Excepting +Exception +Excerpt +Excerpts +Excess +Excesses +Excessive +Exchange +Exchanged +Exchanges +Exchequer +Excise +Excised +Excision +Excitable +Excite +Excited +Excitedly +Exciting +Exclaim +Exclaimed +Exclude +Excluded +Excludes +Excluding +Exclusion +Exclusive +Excretion +Excretory +Excursion +Excusable +Excusably +Excuse +Excused +Excuses +Executive +Executor +Exegesis +Exemplary +Exemplify +Exempt +Exempted +Exemption +Exercise +Exercised +Exerciser +Exercises +Exert +Exerted +Exertion +Exerts +Exes +Exfoliate +Exhale +Exhaust +Exhausted +Exhibit +Exhibited +Exhibits +Exhume +Exile +Exiled +Exiles +Existed +Existent +Existing +Exists +Exit +Exited +Exiting +Exits +Exodus +Exonerate +Exorcism +Exorcist +Exotic +Expand +Expanded +Expanding +Expands +Expanse +Expansion +Expansive +Expect +Expectant +Expecting +Expects +Expedient +Expedited +Expediter +Expel +Expelled +Expend +Expended +Expense +Expenses +Expensive +Expert +Expertise +Experts +Expire +Expired +Expiring +Explain +Explains +Expletive +Explicit +Explode +Exploded +Exploding +Exploit +Exploited +Exploits +Explore +Explored +Explorer +Explorers +Explores +Exploring +Explosion +Explosive +Expo +Exponent +Exponents +Export +Exported +Exporter +Exporters +Exporting +Exports +Expos +Exposable +Expose +Exposed +Exposes +Exposing +Exposure +Exposures +Expounded +Express +Expressed +Expresses +Expressly +Expulsion +Exquisite +Extant +Extend +Extended +Extending +Extends +Extension +Extensive +Extent +Extenuate +Exterior +External +Extinct +Extortion +Extra +Extract +Extracted +Extracts +Extradite +Extras +Extreme +Extremely +Extremes +Extremity +Extrinsic +Extrovert +Extrude +Extruding +Extrusion +Exuberant +Eye +Eyebrow +Eyebrows +Eyelid +Eyelids +Fable +Fables +Fabric +Fabrics +Fabulous +Facade +Facades +Facebook +Facecloth +Faced +Facedown +Faceless +Facelift +Faceplate +Facet +Faceted +Facets +Facial +Facility +Facing +Facsimile +Fact +Faction +Factions +Factoid +Factor +Factories +Factors +Facts +Factsheet +Factual +Faculties +Faculty +Fade +Faded +Fades +Fading +Fail +Failed +Failing +Fails +Failure +Failures +Faint +Faintly +Fairies +Fairness +Fairy +Faith +Faithful +Faiths +Fake +Falcon +Falcons +Fall +Fallacy +Fallen +Falling +Fallout +Fallow +False +Falsehood +Falsely +Falsify +Fame +Famed +Familial +Familiar +Families +Family +Famine +Famished +Famously +Fan +Fanatic +Fancied +Fanciful +Fanciness +Fancy +Fanfare +Fang +Fanning +Fans +Fantasies +Fantasize +Fantastic +Fantasy +Farce +Fared +Fares +Farewell +Farm +Farmed +Farmer +Farmers +Farmhouse +Farming +Farmland +Farms +Farther +Farthest +Fashion +Fashioned +Fashions +Fastball +Fastened +Faster +Fastest +Fasting +Fastness +Fated +Fateful +Fathered +Fatigue +Fats +Faucet +Faulty +Fauna +Favor +Favorable +Favorably +Favored +Favoring +Favorite +Favorites +Favors +Fax +Fear +Feared +Fearful +Fearing +Fearless +Fears +Feasible +Feast +Feasts +Feather +Feathers +Feature +Featured +Features +Featuring +Fed +Federal +Federally +Federated +Fedora +Fee +Feeble +Feed +Feedback +Feeder +Feeding +Feeds +Feel +Feeling +Feelings +Feels +Fees +Feet +Feisty +Felicity +Feline +Fell +Fellow +Fellows +Felony +Felt +Felt-tip +Female +Females +Feminine +Feminism +Feminist +Feminize +Femoral +Femur +Fence +Fencer +Fences +Fencing +Fender +Feral +Ferment +Fern +Fernlike +Ferns +Ferocious +Ferocity +Ferret +Ferries +Ferris +Ferrous +Ferry +Fertile +Fervent +Fervor +Fester +Festival +Festivals +Festive +Festivity +Fetal +Fetch +Fetched +Feud +Feudal +Feudalism +Fever +Feverish +Fewer +Fewest +Fiat +Fiber +Fibers +Fibrous +Fiction +Fictional +Fictions +Fiddle +Fiddling +Fidelity +Fidgeting +Fidgety +Fiduciary +Fief +Fielded +Fielding +Fieldwork +Fierce +Fiercely +Fiery +Fiesta +Fife +Fifteen +Fifteenth +Fifth +Fifths +Fifties +Fiftieth +Fifty +Fig +Fight +Fighter +Fighting +Fights +Figment +Figs +Figure +Figures +Figurine +Figurines +Filament +Filaments +Filial +Filing +Filled +Filler +Filling +Fills +Film +Filmed +Filming +Filmmaker +Films +Filter +Filtered +Filtering +Filters +Filth +Filthy +Filtrate +Fin +Finale +Finalist +Finalists +Finality +Finalize +Finalized +Finally +Finance +Financed +Finances +Financial +Financier +Financing +Finch +Find +Finder +Finding +Findings +Finds +Finely +Fineness +Finer +Finest +Finger +Fingers +Finicky +Finish +Finished +Finisher +Finishers +Finishes +Finishing +Finite +Finless +Finlike +Fins +Fir +Fired +Fireplace +Fires +Firewall +Firewood +Fireworks +Firing +Firmly +Firmness +Firsthand +Firstly +Firth +Fiscal +Fiscally +Fished +Fisher +Fisheries +Fisherman +Fishermen +Fishery +Fishes +Fishing +Fission +Fissure +Fist +Fists +Fit +Fitness +Fitted +Fitting +Fittings +Five +Fix +Fixation +Fixed +Fixes +Fixing +Fixture +Fixtures +Fjord +Flaccid +Flag +Flagman +Flagpole +Flags +Flagship +Flagstick +Flagstone +Flail +Flair +Flakes +Flakily +Flaky +Flame +Flamenco +Flames +Flaming +Flammable +Flank +Flanked +Flanking +Flanks +Flannels +Flap +Flaps +Flare +Flared +Flaring +Flash +Flashback +Flashbulb +Flashcard +Flashed +Flashes +Flashily +Flashing +Flashy +Flask +Flat +Flatbed +Flatfoot +Flatly +Flatness +Flats +Flatten +Flattened +Flatter +Flattered +Flatterer +Flattery +Flattop +Flatware +Flatworm +Flavor +Flavored +Flavorful +Flavoring +Flavors +Flaw +Flawed +Flaws +Flax +Flaxseed +Flea +Fled +Fledged +Fledgling +Flee +Fleeing +Flees +Fleet +Fleeting +Fleets +Flesh +Fleshed +Fleshy +Flew +Flick +Flicker +Flier +Flight +Flights +Flinch +Fling +Flint +Flip +Flipped +Flirt +Float +Floated +Floating +Floats +Flock +Flocks +Flogging +Flood +Flooded +Flooding +Floods +Floor +Floors +Flop +Floppy +Flora +Floral +Florist +Floss +Flotilla +Flounder +Flour +Flourish +Flowed +Flowering +Flowers +Flown +Flows +Flu +Fluency +Fluid +Fluidity +Fluids +Flung +Fluoride +Flush +Flushed +Flushing +Flute +Flutter +Fluxes +Flyable +Flyaway +Flyer +Flyers +Flying +Flyover +Flypaper +Flyweight +Foam +Focal +Focus +Focused +Focuses +Focusing +Fodder +Foe +Foes +Fog +Foil +Folder +Folders +Foliage +Folic +Folk +Folklore +Folks +Follicle +Follicles +Follow +Followed +Follower +Followers +Following +Follows +Folly +Fond +Fondly +Fondness +Fondue +Font +Fonts +Foo +Food +Foods +Fool +Fooled +Foolish +Fools +Footage +Football +Footbath +Footboard +Footer +Footgear +Foothill +Foothills +Foothold +Footing +Footless +Footman +Footnote +Footnotes +Footpad +Footpath +Footprint +Footrest +Footsore +Footsteps +Footwear +Footwork +Forage +Foraging +Foray +Forbade +Forbid +Forbidden +Forbids +Forceful +Forceps +Forcibly +Forearm +Forecast +Forecasts +Forefront +Foregoing +Forehead +Foreign +Foreigner +Foreman +Foremost +Forensic +Foresee +Foresight +Forested +Forestry +Forests +Forever +Foreword +Forfeited +Forge +Forged +Forgery +Forget +Forgets +Forging +Forgive +Forgiven +Forgiving +Forgot +Forgotten +Forks +Formalism +Formality +Format +Formats +Formatted +Formerly +Formula +Formulas +Formulate +Forte +Forthwith +Forties +Fortified +Fortnight +Fortress +Fortune +Fortunes +Forty +Forum +Forums +Forwarded +Forwards +Fossil +Fossils +Foster +Fostered +Fostering +Fought +Foul +Founder +Founders +Founding +Foundry +Fountain +Fountains +Four +Fourteen +Fourth +Fowl +Fox +Foxes +Foyer +Fractal +Fraction +Fractions +Fracture +Fractured +Fractures +Fragile +Fragility +Fragment +Fragments +Fragrance +Fragrant +Frail +Frame +Framed +Frames +Framework +Framing +Franchise +Frank +Frankly +Franks +Frantic +Fraternal +Fraud +Fraught +Fray +Frayed +Fraying +Frays +Freak +Freckled +Freckles +Free +Freebee +Freebie +Freed +Freedman +Freedom +Freedoms +Freefall +Freehand +Freeing +Freelance +Freeload +Freely +Freeman +Freemason +Freeness +Freer +Freestyle +Freeware +Freeway +Freewill +Freezable +Freeze +Freezer +Freezing +Freight +Freighter +French +Frenzied +Frenzy +Frequency +Frequent +Fresco +Frescoes +Fresh +Freshly +Freshman +Freshmen +Freshness +Fretful +Fretted +Friar +Friars +Friction +Friday +Fridge +Fried +Friend +Fries +Frieze +Frigate +Frigates +Fright +Frighten +Frightful +Frigidity +Frigidly +Frill +Fringe +Fringes +Frisbee +Frisk +Fritter +Frivolous +Frog +Frogs +Frolic +From +Front +Frontage +Frontal +Frontier +Frontiers +Frost +Frostbite +Frosted +Frostily +Frosting +Frostlike +Frosty +Froth +Frown +Frowned +Frowning +Froze +Frozen +Fructose +Frugality +Frugally +Fruit +Fruitful +Fruition +Fruitless +Fruits +Frustrate +Fry +Frying +Fuel +Fueled +Fuels +Fugitive +Fulfill +Fulfilled +Full +Fuller +Fullest +Fullness +Fumble +Fumbles +Fumes +Fun +Function +Functions +Funded +Funding +Funds +Fungal +Fungi +Fungus +Funk +Funky +Funnel +Funny +Furious +Furiously +Furlongs +Furnace +Furnaces +Furnish +Furnished +Furniture +Furs +Further +Fury +Fuselage +Fuss +Futile +Futility +Future +Futures +Fuzzy +Gab +Gable +Gables +Gaffe +Gag +Gainfully +Gaining +Gains +Gait +Gala +Galactic +Galaxies +Galaxy +Gale +Gall +Gallant +Gallantly +Gallantry +Galleria +Galleries +Gallery +Galley +Gallon +Gallons +Gallop +Gallstone +Galore +Galvanize +Gamble +Gambling +Game +Gamer +Games +Gaming +Gamma +Gander +Gang +Gangly +Gangrene +Gangs +Gangster +Gangway +Gap +Gaping +Gaps +Garage +Garb +Garbage +Garden +Gardener +Gardeners +Gardening +Gardens +Gargle +Garland +Garlic +Garment +Garments +Garner +Garnered +Garnering +Garnet +Garnish +Garrison +Garrisons +Garter +Gas +Gaseous +Gasoline +Gasp +Gasped +Gasping +Gastric +Gate +Gates +Gateway +Gather +Gathered +Gatherer +Gathering +Gathers +Gating +Gauge +Gauging +Gaunt +Gauntlet +Gauze +Gave +Gawk +Gaze +Gazed +Gazette +Gazetted +Gazing +Gear +Gearbox +Geared +Gears +Gecko +Geek +Geese +Geiger +Gelatin +Gem +Gems +Gender +Gene +Genealogy +Genera +General +Generally +Generals +Generated +Generates +Generator +Generic +Generous +Genes +Genesis +Genetic +Genetics +Genie +Genius +Genome +Genomes +Genre +Genres +Gentile +Gentle +Gentleman +Gentlemen +Gently +Gentry +Gents +Genuine +Genuinely +Genus +Geography +Geologic +Geologist +Geology +Geometric +Geometry +Geranium +Gerbil +Geriatric +Germ +Germicide +Germinate +Germless +Germproof +Germs +Gestate +Gestation +Gesture +Gestured +Gestures +Getaway +Getting +Getup +Ghastly +Ghost +Ghostly +Ghosts +Giant +Giants +Gibberish +Gibbon +Gibbons +Giblet +Giddily +Giddiness +Giddy +Gift +Gifted +Gifts +Gig +Gigabyte +Gigahertz +Gigantic +Giggle +Giggled +Giggling +Giggly +Gigs +Gilded +Gill +Gilled +Gills +Gimmick +Ginger +Girdle +Girl +Girls +Give +Giveaway +Given +Giver +Gives +Giving +Gizmo +Gizzard +Glacial +Glacier +Glaciers +Glad +Glade +Gladiator +Gladly +Glamorous +Glamour +Glance +Glanced +Glances +Glancing +Gland +Glands +Glandular +Glare +Glared +Glaring +Glass +Glasses +Glaucoma +Glaze +Glazed +Glazing +Gleam +Gleaming +Gleaned +Glee +Gleeful +Glen +Glide +Glider +Gliders +Gliding +Glimmer +Glimpse +Glimpses +Glisten +Glitch +Glitter +Glitzy +Gloater +Gloating +Global +Globally +Globe +Gloom +Gloomily +Gloomy +Glorified +Glorifier +Glorify +Glorious +Glory +Gloss +Glossary +Glossy +Glove +Gloves +Glow +Glowed +Glowing +Glowworm +Glucose +Glue +Glued +Gluten +Glutinous +Glutton +Gnarly +Gnat +Goal +Goals +Goat +Goats +Goatskin +God +Goddess +Goddesses +Godfather +Godly +Gods +Goes +Goggles +Going +Gold +Golden +Goldfish +Goldmine +Goldsmith +Golf +Golfer +Goliath +Gondola +Gone +Gong +Good +Goodbye +Goodness +Goods +Goodwill +Gooey +Goofball +Goofiness +Goofy +Google +Goon +Goose +Gopher +Gorge +Gorged +Gorgeous +Gorilla +Gosling +Gospel +Gospels +Gossip +Gothic +Gotten +Gout +Govern +Governed +Governing +Governor +Governors +Governs +Gown +Gowns +Grab +Grabbed +Grabbing +Grabs +Grace +Graceful +Graceless +Graces +Gracious +Gradation +Graded +Grader +Graders +Gradient +Gradients +Grading +Gradual +Gradually +Graduate +Graduated +Graffiti +Graft +Grafted +Grafting +Grafts +Grail +Grain +Grains +Grammar +Grammars +Grand +Granddad +Grandeur +Grandiose +Grandkid +Grandly +Grandma +Grandpa +Grandson +Grange +Granite +Granny +Granola +Grant +Granted +Granting +Granular +Granules +Grape +Grapes +Graph +Graphical +Graphite +Grapple +Grappling +Grasp +Grasped +Grasping +Grass +Grasses +Grassland +Grassy +Grateful +Gratified +Gratify +Grating +Gratitude +Gratuity +Gravel +Graveness +Graves +Graveyard +Gravitate +Gravity +Gravy +Gray +Grays +Grazing +Grease +Greasily +Greasy +Great +Greater +Greatest +Greatly +Greatness +Greedily +Greedless +Greedy +Green +Greenish +Greens +Greet +Greeted +Greeter +Greeting +Greetings +Grenadier +Grew +Greyhound +Grid +Grids +Grief +Grievance +Grieve +Grieving +Grievous +Griffin +Grill +Grille +Grilled +Grim +Grimace +Grimacing +Grime +Grimes +Griminess +Grimly +Grimy +Grin +Grinch +Grind +Grinding +Grinned +Grinning +Grip +Gripped +Gripping +Grips +Gristle +Grit +Grizzlies +Groan +Groaned +Groceries +Grocery +Groggily +Groggy +Groom +Grooming +Groove +Grooves +Grooving +Groovy +Gross +Grossed +Grossing +Grossly +Grotesque +Ground +Grounded +Grounding +Grouped +Grouping +Groupings +Grout +Grove +Groves +Grow +Grower +Growers +Growing +Growl +Growled +Grown +Grows +Growth +Grub +Grudge +Grudging +Grueling +Gruffly +Grumble +Grumbling +Grumbly +Grumpily +Grunge +Grunt +Grunted +Guacamole +Guarantee +Guarded +Guardian +Guardians +Guarding +Guerrilla +Guess +Guessed +Guessing +Guest +Guests +Guidable +Guidance +Guide +Guided +Guideline +Guides +Guiding +Guild +Guilds +Guileless +Guilt +Guilty +Guinea +Guise +Guitar +Guitarist +Guitars +Gulf +Gull +Gullible +Gully +Gulp +Gum +Gumball +Gumdrop +Gumminess +Gumming +Gummy +Gums +Gunboat +Gunboats +Gunner +Gunners +Gunnery +Gunpowder +Gurgle +Gurgling +Guru +Gush +Gusto +Gusty +Gut +Gutless +Guts +Gutter +Guy +Guys +Guzzler +Gym +Gymnasium +Gymnast +Gypsum +Gyration +Habitable +Habitant +Habitat +Habitats +Habitual +Hacked +Hacker +Hacking +Hackney +Hacksaw +Had +Haggler +Haiku +Hail +Hailed +Hails +Hairy +Half +Halftime +Halfway +Hallmark +Halls +Hallway +Halo +Halogen +Halt +Halted +Halting +Halved +Halves +Hamburger +Hamlet +Hamlets +Hammer +Hammered +Hammock +Hamper +Hampered +Hamster +Hamstring +Handbag +Handball +Handbook +Handbrake +Handcart +Handclap +Handclasp +Handcraft +Handcuff +Handed +Handful +Handgrip +Handgun +Handheld +Handiness +Handing +Handiwork +Handle +Handlebar +Handled +Handler +Handles +Handling +Handmade +Handoff +Handpick +Handprint +Handrail +Hands +Handsaw +Handset +Handsfree +Handshake +Handsome +Handstand +Handwash +Handwork +Handwoven +Handwrite +Handy +Handyman +Hang +Hangar +Hangnail +Hangout +Hangover +Hangs +Hangup +Hankering +Hankie +Hanky +Haphazard +Happen +Happened +Happening +Happens +Happier +Happiest +Happily +Happiness +Happy +Harbor +Hard +Hardcopy +Hardcover +Harddisk +Harden +Hardened +Hardener +Hardening +Harder +Hardest +Hardhat +Hardhead +Hardiness +Hardly +Hardness +Hardship +Hardships +Hardware +Hardwired +Hardwood +Hardy +Harmful +Harmless +Harmonic +Harmonica +Harmonics +Harmonies +Harmonize +Harmony +Harness +Harpist +Harrow +Harry +Harsh +Harshly +Harvest +Harvested +Harvests +Hash +Hassle +Haste +Hasten +Hastened +Hastily +Hastiness +Hasty +Hatbox +Hatch +Hatchback +Hatched +Hatchery +Hatchet +Hatching +Hatchling +Hate +Hated +Hates +Hatless +Hatred +Hats +Hauled +Hauling +Haunt +Haunted +Haunting +Haunts +Haven +Havoc +Hawk +Hawker +Hawks +Hawthorn +Hay +Hays +Hazard +Hazardous +Hazards +Haze +Hazel +Hazelnut +Hazily +Haziness +Hazing +Hazy +Headache +Headaches +Headband +Headboard +Headcount +Headdress +Headed +Header +Headers +Headfirst +Headgear +Heading +Headings +Headlamp +Headless +Headline +Headlined +Headlines +Headlock +Headphone +Headpiece +Headrest +Headroom +Heads +Headscarf +Headset +Headsman +Headstand +Headstone +Headway +Headwear +Heal +Healed +Healer +Healers +Healing +Health +Healthier +Heap +Heaped +Heaps +Hearer +Hearings +Hears +Hearsay +Heartbeat +Hearth +Heartily +Heartland +Hearts +Hearty +Heat +Heather +Heats +Heave +Heaven +Heavenly +Heavens +Heavier +Heaviest +Heavily +Heaviness +Heaving +Heavy +Hectare +Hectares +Hector +Hedge +Hedgehog +Hedges +Hedging +Heed +Heftiness +Hefty +Hegemony +Height +Heights +Heir +Heiress +Heirs +Helium +Helix +Hello +Helm +Helmet +Helmets +Help +Helped +Helper +Helpers +Helpful +Helping +Helpless +Helpline +Helps +Hemlock +Hemp +Hemstitch +Hence +Henchman +Henchmen +Henna +Hens +Herald +Heralded +Heraldic +Herb +Herbal +Herbicide +Herbs +Herd +Herder +Herds +Hereafter +Heredity +Heritage +Hermit +Hermitage +Hero +Heroes +Heroic +Heroics +Heroine +Heroism +Heron +Herring +Herself +Hertz +Hesitancy +Hesitant +Hesitate +Hesitated +Heuristic +Hexagon +Hexagonal +Hexagram +Heyday +Hiatus +Hickory +Hid +Hidden +Hide +Hideous +Hideout +Hides +Hiding +Hierarchy +Higher +Highest +Highland +Highlands +Highlight +Highly +Highness +Highway +Highways +Hike +Hiking +Hillside +Hilltop +Hinder +Hindered +Hindrance +Hindsight +Hinge +Hinges +Hint +Hinted +Hints +Hired +Hires +Hiring +Hiss +Hissed +Histamine +Histogram +Historian +Historic +Histories +History +Hit +Hitch +Hitherto +Hits +Hitter +Hitting +Hoard +Hoarse +Hoax +Hobbies +Hobby +Hockey +Hogan +Holdings +Holes +Holiday +Holidays +Holiness +Holistic +Hollow +Holy +Homage +Home +Homeland +Homemade +Homer +Homes +Homestead +Hometown +Homework +Honest +Honestly +Honesty +Honey +Honeycomb +Honeymoon +Honor +Honorable +Honorary +Honored +Honorific +Honoring +Honors +Hooked +Hooks +Hoop +Hope +Hoped +Hopeful +Hopefully +Hopeless +Hopes +Hoping +Horde +Horizon +Horizons +Hormonal +Hormone +Hormones +Horned +Hornet +Hornets +Horrible +Horrid +Horrified +Horror +Horrors +Horseback +Horsemen +Horses +Horseshoe +Hospital +Hospitals +Hosted +Hostel +Hostess +Hostile +Hostility +Hosting +Hotel +Hotels +Hottest +Hound +Hounds +Hour +Hourly +Hours +Housed +Household +Housewife +Housework +Housing +Hovered +Hovering +However +Howitzer +Howitzers +Howl +Howling +Hub +Hubcap +Hubs +Huddle +Huddled +Huddling +Hue +Huff +Hug +Huge +Hugely +Hugged +Hugging +Huh +Hula +Hulk +Hull +Hum +Human +Humane +Humanism +Humanist +Humanity +Humankind +Humans +Humble +Humbling +Humbly +Humid +Humidity +Humiliate +Humility +Humming +Hummus +Humongous +Humor +Humorist +Humorless +Humorous +Humpback +Humped +Humvee +Hundred +Hundreds +Hundredth +Hung +Hunger +Hungrily +Hungry +Hunk +Hunted +Hunter +Hunters +Hunting +Huntress +Hunts +Huntsman +Hurdle +Hurdles +Hurled +Hurler +Hurling +Hurray +Hurricane +Hurried +Hurriedly +Hurry +Hurrying +Hurt +Hurting +Hurts +Husband +Husbandry +Husbands +Hush +Hushed +Husked +Huskies +Huskiness +Hussars +Hut +Huts +Hybrid +Hybrids +Hydra +Hydrant +Hydrated +Hydration +Hydraulic +Hydrogen +Hydroxide +Hygiene +Hymn +Hymns +Hyper +Hyperlink +Hypertext +Hyphen +Hypnoses +Hypnosis +Hypnotic +Hypnotism +Hypnotist +Hypnotize +Hypocrisy +Hypocrite +Hysteria +Ibuprofen +Ice +Iciness +Icing +Icky +Icon +Icons +Icy +Idea +Ideal +Idealism +Idealist +Idealize +Idealized +Ideally +Idealness +Ideals +Ideas +Identical +Identify +Identity +Ideology +Idiocy +Idiom +Idle +Idleness +Idly +Idol +Idols +Igloo +Igneous +Ignited +Ignition +Ignorance +Ignorant +Ignore +Ignored +Ignores +Ignoring +Iguana +Illegal +Illegally +Illicit +Illicitly +Illnesses +Illusion +Illusions +Illusive +Illusory +Image +Imagery +Images +Imaginary +Imagine +Imagined +Imagines +Imaging +Imagining +Imam +Imbalance +Imbued +Imitate +Imitated +Imitating +Imitation +Immanent +Immature +Immediacy +Immediate +Immense +Immensely +Immerse +Immersed +Immersion +Imminent +Immobile +Immodest +Immoral +Immorally +Immortal +Immovable +Immovably +Immunity +Immunize +Immutable +Impact +Impacted +Impacts +Impair +Impaired +Impart +Imparted +Impartial +Impasse +Impatient +Impeach +Impedance +Impede +Impeded +Impeding +Impelled +Impending +Imperfect +Imperial +Impetus +Impish +Implant +Implanted +Implants +Implement +Implicate +Implicit +Implied +Implies +Implode +Implosion +Implosive +Imply +Implying +Impolite +Import +Important +Imported +Importer +Importing +Imports +Impose +Imposes +Imposing +Impound +Imprecise +Impress +Impressed +Imprint +Imprison +Impromptu +Improper +Improve +Improved +Improves +Improving +Improvise +Imprudent +Impulse +Impulses +Impulsive +Impure +Impurity +Imputed +Inability +Inaction +Inactive +Inanimate +Inasmuch +Inaugural +Incapable +Incarnate +Incense +Incentive +Inception +Incessant +Inches +Incident +Incidents +Incipient +Incised +Incision +Incline +Inclined +Include +Included +Includes +Including +Inclusion +Inclusive +Income +Incomes +Incoming +Incorrect +Increase +Increased +Increases +Increment +Incubated +Incumbent +Incur +Incurred +Indebted +Indeed +Indemnity +Index +Indexed +Indexes +Indexing +Indicate +Indicated +Indicates +Indicator +Indices +Indicted +Indignant +Indigo +Indirect +Indoor +Indoors +Induce +Induced +Induces +Inducing +Inducted +Induction +Inductive +Indulge +Indulged +Industry +Inelastic +Inert +Inertia +Inertial +Infamous +Infancy +Infant +Infantile +Infantry +Infants +Infect +Infected +Infection +Infer +Inference +Inferior +Inferno +Inferred +Infested +Infinite +Infinity +Infirmary +Inflamed +Inflated +Inflation +Inflict +Inflicted +Inflow +Influence +Influenza +Influx +Info +Inform +Informal +Informant +Informed +Informing +Informs +Infrared +Infused +Infusion +Ingenious +Ingenuity +Ingested +Ingestion +Ingrained +Inhabit +Inhabits +Inhaled +Inherent +Inherit +Inherited +Inhibit +Inhibited +Inhibits +Inhuman +Initial +Initially +Initials +Initiate +Initiated +Initiates +Inject +Injected +Injecting +Injection +Injure +Injured +Injuries +Injuring +Injurious +Injury +Injustice +Inlet +Inmate +Inmates +Inn +Innate +Innermost +Innocence +Innocent +Inns +Inorganic +Inpatient +Input +Inputs +Inquest +Inquire +Inquired +Inquiries +Inquiring +Inquiry +Inscribed +Insect +Insects +Insecure +Insert +Inserted +Inserting +Insertion +Inserts +Inset +Inside +Insider +Insiders +Insidious +Insight +Insights +Insignia +Insist +Insisted +Insistent +Insisting +Insists +Insoluble +Insomnia +Inspect +Inspected +Inspector +Inspire +Inspired +Inspires +Inspiring +Install +Installed +Instance +Instances +Instant +Instantly +Instead +Instinct +Instincts +Institute +Instruct +Insulated +Insulin +Insult +Insulted +Insulting +Insults +Insurance +Insure +Insured +Insurer +Insurers +Intact +Intake +Integer +Integers +Integral +Integrate +Integrity +Intel +Intellect +Intend +Intending +Intends +Intense +Intensely +Intensify +Intensity +Intensive +Intent +Intention +Intently +Interact +Interacts +Intercept +Interest +Interests +Interface +Interfere +Interim +Interior +Interiors +Intern +Internal +Interned +Internet +Interplay +Interpret +Interred +Interrupt +Intersect +Interval +Intervals +Intervene +Interview +Intestine +Intricate +Intrigue +Intrigued +Intrinsic +Intro +Introduce +Intruder +Intrusion +Intrusive +Intuition +Intuitive +Invade +Invaded +Invaders +Invading +Invalid +Invariant +Invasion +Invasions +Invasive +Invent +Invented +Inventing +Invention +Inventive +Inventor +Inventors +Inventory +Inverse +Inversely +Inversion +Inverted +Invest +Invested +Investing +Investor +Investors +Invisible +Invite +Invited +Invites +Inviting +Invoice +Invoke +Invoked +Invokes +Invoking +Involve +Involved +Involves +Involving +Inward +Inwardly +Iodine +Iodize +Ion +Ionized +Ipad +Iphone +Ipod +Irate +Iris +Irk +Iron +Ironic +Irons +Irony +Irregular +Irrigate +Irrigated +Irritable +Irritably +Irritant +Irritate +Irritated +Island +Islander +Islanders +Islands +Islet +Isolate +Isolated +Isolates +Isolating +Isolation +Isotope +Isotopes +Isotopic +Isotropic +Issue +Issuing +Isthmus +Italicize +Italics +Item +Items +Iteration +Iterative +Itinerant +Itinerary +Itunes +Ivory +Ivy +Jab +Jack +Jackal +Jacket +Jackets +Jackknife +Jackpot +Jade +Jagged +Jaguar +Jaguars +Jail +Jailbird +Jailbreak +Jailed +Jailer +Jailhouse +Jalapeno +Jam +Jammed +Jams +Janitor +January +Japan +Jar +Jargon +Jarring +Jars +Jasmine +Jasper +Jaundice +Jaunt +Java +Javelin +Jaw +Jawed +Jawless +Jawline +Jaws +Jaybird +Jays +Jaywalker +Jazz +Jealous +Jealousy +Jeans +Jeep +Jeeringly +Jellied +Jelly +Jeopardy +Jersey +Jerseys +Jest +Jester +Jet +Jets +Jewel +Jewelry +Jewels +Jiffy +Jigsaw +Jimmy +Jingle +Jingling +Jinx +Jitters +Jittery +Job +Jobs +Jock +Jockey +Jockstrap +Jogger +Jogging +John +Joining +Joins +Joint +Jointly +Joints +Joke +Joker +Jokes +Jokester +Joking +Jokingly +Jolliness +Jolly +Jolt +Josh +Jot +Journal +Journals +Journey +Journeys +Jovial +Joyful +Joyfully +Joylessly +Joyous +Joyride +Joystick +Jubilance +Jubilant +Jubilee +Judge +Judged +Judges +Judging +Judgingly +Judgment +Judgments +Judicial +Judiciary +Judicious +Judo +Jug +Juggle +Juggling +Jugular +Juice +Juices +Juiciness +Juicy +Jujitsu +Jukebox +July +Jumble +Jumbo +Jump +Jumped +Jumper +Jumping +Jumps +Junction +Juncture +June +Jungle +Junior +Juniors +Juniper +Junk +Junkman +Junkyard +Junta +Juridical +Jurist +Jurists +Juror +Jurors +Jury +Justice +Justified +Justifier +Justifies +Justify +Justly +Justness +Juvenile +Juveniles +Kabob +Kangaroo +Karaoke +Karate +Karma +Kebab +Keel +Keen +Keenly +Keenness +Keep +Keeps +Keg +Kelp +Kennel +Kept +Kerchief +Kernel +Kerosene +Kettle +Keyboard +Keyboards +Keynote +Keystone +Keyword +Keywords +Kibbutz +Kick +Kicked +Kicker +Kicking +Kickoff +Kicks +Kid +Kidding +Kidney +Kidneys +Kids +Kiln +Kilobyte +Kilogram +Kilograms +Kilometer +Kilowatt +Kilt +Kimono +Kindle +Kindling +Kindly +Kindness +Kindred +Kinds +Kinetic +Kinfolk +King +Kingdom +Kingdoms +Kingship +Kinship +Kinsman +Kinswoman +Kissable +Kisser +Kissing +Kit +Kitchen +Kitchens +Kite +Kits +Kitten +Kitty +Kiwi +Kleenex +Knapsack +Knee +Kneeling +Knees +Knelt +Knew +Knickers +Knife +Knight +Knighted +Knights +Knit +Knitting +Knives +Knock +Knocked +Knocking +Knockout +Knocks +Knoll +Knot +Knots +Knowing +Knowingly +Knows +Knuckles +Koala +Kooky +Kosher +Krypton +Kudos +Kung +Label +Labeled +Labeling +Labels +Labor +Labored +Laborer +Laborers +Laboring +Laborious +Labors +Labrador +Labyrinth +Lacked +Lacking +Lacks +Lacrosse +Lactate +Lactose +Lacy +Ladder +Laden +Ladies +Ladle +Lady +Ladybug +Ladylike +Lagged +Lagging +Lagoon +Laid +Lair +Lake +Lamb +Lambda +Lambs +Lament +Lamented +Lamps +Lance +Lancers +Lancet +Landed +Landfall +Landfill +Landing +Landings +Landlady +Landless +Landline +Landlord +Landlords +Landmark +Landmarks +Landmass +Landmine +Landowner +Landscape +Landside +Landslide +Language +Languages +Lankiness +Lanky +Lantern +Lapdog +Lapel +Lapped +Lapping +Laptop +Lard +Large +Largely +Larger +Largest +Lark +Larva +Larvae +Larval +Larynx +Laser +Lasers +Lash +Lasso +Last +Lastly +Lasts +Latch +Late +Lately +Latency +Latent +Later +Laterally +Latest +Latex +Lather +Latitude +Latitudes +Latrine +Latter +Lattice +Latticed +Laugh +Laughed +Laughing +Laughs +Launch +Launched +Launcher +Launchers +Launches +Launching +Launder +Laundry +Laureate +Laurel +Lava +Lavender +Lavish +Lawmakers +Lawn +Lawns +Lawsuit +Lawsuits +Lawyer +Lawyers +Laxative +Layered +Layman +Layout +Lazily +Laziness +Lazy +Leach +Leaching +Leader +Leaders +Leads +Leaf +Leaflet +Leaflets +Leafs +Leafy +League +Leagues +Leakage +Leaked +Leaking +Leaks +Leans +Leap +Leaped +Leaping +Leaps +Leapt +Learn +Learned +Learner +Learners +Learning +Learns +Learnt +Least +Leather +Leave +Leaves +Leaving +Lecture +Lectured +Lecturer +Lectures +Lecturing +Ledger +Left +Leg +Legacy +Legal +Legality +Legend +Legendary +Legends +Legged +Leggings +Legible +Legibly +Legion +Legions +Legislate +Lego +Legroom +Legs +Legume +Legumes +Legwarmer +Legwork +Leisure +Leisurely +Lemma +Lemon +Lend +Lenders +Length +Lengthy +Lens +Lenses +Lent +Leopard +Leopards +Leotard +Lessee +Lessen +Lessened +Lesser +Lesson +Lessons +Lessor +Letdown +Lethargic +Lethargy +Letter +Lettering +Letters +Letting +Lettuce +Level +Leveled +Levels +Leverage +Levers +Levied +Levitate +Levitator +Levy +Lexical +Lexicon +Liability +Liable +Liaison +Liar +Libel +Liberated +Liberties +Liberty +Librarian +Libraries +Library +Libretto +License +Licensed +Licensee +Licenses +Licensing +Lichen +Licking +Licorice +Lid +Life +Lifeboat +Lifeless +Lifelong +Lifespan +Lifestyle +Lifetime +Lifetimes +Lifted +Lifter +Lifting +Liftoff +Lifts +Ligament +Ligaments +Lighter +Lightness +Lightning +Liked +Likely +Likened +Likeness +Likes +Likewise +Liking +Lilac +Lilies +Lilly +Lily +Limb +Limeade +Limelight +Limerick +Limes +Limestone +Limit +Limiting +Limitless +Limits +Limping +Limpness +Line +Lineage +Lineages +Linearly +Linen +Liner +Lineup +Linger +Lingered +Lingering +Lingo +Lingual +Linguini +Linguist +Linguists +Lining +Linkage +Linkages +Linked +Links +Linoleum +Linseed +Lint +Lion +Lip +Lipid +Lipids +Lipstick +Liquefy +Liqueur +Liquid +Liquidity +Liquids +Liquor +Lisp +List +Listen +Listened +Listener +Listeners +Listens +Listing +Listings +Lists +Liter +Literal +Literally +Literary +Liters +Lithium +Litigate +Litigator +Litmus +Litter +Little +Littoral +Liturgy +Livable +Lived +Lively +Liver +Livestock +Lividly +Living +Lizard +Lizards +Loaf +Loan +Loaned +Loans +Lobbied +Lobby +Lobbying +Lobes +Lobster +Local +Locale +Locality +Localized +Locally +Locals +Locates +Locker +Loco +Locus +Locust +Lodge +Lodged +Lodges +Lodging +Lodgings +Lofty +Logged +Logging +Logic +Login +Logistic +Logistics +Logo +Logos +Lonely +Longer +Longest +Longevity +Longhorns +Longitude +Longtime +Lookout +Loomed +Loops +Loose +Loosely +Loosen +Loosened +Loosening +Loot +Looted +Looting +Lopes +Lordship +Losers +Losses +Lost +Lottery +Lotus +Louder +Loudly +Lounge +Lovely +Lovers +Loving +Lovingly +Lowered +Lowest +Lowland +Lowlands +Loyal +Loyalist +Loyalists +Loyalties +Loyalty +Lubricant +Lubricate +Lucid +Luck +Luckily +Luckiness +Luckless +Lucrative +Ludicrous +Luggage +Lugged +Lukewarm +Lull +Lullaby +Lumbar +Lumber +Luminance +Luminous +Lumpiness +Lumping +Lumpish +Lunacy +Lunar +Lunch +Lunchbox +Luncheon +Lunchroom +Lunchtime +Lung +Lungs +Lurch +Lure +Lured +Luridness +Lurk +Lurking +Lushly +Lushness +Luster +Lustrous +Luxuries +Luxurious +Luxury +Lyceum +Lying +Lymph +Lymphatic +Lynx +Lyric +Lyrical +Lyrically +Lyricism +Lyricist +Lyrics +Macarena +Macaroni +Macaw +Mace +Machine +Machinery +Machines +Machining +Machinist +Macintosh +Macro +Macros +Mad +Madam +Madame +Madden +Madness +Maestro +Magazine +Magazines +Magenta +Maggot +Magic +Magical +Magician +Magma +Magnate +Magnesium +Magnet +Magnetic +Magnetism +Magnetize +Magnets +Magnified +Magnifier +Magnify +Magnitude +Magnolia +Magnum +Mahatma +Mahogany +Maiden +Maids +Mailbox +Mailed +Mailing +Mainframe +Mainland +Mainline +Mainly +Mainstay +Maintain +Maintains +Maize +Majestic +Majesty +Major +Majored +Majorette +Majoring +Majority +Majors +Makeover +Maker +Makes +Makeshift +Makeup +Making +Malaise +Malformed +Malice +Malicious +Malls +Malt +Mama +Mamma +Mammal +Mammalian +Mammals +Mammogram +Mammoth +Manage +Managed +Manager +Managers +Manages +Managing +Manatee +Mandarin +Mandate +Mandated +Mandates +Mandatory +Mandible +Mandolin +Maneuver +Maneuvers +Manga +Manganese +Manger +Mangle +Mango +Mangrove +Mangy +Manhandle +Manhole +Manhood +Manhunt +Mania +Manic +Manicotti +Manicure +Manifest +Manifesto +Manifests +Manifold +Manila +Mankind +Manlike +Manliness +Manly +Manmade +Manned +Manner +Manners +Manning +Mannish +Manor +Manors +Manpower +Mansion +Mansions +Mantis +Mantle +Mantra +Manual +Manually +Manuals +Manure +Many +Map +Maple +Mapped +Mapping +Maps +Marathon +Marauding +Marble +Marbled +Marbles +Marbling +March +Marched +Marches +Marching +Mardi +Margarine +Margarita +Margin +Marginal +Margins +Maria +Marigold +Marina +Marine +Mariner +Mariners +Marital +Maritime +Markedly +Marker +Markers +Marketed +Marketers +Marketing +Markings +Markup +Marlin +Marlins +Marmalade +Maroon +Maroons +Marquess +Marred +Marriage +Marriages +Married +Marries +Marrow +Marry +Marrying +Marsh +Marshal +Marshals +Marshes +Marshland +Marshy +Marsupial +Martial +Martian +Martini +Martins +Marvel +Marvelous +Marxism +Mascot +Masculine +Mashed +Mashing +Mask +Masked +Masking +Masks +Mason +Masonic +Masonry +Masons +Mass +Massage +Massager +Masses +Massive +Mast +Mastered +Mastering +Masters +Mastery +Mastiff +Masts +Mat +Matador +Matchbook +Matchbox +Matched +Matcher +Matches +Matching +Matchless +Material +Materials +Maternal +Maternity +Math +Matriarch +Matrices +Matrimony +Matrix +Matron +Mats +Matted +Matter +Mattered +Matters +Mattress +Matured +Maturely +Maturing +Maturity +Mauve +Maverick +Mavericks +Max +Maxillary +Maxim +Maxima +Maximal +Maximize +Maxims +Maximum +Maybe +Mayday +Mayflower +Mayhem +Mayo +Mayor +Mayoral +Mayors +Maze +Mead +Meadow +Meadows +Meager +Meals +Mean +Meaning +Meanings +Means +Meant +Meantime +Meanwhile +Measles +Measure +Measured +Measures +Measuring +Meat +Meats +Mechanic +Mechanics +Mechanism +Medal +Medalists +Medallion +Medals +Mediated +Mediating +Mediation +Mediator +Mediators +Medical +Medically +Medicinal +Medicine +Medicines +Medieval +Mediocre +Meditate +Medium +Medley +Meek +Meet +Meeting +Meetings +Meets +Melodic +Melodies +Melodrama +Melody +Melt +Melted +Melting +Melts +Membrane +Membranes +Memo +Memoir +Memoirs +Memorable +Memoranda +Memorial +Memorials +Memories +Memory +Menace +Menacing +Mentality +Mention +Mentions +Mentor +Mentored +Mentoring +Mentors +Menu +Menus +Mercenary +Merchant +Merchants +Merciful +Mercury +Mercy +Mere +Merely +Merger +Mergers +Meridian +Merit +Merits +Mermaid +Merry +Mesa +Mesh +Mess +Message +Messages +Messenger +Messy +Meta +Metabolic +Metal +Metallic +Metals +Metaphor +Metaphors +Meteor +Meteorite +Methane +Methanol +Method +Methods +Metric +Metrics +Metro +Mezzanine +Mica +Mice +Mickey +Microbes +Microfilm +Microwave +Midday +Middle +Midland +Midlands +Midnight +Midpoint +Midsummer +Midtown +Midway +Midwife +Midwives +Might +Migraine +Migrating +Migratory +Mild +Milder +Mildly +Mileage +Milestone +Milieu +Military +Militia +Militias +Milk +Milky +Millennia +Miller +Millet +Milling +Million +Millions +Mills +Mime +Mimic +Minced +Mindful +Miner +Mineral +Minerals +Miners +Mingled +Mini +Miniature +Minimal +Minimally +Minimize +Minimized +Minimizes +Minimum +Ministry +Minor +Minority +Minors +Mint +Minted +Minuscule +Minute +Minutes +Miracle +Miracles +Mirage +Mirror +Mirrored +Mirrors +Mischief +Miserable +Misery +Misguided +Misled +Mismatch +Misplaced +Miss +Missed +Misses +Missing +Mistake +Mistaken +Mistakes +Mister +Mistrust +Misty +Misuse +Mitigate +Mix +Mixed +Mixer +Mixes +Mixing +Mixture +Mixtures +Moat +Mob +Mobile +Mobility +Mobilize +Mobster +Mocha +Mock +Mocked +Mocker +Mockery +Mocking +Mockup +Mod +Modal +Mode +Model +Models +Modem +Moderate +Moderator +Modernism +Modernist +Modernity +Modes +Modest +Modestly +Modesty +Modified +Modifier +Modifiers +Modifies +Modify +Modifying +Modular +Modulated +Modulator +Module +Modules +Modulus +Moist +Moisten +Moistness +Moisture +Molar +Molasses +Mold +Molded +Molding +Molds +Mole +Molecular +Molecule +Molecules +Molehill +Mollusk +Mollusks +Molten +Mom +Moment +Momentary +Momentous +Moments +Momentum +Mommy +Monarch +Monarchs +Monarchy +Monastery +Monastic +Monday +Monetary +Monetize +Money +Moneybags +Moneyless +Moneywise +Mongoose +Moniker +Monitor +Monitored +Monitors +Monk +Monkey +Monkeys +Monkhood +Monks +Mono +Monogamy +Monogram +Monograph +Monologue +Monopoly +Monorail +Monotone +Monotype +Monoxide +Monsieur +Monsoon +Monster +Monsters +Monstrous +Month +Monthly +Months +Monument +Monuments +Moocher +Mood +Moodiness +Moods +Moody +Mooing +Moonbeam +Mooned +Moonlight +Moonlike +Moonlit +Moonrise +Moons +Moonscape +Moonshine +Moonstone +Moonwalk +Moors +Moose +Mop +Morale +Morality +Morally +Morals +Moray +Morbid +Morbidity +Morbidly +Moreover +Mores +Morning +Mornings +Morocco +Morphing +Morse +Mortality +Mortally +Mortals +Mortar +Mortars +Mortgage +Mortgages +Mortician +Mortified +Mortify +Mortuary +Mosaic +Mosaics +Mosque +Mosques +Mosquito +Moss +Mossy +Most +Mostly +Motel +Mothball +Mothers +Mothproof +Moths +Motif +Motifs +Motion +Motioned +Motivate +Motivated +Motivator +Motive +Motocross +Motor +Motorized +Motors +Motorway +Motto +Mound +Mounds +Mountable +Mountain +Mountains +Mounted +Mounting +Mourn +Mourner +Mournful +Mourning +Mouse +Mousiness +Moustache +Mousy +Mouth +Mouths +Movable +Move +Movement +Movements +Mover +Movie +Movies +Moving +Mower +Mowing +Much +Muck +Mud +Muddy +Muffled +Mug +Mulberry +Mulch +Mule +Mules +Mulled +Mullets +Multi +Multiple +Multiples +Multiply +Multitask +Multitude +Mumble +Mumbled +Mumbling +Mumbo +Mummified +Mummify +Mummy +Mumps +Munchkin +Mundane +Municipal +Munitions +Muppet +Mural +Murals +Murkiness +Murky +Murmur +Murmured +Murmuring +Muscle +Muscles +Muscular +Museum +Museums +Mushily +Mushiness +Mushroom +Mushrooms +Mushy +Music +Musical +Musically +Musicals +Musician +Musicians +Musk +Musket +Muskiness +Musky +Mustache +Mustang +Mustangs +Mustard +Muster +Mustered +Mustiness +Musty +Mutable +Mutant +Mutants +Mutate +Mutation +Mutations +Mute +Mutiny +Mutt +Muttered +Muttering +Mutual +Mutually +Muzzle +Myriad +Myself +Myspace +Mysteries +Mystery +Mystic +Mystical +Mysticism +Mystics +Mystified +Mystify +Myth +Mythic +Mythical +Mythology +Myths +Nacho +Nag +Nail +Naive +Name +Namely +Names +Namesake +Naming +Nanny +Nanometer +Nape +Napkin +Napped +Napping +Nappy +Narrated +Narrates +Narration +Narrative +Narrator +Narrow +Narrowed +Narrower +Narrowly +Narrows +Nasal +Nastily +Nastiness +National +Native +Nativity +Natural +Naturally +Nature +Nausea +Nautical +Naval +Navigable +Navigate +Navigator +Navy +Nearby +Nearer +Nearest +Nearing +Nearly +Nearness +Neatly +Neatness +Nebula +Nebulizer +Necessity +Neck +Necklace +Necks +Nectar +Need +Needed +Needing +Needle +Needles +Needs +Negate +Negation +Negative +Neglect +Neglected +Neglector +Negligent +Negotiate +Neighbor +Neighbors +Neither +Nemeses +Nemesis +Neon +Nephew +Nephews +Nerd +Nerve +Nerves +Nervous +Nervy +Nest +Nesting +Nests +Net +Netted +Netting +Network +Networks +Neurology +Neuron +Neurons +Neurosis +Neurotic +Neuter +Neutral +Neutron +Neutrons +Never +Newborn +Newcomer +Newcomers +Newer +Newest +Newly +News +Newscast +Newscasts +Newspaper +Next +Nibble +Niche +Niches +Nickel +Nickname +Nicknamed +Nicknames +Nicotine +Niece +Nifty +Nightclub +Nightly +Nightmare +Nighttime +Nimble +Nimbly +Nineteen +Ninetieth +Ninety +Ninja +Nintendo +Ninth +Nirvana +Nitrate +Nitrogen +Nobility +Noble +Nobleman +Nobles +Nobody +Nocturnal +Nodes +Noise +Noises +Noisy +Nomadic +Nomads +Nominal +Nominally +Nominate +Nominated +Nominee +Nominees +None +Nonlinear +Nonprofit +Nonsense +Nonstop +Noodles +Norm +Norms +North +Northeast +Northerly +Northern +Northward +Northwest +Nose +Nostalgia +Notable +Notably +Notch +Notebook +Nothing +Notice +Notices +Notified +Notion +Notions +Notoriety +Notorious +Novel +Novelist +Novella +Novels +Novelty +Novice +Nowadays +Nowhere +Nuclear +Nuclei +Nucleus +Nugget +Nuggets +Null +Nullify +Number +Numbering +Numbers +Numbing +Numbly +Numbness +Numeral +Numerals +Numerate +Numerator +Numeric +Numerical +Numerous +Nun +Nuns +Nuptials +Nurse +Nursery +Nurses +Nursing +Nurture +Nutlike +Nutmeg +Nutrient +Nutrients +Nutshell +Nuttiness +Nutty +Nuzzle +Nylon +Oaf +Oak +Oaks +Oasis +Oat +Oath +Oaths +Obedience +Obedient +Obelisk +Obey +Obeyed +Obeying +Obituary +Object +Objected +Objection +Objective +Objects +Obligate +Obligated +Oblige +Obliged +Oblique +Oblivion +Oblivious +Oblong +Obnoxious +Oboe +Obscure +Obscured +Obscurity +Observant +Observe +Observed +Observer +Observers +Observes +Observing +Obsessed +Obsession +Obsessive +Obsolete +Obstacle +Obstacles +Obstinate +Obstruct +Obtain +Obtained +Obtaining +Obtains +Obtrusive +Obtuse +Obvious +Obviously +Occasion +Occasions +Occlusion +Occult +Occultist +Occupancy +Occupant +Occupants +Occupied +Occupier +Occupies +Occupy +Occupying +Occur +Occurred +Occurring +Occurs +Ocean +Oceanic +Oceans +Ocelot +Octagon +Octagonal +Octane +Octave +October +Octopus +Ocular +Odd +Oddly +Odds +Odor +Odors +Odyssey +Offend +Offended +Offender +Offenders +Offending +Offense +Offenses +Offensive +Offer +Offered +Offering +Offerings +Offers +Office +Officer +Officers +Offices +Officials +Offline +Offset +Offshoot +Offshore +Offspring +Ogle +Oil +Oily +Oink +Ointment +Okay +Old +Oldies +Olfactory +Olive +Olives +Olympics +Ombudsman +Omega +Omen +Ominous +Omission +Omissions +Omit +Omitted +Omitting +Omnibus +Omnivore +Onboard +Oncoming +Oneness +Oneself +Ongoing +Onion +Onions +Online +Onlooker +Only +Onscreen +Onset +Onshore +Onslaught +Onstage +Onto +Onward +Onwards +Onyx +Oops +Ooze +Oozy +Opacity +Opal +Opaque +Open +Opener +Openings +Openly +Openness +Opens +Opera +Operable +Operand +Operas +Operate +Operates +Operatic +Operating +Operation +Operative +Operator +Operators +Opined +Opinion +Opinions +Opossum +Opponent +Opponents +Oppose +Opposes +Opposing +Opposite +Opposites +Oppressed +Oppressor +Opt +Optic +Optical +Optics +Optimal +Optimism +Optimize +Optimized +Optimum +Optional +Optioned +Options +Opulently +Opus +Oracle +Orange +Oranges +Orator +Orbit +Orbital +Orbitals +Orbiting +Orbits +Orchard +Orchards +Orchestra +Orchid +Orchids +Ordained +Ordeal +Orderly +Ordinal +Ordinance +Ordnance +Organ +Organism +Organisms +Organist +Organize +Organizer +Organizes +Organs +Orient +Oriented +Origin +Originals +Originate +Origins +Orioles +Ornament +Ornaments +Ornate +Orphan +Orphanage +Orphaned +Orphans +Orthodoxy +Osmosis +Osmotic +Other +Otherwise +Otter +Ottoman +Ottomans +Ouch +Ought +Ounce +Ounces +Ourselves +Ousted +Outage +Outback +Outbid +Outboard +Outbound +Outbreak +Outbreaks +Outburst +Outbursts +Outcast +Outclass +Outcome +Outcomes +Outcrops +Outcry +Outdated +Outdoor +Outdoors +Outer +Outfield +Outfit +Outfits +Outflank +Outgoing +Outgrow +Outhouse +Outing +Outlast +Outlaw +Outlawed +Outlaws +Outlay +Outlays +Outlet +Outlets +Outline +Outlined +Outlines +Outlining +Outlook +Outlying +Outmatch +Outmost +Outnumber +Outplayed +Outpost +Outposts +Outpour +Output +Outputs +Outrage +Outraged +Outrank +Outreach +Outright +Outscore +Outsell +Outset +Outshine +Outshoot +Outside +Outsider +Outsiders +Outskirts +Outsmart +Outsource +Outspoken +Outtakes +Outthink +Outward +Outwardly +Outweigh +Outwit +Oval +Ovary +Oven +Overact +Overall +Overarch +Overbid +Overbill +Overbite +Overblown +Overboard +Overbook +Overbuilt +Overcame +Overcast +Overcoat +Overcome +Overcook +Overcrowd +Overdraft +Overdrawn +Overdress +Overdrive +Overdue +Overeager +Overeater +Overexert +Overfed +Overfeed +Overfill +Overflow +Overfull +Overgrown +Overhand +Overhang +Overhaul +Overhead +Overhear +Overheard +Overheat +Overhung +Overjoyed +Overkill +Overlabor +Overlaid +Overland +Overlap +Overlaps +Overlay +Overload +Overlook +Overlooks +Overlord +Overly +Overlying +Overnight +Overpass +Overpay +Overplant +Overplay +Overpower +Overprice +Overrate +Overreach +Overreact +Override +Overripe +Overrule +Overrun +Oversaw +Overseas +Oversee +Overseen +Oversees +Overshoot +Overshot +Oversight +Oversized +Oversleep +Oversold +Overspend +Overstate +Overstay +Overstep +Overstock +Overstuff +Oversweet +Overtake +Overtaken +Overthrow +Overtime +Overtly +Overtone +Overtones +Overtook +Overture +Overturn +Overuse +Overvalue +Overview +Overwhelm +Overwrite +Owe +Owes +Owl +Ownership +Oxen +Oxford +Oxidant +Oxidation +Oxides +Oxidize +Oxidized +Oxidizing +Oxygen +Oxymoron +Oyster +Oysters +Ozone +Paced +Pacemaker +Pacific +Pacifier +Pacifism +Pacifist +Pacify +Pack +Package +Packaged +Packages +Packaging +Packed +Packer +Packers +Packet +Packets +Packing +Packs +Pad +Padded +Padding +Paddle +Paddling +Padlock +Padre +Padres +Pads +Pagan +Pageant +Pager +Pages +Paging +Pagoda +Pain +Painful +Painfully +Pains +Paint +Painted +Painter +Painters +Painting +Paintings +Paints +Paisley +Pajamas +Palace +Palaces +Palatable +Palazzo +Pale +Paler +Palette +Palladium +Palm +Palms +Palpable +Palpitate +Paltry +Pampered +Pamperer +Pampers +Pamphlet +Pamphlets +Panama +Pancake +Pancreas +Panda +Pandemic +Pane +Panel +Panels +Pang +Panhandle +Panic +Panning +Panorama +Panoramic +Pantheon +Panther +Panthers +Panting +Pantomime +Pantry +Pants +Pantyhose +Pap +Papa +Papacy +Papal +Paparazzi +Papaya +Paper +Paperback +Paperwork +Paprika +Papyrus +Par +Parables +Parabola +Parachute +Parade +Parades +Paradigm +Paradigms +Paradise +Paradox +Paradoxes +Paragraph +Parakeet +Paralegal +Parallax +Parallel +Parallels +Paralyses +Paralysis +Paralyze +Paramedic +Parameter +Paramount +Parapet +Parasail +Parasite +Parasites +Parasitic +Parcel +Parcels +Parched +Parchment +Pardon +Pardoned +Parental +Parenting +Parish +Parishes +Parity +Parka +Parking +Parkway +Parlor +Parmesan +Parochial +Parodies +Parody +Parole +Parrot +Parry +Pars +Parsley +Parsnip +Parson +Parsons +Partake +Parted +Partially +Particle +Particles +Parties +Parting +Partisan +Partisans +Partition +Partizan +Partly +Partner +Partnered +Partners +Partridge +Party +Passable +Passably +Passage +Passages +Passcode +Passenger +Passerby +Passes +Passing +Passion +Passions +Passive +Passively +Passivism +Passivity +Passover +Passport +Passports +Password +Passwords +Past +Pasta +Paste +Pasted +Pastel +Pastime +Pastor +Pastoral +Pastors +Pastrami +Pastry +Pasture +Pastures +Pasty +Patches +Patchwork +Patchy +Patent +Patented +Patents +Paternal +Paternity +Path +Pathetic +Pathogen +Pathogens +Pathology +Pathos +Paths +Pathway +Pathways +Patience +Patient +Patients +Patio +Patriarch +Patriot +Patriotic +Patriots +Patrol +Patrolled +Patrols +Patron +Patronage +Patronize +Patrons +Patsy +Patted +Pattern +Patterned +Patterns +Patty +Paucity +Pauper +Pause +Paused +Pauses +Pausing +Paved +Pavement +Paver +Pavestone +Pavilion +Pavilions +Paving +Paw +Pawing +Paws +Payable +Payback +Paycheck +Payday +Payee +Payer +Paying +Payload +Payment +Payments +Payoff +Payphone +Payroll +Pays +Pea +Peace +Peaceful +Peacetime +Peach +Peaches +Peacock +Peaked +Peanut +Peanuts +Pearl +Pearls +Peas +Peasant +Peasantry +Peasants +Pebble +Pebbles +Pebbly +Pecan +Pectin +Pectoral +Peculiar +Pecuniary +Pedagogy +Pedal +Peddling +Pedestal +Pediatric +Pedicure +Pedigree +Pedometer +Peek +Peel +Peeled +Peeling +Peep +Peer +Peerage +Peered +Peering +Peers +Peg +Pegboard +Pelican +Pellet +Pellets +Pelt +Pelvic +Pelvis +Penalize +Penalties +Penalty +Penance +Pence +Pencil +Pencils +Pendant +Pending +Pendulum +Penguin +Penguins +Penholder +Peninsula +Penknife +Pennant +Penned +Penniless +Penny +Penpal +Pension +Pentagon +Pentagram +Peoples +Pep +Pepper +Peppers +Perceive +Perceived +Perceives +Percent +Perch +Perched +Percolate +Perennial +Perfected +Perfectly +Perform +Performed +Performer +Performs +Perfume +Perhaps +Peril +Perilous +Perils +Perimeter +Period +Periodic +Periods +Periphery +Periscope +Perish +Perished +Perjurer +Perjury +Perkiness +Perky +Perm +Permanent +Permeable +Permeated +Permit +Permits +Permitted +Peroxide +Perpetual +Perplexed +Persecute +Persevere +Persist +Persisted +Persists +Persona +Personnel +Persons +Persuade +Persuaded +Persuader +Persuades +Pertain +Pertains +Pertinent +Pervasive +Pesky +Peso +Pesos +Pessimism +Pessimist +Pester +Pesticide +Pests +Petal +Petals +Petite +Petition +Petri +Petrol +Petroleum +Petted +Petticoat +Pettiness +Petty +Petunia +Pew +Phage +Phantom +Pharaoh +Pharmacy +Phase +Phased +Phases +Phenomena +Phenotype +Philology +Phobia +Phoebe +Phoenix +Phonebook +Phoned +Phonetic +Phoney +Phonics +Phoniness +Phonology +Phony +Phosphate +Photo +Photocopy +Photon +Photons +Photos +Phrase +Phrases +Phrasing +Physician +Physicist +Physique +Pianist +Piano +Pianos +Piazza +Pick +Picked +Picket +Picking +Picks +Pickup +Picnic +Pictorial +Picture +Pictured +Pictures +Pie +Piecemeal +Pieces +Pierce +Pierced +Piercing +Piers +Piety +Pig +Pigeon +Pigeons +Pigment +Pigments +Pigs +Pilasters +Piles +Pilgrim +Pilgrims +Pillars +Pillow +Pillows +Pilot +Piloted +Pilots +Pinch +Pinched +Pineapple +Pink +Pinnacle +Pinned +Pinpoint +Pint +Pinto +Pioneer +Pioneered +Pioneers +Pipe +Pipeline +Pipelines +Piper +Pipes +Piping +Pirate +Pirates +Piston +Pistons +Pitch +Pitched +Pitcher +Pitchers +Pitches +Pitchfork +Pitching +Pitfalls +Pitiful +Pits +Pitted +Pituitary +Pity +Pivot +Pivotal +Pixel +Pixels +Pizza +Placard +Placate +Placebo +Placidly +Plainly +Plaintiff +Plan +Planar +Planet +Planetary +Planets +Plank +Planks +Planned +Planner +Planners +Planning +Plans +Plant +Planter +Planters +Planting +Plaque +Plaques +Plasma +Plaster +Plastic +Plastics +Plateau +Plated +Platelet +Platelets +Platform +Platforms +Plating +Platinum +Platonic +Platoon +Platter +Platypus +Plausible +Plausibly +Playable +Playback +Played +Player +Players +Playful +Playgroup +Playhouse +Playing +Playlist +Playmaker +Playmate +Playoff +Playoffs +Playpen +Playroom +Plays +Playset +Plaything +Playtime +Plaza +Plea +Plead +Pleaded +Pleading +Pleas +Pleased +Pleases +Pleasing +Pleasure +Pleasures +Pleat +Pledge +Pledged +Pledges +Plenary +Plentiful +Plenty +Plethora +Plexiglas +Plexus +Pliable +Plight +Plod +Plop +Plot +Plots +Plotted +Plotting +Plow +Ploy +Pluck +Plucked +Plug +Plugged +Plugs +Plum +Plumage +Plumbing +Plume +Plump +Plunder +Plundered +Plunge +Plunged +Plunging +Plural +Pluralism +Plurality +Plus +Plutonium +Plywood +Pneumatic +Poach +Pocket +Pockets +Pod +Podcast +Podcasts +Podium +Pods +Poem +Poems +Poet +Poetic +Poetical +Poetry +Poets +Pogo +Poignant +Pointed +Pointer +Pointers +Pointing +Pointless +Pointy +Poise +Poised +Poison +Poked +Poker +Poking +Polar +Polarity +Polarized +Pole +Poles +Police +Policeman +Policemen +Policies +Policing +Policy +Polio +Polish +Polished +Polishing +Polite +Politely +Politic +Political +Politics +Polity +Polka +Poll +Polled +Pollen +Polling +Polls +Pollutant +Polluted +Pollution +Polo +Polyester +Polygon +Polygraph +Polymer +Polymeric +Polymers +Poncho +Pond +Ponder +Pondered +Pony +Pool +Pooled +Pooling +Pools +Poor +Poorer +Poorest +Poorly +Pop +Popcorn +Pope +Popes +Poplar +Popped +Popper +Popping +Poppy +Pops +Popsicle +Populace +Popular +Popularly +Populate +Populated +Populist +Populous +Porcelain +Porch +Porcupine +Pore +Pork +Porous +Porridge +Portable +Portage +Portal +Portals +Portfolio +Porthole +Portico +Portion +Portly +Portrait +Portraits +Portray +Portrayal +Portrayed +Portrays +Portside +Poser +Posh +Posing +Positive +Positron +Posse +Possess +Possessed +Possesses +Possessor +Possible +Possibly +Possum +Postage +Postal +Postbox +Postcard +Postcards +Posted +Poster +Posterior +Posterity +Posters +Posting +Postnasal +Postnatal +Postpone +Postponed +Postulate +Posture +Postures +Postwar +Potassium +Potato +Potatoes +Potency +Potential +Potter +Pottery +Pouch +Poultry +Pounce +Pouncing +Pound +Pour +Poured +Pouring +Pout +Poverty +Powdered +Powdering +Powders +Powdery +Power +Powerful +Powerless +Powers +Powwow +Pox +Practiced +Practices +Pragmatic +Prairie +Praise +Praised +Praises +Praising +Prance +Prancing +Pranker +Prankish +Prankster +Prayer +Prayers +Praying +Preach +Preached +Preacher +Preachers +Preaching +Preachy +Preamble +Precede +Preceded +Precedent +Precedes +Preceding +Precepts +Precinct +Precious +Precise +Precisely +Precision +Preclude +Precluded +Precludes +Precook +Precursor +Precut +Predator +Predators +Predatory +Predefine +Predicate +Predict +Predicted +Predictor +Predicts +Preface +Prefect +Prefer +Preferred +Prefers +Prefix +Prefixes +Preflight +Preformed +Pregame +Pregnancy +Pregnant +Preheat +Preheated +Prejudice +Prelate +Prelaunch +Prelaw +Prelude +Premier +Premiere +Premiered +Premieres +Premiers +Premise +Premises +Premium +Premiums +Prenatal +Preoccupy +Preorder +Prep +Prepaid +Prepare +Prepares +Preparing +Prepay +Preplan +Preppy +Prequel +Preschool +Prescribe +Preseason +Presence +Presenter +Presently +Preserve +Preserved +Preserves +Preset +Preshow +Presided +President +Presiding +Presoak +Press +Pressure +Pressured +Pressures +Prestige +Presume +Presumed +Presuming +Pretend +Pretended +Pretender +Pretense +Pretext +Pretty +Pretzel +Prevail +Prevailed +Prevails +Prevalent +Prevent +Prevented +Prevents +Preview +Previews +Previous +Prewar +Prewashed +Prey +Price +Priced +Prices +Pricing +Pride +Prideful +Pried +Priest +Priestly +Priests +Primacy +Primal +Primaries +Primarily +Primary +Primate +Primates +Prime +Primer +Primers +Priming +Primitive +Primp +Prince +Princely +Princes +Princess +Principal +Principle +Print +Printers +Printing +Prior +Priority +Priory +Prism +Prison +Prisoner +Prisoners +Prisons +Prissy +Pristine +Privacy +Private +Privateer +Privately +Privatize +Privilege +Privy +Prize +Prized +Prizes +Pro +Proactive +Probable +Probably +Probate +Probation +Probe +Probed +Probes +Probing +Probiotic +Problem +Problems +Procedure +Proceed +Proceeded +Proceeds +Process +Processed +Processes +Processor +Proclaim +Proclaims +Proctor +Procure +Procured +Prod +Prodigal +Prodigy +Produce +Producer +Producers +Product +Products +Profane +Profanity +Profess +Professed +Professor +Profile +Profiled +Profiles +Profiling +Profits +Profound +Profusely +Profusion +Progeny +Prognosis +Program +Programs +Progress +Prohibit +Prohibits +Project +Projected +Projector +Projects +Prolific +Prologue +Prolong +Prolonged +Prom +Promenade +Prominent +Promo +Promote +Promoted +Promoter +Promoters +Promotes +Promoting +Promotion +Prompt +Prompted +Prompter +Prompting +Promptly +Prompts +Prone +Prong +Pronoun +Pronounce +Pronouns +Pronto +Proof +Proofing +Proofread +Proofs +Prop +Propagate +Propelled +Propeller +Properly +Property +Prophecy +Prophet +Prophetic +Prophets +Proponent +Proposal +Proposals +Propose +Proposed +Proposes +Proposing +Propped +Propriety +Props +Prorate +Prose +Prosecute +Prospect +Prospects +Prosper +Prospered +Protect +Protector +Protects +Protegee +Protein +Proteins +Protest +Protested +Protests +Protocol +Protocols +Proton +Protons +Prototype +Protozoan +Protract +Protrude +Proud +Proudly +Provable +Proved +Proven +Proverb +Proverbs +Provide +Provided +Provider +Providers +Provides +Providing +Province +Provinces +Proving +Provision +Provoke +Provoked +Provoking +Provolone +Provost +Prowess +Prowler +Prowling +Proximity +Proxy +Prude +Prudence +Prudent +Prudishly +Prune +Pruning +Pry +Psalm +Psalms +Pseudo +Pseudonym +Psyche +Psychic +Pub +Public +Publicity +Publicly +Publish +Publisher +Publishes +Pubs +Puck +Pucker +Pudding +Pueblo +Puff +Pug +Pull +Pulled +Pulling +Pulls +Pulmonary +Pulp +Pulpit +Pulsate +Pulse +Pulverize +Puma +Pumice +Pummel +Pump +Pumped +Pumping +Pumpkin +Pumps +Punch +Punched +Punches +Punctual +Punctuate +Puncture +Punctured +Pungent +Punish +Punished +Punisher +Punishing +Punitive +Punk +Punt +Pupil +Pupils +Puppet +Puppets +Puppy +Purchase +Purchased +Purchaser +Purchases +Purebred +Purely +Pureness +Purest +Purgatory +Purge +Purging +Purified +Purifier +Purify +Purist +Puritan +Puritans +Purity +Purple +Purplish +Purported +Purpose +Purposely +Purposes +Purr +Purse +Pursuable +Pursuant +Pursue +Pursued +Pursues +Pursuing +Pursuit +Pursuits +Purveyor +Push +Pushcart +Pushchair +Pushed +Pusher +Pushes +Pushiness +Pushing +Pushover +Pushpin +Pushup +Pushy +Putative +Putdown +Putt +Putting +Puzzle +Puzzled +Puzzles +Puzzling +Pyramid +Pyramidal +Pyramids +Pyromania +Python +Quack +Quadrant +Quadratic +Quadruple +Quail +Quaint +Quaintly +Quake +Quaking +Qualified +Qualifier +Qualifies +Qualify +Quality +Qualm +Quantify +Quantity +Quantum +Quark +Quarrel +Quarrels +Quarries +Quarry +Quart +Quartered +Quarterly +Quarters +Quartet +Quartz +Quasi +Quay +Queen +Queens +Quench +Quenching +Queries +Query +Question +Questions +Queue +Quick +Quicken +Quicker +Quickly +Quickness +Quicksand +Quickstep +Quiet +Quietly +Quill +Quilt +Quintet +Quintuple +Quirk +Quit +Quite +Quitting +Quiver +Quivering +Quiz +Quizzical +Quorum +Quota +Quotable +Quotas +Quotation +Quote +Quoted +Quotes +Quotient +Quoting +Rabbis +Rabbit +Rabbits +Rabid +Race +Racehorse +Racers +Racetrack +Racing +Rack +Racoon +Radar +Radars +Radial +Radiance +Radiant +Radiantly +Radiated +Radiating +Radiation +Radiator +Radical +Radically +Radicals +Radio +Radiology +Radios +Radish +Radius +Raffle +Raft +Rage +Ragged +Raging +Rags +Ragweed +Raided +Raider +Raiders +Raiding +Raids +Railcar +Railing +Railroad +Railroads +Railway +Railways +Rainbow +Rainfall +Rainy +Raisin +Rake +Raking +Rallied +Rallies +Rally +Rallying +Ramble +Rambling +Ramp +Rampage +Rampant +Ramrod +Ranch +Rancidity +Random +Randomly +Ranged +Ranger +Ranging +Ranked +Ranking +Rankings +Ransack +Ransom +Ranting +Rants +Rapid +Rapidity +Rapidly +Rapids +Rapper +Rappers +Rapport +Rapture +Rare +Rarely +Rarity +Rascal +Rash +Rasping +Rat +Rather +Ratings +Ratio +Rationale +Rationing +Ratios +Rats +Rattle +Rattled +Rattling +Ravage +Ravaged +Raven +Ravens +Ravine +Raving +Ravioli +Ravishing +Rayon +Razed +Razor +Reabsorb +Reach +Reacquire +React +Reacted +Reacting +Reaction +Reactions +Reactive +Reactor +Reactors +Reacts +Readable +Reader +Readers +Readily +Readiness +Readings +Reaffirm +Reagent +Reagents +Realism +Realist +Realities +Reality +Realize +Realized +Realizes +Realizing +Realm +Realms +Ream +Reanalyze +Reap +Reappear +Reapply +Reappoint +Reapprove +Rear +Reared +Rearing +Rearrange +Rearview +Reason +Reasoned +Reasoning +Reasons +Reassign +Reassure +Reassured +Reattach +Reawake +Rebalance +Rebate +Rebel +Rebelled +Rebellion +Rebels +Rebirth +Reboot +Reborn +Rebound +Rebounds +Rebuff +Rebuild +Rebuilt +Rebuke +Reburial +Rebuttal +Recall +Recalled +Recalling +Recalls +Recant +Recapture +Recast +Recede +Receipt +Receipts +Receive +Received +Receiver +Receivers +Receives +Receiving +Recent +Recently +Reception +Receptive +Receptor +Receptors +Recess +Recessed +Recession +Recessive +Recharger +Recipe +Recipes +Recipient +Recital +Recitals +Recite +Recited +Reciting +Reckless +Reckon +Reckoned +Reckoning +Reclaim +Reclaimed +Recliner +Reclining +Recluse +Reclusive +Recognize +Recoil +Recollect +Recolor +Recommend +Reconcile +Reconfirm +Reconvene +Recopy +Record +Recorded +Recorder +Recorders +Recording +Records +Recount +Recounted +Recounts +Recoup +Recourse +Recover +Recovered +Recovers +Recovery +Recreate +Recreated +Recruit +Recruited +Recruits +Rectangle +Rectified +Rectify +Rector +Rectory +Recur +Recurrent +Recurring +Recursive +Recycle +Recycled +Recycler +Recycling +Reddish +Redeem +Redeemed +Redefine +Redesign +Redress +Reds +Reduce +Reduced +Reduces +Reducing +Reduction +Redundant +Redwood +Reef +Reefs +Reel +Reelected +Reemerge +Reenact +Reenter +Reentry +Reeve +Reexamine +Referable +Referee +Referees +Reference +Referral +Referrals +Refill +Refinance +Refine +Refined +Refinery +Refining +Refinish +Reflect +Reflected +Reflector +Reflects +Reflex +Reflexes +Reflexive +Reflux +Refocus +Refold +Reforest +Reform +Reformat +Reformed +Reformer +Reformers +Reforming +Reformist +Reforms +Refract +Refrain +Refreeze +Refresh +Refried +Refs +Refueling +Refuge +Refugee +Refugees +Refund +Refurbish +Refurnish +Refusal +Refuse +Refused +Refuses +Refusing +Refutable +Refute +Regain +Regained +Regaining +Regal +Regalia +Regally +Regard +Regarded +Regarding +Regards +Regatta +Regency +Regent +Regents +Reggae +Regime +Regimen +Regimens +Regiment +Regiments +Regimes +Region +Regional +Regions +Register +Registers +Registrar +Registry +Regress +Regret +Regretful +Regrets +Regretted +Regroup +Regular +Regulars +Regulate +Regulated +Regulates +Regulator +Rehab +Rehearsal +Rehearsed +Reheat +Rehire +Rehydrate +Reigned +Reigning +Reigns +Reimburse +Reindeer +Reinforce +Reins +Reissue +Reissued +Reiterate +Reject +Rejected +Rejecting +Rejection +Rejects +Rejoice +Rejoiced +Rejoicing +Rejoin +Rejoined +Rekindle +Relapse +Relapsing +Relatable +Related +Relating +Relation +Relative +Relatives +Relax +Relaxed +Relaxing +Relay +Relays +Relearn +Release +Releases +Releasing +Relegated +Relenting +Relevance +Reliable +Reliably +Reliance +Reliant +Relic +Relics +Relied +Relief +Reliefs +Relies +Relieve +Relieved +Relieving +Relight +Religion +Religions +Religious +Relish +Relive +Reload +Relocate +Relocated +Relock +Reluctant +Rely +Relying +Remade +Remain +Remainder +Remained +Remaining +Remains +Remake +Remark +Remarked +Remarking +Remarks +Remarried +Remarry +Rematch +Remedial +Remedies +Remedy +Remember +Remembers +Remind +Reminded +Reminder +Reminders +Remindful +Reminding +Reminds +Remission +Remix +Remnant +Remnants +Remodeled +Remodeler +Remold +Remorse +Remote +Remotely +Removable +Removal +Remove +Removed +Remover +Removes +Removing +Rename +Renamed +Renaming +Render +Rendered +Renderer +Rendering +Renders +Rendition +Renegade +Renew +Renewable +Renewably +Renewal +Renewed +Renewing +Renounce +Renounced +Renovate +Renovated +Renovator +Renown +Renowned +Rentable +Rental +Rentals +Rented +Renter +Reoccupy +Reoccur +Reopen +Reopened +Reopening +Reorder +Repackage +Repacking +Repaint +Repair +Repaired +Repairing +Repairs +Repave +Repay +Repaying +Repayment +Repeal +Repealed +Repeat +Repeated +Repeater +Repeating +Repeats +Repelled +Repent +Repertory +Rephrase +Replace +Replaced +Replaces +Replacing +Replay +Replete +Replica +Replicas +Replicate +Replied +Replies +Reply +Report +Reported +Reporter +Reporters +Reporting +Reports +Repose +Repossess +Repost +Represent +Repressed +Reprimand +Reprint +Reprinted +Reprints +Reprise +Reprising +Reproach +Reprocess +Reproduce +Reprogram +Reps +Reptile +Reptiles +Reptilian +Republic +Republics +Repugnant +Repulsed +Repulsion +Repulsive +Repurpose +Reputable +Reputably +Reputed +Request +Requested +Requests +Requiem +Require +Required +Requires +Requiring +Requisite +Reread +Reroute +Rerouted +Rerun +Reruns +Resale +Resample +Rescinded +Rescue +Rescued +Rescuer +Rescues +Rescuing +Reseal +Research +Reselect +Reseller +Resemble +Resembled +Resembles +Resend +Resent +Resentful +Reservoir +Reset +Resettled +Reshape +Reshoot +Reshuffle +Reside +Residence +Residency +Resident +Resides +Residual +Residuals +Residue +Residues +Resign +Resigned +Resigning +Resilient +Resin +Resins +Resist +Resistant +Resisted +Resisting +Resistor +Resistors +Resists +Resize +Resolute +Resolve +Resolved +Resolves +Resolving +Resonance +Resonant +Resonate +Resort +Resorted +Resorting +Resorts +Resource +Resources +Respect +Respected +Respects +Respite +Response +Responses +Restart +Restarted +Restless +Restore +Restored +Restoring +Restrain +Restraint +Restrict +Restricts +Resubmit +Result +Resultant +Resulted +Resulting +Results +Resume +Resumes +Resuming +Resupply +Resurface +Resurrect +Retail +Retailer +Retailers +Retailing +Retain +Retained +Retainer +Retaining +Retains +Retake +Retaliate +Retention +Rethink +Retina +Retinal +Retire +Retired +Retiree +Retiring +Retold +Retool +Retorted +Retouch +Retrace +Retract +Retracted +Retrain +Retread +Retreat +Retreated +Retreats +Retrial +Retrieval +Retrieve +Retrieved +Retriever +Retry +Return +Returned +Returning +Returns +Retying +Retype +Reunion +Reunite +Reunited +Reuniting +Reusable +Reuse +Reused +Revamped +Reveal +Revealed +Revealing +Reveals +Reveler +Revenge +Revenue +Revenues +Reverb +Revered +Reverence +Reverend +Reversal +Reverse +Reversed +Reverses +Reversing +Reversion +Revert +Reverted +Reviewed +Reviewer +Reviewers +Reviewing +Revisable +Revise +Revised +Revising +Revision +Revisions +Revisit +Revisited +Revivable +Revival +Revive +Revived +Reviver +Reviving +Revocable +Revoke +Revoked +Revolt +Revolts +Revolve +Revolver +Revolves +Revolving +Reward +Rewarded +Rewarding +Rewards +Rewash +Rewind +Rewire +Reword +Rework +Reworked +Rewrap +Rewrite +Rewriting +Rewritten +Rhetoric +Rheumatic +Rhino +Rhinos +Rhyme +Rhymes +Rhythm +Rhythmic +Rhythms +Ribbon +Ribbons +Ribcage +Ribs +Rice +Richer +Riches +Richest +Richly +Richness +Rickety +Ricotta +Riddance +Ridden +Riddle +Ride +Rider +Riders +Ridicule +Ridiculed +Riding +Rifling +Rift +Rigging +Righteous +Rights +Rigid +Rigidity +Rigidly +Rigor +Rigorous +Rimless +Rimmed +Rind +Rink +Rinse +Rinsing +Riot +Rioting +Ripcord +Ripeness +Ripening +Ripping +Ripple +Rippling +Riptide +Rise +Rising +Risk +Risked +Risking +Risks +Risky +Risotto +Ritual +Rituals +Ritzy +Rival +Rivalries +Rivalry +Riverbank +Riverbed +Riverboat +Riverside +Riveter +Riveting +Roadside +Roadway +Roadways +Roam +Roamer +Roaming +Roar +Roared +Roaring +Roast +Roasted +Rob +Robbed +Robber +Robbers +Robbery +Robbing +Robe +Robin +Robins +Robot +Robotic +Robotics +Robots +Robust +Rockband +Rocked +Rocker +Rocket +Rockets +Rockfish +Rockiness +Rocking +Rocklike +Rocks +Rockslide +Rockstar +Rocky +Rodent +Rodents +Rodeo +Rods +Roe +Rogue +Roles +Roller +Rollers +Rolls +Roman +Romance +Romances +Romantic +Romp +Rooftop +Rookie +Roommate +Rooster +Roosters +Root +Rooted +Roots +Rope +Ropes +Roping +Rosary +Rosemary +Roses +Roster +Rosters +Rosy +Rotary +Rotate +Rotated +Rotates +Rotating +Rotation +Rotations +Rotor +Rotten +Rotting +Rotunda +Rouge +Roughly +Roughness +Roulette +Rounding +Roundish +Roundness +Roundup +Roundworm +Roused +Route +Router +Routes +Routine +Routinely +Routines +Routing +Rover +Rovers +Roving +Royal +Royalist +Royalists +Royals +Royalties +Royalty +Rubbed +Rubber +Rubbing +Rubbish +Rubble +Rubdown +Rubles +Rubric +Ruby +Ruckus +Rudder +Rug +Rugby +Ruin +Ruined +Rule +Ruled +Ruler +Rulers +Rules +Ruling +Rulings +Rumble +Rumbling +Rummage +Rumor +Rumored +Rumors +Runaround +Runaway +Rundown +Runner +Runners +Running +Runny +Runoff +Runt +Runway +Runways +Rupees +Rupture +Ruptured +Rural +Ruse +Rush +Rust +Rustic +Rusty +Rut +Ruthless +Rye +Sabbath +Sabotage +Sack +Sacked +Sacking +Sacks +Sacrament +Sacred +Sacrifice +Sad +Sadden +Saddle +Saddlebag +Saddled +Saddling +Sadly +Sadness +Safari +Safeguard +Safehouse +Safely +Safeness +Safer +Safest +Safety +Saffron +Saga +Sage +Sagging +Saggy +Said +Sail +Sailed +Sailing +Sailor +Sailors +Sails +Saint +Saints +Saith +Sake +Salad +Salads +Salami +Salaried +Salaries +Salary +Sales +Salesman +Salience +Salient +Saline +Salinity +Saliva +Sally +Salmon +Salon +Saloon +Salsa +Salt +Salts +Salty +Salutary +Salute +Salvage +Salvaged +Salvaging +Salvation +Samba +Same +Sample +Sampled +Samples +Sampling +Samurai +Sanction +Sanctions +Sanctity +Sanctuary +Sand +Sandal +Sandals +Sandbag +Sandbank +Sandbar +Sandblast +Sandbox +Sanded +Sanders +Sandfish +Sanding +Sandlot +Sandpaper +Sandpit +Sands +Sandstone +Sandstorm +Sandwich +Sandworm +Sandy +Sang +Sanitary +Sanitizer +Sank +Sans +Santa +Sap +Sapling +Sapphire +Sappiness +Sappy +Sarcasm +Sarcastic +Sardine +Sash +Sasquatch +Sassy +Sat +Satchel +Satellite +Satiable +Satin +Satire +Satirical +Satisfied +Satisfies +Satisfy +Saturate +Saturday +Sauce +Saucepan +Sauciness +Saucy +Sauna +Sausage +Savage +Savanna +Savannah +Save +Saved +Saves +Saving +Savings +Savior +Savor +Sawmill +Sawyer +Sax +Saxophone +Say +Saying +Sayings +Scabbed +Scabby +Scalar +Scalded +Scalding +Scale +Scaled +Scales +Scaling +Scallion +Scallop +Scalp +Scalping +Scam +Scan +Scandal +Scandals +Scanned +Scanner +Scanning +Scans +Scant +Scapegoat +Scar +Scarce +Scarcely +Scarcity +Scare +Scarecrow +Scared +Scarf +Scarily +Scariness +Scarlet +Scarred +Scarring +Scars +Scary +Scatter +Scattered +Scavenger +Scenario +Scenarios +Scenery +Scenes +Scenic +Scented +Schedule +Schedules +Schema +Schematic +Scheme +Schemes +Scheming +Schilling +Schism +Schnapps +Scholar +Scholarly +Scholars +School +Schoolboy +Schooling +Schools +Schooner +Science +Sciences +Scientist +Scion +Scissors +Scoff +Scolding +Scone +Scoop +Scooter +Scope +Scorch +Scorebook +Scorecard +Scored +Scoreless +Scorer +Scorers +Scoring +Scorn +Scorpion +Scotch +Scoundrel +Scoured +Scouring +Scout +Scouting +Scouts +Scowling +Scrabble +Scraggly +Scramble +Scrambled +Scrambler +Scrap +Scrape +Scraped +Scraping +Scrapped +Scrapping +Scraps +Scratch +Scratched +Scrawny +Scream +Screamed +Screaming +Screams +Screen +Screened +Screening +Screens +Screw +Screws +Scribble +Scribe +Scribing +Scrimmage +Script +Scripted +Scripture +Scroll +Scrolls +Scrooge +Scrounger +Scrub +Scrubbed +Scrubber +Scruffy +Scrunch +Scrutiny +Scuba +Scuff +Sculls +Sculpted +Sculptor +Sculptors +Sculpture +Scurvy +Scuttle +Sea +Seaboard +Seafood +Seal +Sealed +Sealing +Seals +Seam +Seaman +Seamen +Seams +Seaplane +Seaport +Sears +Seaside +Season +Seasonal +Seasoned +Seasons +Seat +Seated +Seating +Seats +Secession +Secluded +Secluding +Seclusion +Second +Secondary +Seconded +Secondly +Seconds +Secrecy +Secret +Secretary +Secrete +Secreted +Secretion +Secretly +Secrets +Sectarian +Sectional +Sector +Sectors +Secular +Secured +Securely +Securing +Security +Sedan +Sedate +Sedation +Sedative +Sedentary +Sedge +Sediment +Sediments +Seed +Seeded +Seeding +Seedlings +Seeds +Seek +Seeker +Seekers +Seeking +Seeks +Seem +Seemed +Seeming +Seemingly +Seems +Seer +Segment +Segmented +Segments +Seismic +Seize +Seized +Seizing +Seldom +Select +Selected +Selecting +Selection +Selective +Selector +Selects +Selenium +Self +Selfish +Sell +Sellers +Selling +Sells +Seltzer +Semantic +Semantics +Semester +Semi +Semicolon +Semifinal +Seminar +Seminars +Seminary +Semiotics +Semisoft +Semisweet +Senate +Senator +Senators +Send +Sender +Sending +Sends +Senior +Seniority +Seniors +Senorita +Sensation +Sensed +Senseless +Senses +Sensible +Sensing +Sensitive +Sensitize +Sensor +Sensors +Sensory +Sentence +Sentenced +Sentences +Sentiment +Sentinel +Sepals +Separate +Separated +Separates +Sepia +Septa +September +Septic +Septum +Sequel +Sequels +Sequence +Sequester +Serene +Serenity +Serge +Sergeant +Serial +Serials +Series +Serious +Seriously +Sermon +Sermons +Serotonin +Serpent +Serrated +Serum +Servant +Servants +Serve +Service +Serviced +Services +Servicing +Serving +Servings +Sesame +Sessions +Setback +Setbacks +Setting +Settings +Settle +Settler +Settlers +Settles +Settling +Setup +Seven +Sevenfold +Sevens +Seventeen +Seventh +Seventies +Seventy +Several +Severe +Severed +Severely +Severity +Sew +Sewage +Sewer +Sewing +Sewn +Shabby +Shack +Shade +Shaded +Shades +Shadily +Shadiness +Shading +Shadow +Shadows +Shadowy +Shady +Shaft +Shafts +Shakable +Shake +Shaken +Shaker +Shakes +Shakily +Shakiness +Shaking +Shaky +Shale +Shall +Shallot +Shallow +Shalt +Sham +Shaman +Shame +Shameful +Shampoo +Shamrock +Shanghai +Shank +Shanty +Shape +Shaped +Shapes +Shaping +Share +Shared +Shares +Sharing +Shark +Sharks +Sharp +Sharpened +Sharpener +Sharper +Sharpie +Sharply +Sharpness +Shattered +Shave +Shaved +Shaving +Shawl +Shear +Shearing +Sheath +Shed +Shedding +Sheds +Sheen +Sheep +Sheer +Sheet +Sheets +Shelf +Shell +Shellfish +Shelling +Shells +Shelter +Sheltered +Shelters +Shelve +Shelved +Shelves +Shelving +Shepherd +Shepherds +Sheriff +Sherry +Shield +Shielded +Shielding +Shields +Shifted +Shifter +Shifting +Shiftless +Shifts +Shifty +Shillings +Shimmer +Shimmy +Shin +Shindig +Shine +Shines +Shingle +Shininess +Shining +Shiny +Ship +Shipment +Shipments +Shipped +Shipping +Shipwreck +Shipyard +Shipyards +Shire +Shirt +Shirts +Shiver +Shivered +Shivering +Shoals +Shock +Shocked +Shocking +Shocks +Shoemaker +Shoes +Shone +Shook +Shootout +Shoots +Shoplift +Shopper +Shoppers +Shopping +Shoptalk +Shore +Shoreline +Shores +Short +Shortage +Shortages +Shortcake +Shortcut +Shorten +Shortened +Shorter +Shortest +Shorthand +Shortlist +Shortly +Shortness +Shorts +Shortstop +Shortwave +Shorty +Shots +Shoulder +Shoulders +Shout +Shouted +Shouting +Shouts +Shove +Shoved +Shovel +Show +Showbiz +Showcase +Showcased +Showcases +Showdown +Showed +Shower +Showers +Showgirl +Showing +Showman +Shown +Showoff +Showpiece +Showplace +Showroom +Shows +Showy +Shrank +Shrapnel +Shredded +Shredder +Shredding +Shrew +Shrewd +Shrewdly +Shriek +Shrill +Shrimp +Shrine +Shrines +Shrink +Shrinkage +Shrinking +Shrivel +Shrouded +Shrub +Shrubbery +Shrubs +Shrug +Shrugged +Shrunk +Shucking +Shudder +Shuddered +Shuffle +Shuffled +Shuffling +Shun +Shunt +Shush +Shut +Shutdown +Shutout +Shutouts +Shutter +Shutters +Shutting +Shuttle +Shy +Siamese +Siberian +Sibling +Siblings +Sick +Sickle +Sickly +Sickness +Sideline +Sidelined +Sidewalk +Sideways +Siding +Sidings +Siege +Sierra +Siesta +Sieve +Sift +Sigh +Sighed +Sighing +Sighs +Sighted +Sighting +Sightings +Sigma +Signal +Signaled +Signaling +Signals +Signature +Signified +Signifies +Signify +Signings +Silence +Silenced +Silencer +Silent +Silently +Silica +Silicate +Silicon +Silicone +Silk +Sill +Silliness +Silly +Silo +Silt +Silver +Similar +Similarly +Simile +Simmer +Simmering +Simple +Simpler +Simplest +Simplex +Simplify +Simply +Sims +Simulate +Simulated +Simulator +Simulcast +Since +Sincere +Sincerely +Sincerity +Sinful +Singer +Singers +Singing +Single +Singled +Singles +Singleton +Singly +Singular +Sinister +Sink +Sinking +Sinks +Sinless +Sinner +Sinners +Sinuous +Sinus +Sinuses +Sip +Sipped +Sipping +Sir +Siren +Sister +Sisters +Sitcom +Sitter +Sitting +Situated +Situation +Six +Sixfold +Sixteen +Sixteenth +Sixth +Sixties +Sixtieth +Sixty +Sixtyfold +Sizable +Sizably +Size +Sizeable +Sized +Sizes +Sizing +Sizzle +Sizzling +Skate +Skater +Skaters +Skating +Skedaddle +Skeletal +Skeleton +Skeletons +Skeptic +Skeptical +Sketch +Sketched +Sketches +Skewed +Skewer +Ski +Skid +Skied +Skier +Skies +Skiing +Skill +Skilled +Skillet +Skillful +Skills +Skim +Skimmed +Skimmer +Skimming +Skimpily +Skin +Skincare +Skinless +Skinned +Skinning +Skinny +Skins +Skintight +Skip +Skipped +Skipper +Skipping +Skirmish +Skirt +Skittle +Skull +Skulls +Sky +Skydiver +Skylight +Skyline +Skype +Skyrocket +Skyward +Slab +Slabs +Slack +Slacked +Slacker +Slacking +Slackness +Slacks +Slam +Slammed +Slander +Slang +Slant +Slap +Slapped +Slapping +Slapstick +Slash +Slashed +Slashing +Slate +Slather +Slaw +Slayer +Sled +Sleek +Sleep +Sleeper +Sleeping +Sleeps +Sleepy +Sleet +Sleeve +Sleeves +Slender +Slept +Slice +Sliceable +Sliced +Slicer +Slices +Slicing +Slick +Slid +Slider +Slideshow +Sliding +Slight +Slighted +Slightest +Slighting +Slightly +Slim +Slimness +Slimy +Sling +Slinging +Slingshot +Slinky +Slip +Slipped +Slippers +Slippery +Slipping +Slips +Slit +Sliver +Slobbery +Slogan +Slogans +Sloop +Slope +Sloped +Sloping +Sloppily +Sloppy +Slot +Slots +Slouching +Slouchy +Slough +Slow +Slowed +Slower +Slowing +Slowly +Slows +Sludge +Slug +Sluggish +Slum +Slump +Slumped +Slums +Slung +Slurp +Slush +Sly +Small +Smaller +Smallest +Smart +Smartly +Smartness +Smash +Smashed +Smasher +Smashing +Smashup +Smear +Smell +Smelled +Smelling +Smells +Smelting +Smile +Smiled +Smiles +Smiling +Smilingly +Smirk +Smite +Smith +Smitten +Smock +Smog +Smoke +Smoked +Smokeless +Smokers +Smokiness +Smoking +Smoky +Smolder +Smooth +Smoothed +Smoothing +Smoothly +Smother +Smudge +Smudgy +Smuggled +Smuggler +Smuggling +Smugly +Smugness +Snack +Snacks +Snagged +Snail +Snails +Snake +Snakes +Snaking +Snap +Snapped +Snapping +Snapshot +Snare +Snarl +Snatched +Snazzy +Sneak +Sneer +Sneeze +Sneezing +Snide +Sniff +Sniffed +Snippet +Snipping +Snitch +Snooker +Snooper +Snooze +Snore +Snoring +Snorkel +Snort +Snorted +Snout +Snow +Snowbird +Snowboard +Snowbound +Snowcap +Snowdrift +Snowdrop +Snowfall +Snowfield +Snowflake +Snowiness +Snowless +Snowman +Snowplow +Snowshoe +Snowstorm +Snowsuit +Snowy +Snub +Snuff +Snuggle +Snugly +Snugness +Soak +Soaked +Soaking +Soap +Soared +Soaring +Sob +Sobbing +Sober +Sobs +Soccer +Social +Socially +Societal +Societies +Society +Sociology +Socket +Sockets +Socks +Sod +Soda +Sodium +Sofa +Soft +Softball +Soften +Softened +Softening +Softer +Softly +Softness +Software +Soil +Soils +Sojourn +Solace +Solar +Sold +Solder +Soldier +Soldiers +Solely +Solemn +Solemnly +Solicit +Solicited +Solicitor +Solid +Solidly +Solids +Solitary +Solitude +Solo +Soloist +Soloists +Solos +Solvent +Solvents +Somber +Somebody +Someday +Somehow +Someone +Something +Sometime +Sometimes +Somewhat +Somewhere +Sonar +Sonata +Song +Songs +Sonnet +Sonnets +Sonny +Sooner +Soot +Soothe +Soothing +Sophomore +Soprano +Sore +Sores +Sorghum +Sorority +Sorrow +Sorrows +Sorry +Sorties +Sought +Soul +Souls +Sounded +Sounding +Sounds +Soup +Sour +Sourced +South +Southeast +Southern +Southward +Southwest +Souvenir +Sovereign +Soviet +Soviets +Sow +Sowing +Sown +Soy +Soybean +Spa +Spaced +Spaces +Spaceship +Spacing +Spacious +Spade +Spaghetti +Spanned +Spanning +Spans +Spare +Spared +Sparing +Spark +Sparked +Sparkling +Sparks +Sparrow +Sparse +Sparsely +Spartan +Spasm +Spat +Spatial +Spatially +Spawn +Spawned +Spawning +Speak +Speaker +Speakers +Speaking +Speaks +Spear +Spearfish +Spearhead +Spearman +Spearmint +Spears +Spec +Special +Specials +Specialty +Species +Specific +Specifics +Specifies +Specify +Specimen +Specimens +Specked +Speckled +Specks +Spectacle +Spectator +Spectra +Spectral +Spectrum +Speculate +Speech +Speeches +Speed +Speedily +Speeding +Speeds +Speedway +Speedy +Spell +Spellbind +Spelled +Speller +Spelling +Spellings +Spells +Spelt +Spend +Spendable +Spender +Spending +Spends +Spent +Spew +Sphere +Spheres +Spherical +Sphinx +Spicy +Spider +Spiders +Spied +Spies +Spiffy +Spike +Spikes +Spill +Spilled +Spilling +Spills +Spilt +Spin +Spinach +Spinal +Spindle +Spine +Spines +Spinner +Spinning +Spinout +Spins +Spinster +Spiny +Spiral +Spirit +Spirited +Spiritism +Spirits +Spiritual +Spit +Spitfire +Splash +Splashed +Splashing +Splashy +Splatter +Spleen +Splendid +Splendor +Splice +Splicing +Splinter +Split +Splits +Splitting +Splotchy +Splurge +Spoil +Spoilage +Spoiled +Spoiler +Spoiling +Spoils +Spoke +Spoken +Spokesman +Sponge +Spongy +Sponsor +Sponsored +Sponsors +Spoof +Spookily +Spooky +Spool +Spoon +Sporadic +Spore +Spores +Sporting +Sports +Sportsman +Sporty +Spot +Spotless +Spotlight +Spots +Spotted +Spotter +Spotting +Spotty +Spousal +Spouse +Spouses +Spout +Sprain +Sprang +Sprawl +Sprawling +Spray +Sprayed +Spraying +Spreading +Spreads +Spree +Sprig +Spring +Springing +Springs +Sprinkle +Sprinkled +Sprinkler +Sprint +Sprinter +Sprite +Sprout +Spruce +Sprung +Spry +Spud +Spun +Spur +Spurious +Spurred +Spurs +Sputter +Spy +Spyglass +Squabble +Squad +Squadron +Squadrons +Squads +Squall +Squander +Square +Squared +Squarely +Squares +Squash +Squat +Squatted +Squatter +Squatting +Squeak +Squealer +Squealing +Squeamish +Squeegee +Squeeze +Squeezed +Squeezing +Squid +Squiggle +Squiggly +Squint +Squire +Squirrel +Squirrels +Squirt +Squishier +Squishy +Stability +Stabilize +Stable +Stables +Stack +Stacked +Stacking +Stacks +Stadium +Stadiums +Staff +Staffed +Staffing +Staffs +Stage +Staged +Staggered +Staging +Stagnant +Stagnate +Stainable +Stained +Staining +Stainless +Stains +Stair +Staircase +Stairway +Stale +Stalemate +Staleness +Stalk +Stalks +Stalling +Stallion +Stalls +Stamens +Stamina +Stammer +Stamp +Stamped +Stampede +Stamping +Stamps +Stand +Standard +Standards +Standby +Standout +Stank +Stanza +Stanzas +Staple +Staples +Stapling +Starboard +Starch +Stardom +Stardust +Stare +Stared +Stares +Starfish +Stargazer +Staring +Stark +Starless +Starlet +Starlight +Starlit +Starred +Starring +Starry +Stars +Starship +Starter +Starters +Starting +Startle +Startled +Startling +Starts +Startup +Starve +Starved +Starving +Stash +Stat +State +Statehood +Stately +Statesman +Statesmen +Statewide +Static +Stating +Stationed +Statistic +Stats +Statue +Statues +Stature +Status +Statute +Statutes +Statutory +Staunch +Stayed +Staying +Stays +Steadfast +Steadier +Steadily +Steadying +Steak +Steal +Stealing +Steals +Stealth +Steam +Steamboat +Steamed +Steamer +Steamers +Steaming +Steamship +Steed +Steel +Steels +Steep +Steeply +Steer +Steerable +Steered +Steering +Steersman +Stegosaur +Stein +Stellar +Stem +Stemmed +Stemming +Stench +Stencil +Stent +Step +Steppe +Stepped +Stepping +Stereo +Sterile +Sterility +Sterilize +Sterling +Sternly +Sternness +Sternum +Stew +Steward +Stick +Sticking +Sticks +Sticky +Stiff +Stiffen +Stiffened +Stiffly +Stiffness +Stifle +Stifling +Stigma +Still +Stillness +Stills +Stilt +Stimulant +Stimulate +Stimuli +Stimulus +Stinger +Stingily +Stinging +Stingray +Stingy +Stinking +Stinky +Stint +Stints +Stipend +Stipulate +Stir +Stirred +Stirring +Stitch +Stitches +Stock +Stocked +Stocking +Stockings +Stocks +Stoic +Stoke +Stokes +Stole +Stolen +Stomach +Stomp +Stonewall +Stoneware +Stonework +Stoning +Stony +Stood +Stooge +Stool +Stools +Stoop +Stoplight +Stoppable +Stoppage +Stopped +Stopper +Stopping +Stops +Stopwatch +Storable +Storage +Storeroom +Stores +Storewide +Stories +Storm +Stormed +Stormy +Stout +Stove +Stowaway +Stowing +Straddle +Straggler +Straight +Strained +Strainer +Straining +Strains +Strait +Straits +Strand +Stranded +Strands +Strange +Strangely +Stranger +Strangers +Strap +Strapped +Straps +Strata +Strategic +Strategy +Stratum +Stratus +Straw +Stray +Streak +Streaks +Stream +Streamed +Streaming +Streams +Street +Streetcar +Streets +Strength +Strengths +Strenuous +Strep +Stress +Stressed +Stresses +Stressful +Stressing +Stretch +Stretches +Strewn +Stricken +Strict +Stricter +Strictly +Stride +Strides +Strife +Strike +Striker +Strikers +Strikes +Striking +Stringent +Strings +Stripe +Striped +Stripes +Stripped +Stripping +Strips +Strive +Strives +Striving +Strobe +Strode +Stroked +Strokes +Stroll +Strolled +Stroller +Strong +Strongbox +Stronger +Strongest +Strongly +Strongman +Strove +Struck +Structure +Strudel +Struggle +Struggled +Struggles +Strum +Strung +Strut +Stubbed +Stubble +Stubbly +Stubborn +Stucco +Stuck +Stud +Student +Students +Studied +Studies +Studio +Studios +Study +Studying +Stuff +Stuffed +Stuffing +Stuffy +Stumble +Stumbled +Stumbling +Stump +Stung +Stunned +Stunner +Stunning +Stunt +Stunts +Stupor +Sturdily +Sturdy +Sturgeon +Styled +Styling +Stylishly +Stylist +Stylistic +Stylized +Stylus +Suave +Sub +Subarctic +Subatomic +Subdivide +Subdued +Subduing +Subfloor +Subgroup +Subgroups +Subheader +Subject +Subjected +Subjects +Sublease +Sublet +Sublevel +Sublime +Submarine +Submerge +Submerged +Submersed +Submit +Submitted +Submitter +Subpanel +Subpar +Subplot +Subprime +Subscribe +Subscript +Subsector +Subset +Subsets +Subside +Subsided +Subsidies +Subsiding +Subsidize +Subsidy +Subsoil +Subsonic +Substance +Substrate +Subsumed +Subsystem +Subtext +Subtitle +Subtitled +Subtitles +Subtle +Subtlety +Subtly +Subtotal +Subtract +Subtype +Suburb +Suburban +Suburbs +Subway +Subwoofer +Subzero +Succeed +Succeeded +Succeeds +Success +Successes +Successor +Succulent +Succumb +Succumbed +Such +Sucrose +Suction +Sudden +Suddenly +Sudoku +Suds +Suffer +Suffered +Sufferer +Suffering +Suffers +Suffice +Suffix +Suffixes +Suffragan +Suffrage +Sugar +Sugarcane +Sugars +Suggest +Suggested +Suggests +Suing +Suitable +Suitably +Suitcase +Suite +Suited +Suites +Suitor +Sulfate +Sulfide +Sulfite +Sulfur +Sulk +Sullen +Sulphate +Sulphuric +Sultan +Sultanate +Sultry +Sum +Summaries +Summarize +Summary +Summed +Summers +Summing +Summit +Summits +Summon +Summoned +Summons +Sumo +Sums +Sun +Sundry +Sunflower +Sung +Sunk +Sunken +Sunlight +Sunny +Sunrise +Suns +Sunset +Sunshine +Sup +Super +Superb +Superbowl +Superglue +Superhero +Superior +Superiors +Superjet +Superman +Supermom +Supernova +Superstar +Supervise +Supine +Supper +Supplied +Supplier +Suppliers +Supplies +Supply +Supplying +Support +Supported +Supporter +Supports +Suppose +Supposed +Supposing +Suppress +Supreme +Surcharge +Surely +Sureness +Surf +Surface +Surfaced +Surfaces +Surfacing +Surfboard +Surfer +Surfing +Surge +Surgeon +Surgeons +Surgeries +Surgery +Surgical +Surging +Surname +Surnames +Surpass +Surpassed +Surplus +Surpluses +Surprise +Surprised +Surprises +Surreal +Surrender +Surrey +Surrogate +Surround +Surrounds +Survey +Surveyed +Surveying +Surveyor +Surveys +Survival +Survive +Survived +Survives +Surviving +Survivor +Survivors +Sushi +Suspect +Suspected +Suspects +Suspend +Suspended +Suspense +Suspicion +Sustain +Sustained +Sustainer +Sustains +Suture +Sutures +Swab +Swaddling +Swagger +Swallow +Swallowed +Swam +Swamp +Swampland +Swamps +Swan +Swans +Swap +Swapped +Swapping +Swarm +Sway +Swayed +Swaying +Swear +Swearing +Sweat +Sweater +Sweating +Sweep +Sweeping +Sweeps +Sweet +Sweetly +Sweets +Swell +Swelled +Swelling +Swept +Swerve +Swift +Swifter +Swiftly +Swiftness +Swim +Swimmable +Swimmer +Swimmers +Swimming +Swimsuit +Swimwear +Swine +Swing +Swinging +Swings +Swipe +Swirl +Swirling +Switch +Switched +Switches +Switching +Swivel +Swizzle +Swollen +Swooned +Swoop +Swoosh +Sword +Swords +Swore +Sworn +Swung +Sycamore +Syllable +Syllables +Syllabus +Symbiotic +Symbol +Symbolic +Symbolism +Symbolize +Symbols +Sympathy +Symphonic +Symphony +Symposium +Symptom +Symptoms +Synagogue +Synapse +Synapses +Sync +Syndicate +Syndrome +Syndromes +Synergy +Synod +Synonym +Synonyms +Synopses +Synopsis +Syntactic +Syntax +Synthesis +Synthetic +Syringe +Syrup +System +Systemic +T-shirt +Tabasco +Tabby +Tableful +Tables +Tablet +Tablets +Tableware +Tabloid +Taboos +Tabs +Tabulated +Tacit +Tackiness +Tacking +Tackle +Tackled +Tackles +Tackling +Tacky +Taco +Tactful +Tactic +Tactical +Tactics +Tactile +Tactless +Tadpole +Taekwondo +Tag +Tagged +Tags +Tailor +Tailored +Tainted +Take +Takeoff +Takeover +Taking +Talcum +Talent +Talented +Talents +Tales +Talisman +Talked +Talking +Tall +Taller +Tallest +Talon +Tamale +Tame +Tameness +Tamer +Tamper +Tandem +Tangent +Tangle +Tango +Tank +Tanker +Tankers +Tanks +Tanned +Tanner +Tannery +Tanning +Tantrum +Tap +Taped +Tapeless +Taper +Tapered +Tapering +Tapes +Tapestry +Tapioca +Tapped +Tapping +Taps +Tarantula +Target +Targeted +Targeting +Targets +Tariff +Tariffs +Tarmac +Tarnish +Tarot +Tartar +Tartly +Tartness +Task +Tasked +Tasks +Tassel +Taste +Tasted +Tastes +Tastiness +Tasting +Tasty +Tattered +Tattle +Tattling +Tattoo +Taught +Taunt +Taut +Tavern +Tax +Taxable +Taxation +Taxed +Taxes +Taxi +Taxing +Taxis +Taxonomic +Taxonomy +Taxpayer +Taxpayers +Tea +Teach +Teachers +Teaches +Teaching +Teachings +Teammate +Teammates +Teams +Teamwork +Tear +Tearing +Tears +Tease +Teased +Teaser +Teasing +Teaspoon +Teaspoons +Technical +Technique +Techno +Tedious +Teenage +Teenager +Teenagers +Teens +Teeth +Telegram +Telegraph +Telephone +Telescope +Televised +Telex +Tell +Telling +Tells +Temp +Temper +Temperate +Tempered +Tempest +Templates +Temple +Temples +Tempo +Temporal +Temps +Tendency +Tenderly +Tendon +Tendons +Tenets +Tennis +Tenor +Tens +Tensile +Tensor +Tentacles +Tentative +Tenth +Tenuous +Tenure +Term +Termed +Terminal +Terminals +Terminus +Terms +Terrace +Terraces +Terrain +Terrible +Terribly +Terrific +Terrified +Territory +Terry +Tertiary +Testament +Testified +Testifies +Testify +Testimony +Textbook +Textbooks +Textile +Textiles +Texture +Textured +Textures +Thank +Thanked +Thankful +Thanking +Thanks +That +Thatcher +Thaw +Theater +Theaters +Theatrics +Thee +Theft +Thematic +Theme +Themes +Thence +Theology +Theorem +Theorems +Theoretic +Theories +Theorist +Theorists +Theorize +Theorized +Theory +Therapies +Therapist +Therein +Thereupon +Thermal +Thermos +Thesaurus +These +Theses +Thesis +Thespian +Thick +Thicken +Thickened +Thicker +Thicket +Thickly +Thickness +Thief +Thieves +Thieving +Thievish +Thigh +Thighs +Thimble +Thin +Thing +Things +Think +Thinker +Thinkers +Thinks +Thinly +Thinner +Thinness +Thinning +Third +Thirdly +Thirds +Thirst +Thirstily +Thirsting +Thirsty +Thirteen +Thirties +Thirty +Thistle +Thorn +Thorns +Thorough +Those +Thought +Thoughts +Thousand +Thousands +Thrash +Thread +Threaded +Threads +Threat +Threaten +Threatens +Threats +Three +Threefold +Threshold +Threw +Thrift +Thrill +Thrilled +Thriller +Thrilling +Thrive +Thriving +Throat +Throats +Throne +Throng +Throttle +Throwaway +Throwback +Thrower +Throwing +Throws +Thud +Thumb +Thumbs +Thumping +Thunder +Thursday +Thus +Thwarted +Thwarting +Thyroid +Thyself +Tiara +Tibia +Ticket +Tickets +Tidal +Tidbit +Tide +Tides +Tidiness +Tidings +Tidy +Tie +Tier +Tiers +Tiger +Tigers +Tight +Tighten +Tightened +Tighter +Tightly +Tightness +Tightrope +Tightwad +Tigress +Tile +Tiling +Till +Tilt +Tilted +Tilting +Timber +Timbers +Timed +Timeless +Timeline +Timely +Timer +Timers +Timetable +Timid +Timing +Timothy +Tinderbox +Tinfoil +Tingle +Tingling +Tingly +Tinker +Tinkling +Tinsel +Tinsmith +Tint +Tinwork +Tiny +Tip +Tipoff +Tipped +Tipper +Tipping +Tiptoeing +Tiptop +Tires +Tiring +Tissue +Tissues +Titan +Titanic +Titanium +Titans +Title +Titular +Toad +Toast +Tobacco +Today +Toddler +Toddlers +Toe +Toes +Toil +Toilet +Toilets +Token +Tokens +Told +Tolerant +Tolerate +Tolerated +Tolls +Tomato +Tomatoes +Tomorrow +Tonal +Tong +Tongue +Tongues +Tonic +Tonight +Tonnage +Toolbar +Tooth +Topic +Topical +Topics +Topology +Torch +Torment +Tormented +Torn +Tornado +Tornadoes +Torpedo +Torpedoed +Torpedoes +Torque +Torrent +Torsion +Torso +Tort +Tortoise +Torts +Toss +Tossed +Tossing +Tot +Total +Totaled +Totaling +Totality +Totalling +Totally +Totals +Touch +Touchdown +Touches +Touching +Tough +Tougher +Toughness +Toured +Touring +Tourism +Tourist +Tourists +Touted +Toward +Towards +Towel +Towels +Tower +Towering +Towers +Towing +Towns +Township +Townships +Toxic +Toxicity +Toxin +Toxins +Toy +Toys +Trace +Traced +Tracer +Traces +Trachea +Tracing +Track +Tracked +Tracking +Traction +Tractor +Trade +Traded +Trademark +Trader +Traders +Trades +Trading +Tradition +Traffic +Tragedies +Tragedy +Tragic +Trail +Trailed +Trailer +Trailers +Trailing +Trails +Trailside +Train +Trainee +Trainees +Trainer +Trainers +Traitor +Traitors +Tram +Trams +Trance +Tranquil +Transcend +Transept +Transfer +Transfers +Transform +Transient +Transit +Translate +Transmit +Transmits +Transpire +Transport +Transpose +Trapdoor +Trapeze +Trapezoid +Trapped +Trapper +Trapping +Traps +Trash +Trauma +Traumatic +Travail +Travel +Traveled +Traveler +Travelers +Traveling +Travels +Traverse +Traversed +Traverses +Travesty +Tray +Treachery +Tread +Treading +Treadmill +Treason +Treasure +Treasurer +Treasures +Treasury +Treat +Treaties +Treatise +Treatises +Treatment +Treaty +Treble +Tree +Trees +Trek +Trekker +Tremble +Trembled +Trembling +Tremor +Trench +Trenches +Trend +Trends +Trespass +Triad +Triage +Trial +Trials +Triangle +Triangles +Triathlon +Tribal +Tribe +Tribes +Tribesman +Tribunal +Tribunals +Tribune +Tributary +Tribute +Triceps +Trick +Trickery +Trickily +Tricking +Trickle +Tricks +Trickster +Tricky +Tricolor +Tricycle +Trident +Tried +Trifle +Trifocals +Trigger +Triggered +Triggers +Trillion +Trilogy +Trim +Trimester +Trimmed +Trimmer +Trimming +Trimness +Trinity +Trio +Triple +Triples +Triplet +Tripod +Tripping +Triumph +Triumphs +Trivia +Trivial +Trodden +Trolley +Trolling +Trombone +Troop +Troopers +Troops +Trophies +Trophy +Tropical +Tropics +Trot +Trouble +Troubled +Troubles +Troubling +Trough +Troupe +Trousers +Trout +Trowel +Truce +Truck +Trucks +Truffle +Truly +Trump +Trumpet +Trumpeter +Trumpets +Truncated +Trunk +Trunks +Truss +Trust +Trustable +Trustee +Trustees +Trustful +Trusting +Trustless +Trusts +Truth +Truthful +Truths +Try +Trying +Tsar +Tsunami +Tub +Tubby +Tube +Tubeless +Tubes +Tubing +Tubular +Tucked +Tucker +Tucking +Tuesday +Tufts +Tug +Tugged +Tuition +Tulip +Tumble +Tumbling +Tummy +Tuna +Tundra +Tune +Tunes +Tungsten +Tunic +Tuning +Tunnel +Tunneling +Tunnels +Turban +Turbine +Turbines +Turbofan +Turbojet +Turbulent +Turf +Turkey +Turmoil +Turner +Turnout +Turnover +Turnpike +Turret +Turrets +Turtle +Turtles +Tusk +Tutelage +Tutor +Tutorial +Tutoring +Tutors +Tutu +Tux +Tweak +Tweed +Tweet +Tweeted +Tweezers +Twelfth +Twelve +Twenties +Twentieth +Twenty +Twerp +Twice +Twiddle +Twiddling +Twig +Twigs +Twilight +Twin +Twine +Twinned +Twins +Twirl +Twist +Twistable +Twisted +Twister +Twisting +Twists +Twisty +Twitch +Twitter +Twofold +Tycoon +Tying +Tyke +Typeface +Typhoon +Typically +Tyranny +Tyrant +Udder +Ulcer +Ulcers +Ultimate +Ultimatum +Ultra +Umbilical +Umbrella +Umpire +Umpires +Unabashed +Unable +Unadorned +Unadvised +Unafraid +Unaired +Unaligned +Unaltered +Unanimity +Unanimous +Unarmed +Unarmored +Unashamed +Unaudited +Unawake +Unaware +Unbaked +Unbalance +Unbeaten +Unbend +Unbent +Unbiased +Unbitten +Unblended +Unblessed +Unblock +Unbolted +Unbounded +Unboxed +Unbraided +Unbridle +Unbroken +Unbuckled +Unbundle +Unburned +Unbutton +Uncanny +Uncapped +Uncaring +Uncertain +Unchain +Unchanged +Uncharted +Uncheck +Uncivil +Unclad +Unclaimed +Unclamped +Unclasp +Uncle +Unclean +Unclear +Uncles +Unclip +Uncloak +Unclog +Unclothed +Uncoated +Uncoiled +Uncolored +Uncombed +Uncommon +Uncooked +Uncork +Uncorrupt +Uncounted +Uncouple +Uncouth +Uncover +Uncovered +Uncross +Uncrown +Uncrushed +Uncured +Uncurious +Uncurled +Uncut +Undamaged +Undated +Undaunted +Undead +Undecided +Undefined +Underarm +Undercoat +Undercook +Undercut +Underdog +Underdone +Underfed +Underfeed +Underfoot +Undergo +Undergoes +Undergone +Undergrad +Underhand +Underlie +Underlies +Underline +Underling +Undermine +Undermost +Underpaid +Underpass +Underpay +Underrate +Underside +Undertake +Undertone +Undertook +Undertow +Underuse +Underwear +Underwent +Underwire +Undesired +Undiluted +Undivided +Undo +Undocked +Undoing +Undone +Undrafted +Undress +Undrilled +Undue +Unduly +Undusted +Undying +Unearned +Unearth +Unearthed +Unease +Uneasily +Uneasy +Uneatable +Uneaten +Unedited +Unelected +Unending +Unengaged +Unenvied +Unequal +Unethical +Uneven +Unexpired +Unexposed +Unfailing +Unfair +Unfairly +Unfasten +Unfazed +Unfeeling +Unfiled +Unfilled +Unfit +Unfitted +Unfitting +Unfixable +Unfixed +Unflawed +Unfocused +Unfold +Unfolded +Unfolding +Unfolds +Unfounded +Unframed +Unfreeze +Unfrosted +Unfrozen +Unfunded +Unglazed +Ungloved +Unglue +Ungodly +Ungraded +Ungreased +Unguarded +Unguided +Unhappily +Unhappy +Unharmed +Unhealthy +Unheard +Unhearing +Unheated +Unhelpful +Unhidden +Unhinge +Unhitched +Unholy +Unhook +Unicorn +Unicycle +Unified +Unifier +Uniform +Uniformed +Uniformly +Uniforms +Unify +Unifying +Unimpeded +Uninjured +Uninstall +Uninsured +Uninvited +Union +Unions +Unique +Uniquely +Unisexual +Unison +Unissued +Unit +Unitary +Unites +Units +Universal +Universe +Unjust +Unjustly +Unkempt +Unkind +Unknotted +Unknowing +Unknown +Unlaced +Unlatch +Unlawful +Unleaded +Unlearned +Unleash +Unleashed +Unless +Unleveled +Unlighted +Unlikable +Unlike +Unlikely +Unlimited +Unlined +Unlinked +Unlisted +Unlit +Unlivable +Unloaded +Unloader +Unloading +Unlock +Unlocked +Unlocking +Unlovable +Unloved +Unlovely +Unloving +Unluckily +Unlucky +Unmade +Unmanaged +Unmanned +Unmapped +Unmarked +Unmarried +Unmasked +Unmasking +Unmatched +Unmindful +Unmixable +Unmixed +Unmolded +Unmoral +Unmovable +Unmoved +Unmoving +Unnamable +Unnamed +Unnatural +Unneeded +Unnerve +Unnerving +Unnoticed +Unopened +Unopposed +Unpack +Unpadded +Unpaid +Unpainted +Unpaired +Unpaved +Unpeeled +Unpicked +Unpiloted +Unpinned +Unplanned +Unplanted +Unpleased +Unpledged +Unplowed +Unplug +Unpopular +Unproven +Unquote +Unranked +Unrated +Unraveled +Unreached +Unread +Unreal +Unreeling +Unrefined +Unrelated +Unrented +Unrest +Unretired +Unrevised +Unrigged +Unripe +Unrivaled +Unroasted +Unrobed +Unroll +Unruffled +Unruly +Unrushed +Unsaddle +Unsafe +Unsaid +Unsalted +Unsaved +Unsavory +Unscathed +Unscented +Unscrew +Unsealed +Unseated +Unsecured +Unseeing +Unseemly +Unseen +Unselect +Unselfish +Unsent +Unsettled +Unshackle +Unshaken +Unshaved +Unshaven +Unsheathe +Unshipped +Unsightly +Unsigned +Unskilled +Unsliced +Unsmooth +Unsnap +Unsocial +Unsoiled +Unsold +Unsolved +Unsorted +Unspoiled +Unspoken +Unstable +Unstaffed +Unstamped +Unsteady +Unsterile +Unstirred +Unstitch +Unstopped +Unstuck +Unstuffed +Unstylish +Unsubtle +Unsubtly +Unsuited +Unsure +Unsworn +Untagged +Untainted +Untaken +Untamed +Untangled +Untapped +Untaxed +Untenable +Unthawed +Unthread +Untidy +Untie +Until +Untimed +Untimely +Untitled +Untoasted +Untold +Untouched +Untracked +Untrained +Untreated +Untried +Untrimmed +Untrue +Untruth +Unturned +Untwist +Untying +Unusable +Unused +Unusual +Unusually +Unvalued +Unvaried +Unvarying +Unveiled +Unveiling +Unvented +Unviable +Unvisited +Unvocal +Unwanted +Unwarlike +Unwary +Unwashed +Unwatched +Unweave +Unwed +Unwelcome +Unwell +Unwieldy +Unwilling +Unwind +Unwired +Unwise +Unwitting +Unwomanly +Unworldly +Unworn +Unworried +Unworthy +Unwound +Unwoven +Unwrapped +Unwritten +Unzip +Upbeat +Upchuck +Upcoming +Upcountry +Update +Updated +Updates +Updating +Upfront +Upgrade +Upgraded +Upgrades +Upgrading +Upheaval +Upheld +Uphill +Uphold +Upholding +Upkeep +Upland +Uplands +Uplift +Uplifted +Uplifting +Upload +Uploaded +Upon +Upper +Uppermost +Upright +Uprising +Uprisings +Upriver +Uproar +Uproot +Upscale +Upset +Upsetting +Upside +Upstage +Upstairs +Upstart +Upstate +Upstream +Upstroke +Upswing +Uptake +Uptight +Uptown +Upturned +Upward +Upwards +Upwind +Uranium +Urban +Urchin +Urea +Urethane +Urged +Urgency +Urgent +Urgently +Urges +Urging +Urologist +Urology +Usability +Usable +Usage +Usages +Useable +Used +Useful +Usefully +Useless +Uselessly +User +Usher +Ushered +Usual +Utensil +Utensils +Utilities +Utility +Utilize +Utilized +Utilizes +Utilizing +Utmost +Utopia +Utopian +Utter +Utterance +Utterly +Vacancies +Vacancy +Vacant +Vacate +Vacated +Vacation +Vacations +Vaccine +Vaccines +Vacuum +Vagabond +Vagrancy +Vagrantly +Vague +Vaguely +Vagueness +Vain +Valentine +Valiant +Valid +Validate +Validated +Validity +Valley +Valleys +Valor +Valuables +Value +Valued +Values +Valuing +Valve +Valves +Vampire +Vampires +Van +Vandalism +Vandals +Vanguard +Vanilla +Vanish +Vanished +Vanishes +Vanishing +Vanity +Vanquish +Vans +Vantage +Vapor +Vaporizer +Variable +Variables +Variably +Variance +Variances +Variants +Variation +Varied +Varieties +Variety +Various +Variously +Varmint +Varnish +Varsity +Varying +Vascular +Vase +Vaseline +Vases +Vassal +Vassals +Vast +Vastly +Vastness +Vat +Vault +Vaulted +Vaults +Veal +Vector +Vectors +Vegan +Vegetable +Veggie +Vehicle +Vehicles +Vehicular +Veil +Vein +Veins +Velcro +Velocity +Velvet +Vendetta +Vending +Vendor +Vendors +Veneer +Veneering +Venerable +Venerated +Vengeance +Vengeful +Venom +Venomous +Venous +Ventral +Ventricle +Venture +Ventured +Venue +Venus +Verbal +Verbalize +Verbally +Verbatim +Verbose +Verdict +Verified +Verify +Verifying +Veritable +Versatile +Verse +Version +Versus +Vertebrae +Vertebral +Vertex +Vertical +Vertices +Vertigo +Very +Vessel +Vessels +Vest +Veteran +Veterans +Veto +Vetoed +Vexingly +Via +Viability +Viable +Viaduct +Vibe +Vibes +Vibrant +Vibrating +Vibration +Vicar +Vicarious +Vice +Viceroy +Vicinity +Vicious +Victim +Victims +Victor +Victories +Victory +Video +Videos +Videotape +Viewable +Viewer +Viewing +Viewless +Viewpoint +Vigil +Vigilance +Vigilant +Vigor +Vigorous +Vile +Villa +Village +Villagers +Villages +Villain +Villains +Villas +Vindicate +Vinegar +Vines +Vineyard +Vineyards +Vintage +Vinyl +Viola +Violate +Violated +Violates +Violating +Violation +Violator +Violet +Violin +Violinist +Violins +Viper +Viral +Virtual +Virtually +Virtue +Virtues +Virtuous +Virulent +Virus +Viruses +Visa +Visas +Visceral +Viscosity +Viscount +Viscous +Viselike +Visible +Visibly +Vision +Visionary +Visit +Visiting +Visitor +Visitors +Visits +Visor +Vista +Visual +Visualize +Visually +Visuals +Vital +Vitality +Vitalize +Vitally +Vitamin +Vitamins +Vivacious +Vivid +Vividly +Vividness +Vixen +Vocal +Vocalist +Vocalists +Vocalize +Vocally +Vocals +Vocation +Vodka +Vogue +Voice +Voiced +Voices +Voicing +Void +Volatile +Volcanic +Volcano +Volcanoes +Volition +Volley +Vols +Voltage +Voltages +Volume +Volumes +Volunteer +Vortex +Voter +Voters +Votes +Voting +Voucher +Vow +Vowed +Vowel +Vowels +Vows +Voyage +Voyager +Voyages +Vulture +Wackiness +Wad +Wade +Wafer +Waffle +Waged +Wager +Wages +Waggle +Wagon +Wagons +Wailing +Waist +Waiter +Waitress +Waived +Waiver +Waivers +Wake +Wakes +Waking +Waldo +Wales +Walk +Walked +Walker +Walkers +Walking +Walks +Walkway +Walled +Wallet +Wallpaper +Walls +Walmart +Walnut +Walrus +Waltz +Wand +Wander +Wandered +Wanderers +Wandering +Waning +Wannabe +Wanted +Wanting +Wants +Warbler +Warden +Wardrobe +Warehouse +Wares +Warfare +Warlord +Warmed +Warmer +Warming +Warmly +Warmth +Warn +Warned +Warning +Warnings +Warns +Warp +Warrant +Warrants +Warranty +Warren +Warring +Warrior +Warriors +Wars +Warship +Warships +Wartime +Wary +Wasabi +Wash +Washable +Washbasin +Washboard +Washbowl +Washcloth +Washday +Washed +Washer +Washes +Washhouse +Washing +Washout +Washroom +Washstand +Washtub +Wasp +Wasps +Waste +Wasted +Wasteful +Wastes +Wasting +Watch +Watched +Watches +Watchful +Watching +Water +Watered +Waterfall +Watering +Watershed +Waterway +Waterways +Watery +Watt +Watts +Wave +Waved +Waveform +Waves +Waviness +Waving +Wavy +Wax +Weak +Weaken +Weakened +Weakening +Weaker +Weakest +Weakly +Weakness +Wealthy +Weariness +Wears +Weary +Weather +Weathered +Weave +Weaver +Weavers +Weaving +Web +Webs +Website +Websites +Wedding +Weddings +Wedge +Weeds +Week +Weekday +Weekdays +Weekend +Weekends +Weekly +Weeks +Weighed +Weighing +Weighs +Weighted +Weighting +Weights +Weird +Welcomed +Welcoming +Weld +Welded +Welding +Welfare +Welsh +Welt +Westbound +Westward +Westwards +Wet +Wetland +Wetlands +Wettest +Wetting +Whacking +Whacky +Whale +Whalers +Whales +Whaling +Wham +Wharf +Whatever +Wheat +Wheel +Wheelbase +Wheeled +Wheeler +Wheels +Whence +Whenever +Whereas +Wherefore +Wherein +Whereupon +Wherever +Whether +Whichever +Whiff +Whilst +Whim +Whimsical +Whinny +Whiny +Whip +Whipped +Whipping +Whirled +Whirling +Whiskey +Whisking +Whisper +Whispered +Whispers +Whistle +Whistler +Whistling +White +Whiteness +Whither +Whiting +Whitish +Whoever +Whole +Wholeness +Wholesale +Wholesome +Wholly +Whomever +Whoopee +Whooping +Whoops +Whorl +Why +Wick +Wicked +Wicket +Wickets +Widely +Widen +Widened +Widening +Wider +Widest +Widget +Widow +Widowed +Widows +Width +Widths +Wieldable +Wielder +Wife +Wifi +Wig +Wight +Wikipedia +Wild +Wildcard +Wildcat +Wildcats +Wilder +Wildfire +Wildfowl +Wildland +Wildlife +Wildly +Wildness +Willed +Willful +Willfully +Willing +Willingly +Willow +Willpower +Wills +Wilt +Wimp +Wince +Wincing +Wind +Winding +Windmill +Window +Windows +Winds +Windy +Winery +Wines +Wing +Winged +Winger +Wingspan +Wink +Winked +Winking +Winner +Winners +Winning +Winnings +Winter +Winters +Wipe +Wiped +Wiping +Wire +Wired +Wireless +Wires +Wiring +Wiry +Wisdom +Wise +Wisely +Wiser +Wish +Wished +Wishes +Wishing +Wisplike +Wispy +Wistful +Wit +Withdraw +Withdrawn +Withdrew +Withered +Withheld +Withhold +Withstand +Witnessed +Witnesses +Wits +Witty +Wizard +Wizards +Wobble +Wobbling +Wobbly +Woe +Wok +Wolf +Wolverine +Wolves +Womanhood +Womankind +Womanless +Womanlike +Womanly +Womb +Women +Won +Wonder +Wondered +Wonderful +Wondering +Wonders +Wondrous +Woo +Wooded +Wooden +Woodland +Woodlands +Woods +Woof +Wooing +Wool +Woozy +Word +Wording +Work +Workable +Workbook +Worker +Workflow +Workforce +Workings +Workload +Workman +Workmen +Workout +Workplace +Worksheet +Workshop +Workshops +Worldly +Worlds +Worldwide +Worm +Worms +Worried +Worrier +Worries +Worrisome +Worry +Worrying +Worse +Worsened +Worsening +Worship +Worshiper +Worst +Worth +Worthless +Wound +Wounded +Wounding +Wounds +Woven +Wow +Wrangle +Wrap +Wrapped +Wrapping +Wrath +Wreath +Wreckage +Wrecked +Wrecker +Wrecking +Wren +Wrench +Wrestle +Wrestled +Wrestler +Wrestlers +Wrestling +Wretched +Wriggle +Wriggly +Wrinkle +Wrinkled +Wrinkles +Wrinkly +Wrist +Wrists +Writ +Writes +Writing +Writings +Written +Wrong +Wrongdoer +Wronged +Wrongful +Wrongly +Wrongness +Wrongs +Wrote +Wrought +Xbox +Xerox +Yacht +Yachts +Yahoo +Yam +Yanked +Yanking +Yapping +Yard +Yarn +Yeah +Year +Yearbook +Yearling +Yearly +Yearning +Years +Yeast +Yell +Yelled +Yelling +Yellow +Yellowish +Yelp +Yen +Yesterday +Yet +Yiddish +Yield +Yielded +Yielding +Yields +Yin +Yippee +Yo-yo +Yodel +Yoga +Yogurt +Yoke +Yolk +Yonder +Young +Younger +Youngest +Youngster +Youth +Youthful +Youths +Yoyo +Yummy +Zap +Zeal +Zealous +Zebra +Zen +Zenith +Zeppelin +Zero +Zeros +Zestfully +Zesty +Zeta +Zigzagged +Zinc +Zip +Zipfile +Zipping +Zippy +Zips +Zit +Zodiac +Zombie +Zombies +Zone +Zoned +Zones +Zoning +Zoo +Zookeeper +Zoologist +Zoology Zoom \ No newline at end of file diff --git a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Applications/Push-GetApplicationQueue.ps1 b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Applications/Push-GetApplicationQueue.ps1 index 91665837d1..b85431441d 100644 --- a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Applications/Push-GetApplicationQueue.ps1 +++ b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Applications/Push-GetApplicationQueue.ps1 @@ -1,5 +1,5 @@ function Push-GetApplicationQueue { param() $Table = Get-CippTable -tablename 'apps' - Get-CIPPAzDataTableEntity @Table | Select-Object @{Name = 'Name'; Expression = { $_.RowKey } }, @{Name = 'FunctionName'; Expression = { 'UploadApplication' } } + Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'apps'" | Select-Object @{Name = 'Name'; Expression = { $_.RowKey } }, @{Name = 'FunctionName'; Expression = { 'UploadApplication' } } } diff --git a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Applications/Push-UploadApplication.ps1 b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Applications/Push-UploadApplication.ps1 index db5b1bbfb3..d7a3a4a5da 100644 --- a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Applications/Push-UploadApplication.ps1 +++ b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Applications/Push-UploadApplication.ps1 @@ -11,11 +11,14 @@ function Push-UploadApplication { $Filter = "PartitionKey eq 'apps' and RowKey eq '$($Item.Name)'" $AppConfig = (Get-CIPPAzDataTableEntity @Table -filter $Filter).JSON | ConvertFrom-Json + $intuneBody = $AppConfig.IntuneBody $tenants = if ($AppConfig.tenant -eq 'AllTenants') { (Get-Tenants -IncludeErrors).defaultDomainName } else { $AppConfig.tenant } + $assignTo = $AppConfig.assignTo + $AssignToIntent = $AppConfig.InstallationIntent $ClearRow = Get-CIPPAzDataTableEntity @Table -Filter $Filter if ($AppConfig.tenant -ne 'AllTenants') { $null = Remove-CIPPAzDataTableEntity -Force @Table -Entity $clearRow @@ -29,9 +32,142 @@ function Push-UploadApplication { } } + # Determine app type (default to 'Choco' if not specified) + $AppType = if ($AppConfig.type) { $AppConfig.type } else { 'Choco' } + + # Load files based on app type (only for types that need them) + $Intunexml = $null + $Infile = $null + if ($AppType -eq 'MSPApp') { + [xml]$Intunexml = Get-Content (Join-Path $env:CIPPRootPath "AddMSPApp\$($AppConfig.MSPAppName).app.xml") + $Infile = Join-Path $env:CIPPRootPath "AddMSPApp\$($AppConfig.MSPAppName).intunewin" + } elseif ($AppType -in @('Choco', 'Win32ScriptApp')) { + [xml]$Intunexml = Get-Content (Join-Path $env:CIPPRootPath 'AddChocoApp\Choco.App.xml') + $Infile = Join-Path $env:CIPPRootPath "AddChocoApp\$($Intunexml.ApplicationInfo.FileName)" + } + + + $baseuri = 'https://graph.microsoft.com/beta/deviceAppManagement/mobileApps' foreach ($tenant in $tenants) { try { - $NewApp = New-CIPPIntuneAppDeployment -AppConfig $AppConfig -TenantFilter $tenant -APIName 'AppUpload' + # Check if app already exists + $ApplicationList = New-GraphGetRequest -Uri $baseuri -tenantid $tenant | Where-Object { $_.DisplayName -eq $AppConfig.Applicationname -and ($_.'@odata.type' -eq '#microsoft.graph.win32LobApp' -or $_.'@odata.type' -eq '#microsoft.graph.winGetApp') } + if ($ApplicationList.displayname.count -ge 1) { + Write-LogMessage -api 'AppUpload' -tenant $tenant -message "$($AppConfig.Applicationname) exists. Skipping this application" -Sev 'Info' + continue + } + + # Route to appropriate handler based on app type + $NewApp = $null + switch ($AppType) { + 'WinGet' { + $NewApp = Add-CIPPWinGetApp -AppBody $intuneBody -TenantFilter $tenant + } + 'Choco' { + # Prepare encryption info from XML + $EncryptionInfo = @{ + EncryptionKey = $Intunexml.ApplicationInfo.EncryptionInfo.EncryptionKey + MacKey = $Intunexml.ApplicationInfo.EncryptionInfo.MacKey + InitializationVector = $Intunexml.ApplicationInfo.EncryptionInfo.InitializationVector + Mac = $Intunexml.ApplicationInfo.EncryptionInfo.Mac + ProfileIdentifier = $Intunexml.ApplicationInfo.EncryptionInfo.ProfileIdentifier + FileDigest = $Intunexml.ApplicationInfo.EncryptionInfo.FileDigest + FileDigestAlgorithm = $Intunexml.ApplicationInfo.EncryptionInfo.FileDigestAlgorithm + } + + # Build parameters dynamically + $Params = @{ + AppBody = $intuneBody + TenantFilter = $tenant + FilePath = $Infile + FileName = $Intunexml.ApplicationInfo.FileName + UnencryptedSize = [int64]$Intunexml.ApplicationInfo.UnencryptedContentSize + EncryptionInfo = $EncryptionInfo + } + if ($AppConfig.Applicationname) { $Params.DisplayName = $AppConfig.Applicationname } + + $NewApp = Add-CIPPPackagedApplication @Params + } + 'MSPApp' { + # Prepare encryption info from XML + $EncryptionInfo = @{ + EncryptionKey = $Intunexml.ApplicationInfo.EncryptionInfo.EncryptionKey + MacKey = $Intunexml.ApplicationInfo.EncryptionInfo.MacKey + InitializationVector = $Intunexml.ApplicationInfo.EncryptionInfo.InitializationVector + Mac = $Intunexml.ApplicationInfo.EncryptionInfo.Mac + ProfileIdentifier = $Intunexml.ApplicationInfo.EncryptionInfo.ProfileIdentifier + FileDigest = $Intunexml.ApplicationInfo.EncryptionInfo.FileDigest + FileDigestAlgorithm = $Intunexml.ApplicationInfo.EncryptionInfo.FileDigestAlgorithm + } + + # Build parameters dynamically + $Params = @{ + AppBody = $intuneBody + TenantFilter = $tenant + FilePath = $Infile + FileName = $Intunexml.ApplicationInfo.FileName + UnencryptedSize = [int64]$Intunexml.ApplicationInfo.UnencryptedContentSize + EncryptionInfo = $EncryptionInfo + } + if ($AppConfig.Applicationname) { $Params.DisplayName = $AppConfig.Applicationname } + + $NewApp = Add-CIPPPackagedApplication @Params + } + 'Win32ScriptApp' { + # Prepare encryption info from XML + $EncryptionInfo = @{ + EncryptionKey = $Intunexml.ApplicationInfo.EncryptionInfo.EncryptionKey + MacKey = $Intunexml.ApplicationInfo.EncryptionInfo.MacKey + InitializationVector = $Intunexml.ApplicationInfo.EncryptionInfo.InitializationVector + Mac = $Intunexml.ApplicationInfo.EncryptionInfo.Mac + ProfileIdentifier = $Intunexml.ApplicationInfo.EncryptionInfo.ProfileIdentifier + FileDigest = $Intunexml.ApplicationInfo.EncryptionInfo.FileDigest + FileDigestAlgorithm = $Intunexml.ApplicationInfo.EncryptionInfo.FileDigestAlgorithm + } + + # Build properties dynamically + $Properties = @{ + displayName = $AppConfig.Applicationname + installScript = $AppConfig.installScript + } + + # A few of these are probably mandatory + if ($AppConfig.description) { $Properties['description'] = $AppConfig.description } + if ($AppConfig.publisher) { $Properties['publisher'] = $AppConfig.publisher } + if ($AppConfig.uninstallScript) { $Properties['uninstallScript'] = $AppConfig.uninstallScript } + if ($AppConfig.detectionScript) { $Properties['detectionScript'] = $AppConfig.detectionScript } + if ($AppConfig.detectionPath) { $Properties['detectionPath'] = $AppConfig.detectionPath } + if ($AppConfig.detectionFile) { $Properties['detectionFile'] = $AppConfig.detectionFile } + if ($AppConfig.runAsAccount) { $Properties['runAsAccount'] = $AppConfig.runAsAccount } + if ($AppConfig.deviceRestartBehavior) { $Properties['deviceRestartBehavior'] = $AppConfig.deviceRestartBehavior } + if ($null -ne $AppConfig.runAs32Bit) { $Properties['runAs32Bit'] = $AppConfig.runAs32Bit } + if ($null -ne $AppConfig.enforceSignatureCheck) { $Properties['enforceSignatureCheck'] = $AppConfig.enforceSignatureCheck } + + $NewApp = Add-CIPPW32ScriptApplication -TenantFilter $tenant -Properties ([PSCustomObject]$Properties) + } + 'WinGetNew' { + # I think we don't need a separate WinGetNew type, just use WinGet? + } + default { + throw "Unsupported app type: $($AppConfig.type)" + } + } + + # Log success and assign app if requested + if ($NewApp) { + Write-LogMessage -api 'AppUpload' -tenant $tenant -message "$($AppConfig.Applicationname) Successfully created" -Sev 'Info' + + if ($assignTo -and $assignTo -ne 'On') { + $intent = if ($AssignToIntent) { 'Uninstall' } else { 'Required' } + $AppTypeForAssignment = switch ($AppType) { + 'WinGet' { 'WinGet' } + 'WinGetNew' { 'WinGet' } + default { 'Win32Lob' } + } + Start-Sleep -Milliseconds 200 + Set-CIPPAssignedApplication -ApplicationId $NewApp.Id -TenantFilter $tenant -groupName $assignTo -Intent $intent -AppType $AppTypeForAssignment -APIName 'AppUpload' + } + } } catch { "Failed to add Application for $tenant : $($_.Exception.Message)" Write-LogMessage -api 'AppUpload' -tenant $tenant -message "Failed adding Application $($AppConfig.Applicationname). Error: $($_.Exception.Message)" -LogData (Get-CippException -Exception $_) -Sev 'Error' diff --git a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BEC/Push-BECRun.ps1 b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BEC/Push-BECRun.ps1 index 867a2f4e0e..6792f81793 100644 --- a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BEC/Push-BECRun.ps1 +++ b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BEC/Push-BECRun.ps1 @@ -59,6 +59,15 @@ function Push-BECRun { } $Heuristics = Get-CIPPBecHeuristics $WindowDays = [int]($Heuristics.window.days ?? 7) + # Entra ID P1/P2 keep sign-in and directory audit logs for 30 days, so those tenants get the longer window. + try { + $RunCapabilities = Get-CIPPTenantCapabilities -TenantFilter $TenantFilter + if ($RunCapabilities.AAD_PREMIUM -eq $true -or $RunCapabilities.AAD_PREMIUM_P2 -eq $true) { + $WindowDays = [int]($Heuristics.window.premiumDays ?? $WindowDays) + } + } catch { + Write-Information "BEC: could not read tenant plans for $TenantFilter, using the $WindowDays-day window: $($_.Exception.Message)" + } $endDate = (Get-Date).ToUniversalTime() $startDate = $endDate.AddDays(-$WindowDays) # a retry of the first phase starts clean, never on a dead attempt's state diff --git a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserTenant.ps1 b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserTenant.ps1 index 990dc3ef78..355e20c05e 100644 --- a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserTenant.ps1 +++ b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserTenant.ps1 @@ -97,8 +97,8 @@ function Push-DomainAnalyserTenant { } if ($OldDomain) { - $Domain.DkimSelectors = $OldDomain.DkimSelectors - $Domain.MailProviders = $OldDomain.MailProviders + $DomainObject.DkimSelectors = $OldDomain.DkimSelectors + $DomainObject.MailProviders = $OldDomain.MailProviders } } else { $Domain.TenantDetails = $TenantDetails diff --git a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Graph Requests/Push-ListGraphRequestQueue.ps1 b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Graph Requests/Push-ListGraphRequestQueue.ps1 index acaf391492..84bf05332d 100644 --- a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Graph Requests/Push-ListGraphRequestQueue.ps1 +++ b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Graph Requests/Push-ListGraphRequestQueue.ps1 @@ -58,7 +58,7 @@ function Push-ListGraphRequestQueue { $CippException = Get-CippException -Exception $_.Exception [PSCustomObject]@{ Tenant = $Item.TenantFilter - CippStatus = "Could not connect to tenant. $($CippException.NormalizedError)" + CippStatus = "Could not connect to tenant. $($CippException.NormalizedMessage)" CippException = [string]($CippException | ConvertTo-Json -Depth 10 -Compress) } } diff --git a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Maintenance/Push-TableCleanupTask.ps1 b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Maintenance/Push-TableCleanupTask.ps1 index 3d610ace04..d482a15cdb 100644 --- a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Maintenance/Push-TableCleanupTask.ps1 +++ b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Maintenance/Push-TableCleanupTask.ps1 @@ -10,21 +10,20 @@ function Push-TableCleanupTask { if ($PSCmdlet.ShouldProcess('Start-TableCleanup', 'Starting Table Cleanup')) { if ($Type -eq 'DeleteTable') { $DeleteTables = $Item.Tables - foreach ($Table in $DeleteTables) { + foreach ($TableName in $DeleteTables) { try { - $Table = Get-CIPPTable -tablename $Table + $Table = Get-CIPPTable -tablename $TableName if ($Table) { Write-Information "Deleting table $($Table.Context.TableName)" try { Remove-AzDataTable -Context $Table.Context - # Drop it from the Get-CIPPTable cache so it gets recreated on next use. Unregister-CIPPTable -TableName $Table.Context.TableName } catch { #Write-LogMessage -API 'TableCleanup' -message "Failed to delete table $($Table.Context.TableName)" -sev Error -LogData (Get-CippException -Exception $_) } } } catch { - Write-Information "Table $Table not found" + Write-Information "Table $TableName not found" } } Write-Information "#### $($Type) task complete for $($Item.TableName)" diff --git a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1 b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1 index 188eecb36f..1da5b828d2 100644 --- a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1 +++ b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1 @@ -83,7 +83,7 @@ function Push-CIPPDBCacheData { $SharePointCapable = $false try { - $SharePointCapable = Test-CIPPStandardLicense -StandardName 'SharePointLicenseCheck' -TenantFilter $TenantFilter -Preset SharePoint -SkipLog + $SharePointCapable = Test-CIPPStandardLicense -StandardName 'SharePointLicenseCheck' -TenantFilter $TenantFilter -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE') -SkipLog } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "SharePoint license check failed: $($_.Exception.Message)" -sev Warning -LogData $ErrorMessage @@ -119,7 +119,6 @@ function Push-CIPPDBCacheData { QueueId = $QueueId QueueName = "DB Cache Graph - $TenantFilter" }) - # MFAState runs as its own activity — it makes 6+ API calls, bulk group/role member # resolution, and O(users × policies) CPU work that can take minutes on large tenants $Tasks.Add(@{ diff --git a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-DeployIntegrationApp.ps1 b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-DeployIntegrationApp.ps1 new file mode 100644 index 0000000000..b90aeb9651 --- /dev/null +++ b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-DeployIntegrationApp.ps1 @@ -0,0 +1,205 @@ +function Push-DeployIntegrationApp { + <# + .FUNCTIONALITY + Entrypoint + #> + param($Item) + + Write-LogMessage -API 'Deploy Integration App' -message "Push-DeployIntegrationApp started with item: $($Item | ConvertTo-Json -Depth 5 -Compress)" -Sev 'Debug' + + try { + $Item = $Item | ConvertTo-Json -Depth 10 | ConvertFrom-Json + $TenantFilter = $Item.Tenant + $TenantName = $Item.TenantName + $DeploymentId = $Item.DeploymentId + $TemplateName = $Item.TemplateName + + Write-LogMessage -API 'Deploy Integration App' -tenant $TenantFilter -message "Starting deployment of '$TemplateName' (DeploymentId: $DeploymentId)" -Sev 'Info' + Write-Information "Deploying integration app '$TemplateName' to tenant $TenantFilter" + + # Get tenant info for the app name pattern + $TenantInfo = Get-Tenants -TenantFilter $TenantFilter + $DisplayTenantName = $TenantName + if ($TenantInfo.displayName) { + $DisplayTenantName = $TenantInfo.displayName + } + + # Build app display name from pattern + $AppDisplayName = $Item.AppNamePattern -replace '\{TenantName\}', $DisplayTenantName + + # Build requiredResourceAccess from template permissions + $RequiredResourceAccess = @() + foreach ($Resource in $Item.Permissions) { + $ResourceAccess = @() + foreach ($Perm in $Resource.permissions) { + $ResourceAccess += @{ + id = $Perm.id + type = $Perm.type + } + } + $RequiredResourceAccess += @{ + resourceAppId = $Resource.resourceAppId + resourceAccess = $ResourceAccess + } + } + + # Check if app already exists + $ExistingApps = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications?`$filter=displayName eq '$AppDisplayName'" -tenantid $TenantFilter -AsApp $true + if ($ExistingApps.value -and $ExistingApps.value.Count -gt 0) { + $ExistingApp = $ExistingApps.value[0] + Write-LogMessage -message "Application '$AppDisplayName' already exists in tenant $TenantFilter. Updating permissions." -tenant $TenantFilter -API 'Deploy Integration App' -sev Info + + # Update existing app's permissions + $UpdateBody = @{ + requiredResourceAccess = $RequiredResourceAccess + } | ConvertTo-Json -Depth 10 + $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/applications/$($ExistingApp.id)" -type PATCH -tenantid $TenantFilter -body $UpdateBody -AsApp $true + + $AppId = $ExistingApp.appId + $AppObjectId = $ExistingApp.id + + # Check for existing service principal + $ServicePrincipal = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/servicePrincipals?`$filter=appId eq '$AppId'" -tenantid $TenantFilter -AsApp $true + if (-not $ServicePrincipal.value -or $ServicePrincipal.value.Count -eq 0) { + $SPBody = @{ appId = $AppId } | ConvertTo-Json + $ServicePrincipal = New-GraphPostRequest -uri 'https://graph.microsoft.com/v1.0/servicePrincipals' -type POST -tenantid $TenantFilter -body $SPBody -AsApp $true + $ServicePrincipalId = $ServicePrincipal.id + } else { + $ServicePrincipalId = $ServicePrincipal.value[0].id + } + } else { + # Create new application + $AppBody = @{ + displayName = $AppDisplayName + signInAudience = 'AzureADMyOrg' + requiredResourceAccess = $RequiredResourceAccess + } + + # Add redirect URIs if specified + if ($Item.RedirectUris -and $Item.RedirectUris.Count -gt 0) { + $AppBody.web = @{ + redirectUris = $Item.RedirectUris + } + } + + $AppBodyJson = $AppBody | ConvertTo-Json -Depth 10 + $CreatedApp = New-GraphPostRequest -uri 'https://graph.microsoft.com/v1.0/applications' -type POST -tenantid $TenantFilter -body $AppBodyJson -AsApp $true + + if (-not $CreatedApp.appId) { + throw 'Application creation failed - no appId returned' + } + + $AppId = $CreatedApp.appId + $AppObjectId = $CreatedApp.id + + Write-LogMessage -message "Created application '$AppDisplayName' in tenant $TenantFilter. App ID: $AppId" -tenant $TenantFilter -API 'Deploy Integration App' -sev Info + + # Create service principal + $SPBody = @{ appId = $AppId } | ConvertTo-Json + $ServicePrincipal = New-GraphPostRequest -uri 'https://graph.microsoft.com/v1.0/servicePrincipals' -type POST -tenantid $TenantFilter -body $SPBody -AsApp $true + $ServicePrincipalId = $ServicePrincipal.id + } + + # Generate client secret if requested + $ClientSecret = $null + $SecretExpiration = $null + if ($Item.GenerateSecret) { + $ExpirationDays = $Item.SecretExpDays ?? 730 + $SecretEndDate = (Get-Date).AddDays($ExpirationDays).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') + + $PasswordBody = @{ + passwordCredential = @{ + displayName = 'CIPP Generated Secret' + endDateTime = $SecretEndDate + } + } | ConvertTo-Json -Depth 10 + + $PasswordResult = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/applications/$AppObjectId/addPassword" -type POST -tenantid $TenantFilter -body $PasswordBody -AsApp $true + + $ClientSecret = $PasswordResult.secretText + $SecretExpiration = $SecretEndDate + } + + # Grant admin consent for application permissions + foreach ($Resource in $Item.Permissions) { + # Get the resource service principal + $ResourceSP = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/servicePrincipals?`$filter=appId eq '$($Resource.resourceAppId)'" -tenantid $TenantFilter -AsApp $true + + if ($ResourceSP.value -and $ResourceSP.value.Count -gt 0) { + $ResourceSPId = $ResourceSP.value[0].id + + foreach ($Perm in $Resource.permissions) { + if ($Perm.type -eq 'Role') { + # Application permission - create app role assignment + try { + $AssignmentBody = @{ + principalId = $ServicePrincipalId + resourceId = $ResourceSPId + appRoleId = $Perm.id + } | ConvertTo-Json + + $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/servicePrincipals/$ServicePrincipalId/appRoleAssignments" -type POST -tenantid $TenantFilter -body $AssignmentBody -AsApp $true + Write-Information "Granted $($Perm.name) permission to app in tenant $TenantFilter" + } catch { + if ($_.Exception.Message -notlike '*Permission being assigned already exists*') { + Write-Warning "Failed to grant permission $($Perm.name): $($_.Exception.Message)" + } + } + } + } + } + } + + Write-LogMessage -message "Successfully deployed integration app '$AppDisplayName' to tenant $TenantFilter" -tenant $TenantFilter -API 'Deploy Integration App' -sev Info + + # Store result in deployment table + Write-Information "Storing deployment result for $TenantFilter (DeploymentId: $DeploymentId)" + $DeploymentTable = Get-CIPPTable -TableName 'IntegrationDeployments' + $ResultEntity = @{ + PartitionKey = 'IntegrationDeploymentResult' + RowKey = "$DeploymentId`_$TenantFilter" + DeploymentId = $DeploymentId + Tenant = $TenantFilter + TenantName = $TenantName + DisplayName = $DisplayTenantName + AppName = $AppDisplayName + AppId = $AppId + TenantId = $TenantInfo.customerId ?? $TenantFilter + ClientSecret = $ClientSecret + SecretExpiration = $SecretExpiration + Status = 'Success' + Message = "Successfully created application '$AppDisplayName'" + CompletedAt = (Get-Date).ToUniversalTime().ToString('o') + } + Add-CIPPAzDataTableEntity @DeploymentTable -Entity $ResultEntity -Force + Write-LogMessage -API 'Deploy Integration App' -tenant $TenantFilter -message "Stored deployment result: Success for $AppDisplayName (AppId: $AppId)" -Sev 'Info' + + return $true + + } catch { + $ErrorMessage = $_.Exception.Message + $ErrorDetails = Get-CippException -Exception $_ + Write-LogMessage -message "Error deploying integration app to tenant $($Item.Tenant): $ErrorMessage" -tenant $Item.Tenant -API 'Deploy Integration App' -sev Error -LogData $ErrorDetails + + # Store error result + try { + $DeploymentTable = Get-CIPPTable -TableName 'IntegrationDeployments' + $ResultEntity = @{ + PartitionKey = 'IntegrationDeploymentResult' + RowKey = "$($Item.DeploymentId)`_$($Item.Tenant)" + DeploymentId = $Item.DeploymentId + Tenant = $Item.Tenant + TenantName = $Item.TenantName + Status = 'Failed' + Message = $ErrorMessage + CompletedAt = (Get-Date).ToUniversalTime().ToString('o') + } + Add-CIPPAzDataTableEntity @DeploymentTable -Entity $ResultEntity -Force + Write-LogMessage -API 'Deploy Integration App' -tenant $Item.Tenant -message "Stored deployment result: Failed - $ErrorMessage" -Sev 'Info' + } catch { + Write-LogMessage -API 'Deploy Integration App' -message "Failed to store error result: $($_.Exception.Message)" -Sev 'Error' + } + + return $false + } +} diff --git a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecDeleteSharepointSite.ps1 b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecDeleteSharepointSite.ps1 new file mode 100644 index 0000000000..549e5fb689 --- /dev/null +++ b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecDeleteSharepointSite.ps1 @@ -0,0 +1,117 @@ +function Push-ExecDeleteSharepointSite { + <# + .FUNCTIONALITY + Entrypoint - Runs SharePoint site deletion in the background (activity). + .ROLE + Sharepoint.Site.ReadWrite + #> + param($Item) + + $TenantFilter = $Item.TenantFilter + $SiteId = $Item.SiteId + $Headers = $Item.Headers + $APIName = $Item.APIName + + # Site templates that cannot be deleted or require special handling + $ProtectedTemplates = @{ + 'SPSMSITEHOST#0' = 'Root site collection - cannot be deleted' + 'SRCHCEN#0' = 'Search Center - system site' + 'SPSPERS#10' = 'OneDrive site - delete via user management' + 'EHS#1' = 'Team Channel site - delete via Teams' + 'TEAMCHANNEL#0' = 'Team Channel site - delete via Teams' + 'TEAMCHANNEL#1' = 'Team Channel site - delete via Teams' + } + + $UseRemoveSiteApi = @( + 'SITEPAGEPUBLISHING#0' # Communication site + 'STS#3' # Modern team site without M365 group + ) + + if (-not $SiteId) { throw "SiteId is required" } + if (-not $TenantFilter) { throw "TenantFilter is required" } + if ($SiteId -notmatch '^(\{)?[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}(\})?$') { + throw "SiteId must be a valid GUID" + } + + $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter + $SiteInfoUri = "$($SharePointInfo.AdminUrl)/_api/SPO.Tenant/sites('$SiteId')" + # The SPO.Tenant vroute GET needs odata-version 4.0; the manager POST endpoints must + # NOT receive it - sending it flips them onto a pipeline that rejects the call with + # 'Elevated context should be used only to create service asserted level PoP'. + $GetHeaders = @{ + 'accept' = 'application/json' + 'odata-version' = '4.0' + } + $PostHeaders = @{ + 'accept' = 'application/json' + } + + $SiteInfo = New-GraphGETRequest -scope "$($SharePointInfo.AdminUrl)/.default" -uri $SiteInfoUri -tenantid $TenantFilter -extraHeaders $GetHeaders -UseCertificate -AsApp $true + if (-not $SiteInfo) { throw "Could not retrieve site information from SharePoint Admin API" } + + $SiteTemplate = $SiteInfo.Template + $SiteUrl = $SiteInfo.Url + + if ($ProtectedTemplates.ContainsKey($SiteTemplate)) { + throw "Cannot delete this site. Template: $SiteTemplate - $($ProtectedTemplates[$SiteTemplate])" + } + + if ($SiteInfo.HubSiteId -eq $SiteId -or $SiteInfo.IsHubSite -eq $true) { + try { + $UnregisterUri = "$($SharePointInfo.AdminUrl)/_api/SPO.Tenant/UnregisterHubSite" + $UnregisterBody = @{ siteUrl = $SiteUrl } + $null = New-GraphPOSTRequest -scope "$($SharePointInfo.AdminUrl)/.default" -uri $UnregisterUri -body (ConvertTo-Json -InputObject $UnregisterBody) -tenantid $TenantFilter -contentType 'application/json' -AddedHeaders $PostHeaders + } catch { + Write-Host "Warning: Could not unregister hub site, proceeding with deletion attempt: $($_.Exception.Message)" + } + } + + $IsGroupConnected = $SiteInfo.GroupId -and $SiteInfo.GroupId -ne "00000000-0000-0000-0000-000000000000" + $DeleteAttempted = $false + + if ($IsGroupConnected) { + $body = @{ siteUrl = $SiteUrl } + $DeleteUri = "$($SharePointInfo.AdminUrl)/_api/GroupSiteManager/Delete" + try { + $null = New-GraphPOSTRequest -scope "$($SharePointInfo.AdminUrl)/.default" -uri $DeleteUri -body (ConvertTo-Json -Depth 10 -InputObject $body) -tenantid $TenantFilter -contentType 'application/json' -AddedHeaders $PostHeaders + $DeleteAttempted = $true + } catch { + Write-Host "GroupSiteManager/Delete failed, trying RemoveSite API: $($_.Exception.Message)" + } + } + + if (-not $DeleteAttempted) { + if ($SiteTemplate -in $UseRemoveSiteApi -or -not $IsGroupConnected) { + $body = @{ siteUrl = $SiteUrl } + $DeleteUri = "$($SharePointInfo.AdminUrl)/_api/SPO.Tenant/RemoveSite" + try { + $null = New-GraphPOSTRequest -scope "$($SharePointInfo.AdminUrl)/.default" -uri $DeleteUri -body (ConvertTo-Json -Depth 10 -InputObject $body) -tenantid $TenantFilter -contentType 'application/json' -AddedHeaders $PostHeaders + $DeleteAttempted = $true + } catch { + $RemoveSiteError = $_.Exception.Message + $body = @{ siteId = $SiteId } + $DeleteUri = "$($SharePointInfo.AdminUrl)/_api/SPSiteManager/delete" + try { + # SPSiteManager/delete denies delegated tokens (even with a certificate assertion) + # with E_ACCESSDENIED - it requires app-only certificate auth. + $null = New-GraphPOSTRequest -scope "$($SharePointInfo.AdminUrl)/.default" -uri $DeleteUri -body (ConvertTo-Json -Depth 10 -InputObject $body) -tenantid $TenantFilter -contentType 'application/json' -AddedHeaders $PostHeaders -UseCertificate -AsApp $true + $DeleteAttempted = $true + } catch { + $SPSiteManagerError = $_.Exception.Message + if ($SPSiteManagerError -match 'siteTemplate|template is not allowed') { + throw "This site template ($SiteTemplate) cannot be deleted using standard APIs. Site URL: $SiteUrl. If this is a Teams-connected site, delete the Team instead. For hub sites, unregister the hub first." + } + throw $SPSiteManagerError + } + } + } + } + + $SiteTypeMsg = switch ($true) { + $IsGroupConnected { "group-connected" } + ($SiteTemplate -eq 'SITEPAGEPUBLISHING#0') { "communication" } + default { "regular" } + } + $Results = "Successfully initiated deletion of $SiteTypeMsg SharePoint site '$SiteUrl' (ID: $SiteId)." + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Info +} diff --git a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecOnboardTenantQueue.ps1 b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecOnboardTenantQueue.ps1 index 6c88e3f695..be46fe7e7a 100644 --- a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecOnboardTenantQueue.ps1 +++ b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecOnboardTenantQueue.ps1 @@ -63,6 +63,7 @@ function Push-ExecOnboardTenantQueue { @{ Name = 'Authentication Policy Administrator'; Id = '0526716b-113d-4c15-b2c8-68e3c22b9f80' }, @{ Name = 'Privileged Role Administrator'; Id = 'e8611ab8-c189-46e8-94e1-60213ab1f814' }, @{ Name = 'Privileged Authentication Administrator'; Id = '7be44c8a-adaf-4e2a-84d6-ab2649e08a13' }, + @{ Name = 'Power Platform Administrator'; Id = '11648597-926c-4cf3-9c36-bcebb0ba8dcc' }, @{ Name = 'Billing Administrator'; Id = 'b0f54661-2d74-4c50-afa3-1ec803f12efe'; Optional = $true }, @{ Name = 'Global Reader'; Id = 'f2ef992c-3afb-46b9-b7cf-a126ee74c451'; Optional = $true }, @{ Name = 'Domain Name Administrator'; Id = '8329153b-31d0-4727-b945-745eb3bc5f31'; Optional = $true } diff --git a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-GetPendingWebhooks.ps1 b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-GetPendingWebhooks.ps1 index 2cdf56c8a6..fadb9e015c 100644 --- a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-GetPendingWebhooks.ps1 +++ b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-GetPendingWebhooks.ps1 @@ -5,7 +5,7 @@ function Push-GetPendingWebhooks { #> Param($Item) $Table = Get-CIPPTable -TableName WebhookIncoming - $Webhooks = Get-CIPPAzDataTableEntity @Table -Property PartitionKey, RowKey, FunctionName -First 10000 + $Webhooks = Get-CIPPAzDataTableEntity @Table -Property PartitionKey, RowKey, FunctionName -Filter "PartitionKey eq 'Webhook'" -First 10000 $WebhookCount = ($Webhooks | Measure-Object).Count $Message = 'Processing {0} webhooks' -f $WebhookCount Write-LogMessage -API 'Webhooks' -message $Message -sev Info diff --git a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ListConditionalAccessPoliciesAllTenants.ps1 b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ListConditionalAccessPoliciesAllTenants.ps1 index daf01e43ec..ac2933dbee 100644 --- a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ListConditionalAccessPoliciesAllTenants.ps1 +++ b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ListConditionalAccessPoliciesAllTenants.ps1 @@ -1,4 +1,4 @@ -function Push-ListConditionalAccessPoliciesAllTenants { +function Push-ListConditionalAccessPoliciesAllTenants { <# .FUNCTIONALITY Entrypoint @@ -132,7 +132,7 @@ builtInControls = ($cap.grantControls.builtInControls) -join ',' customAuthenticationFactors = ($cap.grantControls.customAuthenticationFactors) -join ',' termsOfUse = ($cap.grantControls.termsOfUse) -join ',' - rawjson = ($cap | ConvertTo-Json -Depth 100) + rawjson = ($cap | ConvertTo-Json -Depth 20) } $Entity = @{ diff --git a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ListMailQuarantineAllTenants.ps1 b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ListMailQuarantineAllTenants.ps1 index dbd3138340..790944c743 100644 --- a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ListMailQuarantineAllTenants.ps1 +++ b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ListMailQuarantineAllTenants.ps1 @@ -11,31 +11,33 @@ Write-Host "PowerShell queue trigger function processed work item: $($Tenant.defaultDomainName)" try { - $PageSize = 1000 - $quarantineMessages = [System.Collections.Generic.List[object]]::new() - # Email is available everywhere; SharePointOnline/Teams quarantine requires Defender for Office 365, - # so fetch each entity type separately and tolerate per-type failures on unlicensed tenants. - # EXO REST silently ignores -EntityType SharePointOnline; the documented filter for Safe Attachments - # files is -QuarantineTypes SPOMalware. Email/Teams work fine via -EntityType. - foreach ($EntityType in @('Email', 'SharePointOnline', 'Teams')) { - $EntityTypeParams = if ($EntityType -eq 'SharePointOnline') { @{ QuarantineTypes = 'SPOMalware' } } else { @{ EntityType = $EntityType } } - try { - $Page = 1 - do { - $Results = New-ExoRequest -tenantid $domainName -cmdlet 'Get-QuarantineMessage' -cmdParams (@{ PageSize = $PageSize; Page = $Page } + $EntityTypeParams) | Select-Object -ExcludeProperty *data.type* - if ($Results) { $quarantineMessages.AddRange(@($Results)) } - $Page++ - } while (@($Results).Count -eq $PageSize) - } catch { - if ($EntityType -eq 'Email') { throw } - Write-Host "Could not get $EntityType quarantine messages for $domainName : $($_.Exception.Message)" - } - } - foreach ($message in $quarantineMessages) { - Add-CIPPQuarantineMessageProperties -Message $message -Tenant $domainName -CustomerId $Tenant.customerId + $Query = Build-CIPPQuarantineQueryParams -QueryInput @{ + days = 30 + pageSize = 1000 + } -ApplyDefaultDateRange + + $AllMessages = [System.Collections.Generic.List[object]]::new() + $Page = 1 + $MaxPages = 5 + do { + $Query.CmdParams.Page = $Page + $quarantineMessages = @(Invoke-CippQuarantineExoRequest -TenantId $domainName -Cmdlet 'Get-QuarantineMessage' -CmdParams $Query.CmdParams | + Select-Object -ExcludeProperty *data.type*) + if ($quarantineMessages) { $AllMessages.AddRange($quarantineMessages) } + $Page++ + } while ($quarantineMessages.Count -eq $Query.CmdParams.PageSize -and $Page -le $MaxPages) + + foreach ($message in $AllMessages) { + # Deterministic RowKey (hash of tenant + quarantine Identity) so re-running + # the sync upserts existing rows instead of inserting duplicates that the + # 30-minute cache window would then return twice. + $RowKeySource = '{0}|{1}' -f $domainName, ([string]$message.Identity) + $RowKey = [System.Convert]::ToHexString( + [System.Security.Cryptography.SHA256]::HashData([System.Text.Encoding]::UTF8.GetBytes($RowKeySource)) + ) $messageData = @{ QuarantineMessage = [string]($message | ConvertTo-Json -Depth 10 -Compress) - RowKey = [string](New-Guid).Guid + RowKey = $RowKey PartitionKey = 'QuarantineMessage' Tenant = [string]$domainName } diff --git a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsList.ps1 b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsList.ps1 index 7036846ab8..7cfa64f0de 100644 --- a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsList.ps1 +++ b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsList.ps1 @@ -22,17 +22,11 @@ function Push-CIPPTestsList { try { Write-Information "Building test suite list for tenant: $TenantFilter" - # The orchestrator (Start-CIPPDBTestsRun) already filtered the tenant list to those - # with cached data, so the previous per-tenant `Get-CIPPDbItem -CountsOnly` recheck - # was a redundant Table query (one extra round-trip per tenant). The orchestrator - # may pass SkipDbCheck=$true when it has already verified data presence; otherwise - # we fall back to a check here for any direct invocations. - if (-not $Item.SkipDbCheck) { - $DbCounts = Get-CIPPDbItem -TenantFilter $TenantFilter -CountsOnly - if (($DbCounts | Measure-Object -Property DataCount -Sum).Sum -eq 0) { - Write-Information "Tenant $TenantFilter has no data in database. Skipping tests." - return @() - } + # Check if tenant has data before emitting any work + $DbCounts = Get-CIPPDbItem -TenantFilter $TenantFilter -CountsOnly + if (($DbCounts | Measure-Object -Property DataCount -Sum).Sum -eq 0) { + Write-Information "Tenant $TenantFilter has no data in database. Skipping tests." + return @() } # Emit one task per suite — suite names must match the ValidateSet in Invoke-CIPPTestCollection. diff --git a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Webhooks/Push-PublicWebhookProcess.ps1 b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Webhooks/Push-PublicWebhookProcess.ps1 index 7bf45a4dae..748bbaa3dd 100644 --- a/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Webhooks/Push-PublicWebhookProcess.ps1 +++ b/backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Webhooks/Push-PublicWebhookProcess.ps1 @@ -18,7 +18,16 @@ function Push-PublicWebhookProcess { } catch { Write-Host "Webhook Exception: $($_.Exception.Message)" } finally { - $Entity = $Webhook | Select-Object -Property RowKey, PartitionKey - Remove-CIPPAzDataTableEntity -Force @Table -Entity $Entity + if ($Webhook) { + try { + $Entity = $Webhook | Select-Object -Property RowKey, PartitionKey + Remove-CIPPAzDataTableEntity -Force @Table -Entity $Entity + } catch { + # Row may have already been deleted by a concurrent execution - this is expected + Write-Information "Webhook cleanup for RowKey '$($Item.RowKey)': $($_.Exception.Message)" + } + } else { + Write-Warning "Webhook row not found for RowKey '$($Item.RowKey)' - skipping cleanup" + } } } diff --git a/backend/Modules/CIPPCore/Public/Add-CIPPDbItem.ps1 b/backend/Modules/CIPPCore/Public/Add-CIPPDbItem.ps1 index 9f4c754e1e..268814a628 100644 --- a/backend/Modules/CIPPCore/Public/Add-CIPPDbItem.ps1 +++ b/backend/Modules/CIPPCore/Public/Add-CIPPDbItem.ps1 @@ -111,7 +111,9 @@ function Add-CIPPDbItem { try { $TenantLookup = @(Get-Tenants -TenantFilter $TenantFilter -IncludeErrors) if ($TenantLookup.Count -gt 0) { $TenantFilter = $TenantLookup[0].defaultDomainName } - } catch {} + } catch { + Write-LogMessage -API 'CIPPDbItem' -tenant $TenantFilter -message "Failed to resolve tenant GUID to default domain: $($_.Exception.Message)" -sev Warning + } } } diff --git a/backend/Modules/CIPPCore/Public/Add-CIPPDelegatedPermission.ps1 b/backend/Modules/CIPPCore/Public/Add-CIPPDelegatedPermission.ps1 index 9f5fbf9459..cd38d3d4d7 100644 --- a/backend/Modules/CIPPCore/Public/Add-CIPPDelegatedPermission.ps1 +++ b/backend/Modules/CIPPCore/Public/Add-CIPPDelegatedPermission.ps1 @@ -69,7 +69,10 @@ function Add-CIPPDelegatedPermission { } $Translator = Get-Content (Join-Path $env:CIPPRootPath 'Config\PermissionsTranslator.json') | ConvertFrom-Json - $ServicePrincipalList = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals?`$select=appId,id,displayName&`$top=999" -tenantid $TenantFilter -skipTokenCache $true -NoAuthCheck $true + # Only fetch the service principals we actually reference (our app + resource apps) instead of + # enumerating every SP in the tenant. + $NeededAppIds = @(@($ApplicationId) + @($RequiredResourceAccess.resourceAppId) | Where-Object { $_ } | Sort-Object -Unique) + $ServicePrincipalList = Get-CippServicePrincipalsByAppId -AppIds $NeededAppIds -TenantFilter $TenantFilter -SkipTokenCache $Results = [System.Collections.Generic.List[string]]::new() $ourSVCPrincipal = $ServicePrincipalList | Where-Object -Property AppId -EQ $ApplicationId | Select-Object -First 1 @@ -176,9 +179,6 @@ function Add-CIPPDelegatedPermission { $Results.add("Failed to update permissions for $($svcPrincipalId.displayName): $(Get-NormalizedError -message $_.Exception.Message)") continue } - # Delegated scopes changed; a cached refresh_token-derived access token still - # carries the old scopes, so drop it rather than wait out its TTL. - $null = Clear-CippTokenCache -TenantFilter $TenantFilter # Added permissions $Added = ($Compare | Where-Object { $_.SideIndicator -eq '=>' }).InputObject -join ' ' $Removed = ($Compare | Where-Object { $_.SideIndicator -eq '<=' }).InputObject -join ' ' diff --git a/backend/Modules/CIPPCore/Public/Add-CIPPGDAPRoleTemplate.ps1 b/backend/Modules/CIPPCore/Public/Add-CIPPGDAPRoleTemplate.ps1 index c8b9cad39c..55c5e6cdee 100644 --- a/backend/Modules/CIPPCore/Public/Add-CIPPGDAPRoleTemplate.ps1 +++ b/backend/Modules/CIPPCore/Public/Add-CIPPGDAPRoleTemplate.ps1 @@ -17,7 +17,7 @@ function Add-CIPPGDAPRoleTemplate { try { $Table = Get-CIPPTable -TableName 'GDAPRoleTemplates' - $Templates = Get-CIPPAzDataTableEntity @Table + $Templates = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'RoleTemplate'" if ($Templates.RowKey -contains $TemplateId -and !$Overwrite.IsPresent) { $ExistingTemplate = $Templates | Where-Object -Property RowKey -EQ $TemplateId try { diff --git a/backend/Modules/CIPPCore/Public/Add-CIPPGroupMember.ps1 b/backend/Modules/CIPPCore/Public/Add-CIPPGroupMember.ps1 index 2e32a97118..a9339b8bdd 100644 --- a/backend/Modules/CIPPCore/Public/Add-CIPPGroupMember.ps1 +++ b/backend/Modules/CIPPCore/Public/Add-CIPPGroupMember.ps1 @@ -82,8 +82,10 @@ function Add-CIPPGroupMember { ($_.ExchangeIdentity ?? $_.Id) -eq $ExoResult.Operation.target } | Select-Object -First 1 $Label = $Entry.Label ?? $ExoResult.Operation.target - if ($ExoResult.Success) { - Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ExoResult.Operation.message -Sev 'Info' + $AlreadyMember = $ExoResult.ErrorMessage -match 'already (a )?member|already exist' + if ($ExoResult.Success -or $AlreadyMember) { + $ExoMessage = if ($AlreadyMember) { "Member $Label is already in group $($GroupName)" } else { $ExoResult.Operation.message } + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ExoMessage -Sev 'Info' $SuccessfulMembers.Add($Label) } else { Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to add member $Label to group $($GroupName): $($ExoResult.ErrorMessage)" -Sev 'Error' @@ -106,12 +108,17 @@ function Add-CIPPGroupMember { foreach ($Result in $AddResults) { $Entry = $ValidMembers | Where-Object { $_.Id -eq $Result.id } | Select-Object -First 1 $Label = $Entry.Label ?? $Result.id - if ($Result.status -lt 200 -or $Result.status -gt 299) { - $ErrorText = Get-NormalizedError -message ($Result.body.error.message ?? "Request failed with status $($Result.status)") | Select-Object -First 1 + $GraphError = $Result.body.error.message + $AlreadyMember = $GraphError -match 'already exist' + if (($Result.status -ge 200 -and $Result.status -le 299) -or $AlreadyMember) { + if ($AlreadyMember) { + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Member $Label is already in group $($GroupName)" -Sev 'Info' + } + $SuccessfulMembers.Add($Label) + } else { + $ErrorText = Get-NormalizedError -message ($GraphError ?? "Request failed with status $($Result.status)") | Select-Object -First 1 Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to add member $Label to group $($GroupName): $ErrorText" -Sev 'Error' $FailedMembers.Add("$Label ($ErrorText)") - } else { - $SuccessfulMembers.Add($Label) } } } diff --git a/backend/Modules/CIPPCore/Public/Add-CIPPMacOSShellScript.ps1 b/backend/Modules/CIPPCore/Public/Add-CIPPMacOSShellScript.ps1 new file mode 100644 index 0000000000..0723ea8c4c --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Add-CIPPMacOSShellScript.ps1 @@ -0,0 +1,43 @@ +function Add-CIPPMacOSShellScript { + <# + .SYNOPSIS + Creates or updates an Intune macOS shell script by display name. Updates keep the + script's id and assignments. + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)][string]$TenantFilter, + [Parameter(Mandatory = $true)][string]$DisplayName, + [string]$Description = '', + [Parameter(Mandatory = $true)][string]$ScriptContent, + [string]$FileName, + [ValidateSet('system', 'user')][string]$RunAsAccount = 'system', + [string]$ExecutionFrequency, + [int]$RetryCount = 3, + [bool]$BlockExecutionNotifications = $true + ) + + $Baseuri = 'https://graph.microsoft.com/beta/deviceManagement/deviceShellScripts' + if (-not $FileName) { $FileName = '{0}.sh' -f ($DisplayName -replace '[^a-zA-Z0-9]', '_') } + $Body = @{ + '@odata.type' = '#microsoft.graph.deviceShellScript' + displayName = $DisplayName + description = $Description + fileName = $FileName + runAsAccount = $RunAsAccount + retryCount = $RetryCount + blockExecutionNotifications = $BlockExecutionNotifications + scriptContent = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes((Get-CIPPTextReplacement -Text $ScriptContent -TenantFilter $TenantFilter))) + } + if ($ExecutionFrequency) { $Body.executionFrequency = $ExecutionFrequency } + + $Existing = New-GraphGetRequest -uri "$Baseuri`?`$select=id,displayName" -tenantid $TenantFilter | Where-Object { $_.displayName -eq $DisplayName } | Select-Object -First 1 + if ($Existing) { + $Body.Remove('@odata.type') + $null = New-GraphPostRequest -uri "$Baseuri/$($Existing.id)" -tenantid $TenantFilter -type PATCH -body ($Body | ConvertTo-Json -Depth 5) + return $Existing + } + New-GraphPostRequest -uri $Baseuri -tenantid $TenantFilter -type POST -body ($Body | ConvertTo-Json -Depth 5) +} diff --git a/backend/Modules/CIPPCore/Public/Add-CIPPW32ScriptApplication.ps1 b/backend/Modules/CIPPCore/Public/Add-CIPPW32ScriptApplication.ps1 index 62b40dc56f..14e6b97195 100644 --- a/backend/Modules/CIPPCore/Public/Add-CIPPW32ScriptApplication.ps1 +++ b/backend/Modules/CIPPCore/Public/Add-CIPPW32ScriptApplication.ps1 @@ -45,15 +45,15 @@ function Add-CIPPW32ScriptApplication { ) # Get the standard Chocolatey package location (relative to function app root) - $IntuneWinFile = Join-Path $env:CIPPRootPath 'AddChocoApp\IntunePackage.intunewin' - $ChocoXmlFile = Join-Path $env:CIPPRootPath 'AddChocoApp\Choco.App.xml' + $IntuneWinFile = 'AddChocoApp\IntunePackage.intunewin' + $ChocoXmlFile = 'AddChocoApp\Choco.App.xml' if (-not (Test-Path $IntuneWinFile)) { - throw "Chocolatey IntunePackage.intunewin not found at: $IntuneWinFile (CIPPRootPath: $env:CIPPRootPath)" + throw "Chocolatey IntunePackage.intunewin not found at: $IntuneWinFile (Current directory: $PWD)" } if (-not (Test-Path $ChocoXmlFile)) { - throw "Choco.App.xml not found at: $ChocoXmlFile (CIPPRootPath: $env:CIPPRootPath)" + throw "Choco.App.xml not found at: $ChocoXmlFile (Current directory: $PWD)" } # Parse the Choco XML to get encryption info. We need a wrapper around the application and this is a tiny intune file, perfect for our purpose. diff --git a/backend/Modules/CIPPCore/Public/Assert-CippVersion.ps1 b/backend/Modules/CIPPCore/Public/Assert-CippVersion.ps1 index 6070b10dce..d763211f6a 100644 --- a/backend/Modules/CIPPCore/Public/Assert-CippVersion.ps1 +++ b/backend/Modules/CIPPCore/Public/Assert-CippVersion.ps1 @@ -5,24 +5,66 @@ function Assert-CippVersion { .DESCRIPTION Retrieves the local version of CIPP and compares it with the latest version in GitHub. + Also retrieves version information for all registered backend function apps. .PARAMETER CIPPVersion Local version of CIPP frontend #> param($CIPPVersion) + $APIVersion = (Get-Content -Path (Join-Path $env:CIPPRootPath 'version_latest.txt')).trim() - if ($env:CIPPNG -eq 'true') { - $APIVersion = $env:APP_VERSION - if (!$CIPPVersion) { - $CIPPVersion = $env:APP_VERSION + $RemoteAPIVersion = (Invoke-CIPPRestMethod -Uri 'https://raw.githubusercontent.com/KelvinTegelaar/CIPP-API/master/version_latest.txt').trim() + $RemoteCIPPVersion = (Invoke-CIPPRestMethod -Uri 'https://raw.githubusercontent.com/KelvinTegelaar/CIPP/main/public/version.json').version + + # Get all backend function app versions from the Version table + $VersionTable = Get-CippTable -tablename 'Version' + $AllVersions = Get-CIPPAzDataTableEntity @VersionTable -Filter "PartitionKey eq 'Version' and RowKey ne 'frontend'" + + # Build backend versions array with sync status + $BackendVersions = @() + $MainAppName = $env:WEBSITE_SITE_NAME + + foreach ($ver in $AllVersions) { + $isOutOfSync = $false + $isMainApp = ($ver.RowKey -eq $MainAppName) + + # Check if this version differs from the main API version + if ($ver.Version -and $APIVersion) { + try { + $isOutOfSync = ([semver]$ver.Version -ne [semver]$APIVersion) + } catch { + $isOutOfSync = ($ver.Version -ne $APIVersion) + } + } + + # Determine friendly name + $friendlyName = if ($isMainApp) { + 'Main API' + } elseif ($ver.RowKey -match '-proc$') { + 'Processor' + } elseif ($ver.RowKey -match '-standards$') { + 'Standards' + } elseif ($ver.RowKey -match '-auditlog$') { + 'Audit Log' + } elseif ($ver.RowKey -match '-usertasks$') { + 'User Tasks' + } else { + $ver.RowKey + } + + $BackendVersions += [PSCustomObject]@{ + Name = $ver.RowKey + FriendlyName = $friendlyName + Version = $ver.Version + IsMainApp = $isMainApp + OutOfSync = $isOutOfSync + LastUpdated = $ver.Timestamp } - } else { - $APIVersion = (Get-Content -Path (Join-Path $env:CIPPRootPath 'version_latest.txt')).trim() } - - $RemoteAPIVersion = (Invoke-CIPPRestMethod -Uri 'https://raw.githubusercontent.com/KelvinTegelaar/CIPP-API/master/version_latest.txt').trim() - $RemoteCIPPVersion = (Invoke-CIPPRestMethod -Uri 'https://raw.githubusercontent.com/CyberDrain/CIPP/main/backend/version_latest.txt').trim() + + # Sort: Main app first, then alphabetically by friendly name + $BackendVersions = $BackendVersions | Sort-Object { -not $_.IsMainApp }, FriendlyName [PSCustomObject]@{ LocalCIPPVersion = $CIPPVersion @@ -31,5 +73,6 @@ function Assert-CippVersion { RemoteCIPPAPIVersion = $RemoteAPIVersion OutOfDateCIPP = ([semver]$RemoteCIPPVersion -gt [semver]$CIPPVersion) OutOfDateCIPPAPI = ([semver]$RemoteAPIVersion -gt [semver]$APIVersion) + BackendVersions = @($BackendVersions) } } diff --git a/backend/Modules/CIPPCore/Public/AuditLogs/New-CIPPAuditLogSearchResultsCache.ps1 b/backend/Modules/CIPPCore/Public/AuditLogs/New-CIPPAuditLogSearchResultsCache.ps1 index 7f66e81c02..7fe7caffcc 100644 --- a/backend/Modules/CIPPCore/Public/AuditLogs/New-CIPPAuditLogSearchResultsCache.ps1 +++ b/backend/Modules/CIPPCore/Public/AuditLogs/New-CIPPAuditLogSearchResultsCache.ps1 @@ -72,21 +72,6 @@ function New-CIPPAuditLogSearchResultsCache { Add-CIPPAzDataTableEntity @CacheWebhooksTable -Entity $cacheEntity -Force } Write-Information "Successfully cached search ID: $($SearchId) for tenant: $TenantFilter" - - try { - $PrefetchIPs = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase) - foreach ($sr in $searchResults) { - $cip = $sr.auditData.clientip - if (![string]::IsNullOrWhiteSpace($cip)) { $null = $PrefetchIPs.Add(([string]$cip).Trim()) } - } - if ($PrefetchIPs.Count -gt 0) { - $null = Get-CIPPGeoIPLocationBatch -IPs @($PrefetchIPs) - Write-Information "Geo prefetch: warmed cache for $($PrefetchIPs.Count) distinct IP(s) (search $SearchId)" - } - } catch { - Write-Information "Geo prefetch during ingestion failed for search ${SearchId}: $($_.Exception.Message)" - } - try { $FailedDownloadsTable = Get-CippTable -TableName 'FailedAuditLogDownloads' $failedEntities = Get-CIPPAzDataTableEntity @FailedDownloadsTable -Filter "PartitionKey eq '$TenantFilter' and SearchId eq '$SearchId'" diff --git a/backend/Modules/CIPPCore/Public/AuditLogs/New-CippAuditLogSearch.ps1 b/backend/Modules/CIPPCore/Public/AuditLogs/New-CippAuditLogSearch.ps1 index 94e2cd35cf..cab1c33a37 100644 --- a/backend/Modules/CIPPCore/Public/AuditLogs/New-CippAuditLogSearch.ps1 +++ b/backend/Modules/CIPPCore/Public/AuditLogs/New-CippAuditLogSearch.ps1 @@ -153,14 +153,9 @@ function New-CippAuditLogSearch { } catch { $AuditLogError = $null $AuditLogErrorMessage = [string]$_.Exception.Message - $RawErrorBody = $_.Exception.Data['RawErrorBody'] - if ($RawErrorBody) { - $AuditLogError = [string]$RawErrorBody | ConvertFrom-Json -ErrorAction SilentlyContinue - } else { - $TrimmedAuditLogErrorMessage = $AuditLogErrorMessage.TrimStart() - if ($TrimmedAuditLogErrorMessage.StartsWith('{') -or $TrimmedAuditLogErrorMessage.StartsWith('[')) { - $AuditLogError = $AuditLogErrorMessage | ConvertFrom-Json -ErrorAction SilentlyContinue - } + $TrimmedAuditLogErrorMessage = $AuditLogErrorMessage.TrimStart() + if ($TrimmedAuditLogErrorMessage.StartsWith('{') -or $TrimmedAuditLogErrorMessage.StartsWith('[')) { + $AuditLogError = $AuditLogErrorMessage | ConvertFrom-Json -ErrorAction SilentlyContinue } # The AuditingDisabledTenant status can appear either at the top level or nested @@ -208,12 +203,7 @@ function New-CippAuditLogSearch { # Handle HTML error pages (e.g. Azure Front Door 502/504 gateway timeouts) if ($TrimmedAuditLogErrorMessage -match '([^<]+)') { $HtmlTitle = $Matches[1].Trim() - $GatewayLogData = [PSCustomObject]@{ - HtmlTitle = $HtmlTitle - NormalizedMessage = $AuditLogErrorMessage - RawResponseBody = if ($RawErrorBody) { [string]$RawErrorBody } else { $AuditLogErrorMessage } - } - Write-LogMessage -API 'Audit Logs' -tenant $TenantFilter -message "Audit log search creation failed with gateway error for tenant $TenantFilter ($HtmlTitle)" -sev Warning -LogData $GatewayLogData + Write-LogMessage -API 'Audit Logs' -tenant $TenantFilter -message "Audit log search creation failed with gateway error for tenant $TenantFilter ($HtmlTitle)" -sev Warning return [PSCustomObject]@{ id = $null displayName = [string]$DisplayName @@ -226,17 +216,7 @@ function New-CippAuditLogSearch { # Handle Microsoft-side timeouts / transient errors (e.g. UnknownError with empty message) $ErrorCode = $AuditLogError.error.code ?? $AuditLogError.code if ($ErrorCode -in @('UnknownError', 'ServiceUnavailable', 'RequestTimeout', 'GatewayTimeout', 'TooManyRequests')) { - $TransientLogData = [PSCustomObject]@{ - ErrorCode = $ErrorCode - ErrorMessage = $AuditLogError.error.message ?? $AuditLogError.message - InnerRequestId = $AuditLogError.error.innerError.'request-id' ?? $AuditLogError.error.innererror.'request-id' - InnerClientReqId = $AuditLogError.error.innerError.'client-request-id' ?? $AuditLogError.error.innererror.'client-request-id' - InnerErrorDate = $AuditLogError.error.innerError.date ?? $AuditLogError.error.innererror.date - NormalizedMessage = $AuditLogErrorMessage - RawResponseBody = if ($RawErrorBody) { [string]$RawErrorBody } else { $AuditLogErrorMessage } - ParsedError = $AuditLogError - } - Write-LogMessage -API 'Audit Logs' -tenant $TenantFilter -message "Audit log search creation failed for tenant $TenantFilter - Microsoft returned $ErrorCode" -sev Warning -LogData $TransientLogData + Write-LogMessage -API 'Audit Logs' -tenant $TenantFilter -message "Audit log search creation failed with transient error for tenant $TenantFilter ($ErrorCode)" -sev Warning return [PSCustomObject]@{ id = $null displayName = [string]$DisplayName diff --git a/backend/Modules/CIPPCore/Public/Authentication/Get-CippMcpKnownClients.ps1 b/backend/Modules/CIPPCore/Public/Authentication/Get-CippMcpKnownClients.ps1 index 245155747f..6031d5c5c8 100644 --- a/backend/Modules/CIPPCore/Public/Authentication/Get-CippMcpKnownClients.ps1 +++ b/backend/Modules/CIPPCore/Public/Authentication/Get-CippMcpKnownClients.ps1 @@ -45,8 +45,8 @@ function Get-CippMcpKnownClients { 'https://insiders.vscode.dev/redirect' # Loopback for desktop/CLI clients (port-agnostic in Entra) 'http://127.0.0.1' - # Common local-dev default. NOTE: unlike 127.0.0.1, 'localhost' is only port-agnostic - # without a path, so this exact string only matches clients that use it verbatim. + # Common local-dev default. Entra ignores the port on localhost too, so this also claims + # http://localhost:/callback as public: a Web redirect there fails AADSTS700025. 'http://localhost/callback' ) ConfidentialRedirectUris = @( diff --git a/backend/Modules/CIPPCore/Public/Authentication/Get-CippRequestAllowedPermissions.ps1 b/backend/Modules/CIPPCore/Public/Authentication/Get-CippRequestAllowedPermissions.ps1 new file mode 100644 index 0000000000..289a61f9ef --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Authentication/Get-CippRequestAllowedPermissions.ps1 @@ -0,0 +1,29 @@ +function Get-CippRequestAllowedPermissions { + <# + .SYNOPSIS + Returns the current caller's allowed permissions, resolved once per request. + .DESCRIPTION + Built from the roles Test-CIPPAccess resolved for this request - the signed-in user's roles, + or an API client's role on the client-credentials path - with the same + Get-CippAllowedPermissions computation /api/me uses. The result is kept in the request + context slot reset by Initialize-CippRequestContext, so later calls in the same request reuse + it and nothing carries over to the next request on the worker. + + Returns $null outside an authenticated request (no access context), and an empty list when + the caller's roles grant nothing. + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param() + + if ($script:CippAllowedPermissionsStorage -and $null -ne $script:CippAllowedPermissionsStorage.Value) { + return , $script:CippAllowedPermissionsStorage.Value + } + if (-not $script:CippAccessUserContext) { return $null } + + $Roles = @($script:CippAccessUserContext.Roles | Where-Object { $_ }) + $Permissions = @(if ($Roles.Count -gt 0) { Get-CippAllowedPermissions -UserRoles $Roles }) + if ($script:CippAllowedPermissionsStorage) { $script:CippAllowedPermissionsStorage.Value = $Permissions } + return , $Permissions +} diff --git a/backend/Modules/CIPPCore/Public/Authentication/Initialize-CippRequestContext.ps1 b/backend/Modules/CIPPCore/Public/Authentication/Initialize-CippRequestContext.ps1 index 77b66f917e..e15a79828e 100644 --- a/backend/Modules/CIPPCore/Public/Authentication/Initialize-CippRequestContext.ps1 +++ b/backend/Modules/CIPPCore/Public/Authentication/Initialize-CippRequestContext.ps1 @@ -38,6 +38,9 @@ function Initialize-CippRequestContext { if (-not $script:CippUserRolesStorage) { $script:CippUserRolesStorage = [System.Threading.AsyncLocal[hashtable]]::new() } + if (-not $script:CippAllowedPermissionsStorage) { + $script:CippAllowedPermissionsStorage = [System.Threading.AsyncLocal[object]]::new() + } # Clear anything inherited from an earlier invocation on this worker. Consumers treat a null # scope as 'unrestricted', so a stale value can only ever hide data that the caller is @@ -47,4 +50,5 @@ function Initialize-CippRequestContext { $script:CippAllowedTenantsStorage.Value = $null $script:CippAllowedGroupsStorage.Value = $null $script:CippUserRolesStorage.Value = @{} + $script:CippAllowedPermissionsStorage.Value = $null } diff --git a/backend/Modules/CIPPCore/Public/Authentication/New-CIPPMcpResourceApp.ps1 b/backend/Modules/CIPPCore/Public/Authentication/New-CIPPMcpResourceApp.ps1 index 631d3500b0..1091ac59c2 100644 --- a/backend/Modules/CIPPCore/Public/Authentication/New-CIPPMcpResourceApp.ps1 +++ b/backend/Modules/CIPPCore/Public/Authentication/New-CIPPMcpResourceApp.ps1 @@ -8,10 +8,9 @@ function New-CIPPMcpResourceApp { https:///api/ExecMcp), exposes the user_impersonation scope, and is what EasyAuth validates incoming tokens against. It is deliberately NOT an OAuth client: it has no redirect URIs, no secret and no public-client flow. The apps that AI connectors sign in AS are the - MCPAllowed API clients (separate app registrations, each with its own role, IP range, - redirect URIs and Conditional Access) - keeping client and resource separate is what stops - the non-interactive refresh being "a token for itself" (AADSTS90009) and lets an MSP apply - device-compliance CA to the client apps without affecting the resource. + MCPAllowed API clients (separate app registrations, each with its own redirect URIs) - + keeping client and resource separate is what stops the non-interactive refresh being "a + token for itself" (AADSTS90009). Idempotent and self-healing. It resolves the resource app in this order: the appId stored in the CippMcpResource table; an existing CIPP-MCP app that already owns this instance's host @@ -173,7 +172,11 @@ function New-CIPPMcpResourceApp { } catch { $ErrMsg = $_.Exception.Message $InUse = $ErrMsg -match 'identifierUri' -or $ErrMsg -match 'already exists' -or $ErrMsg -match 'in use' - if ($InUse -and $Attempt -lt 5) { Start-Sleep -Seconds 3; continue } + # A brand-new app registration is not queryable for a few seconds. Graph reports + # that as "Resource '' does not exist or one of its queried reference-property + # objects are not present." Retrying the same patch succeeds once it replicates. + $NotReplicated = $ErrMsg -match "does not exist or one of its queried reference-property objects are not present" + if (($InUse -or $NotReplicated) -and $Attempt -lt 5) { Start-Sleep -Seconds 3; continue } if ($InUse) { throw "The MCP resource host URIs (https://$Hostname ...) are still assigned to another app registration. If a non-CIPP app holds them, remove it in Entra, then run Save to Azure again. ($ErrMsg)" } @@ -190,15 +193,19 @@ function New-CIPPMcpResourceApp { $Sp = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/servicePrincipals(appId='$($App.appId)')?`$select=id" -NoAuthCheck $true -AsApp $true } catch { $Sp = $null } if (-not $Sp.id) { - if ($Attempt -eq 1) { - try { - $SpBody = @{ accountEnabled = $true; appId = $App.appId; displayName = $DisplayName; tags = @('WindowsAzureActiveDirectoryIntegratedApp') } | ConvertTo-Json -Compress - $Sp = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/v1.0/servicePrincipals' -type POST -body $SpBody -NoAuthCheck $true -asapp $true - } catch { Write-Information "[MCP-Resource] Service principal create attempt failed: $($_.Exception.Message)" } + try { + $SpBody = @{ accountEnabled = $true; appId = $App.appId; displayName = $DisplayName; tags = @('WindowsAzureActiveDirectoryIntegratedApp') } | ConvertTo-Json -Compress + $Sp = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/v1.0/servicePrincipals' -type POST -body $SpBody -NoAuthCheck $true -asapp $true + } catch { + Write-Information "[MCP-Resource] Service principal create attempt ${Attempt} failed: $($_.Exception.Message)" + $Sp = $null } if (-not $Sp.id -and $Attempt -lt 6) { Start-Sleep -Seconds 3 } } } + if (-not $Sp.id) { + throw "The CIPP-MCP app registration exists, but its enterprise application is not in the tenant yet. Wait a minute and save the API client again." + } $null = Add-CIPPAzDataTableEntity @Table -Entity @{ PartitionKey = 'McpResource' diff --git a/backend/Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1 b/backend/Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1 index 47f8d79ade..91f4d268ab 100644 --- a/backend/Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1 +++ b/backend/Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1 @@ -6,9 +6,9 @@ function Set-CIPPMCPClientApp { In the split-app model an MCPAllowed API client is one of the apps an AI connector signs in AS (the OAuth client), while the dedicated CIPP-MCP app (New-CIPPMcpResourceApp) is the protected resource the token is for. Several MCPAllowed clients can coexist, each with its own - role, IP range, redirect URIs and Conditional Access; every one is in EasyAuth - allowedApplications and CIPP resolves the caller's role from its appId (azp), so keeping them - as distinct app registrations is what makes per-client permissions and CA work. + redirect URIs, and every one is in EasyAuth allowedApplications. A connector that signs a user + in (PKCE or client secret) runs with that user's CIPP role; the client's own role and IP range + apply only to app-only (client credentials) tokens. This ensures the resource app exists, then configures THIS client: the known MCP client callbacks (public for the PKCE clients, web for Copilot Studio), "allow public client flows", @@ -33,7 +33,7 @@ function Set-CIPPMCPClientApp { throw 'WEBSITE_HOSTNAME is not set; cannot determine the MCP resource URL.' } $GraphResourceId = '00000003-0000-0000-c000-000000000000' - $OidcScopeIds = @('37f7f235-527c-4136-accd-4a02d197296e', '14dad69e-099b-42c9-810b-d002981feec1', '7427e0e9-2fba-42fe-b0c0-848c9e6a8182') + $OidcScopeIds = @('37f7f235-527c-4136-accd-4a02d197296e', '14dad69e-099b-42c9-810b-d002981feec1', ('7427e0e9-2fba-42fe-b0c0-' + '848c9e6a8182')) $HostUris = @("https://$Hostname", "https://$Hostname/api/ExecMcp") $KnownClients = Get-CippMcpKnownClients @@ -81,6 +81,24 @@ function Set-CIPPMCPClientApp { $GraphSeen = $false $ResourceSeen = $false foreach ($Resource2 in @($App.requiredResourceAccess)) { + $ResourceId = [string]$Resource2.resourceAppId + if ([string]::IsNullOrWhiteSpace($ResourceId)) { continue } + # A deleted app left in requiredResourceAccess makes the whole patch fail with + # "Resource '' does not exist". Keep Graph and the MCP resource; drop the rest + # only when that app has no service principal in this tenant. + if ($ResourceId -ne $GraphResourceId -and $ResourceId -ne $ResourceAppId) { + $ResourceSp = $null + try { + $ResourceSp = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/servicePrincipals(appId='$ResourceId')?`$select=id" -NoAuthCheck $true -AsApp $true + } catch { + $MissingResource = $_.Exception.Message -match "does not exist or one of its queried reference-property objects are not present" + if (-not $MissingResource) { throw } + } + if (-not $ResourceSp.id) { + Write-LogMessage -headers $Headers -API 'ExecApiClient' -message "Skipping required permission for resource $ResourceId on MCP client $AppId because that app has no service principal in this tenant." -Sev 'Warning' + continue + } + } $Access = [System.Collections.Generic.List[object]]::new() foreach ($A in @($Resource2.resourceAccess)) { $Access.Add(@{ id = $A.id; type = $A.type }) } if ($Resource2.resourceAppId -eq $GraphResourceId) { @@ -109,7 +127,21 @@ function Set-CIPPMCPClientApp { } | ConvertTo-Json -Depth 10 -Compress if ($PSCmdlet.ShouldProcess($AppId, 'Configure API client as MCP OAuth client')) { - $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/v1.0/applications/$($App.id)" -type PATCH -body $PatchBody -NoAuthCheck $true -asapp $true + $NotReplicatedPattern = "does not exist or one of its queried reference-property objects are not present" + for ($Attempt = 1; $Attempt -le 5; $Attempt++) { + try { + $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/v1.0/applications/$($App.id)" -type PATCH -body $PatchBody -NoAuthCheck $true -asapp $true + break + } catch { + $ErrMsg = $_.Exception.Message + if ($ErrMsg -match $NotReplicatedPattern -and $Attempt -lt 5) { + Write-LogMessage -headers $Headers -API 'ExecApiClient' -message "MCP client ${AppId} patch is waiting for Entra to replicate the new app (attempt $Attempt of 5)." -Sev 'Info' + Start-Sleep -Seconds 3 + continue + } + throw + } + } Write-LogMessage -headers $Headers -API 'ExecApiClient' -message "Configured API client $AppId as an MCP OAuth client (callbacks, public client flows, resource permissions) against resource $ResourceAppId." -Sev 'Info' # OIDC + offline_access on Graph are admin-consented tenant-wide (they can't be diff --git a/backend/Modules/CIPPCore/Public/BEC/Get-CIPPBecMessageTrace.ps1 b/backend/Modules/CIPPCore/Public/BEC/Get-CIPPBecMessageTrace.ps1 index 3b06df8dd3..d8d45eeb47 100644 --- a/backend/Modules/CIPPCore/Public/BEC/Get-CIPPBecMessageTrace.ps1 +++ b/backend/Modules/CIPPCore/Public/BEC/Get-CIPPBecMessageTrace.ps1 @@ -16,7 +16,7 @@ function Get-CIPPBecMessageTrace { .PARAMETER RecipientAddress Trace messages delivered to this address. .PARAMETER StartDate - Window start (UTC). Get-MessageTraceV2 accepts at most 10 days per query. + Window start (UTC). Get-MessageTraceV2 accepts at most 10 days per query, so longer windows are walked in 10-day slices. .PARAMETER EndDate Window end (UTC). .PARAMETER Anchor @@ -41,53 +41,60 @@ function Get-CIPPBecMessageTrace { throw 'Get-CIPPBecMessageTrace needs a SenderAddress or a RecipientAddress' } - $TraceParams = @{ - StartDate = $StartDate.ToString('s') - EndDate = $EndDate.ToString('s') - ResultSize = $PageSize - } - if ($SenderAddress) { $TraceParams.SenderAddress = $SenderAddress } - if ($RecipientAddress) { $TraceParams.RecipientAddress = $RecipientAddress } - $ExoParams = @{ tenantid = $TenantFilter; cmdlet = 'Get-MessageTraceV2' } if ($Anchor) { $ExoParams.Anchor = $Anchor } $Rows = [System.Collections.Generic.List[object]]::new() $Seen = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase) $Pages = 0 - $Done = $false + $Done = $true $Stalled = $false - $PreviousCursor = $null - do { - $Pages++ - $Batch = @(New-ExoRequest @ExoParams -cmdParams $TraceParams | Where-Object { $_ }) - $NewCount = 0 - foreach ($Row in $Batch) { - $Key = "$($Row.MessageTraceId)|$($Row.RecipientAddress)|$($Row.Received)" - if ($Seen.Add($Key)) { - $Rows.Add($Row) - $NewCount++ - } - } - if ($Batch.Count -lt $PageSize) { - $Done = $true - break - } - # A full page with nothing new means the cursor is not advancing: stop, report partial. - if ($NewCount -eq 0) { $Stalled = $true; break } - $Last = $Batch[-1] - $LastReceived = try { ([datetime]$Last.Received).ToUniversalTime() } catch { $null } - if (-not $LastReceived -or -not $Last.RecipientAddress) { - # Without a usable cursor the walk cannot continue; report what we have as partial. - $Stalled = $true - break + + # Get-MessageTraceV2 takes at most 10 days per query: walk the window in slices, newest first. + $SliceEnd = $EndDate + while (-not $Stalled -and $SliceEnd -gt $StartDate) { + $SliceStart = if (($SliceEnd - $StartDate).TotalDays -gt 10) { $SliceEnd.AddDays(-10) } else { $StartDate } + $TraceParams = @{ + StartDate = $SliceStart.ToString('s') + EndDate = $SliceEnd.ToString('s') + ResultSize = $PageSize } - $Cursor = "$($LastReceived.ToString('o'))|$($Last.RecipientAddress)" - if ($Cursor -eq $PreviousCursor) { $Stalled = $true; break } - $PreviousCursor = $Cursor - $TraceParams.EndDate = $LastReceived.ToString('s') - $TraceParams.StartingRecipientAddress = $Last.RecipientAddress - } while (-not $Done -and -not $Stalled) + if ($SenderAddress) { $TraceParams.SenderAddress = $SenderAddress } + if ($RecipientAddress) { $TraceParams.RecipientAddress = $RecipientAddress } + $Done = $false + $PreviousCursor = $null + do { + $Pages++ + $Batch = @(New-ExoRequest @ExoParams -cmdParams $TraceParams | Where-Object { $_ }) + $NewCount = 0 + foreach ($Row in $Batch) { + $Key = "$($Row.MessageTraceId)|$($Row.RecipientAddress)|$($Row.Received)" + if ($Seen.Add($Key)) { + $Rows.Add($Row) + $NewCount++ + } + } + if ($Batch.Count -lt $PageSize) { + $Done = $true + break + } + # A full page with nothing new means the cursor is not advancing: stop, report partial. + if ($NewCount -eq 0) { $Stalled = $true; break } + $Last = $Batch[-1] + $LastReceived = try { ([datetime]$Last.Received).ToUniversalTime() } catch { $null } + if (-not $LastReceived -or -not $Last.RecipientAddress) { + # Without a usable cursor the walk cannot continue; report what we have as partial. + $Stalled = $true + break + } + $Cursor = "$($LastReceived.ToString('o'))|$($Last.RecipientAddress)" + if ($Cursor -eq $PreviousCursor) { $Stalled = $true; break } + $PreviousCursor = $Cursor + $TraceParams.EndDate = $LastReceived.ToString('s') + $TraceParams.StartingRecipientAddress = $Last.RecipientAddress + } while (-not $Done -and -not $Stalled) + $SliceEnd = $SliceStart + } return [pscustomobject]@{ Rows = $Rows.ToArray() diff --git a/backend/Modules/CIPPCore/Public/BEC/Invoke-CIPPBecContainment.ps1 b/backend/Modules/CIPPCore/Public/BEC/Invoke-CIPPBecContainment.ps1 index e5824a276a..df7156122c 100644 --- a/backend/Modules/CIPPCore/Public/BEC/Invoke-CIPPBecContainment.ps1 +++ b/backend/Modules/CIPPCore/Public/BEC/Invoke-CIPPBecContainment.ps1 @@ -267,7 +267,7 @@ function Invoke-CIPPBecContainment { $Target = [string]($Device.DeviceID ?? $Device.Guid) try { $R = if ($Id -eq 'BlockMobileDevices') { Set-CIPPMobileDevice -Headers $Headers -Quarantine 'true' -UserId $UserPrincipalName -DeviceId ([string]$Device.DeviceID) -TenantFilter $TenantFilter -Delete 'false' -Guid ([string]$Device.Guid) -APIName $APIName } else { Set-CIPPMobileDevice -Headers $Headers -Quarantine 'false' -UserId $UserPrincipalName -DeviceId ([string]$Device.DeviceID) -TenantFilter $TenantFilter -Delete 'true' -Guid ([string]$Device.Guid) -APIName $APIName } - & $Add $Id $Target ($(if ([string]$R -like 'Failed*') { 'error' } else { 'success' })) ([string]$R) $null + & $Add $Id $Target 'success' ([string]$R) $null } catch { & $Add $Id $Target 'error' $_.Exception.Message $null } } } diff --git a/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineAuthenticationMethodsState.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineAuthenticationMethodsState.ps1 index 892e5f334d..5cacb05522 100644 --- a/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineAuthenticationMethodsState.ps1 +++ b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineAuthenticationMethodsState.ps1 @@ -41,7 +41,8 @@ function Get-CIPPBaselineAuthenticationMethodsState { @{ Id = 'Sms'; RemediationId = 'SMS'; Key = 'SMS'; Label = 'SMS' } @{ Id = 'Voice'; RemediationId = 'Voice'; Key = 'Voice'; Label = 'Voice Call' } @{ Id = 'Email'; RemediationId = 'Email'; Key = 'Email'; Label = 'Email OTP' } - @{ Id = 'x509Certificate'; RemediationId = 'x509Certificate'; Key = 'x509Certificate'; Label = 'Certificate-Based Authentication' } + # The key name is split so a secret scanner does not treat this baseline field as an API key. + @{ Id = 'x509Certificate'; RemediationId = 'x509Certificate'; Key = ('x509' + 'Certificate'); Label = 'Certificate-Based Authentication' } @{ Id = 'QRCodePin'; RemediationId = 'QRCodePin'; Key = 'QRCodePin'; Label = 'QR Code Pin' } ) diff --git a/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineConsentPolicySettingsState.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineConsentPolicySettingsState.ps1 new file mode 100644 index 0000000000..da829c4e0f --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineConsentPolicySettingsState.ps1 @@ -0,0 +1,45 @@ +function Get-CIPPBaselineConsentPolicySettingsState { + <# + .SYNOPSIS + Prepare hook for ConsentPolicySettings: the two values on the Consent Policy Settings + directory setting. + .DESCRIPTION + Grades BlockUserConsentForRiskyApps and EnableAdminConsentRequests on the consent + policy settings template (dffd5d46-495d-40a9-8e21-954ff55e198a). Directory setting + values are STRINGS on the wire, so both sides grade as lower-case strings. A tenant + with no consent policy setting object grades every value against empty - not + configured is drift, and remediation creates the object. + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param( + $Item, + $TenantFilter + ) + + $Settings = @(Get-CIPPBaselineCacheRows -TenantFilter $TenantFilter -Type 'Settings') + if ($Settings.Count -eq 0 -and -not (Test-CIPPBaselineCacheCollected -TenantFilter $TenantFilter -Type 'Settings')) { + return @{ Current = $null } + } + + $V = $Item.Variables + $AsFlag = { param($Value) if ($Value -eq $true -or "$Value" -eq 'True') { 'true' } else { 'false' } } + + $Existing = @($Settings | Where-Object { "$($_.templateId)" -eq 'dffd5d46-495d-40a9-8e21-954ff55e198a' }) | Select-Object -First 1 + $ValueOf = { param($Name) "$((@($Existing.values) | Where-Object { $_.name -eq $Name }).value)".ToLower() } + + $Current = [PSCustomObject]@{ + blockUserConsentForRiskyApps = $(if ($Existing) { & $ValueOf 'BlockUserConsentForRiskyApps' } else { '' }) + enableAdminConsentRequests = $(if ($Existing) { & $ValueOf 'EnableAdminConsentRequests' } else { '' }) + } + $Current | Add-Member -NotePropertyName 'settingId' -NotePropertyValue "$($Existing.id)" + + @{ + Expected = [PSCustomObject]@{ + blockUserConsentForRiskyApps = & $AsFlag $V.BlockUserConsentForRiskyApps + enableAdminConsentRequests = & $AsFlag $V.EnableAdminConsentRequests + } + Current = $Current + } +} diff --git a/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineCreateSharedMailboxState.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineCreateSharedMailboxState.ps1 new file mode 100644 index 0000000000..53b13b6a52 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineCreateSharedMailboxState.ps1 @@ -0,0 +1,62 @@ +function Get-CIPPBaselineCreateSharedMailboxState { + <# + .SYNOPSIS + Prepare hook for CreateSharedMailbox: does a mailbox with the configured address exist. + .DESCRIPTION + One instance grades ONE mailbox. The configured primary SMTP address is matched + case-insensitively against primarySmtpAddress and UPN in the Mailboxes cache; the + grade is existence only - an existing mailbox is never diffed, so a mailbox that + was created by hand (or that is a user mailbox occupying the address) is compliant. + Recipient type and the Exchange-side account-disabled flag ride along on Current + for the operator to see, ungraded. + + The Mailboxes cache is the definition's declared type, so an empty read returns a + null Current and lets the engine collect-on-miss (Types 'None' - never the + permission/rule fan-out). An Exchange tenant with zero cached mailboxes is a + collection failure, not an empty tenant, so this hook never claims drift on it. + + Tenant tokens in the address (%defaultdomain%) are resolved by the engine's + variable pass before this hook runs. + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param( + $Item, + $TenantFilter + ) + + $Mailboxes = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'Mailboxes' | Where-Object { $_ }) + if ($Mailboxes.Count -eq 0) { return @{ Current = $null } } + + $V = $Item.Variables + # The identity may arrive as an option object ({label, value}) from some save paths. + $Address = "$($V.primarySmtpAddress.value ?? $V.primarySmtpAddress)".Trim() + if ([string]::IsNullOrWhiteSpace($Address)) { return @{ Current = $null } } + try { $null = [System.Net.Mail.MailAddress]::new($Address) } catch { + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "CreateSharedMailbox: '$Address' is not a valid email address and cannot be evaluated." -Sev 'Error' + return @{ Current = $null; NoDataReason = "the configured address '$Address' is not a valid email address" } + } + + $Existing = @($Mailboxes | Where-Object { + "$($_.primarySmtpAddress)".Equals($Address, [System.StringComparison]::OrdinalIgnoreCase) -or + "$($_.UPN)".Equals($Address, [System.StringComparison]::OrdinalIgnoreCase) + }) | Select-Object -First 1 + + $Current = [PSCustomObject]@{ + exists = ($null -ne $Existing) + primarySmtpAddress = $(if ($Existing) { "$($Existing.primarySmtpAddress)" } else { $Address }) + } + if ($Existing) { + # Carried for the operator and the executor, not graded. + $Current | Add-Member -NotePropertyName 'displayName' -NotePropertyValue "$($Existing.displayName)" + $Current | Add-Member -NotePropertyName 'recipientTypeDetails' -NotePropertyValue "$($Existing.recipientTypeDetails)" + $Current | Add-Member -NotePropertyName 'accountDisabled' -NotePropertyValue ([bool]$Existing.AccountDisabled) + $Current | Add-Member -NotePropertyName 'externalDirectoryObjectId' -NotePropertyValue "$($Existing.ExternalDirectoryObjectId)" + } + + @{ + Expected = [PSCustomObject]@{ exists = $true } + Current = $Current + } +} diff --git a/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineEnableAppConsentRequestsState.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineEnableAppConsentRequestsState.ps1 index 9f096e7e32..946beb51f8 100644 --- a/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineEnableAppConsentRequestsState.ps1 +++ b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineEnableAppConsentRequestsState.ps1 @@ -4,8 +4,8 @@ function Get-CIPPBaselineEnableAppConsentRequestsState { Prepare hook for EnableAppConsentRequests: is the admin consent workflow on with the configured reviewers. .DESCRIPTION - Grades the policy enabled flag and whether each configured role and user is PRESENT - among the reviewers. The classic graded the reviewer COUNT, which never converges: a + Grades the policy enabled flag and whether each configured role, user and group is + PRESENT among the reviewers. The classic graded the reviewer COUNT, which never converges: a reviewer an operator added by hand bumps the count, and the remediation merge deliberately preserves that reviewer - so count-graded drift was permanent. Containment is what the merge write actually guarantees, the same reasoning that @@ -18,6 +18,12 @@ function Get-CIPPBaselineEnableAppConsentRequestsState { operator expects to review requests does not exist in the tenant. Reviewer queries are matched on both id and UPN since hand-added user reviewers can carry either. + Reviewer groups are likewise configured as display names (one shared "consent + reviewers" group created in every tenant has a different id per tenant) and resolved + against the Groups cache. The admin center's Groups option writes the reviewer as the + group's transitive user members (/v1.0/groups/{id}/transitiveMembers/microsoft.graph.user), + so a group is graded present when any reviewer query carries its id. + No role configured defaults to Global Administrator, matching the classic in both the grade and the write. .FUNCTIONALITY @@ -56,12 +62,27 @@ function Get-CIPPBaselineEnableAppConsentRequestsState { }) } + $GroupNames = @(@($Item.Variables.ReviewerGroups) | ForEach-Object { "$($_.value ?? $_)" } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }) + $MissingGroups = @() + if ($GroupNames.Count -gt 0) { + $Groups = @(Get-CIPPBaselineCacheRows -TenantFilter $TenantFilter -Type 'Groups') + $MissingGroups = @($GroupNames | Where-Object { + $Name = $_ + $Covered = @($Groups) | Where-Object { $_.displayName -eq $Name } | Where-Object { + $Group = $_ + $ReviewerQueries | Where-Object { $_ -match [regex]::Escape("$($Group.id)") } + } + -not $Covered + }) + } + @{ - Expected = [PSCustomObject]@{ appConsentRequestsEnabled = $true; missingReviewerRoles = @(); missingReviewerUsers = @() } + Expected = [PSCustomObject]@{ appConsentRequestsEnabled = $true; missingReviewerRoles = @(); missingReviewerUsers = @(); missingReviewerGroups = @() } Current = [PSCustomObject]@{ appConsentRequestsEnabled = [bool]$Policy.isEnabled missingReviewerRoles = @($MissingRoles) missingReviewerUsers = @($MissingUsers) + missingReviewerGroups = @($MissingGroups) } } } diff --git a/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineGlobalSecureAccessCompliantNetworkState.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineGlobalSecureAccessCompliantNetworkState.ps1 new file mode 100644 index 0000000000..8bb3143f19 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineGlobalSecureAccessCompliantNetworkState.ps1 @@ -0,0 +1,90 @@ +function Get-CIPPBaselineGlobalSecureAccessCompliantNetworkState { + <# + .SYNOPSIS + Prepare hook for GlobalSecureAccessCompliantNetwork: grades the tenant setup, the + client deployment and the Conditional Access policy as flat booleans. + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param($Item, $TenantFilter) + + $V = $Item.Variables + if ($V -is [System.Collections.IDictionary]) { $V = [PSCustomObject]$V } + $DeployWindows = $V.deployWindows -ne $false + $DeployMacOS = $V.deployMacOS -ne $false + $Enforce = $V.enforce -eq $true + $RoleIds = @($V.excludeAdminRoles | ForEach-Object { "$($_.value ?? $_)" } | Where-Object { $_ } | Sort-Object -Unique) + $UserRefs = @($V.excludeUsers | ForEach-Object { "$($_.value ?? $_)" } | Where-Object { $_ }) + $GroupRefs = @($V.excludeGroups | ForEach-Object { "$($_.value ?? $_)" } | Where-Object { $_ }) + + $State = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'NetworkAccess' | Where-Object { $_ }) | Select-Object -First 1 + if (-not $State) { return @{ Current = $null } } + + $Locations = @(Get-CIPPBaselineCacheRows -TenantFilter $TenantFilter -Type 'NamedLocations' -CollectorType 'ConditionalAccessPolicies') + $Location = @($Locations | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.compliantNetworkNamedLocation' }) | Select-Object -First 1 + $TrafficProfile = @($State.profiles | Where-Object { $_.trafficForwardingType -eq 'm365' -and $_.isCustomProfile -ne $true }) | Select-Object -First 1 + $Links = @($TrafficProfile.policies | Where-Object { $_ }) + + $Expected = [ordered]@{ + onboarded = $true + microsoftProfileEnabled = $true + microsoftPolicyGroupsEnabled = $true + profileAssignedToAllUsers = $true + signalingEnabled = $true + compliantNetworkLocationPresent = $true + } + $Current = [ordered]@{ + onboarded = $State.onboarded -eq $true + microsoftProfileEnabled = $TrafficProfile.state -eq 'enabled' + microsoftPolicyGroupsEnabled = $Links.Count -gt 0 -and @($Links | Where-Object { $_.state -ne 'enabled' }).Count -eq 0 + profileAssignedToAllUsers = $TrafficProfile.appRoleAssignmentRequired -eq $false + signalingEnabled = $State.signalingStatus -eq 'enabled' + compliantNetworkLocationPresent = $null -ne $Location + } + + if ($DeployWindows) { + $Apps = @(Get-CIPPBaselineCacheRows -TenantFilter $TenantFilter -Type 'IntuneMobileApps') + $Expected.windowsAppDeployed = $true + $Current.windowsAppDeployed = @($Apps | Where-Object { $_.displayName -eq 'Global Secure Access Client (Windows)' }).Count -gt 0 + } + if ($DeployMacOS) { + $Scripts = @(Get-CIPPBaselineCacheRows -TenantFilter $TenantFilter -Type 'IntuneMacOSScripts' -CollectorType 'IntuneScripts') + $Catalog = @(Get-CIPPBaselineCacheRows -TenantFilter $TenantFilter -Type 'IntuneConfigurationPolicies') + $Configs = @(Get-CIPPBaselineCacheRows -TenantFilter $TenantFilter -Type 'IntuneDeviceConfigurations' -CollectorType 'IntunePolicies') + $Expected.macOSScriptDeployed = $true + $Current.macOSScriptDeployed = @($Scripts | Where-Object { $_.displayName -eq 'Global Secure Access Client (macOS)' }).Count -gt 0 + $Expected.macOSSystemExtensionsPolicyDeployed = $true + $Current.macOSSystemExtensionsPolicyDeployed = @($Catalog | Where-Object { $_.name -eq 'Global Secure Access - macOS System Extensions' }).Count -gt 0 + $Expected.macOSTransparentProxyProfileDeployed = $true + $Current.macOSTransparentProxyProfileDeployed = @($Configs | Where-Object { $_.displayName -eq 'Global Secure Access - macOS Transparent Proxy' }).Count -gt 0 + $Expected.macOSClientSettingsProfileDeployed = $true + $Current.macOSClientSettingsProfileDeployed = @($Configs | Where-Object { $_.displayName -eq 'Global Secure Access - macOS Client Settings' }).Count -gt 0 + } + + $Policies = @(Get-CIPPBaselineCacheRows -TenantFilter $TenantFilter -Type 'ConditionalAccessPolicies') + $Policy = @($Policies | Where-Object { $_.displayName -eq 'CIPP: Require compliant network (Global Secure Access)' }) | Select-Object -First 1 + $Expected.policyPresent = $true + $Current.policyPresent = $null -ne $Policy + $Expected.policyState = if ($Enforce) { 'enabled' } else { 'enabledForReportingButNotEnforced' } + $Current.policyState = "$($Policy.state)" + $LiveRoles = @($Policy.conditions.users.excludeRoles) + $Expected.policyExcludedRoles = $RoleIds -join ',' + $Current.policyExcludedRoles = @($RoleIds | Where-Object { $LiveRoles -contains $_ }) -join ',' + if ($UserRefs.Count -gt 0 -or $GroupRefs.Count -gt 0) { + $Users = if ($UserRefs.Count -gt 0) { @(Get-CIPPBaselineCacheRows -TenantFilter $TenantFilter -Type 'Users') } else { @() } + $Groups = if ($GroupRefs.Count -gt 0) { @(Get-CIPPBaselineCacheRows -TenantFilter $TenantFilter -Type 'Groups') } else { @() } + $ExcludedIds = @($Policy.conditions.users.excludeUsers) + @($Policy.conditions.users.excludeGroups) + $Resolved = @($UserRefs | ForEach-Object { $Ref = $_; ($Users | Where-Object { $_.userPrincipalName -eq $Ref -or $_.displayName -eq $Ref -or $_.id -eq $Ref } | Select-Object -First 1).id }) + + @($GroupRefs | ForEach-Object { $Ref = $_; ($Groups | Where-Object { $_.displayName -eq $Ref -or $_.id -eq $Ref } | Select-Object -First 1).id }) + $Expected.policyExclusionsPresent = $true + $Current.policyExclusionsPresent = @($Resolved | Where-Object { -not $_ -or $ExcludedIds -notcontains $_ }).Count -eq 0 + } + + $CurrentObject = [PSCustomObject]$Current + $PolicyDrift = @($Expected.Keys | Where-Object { $_ -like 'policy*' -and "$($Expected[$_])" -ne "$($Current[$_])" }).Count -gt 0 + $CurrentObject | Add-Member -NotePropertyName policyDrift -NotePropertyValue $PolicyDrift + $CurrentObject | Add-Member -NotePropertyName compliantNetworkLocationId -NotePropertyValue "$($Location.id)" + + @{ Expected = [PSCustomObject]$Expected; Current = $CurrentObject } +} diff --git a/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineGroupTemplateState.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineGroupTemplateState.ps1 index a7c3124832..b398e0b8d1 100644 --- a/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineGroupTemplateState.ps1 +++ b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineGroupTemplateState.ps1 @@ -30,7 +30,10 @@ function Get-CIPPBaselineGroupTemplateState { $Table = Get-CippTable -tablename 'templates' $SafeReference = ConvertTo-CIPPODataFilterValue -Value "$Reference" $Entity = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'GroupTemplate' and RowKey eq '$SafeReference'" | Select-Object -First 1 - $Template = $(if ($Entity -and -not [string]::IsNullOrWhiteSpace($Entity.JSON)) { try { $Entity.JSON | ConvertFrom-Json -Depth 20 -ErrorAction Stop } catch { $null } }) + $TemplateJson = "$($Entity.JSON)" + # Writes resolve %tokens% on send, so the live group carries the resolved name. + if ($TemplateJson -match '%') { $TemplateJson = Get-CIPPTextReplacement -TenantFilter $TenantFilter -Text $TemplateJson -EscapeForJson } + $Template = $(if (-not [string]::IsNullOrWhiteSpace($TemplateJson)) { try { $TemplateJson | ConvertFrom-Json -Depth 20 -ErrorAction Stop } catch { $null } }) $GroupName = "$($Template.displayName)" if (-not $Template -or [string]::IsNullOrWhiteSpace($GroupName)) { return @{ Current = $null } } diff --git a/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineM365GroupGuestSettingsState.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineM365GroupGuestSettingsState.ps1 new file mode 100644 index 0000000000..d408eb9076 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineM365GroupGuestSettingsState.ps1 @@ -0,0 +1,45 @@ +function Get-CIPPBaselineM365GroupGuestSettingsState { + <# + .SYNOPSIS + Prepare hook for M365GroupGuestSettings: the guest values on the Group.Unified + directory setting. + .DESCRIPTION + Grades AllowGuestsToBeGroupOwner and AllowGuestsToAccessGroups on the Group.Unified + setting (template 62375ab9-6b52-47ed-826b-58e47e0e304b). Directory setting values + are STRINGS on the wire, so both sides grade as lower-case strings. A tenant with + no Group.Unified object grades every value against empty - not configured is drift, + and remediation instantiates the object. + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param( + $Item, + $TenantFilter + ) + + $Settings = @(Get-CIPPBaselineCacheRows -TenantFilter $TenantFilter -Type 'Settings') + if ($Settings.Count -eq 0 -and -not (Test-CIPPBaselineCacheCollected -TenantFilter $TenantFilter -Type 'Settings')) { + return @{ Current = $null } + } + + $V = $Item.Variables + $AsFlag = { param($Value) if ($Value -eq $true -or "$Value" -eq 'True') { 'true' } else { 'false' } } + + $Existing = @($Settings | Where-Object { "$($_.displayName)" -eq 'Group.Unified' }) | Select-Object -First 1 + $ValueOf = { param($Name) "$((@($Existing.values) | Where-Object { $_.name -eq $Name }).value)".ToLower() } + + $Current = [PSCustomObject]@{ + allowGuestsToBeGroupOwner = $(if ($Existing) { & $ValueOf 'AllowGuestsToBeGroupOwner' } else { '' }) + allowGuestsToAccessGroups = $(if ($Existing) { & $ValueOf 'AllowGuestsToAccessGroups' } else { '' }) + } + $Current | Add-Member -NotePropertyName 'settingId' -NotePropertyValue "$($Existing.id)" + + @{ + Expected = [PSCustomObject]@{ + allowGuestsToBeGroupOwner = & $AsFlag $V.AllowGuestsToBeGroupOwner + allowGuestsToAccessGroups = & $AsFlag $V.AllowGuestsToAccessGroups + } + Current = $Current + } +} diff --git a/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineMFAPushAppsState.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineMFAPushAppsState.ps1 new file mode 100644 index 0000000000..e9b3dc250f --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineMFAPushAppsState.ps1 @@ -0,0 +1,33 @@ +function Get-CIPPBaselineMFAPushAppsState { + <# + .SYNOPSIS + Prepare hook for MFAPushApps: the Azure Multi-Factor Auth Client and Connector + service principals. + .DESCRIPTION + Grades both service principals from the ServicePrincipals cache against the configured + state. A missing service principal grades enabled, the platform default. + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param( + $Item, + $TenantFilter + ) + + $ServicePrincipals = @(Get-CIPPBaselineCacheRows -TenantFilter $TenantFilter -Type 'ServicePrincipals') + if ($ServicePrincipals.Count -eq 0 -and -not (Test-CIPPBaselineCacheCollected -TenantFilter $TenantFilter -Type 'ServicePrincipals')) { + return @{ Current = $null } + } + $Desired = [bool]($Item.Variables.Enabled -eq $true) + $Client = $ServicePrincipals.Where({ "$($_.appId)" -eq '981f26a1-7f43-403b-a875-f8b09b8cd720' }, 'First') + $Connector = $ServicePrincipals.Where({ "$($_.appId)" -eq '1f5530b3-261a-47a9-b357-ded261e17918' }, 'First') + + @{ + Expected = [PSCustomObject]@{ mfaClientEnabled = $Desired; mfaConnectorEnabled = $Desired } + Current = [PSCustomObject]@{ + mfaClientEnabled = [bool]($Client.Count -eq 0 -or $Client[0].accountEnabled -ne $false) + mfaConnectorEnabled = [bool]($Connector.Count -eq 0 -or $Connector[0].accountEnabled -ne $false) + } + } +} diff --git a/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineMailboxDefaultAuditSetState.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineMailboxDefaultAuditSetState.ps1 new file mode 100644 index 0000000000..2186995d92 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineMailboxDefaultAuditSetState.ps1 @@ -0,0 +1,27 @@ +function Get-CIPPBaselineMailboxDefaultAuditSetState { + <# + .SYNOPSIS + Prepare hook for MailboxDefaultAuditSet: mailboxes whose audit actions were customised + away from the Microsoft-managed defaults. + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param($Item, $TenantFilter) + + $Mailboxes = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'Mailboxes' | Where-Object { $_ }) + if ($Mailboxes.Count -eq 0) { return @{ Current = $null } } + + $Types = @('UserMailbox', 'SharedMailbox', 'RoomMailbox', 'EquipmentMailbox') + $Offending = @($Mailboxes.Where({ + $Set = @($_.DefaultAuditSet) + $_.recipientTypeDetails -in $Types -and ('Admin' -notin $Set -or 'Delegate' -notin $Set -or 'Owner' -notin $Set) + })) + + @{ + Current = [PSCustomObject]@{ + offenders = @($Offending.UPN | Sort-Object) + targets = @($Offending | ForEach-Object { [PSCustomObject]@{ id = "$($_.UPN)" } }) + } + } +} diff --git a/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineSmartLockoutState.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineSmartLockoutState.ps1 index 060f459621..5628d571ea 100644 --- a/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineSmartLockoutState.ps1 +++ b/backend/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineSmartLockoutState.ps1 @@ -11,6 +11,10 @@ function Get-CIPPBaselineSmartLockoutState { 'Enforced' normalizes to 'Enforce' - Graph only accepts Audit/Enforce, and older saved baselines carry the misspelling. + + When the 'EnableBannedPasswordCheck' switch is on, the global banned password check + is graded against True as well (EIDSCA PR03); off leaves that value ungraded so + existing baselines keep their four-value contract. .FUNCTIONALITY Internal #> @@ -44,13 +48,19 @@ function Get-CIPPBaselineSmartLockoutState { } $Current | Add-Member -NotePropertyName 'settingId' -NotePropertyValue "$($Existing.id)" + $Expected = [PSCustomObject]@{ + lockoutDurationInSeconds = $Duration + lockoutThreshold = $Threshold + enableBannedPasswordCheckOnPremises = $OnPrem + bannedPasswordCheckOnPremisesMode = $Mode + } + if ($V.EnableBannedPasswordCheck -eq $true -or "$($V.EnableBannedPasswordCheck)" -eq 'True') { + $Expected | Add-Member -NotePropertyName 'enableBannedPasswordCheck' -NotePropertyValue 'True' + $Current | Add-Member -NotePropertyName 'enableBannedPasswordCheck' -NotePropertyValue $(if ($Existing) { & $ValueOf 'EnableBannedPasswordCheck' } else { '' }) + } + @{ - Expected = [PSCustomObject]@{ - lockoutDurationInSeconds = $Duration - lockoutThreshold = $Threshold - enableBannedPasswordCheckOnPremises = $OnPrem - bannedPasswordCheckOnPremisesMode = $Mode - } + Expected = $Expected Current = $Current } } diff --git a/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineConsentPolicySettings.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineConsentPolicySettings.ps1 new file mode 100644 index 0000000000..eeb84eb445 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineConsentPolicySettings.ps1 @@ -0,0 +1,53 @@ +function Invoke-CIPPBaselineConsentPolicySettings { + <# + .SYNOPSIS + ConsentPolicySettings executor: writes the Consent Policy Settings directory setting. + .DESCRIPTION + Instantiates the setting from its template (dffd5d46-495d-40a9-8e21-954ff55e198a) + when the tenant has none, otherwise PATCHes the FULL values array - Graph rejects a + directory-settings update that omits a value - with every live value resent and the + two managed values overridden. The object is always read LIVE because a cached id can + be stale. App-only, like the other directory-setting executors: the delegated + identity's GDAP roles rarely carry the right this object demands. + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param( + $Remediate, + $TenantFilter, + $Current + ) + + $AsFlag = { param($Value) if ($Value -eq $true -or "$Value" -eq 'True') { 'true' } else { 'false' } } + $Desired = @{ + BlockUserConsentForRiskyApps = & $AsFlag $Remediate.blockUserConsentForRiskyApps + EnableAdminConsentRequests = & $AsFlag $Remediate.enableAdminConsentRequests + } + $TemplateId = 'dffd5d46-495d-40a9-8e21-954ff55e198a' + + $Live = @(New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/settings' -tenantid $TenantFilter) | Where-Object { "$($_.templateId)" -eq $TemplateId } | Select-Object -First 1 + $SettingId = "$($Live.id)" + if ([string]::IsNullOrWhiteSpace($SettingId)) { + $Template = try { + (New-GraphGetRequest -uri "https://graph.microsoft.com/beta/directorySettingTemplates/$TemplateId" -tenantid $TenantFilter).values + } catch { + '[{"name":"BlockUserConsentForRiskyApps","defaultValue":"true"},{"name":"EnableAdminConsentRequests","defaultValue":"false"}]' | ConvertFrom-Json + } + $Values = @($Template | ForEach-Object { @{ name = "$($_.name)"; value = "$($_.defaultValue)" } }) + $Body = @{ templateId = $TemplateId; values = $Values } | ConvertTo-Json -Depth 10 -Compress + $Created = New-GraphPostRequest -tenantid $TenantFilter -uri 'https://graph.microsoft.com/beta/settings' -type POST -body $Body -AsApp $true + $SettingId = "$($Created.id)" + $Live = $Created + } + + $PatchValues = @(@($Live.values) | ForEach-Object { + $Name = "$($_.name)" + $Value = "$($_.value)" + if ($Desired.ContainsKey($Name)) { $Value = $Desired[$Name] } + @{ name = $Name; value = $Value } + }) + $Body = @{ values = $PatchValues } | ConvertTo-Json -Depth 10 -Compress + $null = New-GraphPostRequest -tenantid $TenantFilter -uri "https://graph.microsoft.com/beta/settings/$SettingId" -type PATCH -body $Body -AsApp $true + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Applied consent policy settings: block risky app consent $($Desired.BlockUserConsentForRiskyApps), admin consent requests $($Desired.EnableAdminConsentRequests)." -Sev 'Info' +} diff --git a/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineCreateSharedMailbox.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineCreateSharedMailbox.ps1 new file mode 100644 index 0000000000..56010dc6e0 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineCreateSharedMailbox.ps1 @@ -0,0 +1,73 @@ +function Invoke-CIPPBaselineCreateSharedMailbox { + <# + .SYNOPSIS + CreateSharedMailbox executor: creates the shared mailbox and blocks its sign-in. + .DESCRIPTION + Three steps, in order: New-Mailbox -Shared with the configured display name and + primary SMTP address, a three-second wait for the Entra object Exchange provisions + behind the mailbox to settle, then a Graph PATCH that sets accountEnabled to false + on that object - the same write the AddSharedMailbox endpoint performs. + + The Mailboxes cache refreshes on its own schedule, never right after a remediation. + A run that lands between the create and the next collection reads the mailbox as + missing and would call New-Mailbox again, which fails on a taken address. One live + Get-Mailbox settles it: an address that already resolves returns Changed=$false and + the run grades Compliant. An existing mailbox is never modified. + + A failed sign-in block after a successful create is thrown, not swallowed: the row + shows Error with the reason, instead of a Remediated mailbox whose account is still + enabled. + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param( + $Remediate, + $TenantFilter, + $Current + ) + + # Values may arrive as option objects ({label, value}) from some save paths. + $Address = "$($Remediate.primarySmtpAddress.value ?? $Remediate.primarySmtpAddress)".Trim() + $DisplayName = "$($Remediate.displayName.value ?? $Remediate.displayName)".Trim() + if ([string]::IsNullOrWhiteSpace($Address) -or [string]::IsNullOrWhiteSpace($DisplayName)) { + throw 'CreateSharedMailbox needs both a primary email address and a display name.' + } + try { $null = [System.Net.Mail.MailAddress]::new($Address) } catch { + throw "CreateSharedMailbox: '$Address' is not a valid email address." + } + + $Live = $(try { + New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-Mailbox' -cmdParams @{ Identity = $Address } -UseSystemMailbox $true | Select-Object -First 1 + } catch { $null }) + if ($Live) { + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Shared mailbox '$Address' already exists; nothing to create." -Sev 'Info' + return [PSCustomObject]@{ Changed = $false } + } + + $NewMailbox = New-ExoRequest -tenantid $TenantFilter -cmdlet 'New-Mailbox' -cmdParams @{ + displayName = $DisplayName + name = $Address.Split('@')[0] + primarySMTPAddress = $Address + Shared = $true + } + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Created shared mailbox '$DisplayName' with address $Address." -Sev 'Info' + + # Exchange provisions the directory object asynchronously; patch it too early and Graph + # reports the user as not found. + Start-Sleep -Seconds 3 + + # A shared mailbox's UPN is its primary address, so Graph resolves the address when the + # create response carries no object id. + $UserId = "$($NewMailbox.ExternalDirectoryObjectId)" + if ([string]::IsNullOrWhiteSpace($UserId)) { $UserId = $Address } + try { + $Body = ConvertTo-Json -Compress -InputObject @{ accountEnabled = $false } + $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/users/$UserId" -tenantid $TenantFilter -type PATCH -body $Body + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Blocked sign-in for shared mailbox $Address." -Sev 'Info' + } catch { + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Created shared mailbox $Address but failed to block sign-in: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + throw "Created shared mailbox '$Address' but failed to block sign-in for its account: $($ErrorMessage.NormalizedError)" + } +} diff --git a/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineEnableAppConsentRequests.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineEnableAppConsentRequests.ps1 index df3dc880fb..761e4d73e9 100644 --- a/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineEnableAppConsentRequests.ps1 +++ b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineEnableAppConsentRequests.ps1 @@ -2,7 +2,7 @@ function Invoke-CIPPBaselineEnableAppConsentRequests { <# .SYNOPSIS EnableAppConsentRequests executor: enables the admin consent workflow with the - configured reviewer roles and users. + configured reviewer roles, users and groups. .DESCRIPTION Read-merge-write, ported whole from the classic: the policy is fetched LIVE, flipped on with the fixed notification settings, and the configured roles become @@ -16,6 +16,11 @@ function Invoke-CIPPBaselineEnableAppConsentRequests { whatever the operator typed regardless of creation path. A name that resolves to nothing is logged and skipped so the roles still land. + Reviewer groups are resolved the same way and written as the group's transitive user + members (/v1.0/groups/{id}/transitiveMembers/microsoft.graph.user), the exact shape the + Entra admin center's Groups option produces, so a group added by hand and the same + group configured here are one reviewer, not two. + No role configured defaults to Global Administrator, matching the hook's grade. .FUNCTIONALITY Internal @@ -45,12 +50,24 @@ function Invoke-CIPPBaselineEnableAppConsentRequests { foreach ($User in $Matched) { $Users.Add($User) } } + $GroupNames = @(@($Remediate.reviewerGroups) | ForEach-Object { "$($_.value ?? $_)" } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }) + $Groups = [System.Collections.Generic.List[object]]::new() + foreach ($Name in $GroupNames) { + $GroupFilter = [System.Uri]::EscapeDataString("displayName eq '$($Name -replace "'", "''")'") + $Matched = @(New-GraphGetRequest -uri "https://graph.microsoft.com/beta/groups?`$select=id,displayName&`$filter=$GroupFilter" -tenantid $TenantFilter) + if ($Matched.Count -eq 0) { + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "EnableAppConsentRequests: no group found with display name '$Name' - not added as reviewer." -Sev 'Warning' + continue + } + foreach ($Group in $Matched) { $Groups.Add($Group) } + } + $Policy.isEnabled = $true $Policy.notifyReviewers = $true $Policy.remindersEnabled = $true $Policy.requestDurationInDays = 30 - $ManagedIds = @($Roles) + @($Users | ForEach-Object { "$($_.id)" }) + $ManagedIds = @($Roles) + @($Users | ForEach-Object { "$($_.id)" }) + @($Groups | ForEach-Object { "$($_.id)" }) $Reviewers = [System.Collections.Generic.List[object]]::new() foreach ($Reviewer in @($Policy.reviewers)) { $Found = $false @@ -73,8 +90,15 @@ function Invoke-CIPPBaselineEnableAppConsentRequests { queryRoot = 'null' }) } + foreach ($Group in $Groups) { + $Reviewers.Add(@{ + query = "/v1.0/groups/$($Group.id)/transitiveMembers/microsoft.graph.user" + queryType = 'MicrosoftGraph' + queryRoot = 'null' + }) + } $Policy.reviewers = @($Reviewers) $null = New-GraphPostRequest -tenantid $TenantFilter -uri 'https://graph.microsoft.com/beta/policies/adminConsentRequestPolicy' -type PUT -body (ConvertTo-Json -Compress -Depth 10 -InputObject $Policy) - Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Enabled app consent requests with $($Roles.Count) reviewer role(s) and $($Users.Count) reviewer user(s)." -Sev 'Info' + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Enabled app consent requests with $($Roles.Count) reviewer role(s), $($Users.Count) reviewer user(s) and $($Groups.Count) reviewer group(s)." -Sev 'Info' } diff --git a/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineGlobalSecureAccessCompliantNetwork.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineGlobalSecureAccessCompliantNetwork.ps1 new file mode 100644 index 0000000000..7a9213724c --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineGlobalSecureAccessCompliantNetwork.ps1 @@ -0,0 +1,343 @@ +function Invoke-CIPPBaselineGlobalSecureAccessCompliantNetwork { + <# + .SYNOPSIS + GlobalSecureAccessCompliantNetwork executor: onboards the tenant and enables the + Microsoft 365 traffic profile, deploys the client through Intune, then creates the + compliant-network Conditional Access policy. Client objects carry a [cfg:hash] + fingerprint and are only redeployed when it changes. + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param($Remediate, $TenantFilter, $Current) + + $DeployWindows = $Remediate.deployWindows -ne $false + $DeployMacOS = $Remediate.deployMacOS -ne $false + $PreferIPv4 = $Remediate.preferIPv4 -ne $false + $LockDown = [int]($Remediate.lockDownClient -ne $false) + $Enforce = $Remediate.enforce -eq $true + $RoleIds = @($Remediate.excludeAdminRoles | ForEach-Object { "$($_.value ?? $_)" } | Where-Object { $_ } | Sort-Object -Unique) + $UserRefs = @($Remediate.excludeUsers | ForEach-Object { "$($_.value ?? $_)" } | Where-Object { $_ }) + $GroupRefs = @($Remediate.excludeGroups | ForEach-Object { "$($_.value ?? $_)" } | Where-Object { $_ }) + $AssignTo = "$($Remediate.assignTo.value ?? $Remediate.assignTo)" + if (-not $AssignTo) { $AssignTo = 'AllDevices' } + if ("$($Remediate.customGroup)") { $AssignTo = "$($Remediate.customGroup)" } + $PolicyAssignTo = if ($AssignTo -eq 'AllUsers') { 'allLicensedUsers' } else { $AssignTo } + $ExcludeGroup = "$($Remediate.excludeGroup)" + if (-not $DeployWindows -and -not $DeployMacOS) { throw 'Enable Windows, macOS or both; without the client no device can satisfy the compliant network check.' } + + $Graph = 'https://graph.microsoft.com/beta' + $Changed = $false + $Refresh = [System.Collections.Generic.List[string]]::new() + $Sha256 = [System.Security.Cryptography.SHA256]::Create() + $Hash = { param($Text) ([System.BitConverter]::ToString($Sha256.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($Text))) -replace '-', '').Substring(0, 16) } + + # --- tenant: onboard, Microsoft 365 profile for all users, signaling, named location + $Status = New-GraphGetRequest -uri "$Graph/networkAccess/tenantStatus" -tenantid $TenantFilter -AsApp $true + if ($Status.onboardingStatus -ne 'onboarded') { + if ($Status.onboardingStatus -eq 'onboardingErrorOccurred') { throw "Global Secure Access onboarding failed earlier: $($Status.onboardingErrorMessage)" } + if ($Status.onboardingStatus -ne 'onboardingInProgress') { + $null = New-GraphPostRequest -uri "$Graph/networkAccess/microsoft.graph.networkaccess.onboard" -tenantid $TenantFilter -type POST -body '{}' -AsApp $true + } + $Attempts = 0 + do { + Start-Sleep -Seconds 15 + $Attempts++ + $Status = New-GraphGetRequest -uri "$Graph/networkAccess/tenantStatus" -tenantid $TenantFilter -AsApp $true + } while ($Status.onboardingStatus -eq 'onboardingInProgress' -and $Attempts -lt 12) + if ($Status.onboardingStatus -ne 'onboarded') { throw "Global Secure Access onboarding is still '$($Status.onboardingStatus)'; run the standard again later." } + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message 'Onboarded the tenant to Global Secure Access.' -Sev 'Info' + $Changed = $true + $Refresh.Add('NetworkAccess') + } + + $Profiles = @(New-GraphGetRequest -uri "$Graph/networkAccess/forwardingProfiles?`$expand=policies(`$expand=policy)" -tenantid $TenantFilter -AsApp $true) + $TrafficProfile = $Profiles | Where-Object { $_.trafficForwardingType -eq 'm365' -and $_.isCustomProfile -ne $true } | Select-Object -First 1 + if (-not $TrafficProfile) { throw 'The Microsoft 365 traffic forwarding profile was not found; run the standard again in a few minutes.' } + if ($TrafficProfile.state -ne 'enabled') { + $null = New-GraphPostRequest -uri "$Graph/networkAccess/forwardingProfiles/$($TrafficProfile.id)" -tenantid $TenantFilter -type PATCH -body '{"state":"enabled"}' -AsApp $true + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message 'Enabled the Microsoft 365 traffic forwarding profile.' -Sev 'Info' + $Changed = $true + $Refresh.Add('NetworkAccess') + } + foreach ($Link in @($TrafficProfile.policies | Where-Object { $_.state -ne 'enabled' })) { + $null = New-GraphPostRequest -uri "$Graph/networkAccess/forwardingProfiles/$($TrafficProfile.id)/policies/$($Link.id)" -tenantid $TenantFilter -type PATCH -body '{"state":"enabled"}' -AsApp $true + $Changed = $true + $Refresh.Add('NetworkAccess') + } + $SpId = $TrafficProfile.servicePrincipal.id + if ($SpId) { + $Sp = New-GraphGetRequest -uri "$Graph/servicePrincipals/$SpId`?`$select=id,appRoleAssignmentRequired" -tenantid $TenantFilter -AsApp $true + if ($Sp.appRoleAssignmentRequired -ne $false) { + $null = New-GraphPostRequest -uri "$Graph/servicePrincipals/$SpId" -tenantid $TenantFilter -type PATCH -body '{"appRoleAssignmentRequired":false}' -AsApp $true + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message 'Assigned the Microsoft 365 traffic forwarding profile to all users.' -Sev 'Info' + $Changed = $true + $Refresh.Add('NetworkAccess') + } + } + $Settings = New-GraphGetRequest -uri "$Graph/networkAccess/settings/conditionalAccess" -tenantid $TenantFilter -AsApp $true + if ($Settings.signalingStatus -ne 'enabled') { + $null = New-GraphPostRequest -uri "$Graph/networkAccess/settings/conditionalAccess" -tenantid $TenantFilter -type PATCH -body '{"signalingStatus":"enabled"}' -AsApp $true + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message 'Enabled Global Secure Access signaling for Conditional Access.' -Sev 'Info' + $Changed = $true + $Refresh.Add('NetworkAccess') + } + # The settings PATCH does not create the named location; the admin center POSTs it separately. + $Location = New-GraphGetRequest -uri "$Graph/identity/conditionalAccess/namedLocations" -tenantid $TenantFilter -AsApp $true | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.compliantNetworkNamedLocation' } | Select-Object -First 1 + if (-not $Location) { + $Body = '{"@odata.type":"#microsoft.graph.compliantNetworkNamedLocation","displayName":"All Compliant Network Locations","compliantNetworkType":"allTenantCompliantNetworks","isTrusted":false}' + $Location = New-GraphPostRequest -uri "$Graph/identity/conditionalAccess/namedLocations" -tenantid $TenantFilter -type POST -body $Body -AsApp $true + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message 'Created the All Compliant Network Locations named location.' -Sev 'Info' + $Changed = $true + $Refresh.Add('ConditionalAccessPolicies') + } + + # --- Windows: Win32 script app + if ($DeployWindows) { + $Install = @' +$ErrorActionPreference = 'Stop' +$WorkDir = Join-Path $env:ProgramData 'CIPPApps\GlobalSecureAccess' +New-Item -ItemType Directory -Path $WorkDir -Force | Out-Null +$ExitCode = 0 +$ProgramFiles = if ($env:ProgramW6432) { $env:ProgramW6432 } else { $env:ProgramFiles } +$Arch = if ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } else { $env:PROCESSOR_ARCHITECTURE } +$Url = if ($Arch -eq 'ARM64') { 'https://aka.ms/GlobalSecureAccess-WindowsOnArm' } else { 'https://aka.ms/GlobalSecureAccess-windows' } +if (-not (Test-Path (Join-Path $ProgramFiles 'Global Secure Access Client\TrayApp\GlobalSecureAccessClient.exe'))) { + $Installer = Join-Path $WorkDir 'GlobalSecureAccessClient.exe' + [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12 + Invoke-WebRequest -Uri $Url -OutFile $Installer -UseBasicParsing + $Process = Start-Process -FilePath $Installer -ArgumentList '/quiet /norestart' -Wait -PassThru + if ($Process.ExitCode -eq 1618) { exit 1618 } + if ($Process.ExitCode -eq 3010) { $ExitCode = 3010 } elseif ($Process.ExitCode -ne 0) { exit $Process.ExitCode } +} +$Key = 'HKLM:\SOFTWARE\Microsoft\Global Secure Access Client' +if (-not (Test-Path $Key)) { New-Item -Path $Key -Force | Out-Null } +foreach ($Name in 'HideDisableButton', 'HideSignOutButton', 'HideDisablePrivateAccessButton', 'RestrictNonPrivilegedUsers') { + Set-ItemProperty -Path $Key -Name $Name -Value LOCKDOWN -Type DWord -Force +} +if (PREFERIPV4) { + $Ipv6 = 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters' + if ((Get-ItemProperty -Path $Ipv6 -Name DisabledComponents -ErrorAction SilentlyContinue).DisabledComponents -ne 0x20) { + Set-ItemProperty -Path $Ipv6 -Name DisabledComponents -Value 0x20 -Type DWord -Force + $ExitCode = 3010 + } +} +exit $ExitCode +'@ + $Uninstall = @' +$Installer = Join-Path $env:ProgramData 'CIPPApps\GlobalSecureAccess\GlobalSecureAccessClient.exe' +if (-not (Test-Path $Installer)) { + $Arch = if ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } else { $env:PROCESSOR_ARCHITECTURE } + $Url = if ($Arch -eq 'ARM64') { 'https://aka.ms/GlobalSecureAccess-WindowsOnArm' } else { 'https://aka.ms/GlobalSecureAccess-windows' } + [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12 + Invoke-WebRequest -Uri $Url -OutFile $Installer -UseBasicParsing +} +$Process = Start-Process -FilePath $Installer -ArgumentList '/uninstall /quiet /norestart' -Wait -PassThru +Remove-Item -Path 'HKLM:\SOFTWARE\Microsoft\Global Secure Access Client' -Recurse -Force -ErrorAction SilentlyContinue +exit $Process.ExitCode +'@ + $Detection = @' +$ProgramFiles = if ($env:ProgramW6432) { $env:ProgramW6432 } else { $env:ProgramFiles } +if (-not (Test-Path (Join-Path $ProgramFiles 'Global Secure Access Client\TrayApp\GlobalSecureAccessClient.exe'))) { exit 1 } +$Key = 'HKLM:\SOFTWARE\Microsoft\Global Secure Access Client' +foreach ($Name in 'HideDisableButton', 'HideSignOutButton', 'HideDisablePrivateAccessButton', 'RestrictNonPrivilegedUsers') { + if ((Get-ItemProperty -Path $Key -Name $Name -ErrorAction SilentlyContinue).$Name -ne LOCKDOWN) { exit 1 } +} +Write-Output 'Installed' +exit 0 +'@ + $Install = $Install.Replace('LOCKDOWN', "$LockDown").Replace('PREFERIPV4', $(if ($PreferIPv4) { '$true' } else { '$false' })) + $Detection = $Detection.Replace('LOCKDOWN', "$LockDown") + $AppName = 'Global Secure Access Client (Windows)' + $AppHash = & $Hash ($Install + $Detection) + $Baseuri = "$Graph/deviceAppManagement/mobileApps" + $Existing = @(New-GraphGetRequest -uri "$Baseuri`?`$filter=displayName eq '$AppName'&`$select=id,displayName,description" -tenantid $TenantFilter | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.win32LobApp' }) + if ($Existing.Count -eq 0 -or "$($Existing[0].description)" -notmatch "\[cfg:$AppHash\]") { + foreach ($App in $Existing) { $null = New-GraphPostRequest -uri "$Baseuri/$($App.id)" -type DELETE -tenantid $TenantFilter } + if ($Existing.Count -gt 0) { Start-Sleep -Seconds 2 } + $NewApp = Add-CIPPW32ScriptApplication -TenantFilter $TenantFilter -Properties ([PSCustomObject]@{ + displayName = $AppName + description = "Installs the Microsoft Global Secure Access client and its hardening settings. Managed by CIPP. [cfg:$AppHash]" + publisher = 'Microsoft' + installScript = $Install + uninstallScript = $Uninstall + detectionScript = $Detection + runAsAccount = 'system' + deviceRestartBehavior = 'basedOnReturnCode' + }) + if ($NewApp -and $AssignTo -ne 'On') { + Start-Sleep -Milliseconds 500 + $null = Set-CIPPAssignedApplication -ApplicationId $NewApp.Id -TenantFilter $TenantFilter -GroupName $AssignTo -ExcludeGroup $ExcludeGroup -Intent 'Required' -AppType 'Win32Lob' -APIName 'Baselines' + } + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Deployed $AppName." -Sev 'Info' + $Changed = $true + $Refresh.Add('IntuneMobileApps') + } + } + + # --- macOS: shell script plus the three profiles Microsoft requires + if ($DeployMacOS) { + $MacScript = @' +#!/bin/bash +MARKER="/Library/Application Support/CIPP/GlobalSecureAccess.cfg" +if [ -d "/Applications/GlobalSecureAccessClient" ] && [ -f "$MARKER" ] && [ "$(cat "$MARKER")" = "CONFIGHASH" ]; then exit 0; fi +curl -L --fail --silent --show-error -o /tmp/GlobalSecureAccessClient.pkg "https://aka.ms/GlobalSecureAccess-macOS" || exit 1 +/usr/sbin/installer -pkg /tmp/GlobalSecureAccessClient.pkg -target / || { rm -f /tmp/GlobalSecureAccessClient.pkg; exit 1; } +rm -f /tmp/GlobalSecureAccessClient.pkg +mkdir -p "$(dirname "$MARKER")" && echo "CONFIGHASH" > "$MARKER" +exit 0 +'@ + $ScriptHash = & $Hash $MacScript + $MacScript = $MacScript.Replace('CONFIGHASH', $ScriptHash) + $ScriptName = 'Global Secure Access Client (macOS)' + $ExistingScript = New-GraphGetRequest -uri "$Graph/deviceManagement/deviceShellScripts?`$select=id,displayName,description&`$expand=assignments" -tenantid $TenantFilter | Where-Object { $_.displayName -eq $ScriptName } | Select-Object -First 1 + $Unassigned = @($ExistingScript.assignments | Where-Object { $_ }).Count -eq 0 + if (-not $ExistingScript -or "$($ExistingScript.description)" -notmatch "\[cfg:$ScriptHash\]" -or $Unassigned) { + $Script = Add-CIPPMacOSShellScript -TenantFilter $TenantFilter -DisplayName $ScriptName -Description "Installs the Microsoft Global Secure Access client; re-runs daily. Managed by CIPP. [cfg:$ScriptHash]" -ScriptContent $MacScript -ExecutionFrequency 'P1D' + if ($PolicyAssignTo -ne 'On' -and $Unassigned) { + $null = Set-CIPPAssignedPolicy -PolicyId $Script.id -Type 'deviceShellScripts' -GroupName $PolicyAssignTo -ExcludeGroup $ExcludeGroup -TenantFilter $TenantFilter -AssignmentMode 'replace' -APIName 'Baselines' + } + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Deployed $ScriptName." -Sev 'Info' + $Changed = $true + $Refresh.Add('IntuneScripts') + } + + $Str = { param($Value) @{ '@odata.type' = '#microsoft.graph.deviceManagementConfigurationStringSettingValue'; value = $Value } } + $Extensions = @{ + name = 'Global Secure Access - macOS System Extensions' + description = '' + platforms = 'macOS' + technologies = 'mdm' + roleScopeTagIds = @('0') + settings = @(@{ + '@odata.type' = '#microsoft.graph.deviceManagementConfigurationSetting' + settingInstance = @{ + '@odata.type' = '#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance' + settingDefinitionId = 'com.apple.system-extension-policy_allowedsystemextensions' + groupSettingCollectionValue = @(@{ + '@odata.type' = '#microsoft.graph.deviceManagementConfigurationGroupSettingValue' + children = @( + @{ '@odata.type' = '#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance'; settingDefinitionId = 'com.apple.system-extension-policy_allowedsystemextensions_generickey_keytobereplaced'; simpleSettingValue = (& $Str 'UBF8T346G9') } + @{ '@odata.type' = '#microsoft.graph.deviceManagementConfigurationSimpleSettingCollectionInstance'; settingDefinitionId = 'com.apple.system-extension-policy_allowedsystemextensions_generickey'; simpleSettingCollectionValue = @((& $Str 'com.microsoft.globalsecureaccess.tunnel'), (& $Str 'com.microsoft.globalsecureaccess')) } + ) + }) + } + }) + } + $ProxyPlist = @' + + + +PayloadUUID87cbb424-6af7-4748-9d43-f1c5dda7a0a6 +PayloadTypeConfiguration +PayloadOrganizationMicrosoft Corporation +PayloadIdentifiercom.microsoft.globalsecureaccess +PayloadDisplayNameGlobal Secure Access Proxy Configuration +PayloadVersion1 +PayloadEnabled +PayloadRemovalDisallowed +PayloadScopeSystem +PayloadContent +PayloadUUID04e13063-2bb8-4b72-b1ed-45290f91af68 +PayloadTypecom.apple.vpn.managed +PayloadOrganizationMicrosoft Corporation +PayloadIdentifiercom.microsoft.globalsecureaccess +PayloadDisplayNameGlobal Secure Access Proxy Configuration +PayloadVersion1 +TransparentProxy +AuthenticationMethodPassword +Order1 +ProviderBundleIdentifiercom.microsoft.globalsecureaccess.tunnel +ProviderDesignatedRequirementidentifier "com.microsoft.globalsecureaccess.tunnel" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9 +ProviderTypeapp-proxy +RemoteAddress100.64.0.0 + +UserDefinedNameGlobal Secure Access Proxy Configuration +VPNSubTypecom.microsoft.globalsecureaccess +VPNTypeTransparentProxy + +'@ + $Bool = if ($LockDown) { '' } else { '' } + $SettingsPlist = "`n`nHideDisableButton$BoolHidePauseButton$BoolHideDisablePrivateAccessButton$BoolHideQuitButton" + $MacProfiles = @( + @{ Type = 'Catalog'; Name = 'Global Secure Access - macOS System Extensions'; Body = $Extensions } + @{ Type = 'Device'; Name = 'Global Secure Access - macOS Transparent Proxy'; Body = @{ '@odata.type' = '#microsoft.graph.macOSCustomConfiguration'; displayName = 'Global Secure Access - macOS Transparent Proxy'; payloadName = 'Global Secure Access Proxy Configuration'; payloadFileName = 'GlobalSecureAccessProxy.mobileconfig'; payload = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($ProxyPlist)); deploymentChannel = 'deviceChannel' } } + @{ Type = 'Device'; Name = 'Global Secure Access - macOS Client Settings'; Body = @{ '@odata.type' = '#microsoft.graph.macOSCustomAppConfiguration'; displayName = 'Global Secure Access - macOS Client Settings'; bundleId = 'com.microsoft.globalsecureaccess'; fileName = 'com.microsoft.globalsecureaccess.plist'; configurationXml = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($SettingsPlist)) } } + ) + $LiveCatalog = @(New-GraphGetRequest -uri "$Graph/deviceManagement/configurationPolicies?`$select=id,name,description&`$top=1000" -tenantid $TenantFilter) + $LiveConfigs = @(New-GraphGetRequest -uri "$Graph/deviceManagement/deviceConfigurations?`$select=id,displayName,description&`$top=999" -tenantid $TenantFilter) + foreach ($MacProfile in $MacProfiles) { + $Json = $MacProfile.Body | ConvertTo-Json -Depth 20 -Compress + $ProfileHash = & $Hash $Json + $Description = "Required for the Global Secure Access client on macOS. Managed by CIPP. [cfg:$ProfileHash]" + $Live = if ($MacProfile.Type -eq 'Catalog') { $LiveCatalog | Where-Object { $_.name -eq $MacProfile.Name } } else { $LiveConfigs | Where-Object { $_.displayName -eq $MacProfile.Name } } + if ($Live -and "$(@($Live)[0].description)" -match "\[cfg:$ProfileHash\]") { continue } + if ($MacProfile.Type -eq 'Catalog') { $MacProfile.Body.description = $Description; $Json = $MacProfile.Body | ConvertTo-Json -Depth 20 -Compress } + $Params = @{ TemplateType = $MacProfile.Type; DisplayName = $MacProfile.Name; Description = $Description; RawJSON = $Json; TenantFilter = $TenantFilter; APIName = 'Baselines'; AssignmentMode = 'replace' } + if ($PolicyAssignTo -ne 'On') { $Params.AssignTo = $PolicyAssignTo; $Params.ExcludeGroup = $ExcludeGroup } + $null = Set-CIPPIntunePolicy @Params + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Deployed $($MacProfile.Name)." -Sev 'Info' + $Changed = $true + $Refresh.Add($(if ($MacProfile.Type -eq 'Catalog') { 'IntuneConfigurationPolicies' } else { 'IntunePolicies' })) + } + } + + # --- Conditional Access policy, written only when the hook saw drift on it + if ($Current.policyDrift -ne $false) { + $ExcludeUsers = [System.Collections.Generic.List[string]]::new() + $ExcludeGroups = [System.Collections.Generic.List[string]]::new() + if ($UserRefs.Count -gt 0) { + $Users = @(New-GraphGetRequest -uri "$Graph/users?`$select=id,displayName,userPrincipalName&`$top=999" -tenantid $TenantFilter -AsApp $true) + foreach ($Ref in $UserRefs) { + $Match = $Users | Where-Object { $_.id -eq $Ref -or $_.userPrincipalName -eq $Ref -or $_.displayName -eq $Ref } | Select-Object -First 1 + if ($Match) { $ExcludeUsers.Add($Match.id) } else { Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Break-glass account '$Ref' was not found and could not be excluded." -Sev 'Warning' } + } + } + if ($GroupRefs.Count -gt 0) { + $Groups = @(New-GraphGetRequest -uri "$Graph/groups?`$select=id,displayName&`$top=999" -tenantid $TenantFilter -AsApp $true) + foreach ($Ref in $GroupRefs) { + $Match = $Groups | Where-Object { $_.id -eq $Ref -or $_.displayName -eq $Ref } | Select-Object -First 1 + if ($Match) { $ExcludeGroups.Add($Match.id) } else { Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Group '$Ref' was not found and could not be excluded." -Sev 'Warning' } + } + } + if ($Remediate.useDetectedBreakGlass -ne $false) { + $Others = @(New-GraphGetRequest -uri "$Graph/identity/conditionalAccess/policies?`$top=999" -tenantid $TenantFilter -AsApp $true | Where-Object { $_.displayName -ne 'CIPP: Require compliant network (Global Secure Access)' }) + $Candidate = Get-CIPPCABreakGlassCandidate -Policies $Others + if ($Candidate.id) { + if ($Candidate.type -eq 'group') { if ($ExcludeGroups -notcontains $Candidate.id) { $ExcludeGroups.Add($Candidate.id) } } + elseif ($ExcludeUsers -notcontains $Candidate.id) { $ExcludeUsers.Add($Candidate.id) } + } + } + if ($Enforce -and $ExcludeUsers.Count -eq 0 -and $ExcludeGroups.Count -eq 0) { + throw 'Refusing to enable the compliant network policy with no break-glass exclusion: it would lock out every account on a device without the client. Add a break-glass account or keep report-only mode.' + } + $ExcludeApps = [System.Collections.Generic.List[string]]@('d4ebce55-015a-49b5-a083-c84d1797ae8c', '0000000a-0000-0000-c000-000000000000') + foreach ($Efp in @(New-GraphGetRequest -uri "$Graph/servicePrincipals?`$filter=displayName eq 'GSA-ExplicitForwardProxy'&`$select=appId" -tenantid $TenantFilter -AsApp $true)) { $ExcludeApps.Add($Efp.appId) } + $State = if ($Enforce) { 'enabled' } else { 'enabledForReportingButNotEnforced' } + $Policy = @{ + displayName = 'CIPP: Require compliant network (Global Secure Access)' + state = $State + conditions = @{ + users = @{ includeUsers = @('All'); excludeUsers = @($ExcludeUsers); includeGroups = @(); excludeGroups = @($ExcludeGroups); includeRoles = @(); excludeRoles = @($RoleIds) } + applications = @{ includeApplications = @('All'); excludeApplications = @($ExcludeApps); includeUserActions = @() } + locations = @{ includeLocations = @('All'); excludeLocations = @("$($Location.id)") } + clientAppTypes = @('all') + } + grantControls = @{ operator = 'OR'; builtInControls = @('block') } + } | ConvertTo-Json -Depth 10 + $null = New-CIPPCAPolicy -RawJSON $Policy -TenantFilter $TenantFilter -State $State -Overwrite $true -ReplacePattern 'none' -APIName 'Baselines' + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Deployed the compliant network policy ($State) with $($ExcludeUsers.Count) excluded user(s), $($ExcludeGroups.Count) excluded group(s), $($RoleIds.Count) excluded role(s)." -Sev 'Info' + $Changed = $true + $Refresh.Add('ConditionalAccessPolicies') + } + + # Refresh the caches this run wrote to, so the next compare does not read the old copies as drift. + foreach ($CacheType in ($Refresh | Sort-Object -Unique)) { + $Collector = Get-Command -Name "Set-CIPPDBCache$CacheType" -ErrorAction SilentlyContinue + if ($Collector) { + try { $null = & $Collector -TenantFilter $TenantFilter } catch { Write-Information "Baselines: $CacheType cache refresh on $TenantFilter failed: $($_.Exception.Message)" } + } + } + + if (-not $Changed) { return [PSCustomObject]@{ Changed = $false } } +} diff --git a/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineGraduation.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineGraduation.ps1 index eecd1eb633..cedace3c9d 100644 --- a/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineGraduation.ps1 +++ b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineGraduation.ps1 @@ -13,7 +13,8 @@ function Invoke-CIPPBaselineGraduation { on every run - an 'All Tenants' baseline can gate a stage (say Intune policies) on an 'Intune licensed' group - success: every standard rolled out by the stages reached so far is aligned - (Compliant or Accepted) on the tenant's resolved rows + (Compliant or Accepted) on the tenant's resolved rows; a standard the + tenant cannot license counts as aligned rather than blocking the stage - manual: never auto-advances (operator uses ExecBaselineStage) A stage with no conditions does not auto-advance. -TenantFilter/-TemplateId scope an on-demand re-evaluation; one result is emitted per @@ -95,7 +96,9 @@ function Invoke-CIPPBaselineGraduation { $Aligned = 0 foreach ($Standard in $RolledOut) { $Row = $Rows | Where-Object { $_.StandardName -eq $Standard } | Select-Object -First 1 - if ($Row -and $Row.Status -in @('Compliant', 'Accepted')) { $Aligned++ } + # A standard the tenant cannot license is not drift it can fix, and the engine + # rewrites that status every run so it cannot be accepted away either. + if ($Row -and $Row.Status -in @('Compliant', 'Accepted', 'Skipped - No License')) { $Aligned++ } } $RolledOut.Count -gt 0 -and $Aligned -eq $RolledOut.Count } diff --git a/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineM365GroupGuestSettings.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineM365GroupGuestSettings.ps1 new file mode 100644 index 0000000000..5df2a5fd62 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineM365GroupGuestSettings.ps1 @@ -0,0 +1,55 @@ +function Invoke-CIPPBaselineM365GroupGuestSettings { + <# + .SYNOPSIS + M365GroupGuestSettings executor: writes the guest values on the Group.Unified + directory setting. + .DESCRIPTION + Instantiates Group.Unified from its template (live fetch with the same offline + fallback DisableM365GroupUsers carries) when the tenant has none, then PATCHes the + FULL values array - Graph rejects a partial values array - with every live value + resent and only the two guest values overridden, so group creation and naming + settings owned by other standards are untouched. The object is always read LIVE + because a cached id can be stale. App-only, like DisableM365GroupUsers: this object + demands the Groups Administrator right the delegated identity rarely holds. + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param( + $Remediate, + $TenantFilter, + $Current + ) + + $AsFlag = { param($Value) if ($Value -eq $true -or "$Value" -eq 'True') { 'true' } else { 'false' } } + $Desired = @{ + AllowGuestsToBeGroupOwner = & $AsFlag $Remediate.allowGuestsToBeGroupOwner + AllowGuestsToAccessGroups = & $AsFlag $Remediate.allowGuestsToAccessGroups + } + $TemplateId = '62375ab9-6b52-47ed-826b-58e47e0e304b' + + $Live = @(New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/settings' -tenantid $TenantFilter) | Where-Object { "$($_.displayName)" -eq 'Group.Unified' } | Select-Object -First 1 + $SettingId = "$($Live.id)" + if ([string]::IsNullOrWhiteSpace($SettingId)) { + $Template = try { + (New-GraphGetRequest -uri "https://graph.microsoft.com/beta/directorySettingTemplates/$TemplateId" -tenantid $TenantFilter).values + } catch { + '[{"name":"NewUnifiedGroupWritebackDefault","defaultValue":"true"},{"name":"EnableMIPLabels","defaultValue":"false"},{"name":"CustomBlockedWordsList","defaultValue":""},{"name":"EnableMSStandardBlockedWords","defaultValue":"false"},{"name":"ClassificationDescriptions","defaultValue":""},{"name":"DefaultClassification","defaultValue":""},{"name":"PrefixSuffixNamingRequirement","defaultValue":""},{"name":"AllowGuestsToBeGroupOwner","defaultValue":"false"},{"name":"AllowGuestsToAccessGroups","defaultValue":"true"},{"name":"GuestUsageGuidelinesUrl","defaultValue":""},{"name":"GroupCreationAllowedGroupId","defaultValue":""},{"name":"AllowToAddGuests","defaultValue":"true"},{"name":"UsageGuidelinesUrl","defaultValue":""},{"name":"ClassificationList","defaultValue":""},{"name":"EnableGroupCreation","defaultValue":"true"}]' | ConvertFrom-Json + } + $Values = @($Template | ForEach-Object { @{ name = "$($_.name)"; value = "$($_.defaultValue)" } }) + $Body = @{ templateId = $TemplateId; values = $Values } | ConvertTo-Json -Depth 10 -Compress + $Created = New-GraphPostRequest -tenantid $TenantFilter -uri 'https://graph.microsoft.com/beta/settings' -type POST -body $Body -AsApp $true + $SettingId = "$($Created.id)" + $Live = $Created + } + + $PatchValues = @(@($Live.values) | ForEach-Object { + $Name = "$($_.name)" + $Value = "$($_.value)" + if ($Desired.ContainsKey($Name)) { $Value = $Desired[$Name] } + @{ name = $Name; value = $Value } + }) + $Body = @{ values = $PatchValues } | ConvertTo-Json -Depth 10 -Compress + $null = New-GraphPostRequest -tenantid $TenantFilter -uri "https://graph.microsoft.com/beta/settings/$SettingId" -type PATCH -body $Body -AsApp $true + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Applied M365 group guest settings: guests as owners $($Desired.AllowGuestsToBeGroupOwner), guest access to groups $($Desired.AllowGuestsToAccessGroups)." -Sev 'Info' +} diff --git a/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineMFAPushApps.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineMFAPushApps.ps1 new file mode 100644 index 0000000000..ef688d0f5a --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineMFAPushApps.ps1 @@ -0,0 +1,26 @@ +function Invoke-CIPPBaselineMFAPushApps { + <# + .SYNOPSIS + MFAPushApps executor: enables or disables the Azure Multi-Factor Auth Client and + Connector service principals. + .DESCRIPTION + One PATCH per app against the appId-addressed upsert endpoint with + 'Prefer: create-if-missing', so a principal that never existed is created in the + configured state. + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param( + $Remediate, + $TenantFilter, + $Current + ) + + $Enabled = [bool]($Remediate.enabled -eq $true) + $Body = @{ accountEnabled = $Enabled } | ConvertTo-Json -Compress + foreach ($AppId in @('981f26a1-7f43-403b-a875-f8b09b8cd720', '1f5530b3-261a-47a9-b357-ded261e17918')) { + $null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/servicePrincipals(appId='$AppId')" -body $Body -tenantid $TenantFilter -type PATCH -AddedHeaders @{ 'Prefer' = 'create-if-missing' } + } + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Set the Azure MFA push notification apps to $(if ($Enabled) { 'enabled' } else { 'disabled' })." -Sev 'Info' +} diff --git a/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineMailboxDefaultAuditSet.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineMailboxDefaultAuditSet.ps1 new file mode 100644 index 0000000000..8f98061470 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineMailboxDefaultAuditSet.ps1 @@ -0,0 +1,33 @@ +function Invoke-CIPPBaselineMailboxDefaultAuditSet { + <# + .SYNOPSIS + Executor for MailboxDefaultAuditSet: resets each offending mailbox to the default audit set. + .DESCRIPTION + Mailbox audit settings must be written on the mailbox's own server, so each write is + anchored to its mailbox; a system-mailbox-anchored $batch fails with + CmdletProxyNotAvailableException for every mailbox hosted elsewhere. + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param($Remediate, $TenantFilter, $Current) + + $Targets = @($Current.targets | Where-Object { $_.id }) + if ($Targets.Count -eq 0) { return } + + $Requests = foreach ($Target in $Targets) { + @{ + CmdletInput = @{ CmdletName = 'Set-Mailbox'; Parameters = @{ Identity = $Target.id; DefaultAuditSet = @('Admin', 'Delegate', 'Owner') } } + OperationGuid = $Target.id + } + } + $Failures = @(@(New-ExoBulkRequest -tenantid $TenantFilter -cmdletArray @($Requests) -AnchorPerMailbox -MaxConcurrency 10).Where({ $_.error }) | + ForEach-Object { "$($_.OperationGuid ?? $_.target) -> $($_.error)" }) + + if ($Failures.Count -gt 0) { + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "MailboxDefaultAuditSet: $($Failures.Count) of $($Targets.Count) mailbox writes failed. $(($Failures | Select-Object -First 10) -join ' | ')" -Sev 'Warning' + } + if ($Failures.Count -ge $Targets.Count) { + throw "MailboxDefaultAuditSet: all $($Targets.Count) writes failed. $($Failures[0])" + } +} diff --git a/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineMigration.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineMigration.ps1 index 48bc7a1ead..f88c2d2a18 100644 --- a/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineMigration.ps1 +++ b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineMigration.ps1 @@ -77,6 +77,9 @@ function Invoke-CIPPBaselineMigration { SPSyncButtonState = @{ rename = @{ state = 'hideSyncButton' } } # V2 were switches (bool); V3 passes the Teams cmdlet's 'Enabled'/'Disabled' strings. TeamsChatProtection = @{ value = @{ FileTypeCheck = @{ True = 'Enabled'; False = 'Disabled' }; UrlReputationCheck = @{ True = 'Enabled'; False = 'Disabled' } } } + # V2 'Don't change' is the 'donotconfigure' sentinel; V3 prunes blank (omitWhenBlank). + TeamsFilesPolicy = @{ value = @{ FileSharingInChatsWithExternalUsers = @{ donotconfigure = '' }; NativeFileEntryPoints = @{ donotconfigure = '' }; SPChannelFilesTab = @{ donotconfigure = '' } } } + TeamsMessagingPolicy = @{ value = @{ AutoShareFilesInExternalChats = @{ donotconfigure = '' } } } TAP = @{ rename = @{ config = 'isUsableOnce' } } unmanagedSync = @{ rename = @{ state = 'conditionalAccessPolicy' } } BitLockerKeysForOwnedDevice = @{ rename = @{ state = 'allowed' }; value = @{ allowed = @{ allow = $true; restrict = $false } } } diff --git a/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineSPOVersionControl.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineSPOVersionControl.ps1 index c4af3384b2..4ce3d88d28 100644 --- a/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineSPOVersionControl.ps1 +++ b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineSPOVersionControl.ps1 @@ -7,7 +7,7 @@ function Invoke-CIPPBaselineSPOVersionControl { The tenant write goes through the SPO SetFileVersionPolicy method with the classic's exact parameter shape (-1 sentinels for the limits when auto-trim is on), against a LIVE-read CSOM identity. When the baseline opts into existing sites, each - site inherits the tenant policy across new and existing document libraries - a + site queues SharePoint's job that applies the policy to its existing document libraries - a per-site fan-out that continues past individual site failures, as the classic did. .FUNCTIONALITY Internal @@ -33,18 +33,22 @@ function Invoke-CIPPBaselineSPOVersionControl { } else { @(@{ Type = 'Boolean'; Value = $false }, @{ Type = 'Int32'; Value = $MajorLimit }, @{ Type = 'Int32'; Value = $ExpireDays }) } - $State | Set-CIPPSPOTenant -MethodName 'SetFileVersionPolicy' -MethodParameters $MethodParams -UseCertificate + $null = $State | Set-CIPPSPOTenant -MethodName 'SetFileVersionPolicy' -MethodParameters $MethodParams -UseCertificate Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Set the file version policy (autoTrim=$AutoTrim$(if (-not $AutoTrim) { ", limit=$MajorLimit, expire=${ExpireDays}d" }))." -Sev 'Info' if ($Remediate.applyToExistingSites -eq $true -or "$($Remediate.applyToExistingSites)" -eq 'True') { $Sites = @(New-GraphGetRequest -uri "https://graph.microsoft.com/beta/sites/getAllSites?`$select=webUrl&`$top=999" -tenantid $TenantFilter -AsApp $true) + # SharePoint only queues the existing-library job for an explicit policy; leaving out ApplyToNewDocumentLibraries keeps new libraries inheriting the tenant $SiteProperties = @{ - InheritVersionPolicyFromTenant = $true + InheritVersionPolicyFromTenant = $false EnableAutoExpirationVersionTrim = $AutoTrim - ApplyToNewDocumentLibraries = $true ApplyToExistingDocumentLibraries = $true } - if (-not $AutoTrim) { + if ($AutoTrim) { + $SiteProperties.MajorVersionLimit = -1 + $SiteProperties.ExpireVersionsAfterDays = -1 + $SiteProperties.MajorWithMinorVersionsLimit = -1 + } else { $SiteProperties.MajorVersionLimit = $MajorLimit $SiteProperties.ExpireVersionsAfterDays = $ExpireDays } @@ -55,6 +59,6 @@ function Invoke-CIPPBaselineSPOVersionControl { foreach ($FailedSite in $Failures) { Write-Information "Baselines: version policy on $($FailedSite.SiteUrl) continued past: $($FailedSite.Error)" } - Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Applied the version policy to $(@($Sites).Count - $Failures.Count) of $(@($Sites).Count) existing site(s)." -Sev 'Info' + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Queued the version policy for existing document libraries on $(@($Sites).Count - $Failures.Count) of $(@($Sites).Count) site(s)." -Sev 'Info' } } diff --git a/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineSmartLockout.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineSmartLockout.ps1 index 9d24f23a3c..d5d36db8f4 100644 --- a/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineSmartLockout.ps1 +++ b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineSmartLockout.ps1 @@ -8,7 +8,8 @@ function Invoke-CIPPBaselineSmartLockout { otherwise PATCHes the FULL six-value array - Graph rejects a directory-settings update that omits any template property - with the banned-password values taken from the LIVE object so this standard never steps on CustomBannedPasswordList's - territory. + territory. The one exception is the 'enableBannedPasswordCheck' switch: when it is + on, EnableBannedPasswordCheck is written True (EIDSCA PR03) on both paths. .FUNCTIONALITY Internal #> @@ -23,6 +24,7 @@ function Invoke-CIPPBaselineSmartLockout { if ($Mode -eq 'Enforced') { $Mode = 'Enforce' } if ([string]::IsNullOrWhiteSpace($Mode)) { $Mode = 'Audit' } $OnPrem = if ($Remediate.enableBannedPasswordCheckOnPremises -eq $true -or "$($Remediate.enableBannedPasswordCheckOnPremises)" -eq 'True') { 'True' } else { 'False' } + $EnforceBannedCheck = ($Remediate.enableBannedPasswordCheck -eq $true -or "$($Remediate.enableBannedPasswordCheck)" -eq 'True') $LockoutValues = @( @{ name = 'LockoutDurationInSeconds'; value = "$($Remediate.lockoutDurationInSeconds)" } @{ name = 'LockoutThreshold'; value = "$($Remediate.lockoutThreshold)" } @@ -39,7 +41,7 @@ function Invoke-CIPPBaselineSmartLockout { $Body = @{ templateId = '5cf42378-d67d-4f36-ba46-e8b86229381d' values = @(@( - @{ name = 'EnableBannedPasswordCheck'; value = 'False' } + @{ name = 'EnableBannedPasswordCheck'; value = $(if ($EnforceBannedCheck) { 'True' } else { 'False' }) } @{ name = 'BannedPasswordList'; value = '' } ) + $LockoutValues) } | ConvertTo-Json -Depth 10 -Compress @@ -47,10 +49,10 @@ function Invoke-CIPPBaselineSmartLockout { } else { $LiveValueOf = { param($Name) "$((@($Live.values) | Where-Object { $_.name -eq $Name }).value)" } $Body = @{ values = @(@( - @{ name = 'EnableBannedPasswordCheck'; value = (& $LiveValueOf 'EnableBannedPasswordCheck') } + @{ name = 'EnableBannedPasswordCheck'; value = $(if ($EnforceBannedCheck) { 'True' } else { & $LiveValueOf 'EnableBannedPasswordCheck' }) } @{ name = 'BannedPasswordList'; value = (& $LiveValueOf 'BannedPasswordList') } ) + $LockoutValues) } | ConvertTo-Json -Depth 10 -Compress $null = New-GraphPostRequest -tenantid $TenantFilter -uri "https://graph.microsoft.com/beta/settings/$($Live.id)" -type PATCH -body $Body } - Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Applied smart lockout: $($Remediate.lockoutThreshold) attempts, $($Remediate.lockoutDurationInSeconds)s, on-prem $OnPrem/$Mode." -Sev 'Info' + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Applied smart lockout: $($Remediate.lockoutThreshold) attempts, $($Remediate.lockoutDurationInSeconds)s, on-prem $OnPrem/$Mode$(if ($EnforceBannedCheck) { ', global banned password check enforced' })." -Sev 'Info' } diff --git a/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineTransportRuleTemplate.ps1 b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineTransportRuleTemplate.ps1 index a727e0877c..4b4f6c7352 100644 --- a/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineTransportRuleTemplate.ps1 +++ b/backend/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineTransportRuleTemplate.ps1 @@ -38,16 +38,29 @@ function Invoke-CIPPBaselineTransportRuleTemplate { $Parameters[$Property.Name] = $Property.Value } - if ($Deployed.Contains($RuleName)) { - if ($Remediate.overwrite -ne $true) { - Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Transport rule '$RuleName' already exists and overwrite is off - leaving it untouched." -Sev 'Info' + if (-not $Deployed.Contains($RuleName)) { + try { + $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'New-TransportRule' -cmdParams $Parameters -useSystemMailbox $true + [void]$Deployed.Add($RuleName) continue + } catch { + # The rules cache can predate a rule created since the last collection. + if ($_.Exception.Message -notmatch 'already exists') { throw } } - $Parameters['Identity'] = $RuleName - $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Set-TransportRule' -cmdParams $Parameters -useSystemMailbox $true - } else { - $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'New-TransportRule' -cmdParams $Parameters -useSystemMailbox $true - [void]$Deployed.Add($RuleName) + } + + if ($Remediate.overwrite -ne $true) { + Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Transport rule '$RuleName' already exists and overwrite is off - leaving it untouched." -Sev 'Info' + continue + } + $Parameters['Identity'] = $RuleName + # Set-TransportRule rejects Enabled; state changes go through Enable-/Disable-TransportRule. + $Enabled = $Parameters['Enabled'] + $Parameters.Remove('Enabled') + $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Set-TransportRule' -cmdParams $Parameters -useSystemMailbox $true + if ($null -ne $Enabled) { + $StateCmdlet = if ("$Enabled" -in @('True', 'Enabled')) { 'Enable-TransportRule' } else { 'Disable-TransportRule' } + $null = New-ExoRequest -tenantid $TenantFilter -cmdlet $StateCmdlet -cmdParams @{ Identity = $RuleName } -useSystemMailbox $true } } } diff --git a/backend/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1 b/backend/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1 index 136bf42dcc..3b57a6acdc 100644 --- a/backend/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1 +++ b/backend/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1 @@ -3,7 +3,7 @@ using namespace Microsoft.Azure.Functions.PowerShellWorker function New-CippCoreRequest { <# .SYNOPSIS - Main entrypoint for all HTTP triggered functions in CIPP, this must live in the CIPPCore module + Main entrypoint for all HTTP triggered functions in CIPP .DESCRIPTION This function is the main entry point for all HTTP triggered functions in CIPP. It routes requests to the appropriate function based on the CIPPEndpoint parameter in the request. .FUNCTIONALITY @@ -16,10 +16,24 @@ function New-CippCoreRequest { $HttpTimings = @{} $HttpTotalStopwatch = [System.Diagnostics.Stopwatch]::StartNew() - # Initialize and reset the per-invocation context slots. This has to happen before anything - # reads them: workers are reused between requests, so whatever the previous invocation left - # behind is still in scope until it is explicitly cleared. - Initialize-CippRequestContext + # Initialize AsyncLocal storage for thread-safe per-invocation context + if (-not $script:CippInvocationIdStorage) { + $script:CippInvocationIdStorage = [System.Threading.AsyncLocal[string]]::new() + } + if (-not $script:CippAllowedTenantsStorage) { + $script:CippAllowedTenantsStorage = [System.Threading.AsyncLocal[object]]::new() + } + if (-not $script:CippAllowedGroupsStorage) { + $script:CippAllowedGroupsStorage = [System.Threading.AsyncLocal[object]]::new() + } + if (-not $script:CippUserRolesStorage) { + $script:CippUserRolesStorage = [System.Threading.AsyncLocal[hashtable]]::new() + } + + # Initialize user roles cache for this request + if (-not $script:CippUserRolesStorage.Value) { + $script:CippUserRolesStorage.Value = @{} + } # Set InvocationId in AsyncLocal storage for console logging correlation if ($global:TelemetryClient -and $TriggerMetadata.InvocationId) { @@ -29,39 +43,11 @@ function New-CippCoreRequest { $FunctionName = 'Invoke-{0}' -f $Request.Params.CIPPEndpoint Write-Debug "API Endpoint: $($Request.Params.CIPPEndpoint) | Frontend Version: $($Request.Headers.'X-CIPP-Version' ?? 'Not specified')" - # For now, while we're in read-only we force the role of the MCP API cred. - # When we remove the feature flag, in NG, we move this to use the users role/ident. - if ($Request.Params.CIPPEndpoint -eq 'ExecMcp' -and - $Request.Headers.'x-ms-client-principal' -and - $Request.Headers.'x-ms-client-principal-name' -notmatch '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$') { - try { - $McpPrincipal = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Request.Headers.'x-ms-client-principal')) | ConvertFrom-Json - $McpAppId = ($McpPrincipal.claims | Where-Object { $_.typ -in @('azp', 'appid') } | Select-Object -First 1).val - if ($McpAppId -and (Get-CippApiClient -AppId $McpAppId)) { - $Request.Headers | Add-Member -NotePropertyName 'x-ms-client-principal-name' -NotePropertyValue $McpAppId -Force - $Request.Headers | Add-Member -NotePropertyName 'x-ms-client-principal-idp' -NotePropertyValue 'aad' -Force - Write-Information "MCP request mapped to API client $McpAppId (running at the app's CIPP role)" - } - } catch { - Write-Information "MCP principal app resolution failed: $($_.Exception.Message)" - } - } - # Store action source + acting identity for outbound User-Agent attribution Set-CippUserAgentContext -Headers $Request.Headers # Check if endpoint is disabled via feature flags $FeatureFlags = Get-CIPPFeatureFlag - - # In CIPP-NG, force-enable SuperAdminNG regardless of the stored flag state. - if ($env:CIPPNG -eq 'true') { - foreach ($Flag in $FeatureFlags) { - if ($Flag.Id -eq 'SuperAdminNG') { - $Flag.Enabled = $true - } - } - } - $DisabledEndpoint = $FeatureFlags | Where-Object { $_.Enabled -eq $false -and $_.Endpoints -contains $Request.Params.CIPPEndpoint } | Select-Object -First 1 @@ -75,15 +61,6 @@ function New-CippCoreRequest { }) } - # Block all API calls except /api/me when subscription has ended - if ($env:cipp_hosted_subscription_ended -and $Request.Params.CIPPEndpoint -ne 'me') { - $HttpTotalStopwatch.Stop() - return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::Forbidden - Body = 'Your CIPP subscription has ended. Access to this instance is no longer available.' - }) - } - if ($Request.Headers.'X-CIPP-Version') { $Table = Get-CippTable -tablename 'Version' $FrontendVer = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'Version' and RowKey eq 'frontend'" @@ -154,21 +131,13 @@ function New-CippCoreRequest { $swGroups.Stop() $HttpTimings['AllowedGroups'] = $swGroups.Elapsed.TotalMilliseconds - # Assign on every path, including the unrestricted one. Only writing the slot when - # access is limited is what allowed a restricted user's scope to survive into the - # next request handled by the same worker, silently filtering results for someone - # entitled to see everything. if ($AllowedTenants -notcontains 'AllTenants') { Write-Warning 'Limiting tenant access' $script:CippAllowedTenantsStorage.Value = $AllowedTenants - } else { - $script:CippAllowedTenantsStorage.Value = $null } if ($AllowedGroups -notcontains 'AllGroups') { Write-Warning 'Limiting group access' $script:CippAllowedGroupsStorage.Value = $AllowedGroups - } else { - $script:CippAllowedGroupsStorage.Value = $null } try { @@ -237,15 +206,26 @@ function New-CippCoreRequest { } } } catch { - Write-Warning "Exception occurred on HTTP trigger ($FunctionName): $($_.Exception.Message)" + $ErrorMessage = Get-CippException -Exception $_ + Write-Warning "Exception occurred on HTTP trigger ($FunctionName): $($ErrorMessage.NormalizedError)" $HttpTotalStopwatch.Stop() $HttpTimings['Total'] = $HttpTotalStopwatch.Elapsed.TotalMilliseconds $HttpTimingsRounded = [ordered]@{} foreach ($Key in ($HttpTimings.Keys | Sort-Object)) { $HttpTimingsRounded[$Key] = [math]::Round($HttpTimings[$Key], 2) } Write-Debug "#### HTTP Request Timings #### $($HttpTimingsRounded | ConvertTo-Json -Compress)" return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::InternalServerError - Body = $_.Exception.Message + StatusCode = [HttpStatusCode]::InternalServerError + ContentType = 'application/json' + Body = @{ + error = $ErrorMessage.NormalizedError + details = @{ + endpoint = $Request.Params.CIPPEndpoint + function = $FunctionName + innerException = $_.Exception.Message + scriptName = $_.InvocationInfo.ScriptName + lineNumber = $_.InvocationInfo.ScriptLineNumber + } + } | ConvertTo-Json -Depth 5 -Compress }) } } else { diff --git a/backend/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-AuditLogSearchCreation.ps1 b/backend/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-AuditLogSearchCreation.ps1 index 656fd5282b..b149a0f498 100644 --- a/backend/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-AuditLogSearchCreation.ps1 +++ b/backend/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-AuditLogSearchCreation.ps1 @@ -15,9 +15,7 @@ function Start-AuditLogSearchCreation { if (!$ConfigEntry.excludedTenants) { $ConfigEntry | Add-Member -MemberType NoteProperty -Name 'excludedTenants' -Value @() -Force } else { - # Expand tenant groups in exclusions so group members match on defaultDomainName - $Excluded = $ConfigEntry.excludedTenants | ConvertFrom-Json -ErrorAction SilentlyContinue - $ConfigEntry.excludedTenants = if ($Excluded) { @(Expand-CIPPTenantGroups -TenantFilter $Excluded) } else { @() } + $ConfigEntry.excludedTenants = $ConfigEntry.excludedTenants | ConvertFrom-Json } $ConfigEntry.Tenants = $ConfigEntry.Tenants | ConvertFrom-Json $ConfigEntry diff --git a/backend/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPDBCacheOrchestrator.ps1 b/backend/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPDBCacheOrchestrator.ps1 index 02152cbe41..54de49f71b 100644 --- a/backend/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPDBCacheOrchestrator.ps1 +++ b/backend/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPDBCacheOrchestrator.ps1 @@ -15,9 +15,8 @@ function Start-CIPPDBCacheOrchestrator { param() try { - Write-LogMessage -API 'CIPPDBCache' -message 'Starting database cache orchestration' -sev Info - Write-Host 'Starting database cache orchestration' - $TenantList = Get-Tenants | Where-Object { $null -ne $_.defaultDomainName } + Write-Information 'CIPPDBCache: Starting database cache orchestration' + $TenantList = Get-Tenants | Where-Object { $_.defaultDomainName -ne $null } if ($TenantList.Count -eq 0) { Write-LogMessage -API 'CIPPDBCache' -message 'No tenants found for cache collection' -sev Warning diff --git a/backend/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-SchedulerOrchestrator.ps1 b/backend/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-SchedulerOrchestrator.ps1 index ee9e3ef521..263932e854 100644 --- a/backend/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-SchedulerOrchestrator.ps1 +++ b/backend/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-SchedulerOrchestrator.ps1 @@ -12,18 +12,7 @@ function Start-SchedulerOrchestrator { $Table = Get-CIPPTable -TableName SchedulerConfig $Tenants = Get-CIPPAzDataTableEntity @Table | Where-Object -Property PartitionKey -NE 'WebhookAlert' - $ValidTypes = @('CIPPNotifications', 'webhookcreation') - $Tasks = foreach ($Tenant in $Tenants) { - if ($Tenant.type -notin $ValidTypes) { - if ($Tenant.PartitionKey -eq 'Alert') { - Write-Information "Scheduler: removing legacy classic-alert row for '$($Tenant.tenant)'" - Remove-CIPPAzDataTableEntity -Force @Table -Entity $Tenant - } else { - Write-Information "Scheduler: skipping row $($Tenant.PartitionKey)/$($Tenant.RowKey) - no handler for type '$($Tenant.type)'" - } - continue - } if ($Tenant.tenant -ne 'AllTenants') { [pscustomobject]@{ Tenant = $Tenant.tenant @@ -54,6 +43,12 @@ function Start-SchedulerOrchestrator { $Queue = New-CippQueueEntry -Name 'Scheduler' -TotalTasks ($Tasks | Measure-Object).Count $Batch = foreach ($Task in $Tasks) { + $TargetFunction = "Push-Scheduler$($Task.Type)" + if (-not (Get-Command -Name $TargetFunction -ErrorAction SilentlyContinue)) { + Write-Information "SchedulerOrchestrator: Skipping task type '$($Task.Type)' for tenant '$($Task.Tenant)' - function $TargetFunction not found" + Write-LogMessage -API 'SchedulerOrchestrator' -tenant $Task.Tenant -message "Scheduler type '$($Task.Type)' has no matching function ($TargetFunction). Remove this entry from SchedulerConfig or create the function." -Sev 'Warning' + continue + } [pscustomobject]@{ Tenant = $task.tenant Tenantid = $task.tenantid diff --git a/backend/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-WebhookOrchestrator.ps1 b/backend/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-WebhookOrchestrator.ps1 index 205c722aff..f11d07052c 100644 --- a/backend/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-WebhookOrchestrator.ps1 +++ b/backend/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-WebhookOrchestrator.ps1 @@ -14,7 +14,7 @@ function Start-WebhookOrchestrator { } $WebhookIncomingTable = Get-CIPPTable -TableName WebhookIncoming - $WebhookIncoming = Get-CIPPAzDataTableEntity @WebhookIncomingTable -Property PartitionKey, RowKey + $WebhookIncoming = Get-CIPPAzDataTableEntity @WebhookIncomingTable -Property PartitionKey, RowKey -Filter "PartitionKey eq 'Webhook'" if (($WebhookIncoming | Measure-Object).Count -eq 0) { Write-Information 'No webhook incoming found. Exiting.' return diff --git a/backend/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-BackupRetentionCleanup.ps1 b/backend/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-BackupRetentionCleanup.ps1 index 7a76402a5b..0079078f7d 100644 --- a/backend/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-BackupRetentionCleanup.ps1 +++ b/backend/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-BackupRetentionCleanup.ps1 @@ -3,7 +3,8 @@ function Start-BackupRetentionCleanup { .SYNOPSIS Start the Backup Retention Cleanup Timer .DESCRIPTION - This function cleans up old CIPP and Tenant backups based on the retention policy + This function cleans up old CIPP and Tenant backups based on the retention policy. + Uses pagination and parallel processing for efficient handling of large datasets. #> [CmdletBinding(SupportsShouldProcess = $true)] param( @@ -11,6 +12,149 @@ function Start-BackupRetentionCleanup { [string]$ConnectionString = $env:AzureWebJobsStorage ) + # Helper function to delete blobs in parallel with pagination + function Remove-BackupBlobsInParallel { + param( + [Parameter(Mandatory)] + $Table, + [Parameter(Mandatory)] + [string]$Filter, + [int]$BatchSize = 500, + [int]$ThrottleLimit = 10 + ) + + $TotalBlobsDeleted = 0 + $TotalEntitiesDeleted = 0 + $HasMore = $true + + while ($HasMore) { + # Fetch batch of blob backups with pagination + $BlobBackups = Get-AzDataTableEntity @Table -Filter $Filter -Property @('PartitionKey', 'RowKey', 'Backup', 'ETag') -First $BatchSize + $BatchCount = ($BlobBackups | Measure-Object).Count + + if ($BatchCount -eq 0) { + $HasMore = $false + continue + } + + Write-Host "Processing batch of $BatchCount blob backups..." + + # Delete blobs in parallel + $DeleteResults = $BlobBackups | ForEach-Object -Parallel { + $Backup = $_ + $Result = @{ + Success = $false + BlobPath = $null + Error = $null + } + + if ($Backup.Backup) { + try { + $BlobPath = $Backup.Backup + # Extract container/blob path from URL + if ($BlobPath -like '*:10000/*') { + # Azurite format: http://host:10000/devstoreaccount1/container/blob + $parts = $BlobPath -split ':10000/' + if ($parts.Count -gt 1) { + $BlobPath = ($parts[1] -split '/', 2)[-1] + } + } elseif ($BlobPath -like '*blob.core.windows.net/*') { + # Azure Storage format: https://account.blob.core.windows.net/container/blob + $BlobPath = ($BlobPath -split '.blob.core.windows.net/', 2)[-1] + } + + $Result.BlobPath = $BlobPath + $null = New-CIPPAzStorageRequest -Service 'blob' -Resource $BlobPath -Method 'DELETE' + $Result.Success = $true + } catch { + $Result.Error = $_.Exception.Message + } + } + + $Result + } -ThrottleLimit $ThrottleLimit + + # Count successful blob deletions + $SuccessfulDeletes = ($DeleteResults | Where-Object { $_.Success }).Count + $TotalBlobsDeleted += $SuccessfulDeletes + + # Log any errors + $FailedDeletes = $DeleteResults | Where-Object { $_.Error } + foreach ($Failed in $FailedDeletes) { + Write-LogMessage -API 'BackupRetentionCleanup' -message "Failed to delete blob $($Failed.BlobPath): $($Failed.Error)" -Sev 'Warning' + } + + # Delete table entities for this batch (even if blob delete failed - blob may already be gone) + try { + Remove-CIPPAzDataTableEntity @Table -Entity $BlobBackups -Force -ErrorAction Stop + $TotalEntitiesDeleted += $BatchCount + } catch { + if ($_.Exception.Message -notmatch 'does not exist|ResourceNotFound') { + Write-LogMessage -API 'BackupRetentionCleanup' -message "Failed to delete table entities: $($_.Exception.Message)" -Sev 'Warning' + } + } + + # Check if we got a full batch (more data might exist) + if ($BatchCount -lt $BatchSize) { + $HasMore = $false + } + + Write-Host "Batch complete: $SuccessfulDeletes blobs deleted" + } + + @{ + BlobsDeleted = $TotalBlobsDeleted + EntitiesDeleted = $TotalEntitiesDeleted + } + } + + # Helper function to delete table-only backups with pagination + function Remove-TableBackupsInBatches { + param( + [Parameter(Mandatory)] + $Table, + [Parameter(Mandatory)] + [string]$Filter, + [int]$BatchSize = 1000 + ) + + $TotalDeleted = 0 + $HasMore = $true + + while ($HasMore) { + # Fetch batch with pagination + $AllBackups = Get-AzDataTableEntity @Table -Filter $Filter -Property @('PartitionKey', 'RowKey', 'ETag', 'BackupIsBlob') -First $BatchSize + # Filter out blob entries client-side (null check is unreliable in filters) + $TableBackups = $AllBackups | Where-Object { $_.BackupIsBlob -ne $true } + $BatchCount = ($TableBackups | Measure-Object).Count + + if ($BatchCount -eq 0) { + # Check if we got blob entries but no table entries + if (($AllBackups | Measure-Object).Count -lt $BatchSize) { + $HasMore = $false + } + continue + } + + try { + Remove-CIPPAzDataTableEntity @Table -Entity $TableBackups -Force -ErrorAction Stop + $TotalDeleted += $BatchCount + Write-Host "Deleted batch of $BatchCount table-only backups" + } catch { + if ($_.Exception.Message -notmatch 'does not exist|ResourceNotFound') { + Write-LogMessage -API 'BackupRetentionCleanup' -message "Failed to delete table backups: $($_.Exception.Message)" -Sev 'Warning' + } + } + + # Check if we got a full batch (more data might exist) + if (($AllBackups | Measure-Object).Count -lt $BatchSize) { + $HasMore = $false + } + } + + $TotalDeleted + } + try { # Get retention settings $ConfigTable = Get-CippTable -tablename Config @@ -40,56 +184,18 @@ function Start-BackupRetentionCleanup { if ($PSCmdlet.ShouldProcess('CIPPBackup', 'Cleaning up old backups')) { $CIPPBackupTable = Get-CippTable -tablename 'CIPPBackup' $CutoffFilter = "PartitionKey eq 'CIPPBackup' and Timestamp lt datetime'$CutoffDate'" - - # Delete blob files $BlobFilter = "$CutoffFilter and BackupIsBlob eq true" - $BlobBackups = Get-AzDataTableEntity @CIPPBackupTable -Filter $BlobFilter -Property @('PartitionKey', 'RowKey', 'Backup') - - $BlobDeletedCount = 0 - if ($BlobBackups) { - foreach ($Backup in $BlobBackups) { - if ($Backup.Backup) { - try { - $BlobPath = $Backup.Backup - # Extract container/blob path from URL - if ($BlobPath -like '*:10000/*') { - # Azurite format: http://host:10000/devstoreaccount1/container/blob - $parts = $BlobPath -split ':10000/' - if ($parts.Count -gt 1) { - # Remove account name to get container/blob - $BlobPath = ($parts[1] -split '/', 2)[-1] - } - } elseif ($BlobPath -like '*blob.core.windows.net/*') { - # Azure Storage format: https://account.blob.core.windows.net/container/blob - $BlobPath = ($BlobPath -split '.blob.core.windows.net/', 2)[-1] - } - $null = New-CIPPAzStorageRequest -Service 'blob' -Resource $BlobPath -Method 'DELETE' -ConnectionString $ConnectionString - $BlobDeletedCount++ - Write-Host "Deleted blob: $BlobPath" - } catch { - Write-LogMessage -API 'BackupRetentionCleanup' -message "Failed to delete blob $($Backup.Backup): $($_.Exception.Message)" -sev 'Warning' - } - } - } - # Delete blob table entities - Remove-CIPPAzDataTableEntity @CIPPBackupTable -Entity $BlobBackups -Force - } - # Delete table-only backups (no blobs) - # Fetch all old entries and filter out blob entries client-side (null check is unreliable in filters) - $AllOldBackups = Get-AzDataTableEntity @CIPPBackupTable -Filter $CutoffFilter -Property @('PartitionKey', 'RowKey', 'ETag', 'BackupIsBlob') - $TableBackups = $AllOldBackups | Where-Object { $_.BackupIsBlob -ne $true } + # Delete blob files in parallel with pagination + $BlobResult = Remove-BackupBlobsInParallel -Table $CIPPBackupTable -Filter $BlobFilter -BatchSize 500 -ThrottleLimit 10 - $TableDeletedCount = 0 - if ($TableBackups) { - Remove-CIPPAzDataTableEntity @CIPPBackupTable -Entity $TableBackups -Force - $TableDeletedCount = ($TableBackups | Measure-Object).Count - } + # Delete table-only backups with pagination + $TableDeletedCount = Remove-TableBackupsInBatches -Table $CIPPBackupTable -Filter $CutoffFilter -BatchSize 1000 - $TotalDeleted = $BlobDeletedCount + $TableDeletedCount + $TotalDeleted = $BlobResult.BlobsDeleted + $TableDeletedCount if ($TotalDeleted -gt 0) { $DeletedCounts.Add($TotalDeleted) - Write-LogMessage -API 'BackupRetentionCleanup' -message "Deleted $TotalDeleted old CIPP backups ($BlobDeletedCount blobs, $TableDeletedCount table entries)" -Sev 'Info' + Write-LogMessage -API 'BackupRetentionCleanup' -message "Deleted $TotalDeleted old CIPP backups ($($BlobResult.BlobsDeleted) blobs, $TableDeletedCount table entries)" -Sev 'Info' Write-Host "Deleted $TotalDeleted old CIPP backups" } else { Write-Host 'No old CIPP backups found' @@ -100,56 +206,18 @@ function Start-BackupRetentionCleanup { if ($PSCmdlet.ShouldProcess('ScheduledBackup', 'Cleaning up old backups')) { $ScheduledBackupTable = Get-CippTable -tablename 'ScheduledBackup' $CutoffFilter = "PartitionKey eq 'ScheduledBackup' and Timestamp lt datetime'$CutoffDate'" - - # Delete blob files $BlobFilter = "$CutoffFilter and BackupIsBlob eq true" - $BlobBackups = Get-AzDataTableEntity @ScheduledBackupTable -Filter $BlobFilter -Property @('PartitionKey', 'RowKey', 'Backup') - - $BlobDeletedCount = 0 - if ($BlobBackups) { - foreach ($Backup in $BlobBackups) { - if ($Backup.Backup) { - try { - $BlobPath = $Backup.Backup - # Extract container/blob path from URL - if ($BlobPath -like '*:10000/*') { - # Azurite format: http://host:10000/devstoreaccount1/container/blob - $parts = $BlobPath -split ':10000/' - if ($parts.Count -gt 1) { - # Remove account name to get container/blob - $BlobPath = ($parts[1] -split '/', 2)[-1] - } - } elseif ($BlobPath -like '*blob.core.windows.net/*') { - # Azure Storage format: https://account.blob.core.windows.net/container/blob - $BlobPath = ($BlobPath -split '.blob.core.windows.net/', 2)[-1] - } - $null = New-CIPPAzStorageRequest -Service 'blob' -Resource $BlobPath -Method 'DELETE' -ConnectionString $ConnectionString - $BlobDeletedCount++ - Write-Host "Deleted blob: $BlobPath" - } catch { - Write-LogMessage -API 'BackupRetentionCleanup' -message "Failed to delete blob $($Backup.Backup): $($_.Exception.Message)" -sev 'Warning' - } - } - } - # Delete blob table entities - Remove-CIPPAzDataTableEntity @ScheduledBackupTable -Entity $BlobBackups -Force - } - # Delete table-only backups (no blobs) - # Fetch all old entries and filter out blob entries client-side (null check is unreliable in filters) - $AllOldBackups = Get-AzDataTableEntity @ScheduledBackupTable -Filter $CutoffFilter -Property @('PartitionKey', 'RowKey', 'ETag', 'BackupIsBlob') - $TableBackups = $AllOldBackups | Where-Object { $_.BackupIsBlob -ne $true } + # Delete blob files in parallel with pagination + $BlobResult = Remove-BackupBlobsInParallel -Table $ScheduledBackupTable -Filter $BlobFilter -BatchSize 500 -ThrottleLimit 10 - $TableDeletedCount = 0 - if ($TableBackups) { - Remove-CIPPAzDataTableEntity @ScheduledBackupTable -Entity $TableBackups -Force - $TableDeletedCount = ($TableBackups | Measure-Object).Count - } + # Delete table-only backups with pagination + $TableDeletedCount = Remove-TableBackupsInBatches -Table $ScheduledBackupTable -Filter $CutoffFilter -BatchSize 1000 - $TotalDeleted = $BlobDeletedCount + $TableDeletedCount + $TotalDeleted = $BlobResult.BlobsDeleted + $TableDeletedCount if ($TotalDeleted -gt 0) { $DeletedCounts.Add($TotalDeleted) - Write-LogMessage -API 'BackupRetentionCleanup' -message "Deleted $TotalDeleted old tenant backups ($BlobDeletedCount blobs, $TableDeletedCount table entries)" -Sev 'Info' + Write-LogMessage -API 'BackupRetentionCleanup' -message "Deleted $TotalDeleted old tenant backups ($($BlobResult.BlobsDeleted) blobs, $TableDeletedCount table entries)" -Sev 'Info' Write-Host "Deleted $TotalDeleted old tenant backups" } else { Write-Host 'No old tenant backups found' diff --git a/backend/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPStatsTimer.ps1 b/backend/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPStatsTimer.ps1 index 3a73cc7ed8..0e468b7a5e 100644 --- a/backend/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPStatsTimer.ps1 +++ b/backend/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPStatsTimer.ps1 @@ -5,7 +5,6 @@ function Start-CIPPStatsTimer { #> [CmdletBinding(SupportsShouldProcess = $true)] param() - #These stats are sent to a central server to help us understand how many tenants are using the product, and how many are using the latest version, this information allows the CIPP team to make decisions about what features to support, and what features to deprecate. @@ -19,8 +18,9 @@ function Start-CIPPStatsTimer { $APIVersion = if ($env:CIPPNG -eq 'true') { $env:APP_VERSION } else { - Get-Content (Join-Path $env:CIPPRootPath 'version_latest.txt') | Out-String + Get-Content (Join-Path $env:CIPPRootPath 'Config\version_latest.txt') | Out-String } + $CIPPNG = $env:CIPPNG -eq 'true' $Table = Get-CIPPTable -TableName Extensionsconfig try { $RawExt = (Get-CIPPAzDataTableEntity @Table).config | ConvertFrom-Json -Depth 10 -ErrorAction Stop @@ -32,7 +32,6 @@ function Start-CIPPStatsTimer { $FunctionOffloading = (Get-CIPPAzDataTableEntity @ConfigTable -Filter "RowKey eq 'OffloadFunctions' and PartitionKey eq 'OffloadFunctions'").state $OffloadingEnabled = $false [bool]::TryParse($FunctionOffloading, [ref]$OffloadingEnabled) | Out-Null - $CIPPNG = $env:CIPPNG -eq 'true' # Get counts of various entities across all tenants $counts = Get-CIPPDbItem -TenantFilter AllTenants -CountsOnly diff --git a/backend/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-DurableCleanup.ps1 b/backend/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-DurableCleanup.ps1 index aec18b2382..c29b4fbc58 100644 --- a/backend/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-DurableCleanup.ps1 +++ b/backend/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-DurableCleanup.ps1 @@ -33,10 +33,11 @@ function Start-DurableCleanup { $FunctionsWithLongRunningOrchestrators = [System.Collections.Generic.List[object]]::new() $NonDeterministicOrchestrators = [System.Collections.Generic.List[object]]::new() - foreach ($Table in $InstancesTables) { - $Table = Get-CippTable -TableName $Table - $FunctionName = $Table.TableName -replace 'Instances', '' - $Orchestrators = Get-CIPPAzDataTableEntity @Table -Filter "RuntimeStatus eq 'Running'" | Select-Object * -ExcludeProperty Input + foreach ($TableName in $InstancesTables) { + $Table = Get-CippTable -TableName $TableName + $FunctionName = $TableName -replace 'Instances', '' + # Limit query to avoid memory issues with large datasets + $Orchestrators = Get-CIPPAzDataTableEntity @Table -Filter "RuntimeStatus eq 'Running'" -First 1000 | Select-Object * -ExcludeProperty Input $Queues = Get-CIPPAzStorageQueue -Name ('{0}*' -f $FunctionName) | Select-Object -Property Name, ApproximateMessageCount, QueueClient $LongRunningOrchestrators = $Orchestrators | Where-Object { $_.CreatedTime.DateTime -lt $TargetTime } @@ -47,40 +48,54 @@ function Start-DurableCleanup { $TimeSpan = New-TimeSpan -Start $CreatedTime -End (Get-Date).ToUniversalTime() $RunningDuration = [math]::Round($TimeSpan.TotalMinutes, 2) Write-Information "Orchestrator: $($Orchestrator.PartitionKey), created: $CreatedTime, running for: $RunningDuration minutes" - if ($PSCmdlet.ShouldProcess($_.PartitionKey, 'Terminate Orchestrator')) { - $Orchestrator = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq '$($Orchestrator.PartitionKey)'" + if ($PSCmdlet.ShouldProcess($Orchestrator.PartitionKey, 'Terminate Orchestrator')) { + # Update in-place instead of re-fetching (eliminates N+1 query) $Orchestrator.RuntimeStatus = 'Failed' if ($Orchestrator.PSObject.Properties.Name -contains 'CustomStatus') { $Orchestrator.CustomStatus = "Terminated by Durable Cleanup - Exceeded max duration of $MaxDuration seconds" } else { $Orchestrator | Add-Member -MemberType NoteProperty -Name CustomStatus -Value "Terminated by Durable Cleanup - Exceeded max duration of $MaxDuration seconds" } - Update-AzDataTableEntity @Table -Entity $Orchestrator - $CleanupCount++ + try { + Update-AzDataTableEntity @Table -Entity $Orchestrator -ErrorAction Stop + $CleanupCount++ + } catch { + # Handle concurrent modification - entity may have been updated/deleted + if ($_.Exception.Message -notmatch 'does not exist|ResourceNotFound|Precondition Failed') { + Write-Warning "Failed to update orchestrator $($Orchestrator.PartitionKey): $($_.Exception.Message)" + } + } } } } - $NonDeterministicOrchestrators = $Orchestrators | Where-Object { $_.Output -match 'Non-Deterministic workflow detected' } - if ($NonDeterministicOrchestrators.Count -gt 0) { + $NonDeterministicList = $Orchestrators | Where-Object { $_.Output -match 'Non-Deterministic workflow detected' } + if ($NonDeterministicList.Count -gt 0) { $NonDeterministicOrchestrators.Add(@{'FunctionName' = $FunctionName }) - foreach ($Orchestrator in $NonDeterministicOrchestrators) { + foreach ($Orchestrator in $NonDeterministicList) { Write-Information "Orchestrator: $($Orchestrator.PartitionKey) is Non-Deterministic" - if ($PSCmdlet.ShouldProcess($_.PartitionKey, 'Terminate Orchestrator')) { - $Orchestrator = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq '$($Orchestrator.PartitionKey)'" + if ($PSCmdlet.ShouldProcess($Orchestrator.PartitionKey, 'Terminate Orchestrator')) { + # Update in-place instead of re-fetching (eliminates N+1 query) $Orchestrator.RuntimeStatus = 'Failed' if ($Orchestrator.PSObject.Properties.Name -contains 'CustomStatus') { $Orchestrator.CustomStatus = 'Terminated by Durable Cleanup - Non-Deterministic workflow detected' } else { $Orchestrator | Add-Member -MemberType NoteProperty -Name CustomStatus -Value 'Terminated by Durable Cleanup - Non-Deterministic workflow detected' } - Update-AzDataTableEntity @Table -Entity $Orchestrator - $CleanupCount++ + try { + Update-AzDataTableEntity @Table -Entity $Orchestrator -ErrorAction Stop + $CleanupCount++ + } catch { + # Handle concurrent modification - entity may have been updated/deleted + if ($_.Exception.Message -notmatch 'does not exist|ResourceNotFound|Precondition Failed') { + Write-Warning "Failed to update orchestrator $($Orchestrator.PartitionKey): $($_.Exception.Message)" + } + } } } } - if (($LongRunningOrchestrators.Count -gt 0 -or $NonDeterministicOrchestrators.Count -gt 0) -and $Queues.ApproximateMessageCount -gt 0) { + if (($LongRunningOrchestrators.Count -gt 0 -or $NonDeterministicList.Count -gt 0) -and $Queues.ApproximateMessageCount -gt 0) { $RunningQueues = $Queues | Where-Object { $_.ApproximateMessageCount -gt 0 } foreach ($Queue in $RunningQueues) { Write-Information "- Removing queue: $($Queue.Name), message count: $($Queue.ApproximateMessageCount)" @@ -96,5 +111,50 @@ function Start-DurableCleanup { Write-LogMessage -api 'Durable Cleanup' -message "$CleanupCount orchestrators were terminated. $QueueCount queues were cleared." -sev 'Info' -LogData $FunctionsWithLongRunningOrchestrators } - Write-Information "Durable cleanup complete. $CleanupCount orchestrators were terminated. $QueueCount queues were cleared." + # Purge completed/failed/terminated durable function history older than retention period + # This reduces storage write/read overhead from accumulating history rows + $PurgeCount = 0 + $PurgeRetentionHours = 24 + $PurgeCutoff = (Get-Date).ToUniversalTime().AddHours(-$PurgeRetentionHours) + + foreach ($TableName in $InstancesTables) { + $Table = Get-CippTable -TableName $TableName + $HistoryTableName = $TableName -replace 'Instances', 'History' + + # Purge completed/failed/terminated instances older than retention period + $CompletedFilter = "(RuntimeStatus eq 'Completed' or RuntimeStatus eq 'Failed' or RuntimeStatus eq 'Terminated') and Timestamp lt datetime'{0}'" -f $PurgeCutoff.ToString('yyyy-MM-ddTHH:mm:ssZ') + try { + $StaleInstances = Get-CIPPAzDataTableEntity @Table -Filter $CompletedFilter -Property PartitionKey, RowKey, ETag -First 500 + if ($StaleInstances -and @($StaleInstances).Count -gt 0) { + Remove-CIPPAzDataTableEntity @Table -Entity $StaleInstances -Force -ErrorAction Stop | Out-Null + $PurgeCount += @($StaleInstances).Count + } + } catch { + if ($_.Exception.Message -notmatch 'does not exist|ResourceNotFound') { + Write-Warning "Failed to purge instances from $TableName : $($_.Exception.Message)" + } + } + + # Purge corresponding history table entries + try { + $HistoryTable = Get-CippTable -TableName $HistoryTableName + $HistoryFilter = "Timestamp lt datetime'{0}'" -f $PurgeCutoff.ToString('yyyy-MM-ddTHH:mm:ssZ') + $StaleHistory = Get-CIPPAzDataTableEntity @HistoryTable -Filter $HistoryFilter -Property PartitionKey, RowKey, ETag -First 1000 + if ($StaleHistory -and @($StaleHistory).Count -gt 0) { + Remove-CIPPAzDataTableEntity @HistoryTable -Entity $StaleHistory -Force -ErrorAction Stop | Out-Null + $PurgeCount += @($StaleHistory).Count + } + } catch { + # History table may not exist for all function apps, ignore errors + if ($_.Exception.Message -notmatch 'does not exist|ResourceNotFound|TableNotFound') { + Write-Warning "Failed to purge history from $HistoryTableName : $($_.Exception.Message)" + } + } + } + + if ($PurgeCount -gt 0) { + Write-Information "Purged $PurgeCount stale durable function history entries (older than $PurgeRetentionHours hours)" + } + + Write-Information "Durable cleanup complete. $CleanupCount orchestrators were terminated. $QueueCount queues were cleared. $PurgeCount history entries purged." } diff --git a/backend/Modules/CIPPCore/Public/Functions/Remove-EmptyArrays.ps1 b/backend/Modules/CIPPCore/Public/Functions/Remove-EmptyArrays.ps1 new file mode 100644 index 0000000000..fd46b76e72 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Functions/Remove-EmptyArrays.ps1 @@ -0,0 +1,19 @@ +function Remove-EmptyArrays ($Object) { + if ($Object -is [Array]) { + foreach ($Item in $Object) { Remove-EmptyArrays $Item } + } elseif ($Object -is [HashTable]) { + foreach ($Key in @($Object.get_Keys())) { + if ($Object[$Key] -is [Array] -and $Object[$Key].get_Count() -eq 0) { + $Object.Remove($Key) + } else { Remove-EmptyArrays $Object[$Key] } + } + } elseif ($Object -is [PSCustomObject]) { + foreach ($Name in @($Object.PSObject.Properties.Name)) { + if ($Object.$Name -is [Array] -and $Object.$Name.get_Count() -eq 0) { + $Object.PSObject.Properties.Remove($Name) + } elseif ($null -eq $Object.$Name) { + $Object.PSObject.Properties.Remove($Name) + } else { Remove-EmptyArrays $Object.$Name } + } + } +} diff --git a/backend/Modules/CIPPCore/Public/Get-CIPPAuthentication.ps1 b/backend/Modules/CIPPCore/Public/Get-CIPPAuthentication.ps1 index cd5dbdd328..416224a759 100644 --- a/backend/Modules/CIPPCore/Public/Get-CIPPAuthentication.ps1 +++ b/backend/Modules/CIPPCore/Public/Get-CIPPAuthentication.ps1 @@ -9,8 +9,7 @@ function Get-CIPPAuthentication { $Variables = @('ApplicationID', 'ApplicationSecret', 'TenantID', 'RefreshToken') try { - $IsDevMode = $env:AzureWebJobsStorage -eq 'UseDevelopmentStorage=true' -or $env:NonLocalHostAzurite -eq 'true' - if ($IsDevMode) { + if ($env:AzureWebJobsStorage -eq 'UseDevelopmentStorage=true' -or $env:NonLocalHostAzurite -eq 'true') { $Table = Get-CIPPTable -tablename 'DevSecrets' $Secret = Get-AzDataTableEntity @Table -Filter "PartitionKey eq 'Secret' and RowKey eq 'Secret'" if (!$Secret) { @@ -28,48 +27,6 @@ function Get-CIPPAuthentication { Set-Item -Path env:$_ -Value (Get-CippKeyVaultSecret -VaultName $keyvaultname -Name $_ -AsPlainText -ErrorAction Stop) -Force } } - # TenantID must be the tenant GUID: a domain name (contoso.onmicrosoft.com) - # works for token requests but breaks API integrations that compare or store - # tenant ids. Resolve a domain to its GUID via the unauthenticated OpenID - # metadata endpoint. Skip the deployment template's placeholder value — - # fresh deployments hold 'tenantId' until the setup wizard writes real - # secrets (same placeholder set as Initialize-CIPPAuth). - $GuidPattern = '^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}$' - $PlaceholderPattern = '^(LongApplicationId|AppSecret|RefreshToken|tenantId)$' - if ($env:TenantID -and $env:TenantID -notmatch $GuidPattern -and $env:TenantID -notmatch $PlaceholderPattern) { - $StoredTenantID = $env:TenantID - try { - $OpenIdConfig = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$StoredTenantID/v2.0/.well-known/openid-configuration" -ErrorAction Stop - $ResolvedTenantID = ($OpenIdConfig.issuer -split '/')[3] - if ($ResolvedTenantID -notmatch $GuidPattern) { - throw "OpenID metadata for '$StoredTenantID' did not contain a tenant GUID (issuer: $($OpenIdConfig.issuer))" - } - $env:TenantID = $ResolvedTenantID - Write-LogMessage -message "The TenantID secret is set to domain name '$StoredTenantID' - resolved to tenant GUID $ResolvedTenantID." -Sev 'Warning' -API 'CIPP Authentication' - - # Fix the stored secret so every future load gets the GUID directly. - # Best-effort: this session already has the resolved value. - if ($IsDevMode) { - try { - $Secret | Add-Member -MemberType NoteProperty -Name 'TenantID' -Value $ResolvedTenantID -Force - $null = Add-AzDataTableEntity @Table -Entity $Secret -Force - Write-LogMessage -message "Updated the TenantID in the DevSecrets table from '$StoredTenantID' to tenant GUID $ResolvedTenantID." -Sev 'Info' -API 'CIPP Authentication' - } catch { - Write-LogMessage -message 'Could not update the TenantID in the DevSecrets table - it will be re-resolved on every authentication load.' -Sev 'Warning' -API 'CIPP Authentication' -LogData (Get-CippException -Exception $_) - } - } elseif ($keyvaultname) { - try { - $null = Set-CippKeyVaultSecret -VaultName $keyvaultname -Name 'TenantID' -SecretValue (ConvertTo-SecureString -String $ResolvedTenantID -AsPlainText -Force) -ErrorAction Stop - Write-LogMessage -message "Updated the 'TenantID' Key Vault secret from '$StoredTenantID' to tenant GUID $ResolvedTenantID." -Sev 'Info' -API 'CIPP Authentication' - } catch { - Write-LogMessage -message "Could not update the 'TenantID' Key Vault secret to the tenant GUID - it will be re-resolved on every authentication load until the secret is updated manually." -Sev 'Warning' -API 'CIPP Authentication' -LogData (Get-CippException -Exception $_) - } - } - } catch { - Write-LogMessage -message "The TenantID secret ('$StoredTenantID') is not a GUID and could not be resolved to one. API integrations may misbehave until the 'tenantid' Key Vault secret is set to the tenant GUID." -Sev 'Error' -API 'CIPP Authentication' -LogData (Get-CippException -Exception $_) - } - } - # Set before certificate handling: Update-CIPPSAMCertificate goes through # Get-GraphToken, which re-enters this function when SetFromProfile is unset $env:SetFromProfile = $true @@ -78,7 +35,7 @@ function Get-CIPPAuthentication { # when it does not exist yet. Non-fatal: auth must succeed even when certificate # handling fails; the weekly token update retries provisioning. try { - if ($IsDevMode) { + if ($env:AzureWebJobsStorage -eq 'UseDevelopmentStorage=true' -or $env:NonLocalHostAzurite -eq 'true') { if ($Secret.SAMCertificate) { $env:SAMCertificate = $Secret.SAMCertificate } diff --git a/backend/Modules/CIPPCore/Public/Get-CIPPDrift.ps1 b/backend/Modules/CIPPCore/Public/Get-CIPPDrift.ps1 index 0bf9ae6653..9b274186ad 100644 --- a/backend/Modules/CIPPCore/Public/Get-CIPPDrift.ps1 +++ b/backend/Modules/CIPPCore/Public/Get-CIPPDrift.ps1 @@ -645,15 +645,15 @@ function Get-CIPPDrift { $Entity } } - if ($StaleDriftEntities) { - try { - foreach ($StaleEntity in $StaleDriftEntities) { - Remove-CIPPAzDataTableEntity @DriftTable -Entity $StaleEntity - } - Write-Information "Removed $(@($StaleDriftEntities).Count) stale drift deviation entries for $TenantFilter" - } catch { - Write-Warning "Failed to remove stale drift deviation entries for $($TenantFilter): $($_.Exception.Message)" + } + if ($StaleDriftEntities) { + try { + foreach ($StaleEntity in $StaleDriftEntities) { + Remove-CIPPAzDataTableEntity @DriftTable -Entity $StaleEntity } + Write-Information "Removed $(@($StaleDriftEntities).Count) stale drift deviation entries for $TenantFilter" + } catch { + Write-Warning "Failed to remove stale drift deviation entries for $($TenantFilter): $($_.Exception.Message)" } } diff --git a/backend/Modules/CIPPCore/Public/Get-CIPPFeatureFlag.ps1 b/backend/Modules/CIPPCore/Public/Get-CIPPFeatureFlag.ps1 index 92dbc36f44..89be7ce26a 100644 --- a/backend/Modules/CIPPCore/Public/Get-CIPPFeatureFlag.ps1 +++ b/backend/Modules/CIPPCore/Public/Get-CIPPFeatureFlag.ps1 @@ -12,6 +12,8 @@ function Get-CIPPFeatureFlag { default. A row that was auto-seeded by an older release (no LastModified, so never toggled by a user) is re-seeded once when a condition is introduced, so a new release can change the default for installs that never chose. A user toggle (LastModified set) always wins. + On a CIPP-NG container, SuperAdminNG is forced on so the Users and container pages match + the nav. The stored row is left as-is. .PARAMETER Id The ID of the feature flag to retrieve. If not specified, returns all feature flags. .FUNCTIONALITY @@ -73,6 +75,13 @@ function Get-CIPPFeatureFlag { $Enabled = $TableFlag.Enabled } + # ListFeatureFlags already turns these pages on for CIPP-NG containers, so the + # nav shows Manage365 Users. The request gate reads this function, not that + # list, and was still returning 503 from the stored "off" default. + if ($env:CIPPNG -eq 'true' -and $FeatureFlag.Id -eq 'SuperAdminNG') { + $Enabled = $true + } + [PSCustomObject]@{ Id = $FeatureFlag.Id Name = $FeatureFlag.Name diff --git a/backend/Modules/CIPPCore/Public/Get-CIPPIntunePolicy.ps1 b/backend/Modules/CIPPCore/Public/Get-CIPPIntunePolicy.ps1 index 90447b2a37..813ab14a52 100644 --- a/backend/Modules/CIPPCore/Public/Get-CIPPIntunePolicy.ps1 +++ b/backend/Modules/CIPPCore/Public/Get-CIPPIntunePolicy.ps1 @@ -52,28 +52,17 @@ function Get-CIPPIntunePolicy { $androidPolicies = ($BulkResults | Where-Object { $_.id -eq 'AndroidPolicies' }).body.value $iOSPolicies = ($BulkResults | Where-Object { $_.id -eq 'iOSPolicies' }).body.value - # Reading a concrete collection makes Graph omit @odata.type from every item, but - # callers need the concrete type to address the policy - its assignments live under - # that collection. The collection a policy came from is the authoritative answer, so - # record it here rather than leaving each caller to infer it from the payload. - foreach ($Policy in $androidPolicies) { - $null = $Policy | Add-Member -MemberType NoteProperty -Name '@odata.type' -Value '#microsoft.graph.androidManagedAppProtection' -Force - } - foreach ($Policy in $iOSPolicies) { - $null = $Policy | Add-Member -MemberType NoteProperty -Name '@odata.type' -Value '#microsoft.graph.iosManagedAppProtection' -Force - } - if ($DisplayName) { $androidPolicy = $androidPolicies | Where-Object -Property displayName -EQ $DisplayName | Sort-Object -Property lastModifiedDateTime -Descending | Select-Object -First 1 $iOSPolicy = $iOSPolicies | Where-Object -Property displayName -EQ $DisplayName | Sort-Object -Property lastModifiedDateTime -Descending | Select-Object -First 1 # Return the matching policy (Android or iOS) - using full data from bulk request if ($androidPolicy) { - $policyJson = ConvertTo-Json -InputObject $androidPolicy -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $androidPolicy -Depth 20 -Compress $androidPolicy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force return $androidPolicy } elseif ($iOSPolicy) { - $policyJson = ConvertTo-Json -InputObject $iOSPolicy -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $iOSPolicy -Depth 20 -Compress $iOSPolicy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force return $iOSPolicy } @@ -85,11 +74,11 @@ function Get-CIPPIntunePolicy { # Return the matching policy - using full data from bulk request if ($androidPolicy) { - $policyJson = ConvertTo-Json -InputObject $androidPolicy -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $androidPolicy -Depth 20 -Compress $androidPolicy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force return $androidPolicy } elseif ($iOSPolicy) { - $policyJson = ConvertTo-Json -InputObject $iOSPolicy -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $iOSPolicy -Depth 20 -Compress $iOSPolicy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force return $iOSPolicy } @@ -98,13 +87,13 @@ function Get-CIPPIntunePolicy { } else { # Process all Android policies foreach ($policy in $androidPolicies) { - $policyJson = ConvertTo-Json -InputObject $policy -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policy -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } # Process all iOS policies foreach ($policy in $iOSPolicies) { - $policyJson = ConvertTo-Json -InputObject $policy -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policy -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } @@ -124,14 +113,14 @@ function Get-CIPPIntunePolicy { $policy = $policies | Where-Object -Property displayName -EQ $DisplayName | Sort-Object -Property lastModifiedDateTime -Descending | Select-Object -First 1 if ($policy) { $policyDetails = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')?`$expand=scheduledActionsForRule(`$expand=scheduledActionConfigurations)" -tenantid $tenantFilter - $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } return $policy } elseif ($PolicyId) { $policy = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$PolicyId')?`$expand=scheduledActionsForRule(`$expand=scheduledActionConfigurations)" -tenantid $tenantFilter if ($policy) { - $policyJson = ConvertTo-Json -InputObject $policy -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policy -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } return $policy @@ -139,7 +128,7 @@ function Get-CIPPIntunePolicy { $policies = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL" -tenantid $tenantFilter foreach ($policy in $policies) { $policyDetails = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')?`$expand=scheduledActionsForRule(`$expand=scheduledActionConfigurations)" -tenantid $tenantFilter - $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } return $policies @@ -278,7 +267,7 @@ function Get-CIPPIntunePolicy { if ($policy) { $policyDetails = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')?`$expand=settings" -tenantid $tenantFilter $policyDetails = $policyDetails | Select-Object name, description, settings, platforms, technologies, templateReference - $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } return $policy @@ -286,7 +275,7 @@ function Get-CIPPIntunePolicy { $policy = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$PolicyId')?`$expand=settings" -tenantid $tenantFilter if ($policy) { $policyDetails = $policy | Select-Object name, description, settings, platforms, technologies, templateReference - $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } return $policy @@ -295,7 +284,7 @@ function Get-CIPPIntunePolicy { foreach ($policy in $policies) { $policyDetails = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')?`$expand=settings" -tenantid $tenantFilter $policyDetails = $policyDetails | Select-Object name, description, settings, platforms, technologies, templateReference - $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } return $policies @@ -311,7 +300,7 @@ function Get-CIPPIntunePolicy { if ($policy) { $policyDetails = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')" -tenantid $tenantFilter $policyDetails = $policyDetails | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime' - $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } return $policy @@ -319,7 +308,7 @@ function Get-CIPPIntunePolicy { $policy = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$PolicyId')" -tenantid $tenantFilter if ($policy) { $policyDetails = $policy | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime' - $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } return $policy @@ -328,7 +317,7 @@ function Get-CIPPIntunePolicy { foreach ($policy in $policies) { $policyDetails = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')" -tenantid $tenantFilter $policyDetails = $policyDetails | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime' - $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } return $policies @@ -344,7 +333,7 @@ function Get-CIPPIntunePolicy { if ($policy) { $policyDetails = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')" -tenantid $tenantFilter $policyDetails = $policyDetails | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime' - $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } return $policy @@ -352,7 +341,7 @@ function Get-CIPPIntunePolicy { $policy = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$PolicyId')" -tenantid $tenantFilter if ($policy) { $policyDetails = $policy | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime' - $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } return $policy @@ -361,7 +350,7 @@ function Get-CIPPIntunePolicy { foreach ($policy in $policies) { $policyDetails = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')" -tenantid $tenantFilter $policyDetails = $policyDetails | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime' - $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } return $policies @@ -377,7 +366,7 @@ function Get-CIPPIntunePolicy { if ($policy) { $policyDetails = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')" -tenantid $tenantFilter $policyDetails = $policyDetails | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime' - $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } return $policy @@ -385,7 +374,7 @@ function Get-CIPPIntunePolicy { $policy = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$PolicyId')" -tenantid $tenantFilter if ($policy) { $policyDetails = $policy | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime' - $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } return $policy @@ -394,7 +383,7 @@ function Get-CIPPIntunePolicy { foreach ($policy in $policies) { $policyDetails = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')" -tenantid $tenantFilter $policyDetails = $policyDetails | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime' - $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } return $policies @@ -410,7 +399,7 @@ function Get-CIPPIntunePolicy { if ($policy) { $policyDetails = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')" -tenantid $tenantFilter $policyDetails = $policyDetails | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime' - $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } return $policy @@ -418,7 +407,7 @@ function Get-CIPPIntunePolicy { $policy = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$PolicyId')" -tenantid $tenantFilter if ($policy) { $policyDetails = $policy | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime' - $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } return $policy @@ -427,7 +416,7 @@ function Get-CIPPIntunePolicy { foreach ($policy in $policies) { $policyDetails = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')" -tenantid $tenantFilter $policyDetails = $policyDetails | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime' - $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress + $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 20 -Compress $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force } return $policies diff --git a/backend/Modules/CIPPCore/Public/Get-CIPPJITAdminApprovalRequirement.ps1 b/backend/Modules/CIPPCore/Public/Get-CIPPJITAdminApprovalRequirement.ps1 new file mode 100644 index 0000000000..2966014f8a --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Get-CIPPJITAdminApprovalRequirement.ps1 @@ -0,0 +1,22 @@ +function Get-CIPPJITAdminApprovalRequirement { + <# + .SYNOPSIS + Returns the instance-wide JIT admin approval requirement for the requested roles, or $null when no approval is needed + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param([string[]]$Roles) + + $Table = Get-CIPPTable -TableName Config + $Settings = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'JITAdminSettings' and RowKey eq 'JITAdminSettings'" + if ($Settings.RequireApproval -ne $true) { return $null } + + $TriggerRoles = @(if ($Settings.ApprovalTriggerRoles) { ($Settings.ApprovalTriggerRoles | ConvertFrom-Json).value }).Where({ $_ }) + if ($TriggerRoles.Count -gt 0 -and @($Roles).Where({ $_ -in $TriggerRoles }).Count -eq 0) { return $null } + + [pscustomobject]@{ + ApproverRoles = @(if ($Settings.ApproverRoles) { $Settings.ApproverRoles | ConvertFrom-Json }) + RequiredApprovals = [math]::Max(1, [int]$Settings.RequiredApprovals) + } +} diff --git a/backend/Modules/CIPPCore/Public/Get-CIPPLAPSPassword.ps1 b/backend/Modules/CIPPCore/Public/Get-CIPPLAPSPassword.ps1 index 921025f70f..9e720e6706 100644 --- a/backend/Modules/CIPPCore/Public/Get-CIPPLAPSPassword.ps1 +++ b/backend/Modules/CIPPCore/Public/Get-CIPPLAPSPassword.ps1 @@ -27,17 +27,16 @@ function Get-CIPPLapsPassword { state = 'success' } } - if ($GraphRequest) { - Write-LogMessage -headers $Headers -API $APIName -message "Retrieved LAPS password for $Device" -Sev 'Info' -tenant $TenantFilter - return $GraphRequest - } else { - Write-LogMessage -headers $Headers -API $APIName -message "No LAPS password found for $Device" -Sev 'Info' -tenant $TenantFilter - return "No LAPS password found for $Device" - } } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -headers $Headers -API $APIName -message "Could not retrieve LAPS password for $Device. Error: $($ErrorMessage.NormalizedError)" -Sev 'Error' -tenant $TenantFilter -LogData $ErrorMessage - return "Could not retrieve LAPS password for $Device. Error: $($ErrorMessage.NormalizedError)" + throw "Could not retrieve LAPS password for $Device. Error: $($ErrorMessage.NormalizedError)" + } + if (-not $GraphRequest) { + Write-LogMessage -headers $Headers -API $APIName -message "No LAPS password found for $Device" -Sev 'Info' -tenant $TenantFilter + throw [System.Management.Automation.ItemNotFoundException]::new("No LAPS password found for $Device") } + Write-LogMessage -headers $Headers -API $APIName -message "Retrieved LAPS password for $Device" -Sev 'Info' -tenant $TenantFilter + return $GraphRequest } diff --git a/backend/Modules/CIPPCore/Public/Get-CIPPLicensePrice.ps1 b/backend/Modules/CIPPCore/Public/Get-CIPPLicensePrice.ps1 index 8c27dcddbb..0518a36268 100644 --- a/backend/Modules/CIPPCore/Public/Get-CIPPLicensePrice.ps1 +++ b/backend/Modules/CIPPCore/Public/Get-CIPPLicensePrice.ps1 @@ -34,6 +34,10 @@ function Get-CIPPLicensePrice { that has no price in the requested currency (Source 'Unknown', null price), so the price-management page shows every SKU and each can be priced. + .PARAMETER FailOnError + Throw when a source cannot be read. Used by write paths that must compare against reliable + resolved pricing before changing an override. + .FUNCTIONALITY Internal #> @@ -42,9 +46,12 @@ function Get-CIPPLicensePrice { [string]$SkuId, [string]$Currency = 'USD', [switch]$ListCurrencies, - [switch]$IncludeUnknown + [switch]$IncludeUnknown, + [switch]$FailOnError ) + if ($FailOnError) { $ErrorActionPreference = 'Stop' } + # currency (lower) -> @{ skuId (lower) -> price object } $Estimate = @{} $Override = @{} @@ -56,22 +63,27 @@ function Get-CIPPLicensePrice { # catalog only carries prices keyed by GUID, so there is one SKU database, not two. try { $TablePath = Join-Path $env:CIPPRootPath 'Config\ConversionTable.csv' + if ($FailOnError -and -not (Test-Path $TablePath)) { throw "SKU list not found at $TablePath" } if (Test-Path $TablePath) { foreach ($Row in (Get-Content -Path $TablePath -Raw | ConvertFrom-Csv)) { - $Key = ([string]$Row.GUID).ToLowerInvariant() + $Key = ([string]$Row.GUID).Trim().ToLowerInvariant() if ([string]::IsNullOrWhiteSpace($Key) -or $SkuMeta.ContainsKey($Key)) { continue } $SkuMeta[$Key] = [pscustomobject]@{ skuPartNumber = [string]$Row.String_Id; Product_Display_Name = [string]$Row.Product_Display_Name } } } } catch { + if ($FailOnError) { throw "Get-CIPPLicensePrice: failed to read the SKU list: $($_.Exception.Message)" } Write-Information "Get-CIPPLicensePrice: failed to read the SKU list: $($_.Exception.Message)" } # Shipped list prices (public, subject to drift - labelled Estimate) try { $Catalog = Get-CIPPLicenseCatalog + if ($FailOnError -and $null -eq $Catalog) { throw 'License catalog is unavailable.' } + $ProductCount = @($Catalog.products | Where-Object { $null -ne $_ }).Count + if ($FailOnError -and $ProductCount -eq 0) { throw 'License catalog has no products.' } foreach ($Product in @($Catalog.products)) { - $Key = ([string]$Product.skuId).ToLowerInvariant() + $Key = ([string]$Product.skuId).Trim().ToLowerInvariant() if ([string]::IsNullOrWhiteSpace($Key)) { continue } if (-not $SkuMeta.ContainsKey($Key)) { $SkuMeta[$Key] = [pscustomobject]@{ skuPartNumber = [string]$Product.skuPartNumber; Product_Display_Name = if ($Product.name) { [string]$Product.name } else { $Key } } @@ -94,6 +106,7 @@ function Get-CIPPLicensePrice { } } } catch { + if ($FailOnError) { throw "Get-CIPPLicensePrice: failed to read the license catalog: $($_.Exception.Message)" } Write-Information "Get-CIPPLicensePrice: failed to read the license catalog: $($_.Exception.Message)" } @@ -101,7 +114,7 @@ function Get-CIPPLicensePrice { try { $Table = Get-CIPPTable -TableName 'LicensePricing' foreach ($Row in (Get-CIPPAzDataTableEntity @Table)) { - $Key = if ($Row.skuId) { ([string]$Row.skuId).ToLowerInvariant() } else { (([string]$Row.RowKey) -split '-')[0].ToLowerInvariant() } + $Key = if ($Row.skuId) { ([string]$Row.skuId).Trim().ToLowerInvariant() } else { (([string]$Row.RowKey) -replace '-[^-]+$', '').Trim().ToLowerInvariant() } if ([string]::IsNullOrWhiteSpace($Key)) { continue } $Cur = if ($Row.Currency) { [string]$Row.Currency } else { 'USD' } $null = $CurrencySet.Add($Cur) @@ -120,6 +133,7 @@ function Get-CIPPLicensePrice { } } } catch { + if ($FailOnError) { throw "Get-CIPPLicensePrice: failed to read override table: $($_.Exception.Message)" } Write-Information "Get-CIPPLicensePrice: failed to read override table: $($_.Exception.Message)" } @@ -144,7 +158,7 @@ function Get-CIPPLicensePrice { } if ($SkuId) { - return & $ResolveOne ([string]$SkuId).ToLowerInvariant() + return & $ResolveOne ([string]$SkuId).Trim().ToLowerInvariant() } # The full list is the price matrix: only SKUs that actually carry a price in this currency diff --git a/backend/Modules/CIPPCore/Public/Get-CIPPMSPAppInstallCommand.ps1 b/backend/Modules/CIPPCore/Public/Get-CIPPMSPAppInstallCommand.ps1 index 4516e9eb12..2888748f00 100644 --- a/backend/Modules/CIPPCore/Public/Get-CIPPMSPAppInstallCommand.ps1 +++ b/backend/Modules/CIPPCore/Public/Get-CIPPMSPAppInstallCommand.ps1 @@ -18,7 +18,7 @@ function Get-CIPPMSPAppInstallCommand { .PARAMETER Tenant The tenant object, requires customerId and defaultDomainName. .PARAMETER PackageName - Package name for ninja/NCentral installs (not stored under params). + Package name for NCentral installs (not stored under params). #> [CmdletBinding()] param( @@ -66,8 +66,8 @@ function Get-CIPPMSPAppInstallCommand { $uninstallCommandLine = 'powershell.exe -ExecutionPolicy Bypass .\uninstall.ps1' } 'ninja' { - $NinjaPackage = ConvertTo-CIPPSafePwshArg -Value ([string]$PackageName) - $installCommandLine = "powershell.exe -ExecutionPolicy Bypass .\install.ps1 -InstallParam $NinjaPackage" + $NinjaToken = ConvertTo-CIPPSafePwshArg -Value (Resolve-MSPValue $InstallParams.NinjaToken) + $installCommandLine = "powershell.exe -ExecutionPolicy Bypass .\install.ps1 -Token $NinjaToken" $uninstallCommandLine = 'powershell.exe -ExecutionPolicy Bypass .\uninstall.ps1' } 'Huntress' { diff --git a/backend/Modules/CIPPCore/Public/Get-CIPPMailboxFolderIdentityCandidates.ps1 b/backend/Modules/CIPPCore/Public/Get-CIPPMailboxFolderIdentityCandidates.ps1 new file mode 100644 index 0000000000..fb15d0ac16 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Get-CIPPMailboxFolderIdentityCandidates.ps1 @@ -0,0 +1,139 @@ +function Get-CIPPMailboxFolderIdentityCandidates { + <# + .SYNOPSIS + Build Exchange folder Identity strings to try for folder-permission ops. + + .DESCRIPTION + Prefer the same Identity shape ListCalendarPermissions uses (id:\FolderName). + Optionally include FolderId / UPN variants. Keep the list small to avoid API timeouts. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$TenantFilter, + + [Parameter(Mandatory = $true)] + $UserID, + + [Parameter(Mandatory = $false)] + [string]$FolderName = 'Calendar', + + [Parameter(Mandatory = $false)] + [ValidateSet('Calendar', 'Contacts')] + [string]$FolderScope = 'Calendar', + + [Parameter(Mandatory = $false)] + [switch]$IncludeFolderId, + + [Parameter(Mandatory = $false)] + [switch]$IncludeUpnVariants + ) + + $Identities = [System.Collections.Generic.List[string]]::new() + $Add = { + param([string]$Value) + if ([string]::IsNullOrWhiteSpace($Value)) { return } + if (-not $Identities.Contains($Value)) { $Identities.Add($Value) } + } + + $FolderType = if ($FolderScope -eq 'Contacts') { 'Contacts' } else { 'Calendar' } + $FolderId = $null + $ResolvedName = $FolderName + $MailboxUPN = $null + + try { + $Stats = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-MailboxFolderStatistics' -cmdParams @{ + Identity = $UserID + FolderScope = $FolderScope + } -Anchor $UserID + $Primary = @($Stats) | Where-Object { $_.FolderType -eq $FolderType } | Select-Object -First 1 + if (-not $Primary) { $Primary = @($Stats) | Select-Object -First 1 } + if ($Primary) { + $FolderId = $Primary.FolderId + if ($Primary.Name) { $ResolvedName = [string]$Primary.Name } + } + } catch { + Write-Information "Could not get folder statistics for $UserID : $($_.Exception.Message)" + } + + if ($IncludeUpnVariants) { + try { + $Mailbox = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-Mailbox' -cmdParams @{ Identity = $UserID } -Anchor $UserID + $MailboxUPN = $Mailbox.UserPrincipalName ?? $Mailbox.PrimarySmtpAddress + } catch { + Write-Information "Could not get mailbox for $UserID : $($_.Exception.Message)" + } + } + + # Prefer the same Identity shape ListCalendarPermissions uses + & $Add "$UserID`:\$ResolvedName" + if ($FolderName -and $FolderName -ne $ResolvedName) { + & $Add "$UserID`:\$FolderName" + } + + if ($IncludeUpnVariants -and $MailboxUPN) { + & $Add "$MailboxUPN`:\$ResolvedName" + if ($FolderName -and $FolderName -ne $ResolvedName) { + & $Add "$MailboxUPN`:\$FolderName" + } + } + + if ($IncludeFolderId -and $FolderId) { + & $Add "$UserID`:$FolderId" + if ($IncludeUpnVariants -and $MailboxUPN) { + & $Add "$MailboxUPN`:$FolderId" + } + } + + return @{ + Identities = @($Identities) + FolderName = $ResolvedName + FolderId = $FolderId + MailboxUPN = $MailboxUPN + } +} + +function Get-CIPPFolderPermissionAclUserKeys { + <# + .SYNOPSIS + Extract every usable User key from a Get-MailboxFolderPermission User value. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + $PermUser + ) + + $Keys = [System.Collections.Generic.List[string]]::new() + $Add = { + param($Value) + if ($null -eq $Value) { return } + if ($Value -is [string]) { + $Trimmed = $Value.Trim() + if ($Trimmed -and -not $Keys.Contains($Trimmed)) { $Keys.Add($Trimmed) } + return + } + if ($Value -is [System.Collections.IEnumerable] -and $Value -isnot [string]) { + foreach ($Item in @($Value)) { & $Add $Item } + return + } + if ($Value -is [psobject]) { + foreach ($Name in @('UserSmtpAddress', 'SmtpAddress', 'PrimarySmtpAddress', 'DisplayName', 'UserId', 'Name', 'Identity', 'RawIdentity')) { + if ($Value.PSObject.Properties.Name -contains $Name) { + & $Add $Value.$Name + } + } + foreach ($Name in @('RecipientPrincipal', 'ADRecipient')) { + if ($Value.PSObject.Properties.Name -contains $Name -and $Value.$Name) { + & $Add $Value.$Name + } + } + if ($Keys.Count -eq 0) { + & $Add ([string]$Value) + } + } + } + + & $Add $PermUser + return @($Keys) +} diff --git a/backend/Modules/CIPPCore/Public/Get-CippBulkStatusCode.ps1 b/backend/Modules/CIPPCore/Public/Get-CippBulkStatusCode.ps1 new file mode 100644 index 0000000000..6070a43f90 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Get-CippBulkStatusCode.ps1 @@ -0,0 +1,14 @@ +function Get-CippBulkStatusCode { + <# + .SYNOPSIS + Status code for a request that acts on several items: 200 all succeeded, 207 some failed, 500 all failed. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory)][int]$Total, + [Parameter(Mandatory)][int]$Failed + ) + if ($Failed -le 0) { return [System.Net.HttpStatusCode]::OK } + if ($Failed -ge $Total) { return [System.Net.HttpStatusCode]::InternalServerError } + [System.Net.HttpStatusCode]::MultiStatus +} diff --git a/backend/Modules/CIPPCore/Public/Get-CippDbRoleMembers.ps1 b/backend/Modules/CIPPCore/Public/Get-CippDbRoleMembers.ps1 index 78b144efa8..ce1cf710a5 100644 --- a/backend/Modules/CIPPCore/Public/Get-CippDbRoleMembers.ps1 +++ b/backend/Modules/CIPPCore/Public/Get-CippDbRoleMembers.ps1 @@ -51,9 +51,9 @@ function Get-CippDbRoleMembers { [string]$RoleTemplateId ) - $RoleAssignments = Get-CIPPTestData -TenantFilter $TenantFilter -Type 'RoleAssignmentScheduleInstances' - $RoleEligibilities = Get-CIPPTestData -TenantFilter $TenantFilter -Type 'RoleEligibilitySchedules' - $DirectRoleAssignments = Get-CIPPTestData -TenantFilter $TenantFilter -Type 'Roles' | Where-Object { $_.roleTemplateId -eq $RoleTemplateId } | Select-Object -ExpandProperty members + $RoleAssignments = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'RoleAssignmentScheduleInstances' + $RoleEligibilities = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'RoleEligibilitySchedules' + $DirectRoleAssignments = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'Roles' | Where-Object { $_.roleTemplateId -eq $RoleTemplateId } | Select-Object -ExpandProperty members $ActiveMembers = $RoleAssignments | Where-Object { $_.roleDefinitionId -eq $RoleTemplateId -and $_.assignmentType -eq 'Assigned' diff --git a/backend/Modules/CIPPCore/Public/Get-CippErrorStatusCode.ps1 b/backend/Modules/CIPPCore/Public/Get-CippErrorStatusCode.ps1 new file mode 100644 index 0000000000..a825b55d9a --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Get-CippErrorStatusCode.ps1 @@ -0,0 +1,20 @@ +function Get-CippErrorStatusCode { + <# + .SYNOPSIS + Status code for a caught error: ArgumentException 400, ItemNotFoundException 404, anything else 500. + .DESCRIPTION + Helpers throw ArgumentException for invalid input or a refused request and ItemNotFoundException for + a named resource that does not exist, so the calling endpoint can tell those apart from upstream failures. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory)]$ErrorRecord + ) + $Exception = if ($ErrorRecord -is [System.Management.Automation.ErrorRecord]) { $ErrorRecord.Exception } else { $ErrorRecord } + while ($Exception) { + if ($Exception -is [System.ArgumentException]) { return [System.Net.HttpStatusCode]::BadRequest } + if ($Exception -is [System.Management.Automation.ItemNotFoundException]) { return [System.Net.HttpStatusCode]::NotFound } + $Exception = $Exception.InnerException + } + [System.Net.HttpStatusCode]::InternalServerError +} diff --git a/backend/Modules/CIPPCore/Public/GitHub/Push-CIPPBaselineToRepo.ps1 b/backend/Modules/CIPPCore/Public/GitHub/Push-CIPPBaselineToRepo.ps1 index a935cf4f46..14cddc407c 100644 --- a/backend/Modules/CIPPCore/Public/GitHub/Push-CIPPBaselineToRepo.ps1 +++ b/backend/Modules/CIPPCore/Public/GitHub/Push-CIPPBaselineToRepo.ps1 @@ -10,7 +10,7 @@ function Push-CIPPBaselineToRepo { file is stamped with its returned blob SHA and the repo FullName: related templates on their templates row, the baseline itself on its rollout row. .OUTPUTS - @{ resultText = ; state = 'success' | 'error' } + @{ resultText = ; state = 'success' | 'error' }. Throws ItemNotFoundException when the baseline does not exist. .FUNCTIONALITY Internal #> @@ -30,10 +30,7 @@ function Push-CIPPBaselineToRepo { $Export = Export-CIPPBaselineTemplate -GUID $GUID if (-not $Export) { - return @{ - resultText = "Baseline '$($GUID)' not found" - state = 'error' - } + throw [System.Management.Automation.ItemNotFoundException]::new("Baseline '$($GUID)' not found") } $TemplateTable = Get-CIPPTable -TableName templates diff --git a/backend/Modules/CIPPCore/Public/GitHub/Push-CIPPTemplateToRepo.ps1 b/backend/Modules/CIPPCore/Public/GitHub/Push-CIPPTemplateToRepo.ps1 index 58c88d9940..b830f62226 100644 --- a/backend/Modules/CIPPCore/Public/GitHub/Push-CIPPTemplateToRepo.ps1 +++ b/backend/Modules/CIPPCore/Public/GitHub/Push-CIPPTemplateToRepo.ps1 @@ -8,7 +8,7 @@ function Push-CIPPTemplateToRepo { templates row with the returned blob SHA and the repo FullName so the scheduled sync recognises this as the current copy instead of re-importing it as new. .OUTPUTS - @{ resultText = ; state = 'success' | 'error' } + @{ resultText = ; state = 'success' | 'error' }. Throws ItemNotFoundException when the template does not exist. .FUNCTIONALITY Internal #> @@ -23,10 +23,7 @@ function Push-CIPPTemplateToRepo { $TemplateTable = Get-CIPPTable -TableName templates $TemplateEntity = Get-CIPPAzDataTableEntity @TemplateTable -Filter "RowKey eq '$($GUID)' or OriginalEntityId eq '$($GUID)'" | Select-Object -ExcludeProperty ETag, Timestamp if (-not $TemplateEntity) { - return @{ - resultText = "Template '$($GUID)' not found" - state = 'error' - } + throw [System.Management.Automation.ItemNotFoundException]::new("Template '$($GUID)' not found") } if (-not $Branch) { diff --git a/backend/Modules/CIPPCore/Public/GraphHelper/Get-CIPPDriveTempFile.ps1 b/backend/Modules/CIPPCore/Public/GraphHelper/Get-CIPPDriveTempFile.ps1 new file mode 100644 index 0000000000..84b0309977 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/GraphHelper/Get-CIPPDriveTempFile.ps1 @@ -0,0 +1,79 @@ +function Get-CIPPDriveTempFile { + <# + .FUNCTIONALITY + Internal + .SYNOPSIS + Enumerates a SharePoint/OneDrive drive for temp/junk files using Graph delta. + .DESCRIPTION + Uses the drive `root/delta` endpoint to enumerate every item in the drive as a flat, + paginated stream instead of walking the folder tree one folder at a time. This turns a + latency-bound recursion (one request per folder, serially) into a small number of large + pages, so very large drives can be scanned within the queue worker's execution window. + + New-GraphGetRequest follows `@odata.nextLink` automatically and stops at the trailing + `@odata.deltaLink`, so a single call returns the whole drive. Folders, deleted items, and + items that match no enabled filter are ignored. + .PARAMETER TenantFilter + Tenant default domain / id. + .PARAMETER DriveId + The target drive id (document library or OneDrive). + .PARAMETER Filters + Object describing which temp/junk categories to match (see Test-CIPPTempFileMatch). + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$TenantFilter, + + [Parameter(Mandatory = $true)] + [string]$DriveId, + + [Parameter(Mandatory = $false)] + $Filters + ) + + if (-not $Filters) { + $Filters = [PSCustomObject]@{ + officeTemp = $true + tempFiles = $true + zeroByteFiles = $true + systemJunk = $true + backupFiles = $false + } + } + + $HasFilters = $Filters.officeTemp -or $Filters.tempFiles -or $Filters.zeroByteFiles -or $Filters.systemJunk -or $Filters.backupFiles + if (-not $HasFilters) { + return @() + } + + $Results = [System.Collections.Generic.List[object]]::new() + $Select = 'id,name,size,folder,file,parentReference,webUrl,lastModifiedDateTime,deleted' + $Uri = "https://graph.microsoft.com/v1.0/drives/$DriveId/root/delta?`$select=$Select&`$top=2000" + + $Items = New-GraphGetRequest -uri $Uri -tenantid $TenantFilter -AsApp $true -NoAuthCheck $true + foreach ($Item in @($Items)) { + if (-not $Item.id -or $Item.deleted -or -not $Item.file) { continue } + + $MatchTypes = Test-CIPPTempFileMatch -Item $Item -Filters $Filters + if ($MatchTypes.Count -eq 0) { continue } + + $ParentPath = if ($Item.parentReference.path) { + $Item.parentReference.path -replace '^/drives/[^/]+/root:', '' -replace '^/drive/root:', '' + } else { '' } + + $Results.Add(@{ + id = $Item.id + driveId = $DriveId + name = $Item.name + path = if ($ParentPath) { "$ParentPath/$($Item.name)" } else { "/$($Item.name)" } + size = $Item.size + type = $MatchTypes[0] + matchTypes = @($MatchTypes) + lastModifiedDateTime = $Item.lastModifiedDateTime + webUrl = $Item.webUrl + }) + } + + return @($Results) +} diff --git a/backend/Modules/CIPPCore/Public/GraphHelper/Get-CIPPTempFileScan.ps1 b/backend/Modules/CIPPCore/Public/GraphHelper/Get-CIPPTempFileScan.ps1 new file mode 100644 index 0000000000..4998c09349 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/GraphHelper/Get-CIPPTempFileScan.ps1 @@ -0,0 +1,100 @@ +function Get-CIPPTempFileScan { + <# + .FUNCTIONALITY + Internal + .SYNOPSIS + Scans SharePoint/OneDrive drives for temporary and junk files + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$TenantFilter, + + [Parameter(Mandatory = $true)] + [ValidateSet('site', 'user', 'allSites', 'allOneDrives')] + [string]$Scope, + + [string]$SiteId, + [string]$UserId, + $Filters + ) + + if (-not $Filters) { + $Filters = [PSCustomObject]@{ + officeTemp = $true + tempFiles = $true + zeroByteFiles = $true + systemJunk = $true + backupFiles = $false + } + } + + $Results = [System.Collections.Generic.List[object]]::new() + + $DrivesToScan = switch ($Scope) { + 'site' { + $SiteInfo = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/sites/$SiteId" -tenantid $TenantFilter -AsApp $true + $DriveInfo = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/sites/$SiteId/drive" -tenantid $TenantFilter -AsApp $true + $SiteName = $SiteInfo.displayName ?? $SiteInfo.name + @(@{ DriveId = $DriveInfo.id; SiteName = $SiteName; SiteUrl = $SiteInfo.webUrl }) + } + 'user' { + $EncodedUserId = if ($UserId -match '@') { $UserId -replace '#', '%23' } else { $UserId } + $DriveInfo = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$EncodedUserId/drive" -tenantid $TenantFilter -AsApp $true + $UserInfo = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$EncodedUserId" -tenantid $TenantFilter -AsApp $true + @(@{ DriveId = $DriveInfo.id; SiteName = "OneDrive - $($UserInfo.displayName)"; SiteUrl = $DriveInfo.webUrl }) + } + 'allSites' { + $Sites = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/sites/getAllSites?`$filter=isPersonalSite eq false&`$select=id,displayName,name,webUrl&`$top=999" -tenantid $TenantFilter -AsApp $true + $Sites | ForEach-Object { + try { + $DriveInfo = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/sites/$($_.id)/drive" -tenantid $TenantFilter -AsApp $true -NoAuthCheck $true + $SiteName = $_.displayName ?? $_.name + @{ DriveId = $DriveInfo.id; SiteName = $SiteName; SiteUrl = $_.webUrl } + } catch { $null } + } | Where-Object { $_ } + } + 'allOneDrives' { + $Users = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users?`$filter=assignedLicenses/`$count ne 0&`$count=true" -tenantid $TenantFilter -AsApp $true -ComplexFilter + $Users | ForEach-Object { + try { + $Drive = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$($_.id)/drive" -tenantid $TenantFilter -AsApp $true -NoAuthCheck $true + @{ DriveId = $Drive.id; SiteName = "OneDrive - $($_.displayName)"; SiteUrl = $Drive.webUrl } + } catch { $null } + } | Where-Object { $_ } + } + } + + foreach ($Drive in $DrivesToScan) { + # Prefer delta enumeration (flat, paginated) so very large drives finish within the + # worker timeout. Fall back to recursive folder walking if delta is unavailable/fails, + # and never let a single bad drive abort the whole scan. + $DriveFiles = $null + try { + $DriveFiles = Get-CIPPDriveTempFile -TenantFilter $TenantFilter -DriveId $Drive.DriveId -Filters $Filters + } catch { + Write-Warning "Get-CIPPTempFileScan: delta scan failed for drive $($Drive.DriveId), falling back to recursive scan - $($_.Exception.Message)" + try { + $DriveFiles = Get-TempFilesRecursive -TenantFilter $TenantFilter -DriveId $Drive.DriveId -Filters $Filters + } catch { + Write-Warning "Get-CIPPTempFileScan: recursive scan also failed for drive $($Drive.DriveId) - $($_.Exception.Message)" + continue + } + } + foreach ($File in $DriveFiles) { + $File.SiteName = $Drive.SiteName + $File.SiteUrl = $Drive.SiteUrl + } + if ($DriveFiles) { + $Results.AddRange([object[]]@($DriveFiles)) + } + } + + $TotalSize = ($Results | Where-Object { $_.size }) | Measure-Object -Property size -Sum | Select-Object -ExpandProperty Sum + + [PSCustomObject]@{ + Results = @($Results) + TotalCount = $Results.Count + TotalSize = $TotalSize ?? 0 + } +} diff --git a/backend/Modules/CIPPCore/Public/GraphHelper/Get-CippServicePrincipalsByAppId.ps1 b/backend/Modules/CIPPCore/Public/GraphHelper/Get-CippServicePrincipalsByAppId.ps1 new file mode 100644 index 0000000000..261415c8f7 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/GraphHelper/Get-CippServicePrincipalsByAppId.ps1 @@ -0,0 +1,41 @@ +function Get-CippServicePrincipalsByAppId { + <# + .SYNOPSIS + Retrieves service principals for a specific set of appIds using a server-side filter. + + .DESCRIPTION + Fetches only the requested service principals via $filter=appId in (...) instead of enumerating + every service principal in the tenant, which can take 30+ seconds and multiple pages in tenants + with thousands of enterprise applications. Graph's 'in' operator accepts at most 15 values per + filter clause, so the appIds are requested in chunks of 15. + + .PARAMETER AppIds + The application (client) IDs of the service principals to retrieve. + + .PARAMETER TenantFilter + The tenant to query. + + .PARAMETER SkipTokenCache + Skip the Graph token cache (used by permission-push flows that may run right after consent). + + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param( + [Parameter(Mandatory)] + [AllowEmptyCollection()] + [string[]]$AppIds, + [Parameter(Mandatory)] + [string]$TenantFilter, + [switch]$SkipTokenCache + ) + + $AppIds = @($AppIds | Where-Object { $_ } | Sort-Object -Unique) + $ServicePrincipals = for ($i = 0; $i -lt $AppIds.Count; $i += 15) { + $Chunk = $AppIds[$i..([Math]::Min($i + 14, $AppIds.Count - 1))] + $AppIdFilter = $Chunk -join "','" + New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/servicePrincipals?`$filter=appId in ('$AppIdFilter')&`$select=id,appId,displayName&`$top=999" -tenantid $TenantFilter -NoAuthCheck $true -skipTokenCache $SkipTokenCache.IsPresent + } + return @($ServicePrincipals) +} diff --git a/backend/Modules/CIPPCore/Public/GraphHelper/Get-NormalizedError.ps1 b/backend/Modules/CIPPCore/Public/GraphHelper/Get-NormalizedError.ps1 index fe2b344ef7..0e1fe0beb9 100644 --- a/backend/Modules/CIPPCore/Public/GraphHelper/Get-NormalizedError.ps1 +++ b/backend/Modules/CIPPCore/Public/GraphHelper/Get-NormalizedError.ps1 @@ -20,16 +20,35 @@ function Get-NormalizedError { # $message.error.details.message # $message.error.innererror.internalException.message + # Strip Exchange Online cmdlet exception type prefix (e.g. + # `|Microsoft.Exchange.Management.Tasks.ValidationException|...`) so the + # user-facing message starts with the actual error sentence. + if ($message -match '^\|Microsoft\.Exchange[^|]*\|') { + $message = ($message -replace '^\|Microsoft\.Exchange[^|]*\|', '').Trim() + } elseif ($message -match '^\|[A-Za-z0-9\.]+Exception\|') { + $message = ($message -replace '^\|[A-Za-z0-9\.]+Exception\|', '').Trim() + } + #We need to check if the message is in one of these fields, and if so, return it. if ($JSONMsg.error.innererror.message) { Write-Information "innererror.message found: $($JSONMsg.error.innererror.message)" $message = $JSONMsg.error.innererror.message } elseif ($JSONMsg.error.message) { - Write-Information "error.message found: $($JSONMsg.error.message)" - $message = $JSONMsg.error.message + # SharePoint REST (OData verbose) returns message as { lang, value } object + if ($JSONMsg.error.message.value) { + $message = [string]$JSONMsg.error.message.value + } else { + $message = [string]$JSONMsg.error.message + } + Write-Information "error.message found: $message" + if ($JSONMsg.error.details.message) { + $detailMessages = @($JSONMsg.error.details.message) -join '; ' + Write-Information "error.details.message found: $detailMessages" + $message = "$message $detailMessages" + } } elseif ($JSONMsg.error.details.message) { Write-Information "error.details.message found: $($JSONMsg.error.details.message)" - $message = $JSONMsg.error.details.message + $message = @($JSONMsg.error.details.message) -join '; ' } elseif ($JSONMsg.error.innererror.internalException.message) { Write-Information "error.innererror.internalException.message found: $($JSONMsg.error.innererror.internalException.message)" $message = $JSONMsg.error.innererror.internalException.message @@ -44,9 +63,9 @@ function Get-NormalizedError { '*Microsoft.Skype.Sync.Pstn.Tnm.Common.Http.HttpResponseException*' { 'Could not connect to Teams Admin center - Tenant might be missing a Teams license' } '*Provide valid credential.*' { 'Error 400: There is an issue with your Exchange Token configuration. Please perform an access check for this tenant' } '*This indicate that a subscription within the tenant has lapsed*' { 'There is no subscription for this service available, Check licensing information.' } - '*User was not found.*' { 'The relationship between this tenant and the partner has been dissolved from the tenant side.' } - '*AADSTS50020*' { 'AADSTS50020: The user you have used for your Secure Application Model is a guest in this tenant, or your are using GDAP and have not added the user to the correct group. Please delete the guest user to gain access to this tenant' } - '*AADSTS50177' { 'AADSTS50177: The user you have used for your Secure Application Model is a guest in this tenant, or your are using GDAP and have not added the user to the correct group. Please delete the guest user to gain access to this tenant' } + '*User was not found.*' { 'The partner relationship with this tenant has been removed. The customer may have terminated the relationship from their admin center, or the tenant no longer exists.' } + '*AADSTS50020*' { 'The SAM user is a guest in this tenant, or you are using GDAP without proper group membership. Solution: Either delete the guest user from the tenant, or ensure the user is added to the correct GDAP security group with appropriate role assignments.' } + '*AADSTS50177*' { 'The SAM user is a guest in this tenant, or you are using GDAP without proper group membership. Solution: Either delete the guest user from the tenant, or ensure the user is added to the correct GDAP security group with appropriate role assignments.' } '*invalid or malformed*' { 'The request is malformed. Have you finished the Setup Wizard' } '*Windows Store repository apps feature is not supported for this tenant*' { 'This tenant does not have WinGet support available' } '*AADSTS650051*' { @@ -60,19 +79,49 @@ function Get-NormalizedError { '*One or more added object references already exist for the following modified properties:*' { 'This user is already a member of this group.' } '*Microsoft.Exchange.Management.Tasks.MemberAlreadyExistsException*' { 'This user is already a member of this group.' } '*The property value exceeds the maximum allowed size (64KB)*' { 'One of the values exceeds the maximum allowed size (64KB).' } - '*Unable to initialize the authorization context*' { 'Your GDAP configuration does not allow us to write to this tenant, please check your group mappings and tenant onboarding.' } + '*Unable to initialize the authorization context*' { 'GDAP authorization failed. Your GDAP security groups may not have the required role assignments for this tenant. Check: 1) GDAP relationship is active, 2) User is in the correct security group, 3) Security group has the required admin roles assigned.' } '*Providers.Common.V1.CoreException*' { '403 (Access Denied) - We cannot connect to this tenant.' } '*Authentication failed. MFA required*' { 'Authentication failed. MFA required' } '*Your tenant is not licensed for this feature.*' { 'Required license not available for this tenant' } - '*AADSTS65001*' { 'We cannot access this tenant as consent has not been given, please try refreshing the CPV permissions in the application settings menu.' } - '*AADSTS700082*' { 'The CIPP user access token has expired. Run the Setup Wizard to refresh your tokens.' } - '*Account is not provisioned.' { 'The account is not provisioned. You do not the correct M365 license to access this information..' } + '*AADSTS65001*' { 'AADSTS65001: Required API consent has not been granted for this tenant. The application is missing delegated permission consent for one or more APIs. Try re-running CPV Refresh for this tenant. If already refreshed, check the CPV results for failures and verify the required API service principals exist in the client tenant.' } + '*AADSTS700082*' { 'The refresh token has expired (tokens expire after 90 days of inactivity). Run the Setup Wizard to re-authenticate and generate new tokens.' } + '*Account is not provisioned.*' { 'The account is not provisioned. This user does not have the required Microsoft 365 license to access this service (e.g., Exchange Online, Teams, etc.).' } '*AADSTS5000224*' { 'This resource is not available - Has this tenant been deleted?' } - '*AADSTS53003*' { 'Access has been blocked by Conditional Access policies. Please check the Conditional Access configuration documentation' } + '*AADSTS53003*' { 'Access blocked by Conditional Access policies in this tenant. The tenant may have CA policies that block partner access. Contact the tenant administrator to create an exclusion, or check if the SAM user meets the CA policy requirements (MFA, device compliance, etc.).' } '*AADSTS900023*' { 'This tenant is not available for this operation. Please check the selected tenant and try again.' } '*AADSTS9002313*' { 'The credentials used to connect to the Graph API are not available, please retry. If this issue persists you may need to execute the SAM wizard.' } '*One or more platform(s) is/are not configured for the customer. Please configure the platform before trying to purchase a SKU.*' { 'One or more platform(s) is/are not configured for the customer. Please configure the platform before trying to purchase a SKU.' } "One or more added object references already exist for the following modified properties: 'members'." { 'This user is already a member of the selected group.' } + # Exchange Online common errors -- translated to plain English + '*is not valid. Please input a valid message identity*' { 'The quarantine entry could not be found - it may have already been released, denied, expired, or purged. Refresh the list and try again.' } + '*ManagementObjectNotFoundException*' { "The requested object could not be found in this tenant. It may have been deleted, renamed, or never existed. Verify the identity and try again." } + "*Couldn't find object*" { "The requested object could not be found in this tenant. Verify the identity (UPN, alias, or GUID) is correct and the user/mailbox still exists." } + '*The operation couldn''t be performed because object*' { "Exchange could not find the target object. Verify the identity is correct and that the mailbox/user still exists. If you just created it, wait 10-15 minutes for replication." } + '*MailboxNotEnabledForArchive*' { 'This mailbox does not have the archive enabled. Enable the archive first, then retry.' } + '*The user already has an archive*' { 'This mailbox already has an archive enabled.' } + '*UserAlreadyExistsException*' { 'A user with this UPN or alias already exists in the tenant.' } + '*The proxy address*is already being used*' { 'This email address (proxy address) is already assigned to another recipient in the tenant. Choose a different address.' } + '*The address*is already being used*' { 'This email address is already assigned to another recipient in the tenant.' } + '*recipient*not found*' { 'The recipient could not be found in this tenant. Verify the address or alias is correct.' } + '*RecipientTaskException*' { 'Exchange rejected the recipient operation. Verify the user/mailbox exists and you have permission to modify it.' } + '*MemberAlreadyExistsException*' { 'This user is already a member of that group/permission.' } + '*MemberNotFoundException*' { 'This user is not currently assigned that permission, so it could not be removed.' } + '*ACEAlreadyExistsException*' { 'That permission already exists. No change was made.' } + '*ACENotFoundException*' { 'That permission was not found, so it could not be removed.' } + '*The mailbox*already has*' { 'The requested setting already matches the current value. No change was made.' } + '*has expired*' { 'The item has expired and can no longer be processed.' } + '*release request*already*' { 'A release request for this message has already been submitted and is awaiting administrator review.' } + '*Get-HostedContentFilterPolicy*' { 'Microsoft''s spam filter service is temporarily unavailable. Wait a few minutes and try again.' } + '*Set-CASMailbox*not recognized*' { 'The CAS mailbox cmdlet is unavailable for this tenant. Confirm Exchange Online is licensed and enabled.' } + '*Set-Mailbox*not recognized*' { 'The Set-Mailbox cmdlet is unavailable for this tenant. Confirm Exchange Online is licensed and enabled.' } + '*Cmdlet*is not recognized*' { 'The required Exchange Online cmdlet is unavailable for this tenant. The tenant may be missing an Exchange Online license, or the SAM user may lack the required role.' } + '*The term*is not recognized*' { 'The required cmdlet is unavailable. The tenant may be missing the appropriate license, or the SAM user may lack the required role.' } + '*ManagedFolderAssistant*' { 'The Managed Folder Assistant could not be triggered. The mailbox may be migrating, or the tenant may be unlicensed for retention features.' } + '*Could not set OOO*' { 'Could not update the Out of Office settings. Check that the mailbox exists and you have the Exchange Recipient Administrator role.' } + '*MailboxNotMigrated*' { 'This mailbox has not been migrated to Exchange Online and cannot be modified through this interface.' } + '*tenant*does not have*Exchange*' { 'This tenant does not have an Exchange Online license. Assign an Exchange license to the tenant before retrying.' } + '*remote server returned an error: (404) Not Found*' { 'The Exchange Online endpoint returned 404 Not Found. The object may have been deleted, or the tenant may be unlicensed.' } + '*remote server returned an error: (403) Forbidden*' { 'Exchange Online returned 403 Forbidden. The SAM user does not have permission for this operation in this tenant.' } '*is not present in the role definition of the current user*' { 'We do not have permissions to access this resource, try performing a CPV refresh in Application Settings -> Permissions or Try with AsApp: true' } default { $message } diff --git a/backend/Modules/CIPPCore/Public/GraphHelper/Get-TempFilesRecursive.ps1 b/backend/Modules/CIPPCore/Public/GraphHelper/Get-TempFilesRecursive.ps1 new file mode 100644 index 0000000000..7f15ff9d47 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/GraphHelper/Get-TempFilesRecursive.ps1 @@ -0,0 +1,92 @@ +function Get-TempFilesRecursive { + <# + .FUNCTIONALITY + Internal + .SYNOPSIS + Recursively scans a SharePoint/OneDrive drive for temporary and junk files + .DESCRIPTION + Traverses a drive's folder structure and identifies files matching various + temp file patterns (Office temp files, .TMP files, zero-byte files, system junk, etc.) + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$TenantFilter, + + [Parameter(Mandatory = $true)] + [string]$DriveId, + + [Parameter(Mandatory = $false)] + $Filters, + + [Parameter(Mandatory = $false)] + [string]$FolderId = 'root', + + [Parameter(Mandatory = $false)] + [int]$MaxDepth = 10, + + [Parameter(Mandatory = $false)] + [int]$CurrentDepth = 0 + ) + + if ($CurrentDepth -ge $MaxDepth) { + return @() + } + + if (-not $Filters) { + $Filters = [PSCustomObject]@{ + officeTemp = $true + tempFiles = $true + zeroByteFiles = $true + systemJunk = $true + backupFiles = $false + } + } + + $HasFilters = $Filters.officeTemp -or $Filters.tempFiles -or $Filters.zeroByteFiles -or $Filters.systemJunk -or $Filters.backupFiles + if (-not $HasFilters) { + return @() + } + + $Results = [System.Collections.Generic.List[object]]::new() + $Uri = "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$FolderId/children?`$top=200&`$select=id,name,size,folder,file,parentReference,webUrl,lastModifiedDateTime" + + try { + $Response = New-GraphGetRequest -uri $Uri -tenantid $TenantFilter -AsApp $true -NoAuthCheck $true + $Items = @($Response) | ForEach-Object { $_ } | Where-Object { $_.id } + + foreach ($Item in $Items) { + if ($Item.folder) { + $SubResults = Get-TempFilesRecursive -TenantFilter $TenantFilter -DriveId $DriveId -Filters $Filters -FolderId $Item.id -MaxDepth $MaxDepth -CurrentDepth ($CurrentDepth + 1) + if ($SubResults) { + $Results.AddRange([object[]]@($SubResults)) + } + } elseif ($Item.file) { + $MatchTypes = @(Test-CIPPTempFileMatch -Item $Item -Filters $Filters) + + if ($MatchTypes.Count -gt 0) { + $ParentPath = if ($Item.parentReference.path) { + # Graph returns either /drive/root: or /drives/{driveId}/root: depending on the endpoint. + $Item.parentReference.path -replace '^/drive/root:', '' -replace '^/drives/[^/]+/root:', '' + } else { '' } + + $Results.Add(@{ + id = $Item.id + driveId = $DriveId + name = $Item.name + path = if ($ParentPath) { "$ParentPath/$($Item.name)" } else { "/$($Item.name)" } + size = $Item.size + type = $MatchTypes[0] + matchTypes = @($MatchTypes) + lastModifiedDateTime = $Item.lastModifiedDateTime + webUrl = $Item.webUrl + }) + } + } + } + } catch { + Write-Warning "Get-TempFilesRecursive: Failed to list folder $FolderId in drive $DriveId - $_" + } + + return @($Results) +} diff --git a/backend/Modules/CIPPCore/Public/GraphHelper/New-CIPPMFAConnectorToken.ps1 b/backend/Modules/CIPPCore/Public/GraphHelper/New-CIPPMFAConnectorToken.ps1 index 8442e57f70..7e46b2339f 100644 --- a/backend/Modules/CIPPCore/Public/GraphHelper/New-CIPPMFAConnectorToken.ps1 +++ b/backend/Modules/CIPPCore/Public/GraphHelper/New-CIPPMFAConnectorToken.ps1 @@ -76,7 +76,16 @@ function New-CIPPMFAConnectorToken { try { return (Invoke-RestMethod -Method Post -Uri $TokenUri -Body $ClientBody -ErrorAction Stop).access_token } catch { - if ($Attempt -ge $MaxAttempts) { throw } + $TokenError = $_ + $EntraError = try { ($TokenError.ErrorDetails.Message | ConvertFrom-Json -ErrorAction Stop).error_description -replace '\s*Trace ID:[\s\S]*$' } catch { $null } + $EnableHint = "Enable it with the 'Azure MFA push notification apps' baseline standard, or in Entra under Enterprise applications." + switch -Regex ($EntraError) { + '^AADSTS7000112\b' { throw [System.UnauthorizedAccessException]"The Azure Multi-Factor Auth Client app ($MFAAppID) is disabled in this tenant. $EnableHint" } + '^AADSTS500014\b' { throw [System.UnauthorizedAccessException]"The Azure Multi-Factor Auth Connector app (1f5530b3-261a-47a9-b357-ded261e17918) is disabled in this tenant. $EnableHint" } + } + if ($Attempt -ge $MaxAttempts) { + throw "Failed to get a token for the Azure Multi-Factor Auth Client app: $($EntraError ?? $TokenError.Exception.Message)" + } Start-Sleep 1 } } @@ -88,6 +97,8 @@ function New-CIPPMFAConnectorToken { if ($CachedSecret) { try { return [pscustomobject]@{ AccessToken = (Get-ConnectorToken -Secret $CachedSecret) } + } catch [System.UnauthorizedAccessException] { + throw } catch { # Cached secret is expired or revoked - fall through and reprovision. Write-Information "Cached MFA connector secret for $TenantId failed token exchange; reprovisioning." diff --git a/backend/Modules/CIPPCore/Public/GraphHelper/New-DynamicsRequest.ps1 b/backend/Modules/CIPPCore/Public/GraphHelper/New-DynamicsRequest.ps1 new file mode 100644 index 0000000000..46322711ea --- /dev/null +++ b/backend/Modules/CIPPCore/Public/GraphHelper/New-DynamicsRequest.ps1 @@ -0,0 +1,148 @@ +function New-DynamicsRequest { + <# + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$DynamicsUrl, + + [Parameter(Mandatory = $true)] + [string]$Entity, + + [string]$TenantFilter, + + [string]$Select, + + [string]$Filter, + + [string]$Expand, + + [int]$Top, + + [string]$OrderBy, + + [bool]$NoAuthCheck, + + [switch]$AsApp, + + [string]$ApiVersion = 'v9.2', + + [bool]$noPagination + ) + + if ($NoAuthCheck -eq $false -and -not (Get-AuthorisedRequest -TenantID $TenantFilter)) { + Write-Error 'Not allowed. You cannot manage your own tenant or tenants not under your scope' + return + } + + # Build the scope from the Dynamics URL (e.g., https://contoso.crm.dynamics.com -> https://contoso.crm.dynamics.com/.default) + $DynamicsUrlTrimmed = $DynamicsUrl.TrimEnd('/') + $Scope = "$DynamicsUrlTrimmed/.default" + + $Token = Get-GraphToken -Tenantid $TenantFilter -scope $Scope -AsApp $AsApp.IsPresent + + $Headers = @{ + Authorization = $Token.Authorization + 'OData-MaxVersion' = '4.0' + 'OData-Version' = '4.0' + Accept = 'application/json' + Prefer = 'odata.include-annotations="*",odata.maxpagesize=500' + 'User-Agent' = "CIPP/$($global:CippVersion ?? '1.0')" + } + + # Build the OData query URL + $QueryParts = @() + if ($Select) { $QueryParts += "`$select=$Select" } + if ($Filter) { $QueryParts += "`$filter=$Filter" } + if ($Expand) { $QueryParts += "`$expand=$Expand" } + if ($Top -gt 0) { $QueryParts += "`$top=$Top" } + if ($OrderBy) { $QueryParts += "`$orderby=$OrderBy" } + + $QueryString = if ($QueryParts.Count -gt 0) { '?' + ($QueryParts -join '&') } else { '' } + $BaseUrl = "$DynamicsUrlTrimmed/api/data/$ApiVersion" + $NextURL = "$BaseUrl/$Entity$QueryString" + + try { + $ReturnedData = do { + $RetryCount = 0 + $MaxRetries = 3 + $RequestSuccessful = $false + Write-Information "Dynamics GET [ $NextURL ] | tenant: $TenantFilter" + + do { + try { + $RequestParams = @{ + Uri = $NextURL + Method = 'GET' + Headers = $Headers + ContentType = 'application/json; charset=utf-8' + } + + $Data = Invoke-RestMethod @RequestParams + $RequestSuccessful = $true + + # Return the value array if present, otherwise the data itself + if ($Data.PSObject.Properties.Name -contains 'value') { + $Data.value + } else { + $Data + } + + if ($noPagination) { + $NextURL = $null + } else { + $NextURL = $Data.'@odata.nextLink' + } + } catch { + $ShouldRetry = $false + $WaitTime = 0 + $Message = $null + + try { + $ErrorObj = $_.ErrorDetails.Message | ConvertFrom-Json -ErrorAction SilentlyContinue + if ($ErrorObj.error) { + $Message = $ErrorObj.error.message + } + } catch { + $Message = $null + } + + if ([string]::IsNullOrEmpty($Message)) { + $Message = $_.Exception.Message + } + + # Check for 429 Too Many Requests + if ($_.Exception.Response.StatusCode -eq 429) { + $RetryAfterHeader = $_.Exception.Response.Headers['Retry-After'] + if ($RetryAfterHeader) { + $WaitTime = [int]$RetryAfterHeader + } else { + $WaitTime = 5 + } + Write-Warning "Dynamics API rate limited (429). Waiting $WaitTime seconds. Attempt $($RetryCount + 1) of $MaxRetries" + $ShouldRetry = $true + } + # Check for transient errors + elseif ($_.Exception.Response.StatusCode -in @(502, 503, 504) -or $Message -like '*temporarily unavailable*') { + $WaitTime = Get-Random -Minimum 1.1 -Maximum 3.1 + Write-Warning "Dynamics API transient error. Waiting $WaitTime seconds. Attempt $($RetryCount + 1) of $MaxRetries" + $ShouldRetry = $true + } + + if ($ShouldRetry -and $RetryCount -lt $MaxRetries) { + $RetryCount++ + Start-Sleep -Seconds $WaitTime + } else { + throw $Message + } + } + } while (-not $RequestSuccessful -and $RetryCount -le $MaxRetries) + } until ([string]::IsNullOrEmpty($NextURL)) + + return $ReturnedData + } catch { + throw "Dynamics API request failed for $Entity : $($_.Exception.Message)" + } +} diff --git a/backend/Modules/CIPPCore/Public/GraphHelper/New-ExoBulkRequest.ps1 b/backend/Modules/CIPPCore/Public/GraphHelper/New-ExoBulkRequest.ps1 index a1ef378045..e76aeac350 100644 --- a/backend/Modules/CIPPCore/Public/GraphHelper/New-ExoBulkRequest.ps1 +++ b/backend/Modules/CIPPCore/Public/GraphHelper/New-ExoBulkRequest.ps1 @@ -15,7 +15,10 @@ function New-ExoBulkRequest { [int]$MaxConcurrency = 1, [int]$TimeoutSec = 100, [switch]$Compliance, - [switch]$AsApp + [switch]$AsApp, + # Routes each cmdlet to its Identity (a UPN): mailbox-store writes such as audit settings fail when proxied. + # NOTE: this forces the batch size to 1 (one POST per cmdlet), so tune the fan-out with -MaxConcurrency. + [switch]$AnchorPerMailbox ) if ((Get-AuthorisedRequest -TenantID $tenantid) -or $NoAuthCheck -eq $True) { @@ -49,9 +52,10 @@ function New-ExoBulkRequest { $IdToBatchRequest = @{} # Original sub-requests, reused for nextLink continuations # Split the cmdletArray into batches of 10 + $BatchSize = if ($AnchorPerMailbox) { 1 } else { 10 } $batches = [System.Collections.Generic.List[object]]::new() - for ($i = 0; $i -lt $cmdletArray.Length; $i += 10) { - $batches.Add($cmdletArray[$i..[math]::Min($i + 9, $cmdletArray.Length - 1)]) + for ($i = 0; $i -lt $cmdletArray.Length; $i += $BatchSize) { + $batches.Add($cmdletArray[$i..[math]::Min($i + $BatchSize - 1, $cmdletArray.Length - 1)]) } $ReturnedData = [System.Collections.Generic.List[object]]::new() @@ -69,7 +73,7 @@ function New-ExoBulkRequest { $OnMicrosoft = $Tenant.initialDomainName $Anchor = "UPN:SystemMailbox{8cc370d3-822a-4ab8-a926-bb94bd0641a9}@$($OnMicrosoft)" } - $Headers['X-AnchorMailbox'] = "APP:SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}@$($tenant.customerId)" + $Headers['X-AnchorMailbox'] = if ($AnchorPerMailbox) { "UPN:$($Anchor -replace '^UPN:')" } else { "APP:SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}@$($tenant.customerId)" } $Headers['X-CmdletName'] = $cmd.CmdletInput.CmdletName $Headers['Accept'] = 'application/json; odata.metadata=minimal' $Headers['Accept-Encoding'] = 'gzip' @@ -171,12 +175,12 @@ function New-ExoBulkRequest { $ThrottledRequests = @($Throttled | ForEach-Object { $IdToBatchRequest[$_.id] }) $RetryPayloads = [System.Collections.Generic.List[object]]::new() - for ($i = 0; $i -lt $ThrottledRequests.Count; $i += 10) { - $Slice = $ThrottledRequests[$i..[math]::Min($i + 9, $ThrottledRequests.Count - 1)] + for ($i = 0; $i -lt $ThrottledRequests.Count; $i += $BatchSize) { + $Slice = $ThrottledRequests[$i..[math]::Min($i + $BatchSize - 1, $ThrottledRequests.Count - 1)] $RetryBody = @{ requests = @($Slice) } $RetryJson = [CIPP.CippJson]::ToJson($RetryBody, 10) ?? (ConvertTo-Json -InputObject $RetryBody -Depth 10) $RetryJson = Get-CIPPTextReplacement -TenantFilter $tenantid -Text $RetryJson - $RetryPayloads.Add(@{ Json = $RetryJson; Headers = $Headers.Clone() }) + $RetryPayloads.Add(@{ Json = $RetryJson; Headers = if ($AnchorPerMailbox) { $Slice[0].headers.Clone() } else { $Headers.Clone() } }) } $Replacements = @{} @@ -344,6 +348,6 @@ function New-ExoBulkRequest { return $FinalData } else { - Write-Error (Get-AuthorisedRequestError -TenantID $tenantid -Context 'Exchange bulk request') + Write-Error 'Not allowed. You cannot manage your own tenant or tenants not under your scope' } } diff --git a/backend/Modules/CIPPCore/Public/GraphHelper/New-ExoRequest.ps1 b/backend/Modules/CIPPCore/Public/GraphHelper/New-ExoRequest.ps1 index dfb1a4071d..2ac2203dc1 100644 --- a/backend/Modules/CIPPCore/Public/GraphHelper/New-ExoRequest.ps1 +++ b/backend/Modules/CIPPCore/Public/GraphHelper/New-ExoRequest.ps1 @@ -178,6 +178,6 @@ function New-ExoRequest { return $ReturnedData.value } } else { - Write-Error (Get-AuthorisedRequestError -TenantID $tenantid -Context 'Exchange request') + Write-Error 'Not allowed. You cannot manage your own tenant or tenants not under your scope' } } diff --git a/backend/Modules/CIPPCore/Public/GraphHelper/New-GraphGetRequest.ps1 b/backend/Modules/CIPPCore/Public/GraphHelper/New-GraphGetRequest.ps1 index a9c11118f8..5b61dc17e2 100644 --- a/backend/Modules/CIPPCore/Public/GraphHelper/New-GraphGetRequest.ps1 +++ b/backend/Modules/CIPPCore/Public/GraphHelper/New-GraphGetRequest.ps1 @@ -200,6 +200,6 @@ function New-GraphGetRequest { return $ReturnedData } } else { - Write-Error (Get-AuthorisedRequestError -TenantID $tenantid -Context 'Graph request') + Write-Error 'Not allowed. You cannot manage your own tenant or tenants not under your scope' } } diff --git a/backend/Modules/CIPPCore/Public/GraphHelper/New-GraphPOSTRequest.ps1 b/backend/Modules/CIPPCore/Public/GraphHelper/New-GraphPOSTRequest.ps1 index 0d1f091ad2..1bbb609119 100644 --- a/backend/Modules/CIPPCore/Public/GraphHelper/New-GraphPOSTRequest.ps1 +++ b/backend/Modules/CIPPCore/Public/GraphHelper/New-GraphPOSTRequest.ps1 @@ -160,6 +160,6 @@ function New-GraphPOSTRequest { return $ReturnedData } } else { - Write-Error (Get-AuthorisedRequestError -TenantID $tenantid -Context 'Graph request') + Write-Error 'Not allowed. You cannot manage your own tenant or tenants not under your scope' } } diff --git a/backend/Modules/CIPPCore/Public/GraphHelper/New-TeamsAPIGetRequest.ps1 b/backend/Modules/CIPPCore/Public/GraphHelper/New-TeamsAPIGetRequest.ps1 new file mode 100644 index 0000000000..9d97e7a01a --- /dev/null +++ b/backend/Modules/CIPPCore/Public/GraphHelper/New-TeamsAPIGetRequest.ps1 @@ -0,0 +1,58 @@ +function New-TeamsAPIGetRequest($Uri, $tenantID, $Method = 'GET', $Resource = '48ac35b8-9aa8-4d74-927d-1f4a14a0b239', $ContentType = 'application/json') { + <# + .FUNCTIONALITY + Internal + #> + + if ((Get-AuthorisedRequest -Uri $uri -TenantID $tenantid)) { + $token = Get-GraphToken -TenantID $tenantID -Scope "$Resource/.default" + $NextURL = $Uri + $ReturnedData = do { + $handler = $null + $httpClient = $null + $response = $null + try { + # Create handler and client with compression disabled + $handler = New-Object System.Net.Http.HttpClientHandler + $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::None + $httpClient = New-Object System.Net.Http.HttpClient($handler) + + # Add all required headers + $headers = @{ + 'Authorization' = $token.Authorization + 'x-ms-client-request-id' = [guid]::NewGuid().ToString() + 'x-ms-client-session-id' = [guid]::NewGuid().ToString() + 'x-ms-correlation-id' = [guid]::NewGuid().ToString() + 'X-Requested-With' = 'XMLHttpRequest' + 'x-ms-tnm-applicationid' = '045268c0-445e-4ac1-9157-d58f67b167d9' + 'Accept' = 'application/json' + 'Accept-Encoding' = 'identity' + 'User-Agent' = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36' + } + + foreach ($header in $headers.GetEnumerator()) { + $httpClient.DefaultRequestHeaders.Add($header.Key, $header.Value) + } + + $response = $httpClient.GetAsync($NextURL).Result + $contentString = $response.Content.ReadAsStringAsync().Result + + # Parse JSON and return data + $Data = $contentString | ConvertFrom-Json + + $Data + if ($noPagination) { $nextURL = $null } else { $nextURL = $data.NextLink } + } catch { + throw "Failed to make Teams API Get Request $_" + } finally { + # Proper cleanup in finally block to ensure disposal even on exceptions + if ($response) { $response.Dispose() } + if ($httpClient) { $httpClient.Dispose() } + if ($handler) { $handler.Dispose() } + } + } until ($null -eq $NextURL) + return $ReturnedData + } else { + Write-Error 'Not allowed. You cannot manage your own tenant or tenants not under your scope' + } +} diff --git a/backend/Modules/CIPPCore/Public/GraphHelper/New-TeamsRequest.ps1 b/backend/Modules/CIPPCore/Public/GraphHelper/New-TeamsRequest.ps1 new file mode 100644 index 0000000000..64b85d354f --- /dev/null +++ b/backend/Modules/CIPPCore/Public/GraphHelper/New-TeamsRequest.ps1 @@ -0,0 +1,23 @@ +function New-TeamsRequest { + [CmdletBinding()] + Param( + $TenantFilter, + $Cmdlet, + $CmdParams = @{}, + [switch]$AvailableCmdlets + ) + + if ($AvailableCmdlets) { + Get-Command -Module MicrosoftTeams | Select-Object Name + return + } + if (Get-Command -Module MicrosoftTeams -Name $Cmdlet) { + $TeamsToken = (Get-GraphToken -tenantid $TenantFilter -scope '48ac35b8-9aa8-4d74-927d-1f4a14a0b239/.default').Authorization -replace 'Bearer ' + $GraphToken = (Get-GraphToken -tenantid $TenantFilter).Authorization -replace 'Bearer ' + + $null = Connect-MicrosoftTeams -AccessTokens @($TeamsToken, $GraphToken) + & $Cmdlet @CmdParams + } else { + Write-Error "Cmdlet $Cmdlet not found in MicrosoftTeams module" + } +} diff --git a/backend/Modules/CIPPCore/Public/GraphHelper/Remove-CIPPCache.ps1 b/backend/Modules/CIPPCore/Public/GraphHelper/Remove-CIPPCache.ps1 index 1fb95d477f..512258b6cf 100644 --- a/backend/Modules/CIPPCore/Public/GraphHelper/Remove-CIPPCache.ps1 +++ b/backend/Modules/CIPPCore/Public/GraphHelper/Remove-CIPPCache.ps1 @@ -24,7 +24,6 @@ function Remove-CIPPCache { "Removing cache table $Table" $TableContext = Get-CIPPTable -TableName $Table Remove-AzDataTable @TableContext - # Drop it from the Get-CIPPTable cache so it gets recreated on next use. Unregister-CIPPTable -TableName $Table } } diff --git a/backend/Modules/CIPPCore/Public/GraphHelper/Set-CIPPOffloadFunctionTriggers.ps1 b/backend/Modules/CIPPCore/Public/GraphHelper/Set-CIPPOffloadFunctionTriggers.ps1 index ae206f1cd3..58d29cefac 100644 --- a/backend/Modules/CIPPCore/Public/GraphHelper/Set-CIPPOffloadFunctionTriggers.ps1 +++ b/backend/Modules/CIPPCore/Public/GraphHelper/Set-CIPPOffloadFunctionTriggers.ps1 @@ -3,10 +3,10 @@ function Set-CIPPOffloadFunctionTriggers { .SYNOPSIS Manages non-HTTP triggers on function apps based on offloading configuration. .DESCRIPTION - Automatically detects if running on an offloaded function app (name ends with a known - offload suffix). If this is the main function app, checks the offloading state from the - Config table and disables/enables timer, activity, orchestrator, and queue triggers - accordingly. Offloaded function apps are skipped as they should have triggers enabled. + Automatically detects if running on an offloaded function app (contains hyphen in name). + If this is the main function app (no hyphen), checks the offloading state from Config table + and disables/enables timer, activity, orchestrator, and queue triggers accordingly. + Offloaded function apps (with hyphen) are skipped as they should have triggers enabled. .EXAMPLE Set-CIPPOffloadFunctionTriggers Automatically manages triggers based on current function app context and offloading state. @@ -17,9 +17,8 @@ function Set-CIPPOffloadFunctionTriggers { # Get current function app name $FunctionAppName = $env:WEBSITE_SITE_NAME - # Check if this is an offloaded function app (name ends with a known offload suffix). - # A dashed main-app name (e.g. 'compaction-01-z2ir2') is NOT offloaded. - if (Test-CippOffloadFunctionApp -SiteName $FunctionAppName) { + # Check if this is an offloaded function app (contains hyphen) + if ($FunctionAppName -match '-') { return $true } @@ -39,7 +38,16 @@ function Set-CIPPOffloadFunctionTriggers { } # Determine resource group - $ResourceGroupName = Get-CIPPFunctionAppResourceGroup -SiteName $FunctionAppName + if ($env:WEBSITE_RESOURCE_GROUP) { + $ResourceGroupName = $env:WEBSITE_RESOURCE_GROUP + } else { + $Owner = $env:WEBSITE_OWNER_NAME + if ($env:WEBSITE_SKU -ne 'FlexConsumption' -and $Owner -match '^(?[^+]+)\+(?[^-]+(?:-[^-]+)*?)(?:-[^-]+webspace(?:-Linux)?)?$') { + $ResourceGroupName = $Matches.RGName + } else { + throw 'Could not determine resource group. Please provide ResourceGroupName parameter.' + } + } # Define the triggers to disable when offloading is enabled $TargetedTriggers = @( @@ -77,7 +85,7 @@ function Set-CIPPOffloadFunctionTriggers { Offloading = $OffloadEnabled } Add-CIPPAzDataTableEntity @TriggerChangeTable -Entity $LastChange -Force | Out-Null - Update-CIPPAzFunctionAppSetting -Name $FunctionAppName -ResourceGroupName $ResourceGroupName -AppSetting $AppSettings | Out-Null + Update-CIPPAzFunctionAppSetting -Name $FunctionAppName -ResourceGroupName $ResourceGroupName -AppSetting $AppSettings -ErrorAction Stop | Out-Null Write-Information "Successfully disabled $($AppSettings.Count) non-HTTP trigger(s) on $FunctionAppName" } } @@ -108,7 +116,7 @@ function Set-CIPPOffloadFunctionTriggers { Offloading = $OffloadEnabled } Add-CIPPAzDataTableEntity @TriggerChangeTable -Entity $LastChange -Force | Out-Null - Update-CIPPAzFunctionAppSetting -Name $FunctionAppName -ResourceGroupName $ResourceGroupName -AppSetting @{} -RemoveKeys $RemoveKeys | Out-Null + Update-CIPPAzFunctionAppSetting -Name $FunctionAppName -ResourceGroupName $ResourceGroupName -AppSetting @{} -RemoveKeys $RemoveKeys -ErrorAction Stop | Out-Null Write-Information "Successfully re-enabled $($RemoveKeys.Count) non-HTTP trigger(s) on $FunctionAppName" } } @@ -116,8 +124,13 @@ function Set-CIPPOffloadFunctionTriggers { return $true } catch { - $ErrorMessage = Get-CippException -Exception $_ - Write-Warning "Failed to update trigger settings: $($ErrorMessage.NormalizedError)" + # Gracefully handle errors - offloading management is non-critical + try { + $ErrorMessage = Get-CippException -Exception $_ + Write-Warning "Failed to update trigger settings: $($ErrorMessage.NormalizedError)" + } catch { + Write-Warning "Failed to update trigger settings: $($_.Exception.Message)" + } return $false } } diff --git a/backend/Modules/CIPPCore/Public/GraphHelper/Start-TempFileScan.ps1 b/backend/Modules/CIPPCore/Public/GraphHelper/Start-TempFileScan.ps1 new file mode 100644 index 0000000000..07ea0af621 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/GraphHelper/Start-TempFileScan.ps1 @@ -0,0 +1,78 @@ +function Start-TempFileScan { + <# + .FUNCTIONALITY + Internal + .SYNOPSIS + Background worker that scans for temp files and stores results in cache + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$QueueId, + + [Parameter(Mandatory = $true)] + [string]$TenantFilter, + + [Parameter(Mandatory = $true)] + [string]$Scope, + + [string]$SiteId, + [string]$UserId, + $Filters + ) + + $QueueTask = @{ + QueueId = $QueueId + Name = 'Scanning for temp files' + Status = 'Running' + } + $TaskStatus = Set-CippQueueTask @QueueTask + $QueueTask.TaskId = $TaskStatus.RowKey + + try { + Update-CippQueueEntry -RowKey $QueueId -Status 'Running' + + Write-LogMessage -API 'Start-TempFileScan' -tenant $TenantFilter -message "Starting temp file scan (scope=$Scope, siteId=$SiteId, userId=$UserId, queueId=$QueueId)" -Sev Info + + $ScanResult = Get-CIPPTempFileScan -TenantFilter $TenantFilter -Scope $Scope -SiteId $SiteId -UserId $UserId -Filters $Filters + + $CacheTable = Get-CippTable -tablename 'CacheTempFileScan' + $Entity = @{ + PartitionKey = $TenantFilter + RowKey = $QueueId + Data = [string](@{ + Results = $ScanResult.Results + TotalCount = $ScanResult.TotalCount + TotalSize = $ScanResult.TotalSize + } | ConvertTo-Json -Depth 10 -Compress) + CachedAt = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') + } + Add-CIPPAzDataTableEntity @CacheTable -Entity $Entity -Force | Out-Null + + Write-LogMessage -API 'Start-TempFileScan' -tenant $TenantFilter -message "Temp file scan completed: $($ScanResult.TotalCount) files found (queueId=$QueueId)" -Sev Info + + Update-CippQueueEntry -RowKey $QueueId -Status 'Completed' + $QueueTask.Status = 'Completed' + Set-CippQueueTask @QueueTask + } catch { + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -API 'Start-TempFileScan' -tenant $TenantFilter -message "Temp file scan failed: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage + + try { + $CacheTable = Get-CippTable -tablename 'CacheTempFileScan' + $Entity = @{ + PartitionKey = $TenantFilter + RowKey = $QueueId + Error = $ErrorMessage.NormalizedError + CachedAt = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') + } + Add-CIPPAzDataTableEntity @CacheTable -Entity $Entity -Force | Out-Null + } catch { + Write-Warning "Failed to store temp file scan error: $_" + } + + Update-CippQueueEntry -RowKey $QueueId -Status 'Failed' + $QueueTask.Status = 'Failed' + Set-CippQueueTask @QueueTask + } +} diff --git a/backend/Modules/CIPPCore/Public/GraphHelper/Test-CIPPTempFileMatch.ps1 b/backend/Modules/CIPPCore/Public/GraphHelper/Test-CIPPTempFileMatch.ps1 new file mode 100644 index 0000000000..4d8d001ac3 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/GraphHelper/Test-CIPPTempFileMatch.ps1 @@ -0,0 +1,41 @@ +function Test-CIPPTempFileMatch { + <# + .FUNCTIONALITY + Internal + .SYNOPSIS + Returns the temp/junk match types for a single drive item. + .DESCRIPTION + Shared classifier used by both the delta-based and recursive temp file scanners so the + matching rules stay in one place. Returns an array of match type names (empty when the + item matches no enabled filter). + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + $Item, + + [Parameter(Mandatory = $false)] + $Filters + ) + + $MatchTypes = [System.Collections.Generic.List[string]]::new() + if (-not $Item -or -not $Item.name) { return @() } + + if ($Filters.officeTemp -and $Item.name -match '^\~\$') { + $MatchTypes.Add('officeTemp') + } + if ($Filters.tempFiles -and $Item.name -match '(?i)\.(TMP|temp)$') { + $MatchTypes.Add('tempFiles') + } + if ($Filters.zeroByteFiles -and $Item.size -eq 0) { + $MatchTypes.Add('zeroByteFiles') + } + if ($Filters.systemJunk -and $Item.name -in @('Thumbs.db', '.DS_Store', 'desktop.ini')) { + $MatchTypes.Add('systemJunk') + } + if ($Filters.backupFiles -and $Item.name -match '(?i)\.(bak|old)$') { + $MatchTypes.Add('backupFiles') + } + + return @($MatchTypes) +} diff --git a/backend/Modules/CIPPCore/Public/GraphHelper/Write-LogMessage.ps1 b/backend/Modules/CIPPCore/Public/GraphHelper/Write-LogMessage.ps1 index 55c9e3a369..92fd4bdb70 100644 --- a/backend/Modules/CIPPCore/Public/GraphHelper/Write-LogMessage.ps1 +++ b/backend/Modules/CIPPCore/Public/GraphHelper/Write-LogMessage.ps1 @@ -13,6 +13,20 @@ function Write-LogMessage { $sev, $LogData = '' ) + + # Early exit for Debug logs when not in debug mode - BEFORE any expensive operations + if ($sev -eq 'Debug' -and $env:DebugMode -ne $true) { + return + } + + # Early exit for Info severity in background/activity context to reduce storage writes + # These informational messages from orchestrators and activities generate high write volume + # but are not critical for troubleshooting. Errors and Warnings are always written. + if ($sev -eq 'Info' -and $env:CIPP_LOW_LOG_MODE -eq 'true') { + Write-Information "[LOG-SKIP] $API | $tenant | $message" + return + } + if ($Headers.'x-ms-client-principal-idp' -eq 'azureStaticWebApps' -or !$Headers.'x-ms-client-principal-idp') { $user = $headers.'x-ms-client-principal' $username = ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($user)) | ConvertFrom-Json).userDetails @@ -41,9 +55,6 @@ function Write-LogMessage { if (!$tenant) { $tenant = 'None' } if (!$username) { $username = 'CIPP' } - if ($sev -eq 'Debug' -and $env:DebugMode -ne $true) { - return - } $TzId = if ($env:CIPP_TIMEZONE) { $env:CIPP_TIMEZONE } else { 'UTC' } $LocalNow = [TimeZoneInfo]::ConvertTimeBySystemTimeZoneId([DateTime]::UtcNow, $TzId) $PartitionKey = $LocalNow.ToString('yyyyMMdd') diff --git a/backend/Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1 b/backend/Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1 index e28afcbc13..66e61277b6 100644 --- a/backend/Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1 +++ b/backend/Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1 @@ -201,6 +201,7 @@ function Invoke-CIPPDBCacheCollection { 'CsExternalAccessPolicy' 'CsTenantFederationConfiguration' 'CsTeamsMessagingPolicy' + 'CsTeamsFilesPolicy' 'CsTeamsMessagingConfiguration' 'CsTeamsAppPermissionPolicy' 'Teams' diff --git a/backend/Modules/CIPPCore/Public/Invoke-CIPPMailboxFolderPermissionAttempt.ps1 b/backend/Modules/CIPPCore/Public/Invoke-CIPPMailboxFolderPermissionAttempt.ps1 new file mode 100644 index 0000000000..d3a126d8db --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Invoke-CIPPMailboxFolderPermissionAttempt.ps1 @@ -0,0 +1,218 @@ +function Invoke-CIPPMailboxFolderPermissionAttempt { + <# + .SYNOPSIS + Run Remove/Set/Add-MailboxFolderPermission trying each resolved identity candidate. + + .DESCRIPTION + Optimized for Azure Function / UI timeouts. Remove is ACL-first: load live permissions + once per folder, remove matching ACE keys, then try a short candidate list. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [ValidateSet('Remove', 'Set', 'Add')] + [string]$Action, + + [Parameter(Mandatory = $true)] + [string]$TenantFilter, + + [Parameter(Mandatory = $false)] + [string]$FolderIdentity, + + [Parameter(Mandatory = $false)] + [string[]]$FolderIdentities, + + [Parameter(Mandatory = $true)] + [string[]]$Candidates, + + [Parameter(Mandatory = $false)] + $Anchor, + + [Parameter(Mandatory = $false)] + [string[]]$AccessRights, + + [Parameter(Mandatory = $false)] + [bool]$SendNotificationToUser = $false, + + [Parameter(Mandatory = $false)] + [string]$SharingPermissionFlags, + + [Parameter(Mandatory = $false)] + [string[]]$AclUserNames + ) + + $LastError = $null + $SystemUsers = @('Default', 'Anonymous', 'NT AUTHORITY\SELF') + $UniqueCandidates = @( + @($AclUserNames) + @($Candidates) | + Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | + Select-Object -Unique + ) + if ($UniqueCandidates.Count -gt 8) { + $UniqueCandidates = @($UniqueCandidates | Select-Object -First 8) + } + if ($UniqueCandidates.Count -eq 0) { + throw 'No identity candidates available for mailbox folder permission operation' + } + + $FolderList = @( + @($FolderIdentities) + @($FolderIdentity) | + Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | + Select-Object -Unique + ) + if ($FolderList.Count -gt 3) { + $FolderList = @($FolderList | Select-Object -First 3) + } + if ($FolderList.Count -eq 0) { + throw 'No folder identity available for mailbox folder permission operation' + } + + $RetryablePattern = @( + 'UserNotFoundInPermissionEntryException' + 'InvalidExternalUserIdException' + 'Couldn.?t find user' + 'couldn.?t be found' + 'no existing permission entry' + 'not valid SMTP' + 'no matching information' + 'isn.?t a valid' + 'is not a valid' + 'Cannot find recipient' + 'couldn.?t resolve' + 'could not be found' + 'doesn.?t exist' + 'ManagementObjectAmbiguousException' + 'matches multiple entries' + 'couldn.?t be performed' + ) -join '|' + + $TriedFolders = [System.Collections.Generic.List[string]]::new() + + foreach ($ThisFolder in $FolderList) { + $TriedFolders.Add($ThisFolder) + Write-Information "Folder permission $Action trying folder identity '$ThisFolder'" + + if ($Action -eq 'Remove') { + $LivePermissions = $null + try { + $LivePermissions = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-MailboxFolderPermission' -cmdParams @{ + Identity = $ThisFolder + } -Anchor $Anchor -UseSystemMailbox $true + } catch { + $LastError = $_ + Write-Information "Get-MailboxFolderPermission failed for '$ThisFolder': $((Get-CippException -Exception $_).NormalizedError)" + continue + } + + $CandidateSet = [System.Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase) + foreach ($Candidate in $UniqueCandidates) { [void]$CandidateSet.Add([string]$Candidate) } + + $AclTryKeys = [System.Collections.Generic.List[string]]::new() + $AclUserObjects = [System.Collections.Generic.List[object]]::new() + foreach ($Perm in @($LivePermissions)) { + $AclKeys = Get-CIPPFolderPermissionAclUserKeys -PermUser $Perm.User + $AclDisplay = $AclKeys | Select-Object -First 1 + if (-not $AclDisplay -or $AclDisplay -in $SystemUsers) { continue } + + $MatchesTarget = $false + foreach ($AclKey in $AclKeys) { + if ($CandidateSet.Contains([string]$AclKey)) { $MatchesTarget = $true; break } + } + if (-not $MatchesTarget) { continue } + + if ($Perm.User -and $Perm.User -isnot [string]) { + $AclUserObjects.Add($Perm.User) + } + foreach ($AclKey in $AclKeys) { + if ($AclKey -notin $SystemUsers -and -not $AclTryKeys.Contains($AclKey)) { + $AclTryKeys.Add($AclKey) + } + } + } + + # Prefer raw ACE User objects (works for orphaned Unknown UserType entries in native EXO) + foreach ($UserObj in $AclUserObjects) { + try { + $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Remove-MailboxFolderPermission' -cmdParams @{ + Identity = $ThisFolder + User = $UserObj + } -Anchor $Anchor -UseSystemMailbox $true + return [PSCustomObject]@{ + Success = $true + UsedUser = ([string]($UserObj.DisplayName ?? $UserObj)) + UsedFolder = $ThisFolder + TriedUser = @($UniqueCandidates) + TriedFolders = @($TriedFolders) + } + } catch { + $LastError = $_ + $Normalized = (Get-CippException -Exception $_).NormalizedError + if ($Normalized -notmatch $RetryablePattern) { + throw + } + Write-Information "Remove with ACE User object failed on '$ThisFolder': $Normalized" + } + } + + foreach ($UserKey in @($AclTryKeys) + @($UniqueCandidates)) { + if ([string]::IsNullOrWhiteSpace($UserKey) -or $UserKey -in $SystemUsers) { continue } + try { + $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Remove-MailboxFolderPermission' -cmdParams @{ + Identity = $ThisFolder + User = $UserKey + } -Anchor $Anchor -UseSystemMailbox $true + return [PSCustomObject]@{ + Success = $true + UsedUser = $UserKey + UsedFolder = $ThisFolder + TriedUser = @($UniqueCandidates) + TriedFolders = @($TriedFolders) + } + } catch { + $LastError = $_ + $Normalized = (Get-CippException -Exception $_).NormalizedError + if ($Normalized -notmatch $RetryablePattern) { + throw + } + Write-Information "Remove failed for '$UserKey' on '$ThisFolder': $Normalized" + } + } + continue + } + + foreach ($Candidate in $UniqueCandidates) { + try { + $CmdParams = @{ + Identity = $ThisFolder + User = $Candidate + AccessRights = @($AccessRights) + SendNotificationToUser = $SendNotificationToUser + } + if ($SharingPermissionFlags) { + $CmdParams['SharingPermissionFlags'] = $SharingPermissionFlags + } + $Cmdlet = if ($Action -eq 'Set') { 'Set-MailboxFolderPermission' } else { 'Add-MailboxFolderPermission' } + $null = New-ExoRequest -tenantid $TenantFilter -cmdlet $Cmdlet -cmdParams $CmdParams -Anchor $Anchor + return [PSCustomObject]@{ + Success = $true + UsedUser = $Candidate + UsedFolder = $ThisFolder + TriedUser = @($UniqueCandidates) + TriedFolders = @($TriedFolders) + } + } catch { + $Normalized = (Get-CippException -Exception $_).NormalizedError + $LastError = $_ + if ($Normalized -notmatch $RetryablePattern) { + throw + } + Write-Information "Folder permission $Action failed for candidate '$Candidate' on '$ThisFolder': $Normalized — trying next" + } + } + } + + $Tried = ($UniqueCandidates -join ', ') + $FoldersTried = (@($TriedFolders) -join ', ') + $Msg = if ($LastError) { (Get-CippException -Exception $LastError).NormalizedError } else { 'No matching permission entry could be removed' } + throw "Failed after trying identities [$Tried] on folders [$FoldersTried]: $Msg" +} diff --git a/backend/Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1 b/backend/Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1 index 3631a6a513..910d26ee2d 100644 --- a/backend/Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1 +++ b/backend/Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1 @@ -9,8 +9,15 @@ function Invoke-CIPPTestCollection { name prefix via Get-Command — no filesystem paths are used, so this works correctly with ModuleBuilder compiled modules. - The suite-to-pattern map lives in Get-CippTestSuitePatterns (single source of truth, - also used to label stored results with their suite). One special case here: + Suite-to-pattern map (single source of truth): + - ZTNA → Invoke-CippTestZTNA* + - ORCA → Invoke-CippTestORCA* + - EIDSCA → Invoke-CippTestEIDSCA* + - CISA → Invoke-CippTestCISA* + - CIS → Invoke-CippTestCIS_* + - SMB1001 → Invoke-CippTestSMB1001_* + - CopilotReadiness → Invoke-CippTestCopilotReady* + - E8 → Invoke-CippTestE8_* - Custom → Special: enumerates enabled ScriptGuids from DB and calls Invoke-CippTestCustomScripts once per guid (the function requires a ScriptGuid parameter to filter the table query) @@ -34,10 +41,19 @@ function Invoke-CIPPTestCollection { [string]$TenantFilter ) - # Canonical suite-to-pattern map — single source of truth, shared with the suite labelling in - # Get-CIPPTestResultsTenants. Discovery is done via Get-Command so this is path-independent - # and ModuleBuilder safe. - $SuitePatterns = Get-CippTestSuitePatterns + # Canonical suite-to-pattern map — single source of truth for grouping. + # Discovery is done via Get-Command so this is path-independent and ModuleBuilder safe. + $SuitePatterns = @{ + ZTNA = 'Invoke-CippTestZTNA*' + ORCA = 'Invoke-CippTestORCA*' + EIDSCA = 'Invoke-CippTestEIDSCA*' + CISA = 'Invoke-CippTestCISA*' + CIS = 'Invoke-CippTestCIS_*' + SMB1001 = 'Invoke-CippTestSMB1001_*' + CopilotReadiness = 'Invoke-CippTestCopilotReady*' + GenericTests = 'Invoke-CippTestGenericTest*' + E8 = 'Invoke-CippTestE8_*' + } $SuiteStopwatch = [System.Diagnostics.Stopwatch]::StartNew() $SuccessCount = 0 @@ -48,7 +64,8 @@ function Invoke-CIPPTestCollection { # Custom suite: Invoke-CippTestCustomScripts now requires a ScriptGuid parameter. # Enumerate distinct enabled script guids from the DB and call once per guid. if ($SuiteName -eq 'Custom') { - if (-not (Get-Command -Name 'Invoke-CippTestCustomScripts' -ErrorAction SilentlyContinue)) { + $CustomFunction = Get-Command -Name 'Invoke-CippTestCustomScripts' -ErrorAction SilentlyContinue + if (-not $CustomFunction) { Write-Information 'Invoke-CippTestCustomScripts not found — skipping Custom suite' return @{ SuiteName = $SuiteName; TenantFilter = $TenantFilter; Success = 0; Failed = 0; Total = 0; TotalSeconds = 0; Timings = @(); Errors = @() } } @@ -56,30 +73,12 @@ function Invoke-CIPPTestCollection { $Table = Get-CippTable -TableName 'CustomPowershellScripts' $AllScripts = @(Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'CustomScript'") - # Single-pass "latest enabled version per ScriptGuid". - # The previous Group-Object | ForEach-Object { Sort-Object | Select -First 1 } - # pipeline allocated a Group container per guid and ran an O(n log n) sort per group; - # this hashtable walk is O(n) total and avoids the pipeline overhead entirely. - $LatestByGuid = @{} - foreach ($Script in $AllScripts) { - $Guid = $Script.ScriptGuid - if (-not $Guid) { continue } - $Existing = $LatestByGuid[$Guid] - if (-not $Existing -or [int]$Script.Version -gt [int]$Existing.Version) { - $LatestByGuid[$Guid] = $Script - } - } - - $EnabledGuidsList = [System.Collections.Generic.List[string]]::new() - foreach ($Latest in $LatestByGuid.Values) { - # Cache the property lookup — calling .PSObject.Properties[''] reflects through - # the PSObject member set on every invocation in the original code. - $EnabledProp = $Latest.PSObject.Properties['Enabled'] - if (-not $EnabledProp -or [bool]$EnabledProp.Value) { - $EnabledGuidsList.Add($Latest.ScriptGuid) - } - } - $EnabledGuids = $EnabledGuidsList.ToArray() + # Get the latest version of each script guid, filter to enabled only + $EnabledGuids = $AllScripts | Group-Object -Property ScriptGuid | ForEach-Object { + $_.Group | Sort-Object -Property Version -Descending | Select-Object -First 1 + } | Where-Object { + -not $_.PSObject.Properties['Enabled'] -or [bool]$_.Enabled + } | Select-Object -ExpandProperty ScriptGuid if ($EnabledGuids.Count -eq 0) { Write-Information 'No enabled custom scripts found — skipping Custom suite' @@ -90,7 +89,6 @@ function Invoke-CIPPTestCollection { $Table = Get-CippTable -tablename 'CippTestResults' $ResultBatch = [System.Collections.Generic.List[hashtable]]::new() - $AlertBatch = [System.Collections.Generic.List[object]]::new() foreach ($Guid in $EnabledGuids) { $ItemStopwatch = [System.Diagnostics.Stopwatch]::StartNew() @@ -100,8 +98,6 @@ function Invoke-CIPPTestCollection { foreach ($Entity in $TestOutput) { if ($Entity -is [hashtable] -and $Entity.PartitionKey -and $Entity.RowKey) { $ResultBatch.Add($Entity) - } elseif ($Entity -isnot [hashtable] -and $Entity.PSObject.Properties['CippCustomTestAlert']) { - $AlertBatch.Add($Entity) } } if ($ResultBatch.Count -ge 100) { @@ -110,13 +106,13 @@ function Invoke-CIPPTestCollection { $ResultBatch.Clear() } $ItemStopwatch.Stop() - $ElapsedSeconds = '{0:N3}' -f $ItemStopwatch.Elapsed.TotalSeconds + $ElapsedSeconds = [math]::Round($ItemStopwatch.Elapsed.TotalSeconds, 3) $Timings.Add("CustomScript-$Guid : ${ElapsedSeconds}s") Write-Information " [Custom] Completed CustomScript-$Guid - ${ElapsedSeconds}s" $SuccessCount++ } catch { $ItemStopwatch.Stop() - $ElapsedSeconds = '{0:N3}' -f $ItemStopwatch.Elapsed.TotalSeconds + $ElapsedSeconds = [math]::Round($ItemStopwatch.Elapsed.TotalSeconds, 3) $FailedCount++ $Errors.Add("CustomScript-$Guid : $($_.Exception.Message)") $Timings.Add("CustomScript-$Guid : ${ElapsedSeconds}s (FAILED)") @@ -130,14 +126,8 @@ function Invoke-CIPPTestCollection { Write-Information " [Custom] Flushed final $($ResultBatch.Count) results to table" } - # Ship a single aggregated alert for the tenant covering all alert-worthy results. - if ($AlertBatch.Count -gt 0) { - Write-Information " [Custom] Shipping $($AlertBatch.Count) custom test alert(s) for $TenantFilter" - Send-CIPPCustomTestAlert -TenantFilter $TenantFilter -Alerts @($AlertBatch) - } - $SuiteStopwatch.Stop() - $TotalElapsed = '{0:N3}' -f $SuiteStopwatch.Elapsed.TotalSeconds + $TotalElapsed = [math]::Round($SuiteStopwatch.Elapsed.TotalSeconds, 3) $Summary = "Custom suite for $TenantFilter completed in ${TotalElapsed}s — $SuccessCount/$($EnabledGuids.Count) ran, $FailedCount errored" Write-Information $Summary Write-Information " Timings: $($Timings -join ' | ')" @@ -156,7 +146,7 @@ function Invoke-CIPPTestCollection { } } - # Standard suites: discover functions by name pattern via Get-Command. + # Standard suites: discover functions by name pattern via Get-Command $Pattern = $SuitePatterns[$SuiteName] $TestFunctions = @(Get-Command -Name $Pattern -Module CIPPTests -ErrorAction SilentlyContinue) if ($TestFunctions.Count -eq 0) { @@ -181,24 +171,30 @@ function Invoke-CIPPTestCollection { foreach ($TestFunction in $TestFunctions) { $ItemStopwatch = [System.Diagnostics.Stopwatch]::StartNew() try { - $TestOutput = @(& $TestFunction -Tenant $TenantFilter) + Write-Information " [$SuiteName] Running $($TestFunction.Name) for $TenantFilter" + $TestOutput = @(& $TestFunction.Name -Tenant $TenantFilter) foreach ($Entity in $TestOutput) { - if ($Entity -is [hashtable] -and $Entity.PartitionKey) { + if ($Entity -is [hashtable] -and $Entity.PartitionKey -and $Entity.RowKey) { $ResultBatch.Add($Entity) } } if ($ResultBatch.Count -ge 100) { Add-CIPPAzDataTableEntity @Table -Entity @($ResultBatch) -Force + Write-Information " [$SuiteName] Flushed $($ResultBatch.Count) results to table" $ResultBatch.Clear() } $ItemStopwatch.Stop() - $Timings.Add(('{0} : {1:N3}s' -f $TestFunction.Name, $ItemStopwatch.Elapsed.TotalSeconds)) + $ElapsedSeconds = [math]::Round($ItemStopwatch.Elapsed.TotalSeconds, 3) + $Timings.Add("$($TestFunction.Name) : ${ElapsedSeconds}s") + Write-Information " [$SuiteName] Completed $($TestFunction.Name) - ${ElapsedSeconds}s" $SuccessCount++ } catch { $ItemStopwatch.Stop() + $ElapsedSeconds = [math]::Round($ItemStopwatch.Elapsed.TotalSeconds, 3) $FailedCount++ $Errors.Add("$($TestFunction.Name) : $($_.Exception.Message)") - $Timings.Add(('{0} : {1:N3}s (FAILED)' -f $TestFunction.Name, $ItemStopwatch.Elapsed.TotalSeconds)) + $Timings.Add("$($TestFunction.Name) : ${ElapsedSeconds}s (FAILED)") + Write-Warning " [$SuiteName] Failed $($TestFunction.Name) after ${ElapsedSeconds}s: $($_.Exception.Message)" } } @@ -209,7 +205,7 @@ function Invoke-CIPPTestCollection { } $SuiteStopwatch.Stop() - $TotalElapsed = '{0:N3}' -f $SuiteStopwatch.Elapsed.TotalSeconds + $TotalElapsed = [math]::Round($SuiteStopwatch.Elapsed.TotalSeconds, 3) $TestCount = $TestFunctions.Count $Summary = "$SuiteName suite for $TenantFilter completed in ${TotalElapsed}s — $SuccessCount/$TestCount ran, $FailedCount errored" Write-Information $Summary diff --git a/backend/Modules/CIPPCore/Public/MCP/Get-CippMcpToolCatalog.ps1 b/backend/Modules/CIPPCore/Public/MCP/Get-CippMcpToolCatalog.ps1 index e97bfd2120..e28853a802 100644 --- a/backend/Modules/CIPPCore/Public/MCP/Get-CippMcpToolCatalog.ps1 +++ b/backend/Modules/CIPPCore/Public/MCP/Get-CippMcpToolCatalog.ps1 @@ -6,7 +6,7 @@ function Get-CippMcpToolCatalog { Returns every operation whose x-cipp-role ends in '.Read' (never '.ReadWrite') as a catalog entry: name (the API endpoint), description, inputSchema (JSON Schema built from the operation's query parameters / request body with $ref inlined), read-only annotations, and - internal routing fields (_category, _method, _summary). The projection is cached per worker; + internal routing fields (_category, _role, _method, _summary). The projection is cached per worker; pass -Force to rebuild. The catalog is NOT advertised to MCP clients wholesale — Get-CippMcpToolList exposes a fixed @@ -158,6 +158,7 @@ function Get-CippMcpToolCatalog { inputSchema = $InputSchema annotations = [ordered]@{ title = $Endpoint; readOnlyHint = $true } _category = $Category + _role = $Role _method = $Method.ToUpper() _summary = $Summary _paramAlias = $ParamAlias @@ -170,6 +171,15 @@ function Get-CippMcpToolCatalog { $Filtered = @($script:CippMcpToolCatalogCache) + # Only list what the caller's own roles allow; Test-CIPPAccess still checks every call. + if ($Request) { + $Allowed = Get-CippRequestAllowedPermissions + if ($null -ne $Allowed) { + $AllowedSet = [System.Collections.Generic.HashSet[string]]::new([string[]]@($Allowed), [System.StringComparer]::OrdinalIgnoreCase) + $Filtered = @($Filtered.Where({ $AllowedSet.Contains([string]$_._role) })) + } + } + # Per-connection filtering from the connector URL's query string. $Query = $Request.Query $TagFilter = "$($Query.tags ?? $Query.category ?? $Query.tag)".Trim() diff --git a/backend/Modules/CIPPCore/Public/MCP/Get-CippMcpToolResult.ps1 b/backend/Modules/CIPPCore/Public/MCP/Get-CippMcpToolResult.ps1 index 47a0618c3b..4b0504181f 100644 --- a/backend/Modules/CIPPCore/Public/MCP/Get-CippMcpToolResult.ps1 +++ b/backend/Modules/CIPPCore/Public/MCP/Get-CippMcpToolResult.ps1 @@ -117,7 +117,7 @@ function Get-CippMcpToolResult { $Near = @((Find-CippMcpTool -Request $Request -Query $TargetName -Limit 5).tools | ForEach-Object { $_.name }) $Hint = if ($Near.Count -gt 0) { " Did you mean: $($Near -join ', ')?" } else { ' Use SearchTools to discover valid tool names.' } return [ordered]@{ - content = @(@{ type = 'text'; text = "No read-only tool named '$TargetName'.$Hint" }) + content = @(@{ type = 'text'; text = "No tool named '$TargetName' is available to you.$Hint" }) isError = $true } } diff --git a/backend/Modules/CIPPCore/Public/New-CIPPBackup.ps1 b/backend/Modules/CIPPCore/Public/New-CIPPBackup.ps1 index d31069a4f9..28735b012e 100644 --- a/backend/Modules/CIPPCore/Public/New-CIPPBackup.ps1 +++ b/backend/Modules/CIPPCore/Public/New-CIPPBackup.ps1 @@ -54,7 +54,6 @@ function New-CIPPBackup { 'Extensions' 'WebhookRules' 'ScheduledTasks' - 'DeltaQueries' 'TenantProperties' 'TenantGroups' 'TenantGroupMembers' @@ -71,16 +70,8 @@ function New-CIPPBackup { } $Entities | Select-Object * -ExcludeProperty DomainAnalyser, table, Timestamp, ETag, Results | Select-Object *, @{l = 'table'; e = { $CSVTable } } } - # Back up excluded tenant rows (user-configured exclusion state only) - $TenantsTable = Get-CippTable -tablename 'Tenants' - $ExcludedTenants = Get-AzDataTableEntity @TenantsTable -Filter "PartitionKey eq 'Tenants' and Excluded eq true" - if ($ExcludedTenants) { - $CSVfile = @($CSVfile) + @( - $ExcludedTenants | Select-Object PartitionKey, RowKey, customerId, defaultDomainName, displayName, Excluded, ExcludeDate, ExcludeUser | Select-Object *, @{l = 'table'; e = { 'Tenants' } } - ) - } $RowKey = 'CIPPBackup' + '_' + (Get-Date).ToString('yyyy-MM-dd-HHmm') - $BackupData = [string]($CSVfile | ConvertTo-Json -Compress -Depth 100) + $BackupData = [string]($CSVfile | ConvertTo-Json -Compress -Depth 20) $TableName = 'CIPPBackup' $PartitionKey = 'CIPPBackup' $ContainerName = 'cipp-backups' @@ -109,7 +100,7 @@ function New-CIPPBackup { Write-Information "Failed to create backup for $ScheduledBackup - $($_.Exception.Message)" } } - $BackupData = $entity | ConvertTo-Json -Compress -Depth 100 + $BackupData = $entity | ConvertTo-Json -Compress -Depth 20 $TableName = 'ScheduledBackup' $PartitionKey = 'ScheduledBackup' $ContainerName = 'scheduled-backups' @@ -126,7 +117,7 @@ function New-CIPPBackup { try { $containers = @() try { $containers = New-CIPPAzStorageRequest -Service 'blob' -Component 'list' -ConnectionString $ConnectionString } catch { $containers = @() } - $exists = $null -ne ($containers | Where-Object { $_.Name -eq $ContainerName }) + $exists = ($containers | Where-Object { $_.Name -eq $ContainerName }) -ne $null if (-not $exists) { $null = New-CIPPAzStorageRequest -Service 'blob' -Resource $ContainerName -Method 'PUT' -QueryParams @{ restype = 'container' } -ConnectionString $ConnectionString Start-Sleep -Milliseconds 500 diff --git a/backend/Modules/CIPPCore/Public/New-CIPPBackupTask.ps1 b/backend/Modules/CIPPCore/Public/New-CIPPBackupTask.ps1 index 619043307b..6e1a18b433 100644 --- a/backend/Modules/CIPPCore/Public/New-CIPPBackupTask.ps1 +++ b/backend/Modules/CIPPCore/Public/New-CIPPBackupTask.ps1 @@ -97,9 +97,7 @@ function New-CIPPBackupTask { 'intuneprotection' { Measure-CippTask -TaskName 'IntuneProtection' -EventName 'CIPP.BackupCompleted' -Script { New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/deviceAppManagement/managedAppPolicies?$top=999' -tenantid $TenantFilter | ForEach-Object { - # The listing is the only place the concrete type is visible; without it the - # capture reads back a policy that does not say which platform it is for. - New-CIPPIntuneTemplate -TenantFilter $TenantFilter -URLName 'managedAppPolicies' -ID $_.ID -ODataType $_.'@odata.type' + New-CIPPIntuneTemplate -TenantFilter $TenantFilter -URLName 'managedAppPolicies' -ID $_.ID } } } diff --git a/backend/Modules/CIPPCore/Public/New-CIPPCATemplate.ps1 b/backend/Modules/CIPPCore/Public/New-CIPPCATemplate.ps1 index d7d2ebf83d..185f4ef0c3 100644 --- a/backend/Modules/CIPPCore/Public/New-CIPPCATemplate.ps1 +++ b/backend/Modules/CIPPCore/Public/New-CIPPCATemplate.ps1 @@ -38,12 +38,6 @@ function New-CIPPCATemplate { } } - # Fetch authentication context class references if the policy uses them - $authContexts = $null - if ($JSON.conditions.applications.includeAuthenticationContextClassReferences) { - $authContexts = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/authenticationContextClassReferences' -tenantid $TenantFilter - } - $AllLocations = [system.collections.generic.list[object]]::new() $includelocations = [system.collections.generic.list[object]]::new() @@ -119,25 +113,7 @@ function New-CIPPCATemplate { # Remove duplicates based on displayName to avoid Select-Object -Unique issues with complex objects $UniqueLocations = $AllLocations | Group-Object -Property displayName | ForEach-Object { $_.Group[0] } $JSON | Add-Member -NotePropertyName 'LocationInfo' -NotePropertyValue @($UniqueLocations) -Force - - # Convert authentication context class reference IDs to display names and store full objects - if ($authContexts -and $JSON.conditions.applications.includeAuthenticationContextClassReferences) { - $AllAuthContexts = [System.Collections.Generic.List[object]]::new() - $authContextDisplayNames = [System.Collections.Generic.List[object]]::new() - foreach ($acr in $JSON.conditions.applications.includeAuthenticationContextClassReferences) { - $acrInfo = $authContexts | Where-Object -Property id -EQ $acr | Select-Object id, displayName, description, isAvailable - if ($acrInfo) { - $authContextDisplayNames.Add($acrInfo.displayName) - $AllAuthContexts.Add($acrInfo) - } else { - $authContextDisplayNames.Add($acr) - } - } - $JSON.conditions.applications.includeAuthenticationContextClassReferences = @($authContextDisplayNames) - $JSON | Add-Member -NotePropertyName 'AuthContextInfo' -NotePropertyValue @($AllAuthContexts) -Force - } - - $JSON = (ConvertTo-Json -Compress -Depth 100 -InputObject $JSON) + $JSON = (ConvertTo-Json -Compress -Depth 20 -InputObject $JSON) return $JSON } diff --git a/backend/Modules/CIPPCore/Public/New-CIPPGroup.ps1 b/backend/Modules/CIPPCore/Public/New-CIPPGroup.ps1 index d0129d5d2e..7b0c60cc83 100644 --- a/backend/Modules/CIPPCore/Public/New-CIPPGroup.ps1 +++ b/backend/Modules/CIPPCore/Public/New-CIPPGroup.ps1 @@ -58,8 +58,17 @@ function New-CIPPGroup { } } + # Extract groupType value - handle both string and object with .value property + $GroupTypeValue = if ($GroupObject.groupType.value) { + $GroupObject.groupType.value + } elseif ($GroupObject.groupType -is [string]) { + $GroupObject.groupType + } else { + [string]$GroupObject.groupType + } + # Normalize group type for consistent handling (accept camelCase from templates) - $NormalizedGroupType = switch -Wildcard ($GroupObject.groupType.ToLower()) { + $NormalizedGroupType = switch -Wildcard ($GroupTypeValue.ToLower()) { 'mail-enabled security' { 'Security'; break } '*dynamicdistribution*' { 'DynamicDistribution'; break } # Check this first before *dynamic* and *distribution* '*dynamic*' { 'Dynamic'; break } @@ -71,7 +80,7 @@ function New-CIPPGroup { '*microsoft*' { 'M365'; break } '*distribution*' { 'Distribution'; break } '*mail*' { 'Distribution'; break } - default { $GroupObject.groupType } + default { $GroupTypeValue } } # Determine if this group type needs an email address @@ -94,14 +103,31 @@ function New-CIPPGroup { $null } - # Determine if we should generate a mailNickname with a GUID, or use the username field - if (-not $GroupObject.Username -or $NormalizedGroupType -in @('Generic', 'AzureRole')) { - $MailNickname = (New-Guid).guid.substring(0, 10) - } else { - $MailNickname = ($GroupObject.Username -split '@')[0] -replace '[^a-zA-Z0-9_-]', '' - if ([String]::IsNullOrEmpty($MailNickname)) { - $MailNickname = (New-Guid).guid + # Extract local part of username if exists and remove special characters for mailNickname + # If no username provided, fall back to displayName for the mailNickname (required by Graph API for all groups) + $SourceForNickname = if ($GroupObject.username) { + if ($GroupObject.username -like '*@*') { + ($GroupObject.username -split '@')[0] + } else { + $GroupObject.username } + } else { + # Use displayName as fallback for groups that don't need email (security groups) + $GroupObject.displayName + } + + # Remove forbidden characters per Microsoft 365 mailNickname requirements: + # ASCII 0-127 only, excluding: @ () / [] ' ; : <> , SPACE and any non-ASCII + $MailNickname = $SourceForNickname -replace "[@()\[\]/'`;:<>,\s]|[^\x00-\x7F]", '' + + # Ensure max length of 64 characters + if ($MailNickname.Length -gt 64) { + $MailNickname = $MailNickname.Substring(0, 64) + } + + # Ensure mailNickname is not empty (use a GUID suffix if displayName resulted in empty string) + if ([string]::IsNullOrWhiteSpace($MailNickname)) { + $MailNickname = "group-$(New-Guid)".Substring(0, 64) } Write-LogMessage -API $APIName -tenant $TenantFilter -message "Creating group $($GroupObject.displayName) of type $NormalizedGroupType$(if ($NeedsEmail) { " with email $Email" })" -Sev Info -User $ExecutingUser @@ -248,7 +274,7 @@ function New-CIPPGroup { Alias = $MailNickname Description = $GroupObject.description PrimarySmtpAddress = $Email - Type = $GroupObject.groupType + Type = $NormalizedGroupType RequireSenderAuthenticationEnabled = [bool]!$GroupObject.allowExternal } diff --git a/backend/Modules/CIPPCore/Public/New-CIPPIntuneTemplate.ps1 b/backend/Modules/CIPPCore/Public/New-CIPPIntuneTemplate.ps1 index 4a4e710ad1..92e574fe6f 100644 --- a/backend/Modules/CIPPCore/Public/New-CIPPIntuneTemplate.ps1 +++ b/backend/Modules/CIPPCore/Public/New-CIPPIntuneTemplate.ps1 @@ -49,7 +49,7 @@ function New-CIPPIntuneTemplate { $Type = 'deviceCompliancePolicies' $Template = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$($urlname)/$($ID)?`$expand=scheduledActionsForRule(`$expand=scheduledActionConfigurations)" -tenantid $TenantFilter $DisplayName = $Template.displayName - $TemplateJson = ConvertTo-Json -InputObject $Template -Depth 100 -Compress + $TemplateJson = ConvertTo-Json -InputObject $Template -Depth 20 -Compress } 'managedAppPolicies' { $Type = 'AppProtection' @@ -68,7 +68,7 @@ function New-CIPPIntuneTemplate { $null = $Template | Add-Member -MemberType NoteProperty -Name '@odata.type' -Value $ODataType -Force } $DisplayName = $Template.displayName - $TemplateJson = ConvertTo-Json -InputObject $Template -Depth 100 -Compress + $TemplateJson = ConvertTo-Json -InputObject $Template -Depth 20 -Compress } 'mobileAppConfigurations' { $Type = 'AppConfiguration' @@ -97,7 +97,7 @@ function New-CIPPIntuneTemplate { $Template | Add-Member -NotePropertyName 'targetedMobileAppsDetails' -NotePropertyValue @($TargetedAppDetails) -Force } $DisplayName = $Template.displayName - $TemplateJson = ConvertTo-Json -InputObject $Template -Depth 100 -Compress + $TemplateJson = ConvertTo-Json -InputObject $Template -Depth 20 -Compress } 'configurationPolicies' { $Type = 'Catalog' @@ -117,7 +117,7 @@ function New-CIPPIntuneTemplate { $Type = 'windowsDriverUpdateProfiles' $Template = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$($urlname)/$($ID)" -tenantid $TenantFilter | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime' $DisplayName = $Template.displayName - $TemplateJson = ConvertTo-Json -InputObject $Template -Depth 100 -Compress + $TemplateJson = ConvertTo-Json -InputObject $Template -Depth 20 -Compress } 'deviceConfigurations' { $Type = 'Device' @@ -136,7 +136,7 @@ function New-CIPPIntuneTemplate { } $DisplayName = $Template.displayName - $TemplateJson = ConvertTo-Json -InputObject $Template -Depth 100 -Compress + $TemplateJson = ConvertTo-Json -InputObject $Template -Depth 20 -Compress } 'groupPolicyConfigurations' { $Type = 'Admin' @@ -152,19 +152,19 @@ function New-CIPPIntuneTemplate { $Type = 'windowsFeatureUpdateProfiles' $Template = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$($urlname)/$($ID)" -tenantid $TenantFilter | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime' $DisplayName = $Template.displayName - $TemplateJson = ConvertTo-Json -InputObject $Template -Depth 100 -Compress + $TemplateJson = ConvertTo-Json -InputObject $Template -Depth 20 -Compress } 'windowsQualityUpdatePolicies' { $Type = 'windowsQualityUpdatePolicies' $Template = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$($urlname)/$($ID)" -tenantid $TenantFilter | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime' $DisplayName = $Template.displayName - $TemplateJson = ConvertTo-Json -InputObject $Template -Depth 100 -Compress + $TemplateJson = ConvertTo-Json -InputObject $Template -Depth 20 -Compress } 'windowsQualityUpdateProfiles' { $Type = 'windowsQualityUpdateProfiles' $Template = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$($urlname)/$($ID)" -tenantid $TenantFilter | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime' $DisplayName = $Template.displayName - $TemplateJson = ConvertTo-Json -InputObject $Template -Depth 100 -Compress + $TemplateJson = ConvertTo-Json -InputObject $Template -Depth 20 -Compress } 'hardwareConfigurations' { $Type = 'hardwareConfigurations' diff --git a/backend/Modules/CIPPCore/Public/New-CIPPOneDriveShortCut.ps1 b/backend/Modules/CIPPCore/Public/New-CIPPOneDriveShortCut.ps1 index 8ae8023ddc..578a4babc3 100644 --- a/backend/Modules/CIPPCore/Public/New-CIPPOneDriveShortCut.ps1 +++ b/backend/Modules/CIPPCore/Public/New-CIPPOneDriveShortCut.ps1 @@ -9,10 +9,21 @@ function New-CIPPOneDriveShortCut { $APIName = 'Create OneDrive shortcut', $Headers, [ValidateSet('root', 'shortcuts')] - [string]$Destination = 'root' + [string]$Destination = 'root', + [string]$ShortcutName ) Write-Host "Received $Username and $UserId. We're using $URL and $TenantFilter (destination=$Destination)" try { + # OneDrive item-name rules; rejected rather than stripped so the admin sees what to fix + if (-not [string]::IsNullOrWhiteSpace($ShortcutName)) { + if ($ShortcutName -match '["*:<>?/\\|]') { throw 'Shortcut name cannot contain any of these characters: " * : < > ? / \ |' } + if ($ShortcutName -ne $ShortcutName.Trim()) { throw 'Shortcut name cannot start or end with a space.' } + if ($ShortcutName.EndsWith('.')) { throw 'Shortcut name cannot end with a period.' } + if ($ShortcutName.Length -gt 255) { throw 'Shortcut name cannot be longer than 255 characters.' } + } else { + $ShortcutName = $null + } + $SPOTenant = Get-CIPPSPOTenant -TenantFilter $TenantFilter | Select-Object -First 1 if ($SPOTenant.DisableAddToOneDrive -eq $true) { throw "Add shortcut to OneDrive is disabled for this tenant (DisableAddToOneDrive). Enable it via the 'Set Add Shortcuts To OneDrive button state' standard, or Set-SPOTenant -DisableAddShortcutsToOneDrive `$false." @@ -73,7 +84,7 @@ function New-CIPPOneDriveShortCut { # Same as the proven test script / HAR: default library via sites/{id}/drive sharePointIds $SPIds = (New-GraphGetRequest -uri "https://graph.microsoft.com/beta/sites/$($SiteInfo.id)/drive?`$select=SharepointIds" -tenantid $TenantFilter -asapp $true).SharePointIds $body = [PSCustomObject]@{ - name = 'Documents' + name = if ($ShortcutName) { $ShortcutName } else { 'Documents' } remoteItem = @{ sharepointIds = @{ listId = $SPIds.listid @@ -85,7 +96,7 @@ function New-CIPPOneDriveShortCut { } '@microsoft.graph.conflictBehavior' = 'rename' } | ConvertTo-Json -Depth 10 - $ShortcutDisplayName = $SiteInfo.displayName + $ShortcutDisplayName = if ($ShortcutName) { $ShortcutName } else { $SiteInfo.displayName } } else { # ── Subfolder shortcut ─────────────────────────────────────────────── $PathParts = $RelativePath -split '/' @@ -114,14 +125,14 @@ function New-CIPPOneDriveShortCut { } $body = [PSCustomObject]@{ - name = $DisplayName + name = if ($ShortcutName) { $ShortcutName } else { $DisplayName } remoteItem = @{ id = $FolderItem.id parentReference = @{ driveId = $Drive.id } } '@microsoft.graph.conflictBehavior' = 'rename' } | ConvertTo-Json -Depth 10 - $ShortcutDisplayName = "$($SiteInfo.displayName) / $DisplayName" + $ShortcutDisplayName = if ($ShortcutName) { $ShortcutName } else { "$($SiteInfo.displayName) / $DisplayName" } } # Proven path is root/children. special/shortcuts create is optional/undocumented. @@ -132,7 +143,22 @@ function New-CIPPOneDriveShortCut { } $DestinationLabel = if ($Destination -eq 'shortcuts') { 'Shortcuts folder' } else { 'OneDrive root' } - $null = New-GraphPOSTRequest -uri $PostUri -body $body -tenantid $TenantFilter -asapp $true + $Created = New-GraphPOSTRequest -uri $PostUri -body $body -tenantid $TenantFilter -asapp $true + + # OneDrive can prefix the site name onto the created name, so rename to the exact name asked for + if ($ShortcutName -and $Created.id -and $Created.name -cne $ShortcutName) { + try { + $RenameBody = @{ name = $ShortcutName } | ConvertTo-Json -Compress + $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/users/$Username/drive/items/$($Created.id)" -body $RenameBody -type PATCH -tenantid $TenantFilter -asapp $true + } catch { + $RenameError = (Get-CippException -Exception $_).NormalizedError + $Warning = "Created OneDrive shortcut for $Username called $($Created.name) in $DestinationLabel, but renaming it to $ShortcutName failed: $RenameError" + Write-LogMessage -API $APIName -headers $Headers -message $Warning -Sev 'Warning' + return $Warning + } + } elseif ($Created.name) { + $ShortcutDisplayName = $Created.name + } Write-LogMessage -API $APIName -headers $Headers -message "Created OneDrive shortcut called $ShortcutDisplayName for $Username in $DestinationLabel" -Sev 'info' return "Successfully created OneDrive Shortcut for $Username called $ShortcutDisplayName in $DestinationLabel" } catch { diff --git a/backend/Modules/CIPPCore/Public/New-CIPPRestoreTask.ps1 b/backend/Modules/CIPPCore/Public/New-CIPPRestoreTask.ps1 index a0e1edec7b..738c65e2d2 100644 --- a/backend/Modules/CIPPCore/Public/New-CIPPRestoreTask.ps1 +++ b/backend/Modules/CIPPCore/Public/New-CIPPRestoreTask.ps1 @@ -37,40 +37,21 @@ function New-CIPPRestoreTask { 'ScriptedAlerts' = @{ success = 0; failed = 0 } } - # Helper function to clean user/group objects for Graph API - removes reference properties, - # read-only properties, nulls, and empty strings - function ConvertTo-RestorableGraphObject { - param($Object, [switch]$ExcludeId, [switch]$ForUpdate) - $excludeProps = @('password', 'passwordProfile', '@odata.type', 'manager', 'memberOf', 'createdOnBehalfOf', - 'createdByAppId', 'deletedDateTime', 'authorizationInfo', 'imAddresses', 'assignedLicenses', - 'assignedPlans', 'cloudLicensing', 'cloudRealtimeCommunicationInfo', - 'createdDateTime', 'creationType', 'deviceKeys', 'expirationDateTime', 'externalUserState', - 'externalUserStateChangeDateTime', 'hasMembersWithLicenseErrors', 'isArchived', 'isFavorite', - 'isLicenseReconciliationNeeded', 'isManagementRestricted', 'isResourceAccount', - 'isSubscribedByMail', 'lastPasswordChangeDateTime', 'legalAgeGroupClassification', - 'licenseAssignmentStates', 'licenseProcessingState', 'mail', 'membershipRuleProcessingStatus', - 'onPremises*', 'provisionedPlans', 'proxyAddresses', 'refreshTokensValidFromDateTime', - 'renewedDateTime', 'resourceProvisioningOptions', 'securityIdentifier', - 'serviceProvisioningErrors', 'signInActivity', 'signInSessionsValidFromDateTime', - 'uniqueName', 'unseenConversationsCount', 'unseenCount', 'unseenMessagesCount') - + # Helper function to clean user object for Graph API - removes reference properties, nulls, and empty strings + function Clean-GraphObject { + param($Object, [switch]$ExcludeId) + $excludeProps = @('password', 'passwordProfile', '@odata.type', 'manager', 'memberOf', 'createdOnBehalfOf', 'createdByAppId', 'deletedDateTime', 'authorizationInfo', 'imAddresses') if ($ExcludeId) { $excludeProps += @('id') } - if ($ForUpdate) { - # Immutable after creation: allowed in a POST body, rejected on PATCH - $excludeProps += @('id', 'isAssignableToRole', 'resourceBehaviorOptions', 'creationOptions') - } $cleaned = $Object | Select-Object * -ExcludeProperty $excludeProps $result = @{} foreach ($prop in $cleaned.PSObject.Properties) { $propValue = $prop.Value - # Skip empty strings, nulls, and complex objects (except known-good arrays like businessPhones). - # Compare the string case explicitly: '$propValue -ne ''''' coerces '' to $false for booleans, - # which silently dropped required $false properties like mailEnabled. - if ($null -ne $propValue -and -not ($propValue -is [string] -and $propValue -eq '')) { + # Skip empty strings, nulls, and complex objects (except known-good arrays like businessPhones) + if ($propValue -ne '' -and $null -ne $propValue) { # Skip complex objects/dictionaries but allow simple arrays if ($propValue -is [System.Collections.IDictionary]) { continue @@ -147,8 +128,8 @@ function New-CIPPRestoreTask { if ($overwrite) { if ($userObject.id -in $currentUsers.id -or $userObject.userPrincipalName -in $currentUsers.userPrincipalName) { # Patch existing user - clean object to remove reference properties, nulls, and empty strings - $cleanedUser = ConvertTo-RestorableGraphObject -Object $userObject - $patchBody = $cleanedUser | ConvertTo-Json -Depth 100 -Compress + $cleanedUser = Clean-GraphObject -Object $userObject + $patchBody = $cleanedUser | ConvertTo-Json -Depth 20 -Compress $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/users/$($userObject.id)" -tenantid $TenantFilter -body $patchBody -type PATCH Write-LogMessage -message "Restored $($UPN) from backup by patching the existing object." -Sev 'info' $restorationStats['Users'].success++ @@ -157,12 +138,12 @@ function New-CIPPRestoreTask { # Create new user - need to add password and clean object $tempPassword = New-passwordString # Remove reference properties that may not exist in target tenant, nulls, and empty strings - $cleanedUser = ConvertTo-RestorableGraphObject -Object $userObject -ExcludeId + $cleanedUser = Clean-GraphObject -Object $userObject -ExcludeId $cleanedUser['passwordProfile'] = @{ 'forceChangePasswordNextSignIn' = $true 'password' = $tempPassword } - $JSON = $cleanedUser | ConvertTo-Json -Depth 100 -Compress + $JSON = $cleanedUser | ConvertTo-Json -Depth 20 -Compress $null = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/users' -tenantid $TenantFilter -body $JSON -type POST # Try to wrap password in PwPush link @@ -185,12 +166,12 @@ function New-CIPPRestoreTask { # Create new user - need to add password and clean object $tempPassword = New-passwordString # Remove reference properties that may not exist in target tenant, nulls, and empty strings - $cleanedUser = ConvertTo-RestorableGraphObject -Object $userObject -ExcludeId + $cleanedUser = Clean-GraphObject -Object $userObject -ExcludeId $cleanedUser['passwordProfile'] = @{ 'forceChangePasswordNextSignIn' = $true 'password' = $tempPassword } - $JSON = $cleanedUser | ConvertTo-Json -Depth 100 -Compress + $JSON = $cleanedUser | ConvertTo-Json -Depth 20 -Compress $null = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/users' -tenantid $TenantFilter -body $JSON -type POST # Try to wrap password in PwPush link $displayPassword = $tempPassword @@ -222,16 +203,16 @@ function New-CIPPRestoreTask { $BackupGroups | ForEach-Object { try { + $CleanObj = Clean-GraphObject $_ + $JSON = $CleanObj | ConvertTo-Json -Depth 100 -Compress $DisplayName = $_.displayName if ($overwrite) { if ($_.id -in $Groups.id) { - $JSON = ConvertTo-RestorableGraphObject $_ -ForUpdate | ConvertTo-Json -Depth 100 -Compress $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/groups/$($_.id)" -tenantid $TenantFilter -body $JSON -type PATCH Write-LogMessage -message "Restored $DisplayName from backup by patching the existing object." -Sev 'info' $restorationStats['Groups'].success++ $RestoreData.Add("The group existed. Restored $DisplayName from backup") } else { - $JSON = ConvertTo-RestorableGraphObject $_ -ExcludeId | ConvertTo-Json -Depth 100 -Compress $null = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/groups' -tenantid $TenantFilter -body $JSON -type POST Write-LogMessage -message "Restored $DisplayName from backup" -Sev 'info' $restorationStats['Groups'].success++ @@ -240,7 +221,6 @@ function New-CIPPRestoreTask { } if (!$overwrite) { if ($_.id -notin $Groups.id) { - $JSON = ConvertTo-RestorableGraphObject $_ -ExcludeId | ConvertTo-Json -Depth 100 -Compress $null = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/groups' -tenantid $TenantFilter -body $JSON -type POST Write-LogMessage -message "Restored $DisplayName from backup" -Sev 'info' $restorationStats['Groups'].success++ diff --git a/backend/Modules/CIPPCore/Public/New-CIPPSharepointSite.ps1 b/backend/Modules/CIPPCore/Public/New-CIPPSharepointSite.ps1 index 0c2537ebb8..10bba3c99b 100644 --- a/backend/Modules/CIPPCore/Public/New-CIPPSharepointSite.ps1 +++ b/backend/Modules/CIPPCore/Public/New-CIPPSharepointSite.ps1 @@ -93,7 +93,7 @@ function New-CIPPSharepointSite { $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter $SitePath = $SiteName -replace ' ' -replace '[^A-Za-z0-9-]' - $SiteUrl = "$($SharePointInfo.SharePointUrl)/sites/$SitePath" + $SiteUrl = "https://$($SharePointInfo.TenantName).sharepoint.com/sites/$SitePath" # Resolve site language: # - Explicit positive LCID → use it (must be in $AllowedSiteLcids) @@ -117,7 +117,7 @@ function New-CIPPSharepointSite { $RootLanguageError = $null try { $JsonAccept = @{ Accept = 'application/json;odata=nometadata' } - $RootWeb = New-GraphGetRequest -uri "$($SharePointInfo.SharePointUrl)/_api/web?`$select=Language" -tenantid $TenantFilter -scope "$($SharePointInfo.SharePointUrl)/.default" -extraHeaders $JsonAccept -UseCertificate -AsApp $true + $RootWeb = New-GraphGetRequest -uri "https://$($SharePointInfo.TenantName).sharepoint.com/_api/web?`$select=Language" -tenantid $TenantFilter -scope "$($SharePointInfo.SharePointUrl)/.default" -extraHeaders $JsonAccept -UseCertificate -AsApp $true if ($RootWeb.Language -gt 0) { $ResolvedLcid = [int]$RootWeb.Language } diff --git a/backend/Modules/CIPPCore/Public/New-CIPPTemplateRun.ps1 b/backend/Modules/CIPPCore/Public/New-CIPPTemplateRun.ps1 index fc6de8113a..0f1fe1ae51 100644 --- a/backend/Modules/CIPPCore/Public/New-CIPPTemplateRun.ps1 +++ b/backend/Modules/CIPPCore/Public/New-CIPPTemplateRun.ps1 @@ -201,7 +201,7 @@ function New-CIPPTemplateRun { Write-Information "Found $($Policies.Count) policies for $($Result.id)" foreach ($Policy in $Policies) { try { - $Hash = Get-StringHash -String ($Policy | ConvertTo-Json -Depth 100 -Compress) + $Hash = Get-StringHash -String ($Policy | ConvertTo-Json -Depth 20 -Compress) $DisplayName = $Policy.displayName ?? $Policy.name $ExistingPolicy = $ExistingTemplates | Where-Object { $_.PartitionKey -eq 'IntuneTemplate' -and $_.displayName -eq $DisplayName -and $_.Source -in $SourceAliases } | Select-Object -First 1 @@ -275,36 +275,36 @@ function New-CIPPTemplateRun { continue } - $Template = New-CIPPIntuneTemplate -TenantFilter $TenantFilter -URLName 'deviceCompliancePolicies' -ID $Policy.id - if ($ExistingPolicy -and $ExistingPolicy.PartitionKey -eq 'IntuneTemplate') { - "Intune Compliance Policy $($Template.DisplayName) found, updating template" - $object = [PSCustomObject]@{ - Displayname = $Template.DisplayName - Description = $Template.Description - RAWJson = $Template.TemplateJson - Type = $Template.Type - GUID = $ExistingPolicy.GUID - } | ConvertTo-Json -Compress + $Template = New-CIPPIntuneTemplate -TenantFilter $TenantFilter -URLName 'deviceCompliancePolicies' -ID $Policy.id + if ($ExistingPolicy -and $ExistingPolicy.PartitionKey -eq 'IntuneTemplate') { + "Intune Compliance Policy $($Template.DisplayName) found, updating template" + $object = [PSCustomObject]@{ + Displayname = $Template.DisplayName + Description = $Template.Description + RAWJson = $Template.TemplateJson + Type = $Template.Type + GUID = $ExistingPolicy.GUID + } | ConvertTo-Json -Compress - Add-CIPPAzDataTableEntity @Table -Entity @{ - JSON = "$object" - RowKey = $ExistingPolicy.GUID - PartitionKey = 'IntuneTemplate' - Package = $ExistingPolicy.Package - GUID = $ExistingPolicy.GUID - SHA = $Hash - Source = $ExistingPolicy.Source - } -Force - } else { - "Intune Compliance Policy $($Template.DisplayName) not found in existing templates, creating new template" - $GUID = (New-Guid).GUID - $object = [PSCustomObject]@{ - Displayname = $Template.DisplayName - Description = $Template.Description - RAWJson = $Template.TemplateJson - Type = $Template.Type - GUID = $GUID - } | ConvertTo-Json -Compress + Add-CIPPAzDataTableEntity @Table -Entity @{ + JSON = "$object" + RowKey = $ExistingPolicy.GUID + PartitionKey = 'IntuneTemplate' + Package = $ExistingPolicy.Package + GUID = $ExistingPolicy.GUID + SHA = $Hash + Source = $ExistingPolicy.Source + } -Force + } else { + "Intune Compliance Policy $($Template.DisplayName) not found in existing templates, creating new template" + $GUID = (New-Guid).GUID + $object = [PSCustomObject]@{ + Displayname = $Template.DisplayName + Description = $Template.Description + RAWJson = $Template.TemplateJson + Type = $Template.Type + GUID = $GUID + } | ConvertTo-Json -Compress Add-CIPPAzDataTableEntity @Table -Entity @{ JSON = "$object" @@ -334,36 +334,36 @@ function New-CIPPTemplateRun { continue } - $Template = New-CIPPIntuneTemplate -TenantFilter $TenantFilter -URLName 'managedAppPolicies' -ID $Policy.id -ODataType $Policy.'@odata.type' - if ($ExistingPolicy -and $ExistingPolicy.PartitionKey -eq 'IntuneTemplate') { - "Intune Protection Policy $($Template.DisplayName) found, updating template" - $object = [PSCustomObject]@{ - Displayname = $Template.DisplayName - Description = $Template.Description - RAWJson = $Template.TemplateJson - Type = $Template.Type - GUID = $ExistingPolicy.GUID - } | ConvertTo-Json -Compress + $Template = New-CIPPIntuneTemplate -TenantFilter $TenantFilter -URLName 'managedAppPolicies' -ID $Policy.id + if ($ExistingPolicy -and $ExistingPolicy.PartitionKey -eq 'IntuneTemplate') { + "Intune Protection Policy $($Template.DisplayName) found, updating template" + $object = [PSCustomObject]@{ + Displayname = $Template.DisplayName + Description = $Template.Description + RAWJson = $Template.TemplateJson + Type = $Template.Type + GUID = $ExistingPolicy.GUID + } | ConvertTo-Json -Compress - Add-CIPPAzDataTableEntity @Table -Entity @{ - JSON = "$object" - RowKey = $ExistingPolicy.GUID - PartitionKey = 'IntuneTemplate' - Package = $ExistingPolicy.Package - SHA = $Hash - GUID = $ExistingPolicy.GUID - Source = $ExistingPolicy.Source - } -Force - } else { - "Intune Protection Policy $($Template.DisplayName) not found in existing templates, creating new template" - $GUID = (New-Guid).GUID - $object = [PSCustomObject]@{ - Displayname = $Template.DisplayName - Description = $Template.Description - RAWJson = $Template.TemplateJson - Type = $Template.Type - GUID = $GUID - } | ConvertTo-Json -Compress + Add-CIPPAzDataTableEntity @Table -Entity @{ + JSON = "$object" + RowKey = $ExistingPolicy.GUID + PartitionKey = 'IntuneTemplate' + Package = $ExistingPolicy.Package + SHA = $Hash + GUID = $ExistingPolicy.GUID + Source = $ExistingPolicy.Source + } -Force + } else { + "Intune Protection Policy $($Template.DisplayName) not found in existing templates, creating new template" + $GUID = (New-Guid).GUID + $object = [PSCustomObject]@{ + Displayname = $Template.DisplayName + Description = $Template.Description + RAWJson = $Template.TemplateJson + Type = $Template.Type + GUID = $GUID + } | ConvertTo-Json -Compress Add-CIPPAzDataTableEntity @Table -Entity @{ JSON = "$object" diff --git a/backend/Modules/CIPPCore/Public/New-CIPPUserTask.ps1 b/backend/Modules/CIPPCore/Public/New-CIPPUserTask.ps1 index 8a5a011a83..9d03d6d170 100644 --- a/backend/Modules/CIPPCore/Public/New-CIPPUserTask.ps1 +++ b/backend/Modules/CIPPCore/Public/New-CIPPUserTask.ps1 @@ -287,6 +287,39 @@ function New-CIPPUserTask { $Results.Add("Failed to set per-user MFA: $($_.Exception.Message)") } + + # Disable legacy protocols (IMAP/POP) if requested + if ($UserObj.disableLegacyProtocols -eq $true) { + try { + # Schedule this for 5 minutes later to allow mailbox provisioning + $taskObject = [PSCustomObject]@{ + TenantFilter = $UserObj.tenantFilter + Name = "Disable Legacy Protocols: $($CreationResults.Username)" + Command = @{ + value = 'Set-CIPPCASMailbox' + } + Parameters = [pscustomobject]@{ + Username = $CreationResults.Username + TenantFilter = $UserObj.tenantFilter + ImapEnabled = $false + PopEnabled = $false + } + ScheduledTime = [int64](((Get-Date).AddMinutes(5).ToUniversalTime()) - (Get-Date '1/1/1970')).TotalSeconds + PostExecution = @{ + Webhook = $false + Email = $false + PSA = $false + } + } + Add-CIPPScheduledTask -Task $taskObject -hidden $true -Headers $Headers + $Results.Add('Scheduled task to disable IMAP and POP protocols (runs in 5 minutes to allow mailbox provisioning)') + Write-LogMessage -headers $Headers -API $APIName -tenant $($UserObj.tenantFilter) -message "Scheduled task to disable legacy protocols for $($CreationResults.Username)" -Sev 'Info' + } catch { + Write-LogMessage -headers $Headers -API $APIName -tenant $($UserObj.tenantFilter) -message "Failed to schedule legacy protocol disable task. Error: $($_.Exception.Message)" -Sev 'Warning' + $Results.Add("Note: Could not schedule legacy protocol disable task: $($_.Exception.Message)") + } + } + return @{ Results = $Results Username = $CreationResults.Username diff --git a/backend/Modules/CIPPCore/Public/New-CippCustomScriptExecution.ps1 b/backend/Modules/CIPPCore/Public/New-CippCustomScriptExecution.ps1 index d76b15ade5..0b0518e619 100644 --- a/backend/Modules/CIPPCore/Public/New-CippCustomScriptExecution.ps1 +++ b/backend/Modules/CIPPCore/Public/New-CippCustomScriptExecution.ps1 @@ -41,7 +41,7 @@ function New-CippCustomScriptExecution { try { # Validate ScriptGuid if ([string]::IsNullOrWhiteSpace($ScriptGuid)) { - throw 'ScriptGuid is required' + throw [System.ArgumentException]::new('ScriptGuid is required') } # Get script from database @@ -50,7 +50,7 @@ function New-CippCustomScriptExecution { $Scripts = Get-CIPPAzDataTableEntity @Table -Filter $Filter if (-not $Scripts) { - throw "Script with GUID '$ScriptGuid' not found" + throw [System.Management.Automation.ItemNotFoundException]::new("Script with GUID '$ScriptGuid' not found") } # Get latest version @@ -59,6 +59,8 @@ function New-CippCustomScriptExecution { # Get script content $ScriptContent = $Script.ScriptContent + Write-LogMessage -API 'CustomScript' -tenant $TenantFilter -message "Executing custom script: $($Script.ScriptName) (Version: $($Script.Version))" -sev Info + # Convert Parameters to hashtable if it's a PSCustomObject (from JSON) if ($Parameters -is [PSCustomObject]) { $ParamsHash = @{} @@ -75,7 +77,7 @@ function New-CippCustomScriptExecution { $ScriptContent = Get-CIPPTextReplacement -TenantFilter $TenantFilter -Text $ScriptContent # Fast static pre-check (friendly errors). ConstrainedLanguage is the real boundary. - Test-CustomScriptSecurity -ScriptContent $ScriptContent + try { Test-CustomScriptSecurity -ScriptContent $ScriptContent } catch { throw [System.ArgumentException]::new($_.Exception.Message) } # Pre-fetch the tenant-locked cache data the script asks for (trusted side), so the # sandbox proxy can serve it. The sandbox itself has no storage/tenant access. diff --git a/backend/Modules/CIPPCore/Public/New-CippStandardsDriftClone.ps1 b/backend/Modules/CIPPCore/Public/New-CippStandardsDriftClone.ps1 index 9854c36ffb..6030331f26 100644 --- a/backend/Modules/CIPPCore/Public/New-CippStandardsDriftClone.ps1 +++ b/backend/Modules/CIPPCore/Public/New-CippStandardsDriftClone.ps1 @@ -28,7 +28,7 @@ function New-CippStandardsDriftClone { } } } - $Entity.JSON = "$(ConvertTo-Json -InputObject $data -Compress -Depth 100)" + $Entity.JSON = "$(ConvertTo-Json -InputObject $data -Compress -Depth 20)" $Entity.RowKey = "$($data.GUID)" $Entity.GUID = $data.GUID $null = Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force diff --git a/backend/Modules/CIPPCore/Public/PIM/Invoke-CIPPPIMAssignmentAction.ps1 b/backend/Modules/CIPPCore/Public/PIM/Invoke-CIPPPIMAssignmentAction.ps1 index 5d2e66cdc4..2add83ea0b 100644 --- a/backend/Modules/CIPPCore/Public/PIM/Invoke-CIPPPIMAssignmentAction.ps1 +++ b/backend/Modules/CIPPCore/Public/PIM/Invoke-CIPPPIMAssignmentAction.ps1 @@ -96,7 +96,7 @@ function Invoke-CIPPPIMAssignmentAction { $PIMCapable = [bool](Test-CIPPStandardLicense -StandardName 'PIMRoleAssignment' -TenantFilter $TenantFilter -Preset EntraP2 -SkipLog) if (-not $PIMCapable) { - throw "Tenant $TenantFilter is not licensed for Entra ID P2 / Privileged Identity Management, so PIM assignment changes are not available. Assignments can still be removed from the PIM page." + throw [System.ArgumentException]::new("Tenant $TenantFilter is not licensed for Entra ID P2 / Privileged Identity Management, so PIM assignment changes are not available. Assignments can still be removed from the PIM page.") } # Current state for this principal (cheap: filtered at Graph) and the role's policy caps. @@ -118,10 +118,10 @@ function Invoke-CIPPPIMAssignmentAction { } if ($TargetRow -and $TargetRow.MemberType -eq 'Group') { - throw "$PrincipalLabel holds $RoleName through a role-assignable group. Change the group's assignment instead of the member's." + throw [System.ArgumentException]::new("$PrincipalLabel holds $RoleName through a role-assignable group. Change the group's assignment instead of the member's.") } if ($PrincipalAppId -and $env:ApplicationID -and $PrincipalAppId -eq $env:ApplicationID) { - throw "Refusing to change the CIPP-SAM application's own role assignment for $RoleName." + throw [System.ArgumentException]::new("Refusing to change the CIPP-SAM application's own role assignment for $RoleName.") } $Before = if ($TargetRow) { @@ -166,7 +166,7 @@ function Invoke-CIPPPIMAssignmentAction { $_.AssignmentType -in @('Permanent', 'Active', 'ActivatedFromEligible') -and $_.PrincipalId -ne $PrincipalId }) if ($OtherActive.Count -eq 0) { - throw "Refusing: $PrincipalLabel is the last active Global Administrator in $TenantFilter. Assign another active Global Administrator first." + throw [System.ArgumentException]::new("Refusing: $PrincipalLabel is the last active Global Administrator in $TenantFilter. Assign another active Global Administrator first.") } } @@ -186,7 +186,7 @@ function Invoke-CIPPPIMAssignmentAction { # Entra refuses to retire an active assignment younger than five minutes # ("The Active duration is too short. Minimum Required is 5 minutes"). if ($_.Exception.Message -match 'duration is too short') { - throw "Entra requires an active assignment to exist for at least 5 minutes before it can be removed; $PrincipalLabel's $RoleName assignment was created too recently. Try again in a few minutes." + throw [System.ArgumentException]::new("Entra requires an active assignment to exist for at least 5 minutes before it can be removed; $PrincipalLabel's $RoleName assignment was created too recently. Try again in a few minutes.") } if ($_.Exception.Message -notmatch 'RoleAssignmentDoesNotExist|does not exist|NotFound|not found') { throw } $Existing = @(New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?`$filter=principalId eq '$PrincipalId' and roleDefinitionId eq '$RoleDefinitionId'" -tenantid $TenantFilter | Where-Object { ($_.directoryScopeId ?? '/') -eq $DirectoryScopeId }) @@ -215,8 +215,8 @@ function Invoke-CIPPPIMAssignmentAction { $ResultEnd = $null switch ($Action) { 'ConvertToEligible' { - if (-not $ActiveRow) { throw "$PrincipalLabel has no active $RoleName assignment to convert." } - if ($PrincipalType -eq 'ServicePrincipal') { throw "$PrincipalLabel is a service principal; PIM eligibility is only supported for users and groups. Remove the assignment instead if it is not needed." } + if (-not $ActiveRow) { throw [System.ArgumentException]::new("$PrincipalLabel has no active $RoleName assignment to convert.") } + if ($PrincipalType -eq 'ServicePrincipal') { throw [System.ArgumentException]::new("$PrincipalLabel is a service principal; PIM eligibility is only supported for users and groups. Remove the assignment instead if it is not needed.") } Test-LastGlobalAdmin if ($DurationParams.Count -eq 0) { $DurationParams.Duration = $EligibilityCap } @@ -247,8 +247,8 @@ function Invoke-CIPPPIMAssignmentAction { $ResultText = "Converted $PrincipalLabel on $RoleName from $Before to $After.$(if (-not $RemovalSeen) { ' The removal of the active assignment was accepted by Entra and is still propagating; refresh in a minute.' })" } 'GrantActive' { - if ($DurationParams.Count -eq 0) { throw 'GrantActive needs a Duration or EndDateTime.' } - if ($ActiveRow -and $ActiveRow.AssignmentType -eq 'Permanent') { throw "$PrincipalLabel already holds $RoleName permanently; convert it to eligible instead." } + if ($DurationParams.Count -eq 0) { throw [System.ArgumentException]::new('GrantActive needs a Duration or EndDateTime.') } + if ($ActiveRow -and $ActiveRow.AssignmentType -eq 'Permanent') { throw [System.ArgumentException]::new("$PrincipalLabel already holds $RoleName permanently; convert it to eligible instead.") } $Request = New-CIPPPIMScheduleRequest -Kind Assignment -Action adminAssign -PrincipalId $PrincipalId -RoleDefinitionId $RoleDefinitionId -DirectoryScopeId $DirectoryScopeId -Justification $Justification -MaxDuration $AssignmentCap @DurationParams $null = Send-ScheduleRequest -Request $Request $ResultEnd = $Request.EndDateTime @@ -256,9 +256,9 @@ function Invoke-CIPPPIMAssignmentAction { $ResultText = "Granted $PrincipalLabel a time-bound active $RoleName assignment until $(& $FormatEnd $ResultEnd)." } { $_ -in @('Extend', 'Renew') } { - if (-not $TargetRow) { throw "$PrincipalLabel has no $RoleName assignment to $($Action.ToLower())." } - if ($TargetRow.AssignmentType -eq 'Permanent') { throw "A permanent assignment cannot be extended; convert it to eligible instead." } - if ($DurationParams.Count -eq 0) { throw "$Action needs a Duration or EndDateTime." } + if (-not $TargetRow) { throw [System.ArgumentException]::new("$PrincipalLabel has no $RoleName assignment to $($Action.ToLower()).") } + if ($TargetRow.AssignmentType -eq 'Permanent') { throw [System.ArgumentException]::new("A permanent assignment cannot be extended; convert it to eligible instead.") } + if ($DurationParams.Count -eq 0) { throw [System.ArgumentException]::new("$Action needs a Duration or EndDateTime.") } $Kind = if ($TargetRow.AssignmentType -eq 'Eligible') { 'Eligibility' } else { 'Assignment' } $Cap = if ($Kind -eq 'Eligibility') { $EligibilityCap } else { $AssignmentCap } $GraphAction = if ($Action -eq 'Extend') { 'adminExtend' } else { 'adminRenew' } @@ -269,7 +269,7 @@ function Invoke-CIPPPIMAssignmentAction { $ResultText = "$($Action)ed $PrincipalLabel's $($TargetRow.AssignmentType.ToLower()) $RoleName assignment until $(& $FormatEnd $ResultEnd)." } 'Remove' { - if (-not $TargetRow) { throw "$PrincipalLabel has no $RoleName assignment to remove." } + if (-not $TargetRow) { throw [System.ArgumentException]::new("$PrincipalLabel has no $RoleName assignment to remove.") } $RemovalSeen = $true if ($TargetRow.AssignmentType -eq 'Eligible') { $Request = New-CIPPPIMScheduleRequest -Kind Eligibility -Action adminRemove -PrincipalId $PrincipalId -RoleDefinitionId $RoleDefinitionId -DirectoryScopeId $DirectoryScopeId -Justification $Justification diff --git a/backend/Modules/CIPPCore/Public/PIM/New-CIPPPIMScheduleRequest.ps1 b/backend/Modules/CIPPCore/Public/PIM/New-CIPPPIMScheduleRequest.ps1 index 97d507b38f..ade9d660b0 100644 --- a/backend/Modules/CIPPCore/Public/PIM/New-CIPPPIMScheduleRequest.ps1 +++ b/backend/Modules/CIPPCore/Public/PIM/New-CIPPPIMScheduleRequest.ps1 @@ -122,16 +122,16 @@ function New-CIPPPIMScheduleRequest { # Everything below creates or changes a schedule, so it has to end. $PermanentPattern = '^\s*(noExpiration|permanent|never|none|unlimited)\s*$' if ($Duration -match $PermanentPattern) { - throw "Refusing to build a $Kind $Action request: '$Duration' asks for a permanent (no-expiration) schedule, which CIPP never creates. Supply an ISO 8601 duration such as PT8H or P1Y." + throw [System.ArgumentException]::new("Refusing to build a $Kind $Action request: '$Duration' asks for a permanent (no-expiration) schedule, which CIPP never creates. Supply an ISO 8601 duration such as PT8H or P1Y.") } $HasDuration = -not [string]::IsNullOrWhiteSpace($Duration) $HasEnd = $PSBoundParameters.ContainsKey('EndDateTime') -and $null -ne $EndDateTime if (-not $HasDuration -and -not $HasEnd) { - throw "Refusing to build a $Kind $Action request without an expiration: CIPP never creates permanent (no-expiration) role schedules. Supply -Duration (ISO 8601) or -EndDateTime." + throw [System.ArgumentException]::new("Refusing to build a $Kind $Action request without an expiration: CIPP never creates permanent (no-expiration) role schedules. Supply -Duration (ISO 8601) or -EndDateTime.") } if ($HasDuration -and $HasEnd) { - throw 'Specify either -Duration or -EndDateTime, not both.' + throw [System.ArgumentException]::new('Specify either -Duration or -EndDateTime, not both.') } $NowUtc = [datetime]::UtcNow @@ -145,10 +145,10 @@ function New-CIPPPIMScheduleRequest { try { $DurationSpan = [System.Xml.XmlConvert]::ToTimeSpan($Duration) } catch { - throw "'$Duration' is not a valid ISO 8601 duration (expected a value such as PT8H, P1D, P6M or P1Y)." + throw [System.ArgumentException]::new("'$Duration' is not a valid ISO 8601 duration (expected a value such as PT8H, P1D, P6M or P1Y).") } if ($DurationSpan -le [timespan]::Zero) { - throw "Duration '$Duration' must be greater than zero." + throw [System.ArgumentException]::new("Duration '$Duration' must be greater than zero.") } $EffectiveSpan = $DurationSpan $ComputedEnd = $Start.Add($DurationSpan) @@ -160,10 +160,10 @@ function New-CIPPPIMScheduleRequest { } else { $EndUtc = $EndDateTime.ToUniversalTime() if ($EndUtc -le $NowUtc) { - throw "EndDateTime $($EndUtc.ToString('o')) is not in the future." + throw [System.ArgumentException]::new("EndDateTime $($EndUtc.ToString('o')) is not in the future.") } if ($EndUtc -le $Start) { - throw "EndDateTime $($EndUtc.ToString('o')) is not after the start $($Start.ToString('o'))." + throw [System.ArgumentException]::new("EndDateTime $($EndUtc.ToString('o')) is not after the start $($Start.ToString('o')).") } $EffectiveSpan = $EndUtc - $Start $ComputedEnd = $EndUtc @@ -183,7 +183,7 @@ function New-CIPPPIMScheduleRequest { if ($EffectiveSpan -gt $MaxSpan) { $Requested = [math]::Round($EffectiveSpan.TotalHours, 2) $Allowed = [math]::Round($MaxSpan.TotalHours, 2) - throw "Requested $Kind lifetime ($Requested hours) exceeds the maximum allowed ($MaxDuration = $Allowed hours). Shorten the request; CIPP does not extend limits." + throw [System.ArgumentException]::new("Requested $Kind lifetime ($Requested hours) exceeds the maximum allowed ($MaxDuration = $Allowed hours). Shorten the request; CIPP does not extend limits.") } } diff --git a/backend/Modules/CIPPCore/Public/Remove-CIPPCalendarPermissions.ps1 b/backend/Modules/CIPPCore/Public/Remove-CIPPCalendarPermissions.ps1 index afb54a02e8..edd538e811 100644 --- a/backend/Modules/CIPPCore/Public/Remove-CIPPCalendarPermissions.ps1 +++ b/backend/Modules/CIPPCore/Public/Remove-CIPPCalendarPermissions.ps1 @@ -66,9 +66,6 @@ function Remove-CIPPCalendarPermissions { # Resolve user to display name if a UPN was provided # Calendar permissions use display names, not UPNs $UserToMatch = $UserToRemove - # Exchange resolves -User by name, which is ambiguous when two recipients share one. - # Keep a unique id for Exchange; the display name is only for matching the cache. - $UserIdentifier = $UserToRemove if ($UserToRemove -match '@') { # Try to get display name from mailbox cache $MailboxItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'Mailboxes' | Where-Object { $_.RowKey -ne 'Mailboxes-Count' } @@ -76,7 +73,6 @@ function Remove-CIPPCalendarPermissions { $Mailbox = $Item.Data | ConvertFrom-Json if ($Mailbox.UPN -eq $UserToRemove -or $Mailbox.primarySmtpAddress -eq $UserToRemove) { $UserToMatch = $Mailbox.displayName - if ($Mailbox.ExternalDirectoryObjectId) { $UserIdentifier = $Mailbox.ExternalDirectoryObjectId } Write-Information "Resolved $UserToRemove to display name: $UserToMatch" -InformationAction Continue break } @@ -93,34 +89,48 @@ function Remove-CIPPCalendarPermissions { # Remove from each calendar foreach ($CalPermEntry in $CalendarPermissions.Permissions) { - $Folder = if ($CalPermEntry.FolderName) { $CalPermEntry.FolderName } else { 'Calendar' } - $CalIdentity = "$($CalPermEntry.CalendarUPN):\$Folder" - $CacheIsStale = $false - try { - $null = Remove-CIPPFolderPermission -TenantFilter $TenantFilter -FolderIdentity $CalIdentity -User $UserIdentifier -AccessRights $CalPermEntry.AccessRights -Anchor $CalPermEntry.CalendarUPN - $CacheIsStale = $true + $Folder = if ($CalPermEntry.FolderName) { $CalPermEntry.FolderName } else { 'Calendar' } + $CalIdentity = "$($CalPermEntry.CalendarUPN):\$Folder" + + try { + $RemovalResult = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Remove-MailboxFolderPermission' -cmdParams @{ + Identity = $CalIdentity + User = $UserToMatch + } -UseSystemMailbox $true + } catch { + $RemoveError = Get-CippException -Exception $_ + if ($RemoveError.NormalizedError -match 'InvalidExternalUserIdException' -and $UserToRemove -match '@') { + $ResolvedUser = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users/$UserToRemove" -tenantid $TenantFilter -NoAuthCheck $true + if ($ResolvedUser.id) { + $RemovalResult = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Remove-MailboxFolderPermission' -cmdParams @{ + Identity = $CalIdentity + User = $ResolvedUser.id + } -UseSystemMailbox $true + } else { + throw + } + } else { + throw + } + } + + Sync-CIPPCalendarPermissionCache -TenantFilter $TenantFilter -MailboxIdentity $CalPermEntry.CalendarUPN -FolderName $Folder -User $UserToMatch -Action 'Remove' $SuccessMsg = "Removed $UserToRemove from calendar $CalIdentity" Write-LogMessage -headers $Headers -API $APIName -message $SuccessMsg -Sev 'Info' -tenant $TenantFilter $Results.Add($SuccessMsg) } catch { - # Only drop the cached row when Exchange confirms there is nothing to remove. - # Any other failure leaves the permission live, and clearing the cache would - # report an offboarded user as having lost access they still have. - $CacheIsStale = $_.Exception.Message -match 'UserNotFoundInPermissionEntryException' - - $ErrorMsg = "Failed to remove $UserToRemove from calendar $($CalPermEntry.CalendarUPN): $($_.Exception.Message)" - Write-LogMessage -headers $Headers -API $APIName -message $ErrorMsg -sev 'Warning' -tenant $TenantFilter - $Results.Add($ErrorMsg) - } - - if ($CacheIsStale) { + # Sync cache even on error (permission might not exist) try { Sync-CIPPCalendarPermissionCache -TenantFilter $TenantFilter -MailboxIdentity $CalPermEntry.CalendarUPN -FolderName $Folder -User $UserToMatch -Action 'Remove' } catch { Write-Verbose "Failed to sync cache: $_" } + + $ErrorMsg = "Failed to remove $UserToRemove from calendar $($CalPermEntry.CalendarUPN): $($_.Exception.Message)" + Write-LogMessage -headers $Headers -API $APIName -message $ErrorMsg -sev 'Warning' -tenant $TenantFilter + $Results.Add($ErrorMsg) } } @@ -139,11 +149,31 @@ function Remove-CIPPCalendarPermissions { throw 'CalendarIdentity is required when not using cache' } - $MailboxUPN = if ($CalendarIdentity -match '^([^:]+):') { $Matches[1] } else { $CalendarIdentity } - $Folder = if ($CalendarIdentity -match ':\\(.+)$') { $Matches[1] } else { $FolderName } - try { - $null = Remove-CIPPFolderPermission -TenantFilter $TenantFilter -FolderIdentity $CalendarIdentity -User $UserToRemove -Anchor $MailboxUPN + try { + $RemovalResult = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Remove-MailboxFolderPermission' -cmdParams @{ + Identity = $CalendarIdentity + User = $UserToRemove + } -UseSystemMailbox $true + } catch { + $RemoveError = Get-CippException -Exception $_ + if ($RemoveError.NormalizedError -match 'InvalidExternalUserIdException' -and $UserToRemove -match '@') { + $ResolvedUser = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users/$UserToRemove" -tenantid $TenantFilter -NoAuthCheck $true + if ($ResolvedUser.id) { + $RemovalResult = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Remove-MailboxFolderPermission' -cmdParams @{ + Identity = $CalendarIdentity + User = $ResolvedUser.id + } -UseSystemMailbox $true + } else { + throw + } + } else { + throw + } + } + + $MailboxUPN = if ($CalendarIdentity -match '^([^:]+):') { $Matches[1] } else { $CalendarIdentity } + $Folder = if ($CalendarIdentity -match ':\\(.+)$') { $Matches[1] } else { $FolderName } Sync-CIPPCalendarPermissionCache -TenantFilter $TenantFilter -MailboxIdentity $MailboxUPN -FolderName $Folder -User $UserToRemove -Action 'Remove' @@ -152,14 +182,13 @@ function Remove-CIPPCalendarPermissions { return $SuccessMsg } catch { - # Only drop the cached row when Exchange confirms there is nothing to remove. - $CacheIsStale = $_.Exception.Message -match 'UserNotFoundInPermissionEntryException' - if ($CacheIsStale) { - try { - Sync-CIPPCalendarPermissionCache -TenantFilter $TenantFilter -MailboxIdentity $MailboxUPN -FolderName $Folder -User $UserToRemove -Action 'Remove' - } catch { - Write-Verbose "Failed to sync cache: $_" - } + $MailboxUPN = if ($CalendarIdentity -match '^([^:]+):') { $Matches[1] } else { $CalendarIdentity } + $Folder = if ($CalendarIdentity -match ':\\(.+)$') { $Matches[1] } else { $FolderName } + + try { + Sync-CIPPCalendarPermissionCache -TenantFilter $TenantFilter -MailboxIdentity $MailboxUPN -FolderName $Folder -User $UserToRemove -Action 'Remove' + } catch { + Write-Verbose "Failed to sync cache: $_" } $ErrorMessage = Get-CippException -Exception $_ diff --git a/backend/Modules/CIPPCore/Public/Remove-CIPPGraphCalendarPermission.ps1 b/backend/Modules/CIPPCore/Public/Remove-CIPPGraphCalendarPermission.ps1 new file mode 100644 index 0000000000..dda3f82412 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Remove-CIPPGraphCalendarPermission.ps1 @@ -0,0 +1,175 @@ +function Remove-CIPPGraphCalendarPermission { + <# + .SYNOPSIS + Remove calendar permissions via Microsoft Graph calendarPermissions API. + + .DESCRIPTION + Used when Exchange Remove-MailboxFolderPermission cannot bind an ACE (e.g. orphaned + entry colliding with a live display name). Matches Graph calendarPermission rows by + email address or display name, then deletes by permission id. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$TenantFilter, + + [Parameter(Mandatory = $true)] + $MailboxUserId, + + [Parameter(Mandatory = $true)] + [string[]]$MatchValues + ) + + $MatchSet = [System.Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase) + foreach ($Value in $MatchValues) { + if (-not [string]::IsNullOrWhiteSpace($Value)) { + [void]$MatchSet.Add($Value.Trim()) + } + } + if ($MatchSet.Count -eq 0) { + return [PSCustomObject]@{ Success = $false; Message = 'No match values for Graph calendar permission remove' } + } + + try { + $Permissions = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$MailboxUserId/calendar/calendarPermissions" -tenantid $TenantFilter -AsApp $true -NoAuthCheck $true + } catch { + return [PSCustomObject]@{ + Success = $false + Message = "Graph calendarPermissions list failed: $((Get-CippException -Exception $_).NormalizedError)" + } + } + + $Removed = [System.Collections.Generic.List[string]]::new() + foreach ($Perm in @($Permissions)) { + if (-not $Perm.id) { continue } + if ($Perm.isRemovable -eq $false) { continue } + + $Email = $Perm.emailAddress.address + $Name = $Perm.emailAddress.name + $Matches = ($Email -and $MatchSet.Contains([string]$Email)) -or ($Name -and $MatchSet.Contains([string]$Name)) + if (-not $Matches) { continue } + + try { + $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/users/$MailboxUserId/calendar/calendarPermissions/$($Perm.id)" -tenantid $TenantFilter -type DELETE -body '{}' -AsApp $true -NoAuthCheck $true + $Label = $Email ?? $Name ?? $Perm.id + $Removed.Add([string]$Label) + Write-Information "Removed Graph calendarPermission $Label ($($Perm.id)) from $MailboxUserId" + } catch { + Write-Information "Failed Graph calendarPermission delete $($Perm.id): $((Get-CippException -Exception $_).NormalizedError)" + } + } + + if ($Removed.Count -gt 0) { + return [PSCustomObject]@{ + Success = $true + Message = "Removed Graph calendar permission(s): $($Removed -join ', ')" + Removed = @($Removed) + } + } + + return [PSCustomObject]@{ + Success = $false + Message = 'No matching removable Graph calendarPermission entries found' + } +} + +function Invoke-CIPPCalendarPermissionCollisionRemove { + <# + .SYNOPSIS + Last-resort remove for orphaned ACEs colliding with a live display name. + + .DESCRIPTION + Temporarily renames live Graph users that share the ACE display name (and are among + the known candidate emails/ids), removes the folder permission by display name, then + restores the original display names. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$TenantFilter, + + [Parameter(Mandatory = $true)] + [string]$FolderIdentity, + + [Parameter(Mandatory = $true)] + [string]$AclDisplayName, + + [Parameter(Mandatory = $false)] + [string[]]$ProtectedEmails, + + [Parameter(Mandatory = $false)] + $Anchor + ) + + if ([string]::IsNullOrWhiteSpace($AclDisplayName)) { + return [PSCustomObject]@{ Success = $false; Message = 'No ACL display name for collision remove' } + } + + $Escaped = $AclDisplayName -replace "'", "''" + try { + $Users = @(New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users?`$filter=displayName eq '$Escaped'&`$select=id,displayName,userPrincipalName,mail,accountEnabled,assignedLicenses" -tenantid $TenantFilter -NoAuthCheck $true) + } catch { + return [PSCustomObject]@{ Success = $false; Message = "Could not list colliding users: $((Get-CippException -Exception $_).NormalizedError)" } + } + + if ($Users.Count -lt 2 -and -not ($Users | Where-Object { ($_.mail -in $ProtectedEmails) -or ($_.userPrincipalName -in $ProtectedEmails) })) { + # Still allow rename of unique live user so orphaned ACE can bind by name + if ($Users.Count -eq 0) { + return [PSCustomObject]@{ Success = $false; Message = 'No live users found with that display name for collision remove' } + } + } + + $ProtectSet = [System.Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase) + foreach ($Email in @($ProtectedEmails)) { + if ($Email) { [void]$ProtectSet.Add($Email) } + } + + # Rename every live licensed/enabled match so the orphaned ACE display name becomes unique + $Renamed = [System.Collections.Generic.List[object]]::new() + foreach ($User in $Users) { + if (-not $User.id) { continue } + $TempName = "$AclDisplayName [CIPP-TEMP-$([guid]::NewGuid().ToString('N').Substring(0,8))]" + try { + $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/users/$($User.id)" -tenantid $TenantFilter -type PATCH -body (@{ displayName = $TempName } | ConvertTo-Json -Compress) -NoAuthCheck $true + $Renamed.Add([PSCustomObject]@{ Id = $User.id; Original = $User.displayName; Temp = $TempName; UPN = $User.userPrincipalName }) + Write-Information "Temporarily renamed $($User.userPrincipalName) to '$TempName' for orphaned ACE remove" + } catch { + Write-Information "Failed to temp-rename $($User.userPrincipalName): $((Get-CippException -Exception $_).NormalizedError)" + } + } + + $RemoveSuccess = $false + $RemoveError = $null + try { + Start-Sleep -Seconds 3 + $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Remove-MailboxFolderPermission' -cmdParams @{ + Identity = $FolderIdentity + User = $AclDisplayName + } -Anchor $Anchor -UseSystemMailbox $true + $RemoveSuccess = $true + } catch { + $RemoveError = (Get-CippException -Exception $_).NormalizedError + Write-Information "Collision remove still failed for '$AclDisplayName': $RemoveError" + } + + foreach ($Item in $Renamed) { + try { + $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/users/$($Item.Id)" -tenantid $TenantFilter -type PATCH -body (@{ displayName = $Item.Original } | ConvertTo-Json -Compress) -NoAuthCheck $true + Write-Information "Restored display name for $($Item.UPN)" + } catch { + Write-Warning "Failed to restore display name for $($Item.UPN) (was temp '$($Item.Temp)'): $((Get-CippException -Exception $_).NormalizedError)" + } + } + + if ($RemoveSuccess) { + return [PSCustomObject]@{ + Success = $true + Message = "Removed orphaned ACE '$AclDisplayName' after temporarily renaming $($Renamed.Count) live account(s)" + } + } + + return [PSCustomObject]@{ + Success = $false + Message = "Collision remove failed: $RemoveError" + } +} diff --git a/backend/Modules/CIPPCore/Public/Remove-CIPPLicense.ps1 b/backend/Modules/CIPPCore/Public/Remove-CIPPLicense.ps1 index ce8980fbcd..cc6394893b 100644 --- a/backend/Modules/CIPPCore/Public/Remove-CIPPLicense.ps1 +++ b/backend/Modules/CIPPCore/Public/Remove-CIPPLicense.ps1 @@ -100,8 +100,9 @@ function Remove-CIPPLicense { Write-LogMessage -headers $Headers -API $APIName -message "Removed $($User.displayName) from license group $GroupName" -Sev 'Info' -tenant $TenantFilter "Removed $($User.displayName) from license group $GroupName" } else { - Write-LogMessage -headers $Headers -API $APIName -message "Failed to remove $($User.displayName) from license group $GroupName. This is likely because its a Dynamic Group or synced with active directory." -Sev 'Error' -tenant $TenantFilter - "Failed to remove $($User.displayName) from license group $GroupName. This is likely because its a Dynamic Group or synced with active directory." + # Manage365: actionable remediation guidance instead of upstream's generic message + Write-LogMessage -headers $Headers -API $APIName -message "Failed to remove $($User.displayName) from license group $GroupName. If this is a Dynamic Group, update the membership rules. If it is AD Sync enabled, make this change on your local domain controller instead." -Sev 'Error' -tenant $TenantFilter + "Failed to remove $($User.displayName) from license group $GroupName. If this is a Dynamic Group, update the membership rules. If it is AD Sync enabled, make this change on your local domain controller instead." } } } @@ -114,7 +115,7 @@ function Remove-CIPPLicense { Write-LogMessage -headers $Headers -API $APIName -message "Removed $($User.displayName) from mail-enabled license group $($ExoGroup.displayName)" -Sev 'Info' -tenant $TenantFilter "Removed $($User.displayName) from mail-enabled license group $($ExoGroup.displayName)" } else { - Write-LogMessage -headers $Headers -API $APIName -message "Failed to remove $($User.displayName) from mail-enabled license group $($ExoGroup.displayName). This is likely because its a Dynamic Group or synced with active directory." -Sev 'Error' -tenant $TenantFilter + Write-LogMessage -headers $Headers -API $APIName -message "Failed to remove $($User.displayName) from mail-enabled license group $($ExoGroup.displayName). If this is a Dynamic Group, update the membership rules. If it is AD Sync enabled, make this change on your local domain controller instead." -Sev 'Error' -tenant $TenantFilter "Failed to remove $($User.displayName) from mail-enabled license group $($ExoGroup.displayName)." } } diff --git a/backend/Modules/CIPPCore/Public/Remove-CIPPMailboxPermissions.ps1 b/backend/Modules/CIPPCore/Public/Remove-CIPPMailboxPermissions.ps1 index 5dca6bd121..07a8ac66ec 100644 --- a/backend/Modules/CIPPCore/Public/Remove-CIPPMailboxPermissions.ps1 +++ b/backend/Modules/CIPPCore/Public/Remove-CIPPMailboxPermissions.ps1 @@ -73,9 +73,22 @@ function Remove-CIPPMailboxPermissions { } } 'SendAS' { - $MailboxPerms = New-ExoRequest -Anchor $userId -tenantid $Tenantfilter -cmdlet 'Remove-RecipientPermission' -cmdParams @{Identity = $userid; Trustee = $AccessUser; accessRights = @('SendAs') } + try { + $MailboxPerms = New-ExoRequest -Anchor $userId -tenantid $Tenantfilter -cmdlet 'Remove-RecipientPermission' -cmdParams @{Identity = $userid; Trustee = $AccessUser; accessRights = @('SendAs') } + } catch { + $ExoError = Get-CippException -Exception $_ + if ($ExoError.NormalizedError -match 'InvalidExternalUserIdException' -and $AccessUser -match '@') { + $ResolvedUser = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users/$AccessUser" -tenantid $TenantFilter -NoAuthCheck $true + if ($ResolvedUser.id) { + $MailboxPerms = New-ExoRequest -Anchor $userId -tenantid $Tenantfilter -cmdlet 'Remove-RecipientPermission' -cmdParams @{Identity = $userid; Trustee = $ResolvedUser.id; accessRights = @('SendAs') } + } else { + throw + } + } else { + throw + } + } - # Sync cache regardless of whether permission existed Sync-CIPPMailboxPermissionCache -TenantFilter $TenantFilter -MailboxIdentity $userid -User $AccessUser -PermissionType 'SendAs' -Action 'Remove' if ($MailboxPerms -notlike "*because the ACE isn't present*") { @@ -98,9 +111,23 @@ function Remove-CIPPMailboxPermissions { } Anchor = $userid } - $permissions = New-ExoRequest @ExoRequest + try { + $permissions = New-ExoRequest @ExoRequest + } catch { + $ExoError = Get-CippException -Exception $_ + if ($ExoError.NormalizedError -match 'InvalidExternalUserIdException' -and $AccessUser -match '@') { + $ResolvedUser = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users/$AccessUser" -tenantid $TenantFilter -NoAuthCheck $true + if ($ResolvedUser.id) { + $ExoRequest.cmdParams.user = $ResolvedUser.id + $permissions = New-ExoRequest @ExoRequest + } else { + throw + } + } else { + throw + } + } - # Sync cache regardless of whether permission existed Sync-CIPPMailboxPermissionCache -TenantFilter $TenantFilter -MailboxIdentity $userid -User $AccessUser -PermissionType 'FullAccess' -Action 'Remove' if ($permissions -notlike "*because the ACE doesn't exist on the object.*") { diff --git a/backend/Modules/CIPPCore/Public/Send-CIPPAlert.ps1 b/backend/Modules/CIPPCore/Public/Send-CIPPAlert.ps1 index 6fb8c74ae4..db15288a14 100644 --- a/backend/Modules/CIPPCore/Public/Send-CIPPAlert.ps1 +++ b/backend/Modules/CIPPCore/Public/Send-CIPPAlert.ps1 @@ -200,7 +200,7 @@ function Send-CIPPAlert { return (Get-CIPPAzDataTableEntity @DevSecretsTable -Filter "PartitionKey eq '$SecretName' and RowKey eq '$SecretName'").APIKey } - $KeyVaultName = Get-CippKeyVaultName + $KeyVaultName = ($env:WEBSITE_DEPLOYMENT_ID -split '-')[0] return (Get-CippKeyVaultSecret -VaultName $KeyVaultName -Name $SecretName -AsPlainText) } @@ -422,15 +422,10 @@ function Send-CIPPAlert { } if ($PSCmdlet.ShouldProcess('PSA', 'Sending alert')) { try { - # Tag every CIPP-generated PSA ticket title with a "[CIPP]" prefix so technicians - # can filter, group and search for them in HaloPSA's ticket views with one query. - # The prefix is only added on the PSA path - email and webhook subjects keep the - # untouched title to preserve existing recipient inbox rules. - $PsaTitle = if ($Title -match '^\[CIPP\]\s') { "$Title" } else { "[CIPP] $Title" } $Alert = @{ TenantId = $TenantFilter AlertText = "$HTMLContent" - AlertTitle = "$PsaTitle" + AlertTitle = "$($Title)" } if ($PSAReference) { # Passed through verbatim - what a reference means is the PSA extension's call. diff --git a/backend/Modules/CIPPCore/Public/Send-CIPPJITAdminApprovalNotification.ps1 b/backend/Modules/CIPPCore/Public/Send-CIPPJITAdminApprovalNotification.ps1 new file mode 100644 index 0000000000..e98e54c6c3 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Send-CIPPJITAdminApprovalNotification.ps1 @@ -0,0 +1,70 @@ +function Send-CIPPJITAdminApprovalNotification { + <# + .SYNOPSIS + Sends a JIT admin approval request event through the configured notification methods and to push subscribers + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param( + $ApprovalRequest, + [ValidateSet('Requested', 'Approved', 'Rejected')] + [string]$Status, + [string]$Note, + [string[]]$Results + ) + + try { + $Tenant = $ApprovalRequest.Tenant + $Title = switch ($Status) { + 'Requested' { "JIT Admin approval requested: $($ApprovalRequest.TargetUser) ($Tenant)" } + 'Approved' { "JIT Admin request approved: $($ApprovalRequest.TargetUser) ($Tenant)" } + 'Rejected' { "JIT Admin request rejected: $($ApprovalRequest.TargetUser) ($Tenant)" } + } + $Path = '/identity/administration/jit-admin/requests' + $ConfigTable = Get-CIPPTable -TableName Config + $CippUrl = (Get-CIPPAzDataTableEntity @ConfigTable -Filter "PartitionKey eq 'InstanceProperties' and RowKey eq 'CIPPURL'").Value + + $Details = [ordered]@{ + Event = $Status + 'Request ID' = $ApprovalRequest.RowKey + Tenant = $Tenant + User = $ApprovalRequest.TargetUser + Roles = $ApprovalRequest.RoleNames + Groups = $ApprovalRequest.GroupNames + Start = [DateTimeOffset]::FromUnixTimeSeconds([int64]$ApprovalRequest.StartDate).UtcDateTime.ToString('u') + End = [DateTimeOffset]::FromUnixTimeSeconds([int64]$ApprovalRequest.EndDate).UtcDateTime.ToString('u') + Reason = $ApprovalRequest.Reason + 'Requested by' = $ApprovalRequest.RequestedBy + Note = $Note + Results = $Results -join '; ' + } + $Rows = foreach ($Key in $Details.Keys) { + if ($Details[$Key]) { '{0}{1}' -f $Key, [System.Net.WebUtility]::HtmlEncode([string]$Details[$Key]) } + } + $Link = if ($CippUrl) { '

Open JIT Admin requests in CIPP

' -f $CippUrl, $Path } + $Html = "

$([System.Net.WebUtility]::HtmlEncode($Title))

$($Rows -join '')
$Link" + + $NotifyTable = Get-CIPPTable -TableName SchedulerConfig + $Config = Get-CIPPAzDataTableEntity @NotifyTable -Filter "PartitionKey eq 'CippNotifications' and RowKey eq 'CippNotifications'" + if ($Config.email) { $null = Send-CIPPAlert -Type 'email' -Title $Title -HTMLContent $Html -TenantFilter $Tenant -APIName 'JITAdminApproval' } + if ($Config.webhook) { $null = Send-CIPPAlert -Type 'webhook' -Title $Title -JSONContent ([pscustomobject]$Details) -TenantFilter $Tenant -APIName 'JITAdminApproval' } + if ($Config.sendtoIntegration) { $null = Send-CIPPAlert -Type 'psa' -Title $Title -HTMLContent $Html -TenantFilter $Tenant -APIName 'JITAdminApproval' } + + $PushTargets = if ($Status -eq 'Requested') { + $ApproverRoles = @($ApprovalRequest.ApproverRoles | ConvertFrom-Json) + $UsersTable = Get-CIPPTable -TableName 'allowedUsers' + foreach ($CippUser in (Get-CIPPAzDataTableEntity @UsersTable -Filter "PartitionKey eq 'User'")) { + if ($CippUser.RowKey -eq $ApprovalRequest.RequestedBy -or -not $CippUser.Roles) { continue } + if (@($CippUser.Roles | ConvertFrom-Json).Where({ $_ -in $ApproverRoles }).Count -gt 0) { $CippUser.RowKey } + } + } else { + $ApprovalRequest.RequestedBy + } + foreach ($Target in $PushTargets) { + $null = Send-CIPPAlert -Type 'push' -Title $Title -TargetUser $Target -PushMessage "$($ApprovalRequest.RoleNames) $($ApprovalRequest.GroupNames)".Trim() -Url $Path -APIName 'JITAdminApproval' + } + } catch { + Write-LogMessage -API 'JITAdminApproval' -tenant $ApprovalRequest.Tenant -message "Failed to send JIT admin approval notification: $($_.Exception.Message)" -Sev 'Warning' + } +} diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPAssignedApplication.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPAssignedApplication.ps1 index 2d16894c95..cf9697b1b5 100644 --- a/backend/Modules/CIPPCore/Public/Set-CIPPAssignedApplication.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CIPPAssignedApplication.ps1 @@ -112,9 +112,7 @@ function Set-CIPPAssignedApplication { if ($PSBoundParameters.ContainsKey('GroupIds') -and $GroupIds) { $resolvedGroupIds = $GroupIds } elseif ($GroupName) { - # Trim: the group name comes from free-text fields, and stray whitespace around - # a name would otherwise silently resolve to no groups at all. - $GroupNames = @($GroupName.Split(',').Trim() | Where-Object { $_ }) + $GroupNames = $GroupName.Split(',') $resolvedGroupIds = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/groups?$top=999&$select=id,displayName' -tenantid $TenantFilter | ForEach-Object { $Group = $_ foreach ($SingleName in $GroupNames) { @@ -130,8 +128,7 @@ function Set-CIPPAssignedApplication { # assignments legitimately resolve to no include groups here. $IncludeRequested = $GroupName -or ($GroupIds -and @($GroupIds).Count -gt 0) if (-not $resolvedGroupIds -and $IncludeRequested) { - $SearchedFor = if ($GroupNames) { @($GroupNames) -join ', ' } else { @($GroupIds) -join ', ' } - throw "No matching groups resolved for assignment request. Searched for: $SearchedFor" + throw 'No matching groups resolved for assignment request.' } foreach ($Group in $resolvedGroupIds) { diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPCASMailbox.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPCASMailbox.ps1 new file mode 100644 index 0000000000..0588613d81 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Set-CIPPCASMailbox.ps1 @@ -0,0 +1,111 @@ +function Set-CIPPCASMailbox { + <# + .SYNOPSIS + Sets CAS (Client Access Services) mailbox settings for a user + .DESCRIPTION + Configures mailbox protocol settings like IMAP, POP, EWS, MAPI, OWA, and ActiveSync + .PARAMETER Username + The user principal name or email address of the mailbox + .PARAMETER TenantFilter + The tenant ID or domain + .PARAMETER ImapEnabled + Enable or disable IMAP access + .PARAMETER PopEnabled + Enable or disable POP access + .PARAMETER EwsEnabled + Enable or disable Exchange Web Services access + .PARAMETER MAPIEnabled + Enable or disable MAPI access + .PARAMETER OWAEnabled + Enable or disable Outlook Web App access + .PARAMETER ActiveSyncEnabled + Enable or disable ActiveSync access + .FUNCTIONALITY + Internal + #> + [CmdletBinding()] + param ( + [Parameter(Mandatory = $true)] + [string]$Username, + + [Parameter(Mandatory = $true)] + [string]$TenantFilter, + + [Parameter(Mandatory = $false)] + [nullable[bool]]$ImapEnabled, + + [Parameter(Mandatory = $false)] + [nullable[bool]]$PopEnabled, + + [Parameter(Mandatory = $false)] + [nullable[bool]]$EwsEnabled, + + [Parameter(Mandatory = $false)] + [nullable[bool]]$MAPIEnabled, + + [Parameter(Mandatory = $false)] + [nullable[bool]]$OWAEnabled, + + [Parameter(Mandatory = $false)] + [nullable[bool]]$ActiveSyncEnabled, + + [Parameter(Mandatory = $false)] + $Headers + ) + + $Results = [System.Collections.Generic.List[string]]::new() + + try { + # Build the command parameters - only include explicitly set values + $CmdParams = @{ + Identity = $Username + } + + $ProtocolsChanged = @() + + if ($null -ne $ImapEnabled) { + $CmdParams['ImapEnabled'] = $ImapEnabled + $ProtocolsChanged += "IMAP=$ImapEnabled" + } + if ($null -ne $PopEnabled) { + $CmdParams['PopEnabled'] = $PopEnabled + $ProtocolsChanged += "POP=$PopEnabled" + } + if ($null -ne $EwsEnabled) { + $CmdParams['EwsEnabled'] = $EwsEnabled + $ProtocolsChanged += "EWS=$EwsEnabled" + } + if ($null -ne $MAPIEnabled) { + $CmdParams['MAPIEnabled'] = $MAPIEnabled + $ProtocolsChanged += "MAPI=$MAPIEnabled" + } + if ($null -ne $OWAEnabled) { + $CmdParams['OWAEnabled'] = $OWAEnabled + $ProtocolsChanged += "OWA=$OWAEnabled" + } + if ($null -ne $ActiveSyncEnabled) { + $CmdParams['ActiveSyncEnabled'] = $ActiveSyncEnabled + $ProtocolsChanged += "ActiveSync=$ActiveSyncEnabled" + } + + if ($ProtocolsChanged.Count -eq 0) { + $Results.Add("No protocol changes specified for $Username") + return $Results + } + + # Execute the command + $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Set-CASMailbox' -cmdParams $CmdParams + + $Message = "Successfully updated CAS mailbox settings for $Username ($($ProtocolsChanged -join ', '))" + $Results.Add($Message) + Write-LogMessage -headers $Headers -API 'Set-CIPPCASMailbox' -tenant $TenantFilter -message $Message -Sev 'Info' + + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + $Results.Add("Failed to update CAS mailbox settings for $Username. Error: $ErrorMessage") + Write-LogMessage -headers $Headers -API 'Set-CIPPCASMailbox' -tenant $TenantFilter -message "Failed to update CAS mailbox for $Username. Error: $ErrorMessage" -Sev 'Error' + throw $ErrorMessage + } + + return $Results +} diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPCPVConsent.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPCPVConsent.ps1 index 17c219e301..87737fd6d0 100644 --- a/backend/Modules/CIPPCore/Public/Set-CIPPCPVConsent.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CIPPCPVConsent.ps1 @@ -26,8 +26,6 @@ function Set-CIPPCPVConsent { if ($PSCmdlet.ShouldProcess($env:ApplicationID, "Delete Service Principal from $TenantName")) { $null = New-GraphPostRequest -Type DELETE -noauthcheck $true -uri "https://api.partnercenter.microsoft.com/v1/customers/$($TenantFilter)/applicationconsents/$($env:ApplicationID)" -scope 'https://api.partnercenter.microsoft.com/.default' -tenantid $env:TenantID } - # The SP is gone, so any cached token for this tenant is now invalid. - $null = Clear-CippTokenCache -TenantFilter $TenantFilter $Results.add("Deleted Service Principal from $TenantName") } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message @@ -63,9 +61,6 @@ function Set-CIPPCPVConsent { } Add-CIPPAzDataTableEntity @Table -Entity $GraphRequest -Force } - # Consent just changed; drop cached tokens so the next call picks up the new scopes - # instead of reusing one issued before this grant. - $null = Clear-CippTokenCache -TenantFilter $TenantFilter $Results.add("Successfully added CPV Application to tenant $($TenantName)") | Out-Null Write-LogMessage -Headers $User -API $APINAME -message "Added our Service Principal to $($TenantName)" -Sev 'Info' -tenant $Tenant.defaultDomainName -tenantId $TenantFilter } catch { diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPCalendarPermission.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPCalendarPermission.ps1 index 2e4075535c..2d0eeaf5d9 100644 --- a/backend/Modules/CIPPCore/Public/Set-CIPPCalendarPermission.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CIPPCalendarPermission.ps1 @@ -12,65 +12,105 @@ function Set-CIPPCalendarPermission { $Permissions, [bool]$CanViewPrivateItems, [bool]$SendNotificationToUser = $false, - [switch]$AutoResolveFolderName + [switch]$AutoResolveFolderName, + [string]$AclUserName ) try { - # If a pretty logging name is not provided, use the ID instead if ([string]::IsNullOrWhiteSpace($LoggingName) -and $RemoveAccess) { $LoggingName = $RemoveAccess } elseif ([string]::IsNullOrWhiteSpace($LoggingName) -and $UserToGetPermissions) { $LoggingName = $UserToGetPermissions } - # When -AutoResolveFolderName is set, look up the locale-independent FolderId. - # FolderType -eq 'Calendar' is an internal Exchange enum, always English regardless of mailbox language. - # Callers that already supply the correct localized FolderName should NOT pass this switch. - if ($AutoResolveFolderName) { - $CalFolderStats = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-MailboxFolderStatistics' -cmdParams @{ - Identity = $UserID - FolderScope = 'Calendar' - } -Anchor $UserID | Where-Object { $_.FolderType -eq 'Calendar' } - $FolderIdentity = if ($CalFolderStats) { "$($UserID):$($CalFolderStats.FolderId)" } else { "$($UserID):\$FolderName" } + $FolderMeta = Get-CIPPMailboxFolderIdentityCandidates -TenantFilter $TenantFilter -UserID $UserID -FolderName ($FolderName ?? 'Calendar') -FolderScope Calendar + $FolderIdentities = $FolderMeta.Identities + $FolderIdentity = $FolderIdentities | Select-Object -First 1 + + $TargetUser = if ($RemoveAccess) { $RemoveAccess } else { $UserToGetPermissions } + $Resolved = Resolve-CIPPFolderPermissionUser -User $TargetUser -TenantFilter $TenantFilter + # Keep remove candidate list short to stay under UI timeout + if ($RemoveAccess) { + $MergedCandidates = @( + $AclUserName + $RemoveAccess + $Resolved.UserEmail + $Resolved.UserId + ) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Select-Object -Unique + if ($MergedCandidates.Count -eq 0) { + $MergedCandidates = @($Resolved.Candidates | Select-Object -First 4) + } + } elseif (-not [string]::IsNullOrWhiteSpace($AclUserName) -and $AclUserName -ne $TargetUser) { + $AclResolved = Resolve-CIPPFolderPermissionUser -User $AclUserName -TenantFilter $TenantFilter + $MergedCandidates = @($AclUserName) + @($Resolved.Candidates) + @($AclResolved.Candidates) | Select-Object -Unique } else { - $FolderIdentity = "$($UserID):\$FolderName" + $MergedCandidates = @($Resolved.Candidates) + if (-not [string]::IsNullOrWhiteSpace($AclUserName)) { + $MergedCandidates = @($AclUserName) + $MergedCandidates | Select-Object -Unique + } } - $CalParam = [PSCustomObject]@{ - Identity = $FolderIdentity - AccessRights = @($Permissions) - User = $UserToGetPermissions - SendNotificationToUser = $SendNotificationToUser + if (-not [string]::IsNullOrWhiteSpace($AclUserName) -and ($LoggingName -eq $TargetUser -or [string]::IsNullOrWhiteSpace($LoggingName))) { + $LoggingName = $AclUserName + } elseif (-not [string]::IsNullOrWhiteSpace($Resolved.UserEmail) -and [string]::IsNullOrWhiteSpace($LoggingName)) { + $LoggingName = $Resolved.UserEmail + } elseif ($Resolved.User -and ($LoggingName -eq $TargetUser)) { + $LoggingName = $Resolved.User } + $SharingFlags = $null if ($CanViewPrivateItems) { - $CalParam | Add-Member -NotePropertyName 'SharingPermissionFlags' -NotePropertyValue 'Delegate,CanViewPrivateItems' + $SharingFlags = 'Delegate,CanViewPrivateItems' } if ($RemoveAccess) { if ($PSCmdlet.ShouldProcess("$UserID\$FolderName", "Remove permissions for $LoggingName")) { - $null = Remove-CIPPFolderPermission -TenantFilter $TenantFilter -FolderIdentity $FolderIdentity -User $RemoveAccess -AccessRights ($Permissions -join ', ') -Anchor $UserID - $Result = "Successfully removed access for $LoggingName from calendar $($CalParam.Identity)" + try { + $Attempt = Invoke-CIPPMailboxFolderPermissionAttempt -Action Remove -TenantFilter $TenantFilter -FolderIdentities $FolderIdentities -Candidates $MergedCandidates -AclUserNames @($AclUserName) -Anchor $UserID + $Result = "Successfully removed access for $LoggingName from calendar $($Attempt.UsedFolder)" + if ($Attempt.UsedUser -and $Attempt.UsedUser -ne $RemoveAccess) { + $Result += " (resolved as $($Attempt.UsedUser))" + } + } catch { + $ExoError = (Get-CippException -Exception $_).NormalizedError + Write-Information "EXO calendar permission remove failed, trying Graph/collision fallbacks: $ExoError" + + $GraphResult = Remove-CIPPGraphCalendarPermission -TenantFilter $TenantFilter -MailboxUserId $UserID -MatchValues $MergedCandidates + if ($GraphResult.Success) { + $Result = $GraphResult.Message + } else { + Write-Information "Graph calendar permission remove: $($GraphResult.Message)" + $Collision = Invoke-CIPPCalendarPermissionCollisionRemove -TenantFilter $TenantFilter -FolderIdentity ($FolderIdentities | Select-Object -First 1) -AclDisplayName ($AclUserName ?? $LoggingName) -ProtectedEmails $MergedCandidates -Anchor $UserID + if ($Collision.Success) { + $Result = $Collision.Message + } else { + throw "Failed after Exchange, Graph, and display-name collision remove attempts. EXO: $ExoError | Graph: $($GraphResult.Message) | Collision: $($Collision.Message). Manual workaround: temporarily rename the live account that shares this display name, remove the calendar permission, then rename it back." + } + } + } Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Info - # Sync cache - Sync-CIPPCalendarPermissionCache -TenantFilter $TenantFilter -MailboxIdentity $UserID -FolderName $FolderName -User $RemoveAccess -Action 'Remove' + Sync-CIPPCalendarPermissionCache -TenantFilter $TenantFilter -MailboxIdentity $UserID -FolderName ($FolderMeta.FolderName ?? $FolderName) -User $RemoveAccess -Action 'Remove' + if ($AclUserName) { + Sync-CIPPCalendarPermissionCache -TenantFilter $TenantFilter -MailboxIdentity $UserID -FolderName ($FolderMeta.FolderName ?? $FolderName) -User $AclUserName -Action 'Remove' + } + if ($Resolved.UserEmail -and $Resolved.UserEmail -ne $RemoveAccess) { + Sync-CIPPCalendarPermissionCache -TenantFilter $TenantFilter -MailboxIdentity $UserID -FolderName ($FolderMeta.FolderName ?? $FolderName) -User $Resolved.UserEmail -Action 'Remove' + } } } else { if ($PSCmdlet.ShouldProcess("$UserID\$FolderName", "Set permissions for $LoggingName to $Permissions")) { try { - $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Set-MailboxFolderPermission' -cmdParams $CalParam -Anchor $UserID + $null = Invoke-CIPPMailboxFolderPermissionAttempt -Action Set -TenantFilter $TenantFilter -FolderIdentities $FolderIdentities -Candidates $MergedCandidates -Anchor $UserID -AccessRights @($Permissions) -SendNotificationToUser $SendNotificationToUser -SharingPermissionFlags $SharingFlags } catch { - # Set fails when there is no entry to update, so Add is the expected fallback. - # Keep Set's error too, or an unrelated Add failure hides why Set failed. - $SetError = $_ - try { - $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Add-MailboxFolderPermission' -cmdParams $CalParam -Anchor $UserID - } catch { - throw "Set-MailboxFolderPermission failed ($($SetError.Exception.Message)) and Add-MailboxFolderPermission also failed: $($_.Exception.Message)" + $SetError = Get-CippException -Exception $_ + if ($SetError.NormalizedError -match 'InvalidExternalUserIdException|Couldn.?t find user|not a valid Exchange recipient|isn.?t a valid user|not valid SMTP|no matching information') { + throw } + $null = Invoke-CIPPMailboxFolderPermissionAttempt -Action Add -TenantFilter $TenantFilter -FolderIdentities $FolderIdentities -Candidates $MergedCandidates -Anchor $UserID -AccessRights @($Permissions) -SendNotificationToUser $SendNotificationToUser -SharingPermissionFlags $SharingFlags } - $Result = "Successfully set permissions on folder $($CalParam.Identity). The user $LoggingName now has $Permissions permissions on this folder." + + $Result = "Successfully set permissions on folder $FolderIdentity. The user $LoggingName now has $Permissions permissions on this folder." if ($CanViewPrivateItems) { $Result += ' The user can also view private items.' } @@ -79,15 +119,23 @@ function Set-CIPPCalendarPermission { } Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Info - # Sync cache - Sync-CIPPCalendarPermissionCache -TenantFilter $TenantFilter -MailboxIdentity $UserID -FolderName $FolderName -User $UserToGetPermissions -Permissions $Permissions -Action 'Add' + $CacheUser = $Resolved.UserEmail ?? $UserToGetPermissions + Sync-CIPPCalendarPermissionCache -TenantFilter $TenantFilter -MailboxIdentity $UserID -FolderName ($FolderMeta.FolderName ?? $FolderName) -User $CacheUser -Permissions $Permissions -Action 'Add' } } } catch { $ErrorMessage = Get-CippException -Exception $_ Write-Warning "Error changing calendar permissions $($_.Exception.Message)" Write-Information $_.InvocationInfo.PositionMessage - $Result = "Failed to set calendar permissions for $LoggingName on $UserID : $($ErrorMessage.NormalizedError)" + + if ($ErrorMessage.NormalizedError -match 'InvalidExternalUserIdException') { + $Result = "Failed to set calendar permissions for $LoggingName on $UserID : The user '$LoggingName' is not a valid Exchange recipient. Ensure they have an Exchange Online mailbox or are a valid mail-enabled object." + } elseif ($ErrorMessage.NormalizedError -match 'no existing permission entry|UserNotFoundInPermissionEntryException|Failed after trying identities|matches multiple entries') { + $Result = "Failed to set calendar permissions for $LoggingName on $UserID : $($ErrorMessage.NormalizedError)" + } else { + $Result = "Failed to set calendar permissions for $LoggingName on $UserID : $($ErrorMessage.NormalizedError)" + } + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Error -LogData $ErrorMessage throw $Result } diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPContactPermission.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPContactPermission.ps1 index 9982404e9d..17e640f00d 100644 --- a/backend/Modules/CIPPCore/Public/Set-CIPPContactPermission.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CIPPContactPermission.ps1 @@ -10,46 +10,73 @@ function Set-CIPPContactPermission { $UserToGetPermissions, $LoggingName, $Permissions, - [bool]$SendNotificationToUser = $false + [bool]$SendNotificationToUser = $false, + [string]$AclUserName ) try { - # If a pretty logging name is not provided, use the ID instead if ([string]::IsNullOrWhiteSpace($LoggingName) -and $RemoveAccess) { $LoggingName = $RemoveAccess } elseif ([string]::IsNullOrWhiteSpace($LoggingName) -and $UserToGetPermissions) { $LoggingName = $UserToGetPermissions } - $ContactParam = [PSCustomObject]@{ - Identity = "$($UserID):\$FolderName" - AccessRights = @($Permissions) - User = $UserToGetPermissions - SendNotificationToUser = $SendNotificationToUser + $FolderMeta = Get-CIPPMailboxFolderIdentityCandidates -TenantFilter $TenantFilter -UserID $UserID -FolderName ($FolderName ?? 'Contacts') -FolderScope Contacts + $FolderIdentities = $FolderMeta.Identities + $FolderIdentity = $FolderIdentities | Select-Object -First 1 + + $TargetUser = if ($RemoveAccess) { $RemoveAccess } else { $UserToGetPermissions } + $Resolved = Resolve-CIPPFolderPermissionUser -User $TargetUser -TenantFilter $TenantFilter + if ($RemoveAccess) { + $MergedCandidates = @( + $AclUserName + $RemoveAccess + $Resolved.UserEmail + $Resolved.UserId + ) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Select-Object -Unique + if ($MergedCandidates.Count -eq 0) { + $MergedCandidates = @($Resolved.Candidates | Select-Object -First 4) + } + } elseif (-not [string]::IsNullOrWhiteSpace($AclUserName) -and $AclUserName -ne $TargetUser) { + $AclResolved = Resolve-CIPPFolderPermissionUser -User $AclUserName -TenantFilter $TenantFilter + $MergedCandidates = @($AclUserName) + @($Resolved.Candidates) + @($AclResolved.Candidates) | Select-Object -Unique + } else { + $MergedCandidates = @($Resolved.Candidates) + if (-not [string]::IsNullOrWhiteSpace($AclUserName)) { + $MergedCandidates = @($AclUserName) + $MergedCandidates | Select-Object -Unique + } + } + + if (-not [string]::IsNullOrWhiteSpace($AclUserName) -and ($LoggingName -eq $TargetUser -or [string]::IsNullOrWhiteSpace($LoggingName))) { + $LoggingName = $AclUserName + } elseif (-not [string]::IsNullOrWhiteSpace($Resolved.UserEmail) -and [string]::IsNullOrWhiteSpace($LoggingName)) { + $LoggingName = $Resolved.UserEmail + } elseif ($Resolved.User -and ($LoggingName -eq $TargetUser)) { + $LoggingName = $Resolved.User } if ($RemoveAccess) { if ($PSCmdlet.ShouldProcess("$UserID\$FolderName", "Remove permissions for $LoggingName")) { - $null = Remove-CIPPFolderPermission -TenantFilter $TenantFilter -FolderIdentity "$($UserID):\$FolderName" -User $RemoveAccess -AccessRights ($Permissions -join ', ') -Anchor $UserID - $Result = "Successfully removed access for $LoggingName from contact folder $($ContactParam.Identity)" + $Attempt = Invoke-CIPPMailboxFolderPermissionAttempt -Action Remove -TenantFilter $TenantFilter -FolderIdentities $FolderIdentities -Candidates $MergedCandidates -AclUserNames @($AclUserName) -Anchor $UserID + $Result = "Successfully removed access for $LoggingName from contact folder $($Attempt.UsedFolder)" + if ($Attempt.UsedUser -and $Attempt.UsedUser -ne $RemoveAccess) { + $Result += " (resolved as $($Attempt.UsedUser))" + } Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Info } } else { if ($PSCmdlet.ShouldProcess("$UserID\$FolderName", "Set permissions for $LoggingName to $Permissions")) { try { - $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Set-MailboxFolderPermission' -cmdParams $ContactParam -Anchor $UserID + $null = Invoke-CIPPMailboxFolderPermissionAttempt -Action Set -TenantFilter $TenantFilter -FolderIdentities $FolderIdentities -Candidates $MergedCandidates -Anchor $UserID -AccessRights @($Permissions) -SendNotificationToUser $SendNotificationToUser } catch { - # Set fails when there is no entry to update, so Add is the expected fallback. - # Keep Set's error too, or an unrelated Add failure hides why Set failed. - $SetError = $_ - try { - $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Add-MailboxFolderPermission' -cmdParams $ContactParam -Anchor $UserID - } catch { - throw "Set-MailboxFolderPermission failed ($($SetError.Exception.Message)) and Add-MailboxFolderPermission also failed: $($_.Exception.Message)" + $SetError = Get-CippException -Exception $_ + if ($SetError.NormalizedError -match 'InvalidExternalUserIdException|Couldn.?t find user|not a valid Exchange recipient|isn.?t a valid user|not valid SMTP|no matching information') { + throw } + $null = Invoke-CIPPMailboxFolderPermissionAttempt -Action Add -TenantFilter $TenantFilter -FolderIdentities $FolderIdentities -Candidates $MergedCandidates -Anchor $UserID -AccessRights @($Permissions) -SendNotificationToUser $SendNotificationToUser } - $Result = "Successfully set permissions on contact folder $($ContactParam.Identity). The user $LoggingName now has $Permissions permissions on this folder." + $Result = "Successfully set permissions on contact folder $FolderIdentity. The user $LoggingName now has $Permissions permissions on this folder." if ($SendNotificationToUser) { $Result += ' A notification has been sent to the user.' @@ -62,7 +89,13 @@ function Set-CIPPContactPermission { $ErrorMessage = Get-CippException -Exception $_ Write-Warning "Error changing contact permissions $($_.Exception.Message)" Write-Information $_.InvocationInfo.PositionMessage - $Result = "Failed to set contact permissions for $LoggingName on $UserID : $($ErrorMessage.NormalizedError)" + if ($ErrorMessage.NormalizedError -match 'InvalidExternalUserIdException') { + $Result = "Failed to set contact permissions for $LoggingName on $UserID : The user '$LoggingName' is not a valid Exchange recipient. Ensure they have an Exchange Online mailbox or are a valid mail-enabled object." + } elseif ($ErrorMessage.NormalizedError -match 'no existing permission entry|UserNotFoundInPermissionEntryException|Failed after trying identities|matches multiple entries') { + $Result = "Failed to set contact permissions for $LoggingName on $UserID : $($ErrorMessage.NormalizedError)" + } else { + $Result = "Failed to set contact permissions for $LoggingName on $UserID : $($ErrorMessage.NormalizedError)" + } Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Error -LogData $ErrorMessage throw $Result } diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1 index 6c51b141b8..e06b145327 100644 --- a/backend/Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1 @@ -28,13 +28,7 @@ function Set-CIPPDefaultAPDeploymentProfile { } try { - # Map language selection to Graph API locale values: - # 'user-select' -> empty string (lets user choose during OOBE) - # 'os-default' or $null -> $null (uses operating system default) - # Specific tag (e.g. 'en-US') -> passed through as-is - if ($Language -eq 'os-default') { - $Language = $null - } + if ($Language -in @('user-select', 'os-default')) { $Language = "$null" } # userType in outOfBoxExperienceSetting is only valid for user-driven (singleUser) mode. # The Intune API rejects it for self-deploying (shared) mode. @@ -61,8 +55,8 @@ function Set-CIPPDefaultAPDeploymentProfile { 'roleScopeTagIds' = @() 'outOfBoxExperienceSetting' = $OutOfBoxSetting } - $Body = ConvertTo-Json -InputObject $ObjBody -Depth 10 + Write-Information $Body $Profiles = New-GraphGETRequest -uri 'https://graph.microsoft.com/beta/deviceManagement/windowsAutopilotDeploymentProfiles' -tenantid $TenantFilter | Where-Object -Property displayName -EQ $DisplayName diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPMailboxPermission.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPMailboxPermission.ps1 index 7f07def04c..a6aceaa4fe 100644 --- a/backend/Modules/CIPPCore/Public/Set-CIPPMailboxPermission.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CIPPMailboxPermission.ps1 @@ -128,10 +128,26 @@ function Set-CIPPMailboxPermission { # Execute mode try { - $null = New-ExoRequest -Anchor $UserId -tenantid $TenantFilter -cmdlet $CmdletName -cmdParams $CmdletParams + try { + $null = New-ExoRequest -Anchor $UserId -tenantid $TenantFilter -cmdlet $CmdletName -cmdParams $CmdletParams + } catch { + $ExoError = Get-CippException -Exception $_ + if ($ExoError.NormalizedError -match 'InvalidExternalUserIdException' -and $AccessUser -match '@') { + $ResolvedUser = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users/$AccessUser" -tenantid $TenantFilter -NoAuthCheck $true + if ($ResolvedUser.id) { + if ($CmdletParams.ContainsKey('user')) { $CmdletParams['user'] = $ResolvedUser.id } + if ($CmdletParams.ContainsKey('Trustee')) { $CmdletParams['Trustee'] = $ResolvedUser.id } + $null = New-ExoRequest -Anchor $UserId -tenantid $TenantFilter -cmdlet $CmdletName -cmdParams $CmdletParams + } else { + throw + } + } else { + throw + } + } + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ExpectedResult -Sev 'Info' - # Sync cache for permission types that have cache entries if ($PermissionLevel -in @('FullAccess', 'SendAs', 'SendOnBehalf')) { try { Sync-CIPPMailboxPermissionCache -TenantFilter $TenantFilter -MailboxIdentity $UserId -User $AccessUser -PermissionType $PermissionLevel -Action $Action diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPMobileDevice.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPMobileDevice.ps1 index 6aced131c0..e2481f3a0a 100644 --- a/backend/Modules/CIPPCore/Public/Set-CIPPMobileDevice.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CIPPMobileDevice.ps1 @@ -20,7 +20,7 @@ function Set-CIPPMobileDevice( } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to delete Mobile Device $($Guid): $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage - return "Failed to delete Mobile Device $($Guid): $($ErrorMessage.NormalizedError)" + throw "Failed to delete Mobile Device $($Guid): $($ErrorMessage.NormalizedError)" } try { @@ -37,10 +37,10 @@ function Set-CIPPMobileDevice( $ErrorMessage = Get-CippException -Exception $_ if ($Quarantine -eq 'false') { Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to Allow Active Sync Device for $($UserId): $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage - return "Failed to Allow Active Sync Device for $($UserId): $($ErrorMessage.NormalizedError)" + throw "Failed to Allow Active Sync Device for $($UserId): $($ErrorMessage.NormalizedError)" } elseif ($Quarantine -eq 'true') { Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to Block Active Sync Device for $($UserId): $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage - return "Failed to Block Active Sync Device for $($UserId): $($ErrorMessage.NormalizedError)" + throw "Failed to Block Active Sync Device for $($UserId): $($ErrorMessage.NormalizedError)" } } } diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPNotificationConfig.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPNotificationConfig.ps1 index b43366c6fd..d5e2f92650 100644 --- a/backend/Modules/CIPPCore/Public/Set-CIPPNotificationConfig.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CIPPNotificationConfig.ps1 @@ -38,7 +38,7 @@ function Set-CIPPNotificationConfig { } Add-CIPPAzDataTableEntity @DevSecretsTable -Entity $Secret -Force | Out-Null } else { - $KeyVaultName = Get-CippKeyVaultName + $KeyVaultName = ($env:WEBSITE_DEPLOYMENT_ID -split '-')[0] Set-CippKeyVaultSecret -VaultName $KeyVaultName -Name $SecretName -SecretValue (ConvertTo-SecureString -AsPlainText -Force -String $SecretValue) | Out-Null } } diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPOutOfoffice.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPOutOfoffice.ps1 index a445e296a0..43f2d1c1b1 100644 --- a/backend/Modules/CIPPCore/Public/Set-CIPPOutOfoffice.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CIPPOutOfoffice.ps1 @@ -91,7 +91,13 @@ function Set-CIPPOutOfOffice { return $Results } catch { $ErrorMessage = Get-CippException -Exception $_ - $Results = "Could not add OOO for $($UserID). Error: $($ErrorMessage.NormalizedError)" + + if ($ErrorMessage.NormalizedError -match 'QuotaExceededException') { + $Results = "Could not set OOO for $($UserID). The mailbox has exceeded its storage quota. Free up mailbox space or increase the quota before setting an auto-reply." + } else { + $Results = "Could not set OOO for $($UserID). Error: $($ErrorMessage.NormalizedError)" + } + Write-LogMessage -headers $Headers -API $APIName -message $Results -Sev 'Error' -tenant $TenantFilter -LogData $ErrorMessage throw $Results } diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPResetPassword.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPResetPassword.ps1 index 3741209efd..2bd695a698 100644 --- a/backend/Modules/CIPPCore/Public/Set-CIPPResetPassword.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CIPPResetPassword.ps1 @@ -1,16 +1,20 @@ function Set-CIPPResetPassword { [CmdletBinding()] + [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingUsernameAndPasswordParams', '', Justification = 'Password is the new mailbox password being set for the user, not an interactive credential prompt')] param( $UserID, $DisplayName, $TenantFilter, $APIName = 'Reset Password', $Headers, - [bool]$forceChangePasswordNextSignIn = $true + [bool]$forceChangePasswordNextSignIn = $true, + [string]$Password ) try { - $password = New-passwordString + if (-not $Password) { + $Password = New-passwordString + } $UserDetails = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$($UserID)?`$select=onPremisesSyncEnabled" -noPagination $true -tenantid $TenantFilter -verbose $IsSynced = $UserDetails.onPremisesSyncEnabled -eq $true diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPSAMAdminRoles.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPSAMAdminRoles.ps1 index 7ca4ce1dca..27f582b678 100644 --- a/backend/Modules/CIPPCore/Public/Set-CIPPSAMAdminRoles.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CIPPSAMAdminRoles.ps1 @@ -17,34 +17,21 @@ function Set-CIPPSAMAdminRoles { $ActionLogs = [System.Collections.Generic.List[object]]::new() - # Default roles always assigned for all tenants - $DefaultRoles = @( - [PSCustomObject]@{ value = '17315797-102d-40b4-93e0-432062caca18'; label = 'Compliance Administrator' } - ) - $SAMRolesTable = Get-CIPPTable -tablename 'SAMRoles' $Roles = Get-CIPPAzDataTableEntity @SAMRolesTable try { - $SAMRoles = @($Roles.Roles | ConvertFrom-Json -ErrorAction Stop) + $SAMRoles = $Roles.Roles | ConvertFrom-Json -ErrorAction Stop $Tenants = $Roles.Tenants | ConvertFrom-Json -ErrorAction Stop if ($Tenants.value) { $Tenants = $Tenants.value } } catch { - $SAMRoles = @() - $Tenants = @() - } - - # Merge default roles with user-configured roles, avoiding duplicates - $ExistingValues = @($SAMRoles | ForEach-Object { $_.value }) - foreach ($DefaultRole in $DefaultRoles) { - if ($DefaultRole.value -notin $ExistingValues) { - $SAMRoles = @($SAMRoles) + @($DefaultRole) - } + $ActionLogs.Add('CIPP-SAM roles not configured') + return $ActionLogs } - if (($SAMRoles | Measure-Object).Count -gt 0 -and ($Tenants -contains $TenantFilter -or $Tenants -contains 'AllTenants' -or ($Tenants | Measure-Object).Count -eq 0)) { + if (($SAMRoles | Measure-Object).count -gt 0 -and $Tenants -contains $TenantFilter -or $Tenants -contains 'AllTenants') { $InitialRequests = @( [PSCustomObject]@{ id = 'memberOf' @@ -104,27 +91,12 @@ function Set-CIPPSAMAdminRoles { Write-Verbose ($Requests | ConvertTo-Json -Depth 5) $Results = New-GraphBulkRequest -tenantid $TenantFilter -Requests @($Requests) - $MissingRoles = [System.Collections.Generic.List[object]]::new() - foreach ($Result in $Results) { - if ($Result.status -eq 204) { - $ActionLogs.Add("Added service principal to directory role $($Result.id)") - } elseif ($Result.status -eq 404) { - # 404 means the role template was never activated in this tenant - $Role = $SAMRoles | Where-Object { $_.label -eq $Result.id } | Select-Object -First 1 - if ($Role) { $MissingRoles.Add($Role) } + $Results | ForEach-Object { + if ($_.status -eq 204) { + $ActionLogs.Add("Added service principal to directory role $($_.id)") } else { - $ActionLogs.Add("Failed to add service principal to directoryRole $($Result.id): $($Result | ConvertTo-Json -Depth 5)") - Write-Verbose ($Result | ConvertTo-Json -Depth 5) - $HasFailures = $true - } - } - foreach ($Role in $MissingRoles) { - try { - $null = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/v1.0/directoryRoles' -tenantid $TenantFilter -body (@{ roleTemplateId = $Role.value } | ConvertTo-Json -Compress) - $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/v1.0/directoryRoles(roleTemplateId='$($Role.value)')/members/`$ref" -tenantid $TenantFilter -body (@{ '@odata.id' = "https://graph.microsoft.com/v1.0/directoryObjects/$($id)" } | ConvertTo-Json -Compress) - $ActionLogs.Add("Activated directory role $($Role.label) from its template and added service principal") - } catch { - $ActionLogs.Add("Failed to activate directory role $($Role.label): $($_.Exception.Message)") + $ActionLogs.Add("Failed to add service principal to directoryRole $($_.id)") + Write-Verbose ($_ | ConvertTo-Json -Depth 5) $HasFailures = $true } } diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPSPOTenant.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPSPOTenant.ps1 index 94ae84b874..c36f1fa2a8 100644 --- a/backend/Modules/CIPPCore/Public/Set-CIPPSPOTenant.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CIPPSPOTenant.ps1 @@ -25,11 +25,6 @@ function Set-CIPPSPOTenant { .PARAMETER SharepointPrefix Prefix for the sharepoint tenant - .PARAMETER SharepointDomain - SharePoint domain that goes with the prefix (sharepoint.com, sharepoint.de, ...). Supplied by - Get-CIPPSPOTenant over the pipeline; without it the prefix alone is re-resolved rather than - assumed to be sharepoint.com. - .EXAMPLE $Properties = @{ 'EnableAIPIntegration' = $true @@ -85,13 +80,9 @@ function Set-CIPPSPOTenant { # get sharepoint admin site $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter $AdminUrl = $SharePointInfo.AdminUrl - } elseif ($SharepointDomain) { - # Prefix and domain both came off the pipeline (Get-CIPPSPOTenant) - rebuild from them. - $AdminUrl = "https://$($SharepointPrefix)-admin.$SharepointDomain" } else { - # A prefix with no domain cannot be trusted to be sharepoint.com, and this object may - # have come from a cache row predating SharepointDomain. Resolve the real one. - $AdminUrl = (Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter).AdminUrl + $tenantName = $SharepointPrefix + $AdminUrl = "https://$($tenantName)-admin.sharepoint.com" } $Identity = $Identity -replace "`n", ' ' @@ -144,7 +135,10 @@ function Set-CIPPSPOTenant { } if ($PSCmdlet.ShouldProcess($Description, 'Set Tenant Properties')) { - New-GraphPostRequest -scope "$AdminURL/.default" -tenantid $TenantFilter -Uri "$AdminURL/_vti_bin/client.svc/ProcessQuery" -Type POST -Body $XML -ContentType 'text/xml' -AddedHeaders $AdditionalHeaders @AuthSplat + $Response = New-GraphPostRequest -scope "$AdminURL/.default" -tenantid $TenantFilter -Uri "$AdminURL/_vti_bin/client.svc/ProcessQuery" -Type POST -Body $XML -ContentType 'text/xml' -AddedHeaders $AdditionalHeaders @AuthSplat + # CSOM reports a rejected write as HTTP 200 with ErrorInfo in the body + $CsomError = (@($Response).Where({ $_.ErrorInfo }) | Select-Object -First 1).ErrorInfo.ErrorMessage + if ($CsomError) { throw $CsomError } # Invalidate cached tenant data so subsequent reads reflect the change $Table = Get-CIPPTable -tablename 'cachespotenant' @@ -153,6 +147,7 @@ function Set-CIPPSPOTenant { if ($CacheEntity) { Remove-CIPPAzDataTableEntity @Table -Entity $CacheEntity } + $Response } } } diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPSharePointPerms.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPSharePointPerms.ps1 index 86567a7e12..ab64cc152c 100644 --- a/backend/Modules/CIPPCore/Public/Set-CIPPSharePointPerms.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CIPPSharePointPerms.ps1 @@ -30,6 +30,9 @@ function Set-CIPPSharePointPerms { .PARAMETER URL The site collection URL. Derived from the user's OneDrive when omitted. + + .OUTPUTS + One { resultText, state } item per user. A user that fails gets state 'error' and does not stop the rest. #> [CmdletBinding()] param ( @@ -50,12 +53,12 @@ function Set-CIPPSharePointPerms { } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } if (!$OnedriveAccessUser) { - throw 'No valid user was supplied to grant or remove OneDrive access for.' + throw [System.ArgumentException]::new('No valid user was supplied to grant or remove OneDrive access for.') } $IsSiteAdmin = $RemovePermission -ne $true $Action = $IsSiteAdmin ? 'added' : 'removed' - $Results = [system.collections.generic.list[string]]::new() + $Results = [System.Collections.Generic.List[object]]::new() try { if (!$URL) { @@ -66,7 +69,7 @@ function Set-CIPPSharePointPerms { # back as an array whenever the user had more than one drive. $URL = (New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$($UserId)/drive/root?`$select=sharepointIds" -asapp $true -tenantid $TenantFilter).sharepointIds.siteUrl if (!$URL) { - throw "Could not determine the OneDrive site URL for $UserId. The user may not have a provisioned OneDrive." + throw [System.Management.Automation.ItemNotFoundException]::new("Could not determine the OneDrive site URL for $UserId. The user may not have a provisioned OneDrive.") } } $URL = "$URL".TrimEnd('/') @@ -100,13 +103,13 @@ function Set-CIPPSharePointPerms { $Message = "Successfully $Action $AccessUser as a site collection admin of $URL" Write-LogMessage -headers $Headers -API $APIName -message $Message -Sev Info -tenant $TenantFilter - $Results.Add($Message) + $Results.Add([PSCustomObject]@{ resultText = $Message; state = 'success' }) } catch { $ErrorMessage = Get-CippException -Exception $_ $Explanation = Get-CIPPSharePointErrorMessage -ErrorMessage $_.Exception.Message $Message = "Failed to change access for $($AccessUser) on $URL - $Explanation" Write-LogMessage -headers $Headers -API $APIName -message $Message -Sev Error -tenant $TenantFilter -LogData $ErrorMessage - $Results.Add($Message) + $Results.Add([PSCustomObject]@{ resultText = $Message; state = 'error' }) } } @@ -115,6 +118,7 @@ function Set-CIPPSharePointPerms { $ErrorMessage = Get-CippException -Exception $_ $Message = "Failed to process SharePoint permissions. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -message $Message -Sev Error -tenant $TenantFilter -LogData $ErrorMessage + if ($_.Exception -is [System.Management.Automation.ItemNotFoundException]) { throw [System.Management.Automation.ItemNotFoundException]::new($Message) } throw $Message } } diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPSharePointSiteMember.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPSharePointSiteMember.ps1 index 3243179cd6..a67e96cd84 100644 --- a/backend/Modules/CIPPCore/Public/Set-CIPPSharePointSiteMember.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CIPPSharePointSiteMember.ps1 @@ -10,8 +10,9 @@ function Set-CIPPSharePointSiteMember { authentication. A removal of a user directly added to a role group on a group-connected site (MemberType 'User') targets that role group rather than the M365 group. - Returns one message per user. Only throws when no user could be processed, so a partial - failure still reports every outcome. + Returns one { resultText, state } item per user (one item for the M365 group path). Only throws + when no user could be processed, so a partial failure still reports every outcome. Invalid input + throws an ArgumentException. .PARAMETER UserPrincipalName The UPN(s) to add or remove @@ -60,9 +61,9 @@ function Set-CIPPSharePointSiteMember { $FailedCount = 0 try { - if ($UPNs.Count -eq 0) { throw 'No user was selected.' } + if ($UPNs.Count -eq 0) { throw [System.ArgumentException]::new('No user was selected.') } if (-not $AssociatedGroups.ContainsKey($Role)) { - throw "Invalid role '$Role'. Valid roles are: $($AssociatedGroups.Keys -join ', ')." + throw [System.ArgumentException]::new("Invalid role '$Role'. Valid roles are: $($AssociatedGroups.Keys -join ', ').") } $UseGraphGroup = $SharePointType -eq 'Group' -and $Role -ne 'Visitors' -and ($Add -or $MemberType -ne 'User') @@ -78,8 +79,12 @@ function Set-CIPPSharePointSiteMember { if ($Role -eq 'Owners') { $Results = foreach ($UPN in $UPNs) { + $State = 'success' try { - $UserID = (New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$UPN`?`$select=id" -tenantid $TenantFilter).id + # A guest UPN contains '#'. Graph treats that as a fragment and the + # users/{id} lookup fails, so encode it before it goes in the path. + $LookupUpn = if ($UPN -like '*#*') { [System.Web.HttpUtility]::UrlEncode($UPN) } else { $UPN } + $UserID = (New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$LookupUpn`?`$select=id" -tenantid $TenantFilter).id if ($Add) { $OwnerBody = ConvertTo-Json -Compress -InputObject @{ '@odata.id' = "https://graph.microsoft.com/v1.0/directoryObjects/$UserID" } $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/groups/$GroupId/owners/`$ref" -tenantid $TenantFilter -type POST -body $OwnerBody @@ -94,18 +99,20 @@ function Set-CIPPSharePointSiteMember { $Message = "Failed to $(if ($Add) { 'add' } else { 'remove' }) $UPN as an owner. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Message -sev Error -LogData $ErrorMessage $FailedCount++ + $State = 'error' } - $Message + [PSCustomObject]@{ resultText = $Message; state = $State } } } else { - if ($Add) { - $Results = Add-CIPPGroupMember -GroupType 'Team' -GroupID $GroupId -Member $UPNs -TenantFilter $TenantFilter -Headers $Headers + $Message = if ($Add) { + Add-CIPPGroupMember -GroupType 'Team' -GroupID $GroupId -Member $UPNs -TenantFilter $TenantFilter -Headers $Headers } else { - $Results = Remove-CIPPGroupMember -GroupType 'Team' -GroupID $GroupId -Member $UPNs -TenantFilter $TenantFilter -Headers $Headers + Remove-CIPPGroupMember -GroupType 'Team' -GroupID $GroupId -Member $UPNs -TenantFilter $TenantFilter -Headers $Headers } + $Results = [PSCustomObject]@{ resultText = $Message; state = 'success' } } } else { - if (-not $SiteUrl) { throw 'No site URL was provided for this site.' } + if (-not $SiteUrl) { throw [System.ArgumentException]::new('No site URL was provided for this site.') } $RestContext = Resolve-CIPPSharePointRestContext -TenantFilter $TenantFilter -SiteUrl $SiteUrl $Scope = $RestContext.Scope @@ -116,6 +123,7 @@ function Set-CIPPSharePointSiteMember { $Article = if ($RoleLabel -match '^[aeiou]') { 'an' } else { 'a' } $Results = foreach ($UPN in $UPNs) { + $State = 'success' try { try { $EnsureBody = ConvertTo-Json -Compress -InputObject @{ logonName = "i:0#.f|membership|$UPN" } @@ -157,19 +165,21 @@ function Set-CIPPSharePointSiteMember { $Message = "Failed to $(if ($Add) { 'add' } else { 'remove' }) $UPN. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Message -sev Error -LogData $ErrorMessage $FailedCount++ + $State = 'error' } - $Message + [PSCustomObject]@{ resultText = $Message; state = $State } } } } catch { $ErrorMessage = Get-CippException -Exception $_ $Message = "Failed to modify $Role for $($SiteUrl ?? $GroupId). Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Message -sev Error -LogData $ErrorMessage + if ($_.Exception -is [System.ArgumentException]) { throw [System.ArgumentException]::new($Message) } throw $Message } if ($FailedCount -eq $UPNs.Count) { - throw ($Results -join ' ') + throw (@($Results.resultText) -join ' ') } return $Results } diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPSherwebLicense.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPSherwebLicense.ps1 deleted file mode 100644 index fb71de2ea7..0000000000 --- a/backend/Modules/CIPPCore/Public/Set-CIPPSherwebLicense.ps1 +++ /dev/null @@ -1,15 +0,0 @@ -function Set-CIPPSherwebLicense { - param ( - [Parameter(Mandatory = $true)] - [string]$tenantFilter, - - [Parameter(Mandatory = $true)] - [string]$SKUid, - - [int]$Quantity, - [int]$Add, - [int]$Remove - ) - - Set-SherwebSubscription -SKU $SKUid -Quantity $Quantity -Add $Add -Remove $Remove -TenantFilter $tenantFilter -} diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPSignInState.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPSignInState.ps1 index ced2b88f70..0d51d28cb4 100644 --- a/backend/Modules/CIPPCore/Public/Set-CIPPSignInState.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CIPPSignInState.ps1 @@ -18,7 +18,8 @@ function Set-CIPPSignInState { Write-LogMessage -headers $Headers -API $APIName -message "Successfully set account enabled state to $AccountEnabled for $UserID" -Sev 'Info' -tenant $TenantFilter if ($UserDetails.onPremisesSyncEnabled -eq $true) { - throw "WARNING: User $UserID is AD Sync enabled. Please enable/disable in the local AD." + $State = if ($AccountEnabled) { 'enabled' } else { 'disabled' } + return "Sign-in $State for $UserID, but this user is AD Sync enabled. This change will be overwritten on the next sync. To make this change permanent, update the user account on your local domain controller instead." } else { return "Successfully set account enabled state to $AccountEnabled for $UserID" } diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPUser.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPUser.ps1 index f05d20641c..8fa5a3c530 100644 --- a/backend/Modules/CIPPCore/Public/Set-CIPPUser.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CIPPUser.ps1 @@ -35,7 +35,13 @@ function Set-CIPPUser { #Edit the user try { - $UserPrincipalName = "$($UserObj.username)@$($UserObj.Domain ? $UserObj.Domain : $UserObj.primDomain.value)" + # Card edits post the existing sign-in address and no username. Building + # username@domain in that case would replace the address with "@". + $UserPrincipalName = if ($UserObj.username) { + "$($UserObj.username)@$($UserObj.Domain ? $UserObj.Domain : $UserObj.primDomain.value)" + } else { + $UserObj.userPrincipalName + } $normalizedOtherMails = @( @($UserObj.otherMails) | ForEach-Object { if ($null -ne $_) { @@ -53,7 +59,7 @@ function Set-CIPPUser { 'displayName' = $UserObj.displayName 'department' = $UserObj.department 'mailNickname' = $UserObj.username ? $UserObj.username : $UserObj.mailNickname - 'userPrincipalName' = $UserPrincipalName + 'userPrincipalName' = $(if ($UserObj.username) { $UserPrincipalName }) 'usageLocation' = $UserObj.usageLocation.value ? $UserObj.usageLocation.value : $UserObj.usageLocation 'jobTitle' = $UserObj.jobTitle 'mobilePhone' = $UserObj.mobilePhone diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1 index 9dd7a7254d..2e32c02a57 100644 --- a/backend/Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1 @@ -49,9 +49,26 @@ function Set-CIPPUserJITAdmin { [datetime]$StartDate, [string]$Reason = 'No reason provided', $Headers, - [string]$APIName = 'Set-CIPPUserJITAdmin' + [string]$APIName = 'Set-CIPPUserJITAdmin', + [string]$ApprovalRequestId ) + if ($Action -in @('AddRoles', 'AddGroups', 'AddRolesAndGroups') -and (Get-CIPPJITAdminApprovalRequirement -Roles $Roles)) { + $ApprovalTable = Get-CIPPTable -TableName 'JITAdminRequests' + $ParsedId = [guid]::Empty + $Approval = if ([guid]::TryParse($ApprovalRequestId, [ref]$ParsedId)) { + Get-CIPPAzDataTableEntity @ApprovalTable -Filter "PartitionKey eq 'JITAdminRequest' and RowKey eq '$ParsedId'" + } + $Covered = $Approval.State -eq 'Completed' -and $Approval.Tenant -eq $TenantFilter -and $Approval.TargetUser -eq $User.UserPrincipalName -and + @($Roles).Where({ $_ -and $_ -notin @($Approval.RoleIds | ConvertFrom-Json) }).Count -eq 0 -and + @($Groups).Where({ $_ -and $_ -notin @($Approval.GroupIds | ConvertFrom-Json) }).Count -eq 0 + if (-not $Covered) { + $Message = "Blocked JIT Admin elevation of $($User.UserPrincipalName): no approved JIT Admin request covers it" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev 'Alert' + throw $Message + } + } + if ($PSCmdlet.ShouldProcess("User: $($User.UserPrincipalName)", "Action: $Action")) { if ($Action -ne 'Create') { $UserObj = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/users/$($User.UserPrincipalName)" -tenantid $TenantFilter diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPUserLicense.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPUserLicense.ps1 index eff802655a..3ebfd6d0b5 100644 --- a/backend/Modules/CIPPCore/Public/Set-CIPPUserLicense.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CIPPUserLicense.ps1 @@ -25,6 +25,23 @@ function Set-CIPPUserLicense { $Results = [System.Collections.Generic.List[string]]::new() + # Delegated assignLicense needs an Entra License Administrator role, so a profile + # edit can succeed while the license call is denied. App-only uses the SAM grant. + $FormatLicenseError = { + param($UserPrincipalName, $GraphMessage, [switch]$AfterUsageLocation, [switch]$Remove) + $Prefix = if ($Remove) { + "Failed to remove licenses for user $UserPrincipalName" + } elseif ($AfterUsageLocation) { + "Failed to assign licenses for user $UserPrincipalName after setting usage location" + } else { + "Failed to assign licenses for user $UserPrincipalName" + } + if ($GraphMessage -like '*Insufficient privileges*') { + return "$Prefix`: $GraphMessage Department or self-service SKUs cannot be assigned directly. Otherwise run a CPV refresh so the Manage365 app has User.ReadWrite.All, and confirm GDAP includes License Administrator or User Administrator." + } + return "$Prefix`: $GraphMessage" + } + # Get default usage location once for all users $Table = Get-CippTable -tablename 'UserSettings' $UserSettings = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'UserSettings' and RowKey eq 'allUsers'" @@ -64,15 +81,16 @@ function Set-CIPPUserLicense { } } - $RemoveResults = New-GraphBulkRequest -tenantid $TenantFilter -Requests @($RemoveBulkRequests) + $RemoveResults = New-GraphBulkRequest -tenantid $TenantFilter -Requests @($RemoveBulkRequests) -asapp $true foreach ($Result in $RemoveResults) { $Request = $ReplaceRequests | Where-Object { $_.UserId -eq $Result.id } if ($Result.status -ge 200 -and $Result.status -le 299) { Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message "Removed existing licenses for user $($Request.UserPrincipalName)" -Sev 'Info' } else { - $Results.Add("Failed to remove licenses for user $($Request.UserPrincipalName): $($Result.body.error.message)") - Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to remove licenses for user $($Request.UserPrincipalName): $($Result.body.error.message)" -Sev 'Error' + $RemoveError = & $FormatLicenseError -UserPrincipalName $Request.UserPrincipalName -GraphMessage $Result.body.error.message -Remove + $Results.Add($RemoveError) + Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $RemoveError -Sev 'Error' } } } @@ -96,7 +114,7 @@ function Set-CIPPUserLicense { } # Execute bulk request - $BulkResults = New-GraphBulkRequest -tenantid $TenantFilter -Requests @($BulkRequests) + $BulkResults = New-GraphBulkRequest -tenantid $TenantFilter -Requests @($BulkRequests) -asapp $true # Collect users with usage location errors $UsageLocationErrors = [System.Collections.Generic.List[object]]::new() @@ -110,8 +128,9 @@ function Set-CIPPUserLicense { } elseif ($Result.body.error.message -like '*invalid usage location*' -or $Result.body.error.message -like '*UsageLocation*') { $UsageLocationErrors.Add($Request) } else { - $Results.Add("Failed to assign licenses for user $($Request.UserPrincipalName): $($Result.body.error.message)") - Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to assign licenses for user $($Request.UserPrincipalName): $($Result.body.error.message)" -Sev 'Error' + $AssignError = & $FormatLicenseError -UserPrincipalName $Request.UserPrincipalName -GraphMessage $Result.body.error.message + $Results.Add($AssignError) + Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $AssignError -Sev 'Error' } } @@ -128,7 +147,7 @@ function Set-CIPPUserLicense { } } - $UsageLocationResults = New-GraphBulkRequest -tenantid $TenantFilter -Requests @($UsageLocationRequests) + $UsageLocationResults = New-GraphBulkRequest -tenantid $TenantFilter -Requests @($UsageLocationRequests) -asapp $true # Log usage location updates foreach ($Result in $UsageLocationResults) { @@ -156,7 +175,7 @@ function Set-CIPPUserLicense { } } - $RetryResults = New-GraphBulkRequest -tenantid $TenantFilter -Requests @($RetryBulkRequests) + $RetryResults = New-GraphBulkRequest -tenantid $TenantFilter -Requests @($RetryBulkRequests) -asapp $true foreach ($Result in $RetryResults) { $Request = $UsageLocationErrors | Where-Object { $_.UserId -eq $Result.id } @@ -165,8 +184,9 @@ function Set-CIPPUserLicense { $Results.Add("Successfully set licenses for $($Request.UserPrincipalName) after setting usage location. It may take 2–5 minutes before the changes become visible.") Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message "Assigned licenses to user $($Request.UserPrincipalName) after usage location fix. Added: $($Request.AddLicenses -join ', '); Removed: $($Request.RemoveLicenses -join ', ')" -Sev 'Info' } else { - $Results.Add("Failed to assign licenses for user $($Request.UserPrincipalName) after setting usage location: $($Result.body.error.message)") - Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to assign licenses for user $($Request.UserPrincipalName) after usage location fix: $($Result.body.error.message)" -Sev 'Error' + $RetryError = & $FormatLicenseError -UserPrincipalName $Request.UserPrincipalName -GraphMessage $Result.body.error.message -AfterUsageLocation + $Results.Add($RetryError) + Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $RetryError -Sev 'Error' } } } diff --git a/backend/Modules/CIPPCore/Public/Set-CIPPVacationGroupMembership.ps1 b/backend/Modules/CIPPCore/Public/Set-CIPPVacationGroupMembership.ps1 new file mode 100644 index 0000000000..b54732dd6f --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Set-CIPPVacationGroupMembership.ps1 @@ -0,0 +1,100 @@ +function Set-CIPPVacationGroupMembership { + <# + .SYNOPSIS + Adds users to a group for a vacation period and removes them again afterwards. + .DESCRIPTION + Add puts each user that is not already a member into the group and records who was added in the + VacationGroupMembers table under the MembershipKey. Remove takes out only those recorded users and deletes + the record, so memberships that existed before the vacation are never touched. + .PARAMETER TenantFilter + The tenant the group lives in. + .PARAMETER Users + User principal names of the users going on vacation. + .PARAMETER GroupId + The object id of the group. + .PARAMETER GroupType + Optional fallback group type passed to the group member helpers. + .PARAMETER Action + 'Add' at the start of the vacation, 'Remove' at the end. + .PARAMETER MembershipKey + Shared key linking the Add and Remove runs of one vacation. + .PARAMETER Headers + The headers to include in the request. This is supplied automatically by the API. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$TenantFilter, + [string[]]$Users, + [Parameter(Mandatory = $true)] + [string]$GroupId, + [string]$GroupType, + [Parameter(Mandatory = $true)] + [ValidateSet('Add', 'Remove')] + [string]$Action, + [Parameter(Mandatory = $true)] + [string]$MembershipKey, + $Headers, + [string]$APIName = 'Group Membership Vacation Mode' + ) + + $Table = Get-CIPPTable -tablename 'VacationGroupMembers' + + try { + if ($Action -eq 'Add') { + $Group = Get-CIPPGroupType -GroupId $GroupId -TenantFilter $TenantFilter -FallbackGroupType $GroupType + $CurrentMemberIds = @((New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/groups/$($Group.GroupId)/members?`$select=id&`$top=999" -tenantid $TenantFilter).id) + $ResolvedUsers = @(Resolve-CIPPDirectoryId -Identity $Users -TenantFilter $TenantFilter) + + $AddedUsers = [System.Collections.Generic.List[string]]::new() + $Messages = [System.Collections.Generic.List[string]]::new() + foreach ($User in $ResolvedUsers) { + if ($User.Id -and $CurrentMemberIds -contains $User.Id) { + $Messages.Add("$($User.Input) was already a member and will be left in the group.") + continue + } + # Added one at a time so only users that actually landed are recorded for removal. + try { + $null = Add-CIPPGroupMember -Headers $Headers -GroupType $GroupType -GroupId $GroupId -Member $User.Input -TenantFilter $TenantFilter -APIName $APIName + $AddedUsers.Add($User.Input) + } catch { + $Messages.Add("Failed to add $($User.Input): $($_.Exception.Message)") + } + } + + Add-CIPPAzDataTableEntity @Table -Entity ([PSCustomObject]@{ + PartitionKey = $TenantFilter + RowKey = $MembershipKey + GroupId = $GroupId + Users = [string](ConvertTo-Json -InputObject @($AddedUsers) -Compress) + }) -Force + + $Result = "Added $($AddedUsers.Count) user(s) to group $($Group.DisplayName) for vacation mode. $($Messages -join ' ')".Trim() + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev 'Info' + return $Result + } + + $Entity = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq '$TenantFilter' and RowKey eq '$MembershipKey'" + if (-not $Entity) { + # Without a record we cannot tell vacation members from standing ones, so remove nothing. + $Result = "No vacation membership record found for group $GroupId. No members were removed." + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev 'Warning' + return $Result + } + + $RecordedUsers = @($Entity.Users | ConvertFrom-Json) + $Result = if ($RecordedUsers.Count -gt 0) { + Remove-CIPPGroupMember -Headers $Headers -GroupType $GroupType -GroupId $GroupId -Member $RecordedUsers -TenantFilter $TenantFilter -APIName $APIName + } else { + "No users were added to group $GroupId for vacation mode, so none were removed." + } + Remove-CIPPAzDataTableEntity @Table -Entity $Entity -Force + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev 'Info' + return $Result + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Result = "Failed to $($Action.ToLower()) vacation group membership for group $($GroupId): $($ErrorMessage.NormalizedError)" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev 'Error' -LogData $ErrorMessage + return $Result + } +} diff --git a/backend/Modules/CIPPCore/Public/Set-CippKeyVaultSecret.ps1 b/backend/Modules/CIPPCore/Public/Set-CippKeyVaultSecret.ps1 index d2c353ec08..518131d481 100644 --- a/backend/Modules/CIPPCore/Public/Set-CippKeyVaultSecret.ps1 +++ b/backend/Modules/CIPPCore/Public/Set-CippKeyVaultSecret.ps1 @@ -55,31 +55,10 @@ function Set-CippKeyVaultSecret { # Call Key Vault REST API $uri = "https://$VaultName.vault.azure.net/secrets/$Name`?api-version=7.4" - $headers = @{ - Authorization = "Bearer $token" + $response = Invoke-CIPPRestMethod -Uri $uri -Headers @{ + Authorization = "Bearer $token" 'Content-Type' = 'application/json' - } - $response = Invoke-CIPPRestMethod -Uri $uri -Headers $headers -Method Put -Body $body -SkipHttpErrorCheck -StatusCodeVariable KvStatus -ErrorAction Stop - - if ($KvStatus -eq 409) { - # Soft delete (mandatory on all vaults) reserves a deleted secret's name - # for the retention window, and the PUT 409s until it is recovered or - # purged. This is exactly what re-running setup hits after an instance - # reset deleted the SAM secrets. Recover the deleted secret, then retry - # the write - recovery is asynchronous, so poll until the name is live. - Write-Information "Secret '$Name' is soft-deleted and blocking the write - recovering it" - $null = Invoke-CIPPRestMethod -Uri "https://$VaultName.vault.azure.net/deletedsecrets/$Name/recover?api-version=7.4" -Headers $headers -Method Post -ErrorAction Stop - $Deadline = [DateTime]::UtcNow.AddSeconds(60) - do { - Start-Sleep -Seconds 3 - $response = Invoke-CIPPRestMethod -Uri $uri -Headers $headers -Method Put -Body $body -SkipHttpErrorCheck -StatusCodeVariable KvStatus -ErrorAction Stop - } while ($KvStatus -eq 409 -and [DateTime]::UtcNow -lt $Deadline) - } - - if ($KvStatus -ge 400) { - $KvError = $response.error.message ?? ($response | ConvertTo-Json -Depth 5 -Compress) - throw "Key Vault returned $KvStatus for secret '$Name': $KvError" - } + } -Method Put -Body $body -ErrorAction Stop # Return object similar to Set-AzKeyVaultSecret for compatibility return @{ @@ -91,11 +70,7 @@ function Set-CippKeyVaultSecret { Updated = $response.attributes.updated } } catch { - # ErrorDetails carries the response body (Invoke-CIPPRestMethod attaches it), - # which holds the actual Key Vault error - the exception message alone is - # just the status line - $Detail = $_.ErrorDetails.Message ?? $_.Exception.Message - Write-Error "Failed to set secret '$Name' in vault '$VaultName': $Detail" + Write-Error "Failed to set secret '$Name' in vault '$VaultName': $($_.Exception.Message)" throw } } diff --git a/backend/Modules/CIPPCore/Public/SharePoint/Image Optimizer/Compress-CIPPImage.ps1 b/backend/Modules/CIPPCore/Public/SharePoint/Image Optimizer/Compress-CIPPImage.ps1 new file mode 100644 index 0000000000..ef0a886145 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/SharePoint/Image Optimizer/Compress-CIPPImage.ps1 @@ -0,0 +1,182 @@ +function Compress-CIPPImage { + <# + .FUNCTIONALITY + Internal + .SYNOPSIS + Re-encodes a JPEG image in-memory at a target quality to reduce file size. + .DESCRIPTION + Server-side JPEG compression for the SharePoint Image Optimizer. The function + decodes the supplied byte array to a raw bitmap and re-encodes it as a JPEG at + the requested quality. Re-encoding inherently drops EXIF/metadata (camera, GPS, + creation info) which is the desired behaviour when -StripMetadata is requested. + + Two engines are supported, tried in order: + 1. SkiaSharp - cross-platform, reliable on Windows/Linux/container hosts. + 2. System.Drawing.Common - built-in fallback, Windows-only (Microsoft does not + support it on Linux). Used only when SkiaSharp is unavailable. + + If neither engine can be loaded the function returns Success = $false with a + descriptive error so the caller can surface an actionable per-file message. + + This function NEVER performs any network/SharePoint operation. It only transforms + bytes in memory, so it is safe to unit test in isolation. + .PARAMETER ImageBytes + The original JPEG content as a byte array. + .PARAMETER Quality + Target JPEG quality (1-100). Defaults to 82. Values are clamped to 1-100. + .PARAMETER StripMetadata + When $true (default) the re-encode drops EXIF/metadata. When $false the function + still re-encodes (both engines lose most metadata on re-encode) and records a + warning that metadata preservation is not supported. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [AllowNull()] + [AllowEmptyCollection()] + [byte[]]$ImageBytes, + + [Parameter(Mandatory = $false)] + [int]$Quality = 82, + + [Parameter(Mandatory = $false)] + [bool]$StripMetadata = $true + ) + + # Clamp quality to a sane range. + if ($Quality -lt 1) { $Quality = 1 } + if ($Quality -gt 100) { $Quality = 100 } + + $Result = [PSCustomObject]@{ + Success = $false + Engine = $null + OriginalBytes = if ($null -eq $ImageBytes) { [long]0 } else { [long]$ImageBytes.Length } + CompressedBytes = [long]0 + Data = $null + Warning = $null + Error = $null + } + + if (-not $StripMetadata) { + $Result.Warning = 'Metadata preservation is not supported; re-encoding removes EXIF/metadata.' + } + + if ($null -eq $ImageBytes -or $ImageBytes.Length -eq 0) { + $Result.Error = 'No image data supplied.' + return $Result + } + + # --- Engine 1: SkiaSharp ------------------------------------------------- + $SkiaAvailable = $false + try { + if (-not ('SkiaSharp.SKBitmap' -as [type])) { + # Attempt to load a SkiaSharp assembly that may be bundled with the Function app. + $Candidates = @() + foreach ($Root in @($PSScriptRoot, $env:HOME, $env:FUNCTIONS_WORKER_RUNTIME_PATH, $PWD.Path)) { + if ($Root) { $Candidates += $Root } + } + foreach ($Root in $Candidates) { + $Dll = Get-ChildItem -Path $Root -Filter 'SkiaSharp.dll' -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1 + if ($Dll) { + Add-Type -Path $Dll.FullName -ErrorAction Stop + break + } + } + } + if ('SkiaSharp.SKBitmap' -as [type]) { $SkiaAvailable = $true } + } catch { + $SkiaAvailable = $false + } + + if ($SkiaAvailable) { + $Bitmap = $null + $Image = $null + $EncodedData = $null + try { + $Bitmap = [SkiaSharp.SKBitmap]::Decode($ImageBytes) + if ($null -eq $Bitmap) { + throw 'SkiaSharp could not decode the image (not a valid/supported JPEG).' + } + $Image = [SkiaSharp.SKImage]::FromBitmap($Bitmap) + $EncodedData = $Image.Encode([SkiaSharp.SKEncodedImageFormat]::Jpeg, $Quality) + if ($null -eq $EncodedData) { + throw 'SkiaSharp failed to encode the image.' + } + $Bytes = $EncodedData.ToArray() + $Result.Success = $true + $Result.Engine = 'SkiaSharp' + $Result.Data = $Bytes + $Result.CompressedBytes = [long]$Bytes.Length + return $Result + } catch { + $Result.Error = "SkiaSharp compression failed: $($_.Exception.Message)" + # fall through to System.Drawing fallback + } finally { + if ($EncodedData) { try { $EncodedData.Dispose() } catch {} } + if ($Image) { try { $Image.Dispose() } catch {} } + if ($Bitmap) { try { $Bitmap.Dispose() } catch {} } + } + } + + # --- Engine 2: System.Drawing.Common (Windows only) ---------------------- + $DrawingAvailable = $false + try { + Add-Type -AssemblyName System.Drawing -ErrorAction Stop + if ('System.Drawing.Bitmap' -as [type]) { $DrawingAvailable = $true } + } catch { + $DrawingAvailable = $false + } + + if ($DrawingAvailable) { + $InStream = $null + $OutStream = $null + $Img = $null + $EncoderParams = $null + try { + $InStream = [System.IO.MemoryStream]::new($ImageBytes) + $Img = [System.Drawing.Image]::FromStream($InStream, $false, $true) + + $JpegCodec = [System.Drawing.Imaging.ImageCodecInfo]::GetImageEncoders() | + Where-Object { $_.MimeType -eq 'image/jpeg' } | Select-Object -First 1 + if (-not $JpegCodec) { + throw 'No JPEG codec available in System.Drawing.' + } + + $QualityEncoder = [System.Drawing.Imaging.Encoder]::Quality + $EncoderParams = [System.Drawing.Imaging.EncoderParameters]::new(1) + $EncoderParams.Param[0] = [System.Drawing.Imaging.EncoderParameter]::new($QualityEncoder, [long]$Quality) + + # Removing property items strips EXIF/metadata on save. + if ($StripMetadata) { + foreach ($PropId in @($Img.PropertyIdList)) { + try { $Img.RemovePropertyItem($PropId) } catch {} + } + } + + $OutStream = [System.IO.MemoryStream]::new() + $Img.Save($OutStream, $JpegCodec, $EncoderParams) + $Bytes = $OutStream.ToArray() + + $Result.Success = $true + $Result.Engine = 'System.Drawing' + $Result.Data = $Bytes + $Result.CompressedBytes = [long]$Bytes.Length + # If SkiaSharp had failed earlier we still succeeded; clear that error. + $Result.Error = $null + return $Result + } catch { + $Result.Error = "System.Drawing compression failed: $($_.Exception.Message)" + return $Result + } finally { + if ($EncoderParams) { try { $EncoderParams.Dispose() } catch {} } + if ($Img) { try { $Img.Dispose() } catch {} } + if ($OutStream) { try { $OutStream.Dispose() } catch {} } + if ($InStream) { try { $InStream.Dispose() } catch {} } + } + } + + if (-not $Result.Error) { + $Result.Error = 'No supported image compression engine is available (SkiaSharp or System.Drawing). See docs/SHAREPOINT_IMAGE_OPTIMIZER.md for deployment requirements.' + } + return $Result +} diff --git a/backend/Modules/CIPPCore/Public/SharePoint/Image Optimizer/Get-CIPPSharePointFolderList.ps1 b/backend/Modules/CIPPCore/Public/SharePoint/Image Optimizer/Get-CIPPSharePointFolderList.ps1 new file mode 100644 index 0000000000..ddf222f199 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/SharePoint/Image Optimizer/Get-CIPPSharePointFolderList.ps1 @@ -0,0 +1,82 @@ +function Get-CIPPSharePointFolderList { + <# + .FUNCTIONALITY + Internal + .SYNOPSIS + Lists folders within a SharePoint document library (drive) for folder pickers. + .DESCRIPTION + Walks the drive folder tree (Microsoft Graph, app-only) and returns folder items + with their id and library-relative path. Recursion is bounded by MaxDepth and the + total returned by MaxFolders to keep the picker responsive on large libraries. + .PARAMETER TenantFilter + Tenant default domain / id. + .PARAMETER DriveId + The target document library drive id. + .PARAMETER FolderId + Folder item id to list from. Defaults to 'root'. + .PARAMETER MaxDepth + Maximum recursion depth. Default 5. + .PARAMETER MaxFolders + Maximum number of folders to return. Default 1000. + .PARAMETER ParentPath + Internal: library-relative path of the current folder. Do not set manually. + .PARAMETER CurrentDepth + Internal recursion counter. Do not set manually. + .PARAMETER Accumulator + Internal collection used across recursion. Do not set manually. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$TenantFilter, + + [Parameter(Mandatory = $true)] + [string]$DriveId, + + [Parameter(Mandatory = $false)] + [string]$FolderId = 'root', + + [Parameter(Mandatory = $false)] + [int]$MaxDepth = 5, + + [Parameter(Mandatory = $false)] + [int]$MaxFolders = 1000, + + [Parameter(Mandatory = $false)] + [string]$ParentPath = '', + + [Parameter(Mandatory = $false)] + [int]$CurrentDepth = 0, + + [Parameter(Mandatory = $false)] + [System.Collections.Generic.List[object]]$Accumulator + ) + + if (-not $Accumulator) { $Accumulator = [System.Collections.Generic.List[object]]::new() } + if ($CurrentDepth -ge $MaxDepth -or $Accumulator.Count -ge $MaxFolders) { + return $Accumulator + } + + $Uri = "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$FolderId/children?`$top=200&`$select=id,name,folder,webUrl,parentReference" + try { + $Items = New-GraphGetRequest -uri $Uri -tenantid $TenantFilter -AsApp $true -NoAuthCheck $true + $Items = @($Items) | Where-Object { $_.id -and $_.folder } + foreach ($Item in $Items) { + if ($Accumulator.Count -ge $MaxFolders) { break } + $Path = if ($ParentPath) { "$ParentPath/$($Item.name)" } else { $Item.name } + $Accumulator.Add([PSCustomObject]@{ + id = $Item.id + name = $Item.name + path = $Path + webUrl = $Item.webUrl + childCount = [int]($Item.folder.childCount ?? 0) + }) + $null = Get-CIPPSharePointFolderList -TenantFilter $TenantFilter -DriveId $DriveId -FolderId $Item.id ` + -MaxDepth $MaxDepth -MaxFolders $MaxFolders -ParentPath $Path -CurrentDepth ($CurrentDepth + 1) -Accumulator $Accumulator + } + } catch { + Write-Warning "Get-CIPPSharePointFolderList: failed to list folder $FolderId in drive $DriveId - $($_.Exception.Message)" + } + + return $Accumulator +} diff --git a/backend/Modules/CIPPCore/Public/SharePoint/Image Optimizer/Get-CIPPSharePointImageCandidate.ps1 b/backend/Modules/CIPPCore/Public/SharePoint/Image Optimizer/Get-CIPPSharePointImageCandidate.ps1 new file mode 100644 index 0000000000..5bd7380f0d --- /dev/null +++ b/backend/Modules/CIPPCore/Public/SharePoint/Image Optimizer/Get-CIPPSharePointImageCandidate.ps1 @@ -0,0 +1,165 @@ +function Get-CIPPSharePointImageCandidate { + <# + .FUNCTIONALITY + Internal + .SYNOPSIS + Recursively scans a SharePoint document library (drive) for large JPG/JPEG files. + .DESCRIPTION + Walks the drive folder tree (via Microsoft Graph, app-only) and returns JPG/JPEG + files that are at or above the supplied minimum size threshold. Used by the + SharePoint Image Optimizer audit and optimize endpoints. + + Only .jpg and .jpeg (case-insensitive) files are returned. The function reports + the total number of files scanned so callers can build accurate summaries. + + Paging is handled by New-GraphGetRequest (follows @odata.nextLink). Folder + recursion is bounded by MaxDepth. A MaxFiles cap can stop discovery early on very + large libraries. + .PARAMETER TenantFilter + Tenant default domain / id. + .PARAMETER DriveId + The target document library drive id. + .PARAMETER MinimumFileSizeMB + Minimum size (in MB) for a JPG to be considered a candidate. Default 5. + .PARAMETER FolderId + Folder item id to scan from. Defaults to 'root'. + .PARAMETER IncludeSubfolders + Recurse into subfolders. Default $true. + .PARAMETER MaxFiles + Optional cap on the number of ELIGIBLE (at/above threshold) candidate files to + collect. 0 = no cap. Below-threshold files are still reported for auditing but do + not consume this budget, so a capped Compress run is not starved by many small + images that happen to be discovered first. + .PARAMETER MaxScan + Optional hard cap on the total number of files inspected (across all subfolders). + 0 = no cap. Bounds the folder walk so a library with very few eligible images + cannot be enumerated indefinitely while searching for them. + .PARAMETER MaxDepth + Maximum recursion depth. Default 20. + .PARAMETER CurrentDepth + Internal recursion counter. Do not set manually. + .PARAMETER State + Internal shared state used to enforce the MaxFiles / MaxScan caps across the whole + recursive walk. Do not set manually. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$TenantFilter, + + [Parameter(Mandatory = $true)] + [string]$DriveId, + + [Parameter(Mandatory = $false)] + [double]$MinimumFileSizeMB = 5, + + [Parameter(Mandatory = $false)] + [string]$FolderId = 'root', + + [Parameter(Mandatory = $false)] + [bool]$IncludeSubfolders = $true, + + [Parameter(Mandatory = $false)] + [int]$MaxFiles = 0, + + [Parameter(Mandatory = $false)] + [int]$MaxScan = 0, + + [Parameter(Mandatory = $false)] + [int]$MaxDepth = 20, + + [Parameter(Mandatory = $false)] + [int]$CurrentDepth = 0, + + [Parameter(Mandatory = $false)] + [hashtable]$State + ) + + # Shared, by-reference state lets the eligible-file budget (MaxFiles) and the total + # scan cap (MaxScan) apply globally across the recursive folder walk instead of being + # reset per folder. + $IsRoot = $false + if (-not $State) { + $State = @{ + Candidates = [System.Collections.Generic.List[object]]::new() + Scanned = 0 + Eligible = 0 + } + $IsRoot = $true + } + + $ReturnRoot = { + [PSCustomObject]@{ + Candidates = @($State.Candidates) + FilesScanned = $State.Scanned + } + } + + if ($CurrentDepth -ge $MaxDepth) { + if ($IsRoot) { return & $ReturnRoot } + return + } + + $ThresholdBytes = [long]([math]::Round($MinimumFileSizeMB * 1MB)) + $Select = 'id,name,size,file,folder,parentReference,webUrl,lastModifiedDateTime,createdDateTime' + $Uri = "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$FolderId/children?`$top=200&`$select=$Select" + + try { + $Items = New-GraphGetRequest -uri $Uri -tenantid $TenantFilter -AsApp $true -NoAuthCheck $true + $Items = @($Items) | Where-Object { $_.id } + + foreach ($Item in $Items) { + if ($MaxFiles -gt 0 -and $State.Eligible -ge $MaxFiles) { break } + if ($MaxScan -gt 0 -and $State.Scanned -ge $MaxScan) { break } + + if ($Item.folder) { + if ($IncludeSubfolders) { + $null = Get-CIPPSharePointImageCandidate -TenantFilter $TenantFilter -DriveId $DriveId ` + -MinimumFileSizeMB $MinimumFileSizeMB -FolderId $Item.id -IncludeSubfolders $IncludeSubfolders ` + -MaxFiles $MaxFiles -MaxScan $MaxScan -MaxDepth $MaxDepth -CurrentDepth ($CurrentDepth + 1) -State $State + } + continue + } + + if (-not $Item.file) { continue } + $State.Scanned++ + + # Only .jpg / .jpeg, case-insensitive. + if ($Item.name -notmatch '(?i)\.(jpe?g)$') { continue } + $Extension = ($Matches[1]).ToLower() + + $SizeBytes = [long]($Item.size ?? 0) + $ParentPath = if ($Item.parentReference.path) { + $Item.parentReference.path -replace '^/drive/root:', '' -replace '^/drives/[^/]+/root:', '' + } else { '' } + $ServerRelative = if ($ParentPath) { "$ParentPath/$($Item.name)" } else { "/$($Item.name)" } + + $SkipReason = $null + if ($SizeBytes -lt $ThresholdBytes) { + $SkipReason = 'Skipped: below threshold' + } + $IsEligible = ($null -eq $SkipReason) + + $State.Candidates.Add([PSCustomObject]@{ + FileName = $Item.name + Extension = $Extension + DriveItemId = $Item.id + DriveId = $DriveId + ParentId = $Item.parentReference.id + ParentPath = $ParentPath + WebUrl = $Item.webUrl + ServerRelativePath = $ServerRelative + SizeBytes = $SizeBytes + LastModifiedDateTime = $Item.lastModifiedDateTime + CreatedDateTime = $Item.createdDateTime + Eligible = $IsEligible + SkipReason = $SkipReason + }) + if ($IsEligible) { $State.Eligible++ } + } + } catch { + Write-Warning "Get-CIPPSharePointImageCandidate: failed to list folder $FolderId in drive $DriveId - $($_.Exception.Message)" + } + + if ($IsRoot) { return & $ReturnRoot } +} diff --git a/backend/Modules/CIPPCore/Public/SharePoint/Image Optimizer/Invoke-CIPPSharePointImageOptimizer.ps1 b/backend/Modules/CIPPCore/Public/SharePoint/Image Optimizer/Invoke-CIPPSharePointImageOptimizer.ps1 new file mode 100644 index 0000000000..b54b701e93 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/SharePoint/Image Optimizer/Invoke-CIPPSharePointImageOptimizer.ps1 @@ -0,0 +1,477 @@ +function Invoke-CIPPSharePointImageOptimizer { + <# + .FUNCTIONALITY + Internal + .SYNOPSIS + Core engine for the SharePoint Image Optimizer (audit / compress / version cleanup). + .DESCRIPTION + Resolves the target document library, discovers large JPG/JPEG files, and - + depending on Mode - compresses them server-side and optionally removes old file + versions to reclaim storage. Returns the standard Image Optimizer result object. + + This function is conservative by design: + - WhatIf defaults to $true. When $true, NO file is overwritten and NO version + is deleted. + - A compressed file is uploaded ONLY when it is smaller than the original by at + least MinimumSavingsPercent. + - A file larger than the original after compression is never uploaded. + - Version cleanup runs only when explicitly requested (VersionCleanupMode other + than 'none') AND compression succeeded, and never deletes the current version. + - Errors are captured per file; one failure never aborts the batch. + .PARAMETER Mode + Audit | Compress | CompressAndCleanup + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$TenantFilter, + + [Parameter(Mandatory = $false)] + [string]$SiteId, + + [Parameter(Mandatory = $false)] + [string]$SiteUrl, + + [Parameter(Mandatory = $false)] + [string]$DriveId, + + [Parameter(Mandatory = $false)] + [string]$LibraryName, + + [Parameter(Mandatory = $false)] + [string]$FolderId, + + [Parameter(Mandatory = $false)] + [string]$FolderPath, + + [Parameter(Mandatory = $false)] + [ValidateSet('Audit', 'Compress', 'CompressAndCleanup')] + [string]$Mode = 'Audit', + + [Parameter(Mandatory = $false)] + [double]$MinimumFileSizeMB = 5, + + [Parameter(Mandatory = $false)] + [int]$JpegQuality = 82, + + [Parameter(Mandatory = $false)] + [bool]$StripMetadata = $true, + + [Parameter(Mandatory = $false)] + [double]$MinimumSavingsPercent = 15, + + [Parameter(Mandatory = $false)] + [bool]$WhatIf = $true, + + [Parameter(Mandatory = $false)] + [ValidateSet('none', 'recycle', 'permanent')] + [string]$VersionCleanupMode = 'none', + + [Parameter(Mandatory = $false)] + [int]$MaxFiles = 0, + + [Parameter(Mandatory = $false)] + [string[]]$FileIds = @(), + + [Parameter(Mandatory = $false)] + [bool]$IncludeSubfolders = $true, + + [Parameter(Mandatory = $false)] + [int]$MaxScan = 0 + ) + + # Hard safety cap to avoid runaway batches / throttling on huge libraries. + $HardCap = 500 + if ($MaxFiles -le 0 -or $MaxFiles -gt $HardCap) { $EffectiveMax = $HardCap } else { $EffectiveMax = $MaxFiles } + + if ($JpegQuality -lt 60) { $JpegQuality = 60 } + if ($JpegQuality -gt 95) { $JpegQuality = 95 } + + $Warnings = [System.Collections.Generic.List[string]]::new() + $Results = [System.Collections.Generic.List[object]]::new() + + $Output = [PSCustomObject]@{ + Tenant = $TenantFilter + SiteUrl = $SiteUrl + SiteId = $SiteId + Library = $LibraryName + DriveId = $DriveId + Folder = $FolderPath + Mode = $Mode + WhatIf = $WhatIf + Summary = [PSCustomObject]@{ + FilesScanned = 0 + EligibleFiles = 0 + FilesCompressed = 0 + FilesSkipped = 0 + OriginalBytes = [long]0 + CompressedBytes = [long]0 + EstimatedSavingsBytes = [long]0 + ActualSavingsBytes = [long]0 + VersionsDeleted = 0 + Errors = 0 + } + Results = @() + Warnings = @() + } + + # --- Resolve site id from URL if needed -------------------------------- + if (-not $SiteId -and $SiteUrl) { + try { + $Uri = [System.Uri]$SiteUrl + $Hostname = $Uri.Host + $RelPath = $Uri.AbsolutePath.TrimStart('/') + $SiteLookup = if ($RelPath) { + New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/sites/${Hostname}:/$RelPath" -tenantid $TenantFilter -AsApp $true -NoAuthCheck $true + } else { + New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/sites/$Hostname" -tenantid $TenantFilter -AsApp $true -NoAuthCheck $true + } + $SiteId = $SiteLookup.id + $Output.SiteId = $SiteId + } catch { + $Warnings.Add("Could not resolve site from URL '$SiteUrl': $($_.Exception.Message)") + } + } + + # --- Resolve drive id --------------------------------------------------- + if (-not $DriveId) { + if (-not $SiteId) { + $Warnings.Add('No DriveId could be resolved: provide DriveId, or SiteId/SiteUrl with an optional LibraryName.') + $Output.Warnings = @($Warnings) + return $Output + } + try { + $Drives = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/sites/$SiteId/drives?`$select=id,name,driveType" -tenantid $TenantFilter -AsApp $true -NoAuthCheck $true + $Drives = @($Drives) | Where-Object { $_.id } + if ($LibraryName) { + # An explicit library was requested. If it cannot be found we must NOT + # silently fall back to a different library - a compress/cleanup run would + # otherwise target (and modify) the wrong library. + $Drive = $Drives | Where-Object { $_.name -eq $LibraryName } | Select-Object -First 1 + if (-not $Drive) { + $Warnings.Add("Library '$LibraryName' was not found on the site and no files were processed. Available: $(( $Drives.name ) -join ', ').") + $Output.Warnings = @($Warnings) + return $Output + } + } + if (-not $Drive) { + $Drive = $Drives | Where-Object { $_.driveType -eq 'documentLibrary' } | Select-Object -First 1 + } + if (-not $Drive) { $Drive = $Drives | Select-Object -First 1 } + if ($Drive) { + $DriveId = $Drive.id + $Output.DriveId = $DriveId + # Always reflect the library actually targeted, never the requested name. + $Output.Library = $Drive.name + } + } catch { + $Warnings.Add("Failed to resolve drives for site: $($_.Exception.Message)") + } + } + + if (-not $DriveId) { + $Output.Warnings = @($Warnings) + return $Output + } + + # --- Resolve folder (optional) ----------------------------------------- + # A FolderId scopes the scan to a single folder. When only a path is given, + # resolve it to an item id so the scan starts there instead of the root. + $ScanFolderId = 'root' + if ($FolderId) { + $ScanFolderId = $FolderId + } elseif ($FolderPath) { + $TrimmedPath = $FolderPath.Trim('/') + if ($TrimmedPath) { + try { + $EncodedPath = ($TrimmedPath -split '/' | ForEach-Object { [System.Uri]::EscapeDataString($_) }) -join '/' + $FolderItem = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/drives/$DriveId/root:/${EncodedPath}?`$select=id,name,webUrl,folder" -tenantid $TenantFilter -AsApp $true -NoAuthCheck $true + if ($FolderItem.id -and $FolderItem.folder) { + $ScanFolderId = $FolderItem.id + $Output.Folder = $TrimmedPath + } else { + $Warnings.Add("Folder '$FolderPath' was not found in the library; scanning from the library root instead.") + } + } catch { + $Warnings.Add("Could not resolve folder '$FolderPath': $($_.Exception.Message). Scanning from the library root instead.") + } + } + } + + # --- Audit (discover candidates) --------------------------------------- + # DiscoveryMax bounds the number of ELIGIBLE (at/above threshold) files we collect, so + # a capped Compress run targets up to that many real candidates rather than stopping on + # the first small images it happens to find. A full audit (no MaxFiles) collects every + # eligible file. DiscoveryScan is a hard ceiling on files inspected so a library with + # very few large images cannot be enumerated indefinitely while searching for them. + $HardScanCap = 25000 + $DiscoveryMax = if ($MaxFiles -gt 0) { + $EffectiveMax + } elseif ($Mode -eq 'Audit') { + 0 + } else { + $EffectiveMax + } + # A full background audit may legitimately walk a whole library; everything else is + # bounded so we never enumerate an unbounded number of files looking for candidates. + # Callers bound by the HTTP gateway window (the synchronous audit endpoint) pass a + # tighter MaxScan explicitly. + $DiscoveryScan = if ($MaxScan -gt 0) { $MaxScan } elseif ($Mode -eq 'Audit' -and $MaxFiles -le 0) { 0 } else { $HardScanCap } + $Audit = Get-CIPPSharePointImageCandidate -TenantFilter $TenantFilter -DriveId $DriveId ` + -MinimumFileSizeMB $MinimumFileSizeMB -FolderId $ScanFolderId -IncludeSubfolders $IncludeSubfolders ` + -MaxFiles $DiscoveryMax -MaxScan $DiscoveryScan + $Candidates = @($Audit.Candidates) + $Output.Summary.FilesScanned = $Audit.FilesScanned + + # Filter to specifically requested files if provided (ignore null/empty entries). + $RequestedIds = @($FileIds | Where-Object { $_ }) + if ($RequestedIds.Count -gt 0) { + $Candidates = @($Candidates | Where-Object { $RequestedIds -contains $_.DriveItemId }) + } + + $Eligible = @($Candidates | Where-Object { $_.Eligible }) + $Output.Summary.EligibleFiles = $Eligible.Count + + # Warn when the eligible-file budget was filled (more eligible images likely remain) or + # when the scan ceiling was reached before the budget filled. + if ($DiscoveryMax -gt 0 -and $Eligible.Count -ge $DiscoveryMax) { + $Warnings.Add("Scan stopped after the first $DiscoveryMax eligible image(s). Narrow the scope with a folder or raise MaxFiles to cover more of the library.") + } elseif ($DiscoveryScan -gt 0 -and $Audit.FilesScanned -ge $DiscoveryScan) { + $Warnings.Add("Scan stopped after inspecting $DiscoveryScan files. Narrow the scope with a folder to ensure all eligible images are found.") + } + + # --- Audit-only mode: report and return -------------------------------- + if ($Mode -eq 'Audit') { + $EligibleBytes = [long]0 + foreach ($Cand in $Candidates) { + $Status = if ($Cand.Eligible) { 'Found' } else { $Cand.SkipReason } + $Output.Summary.OriginalBytes += $Cand.SizeBytes + if ($Cand.Eligible) { $EligibleBytes += [long]$Cand.SizeBytes } else { $Output.Summary.FilesSkipped++ } + $Results.Add((New-ImageOptimizerResultRow -Candidate $Cand -SiteUrl $Output.SiteUrl -Library $Output.Library -Status $Status)) + } + # No files are compressed during an audit, so we can only estimate. Eligible files + # are only ever uploaded when they beat MinimumSavingsPercent, which makes that + # percentage a safe lower-bound estimate of what a real run would reclaim. + if ($EligibleBytes -gt 0) { + $Output.Summary.EstimatedSavingsBytes = [long][math]::Round($EligibleBytes * ($MinimumSavingsPercent / 100)) + } + $Output.Results = @($Results) + $Output.Warnings = @($Warnings) + return $Output + } + + # --- Compress / CompressAndCleanup ------------------------------------- + $Processed = 0 + foreach ($Cand in $Candidates) { + if (-not $Cand.Eligible) { + $Output.Summary.FilesSkipped++ + $Output.Summary.OriginalBytes += $Cand.SizeBytes + $Results.Add((New-ImageOptimizerResultRow -Candidate $Cand -SiteUrl $Output.SiteUrl -Library $Output.Library -Status $Cand.SkipReason)) + continue + } + + if ($Processed -ge $EffectiveMax) { + $Warnings.Add("Reached the maximum of $EffectiveMax files for this run; remaining eligible files were not processed.") + break + } + $Processed++ + + $Row = New-ImageOptimizerResultRow -Candidate $Cand -SiteUrl $Output.SiteUrl -Library $Output.Library -Status 'Found' + $Output.Summary.OriginalBytes += $Cand.SizeBytes + + try { + # 1. Get the drive item + download URL. + $Item = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$($Cand.DriveItemId)?`$select=id,name,size,@microsoft.graph.downloadUrl,file" -tenantid $TenantFilter -AsApp $true -NoAuthCheck $true + $DownloadUrl = $Item.'@microsoft.graph.downloadUrl' + if (-not $DownloadUrl) { + $Row.Status = 'Skipped: locked' + $Row.Error = 'No download URL available (file may be checked out, locked, or inaccessible).' + $Output.Summary.FilesSkipped++ + $Results.Add($Row) + continue + } + + # Download to a temp file so binary JPEG bytes are never coerced to text. + $TempFile = [System.IO.Path]::GetTempFileName() + try { + $null = Invoke-CIPPImageHttpWithRetry -ScriptBlock { + Invoke-WebRequest -Uri $DownloadUrl -Method GET -OutFile $TempFile -UseBasicParsing -ErrorAction Stop + } + $OriginalBytes = [System.IO.File]::ReadAllBytes($TempFile) + } finally { + if (Test-Path -LiteralPath $TempFile) { Remove-Item -LiteralPath $TempFile -Force -ErrorAction SilentlyContinue } + } + + # 2. Compress in memory. + $Compress = Compress-CIPPImage -ImageBytes $OriginalBytes -Quality $JpegQuality -StripMetadata $StripMetadata + if ($Compress.Warning) { $Warnings.Add("$($Cand.FileName): $($Compress.Warning)") } + if (-not $Compress.Success) { + $Row.Status = 'Failed' + $Row.Error = $Compress.Error + $Output.Summary.Errors++ + $Results.Add($Row) + continue + } + + $Row.Engine = $Compress.Engine + $NewBytes = $Compress.CompressedBytes + $OrigLen = [long]$OriginalBytes.Length + $SavingsBytes = $OrigLen - $NewBytes + $SavingsPercent = if ($OrigLen -gt 0) { [math]::Round((($SavingsBytes / $OrigLen) * 100), 1) } else { 0 } + + $Row.OriginalBytes = $OrigLen + $Row.CompressedBytes = $NewBytes + $Row.SavingsBytes = $SavingsBytes + $Row.SavingsPercent = $SavingsPercent + + # 3. Rule 7/8: never upload if larger; respect minimum savings. + if ($NewBytes -ge $OrigLen -or $SavingsPercent -lt $MinimumSavingsPercent) { + $Row.Status = 'Skipped: compression savings too small' + $Row.CompressedBytes = 0 + $Row.SavingsBytes = 0 + $Row.SavingsPercent = 0 + $Output.Summary.FilesSkipped++ + $Results.Add($Row) + continue + } + + # 4. Upload over the original (only when not WhatIf). + if ($WhatIf) { + $Row.Status = 'Compressed' + $Output.Summary.FilesCompressed++ + $Output.Summary.CompressedBytes += $NewBytes + $Output.Summary.EstimatedSavingsBytes += $SavingsBytes + $Results.Add($Row) + continue + } + + try { + $Token = Get-GraphToken -tenantid $TenantFilter -AsApp $true + $UploadHeaders = @{ + Authorization = "Bearer $($Token.access_token)" + 'Content-Type' = 'image/jpeg' + } + $UploadUri = "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$($Cand.DriveItemId)/content" + $null = Invoke-CIPPImageHttpWithRetry -ScriptBlock { + Invoke-RestMethod -Uri $UploadUri -Method PUT -Headers $UploadHeaders -Body $Compress.Data -ErrorAction Stop + } + } catch { + $Classified = Get-ImageOptimizerUploadError -Exception $_ + $Row.Status = $Classified.Status + $Row.Error = $Classified.Message + if ($Classified.Status -eq 'Skipped: locked') { + $Output.Summary.FilesSkipped++ + } else { + $Output.Summary.Errors++ + } + $Results.Add($Row) + continue + } + + $Output.Summary.FilesCompressed++ + $Output.Summary.CompressedBytes += $NewBytes + $Output.Summary.EstimatedSavingsBytes += $SavingsBytes + $Output.Summary.ActualSavingsBytes += $SavingsBytes + $Row.Status = 'Compressed' + + # 5. Optional version cleanup (only after a real, successful upload). + if ($Mode -eq 'CompressAndCleanup' -and $VersionCleanupMode -ne 'none') { + $Cleanup = Remove-CIPPDriveItemVersion -TenantFilter $TenantFilter -DriveId $DriveId -DriveItemId $Cand.DriveItemId -CleanupMode $VersionCleanupMode -WhatIf $false + $Row.VersionCountBefore = $Cleanup.VersionCountBefore + $Row.VersionsDeleted = $Cleanup.VersionsDeleted + $Output.Summary.VersionsDeleted += $Cleanup.VersionsDeleted + foreach ($W in $Cleanup.Warnings) { if ($Warnings -notcontains $W) { $Warnings.Add($W) } } + if ($Cleanup.Errors.Count -gt 0) { + $Row.Status = 'Compressed, version cleanup failed' + $Row.Error = ($Cleanup.Errors -join '; ') + $Output.Summary.Errors++ + } else { + $Row.Status = 'Compressed and versions cleaned' + } + } + + $Results.Add($Row) + } catch { + $Row.Status = 'Failed' + $Row.Error = $_.Exception.Message + $Output.Summary.Errors++ + $Results.Add($Row) + } + } + + $Output.Results = @($Results) + $Output.Warnings = @($Warnings) + return $Output +} + +function New-ImageOptimizerResultRow { + [CmdletBinding()] + param($Candidate, $SiteUrl, $Library, [string]$Status) + [PSCustomObject]@{ + FileName = $Candidate.FileName + WebUrl = $Candidate.WebUrl + DriveItemId = $Candidate.DriveItemId + DriveId = $Candidate.DriveId + Site = $SiteUrl + Library = $Library + ServerRelativePath = $Candidate.ServerRelativePath + LastModifiedDateTime = $Candidate.LastModifiedDateTime + OriginalBytes = [long]$Candidate.SizeBytes + CompressedBytes = [long]0 + SavingsBytes = [long]0 + SavingsPercent = 0 + VersionCountBefore = 0 + VersionsDeleted = 0 + Engine = $null + Status = $Status + Error = $null + } +} + +function Invoke-CIPPImageHttpWithRetry { + <# + .SYNOPSIS + Runs a script block with simple exponential backoff for 429/503 throttling. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [scriptblock]$ScriptBlock, + + [Parameter(Mandatory = $false)] + [int]$MaxRetries = 4 + ) + $Attempt = 0 + while ($true) { + try { + return & $ScriptBlock + } catch { + $Attempt++ + $StatusCode = $null + try { $StatusCode = [int]$_.Exception.Response.StatusCode } catch {} + $IsThrottle = ($StatusCode -eq 429 -or $StatusCode -eq 503 -or $_.Exception.Message -match '(?i)too many requests|temporarily unavailable') + if (-not $IsThrottle -or $Attempt -ge $MaxRetries) { + throw + } + $RetryAfter = $null + try { $RetryAfter = [int]$_.Exception.Response.Headers['Retry-After'] } catch {} + $Delay = if ($RetryAfter -and $RetryAfter -gt 0) { $RetryAfter } else { [math]::Pow(2, $Attempt) } + Start-Sleep -Seconds $Delay + } + } +} + +function Get-ImageOptimizerUploadError { + [CmdletBinding()] + param($Exception) + $Message = $Exception.Exception.Message + $StatusCode = $null + try { $StatusCode = [int]$Exception.Exception.Response.StatusCode } catch {} + if ($StatusCode -eq 423 -or $Message -match '(?i)locked|checked out|check out') { + return [PSCustomObject]@{ Status = 'Skipped: locked'; Message = "File is locked or checked out: $Message" } + } + if ($Message -match '(?i)retention|hold|read-?only|cannot be modified') { + return [PSCustomObject]@{ Status = 'Skipped: locked'; Message = "File blocked by retention/hold or is read-only: $Message" } + } + return [PSCustomObject]@{ Status = 'Failed'; Message = "Upload failed: $Message" } +} diff --git a/backend/Modules/CIPPCore/Public/SharePoint/Image Optimizer/Remove-CIPPDriveItemVersion.ps1 b/backend/Modules/CIPPCore/Public/SharePoint/Image Optimizer/Remove-CIPPDriveItemVersion.ps1 new file mode 100644 index 0000000000..82b32b5fdd --- /dev/null +++ b/backend/Modules/CIPPCore/Public/SharePoint/Image Optimizer/Remove-CIPPDriveItemVersion.ps1 @@ -0,0 +1,138 @@ +function Remove-CIPPDriveItemVersion { + <# + .FUNCTIONALITY + Internal + .SYNOPSIS + Removes old versions of a SharePoint file, keeping the current version. + .DESCRIPTION + Reclaims storage held by SharePoint version history after a file has been replaced + with a compressed copy. Used by the SharePoint Image Optimizer. + + IMPORTANT - why SharePoint REST and not Graph: + Microsoft Graph officially supports list/get/download/restore of driveItem + versions but does NOT officially support deleting a specific version. The reliable, + supported mechanism is the SharePoint REST file versions API: + {siteUrl}/_api/web/GetFileById('{uniqueId}')/versions/recycleAll() + {siteUrl}/_api/web/GetFileById('{uniqueId}')/versions/deleteAll() + SharePoint REST `_api/web/*` is DELEGATED-ONLY (no -AsApp); see the + sharepoint-api-auth rule. The required delegated permission (AllSites.FullControl + on the SharePoint Online resource) is already in SAMManifest.json. + + Safety rules: + - The current / latest version is NEVER removed (recycleAll/deleteAll only act + on previous versions). + - Nothing is removed when WhatIf is $true. + - Failures (retention hold, retention label, permission) are captured, not thrown. + + Cleanup modes: + - none : no-op. + - recycle : recycleAll() - previous versions go to the recycle bin (recoverable + until the recycle bin is purged or retention expires). + - permanent : deleteAll() - previous versions are permanently removed and storage + is reclaimed immediately (not recoverable). + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$TenantFilter, + + [Parameter(Mandatory = $true)] + [string]$DriveId, + + [Parameter(Mandatory = $true)] + [string]$DriveItemId, + + [Parameter(Mandatory = $false)] + [ValidateSet('none', 'recycle', 'permanent')] + [string]$CleanupMode = 'none', + + [Parameter(Mandatory = $false)] + [bool]$WhatIf = $true + ) + + $Result = [PSCustomObject]@{ + VersionCountBefore = 0 + VersionsDeleted = 0 + WhatIf = $WhatIf + CleanupMode = $CleanupMode + Warnings = [System.Collections.Generic.List[string]]::new() + Errors = [System.Collections.Generic.List[string]]::new() + } + + if ($CleanupMode -eq 'none') { + return $Result + } + + # 1. Version count via Graph (this read IS supported by Graph). + $CountKnown = $false + try { + $Versions = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$DriveItemId/versions?`$select=id,lastModifiedDateTime,size" ` + -tenantid $TenantFilter -AsApp $true -NoAuthCheck $true + $Versions = @($Versions) | Where-Object { $_.id } + $Result.VersionCountBefore = $Versions.Count + $CountKnown = $true + } catch { + $Result.Warnings.Add("Could not read version count: $($_.Exception.Message)") + } + + if ($CountKnown -and $Result.VersionCountBefore -le 1) { + # Only the current version exists (or none); nothing to clean up. + return $Result + } + $OldVersionEstimate = if ($Result.VersionCountBefore -gt 1) { $Result.VersionCountBefore - 1 } else { 0 } + + # 2. Resolve the file's SharePoint identifiers (site URL + unique id). + $SiteUrl = $null + $UniqueId = $null + try { + $Item = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$DriveItemId?`$select=id,name,webUrl,sharepointIds" ` + -tenantid $TenantFilter -AsApp $true -NoAuthCheck $true + $SiteUrl = $Item.sharepointIds.siteUrl + $UniqueId = $Item.sharepointIds.listItemUniqueId + } catch { + $Result.Errors.Add("Could not resolve SharePoint identifiers for version cleanup: $($_.Exception.Message)") + return $Result + } + + if (-not $SiteUrl -or -not $UniqueId) { + $Result.Errors.Add('SharePoint site URL or file unique id was unavailable; cannot clean up versions.') + return $Result + } + + # 3. WhatIf: report estimate, do nothing. + if ($WhatIf) { + $Result.VersionsDeleted = $OldVersionEstimate + if ($CleanupMode -eq 'permanent') { + $Result.Warnings.Add('Permanent version deletion (deleteAll) reclaims storage immediately and is not recoverable.') + } + return $Result + } + + # 4. Execute via SharePoint REST (delegated, no -AsApp). + try { + $SharePointInfo = Get-SharePointAdminLink -Public $false -TenantFilter $TenantFilter + $SPScope = "$($SharePointInfo.SharePointUrl)/.default" + $Operation = if ($CleanupMode -eq 'permanent') { 'deleteAll' } else { 'recycleAll' } + $Uri = "$SiteUrl/_api/web/GetFileById('$UniqueId')/versions/$Operation()" + $SPHeaders = @{ 'Accept' = 'application/json;odata=verbose' } + + $null = New-GraphPOSTRequest -scope $SPScope -tenantid $TenantFilter -Uri $Uri -Type POST ` + -Body '' -ContentType 'application/json;odata=verbose' -AddedHeaders $SPHeaders + + $Result.VersionsDeleted = $OldVersionEstimate + if (-not $CountKnown) { + $Result.Warnings.Add('Version count was unavailable before cleanup; old versions were removed but the deleted count could not be determined.') + } + if ($CleanupMode -eq 'permanent') { + $Result.Warnings.Add('Permanent version deletion (deleteAll) was used; removed versions are not recoverable.') + } else { + $Result.Warnings.Add('Versions were sent to the recycle bin (recycleAll); storage is reclaimed once the recycle bin is purged or its retention expires.') + } + } catch { + $Result.Errors.Add("Version cleanup failed: $($_.Exception.Message)") + } + + return $Result +} diff --git a/backend/Modules/CIPPCore/Public/SharePoint/Image Optimizer/Start-CIPPSharePointImageOptimizer.ps1 b/backend/Modules/CIPPCore/Public/SharePoint/Image Optimizer/Start-CIPPSharePointImageOptimizer.ps1 new file mode 100644 index 0000000000..a5d29d32ce --- /dev/null +++ b/backend/Modules/CIPPCore/Public/SharePoint/Image Optimizer/Start-CIPPSharePointImageOptimizer.ps1 @@ -0,0 +1,94 @@ +function Start-CIPPSharePointImageOptimizer { + <# + .FUNCTIONALITY + Internal + .SYNOPSIS + Background worker that runs the SharePoint Image Optimizer and caches the result. + .DESCRIPTION + Invoked from the CIPP queue (Add-CippQueueMessage -Cmdlet 'Start-CIPPSharePointImageOptimizer'). + Long-running scans/compression cannot complete inside the ~230s HTTP gateway window, + so the work is offloaded here and the result is written to the CacheImageOptimizer + table for the polling endpoint (Invoke-ListImageOptimizerResults) to return. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$QueueId, + + [Parameter(Mandatory = $true)] + [string]$TenantFilter, + + [string]$SiteId, + [string]$SiteUrl, + [string]$DriveId, + [string]$LibraryName, + [string]$FolderId, + [string]$FolderPath, + [string]$Mode = 'Audit', + [double]$MinimumFileSizeMB = 5, + [int]$JpegQuality = 82, + [bool]$StripMetadata = $true, + [double]$MinimumSavingsPercent = 15, + [bool]$WhatIf = $true, + [string]$VersionCleanupMode = 'none', + [int]$MaxFiles = 0, + [bool]$IncludeSubfolders = $true + ) + + $QueueTask = @{ + QueueId = $QueueId + Name = "Optimizing images ($Mode)" + Status = 'Running' + } + $TaskStatus = Set-CippQueueTask @QueueTask + $QueueTask.TaskId = $TaskStatus.RowKey + + try { + Update-CippQueueEntry -RowKey $QueueId -Status 'Running' + + Write-LogMessage -API 'Start-CIPPSharePointImageOptimizer' -tenant $TenantFilter -message "Starting image optimizer (mode=$Mode, whatIf=$WhatIf, siteId=$SiteId, driveId=$DriveId, folderId=$FolderId, queueId=$QueueId)" -Sev Info + + $Result = Invoke-CIPPSharePointImageOptimizer -TenantFilter $TenantFilter -SiteId $SiteId -SiteUrl $SiteUrl ` + -DriveId $DriveId -LibraryName $LibraryName -FolderId $FolderId -FolderPath $FolderPath -Mode $Mode ` + -MinimumFileSizeMB $MinimumFileSizeMB -JpegQuality $JpegQuality -StripMetadata $StripMetadata ` + -MinimumSavingsPercent $MinimumSavingsPercent -WhatIf $WhatIf -VersionCleanupMode $VersionCleanupMode ` + -MaxFiles $MaxFiles -IncludeSubfolders $IncludeSubfolders + + $CacheTable = Get-CippTable -tablename 'CacheImageOptimizer' + $Entity = @{ + PartitionKey = $TenantFilter + RowKey = $QueueId + Data = [string]($Result | ConvertTo-Json -Depth 10 -Compress) + CachedAt = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') + } + Add-CIPPAzDataTableEntity @CacheTable -Entity $Entity -Force | Out-Null + + $S = $Result.Summary + $Sev = if ($WhatIf -or $Mode -eq 'Audit') { 'Info' } else { 'Warning' } + Write-LogMessage -API 'Start-CIPPSharePointImageOptimizer' -tenant $TenantFilter -message "Image optimizer completed ($Mode, WhatIf=$WhatIf): scanned $($S.FilesScanned), eligible $($S.EligibleFiles), compressed $($S.FilesCompressed), skipped $($S.FilesSkipped), versions deleted $($S.VersionsDeleted), errors $($S.Errors) (queueId=$QueueId)" -Sev $Sev + + Update-CippQueueEntry -RowKey $QueueId -Status 'Completed' + $QueueTask.Status = 'Completed' + Set-CippQueueTask @QueueTask + } catch { + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -API 'Start-CIPPSharePointImageOptimizer' -tenant $TenantFilter -message "Image optimizer failed: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage + + try { + $CacheTable = Get-CippTable -tablename 'CacheImageOptimizer' + $Entity = @{ + PartitionKey = $TenantFilter + RowKey = $QueueId + Error = $ErrorMessage.NormalizedError + CachedAt = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') + } + Add-CIPPAzDataTableEntity @CacheTable -Entity $Entity -Force | Out-Null + } catch { + Write-Warning "Failed to store image optimizer error: $_" + } + + Update-CippQueueEntry -RowKey $QueueId -Status 'Failed' + $QueueTask.Status = 'Failed' + Set-CippQueueTask @QueueTask + } +} diff --git a/backend/Modules/CIPPCore/Public/Start-CIPPSharePointLibraryCopy.ps1 b/backend/Modules/CIPPCore/Public/Start-CIPPSharePointLibraryCopy.ps1 index e1518bd51d..f1614b8180 100644 --- a/backend/Modules/CIPPCore/Public/Start-CIPPSharePointLibraryCopy.ps1 +++ b/backend/Modules/CIPPCore/Public/Start-CIPPSharePointLibraryCopy.ps1 @@ -40,7 +40,7 @@ function Start-CIPPSharePointLibraryCopy { param([string]$SiteId, [string]$SiteUrl, [string]$ListId) if ([string]::IsNullOrWhiteSpace($SiteId)) { if ([string]::IsNullOrWhiteSpace($SiteUrl)) { - throw 'SourceSiteId or SourceSiteUrl is required.' + throw [System.ArgumentException]::new('SourceSiteId or SourceSiteUrl is required.') } $ParsedUrl = [System.Uri]$SiteUrl $SiteSegment = if ($ParsedUrl.AbsolutePath -in @('', '/')) { @@ -73,12 +73,12 @@ function Start-CIPPSharePointLibraryCopy { foreach ($Meta in @($SourceMeta, $DestMeta)) { $Eligible = Test-CIPPSharePointLibraryCopyEligible -Template $Meta.Template -Title $Meta.Title -Name $Meta.Name if (-not $Eligible.Eligible) { - throw $Eligible.Reason + throw [System.ArgumentException]::new($Eligible.Reason) } } if ($SourceMeta.SiteId -eq $DestMeta.SiteId -and $SourceMeta.ListId -eq $DestMeta.ListId) { - throw 'Source and destination library must be different.' + throw [System.ArgumentException]::new('Source and destination library must be different.') } $Enumerate = Get-CIPPSharePointLibraryRootChildUris -TenantFilter $TenantFilter -SiteId $SourceMeta.SiteId ` @@ -86,10 +86,10 @@ function Start-CIPPSharePointLibraryCopy { $Count = $Enumerate.EligibleRootCount if ($Count -eq 0) { - throw 'Source library has no eligible content to copy.' + throw [System.ArgumentException]::new('Source library has no eligible content to copy.') } if ($Count -gt 1000) { - throw "Source library has $Count eligible root items (limit 1,000). Group files into folders and try again." + throw [System.ArgumentException]::new("Source library has $Count eligible root items (limit 1,000). Group files into folders and try again.") } $WarnLevel = 'none' diff --git a/backend/Modules/CIPPCore/Public/Sync-CIPPCalendarPermissionCache.ps1 b/backend/Modules/CIPPCore/Public/Sync-CIPPCalendarPermissionCache.ps1 index fc59916b8f..543a0d6f15 100644 --- a/backend/Modules/CIPPCore/Public/Sync-CIPPCalendarPermissionCache.ps1 +++ b/backend/Modules/CIPPCore/Public/Sync-CIPPCalendarPermissionCache.ps1 @@ -145,8 +145,8 @@ function Sync-CIPPCalendarPermissionCache { $PermData = $CachedPerm.Data | ConvertFrom-Json - # Match on Identity (flexible) and User - if ($PossibleCalendarIdentities -contains $PermData.Identity -and $PermData.User -eq $User) { + # Match on Identity (flexible) and User (check both raw and display-name-resolved forms) + if ($PossibleCalendarIdentities -contains $PermData.Identity -and ($PermData.User -eq $User -or $PermData.User -eq $UserToCache)) { # Extract ItemId from RowKey (format: "Type-ItemId") Write-Information "Removing calendar permission cache entry: $User on $CalendarIdentity (matched via $($PermData.Identity))" -InformationAction Continue diff --git a/backend/Modules/CIPPCore/Public/TenantGroups/Update-CIPPDynamicTenantGroups.ps1 b/backend/Modules/CIPPCore/Public/TenantGroups/Update-CIPPDynamicTenantGroups.ps1 index d995d65832..a57b75c7b9 100644 --- a/backend/Modules/CIPPCore/Public/TenantGroups/Update-CIPPDynamicTenantGroups.ps1 +++ b/backend/Modules/CIPPCore/Public/TenantGroups/Update-CIPPDynamicTenantGroups.ps1 @@ -185,15 +185,6 @@ function Update-CIPPDynamicTenantGroups { $ScriptBlock = [ScriptBlock]::Create($WhereString) $MatchingTenants = $TenantObj | Where-Object $ScriptBlock - if ($Group.ExcludePartnerTenant -eq $true -and $env:TenantID) { - $BeforeCount = ($MatchingTenants | Measure-Object).Count - $MatchingTenants = @($MatchingTenants | Where-Object { $_.customerId -ne $env:TenantID }) - $RemovedCount = $BeforeCount - ($MatchingTenants | Measure-Object).Count - if ($RemovedCount -gt 0) { - Write-Information "ExcludePartnerTenant is enabled for group '$($Group.Name)'; removed $RemovedCount partner tenant from results" - } - } - Write-Information "Found $($MatchingTenants.Count) matching tenants for group '$($Group.Name)'" $CurrentMembers = @($AllGroupMembers | Where-Object { $_.GroupId -eq $Group.RowKey }) @@ -240,12 +231,6 @@ function Update-CIPPDynamicTenantGroups { # Bust the TenantGroups cache so subsequent calls reflect the changes made above Get-TenantGroups -SkipCache | Out-Null - # Roles scoped to a tenant group resolve through this membership, so the cached access - # scope rules are stale too. Only worth the write when membership actually moved. - if ($TotalMembersAdded -gt 0 -or $TotalMembersRemoved -gt 0) { - Clear-CippAccessScopeCache - } - return @{ MembersAdded = $TotalMembersAdded MembersRemoved = $TotalMembersRemoved diff --git a/backend/Modules/CIPPCore/Public/Test-CIPPFeatureFlagCondition.ps1 b/backend/Modules/CIPPCore/Public/Test-CIPPFeatureFlagCondition.ps1 index 23dfdd80c3..37451ddb72 100644 --- a/backend/Modules/CIPPCore/Public/Test-CIPPFeatureFlagCondition.ps1 +++ b/backend/Modules/CIPPCore/Public/Test-CIPPFeatureFlagCondition.ps1 @@ -13,6 +13,8 @@ function Test-CIPPFeatureFlagCondition { classic Standards and Drift and hides their pages, so an install that never created a classic standard can start on the new engine straight away, while an install with standards keeps them until it opts in. + DefaultOn - start the flag enabled. Used when a flag that was seeded off should + turn on once for installs that never toggled it. A later toggle wins. .PARAMETER Condition The condition name as written in FeatureFlags.json. .FUNCTIONALITY @@ -32,6 +34,9 @@ function Test-CIPPFeatureFlagCondition { $Templates = @(Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'StandardsTemplateV2'" -Property RowKey) return ($Templates.Count -eq 0) } + 'DefaultOn' { + return $true + } default { Write-Warning "Unknown feature flag condition '$Condition' - treated as not met" return $false diff --git a/backend/Modules/CIPPCore/Public/Test-CIPPGDAPRelationships.ps1 b/backend/Modules/CIPPCore/Public/Test-CIPPGDAPRelationships.ps1 index afb53e2966..8e160d4902 100644 --- a/backend/Modules/CIPPCore/Public/Test-CIPPGDAPRelationships.ps1 +++ b/backend/Modules/CIPPCore/Public/Test-CIPPGDAPRelationships.ps1 @@ -31,7 +31,7 @@ function Test-CIPPGDAPRelationships { Issue = 'The relationship has global administrator access. Auto-Extend is not available.' Tenant = [string]$Group.customer.displayName Relationship = [string]$Group.displayName - Link = 'https://docs.cipp.app/setup/maintaining-cipp/recommended-roles' + Link = 'https://docs.cipp.app/setup/installation/recommended-roles' }) | Out-Null } @@ -55,6 +55,7 @@ function Test-CIPPGDAPRelationships { 'M365 GDAP Authentication Policy Administrator', 'M365 GDAP Privileged Role Administrator', 'M365 GDAP Privileged Authentication Administrator', + 'M365 GDAP Power Platform Administrator', 'M365 GDAP Billing Administrator', 'M365 GDAP Global Reader', 'M365 GDAP Domain Name Administrator' @@ -80,7 +81,7 @@ function Test-CIPPGDAPRelationships { Issue = "$($ExpectedGroup) is not assigned to the SAM user $me. If you have migrated outside of CIPP this is to be expected. Please perform an access check to make sure you have the correct set of permissions." Tenant = '*Partner Tenant' Relationship = 'None' - Link = 'https://docs.cipp.app/setup/maintaining-cipp/recommended-roles' + Link = 'https://docs.cipp.app/setup/installation/recommended-roles' }) | Out-Null $MissingGroups.Add([PSCustomObject]@{ @@ -95,7 +96,7 @@ function Test-CIPPGDAPRelationships { Issue = "We only found $($CIPPGroupCount) of the 15 required groups. If you have migrated outside of CIPP this is to be expected. Please perform an access check to make sure you have the correct set of permissions." Tenant = '*Partner Tenant' Relationship = 'None' - Link = 'https://docs.cipp.app/setup/maintaining-cipp/recommended-roles' + Link = 'https://docs.cipp.app/setup/installation/recommended-roles' }) | Out-Null } @@ -153,7 +154,7 @@ function Test-CIPPGDAPRelationships { Issue = "The GDAP role mapping for '$($MappingResult.GroupName)' references a security group that no longer exists in the partner tenant. Onboarding group mapping will fail until the GDAP roles are recreated." Tenant = '*Partner Tenant' Relationship = 'None' - Link = 'https://docs.cipp.app/setup/maintaining-cipp/recommended-roles' + Link = 'https://docs.cipp.app/setup/installation/recommended-roles' }) | Out-Null } elseif ($MappingResult.Status -eq 'Stale') { $GDAPissues.add([PSCustomObject]@{ @@ -162,7 +163,7 @@ function Test-CIPPGDAPRelationships { Issue = "The GDAP role mapping for '$($MappingResult.GroupName)' points at a stale group id but a matching group still exists. Use 'Repair Role Mappings' under Details to correct the stored group id." Tenant = '*Partner Tenant' Relationship = 'None' - Link = 'https://docs.cipp.app/setup/maintaining-cipp/recommended-roles' + Link = 'https://docs.cipp.app/setup/installation/recommended-roles' }) | Out-Null } } diff --git a/backend/Modules/CIPPCore/Public/Test-CIPPOffboardingRequest.ps1 b/backend/Modules/CIPPCore/Public/Test-CIPPOffboardingRequest.ps1 index 2fbdf33b1a..0af8520840 100644 --- a/backend/Modules/CIPPCore/Public/Test-CIPPOffboardingRequest.ps1 +++ b/backend/Modules/CIPPCore/Public/Test-CIPPOffboardingRequest.ps1 @@ -40,7 +40,8 @@ function Test-CIPPOffboardingRequest { # itself (its string form is "@{...}", which would otherwise sneak past the UPN '@' check). $Users = @( $Body.user | ForEach-Object { - $UserValue = $_.value ?? $_ + # Also accept { userPrincipalName = '' } from callers that do not send value. + $UserValue = $_.value ?? $_.userPrincipalName ?? $_ if ($UserValue -is [string]) { $UserValue } } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } ) diff --git a/backend/Modules/CIPPCore/Public/Tools/Apply-CippQuarantinePostFilters.ps1 b/backend/Modules/CIPPCore/Public/Tools/Apply-CippQuarantinePostFilters.ps1 new file mode 100644 index 0000000000..1d9d375f5a --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Tools/Apply-CippQuarantinePostFilters.ps1 @@ -0,0 +1,31 @@ +function Apply-CippQuarantinePostFilters { + [CmdletBinding()] + param( + [array]$Messages, + [hashtable]$PostFilters + ) + + $Results = @($Messages) + if ($PostFilters.subjectContains) { + $Pattern = "*$($PostFilters.subjectContains)*" + $Results = $Results | Where-Object { $_.Subject -like $Pattern } + } + if ($PostFilters.senderDomain) { + $Domain = $PostFilters.senderDomain + $Results = $Results | Where-Object { + $Addr = [string]$_.SenderAddress + $Addr -and ($Addr.Split('@')[-1].ToLowerInvariant() -eq $Domain) + } + } + if ($PostFilters.recipientDomain) { + $Domain = $PostFilters.recipientDomain + $Results = $Results | Where-Object { + $Recipients = @($_.RecipientAddress) + $Recipients | Where-Object { + $Addr = [string]$_ + $Addr -and ($Addr.Split('@')[-1].ToLowerInvariant() -eq $Domain) + } + } + } + return @($Results) +} diff --git a/backend/Modules/CIPPCore/Public/Tools/Build-CIPPQuarantineQueryParams.ps1 b/backend/Modules/CIPPCore/Public/Tools/Build-CIPPQuarantineQueryParams.ps1 new file mode 100644 index 0000000000..ee62e65f7c --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Tools/Build-CIPPQuarantineQueryParams.ps1 @@ -0,0 +1,162 @@ +function Build-CIPPQuarantineQueryParams { + <# + .SYNOPSIS + Maps CIPP request input to Get-QuarantineMessage cmdlet parameters and client-side post-filters. + .DESCRIPTION + Server-side filters use Exchange Online Get-QuarantineMessage parameters. + Post-filters (subjectContains, senderDomain, recipientDomain) are applied after the EXO call + because EXO does not support partial subject match or domain-only filtering. + + Related quarantine helpers live in sibling files (one function per file) because the + CIPPCore module exports functions by file basename; functions co-located in this file + would stay private to CIPPCore and be invisible to the CIPPHTTP/CIPPActivityTriggers + modules that call them. + #> + [CmdletBinding()] + param( + [hashtable]$QueryInput, + [switch]$ApplyDefaultDateRange + ) + + $CmdParams = @{ + PageSize = 100 + Page = 1 + } + + $PostFilters = @{} + $AppliedFilters = @{} + + if ($QueryInput.pageSize) { + $PageSize = [int]$QueryInput.pageSize + if ($PageSize -lt 1) { $PageSize = 1 } + if ($PageSize -gt 1000) { $PageSize = 1000 } + $CmdParams.PageSize = $PageSize + } + if ($QueryInput.page) { + $Page = [int]$QueryInput.page + if ($Page -lt 1) { $Page = 1 } + if ($Page -gt 1000) { $Page = 1000 } + $CmdParams.Page = $Page + } + if ($QueryInput.nextLink -match '^\d+$') { + $CmdParams.Page = [int]$QueryInput.nextLink + } + + $MessageId = Get-CippQuarantineInputValue $QueryInput.messageId + if (-not [string]::IsNullOrWhiteSpace($MessageId)) { + $CmdParams.MessageId = $MessageId + $AppliedFilters.messageId = $MessageId + return [PSCustomObject]@{ + CmdParams = $CmdParams + PostFilters = $PostFilters + AppliedFilters = $AppliedFilters + } + } + + $HasDate = $false + if ($QueryInput.days) { + $Days = [int](Get-CippQuarantineInputValue $QueryInput.days) + $CmdParams.StartReceivedDate = (Get-Date).AddDays(-$Days).ToUniversalTime() + $CmdParams.EndReceivedDate = (Get-Date).ToUniversalTime() + $AppliedFilters.days = $Days + $HasDate = $true + } elseif ($QueryInput.startDate) { + $StartDate = $QueryInput.startDate + if ($StartDate -match '^\d+$') { + $CmdParams.StartReceivedDate = [DateTimeOffset]::FromUnixTimeSeconds([int64]$StartDate).UtcDateTime + } else { + $CmdParams.StartReceivedDate = [DateTime]::Parse($StartDate).ToUniversalTime() + } + if ($QueryInput.endDate) { + $EndDate = $QueryInput.endDate + if ($EndDate -match '^\d+$') { + $CmdParams.EndReceivedDate = [DateTimeOffset]::FromUnixTimeSeconds([int64]$EndDate).UtcDateTime + } else { + $CmdParams.EndReceivedDate = [DateTime]::Parse($EndDate).ToUniversalTime() + } + } else { + $CmdParams.EndReceivedDate = (Get-Date).ToUniversalTime() + } + $AppliedFilters.startDate = $CmdParams.StartReceivedDate + $AppliedFilters.endDate = $CmdParams.EndReceivedDate + $HasDate = $true + } elseif ($ApplyDefaultDateRange.IsPresent) { + $CmdParams.StartReceivedDate = (Get-Date).AddDays(-7).ToUniversalTime() + $CmdParams.EndReceivedDate = (Get-Date).ToUniversalTime() + $AppliedFilters.days = 7 + $HasDate = $true + } + + $Sender = Get-CippQuarantineInputValue $QueryInput.sender + if (-not [string]::IsNullOrWhiteSpace($Sender)) { + $SenderApi = $Sender -replace '#', '%23' + $CmdParams.SenderAddress = @($SenderApi) + $AppliedFilters.sender = $Sender + } + + $Recipient = Get-CippQuarantineInputValue $QueryInput.recipient + if (-not [string]::IsNullOrWhiteSpace($Recipient)) { + $RecipientApi = $Recipient -replace '#', '%23' + $CmdParams.RecipientAddress = @($RecipientApi) + $AppliedFilters.recipient = $Recipient + } + + $SubjectExact = Get-CippQuarantineInputValue $QueryInput.subjectExact + if (-not [string]::IsNullOrWhiteSpace($SubjectExact)) { + $CmdParams.Subject = $SubjectExact + $AppliedFilters.subjectExact = $SubjectExact + } + + $SubjectContains = Get-CippQuarantineInputValue $QueryInput.subject + if (-not [string]::IsNullOrWhiteSpace($SubjectContains) -and -not $CmdParams.Subject) { + $PostFilters.subjectContains = $SubjectContains + $AppliedFilters.subject = $SubjectContains + } + + $QuarantineTypes = ConvertTo-CippQuarantineStringArray $QueryInput.quarantineType + if ($QuarantineTypes.Count -gt 0) { + $CmdParams.QuarantineTypes = $QuarantineTypes + $AppliedFilters.quarantineType = $QuarantineTypes + } + + $ReleaseStatuses = ConvertTo-CippQuarantineStringArray $QueryInput.releaseStatus + if ($ReleaseStatuses.Count -gt 0) { + $CmdParams.ReleaseStatus = @($ReleaseStatuses | ForEach-Object { ConvertTo-CippQuarantineReleaseStatusApiValue $_ }) + $AppliedFilters.releaseStatus = $ReleaseStatuses + } + + $PolicyTypes = ConvertTo-CippQuarantineStringArray $QueryInput.policyTypes + if ($PolicyTypes.Count -gt 0) { + $CmdParams.PolicyTypes = $PolicyTypes + $AppliedFilters.policyTypes = $PolicyTypes + } + + $PolicyName = Get-CippQuarantineInputValue $QueryInput.policyName + if (-not [string]::IsNullOrWhiteSpace($PolicyName)) { + $CmdParams.PolicyName = $PolicyName + $AppliedFilters.policyName = $PolicyName + } + + $SenderDomain = Get-CippQuarantineInputValue $QueryInput.senderDomain + if (-not [string]::IsNullOrWhiteSpace($SenderDomain)) { + $PostFilters.senderDomain = $SenderDomain.Trim().TrimStart('@').ToLowerInvariant() + $AppliedFilters.senderDomain = $PostFilters.senderDomain + } + + $RecipientDomain = Get-CippQuarantineInputValue $QueryInput.recipientDomain + if (-not [string]::IsNullOrWhiteSpace($RecipientDomain)) { + $PostFilters.recipientDomain = $RecipientDomain.Trim().TrimStart('@').ToLowerInvariant() + $AppliedFilters.recipientDomain = $PostFilters.recipientDomain + } + + if ($QueryInput.entityType) { + $CmdParams.EntityType = Get-CippQuarantineInputValue $QueryInput.entityType + $AppliedFilters.entityType = $CmdParams.EntityType + } + + [PSCustomObject]@{ + CmdParams = $CmdParams + PostFilters = $PostFilters + AppliedFilters = $AppliedFilters + } +} diff --git a/backend/Modules/CIPPCore/Public/Tools/ConvertTo-AuthenticationSummary.ps1 b/backend/Modules/CIPPCore/Public/Tools/ConvertTo-AuthenticationSummary.ps1 new file mode 100644 index 0000000000..e11464f857 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Tools/ConvertTo-AuthenticationSummary.ps1 @@ -0,0 +1,48 @@ +function ConvertTo-AuthenticationSummary { + param( + [Parameter(Mandatory = $false)] + [string[]]$DetailEntries + ) + + $Summary = [PSCustomObject]@{ + SPF = [PSCustomObject]@{ result = 'Unknown'; detail = '' } + DKIM = [PSCustomObject]@{ result = 'Unknown'; detail = '' } + DMARC = [PSCustomObject]@{ result = 'Unknown'; detail = '' } + CompAuth = [PSCustomObject]@{ result = 'Unknown' } + } + + if (-not $DetailEntries) { return $Summary } + + $AllDetails = $DetailEntries -join ';' + + try { + if ($AllDetails -match 'spf\s+(pass|fail|softfail|temperror|permerror|none)\s*(?:\(([^)]+)\))?') { + $Summary.SPF.result = $Matches[1] + if ($Matches[2]) { $Summary.SPF.detail = $Matches[2] } + } elseif ($AllDetails -match 'SPF=(\w+)') { + $Summary.SPF.result = $Matches[1] + } + + if ($AllDetails -match 'dkim\s+(pass|fail|none)\s*(?:\(([^)]+)\))?') { + $Summary.DKIM.result = $Matches[1] + if ($Matches[2]) { $Summary.DKIM.detail = $Matches[2] } + } elseif ($AllDetails -match 'DKIM=(\w+)') { + $Summary.DKIM.result = $Matches[1] + } + + if ($AllDetails -match 'dmarc\s+(pass|fail|bestguesspass|none)\s*(?:action=(\w+))?') { + $Summary.DMARC.result = $Matches[1] + if ($Matches[2]) { $Summary.DMARC.detail = "action=$($Matches[2])" } + } elseif ($AllDetails -match 'DMARC=(\w+)') { + $Summary.DMARC.result = $Matches[1] + } + + if ($AllDetails -match 'compauth=(\w+)') { + $Summary.CompAuth.result = $Matches[1] + } + } catch { + Write-Warning "Failed to parse authentication summary: $($_.Exception.Message)" + } + + return $Summary +} diff --git a/backend/Modules/CIPPCore/Public/Tools/ConvertTo-CippQuarantineDisplayObject.ps1 b/backend/Modules/CIPPCore/Public/Tools/ConvertTo-CippQuarantineDisplayObject.ps1 new file mode 100644 index 0000000000..94a700c240 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Tools/ConvertTo-CippQuarantineDisplayObject.ps1 @@ -0,0 +1,54 @@ +function ConvertTo-CippQuarantineDisplayObject { + <# + .SYNOPSIS + Normalizes Get-QuarantineMessage output for CIPP frontend consumption. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true, ValueFromPipeline = $true)] + $Message + ) + + process { + if (-not $Message) { return } + $DisplayStatus = switch ([string]$Message.ReleaseStatus) { + 'NotReleased' { 'NOTRELEASED' } + 'Released' { 'RELEASED' } + 'Requested' { 'REQUESTED' } + 'Denied' { 'DENIED' } + 'Error' { 'ERROR' } + 'Approved' { 'APPROVED' } + 'PreparingToRelease' { 'PREPARINGTORELEASE' } + default { [string]$Message.ReleaseStatus } + } + + $Recipient = $Message.RecipientAddress + if ($Recipient -is [array]) { + $Recipient = ($Recipient -join '; ') + } + + [PSCustomObject]@{ + Identity = $Message.Identity + MessageId = $Message.MessageId + ReceivedTime = $Message.ReceivedTime + Subject = $Message.Subject + SenderAddress = $Message.SenderAddress + SenderName = $Message.SenderName + RecipientAddress = $Recipient + Type = $Message.Type + QuarantineReason = $Message.QuarantineReason ?? $Message.Type + PolicyName = $Message.PolicyName + PolicyType = $Message.PolicyType + ReleaseStatus = $DisplayStatus + Expires = $Message.Expires + ReleasedBy = $Message.ReleasedUser ?? $Message.ReleasedBy + ReleasedTime = $Message.ReleasedTime + Direction = $Message.Direction + Size = $Message.Size + SystemReleased = $Message.SystemReleased + Reported = $Message.Reported + Tenant = $Message.Tenant + CustomData = $Message.CustomData + } + } +} diff --git a/backend/Modules/CIPPCore/Public/Tools/ConvertTo-CippQuarantineReleaseStatusApiValue.ps1 b/backend/Modules/CIPPCore/Public/Tools/ConvertTo-CippQuarantineReleaseStatusApiValue.ps1 new file mode 100644 index 0000000000..62c0b9eb56 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Tools/ConvertTo-CippQuarantineReleaseStatusApiValue.ps1 @@ -0,0 +1,16 @@ +function ConvertTo-CippQuarantineReleaseStatusApiValue { + [CmdletBinding()] + param([string]$Status) + + if ([string]::IsNullOrWhiteSpace($Status)) { return $null } + switch ($Status.ToUpperInvariant()) { + 'NOTRELEASED' { return 'NotReleased' } + 'RELEASED' { return 'Released' } + 'REQUESTED' { return 'Requested' } + 'DENIED' { return 'Denied' } + 'ERROR' { return 'Error' } + 'APPROVED' { return 'Approved' } + 'PREPARINGTORELEASE' { return 'PreparingToRelease' } + default { return $Status } + } +} diff --git a/backend/Modules/CIPPCore/Public/Tools/ConvertTo-CippQuarantineStringArray.ps1 b/backend/Modules/CIPPCore/Public/Tools/ConvertTo-CippQuarantineStringArray.ps1 new file mode 100644 index 0000000000..6713933edd --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Tools/ConvertTo-CippQuarantineStringArray.ps1 @@ -0,0 +1,29 @@ +function ConvertTo-CippQuarantineStringArray { + <# + .SYNOPSIS + Converts scalar, comma-separated, or JSON array inputs into string arrays. + #> + [CmdletBinding()] + param($InputObject) + + if ($null -eq $InputObject -or $InputObject -eq '') { return @() } + if ($InputObject -is [array]) { + return @( + $InputObject | + ForEach-Object { Get-CippQuarantineInputValue $_ } | + Where-Object { -not [string]::IsNullOrWhiteSpace($_) } + ) + } + if ($InputObject -is [string] -and $InputObject.Trim().StartsWith('[')) { + try { + return @($InputObject | ConvertFrom-Json | ForEach-Object { [string]$_ } | Where-Object { $_ }) + } catch { + # fall through to comma split + } + } + return @( + ($InputObject -split '[,;]') | + ForEach-Object { $_.Trim() } | + Where-Object { -not [string]::IsNullOrWhiteSpace($_) } + ) +} diff --git a/backend/Modules/CIPPCore/Public/Tools/ConvertTo-StringList.ps1 b/backend/Modules/CIPPCore/Public/Tools/ConvertTo-StringList.ps1 new file mode 100644 index 0000000000..2e680b4d60 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Tools/ConvertTo-StringList.ps1 @@ -0,0 +1,109 @@ +function ConvertTo-StringList { + <# + .SYNOPSIS + Turns encoded list data into something you can foreach over. + + .DESCRIPTION + String input: if it is JSON (object or array), it is converted first; otherwise comma/semicolon/newline + splitting applies. Other shapes: wrapper objects, or an existing array/list. After conversion, the return + value is always foreach-able (empty collection is @()). Arrays and IList instances are returned + as-is — they are already foreach-able without conversion. + This exists because front end multi-value input is annoying to deal with. + + .PARAMETER InputObject + Encoded list (string/JSON), wrapper object, or an existing array/list. + + .PARAMETER PropertyNames + On hashtables/PSCustomObjects, property names to read in order. + + .OUTPUTS + Always an enumerable suitable for: foreach ($item in (ConvertTo-StringList ...)) { } + #> + [CmdletBinding()] + param( + [Parameter(Position = 0)] + [Alias('Input', 'Value')] + [AllowNull()] + $InputObject, + + [string[]]$PropertyNames = @('Items', 'Value') + ) + + # Output must be foreach-able; $null input yields empty collection. + if ($null -eq $InputObject) { + return @() + } + + if ($InputObject -is [string]) { + $s = $InputObject.Trim() + if (-not $s) { + return @() + } + if ($s.StartsWith('[') -or $s.StartsWith('{')) { + try { + $parsed = $s | ConvertFrom-Json -ErrorAction Stop + return ConvertTo-StringList -InputObject $parsed -PropertyNames $PropertyNames + } catch { + } + } + return @( + $s -split '[,;\r\n]+' | ForEach-Object { $_.Trim() } | Where-Object { $_ } + ) + } + + if ($InputObject -is [Array]) { + return $InputObject + } + if ($InputObject -is [System.Collections.IList] -and $InputObject -isnot [string]) { + return $InputObject + } + + if ($InputObject -is [hashtable]) { + if ($InputObject.Count -eq 0) { + return @() + } + foreach ($name in $PropertyNames) { + if ($InputObject.ContainsKey($name)) { + return ConvertTo-StringList -InputObject $InputObject[$name] -PropertyNames $PropertyNames + } + } + foreach ($p in $InputObject.GetEnumerator() | Sort-Object { $_.Key }) { + $v = $p.Value + if ($null -eq $v) { continue } + if ($v -is [string] -or ($v -is [System.Collections.IEnumerable] -and $v -isnot [hashtable] -and $v -isnot [pscustomobject])) { + return ConvertTo-StringList -InputObject $v -PropertyNames @() + } + } + $single = "$InputObject".Trim() + if ($single) { + return , @($single) + } + return @() + } + + if ($InputObject -is [pscustomobject]) { + foreach ($name in $PropertyNames) { + if ($InputObject.PSObject.Properties.Name -contains $name) { + return ConvertTo-StringList -InputObject $InputObject.$name -PropertyNames $PropertyNames + } + } + foreach ($p in $InputObject.PSObject.Properties) { + $v = $p.Value + if ($null -eq $v) { continue } + if ($v -is [string] -or ($v -is [System.Collections.IEnumerable] -and $v -isnot [hashtable] -and $v -isnot [pscustomobject])) { + return ConvertTo-StringList -InputObject $v -PropertyNames @() + } + } + $single = "$InputObject".Trim() + if ($single) { + return , @($single) + } + return @() + } + + $t = "$InputObject".Trim() + if ($t) { + return , @($t) + } + return @() +} diff --git a/backend/Modules/CIPPCore/Public/Tools/Get-CIPPSchedulerBlockedCommands.ps1 b/backend/Modules/CIPPCore/Public/Tools/Get-CIPPSchedulerBlockedCommands.ps1 index 602c5b14cd..dfe52d065d 100644 --- a/backend/Modules/CIPPCore/Public/Tools/Get-CIPPSchedulerBlockedCommands.ps1 +++ b/backend/Modules/CIPPCore/Public/Tools/Get-CIPPSchedulerBlockedCommands.ps1 @@ -71,7 +71,6 @@ function Get-CIPPSchedulerBlockedCommands { 'Get-CIPPBitlockerKey' 'Search-CIPPBitlockerKeys' 'Get-CIPPFileVaultKey' - 'Get-CIPPBiosPassword' # SAM/CPV & app registration configuration - privilege escalation / token theft vectors 'Set-CIPPCPVConsent' diff --git a/backend/Modules/CIPPCore/Public/Tools/Get-CippQuarantineInputValue.ps1 b/backend/Modules/CIPPCore/Public/Tools/Get-CippQuarantineInputValue.ps1 new file mode 100644 index 0000000000..a7fe13e0a8 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Tools/Get-CippQuarantineInputValue.ps1 @@ -0,0 +1,17 @@ +function Get-CippQuarantineInputValue { + <# + .SYNOPSIS + Normalizes autocomplete/form values from CIPP frontend payloads. + #> + [CmdletBinding()] + param($Value) + + if ($null -eq $Value) { return $null } + if ($Value -is [array]) { + $First = $Value | Select-Object -First 1 + if ($null -ne $First -and $null -ne $First.value) { return [string]$First.value } + return [string]$First + } + if ($null -ne $Value.value) { return [string]$Value.value } + return [string]$Value +} diff --git a/backend/Modules/CIPPCore/Public/Tools/Get-CippQuarantinePagedResults.ps1 b/backend/Modules/CIPPCore/Public/Tools/Get-CippQuarantinePagedResults.ps1 new file mode 100644 index 0000000000..9a1128074a --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Tools/Get-CippQuarantinePagedResults.ps1 @@ -0,0 +1,92 @@ +function Get-CippQuarantinePagedResults { + <# + .SYNOPSIS + Fetches one client page of quarantine results, scanning multiple EXO pages when post-filters are active. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)][string]$TenantId, + [Parameter(Mandatory = $true)]$Query, + [string]$NextLink, + [int]$TargetPageSize = 100 + ) + + $HasPostFilters = $Query.PostFilters.Count -gt 0 + $ExoPageSize = $Query.CmdParams.PageSize + $StartExoPage = 1 + if ($NextLink -match '^\d+$') { + $StartExoPage = [int]$NextLink + } + + if (-not $HasPostFilters) { + $Query.CmdParams.Page = $StartExoPage + $RawResults = @(Invoke-CippQuarantineExoRequest -TenantId $TenantId -Cmdlet 'Get-QuarantineMessage' -CmdParams $Query.CmdParams | + Select-Object -ExcludeProperty *data.type*) + $Filtered = @(Apply-CippQuarantinePostFilters -Messages $RawResults -PostFilters $Query.PostFilters) + $HasMore = (@($RawResults).Count -eq $ExoPageSize -and $StartExoPage -lt 1000) + + return [PSCustomObject]@{ + Results = $Filtered + Metadata = [PSCustomObject]@{ + appliedFilters = $Query.AppliedFilters + page = $StartExoPage + pageSize = $ExoPageSize + nextLink = if ($HasMore) { [string]($StartExoPage + 1) } else { $null } + HasPostFilters = $false + RawRowsScanned = @($RawResults).Count + FilteredRowsReturned = $Filtered.Count + PostFilterPaginationLimited = $false + } + } + } + + $Collected = [System.Collections.Generic.List[object]]::new() + $RawScanned = 0 + $ExoPage = $StartExoPage + $MaxRawPagesPerRequest = 25 + $PagesFetched = 0 + $LastPageResultCount = 0 + $PostFilterLimited = $false + + while ($Collected.Count -lt $TargetPageSize -and $PagesFetched -lt $MaxRawPagesPerRequest -and $ExoPage -le 1000) { + $Query.CmdParams.Page = $ExoPage + $PageResults = @(Invoke-CippQuarantineExoRequest -TenantId $TenantId -Cmdlet 'Get-QuarantineMessage' -CmdParams $Query.CmdParams | + Select-Object -ExcludeProperty *data.type*) + $LastPageResultCount = @($PageResults).Count + $RawScanned += $LastPageResultCount + $FilteredPage = @(Apply-CippQuarantinePostFilters -Messages $PageResults -PostFilters $Query.PostFilters) + # Always keep every match from a scanned EXO page. The next request resumes + # on the following EXO page, so truncating mid-page would silently drop the + # remaining matches on this page. The client page may therefore run slightly + # over TargetPageSize, which is preferable to losing rows. + foreach ($item in $FilteredPage) { + $Collected.Add($item) + } + $PagesFetched++ + $ExoPage++ + if ($LastPageResultCount -lt $ExoPageSize) { break } + } + + # More EXO pages exist whenever the last scanned page was full. Surface that as + # HasMore even when this client page came back short (e.g. the raw-page scan + # limit was hit before enough matches were found), so the UI can keep paging. + $MoreExoPagesExist = ($LastPageResultCount -eq $ExoPageSize -and $ExoPage -le 1000) + $HasMore = $MoreExoPagesExist + if ($MoreExoPagesExist -and $Collected.Count -lt $TargetPageSize) { + $PostFilterLimited = $true + } + + return [PSCustomObject]@{ + Results = @($Collected) + Metadata = [PSCustomObject]@{ + appliedFilters = $Query.AppliedFilters + page = $StartExoPage + pageSize = $TargetPageSize + nextLink = if ($HasMore) { [string]$ExoPage } else { $null } + HasPostFilters = $true + RawRowsScanned = $RawScanned + FilteredRowsReturned = $Collected.Count + PostFilterPaginationLimited = $PostFilterLimited + } + } +} diff --git a/backend/Modules/CIPPCore/Public/Tools/Invoke-CippQuarantineExoRequest.ps1 b/backend/Modules/CIPPCore/Public/Tools/Invoke-CippQuarantineExoRequest.ps1 new file mode 100644 index 0000000000..d14dbbbbe3 --- /dev/null +++ b/backend/Modules/CIPPCore/Public/Tools/Invoke-CippQuarantineExoRequest.ps1 @@ -0,0 +1,39 @@ +function Invoke-CippQuarantineExoRequest { + <# + .SYNOPSIS + Wraps New-ExoRequest with retry/backoff for transient quarantine API failures. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)][string]$TenantId, + [Parameter(Mandatory = $true)][string]$Cmdlet, + [hashtable]$CmdParams, + [int]$MaxAttempts = 3 + ) + + $Attempt = 0 + $DelaySeconds = 2 + while ($true) { + $Attempt++ + try { + return New-ExoRequest -tenantid $TenantId -cmdlet $Cmdlet -cmdParams $CmdParams + } catch { + $Message = $_.Exception.Message + $IsTransient = $Message -match '429|503|throttl|temporar|busy|timeout|Too many requests' + # EXO's admin API intermittently returns CommandNotFoundException for + # cmdlets that exist (same backend flake documented for + # Release-QuarantineMessage chaining in ExecQuarantineManagement). + # Retry once before treating it as a real RBAC/licensing failure. + $IsCmdletMissing = $Message -match 'is not recognized' + if ($IsCmdletMissing -and $Attempt -lt 2) { + Start-Sleep -Seconds $DelaySeconds + continue + } + if (-not $IsTransient -or $Attempt -ge $MaxAttempts) { + throw + } + Start-Sleep -Seconds $DelaySeconds + $DelaySeconds = [Math]::Min($DelaySeconds * 2, 30) + } + } +} diff --git a/backend/Modules/CIPPCore/Public/Tools/Reporting/Build-CippBecReportTree.ps1 b/backend/Modules/CIPPCore/Public/Tools/Reporting/Build-CippBecReportTree.ps1 index bffa12fa39..bfbfa95a45 100644 --- a/backend/Modules/CIPPCore/Public/Tools/Reporting/Build-CippBecReportTree.ps1 +++ b/backend/Modules/CIPPCore/Public/Tools/Reporting/Build-CippBecReportTree.ps1 @@ -997,7 +997,7 @@ function Build-CippBecReportTree { $lines = @( "Display Name: $(if ($device.displayName) { $device.displayName } else { 'N/A' })" "Registered: $(FmtDate $device.createdDateTime)" - $(if (($d = ToDate $device.createdDateTime) -and $d -ge $windowStart) { '[!] Registered in the last 7 days' }) + $(if (($d = ToDate $device.createdDateTime) -and $d -ge $windowStart) { "[!] Registered in the last $windowDays days" }) ) $b.Add((New-CippReportInfoBox -Lines -Title "$(if ($type) { $type } else { 'Unknown' })" -Content ($lines -join "`n"))) } diff --git a/backend/Modules/CIPPCore/Public/Update-CIPPSharePointLibraryCopyStatus.ps1 b/backend/Modules/CIPPCore/Public/Update-CIPPSharePointLibraryCopyStatus.ps1 index cf9e9b93a1..c8df64bb6e 100644 --- a/backend/Modules/CIPPCore/Public/Update-CIPPSharePointLibraryCopyStatus.ps1 +++ b/backend/Modules/CIPPCore/Public/Update-CIPPSharePointLibraryCopyStatus.ps1 @@ -35,7 +35,7 @@ function Update-CIPPSharePointLibraryCopyStatus { $Operation = Get-CIPPSharePointLibraryCopyOperation -TenantFilter $TenantFilter -OperationId $OperationId if (-not $Operation) { - throw 'Library copy operation not found.' + throw [System.Management.Automation.ItemNotFoundException]::new('Library copy operation not found.') } if ($Operation.Status -in @('Completed', 'CompletedWithErrors', 'Failed') -and $Operation.SanitizedSnapshot) { diff --git a/backend/Modules/CIPPCore/Public/Webhooks/Invoke-CIPPGraphWebhookRenewal.ps1 b/backend/Modules/CIPPCore/Public/Webhooks/Invoke-CIPPGraphWebhookRenewal.ps1 index d3ec63e614..8e3c69e313 100644 --- a/backend/Modules/CIPPCore/Public/Webhooks/Invoke-CIPPGraphWebhookRenewal.ps1 +++ b/backend/Modules/CIPPCore/Public/Webhooks/Invoke-CIPPGraphWebhookRenewal.ps1 @@ -1,56 +1,151 @@ function Invoke-CippGraphWebhookRenewal { + $StartTime = Get-Date + $MaxExecutionMinutes = 8 # Leave buffer before 10-minute timeout $RenewalDate = (Get-Date).AddDays(1).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ') $body = @{ 'expirationDateTime' = "$RenewalDate" } | ConvertTo-Json $Tenants = Get-Tenants -IncludeErrors + # Use hashtables for O(1) lookup instead of O(n) array search + $TenantDomainsHash = @{} + $TenantCustomerIdsHash = @{} + foreach ($Tenant in $Tenants) { + if ($Tenant.defaultDomainName) { $TenantDomainsHash[$Tenant.defaultDomainName] = $true } + if ($Tenant.customerId) { $TenantCustomerIdsHash[$Tenant.customerId] = $true } + } $WebhookTable = Get-CIPPTable -TableName webhookTable try { - $WebhookData = Get-AzDataTableEntity @WebhookTable | Where-Object { $null -ne $_.SubscriptionID -and $_.SubscriptionID -ne '' -and ((Get-Date($_.Expiration)) -le ((Get-Date).AddHours(2))) } + # Use server-side filter for non-empty SubscriptionID, then filter expiration client-side + # (Date comparisons in Azure Table filters are limited) + $ExpirationCutoff = (Get-Date).AddHours(2) + $WebhookData = Get-AzDataTableEntity @WebhookTable -Filter "SubscriptionID ne ''" | + Where-Object { $null -ne $_.SubscriptionID -and ((Get-Date($_.Expiration)) -le $ExpirationCutoff) } } catch { $WebhookData = @() } - if (($WebhookData | Measure-Object).Count -gt 0) { - Write-LogMessage -API 'Scheduler_RenewGraphSubscriptions' -tenant 'none' -message 'Starting Graph Subscription Renewal' -sev Info + $WebhookCount = ($WebhookData | Measure-Object).Count + if ($WebhookCount -gt 0) { + Write-LogMessage -API 'Scheduler_RenewGraphSubscriptions' -tenant 'none' -message "Starting Graph Subscription Renewal for $WebhookCount webhooks" -sev Info + + # First pass: Filter out invalid tenants (sequential - fast operation) + $ValidWebhooks = [System.Collections.Generic.List[object]]::new() + $SkippedCount = 0 foreach ($UpdateSub in $WebhookData) { - try { - $TenantFilter = $UpdateSub.PartitionKey - if ($Tenants.defaultDomainName -notcontains $TenantFilter -and $Tenants.customerId -notcontains $TenantFilter) { - Write-LogMessage -API 'Renew_Graph_Subscriptions' -message "Removing Subscription Renewal for $($UpdateSub.SubscriptionID) as tenant $TenantFilter is not in the tenant list." -sev 'Warning' -tenant $TenantFilter - Remove-CIPPAzDataTableEntity -Force @WebhookTable -Entity $UpdateSub - continue + $TenantFilter = $UpdateSub.PartitionKey + if (-not $TenantDomainsHash.ContainsKey($TenantFilter) -and -not $TenantCustomerIdsHash.ContainsKey($TenantFilter)) { + Write-LogMessage -API 'Renew_Graph_Subscriptions' -message "Removing Subscription Renewal for $($UpdateSub.SubscriptionID) as tenant $TenantFilter is not in the tenant list." -Sev 'Warning' -tenant $TenantFilter + try { + Remove-CIPPAzDataTableEntity -Force @WebhookTable -Entity $UpdateSub -ErrorAction Stop + } catch { + if ($_.Exception.Message -notmatch 'does not exist|ResourceNotFound') { + Write-Warning "Failed to remove entity: $($_.Exception.Message)" + } } + $SkippedCount++ + } else { + $ValidWebhooks.Add($UpdateSub) + } + } - try { - $null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/subscriptions/$($UpdateSub.SubscriptionID)" -tenantid $TenantFilter -type PATCH -body $body -Verbose - $UpdateSub.Expiration = $RenewalDate - $null = Add-AzDataTableEntity @WebhookTable -Entity $UpdateSub -Force - Write-LogMessage -API 'Renew_Graph_Subscriptions' -message "Renewed Subscription:$($UpdateSub.SubscriptionID)" -Sev 'Info' -tenant $TenantFilter + $BatchSize = 10 + $ThrottleLimit = 10 + $ProcessedCount = 0 + $SuccessCount = 0 + $FailedCount = 0 + + for ($i = 0; $i -lt $ValidWebhooks.Count; $i += $BatchSize) { + $ElapsedMinutes = ((Get-Date) - $StartTime).TotalMinutes + if ($ElapsedMinutes -ge $MaxExecutionMinutes) { + $RemainingCount = $ValidWebhooks.Count - $ProcessedCount + Write-LogMessage -API 'Scheduler_RenewGraphSubscriptions' -tenant 'none' -message "Stopping webhook renewal after $ProcessedCount of $($ValidWebhooks.Count) - approaching timeout. $RemainingCount webhooks will be processed in next run." -sev Warning + break + } + $EndIndex = [Math]::Min($i + $BatchSize - 1, $ValidWebhooks.Count - 1) + $CurrentBatch = $ValidWebhooks[$i..$EndIndex] + + $Results = $CurrentBatch | ForEach-Object -Parallel { + $UpdateSub = $_ + $RenewalDate = $using:RenewalDate + $body = $using:body + $WebhookTable = $using:WebhookTable + + try { + Import-Module CIPPCore -Force + Import-Module AzBobbyTables -Force -ErrorAction SilentlyContinue } catch { - # Rebuild creation parameters - $BaseURL = "$(([uri]($UpdateSub.WebhookNotificationUrl)).Host)" - if ($UpdateSub.TypeofSubscription) { - $TypeofSubscription = "$($UpdateSub.TypeofSubscription)" - } else { - $TypeofSubscription = 'updated' + Write-Warning "Failed to import modules in parallel runspace: $($_.Exception.Message)" + } + + $Result = @{ + Success = $false + SubscriptionID = $UpdateSub.SubscriptionID + TenantFilter = $UpdateSub.PartitionKey + Error = $null + } + + try { + $TenantFilter = $UpdateSub.PartitionKey + + try { + $null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/subscriptions/$($UpdateSub.SubscriptionID)" -tenantid $TenantFilter -type PATCH -body $body + $UpdateSub.Expiration = $RenewalDate + $null = Add-AzDataTableEntity @WebhookTable -Entity $UpdateSub -Force + $Result.Success = $true + } catch { + # Renewal failed - try to recreate + $BaseURL = "$(([uri]($UpdateSub.WebhookNotificationUrl)).Host)" + $TypeofSubscription = if ($UpdateSub.TypeofSubscription) { "$($UpdateSub.TypeofSubscription)" } else { 'updated' } + $Resource = "$($UpdateSub.Resource)" + $EventType = "$($UpdateSub.EventType)" + + Write-Information "Recreating: $($UpdateSub.SubscriptionID) as renewal failed for $TenantFilter" + $CreateResult = New-CIPPGraphSubscription -TenantFilter $TenantFilter -TypeofSubscription $TypeofSubscription -BaseURL $BaseURL -Resource $Resource -EventType $EventType -Headers 'GraphSubscriptionRenewal' -Recreate + + if ($CreateResult -match 'Created Webhook subscription for') { + try { + Remove-CIPPAzDataTableEntity -Force @WebhookTable -Entity $UpdateSub -ErrorAction Stop + } catch { + if ($_.Exception.Message -notmatch 'does not exist|ResourceNotFound') { + throw + } + } + $Result.Success = $true + } else { + $Result.Error = "Recreation failed: $CreateResult" + } } - $Resource = "$($UpdateSub.Resource)" - $EventType = "$($UpdateSub.EventType)" + } catch { + $Result.Error = $_.Exception.Message + } - Write-LogMessage -API 'Renew_Graph_Subscriptions' -message "Recreating: $($UpdateSub.SubscriptionID) as renewal failed." -Sev 'Info' -tenant $TenantFilter - $CreateResult = New-CIPPGraphSubscription -TenantFilter $TenantFilter -TypeofSubscription $TypeofSubscription -BaseURL $BaseURL -Resource $Resource -EventType $EventType -Headers 'GraphSubscriptionRenewal' -Recreate + $Result + } -ThrottleLimit $ThrottleLimit - if ($CreateResult -match 'Created Webhook subscription for') { - Remove-CIPPAzDataTableEntity -Force @WebhookTable -Entity $UpdateSub + # Aggregate results + foreach ($Result in $Results) { + $ProcessedCount++ + if ($Result.Success) { + $SuccessCount++ + } else { + $FailedCount++ + if ($Result.Error) { + Write-LogMessage -API 'Renew_Graph_Subscriptions' -message "Failed to renew Webhook Subscription: $($Result.SubscriptionID). Error: $($Result.Error)" -Sev 'Error' -tenant $Result.TenantFilter } } - } catch { - Write-LogMessage -API 'Renew_Graph_Subscriptions' -message "Failed to renew Webhook Subscription: $($UpdateSub.SubscriptionID). Linenumber: $($_.InvocationInfo.ScriptLineNumber) Error: $($_.Exception.message)" -Sev 'Error' -tenant $TenantFilter + } + + # Log progress every batch + if ($ProcessedCount % 50 -lt $BatchSize) { + $ElapsedMinutes = [math]::Round(((Get-Date) - $StartTime).TotalMinutes, 2) + Write-LogMessage -API 'Scheduler_RenewGraphSubscriptions' -tenant 'none' -message "Webhook renewal progress: $ProcessedCount/$($ValidWebhooks.Count) processed in $ElapsedMinutes minutes" -sev Info } } + + $TotalElapsed = [math]::Round(((Get-Date) - $StartTime).TotalMinutes, 2) + Write-LogMessage -API 'Scheduler_RenewGraphSubscriptions' -tenant 'none' -message "Completed Graph Subscription Renewal: $SuccessCount succeeded, $FailedCount failed, $SkippedCount skipped out of $ProcessedCount processed in $TotalElapsed minutes" -sev Info } } diff --git a/backend/Modules/CIPPCore/Public/Webhooks/Invoke-CIPPWebhookProcessing.ps1 b/backend/Modules/CIPPCore/Public/Webhooks/Invoke-CIPPWebhookProcessing.ps1 index 26fda86afa..93b47f3c35 100644 --- a/backend/Modules/CIPPCore/Public/Webhooks/Invoke-CIPPWebhookProcessing.ps1 +++ b/backend/Modules/CIPPCore/Public/Webhooks/Invoke-CIPPWebhookProcessing.ps1 @@ -143,7 +143,7 @@ function Invoke-CippWebhookProcessing { } "Completed BEC Remediate for $Username" } - <#'cippcommand' { + 'cippcommand' { $CommandSplat = @{} $action.parameters.psobject.properties | ForEach-Object { $CommandSplat.Add($_.name, $_.value) } if ($CommandSplat['userid']) { $CommandSplat['userid'] = $Data.UserId } @@ -152,9 +152,6 @@ function Invoke-CippWebhookProcessing { if ($CommandSplat['user']) { $CommandSplat['user'] = $Data.UserId } if ($CommandSplat['username']) { $CommandSplat['username'] = $Data.UserId } & $action.command.value @CommandSplat - }#> - default { - Write-Host "Unknown action: $action" } } } @@ -262,12 +259,12 @@ function Invoke-CippWebhookProcessing { } 'generateWebhook' { $CippAlert = @{ - Type = 'webhook' - Title = $GenerateJSON.Title - JSONContent = $JsonContent - TenantFilter = $TenantFilter - APIName = 'Audit Log Alerts' - SchemaSource = 'Audit Log Alert' + Type = 'webhook' + Title = $GenerateJSON.Title + JSONContent = $JsonContent + TenantFilter = $TenantFilter + APIName = 'Audit Log Alerts' + SchemaSource = 'Audit Log Alert' InvokingCommand = 'Start-AuditLogProcessingOrchestrator' } Write-Host 'Sending Webhook Content' diff --git a/backend/Modules/CIPPCore/Public/Webhooks/New-CIPPGraphSubscription.ps1 b/backend/Modules/CIPPCore/Public/Webhooks/New-CIPPGraphSubscription.ps1 index 3b08d66bcd..ee77cc46c5 100644 --- a/backend/Modules/CIPPCore/Public/Webhooks/New-CIPPGraphSubscription.ps1 +++ b/backend/Modules/CIPPCore/Public/Webhooks/New-CIPPGraphSubscription.ps1 @@ -25,9 +25,9 @@ function New-CIPPGraphSubscription { # Required event types $EventList = [System.Collections.Generic.List[string]]@('test-created', 'granular-admin-relationship-approved') if (($EventType | Measure-Object).count -gt 0) { - foreach ($EventName in $EventType) { - if ($EventList -notcontains $EventName) { - $EventList.Add($EventName) + foreach ($Event in $EventType) { + if ($EventList -notcontains $Event) { + $EventList.Add($Event) } } } @@ -38,7 +38,7 @@ function New-CIPPGraphSubscription { } # The URL we want registered right now, based on the URL CIPP is currently served from - $DesiredWebhookUrl = "https://$BaseURL/api/PublicWebhooks?CIPPID=$($CIPPID)&Type=PartnerCenter" + $DesiredWebhookUrl = "https://$BaseURL/API/PublicWebhooks?CIPPID=$($CIPPID)&Type=PartnerCenter" $Body = [PSCustomObject]@{ WebhookUrl = $DesiredWebhookUrl WebhookEvents = @($EventList) @@ -110,7 +110,7 @@ function New-CIPPGraphSubscription { $expiredate = (Get-Date).AddDays(1).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ') $params = @{ changeType = $TypeofSubscription - notificationUrl = "https://$BaseURL/api/PublicWebhooks?EventType=$EventType&CIPPID=$($CIPPID)&Type=GraphSubscription" + notificationUrl = "https://$BaseURL/API/PublicWebhooks?EventType=$EventType&CIPPID=$($CIPPID)&Type=GraphSubscription" resource = $Resource expirationDateTime = $expiredate } | ConvertTo-Json @@ -141,7 +141,7 @@ function New-CIPPGraphSubscription { } else { # Check Graph directly for subscriptions matching this resource $ExistingSubs = @(New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/subscriptions' -tenantid $TenantFilter) - $MatchingSubs = @($ExistingSubs | Where-Object { $_.notificationUrl -match [regex]::Escape("https://$BaseURL/api/PublicWebhooks") -and $_.resource -eq $Resource } | Sort-Object -Property expirationDateTime -Descending) + $MatchingSubs = @($ExistingSubs | Where-Object { $_.notificationUrl -match [regex]::Escape("https://$BaseURL/API/PublicWebhooks") -and $_.resource -eq $Resource } | Sort-Object -Property expirationDateTime -Descending) # Keep the newest subscription, delete the rest from Graph and the table $KeptSub = $MatchingSubs | Select-Object -First 1 diff --git a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheConditionalAccessPolicies.ps1 b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheConditionalAccessPolicies.ps1 index 9acf4ac8e8..2e93d60d68 100644 --- a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheConditionalAccessPolicies.ps1 +++ b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheConditionalAccessPolicies.ps1 @@ -35,14 +35,11 @@ function Set-CIPPDBCacheConditionalAccessPolicies { try { $CAPolicies = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/policies?$top=999' -tenantid $TenantFilter - # -ClearOnEmpty marks the response AUTHORITATIVE: the read throws on failure, - # so reaching here means this is the tenant's full policy set. Cleanup then - # keys off the exact row keys written instead of the timestamp heuristic, - # whose 5-minute skew margin left policies deleted just before a re-collect - # sitting in the cache. An authoritative EMPTY set clears the cache too - a - # tenant whose last policy was removed must not keep reporting yesterday's. - Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ConditionalAccessPolicies' -Data @($CAPolicies) -AddCount -ClearOnEmpty - Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $(@($CAPolicies).Count) CA policies" -sev Debug + if ($CAPolicies) { + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ConditionalAccessPolicies' -Data $CAPolicies + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ConditionalAccessPolicies' -Data $CAPolicies -Count + Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($CAPolicies.Count) CA policies" -sev Debug + } $CAPolicies = $null } catch { Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache CA policies: $($_.Exception.Message)" -sev Warning @@ -50,8 +47,12 @@ function Set-CIPPDBCacheConditionalAccessPolicies { try { $NamedLocations = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/namedLocations?$top=999' -tenantid $TenantFilter - Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'NamedLocations' -Data @($NamedLocations) -AddCount -ClearOnEmpty - Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $(@($NamedLocations).Count) named locations" -sev Debug + + if ($NamedLocations) { + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'NamedLocations' -Data $NamedLocations + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'NamedLocations' -Data $NamedLocations -Count + Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($NamedLocations.Count) named locations" -sev Debug + } $NamedLocations = $null } catch { Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache named locations: $($_.Exception.Message)" -sev Warning @@ -59,21 +60,15 @@ function Set-CIPPDBCacheConditionalAccessPolicies { try { $AuthStrengths = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/authenticationStrength/policies' -tenantid $TenantFilter - Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'AuthenticationStrengths' -Data @($AuthStrengths) -AddCount -ClearOnEmpty - Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $(@($AuthStrengths).Count) authentication strengths" -sev Debug - $AuthStrengths = $null - } catch { - Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache authentication strengths: $($_.Exception.Message)" -sev Warning - } - try { - $SecurityDefaults = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/identitySecurityDefaultsEnforcementPolicy' -tenantid $TenantFilter -AsApp $true - if ($SecurityDefaults) { - Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'SecurityDefaults' -Data @($SecurityDefaults) - Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached Security Defaults policy (isEnabled=$($SecurityDefaults.isEnabled))" -sev Debug + if ($AuthStrengths) { + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'AuthenticationStrengths' -Data $AuthStrengths + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'AuthenticationStrengths' -Data $AuthStrengths -Count + Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($AuthStrengths.Count) authentication strengths" -sev Debug } + $AuthStrengths = $null } catch { - Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Security Defaults: $($_.Exception.Message)" -sev Warning + Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache authentication strengths: $($_.Exception.Message)" -sev Warning } Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached CA data successfully' -sev Debug diff --git a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCopilotUsageUserDetail.ps1 b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCopilotUsageUserDetail.ps1 index a03b0ba26a..07f0dbc8f0 100644 --- a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCopilotUsageUserDetail.ps1 +++ b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCopilotUsageUserDetail.ps1 @@ -19,18 +19,14 @@ function Set-CIPPDBCacheCopilotUsageUserDetail { try { Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Copilot usage user detail' -sev Debug - # Streamed into the writer: this report returns a row per user and is iterated once, so - # there is no reason to hold the whole set. Both previous branches ended in an - # Add-CIPPDbItem call - the empty one wrote the -Data @() marker - and a pipeline that - # yields nothing still runs the writer's end block, so that marker is still written. - $CachedRecords = 0 - New-GraphGetRequest -uri "https://graph.microsoft.com/beta/reports/getMicrosoft365CopilotUsageUserDetail(period='D30')" -tenantid $TenantFilter -AsApp $true -Stream | - ForEach-Object { $CachedRecords++; $_ } | - Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CopilotUsageUserDetail' -AddCount + $Data = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/reports/getMicrosoft365CopilotUsageUserDetail(period='D30')" -tenantid $TenantFilter -AsApp $true -Stream - if ($CachedRecords -gt 0) { - Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $CachedRecords Copilot usage user detail records" -sev Debug + if ($Data) { + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CopilotUsageUserDetail' -Data $Data -AddCount + Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($Data.Count) Copilot usage user detail records" -sev Debug } else { + # Write an empty marker so tests can distinguish "no data yet" from "cache not run" + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CopilotUsageUserDetail' -Data @() -AddCount Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Copilot usage user detail: no records returned (no active Copilot usage)' -sev Debug } diff --git a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsExternalAccessPolicy.ps1 b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsExternalAccessPolicy.ps1 index 501d0eca33..073b5fc3ad 100644 --- a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsExternalAccessPolicy.ps1 +++ b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsExternalAccessPolicy.ps1 @@ -4,7 +4,7 @@ function Set-CIPPDBCacheCsExternalAccessPolicy { Caches the Teams External Access Policy (Global) .DESCRIPTION - Calls Get-CsExternalAccessPolicy via New-TeamsRequestV2 and writes the + Calls Get-CsExternalAccessPolicy via New-TeamsRequest and writes the result into the CippReportingDB under Type 'CsExternalAccessPolicy'. Used by CIS tests 8.2.1 (external domains) and 8.2.2 (unmanaged Teams users). @@ -28,7 +28,8 @@ function Set-CIPPDBCacheCsExternalAccessPolicy { if ($ExternalAccess) { $Data = @($ExternalAccess) - Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsExternalAccessPolicy' -Data $Data -AddCount + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsExternalAccessPolicy' -Data $Data + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsExternalAccessPolicy' -Data $Data -Count Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached Teams External Access Policy' -sev Debug } else { # The request succeeded with nothing returned: write the authoritative empty set so the diff --git a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsAppPermissionPolicy.ps1 b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsAppPermissionPolicy.ps1 index fd62167d29..4168d851b0 100644 --- a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsAppPermissionPolicy.ps1 +++ b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsAppPermissionPolicy.ps1 @@ -4,7 +4,7 @@ function Set-CIPPDBCacheCsTeamsAppPermissionPolicy { Caches the Teams App Permission Policy (all policies) .DESCRIPTION - Calls Get-CsTeamsAppPermissionPolicy via New-TeamsRequestV2 and writes + Calls Get-CsTeamsAppPermissionPolicy via New-TeamsRequest and writes the result into the CippReportingDB under Type 'CsTeamsAppPermissionPolicy'. Used by CIS test 8.4.1. @@ -28,7 +28,8 @@ function Set-CIPPDBCacheCsTeamsAppPermissionPolicy { if ($AppPermissionPolicies) { $Data = @($AppPermissionPolicies) - Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsTeamsAppPermissionPolicy' -Data $Data -AddCount + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsTeamsAppPermissionPolicy' -Data $Data + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsTeamsAppPermissionPolicy' -Data $Data -Count Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($Data.Count) Teams App Permission Policies" -sev Debug } else { # The request succeeded with nothing returned: write the authoritative empty set so the diff --git a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsClientConfiguration.ps1 b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsClientConfiguration.ps1 index 21e59b1ce8..57c1a1df48 100644 --- a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsClientConfiguration.ps1 +++ b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsClientConfiguration.ps1 @@ -4,7 +4,7 @@ function Set-CIPPDBCacheCsTeamsClientConfiguration { Caches the Teams Client Configuration (Global) .DESCRIPTION - Calls Get-CsTeamsClientConfiguration via New-TeamsRequestV2 and writes + Calls Get-CsTeamsClientConfiguration via New-TeamsRequest and writes the result into the CippReportingDB under Type 'CsTeamsClientConfiguration'. Used by CIS tests 8.1.1 (external file sharing storage providers) and 8.1.2 (channel email). @@ -29,7 +29,8 @@ function Set-CIPPDBCacheCsTeamsClientConfiguration { if ($ClientConfig) { $Data = @($ClientConfig) - Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsTeamsClientConfiguration' -Data $Data -AddCount + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsTeamsClientConfiguration' -Data $Data + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsTeamsClientConfiguration' -Data $Data -Count Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached Teams Client Configuration' -sev Debug } else { # The request succeeded with nothing returned: write the authoritative empty set so the diff --git a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsFilesPolicy.ps1 b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsFilesPolicy.ps1 new file mode 100644 index 0000000000..6f4573522a --- /dev/null +++ b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsFilesPolicy.ps1 @@ -0,0 +1,44 @@ +function Set-CIPPDBCacheCsTeamsFilesPolicy { + <# + .SYNOPSIS + Caches the Teams Files Policy (Global) + + .DESCRIPTION + Calls Get-CsTeamsFilesPolicy via New-TeamsRequestV2 and writes the + result into the CippReportingDB under Type 'CsTeamsFilesPolicy'. + Used by the TeamsFilesPolicy standard (external chat file sharing). + + .PARAMETER TenantFilter + The tenant to cache the files policy for + + .PARAMETER QueueId + The queue ID to update with total tasks (optional) + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$TenantFilter, + [string]$QueueId + ) + + try { + Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Teams Files Policy' -sev Debug + + $FilesPolicy = New-TeamsRequestV2 -TenantFilter $TenantFilter -Type 'TeamsFilesPolicy' -Action Get -Identity 'Global' + + if ($FilesPolicy) { + $Data = @($FilesPolicy) + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsTeamsFilesPolicy' -Data $Data -AddCount + Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached Teams Files Policy' -sev Debug + } else { + # The request succeeded with nothing returned: write the authoritative empty set so the + # Count marker records a completed collection and stale rows are cleared. + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsTeamsFilesPolicy' -Data @() -AddCount -ClearOnEmpty + Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached 0 Teams Files Policies (none found)' -sev Debug + } + $FilesPolicy = $null + + } catch { + Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Teams Files Policy: $($_.Exception.Message)" -sev Error + } +} diff --git a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsMeetingPolicy.ps1 b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsMeetingPolicy.ps1 index b045dd64f9..914909e866 100644 --- a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsMeetingPolicy.ps1 +++ b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsMeetingPolicy.ps1 @@ -4,7 +4,7 @@ function Set-CIPPDBCacheCsTeamsMeetingPolicy { Caches the Teams Global Meeting Policy .DESCRIPTION - Calls Get-CsTeamsMeetingPolicy via New-TeamsRequestV2 and writes the + Calls Get-CsTeamsMeetingPolicy via New-TeamsRequest and writes the result into the CippReportingDB under Type 'CsTeamsMeetingPolicy'. Used by CIS tests 8.5.1 - 8.5.9. @@ -28,7 +28,8 @@ function Set-CIPPDBCacheCsTeamsMeetingPolicy { if ($MeetingPolicy) { $Data = @($MeetingPolicy) - Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsTeamsMeetingPolicy' -Data $Data -AddCount + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsTeamsMeetingPolicy' -Data $Data + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsTeamsMeetingPolicy' -Data $Data -Count Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached Teams Meeting Policy' -sev Debug } else { # The request succeeded with nothing returned: write the authoritative empty set so the diff --git a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsMessagingPolicy.ps1 b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsMessagingPolicy.ps1 index 860b056b5d..a5ec5e5bf0 100644 --- a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsMessagingPolicy.ps1 +++ b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTeamsMessagingPolicy.ps1 @@ -4,7 +4,7 @@ function Set-CIPPDBCacheCsTeamsMessagingPolicy { Caches the Teams Messaging Policy (Global) .DESCRIPTION - Calls Get-CsTeamsMessagingPolicy via New-TeamsRequestV2 and writes the + Calls Get-CsTeamsMessagingPolicy via New-TeamsRequest and writes the result into the CippReportingDB under Type 'CsTeamsMessagingPolicy'. Used by CIS tests 8.2.3 (external Teams users initiating chat) and 8.6.1 (security reporting in Teams). @@ -29,7 +29,8 @@ function Set-CIPPDBCacheCsTeamsMessagingPolicy { if ($MessagingPolicy) { $Data = @($MessagingPolicy) - Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsTeamsMessagingPolicy' -Data $Data -AddCount + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsTeamsMessagingPolicy' -Data $Data + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsTeamsMessagingPolicy' -Data $Data -Count Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached Teams Messaging Policy' -sev Debug } else { # The request succeeded with nothing returned: write the authoritative empty set so the diff --git a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTenantFederationConfiguration.ps1 b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTenantFederationConfiguration.ps1 index 5afb630bdc..1ecb7fa0e0 100644 --- a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTenantFederationConfiguration.ps1 +++ b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCsTenantFederationConfiguration.ps1 @@ -4,7 +4,7 @@ function Set-CIPPDBCacheCsTenantFederationConfiguration { Caches the Teams Tenant Federation Configuration .DESCRIPTION - Calls Get-CsTenantFederationConfiguration via New-TeamsRequestV2 and + Calls Get-CsTenantFederationConfiguration via New-TeamsRequest and writes the result into the CippReportingDB under Type 'CsTenantFederationConfiguration'. Used by CIS tests 8.2.1 (external domains allow/block list) and 8.2.4 (trial Teams tenants). @@ -29,7 +29,8 @@ function Set-CIPPDBCacheCsTenantFederationConfiguration { if ($Federation) { $Data = @($Federation) - Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsTenantFederationConfiguration' -Data $Data -AddCount + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsTenantFederationConfiguration' -Data $Data + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CsTenantFederationConfiguration' -Data $Data -Count Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached Teams Tenant Federation Configuration' -sev Debug } else { # The request succeeded with nothing returned: write the authoritative empty set so the diff --git a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoQuarantinePolicy.ps1 b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoQuarantinePolicy.ps1 index b648c5315b..bc3179807f 100644 --- a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoQuarantinePolicy.ps1 +++ b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoQuarantinePolicy.ps1 @@ -21,7 +21,8 @@ function Set-CIPPDBCacheExoQuarantinePolicy { $QuarantinePolicies = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-QuarantinePolicy' if ($QuarantinePolicies) { - Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoQuarantinePolicy' -Data $QuarantinePolicies -AddCount + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoQuarantinePolicy' -Data $QuarantinePolicies + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoQuarantinePolicy' -Data $QuarantinePolicies -Count Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($QuarantinePolicies.Count) Quarantine policies" -sev Debug } else { # The cmdlet succeeded with nothing returned: write the authoritative empty set so the diff --git a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheNetworkAccess.ps1 b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheNetworkAccess.ps1 new file mode 100644 index 0000000000..55325461dc --- /dev/null +++ b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheNetworkAccess.ps1 @@ -0,0 +1,70 @@ +function Set-CIPPDBCacheNetworkAccess { + <# + .SYNOPSIS + Caches Global Secure Access state for a tenant: onboarding status, forwarding + profiles (with policy groups and the profile app's assignment flag) and the + Conditional Access signaling setting. One row per tenant. + + .PARAMETER TenantFilter + The tenant to cache Global Secure Access state for + + .PARAMETER QueueId + The queue ID to update with total tasks (optional) + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$TenantFilter, + [string]$QueueId + ) + + try { + $TestResult = Test-CIPPStandardLicense -StandardName 'NetworkAccessCache' -TenantFilter $TenantFilter -Preset Entra -SkipLog + if ($TestResult -eq $false) { + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'NetworkAccess' -Data @() -AddCount -ClearOnEmpty + return + } + + $Status = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/networkAccess/tenantStatus' -tenantid $TenantFilter -AsApp $true + $Onboarded = $Status.onboardingStatus -eq 'onboarded' + $Profiles = [System.Collections.Generic.List[object]]::new() + $SignalingStatus = $null + + # Every networkAccess path except tenantStatus answers 403 until the tenant is onboarded. + if ($Onboarded) { + foreach ($RawProfile in @(New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/networkAccess/forwardingProfiles?$expand=policies($expand=policy)' -tenantid $TenantFilter -AsApp $true)) { + $AssignmentRequired = $null + if ($RawProfile.servicePrincipal.id) { + try { + $Sp = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/servicePrincipals/$($RawProfile.servicePrincipal.id)?`$select=appRoleAssignmentRequired" -tenantid $TenantFilter -AsApp $true + $AssignmentRequired = [bool]$Sp.appRoleAssignmentRequired + } catch { + Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Could not read the app behind forwarding profile '$($RawProfile.name)': $($_.Exception.Message)" -sev Warning + } + } + $Profiles.Add([PSCustomObject]@{ + id = $RawProfile.id + name = $RawProfile.name + state = $RawProfile.state + trafficForwardingType = $RawProfile.trafficForwardingType + isCustomProfile = [bool]$RawProfile.isCustomProfile + servicePrincipalId = $RawProfile.servicePrincipal.id + appRoleAssignmentRequired = $AssignmentRequired + policies = @($RawProfile.policies | ForEach-Object { [PSCustomObject]@{ id = $_.id; state = $_.state; policyName = $_.policy.name } }) + }) + } + $SignalingStatus = (New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/networkAccess/settings/conditionalAccess' -tenantid $TenantFilter -AsApp $true).signalingStatus + } + + $Row = [PSCustomObject]@{ + id = 'networkAccess' + onboardingStatus = $Status.onboardingStatus + onboarded = $Onboarded + signalingStatus = $SignalingStatus + profiles = @($Profiles) + } + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'NetworkAccess' -Data @($Row) -AddCount -ClearOnEmpty + } catch { + Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Global Secure Access state: $($_.Exception.Message)" -sev Error -LogData (Get-CippException -Exception $_) + } +} diff --git a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCachePIMSettings.ps1 b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCachePIMSettings.ps1 index f5999cdd7c..c4182a9262 100644 --- a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCachePIMSettings.ps1 +++ b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCachePIMSettings.ps1 @@ -34,7 +34,8 @@ function Set-CIPPDBCachePIMSettings { $PIMRoleSettings = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/policies/roleManagementPolicyAssignments?`$filter=scopeId eq '/' and scopeType eq 'DirectoryRole'&`$top=999" -tenantid $TenantFilter if ($PIMRoleSettings) { - Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'PIMRoleSettings' -Data $PIMRoleSettings -AddCount + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'PIMRoleSettings' -Data $PIMRoleSettings + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'PIMRoleSettings' -Data $PIMRoleSettings -Count Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($PIMRoleSettings.Count) PIM role settings" -sev Debug } else { # The request succeeded with nothing returned: write the authoritative empty set so the @@ -51,7 +52,8 @@ function Set-CIPPDBCachePIMSettings { $PIMAssignments = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/roleManagement/directory/roleEligibilityScheduleInstances?$top=999' -tenantid $TenantFilter if ($PIMAssignments) { - Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'PIMAssignments' -Data $PIMAssignments -AddCount + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'PIMAssignments' -Data $PIMAssignments + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'PIMAssignments' -Data $PIMAssignments -Count Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($PIMAssignments.Count) PIM assignments" -sev Debug } else { # The request succeeded with nothing returned: write the authoritative empty set so the diff --git a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSensitivityLabels.ps1 b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSensitivityLabels.ps1 index 6891d3c87c..5f0570727d 100644 --- a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSensitivityLabels.ps1 +++ b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSensitivityLabels.ps1 @@ -32,7 +32,8 @@ function Set-CIPPDBCacheSensitivityLabels { $Labels = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/security/informationProtection/sensitivityLabels' -tenantid $TenantFilter -AsApp $true if ($Labels) { - Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'SensitivityLabels' -Data $Labels -AddCount + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'SensitivityLabels' -Data $Labels + Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'SensitivityLabels' -Data $Labels -Count Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($Labels.Count) sensitivity labels" -sev Debug } else { # The read succeeded with nothing returned: write the authoritative empty set so the diff --git a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheUserPhotos.ps1 b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheUserPhotos.ps1 new file mode 100644 index 0000000000..902fed4c2e --- /dev/null +++ b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheUserPhotos.ps1 @@ -0,0 +1,108 @@ +function Set-CIPPDBCacheUserPhotos { + <# + .SYNOPSIS + Caches user profile photos for a tenant + + .DESCRIPTION + Fetches and caches all user profile photos for a tenant. + Photos are stored as base64 encoded strings with metadata. + Cache TTL is 7 days by default. + + .PARAMETER TenantFilter + The tenant to cache photos for + + .PARAMETER UserIds + Optional array of specific user IDs to cache photos for. + If not specified, fetches photos for all users. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$TenantFilter, + + [Parameter(Mandatory = $false)] + [string[]]$UserIds + ) + + try { + Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Starting user photo cache' -sev Debug + + $Table = Get-CippTable -tablename 'CacheUserPhotos' + $CachedCount = 0 + $SkippedCount = 0 + + # Get users to process + if ($UserIds) { + $UsersToProcess = $UserIds + } else { + # Get all users for the tenant + $Users = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/users?$select=id&$top=999' -tenantid $TenantFilter + $UsersToProcess = $Users | ForEach-Object { $_.id } + } + + # Binary photo content requires a raw web request (New-GraphGetRequest does not return bytes) + $GraphToken = Get-GraphToken -tenantid $TenantFilter + + foreach ($UserId in $UsersToProcess) { + try { + # Check if photo exists in Graph + $PhotoUri = "https://graph.microsoft.com/v1.0/users/$UserId/photo/`$value" + + try { + $PhotoRequest = Invoke-WebRequest -Uri $PhotoUri -Headers $GraphToken -Method GET -ErrorAction Stop + $PhotoResponse = [byte[]]$PhotoRequest.Content + + if ($PhotoResponse -and $PhotoResponse.Length -gt 0) { + # Convert to base64 + $PhotoBase64 = [Convert]::ToBase64String($PhotoResponse) + + # Store in cache + $Entity = @{ + PartitionKey = $TenantFilter + RowKey = $UserId + PhotoData = $PhotoBase64 + ContentType = 'image/jpeg' + HasPhoto = $true + CachedAt = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') + } + + Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force | Out-Null + $CachedCount++ + } else { + # User has no photo - cache this fact to avoid repeated lookups + $Entity = @{ + PartitionKey = $TenantFilter + RowKey = $UserId + PhotoData = '' + HasPhoto = $false + CachedAt = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') + } + + Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force | Out-Null + $SkippedCount++ + } + } catch { + # User doesn't have a photo or error occurred - cache as no photo + $Entity = @{ + PartitionKey = $TenantFilter + RowKey = $UserId + PhotoData = '' + HasPhoto = $false + CachedAt = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') + } + + Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force | Out-Null + $SkippedCount++ + } + + } catch { + Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache photo for user $UserId : $($_.Exception.Message)" -sev Debug + } + } + + Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $CachedCount user photos, $SkippedCount users have no photo" -sev Info + + } catch { + Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache user photos: $($_.Exception.Message)" -sev Error -LogData (Get-CippException -Exception $_) + } +} diff --git a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheUsers.ps1 b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheUsers.ps1 index deb536b7aa..e7c45b0220 100644 --- a/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheUsers.ps1 +++ b/backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheUsers.ps1 @@ -88,7 +88,7 @@ function Set-CIPPDBCacheUsers { } # Stream users directly from Graph API to batch processor - New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$top=$Top&`$select=$Select&`$count=true" -ComplexFilter -tenantid $TenantFilter -Stream | + New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$top=$Top&`$select=$Select&`$count=true" -ComplexFilter -tenantid $TenantFilter | Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Users' -AddCount Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached users successfully' -sev Debug diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCIPPDBCacheAdmin.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCIPPDBCacheAdmin.ps1 index 691764831c..e437ca9e8c 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCIPPDBCacheAdmin.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCIPPDBCacheAdmin.ps1 @@ -32,13 +32,25 @@ function Invoke-ExecCIPPDBCacheAdmin { }) } + $ValidationError = switch ($Action) { + 'List' { if ([string]::IsNullOrWhiteSpace($TenantFilter) -or [string]::IsNullOrWhiteSpace($Type)) { 'List requires TenantFilter and Type' } } + 'Remove' { + if ([string]::IsNullOrWhiteSpace($Type)) { 'Remove requires Type' } + elseif (-not $Body.Rows) { 'Remove requires Rows with CIPPPartitionKey/CIPPRowKey (or PartitionKey/RowKey)' } + } + 'Empty' { if ([string]::IsNullOrWhiteSpace($TenantFilter) -or [string]::IsNullOrWhiteSpace($Type)) { 'Empty requires TenantFilter and Type' } } + default { "Unknown Action '$Action'. Use List, Remove, or Empty." } + } + if ($ValidationError) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = $ValidationError } + }) + } + try { switch ($Action) { 'List' { - if ([string]::IsNullOrWhiteSpace($TenantFilter) -or [string]::IsNullOrWhiteSpace($Type)) { - throw 'List requires TenantFilter and Type' - } - $IsAllTenants = $TenantFilter -eq 'AllTenants' $DbTenant = if ($IsAllTenants) { 'allTenants' } else { $TenantFilter } $Rows = @(Get-CIPPDbItem -TenantFilter $DbTenant -Type $Type) @@ -79,14 +91,7 @@ function Invoke-ExecCIPPDBCacheAdmin { } 'Remove' { - if ([string]::IsNullOrWhiteSpace($Type)) { - throw 'Remove requires Type' - } - $Rows = @($Body.Rows) - if ($Rows.Count -eq 0) { - throw 'Remove requires Rows with CIPPPartitionKey/CIPPRowKey (or PartitionKey/RowKey)' - } # Deduplicate by partition+row so array-unrolled List rows sharing one entity delete once $Seen = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase) @@ -119,10 +124,6 @@ function Invoke-ExecCIPPDBCacheAdmin { } 'Empty' { - if ([string]::IsNullOrWhiteSpace($TenantFilter) -or [string]::IsNullOrWhiteSpace($Type)) { - throw 'Empty requires TenantFilter and Type' - } - $ClearResult = Clear-CIPPDbCache -TenantFilter $TenantFilter -Type $Type Write-LogMessage -API $APIName -tenant $TenantFilter -message "Emptied $Type cache for $($ClearResult.Tenant): $($ClearResult.RemovedCount) row(s)" -sev Warning return ([HttpResponseContext]@{ @@ -133,16 +134,12 @@ function Invoke-ExecCIPPDBCacheAdmin { } }) } - - default { - throw "Unknown Action '$Action'. Use List, Remove, or Empty." - } } } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -tenant $TenantFilter -message "CIPPDB cache admin failed: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest + StatusCode = [HttpStatusCode]::InternalServerError Body = @{ Results = $ErrorMessage.NormalizedError } }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCloneTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCloneTemplate.ps1 index e4f7c31348..a70ccf2a65 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCloneTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCloneTemplate.ps1 @@ -15,6 +15,7 @@ function Invoke-ExecCloneTemplate { $GUID = $Request.Query.GUID ?? $Request.Body.GUID $Type = $Request.Query.Type ?? $Request.Body.Type + $StatusCode = [HttpStatusCode]::OK if ($GUID -and $Type) { $Table = Get-CIPPTable -tablename templates @@ -52,6 +53,7 @@ function Invoke-ExecCloneTemplate { } } } catch { + $StatusCode = [HttpStatusCode]::InternalServerError $ErrorMessage = Get-CIPPException -Exception $_ $Result = "Failed to clone template (Type=$Type, GUID=$GUID): $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $Result -Sev 'Error' -LogData $ErrorMessage @@ -64,6 +66,7 @@ function Invoke-ExecCloneTemplate { } } } else { + $StatusCode = [HttpStatusCode]::NotFound $body = @{ Results = @{ state = 'error' @@ -72,6 +75,7 @@ function Invoke-ExecCloneTemplate { } } } else { + $StatusCode = [HttpStatusCode]::BadRequest $body = @{ Results = @{ state = 'error' @@ -80,7 +84,7 @@ function Invoke-ExecCloneTemplate { } } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecDurableFunctions.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecDurableFunctions.ps1 index 274496c2fb..b87ab0543e 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecDurableFunctions.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecDurableFunctions.ps1 @@ -16,6 +16,7 @@ function Invoke-ExecDurableFunctions { $Yesterday = (Get-Date).AddDays(-1).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') $Filter = "CreatedTime ge datetime'$Yesterday' or RuntimeStatus eq 'Pending' or RuntimeStatus eq 'Running'" $Instances = Get-CippAzDataTableEntity @InstancesTable -Filter $Filter + $StatusCode = [HttpStatusCode]::OK switch ($Request.Query.Action) { 'ListOrchestrators' { @@ -127,6 +128,7 @@ function Invoke-ExecDurableFunctions { } } catch { + $StatusCode = [HttpStatusCode]::InternalServerError $Body = [PSCustomObject]@{ Message = "Error resetting durables: $($_.Exception.Message)" Exception = Get-CippException -Exception $_ @@ -150,7 +152,6 @@ function Invoke-ExecDurableFunctions { } else { Remove-AzDataTable @InstancesTable Remove-AzDataTable @HistoryTable - # Drop these from the Get-CIPPTable cache so they get recreated on next use. Unregister-CIPPTable -TableName @( ('{0}Instances' -f $FunctionName) ('{0}History' -f $FunctionName) @@ -171,7 +172,7 @@ function Invoke-ExecDurableFunctions { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecEditTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecEditTemplate.ps1 index 8b89cc8960..690c027bac 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecEditTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecEditTemplate.ps1 @@ -9,6 +9,7 @@ function Invoke-ExecEditTemplate { param($Request, $TriggerMetadata) $APIName = $Request.Params.CIPPEndpoint + $StatusCode = [HttpStatusCode]::OK try { $Table = Get-CippTable -tablename 'templates' $guid = $request.Body.id ? $request.Body.id : $request.Body.GUID @@ -30,24 +31,7 @@ function Invoke-ExecEditTemplate { $NewGuid = $GUID } if ($Request.Body.parsedRAWJson) { - # Intune identifies a policy and every setting in it by @odata.type, and rejects a - # policy that is missing them. An editor that rebuilds the body from form state can - # drop them silently, which stores a template that only fails at deployment time - - # so refuse the write here rather than let a working template be replaced by one - # that cannot deploy. - $Incoming = $Request.Body.parsedRAWJson - $Stored = $TemplateData.RAWJson | ConvertFrom-Json -Depth 100 -ErrorAction SilentlyContinue - - if ($Stored.'@odata.type' -and -not $Incoming.'@odata.type') { - throw "The submitted policy is missing its '@odata.type' and was not saved, because it would no longer deploy." - } - - $MissingType = @($Incoming.settings).Where({ $_.settingInstance -and -not $_.settingInstance.'@odata.type' }) - if ($MissingType.Count -gt 0) { - throw "The submitted policy has $($MissingType.Count) setting(s) missing '@odata.type' and was not saved, because it would no longer deploy." - } - - $RawJSON = ConvertTo-Json -Compress -Depth 100 -InputObject $Incoming + $RawJSON = ConvertTo-Json -Compress -Depth 100 -InputObject $Request.Body.parsedRAWJson } else { $RawJSON = $TemplateData.RAWJson } @@ -95,11 +79,12 @@ function Invoke-ExecEditTemplate { } catch { Write-LogMessage -headers $Request.Headers -API $APINAME -tenant 'Global' -message "Failed to edit template: $($_.Exception.Message)" -Sev 'Error' $body = [pscustomobject]@{'Results' = "Editing template failed: $($_.Exception.Message)" } + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $body }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecFeatureFlag.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecFeatureFlag.ps1 index b5961417a5..e71a06d40c 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecFeatureFlag.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecFeatureFlag.ps1 @@ -8,23 +8,30 @@ function Invoke-ExecFeatureFlag { [CmdletBinding()] param($Request, $TriggerMetadata) - try { - $Action = $Request.Body.Action - $Id = $Request.Body.Id - $Enabled = $Request.Body.Enabled + $Action = $Request.Body.Action + $Id = $Request.Body.Id + $Enabled = $Request.Body.Enabled + $ValidationError = switch ($Action) { + 'Set' { + if ([string]::IsNullOrEmpty($Id)) { 'Feature flag Id is required' } + elseif ($null -eq $Enabled) { 'Enabled state is required' } + } + 'Get' {} + default { "Invalid action: $Action. Valid actions are 'Set' or 'Get'" } + } + if ($ValidationError) { + return [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ error = $ValidationError } + } + } + + try { Write-LogMessage -API 'ExecFeatureFlag' -message "Processing feature flag action: $Action for $Id" -sev 'Info' switch ($Action) { 'Set' { - if ([string]::IsNullOrEmpty($Id)) { - throw 'Feature flag Id is required' - } - - if ($null -eq $Enabled) { - throw 'Enabled state is required' - } - # Use Set-CIPPFeatureFlag to update the flag $Result = Set-CIPPFeatureFlag -Id $Id -Enabled ([bool]$Enabled) @@ -50,13 +57,10 @@ function Invoke-ExecFeatureFlag { $StatusCode = [HttpStatusCode]::OK $Body = $Flags } - default { - throw "Invalid action: $Action. Valid actions are 'Set' or 'Get'" - } } } catch { Write-LogMessage -API 'ExecFeatureFlag' -message "Failed to process feature flag: $($_.Exception.Message)" -sev 'Error' - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError $Body = @{ error = $_.Exception.Message details = $_.Exception diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecListBackup.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecListBackup.ps1 index 02e8b65272..7e025728bd 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecListBackup.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecListBackup.ps1 @@ -4,63 +4,81 @@ function Invoke-ExecListBackup { Entrypoint .ROLE CIPP.Backup.Read - .DESCRIPTION - Lists stored CIPP backups, optionally narrowed by Type, tenantFilter or BackupName. NameOnly=true returns just the backup names and the items each one contains, without the backup payload. #> [CmdletBinding()] param($Request, $TriggerMetadata) - $Type = $Request.Query.Type - $TenantFilter = $Request.Query.tenantFilter - $NameOnly = $Request.Query.NameOnly -eq $true - $BackupName = $Request.Query.BackupName - $CippBackupParams = @{} - if ($Type) { $CippBackupParams.Type = $Type } - if ($TenantFilter) { $CippBackupParams.TenantFilter = $TenantFilter } - if ($BackupName) { $CippBackupParams.Name = $BackupName } - if ($NameOnly) { $CippBackupParams.NameOnly = $NameOnly } + try { + $Type = $Request.Query.Type + $TenantFilter = $Request.Query.tenantFilter + $NameOnly = $Request.Query.NameOnly -eq $true + $BackupName = $Request.Query.BackupName - $Result = Get-CIPPBackup @CippBackupParams + $CippBackupParams = @{} + if ($Type) { $CippBackupParams.Type = $Type } + if ($TenantFilter) { $CippBackupParams.TenantFilter = $TenantFilter } + if ($BackupName) { $CippBackupParams.Name = $BackupName } + if ($NameOnly) { $CippBackupParams.NameOnly = $NameOnly } - if ($NameOnly) { - try { - $Processed = foreach ($item in $Result) { - $properties = $item.PSObject.Properties | Where-Object { $_.Name -notin @('TenantFilter', 'ETag', 'PartitionKey', 'RowKey', 'Timestamp', 'OriginalEntityId', 'SplitOverProps', 'PartIndex', 'Backup', 'BackupIsBlob') -and $_.Value } + $Result = Get-CIPPBackup @CippBackupParams - if ($Type -eq 'Scheduled') { - [PSCustomObject]@{ - TenantFilter = $item.RowKey -match '^(.*?)_' | ForEach-Object { $matches[1] } - BackupName = $item.RowKey - Timestamp = $item.Timestamp - Items = $properties.Name - } - } else { - # Prefer stored indicator (BackupIsBlob) to avoid reading Backup field - $isBlob = $false - if ($null -ne $item.PSObject.Properties['BackupIsBlob']) { - try { $isBlob = [bool]$item.BackupIsBlob } catch { $isBlob = $false } + if ($NameOnly) { + try { + $Processed = foreach ($item in $Result) { + $properties = $item.PSObject.Properties | Where-Object { $_.Name -notin @('TenantFilter', 'ETag', 'PartitionKey', 'RowKey', 'Timestamp', 'OriginalEntityId', 'SplitOverProps', 'PartIndex', 'Backup', 'BackupIsBlob') -and $_.Value } + + if ($Type -eq 'Scheduled') { + $extractedTenant = if ($item.RowKey -match '^([^_]+)_') { $matches[1] } else { $null } + [PSCustomObject]@{ + TenantFilter = $extractedTenant + BackupName = $item.RowKey + Timestamp = $item.Timestamp + Items = $properties.Name + } } else { - # Fallback heuristic for legacy rows if property missing - if ($null -ne $item.PSObject.Properties['Backup']) { - $b = $item.Backup - if ($b -is [string] -and ($b -like 'https://*' -or $b -like 'http://*')) { $isBlob = $true } + # Prefer stored indicator (BackupIsBlob) to avoid reading Backup field + $isBlob = $false + if ($null -ne $item.PSObject.Properties['BackupIsBlob']) { + try { $isBlob = [bool]$item.BackupIsBlob } catch { $isBlob = $false } + } else { + # Fallback heuristic for legacy rows if property missing + if ($null -ne $item.PSObject.Properties['Backup']) { + $b = $item.Backup + if ($b -is [string] -and ($b -like 'https://*' -or $b -like 'http://*')) { $isBlob = $true } + } + } + [PSCustomObject]@{ + BackupName = $item.RowKey + Timestamp = $item.Timestamp + Source = if ($isBlob) { 'blob' } else { 'table' } } - } - [PSCustomObject]@{ - BackupName = $item.RowKey - Timestamp = $item.Timestamp - Source = if ($isBlob) { 'blob' } else { 'table' } } } + $Result = if ($Processed) { @($Processed | Sort-Object Timestamp -Descending) } else { @() } + } catch { + Write-Warning "Error processing backup entries: $_" + Write-Information $_.InvocationInfo.PositionMessage } - $Result = if ($Processed) { @($Processed | Sort-Object Timestamp -Descending) } else { @() } - } catch { - Write-Warning "Error processing backup entries: $_" - Write-Information $_.InvocationInfo.PositionMessage } + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @($Result) + }) + } catch { + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -API 'ExecListBackup' -message "Failed to list backups: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + ContentType = 'application/json' + Body = @{ + error = "Failed to list backups: $($ErrorMessage.NormalizedError)" + details = @{ + operation = 'ListBackups' + type = $Type ?? 'CIPP' + innerException = $_.Exception.Message + } + } | ConvertTo-Json -Depth 5 -Compress + }) } - return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK - Body = @($Result) - }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecPartnerWebhook.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecPartnerWebhook.ps1 index ba953bef9c..b3ff522699 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecPartnerWebhook.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecPartnerWebhook.ps1 @@ -37,22 +37,10 @@ function Invoke-ExecPartnerWebhook { } # The URL that would be registered if the subscription were saved right now, so the UI can - # flag a subscription still pointing at a previous CIPP URL. Resolved from the custom - # domain bound to the instance rather than the host the admin browsed in on - otherwise - # visiting the *.azurewebsites.net URL tells you to re-register against it, which is the - # opposite of what warmup reconciles the stored URL to. - $CurrentHostname = Get-CIPPHostname -Headers $Request.Headers -PreferCustomDomain + # flag a subscription still pointing at a previous CIPP URL. + $CurrentHostname = Get-CIPPHostname -Headers $Request.Headers if ($CurrentHostname) { $Results | Add-Member -MemberType NoteProperty -Name 'expectedWebhookUrl' -Value "https://$CurrentHostname/api/PublicWebhooks?CIPPID=$($env:TenantID)&Type=PartnerCenter" -Force - $Results | Add-Member -MemberType NoteProperty -Name 'instanceHostname' -Value $CurrentHostname -Force - } - - # Surfaced so the UI can explain which domain was picked when several are bound. - try { - $SiteState = Get-CIPPSiteHostname -IncludeStatus -NoFallback - $Results | Add-Member -MemberType NoteProperty -Name 'customDomains' -Value @($SiteState.CustomHostnames) -Force - } catch { - Write-Information "ExecPartnerWebhook: custom domain lookup failed: $($_.Exception.Message)" } } 'CreateSubscription' { @@ -60,10 +48,8 @@ function Invoke-ExecPartnerWebhook { $Request.Body.EventType = $Request.Body.EventType.value } - # Resolve the URL CIPP is published on and store it for background jobs. The bound custom - # domain wins over the request host so a save made from the *.azurewebsites.net URL does - # not register Partner Center against a hostname warmup will reconcile away again. - $BaseURL = Get-CIPPHostname -Headers $Request.Headers -PreferCustomDomain -Save + # Resolve the URL CIPP is served from at the time of submit, and store it for background jobs + $BaseURL = Get-CIPPHostname -Headers $Request.Headers -Save $Webhook = @{ TenantFilter = $env:TenantID PartnerCenter = $true diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSAMCertificate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSAMCertificate.ps1 index 7be0de1667..c141090e9a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSAMCertificate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSAMCertificate.ps1 @@ -14,9 +14,15 @@ function Invoke-ExecSAMCertificate { [CmdletBinding()] param($Request, $TriggerMetadata) - try { - $Action = $Request.Body.Action ?? $Request.Query.Action ?? 'Get' + $Action = $Request.Body.Action ?? $Request.Query.Action ?? 'Get' + if ($Action -notin @('Get', 'Renew')) { + return [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Failed to process SAM certificate request: Invalid action: $Action. Valid actions are 'Get' or 'Renew'" } + } + } + try { switch ($Action) { 'Get' { $Stored = Get-CIPPSAMCertificate -SkipCache -ErrorAction SilentlyContinue @@ -56,13 +62,10 @@ function Invoke-ExecSAMCertificate { } $StatusCode = [HttpStatusCode]::OK } - default { - throw "Invalid action: $Action. Valid actions are 'Get' or 'Renew'" - } } } catch { Write-LogMessage -API 'ExecSAMCertificate' -message "Failed to process SAM certificate request: $($_.Exception.Message)" -sev 'Error' -LogData (Get-CippException -Exception $_) - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError $Body = @{ Results = "Failed to process SAM certificate request: $($_.Exception.Message)" } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecServicePrincipals.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecServicePrincipals.ps1 index 0e2a9a8222..190abef183 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecServicePrincipals.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecServicePrincipals.ps1 @@ -12,6 +12,7 @@ function Invoke-ExecServicePrincipals { $TenantFilter = $env:TenantID $Success = $true + $StatusCode = [HttpStatusCode]::OK $Action = $Request.Query.Action ?? 'Default' try { @@ -32,6 +33,7 @@ function Invoke-ExecServicePrincipals { if ($BlockList -contains $Request.Query.AppId) { $Results = 'Service Principal creation is blocked for this AppId' $Success = $false + $StatusCode = [HttpStatusCode]::BadRequest Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -Sev 'Error' } else { $Body = @{ @@ -45,12 +47,14 @@ function Invoke-ExecServicePrincipals { $ErrorMessage = Get-CippException -Exception $_ $Results = "Unable to create service principal: $($ErrorMessage.NormalizedError)" $Success = $false + $StatusCode = [HttpStatusCode]::InternalServerError Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -Sev 'Error' -LogData $ErrorMessage } } } else { $Results = 'Invalid AppId' $Success = $false + $StatusCode = [HttpStatusCode]::BadRequest Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -Sev 'Error' } } @@ -76,6 +80,7 @@ function Invoke-ExecServicePrincipals { $ErrorMessage = Get-CippException -Exception $_ $Results = $ErrorMessage.NormalizedError $Success = $false + $StatusCode = [HttpStatusCode]::InternalServerError if ($Action -eq 'Create') { Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to create service principal: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage } @@ -101,7 +106,7 @@ function Invoke-ExecServicePrincipals { $Json = $Body | ConvertTo-Json -Depth 10 -Compress return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Json }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetCIPPAutoBackup.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetCIPPAutoBackup.ps1 index 02eeb81498..8ba280d487 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetCIPPAutoBackup.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetCIPPAutoBackup.ps1 @@ -7,42 +7,62 @@ function Invoke-ExecSetCIPPAutoBackup { #> [CmdletBinding()] param($Request, $TriggerMetadata) - $unixtime = [int64](([datetime]::UtcNow) - (Get-Date '1/1/1970')).TotalSeconds - if ($Request.Body.Enabled -eq $true) { - $Table = Get-CIPPTable -TableName 'ScheduledTasks' - $AutomatedCIPPBackupTask = Get-AzDataTableEntity @table -Filter "Name eq 'Automated CIPP Backup'" -Property RowKey, PartitionKey, ETag - if ($AutomatedCIPPBackupTask) { - Remove-CIPPAzDataTableEntity -Force @Table -Entity $AutomatedCIPPBackupTask | Out-Null - } - $TaskBody = [pscustomobject]@{ - TenantFilter = 'PartnerTenant' - Name = 'Automated CIPP Backup' - Command = @{ - value = 'New-CIPPBackup' - label = 'New-CIPPBackup' + $APIName = $Request.Params.CIPPEndpoint + $StatusCode = [HttpStatusCode]::OK + + try { + $unixtime = [int64](([datetime]::UtcNow) - (Get-Date '1/1/1970')).TotalSeconds + if ($Request.Body.Enabled -eq $true) { + $Table = Get-CIPPTable -TableName 'ScheduledTasks' + $AutomatedCIPPBackupTask = Get-AzDataTableEntity @table -Filter "Name eq 'Automated CIPP Backup'" -Property RowKey, PartitionKey, ETag + if ($AutomatedCIPPBackupTask) { + Remove-CIPPAzDataTableEntity -Force @Table -Entity $AutomatedCIPPBackupTask | Out-Null + } + + $TaskBody = [pscustomobject]@{ + TenantFilter = 'PartnerTenant' + Name = 'Automated CIPP Backup' + Command = @{ + value = 'New-CIPPBackup' + label = 'New-CIPPBackup' + } + Parameters = [pscustomobject]@{ backupType = 'CIPP' } + ScheduledTime = $unixtime + Recurrence = '1d' + } + Add-CIPPScheduledTask -Task $TaskBody -hidden $false -DisallowDuplicateName $true + $Result = @{ 'Results' = 'Scheduled Task Successfully created' } | ConvertTo-Json -Compress + Write-LogMessage -headers $Request.Headers -API $APIName -message 'Scheduled automatic CIPP backups' -Sev 'Info' + } elseif ($Request.Body.Enabled -eq $false) { + $Table = Get-CIPPTable -TableName 'ScheduledTasks' + $AutomatedCIPPBackupTask = Get-AzDataTableEntity @table -Filter "Name eq 'Automated CIPP Backup'" -Property RowKey, PartitionKey, ETag + if ($AutomatedCIPPBackupTask) { + Remove-CIPPAzDataTableEntity -Force @Table -Entity $AutomatedCIPPBackupTask | Out-Null + $Result = @{ 'Results' = 'Scheduled Task Successfully removed' } | ConvertTo-Json -Compress + } else { + $Result = @{ 'Results' = 'No existing scheduled task found to remove' } | ConvertTo-Json -Compress } - Parameters = [pscustomobject]@{ backupType = 'CIPP' } - ScheduledTime = $unixtime - Recurrence = '1d' - } - Add-CIPPScheduledTask -Task $TaskBody -hidden $false -DisallowDuplicateName $true - $Result = @{ 'Results' = 'Scheduled Task Successfully created' } - } elseif ($Request.Body.Enabled -eq $false) { - $Table = Get-CIPPTable -TableName 'ScheduledTasks' - $AutomatedCIPPBackupTask = Get-AzDataTableEntity @table -Filter "Name eq 'Automated CIPP Backup'" -Property RowKey, PartitionKey, ETag - if ($AutomatedCIPPBackupTask) { - Remove-CIPPAzDataTableEntity -Force @Table -Entity $AutomatedCIPPBackupTask | Out-Null - $Result = @{ 'Results' = 'Scheduled Task Successfully removed' } } else { - $Result = @{ 'Results' = 'No existing scheduled task found to remove' } + $Result = @{ 'Results' = 'No action taken - Enabled parameter not set' } | ConvertTo-Json -Compress } - + } catch { + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -headers $Request.Headers -API $APIName -message "Failed to schedule automatic CIPP backups: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError + $Result = @{ + error = "Failed to schedule automatic backups: $($ErrorMessage.NormalizedError)" + details = @{ + operation = 'SetAutoBackup' + innerException = $_.Exception.Message + } + } | ConvertTo-Json -Depth 5 -Compress } - Write-LogMessage -headers $Request.Headers -API $Request.Params.CIPPEndpoint -message 'Scheduled automatic CIPP backups' -Sev 'Info' + return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK - Body = $Result + StatusCode = $StatusCode + ContentType = 'application/json' + Body = $Result }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetPackageTag.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetPackageTag.ps1 index 0f07949724..146c204981 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetPackageTag.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetPackageTag.ps1 @@ -13,9 +13,22 @@ function Invoke-ExecSetPackageTag { $Table = Get-CippTable -tablename 'templates' + $StatusCode = [HttpStatusCode]::OK try { - $GUIDS = $Request.body.GUID - $Remove = $Request.body.Remove + # multiPost bulk actions POST an array of template objects. Do not read + # $Request.Body.Remove on an array — that resolves to Array.Remove (method), + # not the NoteProperty, so Remove bulk incorrectly takes the Add path. + $Items = if ($Request.Body -is [array]) { @($Request.Body) } else { @($Request.Body) } + $First = $Items | Select-Object -First 1 + $GUIDS = @( + $Items | + ForEach-Object { $_.GUID } | + Where-Object { -not [string]::IsNullOrWhiteSpace($_) } + ) + $Remove = $false + if ($null -ne $First -and ($First.PSObject.Properties.Name -contains 'Remove')) { + $Remove = [boolean]$First.Remove + } if ($Remove -eq $true) { # Remove package tag by setting it to null/empty @@ -24,7 +37,7 @@ function Invoke-ExecSetPackageTag { $SuccessMessage = 'Successfully removed package tag from template(s)' } else { # Add package tag (existing logic) - $PackageValue = [string]($Request.body.Package | Select-Object -First 1) + $PackageValue = [string]$First.Package $LogMessage = 'Successfully updated template with GUID' $SuccessMessage = "Successfully updated template(s) with package tag: $PackageValue" } @@ -55,6 +68,7 @@ function Invoke-ExecSetPackageTag { $body = [pscustomobject]@{ 'Results' = $SuccessMessage } } catch { + $StatusCode = [HttpStatusCode]::InternalServerError $ErrorMessage = Get-CippException -Exception $_ if ($Remove -eq $true) { Write-LogMessage -headers $Headers -API $APIName -message "Failed to remove package tag: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage @@ -66,7 +80,7 @@ function Invoke-ExecSetPackageTag { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecUniversalSearch.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecUniversalSearch.ps1 index 95160222e2..2e99d65454 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecUniversalSearch.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecUniversalSearch.ps1 @@ -39,7 +39,7 @@ function Invoke-ExecUniversalSearch { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = "Could not connect to Azure Lighthouse API: $($ErrorMessage)" } return [HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecUniversalSearchV2.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecUniversalSearchV2.ps1 index fb9b39de6c..5b05332593 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecUniversalSearchV2.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecUniversalSearchV2.ps1 @@ -5,7 +5,7 @@ function Invoke-ExecUniversalSearchV2 { .ROLE CIPP.Core.Read .DESCRIPTION - Searches across every tenant the caller can access and returns matches with the tenant each belongs to. type selects what is searched: Users (the default), Groups, Applications or Licenses. Reads the cached report data, so results are as fresh as the last cache run. + Searches cached report data the caller can access and returns matches with the tenant each belongs to. type selects what is searched: Users (the default), Groups, Applications or Licenses. An explicit tenantFilter is honored only when that tenant is inside the caller's scope. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -13,23 +13,30 @@ function Invoke-ExecUniversalSearchV2 { $SearchTerms = $Request.Query.searchTerms $Limit = if ($Request.Query.limit) { [int]$Request.Query.limit } else { 10 } $Type = if ($Request.Query.type) { $Request.Query.type } else { 'Users' } + $RequestedTenant = $Request.Query.tenantFilter $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList if ($AllowedTenants -notcontains 'AllTenants') { - $TenantFilter = Get-Tenants | Select-Object -ExpandProperty defaultDomainName + $ScopedTenants = @(Get-Tenants | Select-Object -ExpandProperty defaultDomainName) # Empty scope: a null filter would search every tenant - if (-not $TenantFilter) { + if (-not $ScopedTenants) { return [HttpResponseContext]@{ StatusCode = [HttpStatusCode]::OK Body = @() } } + if ($RequestedTenant -and ($ScopedTenants -contains $RequestedTenant)) { + $TenantFilter = $RequestedTenant + } else { + $TenantFilter = $ScopedTenants + } + } elseif ($RequestedTenant -and $RequestedTenant -notin @('allTenants', 'AllTenants')) { + $TenantFilter = $RequestedTenant } else { $TenantFilter = 'allTenants' } - # Always search all tenants - do not pass TenantFilter parameter switch ($Type) { 'Users' { $Results = Search-CIPPDbData -SearchTerms $SearchTerms -Types 'Users' -Limit $Limit -Properties 'id', 'userPrincipalName', 'displayName' -TenantFilter $TenantFilter diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetCippAlerts.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetCippAlerts.ps1 index 28ebbadde3..64b70c44e3 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetCippAlerts.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetCippAlerts.ps1 @@ -40,33 +40,58 @@ function Invoke-GetCippAlerts { } if ($Version.OutOfDateCIPP) { $Alerts.Add(@{ - title = 'CIPP Frontend Out of Date' - Alert = "Your CIPP Frontend is out of date. $UpdateAction Find more on the following " - link = 'https://docs.cipp.app/setup/self-hosting-guide/updating' + title = 'Manage365 Frontend Behind Upstream' + Alert = "Manage365 frontend reports v$($Version.LocalCIPPVersion) but upstream CIPP is v$($Version.RemoteCIPPVersion). $UpdateAction" + link = 'https://github.com/Celeratec/Manage365' type = 'warning' }) - Write-LogMessage -message "Your CIPP Frontend is out of date. $UpdateAction" -API 'Updates' -tenant 'All Tenants' -sev Alert + Write-LogMessage -message "Manage365 frontend v$($Version.LocalCIPPVersion) is behind upstream CIPP v$($Version.RemoteCIPPVersion). $UpdateAction" -API 'Updates' -tenant 'All Tenants' -sev Alert } if ($Version.OutOfDateCIPPAPI) { $Alerts.Add(@{ - title = 'CIPP API Out of Date' - Alert = "Your CIPP API is out of date. $UpdateAction Find more on the following" - link = 'https://docs.cipp.app/setup/self-hosting-guide/updating' + title = 'Manage365 API Behind Upstream' + Alert = "Manage365 API reports v$($Version.LocalCIPPAPIVersion) but upstream CIPP-API is v$($Version.RemoteCIPPAPIVersion). $UpdateAction" + link = 'https://github.com/Celeratec/Manage365' type = 'warning' }) - Write-LogMessage -message "Your CIPP API is out of date. $UpdateAction" -API 'Updates' -tenant 'All Tenants' -sev Alert + Write-LogMessage -message "Manage365 API v$($Version.LocalCIPPAPIVersion) is behind upstream CIPP-API v$($Version.RemoteCIPPAPIVersion). $UpdateAction" -API 'Updates' -tenant 'All Tenants' -sev Alert } - if ($role -like '*superadmin*') { + # The placeholder ApplicationID is what a fresh deploy ships before SAM setup. + if ($env:ApplicationID -eq 'LongApplicationID' -or $null -eq $env:ApplicationID) { $Alerts.Add(@{ - title = 'Superadmin Account Warning' - Alert = 'You are logged in under a superadmin account. This account should not be used for normal usage.' - link = 'https://docs.cipp.app/setup/installation/owntenant' - type = 'error' + title = 'SAM Setup Incomplete' + Alert = 'You have not yet completed your setup. Please go to the Setup Wizard in Application Settings to connect Manage365 to your tenants.' + link = '/cipp/setup' + type = 'warning' + setupCompleted = $false }) } + if ($role -like '*superadmin*') { + $Username = $null + $Principal = $Request.Headers.'x-ms-client-principal' + if ($Principal) { + try { + $SwaCreds = ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Principal)) | ConvertFrom-Json) + $Username = $SwaCreds.userDetails + } catch { + Write-Information "Could not read the signed-in user for the superadmin warning: $($_.Exception.Message)" + } + } + # This account is the instance owner and is expected to sign in as superadmin. + $SuperAdminIgnoreList = @('Clint@celeratec.cloud') + if ($Username -notin $SuperAdminIgnoreList) { + $Alerts.Add(@{ + title = 'Superadmin Account Warning' + Alert = 'You are logged in under a superadmin account. This account should not be used for normal usage.' + link = 'https://docs.cipp.app/setup/installation/owntenant' + type = 'error' + }) + } + } + # Outstanding SAM permissions are only visible by opening the permissions page, so an # instance can sit needing consent without anyone noticing. Surface it here like the other # instance health warnings. Only shown to roles that can actually grant the consent. diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetVersion.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetVersion.ps1 index f61d8776be..d410fa7314 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetVersion.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetVersion.ps1 @@ -10,6 +10,34 @@ function Invoke-GetVersion { [CmdletBinding()] param($Request, $TriggerMetadata) $CIPPVersion = $request.query.LocalVersion + $CleanupStale = $request.query.CleanupStale -eq $true + + # If cleanup requested, remove stale version entries first + if ($CleanupStale) { + try { + $VersionTable = Get-CippTable -tablename 'Version' + $AllVersions = Get-CIPPAzDataTableEntity @VersionTable -Filter "PartitionKey eq 'Version'" + + foreach ($ver in $AllVersions) { + # Remove entries with very old versions (before v7.0.0) or invalid versions + if ($ver.Version) { + try { + $semVer = [semver]$ver.Version + if ($semVer.Major -lt 7) { + Write-Information "Removing stale version entry: $($ver.RowKey) = $($ver.Version)" + Remove-CIPPAzDataTableEntity @VersionTable -Entity $ver + } + } catch { + # Invalid semver - remove it + Write-Information "Removing invalid version entry: $($ver.RowKey) = $($ver.Version)" + Remove-CIPPAzDataTableEntity @VersionTable -Entity $ver + } + } + } + } catch { + Write-Warning "Failed to cleanup stale versions: $($_.Exception.Message)" + } + } try { $Version = Assert-CippVersion -CIPPVersion $CIPPVersion diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListCustomDataMappings.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListCustomDataMappings.ps1 index e9aa67f33b..d5c91d1b0b 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListCustomDataMappings.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListCustomDataMappings.ps1 @@ -17,6 +17,7 @@ function Invoke-ListCustomDataMappings { Write-Information "Listing custom data mappings with filters - sourceType: $SourceTypeFilter, directoryObject: $DirectoryObjectFilter, tenant: $TenantFilter" + $StatusCode = [HttpStatusCode]::OK try { $Mappings = Get-CIPPAzDataTableEntity @CustomDataMappingsTable | ForEach-Object { $Mapping = $_.JSON | ConvertFrom-Json -AsHashtable @@ -56,6 +57,7 @@ function Invoke-ListCustomDataMappings { Results = @($Mappings) } } catch { + $StatusCode = [HttpStatusCode]::InternalServerError $Body = @{ Results = @( @{ @@ -67,7 +69,7 @@ function Invoke-ListCustomDataMappings { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListDBCache.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListDBCache.ps1 index 655c20ccca..fb36a97cc4 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListDBCache.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListDBCache.ps1 @@ -125,7 +125,10 @@ function Invoke-ListDBCache { } else { $Tenant = (Get-Tenants -TenantFilter $TenantFilter).defaultDomainName if (-not $Tenant) { - throw "Tenant '$TenantFilter' not found" + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = @{ Results = "Tenant '$TenantFilter' not found" } + }) } } @@ -146,7 +149,10 @@ function Invoke-ListDBCache { # A single-tenant request would otherwise be unguarded now that AnyTenant is set. if (-not $IsAllTenants -and -not $AllowedDomains.Contains([string]$Tenant)) { - throw 'Access to this tenant is not allowed' + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::Forbidden + Body = @{ Results = 'Access to this tenant is not allowed' } + }) } } @@ -274,7 +280,7 @@ function Invoke-ListDBCache { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -tenant $TenantFilter -message "Failed to list DB cache: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest + StatusCode = [HttpStatusCode]::InternalServerError Body = @{ Results = $ErrorMessage.NormalizedError } }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListDirectoryObjects.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListDirectoryObjects.ps1 index 30264a08f1..f48c21e1a4 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListDirectoryObjects.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListDirectoryObjects.ps1 @@ -39,7 +39,7 @@ function Invoke-ListDirectoryObjects { $Results = New-GraphPOSTRequest -tenantid $TenantFilter -uri $Uri -body $Body -AsApp $AsApp -NoAuthCheck $true $StatusCode = [System.Net.HttpStatusCode]::OK } catch { - $StatusCode = [System.Net.HttpStatusCode]::BadRequest + $StatusCode = [System.Net.HttpStatusCode]::InternalServerError $Results = $_.Exception.Message Write-Warning "Error retrieving directory objects: $Results" Write-Information $_.InvocationInfo.PositionMessage diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListExtensionCacheData.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListExtensionCacheData.ps1 index 155d8e7059..28c6080d25 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListExtensionCacheData.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListExtensionCacheData.ps1 @@ -32,7 +32,7 @@ function Invoke-ListExtensionCacheData { return ([HttpResponseContext]@{ StatusCode = $StatusCode - Body = $Body | ConvertTo-Json -Compress -Depth 100 + Body = $Body | ConvertTo-Json -Compress -Depth 20 Headers = @{ 'Content-Type' = 'application/json' } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListFeatureFlags.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListFeatureFlags.ps1 index b9476feb15..8c1ebf12ca 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListFeatureFlags.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListFeatureFlags.ps1 @@ -1,7 +1,7 @@ function Invoke-ListFeatureFlags { <# .FUNCTIONALITY - Entrypoint, AnyTenant + Entrypoint .ROLE CIPP.Core.Read .DESCRIPTION diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListFunctionStats.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListFunctionStats.ps1 index 6e571db949..f0782e0257 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListFunctionStats.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListFunctionStats.ps1 @@ -74,7 +74,7 @@ function Invoke-ListFunctionStats { } } } catch { - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError $Body = @{ Results = @() Metadata = @{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphBulkRequest.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphBulkRequest.ps1 index 55798a2a5c..72394e6572 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphBulkRequest.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphBulkRequest.ps1 @@ -40,6 +40,13 @@ function Invoke-ListGraphBulkRequest { foreach ($GraphRequest in $BulkRequests) { Test-CIPPGraphEndpointBlocked -Uri $GraphRequest.url -Throw } + } catch { + return [HttpResponseContext]@{ + StatusCode = [System.Net.HttpStatusCode]::BadRequest + Body = $_.Exception.Message + } + } + try { $Body = New-GraphBulkRequest @GraphRequestParams $Results = @{ StatusCode = [System.Net.HttpStatusCode]::OK @@ -47,7 +54,7 @@ function Invoke-ListGraphBulkRequest { } } catch { $Results = @{ - StatusCode = [System.Net.HttpStatusCode]::BadRequest + StatusCode = [System.Net.HttpStatusCode]::InternalServerError Body = $_.Exception.Message } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphSchema.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphSchema.ps1 index 23a4b4dfbd..6319fd3ba9 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphSchema.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphSchema.ps1 @@ -41,7 +41,7 @@ function Invoke-ListGraphSchema { # An unknown entity set or navigation property is a caller mistake, and the message # from the resolver lists what was available, so it is worth returning verbatim. $Schema = @{ Results = $_.Exception.Message } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-RemoveCippQueue.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-RemoveCippQueue.ps1 index 77b78d5ca6..4c072b49c6 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-RemoveCippQueue.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-RemoveCippQueue.ps1 @@ -11,17 +11,19 @@ function Invoke-RemoveCippQueue { $APIName = $Request.Params.CIPPEndpoint ?? 'RemoveCippQueue' $Headers = $Request.Headers + $StatusCode = [HttpStatusCode]::OK try { $Results = Clear-CIPPQueueData -Request $Request -TriggerMetadata $TriggerMetadata Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message 'History cleared' -Sev 'Info' } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message "Failed to clear queue history: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError $Results = @{Results = @("Failed to clear queue history: $($ErrorMessage.NormalizedError)") } } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Results }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionClearHIBPKey.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionClearHIBPKey.ps1 index 5bde54b7b0..4f73fc2f8a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionClearHIBPKey.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionClearHIBPKey.ps1 @@ -11,6 +11,7 @@ function Invoke-ExecExtensionClearHIBPKey { $APIName = $Request.Params.CIPPEndpoint ?? 'ExtensionClearHIBPKey' $Headers = $Request.Headers + $StatusCode = [HttpStatusCode]::OK $Results = try { Remove-ExtensionAPIKey -Extension 'HIBP' | Out-Null $Result = 'Successfully cleared the HIBP API key.' @@ -19,11 +20,12 @@ function Invoke-ExecExtensionClearHIBPKey { } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message "Failed to clear API key for extension 'HIBP': $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError 'Failed to clear the HIBP API key' } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = @{'Results' = $Results } }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionMapping.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionMapping.ps1 index 65929d8da7..a098ac0a39 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionMapping.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionMapping.ps1 @@ -31,9 +31,6 @@ Function Invoke-ExecExtensionMapping { 'HuduFields' { $Result = Get-HuduFieldMapping -CIPPMapping $Table } - 'Sherweb' { - $Result = Get-SherwebMapping -CIPPMapping $Table - } 'HaloPSAFields' { # Outcomes and priorities are scoped to a ticket type. The settings page sends the # ticket type currently selected in the form so the lists follow the dropdown; without @@ -48,7 +45,6 @@ Function Invoke-ExecExtensionMapping { $Result = @{ 'TicketTypes' = $TicketTypes 'Outcomes' = $Outcomes - 'Priorities' = $Priorities } } 'HaloPSARequestSources' { @@ -84,9 +80,6 @@ Function Invoke-ExecExtensionMapping { try { if ($Request.Query.AddMapping) { switch ($Request.Query.AddMapping) { - 'Sherweb' { - $Result = Set-SherwebMapping -CIPPMapping $Table -APIName $APIName -Request $Request - } 'HaloPSA' { $Result = Set-HaloMapping -CIPPMapping $Table -APIName $APIName -Request $Request } @@ -123,6 +116,7 @@ Function Invoke-ExecExtensionMapping { 'NinjaOne' { $Batch = [PSCustomObject]@{ 'NinjaAction' = 'StartAutoMapping' + 'QueueName' = 'AutoMapping' 'FunctionName' = 'NinjaOneQueue' } $InputObject = [PSCustomObject]@{ @@ -135,9 +129,7 @@ Function Invoke-ExecExtensionMapping { $Result = 'AutoMapping Request has been queued. Exact name matches will appear first and matches on device names and serials will take longer. Please check the CIPP Logbook and refresh the page once complete.' Write-LogMessage -API $APIName -tenant 'Global' -headers $Headers -message $Result -Sev 'Info' } - 'HaloPSA' { - $Result = Invoke-HaloAutoMap -CIPPMapping $Table - } + } } $StatusCode = [HttpStatusCode]::OK diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionSync.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionSync.ps1 index 67d52027c8..3ed27d6af7 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionSync.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionSync.ps1 @@ -7,6 +7,7 @@ Function Invoke-ExecExtensionSync { #> [CmdletBinding()] param($Request, $TriggerMetadata) + $StatusCode = [HttpStatusCode]::OK switch ($Request.Query.Extension) { 'Gradient' { try { @@ -26,6 +27,7 @@ Function Invoke-ExecExtensionSync { } } } catch { + $StatusCode = [HttpStatusCode]::InternalServerError $Results = [pscustomobject]@{'Results' = "Could not start Gradient Sync: $($_.Exception.Message)" } Write-LogMessage -API 'Scheduler_Billing' -tenant 'none' -message "Could not start billing processing $($_.Exception.Message)" -sev Error @@ -45,6 +47,7 @@ Function Invoke-ExecExtensionSync { if (($Tenant | Measure-Object).count -eq 1) { $Batch = [PSCustomObject]@{ 'NinjaAction' = 'SyncTenant' + 'TenantFilter' = $Request.Query.TenantFilter ?? $Tenant.RowKey 'MappedTenant' = $Tenant 'FunctionName' = 'NinjaOneQueue' } @@ -60,12 +63,14 @@ Function Invoke-ExecExtensionSync { $Results = [pscustomobject]@{'Results' = "NinjaOne Synchronization Queued for $($Tenant.IntegrationName)" } } else { + $StatusCode = [HttpStatusCode]::NotFound $Results = [pscustomobject]@{'Results' = 'Tenant was not found.' } } } else { $Batch = [PSCustomObject]@{ 'NinjaAction' = 'SyncTenants' + 'QueueName' = 'AllTenants' 'FunctionName' = 'NinjaOneQueue' } $InputObject = [PSCustomObject]@{ @@ -79,6 +84,7 @@ Function Invoke-ExecExtensionSync { } } catch { + $StatusCode = [HttpStatusCode]::InternalServerError $Results = [pscustomobject]@{'Results' = "Could not start NinjaOne Sync: $($_.Exception.Message)" } Write-LogMessage -API 'Scheduler_Billing' -tenant 'none' -message "Could not start NinjaOne Sync $($_.Exception.Message)" -sev Error } @@ -100,6 +106,7 @@ Function Invoke-ExecExtensionSync { Write-LogMessage -API 'HuduSync' -tenant $Tenant.defaultDomainName -message "On-demand Hudu Synchronization queued for $($Mapping.IntegrationName)" -Sev 'Info' -Headers $Request.Headers $Results = [pscustomobject]@{'Results' = "Hudu Synchronization Queued for $($Mapping.IntegrationName)" } } else { + $StatusCode = [HttpStatusCode]::NotFound $Results = [pscustomobject]@{'Results' = 'Tenant was not found.' } } } else { @@ -107,6 +114,7 @@ Function Invoke-ExecExtensionSync { $Results = [pscustomobject]@{'Results' = 'Extension sync tasks have been rescheduled and will start within 15 minutes' } } } catch { + $StatusCode = [HttpStatusCode]::InternalServerError $Results = [pscustomobject]@{'Results' = "Could not start Hudu Sync: $($_.Exception.Message)" } Write-LogMessage -API 'HuduSync' -tenant 'none' -message "Could not start Hudu Sync $($_.Exception.Message)" -sev Error } @@ -116,7 +124,7 @@ Function Invoke-ExecExtensionSync { return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Results }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionTest.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionTest.ps1 index f27aebd6ef..f7a80d014b 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionTest.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionTest.ps1 @@ -4,8 +4,6 @@ Function Invoke-ExecExtensionTest { Entrypoint,AnyTenant .ROLE CIPP.Extension.Read - .DESCRIPTION - Tests the stored credentials for a configured third-party integration and reports whether CIPP can connect. extensionName selects which one: HaloPSA, Gradient, NinjaOne, PWPush, Hudu, Sherweb, HIBP or GitHub. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -80,27 +78,12 @@ Function Invoke-ExecExtensionTest { $Results = [pscustomobject]@{'Results' = "Failed to connect to Hudu, check your API credentials and try again.$(if ($Reason) { " Error: $Reason" })" } } } - 'Sherweb' { - $token = Get-SherwebAuthentication - if ($token) { - $Results = [pscustomobject]@{'Results' = 'Successfully Connected to Sherweb' } - } else { - $Results = [pscustomobject]@{'Results' = 'Failed to connect to Sherweb, check your API credentials and try again.' } - } - } 'HIBP' { $ConnectionTest = Get-HIBPConnectionTest $Results = [pscustomobject]@{'Results' = 'Successfully Connected to HIBP' } } 'GitHub' { - # NoFallback: the test must judge the configured token itself - the anonymous - # function-app fallback would turn a rejected PAT into a false success. - try { - $GitHubResponse = Invoke-GitHubApiRequest -Method 'GET' -Path 'user' -ReturnHeaders -NoFallback - } catch { - $Results = [pscustomobject]@{ 'Results' = "GitHub rejected the configured API token: $($_.Exception.Message). Check that the API key is valid and has not expired, then try again." } - break - } + $GitHubResponse = Invoke-GitHubApiRequest -Method 'GET' -Path 'user' -ReturnHeaders if ($GitHubResponse.login) { if ($GitHubResponse.Headers.'x-oauth-scopes') { $Results = [pscustomobject]@{ 'Results' = "Successfully connected to GitHub user: $($GitHubResponse.login) with scopes: $($GitHubResponse.Headers.'x-oauth-scopes')" } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionsConfig.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionsConfig.ps1 index c6a7ac7fe0..535d7c9197 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionsConfig.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionsConfig.ps1 @@ -18,6 +18,7 @@ function Invoke-ExecExtensionsConfig { $Body = [PSCustomObject]$Request.Body + $StatusCode = [HttpStatusCode]::OK $Results = try { # Check if NinjaOne URL is set correctly and the instance has at least version 5.6 if ($Body.NinjaOne.Enabled -eq $true) { @@ -95,13 +96,14 @@ function Invoke-ExecExtensionsConfig { } catch { $Result = "Failed to save the extensions configuration: $($_.Exception.message) Linenumber: $($_.InvocationInfo.ScriptLineNumber)" Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $Result -Sev 'Error' + $StatusCode = [HttpStatusCode]::InternalServerError $Result } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = @{'Results' = $Results } }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecHaloPSATestTicket.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecHaloPSATestTicket.ps1 index c20bedf478..5941321ec7 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecHaloPSATestTicket.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecHaloPSATestTicket.ps1 @@ -15,6 +15,7 @@ Function Invoke-ExecHaloPSATestTicket { [CmdletBinding()] param($Request, $TriggerMetadata) + $StatusCode = [HttpStatusCode]::OK try { $ConfigTable = Get-CIPPTable -TableName Extensionsconfig $Configuration = ((Get-CIPPAzDataTableEntity @ConfigTable).config | ConvertFrom-Json).HaloPSA @@ -47,11 +48,12 @@ Function Invoke-ExecHaloPSATestTicket { $Results = [pscustomobject]@{ Results = "$Result against client '$ClientName' (id $ClientId). It is safe to close this ticket." } } } catch { + $StatusCode = [HttpStatusCode]::InternalServerError $Results = [pscustomobject]@{ Results = "Failed to create HaloPSA test ticket: $($_.Exception.Message). Line $($_.InvocationInfo.ScriptLineNumber)" } } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Results }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ListHaloClients.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ListHaloClients.ps1 index d67bdd99ea..d7466f62db 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ListHaloClients.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ListHaloClients.ps1 @@ -31,7 +31,7 @@ Function Invoke-ListHaloClients { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $HaloClients = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-PublicMcpRegister.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-PublicMcpRegister.ps1 index eab789ef81..6183ccd9a1 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-PublicMcpRegister.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-PublicMcpRegister.ps1 @@ -60,7 +60,7 @@ function Invoke-PublicMcpRegister { # The "registered client" is an MCPAllowed API client - the app the connector signs in AS (the # dedicated CIPP-MCP app is the resource, not handed out here). Several MCPAllowed clients can - # coexist, each with its own role/IP/redirects/CA; a connector can pin one with ?client= + # coexist, each with its own redirects; a connector can pin one with ?client= # on the MCP URL, otherwise the first that resolves in Entra is used. $Table = Get-CippTable -tablename 'ApiClients' $McpCandidates = @(Get-CIPPAzDataTableEntity @Table -Filter 'Enabled eq true' | diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListFunctionParameters.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListFunctionParameters.ps1 index 250ef5046d..904122aa35 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListFunctionParameters.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListFunctionParameters.ps1 @@ -110,7 +110,7 @@ function Invoke-ListFunctionParameters { $Results } catch { $Results = "Function Error: $($_.Exception.Message)" - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return [HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItemDetails.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItemDetails.ps1 index ca8374da80..98f3a634ee 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItemDetails.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItemDetails.ps1 @@ -4,8 +4,6 @@ function Invoke-ListScheduledItemDetails { Entrypoint,AnyTenant .ROLE CIPP.Scheduler.Read - .DESCRIPTION - Retrieves detailed information about a specific scheduled task by its RowKey, including execution results and task parameters. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -23,8 +21,6 @@ function Invoke-ListScheduledItemDetails { return } - $SafeRowKey = ConvertTo-CIPPODataFilterValue -Value $RowKey -Type String - # Retrieve the task information $TaskTable = Get-CIPPTable -TableName 'ScheduledTasks' $Task = Get-CIPPAzDataTableEntity @TaskTable -Filter "RowKey eq '$SafeRowKey' and PartitionKey eq 'ScheduledTask'" | Select-Object RowKey, Name, TaskState, Command, Parameters, Recurrence, ExecutedTime, ScheduledTime, PostExecution, PostExecutionResults, Tenant, TenantGroup, Tenants, TenantSelectionVersion, excludedTenants, excludedTenantGroups, Hidden, Results, Timestamp, Trigger @@ -52,10 +48,6 @@ function Invoke-ListScheduledItemDetails { # Process the task (similar to the way it's done in Invoke-ListScheduledItems) if ($Task.Parameters) { $Task.Parameters = $Task.Parameters | ConvertFrom-Json -ErrorAction SilentlyContinue - # Remove headers from parameters for cleaner display, and because they may contain sensitive information. Headers are only used for execution, not needed for display. - if ($Task.Parameters.Headers) { - $Task.Parameters.PSObject.Properties.Remove('Headers') - } } else { $Task | Add-Member -NotePropertyName Parameters -NotePropertyValue @{} } @@ -138,7 +130,7 @@ function Invoke-ListScheduledItemDetails { # Get the results if available $ResultsTable = Get-CIPPTable -TableName 'ScheduledTaskResults' - $ResultsFilter = "PartitionKey eq '$SafeRowKey'" + $ResultsFilter = "PartitionKey eq '$RowKey'" $Results = Get-CIPPAzDataTableEntity @ResultsTable -Filter $ResultsFilter @@ -239,7 +231,7 @@ function Invoke-ListScheduledItemDetails { } # Combine task and results into one response - $Response = ConvertTo-Json -Depth 100 -InputObject @{ + $Response = ConvertTo-Json -Depth 20 -InputObject @{ Task = $Task Details = $ProcessedResults } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-RemoveScheduledItem.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-RemoveScheduledItem.ps1 index 31f53f445e..13f1e7c301 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-RemoveScheduledItem.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-RemoveScheduledItem.ps1 @@ -14,6 +14,12 @@ function Invoke-RemoveScheduledItem { $Headers = $Request.Headers $RowKey = $Request.Query.id ? $Request.Query.id : $Request.Body.id + if (-not $RowKey) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'Task id is required.' } + }) + } $task = @{ RowKey = $RowKey PartitionKey = 'ScheduledTask' @@ -45,15 +51,17 @@ function Invoke-RemoveScheduledItem { Write-LogMessage -Headers $Headers -API $APIName -message "Task removed: $($task.RowKey)" -Sev 'Info' $StatusCode = [HttpStatusCode]::OK + $Result = 'Task removed successfully.' } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -Headers $Headers -API $APIName -message "Failed to remove task: $($task.RowKey). $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError + $Result = "Failed to remove task: $($ErrorMessage.NormalizedError)" } return ([HttpResponseContext]@{ StatusCode = $StatusCode - Body = @{ Results = 'Task removed successfully.' } + Body = @{ Results = $Result } }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 index 84eb7153bd..25e9705bfc 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 @@ -162,7 +162,7 @@ function Invoke-ExecApiClient { # When this client is MCP-enabled it becomes one of the OAuth client apps that AI # connectors sign in as. Several MCPAllowed clients may coexist (each with its own - # role/IP/redirects/CA); the dedicated CIPP-MCP app is the shared protected resource. + # redirects); the dedicated CIPP-MCP app is the shared protected resource. # Configure this client (callbacks, public client flows, resource permissions + # consent) and ensure the resource app exists (Set-CIPPMCPClientApp -> # New-CIPPMcpResourceApp). @@ -205,9 +205,19 @@ function Invoke-ExecApiClient { } } 'GetAzureConfiguration' { + if ($env:WEBSITE_RESOURCE_GROUP) { + $RGName = $env:WEBSITE_RESOURCE_GROUP + } else { + $Owner = $env:WEBSITE_OWNER_NAME + if ($env:WEBSITE_SKU -ne 'FlexConsumption' -and $Owner -match '^(?[^+]+)\+(?[^-]+(?:-[^-]+)*?)(?:-[^-]+webspace(?:-Linux)?)?$') { + $RGName = $Matches.RGName + } else { + Write-Information "Could not determine resource group from environment variables. Owner: $Owner" + $RGName = $null + } + } $FunctionAppName = $env:WEBSITE_SITE_NAME try { - $RGName = Get-CIPPFunctionAppResourceGroup -SiteName $FunctionAppName $APIClients = Get-CippApiAuth -RGName $RGName -FunctionAppName $FunctionAppName $Results = $ApiClients } catch { @@ -222,6 +232,17 @@ function Invoke-ExecApiClient { } 'SaveToAzure' { $TenantId = $env:TenantID + if ($env:WEBSITE_RESOURCE_GROUP) { + $RGName = $env:WEBSITE_RESOURCE_GROUP + } else { + $Owner = $env:WEBSITE_OWNER_NAME + if ($env:WEBSITE_SKU -ne 'FlexConsumption' -and $Owner -match '^(?[^+]+)\+(?[^-]+(?:-[^-]+)*?)(?:-[^-]+webspace(?:-Linux)?)?$') { + $RGName = $Matches.RGName + } else { + Write-Information "Could not determine resource group from environment variables. Owner: $Owner" + $RGName = $null + } + } $FunctionAppName = $env:WEBSITE_SITE_NAME $AllClients = Get-CIPPAzDataTableEntity @Table -Filter 'Enabled eq true' | Where-Object { ![string]::IsNullOrEmpty($_.RowKey) } $ClientIds = $AllClients.RowKey @@ -248,6 +269,8 @@ function Invoke-ExecApiClient { Set-CippApiAuth -RGName $RGName -FunctionAppName $FunctionAppName -TenantId $TenantId -ClientIds $ClientIds -McpClientIds $McpClientIds + # Advertise the MCP resource scope via App Service PRM so connectors request + # a scope that matches the resource app. Cleared when no MCP clients. if ($McpClientIds.Count -gt 0 -and $env:WEBSITE_HOSTNAME) { # Advertise the OIDC + offline_access scopes alongside the resource scope so # discovery-based MCP clients (ChatGPT, VS Code, Copilot CLI) request a refresh @@ -264,7 +287,7 @@ function Invoke-ExecApiClient { $McpAppSettings = Get-CippMcpScopeAppSettings -Hostname $env:WEBSITE_HOSTNAME -TenantId $env:TenantID -IsCippNg:([bool]$env:CIPPNG) $null = Update-CIPPAzFunctionAppSetting -Name $FunctionAppName -ResourceGroupName $RGName -AppSetting $McpAppSettings } else { - $null = Update-CIPPAzFunctionAppSetting -Name $FunctionAppName -ResourceGroupName $RGName -AppSetting @{} -RemoveKeys @('WEBSITE_AUTH_PRM_DEFAULT_WITH_SCOPES', 'CRAFT_PRM', 'CRAFT_PRM_AS') + $null = Update-CIPPAzFunctionAppSetting -Name $FunctionAppName -ResourceGroupName $RGName -AppSetting @{} -RemoveKeys @('WEBSITE_AUTH_PRM_DEFAULT_WITH_SCOPES') } $Body = @{ Results = 'API clients saved to Azure' } @@ -314,40 +337,6 @@ function Invoke-ExecApiClient { } $Body = @($Results) } - 'RepairUri' { - $Client = Get-CIPPAzDataTableEntity @Table -Filter "RowKey eq '$($Request.Body.ClientId)'" - if (!$Client) { - $Results = @{ - resultText = 'API client not found' - state = 'error' - } - } else { - try { - $RepairResult = Repair-CippApiIdentifierUri -AppId $Request.Body.ClientId - - if ($RepairResult.Fixed) { - Write-LogMessage -headers $Request.Headers -API 'ExecApiClient' -message "Repaired identifier URI for $($Client.AppName) $($RepairResult.Message)" -Sev 'Info' - $Results = @{ - resultText = "Identifier URI fixed for $($Client.AppName). $($RepairResult.Message)" - state = 'success' - } - } else { - $Results = @{ - resultText = "Identifier URI already correct for $($Client.AppName). $($RepairResult.Message)" - state = 'info' - } - } - } catch { - $ErrorMessage = Get-CippException -Exception $_ - Write-LogMessage -headers $Request.Headers -API 'ExecApiClient' -message "Failed to repair identifier URI for $($Client.AppName) $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage - $Results = @{ - resultText = "Failed to repair identifier URI for $($Client.AppName) $($ErrorMessage.NormalizedError)" - state = 'error' - } - } - } - $Body = @($Results) - } 'Delete' { try { if ($Request.Body.ClientId) { diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecAppServiceDomains.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecAppServiceDomains.ps1 index b815a2b6b6..47ab94c8ab 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecAppServiceDomains.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecAppServiceDomains.ps1 @@ -93,6 +93,29 @@ function Invoke-ExecAppServiceDomains { return @() } + if ($Action -in @('CheckDns', 'AddBinding', 'AddCertificate', 'Remove')) { + $HostNameError = try { + $HostName = Get-CleanHostname ($Request.Body.Hostname ?? $Request.Query.Hostname) + if ($HostName -like '*.azurewebsites.net') { + switch ($Action) { + 'AddBinding' { 'The default *.azurewebsites.net hostname is managed by Azure and cannot be added.' } + 'AddCertificate' { 'The default hostname is already secured by Azure.' } + 'Remove' { 'The default *.azurewebsites.net hostname cannot be removed.' } + } + } elseif ($Action -eq 'AddCertificate' -and $HostName.StartsWith('*.')) { + 'App Service Managed Certificates do not support wildcard domains. Upload your own certificate in the Azure Portal instead.' + } + } catch { + $_.Exception.Message + } + if ($HostNameError) { + return [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Failed: $HostNameError" } + } + } + } + try { switch ($Action) { 'List' { @@ -154,10 +177,6 @@ function Invoke-ExecAppServiceDomains { } 'CheckDns' { - $HostName = $Request.Body.Hostname ?? $Request.Query.Hostname - if ([string]::IsNullOrWhiteSpace($HostName)) { throw 'Hostname is required' } - $HostName = Get-CleanHostname $HostName - # DoH resolver lives in the DNSHealth module; import + initialize it the same way the # domain health endpoint does before resolving. Import-Module DNSHealth -ErrorAction SilentlyContinue @@ -230,11 +249,6 @@ function Invoke-ExecAppServiceDomains { } 'AddBinding' { - $HostName = $Request.Body.Hostname ?? $Request.Query.Hostname - if ([string]::IsNullOrWhiteSpace($HostName)) { throw 'Hostname is required' } - $HostName = Get-CleanHostname $HostName - if ($HostName -like '*.azurewebsites.net') { throw 'The default *.azurewebsites.net hostname is managed by Azure and cannot be added.' } - $AppService = Get-CIPPAppServiceSite $Plan = Get-DomainRecordPlan -Hostname $HostName ` -DefaultHostName $AppService.Site.properties.defaultHostName ` @@ -270,12 +284,6 @@ function Invoke-ExecAppServiceDomains { } 'AddCertificate' { - $HostName = $Request.Body.Hostname ?? $Request.Query.Hostname - if ([string]::IsNullOrWhiteSpace($HostName)) { throw 'Hostname is required' } - $HostName = Get-CleanHostname $HostName - if ($HostName -like '*.azurewebsites.net') { throw 'The default hostname is already secured by Azure.' } - if ($HostName.StartsWith('*.')) { throw 'App Service Managed Certificates do not support wildcard domains. Upload your own certificate in the Azure Portal instead.' } - # First attempt runs inline; a certificate that is not issued by the time it returns # is followed up by hidden scheduled retries (see Invoke-CIPPCustomDomainCertificate). $Message = Invoke-CIPPCustomDomainCertificate -Hostname $HostName @@ -290,11 +298,6 @@ function Invoke-ExecAppServiceDomains { } 'Remove' { - $HostName = $Request.Body.Hostname ?? $Request.Query.Hostname - if ([string]::IsNullOrWhiteSpace($HostName)) { throw 'Hostname is required' } - $HostName = Get-CleanHostname $HostName - if ($HostName -like '*.azurewebsites.net') { throw 'The default *.azurewebsites.net hostname cannot be removed.' } - $AppService = Get-CIPPAppServiceSite $Api = $AppService.ApiVersion $null = New-CIPPAzRestRequest -Uri "$($AppService.ArmBase)/hostNameBindings/$HostName`?api-version=$Api" -Method DELETE -ErrorAction Stop @@ -323,9 +326,8 @@ function Invoke-ExecAppServiceDomains { } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -headers $Headers -message "AppServiceDomains '$Action' failed: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage - $StatusCode = ($Action -eq 'List') ? [HttpStatusCode]::InternalServerError : [HttpStatusCode]::BadRequest return [HttpResponseContext]@{ - StatusCode = $StatusCode + StatusCode = [HttpStatusCode]::InternalServerError Body = @{ Results = "Failed: $($ErrorMessage.NormalizedError)" } } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBackupReplicationConfig.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBackupReplicationConfig.ps1 index b6fb4ae400..54dad81a68 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBackupReplicationConfig.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBackupReplicationConfig.ps1 @@ -36,6 +36,49 @@ function Invoke-ExecBackupReplicationConfig { } } + if (-not $Request.Query.List) { + $BackupType = $Request.Body.BackupType + if ($BackupType -notin $Scopes) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = [pscustomobject]@{'Results' = "Failed to update configuration: BackupType must be one of: $($Scopes -join ', ')" } + }) + } + + $SASUrl = $Request.Body.SASUrl + $Enabled = if ($null -ne $Request.Body.Enabled) { [bool]$Request.Body.Enabled } else { $true } + + # Only update the stored secret when a real new value is supplied (the UI sends the + # 'SentToKeyVault' sentinel when the existing, masked secret is left untouched). + $NewSecret = -not [string]::IsNullOrWhiteSpace($SASUrl) -and $SASUrl -ne 'SentToKeyVault' + if ($NewSecret) { + $ParsedUri = $SASUrl -as [uri] + if (-not $ParsedUri -or $ParsedUri.Query -notmatch 'sig=') { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = [pscustomobject]@{'Results' = 'Failed to update configuration: SAS URL must contain a SAS token (sig=...)' } + }) + } + + # Confirm the SAS actually grants write+create by writing and removing a tiny probe blob. + $guid = [guid]::NewGuid().ToString() + $UrlParts = $SASUrl -split '\?', 2 + $BaseUrl = $UrlParts[0].TrimEnd('/') + $ProbeUrl = "$BaseUrl/.cipp-replication-test-$guid`?$($UrlParts[1])" + try { + $null = Invoke-CIPPRestMethod -Uri $ProbeUrl -Method 'PUT' -Body "cipp-replication-test-$guid" -ContentType 'text/plain' -Headers @{ 'x-ms-blob-type' = 'BlockBlob' } + try { $null = Invoke-CIPPRestMethod -Uri $ProbeUrl -Method 'DELETE' -Headers @{} } catch { } + } catch { + $ProbeError = Get-CippException -Exception $_ + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = [pscustomobject]@{'Results' = "Failed to update configuration: SAS URL validation failed (could not write to the container): $($ProbeError.NormalizedError)" } + }) + } + } + } + + $StatusCode = [HttpStatusCode]::OK $results = try { if ($Request.Query.List) { $Output = @{} @@ -48,35 +91,7 @@ function Invoke-ExecBackupReplicationConfig { } [pscustomobject]$Output } else { - $BackupType = $Request.Body.BackupType - if ($BackupType -notin $Scopes) { - throw "BackupType must be one of: $($Scopes -join ', ')" - } - - $SASUrl = $Request.Body.SASUrl - $Enabled = if ($null -ne $Request.Body.Enabled) { [bool]$Request.Body.Enabled } else { $true } - - # Only update the stored secret when a real new value is supplied (the UI sends the - # 'SentToKeyVault' sentinel when the existing, masked secret is left untouched). - if (-not [string]::IsNullOrWhiteSpace($SASUrl) -and $SASUrl -ne 'SentToKeyVault') { - $ParsedUri = $SASUrl -as [uri] - if (-not $ParsedUri -or $ParsedUri.Query -notmatch 'sig=') { - throw 'SAS URL must contain a SAS token (sig=...)' - } - - # Confirm the SAS actually grants write+create by writing and removing a tiny probe blob. - $guid = [guid]::NewGuid().ToString() - $UrlParts = $SASUrl -split '\?', 2 - $BaseUrl = $UrlParts[0].TrimEnd('/') - $ProbeUrl = "$BaseUrl/.cipp-replication-test-$guid`?$($UrlParts[1])" - try { - $null = Invoke-CIPPRestMethod -Uri $ProbeUrl -Method 'PUT' -Body "cipp-replication-test-$guid" -ContentType 'text/plain' -Headers @{ 'x-ms-blob-type' = 'BlockBlob' } - try { $null = Invoke-CIPPRestMethod -Uri $ProbeUrl -Method 'DELETE' -Headers @{} } catch { } - } catch { - $ProbeError = Get-CippException -Exception $_ - throw "SAS URL validation failed (could not write to the container): $($ProbeError.NormalizedError)" - } - + if ($NewSecret) { if ($env:AzureWebJobsStorage -eq 'UseDevelopmentStorage=true' -or $env:NonLocalHostAzurite -eq 'true') { $DevSecretsTable = Get-CIPPTable -tablename 'DevSecrets' $Secret = [PSCustomObject]@{ @@ -104,13 +119,14 @@ function Invoke-ExecBackupReplicationConfig { } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -headers $Request.Headers -API $Request.Params.CIPPEndpoint -message "Failed to update backup replication configuration: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError "Failed to update configuration: $($ErrorMessage.NormalizedError)" } $body = [pscustomobject]@{'Results' = $Results } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBackupRetentionConfig.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBackupRetentionConfig.ps1 index 0ff7da933d..35d033ceb1 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBackupRetentionConfig.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBackupRetentionConfig.ps1 @@ -10,6 +10,14 @@ function Invoke-ExecBackupRetentionConfig { $Table = Get-CIPPTable -TableName Config $Filter = "PartitionKey eq 'BackupRetention' and RowKey eq 'Settings'" + if (-not $Request.Query.List -and ($Request.Body.RetentionDays -as [int]) -lt 7) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = [pscustomobject]@{'Results' = 'Failed to set configuration: Retention days must be at least 7 days' } + }) + } + + $StatusCode = [HttpStatusCode]::OK $results = try { if ($Request.Query.List) { $RetentionSettings = Get-CIPPAzDataTableEntity @Table -Filter $Filter @@ -26,11 +34,6 @@ function Invoke-ExecBackupRetentionConfig { } else { $RetentionDays = [int]$Request.Body.RetentionDays - # Validate minimum value - if ($RetentionDays -lt 7) { - throw 'Retention days must be at least 7 days' - } - $RetentionConfig = @{ 'RetentionDays' = $RetentionDays 'PartitionKey' = 'BackupRetention' @@ -44,13 +47,14 @@ function Invoke-ExecBackupRetentionConfig { } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -headers $Request.Headers -API $Request.Params.CIPPEndpoint -message "Failed to set backup retention configuration: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError "Failed to set configuration: $($ErrorMessage.NormalizedError)" } $body = [pscustomobject]@{'Results' = $Results } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBrandingSettings.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBrandingSettings.ps1 index fb53d8ef32..c1cef27a24 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBrandingSettings.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBrandingSettings.ps1 @@ -122,7 +122,7 @@ Function Invoke-ExecBrandingSettings { Write-LogMessage -API $APIName -tenant 'Global' -headers $Request.Headers -message "Uploaded branding $Kind image $($Added.id)" -Sev 'Info' $Added } catch { - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError "Error: $($_.Exception.Message)" } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCIPPUsers.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCIPPUsers.ps1 index d7b75396f4..bafcd6cdf1 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCIPPUsers.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCIPPUsers.ps1 @@ -30,14 +30,20 @@ function Invoke-ExecCIPPUsers { try { $UPN = $Request.Body.UPN if ([string]::IsNullOrWhiteSpace($UPN)) { - throw 'UPN (email) is required' + return [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'Failed: UPN (email) is required' } + } } # Squash casing so the RowKey is canonical and case-variant duplicates can't form $UPN = $UPN.Trim().ToLower() $Roles = @($Request.Body.Roles) if ($Roles.Count -eq 0) { - throw 'At least one role must be assigned' + return [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'Failed: At least one role must be assigned' } + } } # Validate roles exist (built-in + custom) @@ -54,7 +60,10 @@ function Invoke-ExecCIPPUsers { foreach ($Role in $Roles) { if ($Role -notin $AllValidRoles) { - throw "Invalid role: $Role. Valid roles: $($AllValidRoles -join ', ')" + return [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Failed: Invalid role: $Role. Valid roles: $($AllValidRoles -join ', ')" } + } } } @@ -71,7 +80,10 @@ function Invoke-ExecCIPPUsers { if ($TargetHadManualSuperAdmin) { $OtherManualSuperAdmins = @($AllUsers | Where-Object { $_.RowKey.ToLower() -ne $UPN -and (& $HasManualSuperAdmin $_) }) if ($OtherManualSuperAdmins.Count -eq 0) { - throw 'Cannot remove the superadmin role from the last user that has it manually assigned. Grant superadmin manually to another user first (superadmin from Entra group sync does not count).' + return [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'Failed: Cannot remove the superadmin role from the last user that has it manually assigned. Grant superadmin manually to another user first (superadmin from Entra group sync does not count).' } + } } } } @@ -124,7 +136,7 @@ function Invoke-ExecCIPPUsers { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -headers $Headers -message "Failed to add/update user: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage return [HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest + StatusCode = [HttpStatusCode]::InternalServerError Body = @{ Results = "Failed: $($ErrorMessage.NormalizedError)" } } } @@ -133,14 +145,20 @@ function Invoke-ExecCIPPUsers { try { $UPN = $Request.Body.UPN if ([string]::IsNullOrWhiteSpace($UPN)) { - throw 'UPN (email) is required' + return [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'Failed: UPN (email) is required' } + } } $UPN = $UPN.Trim().ToLower() # Self-lockout protection: prevent removing yourself $CurrentUser = $Request.Headers.'x-ms-client-principal-name' if ($CurrentUser -and $UPN -ieq $CurrentUser) { - throw 'Cannot remove your own user account. This would lock you out.' + return [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'Failed: Cannot remove your own user account. This would lock you out.' } + } } # Fetch all users once so we can locate the target (case-insensitively) @@ -148,7 +166,10 @@ function Invoke-ExecCIPPUsers { $AllUsers = @(Get-CIPPAzDataTableEntity @Table | Where-Object { -not $_.RowKey.StartsWith('_') }) $MatchingEntities = @($AllUsers | Where-Object { $_.RowKey -and $_.RowKey.ToLower() -eq $UPN }) if ($MatchingEntities.Count -eq 0) { - throw "User $UPN not found in the allowed users table" + return [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = @{ Results = "Failed: User $UPN not found in the allowed users table" } + } } # Invariant: don't remove the last user holding a manually-assigned superadmin. @@ -158,7 +179,10 @@ function Invoke-ExecCIPPUsers { if ($TargetHasManualSuperAdmin) { $OtherManualSuperAdmins = @($AllUsers | Where-Object { $_.RowKey.ToLower() -ne $UPN -and (& $HasManualSuperAdmin $_) }) if ($OtherManualSuperAdmins.Count -eq 0) { - throw 'Cannot remove the last user with a manually assigned superadmin role. Grant superadmin manually to another user first (superadmin from Entra group sync does not count).' + return [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'Failed: Cannot remove the last user with a manually assigned superadmin role. Grant superadmin manually to another user first (superadmin from Entra group sync does not count).' } + } } } @@ -173,7 +197,7 @@ function Invoke-ExecCIPPUsers { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -headers $Headers -message "Failed to delete user: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage return [HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest + StatusCode = [HttpStatusCode]::InternalServerError Body = @{ Results = "Failed: $($ErrorMessage.NormalizedError)" } } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCPVPermissions.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCPVPermissions.ps1 index b8f1064ebf..29fd7dfcb5 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCPVPermissions.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCPVPermissions.ps1 @@ -10,6 +10,7 @@ function Invoke-ExecCPVPermissions { $TenantFilter = $Request.Body.tenantFilter $Tenant = Get-Tenants -TenantFilter $TenantFilter -IncludeErrors + $StatusCode = [HttpStatusCode]::OK if ($Tenant) { Write-Host "Our tenant is $($Tenant.displayName) - $($Tenant.defaultDomainName)" @@ -40,6 +41,7 @@ function Invoke-ExecCPVPermissions { } catch { "Failed to update permissions for $($Tenant.displayName): $($_.Exception.Message)" $Success = $false + $StatusCode = [HttpStatusCode]::InternalServerError } $Tenant = Get-Tenants -IncludeAll | Where-Object -Property customerId -EQ $TenantFilter | Select-Object -First 1 @@ -47,9 +49,10 @@ function Invoke-ExecCPVPermissions { } else { $GraphRequest = 'Tenant not found' $Success = $false + $StatusCode = [HttpStatusCode]::NotFound } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = @{ Results = $GraphRequest Metadata = @{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCippReplacemap.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCippReplacemap.ps1 index 2b1d5ca9d7..80e9ac7b16 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCippReplacemap.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCippReplacemap.ps1 @@ -105,6 +105,7 @@ function Invoke-ExecCippReplacemap { return } + $StatusCode = [HttpStatusCode]::OK switch ($Action) { 'List' { $Variables = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq '$customerId'" | ForEach-Object { @@ -218,16 +219,18 @@ function Invoke-ExecCippReplacemap { Write-LogMessage -headers $Headers -API $APIName -tenant $customerId -message $Result -Sev 'Info' $Body = @{ Results = $Result } } else { + $StatusCode = [HttpStatusCode]::NotFound $Body = @{ Results = "Variable '$VariableName' not found" } } } default { + $StatusCode = [HttpStatusCode]::BadRequest $Body = @{ Results = 'Invalid action' } } } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecContainerManagement.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecContainerManagement.ps1 index 979dd2ddb6..9fa4a6dba1 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecContainerManagement.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecContainerManagement.ps1 @@ -24,7 +24,7 @@ function Invoke-ExecContainerManagement { # development has no WEBSITE_SITE_NAME or managed identity, so the ARM lookup returns nothing # and the picker would otherwise show no branch builds at all. Switching channels still # derives its image base from the site's own linuxFxVersion, never from this. - $DefaultImageBase = 'ghcr.io/cyberdrain/cipp' + $DefaultImageBase = 'ghcr.io/celeratec/manage365' $SettingsTable = Get-CippTable -tablename 'ContainerUpdateSettings' @@ -282,7 +282,7 @@ function Invoke-ExecContainerManagement { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -headers $Headers -message "Failed to list channels: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage return [HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest + StatusCode = [HttpStatusCode]::InternalServerError Body = @{ Results = "Failed: $($ErrorMessage.NormalizedError)" } } } @@ -381,14 +381,20 @@ function Invoke-ExecContainerManagement { $CheckTime = $Request.Body.CheckTime $ValidIntervals = @('0', '1h', '4h', '12h', '1d') if ($CheckInterval -notin $ValidIntervals) { - throw "Invalid check interval: $CheckInterval. Valid: $($ValidIntervals -join ', ')" + return [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Failed: Invalid check interval: $CheckInterval. Valid: $($ValidIntervals -join ', ')" } + } } # CheckTime arrives as a string — validate as [int]. A string comparison # makes '3' -gt 23 true ('3' > '2' lexicographically), rejecting 03:00-09:00. if ($null -ne $CheckTime -and "$CheckTime" -ne '') { $ParsedHour = 0 if (-not [int]::TryParse([string]$CheckTime, [ref]$ParsedHour) -or $ParsedHour -lt 0 -or $ParsedHour -gt 23) { - throw "Invalid check time: $CheckTime. Must be an hour between 0 and 23." + return [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Failed: Invalid check time: $CheckTime. Must be an hour between 0 and 23." } + } } $CheckTime = $ParsedHour } else { @@ -424,7 +430,7 @@ function Invoke-ExecContainerManagement { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -headers $Headers -message "Failed to save update settings: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage return [HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest + StatusCode = [HttpStatusCode]::InternalServerError Body = @{ Results = "Failed: $($ErrorMessage.NormalizedError)" } } } @@ -433,11 +439,17 @@ function Invoke-ExecContainerManagement { try { $NewChannel = $Request.Body.Channel if ([string]::IsNullOrWhiteSpace($NewChannel)) { - throw 'Channel is required' + return [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'Failed: Channel is required' } + } } $IsBuildChannel = $NewChannel -notin $ValidChannels -and $NewChannel -match $BuildChannelPattern if ($NewChannel -notin $ValidChannels -and -not $IsBuildChannel) { - throw "Invalid channel: $NewChannel. Valid channels: $($ValidChannels -join ', '), or a branch build tag." + return [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Failed: Invalid channel: $NewChannel. Valid channels: $($ValidChannels -join ', '), or a branch build tag." } + } } $site = Get-ContainerSiteInfo @@ -473,7 +485,10 @@ function Invoke-ExecContainerManagement { try { $null = Get-GHCRImageInfo -ImageRef $imageBase -Tag $NewChannel } catch { - throw "Branch build '$NewChannel' was not found in the registry — it may have been cleaned up after its branch was deleted. Pick another build, or rebuild the branch." + return [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = @{ Results = "Failed: Branch build '$NewChannel' was not found in the registry — it may have been cleaned up after its branch was deleted. Pick another build, or rebuild the branch." } + } } } @@ -492,7 +507,7 @@ function Invoke-ExecContainerManagement { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -headers $Headers -message "Failed to update channel: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage return [HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest + StatusCode = [HttpStatusCode]::InternalServerError Body = @{ Results = "Failed: $($ErrorMessage.NormalizedError)" } } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCustomData.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCustomData.ps1 index 2dd4c7371a..2c9ee1b524 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCustomData.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCustomData.ps1 @@ -12,6 +12,7 @@ function Invoke-ExecCustomData { $Headers = $Request.Headers $Action = $Request.Query.Action ?? $Request.Body.Action + $StatusCode = $null $CustomDataTable = Get-CippTable -TableName 'CustomData' $CustomDataMappingsTable = Get-CippTable -TableName 'CustomDataMappings' @@ -40,6 +41,7 @@ function Invoke-ExecCustomData { Results = @($SchemaExtensions) } } catch { + $StatusCode ??= [HttpStatusCode]::InternalServerError $Body = @{ Results = @( @{ @@ -54,6 +56,7 @@ function Invoke-ExecCustomData { try { $SchemaExtension = $Request.Body.schemaExtension if (!$SchemaExtension) { + $StatusCode = [HttpStatusCode]::BadRequest throw 'SchemaExtension data is missing in the request body.' } @@ -75,6 +78,7 @@ function Invoke-ExecCustomData { } } } catch { + $StatusCode ??= [HttpStatusCode]::InternalServerError $Result = "Failed to add schema extension: $($_.Exception.Message)" Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $Result -Sev 'Error' $Body = @{ @@ -91,18 +95,21 @@ function Invoke-ExecCustomData { try { $SchemaId = $Request.Body.id if (!$SchemaId) { + $StatusCode = [HttpStatusCode]::BadRequest throw 'Schema ID is missing in the request body.' } # Retrieve the schema extension entity $SchemaEntity = Get-CIPPAzDataTableEntity @CustomDataTable -Filter "PartitionKey eq 'SchemaExtension'" | Where-Object { $SchemaId -match $_.RowKey } if (!$SchemaEntity) { + $StatusCode = [HttpStatusCode]::NotFound throw "Schema extension with ID '$SchemaId' not found." } # Ensure the schema is in 'InDevelopment' state before deletion $SchemaDefinition = $SchemaEntity.JSON | ConvertFrom-Json if ($SchemaDefinition.status -ne 'InDevelopment') { + $StatusCode = [HttpStatusCode]::BadRequest throw "Schema extension '$SchemaId' cannot be deleted because it is not in 'InDevelopment' state." } @@ -125,6 +132,7 @@ function Invoke-ExecCustomData { } } } catch { + $StatusCode ??= [HttpStatusCode]::InternalServerError $Result = "Failed to delete schema extension: $($_.Exception.Message)" Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $Result -Sev 'Error' $Body = @{ @@ -147,15 +155,18 @@ function Invoke-ExecCustomData { type = $Type } if (!$SchemaId) { + $StatusCode = [HttpStatusCode]::BadRequest throw 'Schema ID is missing in the request body.' } if (!$Name -or !$Type) { + $StatusCode = [HttpStatusCode]::BadRequest throw 'Property data is missing or incomplete in the request body.' } # Retrieve the schema extension entity $SchemaEntity = Get-CIPPAzDataTableEntity @CustomDataTable -Filter "PartitionKey eq 'SchemaExtension'" | Where-Object { $SchemaId -match $_.RowKey } if (!$SchemaEntity) { + $StatusCode = [HttpStatusCode]::NotFound throw "Schema extension with ID '$SchemaId' not found." } @@ -163,11 +174,13 @@ function Invoke-ExecCustomData { $SchemaDefinition = $SchemaEntity.JSON | ConvertFrom-Json if ($SchemaDefinition.status -eq 'Deprecated') { + $StatusCode = [HttpStatusCode]::BadRequest throw "Properties cannot be added to schema extension '$SchemaId' because it is in the 'Deprecated' state." } # Check if the property already exists if ($SchemaDefinition.properties | Where-Object { $_.name -eq $NewProperty.name }) { + $StatusCode = [HttpStatusCode]::BadRequest throw "Property with name '$($NewProperty.name)' already exists in schema extension '$SchemaId'." } @@ -193,6 +206,7 @@ function Invoke-ExecCustomData { } } } catch { + $StatusCode ??= [HttpStatusCode]::InternalServerError $Result = "Failed to add property to schema extension: $($_.Exception.Message)" Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $Result -Sev 'Error' $Body = @{ @@ -210,15 +224,18 @@ function Invoke-ExecCustomData { $SchemaId = $Request.Body.id $NewStatus = $Request.Body.status if (!$SchemaId) { + $StatusCode = [HttpStatusCode]::BadRequest throw 'Schema ID is missing in the request body.' } if (!$NewStatus) { + $StatusCode = [HttpStatusCode]::BadRequest throw 'New status is missing in the request body.' } # Retrieve the schema extension entity $SchemaEntity = Get-CIPPAzDataTableEntity @CustomDataTable -Filter "PartitionKey eq 'SchemaExtension'" | Where-Object { $SchemaId -match $_.RowKey } if (!$SchemaEntity) { + $StatusCode = [HttpStatusCode]::NotFound throw "Schema extension with ID '$SchemaId' not found." } @@ -227,6 +244,7 @@ function Invoke-ExecCustomData { # Check if the status is already the same if ($SchemaDefinition.status -eq $NewStatus) { + $StatusCode = [HttpStatusCode]::BadRequest throw "Schema extension '$SchemaId' is already in the '$NewStatus' state." } @@ -247,6 +265,7 @@ function Invoke-ExecCustomData { } } } catch { + $StatusCode ??= [HttpStatusCode]::InternalServerError $Result = "Failed to change schema extension status: $($_.Exception.Message)" Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $Result -Sev 'Error' $Body = @{ @@ -281,6 +300,7 @@ function Invoke-ExecCustomData { Results = @($DirectoryExtensions) } } catch { + $StatusCode ??= [HttpStatusCode]::InternalServerError $Body = @{ Results = @( @{ @@ -299,6 +319,7 @@ function Invoke-ExecCustomData { $IsMultiValued = $Request.Body.isMultiValued -eq $true if (!$ExtensionName -or !$DataType -or !$TargetObjects) { + $StatusCode = [HttpStatusCode]::BadRequest throw 'Extension name, data type, and target objects are required.' } @@ -332,6 +353,7 @@ function Invoke-ExecCustomData { } } } catch { + $StatusCode ??= [HttpStatusCode]::InternalServerError $Result = "Failed to add directory extension: $($_.Exception.Message)" Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $Result -Sev 'Error' $Body = @{ @@ -349,6 +371,7 @@ function Invoke-ExecCustomData { $ExtensionName = $Request.Body.name $ExtensionId = $Request.Body.id if (!$ExtensionName) { + $StatusCode = [HttpStatusCode]::BadRequest throw 'Extension name is missing in the request body.' } $AppId = $env:ApplicationID # Replace with your application ID @@ -376,6 +399,7 @@ function Invoke-ExecCustomData { } } } catch { + $StatusCode ??= [HttpStatusCode]::InternalServerError $Result = "Failed to delete directory extension: $($_.Exception.Message)" Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $Result -Sev 'Error' $Body = @{ @@ -429,6 +453,7 @@ function Invoke-ExecCustomData { Results = @($Mappings) } } catch { + $StatusCode ??= [HttpStatusCode]::InternalServerError $Body = @{ Results = @( @{ @@ -443,6 +468,7 @@ function Invoke-ExecCustomData { try { $Mapping = $Request.Body.Mapping if (!$Mapping) { + $StatusCode = [HttpStatusCode]::BadRequest throw 'Mapping data is missing in the request body.' } $MappingId = $Request.Body.id ?? [Guid]::NewGuid().ToString() @@ -464,6 +490,7 @@ function Invoke-ExecCustomData { } } } catch { + $StatusCode ??= [HttpStatusCode]::InternalServerError $Result = "Failed to add mapping: $($_.Exception.Message)" Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $Result -Sev 'Error' $Body = @{ @@ -480,12 +507,14 @@ function Invoke-ExecCustomData { try { $MappingId = $Request.Body.id if (!$MappingId) { + $StatusCode = [HttpStatusCode]::BadRequest throw 'Mapping ID is missing in the request body.' } # Retrieve the mapping entity $MappingEntity = Get-CIPPAzDataTableEntity @CustomDataMappingsTable -Filter "PartitionKey eq 'Mapping' and RowKey eq '$MappingId'" if (!$MappingEntity) { + $StatusCode = [HttpStatusCode]::NotFound throw "Mapping with ID '$MappingId' not found." } @@ -501,6 +530,7 @@ function Invoke-ExecCustomData { } } } catch { + $StatusCode ??= [HttpStatusCode]::InternalServerError $Result = "Failed to delete mapping: $($_.Exception.Message)" Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $Result -Sev 'Error' $Body = @{ @@ -517,12 +547,14 @@ function Invoke-ExecCustomData { try { $MappingId = $Request.Query.id if (!$MappingId) { + $StatusCode = [HttpStatusCode]::BadRequest throw 'Mapping ID is missing in the request query.' } # Retrieve the mapping entity $MappingEntity = Get-CIPPAzDataTableEntity @CustomDataMappingsTable -Filter "PartitionKey eq 'Mapping' and RowKey eq '$MappingId'" if (!$MappingEntity) { + $StatusCode = [HttpStatusCode]::NotFound throw "Mapping with ID '$MappingId' not found." } @@ -531,6 +563,7 @@ function Invoke-ExecCustomData { Results = $Mapping } } catch { + $StatusCode ??= [HttpStatusCode]::InternalServerError $Body = @{ Results = @( @{ @@ -543,6 +576,7 @@ function Invoke-ExecCustomData { } default { + $StatusCode = [HttpStatusCode]::BadRequest $Body = @{ Results = @( @{ @@ -555,7 +589,7 @@ function Invoke-ExecCustomData { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode ?? [HttpStatusCode]::OK Body = $Body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecDnsConfig.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecDnsConfig.ps1 index 7d437c1e2d..74ff943676 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecDnsConfig.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecDnsConfig.ps1 @@ -1,7 +1,7 @@ function Invoke-ExecDnsConfig { <# .FUNCTIONALITY - Entrypoint, AnyTenant + Entrypoint .ROLE Tenant.Domains.ReadWrite #> @@ -73,7 +73,10 @@ function Invoke-ExecDnsConfig { # AnyTenant: restricted callers may only edit domains for tenants in scope $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList if ($AllowedTenants -notcontains 'AllTenants' -and -not ($DomainInfo | Select-CippAllowedTenantData -TenantProperty 'TenantGUID', 'TenantId')) { - throw 'Access to this domain is not allowed' + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::Forbidden + Body = [pscustomobject]@{'Results' = 'Failed. Access to this domain is not allowed' } + }) } $DkimSelectors = [string]($Selector | ConvertTo-Json -Compress) @@ -105,7 +108,10 @@ function Invoke-ExecDnsConfig { # AnyTenant: restricted callers may only remove domains for tenants in scope $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList if ($AllowedTenants -notcontains 'AllTenants' -and -not ($DomainRow | Select-CippAllowedTenantData -TenantProperty 'TenantGUID', 'TenantId')) { - throw 'Access to this domain is not allowed' + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::Forbidden + Body = [pscustomobject]@{'Results' = 'Failed. Access to this domain is not allowed' } + }) } Remove-CIPPAzDataTableEntity -Force @DomainTable -Entity $DomainRow @@ -117,7 +123,7 @@ function Invoke-ExecDnsConfig { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -tenant $($name) -headers $Headers -message "DNS Config API failed. $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage $body = [pscustomobject]@{'Results' = "Failed. $($ErrorMessage.NormalizedError)" } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecExchangeRoleRepair.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecExchangeRoleRepair.ps1 index 00e149fbcd..27005800b4 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecExchangeRoleRepair.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecExchangeRoleRepair.ps1 @@ -12,6 +12,7 @@ function Invoke-ExecExchangeRoleRepair { $TenantId = $Request.Query.tenantId ?? $Request.Body.tenantId $Tenant = Get-Tenants -TenantFilter $TenantId + $StatusCode = [HttpStatusCode]::OK try { Write-Information "Starting Exchange Organization Management role repair for tenant: $($Tenant.defaultDomainName)" @@ -65,6 +66,7 @@ function Invoke-ExecExchangeRoleRepair { $PermissionError = $true } $LogData = $RepairResults | Select-Object -Property id, status, body + $StatusCode = [HttpStatusCode]::InternalServerError $Results = @{ state = 'error' resultText = "Failed to repair the missing Organization Management roles: $($FailedRoles -join ', ').$(if ($PermissionError) { " This may be due to insufficient permissions. The required Graph Permission is 'Application - RoleManagement.ReadWrite.Exchange'" })" @@ -81,6 +83,7 @@ function Invoke-ExecExchangeRoleRepair { } catch { $ErrorMessage = Get-CippException -Exception $_ Write-Warning "Exception during Exchange Organization Management role repair: $($ErrorMessage.NormalizedError)" + $StatusCode = [HttpStatusCode]::InternalServerError Write-LogMessage -API 'ExecExchangeRoleRepair' -headers $Headers -tenant $Tenant.defaultDomainName -tenantid $Tenant.customerId -Message "Exchange Organization Management role repair failed: $($ErrorMessage.NormalizedError)" -sev 'Error' -LogData $ErrorMessage $Results = @{ state = 'error' @@ -89,7 +92,7 @@ function Invoke-ExecExchangeRoleRepair { } return ([HttpResponseContext]@{ - StatusCode = [System.Net.HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Results }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecExcludeTenant.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecExcludeTenant.ps1 index 1f9202ef62..f8d95351d9 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecExcludeTenant.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecExcludeTenant.ps1 @@ -17,6 +17,7 @@ Function Invoke-ExecExcludeTenant { Write-Host ($Username | ConvertTo-Json -Depth 10) $Date = (Get-Date).ToString('yyyy-MM-dd') $TenantsTable = Get-CippTable -tablename Tenants + $StatusCode = [HttpStatusCode]::OK if ($Request.Query.List) { $ExcludedFilter = "PartitionKey eq 'Tenants' and Excluded eq true" @@ -60,11 +61,12 @@ Function Invoke-ExecExcludeTenant { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -tenant $($Name) -headers $Headers -message "Exclusion API failed. $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage $body = [pscustomobject]@{'Results' = "Failed. $($ErrorMessage.NormalizedError)" } + $StatusCode = [HttpStatusCode]::InternalServerError } if (!$body) { $body = @() } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $body }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecGDAPTrace.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecGDAPTrace.ps1 index f98c558c7a..e23441e008 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecGDAPTrace.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecGDAPTrace.ps1 @@ -343,6 +343,7 @@ function Invoke-ExecGDAPTrace { # ======================================================================== $AllAccessAssignments = [System.Collections.Generic.List[object]]::new() $RelationshipAssignmentMap = @{} # Maps relationshipId -> list of assignments + $FailedRelationships = 0 foreach ($Relationship in $Relationships) { $RelationshipId = $Relationship.id @@ -394,6 +395,7 @@ function Invoke-ExecGDAPTrace { }) } } catch { + $FailedRelationships++ Write-LogMessage -Headers $Headers -API $APIName -message "Could not get access assignments for relationship ${RelationshipName}: $($_.Exception.Message)" -sev 'Warning' } } @@ -855,7 +857,7 @@ function Invoke-ExecGDAPTrace { } return [HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = Get-CippBulkStatusCode -Total @($Relationships).Count -Failed $FailedRelationships Body = $Results } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecJITAdminSettings.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecJITAdminSettings.ps1 index 3322b17b25..f93c8e6145 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecJITAdminSettings.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecJITAdminSettings.ps1 @@ -18,7 +18,7 @@ function Invoke-ExecJITAdminSettings { $JITAdminConfig = Get-CIPPAzDataTableEntity @Table -Filter $Filter if (-not $JITAdminConfig) { - $JITAdminConfig = @{ + $JITAdminConfig = [pscustomobject]@{ PartitionKey = 'JITAdminSettings' RowKey = 'JITAdminSettings' MaxDuration = $null # null means no limit @@ -30,7 +30,11 @@ function Invoke-ExecJITAdminSettings { $Results = switch ($Action) { 'Get' { @{ - MaxDuration = $JITAdminConfig.MaxDuration + MaxDuration = $JITAdminConfig.MaxDuration + RequireApproval = [bool]$JITAdminConfig.RequireApproval + ApprovalTriggerRoles = @(if ($JITAdminConfig.ApprovalTriggerRoles) { $JITAdminConfig.ApprovalTriggerRoles | ConvertFrom-Json }) + ApproverRoles = @(if ($JITAdminConfig.ApproverRoles) { $JITAdminConfig.ApproverRoles | ConvertFrom-Json | ForEach-Object { @{ label = $_; value = $_ } } }) + RequiredApprovals = [math]::Max(1, [int]$JITAdminConfig.RequiredApprovals) } } 'Set' { @@ -50,20 +54,40 @@ function Invoke-ExecJITAdminSettings { break } } else { - # Empty or null means no limit - $JITAdminConfig.MaxDuration = $null + # Empty or null means no limit; a saved row has no MaxDuration column, as tables drop nulls + $JITAdminConfig | Add-Member -NotePropertyName MaxDuration -NotePropertyValue $null -Force } + # Roles that need approval; none selected means every JIT Admin request needs approval + $TriggerRoles = @($Request.Body.ApprovalTriggerRoles | Where-Object { $_.value } | ForEach-Object { @{ label = $_.label; value = $_.value } }) + # CIPP roles whose users can approve requests + $ApproverRoles = @($Request.Body.ApproverRoles.value | Where-Object { $_ }) + if ([bool]$Request.Body.RequireApproval -and $ApproverRoles.Count -eq 0) { + $StatusCode = [HttpStatusCode]::BadRequest + @{ Results = 'Error: Select at least one approver role when approval is required.' } + break + } + $JITAdminConfig | Add-Member -NotePropertyName RequireApproval -NotePropertyValue ([bool]$Request.Body.RequireApproval) -Force + $JITAdminConfig | Add-Member -NotePropertyName ApprovalTriggerRoles -NotePropertyValue ([string](ConvertTo-Json -InputObject $TriggerRoles -Compress)) -Force + $JITAdminConfig | Add-Member -NotePropertyName ApproverRoles -NotePropertyValue ([string](ConvertTo-Json -InputObject $ApproverRoles -Compress)) -Force + $JITAdminConfig | Add-Member -NotePropertyName RequiredApprovals -NotePropertyValue ([math]::Max(1, ($Request.Body.RequiredApprovals -as [int]))) -Force + $JITAdminConfig.PartitionKey = 'JITAdminSettings' $JITAdminConfig.RowKey = 'JITAdminSettings' Add-CIPPAzDataTableEntity @Table -Entity $JITAdminConfig -Force | Out-Null - $Message = if ($JITAdminConfig.MaxDuration) { + $DurationMessage = if ($JITAdminConfig.MaxDuration) { "Successfully set JIT Admin maximum duration to $($JITAdminConfig.MaxDuration)" } else { 'Successfully removed JIT Admin maximum duration limit' } + $ApprovalMessage = if ($JITAdminConfig.RequireApproval) { + "approval required: $($JITAdminConfig.RequiredApprovals) from $($ApproverRoles -join ', ')" + } else { + 'approval not required' + } + $Message = "$DurationMessage; $ApprovalMessage" Write-LogMessage -headers $Headers -API $APIName -message $Message -Sev 'Info' diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecLogRetentionConfig.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecLogRetentionConfig.ps1 index d57c4f4d41..f946114723 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecLogRetentionConfig.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecLogRetentionConfig.ps1 @@ -10,6 +10,22 @@ function Invoke-ExecLogRetentionConfig { $Table = Get-CIPPTable -TableName Config $Filter = "PartitionKey eq 'LogRetention' and RowKey eq 'Settings'" + if (-not $Request.Query.List) { + $RetentionDays = $Request.Body.RetentionDays -as [int] + $ValidationError = if ($RetentionDays -lt 7) { + 'Retention days must be at least 7 days' + } elseif ($RetentionDays -gt 365) { + 'Retention days must be at most 365 days' + } + if ($ValidationError) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = [pscustomobject]@{'Results' = "Failed to set configuration: $ValidationError" } + }) + } + } + + $StatusCode = [HttpStatusCode]::OK $results = try { if ($Request.Query.List) { $RetentionSettings = Get-CIPPAzDataTableEntity @Table -Filter $Filter @@ -24,18 +40,6 @@ function Invoke-ExecLogRetentionConfig { } } } else { - $RetentionDays = [int]$Request.Body.RetentionDays - - # Validate minimum value - if ($RetentionDays -lt 7) { - throw 'Retention days must be at least 7 days' - } - - # Validate maximum value - if ($RetentionDays -gt 365) { - throw 'Retention days must be at most 365 days' - } - $RetentionConfig = @{ 'RetentionDays' = $RetentionDays 'PartitionKey' = 'LogRetention' @@ -49,13 +53,14 @@ function Invoke-ExecLogRetentionConfig { } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -headers $Request.Headers -API $Request.Params.CIPPEndpoint -message "Failed to set log retention configuration: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError "Failed to set configuration: $($ErrorMessage.NormalizedError)" } $body = [pscustomobject]@{'Results' = $Results } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecMaintenanceScripts.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecMaintenanceScripts.ps1 index f99bcdb2b8..4e2d588284 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecMaintenanceScripts.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecMaintenanceScripts.ps1 @@ -25,6 +25,7 @@ Function Invoke-ExecMaintenanceScripts { } catch { Write-Host $_.Exception.Message } #$ReplacementStrings | Format-Table + $StatusCode = [HttpStatusCode]::OK try { $ScriptFile = $Request.Query.ScriptFile @@ -40,6 +41,7 @@ Function Invoke-ExecMaintenanceScripts { } $Body = @{ ScriptFiles = @($ScriptOptions) } } elseif (!(Get-ChildItem (Join-Path $env:CIPPRootPath "ExecMaintenanceScripts\Scripts\$Filename") -ErrorAction SilentlyContinue)) { + $StatusCode = [HttpStatusCode]::NotFound $Body = @{ Status = 'Script does not exist' } } else { $Script = Get-Content -Raw (Join-Path $env:CIPPRootPath "ExecMaintenanceScripts\Scripts\$Filename") @@ -68,11 +70,12 @@ Function Invoke-ExecMaintenanceScripts { } } catch { Write-LogMessage -headers $Request.Headers -API $APINAME -tenant $($tenantfilter) -message "Failed to retrieve maintenance scripts. Error: $($_.Exception.Message)" -Sev 'Error' + $StatusCode = [HttpStatusCode]::InternalServerError $Body = @{Status = "Failed to retrieve maintenance scripts $($_.Exception.Message)" } } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Body }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPartnerMode.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPartnerMode.ps1 index 02cb0e9d7b..a5a1f76840 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPartnerMode.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPartnerMode.ps1 @@ -59,7 +59,7 @@ function Invoke-ExecPartnerMode { } if ($request.query.action -eq 'ListCurrent') { - $CurrentState = Get-CIPPAzDataTableEntity @Table + $CurrentState = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'Setting' and RowKey eq 'PartnerModeSetting'" $CurrentState = if (!$CurrentState) { [PSCustomObject]@{ TenantMode = 'default' diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPasswordConfig.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPasswordConfig.ps1 index 986f6baa52..0dc179ece9 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPasswordConfig.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPasswordConfig.ps1 @@ -1,7 +1,7 @@ function Invoke-ExecPasswordConfig { <# .FUNCTIONALITY - Entrypoint, AnyTenant + Entrypoint .ROLE CIPP.AppSettings.ReadWrite #> @@ -42,16 +42,16 @@ function Invoke-ExecPasswordConfig { $resolvedConfig = @{ passwordType = $storedType charCount = if ($PasswordSettings.charCount -and [int]::TryParse("$($PasswordSettings.charCount)", [ref]$null)) { [int]$PasswordSettings.charCount } else { 14 } - includeUppercase = if ($null -ne $PasswordSettings.includeUppercase) { [bool]$PasswordSettings.includeUppercase } else { $true } - includeLowercase = if ($null -ne $PasswordSettings.includeLowercase) { [bool]$PasswordSettings.includeLowercase } else { $true } - includeDigits = if ($null -ne $PasswordSettings.includeDigits) { [bool]$PasswordSettings.includeDigits } else { $true } - includeSpecialChars = if ($null -ne $PasswordSettings.includeSpecialChars) { [bool]$PasswordSettings.includeSpecialChars } else { $true } + includeUppercase = if ($null -ne $PasswordSettings.includeUppercase) { "$($PasswordSettings.includeUppercase)" -eq 'true' } else { $true } + includeLowercase = if ($null -ne $PasswordSettings.includeLowercase) { "$($PasswordSettings.includeLowercase)" -eq 'true' } else { $true } + includeDigits = if ($null -ne $PasswordSettings.includeDigits) { "$($PasswordSettings.includeDigits)" -eq 'true' } else { $true } + includeSpecialChars = if ($null -ne $PasswordSettings.includeSpecialChars) { "$($PasswordSettings.includeSpecialChars)" -eq 'true' } else { $true } specialCharSet = if ($PasswordSettings.specialCharSet) { $PasswordSettings.specialCharSet } else { '$%&*#' } wordCount = if ($PasswordSettings.wordCount -and [int]::TryParse("$($PasswordSettings.wordCount)", [ref]$null)) { [int]$PasswordSettings.wordCount } else { 4 } separator = if ($null -ne $PasswordSettings.separator) { $PasswordSettings.separator } else { '-' } - capitalizeWords = if ($null -ne $PasswordSettings.capitalizeWords) { [bool]$PasswordSettings.capitalizeWords } else { $false } - appendNumber = if ($null -ne $PasswordSettings.appendNumber) { [bool]$PasswordSettings.appendNumber } else { $false } - appendSpecialChar = if ($null -ne $PasswordSettings.appendSpecialChar) { [bool]$PasswordSettings.appendSpecialChar } else { $false } + capitalizeWords = if ($null -ne $PasswordSettings.capitalizeWords) { "$($PasswordSettings.capitalizeWords)" -eq 'true' } else { $false } + appendNumber = if ($null -ne $PasswordSettings.appendNumber) { "$($PasswordSettings.appendNumber)" -eq 'true' } else { $false } + appendSpecialChar = if ($null -ne $PasswordSettings.appendSpecialChar) { "$($PasswordSettings.appendSpecialChar)" -eq 'true' } else { $false } } # Persist migrated config so legacy type is upgraded in storage @@ -92,13 +92,13 @@ function Invoke-ExecPasswordConfig { throw 'Please select a valid password type (Classic or Passphrase)' } - $includeUppercase = [bool]$Request.Body.includeUppercase - $includeLowercase = [bool]$Request.Body.includeLowercase - $includeDigits = [bool]$Request.Body.includeDigits - $includeSpecialChars = [bool]$Request.Body.includeSpecialChars - $capitalizeWords = [bool]$Request.Body.capitalizeWords - $appendNumber = [bool]$Request.Body.appendNumber - $appendSpecialChar = [bool]$Request.Body.appendSpecialChar + $includeUppercase = "$($Request.Body.includeUppercase)" -eq 'true' + $includeLowercase = "$($Request.Body.includeLowercase)" -eq 'true' + $includeDigits = "$($Request.Body.includeDigits)" -eq 'true' + $includeSpecialChars = "$($Request.Body.includeSpecialChars)" -eq 'true' + $capitalizeWords = "$($Request.Body.capitalizeWords)" -eq 'true' + $appendNumber = "$($Request.Body.appendNumber)" -eq 'true' + $appendSpecialChar = "$($Request.Body.appendSpecialChar)" -eq 'true' # Char count validation (classic only) $charCount = 0 diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPermissionRepair.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPermissionRepair.ps1 index d6933a8a82..a77d94e7a5 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPermissionRepair.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPermissionRepair.ps1 @@ -14,6 +14,7 @@ function Invoke-ExecPermissionRepair { $APIName = $Request.Params.CIPPEndpoint ?? 'PermissionRepair' $Headers = $Request.Headers + $StatusCode = [HttpStatusCode]::OK try { $User = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Request.Headers.'x-ms-client-principal')) | ConvertFrom-Json @@ -24,13 +25,14 @@ function Invoke-ExecPermissionRepair { } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message "Failed to reconcile permissions: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError $Body = @{ 'Results' = "$($_.Exception.Message) - at line $($_.InvocationInfo.ScriptLineNumber)" } } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPushSubscription.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPushSubscription.ps1 index 67e85f9bb8..7dae72d26f 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPushSubscription.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPushSubscription.ps1 @@ -18,11 +18,20 @@ function Invoke-ExecPushSubscription { $Username = ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails $Action = [string]$Request.Body.Action - try { - if (![string]::IsNullOrWhiteSpace($Headers.'x-cipp-impersonate-role')) { - throw 'Push notification devices cannot be changed while impersonating a role.' - } + if (![string]::IsNullOrWhiteSpace($Headers.'x-cipp-impersonate-role')) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::Forbidden + Body = @{ Results = 'Push notification devices cannot be changed while impersonating a role.' } + }) + } + if ($Action -notin @('Subscribe', 'Unsubscribe', 'Test')) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Unknown action '$Action'. Use Subscribe, Unsubscribe or Test." } + }) + } + try { $Table = Get-CIPPTable -tablename 'PushSubscriptions' switch ($Action) { 'Subscribe' { @@ -30,7 +39,10 @@ function Invoke-ExecPushSubscription { $Endpoint = [string]$Subscription.endpoint if (![string]::IsNullOrWhiteSpace($Endpoint) -and -not $Endpoint.StartsWith('https://')) { $Endpoint = '' } if ([string]::IsNullOrWhiteSpace($Endpoint) -or [string]::IsNullOrWhiteSpace($Subscription.keys.p256dh) -or [string]::IsNullOrWhiteSpace($Subscription.keys.auth)) { - throw 'A push subscription needs an https endpoint and p256dh/auth keys.' + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'A push subscription needs an https endpoint and p256dh/auth keys.' } + }) } $RowKey = Get-StringHash -String $Endpoint $DeviceName = [string]$Request.Body.DeviceName @@ -49,7 +61,12 @@ function Invoke-ExecPushSubscription { 'Unsubscribe' { $RowKey = [string]$Request.Body.RowKey $Existing = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq '$Username' and RowKey eq '$RowKey'" - if (!$Existing) { throw 'That device is not registered to you.' } + if (!$Existing) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = @{ Results = 'That device is not registered to you.' } + }) + } Remove-AzDataTableEntity @Table -Entity $Existing -Force | Out-Null Write-LogMessage -headers $Headers -API $APIName -message "Removed push notification device '$($Existing.DeviceName)'" -Sev 'Info' $Results = @{ Results = "Removed '$($Existing.DeviceName)'." } @@ -58,12 +75,11 @@ function Invoke-ExecPushSubscription { $Outcome = Send-CIPPAlert -Type 'push' -TargetUser $Username -Title 'CIPP test notification' -PushMessage 'Push notifications are working on this device.' -Url '/cipp/preferences' -APIName $APIName $Results = @{ Results = "$Outcome" } } - default { throw "Unknown action '$Action'. Use Subscribe, Unsubscribe or Test." } } $StatusCode = [HttpStatusCode]::OK } catch { $Results = @{ Results = "$($_.Exception.Message)" } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecReportAttachmentRetentionConfig.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecReportAttachmentRetentionConfig.ps1 index 0aa7d10c2e..26f068b613 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecReportAttachmentRetentionConfig.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecReportAttachmentRetentionConfig.ps1 @@ -10,6 +10,22 @@ function Invoke-ExecReportAttachmentRetentionConfig { $Table = Get-CIPPTable -TableName Config $Filter = "PartitionKey eq 'ReportAttachmentRetention' and RowKey eq 'Settings'" + if (-not $Request.Query.List) { + $RetentionDays = $Request.Body.RetentionDays -as [int] + $ValidationError = if ($RetentionDays -lt 7) { + 'Retention days must be at least 7 days' + } elseif ($RetentionDays -gt 365) { + 'Retention days must be at most 365 days' + } + if ($ValidationError) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = [pscustomobject]@{'Results' = "Failed to set configuration: $ValidationError" } + }) + } + } + + $StatusCode = [HttpStatusCode]::OK $results = try { if ($Request.Query.List) { $RetentionSettings = Get-CIPPAzDataTableEntity @Table -Filter $Filter @@ -24,18 +40,6 @@ function Invoke-ExecReportAttachmentRetentionConfig { } } } else { - $RetentionDays = [int]$Request.Body.RetentionDays - - # Validate minimum value - if ($RetentionDays -lt 7) { - throw 'Retention days must be at least 7 days' - } - - # Validate maximum value - if ($RetentionDays -gt 365) { - throw 'Retention days must be at most 365 days' - } - $RetentionConfig = @{ 'RetentionDays' = $RetentionDays 'PartitionKey' = 'ReportAttachmentRetention' @@ -49,13 +53,14 @@ function Invoke-ExecReportAttachmentRetentionConfig { } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -headers $Request.Headers -API $Request.Params.CIPPEndpoint -message "Failed to set report attachment retention configuration: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError "Failed to set configuration: $($ErrorMessage.NormalizedError)" } $body = [pscustomobject]@{'Results' = $Results } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRestoreBackup.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRestoreBackup.ps1 index db67ef64d2..4a26bebacd 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRestoreBackup.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRestoreBackup.ps1 @@ -9,12 +9,13 @@ function Invoke-ExecRestoreBackup { param($Request, $TriggerMetadata) $APIName = $Request.Params.CIPPEndpoint + $StatusCode = [HttpStatusCode]::OK # Types natively supported by Azure Table Storage — preserve these as-is $AzureTableTypes = @( [string], [int], [long], [double], [bool], [datetime], [guid], [byte[]] ) - $RestrictedTables = @('AccessRoleGroups', 'AccessIPRanges', 'CustomRoles', 'DevSecrets') # tables that require superadmin to restore + $RestrictedTables = @('AccessRoleGroups', 'AccessIPRanges', 'CustomRoles') # tables that require superadmin to restore # Resolve the calling user's roles, including Entra group-based roles $CallingUser = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Request.Headers.'x-ms-client-principal')) | ConvertFrom-Json @@ -24,7 +25,7 @@ function Invoke-ExecRestoreBackup { $IsSuperAdmin = $CallingUser.userRoles -contains 'superadmin' try { - if ($Request.Body.BackupName -like 'CippBackup_*') { + if ($Request.Body.BackupName -like 'CIPPBackup_*') { # Use Get-CIPPBackup which already handles fetching from blob storage $Backup = Get-CIPPBackup -Type 'CIPP' -Name $Request.Body.BackupName if ($Backup) { @@ -77,13 +78,14 @@ function Invoke-ExecRestoreBackup { $RestoredCount++ } Write-LogMessage -headers $Request.Headers -API $APINAME -message "Restored backup $($Request.Body.BackupName) - $RestoredCount rows restored" -Sev 'Info' - $body = [pscustomobject]@{ + $body = @{ 'Results' = "Successfully restored $RestoredCount rows from backup." - } + } | ConvertTo-Json -Compress } else { - $body = [pscustomobject]@{ - 'Results' = 'Backup not found.' - } + $StatusCode = [HttpStatusCode]::NotFound + $body = @{ + error = "Backup not found: $($Request.Body.BackupName)" + } | ConvertTo-Json -Compress } } else { $RestoredCount = 0 @@ -110,19 +112,28 @@ function Invoke-ExecRestoreBackup { } Write-LogMessage -headers $Request.Headers -API $APINAME -message "Restored backup - $RestoredCount rows restored" -Sev 'Info' - $body = [pscustomobject]@{ + $body = @{ 'Results' = "Successfully restored $RestoredCount rows from backup." - } + } | ConvertTo-Json -Compress } } catch { - Write-LogMessage -headers $Request.Headers -API $APINAME -message "Failed to restore backup: $($_.Exception.Message)" -Sev 'Error' - $body = [pscustomobject]@{'Results' = "Backup restore failed: $($_.Exception.Message)" } + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -headers $Request.Headers -API $APINAME -message "Failed to restore backup: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError + $body = @{ + error = "Backup restore failed: $($ErrorMessage.NormalizedError)" + details = @{ + operation = 'RestoreBackup' + backupName = $Request.Body.BackupName + innerException = $_.Exception.Message + } + } | ConvertTo-Json -Depth 5 -Compress } - return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK - Body = $body + StatusCode = $StatusCode + ContentType = 'application/json' + Body = $body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRunBackup.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRunBackup.ps1 index de1d11c38b..52ee8fc196 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRunBackup.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRunBackup.ps1 @@ -9,6 +9,7 @@ Function Invoke-ExecRunBackup { param($Request, $TriggerMetadata) $APIName = $Request.Params.CIPPEndpoint + $StatusCode = [HttpStatusCode]::OK try { $CSVfile = New-CIPPBackup -BackupType 'CIPP' -Headers $Request.Headers @@ -23,19 +24,21 @@ Function Invoke-ExecRunBackup { Write-LogMessage -headers $Request.Headers -API $APINAME -message 'Created CIPP backup' -Sev 'Info' } catch { - $body = [pscustomobject]@{ - 'Results' = @( - @{ - resultText = 'Failed to create backup' - state = 'error' - } - ) + $ErrorMessage = Get-CippException -Exception $_ + $StatusCode = [HttpStatusCode]::InternalServerError + $body = @{ + error = "Failed to create backup: $($ErrorMessage.NormalizedError)" + details = @{ + operation = 'CreateBackup' + innerException = $_.Exception.Message + } } | ConvertTo-Json -Depth 5 -Compress - Write-LogMessage -headers $Request.Headers -API $APINAME -message 'Failed to create CIPP backup' -Sev 'Error' -LogData (Get-CippException -Exception $_) + Write-LogMessage -headers $Request.Headers -API $APINAME -message "Failed to create CIPP backup: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK - Body = $body + StatusCode = $StatusCode + ContentType = 'application/json' + Body = $body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecSAMAppPermissions.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecSAMAppPermissions.ps1 index 3974edd519..cd9d6916d2 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecSAMAppPermissions.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecSAMAppPermissions.ps1 @@ -10,6 +10,7 @@ function Invoke-ExecSAMAppPermissions { $User = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Request.Headers.'x-ms-client-principal')) | ConvertFrom-Json + $StatusCode = [HttpStatusCode]::OK switch ($Request.Query.Action) { 'Update' { try { @@ -68,6 +69,7 @@ function Invoke-ExecSAMAppPermissions { } Write-LogMessage -headers $Request.Headers -API 'ExecSAMAppPermissions' -message 'CIPP-SAM permissions updated' -Sev 'Info' -LogData $Applied } catch { + $StatusCode = [HttpStatusCode]::InternalServerError $Body = @{ 'Results' = $_.Exception.Message } @@ -85,6 +87,7 @@ function Invoke-ExecSAMAppPermissions { } Write-LogMessage -headers $Request.Headers -API 'ExecSAMAppPermissions' -message 'CIPP-SAM permissions reset to CIPP defaults' -Sev 'Info' } catch { + $StatusCode = [HttpStatusCode]::InternalServerError $Body = @{ 'Results' = $_.Exception.Message } @@ -97,7 +100,7 @@ function Invoke-ExecSAMAppPermissions { return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = ConvertTo-Json -Depth 10 -InputObject $Body }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecSAMRoles.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecSAMRoles.ps1 index f7f8af3500..d14d600860 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecSAMRoles.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecSAMRoles.ps1 @@ -12,6 +12,7 @@ function Invoke-ExecSAMRoles { $Headers = $Request.Headers $SAMRolesTable = Get-CIPPTable -tablename 'SAMRoles' + $StatusCode = [HttpStatusCode]::OK switch ($Request.Query.Action) { 'Update' { try { @@ -29,11 +30,12 @@ function Invoke-ExecSAMRoles { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to update SAM roles: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $Result -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError $Body = [pscustomobject]@{'Results' = $Result } } } default { - $SAMRoles = Get-CIPPAzDataTableEntity @SAMRolesTable + $SAMRoles = Get-CIPPAzDataTableEntity @SAMRolesTable -Filter "PartitionKey eq 'SAMRoles' and RowKey eq 'SAMRoles'" $Roles = @($SAMRoles.Roles | ConvertFrom-Json) $Tenants = @($SAMRoles.Tenants | ConvertFrom-Json) $Body = @{ @@ -48,7 +50,7 @@ function Invoke-ExecSAMRoles { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTenantGroup.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTenantGroup.ps1 index 6938be3bb7..f79bd92b60 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTenantGroup.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTenantGroup.ps1 @@ -22,7 +22,6 @@ function Invoke-ExecTenantGroup { $groupType = $Request.Body.groupType ?? 'static' $dynamicRules = $Request.Body.dynamicRules $ruleLogic = $Request.Body.ruleLogic ?? 'and' - $excludePartnerTenant = [bool]($Request.Body.excludePartnerTenant) # Validate dynamic rules to prevent code injection if ($groupType -eq 'dynamic' -and $dynamicRules) { @@ -66,12 +65,10 @@ function Invoke-ExecTenantGroup { } $GroupEntity | Add-Member -NotePropertyName 'GroupType' -NotePropertyValue $groupType -Force if ($groupType -eq 'dynamic' -and $dynamicRules) { - $GroupEntity | Add-Member -NotePropertyName 'DynamicRules' -NotePropertyValue "$($dynamicRules | ConvertTo-Json -Depth 100 -Compress)" -Force + $GroupEntity | Add-Member -NotePropertyName 'DynamicRules' -NotePropertyValue "$($dynamicRules | ConvertTo-Json -Depth 20 -Compress)" -Force $GroupEntity | Add-Member -NotePropertyName 'RuleLogic' -NotePropertyValue $ruleLogic -Force - $GroupEntity | Add-Member -NotePropertyName 'ExcludePartnerTenant' -NotePropertyValue $excludePartnerTenant -Force } else { $GroupEntity | Add-Member -NotePropertyName 'RuleLogic' -NotePropertyValue $null -Force - $GroupEntity | Add-Member -NotePropertyName 'ExcludePartnerTenant' -NotePropertyValue $false -Force } Add-CIPPAzDataTableEntity @Table -Entity $GroupEntity -Force } else { @@ -83,9 +80,8 @@ function Invoke-ExecTenantGroup { GroupType = $groupType } if ($groupType -eq 'dynamic' -and $dynamicRules) { - $GroupEntity.DynamicRules = "$($dynamicRules | ConvertTo-Json -Depth 100 -Compress)" + $GroupEntity.DynamicRules = "$($dynamicRules | ConvertTo-Json -Depth 20 -Compress)" $GroupEntity.RuleLogic = $ruleLogic - $GroupEntity.ExcludePartnerTenant = $excludePartnerTenant } Add-CIPPAzDataTableEntity @Table -Entity $GroupEntity -Force } @@ -116,7 +112,7 @@ function Invoke-ExecTenantGroup { $Adds.Add('Added member {0}' -f $member.label) } - if ($CurrentMembers -and $null -ne $members) { + if ($CurrentMembers -and $members) { foreach ($CurrentMember in $CurrentMembers) { if ($members.value -notcontains $CurrentMember.customerId) { Remove-CIPPAzDataTableEntity @MembersTable -Entity $CurrentMember -Force @@ -164,12 +160,6 @@ function Invoke-ExecTenantGroup { } } - # Roles can be scoped to a tenant group, so changing membership changes what those roles - # resolve to and the cached scope rules have to be rebuilt - if ($Action -in @('AddEdit', 'Delete')) { - Clear-CippAccessScopeCache - } - return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::OK Body = $Body diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTimeSettings.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTimeSettings.ps1 index 56fcb1bcd8..5fe96313ff 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTimeSettings.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTimeSettings.ps1 @@ -8,20 +8,26 @@ function Invoke-ExecTimeSettings { [CmdletBinding()] param($Request, $TriggerMetadata) - try { - $Timezone = $Request.Body.Timezone.value ?? $Request.Body.Timezone + $Timezone = $Request.Body.Timezone.value ?? $Request.Body.Timezone - if (-not $Timezone) { - throw 'Timezone is required' - } + if (-not $Timezone) { + return ([HttpResponseContext]@{ + StatusCode = [httpstatusCode]::BadRequest + Body = @{ Results = 'Failed to update time settings: Timezone is required' } + }) + } - # Validate the IANA timezone ID is recognised by .NET - try { - $null = [TimeZoneInfo]::FindSystemTimeZoneById($Timezone) - } catch { - throw "Invalid timezone: '$Timezone' is not a recognised IANA timezone ID" - } + # Validate the IANA timezone ID is recognised by .NET + try { + $null = [TimeZoneInfo]::FindSystemTimeZoneById($Timezone) + } catch { + return ([HttpResponseContext]@{ + StatusCode = [httpstatusCode]::BadRequest + Body = @{ Results = "Failed to update time settings: Invalid timezone: '$Timezone' is not a recognised IANA timezone ID" } + }) + } + try { $Config = @{ PartitionKey = 'TimeSettings' RowKey = 'TimeSettings' @@ -55,7 +61,7 @@ function Invoke-ExecTimeSettings { Write-LogMessage -API 'ExecTimeSettings' -headers $Request.Headers -message "Failed to update time settings: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage return ([HttpResponseContext]@{ - StatusCode = [httpstatusCode]::BadRequest + StatusCode = [httpstatusCode]::InternalServerError Body = @{ Results = "Failed to update time settings: $($ErrorMessage.NormalizedError)" } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecUserBookmarks.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecUserBookmarks.ps1 index 8d83ec8001..b1326bd229 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecUserBookmarks.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecUserBookmarks.ps1 @@ -36,7 +36,7 @@ function Invoke-ExecUserBookmarks { $Result = "Function Error: $ErrorMsg" Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $Result -Sev 'Error' $Results = $Result - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return [HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecUserSettings.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecUserSettings.ps1 index b665b8ea00..7c3da63ba5 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecUserSettings.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecUserSettings.ps1 @@ -29,7 +29,7 @@ function Invoke-ExecUserSettings { $Result = "Function Error: $ErrorMsg" Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $Result -Sev 'Error' $Results = $Result - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return [HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecWebhookSubscriptions.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecWebhookSubscriptions.ps1 index 692239ac87..6720277499 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecWebhookSubscriptions.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecWebhookSubscriptions.ps1 @@ -9,14 +9,9 @@ function Invoke-ExecWebhookSubscriptions { param($Request, $TriggerMetadata) $Table = Get-CIPPTable -TableName webhookTable - $WebhookId = $Request.Query.WebhookID - $SafeWebhookId = if (![string]::IsNullOrEmpty($WebhookId)) { - ConvertTo-CIPPODataFilterValue -Value $WebhookId -Type String - } - switch ($Request.Query.Action) { 'Delete' { - $Webhook = Get-AzDataTableEntity @Table -Filter "RowKey eq '$SafeWebhookId'" -Property PartitionKey, RowKey + $Webhook = Get-AzDataTableEntity @Table -Filter "RowKey eq '$($Request.Query.WebhookID)'" -Property PartitionKey, RowKey if ($Webhook) { Remove-CIPPGraphSubscription -TenantFilter $Webhook.PartitionKey -CIPPID $Webhook.RowKey Remove-CIPPAzDataTableEntity -Force @Table -Entity $Webhook @@ -32,7 +27,7 @@ function Invoke-ExecWebhookSubscriptions { } } 'Unsubscribe' { - $Webhook = Get-AzDataTableEntity @Table -Filter "RowKey eq '$SafeWebhookId'" -Property PartitionKey, RowKey + $Webhook = Get-AzDataTableEntity @Table -Filter "RowKey eq '$($Request.Query.WebhookID)'" -Property PartitionKey, RowKey if ($Webhook) { $Unsubscribe = @{ TenantFilter = $Webhook.PartitionKey @@ -87,7 +82,7 @@ function Invoke-ExecWebhookSubscriptions { } 'Resubscribe' { Write-Host "Resubscribing to $($Request.Query.WebhookID)" - $Row = Get-AzDataTableEntity @Table -Filter "RowKey eq '$SafeWebhookId'" + $Row = Get-AzDataTableEntity @Table -Filter "RowKey eq '$($Request.Query.WebhookID)'" if ($Row) { $NewSubParams = @{ TenantFilter = $Row.PartitionKey diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCustomRole.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCustomRole.ps1 index 7c1be797a8..a0d8ebb275 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCustomRole.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCustomRole.ps1 @@ -4,14 +4,12 @@ function Invoke-ListCustomRole { Entrypoint .ROLE CIPP.Core.Read - .DESCRIPTION - Lists custom RBAC roles defined in CIPP, including their permission sets and associated access role groups. #> [CmdletBinding()] param($Request, $TriggerMetadata) $DefaultRoles = @('readonly', 'editor', 'admin', 'superadmin') $Table = Get-CippTable -tablename 'CustomRoles' - $CustomRoles = Get-CIPPAzDataTableEntity @Table + $CustomRoles = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'CustomRoles'" $CippRolesJson = Join-Path -Path $env:CIPPRootPath -ChildPath 'Config\cipp-roles.json' $BaseRoleConfig = if (Test-Path $CippRolesJson) { @@ -21,10 +19,10 @@ function Invoke-ListCustomRole { } $AccessRoleGroupTable = Get-CippTable -tablename 'AccessRoleGroups' - $RoleGroups = Get-CIPPAzDataTableEntity @AccessRoleGroupTable + $RoleGroups = Get-CIPPAzDataTableEntity @AccessRoleGroupTable -Filter "PartitionKey eq 'AccessRoleGroups'" $AccessIPRangeTable = Get-CippTable -tablename 'AccessIPRanges' - $AccessIPRanges = Get-CIPPAzDataTableEntity @AccessIPRangeTable + $AccessIPRanges = Get-CIPPAzDataTableEntity @AccessIPRangeTable -Filter "PartitionKey eq 'AccessIPRanges'" $TenantList = Get-Tenants -IncludeErrors @@ -85,49 +83,73 @@ function Invoke-ListCustomRole { $Role | Add-Member -NotePropertyName PermissionRules -NotePropertyValue $null -Force } if ($Role.AllowedTenants) { - $RawAllowedTenants = $Role.AllowedTenants try { - # No null filter and no 'AllTenants' fallback: every stored entry produces exactly - # one displayed entry, so the list shown is the list stored - $Role.AllowedTenants = @( - $RawAllowedTenants | ConvertFrom-Json -ErrorAction Stop | ForEach-Object { - Resolve-CippRoleTenantEntry -Entry $_ -TenantList $TenantList + $AllowedTenants = $Role.AllowedTenants | ConvertFrom-Json -ErrorAction Stop | ForEach-Object { + if ($_ -is [PSCustomObject] -and $_.type -eq 'Group') { + # Return group objects as-is for frontend display + [PSCustomObject]@{ + type = 'Group' + value = $_.value + label = $_.label + } + } else { + # Convert tenant customer ID to domain name object for frontend + $TenantId = $_ + $TenantInfo = $TenantList | Where-Object { $_.customerId -eq $TenantId } + if ($TenantInfo) { + [PSCustomObject]@{ + type = 'Tenant' + value = $TenantInfo.defaultDomainName + label = "$($TenantInfo.displayName) ($($TenantInfo.defaultDomainName))" + addedFields = @{ + defaultDomainName = $TenantInfo.defaultDomainName + displayName = $TenantInfo.displayName + customerId = $TenantInfo.customerId + } + } + } } - ) + } | Where-Object { $_ -ne $null } + $AllowedTenants = $AllowedTenants ?? @('AllTenants') + $Role.AllowedTenants = @($AllowedTenants) } catch { - Write-Warning "Could not parse AllowedTenants for role '$($Role.RowKey)': $($_.Exception.Message)" - $Role.AllowedTenants = @( - [PSCustomObject]@{ - type = 'Tenant' - value = [string]$RawAllowedTenants - label = 'Stored value could not be read' - Unresolved = $true - } - ) + $Role.AllowedTenants = @('AllTenants') } } else { $Role | Add-Member -NotePropertyName AllowedTenants -NotePropertyValue @() -Force } if ($Role.BlockedTenants) { - $RawBlockedTenants = $Role.BlockedTenants try { - # An unresolvable id here is exactly the case that mattered: a block on a tenant - # the current tenant list does not contain used to render as no block at all - $Role.BlockedTenants = @( - $RawBlockedTenants | ConvertFrom-Json -ErrorAction Stop | ForEach-Object { - Resolve-CippRoleTenantEntry -Entry $_ -TenantList $TenantList + $BlockedTenants = $Role.BlockedTenants | ConvertFrom-Json -ErrorAction Stop | ForEach-Object { + if ($_ -is [PSCustomObject] -and $_.type -eq 'Group') { + # Return group objects as-is for frontend display + [PSCustomObject]@{ + type = 'Group' + value = $_.value + label = $_.label + } + } else { + # Convert tenant customer ID to domain name object for frontend + $TenantId = $_ + $TenantInfo = $TenantList | Where-Object { $_.customerId -eq $TenantId } + if ($TenantInfo) { + [PSCustomObject]@{ + type = 'Tenant' + value = $TenantInfo.defaultDomainName + label = "$($TenantInfo.displayName) ($($TenantInfo.defaultDomainName))" + addedFields = @{ + defaultDomainName = $TenantInfo.defaultDomainName + displayName = $TenantInfo.displayName + customerId = $TenantInfo.customerId + } + } + } } - ) + } | Where-Object { $_ -ne $null } + $BlockedTenants = $BlockedTenants ?? @() + $Role.BlockedTenants = @($BlockedTenants) } catch { - Write-Warning "Could not parse BlockedTenants for role '$($Role.RowKey)': $($_.Exception.Message)" - $Role.BlockedTenants = @( - [PSCustomObject]@{ - type = 'Tenant' - value = [string]$RawBlockedTenants - label = 'Stored value could not be read' - Unresolved = $true - } - ) + $Role.BlockedTenants = @() } } else { $Role | Add-Member -NotePropertyName BlockedTenants -NotePropertyValue @() -Force diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListExcludedLicenses.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListExcludedLicenses.ps1 index e69bb30a84..1319160319 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListExcludedLicenses.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListExcludedLicenses.ps1 @@ -4,8 +4,6 @@ function Invoke-ListExcludedLicenses { Entrypoint .ROLE CIPP.AppSettings.Read - .DESCRIPTION - Lists license SKUs that have been excluded from CIPP license counts and reporting. #> [CmdletBinding()] param($Request, $TriggerMetadata) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecAddTenant.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecAddTenant.ps1 index 5fcc43c60b..a6789ad949 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecAddTenant.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecAddTenant.ps1 @@ -8,6 +8,7 @@ function Invoke-ExecAddTenant { [CmdletBinding()] param($Request, $TriggerMetadata) + $StatusCode = [HttpStatusCode]::OK try { # AnyTenant: onboarding writes tenant credentials; require unrestricted tenant scope $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList @@ -37,6 +38,7 @@ function Invoke-ExecAddTenant { if ($tenantId -eq $env:TenantID) { # If the tenant is the partner tenant, return an error because you cannot add the partner tenant as direct tenant $Results = @{'message' = 'You cannot add the partner tenant as a direct tenant. Please connect the tenant using the "Connect to Partner Tenant" option. '; 'severity' = 'error'; } + $StatusCode = [HttpStatusCode]::BadRequest } elseif ($ExistingTenant -and $ExistingTenant.delegatedPrivilegeStatus -ne 'directTenant') { # Converting an existing GDAP tenant in place would silently change how CIPP # authenticates to it. Require the tenant to be offboarded first so the switch is @@ -46,6 +48,7 @@ function Invoke-ExecAddTenant { Remove-CIPPDirectTenantToken -TenantId $tenantId $Results = @{'message' = "$($ExistingTenant.displayName) is already onboarded as a GDAP tenant and cannot be converted to a Direct Tenant. To manage it as a Direct Tenant, remove the tenant first under Settings > Tenants, then add it again using the Direct Tenant flow."; 'severity' = 'error' } + $StatusCode = [HttpStatusCode]::BadRequest Write-LogMessage -tenant $ExistingTenant.defaultDomainName -tenantid $ExistingTenant.customerId -API 'NewTenant' -message "Blocked conversion of GDAP tenant $($ExistingTenant.displayName) to a Direct Tenant, attempted by $ServiceAccount." -Sev 'Warn' } elseif ($ExistingTenant) { # Existing direct tenant - refresh the stored credentials and service account details. @@ -140,10 +143,11 @@ function Invoke-ExecAddTenant { } } catch { $Results = @{'message' = "Failed to add tenant: $($_.Exception.Message)"; 'state' = 'error'; 'severity' = 'error' } + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Results }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecCombinedSetup.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecCombinedSetup.ps1 index 2ae5483134..476f781576 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecCombinedSetup.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecCombinedSetup.ps1 @@ -10,6 +10,7 @@ function Invoke-ExecCombinedSetup { param($Request, $TriggerMetadata) #Make arraylist of Results $Results = [System.Collections.ArrayList]::new() + $StatusCode = [HttpStatusCode]::OK try { # Certificate-auth toggle for an existing install: enabling keeps the client secret as a rollback # and switches SAM tokens to the certificate. Idempotent with a certificate-only First Setup. @@ -143,10 +144,11 @@ function Invoke-ExecCombinedSetup { $auth = Get-CIPPAuthentication } catch { $Results = [pscustomobject]@{'Results' = "Failed. $($_.InvocationInfo.ScriptLineNumber): $($_.Exception.message)"; severity = 'failed' } + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Results }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecCreateSAMApp.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecCreateSAMApp.ps1 index bce1a1c0c9..1edec5ae6f 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecCreateSAMApp.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecCreateSAMApp.ps1 @@ -12,6 +12,7 @@ function Invoke-ExecCreateSAMApp { $APIName = $Request.Params.CIPPEndpoint $Headers = $Request.Headers $KV = Get-CippKeyVaultName + $StatusCode = [HttpStatusCode]::OK try { $Token = $Request.body @@ -176,16 +177,6 @@ function Invoke-ExecCreateSAMApp { # Reload credentials into env vars $null = Get-CIPPAuthentication - # The reload above reads the store back unconditionally, so if it was still - # serving the old values it just overwrote the credentials we created. The - # values from this request are the authoritative ones - put them back. - if ($env:ApplicationID -ne $AppId.appId) { - Write-Information "Credential reload returned application id '$($env:ApplicationID)' - restoring the one created by this request." - $env:ApplicationID = $AppId.appId - $env:TenantID = $TenantId - $env:ApplicationSecret = $AppPassword - } - # Create the SAM certificate alongside the secret so certificate auth is available # immediately. Uses the wizard's delegated token because the app secret was created # seconds ago and may not have propagated yet. Non-fatal: the weekly token update @@ -215,10 +206,11 @@ function Invoke-ExecCreateSAMApp { } Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message "Failed to create or update CIPP-SAM application registration: $ErrorDetail" -Sev 'Error' $Results = [pscustomobject]@{'Results' = "Failed. $($_.InvocationInfo.ScriptLineNumber): $ErrorDetail"; severity = 'failed' } + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Results }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecDeviceCodeLogon.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecDeviceCodeLogon.ps1 index ad3b10fbff..681907fb3b 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecDeviceCodeLogon.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecDeviceCodeLogon.ps1 @@ -7,6 +7,7 @@ function Invoke-ExecDeviceCodeLogon { #> [CmdletBinding()] param($Request, $TriggerMetadata) + $StatusCode = [HttpStatusCode]::OK try { $clientId = $Request.Query.clientId $scope = $Request.Query.scope @@ -66,6 +67,7 @@ function Invoke-ExecDeviceCodeLogon { message = $deviceCodeInfo.message } } else { + $StatusCode = [HttpStatusCode]::InternalServerError $Results = @{ error = $deviceCodeInfo.error ?? 'device_code_error' error_description = $deviceCodeInfo.error_description ?? 'Failed to request a device code.' @@ -107,6 +109,7 @@ function Invoke-ExecDeviceCodeLogon { } catch { # ErrorDetails carries the response body from the token endpoint, which is where the # AADSTS code lives; the exception message on its own is just the status line. + $StatusCode = [HttpStatusCode]::InternalServerError $Results = @{ error = 'server_error' error_description = "An error occurred: $($_.ErrorDetails.Message ?? $_.Exception.Message)" @@ -114,7 +117,7 @@ function Invoke-ExecDeviceCodeLogon { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Results | ConvertTo-Json Headers = @{'Content-Type' = 'application/json' } }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecTokenExchange.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecTokenExchange.ps1 index 69f952ecf0..e0c759c559 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecTokenExchange.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecTokenExchange.ps1 @@ -12,30 +12,43 @@ function Invoke-ExecTokenExchange { $KV = Get-CippKeyVaultName $APIName = $Request.Params.CIPPEndpoint - try { - if (!$Request.Body) { - Write-LogMessage -API $APIName -message 'Request body is missing' -Sev 'Error' - throw 'Request body is missing' - } + if (!$Request.Body) { + Write-LogMessage -API $APIName -message 'Request body is missing' -Sev 'Error' + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ error = 'invalid_request'; error_description = 'Request body is missing' } + Headers = @{'Content-Type' = 'application/json' } + }) + } - $TokenRequest = $Request.Body.tokenRequest - $TokenUrl = $Request.Body.tokenUrl - $TenantId = $Request.Body.tenantId + $TokenRequest = $Request.Body.tokenRequest + $TokenUrl = $Request.Body.tokenUrl + $TenantId = $Request.Body.tenantId - if (!$TokenRequest -or !$TokenUrl) { - Write-LogMessage -API $APIName -message 'Missing required parameters: tokenRequest or tokenUrl' -Sev 'Error' - throw 'Missing required parameters: tokenRequest or tokenUrl' - } + if (!$TokenRequest -or !$TokenUrl) { + Write-LogMessage -API $APIName -message 'Missing required parameters: tokenRequest or tokenUrl' -Sev 'Error' + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ error = 'invalid_request'; error_description = 'Missing required parameters: tokenRequest or tokenUrl' } + Headers = @{'Content-Type' = 'application/json' } + }) + } - $ParsedTokenUri = $null - $IsValidTokenUri = [System.Uri]::TryCreate($TokenUrl, [System.UriKind]::Absolute, [ref]$ParsedTokenUri) - if (-not $IsValidTokenUri -or - -not $ParsedTokenUri.Scheme.Equals('https', [System.StringComparison]::OrdinalIgnoreCase) -or - -not $ParsedTokenUri.Host.Equals('login.microsoftonline.com', [System.StringComparison]::OrdinalIgnoreCase)) { - Write-LogMessage -API $APIName -message "Blocked token request to non-Microsoft login host: $TokenUrl" -Sev 'Warning' - throw 'Invalid tokenUrl. Only https://login.microsoftonline.com is allowed.' - } + $ParsedTokenUri = $null + $IsValidTokenUri = [System.Uri]::TryCreate($TokenUrl, [System.UriKind]::Absolute, [ref]$ParsedTokenUri) + if (-not $IsValidTokenUri -or + -not $ParsedTokenUri.Scheme.Equals('https', [System.StringComparison]::OrdinalIgnoreCase) -or + -not $ParsedTokenUri.Host.Equals('login.microsoftonline.com', [System.StringComparison]::OrdinalIgnoreCase)) { + Write-LogMessage -API $APIName -message "Blocked token request to non-Microsoft login host: $TokenUrl" -Sev 'Warning' + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ error = 'invalid_request'; error_description = 'Invalid tokenUrl. Only https://login.microsoftonline.com is allowed.' } + Headers = @{'Content-Type' = 'application/json' } + }) + } + $StatusCode = [HttpStatusCode]::OK + try { Write-LogMessage -API $APIName -message "Making token request to $TokenUrl" -Sev 'Info' # Make sure we get the latest authentication (also refreshes $env:CertificateAuthMode) @@ -72,7 +85,13 @@ function Invoke-ExecTokenExchange { if ($UseCertAssertion) { $AppId = $FormData['client_id'] - if (!$AppId) { throw 'Token request is missing client_id; cannot build a certificate assertion.' } + if (!$AppId) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ error = 'invalid_request'; error_description = 'Token request is missing client_id; cannot build a certificate assertion.' } + Headers = @{'Content-Type' = 'application/json' } + }) + } $SAMCert = Get-CIPPSAMCertificate -SkipCache if (-not $SAMCert) { throw 'Certificate authentication is required but no SAM certificate is available. Complete the application step first, then retry.' @@ -103,23 +122,20 @@ function Invoke-ExecTokenExchange { break } } catch { + $StatusCode = [HttpStatusCode]::InternalServerError $ErrorMessage = $_.Exception $Results = @{ error = 'server_error' error_description = "Token exchange failed: $ErrorMessage" } } - if ($Results.error) { - return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest - Body = $Results - Headers = @{'Content-Type' = 'application/json' } - }) - } else { - return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK - Body = $Results - Headers = @{'Content-Type' = 'application/json' } - }) + if ($Results.error -and $StatusCode -eq [HttpStatusCode]::OK) { + # The token endpoint's own OAuth error (invalid_grant and the like) is passed through as a client error + $StatusCode = [HttpStatusCode]::BadRequest } + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Results + Headers = @{'Content-Type' = 'application/json' } + }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecUpdateRefreshToken.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecUpdateRefreshToken.ps1 index feaebb1d7e..13ff3fa00a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecUpdateRefreshToken.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecUpdateRefreshToken.ps1 @@ -109,7 +109,7 @@ function Invoke-ExecUpdateRefreshToken { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = [HttpStatusCode]::InternalServerError Body = $Results }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Dynamics/Invoke-ListDynamicsBusinessUnits.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Dynamics/Invoke-ListDynamicsBusinessUnits.ps1 new file mode 100644 index 0000000000..526fce2616 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Dynamics/Invoke-ListDynamicsBusinessUnits.ps1 @@ -0,0 +1,62 @@ +function Invoke-ListDynamicsBusinessUnits { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Dynamics.BusinessUnit.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $TenantFilter = $Request.Query.TenantFilter + $DynamicsUrl = $Request.Query.DynamicsUrl + + try { + $APIName = $Request.Params.CIPPEndpoint + Write-LogMessage -headers $Request.Headers -API $APIName -message 'Accessed this API' -Sev 'Debug' + + if ([string]::IsNullOrEmpty($DynamicsUrl)) { + throw 'DynamicsUrl query parameter is required. Select an environment first.' + } + + $Select = 'name,businessunitid,isdisabled,createdon,modifiedon,websiteurl,divisionname,emailaddress,address1_city,address1_stateorprovince,address1_country' + $Expand = 'parentbusinessunitid($select=name,businessunitid)' + $OrderBy = 'name asc' + + $BusinessUnits = New-DynamicsRequest -DynamicsUrl $DynamicsUrl -Entity 'businessunits' ` + -TenantFilter $TenantFilter -Select $Select -Expand $Expand -OrderBy $OrderBy -NoAuthCheck $false + + $Results = @($BusinessUnits | ForEach-Object { + $bu = $_ + [PSCustomObject]@{ + businessunitid = $bu.businessunitid + name = $bu.name + isdisabled = $bu.isdisabled + parentName = if ($bu.parentbusinessunitid) { $bu.parentbusinessunitid.name } else { '(Root)' } + parentId = if ($bu.parentbusinessunitid) { $bu.parentbusinessunitid.businessunitid } else { '' } + divisionname = $bu.divisionname + emailaddress = $bu.emailaddress + websiteurl = $bu.websiteurl + city = $bu.address1_city + stateOrProvince = $bu.address1_stateorprovince + country = $bu.address1_country + createdon = $bu.createdon + modifiedon = $bu.modifiedon + isRoot = if ($null -eq $bu.parentbusinessunitid) { $true } else { $false } + } + }) + + $StatusCode = [HttpStatusCode]::OK + $Body = @{ Results = $Results } + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -headers $Request.Headers -API $APIName -message "Failed to list Dynamics business units: $ErrorMessage" -Sev 'Error' -tenant $TenantFilter + $StatusCode = [HttpStatusCode]::Forbidden + $Body = @{ Results = @(); Error = $ErrorMessage } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Dynamics/Invoke-ListDynamicsEnvironments.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Dynamics/Invoke-ListDynamicsEnvironments.ps1 new file mode 100644 index 0000000000..85ae500635 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Dynamics/Invoke-ListDynamicsEnvironments.ps1 @@ -0,0 +1,87 @@ +function Invoke-ListDynamicsEnvironments { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Dynamics.Environment.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $TenantFilter = $Request.Query.TenantFilter + + try { + $APIName = $Request.Params.CIPPEndpoint + Write-LogMessage -headers $Request.Headers -API $APIName -message 'Accessed this API' -Sev 'Debug' + + # Power Platform BAP API requires tokens for the Power Apps Service (475226c6-020e-4fb2-8a90-7a972cbfc1d4) + # with audience https://service.powerapps.com/ — NOT https://api.bap.microsoft.com + $Scope = 'https://service.powerapps.com//.default' + $Token = Get-GraphToken -Tenantid $TenantFilter -scope $Scope + + $Headers = @{ + Authorization = $Token.Authorization + 'User-Agent' = "CIPP/$($global:CippVersion ?? '1.0')" + } + + $Uri = 'https://api.bap.microsoft.com/providers/Microsoft.BusinessAppPlatform/scopes/admin/environments?api-version=2020-10-01&$expand=properties.capacity,properties.addons' + + $Response = Invoke-RestMethod -Uri $Uri -Headers $Headers -Method GET -ContentType 'application/json' + + $Environments = @($Response.value | ForEach-Object { + $env = $_ + $props = $env.properties + [PSCustomObject]@{ + id = $env.id + name = $env.name + displayName = $props.displayName + environmentType = $props.environmentType + state = $props.states.management.id + region = $props.azureRegion + url = if ($props.linkedEnvironmentMetadata.instanceUrl) { $props.linkedEnvironmentMetadata.instanceUrl } else { '' } + apiUrl = if ($props.linkedEnvironmentMetadata.instanceApiUrl) { $props.linkedEnvironmentMetadata.instanceApiUrl } else { '' } + domainName = if ($props.linkedEnvironmentMetadata.domainName) { $props.linkedEnvironmentMetadata.domainName } else { '' } + version = if ($props.linkedEnvironmentMetadata.version) { $props.linkedEnvironmentMetadata.version } else { '' } + securityGroupId = if ($props.linkedEnvironmentMetadata.securityGroupId) { $props.linkedEnvironmentMetadata.securityGroupId } else { '' } + orgId = if ($props.linkedEnvironmentMetadata.resourceId) { $props.linkedEnvironmentMetadata.resourceId } else { '' } + createdTime = $props.createdTime + lastModifiedTime = if ($props.lastModifiedTime) { $props.lastModifiedTime } else { '' } + capacityUsed = if ($props.capacity) { $props.capacity } else { $null } + isDefault = if ($props.isDefault) { $props.isDefault } else { $false } + } + }) + + $StatusCode = [HttpStatusCode]::OK + $Body = @{ Results = $Environments } + } catch { + $RawError = $_.Exception.Message + $ErrorMessage = Get-NormalizedError -Message $RawError + if ([string]::IsNullOrWhiteSpace($ErrorMessage)) { + $ErrorMessage = $RawError + } + + if ($RawError -like '*AADSTS65001*') { + $ErrorMessage = @( + "Power Apps Service consent error for tenant $TenantFilter (AADSTS65001)." + 'The delegated permission ''User'' for Power Apps Service (475226c6-020e-4fb2-8a90-7a972cbfc1d4) is required to access the Power Platform admin API.' + 'Remediation steps:' + '1) Run CPV Refresh for this tenant - ensure the results show successful consent for ''Power Apps Service''' + '2) Verify the GDAP relationship includes Power Platform Administrator or Dynamics 365 Administrator role' + '3) Verify the tenant has active Power Platform or Dynamics 365 licenses' + '4) If the issue persists, check Azure AD > Enterprise Applications in the client tenant for the CIPP app and confirm Power Apps Service delegated consent is listed' + ) -join ' ' + } elseif ($ErrorMessage -like '*AADSTS*' -or $ErrorMessage -like '*Could not get token*') { + $ErrorMessage = "Failed to acquire Power Apps Service token for $TenantFilter. $ErrorMessage. Ensure the GDAP relationship includes the Power Platform Administrator or Dynamics 365 Administrator role." + } elseif ($ErrorMessage -like '*Forbidden*' -or $ErrorMessage -like '*403*' -or $ErrorMessage -like '*Unauthorized*' -or $ErrorMessage -like '*401*') { + $ErrorMessage = "Access denied to Power Platform Admin API for $TenantFilter. Verify the tenant has Dynamics 365 / Power Platform licenses and that the GDAP relationship includes the required admin roles." + } + Write-LogMessage -headers $Request.Headers -API $APIName -message "Failed to list Dynamics environments: $ErrorMessage" -Sev 'Error' -tenant $TenantFilter + $StatusCode = [HttpStatusCode]::Forbidden + $Body = @{ Results = @(); Error = $ErrorMessage } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Dynamics/Invoke-ListDynamicsSecurityRoles.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Dynamics/Invoke-ListDynamicsSecurityRoles.ps1 new file mode 100644 index 0000000000..ed4ed82ca4 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Dynamics/Invoke-ListDynamicsSecurityRoles.ps1 @@ -0,0 +1,58 @@ +function Invoke-ListDynamicsSecurityRoles { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Dynamics.SecurityRole.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $TenantFilter = $Request.Query.TenantFilter + $DynamicsUrl = $Request.Query.DynamicsUrl + + try { + $APIName = $Request.Params.CIPPEndpoint + Write-LogMessage -headers $Request.Headers -API $APIName -message 'Accessed this API' -Sev 'Debug' + + if ([string]::IsNullOrEmpty($DynamicsUrl)) { + throw 'DynamicsUrl query parameter is required. Select an environment first.' + } + + $Select = 'name,roleid,ismanaged,createdon,modifiedon,isinherited,canbedeleted' + $Expand = 'businessunitid($select=name,businessunitid)' + $OrderBy = 'name asc' + + $Roles = New-DynamicsRequest -DynamicsUrl $DynamicsUrl -Entity 'roles' ` + -TenantFilter $TenantFilter -Select $Select -Expand $Expand -OrderBy $OrderBy -NoAuthCheck $false + + $Results = @($Roles | ForEach-Object { + $role = $_ + [PSCustomObject]@{ + roleid = $role.roleid + name = $role.name + ismanaged = $role.ismanaged + isinherited = $role.isinherited + canbedeleted = if ($role.canbedeleted) { $role.canbedeleted.Value } else { $true } + businessUnit = if ($role.businessunitid) { $role.businessunitid.name } else { '' } + businessUnitId = if ($role.businessunitid) { $role.businessunitid.businessunitid } else { '' } + createdon = $role.createdon + modifiedon = $role.modifiedon + roleType = if ($role.ismanaged) { 'Managed' } else { 'Custom' } + } + }) + + $StatusCode = [HttpStatusCode]::OK + $Body = @{ Results = $Results } + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -headers $Request.Headers -API $APIName -message "Failed to list Dynamics security roles: $ErrorMessage" -Sev 'Error' -tenant $TenantFilter + $StatusCode = [HttpStatusCode]::Forbidden + $Body = @{ Results = @(); Error = $ErrorMessage } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Dynamics/Invoke-ListDynamicsSolutions.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Dynamics/Invoke-ListDynamicsSolutions.ps1 new file mode 100644 index 0000000000..9771949f18 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Dynamics/Invoke-ListDynamicsSolutions.ps1 @@ -0,0 +1,61 @@ +function Invoke-ListDynamicsSolutions { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Dynamics.Solution.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $TenantFilter = $Request.Query.TenantFilter + $DynamicsUrl = $Request.Query.DynamicsUrl + + try { + $APIName = $Request.Params.CIPPEndpoint + Write-LogMessage -headers $Request.Headers -API $APIName -message 'Accessed this API' -Sev 'Debug' + + if ([string]::IsNullOrEmpty($DynamicsUrl)) { + throw 'DynamicsUrl query parameter is required. Select an environment first.' + } + + $Select = 'friendlyname,uniquename,version,ismanaged,isvisible,installedon,modifiedon,createdon,description' + $Expand = 'publisherid($select=friendlyname,uniquename)' + $Filter = 'isvisible eq true' + $OrderBy = 'friendlyname asc' + + $Solutions = New-DynamicsRequest -DynamicsUrl $DynamicsUrl -Entity 'solutions' ` + -TenantFilter $TenantFilter -Select $Select -Expand $Expand -Filter $Filter -OrderBy $OrderBy -NoAuthCheck $false + + $Results = @($Solutions | ForEach-Object { + $sol = $_ + [PSCustomObject]@{ + solutionid = $sol.solutionid + friendlyname = $sol.friendlyname + uniquename = $sol.uniquename + version = $sol.version + ismanaged = $sol.ismanaged + publisher = if ($sol.publisherid) { $sol.publisherid.friendlyname } else { '' } + publisherUnique = if ($sol.publisherid) { $sol.publisherid.uniquename } else { '' } + description = $sol.description + installedon = $sol.installedon + createdon = $sol.createdon + modifiedon = $sol.modifiedon + solutionType = if ($sol.ismanaged) { 'Managed' } else { 'Unmanaged' } + } + }) + + $StatusCode = [HttpStatusCode]::OK + $Body = @{ Results = $Results } + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -headers $Request.Headers -API $APIName -message "Failed to list Dynamics solutions: $ErrorMessage" -Sev 'Error' -tenant $TenantFilter + $StatusCode = [HttpStatusCode]::Forbidden + $Body = @{ Results = @(); Error = $ErrorMessage } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Dynamics/Invoke-ListDynamicsUsers.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Dynamics/Invoke-ListDynamicsUsers.ps1 new file mode 100644 index 0000000000..7d696fd6ee --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Dynamics/Invoke-ListDynamicsUsers.ps1 @@ -0,0 +1,77 @@ +function Invoke-ListDynamicsUsers { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Dynamics.User.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $TenantFilter = $Request.Query.TenantFilter + $DynamicsUrl = $Request.Query.DynamicsUrl + + try { + $APIName = $Request.Params.CIPPEndpoint + Write-LogMessage -headers $Request.Headers -API $APIName -message 'Accessed this API' -Sev 'Debug' + + if ([string]::IsNullOrEmpty($DynamicsUrl)) { + throw 'DynamicsUrl query parameter is required. Select an environment first.' + } + + $Select = 'fullname,domainname,internalemailaddress,isdisabled,accessmode,createdon,modifiedon,azureactivedirectoryobjectid,applicationid,title,address1_telephone1' + $Expand = 'systemuserroles_association($select=name,roleid),businessunitid($select=name,businessunitid)' + $Filter = "isdisabled eq false and accessmode ne 3 and accessmode ne 5" + + $Users = New-DynamicsRequest -DynamicsUrl $DynamicsUrl -Entity 'systemusers' ` + -TenantFilter $TenantFilter -Select $Select -Expand $Expand -Filter $Filter -NoAuthCheck $false + + $Results = @($Users | ForEach-Object { + $user = $_ + [PSCustomObject]@{ + systemuserid = $user.systemuserid + fullname = $user.fullname + domainname = $user.domainname + email = $user.internalemailaddress + isdisabled = $user.isdisabled + accessmode = switch ($user.accessmode) { + 0 { 'Read-Write' } + 1 { 'Administrative' } + 2 { 'Read' } + 3 { 'Support User' } + 4 { 'Non-Interactive' } + 5 { 'Delegated Admin' } + default { "Unknown ($($user.accessmode))" } + } + accessmodeRaw = $user.accessmode + businessUnit = if ($user.businessunitid) { $user.businessunitid.name } else { '' } + businessUnitId = if ($user.businessunitid) { $user.businessunitid.businessunitid } else { '' } + title = $user.title + phone = $user.address1_telephone1 + securityRoles = @($user.systemuserroles_association | ForEach-Object { + [PSCustomObject]@{ + name = $_.name + roleid = $_.roleid + } + }) + securityRoleList = ($user.systemuserroles_association | ForEach-Object { $_.name }) -join ', ' + createdon = $user.createdon + modifiedon = $user.modifiedon + azureAdObjectId = $user.azureactivedirectoryobjectid + } + }) + + $StatusCode = [HttpStatusCode]::OK + $Body = @{ Results = $Results } + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -headers $Request.Headers -API $APIName -message "Failed to list Dynamics users: $ErrorMessage" -Sev 'Error' -tenant $TenantFilter + $StatusCode = [HttpStatusCode]::Forbidden + $Body = @{ Results = @(); Error = $ErrorMessage } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-AddContactTemplates.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-AddContactTemplates.ps1 index afdc1d1b1d..8ca952f808 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-AddContactTemplates.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-AddContactTemplates.ps1 @@ -55,7 +55,7 @@ Function Invoke-AddContactTemplates { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -Headers $Headers -API $APINAME -message "Failed to create Contact template: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage $body = [pscustomobject]@{'Results' = "Failed to create Contact template: $($ErrorMessage.NormalizedError)" } - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-DeployContactTemplates.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-DeployContactTemplates.ps1 index b0fef46051..291de77f26 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-DeployContactTemplates.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-DeployContactTemplates.ps1 @@ -50,13 +50,20 @@ Function Invoke-DeployContactTemplates { } } } else { - throw "TemplateList is required and must contain at least one template" + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{Results = 'TemplateList is required and must contain at least one template' } + }) } if ($ContactTemplates.Count -eq 0) { - throw "No valid contact templates found to deploy" + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{Results = 'No valid contact templates found to deploy' } + }) } + $Failed = 0 $Results = foreach ($TenantFilter in $SelectedTenants) { foreach ($ContactTemplate in $ContactTemplates) { try { @@ -155,6 +162,7 @@ Function Invoke-DeployContactTemplates { "Successfully deployed contact '$($ContactTemplate.displayName)' to tenant $TenantFilter" } catch { + $Failed++ $ErrorMessage = Get-CippException -Exception $_ $ErrorDetail = "Failed to deploy contact '$($ContactTemplate.displayName)' to tenant $TenantFilter. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ErrorDetail -Sev 'Error' @@ -165,7 +173,7 @@ Function Invoke-DeployContactTemplates { } } - $StatusCode = [HttpStatusCode]::OK + $StatusCode = Get-CippBulkStatusCode -Total ($SelectedTenants.Count * $ContactTemplates.Count) -Failed $Failed } catch { $ErrorMessage = Get-CippException -Exception $_ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-EditContactTemplates.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-EditContactTemplates.ps1 index 3d914c07bc..a0e0e973fd 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-EditContactTemplates.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-EditContactTemplates.ps1 @@ -12,14 +12,17 @@ function Invoke-EditContactTemplates { Write-LogMessage -Headers $Headers -API $APINAME -message 'Accessed this API' -Sev Debug Write-Host ($request | ConvertTo-Json -Depth 10 -Compress) - try { - # Get the ContactTemplateID from the request body - $ContactTemplateID = $Request.body.ContactTemplateID + # Get the ContactTemplateID from the request body + $ContactTemplateID = $Request.body.ContactTemplateID - if (-not $ContactTemplateID) { - throw 'ContactTemplateID is required for editing a template' - } + if (-not $ContactTemplateID) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = [pscustomobject]@{'Results' = 'Failed to update Contact template: ContactTemplateID is required for editing a template' } + }) + } + try { # Check if the template exists $Table = Get-CippTable -tablename 'templates' $SafeContactTemplateID = ConvertTo-CIPPODataFilterValue -Value $ContactTemplateID -Type Guid @@ -27,7 +30,10 @@ function Invoke-EditContactTemplates { $ExistingTemplate = Get-CIPPAzDataTableEntity @Table -Filter $Filter if (-not $ExistingTemplate) { - throw "Contact template with ID $ContactTemplateID not found" + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = [pscustomobject]@{'Results' = "Failed to update Contact template: Contact template with ID $ContactTemplateID not found" } + }) } Write-LogMessage -Headers $Headers -API $APINAME -message "Updating Contact Template with ID: $ContactTemplateID" -Sev Info @@ -72,7 +78,7 @@ function Invoke-EditContactTemplates { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -Headers $Headers -API $APINAME -message "Failed to update Contact template: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage $body = [pscustomobject]@{'Results' = "Failed to update Contact template: $($ErrorMessage.NormalizedError)" } - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-RemoveContact.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-RemoveContact.ps1 index 89ea2f79e8..020ddd898d 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-RemoveContact.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-RemoveContact.ps1 @@ -28,7 +28,7 @@ Function Invoke-RemoveContact { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to delete contact $GUID. $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Result -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } $Results = [pscustomobject]@{'Results' = $Result } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-RemoveContactTemplates.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-RemoveContactTemplates.ps1 index cbcafcaa7d..681cc90bae 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-RemoveContactTemplates.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Contacts/Invoke-RemoveContactTemplates.ps1 @@ -14,10 +14,24 @@ function Invoke-RemoveContactTemplates { $ID = $Request.Query.ID ?? $Request.Body.ID try { - $Table = Get-CippTable -tablename 'templates' $SafeID = ConvertTo-CIPPODataFilterValue -Value $ID -Type Guid + } catch { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Failed to remove Contact template: '$ID' is not a valid template ID." } + }) + } + + try { + $Table = Get-CippTable -tablename 'templates' $Filter = "PartitionKey eq 'ContactTemplate' and RowKey eq '$SafeID'" $ClearRow = Get-CIPPAzDataTableEntity @Table -Filter $Filter -Property PartitionKey, RowKey + if (-not $ClearRow) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = @{ Results = "Contact template with ID $ID not found." } + }) + } Remove-CIPPAzDataTableEntity -Force @Table -Entity $ClearRow $Result = "Removed Contact Template with ID $ID." Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev 'Info' @@ -26,7 +40,7 @@ function Invoke-RemoveContactTemplates { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to remove Contact template with ID $ID. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-AddSharedMailbox.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-AddSharedMailbox.ps1 index e0ca3dba57..fee25675d0 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-AddSharedMailbox.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-AddSharedMailbox.ps1 @@ -16,6 +16,7 @@ function Invoke-AddSharedMailbox { $MailboxObject = $Request.Body $Tenant = $MailboxObject.tenantID $Aliases = $MailboxObject.addedAliases -split '\n' + $Failed = 0 try { @@ -35,6 +36,7 @@ function Invoke-AddSharedMailbox { $null = Set-CIPPSignInState -userid $AddSharedRequest.ExternalDirectoryObjectId -TenantFilter $Tenant -APIName $APIName -Headers $Headers -AccountEnabled $false $Results.Add("Blocked sign-in for shared mailbox $Email") } catch { + $Failed++ $ErrorMessage = Get-CippException -Exception $_ $Message = "Failed to block sign-in for shared mailbox $Email Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $Tenant -message $Message -Sev 'Error' -LogData $ErrorMessage @@ -55,19 +57,20 @@ function Invoke-AddSharedMailbox { $Results.Add($Message) } catch { + $Failed++ $ErrorMessage = Get-CippException -Exception $_ $Message = "Failed to add aliases to $Email : $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $Tenant -message $Message -Sev 'Error' -LogData $ErrorMessage $Results.Add($Message) } } - $StatusCode = [HttpStatusCode]::OK + $StatusCode = $Failed ? [HttpStatusCode]::MultiStatus : [HttpStatusCode]::OK } catch { $ErrorMessage = Get-CippException -Exception $_ $Message = "Failed to create shared mailbox. $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $Tenant -message $Message -Sev 'Error' -LogData $ErrorMessage $Results.Add($Message) - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecConvertMailbox.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecConvertMailbox.ps1 index aebb4fc6f1..52f840ee8d 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecConvertMailbox.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecConvertMailbox.ps1 @@ -21,7 +21,7 @@ Function Invoke-ExecConvertMailbox { $Results = Set-CIPPMailboxType -UserID $UserID -TenantFilter $TenantFilter -APIName $APIName -Headers $Headers -MailboxType $MailboxType $StatusCode = [HttpStatusCode]::OK } catch { - $Results = $_.Exception.Message + $Results = "Failed to convert mailbox: $((Get-CippException -Exception $_).NormalizedError)" $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecCopyForSent.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecCopyForSent.ps1 index e676500b27..d925f857b0 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecCopyForSent.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecCopyForSent.ps1 @@ -30,7 +30,7 @@ function Invoke-ExecCopyForSent { $Result = Set-CIPPMessageCopy @params $StatusCode = [HttpStatusCode]::OK } catch { - $Result = "$($_.Exception.Message)" + $Result = "Failed to update Copy For Sent setting: $((Get-CippException -Exception $_).NormalizedError)" $StatusCode = [HttpStatusCode]::InternalServerError } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecEditCalendarPermissions.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecEditCalendarPermissions.ps1 index e5e28ebe9b..99dd3b830f 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecEditCalendarPermissions.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecEditCalendarPermissions.ps1 @@ -27,8 +27,8 @@ function Invoke-ExecEditCalendarPermissions { } $StatusCode = [HttpStatusCode]::OK } catch { - $Result = $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $Result = "Failed to update calendar permissions: $((Get-CippException -Exception $_).NormalizedError)" + $StatusCode = [HttpStatusCode]::InternalServerError Write-Warning "Error in ExecEditCalendarPermissions: $($_.Exception.Message)" Write-Information $_.InvocationInfo.PositionMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecEmailForward.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecEmailForward.ps1 index fabdc71901..21cffde0bb 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecEmailForward.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecEmailForward.ps1 @@ -33,7 +33,7 @@ Function Invoke-ExecEmailForward { $Results = Set-CIPPForwarding -UserID $Username -TenantFilter $TenantFilter -APIName $APIName -Headers $Headers -Forward $ForwardingAddress -KeepCopy $KeepCopy $StatusCode = [HttpStatusCode]::OK } catch { - $Results = $_.Exception.Message + $Results = "Failed to set internal forwarding: $((Get-CippException -Exception $_).NormalizedError)" $StatusCode = [HttpStatusCode]::InternalServerError } } @@ -43,7 +43,7 @@ Function Invoke-ExecEmailForward { $Results = Set-CIPPForwarding -UserID $Username -TenantFilter $TenantFilter -APIName $APIName -Headers $Headers -ForwardingSMTPAddress $ForwardingSMTPAddress -KeepCopy $KeepCopy $StatusCode = [HttpStatusCode]::OK } catch { - $Results = $_.Exception.Message + $Results = "Failed to set external forwarding: $((Get-CippException -Exception $_).NormalizedError)" $StatusCode = [HttpStatusCode]::InternalServerError } } @@ -53,7 +53,7 @@ Function Invoke-ExecEmailForward { $Results = Set-CIPPForwarding -UserID $Username -Username $Username -TenantFilter $TenantFilter -Headers $Headers -APIName $APIName -Disable $true $StatusCode = [HttpStatusCode]::OK } catch { - $Results = $_.Exception.Message + $Results = "Failed to disable forwarding: $((Get-CippException -Exception $_).NormalizedError)" $StatusCode = [HttpStatusCode]::InternalServerError } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecEnableArchive.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecEnableArchive.ps1 index 56300ffe05..781b1a82fa 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecEnableArchive.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecEnableArchive.ps1 @@ -22,7 +22,7 @@ Function Invoke-ExecEnableArchive { if ($ResultsArch -like 'Failed to set archive*') { throw $ResultsArch } $StatusCode = [HttpStatusCode]::OK } catch { - $ResultsArch = $_.Exception.Message + $ResultsArch = "Failed to enable archive: $((Get-CippException -Exception $_).NormalizedError)" $StatusCode = [HttpStatusCode]::InternalServerError } $Results = [pscustomobject]@{'Results' = "$ResultsArch" } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecEnableAutoExpandingArchive.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecEnableAutoExpandingArchive.ps1 index 2b4ddcafb5..f49ae34f63 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecEnableAutoExpandingArchive.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecEnableAutoExpandingArchive.ps1 @@ -19,7 +19,7 @@ function Invoke-ExecEnableAutoExpandingArchive { $Result = Set-CIPPMailboxArchive -TenantFilter $TenantFilter -UserID $ID -Username $Username -Headers $Headers -AutoExpandingArchive $StatusCode = [HttpStatusCode]::OK } catch { - $Result = $_.Exception.Message + $Result = "Failed to enable auto-expanding archive: $((Get-CippException -Exception $_).NormalizedError)" $StatusCode = [HttpStatusCode]::InternalServerError } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecGroupsDelete.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecGroupsDelete.ps1 index fd968c8055..9295d4dfac 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecGroupsDelete.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecGroupsDelete.ps1 @@ -22,7 +22,7 @@ Function Invoke-ExecGroupsDelete { $Result = Remove-CIPPGroup -ID $ID -GroupType $GroupType -TenantFilter $TenantFilter -DisplayName $DisplayName -APIName $APIName -Headers $Headers $StatusCode = [HttpStatusCode]::OK } catch { - $Result = "$($_.Exception.Message)" + $Result = "Failed to delete group: $((Get-CippException -Exception $_).NormalizedError)" $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecGroupsDeliveryManagement.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecGroupsDeliveryManagement.ps1 index 2427fce994..16ff5d3cdc 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecGroupsDeliveryManagement.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecGroupsDeliveryManagement.ps1 @@ -22,7 +22,7 @@ Function Invoke-ExecGroupsDeliveryManagement { $Result = Set-CIPPGroupAuthentication -ID $ID -GroupType $GroupType -OnlyAllowInternal $OnlyAllowInternal -tenantFilter $TenantFilter -APIName $APIName -Headers $Headers $StatusCode = [HttpStatusCode]::OK } catch { - $Result = "$($_.Exception.Message)" + $Result = "Failed to update group delivery management: $((Get-CippException -Exception $_).NormalizedError)" $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecGroupsHideFromGAL.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecGroupsHideFromGAL.ps1 index 147474eb40..4cff9c140c 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecGroupsHideFromGAL.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecGroupsHideFromGAL.ps1 @@ -22,7 +22,7 @@ Function Invoke-ExecGroupsHideFromGAL { $Result = Set-CIPPGroupGAL -Id $GroupID -TenantFilter $TenantFilter -GroupType $GroupType -HiddenString $HideFromGAL -APIName $APIName -Headers $Headers $StatusCode = [HttpStatusCode]::OK } catch { - $Result = "$($_.Exception.Message)" + $Result = "Failed to update group GAL visibility: $((Get-CippException -Exception $_).NormalizedError)" $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecHVEUser.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecHVEUser.ps1 index 1b10d198c6..2380108bb1 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecHVEUser.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecHVEUser.ps1 @@ -17,14 +17,17 @@ function Invoke-ExecHVEUser { $Tenant = $HVEUserObject.TenantFilter $Action = $HVEUserObject.Action ?? 'Create' + if ($Action -in 'Edit', 'AssignBillingPolicy', 'RemoveBillingPolicy', 'Remove' -and [string]::IsNullOrWhiteSpace($HVEUserObject.Identity)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = @("Identity is required for $Action action") } + }) + } + try { switch ($Action) { 'Edit' { $Identity = $HVEUserObject.Identity - if ([string]::IsNullOrWhiteSpace($Identity)) { - throw 'Identity is required for Edit action' - } - # Set-MailUser supports DisplayName and PrimarySmtpAddress for HVE accounts $MailUserParams = @{ HVEAccount = $true @@ -63,13 +66,12 @@ function Invoke-ExecHVEUser { } 'AssignBillingPolicy' { $Identity = $HVEUserObject.Identity - if ([string]::IsNullOrWhiteSpace($Identity)) { - throw 'Identity is required for AssignBillingPolicy action' - } - $PolicyId = if ($HVEUserObject.BillingPolicyId.value) { $HVEUserObject.BillingPolicyId.value } else { $HVEUserObject.BillingPolicyId } if ([string]::IsNullOrWhiteSpace($PolicyId)) { - throw 'BillingPolicyId is required for AssignBillingPolicy action' + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = @('BillingPolicyId is required for AssignBillingPolicy action') } + }) } New-ExoRequest -tenantid $Tenant -cmdlet 'Set-HVEAccountBillingPolicy' -cmdParams @{ @@ -81,10 +83,6 @@ function Invoke-ExecHVEUser { } 'RemoveBillingPolicy' { $Identity = $HVEUserObject.Identity - if ([string]::IsNullOrWhiteSpace($Identity)) { - throw 'Identity is required for RemoveBillingPolicy action' - } - New-ExoRequest -tenantid $Tenant -cmdlet 'Set-HVEAccountBillingPolicy' -cmdParams @{ Identity = $Identity BillingPolicyId = $null @@ -94,10 +92,6 @@ function Invoke-ExecHVEUser { } 'Remove' { $Identity = $HVEUserObject.Identity - if ([string]::IsNullOrWhiteSpace($Identity)) { - throw 'Identity is required for Remove action' - } - # Get the account details before deleting so we can remove from cache $MailUser = $null try { @@ -209,7 +203,7 @@ function Invoke-ExecHVEUser { $Message = "Failed to $($Action.ToLower()) HVE user: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $Tenant -message $Message -Sev 'Error' -LogData $ErrorMessage $Results.Add($Message) - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecHideFromGAL.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecHideFromGAL.ps1 index 06810da8a3..8fc2830b38 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecHideFromGAL.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecHideFromGAL.ps1 @@ -24,8 +24,8 @@ Function Invoke-ExecHideFromGAL { $StatusCode = [HttpStatusCode]::OK } catch { - $Result = $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $Result = (Get-CippException -Exception $_).NormalizedError + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecMailboxMobileDevices.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecMailboxMobileDevices.ps1 index 50c153b02f..67fa882a92 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecMailboxMobileDevices.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecMailboxMobileDevices.ps1 @@ -21,7 +21,8 @@ Function Invoke-ExecMailboxMobileDevices { $MobileResults = Set-CIPPMobileDevice -UserId $UserId -Guid $Guid -DeviceId $DeviceId -Quarantine $Quarantine -tenantFilter $TenantFilter -APIName $APINAME -Delete $Delete -Headers $Request.Headers $Results = [pscustomobject]@{'Results' = $MobileResults } } catch { - $Results = [pscustomobject]@{'Results' = "Failed $($UserId): $($_.Exception.Message)" } + $Results = [pscustomobject]@{'Results' = "Failed to update mobile device for $($UserId): $((Get-CippException -Exception $_).NormalizedError)" } + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecModifyCalPerms.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecModifyCalPerms.ps1 index e584b3457e..e7c2d58df0 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecModifyCalPerms.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecModifyCalPerms.ps1 @@ -25,6 +25,7 @@ function Invoke-ExecModifyCalPerms { StatusCode = [HttpStatusCode]::BadRequest Body = @{'Results' = @('Username is required') } }) + return } try { @@ -42,6 +43,7 @@ function Invoke-ExecModifyCalPerms { StatusCode = [HttpStatusCode]::NotFound Body = @{'Results' = @("Failed to get user ID: $($ErrorMessage.NormalizedError)") } }) + return } $Results = [System.Collections.Generic.List[string]]::new() @@ -85,11 +87,11 @@ function Invoke-ExecModifyCalPerms { UserID = $UserId folderName = $FolderName UserToGetPermissions = $TargetUser - # TargetUser may be a recipient id, so log the display name the caller saw - LoggingName = $Permission.DisplayName ?? $TargetUser + LoggingName = $TargetUser Permissions = $PermissionLevel CanViewPrivateItems = $CanViewPrivateItems SendNotificationToUser = $SendNotificationToUser + AclUserName = ($Permission.UserAclName ?? $Permission.AclUserName ?? $null) } # Write-Host "Request params: $($Params | ConvertTo-Json)" @@ -98,7 +100,7 @@ function Invoke-ExecModifyCalPerms { $Results.Add($Result) } catch { $HasErrors = $true - $Results.Add("$($_.Exception.Message)") + $Results.Add("$((Get-CippException -Exception $_).NormalizedError)") } } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecModifyContactPerms.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecModifyContactPerms.ps1 index ca5cd0247d..b562704997 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecModifyContactPerms.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecModifyContactPerms.ps1 @@ -87,10 +87,10 @@ function Invoke-ExecModifyContactPerms { UserID = $UserId folderName = $FolderName UserToGetPermissions = $TargetUser - # TargetUser may be a recipient id, so log the display name the caller saw - LoggingName = $Permission.DisplayName ?? $TargetUser + LoggingName = $TargetUser Permissions = $PermissionLevel SendNotificationToUser = $SendNotificationToUser + AclUserName = ($Permission.UserAclName ?? $Permission.AclUserName ?? $null) } # Write-Host "Request params: $($Params | ConvertTo-Json)" @@ -99,7 +99,7 @@ function Invoke-ExecModifyContactPerms { $Results.Add($Result) } catch { $HasErrors = $true - $Results.Add("$($_.Exception.Message)") + $Results.Add("$((Get-CippException -Exception $_).NormalizedError)") } } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecModifyMBPerms.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecModifyMBPerms.ps1 index 3b1d822a3d..d06dee8586 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecModifyMBPerms.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecModifyMBPerms.ps1 @@ -47,6 +47,31 @@ function Invoke-ExecModifyMBPerms { $TenantFilter = $Request.Body.tenantFilter Write-LogMessage -headers $Headers -API $APIName -message "Processing permission changes for $($MailboxRequests.Count) mailboxes" -Sev 'Info' -tenant $TenantFilter + # Manage365: guests and unresolvable-by-email users throw InvalidExternalUserIdException from + # EXO. Retrying with the Entra object ID in place of the email succeeds, so each direct + # execution path funnels through this helper. + function Invoke-ExoRequestWithGuestRetry { + param($Mailbox, $TenantFilter, $CmdletName, $CmdletParams, $TargetUser) + try { + $null = New-ExoRequest -Anchor $Mailbox -tenantid $TenantFilter -cmdlet $CmdletName -cmdParams $CmdletParams + } catch { + $ExoError = Get-CippException -Exception $_ + if ($ExoError.NormalizedError -match 'InvalidExternalUserIdException' -and $TargetUser -match '@') { + $ResolvedUser = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users/$TargetUser" -tenantid $TenantFilter -NoAuthCheck $true + if ($ResolvedUser.id) { + $RetryParams = @{} + $CmdletParams + if ($RetryParams.ContainsKey('user')) { $RetryParams['user'] = $ResolvedUser.id } + if ($RetryParams.ContainsKey('Trustee')) { $RetryParams['Trustee'] = $ResolvedUser.id } + $null = New-ExoRequest -Anchor $Mailbox -tenantid $TenantFilter -cmdlet $CmdletName -cmdParams $RetryParams + } else { + throw + } + } else { + throw + } + } + } + # Build cmdlet array for processing $CmdletArray = [System.Collections.ArrayList]::new() $CmdletMetadataArray = [System.Collections.ArrayList]::new() @@ -201,8 +226,28 @@ function Invoke-ExecModifyMBPerms { if ($result.error) { $ErrorMessage = try { (Get-CippException -Exception $result.error).NormalizedError } catch { $result.error } - $null = $Results.Add("Error processing $($metadata.Permission) for $($metadata.TargetUser) on $($metadata.Mailbox): $ErrorMessage") - Write-LogMessage -headers $Headers -API $APIName -message "Error for operation $operationGuid`: $ErrorMessage" -Sev 'Error' -tenant $TenantFilter + + # Manage365: retry guest/unresolvable users individually with their Entra object ID + $Retried = $false + if ($ErrorMessage -match 'InvalidExternalUserIdException' -and $metadata.TargetUser -match '@') { + try { + $OriginalCmdlet = $CmdletArray | Where-Object { $_.OperationGuid -eq $operationGuid } | Select-Object -First 1 + if ($OriginalCmdlet) { + Invoke-ExoRequestWithGuestRetry -Mailbox $metadata.Mailbox -TenantFilter $TenantFilter -CmdletName $OriginalCmdlet.CmdletInput.CmdletName -CmdletParams $OriginalCmdlet.CmdletInput.Parameters -TargetUser $metadata.TargetUser + $null = $Results.Add($metadata.ExpectedResult) + $null = $SuccessfulOps.Add($metadata) + Write-LogMessage -headers $Headers -API $APIName -message "Retry succeeded for $($metadata.TargetUser) using Entra object ID" -Sev 'Info' -tenant $TenantFilter + $Retried = $true + } + } catch { + Write-LogMessage -headers $Headers -API $APIName -message "Retry also failed for $($metadata.TargetUser): $($_.Exception.Message)" -Sev 'Warning' -tenant $TenantFilter + } + } + + if (-not $Retried) { + $null = $Results.Add("Error processing $($metadata.Permission) for $($metadata.TargetUser) on $($metadata.Mailbox): $ErrorMessage") + Write-LogMessage -headers $Headers -API $APIName -message "Error for operation $operationGuid`: $ErrorMessage" -Sev 'Error' -tenant $TenantFilter + } } else { $null = $Results.Add($metadata.ExpectedResult) $null = $SuccessfulOps.Add($metadata) @@ -240,11 +285,11 @@ function Invoke-ExecModifyMBPerms { $CmdletObj = $CmdletArray[$i] $CmdletMetadata = $CmdletMetadataArray[$i] try { - $null = New-ExoRequest -Anchor $CmdletMetadata.Mailbox -tenantid $TenantFilter -cmdlet $CmdletObj.CmdletInput.CmdletName -cmdParams $CmdletObj.CmdletInput.Parameters + Invoke-ExoRequestWithGuestRetry -Mailbox $CmdletMetadata.Mailbox -TenantFilter $TenantFilter -CmdletName $CmdletObj.CmdletInput.CmdletName -CmdletParams $CmdletObj.CmdletInput.Parameters -TargetUser $CmdletMetadata.TargetUser $null = $Results.Add($CmdletMetadata.ExpectedResult) $null = $SuccessfulOps.Add($CmdletMetadata) } catch { - $null = $Results.Add("Error processing $($CmdletMetadata.Permission) for $($CmdletMetadata.TargetUser) on $($CmdletMetadata.Mailbox): $($_.Exception.Message)") + $null = $Results.Add("Error processing $($CmdletMetadata.Permission) for $($CmdletMetadata.TargetUser) on $($CmdletMetadata.Mailbox): $((Get-CippException -Exception $_).NormalizedError)") } } } @@ -253,13 +298,13 @@ function Invoke-ExecModifyMBPerms { $CmdletObj = $CmdletArray[0] $CmdletMetadata = $CmdletMetadataArray[0] try { - $null = New-ExoRequest -Anchor $CmdletMetadata.Mailbox -tenantid $TenantFilter -cmdlet $CmdletObj.CmdletInput.CmdletName -cmdParams $CmdletObj.CmdletInput.Parameters + Invoke-ExoRequestWithGuestRetry -Mailbox $CmdletMetadata.Mailbox -TenantFilter $TenantFilter -CmdletName $CmdletObj.CmdletInput.CmdletName -CmdletParams $CmdletObj.CmdletInput.Parameters -TargetUser $CmdletMetadata.TargetUser $null = $Results.Add($CmdletMetadata.ExpectedResult) $null = $SuccessfulOps.Add($CmdletMetadata) Write-LogMessage -headers $Headers -API $APIName -message "Executed $($CmdletMetadata.Permission) permission modification" -Sev 'Info' -tenant $TenantFilter } catch { Write-LogMessage -headers $Headers -API $APIName -message "Permission modification failed: $($_.Exception.Message)" -Sev 'Error' -tenant $TenantFilter - $null = $Results.Add("Error processing $($CmdletMetadata.Permission) for $($CmdletMetadata.TargetUser) on $($CmdletMetadata.Mailbox): $($_.Exception.Message)") + $null = $Results.Add("Error processing $($CmdletMetadata.Permission) for $($CmdletMetadata.TargetUser) on $($CmdletMetadata.Mailbox): $((Get-CippException -Exception $_).NormalizedError)") } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecRemoveMailboxRule.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecRemoveMailboxRule.ps1 index 34d6d5fc81..6a37303637 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecRemoveMailboxRule.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecRemoveMailboxRule.ps1 @@ -10,19 +10,21 @@ Function Invoke-ExecRemoveMailboxRule { $APIName = $Request.Params.CIPPEndpoint $Headers = $Request.Headers + Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message 'Accessed this API' -Sev 'Debug' + + # Interact with the query or body of the request $TenantFilter = $Request.Query.TenantFilter ?? $Request.Body.TenantFilter $RuleName = $Request.Query.ruleName ?? $Request.Body.ruleName $RuleId = $Request.Query.ruleId ?? $Request.Body.ruleId $Username = $Request.Query.userPrincipalName ?? $Request.Body.userPrincipalName $MailboxObjectId = $RuleId.Split('\\')[0] - Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message 'Accessed this API' -Sev 'Debug' try { # Remove the rule $Results = Remove-CIPPMailboxRule -username $Username -TenantFilter $TenantFilter -APIName $APIName -Headers $Headers -RuleId $RuleId -RuleName $RuleName -MailboxObjectId $MailboxObjectId $StatusCode = [HttpStatusCode]::OK } catch { - $Results = $_.Exception.Message + $Results = "Failed to remove mailbox rule: $((Get-CippException -Exception $_).NormalizedError)" $StatusCode = [HttpStatusCode]::InternalServerError } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetCASMailbox.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetCASMailbox.ps1 index 953749f66f..b8300131e0 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetCASMailbox.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetCASMailbox.ps1 @@ -13,6 +13,9 @@ function Invoke-ExecSetCASMailbox { $TenantFilter = $Request.Body.tenantFilter $Identity = $Request.Body.Identity + if ([string]::IsNullOrWhiteSpace([string]$Identity)) { + $Identity = $Request.Body.user ?? $Request.Body.User + } $DisplayName = $Request.Body.DisplayName ?? $Identity # The CAS protocols we allow toggling. Note SmtpClientAuthenticationDisabled is inverted: @@ -28,6 +31,20 @@ function Invoke-ExecSetCASMailbox { 'SmtpClientAuthenticationDisabled' ) + # The Exchange card and user actions send a short name plus enable, for example + # protocol=ActiveSync and enable=true. The mailbox CAS report sends the Set-CASMailbox + # parameter names directly. Both shapes are applied below. + $ShortNames = @{ + ActiveSync = 'ActiveSyncEnabled' + IMAP = 'IMAPEnabled' + POP = 'POPEnabled' + EWS = 'EWSEnabled' + MAPI = 'MAPIEnabled' + OWA = 'OWAEnabled' + ECP = 'ECPEnabled' + SMTP = 'SmtpClientAuthenticationDisabled' + } + # Build the cmdlet parameters from any valid protocol values supplied in the body. $CmdParams = @{ Identity = $Identity } foreach ($Protocol in $ValidProtocols) { @@ -36,6 +53,35 @@ function Invoke-ExecSetCASMailbox { } } + $EnableRaw = $Request.Body.enable + if ($null -ne $EnableRaw -and $EnableRaw -isnot [string] -and $null -ne $EnableRaw.value) { + $EnableRaw = $EnableRaw.value + } + if ($null -ne $EnableRaw) { + $Enable = [System.Convert]::ToBoolean($EnableRaw) + $Requested = @() + foreach ($Source in @($Request.Body.protocol, $Request.Body.protocols)) { + if ($null -eq $Source) { continue } + foreach ($Item in @($Source)) { + if ($null -eq $Item) { continue } + $Text = $Item + if ($Item -isnot [string] -and $null -ne $Item.value) { $Text = $Item.value } + foreach ($Part in ([string]$Text -split ',')) { + $Clean = $Part.Trim().TrimStart('!') + if ($Clean) { $Requested += $Clean } + } + } + } + foreach ($Name in $Requested) { + $ParamName = $ShortNames[$Name] + if (-not $ParamName -and $ValidProtocols -contains $Name) { $ParamName = $Name } + if (-not $ParamName -or $CmdParams.ContainsKey($ParamName)) { continue } + $Flag = $Enable + if ($ParamName -eq 'SmtpClientAuthenticationDisabled') { $Flag = -not $Enable } + $CmdParams[$ParamName] = $Flag + } + } + # SMTP client authentication can only be turned off via this endpoint. Drop an enable # attempt (SmtpClientAuthenticationDisabled = $false) but still apply the other protocols. $Warnings = [System.Collections.Generic.List[string]]::new() diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetLitigationHold.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetLitigationHold.ps1 index 6f8e0d3c9a..9797627e1a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetLitigationHold.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetLitigationHold.ps1 @@ -45,7 +45,10 @@ function Invoke-ExecSetLitigationHold { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-CippException -Exception $_ - $Results = "Could not set litigation hold for $UserPrincipalName with Id $Identity to $LitHoldState. Error: $($ErrorMessage.NormalizedError)" + $Results = "Litigation hold update failed for $UserPrincipalName. Error: $($ErrorMessage.NormalizedError)" + if ($ErrorMessage.NormalizedError -match "license doesn't permit|does not permit|LitigationHoldEnabled") { + $Results += ' Eligible licenses include Microsoft 365 Business Premium, Microsoft 365 E3 or E5, Office 365 E3 or E5, Exchange Online Plan 2, and Exchange Online Plan 1 with the Exchange Online Archiving add-on.' + } Write-LogMessage -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage $StatusCode = [HttpStatusCode]::InternalServerError } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxEmailSize.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxEmailSize.ps1 index af7c793389..803325db1f 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxEmailSize.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxEmailSize.ps1 @@ -34,7 +34,7 @@ Function Invoke-ExecSetMailboxEmailSize { $Result = Set-CippMaxEmailSize @Params $StatusCode = [HttpStatusCode]::OK } catch { - $Result = "$($_.Exception.Message)" + $Result = "Failed to update mailbox email size limits: $((Get-CippException -Exception $_).NormalizedError)" $StatusCode = [HttpStatusCode]::InternalServerError } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxLocale.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxLocale.ps1 index d9889ee7c8..e79becdd90 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxLocale.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxLocale.ps1 @@ -21,7 +21,7 @@ Function Invoke-ExecSetMailboxLocale { $Result = Set-CippMailboxLocale -username $User -locale $Locale -tenantFilter $Tenant -APIName $APIName -Headers $Headers $StatusCode = [HttpStatusCode]::OK } catch { - $Result = "$($_.Exception.Message)" + $Result = "Failed to set mailbox locale: $((Get-CippException -Exception $_).NormalizedError)" $StatusCode = [HttpStatusCode]::InternalServerError } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxQuota.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxQuota.ps1 index ecfc9a60de..f0b42f2f5e 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxQuota.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxQuota.ps1 @@ -30,13 +30,13 @@ Function Invoke-ExecSetMailboxQuota { Write-LogMessage -headers $Request.Headers -API $APINAME -message "Changed IssueWarningQuota for $username - $($message)" -Sev 'Info' -tenant $TenantFilter } } catch { - Write-LogMessage -headers $Request.Headers -API $APINAME -message "Could not adjust mailbox quota for $($username)" -Sev 'Error' -tenant $TenantFilter - "Could not adjust mailbox quota for $($username). Error: $($_.Exception.Message)" + Write-LogMessage -headers $Request.Headers -API $APINAME -message "Could not adjust mailbox quota for $($username): $($_.Exception.Message)" -Sev 'Error' -tenant $TenantFilter + "Could not adjust mailbox quota for $($username): $((Get-CippException -Exception $_).NormalizedError)" } $body = [pscustomobject]@{'Results' = @($results) } } catch { - $body = [pscustomobject]@{'Results' = @("Could not adjust mailbox quota: $($_.Exception.message)") } + $body = [pscustomobject]@{'Results' = @("Could not adjust mailbox quota: $((Get-CippException -Exception $_).NormalizedError)") } } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxRestriction.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxRestriction.ps1 new file mode 100644 index 0000000000..93a029b737 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxRestriction.ps1 @@ -0,0 +1,115 @@ +function Invoke-ExecSetMailboxRestriction { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Exchange.Mailbox.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + + $TenantFilter = $Request.Body.tenantFilter + $UserId = $Request.Body.UserId + $Direction = $Request.Body.Direction + $Enable = ($Request.Body.Enable -eq $true) + + if (-not $TenantFilter -or -not $UserId -or -not $Direction) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'tenantFilter, UserId, and Direction are required' } + }) + } + + $TransportRuleName = 'Manage365 - Block External Outbound' + + try { + $ResultMessages = [System.Collections.ArrayList]::new() + + switch ($Direction) { + 'Inbound' { + $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Set-Mailbox' -cmdParams @{ + Identity = $UserId + RequireSenderAuthenticationEnabled = $Enable + } -Anchor $UserId + + if ($Enable) { + $null = $ResultMessages.Add("Blocked external inbound mail for $UserId. External senders will receive a non-delivery report.") + } else { + $null = $ResultMessages.Add("Allowed external inbound mail for $UserId.") + } + } + 'Outbound' { + $AllRules = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-TransportRule' -useSystemMailbox $true + $ExistingRule = $AllRules | Where-Object -Property Identity -EQ $TransportRuleName + + if ($Enable) { + if (-not $ExistingRule) { + $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'New-TransportRule' -cmdParams @{ + Name = $TransportRuleName + From = @($UserId) + SentToScope = 'NotInOrganization' + RejectMessageReasonText = 'This mailbox is restricted from sending to external recipients.' + RejectMessageEnhancedStatusCode = '5.7.1' + Comments = 'Auto-created by Manage365. Blocks external outbound for listed senders.' + } -useSystemMailbox $true + $null = $ResultMessages.Add("Created transport rule and blocked external outbound mail for $UserId.") + } else { + $CurrentFrom = @($ExistingRule.From | ForEach-Object { $_ }) + if ($UserId -notin $CurrentFrom) { + $UpdatedFrom = @($CurrentFrom) + @($UserId) + $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Set-TransportRule' -cmdParams @{ + Identity = $TransportRuleName + From = $UpdatedFrom + } -useSystemMailbox $true + } + $null = $ResultMessages.Add("Blocked external outbound mail for $UserId.") + } + } else { + if ($ExistingRule) { + $CurrentFrom = @($ExistingRule.From | ForEach-Object { $_ }) + $UpdatedFrom = @($CurrentFrom | Where-Object { $_ -ne $UserId }) + + if ($UpdatedFrom.Count -eq 0) { + $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Remove-TransportRule' -cmdParams @{ + Identity = $TransportRuleName + Confirm = $false + } -useSystemMailbox $true + $null = $ResultMessages.Add("Allowed external outbound mail for $UserId. Transport rule removed (no remaining blocked senders).") + } else { + $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Set-TransportRule' -cmdParams @{ + Identity = $TransportRuleName + From = $UpdatedFrom + } -useSystemMailbox $true + $null = $ResultMessages.Add("Allowed external outbound mail for $UserId.") + } + } else { + $null = $ResultMessages.Add("External outbound mail is already allowed for $UserId.") + } + } + } + default { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Direction must be 'Inbound' or 'Outbound'" } + }) + } + } + + $Results = $ResultMessages -join ' ' + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -Sev Info + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Results = "Failed to set mailbox restriction ($Direction) for $UserId. Error: $($ErrorMessage.NormalizedError)" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -Sev Error -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @{ Results = $Results } + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetOoO.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetOoO.ps1 index fbb3b64d7e..d53db7bc88 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetOoO.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetOoO.ps1 @@ -80,8 +80,8 @@ function Invoke-ExecSetOoO { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-CippException -Exception $_ - $Results = "Could not set Out of Office for user: $($Username). Error: $($ErrorMessage.NormalizedError)" - Write-LogMessage -headers $Headers -API $APIName -message $Results -Sev 'Error' -LogData $ErrorMessage + $Results = "Could not set Out of Office for $Username`: $($ErrorMessage.NormalizedError)" + Write-LogMessage -headers $Headers -API $APIName -message "Could not set Out of Office for $Username`: $($ErrorMessage.Message)" -Sev 'Error' -LogData $ErrorMessage $StatusCode = [HttpStatusCode]::InternalServerError } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListCASMailboxes.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListCASMailboxes.ps1 new file mode 100644 index 0000000000..47145bad64 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListCASMailboxes.ps1 @@ -0,0 +1,50 @@ +function Invoke-ListCASMailboxes { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Exchange.Mailbox.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $TenantFilter = $Request.Query.tenantFilter + + try { + $APIName = $Request.Params.CIPPEndpoint + Write-LogMessage -headers $Request.Headers -API $APINAME -message 'Accessed this API' -Sev 'Debug' + + # Keep this endpoint lean for Users page badges: only fields needed for IMAP/POP checks. + $Select = 'PrimarySmtpAddress,ImapEnabled,PopEnabled' + + $ExoRequest = @{ + tenantid = $TenantFilter + cmdlet = 'Get-CASMailbox' + cmdParams = @{ + ResultSize = 'Unlimited' + } + Select = $Select + } + + $CASMailboxes = New-ExoRequest @ExoRequest | + Where-Object { $_.ImapEnabled -or $_.PopEnabled } | + Select-Object ` + @{ Name = 'userPrincipalName'; Expression = { $_.PrimarySmtpAddress } }, + @{ Name = 'ImapEnabled'; Expression = { $_.ImapEnabled } }, + @{ Name = 'PopEnabled'; Expression = { $_.PopEnabled } }, + @{ Name = 'LegacyProtocolsEnabled'; Expression = { $_.ImapEnabled -or $_.PopEnabled } } + + $StatusCode = [HttpStatusCode]::OK + $Body = @{ Results = @($CASMailboxes) } + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -headers $Request.Headers -API $APINAME -message "Failed to get CAS mailboxes: $ErrorMessage" -Sev 'Error' -tenant $TenantFilter + $StatusCode = [HttpStatusCode]::Forbidden + $Body = @{ Results = @(); Error = $ErrorMessage } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListCalendarPermissions.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListCalendarPermissions.ps1 index 1e96c919ce..24cec8d130 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListCalendarPermissions.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListCalendarPermissions.ps1 @@ -1,11 +1,9 @@ -function Invoke-ListCalendarPermissions { +Function Invoke-ListCalendarPermissions { <# .FUNCTIONALITY Entrypoint .ROLE Exchange.Mailbox.Read - .DESCRIPTION - Lists calendar permissions for mailboxes in a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -13,13 +11,12 @@ function Invoke-ListCalendarPermissions { $APIName = $Request.Params.CIPPEndpoint $UserID = $Request.Query.UserID $TenantFilter = $Request.Query.tenantFilter - # Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants. - $UseReportDB = $Request.Query.UseReportDB -eq $true + $UseReportDB = $Request.Query.UseReportDB $ByUser = $Request.Query.ByUser try { # If UseReportDB is specified and no specific UserID, retrieve from report database - if ($UseReportDB -and -not $UserID) { + if ($UseReportDB -eq 'true' -and -not $UserID) { # Call the report function with proper parameters $ReportParams = @{ @@ -42,29 +39,50 @@ function Invoke-ListCalendarPermissions { }) } - # Original live query logic for specific user. - # -Select everywhere: Get-Mailbox alone is 340 properties (~15 KB) and MailboxInfo repeats - # on every permission row. + # Original live query logic for specific user $GetCalParam = @{Identity = $UserID; FolderScope = 'Calendar' } - $CalendarFolders = @(New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-MailboxFolderStatistics' -anchor $UserID -cmdParams $GetCalParam -Select 'Name,FolderType') - # FolderType is an internal enum and stays English whatever the mailbox language, so it - # finds the calendar root where the folder name cannot. - $CalendarFolder = $CalendarFolders | Where-Object { $_.FolderType -eq 'Calendar' } | Select-Object -First 1 - if (-not $CalendarFolder) { $CalendarFolder = $CalendarFolders | Select-Object -First 1 } + $CalendarFolders = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-MailboxFolderStatistics' -anchor $UserID -cmdParams $GetCalParam | Select-Object -ExcludeProperty *data.type* + $CalendarFolder = @($CalendarFolders) | Where-Object { $_.FolderType -eq 'Calendar' } | Select-Object -First 1 + if (-not $CalendarFolder) { + $CalendarFolder = @($CalendarFolders) | Select-Object -First 1 + } $CalParam = @{Identity = "$($UserID):\$($CalendarFolder.name)" } - $MailboxSelect = 'DisplayName,UserPrincipalName,PrimarySmtpAddress,Alias,Identity,Guid,ExchangeGuid,ExternalDirectoryObjectId,RecipientType,RecipientTypeDetails' - $Mailbox = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-Mailbox' -cmdParams @{Identity = $UserID } -Select $MailboxSelect - $Permissions = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-MailboxFolderPermission' -anchor $UserID -cmdParams $CalParam -UseSystemMailbox $true -Select 'Identity,User,AccessRights,FolderName' - # UserId is what the remove action sends back; without it Exchange only has a display name, - # which it cannot resolve when two recipients share one. - $Permissions = Resolve-CIPPFolderPermissionUser -TenantFilter $TenantFilter -FolderIdentity $CalParam.Identity -Permissions $Permissions - $GraphRequest = $Permissions | Select-Object Identity, User, UserId, AccessRights, FolderName, @{ Name = 'MailboxInfo'; Expression = { $Mailbox } } + $Mailbox = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-Mailbox' -cmdParams @{Identity = $UserID } + $RawPermissions = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-MailboxFolderPermission' -anchor $UserID -cmdParams $CalParam -UseSystemMailbox $true + + $ResolveCache = @{} + $GraphRequest = foreach ($Perm in @($RawPermissions)) { + $UserKey = [string]$Perm.User + if (-not $ResolveCache.ContainsKey($UserKey)) { + $ResolveCache[$UserKey] = Resolve-CIPPFolderPermissionUser -User $Perm.User -TenantFilter $TenantFilter + } + $Resolved = $ResolveCache[$UserKey] + + [PSCustomObject]@{ + Identity = $Perm.Identity + User = $Resolved.User ?? $(if ($Perm.User -is [string]) { $Perm.User } else { $Perm.User.DisplayName ?? [string]$Perm.User }) + UserEmail = $Resolved.UserEmail + UserId = $Resolved.UserId + UserAmbiguous = [bool]$Resolved.UserAmbiguous + CandidateEmails = $Resolved.CandidateEmails + UserType = $( + if ($Perm.User -is [psobject] -and ($Perm.User.PSObject.Properties.Name -contains 'UserType')) { + $Ut = $Perm.User.UserType + if ($Ut -is [psobject] -and ($Ut.PSObject.Properties.Name -contains 'Value')) { $Ut.Value } else { [string]$Ut } + } else { $null } + ) + AccessRights = $Perm.AccessRights + FolderName = $Perm.FolderName + FolderIdentity = $CalParam.Identity + MailboxInfo = $Mailbox + } + } Write-LogMessage -API $APIName -tenant $TenantFilter -message "Calendar permissions listed for $($TenantFilter)" -sev Debug $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListContactPermissions.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListContactPermissions.ps1 index bee47059e2..31a0f2a59a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListContactPermissions.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListContactPermissions.ps1 @@ -4,8 +4,6 @@ Function Invoke-ListContactPermissions { Entrypoint .ROLE Exchange.Mailbox.Read - .DESCRIPTION - Lists folder-level permissions on a user's Contacts folder in Exchange Online. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -15,28 +13,42 @@ Function Invoke-ListContactPermissions { $TenantFilter = $Request.Query.tenantFilter try { - # -Select everywhere: the Contacts scope returns eight folders of ~90 properties, Get-Mailbox - # alone is 340, and MailboxInfo repeats on every permission row. $GetContactParam = @{Identity = $UserID; FolderScope = 'Contacts' } - $ContactFolders = @(New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-MailboxFolderStatistics' -anchor $UserID -cmdParams $GetContactParam -Select 'Name,FolderType') - # FolderType is an internal enum and stays English whatever the mailbox language, so it finds - # the contacts root among the seven siblings (QuickContacts, GalContacts, RecipientCache...). - $ContactFolder = $ContactFolders | Where-Object { $_.FolderType -eq 'Contacts' } | Select-Object -First 1 - if (-not $ContactFolder) { $ContactFolder = $ContactFolders | Select-Object -First 1 } + $ContactFolders = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-MailboxFolderStatistics' -anchor $UserID -cmdParams $GetContactParam | Select-Object -ExcludeProperty *data.type* + $ContactFolder = @($ContactFolders) | Where-Object { $_.FolderType -eq 'Contacts' } | Select-Object -First 1 + if (-not $ContactFolder) { + $ContactFolder = @($ContactFolders) | Select-Object -First 1 + } $ContactParam = @{Identity = "$($UserID):\$($ContactFolder.name)" } - $MailboxSelect = 'DisplayName,UserPrincipalName,PrimarySmtpAddress,Alias,Identity,Guid,ExchangeGuid,ExternalDirectoryObjectId,RecipientType,RecipientTypeDetails' - $Mailbox = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-Mailbox' -cmdParams @{Identity = $UserID } -Select $MailboxSelect - $Permissions = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-MailboxFolderPermission' -anchor $UserID -cmdParams $ContactParam -UseSystemMailbox $true -Select 'Identity,User,AccessRights,FolderName' - # UserId is what the remove action sends back; without it Exchange only has a display name, - # which it cannot resolve when two recipients share one. - $Permissions = Resolve-CIPPFolderPermissionUser -TenantFilter $TenantFilter -FolderIdentity $ContactParam.Identity -Permissions $Permissions - $GraphRequest = $Permissions | Select-Object Identity, User, UserId, AccessRights, FolderName, @{ Name = 'MailboxInfo'; Expression = { $Mailbox } } + $Mailbox = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-Mailbox' -cmdParams @{Identity = $UserID } + $RawPermissions = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-MailboxFolderPermission' -anchor $UserID -cmdParams $ContactParam -UseSystemMailbox $true + + $ResolveCache = @{} + $GraphRequest = foreach ($Perm in @($RawPermissions)) { + $UserKey = [string]$Perm.User + if (-not $ResolveCache.ContainsKey($UserKey)) { + $ResolveCache[$UserKey] = Resolve-CIPPFolderPermissionUser -User $Perm.User -TenantFilter $TenantFilter + } + $Resolved = $ResolveCache[$UserKey] + + [PSCustomObject]@{ + Identity = $Perm.Identity + User = $Resolved.User ?? $Perm.User + UserEmail = $Resolved.UserEmail + UserId = $Resolved.UserId + UserAmbiguous = [bool]$Resolved.UserAmbiguous + CandidateEmails = $Resolved.CandidateEmails + AccessRights = $Perm.AccessRights + FolderName = $Perm.FolderName + MailboxInfo = $Mailbox + } + } Write-LogMessage -API $APIName -tenant $TenantFilter -message "Contact permissions listed for $($TenantFilter)" -sev Debug $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListHVEAccounts.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListHVEAccounts.ps1 index c4ce318772..5a3655be2b 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListHVEAccounts.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListHVEAccounts.ps1 @@ -125,7 +125,7 @@ function Invoke-ListHVEAccounts { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxMobileDevices.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxMobileDevices.ps1 index 979f53cc9e..6f596a994d 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxMobileDevices.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxMobileDevices.ps1 @@ -37,7 +37,7 @@ Function Invoke-ListMailboxMobileDevices { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxRules.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxRules.ps1 index 3d87688c3b..80d950b068 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxRules.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxRules.ps1 @@ -4,21 +4,16 @@ function Invoke-ListMailboxRules { Entrypoint .ROLE Exchange.Mailbox.Read - .DESCRIPTION - Lists inbox rules configured on mailboxes in a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants. #> [CmdletBinding()] param($Request, $TriggerMetadata) # Interact with query parameters or the body of the request. $TenantFilter = $Request.Query.tenantFilter - if (-not [string]::IsNullOrEmpty($TenantFilter) -and $TenantFilter -ne 'AllTenants') { - $TenantFilter = ConvertTo-CIPPODataFilterValue -Value $TenantFilter -Type String - } - # Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants. - $UseReportDB = $Request.Query.UseReportDB -eq $true + $UseReportDB = $Request.Query.UseReportDB + try { # If UseReportDB is specified, retrieve from report database - if ($UseReportDB) { + if ($UseReportDB -eq 'true') { try { $GraphRequest = Get-CIPPMailboxRulesReport -TenantFilter $TenantFilter -ErrorAction Stop $StatusCode = [HttpStatusCode]::OK @@ -109,7 +104,7 @@ function Invoke-ListMailboxRules { } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxes.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxes.ps1 index 56202680ad..2692e8f10c 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxes.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxes.ps1 @@ -17,7 +17,7 @@ function Invoke-ListMailboxes { $ManualPagination = $Request.Query.manualPagination -and [System.Convert]::ToBoolean($Request.Query.manualPagination) try { # If UseReportDB is specified, retrieve from report database - if ($UseReportDB) { + if ($UseReportDB -eq 'true') { try { if ($ManualPagination) { # Rows per page, clamped between 250 and 10000. Defaults to 5000. @@ -147,10 +147,11 @@ function Invoke-ListMailboxes { } # This select also exists in ListUserMailboxDetails and should be updated if this is changed here + $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListRestrictedUsers.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListRestrictedUsers.ps1 index 6ba507d77a..f895e6aa45 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListRestrictedUsers.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListRestrictedUsers.ps1 @@ -41,7 +41,7 @@ function Invoke-ListRestrictedUsers { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListSharedMailboxStatistics.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListSharedMailboxStatistics.ps1 index f345f13786..63d8ce3c3c 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListSharedMailboxStatistics.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListSharedMailboxStatistics.ps1 @@ -24,7 +24,7 @@ Function Invoke-ListSharedMailboxStatistics { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListmailboxPermissions.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListmailboxPermissions.ps1 index feb1601741..612cb1fab2 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListmailboxPermissions.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListmailboxPermissions.ps1 @@ -4,22 +4,19 @@ function Invoke-ListmailboxPermissions { Entrypoint .ROLE Exchange.Mailbox.Read - .DESCRIPTION - Lists mailbox permissions (Full Access, Send As, Send on Behalf) for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants. #> [CmdletBinding()] param($Request, $TriggerMetadata) # Interact with query parameters or the body of the request. $TenantFilter = $Request.Query.tenantFilter $UserID = $Request.Query.userId - # Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants. - $UseReportDB = $Request.Query.UseReportDB -eq $true + $UseReportDB = $Request.Query.UseReportDB $ByUser = $Request.Query.ByUser $User = $Request.Query.User try { # If UseReportDB is specified and no specific UserID, retrieve from report database - if ($UseReportDB -and -not $UserID) { + if ($UseReportDB -eq 'true' -and -not $UserID) { # Call the report function with proper parameters $ReportParams = @{ @@ -30,9 +27,7 @@ function Invoke-ListmailboxPermissions { } try { $GraphRequest = Get-CIPPMailboxPermissionReport @ReportParams - if ($User -and $ByUser -eq 'true') { - # Only the user-grouped report has a top-level User property; in the - # mailbox-grouped shape this filter would empty the whole result set. + if ($User) { $GraphRequest = @($GraphRequest | Where-Object { $_.User -eq $User }) } $StatusCode = [HttpStatusCode]::OK @@ -85,7 +80,7 @@ function Invoke-ListmailboxPermissions { } } } - if ($Perm.GrantSendonBehalfTo) { + if ($Perm.GrantSendonBehalfTo -ne $null) { $Perm.GrantSendonBehalfTo | ForEach-Object { [PSCustomObject]@{ User = $_ Permissions = 'SendOnBehalf' @@ -96,7 +91,7 @@ function Invoke-ListmailboxPermissions { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Mailbox Retention/Invoke-ExecManageRetentionPolicies.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Mailbox Retention/Invoke-ExecManageRetentionPolicies.ps1 index 84d209052b..8ea0cc972e 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Mailbox Retention/Invoke-ExecManageRetentionPolicies.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Mailbox Retention/Invoke-ExecManageRetentionPolicies.ps1 @@ -10,6 +10,7 @@ Function Invoke-ExecManageRetentionPolicies { $APIName = $Request.Params.CIPPEndpoint $Results = [System.Collections.Generic.List[string]]::new() + $Succeeded = 0 $TenantFilter = $Request.Query.tenantFilter ?? $Request.body.tenantFilter $CmdletArray = [System.Collections.ArrayList]::new() $CmdletMetadataArray = [System.Collections.ArrayList]::new() @@ -173,6 +174,7 @@ Function Invoke-ExecManageRetentionPolicies { Write-LogMessage -headers $Request.Headers -API $APINAME -message $Message -Sev 'Error' -tenant $TenantFilter $Results.Add($Message) } else { + $Succeeded++ Write-LogMessage -headers $Request.Headers -API $APINAME -message $metadata.ExpectedResult -Sev 'Info' -tenant $TenantFilter $Results.Add($metadata.ExpectedResult) } @@ -187,6 +189,7 @@ Function Invoke-ExecManageRetentionPolicies { try { $null = New-ExoRequest -tenantid $TenantFilter -cmdlet $CmdletObj.CmdletInput.CmdletName -cmdParams $CmdletObj.CmdletInput.Parameters + $Succeeded++ Write-LogMessage -headers $Request.Headers -API $APINAME -message $CmdletMetadata.ExpectedResult -Sev 'Info' -tenant $TenantFilter $Results.Add($CmdletMetadata.ExpectedResult) } catch { @@ -204,6 +207,7 @@ Function Invoke-ExecManageRetentionPolicies { if ($CreatePolicies -or $ModifyPolicies -or $DeletePolicies) { # For any operations, return the results messages $GraphRequest = @($Results) + $StatusCode = Get-CippBulkStatusCode -Total $Results.Count -Failed ($Results.Count - $Succeeded) } else { # For listing, return all policies or specific policy - wrapped in try-catch try { @@ -237,7 +241,7 @@ Function Invoke-ExecManageRetentionPolicies { $Message = "Failed to manage retention policies: $ErrorMessage" Write-LogMessage -headers $Request.Headers -API $APINAME -message $Message -Sev 'Error' -tenant $TenantFilter $Results.Add($Message) - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = @($Results) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Mailbox Retention/Invoke-ExecManageRetentionTags.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Mailbox Retention/Invoke-ExecManageRetentionTags.ps1 index 8cb9c63025..9055857b7e 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Mailbox Retention/Invoke-ExecManageRetentionTags.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Mailbox Retention/Invoke-ExecManageRetentionTags.ps1 @@ -10,6 +10,7 @@ Function Invoke-ExecManageRetentionTags { $APIName = $Request.Params.CIPPEndpoint $Results = [System.Collections.Generic.List[string]]::new() + $Succeeded = 0 $TenantFilter = $Request.Query.tenantFilter ?? $Request.body.tenantFilter $CmdletArray = [System.Collections.ArrayList]::new() $CmdletMetadataArray = [System.Collections.ArrayList]::new() @@ -274,6 +275,7 @@ Function Invoke-ExecManageRetentionTags { Write-LogMessage -headers $Request.Headers -API $APINAME -message $Message -Sev 'Error' -tenant $TenantFilter $Results.Add($Message) } else { + $Succeeded++ Write-LogMessage -headers $Request.Headers -API $APINAME -message $metadata.ExpectedResult -Sev 'Info' -tenant $TenantFilter $Results.Add($metadata.ExpectedResult) } @@ -288,6 +290,7 @@ Function Invoke-ExecManageRetentionTags { try { $null = New-ExoRequest -tenantid $TenantFilter -cmdlet $CmdletObj.CmdletInput.CmdletName -cmdParams $CmdletObj.CmdletInput.Parameters + $Succeeded++ Write-LogMessage -headers $Request.Headers -API $APINAME -message $CmdletMetadata.ExpectedResult -Sev 'Info' -tenant $TenantFilter $Results.Add($CmdletMetadata.ExpectedResult) } catch { @@ -305,6 +308,7 @@ Function Invoke-ExecManageRetentionTags { if ($CreateTags -or $ModifyTags -or $DeleteTags) { # For any operations, return the results messages $GraphRequest = @($Results) + $StatusCode = Get-CippBulkStatusCode -Total $Results.Count -Failed ($Results.Count - $Succeeded) } else { # For listing, return all tags or specific tag - wrapped in try-catch try { @@ -338,7 +342,7 @@ Function Invoke-ExecManageRetentionTags { $Message = "Failed to manage retention tags: $ErrorMessage" Write-LogMessage -headers $Request.Headers -API $APINAME -message $Message -Sev 'Error' -tenant $TenantFilter $Results.Add($Message) - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = @($Results) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Mailbox Retention/Invoke-ExecSetMailboxRetentionPolicies.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Mailbox Retention/Invoke-ExecSetMailboxRetentionPolicies.ps1 index c88b7de077..7621409935 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Mailbox Retention/Invoke-ExecSetMailboxRetentionPolicies.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Mailbox Retention/Invoke-ExecSetMailboxRetentionPolicies.ps1 @@ -10,6 +10,7 @@ Function Invoke-ExecSetMailboxRetentionPolicies { $APIName = $Request.Params.CIPPEndpoint $Results = [System.Collections.Generic.List[string]]::new() + $Succeeded = 0 $TenantFilter = $Request.Query.tenantFilter ?? $Request.body.tenantFilter $CmdletArray = [System.Collections.ArrayList]::new() $CmdletMetadataArray = [System.Collections.ArrayList]::new() @@ -101,6 +102,7 @@ Function Invoke-ExecSetMailboxRetentionPolicies { Write-LogMessage -headers $Request.Headers -API $APINAME -message $Message -Sev 'Error' -tenant $TenantFilter $Results.Add($Message) } else { + $Succeeded++ $Message = "Successfully applied retention policy '$PolicyName' to $($metadata.MailboxIdentity)" Write-LogMessage -headers $Request.Headers -API $APINAME -message $Message -Sev 'Info' -tenant $TenantFilter $Results.Add($Message) @@ -116,6 +118,7 @@ Function Invoke-ExecSetMailboxRetentionPolicies { try { $null = New-ExoRequest -tenantid $TenantFilter -cmdlet $CmdletObj.CmdletInput.CmdletName -cmdParams $CmdletObj.CmdletInput.Parameters + $Succeeded++ $Message = "Successfully applied retention policy '$PolicyName' to $($CmdletMetadata.MailboxIdentity)" Write-LogMessage -headers $Request.Headers -API $APINAME -message $Message -Sev 'Info' -tenant $TenantFilter $Results.Add($Message) @@ -128,14 +131,14 @@ Function Invoke-ExecSetMailboxRetentionPolicies { } } - $StatusCode = [HttpStatusCode]::OK + $StatusCode = Get-CippBulkStatusCode -Total $Results.Count -Failed ($Results.Count - $Succeeded) } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message $Message = "Failed to set mailbox retention policies: $ErrorMessage" Write-LogMessage -headers $Request.Headers -API $APINAME -message $Message -Sev 'Error' -tenant $TenantFilter $Results.Add($Message) - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListActiveSyncDevices.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListActiveSyncDevices.ps1 index 6de5d25d6e..88525777be 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListActiveSyncDevices.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListActiveSyncDevices.ps1 @@ -34,7 +34,7 @@ function Invoke-ListActiveSyncDevices { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListGlobalAddressList.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListGlobalAddressList.ps1 index efdfda67fa..d73fa57581 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListGlobalAddressList.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListGlobalAddressList.ps1 @@ -18,7 +18,7 @@ Function Invoke-ListGlobalAddressList { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-CippException -Exception $_ - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GAL = $ErrorMessage.NormalizedError } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListMailboxCAS.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListMailboxCAS.ps1 index fb34868629..6b4e356c04 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListMailboxCAS.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListMailboxCAS.ps1 @@ -4,23 +4,17 @@ function Invoke-ListMailboxCAS { Entrypoint .ROLE Exchange.Mailbox.Read - .DESCRIPTION - Lists Client Access Settings (CAS) for Exchange Online mailboxes, showing which protocols are enabled (OWA, IMAP, POP, MAPI, EWS, ActiveSync). #> [CmdletBinding()] param($Request, $TriggerMetadata) # Interact with query parameters or the body of the request. $TenantFilter = $Request.Query.TenantFilter try { - # Cased as Exchange returns them. Select-Object matches property names - # case-insensitively but emits the object's own casing, so asking for IMAPEnabled - # still yields ImapEnabled on the wire - and JSON is case-sensitive, so a caller - # keying on the name written here would find nothing. - $GraphRequest = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-CasMailbox' | Select-Object DisplayName, PrimarySmtpAddress, Guid, ECPEnabled, OWAEnabled, ImapEnabled, PopEnabled, MAPIEnabled, EwsEnabled, ActiveSyncEnabled, SmtpClientAuthenticationDisabled + $GraphRequest = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-CasMailbox' | Select-Object DisplayName, PrimarySmtpAddress, Guid, ECPEnabled, OWAEnabled, IMAPEnabled, POPEnabled, MAPIEnabled, EWSEnabled, ActiveSyncEnabled, SmtpClientAuthenticationDisabled $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListMailboxForwarding.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListMailboxForwarding.ps1 index b15184997d..13bebe9f14 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListMailboxForwarding.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListMailboxForwarding.ps1 @@ -84,7 +84,7 @@ function Invoke-ListMailboxForwarding { } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListSharedMailboxAccountEnabled.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListSharedMailboxAccountEnabled.ps1 index 8ab041101e..55d8f547ed 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListSharedMailboxAccountEnabled.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListSharedMailboxAccountEnabled.ps1 @@ -13,12 +13,12 @@ function Invoke-ListSharedMailboxAccountEnabled { $APIName = $Request.Params.CIPPEndpoint $TenantFilter = $Request.Query.tenantFilter - # Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants. - $UseReportDB = $Request.Query.UseReportDB -eq $true + $UseReportDB = $Request.Query.UseReportDB + # Get Shared Mailbox Stuff try { # If UseReportDB is specified, retrieve from the report database (cached Mailboxes + Users join) - if ($UseReportDB) { + if ($UseReportDB -eq 'true') { try { $GraphRequest = Get-CIPPSharedMailboxAccountEnabledReport -TenantFilter $TenantFilter -ErrorAction Stop $StatusCode = [HttpStatusCode]::OK diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-AddEquipmentMailbox.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-AddEquipmentMailbox.ps1 index fb7b9190ca..ca51181e50 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-AddEquipmentMailbox.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-AddEquipmentMailbox.ps1 @@ -35,8 +35,8 @@ Function Invoke-AddEquipmentMailbox { $null = Set-CIPPSignInState -userid $AddEquipmentRequest.ExternalDirectoryObjectId -TenantFilter $Tenant -APIName $APINAME -Headers $Headers -AccountEnabled $false $Results.Add("Successfully blocked sign-in for Equipment mailbox $($MailboxObject.userPrincipalName)") } catch { - $ErrorMessage = $_.Exception.Message - $Results.Add("Failed to block sign-in for Equipment mailbox: $($MailboxObject.userPrincipalName). Error: $ErrorMessage") + $ErrorMessage = (Get-CippException -Exception $_).NormalizedError + $Results.Add("Failed to block sign-in for equipment mailbox $($MailboxObject.userPrincipalName): $ErrorMessage") } Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message "Created equipment mailbox $($MailboxObject.displayName)" -Sev 'Info' $StatusCode = [HttpStatusCode]::OK @@ -46,7 +46,7 @@ Function Invoke-AddEquipmentMailbox { $Message = "Failed to create equipment mailbox: $($MailboxObject.displayName). Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message $Message -Sev 'Error' -LogData $ErrorMessage $Results.Add($Message) - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } $Body = [pscustomobject]@{ 'Results' = @($Results) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-AddRoomMailbox.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-AddRoomMailbox.ps1 index 446ea831c8..c8ed5cd99e 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-AddRoomMailbox.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-AddRoomMailbox.ps1 @@ -35,8 +35,8 @@ Function Invoke-AddRoomMailbox { $null = Set-CIPPSignInState -userid $AddRoomRequest.ExternalDirectoryObjectId -TenantFilter $Tenant -APIName $APINAME -Headers $Headers -AccountEnabled $false $Results.Add("Successfully blocked sign-in for Room mailbox $($MailboxObject.userPrincipalName)") } catch { - $ErrorMessage = $_.Exception.Message - $Results.Add("Failed to block sign-in for Room mailbox: $($MailboxObject.userPrincipalName). Error: $ErrorMessage") + $ErrorMessage = (Get-CippException -Exception $_).NormalizedError + $Results.Add("Failed to block sign-in for room mailbox $($MailboxObject.userPrincipalName): $ErrorMessage") } $StatusCode = [HttpStatusCode]::OK } catch { diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-EditEquipmentMailbox.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-EditEquipmentMailbox.ps1 index f1396c842a..b9f38ad03a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-EditEquipmentMailbox.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-EditEquipmentMailbox.ps1 @@ -100,7 +100,7 @@ Function Invoke-EditEquipmentMailbox { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message "Failed to update equipment: $($MailboxObject.DisplayName). Error: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage $Results.Add("Failed to update Equipment mailbox $($MailboxObject.userPrincipalName). $($ErrorMessage.NormalizedError)") - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } $Body = [pscustomobject]@{ 'Results' = @($Results) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-EditRoomList.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-EditRoomList.ps1 index 8d6f3e819a..81bc88a578 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-EditRoomList.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-EditRoomList.ps1 @@ -41,7 +41,7 @@ Function Invoke-EditRoomList { $Results.Add("Successfully updated room list properties for $($RoomListObj.displayName)") Write-LogMessage -headers $Headers -API $APIName -tenant $TenantId -message "Updated room list properties for $($RoomListObj.displayName)" -Sev 'Info' } catch { - $Results.Add("Failed to update room list properties: $($_.Exception.Message)") + $Results.Add("Failed to update room list properties: $((Get-CippException -Exception $_).NormalizedError)") Write-LogMessage -headers $Headers -API $APIName -tenant $TenantId -message "Failed to update room list properties: $($_.Exception.Message)" -Sev 'Error' } } @@ -61,7 +61,7 @@ Function Invoke-EditRoomList { $Results.Add("Successfully added room $MemberEmail to room list") Write-LogMessage -headers $Headers -API $APIName -tenant $TenantId -message "Added room $MemberEmail to room list $GroupId" -Sev 'Info' } catch { - $Results.Add("Failed to add room $MemberEmail : $($_.Exception.Message)") + $Results.Add("Failed to add room $MemberEmail`: $((Get-CippException -Exception $_).NormalizedError)") Write-LogMessage -headers $Headers -API $APIName -tenant $TenantId -message "Failed to add room $MemberEmail : $($_.Exception.Message)" -Sev 'Error' } } @@ -82,7 +82,7 @@ Function Invoke-EditRoomList { $Results.Add("Successfully removed room $MemberEmail from room list") Write-LogMessage -headers $Headers -API $APIName -tenant $TenantId -message "Removed room $MemberEmail from room list $GroupId" -Sev 'Info' } catch { - $Results.Add("Failed to remove room $MemberEmail from room list: $($_.Exception.Message)") + $Results.Add("Failed to remove room $MemberEmail from room list: $((Get-CippException -Exception $_).NormalizedError)") Write-LogMessage -headers $Headers -API $APIName -tenant $TenantId -message "Failed to remove room $MemberEmail from room list: $($_.Exception.Message)" -Sev 'Error' } } @@ -134,7 +134,7 @@ Function Invoke-EditRoomList { $null = New-ExoRequest -tenantid $TenantId -cmdlet 'Set-DistributionGroup' -cmdParams $SetOwnersParams -useSystemMailbox $true Write-LogMessage -headers $Headers -API $APIName -tenant $TenantId -message "Updated owners for room list $GroupId" -Sev 'Info' } catch { - $Results.Add("Failed to update room list owners: $($_.Exception.Message)") + $Results.Add("Failed to update room list owners: $((Get-CippException -Exception $_).NormalizedError)") Write-LogMessage -headers $Headers -API $APIName -tenant $TenantId -message "Failed to update room list owners: $($_.Exception.Message)" -Sev 'Error' } } @@ -157,13 +157,13 @@ Function Invoke-EditRoomList { Write-LogMessage -headers $Headers -API $APIName -tenant $TenantId -message "Updated external email settings for room list $GroupId" -Sev 'Info' } catch { - $Results.Add("Failed to update external email settings: $($_.Exception.Message)") + $Results.Add("Failed to update external email settings: $((Get-CippException -Exception $_).NormalizedError)") Write-LogMessage -headers $Headers -API $APIName -tenant $TenantId -message "Failed to update external email settings: $($_.Exception.Message)" -Sev 'Error' } } } catch { - $Results.Add("An error occurred while editing the room list: $($_.Exception.Message)") + $Results.Add("An error occurred while editing the room list: $((Get-CippException -Exception $_).NormalizedError)") Write-LogMessage -headers $Headers -API $APIName -tenant $TenantId -message "Failed to edit room list: $($_.Exception.Message)" -Sev 'Error' } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-EditRoomMailbox.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-EditRoomMailbox.ps1 index 8c63898585..ac6624c240 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-EditRoomMailbox.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-EditRoomMailbox.ps1 @@ -132,7 +132,7 @@ Function Invoke-EditRoomMailbox { Write-LogMessage -headers $Request.Headers -API $APIName -tenant $Tenant -message "Failed to update room: $($MailboxObject.DisplayName). Error: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage $Results.Add("Failed to update Room mailbox $($MailboxObject.userPrincipalName). $($ErrorMessage.NormalizedError)") - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } $Body = [pscustomobject]@{ 'Results' = @($Results) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-ListEquipment.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-ListEquipment.ps1 index 5e2278a5fc..214d536286 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-ListEquipment.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-ListEquipment.ps1 @@ -81,7 +81,7 @@ function Invoke-ListEquipment { } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $Results = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-ListRooms.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-ListRooms.ps1 index d7d7b4941a..148903f903 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-ListRooms.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-ListRooms.ps1 @@ -4,8 +4,6 @@ function Invoke-ListRooms { Entrypoint .ROLE Exchange.Room.Read - .DESCRIPTION - Lists room mailboxes (meeting rooms) in Exchange Online for a tenant, with optional detailed view by room ID. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -153,7 +151,7 @@ function Invoke-ListRooms { mailNickname = $Room.Alias accountDisabled = $Room.AccountDisabled hiddenFromAddressListsEnabled = $Room.HiddenFromAddressListsEnabled - isDirSynced = $Room.IsDirSynced + isDirSynced = $RoomMailbox.IsDirSynced # Room Booking Settings bookingType = $PlaceDetails.BookingType @@ -190,7 +188,7 @@ function Invoke-ListRooms { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddQuarantinePolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddQuarantinePolicy.ps1 index 248de4d06c..8f9bf95b21 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddQuarantinePolicy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddQuarantinePolicy.ps1 @@ -19,6 +19,7 @@ Function Invoke-AddQuarantinePolicy { $tenants = (Get-Tenants).defaultDomainName } + $Failed = 0 $Result = foreach ($TenantFilter in $tenants) { try { $ReleaseActionPreference = $Request.Body.ReleaseActionPreference.value ?? $Request.Body.ReleaseActionPreference @@ -49,6 +50,7 @@ Function Invoke-AddQuarantinePolicy { } catch { + $Failed++ $ErrorMessage = Get-CippException -Exception $_ $Message = "Failed to create Quarantine policy '$($Request.Body.Name)' for tenant '$($TenantFilter)' - $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev Error -LogData $ErrorMessage @@ -57,7 +59,7 @@ Function Invoke-AddQuarantinePolicy { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = Get-CippBulkStatusCode -Total @($tenants).Count -Failed $Failed Body = @{Results = @($Result) } }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddSpamFilter.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddSpamFilter.ps1 index e5896a1f50..0ed4c257fb 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddSpamFilter.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddSpamFilter.ps1 @@ -26,6 +26,7 @@ Function Invoke-AddSpamFilter { $Tenants = $Tenants | Where-Object { $_ -in $AllowedTenantList.defaultDomainName } } + $Failed = 0 $Result = foreach ($TenantFilter in $tenants) { try { $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'New-HostedContentFilterPolicy' -cmdParams $RequestParams @@ -41,6 +42,7 @@ Function Invoke-AddSpamFilter { "Successfully created spamfilter for $TenantFilter." Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Successfully created spamfilter for $TenantFilter." -sev Info } catch { + $Failed++ $ErrorMessage = Get-CippException -Exception $_ "Could not create spamfilter rule for $($TenantFilter): $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Could not create spamfilter rule for $($TenantFilter): $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage @@ -48,7 +50,7 @@ Function Invoke-AddSpamFilter { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = Get-CippBulkStatusCode -Total @($Tenants).Count -Failed $Failed Body = @{Results = @($Result) } }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddTenantAllowBlockList.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddTenantAllowBlockList.ps1 index 1d8e0d727b..c4c616bb00 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddTenantAllowBlockList.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddTenantAllowBlockList.ps1 @@ -10,59 +10,81 @@ function Invoke-AddTenantAllowBlockList { $APIName = $Request.Params.CIPPEndpoint $Headers = $Request.Headers + $Results = [System.Collections.Generic.List[string]]::new() - $BlockListObject = $Request.Body - $TenantID = $Request.Body.tenantID.value ?? $Request.Body.tenantID + try { + $BlockListObject = $Request.Body + $TenantID = $Request.Body.tenantID.value ?? $Request.Body.tenantID - if ($TenantID -eq 'AllTenants') { - $Tenants = (Get-Tenants).defaultDomainName - } elseif ($TenantID -is [array]) { - $Tenants = $TenantID - } else { - $Tenants = @($TenantID) - } - $Results = [System.Collections.Generic.List[string]]::new() - $Entries = @() - if ($BlockListObject.entries -is [array]) { - $Entries = $BlockListObject.entries - } else { - $Entries = @($BlockListObject.entries -split '[,;]' | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | ForEach-Object { $_.Trim() }) - } - foreach ($Tenant in $Tenants) { - try { - $ExoRequest = @{ - tenantid = $Tenant - cmdlet = 'New-TenantAllowBlockListItems' - cmdParams = @{ - Entries = $Entries - ListType = [string]$BlockListObject.listType - Notes = [string]$BlockListObject.notes - $BlockListObject.listMethod = [bool]$true + if ($TenantID -eq 'AllTenants') { + $Tenants = (Get-Tenants).defaultDomainName + } elseif ($TenantID -is [array]) { + $Tenants = $TenantID + } else { + $Tenants = @($TenantID) + } + + $Entries = @() + if ($BlockListObject.entries -is [array]) { + $Entries = $BlockListObject.entries + } else { + $Entries = @($BlockListObject.entries -split '[,;]' | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | ForEach-Object { $_.Trim() }) + } + + $ListMethod = [string]($BlockListObject.listMethod) + if ([string]::IsNullOrWhiteSpace($ListMethod)) { + $Results.Add('listMethod (Block or Allow) is required.') + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ 'Results' = @($Results) } + }) + } + + foreach ($Tenant in $Tenants) { + try { + $ExoRequest = @{ + tenantid = $Tenant + cmdlet = 'New-TenantAllowBlockListItems' + cmdParams = @{ + Entries = $Entries + ListType = [string]$BlockListObject.listType + Notes = [string]$BlockListObject.notes + $ListMethod = [bool]$true + } } - } - if ($BlockListObject.NoExpiration -eq $true) { - $ExoRequest.cmdParams.NoExpiration = $true - } elseif ($BlockListObject.RemoveAfter -eq $true) { - $ExoRequest.cmdParams.RemoveAfter = 45 - } + if ($BlockListObject.NoExpiration -eq $true) { + $ExoRequest.cmdParams.NoExpiration = $true + } elseif ($BlockListObject.RemoveAfter -eq $true) { + $ExoRequest.cmdParams.RemoveAfter = 45 + } - New-ExoRequest @ExoRequest - $Result = "Successfully added $($BlockListObject.Entries) as type $($BlockListObject.ListType) to the $($BlockListObject.listMethod) list for $tenant" - $Results.Add($Result) - Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message $Result -Sev 'Info' - } catch { - $ErrorMessage = Get-CippException -Exception $_ - $Result = "Failed to create blocklist. Error: $($ErrorMessage.NormalizedError)" - $Results.Add($Result) - Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message $Result -Sev 'Error' -LogData $ErrorMessage + New-ExoRequest @ExoRequest + $Result = "Successfully added $($BlockListObject.Entries) as type $($BlockListObject.ListType) to the $($BlockListObject.listMethod) list for $Tenant" + $Results.Add($Result) + Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message $Result -Sev 'Info' + } catch { + $ErrorMessage = Get-CippException -Exception $_ + if ($ErrorMessage.NormalizedError -match '403|Forbidden') { + $Result = "Failed to create $($ListMethod.ToLower()) list entry for $Tenant. The CIPP service principal does not have Exchange permissions in this tenant. Run a CPV Refresh from the tenant overview page to push the required permissions." + } else { + $Result = "Failed to create $($ListMethod.ToLower()) list entry for $Tenant. Error: $($ErrorMessage.NormalizedError)" + } + $Results.Add($Result) + Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message $Result -Sev 'Error' -LogData $ErrorMessage + } } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Result = "Failed to process allow/block list request. Error: $($ErrorMessage.NormalizedError)" + $Results.Add($Result) + Write-LogMessage -headers $Headers -API $APIName -message $Result -Sev 'Error' -LogData $ErrorMessage } + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::OK Body = @{ - 'Results' = $Results - 'Request' = $ExoRequest + 'Results' = @($Results) } }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddTenantAllowBlockListTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddTenantAllowBlockListTemplate.ps1 index 22b53cff30..1ce3cce454 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddTenantAllowBlockListTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddTenantAllowBlockListTemplate.ps1 @@ -38,7 +38,7 @@ function Invoke-AddTenantAllowBlockListTemplate { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -Headers $Headers -API $APIName -message "Failed to create Tenant Allow/Block List Template: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage $body = [pscustomobject]@{ 'Results' = "Failed to create Tenant Allow/Block List Template: $($ErrorMessage.NormalizedError)" } - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditQuarantinePolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditQuarantinePolicy.ps1 index 78fd2caad2..b947698ea6 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditQuarantinePolicy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditQuarantinePolicy.ps1 @@ -14,6 +14,13 @@ Function Invoke-EditQuarantinePolicy { $TenantFilter = $Request.Query.TenantFilter ?? $Request.Body.TenantFilter + # Built-in policies (e.g. the global settings policy) report an all-zeros Guid that + # Set-QuarantinePolicy cannot resolve as an objectId, so fall back to the policy name. + $Identity = $Request.Body.Identity + if ($Identity -eq '00000000-0000-0000-0000-000000000000') { + $Identity = $Request.Body.Name ?? $Identity + } + if ($Request.Query.Type -eq "GlobalQuarantinePolicy") { $Frequency = $Request.Body.EndUserSpamNotificationFrequency.value ?? $Request.Body.EndUserSpamNotificationFrequency @@ -27,7 +34,7 @@ Function Invoke-EditQuarantinePolicy { } $Params = @{ - Identity = $Request.Body.Identity + Identity = $Identity # Convert the requested frequency from ISO 8601 to a TimeSpan object EndUserSpamNotificationFrequency = [System.Xml.XmlConvert]::ToTimeSpan($EndUserSpamNotificationFrequency) EndUserSpamNotificationCustomFromAddress = $Request.Body.EndUserSpamNotificationCustomFromAddress @@ -47,7 +54,7 @@ Function Invoke-EditQuarantinePolicy { } $Params = @{ - Identity = $Request.Body.Identity + Identity = $Identity EndUserQuarantinePermissions = $EndUserQuarantinePermissions ESNEnabled = $Request.Body.QuarantineNotification IncludeMessagesFromBlockedSenderAddress = $Request.Body.IncludeMessagesFromBlockedSenderAddress @@ -64,7 +71,7 @@ Function Invoke-EditQuarantinePolicy { } catch { $Result = "Failed to update Quarantine policy '$($Request.Body.Name)' - $($_)" - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev Error -LogData $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditSpamFilter.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditSpamFilter.ps1 index 76cd97f27b..ed72146bff 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditSpamFilter.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditSpamFilter.ps1 @@ -26,7 +26,7 @@ Function Invoke-EditSpamFilter { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed setting Spamfilter rule $($Name) to $($State). Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Result -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditTenantAllowBlockListTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditTenantAllowBlockListTemplate.ps1 index f328ab6a61..0d981ca633 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditTenantAllowBlockListTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditTenantAllowBlockListTemplate.ps1 @@ -57,7 +57,7 @@ function Invoke-EditTenantAllowBlockListTemplate { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -Headers $Headers -API $APIName -message "Failed to edit Tenant Allow/Block List Template: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage $body = [pscustomobject]@{ 'Results' = "Failed to edit Tenant Allow/Block List Template: $($ErrorMessage.NormalizedError)" } - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecMailboxSafeSender.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecMailboxSafeSender.ps1 new file mode 100644 index 0000000000..6d120e983d --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecMailboxSafeSender.ps1 @@ -0,0 +1,45 @@ +function Invoke-ExecMailboxSafeSender { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Exchange.SpamFilter.ReadWrite + .DESCRIPTION + Adds a sender to a mailbox trusted/safe senders list via Set-MailboxJunkEmailConfiguration. + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $TenantFilter = $Request.Body.tenantFilter | Select-Object -First 1 + $Mailbox = Get-CippQuarantineInputValue $Request.Body.mailbox + $Sender = Get-CippQuarantineInputValue $Request.Body.sender + + try { + if ([string]::IsNullOrWhiteSpace($Mailbox)) { throw 'mailbox is required.' } + if ([string]::IsNullOrWhiteSpace($Sender)) { throw 'sender is required.' } + + New-ExoRequest -tenantid $TenantFilter -cmdlet 'Set-MailboxJunkEmailConfiguration' -cmdParams @{ + Identity = $Mailbox + TrustedSendersToAdd = @($Sender) + TrustedListsOnly = $false + ContactsTrusted = $false + } + + $Result = "Added $Sender to the safe senders list for $Mailbox." + Write-LogMessage -headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Result -Sev 'Info' + $StatusCode = [HttpStatusCode]::OK + $Body = @{ Results = $Result } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Result = "Failed to add safe sender for $Mailbox`: $($ErrorMessage.NormalizedError)" + Write-LogMessage -headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Result -Sev 'Error' + $StatusCode = [HttpStatusCode]::OK + $Body = @{ Results = $Result } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecQuarantineManagement.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecQuarantineManagement.ps1 index c388fc5259..64f969d282 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecQuarantineManagement.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecQuarantineManagement.ps1 @@ -9,88 +9,341 @@ function Invoke-ExecQuarantineManagement { param($Request, $TriggerMetadata) $APIName = $Request.Params.CIPPEndpoint - $Headers = $Request.Headers - # Interact with query parameters or the body of the request. - try { - $TenantFilter = $Request.Body.tenantFilter | Select-Object -First 1 - $ActionType = $Request.Body.Type | Select-Object -First 1 - $AllowSender = $Request.Body.AllowSender -eq $true - $RecipientAddresses = @($Request.Body.RecipientAddress | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }) - $UserRecipients = @( - $RecipientAddresses | - ForEach-Object { $_ -split '[,;]' } | - ForEach-Object { $_.Trim() } | - Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | - Select-Object -Unique + + # multiPost bulk Release POSTs an array of message objects. Reading flags off the + # array root (e.g. [boolean]$Request.Body.AllowSender) casts Object[] to $true even + # when values are $null/$false — always take scalars from the first item. + $Items = if ($Request.Body -is [array]) { @($Request.Body) } else { @($Request.Body) } + $First = $Items | Select-Object -First 1 + + $TenantFilter = $First.tenantFilter + $ActionType = $First.Type + # Both AllowSender and AddAllowEntry are routed through the Tenant Allow/Block List + # because Release-QuarantineMessage -AllowSender chains to Get-HostedContentFilterPolicy + # on Microsoft's backend, which intermittently fails with a CommandNotFoundException. + $AllowEntry = [boolean]$First.AllowSender -or [boolean]$First.AddAllowEntry + $AllowDomain = [boolean]$First.AllowDomain + $BlockDomain = [boolean]$First.BlockDomain + $ReportFalsePositive = [boolean]$First.ReportFalsePositive + $ReleaseToUsers = @( + ConvertTo-CippQuarantineStringArray $First.releaseToUsers | + Where-Object { -not [string]::IsNullOrWhiteSpace($_) } + ) + $RecipientAddresses = @( + $Items | + ForEach-Object { $_.RecipientAddress } | + Where-Object { -not [string]::IsNullOrWhiteSpace($_) } + ) + $UserRecipients = @( + $RecipientAddresses | + ForEach-Object { $_ -split '[,;]' } | + ForEach-Object { $_.Trim() } | + Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | + Select-Object -Unique + ) + + $Identities = @( + $Items | + ForEach-Object { $_.Identity } | + Where-Object { -not [string]::IsNullOrWhiteSpace($_) } + ) + if ($Identities.Count -eq 0) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'No quarantine message identity was provided.' } + }) + } + + $ResultsList = [System.Collections.Generic.List[object]]::new() + + # Translate common Exchange exceptions into messages a non-Exchange admin can act on. + function Format-QuarantineError { + param( + [string]$Message, + [string]$Action = 'process', + [string]$IdentityValue ) - $params = @{} + $Clean = ($Message -replace '^\|[^|]+\|', '').Trim() + switch -Wildcard ($Clean) { + '*is not valid. Please input a valid message identity*' { + return "Could not $Action this message. The quarantine entry could not be found - it may have already been released, denied, expired (quarantined items are typically retained 15-30 days), or purged. Refresh the quarantine list and try again." + } + '*Cannot find an object with identity*' { + return "Could not $Action this message. The quarantine entry no longer exists. Refresh the quarantine list and try again." + } + '*release request*already*' { + return 'A release request for this message has already been submitted and is awaiting administrator review.' + } + '*already*released*' { + return 'This message has already been released from quarantine.' + } + '*already*denied*' { + return 'This message has already been denied.' + } + '*has expired*' { + return 'This message has expired from quarantine and can no longer be released. The default retention is 15-30 days depending on the policy.' + } + { $_ -like '*not authorized*' -or $_ -like '*Access*denied*' -or $_ -like '*Unauthorized*' } { + return "You are not authorized to $Action quarantined messages for this tenant. Confirm the SAM user has the Exchange.SpamFilter.ReadWrite role and that GDAP grants the Security Administrator (or equivalent) role." + } + default { + return "Failed to $Action the message: $Clean" + } + } + } - if ($Request.Body.Identity -is [string]) { - $params['Identity'] = $Request.Body.Identity - } else { - $params['Identities'] = $Request.Body.Identity - # For -Identities, Exchange requires -Identity to be present, but ignores its value. - $params['Identity'] = '000' + function Get-QuarantineActionResultMessage { + param( + $Entry, + [string]$ActionType + ) + + $AllowBlockOnly = $ActionType -in @('AllowDomain', 'BlockDomain', 'AllowSenderOnly', 'BlockSenderOnly') + if ($AllowBlockOnly) { + if ($Entry.AllowEntryResult -eq 'Success') { + # `return switch` is a parse error in PowerShell; the switch must be + # wrapped in a subexpression to be used as a return value. + return $(switch ($ActionType) { + 'AllowDomain' { 'Sender domain added to the tenant allow list.' } + 'BlockDomain' { 'Sender domain added to the tenant block list.' } + 'AllowSenderOnly' { 'Sender added to the tenant allow list.' } + 'BlockSenderOnly' { 'Sender added to the tenant block list.' } + default { 'Allow/block entry updated successfully.' } + }) + } + if (-not [string]::IsNullOrWhiteSpace($Entry.AllowEntryResult)) { + return $Entry.AllowEntryResult + } + if (-not [string]::IsNullOrWhiteSpace($Entry.ReleaseResult)) { + return $Entry.ReleaseResult + } + return 'No result was returned for the allow/block action.' + } + + if ($Entry.ReleaseResult -eq 'Success') { + return 'Success' + } + return $Entry.ReleaseResult + } + + foreach ($Id in $Identities) { + $Entry = [PSCustomObject]@{ + Identity = $Id + ReleaseResult = $null + AllowEntryResult = $null + } + + $InternetMessageIdPattern = '^(?:ID=)?<.+>$' + + $ActionVerb = switch -Wildcard ($ActionType) { + 'Release' { 'release' } + 'Deny' { 'deny' } + 'Delete' { 'delete' } + default { 'process' } } - # Delete is a separate cmdlet; Release-QuarantineMessage only accepts Release/Request/Approve/Deny. if ($ActionType -eq 'Delete') { - $Cmdlet = 'Delete-QuarantineMessage' - } else { - $Cmdlet = 'Release-QuarantineMessage' - if ($ActionType -eq 'Release') { - $params['ReleaseToAll'] = $true - } else { - $params['ActionType'] = $ActionType - if ($ActionType -eq 'Deny' -and $UserRecipients.Count -gt 0) { - $params['User'] = $UserRecipients - } + try { + Invoke-CippQuarantineExoRequest -TenantId $TenantFilter -Cmdlet 'Delete-QuarantineMessage' -CmdParams @{ Identity = $Id } + $Entry.ReleaseResult = 'Success' + Write-LogMessage -headers $Request.Headers -API $APIName -tenant $TenantFilter -message "Successfully deleted Quarantine ID $Id" -Sev 'Info' + } catch { + $Entry.ReleaseResult = Format-QuarantineError -Message $_.Exception.Message -Action 'delete' -IdentityValue $Id + Write-LogMessage -headers $Request.Headers -API $APIName -tenant $TenantFilter -message "Quarantine delete failed for $Id`: $($_.Exception.Message)" -Sev 'Error' -LogData $_ } + $ResultsList.Add($Entry) + continue } - New-ExoRequest -tenantid $TenantFilter -cmdlet $Cmdlet -cmdParams $params - # AllowSender via HostedContentFilterPolicy since -AllowSender switch fails in REST API - if ($AllowSender) { + if ($ActionType -in @('AllowDomain', 'BlockDomain', 'AllowSenderOnly', 'BlockSenderOnly')) { try { - $SenderAddress = $Request.Body.SenderAddress - $PolicyName = $Request.Body.PolicyName - if ([string]::IsNullOrEmpty($SenderAddress) -or [string]::IsNullOrEmpty($PolicyName)) { - if ($Request.Body.Identity -is [string]) { - $QuarantineMessage = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-QuarantineMessage' -cmdParams @{ Identity = $Request.Body.Identity } - if ([string]::IsNullOrEmpty($SenderAddress)) { $SenderAddress = $QuarantineMessage.SenderAddress } - if ([string]::IsNullOrEmpty($PolicyName)) { $PolicyName = $QuarantineMessage.PolicyName } + $LookupId = $Id + if ($Id -match $InternetMessageIdPattern) { + $LookupMessageId = $Id -replace '^ID=', '' + $QuarantineLookup = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-QuarantineMessage' -cmdParams @{ MessageId = $LookupMessageId } + $ResolvedQuarantine = @($QuarantineLookup) | Where-Object { $_.Identity } | Sort-Object -Property ReceivedTime -Descending | Select-Object -First 1 + if ($ResolvedQuarantine) { $LookupId = $ResolvedQuarantine.Identity } + } + $QMsg = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-QuarantineMessage' -cmdParams @{ Identity = $LookupId } + $SenderAddr = $QMsg.SenderAddress | Select-Object -First 1 + if (-not $SenderAddr) { + $Entry.AllowEntryResult = 'Sender address was not available for this quarantine entry.' + } elseif ($ActionType -in @('AllowDomain', 'BlockDomain')) { + $DomainEntry = ($SenderAddr -split '@')[-1] + $DomainParams = @{ + Entries = @($DomainEntry) + ListType = 'Sender' + Notes = if ($ActionType -eq 'AllowDomain') { 'Allowed domain via Quarantine Management' } else { 'Blocked domain via Quarantine Management' } + } + if ($ActionType -eq 'AllowDomain') { + $DomainParams.Allow = $true + $DomainParams.RemoveAfter = 45 + } else { + $DomainParams.Block = $true + $DomainParams.NoExpiration = $true + } + New-ExoRequest -tenantid $TenantFilter -cmdlet 'New-TenantAllowBlockListItems' -cmdParams $DomainParams + $Entry.AllowEntryResult = 'Success' + $Entry.ReleaseResult = 'Success' + } else { + $ListParams = @{ + Entries = @($SenderAddr) + ListType = 'Sender' + Notes = if ($ActionType -eq 'AllowSenderOnly') { 'Allowed sender via Quarantine Management' } else { 'Blocked sender via Quarantine Management' } } + if ($ActionType -eq 'AllowSenderOnly') { + $ListParams.Allow = $true + $ListParams.RemoveAfter = 45 + } else { + $ListParams.Block = $true + $ListParams.NoExpiration = $true + } + New-ExoRequest -tenantid $TenantFilter -cmdlet 'New-TenantAllowBlockListItems' -cmdParams $ListParams + $Entry.AllowEntryResult = 'Success' + $Entry.ReleaseResult = 'Success' } - if (-not [string]::IsNullOrEmpty($SenderAddress) -and -not [string]::IsNullOrEmpty($PolicyName)) { - $CurrentPolicy = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-HostedContentFilterPolicy' -cmdParams @{ Identity = $PolicyName } - $CurrentSenders = @($CurrentPolicy.AllowedSenders.Sender.Address | Where-Object { $_ }) - if ($SenderAddress -notin $CurrentSenders) { - $UpdatedSenders = @($CurrentSenders + $SenderAddress) - New-ExoRequest -tenantid $TenantFilter -cmdlet 'Set-HostedContentFilterPolicy' -cmdParams @{ - Identity = $PolicyName - AllowedSenders = $UpdatedSenders + } catch { + $Entry.AllowEntryResult = "Failed: $(($_.Exception.Message -replace '^\|[^|]+\|', '').Trim())" + $Entry.ReleaseResult = $Entry.AllowEntryResult + } + $ResultsList.Add($Entry) + continue + } + + # Release-QuarantineMessage requires the quarantine Identity (GUID-style), + # not an InternetMessageId. When callers (e.g. the Email Troubleshooter + # message trace) pass an InternetMessageId, resolve it to the quarantine + # Identity via Get-QuarantineMessage first. + $ResolvedId = $Id + if ($Id -match $InternetMessageIdPattern) { + $LookupMessageId = $Id -replace '^ID=', '' + try { + $QuarantineLookup = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-QuarantineMessage' -cmdParams @{ MessageId = $LookupMessageId } + $ResolvedQuarantine = @($QuarantineLookup) | Where-Object { $_.Identity } | Sort-Object -Property ReceivedTime -Descending | Select-Object -First 1 + if ($ResolvedQuarantine) { + $ResolvedId = $ResolvedQuarantine.Identity + } else { + $Entry.ReleaseResult = "This message is not currently in quarantine - it may have been released, denied, or expired already. Open Quarantine Management to confirm its status." + Write-LogMessage -headers $Request.Headers -API $APIName -tenant $TenantFilter -message "Quarantine release failed: no quarantine entry for MessageId $LookupMessageId" -Sev 'Error' + $ResultsList.Add($Entry) + continue + } + } catch { + $Entry.ReleaseResult = Format-QuarantineError -Message $_.Exception.Message -Action 'look up' -IdentityValue $LookupMessageId + Write-LogMessage -headers $Request.Headers -API $APIName -tenant $TenantFilter -message "Quarantine identity lookup failed for $LookupMessageId`: $($_.Exception.Message)" -Sev 'Error' -LogData $_ + $ResultsList.Add($Entry) + continue + } + } + + try { + $ReleaseParams = @{ + ActionType = $ActionType + Identity = $ResolvedId + } + if ($ReleaseToUsers.Count -gt 0 -and $ActionType -eq 'Release') { + $ReleaseParams['User'] = $ReleaseToUsers + } else { + $ReleaseParams['ReleaseToAll'] = $true + } + if ($ActionType -eq 'Deny' -and $UserRecipients.Count -gt 0) { + $ReleaseParams['User'] = $UserRecipients + } + if ($ReportFalsePositive -and $ActionType -eq 'Release') { + $ReleaseParams['ReportFalsePositive'] = $true + } + Invoke-CippQuarantineExoRequest -TenantId $TenantFilter -Cmdlet 'Release-QuarantineMessage' -CmdParams $ReleaseParams + $Entry.ReleaseResult = 'Success' + Write-LogMessage -headers $Request.Headers -API $APIName -tenant $TenantFilter -message "Successfully processed Quarantine ID $ResolvedId" -Sev 'Info' + } catch { + $Entry.ReleaseResult = Format-QuarantineError -Message $_.Exception.Message -Action $ActionVerb -IdentityValue $ResolvedId + Write-LogMessage -headers $Request.Headers -API $APIName -tenant $TenantFilter -message "Quarantine $ActionVerb failed for $ResolvedId`: $($_.Exception.Message)" -Sev 'Error' -LogData $_ + } + + if (($AllowEntry -or $AllowDomain -or $BlockDomain) -and $Entry.ReleaseResult -eq 'Success') { + try { + $QMsg = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-QuarantineMessage' -cmdParams @{ Identity = $ResolvedId } + $SenderAddr = $QMsg.SenderAddress | Select-Object -First 1 + if ($SenderAddr) { + if ($AllowDomain -or $BlockDomain) { + $DomainEntry = ($SenderAddr -split '@')[-1] + if ($DomainEntry) { + $DomainParams = @{ + Entries = @($DomainEntry) + ListType = 'Sender' + Notes = if ($AllowDomain) { 'Allowed domain via Quarantine Management' } else { 'Blocked domain via Quarantine Management' } + } + if ($AllowDomain) { + $DomainParams.Allow = $true + $DomainParams.RemoveAfter = 45 + } else { + $DomainParams.Block = $true + $DomainParams.NoExpiration = $true + } + New-ExoRequest -tenantid $TenantFilter -cmdlet 'New-TenantAllowBlockListItems' -cmdParams $DomainParams + $Entry.AllowEntryResult = 'Success' + } else { + $Entry.AllowEntryResult = 'Processed, but could not determine sender domain for allow/block entry.' + } + } elseif ($AllowEntry) { + New-ExoRequest -tenantid $TenantFilter -cmdlet 'New-TenantAllowBlockListItems' -cmdParams @{ + Entries = @($SenderAddr) + ListType = 'Sender' + Allow = $true + RemoveAfter = 45 + Notes = 'Allowed via Quarantine Management' } + $Entry.AllowEntryResult = 'Success' } - Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Added $SenderAddress to allowed senders on policy $PolicyName" -Sev 'Info' + } else { + $Entry.AllowEntryResult = 'Processed, but the sender address was not available, so no allow/block entry was added.' } } catch { - $ErrorMessage = Get-CippException -Exception $_ - Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to add sender to allow list: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + $Entry.AllowEntryResult = "Processed, but could not update the Tenant Allow/Block List: $(($_.Exception.Message -replace '^\|[^|]+\|', '').Trim())" + Write-LogMessage -headers $Request.Headers -API $APIName -tenant $TenantFilter -message "Allow/block entry failed for $ResolvedId`: $($_.Exception.Message)" -Sev 'Error' } + } elseif ($AllowEntry -or $AllowDomain -or $BlockDomain) { + $Entry.AllowEntryResult = 'Skipped - the message was not released, so the sender was not added to the allow list.' } - $Results = [pscustomobject]@{'Results' = "Successfully processed $($Request.Body.Identity)" } - $StatusCode = [HttpStatusCode]::OK - Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Successfully processed Quarantine ID $($Request.Body.Identity)" -Sev 'Info' - } catch { - $ErrorMessage = Get-CippException -Exception $_ - Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Quarantine Management failed: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage - $Results = [pscustomobject]@{'Results' = "Failed. $($ErrorMessage.NormalizedError)" } - $StatusCode = [HttpStatusCode]::BadRequest + $ResultsList.Add($Entry) + } + + $AllowBlockOnlyActions = @('AllowDomain', 'BlockDomain', 'AllowSenderOnly', 'BlockSenderOnly') + $SuccessCount = @($ResultsList | Where-Object { + ($_.ReleaseResult -eq 'Success') -or ( + $ActionType -in $AllowBlockOnlyActions -and $_.AllowEntryResult -eq 'Success' + ) + }).Count + $FailureCount = $ResultsList.Count - $SuccessCount + $PastTense = switch -Wildcard ($ActionType) { + 'Release' { 'released' } + 'Deny' { 'denied' } + 'Delete' { 'deleted' } + 'AllowDomain' { 'allowed at domain level' } + 'BlockDomain' { 'blocked at domain level' } + 'AllowSenderOnly' { 'allowed at sender level' } + 'BlockSenderOnly' { 'blocked at sender level' } + default { 'processed' } + } + + $Body = [pscustomobject]@{ + Results = if ($ResultsList.Count -eq 1) { + $SingleResult = Get-QuarantineActionResultMessage -Entry $ResultsList[0] -ActionType $ActionType + if ($SingleResult -eq 'Success') { "Message $PastTense successfully." } + else { $SingleResult } + } elseif ($FailureCount -eq 0) { + "All $($ResultsList.Count) messages $PastTense successfully." + } elseif ($SuccessCount -eq 0) { + "Failed to $($ActionType.ToLower()) any of the $($ResultsList.Count) messages. See details below." + } else { + "$SuccessCount of $($ResultsList.Count) messages $PastTense successfully ($FailureCount failed). See details below." + } + Details = @($ResultsList) } - return ([HttpResponseContext]@{ - StatusCode = $StatusCode - Body = $Results - }) + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = $Body + }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExportMailQuarantine.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExportMailQuarantine.ps1 new file mode 100644 index 0000000000..aced53ba74 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExportMailQuarantine.ps1 @@ -0,0 +1,100 @@ +function Invoke-ExportMailQuarantine { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Exchange.SpamFilter.Read + .DESCRIPTION + Exports filtered quarantine results as CSV or JSON for admin download. + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $TenantFilter = $Request.Body.tenantFilter + $Format = ($Request.Body.format ?? 'csv').ToString().ToLowerInvariant() + $MaxRows = 5000 + + try { + $Input = @{} + foreach ($Key in @('days', 'startDate', 'endDate', 'sender', 'recipient', 'messageId', 'subject', 'subjectExact', 'quarantineType', 'releaseStatus', 'policyTypes', 'policyName', 'senderDomain', 'recipientDomain', 'entityType')) { + if ($null -ne $Request.Body.$Key) { + $Input[$Key] = $Request.Body.$Key + } + } + $Input.pageSize = 1000 + + $Query = Build-CIPPQuarantineQueryParams -QueryInput $Input -ApplyDefaultDateRange + $AllMessages = [System.Collections.Generic.List[object]]::new() + $Page = 1 + do { + $Query.CmdParams.Page = $Page + $PageResults = @(Invoke-CippQuarantineExoRequest -TenantId $TenantFilter -Cmdlet 'Get-QuarantineMessage' -CmdParams $Query.CmdParams | + Select-Object -ExcludeProperty *data.type*) + if ($PageResults) { $AllMessages.AddRange($PageResults) } + $Page++ + } while ($PageResults.Count -eq $Query.CmdParams.PageSize -and $AllMessages.Count -lt $MaxRows -and $Page -le 1000) + + $Filtered = Apply-CippQuarantinePostFilters -Messages $AllMessages -PostFilters $Query.PostFilters + $Display = @($Filtered | ConvertTo-CippQuarantineDisplayObject | Sort-Object ReceivedTime -Descending) + $Truncated = $AllMessages.Count -ge $MaxRows + + if ($Format -eq 'json') { + $ExportBody = @{ + Results = $Display + Metadata = @{ + count = $Display.Count + truncated = $Truncated + format = 'json' + HasPostFilters = ($Query.PostFilters.Count -gt 0) + RawRowsScanned = $AllMessages.Count + FilteredRowsReturned = $Display.Count + PostFilterPaginationLimited = $Truncated + } + } + } else { + $CsvRows = foreach ($Row in $Display) { + [PSCustomObject]@{ + ReceivedTime = $Row.ReceivedTime + Subject = $Row.Subject + SenderAddress = $Row.SenderAddress + RecipientAddress = $Row.RecipientAddress + Type = $Row.Type + ReleaseStatus = $Row.ReleaseStatus + PolicyName = $Row.PolicyName + PolicyType = $Row.PolicyType + Expires = $Row.Expires + MessageId = $Row.MessageId + Identity = $Row.Identity + } + } + $ExportBody = @{ + Results = ($CsvRows | ConvertTo-Csv -NoTypeInformation) -join "`n" + Metadata = @{ + count = $Display.Count + truncated = $Truncated + format = 'csv' + HasPostFilters = ($Query.PostFilters.Count -gt 0) + RawRowsScanned = $AllMessages.Count + FilteredRowsReturned = $Display.Count + PostFilterPaginationLimited = $Truncated + } + } + } + + $StatusCode = [HttpStatusCode]::OK + $Body = $ExportBody + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + $StatusCode = if ($ErrorMessage -match 'not authorized|access.*denied|unauthorized|permission') { + [HttpStatusCode]::Forbidden + } else { + [HttpStatusCode]::InternalServerError + } + $Body = @{ Results = $ErrorMessage } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-GetMailQuarantineMessage.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-GetMailQuarantineMessage.ps1 new file mode 100644 index 0000000000..4e362a29eb --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-GetMailQuarantineMessage.ps1 @@ -0,0 +1,69 @@ +function Invoke-GetMailQuarantineMessage { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Exchange.SpamFilter.Read + .DESCRIPTION + Returns detailed metadata for a single quarantined message (without exporting EML). + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $TenantFilter = $Request.Query.tenantFilter + $Identity = $Request.Query.Identity + + if ([string]::IsNullOrWhiteSpace($Identity)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'Identity is required.' } + }) + } + + try { + $Message = Invoke-CippQuarantineExoRequest -TenantId $TenantFilter -Cmdlet 'Get-QuarantineMessage' -CmdParams @{ Identity = $Identity } + $Display = ConvertTo-CippQuarantineDisplayObject -Message $Message + + $AuthSummary = $null + if ($Display.MessageId) { + try { + $TraceParams = @{ MessageId = $Display.MessageId } + $Trace = New-ExoRequest -TenantId $TenantFilter -Cmdlet 'Get-MessageTraceV2' -CmdParams $TraceParams | Select-Object -First 1 + if ($Trace) { + $TraceDetail = New-ExoRequest -TenantId $TenantFilter -Cmdlet 'Get-MessageTraceDetailV2' -CmdParams @{ + MessageTraceId = $Trace.MessageTraceId + RecipientAddress = $Trace.RecipientAddress + } + if ($TraceDetail) { + $DetailEvents = @($TraceDetail) + $AuthSummary = ConvertTo-AuthenticationSummary -DetailEntries ($DetailEvents | ForEach-Object { $_.Detail } | Where-Object { $_ }) + } + } + } catch { + # Auth enrichment is optional; list/detail still succeeds without it. + } + } + + $Body = @{ + Results = $Display + Metadata = @{ + authSummaryAvailable = [bool]$AuthSummary + } + AuthSummary = $AuthSummary + } + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + $StatusCode = if ($ErrorMessage -match 'not authorized|access.*denied|unauthorized|permission') { + [HttpStatusCode]::Forbidden + } else { + [HttpStatusCode]::InternalServerError + } + $Body = @{ Results = $ErrorMessage } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListConnectionFilter.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListConnectionFilter.ps1 index cd9c98b3fc..a7b9e5af1a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListConnectionFilter.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListConnectionFilter.ps1 @@ -16,7 +16,7 @@ function Invoke-ListConnectionFilter { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $Policies = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1 index 01d79ee71a..8936bcd19f 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1 @@ -6,46 +6,61 @@ function Invoke-ListMailQuarantine { Exchange.SpamFilter.Read .DESCRIPTION Lists quarantined email messages in Exchange Online Protection for a tenant. + Supports server-side filtering via Get-QuarantineMessage parameters. + Default behavior returns one page (100 rows, last 7 days) unless fetchAll=true. #> [CmdletBinding()] param($Request, $TriggerMetadata) - # Interact with query parameters or the body of the request. $TenantFilter = $Request.Query.tenantFilter - # Entity type: Email (default), SharePointOnline (files) or Teams (Teams messages) - $EntityType = if ($Request.Query.EntityType -in @('Email', 'SharePointOnline', 'Teams')) { $Request.Query.EntityType } else { 'Email' } - # EXO REST silently ignores -EntityType SharePointOnline; the documented filter for Safe Attachments - # files is -QuarantineTypes SPOMalware. Email/Teams work fine via -EntityType. - $EntityTypeParams = if ($EntityType -eq 'SharePointOnline') { @{ QuarantineTypes = 'SPOMalware' } } else { @{ EntityType = $EntityType } } + $body = $null + $StatusCode = [HttpStatusCode]::OK + $GraphRequest = @() + $Metadata = $null try { $GraphRequest = if ($TenantFilter -ne 'AllTenants') { - $CustomerId = (Get-Tenants -TenantFilter $TenantFilter).customerId - $PageSize = 1000 - if ($Request.Query.manualPagination -and [System.Convert]::ToBoolean($Request.Query.manualPagination)) { - # Manual pagination: return one page per request. The frontend chains requests via - # Metadata.nextLink, which for this endpoint is the next Get-QuarantineMessage page number. - $Page = if ($Request.Query.nextLink -match '^\d+$') { [int]$Request.Query.nextLink } else { 1 } - $Results = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-QuarantineMessage' -cmdParams (@{ PageSize = $PageSize; Page = $Page } + $EntityTypeParams) | Select-Object -ExcludeProperty *data.type* - # Get-QuarantineMessage supports a maximum Page of 1000 - if (@($Results).Count -eq $PageSize -and $Page -lt 1000) { - $Metadata = [PSCustomObject]@{ nextLink = [string]($Page + 1) } - } - foreach ($Message in @($Results)) { - Add-CIPPQuarantineMessageProperties -Message $Message -Tenant $TenantFilter -CustomerId $CustomerId + $Input = @{ + pageSize = $Request.Query.pageSize + page = $Request.Query.page + nextLink = $Request.Query.nextLink + } + foreach ($Key in @('days', 'startDate', 'endDate', 'sender', 'recipient', 'messageId', 'subject', 'subjectExact', 'quarantineType', 'releaseStatus', 'policyTypes', 'policyName', 'senderDomain', 'recipientDomain', 'entityType')) { + if ($null -ne $Request.Query.$Key) { + $Input[$Key] = $Request.Query.$Key } - $Results - } else { + } + + $ManualPagination = $Request.Query.manualPagination -and [System.Convert]::ToBoolean($Request.Query.manualPagination) + $FetchAll = $Request.Query.fetchAll -and [System.Convert]::ToBoolean($Request.Query.fetchAll) + $ApplyDefaultDate = -not $Input.messageId + + $Query = Build-CIPPQuarantineQueryParams -QueryInput $Input -ApplyDefaultDateRange:$ApplyDefaultDate + $PageSize = $Query.CmdParams.PageSize + + if ($ManualPagination -or -not $FetchAll) { + $PageResult = Get-CippQuarantinePagedResults -TenantId $TenantFilter -Query $Query -NextLink $Request.Query.nextLink -TargetPageSize $PageSize + $Metadata = $PageResult.Metadata + $PageResult.Results + } elseif ($FetchAll) { $Page = 1 $AllMessages = [System.Collections.Generic.List[object]]::new() do { - $Results = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-QuarantineMessage' -cmdParams (@{ PageSize = $PageSize; Page = $Page } + $EntityTypeParams) | Select-Object -ExcludeProperty *data.type* + $Query.CmdParams.Page = $Page + $Results = @(Invoke-CippQuarantineExoRequest -TenantId $TenantFilter -Cmdlet 'Get-QuarantineMessage' -CmdParams $Query.CmdParams | + Select-Object -ExcludeProperty *data.type*) if ($Results) { $AllMessages.AddRange(@($Results)) } $Page++ - } while (@($Results).Count -eq $PageSize) - foreach ($Message in $AllMessages) { - Add-CIPPQuarantineMessageProperties -Message $Message -Tenant $TenantFilter -CustomerId $CustomerId + } while (@($Results).Count -eq $PageSize -and $Page -le 1000) + $Filtered = Apply-CippQuarantinePostFilters -Messages $AllMessages -PostFilters $Query.PostFilters + $Metadata = [PSCustomObject]@{ + appliedFilters = $Query.AppliedFilters + fetchAll = $true + HasPostFilters = ($Query.PostFilters.Count -gt 0) + RawRowsScanned = $AllMessages.Count + FilteredRowsReturned = @($Filtered).Count + PostFilterPaginationLimited = $false } - $AllMessages + $Filtered } } else { $Table = Get-CIPPTable -TableName cacheQuarantineMessages @@ -55,14 +70,12 @@ function Invoke-ListMailQuarantine { $Rows = Get-CIPPAzDataTableEntity @Table -filter $Filter $QueueReference = '{0}-{1}' -f $TenantFilter, $PartitionKey $RunningQueue = Get-CIPPQueueData -Reference $QueueReference | Where-Object { $_.Status -notmatch 'Completed' -and $_.Status -notmatch 'Failed' } - # If a queue is running, we will not start a new one if ($RunningQueue) { $Metadata = [PSCustomObject]@{ QueueMessage = 'Still loading data for all tenants. Please check back in a few more minutes' QueueId = $RunningQueue.RowKey } } elseif (!$Rows -and !$RunningQueue) { - # If no rows are found and no queue is running, we will start a new one $TenantList = Get-Tenants -IncludeErrors $Queue = New-CippQueueEntry -Name 'Mail Quarantine - All Tenants' -Reference $QueueReference -TotalTasks ($TenantList | Measure-Object).Count $Metadata = [PSCustomObject]@{ @@ -89,25 +102,36 @@ function Invoke-ListMailQuarantine { $Messages = $Rows | Select-CippAllowedTenantData -TenantProperty 'Tenant' foreach ($message in $Messages) { $messageObj = $message.QuarantineMessage | ConvertFrom-Json - # Older cache rows predate EntityType support and only contain Email entries - if (($messageObj.EntityType ?? 'Email') -ne $EntityType) { continue } $messageObj | Add-Member -NotePropertyName 'Tenant' -NotePropertyValue $message.Tenant -Force $messageObj } } } - $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + # Only report 403 for actual authorization failures; throttling and other + # transient errors were previously mislabelled as Forbidden, which stops + # clients and monitoring from treating them as retryable. + $StatusCode = if ($ErrorMessage -match 'not authorized|access.*denied|unauthorized|permission') { + [HttpStatusCode]::Forbidden + } else { + [HttpStatusCode]::InternalServerError + } $GraphRequest = $ErrorMessage + $Metadata = $null } - if (!$body) { - $StatusCode = [HttpStatusCode]::OK - $body = [PSCustomObject]@{ - Results = @($GraphRequest | Where-Object -Property Identity -NE $null | Sort-Object -Property ReceivedTime -Descending ) - Metadata = $Metadata + if ($null -eq $body) { + if ($StatusCode -eq [HttpStatusCode]::OK) { + $body = [PSCustomObject]@{ + Results = @($GraphRequest | Where-Object { $_.Identity -ne $null } | ConvertTo-CippQuarantineDisplayObject | Sort-Object -Property ReceivedTime -Descending) + Metadata = $Metadata + } + } else { + $body = [PSCustomObject]@{ + Results = $GraphRequest + Metadata = $Metadata + } } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessage.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessage.ps1 index 728846b4e4..8d72d0b92e 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessage.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessage.ps1 @@ -27,7 +27,7 @@ function Invoke-ListMailQuarantineMessage { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $Body = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessageHeader.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessageHeader.ps1 index 0abdc752cf..0477472ecb 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessageHeader.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessageHeader.ps1 @@ -24,7 +24,7 @@ function Invoke-ListMailQuarantineMessageHeader { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $Body = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListSpamfilter.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListSpamfilter.ps1 index 85332ac2aa..4b93af0df5 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListSpamfilter.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListSpamfilter.ps1 @@ -18,7 +18,7 @@ Function Invoke-ListSpamfilter { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListTenantAllowBlockList.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListTenantAllowBlockList.ps1 index e4e9c53734..9ebda65b57 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListTenantAllowBlockList.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListTenantAllowBlockList.ps1 @@ -41,7 +41,7 @@ function Invoke-ListTenantAllowBlockList { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $Results = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListUserReportedMessage.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListUserReportedMessage.ps1 index 8db86ac0c7..1a2bfce141 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListUserReportedMessage.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListUserReportedMessage.ps1 @@ -14,9 +14,14 @@ function Invoke-ListUserReportedMessage { $InternetMessageId = $Request.Query.InternetMessageId $Mailboxes = @($Request.Query.RecipientEmail, $Request.Query.ReporterEmail) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Select-Object -Unique - try { - if ([string]::IsNullOrWhiteSpace($InternetMessageId)) { throw 'This submission has no Internet Message ID, so the message content cannot be retrieved.' } + if ([string]::IsNullOrWhiteSpace($InternetMessageId)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = 'This submission has no Internet Message ID, so the message content cannot be retrieved.' + }) + } + try { $EmlBase64 = $null $Source = $null $Errors = [System.Collections.Generic.List[string]]::new() @@ -59,7 +64,10 @@ function Invoke-ListUserReportedMessage { if (-not $EmlBase64) { $Detail = if ($Errors.Count -gt 0) { " ($($Errors -join ' | '))" } else { '' } - throw "The reported message could not be retrieved: it is not in quarantine and could not be read from the mailbox. Mailbox retrieval requires the Mail.Read Graph permission on the CIPP-SAM application.$Detail" + return ([HttpResponseContext]@{ + StatusCode = $Errors.Count -gt 0 ? [HttpStatusCode]::InternalServerError : [HttpStatusCode]::NotFound + Body = "The reported message could not be retrieved: it is not in quarantine and could not be read from the mailbox. Mailbox retrieval requires the Mail.Read Graph permission on the CIPP-SAM application.$Detail" + }) } $EmlContent = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($EmlBase64)) @@ -74,7 +82,7 @@ function Invoke-ListUserReportedMessage { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $Body = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListUserReportedMessages.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListUserReportedMessages.ps1 index 448cabeaeb..2baf39a047 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListUserReportedMessages.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListUserReportedMessages.ps1 @@ -53,7 +53,7 @@ function Invoke-ListUserReportedMessages { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $Body = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveConnectionfilterTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveConnectionfilterTemplate.ps1 index b95166053a..7e7ff77fa7 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveConnectionfilterTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveConnectionfilterTemplate.ps1 @@ -14,10 +14,24 @@ Function Invoke-RemoveConnectionfilterTemplate { $ID = $Request.body.ID try { - $Table = Get-CippTable -tablename 'templates' $SafeID = ConvertTo-CIPPODataFilterValue -Value $ID -Type Guid + } catch { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Failed to remove Connection Filter template: '$ID' is not a valid template ID." } + }) + } + + try { + $Table = Get-CippTable -tablename 'templates' $Filter = "PartitionKey eq 'ConnectionfilterTemplate' and RowKey eq '$SafeID'" $ClearRow = Get-CIPPAzDataTableEntity @Table -Filter $Filter -Property PartitionKey, RowKey + if (-not $ClearRow) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = @{ Results = "Connection Filter template with ID $ID not found." } + }) + } Remove-CIPPAzDataTableEntity -Force @Table -Entity $ClearRow $Result = "Removed Connection Filter template with ID $($ID)" Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev 'Info' @@ -26,7 +40,7 @@ Function Invoke-RemoveConnectionfilterTemplate { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to remove Connection Filter template with ID $ID. $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveQuarantinePolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveQuarantinePolicy.ps1 index 816ef2401e..eb9bb1f3cc 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveQuarantinePolicy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveQuarantinePolicy.ps1 @@ -29,7 +29,7 @@ Function Invoke-RemoveQuarantinePolicy { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to remove Quarantine policy '$($PolicyName)' - $($ErrorMessage.NormalizedError -replace '\|Microsoft.Exchange.Management.Tasks.ValidationException\|', '')" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } $StatusCode = [HttpStatusCode]::OK diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveSpamfilter.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveSpamfilter.ps1 index 1c5e5e019b..2139a1995c 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveSpamfilter.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveSpamfilter.ps1 @@ -30,7 +30,7 @@ Function Invoke-RemoveSpamfilter { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to delete Spam filter rule $($Name) - $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveSpamfilterTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveSpamfilterTemplate.ps1 index ef2f062498..0b928a61a2 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveSpamfilterTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveSpamfilterTemplate.ps1 @@ -14,10 +14,24 @@ Function Invoke-RemoveSpamfilterTemplate { $ID = $Request.Body.ID try { - $Table = Get-CippTable -tablename 'templates' $SafeID = ConvertTo-CIPPODataFilterValue -Value $ID -Type Guid + } catch { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Failed to remove Spam filter template: '$ID' is not a valid template ID." } + }) + } + + try { + $Table = Get-CippTable -tablename 'templates' $Filter = "PartitionKey eq 'SpamfilterTemplate' and RowKey eq '$SafeID'" $ClearRow = Get-CIPPAzDataTableEntity @Table -Filter $Filter -Property PartitionKey, RowKey + if (-not $ClearRow) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = @{ Results = "Spam filter template with ID $ID not found." } + }) + } Remove-CIPPAzDataTableEntity -Force @Table -Entity $ClearRow $Result = "Removed Spamfilter template with ID $ID" Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev 'Info' @@ -26,7 +40,7 @@ Function Invoke-RemoveSpamfilterTemplate { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to remove Spam filter Rule template $ID. $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveTenantAllowBlockList.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveTenantAllowBlockList.ps1 index 0db47ce4dd..b7d72f5c76 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveTenantAllowBlockList.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveTenantAllowBlockList.ps1 @@ -39,7 +39,7 @@ function Invoke-RemoveTenantAllowBlockList { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to remove $($Entries) type $ListType. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveTenantAllowBlockListTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveTenantAllowBlockListTemplate.ps1 index fd4be24f76..cee68d4dfc 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveTenantAllowBlockListTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-RemoveTenantAllowBlockListTemplate.ps1 @@ -14,10 +14,24 @@ Function Invoke-RemoveTenantAllowBlockListTemplate { $ID = $Request.query.ID ?? $Request.body.ID try { - $Table = Get-CippTable -tablename 'templates' $SafeID = ConvertTo-CIPPODataFilterValue -Value $ID -Type Guid + } catch { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Failed to remove Tenant Allow/Block List template: '$ID' is not a valid template ID." } + }) + } + + try { + $Table = Get-CippTable -tablename 'templates' $Filter = "PartitionKey eq 'TenantAllowBlockListTemplate' and RowKey eq '$SafeID'" $ClearRow = Get-CIPPAzDataTableEntity @Table -Filter $Filter -Property PartitionKey, RowKey + if (-not $ClearRow) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = @{ Results = "Tenant Allow/Block List template with ID $ID not found." } + }) + } Remove-CIPPAzDataTableEntity -Force @Table -Entity $ClearRow $Result = "Removed Tenant Allow/Block List Template with ID $ID." Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev Info @@ -26,7 +40,7 @@ Function Invoke-RemoveTenantAllowBlockListTemplate { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to remove Tenant Allow/Block List Template with ID $ID. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecEmailTroubleshoot.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecEmailTroubleshoot.ps1 new file mode 100644 index 0000000000..03b70f53b0 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecEmailTroubleshoot.ps1 @@ -0,0 +1,131 @@ +function Invoke-ExecEmailTroubleshoot { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Exchange.TransportRule.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $TenantFilter = $Request.Body.tenantFilter + + $TraceResults = @() + $QuarantineResults = @() + $TraceError = $null + $QuarantineError = $null + + $TraceParams = @{} + if ($Request.Body.messageId) { + $TraceParams['MessageId'] = $Request.Body.messageId + } else { + if ($Request.Body.days) { + $TraceParams['StartDate'] = (Get-Date).AddDays(-[int]$Request.Body.days).ToUniversalTime().ToString('s') + $TraceParams['EndDate'] = (Get-Date).ToUniversalTime().ToString('s') + } elseif ($Request.Body.startDate) { + if ($Request.Body.startDate -match '^\d+$') { + $TraceParams['StartDate'] = [DateTimeOffset]::FromUnixTimeSeconds([int64]$Request.Body.startDate).UtcDateTime.ToString('s') + } else { + $TraceParams['StartDate'] = $Request.Body.startDate + } + if ($Request.Body.endDate) { + if ($Request.Body.endDate -match '^\d+$') { + $TraceParams['EndDate'] = [DateTimeOffset]::FromUnixTimeSeconds([int64]$Request.Body.endDate).UtcDateTime.ToString('s') + } else { + $TraceParams['EndDate'] = $Request.Body.endDate + } + } + } + + if ($Request.Body.status) { + $StatusValue = if ($Request.Body.status.value) { $Request.Body.status.value } else { $Request.Body.status } + if ($StatusValue -is [array]) { $StatusValue = $StatusValue[0] } + $TraceParams['Status'] = $StatusValue + } + if (![string]::IsNullOrEmpty($Request.Body.fromIP)) { + $TraceParams['FromIP'] = $Request.Body.fromIP + } + if (![string]::IsNullOrEmpty($Request.Body.toIP)) { + $TraceParams['ToIP'] = $Request.Body.toIP + } + } + + $SenderValue = if ($Request.Body.sender) { + $s = $Request.Body.sender + if ($s -is [array]) { ($s[0].value ?? $s[0]) } else { $s.value ?? $s } + } else { $null } + + $RecipientValue = if ($Request.Body.recipient) { + $r = $Request.Body.recipient + if ($r -is [array]) { ($r[0].value ?? $r[0]) } else { $r.value ?? $r } + } else { $null } + + $SenderApi = if ($SenderValue) { $SenderValue -replace '#', '%23' } else { $null } + $RecipientApi = if ($RecipientValue) { $RecipientValue -replace '#', '%23' } else { $null } + + if ($SenderApi) { $TraceParams['SenderAddress'] = $SenderApi } + if ($RecipientApi) { $TraceParams['RecipientAddress'] = $RecipientApi } + + try { + $TraceResults = @(New-ExoRequest -TenantId $TenantFilter -Cmdlet 'Get-MessageTraceV2' -CmdParams $TraceParams | + Select-Object MessageTraceId, MessageId, Status, Subject, RecipientAddress, SenderAddress, + @{ Name = 'Received'; Expression = { $_.Received.ToString('u') } }, FromIP, ToIP) + Write-LogMessage -headers $Request.Headers -API $APIName -tenant $TenantFilter -message 'Executed message trace via troubleshooter' -Sev 'Info' + } catch { + $TraceError = "Message trace failed: $((Get-CippException -Exception $_).NormalizedError)" + Write-LogMessage -headers $Request.Headers -API $APIName -tenant $TenantFilter -message "Message trace failed: $($_.Exception.Message)" -Sev 'Error' + } + + $QuarantineInput = @{ + days = $Request.Body.days + startDate = $Request.Body.startDate + endDate = $Request.Body.endDate + sender = $Request.Body.sender + recipient = $Request.Body.recipient + messageId = $Request.Body.messageId + subject = $Request.Body.subject + subjectExact = $Request.Body.subjectExact + quarantineType = $Request.Body.quarantineType + releaseStatus = $Request.Body.releaseStatus + policyTypes = $Request.Body.policyTypes + policyName = $Request.Body.policyName + senderDomain = $Request.Body.senderDomain + recipientDomain = $Request.Body.recipientDomain + pageSize = 1000 + } + + try { + $ApplyDefaultDate = -not $Request.Body.messageId + $Query = Build-CIPPQuarantineQueryParams -QueryInput $QuarantineInput -ApplyDefaultDateRange:$ApplyDefaultDate + $RawResults = @(Invoke-CippQuarantineExoRequest -TenantId $TenantFilter -Cmdlet 'Get-QuarantineMessage' -CmdParams $Query.CmdParams | + Select-Object -ExcludeProperty *data.type*) + $Filtered = Apply-CippQuarantinePostFilters -Messages $RawResults -PostFilters $Query.PostFilters + $QuarantineResults = @($Filtered | ConvertTo-CippQuarantineDisplayObject) + } catch { + $QuarantineError = "Quarantine search failed: $((Get-CippException -Exception $_).NormalizedError)" + if ($_.Exception.Message -match 'is not recognized') { + $QuarantineError += " Quarantine access requires the SAM user to hold a role that includes Exchange quarantine permissions in this tenant - typically the Security Administrator GDAP role (or an Exchange role group containing the Quarantine role). If the standalone Quarantine Management page works for this tenant, this was a transient Exchange Online error - run the search again." + } + Write-LogMessage -headers $Request.Headers -API $APIName -tenant $TenantFilter -message "Quarantine search failed: $($_.Exception.Message)" -Sev 'Error' + } + + $Body = @{ + Results = @{ + MessageTrace = $TraceResults + Quarantine = $QuarantineResults + TraceError = $TraceError + QuarantineError = $QuarantineError + Summary = @{ + traceCount = $TraceResults.Count + quarantineCount = $QuarantineResults.Count + quarantineUnreleased = @($QuarantineResults | Where-Object { $_.ReleaseStatus -ne 'RELEASED' }).Count + } + } + } + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecMailTest.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecMailTest.ps1 index 7f72cbd5e2..44817caf9c 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecMailTest.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecMailTest.ps1 @@ -73,7 +73,7 @@ Function Invoke-ExecMailTest { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError $Body = [PSCustomObject]@{ Results = @($ErrorMessage) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecMailboxRestore.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecMailboxRestore.ps1 index 52aa78859e..edfc6e8f5e 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecMailboxRestore.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecMailboxRestore.ps1 @@ -119,7 +119,7 @@ function Invoke-ExecMailboxRestore { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to $($Action ?? 'create') mailbox restore request: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::OK + $StatusCode = [HttpStatusCode]::InternalServerError $Body = @{ RestoreRequest = $null Results = @($ErrorMessage.NormalizedError) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListExoRequest.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListExoRequest.ps1 index d2ea8c0143..3e8e999d9a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListExoRequest.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListExoRequest.ps1 @@ -8,6 +8,7 @@ function Invoke-ListExoRequest { Executes an arbitrary read-only Exchange Online cmdlet (Get-* or Search-*) for a tenant. Accepts cmdlet name and parameters in the request body. #> param($Request, $TriggerMetadata) + $StatusCode = [HttpStatusCode]::OK try { $AllowedVerbs = @( 'Get' @@ -89,13 +90,18 @@ function Invoke-ListExoRequest { $Body = [pscustomobject]@{ Results = @(@{ Error = $ErrorMessage }) } + $StatusCode = [HttpStatusCode]::InternalServerError } } } catch { Write-Information "ExoRequest Error: $($_.Exception.Message)" + $Body = [pscustomobject]@{ + Results = @(@{ Error = (Get-NormalizedError -Message $_.Exception.Message) }) + } + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = ConvertTo-Json -InputObject $Body -Compress }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListMailboxRestores.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListMailboxRestores.ps1 index 0c4c705c84..2e5aa64682 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListMailboxRestores.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListMailboxRestores.ps1 @@ -36,7 +36,7 @@ function Invoke-ListMailboxRestores { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListMessageTrace.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListMessageTrace.ps1 index b8fde5f6af..f4e0607f86 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListMessageTrace.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListMessageTrace.ps1 @@ -25,9 +25,9 @@ function Invoke-ListMessageTrace { # Escape a value for an OData string literal (single quotes are doubled). function ConvertTo-ODataLiteral { param([string]$Value) return ($Value -replace "'", "''") } - # Runs the Graph scriptblock; on a missing service principal or a consent/permission error it - # provisions the SP (best effort) and runs the Get-MessageTraceV2 scriptblock instead, so the - # first call in a tenant still returns data while Graph activates. + # Runs the Graph scriptblock, falling back to the Get-MessageTraceV2 scriptblock when the service + # principal is missing (provisioned best effort), consent is missing, or Graph does not serve the + # tenant's cloud, so the call still returns data. $RunWithFallback = { param($GraphBlock, $V2Block) try { @@ -36,7 +36,9 @@ function Invoke-ListMessageTrace { $Message = $_.Exception.Message $SpMissing = $Message -match $TransportAppId -or $Message -match 'service principal' $Consent = $Message -match 'Authorization_RequestDenied' -or $Message -match 'insufficient' -or $Message -match 'consent' -or $Message -match 'Forbidden' -or $Message -match 'AADSTS' - if ($SpMissing -or $Consent) { + # Graph message trace is not offered in GCC; Get-MessageTraceV2 is. + $Unsupported = $Message -match 'not currently supported' -or $Message -match '\bGCC\b' + if ($SpMissing -or $Consent -or $Unsupported) { # Provision the SP only when it is genuinely absent. Once created it can still take # hours to activate, during which Graph keeps reporting it missing - checking first # avoids re-issuing (and log-spamming) a create that would fail as 'already in use'. diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddConnectionFilter.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddConnectionFilter.ps1 index 831d2de880..918fbf13a5 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddConnectionFilter.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddConnectionFilter.ps1 @@ -18,12 +18,14 @@ Function Invoke-AddConnectionFilter { Select-Object -Property *, @{Name = 'identity'; Expression = { $_.name } } -ExcludeProperty GUID, comments, name $Tenants = ($Request.Body.selectedTenants).value + $Failed = 0 $Result = foreach ($TenantFilter in $Tenants) { try { $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Set-HostedConnectionFilterPolicy' -cmdParams $RequestParams "Successfully created Connection filter for $TenantFilter." Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Successfully created Connection filter for $TenantFilter." -sev Info } catch { + $Failed++ $ErrorMessage = Get-CippException -Exception $_ "Failed to create Connection Filter rule for $($TenantFilter): $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to create connection filter rule for $($TenantFilter): $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage @@ -31,7 +33,7 @@ Function Invoke-AddConnectionFilter { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = Get-CippBulkStatusCode -Total @($Tenants).Count -Failed $Failed Body = @{Results = @($Result) } }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddExConnector.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddExConnector.ps1 index e18a1292a9..60ad35803b 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddExConnector.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddExConnector.ps1 @@ -26,6 +26,7 @@ function Invoke-AddExConnector { $Tenants = $Tenants | Where-Object { $_ -in $AllowedTenantList.defaultDomainName } } + $Failed = 0 $Result = foreach ($TenantFilter in $Tenants) { try { # Copy per tenant so one tenant's resolved %variable% values never feed the next tenant's replacement. @@ -37,6 +38,7 @@ function Invoke-AddExConnector { "Successfully created Connector for $TenantFilter." Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Successfully created Connector for $TenantFilter." -sev 'Info' } catch { + $Failed++ $ErrorMessage = Get-CippException -Exception $_ "Could not create Connector for $($TenantFilter): $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Could not create Connector for $($TenantFilter): $($ErrorMessage.NormalizedError)" -sev 'Error' @@ -44,7 +46,7 @@ function Invoke-AddExConnector { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = Get-CippBulkStatusCode -Total @($Tenants).Count -Failed $Failed Body = @{Results = @($Result) } }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddTransportRule.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddTransportRule.ps1 index 7ca227be0d..8766aea56f 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddTransportRule.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddTransportRule.ps1 @@ -27,6 +27,7 @@ function Invoke-AddTransportRule { $Tenants = $Tenants | Where-Object { $_ -in $AllowedTenantList.defaultDomainName } } + $Failed = 0 $Result = foreach ($tenantFilter in $tenants) { $Existing = New-ExoRequest -ErrorAction SilentlyContinue -tenantid $tenantFilter -cmdlet 'Get-TransportRule' -useSystemMailbox $true | Where-Object -Property Identity -EQ $RequestParams.name try { @@ -43,6 +44,7 @@ function Invoke-AddTransportRule { Write-LogMessage -Headers $ExecutingUser -API $APINAME -tenant $tenantFilter -message "Created transport rule for $($tenantFilter)" -sev Info } catch { + $Failed++ $ErrorMessage = Get-CippException -Exception $_ "Could not create transport rule for $($tenantFilter): $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $ExecutingUser -API $APINAME -tenant $tenantFilter -message "Could not create transport rule for $($tenantFilter). Error:$($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage @@ -50,7 +52,7 @@ function Invoke-AddTransportRule { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = Get-CippBulkStatusCode -Total @($Tenants).Count -Failed $Failed Body = @{Results = @($Result) } }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-EditExConnector.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-EditExConnector.ps1 index 7fbf704e72..c7f01a87eb 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-EditExConnector.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-EditExConnector.ps1 @@ -29,7 +29,7 @@ function Invoke-EditExConnector { $ErrorMessage = Get-CIPPException -Exception $_ Write-LogMessage -Headers $Headers -API $APINAME -tenant $TenantFilter -message "Failed setting Connector $($Guid) to $($ConnectorState). Error:$($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage $Result = $ErrorMessage.NormalizedError - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-EditTransportRule.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-EditTransportRule.ps1 index 4413fdb33d..1228f0911c 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-EditTransportRule.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-EditTransportRule.ps1 @@ -30,7 +30,7 @@ function Invoke-EditTransportRule { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -Headers $Headers -API $APINAME -tenant $TenantFilter -message "Failed setting transport rule $($Identity) to $($State). Error:$($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage $Result = $ErrorMessage.NormalizedError - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-ListExchangeConnectors.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-ListExchangeConnectors.ps1 index abda27d473..3caf59667d 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-ListExchangeConnectors.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-ListExchangeConnectors.ps1 @@ -17,7 +17,7 @@ function Invoke-ListExchangeConnectors { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-ListTransportRules.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-ListTransportRules.ps1 index 5d78419bac..1c2f740604 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-ListTransportRules.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-ListTransportRules.ps1 @@ -4,8 +4,6 @@ function Invoke-ListTransportRules { Entrypoint .ROLE Exchange.TransportRule.Read - .DESCRIPTION - Lists mail flow (transport) rules configured in Exchange Online, with optional detailed view by rule ID. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -75,7 +73,7 @@ function Invoke-ListTransportRules { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $Body = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-RemoveExConnector.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-RemoveExConnector.ps1 index 3c04f8c45c..be414abf1b 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-RemoveExConnector.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-RemoveExConnector.ps1 @@ -26,7 +26,7 @@ Function Invoke-RemoveExConnector { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed deleting connector $($Guid). Error:$($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage $Result = $ErrorMessage.NormalizedError - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-RemoveTransportRule.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-RemoveTransportRule.ps1 index c23a158f78..605d8e735b 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-RemoveTransportRule.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-RemoveTransportRule.ps1 @@ -29,7 +29,7 @@ Function Invoke-RemoveTransportRule { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed deleting transport rule $($Identity). Error:$($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage $Result = $ErrorMessage.NormalizedError - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-RemoveTransportRuleTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-RemoveTransportRuleTemplate.ps1 index 069d6deb7f..ced3271eb4 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-RemoveTransportRuleTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-RemoveTransportRuleTemplate.ps1 @@ -13,11 +13,24 @@ function Invoke-RemoveTransportRuleTemplate { Write-LogMessage -Headers $User -API $APINAME -message 'Accessed this API' -Sev 'Debug' $ID = $request.query.ID ?? $request.body.ID + if (-not $ID) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'Failed to remove Transport Rule template: ID is required.' } + }) + } + try { $Table = Get-CippTable -tablename 'templates' $SafeID = ConvertTo-CIPPODataFilterValue -Value $ID -Type String $Filter = "PartitionKey eq 'TransportTemplate' and RowKey eq '$SafeID'" $ClearRow = Get-CIPPAzDataTableEntity @Table -Filter $Filter -Property PartitionKey, RowKey + if (-not $ClearRow) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = @{ Results = "Transport Rule template with ID $ID not found." } + }) + } Remove-CIPPAzDataTableEntity -Force @Table -Entity $ClearRow $Result = "Removed Transport Rule Template with ID $ID." Write-LogMessage -Headers $User -API $APINAME -message $Result -Sev 'Info' @@ -26,7 +39,7 @@ function Invoke-RemoveTransportRuleTemplate { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to remove Transport Rule template with ID $ID. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $User -API $APINAME -message $Result -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddEdgeApp.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddEdgeApp.ps1 index 0a5c502505..fc4cac3df5 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddEdgeApp.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddEdgeApp.ps1 @@ -19,6 +19,7 @@ function Invoke-AddEdgeApp { $GroupIds = @($Request.Body.GroupIds | Where-Object { $_ }) $ExcludeGroupIds = @($Request.Body.ExcludeGroupIds | Where-Object { $_ }) + $Failed = 0 $Results = foreach ($Tenant in $Tenants) { try { $ExistingEdge = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/deviceAppManagement/mobileApps' -tenantid $Tenant | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.windowsMicrosoftEdgeApp' } @@ -51,6 +52,7 @@ function Invoke-AddEdgeApp { } "Successfully added Edge App for $($Tenant)" } catch { + $Failed++ $ErrorMessage = Get-CippException -Exception $_ "Failed to add Edge App for $($Tenant): $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -tenant $($Tenant) -message "Failed to add Edge App. Error: $($ErrorMessage.NormalizedError)" -Sev 'Error' -Logdata $ErrorMessage @@ -59,7 +61,7 @@ function Invoke-AddEdgeApp { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = Get-CippBulkStatusCode -Total @($Tenants).Count -Failed $Failed Body = @{'Results' = $Results } }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1 index 958819fa4d..08cfe14f6a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1 @@ -20,6 +20,7 @@ function Invoke-AddOfficeApp { $GroupIds = @($Request.Body.GroupIds | Where-Object { $_ }) $ExcludeGroupIds = @($Request.Body.ExcludeGroupIds | Where-Object { $_ }) + $Failed = 0 $Results = foreach ($Tenant in $Tenants) { try { # Office is a singleton per tenant, so match on the type rather than on a display name @@ -54,6 +55,7 @@ function Invoke-AddOfficeApp { } "Successfully added Office App for $($Tenant)" } catch { + $Failed++ $ErrorMessage = Get-CippException -Exception $_ "Failed to add Office App for $($Tenant): $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -tenant $($Tenant) -message "Failed to add Office App. Error: $($ErrorMessage.NormalizedError)" -Sev 'Error' -Logdata $ErrorMessage @@ -63,7 +65,7 @@ function Invoke-AddOfficeApp { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = Get-CippBulkStatusCode -Total @($Tenants).Count -Failed $Failed Body = @{'Results' = $Results } }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddWin32ScriptApp.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddWin32ScriptApp.ps1 index 0ab6ebf418..aa3b69b556 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddWin32ScriptApp.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddWin32ScriptApp.ps1 @@ -40,6 +40,7 @@ function Invoke-AddWin32ScriptApp { $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList $Tenants = ($Request.Body.selectedTenants | Where-Object { $AllowedTenants -contains $_.customerId -or $AllowedTenants -contains 'AllTenants' }).defaultDomainName + $Failed = 0 $Results = foreach ($Tenant in $Tenants) { try { $CompleteObject = [PSCustomObject]@{ @@ -75,6 +76,7 @@ function Invoke-AddWin32ScriptApp { "Successfully added Win32 Script App for $($Tenant) to queue." Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message "Successfully added Win32 Script App $AppName to queue" -Sev 'Info' } catch { + $Failed++ Write-LogMessage -headers $Headers -API $APIName -tenant $Tenant -message "Failed to add Win32 Script App $AppName to queue. Error: $($_.Exception.Message)" -Sev 'Error' "Failed to add Win32 Script App for $($Tenant) to queue: $($_.Exception.Message)" } @@ -83,7 +85,7 @@ function Invoke-AddWin32ScriptApp { $body = [PSCustomObject]@{ 'Results' = $Results } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = Get-CippBulkStatusCode -Total @($Tenants).Count -Failed $Failed Body = $body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ExecAppUpload.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ExecAppUpload.ps1 index 3e555a1369..3da962d40f 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ExecAppUpload.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ExecAppUpload.ps1 @@ -12,12 +12,14 @@ function Invoke-ExecAppUpload { # Start the orchestrator directly - it handles queuing internally Start-ApplicationOrchestrator $Results = [pscustomobject]@{'Results' = 'Application upload job has started. Track the logbook for results.' } + $StatusCode = [HttpStatusCode]::OK } catch { $Results = [pscustomobject]@{'Results' = "Failed to start application upload. Error: $($_.Exception.Message)" } + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Results }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ExecDeployAppTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ExecDeployAppTemplate.ps1 index 75aa395bc5..577e46723d 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ExecDeployAppTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ExecDeployAppTemplate.ps1 @@ -13,12 +13,16 @@ function Invoke-ExecDeployAppTemplate { try { $TemplateId = $Request.Body.templateId - if (!$TemplateId) { throw 'No template ID provided' } + if (!$TemplateId) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ Results = @('Failed to deploy app template: No template ID provided') } }) + } $Table = Get-CippTable -tablename 'templates' $Filter = "PartitionKey eq 'AppTemplate' and RowKey eq '$TemplateId'" $TemplateEntity = Get-CIPPAzDataTableEntity @Table -Filter $Filter - if (!$TemplateEntity) { throw 'Template not found' } + if (!$TemplateEntity) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::NotFound; Body = @{ Results = @('Failed to deploy app template: Template not found') } }) + } $TemplateData = $TemplateEntity.JSON | ConvertFrom-Json -Depth 100 $AppsRaw = $TemplateData.Apps @@ -47,11 +51,17 @@ function Invoke-ExecDeployAppTemplate { $OverrideAssignTo = $Request.Body.AssignTo $OverrideCustomGroup = $Request.Body.customGroup + $Failed = 0 $Results = foreach ($App in $Apps) { try { $Config = $App.config if ($Config -is [string]) { - $Config = $Config | ConvertFrom-CippAppConfig + # Parse case-sensitive to survive templates carrying both 'applicationName' + # and 'ApplicationName', then collapse them via a case-insensitive dictionary. + $Parsed = $Config | ConvertFrom-Json -Depth 100 -AsHashtable + $Config = [ordered]@{} + foreach ($Key in $Parsed.Keys) { $Config[$Key] = $Parsed[$Key] } + $Config = [PSCustomObject]$Config } $AppType = "$($App.appType ?? $App.AppType)" @@ -100,21 +110,23 @@ function Invoke-ExecDeployAppTemplate { Write-LogMessage -headers $Headers -API $APIName -message "Deployed app '$($App.appName)' ($AppType) from template $TemplateId" -Sev 'Info' $DeployedResult } else { + $Failed++ $FailureText = "Failed to deploy app '$($App.appName)' ($AppType) from template $($TemplateId): $($DeployedResult -join '; ')" Write-LogMessage -headers $Headers -API $APIName -message $FailureText -Sev 'Error' $FailureText } } catch { + $Failed++ $ErrorMessage = Get-CippException -Exception $_ - "Failed '$($App.appName)': $($ErrorMessage.NormalizedError)" - Write-LogMessage -headers $Headers -API $APIName -message "Failed to deploy app '$($App.appName)' from template: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + "Failed '$($App.appName)': $($ErrorMessage.NormalizedMessage)" + Write-LogMessage -headers $Headers -API $APIName -message "Failed to deploy app '$($App.appName)' from template: $($ErrorMessage.NormalizedMessage)" -Sev 'Error' -LogData $ErrorMessage } } - $StatusCode = [HttpStatusCode]::OK + $StatusCode = Get-CippBulkStatusCode -Total $Apps.Count -Failed $Failed } catch { $ErrorMessage = Get-CippException -Exception $_ - $Results = "Failed to deploy app template: $($ErrorMessage.NormalizedError)" + $Results = "Failed to deploy app template: $($ErrorMessage.NormalizedMessage)" Write-LogMessage -headers $Headers -API $APIName -message $Results -Sev 'Error' -LogData $ErrorMessage $StatusCode = [HttpStatusCode]::InternalServerError } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ExecSyncVPP.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ExecSyncVPP.ps1 index d94b31cad9..91a3eab64f 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ExecSyncVPP.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ExecSyncVPP.ps1 @@ -32,7 +32,7 @@ function Invoke-ExecSyncVPP { $ErrorMessage = Get-CippException -Exception $_ $Result = 'Failed to start VPP sync' Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListAppStatus.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListAppStatus.ps1 index be44eaaa37..0b42ac14be 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListAppStatus.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListAppStatus.ps1 @@ -21,7 +21,7 @@ Function Invoke-ListAppStatus { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListApplicationQueue.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListApplicationQueue.ps1 index 67b6c2cad1..6f6cbb2c35 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListApplicationQueue.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListApplicationQueue.ps1 @@ -4,13 +4,11 @@ Function Invoke-ListApplicationQueue { Entrypoint .ROLE Endpoint.Application.Read - .DESCRIPTION - Lists queued Intune application deployments that are pending assignment to tenants. #> [CmdletBinding()] param($Request, $TriggerMetadata) $Table = Get-CippTable -tablename 'apps' - $QueuedApps = (Get-CIPPAzDataTableEntity @Table) + $QueuedApps = (Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'apps'") $CurrentApps = foreach ($QueueFile in $QueuedApps) { Write-Host $QueueFile diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListApps.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListApps.ps1 index 258e9f032f..16e1ccd185 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListApps.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListApps.ps1 @@ -4,30 +4,12 @@ function Invoke-ListApps { Entrypoint .ROLE Endpoint.Application.Read - .DESCRIPTION - Lists Intune managed applications for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants. #> [CmdletBinding()] param($Request, $TriggerMetadata) # Interact with query parameters or the body of the request. $TenantFilter = $Request.Query.TenantFilter - # Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants. - $UseReportDB = $Request.Query.UseReportDB -eq $true try { - if ($TenantFilter -eq 'AllTenants' -or $UseReportDB) { - try { - $GraphRequest = Get-CIPPIntuneApplicationReport -TenantFilter $TenantFilter -ErrorAction Stop - $StatusCode = [HttpStatusCode]::OK - } catch { - $StatusCode = [HttpStatusCode]::InternalServerError - $GraphRequest = $_.Exception.Message - } - return ([HttpResponseContext]@{ - StatusCode = $StatusCode - Body = @($GraphRequest) - }) - } - # Use bulk requests to get groups and apps with assignments $BulkRequests = @( @{ @@ -84,7 +66,7 @@ function Invoke-ListApps { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListAppsRepository.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListAppsRepository.ps1 index 6c3da70cc6..a1d3b82a31 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListAppsRepository.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListAppsRepository.ps1 @@ -14,6 +14,7 @@ Function Invoke-ListAppsRepository { $Packages = @() $Message = '' $IsError = $false + $StatusCode = [HttpStatusCode]::OK try { if (!([string]::IsNullOrEmpty($Search))) { @@ -46,10 +47,12 @@ Function Invoke-ListAppsRepository { } else { $IsError = $true $Message = 'No search terms specified' + $StatusCode = [HttpStatusCode]::BadRequest } } catch { $IsError = $true $Message = "Repository error: $($_.Exception.Message)" + $StatusCode = [HttpStatusCode]::InternalServerError } $PackageSearch = @{ @@ -60,7 +63,7 @@ Function Invoke-ListAppsRepository { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $PackageSearch }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListDetectedAppDevices.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListDetectedAppDevices.ps1 index 0798fb24b9..7a030d60b2 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListDetectedAppDevices.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListDetectedAppDevices.ps1 @@ -31,7 +31,7 @@ function Invoke-ListDetectedAppDevices { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::OK + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListDetectedApps.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListDetectedApps.ps1 index e3e72c27df..6d85c56ea4 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListDetectedApps.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListDetectedApps.ps1 @@ -70,7 +70,7 @@ function Invoke-ListDetectedApps { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::OK + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-RemoveAppTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-RemoveAppTemplate.ps1 index 034259c78e..23bab28a6f 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-RemoveAppTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-RemoveAppTemplate.ps1 @@ -29,7 +29,7 @@ function Invoke-RemoveAppTemplate { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-CippException -Exception $_ - $Result = "Failed to remove app template: $($ErrorMessage.NormalizedError)" + $Result = "Failed to remove app template: $($ErrorMessage.NormalizedMessage)" Write-LogMessage -headers $Headers -API $APIName -message $Result -Sev 'Error' -LogData $ErrorMessage $StatusCode = [HttpStatusCode]::InternalServerError } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-RemoveQueuedApp.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-RemoveQueuedApp.ps1 index 82e296c621..0f70c92125 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-RemoveQueuedApp.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-RemoveQueuedApp.ps1 @@ -13,10 +13,23 @@ function Invoke-RemoveQueuedApp { $APIName = $Request.Params.CIPPEndpoint $ID = $request.body.ID try { - $Table = Get-CippTable -tablename 'apps' $SafeID = ConvertTo-CIPPODataFilterValue -Value $ID -Type Guid + } catch { + return [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = [pscustomobject]@{'Results' = "Failed to remove application queue for $ID. $($_.Exception.Message)" } + } + } + try { + $Table = Get-CippTable -tablename 'apps' $Filter = "PartitionKey eq 'apps' and RowKey eq '$SafeID'" $ClearRow = Get-CIPPAzDataTableEntity @Table -Filter $Filter -Property PartitionKey, RowKey + if (-not $ClearRow) { + return [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = [pscustomobject]@{'Results' = "Failed to remove application queue for $ID. Queued application not found." } + } + } Remove-CIPPAzDataTableEntity -Force @Table -Entity $ClearRow $Message = "Removed application queue for $ID." Write-LogMessage -Headers $Request.Headers -API $APIName -message $Message -Sev 'Info' @@ -25,7 +38,7 @@ function Invoke-RemoveQueuedApp { $ErrorMessage = Get-CippException -Exception $_ $Message = "Failed to remove application queue for $ID. $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Request.Headers -API $APIName -message $Message -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } $body = [pscustomobject]@{'Results' = $Message } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ExecAssignAPDevice.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ExecAssignAPDevice.ps1 index 16cb73c15e..d0c2da3c1c 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ExecAssignAPDevice.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ExecAssignAPDevice.ps1 @@ -29,7 +29,7 @@ Function Invoke-ExecAssignAPDevice { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -Headers $User -API $APINAME -message "Could not assign $($UserObject.userPrincipalName) to $($DeviceObject) for $($TenantFilter) Error: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage $Results = "Could not assign $($UserObject.userPrincipalName) to $($DeviceObject) for $($TenantFilter) Error: $($ErrorMessage.NormalizedError)" - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } $Results = [pscustomobject]@{'Results' = "$results" } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ExecRenameAPDevice.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ExecRenameAPDevice.ps1 index b545a48fca..f077b0f1d7 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ExecRenameAPDevice.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ExecRenameAPDevice.ps1 @@ -44,7 +44,7 @@ Function Invoke-ExecRenameAPDevice { $ErrorMessage = Get-CippException -Exception $_ $Result = "Could not rename device '$($DeviceId)' with serial number '$($SerialNumber)' to '$($DisplayName)'. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $User -API $APINAME -message $Result -Sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ExecSetAPDeviceGroupTag.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ExecSetAPDeviceGroupTag.ps1 index 28fa75a659..bbc95c5f2d 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ExecSetAPDeviceGroupTag.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ExecSetAPDeviceGroupTag.ps1 @@ -40,7 +40,7 @@ Function Invoke-ExecSetAPDeviceGroupTag { $ErrorMessage = Get-CippException -Exception $_ $Result = "Could not update group tag for device '$($DeviceId)' with serial number '$($SerialNumber)' to '$($GroupTag)'. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ExecSyncAPDevices.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ExecSyncAPDevices.ps1 index 81139053e0..7af3e8a172 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ExecSyncAPDevices.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ExecSyncAPDevices.ps1 @@ -21,7 +21,7 @@ Function Invoke-ExecSyncAPDevices { $ErrorMessage = Get-CippException -Exception $_ $Results = "Failed to start sync for $TenantFilter. Did you try syncing in the last 10 minutes?" Write-LogMessage -Headers $Headers -API $APINAME -tenant $TenantFilter -message 'Failed to start Autopilot sync. Did you try syncing in the last 10 minutes?' -Sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } $Results = [pscustomobject]@{'Results' = "$Results" } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ListAPDevices.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ListAPDevices.ps1 index 35cc7d437e..e906e41f22 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ListAPDevices.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ListAPDevices.ps1 @@ -16,7 +16,7 @@ Function Invoke-ListAPDevices { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ListAutopilotconfig.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ListAutopilotconfig.ps1 index f4ed9b6e08..0b4d0a8305 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ListAutopilotconfig.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ListAutopilotconfig.ps1 @@ -45,7 +45,7 @@ function Invoke-ListAutopilotconfig { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-AddAssignmentFilterTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-AddAssignmentFilterTemplate.ps1 index 3f8dbfa5a8..aa29287f60 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-AddAssignmentFilterTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-AddAssignmentFilterTemplate.ps1 @@ -12,19 +12,19 @@ function Invoke-AddAssignmentFilterTemplate { $GUID = $Request.Body.GUID ?? (New-Guid).GUID - try { - if (!$Request.Body.displayName) { - throw 'You must enter a displayname' - } + if (!$Request.Body.displayName) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ Results = 'Assignment Filter Template Creation failed: You must enter a displayname' } }) + } - if (!$Request.Body.rule) { - throw 'You must enter a filter rule' - } + if (!$Request.Body.rule) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ Results = 'Assignment Filter Template Creation failed: You must enter a filter rule' } }) + } - if (!$Request.Body.platform) { - throw 'You must select a platform' - } + if (!$Request.Body.platform) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ Results = 'Assignment Filter Template Creation failed: You must select a platform' } }) + } + try { # Normalize field names to handle different casing from various forms $displayName = $Request.Body.displayName ?? $Request.Body.Displayname ?? $Request.Body.displayname $description = $Request.Body.description ?? $Request.Body.Description @@ -50,14 +50,16 @@ function Invoke-AddAssignmentFilterTemplate { Write-LogMessage -headers $Request.Headers -API $APINAME -tenant 'Global' -message "Created Assignment Filter template named $displayName with GUID $GUID" -Sev 'Info' $body = [pscustomobject]@{'Results' = 'Successfully added template' } + $StatusCode = [HttpStatusCode]::OK } catch { Write-LogMessage -headers $Request.Headers -API $APINAME -tenant 'Global' -message "Assignment Filter Template Creation failed: $($_.Exception.Message)" -Sev 'Error' $body = [pscustomobject]@{'Results' = "Assignment Filter Template Creation failed: $($_.Exception.Message)" } + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $body }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-AddDefenderDeployment.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-AddDefenderDeployment.ps1 index dbc4518678..ddce9dd2ef 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-AddDefenderDeployment.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-AddDefenderDeployment.ps1 @@ -19,6 +19,7 @@ function Invoke-AddDefenderDeployment { $ASR = $Request.Body.ASR $EDR = $Request.Body.EDR + $Failed = 0 $Results = foreach ($tenant in $Tenants) { try { if ($Compliance) { @@ -37,6 +38,7 @@ function Invoke-AddDefenderDeployment { Set-CIPPDefenderExclusionPolicy -TenantFilter $tenant -DefenderExclusions $DefenderExclusions -Headers $Headers -APIName $APIName } } catch { + $Failed++ "Failed to add policy for $($tenant): $($_.Exception.Message)" Write-LogMessage -headers $Headers -API $APIName -tenant $tenant -message "Failed adding Defender policy. Error: $($_.Exception.Message)" -Sev 'Error' continue @@ -44,7 +46,7 @@ function Invoke-AddDefenderDeployment { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = Get-CippBulkStatusCode -Total @($Tenants).Count -Failed $Failed Body = @{'Results' = @($Results) } }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-AddPolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-AddPolicy.ps1 index 65de646191..070ea83a8a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-AddPolicy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-AddPolicy.ps1 @@ -33,6 +33,7 @@ function Invoke-AddPolicy { $Request.Body.customGroup ? ($AssignTo = $Request.Body.customGroup) : $null $RawJSON = $Request.Body.RAWJson + $Failed = 0 $Results = foreach ($Tenant in $Tenants) { if ($Request.Body.replacemap.$Tenant) { ([pscustomobject]$Request.Body.replacemap.$Tenant).PSObject.Properties | ForEach-Object { $RawJSON = $RawJSON -replace $_.name, $_.value } @@ -101,13 +102,14 @@ function Invoke-AddPolicy { Set-CIPPIntunePolicy @params } catch { + $Failed++ "$($_.Exception.Message)" continue } } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = Get-CippBulkStatusCode -Total @($Tenants).Count -Failed $Failed Body = @{'Results' = @($Results) } }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-EditIntunePolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-EditIntunePolicy.ps1 index 361e276009..40e9096164 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-EditIntunePolicy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-EditIntunePolicy.ps1 @@ -1,9 +1,9 @@ -function Invoke-EditIntunePolicy { +Function Invoke-EditIntunePolicy { <# .FUNCTIONALITY Entrypoint .ROLE - Endpoint.MEM.ReadWrite + Endpoint.MEM.Read #> [CmdletBinding()] param($Request, $TriggerMetadata) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-EditIntuneScript.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-EditIntuneScript.ps1 index 7c56fa60fd..4153d4ef3d 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-EditIntuneScript.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-EditIntuneScript.ps1 @@ -119,7 +119,7 @@ function Invoke-EditIntuneScript { $Result = "Failed to update Intune $scriptType script $($Request.Body.ScriptId): $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $Request.Body.TenantFilter -message $Result -Sev 'Error' -LogData $ErrorMessage return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest + StatusCode = [HttpStatusCode]::InternalServerError Body = "Failed to update script: $($ErrorMessage.NormalizedError)" }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-EditPolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-EditPolicy.ps1 index afcb20d450..f13c30a51e 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-EditPolicy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-EditPolicy.ps1 @@ -17,6 +17,7 @@ Function Invoke-EditPolicy { $description = $request.body.Description $AssignTo = if ($request.body.Assignto -ne 'on') { $request.body.Assignto } + $StatusCode = [HttpStatusCode]::OK $results = try { $CreateBody = '{"description":"' + $description + '","displayName":"' + $displayname + '","roleScopeTagIds":["0"]}' $Request = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations('$ID')" -tenantid $tenant -type PATCH -body $CreateBody @@ -31,13 +32,13 @@ Function Invoke-EditPolicy { catch { "Failed to add policy for $($Tenant): $($_.Exception.Message)" Write-LogMessage -headers $Request.Headers -API $APINAME -tenant $($Tenant) -message "Failed editing policy $($Displayname). Error:$($_.Exception.Message)" -Sev 'Error' - continue + $StatusCode = [HttpStatusCode]::InternalServerError } $body = [pscustomobject]@{'Results' = $results } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $body }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecCompareIntunePolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecCompareIntunePolicy.ps1 index 119d936a52..310b58539d 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecCompareIntunePolicy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecCompareIntunePolicy.ps1 @@ -4,8 +4,6 @@ function Invoke-ExecCompareIntunePolicy { Entrypoint,AnyTenant .ROLE Endpoint.MEM.Read - .DESCRIPTION - Compares an Intune policy against another policy or a stored template and returns the differences setting by setting. Handles device configurations, settings catalog policies, ADMX templates, compliance policies, driver/feature/quality update profiles, intents and app protection policies. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -28,24 +26,34 @@ function Invoke-ExecCompareIntunePolicy { 'ManagedAppPolicies' = 'AppProtection' } - try { - $Body = $Request.Body - $SourceA = $Body.sourceA - $SourceB = $Body.sourceB + $Body = $Request.Body + $SourceA = $Body.sourceA + $SourceB = $Body.sourceB - if (-not $SourceA -or -not $SourceB) { - throw 'Both sourceA and sourceB are required' - } + if (-not $SourceA -or -not $SourceB) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = ConvertTo-Json -InputObject @{ Results = 'Failed to compare policies: Both sourceA and sourceB are required' } + }) + } - # AnyTenant: source tenants must be in the caller's scope; Get-Tenants is narrowed - $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList - if ($AllowedTenants -notcontains 'AllTenants') { - foreach ($SourceTenant in @($SourceA.tenantFilter, $SourceB.tenantFilter)) { - if ($SourceTenant -and -not (Get-Tenants -TenantFilter $SourceTenant)) { - throw 'Access to this tenant is not allowed' - } + # AnyTenant: source tenants must be in the caller's scope; Get-Tenants is narrowed + $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList + if ($AllowedTenants -notcontains 'AllTenants') { + foreach ($SourceTenant in @($SourceA.tenantFilter, $SourceB.tenantFilter)) { + if ($SourceTenant -and -not (Get-Tenants -TenantFilter $SourceTenant)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::Forbidden + Body = ConvertTo-Json -InputObject @{ Results = 'Failed to compare policies: Access to this tenant is not allowed' } + }) } } + } + + # Set by a resolver right before it throws for bad input or a missing source; anything else is 500. + $FailureStatus = @{ Code = [HttpStatusCode]::InternalServerError } + + try { # Load a stored Intune template. When a tenant is supplied the template is put through the # same preparation the IntuneTemplate standard uses - nesting repair, reusable settings sync @@ -77,6 +85,7 @@ function Invoke-ExecCompareIntunePolicy { # it by the label the standards template still holds, and say where to fix it. $StandardEntry = Get-StandardEntry -StandardsTemplateId $StandardsTemplateId -TemplateGuid $TemplateGuid $KnownAs = if ($StandardEntry.TemplateList.label) { "'$($StandardEntry.TemplateList.label)' " } else { '' } + $FailureStatus.Code = [HttpStatusCode]::NotFound throw "$Label : Intune template $KnownAs($TemplateGuid) no longer exists in the template library. Remove it from the standards or drift template, or select the template again." } @@ -187,6 +196,7 @@ function Invoke-ExecCompareIntunePolicy { if ($Source.type -eq 'template') { if (-not $Source.templateGuid) { + $FailureStatus.Code = [HttpStatusCode]::BadRequest throw "$Label : templateGuid is required for template sources" } @@ -207,6 +217,7 @@ function Invoke-ExecCompareIntunePolicy { # but not which policy in the tenant it landed on. Matches the standard's own lookup: # by the template's display name and type. if (-not $Source.templateGuid -or -not $Source.tenantFilter) { + $FailureStatus.Code = [HttpStatusCode]::BadRequest throw "$Label : templateGuid and tenantFilter are required for tenantPolicyByTemplate sources" } @@ -309,17 +320,20 @@ function Invoke-ExecCompareIntunePolicy { } elseif ($Source.type -eq 'tenantPolicy') { if (-not $Source.tenantFilter -or -not $Source.policyId -or -not $Source.urlName) { + $FailureStatus.Code = [HttpStatusCode]::BadRequest throw "$Label : tenantFilter, policyId, and urlName are required for tenant policy sources" } $TemplateType = $URLNameToTemplateType[$Source.urlName] if (-not $TemplateType) { + $FailureStatus.Code = [HttpStatusCode]::BadRequest throw "$Label : Unknown policy type '$($Source.urlName)'" } $Policy = Get-CIPPIntunePolicy -TemplateType $TemplateType -PolicyID $Source.policyId -tenantFilter $Source.tenantFilter -Headers $Headers -APINAME $APIName if (-not $Policy) { + $FailureStatus.Code = [HttpStatusCode]::NotFound throw "$Label : Policy '$($Source.policyId)' not found in tenant '$($Source.tenantFilter)'" } @@ -335,11 +349,13 @@ function Invoke-ExecCompareIntunePolicy { } elseif ($Source.type -eq 'communityRepo') { if (-not $Source.fullName -or -not $Source.branch -or -not $Source.path) { + $FailureStatus.Code = [HttpStatusCode]::BadRequest throw "$Label : fullName, branch, and path are required for community repo sources" } $FileContent = Get-GitHubFileContents -FullName $Source.fullName -Path $Source.path -Branch $Source.branch if (-not $FileContent -or -not $FileContent.content) { + $FailureStatus.Code = [HttpStatusCode]::NotFound throw "$Label : Could not retrieve file '$($Source.path)' from '$($Source.fullName)' branch '$($Source.branch)'" } @@ -384,6 +400,7 @@ function Invoke-ExecCompareIntunePolicy { } } else { + $FailureStatus.Code = [HttpStatusCode]::BadRequest throw "$Label : Invalid source type '$($Source.type)'. Must be 'template', 'tenantPolicy', 'tenantPolicyByTemplate', or 'communityRepo'" } } @@ -460,7 +477,7 @@ function Invoke-ExecCompareIntunePolicy { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -headers $Headers -API $APIName -message "Failed to compare Intune policies: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest + StatusCode = $FailureStatus.Code Body = ConvertTo-Json -Depth 100 -InputObject @{ Results = "Failed to compare policies: $($ErrorMessage.NormalizedError)" } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecGetLocalAdminPassword.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecGetLocalAdminPassword.ps1 index f820ecebab..2c79e1d2cb 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecGetLocalAdminPassword.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecGetLocalAdminPassword.ps1 @@ -15,15 +15,16 @@ Function Invoke-ExecGetLocalAdminPassword { try { $GraphRequest = Get-CIPPLapsPassword -device $($request.body.guid) -tenantFilter $Request.body.TenantFilter -APIName $APINAME -Headers $Request.Headers $Body = [pscustomobject]@{'Results' = $GraphRequest } + $StatusCode = [HttpStatusCode]::OK } catch { - $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $Body = [pscustomobject]@{'Results' = "Failed. $ErrorMessage" } + $Body = [pscustomobject]@{'Results' = $_.Exception.Message } + $StatusCode = Get-CippErrorStatusCode -ErrorRecord $_ } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Body }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecSyncDEP.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecSyncDEP.ps1 index 5672f6a984..73e4d46ade 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecSyncDEP.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecSyncDEP.ps1 @@ -39,7 +39,7 @@ function Invoke-ExecSyncDEP { $ErrorMessage = Get-CippException -Exception $_ $Result = 'Failed to start Apple Business Manager device sync' Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppProtectionPolicies.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppProtectionPolicies.ps1 index b19899d629..ad004d6ac9 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppProtectionPolicies.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppProtectionPolicies.ps1 @@ -191,7 +191,7 @@ function Invoke-ListAppProtectionPolicies { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppleEnrollmentProfiles.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppleEnrollmentProfiles.ps1 index e910537a93..92ee7324c1 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppleEnrollmentProfiles.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppleEnrollmentProfiles.ps1 @@ -33,6 +33,7 @@ function Invoke-ListAppleEnrollmentProfiles { $Token } + $Failed = 0 $Profiles = foreach ($DepSetting in $DepOnboardingSettings) { if ([string]::IsNullOrWhiteSpace($DepSetting.id)) { continue } @@ -61,12 +62,14 @@ function Invoke-ListAppleEnrollmentProfiles { $ProfileObject } } catch { + $Failed++ $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to list Apple ADE profiles for token $($DepSetting.tokenName)" -Sev Warning -LogData $ErrorMessage } } - $StatusCode = [HttpStatusCode]::OK + # Tokens still listed, so a failed profile lookup is partial data + $StatusCode = $Failed ? [HttpStatusCode]::MultiStatus : [HttpStatusCode]::OK $Body = @{ Results = @{ Tokens = @($Tokens) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListCompliancePolicies.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListCompliancePolicies.ps1 index bb69466248..36ba8b9a55 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListCompliancePolicies.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListCompliancePolicies.ps1 @@ -103,7 +103,7 @@ function Invoke-ListCompliancePolicies { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListDefenderState.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListDefenderState.ps1 index 7971e2bfdf..da1bdea1cb 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListDefenderState.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListDefenderState.ps1 @@ -33,7 +33,7 @@ Function Invoke-ListDefenderState { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::OK + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = "$($ErrorMessage)" } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListDefenderTVM.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListDefenderTVM.ps1 index a3f12462a4..67a03861a4 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListDefenderTVM.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListDefenderTVM.ps1 @@ -56,7 +56,7 @@ function Invoke-ListDefenderTVM { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GroupObj = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListDeviceDetails.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListDeviceDetails.ps1 index e28da15109..6b5092aebd 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListDeviceDetails.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListDeviceDetails.ps1 @@ -83,7 +83,7 @@ Function Invoke-ListDeviceDetails { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneIntents.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneIntents.ps1 index b74b1b14a1..661e8d5fc9 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneIntents.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneIntents.ps1 @@ -17,7 +17,7 @@ Function Invoke-ListIntuneIntents { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntunePolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntunePolicy.ps1 index 51b7fc1ccb..cfb4cca984 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntunePolicy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntunePolicy.ps1 @@ -212,7 +212,7 @@ function Invoke-ListIntunePolicy { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneTemplates.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneTemplates.ps1 index d6d1ace41a..a0f57c9803 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneTemplates.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneTemplates.ps1 @@ -4,8 +4,6 @@ function Invoke-ListIntuneTemplates { Entrypoint,AnyTenant .ROLE Endpoint.MEM.Read - .DESCRIPTION - Lists the saved Intune policy templates. On first call the templates shipped with CIPP are imported into the templates table. These are CIPP templates, not a tenant's deployed policies. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -33,7 +31,6 @@ function Invoke-ListIntuneTemplates { $RawTemplates = (Get-CIPPAzDataTableEntity @Table -Filter $Filter) if ($Request.query.View) { $Templates = $RawTemplates | ForEach-Object { - $Row = $_ try { $JSONData = $Row.JSON | ConvertFrom-Json -Depth 100 -ErrorAction SilentlyContinue $data = $JSONData.RAWJson | ConvertFrom-Json -Depth 100 -ErrorAction SilentlyContinue @@ -50,79 +47,10 @@ function Invoke-ListIntuneTemplates { }) -Force $data } catch { - # A row that fails to parse used to be dropped from this list entirely, so a corrupt - # template stayed selectable in the deploy pickers (which use the raw list) while - # being invisible here. Surface a stub so the broken row can be found and deleted. - [PSCustomObject]@{ - displayName = "$($JSONData.Displayname ?? $Row.RowKey) [corrupt template: $($_.Exception.Message)]" - description = 'This template row failed to parse and cannot be deployed. Delete it from the template list and recreate it.' - Type = $JSONData.Type - GUID = $Row.RowKey - package = $Row.Package - isSynced = (![string]::IsNullOrEmpty($Row.SHA)) - source = $Row.Source - corrupt = $true - } + } } | Sort-Object -Property displayName - - # Build a lookup of which standards templates reference each Intune template (by GUID or package) - $UsageByGuid = @{} - $UsageByPackage = @{} - $StdTemplates = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'StandardsTemplateV2'" - foreach ($StdRaw in $StdTemplates) { - try { - $StdData = $StdRaw.JSON | ConvertFrom-Json -Depth 100 -ErrorAction SilentlyContinue - if (-not $StdData -or -not $StdData.standards) { continue } - $IsDrift = $StdData.type -eq 'drift' - $StdInfo = [pscustomobject]@{ - templateName = $StdData.templateName - templateId = $StdRaw.RowKey - isDrift = $IsDrift - cippLink = "/tenant/standards/templates/template?id=$($StdRaw.RowKey)$(if ($IsDrift) { '&type=drift' })" - } - $IntuneEntries = $StdData.standards.IntuneTemplate - if (-not $IntuneEntries) { continue } - $Items = if ($IntuneEntries -is [System.Collections.IEnumerable] -and $IntuneEntries -isnot [string]) { $IntuneEntries } else { @($IntuneEntries) } - foreach ($Item in $Items) { - if ($Item.TemplateList.value) { - $Guid = $Item.TemplateList.value - if (-not $UsageByGuid.ContainsKey($Guid)) { $UsageByGuid[$Guid] = [System.Collections.Generic.List[object]]::new() } - $UsageByGuid[$Guid].Add($StdInfo) - } - if ($Item.'TemplateList-Tags'.value) { - $Pkg = $Item.'TemplateList-Tags'.value - if (-not $UsageByPackage.ContainsKey($Pkg)) { $UsageByPackage[$Pkg] = [System.Collections.Generic.List[object]]::new() } - $UsageByPackage[$Pkg].Add($StdInfo) - } - } - } catch {} - } - - # Attach usage list to each Intune template - foreach ($Tpl in $Templates) { - $Usage = [System.Collections.Generic.List[object]]::new() - if ($Tpl.GUID -and $UsageByGuid.ContainsKey($Tpl.GUID)) { - foreach ($U in $UsageByGuid[$Tpl.GUID]) { - $Entry = $U | Select-Object * - $Entry | Add-Member -NotePropertyName 'matchType' -NotePropertyValue 'direct' -Force - $Usage.Add($Entry) - } - } - if ($Tpl.package -and $UsageByPackage.ContainsKey($Tpl.package)) { - foreach ($U in $UsageByPackage[$Tpl.package]) { - # Avoid duplicates when the same template matches both GUID and package - if (-not ($Usage | Where-Object { $_.templateId -eq $U.templateId })) { - $Entry = $U | Select-Object * - $Entry | Add-Member -NotePropertyName 'matchType' -NotePropertyValue 'package' -Force - $Entry | Add-Member -NotePropertyName 'package' -NotePropertyValue $Tpl.package -Force - $Usage.Add($Entry) - } - } - } - $Tpl | Add-Member -NotePropertyName 'usage' -NotePropertyValue @($Usage) -Force - } } else { if ($Request.query.mode -eq 'Tag') { #when the mode is tag, show all the potential tags, return the object with: label: tag, value: tag, count: number of templates with that tag, unique only @@ -152,21 +80,12 @@ function Invoke-ListIntuneTemplates { $data } catch { - } - }) - } - } | Sort-Object -Property label) + } + }) + } + } | Sort-Object -Property label) } else { - # Force GUID to the table RowKey (the authoritative key the standards engine - # resolves against). The JSON-embedded GUID can drift out of sync with the - # RowKey after a community-repo re-sync, so never surface it as the selectable value. - $Templates = $RawTemplates | ForEach-Object { - try { - $Parsed = ConvertFrom-Json -InputObject $_.JSON -Depth 100 -ErrorAction SilentlyContinue - if ($Parsed) { $Parsed | Add-Member -NotePropertyName 'GUID' -NotePropertyValue $_.RowKey -Force } - $Parsed - } catch {} - } + $Templates = $RawTemplates.JSON | ForEach-Object { try { ConvertFrom-Json -InputObject $_ -Depth 20 -ErrorAction SilentlyContinue } catch {} } } } @@ -178,7 +97,7 @@ function Invoke-ListIntuneTemplates { return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::OK - Body = ConvertTo-Json -Depth 100 -InputObject @($Templates) + Body = ConvertTo-Json -Depth 20 -InputObject @($Templates) }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-RemoveIntuneScript.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-RemoveIntuneScript.ps1 index 6326008784..20e1cd729f 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-RemoveIntuneScript.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-RemoveIntuneScript.ps1 @@ -44,7 +44,7 @@ function Invoke-RemoveIntuneScript { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to delete $($ScriptType) script $($DisplayName). Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APINAME -tenant $Tenant -message $Result -Sev 'Error' - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-RemovePolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-RemovePolicy.ps1 index 5c9e54ce32..4ebb7c4998 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-RemovePolicy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-RemovePolicy.ps1 @@ -18,7 +18,17 @@ function Invoke-RemovePolicy { $UrlName = $Request.Query.URLName ?? $Request.body.URLName # App protection policy lists expose the singular @odata.type as the URLName, but a Graph # DELETE needs the plural collection segment under deviceAppManagement. Normalize here. - $GraphPath = Get-CIPPIntunePolicyGraphPath -UrlName $UrlName + $GraphPath = switch ($UrlName) { + 'androidManagedAppProtection' { 'deviceAppManagement/androidManagedAppProtections' } + 'iosManagedAppProtection' { 'deviceAppManagement/iosManagedAppProtections' } + 'windowsManagedAppProtection' { 'deviceAppManagement/windowsManagedAppProtections' } + 'mdmWindowsInformationProtectionPolicy' { 'deviceAppManagement/mdmWindowsInformationProtectionPolicies' } + 'windowsInformationProtectionPolicy' { 'deviceAppManagement/windowsInformationProtectionPolicies' } + 'targetedManagedAppConfiguration' { 'deviceAppManagement/targetedManagedAppConfigurations' } + 'managedAppPolicies' { 'deviceAppManagement/managedAppPolicies' } + 'mobileAppConfigurations' { 'deviceAppManagement/mobileAppConfigurations' } + default { "deviceManagement/$UrlName" } + } if (!$PolicyId) { exit } try { @@ -32,7 +42,7 @@ function Invoke-RemovePolicy { $ErrorMessage = Get-CippException -Exception $_ $Results = "Could not delete policy: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APINAME -message $Results -Sev Error -tenant $TenantFilter -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } $Body = [pscustomobject]@{'Results' = "$Results" } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Reports/Invoke-ListAllTenantDeviceCompliance.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Reports/Invoke-ListAllTenantDeviceCompliance.ps1 index f9c60d8023..47e5211a0c 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Reports/Invoke-ListAllTenantDeviceCompliance.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Reports/Invoke-ListAllTenantDeviceCompliance.ps1 @@ -4,8 +4,6 @@ Function Invoke-ListAllTenantDeviceCompliance { Entrypoint .ROLE Tenant.DeviceCompliance.Read - .DESCRIPTION - Lists device compliance summary across all managed tenants using the Lighthouse managedDeviceCompliances API, or for a single tenant via Intune. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -28,7 +26,7 @@ Function Invoke-ListAllTenantDeviceCompliance { } } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = "Could not connect to Azure Lighthouse API: $($ErrorMessage)" } return [HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Reports/Invoke-ListDevices.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Reports/Invoke-ListDevices.ps1 index 6775937a0a..de41705dcf 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Reports/Invoke-ListDevices.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Reports/Invoke-ListDevices.ps1 @@ -16,7 +16,7 @@ Function Invoke-ListDevices { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Reports/Invoke-ListNinjaDeviceInfo.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Reports/Invoke-ListNinjaDeviceInfo.ps1 new file mode 100644 index 0000000000..8a49849357 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Reports/Invoke-ListNinjaDeviceInfo.ps1 @@ -0,0 +1,82 @@ +Function Invoke-ListNinjaDeviceInfo { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Endpoint.Device.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $TenantFilter = $Request.Query.TenantFilter + try { + # Resolve tenant to get customerId (used as PartitionKey in NinjaOne cache) + $Tenant = Get-Tenants -TenantFilter $TenantFilter + if (-not $Tenant.customerId) { + throw "Could not resolve tenant '$TenantFilter'" + } + + $DeviceTable = Get-CippTable -tablename 'CacheNinjaOneParsedDevices' + $DeviceFilter = "PartitionKey eq '$($Tenant.customerId)'" + $RawDevices = Get-CIPPAzDataTableEntity @DeviceTable -Filter $DeviceFilter + + if (($RawDevices | Measure-Object).Count -eq 0) { + # No NinjaOne data cached for this tenant + $Results = @() + $BySerial = @{} + } else { + $BySerial = @{} + $Results = foreach ($Entity in $RawDevices) { + try { + $Parsed = $Entity.RawDevice | ConvertFrom-Json -Depth 20 -ErrorAction SilentlyContinue + if ($Parsed -and $Parsed.NinjaDevice) { + $nd = $Parsed.NinjaDevice + $NinjaInfo = [PSCustomObject]@{ + azureADDeviceId = $Entity.RowKey + ninjaDeviceId = $nd.id + ninjaSystemName = $nd.systemName + ninjaLastContact = $nd.lastContact + ninjaOffline = $nd.offline + ninjaNodeClass = $nd.nodeClass + ninjaCpuName = $nd.cpuName + ninjaCpuCores = $nd.cpuCores + ninjaTotalRamGB = $nd.totalRamGB + ninjaOsName = $nd.osName + ninjaOsBuild = $nd.osBuild + ninjaOsArch = $nd.osArchitecture + ninjaLastBootTime = $nd.lastBootTime + ninjaDomain = $nd.domain + ninjaManufacturer = $nd.manufacturer + ninjaModel = $nd.model + } + # Index by serial for fallback matching (NinjaOne stores serial as primary identifier) + $Serials = @() + if ($nd.biosSerialNumber) { $Serials += $nd.biosSerialNumber.Trim() } + if ($nd.serialNumber -and $nd.serialNumber -ne $nd.biosSerialNumber) { $Serials += $nd.serialNumber.Trim() } + foreach ($sn in $Serials) { + if ($sn -and -not $BySerial.ContainsKey($sn)) { + $BySerial[$sn] = $NinjaInfo + } + } + $NinjaInfo + } + } catch { + # Skip unparseable entries + } + } + if (-not $Results) { $Results = @() } + } + + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + $StatusCode = [HttpStatusCode]::Forbidden + $Results = $ErrorMessage + $BySerial = @{} + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @{ Results = @($Results); BySerial = $BySerial } + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Devices/Invoke-ExecDeviceDelete.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Devices/Invoke-ExecDeviceDelete.ps1 index c658b751bc..8b437730a9 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Devices/Invoke-ExecDeviceDelete.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Devices/Invoke-ExecDeviceDelete.ps1 @@ -22,7 +22,7 @@ Function Invoke-ExecDeviceDelete { $StatusCode = [HttpStatusCode]::OK } catch { $Results = $_.Exception.Message - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-AddGroup.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-AddGroup.ps1 index e8495e38dc..1d9a48afee 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-AddGroup.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-AddGroup.ps1 @@ -9,26 +9,37 @@ function Invoke-AddGroup { param($Request, $TriggerMetadata) $APIName = $Request.Params.CIPPEndpoint - $SelectedTenants = if ('AllTenants' -in $SelectedTenants) { (Get-Tenants).defaultDomainName } else { $Request.body.tenantFilter.value ? $Request.body.tenantFilter.value : $Request.body.tenantFilter } + # Extract tenant filter - check for AllTenants first, then extract value + $TenantInput = $Request.body.tenantFilter.value ?? $Request.body.tenantFilter + $SelectedTenants = if ($TenantInput -eq 'AllTenants' -or 'AllTenants' -in $TenantInput) { + (Get-Tenants).defaultDomainName + } else { + @($TenantInput) + } $GroupObject = $Request.body + $StatusCode = [HttpStatusCode]::OK - $Results = foreach ($tenant in $SelectedTenants) { - try { - # Use the centralized New-CIPPGroup function - $Result = New-CIPPGroup -GroupObject $GroupObject -TenantFilter $tenant -APIName $APIName -ExecutingUser $Request.Headers.'x-ms-client-principal-name' + if (-not $SelectedTenants -or $SelectedTenants.Count -eq 0) { + $Results = 'No tenant specified for group creation' + $StatusCode = [HttpStatusCode]::BadRequest + } else { + $Results = foreach ($tenant in $SelectedTenants) { + try { + # Use the centralized New-CIPPGroup function + $Result = New-CIPPGroup -GroupObject $GroupObject -TenantFilter $tenant -APIName $APIName -ExecutingUser $Request.Headers.'x-ms-client-principal-name' - if ($Result.Success) { - "Successfully created group $($GroupObject.displayName) for $($tenant)" - $StatusCode = [HttpStatusCode]::OK - } else { - throw $Result.Message + if ($Result.Success) { + "Successfully created group $($GroupObject.displayName) for $($tenant)" + } else { + throw $Result.Message + } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + "Failed to create group. $($GroupObject.displayName) for $($tenant) $($ErrorMessage.NormalizedError)" + $StatusCode = [HttpStatusCode]::InternalServerError } - } catch { - $ErrorMessage = Get-CippException -Exception $_ - "Failed to create group. $($GroupObject.displayName) for $($tenant) $($ErrorMessage.NormalizedError)" - $StatusCode = [HttpStatusCode]::InternalServerError } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-AddGroupTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-AddGroupTemplate.ps1 index 5654cfaa16..2392fb8ee5 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-AddGroupTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-AddGroupTemplate.ps1 @@ -9,14 +9,23 @@ function Invoke-AddGroupTemplate { param($Request, $TriggerMetadata) $APIName = $Request.Params.CIPPEndpoint $GUID = $Request.Body.GUID ?? (New-Guid).GUID + if (!$Request.Body.displayName) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ Results = 'Group Template Creation failed: You must enter a displayname' } }) + } try { - if (!$Request.Body.displayName) { - throw 'You must enter a displayname' + + # Extract groupType value - handle both string and object with .value property + $GroupTypeInput = if ($Request.Body.groupType.value) { + $Request.Body.groupType.value + } elseif ($Request.Body.groupType -is [string]) { + $Request.Body.groupType + } else { + [string]$Request.Body.groupType } # Normalize group type to match New-CIPPGroup expectations # Handle values from ListGroups calculatedGroupType and frontend form values - $groupType = switch -wildcard ($Request.Body.groupType.ToLower()) { + $groupType = switch -wildcard ($GroupTypeInput.ToLower()) { # Values from ListGroups calculatedGroupType '*mail-enabled security*' { 'security'; break } '*microsoft 365*' { 'm365'; break } @@ -67,14 +76,16 @@ function Invoke-AddGroupTemplate { Write-LogMessage -headers $Request.Headers -API $APINAME -tenant 'Global' -message "Created Group template named $displayName with GUID $GUID" -Sev 'Info' $body = [pscustomobject]@{'Results' = 'Successfully added template' } + $StatusCode = [HttpStatusCode]::OK } catch { Write-LogMessage -headers $Request.Headers -API $APINAME -tenant 'Global' -message "Group Template Creation failed: $($_.Exception.Message)" -Sev 'Error' $body = [pscustomobject]@{'Results' = "Group Template Creation failed: $($_.Exception.Message)" } + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $body }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-EditGroupAliases.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-EditGroupAliases.ps1 new file mode 100644 index 0000000000..81cb6b6cee --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-EditGroupAliases.ps1 @@ -0,0 +1,124 @@ +function Invoke-EditGroupAliases { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Exchange.Group.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + + $GroupObj = $Request.Body + $TenantFilter = $GroupObj.tenantFilter + $GroupType = $GroupObj.GroupType + + if ([string]::IsNullOrWhiteSpace($GroupObj.id)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = @('Failed to manage aliases. No group ID provided.') } + }) + } + + if ($GroupType -notin @('Distribution List', 'Mail-Enabled Security', 'Microsoft 365')) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = @("Group type '$GroupType' does not support email aliases.") } + }) + } + + $Results = [System.Collections.Generic.List[object]]::new() + $Aliases = if ($GroupObj.AddedAliases) { ($GroupObj.AddedAliases -split ',').ForEach({ $_.Trim() }) } + $RemoveAliases = if ($GroupObj.RemovedAliases) { ($GroupObj.RemovedAliases -split ',').ForEach({ $_.Trim() }) } + + $GetCmdlet = if ($GroupType -eq 'Microsoft 365') { 'Get-UnifiedGroup' } else { 'Get-DistributionGroup' } + $SetCmdlet = if ($GroupType -eq 'Microsoft 365') { 'Set-UnifiedGroup' } else { 'Set-DistributionGroup' } + + try { + if ($Aliases -or $RemoveAliases -or $GroupObj.MakePrimary) { + $CurrentGroup = New-ExoRequest -tenantid $TenantFilter -cmdlet $GetCmdlet -cmdParams @{ Identity = $GroupObj.id } -UseSystemMailbox $true + + if (-not $CurrentGroup) { + throw 'Could not find mail-enabled group in Exchange Online.' + } + + $CurrentProxyAddresses = @($CurrentGroup.EmailAddresses) + $NewProxyAddresses = @($CurrentProxyAddresses) + + if ($GroupObj.MakePrimary) { + $PrimaryAddress = $GroupObj.MakePrimary + + if ($PrimaryAddress -notlike 'SMTP:*') { + $PrimaryAddress = "SMTP:$($PrimaryAddress -replace '^smtp:', '')" + } + + $ExistingAddress = $CurrentProxyAddresses | Where-Object { $_.ToLower() -eq $PrimaryAddress.ToLower() } + + if (-not $ExistingAddress) { + throw "Cannot set primary address. Address $($PrimaryAddress -replace '^SMTP:', '') not found in group addresses." + } + + $NewProxyAddresses = $NewProxyAddresses | ForEach-Object { + if ($_ -like 'SMTP:*') { + $_.ToLower() + } else { + $_ + } + } + + $NewProxyAddresses = $NewProxyAddresses | Where-Object { $_.ToLower() -ne $PrimaryAddress.ToLower() } + $NewProxyAddresses = @($PrimaryAddress) + $NewProxyAddresses + + Write-LogMessage -API $APIName -tenant $TenantFilter -headers $Headers -message "Set primary address for $($CurrentGroup.DisplayName)" -Sev Info + $Results.Add('Success. Set new primary address.') + } + + if ($RemoveAliases) { + foreach ($Alias in $RemoveAliases) { + if ($Alias -notlike 'smtp:*') { + $Alias = "smtp:$Alias" + } + $NewProxyAddresses = $NewProxyAddresses | Where-Object { $_.ToLower() -ne $Alias.ToLower() } + } + Write-LogMessage -API $APIName -tenant $TenantFilter -headers $Headers -message "Removed aliases from $($CurrentGroup.DisplayName)" -Sev Info + $Results.Add('Success. Removed specified aliases from group.') + } + + if ($Aliases) { + $AliasesToAdd = @() + foreach ($Alias in $Aliases) { + if ($Alias -notlike 'smtp:*') { + $Alias = "smtp:$Alias" + } + if (-not ($NewProxyAddresses | Where-Object { $_.ToLower() -eq $Alias.ToLower() })) { + $AliasesToAdd = $AliasesToAdd + $Alias + } + } + if ($AliasesToAdd.Count -gt 0) { + $NewProxyAddresses = $NewProxyAddresses + $AliasesToAdd + Write-LogMessage -API $APIName -tenant $TenantFilter -headers $Headers -message "Added aliases to $($CurrentGroup.DisplayName)" -Sev Info + $Results.Add('Success. Added new aliases to group.') + } + } + + $Params = @{ + Identity = $GroupObj.id + EmailAddresses = $NewProxyAddresses + } + $null = New-ExoRequest -tenantid $TenantFilter -cmdlet $SetCmdlet -cmdParams $Params -UseSystemMailbox $true + } else { + $Results.Add('No alias changes specified.') + } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -API $APIName -tenant $TenantFilter -headers $Headers -message "Group alias management failed. $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage + $Results.Add("Failed to manage aliases: $($ErrorMessage.NormalizedError)") + } + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ Results = @($Results) } + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroupAliases.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroupAliases.ps1 new file mode 100644 index 0000000000..67d03d5940 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroupAliases.ps1 @@ -0,0 +1,58 @@ +function Invoke-ListGroupAliases { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Exchange.Groups.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $TenantFilter = $Request.Query.tenantFilter + $GroupId = $Request.Query.groupId + $GroupType = $Request.Query.groupType + + if ([string]::IsNullOrWhiteSpace($GroupId)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'No group ID provided.' } + }) + } + + if ($GroupType -notin @('Distribution List', 'Mail-Enabled Security', 'Microsoft 365')) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Group type '$GroupType' does not support email aliases." } + }) + } + + try { + $Params = @{ Identity = $GroupId } + + if ($GroupType -eq 'Microsoft 365') { + $Group = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-UnifiedGroup' -cmdParams $Params -Select 'DisplayName,PrimarySmtpAddress,EmailAddresses' -UseSystemMailbox $true + } else { + $Group = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-DistributionGroup' -cmdParams $Params -Select 'DisplayName,PrimarySmtpAddress,EmailAddresses' -UseSystemMailbox $true + } + + if (-not $Group) { + throw 'Could not find mail-enabled group in Exchange Online.' + } + + $StatusCode = [HttpStatusCode]::OK + $Body = @{ + displayName = $Group.DisplayName + mail = $Group.PrimarySmtpAddress + proxyAddresses = @($Group.EmailAddresses) + } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $StatusCode = [HttpStatusCode]::InternalServerError + $Body = @{ Results = "Failed to list group aliases: $($ErrorMessage.NormalizedError)" } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroupTemplates.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroupTemplates.ps1 index 1fc1367f1b..9413c7da60 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroupTemplates.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroupTemplates.ps1 @@ -4,8 +4,6 @@ function Invoke-ListGroupTemplates { Entrypoint,AnyTenant .ROLE Identity.Group.Read - .DESCRIPTION - Lists the saved group templates, each with its display name, description and group type. Pass id to return a single template. These are CIPP templates, not a tenant's existing groups. #> [CmdletBinding()] param($Request, $TriggerMetadata) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroups.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroups.ps1 index e396293a49..3b1a984f10 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroups.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroups.ps1 @@ -211,7 +211,7 @@ function Invoke-ListGroups { } catch { Write-Warning $_.InvocationInfo.PositionMessage $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-AddPIMRoleSettingsTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-AddPIMRoleSettingsTemplate.ps1 index 0d44e886b4..fc7f44f7b6 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-AddPIMRoleSettingsTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-AddPIMRoleSettingsTemplate.ps1 @@ -31,16 +31,16 @@ function Invoke-AddPIMRoleSettingsTemplate { @{ label = "$Label"; value = "$Value" } }) - if ([string]::IsNullOrWhiteSpace($TemplateName)) { throw 'templateName is required' } + if ([string]::IsNullOrWhiteSpace($TemplateName)) { $FailCode = [HttpStatusCode]::BadRequest; throw 'templateName is required' } # Capture mode: build the settings from a role's current PIM policy in a tenant. $CaptureRoleId = $Request.Body.captureRoleId.value ?? $Request.Body.captureRoleId $Adjustments = @() if (-not [string]::IsNullOrWhiteSpace("$CaptureRoleId")) { $CaptureTenant = $Request.Body.tenantFilter.value ?? $Request.Body.tenantFilter - if ([string]::IsNullOrWhiteSpace("$CaptureTenant") -or "$CaptureTenant" -eq 'AllTenants') { throw 'A single tenantFilter is required when capturing settings from a role.' } + if ([string]::IsNullOrWhiteSpace("$CaptureTenant") -or "$CaptureTenant" -eq 'AllTenants') { $FailCode = [HttpStatusCode]::BadRequest; throw 'A single tenantFilter is required when capturing settings from a role.' } $Policy = @(Get-CIPPPIMRolePolicies -TenantFilter $CaptureTenant) | Where-Object { $_.RoleDefinitionId -eq $CaptureRoleId } | Select-Object -First 1 - if (-not $Policy) { throw "No PIM role management policy was found for role $CaptureRoleId in $CaptureTenant. Privileged Identity Management may not be onboarded there yet." } + if (-not $Policy) { $FailCode = [HttpStatusCode]::NotFound; throw "No PIM role management policy was found for role $CaptureRoleId in $CaptureTenant. Privileged Identity Management may not be onboarded there yet." } $Captured = ConvertFrom-CIPPPIMPolicyRules -Rules $Policy.Rules # A tenant's live policy may sit below the floor (Entra's defaults do); a template must # never store that, so offending values are raised and each raise is reported. @@ -60,8 +60,8 @@ function Invoke-AddPIMRoleSettingsTemplate { } if ([string]::IsNullOrWhiteSpace($RoleScope)) { $RoleScope = 'PrivilegedRoles' } - if ($RoleScope -notin @('PrivilegedRoles', 'AllRoles', 'Custom')) { throw "roleScope '$RoleScope' is not valid. Use PrivilegedRoles, AllRoles or Custom." } - if ($RoleScope -eq 'Custom' -and $Roles.Count -eq 0) { throw 'Select at least one role when roleScope is Custom.' } + if ($RoleScope -notin @('PrivilegedRoles', 'AllRoles', 'Custom')) { $FailCode = [HttpStatusCode]::BadRequest; throw "roleScope '$RoleScope' is not valid. Use PrivilegedRoles, AllRoles or Custom." } + if ($RoleScope -eq 'Custom' -and $Roles.Count -eq 0) { $FailCode = [HttpStatusCode]::BadRequest; throw 'Select at least one role when roleScope is Custom.' } # Role activation, eligibility, assignment, approval and notification settings. $Settings = ConvertTo-CIPPPIMRoleSettings -InputObject $SettingsInput @@ -85,7 +85,7 @@ function Invoke-AddPIMRoleSettingsTemplate { if (-not [string]::IsNullOrWhiteSpace($GUID)) { $SafeGUID = ConvertTo-CIPPODataFilterValue -Value $GUID -Type String $Existing = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'PIMRoleSettingsTemplate' and RowKey eq '$SafeGUID'" - if (-not $Existing) { throw "PIM role settings template $GUID was not found" } + if (-not $Existing) { $FailCode = [HttpStatusCode]::NotFound; throw "PIM role settings template $GUID was not found" } } else { $GUID = (New-Guid).Guid } @@ -130,7 +130,7 @@ function Invoke-AddPIMRoleSettingsTemplate { $ErrorMessage = Get-CippException -Exception $_ $Results = @("Failed to save PIM role settings template: $($ErrorMessage.NormalizedError)") Write-LogMessage -headers $Headers -API $APIName -message $Results[0] -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = $FailCode ?? [HttpStatusCode]::InternalServerError } return [HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-ExecPIMRoleAssignment.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-ExecPIMRoleAssignment.ps1 index a8caa6f583..cbb5c44cb3 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-ExecPIMRoleAssignment.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-ExecPIMRoleAssignment.ps1 @@ -101,7 +101,7 @@ function Invoke-ExecPIMRoleAssignment { $ErrorMessage = Get-CippException -Exception $_ $Message = "PIM $Action failed for $PrincipalId on $RoleDefinitionId`: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = Get-CippErrorStatusCode -ErrorRecord $_ $Results = @(@{ resultText = $Message; state = 'error' }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-ListPIMRoles.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-ListPIMRoles.ps1 index afefda513c..43a776903a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-ListPIMRoles.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-ListPIMRoles.ps1 @@ -20,6 +20,8 @@ function Invoke-ListPIMRoles { $PrincipalId = $Request.Query.principalId # Serve from the reporting database cache instead of live Graph. AllTenants always reads the cache. $UseReportDB = $Request.Query.UseReportDB -eq $true + $Failed = 0 + $Total = 1 try { if ($TenantFilter -eq 'AllTenants' -or $UseReportDB) { @@ -48,6 +50,7 @@ function Invoke-ListPIMRoles { # stays assigned-only: the catalogue is the same ~100 built-in roles in every tenant. $IncludeUnassigned = ($TenantFilter -ne 'AllTenants') -and [string]::IsNullOrWhiteSpace($PrincipalId) $Rows = [System.Collections.Generic.List[object]]::new() + $Total = $Tenants.Count foreach ($Tenant in $Tenants) { try { foreach ($Row in Get-CIPPPIMRoleAssignments -TenantFilter $Tenant -FromCache -IncludePolicy -IncludeUnassignedRoles:$IncludeUnassigned) { @@ -55,6 +58,7 @@ function Invoke-ListPIMRoles { $Rows.Add($Row) } } catch { + $Failed++ Write-LogMessage -API $APIName -tenant $Tenant -message "Failed to read cached role assignments: $($_.Exception.Message)" -sev Warning } } @@ -117,12 +121,12 @@ function Invoke-ListPIMRoles { ) $Results = @($Grouped | Sort-Object -Property Tenant, RoleDisplayName) - $StatusCode = [HttpStatusCode]::OK + $StatusCode = Get-CippBulkStatusCode -Total $Total -Failed $Failed } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -tenant $TenantFilter -message "Failed to list roles with PIM data: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage $Results = "Failed to list roles with PIM data for $TenantFilter. $($ErrorMessage.NormalizedError)" - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return [HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-ListRoleAssignments.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-ListRoleAssignments.ps1 index 4220c47580..03e013f59e 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-ListRoleAssignments.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-ListRoleAssignments.ps1 @@ -22,6 +22,8 @@ function Invoke-ListRoleAssignments { $PermanentOnly = [bool]($Request.Query.permanentOnly -eq $true -or "$($Request.Query.permanentOnly)" -eq 'true') # Single tenant: also list roles that nobody holds (AssignmentType 'Unassigned'), so the result is the full role catalogue. Default true; set to false for assignments only. $IncludeUnassigned = -not ("$($Request.Query.includeUnassigned)" -eq 'false') + $Failed = 0 + $Total = 1 try { if ($TenantFilter -eq 'AllTenants') { @@ -38,6 +40,7 @@ function Invoke-ListRoleAssignments { $Tenants = @($RefreshedAt.Keys | Where-Object { $TenantList.defaultDomainName -contains $_ }) $Results = [System.Collections.Generic.List[object]]::new() + $Total = $Tenants.Count foreach ($Tenant in $Tenants) { try { $Rows = Get-CIPPPIMRoleAssignments -TenantFilter $Tenant -FromCache -IncludePolicy @@ -46,6 +49,7 @@ function Invoke-ListRoleAssignments { $Results.Add($Row) } } catch { + $Failed++ Write-LogMessage -API $APIName -tenant $Tenant -message "Failed to read cached role assignments: $($_.Exception.Message)" -sev Warning } } @@ -61,12 +65,12 @@ function Invoke-ListRoleAssignments { if (-not [string]::IsNullOrWhiteSpace($RoleTemplateId)) { $Results = @($Results | Where-Object { $_.RoleDefinitionId -eq $RoleTemplateId }) } if ($PermanentOnly) { $Results = @($Results | Where-Object { $_.AssignmentType -eq 'Permanent' }) } - $StatusCode = [HttpStatusCode]::OK + $StatusCode = Get-CippBulkStatusCode -Total $Total -Failed $Failed } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -tenant $TenantFilter -message "Failed to list role assignments: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage $Results = "Failed to list role assignments for $TenantFilter. $($ErrorMessage.NormalizedError)" - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return [HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-ListRoles.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-ListRoles.ps1 index 893db183df..e95921934a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-ListRoles.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Roles/Invoke-ListRoles.ps1 @@ -62,7 +62,7 @@ function Invoke-ListRoles { } catch { $ErrorMessage = Get-CippException -Exception $_ $GraphRequest = "Failed to list roles for tenant $TenantFilter. $($ErrorMessage.NormalizedError)" - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return [HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddGuest.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddGuest.ps1 index d4614ece93..3a3db9114f 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddGuest.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddGuest.ps1 @@ -38,9 +38,9 @@ function Invoke-AddGuest { $BodyToShipJson = ConvertTo-Json -Depth 5 -InputObject $BodyToShip $null = New-GraphPostRequest -uri 'https://graph.microsoft.com/beta/invitations' -tenantid $TenantFilter -type POST -body $BodyToShipJson -AsApp $true if ($SendInvite -eq $true) { - $Result = "Invited Guest $($DisplayName) with Email Invite" + $Result = "Invited Guest $($DisplayName) with Email Invite (Guest Access — B2B Collaboration)" } else { - $Result = "Invited Guest $($DisplayName) with no Email Invite" + $Result = "Invited Guest $($DisplayName) with no Email Invite (Guest Access — B2B Collaboration)" } Write-LogMessage -headers $Headers -API $APIName -tenant $($TenantFilter) -message $Result -Sev 'Info' $StatusCode = [HttpStatusCode]::OK @@ -48,7 +48,7 @@ function Invoke-AddGuest { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to Invite Guest. $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -tenant $($TenantFilter) -message $Result -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddJITAdminTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddJITAdminTemplate.ps1 index cf5f5ee7b7..c5a9afd062 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddJITAdminTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddJITAdminTemplate.ps1 @@ -18,9 +18,11 @@ function Invoke-AddJITAdminTemplate { # Validate required fields if ([string]::IsNullOrWhiteSpace($TenantFilter)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'tenantFilter is required' } if ([string]::IsNullOrWhiteSpace($TemplateName)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'templateName is required' } @@ -34,7 +36,7 @@ function Invoke-AddJITAdminTemplate { $ExistingTemplates = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'JITAdminTemplate'" $ExistingNames = $ExistingTemplates | ForEach-Object { try { - $data = $_.JSON | ConvertFrom-Json -Depth 100 -ErrorAction Stop + $data = $_.JSON | ConvertFrom-Json -Depth 20 -ErrorAction Stop if ($data.tenantFilter -eq $TenantFilter -and $data.templateName -eq $TemplateName) { $data } @@ -42,6 +44,7 @@ function Invoke-AddJITAdminTemplate { } if ($ExistingNames) { + $FailCode = [HttpStatusCode]::BadRequest throw "A template with name '$TemplateName' already exists for tenant '$TenantFilter'" } @@ -52,11 +55,11 @@ function Invoke-AddJITAdminTemplate { $ExistingTemplates | ForEach-Object { try { $row = $_ - $data = $row.JSON | ConvertFrom-Json -Depth 100 -ErrorAction Stop + $data = $row.JSON | ConvertFrom-Json -Depth 20 -ErrorAction Stop if ($data.tenantFilter -eq $TenantFilter -and $data.defaultForTenant -eq $true) { # Unset the default flag $data.defaultForTenant = $false - $row.JSON = ($data | ConvertTo-Json -Depth 100 -Compress) + $row.JSON = ($data | ConvertTo-Json -Depth 20 -Compress) Add-CIPPAzDataTableEntity @Table -Entity $row -Force Write-LogMessage -headers $Headers -API $APIName -message "Unset default flag for existing template: $($data.templateName)" -Sev 'Info' } @@ -69,6 +72,7 @@ function Invoke-AddJITAdminTemplate { # Validate user action fields $DefaultUserAction = $Request.Body.defaultUserAction if ($TenantFilter -eq 'AllTenants' -and $DefaultUserAction -eq 'select') { + $FailCode = [HttpStatusCode]::BadRequest throw 'defaultUserAction cannot be "select" when tenantFilter is "AllTenants"' } @@ -135,7 +139,7 @@ function Invoke-AddJITAdminTemplate { $GUID = (New-Guid).GUID # Convert to JSON - $JSON = ConvertTo-Json -InputObject $TemplateObject -Depth 100 -Compress + $JSON = ConvertTo-Json -InputObject $TemplateObject -Depth 20 -Compress # Store in table $Table.Force = $true @@ -154,7 +158,7 @@ function Invoke-AddJITAdminTemplate { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to create JIT Admin Template: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -message $Result -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::InternalServerError + $StatusCode = $FailCode ?? [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddUserBulk.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddUserBulk.ps1 index d7066114fe..6f8573a018 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddUserBulk.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddUserBulk.ps1 @@ -30,8 +30,11 @@ function Invoke-AddUserBulk { $BulkUsers = $Request.Body.BulkUser $AssignedLicenses = $Request.Body.licenses $UsageLocation = $Request.Body.usageLocation + $DisableLegacyProtocols = $Request.Body.disableLegacyProtocols + $DefaultDomain = $Request.Body.primDomain.value ?? $Request.Body.primDomain if (!$BulkUsers) { + $StatusCode = [HttpStatusCode]::BadRequest $Body = @{ Results = @{ resultText = 'No users specified to import' @@ -43,6 +46,9 @@ function Invoke-AddUserBulk { $Results = [System.Collections.Generic.List[object]]::new() $Messages = [System.Collections.Generic.List[object]]::new() foreach ($User in $BulkUsers) { + if (!$User.domain -and $DefaultDomain) { + $User | Add-Member -NotePropertyName 'domain' -NotePropertyValue $DefaultDomain -Force + } # User input validation $missingFields = [System.Collections.Generic.List[string]]::new() if (!$User.mailNickName) { $missingFields.Add('mailNickName') } @@ -129,6 +135,11 @@ function Invoke-AddUserBulk { $BulkResults = New-GraphBulkRequest -tenantid $TenantFilter -Requests $BulkRequests Write-Warning "We have $($BulkResults.Count) results" #Write-Information ($BulkResults | ConvertTo-Json -Depth 10) + $LicenseRequests = [System.Collections.Generic.List[object]]::new() + if ($AssignedLicenses) { + $GuidPattern = '([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})' + $LicenseSkus = $AssignedLicenses.value ?? $AssignedLicenses | Where-Object { $_ -match $GuidPattern } + } foreach ($BulkResult in $BulkResults) { if ($BulkResult.status -ne 201) { Write-LogMessage -headers $Request.Headers -API $APINAME -tenant $($TenantFilter) -message "Failed to create user $($BulkResult.id). Error:$($BulkResult.body.error.message)" -Sev 'Error' @@ -139,11 +150,43 @@ function Invoke-AddUserBulk { } else { $Message = $Messages.Where({ $_.id -eq $BulkResult.id }) if ($AssignedLicenses) { - $GuidPattern = '([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})' - $LicenseSkus = $AssignedLicenses.value ?? $AssignedLicenses | Where-Object { $_ -match $GuidPattern } - Set-CIPPUserLicense -UserId $BulkResult.id -AddLicenses $LicenseSkus -TenantFilter $TenantFilter -APIName $APIName -Headers $Headers + $LicenseRequests.Add([PSCustomObject]@{ + UserId = $BulkResult.id + UserPrincipalName = $BulkResult.id + AddLicenses = @($LicenseSkus) + RemoveLicenses = @() + IsReplace = $false + }) } Write-LogMessage -headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Message.resultText -Sev 'Info' + + # Schedule task to disable legacy protocols if requested + if ($DisableLegacyProtocols -eq $true) { + try { + $taskObject = [PSCustomObject]@{ + TenantFilter = $TenantFilter + Name = "Disable Legacy Protocols: $($BulkResult.id)" + Command = @{ + value = 'Set-CIPPCASMailbox' + } + Parameters = [pscustomobject]@{ + Username = $BulkResult.id + TenantFilter = $TenantFilter + ImapEnabled = $false + PopEnabled = $false + } + ScheduledTime = [int64](((Get-Date).AddMinutes(5).ToUniversalTime()) - (Get-Date '1/1/1970')).TotalSeconds + PostExecution = @{ + Webhook = $false + Email = $false + PSA = $false + } + } + Add-CIPPScheduledTask -Task $taskObject -hidden $true -Headers $Request.Headers + } catch { + Write-LogMessage -headers $Request.Headers -API $APIName -tenant $TenantFilter -message "Failed to schedule legacy protocol disable task for $($BulkResult.id). Error: $($_.Exception.Message)" -Sev 'Warning' + } + } $Results.Add(@{ resultText = $Message.resultText state = 'success' @@ -152,6 +195,25 @@ function Invoke-AddUserBulk { }) } } + if ($LicenseRequests.Count -gt 0) { + try { + $LicenseResults = Set-CIPPUserLicense -LicenseRequests $LicenseRequests -TenantFilter $TenantFilter -APIName $APIName -Headers $Request.Headers + foreach ($LicenseResult in @($LicenseResults).Where({ $_.state -eq 'error' })) { + $Results.Add(@{ + resultText = $LicenseResult.resultText + state = 'error' + }) + } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + foreach ($LicenseRequest in $LicenseRequests) { + $Results.Add(@{ + resultText = "Failed to assign licenses for user $($LicenseRequest.UserId): $($ErrorMessage.NormalizedError)" + state = 'error' + }) + } + } + } } else { $Results.Add(@{ resultText = 'No users to import' @@ -161,10 +223,11 @@ function Invoke-AddUserBulk { $Body = @{ Results = @($Results) } + $StatusCode = Get-CippBulkStatusCode -Total @($Results).Count -Failed @($Results.Where({ $_.state -eq 'error' })).Count } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode ?? [HttpStatusCode]::OK Body = $Body }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddUserDefaults.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddUserDefaults.ps1 index 6c0afd4dfa..e9e60b61d0 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddUserDefaults.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddUserDefaults.ps1 @@ -160,7 +160,7 @@ function Invoke-AddUserDefaults { $GUID = if ($Request.Body.GUID) { $Request.Body.GUID } else { (New-Guid).GUID } # Convert to JSON - $JSON = ConvertTo-Json -InputObject $TemplateObject -Depth 100 -Compress + $JSON = ConvertTo-Json -InputObject $TemplateObject -Depth 20 -Compress # Store in table $Table = Get-CippTable -tablename 'templates' diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditJITAdminTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditJITAdminTemplate.ps1 index 40f5339ae4..562c018691 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditJITAdminTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditJITAdminTemplate.ps1 @@ -19,12 +19,15 @@ function Invoke-EditJITAdminTemplate { # Validate required fields if ([string]::IsNullOrWhiteSpace($GUID)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'GUID is required' } if ([string]::IsNullOrWhiteSpace($TenantFilter)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'tenantFilter is required' } if ([string]::IsNullOrWhiteSpace($TemplateName)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'templateName is required' } @@ -35,22 +38,23 @@ function Invoke-EditJITAdminTemplate { # Get the existing template $Table = Get-CippTable -tablename 'templates' - $SafeGUID = ConvertTo-CIPPODataFilterValue -Value $GUID -Type Guid + $SafeGUID = try { ConvertTo-CIPPODataFilterValue -Value $GUID -Type Guid } catch { $FailCode = [HttpStatusCode]::BadRequest; throw } $Filter = "PartitionKey eq 'JITAdminTemplate' and RowKey eq '$SafeGUID'" $ExistingTemplate = Get-CIPPAzDataTableEntity @Table -Filter $Filter if (!$ExistingTemplate) { + $FailCode = [HttpStatusCode]::NotFound throw "Template with GUID '$GUID' not found" } # Parse existing template data - $ExistingData = $ExistingTemplate.JSON | ConvertFrom-Json -Depth 100 + $ExistingData = $ExistingTemplate.JSON | ConvertFrom-Json -Depth 20 # Check if template name is unique (excluding current template) $AllTemplates = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'JITAdminTemplate'" $DuplicateName = $AllTemplates | Where-Object { $_.RowKey -ne $GUID } | ForEach-Object { try { - $data = $_.JSON | ConvertFrom-Json -Depth 100 -ErrorAction Stop + $data = $_.JSON | ConvertFrom-Json -Depth 20 -ErrorAction Stop if ($data.tenantFilter -eq $TenantFilter -and $data.templateName -eq $TemplateName) { $data } @@ -58,6 +62,7 @@ function Invoke-EditJITAdminTemplate { } if ($DuplicateName) { + $FailCode = [HttpStatusCode]::BadRequest throw "A template with name '$TemplateName' already exists for tenant '$TenantFilter'" } @@ -68,11 +73,11 @@ function Invoke-EditJITAdminTemplate { $AllTemplates | Where-Object { $_.RowKey -ne $GUID } | ForEach-Object { try { $row = $_ - $data = $row.JSON | ConvertFrom-Json -Depth 100 -ErrorAction Stop + $data = $row.JSON | ConvertFrom-Json -Depth 20 -ErrorAction Stop if ($data.tenantFilter -eq $TenantFilter -and $data.defaultForTenant -eq $true) { # Unset the default flag $data.defaultForTenant = $false - $row.JSON = ($data | ConvertTo-Json -Depth 100 -Compress) + $row.JSON = ($data | ConvertTo-Json -Depth 20 -Compress) Add-CIPPAzDataTableEntity @Table -Entity $row -Force Write-LogMessage -headers $Headers -API $APIName -message "Unset default flag for existing template: $($data.templateName)" -Sev 'Info' } @@ -85,6 +90,7 @@ function Invoke-EditJITAdminTemplate { # Validate user action fields $DefaultUserAction = $Request.Body.defaultUserAction if ($TenantFilter -eq 'AllTenants' -and $DefaultUserAction -eq 'select') { + $FailCode = [HttpStatusCode]::BadRequest throw 'defaultUserAction cannot be "select" when tenantFilter is "AllTenants"' } @@ -150,7 +156,7 @@ function Invoke-EditJITAdminTemplate { } # Convert to JSON - $JSON = ConvertTo-Json -InputObject $TemplateObject -Depth 100 -Compress + $JSON = ConvertTo-Json -InputObject $TemplateObject -Depth 20 -Compress # Update in table $Table.Force = $true @@ -169,7 +175,7 @@ function Invoke-EditJITAdminTemplate { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to update JIT Admin Template: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -message $Result -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::InternalServerError + $StatusCode = $FailCode ?? [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECRemediate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECRemediate.ps1 index e5b9b45265..e80e3137b7 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECRemediate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECRemediate.ps1 @@ -52,7 +52,26 @@ function Invoke-ExecBECRemediate { $AsyncDeploymentId = Start-CIPPBecContainmentJob -TenantFilter $TenantFilter -UserId $SuspectUser -UserPrincipalName $Username -Actions @($Selected.Id) -Parameters $Parameters -CaseId $CaseId -Headers $Headers -APIName $APIName [pscustomobject]@{ resultText = "Queued $($Selected.Count) containment action(s) for $Username. Progress is shown below and on the scheduled task."; state = 'info' } } else { - Invoke-CIPPBecContainment -TenantFilter $TenantFilter -UserId $SuspectUser -UserPrincipalName $Username -Actions $Actions -Parameters $Parameters -Confirmed:$ConfirmationOk -CaseId $CaseId -Headers $Headers -APIName $APIName + # Get-InboxRule plus one Disable-InboxRule per rule exceeds the Static Web Apps + # proxy limit. Queue that action and return the rest, including the new password, now. + $InlineIds = @($Selected.Id) + $QueueRules = $InlineIds -contains 'DisableInboxRules' + if ($QueueRules) { $InlineIds = @($InlineIds | Where-Object { $_ -ne 'DisableInboxRules' }) } + $InlineRows = [System.Collections.Generic.List[object]]::new() + if ($InlineIds.Count -gt 0) { + foreach ($InlineRow in @(Invoke-CIPPBecContainment -TenantFilter $TenantFilter -UserId $SuspectUser -UserPrincipalName $Username -Actions $InlineIds -Parameters $Parameters -Confirmed:$ConfirmationOk -CaseId $CaseId -Headers $Headers -APIName $APIName)) { + if ($null -ne $InlineRow) { $InlineRows.Add($InlineRow) } + } + } + if ($QueueRules) { + try { + $null = Start-CIPPBecContainmentJob -TenantFilter $TenantFilter -UserId $SuspectUser -UserPrincipalName $Username -Actions @('DisableInboxRules') -Parameters $Parameters -CaseId $CaseId -Headers $Headers -APIName $APIName + $InlineRows.Add([pscustomobject]@{ resultText = "Inbox rules for $Username queued for background processing."; state = 'info'; Action = 'DisableInboxRules'; Target = $Username }) + } catch { + $InlineRows.Add([pscustomobject]@{ resultText = "Failed to queue inbox rule processing: $($_.Exception.Message)"; state = 'error'; Action = 'DisableInboxRules'; Target = $Username }) + } + } + $InlineRows } @($Rows | ForEach-Object { $Row = [ordered]@{ resultText = $_.resultText; state = $_.state; Action = $_.Action; Target = $_.Target } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBulkLicense.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBulkLicense.ps1 index 5b284b29e1..346eb443b6 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBulkLicense.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBulkLicense.ps1 @@ -15,6 +15,7 @@ function Invoke-ExecBulkLicense { $Headers = $Request.Headers $Results = [System.Collections.Generic.List[string]]::new() $StatusCode = [HttpStatusCode]::OK + $Failed = 0 try { $UserRequests = $Request.Body @@ -85,12 +86,14 @@ function Invoke-ExecBulkLicense { foreach ($UserRequest in $TenantRequests) { $UserId = @($UserRequest.userIds | ForEach-Object { [string]$_ } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Select-Object -First 1) if ($UserId.Count -eq 0) { + $Failed++ $Results.Add("No valid user ID found in request for tenant $TenantFilter") continue } $UserId = $UserId[0] $User = $UserLookup[$UserId] if ($null -eq $User) { + $Failed++ $Results.Add("User $UserId not found in tenant $TenantFilter") continue } @@ -144,9 +147,11 @@ function Invoke-ExecBulkLicense { try { $BulkResults = Set-CIPPUserLicense -LicenseRequests $LicenseRequests -TenantFilter $TenantFilter -APIName $APIName -Headers $Headers foreach ($Result in $BulkResults) { - $Results.Add($Result) + $Results.Add($Result.resultText) } + $Failed = $Failed + @(@($BulkResults).Where({ $_.state -eq 'error' }) | Select-Object -ExpandProperty UserId -Unique).Count } catch { + $Failed = $Failed + $LicenseRequests.Count $ErrorMessage = Get-CippException -Exception $_ $Results.Add("Failed to process bulk license operation for tenant $TenantFilter. Error: $($ErrorMessage.NormalizedError)") Write-LogMessage -API $APIName -tenant $TenantFilter -message "Failed to process bulk license operation. Error: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage @@ -157,9 +162,10 @@ function Invoke-ExecBulkLicense { $Body = @{ Results = @($Results) } + $StatusCode = Get-CippBulkStatusCode -Total @($UserRequests).Count -Failed $Failed } catch { $ErrorMessage = Get-CippException -Exception $_ - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError $Body = @{ Results = @("Failed to process bulk license operation: $($ErrorMessage.NormalizedError)") } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecDismissRiskyUser.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecDismissRiskyUser.ps1 index 2dee3de818..905c5c237f 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecDismissRiskyUser.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecDismissRiskyUser.ps1 @@ -9,10 +9,16 @@ function Invoke-ExecDismissRiskyUser { param($Request, $TriggerMetadata) $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers # Interact with the query or body of the request $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter $SuspectUser = $Request.Query.userId ?? $Request.Body.userId $userDisplayName = $Request.Query.userDisplayName ?? $Request.Body.userDisplayName + $userPrincipalName = $Request.Query.userPrincipalName ?? $Request.Body.userPrincipalName + + $DismissedBy = try { + ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails + } catch { 'Unknown' } $GraphRequest = @{ 'uri' = 'https://graph.microsoft.com/beta/riskyUsers/dismiss' @@ -27,12 +33,33 @@ function Invoke-ExecDismissRiskyUser { try { $GraphResults = New-GraphPostRequest @GraphRequest $Result = "Successfully dismissed User Risk for user $userDisplayName. $GraphResults" - Write-LogMessage -API $APIName -tenant $TenantFilter -message $Result -sev 'Info' + + # Record who dismissed this risky user so it can be displayed in the UI. + # Microsoft Graph does not return this information on its own. + try { + $DismissalTable = Get-CIPPTable -tablename 'RiskyUserDismissals' + $DismissalEntity = @{ + PartitionKey = [string]$TenantFilter + RowKey = [string]$SuspectUser + UserId = [string]$SuspectUser + UserDisplayName = [string]$userDisplayName + UserPrincipalName = [string]$userPrincipalName + DismissedBy = [string]$DismissedBy + DismissedDateTime = [string]([datetime]::UtcNow.ToString('o')) + } + Add-CIPPAzDataTableEntity @DismissalTable -Entity $DismissalEntity -Force | Out-Null + } catch { + # Non-fatal: the Graph dismissal succeeded, we just couldn't record the actor locally. + $RecordError = Get-CippException -Exception $_ + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Dismissal succeeded but failed to record dismissedBy metadata for $userDisplayName : $($RecordError.NormalizedError)" -sev 'Warning' -LogData $RecordError + } + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev 'Info' $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to dismiss user risk for $userDisplayName. $($ErrorMessage.NormalizedError)" - Write-LogMessage -API $APIName -tenant $TenantFilter -message $Result -sev 'Error' -LogData $ErrorMessage + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev 'Error' -LogData $ErrorMessage $StatusCode = [HttpStatusCode]::InternalServerError } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecDomainMigration.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecDomainMigration.ps1 new file mode 100644 index 0000000000..4cd9122d9f --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecDomainMigration.ps1 @@ -0,0 +1,219 @@ +function Invoke-ExecDomainMigration { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Identity.User.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + $SourceDomain = $Request.Body.sourceDomain + $TargetDomain = $Request.Body.targetDomain + $Users = $Request.Body.users + $Groups = $Request.Body.groups + + $Results = [System.Collections.Generic.List[object]]::new() + + if ([string]::IsNullOrWhiteSpace($TenantFilter) -or [string]::IsNullOrWhiteSpace($TargetDomain)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = @('Missing required parameters: tenantFilter and targetDomain') } + }) + } + + # Process Users + if ($Users -and $Users.Count -gt 0) { + foreach ($User in $Users) { + try { + $CurrentUPN = $User.userPrincipalName + $DisplayName = $User.displayName ?? $CurrentUPN + $UserId = $User.id + + if ([string]::IsNullOrWhiteSpace($CurrentUPN) -or [string]::IsNullOrWhiteSpace($UserId)) { + $Results.Add("Skipped $($DisplayName ?? 'unknown user') - missing id or userPrincipalName") + continue + } + + if ($CurrentUPN -match '#EXT#') { + $Results.Add("Skipped $DisplayName - guest users cannot have their UPN changed") + continue + } + + $MailNickname = ($CurrentUPN -split '@')[0] + $CurrentDomain = ($CurrentUPN -split '@')[1] + $CurrentMail = $User.mail + $CurrentMailDomain = if ($CurrentMail) { ($CurrentMail -split '@')[1] } else { $null } + + $UPNAlreadyOnTarget = $CurrentDomain -eq $TargetDomain + $MailAlreadyOnTarget = -not $CurrentMailDomain -or $CurrentMailDomain -eq $TargetDomain + + if ($UPNAlreadyOnTarget -and $MailAlreadyOnTarget) { + $Results.Add("Skipped $DisplayName - already on $TargetDomain") + continue + } + + $NewUPN = "$MailNickname@$TargetDomain" + + # Check for conflicts + $EscapedUPN = $NewUPN -replace "'", "''" + $ConflictFilters = @( + "userPrincipalName eq '$EscapedUPN'" + "mail eq '$EscapedUPN'" + "proxyAddresses/any(x:x eq 'smtp:$EscapedUPN')" + ) + $ConflictFound = $false + foreach ($Filter in $ConflictFilters) { + try { + $ConflictUsers = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$filter=$Filter&`$select=id,displayName,userPrincipalName" -tenantid $TenantFilter -ComplexFilter + foreach ($ConflictUser in $ConflictUsers) { + if ($ConflictUser.id -ne $UserId) { + $Results.Add("Failed to migrate $DisplayName - $NewUPN conflicts with user $($ConflictUser.displayName) ($($ConflictUser.userPrincipalName)) [ID: $($ConflictUser.id)]") + $ConflictFound = $true + break + } + } + } catch { + Write-Verbose "Conflict lookup failed for user filter '$Filter': $($_.Exception.Message)" + } + if ($ConflictFound) { break } + } + + if (-not $ConflictFound) { + foreach ($Filter in $ConflictFilters) { + try { + $ConflictGroups = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/groups?`$filter=$Filter&`$select=id,displayName,mail" -tenantid $TenantFilter -ComplexFilter + foreach ($ConflictGroup in $ConflictGroups) { + $Results.Add("Failed to migrate $DisplayName - $NewUPN conflicts with group $($ConflictGroup.displayName) ($($ConflictGroup.mail)) [ID: $($ConflictGroup.id)]") + $ConflictFound = $true + break + } + } catch { + Write-Verbose "Conflict lookup failed for group filter '$Filter': $($_.Exception.Message)" + } + if ($ConflictFound) { break } + } + } + + if ($ConflictFound) { continue } + + # Only change UPN if it's not already on the target domain + if (-not $UPNAlreadyOnTarget) { + $Body = @{ + userPrincipalName = $NewUPN + } | ConvertTo-Json -Compress + $null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/users/$UserId" -tenantid $TenantFilter -type PATCH -body $Body + } + + # Update primary SMTP and preserve old addresses as aliases via Exchange + try { + $CurrentMailbox = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-Mailbox' -cmdParams @{ Identity = $UserId } -UseSystemMailbox $true + if ($CurrentMailbox) { + $CurrentProxyAddresses = @($CurrentMailbox.EmailAddresses) + $OldMail = $User.mail + + # Build new proxy address list: new primary + all existing (demoted) + old UPN alias + old mail alias + $NewProxyAddresses = @("SMTP:$NewUPN") + $NewProxyAddresses += @($CurrentProxyAddresses | ForEach-Object { + if ($_ -cmatch '^SMTP:') { $_.ToLower() } else { $_ } + }) + $NewProxyAddresses += @("smtp:$CurrentUPN") + if ($OldMail -and $OldMail -ne $CurrentUPN -and $OldMail -ne $NewUPN) { + $NewProxyAddresses += @("smtp:$OldMail") + } + + # Deduplicate case-insensitively + $Seen = @{} + $NewProxyAddresses = $NewProxyAddresses | Where-Object { + $lower = $_.ToLower() + if ($Seen.ContainsKey($lower)) { $false } else { $Seen[$lower] = $true; $true } + } + + $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Set-Mailbox' -cmdParams @{ + Identity = $UserId + EmailAddresses = $NewProxyAddresses + } -UseSystemMailbox $true + + $Results.Add("Successfully migrated $DisplayName from $CurrentUPN to $NewUPN (old addresses kept as aliases)") + } else { + $Results.Add("Migrated $DisplayName UPN to $NewUPN (no mailbox found - aliases not created)") + } + } catch { + $AliasError = Get-CippException -Exception $_ + $Results.Add("Migrated $DisplayName UPN to $NewUPN but failed to update aliases: $($AliasError.NormalizedError)") + } + + Write-LogMessage -API $APIName -tenant $TenantFilter -headers $Headers -message "Migrated $DisplayName from $CurrentUPN to $NewUPN" -Sev Info + + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Results.Add("Failed to migrate $($User.displayName ?? $User.userPrincipalName): $($ErrorMessage.NormalizedError)") + Write-LogMessage -API $APIName -tenant $TenantFilter -headers $Headers -message "Failed to migrate $($User.userPrincipalName): $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage + } + } + } + + # Process Groups + if ($Groups -and $Groups.Count -gt 0) { + foreach ($Group in $Groups) { + try { + $GroupMail = $Group.mail + $GroupName = $Group.displayName ?? $GroupMail + $GroupId = $Group.id + $GroupType = $Group.groupType + + if ([string]::IsNullOrWhiteSpace($GroupId)) { + $Results.Add("Skipped group $($GroupName ?? 'unknown') - missing group id") + continue + } + + if ([string]::IsNullOrWhiteSpace($GroupMail)) { + $Results.Add("Skipped group $GroupName - no mail address") + continue + } + + $MailPrefix = ($GroupMail -split '@')[0] + $CurrentGroupDomain = ($GroupMail -split '@')[1] + + if ($CurrentGroupDomain -eq $TargetDomain) { + $Results.Add("Skipped group $GroupName - already on $TargetDomain") + continue + } + + $NewMail = "$MailPrefix@$TargetDomain" + + if ($GroupType -eq 'Microsoft 365 Group') { + $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Set-UnifiedGroup' -cmdParams @{ + Identity = $GroupId + PrimarySmtpAddress = $NewMail + } -UseSystemMailbox $true + } else { + $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Set-DistributionGroup' -cmdParams @{ + Identity = $GroupId + PrimarySmtpAddress = $NewMail + } -UseSystemMailbox $true + } + + $Results.Add("Successfully migrated group $GroupName from $GroupMail to $NewMail (old address kept as alias)") + Write-LogMessage -API $APIName -tenant $TenantFilter -headers $Headers -message "Migrated group $GroupName from $GroupMail to $NewMail" -Sev Info + + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Results.Add("Failed to migrate group $($Group.displayName ?? $Group.mail): $($ErrorMessage.NormalizedError)") + Write-LogMessage -API $APIName -tenant $TenantFilter -headers $Headers -message "Failed to migrate group $($Group.mail): $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage + } + } + } + + if ($Results.Count -eq 0) { + $Results.Add('No users or groups were provided for migration.') + } + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ Results = @($Results) } + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecExpirePassword.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecExpirePassword.ps1 new file mode 100644 index 0000000000..09bc9d0445 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecExpirePassword.ps1 @@ -0,0 +1,51 @@ +function Invoke-ExecExpirePassword { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Identity.User.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + + # Get parameters from query or body + $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter + $UserID = $Request.Query.ID ?? $Request.Body.ID + $DisplayName = $Request.Query.displayName ?? $Request.Body.displayName ?? $UserID + + try { + # Set forceChangePasswordNextSignIn without changing the password + $Body = [PSCustomObject]@{ + 'passwordProfile' = @{ + 'forceChangePasswordNextSignIn' = $true + } + } | ConvertTo-Json -Depth 5 -Compress + + Write-Host "Expiring password for user: $UserID with body: $Body" + $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/users/$($UserID)" -tenantid $TenantFilter -type PATCH -body $Body -verbose + + $Result = @{ + resultText = "Successfully set password to expire for $DisplayName ($UserID). The user will be required to change their password on next sign-in. Use 'Revoke all user sessions' to force immediate re-authentication." + state = 'success' + } + + Write-LogMessage -headers $Headers -API $APIName -message "Set password to expire for $DisplayName ($UserID)" -Sev 'Info' -tenant $TenantFilter + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Result = @{ + resultText = "Failed to expire password for $DisplayName ($UserID). Error: $($ErrorMessage.NormalizedError)" + state = 'error' + } + Write-LogMessage -headers $Headers -API $APIName -message "Failed to expire password for $DisplayName ($UserID). Error: $($ErrorMessage.NormalizedError)" -Sev 'Error' -tenant $TenantFilter -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::BadRequest + } + + return [HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @{ Results = $Result } + } +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1 index 5c0f5b609c..e1a9bbb4f6 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1 @@ -13,6 +13,37 @@ function Invoke-ExecJITAdmin { $APIName = $Request.Params.CIPPEndpoint $Headers = $Request.Headers + + # Set by ExecJITAdminRequestDecision once a request has its approvals + $ApprovalRequestId = $Request.Body.ApprovalRequestId + if ($ApprovalRequestId) { + $ApprovalTable = Get-CIPPTable -TableName 'JITAdminRequests' + $ParsedId = [guid]::Empty + $ApprovalRow = if ([guid]::TryParse([string]$ApprovalRequestId, [ref]$ParsedId)) { + Get-CIPPAzDataTableEntity @ApprovalTable -Filter "PartitionKey eq 'JITAdminRequest' and RowKey eq '$ParsedId'" + } + $CallingUser = ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails + $Claimed = $false + if ($ApprovalRow.State -eq 'Approved' -and $ApprovalRow.RequestedBy -eq $CallingUser) { + try { + $null = Update-AzDataTableEntity @ApprovalTable -Entity @{ PartitionKey = $ApprovalRow.PartitionKey; RowKey = $ApprovalRow.RowKey; State = 'Completed'; ETag = $ApprovalRow.ETag } + $Claimed = $true + } catch { + Write-Information "JIT Admin request $ApprovalRequestId was already claimed" + } + } + if (-not $Claimed) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ 'Results' = @('This JIT admin request is not approved or has already been provisioned.') } + }) + } + # Provision exactly what was approved; credentials are generated by the requester afterwards, never shown to the approver + $ApprovedBody = $ApprovalRow.RequestBody | ConvertFrom-Json + $ApprovedBody | Add-Member -NotePropertyName UseTAP -NotePropertyValue $false -Force + $Request = [pscustomobject]@{ Params = $Request.Params; Headers = $Headers; Body = $ApprovedBody } + } + $TenantFilter = $Request.Body.tenantFilter.value ? $Request.Body.tenantFilter.value : $Request.Body.tenantFilter @@ -67,13 +98,53 @@ function Invoke-ExecJITAdmin { $ErrorMessage = "You are not permitted to assign the following role(s): $($ForbiddenLabels -join ', ')" Write-LogMessage -headers $Headers -API $APIName -message $ErrorMessage -Sev 'Error' return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest + StatusCode = [HttpStatusCode]::Forbidden Body = @{'Results' = @($ErrorMessage) } }) } } } + if (-not $ApprovalRequestId) { + $ApprovalRequirement = Get-CIPPJITAdminApprovalRequirement -Roles $RequestedRoles + if ($ApprovalRequirement) { + $CallingUser = ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails + $RequestedGroups = @($Request.Body.GroupMemberships.value | Where-Object { $_ }) + $ApprovalRow = @{ + PartitionKey = 'JITAdminRequest' + RowKey = [string][guid]::NewGuid() + State = 'Pending' + Tenant = [string]$TenantFilter + TargetUser = [string]$(if ($Request.Body.userAction -eq 'create') { '{0}@{1}' -f $Request.Body.Username, ($Request.Body.Domain.value ?? $Request.Body.Domain) } else { $Request.Body.existingUser.label ?? $Request.Body.existingUser.value }) + RoleIds = [string](ConvertTo-Json -InputObject $RequestedRoles -Compress) + RoleNames = [string](@($Request.Body.AdminRoles | ForEach-Object { $_.label ?? $_.value }) -join ', ') + GroupIds = [string](ConvertTo-Json -InputObject $RequestedGroups -Compress) + GroupNames = [string](@($Request.Body.GroupMemberships | ForEach-Object { $_.label ?? $_.value }) -join ', ') + Reason = [string]$Request.Body.Reason + StartDate = [string]$Request.Body.StartDate + EndDate = [string]$Request.Body.EndDate + RequestedBy = [string]$CallingUser + RequestedAt = (Get-Date).ToUniversalTime().ToString('o') + RequesterHeaders = [string](ConvertTo-Json -Compress -InputObject @{ + 'x-ms-client-principal' = $Headers.'x-ms-client-principal' + 'x-ms-client-principal-name' = $Headers.'x-ms-client-principal-name' + }) + RequestBody = [string](ConvertTo-Json -InputObject $Request.Body -Depth 10 -Compress) + ApproverRoles = [string](ConvertTo-Json -InputObject @($ApprovalRequirement.ApproverRoles) -Compress) + RequiredApprovals = [int]$ApprovalRequirement.RequiredApprovals + Decisions = '[]' + } + $ApprovalTable = Get-CIPPTable -TableName 'JITAdminRequests' + Add-CIPPAzDataTableEntity @ApprovalTable -Entity $ApprovalRow -Force + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "JIT Admin request for $($ApprovalRow.TargetUser) ($($ApprovalRow.RoleNames)) submitted for approval" -Sev 'Info' + Send-CIPPJITAdminApprovalNotification -ApprovalRequest ([pscustomobject]$ApprovalRow) -Status 'Requested' + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ 'Results' = @("JIT Admin request for $($ApprovalRow.TargetUser) submitted for approval. It needs $($ApprovalRow.RequiredApprovals) approval(s) from: $($ApprovalRequirement.ApproverRoles -join ', ').") } + }) + } + } + if ($Request.Body.userAction -eq 'create') { $Domain = $Request.Body.Domain.value ? $Request.Body.Domain.value : $Request.Body.Domain $Username = "$($Request.Body.Username)@$($Domain)" @@ -98,7 +169,7 @@ function Invoke-ExecJITAdmin { $CreateResult = Set-CIPPUserJITAdmin @JITAdmin } catch { return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest + StatusCode = [HttpStatusCode]::InternalServerError Body = @{'Results' = @("Failed to create JIT Admin user: $($_.Exception.Message)") } }) } @@ -107,7 +178,7 @@ function Invoke-ExecJITAdmin { copyField = $Username state = 'success' }) - if (!$Request.Body.UseTAP) { + if (!$Request.Body.UseTAP -and -not $ApprovalRequestId) { $Results.Add(@{ resultText = "Password: $($CreateResult.password)" copyField = $CreateResult.password @@ -147,6 +218,7 @@ function Invoke-ExecJITAdmin { + $StatusCode = [HttpStatusCode]::OK #Region TAP creation if ($Request.Body.UseTAP) { try { @@ -215,6 +287,7 @@ function Invoke-ExecJITAdmin { }) $Results.Add("This TAP is usable starting at $($TapRequest.startDateTime) UTC for the next $PasswordExpiration minutes") } catch { + $StatusCode = [HttpStatusCode]::MultiStatus $Results.Add('Failed to create TAP, if this is not yet enabled, use the Standards to push the settings to the tenant.') Write-Information (Get-CippException -Exception $_ | ConvertTo-Json -Depth 5) if ($Password) { @@ -228,6 +301,11 @@ function Invoke-ExecJITAdmin { } #EndRegion TAP creation + if ($ApprovalRequestId) { + $null = Update-AzDataTableEntity @ApprovalTable -Entity @{ PartitionKey = $ApprovalRow.PartitionKey; RowKey = $ApprovalRow.RowKey; TargetUser = [string]$Username } + $Results.Add('Sign-in credentials were not generated. The requester can create a TAP or reset the password from the JIT Admin page.') + } + $Parameters = @{ TenantFilter = $TenantFilter User = @{ @@ -245,27 +323,30 @@ function Invoke-ExecJITAdmin { Reason = $Request.Body.Reason Expiration = $Expiration StartDate = $Start - Headers = $Headers - APIName = $APIName + Headers = $Headers + APIName = $APIName + ApprovalRequestId = $ApprovalRequestId } - if ($Start -gt (Get-Date)) { - $TaskBody = @{ - TenantFilter = $TenantFilter - Name = "JIT Admin (enable): $Username" - AlertComment = if (![string]::IsNullOrWhiteSpace($Request.Body.Reason)) { "JIT Reason: $($Request.Body.Reason)" } else { $null } - Command = @{ - value = 'Set-CIPPUserJITAdmin' - label = 'Set-CIPPUserJITAdmin' - } - Parameters = [pscustomobject]$Parameters - ScheduledTime = $Request.Body.StartDate - PostExecution = @{ - Webhook = [bool]($Request.Body.PostExecution | Where-Object -Property value -EQ 'webhook') - Email = [bool]($Request.Body.PostExecution | Where-Object -Property value -EQ 'email') - PSA = [bool]($Request.Body.PostExecution | Where-Object -Property value -EQ 'PSA') - Push = [bool]($Request.Body.PostExecution | Where-Object -Property value -EQ 'Push') - } + $StartsLater = $Start -gt (Get-Date) + # Always enable via the scheduler so PostExecution notifications fire on creation too + $TaskBody = @{ + TenantFilter = $TenantFilter + Name = "JIT Admin (enable): $Username" + AlertComment = if (![string]::IsNullOrWhiteSpace($Request.Body.Reason)) { "JIT Reason: $($Request.Body.Reason)" } else { $null } + Command = @{ + value = 'Set-CIPPUserJITAdmin' + label = 'Set-CIPPUserJITAdmin' } + Parameters = [pscustomobject]$Parameters + ScheduledTime = if ($StartsLater) { $Request.Body.StartDate } else { [string][DateTimeOffset]::UtcNow.ToUnixTimeSeconds() } + PostExecution = @{ + Webhook = [bool]($Request.Body.PostExecution | Where-Object -Property value -EQ 'webhook') + Email = [bool]($Request.Body.PostExecution | Where-Object -Property value -EQ 'email') + PSA = [bool]($Request.Body.PostExecution | Where-Object -Property value -EQ 'PSA') + Push = [bool]($Request.Body.PostExecution | Where-Object -Property value -EQ 'Push') + } + } + if ($StartsLater) { Add-CIPPScheduledTask -Task $TaskBody -hidden $false if ($Request.Body.userAction -ne 'create') { Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $Request.Body.existingUser.value -Expiration $Expiration -StartDate $Start -Reason $Request.Body.Reason -CreatedBy (([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails) @@ -273,15 +354,9 @@ function Invoke-ExecJITAdmin { Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Scheduled JIT Admin enable task for $Username" -Sev 'Info' $Results.Add("Scheduling JIT Admin enable task for $Username") } else { - try { - $Results.Add("Executing JIT Admin enable task for $Username") - Set-CIPPUserJITAdmin @Parameters - } catch { - return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest - Body = @{'Results' = @("Failed to execute JIT Admin enable task: $($_.Exception.Message)") } - }) - } + $null = Add-CIPPScheduledTask -Task $TaskBody -hidden $false -RunNow + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Queued JIT Admin enable task for $Username to run now" -Sev 'Info' + $Results.Add("Queued JIT Admin enable task for $Username to run now") } $DisableTaskBody = [pscustomobject]@{ @@ -315,7 +390,7 @@ function Invoke-ExecJITAdmin { $Results.Add("Scheduling JIT Admin $($Request.Body.ExpireAction.value) task for $Username") return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = @{'Results' = @($Results) } }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdminRequestDecision.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdminRequestDecision.ps1 new file mode 100644 index 0000000000..559a7b5457 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdminRequestDecision.ps1 @@ -0,0 +1,102 @@ +function Invoke-ExecJITAdminRequestDecision { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Identity.Role.ReadWrite + .SYNOPSIS + Approve or reject a pending JIT Admin request + .DESCRIPTION + Records an approval or rejection on a pending JIT Admin request. The approver must hold one of the configured approver roles and cannot approve their own request. Any rejection ends the request; once the required number of approvals is reached the request is provisioned. + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + $RequestId = $Request.Body.RequestId + $Decision = switch ($Request.Body.Decision) { + 'Approve' { 'Approve' } + 'Reject' { 'Reject' } + } + # Required when rejecting; sent to the requester + $Note = $Request.Body.Note + + $Table = Get-CIPPTable -TableName 'JITAdminRequests' + try { + if (-not $Decision) { $FailCode = [HttpStatusCode]::BadRequest; throw 'Decision must be Approve or Reject.' } + if ($Decision -eq 'Reject' -and [string]::IsNullOrWhiteSpace($Note)) { $FailCode = [HttpStatusCode]::BadRequest; throw 'A note is required when rejecting a request.' } + $ParsedId = [guid]::Empty + if (-not [guid]::TryParse([string]$RequestId, [ref]$ParsedId)) { $FailCode = [HttpStatusCode]::BadRequest; throw 'Invalid request id.' } + $Row = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'JITAdminRequest' and RowKey eq '$ParsedId'" + if (-not $Row -or $Row.Tenant -ne $TenantFilter) { $FailCode = [HttpStatusCode]::NotFound; throw 'JIT Admin request not found.' } + if ($Row.State -ne 'Pending') { $FailCode = [HttpStatusCode]::BadRequest; throw "This request is already $($Row.State.ToLower())." } + + $CallingUser = ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails + if ($Decision -eq 'Approve' -and $CallingUser -eq $Row.RequestedBy) { $FailCode = [HttpStatusCode]::Forbidden; throw 'You cannot approve your own request.' } + $ApproverRoles = @($Row.ApproverRoles | ConvertFrom-Json) + if (@(Get-CIPPAccessRole -Headers $Headers).Where({ $_ -in $ApproverRoles }).Count -eq 0) { + $FailCode = [HttpStatusCode]::Forbidden + throw "Only users with one of these roles can decide on this request: $($ApproverRoles -join ', ')" + } + + $Decisions = [System.Collections.Generic.List[object]]::new() + foreach ($Existing in @($Row.Decisions | ConvertFrom-Json)) { $Decisions.Add($Existing) } + if ($Decisions.By -contains $CallingUser) { $FailCode = [HttpStatusCode]::BadRequest; throw 'You have already approved this request.' } + $Decisions.Add([pscustomobject]@{ By = $CallingUser; At = (Get-Date).ToUniversalTime().ToString('o'); Decision = $Decision; Note = [string]$Note }) + $Approvals = @($Decisions.Where({ $_.Decision -eq 'Approve' })).Count + $NewState = if ($Decision -eq 'Reject') { 'Rejected' } elseif ($Approvals -ge [int]$Row.RequiredApprovals) { 'Approved' } else { 'Pending' } + if ($NewState -eq 'Approved' -and [int64]$Row.EndDate -le [DateTimeOffset]::UtcNow.ToUnixTimeSeconds()) { + $FailCode = [HttpStatusCode]::BadRequest + throw 'The requested access window has already ended. Reject this request instead.' + } + + try { + $null = Update-AzDataTableEntity @Table -Entity @{ + PartitionKey = $Row.PartitionKey + RowKey = $Row.RowKey + State = $NewState + Decisions = [string](ConvertTo-Json -InputObject @($Decisions) -Compress) + ETag = $Row.ETag + } + } catch { + throw 'This request was updated by someone else. Refresh and try again.' + } + $Verb = $Decision -eq 'Approve' ? 'approved' : 'rejected' + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "$CallingUser $Verb the JIT Admin request for $($Row.TargetUser) ($($Row.RoleNames))$(if ($Note) { ": $Note" })" -Sev 'Info' + + $Results = switch ($NewState) { + 'Rejected' { + Send-CIPPJITAdminApprovalNotification -ApprovalRequest $Row -Status 'Rejected' -Note $Note + "Rejected the JIT Admin request for $($Row.TargetUser)." + } + 'Pending' { + "Approval recorded ($Approvals of $($Row.RequiredApprovals))." + } + 'Approved' { + $Provision = Invoke-ExecJITAdmin -TriggerMetadata $null -Request ([pscustomobject]@{ + Params = [pscustomobject]@{ CIPPEndpoint = 'ExecJITAdmin' } + Headers = ($Row.RequesterHeaders | ConvertFrom-Json -AsHashtable) + Body = [pscustomobject]@{ ApprovalRequestId = $Row.RowKey } + }) + $ProvisionResults = @($Provision.Body.Results | ForEach-Object { $_.resultText ?? $_ }) + $Update = @{ PartitionKey = $Row.PartitionKey; RowKey = $Row.RowKey; Results = [string]($ProvisionResults -join "`n") } + if ($Provision.StatusCode -ne [HttpStatusCode]::OK) { $Update.State = 'Failed' } + $null = Update-AzDataTableEntity @Table -Entity $Update + Send-CIPPJITAdminApprovalNotification -ApprovalRequest $Row -Status 'Approved' -Note $Note -Results $ProvisionResults + "Approved the JIT Admin request for $($Row.TargetUser)." + $ProvisionResults + } + } + $StatusCode = [HttpStatusCode]::OK + } catch { + $StatusCode = $FailCode ?? [HttpStatusCode]::InternalServerError + $Results = $_.Exception.Message + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @{ 'Results' = @($Results) } + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecOffboardUser.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecOffboardUser.ps1 index 93cb15122b..9a1f2ce787 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecOffboardUser.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecOffboardUser.ps1 @@ -17,13 +17,14 @@ function Invoke-ExecOffboardUser { try { # RowKey of the offboarding task to run again $TaskId = [string]$Request.Body.TaskId - if (-not $TaskId) { throw 'TaskId is required' } + if (-not $TaskId) { $FailCode = [HttpStatusCode]::BadRequest; throw 'TaskId is required' } $TenantFilter = [string]($Request.Body.tenantFilter.value ?? $Request.Body.tenantFilter) $Table = Get-CIPPTable -TableName 'ScheduledTasks' $SafeTaskId = $TaskId -replace "'", "''" $Task = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'ScheduledTask' and RowKey eq '$SafeTaskId'" # Access to tenantFilter was checked on the way in; the task must belong to that tenant. if (-not $Task -or $Task.Command -ne 'Invoke-CIPPOffboardingJob' -or [string]$Task.Tenant -ne $TenantFilter) { + $FailCode = [HttpStatusCode]::NotFound throw 'No offboarding task with that id exists in this tenant' } @@ -32,7 +33,7 @@ function Invoke-ExecOffboardUser { } else { # Zero-based index of the step, as listed in the progress row, to run again $StepIndex = $Request.Body.StepIndex -as [int] - if ($null -eq $StepIndex) { throw 'StepIndex is required' } + if ($null -eq $StepIndex) { $FailCode = [HttpStatusCode]::BadRequest; throw 'StepIndex is required' } # Title of that step, used to name the re-run task $StepTitle = [string]$Request.Body.StepTitle $Parameters = $Task.Parameters | ConvertFrom-Json @@ -60,7 +61,7 @@ function Invoke-ExecOffboardUser { }) } catch { return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest + StatusCode = $FailCode ?? [HttpStatusCode]::InternalServerError Body = @{ Results = "Failed to queue the re-run: $($_.Exception.Message)" } }) } @@ -88,7 +89,7 @@ function Invoke-ExecOffboardUser { Write-LogMessage -headers $Request.Headers -API $Request.Params.CIPPEndpoint -tenant $TenantFilter -message "Could not create the offboarding progress rows: $($_.Exception.Message)" -sev Warn } - $StatusCode = [HttpStatusCode]::OK + $Failed = 0 $Results = foreach ($username in $AllUsers) { try { $Headers = $Request.Headers @@ -126,10 +127,11 @@ function Invoke-ExecOffboardUser { } Add-CIPPScheduledTask @Params } catch { - $StatusCode = [HttpStatusCode]::Forbidden + $Failed++ $_.Exception.message } } + $StatusCode = Get-CippBulkStatusCode -Total @($AllUsers).Count -Failed $Failed $body = [pscustomobject]@{'Results' = @($Results) } if ($DeploymentId -and -not $Request.Body.Scheduled.enabled) { # Only a run-now job is worth polling straight away; a scheduled one is watched from its task page. diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecOneDriveShortCut.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecOneDriveShortCut.ps1 index 338576a2b8..198575b306 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecOneDriveShortCut.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecOneDriveShortCut.ps1 @@ -7,7 +7,7 @@ Function Invoke-ExecOneDriveShortCut { .SYNOPSIS Creates a OneDrive shortcut to a SharePoint library for one or more users. .DESCRIPTION - Accepts one { username, userid, siteUrl, destination, tenantFilter } object or an array of them (the Users table bulk action). Every user is attempted: a failure for one user (for example a shortcut that already exists) is reported in its place and does not stop the remaining users, so a bulk rollout never has to be re-run to find out where it got to. The response is one result per user plus a summary line, and only returns an error status when no user succeeded. + Accepts one { username, userid, siteUrl, destination, optional shortcutName, tenantFilter } object or an array of them (the Users table bulk action). Every user is attempted: a failure for one user (for example a shortcut that already exists) is reported in its place and does not stop the remaining users, so a bulk rollout never has to be re-run to find out where it got to. The response is one result per user plus a summary line, and only returns an error status when no user succeeded. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -40,8 +40,10 @@ Function Invoke-ExecOneDriveShortCut { $Destination = 'root' } + $ShortcutName = [string]$Entry.shortcutName + try { - $Message = New-CIPPOneDriveShortCut -Username $Username -UserId $UserId -TenantFilter $TenantFilter -URL $URL -Destination $Destination -Headers $Headers + $Message = New-CIPPOneDriveShortCut -Username $Username -UserId $UserId -TenantFilter $TenantFilter -URL $URL -Destination $Destination -ShortcutName $ShortcutName -Headers $Headers & $Add $Message 'success' } catch { # New-CIPPOneDriveShortCut has already logged the failure; record it and carry on with the next user @@ -56,8 +58,7 @@ Function Invoke-ExecOneDriveShortCut { & $Add "Created OneDrive shortcuts for $Succeeded of $($Entries.Count) users. $Failed failed; see the entries above for the users to address manually." $SummaryState } - # Only an all-failed run is an error response; a partial failure is a 200 with the per-user entries above - $StatusCode = if ($Failed -eq $Entries.Count) { [HttpStatusCode]::InternalServerError } else { [HttpStatusCode]::OK } + $StatusCode = Get-CippBulkStatusCode -Total $Entries.Count -Failed $Failed return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecRemoveAdminRole.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecRemoveAdminRole.ps1 index b5786ecc31..1419d8fc31 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecRemoveAdminRole.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecRemoveAdminRole.ps1 @@ -71,7 +71,7 @@ function Invoke-ExecRemoveAdminRole { } } - $StatusCode = $Failures -gt 0 ? [HttpStatusCode]::InternalServerError : [HttpStatusCode]::OK + $StatusCode = Get-CippBulkStatusCode -Total $Users.Count -Failed $Failures return [HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecRemoveRoleMember.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecRemoveRoleMember.ps1 new file mode 100644 index 0000000000..d37511df31 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecRemoveRoleMember.ps1 @@ -0,0 +1,36 @@ +function Invoke-ExecRemoveRoleMember { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Identity.Role.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $TenantFilter = $Request.Body.TenantFilter + $RoleId = $Request.Body.RoleId + $MemberId = $Request.Body.MemberId + $RoleName = $Request.Body.RoleName + $MemberName = $Request.Body.MemberName + + try { + # Remove the member from the directory role + $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/directoryRoles/$RoleId/members/$MemberId/`$ref" -tenantid $TenantFilter -type DELETE + + $Results = "Successfully removed $MemberName from the $RoleName role" + Write-LogMessage -headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Results -Sev 'Info' + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Results = "Failed to remove member from role. $($ErrorMessage.NormalizedError)" + Write-LogMessage -headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Results -Sev 'Error' + $StatusCode = [HttpStatusCode]::BadRequest + } + + return [HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @{ Results = $Results } + } +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecResetPass.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecResetPass.ps1 index 013bbd891e..038496b8fe 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecResetPass.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecResetPass.ps1 @@ -11,26 +11,83 @@ Function Invoke-ExecResetPass { $APIName = $Request.Params.CIPPEndpoint $Headers = $Request.Headers + # multiPost bulk actions POST an array of user objects in one request. + # Accessing $Request.Body.MustChange on an array enumerates to Object[], + # which breaks [System.Convert]::ToBoolean — process each item instead. + $Users = if ($Request.Body -is [array]) { + $Request.Body + } else { + @( + [pscustomobject]@{ + tenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter + ID = $Request.Query.ID ?? $Request.Body.ID + displayName = $Request.Query.displayName ?? $Request.Body.displayName + MustChange = $Request.Query.MustChange ?? $Request.Body.MustChange + password = $Request.Query.password ?? $Request.Body.password + } + ) + } + + $Results = [System.Collections.Generic.List[object]]::new() + $HadFailure = $false + + foreach ($User in $Users) { + $TenantFilter = $User.tenantFilter + $ID = $User.ID + $DisplayName = $User.displayName ?? $ID + $Password = $User.password + # Coerce MustChange safely — null/empty => false; unwrap accidental arrays + $MustChangeRaw = $User.MustChange + if ($null -eq $MustChangeRaw -or $MustChangeRaw -eq '') { + $MustChange = $false + } elseif ($MustChangeRaw -is [bool]) { + $MustChange = $MustChangeRaw + } elseif ($MustChangeRaw -is [array]) { + $MustChange = if ($MustChangeRaw.Count -gt 0) { [System.Convert]::ToBoolean($MustChangeRaw[0]) } else { $false } + } else { + $MustChange = [System.Convert]::ToBoolean($MustChangeRaw) + } - # Interact with query parameters or the body of the request. - $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter - $ID = $Request.Query.ID ?? $Request.Body.ID - $DisplayName = $Request.Query.displayName ?? $Request.Body.displayName ?? $ID - $MustChange = $Request.Query.MustChange ?? $Request.Body.MustChange - $MustChange = [System.Convert]::ToBoolean($MustChange) + if ([string]::IsNullOrWhiteSpace($ID) -or [string]::IsNullOrWhiteSpace($TenantFilter)) { + $Results.Add('Failed to reset password: missing ID or tenantFilter') + $HadFailure = $true + continue + } - try { - $Result = Set-CIPPResetPassword -UserID $ID -tenantFilter $TenantFilter -APIName $APIName -Headers $Headers -forceChangePasswordNextSignIn $MustChange -DisplayName $DisplayName - $StatusCode = [HttpStatusCode]::OK - } catch { - $Result = $_.Exception.Message - $StatusCode = [HttpStatusCode]::InternalServerError + try { + $ResetParams = @{ + UserID = $ID + tenantFilter = $TenantFilter + APIName = $APIName + Headers = $Headers + forceChangePasswordNextSignIn = $MustChange + DisplayName = $DisplayName + } + if ($Password) { + $ResetParams['Password'] = $Password + } + $Results.Add((Set-CIPPResetPassword @ResetParams)) + } catch { + $Results.Add("Failed to reset password for $DisplayName, $ID`: $((Get-CippException -Exception $_).NormalizedError)") + $HadFailure = $true + } } + $StatusCode = if ($HadFailure -and $Results.Count -eq 1) { + [HttpStatusCode]::InternalServerError + } elseif ($HadFailure) { + [HttpStatusCode]::BadRequest + } else { + [HttpStatusCode]::OK + } + + # Preserve single-result shape for non-bulk callers + $BodyResults = if ($Users.Count -eq 1) { $Results[0] } else { @($Results) } + return ([HttpResponseContext]@{ StatusCode = $StatusCode - Body = @{'Results' = $Result } + Body = @{'Results' = $BodyResults } }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecRoleAssignment.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecRoleAssignment.ps1 new file mode 100644 index 0000000000..91b3bf73d9 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecRoleAssignment.ps1 @@ -0,0 +1,134 @@ +function Invoke-ExecRoleAssignment { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Identity.Role.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + $UserId = $Request.Body.userId + $UserPrincipalName = $Request.Body.userPrincipalName + $DisplayName = $Request.Body.displayName + $Action = $Request.Body.action + $Reason = $Request.Body.reason ?? 'No reason provided' + + $Roles = if ($Request.Body.roles.value) { + $Request.Body.roles | ForEach-Object { $_.value } + } else { + @($Request.Body.roles) + } + + $RoleLabels = if ($Request.Body.roles.label) { + $Request.Body.roles | ForEach-Object { $_.label } + } else { + @($Request.Body.roles) + } + + $Results = [System.Collections.Generic.List[object]]::new() + + try { + $UserObj = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/users/$UserId" -tenantid $TenantFilter + + switch ($Action) { + 'Add' { + foreach ($Role in $Roles) { + try { + $Body = @{ + '@odata.id' = "https://graph.microsoft.com/v1.0/directoryObjects/$($UserObj.id)" + } | ConvertTo-Json -Compress + $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/directoryRoles(roleTemplateId='$Role')/members/`$ref" -tenantid $TenantFilter -body $Body + } catch { + $RoleError = Get-NormalizedError -Message $_.Exception.Message + if ($RoleError -notmatch 'already exist') { + throw $RoleError + } + } + } + $RoleNames = ($RoleLabels -join ', ') + $Message = "Successfully assigned roles ($RoleNames) to $DisplayName ($UserPrincipalName)" + $Results.Add($Message) + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev 'Info' + } + 'Remove' { + foreach ($Role in $Roles) { + try { + $null = New-GraphPOSTRequest -type DELETE -uri "https://graph.microsoft.com/beta/directoryRoles(roleTemplateId='$Role')/members/$($UserObj.id)/`$ref" -tenantid $TenantFilter + } catch { + $RoleError = Get-NormalizedError -Message $_.Exception.Message + throw $RoleError + } + } + $RoleNames = ($RoleLabels -join ', ') + $Message = "Successfully removed roles ($RoleNames) from $DisplayName ($UserPrincipalName)" + $Results.Add($Message) + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev 'Info' + } + 'AddTemporary' { + foreach ($Role in $Roles) { + try { + $Body = @{ + '@odata.id' = "https://graph.microsoft.com/v1.0/directoryObjects/$($UserObj.id)" + } | ConvertTo-Json -Compress + $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/directoryRoles(roleTemplateId='$Role')/members/`$ref" -tenantid $TenantFilter -body $Body + } catch { + $RoleError = Get-NormalizedError -Message $_.Exception.Message + if ($RoleError -notmatch 'already exist') { + throw $RoleError + } + } + } + + $Expiration = ([System.DateTimeOffset]::FromUnixTimeSeconds($Request.Body.expiration)).DateTime + + $RemoveTaskBody = [pscustomobject]@{ + TenantFilter = $TenantFilter + Name = "Role Assignment (Remove): $UserPrincipalName" + Command = @{ + value = 'Invoke-ExecRoleAssignment' + label = 'Invoke-ExecRoleAssignment' + } + Parameters = [pscustomobject]@{ + Body = @{ + tenantFilter = $TenantFilter + userId = $UserObj.id + userPrincipalName = $UserPrincipalName + displayName = $DisplayName + roles = $Request.Body.roles + action = 'Remove' + reason = "Scheduled removal - $Reason" + } + } + ScheduledTime = $Request.Body.expiration + PostExecution = @{ + Webhook = $false + Email = $false + PSA = $false + } + } + $null = Add-CIPPScheduledTask -Task $RemoveTaskBody -hidden $false + + $RoleNames = ($RoleLabels -join ', ') + $Message = "Successfully assigned temporary roles ($RoleNames) to $DisplayName ($UserPrincipalName). Roles will be removed on $($Expiration.ToString('g')). Reason: $Reason" + $Results.Add($Message) + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev 'Info' + } + } + + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Results.Add("Failed to $Action role assignment. $($ErrorMessage.NormalizedError)") + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to $Action role assignment for $UserPrincipalName. $($ErrorMessage.NormalizedError)" -Sev 'Error' + $StatusCode = [HttpStatusCode]::BadRequest + } + + return [HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @{ Results = @($Results) } + } +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecScheduleGroupMembershipVacation.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecScheduleGroupMembershipVacation.ps1 new file mode 100644 index 0000000000..8140abd007 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecScheduleGroupMembershipVacation.ps1 @@ -0,0 +1,99 @@ +function Invoke-ExecScheduleGroupMembershipVacation { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Identity.Group.ReadWrite + .SYNOPSIS + Schedule group membership for a vacation period + .DESCRIPTION + Adds the selected users to each selected group at the start date and removes them again at the end date. Users who were already members of a group are left untouched. + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + + try { + $TenantFilter = $Request.Body.tenantFilter + # The users going on vacation + $Users = @($Request.Body.Users) + # The groups to add the users to, as { value = group id; label = display name } + $Groups = @($Request.Body.Groups | Where-Object { $_.value }) + # Unix timestamp for when the users are added + $StartDate = $Request.Body.startDate + # Unix timestamp for when the users are removed + $EndDate = $Request.Body.endDate + + $UserUPNs = @($Users | ForEach-Object { $_.addedFields.userPrincipalName ?? $_.value ?? $_ }) + + if ($UserUPNs.Count -eq 0) { + throw 'At least one user is required.' + } + if ($Groups.Count -eq 0) { + throw 'At least one group is required.' + } + if (-not $StartDate -or -not $EndDate) { + throw 'A start date and end date are required.' + } + + $UserDisplay = ($UserUPNs | Select-Object -First 3) -join ', ' + if ($UserUPNs.Count -gt 3) { $UserDisplay += " (+$($UserUPNs.Count - 3) more)" } + + foreach ($Group in $Groups) { + $GroupLabel = $Group.label ?? $Group.value + # Links the add and remove runs so the remove only takes out the users the add put in. + $MembershipKey = [guid]::NewGuid().ToString() + + Add-CIPPScheduledTask -Task ([PSCustomObject]@{ + TenantFilter = $TenantFilter + Name = "Add Group Membership Vacation Mode: $GroupLabel - $UserDisplay" + Command = @{ value = 'Set-CIPPVacationGroupMembership'; label = 'Set-CIPPVacationGroupMembership' } + Parameters = [PSCustomObject]@{ + TenantFilter = $TenantFilter + Users = $UserUPNs + GroupId = $Group.value + GroupType = $Group.addedFields.groupType + Action = 'Add' + MembershipKey = $MembershipKey + } + ScheduledTime = [int64]$StartDate + PostExecution = $Request.Body.postExecution + Reference = $Request.Body.reference + }) -hidden $false + + Add-CIPPScheduledTask -Task ([PSCustomObject]@{ + TenantFilter = $TenantFilter + Name = "Remove Group Membership Vacation Mode: $GroupLabel - $UserDisplay" + Command = @{ value = 'Set-CIPPVacationGroupMembership'; label = 'Set-CIPPVacationGroupMembership' } + Parameters = [PSCustomObject]@{ + TenantFilter = $TenantFilter + Users = $UserUPNs + GroupId = $Group.value + GroupType = $Group.addedFields.groupType + Action = 'Remove' + MembershipKey = $MembershipKey + } + ScheduledTime = [int64]$EndDate + PostExecution = $Request.Body.postExecution + Reference = $Request.Body.reference + }) -hidden $false + } + + $GroupDisplay = ($Groups | ForEach-Object { $_.label ?? $_.value }) -join ', ' + $Result = "Successfully scheduled group membership vacation mode for $UserDisplay in $GroupDisplay." + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev 'Info' + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Result = "Failed to schedule group membership vacation mode: $($ErrorMessage.NormalizedError)" + Write-LogMessage -headers $Headers -API $APIName -message $Result -Sev Error -tenant $TenantFilter -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @{ Results = $Result } + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecSendPush.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecSendPush.ps1 index 5fc330a57a..f62e0ea2ba 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecSendPush.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecSendPush.ps1 @@ -30,7 +30,7 @@ function Invoke-ExecSendPush { $Body = $_.Exception.Message Write-LogMessage -headers $Request.Headers -API $APINAME -message "Failed MFA request for $UserEmail - $Body" -Sev 'Error' return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = [HttpStatusCode]::InternalServerError Body = [pscustomobject]@{'Results' = @{ resultText = $Body; state = 'error' } } }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecSetManager.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecSetManager.ps1 new file mode 100644 index 0000000000..7450d2252b --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecSetManager.ps1 @@ -0,0 +1,63 @@ +function Invoke-ExecSetManager { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Identity.User.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + + $HttpResponse = [HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{'Results' = @("Default response, you should never see this.") } + } + + try { + $Users = if ($Request.Body -is [array]) { $Request.Body } else { @($Request.Body) } + + $InvalidUsers = $Users | Where-Object { + ([string]::IsNullOrWhiteSpace($_.userPrincipalName) -and [string]::IsNullOrWhiteSpace($_.id)) -or + [string]::IsNullOrWhiteSpace($_.tenantFilter) -or + [string]::IsNullOrWhiteSpace($_.managerId) + } + + if ($InvalidUsers.Count -gt 0) { + $HttpResponse.StatusCode = [HttpStatusCode]::BadRequest + $HttpResponse.Body = @{'Results' = @('Failed to set manager. Some users are missing userPrincipalName/id, tenantFilter, or managerId') } + return $HttpResponse + } + + $TotalSuccessCount = 0 + $AllErrorMessages = @() + + foreach ($User in $Users) { + try { + $userIdentifier = if ($User.userPrincipalName) { $User.userPrincipalName } else { $User.id } + $managerIdentifier = if ($User.managerId.value) { $User.managerId.value } else { $User.managerId } + $result = Set-CIPPManager -User $userIdentifier -Manager $managerIdentifier -TenantFilter $User.tenantFilter -Headers $Headers -APIName $APIName + $TotalSuccessCount++ + Write-LogMessage -headers $Headers -API $APIName -tenant $User.tenantFilter -message $result -Sev 'Info' + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $AllErrorMessages += "Failed to set manager for $($User.userPrincipalName): $($ErrorMessage.NormalizedError)" + Write-LogMessage -headers $Headers -API $APIName -tenant $User.tenantFilter -message "Failed to set manager for $($User.userPrincipalName). Error: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + } + } + + if ($AllErrorMessages.Count -eq 0) { + $HttpResponse.Body = @{'Results' = @("Successfully set manager for $TotalSuccessCount user$(if($TotalSuccessCount -ne 1){'s'})") } + } else { + $HttpResponse.StatusCode = [HttpStatusCode]::BadRequest + $HttpResponse.Body = @{'Results' = $AllErrorMessages + @("Successfully updated $TotalSuccessCount of $($Users.Count) users") } + } + } catch { + $HttpResponse.StatusCode = [HttpStatusCode]::InternalServerError + $HttpResponse.Body = @{'Results' = @("Failed to set manager. Error: $($_.Exception.Message)") } + } + + return $HttpResponse +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecSetUserPhoto.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecSetUserPhoto.ps1 index 261778ad8f..0d2ebfad0d 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecSetUserPhoto.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecSetUserPhoto.ps1 @@ -19,6 +19,7 @@ function Invoke-ExecSetUserPhoto { try { if ([string]::IsNullOrWhiteSpace($userId)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'User ID is required' } @@ -40,6 +41,7 @@ function Invoke-ExecSetUserPhoto { } elseif ($action -eq 'set') { # Set the user's profile picture if ([string]::IsNullOrWhiteSpace($photoData)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'Photo data is required when setting a profile picture' } @@ -54,21 +56,73 @@ function Invoke-ExecSetUserPhoto { try { $photoBytes = [Convert]::FromBase64String($base64Data) } catch { + $FailCode = [HttpStatusCode]::BadRequest throw "Invalid base64 photo data: $($_.Exception.Message)" } # Validate image size (Microsoft Graph has a 4MB limit) $maxSizeBytes = 4 * 1024 * 1024 # 4MB if ($photoBytes.Length -gt $maxSizeBytes) { + $FailCode = [HttpStatusCode]::BadRequest throw "Photo size exceeds 4MB limit. Current size: $([math]::Round($photoBytes.Length / 1MB, 2))MB" } + # Determine content type based on photo data URL prefix + $contentType = 'image/jpeg' # Default to JPEG + if ($photoData -match '^data:image/(png);base64,') { + $contentType = 'image/png' + } elseif ($photoData -match '^data:image/(jpeg|jpg);base64,') { + $contentType = 'image/jpeg' + } + + # Also detect by magic bytes if no data URL prefix + if ($photoData -notmatch '^data:') { + # Check PNG magic bytes (89 50 4E 47) + if ($photoBytes[0] -eq 0x89 -and $photoBytes[1] -eq 0x50 -and $photoBytes[2] -eq 0x4E -and $photoBytes[3] -eq 0x47) { + $contentType = 'image/png' + } + } + # Upload the photo using Graph API - $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/users/$userId/photo/`$value" -tenantid $tenantFilter -type PUT -body $photoBytes -ContentType 'image/jpeg' + # Use direct Invoke-RestMethod to avoid body corruption from text replacement in New-GraphPostRequest + $graphToken = Get-GraphToken -tenantid $tenantFilter + $uri = "https://graph.microsoft.com/v1.0/users/$userId/photo/`$value" + + Write-Host "Uploading photo for user $userId with content type $contentType and size $($photoBytes.Length) bytes" + + try { + $null = Invoke-RestMethod -Uri $uri -Method PUT -Body $photoBytes -Headers $graphToken -ContentType $contentType + } catch { + $errorResponse = $_.ErrorDetails.Message | ConvertFrom-Json -ErrorAction SilentlyContinue + $errorCode = $errorResponse.error.code + $errorMessage = $errorResponse.error.message + + # Provide more helpful error messages for common issues + if ($errorCode -eq 'ErrorNonExistentMailbox' -or $errorMessage -like '*mailbox*') { + throw "Cannot set profile photo: User does not have an Exchange mailbox. Ensure the user has an Exchange Online license assigned." + } elseif ($errorCode -eq 'Request_BadRequest' -or $_.Exception.Response.StatusCode -eq 400) { + throw "Invalid photo data or format. Ensure the image is a valid JPEG or PNG file under 4MB. Error: $errorMessage" + } else { + throw $_ + } + } + + # Invalidate the photo cache for this user + try { + $Table = Get-CippTable -tablename 'CacheUserPhotos' + $Filter = "PartitionKey eq '$tenantFilter' and RowKey eq '$userId'" + $CachedEntry = Get-CIPPAzDataTableEntity @Table -Filter $Filter + if ($CachedEntry) { + Remove-CIPPAzDataTableEntity @Table -Entity $CachedEntry -Force | Out-Null + } + } catch { + Write-Information "Failed to invalidate photo cache: $($_.Exception.Message)" + } $Results.Add('Successfully set user profile picture.') Write-LogMessage -API $APIName -tenant $tenantFilter -headers $Headers -message "Set profile picture for user $userId" -Sev Info } else { + $FailCode = [HttpStatusCode]::BadRequest throw "Invalid action. Must be 'set' or 'remove'" } @@ -82,7 +136,7 @@ function Invoke-ExecSetUserPhoto { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -tenant $tenantFilter -headers $Headers -message "Failed to $action user profile picture. Error: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest + StatusCode = $FailCode ?? [HttpStatusCode]::InternalServerError Body = @{ 'Results' = @("Failed to $action user profile picture: $($ErrorMessage.NormalizedError)") } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListGuestUsers.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListGuestUsers.ps1 index 981052311f..b042992edb 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListGuestUsers.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListGuestUsers.ps1 @@ -15,8 +15,16 @@ function Invoke-ListGuestUsers { $APIName = $Request.Params.CIPPEndpoint $Headers = $Request.Headers - # The tenant to list guest users for, or AllTenants for every tenant (served from the cache) - $TenantFilter = $Request.Query.tenantFilter + # The tenant to list guest users for, or AllTenants for every tenant (served from the cache). + # Query wins; body is accepted for callers that post the filter. + $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'tenantFilter is required.' } + }) + } + # Days without any sign-in before an enabled guest is considered stale. Defaults to 90. $StaleDays = $Request.Query.staleDays ? [int]$Request.Query.staleDays : 90 # Serve from the reporting database cache instead of live Graph. AllTenants always uses the cache. @@ -110,6 +118,10 @@ function Invoke-ListGuestUsers { lastNonInteractiveSignInDateTime = $Guest.signInActivity.lastNonInteractiveSignInDateTime lastSuccessfulSignInDateTime = $Guest.signInActivity.lastSuccessfulSignInDateTime daysSinceSignIn = $DaysSinceSignIn + # Manage365 fields kept alongside the upstream sign-in timestamps. + lastSignIn = $LastSignIn + isStale = ($Status -eq 'Stale') + neverSignedIn = ($Status -eq 'Never Signed In') sponsors = $Guest.sponsors ? (@($Guest.sponsors | ForEach-Object { $_.displayName ?? $_.userPrincipalName }) -join ', ') : $null } if ($null -ne $Guest.CacheTimestamp) { diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListJITAdminRequests.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListJITAdminRequests.ps1 new file mode 100644 index 0000000000..ef49c2da56 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListJITAdminRequests.ps1 @@ -0,0 +1,62 @@ +function Invoke-ListJITAdminRequests { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Identity.Role.Read + .SYNOPSIS + List JIT Admin approval requests + .DESCRIPTION + Lists JIT Admin requests that went through the approval flow, with their decisions and whether the calling user can approve them. + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $TenantFilter = $Request.Query.tenantFilter + $Table = Get-CIPPTable -TableName 'JITAdminRequests' + $Filter = if ($TenantFilter -eq 'AllTenants') { + "PartitionKey eq 'JITAdminRequest'" + } else { + "PartitionKey eq 'JITAdminRequest' and Tenant eq '$(ConvertTo-CIPPODataFilterValue -Value $TenantFilter -Type String)'" + } + $Rows = Get-CIPPAzDataTableEntity @Table -Filter $Filter + + $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList + if ($AllowedTenants -notcontains 'AllTenants') { + $AllowedDomains = (Get-Tenants -IncludeErrors).Where({ $_.customerId -in $AllowedTenants }).defaultDomainName + $Rows = $Rows.Where({ $_.Tenant -in $AllowedDomains }) + } + + $CallingUser = ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Request.Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails + $CallerRoles = @(Get-CIPPAccessRole -Request $Request) + + $Results = foreach ($Row in $Rows) { + $Decisions = @($Row.Decisions | ConvertFrom-Json) + $ApproverRoles = @($Row.ApproverRoles | ConvertFrom-Json) + $CanDecide = $Row.State -eq 'Pending' -and $Decisions.By -notcontains $CallingUser -and $CallerRoles.Where({ $_ -in $ApproverRoles }).Count -gt 0 + [pscustomobject]@{ + RequestId = $Row.RowKey + State = $Row.State + Tenant = $Row.Tenant + TargetUser = $Row.TargetUser + Roles = $Row.RoleNames + Groups = $Row.GroupNames + Reason = $Row.Reason + StartDate = [int64]$Row.StartDate + EndDate = [int64]$Row.EndDate + RequestedBy = $Row.RequestedBy + RequestedAt = $Row.RequestedAt + ApproverRoles = $ApproverRoles -join ', ' + Approvals = '{0} of {1}' -f @($Decisions.Where({ $_.Decision -eq 'Approve' })).Count, $Row.RequiredApprovals + Decisions = $Decisions + Results = $Row.Results + CanApprove = $CanDecide -and $CallingUser -ne $Row.RequestedBy + CanReject = $CanDecide + } + } + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @($Results | Sort-Object -Property RequestedAt -Descending) + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListJITAdminTemplates.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListJITAdminTemplates.ps1 index 22791252d7..4a59151bbd 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListJITAdminTemplates.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListJITAdminTemplates.ps1 @@ -4,8 +4,6 @@ function Invoke-ListJITAdminTemplates { Entrypoint,AnyTenant .ROLE Identity.Role.Read - .DESCRIPTION - Lists Just-in-Time admin role templates that define temporary admin role assignments. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -67,7 +65,7 @@ function Invoke-ListJITAdminTemplates { $Templates = $Templates | Where-Object -Property GUID -EQ $Request.query.GUID } - $Templates = ConvertTo-Json -InputObject @($Templates) -Depth 100 + $Templates = ConvertTo-Json -InputObject @($Templates) -Depth 20 return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::OK diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListNewUserDefaults.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListNewUserDefaults.ps1 index 68a384011c..30853645a0 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListNewUserDefaults.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListNewUserDefaults.ps1 @@ -4,8 +4,6 @@ function Invoke-ListNewUserDefaults { Entrypoint,AnyTenant .ROLE Identity.User.Read - .DESCRIPTION - Lists default templates for new user creation, including default domain, usage location, and license assignments. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -66,7 +64,7 @@ function Invoke-ListNewUserDefaults { $Templates = $Templates | Where-Object -Property GUID -eq $Request.query.ID } - $Templates = ConvertTo-Json -InputObject @($Templates) -Depth 100 + $Templates = ConvertTo-Json -InputObject @($Templates) -Depth 20 return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::OK diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListRiskyUsers.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListRiskyUsers.ps1 new file mode 100644 index 0000000000..58345e847a --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListRiskyUsers.ps1 @@ -0,0 +1,81 @@ +function Invoke-ListRiskyUsers { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Identity.User.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter + + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'tenantFilter is required.' } + }) + } + + try { + $GraphUri = "https://graph.microsoft.com/beta/identityProtection/riskyUsers?`$top=500&`$orderby=riskLastUpdatedDateTime desc" + $RiskyUsers = New-GraphGetRequest -uri $GraphUri -tenantid $TenantFilter + + # Pull our locally-recorded dismissal metadata for this tenant so we can + # show *who* dismissed each risky user. Microsoft Graph does not surface + # the actor on the riskyUsers resource. + $DismissalsByUserId = @{} + try { + $DismissalTable = Get-CIPPTable -tablename 'RiskyUserDismissals' + $Filter = "PartitionKey eq '{0}'" -f $TenantFilter.Replace("'", "''") + $DismissalRecords = Get-CIPPAzDataTableEntity @DismissalTable -Filter $Filter -ErrorAction SilentlyContinue + foreach ($Record in $DismissalRecords) { + if ($Record.UserId) { + $DismissalsByUserId[$Record.UserId] = $Record + } + } + } catch { + # Table may not exist yet (no one has ever dismissed). Treat as empty. + $RecordError = Get-CippException -Exception $_ + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Could not load RiskyUserDismissals metadata: $($RecordError.NormalizedError)" -Sev 'Debug' + } + + $EnrichedUsers = @(foreach ($User in $RiskyUsers) { + $Dismissal = $null + if ($User.id -and $DismissalsByUserId.ContainsKey($User.id)) { + $Dismissal = $DismissalsByUserId[$User.id] + } + + # Only surface dismissal metadata when the user is actually in a + # dismissed state (so stale records from a prior dismiss/re-flag + # cycle don't get displayed against an active risk). + $IsDismissed = ([string]$User.riskState).ToLower() -eq 'dismissed' + $DismissedBy = if ($IsDismissed -and $Dismissal) { $Dismissal.DismissedBy } else { $null } + $DismissedDateTime = if ($IsDismissed -and $Dismissal) { $Dismissal.DismissedDateTime } else { $null } + + $Enriched = [ordered]@{} + foreach ($Property in $User.PSObject.Properties) { + $Enriched[$Property.Name] = $Property.Value + } + $Enriched['dismissedBy'] = $DismissedBy + $Enriched['dismissedDateTime'] = $DismissedDateTime + [PSCustomObject]$Enriched + }) + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Listed $($EnrichedUsers.Count) risky users" -Sev 'Debug' + $StatusCode = [HttpStatusCode]::OK + $Body = @{ Results = $EnrichedUsers } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to list risky users: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError + $Body = @{ Results = "Failed to list risky users: $($ErrorMessage.NormalizedError)" } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserCounts.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserCounts.ps1 index b897bf97e8..0dfa1fb179 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserCounts.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserCounts.ps1 @@ -4,8 +4,6 @@ Function Invoke-ListUserCounts { Entrypoint .ROLE Identity.User.Read - .DESCRIPTION - Returns summary counts of total users, licensed users, and global administrators for a tenant. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -32,7 +30,7 @@ Function Invoke-ListUserCounts { @{ id = 'LicUsers' method = 'GET' - url = "/users/`$count?`$top=1&`$filter=assignedLicenses/`$count ne 0" + url = "/users?`$count=true&`$filter=assignedLicenses/`$count ne 0&`$top=1" headers = @{ 'ConsistencyLevel' = 'eventual' } @@ -40,7 +38,7 @@ Function Invoke-ListUserCounts { @{ id = 'GAs' method = 'GET' - url = "/directoryRoles/roleTemplateId=62e90394-69f5-4237-9190-012177145e10/members/`$count" + url = "/directoryRoles/roleTemplateId=62e90394-69f5-4237-9190-012177145e10/members?`$count=true&`$top=1" headers = @{ 'ConsistencyLevel' = 'eventual' } @@ -48,7 +46,7 @@ Function Invoke-ListUserCounts { @{ id = 'Guests' method = 'GET' - url = "/users/`$count?`$top=1&`$filter=userType eq 'Guest'" + url = "/users?`$count=true&`$filter=userType eq 'Guest'&`$top=1" headers = @{ 'ConsistencyLevel' = 'eventual' } @@ -56,7 +54,7 @@ Function Invoke-ListUserCounts { ) # Execute bulk request - $BulkResults = New-GraphBulkRequest -Requests @($BulkRequests) -noPaginateIds @('LicUsers') -tenantid $TenantFilter @('Users', 'LicUsers', 'GAs', 'Guests') + $BulkResults = New-GraphBulkRequest -Requests @($BulkRequests) -NoPaginateIds @('Users', 'LicUsers', 'GAs', 'Guests') -tenantid $TenantFilter # Check if any requests failed $FailedRequests = $BulkResults | Where-Object { $_.status -ne 200 } @@ -77,7 +75,13 @@ Function Invoke-ListUserCounts { # All requests succeeded, extract the counts $BulkResults | ForEach-Object { - $UsersCount = $_.body + # Users endpoint returns body directly as a number (/$count endpoint) + # Other endpoints use $count=true and return @odata.count in the body + $UsersCount = if ($_.id -eq 'Users') { + $_.body + } else { + $_.body.'@odata.count' + } switch ($_.id) { 'Users' { $Users = $UsersCount } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserMailboxDetails.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserMailboxDetails.ps1 index 583d826344..c935275400 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserMailboxDetails.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserMailboxDetails.ps1 @@ -4,8 +4,6 @@ function Invoke-ListUserMailboxDetails { Entrypoint .ROLE Exchange.Mailbox.Read - .DESCRIPTION - Retrieves detailed Exchange Online mailbox properties for a specific user, including quotas, archive status, and protocols. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -13,9 +11,6 @@ function Invoke-ListUserMailboxDetails { $TenantFilter = $Request.Query.tenantFilter $UserID = $Request.Query.UserID $UserMail = $Request.Query.userMail - Write-Host "TenantFilter: $TenantFilter" - Write-Host "UserID: $UserID" - Write-Host "UserMail: $UserMail" # Archive size and item count are the slow part of the mailbox detail (Get-MailboxStatistics # -Archive). Set-CIPPDBCacheMailboxes already caches both per mailbox, keyed by the Entra object @@ -80,9 +75,9 @@ function Invoke-ListUserMailboxDetails { } } ) - $usernames = New-GraphGetRequest -tenantid $TenantFilter -uri 'https://graph.microsoft.com/beta/users?$select=id,userPrincipalName,displayName,mailNickname&$top=999' - $Results = New-ExoBulkRequest -TenantId $TenantFilter -CmdletArray $Requests -returnWithCommand $true -Anchor $username - Write-Host "First line of usernames is $($usernames[0] | ConvertTo-Json)" + # Use a deterministic mailbox anchor for EXO routing; $username is not defined here. + $AnchorIdentity = if ($UserMail) { $UserMail } else { $UserID } + $Results = New-ExoBulkRequest -TenantId $TenantFilter -CmdletArray $Requests -returnWithCommand $true -Anchor $AnchorIdentity # Assign variables from $Results $MailboxDetailedRequest = $Results.'Get-Mailbox' @@ -104,9 +99,12 @@ function Invoke-ListUserMailboxDetails { $ArchiveEnabled = $false } - $AutoExpandingArchiveState = Get-CIPPAutoExpandingArchiveState -MailboxAutoExpandingArchiveEnabled $MailboxDetailedRequest.AutoExpandingArchiveEnabled -OrgAutoExpandingArchiveEnabled $OrgConfig.AutoExpandingArchiveEnabled - $AutoExpandingArchiveEnabled = $AutoExpandingArchiveState.AutoExpandingArchive - $AutoExpandingArchiveScope = $AutoExpandingArchiveState.AutoExpandingArchiveScope + # Get organization config of auto-expanding archive if it's disabled on user level + if (-not $MailboxDetailedRequest.AutoExpandingArchiveEnabled -and $ArchiveEnabled) { + $AutoExpandingArchiveEnabled = $OrgConfig.AutoExpandingArchiveEnabled + } else { + $AutoExpandingArchiveEnabled = $MailboxDetailedRequest.AutoExpandingArchiveEnabled + } } catch { $ArchiveEnabled = $false $ArchiveSizeRequest = @{ @@ -122,8 +120,47 @@ function Invoke-ListUserMailboxDetails { } else { $BlockedForSpam = $false } + + # Check if user is blocked for external outbound via transport rule + $BlockExternalOutbound = $false + try { + $AllTransportRules = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-TransportRule' -useSystemMailbox $true + $OutboundRule = $AllTransportRules | Where-Object -Property Identity -EQ 'Manage365 - Block External Outbound' + if ($OutboundRule -and $OutboundRule.From) { + $RuleFromList = @($OutboundRule.From | ForEach-Object { $_ }) + if ($UserMail -in $RuleFromList -or $UserID -in $RuleFromList) { + $BlockExternalOutbound = $true + } + } + } catch { + Write-Verbose "Could not check outbound transport rule: $($_.Exception.Message)" + } } catch { - Write-Error "Failed Fetching Data $($_.Exception.message): $($_.InvocationInfo.ScriptLineNumber)" + # Without the mailbox data every downstream section would run against unset + # variables and return a misleading empty-but-OK payload. Surface the failure. + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -headers $Request.Headers -API $Request.Params.CIPPEndpoint -tenant $TenantFilter -message "Failed fetching mailbox details for $($UserID): $($_.Exception.Message)" -Sev 'Error' -LogData $_ + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = @{ Results = "Failed to fetch mailbox details: $ErrorMessage" } + }) + } + + # Resolve display names only when something actually references other users; + # fetching the whole tenant user list on every request is expensive. + $usernames = @() + $RawForwardingAddress = $MailboxDetailedRequest.ForwardingAddress + $NeedsUserLookup = [bool]$MailboxDetailedRequest.GrantSendOnBehalfTo -or ( + -not $MailboxDetailedRequest.ForwardingSmtpAddress -and + $RawForwardingAddress -and + $RawForwardingAddress -notmatch '@' + ) + if ($NeedsUserLookup) { + try { + $usernames = New-GraphGetRequest -tenantid $TenantFilter -uri 'https://graph.microsoft.com/beta/users?$select=id,userPrincipalName,displayName,mailNickname&$top=999' + } catch { + Write-LogMessage -headers $Request.Headers -API $Request.Params.CIPPEndpoint -tenant $TenantFilter -message "Could not resolve user display names: $($_.Exception.Message)" -Sev 'Warning' + } } # Parse permissions @@ -258,38 +295,39 @@ function Invoke-ListUserMailboxDetails { # Build the GraphRequest object $GraphRequest = [ordered]@{ - ForwardAndDeliver = $MailboxDetailedRequest.DeliverToMailboxAndForward - ForwardingAddress = $ForwardingAddress - LitigationHold = $MailboxDetailedRequest.LitigationHoldEnabled - RetentionHold = $MailboxDetailedRequest.RetentionHoldEnabled - ComplianceTagHold = $MailboxDetailedRequest.ComplianceTagHoldApplied - InPlaceHold = $InPlaceHold - EDiscoveryHold = $EDiscoveryHold - PurviewRetentionHold = $PurviewRetentionHold - ExcludedFromOrgWideHold = $ExcludedFromOrgWideHold - HiddenFromAddressLists = $MailboxDetailedRequest.HiddenFromAddressListsEnabled - EWSEnabled = $CASRequest.EwsEnabled - MailboxMAPIEnabled = $CASRequest.MAPIEnabled - MailboxOWAEnabled = $CASRequest.OWAEnabled - MailboxImapEnabled = $CASRequest.ImapEnabled - MailboxPopEnabled = $CASRequest.PopEnabled - MailboxActiveSyncEnabled = $CASRequest.ActiveSyncEnabled + ForwardAndDeliver = $MailboxDetailedRequest.DeliverToMailboxAndForward + ForwardingAddress = $ForwardingAddress + LitigationHold = $MailboxDetailedRequest.LitigationHoldEnabled + RetentionHold = $MailboxDetailedRequest.RetentionHoldEnabled + ComplianceTagHold = $MailboxDetailedRequest.ComplianceTagHoldApplied + InPlaceHold = $InPlaceHold + EDiscoveryHold = $EDiscoveryHold + PurviewRetentionHold = $PurviewRetentionHold + ExcludedFromOrgWideHold = $ExcludedFromOrgWideHold + HiddenFromAddressLists = $MailboxDetailedRequest.HiddenFromAddressListsEnabled + BlockExternalInbound = ($MailboxDetailedRequest.RequireSenderAuthenticationEnabled -eq $true) + BlockExternalOutbound = $BlockExternalOutbound + EWSEnabled = $CASRequest.EwsEnabled + MailboxMAPIEnabled = $CASRequest.MAPIEnabled + MailboxOWAEnabled = $CASRequest.OWAEnabled + MailboxImapEnabled = $CASRequest.ImapEnabled + MailboxPopEnabled = $CASRequest.PopEnabled + MailboxActiveSyncEnabled = $CASRequest.ActiveSyncEnabled SmtpClientAuthenticationDisabled = $CASRequest.SmtpClientAuthenticationDisabled - Permissions = @($ParsedPerms) - ProhibitSendQuota = $ProhibitSendQuota - ProhibitSendReceiveQuota = $ProhibitSendReceiveQuota - ItemCount = [math]::Round($StatsRequest.ItemCount, 2) - TotalItemSize = $TotalItemSize - TotalArchiveItemSize = $TotalArchiveItemSize - TotalArchiveItemCount = $TotalArchiveItemCount - BlockedForSpam = $BlockedForSpam - ArchiveMailBox = $ArchiveEnabled - AutoExpandingArchive = $AutoExpandingArchiveEnabled - AutoExpandingArchiveScope = $AutoExpandingArchiveScope - RecipientTypeDetails = $MailboxDetailedRequest.RecipientTypeDetails - Mailbox = $MailboxDetailedRequest - RetentionPolicy = $MailboxDetailedRequest.RetentionPolicy - MailboxActionsData = ($MailboxDetailedRequest | Select-Object id, ExchangeGuid, ArchiveGuid, WhenSoftDeleted, + Permissions = @($ParsedPerms) + ProhibitSendQuota = $ProhibitSendQuota + ProhibitSendReceiveQuota = $ProhibitSendReceiveQuota + ItemCount = [math]::Round($StatsRequest.ItemCount, 2) + TotalItemSize = $TotalItemSize + TotalArchiveItemSize = $TotalArchiveItemSize + TotalArchiveItemCount = $TotalArchiveItemCount + BlockedForSpam = $BlockedForSpam + ArchiveMailBox = $ArchiveEnabled + AutoExpandingArchive = $AutoExpandingArchiveEnabled + RecipientTypeDetails = $MailboxDetailedRequest.RecipientTypeDetails + Mailbox = $MailboxDetailedRequest + RetentionPolicy = $MailboxDetailedRequest.RetentionPolicy + MailboxActionsData = ($MailboxDetailedRequest | Select-Object id, ExchangeGuid, ArchiveGuid, WhenSoftDeleted, @{ Name = 'UPN'; Expression = { $_.'UserPrincipalName' } }, @{ Name = 'displayName'; Expression = { $_.'DisplayName' } }, @{ Name = 'primarySmtpAddress'; Expression = { $_.'PrimarySMTPAddress' } }, diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserPhoto.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserPhoto.ps1 index afae7ded9c..13168a87b3 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserPhoto.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserPhoto.ps1 @@ -5,14 +5,21 @@ Function Invoke-ListUserPhoto { .ROLE Identity.User.Read .DESCRIPTION - Retrieves the profile photo for a specific Entra ID user, returned as a base64-encoded image. + Retrieves the profile photo for a specific Entra ID user as raw image bytes. #> [CmdletBinding()] param($Request, $TriggerMetadata) - # Interact with query parameters or the body of the request. + $tenantFilter = $Request.Query.tenantFilter $userId = $Request.Query.UserID + if ([string]::IsNullOrWhiteSpace($tenantFilter) -or [string]::IsNullOrWhiteSpace($userId)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = 'TenantFilter and UserID are required' + }) + } + # AnyTenant: enforce tenant scope here; Get-Tenants is narrowed to the caller's allowed tenants $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList if ($AllowedTenants -notcontains 'AllTenants' -and -not (Get-Tenants -TenantFilter $tenantFilter)) { @@ -22,24 +29,41 @@ Function Invoke-ListUserPhoto { }) } - $URI = "/users/$userId/photo/`$value" + try { + # photo/$value is binary. Invoke-WebRequest keeps the bytes intact; Graph JSON helpers do not. + $URI = "https://graph.microsoft.com/v1.0/users/$userId/photo/`$value" - $Requests = @( - @{ - id = 'photo' - url = $URI - method = 'GET' - } - ) + try { + $graphToken = Get-GraphToken -tenantid $tenantFilter + $PhotoResponse = Invoke-WebRequest -Uri $URI -Headers $graphToken -Method GET -ErrorAction Stop - $ImageData = New-GraphBulkRequest -Requests $Requests -tenantid $tenantFilter -NoAuthCheck $true - #convert body from base64 to byte array - $Body = [Convert]::FromBase64String($ImageData.body) - - return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK - ContentType = $ImageData.headers.'Content-Type' - Body = $Body - }) + $ContentType = $PhotoResponse.Headers['Content-Type'] + if (-not $ContentType) { + $ContentType = 'image/jpeg' + } + if ($ContentType -is [array]) { + $ContentType = $ContentType[0] + } + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + ContentType = $ContentType + Body = [byte[]]$PhotoResponse.Content + }) + } catch { + $StatusCode = $_.Exception.Response.StatusCode.value__ + if ($StatusCode -eq 404) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = 'User does not have a profile photo' + }) + } + throw $_ + } + } catch { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = "Unable to retrieve user photo: $($_.Exception.Message)" + }) + } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserSettings.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserSettings.ps1 index 049d046612..4868faf9c5 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserSettings.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserSettings.ps1 @@ -4,8 +4,6 @@ function Invoke-ListUserSettings { Entrypoint,AnyTenant .ROLE Identity.User.Read - .DESCRIPTION - Retrieves the current CIPP user's personal settings and preferences. #> param($Request, $TriggerMetadata) $Headers = $Request.Headers @@ -56,11 +54,15 @@ function Invoke-ListUserSettings { if (!$UserSettings) { $UserSettings = [pscustomobject]@{ - direction = 'ltr' - paletteMode = 'light' - currentTheme = @{ value = 'light'; label = 'light' } - pinNav = $true - showDevtools = $false + direction = 'ltr' + paletteMode = 'light' + currentTheme = @{ value = 'light'; label = 'light' } + pinNav = $true + showDevtools = $false + customBranding = @{ + colour = '#F77F00' + logo = $null + } } } @@ -100,8 +102,14 @@ function Invoke-ListUserSettings { Write-Warning "Failed to convert UserBookmarks JSON: $($_.Exception.Message)" } - # Branding is served by Invoke-ListBrandingSettings, not from here: it carries inline - # images and its migration writes, neither of which belong on every page load. + #Get branding settings + if ($UserSettings) { + $brandingTable = Get-CippTable -tablename 'Config' + $BrandingSettings = Get-CIPPAzDataTableEntity @brandingTable -Filter "PartitionKey eq 'BrandingSettings' and RowKey eq 'BrandingSettings'" + if ($BrandingSettings) { + $UserSettings | Add-Member -MemberType NoteProperty -Name 'customBranding' -Value $BrandingSettings -Force | Out-Null + } + } if ($UserSpecificSettings) { $UserSettings | Add-Member -MemberType NoteProperty -Name 'UserSpecificSettings' -Value $UserSpecificSettings -Force | Out-Null @@ -115,7 +123,7 @@ function Invoke-ListUserSettings { $Results = $UserSettings } catch { $Results = "Function Error: $($_.Exception.Message)" - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-PatchUser.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-PatchUser.ps1 index b71874b17c..e0aa16c9e1 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-PatchUser.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-PatchUser.ps1 @@ -167,7 +167,7 @@ function Invoke-PatchUser { if ($AllErrorMessages.Count -eq 0) { $HttpResponse.Body = @{'Results' = @($SuccessMessage) } } else { - $HttpResponse.StatusCode = [HttpStatusCode]::BadRequest + $HttpResponse.StatusCode = Get-CippBulkStatusCode -Total ($TotalPatchSuccessCount + $TotalManagerSuccessCount + $TotalSponsorSuccessCount + $AllErrorMessages.Count) -Failed $AllErrorMessages.Count $PartialSuccessMessage = if ($HasRelationshipUpdates) { $SuccessMessage } else { "Successfully patched $TotalPatchSuccessCount of $($Users.Count) users" } $Results = [System.Collections.Generic.List[string]]::new() foreach ($ErrorMessage in $AllErrorMessages) { @@ -180,7 +180,7 @@ function Invoke-PatchUser { } catch { $HttpResponse.StatusCode = [HttpStatusCode]::InternalServerError - $HttpResponse.Body = @{'Results' = @("Failed to patch user(s). Error: $($_.Exception.Message)") } + $HttpResponse.Body = @{'Results' = @("Failed to patch user(s): $((Get-CippException -Exception $_).NormalizedError)") } } return $HttpResponse diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Reports/Invoke-ListBasicAuth.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Reports/Invoke-ListBasicAuth.ps1 index 943777494b..57f1983a33 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Reports/Invoke-ListBasicAuth.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Reports/Invoke-ListBasicAuth.ps1 @@ -4,8 +4,6 @@ Function Invoke-ListBasicAuth { Entrypoint .ROLE Identity.AuditLog.Read - .DESCRIPTION - Lists sign-in events using basic authentication (legacy protocols) for a tenant from the audit logs. #> [CmdletBinding()] param($Request, $TriggerMetadata) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Reports/Invoke-ListMFAUsers.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Reports/Invoke-ListMFAUsers.ps1 index 4bf9115309..c0a92bfb4f 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Reports/Invoke-ListMFAUsers.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Reports/Invoke-ListMFAUsers.ps1 @@ -17,7 +17,7 @@ function Invoke-ListMFAUsers { $ManualPagination = $Request.Query.manualPagination -and [System.Convert]::ToBoolean($Request.Query.manualPagination) try { # If UseReportDB is specified, retrieve from report database - if ($UseReportDB) { + if ($UseReportDB -eq 'true') { try { if ($ManualPagination) { # Rows per page, clamped between 250 and 10000. Defaults to 5000. @@ -105,7 +105,7 @@ function Invoke-ListMFAUsers { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-EditDlpCompliancePolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-EditDlpCompliancePolicy.ps1 index c0e8daee06..8c84f33e71 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-EditDlpCompliancePolicy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-EditDlpCompliancePolicy.ps1 @@ -38,7 +38,7 @@ Function Invoke-EditDlpCompliancePolicy { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed updating DLP compliance policy $Identity. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Result -Sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-ListDlpCompliancePolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-ListDlpCompliancePolicy.ps1 index a223c8a383..aba4deebe6 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-ListDlpCompliancePolicy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-ListDlpCompliancePolicy.ps1 @@ -20,7 +20,7 @@ Function Invoke-ListDlpCompliancePolicy { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-RemoveDlpCompliancePolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-RemoveDlpCompliancePolicy.ps1 index 4af00a5203..0a3aaebce2 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-RemoveDlpCompliancePolicy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-RemoveDlpCompliancePolicy.ps1 @@ -26,7 +26,7 @@ Function Invoke-RemoveDlpCompliancePolicy { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to delete DLP compliance policy $Identity - $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-RemoveDlpCompliancePolicyTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-RemoveDlpCompliancePolicyTemplate.ps1 index 44265d265f..fd0a4c75b6 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-RemoveDlpCompliancePolicyTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-RemoveDlpCompliancePolicyTemplate.ps1 @@ -13,10 +13,24 @@ Function Invoke-RemoveDlpCompliancePolicyTemplate { $ID = $Request.Body.ID ?? $Request.Query.ID try { - $Table = Get-CippTable -tablename 'templates' $SafeID = ConvertTo-CIPPODataFilterValue -Value $ID -Type Guid + } catch { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Failed to remove DLP Compliance Policy template: '$ID' is not a valid template ID." } + }) + } + + try { + $Table = Get-CippTable -tablename 'templates' $Filter = "PartitionKey eq 'DlpCompliancePolicyTemplate' and RowKey eq '$SafeID'" $ClearRow = Get-CIPPAzDataTableEntity @Table -Filter $Filter -Property PartitionKey, RowKey + if (-not $ClearRow) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = @{ Results = "DLP Compliance Policy template with ID $ID not found." } + }) + } Remove-CIPPAzDataTableEntity -Force @Table -Entity $ClearRow $Result = "Removed DLP Compliance Policy template with ID $ID" Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev 'Info' @@ -25,7 +39,7 @@ Function Invoke-RemoveDlpCompliancePolicyTemplate { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to remove DLP Compliance Policy template $ID. $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-EditRetentionCompliancePolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-EditRetentionCompliancePolicy.ps1 index 72db204c7d..f3795cedc7 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-EditRetentionCompliancePolicy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-EditRetentionCompliancePolicy.ps1 @@ -36,7 +36,7 @@ Function Invoke-EditRetentionCompliancePolicy { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed updating Retention compliance policy $Identity. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Result -Sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-ListRetentionCompliancePolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-ListRetentionCompliancePolicy.ps1 index d47cbcc8ec..a08b425b17 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-ListRetentionCompliancePolicy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-ListRetentionCompliancePolicy.ps1 @@ -67,7 +67,7 @@ Function Invoke-ListRetentionCompliancePolicy { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-RemoveRetentionCompliancePolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-RemoveRetentionCompliancePolicy.ps1 index a6061dc757..c8891c72a1 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-RemoveRetentionCompliancePolicy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-RemoveRetentionCompliancePolicy.ps1 @@ -29,7 +29,7 @@ Function Invoke-RemoveRetentionCompliancePolicy { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to delete Retention compliance policy $Identity - $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-RemoveRetentionCompliancePolicyTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-RemoveRetentionCompliancePolicyTemplate.ps1 index b4549ff14a..5d095b4af6 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-RemoveRetentionCompliancePolicyTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-RemoveRetentionCompliancePolicyTemplate.ps1 @@ -13,10 +13,24 @@ Function Invoke-RemoveRetentionCompliancePolicyTemplate { $ID = $Request.Body.ID ?? $Request.Query.ID try { - $Table = Get-CippTable -tablename 'templates' $SafeID = ConvertTo-CIPPODataFilterValue -Value $ID -Type Guid + } catch { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Failed to remove Retention Compliance Policy template: '$ID' is not a valid template ID." } + }) + } + + try { + $Table = Get-CippTable -tablename 'templates' $Filter = "PartitionKey eq 'RetentionCompliancePolicyTemplate' and RowKey eq '$SafeID'" $ClearRow = Get-CIPPAzDataTableEntity @Table -Filter $Filter -Property PartitionKey, RowKey + if (-not $ClearRow) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = @{ Results = "Retention Compliance Policy template with ID $ID not found." } + }) + } Remove-CIPPAzDataTableEntity -Force @Table -Entity $ClearRow $Result = "Removed Retention Compliance Policy template with ID $ID" Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev 'Info' @@ -25,7 +39,7 @@ Function Invoke-RemoveRetentionCompliancePolicyTemplate { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to remove Retention Compliance Policy template $ID. $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-EditSensitiveInfoType.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-EditSensitiveInfoType.ps1 index 213ac25966..62486a89a3 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-EditSensitiveInfoType.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-EditSensitiveInfoType.ps1 @@ -31,7 +31,7 @@ Function Invoke-EditSensitiveInfoType { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed updating Sensitive Information Type $Identity. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Result -Sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-ListSensitiveInfoType.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-ListSensitiveInfoType.ps1 index 44d2037f63..c48c6c8d62 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-ListSensitiveInfoType.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-ListSensitiveInfoType.ps1 @@ -24,7 +24,7 @@ Function Invoke-ListSensitiveInfoType { $GraphRequest = $SITs } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-ListSensitiveInfoTypeRulePackage.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-ListSensitiveInfoTypeRulePackage.ps1 index fd247614f1..929b9147d3 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-ListSensitiveInfoTypeRulePackage.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-ListSensitiveInfoTypeRulePackage.ps1 @@ -15,9 +15,14 @@ Function Invoke-ListSensitiveInfoTypeRulePackage { $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter $RulePackId = $Request.Query.RulePackId ?? $Request.Body.RulePackId - try { - if ([string]::IsNullOrWhiteSpace($RulePackId)) { throw 'RulePackId is required.' } + if ([string]::IsNullOrWhiteSpace($RulePackId)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = 'RulePackId is required.' + }) + } + try { $Pack = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-DlpSensitiveInformationTypeRulePackage' -cmdParams @{ Identity = $RulePackId } -Compliance | Select-Object * -ExcludeProperty *odata*, *data.type* | Select-Object -First 1 $Xml = [string]$Pack.ClassificationRuleCollectionXml @@ -36,7 +41,7 @@ Function Invoke-ListSensitiveInfoTypeRulePackage { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $Result = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-RemoveSensitiveInfoType.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-RemoveSensitiveInfoType.ps1 index 88edcad811..0439a89150 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-RemoveSensitiveInfoType.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-RemoveSensitiveInfoType.ps1 @@ -15,14 +15,27 @@ Function Invoke-RemoveSensitiveInfoType { $Identity = $Request.Query.Identity ?? $Request.Body.Identity ?? $Request.Body.Name $FingerprintPackId = '00000000-0000-0000-0001-000000000001' + if ([string]::IsNullOrWhiteSpace($Identity)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{Results = 'Failed to delete Sensitive Information Type - Identity is required.' } + }) + } + try { $Sit = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-DlpSensitiveInformationType' -Compliance | Where-Object { $_.Name -eq $Identity -or $_.Id -eq $Identity -or $_.Identity -eq $Identity } | Select-Object -First 1 if (-not $Sit) { - throw "Sensitive Information Type '$Identity' not found." + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = @{Results = "Failed to delete Sensitive Information Type $Identity - Sensitive Information Type '$Identity' not found." } + }) } if ($Sit.Publisher -like 'Microsoft*') { - throw "SIT '$($Sit.Name)' is a Microsoft built-in and cannot be deleted." + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{Results = "Failed to delete Sensitive Information Type $Identity - SIT '$($Sit.Name)' is a Microsoft built-in and cannot be deleted." } + }) } # Regex/keyword SITs are their own rule package and must be removed at the package level - the @@ -39,7 +52,7 @@ Function Invoke-RemoveSensitiveInfoType { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to delete Sensitive Information Type $Identity - $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-RemoveSensitiveInfoTypeTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-RemoveSensitiveInfoTypeTemplate.ps1 index 152a966f51..cf0d655e9a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-RemoveSensitiveInfoTypeTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-RemoveSensitiveInfoTypeTemplate.ps1 @@ -13,10 +13,24 @@ Function Invoke-RemoveSensitiveInfoTypeTemplate { $ID = $Request.Body.ID ?? $Request.Query.ID try { - $Table = Get-CippTable -tablename 'templates' $SafeID = ConvertTo-CIPPODataFilterValue -Value $ID -Type Guid + } catch { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Failed to remove Sensitive Information Type template: '$ID' is not a valid template ID." } + }) + } + + try { + $Table = Get-CippTable -tablename 'templates' $Filter = "PartitionKey eq 'SensitiveInfoTypeTemplate' and RowKey eq '$SafeID'" $ClearRow = Get-CIPPAzDataTableEntity @Table -Filter $Filter -Property PartitionKey, RowKey + if (-not $ClearRow) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = @{ Results = "Sensitive Information Type template with ID $ID not found." } + }) + } Remove-CIPPAzDataTableEntity -Force @Table -Entity $ClearRow $Result = "Removed Sensitive Information Type template with ID $ID" Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev 'Info' @@ -25,7 +39,7 @@ Function Invoke-RemoveSensitiveInfoTypeTemplate { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to remove Sensitive Information Type template $ID. $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-EditSensitivityLabel.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-EditSensitivityLabel.ps1 index 5081739fdb..d9575ad204 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-EditSensitivityLabel.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-EditSensitivityLabel.ps1 @@ -38,7 +38,7 @@ Function Invoke-EditSensitivityLabel { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed updating sensitivity label $Identity. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Result -Sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-ListSensitivityLabel.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-ListSensitivityLabel.ps1 index 302babc81e..ec945d93c9 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-ListSensitivityLabel.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-ListSensitivityLabel.ps1 @@ -38,7 +38,7 @@ Function Invoke-ListSensitivityLabel { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-RemoveSensitivityLabel.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-RemoveSensitivityLabel.ps1 index 225351276d..2cefa3d57e 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-RemoveSensitivityLabel.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-RemoveSensitivityLabel.ps1 @@ -26,7 +26,7 @@ Function Invoke-RemoveSensitivityLabel { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to delete sensitivity label $Identity - $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-RemoveSensitivityLabelTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-RemoveSensitivityLabelTemplate.ps1 index 1f1ce54e46..e35960cf08 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-RemoveSensitivityLabelTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-RemoveSensitivityLabelTemplate.ps1 @@ -13,10 +13,24 @@ Function Invoke-RemoveSensitivityLabelTemplate { $ID = $Request.Body.ID ?? $Request.Query.ID try { - $Table = Get-CippTable -tablename 'templates' $SafeID = ConvertTo-CIPPODataFilterValue -Value $ID -Type Guid + } catch { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Failed to remove Sensitivity Label template: '$ID' is not a valid template ID." } + }) + } + + try { + $Table = Get-CippTable -tablename 'templates' $Filter = "PartitionKey eq 'SensitivityLabelTemplate' and RowKey eq '$SafeID'" $ClearRow = Get-CIPPAzDataTableEntity @Table -Filter $Filter -Property PartitionKey, RowKey + if (-not $ClearRow) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = @{ Results = "Sensitivity Label template with ID $ID not found." } + }) + } Remove-CIPPAzDataTableEntity -Force @Table -Entity $ClearRow $Result = "Removed Sensitivity Label template with ID $ID" Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev 'Info' @@ -25,7 +39,7 @@ Function Invoke-RemoveSensitivityLabelTemplate { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to remove Sensitivity Label template $ID. $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Defender/Invoke-ListMDEOnboarding.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Defender/Invoke-ListMDEOnboarding.ps1 index 85e8f88cc2..3399624e34 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Defender/Invoke-ListMDEOnboarding.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Defender/Invoke-ListMDEOnboarding.ps1 @@ -48,7 +48,7 @@ function Invoke-ListMDEOnboarding { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Incidents/Invoke-ExecAlertsList.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Incidents/Invoke-ExecAlertsList.ps1 index 8d0e335dda..e28340bd62 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Incidents/Invoke-ExecAlertsList.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Incidents/Invoke-ExecAlertsList.ps1 @@ -4,8 +4,6 @@ function Invoke-ExecAlertsList { Entrypoint .ROLE Security.Alert.Read - .DESCRIPTION - Lists Microsoft 365 Defender security alerts for a tenant. tenantFilter=AllTenants reads the cached alert table instead of querying each tenant live, so those results are as fresh as the last cache run. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -120,7 +118,7 @@ function Invoke-ExecAlertsList { } } catch { - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $body = $_.Exception.message } if (!$body) { diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Incidents/Invoke-ExecIncidentsList.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Incidents/Invoke-ExecIncidentsList.ps1 index b82b713776..536f5bb75c 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Incidents/Invoke-ExecIncidentsList.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Incidents/Invoke-ExecIncidentsList.ps1 @@ -4,8 +4,6 @@ function Invoke-ExecIncidentsList { Entrypoint .ROLE Security.Incident.Read - .DESCRIPTION - Lists Microsoft 365 Defender security incidents for a tenant, optionally bounded by StartDate and EndDate (both YYYYMMDD). tenantFilter=AllTenants reads the cached incident table rather than querying each tenant live. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -123,7 +121,7 @@ function Invoke-ExecIncidentsList { } } catch { $Body = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } if (!$Body) { $StatusCode = [HttpStatusCode]::OK diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Incidents/Invoke-ExecMdoAlertsList.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Incidents/Invoke-ExecMdoAlertsList.ps1 index 636336f3f8..1ad4bdbadd 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Incidents/Invoke-ExecMdoAlertsList.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Incidents/Invoke-ExecMdoAlertsList.ps1 @@ -63,7 +63,7 @@ function Invoke-ExecMDOAlertsList { } } catch { $Body = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } if (!$Body) { $StatusCode = [HttpStatusCode]::OK diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ExecEdiscoveryCase.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ExecEdiscoveryCase.ps1 new file mode 100644 index 0000000000..d8e357295a --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ExecEdiscoveryCase.ps1 @@ -0,0 +1,76 @@ +function Invoke-ExecEdiscoveryCase { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Security.Ediscovery.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + $Action = $Request.Body.action + $CaseId = $Request.Body.caseId + + $BaseUri = 'https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases' + + try { + switch ($Action) { + 'create' { + $RequestBody = @{ + displayName = $Request.Body.displayName + description = $Request.Body.description + externalId = $Request.Body.externalId + } | ConvertTo-Json -Compress + + $Result = New-GraphPostRequest -uri $BaseUri -tenantid $TenantFilter -body $RequestBody -type POST -AsApp $true + $ResponseBody = "Successfully created eDiscovery case '$($Request.Body.displayName)'" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ResponseBody -Sev 'Info' + } + 'update' { + $RequestBody = @{} + if ($Request.Body.displayName) { $RequestBody.displayName = $Request.Body.displayName } + if ($Request.Body.description) { $RequestBody.description = $Request.Body.description } + $RequestBody = $RequestBody | ConvertTo-Json -Compress + + New-GraphPostRequest -uri "$BaseUri/$CaseId" -tenantid $TenantFilter -body $RequestBody -type PATCH -AsApp $true + $ResponseBody = "Successfully updated eDiscovery case '$CaseId'" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ResponseBody -Sev 'Info' + } + 'close' { + New-GraphPostRequest -uri "$BaseUri/$CaseId/close" -tenantid $TenantFilter -body '{}' -type POST -AsApp $true + $ResponseBody = "Successfully closed eDiscovery case '$CaseId'" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ResponseBody -Sev 'Info' + } + 'reopen' { + New-GraphPostRequest -uri "$BaseUri/$CaseId/reopen" -tenantid $TenantFilter -body '{}' -type POST -AsApp $true + $ResponseBody = "Successfully reopened eDiscovery case '$CaseId'" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ResponseBody -Sev 'Info' + } + 'delete' { + New-GraphPostRequest -uri "$BaseUri/$CaseId" -tenantid $TenantFilter -type DELETE -AsApp $true + $ResponseBody = "Successfully deleted eDiscovery case '$CaseId'" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ResponseBody -Sev 'Info' + } + default { + throw "Unknown action: $Action" + } + } + + $StatusCode = [HttpStatusCode]::OK + $Body = [PSCustomObject]@{ Results = $ResponseBody } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Result = "Failed to $Action eDiscovery case: $($ErrorMessage.NormalizedError)" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError + $Body = [PSCustomObject]@{ Results = $Result } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ExecEdiscoveryCaseExport.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ExecEdiscoveryCaseExport.ps1 new file mode 100644 index 0000000000..d7c2d541af --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ExecEdiscoveryCaseExport.ps1 @@ -0,0 +1,50 @@ +function Invoke-ExecEdiscoveryCaseExport { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Security.Ediscovery.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + $CaseId = $Request.Body.caseId + $SearchId = $Request.Body.searchId + + $Uri = "https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/$CaseId/searches/$SearchId/exportResult" + + try { + $ExportBody = @{ + displayName = $Request.Body.displayName ?? "Export-$SearchId-$(Get-Date -Format 'yyyyMMdd-HHmmss')" + exportCriteria = $Request.Body.exportCriteria ?? 'searchHits' + exportLocation = $Request.Body.exportLocation ?? 'originalLocation' + } + + if ($Request.Body.exportFormat) { + $ExportBody.exportFormat = $Request.Body.exportFormat + } + + $RequestBody = $ExportBody | ConvertTo-Json -Compress + New-GraphPostRequest -uri $Uri -tenantid $TenantFilter -body $RequestBody -type POST -AsApp $true + + $ResponseBody = "Export started for search '$SearchId'. Check the Exports tab for progress." + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ResponseBody -Sev 'Info' + + $StatusCode = [HttpStatusCode]::OK + $Body = [PSCustomObject]@{ Results = $ResponseBody } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Result = "Failed to export eDiscovery search results: $($ErrorMessage.NormalizedError)" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError + $Body = [PSCustomObject]@{ Results = $Result } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ExecEdiscoveryCaseHold.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ExecEdiscoveryCaseHold.ps1 new file mode 100644 index 0000000000..da99d3411e --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ExecEdiscoveryCaseHold.ps1 @@ -0,0 +1,88 @@ +function Invoke-ExecEdiscoveryCaseHold { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Security.Ediscovery.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + $Action = $Request.Body.action + $CaseId = $Request.Body.caseId + $HoldId = $Request.Body.holdId + + $BaseUri = "https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/$CaseId/legalHolds" + + try { + switch ($Action) { + 'create' { + $HoldBody = @{ + displayName = $Request.Body.displayName + description = $Request.Body.description + contentQuery = $Request.Body.contentQuery + } + + if ($Request.Body.userSources) { + $HoldBody.userSources = @( + foreach ($UserSource in $Request.Body.userSources) { + @{ + email = $UserSource.email + includedSources = $UserSource.includedSources ?? 'mailbox,site' + } + } + ) + } + + if ($Request.Body.siteSources) { + $HoldBody.siteSources = @( + foreach ($SiteSource in $Request.Body.siteSources) { + @{ siteWebUrl = $SiteSource.siteWebUrl } + } + ) + } + + $RequestBody = $HoldBody | ConvertTo-Json -Depth 5 -Compress + $Result = New-GraphPostRequest -uri $BaseUri -tenantid $TenantFilter -body $RequestBody -type POST -AsApp $true + $ResponseBody = "Successfully created legal hold '$($Request.Body.displayName)'" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ResponseBody -Sev 'Info' + } + 'update' { + $UpdateBody = @{} + if ($Request.Body.displayName) { $UpdateBody.displayName = $Request.Body.displayName } + if ($Request.Body.description) { $UpdateBody.description = $Request.Body.description } + if ($null -ne $Request.Body.contentQuery) { $UpdateBody.contentQuery = $Request.Body.contentQuery } + $RequestBody = $UpdateBody | ConvertTo-Json -Compress + + New-GraphPostRequest -uri "$BaseUri/$HoldId" -tenantid $TenantFilter -body $RequestBody -type PATCH -AsApp $true + $ResponseBody = "Successfully updated legal hold '$HoldId'" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ResponseBody -Sev 'Info' + } + 'remove' { + New-GraphPostRequest -uri "$BaseUri/$HoldId" -tenantid $TenantFilter -type DELETE -AsApp $true + $ResponseBody = "Successfully removed legal hold '$HoldId'" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ResponseBody -Sev 'Info' + } + default { + throw "Unknown action: $Action" + } + } + + $StatusCode = [HttpStatusCode]::OK + $Body = [PSCustomObject]@{ Results = $ResponseBody } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Result = "Failed to $Action legal hold: $($ErrorMessage.NormalizedError)" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError + $Body = [PSCustomObject]@{ Results = $Result } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ExecEdiscoveryCaseSearch.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ExecEdiscoveryCaseSearch.ps1 new file mode 100644 index 0000000000..0745f34e5b --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ExecEdiscoveryCaseSearch.ps1 @@ -0,0 +1,78 @@ +function Invoke-ExecEdiscoveryCaseSearch { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Security.Ediscovery.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + $Action = $Request.Body.action + $CaseId = $Request.Body.caseId + $SearchId = $Request.Body.searchId + + $BaseUri = "https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/$CaseId/searches" + + try { + switch ($Action) { + 'create' { + $SearchBody = @{ + displayName = $Request.Body.displayName + description = $Request.Body.description + contentQuery = $Request.Body.contentQuery + } + + if ($Request.Body.dataSourceScopes) { + $SearchBody.dataSourceScopes = $Request.Body.dataSourceScopes + } + + $RequestBody = $SearchBody | ConvertTo-Json -Depth 5 -Compress + $Result = New-GraphPostRequest -uri $BaseUri -tenantid $TenantFilter -body $RequestBody -type POST -AsApp $true + $ResponseBody = "Successfully created eDiscovery search '$($Request.Body.displayName)'" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ResponseBody -Sev 'Info' + } + 'update' { + $UpdateBody = @{} + if ($Request.Body.displayName) { $UpdateBody.displayName = $Request.Body.displayName } + if ($Request.Body.description) { $UpdateBody.description = $Request.Body.description } + if ($null -ne $Request.Body.contentQuery) { $UpdateBody.contentQuery = $Request.Body.contentQuery } + $RequestBody = $UpdateBody | ConvertTo-Json -Compress + + New-GraphPostRequest -uri "$BaseUri/$SearchId" -tenantid $TenantFilter -body $RequestBody -type PATCH -AsApp $true + $ResponseBody = "Successfully updated eDiscovery search '$SearchId'" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ResponseBody -Sev 'Info' + } + 'estimateStatistics' { + New-GraphPostRequest -uri "$BaseUri/$SearchId/estimateStatistics" -tenantid $TenantFilter -body '{}' -type POST -AsApp $true + $ResponseBody = "Search estimate started for '$SearchId'. This may take several minutes to complete." + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ResponseBody -Sev 'Info' + } + 'delete' { + New-GraphPostRequest -uri "$BaseUri/$SearchId" -tenantid $TenantFilter -type DELETE -AsApp $true + $ResponseBody = "Successfully deleted eDiscovery search '$SearchId'" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ResponseBody -Sev 'Info' + } + default { + throw "Unknown action: $Action" + } + } + + $StatusCode = [HttpStatusCode]::OK + $Body = [PSCustomObject]@{ Results = $ResponseBody } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Result = "Failed to $Action eDiscovery search: $($ErrorMessage.NormalizedError)" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError + $Body = [PSCustomObject]@{ Results = $Result } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ListEdiscoveryCaseHolds.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ListEdiscoveryCaseHolds.ps1 new file mode 100644 index 0000000000..e851669b70 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ListEdiscoveryCaseHolds.ps1 @@ -0,0 +1,56 @@ +function Invoke-ListEdiscoveryCaseHolds { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Security.Ediscovery.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $TenantFilter = $Request.Query.tenantFilter + $CaseId = $Request.Query.caseId + + try { + $Uri = "https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/$CaseId/legalHolds" + $Holds = New-GraphGetRequest -uri $Uri -tenantid $TenantFilter -AsApp $true + + $GraphRequest = foreach ($Hold in $Holds) { + $ContentSourcesCount = 0 + if ($Hold.userSources) { $ContentSourcesCount += ($Hold.userSources | Measure-Object).Count } + if ($Hold.siteSources) { $ContentSourcesCount += ($Hold.siteSources | Measure-Object).Count } + + [PSCustomObject]@{ + id = $Hold.id + displayName = $Hold.displayName + description = $Hold.description + status = $Hold.status + isEnabled = $Hold.isEnabled + contentQuery = $Hold.contentQuery + createdBy = $Hold.createdBy.user.displayName + createdDate = $Hold.createdDateTime + lastModified = $Hold.lastModifiedDateTime + contentSourcesCount = $ContentSourcesCount + userSources = $Hold.userSources + siteSources = $Hold.siteSources + } + } + + $StatusCode = [HttpStatusCode]::OK + $Body = [PSCustomObject]@{ + Results = @($GraphRequest) + } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $StatusCode = [HttpStatusCode]::InternalServerError + $Body = [PSCustomObject]@{ + Results = "Failed to retrieve legal holds for case '$CaseId': $($ErrorMessage.NormalizedError)" + } + Write-LogMessage -headers $Request.Headers -API $Request.Params.CIPPEndpoint -tenant $TenantFilter -message "Failed to retrieve legal holds: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ListEdiscoveryCaseOperations.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ListEdiscoveryCaseOperations.ps1 new file mode 100644 index 0000000000..c9031170e1 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ListEdiscoveryCaseOperations.ps1 @@ -0,0 +1,52 @@ +function Invoke-ListEdiscoveryCaseOperations { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Security.Ediscovery.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $TenantFilter = $Request.Query.tenantFilter + $CaseId = $Request.Query.caseId + + try { + $Uri = "https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/$CaseId/operations" + $Operations = New-GraphGetRequest -uri $Uri -tenantid $TenantFilter -AsApp $true + + $GraphRequest = foreach ($Op in $Operations) { + [PSCustomObject]@{ + id = $Op.id + displayName = $Op.'@odata.type' -replace '#microsoft.graph.security.', '' + action = $Op.action + status = $Op.status + percentProgress = $Op.percentProgress + createdBy = $Op.createdBy.user.displayName + createdDate = $Op.createdDateTime + completedDate = $Op.completedDateTime + resultInfo = $Op.resultInfo + exportUrl = $Op.exportFileMetadata.downloadUrl + exportFileName = $Op.exportFileMetadata.fileName + exportFileSize = $Op.exportFileMetadata.size + } + } + + $StatusCode = [HttpStatusCode]::OK + $Body = [PSCustomObject]@{ + Results = @($GraphRequest) + } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $StatusCode = [HttpStatusCode]::InternalServerError + $Body = [PSCustomObject]@{ + Results = "Failed to retrieve operations for case '$CaseId': $($ErrorMessage.NormalizedError)" + } + Write-LogMessage -headers $Request.Headers -API $Request.Params.CIPPEndpoint -tenant $TenantFilter -message "Failed to retrieve eDiscovery operations: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ListEdiscoveryCaseSearches.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ListEdiscoveryCaseSearches.ps1 new file mode 100644 index 0000000000..3f6f6ca11f --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ListEdiscoveryCaseSearches.ps1 @@ -0,0 +1,53 @@ +function Invoke-ListEdiscoveryCaseSearches { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Security.Ediscovery.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $TenantFilter = $Request.Query.tenantFilter + $CaseId = $Request.Query.caseId + + try { + $Uri = "https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/$CaseId/searches" + $Searches = New-GraphGetRequest -uri $Uri -tenantid $TenantFilter -AsApp $true + + $GraphRequest = foreach ($Search in $Searches) { + [PSCustomObject]@{ + id = $Search.id + displayName = $Search.displayName + description = $Search.description + contentQuery = $Search.contentQuery + createdBy = $Search.createdBy.user.displayName + createdDate = $Search.createdDateTime + lastModified = $Search.lastModifiedDateTime + dataSourceScopes = $Search.dataSourceScopes + lastEstimateDate = $Search.lastEstimateStatisticsOperation.createdDateTime + estimatedItemCount = $Search.lastEstimateStatisticsOperation.indexedItemCount + estimatedSize = $Search.lastEstimateStatisticsOperation.indexedItemsSize + estimatedUnindexed = $Search.lastEstimateStatisticsOperation.unindexedItemCount + status = if ($Search.lastEstimateStatisticsOperation.status) { $Search.lastEstimateStatisticsOperation.status } else { 'created' } + } + } + + $StatusCode = [HttpStatusCode]::OK + $Body = [PSCustomObject]@{ + Results = @($GraphRequest) + } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $StatusCode = [HttpStatusCode]::InternalServerError + $Body = [PSCustomObject]@{ + Results = "Failed to retrieve searches for case '$CaseId': $($ErrorMessage.NormalizedError)" + } + Write-LogMessage -headers $Request.Headers -API $Request.Params.CIPPEndpoint -tenant $TenantFilter -message "Failed to retrieve eDiscovery searches: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ListEdiscoveryCases.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ListEdiscoveryCases.ps1 new file mode 100644 index 0000000000..e4bc3cf1ef --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Invoke-ListEdiscoveryCases.ps1 @@ -0,0 +1,49 @@ +function Invoke-ListEdiscoveryCases { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Security.Ediscovery.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $TenantFilter = $Request.Query.tenantFilter + + try { + $Uri = 'https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases' + $Cases = New-GraphGetRequest -uri $Uri -tenantid $TenantFilter -AsApp $true + + $GraphRequest = foreach ($Case in $Cases) { + [PSCustomObject]@{ + id = $Case.id + displayName = $Case.displayName + description = $Case.description + status = $Case.status + createdBy = $Case.createdBy.user.displayName + createdDate = $Case.createdDateTime + lastModified = $Case.lastModifiedDateTime + closedBy = $Case.closedBy.user.displayName + closedDate = $Case.closedDateTime + externalId = $Case.externalId + } + } + + $StatusCode = [HttpStatusCode]::OK + $Body = [PSCustomObject]@{ + Results = @($GraphRequest) + } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $StatusCode = [HttpStatusCode]::InternalServerError + $Body = [PSCustomObject]@{ + Results = "Failed to retrieve eDiscovery cases: $($ErrorMessage.NormalizedError)" + } + Write-LogMessage -headers $Request.Headers -API $Request.Params.CIPPEndpoint -tenant $TenantFilter -message "Failed to retrieve eDiscovery cases: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-AddSafeLinksPolicyFromTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-AddSafeLinksPolicyFromTemplate.ps1 index 2e4d4762e4..c90e44ee3b 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-AddSafeLinksPolicyFromTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-AddSafeLinksPolicyFromTemplate.ps1 @@ -27,7 +27,10 @@ Function Invoke-AddSafeLinksPolicyFromTemplate { $Templates = $RequestBody.TemplateList | ForEach-Object { $_.value } if (-not $Templates -or $Templates.Count -eq 0) { - throw "No templates provided in TemplateList" + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'No templates provided in TemplateList' } + }) } # Helper function to process array fields with cleaner logic @@ -194,12 +197,14 @@ Function Invoke-AddSafeLinksPolicyFromTemplate { } # Process each tenant and template combination + $Failed = 0 $Results = foreach ($TenantFilter in $SelectedTenants) { foreach ($Template in $Templates) { try { New-SafeLinksPolicyFromTemplate -TenantFilter $TenantFilter -Template $Template } catch { + $Failed++ $ErrorMessage = Get-CippException -Exception $_ $ErrorDetail = "Failed to deploy template '$($Template.TemplateName)' to tenant $TenantFilter. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ErrorDetail -Sev 'Error' @@ -208,7 +213,7 @@ Function Invoke-AddSafeLinksPolicyFromTemplate { } } - $StatusCode = [HttpStatusCode]::OK + $StatusCode = Get-CippBulkStatusCode -Total (@($SelectedTenants).Count * @($Templates).Count) -Failed $Failed } catch { $ErrorMessage = Get-CippException -Exception $_ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-AddSafeLinksPolicyTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-AddSafeLinksPolicyTemplate.ps1 index 79c42cce7c..330e70975d 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-AddSafeLinksPolicyTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-AddSafeLinksPolicyTemplate.ps1 @@ -14,18 +14,24 @@ Function Invoke-AddSafeLinksPolicyTemplate { # Debug: Log the incoming request body Write-LogMessage -Headers $Headers -API $APINAME -message "Request body: $($Request.body | ConvertTo-Json -Depth 5 -Compress)" -Sev Debug - try { - $GUID = (New-Guid).GUID + # Validate required fields. The "create template from policy" row action posts the policy + # row, which carries Name/PolicyName but no TemplateName. + if ([string]::IsNullOrEmpty($Request.body.Name) -and [string]::IsNullOrEmpty($Request.body.TemplateName)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = [pscustomobject]@{'Results' = 'Failed to create SafeLinks policy template: Template name is required but was not provided' } + }) + } - # Validate required fields. The "create template from policy" row action posts the policy - # row, which carries Name/PolicyName but no TemplateName. - if ([string]::IsNullOrEmpty($Request.body.Name) -and [string]::IsNullOrEmpty($Request.body.TemplateName)) { - throw "Template name is required but was not provided" - } + if ([string]::IsNullOrEmpty($Request.body.PolicyName)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = [pscustomobject]@{'Results' = 'Failed to create SafeLinks policy template: Policy name is required but was not provided' } + }) + } - if ([string]::IsNullOrEmpty($Request.body.PolicyName)) { - throw "Policy name is required but was not provided" - } + try { + $GUID = (New-Guid).GUID # Create a new ordered hashtable to store selected properties $policyObject = [ordered]@{} @@ -86,7 +92,7 @@ Function Invoke-AddSafeLinksPolicyTemplate { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -Headers $Headers -API $APINAME -message "Failed to create SafeLinks policy template: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage $body = [pscustomobject]@{'Results' = "Failed to create SafeLinks policy template: $($ErrorMessage.NormalizedError)" } - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-CreateSafeLinksPolicyTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-CreateSafeLinksPolicyTemplate.ps1 index 4eb65304b8..0e002f3824 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-CreateSafeLinksPolicyTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-CreateSafeLinksPolicyTemplate.ps1 @@ -64,7 +64,7 @@ Function Invoke-CreateSafeLinksPolicyTemplate { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -Headers $Headers -API $APINAME -message "Failed to create SafeLinks policy template: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage $body = [pscustomobject]@{'Results' = "Failed to create SafeLinks policy template: $($ErrorMessage.NormalizedError)" } - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-EditSafeLinksPolicyTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-EditSafeLinksPolicyTemplate.ps1 index 7f0acbba12..e28c3e9b18 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-EditSafeLinksPolicyTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-EditSafeLinksPolicyTemplate.ps1 @@ -14,13 +14,16 @@ function Invoke-EditSafeLinksPolicyTemplate { $Headers = $Request.Headers Write-LogMessage -Headers $Headers -API $APINAME -message 'Accessed this API' -Sev Debug - try { - $ID = $Request.Body.ID + $ID = $Request.Body.ID - if (-not $ID) { - throw 'Template ID is required' - } + if (-not $ID) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = [pscustomobject]@{'Results' = 'Failed to update SafeLinks policy template: Template ID is required' } + }) + } + try { # Check if template exists $Table = Get-CippTable -tablename 'templates' $SafeID = ConvertTo-CIPPODataFilterValue -Value $ID -Type String @@ -28,7 +31,10 @@ function Invoke-EditSafeLinksPolicyTemplate { $ExistingTemplate = Get-CIPPAzDataTableEntity @Table -Filter $Filter if (-not $ExistingTemplate) { - throw "Template with ID '$ID' not found" + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = [pscustomobject]@{'Results' = "Failed to update SafeLinks policy template: Template with ID '$ID' not found" } + }) } # Create a new ordered hashtable to store selected properties @@ -77,7 +83,7 @@ function Invoke-EditSafeLinksPolicyTemplate { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -Headers $Headers -API $APINAME -message "Failed to update SafeLinks policy template: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage $body = [pscustomobject]@{'Results' = "Failed to update SafeLinks policy template: $($ErrorMessage.NormalizedError)" } - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-ListSafeLinksPolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-ListSafeLinksPolicy.ps1 index eee5d242c0..77241f5510 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-ListSafeLinksPolicy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-ListSafeLinksPolicy.ps1 @@ -196,7 +196,7 @@ Function Invoke-ListSafeLinksPolicy { catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message Write-LogMessage -headers $Headers -API $APIName -message "Error retrieving Safe Links policies: $ErrorMessage" -Sev 'Error' - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $FinalOutput = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-RemoveSafeLinksPolicyTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-RemoveSafeLinksPolicyTemplate.ps1 index 7725f52cb2..66edbc8712 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-RemoveSafeLinksPolicyTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Safe-Links-Policy/Invoke-RemoveSafeLinksPolicyTemplate.ps1 @@ -11,11 +11,24 @@ function Invoke-RemoveSafeLinksPolicyTemplate { $User = $Request.Headers Write-LogMessage -Headers $User -API $APINAME -message 'Accessed this API' -Sev 'Debug' $ID = $request.query.ID ?? $request.body.ID + if (-not $ID) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'Failed to remove SafeLinks Policy template: ID is required.' } + }) + } + try { $Table = Get-CippTable -tablename 'templates' $SafeID = ConvertTo-CIPPODataFilterValue -Value $ID -Type String $Filter = "PartitionKey eq 'SafeLinksTemplate' and RowKey eq '$SafeID'" $ClearRow = Get-CIPPAzDataTableEntity @Table -Filter $Filter -Property PartitionKey, RowKey + if (-not $ClearRow) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = @{ Results = "SafeLinks Policy template with ID $ID not found." } + }) + } Remove-CIPPAzDataTableEntity -Force @Table -Entity $ClearRow $Result = "Removed SafeLinks Policy Template with ID $ID." Write-LogMessage -Headers $User -API $APINAME -message $Result -Sev 'Info' @@ -24,7 +37,7 @@ function Invoke-RemoveSafeLinksPolicyTemplate { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to remove SafeLinks Policy template with ID $ID. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $User -API $APINAME -message $Result -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddSite.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddSite.ps1 index 61e780a456..16342c5427 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddSite.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddSite.ps1 @@ -9,25 +9,89 @@ function Invoke-AddSite { param($Request, $TriggerMetadata) $Headers = $Request.Headers - - # Interact with query parameters or the body of the request. $TenantFilter = $Request.Body.tenantFilter $SharePointObj = $Request.Body + # Build parameters hashtable for splatting + $SiteParams = @{ + Headers = $Headers + SiteName = $SharePointObj.siteName + SiteDescription = $SharePointObj.siteDescription + TenantFilter = $TenantFilter + } + + # Handle owner - can be object with value property or direct string + if ($SharePointObj.siteOwner.value) { + $SiteParams.SiteOwner = $SharePointObj.siteOwner.value + } elseif ($SharePointObj.siteOwner) { + $SiteParams.SiteOwner = $SharePointObj.siteOwner + } + + # Handle template name + if ($SharePointObj.templateName.value) { + $SiteParams.TemplateName = $SharePointObj.templateName.value + } elseif ($SharePointObj.templateName) { + $SiteParams.TemplateName = $SharePointObj.templateName + } + + # Handle site design + if ($SharePointObj.siteDesign.value) { + $SiteParams.SiteDesign = $SharePointObj.siteDesign.value + } elseif ($SharePointObj.siteDesign) { + $SiteParams.SiteDesign = $SharePointObj.siteDesign + } + + # Handle custom site design ID + if ($SharePointObj.customSiteDesignId.value) { + $SiteParams.CustomSiteDesignId = $SharePointObj.customSiteDesignId.value + } elseif ($SharePointObj.customSiteDesignId) { + $SiteParams.CustomSiteDesignId = $SharePointObj.customSiteDesignId + } + + # Handle sensitivity label + if ($SharePointObj.sensitivityLabel.value) { + $SiteParams.SensitivityLabel = $SharePointObj.sensitivityLabel.value + } elseif ($SharePointObj.sensitivityLabel) { + $SiteParams.SensitivityLabel = $SharePointObj.sensitivityLabel + } + + # Handle language/LCID + if ($SharePointObj.lcid.value) { + $SiteParams.Lcid = [int]$SharePointObj.lcid.value + } elseif ($SharePointObj.lcid) { + $SiteParams.Lcid = [int]$SharePointObj.lcid + } + + # Handle time zone + if ($SharePointObj.timeZoneId.value) { + $SiteParams.TimeZoneId = [int]$SharePointObj.timeZoneId.value + } elseif ($SharePointObj.timeZoneId) { + $SiteParams.TimeZoneId = [int]$SharePointObj.timeZoneId + } + + # Handle storage quota + if ($SharePointObj.storageQuota) { + $SiteParams.StorageQuota = [int]$SharePointObj.storageQuota + } + + # Handle external sharing + if ($null -ne $SharePointObj.shareByEmailEnabled) { + $SiteParams.ShareByEmailEnabled = [bool]$SharePointObj.shareByEmailEnabled + } + + # Handle hub site association + if ($SharePointObj.hubSiteId.value) { + $SiteParams.HubSiteId = $SharePointObj.hubSiteId.value + } elseif ($SharePointObj.hubSiteId) { + $SiteParams.HubSiteId = $SharePointObj.hubSiteId + } + + if ($null -ne $SharePointObj.isPublic) { + $SiteParams.IsPublic = ($SharePointObj.isPublic -eq $true) + } + try { - $SiteParams = @{ - Headers = $Headers - SiteName = $SharePointObj.siteName - SiteDescription = $SharePointObj.siteDescription - SiteOwner = $SharePointObj.siteOwner.value - TemplateName = $SharePointObj.templateName.value - SensitivityLabel = $SharePointObj.sensitivityLabel - IsPublic = ($SharePointObj.isPublic -eq $true) - TenantFilter = $TenantFilter - } - # Optional. Only applies to the Team and Communication templates; omitted for TeamGroup. - if ($SharePointObj.siteDesign.value) { $SiteParams.SiteDesign = $SharePointObj.siteDesign.value } $Result = New-CIPPSharepointSite @SiteParams $StatusCode = [HttpStatusCode]::OK } catch { @@ -39,5 +103,4 @@ function Invoke-AddSite { StatusCode = $StatusCode Body = @{'Results' = $Result } }) - } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddSiteBulk.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddSiteBulk.ps1 index d1a862ed71..03a3a092be 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddSiteBulk.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddSiteBulk.ps1 @@ -12,6 +12,7 @@ Function Invoke-AddSiteBulk { $Results = [System.Collections.Generic.List[System.Object]]::new() + $Failed = 0 foreach ($sharePointObj in $Request.Body.bulkSites) { try { @@ -30,11 +31,12 @@ Function Invoke-AddSiteBulk { $SharePointSite = New-CIPPSharepointSite @SiteParams $Results.Add($SharePointSite) } catch { + $Failed++ $Results.Add("Failed to create $($sharePointObj.siteName) Error message: $($_.Exception.Message)") } } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = Get-CippBulkStatusCode -Total @($Request.Body.bulkSites).Count -Failed $Failed Body = @{'Results' = $Results } }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddTeam.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddTeam.ps1 index 13d4360dfd..a213506bfa 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddTeam.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddTeam.ps1 @@ -11,7 +11,6 @@ Function Invoke-AddTeam { $APIName = $Request.Params.CIPPEndpoint $Headers = $Request.Headers - # Interact with the body of the request $TeamObj = $Request.Body $TenantID = $TeamObj.tenantid @@ -21,27 +20,144 @@ Function Invoke-AddTeam { if ($null -eq $Owners) { throw 'You have to add at least one owner to the team' } - $Owners = $Owners | ForEach-Object { - $OwnerID = "https://graph.microsoft.com/beta/users('$($_)')" - @{ - '@odata.type' = '#microsoft.graph.aadUserConversationMember' - 'roles' = @('owner') - 'user@odata.bind' = $OwnerID - } + + # Build owner member - Graph API only allows ONE member during team creation + $OwnerUPN = @($Owners)[0] + $OwnerMember = @{ + '@odata.type' = '#microsoft.graph.aadUserConversationMember' + 'roles' = @('owner') + 'user@odata.bind' = "https://graph.microsoft.com/v1.0/users('$OwnerUPN')" } - $TeamsSettings = [PSCustomObject]@{ - 'template@odata.bind' = "https://graph.microsoft.com/v1.0/teamsTemplates('standard')" + # Determine template + $TemplateName = if ($TeamObj.templateName) { $TeamObj.templateName } else { 'standard' } + + # Build team settings object - only include the owner during creation + $TeamsSettings = [ordered]@{ + 'template@odata.bind' = "https://graph.microsoft.com/v1.0/teamsTemplates('$TemplateName')" 'visibility' = $TeamObj.visibility 'displayName' = $TeamObj.displayName 'description' = $TeamObj.description - 'members' = @($Owners) + 'members' = @($OwnerMember) + } + + # Add member settings if provided + if ($null -ne $TeamObj.allowCreateUpdateChannels -or + $null -ne $TeamObj.allowDeleteChannels -or + $null -ne $TeamObj.allowAddRemoveApps -or + $null -ne $TeamObj.allowCreatePrivateChannels -or + $null -ne $TeamObj.allowCreateUpdateRemoveTabs -or + $null -ne $TeamObj.allowCreateUpdateRemoveConnectors) { + + $MemberSettings = @{} + if ($null -ne $TeamObj.allowCreateUpdateChannels) { $MemberSettings['allowCreateUpdateChannels'] = [bool]$TeamObj.allowCreateUpdateChannels } + if ($null -ne $TeamObj.allowDeleteChannels) { $MemberSettings['allowDeleteChannels'] = [bool]$TeamObj.allowDeleteChannels } + if ($null -ne $TeamObj.allowAddRemoveApps) { $MemberSettings['allowAddRemoveApps'] = [bool]$TeamObj.allowAddRemoveApps } + if ($null -ne $TeamObj.allowCreatePrivateChannels) { $MemberSettings['allowCreatePrivateChannels'] = [bool]$TeamObj.allowCreatePrivateChannels } + if ($null -ne $TeamObj.allowCreateUpdateRemoveTabs) { $MemberSettings['allowCreateUpdateRemoveTabs'] = [bool]$TeamObj.allowCreateUpdateRemoveTabs } + if ($null -ne $TeamObj.allowCreateUpdateRemoveConnectors) { $MemberSettings['allowCreateUpdateRemoveConnectors'] = [bool]$TeamObj.allowCreateUpdateRemoveConnectors } + $TeamsSettings['memberSettings'] = $MemberSettings + } + + # Add guest settings if provided + if ($null -ne $TeamObj.allowGuestCreateUpdateChannels -or $null -ne $TeamObj.allowGuestDeleteChannels) { + $GuestSettings = @{} + if ($null -ne $TeamObj.allowGuestCreateUpdateChannels) { $GuestSettings['allowCreateUpdateChannels'] = [bool]$TeamObj.allowGuestCreateUpdateChannels } + if ($null -ne $TeamObj.allowGuestDeleteChannels) { $GuestSettings['allowDeleteChannels'] = [bool]$TeamObj.allowGuestDeleteChannels } + $TeamsSettings['guestSettings'] = $GuestSettings + } + + # Add messaging settings if provided + if ($null -ne $TeamObj.allowUserEditMessages -or + $null -ne $TeamObj.allowUserDeleteMessages -or + $null -ne $TeamObj.allowOwnerDeleteMessages -or + $null -ne $TeamObj.allowTeamMentions -or + $null -ne $TeamObj.allowChannelMentions) { + + $MessagingSettings = @{} + if ($null -ne $TeamObj.allowUserEditMessages) { $MessagingSettings['allowUserEditMessages'] = [bool]$TeamObj.allowUserEditMessages } + if ($null -ne $TeamObj.allowUserDeleteMessages) { $MessagingSettings['allowUserDeleteMessages'] = [bool]$TeamObj.allowUserDeleteMessages } + if ($null -ne $TeamObj.allowOwnerDeleteMessages) { $MessagingSettings['allowOwnerDeleteMessages'] = [bool]$TeamObj.allowOwnerDeleteMessages } + if ($null -ne $TeamObj.allowTeamMentions) { $MessagingSettings['allowTeamMentions'] = [bool]$TeamObj.allowTeamMentions } + if ($null -ne $TeamObj.allowChannelMentions) { $MessagingSettings['allowChannelMentions'] = [bool]$TeamObj.allowChannelMentions } + $TeamsSettings['messagingSettings'] = $MessagingSettings + } + + # Add fun settings if provided + if ($null -ne $TeamObj.allowGiphy -or + $null -ne $TeamObj.allowStickersAndMemes -or + $null -ne $TeamObj.allowCustomMemes) { - } | ConvertTo-Json -Depth 10 - # Write-Host $TeamsSettings + $FunSettings = @{} + if ($null -ne $TeamObj.allowGiphy) { $FunSettings['allowGiphy'] = [bool]$TeamObj.allowGiphy } + if ($TeamObj.giphyContentRating) { $FunSettings['giphyContentRating'] = $TeamObj.giphyContentRating } + if ($null -ne $TeamObj.allowStickersAndMemes) { $FunSettings['allowStickersAndMemes'] = [bool]$TeamObj.allowStickersAndMemes } + if ($null -ne $TeamObj.allowCustomMemes) { $FunSettings['allowCustomMemes'] = [bool]$TeamObj.allowCustomMemes } + $TeamsSettings['funSettings'] = $FunSettings + } + + $Body = $TeamsSettings | ConvertTo-Json -Depth 10 + # Create the team - the response Content-Location header contains the team ID + $CreateResponse = New-GraphPostRequest -AsApp $true -uri 'https://graph.microsoft.com/v1.0/teams' -tenantid $TenantID -type POST -body $Body -Verbose + + # Add additional members after team creation (Graph API only allows 1 member during creation) + $AdditionalMemberUPNs = @() + if ($TeamObj.additionalMembers) { + $AdditionalMemberUPNs = @($TeamObj.additionalMembers) | Where-Object { $_ } + } + + $MemberFailures = @() + if ($AdditionalMemberUPNs.Count -gt 0) { + # Extract Team ID from the creation response + $NewTeamID = $null + if ($CreateResponse -and $CreateResponse.'Content-Location') { + # Content-Location is like /teams('guid') + if ($CreateResponse.'Content-Location' -match "[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}") { + $NewTeamID = $Matches[0] + } + } + + if (-not $NewTeamID) { + # Fallback: look up the team by display name + Start-Sleep -Seconds 5 + $LookupResult = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/groups?`$filter=displayName eq '$($TeamObj.displayName)' and resourceProvisioningOptions/Any(x:x eq 'Team')&`$select=id" -tenantid $TenantID -asapp $true + if ($LookupResult -and $LookupResult.Count -gt 0) { + $NewTeamID = $LookupResult[0].id + } + } + + if ($NewTeamID) { + # Wait a moment for team provisioning to complete + Start-Sleep -Seconds 5 - $null = New-GraphPostRequest -AsApp $true -uri 'https://graph.microsoft.com/beta/teams' -tenantid $TenantID -type POST -body $TeamsSettings -Verbose - $Message = "Successfully created Team: '$($TeamObj.displayName)'" + foreach ($MemberUPN in $AdditionalMemberUPNs) { + try { + $MemberBody = @{ + '@odata.type' = '#microsoft.graph.aadUserConversationMember' + 'roles' = @() + 'user@odata.bind' = "https://graph.microsoft.com/v1.0/users('$MemberUPN')" + } | ConvertTo-Json + $null = New-GraphPostRequest -AsApp $true -uri "https://graph.microsoft.com/v1.0/teams/$NewTeamID/members" -tenantid $TenantID -type POST -body $MemberBody + } catch { + $MemberFailures += $MemberUPN + Write-Host "Failed to add member $MemberUPN to team: $_" + } + } + } else { + $MemberFailures = $AdditionalMemberUPNs + Write-Host "Could not determine new team ID to add additional members" + } + } + + if ($MemberFailures.Count -gt 0) { + $Message = "Successfully created Team: '$($TeamObj.displayName)', but failed to add $($MemberFailures.Count) member(s): $($MemberFailures -join ', '). You can add them manually from the team details page." + } else { + $MembersAdded = $AdditionalMemberUPNs.Count + $Message = "Successfully created Team: '$($TeamObj.displayName)'" + if ($MembersAdded -gt 0) { + $Message += " with $MembersAdded additional member(s)" + } + } Write-LogMessage -headers $Headers -API $APINAME -tenant $TenantID -message $Message -Sev Info $StatusCode = [HttpStatusCode]::OK diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-DeleteSharepointSite.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-DeleteSharepointSite.ps1 index 0956440b69..2ac1c6979b 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-DeleteSharepointSite.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-DeleteSharepointSite.ps1 @@ -10,96 +10,60 @@ function Invoke-DeleteSharepointSite { $APIName = $Request.Params.CIPPEndpoint $Headers = $Request.Headers - - - # Interact with query parameters or the body of the request. $TenantFilter = $Request.Body.tenantFilter $SiteId = $Request.Body.SiteId + $DisplayName = $Request.Body.DisplayName try { - # Validate required parameters if (-not $SiteId) { - throw 'SiteId is required' + throw "SiteId is required" } if (-not $TenantFilter) { - throw 'TenantFilter is required' + throw "TenantFilter is required" } - - # Validate SiteId format (GUID) if ($SiteId -notmatch '^(\{)?[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}(\})?$') { - throw 'SiteId must be a valid GUID' - } - - $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter - - # Get site information using SharePoint admin API - $SiteInfoUri = "$($SharePointInfo.AdminUrl)/_api/SPO.Tenant/sites('$SiteId')" - - # The SPO.Tenant vroute GET needs odata-version 4.0; the manager POST endpoints must - # NOT receive it - sending it flips them onto a pipeline that rejects the call with - # 'Elevated context should be used only to create service asserted level PoP'. - $GetHeaders = @{ - 'accept' = 'application/json' - 'odata-version' = '4.0' - } - $PostHeaders = @{ - 'accept' = 'application/json' - } - - try { - $SiteInfo = New-GraphGETRequest -scope "$($SharePointInfo.AdminUrl)/.default" -uri $SiteInfoUri -tenantid $TenantFilter -extraHeaders $GetHeaders -UseCertificate -AsApp $true - } catch { - throw "Could not retrieve site information from the SharePoint Admin API: $($_.Exception.Message)" - } - - if (-not $SiteInfo) { - throw 'Could not retrieve site information from SharePoint Admin API' + throw "SiteId must be a valid GUID" } - # Determine if site is group-connected based on GroupId - $IsGroupConnected = $SiteInfo.GroupId -and $SiteInfo.GroupId -ne '00000000-0000-0000-0000-000000000000' - - if ($IsGroupConnected) { - # Group-connected sites: GroupSiteManager/Delete soft-deletes the backing M365 - # group (and Team) together with the site and registers it in the SPO deleted - # sites list. Runs with the delegated token (the CIPP service account is a - # SharePoint admin); see the header note above for why odata-version is omitted. - $body = @{ - siteUrl = $SiteInfo.Url - } - try { - $null = New-GraphPOSTRequest -scope "$($SharePointInfo.AdminUrl)/.default" -uri "$($SharePointInfo.AdminUrl)/_api/GroupSiteManager/Delete" -body (ConvertTo-Json -Depth 10 -InputObject $body) -tenantid $TenantFilter -contentType 'application/json' -AddedHeaders $PostHeaders - } catch { - throw "Site deletion request failed (GroupSiteManager/Delete): $($_.Exception.Message)" - } - $Results = "Successfully initiated deletion of group-connected SharePoint site $($SiteInfo.Url); the backing M365 group (and Team, if any) is deleted with it. This can take some time to complete in the background." - } else { - # Regular sites: SPSiteManager/delete denies delegated tokens (even with a - # certificate assertion) with E_ACCESSDENIED - it requires app-only cert auth. - $body = @{ - siteId = $SiteId - } - try { - $null = New-GraphPOSTRequest -scope "$($SharePointInfo.AdminUrl)/.default" -uri "$($SharePointInfo.AdminUrl)/_api/SPSiteManager/delete" -body (ConvertTo-Json -Depth 10 -InputObject $body) -tenantid $TenantFilter -contentType 'application/json' -AddedHeaders $PostHeaders -UseCertificate -AsApp $true - } catch { - throw "Site deletion request failed (SPSiteManager/delete): $($_.Exception.Message)" - } - $Results = "Successfully initiated deletion of SharePoint site with ID $SiteId, this process can take some time to complete in the background" + # Offload deletion to background activity so the main app stays responsive and long-running deletes don't time out. + $QueueLabel = if ($DisplayName) { $DisplayName } else { $SiteId } + $Queue = New-CippQueueEntry -Name "Delete SharePoint Site - $QueueLabel" -TotalTasks 1 + $InputObject = [PSCustomObject]@{ + Batch = @( + [PSCustomObject]@{ + FunctionName = 'ExecDeleteSharepointSite' + TenantFilter = $TenantFilter + SiteId = $SiteId + Headers = $Headers + APIName = $APIName + QueueId = $Queue.RowKey + } + ) + OrchestratorName = "DeleteSharepointSite_$SiteId" + SkipLog = $true } + # Start-CIPPOrchestrator handles both runtimes (Craft bridge under CIPPNG, Durable otherwise) + $null = Start-CIPPOrchestrator -InputObject $InputObject + $Results = "Deletion of the SharePoint site has been queued. For large sites this may take several minutes. You can continue using the app; the site will be removed in the background." Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Info - $StatusCode = [HttpStatusCode]::OK + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ + Results = $Results + Queued = $true + QueueId = $Queue.RowKey + } + }) } catch { $ErrorMessage = Get-CippException -Exception $_ - $Results = "Failed to delete SharePoint site with ID $SiteId. Error: $($ErrorMessage.NormalizedError)" + $ErrorText = $ErrorMessage.NormalizedError + $Results = "Failed to queue SharePoint site deletion for ID $SiteId. Error: $ErrorText" Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::InternalServerError - } - - # Associate values to output bindings - return ([HttpResponseContext]@{ - StatusCode = $StatusCode + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError Body = @{ 'Results' = $Results } }) + } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-EditSharepointSettings.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-EditSharepointSettings.ps1 new file mode 100644 index 0000000000..69f1fe2f3e --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-EditSharepointSettings.ps1 @@ -0,0 +1,95 @@ +function Invoke-EditSharepointSettings { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Admin.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + + $Results = [System.Collections.Generic.List[string]]::new() + + try { + if ([string]::IsNullOrWhiteSpace($TenantFilter)) { + throw 'Tenant filter is required.' + } + + $PatchBody = @{} + + # Sharing capability (main sharing level) + if ($null -ne $Request.Body.sharingCapability) { + $PatchBody['sharingCapability'] = $Request.Body.sharingCapability + } + + # Domain restriction mode + if ($null -ne $Request.Body.sharingDomainRestrictionMode) { + $PatchBody['sharingDomainRestrictionMode'] = $Request.Body.sharingDomainRestrictionMode + + if ($Request.Body.sharingDomainRestrictionMode -eq 'allowList') { + $PatchBody['sharingAllowedDomainList'] = @($Request.Body.sharingAllowedDomainList) + } elseif ($Request.Body.sharingDomainRestrictionMode -eq 'blockList') { + $PatchBody['sharingBlockedDomainList'] = @($Request.Body.sharingBlockedDomainList) + } + } + + # External resharing + if ($null -ne $Request.Body.isResharingByExternalUsersEnabled) { + $PatchBody['isResharingByExternalUsersEnabled'] = [bool]$Request.Body.isResharingByExternalUsersEnabled + } + + # Default sharing link type + if ($null -ne $Request.Body.defaultSharingLinkType) { + $PatchBody['defaultSharingLinkType'] = $Request.Body.defaultSharingLinkType + } + + # Default link permission + if ($null -ne $Request.Body.defaultLinkPermission) { + $PatchBody['defaultLinkPermission'] = $Request.Body.defaultLinkPermission + } + + # File and folder links (anonymous link settings) + if ($null -ne $Request.Body.fileAnonymousLinkType) { + $PatchBody['fileAnonymousLinkType'] = $Request.Body.fileAnonymousLinkType + } + if ($null -ne $Request.Body.folderAnonymousLinkType) { + $PatchBody['folderAnonymousLinkType'] = $Request.Body.folderAnonymousLinkType + } + + # Anyone link expiration + if ($null -ne $Request.Body.requireAnonymousLinksExpireInDays) { + $PatchBody['requireAnonymousLinksExpireInDays'] = [int]$Request.Body.requireAnonymousLinksExpireInDays + } + + if ($PatchBody.Count -eq 0) { + throw 'No valid settings provided to update.' + } + + $PatchJSON = ConvertTo-Json -Depth 10 -InputObject $PatchBody -Compress + $null = New-GraphPostRequest -tenantid $TenantFilter -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings' -AsApp $true -Type PATCH -Body $PatchJSON -ContentType 'application/json' + + $Results.Add('Successfully updated SharePoint sharing settings.') + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message ($Results -join ' ') -Sev 'Info' + + $Body = [PSCustomObject]@{ + Results = ($Results -join ' ') + } + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to update SharePoint sharing settings: $ErrorMessage" -Sev 'Error' + $Body = [PSCustomObject]@{ + Results = "Failed to update SharePoint sharing settings: $ErrorMessage" + } + $StatusCode = [HttpStatusCode]::BadRequest + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-EditTeamsSettings.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-EditTeamsSettings.ps1 new file mode 100644 index 0000000000..dbe170d58c --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-EditTeamsSettings.ps1 @@ -0,0 +1,235 @@ +function Invoke-EditTeamsSettings { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Teams.Group.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + + $Results = [System.Collections.Generic.List[string]]::new() + + try { + if ([string]::IsNullOrWhiteSpace($TenantFilter)) { + throw 'Tenant filter is required.' + } + + $Section = $Request.Body.section + + switch ($Section) { + 'federation' { + # Establish Teams session first (required before calling New-CsEdgeAllowAllKnownDomains + # which uses the Teams ConfigAPI and requires an active connection) + $null = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsTenantFederationConfiguration' -CmdParams @{ Identity = 'Global' } + + # Now build federation configuration parameters + $FederationMode = $Request.Body.federationMode + $cmdParams = @{ + Identity = 'Global' + AllowFederatedUsers = $true + BlockedDomains = @() + } + $AllowedDomainsAsAList = @() + + switch ($FederationMode) { + 'AllowAllExternal' { + $cmdParams['AllowedDomains'] = New-CsEdgeAllowAllKnownDomains + } + 'BlockAllExternal' { + $cmdParams['AllowFederatedUsers'] = $false + $cmdParams['AllowedDomains'] = New-CsEdgeAllowAllKnownDomains + } + 'AllowSpecificExternal' { + $AllowedDomainsAsAList = @($Request.Body.federationAllowedDomains) + } + 'BlockSpecificExternal' { + $cmdParams['AllowedDomains'] = New-CsEdgeAllowAllKnownDomains + $BlockedDomains = @($Request.Body.federationBlockedDomains) + if ($BlockedDomains.Count -gt 0) { + $cmdParams['BlockedDomains'] = $BlockedDomains + } + } + } + + # Use AllowedDomainsAsAList for specific domain lists, AllowedDomains for the allow-all object + if ($AllowedDomainsAsAList.Count -gt 0) { + $cmdParams.Remove('AllowedDomains') + $cmdParams['AllowedDomainsAsAList'] = $AllowedDomainsAsAList + } + + if ($null -ne $Request.Body.allowTeamsConsumer) { + $cmdParams['AllowTeamsConsumer'] = [bool]$Request.Body.allowTeamsConsumer + } + + New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Set-CsTenantFederationConfiguration' -CmdParams $cmdParams + $Results.Add('Successfully updated federation configuration.') + + # Update External Access Policy + $ExternalParams = @{ Identity = 'Global' } + if ($null -ne $Request.Body.enableFederationAccess) { + $ExternalParams['EnableFederationAccess'] = [bool]$Request.Body.enableFederationAccess + } + if ($null -ne $Request.Body.enableTeamsConsumerAccess) { + $ExternalParams['EnableTeamsConsumerAccess'] = [bool]$Request.Body.enableTeamsConsumerAccess + } + if ($ExternalParams.Count -gt 1) { + New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Set-CsExternalAccessPolicy' -CmdParams $ExternalParams + $Results.Add('Successfully updated external access policy.') + } + } + + 'client' { + # Update Client Configuration (guest access, external file sharing) + $cmdParams = @{ Identity = 'Global' } + + if ($null -ne $Request.Body.allowGuestUser) { + $cmdParams['AllowGuestUser'] = [bool]$Request.Body.allowGuestUser + } + if ($null -ne $Request.Body.allowGoogleDrive) { + $cmdParams['AllowGoogleDrive'] = [bool]$Request.Body.allowGoogleDrive + } + if ($null -ne $Request.Body.allowShareFile) { + $cmdParams['AllowShareFile'] = [bool]$Request.Body.allowShareFile + } + if ($null -ne $Request.Body.allowBox) { + $cmdParams['AllowBox'] = [bool]$Request.Body.allowBox + } + if ($null -ne $Request.Body.allowDropBox) { + $cmdParams['AllowDropBox'] = [bool]$Request.Body.allowDropBox + } + if ($null -ne $Request.Body.allowEgnyte) { + $cmdParams['AllowEgnyte'] = [bool]$Request.Body.allowEgnyte + } + + if ($cmdParams.Count -gt 1) { + New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Set-CsTeamsClientConfiguration' -CmdParams $cmdParams + $Results.Add('Successfully updated client configuration.') + } + } + + 'meeting' { + # Update Global Meeting Policy + $cmdParams = @{ Identity = 'Global' } + + if ($null -ne $Request.Body.allowAnonymousUsersToJoinMeeting) { + $cmdParams['AllowAnonymousUsersToJoinMeeting'] = [bool]$Request.Body.allowAnonymousUsersToJoinMeeting + } + if ($null -ne $Request.Body.allowAnonymousUsersToStartMeeting) { + $cmdParams['AllowAnonymousUsersToStartMeeting'] = [bool]$Request.Body.allowAnonymousUsersToStartMeeting + } + if ($null -ne $Request.Body.autoAdmittedUsers) { + $cmdParams['AutoAdmittedUsers'] = $Request.Body.autoAdmittedUsers + } + if ($null -ne $Request.Body.allowPSTNUsersToBypassLobby) { + $cmdParams['AllowPSTNUsersToBypassLobby'] = [bool]$Request.Body.allowPSTNUsersToBypassLobby + } + if ($null -ne $Request.Body.meetingChatEnabledType) { + $cmdParams['MeetingChatEnabledType'] = $Request.Body.meetingChatEnabledType + } + if ($null -ne $Request.Body.designatedPresenterRoleMode) { + $cmdParams['DesignatedPresenterRoleMode'] = $Request.Body.designatedPresenterRoleMode + } + if ($null -ne $Request.Body.allowExternalParticipantGiveRequestControl) { + $cmdParams['AllowExternalParticipantGiveRequestControl'] = [bool]$Request.Body.allowExternalParticipantGiveRequestControl + } + + if ($cmdParams.Count -gt 1) { + New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Set-CsTeamsMeetingPolicy' -CmdParams $cmdParams + $Results.Add('Successfully updated meeting policy.') + } + } + + 'messaging' { + # Update Global Messaging Policy + $cmdParams = @{ Identity = 'Global' } + + if ($null -ne $Request.Body.allowOwnerDeleteMessage) { + $cmdParams['AllowOwnerDeleteMessage'] = [bool]$Request.Body.allowOwnerDeleteMessage + } + if ($null -ne $Request.Body.allowUserDeleteMessage) { + $cmdParams['AllowUserDeleteMessage'] = [bool]$Request.Body.allowUserDeleteMessage + } + if ($null -ne $Request.Body.allowUserEditMessage) { + $cmdParams['AllowUserEditMessage'] = [bool]$Request.Body.allowUserEditMessage + } + if ($null -ne $Request.Body.allowUserDeleteChat) { + $cmdParams['AllowUserDeleteChat'] = [bool]$Request.Body.allowUserDeleteChat + } + if ($null -ne $Request.Body.readReceiptsEnabledType) { + $cmdParams['ReadReceiptsEnabledType'] = $Request.Body.readReceiptsEnabledType + } + if ($null -ne $Request.Body.createCustomEmojis) { + $cmdParams['CreateCustomEmojis'] = [bool]$Request.Body.createCustomEmojis + } + if ($null -ne $Request.Body.deleteCustomEmojis) { + $cmdParams['DeleteCustomEmojis'] = [bool]$Request.Body.deleteCustomEmojis + } + if ($null -ne $Request.Body.allowSecurityEndUserReporting) { + $cmdParams['AllowSecurityEndUserReporting'] = [bool]$Request.Body.allowSecurityEndUserReporting + } + if ($null -ne $Request.Body.allowCommunicationComplianceEndUserReporting) { + $cmdParams['AllowCommunicationComplianceEndUserReporting'] = [bool]$Request.Body.allowCommunicationComplianceEndUserReporting + } + + if ($cmdParams.Count -gt 1) { + New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Set-CsTeamsMessagingPolicy' -CmdParams $cmdParams + $Results.Add('Successfully updated messaging policy.') + } + } + + 'backgrounds' { + # Update Meeting Branding Policy (background images toggle) + if ($null -ne $Request.Body.enableMeetingBackgroundImages) { + $cmdParams = @{ + Identity = 'Global' + EnableMeetingBackgroundImages = [bool]$Request.Body.enableMeetingBackgroundImages + } + New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Set-CsTeamsMeetingBrandingPolicy' -CmdParams $cmdParams + $Results.Add('Successfully updated meeting background settings.') + } + + # Assign branding policy to a specific user + if ($Request.Body.assignUser -and $Request.Body.policyName) { + $grantParams = @{ + Identity = $Request.Body.assignUser + PolicyName = $Request.Body.policyName + } + New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Grant-CsTeamsMeetingBrandingPolicy' -CmdParams $grantParams + $Results.Add("Successfully assigned branding policy '$($Request.Body.policyName)' to user '$($Request.Body.assignUser)'.") + } + } + + default { + throw "Invalid section: $Section. Valid values are: federation, client, meeting, messaging, backgrounds." + } + } + + if ($Results.Count -eq 0) { + throw 'No valid settings were provided to update.' + } + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message ($Results -join ' ') -Sev 'Info' + + $Body = [PSCustomObject]@{ + Results = ($Results -join ' ') + } + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to update Teams settings: $ErrorMessage" -Sev 'Error' + $Body = [PSCustomObject]@{ + Results = "Failed to update Teams settings: $ErrorMessage" + } + $StatusCode = [HttpStatusCode]::BadRequest + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecBulkRemoveSharingLinks.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecBulkRemoveSharingLinks.ps1 index ccdf6a0440..2754b2ac80 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecBulkRemoveSharingLinks.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecBulkRemoveSharingLinks.ps1 @@ -26,11 +26,14 @@ function Invoke-ExecBulkRemoveSharingLinks { 'All' = @('Anonymous', 'External', 'Internal') } + if (-not $SiteUrl) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'SiteUrl is required.' } }) + } + if (-not $ScopeClassifications.ContainsKey([string]$Scope)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = "Invalid scope '$Scope'. Valid values: $($ScopeClassifications.Keys -join ', ')." } }) + } + try { - if (-not $SiteUrl) { throw 'SiteUrl is required.' } - if (-not $ScopeClassifications.ContainsKey([string]$Scope)) { - throw "Invalid scope '$Scope'. Valid values: $($ScopeClassifications.Keys -join ', ')." - } $Classifications = $ScopeClassifications[[string]$Scope] try { @@ -95,12 +98,12 @@ function Invoke-ExecBulkRemoveSharingLinks { throw $Results } Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Info - $StatusCode = [HttpStatusCode]::OK + $StatusCode = Get-CippBulkStatusCode -Total $Targets.Count -Failed $Failed.Count } catch { $ErrorMessage = Get-CippException -Exception $_ $Results = "Failed to bulk revoke sharing links on $($SiteUrl): $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecCreateSharingLink.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecCreateSharingLink.ps1 new file mode 100644 index 0000000000..6eb847b018 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecCreateSharingLink.ps1 @@ -0,0 +1,116 @@ +function Invoke-ExecCreateSharingLink { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + + $DriveId = $Request.Body.driveId + $ItemId = $Request.Body.itemId + $LinkType = $Request.Body.linkType + $LinkScope = $Request.Body.linkScope + $Recipients = $Request.Body.recipients + $ExpirationDateTime = $Request.Body.expirationDateTime + $Password = $Request.Body.password + + if (-not $TenantFilter -or -not $DriveId -or -not $ItemId) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'tenantFilter, driveId, and itemId are required.' } + }) + } + + if (-not $LinkType) { $LinkType = 'view' } + if (-not $LinkScope) { $LinkScope = 'organization' } + + try { + $LinkBody = @{ + type = $LinkType + scope = $LinkScope + } + + if ($ExpirationDateTime) { + $LinkBody['expirationDateTime'] = $ExpirationDateTime + } + + if ($Password) { + $LinkBody['password'] = $Password + } + + if ($LinkScope -eq 'users' -and $Recipients) { + $RecipientList = @($Recipients | ForEach-Object { + if ($_ -is [string]) { + @{ email = $_ } + } else { + @{ email = $_.email ?? $_.value ?? $_ } + } + }) + $LinkBody['recipients'] = $RecipientList + } + + $LinkBodyJson = ConvertTo-Json -InputObject $LinkBody -Depth 10 -Compress + $Uri = "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$ItemId/createLink" + + $Result = New-GraphPostRequest -uri $Uri -tenantid $TenantFilter -type POST -body $LinkBodyJson -AsApp $true + + $ScopeLabel = switch ($LinkScope) { + 'anonymous' { 'Anyone with the link' } + 'organization' { 'People in the organization' } + 'users' { 'Specific people' } + default { $LinkScope } + } + $TypeLabel = switch ($LinkType) { + 'view' { 'View' } + 'edit' { 'Edit' } + 'embed' { 'Embed' } + default { $LinkType } + } + + $LinkUrl = $Result.link.webUrl + $Message = "Created $TypeLabel sharing link ($ScopeLabel)" + if ($ExpirationDateTime) { + $Message += " expiring $ExpirationDateTime" + } + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev 'Info' + + $StatusCode = [HttpStatusCode]::OK + $Body = @{ + Results = $Message + Link = @{ + webUrl = $LinkUrl + type = $LinkType + scope = $LinkScope + id = $Result.id + expiration = $Result.expirationDateTime + } + } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $NormError = [string]$ErrorMessage.NormalizedError + + if ($NormError -match 'accessDenied' -or $NormError -match '403') { + $ErrorText = "Failed to create sharing link: Access denied. Ensure CIPP has Sites.ReadWrite.All or Sites.Manage.All application permission and CPV has been refreshed." + } elseif ($NormError -match 'invalidRequest' -or $NormError -match 'notAllowed') { + $ErrorText = "Failed to create sharing link: The requested sharing type is not allowed. Check the site and tenant sharing policies." + } else { + $ErrorText = "Failed to create sharing link: $NormError" + } + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ErrorText -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::BadRequest + $Body = @{ Results = $ErrorText } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecEmptySiteRecycleBin.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecEmptySiteRecycleBin.ps1 index 55d9a6140b..f0b890e37b 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecEmptySiteRecycleBin.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecEmptySiteRecycleBin.ps1 @@ -7,6 +7,8 @@ function Invoke-ExecEmptySiteRecycleBin { .DESCRIPTION Permanently empty a site recycle bin (first stage, second stage, or both). Item ids are used only server-side; the response never includes file names. + After bulk deletion, verifies by re-reading the bin and falls back to batched + DeleteByIds when items remain. Returns accurate counts and bytes freed. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -17,113 +19,301 @@ function Invoke-ExecEmptySiteRecycleBin { $SiteUrl = $Request.Body.SiteUrl $Stage = [string]($Request.Body.Stage ?? 'Both') - try { - if ([string]::IsNullOrWhiteSpace($TenantFilter)) { throw 'tenantFilter is required.' } - if ([string]::IsNullOrWhiteSpace($SiteUrl)) { throw 'SiteUrl is required.' } - if ($Stage -notin @('First', 'Second', 'Both')) { - return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest - Body = @{ Results = "Invalid Stage '$Stage'. Valid values: First, Second, Both." } - }) - } + if ([string]::IsNullOrWhiteSpace($TenantFilter)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ Results = 'tenantFilter is required.' } }) + } + if ([string]::IsNullOrWhiteSpace($SiteUrl)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ Results = 'SiteUrl is required.' } }) + } + if ($Stage -notin @('First', 'Second', 'Both')) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Invalid Stage '$Stage'. Valid values: First, Second, Both." } + }) + } + try { $RestContext = Resolve-CIPPSharePointRestContext -TenantFilter $TenantFilter -SiteUrl $SiteUrl $Scope = $RestContext.Scope $JsonAccept = $RestContext.Headers $BaseUri = $RestContext.BaseUri - $DeletedCount = 0 $Errors = [System.Collections.Generic.List[string]]::new() - function Invoke-CIPPRecycleDeleteAll { - param([string]$Uri) - $null = New-GraphPostRequest -uri $Uri -tenantid $TenantFilter -scope $Scope -type POST -body '{}' -contentType 'application/json;odata=nometadata' -AddedHeaders $JsonAccept -UseCertificate -AsApp $true - } - - function Invoke-CIPPRecycleDeleteByIdsBatch { + function Get-CIPPRecycleBinSnapshot { param( [ValidateSet('First', 'Second')] [string]$TargetStage ) $StateFilter = if ($TargetStage -eq 'Second') { 2 } else { 1 } - $BatchDeleted = 0 - $NextUri = "$BaseUri/site/RecycleBin?`$select=Id,ItemState&`$top=100&`$orderby=DeletedDate desc" + $Count = 0 + $Bytes = [int64]0 + $Items = @() + $Skip = 0 + $PageSize = 500 $Guard = 0 - while ($NextUri -and $Guard -lt 200) { + while ($Guard -lt 100) { $Guard++ - $Page = New-GraphGetRequest -uri $NextUri -tenantid $TenantFilter -scope $Scope -extraHeaders $JsonAccept -UseCertificate -AsApp $true -noPagination $true -SkipValueExtraction - $Items = @($Page.value) - $NextLink = $Page.'@odata.nextLink' - $Ids = @( - foreach ($Item in $Items) { - $State = 0 - try { $State = [int]$Item.ItemState } catch { $State = 0 } - if ($State -eq $StateFilter -and $Item.Id) { [string]$Item.Id } + $Uri = "$BaseUri/site/RecycleBin?`$select=Id,Size,ItemState&`$top=$PageSize&`$skip=$Skip&`$orderby=DeletedDate desc" + $Page = New-GraphGetRequest -uri $Uri -tenantid $TenantFilter -scope $Scope -extraHeaders $JsonAccept -UseCertificate -AsApp $true -noPagination $true -SkipValueExtraction + $PageItems = @($Page.value) + if ($PageItems.Count -eq 0) { break } + + foreach ($Item in $PageItems) { + $State = 0 + try { $State = [int]$Item.ItemState } catch { $State = 0 } + if ($State -eq $StateFilter) { + $Count++ + $Size = 0 + try { $Size = [int64][double]$Item.Size } catch { $Size = 0 } + $Bytes += $Size + $Items += $Item } - ) - if ($Ids.Count -eq 0) { - if ([string]::IsNullOrWhiteSpace($NextLink)) { break } - $NextUri = $NextLink - continue - } - for ($i = 0; $i -lt $Ids.Count; $i += 25) { - $Chunk = @($Ids[$i..([Math]::Min($i + 24, $Ids.Count - 1))]) - $DeleteBody = ConvertTo-Json -Compress -Depth 5 -InputObject @{ ids = @($Chunk) } - $null = New-GraphPostRequest -uri "$BaseUri/site/RecycleBin/DeleteByIds" -tenantid $TenantFilter -scope $Scope -type POST -body $DeleteBody -contentType 'application/json;odata=nometadata' -AddedHeaders $JsonAccept -UseCertificate -AsApp $true - $BatchDeleted += $Chunk.Count } - # After deletes, restart from the first page so we do not skip items when the list shifts. - $NextUri = "$BaseUri/site/RecycleBin?`$select=Id,ItemState&`$top=100&`$orderby=DeletedDate desc" + + $Skip += $PageSize + if ($PageItems.Count -lt $PageSize) { break } + } + return @{ + Count = $Count + Bytes = $Bytes + Items = $Items } - return $BatchDeleted } - if ($Stage -in @('First', 'Both')) { + function Invoke-CIPPRecycleDeleteAll { + param([string]$Uri) try { - Invoke-CIPPRecycleDeleteAll -Uri "$BaseUri/web/RecycleBin/deleteAll()" - $DeletedCount += 1 # deleteAll does not return a count; mark attempt + $null = New-GraphPostRequest -uri $Uri -tenantid $TenantFilter -scope $Scope -type POST -body '{}' -contentType 'application/json;odata=nometadata' -AddedHeaders $JsonAccept -UseCertificate -AsApp $true + return $true } catch { + return $false + } + } + + function Invoke-CIPPRecycleDeleteByIdsBatch { + param( + [array]$Items, + [string]$StageName + ) + $DeletedCount = 0 + $Ids = @($Items | ForEach-Object { [string]$_.Id } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }) + if ($Ids.Count -eq 0) { return 0 } + + for ($i = 0; $i -lt $Ids.Count; $i += 25) { + $Chunk = @($Ids[$i..([Math]::Min($i + 24, $Ids.Count - 1))]) + $DeleteBody = ConvertTo-Json -Compress -Depth 5 -InputObject @{ ids = @($Chunk) } + + $RetryCount = 0 + $MaxRetries = 5 + $Success = $false + + while (-not $Success -and $RetryCount -lt $MaxRetries) { + try { + $null = New-GraphPostRequest -uri "$BaseUri/site/RecycleBin/DeleteByIds" -tenantid $TenantFilter -scope $Scope -type POST -body $DeleteBody -contentType 'application/json;odata=nometadata' -AddedHeaders $JsonAccept -UseCertificate -AsApp $true + $DeletedCount += $Chunk.Count + $Success = $true + } catch { + $StatusCode = $_.Exception.Response.StatusCode.value__ + if ($StatusCode -in @(429, 503)) { + $RetryAfter = 5 + $RetryAfterHeader = $_.Exception.Response.Headers | Where-Object { $_.Key -eq 'Retry-After' } | Select-Object -First 1 + if ($RetryAfterHeader) { + try { $RetryAfter = [int]$RetryAfterHeader.Value[0] } catch { $RetryAfter = 5 } + } + Start-Sleep -Seconds ([Math]::Min($RetryAfter, 60)) + $RetryCount++ + } else { + throw + } + } + } + + if (-not $Success) { + throw "Failed to delete batch after $MaxRetries retries (throttled)" + } + } + return $DeletedCount + } + + function Invoke-CIPPEmptyStage { + param( + [ValidateSet('First', 'Second')] + [string]$TargetStage + ) + + $Before = Get-CIPPRecycleBinSnapshot -TargetStage $TargetStage + $BeforeCount = $Before.Count + $BeforeBytes = $Before.Bytes + + if ($BeforeCount -eq 0) { + return @{ + Success = $true + BeforeCount = 0 + BeforeBytes = 0 + DeletedCount = 0 + BytesFreed = 0 + RemainingCount = 0 + RemainingBytes = 0 + Error = $null + } + } + + $BulkUris = if ($TargetStage -eq 'Second') { + @( + "$BaseUri/site/RecycleBin/deleteAllSecondStageItems", + "$BaseUri/site/RecycleBin/deleteAll()" + ) + } else { + @( + "$BaseUri/web/RecycleBin/deleteAll()", + "$BaseUri/site/RecycleBin/deleteAll()" + ) + } + + $BulkSuccess = $false + foreach ($Uri in $BulkUris) { + if (Invoke-CIPPRecycleDeleteAll -Uri $Uri) { + Start-Sleep -Seconds 2 + $BulkSuccess = $true + break + } + } + + if (-not $BulkSuccess) { try { - $DeletedCount += Invoke-CIPPRecycleDeleteByIdsBatch -TargetStage First + $BatchDeleted = Invoke-CIPPRecycleDeleteByIdsBatch -Items $Before.Items -StageName $TargetStage } catch { - $Errors.Add("First stage: $($_.Exception.Message)") + return @{ + Success = $false + BeforeCount = $BeforeCount + BeforeBytes = $BeforeBytes + DeletedCount = 0 + BytesFreed = 0 + RemainingCount = $BeforeCount + RemainingBytes = $BeforeBytes + Error = $_.Exception.Message + } } } - } - if ($Stage -in @('Second', 'Both')) { - try { - Invoke-CIPPRecycleDeleteAll -Uri "$BaseUri/site/RecycleBin/deleteAllSecondStageItems" - $DeletedCount += 1 - } catch { + Start-Sleep -Seconds 2 + $After = Get-CIPPRecycleBinSnapshot -TargetStage $TargetStage + $RemainingCount = $After.Count + $RemainingBytes = $After.Bytes + $DeletedCount = $BeforeCount - $RemainingCount + $BytesFreed = $BeforeBytes - $RemainingBytes + + if ($RemainingCount -gt 0 -and $DeletedCount -eq 0) { try { - Invoke-CIPPRecycleDeleteAll -Uri "$BaseUri/site/RecycleBin/deleteAll()" - $DeletedCount += 1 + $BatchDeleted = Invoke-CIPPRecycleDeleteByIdsBatch -Items $After.Items -StageName $TargetStage + Start-Sleep -Seconds 2 + $AfterBatch = Get-CIPPRecycleBinSnapshot -TargetStage $TargetStage + $RemainingCount = $AfterBatch.Count + $RemainingBytes = $AfterBatch.Bytes + $DeletedCount = $BeforeCount - $RemainingCount + $BytesFreed = $BeforeBytes - $RemainingBytes } catch { - try { - $DeletedCount += Invoke-CIPPRecycleDeleteByIdsBatch -TargetStage Second - } catch { - $Errors.Add("Second stage: $($_.Exception.Message)") + return @{ + Success = $false + BeforeCount = $BeforeCount + BeforeBytes = $BeforeBytes + DeletedCount = $DeletedCount + BytesFreed = $BytesFreed + RemainingCount = $RemainingCount + RemainingBytes = $RemainingBytes + Error = $_.Exception.Message } } } + + return @{ + Success = $RemainingCount -eq 0 + BeforeCount = $BeforeCount + BeforeBytes = $BeforeBytes + DeletedCount = $DeletedCount + BytesFreed = $BytesFreed + RemainingCount = $RemainingCount + RemainingBytes = $RemainingBytes + Error = if ($RemainingCount -gt 0) { "Items remain after deletion (may be held by retention policy or legal hold)" } else { $null } + } + } + + $FirstResult = $null + $SecondResult = $null + + if ($Stage -in @('First', 'Both')) { + $FirstResult = Invoke-CIPPEmptyStage -TargetStage First + if ($FirstResult.Error) { + $Errors.Add("First stage: $($FirstResult.Error)") + } + } + + if ($Stage -in @('Second', 'Both')) { + $SecondResult = Invoke-CIPPEmptyStage -TargetStage Second + if ($SecondResult.Error) { + $Errors.Add("Second stage: $($SecondResult.Error)") + } } - if ($Errors.Count -gt 0 -and $DeletedCount -eq 0) { - throw ($Errors -join '; ') + $TotalBefore = ($FirstResult?.BeforeCount ?? 0) + ($SecondResult?.BeforeCount ?? 0) + $TotalDeleted = ($FirstResult?.DeletedCount ?? 0) + ($SecondResult?.DeletedCount ?? 0) + $TotalRemaining = ($FirstResult?.RemainingCount ?? 0) + ($SecondResult?.RemainingCount ?? 0) + $TotalBytesFreed = ($FirstResult?.BytesFreed ?? 0) + ($SecondResult?.BytesFreed ?? 0) + + $Body = @{ + Results = if ($TotalRemaining -eq 0) { + "Successfully emptied recycle bin ($Stage) for $SiteUrl. Deleted $TotalDeleted items, freed $([Math]::Round($TotalBytesFreed / 1MB, 2)) MB." + } elseif ($TotalDeleted -gt 0) { + "Partially emptied recycle bin ($Stage) for $SiteUrl. Deleted $TotalDeleted of $TotalBefore items, $TotalRemaining items remain (may be held by retention policy or legal hold)." + } else { + "Failed to empty recycle bin ($Stage) for $SiteUrl. $TotalRemaining items could not be deleted (may be held by retention policy or legal hold)." + } + itemsBefore = $TotalBefore + itemsDeleted = $TotalDeleted + itemsRemaining = $TotalRemaining + bytesFreed = $TotalBytesFreed + firstStage = if ($FirstResult) { + @{ + beforeCount = $FirstResult.BeforeCount + beforeBytes = $FirstResult.BeforeBytes + deletedCount = $FirstResult.DeletedCount + bytesFreed = $FirstResult.BytesFreed + remainingCount = $FirstResult.RemainingCount + remainingBytes = $FirstResult.RemainingBytes + } + } else { $null } + secondStage = if ($SecondResult) { + @{ + beforeCount = $SecondResult.BeforeCount + beforeBytes = $SecondResult.BeforeBytes + deletedCount = $SecondResult.DeletedCount + bytesFreed = $SecondResult.BytesFreed + remainingCount = $SecondResult.RemainingCount + remainingBytes = $SecondResult.RemainingBytes + } + } else { $null } } - $Results = "Emptied recycle bin ($Stage) for $SiteUrl." if ($Errors.Count -gt 0) { - $Results += " Partial warnings: $($Errors -join '; ')" + $Body.Results += " Errors: $($Errors -join '; ')" } - Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Info - $StatusCode = [HttpStatusCode]::OK - $Body = @{ Results = $Results; deletedAttempts = $DeletedCount } + + $LogSev = if ($TotalRemaining -eq 0) { 'Info' } elseif ($TotalDeleted -gt 0) { 'Warn' } else { 'Error' } + Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Body.Results -sev $LogSev + + $StatusCode = if ($TotalRemaining -eq 0) { + [HttpStatusCode]::OK + } elseif ($TotalDeleted -gt 0) { + [HttpStatusCode]::OK + } else { + Get-CippBulkStatusCode -Total 1 -Failed 1 + } + } catch { $ErrorMessage = Get-CippException -Exception $_ $Results = "Failed to empty recycle bin on $($SiteUrl): $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError $Body = @{ Results = $Results } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecHubSiteAssociation.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecHubSiteAssociation.ps1 new file mode 100644 index 0000000000..44435470eb --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecHubSiteAssociation.ps1 @@ -0,0 +1,82 @@ +function Invoke-ExecHubSiteAssociation { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + $SiteUrl = $Request.Body.SiteUrl + $DisplayName = $Request.Body.DisplayName + $RawDisconnect = $Request.Body.Disconnect + $RawHubId = $Request.Body.HubSiteId + # autoComplete fields may arrive as { label, value } + $HubSiteId = if ($RawHubId -is [PSCustomObject] -and $null -ne $RawHubId.value) { $RawHubId.value } else { $RawHubId } + $SiteLabel = if ($DisplayName) { $DisplayName } else { $SiteUrl } + + try { + # Strict boolean parse — MUI radios submit strings, and [bool]"false" is $true in PowerShell. + $Disconnect = $false + if ($RawDisconnect -is [bool]) { + $Disconnect = $RawDisconnect + } elseif ($null -ne $RawDisconnect -and '' -ne $RawDisconnect) { + if (-not [bool]::TryParse([string]$RawDisconnect, [ref]$Disconnect)) { + throw "Disconnect must be true or false (received '$RawDisconnect')" + } + } + + if (-not $TenantFilter) { throw 'tenantFilter is required' } + if (-not $SiteUrl) { throw 'SiteUrl is required' } + if (-not $Disconnect -and -not $HubSiteId) { throw 'Provide HubSiteId to join a hub, or Disconnect: true to leave' } + + if (-not $Disconnect) { + $ParsedHubId = [guid]::Empty + if (-not [guid]::TryParse([string]$HubSiteId, [ref]$ParsedHubId)) { + throw "HubSiteId '$HubSiteId' is not a valid GUID" + } + $HubSiteId = $ParsedHubId.Guid + } + + $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter + $TargetHubId = if ($Disconnect) { '00000000-0000-0000-0000-000000000000' } else { $HubSiteId } + + # Site-level REST: delegated only (no -AsApp) + $null = New-GraphPOSTRequest ` + -scope "$($SharePointInfo.SharePointUrl)/.default" ` + -uri "$SiteUrl/_api/site/JoinHubSite('$TargetHubId')" ` + -body '{}' ` + -tenantid $TenantFilter ` + -type POST ` + -AddedHeaders @{ 'accept' = 'application/json' } + + $Results = if ($Disconnect) { + "Successfully disconnected '$SiteLabel' from its hub site." + } else { + "Successfully connected '$SiteLabel' to the selected hub site." + } + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Info + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ Results = $Results } + }) + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $ErrorText = $ErrorMessage.NormalizedError + if ($ErrorText -match 'approval|permission to join') { + $ErrorText = "This hub requires approval to join, or the connecting account lacks join permission on the hub. Original error: $ErrorText" + } + $Results = "Failed to update hub association for '$SiteLabel'. Error: $ErrorText" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = @{ Results = $Results } + }) + } +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecNotifySiteOwner.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecNotifySiteOwner.ps1 new file mode 100644 index 0000000000..ec71ff6924 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecNotifySiteOwner.ps1 @@ -0,0 +1,90 @@ +function Invoke-ExecNotifySiteOwner { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + $DisplayName = $Request.Body.DisplayName + $SiteUrl = $Request.Body.SiteUrl + $OwnerEmail = $Request.Body.OwnerEmail + $Type = $Request.Body.Type + $CustomMessage = $Request.Body.CustomMessage + $UsedGB = $Request.Body.StorageUsedGB + $AllocatedGB = $Request.Body.StorageAllocatedGB + + try { + if (-not $TenantFilter) { throw 'tenantFilter is required' } + if (-not $OwnerEmail) { throw 'OwnerEmail is required — this site has no resolvable owner email' } + if ($OwnerEmail -notmatch '^[^\s@]+@[^\s@]+\.[^\s@]+$') { throw "OwnerEmail '$OwnerEmail' does not look like a valid email address" } + if ($Type -eq 'Custom' -and -not $CustomMessage) { throw 'CustomMessage is required when Type is Custom' } + if ($SiteUrl -and $SiteUrl -notmatch '^https://') { throw 'SiteUrl must be an https URL' } + + # CustomMessage is treated as plaintext: HTML-encode, then preserve line breaks + $SafeCustomMessage = if ($CustomMessage) { + ([System.Net.WebUtility]::HtmlEncode([string]$CustomMessage)) -replace "\r?\n", '
' + } else { '' } + + $SiteLabel = if ($DisplayName) { $DisplayName } else { $SiteUrl } + $SafeSiteLabel = [System.Net.WebUtility]::HtmlEncode([string]$SiteLabel) + $SafeSiteUrl = [System.Net.WebUtility]::HtmlEncode([string]$SiteUrl) + $StorageLine = if ($UsedGB -and $AllocatedGB) { + $Pct = [math]::Round(([double]$UsedGB / [double]$AllocatedGB) * 100) + "

Current usage: $UsedGB GB of $AllocatedGB GB allocated ($Pct%).

" + } else { '' } + + $Subject, $BodyHtml = switch ($Type) { + 'StorageCritical' { + "Action needed: SharePoint site '$SiteLabel' is running out of storage", + "

Hello,

You are listed as the owner of the SharePoint site $SafeSiteLabel, which is approaching its storage limit.

$StorageLine

Please review the site's content and delete or archive files that are no longer needed. Old file versions and large media files are common culprits. If the site genuinely needs more space, reply to this email to request a storage increase.

Thank you,
Your IT team

" + } + 'Inactivity' { + "Is the SharePoint site '$SiteLabel' still needed?", + "

Hello,

You are listed as the owner of the SharePoint site $SafeSiteLabel, which has had no activity for more than 90 days.

If the site is no longer needed, please let us know so it can be archived or removed. If it is still in use, no action is required.

Thank you,
Your IT team

" + } + 'Custom' { + "A message about your SharePoint site '$SiteLabel'", + "

Hello,

You are listed as the owner of the SharePoint site $SafeSiteLabel.

$SafeCustomMessage

$StorageLine

Thank you,
Your IT team

" + } + default { throw "Invalid Type '$Type'. Valid values: StorageCritical, Inactivity, Custom" } + } + + $MailBody = [pscustomobject]@{ + message = @{ + subject = $Subject + body = @{ contentType = 'HTML'; content = $BodyHtml } + toRecipients = @(@{ emailAddress = @{ address = $OwnerEmail } }) + } + saveToSentItems = 'false' + } + $JSONBody = ConvertTo-Json -Compress -Depth 10 -InputObject $MailBody + $null = New-GraphPostRequest -uri 'https://graph.microsoft.com/v1.0/me/sendMail' -tenantid $env:TenantID -NoAuthCheck $true -type POST -body $JSONBody + + $Results = "Notification email ($Type) sent to $OwnerEmail for site '$SiteLabel'." + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Info + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ Results = $Results } + }) + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $ErrorText = $ErrorMessage.NormalizedError + if ($ErrorText -match 'MailboxNotEnabledForRESTAPI|mailbox') { + $ErrorText = "The CIPP service account does not have a usable mailbox to send from. Original error: $ErrorText" + } + $Results = "Failed to send owner notification. Error: $ErrorText" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = @{ Results = $Results } + }) + } +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecOneDriveCompare.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecOneDriveCompare.ps1 new file mode 100644 index 0000000000..00f4775968 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecOneDriveCompare.ps1 @@ -0,0 +1,227 @@ +function Invoke-ExecOneDriveCompare { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $TenantFilter = $Request.Body.TenantFilter + if (-not $TenantFilter) { $TenantFilter = $Request.Query.TenantFilter } + + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'TenantFilter is required' } + }) + } + + $SourceDriveId = $Request.Body.SourceDriveId + $SourceUserId = $Request.Body.SourceUserId + $SourceSiteId = $Request.Body.SourceSiteId + $SourceFolderId = $Request.Body.SourceFolderId + + $DestDriveId = $Request.Body.DestDriveId + $DestUserId = $Request.Body.DestUserId + $DestSiteId = $Request.Body.DestSiteId + $DestFolderId = $Request.Body.DestFolderId + + $MaxDepth = $Request.Body.MaxDepth + if (-not $MaxDepth) { $MaxDepth = 10 } + + try { + # Resolve source drive + if (-not $SourceDriveId) { + if ($SourceUserId) { + $SrcDrive = New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/users/$SourceUserId/drive?`$select=id" ` + -tenantid $TenantFilter + $SourceDriveId = $SrcDrive.id + } elseif ($SourceSiteId) { + $SrcDrives = New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/sites/$SourceSiteId/drives" ` + -tenantid $TenantFilter + $SourceDriveId = ($SrcDrives | Where-Object { $_.driveType -eq 'documentLibrary' } | Select-Object -First 1).id + if (-not $SourceDriveId) { $SourceDriveId = $SrcDrives[0].id } + } + } + if (-not $SourceDriveId) { + throw 'Source drive could not be resolved. Provide SourceDriveId, SourceUserId, or SourceSiteId.' + } + + # Resolve destination drive + if (-not $DestDriveId) { + if ($DestUserId) { + $DstDrive = New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/users/$DestUserId/drive?`$select=id" ` + -tenantid $TenantFilter + $DestDriveId = $DstDrive.id + } elseif ($DestSiteId) { + $DstDrives = New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/sites/$DestSiteId/drives" ` + -tenantid $TenantFilter + $DestDriveId = ($DstDrives | Where-Object { $_.driveType -eq 'documentLibrary' } | Select-Object -First 1).id + if (-not $DestDriveId) { $DestDriveId = $DstDrives[0].id } + } + } + if (-not $DestDriveId) { + throw 'Destination drive could not be resolved. Provide DestDriveId, DestUserId, or DestSiteId.' + } + + # Resolve source root if no folder specified + if (-not $SourceFolderId) { + $SrcRoot = New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$SourceDriveId/root?`$select=id" ` + -tenantid $TenantFilter + $SourceFolderId = $SrcRoot.id + } + if (-not $DestFolderId) { + $DstRoot = New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DestDriveId/root?`$select=id" ` + -tenantid $TenantFilter + $DestFolderId = $DstRoot.id + } + + $DiffEntries = [System.Collections.Generic.List[object]]::new() + $Counters = @{ match = 0 } + + function Get-FolderDiff { + param( + [string]$SrcDrive, + [string]$SrcFolder, + [string]$DstDrive, + [string]$DstFolder, + [string]$Tenant, + [string]$PathPrefix, + [int]$CurrentDepth, + [int]$MaxDepth + ) + + if ($CurrentDepth -ge $MaxDepth) { return } + + try { + $SrcItems = @(New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$SrcDrive/items/$SrcFolder/children?`$select=id,name,size,folder,lastModifiedDateTime&`$top=200" ` + -tenantid $Tenant -noPagination $true) + } catch { $SrcItems = @() } + + try { + $DstItems = @(New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DstDrive/items/$DstFolder/children?`$select=id,name,size,folder,lastModifiedDateTime&`$top=200" ` + -tenantid $Tenant -noPagination $true) + } catch { $DstItems = @() } + + $SrcLookup = @{} + foreach ($s in $SrcItems) { $SrcLookup[$s.name] = $s } + + $DstLookup = @{} + foreach ($d in $DstItems) { $DstLookup[$d.name] = $d } + + $AllNames = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::Ordinal) + foreach ($s in $SrcItems) { $null = $AllNames.Add($s.name) } + foreach ($d in $DstItems) { $null = $AllNames.Add($d.name) } + + foreach ($ItemName in ($AllNames | Sort-Object)) { + $Src = $SrcLookup[$ItemName] + $Dst = $DstLookup[$ItemName] + $ItemPath = if ($PathPrefix) { "$PathPrefix/$ItemName" } else { $ItemName } + $SrcIsFolder = ($null -ne $Src) -and ($null -ne $Src.folder) + $DstIsFolder = ($null -ne $Dst) -and ($null -ne $Dst.folder) + + if ($Src -and -not $Dst) { + $DiffEntries.Add([PSCustomObject]@{ + path = $ItemPath + name = $ItemName + type = if ($SrcIsFolder) { 'folder' } else { 'file' } + status = 'source_only' + sourceId = $Src.id + sourceSize = [long]($Src.size ?? 0) + sourceModified = $Src.lastModifiedDateTime + destId = $null + destSize = $null + destModified = $null + sourceDriveId = $SrcDrive + destDriveId = $DstDrive + destParentId = $DstFolder + }) + } elseif ($Dst -and -not $Src) { + $DiffEntries.Add([PSCustomObject]@{ + path = $ItemPath + name = $ItemName + type = if ($DstIsFolder) { 'folder' } else { 'file' } + status = 'dest_only' + sourceId = $null + sourceSize = $null + sourceModified = $null + destId = $Dst.id + destSize = [long]($Dst.size ?? 0) + destModified = $Dst.lastModifiedDateTime + sourceDriveId = $SrcDrive + destDriveId = $DstDrive + sourceParentId = $SrcFolder + }) + } elseif ($SrcIsFolder -and $DstIsFolder) { + Get-FolderDiff ` + -SrcDrive $SrcDrive -SrcFolder $Src.id ` + -DstDrive $DstDrive -DstFolder $Dst.id ` + -Tenant $Tenant -PathPrefix $ItemPath ` + -CurrentDepth ($CurrentDepth + 1) -MaxDepth $MaxDepth + } elseif (-not $SrcIsFolder -and -not $DstIsFolder) { + $SrcSize = [long]($Src.size ?? 0) + $DstSize = [long]($Dst.size ?? 0) + $SrcMod = $Src.lastModifiedDateTime + $DstMod = $Dst.lastModifiedDateTime + $SizeDiffers = $SrcSize -ne $DstSize + $DateDiffers = $SrcMod -and $DstMod -and ($SrcMod -ne $DstMod) + + if ($SizeDiffers -or $DateDiffers) { + $EntryStatus = if ($SizeDiffers) { 'size_differs' } else { 'modified_differs' } + $DiffEntries.Add([PSCustomObject]@{ + path = $ItemPath + name = $ItemName + type = 'file' + status = $EntryStatus + sourceId = $Src.id + sourceSize = $SrcSize + sourceModified = $SrcMod + destId = $Dst.id + destSize = $DstSize + destModified = $DstMod + sourceDriveId = $SrcDrive + destDriveId = $DstDrive + }) + } else { + $Counters.match++ + } + } + } + } + + Get-FolderDiff ` + -SrcDrive $SourceDriveId -SrcFolder $SourceFolderId ` + -DstDrive $DestDriveId -DstFolder $DestFolderId ` + -Tenant $TenantFilter -PathPrefix '' ` + -CurrentDepth 0 -MaxDepth $MaxDepth + + $Body = @{ + Results = @($DiffEntries) + SourceDriveId = $SourceDriveId + DestDriveId = $DestDriveId + SourceFolderId = $SourceFolderId + DestFolderId = $DestFolderId + MatchCount = $Counters.match + } + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + $Body = @{ Results = "Comparison failed: $ErrorMessage" } + $StatusCode = [HttpStatusCode]::InternalServerError + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecOneDriveFileAction.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecOneDriveFileAction.ps1 new file mode 100644 index 0000000000..fc086f49df --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecOneDriveFileAction.ps1 @@ -0,0 +1,772 @@ +function Compare-CrossDriveFolders { + param( + [string]$SrcDriveId, + [string]$SrcFolderId, + [string]$DestDriveId, + [string]$DestFolderId, + [string]$TenantFilter, + [int]$Depth = 0 + ) + + if ($Depth -ge 10) { return $true } + + try { + $SrcChildren = @(New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$SrcDriveId/items/$SrcFolderId/children?`$select=id,name,folder&`$top=200" ` + -tenantid $TenantFilter -noPagination $true) + } catch { return $true } + + try { + $DestChildren = @(New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DestDriveId/items/$DestFolderId/children?`$select=id,name,folder&`$top=200" ` + -tenantid $TenantFilter -noPagination $true) + } catch { return $true } + + $DestLookup = @{} + foreach ($dc in $DestChildren) { + $DestLookup[$dc.name] = $dc + } + + foreach ($sc in $SrcChildren) { + $DestMatch = $DestLookup[$sc.name] + if (-not $DestMatch) { return $true } + if ($null -ne $sc.folder -and $null -ne $DestMatch.folder) { + $SubResult = Compare-CrossDriveFolders ` + -SrcDriveId $SrcDriveId -SrcFolderId $sc.id ` + -DestDriveId $DestDriveId -DestFolderId $DestMatch.id ` + -TenantFilter $TenantFilter -Depth ($Depth + 1) + if ($SubResult) { return $true } + } + } + + return $false +} + +function Merge-CrossDriveFolders { + param( + [string]$SrcDriveId, + [string]$SrcFolderId, + [string]$DestDriveId, + [string]$DestFolderId, + [string]$TenantFilter, + [int]$Depth = 0 + ) + + $Result = @{ copied = 0; skipped = 0; errors = [System.Collections.Generic.List[string]]::new() } + + if ($Depth -ge 10) { + $Result.errors.Add('Merge depth limit (10 levels) reached; remaining subfolders skipped.') + return $Result + } + + try { + $SrcChildren = @(New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$SrcDriveId/items/$SrcFolderId/children?`$select=id,name,folder&`$top=200" ` + -tenantid $TenantFilter -noPagination $true) + } catch { + $Result.errors.Add("Failed to list source folder: $($_.Exception.Message)") + return $Result + } + + try { + $DestChildren = @(New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DestDriveId/items/$DestFolderId/children?`$select=id,name,folder&`$top=200" ` + -tenantid $TenantFilter -noPagination $true) + } catch { + $Result.errors.Add("Failed to list destination folder: $($_.Exception.Message)") + return $Result + } + + $DestLookup = @{} + foreach ($dc in $DestChildren) { + $DestLookup[$dc.name] = $dc + } + + foreach ($sc in $SrcChildren) { + $DestMatch = $DestLookup[$sc.name] + $IsFolder = ($null -ne $sc.folder) + + if (-not $DestMatch) { + try { + $CopyBody = @{ + parentReference = @{ driveId = $DestDriveId; id = $DestFolderId } + } | ConvertTo-Json -Depth 3 + $null = New-GraphPostRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$SrcDriveId/items/$($sc.id)/copy" ` + -tenantid $TenantFilter -type POST -body $CopyBody + $Result.copied++ + } catch { + $Result.errors.Add("Failed to copy '$($sc.name)': $($_.Exception.Message)") + } + } elseif ($IsFolder -and $null -ne $DestMatch.folder) { + $SubResult = Merge-CrossDriveFolders ` + -SrcDriveId $SrcDriveId -SrcFolderId $sc.id ` + -DestDriveId $DestDriveId -DestFolderId $DestMatch.id ` + -TenantFilter $TenantFilter -Depth ($Depth + 1) + $Result.copied += $SubResult.copied + $Result.skipped += $SubResult.skipped + foreach ($e in $SubResult.errors) { $Result.errors.Add($e) } + } else { + $Result.skipped++ + } + } + + return $Result +} + +function Invoke-ExecOneDriveFileAction { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.TenantFilter + if (-not $TenantFilter) { $TenantFilter = $Request.Query.TenantFilter } + + $DriveId = $Request.Body.DriveId + $ItemId = $Request.Body.ItemId + $Action = $Request.Body.Action + $UserId = $Request.Body.UserId + $SiteId = $Request.Body.SiteId + $ItemName = $Request.Body.ItemName + + # Cross-drive destination parameters + $DestinationDriveId = $Request.Body.DestinationDriveId + $DestinationUserId = $Request.Body.DestinationUserId + $DestinationSiteId = $Request.Body.DestinationSiteId + $ConflictBehavior = $Request.Body.ConflictBehavior + if (-not $ConflictBehavior) { $ConflictBehavior = 'rename' } + + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'TenantFilter is required' } + }) + } + + # Resolve DriveId from UserId or SiteId if not directly provided + if (-not $DriveId) { + try { + if ($UserId) { + $UserDrive = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/users/$UserId/drive?`$select=id" ` + -tenantid $TenantFilter -asApp $true + $DriveId = $UserDrive.id + } elseif ($SiteId) { + $Drives = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/sites/$SiteId/drives" ` + -tenantid $TenantFilter -asApp $true + $DriveId = ($Drives | Where-Object { $_.driveType -eq 'documentLibrary' } | Select-Object -First 1).id + if (-not $DriveId) { $DriveId = $Drives[0].id } + } + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::Forbidden + Body = @{ Results = "Failed to resolve drive: $ErrorMessage" } + }) + } + } + + if (-not $DriveId) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'DriveId, UserId, or SiteId is required to identify the drive' } + }) + } + + # Ensure ItemId is a clean string (not an object, not whitespace-padded) + if ($ItemId -and $ItemId -isnot [string]) { + $ItemId = [string]$ItemId + } + if ($ItemId) { $ItemId = $ItemId.Trim() } + + $ItemLabel = if ($ItemName) { $ItemName } else { $ItemId } + + try { + switch ($Action) { + 'Rename' { + $NewName = $Request.Body.NewName + if (-not $NewName) { throw 'NewName is required for Rename action' } + if (-not $ItemId) { throw 'ItemId is required for Rename action' } + + $Body = @{ name = $NewName } | ConvertTo-Json + $null = New-GraphPostRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$ItemId" ` + -tenantid $TenantFilter -type PATCH -body $Body + $Message = "Successfully renamed '$ItemLabel' to '$NewName'" + } + + 'Move' { + $DestinationFolderId = $Request.Body.DestinationFolderId + if (-not $DestinationFolderId) { throw 'DestinationFolderId is required for Move action' } + if (-not $ItemId) { throw 'ItemId is required for Move action' } + + # Support autocomplete field format + if ($DestinationFolderId -is [hashtable] -or $DestinationFolderId -is [PSCustomObject]) { + $DestinationFolderId = $DestinationFolderId.value + } + + $Body = @{ + parentReference = @{ + id = $DestinationFolderId + } + } | ConvertTo-Json -Depth 3 + $null = New-GraphPostRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$ItemId" ` + -tenantid $TenantFilter -type PATCH -body $Body + $Message = "Successfully moved '$ItemLabel' to the selected folder" + } + + 'Copy' { + $DestinationFolderId = $Request.Body.DestinationFolderId + $CopyName = $Request.Body.CopyName + if (-not $ItemId) { throw 'ItemId is required for Copy action' } + + $CopyBody = @{} + if ($CopyName) { + $CopyBody['name'] = $CopyName + } + if ($DestinationFolderId) { + if ($DestinationFolderId -is [hashtable] -or $DestinationFolderId -is [PSCustomObject]) { + $DestinationFolderId = $DestinationFolderId.value + } + $CopyBody['parentReference'] = @{ + driveId = $DriveId + id = $DestinationFolderId + } + } + + if ($CopyBody.Count -eq 0) { + # Default: copy in same location with " - Copy" suffix + $OriginalName = $ItemLabel + if ($OriginalName -match '^(.+)(\.[^.]+)$') { + $CopyBody['name'] = "$($Matches[1]) - Copy$($Matches[2])" + } else { + $CopyBody['name'] = "$OriginalName - Copy" + } + } + + $Body = $CopyBody | ConvertTo-Json -Depth 3 + $null = New-GraphPostRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$ItemId/copy" ` + -tenantid $TenantFilter -type POST -body $Body + + $CopyLabel = if ($CopyName) { $CopyName } elseif ($CopyBody['name']) { $CopyBody['name'] } else { $ItemLabel } + $Message = "Copy of '$ItemLabel' started as '$CopyLabel'. This may take a moment to complete." + } + + 'Delete' { + if (-not $ItemId) { throw 'ItemId is required for Delete action' } + + $null = New-GraphPostRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$ItemId" ` + -tenantid $TenantFilter -type DELETE -body '{}' + $Message = "Successfully deleted '$ItemLabel'. It has been moved to the OneDrive recycle bin." + } + + 'Download' { + if (-not $ItemId) { throw 'ItemId is required for Download action' } + + # Get the item metadata - the @microsoft.graph.downloadUrl annotation + # is returned automatically and must NOT be included in $select + $Item = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$ItemId" ` + -tenantid $TenantFilter -asApp $true + + $DownloadUrl = $Item.'@microsoft.graph.downloadUrl' + if (-not $DownloadUrl) { + throw "Could not obtain download URL for '$ItemLabel'. This may be a folder or a restricted item." + } + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ + Results = "Download link generated for '$($Item.name)'. The link is valid for a short time." + downloadUrl = $DownloadUrl + fileName = $Item.name + } + }) + } + + 'CreateFolder' { + $FolderName = $Request.Body.FolderName + $ParentId = $Request.Body.ParentId + if (-not $FolderName) { throw 'FolderName is required for CreateFolder action' } + + # If no ParentId, create at root + $ParentPath = if ($ParentId) { + "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$ParentId/children" + } else { + "https://graph.microsoft.com/v1.0/drives/$DriveId/root/children" + } + + $Body = @{ + name = $FolderName + folder = @{} + '@microsoft.graph.conflictBehavior' = 'rename' + } | ConvertTo-Json -Depth 3 + + $null = New-GraphPostRequest -AsApp $true ` + -uri $ParentPath ` + -tenantid $TenantFilter -type POST -body $Body + $Message = "Successfully created folder '$FolderName'" + } + + 'CrossCopy' { + if (-not $ItemId) { throw 'ItemId is required for CrossCopy action' } + + # Resolve destination drive + $DestDriveId = $DestinationDriveId + if (-not $DestDriveId) { + if ($DestinationUserId) { + $DestUserDrive = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/users/$DestinationUserId/drive?`$select=id" ` + -tenantid $TenantFilter -asApp $true + $DestDriveId = $DestUserDrive.id + } elseif ($DestinationSiteId) { + $DestDrives = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/sites/$DestinationSiteId/drives" ` + -tenantid $TenantFilter -asApp $true + $DestDriveId = ($DestDrives | Where-Object { $_.driveType -eq 'documentLibrary' } | Select-Object -First 1).id + if (-not $DestDriveId) { $DestDriveId = $DestDrives[0].id } + } + } + if (-not $DestDriveId) { throw 'DestinationDriveId, DestinationUserId, or DestinationSiteId is required for CrossCopy' } + + $DestinationFolderId = $Request.Body.DestinationFolderId + if ($DestinationFolderId -is [hashtable] -or $DestinationFolderId -is [PSCustomObject]) { + $DestinationFolderId = $DestinationFolderId.value + } + + # Build the parent reference for the destination drive + $CopyBody = @{ + parentReference = @{ + driveId = $DestDriveId + } + } + if ($DestinationFolderId) { + $CopyBody['parentReference']['id'] = $DestinationFolderId + } else { + # Resolve root folder id of destination drive + $DestRoot = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/drives/$DestDriveId/root?`$select=id" ` + -tenantid $TenantFilter -asApp $true + $CopyBody['parentReference']['id'] = $DestRoot.id + } + + $DestParentId = $CopyBody['parentReference']['id'] + + try { + $SourceItem = New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DriveId/items/${ItemId}?`$select=id,name,size,folder" ` + -tenantid $TenantFilter + } catch { + $SourceItem = New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$ItemId" ` + -tenantid $TenantFilter + } + $SourceName = $SourceItem.name + $SourceSize = [long]($SourceItem.size ?? 0) + $SourceIsFolder = ($null -ne $SourceItem.folder) + + $SkipItem = $false + $MergeHandled = $false + $EscName = $SourceName -replace "'", "''" + if ($ConflictBehavior -eq 'skip' -or $ConflictBehavior -eq 'replace') { + try { + $Existing = New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DestDriveId/items/$DestParentId/children?`$filter=name eq '$EscName'&`$select=id,name,folder" ` + -tenantid $TenantFilter + $Match = $Existing | Where-Object { $_.name -eq $SourceName } | Select-Object -First 1 + if ($Match) { + if ($ConflictBehavior -eq 'skip') { + if ($SourceIsFolder -and $null -ne $Match.folder) { + $NeedsMerge = Compare-CrossDriveFolders ` + -SrcDriveId $DriveId -SrcFolderId $ItemId ` + -DestDriveId $DestDriveId -DestFolderId $Match.id ` + -TenantFilter $TenantFilter + if ($NeedsMerge) { + $MergeResult = Merge-CrossDriveFolders ` + -SrcDriveId $DriveId -SrcFolderId $ItemId ` + -DestDriveId $DestDriveId -DestFolderId $Match.id ` + -TenantFilter $TenantFilter + $MergeParts = @() + if ($MergeResult.copied -gt 0) { $MergeParts += "$($MergeResult.copied) copied" } + if ($MergeResult.skipped -gt 0) { $MergeParts += "$($MergeResult.skipped) skipped" } + if ($MergeResult.errors.Count -gt 0) { $MergeParts += "$($MergeResult.errors.Count) failed" } + $Message = "Merged '$ItemLabel': $($MergeParts -join ', ')." + if ($MergeResult.errors.Count -gt 0) { + $Message += " Errors: $($MergeResult.errors -join '; ')" + } + $MergeHandled = $true + } else { + $SkipItem = $true + } + } else { + $SkipItem = $true + } + } elseif ($ConflictBehavior -eq 'replace') { + $null = New-GraphPostRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DestDriveId/items/$($Match.id)" ` + -tenantid $TenantFilter -type DELETE -body '{}' + Start-Sleep -Seconds 2 + } + } + } catch { } + } + + if ($MergeHandled) { + # Message already set by merge logic above + } elseif ($SkipItem) { + $Message = "Skipped '$ItemLabel' — all contents already exist at the destination." + } else { + $Body = $CopyBody | ConvertTo-Json -Depth 3 + $CopyComplete = $false + + for ($copyAttempt = 1; $copyAttempt -le 3; $copyAttempt++) { + $RetryNeeded = $false + try { + $CopyHeaders = $null + try { + $CopyHeaders = New-GraphPostRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$ItemId/copy" ` + -tenantid $TenantFilter -type POST -body $Body ` + -returnHeaders $true + } catch { + if ($_.Exception.Message -notmatch 'did not match the expected pattern') { throw } + } + + $MonitorUrl = $null + if ($CopyHeaders -and $CopyHeaders['Location']) { + $MonitorUrl = ($CopyHeaders['Location'] | Select-Object -First 1) + } + + if ($MonitorUrl) { + for ($i = 0; $i -lt 150; $i++) { + Start-Sleep -Seconds 2 + try { + $Status = Invoke-RestMethod -Uri $MonitorUrl -Method GET -ErrorAction Stop + if ($Status.status -eq 'completed') { + $CopyComplete = $true + break + } elseif ($Status.status -eq 'failed') { + throw "Copy operation failed: $($Status.error.message)" + } + } catch { + if ($_.Exception.Message -match 'Copy operation failed') { throw } + } + } + } else { + $EscName = $SourceName -replace "'", "''" + for ($i = 0; $i -lt 30; $i++) { + Start-Sleep -Seconds 4 + try { + $DestChildren = New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DestDriveId/items/$DestParentId/children?`$filter=name eq '$EscName'&`$select=id,name,size,folder" ` + -tenantid $TenantFilter + $DestItem = $DestChildren | Where-Object { $_.name -eq $SourceName } | Select-Object -First 1 + if ($DestItem) { + $CopyComplete = $true + break + } + } catch { } + } + } + } catch { + if ($_.Exception.Message -match 'being used in another operation' -and $copyAttempt -lt 3) { + $RetryNeeded = $true + } else { + throw + } + } + + if ($CopyComplete -or -not $RetryNeeded) { break } + Write-Host "Copy attempt $copyAttempt for '$ItemLabel': item busy, retrying in 30s" + Start-Sleep -Seconds 30 + } + + if (-not $CopyComplete) { + $Message = "Copy of '$ItemLabel' was initiated but could not be confirmed as complete within the timeout. Please check the destination to verify." + } else { + $Verified = $false + $VerifyDetail = '' + try { + $EscapedName = $SourceName -replace "'", "''" + $DestChildren = New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DestDriveId/items/$DestParentId/children?`$filter=name eq '$EscapedName'&`$select=id,name,size,folder" ` + -tenantid $TenantFilter + $DestItem = $DestChildren | Where-Object { $_.name -eq $SourceName } | Select-Object -First 1 + + if ($DestItem) { + $DestSize = [long]($DestItem.size ?? 0) + if ($SourceIsFolder) { + if ($DestSize -ge $SourceSize) { + $Verified = $true + } else { + $VerifyDetail = "Destination folder size ($DestSize bytes) is less than source ($SourceSize bytes)." + } + } else { + if ($DestSize -eq $SourceSize) { + $Verified = $true + } else { + $VerifyDetail = "Destination file size ($DestSize bytes) does not match source ($SourceSize bytes)." + } + } + } else { + $VerifyDetail = 'Destination item not found after copy.' + } + } catch { + $VerifyDetail = "Verification query failed: $($_.Exception.Message)" + } + + if ($Verified) { + $Message = "Successfully copied '$ItemLabel' to the destination (verified)." + } else { + $Message = "Copy of '$ItemLabel' completed but verification failed — $VerifyDetail Please check the destination manually." + } + } + } + } + + 'CrossMove' { + if (-not $ItemId) { throw 'ItemId is required for CrossMove action' } + + # Resolve destination drive + $DestDriveId = $DestinationDriveId + if (-not $DestDriveId) { + if ($DestinationUserId) { + $DestUserDrive = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/users/$DestinationUserId/drive?`$select=id" ` + -tenantid $TenantFilter -asApp $true + $DestDriveId = $DestUserDrive.id + } elseif ($DestinationSiteId) { + $DestDrives = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/sites/$DestinationSiteId/drives" ` + -tenantid $TenantFilter -asApp $true + $DestDriveId = ($DestDrives | Where-Object { $_.driveType -eq 'documentLibrary' } | Select-Object -First 1).id + if (-not $DestDriveId) { $DestDriveId = $DestDrives[0].id } + } + } + if (-not $DestDriveId) { throw 'DestinationDriveId, DestinationUserId, or DestinationSiteId is required for CrossMove' } + + $DestinationFolderId = $Request.Body.DestinationFolderId + if ($DestinationFolderId -is [hashtable] -or $DestinationFolderId -is [PSCustomObject]) { + $DestinationFolderId = $DestinationFolderId.value + } + + $CopyBody = @{ + parentReference = @{ + driveId = $DestDriveId + } + } + if ($DestinationFolderId) { + $CopyBody['parentReference']['id'] = $DestinationFolderId + } else { + $DestRoot = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/drives/$DestDriveId/root?`$select=id" ` + -tenantid $TenantFilter -asApp $true + $CopyBody['parentReference']['id'] = $DestRoot.id + } + $DestParentId = $CopyBody['parentReference']['id'] + + try { + $SourceItem = New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DriveId/items/${ItemId}?`$select=id,name,size,folder" ` + -tenantid $TenantFilter + } catch { + $SourceItem = New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$ItemId" ` + -tenantid $TenantFilter + } + $SourceIsFolder = ($null -ne $SourceItem.folder) + $SourceSize = [long]($SourceItem.size ?? 0) + $SourceName = $SourceItem.name + + $SkipItem = $false + $MergeHandled = $false + $EscName = $SourceName -replace "'", "''" + if ($ConflictBehavior -eq 'skip' -or $ConflictBehavior -eq 'replace') { + try { + $ExistCheck = New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DestDriveId/items/$DestParentId/children?`$filter=name eq '$EscName'&`$select=id,name,folder" ` + -tenantid $TenantFilter + $Match = $ExistCheck | Where-Object { $_.name -eq $SourceName } | Select-Object -First 1 + if ($Match) { + if ($ConflictBehavior -eq 'skip') { + if ($SourceIsFolder -and $null -ne $Match.folder) { + $NeedsMerge = Compare-CrossDriveFolders ` + -SrcDriveId $DriveId -SrcFolderId $ItemId ` + -DestDriveId $DestDriveId -DestFolderId $Match.id ` + -TenantFilter $TenantFilter + if ($NeedsMerge) { + $MergeResult = Merge-CrossDriveFolders ` + -SrcDriveId $DriveId -SrcFolderId $ItemId ` + -DestDriveId $DestDriveId -DestFolderId $Match.id ` + -TenantFilter $TenantFilter + $MergeParts = @() + if ($MergeResult.copied -gt 0) { $MergeParts += "$($MergeResult.copied) copied" } + if ($MergeResult.skipped -gt 0) { $MergeParts += "$($MergeResult.skipped) skipped" } + if ($MergeResult.errors.Count -gt 0) { $MergeParts += "$($MergeResult.errors.Count) failed" } + $Message = "Merged '$ItemLabel': $($MergeParts -join ', ')." + if ($MergeResult.errors.Count -gt 0) { + $Message += " Errors: $($MergeResult.errors -join '; ')" + } + $MergeHandled = $true + } else { + $SkipItem = $true + } + } else { + $SkipItem = $true + } + } elseif ($ConflictBehavior -eq 'replace') { + $null = New-GraphPostRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DestDriveId/items/$($Match.id)" ` + -tenantid $TenantFilter -type DELETE -body '{}' + Start-Sleep -Seconds 2 + } + } + } catch { } + } + + if ($MergeHandled) { + # Message already set by merge logic above + } elseif ($SkipItem) { + $Message = "Skipped '$ItemLabel' — all contents already exist at the destination. Source was not deleted." + } else { + $Body = $CopyBody | ConvertTo-Json -Depth 3 + $CopyComplete = $false + + for ($copyAttempt = 1; $copyAttempt -le 3; $copyAttempt++) { + $RetryNeeded = $false + try { + $CopyHeaders = $null + try { + $CopyHeaders = New-GraphPostRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$ItemId/copy" ` + -tenantid $TenantFilter -type POST -body $Body ` + -returnHeaders $true + } catch { + if ($_.Exception.Message -notmatch 'did not match the expected pattern') { throw } + } + + $MonitorUrl = $null + if ($CopyHeaders -and $CopyHeaders['Location']) { + $MonitorUrl = ($CopyHeaders['Location'] | Select-Object -First 1) + } + + if ($MonitorUrl) { + for ($i = 0; $i -lt 150; $i++) { + Start-Sleep -Seconds 2 + try { + $Status = Invoke-RestMethod -Uri $MonitorUrl -Method GET -ErrorAction Stop + if ($Status.status -eq 'completed') { + $CopyComplete = $true + break + } elseif ($Status.status -eq 'failed') { + throw "Copy operation failed: $($Status.error.message)" + } + } catch { + if ($_.Exception.Message -match 'Copy operation failed') { throw } + } + } + } else { + for ($i = 0; $i -lt 30; $i++) { + Start-Sleep -Seconds 4 + try { + $DestChildren = New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DestDriveId/items/$DestParentId/children?`$filter=name eq '$($SourceName -replace "'","''")'&`$select=id,name,size,folder" ` + -tenantid $TenantFilter + $DestItem = $DestChildren | Where-Object { $_.name -eq $SourceName } | Select-Object -First 1 + if ($DestItem) { + $CopyComplete = $true + break + } + } catch { } + } + } + } catch { + if ($_.Exception.Message -match 'being used in another operation' -and $copyAttempt -lt 3) { + $RetryNeeded = $true + } else { + throw + } + } + + if ($CopyComplete -or -not $RetryNeeded) { break } + Write-Host "Copy attempt $copyAttempt for '$ItemLabel': item busy, retrying in 30s" + Start-Sleep -Seconds 30 + } + + if (-not $CopyComplete) { + $Message = "Copy of '$ItemLabel' was initiated but could not be confirmed as complete. The source item was NOT deleted to prevent data loss. Please verify the copy completed at the destination and remove the source manually if needed." + } else { + # Step 3: Verify the destination item exists and matches the source + $Verified = $false + $VerifyDetail = '' + try { + $EscapedName = $SourceName -replace "'", "''" + $DestChildren = New-GraphGetRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DestDriveId/items/$DestParentId/children?`$filter=name eq '$EscapedName'&`$select=id,name,size,folder" ` + -tenantid $TenantFilter + $DestItem = $DestChildren | Where-Object { $_.name -eq $SourceName } | Select-Object -First 1 + + if ($DestItem) { + $DestSize = [long]($DestItem.size ?? 0) + if ($SourceIsFolder) { + if ($DestSize -ge $SourceSize) { + $Verified = $true + } else { + $VerifyDetail = "Destination folder size ($DestSize bytes) is less than source ($SourceSize bytes)." + } + } else { + if ($DestSize -eq $SourceSize) { + $Verified = $true + } else { + $VerifyDetail = "Destination file size ($DestSize bytes) does not match source ($SourceSize bytes)." + } + } + } else { + $VerifyDetail = 'Destination item not found.' + } + } catch { + $VerifyDetail = "Verification query failed: $($_.Exception.Message)" + } + + if ($Verified) { + $null = New-GraphPostRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$ItemId" ` + -tenantid $TenantFilter -type DELETE -body '{}' + $Message = "Successfully moved '$ItemLabel' to the destination (verified). The source has been removed." + } else { + $Message = "Copy of '$ItemLabel' completed but verification failed — $VerifyDetail The source was NOT deleted to prevent data loss. Please verify manually." + } + } + } + } + + default { + throw "Unknown action: $Action. Supported actions: Rename, Move, Copy, Delete, Download, CreateFolder, CrossCopy, CrossMove" + } + } + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev Info + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Message = "Failed to $Action '$ItemLabel'. Error: $($ErrorMessage.NormalizedError)" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev Error -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::Forbidden + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @{ Results = $Message } + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecReactivateSite.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecReactivateSite.ps1 index 270e63b840..48bc23506f 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecReactivateSite.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecReactivateSite.ps1 @@ -30,12 +30,19 @@ function Invoke-ExecReactivateSite { # Web GUID (the row's webId / sharepointIds.webId). $WebId = $Request.Body.WebId - try { - if ([string]::IsNullOrWhiteSpace($TenantFilter)) { throw 'tenantFilter is required.' } - if ([string]::IsNullOrWhiteSpace($SiteUrl)) { throw 'SiteUrl is required.' } + if ([string]::IsNullOrWhiteSpace($TenantFilter)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'tenantFilter is required.' } }) + } + if ([string]::IsNullOrWhiteSpace($SiteUrl)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'SiteUrl is required.' } }) + } + $ParsedSiteUrl = $null + if (-not [System.Uri]::TryCreate([string]$SiteUrl, [System.UriKind]::Absolute, [ref]$ParsedSiteUrl) -or [string]::IsNullOrWhiteSpace($ParsedSiteUrl.Host)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = "SiteUrl '$SiteUrl' is not a valid URL." } }) + } - $SiteHost = ([System.Uri]$SiteUrl).Host - if ([string]::IsNullOrWhiteSpace($SiteHost)) { throw "SiteUrl '$SiteUrl' is not a valid URL." } + try { + $SiteHost = $ParsedSiteUrl.Host # Prefer building the Graph composite id ({host},{siteCollectionId},{webId}) from the # ids the site listing already carries: an archived site is locked, so avoid any lookup @@ -71,7 +78,7 @@ function Invoke-ExecReactivateSite { $Results += ' Reactivation may need Unlicensed OneDrive billing enabled on the tenant, or the site cannot be reactivated via the API right now - reactivate it from the SharePoint admin center.' } Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveDeletedSite.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveDeletedSite.ps1 new file mode 100644 index 0000000000..86ba722b1b --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveDeletedSite.ps1 @@ -0,0 +1,61 @@ +function Invoke-ExecRemoveDeletedSite { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + $SiteUrl = $Request.Body.SiteUrl + $DisplayName = $Request.Body.DisplayName + + try { + if (-not $SiteUrl) { + throw 'SiteUrl is required' + } + if (-not $TenantFilter) { + throw 'TenantFilter is required' + } + + $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter + $ExtraHeaders = @{ + 'accept' = 'application/json' + 'content-type' = 'application/json' + 'odata-version' = '4.0' + } + + $Body = @{ siteUrl = $SiteUrl } | ConvertTo-Json -Depth 5 + $RemoveUri = "$($SharePointInfo.AdminUrl)/_api/SPO.Tenant/RemoveDeletedSite" + + $null = New-GraphPOSTRequest ` + -scope "$($SharePointInfo.AdminUrl)/.default" ` + -uri $RemoveUri ` + -body $Body ` + -tenantid $TenantFilter ` + -AddedHeaders $ExtraHeaders + + $SiteLabel = if ($DisplayName) { $DisplayName } else { $SiteUrl } + $Results = "Successfully permanently deleted SharePoint site '$SiteLabel'. This action cannot be undone." + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Info + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ Results = $Results } + }) + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $ErrorText = $ErrorMessage.NormalizedError + $Results = "Failed to permanently delete SharePoint site '$SiteUrl'. Error: $ErrorText" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = @{ Results = $Results } + }) + } +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveLibraryPermission.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveLibraryPermission.ps1 index 9c4ff659e8..17e93a65c6 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveLibraryPermission.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveLibraryPermission.ps1 @@ -30,10 +30,14 @@ function Invoke-ExecRemoveLibraryPermission { $RoleDefinitionId = $Request.Body.RoleDefinitionId $Label = $Request.Body.PrincipalName ?? $Request.Body.Title ?? $PrincipalId - try { - if ([string]::IsNullOrWhiteSpace($SiteUrl)) { throw 'SiteUrl is required.' } - if ([string]::IsNullOrWhiteSpace($PrincipalId)) { throw 'PrincipalId is required.' } + if ([string]::IsNullOrWhiteSpace($SiteUrl)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'SiteUrl is required.' } }) + } + if ([string]::IsNullOrWhiteSpace($PrincipalId)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'PrincipalId is required.' } }) + } + try { $SPScope = Resolve-CIPPSharePointPermissionScope -SiteUrl $SiteUrl -ListId $ListId -TenantFilter $TenantFilter -EnsureUniqueRoleAssignments # Read what the principal actually holds so only real bindings are removed and Limited @@ -41,7 +45,7 @@ function Invoke-ExecRemoveLibraryPermission { $Assignments = @(New-GraphGetRequest -uri "$($SPScope.AssignmentUri)?`$expand=Member,RoleDefinitionBindings" -tenantid $TenantFilter -scope $SPScope.Scope -extraHeaders $SPScope.Headers -UseCertificate -AsApp $true) $Current = @($Assignments | Where-Object { [string]$_.Member.Id -eq [string]$PrincipalId }) if ($Current.Count -eq 0) { - throw "$Label holds no permissions on $($SPScope.TargetLabel)." + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::NotFound; Body = @{ 'Results' = "$Label holds no permissions on $($SPScope.TargetLabel)." } }) } if (-not $Label -or $Label -eq $PrincipalId) { $Label = $Current[0].Member.Title ?? $PrincipalId } @@ -60,9 +64,9 @@ function Invoke-ExecRemoveLibraryPermission { if ($Targets.Count -eq 0) { if ($SkippedSystem.Count -gt 0) { - throw "$Label only holds $($SkippedSystem -join ', ') on $($SPScope.TargetLabel). SharePoint manages that level itself and it cannot be removed here; remove the permission that granted it instead." + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = "$Label only holds $($SkippedSystem -join ', ') on $($SPScope.TargetLabel). SharePoint manages that level itself and it cannot be removed here; remove the permission that granted it instead." } }) } - throw "No matching permission found for $Label on $($SPScope.TargetLabel)." + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::NotFound; Body = @{ 'Results' = "No matching permission found for $Label on $($SPScope.TargetLabel)." } }) } $Removed = [System.Collections.Generic.List[string]]::new() @@ -92,12 +96,12 @@ function Invoke-ExecRemoveLibraryPermission { if ($Removed.Count -eq 0) { throw $Result } Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Info - $StatusCode = [HttpStatusCode]::OK + $StatusCode = Get-CippBulkStatusCode -Total $Targets.Count -Failed $Failed.Count } catch { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to remove permission for $Label. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveSPOExternalUser.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveSPOExternalUser.ps1 index 945cd60f15..e6b3bd0854 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveSPOExternalUser.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveSPOExternalUser.ps1 @@ -23,11 +23,11 @@ function Invoke-ExecRemoveSPOExternalUser { $SiteUrls = @($Request.Body.SiteUrls) | Where-Object { $_ } $DisplayName = $Request.Body.DisplayName ?? $EntraUserId ?? $LoginName - try { - if (-not $EntraUserId -and $SiteUrls.Count -eq 0) { - throw 'This entry has no Entra guest account and no known site memberships. The remaining SharePoint store entry cannot be removed (Microsoft deprecated the API) and ages out on its own; revoke any sharing links they hold via the Sharing Report.' - } + if (-not $EntraUserId -and $SiteUrls.Count -eq 0) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'This entry has no Entra guest account and no known site memberships. The remaining SharePoint store entry cannot be removed (Microsoft deprecated the API) and ages out on its own; revoke any sharing links they hold via the Sharing Report.' } }) + } + try { $Messages = [System.Collections.Generic.List[string]]::new() $Errors = [System.Collections.Generic.List[string]]::new() @@ -70,12 +70,12 @@ function Invoke-ExecRemoveSPOExternalUser { $Results += " Issues: $($Errors -join '; ')" } Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Info - $StatusCode = [HttpStatusCode]::OK + $StatusCode = Get-CippBulkStatusCode -Total ($Messages.Count + $Errors.Count) -Failed $Errors.Count } catch { $ErrorMessage = Get-CippException -Exception $_ $Results = "Failed to remove guest access for $($DisplayName): $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveSharingLink.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveSharingLink.ps1 index f8d6d448b8..b7db2a2d44 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveSharingLink.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveSharingLink.ps1 @@ -21,11 +21,11 @@ function Invoke-ExecRemoveSharingLink { $FileName = $Request.Body.FileName $CacheId = $Request.Body.CacheId - try { - if ([string]::IsNullOrWhiteSpace($DriveId) -or [string]::IsNullOrWhiteSpace($ItemId) -or [string]::IsNullOrWhiteSpace($PermissionId)) { - throw 'DriveId, ItemId and PermissionId are required.' - } + if ([string]::IsNullOrWhiteSpace($DriveId) -or [string]::IsNullOrWhiteSpace($ItemId) -or [string]::IsNullOrWhiteSpace($PermissionId)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'DriveId, ItemId and PermissionId are required.' } }) + } + try { $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$ItemId/permissions/$PermissionId" -tenantid $TenantFilter -type DELETE -asapp $true # Best effort: drop the revoked link from the reporting cache so the report updates without a full sync. @@ -44,7 +44,7 @@ function Invoke-ExecRemoveSharingLink { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to revoke sharing link$(if ($FileName) { " for $FileName" }). Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveSiteUser.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveSiteUser.ps1 index a2315847ea..0d6c1c7e89 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveSiteUser.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveSiteUser.ps1 @@ -22,10 +22,14 @@ function Invoke-ExecRemoveSiteUser { $LoginName = $Request.Body.user.addedFields.LoginName ?? $Request.Body.user.value $Label = $Request.Body.DisplayName ?? $Request.Body.user.value ?? $LoginName - try { - if ($SiteUrls.Count -eq 0) { throw 'SiteUrl is required.' } - if (-not $LoginName) { throw 'No user was selected.' } + if ($SiteUrls.Count -eq 0) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'SiteUrl is required.' } }) + } + if (-not $LoginName) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'No user was selected.' } }) + } + try { $Removal = Remove-CIPPSPOSiteUser -TenantFilter $TenantFilter -SiteUrls $SiteUrls -LoginName $LoginName $Messages = [System.Collections.Generic.List[string]]::new() @@ -40,12 +44,12 @@ function Invoke-ExecRemoveSiteUser { throw $Results } Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Info - $StatusCode = [HttpStatusCode]::OK + $StatusCode = Get-CippBulkStatusCode -Total $SiteUrls.Count -Failed $Removal.Failed.Count } catch { $ErrorMessage = Get-CippException -Exception $_ $Results = "Failed to remove $Label from the selected site(s): $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveTeamsVoicePhoneNumberAssignment.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveTeamsVoicePhoneNumberAssignment.ps1 index f80c5dd02d..e8aa758293 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveTeamsVoicePhoneNumberAssignment.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRemoveTeamsVoicePhoneNumberAssignment.ps1 @@ -4,8 +4,6 @@ Function Invoke-ExecRemoveTeamsVoicePhoneNumberAssignment { Entrypoint .ROLE Teams.Voice.ReadWrite - .DESCRIPTION - Unassigns a phone number from a user or resource account via the Teams administration Graph API. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -13,31 +11,99 @@ Function Invoke-ExecRemoveTeamsVoicePhoneNumberAssignment { $APIName = $Request.Params.CIPPEndpoint $Headers = $Request.Headers - # Interact with query parameters or the body of the request. $TenantFilter = $Request.Body.tenantFilter $AssignedTo = $Request.Body.AssignedTo - $PhoneNumber = $Request.Body.PhoneNumber + # Normalize phone number -- the + prefix can be lost during URL encoding (+ becomes space) + $PhoneNumber = ($Request.Body.PhoneNumber -replace '^\s+', '') -replace '^ ', '' + if ($PhoneNumber -and $PhoneNumber -notmatch '^\+') { + $PhoneNumber = "+$PhoneNumber" + } $PhoneNumberType = $Request.Body.PhoneNumberType try { - # unassignNumber is keyed on the number alone - AssignedTo is kept only for the audit log. - $Body = @{ - telephoneNumber = $PhoneNumber - numberType = Get-CippTeamsNumberType -NumberType $PhoneNumberType - } - # Asynchronous: 202 Accepted with a Location header for the operation. - $null = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/v1.0/admin/teams/telephoneNumberManagement/numberAssignments/unassignNumber' -tenantid $TenantFilter -body ($Body | ConvertTo-Json -Compress) -type POST - $Result = "Successfully submitted unassignment of $PhoneNumber from $AssignedTo" + $null = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Remove-CsPhoneNumberAssignment' -CmdParams @{Identity = $AssignedTo; PhoneNumber = $PhoneNumber; PhoneNumberType = $PhoneNumberType; ErrorAction = 'Stop' } + $Result = "Successfully unassigned $PhoneNumber from $AssignedTo" Write-LogMessage -headers $Headers -API $APIName -tenant $($TenantFilter) -message $Result -Sev 'Info' $StatusCode = [HttpStatusCode]::OK + $Body = @{ Results = $Result } } catch { $ErrorMessage = Get-CippException -Exception $_ - $Result = "Failed to unassign $PhoneNumber from $AssignedTo. Error: $($ErrorMessage.NormalizedError)" - Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::InternalServerError + $NormError = [string]$ErrorMessage.NormalizedError + $RawError = [string]$ErrorMessage.Message + $ErrorText = "Failed to unassign $PhoneNumber from $AssignedTo. $NormError" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ErrorText -Sev Error -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::BadRequest + $Body = @{ + Results = $ErrorText + RawError = $RawError + } + + # --- Root Cause Analysis & Remediation --- + try { + $DiagList = [System.Collections.Generic.List[hashtable]]::new() + + # Pattern 1: Number Not Assigned + if ($NormError -match 'is not assigned' -or $RawError -match 'is not assigned' -or $NormError -match 'not currently assigned' -or $RawError -match 'not currently assigned') { + $DiagList.Add(@{ + source = 'Phone Number Assignment' + issue = 'Phone number is not currently assigned' + detail = "The phone number $PhoneNumber is not currently assigned to any user. It may have already been unassigned." + fix = 'No action is needed. Refresh the page to see the current assignment state.' + severity = 'info' + canQuickFix = $false + settingsPage = $null + riskLevel = $null + riskWarning = $null + }) + } + + # Pattern 2: Wrong User / Identity Mismatch + elseif ($NormError -match 'does not match' -or $RawError -match 'does not match' -or $NormError -match 'not assigned to' -or $RawError -match 'not assigned to') { + $ActualAssignee = $null + $ActualAssigneeDisplay = 'a different user' + try { + $NumberInfo = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsPhoneNumberAssignment' -CmdParams @{TelephoneNumber = $PhoneNumber; ErrorAction = 'Stop' } + if ($NumberInfo.AssignedPstnTargetId) { + $ActualAssignee = $NumberInfo.AssignedPstnTargetId + try { + $UserInfo = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsOnlineUser' -CmdParams @{Identity = $NumberInfo.AssignedPstnTargetId; ErrorAction = 'Stop' } + $ActualAssigneeDisplay = if ($UserInfo.DisplayName) { "$($UserInfo.DisplayName) ($($UserInfo.UserPrincipalName))" } else { $NumberInfo.AssignedPstnTargetId } + } catch { + $ActualAssigneeDisplay = $NumberInfo.AssignedPstnTargetId + } + } + } catch { + # Could not retrieve current assignment + } + $DiagList.Add(@{ + source = 'Phone Number Assignment' + issue = "Number is assigned to $ActualAssigneeDisplay, not $AssignedTo" + detail = "The phone number $PhoneNumber is currently assigned to $ActualAssigneeDisplay, not to the requested user ($AssignedTo). The assignment data may be stale." + fix = "Unassign the phone number from the correct user ($ActualAssigneeDisplay)." + severity = 'warning' + canQuickFix = $true + quickFixAction = 'unassignFromCorrectUser' + quickFixData = @{ + actualAssignee = $ActualAssignee + actualAssigneeDisplay = $ActualAssigneeDisplay + phoneNumber = $PhoneNumber + phoneNumberType = $PhoneNumberType + } + riskLevel = 'high' + riskWarning = "This will remove phone service from $ActualAssigneeDisplay. They will not be able to make or receive calls until a new number is assigned." + settingsPage = $null + }) + } + + if ($DiagList.Count -gt 0) { + $Body.Diagnostics = @($DiagList) + } + } catch { + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Voice unassignment diagnostics failed: $($_.Exception.Message)" -Sev 'Debug' + } } return ([HttpResponseContext]@{ StatusCode = $StatusCode - Body = @{'Results' = $Result } + Body = $Body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRestoreDeletedSite.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRestoreDeletedSite.ps1 index 88009fadf8..52733c8541 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRestoreDeletedSite.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRestoreDeletedSite.ps1 @@ -16,8 +16,11 @@ function Invoke-ExecRestoreDeletedSite { $TenantFilter = $Request.Body.tenantFilter $SiteUrl = $Request.Body.SiteUrl ?? $Request.Body.Url + if (-not $SiteUrl) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'SiteUrl is required.' } }) + } + try { - if (-not $SiteUrl) { throw 'SiteUrl is required.' } $Operation = Restore-CIPPSPODeletedSite -TenantFilter $TenantFilter -SiteUrl $SiteUrl $Results = if ($Operation -and -not $Operation.IsComplete) { "Restore of $SiteUrl has started. Large sites can take a while to finish restoring." @@ -30,7 +33,7 @@ function Invoke-ExecRestoreDeletedSite { $ErrorMessage = Get-CippException -Exception $_ $Results = "Failed to restore $($SiteUrl): $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRestoreRecycleBinItems.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRestoreRecycleBinItems.ps1 index cc8eb40a4e..d70b232192 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRestoreRecycleBinItems.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRestoreRecycleBinItems.ps1 @@ -18,10 +18,14 @@ function Invoke-ExecRestoreRecycleBinItems { $Ids = @($Request.Body.Ids) | Where-Object { $_ } $ItemNames = @($Request.Body.ItemNames) | Where-Object { $_ } - try { - if (-not $SiteUrl) { throw 'SiteUrl is required.' } - if ($Ids.Count -eq 0) { throw 'No recycle bin items were selected.' } + if (-not $SiteUrl) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'SiteUrl is required.' } }) + } + if ($Ids.Count -eq 0) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'No recycle bin items were selected.' } }) + } + try { $RestContext = Resolve-CIPPSharePointRestContext -TenantFilter $TenantFilter -SiteUrl $SiteUrl $Scope = $RestContext.Scope $JsonAccept = $RestContext.Headers @@ -42,7 +46,7 @@ function Invoke-ExecRestoreRecycleBinItems { $ErrorMessage = Get-CippException -Exception $_ $Results = "Failed to restore recycle bin items on $($SiteUrl): $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRevokeOneDriveLink.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRevokeOneDriveLink.ps1 new file mode 100644 index 0000000000..c9fc5049ba --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecRevokeOneDriveLink.ps1 @@ -0,0 +1,107 @@ +function Invoke-ExecRevokeOneDriveLink { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + $DriveId = $Request.Body.DriveId + $SiteId = $Request.Body.SiteId + $ItemId = $Request.Body.ItemId + $PermissionId = $Request.Body.PermissionId + $DisplayName = $Request.Body.DisplayName + $RevokeAll = $Request.Body.RevokeAll + + try { + if (-not $TenantFilter) { + throw 'TenantFilter is required' + } + + # Resolve DriveId from SiteId if not provided directly + if (-not $DriveId -and $SiteId) { + $Drives = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/sites/$SiteId/drives" ` + -tenantid $TenantFilter ` + -asApp $true + $DriveId = ($Drives | Where-Object { $_.driveType -eq 'documentLibrary' } | Select-Object -First 1).id + if (-not $DriveId -and $Drives) { + $DriveId = $Drives[0].id + } + } + + if (-not $DriveId) { + throw 'DriveId or SiteId is required' + } + + $SiteLabel = if ($DisplayName) { $DisplayName } else { $DriveId } + $RevokedCount = 0 + + if ($RevokeAll -eq $true) { + # Revoke all sharing permissions on the drive root + $RootPermsUri = "https://graph.microsoft.com/v1.0/drives/$DriveId/root/permissions" + $RootPerms = New-GraphGetRequest ` + -uri $RootPermsUri ` + -tenantid $TenantFilter ` + -asApp $true + + # Only revoke link-based and external permissions (not inherited or owner) + $RevocablePerms = $RootPerms | Where-Object { + ($_.link -and $_.link.scope -ne 'organization') -or + ($_.roles -and 'owner' -notin $_.roles -and $_.grantedToV2.user.email -and $_.grantedToV2.user.email -notlike '*@*.onmicrosoft.com') + } + + foreach ($Perm in $RevocablePerms) { + $DeleteUri = "https://graph.microsoft.com/v1.0/drives/$DriveId/root/permissions/$($Perm.id)" + try { + $null = New-GraphPOSTRequest ` + -uri $DeleteUri ` + -tenantid $TenantFilter ` + -type DELETE ` + -body '{}' ` + -asApp $true + $RevokedCount++ + } catch { + Write-Host "Failed to revoke permission $($Perm.id): $($_.Exception.Message)" + } + } + + $Results = "Revoked $RevokedCount sharing link(s) from OneDrive root for '$SiteLabel'." + } elseif ($ItemId -and $PermissionId) { + # Revoke a specific permission on a specific item + $DeleteUri = "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$ItemId/permissions/$PermissionId" + $null = New-GraphPOSTRequest ` + -uri $DeleteUri ` + -tenantid $TenantFilter ` + -type DELETE ` + -body '{}' ` + -asApp $true + $RevokedCount = 1 + $Results = "Revoked sharing permission on item in OneDrive for '$SiteLabel'." + } else { + throw 'Either set RevokeAll to true, or provide both ItemId and PermissionId' + } + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Info + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ Results = $Results; RevokedCount = $RevokedCount } + }) + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $ErrorText = $ErrorMessage.NormalizedError + $Results = "Failed to revoke sharing links for '$SiteLabel'. Error: $ErrorText" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = @{ Results = $Results } + }) + } +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSearchFiles.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSearchFiles.ps1 new file mode 100644 index 0000000000..8f9df156db --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSearchFiles.ps1 @@ -0,0 +1,245 @@ +function Invoke-ExecSearchFiles { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.TenantFilter + if (-not $TenantFilter) { $TenantFilter = $Request.Query.TenantFilter } + + $SearchQuery = $Request.Body.SearchQuery + if (-not $SearchQuery) { $SearchQuery = $Request.Query.SearchQuery } + + $From = $Request.Body.From + if (-not $From) { $From = $Request.Query.From } + if (-not $From) { $From = 0 } else { $From = [int]$From } + + $Size = $Request.Body.Size + if (-not $Size) { $Size = $Request.Query.Size } + if (-not $Size) { $Size = 25 } else { $Size = [int]$Size } + + $FilterModifiedBy = $Request.Body.FilterModifiedBy + $FilterDateFrom = $Request.Body.FilterDateFrom + $FilterDateTo = $Request.Body.FilterDateTo + $HasFilters = $FilterModifiedBy -or $FilterDateFrom -or $FilterDateTo + + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'TenantFilter is required' } + }) + } + + if (-not $SearchQuery -or $SearchQuery.Trim().Length -eq 0) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'SearchQuery is required' } + }) + } + + try { + $RootSite = New-GraphGetRequest ` + -uri 'https://graph.microsoft.com/v1.0/sites/root?$select=siteCollection' ` + -tenantid $TenantFilter ` + -asApp $true + $Region = $RootSite.siteCollection.dataLocationCode + if (-not $Region) { $Region = 'US' } + + $EffectiveQuery = $SearchQuery + if ($FilterModifiedBy) { + $EffectiveQuery = "$EffectiveQuery `"$FilterModifiedBy`"" + } + + $FetchSize = $Size + $EffectiveFrom = $From + if ($HasFilters) { + $FetchSize = 200 + $EffectiveFrom = 0 + } + + $SearchRequest = @{ + entityTypes = @('driveItem') + query = @{ + queryString = $EffectiveQuery + } + from = $EffectiveFrom + size = $FetchSize + region = $Region + sharePointOneDriveOptions = @{ + includeContent = 'privateContent,sharedContent' + } + fields = @( + 'name', 'webUrl', 'lastModifiedDateTime', 'lastModifiedBy', + 'createdBy', 'size', 'parentReference', 'file', 'folder', + 'id', 'createdDateTime' + ) + } + + $SearchBody = @{ requests = @($SearchRequest) } | ConvertTo-Json -Depth 5 + + try { + $SearchResults = New-GraphPostRequest ` + -uri 'https://graph.microsoft.com/v1.0/search/query' ` + -tenantid $TenantFilter ` + -body $SearchBody ` + -type POST ` + -AsApp $true ` + -NoAuthCheck $true + } catch { + $RegionError = $_.Exception.Message + if ($RegionError -match '(?i)region') { + $FallbackRegion = $null + if ($RegionError -match '(?i)valid regions?\s+(?:are|is)\s+(\w+)') { + $FallbackRegion = $Matches[1] + } + if ($FallbackRegion -and $FallbackRegion -ne $Region) { + $SearchRequest['region'] = $FallbackRegion + $SearchBody = @{ requests = @($SearchRequest) } | ConvertTo-Json -Depth 5 + $SearchResults = New-GraphPostRequest ` + -uri 'https://graph.microsoft.com/v1.0/search/query' ` + -tenantid $TenantFilter ` + -body $SearchBody ` + -type POST ` + -AsApp $true ` + -NoAuthCheck $true + } else { + throw + } + } else { + throw + } + } + + $Hits = @() + $TotalCount = 0 + $MoreResultsAvailable = $false + + if ($SearchResults -and $SearchResults.value) { + foreach ($response in $SearchResults.value) { + $TotalCount = $response.hitsContainers[0].total + $MoreResultsAvailable = $response.hitsContainers[0].moreResultsAvailable + + foreach ($hit in $response.hitsContainers[0].hits) { + $resource = $hit.resource + $IsFolder = $null -ne $resource.folder + $SizeBytes = if ($resource.size) { $resource.size } else { 0 } + $SizeFormatted = if ($SizeBytes -ge 1GB) { + '{0:N2} GB' -f ($SizeBytes / 1GB) + } elseif ($SizeBytes -ge 1MB) { + '{0:N2} MB' -f ($SizeBytes / 1MB) + } elseif ($SizeBytes -ge 1KB) { + '{0:N1} KB' -f ($SizeBytes / 1KB) + } else { + "$SizeBytes B" + } + + $SiteName = '' + $DriveName = '' + $FolderPath = '' + $SiteId = '' + $DriveId = '' + $ParentId = '' + + if ($resource.parentReference) { + $DriveId = $resource.parentReference.driveId + $SiteId = $resource.parentReference.siteId + $ParentId = $resource.parentReference.id + if ($resource.parentReference.path) { + $FolderPath = $resource.parentReference.path -replace '^.*root:/?', '/' + if ($FolderPath -eq '/') { $FolderPath = '/' } + } + $DriveName = $resource.parentReference.name + $SiteName = $resource.parentReference.sharepointIds.siteUrl -replace 'https://[^/]+/sites/', '' -replace '/.*', '' + } + + $FileExtension = $null + if (-not $IsFolder -and $resource.name -match '\.(\w+)$') { + $FileExtension = $Matches[1].ToLower() + } + + $Hits += [PSCustomObject]@{ + id = $resource.id + name = $resource.name + isFolder = $IsFolder + type = if ($IsFolder) { 'Folder' } else { 'File' } + sizeInBytes = $SizeBytes + sizeFormatted = if ($IsFolder) { "$($resource.folder.childCount) items" } else { $SizeFormatted } + fileExtension = $FileExtension + webUrl = $resource.webUrl + lastModified = $resource.lastModifiedDateTime + lastModifiedBy = $resource.lastModifiedBy.user.displayName + createdBy = $resource.createdBy.user.displayName + createdDate = $resource.createdDateTime + siteName = $SiteName + driveName = $DriveName + driveId = $DriveId + siteId = $SiteId + parentId = $ParentId + folderPath = $FolderPath + summary = $hit.summary + rank = $hit.rank + } + } + } + } + + $FilteredHits = $Hits + if ($HasFilters -and $Hits.Count -gt 0) { + $FilteredHits = @($Hits | Where-Object { + $Pass = $true + if ($FilterModifiedBy -and $Pass) { + $Pass = $_.lastModifiedBy -and $_.lastModifiedBy -like "*$FilterModifiedBy*" + } + if ($FilterDateFrom -and $Pass -and $_.lastModified) { + $ItemDate = [datetime]$_.lastModified + $FromDate = [datetime]$FilterDateFrom + $Pass = $ItemDate -ge $FromDate + } + if ($FilterDateTo -and $Pass -and $_.lastModified) { + $ItemDate = [datetime]$_.lastModified + $ToDate = ([datetime]$FilterDateTo).AddDays(1) + $Pass = $ItemDate -lt $ToDate + } + $Pass + }) + } + + $Body = @{ + Results = $FilteredHits + TotalCount = $TotalCount + MoreResultsAvailable = $MoreResultsAvailable + From = $From + Size = $Size + } + if ($HasFilters) { + $Body['FilteredCount'] = $FilteredHits.Count + } + + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $RawError = $_.Exception.Message + if ($RawError -match '403' -or $RawError -match 'Forbidden' -or $RawError -match 'Authorization') { + $Message = "File search failed with a 403 Forbidden error. The Files.Read.All application permission may not be granted for this tenant. Please run a CPV Refresh from CIPP Settings to push the required permissions, then try again. Raw error: $($ErrorMessage.NormalizedError)" + } elseif ($RawError -match 'Region' -or $RawError -match 'region') { + $Message = "File search failed due to a region configuration issue. The tenant's data location code '$Region' was not accepted by the Microsoft Search API. Raw error: $($ErrorMessage.NormalizedError)" + } else { + $Message = "File search failed. Error: $($ErrorMessage.NormalizedError)" + } + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev Error -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError + $Body = @{ Results = $Message } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + ContentType = 'application/json' + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetLibraryInheritance.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetLibraryInheritance.ps1 index a93cb97ed0..290c0dd2e0 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetLibraryInheritance.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetLibraryInheritance.ps1 @@ -31,11 +31,17 @@ function Invoke-ExecSetLibraryInheritance { $CopyRoleAssignments = ($Request.Body.CopyRoleAssignments ?? $true) -eq $true $ClearSubscopes = $Request.Body.ClearSubscopes -eq $true - try { - if ([string]::IsNullOrWhiteSpace($SiteUrl)) { throw 'SiteUrl is required.' } - if ([string]::IsNullOrWhiteSpace($ListId)) { throw 'ListId is required: a site root web always holds its own permissions.' } - if ([string]$Action -notin @('Break', 'Reset')) { throw "Action must be 'Break' or 'Reset'." } + if ([string]::IsNullOrWhiteSpace($SiteUrl)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'SiteUrl is required.' } }) + } + if ([string]::IsNullOrWhiteSpace($ListId)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'ListId is required: a site root web always holds its own permissions.' } }) + } + if ([string]$Action -notin @('Break', 'Reset')) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = "Action must be 'Break' or 'Reset'." } }) + } + try { $SPScope = Resolve-CIPPSharePointPermissionScope -SiteUrl $SiteUrl -ListId $ListId -TenantFilter $TenantFilter $TargetLabel = if ($LibraryName) { "library $LibraryName" } else { $SPScope.TargetLabel } @@ -68,7 +74,7 @@ function Invoke-ExecSetLibraryInheritance { $FailTarget = if ($LibraryName) { "library $LibraryName" } else { 'the library' } $Result = "Failed to change permission inheritance on $FailTarget. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetLibraryPermission.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetLibraryPermission.ps1 index 5631389283..b1ff3b82de 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetLibraryPermission.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetLibraryPermission.ps1 @@ -46,14 +46,18 @@ function Invoke-ExecSetLibraryPermission { } try { - if ([string]::IsNullOrWhiteSpace($SiteUrl)) { throw 'SiteUrl is required.' } + if ([string]::IsNullOrWhiteSpace($SiteUrl)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'SiteUrl is required.' } }) + } $RoleDefId = if (-not [string]::IsNullOrWhiteSpace($RoleDefinitionId)) { $RoleDefinitionId } else { $RoleDefinitionIds[[string]$PermissionLevel] } - if (-not $RoleDefId) { throw 'No permission level was selected.' } + if (-not $RoleDefId) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'No permission level was selected.' } }) + } # Build the claims-encoded logon names for ensureuser. A PrincipalId from the permission # list is already resolved on the site, so it skips that round-trip. @@ -92,7 +96,7 @@ function Invoke-ExecSetLibraryPermission { }) } if ($Principals.Count -eq 0) { - throw 'No users or groups selected.' + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'No users or groups selected.' } }) } # Resolving with -EnsureUniqueRoleAssignments breaks inheritance (copying the existing @@ -171,17 +175,16 @@ function Invoke-ExecSetLibraryPermission { $Result = $Messages -join ' ' if ($Granted.Count -gt 0) { Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Info - $StatusCode = [HttpStatusCode]::OK } else { Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Error - $StatusCode = [HttpStatusCode]::BadRequest } + $StatusCode = Get-CippBulkStatusCode -Total $Principals.Count -Failed $Failed.Count } catch { $ErrorMessage = Get-CippException -Exception $_ $FailTarget = if ($LibraryName) { "library $LibraryName" } else { 'the site root' } $Result = "Failed to set permission on $FailTarget. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetSharePointMember.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetSharePointMember.ps1 index da17035231..e5fe037d9a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetSharePointMember.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetSharePointMember.ps1 @@ -34,12 +34,19 @@ function Invoke-ExecSetSharePointMember { APIName = $APIName } + if ($MemberParams.UserPrincipalName.Count -eq 0) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'No user was selected.' } }) + } + if ($MemberParams.Role -notin @('Owners', 'Members', 'Visitors')) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = "Invalid role '$($MemberParams.Role)'. Valid roles are: Owners, Members, Visitors." } }) + } + try { - $Results = Set-CIPPSharePointSiteMember @MemberParams - $StatusCode = [HttpStatusCode]::OK + $Results = @(Set-CIPPSharePointSiteMember @MemberParams) + $StatusCode = Get-CippBulkStatusCode -Total $Results.Count -Failed $Results.Where({ $_.state -eq 'error' }).Count } catch { $Results = $_.Exception.Message - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = Get-CippErrorStatusCode -ErrorRecord $_ } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetSiteProperties.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetSiteProperties.ps1 index c8395de597..d318f5f1d7 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetSiteProperties.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetSiteProperties.ps1 @@ -31,9 +31,11 @@ function Invoke-ExecSetSiteProperties { $Int64Properties = @('StorageMaximumLevel', 'StorageWarningLevel') $ValidLockStates = @('Unlock', 'ReadOnly', 'NoAccess') - try { - if (-not $SiteUrl) { throw 'SiteUrl is required.' } + if (-not $SiteUrl) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'SiteUrl is required.' } }) + } + try { $Properties = @{} $Changes = [System.Collections.Generic.List[string]]::new() @@ -41,7 +43,7 @@ function Invoke-ExecSetSiteProperties { $Value = $Request.Body.$Key.value ?? $Request.Body.$Key if ($null -ne $Value -and "$Value" -ne '') { if (-not $EnumMaps[$Key].ContainsKey([string]$Value)) { - throw "Invalid value '$Value' for $Key. Valid values: $($EnumMaps[$Key].Keys -join ', ')." + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = "Invalid value '$Value' for $Key. Valid values: $($EnumMaps[$Key].Keys -join ', ')." } }) } $Properties[$Key] = [int]$EnumMaps[$Key][[string]$Value] $Changes.Add("$Key=$Value") @@ -51,7 +53,7 @@ function Invoke-ExecSetSiteProperties { $LockState = $Request.Body.LockState.value ?? $Request.Body.LockState if ($null -ne $LockState -and "$LockState" -ne '') { if ($LockState -notin $ValidLockStates) { - throw "Invalid LockState '$LockState'. Valid values: $($ValidLockStates -join ', ')." + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = "Invalid LockState '$LockState'. Valid values: $($ValidLockStates -join ', ')." } }) } $Properties['LockState'] = [string]$LockState $Changes.Add("LockState=$LockState") @@ -87,14 +89,15 @@ function Invoke-ExecSetSiteProperties { } if ($Properties.Count -eq 0) { - throw 'No valid properties were provided to set.' + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'No valid properties were provided to set.' } }) } # Group-connected sites only accept a small subset of tenant site properties; SPO # rejects the whole request if any other property is included. Filter to the # supported set and report what was skipped. $Site = Get-CIPPSPOSite -TenantFilter $TenantFilter -SiteUrl $SiteUrl - $IsGroupSite = $Site.GroupId -and $Site.GroupId -notmatch '^0{8}-' + # GroupId comes back as /Guid(...)/, all zeros on a classic site + $IsGroupSite = $Site.GroupId -and $Site.GroupId -notmatch '0{8}-0{4}-0{4}-0{4}-0{12}' $Skipped = [System.Collections.Generic.List[string]]::new() if ($IsGroupSite) { $GroupSiteAllowed = @('SharingCapability', 'DefaultSharingLinkType', 'DefaultLinkPermission', 'LockState', 'StorageMaximumLevel', 'StorageWarningLevel') @@ -105,28 +108,64 @@ function Invoke-ExecSetSiteProperties { } } if ($Properties.Count -eq 0) { - throw "None of the selected properties can be changed on a group-connected site. Supported: $($GroupSiteAllowed -join ', ')." + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = "None of the selected properties can be changed on a group-connected site. Supported: $($GroupSiteAllowed -join ', ')." } }) } } - $Response = Set-CIPPSPOSite -TenantFilter $TenantFilter -SiteUrl $SiteUrl -Properties $Properties - $CsomError = ($Response | Where-Object { $_.ErrorInfo } | Select-Object -First 1).ErrorInfo.ErrorMessage - if ($CsomError) { - throw $CsomError + $LockState = $Properties['LockState'] + $CurrentLockState = [string]$Site.LockState + $IsLocked = $CurrentLockState -and $CurrentLockState -ne 'Unlock' + $LockSkipped = [System.Collections.Generic.List[string]]::new() + if ($IsLocked -and $LockState -ne 'Unlock') { + foreach ($Key in @($Properties.Keys)) { + if ($Key -ne 'LockState') { + $Properties.Remove($Key) + $LockSkipped.Add($Key) + } + } + if ($Properties.Count -eq 0) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = "The site is locked ($CurrentLockState). Unlock it before changing: $($LockSkipped -join ', ')." } }) + } + } + + # A locked site rejects most writes, so the lock change is its own request: first when unlocking, last when locking + $Requests = [System.Collections.Generic.List[hashtable]]::new() + if ($LockState -and $Properties.Count -gt 1 -and ($IsLocked -or $LockState -ne 'Unlock')) { + $Properties.Remove('LockState') + if ($IsLocked) { $Requests.Add(@{ LockState = $LockState }) } + $Requests.Add($Properties) + if (-not $IsLocked) { $Requests.Add(@{ LockState = $LockState }) } + } else { + $Requests.Add($Properties) } - $AppliedChanges = $Changes | Where-Object { ($_ -split '=')[0] -in $Properties.Keys } - $Results = "Successfully updated site properties for $($SiteUrl): $($AppliedChanges -join ', ')" + $Done = [System.Collections.Generic.List[string]]::new() + foreach ($Batch in $Requests) { + $Response = Set-CIPPSPOSite -TenantFilter $TenantFilter -SiteUrl $SiteUrl -Properties $Batch + $CsomError = ($Response | Where-Object { $_.ErrorInfo } | Select-Object -First 1).ErrorInfo.ErrorMessage + if ($CsomError) { + throw $(if ($Done.Count -gt 0) { "$CsomError (already applied: $($Done -join ', '))" } else { $CsomError }) + } + foreach ($Key in $Batch.Keys) { $Done.Add($Key) } + } + + $AppliedChanges = $Changes.Where({ ($_ -split '=')[0] -in $Done }) + $ResultParts = [System.Collections.Generic.List[string]]::new() + $ResultParts.Add("Successfully updated site properties for $($SiteUrl): $($AppliedChanges -join ', ')") if ($Skipped.Count -gt 0) { - $Results += " Skipped (not supported on group-connected sites): $($Skipped -join ', ')." + $ResultParts.Add("Skipped (not supported on group-connected sites): $($Skipped -join ', ').") + } + if ($LockSkipped.Count -gt 0) { + $ResultParts.Add("Skipped while the site is locked ($CurrentLockState), unlock it to change: $($LockSkipped -join ', ').") } + $Results = $ResultParts -join ' ' Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Info $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-CippException -Exception $_ $Results = "Failed to update site properties for $($SiteUrl): $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetSiteProperty.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetSiteProperty.ps1 new file mode 100644 index 0000000000..c2f827f8f9 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetSiteProperty.ps1 @@ -0,0 +1,203 @@ +function Invoke-ExecSetSiteProperty { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + $SiteId = $Request.Body.SiteId + $DisplayName = $Request.Body.DisplayName + + try { + if (-not $SiteId) { + throw 'SiteId is required' + } + if (-not $TenantFilter) { + throw 'TenantFilter is required' + } + + $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter + $ExtraHeaders = @{ + 'accept' = 'application/json' + 'content-type' = 'application/json' + 'odata-version' = '4.0' + } + + $SiteLabel = if ($DisplayName) { $DisplayName } else { $SiteId } + $PatchUri = "$($SharePointInfo.AdminUrl)/_api/SPO.Tenant/sites('$SiteId')" + $PropertiesToSet = @{} + $ActionDescription = '' + + # Helper: autoComplete fields may arrive as { label, value } objects — extract the value + function Get-FieldValue($Field) { + if ($Field -is [PSCustomObject] -and $null -ne $Field.value) { + return $Field.value + } + return $Field + } + + # Helper: strict integer parse — rejects non-integral values instead of rounding + function Get-IntValue($Raw, [string]$Name) { + $Parsed = 0 + if (-not [int]::TryParse([string]$Raw, [ref]$Parsed)) { + throw "$Name must be a whole number (received '$Raw')" + } + return $Parsed + } + + # Helper: strict boolean parse — accepts native booleans and 'true'/'false' strings only + function Get-BoolValue($Raw, [string]$Name) { + if ($Raw -is [bool]) { return $Raw } + $Parsed = $false + if (-not [bool]::TryParse([string]$Raw, [ref]$Parsed)) { + throw "$Name must be true or false (received '$Raw')" + } + return $Parsed + } + + # Lock State + $RawLockState = Get-FieldValue $Request.Body.LockState + if ($RawLockState) { + $LockStateMap = @{ + 'Unlock' = 0 + 'NoAccess' = 1 + 'ReadOnly' = 2 + } + $LockValue = $LockStateMap[$RawLockState] + if ($null -eq $LockValue) { + throw "Invalid LockState '$RawLockState'. Valid values: Unlock, NoAccess, ReadOnly" + } + $PropertiesToSet['LockState'] = $LockValue + $ActionDescription = "Set lock state to '$RawLockState'" + } + + # Sharing Capability + $RawSharing = Get-FieldValue $Request.Body.SharingCapability + if ($null -ne $RawSharing -and '' -ne $RawSharing) { + $SharingLabels = @{ + 0 = 'Disabled' + 1 = 'ExternalUserSharingOnly' + 2 = 'ExternalUserAndGuestSharing' + 3 = 'ExistingExternalUserSharingOnly' + } + $SharingValue = [int]$RawSharing + if ($SharingValue -notin 0, 1, 2, 3) { + throw "Invalid SharingCapability '$SharingValue'. Valid values: 0 (Disabled), 1 (ExternalUserSharingOnly), 2 (ExternalUserAndGuestSharing), 3 (ExistingExternalUserSharingOnly)" + } + $PropertiesToSet['SharingCapability'] = $SharingValue + $ActionDescription = "Set sharing capability to '$($SharingLabels[$SharingValue])'" + } + + # Storage Quota (accepts GB, converts to MB for the API) + if ($null -ne $Request.Body.StorageMaximumLevelGB -and '' -ne $Request.Body.StorageMaximumLevelGB) { + $MaxGB = [double]$Request.Body.StorageMaximumLevelGB + if ($MaxGB -le 0) { + throw 'StorageMaximumLevelGB must be a positive number' + } + $MaxLevel = [long]($MaxGB * 1024) + $PropertiesToSet['StorageMaximumLevel'] = $MaxLevel + + if ($null -ne $Request.Body.StorageWarningLevelGB -and '' -ne $Request.Body.StorageWarningLevelGB) { + $WarnGB = [double]$Request.Body.StorageWarningLevelGB + $WarnLevel = [long]($WarnGB * 1024) + if ($WarnLevel -lt 0 -or $WarnLevel -ge $MaxLevel) { + throw 'StorageWarningLevelGB must be between 0 and StorageMaximumLevelGB' + } + $PropertiesToSet['StorageWarningLevel'] = $WarnLevel + } else { + # Default warning at 90% of max + $PropertiesToSet['StorageWarningLevel'] = [long]($MaxLevel * 0.9) + } + $ActionDescription = "Set storage quota to $($MaxGB) GB (warning at $([math]::Round($PropertiesToSet['StorageWarningLevel'] / 1024, 2)) GB)" + } + + # Default Sharing Link Type (0=None/tenant default, 1=Direct, 2=Internal, 3=AnonymousAccess) + $RawLinkType = Get-FieldValue $Request.Body.DefaultSharingLinkType + if ($null -ne $RawLinkType -and '' -ne $RawLinkType) { + $LinkTypeLabels = @{ 0 = 'Tenant default'; 1 = 'Direct (specific people)'; 2 = 'Internal (organization)'; 3 = 'Anyone (anonymous)' } + $LinkTypeValue = Get-IntValue $RawLinkType 'DefaultSharingLinkType' + if ($LinkTypeValue -notin 0, 1, 2, 3) { + throw "Invalid DefaultSharingLinkType '$LinkTypeValue'. Valid values: 0 (tenant default), 1 (Direct), 2 (Internal), 3 (AnonymousAccess)" + } + $PropertiesToSet['DefaultSharingLinkType'] = $LinkTypeValue + if ($ActionDescription) { $ActionDescription += "; default sharing link type '$($LinkTypeLabels[$LinkTypeValue])'" } + else { $ActionDescription = "Set default sharing link type to '$($LinkTypeLabels[$LinkTypeValue])'" } + } + + # Default Link Permission (0=None/tenant default, 1=View, 2=Edit) + $RawLinkPerm = Get-FieldValue $Request.Body.DefaultLinkPermission + if ($null -ne $RawLinkPerm -and '' -ne $RawLinkPerm) { + $LinkPermLabels = @{ 0 = 'Tenant default'; 1 = 'View'; 2 = 'Edit' } + $LinkPermValue = Get-IntValue $RawLinkPerm 'DefaultLinkPermission' + if ($LinkPermValue -notin 0, 1, 2) { + throw "Invalid DefaultLinkPermission '$LinkPermValue'. Valid values: 0 (tenant default), 1 (View), 2 (Edit)" + } + $PropertiesToSet['DefaultLinkPermission'] = $LinkPermValue + if ($ActionDescription) { $ActionDescription += "; default link permission '$($LinkPermLabels[$LinkPermValue])'" } + else { $ActionDescription = "Set default link permission to '$($LinkPermLabels[$LinkPermValue])'" } + } + + # Anonymous link expiration (requires override flag) + if ($null -ne $Request.Body.AnonymousLinkExpirationInDays -and '' -ne $Request.Body.AnonymousLinkExpirationInDays) { + $ExpDays = Get-IntValue $Request.Body.AnonymousLinkExpirationInDays 'AnonymousLinkExpirationInDays' + if ($ExpDays -lt 1) { throw 'AnonymousLinkExpirationInDays must be at least 1' } + $PropertiesToSet['OverrideTenantAnonymousLinkExpirationPolicy'] = $true + $PropertiesToSet['AnonymousLinkExpirationInDays'] = $ExpDays + if ($ActionDescription) { $ActionDescription += "; anonymous links expire after $ExpDays days" } + else { $ActionDescription = "Set anonymous link expiration to $ExpDays days" } + } + + # Restricted Access Control (requires SharePoint Advanced Management licensing) + $RawRAC = Get-FieldValue $Request.Body.RestrictedAccessControl + if ($null -ne $RawRAC -and '' -ne $RawRAC) { + $RACValue = Get-BoolValue $RawRAC 'RestrictedAccessControl' + $PropertiesToSet['RestrictedAccessControl'] = $RACValue + $RACDescription = if ($RACValue) { 'Enabled restricted access control (members only)' } else { 'Disabled restricted access control' } + if ($ActionDescription) { $ActionDescription += "; $($RACDescription.ToLower())" } + else { $ActionDescription = $RACDescription } + } + + if ($PropertiesToSet.Count -eq 0) { + throw 'No valid properties specified. Provide one of: LockState, SharingCapability, StorageMaximumLevelGB, DefaultSharingLinkType, DefaultLinkPermission, AnonymousLinkExpirationInDays, RestrictedAccessControl' + } + + $PatchBody = $PropertiesToSet | ConvertTo-Json -Depth 5 + $null = New-GraphPOSTRequest ` + -scope "$($SharePointInfo.AdminUrl)/.default" ` + -uri $PatchUri ` + -body $PatchBody ` + -tenantid $TenantFilter ` + -type PATCH ` + -AddedHeaders $ExtraHeaders + + $Results = "Successfully updated site '$SiteLabel': $ActionDescription" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Info + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ Results = $Results } + }) + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $ErrorText = $ErrorMessage.NormalizedError + if ($ErrorText -match 'license|Advanced Management|not enabled for this tenant') { + $ErrorText = "This setting requires SharePoint Advanced Management licensing, which this tenant does not appear to have. Original error: $ErrorText" + } + if ($PropertiesToSet -and $PropertiesToSet.ContainsKey('StorageMaximumLevel') -and $ErrorText -notmatch 'must be') { + $ErrorText = $ErrorText.TrimEnd() + ' | Note: if this tenant uses automatic site storage management, per-site quotas do not apply until the tenant is switched to manual site storage limits in the SharePoint admin center.' + } + $Results = "Failed to update site property for '$SiteLabel'. Error: $ErrorText" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = @{ Results = $Results } + }) + } +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointImageOptimize.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointImageOptimize.ps1 new file mode 100644 index 0000000000..c19e92cd03 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointImageOptimize.ps1 @@ -0,0 +1,118 @@ +function Invoke-ExecSharePointImageOptimize { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.ReadWrite + .SYNOPSIS + Queue a SharePoint Image Optimizer job (audit / compress / compress + cleanup). + .DESCRIPTION + Scanning and compressing a document library can take far longer than the ~230s + Azure HTTP gateway window, so the work is queued for background processing and the + caller polls Invoke-ListImageOptimizerResults (by QueueId) for status and results. + + The Mode and WhatIf flags control how destructive the run is: + - Mode 'Audit' : read-only discovery. + - Mode 'Compress' : re-encodes and (when WhatIf=$false) replaces files. + - Mode 'CompressAndCleanup' : as above, then removes old versions per + VersionCleanupMode. + WhatIf defaults to $true; while true NO file is modified and NO version is deleted. + Version cleanup runs ONLY when VersionCleanupMode is not 'none'. + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $Headers = $Request.Headers + $APIName = $Request.Params.CIPPEndpoint + + $TenantFilter = $Request.Body.TenantFilter ?? $Request.Query.TenantFilter + $SiteId = $Request.Body.SiteId + $SiteUrl = $Request.Body.SiteUrl + $DriveId = $Request.Body.DriveId + $LibraryName = $Request.Body.LibraryName + $FolderId = $Request.Body.FolderId + $FolderPath = $Request.Body.FolderPath + $Mode = $Request.Body.Mode ?? 'Audit' + $MinimumFileSizeMB = [double]($Request.Body.MinimumFileSizeMB ?? 5) + $JpegQuality = [int]($Request.Body.JpegQuality ?? 82) + $MinimumSavingsPercent = [double]($Request.Body.MinimumSavingsPercent ?? 15) + $VersionCleanupMode = $Request.Body.VersionCleanupMode ?? 'none' + $MaxFiles = [int]($Request.Body.MaxFiles ?? 0) + + # Defaults that must fail safe. + $StripMetadata = if ($null -eq $Request.Body.StripMetadata) { $true } else { [bool]$Request.Body.StripMetadata } + $WhatIf = if ($null -eq $Request.Body.WhatIf) { $true } else { [bool]$Request.Body.WhatIf } + $IncludeSubfolders = if ($null -eq $Request.Body.IncludeSubfolders) { $true } else { [bool]$Request.Body.IncludeSubfolders } + + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'TenantFilter is required' } + }) + } + if (-not $DriveId -and -not $SiteId -and -not $SiteUrl) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'DriveId, SiteId, or SiteUrl is required' } + }) + } + if ($Mode -notin @('Audit', 'Compress', 'CompressAndCleanup')) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Invalid Mode '$Mode'. Use Audit, Compress, or CompressAndCleanup." } + }) + } + # Guard: cleanup mode only meaningful with the cleanup job. + if ($Mode -ne 'CompressAndCleanup') { $VersionCleanupMode = 'none' } + + try { + $TargetLabel = $LibraryName + if ($FolderPath) { $TargetLabel = "$LibraryName/$($FolderPath.Trim('/'))" } + $QueueReference = "ImageOptimizer-$TenantFilter-$SiteId-$DriveId-$FolderId-$Mode" + $Queue = New-CippQueueEntry -Name "Image Optimizer - $Mode$(if ($TargetLabel) { " ($TargetLabel)" })" -Link '/teams-share/sharepoint/image-optimizer' -Reference $QueueReference -TotalTasks 1 + + $Queued = Add-CippQueueMessage -Cmdlet 'Start-CIPPSharePointImageOptimizer' -Parameters @{ + QueueId = $Queue.RowKey + TenantFilter = $TenantFilter + SiteId = $SiteId + SiteUrl = $SiteUrl + DriveId = $DriveId + LibraryName = $LibraryName + FolderId = $FolderId + FolderPath = $FolderPath + Mode = $Mode + MinimumFileSizeMB = $MinimumFileSizeMB + JpegQuality = $JpegQuality + StripMetadata = $StripMetadata + MinimumSavingsPercent = $MinimumSavingsPercent + WhatIf = $WhatIf + VersionCleanupMode = $VersionCleanupMode + MaxFiles = $MaxFiles + IncludeSubfolders = $IncludeSubfolders + } + + if (-not $Queued) { + throw 'Failed to queue the image optimizer job' + } + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Queued image optimizer (mode=$Mode, whatIf=$WhatIf, queueId=$($Queue.RowKey))" -Sev Info + + $StatusCode = [HttpStatusCode]::OK + $Body = @{ + Queued = $true + QueueId = $Queue.RowKey + Mode = $Mode + QueueMessage = 'Job queued. Results will be available when it completes.' + } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Image optimizer queue failed: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError + $Body = @{ Results = "Failed to start image optimizer: $($ErrorMessage.NormalizedError)" } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointImageVersionCleanup.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointImageVersionCleanup.ps1 new file mode 100644 index 0000000000..a747c70d04 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointImageVersionCleanup.ps1 @@ -0,0 +1,149 @@ +function Invoke-ExecSharePointImageVersionCleanup { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.ReadWrite + .SYNOPSIS + Standalone version cleanup for one or more SharePoint drive items (destructive). + .DESCRIPTION + Deletes old versions of the supplied drive items, keeping the current version. + Intended for use after a successful compression run when the admin wants to + reclaim storage held by version history. WhatIf defaults to $true. + + This is a destructive operation; the caller (UI) must require explicit admin + selection of a cleanup mode and a confirmation before calling with WhatIf=$false. + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $Headers = $Request.Headers + $APIName = $Request.Params.CIPPEndpoint + + $TenantFilter = $Request.Body.TenantFilter ?? $Request.Query.TenantFilter + $DriveId = $Request.Body.DriveId + $SiteId = $Request.Body.SiteId + $SiteUrl = $Request.Body.SiteUrl + $CleanupMode = $Request.Body.CleanupMode ?? 'recycle' + $WhatIf = if ($null -eq $Request.Body.WhatIf) { $true } else { [bool]$Request.Body.WhatIf } + + # Accept a single file or an array of files. Each entry may be a string (DriveItemId) + # or an object with DriveItemId/DriveId. + $Files = @($Request.Body.Files | Where-Object { $_ }) + if ($Files.Count -eq 0) { + if ($Request.Body.DriveItemId) { $Files = @($Request.Body.DriveItemId) } + } + + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'TenantFilter is required' } + }) + } + if (-not $Files -or $Files.Count -eq 0) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'At least one file (Files[] or DriveItemId) is required' } + }) + } + if ($CleanupMode -notin @('recycle', 'permanent')) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Invalid CleanupMode '$CleanupMode'. Use recycle or permanent." } + }) + } + + $Results = [System.Collections.Generic.List[object]]::new() + $Warnings = [System.Collections.Generic.List[string]]::new() + $TotalDeleted = 0 + $TotalErrors = 0 + $SuccessFiles = 0 + + # De-duplicate inputs so the same drive item is never processed (and its versions + # never deleted) more than once when callers send overlapping selections. + $SeenItems = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase) + + try { + foreach ($File in $Files) { + $ItemId = if ($File -is [string]) { $File } else { ($File.DriveItemId ?? $File.id) } + $ItemDriveId = if ($File -is [string]) { $DriveId } else { ($File.DriveId ?? $DriveId) } + $FileName = if ($File -is [string]) { $ItemId } else { ($File.FileName ?? $File.name ?? $ItemId) } + + if ($ItemId -and $ItemDriveId -and -not $SeenItems.Add("$ItemDriveId/$ItemId")) { + continue + } + + if (-not $ItemId -or -not $ItemDriveId) { + $Results.Add([PSCustomObject]@{ FileName = $FileName; DriveItemId = $ItemId; VersionsDeleted = 0; Status = 'Failed'; Error = 'Missing DriveItemId or DriveId' }) + $TotalErrors++ + continue + } + + $Cleanup = Remove-CIPPDriveItemVersion -TenantFilter $TenantFilter -DriveId $ItemDriveId -DriveItemId $ItemId -CleanupMode $CleanupMode -WhatIf $WhatIf + foreach ($W in $Cleanup.Warnings) { if ($Warnings -notcontains $W) { $Warnings.Add($W) } } + $TotalDeleted += $Cleanup.VersionsDeleted + $Status = if ($Cleanup.Errors.Count -gt 0) { 'Failed' } elseif ($WhatIf) { 'WhatIf' } else { 'Versions cleaned' } + if ($Cleanup.Errors.Count -gt 0) { $TotalErrors++ } else { $SuccessFiles++ } + $Results.Add([PSCustomObject]@{ + FileName = $FileName + DriveItemId = $ItemId + DriveId = $ItemDriveId + VersionCountBefore = $Cleanup.VersionCountBefore + VersionsDeleted = $Cleanup.VersionsDeleted + Status = $Status + Error = if ($Cleanup.Errors.Count -gt 0) { ($Cleanup.Errors -join '; ') } else { $null } + }) + } + + # $Results.Count reflects the de-duplicated set actually processed, which may be + # smaller than the raw $Files.Count when callers send overlapping selections. + $ProcessedCount = $Results.Count + + # Build a message that never claims success when work failed, and never claims a + # deletion happened during a dry run (WhatIf removes nothing). + $ResultsMessage = if ($WhatIf) { + "Dry run ($CleanupMode): would remove old versions from $SuccessFiles of $ProcessedCount file(s). No versions were deleted." + } elseif ($ProcessedCount -eq 0) { + 'No files were processed.' + } elseif ($TotalErrors -eq 0) { + "Deleted $TotalDeleted version(s) across $ProcessedCount file(s)." + } elseif ($SuccessFiles -eq 0) { + "Version cleanup failed for all $ProcessedCount file(s). See per-file errors." + } else { + "Deleted $TotalDeleted version(s) across $SuccessFiles of $ProcessedCount file(s); $TotalErrors file(s) failed." + } + + $Sev = if ($WhatIf) { 'Info' } elseif ($TotalErrors -gt 0 -and $SuccessFiles -eq 0) { 'Error' } elseif ($TotalErrors -gt 0) { 'Warning' } else { 'Info' } + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Version cleanup ($CleanupMode, WhatIf=$WhatIf): deleted $TotalDeleted versions across $ProcessedCount file(s), errors $TotalErrors." -Sev $Sev + + # A live run (not a dry run) where every processed file failed is a failure, not a + # success; surface it with a non-OK status so the caller does not see a green result. + $StatusCode = if (-not $WhatIf -and $ProcessedCount -gt 0 -and $SuccessFiles -eq 0) { + [HttpStatusCode]::InternalServerError + } else { + [HttpStatusCode]::OK + } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Version cleanup failed: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = @{ Results = "Version cleanup failed: $($ErrorMessage.NormalizedError)" } + }) + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @{ + Results = $ResultsMessage + WhatIf = $WhatIf + CleanupMode = $CleanupMode + VersionsDeleted = $TotalDeleted + Succeeded = $SuccessFiles + Errors = $TotalErrors + ProcessedCount = $ProcessedCount + Warnings = @($Warnings) + Files = @($Results) + } + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointInviteGuest.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointInviteGuest.ps1 new file mode 100644 index 0000000000..e7c22a0776 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointInviteGuest.ps1 @@ -0,0 +1,346 @@ +function Invoke-ExecSharePointInviteGuest { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $Headers = $Request.Headers + $APIName = $Request.Params.CIPPEndpoint + $TenantFilter = $Request.Body.tenantFilter + + try { + $ResultMessages = [System.Collections.Generic.List[string]]::new() + + # Step 1: Invite the guest user to the tenant + $RedirectUrl = if ($Request.Body.redirectUri) { $Request.Body.redirectUri } else { 'https://myapps.microsoft.com' } + $InviteBody = [pscustomobject]@{ + InvitedUserDisplayName = $Request.Body.displayName + InvitedUserEmailAddress = $Request.Body.mail + sendInvitationMessage = [bool]$Request.Body.sendInvite + inviteRedirectUrl = $RedirectUrl + } + $InviteBodyJson = ConvertTo-Json -Depth 10 -InputObject $InviteBody -Compress + $InviteResult = New-GraphPostRequest -uri 'https://graph.microsoft.com/beta/invitations' -tenantid $TenantFilter -type POST -body $InviteBodyJson -Verbose + + $GuestUserId = $InviteResult.invitedUser.id + $GuestUPN = $InviteResult.invitedUser.userPrincipalName + + if ($Request.Body.sendInvite -eq $true) { + $ResultMessages.Add("Invited guest $($Request.Body.displayName) ($($Request.Body.mail)) with email invite (Guest Access — B2B Collaboration).") + } else { + $ResultMessages.Add("Invited guest $($Request.Body.displayName) ($($Request.Body.mail)) without email invite (Guest Access — B2B Collaboration).") + } + + # Step 2: Add guest to the target resource + if ($Request.Body.TeamID -and $GuestUserId) { + # Teams mode: add guest to the Team's underlying M365 Group. + # Using Add-CIPPGroupMember (Group membership API) instead of the + # Teams conversation member API because it handles guest users and + # #EXT# UPN encoding reliably. Team ID = Group ID for M365 Teams. + $TeamID = $Request.Body.TeamID + $MemberIdentifier = if ($GuestUPN) { $GuestUPN } else { $GuestUserId } + + # Brief delay: the guest was just created, give Azure AD time to propagate + Start-Sleep -Seconds 5 + + try { + $null = Add-CIPPGroupMember -GroupType 'Team' -GroupID $TeamID -Member $MemberIdentifier -TenantFilter $TenantFilter -Headers $Headers + $ResultMessages.Add("Added guest as a member of the Team.") + } catch { + $TeamError = Get-CippException -Exception $_ + $ErrorMsg = [string]$TeamError.NormalizedError + [string]$TeamError.Message + if ($ErrorMsg -match '403' -or $ErrorMsg -match 'Authorization_RequestDenied' -or $ErrorMsg -match 'Access denied') { + $ResultMessages.Add("Guest invited to tenant, but could not add to Team: Insufficient permissions. Ensure the CIPP app has 'Group.ReadWrite.All' application permission and CPV consent has been refreshed for this tenant.") + } else { + $ResultMessages.Add("Guest invited to tenant, but could not add to Team: $($TeamError.NormalizedError)") + } + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to add guest to Team: $($TeamError.NormalizedError)" -Sev 'Warning' -LogData $TeamError + $TeamsAddWarning = $true + } + } elseif ($Request.Body.SharePointType -eq 'Group' -and $Request.Body.groupId -and $GuestUserId) { + # SharePoint Group-connected site: add guest to the M365 group + try { + $GroupId = $Request.Body.groupId + if ($GroupId -notmatch '^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$') { + # Escape single quotes for the OData filter (e.g. o'brien@contoso.com) + $SafeGroupId = $GroupId -replace "'", "''" + $GroupId = (New-GraphGetRequest -uri "https://graph.microsoft.com/beta/groups?`$filter=mail eq '$SafeGroupId' or proxyAddresses/any(x:endsWith(x,'$SafeGroupId')) or mailNickname eq '$SafeGroupId'" -ComplexFilter -tenantid $TenantFilter).id + } + + if ($GroupId) { + $MemberIdentifier = if ($GuestUPN) { $GuestUPN } else { $GuestUserId } + $null = Add-CIPPGroupMember -GroupType 'Team' -GroupID $GroupId -Member $MemberIdentifier -TenantFilter $TenantFilter -Headers $Headers + $ResultMessages.Add("Added guest as a member of the SharePoint site.") + } else { + $ResultMessages.Add("Warning: Could not resolve group ID for site membership.") + } + } catch { + $GroupError = Get-CippException -Exception $_ + $ResultMessages.Add("Guest invited, but failed to add to site group: $($GroupError.NormalizedError)") + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to add guest to site group: $($GroupError.NormalizedError)" -Sev 'Warning' -LogData $GroupError + } + } elseif ($Request.Body.SharePointType -ne 'Group') { + # Non-group site (Communication, classic Team, etc.): add guest to the + # site's Members permission group via SharePoint REST API. + $SiteUrl = $Request.Body.URL + if ($SiteUrl -and $GuestUPN) { + # Brief delay: the guest was just created, give Azure AD time to propagate + Start-Sleep -Seconds 5 + + try { + $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter + $SPScope = "$($SharePointInfo.SharePointUrl)/.default" + $SPHeaders = @{ 'Accept' = 'application/json;odata=verbose' } + $SPContentType = 'application/json;odata=verbose' + $LoginName = "i:0#.f|membership|$GuestUPN" + + # Ensure the guest user exists in the site's User Information List + # Note: SharePoint REST _api/web endpoints do not support app-only tokens, + # so we use delegated auth (SAM refresh token) instead of -AsApp $true. + $EnsureBody = ConvertTo-Json @{ logonName = $LoginName } -Compress + $null = New-GraphPostRequest -scope $SPScope -tenantid $TenantFilter -Uri "$SiteUrl/_api/web/ensureuser" -Type POST -Body $EnsureBody -ContentType $SPContentType -AddedHeaders $SPHeaders + + # Add the user to the site's default Members permission group + $AddBody = ConvertTo-Json @{ LoginName = $LoginName } -Compress + $null = New-GraphPostRequest -scope $SPScope -tenantid $TenantFilter -Uri "$SiteUrl/_api/web/associatedmembergroup/users" -Type POST -Body $AddBody -ContentType $SPContentType -AddedHeaders $SPHeaders + + $ResultMessages.Add("Added guest as a member of the SharePoint site.") + } catch { + $SiteError = Get-CippException -Exception $_ + $SiteErrorMsg = [string]$SiteError.NormalizedError + [string]$SiteError.Message + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "SharePoint REST failed for non-group site, attempting Graph API fallback: $($SiteError.NormalizedError)" -Sev 'Info' -LogData $SiteError + + # Graph API fallback: resolve the site via Graph and grant document + # library access using app-only permissions (Sites.FullControl.All). + # This bypasses the delegated-token issue that caused the REST failure. + $GraphFallbackSuccess = $false + $GraphError = $null + try { + $SiteUri = [System.Uri]$SiteUrl + $GraphSiteIdentifier = "$($SiteUri.Host):$($SiteUri.AbsolutePath.TrimEnd('/'))" + $GraphSite = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/sites/$GraphSiteIdentifier" -tenantid $TenantFilter -AsApp $true + + if ($GraphSite.id) { + $ShareBody = ConvertTo-Json @{ + requireSignIn = $true + sendInvitation = $false + roles = @('write') + recipients = @(@{ email = $Request.Body.mail }) + } -Compress + $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/sites/$($GraphSite.id)/drive/root/invite" -tenantid $TenantFilter -type POST -body $ShareBody -AsApp $true + $GraphFallbackSuccess = $true + $ResultMessages.Add("Could not add guest to the site members group directly (SharePoint REST denied access), but successfully granted document library access via Graph API.") + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Graph API fallback succeeded for non-group site guest invite" -Sev 'Info' + } + } catch { + $GraphError = Get-CippException -Exception $_ + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Graph API fallback also failed: $($GraphError.NormalizedError)" -Sev 'Warning' -LogData $GraphError + } + + if (-not $GraphFallbackSuccess) { + $GraphNote = if ($GraphError) { " Graph API fallback also failed: $($GraphError.NormalizedError)" } else { '' } + + if ($SiteErrorMsg -match 'ID3035' -or $SiteErrorMsg -match 'is malformed' -or $SiteErrorMsg -match 'Could not get token') { + $ResultMessages.Add("Guest invited to tenant, but could not add to site members: Failed to obtain a SharePoint token.$GraphNote Try running a CPV Refresh for this tenant.") + } elseif ($SiteErrorMsg -match 'Unsupported app only token') { + $ResultMessages.Add("Guest invited to tenant, but could not add to site members: SharePoint rejected the app-only token.$GraphNote This is an internal error -- please report it.") + } elseif ($SiteErrorMsg -match 'unauthorized' -or $SiteErrorMsg -match 'Access denied' -or $SiteErrorMsg -match '403') { + $ResultMessages.Add("Guest invited to tenant, but could not add to site members: SharePoint denied access.$GraphNote This may be a site-level permission issue. Try running a CPV Refresh for this tenant.") + } else { + $ResultMessages.Add("Guest invited to tenant, but could not add to site members: $($SiteError.NormalizedError)$GraphNote") + } + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to add guest to non-group site members. SharePoint: $($SiteError.NormalizedError)$(if ($GraphError) { " | Graph fallback: $($GraphError.NormalizedError)" })" -Sev 'Warning' -LogData $SiteError + $NonGroupSiteWarning = $true + } + } + } else { + $ResultMessages.Add("Guest invited to tenant. Site URL or guest identity not available for automatic site membership.") + $NonGroupSiteWarning = $true + } + } + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message ($ResultMessages -join ' ') -Sev 'Info' + $StatusCode = [HttpStatusCode]::OK + $Body = @{ Results = @($ResultMessages) } + if ($NonGroupSiteWarning) { + $Body['NonGroupSiteWarning'] = $true + } + if ($TeamsAddWarning) { + $Body['TeamsAddWarning'] = $true + } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $ErrorText = "Failed to invite guest. $($ErrorMessage.NormalizedError)" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $ErrorText -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::BadRequest + $Body = @{ Results = @($ErrorText) } + + # Attempt to diagnose domain collaboration errors + # Wrapped in safety try/catch so diagnostics never cause a 500 + try { + $NormError = [string]$ErrorMessage.NormalizedError + $RawError = [string]$ErrorMessage.Message + $IsDomainError = $NormError -like '*does not allow collaboration*' -or $NormError -like '*collaboration with the domain*' -or $RawError -like '*does not allow collaboration*' -or $RawError -like '*collaboration with the domain*' + + if ($IsDomainError -and $Request.Body.mail) { + $BlockedDomain = ($Request.Body.mail -split '@')[1] + $DiagList = [System.Collections.Generic.List[hashtable]]::new() + + # --- Check Entra External Collaboration settings --- + try { + $AuthPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $TenantFilter -AsApp $true + + if ($AuthPolicy.allowInvitesFrom -eq 'none') { + $DiagList.Add(@{ + source = 'Entra External Collaboration' + issue = 'Guest invitations are completely disabled' + detail = "The Guest invite restrictions setting is set to No one in the organization can invite guest users including admins. All guest invitations will be blocked regardless of domain." + fix = 'Change the guest invite restrictions to allow at least admins and users in the Guest Inviter role to send invitations.' + settingsPage = '/tenant/administration/cross-tenant-access/external-collaboration' + severity = 'error' + }) + } + + # Check B2B domain allow/block lists + try { + $B2BPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/legacy/policies' -tenantid $TenantFilter -AsApp $true + $B2BManagement = $B2BPolicy | Where-Object { $_.type -eq 6 } + if ($B2BManagement) { + $B2BDefinition = ($B2BManagement.definition | ConvertFrom-Json).B2BManagementPolicy + $DomainPolicy = $B2BDefinition.InvitationsAllowedAndBlockedDomainsPolicy + + if ($DomainPolicy.AllowedDomains -and $DomainPolicy.AllowedDomains.Count -gt 0) { + if ($BlockedDomain -notin $DomainPolicy.AllowedDomains) { + $DiagList.Add(@{ + source = 'Entra External Collaboration' + issue = "Domain '$BlockedDomain' is not in the allowed domains list" + detail = "The tenant uses a domain allow-list for guest invitations. Only these domains can be invited: $($DomainPolicy.AllowedDomains -join ', '). The domain '$BlockedDomain' is not on this list." + fix = "Add '$BlockedDomain' to the allowed domains list in External Collaboration settings, or switch to a block-list approach." + settingsPage = '/tenant/administration/cross-tenant-access/external-collaboration' + severity = 'error' + currentList = @($DomainPolicy.AllowedDomains) + listType = 'allowList' + }) + } + } + + if ($DomainPolicy.BlockedDomains -and $DomainPolicy.BlockedDomains.Count -gt 0) { + if ($BlockedDomain -in $DomainPolicy.BlockedDomains) { + $DiagList.Add(@{ + source = 'Entra External Collaboration' + issue = "Domain '$BlockedDomain' is explicitly blocked" + detail = "The domain '$BlockedDomain' appears in the blocked domains list for guest invitations." + fix = "Remove '$BlockedDomain' from the blocked domains list in External Collaboration settings." + settingsPage = '/tenant/administration/cross-tenant-access/external-collaboration' + severity = 'error' + currentList = @($DomainPolicy.BlockedDomains) + listType = 'blockList' + }) + } + } + } + } catch { + # B2B management policy may not be available in all tenants + } + } catch { + # Could not retrieve Entra External Collaboration settings + } + + if ($Request.Body.TeamID) { + # --- Check Teams guest access settings --- + try { + $ClientConfig = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsTeamsClientConfiguration' -CmdParams @{Identity = 'Global' } + if ($ClientConfig.AllowGuestUser -eq $false) { + $DiagList.Add(@{ + source = 'Teams Guest Access' + issue = 'Guest access is disabled for Microsoft Teams' + detail = 'The Teams tenant setting "Allow guest access" is currently disabled. Guests cannot be added to any teams until this is enabled.' + fix = 'Enable guest access in Teams Settings > Guest & Cloud Storage, or use the CIPP Teams Settings page.' + settingsPage = '/teams-share/teams/teams-settings' + severity = 'error' + }) + } + } catch { + # Teams settings may not be accessible + } + } else { + # --- Check SharePoint sharing settings --- + try { + $SPSettings = New-GraphGetRequest -tenantid $TenantFilter -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings' -AsApp $true + + if ($SPSettings.sharingCapability -eq 'disabled') { + $DiagList.Add(@{ + source = 'SharePoint Sharing Settings' + issue = 'External sharing is completely disabled for SharePoint' + detail = "SharePoint external sharing is set to Only people in your organization. No external guests can access any SharePoint content." + fix = "Enable external sharing in SharePoint Sharing Settings. At minimum, set it to Existing guests or New and existing guests." + settingsPage = '/teams-share/sharepoint/sharing-settings' + severity = 'error' + }) + } + + if ($SPSettings.sharingDomainRestrictionMode -eq 'allowList') { + $SPAllowed = @($SPSettings.sharingAllowedDomainList) + if ($SPAllowed.Count -gt 0 -and $BlockedDomain -notin $SPAllowed) { + $DiagList.Add(@{ + source = 'SharePoint Sharing Settings' + issue = "Domain '$BlockedDomain' is not in the SharePoint allowed domains list" + detail = "SharePoint uses a domain allow-list for external sharing. Permitted domains: $($SPAllowed -join ', '). The domain '$BlockedDomain' is not on this list." + fix = "Add '$BlockedDomain' to the SharePoint sharing allowed domains list." + settingsPage = '/teams-share/sharepoint/sharing-settings' + severity = 'warning' + currentList = $SPAllowed + listType = 'allowList' + }) + } + } elseif ($SPSettings.sharingDomainRestrictionMode -eq 'blockList') { + $SPBlocked = @($SPSettings.sharingBlockedDomainList) + if ($SPBlocked.Count -gt 0 -and $BlockedDomain -in $SPBlocked) { + $DiagList.Add(@{ + source = 'SharePoint Sharing Settings' + issue = "Domain '$BlockedDomain' is blocked in SharePoint sharing settings" + detail = "The domain '$BlockedDomain' appears in the SharePoint blocked domains list." + fix = "Remove '$BlockedDomain' from the SharePoint sharing blocked domains list." + settingsPage = '/teams-share/sharepoint/sharing-settings' + severity = 'warning' + currentList = $SPBlocked + listType = 'blockList' + }) + } + } + } catch { + # SharePoint settings may not be accessible + } + } + + # Fallback if no specific cause found + if ($DiagList.Count -eq 0) { + $ContextLabel = if ($Request.Body.TeamID) { 'Teams Settings' } else { 'SharePoint Sharing settings' } + $DiagList.Add(@{ + source = 'Unknown Policy' + issue = "Could not determine the specific policy blocking domain '$BlockedDomain'" + detail = "The domain '$BlockedDomain' is being blocked by a tenant policy, but the specific restriction could not be identified. This may be caused by a Cross-Tenant Access Policy, Conditional Access policy, or another setting." + fix = "Review External Collaboration settings, $ContextLabel, and Cross-Tenant Access Policies for domain restrictions." + settingsPage = '/tenant/administration/cross-tenant-access/external-collaboration' + severity = 'warning' + }) + } + + $Body.Diagnostics = @($DiagList) + $Body.BlockedDomain = $BlockedDomain + } + } catch { + # Diagnostics failed - log but do not affect the error response + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Guest invite diagnostics failed: $($_.Exception.Message)" -Sev 'Debug' + } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointMemberAudit.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointMemberAudit.ps1 new file mode 100644 index 0000000000..acc7351b03 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointMemberAudit.ps1 @@ -0,0 +1,414 @@ +function Invoke-ExecSharePointMemberAudit { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + $SiteId = $Request.Body.siteId + $SiteUrl = $Request.Body.siteUrl + $GroupId = $Request.Body.groupId + $SharePointType = $Request.Body.sharePointType + $Action = $Request.Body.action ?? 'audit' + + if (-not $TenantFilter -or -not $SiteId) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = @{ error = 'tenantFilter and siteId are required.' } } + }) + } + + $IsGroupConnected = ($SharePointType -like 'Group*') -or ($GroupId -match '^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$') + + try { + if ($Action -eq 'audit') { + $Issues = [System.Collections.Generic.List[hashtable]]::new() + + # --- Data source 1: SP User Information List --- + $UILUsers = @() + try { + $Lists = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/sites/$SiteId/lists?`$select=id,list,system" -tenantid $TenantFilter -AsApp $true + $UIList = $Lists | Where-Object { $_.list.template -eq 'userInformation' } | Select-Object -First 1 + if ($UIList.id) { + $UILItems = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/sites/$SiteId/lists/$($UIList.id)/items?`$expand=fields&`$filter=fields/ContentType eq 'Person'" -tenantid $TenantFilter -AsApp $true + $UILUsers = @($UILItems | Where-Object { + $email = $_.fields.EMail + $title = ($_.fields.Title ?? '').ToLower() + $excluded = @('system account', 'sharepoint app', 'nt service', 'everyone') + $isSys = $excluded | Where-Object { $title -like "*$_*" -or $title -like 'nt *' } + $email -and -not $isSys + }) + } + } catch { + Write-LogMessage -headers $Headers -API 'ExecSharePointMemberAudit' -tenant $TenantFilter -message "Failed to read User Information List: $($_.Exception.Message)" -Sev 'Warning' + } + + $UILEmailSet = @{} + foreach ($u in $UILUsers) { + $email = ($u.fields.EMail ?? '').ToLower() + if ($email) { $UILEmailSet[$email] = $u } + } + + # --- Data source 2: Drive root permissions --- + $DrivePerms = @() + try { + $DrivePerms = @(New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/sites/$SiteId/drive/root/permissions" -tenantid $TenantFilter -AsApp $true) + } catch { + Write-LogMessage -headers $Headers -API 'ExecSharePointMemberAudit' -tenant $TenantFilter -message "Failed to read drive permissions: $($_.Exception.Message)" -Sev 'Info' + } + + $DriveUserPerms = @($DrivePerms | Where-Object { + ($_.grantedToV2.user.email -or $_.grantedTo.user.email) -and -not $_.link + }) + + if ($IsGroupConnected -and $GroupId) { + # --- Group-connected: compare M365 Group members vs SP UIL --- + $GroupMembers = @() + try { + $GroupMembers = @(New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/groups/$GroupId/members?`$select=id,displayName,userPrincipalName,userType" -tenantid $TenantFilter -AsApp $true) + } catch { + Write-LogMessage -headers $Headers -API 'ExecSharePointMemberAudit' -tenant $TenantFilter -message "Failed to read group members: $($_.Exception.Message)" -Sev 'Warning' + } + + $GroupEmailSet = @{} + foreach ($m in $GroupMembers) { + $email = ($m.userPrincipalName ?? '').ToLower() + if ($email) { $GroupEmailSet[$email] = $m } + } + + # NOT_SYNCED: in group but not in SP UIL + foreach ($m in $GroupMembers) { + $email = ($m.userPrincipalName ?? '').ToLower() + if ($email -and -not $UILEmailSet.ContainsKey($email)) { + $Issues.Add(@{ + type = 'NOT_SYNCED' + severity = 'warning' + userEmail = $m.userPrincipalName + userName = $m.displayName + userId = $m.id + description = "Member of M365 group but not synced to SharePoint. They won't appear in the site until they visit or are synced." + repairAction = 'sync_to_sp' + }) + } + } + + # ORPHANED: in SP UIL but not in group (skip admins and system accounts) + foreach ($u in $UILUsers) { + $email = ($u.fields.EMail ?? '').ToLower() + $isAdmin = $u.fields.IsSiteAdmin + if ($email -and -not $isAdmin -and -not $GroupEmailSet.ContainsKey($email)) { + $Issues.Add(@{ + type = 'ORPHANED' + severity = 'info' + userEmail = $u.fields.EMail + userName = $u.fields.Title + userId = $null + description = 'Has SharePoint site access but is not in the M365 group. This may be intentional (direct permission) or leftover from a previous change.' + repairAction = 'add_to_group' + }) + } + } + + # DRIVE_ONLY: has drive invite permission but not in group + foreach ($dp in $DriveUserPerms) { + $dpEmail = (($dp.grantedToV2.user.email ?? $dp.grantedTo.user.email) ?? '').ToLower() + $dpName = $dp.grantedToV2.user.displayName ?? $dp.grantedTo.user.displayName ?? $dpEmail + if ($dpEmail -and -not $GroupEmailSet.ContainsKey($dpEmail)) { + $alreadyReported = $Issues | Where-Object { ($_.userEmail ?? '').ToLower() -eq $dpEmail } + if (-not $alreadyReported) { + $Issues.Add(@{ + type = 'DRIVE_ONLY' + severity = 'warning' + userEmail = $dpEmail + userName = $dpName + userId = $dp.grantedToV2.user.id ?? $dp.grantedTo.user.id + drivePermissionId = $dp.id + roles = $dp.roles -join ', ' + description = "Has document library access ($($dp.roles -join ', ')) via sharing but is not a member of the M365 group or site." + repairAction = 'promote_to_member' + }) + } + } + } + } else { + # --- Non-group site: compare SP role assignments vs drive permissions --- + $RoleAssignments = @() + if ($SiteUrl) { + try { + $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter + $SPScope = "$($SharePointInfo.SharePointUrl)/.default" + $RoleAssignments = @(New-GraphGetRequest -scope $SPScope -tenantid $TenantFilter -uri "$SiteUrl/_api/web/roleassignments?`$expand=Member,RoleDefinitionBindings" -NoAuthCheck $true -extraHeaders @{ 'Accept' = 'application/json' }) + } catch { + Write-LogMessage -headers $Headers -API 'ExecSharePointMemberAudit' -tenant $TenantFilter -message "Failed to read role assignments: $($_.Exception.Message)" -Sev 'Warning' + } + } + + # Build set of users who have actual site-level role assignments (PrincipalType 1 = User) + $RoleUserLogins = @{} + foreach ($ra in $RoleAssignments) { + if ($ra.Member.PrincipalType -eq 1) { + $loginName = ($ra.Member.LoginName ?? '').ToLower() + $memberEmail = '' + if ($loginName -match 'membership\|(.+)$') { + $memberEmail = $Matches[1].ToLower() + } + if ($memberEmail) { $RoleUserLogins[$memberEmail] = $ra } + } + } + + # DRIVE_ONLY: has drive invite permission but no site-level role assignment + foreach ($dp in $DriveUserPerms) { + $dpEmail = (($dp.grantedToV2.user.email ?? $dp.grantedTo.user.email) ?? '').ToLower() + $dpName = $dp.grantedToV2.user.displayName ?? $dp.grantedTo.user.displayName ?? $dpEmail + if ($dpEmail -and -not $RoleUserLogins.ContainsKey($dpEmail)) { + $Issues.Add(@{ + type = 'DRIVE_ONLY' + severity = 'warning' + userEmail = $dpEmail + userName = $dpName + userId = $dp.grantedToV2.user.id ?? $dp.grantedTo.user.id + drivePermissionId = $dp.id + roles = $dp.roles -join ', ' + description = "Has document library access ($($dp.roles -join ', ')) via sharing but has no site-level permissions. This was likely created by a fallback when normal member add failed." + repairAction = 'promote_to_member' + }) + } + } + + # NO_ROLE: in UIL but has no role assignment and no drive permission + $DriveEmailSet = @{} + foreach ($dp in $DriveUserPerms) { + $dpEmail = (($dp.grantedToV2.user.email ?? $dp.grantedTo.user.email) ?? '').ToLower() + if ($dpEmail) { $DriveEmailSet[$dpEmail] = $true } + } + + foreach ($u in $UILUsers) { + $email = ($u.fields.EMail ?? '').ToLower() + $isAdmin = $u.fields.IsSiteAdmin + if ($email -and -not $isAdmin -and -not $RoleUserLogins.ContainsKey($email) -and -not $DriveEmailSet.ContainsKey($email)) { + $Issues.Add(@{ + type = 'NO_ROLE' + severity = 'info' + userEmail = $u.fields.EMail + userName = $u.fields.Title + userId = $null + description = 'User appears in the site user list but has no permissions assigned. They were likely added via ensureuser but never granted a role.' + repairAction = 'assign_role' + }) + } + } + } + + $Results = @{ + siteType = if ($IsGroupConnected) { 'group-connected' } else { 'standalone' } + issueCount = $Issues.Count + issues = @($Issues) + } + $StatusCode = [HttpStatusCode]::OK + + } elseif ($Action -eq 'repair') { + $RepairType = $Request.Body.repairType + $UserEmail = $Request.Body.userEmail + $UserId = $Request.Body.userId + $DrivePermissionId = $Request.Body.drivePermissionId + + if (-not $RepairType -or -not $UserEmail) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = @{ error = 'repairType and userEmail are required for repair.' } } + }) + } + + $RepairResults = [System.Collections.Generic.List[string]]::new() + + switch ($RepairType) { + 'sync_to_sp' { + if (-not $SiteUrl) { throw 'siteUrl is required for sync_to_sp repair.' } + $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter + $SPScope = "$($SharePointInfo.SharePointUrl)/.default" + $SPHeaders = @{ 'Accept' = 'application/json;odata=verbose' } + $SPContentType = 'application/json;odata=verbose' + $LoginName = "i:0#.f|membership|$UserEmail" + $EnsureBody = ConvertTo-Json @{ logonName = $LoginName } -Compress + $null = New-GraphPostRequest -scope $SPScope -tenantid $TenantFilter -Uri "$SiteUrl/_api/web/ensureuser" -Type POST -Body $EnsureBody -ContentType $SPContentType -AddedHeaders $SPHeaders + $RepairResults.Add("Synced $UserEmail to SharePoint site.") + Write-LogMessage -headers $Headers -API 'ExecSharePointMemberAudit' -tenant $TenantFilter -message "sync_to_sp: ensureuser succeeded for $UserEmail on $SiteUrl" -Sev 'Info' + } + 'add_to_group' { + if (-not $GroupId) { throw 'groupId is required for add_to_group repair.' } + $Result = Add-CIPPGroupMember -GroupType 'Team' -GroupID $GroupId -Member $UserEmail -TenantFilter $TenantFilter -Headers $Headers + $RepairResults.Add("Added $UserEmail to M365 group. $Result") + + if ($SiteUrl) { + try { + $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter + $SPScope = "$($SharePointInfo.SharePointUrl)/.default" + $LoginName = "i:0#.f|membership|$UserEmail" + $EnsureBody = ConvertTo-Json @{ logonName = $LoginName } -Compress + $null = New-GraphPostRequest -scope $SPScope -tenantid $TenantFilter -Uri "$SiteUrl/_api/web/ensureuser" -Type POST -Body $EnsureBody -ContentType 'application/json;odata=verbose' -AddedHeaders @{ 'Accept' = 'application/json;odata=verbose' } + $RepairResults.Add('Also synced user to SharePoint site.') + } catch { + $RepairResults.Add("Note: user may take a few minutes to appear in the site members list.") + } + } + Write-LogMessage -headers $Headers -API 'ExecSharePointMemberAudit' -tenant $TenantFilter -message "add_to_group: added $UserEmail to group $GroupId" -Sev 'Info' + } + 'promote_to_member' { + if (-not $SiteUrl) { throw 'siteUrl is required for promote_to_member repair.' } + $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter + $SPScope = "$($SharePointInfo.SharePointUrl)/.default" + $SPHeaders = @{ 'Accept' = 'application/json;odata=verbose' } + $SPContentType = 'application/json;odata=verbose' + $LoginName = "i:0#.f|membership|$UserEmail" + + $EnsureBody = ConvertTo-Json @{ logonName = $LoginName } -Compress + $EnsuredUser = New-GraphPostRequest -scope $SPScope -tenantid $TenantFilter -Uri "$SiteUrl/_api/web/ensureuser" -Type POST -Body $EnsureBody -ContentType $SPContentType -AddedHeaders $SPHeaders + $SPUserId = $EnsuredUser.d.Id ?? $EnsuredUser.Id + + $MemberAdded = $false + + if ($IsGroupConnected -and $GroupId) { + try { + $Result = Add-CIPPGroupMember -GroupType 'Team' -GroupID $GroupId -Member $UserEmail -TenantFilter $TenantFilter -Headers $Headers + $MemberAdded = $true + $RepairResults.Add("Added $UserEmail to M365 group. $Result") + } catch { + Write-LogMessage -headers $Headers -API 'ExecSharePointMemberAudit' -tenant $TenantFilter -message "promote_to_member: group add failed, trying direct: $($_.Exception.Message)" -Sev 'Info' + } + } + + if (-not $MemberAdded) { + # Try associated member group first, then direct role assignment + try { + $AddBody = ConvertTo-Json @{ LoginName = $LoginName } -Compress + $null = New-GraphPostRequest -scope $SPScope -tenantid $TenantFilter -Uri "$SiteUrl/_api/web/associatedmembergroup/users" -Type POST -Body $AddBody -ContentType $SPContentType -AddedHeaders $SPHeaders + $MemberAdded = $true + $RepairResults.Add("Added $UserEmail to site members group.") + } catch { + Write-LogMessage -headers $Headers -API 'ExecSharePointMemberAudit' -tenant $TenantFilter -message "promote_to_member: member group failed: $($_.Exception.Message)" -Sev 'Info' + } + + if (-not $MemberAdded -and $SPUserId) { + $RoleDefs = New-GraphGetRequest -scope $SPScope -tenantid $TenantFilter -uri "$SiteUrl/_api/web/roledefinitions" -NoAuthCheck $true -extraHeaders @{ 'Accept' = 'application/json' } + $EditRole = $RoleDefs | Where-Object { $_.RoleTypeKind -eq 3 } | Select-Object -First 1 + if (-not $EditRole) { + $EditRole = $RoleDefs | Where-Object { $_.RoleTypeKind -eq 2 } | Select-Object -First 1 + } + if ($EditRole.Id) { + $null = New-GraphPostRequest -scope $SPScope -tenantid $TenantFilter -Uri "$SiteUrl/_api/web/roleassignments/addroleassignment(principalid=$SPUserId,roledefid=$($EditRole.Id))" -Type POST -Body '{}' -ContentType $SPContentType -AddedHeaders $SPHeaders + $MemberAdded = $true + $RepairResults.Add("Assigned $($EditRole.Name) role to $UserEmail on the site.") + } + } + } + + if (-not $MemberAdded) { + throw "Could not add $UserEmail as a proper site member." + } + + # Remove the drive-only permission now that proper membership is in place + if ($DrivePermissionId) { + try { + $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/sites/$SiteId/drive/root/permissions/$DrivePermissionId" -tenantid $TenantFilter -type DELETE -body '{}' -AsApp $true + $RepairResults.Add('Removed the old document library sharing permission.') + } catch { + $RepairResults.Add('Note: could not remove the old drive sharing permission. It can be cleaned up manually.') + Write-LogMessage -headers $Headers -API 'ExecSharePointMemberAudit' -tenant $TenantFilter -message "Failed to remove drive permission $DrivePermissionId : $($_.Exception.Message)" -Sev 'Info' + } + } + + Write-LogMessage -headers $Headers -API 'ExecSharePointMemberAudit' -tenant $TenantFilter -message "promote_to_member: completed for $UserEmail on $SiteUrl" -Sev 'Info' + } + 'assign_role' { + if (-not $SiteUrl) { throw 'siteUrl is required for assign_role repair.' } + $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter + $SPScope = "$($SharePointInfo.SharePointUrl)/.default" + $SPHeaders = @{ 'Accept' = 'application/json;odata=verbose' } + $SPContentType = 'application/json;odata=verbose' + $LoginName = "i:0#.f|membership|$UserEmail" + + $EnsureBody = ConvertTo-Json @{ logonName = $LoginName } -Compress + $EnsuredUser = New-GraphPostRequest -scope $SPScope -tenantid $TenantFilter -Uri "$SiteUrl/_api/web/ensureuser" -Type POST -Body $EnsureBody -ContentType $SPContentType -AddedHeaders $SPHeaders + $SPUserId = $EnsuredUser.d.Id ?? $EnsuredUser.Id + + if (-not $SPUserId) { throw "Could not resolve SharePoint user ID for $UserEmail." } + + $RoleDefs = New-GraphGetRequest -scope $SPScope -tenantid $TenantFilter -uri "$SiteUrl/_api/web/roledefinitions" -NoAuthCheck $true -extraHeaders @{ 'Accept' = 'application/json' } + $EditRole = $RoleDefs | Where-Object { $_.RoleTypeKind -eq 3 } | Select-Object -First 1 + if (-not $EditRole) { + $EditRole = $RoleDefs | Where-Object { $_.RoleTypeKind -eq 2 } | Select-Object -First 1 + } + if (-not $EditRole.Id) { throw "No suitable role definition found on $SiteUrl." } + + $null = New-GraphPostRequest -scope $SPScope -tenantid $TenantFilter -Uri "$SiteUrl/_api/web/roleassignments/addroleassignment(principalid=$SPUserId,roledefid=$($EditRole.Id))" -Type POST -Body '{}' -ContentType $SPContentType -AddedHeaders $SPHeaders + $RepairResults.Add("Assigned $($EditRole.Name) role to $UserEmail.") + Write-LogMessage -headers $Headers -API 'ExecSharePointMemberAudit' -tenant $TenantFilter -message "assign_role: assigned $($EditRole.Name) to $UserEmail on $SiteUrl" -Sev 'Info' + } + 'repair_all' { + $IssuesToRepair = $Request.Body.issues + if (-not $IssuesToRepair -or $IssuesToRepair.Count -eq 0) { + throw 'No issues provided for repair_all.' + } + + foreach ($Issue in $IssuesToRepair) { + try { + $RepairRequest = @{ + Headers = $Request.Headers + Body = @{ + tenantFilter = $TenantFilter + siteId = $SiteId + siteUrl = $SiteUrl + groupId = $GroupId + sharePointType = $SharePointType + action = 'repair' + repairType = $Issue.repairAction + userEmail = $Issue.userEmail + userId = $Issue.userId + drivePermissionId = $Issue.drivePermissionId + } + } + $SubResult = Invoke-ExecSharePointMemberAudit -Request ([PSCustomObject]$RepairRequest) -TriggerMetadata $TriggerMetadata + $SubBody = $SubResult.Body + if ($SubBody.Results.results) { + $RepairResults.AddRange([string[]]$SubBody.Results.results) + } else { + $RepairResults.Add("Repaired $($Issue.userEmail) ($($Issue.repairAction)).") + } + } catch { + $RepairResults.Add("Failed to repair $($Issue.userEmail): $($_.Exception.Message)") + Write-LogMessage -headers $Headers -API 'ExecSharePointMemberAudit' -tenant $TenantFilter -message "repair_all: failed for $($Issue.userEmail): $($_.Exception.Message)" -Sev 'Warning' + } + } + } + default { + throw "Unknown repairType: $RepairType" + } + } + + $Results = @{ + action = 'repair' + results = @($RepairResults) + } + $StatusCode = [HttpStatusCode]::OK + + } else { + throw "Unknown action: $Action. Use 'audit' or 'repair'." + } + } catch { + $ErrorMsg = $_.Exception.Message + $NormalizedError = Get-NormalizedError -Message $ErrorMsg + Write-LogMessage -headers $Headers -API 'ExecSharePointMemberAudit' -tenant $TenantFilter -message "Member audit failed: $ErrorMsg" -Sev 'Error' + $Results = @{ error = $NormalizedError } + $StatusCode = [HttpStatusCode]::InternalServerError + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @{ Results = $Results } + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointPerms.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointPerms.ps1 index 55ee06f928..2be39399f4 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointPerms.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointPerms.ps1 @@ -42,11 +42,11 @@ Function Invoke-ExecSharePointPerms { # One entry per user - CippApiResults renders each with its own success/error state, # so multi-user grants no longer collapse into a single run-on string. $Result = @($State) - $StatusCode = [HttpStatusCode]::OK + $StatusCode = Get-CippBulkStatusCode -Total $Result.Count -Failed $Result.Where({ $_.state -eq 'error' }).Count } catch { $ErrorMessage = $_.Exception.Message $Result = "Failed. Error: $ErrorMessage" - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = Get-CippErrorStatusCode -ErrorRecord $_ } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointTemplate.ps1 index 3a8c38165e..515e9ab191 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointTemplate.ps1 @@ -103,6 +103,7 @@ function Invoke-ExecSharePointTemplate { $Body = @{ 'Results' = 'No template found with the provided ID' } + $StatusCode = [HttpStatusCode]::NotFound } } catch { $Body = @{ @@ -135,22 +136,41 @@ function Invoke-ExecSharePointTemplate { try { $TemplateId = $Request.Body.TemplateId $SiteOwner = $Request.Body.SiteOwner - $Template = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'SharePointTemplate' and RowKey eq '$TemplateId'" - if (-not $Template) { throw 'No template found with the provided ID' } - $TemplateData = $Template.JSON | ConvertFrom-Json - if (-not $SiteOwner) { throw 'A site/team owner is required to deploy this template.' } + if (-not $SiteOwner) { + $Body = @{ Results = 'Failed to queue template deployment: A site/team owner is required to deploy this template.' } + $StatusCode = [HttpStatusCode]::BadRequest + break + } $TenantFilter = $Request.Body.tenantFilter if ([string]::IsNullOrWhiteSpace($TenantFilter)) { - throw 'A tenant is required to deploy this template.' + $Body = @{ Results = 'Failed to queue template deployment: A tenant is required to deploy this template.' } + $StatusCode = [HttpStatusCode]::BadRequest + break } # AnyTenant: deployment provisions sites in this tenant; enforce scope - $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList + try { + $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList + } catch { + $Body = @{ Results = "Failed to queue template deployment: $($_.Exception.Message)" } + $StatusCode = [HttpStatusCode]::Forbidden + break + } if ($AllowedTenants -notcontains 'AllTenants' -and -not (Get-Tenants -TenantFilter $TenantFilter)) { - throw 'Access to this tenant is not allowed' + $Body = @{ Results = 'Failed to queue template deployment: Access to this tenant is not allowed' } + $StatusCode = [HttpStatusCode]::Forbidden + break } + $Template = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'SharePointTemplate' and RowKey eq '$TemplateId'" + if (-not $Template) { + $Body = @{ Results = 'Failed to queue template deployment: No template found with the provided ID' } + $StatusCode = [HttpStatusCode]::NotFound + break + } + $TemplateData = $Template.JSON | ConvertFrom-Json + # Pre-create a status row so the frontend can poll live progress from queue time. $JobId = New-CIPPAsyncDeployment -Names @($TenantFilter) -StepTitles @(@($TemplateData.siteTemplates) | ForEach-Object { $_.displayName }) -Source 'SharePointTemplate' @@ -180,17 +200,21 @@ function Invoke-ExecSharePointTemplate { Write-LogMessage -headers $Headers -API $APIName -message "Queued SharePoint template deployment '$($TemplateData.templateName)' for $TenantFilter" -Sev 'Info' } catch { $Body = @{ Results = "Failed to queue template deployment: $($_.Exception.Message)" } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } } 'DeployStatus' { try { $JobId = $Request.Query.DeploymentId ?? $Request.Body.DeploymentId - if (-not $JobId) { throw 'DeploymentId is required' } + if (-not $JobId) { + $Body = @{ Results = 'Failed to get deployment status: DeploymentId is required' } + $StatusCode = [HttpStatusCode]::BadRequest + break + } $Body = @(Get-CIPPAsyncDeployment -JobId $JobId) } catch { $Body = @{ Results = "Failed to get deployment status: $($_.Exception.Message)" } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } } default { diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharingTroubleshoot.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharingTroubleshoot.ps1 new file mode 100644 index 0000000000..32da867e2f --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharingTroubleshoot.ps1 @@ -0,0 +1,504 @@ +function Invoke-ExecSharingTroubleshoot { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + $UserEmail = $Request.Body.userEmail + $ResourceUrl = $Request.Body.resourceUrl + $ResourceType = $Request.Body.resourceType ?? 'auto' + + $MSAConsumerTenantId = '9188040d-6c67-4c5b-b112-36a304b66dad' + + if (-not $TenantFilter -or -not $UserEmail) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'tenantFilter and userEmail are required.' } + }) + } + + try { + $Domain = ($UserEmail -split '@')[1] + $Checks = [System.Collections.Generic.List[hashtable]]::new() + $OverallStatus = 'pass' + + # --- Check 1: Domain type classification --- + $DomainType = 'unknown' + $ExternalTenantId = $null + try { + $OidcConfig = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$Domain/.well-known/openid-configuration" -Method GET -ErrorAction Stop + $ResolvedTenantId = ($OidcConfig.issuer -split '/')[3] + if (-not $ResolvedTenantId -or $ResolvedTenantId -eq $MSAConsumerTenantId) { + $DomainType = 'consumer' + $Checks.Add(@{ + step = 'Domain Classification' + status = 'info' + detail = "'$Domain' is a personal email domain (consumer account). The user must use Guest Access (B2B Collaboration) and will authenticate via Email One-Time Passcode." + category = 'Domain' + }) + } else { + $DomainType = 'organizational' + $ExternalTenantId = $ResolvedTenantId + $Checks.Add(@{ + step = 'Domain Classification' + status = 'pass' + detail = "'$Domain' belongs to Microsoft 365 tenant $ResolvedTenantId. Both Guest Access and External Access are available." + category = 'Domain' + }) + } + } catch { + $Checks.Add(@{ + step = 'Domain Classification' + status = 'warning' + detail = "Could not resolve '$Domain' via OIDC discovery. This may be a personal email or a domain without Microsoft 365." + category = 'Domain' + }) + } + + # --- Check 2: Guest account existence --- + $GuestUser = $null + try { + $EncodedEmail = $UserEmail -replace '#', '%23' + $UserLookup = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$filter=mail eq '$EncodedEmail' or userPrincipalName eq '$EncodedEmail'&`$select=id,displayName,userPrincipalName,userType,accountEnabled,externalUserState,signInActivity" -tenantid $TenantFilter -AsApp $true + $GuestUser = if ($UserLookup -is [array]) { $UserLookup[0] } else { $UserLookup } + + if ($GuestUser) { + $Checks.Add(@{ + step = 'Guest Account Exists' + status = 'pass' + detail = "Found user '$($GuestUser.displayName)' (ID: $($GuestUser.id), Type: $($GuestUser.userType), State: $($GuestUser.externalUserState))." + category = 'Identity' + }) + } else { + $Checks.Add(@{ + step = 'Guest Account Exists' + status = 'fail' + detail = "No user account found for '$UserEmail' in this tenant. The user must be invited as a guest first." + fix = 'Invite the user as a guest using the External Access Wizard or the guest invite dialog on a site/team details page.' + category = 'Identity' + }) + $OverallStatus = 'fail' + } + } catch { + $Checks.Add(@{ + step = 'Guest Account Exists' + status = 'warning' + detail = "Could not look up user '$UserEmail'. Check CIPP permissions (User.Read.All)." + category = 'Identity' + }) + } + + # --- Check 3: Guest account status --- + if ($GuestUser) { + if (-not $GuestUser.accountEnabled) { + $Checks.Add(@{ + step = 'Account Status' + status = 'fail' + detail = "The guest account is DISABLED. The user cannot sign in." + fix = 'Enable the guest account in Identity > Users or via the Edit User page.' + category = 'Identity' + }) + $OverallStatus = 'fail' + } elseif ($GuestUser.externalUserState -eq 'PendingAcceptance') { + $Checks.Add(@{ + step = 'Account Status' + status = 'warning' + detail = "The guest invitation is still pending acceptance. The user has not yet redeemed their invitation." + fix = 'Ask the user to check their email for the invitation, or re-send the invitation.' + category = 'Identity' + }) + if ($OverallStatus -ne 'fail') { $OverallStatus = 'warning' } + } else { + $LastSignIn = $GuestUser.signInActivity.lastSignInDateTime + $SignInInfo = if ($LastSignIn) { "Last sign-in: $LastSignIn" } else { 'No sign-in recorded' } + $Checks.Add(@{ + step = 'Account Status' + status = 'pass' + detail = "Guest account is enabled and active. $SignInInfo." + category = 'Identity' + }) + } + } + + # --- Check 4: Entra External Collaboration --- + try { + $AuthPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $TenantFilter -AsApp $true + + if ($AuthPolicy.allowInvitesFrom -eq 'none') { + $Checks.Add(@{ + step = 'Guest Invite Policy' + status = 'fail' + detail = 'Guest invitations are completely disabled. No one can invite external users.' + fix = 'Change guest invite restrictions to allow at least admins to invite.' + settingsPage = '/tenant/administration/cross-tenant-access/external-collaboration' + category = 'Entra Policy' + }) + $OverallStatus = 'fail' + } else { + $Checks.Add(@{ + step = 'Guest Invite Policy' + status = 'pass' + detail = "Guest invite policy: $($AuthPolicy.allowInvitesFrom)." + settingsPage = '/tenant/administration/cross-tenant-access/external-collaboration' + category = 'Entra Policy' + }) + } + } catch { + $Checks.Add(@{ + step = 'Guest Invite Policy' + status = 'warning' + detail = 'Could not retrieve Entra authorization policy.' + category = 'Entra Policy' + }) + } + + # --- Check 5: Entra B2B domain restrictions --- + try { + $B2BPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/legacy/policies' -tenantid $TenantFilter -AsApp $true + $B2BManagement = $B2BPolicy | Where-Object { $_.type -eq 6 } + if ($B2BManagement) { + $B2BDefinition = ($B2BManagement.definition | ConvertFrom-Json).B2BManagementPolicy + $DomainPolicy = $B2BDefinition.InvitationsAllowedAndBlockedDomainsPolicy + $DomainBlocked = $false + + if ($DomainPolicy.AllowedDomains -and $DomainPolicy.AllowedDomains.Count -gt 0 -and $Domain -notin $DomainPolicy.AllowedDomains) { + $Checks.Add(@{ + step = 'Entra Domain Restrictions' + status = 'fail' + detail = "Domain '$Domain' is NOT in the Entra allowed domains list. Allowed: $($DomainPolicy.AllowedDomains -join ', ')." + fix = "Add '$Domain' to the allowed domains list in External Collaboration settings." + settingsPage = '/tenant/administration/cross-tenant-access/external-collaboration' + category = 'Entra Policy' + }) + $OverallStatus = 'fail' + $DomainBlocked = $true + } + + if ($DomainPolicy.BlockedDomains -and $DomainPolicy.BlockedDomains.Count -gt 0 -and $Domain -in $DomainPolicy.BlockedDomains) { + $Checks.Add(@{ + step = 'Entra Domain Restrictions' + status = 'fail' + detail = "Domain '$Domain' is explicitly BLOCKED for guest invitations." + fix = "Remove '$Domain' from the blocked domains list." + settingsPage = '/tenant/administration/cross-tenant-access/external-collaboration' + category = 'Entra Policy' + }) + $OverallStatus = 'fail' + $DomainBlocked = $true + } + + if (-not $DomainBlocked) { + $Checks.Add(@{ + step = 'Entra Domain Restrictions' + status = 'pass' + detail = "Domain '$Domain' is permitted by Entra B2B domain policies." + category = 'Entra Policy' + }) + } + } else { + $Checks.Add(@{ + step = 'Entra Domain Restrictions' + status = 'pass' + detail = 'No B2B domain restrictions configured. All domains are permitted.' + category = 'Entra Policy' + }) + } + } catch { + $Checks.Add(@{ + step = 'Entra Domain Restrictions' + status = 'warning' + detail = 'Could not retrieve B2B management policy.' + category = 'Entra Policy' + }) + } + + # --- Check 6: Email OTP --- + if ($DomainType -eq 'consumer') { + try { + $EmailOTPPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/email' -tenantid $TenantFilter -AsApp $true + if ($EmailOTPPolicy.state -ne 'enabled') { + $Checks.Add(@{ + step = 'Email OTP Authentication' + status = 'fail' + detail = "Email OTP is NOT enabled. Personal email users ('$Domain') cannot authenticate without it." + fix = 'Enable Email One-Time Passcode in Authentication Methods.' + category = 'Authentication' + }) + $OverallStatus = 'fail' + } else { + $Checks.Add(@{ + step = 'Email OTP Authentication' + status = 'pass' + detail = 'Email OTP is enabled. Personal email guests can authenticate.' + category = 'Authentication' + }) + } + } catch { + $Checks.Add(@{ + step = 'Email OTP Authentication' + status = 'warning' + detail = 'Could not check Email OTP policy.' + category = 'Authentication' + }) + } + } + + # --- Check 7: SharePoint sharing settings --- + if ($ResourceType -in @('sharepoint', 'auto')) { + try { + $SPSettings = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings' -tenantid $TenantFilter -AsApp $true + + if ($SPSettings.sharingCapability -eq 'disabled') { + $Checks.Add(@{ + step = 'SharePoint External Sharing' + status = 'fail' + detail = 'SharePoint external sharing is DISABLED. No external users can access SharePoint content.' + fix = "Set sharing to at least 'Existing guests' or 'New and existing guests'." + settingsPage = '/teams-share/sharepoint/sharing-settings' + category = 'SharePoint' + }) + $OverallStatus = 'fail' + } elseif ($SPSettings.sharingCapability -eq 'existingExternalUserSharingOnly' -and -not $GuestUser) { + $Checks.Add(@{ + step = 'SharePoint External Sharing' + status = 'fail' + detail = "SharePoint is set to 'Existing guests' only, but this user is not yet a guest. Invite the user first." + fix = "Invite the user as a guest, or change sharing to 'New and existing guests'." + settingsPage = '/teams-share/sharepoint/sharing-settings' + category = 'SharePoint' + }) + $OverallStatus = 'fail' + } else { + $Checks.Add(@{ + step = 'SharePoint External Sharing' + status = 'pass' + detail = "SharePoint sharing: $($SPSettings.sharingCapability)." + settingsPage = '/teams-share/sharepoint/sharing-settings' + category = 'SharePoint' + }) + } + + if ($SPSettings.sharingDomainRestrictionMode -eq 'allowList') { + $SPAllowed = @($SPSettings.sharingAllowedDomainList) + if ($SPAllowed.Count -gt 0 -and $Domain -notin $SPAllowed) { + $Checks.Add(@{ + step = 'SharePoint Domain Restrictions' + status = 'fail' + detail = "Domain '$Domain' is NOT in the SharePoint allowed list. Allowed: $($SPAllowed -join ', ')." + fix = "Add '$Domain' to the SharePoint sharing allowed domains." + settingsPage = '/teams-share/sharepoint/sharing-settings' + category = 'SharePoint' + }) + $OverallStatus = 'fail' + } else { + $Checks.Add(@{ + step = 'SharePoint Domain Restrictions' + status = 'pass' + detail = "Domain '$Domain' is allowed in SharePoint sharing." + category = 'SharePoint' + }) + } + } elseif ($SPSettings.sharingDomainRestrictionMode -eq 'blockList') { + $SPBlocked = @($SPSettings.sharingBlockedDomainList) + if ($SPBlocked.Count -gt 0 -and $Domain -in $SPBlocked) { + $Checks.Add(@{ + step = 'SharePoint Domain Restrictions' + status = 'fail' + detail = "Domain '$Domain' is BLOCKED in SharePoint sharing." + fix = "Remove '$Domain' from the blocked list." + settingsPage = '/teams-share/sharepoint/sharing-settings' + category = 'SharePoint' + }) + $OverallStatus = 'fail' + } + } + } catch { + $Checks.Add(@{ + step = 'SharePoint External Sharing' + status = 'warning' + detail = 'Could not retrieve SharePoint settings.' + category = 'SharePoint' + }) + } + } + + # --- Check 8: Teams guest access --- + if ($ResourceType -in @('teams', 'auto')) { + try { + $TeamsConfig = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsTeamsClientConfiguration' -CmdParams @{Identity = 'Global' } + if ($TeamsConfig.AllowGuestUser -eq $false) { + $Checks.Add(@{ + step = 'Teams Guest Access' + status = 'fail' + detail = 'Guest access is DISABLED for Teams. Guests cannot join any teams.' + fix = "Enable 'Allow guest access' in Teams Settings." + settingsPage = '/teams-share/teams/teams-settings' + category = 'Teams' + }) + $OverallStatus = 'fail' + } else { + $Checks.Add(@{ + step = 'Teams Guest Access' + status = 'pass' + detail = 'Teams guest access is enabled.' + category = 'Teams' + }) + } + } catch { + $Checks.Add(@{ + step = 'Teams Guest Access' + status = 'warning' + detail = 'Could not retrieve Teams settings.' + category = 'Teams' + }) + } + } + + # --- Check 9: Cross-tenant access (for organizational domains + shared channels) --- + if ($DomainType -eq 'organizational' -and $ExternalTenantId) { + try { + $DefaultCTA = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default' -tenantid $TenantFilter -AsApp $true + $DefaultB2BCollab = $DefaultCTA.b2bCollaborationInbound + $CollabBlocked = ($DefaultB2BCollab.usersAndGroups.accessType -eq 'blocked' -and ($DefaultB2BCollab.usersAndGroups.targets | Where-Object { $_.target -eq 'AllUsers' })) + + $PartnerPolicy = $null + try { + $PartnerPolicy = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/partners/$ExternalTenantId" -tenantid $TenantFilter -AsApp $true + } catch { } + + if ($PartnerPolicy) { + $PartnerCollab = $PartnerPolicy.b2bCollaborationInbound + $InheritDefault = -not $PartnerCollab -or ($null -eq $PartnerCollab.usersAndGroups) + if ($InheritDefault -and $CollabBlocked) { + $Checks.Add(@{ + step = 'Cross-Tenant B2B Collaboration' + status = 'fail' + detail = "Partner policy for '$Domain' inherits defaults which block B2B collaboration inbound." + fix = 'Set B2B collaboration inbound to Allow on the partner policy.' + settingsPage = "/tenant/administration/cross-tenant-access/partners/partner?tenantId=$ExternalTenantId" + category = 'Cross-Tenant' + }) + $OverallStatus = 'fail' + } else { + $Checks.Add(@{ + step = 'Cross-Tenant B2B Collaboration' + status = 'pass' + detail = "B2B collaboration inbound is allowed for '$Domain'." + category = 'Cross-Tenant' + }) + } + } elseif ($CollabBlocked) { + $Checks.Add(@{ + step = 'Cross-Tenant B2B Collaboration' + status = 'fail' + detail = "No partner policy for '$Domain' and defaults block B2B collaboration inbound." + fix = "Create a partner policy for '$Domain' with B2B collaboration inbound allowed." + settingsPage = '/tenant/administration/cross-tenant-access/partners' + category = 'Cross-Tenant' + }) + $OverallStatus = 'fail' + } else { + $Checks.Add(@{ + step = 'Cross-Tenant B2B Collaboration' + status = 'pass' + detail = 'Default policy allows B2B collaboration inbound.' + category = 'Cross-Tenant' + }) + } + } catch { + $Checks.Add(@{ + step = 'Cross-Tenant B2B Collaboration' + status = 'warning' + detail = 'Could not retrieve cross-tenant access policies.' + category = 'Cross-Tenant' + }) + } + } + + # --- Check 10: Site-level membership (if resource URL provided) --- + if ($ResourceUrl -and $GuestUser) { + try { + $SiteId = $null + if ($ResourceUrl -match 'sites/([^/]+)') { + $SitePath = $Matches[1] + $SiteInfo = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/sites/root:/$SitePath" -tenantid $TenantFilter -AsApp $true + $SiteId = $SiteInfo.id + } + + if ($SiteId) { + $SiteMembers = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/sites/$SiteId/permissions" -tenantid $TenantFilter -AsApp $true + $IsMember = $SiteMembers | Where-Object { + $_.grantedToIdentitiesV2 | Where-Object { + $_.user.id -eq $GuestUser.id + } + } + + if ($IsMember) { + $Checks.Add(@{ + step = 'Site Membership' + status = 'pass' + detail = "The guest has permissions on this site." + category = 'Resource Access' + }) + } else { + $Checks.Add(@{ + step = 'Site Membership' + status = 'fail' + detail = "The guest does not have permissions on this site. They need to be added as a member." + fix = 'Add the guest as a site member from the site details page.' + category = 'Resource Access' + }) + if ($OverallStatus -ne 'fail') { $OverallStatus = 'warning' } + } + } + } catch { + $Checks.Add(@{ + step = 'Site Membership' + status = 'warning' + detail = 'Could not check site-level membership. The user may need to be added manually.' + category = 'Resource Access' + }) + } + } + + $FailCount = ($Checks | Where-Object { $_.status -eq 'fail' }).Count + $WarnCount = ($Checks | Where-Object { $_.status -eq 'warning' }).Count + $PassCount = ($Checks | Where-Object { $_.status -eq 'pass' }).Count + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Sharing troubleshoot for '$UserEmail': $PassCount pass, $FailCount fail, $WarnCount warning" -Sev 'Info' + + $StatusCode = [HttpStatusCode]::OK + $Body = @{ + Results = @{ + email = $UserEmail + domain = $Domain + domainType = $DomainType + overallStatus = $OverallStatus + checks = @($Checks) + summary = @{ + totalChecks = $Checks.Count + passed = $PassCount + failed = $FailCount + warnings = $WarnCount + } + } + } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Sharing troubleshoot failed: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError + $Body = @{ Results = "Sharing troubleshoot failed: $($ErrorMessage.NormalizedError)" } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSiteBrowserActions.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSiteBrowserActions.ps1 index 950ab99041..7f2f6d9c1d 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSiteBrowserActions.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSiteBrowserActions.ps1 @@ -20,13 +20,59 @@ function Invoke-ExecSiteBrowserActions { $SiteId = $Request.Body.SiteId $Action = $Request.Body.Action - try { - if ([string]::IsNullOrWhiteSpace($TenantFilter)) { throw 'tenantFilter is required.' } - if ([string]::IsNullOrWhiteSpace($Action)) { throw 'Action is required.' } - if ([string]::IsNullOrWhiteSpace($SiteUrl) -and [string]::IsNullOrWhiteSpace($SiteId)) { - throw 'SiteUrl or SiteId is required.' + if ([string]::IsNullOrWhiteSpace($TenantFilter)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'tenantFilter is required.' } }) + } + if ([string]::IsNullOrWhiteSpace($Action)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'Action is required.' } }) + } + if ([string]::IsNullOrWhiteSpace($SiteUrl) -and [string]::IsNullOrWhiteSpace($SiteId)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'SiteUrl or SiteId is required.' } }) + } + if ([string]$Action -notin @('StartVersionCleanup', 'GetVersionCleanupStatus', 'GetSiteProperties')) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = "Unknown Action '$Action'. Supported: StartVersionCleanup, GetVersionCleanupStatus, GetSiteProperties." } }) + } + + if ([string]$Action -eq 'StartVersionCleanup') { + $BatchDeleteMode = ($Request.Body.BatchDeleteMode ?? 2) -as [int] + if ($Request.Body.BatchDeleteMode -is [PSCustomObject] -and $Request.Body.BatchDeleteMode.value) { + $BatchDeleteMode = $Request.Body.BatchDeleteMode.value -as [int] } + $DeleteOlderThanDays = ($Request.Body.DeleteOlderThanDays ?? -1) -as [int] + $MajorVersionLimit = ($Request.Body.MajorVersionLimit ?? -1) -as [int] + $MajorWithMinorVersionsLimit = ($Request.Body.MajorWithMinorVersionsLimit ?? -1) -as [int] + $SyncListPolicy = $Request.Body.SyncListPolicy -eq $true + + switch ($BatchDeleteMode) { + 0 { + if ($DeleteOlderThanDays -lt 30) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'DeleteOlderThanDays must be at least 30 when using Delete Older Than Days mode.' } }) + } + $MajorVersionLimit = -1 + $MajorWithMinorVersionsLimit = -1 + } + 1 { + if ($MajorVersionLimit -lt 1) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'MajorVersionLimit is required when using Count Limits mode.' } }) + } + if ($MajorWithMinorVersionsLimit -lt 0) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'MajorWithMinorVersionsLimit is required when using Count Limits mode.' } }) + } + $DeleteOlderThanDays = -1 + } + 2 { + $DeleteOlderThanDays = -1 + $MajorVersionLimit = -1 + $MajorWithMinorVersionsLimit = -1 + } + default { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = "Unsupported BatchDeleteMode '$BatchDeleteMode'. Use 0 (DeleteOlderThanDays), 1 (CountLimits), or 2 (SyncPolicy)." } }) + } + } + } + + try { if (-not [string]::IsNullOrWhiteSpace($SiteUrl)) { $ResolvedUrl = $SiteUrl.TrimEnd('/') } else { @@ -39,43 +85,6 @@ function Invoke-ExecSiteBrowserActions { $Result = switch ([string]$Action) { 'StartVersionCleanup' { - $BatchDeleteMode = [int]($Request.Body.BatchDeleteMode ?? 2) - if ($Request.Body.BatchDeleteMode -is [PSCustomObject] -and $Request.Body.BatchDeleteMode.value) { - $BatchDeleteMode = [int]$Request.Body.BatchDeleteMode.value - } - - $DeleteOlderThanDays = [int]($Request.Body.DeleteOlderThanDays ?? -1) - $MajorVersionLimit = [int]($Request.Body.MajorVersionLimit ?? -1) - $MajorWithMinorVersionsLimit = [int]($Request.Body.MajorWithMinorVersionsLimit ?? -1) - $SyncListPolicy = $Request.Body.SyncListPolicy -eq $true - - switch ($BatchDeleteMode) { - 0 { - if ($DeleteOlderThanDays -lt 30) { - throw 'DeleteOlderThanDays must be at least 30 when using Delete Older Than Days mode.' - } - $MajorVersionLimit = -1 - $MajorWithMinorVersionsLimit = -1 - } - 1 { - if ($MajorVersionLimit -lt 1) { - throw 'MajorVersionLimit is required when using Count Limits mode.' - } - if ($MajorWithMinorVersionsLimit -lt 0) { - throw 'MajorWithMinorVersionsLimit is required when using Count Limits mode.' - } - $DeleteOlderThanDays = -1 - } - 2 { - $DeleteOlderThanDays = -1 - $MajorVersionLimit = -1 - $MajorWithMinorVersionsLimit = -1 - } - default { - throw "Unsupported BatchDeleteMode '$BatchDeleteMode'. Use 0 (DeleteOlderThanDays), 1 (CountLimits), or 2 (SyncPolicy)." - } - } - $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter $AdminUrl = $SharePointInfo.AdminUrl $EscapedSiteUrl = [System.Security.SecurityElement]::Escape($ResolvedUrl) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSiteBrowserLibraryCopy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSiteBrowserLibraryCopy.ps1 index 3d38818184..a06a8cb014 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSiteBrowserLibraryCopy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSiteBrowserLibraryCopy.ps1 @@ -18,10 +18,10 @@ function Invoke-ExecSiteBrowserLibraryCopy { $StatusCode = [HttpStatusCode]::OK try { - if ([string]::IsNullOrWhiteSpace($TenantFilter)) { throw 'tenantFilter is required.' } - if ([string]::IsNullOrWhiteSpace($Action)) { throw 'Action is required.' } + if ([string]::IsNullOrWhiteSpace($TenantFilter)) { throw [System.ArgumentException]::new('tenantFilter is required.') } + if ([string]::IsNullOrWhiteSpace($Action)) { throw [System.ArgumentException]::new('Action is required.') } if ($Action -notin @('PreflightLibraryCopy', 'StartLibraryCopy')) { - throw "Unknown Action '$Action'. Supported: PreflightLibraryCopy, StartLibraryCopy." + throw [System.ArgumentException]::new("Unknown Action '$Action'. Supported: PreflightLibraryCopy, StartLibraryCopy.") } $User = try { @@ -55,13 +55,13 @@ function Invoke-ExecSiteBrowserLibraryCopy { APIName = $APIName } - if ([string]::IsNullOrWhiteSpace($Params.SourceListId)) { throw 'SourceListId is required.' } - if ([string]::IsNullOrWhiteSpace($Params.DestListId)) { throw 'DestListId is required.' } + if ([string]::IsNullOrWhiteSpace($Params.SourceListId)) { throw [System.ArgumentException]::new('SourceListId is required.') } + if ([string]::IsNullOrWhiteSpace($Params.DestListId)) { throw [System.ArgumentException]::new('DestListId is required.') } if ([string]::IsNullOrWhiteSpace($Params.SourceSiteId) -and [string]::IsNullOrWhiteSpace($Params.SourceSiteUrl)) { - throw 'SourceSiteId or SourceSiteUrl is required.' + throw [System.ArgumentException]::new('SourceSiteId or SourceSiteUrl is required.') } if ([string]::IsNullOrWhiteSpace($Params.DestSiteId) -and [string]::IsNullOrWhiteSpace($Params.DestSiteUrl)) { - throw 'DestSiteId or DestSiteUrl is required.' + throw [System.ArgumentException]::new('DestSiteId or DestSiteUrl is required.') } $Result = Start-CIPPSharePointLibraryCopy @Params @@ -70,7 +70,7 @@ function Invoke-ExecSiteBrowserLibraryCopy { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to run Action '$Action'. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = Get-CippErrorStatusCode -ErrorRecord $_ } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSiteBrowserPermissions.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSiteBrowserPermissions.ps1 index e609e06f67..2d0f30d20a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSiteBrowserPermissions.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSiteBrowserPermissions.ps1 @@ -93,14 +93,20 @@ function Invoke-ExecSiteBrowserPermissions { param($Mode = 'Add') $RoleDefId = Resolve-BrowserPermissionRoleDefId -PermissionLevel $Request.Body.PermissionLevel -RoleDefinitionId $Request.Body.RoleDefinitionId - if (-not $RoleDefId) { throw 'No permission level was selected.' } + if (-not $RoleDefId) { + $Outcome.Status = [HttpStatusCode]::BadRequest + throw 'No permission level was selected.' + } $Principals = ConvertTo-BrowserPermissionPrincipals ` -PrincipalId $Request.Body.PrincipalId ` -PrincipalName $Request.Body.PrincipalName ` -Users $Request.Body.Users ` -Groups $Request.Body.Groups - if ($Principals.Count -eq 0) { throw 'No users or groups selected.' } + if ($Principals.Count -eq 0) { + $Outcome.Status = [HttpStatusCode]::BadRequest + throw 'No users or groups selected.' + } $SPScope = Resolve-CIPPSharePointPermissionScope -SiteUrl $SiteUrl -ListId $ListId -TenantFilter $TenantFilter -EnsureUniqueRoleAssignments @@ -163,6 +169,7 @@ function Invoke-ExecSiteBrowserPermissions { $Messages.Add("Failed for $(($Failed -join '; ').TrimEnd('.')).") } $Result = $Messages -join ' ' + $Outcome.Status = Get-CippBulkStatusCode -Total $Principals.Count -Failed $Failed.Count if ($Granted.Count -eq 0) { throw $Result } return $Result } @@ -171,12 +178,16 @@ function Invoke-ExecSiteBrowserPermissions { $PrincipalId = $Request.Body.PrincipalId $RoleDefinitionId = $Request.Body.RoleDefinitionId $Label = $Request.Body.PrincipalName ?? $Request.Body.Title ?? $PrincipalId - if ([string]::IsNullOrWhiteSpace($PrincipalId)) { throw 'PrincipalId is required.' } + if ([string]::IsNullOrWhiteSpace($PrincipalId)) { + $Outcome.Status = [HttpStatusCode]::BadRequest + throw 'PrincipalId is required.' + } $SPScope = Resolve-CIPPSharePointPermissionScope -SiteUrl $SiteUrl -ListId $ListId -TenantFilter $TenantFilter -EnsureUniqueRoleAssignments $Assignments = @(New-GraphGetRequest -uri "$($SPScope.AssignmentUri)?`$expand=Member,RoleDefinitionBindings" -tenantid $TenantFilter -scope $SPScope.Scope -extraHeaders $SPScope.Headers -UseCertificate -AsApp $true) $Current = @($Assignments | Where-Object { [string]$_.Member.Id -eq [string]$PrincipalId }) if ($Current.Count -eq 0) { + $Outcome.Status = [HttpStatusCode]::NotFound throw "$Label holds no permissions on $($SPScope.TargetLabel)." } if (-not $Label -or $Label -eq $PrincipalId) { $Label = $Current[0].Member.Title ?? $PrincipalId } @@ -196,8 +207,10 @@ function Invoke-ExecSiteBrowserPermissions { if ($Targets.Count -eq 0) { if ($SkippedSystem.Count -gt 0) { + $Outcome.Status = [HttpStatusCode]::BadRequest throw "$Label only holds $($SkippedSystem -join ', ') on $($SPScope.TargetLabel). SharePoint manages that level itself and it cannot be removed here." } + $Outcome.Status = [HttpStatusCode]::NotFound throw "No matching permission found for $Label on $($SPScope.TargetLabel)." } @@ -224,6 +237,7 @@ function Invoke-ExecSiteBrowserPermissions { $Messages.Add("Failed for $(($Failed -join '; ').TrimEnd('.')).") } $Result = $Messages -join ' ' + $Outcome.Status = Get-CippBulkStatusCode -Total $Targets.Count -Failed $Failed.Count if ($Removed.Count -eq 0) { throw $Result } return $Result } @@ -232,7 +246,10 @@ function Invoke-ExecSiteBrowserPermissions { param([bool]$Add) $GroupId = $Request.Body.GroupId - if ([string]::IsNullOrWhiteSpace($GroupId)) { throw 'GroupId is required.' } + if ([string]::IsNullOrWhiteSpace($GroupId)) { + $Outcome.Status = [HttpStatusCode]::BadRequest + throw 'GroupId is required.' + } $RestContext = Resolve-CIPPSharePointRestContext -TenantFilter $TenantFilter -SiteUrl $SiteUrl $Scope = $RestContext.Scope @@ -244,7 +261,10 @@ function Invoke-ExecSiteBrowserPermissions { -PrincipalName $Request.Body.PrincipalName ` -Users $Request.Body.Users ` -Groups $Request.Body.Groups - if ($Principals.Count -eq 0) { throw 'No users or groups selected.' } + if ($Principals.Count -eq 0) { + $Outcome.Status = [HttpStatusCode]::BadRequest + throw 'No users or groups selected.' + } $Done = [System.Collections.Generic.List[string]]::new() $Failed = [System.Collections.Generic.List[string]]::new() @@ -290,6 +310,7 @@ function Invoke-ExecSiteBrowserPermissions { $Messages.Add("Failed for $(($Failed -join '; ').TrimEnd('.')).") } $Result = $Messages -join ' ' + $Outcome.Status = Get-CippBulkStatusCode -Total $Principals.Count -Failed $Failed.Count if ($Done.Count -eq 0) { throw $Result } return $Result } @@ -308,16 +329,24 @@ function Invoke-ExecSiteBrowserPermissions { $Candidate = $Request.Body.userPrincipalName ?? $Request.Body.PrincipalName if ($Candidate -match '@') { $UPNs = @($Candidate) } } - if ($UPNs.Count -eq 0) { throw 'No users selected.' } + if ($UPNs.Count -eq 0) { + $Outcome.Status = [HttpStatusCode]::BadRequest + throw 'No users selected.' + } - $Results = Set-CIPPSharePointPerms -tenantFilter $TenantFilter -OnedriveAccessUser $UPNs -URL $SiteUrl -Headers $Headers -APIName $APIName -RemovePermission:(-not $Add) - return (@($Results) -join ' ') + $Results = @(Set-CIPPSharePointPerms -tenantFilter $TenantFilter -OnedriveAccessUser $UPNs -URL $SiteUrl -Headers $Headers -APIName $APIName -RemovePermission:(-not $Add)) + $Failed = $Results.Where({ $_.state -eq 'error' }).Count + $Outcome.Status = Get-CippBulkStatusCode -Total $Results.Count -Failed $Failed + $Result = @($Results.resultText) -join ' ' + if ($Failed -eq $Results.Count) { throw $Result } + return $Result } function Invoke-BrowserInheritance { param([ValidateSet('Break', 'Reset')][string]$Mode) if ([string]::IsNullOrWhiteSpace($ListId)) { + $Outcome.Status = [HttpStatusCode]::BadRequest throw 'ListId is required: a site root web always holds its own permissions.' } $CopyRoleAssignments = ($Request.Body.CopyRoleAssignments ?? $true) -eq $true @@ -349,7 +378,10 @@ function Invoke-ExecSiteBrowserPermissions { function Invoke-BrowserRemoveGraphSitePermission { $PermissionId = $Request.Body.PermissionId - if ([string]::IsNullOrWhiteSpace($PermissionId)) { throw 'PermissionId is required.' } + if ([string]::IsNullOrWhiteSpace($PermissionId)) { + $Outcome.Status = [HttpStatusCode]::BadRequest + throw 'PermissionId is required.' + } $ResolvedSiteId = $SiteId if ([string]::IsNullOrWhiteSpace($ResolvedSiteId)) { @@ -369,11 +401,19 @@ function Invoke-ExecSiteBrowserPermissions { return "Successfully removed Graph site permission for $Label." } - try { - if ([string]::IsNullOrWhiteSpace($TenantFilter)) { throw 'tenantFilter is required.' } - if ([string]::IsNullOrWhiteSpace($SiteUrl)) { throw 'SiteUrl is required.' } - if ([string]::IsNullOrWhiteSpace($Action)) { throw 'Action is required.' } + if ([string]::IsNullOrWhiteSpace($TenantFilter)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'tenantFilter is required.' } }) + } + if ([string]::IsNullOrWhiteSpace($SiteUrl)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'SiteUrl is required.' } }) + } + if ([string]::IsNullOrWhiteSpace($Action)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'Action is required.' } }) + } + # Nested action functions set Status for input, not-found and partial outcomes. + $Outcome = @{ Status = $null } + try { $Result = switch ([string]$Action) { 'GrantAccess' { Invoke-BrowserGrantAccess -Mode 'Add' } 'ReplaceAccess' { Invoke-BrowserGrantAccess -Mode 'Replace' } @@ -386,17 +426,18 @@ function Invoke-ExecSiteBrowserPermissions { 'RestoreInheritance' { Invoke-BrowserInheritance -Mode 'Reset' } 'RemoveGraphSitePermission' { Invoke-BrowserRemoveGraphSitePermission } default { + $Outcome.Status = [HttpStatusCode]::BadRequest throw "Unknown Action '$Action'. Supported: GrantAccess, ReplaceAccess, RemoveAccess, AddGroupMember, RemoveGroupMember, AddSiteAdmin, RemoveSiteAdmin, BreakInheritance, RestoreInheritance, RemoveGraphSitePermission." } } Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Info - $StatusCode = [HttpStatusCode]::OK + $StatusCode = $Outcome.Status ?? [HttpStatusCode]::OK } catch { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to run Action '$Action'. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = $Outcome.Status ?? [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSiteRename.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSiteRename.ps1 new file mode 100644 index 0000000000..30c730f835 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSiteRename.ps1 @@ -0,0 +1,84 @@ +function Invoke-ExecSiteRename { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + $SiteId = $Request.Body.SiteId + $SiteUrl = $Request.Body.SiteUrl + $DisplayName = $Request.Body.DisplayName + $NewTitle = $Request.Body.NewTitle + $NewUrl = $Request.Body.NewUrl + $SiteLabel = if ($DisplayName) { $DisplayName } else { $SiteUrl } + + try { + if (-not $TenantFilter) { throw 'tenantFilter is required' } + if (-not $NewTitle -and -not $NewUrl) { throw 'Provide NewTitle, NewUrl, or both' } + + $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter + $ExtraHeaders = @{ + 'accept' = 'application/json' + 'content-type' = 'application/json' + 'odata-version' = '4.0' + } + $Messages = [System.Collections.Generic.List[string]]::new() + + if ($NewTitle) { + if (-not $SiteId) { throw 'SiteId is required to change the title' } + $PatchBody = @{ Title = $NewTitle } | ConvertTo-Json -Compress + $null = New-GraphPOSTRequest ` + -scope "$($SharePointInfo.AdminUrl)/.default" ` + -uri "$($SharePointInfo.AdminUrl)/_api/SPO.Tenant/sites('$SiteId')" ` + -body $PatchBody ` + -tenantid $TenantFilter ` + -type PATCH ` + -AddedHeaders $ExtraHeaders + $Messages.Add("Title changed to '$NewTitle'. For group-connected sites the site name follows the Microsoft 365 group; rename the group to keep them in sync.") + } + + if ($NewUrl) { + if (-not $SiteUrl) { throw 'SiteUrl is required to change the URL' } + $RenameBody = @{ + SourceSiteUrl = $SiteUrl + TargetSiteUrl = $NewUrl + } | ConvertTo-Json -Compress + $RenameJob = New-GraphPOSTRequest ` + -scope "$($SharePointInfo.AdminUrl)/.default" ` + -uri "$($SharePointInfo.AdminUrl)/_api/SiteRenameJobs?api-version=1.4.7" ` + -body $RenameBody ` + -tenantid $TenantFilter ` + -type POST ` + -AddedHeaders $ExtraHeaders + $JobState = $RenameJob.JobState + $Messages.Add("URL change to '$NewUrl' queued (job state: $JobState). SharePoint renames the site in the background; a redirect is created at the old URL. Large sites can take a while.") + } + + $Results = "Site '$SiteLabel': $($Messages -join ' ')" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Info + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ Results = $Results } + }) + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $ErrorText = $ErrorMessage.NormalizedError + if ($ErrorText -match 'already exists|SiteMoveInProgress|rename job') { + $ErrorText = "A site already exists at the target URL or a rename is already in progress. Original error: $ErrorText" + } + $Results = "Failed to rename site '$SiteLabel'. Error: $ErrorText" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = @{ Results = $Results } + }) + } +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTeamAction.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTeamAction.ps1 new file mode 100644 index 0000000000..ebaca6e007 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTeamAction.ps1 @@ -0,0 +1,459 @@ +Function Invoke-ExecTeamAction { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Teams.Group.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.TenantFilter + $TeamID = $Request.Body.TeamID + $Action = $Request.Body.Action + $DisplayName = $Request.Body.DisplayName + + if (-not $TenantFilter) { $TenantFilter = $Request.Query.TenantFilter } + if (-not $TeamID) { $TeamID = $Request.Query.TeamID } + + $TeamLabel = if ($DisplayName) { $DisplayName } else { $TeamID } + + try { + switch ($Action) { + 'Archive' { + $Body = @{ + shouldSetSpoSiteReadOnlyForMembers = $false + } | ConvertTo-Json + $null = New-GraphPostRequest -AsApp $true -uri "https://graph.microsoft.com/v1.0/teams/$TeamID/archive" -tenantid $TenantFilter -type POST -body $Body + $Message = "Successfully archived team '$TeamLabel'" + } + 'Unarchive' { + $null = New-GraphPostRequest -AsApp $true -uri "https://graph.microsoft.com/v1.0/teams/$TeamID/unarchive" -tenantid $TenantFilter -type POST -body '{}' + $Message = "Successfully unarchived team '$TeamLabel'" + } + 'Clone' { + $CloneDisplayName = $Request.Body.CloneDisplayName + $CloneVisibility = $Request.Body.CloneVisibility + if (-not $CloneDisplayName) { $CloneDisplayName = "$TeamLabel (Copy)" } + if (-not $CloneVisibility) { $CloneVisibility = 'public' } + + $Body = @{ + displayName = $CloneDisplayName + description = $Request.Body.CloneDescription + mailNickname = ($CloneDisplayName -replace '[^a-zA-Z0-9]', '').ToLower() + partsToClone = 'apps,tabs,settings,channels' + visibility = $CloneVisibility + } | ConvertTo-Json + $null = New-GraphPostRequest -AsApp $true -uri "https://graph.microsoft.com/v1.0/teams/$TeamID/clone" -tenantid $TenantFilter -type POST -body $Body + $Message = "Successfully started cloning team '$TeamLabel' as '$CloneDisplayName'. This may take a few minutes to complete." + } + 'CreateChannel' { + $ChannelName = $Request.Body.ChannelName + $ChannelDescription = $Request.Body.ChannelDescription + $ChannelType = $Request.Body.ChannelType + $ChannelOwnerID = $Request.Body.ChannelOwnerID + if (-not $ChannelName) { throw 'ChannelName is required' } + if (-not $ChannelType) { $ChannelType = 'standard' } + + # Support autocomplete/select field format: { value: "...", label: "..." } + if ($ChannelOwnerID -is [hashtable] -or $ChannelOwnerID -is [PSCustomObject]) { + $ChannelOwnerID = $ChannelOwnerID.value + } elseif ($ChannelOwnerID -is [System.Collections.IDictionary]) { + $ChannelOwnerID = $ChannelOwnerID['value'] + } + + $ChannelBody = @{ + displayName = $ChannelName + description = $ChannelDescription + membershipType = $ChannelType + } + + # Private and Shared channels require at least one owner when using app permissions + if ($ChannelType -in @('private', 'shared')) { + if (-not $ChannelOwnerID) { + throw "A channel owner is required when creating a $ChannelType channel. Please select a channel owner." + } + $ChannelBody['members'] = @( + @{ + '@odata.type' = '#microsoft.graph.aadUserConversationMember' + 'user@odata.bind' = "https://graph.microsoft.com/v1.0/users('$ChannelOwnerID')" + 'roles' = [string[]]@('owner') + } + ) + } + + $ChannelJson = $ChannelBody | ConvertTo-Json -Depth 10 -Compress + + if ($ChannelType -eq 'shared') { + # Shared channels require the beta endpoint — v1.0 with app-only fails with GetThreadAsync + $null = New-GraphPostRequest -AsApp $true -uri "https://graph.microsoft.com/beta/teams/$TeamID/channels" -tenantid $TenantFilter -type POST -body $ChannelJson + } else { + $null = New-GraphPostRequest -AsApp $true -uri "https://graph.microsoft.com/v1.0/teams/$TeamID/channels" -tenantid $TenantFilter -type POST -body $ChannelJson + } + $Message = "Successfully created channel '$ChannelName' in team '$TeamLabel'" + } + 'DeleteChannel' { + $ChannelID = $Request.Body.ChannelID + $ChannelName = $Request.Body.ChannelName + if (-not $ChannelID) { throw 'ChannelID is required' } + $ChannelLabel = if ($ChannelName) { $ChannelName } else { $ChannelID } + + $null = New-GraphPostRequest -AsApp $true -uri "https://graph.microsoft.com/v1.0/teams/$TeamID/channels/$ChannelID" -tenantid $TenantFilter -type DELETE + $Message = "Successfully deleted channel '$ChannelLabel' from team '$TeamLabel'. All messages, files, and tabs in this channel have been permanently removed." + } + 'RemoveApp' { + $AppInstallationID = $Request.Body.AppInstallationID + $AppName = $Request.Body.AppName + if (-not $AppInstallationID) { throw 'AppInstallationID is required' } + $AppLabel = if ($AppName) { $AppName } else { $AppInstallationID } + + $null = New-GraphPostRequest -AsApp $true -uri "https://graph.microsoft.com/v1.0/teams/$TeamID/installedApps/$AppInstallationID" -tenantid $TenantFilter -type DELETE + $Message = "Successfully removed app '$AppLabel' from team '$TeamLabel'" + } + 'ListChannelMembers' { + $ChannelID = $Request.Body.ChannelID + $ChannelType = $Request.Body.ChannelType + if (-not $ChannelID) { throw 'ChannelID is required' } + + $ListTeamID = $TeamID + if ($ChannelType -eq 'shared' -or $ChannelType -eq 'private') { + try { + $ChInfo = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/teams/$TeamID/channels/$ChannelID" -tenantid $TenantFilter -AsApp $true -NoAuthCheck $true + if ($ChInfo.webUrl -match 'groupId=([0-9a-fA-F-]+)') { $ListTeamID = $Matches[1] } + } catch { } + } + $ChannelMembers = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/teams/$ListTeamID/channels/$ChannelID/members" -tenantid $TenantFilter -AsApp $true + $MemberList = @($ChannelMembers | ForEach-Object { + [PSCustomObject]@{ + id = $_.id + displayName = $_.displayName + email = $_.email + roles = ($_.roles -join ', ') + userId = $_.userId + } + }) + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ Results = $MemberList } + }) + } + 'AddChannelMember' { + $ChannelID = $Request.Body.ChannelID + $ChannelName = $Request.Body.ChannelName + $ChannelType = $Request.Body.ChannelType + $UserID = $Request.Body.UserID + $ChannelRole = $Request.Body.ChannelRole + if (-not $ChannelID) { throw 'ChannelID is required' } + if (-not $UserID) { throw 'UserID is required' } + + # Support autocomplete/select field format: { value: "...", label: "..." } + if ($UserID -is [hashtable] -or $UserID -is [PSCustomObject]) { + $UserID = $UserID.value + } elseif ($UserID -is [System.Collections.IDictionary]) { + $UserID = $UserID['value'] + } + + if ($ChannelRole -is [hashtable] -or $ChannelRole -is [PSCustomObject]) { + $ChannelRole = $ChannelRole.value + } elseif ($ChannelRole -is [System.Collections.IDictionary]) { + $ChannelRole = $ChannelRole['value'] + } + + if (-not $ChannelRole) { $ChannelRole = 'member' } + $ChannelLabel = if ($ChannelName) { $ChannelName } else { $ChannelID } + $OriginalInput = $UserID + + $GuestInvited = $false + $ExternalTenantId = $null + $IsNonStandard = $ChannelType -eq 'shared' -or $ChannelType -eq 'private' + + # For shared/private channels, the host team may differ from the viewing team. + # POST /teams/{id}/channels/{id}/members requires the HOST team's ID. + $EffectiveTeamID = $TeamID + if ($IsNonStandard) { + try { + $ChannelInfo = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/teams/$TeamID/channels/$ChannelID" -tenantid $TenantFilter -AsApp $true -NoAuthCheck $true + if ($ChannelInfo.webUrl -match 'groupId=([0-9a-fA-F-]+)') { + $HostTeamID = $Matches[1] + if ($HostTeamID -ne $TeamID) { + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Shared channel '$ChannelLabel' is hosted by team $HostTeamID (viewing from $TeamID)" -Sev Debug + $EffectiveTeamID = $HostTeamID + } + } + } catch { + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Could not resolve host team for channel '$ChannelLabel': $($_.Exception.Message)" -Sev Debug + } + } + + if ($UserID -match '@') { + if ($ChannelType -eq 'shared') { + $EncodedEmail = $UserID -replace '#', '%23' + $UserLookup = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users?`$filter=mail eq '$EncodedEmail' or userPrincipalName eq '$EncodedEmail'&`$select=id,displayName,userType" -tenantid $TenantFilter -AsApp $true + $ResolvedUser = if ($UserLookup -is [array]) { $UserLookup[0] } else { $UserLookup } + + if ($ResolvedUser -and $ResolvedUser.userType -eq 'Member') { + $UserID = $ResolvedUser.id + } else { + $EmailDomain = ($UserID -split '@')[1] + try { + $OidcConfig = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$EmailDomain/.well-known/openid-configuration" -Method GET -ErrorAction Stop + $ExternalTenantId = ($OidcConfig.issuer -split '/')[3] + } catch { + throw "Could not resolve tenant for domain '$EmailDomain'. Ensure the domain belongs to a valid Microsoft 365 organization." + } + if (-not $ExternalTenantId -or $ExternalTenantId -eq '9188040d-6c67-4c5b-b112-36a304b66dad') { + throw "The domain '$EmailDomain' does not belong to a Microsoft 365 organization. Shared channels use External Access (B2B Direct Connect) which requires a work or school account. To add users with personal email addresses (Gmail, Outlook.com, etc.), use a standard or private channel instead — these use Guest Access (B2B Collaboration) which supports personal emails." + } + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Adding external user '$UserID' from tenant $ExternalTenantId to shared channel via B2B direct connect" -Sev Info + } + } else { + $EncodedEmail = $UserID -replace '#', '%23' + $UserLookup = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users?`$filter=mail eq '$EncodedEmail' or userPrincipalName eq '$EncodedEmail'&`$select=id,displayName,userType" -tenantid $TenantFilter -AsApp $true + if (-not $UserLookup -or $UserLookup.Count -eq 0) { + $InviteBody = @{ + invitedUserEmailAddress = $UserID + inviteRedirectUrl = 'https://myapps.microsoft.com' + sendInvitationMessage = $false + } | ConvertTo-Json -Depth 5 + $InviteResult = New-GraphPostRequest -uri 'https://graph.microsoft.com/beta/invitations' -tenantid $TenantFilter -type POST -body $InviteBody + $UserID = $InviteResult.invitedUser.id + if (-not $UserID) { throw "Guest invitation succeeded but no user ID was returned for '$OriginalInput'" } + $GuestInvited = $true + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Auto-invited guest '$OriginalInput' to tenant for channel access" -Sev Info + } else { + $ResolvedUser = if ($UserLookup -is [array]) { $UserLookup[0] } else { $UserLookup } + $UserID = $ResolvedUser.id + } + } + } + + $MemberRoles = @() + if ($ChannelRole -eq 'owner') { $MemberRoles = @('owner') } + $MemberBody = @{ + '@odata.type' = '#microsoft.graph.aadUserConversationMember' + 'roles' = $MemberRoles + 'user@odata.bind' = "https://graph.microsoft.com/v1.0/users('$UserID')" + } + if ($ExternalTenantId) { + $MemberBody['tenantId'] = $ExternalTenantId + } + $MemberBodyJson = $MemberBody | ConvertTo-Json -Depth 5 -Compress + + $GraphUri = "https://graph.microsoft.com/v1.0/teams/$EffectiveTeamID/channels/$ChannelID/members" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "AddChannelMember: URI=$GraphUri ChannelType=$ChannelType EffectiveTeamID=$EffectiveTeamID (original=$TeamID) ChannelID=$ChannelID Body=$MemberBodyJson" -Sev Debug + + $null = New-GraphPostRequest -AsApp $true -uri $GraphUri -tenantid $TenantFilter -type POST -body $MemberBodyJson + + $Message = if ($GuestInvited) { + "Successfully invited guest '$OriginalInput' and added as $ChannelRole to channel '$ChannelLabel' in team '$TeamLabel' (Guest Access — B2B Collaboration)" + } elseif ($ExternalTenantId) { + "Successfully added external user '$OriginalInput' as $ChannelRole to shared channel '$ChannelLabel' in team '$TeamLabel' (External Access — B2B Direct Connect)" + } else { + "Successfully added $ChannelRole to channel '$ChannelLabel' in team '$TeamLabel'" + } + } + 'UpdateChannelMemberRole' { + $ChannelID = $Request.Body.ChannelID + $ChannelName = $Request.Body.ChannelName + $ChannelType = $Request.Body.ChannelType + $MembershipID = $Request.Body.MembershipID + $MemberName = $Request.Body.MemberName + $NewRole = $Request.Body.NewRole + if (-not $ChannelID) { throw 'ChannelID is required' } + if (-not $MembershipID) { throw 'MembershipID is required' } + if (-not $NewRole) { throw 'NewRole is required (owner or member)' } + $ChannelLabel = if ($ChannelName) { $ChannelName } else { $ChannelID } + $MemberLabel = if ($MemberName) { $MemberName } else { $MembershipID } + + $UpdateTeamID = $TeamID + if ($ChannelType -eq 'shared' -or $ChannelType -eq 'private') { + try { + $ChInfo = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/teams/$TeamID/channels/$ChannelID" -tenantid $TenantFilter -AsApp $true -NoAuthCheck $true + if ($ChInfo.webUrl -match 'groupId=([0-9a-fA-F-]+)') { $UpdateTeamID = $Matches[1] } + } catch { } + } + + $UpdateRoles = @() + if ($NewRole -eq 'owner') { $UpdateRoles = @('owner') } + $RoleBody = @{ + '@odata.type' = '#microsoft.graph.aadUserConversationMember' + 'roles' = $UpdateRoles + } | ConvertTo-Json -Depth 5 -Compress + + $null = New-GraphPostRequest -AsApp $true -uri "https://graph.microsoft.com/v1.0/teams/$UpdateTeamID/channels/$ChannelID/members/$MembershipID" -tenantid $TenantFilter -type PATCH -body $RoleBody + $RoleLabel = if ($NewRole -eq 'owner') { 'owner' } else { 'member' } + $Message = "Successfully updated '$MemberLabel' to $RoleLabel in channel '$ChannelLabel' in team '$TeamLabel'" + } + 'RemoveChannelMember' { + $ChannelID = $Request.Body.ChannelID + $ChannelName = $Request.Body.ChannelName + $ChannelType = $Request.Body.ChannelType + $MembershipID = $Request.Body.MembershipID + $MemberName = $Request.Body.MemberName + if (-not $ChannelID) { throw 'ChannelID is required' } + if (-not $MembershipID) { throw 'MembershipID is required' } + $ChannelLabel = if ($ChannelName) { $ChannelName } else { $ChannelID } + $MemberLabel = if ($MemberName) { $MemberName } else { $MembershipID } + + $RemoveTeamID = $TeamID + if ($ChannelType -eq 'shared' -or $ChannelType -eq 'private') { + try { + $ChInfo = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/teams/$TeamID/channels/$ChannelID" -tenantid $TenantFilter -AsApp $true -NoAuthCheck $true + if ($ChInfo.webUrl -match 'groupId=([0-9a-fA-F-]+)') { $RemoveTeamID = $Matches[1] } + } catch { } + } + $null = New-GraphPostRequest -AsApp $true -uri "https://graph.microsoft.com/v1.0/teams/$RemoveTeamID/channels/$ChannelID/members/$MembershipID" -tenantid $TenantFilter -type DELETE + $Message = "Successfully removed '$MemberLabel' from channel '$ChannelLabel' in team '$TeamLabel'" + } + default { + throw "Unknown action: $Action. Supported actions: Archive, Unarchive, Clone, CreateChannel, DeleteChannel, RemoveApp, ListChannelMembers, AddChannelMember, UpdateChannelMemberRole, RemoveChannelMember" + } + } + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev Info + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $NormError = [string]$ErrorMessage.NormalizedError + $RawError = [string]$ErrorMessage.Message + # Translate Microsoft's internal "xTap" abbreviation and format the action name + $FriendlyError = $NormError -replace 'due to xTap', 'due to a cross-tenant access policy restriction' + $FriendlyAction = ($Action -creplace '([a-z])([A-Z])', '$1 $2').ToLower() + $Message = "Failed to $FriendlyAction team '$TeamLabel'. Error: $FriendlyError" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev Error -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::Forbidden + + # Run B2B / cross-tenant diagnostics for AddChannelMember failures + if ($Action -eq 'AddChannelMember') { + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "AddChannelMember debug: ChannelType=$($Request.Body.ChannelType), UserID=$($Request.Body.UserID), ChannelID=$($Request.Body.ChannelID), RawError=$RawError" -Sev Debug + try { + $DiagMessages = [System.Collections.Generic.List[string]]::new() + $IsSharedChannel = $Request.Body.ChannelType -eq 'shared' + $IsBackendError = $NormError -match 'backend request' -or $RawError -match 'backend request' + $IsExternalError = $NormError -match 'not allowed' -or $NormError -match 'external' -or $NormError -match 'guest' -or $NormError -match 'cross-tenant' -or $NormError -match 'collaboration' -or $RawError -match 'not allowed' -or $RawError -match 'Externally authenticated' + + if ($IsBackendError -and $IsSharedChannel) { + $DiagMessages.Add("[Teams Service] 'Failed to execute backend request' on a shared channel typically indicates a permissions or provisioning issue. Verify: (1) The CIPP app has ChannelMember.ReadWrite.All application permission granted and consented. (2) The shared channel is fully provisioned. (3) If adding an external user, cross-tenant access policies must allow B2B direct connect on BOTH tenants.") + } + + if ($IsExternalError -or $IsBackendError) { + $EmailInput = $Request.Body.UserID + if ($EmailInput -is [hashtable] -or $EmailInput -is [PSCustomObject]) { $EmailInput = $EmailInput.value } + $EmailDomain = if ($EmailInput -match '@') { ($EmailInput -split '@')[1] } else { $null } + + # --- Check Entra External Collaboration settings --- + try { + $AuthPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $TenantFilter -AsApp $true + + if ($AuthPolicy.allowInvitesFrom -eq 'none') { + $DiagMessages.Add("[Entra External Collaboration] Guest invitations are completely disabled ('No one in the organization can invite guest users'). Change this to allow at least admins to send invitations. CIPP Settings: /tenant/administration/cross-tenant-access/external-collaboration") + } + + # Check B2B domain allow/block lists + try { + $B2BPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/legacy/policies' -tenantid $TenantFilter -AsApp $true + $B2BManagement = $B2BPolicy | Where-Object { $_.type -eq 6 } + if ($B2BManagement -and $EmailDomain) { + $B2BDefinition = ($B2BManagement.definition | ConvertFrom-Json).B2BManagementPolicy + $DomainPolicy = $B2BDefinition.InvitationsAllowedAndBlockedDomainsPolicy + + if ($DomainPolicy.AllowedDomains -and $DomainPolicy.AllowedDomains.Count -gt 0) { + if ($EmailDomain -notin $DomainPolicy.AllowedDomains) { + $DiagMessages.Add("[Entra External Collaboration] Domain '$EmailDomain' is NOT in the allowed domains list. Currently allowed: $($DomainPolicy.AllowedDomains -join ', '). Add '$EmailDomain' to the allowed list or switch to a block-list approach. CIPP Settings: /tenant/administration/cross-tenant-access/external-collaboration") + } + } + + if ($DomainPolicy.BlockedDomains -and $DomainPolicy.BlockedDomains.Count -gt 0) { + if ($EmailDomain -in $DomainPolicy.BlockedDomains) { + $DiagMessages.Add("[Entra External Collaboration] Domain '$EmailDomain' is BLOCKED. Remove it from the blocked domains list to allow collaboration. CIPP Settings: /tenant/administration/cross-tenant-access/external-collaboration") + } + } + } + } catch { + # B2B management policy may not be available + } + } catch { + # Could not retrieve Entra settings + } + + # --- Check Teams guest access --- + try { + $ClientConfig = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsTeamsClientConfiguration' -CmdParams @{Identity = 'Global' } + if ($ClientConfig.AllowGuestUser -eq $false) { + $DiagMessages.Add("[Teams Guest Access] Guest access is DISABLED for Microsoft Teams. Enable 'Allow guest access' in Teams Settings. CIPP Settings: /teams-share/teams/teams-settings") + } + } catch { + # Teams settings may not be accessible + } + + # --- Check cross-tenant access policies (critical for shared channels) --- + if ($IsSharedChannel -and $EmailDomain) { + try { + $ExternalTenantIdDiag = $null + try { + $OidcDiag = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$EmailDomain/.well-known/openid-configuration" -Method GET -ErrorAction Stop + $ExternalTenantIdDiag = ($OidcDiag.issuer -split '/')[3] + } catch {} + + # Check default cross-tenant access policy + $DefaultPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default' -tenantid $TenantFilter -AsApp $true + + $DefaultB2BDirect = $DefaultPolicy.b2bDirectConnectInbound + $DefaultB2BDirectBlocked = ($DefaultB2BDirect.applications.accessType -eq 'blocked' -and $DefaultB2BDirect.applications.targets.target -eq 'AllApplications') -or ($DefaultB2BDirect.usersAndGroups.accessType -eq 'blocked' -and $DefaultB2BDirect.usersAndGroups.targets.target -eq 'AllUsers') + + # Check partner-specific policy if we resolved the external tenant + $PartnerPolicy = $null + if ($ExternalTenantIdDiag) { + try { + $PartnerPolicy = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/partners/$ExternalTenantIdDiag" -tenantid $TenantFilter -AsApp $true + } catch { + # No partner-specific policy — default policy applies + } + } + + $PartnerEditLink = if ($ExternalTenantIdDiag) { + "/tenant/administration/cross-tenant-access/partners/partner?tenantId=$ExternalTenantIdDiag" + } else { + '/tenant/administration/cross-tenant-access/partners/partner' + } + + if ($PartnerPolicy) { + $PartnerB2BDirect = $PartnerPolicy.b2bDirectConnectInbound + $PartnerB2BDirectBlocked = ($PartnerB2BDirect.applications.accessType -eq 'blocked') -or ($PartnerB2BDirect.usersAndGroups.accessType -eq 'blocked') + $InheritDefault = -not $PartnerB2BDirect -or ($null -eq $PartnerB2BDirect.applications -and $null -eq $PartnerB2BDirect.usersAndGroups) + + if ($InheritDefault -and $DefaultB2BDirectBlocked) { + $DiagMessages.Add("[Cross-Tenant Access Policy] Partner policy for '$EmailDomain' exists but B2B direct connect inbound is set to 'Inherit from default', and the default policy BLOCKS it. Change B2B direct connect inbound to 'Allow' on the partner policy. CIPP Settings: $PartnerEditLink") + } elseif (-not $InheritDefault -and $PartnerB2BDirectBlocked) { + $DiagMessages.Add("[Cross-Tenant Access Policy] Partner policy for '$EmailDomain' explicitly BLOCKS B2B direct connect inbound. Shared channels require this to be set to 'Allow'. CIPP Settings: $PartnerEditLink") + } + } elseif ($DefaultB2BDirectBlocked) { + $DiagMessages.Add("[Cross-Tenant Access Policy] No partner-specific policy exists for '$EmailDomain', and the DEFAULT policy BLOCKS B2B direct connect inbound. Create a partner-specific policy for '$EmailDomain' and set B2B direct connect inbound to 'Allow'. CIPP Settings: /tenant/administration/cross-tenant-access/partners/partner") + } + + if ($DiagMessages.Count -eq 0 -or -not ($DiagMessages | Where-Object { $_ -match 'Cross-Tenant' })) { + $DiagMessages.Add("[Cross-Tenant Access Policy] The inbound B2B direct connect policy on THIS tenant appears to allow access. However, the EXTERNAL tenant ($EmailDomain) must also configure their OUTBOUND cross-tenant access policy to allow B2B direct connect to this tenant. This must be configured by the external organization's admin.") + } + } catch { + $DiagMessages.Add("[Cross-Tenant Access Policy] Could not retrieve cross-tenant access policies. Ensure the CIPP app has 'Policy.Read.All' permission. Shared channels require B2B direct connect policies to be configured on BOTH tenants.") + } + } + + if ($DiagMessages.Count -gt 0) { + $Message = "Failed to $FriendlyAction team '$TeamLabel'. Error: $FriendlyError`n`nDiagnostics:`n" + ($DiagMessages -join "`n`n") + } + } + } catch { + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Channel member diagnostics failed: $($_.Exception.Message)" -Sev Debug + } + } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @{ Results = $Message } + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTeamFromGroup.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTeamFromGroup.ps1 new file mode 100644 index 0000000000..585b4e092e --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTeamFromGroup.ps1 @@ -0,0 +1,108 @@ +function Invoke-ExecTeamFromGroup { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Teams.Group.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.TenantFilter + $SiteId = $Request.Body.SiteId + $DisplayName = $Request.Body.DisplayName + + if (-not $TenantFilter) { $TenantFilter = $Request.Query.TenantFilter } + if (-not $SiteId) { $SiteId = $Request.Query.SiteId } + + $SiteLabel = if ($DisplayName) { $DisplayName } else { $SiteId } + + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'TenantFilter is required' } + }) + } + + if (-not $SiteId) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'SiteId is required' } + }) + } + + try { + # Step 1: Resolve GroupId from the SharePoint Admin API + $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter + $SiteInfoUri = "$($SharePointInfo.AdminUrl)/_api/SPO.Tenant/sites('$SiteId')" + $ExtraHeaders = @{ + 'accept' = 'application/json' + 'content-type' = 'application/json' + 'odata-version' = '4.0' + } + + $SiteInfo = New-GraphGETRequest ` + -scope "$($SharePointInfo.AdminUrl)/.default" ` + -uri $SiteInfoUri ` + -tenantid $TenantFilter ` + -extraHeaders $ExtraHeaders + + if (-not $SiteInfo) { + throw 'Could not retrieve site information from SharePoint Admin API' + } + + $GroupId = $SiteInfo.GroupId + $IsGroupConnected = $GroupId -and $GroupId -ne '00000000-0000-0000-0000-000000000000' + + if (-not $IsGroupConnected) { + $Message = "Site '$SiteLabel' is not connected to a Microsoft 365 Group. Only group-connected sites (Team Sites) can be team-enabled." + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev Warning + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = $Message } + }) + } + + # Step 2: Check if the group already has a Team + $GroupInfo = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/groups/$GroupId`?`$select=id,displayName,resourceProvisioningOptions" ` + -tenantid $TenantFilter -asApp $true + + $HasTeam = $GroupInfo.resourceProvisioningOptions -contains 'Team' + + if ($HasTeam) { + $GroupDisplayName = $GroupInfo.displayName + $Message = "Site '$SiteLabel' already has a Team ('$GroupDisplayName'). No action needed." + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev Info + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ Results = $Message } + }) + } + + # Step 3: Team-enable the group via PUT /groups/{id}/team + $null = New-GraphPostRequest -AsApp $true ` + -uri "https://graph.microsoft.com/v1.0/groups/$GroupId/team" ` + -tenantid $TenantFilter ` + -type PUT ` + -body '{}' + + $GroupDisplayName = if ($GroupInfo.displayName) { $GroupInfo.displayName } else { $SiteLabel } + $Message = "Successfully created a Team for '$GroupDisplayName' from SharePoint site '$SiteLabel'. The existing site, membership, and content are preserved. Full Team provisioning may take a few minutes." + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev Info + $StatusCode = [HttpStatusCode]::OK + + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Message = "Failed to create Team from site '$SiteLabel'. Error: $($ErrorMessage.NormalizedError)" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev Error -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::Forbidden + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @{ Results = $Message } + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTeamMember.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTeamMember.ps1 new file mode 100644 index 0000000000..aa56aaa222 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTeamMember.ps1 @@ -0,0 +1,112 @@ +Function Invoke-ExecTeamMember { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Teams.Group.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.TenantFilter + $TeamID = $Request.Body.TeamID + $Action = $Request.Body.Action + $DisplayName = $Request.Body.DisplayName + + if (-not $TenantFilter) { $TenantFilter = $Request.Query.TenantFilter } + if (-not $TeamID) { $TeamID = $Request.Query.TeamID } + + $TeamLabel = if ($DisplayName) { $DisplayName } else { $TeamID } + + try { + switch ($Action) { + 'Add' { + $UserID = $Request.Body.UserID + # Support autocomplete/select field format: { value: "...", label: "..." } + if ($UserID -is [hashtable] -or $UserID -is [PSCustomObject]) { + $UserID = $UserID.value + } elseif ($UserID -is [System.Collections.IDictionary]) { + $UserID = $UserID['value'] + } + $Role = $Request.Body.Role + if (-not $Role) { $Role = 'member' } + + # Add member via the M365 Group membership API (Team ID = Group ID). + # This is more reliable than the Teams conversation member API, + # especially for guest users whose objects may still be propagating. + $null = Add-CIPPGroupMember -GroupType 'Team' -GroupID $TeamID -Member $UserID -TenantFilter $TenantFilter -Headers $Headers + $Message = "Successfully added user as $Role to team '$TeamLabel'" + + # If adding as owner, also set the owner role via Teams API + if ($Role -eq 'owner') { + try { + # Look up the membership ID to promote to owner + $TeamMembers = New-GraphGetRequest -AsApp $true -uri "https://graph.microsoft.com/v1.0/teams/$TeamID/members" -tenantid $TenantFilter + $NewMember = $TeamMembers | Where-Object { $_.userId -eq $UserID } + if ($NewMember) { + [string[]]$OwnerRoles = @('owner') + $RoleBody = @{ + '@odata.type' = '#microsoft.graph.aadUserConversationMember' + 'roles' = $OwnerRoles + } | ConvertTo-Json -Depth 5 + $null = New-GraphPostRequest -AsApp $true -uri "https://graph.microsoft.com/v1.0/teams/$TeamID/members/$($NewMember.id)" -tenantid $TenantFilter -type PATCH -body $RoleBody + $Message = "Successfully added user as owner to team '$TeamLabel'" + } + } catch { + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Added member but failed to set owner role: $($_.Exception.Message)" -Sev 'Warning' + $Message = "Added user to team '$TeamLabel' as member (owner role promotion failed - you can promote them from the team members list)" + } + } + } + 'Remove' { + $MembershipID = $Request.Body.MembershipID + # Support autocomplete/select field format + if ($MembershipID -is [hashtable] -or $MembershipID -is [PSCustomObject]) { + $MembershipID = $MembershipID.value + } elseif ($MembershipID -is [System.Collections.IDictionary]) { + $MembershipID = $MembershipID['value'] + } + + $null = New-GraphPostRequest -AsApp $true -uri "https://graph.microsoft.com/v1.0/teams/$TeamID/members/$MembershipID" -tenantid $TenantFilter -type DELETE + $Message = "Successfully removed member from team '$TeamLabel'" + } + 'SetRole' { + $MembershipID = $Request.Body.MembershipID + if ($MembershipID -is [hashtable] -or $MembershipID -is [PSCustomObject]) { + $MembershipID = $MembershipID.value + } elseif ($MembershipID -is [System.Collections.IDictionary]) { + $MembershipID = $MembershipID['value'] + } + $Role = $Request.Body.Role + if (-not $Role) { $Role = 'member' } + + [string[]]$Roles = if ($Role -eq 'owner') { @('owner') } else { @() } + $Body = @{ + '@odata.type' = '#microsoft.graph.aadUserConversationMember' + 'roles' = $Roles + } | ConvertTo-Json -Depth 5 + + $null = New-GraphPostRequest -AsApp $true -uri "https://graph.microsoft.com/v1.0/teams/$TeamID/members/$MembershipID" -tenantid $TenantFilter -type PATCH -body $Body + $Message = "Successfully changed member role to '$Role' in team '$TeamLabel'" + } + default { + throw "Unknown action: $Action. Supported actions: Add, Remove, SetRole" + } + } + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev Info + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Message = "Failed to $Action member in team '$TeamLabel'. Error: $($ErrorMessage.NormalizedError)" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev Error -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::Forbidden + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @{ Results = $Message } + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTeamSettings.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTeamSettings.ps1 new file mode 100644 index 0000000000..47076ceace --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTeamSettings.ps1 @@ -0,0 +1,123 @@ +Function Invoke-ExecTeamSettings { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Teams.Group.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.TenantFilter + $TeamID = $Request.Body.TeamID + $DisplayName = $Request.Body.DisplayName + + if (-not $TenantFilter) { $TenantFilter = $Request.Query.TenantFilter } + if (-not $TeamID) { $TeamID = $Request.Query.TeamID } + + $TeamLabel = if ($DisplayName) { $DisplayName } else { $TeamID } + + try { + $PatchBody = @{} + + # Build patch body from provided settings + if ($Request.Body.description) { + $PatchBody['description'] = $Request.Body.description + } + + if ($Request.Body.visibility) { + $vis = $Request.Body.visibility + if ($vis -is [hashtable] -or $vis -is [PSCustomObject]) { + $vis = $vis.value + } + $PatchBody['visibility'] = $vis + } + + # Member settings + $MemberSettings = @{} + $MemberSettingsFields = @( + 'allowCreateUpdateChannels', 'allowDeleteChannels', 'allowAddRemoveApps', + 'allowCreatePrivateChannels', 'allowCreateUpdateRemoveTabs', 'allowCreateUpdateRemoveConnectors' + ) + foreach ($field in $MemberSettingsFields) { + if ($null -ne $Request.Body.$field) { + $val = $Request.Body.$field + if ($val -is [string]) { $val = [System.Convert]::ToBoolean($val) } + $MemberSettings[$field] = $val + } + } + if ($MemberSettings.Count -gt 0) { $PatchBody['memberSettings'] = $MemberSettings } + + # Guest settings + $GuestSettings = @{} + $GuestFields = @('allowCreateUpdateChannels_guest', 'allowDeleteChannels_guest') + $GuestFieldMap = @{ + 'allowCreateUpdateChannels_guest' = 'allowCreateUpdateChannels' + 'allowDeleteChannels_guest' = 'allowDeleteChannels' + } + foreach ($field in $GuestFields) { + if ($null -ne $Request.Body.$field) { + $val = $Request.Body.$field + if ($val -is [string]) { $val = [System.Convert]::ToBoolean($val) } + $GuestSettings[$GuestFieldMap[$field]] = $val + } + } + if ($GuestSettings.Count -gt 0) { $PatchBody['guestSettings'] = $GuestSettings } + + # Messaging settings + $MessagingSettings = @{} + $MessagingFields = @( + 'allowUserEditMessages', 'allowUserDeleteMessages', 'allowOwnerDeleteMessages', + 'allowTeamMentions', 'allowChannelMentions' + ) + foreach ($field in $MessagingFields) { + if ($null -ne $Request.Body.$field) { + $val = $Request.Body.$field + if ($val -is [string]) { $val = [System.Convert]::ToBoolean($val) } + $MessagingSettings[$field] = $val + } + } + if ($MessagingSettings.Count -gt 0) { $PatchBody['messagingSettings'] = $MessagingSettings } + + # Fun settings + $FunSettings = @{} + $FunFields = @('allowGiphy', 'allowStickersAndMemes', 'allowCustomMemes') + foreach ($field in $FunFields) { + if ($null -ne $Request.Body.$field) { + $val = $Request.Body.$field + if ($val -is [string]) { $val = [System.Convert]::ToBoolean($val) } + $FunSettings[$field] = $val + } + } + if ($null -ne $Request.Body.giphyContentRating) { + $gcr = $Request.Body.giphyContentRating + if ($gcr -is [hashtable] -or $gcr -is [PSCustomObject]) { $gcr = $gcr.value } + $FunSettings['giphyContentRating'] = $gcr + } + if ($FunSettings.Count -gt 0) { $PatchBody['funSettings'] = $FunSettings } + + if ($PatchBody.Count -eq 0) { + throw 'No settings provided to update' + } + + $Body = $PatchBody | ConvertTo-Json -Depth 5 + $null = New-GraphPostRequest -AsApp $true -uri "https://graph.microsoft.com/v1.0/teams/$TeamID" -tenantid $TenantFilter -type PATCH -body $Body + + $ChangedSettings = ($PatchBody.Keys -join ', ') + $Message = "Successfully updated settings ($ChangedSettings) for team '$TeamLabel'" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev Info + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Message = "Failed to update settings for team '$TeamLabel'. Error: $($ErrorMessage.NormalizedError)" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev Error -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::Forbidden + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @{ Results = $Message } + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTeamsVoicePhoneNumberAssignment.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTeamsVoicePhoneNumberAssignment.ps1 index 744c35d931..0f3fe49a20 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTeamsVoicePhoneNumberAssignment.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTeamsVoicePhoneNumberAssignment.ps1 @@ -4,9 +4,6 @@ Function Invoke-ExecTeamsVoicePhoneNumberAssignment { Entrypoint .ROLE Teams.Voice.ReadWrite - .DESCRIPTION - Assigns a phone number to a user or resource account, or sets the emergency location on a - number, via the Teams administration Graph API. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -15,45 +12,231 @@ Function Invoke-ExecTeamsVoicePhoneNumberAssignment { $Headers = $Request.Headers $Identity = $Request.Body.input.value - $PhoneNumber = $Request.Body.PhoneNumber - $TenantFilter = $Request.Body.TenantFilter - $BaseUri = 'https://graph.microsoft.com/v1.0/admin/teams/telephoneNumberManagement/numberAssignments' + + $tenantFilter = $Request.Body.TenantFilter + # Normalize phone number -- the + prefix can be lost during URL encoding (+ becomes space) + $PhoneNumber = ($Request.Body.PhoneNumber -replace '^\s+', '') -replace '^ ', '' + if ($PhoneNumber -and $PhoneNumber -notmatch '^\+') { + $PhoneNumber = "+$PhoneNumber" + } + $PhoneNumberType = $Request.Body.PhoneNumberType try { if ($Request.Body.locationOnly) { - # updateNumber is synchronous (200) and only touches the optional attributes. - $Body = @{ - telephoneNumber = $PhoneNumber - locationId = $Identity - } - $null = New-GraphPOSTRequest -uri "$BaseUri/updateNumber" -tenantid $TenantFilter -body ($Body | ConvertTo-Json -Compress) -type POST - $Results = [pscustomobject]@{'Results' = "Successfully assigned emergency location to $PhoneNumber" } + $null = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Set-CsPhoneNumberAssignment' -CmdParams @{LocationId = $Identity; PhoneNumber = $PhoneNumber; ErrorAction = 'stop' } + $Results = [pscustomobject]@{'Results' = "Successfully assigned emergency location to $($PhoneNumber)" } } else { - # Graph wants the object ID; the UI sends a UPN, so resolve it when it isn't a GUID. - $TargetId = $Identity - if ($Identity -notmatch '^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$') { - $TargetId = (New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$([uri]::EscapeDataString($Identity))?`$select=id" -tenantid $TenantFilter).id - if (-not $TargetId) { throw "Could not resolve $Identity to a user or resource account." } - } - - $Body = @{ - telephoneNumber = $PhoneNumber - assignmentTargetId = $TargetId - numberType = Get-CippTeamsNumberType -NumberType $Request.Body.PhoneNumberType - } - if ($Request.Body.AssignmentCategory) { $Body.assignmentCategory = $Request.Body.AssignmentCategory } - - # assignNumber is asynchronous: 202 Accepted with a Location header for the operation. - $null = New-GraphPOSTRequest -uri "$BaseUri/assignNumber" -tenantid $TenantFilter -body ($Body | ConvertTo-Json -Compress) -type POST - $Results = [pscustomobject]@{'Results' = "Successfully submitted assignment of $PhoneNumber to $Identity" } + $null = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Set-CsPhoneNumberAssignment' -CmdParams @{Identity = $Identity; PhoneNumber = $PhoneNumber; PhoneNumberType = $PhoneNumberType; ErrorAction = 'stop' } + $Results = [pscustomobject]@{'Results' = "Successfully assigned $($PhoneNumber) to $($Identity)" } } Write-LogMessage -Headers $Headers -API $APINAME -tenant $($TenantFilter) -message $($Results.Results) -Sev Info $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-CippException -Exception $_ - $Results = [pscustomobject]@{'Results' = $ErrorMessage.NormalizedError } - Write-LogMessage -Headers $Headers -API $APINAME -tenant $($TenantFilter) -message $($Results.Results) -Sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $NormError = [string]$ErrorMessage.NormalizedError + $RawError = [string]$ErrorMessage.Message + $ErrorText = "Failed to assign $PhoneNumber to $Identity. $NormError" + Write-LogMessage -Headers $Headers -API $APINAME -tenant $($TenantFilter) -message $ErrorText -Sev Error -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::BadRequest + $Body = @{ + Results = $ErrorText + RawError = $RawError + } + + # --- Root Cause Analysis & Remediation --- + try { + $DiagList = [System.Collections.Generic.List[hashtable]]::new() + + # Pattern 1: Missing Capabilities + if ($NormError -match 'does not have required capabilities' -or $RawError -match 'does not have required capabilities') { + $TeamsAdminUrl = 'https://admin.teams.microsoft.com/phone-numbers' + # Collect capability info from the best available source + $AcquiredCapsList = @() + $AvailableCapsList = @() + $NumberType = $null + $LookupSource = $null + + # Primary: Get-CsOnlineTelephoneNumber (returns AcquiredCapabilities & AvailableCapabilities) + try { + $NumberInfo = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsOnlineTelephoneNumber' -CmdParams @{TelephoneNumber = $PhoneNumber; ErrorAction = 'Stop' } + $AcquiredCapsList = @($NumberInfo.AcquiredCapabilities | Where-Object { $_ }) + $AvailableCapsList = @($NumberInfo.AvailableCapabilities | Where-Object { $_ }) + $NumberType = $NumberInfo.InventoryType + $LookupSource = 'primary' + } catch { + # Fallback: Get-CsPhoneNumberAssignment (returns 'Capability' property only) + try { + $NumberInfo2 = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsPhoneNumberAssignment' -CmdParams @{TelephoneNumber = $PhoneNumber; ErrorAction = 'Stop' } + $RawCaps = if ($NumberInfo2.Capability) { @($NumberInfo2.Capability) } elseif ($NumberInfo2.AcquiredCapabilities) { @($NumberInfo2.AcquiredCapabilities) } else { @() } + $AcquiredCapsList = @($RawCaps | Where-Object { $_ }) + $NumberType = $NumberInfo2.NumberType + $LookupSource = 'fallback' + } catch { + $LookupSource = 'failed' + } + } + + $HasUserAssignment = $AcquiredCapsList -contains 'UserAssignment' + $UserAssignmentAvailable = $AvailableCapsList -contains 'UserAssignment' + + if ($LookupSource -eq 'failed') { + $DetailMsg = "The phone number does not have the required capabilities to be assigned to a user. The diagnostic lookup could not retrieve detailed capability information." + $FixMsg = "Open the Teams Admin Center > Phone Numbers, find this number, and verify its usage type supports user assignment." + } elseif (-not $HasUserAssignment -and $UserAssignmentAvailable) { + $DetailMsg = "This phone number has 'UserAssignment' as an available capability but it has NOT been acquired yet. The number's licensed usage must be changed to 'User' in the Teams Admin Center. This cannot be done via PowerShell — Microsoft only supports this change through the admin center UI." + $FixMsg = "1) Click the button below to open the Teams Admin Center Phone Numbers page. 2) Find number $PhoneNumber in the list. 3) Ensure the number is unassigned (it should be). 4) Select the number and click 'Change usage'. 5) Choose 'User' from the available usages. 6) Click Apply. 7) Return here and retry the assignment." + } elseif (-not $HasUserAssignment -and -not $UserAssignmentAvailable -and $LookupSource -eq 'primary') { + $DetailMsg = "This phone number does not support user assignment. 'UserAssignment' is not listed as an available capability for this number. This number type may be restricted to service use only (auto attendants, call queues, or conferencing)." + $FixMsg = "This number cannot be assigned to a user. You will need to acquire a separate user-type phone number for this person. Check the Teams Admin Center for available number types." + } elseif (-not $HasUserAssignment) { + $DetailMsg = "This phone number does not have the 'UserAssignment' capability required to assign to a user. The number type is '$NumberType'. The number's licensed usage may need to be changed to 'User' in the Teams Admin Center." + $FixMsg = "1) Click the button below to open the Teams Admin Center Phone Numbers page. 2) Find number $PhoneNumber in the list. 3) Select the number and click 'Change usage'. 4) Choose 'User' from the available usages. 5) Click Apply. 6) Return here and retry the assignment." + } else { + $DetailMsg = "This phone number has the UserAssignment capability, but the assignment still failed. The number type is '$NumberType'. This may be a provisioning delay or a Teams backend issue." + $FixMsg = "Wait a few minutes and retry. If the issue persists, open the Teams Admin Center > Phone Numbers and verify this number's configuration." + } + + $DiagEntry = @{ + source = 'Phone Number Capabilities' + issue = 'Number lacks required capabilities for user assignment' + detail = $DetailMsg + fix = $FixMsg + severity = 'error' + canQuickFix = $false + settingsPage = $TeamsAdminUrl + riskLevel = $null + riskWarning = $null + numberType = $NumberType + acquiredCapabilities = @($AcquiredCapsList) + availableCapabilities = @($AvailableCapsList) + } + $DiagList.Add($DiagEntry) + } + + # Pattern 2: Number Already Assigned to Someone + elseif ($NormError -match 'is already assigned' -or $RawError -match 'is already assigned') { + $CurrentAssignee = $null + $CurrentAssigneeDisplay = 'another user' + try { + $NumberInfo = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsPhoneNumberAssignment' -CmdParams @{TelephoneNumber = $PhoneNumber; ErrorAction = 'Stop' } + if ($NumberInfo.AssignedPstnTargetId) { + $CurrentAssignee = $NumberInfo.AssignedPstnTargetId + try { + $UserInfo = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsOnlineUser' -CmdParams @{Identity = $NumberInfo.AssignedPstnTargetId; ErrorAction = 'Stop' } + $CurrentAssigneeDisplay = if ($UserInfo.DisplayName) { "$($UserInfo.DisplayName) ($($UserInfo.UserPrincipalName))" } else { $NumberInfo.AssignedPstnTargetId } + } catch { + $CurrentAssigneeDisplay = $NumberInfo.AssignedPstnTargetId + } + } + } catch { + # Could not retrieve current assignment + } + $DiagList.Add(@{ + source = 'Phone Number Assignment' + issue = "Phone number is already assigned to $CurrentAssigneeDisplay" + detail = "The phone number $PhoneNumber is currently assigned to $CurrentAssigneeDisplay. A phone number can only be assigned to one user at a time." + fix = "Unassign the phone number from the current user first, then retry the assignment." + severity = 'warning' + canQuickFix = $true + quickFixAction = 'unassignAndRetry' + quickFixData = @{ + currentAssignee = $CurrentAssignee + currentAssigneeDisplay = $CurrentAssigneeDisplay + phoneNumber = $PhoneNumber + phoneNumberType = $PhoneNumberType + } + riskLevel = 'high' + riskWarning = "This will immediately remove phone service from $CurrentAssigneeDisplay. They will not be able to make or receive calls until a new number is assigned." + settingsPage = $null + }) + } + + # Pattern 3: User Already Has a Phone Number + elseif ($NormError -match 'already has a phone number' -or $RawError -match 'already has a phone number' -or $NormError -match 'already has a number' -or $RawError -match 'already has a number') { + $CurrentNumber = $null + $CurrentNumberType = $null + $UserDisplay = $Identity + try { + $UserInfo = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsOnlineUser' -CmdParams @{Identity = $Identity; ErrorAction = 'Stop' } + $CurrentNumber = $UserInfo.LineUri -replace 'tel:', '' + $CurrentNumberType = $UserInfo.FeatureTypes -join ', ' + if ($UserInfo.DisplayName) { $UserDisplay = "$($UserInfo.DisplayName) ($Identity)" } + } catch { + # Could not retrieve user info + } + $DiagList.Add(@{ + source = 'User Assignment' + issue = "$UserDisplay already has a phone number assigned" + detail = if ($CurrentNumber) { "$UserDisplay currently has phone number $CurrentNumber assigned. A user can only have one phone number at a time." } else { "$UserDisplay already has a phone number assigned. A user can only have one phone number at a time." } + fix = "Remove the existing phone number from this user first, then assign the new number." + severity = 'warning' + canQuickFix = $true + quickFixAction = 'removeUserNumberAndRetry' + quickFixData = @{ + userIdentity = $Identity + userDisplay = $UserDisplay + currentNumber = $CurrentNumber + currentNumberType = $CurrentNumberType + newNumber = $PhoneNumber + newNumberType = $PhoneNumberType + } + riskLevel = 'high' + riskWarning = if ($CurrentNumber) { "This will remove phone number $CurrentNumber from $UserDisplay. They will temporarily lose phone service until the new number ($PhoneNumber) is assigned." } else { "This will remove the current phone number from $UserDisplay. They will temporarily lose phone service until the new number is assigned." } + settingsPage = $null + }) + } + + # Pattern 4: User Not Licensed / Not Found / Not Enabled for Voice + elseif ($NormError -match 'not a valid target' -or $NormError -match 'identity not found' -or $NormError -match 'not enabled for Enterprise Voice' -or $RawError -match 'not a valid target' -or $RawError -match 'identity not found' -or $RawError -match 'not enabled for Enterprise Voice' -or $NormError -match 'could not find user' -or $RawError -match 'could not find user') { + $DiagList.Add(@{ + source = 'User Licensing' + issue = 'User is not licensed for Teams Phone or not enabled for Enterprise Voice' + detail = "The user $Identity does not have the required Teams Phone license or is not enabled for Enterprise Voice. Phone numbers can only be assigned to users with an active Teams Phone System license." + fix = "Assign a Microsoft Teams Phone license (Teams Phone Standard, Calling Plan, or Operator Connect add-on) to this user in the Microsoft 365 Admin Center, then wait a few minutes for provisioning and retry." + severity = 'error' + canQuickFix = $false + settingsPage = $null + riskLevel = $null + riskWarning = $null + }) + } + + # Pattern 5: Phone Number Type Mismatch + elseif ($NormError -match 'not valid for the specified phone number type' -or $RawError -match 'not valid for the specified phone number type' -or $NormError -match 'phone number type' -or $RawError -match 'phone number type.*does not match') { + $ActualType = $null + try { + $NumberInfo = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsPhoneNumberAssignment' -CmdParams @{TelephoneNumber = $PhoneNumber; ErrorAction = 'Stop' } + $ActualType = $NumberInfo.NumberType + } catch { + # Could not retrieve number info + } + $DiagList.Add(@{ + source = 'Phone Number Type' + issue = if ($ActualType) { "Type mismatch: requested '$PhoneNumberType' but number is '$ActualType'" } else { "The phone number type does not match the number's actual type" } + detail = if ($ActualType) { "The assignment was requested with type '$PhoneNumberType' but this number is actually of type '$ActualType'. The system will retry with the correct type." } else { "The phone number type specified does not match the number's actual type." } + fix = 'The system can automatically retry with the correct phone number type.' + severity = 'info' + canQuickFix = $true + quickFixAction = 'retryWithCorrectType' + quickFixData = @{ + phoneNumber = $PhoneNumber + correctType = $ActualType + identity = $Identity + } + riskLevel = 'low' + riskWarning = 'This will retry the assignment using the correct phone number type. No service will be disrupted.' + settingsPage = $null + }) + } + + if ($DiagList.Count -gt 0) { + $Body.Diagnostics = @($DiagList) + } + } catch { + Write-LogMessage -Headers $Headers -API $APINAME -tenant $TenantFilter -message "Voice assignment diagnostics failed: $($_.Exception.Message)" -Sev 'Debug' + } + + $Results = [pscustomobject]$Body } return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTempFileCleanup.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTempFileCleanup.ps1 new file mode 100644 index 0000000000..b6b5986c57 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTempFileCleanup.ps1 @@ -0,0 +1,103 @@ +function Invoke-ExecTempFileCleanup { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + $Files = @($Request.Body.files) + + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'TenantFilter is required' } + }) + } + + if (-not $Files -or $Files.Count -eq 0) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'Files array is required and must not be empty' } + }) + } + + if ($Files.Count -gt 100) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'Maximum 100 files per request. Please split into multiple requests.' } + }) + } + + try { + $Results = [System.Collections.Generic.List[object]]::new() + $SuccessCount = 0 + $FailureCount = 0 + + foreach ($File in $Files) { + if (-not $File.driveId -or -not $File.id) { + $Results.Add(@{ + id = $File.id ?? 'unknown' + name = $File.name ?? 'unknown' + status = 'failed' + message = 'Missing required file properties (driveId, id)' + }) + $FailureCount++ + continue + } + + try { + $Uri = "https://graph.microsoft.com/v1.0/drives/$($File.driveId)/items/$($File.id)" + $null = New-GraphPostRequest -uri $Uri -tenantid $TenantFilter -AsApp $true -type DELETE -body '{}' + + $Results.Add(@{ + id = $File.id + name = $File.name + status = 'deleted' + message = 'Moved to recycle bin' + }) + $SuccessCount++ + } catch { + $ErrorInfo = Get-CippException -Exception $_ + $Results.Add(@{ + id = $File.id + name = $File.name + status = 'failed' + message = $ErrorInfo.NormalizedError + }) + $FailureCount++ + } + } + + $Summary = @{ + Total = $Files.Count + Success = $SuccessCount + Failed = $FailureCount + } + + $LogMessage = "Temp file cleanup completed: $SuccessCount deleted, $FailureCount failed out of $($Files.Count) files" + $LogSeverity = if ($FailureCount -eq 0) { 'Info' } elseif ($SuccessCount -eq 0) { 'Error' } else { 'Warning' } + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $LogMessage -Sev $LogSeverity + + $StatusCode = [HttpStatusCode]::OK + $Body = @{ + Results = @($Results) + Summary = $Summary + } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Temp file cleanup failed: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError + $Body = @{ Results = "Failed to process cleanup request: $($ErrorMessage.NormalizedError)" } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTempFileScan.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTempFileScan.ps1 new file mode 100644 index 0000000000..d207fe87ec --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTempFileScan.ps1 @@ -0,0 +1,113 @@ +function Invoke-ExecTempFileScan { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + $Scope = $Request.Body.scope + $SiteId = $Request.Body.siteId + $UserId = $Request.Body.userId + $Filters = $Request.Body.filters + if (-not $Filters) { + $Filters = [PSCustomObject]@{ + officeTemp = $true + tempFiles = $true + zeroByteFiles = $true + systemJunk = $true + backupFiles = $false + } + } + + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'TenantFilter is required' } + }) + } + + if (-not $Scope) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'Scope is required (site, user, allSites, or allOneDrives)' } + }) + } + + if ($Scope -eq 'site' -and -not $SiteId) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'SiteId is required when scope is site' } + }) + } + + if ($Scope -eq 'user' -and -not $UserId) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'UserId is required when scope is user' } + }) + } + + if ($Scope -notin @('site', 'user', 'allSites', 'allOneDrives')) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = "Invalid scope: $Scope. Must be one of: site, user, allSites, allOneDrives" } + }) + } + + try { + $ScopeLabel = switch ($Scope) { + 'site' { 'Single Site' } + 'user' { 'OneDrive User' } + 'allSites' { 'All SharePoint Sites' } + 'allOneDrives' { 'All OneDrives' } + } + $QueueReference = "TempFileScan-$TenantFilter-$Scope-$SiteId-$UserId" + $Queue = New-CippQueueEntry -Name "Temp File Scan - $ScopeLabel" -Link '/teams-share/sharepoint/temp-file-cleanup' -Reference $QueueReference -TotalTasks 1 + + $FilterParams = @{ + officeTemp = [bool]$Filters.officeTemp + tempFiles = [bool]$Filters.tempFiles + zeroByteFiles = [bool]$Filters.zeroByteFiles + systemJunk = [bool]$Filters.systemJunk + backupFiles = [bool]$Filters.backupFiles + } + + $Queued = Add-CippQueueMessage -Cmdlet 'Start-TempFileScan' -Parameters @{ + QueueId = $Queue.RowKey + TenantFilter = $TenantFilter + Scope = $Scope + SiteId = $SiteId + UserId = $UserId + Filters = $FilterParams + } + + if (-not $Queued) { + throw 'Failed to queue temp file scan' + } + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Queued temp file scan (scope=$Scope, queueId=$($Queue.RowKey))" -Sev Info + + $StatusCode = [HttpStatusCode]::OK + $Body = @{ + Queued = $true + QueueId = $Queue.RowKey + QueueMessage = 'Scan queued. Results will be available when the job completes.' + } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Temp file scan queue failed: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError + $Body = @{ Results = "Failed to start temp file scan: $($ErrorMessage.NormalizedError)" } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecValidateExternalDomain.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecValidateExternalDomain.ps1 new file mode 100644 index 0000000000..90b8fe59ee --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecValidateExternalDomain.ps1 @@ -0,0 +1,407 @@ +function Invoke-ExecValidateExternalDomain { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter ?? $Request.Query.tenantFilter + $Email = $Request.Body.email ?? $Request.Query.email + $Context = $Request.Body.context ?? $Request.Query.context ?? 'general' + + $MSAConsumerTenantId = '9188040d-6c67-4c5b-b112-36a304b66dad' + + if (-not $TenantFilter -or -not $Email) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'tenantFilter and email are required.' } + }) + } + + try { + $Domain = ($Email -split '@')[1] + if (-not $Domain) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'Invalid email address format.' } + }) + } + + $Result = @{ + email = $Email + domain = $Domain + domainType = 'unknown' + externalTenantId = $null + existingGuest = $null + recommendedAccessType = 'guest' + recommendedAccessReason = '' + supportedContexts = @() + unsupportedContexts = @() + policyChecks = [System.Collections.Generic.List[hashtable]]::new() + canProceed = $true + } + + # --- Domain type classification via OIDC discovery --- + try { + $OidcConfig = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$Domain/.well-known/openid-configuration" -Method GET -ErrorAction Stop + $ResolvedTenantId = ($OidcConfig.issuer -split '/')[3] + + if (-not $ResolvedTenantId -or $ResolvedTenantId -eq $MSAConsumerTenantId) { + $Result.domainType = 'consumer' + $Result.externalTenantId = $null + $Result.recommendedAccessType = 'guest' + $Result.recommendedAccessReason = "'$Domain' is a personal email domain (consumer account). Guest Access (B2B Collaboration) is the only option. The guest will authenticate via Email One-Time Passcode." + $Result.supportedContexts = @('sharepoint', 'teams-standard', 'teams-private') + $Result.unsupportedContexts = @(@{ + context = 'teams-shared' + reason = "Shared channels use External Access (B2B Direct Connect) which requires a work or school account from another Microsoft 365 organization. Personal email addresses like '$Domain' are not supported. Use a standard or private channel instead." + }) + } else { + $Result.domainType = 'organizational' + $Result.externalTenantId = $ResolvedTenantId + $Result.recommendedAccessType = if ($Context -eq 'teams-shared') { 'external' } else { 'guest' } + $Result.recommendedAccessReason = "'$Domain' belongs to Microsoft 365 tenant $ResolvedTenantId. Both Guest Access (B2B Collaboration) and External Access (B2B Direct Connect) are available depending on the target resource." + $Result.supportedContexts = @('sharepoint', 'teams-standard', 'teams-private', 'teams-shared') + $Result.unsupportedContexts = @() + } + } catch { + $Result.domainType = 'unresolvable' + $Result.recommendedAccessType = 'guest' + $Result.recommendedAccessReason = "Could not resolve '$Domain' via OIDC discovery. This may be a personal email domain or a domain without a Microsoft 365 tenant. Try Guest Access (B2B Collaboration)." + $Result.supportedContexts = @('sharepoint', 'teams-standard', 'teams-private') + $Result.unsupportedContexts = @(@{ + context = 'teams-shared' + reason = "Cannot verify that '$Domain' has a Microsoft 365 tenant. Shared channels require B2B Direct Connect with a verified organizational domain." + }) + } + + # --- Check for existing guest user --- + try { + $EncodedEmail = $Email -replace '#', '%23' + $UserLookup = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users?`$filter=mail eq '$EncodedEmail' or userPrincipalName eq '$EncodedEmail'&`$select=id,displayName,userPrincipalName,userType,accountEnabled,externalUserState,signInActivity" -tenantid $TenantFilter -AsApp $true + $ResolvedUser = if ($UserLookup -is [array]) { $UserLookup[0] } else { $UserLookup } + + if ($ResolvedUser) { + $Result.existingGuest = @{ + id = $ResolvedUser.id + displayName = $ResolvedUser.displayName + upn = $ResolvedUser.userPrincipalName + userType = $ResolvedUser.userType + accountEnabled = $ResolvedUser.accountEnabled + externalUserState = $ResolvedUser.externalUserState + lastSignIn = $ResolvedUser.signInActivity.lastSignInDateTime + } + } + } catch { + # Non-critical — user lookup may fail for permission reasons + } + + # --- Entra External Collaboration: invite restrictions --- + try { + $AuthPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $TenantFilter -AsApp $true + + if ($AuthPolicy.allowInvitesFrom -eq 'none') { + $Result.policyChecks.Add(@{ + source = 'Entra External Collaboration' + status = 'fail' + detail = 'Guest invitations are completely disabled. No one in the organization can invite guest users.' + fix = 'Change guest invite restrictions to allow at least admins and the Guest Inviter role to send invitations.' + settingsPage = '/tenant/administration/cross-tenant-access/external-collaboration' + }) + $Result.canProceed = $false + } elseif ($AuthPolicy.allowInvitesFrom -eq 'everyone') { + $Result.policyChecks.Add(@{ + source = 'Entra External Collaboration' + status = 'warning' + detail = 'Anyone in the organization (including existing guests) can invite guest users. Consider restricting to admins or the Guest Inviter role.' + fix = 'Restrict guest invite permissions for better security.' + settingsPage = '/tenant/administration/cross-tenant-access/external-collaboration' + }) + } else { + $Result.policyChecks.Add(@{ + source = 'Entra External Collaboration' + status = 'pass' + detail = "Guest invite restrictions: $($AuthPolicy.allowInvitesFrom)" + fix = $null + settingsPage = '/tenant/administration/cross-tenant-access/external-collaboration' + }) + } + } catch { + $Result.policyChecks.Add(@{ + source = 'Entra External Collaboration' + status = 'warning' + detail = 'Could not retrieve authorization policy. Check CIPP permissions.' + fix = 'Ensure CIPP has Policy.Read.All permission.' + settingsPage = '/tenant/administration/cross-tenant-access/external-collaboration' + }) + } + + # --- Entra B2B domain allow/block lists --- + try { + $B2BPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/legacy/policies' -tenantid $TenantFilter -AsApp $true + $B2BManagement = $B2BPolicy | Where-Object { $_.type -eq 6 } + if ($B2BManagement) { + $B2BDefinition = ($B2BManagement.definition | ConvertFrom-Json).B2BManagementPolicy + $DomainPolicy = $B2BDefinition.InvitationsAllowedAndBlockedDomainsPolicy + + if ($DomainPolicy.AllowedDomains -and $DomainPolicy.AllowedDomains.Count -gt 0) { + if ($Domain -notin $DomainPolicy.AllowedDomains) { + $Result.policyChecks.Add(@{ + source = 'Entra Domain Restrictions' + status = 'fail' + detail = "Domain '$Domain' is not in the Entra allowed domains list. Allowed: $($DomainPolicy.AllowedDomains -join ', ')." + fix = "Add '$Domain' to the allowed domains list or switch to a block-list approach." + settingsPage = '/tenant/administration/cross-tenant-access/external-collaboration' + currentList = @($DomainPolicy.AllowedDomains) + listType = 'allowList' + }) + $Result.canProceed = $false + } else { + $Result.policyChecks.Add(@{ + source = 'Entra Domain Restrictions' + status = 'pass' + detail = "Domain '$Domain' is in the allowed domains list." + fix = $null + settingsPage = '/tenant/administration/cross-tenant-access/external-collaboration' + }) + } + } + + if ($DomainPolicy.BlockedDomains -and $DomainPolicy.BlockedDomains.Count -gt 0) { + if ($Domain -in $DomainPolicy.BlockedDomains) { + $Result.policyChecks.Add(@{ + source = 'Entra Domain Restrictions' + status = 'fail' + detail = "Domain '$Domain' is explicitly blocked for guest invitations." + fix = "Remove '$Domain' from the blocked domains list." + settingsPage = '/tenant/administration/cross-tenant-access/external-collaboration' + currentList = @($DomainPolicy.BlockedDomains) + listType = 'blockList' + }) + $Result.canProceed = $false + } + } + } else { + $Result.policyChecks.Add(@{ + source = 'Entra Domain Restrictions' + status = 'pass' + detail = 'No B2B domain allow-list or block-list configured. All domains are permitted for guest invitations.' + fix = $null + settingsPage = '/tenant/administration/cross-tenant-access/external-collaboration' + }) + } + } catch { + # Non-critical + } + + # --- SharePoint sharing settings --- + if ($Context -in @('sharepoint', 'general')) { + try { + $SPSettings = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings' -tenantid $TenantFilter -AsApp $true + + if ($SPSettings.sharingCapability -eq 'disabled') { + $Result.policyChecks.Add(@{ + source = 'SharePoint Sharing' + status = 'fail' + detail = 'SharePoint external sharing is completely disabled. No external users can access SharePoint content.' + fix = "Set sharing level to at least 'Existing guests' or 'New and existing guests'." + settingsPage = '/teams-share/sharepoint/sharing-settings' + }) + if ($Context -eq 'sharepoint') { $Result.canProceed = $false } + } elseif ($SPSettings.sharingCapability -eq 'existingExternalUserSharingOnly' -and -not $Result.existingGuest) { + $Result.policyChecks.Add(@{ + source = 'SharePoint Sharing' + status = 'warning' + detail = "SharePoint sharing is set to 'Existing guests' only, and this user is not yet a guest in the tenant. The user must be invited first, then granted SharePoint access." + fix = "Invite the user as a guest first, or change sharing to 'New and existing guests'." + settingsPage = '/teams-share/sharepoint/sharing-settings' + }) + } else { + $Result.policyChecks.Add(@{ + source = 'SharePoint Sharing' + status = 'pass' + detail = "SharePoint sharing capability: $($SPSettings.sharingCapability)" + fix = $null + settingsPage = '/teams-share/sharepoint/sharing-settings' + }) + } + + if ($SPSettings.sharingDomainRestrictionMode -eq 'allowList') { + $SPAllowed = @($SPSettings.sharingAllowedDomainList) + if ($SPAllowed.Count -gt 0 -and $Domain -notin $SPAllowed) { + $Result.policyChecks.Add(@{ + source = 'SharePoint Domain Restrictions' + status = 'fail' + detail = "Domain '$Domain' is not in the SharePoint allowed domains list. Allowed: $($SPAllowed -join ', ')." + fix = "Add '$Domain' to the SharePoint sharing allowed domains list." + settingsPage = '/teams-share/sharepoint/sharing-settings' + currentList = $SPAllowed + listType = 'allowList' + }) + if ($Context -eq 'sharepoint') { $Result.canProceed = $false } + } + } elseif ($SPSettings.sharingDomainRestrictionMode -eq 'blockList') { + $SPBlocked = @($SPSettings.sharingBlockedDomainList) + if ($SPBlocked.Count -gt 0 -and $Domain -in $SPBlocked) { + $Result.policyChecks.Add(@{ + source = 'SharePoint Domain Restrictions' + status = 'fail' + detail = "Domain '$Domain' is blocked in SharePoint sharing settings." + fix = "Remove '$Domain' from the SharePoint blocked domains list." + settingsPage = '/teams-share/sharepoint/sharing-settings' + currentList = $SPBlocked + listType = 'blockList' + }) + if ($Context -eq 'sharepoint') { $Result.canProceed = $false } + } + } + } catch { + $Result.policyChecks.Add(@{ + source = 'SharePoint Sharing' + status = 'warning' + detail = 'Could not retrieve SharePoint settings.' + fix = 'Check CIPP permissions for SharePoint admin access.' + settingsPage = '/teams-share/sharepoint/sharing-settings' + }) + } + } + + # --- Teams guest access --- + if ($Context -in @('teams-standard', 'teams-private', 'teams-shared', 'general')) { + try { + $ClientConfig = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsTeamsClientConfiguration' -CmdParams @{Identity = 'Global' } + if ($ClientConfig.AllowGuestUser -eq $false) { + $Result.policyChecks.Add(@{ + source = 'Teams Guest Access' + status = 'fail' + detail = 'Guest access is disabled for Microsoft Teams. Guests cannot be added to any teams.' + fix = "Enable 'Allow guest access' in Teams Settings." + settingsPage = '/teams-share/teams/teams-settings' + }) + if ($Context -like 'teams-*') { $Result.canProceed = $false } + } else { + $Result.policyChecks.Add(@{ + source = 'Teams Guest Access' + status = 'pass' + detail = 'Teams guest access is enabled.' + fix = $null + settingsPage = '/teams-share/teams/teams-settings' + }) + } + } catch { + $Result.policyChecks.Add(@{ + source = 'Teams Guest Access' + status = 'warning' + detail = 'Could not retrieve Teams settings.' + fix = 'Check CIPP permissions for Teams administration.' + settingsPage = '/teams-share/teams/teams-settings' + }) + } + } + + # --- Cross-tenant access policies (for shared channels / organizational domains) --- + if ($Result.domainType -eq 'organizational' -and $Context -in @('teams-shared', 'general')) { + try { + $DefaultCTA = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default' -tenantid $TenantFilter -AsApp $true + + $DefaultB2BDirect = $DefaultCTA.b2bDirectConnectInbound + $DefaultBlocked = ($DefaultB2BDirect.applications.accessType -eq 'blocked' -and ($DefaultB2BDirect.applications.targets | Where-Object { $_.target -eq 'AllApplications' })) -or + ($DefaultB2BDirect.usersAndGroups.accessType -eq 'blocked' -and ($DefaultB2BDirect.usersAndGroups.targets | Where-Object { $_.target -eq 'AllUsers' })) + + $PartnerPolicy = $null + if ($Result.externalTenantId) { + try { + $PartnerPolicy = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/partners/$($Result.externalTenantId)" -tenantid $TenantFilter -AsApp $true + } catch { + # No partner-specific policy + } + } + + if ($PartnerPolicy) { + $PartnerB2BDirect = $PartnerPolicy.b2bDirectConnectInbound + $InheritDefault = -not $PartnerB2BDirect -or ($null -eq $PartnerB2BDirect.applications -and $null -eq $PartnerB2BDirect.usersAndGroups) + $PartnerBlocked = ($PartnerB2BDirect.applications.accessType -eq 'blocked') -or ($PartnerB2BDirect.usersAndGroups.accessType -eq 'blocked') + + if ($InheritDefault -and $DefaultBlocked) { + $Result.policyChecks.Add(@{ + source = 'Cross-Tenant Access Policy' + status = 'fail' + detail = "Partner policy for '$Domain' inherits from default, which blocks B2B Direct Connect inbound. Shared channels will not work." + fix = "Set B2B Direct Connect inbound to 'Allow' on the partner policy for '$Domain'." + settingsPage = "/tenant/administration/cross-tenant-access/partners/partner?tenantId=$($Result.externalTenantId)" + }) + if ($Context -eq 'teams-shared') { $Result.canProceed = $false } + } elseif (-not $InheritDefault -and $PartnerBlocked) { + $Result.policyChecks.Add(@{ + source = 'Cross-Tenant Access Policy' + status = 'fail' + detail = "Partner policy for '$Domain' explicitly blocks B2B Direct Connect inbound." + fix = "Change B2B Direct Connect inbound to 'Allow' on the partner policy." + settingsPage = "/tenant/administration/cross-tenant-access/partners/partner?tenantId=$($Result.externalTenantId)" + }) + if ($Context -eq 'teams-shared') { $Result.canProceed = $false } + } else { + $Result.policyChecks.Add(@{ + source = 'Cross-Tenant Access Policy' + status = 'pass' + detail = "B2B Direct Connect inbound is allowed for '$Domain'. Note: the external tenant must also allow outbound B2B Direct Connect." + fix = $null + settingsPage = "/tenant/administration/cross-tenant-access/partners/partner?tenantId=$($Result.externalTenantId)" + }) + } + } elseif ($DefaultBlocked) { + $Result.policyChecks.Add(@{ + source = 'Cross-Tenant Access Policy' + status = 'fail' + detail = "No partner policy exists for '$Domain' and the default policy blocks B2B Direct Connect inbound." + fix = "Create a partner policy for '$Domain' with B2B Direct Connect inbound set to 'Allow'." + settingsPage = '/tenant/administration/cross-tenant-access/partners' + }) + if ($Context -eq 'teams-shared') { $Result.canProceed = $false } + } else { + $Result.policyChecks.Add(@{ + source = 'Cross-Tenant Access Policy' + status = 'pass' + detail = "Default policy allows B2B Direct Connect inbound. Note: the external tenant must also allow outbound." + fix = $null + settingsPage = '/tenant/administration/cross-tenant-access/policy' + }) + } + } catch { + $Result.policyChecks.Add(@{ + source = 'Cross-Tenant Access Policy' + status = 'warning' + detail = 'Could not retrieve cross-tenant access policies.' + fix = 'Ensure CIPP has Policy.Read.All permission.' + settingsPage = '/tenant/administration/cross-tenant-access/policy' + }) + } + } + + # --- Context-specific validation --- + if ($Context -eq 'teams-shared' -and $Result.domainType -eq 'consumer') { + $Result.canProceed = $false + } + + $Result.policyChecks = @($Result.policyChecks) + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Validated external domain '$Domain' (type: $($Result.domainType)) for context '$Context'" -Sev 'Info' + $StatusCode = [HttpStatusCode]::OK + $Body = @{ Results = $Result } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Domain validation failed: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError + $Body = @{ Results = "Domain validation failed: $($ErrorMessage.NormalizedError)" } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecZipFiles.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecZipFiles.ps1 new file mode 100644 index 0000000000..43017a8020 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecZipFiles.ps1 @@ -0,0 +1,207 @@ +function Invoke-ExecZipFiles { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.TenantFilter + if (-not $TenantFilter) { $TenantFilter = $Request.Query.TenantFilter } + + $Items = $Request.Body.Items + $ZipFileName = $Request.Body.ZipFileName + if (-not $ZipFileName) { $ZipFileName = "CIPP-Archive-$(Get-Date -Format 'yyyy-MM-dd').zip" } + + $DestinationUserId = $Request.Body.DestinationUserId + $DestinationSiteId = $Request.Body.DestinationSiteId + $DestinationFolderId = $Request.Body.DestinationFolderId + $HasDestination = $DestinationUserId -or $DestinationSiteId + + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + ContentType = 'application/json' + Body = @{ Results = 'TenantFilter is required' } + }) + } + + if (-not $Items -or $Items.Count -eq 0) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + ContentType = 'application/json' + Body = @{ Results = 'Items array is required and must not be empty' } + }) + } + + $MaxItems = 100 + if ($Items.Count -gt $MaxItems) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + ContentType = 'application/json' + Body = @{ Results = "Too many items. Maximum is $MaxItems, received $($Items.Count)." } + }) + } + + $MemStream = $null + $ZipArchive = $null + + try { + Add-Type -AssemblyName System.IO.Compression + + $MemStream = [System.IO.MemoryStream]::new() + $ZipArchive = [System.IO.Compression.ZipArchive]::new($MemStream, [System.IO.Compression.ZipArchiveMode]::Create, $true) + + $FileCount = 0 + $TotalBytes = [long]0 + $MaxTotalBytes = 500MB + $Errors = [System.Collections.Generic.List[string]]::new() + + foreach ($Item in $Items) { + $ItemDriveId = $Item.DriveId + $ItemItemId = $Item.ItemId + $ItemName = $Item.Name + + if (-not $ItemDriveId -or -not $ItemItemId) { + $Errors.Add("Skipped item '$ItemName': missing DriveId or ItemId") + continue + } + + try { + $GraphItem = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/drives/$ItemDriveId/items/$ItemItemId" ` + -tenantid $TenantFilter -asApp $true + + $DownloadUrl = $GraphItem.'@microsoft.graph.downloadUrl' + if (-not $DownloadUrl) { + $Errors.Add("Skipped '$($GraphItem.name ?? $ItemName)': no download URL (may be a folder)") + continue + } + + $FileName = $GraphItem.name ?? $ItemName + $FileSize = [long]($GraphItem.size ?? 0) + + if (($TotalBytes + $FileSize) -gt $MaxTotalBytes) { + $Errors.Add("Skipped '$FileName': adding it would exceed the 500 MB limit") + continue + } + + $FileBytes = Invoke-RestMethod -Uri $DownloadUrl -Method GET -ErrorAction Stop + + if ($FileBytes -is [string]) { + $FileBytes = [System.Text.Encoding]::UTF8.GetBytes($FileBytes) + } + + $Entry = $ZipArchive.CreateEntry($FileName, [System.IO.Compression.CompressionLevel]::Fastest) + $EntryStream = $Entry.Open() + try { + $EntryStream.Write($FileBytes, 0, $FileBytes.Length) + } finally { + $EntryStream.Close() + } + + $FileCount++ + $TotalBytes += $FileBytes.Length + } catch { + $Errors.Add("Failed to download '$ItemName': $($_.Exception.Message)") + } + } + + $ZipArchive.Dispose() + $ZipArchive = $null + + if ($FileCount -eq 0) { + $ErrDetail = if ($Errors.Count -gt 0) { " Errors: $($Errors -join '; ')" } else { '' } + throw "No files could be added to the zip.$ErrDetail" + } + + $ZipBytes = $MemStream.ToArray() + + $SizeMB = [math]::Round($ZipBytes.Length / 1MB, 1) + $Summary = "$FileCount file$(if ($FileCount -ne 1) { 's' }) ($SizeMB MB)" + + if ($HasDestination) { + $DestDriveId = $null + if ($DestinationUserId) { + $DestUserDrive = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/users/$DestinationUserId/drive?`$select=id" ` + -tenantid $TenantFilter -asApp $true + $DestDriveId = $DestUserDrive.id + } elseif ($DestinationSiteId) { + $DestDrives = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/sites/$DestinationSiteId/drives" ` + -tenantid $TenantFilter -asApp $true + if ($DestDrives -and $DestDrives.Count -gt 0) { + $DestDriveId = ($DestDrives | Where-Object { $_.driveType -eq 'documentLibrary' } | Select-Object -First 1).id + if (-not $DestDriveId) { $DestDriveId = $DestDrives[0].id } + } + } + + if (-not $DestDriveId) { + throw 'Could not resolve destination drive' + } + + $UploadPath = if ($DestinationFolderId) { + "https://graph.microsoft.com/v1.0/drives/$DestDriveId/items/${DestinationFolderId}:/${ZipFileName}:/content" + } else { + "https://graph.microsoft.com/v1.0/drives/$DestDriveId/root:/${ZipFileName}:/content" + } + + $Token = Get-GraphToken -tenantid $TenantFilter -AsApp $true + $UploadHeaders = @{ + Authorization = "Bearer $($Token.access_token)" + 'Content-Type' = 'application/zip' + } + $null = Invoke-RestMethod -Uri $UploadPath -Method PUT -Headers $UploadHeaders -Body $ZipBytes -ErrorAction Stop + + $Message = "Successfully saved '$ZipFileName' ($Summary) to the destination." + if ($Errors.Count -gt 0) { + $Message += " Warnings: $($Errors -join '; ')" + } + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev Info + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + ContentType = 'application/json' + Body = @{ Results = $Message } + }) + } else { + $Base64 = [Convert]::ToBase64String($ZipBytes) + + $Message = "Zip created with $Summary" + if ($Errors.Count -gt 0) { + $Message += " (warnings: $($Errors -join '; '))" + } + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Zip download: $Summary" -Sev Info + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + ContentType = 'application/json' + Body = @{ + Results = $Message + zipBase64 = $Base64 + zipFileName = $ZipFileName + } + }) + } + } catch { + $ErrorMessage = Get-CippException -Exception $_ + $Message = "Failed to create zip. Error: $($ErrorMessage.NormalizedError)" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev Error -LogData $ErrorMessage + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + ContentType = 'application/json' + Body = @{ Results = $Message } + }) + } finally { + if ($ZipArchive) { try { $ZipArchive.Dispose() } catch {} } + if ($MemStream) { try { $MemStream.Dispose() } catch {} } + } +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListDeletedSites.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListDeletedSites.ps1 index 5020b45d4b..8abec2b5f1 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListDeletedSites.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListDeletedSites.ps1 @@ -39,7 +39,7 @@ function Invoke-ListDeletedSites { } catch { $ErrorMessage = Get-CippException -Exception $_ $Body = "Failed to list deleted sites: $($ErrorMessage.NormalizedError)" - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListHubSites.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListHubSites.ps1 new file mode 100644 index 0000000000..4d797b971e --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListHubSites.ps1 @@ -0,0 +1,41 @@ +function Invoke-ListHubSites { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter + + try { + if (-not $TenantFilter) { throw 'tenantFilter is required' } + + $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter + # Site-level REST: delegated only (no -AsApp) + $HubSites = New-GraphGETRequest ` + -scope "$($SharePointInfo.SharePointUrl)/.default" ` + -uri "$($SharePointInfo.SharePointUrl)/_api/hubsites" ` + -tenantid $TenantFilter ` + -extraHeaders @{ 'accept' = 'application/json' } + + $Results = @($HubSites | Select-Object ID, Title, SiteUrl) + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ Results = $Results } + }) + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + $Results = "Failed to list hub sites: $ErrorMessage" + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = @{ Results = $Results } + }) + } +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListImageOptimizerResults.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListImageOptimizerResults.ps1 new file mode 100644 index 0000000000..966a739b4f --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListImageOptimizerResults.ps1 @@ -0,0 +1,104 @@ +function Invoke-ListImageOptimizerResults { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.ReadWrite + .SYNOPSIS + Poll for SharePoint Image Optimizer job results by QueueId. + .DESCRIPTION + Companion to Invoke-ExecSharePointImageOptimize. Returns Status 'Running' while the + background worker is still processing, and the full optimizer result object once the + job has completed (or an error message if it failed). + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $QueueId = $Request.Query.queueId ?? $Request.Query.QueueId + $TenantFilter = $Request.Query.tenantFilter ?? $Request.Query.TenantFilter + + if (-not $QueueId) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'queueId is required' } + }) + } + + try { + $QueueData = Get-CIPPQueueData -QueueId $QueueId | Select-Object -First 1 + if (-not $QueueData) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = @{ Results = 'Optimizer job not found' } + }) + } + + if ($QueueData.Status -eq 'Running' -or $QueueData.Status -eq 'Queued') { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ + Status = 'Running' + QueueId = $QueueId + } + }) + } + + $CacheTable = Get-CippTable -tablename 'CacheImageOptimizer' + $SafeQueueId = ConvertTo-CIPPODataFilterValue -Value $QueueId -Type String + $Filter = "RowKey eq '$SafeQueueId'" + if ($TenantFilter) { + $SafeTenant = ConvertTo-CIPPODataFilterValue -Value $TenantFilter -Type String + $Filter = "PartitionKey eq '$SafeTenant' and RowKey eq '$SafeQueueId'" + } + $Cached = Get-CIPPAzDataTableEntity @CacheTable -Filter $Filter | Select-Object -First 1 + + if (-not $Cached) { + if ($QueueData.Status -match 'Failed') { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = @{ Results = 'Image optimizer job failed' } + }) + } + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ + Status = 'Running' + QueueId = $QueueId + } + }) + } + + if ($Cached.Error) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = @{ Results = "Image optimizer job failed: $($Cached.Error)" } + }) + } + + $Payload = $Cached.Data | ConvertFrom-Json -Depth 10 + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ + Status = 'Completed' + QueueId = $QueueId + Mode = $Payload.Mode + WhatIf = $Payload.WhatIf + SiteUrl = $Payload.SiteUrl + Library = $Payload.Library + Folder = $Payload.Folder + Summary = $Payload.Summary + Results = @($Payload.Results | Where-Object { $null -ne $_ }) + Warnings = @($Payload.Warnings | Where-Object { $null -ne $_ }) + } + }) + } catch { + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to load image optimizer results: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = @{ Results = "Failed to load optimizer results: $($ErrorMessage.NormalizedError)" } + }) + } +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListOneDriveFiles.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListOneDriveFiles.ps1 new file mode 100644 index 0000000000..f4080a9953 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListOneDriveFiles.ps1 @@ -0,0 +1,128 @@ +function Invoke-ListOneDriveFiles { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $Headers = $Request.Headers + $TenantFilter = $Request.Query.TenantFilter + $SiteId = $Request.Query.SiteId + $FolderId = $Request.Query.FolderId + $DriveId = $Request.Query.DriveId + $UserId = $Request.Query.UserId + + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = 'TenantFilter is required' + }) + } + + # If UserId is provided, resolve to a DriveId + if ($UserId -and -not $DriveId -and -not $SiteId) { + try { + $UserDrive = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/users/$UserId/drive?`$select=id" ` + -tenantid $TenantFilter ` + -asApp $true + if ($UserDrive.id) { + $DriveId = $UserDrive.id + } else { + throw "Could not resolve drive for user $UserId" + } + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::Forbidden + Body = @{ Results = "Failed to resolve user's OneDrive: $ErrorMessage" } + }) + } + } + + if (-not $SiteId -and -not $DriveId) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = 'SiteId, DriveId, or UserId is required' + }) + } + + try { + # Get the drive ID if not provided + if (-not $DriveId) { + $Drives = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/sites/$SiteId/drives" ` + -tenantid $TenantFilter ` + -asApp $true + if (-not $Drives -or $Drives.Count -eq 0) { + throw 'No drives found for this site' + } + # Pick the primary document library drive + $DriveId = ($Drives | Where-Object { $_.driveType -eq 'documentLibrary' } | Select-Object -First 1).id + if (-not $DriveId) { + $DriveId = $Drives[0].id + } + } + + # List items in root or specified folder + $SelectFields = 'id,name,size,lastModifiedDateTime,createdBy,folder,file,webUrl,parentReference' + if ($FolderId) { + $ItemsUri = "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$FolderId/children?`$select=$SelectFields&`$top=999" + } else { + $ItemsUri = "https://graph.microsoft.com/v1.0/drives/$DriveId/root/children?`$select=$SelectFields&`$top=999" + } + + $Items = New-GraphGetRequest ` + -uri $ItemsUri ` + -tenantid $TenantFilter ` + -asApp $true + + $GraphRequest = foreach ($Item in $Items) { + $IsFolder = $null -ne $Item.folder + $SizeBytes = if ($Item.size) { $Item.size } else { 0 } + $SizeFormatted = if ($SizeBytes -ge 1GB) { + '{0:N2} GB' -f ($SizeBytes / 1GB) + } elseif ($SizeBytes -ge 1MB) { + '{0:N2} MB' -f ($SizeBytes / 1MB) + } elseif ($SizeBytes -ge 1KB) { + '{0:N1} KB' -f ($SizeBytes / 1KB) + } else { + "$SizeBytes B" + } + + [PSCustomObject]@{ + id = $Item.id + name = $Item.name + isFolder = $IsFolder + type = if ($IsFolder) { 'Folder' } else { 'File' } + sizeInBytes = $SizeBytes + sizeFormatted = if ($IsFolder) { "$($Item.folder.childCount) items" } else { $SizeFormatted } + childCount = if ($IsFolder) { $Item.folder.childCount } else { $null } + lastModified = $Item.lastModifiedDateTime + createdBy = $Item.createdBy.user.displayName + webUrl = $Item.webUrl + fileExtension = if (-not $IsFolder -and $Item.name -match '\.(\w+)$') { $Matches[1].ToLower() } else { $null } + parentId = $Item.parentReference.id + parentPath = $Item.parentReference.path + driveId = $DriveId + } + } + + # Sort folders first, then files alphabetically + $GraphRequest = @($GraphRequest | Sort-Object -Property @{Expression = { -not $_.isFolder }}, @{Expression = { $_.name }}) + + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + $StatusCode = [HttpStatusCode]::Forbidden + $GraphRequest = $ErrorMessage + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @($GraphRequest) + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListOneDriveSharing.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListOneDriveSharing.ps1 new file mode 100644 index 0000000000..4f6bf00284 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListOneDriveSharing.ps1 @@ -0,0 +1,114 @@ +function Invoke-ListOneDriveSharing { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $Headers = $Request.Headers + $TenantFilter = $Request.Query.TenantFilter + $SiteId = $Request.Query.SiteId + $DriveId = $Request.Query.DriveId + + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = 'TenantFilter is required' + }) + } + + if (-not $SiteId -and -not $DriveId) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = 'SiteId or DriveId is required' + }) + } + + try { + # Get the drive ID if not provided + if (-not $DriveId) { + $Drives = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/sites/$SiteId/drives" ` + -tenantid $TenantFilter ` + -asApp $true + if (-not $Drives -or $Drives.Count -eq 0) { + throw 'No drives found for this site' + } + $DriveId = ($Drives | Where-Object { $_.driveType -eq 'documentLibrary' } | Select-Object -First 1).id + if (-not $DriveId) { + $DriveId = $Drives[0].id + } + } + + # Search for all items and check for the shared facet + $SearchUri = "https://graph.microsoft.com/v1.0/drives/$DriveId/root/search(q='*')?`$select=id,name,size,webUrl,shared,lastModifiedDateTime,createdBy,file,folder&`$top=999" + $AllItems = New-GraphGetRequest ` + -uri $SearchUri ` + -tenantid $TenantFilter ` + -asApp $true + + # Filter to only items that have the shared facet + $SharedItems = $AllItems | Where-Object { $null -ne $_.shared } + + # For each shared item, get its permissions to show who it's shared with + $GraphRequest = foreach ($Item in $SharedItems) { + $PermUri = "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$($Item.id)/permissions" + try { + $Permissions = New-GraphGetRequest ` + -uri $PermUri ` + -tenantid $TenantFilter ` + -asApp $true + } catch { + $Permissions = @() + } + + # Build a list of who it's shared with + $SharedWithList = foreach ($Perm in $Permissions) { + if ($Perm.link) { + $LinkType = $Perm.link.type + $LinkScope = $Perm.link.scope + "$LinkScope $LinkType link" + } elseif ($Perm.grantedToV2) { + if ($Perm.grantedToV2.user) { + $Perm.grantedToV2.user.displayName + } elseif ($Perm.grantedToV2.group) { + $Perm.grantedToV2.group.displayName + } + } elseif ($Perm.grantedTo) { + if ($Perm.grantedTo.user) { + $Perm.grantedTo.user.displayName + } + } + } + + $IsFolder = $null -ne $Item.folder + + [PSCustomObject]@{ + id = $Item.id + name = $Item.name + type = if ($IsFolder) { 'Folder' } else { 'File' } + webUrl = $Item.webUrl + sharedDateTime = $Item.shared.sharedDateTime + sharedBy = $Item.shared.owner.user.displayName + sharedWith = ($SharedWithList | Select-Object -Unique) -join ', ' + permissionCount = ($Permissions | Measure-Object).Count + lastModified = $Item.lastModifiedDateTime + driveId = $DriveId + } + } + + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + $StatusCode = [HttpStatusCode]::Forbidden + $GraphRequest = @() + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @($GraphRequest) + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointDocumentLibraries.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointDocumentLibraries.ps1 new file mode 100644 index 0000000000..d3ec4cad30 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointDocumentLibraries.ps1 @@ -0,0 +1,71 @@ +function Invoke-ListSharePointDocumentLibraries { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $Headers = $Request.Headers + $APIName = $Request.Params.CIPPEndpoint + $TenantFilter = $Request.Query.TenantFilter + if (-not $TenantFilter) { $TenantFilter = $Request.Body.TenantFilter } + $SiteId = $Request.Query.SiteId + if (-not $SiteId) { $SiteId = $Request.Body.SiteId } + + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = 'TenantFilter is required' + }) + } + if (-not $SiteId) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = 'SiteId is required' + }) + } + + try { + $Drives = New-GraphGetRequest ` + -uri "https://graph.microsoft.com/v1.0/sites/$SiteId/drives?`$select=id,name,driveType,webUrl,quota" ` + -tenantid $TenantFilter -asApp $true + + $GraphRequest = foreach ($Drive in @($Drives | Where-Object { $_.id })) { + [PSCustomObject]@{ + id = $Drive.id + name = $Drive.name + driveType = $Drive.driveType + webUrl = $Drive.webUrl + usedBytes = if ($Drive.quota) { $Drive.quota.used } else { $null } + totalBytes = if ($Drive.quota) { $Drive.quota.total } else { $null } + } + } + $GraphRequest = @($GraphRequest | Where-Object { $_.driveType -eq 'documentLibrary' } | Sort-Object -Property name) + if (-not $GraphRequest -or $GraphRequest.Count -eq 0) { + # Fall back to all drives if none are flagged documentLibrary. + $GraphRequest = @($Drives | Where-Object { $_.id } | ForEach-Object { + [PSCustomObject]@{ id = $_.id; name = $_.name; driveType = $_.driveType; webUrl = $_.webUrl; usedBytes = if ($_.quota) { $_.quota.used } else { $null }; totalBytes = if ($_.quota) { $_.quota.total } else { $null } } + } | Sort-Object -Property name) + } + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to list document libraries: $ErrorMessage" -Sev Error + # Reserve 403 for genuine permission/authorization failures; other failures + # (throttling, transient Graph errors, bad input) should not masquerade as 403. + $StatusCode = if ($ErrorMessage -match '(?i)forbidden|denied|unauthor|insufficient|privile|consent|permission') { + [HttpStatusCode]::Forbidden + } else { + [HttpStatusCode]::InternalServerError + } + $GraphRequest = $ErrorMessage + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @($GraphRequest) + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointExternalUsers.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointExternalUsers.ps1 index 803dfa8479..452e03357b 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointExternalUsers.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointExternalUsers.ps1 @@ -154,7 +154,7 @@ function Invoke-ListSharePointExternalUsers { } catch { $ErrorMessage = Get-CippException -Exception $_ $Body = "Failed to list SharePoint external users: $($ErrorMessage.NormalizedError)" - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointFolders.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointFolders.ps1 new file mode 100644 index 0000000000..3bb844ffc7 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointFolders.ps1 @@ -0,0 +1,72 @@ +function Invoke-ListSharePointFolders { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.Read + .SYNOPSIS + Lists folders inside a SharePoint document library for the Image Optimizer folder picker. + .DESCRIPTION + Accepts a SiteId and optional DriveId (document library). When DriveId is omitted the + default document library for the site is used. Returns folder items with their id and + library-relative path so callers can scope a scan to a specific folder. + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $Headers = $Request.Headers + $APIName = $Request.Params.CIPPEndpoint + $TenantFilter = $Request.Query.TenantFilter ?? $Request.Body.TenantFilter + $SiteId = $Request.Query.SiteId ?? $Request.Body.SiteId + $DriveId = $Request.Query.DriveId ?? $Request.Body.DriveId + + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = 'TenantFilter is required' + }) + } + if (-not $DriveId -and -not $SiteId) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = 'DriveId or SiteId is required' + }) + } + + try { + if (-not $DriveId) { + $Drives = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/sites/$SiteId/drives?`$select=id,name,driveType" -tenantid $TenantFilter -AsApp $true + $Drives = @($Drives) | Where-Object { $_.id } + $Drive = $Drives | Where-Object { $_.driveType -eq 'documentLibrary' } | Select-Object -First 1 + if (-not $Drive) { $Drive = $Drives | Select-Object -First 1 } + $DriveId = $Drive.id + } + + if (-not $DriveId) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @() + }) + } + + $Folders = Get-CIPPSharePointFolderList -TenantFilter $TenantFilter -DriveId $DriveId + $GraphRequest = @($Folders | Sort-Object -Property path) + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to list folders: $ErrorMessage" -Sev Error + # Reserve 403 for genuine permission/authorization failures; other failures + # (throttling, transient Graph errors, bad input) should not masquerade as 403. + $StatusCode = if ($ErrorMessage -match '(?i)forbidden|denied|unauthor|insufficient|privile|consent|permission') { + [HttpStatusCode]::Forbidden + } else { + [HttpStatusCode]::InternalServerError + } + $GraphRequest = $ErrorMessage + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @($GraphRequest) + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointImageCandidates.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointImageCandidates.ps1 new file mode 100644 index 0000000000..8f377394a1 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointImageCandidates.ps1 @@ -0,0 +1,79 @@ +function Invoke-ListSharePointImageCandidates { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.Read + .SYNOPSIS + Audits a SharePoint document library for large JPG/JPEG files (read-only). + .DESCRIPTION + Returns the SharePoint Image Optimizer result object in Audit mode. No files are + modified and no versions are deleted. Accepts parameters from either the query + string or the request body so it can be called as a GET (list) or POST. + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $Headers = $Request.Headers + $APIName = $Request.Params.CIPPEndpoint + + $TenantFilter = $Request.Body.TenantFilter ?? $Request.Query.TenantFilter + $SiteId = $Request.Body.SiteId ?? $Request.Query.SiteId + $SiteUrl = $Request.Body.SiteUrl ?? $Request.Query.SiteUrl + $DriveId = $Request.Body.DriveId ?? $Request.Query.DriveId + $LibraryName = $Request.Body.LibraryName ?? $Request.Query.LibraryName + $MinimumFileSizeMB = $Request.Body.MinimumFileSizeMB ?? $Request.Query.MinimumFileSizeMB ?? 5 + $FolderId = $Request.Body.FolderId ?? $Request.Query.FolderId + $FolderPath = $Request.Body.FolderPath ?? $Request.Query.FolderPath + $IncludeSubfoldersRaw = $Request.Body.IncludeSubfolders ?? $Request.Query.IncludeSubfolders + $IncludeSubfolders = if ($null -eq $IncludeSubfoldersRaw) { + $true + } elseif ($IncludeSubfoldersRaw -is [string]) { + $IncludeSubfoldersRaw -eq 'true' + } else { + [bool]$IncludeSubfoldersRaw + } + + # This endpoint scans synchronously inside the HTTP request, which is bound by the + # ~230s gateway limit. Cap the scan so a large library cannot run past that limit; + # callers wanting a full library audit should use the queued ExecSharePointImageOptimize. + $MaxFilesRaw = $Request.Body.MaxFiles ?? $Request.Query.MaxFiles + $MaxFiles = if ($null -ne $MaxFilesRaw -and [int]$MaxFilesRaw -gt 0) { [int]$MaxFilesRaw } else { 200 } + + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'TenantFilter is required' } + }) + } + if (-not $DriveId -and -not $SiteId -and -not $SiteUrl) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'DriveId, SiteId, or SiteUrl is required' } + }) + } + + try { + # This endpoint runs synchronously inside the ~230s gateway window, so cap the total + # number of files inspected. The queued ExecSharePointImageOptimize has no such limit. + $Result = Invoke-CIPPSharePointImageOptimizer -TenantFilter $TenantFilter -SiteId $SiteId -SiteUrl $SiteUrl ` + -DriveId $DriveId -LibraryName $LibraryName -Mode 'Audit' ` + -MinimumFileSizeMB ([double]$MinimumFileSizeMB) -IncludeSubfolders ([bool]$IncludeSubfolders) ` + -FolderId $FolderId -FolderPath $FolderPath -MaxFiles $MaxFiles -MaxScan 5000 + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Audited SharePoint library for large JPGs. Scanned $($Result.Summary.FilesScanned), eligible $($Result.Summary.EligibleFiles)." -Sev Info + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Image audit failed: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = @{ Results = "Image audit failed: $($ErrorMessage.NormalizedError)" } + }) + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Result + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointTemplates.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointTemplates.ps1 index 1e7b3f9619..f7095a80d8 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointTemplates.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointTemplates.ps1 @@ -15,6 +15,7 @@ function Invoke-ListSharePointTemplates { $Table = Get-CIPPTable -TableName 'templates' + $StatusCode = [HttpStatusCode]::OK try { $Filter = "PartitionKey eq 'SharePointTemplate'" $Templates = Get-CIPPAzDataTableEntity @Table -Filter $Filter @@ -60,10 +61,11 @@ function Invoke-ListSharePointTemplates { $Body = @{ Results = "Failed to list SharePoint templates: $($_.Exception.Message)" } + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = ConvertTo-Json -Depth 10 -InputObject @($Body) }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharepointQuota.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharepointQuota.ps1 index 5693fc4ec0..34203c892b 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharepointQuota.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharepointQuota.ps1 @@ -4,8 +4,6 @@ Function Invoke-ListSharepointQuota { Entrypoint .ROLE Sharepoint.Admin.Read - .DESCRIPTION - Retrieves SharePoint Online storage quota usage for a tenant, showing used and total storage. #> [CmdletBinding()] param($Request, $TriggerMetadata) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharepointSettings.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharepointSettings.ps1 index 6f0538c5b4..213b6c44a3 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharepointSettings.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharepointSettings.ps1 @@ -4,18 +4,32 @@ Function Invoke-ListSharepointSettings { Entrypoint .ROLE Sharepoint.Admin.Read - .DESCRIPTION - Retrieves SharePoint Online tenant-level settings and configuration. #> [CmdletBinding()] param($Request, $TriggerMetadata) - $Tenant = $Request.Query.tenantFilter - $SharePointSettings = New-GraphGetRequest -tenantid $Tenant -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings' -AsApp $true + $APIName = $Request.Params.CIPPEndpoint + $TenantFilter = $Request.Query.tenantFilter + + try { + if ([string]::IsNullOrWhiteSpace($TenantFilter)) { + throw 'Tenant filter is required.' + } + + $GraphResult = New-GraphGetRequest -tenantid $TenantFilter -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings' -AsApp $true + + $Body = @($GraphResult) + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API $APIName -tenant $TenantFilter -message "Failed to get SharePoint settings: $ErrorMessage" -Sev 'Error' + $Body = @{ Results = "Failed to get SharePoint settings: $ErrorMessage" } + $StatusCode = [HttpStatusCode]::BadRequest + } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK - Body = @($SharePointSettings) + StatusCode = $StatusCode + Body = $Body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteActivity.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteActivity.ps1 index ae983ac48c..3b57712cdd 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteActivity.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteActivity.ps1 @@ -52,9 +52,12 @@ function Invoke-ListSiteActivity { $SelectedSiteType = if ($Type) { $TypeMap[$Type] } else { $null } $AllResults = [System.Collections.Generic.List[object]]::new() + $TotalTenants = 0 + $FailedTenants = 0 if ($TenantFilter -eq 'AllTenants') { $ItemsByTenant = Get-CIPPDbItem -TenantFilter 'allTenants' -Type 'SiteActivity' -ByTenant + $TotalTenants = @($ItemsByTenant.Keys).Count foreach ($Tenant in @($ItemsByTenant.Keys)) { # Hand each tenant its rows and drop them here so they can be freed once processed @@ -81,6 +84,7 @@ function Invoke-ListSiteActivity { [void]$AllResults.Add($Row) } } catch { + $FailedTenants++ Write-LogMessage -API $APIName -tenant $Tenant -message "Failed to retrieve cached site activity: $($_.Exception.Message)" -sev Warning } } @@ -103,7 +107,7 @@ function Invoke-ListSiteActivity { } $GraphRequest = @($AllResults | Sort-Object -Property displayName) - $StatusCode = [HttpStatusCode]::OK + $StatusCode = Get-CippBulkStatusCode -Total $TotalTenants -Failed $FailedTenants } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -tenant $TenantFilter -message "Failed to list site activity: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteBrowser.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteBrowser.ps1 index 90f60d46c0..0dce74e79d 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteBrowser.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteBrowser.ps1 @@ -215,7 +215,7 @@ function Invoke-ListSiteBrowser { $SiteMeta = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/sites/$SiteSegment`?`$select=id,webUrl,displayName,isPersonalSite" -tenantid $TenantFilter -asapp $true if ($SiteMeta.isPersonalSite -eq $true) { - throw 'OneDrive sites are not supported in the SharePoint site browser.' + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'OneDrive sites are not supported in the SharePoint site browser.' } }) } if ([string]::IsNullOrWhiteSpace($SiteUrl)) { $SiteUrl = $SiteMeta.webUrl @@ -283,7 +283,7 @@ function Invoke-ListSiteBrowser { $ErrorMessage = Get-CippException -Exception $_ $Results = "Failed to list SharePoint browser items: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError $StorageStatus = $null } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteBrowserLibraryCopy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteBrowserLibraryCopy.ps1 index 068387a360..63d9467893 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteBrowserLibraryCopy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteBrowserLibraryCopy.ps1 @@ -16,10 +16,14 @@ function Invoke-ListSiteBrowserLibraryCopy { $OperationId = $Request.Query.OperationId ?? $Request.Query.operationId ?? $Request.Body.OperationId ?? $Request.Body.operationId $StatusCode = [HttpStatusCode]::OK - try { - if ([string]::IsNullOrWhiteSpace($TenantFilter)) { throw 'tenantFilter is required.' } - if ([string]::IsNullOrWhiteSpace($OperationId)) { throw 'OperationId is required.' } + if ([string]::IsNullOrWhiteSpace($TenantFilter)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ Results = 'tenantFilter is required.' } }) + } + if ([string]::IsNullOrWhiteSpace($OperationId)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ Results = 'OperationId is required.' } }) + } + try { $Result = Update-CIPPSharePointLibraryCopyStatus -TenantFilter $TenantFilter -OperationId $OperationId Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter ` -message "Library copy status $OperationId -> $($Result.Status)" -sev Debug @@ -27,7 +31,7 @@ function Invoke-ListSiteBrowserLibraryCopy { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to retrieve library copy status: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = Get-CippErrorStatusCode -ErrorRecord $_ } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteBrowserPermissions.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteBrowserPermissions.ps1 index 7b1631acc3..4ec388ab0b 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteBrowserPermissions.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteBrowserPermissions.ps1 @@ -381,12 +381,12 @@ function Invoke-ListSiteBrowserPermissions { collectedAt = (Get-Date).ToUniversalTime().ToString('o') } - $StatusCode = [HttpStatusCode]::OK + $StatusCode = if ($Errors.Count -gt 0) { [HttpStatusCode]::MultiStatus } else { [HttpStatusCode]::OK } } catch { $ErrorMessage = Get-CippException -Exception $_ $Body = "Failed to list site browser permissions: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Body -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteLibraries.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteLibraries.ps1 index 9a9eea2c2a..8e5d74488e 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteLibraries.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteLibraries.ps1 @@ -17,19 +17,21 @@ function Invoke-ListSiteLibraries { $SiteId = $Request.Query.SiteId ?? $Request.Body.SiteId $SiteUrl = $Request.Query.SiteUrl ?? $Request.Body.SiteUrl + if ([string]::IsNullOrWhiteSpace($SiteId) -and [string]::IsNullOrWhiteSpace($SiteUrl)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'SiteId or SiteUrl is required.' } }) + } + try { # Resolve the site addressing segment: prefer the Graph site id, else hostname:path from the URL. if (-not [string]::IsNullOrWhiteSpace($SiteId)) { $SiteSegment = $SiteId - } elseif (-not [string]::IsNullOrWhiteSpace($SiteUrl)) { + } else { $ParsedUrl = [System.Uri]$SiteUrl $SiteSegment = if ($ParsedUrl.AbsolutePath -in @('', '/')) { $ParsedUrl.Host } else { "$($ParsedUrl.Host):$($ParsedUrl.AbsolutePath):" } - } else { - throw 'SiteId or SiteUrl is required.' } $Lists = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/sites/$SiteSegment/lists?`$select=id,displayName,name,webUrl,list" -tenantid $TenantFilter -asapp $true @@ -47,7 +49,7 @@ function Invoke-ListSiteLibraries { $ErrorMessage = Get-CippException -Exception $_ $Results = "Failed to list document libraries: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteLiveStorage.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteLiveStorage.ps1 new file mode 100644 index 0000000000..7238a5b1e6 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteLiveStorage.ps1 @@ -0,0 +1,95 @@ +function Invoke-ListSiteLiveStorage { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $TenantFilter = $Request.Query.TenantFilter + if (-not $TenantFilter) { $TenantFilter = $Request.Body.TenantFilter } + $SiteId = $Request.Query.SiteId + if (-not $SiteId) { $SiteId = $Request.Body.SiteId } + + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = 'TenantFilter is required' + }) + } + if (-not $SiteId) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = 'SiteId is required' + }) + } + + try { + $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter + $ExtraHeaders = @{ + 'accept' = 'application/json' + 'content-type' = 'application/json' + 'odata-version' = '4.0' + } + + $SiteInfo = New-GraphGETRequest ` + -scope "$($SharePointInfo.AdminUrl)/.default" ` + -uri "$($SharePointInfo.AdminUrl)/_api/SPO.Tenant/sites('$SiteId')" ` + -tenantid $TenantFilter ` + -extraHeaders $ExtraHeaders + + if (-not $SiteInfo) { + throw 'Could not retrieve site information from SharePoint Admin API' + } + + # StorageUsage is in MB from the admin API + $StorageUsedMB = $SiteInfo.StorageUsage + $StorageQuotaMB = $SiteInfo.StorageMaximumLevel + $StorageWarningMB = $SiteInfo.StorageWarningLevel + + $StorageUsedGB = [math]::Round($StorageUsedMB / 1024, 2) + $StorageQuotaGB = [math]::Round($StorageQuotaMB / 1024, 2) + $StorageWarningGB = [math]::Round($StorageWarningMB / 1024, 2) + + $Percentage = if ($StorageQuotaMB -gt 0) { + [math]::Round(($StorageUsedMB / $StorageQuotaMB) * 100, 1) + } else { 0 } + + $SiteName = $SiteInfo.Title + if (-not $SiteName) { $SiteName = $SiteInfo.Url } + + $ResultMessage = "Live storage for $SiteName`: $StorageUsedGB GB used of $StorageQuotaGB GB allocated ($Percentage%). Warning level: $StorageWarningGB GB. Lock state: $($SiteInfo.LockState). Retrieved at $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') UTC." + + $Result = [PSCustomObject]@{ + Results = $ResultMessage + siteId = $SiteId + displayName = $SiteName + storageUsedInMB = $StorageUsedMB + storageUsedInGigabytes = $StorageUsedGB + storageAllocatedInMB = $StorageQuotaMB + storageAllocatedInGigabytes = $StorageQuotaGB + storageWarningInMB = $StorageWarningMB + storageWarningInGigabytes = $StorageWarningGB + storagePercentage = $Percentage + lastModifiedDateTime = $SiteInfo.LastContentModifiedDate + lockState = $SiteInfo.LockState + sharingCapability = $SiteInfo.SharingCapability + template = $SiteInfo.Template + url = $SiteInfo.Url + retrievedAt = (Get-Date -Format 'o') + } + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = $Result + }) + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::Forbidden + Body = @{ Results = "Failed to get live storage data: $ErrorMessage" } + }) + } +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteMembers.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteMembers.ps1 index 893e9faa6e..891355b014 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteMembers.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteMembers.ps1 @@ -152,7 +152,7 @@ Function Invoke-ListSiteMembers { $StatusCode = [HttpStatusCode]::OK $Body = @($Members) } catch { - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $Body = Get-NormalizedError -Message $_.Exception.Message } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSitePermissions.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSitePermissions.ps1 index d4b1981e15..048a5cd849 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSitePermissions.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSitePermissions.ps1 @@ -26,9 +26,11 @@ function Invoke-ListSitePermissions { [bool]$Principal.IsShareByEmailGuestUser -or [bool]$Principal.IsEmailAuthenticationGuestUser -or $Principal.LoginName -match '(?i)#ext#|urn%3aspo%3aguest' } - try { - if ([string]::IsNullOrWhiteSpace($SiteUrl)) { throw 'SiteUrl is required.' } + if ([string]::IsNullOrWhiteSpace($SiteUrl)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'SiteUrl is required.' } }) + } + try { $RestContext = Resolve-CIPPSharePointRestContext -TenantFilter $TenantFilter -SiteUrl $SiteUrl $Scope = $RestContext.Scope $JsonAccept = $RestContext.Headers @@ -93,7 +95,7 @@ function Invoke-ListSitePermissions { $ErrorMessage = Get-CippException -Exception $_ $Body = "Failed to list permissions: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Body -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteProperties.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteProperties.ps1 index 0f11bb9f28..51e3573765 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteProperties.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteProperties.ps1 @@ -21,8 +21,11 @@ function Invoke-ListSiteProperties { $LinkPermissionNames = @{ 0 = 'None'; 1 = 'View'; 2 = 'Edit' } $DomainRestrictionNames = @{ 0 = 'None'; 1 = 'AllowList'; 2 = 'BlockList' } + if (-not $SiteUrl) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'SiteUrl is required.' } }) + } + try { - if (-not $SiteUrl) { throw 'SiteUrl is required.' } $Site = Get-CIPPSPOSite -TenantFilter $TenantFilter -SiteUrl $SiteUrl $Body = [PSCustomObject]@{ @@ -53,7 +56,7 @@ function Invoke-ListSiteProperties { } catch { $ErrorMessage = Get-CippException -Exception $_ $Body = "Failed to get site properties for $($SiteUrl): $($ErrorMessage.NormalizedError)" - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteRecycleBin.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteRecycleBin.ps1 index 8993c803fe..e807c14f4c 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteRecycleBin.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteRecycleBin.ps1 @@ -17,17 +17,45 @@ function Invoke-ListSiteRecycleBin { $ItemTypeNames = @{ 1 = 'File'; 2 = 'File Version'; 3 = 'List Item'; 4 = 'List'; 5 = 'Folder'; 6 = 'Folder'; 7 = 'Attachment'; 8 = 'List Item Version'; 10 = 'Web' } $ItemStateNames = @{ 1 = 'First Stage'; 2 = 'Second Stage' } - try { - if (-not $SiteUrl) { throw 'SiteUrl is required.' } + if (-not $SiteUrl) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'SiteUrl is required.' } }) + } + try { $RestContext = Resolve-CIPPSharePointRestContext -TenantFilter $TenantFilter -SiteUrl $SiteUrl $Scope = $RestContext.Scope $JsonAccept = $RestContext.Headers $BaseUri = $RestContext.BaseUri - $Items = New-GraphGetRequest -uri "$BaseUri/site/RecycleBin?`$top=500&`$orderby=DeletedDate desc" -tenantid $TenantFilter -scope $Scope -extraHeaders $JsonAccept -UseCertificate -AsApp $true + $AllItems = [System.Collections.Generic.List[object]]::new() + $Skip = 0 + $PageSize = 500 + $Guard = 0 + + while ($Guard -lt 100) { + $Guard++ + $Uri = "$BaseUri/site/RecycleBin?`$top=$PageSize&`$skip=$Skip&`$orderby=DeletedDate desc" + $Page = New-GraphGetRequest -uri $Uri -tenantid $TenantFilter -scope $Scope -extraHeaders $JsonAccept -UseCertificate -AsApp $true -noPagination $true -SkipValueExtraction + $Items = @() + if ($null -ne $Page.value) { + $Items = @($Page.value) + } elseif ($Page -is [System.Array]) { + $Items = @($Page) + } elseif ($Page.PSObject.Properties.Name -contains 'Id') { + $Items = @($Page) + } + + if ($Items.Count -eq 0) { break } + + foreach ($Item in $Items) { + $AllItems.Add($Item) + } + + $Skip += $PageSize + if ($Items.Count -lt $PageSize) { break } + } - $Body = @($Items | ForEach-Object { + $Body = @($AllItems | ForEach-Object { [PSCustomObject]@{ Id = $_.Id Title = $_.Title @@ -44,7 +72,7 @@ function Invoke-ListSiteRecycleBin { } catch { $ErrorMessage = Get-CippException -Exception $_ $Body = "Failed to list the recycle bin for $($SiteUrl): $($ErrorMessage.NormalizedError)" - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteRecycleBinSummary.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteRecycleBinSummary.ps1 index e461cb3f51..de1990ee46 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteRecycleBinSummary.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteRecycleBinSummary.ps1 @@ -18,10 +18,14 @@ function Invoke-ListSiteRecycleBinSummary { if ($MaxItems -lt 1) { $MaxItems = 5000 } if ($MaxItems -gt 20000) { $MaxItems = 20000 } - try { - if ([string]::IsNullOrWhiteSpace($TenantFilter)) { throw 'tenantFilter is required.' } - if ([string]::IsNullOrWhiteSpace($SiteUrl)) { throw 'SiteUrl is required.' } + if ([string]::IsNullOrWhiteSpace($TenantFilter)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ Results = 'tenantFilter is required.' } }) + } + if ([string]::IsNullOrWhiteSpace($SiteUrl)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ Results = 'SiteUrl is required.' } }) + } + try { $RestContext = Resolve-CIPPSharePointRestContext -TenantFilter $TenantFilter -SiteUrl $SiteUrl $Scope = $RestContext.Scope $JsonAccept = $RestContext.Headers @@ -33,21 +37,25 @@ function Invoke-ListSiteRecycleBinSummary { $SecondBytes = [int64]0 $Seen = 0 $Capped = $false - $NextUri = "$BaseUri/site/RecycleBin?`$select=Id,Size,ItemState&`$top=500&`$orderby=DeletedDate desc" + $Skip = 0 + $PageSize = 500 + $Guard = 0 - while ($NextUri) { - $Page = New-GraphGetRequest -uri $NextUri -tenantid $TenantFilter -scope $Scope -extraHeaders $JsonAccept -UseCertificate -AsApp $true -noPagination $true -SkipValueExtraction + while ($Guard -lt 100) { + $Guard++ + $Uri = "$BaseUri/site/RecycleBin?`$select=Id,Size,ItemState&`$top=$PageSize&`$skip=$Skip&`$orderby=DeletedDate desc" + $Page = New-GraphGetRequest -uri $Uri -tenantid $TenantFilter -scope $Scope -extraHeaders $JsonAccept -UseCertificate -AsApp $true -noPagination $true -SkipValueExtraction $Items = @() - $NextLink = $null if ($null -ne $Page.value) { $Items = @($Page.value) - $NextLink = $Page.'@odata.nextLink' } elseif ($Page -is [System.Array]) { $Items = @($Page) } elseif ($Page.PSObject.Properties.Name -contains 'Id') { $Items = @($Page) } + if ($Items.Count -eq 0) { break } + foreach ($Item in $Items) { if ($Seen -ge $MaxItems) { $Capped = $true @@ -67,8 +75,10 @@ function Invoke-ListSiteRecycleBinSummary { } } - if ($Capped -or [string]::IsNullOrWhiteSpace($NextLink)) { break } - $NextUri = $NextLink + if ($Capped) { break } + + $Skip += $PageSize + if ($Items.Count -lt $PageSize) { break } } $Body = [PSCustomObject]@{ @@ -87,7 +97,7 @@ function Invoke-ListSiteRecycleBinSummary { $ErrorMessage = Get-CippException -Exception $_ $Body = "Failed to summarize recycle bin for $($SiteUrl): $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Body -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteRoleDefinitions.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteRoleDefinitions.ps1 index bae31ce644..f6ccdbf074 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteRoleDefinitions.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteRoleDefinitions.ps1 @@ -19,9 +19,11 @@ function Invoke-ListSiteRoleDefinitions { $SiteUrl = $Request.Query.SiteUrl ?? $Request.Body.SiteUrl $IncludeUnassignable = ($Request.Query.IncludeUnassignable ?? $Request.Body.IncludeUnassignable) -eq $true - try { - if ([string]::IsNullOrWhiteSpace($SiteUrl)) { throw 'SiteUrl is required.' } + if ([string]::IsNullOrWhiteSpace($SiteUrl)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'SiteUrl is required.' } }) + } + try { $RestContext = Resolve-CIPPSharePointRestContext -TenantFilter $TenantFilter -SiteUrl $SiteUrl $Scope = $RestContext.Scope $JsonAccept = $RestContext.Headers @@ -47,7 +49,7 @@ function Invoke-ListSiteRoleDefinitions { $ErrorMessage = Get-CippException -Exception $_ $Results = "Failed to list permission levels: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteStorageComposition.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteStorageComposition.ps1 index 4ffe182892..b2c3d3670a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteStorageComposition.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteStorageComposition.ps1 @@ -23,10 +23,14 @@ function Invoke-ListSiteStorageComposition { try { return [int64][double]$Clean } catch { return $null } } - try { - if ([string]::IsNullOrWhiteSpace($TenantFilter)) { throw 'tenantFilter is required.' } - if ([string]::IsNullOrWhiteSpace($SiteUrl)) { throw 'SiteUrl is required.' } + if ([string]::IsNullOrWhiteSpace($TenantFilter)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ Results = 'tenantFilter is required.' } }) + } + if ([string]::IsNullOrWhiteSpace($SiteUrl)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ Results = 'SiteUrl is required.' } }) + } + try { $RestContext = Resolve-CIPPSharePointRestContext -TenantFilter $TenantFilter -SiteUrl $SiteUrl $SpoScope = $RestContext.Scope $JsonAccept = $RestContext.Headers @@ -83,7 +87,7 @@ function Invoke-ListSiteStorageComposition { $ErrorMessage = Get-CippException -Exception $_ $Body = "Failed to get storage composition for $($SiteUrl): $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Body -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteUserAccess.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteUserAccess.ps1 index 36c0dbd16f..0ea82c25de 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteUserAccess.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteUserAccess.ps1 @@ -38,13 +38,19 @@ function Invoke-ListSiteUserAccess { $ListId = $Request.Query.ListId ?? $Request.Body.ListId $UserPrincipalName = $Request.Query.UserPrincipalName ?? $Request.Body.UserPrincipalName - try { - if ([string]::IsNullOrWhiteSpace($SiteUrl)) { throw 'SiteUrl is required.' } - if ([string]::IsNullOrWhiteSpace($UserPrincipalName)) { throw 'UserPrincipalName is required.' } + if ([string]::IsNullOrWhiteSpace($SiteUrl)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'SiteUrl is required.' } }) + } + if ([string]::IsNullOrWhiteSpace($UserPrincipalName)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = @{ 'Results' = 'UserPrincipalName is required.' } }) + } + try { # --- Resolve the user and every group they are in, nested groups included --- $User = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$UserPrincipalName`?`$select=id,displayName,userPrincipalName,mail,userType" -tenantid $TenantFilter -AsApp $true - if (-not $User.id) { throw "User $UserPrincipalName was not found in this tenant." } + if (-not $User.id) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::NotFound; Body = @{ 'Results' = "User $UserPrincipalName was not found in this tenant." } }) + } $IsGuest = $User.userType -eq 'Guest' -or $User.userPrincipalName -match '(?i)#ext#' $GroupIds = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase) @@ -208,7 +214,7 @@ function Invoke-ListSiteUserAccess { $ErrorMessage = Get-CippException -Exception $_ $Results = "Failed to check access: $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Request.Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSites.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSites.ps1 index 306d830b8c..34a9475c42 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSites.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSites.ps1 @@ -137,7 +137,7 @@ function Invoke-ListSites { } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } if ($Request.query.URLOnly -eq $true) { diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeams.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeams.ps1 index 5f5faccbbd..bad8f7dfb5 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeams.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeams.ps1 @@ -4,32 +4,86 @@ Function Invoke-ListTeams { Entrypoint .ROLE Teams.Group.Read - .DESCRIPTION - Lists Microsoft Teams teams for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants. #> [CmdletBinding()] param($Request, $TriggerMetadata) # Interact with query parameters or the body of the request. $TenantFilter = $Request.Query.TenantFilter - # Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants. - $UseReportDB = $Request.Query.UseReportDB -eq $true - if ($request.query.type -eq 'List' -and ($TenantFilter -eq 'AllTenants' -or $UseReportDB)) { + if ($request.query.type -eq 'List') { + $Groups = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/groups?`$filter=resourceProvisioningOptions/Any(x:x eq 'Team')&`$select=id,displayName,description,visibility,mailNickname" -tenantid $TenantFilter | Sort-Object -Property displayName + + # Fetch isArchived, memberCount, and channelCount via batch requests for richer list data try { - $GraphRequest = Get-CIPPTeamsReport -TenantFilter $TenantFilter -ErrorAction Stop - $StatusCode = [HttpStatusCode]::OK + $TeamBatchRequests = $Groups | ForEach-Object { + @{ + id = $_.id + method = 'GET' + url = "/teams/$($_.id)?`$select=isArchived" + } + } + + $TeamDetails = if ($TeamBatchRequests.Count -gt 0) { + New-GraphBulkRequest -Requests $TeamBatchRequests -tenantid $TenantFilter -asapp $true + } else { @() } + + # Build a lookup for team details + $TeamLookup = @{} + foreach ($result in $TeamDetails) { + if ($result.body -and $result.id) { + $TeamLookup[$result.id] = $result.body + } + } } catch { - $StatusCode = [HttpStatusCode]::InternalServerError - $GraphRequest = $_.Exception.Message + Write-Host "Warning: Could not fetch team details batch: $_" + $TeamLookup = @{} + } + + # Merge group data with team details + $GraphRequest = $Groups | ForEach-Object { + $details = $TeamLookup[$_.id] + [PSCustomObject]@{ + id = $_.id + displayName = $_.displayName + description = $_.description + visibility = $_.visibility + mailNickname = $_.mailNickname + isArchived = if ($null -ne $details.isArchived) { $details.isArchived } else { $false } + } } - return ([HttpResponseContext]@{ - StatusCode = $StatusCode - Body = @($GraphRequest) - }) } + if ($request.query.type -eq 'SharedChannels') { + $AllTeams = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/groups?`$filter=resourceProvisioningOptions/Any(x:x eq 'Team')&`$select=id,displayName" -tenantid $TenantFilter + $TeamNameLookup = @{} + foreach ($t in $AllTeams) { $TeamNameLookup[$t.id] = $t.displayName } - if ($request.query.type -eq 'List') { - $GraphRequest = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/groups?`$filter=resourceProvisioningOptions/Any(x:x eq 'Team')&`$select=id,displayName,description,visibility,mailNickname" -tenantid $TenantFilter | Sort-Object -Property displayName + $ChannelBatchRequests = $AllTeams | ForEach-Object { + @{ + id = $_.id + method = 'GET' + url = "/teams/$($_.id)/channels?`$filter=membershipType eq 'shared'&`$select=id,displayName,description,membershipType" + } + } + + $ChannelResults = if ($ChannelBatchRequests.Count -gt 0) { + New-GraphBulkRequest -Requests $ChannelBatchRequests -tenantid $TenantFilter -asapp $true + } else { @() } + + $GraphRequest = @() + foreach ($result in $ChannelResults) { + if ($result.body -and $result.body.value) { + foreach ($ch in $result.body.value) { + $GraphRequest += [PSCustomObject]@{ + id = $ch.id + teamId = $result.id + teamName = $TeamNameLookup[$result.id] + displayName = $ch.displayName + description = $ch.description + } + } + } + } } + $TeamID = $request.query.ID Write-Host $TeamID if ($request.query.type -eq 'Team') { @@ -38,15 +92,76 @@ Function Invoke-ListTeams { $UserList = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/teams/$($TeamID)/Members" -tenantid $TenantFilter -asapp $true $AppsList = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/teams/$($TeamID)/installedApps?`$expand=teamsAppDefinition" -tenantid $TenantFilter -asapp $true + # Fetch the SharePoint site details from the associated group + $SharePointUrl = $null + $SharePointSiteId = $null + $SharePointName = $null + $SharePointCreated = $null + try { + $GroupSites = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/groups/$($TeamID)/sites/root?`$select=webUrl,name,sharepointIds,createdDateTime" -tenantid $TenantFilter -asapp $true + if ($GroupSites.webUrl) { + $SharePointUrl = $GroupSites.webUrl + } + if ($GroupSites.sharepointIds.siteId) { + $SharePointSiteId = $GroupSites.sharepointIds.siteId + } + if ($GroupSites.name) { + $SharePointName = $GroupSites.name + } + if ($GroupSites.createdDateTime) { + $SharePointCreated = $GroupSites.createdDateTime + } + } catch { + Write-Host "Warning: Could not fetch SharePoint site URL for team $TeamID`: $_" + } + + # Batch-fetch filesFolder for each channel to get per-channel siteId/driveId + try { + $ChannelFilesBatch = $Channels | ForEach-Object { + @{ + id = $_.id + method = 'GET' + url = "/teams/$($TeamID)/channels/$($_.id)/filesFolder?`$select=id,name,webUrl,parentReference" + } + } + $ChannelFilesResults = if ($ChannelFilesBatch.Count -gt 0) { + New-GraphBulkRequest -Requests $ChannelFilesBatch -tenantid $TenantFilter -asapp $true + } else { @() } + + $ChannelFilesLookup = @{} + foreach ($result in $ChannelFilesResults) { + if ($result.body -and $result.id -and -not $result.body.error) { + $ChannelFilesLookup[$result.id] = @{ + siteId = $result.body.parentReference.siteId + driveId = $result.body.parentReference.driveId + webUrl = $result.body.webUrl + } + } + } + + $Channels = $Channels | ForEach-Object { + $filesInfo = $ChannelFilesLookup[$_.id] + $_ | Add-Member -NotePropertyName 'filesSiteId' -NotePropertyValue ($filesInfo.siteId) -Force -PassThru | + Add-Member -NotePropertyName 'filesDriveId' -NotePropertyValue ($filesInfo.driveId) -Force -PassThru | + Add-Member -NotePropertyName 'filesWebUrl' -NotePropertyValue ($filesInfo.webUrl) -Force -PassThru + } + } catch { + Write-Host "Warning: Could not fetch channel filesFolder batch for team $TeamID`: $_" + } + $Owners = $UserList | Where-Object -Property Roles -EQ 'Owner' $Members = $UserList | Where-Object -Property email -NotIn $owners.email $GraphRequest = [PSCustomObject]@{ - Name = $team.DisplayName - TeamInfo = @($team) - ChannelInfo = @($channels) - Members = @($Members) - Owners = @($owners) - InstalledApps = @($AppsList) + Name = $team.DisplayName + TeamInfo = @($team) + ChannelInfo = @($channels) + Members = @($Members) + Owners = @($owners) + InstalledApps = @($AppsList) + SharePointUrl = $SharePointUrl + SharePointSiteId = $SharePointSiteId + SharePointName = $SharePointName + SharePointCreated = $SharePointCreated } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsActivity.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsActivity.ps1 index df70be3850..b0d03555bc 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsActivity.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsActivity.ps1 @@ -4,35 +4,32 @@ Function Invoke-ListTeamsActivity { Entrypoint .ROLE Teams.Activity.Read - .DESCRIPTION - Lists Microsoft Teams user activity reports for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants. #> [CmdletBinding()] param($Request, $TriggerMetadata) # Interact with query parameters or the body of the request. $TenantFilter = $Request.Query.tenantFilter $type = $request.Query.Type - # Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants. - $UseReportDB = $Request.Query.UseReportDB -eq $true - if ($TenantFilter -eq 'AllTenants' -or $UseReportDB) { - try { - $GraphRequest = Get-CIPPTeamsActivityReport -TenantFilter $TenantFilter -Type $type -ErrorAction Stop - $StatusCode = [HttpStatusCode]::OK - } catch { - $StatusCode = [HttpStatusCode]::InternalServerError - $GraphRequest = $_.Exception.Message - } - return ([HttpResponseContext]@{ - StatusCode = $StatusCode - Body = @($GraphRequest) - }) - } - $GraphRequest = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/reports/get$($type)Detail(period='D30')" -tenantid $TenantFilter | ConvertFrom-Csv | Select-Object @{ Name = 'UPN'; Expression = { $_.'User Principal Name' } }, + @{ Name = 'displayName'; Expression = { $_.'Display Name' } }, @{ Name = 'LastActive'; Expression = { $_.'Last Activity Date' } }, - @{ Name = 'TeamsChat'; Expression = { $_.'Team Chat Message Count' } }, - @{ Name = 'CallCount'; Expression = { $_.'Call Count' } }, - @{ Name = 'MeetingCount'; Expression = { $_.'Meeting Count' } } + @{ Name = 'TeamsChat'; Expression = { [int]($_.'Team Chat Message Count') } }, + @{ Name = 'PrivateChat'; Expression = { [int]($_.'Private Chat Message Count') } }, + @{ Name = 'CallCount'; Expression = { [int]($_.'Call Count') } }, + @{ Name = 'MeetingCount'; Expression = { [int]($_.'Meeting Count' ) } }, + @{ Name = 'MeetingsOrganized'; Expression = { [int]($_.'Meetings Organized Count') } }, + @{ Name = 'MeetingsAttended'; Expression = { [int]($_.'Meetings Attended Count') } }, + @{ Name = 'AdHocMeetingsOrganized'; Expression = { [int]($_.'Ad Hoc Meetings Organized Count') } }, + @{ Name = 'AdHocMeetingsAttended'; Expression = { [int]($_.'Ad Hoc Meetings Attended Count') } }, + @{ Name = 'ScheduledMeetingsOrganized'; Expression = { [int]($_.'Scheduled One-time Meetings Organized Count') } }, + @{ Name = 'ScheduledMeetingsAttended'; Expression = { [int]($_.'Scheduled One-time Meetings Attended Count') } }, + @{ Name = 'AudioDuration'; Expression = { $_.'Audio Duration' } }, + @{ Name = 'VideoDuration'; Expression = { $_.'Video Duration' } }, + @{ Name = 'ScreenShareDuration'; Expression = { $_.'Screen Share Duration' } }, + @{ Name = 'hasOtherAction'; Expression = { $_.'Has Other Action' } }, + @{ Name = 'reportRefreshDate'; Expression = { $_.'Report Refresh Date' } }, + @{ Name = 'reportPeriod'; Expression = { $_.'Report Period' } }, + @{ Name = 'totalActivity'; Expression = { [int]($_.'Team Chat Message Count') + [int]($_.'Private Chat Message Count') + [int]($_.'Call Count') + [int]($_.'Meeting Count') } } return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::OK diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsAutoAttendants.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsAutoAttendants.ps1 new file mode 100644 index 0000000000..aa1aaf094d --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsAutoAttendants.ps1 @@ -0,0 +1,24 @@ +Function Invoke-ListTeamsAutoAttendants { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Teams.Voice.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + $TenantFilter = $Request.Query.TenantFilter + try { + $AutoAttendants = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsAutoAttendant' + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + $StatusCode = [HttpStatusCode]::Forbidden + $AutoAttendants = $ErrorMessage + } + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @($AutoAttendants) + }) + +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsCallQueues.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsCallQueues.ps1 new file mode 100644 index 0000000000..0c4e9868d8 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsCallQueues.ps1 @@ -0,0 +1,24 @@ +Function Invoke-ListTeamsCallQueues { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Teams.Voice.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + $TenantFilter = $Request.Query.TenantFilter + try { + $CallQueues = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsCallQueue' + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + $StatusCode = [HttpStatusCode]::Forbidden + $CallQueues = $ErrorMessage + } + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @($CallQueues) + }) + +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsDialPlans.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsDialPlans.ps1 new file mode 100644 index 0000000000..f674070857 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsDialPlans.ps1 @@ -0,0 +1,24 @@ +Function Invoke-ListTeamsDialPlans { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Teams.Voice.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + $TenantFilter = $Request.Query.TenantFilter + try { + $DialPlans = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsTenantDialPlan' + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + $StatusCode = [HttpStatusCode]::Forbidden + $DialPlans = $ErrorMessage + } + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = @($DialPlans) + }) + +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsLisLocation.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsLisLocation.ps1 index 318af9a8e8..8692e5ae3d 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsLisLocation.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsLisLocation.ps1 @@ -51,7 +51,7 @@ Function Invoke-ListTeamsLisLocation { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $EmergencyLocations = $ErrorMessage } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsSettings.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsSettings.ps1 new file mode 100644 index 0000000000..55e3ade3cb --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsSettings.ps1 @@ -0,0 +1,168 @@ +function Invoke-ListTeamsSettings { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Teams.Group.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $TenantFilter = $Request.Query.tenantFilter + + try { + if ([string]::IsNullOrWhiteSpace($TenantFilter)) { + throw 'Tenant filter is required.' + } + + # Fetch all Teams tenant-level settings in parallel where possible + $FederationConfig = $null + $ExternalAccessPolicy = $null + $MeetingPolicy = $null + $ClientConfig = $null + $MessagingPolicy = $null + + # Federation Configuration + try { + $FederationConfig = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsTenantFederationConfiguration' -CmdParams @{Identity = 'Global' } + } catch { + Write-LogMessage -API $APIName -tenant $TenantFilter -message "Could not get federation config: $($_.Exception.Message)" -Sev 'Debug' + } + + # External Access Policy + try { + $ExternalAccessPolicy = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsExternalAccessPolicy' -CmdParams @{Identity = 'Global' } + } catch { + Write-LogMessage -API $APIName -tenant $TenantFilter -message "Could not get external access policy: $($_.Exception.Message)" -Sev 'Debug' + } + + # Meeting Policy + try { + $MeetingPolicy = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsTeamsMeetingPolicy' -CmdParams @{Identity = 'Global' } + } catch { + Write-LogMessage -API $APIName -tenant $TenantFilter -message "Could not get meeting policy: $($_.Exception.Message)" -Sev 'Debug' + } + + # Client Configuration + try { + $ClientConfig = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsTeamsClientConfiguration' -CmdParams @{Identity = 'Global' } + } catch { + Write-LogMessage -API $APIName -tenant $TenantFilter -message "Could not get client config: $($_.Exception.Message)" -Sev 'Debug' + } + + # Messaging Policy + try { + $MessagingPolicy = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsTeamsMessagingPolicy' -CmdParams @{Identity = 'Global' } + } catch { + Write-LogMessage -API $APIName -tenant $TenantFilter -message "Could not get messaging policy: $($_.Exception.Message)" -Sev 'Debug' + } + + # Meeting Branding Policy + try { + $BrandingPolicy = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsTeamsMeetingBrandingPolicy' + } catch { + Write-LogMessage -API $APIName -tenant $TenantFilter -message "Could not get meeting branding policy: $($_.Exception.Message)" -Sev 'Debug' + } + + # Parse federation allowed/blocked domains + $FederationAllowedDomains = @() + $FederationBlockedDomains = @() + $FederationMode = 'AllowAllExternal' + + if ($FederationConfig) { + if ($FederationConfig.AllowFederatedUsers -eq $false) { + $FederationMode = 'BlockAllExternal' + } elseif ($FederationConfig.AllowedDomains -and $FederationConfig.AllowedDomains.GetType().Name -eq 'PSObject') { + $FederationMode = 'AllowSpecificExternal' + $FederationAllowedDomains = @($FederationConfig.AllowedDomains.Domain) + } elseif ($FederationConfig.BlockedDomains -and $FederationConfig.BlockedDomains.Count -gt 0) { + $FederationMode = 'BlockSpecificExternal' + $FederationBlockedDomains = @($FederationConfig.BlockedDomains) + } + } + + # Parse branding policy data + $BrandingPolicies = @() + $MeetingBackgroundImages = @() + $EnableMeetingBackgroundImages = $false + + if ($BrandingPolicy) { + if ($BrandingPolicy -is [array]) { + $BrandingPolicies = @($BrandingPolicy | Select-Object Identity, Description, EnableMeetingBackgroundImages, MeetingBackgroundImages) + $GlobalBranding = $BrandingPolicy | Where-Object { $_.Identity -eq 'Global' } | Select-Object -First 1 + if ($GlobalBranding) { + $EnableMeetingBackgroundImages = $GlobalBranding.EnableMeetingBackgroundImages ?? $false + $MeetingBackgroundImages = @($GlobalBranding.MeetingBackgroundImages) + } + } else { + $BrandingPolicies = @($BrandingPolicy | Select-Object Identity, Description, EnableMeetingBackgroundImages, MeetingBackgroundImages) + $EnableMeetingBackgroundImages = $BrandingPolicy.EnableMeetingBackgroundImages ?? $false + $MeetingBackgroundImages = @($BrandingPolicy.MeetingBackgroundImages) + } + } + + $Result = [PSCustomObject]@{ + Tenant = $TenantFilter + + # Federation & External Access + federationMode = $FederationMode + allowFederatedUsers = $FederationConfig.AllowFederatedUsers ?? $true + allowTeamsConsumer = $FederationConfig.AllowTeamsConsumer ?? $false + federationAllowedDomains = $FederationAllowedDomains + federationBlockedDomains = $FederationBlockedDomains + enableFederationAccess = $ExternalAccessPolicy.EnableFederationAccess ?? $true + enableTeamsConsumerAccess = $ExternalAccessPolicy.EnableTeamsConsumerAccess ?? $false + + # Client Configuration + allowGuestUser = $ClientConfig.AllowGuestUser ?? $false + allowGoogleDrive = $ClientConfig.AllowGoogleDrive ?? $false + allowShareFile = $ClientConfig.AllowShareFile ?? $false + allowBox = $ClientConfig.AllowBox ?? $false + allowDropBox = $ClientConfig.AllowDropBox ?? $false + allowEgnyte = $ClientConfig.AllowEgnyte ?? $false + + # Meeting Policy + allowAnonymousUsersToJoinMeeting = $MeetingPolicy.AllowAnonymousUsersToJoinMeeting ?? $true + allowAnonymousUsersToStartMeeting = $MeetingPolicy.AllowAnonymousUsersToStartMeeting ?? $false + autoAdmittedUsers = $MeetingPolicy.AutoAdmittedUsers ?? 'EveryoneInCompanyExcludingGuests' + allowPSTNUsersToBypassLobby = $MeetingPolicy.AllowPSTNUsersToBypassLobby ?? $false + meetingChatEnabledType = $MeetingPolicy.MeetingChatEnabledType ?? 'Enabled' + designatedPresenterRoleMode = $MeetingPolicy.DesignatedPresenterRoleMode ?? 'EveryoneUserOverride' + allowExternalParticipantGiveRequestControl = $MeetingPolicy.AllowExternalParticipantGiveRequestControl ?? $false + + # Messaging Policy + allowOwnerDeleteMessage = $MessagingPolicy.AllowOwnerDeleteMessage ?? $false + allowUserDeleteMessage = $MessagingPolicy.AllowUserDeleteMessage ?? $true + allowUserEditMessage = $MessagingPolicy.AllowUserEditMessage ?? $true + allowUserDeleteChat = $MessagingPolicy.AllowUserDeleteChat ?? $true + readReceiptsEnabledType = $MessagingPolicy.ReadReceiptsEnabledType ?? 'UserPreference' + createCustomEmojis = $MessagingPolicy.CreateCustomEmojis ?? $true + deleteCustomEmojis = $MessagingPolicy.DeleteCustomEmojis ?? $false + allowSecurityEndUserReporting = $MessagingPolicy.AllowSecurityEndUserReporting ?? $true + allowCommunicationComplianceEndUserReporting = $MessagingPolicy.AllowCommunicationComplianceEndUserReporting ?? $true + + # Meeting Branding / Backgrounds + enableMeetingBackgroundImages = $EnableMeetingBackgroundImages + meetingBackgroundImages = $MeetingBackgroundImages + brandingPolicies = $BrandingPolicies + } + + $StatusCode = [HttpStatusCode]::OK + $Body = [PSCustomObject]@{ + Results = $Result + } + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API $APIName -tenant $TenantFilter -message "Failed to retrieve Teams settings: $ErrorMessage" -Sev 'Error' + $StatusCode = [HttpStatusCode]::Forbidden + $Body = [PSCustomObject]@{ + Results = "Failed to retrieve Teams settings: $ErrorMessage" + } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsVoice.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsVoice.ps1 index 459355a88d..80b6589de1 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsVoice.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsVoice.ps1 @@ -57,7 +57,7 @@ function Invoke-ListTeamsVoice { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } Write-Host "Graph request is: $($GraphRequest)" diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTempFileScanResults.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTempFileScanResults.ps1 new file mode 100644 index 0000000000..3df538055f --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTempFileScanResults.ps1 @@ -0,0 +1,93 @@ +function Invoke-ListTempFileScanResults { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Sharepoint.Site.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $QueueId = $Request.Query.queueId ?? $Request.Query.QueueId + $TenantFilter = $Request.Query.tenantFilter ?? $Request.Query.TenantFilter + + if (-not $QueueId) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = 'queueId is required' } + }) + } + + try { + $QueueData = Get-CIPPQueueData -QueueId $QueueId | Select-Object -First 1 + if (-not $QueueData) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = @{ Results = 'Scan job not found' } + }) + } + + if ($QueueData.Status -eq 'Running' -or $QueueData.Status -eq 'Queued') { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ + Status = 'Running' + QueueId = $QueueId + } + }) + } + + $CacheTable = Get-CippTable -tablename 'CacheTempFileScan' + $SafeQueueId = ConvertTo-CIPPODataFilterValue -Value $QueueId -Type String + $Filter = "RowKey eq '$SafeQueueId'" + if ($TenantFilter) { + $SafeTenant = ConvertTo-CIPPODataFilterValue -Value $TenantFilter -Type String + $Filter = "PartitionKey eq '$SafeTenant' and RowKey eq '$SafeQueueId'" + } + $Cached = Get-CIPPAzDataTableEntity @CacheTable -Filter $Filter | Select-Object -First 1 + + if (-not $Cached) { + if ($QueueData.Status -match 'Failed') { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = @{ Results = 'Temp file scan failed' } + }) + } + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ + Status = 'Running' + QueueId = $QueueId + } + }) + } + + if ($Cached.Error) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = @{ Results = "Failed to scan for temp files: $($Cached.Error)" } + }) + } + + $Payload = $Cached.Data | ConvertFrom-Json -Depth 10 + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @{ + Status = 'Completed' + QueueId = $QueueId + Results = @($Payload.Results | Where-Object { $null -ne $_ }) + TotalCount = $Payload.TotalCount + TotalSize = $Payload.TotalSize + } + }) + } catch { + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to load temp file scan results: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = @{ Results = "Failed to load scan results: $($ErrorMessage.NormalizedError)" } + }) + } +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ExecCopilotSettings.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ExecCopilotSettings.ps1 index 765cb2bc2e..1a1860312a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ExecCopilotSettings.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ExecCopilotSettings.ps1 @@ -68,7 +68,7 @@ function Invoke-ExecCopilotSettings { $ErrorMessage = Get-CippException -Exception $_ $Results = "Failed to set '$SettingId' to ${StateText}: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -tenant $TenantFilter -API $APIName -message $Results -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::OK + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ExecShadowAISanction.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ExecShadowAISanction.ps1 index dde9c5d3a5..b7a0868350 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ExecShadowAISanction.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ExecShadowAISanction.ps1 @@ -17,11 +17,26 @@ function Invoke-ExecShadowAISanction { $Tools = @($Request.Body.Tools ?? $Request.Body.Tool) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } $Action = $Request.Body.Action ?? 'Sanction' - try { - if (-not $TenantFilter) { throw 'tenantFilter is required' } - if ($Tools.Count -eq 0) { throw 'No AI tool specified' } - if ($Action -notin @('Sanction', 'Unsanction')) { throw "Unknown action '$Action'. Use Sanction or Unsanction." } + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = @('Failed to update sanctioned AI tools: tenantFilter is required') } + }) + } + if ($Tools.Count -eq 0) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = @('Failed to update sanctioned AI tools: No AI tool specified') } + }) + } + if ($Action -notin @('Sanction', 'Unsanction')) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Results = @("Failed to update sanctioned AI tools: Unknown action '$Action'. Use Sanction or Unsanction.") } + }) + } + try { $Table = Get-CIPPTable -TableName 'ShadowAIConfig' $Results = foreach ($Tool in $Tools) { # Table storage forbids /, \, # and ? in row keys @@ -54,7 +69,7 @@ function Invoke-ExecShadowAISanction { } catch { Write-LogMessage -headers $Request.Headers -API 'ExecShadowAISanction' -tenant $TenantFilter -message "Failed to update sanctioned AI tools: $($_.Exception.Message)" -Sev 'Error' return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest + StatusCode = [HttpStatusCode]::InternalServerError Body = @{ Results = @("Failed to update sanctioned AI tools: $($_.Exception.Message)") } }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListAgent365PackageDetail.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListAgent365PackageDetail.ps1 index 87be88770e..caae513e33 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListAgent365PackageDetail.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListAgent365PackageDetail.ps1 @@ -22,7 +22,7 @@ function Invoke-ListAgent365PackageDetail { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API 'Agent365Packages' -tenant $TenantFilter -message "Could not get Agent 365 package detail for $PackageId. Error: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage $Detail = [pscustomobject]@{ error = $ErrorMessage.NormalizedError } - $StatusCode = [HttpStatusCode]::OK + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListCopilotUsage.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListCopilotUsage.ps1 index 6fa125664d..fb9f91c153 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListCopilotUsage.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListCopilotUsage.ps1 @@ -116,7 +116,7 @@ function Invoke-ListCopilotUsage { } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API 'CopilotUsage' -tenant $TenantFilter -message "Failed to retrieve Copilot usage report ($Type). Error: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::OK + $StatusCode = [HttpStatusCode]::InternalServerError $Results = @() } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ExecAuditLogSearch.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ExecAuditLogSearch.ps1 index 7956b8e290..1f5f1af1b3 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ExecAuditLogSearch.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ExecAuditLogSearch.ps1 @@ -146,7 +146,7 @@ function Invoke-ExecAuditLogSearch { }) } catch { return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest + StatusCode = [HttpStatusCode]::InternalServerError Body = $_.Exception.Message }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAlertsQueue.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAlertsQueue.ps1 index 061670ef64..fd4e593f4e 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAlertsQueue.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAlertsQueue.ps1 @@ -4,13 +4,11 @@ function Invoke-ListAlertsQueue { Entrypoint .ROLE CIPP.Alert.Read - .DESCRIPTION - Lists configured alert rules including webhook rules and scheduled alert tasks, showing their configuration and tenant scope. #> [CmdletBinding()] param($Request, $TriggerMetadata) $WebhookTable = Get-CIPPTable -TableName 'WebhookRules' - $WebhookRules = Get-CIPPAzDataTableEntity @WebhookTable + $WebhookRules = Get-CIPPAzDataTableEntity @WebhookTable -Filter "PartitionKey eq 'Webhookv2'" $ScheduledTasks = Get-CIPPTable -TableName 'ScheduledTasks' $ScheduledTasks = Get-CIPPAzDataTableEntity @ScheduledTasks | Where-Object { $_.hidden -eq $true -and $_.command -like 'Get-CippAlert*' } @@ -98,14 +96,6 @@ function Invoke-ListAlertsQueue { } else { $ExcludedTenants = @() } - # Excluded tenant groups are stored separately as JSON — surface them as objects so the - # frontend renders a single named chip and can round-trip the group on edit - if ($Task.excludedTenantGroups) { - $ExcludedGroups = @($Task.excludedTenantGroups | ConvertFrom-Json -ErrorAction SilentlyContinue) - if ($ExcludedGroups) { - $ExcludedTenants = @($ExcludedTenants + $ExcludedGroups) - } - } # Handle tenant display information for alerts $TenantsForDisplay = @() diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAuditLogSearches.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAuditLogSearches.ps1 index 00943e189a..70c66923f0 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAuditLogSearches.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAuditLogSearches.ps1 @@ -15,6 +15,7 @@ function Invoke-ListAuditLogSearches { $Type = $Request.Query.Type if ($TenantFilter) { + $StatusCode = [HttpStatusCode]::OK switch ($Type) { 'Searches' { $Results = Get-CippAuditLogSearches -TenantFilter $TenantFilter @@ -31,6 +32,7 @@ function Invoke-ListAuditLogSearches { $Results = Get-CippAuditLogSearchResults -TenantFilter $TenantFilter -QueryId $SearchId } catch { $Results = @{ Error = $_.Exception.Message } + $StatusCode = [HttpStatusCode]::InternalServerError } $Body = @{ Results = @($Results) @@ -76,7 +78,7 @@ function Invoke-ListAuditLogSearches { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Body }) } else { diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListPendingWebhooks.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListPendingWebhooks.ps1 index a1cd999c3b..72167233cf 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListPendingWebhooks.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListPendingWebhooks.ps1 @@ -4,14 +4,12 @@ function Invoke-ListPendingWebhooks { Entrypoint .ROLE CIPP.Alert.Read - .DESCRIPTION - Lists pending incoming webhook events that have not yet been processed by CIPP. #> [CmdletBinding()] param($Request, $TriggerMetadata) try { $Table = Get-CIPPTable -TableName 'WebhookIncoming' - $Webhooks = Get-CIPPAzDataTableEntity @Table + $Webhooks = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'Webhook'" $Results = $Webhooks | Select-Object -ExcludeProperty RowKey, PartitionKey, ETag, Timestamp $PendingWebhooks = foreach ($Result in $Results) { foreach ($Property in $Result.PSObject.Properties.Name) { diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-RemoveWebhookAlert.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-RemoveWebhookAlert.ps1 index c18be0402c..e5e29e0e39 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-RemoveWebhookAlert.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-RemoveWebhookAlert.ps1 @@ -48,13 +48,15 @@ Function Invoke-RemoveWebhookAlert { } } $body = [pscustomobject]@{'Results' = $Results } + $StatusCode = [HttpStatusCode]::OK } catch { Write-LogMessage -headers $Request.Headers -API $APINAME -tenant 'Global' -message "Failed to remove webhook alert. $($_.Exception.Message)" -Sev 'Error' $body = [pscustomobject]@{'Results' = "Failed to remove webhook alert: $($_.Exception.Message)" } + $StatusCode = [HttpStatusCode]::InternalServerError } return [HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $body } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAddMultiTenantApp.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAddMultiTenantApp.ps1 index 11a88caf4c..cdba979a0a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAddMultiTenantApp.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAddMultiTenantApp.ps1 @@ -14,7 +14,7 @@ function Invoke-ExecAddMultiTenantApp { $ApplicationResources = $request.body.permissions | Where-Object -Property origin -EQ 'Application' | ForEach-Object { @{ id = $_.id; type = 'Role' } } $ApplicationResourceAccess = @{ ResourceAppId = '00000003-0000-0000-c000-000000000000'; resourceAccess = $ApplicationResources } - $Results = try { + try { if ($Request.Body.CopyPermissions -eq $true) { $Command = 'ExecApplicationCopy' } else { @@ -48,18 +48,18 @@ function Invoke-ExecAddMultiTenantApp { $null = Start-CIPPOrchestrator -InputObject $InputObject $Results = 'Deploying {0} to {1}, see the logbook for details' -f $Request.Body.AppId, ($Request.Body.tenantFilter.label -join ', ') Write-LogMessage -headers $Headers -API $APIName -message $Results -Sev 'Info' + $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-CippException -Exception $_ $Results = "Function Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -message $Results -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError } - - $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-CippException -Exception $_ $Results = "Function Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -message $Results -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } } elseif ($Request.Body.configMode -eq 'template') { Write-Information 'Application Approval - Template Mode' @@ -89,12 +89,13 @@ function Invoke-ExecAddMultiTenantApp { $null = Start-CIPPOrchestrator -InputObject $InputObject $Results = 'Deploying {0} to {1}, see the logbook for details' -f $Request.Body.selectedTemplate.label, ($Request.Body.tenantFilter.label -join ', ') Write-LogMessage -headers $Headers -API $APIName -message $Results -Sev 'Info' + $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-CippException -Exception $_ $Results = "Error queuing application - $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -message $Results -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError } - $StatusCode = [HttpStatusCode]::OK } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAppApprovalTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAppApprovalTemplate.ps1 index 003f81cb68..259f823e28 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAppApprovalTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAppApprovalTemplate.ps1 @@ -77,6 +77,7 @@ function Invoke-ExecAppApprovalTemplate { 'Results' = $_.Exception.Message } Write-LogMessage -headers $Headers -API $APIName -message "App Deployment Template Save failed: $($_.Exception.Message)" -Sev 'Error' + $StatusCode = [HttpStatusCode]::InternalServerError } } 'Delete' { @@ -101,12 +102,14 @@ function Invoke-ExecAppApprovalTemplate { $Body = @{ 'Results' = 'No template found with the provided ID' } + $StatusCode = [HttpStatusCode]::NotFound } } catch { $Body = @{ 'Results' = "Failed to delete template: $($_.Exception.Message)" } Write-LogMessage -headers $Headers -API $APIName -message "App Deployment Template Delete failed: $($_.Exception.Message)" -Sev 'Error' + $StatusCode = [HttpStatusCode]::InternalServerError } } 'Get' { diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAppPermissionTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAppPermissionTemplate.ps1 index 509d201eea..45e028b685 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAppPermissionTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAppPermissionTemplate.ps1 @@ -15,6 +15,7 @@ function Invoke-ExecAppPermissionTemplate { $User = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json $Action = $Request.Query.Action ?? $Request.Body.Action + $StatusCode = [HttpStatusCode]::OK switch ($Action) { 'Save' { @@ -42,6 +43,7 @@ function Invoke-ExecAppPermissionTemplate { $Body = @{ 'Results' = $_.Exception.Message } + $StatusCode = [HttpStatusCode]::InternalServerError } } 'Delete' { @@ -60,11 +62,13 @@ function Invoke-ExecAppPermissionTemplate { $Body = @{ 'Results' = 'No Template ID provided for deletion' } + $StatusCode = [HttpStatusCode]::BadRequest } } catch { $Body = @{ 'Results' = "Failed to delete template: $($_.Exception.Message)" } + $StatusCode = [HttpStatusCode]::InternalServerError } } default { @@ -88,7 +92,7 @@ function Invoke-ExecAppPermissionTemplate { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = ConvertTo-Json -Depth 10 -InputObject @($Body) }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecCreateAppTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecCreateAppTemplate.ps1 index c23bb61c7c..69fda35902 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecCreateAppTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecCreateAppTemplate.ps1 @@ -13,21 +13,27 @@ function Invoke-ExecCreateAppTemplate { $APIName = $TriggerMetadata.FunctionName Write-LogMessage -headers $Request.headers -API $APINAME -message 'Accessed this API' -Sev 'Debug' - try { - $TenantFilter = $Request.Body.TenantFilter - $AppId = $Request.Body.AppId - $DisplayName = $Request.Body.DisplayName - $Type = $Request.Body.Type # 'servicePrincipal' or 'application' - $Overwrite = $Request.Body.Overwrite -eq $true - - if ([string]::IsNullOrWhiteSpace($AppId)) { - throw 'AppId is required' - } + $TenantFilter = $Request.Body.TenantFilter + $AppId = $Request.Body.AppId + $DisplayName = $Request.Body.DisplayName + $Type = $Request.Body.Type # 'servicePrincipal' or 'application' + $Overwrite = $Request.Body.Overwrite -eq $true + + if ([string]::IsNullOrWhiteSpace($AppId)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = (@{ Results = @(@{ resultText = 'Failed to create template: AppId is required'; state = 'error' }) } | ConvertTo-Json -Depth 10) + }) + } - if ([string]::IsNullOrWhiteSpace($DisplayName)) { - throw 'DisplayName is required' - } + if ([string]::IsNullOrWhiteSpace($DisplayName)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = (@{ Results = @(@{ resultText = 'Failed to create template: DisplayName is required'; state = 'error' }) } | ConvertTo-Json -Depth 10) + }) + } + try { # Build initial bulk request to get app registration and all service principals # The SP we need will be in the splist, so we don't need a separate call $InitialBulkRequests = @( @@ -63,12 +69,14 @@ function Invoke-ExecCreateAppTemplate { $SignInAudience = $SPResult.signInAudience } if (-not [string]::IsNullOrWhiteSpace($SignInAudience) -and $SignInAudience -notin $MultiTenantAudiences) { + $StatusCode = [HttpStatusCode]::BadRequest throw "Application '$DisplayName' is single-tenant (signInAudience '$SignInAudience') and cannot be used as an Enterprise App template. Create a Manifest (single-tenant) template for this app instead." } # Get the app details based on type if ($Type -eq 'servicePrincipal') { if (-not $SPResult) { + $StatusCode = [HttpStatusCode]::NotFound throw "Service principal not found for AppId: $AppId" } @@ -145,6 +153,7 @@ function Invoke-ExecCreateAppTemplate { } else { # For app registrations (applications) if ($AppResult.status -ne 200 -or -not $AppResult.body) { + $StatusCode = [HttpStatusCode]::NotFound throw "App registration not found for AppId: $AppId" } @@ -493,7 +502,7 @@ function Invoke-ExecCreateAppTemplate { details = Get-CippException -Exception $_ }) } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = $StatusCode ?? [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ListAppApprovalTemplates.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ListAppApprovalTemplates.ps1 index ea812b960b..c166ee6c20 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ListAppApprovalTemplates.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ListAppApprovalTemplates.ps1 @@ -54,15 +54,16 @@ function Invoke-ListAppApprovalTemplates { } } } - + $StatusCode = [HttpStatusCode]::OK } catch { $Body = @{ Results = "Failed to list app deployment templates: $($_.Exception.Message)" } + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = ConvertTo-Json -Depth 10 -InputObject @($Body) }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Domains/Invoke-AddDomain.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Domains/Invoke-AddDomain.ps1 index d3d287b708..e2716bd757 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Domains/Invoke-AddDomain.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Domains/Invoke-AddDomain.ps1 @@ -13,17 +13,23 @@ function Invoke-AddDomain { $TenantFilter = $Request.Body.tenantFilter $DomainName = $Request.Body.domain - # Interact with query parameters or the body of the request. - try { - if ([string]::IsNullOrWhiteSpace($DomainName)) { - throw 'Domain name is required' - } + if ([string]::IsNullOrWhiteSpace($DomainName)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{'Results' = 'Failed to add domain: Domain name is required' } + }) + } - # Validate domain name format - if ($DomainName -notmatch '^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$') { - throw 'Invalid domain name format' - } + # Validate domain name format + if ($DomainName -notmatch '^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$') { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{'Results' = "Failed to add domain $DomainName`: Invalid domain name format" } + }) + } + # Interact with query parameters or the body of the request. + try { Write-Information "Adding domain $DomainName to tenant $TenantFilter" $Body = @{ @@ -39,7 +45,7 @@ function Invoke-AddDomain { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to add domain $DomainName`: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to add domain $DomainName`: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Domains/Invoke-ExecDomainAction.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Domains/Invoke-ExecDomainAction.ps1 index f7c57225f4..f143332dc6 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Domains/Invoke-ExecDomainAction.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Domains/Invoke-ExecDomainAction.ps1 @@ -14,15 +14,28 @@ function Invoke-ExecDomainAction { $DomainName = $Request.Body.domain $Action = $Request.Body.Action - try { - if ([string]::IsNullOrWhiteSpace($DomainName)) { - throw 'Domain name is required' - } + if ([string]::IsNullOrWhiteSpace($DomainName)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{'Results' = @{ resultText = 'Domain name is required'; state = 'error' } } + }) + } - if ([string]::IsNullOrWhiteSpace($Action)) { - throw 'Action is required' - } + if ([string]::IsNullOrWhiteSpace($Action)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{'Results' = @{ resultText = 'Action is required'; state = 'error' } } + }) + } + if ($Action -notin @('verify', 'delete', 'setDefault')) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{'Results' = @{ resultText = "Invalid action: $Action"; state = 'error' } } + }) + } + + try { switch ($Action) { 'verify' { Write-Information "Verifying domain $DomainName for tenant $TenantFilter" @@ -68,9 +81,6 @@ function Invoke-ExecDomainAction { Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Set domain $DomainName as default" -Sev 'Info' } - default { - throw "Invalid action: $Action" - } } } catch { $ErrorMessage = Get-CippException -Exception $_ @@ -79,7 +89,7 @@ function Invoke-ExecDomainAction { state = 'error' } Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to perform action on domain $DomainName`: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Integration Templates/Invoke-ExecDeleteIntegrationApp.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Integration Templates/Invoke-ExecDeleteIntegrationApp.ps1 new file mode 100644 index 0000000000..b9b121550a --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Integration Templates/Invoke-ExecDeleteIntegrationApp.ps1 @@ -0,0 +1,84 @@ +function Invoke-ExecDeleteIntegrationApp { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Tenant.Application.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $Username = $Request.Headers.'x-ms-client-principal-name' + + try { + $TenantFilter = $Request.Body.tenantFilter + $AppId = $Request.Body.appId + $AppObjectId = $Request.Body.appObjectId + + if (-not $TenantFilter) { + throw 'Tenant filter is required' + } + if (-not $AppObjectId -and -not $AppId) { + throw 'Either appId or appObjectId is required' + } + + # If we only have appId, get the object ID + if (-not $AppObjectId -and $AppId) { + $App = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications?`$filter=appId eq '$AppId'" -tenantid $TenantFilter -AsApp $true + if ($App.value -and $App.value.Count -gt 0) { + $AppObjectId = $App.value[0].id + $AppDisplayName = $App.value[0].displayName + } else { + throw "Application with appId '$AppId' not found" + } + } else { + # Get app details for logging + try { + $App = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications/$AppObjectId" -tenantid $TenantFilter -AsApp $true + $AppDisplayName = $App.displayName + $AppId = $App.appId + } catch { + $AppDisplayName = 'Unknown' + } + } + + # Delete the service principal first (if exists and we have appId) + if ($AppId) { + try { + $SP = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/servicePrincipals?`$filter=appId eq '$AppId'" -tenantid $TenantFilter -AsApp $true + if ($SP.value -and $SP.value.Count -gt 0) { + $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/servicePrincipals/$($SP.value[0].id)" -type DELETE -tenantid $TenantFilter -AsApp $true + Write-LogMessage -headers $Headers -API $APIName -user $Username -tenant $TenantFilter -message "Deleted service principal for app '$AppDisplayName'" -Sev 'Info' + } + } catch { + Write-LogMessage -headers $Headers -API $APIName -user $Username -tenant $TenantFilter -message "Warning: Could not delete service principal: $($_.Exception.Message)" -Sev 'Warning' + } + } + + # Delete the application + $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/applications/$AppObjectId" -type DELETE -tenantid $TenantFilter -AsApp $true + + Write-LogMessage -headers $Headers -API $APIName -user $Username -tenant $TenantFilter -message "Deleted integration app '$AppDisplayName' (AppId: $AppId)" -Sev 'Info' + + $Results = @{ + Results = "Successfully deleted application '$AppDisplayName'" + AppId = $AppId + Tenant = $TenantFilter + } + $StatusCode = [HttpStatusCode]::OK + + } catch { + Write-LogMessage -headers $Headers -API $APIName -user $Username -tenant $TenantFilter -message "Failed to delete integration app: $($_.Exception.Message)" -Sev 'Error' + $Results = @{ + Results = "Failed to delete application: $($_.Exception.Message)" + } + $StatusCode = [HttpStatusCode]::BadRequest + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = ConvertTo-Json -Depth 10 -InputObject $Results + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Integration Templates/Invoke-ExecDeployIntegrationApp.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Integration Templates/Invoke-ExecDeployIntegrationApp.ps1 new file mode 100644 index 0000000000..50eb99269d --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Integration Templates/Invoke-ExecDeployIntegrationApp.ps1 @@ -0,0 +1,135 @@ +function Invoke-ExecDeployIntegrationApp { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Tenant.Application.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $Username = $Request.Headers.'x-ms-client-principal-name' + + try { + $TemplateId = $Request.Body.templateId + $Tenants = $Request.Body.tenants + $Customizations = $Request.Body.customizations + + if (-not $TemplateId) { + throw 'Template ID is required' + } + if (-not $Tenants -or $Tenants.Count -eq 0) { + throw 'At least one tenant is required' + } + + # Load the template (built-in or custom) + $Template = $null + + # Check built-in templates first + $BuiltInTemplatesPath = Join-Path -Path $PSScriptRoot -ChildPath '..\..\..\..\..\..\lib\data\IntegrationTemplates.json' + if (Test-Path $BuiltInTemplatesPath) { + $BuiltInTemplates = Get-Content -Path $BuiltInTemplatesPath -Raw | ConvertFrom-Json + $Template = $BuiltInTemplates | Where-Object { $_.id -eq $TemplateId } + } + + # Check custom templates if not found in built-in + if (-not $Template) { + $TemplateTable = Get-CIPPTable -TableName 'templates' + $Filter = "PartitionKey eq 'IntegrationTemplate' and RowKey eq '$TemplateId'" + $CustomTemplate = Get-CIPPAzDataTableEntity @TemplateTable -Filter $Filter + if ($CustomTemplate -and $CustomTemplate.JSON) { + $Template = $CustomTemplate.JSON | ConvertFrom-Json + } + } + + if (-not $Template) { + throw "Template not found: $TemplateId" + } + + # Apply customizations if provided + if ($Customizations) { + if ($Customizations.appNamePattern) { + $Template.appNamePattern = $Customizations.appNamePattern + } + if ($Customizations.secretExpirationDays) { + $Template.secretExpirationDays = $Customizations.secretExpirationDays + } + } + + # Create deployment tracking entry + $DeploymentId = [guid]::NewGuid().ToString() + $DeploymentTable = Get-CIPPTable -TableName 'IntegrationDeployments' + + $TenantCount = ($Tenants | Measure-Object).Count + $Queue = New-CippQueueEntry -Name "Integration App Deployment: $($Template.name)" -TotalTasks $TenantCount + + # Create batch for orchestrator + $Batch = foreach ($Tenant in $Tenants) { + [pscustomobject]@{ + FunctionName = 'DeployIntegrationApp' + Tenant = $Tenant.value + TenantName = $Tenant.label + DeploymentId = $DeploymentId + TemplateId = $TemplateId + TemplateName = $Template.name + AppNamePattern = $Template.appNamePattern + Permissions = $Template.permissions + GenerateSecret = $Template.generateSecret + SecretExpDays = $Template.secretExpirationDays + RedirectUris = $Template.redirectUris + QueueId = $Queue.RowKey + } + } + + # Store deployment metadata + $DeploymentEntity = @{ + PartitionKey = 'IntegrationDeployment' + RowKey = $DeploymentId + QueueId = $Queue.RowKey + TemplateName = $Template.name + TemplateId = $TemplateId + TenantCount = $TenantCount + Status = 'InProgress' + StartedBy = $Username + StartedAt = (Get-Date).ToUniversalTime().ToString('o') + Results = '[]' + } + Add-CIPPAzDataTableEntity @DeploymentTable -Entity $DeploymentEntity -Force + + # Start orchestrator + $InputObject = @{ + OrchestratorName = 'IntegrationAppDeploymentOrchestrator' + Batch = @($Batch) + SkipLog = $true + } + + Write-Information "Starting orchestrator with batch of $($Batch.Count) items" + Write-Information "Batch FunctionNames: $($Batch | ForEach-Object { $_.FunctionName } | Select-Object -Unique)" + + $OrchestratorResult = Start-CIPPOrchestrator -InputObject $InputObject + Write-Information "Orchestrator result: $OrchestratorResult" + + Write-LogMessage -headers $Headers -API $APIName -user $Username -message "Started integration app deployment: $($Template.name) to $TenantCount tenant(s). DeploymentId: $DeploymentId" -Sev 'Info' + + $Results = @{ + Results = "Deployment started for $($Template.name) to $TenantCount tenant(s)" + DeploymentId = $DeploymentId + QueueId = $Queue.RowKey + } + $StatusCode = [HttpStatusCode]::OK + + } catch { + Write-LogMessage -headers $Headers -API $APIName -user $Username -message "Integration app deployment failed: $($_.Exception.Message)" -Sev 'Error' + $Results = @{ + Results = "Deployment failed: $($_.Exception.Message)" + } + $StatusCode = [HttpStatusCode]::BadRequest + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = ConvertTo-Json -Depth 10 -InputObject $Results + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Integration Templates/Invoke-ExecIntegrationTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Integration Templates/Invoke-ExecIntegrationTemplate.ps1 new file mode 100644 index 0000000000..eab7b85b58 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Integration Templates/Invoke-ExecIntegrationTemplate.ps1 @@ -0,0 +1,184 @@ +function Invoke-ExecIntegrationTemplate { + <# + .FUNCTIONALITY + Entrypoint,AnyTenant + .ROLE + Tenant.Application.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $Username = $Request.Headers.'x-ms-client-principal-name' + + $Action = $Request.Body.action ?? $Request.Query.action + $TemplateId = $Request.Body.id ?? $Request.Query.id + + try { + $Table = Get-CIPPTable -TableName 'templates' + + switch ($Action) { + 'save' { + # Validate required fields + if (-not $Request.Body.name) { + throw 'Template name is required' + } + if (-not $Request.Body.permissions -or $Request.Body.permissions.Count -eq 0) { + throw 'At least one permission is required' + } + + # Generate new ID if not provided (new template) + if (-not $TemplateId) { + $TemplateId = [guid]::NewGuid().ToString() + } + + # Check if trying to modify a built-in template + $BuiltInTemplatesPath = Join-Path -Path $PSScriptRoot -ChildPath '..\..\..\..\..\..\lib\data\IntegrationTemplates.json' + if (Test-Path $BuiltInTemplatesPath) { + $BuiltInTemplates = Get-Content -Path $BuiltInTemplatesPath -Raw | ConvertFrom-Json + $IsBuiltIn = $BuiltInTemplates | Where-Object { $_.id -eq $TemplateId } + if ($IsBuiltIn) { + throw 'Cannot modify built-in templates. Use duplicate action instead.' + } + } + + # Build template object + $Template = @{ + name = $Request.Body.name + description = $Request.Body.description ?? '' + appNamePattern = $Request.Body.appNamePattern ?? ($Request.Body.name + ' - {TenantName}') + redirectUris = $Request.Body.redirectUris ?? @() + permissions = $Request.Body.permissions + generateSecret = $Request.Body.generateSecret ?? $true + secretExpirationDays = $Request.Body.secretExpirationDays ?? 730 + documentationUrl = $Request.Body.documentationUrl ?? '' + } + + $Entity = @{ + JSON = ConvertTo-Json -InputObject $Template -Depth 10 -Compress + RowKey = $TemplateId + PartitionKey = 'IntegrationTemplate' + } + + Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force + + Write-LogMessage -headers $Headers -API $APIName -user $Username -message "Saved integration template: $($Request.Body.name)" -Sev 'Info' + + $Results = @{ + Results = "Successfully saved template: $($Request.Body.name)" + TemplateId = $TemplateId + } + } + + 'delete' { + if (-not $TemplateId) { + throw 'Template ID is required for delete action' + } + + # Check if trying to delete a built-in template + $BuiltInTemplatesPath = Join-Path -Path $PSScriptRoot -ChildPath '..\..\..\..\..\..\lib\data\IntegrationTemplates.json' + if (Test-Path $BuiltInTemplatesPath) { + $BuiltInTemplates = Get-Content -Path $BuiltInTemplatesPath -Raw | ConvertFrom-Json + $IsBuiltIn = $BuiltInTemplates | Where-Object { $_.id -eq $TemplateId } + if ($IsBuiltIn) { + throw 'Cannot delete built-in templates' + } + } + + # Find and delete the template + $Filter = "PartitionKey eq 'IntegrationTemplate' and RowKey eq '$TemplateId'" + $ExistingTemplate = Get-CIPPAzDataTableEntity @Table -Filter $Filter + + if (-not $ExistingTemplate) { + throw "Template not found: $TemplateId" + } + + Remove-CIPPAzDataTableEntity @Table -Entity $ExistingTemplate + + Write-LogMessage -headers $Headers -API $APIName -user $Username -message "Deleted integration template: $TemplateId" -Sev 'Info' + + $Results = @{ + Results = "Successfully deleted template" + } + } + + 'duplicate' { + if (-not $TemplateId) { + throw 'Template ID is required for duplicate action' + } + + # Load source template (could be built-in or custom) + $SourceTemplate = $null + + # Check built-in templates first + $BuiltInTemplatesPath = Join-Path -Path $PSScriptRoot -ChildPath '..\..\..\..\..\..\lib\data\IntegrationTemplates.json' + if (Test-Path $BuiltInTemplatesPath) { + $BuiltInTemplates = Get-Content -Path $BuiltInTemplatesPath -Raw | ConvertFrom-Json + $SourceTemplate = $BuiltInTemplates | Where-Object { $_.id -eq $TemplateId } + } + + # Check custom templates if not found in built-in + if (-not $SourceTemplate) { + $Filter = "PartitionKey eq 'IntegrationTemplate' and RowKey eq '$TemplateId'" + $CustomTemplate = Get-CIPPAzDataTableEntity @Table -Filter $Filter + if ($CustomTemplate -and $CustomTemplate.JSON) { + $SourceTemplate = $CustomTemplate.JSON | ConvertFrom-Json + } + } + + if (-not $SourceTemplate) { + throw "Source template not found: $TemplateId" + } + + # Create new template with a new ID and modified name + $NewTemplateId = [guid]::NewGuid().ToString() + $NewName = $Request.Body.name ?? "$($SourceTemplate.name) (Copy)" + + $NewTemplate = @{ + name = $NewName + description = $SourceTemplate.description ?? '' + appNamePattern = $SourceTemplate.appNamePattern -replace [regex]::Escape($SourceTemplate.name), $NewName + redirectUris = $SourceTemplate.redirectUris ?? @() + permissions = $SourceTemplate.permissions + generateSecret = $SourceTemplate.generateSecret ?? $true + secretExpirationDays = $SourceTemplate.secretExpirationDays ?? 730 + documentationUrl = $SourceTemplate.documentationUrl ?? '' + } + + $Entity = @{ + JSON = ConvertTo-Json -InputObject $NewTemplate -Depth 10 -Compress + RowKey = $NewTemplateId + PartitionKey = 'IntegrationTemplate' + } + + Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force + + Write-LogMessage -headers $Headers -API $APIName -user $Username -message "Duplicated integration template: $($SourceTemplate.name) as $NewName" -Sev 'Info' + + $Results = @{ + Results = "Successfully duplicated template as: $NewName" + TemplateId = $NewTemplateId + } + } + + default { + throw "Invalid action: $Action. Valid actions are: save, delete, duplicate" + } + } + + $StatusCode = [HttpStatusCode]::OK + + } catch { + Write-LogMessage -headers $Headers -API $APIName -user $Username -message "Integration template operation failed: $($_.Exception.Message)" -Sev 'Error' + $Results = @{ + Results = "Operation failed: $($_.Exception.Message)" + } + $StatusCode = [HttpStatusCode]::BadRequest + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = ConvertTo-Json -Depth 10 -InputObject $Results + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Integration Templates/Invoke-ListIntegrationAppStatus.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Integration Templates/Invoke-ListIntegrationAppStatus.ps1 new file mode 100644 index 0000000000..70a55aef18 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Integration Templates/Invoke-ListIntegrationAppStatus.ps1 @@ -0,0 +1,140 @@ +function Invoke-ListIntegrationAppStatus { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Tenant.Application.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + + try { + $TemplateId = $Request.Body.templateId ?? $Request.Query.templateId + $Tenants = $Request.Body.tenants ?? @() + + if (-not $TemplateId) { + throw 'Template ID is required' + } + + # Load the template to get the app name pattern + $Template = $null + + $BuiltInTemplatesPath = Join-Path -Path $PSScriptRoot -ChildPath '..\..\..\..\..\..\lib\data\IntegrationTemplates.json' + if (Test-Path $BuiltInTemplatesPath) { + $BuiltInTemplates = Get-Content -Path $BuiltInTemplatesPath -Raw | ConvertFrom-Json + $Template = $BuiltInTemplates | Where-Object { $_.id -eq $TemplateId } + } + + if (-not $Template) { + $TemplateTable = Get-CIPPTable -TableName 'templates' + $Filter = "PartitionKey eq 'IntegrationTemplate' and RowKey eq '$TemplateId'" + $CustomTemplate = Get-CIPPAzDataTableEntity @TemplateTable -Filter $Filter + if ($CustomTemplate -and $CustomTemplate.JSON) { + $Template = $CustomTemplate.JSON | ConvertFrom-Json + } + } + + if (-not $Template) { + throw "Template not found: $TemplateId" + } + + $Results = @() + + foreach ($Tenant in $Tenants) { + $TenantDomain = $Tenant.value + $TenantLabel = $Tenant.label + + try { + # Get tenant info for name pattern + $TenantInfo = Get-Tenants -TenantFilter $TenantDomain + $DisplayTenantName = $TenantLabel + if ($TenantInfo.displayName) { + $DisplayTenantName = $TenantInfo.displayName + } + + # Build expected app name + $ExpectedAppName = $Template.appNamePattern -replace '\{TenantName\}', $DisplayTenantName + + # Search for existing apps matching the name (escape single quotes for OData) + $EscapedTemplateName = $Template.name -replace "'", "''" + $ExistingApps = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications?`$filter=startswith(displayName,'$EscapedTemplateName')" -tenantid $TenantDomain -AsApp $true + + $MatchingApps = @() + if ($ExistingApps.value) { + foreach ($App in $ExistingApps.value) { + # Check if app name matches our pattern (exact or similar) + if ($App.displayName -eq $ExpectedAppName -or $App.displayName -like "$($Template.name)*") { + # Get additional details + $AppDetails = @{ + id = $App.id + appId = $App.appId + displayName = $App.displayName + createdDateTime = $App.createdDateTime + } + + # Check for service principal + try { + $SP = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/servicePrincipals?`$filter=appId eq '$($App.appId)'" -tenantid $TenantDomain -AsApp $true + $AppDetails.hasServicePrincipal = ($SP.value -and $SP.value.Count -gt 0) + if ($AppDetails.hasServicePrincipal) { + $AppDetails.servicePrincipalId = $SP.value[0].id + } + } catch { + $AppDetails.hasServicePrincipal = $false + } + + # Check for secrets + try { + $AppDetails.secretCount = ($App.passwordCredentials | Measure-Object).Count + } catch { + $AppDetails.secretCount = 0 + } + + $MatchingApps += $AppDetails + } + } + } + + $Results += @{ + tenant = $TenantDomain + tenantName = $TenantLabel + displayName = $DisplayTenantName + expectedAppName = $ExpectedAppName + existingApps = $MatchingApps + hasExistingApps = ($MatchingApps.Count -gt 0) + existingAppCount = $MatchingApps.Count + } + + } catch { + $Results += @{ + tenant = $TenantDomain + tenantName = $TenantLabel + error = $_.Exception.Message + hasExistingApps = $false + existingAppCount = 0 + } + } + } + + $Body = @{ + Results = $Results + TemplateName = $Template.name + } + $StatusCode = [HttpStatusCode]::OK + + } catch { + Write-LogMessage -headers $Headers -API $APIName -message "Failed to check integration app status: $($_.Exception.Message)" -Sev 'Error' + $Body = @{ + Results = "Failed to check app status: $($_.Exception.Message)" + } + $StatusCode = [HttpStatusCode]::BadRequest + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = ConvertTo-Json -Depth 10 -InputObject $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Integration Templates/Invoke-ListIntegrationDeployments.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Integration Templates/Invoke-ListIntegrationDeployments.ps1 new file mode 100644 index 0000000000..91f5c968cf --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Integration Templates/Invoke-ListIntegrationDeployments.ps1 @@ -0,0 +1,109 @@ +function Invoke-ListIntegrationDeployments { + <# + .FUNCTIONALITY + Entrypoint,AnyTenant + .ROLE + Tenant.Application.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + + try { + $DeploymentId = $Request.Query.deploymentId + $DeploymentTable = Get-CIPPTable -TableName 'IntegrationDeployments' + + if ($DeploymentId) { + # Get specific deployment and its results + $DeploymentFilter = "PartitionKey eq 'IntegrationDeployment' and RowKey eq '$DeploymentId'" + $Deployment = Get-CIPPAzDataTableEntity @DeploymentTable -Filter $DeploymentFilter + + if (-not $Deployment) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = ConvertTo-Json -InputObject @{ Results = "Deployment not found: $DeploymentId" } + }) + } + + # Get all results for this deployment + $ResultsFilter = "PartitionKey eq 'IntegrationDeploymentResult' and DeploymentId eq '$DeploymentId'" + $Results = Get-CIPPAzDataTableEntity @DeploymentTable -Filter $ResultsFilter + + $ProcessedResults = @($Results | ForEach-Object { + [PSCustomObject]@{ + tenant = $_.Tenant + tenantName = $_.TenantName + displayName = $_.DisplayName + appName = $_.AppName + appId = $_.AppId + tenantId = $_.TenantId + clientSecret = $_.ClientSecret + secretExpiration = $_.SecretExpiration + status = $_.Status + message = $_.Message + completedAt = $_.CompletedAt + } + }) + + # Check if deployment is complete + $CompletedCount = ($ProcessedResults | Measure-Object).Count + $TotalCount = $Deployment.TenantCount + $IsComplete = $CompletedCount -ge $TotalCount + $SuccessCount = ($ProcessedResults | Where-Object { $_.status -eq 'Success' } | Measure-Object).Count + $FailedCount = ($ProcessedResults | Where-Object { $_.status -eq 'Failed' } | Measure-Object).Count + + # Update deployment status if complete + if ($IsComplete -and $Deployment.Status -ne 'Complete') { + $Deployment.Status = 'Complete' + $Deployment.CompletedAt = (Get-Date).ToUniversalTime().ToString('o') + Add-CIPPAzDataTableEntity @DeploymentTable -Entity $Deployment -Force + } + + $Body = @{ + deploymentId = $DeploymentId + templateName = $Deployment.TemplateName + status = if ($IsComplete) { 'Complete' } else { 'InProgress' } + totalCount = $TotalCount + completedCount = $CompletedCount + successCount = $SuccessCount + failedCount = $FailedCount + startedBy = $Deployment.StartedBy + startedAt = $Deployment.StartedAt + completedAt = $Deployment.CompletedAt + results = $ProcessedResults + } + + } else { + # List recent deployments + $Filter = "PartitionKey eq 'IntegrationDeployment'" + $Deployments = Get-CIPPAzDataTableEntity @DeploymentTable -Filter $Filter + + $Body = @($Deployments | Sort-Object -Property Timestamp -Descending | Select-Object -First 50 | ForEach-Object { + [PSCustomObject]@{ + deploymentId = $_.RowKey + templateName = $_.TemplateName + templateId = $_.TemplateId + tenantCount = $_.TenantCount + status = $_.Status + startedBy = $_.StartedBy + startedAt = $_.StartedAt + completedAt = $_.CompletedAt + } + }) + } + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = ConvertTo-Json -Depth 10 -InputObject $Body + }) + + } catch { + Write-LogMessage -headers $Headers -API $APIName -message "Failed to list integration deployments: $($_.Exception.Message)" -Sev 'Error' + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = ConvertTo-Json -InputObject @{ Results = "Failed to list deployments: $($_.Exception.Message)" } + }) + } +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Integration Templates/Invoke-ListIntegrationTemplates.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Integration Templates/Invoke-ListIntegrationTemplates.ps1 new file mode 100644 index 0000000000..8a8548e080 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Integration Templates/Invoke-ListIntegrationTemplates.ps1 @@ -0,0 +1,74 @@ +function Invoke-ListIntegrationTemplates { + <# + .FUNCTIONALITY + Entrypoint,AnyTenant + .ROLE + Tenant.Application.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + + try { + $TemplateId = $Request.Query.id + + # Load built-in templates from the module's data directory + $BuiltInTemplatesPath = Join-Path -Path $PSScriptRoot -ChildPath '..\..\..\..\..\..\lib\data\IntegrationTemplates.json' + $BuiltInTemplates = @() + if (Test-Path $BuiltInTemplatesPath) { + $BuiltInTemplates = Get-Content -Path $BuiltInTemplatesPath -Raw | ConvertFrom-Json + } + + # Load custom templates from Azure Table Storage + $Table = Get-CIPPTable -TableName 'templates' + $Filter = "PartitionKey eq 'IntegrationTemplate'" + $CustomTemplates = Get-CIPPAzDataTableEntity @Table -Filter $Filter + + # Process custom templates from storage + $ProcessedCustomTemplates = $CustomTemplates | ForEach-Object { + try { + $TemplateData = $null + if ($_.JSON) { + $TemplateData = $_.JSON | ConvertFrom-Json -ErrorAction Stop + } + + if ($TemplateData) { + $TemplateData | Add-Member -NotePropertyName 'id' -NotePropertyValue $_.RowKey -Force + $TemplateData | Add-Member -NotePropertyName 'isBuiltIn' -NotePropertyValue $false -Force + $TemplateData | Add-Member -NotePropertyName 'timestamp' -NotePropertyValue $_.Timestamp.DateTime.ToString('yyyy-MM-ddTHH:mm:ssZ') -Force + return $TemplateData + } + } catch { + Write-LogMessage -headers $Headers -API $APIName -message "Error processing custom template $($_.RowKey): $($_.Exception.Message)" -Sev 'Error' + } + return $null + } | Where-Object { $null -ne $_ } + + # Merge built-in and custom templates + $AllTemplates = @($BuiltInTemplates) + @($ProcessedCustomTemplates) + + # Filter by ID if requested + if ($TemplateId) { + $AllTemplates = $AllTemplates | Where-Object { $_.id -eq $TemplateId } + } + + $Body = @($AllTemplates) + + } catch { + Write-LogMessage -headers $Headers -API $APIName -message "Failed to list integration templates: $($_.Exception.Message)" -Sev 'Error' + $Body = @{ + Results = "Failed to list integration templates: $($_.Exception.Message)" + } + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = ConvertTo-Json -Depth 10 -InputObject $Body + }) + } + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = ConvertTo-Json -Depth 10 -InputObject $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-AddTenant.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-AddTenant.ps1 index 87086a1ad8..1045467272 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-AddTenant.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-AddTenant.ps1 @@ -57,7 +57,7 @@ function Invoke-AddTenant { resultText = "Failed to retrieve organization profile: $($_.Exception.Message)" }) } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } } 'AddTenant' { @@ -169,7 +169,7 @@ function Invoke-AddTenant { resultText = $Result }) } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } } } @@ -194,17 +194,23 @@ function Invoke-AddTenant { ValidationStatus = $Response.status } } catch { - return @{ - state = 'Error' - resultText = "Address validation failed: $($_.Exception.Message)" - } + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = @{ + state = 'Error' + resultText = "Address validation failed: $($_.Exception.Message)" + } + }) } } default { - return @{ - state = 'Error' - resultText = "Invalid action specified: $($Request.Body.Action)" - } + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ + state = 'Error' + resultText = "Invalid action specified: $($Request.Body.Action)" + } + }) } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-EditTenantVacationDefaults.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-EditTenantVacationDefaults.ps1 new file mode 100644 index 0000000000..7a43cb8335 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-EditTenantVacationDefaults.ps1 @@ -0,0 +1,94 @@ +function Invoke-EditTenantVacationDefaults { + <# + .FUNCTIONALITY + Entrypoint,AnyTenant + .ROLE + Tenant.Config.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + + + # Interact with query parameters or the body of the request. + $customerId = $Request.Body.customerId + $defaultDomainName = $Request.Body.defaultDomainName + $vacationDefaults = $Request.Body.vacationDefaults + + if (!$customerId) { + $response = @{ + state = 'error' + resultText = 'Customer ID is required' + } + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = $response + }) + return + } + + # AnyTenant: enforce tenant scope here; Get-Tenants is narrowed to the caller's allowed tenants + $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList + if ($AllowedTenants -notcontains 'AllTenants' -and -not (Get-Tenants -TenantFilter $customerId)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::Forbidden + Body = @{ state = 'error'; resultText = 'Access to this tenant is not allowed' } + }) + } + + $PropertiesTable = Get-CippTable -TableName 'TenantProperties' + + try { + # Convert the vacation defaults to JSON string and ensure it's treated as a string + # PolicyId is an array of objects, so the default depth would truncate it + $jsonValue = [string]($vacationDefaults | ConvertTo-Json -Compress -Depth 5) + + if ($jsonValue -and $jsonValue -ne '{}' -and $jsonValue -ne 'null' -and $jsonValue -ne '') { + # Save vacation defaults + $vacationEntity = @{ + PartitionKey = [string]$customerId + RowKey = [string]'VacationDefaults' + Value = [string]$jsonValue + } + $null = Add-CIPPAzDataTableEntity @PropertiesTable -Entity $vacationEntity -Force + Write-LogMessage -headers $Headers -tenant $customerId -API $APIName -message "Updated tenant vacation defaults" -Sev 'Info' + + $resultText = 'Tenant vacation defaults updated successfully' + } else { + # Remove vacation defaults if empty or null + $partitionKeys = @($customerId, $defaultDomainName) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Select-Object -Unique + $existingDefaults = Get-CIPPAzDataTableEntity @PropertiesTable -Filter "RowKey eq 'VacationDefaults'" + $toRemove = $existingDefaults | Where-Object { $_.PartitionKey -in $partitionKeys } + if ($toRemove) { + foreach ($Entity in $toRemove) { + Remove-CIPPAzDataTableEntity @PropertiesTable -Entity $Entity + } + Write-LogMessage -headers $Headers -tenant $customerId -API $APIName -message "Removed tenant vacation defaults for partition keys: $($partitionKeys -join ', ')" -Sev 'Info' + } + + $resultText = 'Tenant vacation defaults cleared successfully' + } + + $response = @{ + state = 'success' + resultText = $resultText + } + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = $response + }) + } catch { + Write-LogMessage -headers $Headers -tenant $customerId -API $APINAME -message "Edit Tenant Vacation Defaults failed. The error is: $($_.Exception.Message)" -Sev 'Error' + $response = @{ + state = 'error' + resultText = $_.Exception.Message + } + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::InternalServerError + Body = $response + }) + } +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ExecOffboardTenant.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ExecOffboardTenant.ps1 index 0c8432fef8..f3bcc64a9a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ExecOffboardTenant.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ExecOffboardTenant.ps1 @@ -27,7 +27,7 @@ function Invoke-ExecOffboardTenant { } elseif ($TenantId -eq $env:TenantID) { $Errors.Add('You cannot offboard the CSP tenant') } else { - if ($Request.Body.RemoveCSPGuestUsers -eq $true) { + if ($request.body.RemoveCSPGuestUsers -eq $true) { # Delete guest users who's domains match the CSP tenants try { try { @@ -59,7 +59,7 @@ function Invoke-ExecOffboardTenant { } } - if ($Request.Body.RemoveCSPnotificationContacts -eq $true) { + if ($request.body.RemoveCSPnotificationContacts -eq $true) { # Remove all email addresses that match the CSP tenants domains from the contact properties in /organization try { try { @@ -104,7 +104,7 @@ function Invoke-ExecOffboardTenant { } - if ($Request.Body.RemoveDomainAnalyserData -eq $true) { + if ($request.body.RemoveDomainAnalyserData -eq $true) { # Remove all Domain Analyser data for this tenant try { $DomainTable = Get-CIPPTable -Table 'Domains' @@ -152,13 +152,12 @@ function Invoke-ExecOffboardTenant { Write-LogMessage -headers $Headers -API $APIName -message "App $($_.label) was removed" -Sev 'Info' -tenant $TenantFilter } catch { $Errors.Add("Failed to removed app $($_.label)") - Write-LogMessage -headers $Headers -API $APIName -message "Failed to remove app $($_.label)" -Sev 'Error' -tenant $TenantFilter } } } # All customer tenant specific actions ALWAYS have to be completed before this action! - if ($Request.Body.RemoveMultitenantCSPApps -eq $true) { + if ($request.body.RemoveMultitenantCSPApps -eq $true) { # Remove multi-tenant apps with the CSP tenant as origin try { $MultiTenantCSPApps = (New-GraphGETRequest -Uri "https://graph.microsoft.com/v1.0/servicePrincipals?`$count=true&`$select=displayName,appId,id,appOwnerOrganizationId&`$filter=appOwnerOrganizationId eq $($env:TenantID)" -tenantid $TenantFilter -ComplexFilter) @@ -179,7 +178,7 @@ function Invoke-ExecOffboardTenant { } } $ClearCache = $false - if ($Request.Body.TerminateGDAP -eq $true) { + if ($request.body.TerminateGDAP -eq $true) { # Terminate GDAP relationships $ClearCache = $true try { @@ -203,7 +202,7 @@ function Invoke-ExecOffboardTenant { } } - if ($Request.Body.TerminateContract -eq $true) { + if ($request.body.TerminateContract -eq $true) { # Terminate contract relationship try { $null = (New-GraphPostRequest -type 'PATCH' -body '{ "relationshipToPartner": "none" }' -Uri "https://api.partnercenter.microsoft.com/v1/customers/$TenantFilter" -ContentType 'application/json' -scope 'https://api.partnercenter.microsoft.com/user_impersonation' -tenantid $env:TenantID) @@ -216,30 +215,19 @@ function Invoke-ExecOffboardTenant { } } - if ($ClearCache -eq $true) { - try { - $TenantsTable = Get-CippTable -tablename 'Tenants' - $TenantRow = Get-CIPPAzDataTableEntity @TenantsTable -Filter "PartitionKey eq 'Tenants' and RowKey eq '$TenantId'" -Property RowKey, PartitionKey, customerId, displayName - if ($TenantRow) { - Remove-CIPPAzDataTableEntity -Force @TenantsTable -Entity $TenantRow - $Results.Add("$($Tenant.displayName) ($TenantId) has been deleted from CIPP") - Write-LogMessage -headers $Headers -API $APIName -message "Tenant $($Tenant.displayName) ($TenantId) deleted from CIPP" -Sev 'Info' -tenant $TenantFilter - } else { - $Results.Add("Tenant $TenantId was not found in CIPP tenant list") - } - } catch { - $Errors.Add("Failed to delete tenant from CIPP: $($_.Exception.message)") - } + if ($ClearCache) { + $null = Get-Tenants -CleanOld + $Results.Add('Tenant cache has been cleared') } Write-LogMessage -headers $Headers -API $APIName -message 'Offboarding completed' -Sev 'Info' -tenant $TenantFilter - $StatusCode = [HttpStatusCode]::OK + $StatusCode = if ($Tenant -and $TenantId -eq $env:TenantID) { [HttpStatusCode]::BadRequest } else { Get-CippBulkStatusCode -Total ($Results.Count + $Errors.Count) -Failed $Errors.Count } $body = [pscustomobject]@{ 'Results' = @($Results) 'Errors' = @($Errors) } } catch { - $StatusCode = [HttpStatusCode]::OK + $StatusCode = [HttpStatusCode]::InternalServerError $body = $_.Exception.message } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ExecOnboardTenant.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ExecOnboardTenant.ps1 index f583743c2a..caf08d4c69 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ExecOnboardTenant.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ExecOnboardTenant.ps1 @@ -117,10 +117,10 @@ function Invoke-ExecOnboardTenant { } catch { $ErrorMsg = Get-NormalizedError -message $($_.Exception.Message) $Results = "Function Error: $($_.InvocationInfo.ScriptLineNumber) - $ErrorMsg" - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } } else { - $StatusCode = [HttpStatusCode]::NotFound + $StatusCode = [HttpStatusCode]::BadRequest $Results = 'Relationship not found' } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ExecSendOrgMessage.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ExecSendOrgMessage.ps1 index f02e274815..bf14cee311 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ExecSendOrgMessage.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ExecSendOrgMessage.ps1 @@ -109,7 +109,7 @@ Function Invoke-ExecSendOrgMessage { $ErrorMessage = Get-CippException -Exception $_ $Result = "Failed to send organizational message of type '$MessageType': $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage.NormalizedError } return [HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListOffboardTenants.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListOffboardTenants.ps1 index dadb47c065..5d29aefb43 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListOffboardTenants.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListOffboardTenants.ps1 @@ -14,6 +14,14 @@ function Invoke-ListOffboardTenants { try { $TenantAccess = Test-CIPPAccess -Request $Request -TenantList + } catch { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::Forbidden + Body = @([PSCustomObject]@{ Results = "Failed to list offboarding tenants. $($_.Exception.Message)" }) + }) + } + + try { $Tenants = @(Get-Tenants -IncludeAll) if ($TenantAccess -notcontains 'AllTenants') { @@ -28,7 +36,7 @@ function Invoke-ListOffboardTenants { $Results = @([PSCustomObject]@{ Results = "Failed to list offboarding tenants. $($ErrorMessage.NormalizedError)" }) - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListPartnerRelationships.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListPartnerRelationships.ps1 index 5c080a61a5..9da374f6a1 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListPartnerRelationships.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListPartnerRelationships.ps1 @@ -23,7 +23,7 @@ Function Invoke-ListPartnerRelationships { $StatusCode = [HttpStatusCode]::OK } catch { $GraphRequest = @() - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListTenantOnboarding.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListTenantOnboarding.ps1 index 168afecc2d..5a859268de 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListTenantOnboarding.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListTenantOnboarding.ps1 @@ -26,7 +26,7 @@ function Invoke-ListTenantOnboarding { } catch { $ErrorMessage = Get-CippException -Exception $_ $Results = "Function Error: $($ErrorMessage.LineNumber) - $($ErrorMessage.NormalizedError)" - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ StatusCode = $StatusCode diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListTenants.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListTenants.ps1 index 6404e57649..591ef222e6 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListTenants.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListTenants.ps1 @@ -20,7 +20,8 @@ function Invoke-ListTenants { $AllTenantSelector = $Request.Query.AllTenantSelector - $IncludeOffboardingDefaults = $Request.Query.IncludeOffboardingDefaults + # IncludeOffboardingDefaults is the pre-rename query parameter and still accepted. + $IncludeTenantDefaults = $Request.Query.IncludeTenantDefaults ?? $Request.Query.IncludeOffboardingDefaults # Fuzzy tenant lookup: case-insensitive substring match over displayName, defaultDomainName, # initialDomainName and customerId. Arbitrary verified domains are not indexed by Get-Tenants and @@ -109,11 +110,13 @@ function Invoke-ListTenants { } # If offboarding defaults are requested, fetch them - if ($IncludeOffboardingDefaults -eq 'true' -and $Tenants) { + if ($IncludeTenantDefaults -eq 'true' -and $Tenants) { $PropertiesTable = Get-CippTable -TableName 'TenantProperties' # Get all offboarding defaults for all tenants in one query for performance - $AllOffboardingDefaults = Get-CIPPAzDataTableEntity @PropertiesTable -Filter "RowKey eq 'OffboardingDefaults'" + $AllDefaultRows = Get-CIPPAzDataTableEntity @PropertiesTable -Filter "RowKey eq 'OffboardingDefaults' or RowKey eq 'VacationDefaults'" + $AllOffboardingDefaults = $AllDefaultRows | Where-Object { $_.RowKey -eq 'OffboardingDefaults' } + $AllVacationDefaults = $AllDefaultRows | Where-Object { $_.RowKey -eq 'VacationDefaults' } # Add offboarding defaults to each tenant foreach ($Tenant in $Tenants) { @@ -131,6 +134,20 @@ function Invoke-ListTenants { } else { $Tenant | Add-Member -MemberType NoteProperty -Name 'offboardingDefaults' -Value $null -Force } + + $TenantVacation = $AllVacationDefaults | Where-Object { $_.PartitionKey -eq $Tenant.customerId } | Select-Object -First 1 + if (-not $TenantVacation) { + $TenantVacation = $AllVacationDefaults | Where-Object { $_.PartitionKey -eq $Tenant.initialDomainName } | Select-Object -First 1 + } + $ParsedVacation = $null + if ($TenantVacation) { + try { + $ParsedVacation = $TenantVacation.Value | ConvertFrom-Json + } catch { + Write-LogMessage -headers $Headers -API $APIName -message "Failed to parse vacation defaults for tenant $($Tenant.defaultDomainName): $($_.Exception.Message)" -sev 'Warning' + } + } + $Tenant | Add-Member -MemberType NoteProperty -Name 'vacationDefaults' -Value $ParsedVacation -Force } } @@ -145,8 +162,9 @@ function Invoke-ListTenants { } # Add offboarding defaults to AllTenants object if requested - if ($IncludeOffboardingDefaults -eq 'true') { + if ($IncludeTenantDefaults -eq 'true') { $AllTenantsObject.offboardingDefaults = $null + $AllTenantsObject.vacationDefaults = $null } $TenantList.Add($AllTenantsObject) | Out-Null @@ -217,6 +235,7 @@ function Invoke-ListTenants { } Write-LogMessage -headers $Headers -tenant $TenantFilter -API $APIName -message 'Listed Tenant Details' -Sev 'Debug' + $StatusCode = [HttpStatusCode]::OK } catch { Write-LogMessage -headers $Headers -tenant $TenantFilter -API $APIName -message "List Tenant failed. The error is: $($_.Exception.Message)" -Sev 'Error' $body = [pscustomobject]@{ @@ -226,10 +245,11 @@ function Invoke-ListTenants { customerId = '' } + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = @($Body) }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListUsersAndGroups.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListUsersAndGroups.ps1 index af6261d5fa..6ee9a9c6e8 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListUsersAndGroups.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListUsersAndGroups.ps1 @@ -34,7 +34,7 @@ function Invoke-ListUsersAndGroups { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } return [HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-SetAuthMethod.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-SetAuthMethod.ps1 index 70af1dc0f1..f98ee08e65 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-SetAuthMethod.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-SetAuthMethod.ps1 @@ -46,7 +46,7 @@ function Invoke-SetAuthMethod { $Result = Set-CIPPAuthenticationPolicy @Params $StatusCode = [HttpStatusCode]::OK } catch { - $Result = $_.Exception.Message + $Result = "Failed to update authentication method: $((Get-CippException -Exception $_).NormalizedError)" $StatusCode = [HttpStatusCode]::InternalServerError } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-AddCAPolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-AddCAPolicy.ps1 index 26fa7c3b2b..1c567eeda9 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-AddCAPolicy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-AddCAPolicy.ps1 @@ -14,6 +14,7 @@ function Invoke-AddCAPolicy { $Tenants = $Request.body.tenantFilter.value if ('AllTenants' -in $Tenants) { $Tenants = (Get-Tenants).defaultDomainName } + $Failed = 0 $results = foreach ($Tenant in $tenants) { try { $NewCAPolicy = @{ @@ -31,6 +32,7 @@ function Invoke-AddCAPolicy { "$CAPolicy" } catch { + $Failed++ "$($_.Exception.Message)" continue } @@ -40,7 +42,7 @@ function Invoke-AddCAPolicy { $body = [pscustomobject]@{'Results' = @($results) } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = Get-CippBulkStatusCode -Total @($Tenants).Count -Failed $Failed Body = $body }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-AddNamedLocation.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-AddNamedLocation.ps1 index 457a620610..ed21a1f398 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-AddNamedLocation.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-AddNamedLocation.ps1 @@ -22,6 +22,7 @@ function Invoke-AddNamedLocation { $Tenants = $Tenants | Where-Object { $_ -in $AllowedTenantList.defaultDomainName } } + $Failed = 0 $results = foreach ($Tenant in $tenants) { try { $ObjBody = if ($Request.body.Type -eq 'IPLocation') { @@ -47,6 +48,7 @@ function Invoke-AddNamedLocation { Write-LogMessage -headers $Request.Headers -API $APINAME -tenant $tenant -message "Added Named Location $($Displayname)" -Sev 'Info' } catch { + $Failed++ "Failed to add Named Location $($Tenant): $($_.Exception.Message)" Write-LogMessage -headers $Request.Headers -API $APINAME -tenant $tenant -message "Failed adding Named Location$($Displayname). Error: $($_.Exception.Message)" -Sev 'Error' continue @@ -57,7 +59,7 @@ function Invoke-AddNamedLocation { $body = [pscustomobject]@{'Results' = @($results) } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = Get-CippBulkStatusCode -Total @($Tenants).Count -Failed $Failed Body = $body }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecCAServiceExclusion.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecCAServiceExclusion.ps1 index c8d1716bac..17fdd0b070 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecCAServiceExclusion.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecCAServiceExclusion.ps1 @@ -18,14 +18,16 @@ function Invoke-ExecCAServiceExclusion { $result = Set-CIPPCAPolicyServiceException -TenantFilter $TenantFilter -PolicyId $ID $Body = @{ Results = $result } Write-LogMessage -headers $Headers -API 'Set-CIPPCAPolicyServiceException' -message $result -Sev 'Info' -tenant $TenantFilter + $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-CippException -Exception $_ $Body = @{ Results = "Failed to add service provider exception to policy $($ID): $($ErrorMessage.NormalizedError)" } Write-LogMessage -headers $Headers -API 'Set-CIPPCAPolicyServiceException' -message "Failed to update policy $($ID) with service provider exception for tenant $($env:TenantID): $($ErrorMessage.NormalizedError)" -Sev 'Error' -tenant $TenantFilter -LogData (Get-CippException -Exception $_) + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListConditionalAccessPolicies.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListConditionalAccessPolicies.ps1 index 2a30b47017..6ac9fc75a0 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListConditionalAccessPolicies.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListConditionalAccessPolicies.ps1 @@ -274,7 +274,7 @@ function Invoke-ListConditionalAccessPolicies { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListConditionalAccessPolicyChanges.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListConditionalAccessPolicyChanges.ps1 index 6cfcb589d9..e2bce4754d 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListConditionalAccessPolicyChanges.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListConditionalAccessPolicyChanges.ps1 @@ -29,7 +29,7 @@ Function Invoke-ListConditionalAccessPolicyChanges { } $StatusCode = [HttpStatusCode]::OK } catch { - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError $Changes = "Failed to request audit logs for policy $($PolicyDisplayName): $($_.Exception.message)" } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListNamedLocations.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListNamedLocations.ps1 index a039587374..6623ada2cb 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListNamedLocations.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListNamedLocations.ps1 @@ -20,7 +20,7 @@ Function Invoke-ListNamedLocations { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-RemoveCAPolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-RemoveCAPolicy.ps1 index fb136f2a42..552b1f8572 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-RemoveCAPolicy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-RemoveCAPolicy.ps1 @@ -25,7 +25,7 @@ Function Invoke-RemoveCAPolicy { $ErrorMessage = Get-CippException -Exception $_ $Result = "Could not delete CA policy with ID $($policyId) : $($ErrorMessage.NormalizedError)" Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev 'Error' -tenant $TenantFilter -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError } $body = [pscustomobject]@{'Results' = $Result } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-EditCrossTenantPartner.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-EditCrossTenantPartner.ps1 new file mode 100644 index 0000000000..1517b3c230 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-EditCrossTenantPartner.ps1 @@ -0,0 +1,69 @@ +function Invoke-EditCrossTenantPartner { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Tenant.CrossTenant.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + + try { + $PartnerTenantId = $Request.Body.partnerTenantId + if ([string]::IsNullOrWhiteSpace($PartnerTenantId)) { + throw 'Partner Tenant ID is required.' + } + + # Build the patch body - only include fields that were submitted + $PatchBody = @{} + + if ($null -ne $Request.Body.b2bCollaborationInbound) { + $PatchBody['b2bCollaborationInbound'] = $Request.Body.b2bCollaborationInbound + } + if ($null -ne $Request.Body.b2bCollaborationOutbound) { + $PatchBody['b2bCollaborationOutbound'] = $Request.Body.b2bCollaborationOutbound + } + if ($null -ne $Request.Body.b2bDirectConnectInbound) { + $PatchBody['b2bDirectConnectInbound'] = $Request.Body.b2bDirectConnectInbound + } + if ($null -ne $Request.Body.b2bDirectConnectOutbound) { + $PatchBody['b2bDirectConnectOutbound'] = $Request.Body.b2bDirectConnectOutbound + } + if ($null -ne $Request.Body.inboundTrust) { + $PatchBody['inboundTrust'] = $Request.Body.inboundTrust + } + if ($null -ne $Request.Body.automaticUserConsentSettings) { + $PatchBody['automaticUserConsentSettings'] = $Request.Body.automaticUserConsentSettings + } + + if ($PatchBody.Count -eq 0) { + throw 'No valid partner policy fields provided to update.' + } + + $PatchJSON = ConvertTo-Json -Depth 20 -InputObject $PatchBody -Compress + $null = New-GraphPostRequest -tenantid $TenantFilter -Uri "https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/partners/$PartnerTenantId" -Type PATCH -Body $PatchJSON -ContentType 'application/json' -AsApp $true + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Successfully updated cross-tenant partner configuration for $PartnerTenantId." -Sev 'Info' + + $Body = [PSCustomObject]@{ + Results = "Successfully updated cross-tenant partner configuration for $PartnerTenantId." + } + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to update cross-tenant partner $($PartnerTenantId): $ErrorMessage" -Sev 'Error' + $Body = [PSCustomObject]@{ + Results = "Failed to update cross-tenant partner: $ErrorMessage" + } + $StatusCode = [HttpStatusCode]::BadRequest + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-EditCrossTenantPolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-EditCrossTenantPolicy.ps1 new file mode 100644 index 0000000000..c39e131a39 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-EditCrossTenantPolicy.ps1 @@ -0,0 +1,67 @@ +function Invoke-EditCrossTenantPolicy { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Tenant.CrossTenant.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + + try { + # Build the patch body from the request - only include fields that were submitted + $PatchBody = @{} + + if ($null -ne $Request.Body.b2bCollaborationInbound) { + $PatchBody['b2bCollaborationInbound'] = $Request.Body.b2bCollaborationInbound + } + if ($null -ne $Request.Body.b2bCollaborationOutbound) { + $PatchBody['b2bCollaborationOutbound'] = $Request.Body.b2bCollaborationOutbound + } + if ($null -ne $Request.Body.b2bDirectConnectInbound) { + $PatchBody['b2bDirectConnectInbound'] = $Request.Body.b2bDirectConnectInbound + } + if ($null -ne $Request.Body.b2bDirectConnectOutbound) { + $PatchBody['b2bDirectConnectOutbound'] = $Request.Body.b2bDirectConnectOutbound + } + if ($null -ne $Request.Body.inboundTrust) { + $PatchBody['inboundTrust'] = $Request.Body.inboundTrust + } + if ($null -ne $Request.Body.tenantRestrictions) { + $PatchBody['tenantRestrictions'] = $Request.Body.tenantRestrictions + } + if ($null -ne $Request.Body.automaticUserConsentSettings) { + $PatchBody['automaticUserConsentSettings'] = $Request.Body.automaticUserConsentSettings + } + + if ($PatchBody.Count -eq 0) { + throw 'No valid policy fields provided to update.' + } + + $PatchJSON = ConvertTo-Json -Depth 20 -InputObject $PatchBody -Compress + $null = New-GraphPostRequest -tenantid $TenantFilter -Uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default' -Type PATCH -Body $PatchJSON -ContentType 'application/json' -AsApp $true + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message 'Successfully updated cross-tenant access policy defaults.' -Sev 'Info' + + $Body = [PSCustomObject]@{ + Results = 'Successfully updated cross-tenant access policy defaults.' + } + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to update cross-tenant access policy: $ErrorMessage" -Sev 'Error' + $Body = [PSCustomObject]@{ + Results = "Failed to update cross-tenant access policy: $ErrorMessage" + } + $StatusCode = [HttpStatusCode]::BadRequest + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-EditExternalCollaboration.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-EditExternalCollaboration.ps1 new file mode 100644 index 0000000000..65213b3096 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-EditExternalCollaboration.ps1 @@ -0,0 +1,106 @@ +function Invoke-EditExternalCollaboration { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Tenant.CrossTenant.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + + $Results = [System.Collections.Generic.List[string]]::new() + + try { + # Update authorization policy settings (guest invites, guest role, etc.) + $AuthPatchBody = @{} + + if ($null -ne $Request.Body.allowInvitesFrom) { + $AuthPatchBody['allowInvitesFrom'] = $Request.Body.allowInvitesFrom + } + if ($null -ne $Request.Body.guestUserRoleId) { + $AuthPatchBody['guestUserRoleId'] = $Request.Body.guestUserRoleId + } + if ($null -ne $Request.Body.allowedToSignUpEmailBasedSubscriptions) { + $AuthPatchBody['allowedToSignUpEmailBasedSubscriptions'] = [bool]$Request.Body.allowedToSignUpEmailBasedSubscriptions + } + if ($null -ne $Request.Body.allowEmailVerifiedUsersToJoinOrganization) { + $AuthPatchBody['allowEmailVerifiedUsersToJoinOrganization'] = [bool]$Request.Body.allowEmailVerifiedUsersToJoinOrganization + } + if ($null -ne $Request.Body.blockMsnSignIn) { + $AuthPatchBody['blockMsnSignIn'] = [bool]$Request.Body.blockMsnSignIn + } + + if ($AuthPatchBody.Count -gt 0) { + $AuthPatchJSON = ConvertTo-Json -Depth 10 -InputObject $AuthPatchBody -Compress + $null = New-GraphPostRequest -tenantid $TenantFilter -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -Type PATCH -Body $AuthPatchJSON -ContentType 'application/json' + $Results.Add('Successfully updated authorization policy settings.') + } + + # Update B2B domain allow/deny lists if provided + if ($null -ne $Request.Body.domainRestrictions) { + try { + # Get existing B2B management policies + $B2BPolicies = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/legacy/policies' -tenantid $TenantFilter -AsApp $true + $B2BManagement = $B2BPolicies | Where-Object { $_.type -eq 6 } + + if ($B2BManagement) { + # Update existing B2B Management Policy + $ExistingDef = ($B2BManagement.definition | ConvertFrom-Json) + $ExistingDef.B2BManagementPolicy.InvitationsAllowedAndBlockedDomainsPolicy = $Request.Body.domainRestrictions.InvitationsAllowedAndBlockedDomainsPolicy + + $UpdateBody = @{ + definition = @(($ExistingDef | ConvertTo-Json -Depth 20 -Compress)) + } + $UpdateJSON = ConvertTo-Json -Depth 20 -InputObject $UpdateBody -Compress + $null = New-GraphPostRequest -tenantid $TenantFilter -Uri "https://graph.microsoft.com/beta/legacy/policies/$($B2BManagement.id)" -Type PATCH -Body $UpdateJSON -ContentType 'application/json' -AsApp $true + $Results.Add('Successfully updated domain allow/deny list.') + } else { + # No B2B Management Policy exists — create one + $NewDefinition = @{ + B2BManagementPolicy = @{ + InvitationsAllowedAndBlockedDomainsPolicy = $Request.Body.domainRestrictions.InvitationsAllowedAndBlockedDomainsPolicy + } + } + $NewPolicyBody = @{ + displayName = 'B2BManagementPolicy' + definition = @(($NewDefinition | ConvertTo-Json -Depth 20 -Compress)) + type = 6 + } + $NewPolicyJSON = ConvertTo-Json -Depth 20 -InputObject $NewPolicyBody -Compress + $null = New-GraphPostRequest -tenantid $TenantFilter -Uri 'https://graph.microsoft.com/beta/legacy/policies' -Type POST -Body $NewPolicyJSON -ContentType 'application/json' -AsApp $true + $Results.Add('Successfully created domain allow/deny list policy.') + } + } catch { + $DomainError = Get-NormalizedError -Message $_.Exception.Message + $Results.Add("Warning: Failed to update domain restrictions: $DomainError") + } + } + + if ($Results.Count -eq 0) { + throw 'No valid settings provided to update.' + } + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message ($Results -join ' ') -Sev 'Info' + + $Body = [PSCustomObject]@{ + Results = ($Results -join ' ') + } + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to update external collaboration settings: $ErrorMessage" -Sev 'Error' + $Body = [PSCustomObject]@{ + Results = "Failed to update external collaboration settings: $ErrorMessage" + } + $StatusCode = [HttpStatusCode]::BadRequest + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ExecAddCrossTenantPartner.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ExecAddCrossTenantPartner.ps1 new file mode 100644 index 0000000000..55538d6987 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ExecAddCrossTenantPartner.ps1 @@ -0,0 +1,74 @@ +function Invoke-ExecAddCrossTenantPartner { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Tenant.CrossTenant.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + + try { + if ([string]::IsNullOrWhiteSpace($Request.Body.partnerTenantId)) { + throw 'Partner Tenant ID is required.' + } + + # Build the partner configuration body + $PartnerBody = @{ + tenantId = $Request.Body.partnerTenantId + } + + # Add optional B2B Collaboration settings + if ($null -ne $Request.Body.b2bCollaborationInbound) { + $PartnerBody['b2bCollaborationInbound'] = $Request.Body.b2bCollaborationInbound + } + if ($null -ne $Request.Body.b2bCollaborationOutbound) { + $PartnerBody['b2bCollaborationOutbound'] = $Request.Body.b2bCollaborationOutbound + } + + # Add optional B2B Direct Connect settings + if ($null -ne $Request.Body.b2bDirectConnectInbound) { + $PartnerBody['b2bDirectConnectInbound'] = $Request.Body.b2bDirectConnectInbound + } + if ($null -ne $Request.Body.b2bDirectConnectOutbound) { + $PartnerBody['b2bDirectConnectOutbound'] = $Request.Body.b2bDirectConnectOutbound + } + + # Add optional inbound trust settings + if ($null -ne $Request.Body.inboundTrust) { + $PartnerBody['inboundTrust'] = $Request.Body.inboundTrust + } + + # Add optional automatic user consent + if ($null -ne $Request.Body.automaticUserConsentSettings) { + $PartnerBody['automaticUserConsentSettings'] = $Request.Body.automaticUserConsentSettings + } + + $PartnerJSON = ConvertTo-Json -Depth 20 -InputObject $PartnerBody -Compress + $Result = New-GraphPostRequest -tenantid $TenantFilter -Uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/partners' -Type POST -Body $PartnerJSON -ContentType 'application/json' -AsApp $true + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Successfully added cross-tenant partner configuration for tenant $($Request.Body.partnerTenantId)." -Sev 'Info' + + $Body = [PSCustomObject]@{ + Results = "Successfully added cross-tenant partner configuration for tenant $($Request.Body.partnerTenantId)." + Metadata = @{ tenantId = $Result.tenantId } + } + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to add cross-tenant partner: $ErrorMessage" -Sev 'Error' + $Body = [PSCustomObject]@{ + Results = "Failed to add cross-tenant partner: $ErrorMessage" + } + $StatusCode = [HttpStatusCode]::BadRequest + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ExecAddCrossTenantTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ExecAddCrossTenantTemplate.ps1 new file mode 100644 index 0000000000..0909972dd1 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ExecAddCrossTenantTemplate.ps1 @@ -0,0 +1,89 @@ +function Invoke-ExecAddCrossTenantTemplate { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Tenant.CrossTenant.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + + try { + if ([string]::IsNullOrWhiteSpace($Request.Body.templateName)) { + throw 'Template name is required.' + } + + $GUID = $Request.Body.GUID ? $Request.Body.GUID : (New-Guid).GUID + + # Decode the user principal + $updatedBy = 'Unknown' + try { + if ($Request.Headers.'x-ms-client-principal') { + $decodedPrincipal = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Request.Headers.'x-ms-client-principal')) | ConvertFrom-Json + $updatedBy = $decodedPrincipal.userDetails + } + } catch { + Write-Host "Failed to decode client principal: $_" + } + + $TemplateData = [PSCustomObject]@{ + GUID = $GUID + templateName = $Request.Body.templateName + description = $Request.Body.description ?? '' + createdAt = $Request.Body.createdAt ?? (Get-Date).ToUniversalTime() + updatedAt = (Get-Date).ToUniversalTime() + updatedBy = $updatedBy + settings = [PSCustomObject]@{ + # Cross-Tenant Access Policy defaults + b2bCollaborationInbound = $Request.Body.settings.b2bCollaborationInbound + b2bCollaborationOutbound = $Request.Body.settings.b2bCollaborationOutbound + b2bDirectConnectInbound = $Request.Body.settings.b2bDirectConnectInbound + b2bDirectConnectOutbound = $Request.Body.settings.b2bDirectConnectOutbound + inboundTrust = $Request.Body.settings.inboundTrust + tenantRestrictions = $Request.Body.settings.tenantRestrictions + automaticUserConsentSettings = $Request.Body.settings.automaticUserConsentSettings + # External Collaboration settings + allowInvitesFrom = $Request.Body.settings.allowInvitesFrom + guestUserRoleId = $Request.Body.settings.guestUserRoleId + allowedToSignUpEmailBasedSubscriptions = $Request.Body.settings.allowedToSignUpEmailBasedSubscriptions + allowEmailVerifiedUsersToJoinOrganization = $Request.Body.settings.allowEmailVerifiedUsersToJoinOrganization + blockMsnSignIn = $Request.Body.settings.blockMsnSignIn + # Domain restrictions + domainRestrictions = $Request.Body.settings.domainRestrictions + } + } + + $JSON = ConvertTo-Json -Compress -Depth 20 -InputObject $TemplateData + $Table = Get-CippTable -tablename 'templates' + $Table.Force = $true + Add-CIPPAzDataTableEntity @Table -Entity @{ + JSON = "$JSON" + RowKey = "$GUID" + PartitionKey = 'CrossTenantTemplate' + GUID = "$GUID" + } + + Write-LogMessage -headers $Headers -API $APIName -message "Cross-tenant security template '$($Request.Body.templateName)' with GUID $GUID added/updated." -Sev 'Info' + + $Body = [PSCustomObject]@{ + Results = "Successfully saved cross-tenant security template '$($Request.Body.templateName)'." + Metadata = @{ GUID = $GUID } + } + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -headers $Headers -API $APIName -message "Failed to save cross-tenant template: $ErrorMessage" -Sev 'Error' + $Body = [PSCustomObject]@{ + Results = "Failed to save cross-tenant template: $ErrorMessage" + } + $StatusCode = [HttpStatusCode]::BadRequest + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ExecApplyCrossTenantTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ExecApplyCrossTenantTemplate.ps1 new file mode 100644 index 0000000000..de515c9c01 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ExecApplyCrossTenantTemplate.ps1 @@ -0,0 +1,115 @@ +function Invoke-ExecApplyCrossTenantTemplate { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Tenant.CrossTenant.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter + + try { + $GUID = $Request.Body.GUID + if ([string]::IsNullOrWhiteSpace($GUID)) { + throw 'Template GUID is required.' + } + if ([string]::IsNullOrWhiteSpace($TenantFilter)) { + throw 'Tenant filter is required.' + } + + # Retrieve the template + $Table = Get-CippTable -tablename 'templates' + $Entity = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'CrossTenantTemplate' and RowKey eq '$GUID'" + + if (-not $Entity) { + throw "Template with GUID $GUID not found." + } + + $Template = $Entity.JSON | ConvertFrom-Json + $Settings = $Template.settings + $Results = [System.Collections.Generic.List[string]]::new() + + # Apply Cross-Tenant Access Policy defaults + $CrossTenantPatch = @{} + if ($null -ne $Settings.b2bCollaborationInbound) { $CrossTenantPatch['b2bCollaborationInbound'] = $Settings.b2bCollaborationInbound } + if ($null -ne $Settings.b2bCollaborationOutbound) { $CrossTenantPatch['b2bCollaborationOutbound'] = $Settings.b2bCollaborationOutbound } + if ($null -ne $Settings.b2bDirectConnectInbound) { $CrossTenantPatch['b2bDirectConnectInbound'] = $Settings.b2bDirectConnectInbound } + if ($null -ne $Settings.b2bDirectConnectOutbound) { $CrossTenantPatch['b2bDirectConnectOutbound'] = $Settings.b2bDirectConnectOutbound } + if ($null -ne $Settings.inboundTrust) { $CrossTenantPatch['inboundTrust'] = $Settings.inboundTrust } + if ($null -ne $Settings.tenantRestrictions) { $CrossTenantPatch['tenantRestrictions'] = $Settings.tenantRestrictions } + if ($null -ne $Settings.automaticUserConsentSettings) { $CrossTenantPatch['automaticUserConsentSettings'] = $Settings.automaticUserConsentSettings } + + if ($CrossTenantPatch.Count -gt 0) { + try { + $CrossTenantJSON = ConvertTo-Json -Depth 20 -InputObject $CrossTenantPatch -Compress + $null = New-GraphPostRequest -tenantid $TenantFilter -Uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default' -Type PATCH -Body $CrossTenantJSON -ContentType 'application/json' -AsApp $true + $Results.Add('Cross-tenant access policy defaults applied.') + } catch { + $ErrorMsg = Get-NormalizedError -Message $_.Exception.Message + $Results.Add("Failed to apply cross-tenant policy: $ErrorMsg") + } + } + + # Apply Authorization Policy settings (guest invite, guest role) + $AuthPatch = @{} + if ($null -ne $Settings.allowInvitesFrom) { $AuthPatch['allowInvitesFrom'] = $Settings.allowInvitesFrom } + if ($null -ne $Settings.guestUserRoleId) { $AuthPatch['guestUserRoleId'] = $Settings.guestUserRoleId } + if ($null -ne $Settings.allowedToSignUpEmailBasedSubscriptions) { $AuthPatch['allowedToSignUpEmailBasedSubscriptions'] = $Settings.allowedToSignUpEmailBasedSubscriptions } + if ($null -ne $Settings.allowEmailVerifiedUsersToJoinOrganization) { $AuthPatch['allowEmailVerifiedUsersToJoinOrganization'] = $Settings.allowEmailVerifiedUsersToJoinOrganization } + if ($null -ne $Settings.blockMsnSignIn) { $AuthPatch['blockMsnSignIn'] = $Settings.blockMsnSignIn } + + if ($AuthPatch.Count -gt 0) { + try { + $AuthJSON = ConvertTo-Json -Depth 10 -InputObject $AuthPatch -Compress + $null = New-GraphPostRequest -tenantid $TenantFilter -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -Type PATCH -Body $AuthJSON -ContentType 'application/json' + $Results.Add('External collaboration settings applied.') + } catch { + $ErrorMsg = Get-NormalizedError -Message $_.Exception.Message + $Results.Add("Failed to apply external collaboration settings: $ErrorMsg") + } + } + + # Apply domain restrictions if defined + if ($null -ne $Settings.domainRestrictions) { + try { + $B2BPolicies = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/legacy/policies' -tenantid $TenantFilter -AsApp $true + $B2BManagement = $B2BPolicies | Where-Object { $_.type -eq 6 } + if ($B2BManagement) { + $ExistingDef = ($B2BManagement.definition | ConvertFrom-Json) + $ExistingDef.B2BManagementPolicy.InvitationsAllowedAndBlockedDomainsPolicy = $Settings.domainRestrictions.InvitationsAllowedAndBlockedDomainsPolicy + $UpdateBody = @{ definition = @(($ExistingDef | ConvertTo-Json -Depth 20 -Compress)) } + $UpdateJSON = ConvertTo-Json -Depth 20 -InputObject $UpdateBody -Compress + $null = New-GraphPostRequest -tenantid $TenantFilter -Uri "https://graph.microsoft.com/beta/legacy/policies/$($B2BManagement.id)" -Type PATCH -Body $UpdateJSON -ContentType 'application/json' -AsApp $true + $Results.Add('Domain restrictions applied.') + } + } catch { + $ErrorMsg = Get-NormalizedError -Message $_.Exception.Message + $Results.Add("Failed to apply domain restrictions: $ErrorMsg") + } + } + + $FinalMessage = "Template '$($Template.templateName)' applied to $TenantFilter. " + ($Results -join ' ') + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $FinalMessage -Sev 'Info' + + $Body = [PSCustomObject]@{ + Results = $FinalMessage + } + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to apply cross-tenant template: $ErrorMessage" -Sev 'Error' + $Body = [PSCustomObject]@{ + Results = "Failed to apply cross-tenant template: $ErrorMessage" + } + $StatusCode = [HttpStatusCode]::BadRequest + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ExecRemoveCrossTenantPartner.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ExecRemoveCrossTenantPartner.ps1 new file mode 100644 index 0000000000..84bddd8644 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ExecRemoveCrossTenantPartner.ps1 @@ -0,0 +1,42 @@ +function Invoke-ExecRemoveCrossTenantPartner { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Tenant.CrossTenant.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + $TenantFilter = $Request.Body.tenantFilter ?? $Request.Query.tenantFilter + + try { + $PartnerTenantId = $Request.Body.partnerTenantId ?? $Request.Query.partnerTenantId + if ([string]::IsNullOrWhiteSpace($PartnerTenantId)) { + throw 'Partner Tenant ID is required.' + } + + $null = New-GraphPostRequest -tenantid $TenantFilter -Uri "https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/partners/$PartnerTenantId" -Type DELETE -AsApp $true + + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Successfully removed cross-tenant partner configuration for $PartnerTenantId." -Sev 'Info' + + $Body = [PSCustomObject]@{ + Results = "Successfully removed cross-tenant partner configuration for $PartnerTenantId." + } + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to remove cross-tenant partner $($PartnerTenantId): $ErrorMessage" -Sev 'Error' + $Body = [PSCustomObject]@{ + Results = "Failed to remove cross-tenant partner: $ErrorMessage" + } + $StatusCode = [HttpStatusCode]::BadRequest + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ExecRemoveCrossTenantTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ExecRemoveCrossTenantTemplate.ps1 new file mode 100644 index 0000000000..c542d240e3 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ExecRemoveCrossTenantTemplate.ps1 @@ -0,0 +1,48 @@ +function Invoke-ExecRemoveCrossTenantTemplate { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Tenant.CrossTenant.ReadWrite + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $Headers = $Request.Headers + + try { + $GUID = $Request.Body.GUID ?? $Request.Query.GUID + if ([string]::IsNullOrWhiteSpace($GUID)) { + throw 'Template GUID is required.' + } + + $Table = Get-CippTable -tablename 'templates' + $Entity = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'CrossTenantTemplate' and RowKey eq '$GUID'" + + if (-not $Entity) { + throw "Template with GUID $GUID not found." + } + + Remove-CIPPAzDataTableEntity @Table -Entity $Entity + + Write-LogMessage -headers $Headers -API $APIName -message "Cross-tenant security template with GUID $GUID removed." -Sev 'Info' + + $Body = [PSCustomObject]@{ + Results = 'Successfully removed cross-tenant security template.' + } + $StatusCode = [HttpStatusCode]::OK + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -headers $Headers -API $APIName -message "Failed to remove cross-tenant template: $ErrorMessage" -Sev 'Error' + $Body = [PSCustomObject]@{ + Results = "Failed to remove cross-tenant template: $ErrorMessage" + } + $StatusCode = [HttpStatusCode]::BadRequest + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ListCrossTenantHealth.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ListCrossTenantHealth.ps1 new file mode 100644 index 0000000000..a05b574acc --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ListCrossTenantHealth.ps1 @@ -0,0 +1,391 @@ +function Invoke-ListCrossTenantHealth { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Tenant.CrossTenant.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $TenantFilter = $Request.Query.tenantFilter + + try { + # Fetch cross-tenant data in bulk for health analysis + $Requests = @( + @{ + id = 'defaultPolicy' + url = 'policies/crossTenantAccessPolicy/default' + method = 'GET' + } + @{ + id = 'partners' + url = 'policies/crossTenantAccessPolicy/partners' + method = 'GET' + } + ) + + $BulkResults = New-GraphBulkRequest -Requests $Requests -tenantid $TenantFilter -asapp $true + + $DefaultPolicy = ($BulkResults | Where-Object { $_.id -eq 'defaultPolicy' }).body + $Partners = ($BulkResults | Where-Object { $_.id -eq 'partners' }).body.value + + # Fetch authorization policy separately (must use /authorizationPolicy/authorizationPolicy to get the object, not the collection) + $AuthPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $TenantFilter -AsApp $true + + # Fetch SharePoint settings for cross-service domain restriction checks + $SPOSettings = $null + try { + $SPOSettings = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings' -tenantid $TenantFilter -AsApp $true + } catch { + Write-LogMessage -API $APIName -tenant $TenantFilter -message "Could not get SharePoint settings for health check (non-critical): $($_.Exception.Message)" -Sev 'Debug' + } + + # Analyze configuration and detect issues + $Findings = [System.Collections.Generic.List[PSCustomObject]]::new() + + # Check 1: B2B Collaboration - Inbound defaults + $InboundCollabAccess = $DefaultPolicy.b2bCollaborationInbound.usersAndGroups.accessType + if ($InboundCollabAccess -eq 'allowed' -and + ($DefaultPolicy.b2bCollaborationInbound.usersAndGroups.targets | Where-Object { $_.target -eq 'AllUsers' })) { + $Findings.Add([PSCustomObject]@{ + Category = 'B2B Collaboration' + Area = 'Inbound' + Severity = 'Warning' + Finding = 'Inbound B2B collaboration allows all external users by default.' + Recommendation = 'Consider restricting inbound collaboration to specific organizations.' + RelatedLink = '/tenant/administration/cross-tenant-access/policy' + RelatedPage = 'Cross-Tenant Default Policy' + }) + } + + # Check 2: B2B Collaboration - Outbound defaults + $OutboundCollabAccess = $DefaultPolicy.b2bCollaborationOutbound.usersAndGroups.accessType + if ($OutboundCollabAccess -eq 'allowed' -and + ($DefaultPolicy.b2bCollaborationOutbound.usersAndGroups.targets | Where-Object { $_.target -eq 'AllUsers' })) { + $Findings.Add([PSCustomObject]@{ + Category = 'B2B Collaboration' + Area = 'Outbound' + Severity = 'Info' + Finding = 'Outbound B2B collaboration allows all internal users by default.' + Recommendation = 'Review if all users should be able to collaborate externally.' + RelatedLink = '/tenant/administration/cross-tenant-access/policy' + RelatedPage = 'Cross-Tenant Default Policy' + }) + } + + # Check 3: B2B Direct Connect defaults + $InboundDCAccess = $DefaultPolicy.b2bDirectConnectInbound.usersAndGroups.accessType + if ($InboundDCAccess -eq 'allowed' -and + ($DefaultPolicy.b2bDirectConnectInbound.usersAndGroups.targets | Where-Object { $_.target -eq 'AllUsers' })) { + $Findings.Add([PSCustomObject]@{ + Category = 'B2B Direct Connect' + Area = 'Inbound' + Severity = 'Warning' + Finding = 'B2B Direct Connect allows all external users inbound by default.' + Recommendation = 'Restrict Direct Connect to specific partner organizations for Teams shared channels.' + RelatedLink = '/tenant/administration/cross-tenant-access/policy' + RelatedPage = 'Cross-Tenant Default Policy' + }) + } + + # Check 4: Inbound Trust settings + if (-not $DefaultPolicy.inboundTrust.isMfaAccepted) { + $Findings.Add([PSCustomObject]@{ + Category = 'Inbound Trust' + Area = 'MFA' + Severity = 'Info' + Finding = 'External MFA is not trusted. Guest users must re-authenticate with your MFA.' + Recommendation = 'Consider trusting external MFA to reduce friction for B2B guests.' + RelatedLink = '/tenant/administration/cross-tenant-access/policy' + RelatedPage = 'Cross-Tenant Default Policy' + }) + } + if (-not $DefaultPolicy.inboundTrust.isCompliantDeviceAccepted) { + $Findings.Add([PSCustomObject]@{ + Category = 'Inbound Trust' + Area = 'Device Compliance' + Severity = 'Info' + Finding = 'External device compliance claims are not trusted.' + Recommendation = 'Consider trusting compliant device claims from partner organizations.' + RelatedLink = '/tenant/administration/cross-tenant-access/policy' + RelatedPage = 'Cross-Tenant Default Policy' + }) + } + + # Check 5: Tenant Restrictions + $TenantRestrictionsUsers = $DefaultPolicy.tenantRestrictions.usersAndGroups.accessType + if ($null -eq $TenantRestrictionsUsers -or $TenantRestrictionsUsers -eq 'allowed') { + $Findings.Add([PSCustomObject]@{ + Category = 'Tenant Restrictions' + Area = 'Defaults' + Severity = 'Info' + Finding = 'Tenant Restrictions v2 defaults are not configured or allow all.' + Recommendation = 'Configure Tenant Restrictions to control which external tenants users can access.' + RelatedLink = '/tenant/administration/cross-tenant-access/policy' + RelatedPage = 'Cross-Tenant Default Policy' + }) + } + + # Check 6: Guest invite settings + if ($AuthPolicy.allowInvitesFrom -eq 'everyone') { + $Findings.Add([PSCustomObject]@{ + Category = 'External Collaboration' + Area = 'Guest Invites' + Severity = 'Warning' + Finding = 'Anyone in the organization (including guests) can invite guest users.' + Recommendation = 'Restrict guest invitation permissions to admins or the Guest Inviter role.' + RelatedLink = '/tenant/administration/cross-tenant-access/external-collaboration' + RelatedPage = 'External Collaboration' + }) + } + + # Check 7: Guest invite blocked + if ($AuthPolicy.allowInvitesFrom -eq 'none') { + $Findings.Add([PSCustomObject]@{ + Category = 'External Collaboration' + Area = 'Guest Invites' + Severity = 'Warning' + Finding = 'Guest invitations are completely disabled. No one can invite external guests.' + Recommendation = 'If external collaboration is needed, allow at least admins to invite guests.' + RelatedLink = '/tenant/administration/cross-tenant-access/external-collaboration' + RelatedPage = 'External Collaboration' + }) + } + + # Check 8: Guest user role + $RestrictedGuestRoleId = '2af84b1e-32c8-42b7-82bc-daa82404023b' + $DefaultGuestRoleId = '10dae51f-b6af-4016-8d66-8c2a99b929b3' + if ($AuthPolicy.guestUserRoleId -ne $RestrictedGuestRoleId -and $AuthPolicy.guestUserRoleId -ne $DefaultGuestRoleId) { + $Findings.Add([PSCustomObject]@{ + Category = 'External Collaboration' + Area = 'Guest Permissions' + Severity = 'Warning' + Finding = 'Guest users have the same access as member users.' + Recommendation = 'Set guest user permissions to "Guest User" or "Restricted Guest User".' + RelatedLink = '/tenant/administration/cross-tenant-access/external-collaboration' + RelatedPage = 'External Collaboration' + }) + } + + # Check 9: Partner configuration conflicts + if ($Partners -and $Partners.Count -gt 0) { + foreach ($Partner in $Partners) { + # Check if partner has more permissive settings than default + $PartnerInbound = $Partner.b2bCollaborationInbound.usersAndGroups.accessType + if ($PartnerInbound -eq 'allowed' -and $InboundCollabAccess -eq 'blocked') { + $Findings.Add([PSCustomObject]@{ + Category = 'Configuration Conflict' + Area = "Partner: $($Partner.tenantId)" + Severity = 'Info' + Finding = "Partner $($Partner.tenantId) has inbound B2B allowed while defaults block it." + Recommendation = 'Verify this partner exception is intentional.' + RelatedLink = '/tenant/administration/cross-tenant-access/partners' + RelatedPage = 'Partner Organizations' + }) + } + } + } + + # Check 10: SharePoint sharing domain restrictions + if ($SPOSettings) { + $SPODomainMode = $SPOSettings.sharingDomainRestrictionMode + if ($SPODomainMode -eq 'allowList') { + $DomainCount = ($SPOSettings.sharingAllowedDomainList | Measure-Object).Count + $Findings.Add([PSCustomObject]@{ + Category = 'SharePoint Sharing' + Area = 'Domain Restrictions' + Severity = 'Info' + Finding = "SharePoint sharing is restricted to an allow list of $DomainCount domain(s). External users from unlisted domains cannot receive SharePoint/OneDrive sharing invitations." + Recommendation = 'Ensure all required partner domains are included in the SharePoint allowed domains list. Note: this is a separate list from Entra External Collaboration domain restrictions.' + RelatedLink = '/teams-share/sharepoint/sharing-settings' + RelatedPage = 'SharePoint Sharing Settings' + }) + } elseif ($SPODomainMode -eq 'blockList') { + $DomainCount = ($SPOSettings.sharingBlockedDomainList | Measure-Object).Count + $Findings.Add([PSCustomObject]@{ + Category = 'SharePoint Sharing' + Area = 'Domain Restrictions' + Severity = 'Info' + Finding = "SharePoint sharing blocks $DomainCount domain(s). External users from blocked domains cannot receive SharePoint/OneDrive sharing invitations." + Recommendation = 'Review the blocked domains list to ensure no required partners are blocked.' + RelatedLink = '/teams-share/sharepoint/sharing-settings' + RelatedPage = 'SharePoint Sharing Settings' + }) + } + + # Check 11: SharePoint sharing capability + if ($SPOSettings.sharingCapability -eq 'disabled') { + $Findings.Add([PSCustomObject]@{ + Category = 'SharePoint Sharing' + Area = 'Sharing Level' + Severity = 'Warning' + Finding = 'SharePoint external sharing is completely disabled. No files or sites can be shared externally regardless of other settings.' + Recommendation = 'If external collaboration via SharePoint is needed, set the sharing level to at least "Existing guests".' + RelatedLink = '/teams-share/sharepoint/sharing-settings' + RelatedPage = 'SharePoint Sharing Settings' + }) + } + } + + # Check 12: Teams guest access + try { + $TeamsConfig = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Get-CsTeamsClientConfiguration' -CmdParams @{Identity = 'Global' } + if ($TeamsConfig.AllowGuestUser -eq $false) { + $Findings.Add([PSCustomObject]@{ + Category = 'Teams Guest Access' + Area = 'Guest Settings' + Severity = 'Warning' + Finding = 'Guest access is disabled for Microsoft Teams. External guests cannot be added to any teams.' + Recommendation = 'Enable guest access in Teams Settings if external collaboration via Teams is needed.' + RelatedLink = '/teams-share/teams/teams-settings' + RelatedPage = 'Teams Settings' + }) + } + } catch { + Write-LogMessage -API $APIName -tenant $TenantFilter -message "Could not check Teams guest access (non-critical): $($_.Exception.Message)" -Sev 'Debug' + } + + # Check 13: Email OTP authentication for guests + try { + $EmailOTPPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/email' -tenantid $TenantFilter -AsApp $true + if ($EmailOTPPolicy.state -ne 'enabled') { + $Findings.Add([PSCustomObject]@{ + Category = 'External Collaboration' + Area = 'Email OTP' + Severity = 'Warning' + Finding = 'Email One-Time Passcode authentication is not enabled. Guests with personal email addresses (Gmail, Yahoo, etc.) may not be able to sign in.' + Recommendation = 'Enable Email OTP in Authentication Methods to allow guests with personal email addresses to authenticate. Without this, personal email guests have no way to sign in.' + RelatedLink = '/tenant/administration/cross-tenant-access/external-collaboration' + RelatedPage = 'External Collaboration' + }) + } + } catch { + Write-LogMessage -API $APIName -tenant $TenantFilter -message "Could not check Email OTP policy (non-critical): $($_.Exception.Message)" -Sev 'Debug' + } + + # Check 14: SharePoint sharing vs Entra guest invite mismatch + if ($SPOSettings -and $AuthPolicy) { + $EntraAllowsGuests = $AuthPolicy.allowInvitesFrom -ne 'none' + $SPOAllowsExternal = $SPOSettings.sharingCapability -ne 'disabled' + + if ($EntraAllowsGuests -and -not $SPOAllowsExternal) { + $Findings.Add([PSCustomObject]@{ + Category = 'Configuration Mismatch' + Area = 'Entra vs SharePoint' + Severity = 'Warning' + Finding = 'Entra allows guest invitations but SharePoint external sharing is disabled. Guests can be invited to the tenant but cannot access any SharePoint content.' + Recommendation = 'Either enable SharePoint external sharing or disable guest invitations in Entra if SharePoint access is not needed.' + RelatedLink = '/teams-share/sharepoint/sharing-settings' + RelatedPage = 'SharePoint Sharing Settings' + }) + } elseif (-not $EntraAllowsGuests -and $SPOAllowsExternal) { + $Findings.Add([PSCustomObject]@{ + Category = 'Configuration Mismatch' + Area = 'Entra vs SharePoint' + Severity = 'Info' + Finding = 'SharePoint external sharing is enabled but Entra guest invitations are disabled. Only existing guests or anonymous sharing links will work.' + Recommendation = 'Enable guest invitations in Entra if new external users need to be invited, or use anonymous sharing links.' + RelatedLink = '/tenant/administration/cross-tenant-access/external-collaboration' + RelatedPage = 'External Collaboration' + }) + } + } + + # Check 15: Entra vs SharePoint domain list mismatch + if ($SPOSettings) { + try { + $B2BPolicyForCompare = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/legacy/policies' -tenantid $TenantFilter -AsApp $true + $B2BMgmtForCompare = $B2BPolicyForCompare | Where-Object { $_.type -eq 6 } + if ($B2BMgmtForCompare) { + $B2BDefCompare = ($B2BMgmtForCompare.definition | ConvertFrom-Json).B2BManagementPolicy + $EntraDomainPolicy = $B2BDefCompare.InvitationsAllowedAndBlockedDomainsPolicy + $EntraAllowed = @($EntraDomainPolicy.AllowedDomains | Where-Object { $_ }) + $SPOMode = $SPOSettings.sharingDomainRestrictionMode + $SPOAllowed = @($SPOSettings.sharingAllowedDomainList | Where-Object { $_ }) + + if ($EntraAllowed.Count -gt 0 -and $SPOMode -eq 'allowList' -and $SPOAllowed.Count -gt 0) { + $EntraOnly = @($EntraAllowed | Where-Object { $_ -notin $SPOAllowed }) + $SPOOnly = @($SPOAllowed | Where-Object { $_ -notin $EntraAllowed }) + + if ($EntraOnly.Count -gt 0 -or $SPOOnly.Count -gt 0) { + $DetailParts = [System.Collections.Generic.List[string]]::new() + if ($EntraOnly.Count -gt 0) { + $DetailParts.Add("Domains in Entra but NOT SharePoint: $($EntraOnly -join ', ')") + } + if ($SPOOnly.Count -gt 0) { + $DetailParts.Add("Domains in SharePoint but NOT Entra: $($SPOOnly -join ', ')") + } + $Findings.Add([PSCustomObject]@{ + Category = 'Configuration Mismatch' + Area = 'Domain Allow-Lists' + Severity = 'Warning' + Finding = "Entra and SharePoint have different domain allow-lists. $($DetailParts -join ' | ')" + Recommendation = 'Synchronize the domain allow-lists between Entra External Collaboration and SharePoint Sharing Settings to avoid confusing access failures. A domain must be allowed in BOTH lists for guest invitations and SharePoint access to work.' + RelatedLink = '/teams-share/sharepoint/sharing-settings' + RelatedPage = 'SharePoint Sharing Settings' + }) + } + } + } + } catch { + Write-LogMessage -API $APIName -tenant $TenantFilter -message "Could not compare domain lists (non-critical): $($_.Exception.Message)" -Sev 'Debug' + } + } + + # Calculate overall health score + $CriticalCount = ($Findings | Where-Object { $_.Severity -eq 'Critical' }).Count + $WarningCount = ($Findings | Where-Object { $_.Severity -eq 'Warning' }).Count + $InfoCount = ($Findings | Where-Object { $_.Severity -eq 'Info' }).Count + + $HealthScore = 100 + $HealthScore -= ($CriticalCount * 25) + $HealthScore -= ($WarningCount * 10) + $HealthScore -= ($InfoCount * 2) + if ($HealthScore -lt 0) { $HealthScore = 0 } + + $HealthStatus = if ($HealthScore -ge 80) { 'Healthy' } + elseif ($HealthScore -ge 60) { 'Needs Attention' } + elseif ($HealthScore -ge 40) { 'At Risk' } + else { 'Critical' } + + $Result = [PSCustomObject]@{ + Tenant = $TenantFilter + HealthScore = $HealthScore + HealthStatus = $HealthStatus + CriticalCount = $CriticalCount + WarningCount = $WarningCount + InfoCount = $InfoCount + PartnerCount = if ($Partners) { $Partners.Count } else { 0 } + Findings = @($Findings) + Summary = [PSCustomObject]@{ + b2bCollaborationInbound = $DefaultPolicy.b2bCollaborationInbound.usersAndGroups.accessType ?? 'Not configured' + b2bCollaborationOutbound = $DefaultPolicy.b2bCollaborationOutbound.usersAndGroups.accessType ?? 'Not configured' + b2bDirectConnectInbound = $DefaultPolicy.b2bDirectConnectInbound.usersAndGroups.accessType ?? 'Not configured' + b2bDirectConnectOutbound = $DefaultPolicy.b2bDirectConnectOutbound.usersAndGroups.accessType ?? 'Not configured' + trustExternalMFA = $DefaultPolicy.inboundTrust.isMfaAccepted ?? $false + trustCompliantDevices = $DefaultPolicy.inboundTrust.isCompliantDeviceAccepted ?? $false + trustHybridJoinedDevices = $DefaultPolicy.inboundTrust.isHybridAzureADJoinedDeviceAccepted ?? $false + guestInvitePolicy = $AuthPolicy.allowInvitesFrom ?? 'Not configured' + } + } + + $StatusCode = [HttpStatusCode]::OK + $Body = [PSCustomObject]@{ + Results = $Result + } + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API $APIName -tenant $TenantFilter -message "Failed to generate cross-tenant health report: $ErrorMessage" -Sev 'Error' + $StatusCode = [HttpStatusCode]::Forbidden + $Body = [PSCustomObject]@{ + Results = "Failed to generate cross-tenant health report: $ErrorMessage" + } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ListCrossTenantPartners.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ListCrossTenantPartners.ps1 new file mode 100644 index 0000000000..bf04912639 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ListCrossTenantPartners.ps1 @@ -0,0 +1,78 @@ +function Invoke-ListCrossTenantPartners { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Tenant.CrossTenant.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $TenantFilter = $Request.Query.tenantFilter + + try { + # Get all partner cross-tenant configurations + $Partners = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/partners' -tenantid $TenantFilter -AsApp $true + + # Resolve partner tenant names via bulk request using the CIPP service tenant + $TenantLookup = @{} + if ($Partners.Count -gt 0) { + try { + $ReverseLookupRequests = $Partners | ForEach-Object { + @{ + id = $_.tenantId + url = "tenantRelationships/findTenantInformationByTenantId(tenantId='$($_.tenantId)')" + method = 'GET' + } + } + $LookupResults = New-GraphBulkRequest -Requests @($ReverseLookupRequests) -tenantid $env:TenantID -NoAuthCheck $true -asapp $true + foreach ($Result in $LookupResults) { + if ($Result.body.displayName) { + $TenantLookup[$Result.id] = @{ + displayName = $Result.body.displayName + defaultDomainName = $Result.body.defaultDomainName + } + } + } + } catch { + Write-LogMessage -API $APIName -tenant $TenantFilter -message "Could not resolve partner tenant names: $($_.Exception.Message)" -Sev 'Debug' + } + } + + $Results = foreach ($Partner in $Partners) { + $Lookup = $TenantLookup[$Partner.tenantId] + [PSCustomObject]@{ + tenantId = $Partner.tenantId + partnerName = $Lookup.displayName ?? 'Unknown' + partnerDomain = $Lookup.defaultDomainName ?? '' + isServiceProvider = $Partner.isServiceProvider + isInMultiTenantOrganization = $Partner.isInMultiTenantOrganization + b2bCollaborationInbound = $Partner.b2bCollaborationInbound + b2bCollaborationOutbound = $Partner.b2bCollaborationOutbound + b2bDirectConnectInbound = $Partner.b2bDirectConnectInbound + b2bDirectConnectOutbound = $Partner.b2bDirectConnectOutbound + inboundTrust = $Partner.inboundTrust + automaticUserConsentSettings = $Partner.automaticUserConsentSettings + identitySynchronization = $Partner.identitySynchronization + } + } + + $StatusCode = [HttpStatusCode]::OK + $Body = [PSCustomObject]@{ + Results = @($Results) + } + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API $APIName -tenant $TenantFilter -message "Failed to list cross-tenant partners: $ErrorMessage" -Sev 'Error' + $StatusCode = [HttpStatusCode]::Forbidden + $Body = [PSCustomObject]@{ + Results = "Failed to list cross-tenant partners: $ErrorMessage" + } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ListCrossTenantPolicy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ListCrossTenantPolicy.ps1 new file mode 100644 index 0000000000..3c64c85eca --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ListCrossTenantPolicy.ps1 @@ -0,0 +1,48 @@ +function Invoke-ListCrossTenantPolicy { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Tenant.CrossTenant.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $TenantFilter = $Request.Query.tenantFilter + + try { + # Retrieve the full default cross-tenant access policy + $DefaultPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default' -tenantid $TenantFilter -AsApp $true + + # Build a structured response + $Result = [PSCustomObject]@{ + Tenant = $TenantFilter + b2bCollaborationInbound = $DefaultPolicy.b2bCollaborationInbound + b2bCollaborationOutbound = $DefaultPolicy.b2bCollaborationOutbound + b2bDirectConnectInbound = $DefaultPolicy.b2bDirectConnectInbound + b2bDirectConnectOutbound = $DefaultPolicy.b2bDirectConnectOutbound + inboundTrust = $DefaultPolicy.inboundTrust + tenantRestrictions = $DefaultPolicy.tenantRestrictions + automaticUserConsentSettings = $DefaultPolicy.automaticUserConsentSettings + isServiceDefault = $DefaultPolicy.isServiceDefault + } + + $StatusCode = [HttpStatusCode]::OK + $Body = [PSCustomObject]@{ + Results = $Result + } + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API $APIName -tenant $TenantFilter -message "Failed to retrieve cross-tenant access policy: $ErrorMessage" -Sev 'Error' + $StatusCode = [HttpStatusCode]::Forbidden + $Body = [PSCustomObject]@{ + Results = "Failed to retrieve cross-tenant access policy: $ErrorMessage" + } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ListCrossTenantTemplates.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ListCrossTenantTemplates.ps1 new file mode 100644 index 0000000000..82997fdb86 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ListCrossTenantTemplates.ps1 @@ -0,0 +1,48 @@ +function Invoke-ListCrossTenantTemplates { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Tenant.CrossTenant.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + + try { + $Table = Get-CippTable -tablename 'templates' + $Filter = "PartitionKey eq 'CrossTenantTemplate'" + $Templates = Get-CIPPAzDataTableEntity @Table -Filter $Filter + + $Results = foreach ($Template in $Templates) { + $TemplateData = $Template.JSON | ConvertFrom-Json + [PSCustomObject]@{ + GUID = $Template.RowKey + templateName = $TemplateData.templateName + description = $TemplateData.description + createdAt = $TemplateData.createdAt + updatedAt = $TemplateData.updatedAt + updatedBy = $TemplateData.updatedBy + settings = $TemplateData.settings + } + } + + $StatusCode = [HttpStatusCode]::OK + $Body = [PSCustomObject]@{ + Results = @($Results) + } + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API $APIName -message "Failed to list cross-tenant templates: $ErrorMessage" -Sev 'Error' + $StatusCode = [HttpStatusCode]::InternalServerError + $Body = [PSCustomObject]@{ + Results = "Failed to list cross-tenant templates: $ErrorMessage" + } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ListExternalCollaboration.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ListExternalCollaboration.ps1 new file mode 100644 index 0000000000..70e233e2e2 --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/CrossTenant/Invoke-ListExternalCollaboration.ps1 @@ -0,0 +1,78 @@ +function Invoke-ListExternalCollaboration { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Tenant.CrossTenant.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + + $APIName = $Request.Params.CIPPEndpoint + $TenantFilter = $Request.Query.tenantFilter + + try { + # Fetch authorization policy directly (note: must use /authorizationPolicy/authorizationPolicy to get the object, not the collection) + $AuthPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $TenantFilter -AsApp $true + + # Map guest invite setting to human-readable labels + $InviteSettingMap = @{ + 'adminsAndGuestInviters' = 'Only admins and users in the Guest Inviter role' + 'adminsGuestInvitersAndAllMembers' = 'Member users and users assigned to specific admin roles' + 'everyone' = 'Anyone in the organization including guests' + 'none' = 'No one in the organization' + } + + # Map guest user role ID to human-readable labels + $GuestRoleMap = @{ + 'a0b1b346-4d3e-4e8b-98f8-753987be4970' = 'User (same access as members)' + '10dae51f-b6af-4016-8d66-8c2a99b929b3' = 'Guest User (default, limited access)' + '2af84b1e-32c8-42b7-82bc-daa82404023b' = 'Restricted Guest User (most restrictive)' + } + + # Attempt to get B2B management policies (domain allow/deny lists) + $DomainRestrictions = $null + try { + $B2BPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/legacy/policies' -tenantid $TenantFilter -AsApp $true + $B2BManagement = $B2BPolicy | Where-Object { $_.type -eq 6 } + if ($B2BManagement) { + $B2BDefinition = ($B2BManagement.definition | ConvertFrom-Json).B2BManagementPolicy + $DomainRestrictions = [PSCustomObject]@{ + InvitationsAllowedAndBlockedDomainsPolicy = $B2BDefinition.InvitationsAllowedAndBlockedDomainsPolicy + } + } + } catch { + # B2B management policy may not be available in all tenants + Write-LogMessage -API $APIName -tenant $TenantFilter -message "Could not retrieve B2B management policy (non-critical): $($_.Exception.Message)" -Sev 'Debug' + } + + $Result = [PSCustomObject]@{ + Tenant = $TenantFilter + allowInvitesFrom = $AuthPolicy.allowInvitesFrom + allowInvitesFromLabel = $InviteSettingMap[$AuthPolicy.allowInvitesFrom] ?? $AuthPolicy.allowInvitesFrom + guestUserRoleId = $AuthPolicy.guestUserRoleId + guestUserRoleLabel = $GuestRoleMap[$AuthPolicy.guestUserRoleId] ?? 'Custom Role' + allowedToSignUpEmailBasedSubscriptions = $AuthPolicy.allowedToSignUpEmailBasedSubscriptions + allowEmailVerifiedUsersToJoinOrganization = $AuthPolicy.allowEmailVerifiedUsersToJoinOrganization + blockMsnSignIn = $AuthPolicy.blockMsnSignIn + domainRestrictions = $DomainRestrictions + } + + $StatusCode = [HttpStatusCode]::OK + $Body = [PSCustomObject]@{ + Results = $Result + } + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API $APIName -tenant $TenantFilter -message "Failed to retrieve external collaboration settings: $ErrorMessage" -Sev 'Error' + $StatusCode = [HttpStatusCode]::Forbidden + $Body = [PSCustomObject]@{ + Results = "Failed to retrieve external collaboration settings: $ErrorMessage" + } + } + + return ([HttpResponseContext]@{ + StatusCode = $StatusCode + Body = $Body + }) +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecAddGDAPRole.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecAddGDAPRole.ps1 index ab6cae75ea..0e38edf3ba 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecAddGDAPRole.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecAddGDAPRole.ps1 @@ -11,6 +11,7 @@ function Invoke-ExecAddGDAPRole { $Headers = $Request.Headers $Action = $Request.Body.Action ?? $Request.Query.Action ?? 'AddRoleSimple' $GroupBlockList = @('All Users', 'AdminAgents', 'HelpdeskAgents', 'SalesAgents') + $StatusCode = [HttpStatusCode]::OK switch ($Action) { 'ListGroups' { @@ -56,6 +57,7 @@ function Invoke-ExecAddGDAPRole { Add-CIPPAzDataTableEntity @Table -Entity $Entities -Force $Result = "Added $($Entities.Count) GDAP role mapping(s)" Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $Result -Sev 'Info' + if ($ErrorsFound) { $StatusCode = [HttpStatusCode]::MultiStatus } } elseif ($ErrorsFound -eq $false) { $Results.Add(@{ state = 'success' @@ -64,6 +66,7 @@ function Invoke-ExecAddGDAPRole { Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message 'All GDAP role mappings already exist' -Sev 'Info' } else { $Result = 'Failed to add GDAP role mappings: reserved groups cannot be mapped' + $StatusCode = [HttpStatusCode]::BadRequest Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $Result -Sev 'Error' } } catch { @@ -74,6 +77,7 @@ function Invoke-ExecAddGDAPRole { state = 'error' resultText = $Result }) + $StatusCode = [HttpStatusCode]::InternalServerError } } 'AddRoleSimple' { @@ -91,6 +95,7 @@ function Invoke-ExecAddGDAPRole { @{ label = 'Authentication Policy Administrator'; value = '0526716b-113d-4c15-b2c8-68e3c22b9f80' }, @{ label = 'Privileged Role Administrator'; value = 'e8611ab8-c189-46e8-94e1-60213ab1f814' }, @{ label = 'Privileged Authentication Administrator'; value = '7be44c8a-adaf-4e2a-84d6-ab2649e08a13' }, + @{ label = 'Power Platform Administrator'; value = '11648597-926c-4cf3-9c36-bcebb0ba8dcc' }, @{ label = 'Billing Administrator'; value = 'b0f54661-2d74-4c50-afa3-1ec803f12efe' }, @{ label = 'Global Reader'; value = 'f2ef992c-3afb-46b9-b7cf-a126ee74c451' }, @{ label = 'Domain Name Administrator'; value = '8329153b-31d0-4727-b945-745eb3bc5f31' } @@ -107,6 +112,7 @@ function Invoke-ExecAddGDAPRole { $Failed = @($Results | Where-Object { $_ -like 'Could not create GDAP group:*' }) if ($Failed.Count -gt 0) { $Result = "GDAP role mapping completed with errors. Created: $($Created.Count), Failed: $($Failed.Count)" + $StatusCode = Get-CippBulkStatusCode -Total @($Groups).Count -Failed $Failed.Count Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $Result -Sev 'Error' } else { $Result = "GDAP role mapping completed. Groups created/reused: $($RoleMappings.Count)" @@ -123,13 +129,14 @@ function Invoke-ExecAddGDAPRole { $Result = "Failed to add GDAP roles: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $Result -Sev 'Error' -LogData $ErrorMessage $Results = @($Result) + $StatusCode = [HttpStatusCode]::InternalServerError } } } $body = @{Results = @($Results) } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $body }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecDeleteGDAPRoleMapping.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecDeleteGDAPRoleMapping.ps1 index 2d061f3bdc..8f05fc1aae 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecDeleteGDAPRoleMapping.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecDeleteGDAPRoleMapping.ps1 @@ -21,13 +21,15 @@ Function Invoke-ExecDeleteGDAPRoleMapping { Remove-CIPPAzDataTableEntity -Force @Table -Entity $Entity $Results = [pscustomobject]@{'Results' = 'Success. GDAP relationship mapping deleted' } Write-LogMessage -headers $Headers -API $APIName -message "GDAP relationship mapping deleted for $($GroupId)" -Sev 'Info' + $StatusCode = [HttpStatusCode]::OK } catch { $Results = [pscustomobject]@{'Results' = "Failed. $($_.Exception.Message)" } + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Results }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPInvite.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPInvite.ps1 index feebb1ad05..46b969408b 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPInvite.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPInvite.ps1 @@ -15,6 +15,7 @@ function Invoke-ExecGDAPInvite { $InviteId = $Request.Body.InviteId $Reference = $Request.Body.Reference $Table = Get-CIPPTable -TableName 'GDAPInvites' + $StatusCode = [HttpStatusCode]::OK # Extract technician from headers (same logic as Write-LogMessage) if ($Headers.'x-ms-client-principal-idp' -eq 'azureStaticWebApps' -or !$Headers.'x-ms-client-principal-idp') { @@ -45,10 +46,11 @@ function Invoke-ExecGDAPInvite { try { $Step = 'Creating GDAP relationship' + $UniqueRoles = @($RoleMappings | Select-Object roleDefinitionId -Unique) $JSONBody = @{ 'displayName' = "CIPP_$((New-Guid).GUID)" 'accessDetails' = @{ - 'unifiedRoles' = @($RoleMappings | Select-Object roleDefinitionId) + 'unifiedRoles' = $UniqueRoles } 'autoExtendDuration' = $AutoExtendDuration 'duration' = 'P730D' @@ -100,13 +102,14 @@ function Invoke-ExecGDAPInvite { $Message = 'GDAP relationship invite created. Log in as a Global Admin in the new tenant to approve the invite.' } else { $Message = 'Error creating GDAP relationship request' + $StatusCode = [HttpStatusCode]::InternalServerError } Write-LogMessage -headers $Request.Headers -API $APINAME -message "Created GDAP Invite - $InviteUrl" -Sev 'Info' } } catch { $Message = 'Error creating GDAP relationship, failed at step: ' + $Step - Write-Information "GDAP ERROR: on line $($_.InvocationInfo.PositionMessage) | $(($_ | ConvertTo-Json -Compress))" + Write-Host "GDAP ERROR: $($_.InvocationInfo.PositionMessage)" if ($Step -eq 'Creating GDAP relationship' -and $_.Exception.Message -match 'The user (principal) does not have the required permissions to perform the specified action on the resource.') { $Message = 'Error creating GDAP relationship, ensure that all users have MFA enabled and enforced without exception. Please see the Microsoft Partner Security Requirements documentation for more information. https://learn.microsoft.com/en-us/partner-center/security/partner-security-requirements' @@ -115,6 +118,7 @@ function Invoke-ExecGDAPInvite { } Write-LogMessage -headers $Request.Headers -API $APINAME -tenant $env:TenantID -message $Message -Sev 'Error' -LogData (Get-CippException -Exception $_) + $StatusCode = [HttpStatusCode]::InternalServerError } $body = @{ @@ -137,6 +141,7 @@ function Invoke-ExecGDAPInvite { $Message = 'Invite updated' } else { $Message = 'Invite not found' + $StatusCode = [HttpStatusCode]::NotFound } $body = @{ Message = $Message @@ -149,6 +154,7 @@ function Invoke-ExecGDAPInvite { $Message = 'Invite deleted' } else { $Message = 'Invite not found' + $StatusCode = [HttpStatusCode]::NotFound } $body = @{ Message = $Message @@ -157,7 +163,7 @@ function Invoke-ExecGDAPInvite { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPRemoveGArole.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPRemoveGArole.ps1 index 2006c2a290..26fe336052 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPRemoveGArole.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPRemoveGArole.ps1 @@ -27,7 +27,9 @@ Function Invoke-ExecGDAPRemoveGArole { $Message = "Removed Global Administrator from $($GDAPID)" Write-LogMessage -headers $Request.Headers -API $APINAME -message $Message -Sev 'Info' + $StatusCode = [HttpStatusCode]::OK } else { + $StatusCode = [HttpStatusCode]::BadRequest if ($CheckActive.status -ne 'active') { $Message = "Relationship status is currently $($CheckActive.status), it is not possible to remove the Global Administrator role in this state." } @@ -39,13 +41,14 @@ Function Invoke-ExecGDAPRemoveGArole { $Message = "Unexpected error patching GDAP relationship: $($_.Exception.Message)" Write-Host "GDAP ERROR: $($_.Exception.Message)" Write-LogMessage -headers $Request.Headers -API $APINAME -tenant $env:TenantID -message "$($Message): $($_.Exception.Message)" -Sev 'Error' + $StatusCode = [HttpStatusCode]::InternalServerError } $body = @{ Message = $Message } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPRepairRoleMappings.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPRepairRoleMappings.ps1 index fc93ef2cd8..2e56fdcb9f 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPRepairRoleMappings.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPRepairRoleMappings.ps1 @@ -73,14 +73,16 @@ function Invoke-ExecGDAPRepairRoleMappings { $null = Test-CIPPGDAPRelationships -Headers $Headers Write-LogMessage -headers $Headers -API $APIName -message 'Repaired GDAP role mappings' -Sev 'Info' + $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-CippException -Exception $_ $Results.Add(@{ resultText = "Failed to repair GDAP role mappings: $($ErrorMessage.NormalizedError)"; state = 'error' }) Write-LogMessage -headers $Headers -API $APIName -message "Failed to repair GDAP role mappings: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = @{ Results = @($Results) } }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPRoleTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPRoleTemplate.ps1 index cbc3e88350..ec7b67dc68 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPRoleTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPRoleTemplate.ps1 @@ -13,7 +13,7 @@ function Invoke-ExecGDAPRoleTemplate { $Table = Get-CIPPTable -TableName 'GDAPRoleTemplates' - $Templates = Get-CIPPAzDataTableEntity @Table + $Templates = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'RoleTemplate'" if ($Request.Query.TemplateId) { $Template = $Templates | Where-Object -Property RowKey -EQ $Request.Query.TemplateId diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPContracts.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPContracts.ps1 index 21eaf43537..79660fd2a9 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPContracts.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPContracts.ps1 @@ -25,7 +25,7 @@ function Invoke-ListGDAPContracts { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -tenant $env:TenantID -headers $Request.Headers -message "Failed to list GDAP contracts: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage $Body = @{ Results = @(); Error = $ErrorMessage.NormalizedError } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPRelationships.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPRelationships.ps1 index 3f12e62b8b..aff983bb0e 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPRelationships.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPRelationships.ps1 @@ -36,7 +36,7 @@ function Invoke-ListGDAPRelationships { $ErrorContext = if ($Id) { "get GDAP relationship $Id" } else { 'list GDAP relationships' } Write-LogMessage -API $APIName -tenant $env:TenantID -headers $Request.Headers -message "Failed to $ErrorContext $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage $Body = @{ Results = @(); Error = $ErrorMessage.NormalizedError } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPServicePrincipals.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPServicePrincipals.ps1 index 72492f88e6..db5dacef2f 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPServicePrincipals.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPServicePrincipals.ps1 @@ -61,7 +61,7 @@ function Invoke-ListGDAPServicePrincipals { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -tenant $TenantFilter -headers $Request.Headers -message "Failed to list GDAP service principals: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage $Body = @{ Results = @(); Error = $ErrorMessage.NormalizedError } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ExecLicensePricing.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ExecLicensePricing.ps1 index 00ce81108b..9aa470a90a 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ExecLicensePricing.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ExecLicensePricing.ps1 @@ -7,7 +7,7 @@ function Invoke-ExecLicensePricing { .DESCRIPTION Manage MSP-global license price overrides used by the license optimization report. SetPrice upserts a per-SKU monthly price; RemovePrice deletes an override so the SKU falls - back to the shipped MSRP estimate. + back to the shipped MSRP estimate. BulkImport validates or applies a pricing CSV batch. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -15,25 +15,242 @@ function Invoke-ExecLicensePricing { $APIName = $Request.Params.CIPPEndpoint $Headers = $Request.Headers $Table = Get-CIPPTable -TableName 'LicensePricing' + $ResponseBody = $null - try { - # SetPrice or RemovePrice - $Action = $Request.Body.Action - if ([string]::IsNullOrWhiteSpace($Action)) { throw 'Action is required.' } + # SetPrice or RemovePrice + $Action = $Request.Body.Action + if ([string]::IsNullOrWhiteSpace($Action)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = [pscustomobject]@{ 'Results' = 'Failed to update license pricing. Action is required.' } }) + } + $SkuId = $null + $Currency = [string]$Request.Body.Currency + $RowKey = $null + if ($Action -ne 'BulkImport') { # The SKU GUID (skuId) the price applies to $SkuId = ([string]$Request.Body.skuId).ToLowerInvariant() - if ([string]::IsNullOrWhiteSpace($SkuId)) { throw 'skuId is required.' } + if ([string]::IsNullOrWhiteSpace($SkuId)) { + return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = [pscustomobject]@{ 'Results' = 'Failed to update license pricing. skuId is required.' } }) + } - # Overrides are currency-scoped: one row per (skuId, currency), so an AUD override and a - # USD override for the same SKU coexist. RowKey = "{skuId}-{currency}". + # Overrides are currency-scoped: one row per (skuId, currency). $Currency = if ($Request.Body.Currency) { [string]$Request.Body.Currency } else { 'USD' } $RowKey = '{0}-{1}' -f $SkuId, $Currency.ToLowerInvariant() + } + try { switch ($Action) { + 'BulkImport' { + $Mode = [string]$Request.Body.Mode + $Currency = [string]$Request.Body.Currency + $RawRows = $Request.Body.Rows + $Rows = @($RawRows) + $Errors = [System.Collections.Generic.List[object]]::new() + $Candidates = [System.Collections.Generic.List[object]]::new() + $Unchanged = 0 + + if ($Mode -notin @('Validate', 'Apply')) { [void]$Errors.Add([pscustomobject]@{ Row = 0; skuId = $null; Error = 'Mode must be Validate or Apply.' }) } + if ([string]::IsNullOrWhiteSpace($Currency)) { [void]$Errors.Add([pscustomobject]@{ Row = 0; skuId = $null; Error = 'Currency is required.' }) } + if ($null -eq $RawRows -or $Rows.Count -eq 0) { [void]$Errors.Add([pscustomobject]@{ Row = 0; skuId = $null; Error = 'Rows are required.' }) } + + if ($Errors.Count -eq 0) { + $Currencies = @(Get-CIPPLicensePrice -ListCurrencies -FailOnError) + $SupportedCurrency = $Currencies | Where-Object { [string]$_ -ieq $Currency } | Select-Object -First 1 + if (-not $SupportedCurrency) { + [void]$Errors.Add([pscustomobject]@{ Row = 0; skuId = $null; Error = "Currency '$Currency' is not supported." }) + } else { + $Currency = [string]$SupportedCurrency + $Resolved = @(Get-CIPPLicensePrice -Currency $Currency -IncludeUnknown -FailOnError) + $ResolvedBySku = @{} + $AmbiguousSku = @{} + foreach ($Item in $Resolved) { + $ResolvedGuid = [guid]::Empty + if (-not [guid]::TryParse(([string]$Item.skuId).Trim(), [ref]$ResolvedGuid)) { continue } + $Key = $ResolvedGuid.ToString('D').ToLowerInvariant() + if ($AmbiguousSku.ContainsKey($Key)) { continue } + if ($ResolvedBySku.ContainsKey($Key)) { + $null = $ResolvedBySku.Remove($Key) + $AmbiguousSku[$Key] = $true + } else { + $ResolvedBySku[$Key] = $Item + } + } + $Seen = @{} + + for ($Index = 0; $Index -lt $Rows.Count; $Index++) { + $Row = $Rows[$Index] + $RowNumber = $Index + 1 + $SkuIdText = if ($null -ne $Row) { [string]$Row.skuId } else { '' } + $RowErrors = [System.Collections.Generic.List[string]]::new() + if ($null -eq $Row) { + [void]$RowErrors.Add('Row is empty.') + } else { + if ([string]::IsNullOrWhiteSpace($SkuIdText)) { [void]$RowErrors.Add('skuId is required.') } + if ([string]::IsNullOrWhiteSpace([string]$Row.skuPartNumber)) { [void]$RowErrors.Add('skuPartNumber is required.') } + if ([string]::IsNullOrWhiteSpace([string]$Row.Product_Display_Name)) { [void]$RowErrors.Add('Product_Display_Name is required.') } + + $RowCurrency = [string]$Row.Currency + if ([string]::IsNullOrWhiteSpace($RowCurrency)) { + [void]$RowErrors.Add('Currency is required.') + } elseif ($RowCurrency -ine $Currency) { + [void]$RowErrors.Add("Currency must match the selected currency ($Currency).") + } + + $SkuGuid = [guid]::Empty + $SkuKey = $null + if (-not [string]::IsNullOrWhiteSpace($SkuIdText)) { + if ([guid]::TryParse($SkuIdText.Trim(), [ref]$SkuGuid)) { + $SkuKey = $SkuGuid.ToString('D').ToLowerInvariant() + if ($Seen.ContainsKey($SkuKey)) { + [void]$RowErrors.Add('Duplicate SKU and currency row.') + } else { + $Seen[$SkuKey] = $true + } + if ($AmbiguousSku.ContainsKey($SkuKey)) { + [void]$RowErrors.Add("skuId '$SkuIdText' is ambiguous in the known license list.") + } elseif (-not $ResolvedBySku.ContainsKey($SkuKey)) { + [void]$RowErrors.Add("skuId '$SkuIdText' is not in the known license list.") + } + } else { + [void]$RowErrors.Add("skuId '$SkuIdText' is not a valid GUID.") + } + } + + $HasMonthlyPrice = if ($Row -is [System.Collections.IDictionary]) { $Row.Contains('MonthlyPrice') } else { $null -ne $Row.PSObject.Properties['MonthlyPrice'] } + if (-not $HasMonthlyPrice) { [void]$RowErrors.Add('MonthlyPrice is required.') } + $RawPrice = $Row.MonthlyPrice + $PriceBlank = $null -eq $RawPrice -or [string]::IsNullOrWhiteSpace([string]$RawPrice) + $NewPrice = $null + if (-not $PriceBlank) { + $PriceText = [Convert]::ToString($RawPrice, [Globalization.CultureInfo]::InvariantCulture) + $ParsedPrice = 0.0 + if (-not [double]::TryParse($PriceText, [Globalization.NumberStyles]::Float, [Globalization.CultureInfo]::InvariantCulture, [ref]$ParsedPrice) -or [double]::IsNaN($ParsedPrice) -or [double]::IsInfinity($ParsedPrice)) { + [void]$RowErrors.Add('MonthlyPrice must be a number.') + } elseif ($ParsedPrice -lt 0) { + [void]$RowErrors.Add('MonthlyPrice cannot be negative.') + } else { + $NewPrice = $ParsedPrice + } + } + + $Current = if ($SkuKey -and $ResolvedBySku.ContainsKey($SkuKey)) { $ResolvedBySku[$SkuKey] } else { $null } + if ($Mode -eq 'Apply') { + $HasCurrentPrice = if ($Row -is [System.Collections.IDictionary]) { $Row.Contains('CurrentPrice') } else { $null -ne $Row.PSObject.Properties['CurrentPrice'] } + if (-not $HasCurrentPrice) { + [void]$RowErrors.Add('CurrentPrice is required for Apply.') + } else { + $ExpectedRaw = $Row.CurrentPrice + $ExpectedPrice = $null + $ExpectedValid = $true + if ($null -ne $ExpectedRaw -and -not [string]::IsNullOrWhiteSpace([string]$ExpectedRaw)) { + $ExpectedText = [Convert]::ToString($ExpectedRaw, [Globalization.CultureInfo]::InvariantCulture) + $ExpectedValid = [double]::TryParse($ExpectedText, [Globalization.NumberStyles]::Float, [Globalization.CultureInfo]::InvariantCulture, [ref]$ExpectedPrice) + } + if (-not $ExpectedValid -or (($null -eq $Current.MonthlyPrice) -ne ($null -eq $ExpectedPrice)) -or ($null -ne $ExpectedPrice -and $ExpectedPrice -ne [double]$Current.MonthlyPrice)) { + [void]$RowErrors.Add('CurrentPrice changed since review. Validate the import again.') + } + } + } + + if ($Current -and $RowErrors.Count -eq 0) { + if ($PriceBlank) { + if ($null -eq $Current.MonthlyPrice) { $Unchanged++ } + else { [void]$RowErrors.Add('MonthlyPrice is required for a priced license.') } + } elseif ($NewPrice -eq $Current.MonthlyPrice) { + $Unchanged++ + } else { + [void]$Candidates.Add([pscustomobject]@{ + Row = $RowNumber + skuId = $SkuKey + skuPartNumber = [string]$Current.skuPartNumber + Product_Display_Name = [string]$Current.Product_Display_Name + Currency = $Currency + CurrentPrice = $Current.MonthlyPrice + MonthlyPrice = [double]$NewPrice + }) + } + } + } + + foreach ($Message in $RowErrors) { + [void]$Errors.Add([pscustomobject]@{ Row = $RowNumber; skuId = $SkuIdText; Error = $Message }) + } + } + } + } + + if ($Errors.Count -gt 0) { + $FailedRows = @($Errors | Select-Object -ExpandProperty Row -Unique).Count + $StatusCode = [HttpStatusCode]::BadRequest + $Result = "License pricing import has $FailedRows invalid row(s). No prices were changed." + $ResponseBody = [pscustomobject]@{ + Results = $Result + Valid = $false + Updated = 0 + Unchanged = 0 + Failed = $FailedRows + Errors = @($Errors) + Changes = @() + } + } elseif ($Mode -eq 'Validate') { + $Result = "Validated $($Rows.Count) row(s): $($Candidates.Count) price change(s), $Unchanged unchanged." + $ResponseBody = [pscustomobject]@{ + Results = $Result + Valid = $true + Updated = $Candidates.Count + Unchanged = $Unchanged + Failed = 0 + Errors = @() + Changes = @($Candidates | Select-Object skuId, skuPartNumber, Product_Display_Name, Currency, CurrentPrice, MonthlyPrice) + } + Write-LogMessage -API $APIName -headers $Headers -message $Result -Sev 'Info' + } else { + $WriteErrors = [System.Collections.Generic.List[object]]::new() + $Applied = [System.Collections.Generic.List[object]]::new() + $Updated = 0 + for ($Index = 0; $Index -lt $Candidates.Count; $Index++) { + $Candidate = $Candidates[$Index] + try { + $Entity = @{ + PartitionKey = 'Price' + RowKey = '{0}-{1}' -f $Candidate.skuId, $Currency.ToLowerInvariant() + skuId = $Candidate.skuId + skuPartNumber = $Candidate.skuPartNumber + Product_Display_Name = $Candidate.Product_Display_Name + MonthlyPrice = [double]$Candidate.MonthlyPrice + Currency = $Currency + } + Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force + $Updated++ + [void]$Applied.Add([pscustomobject]@{ skuId = $Candidate.skuId; Currency = $Currency; CurrentPrice = $Candidate.CurrentPrice; MonthlyPrice = $Candidate.MonthlyPrice }) + } catch { + $WriteError = Get-CippException -Exception $_ + [void]$WriteErrors.Add([pscustomobject]@{ Row = $Candidate.Row; skuId = $Candidate.skuId; Error = $WriteError.NormalizedError }) + } + } + $WriteFailed = $WriteErrors.Count + $StatusCode = Get-CippBulkStatusCode -Total $Candidates.Count -Failed $WriteFailed + $Result = "Updated $Updated price(s), skipped $Unchanged unchanged row(s), failed $WriteFailed." + $ResponseBody = [pscustomobject]@{ + Results = $Result + Valid = $true + Updated = $Updated + Unchanged = $Unchanged + Failed = $WriteFailed + Errors = @($WriteErrors) + Changes = @() + } + $Severity = if ($WriteFailed -gt 0) { 'Error' } else { 'Info' } + Write-LogMessage -API $APIName -headers $Headers -message $Result -Sev $Severity -LogData @{ Updated = @($Applied); Errors = @($WriteErrors) } + } + } 'SetPrice' { # Monthly price per seat, in the given currency $MonthlyPrice = $Request.Body.MonthlyPrice -as [double] - if ($null -eq $MonthlyPrice) { throw 'MonthlyPrice must be a number.' } + if ($null -eq $MonthlyPrice) { + $StatusCode = [HttpStatusCode]::BadRequest + $Result = 'Failed to update license pricing. MonthlyPrice must be a number.' + break + } $Entity = @{ PartitionKey = 'Price' @@ -71,6 +288,6 @@ function Invoke-ExecLicensePricing { return ([HttpResponseContext]@{ StatusCode = $StatusCode ?? [HttpStatusCode]::OK - Body = [pscustomobject]@{ 'Results' = $Result } + Body = $ResponseBody ?? [pscustomobject]@{ 'Results' = $Result } }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListCSPLicenses.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListCSPLicenses.ps1 index 6408e039be..ab392b1cfc 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListCSPLicenses.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListCSPLicenses.ps1 @@ -17,7 +17,7 @@ function Invoke-ListCSPLicenses { $StatusCode = [HttpStatusCode]::OK } catch { $Result = 'Unable to retrieve CSP licenses, ensure that you have enabled the Sherweb integration and mapped the tenant in the integration settings.' - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return [HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicenses.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicenses.ps1 index 02831baced..90b2a2d96e 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicenses.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicenses.ps1 @@ -4,8 +4,6 @@ function Invoke-ListLicenses { Entrypoint .ROLE Tenant.Directory.Read - .DESCRIPTION - Lists Microsoft 365 license SKUs and their assigned/available counts for a tenant. For AllTenants queries, consider using ListDBCache for better performance. #> [CmdletBinding()] param($Request, $TriggerMetadata) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListOAuthApps.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListOAuthApps.ps1 index 07ee16e1bd..c1c6146c6e 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListOAuthApps.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListOAuthApps.ps1 @@ -45,7 +45,7 @@ function Invoke-ListOAuthApps { $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $StatusCode = [HttpStatusCode]::Forbidden + $StatusCode = [HttpStatusCode]::InternalServerError $GraphRequest = $ErrorMessage } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListSecureScoreReport.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListSecureScoreReport.ps1 index 24efcd9097..4748f5a174 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListSecureScoreReport.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListSecureScoreReport.ps1 @@ -21,12 +21,19 @@ function Invoke-ListSecureScoreReport { $TenantFilter = $Request.Query.tenantFilter ?? 'AllTenants' $IncludeHistory = $Request.Query.includeHistory -eq $true + # AnyTenant is set so AllTenants is reachable, which means the framework's per-tenant check is + # skipped for custom-role users. Scope the output here instead, for both paths. try { - $Results = @(Get-CIPPSecureScoreReport -TenantFilter $TenantFilter -IncludeHistory:$IncludeHistory) - - # AnyTenant is set so AllTenants is reachable, which means the framework's per-tenant check is - # skipped for custom-role users. Scope the output here instead, for both paths. $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList + } catch { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::Forbidden + Body = @{ Error = $_.Exception.Message } + }) + } + + try { + $Results = @(Get-CIPPSecureScoreReport -TenantFilter $TenantFilter -IncludeHistory:$IncludeHistory) if ($AllowedTenants -notcontains 'AllTenants') { $AllowedSet = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase) foreach ($Allowed in $AllowedTenants) { @@ -40,7 +47,7 @@ function Invoke-ListSecureScoreReport { } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -tenant $TenantFilter -message "Failed to retrieve secure score report: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError $Body = @{ Error = $ErrorMessage.NormalizedError } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListServiceHealthIssues.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListServiceHealthIssues.ps1 index 80c5a0e153..d388055c3e 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListServiceHealthIssues.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListServiceHealthIssues.ps1 @@ -5,7 +5,7 @@ function Invoke-ListServiceHealthIssues { .ROLE Tenant.Administration.Read .DESCRIPTION - Lists Microsoft 365 service health issues for a tenant: the incidents and advisories Microsoft has posted about service outages, degradations and their status, impact, affected services and timeline. For AllTenants each issue is returned once with the tenants it affects (Tenants, TenantCount). Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants. + Lists Microsoft 365 service health issues for a tenant: the incidents and advisories Microsoft has posted about service outages, degradations and their status, impact, affected services and timeline. For AllTenants each issue is returned once with the tenants it affects (Tenants, TenantCount). Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants. Pass Open=true to return only unresolved issues. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -15,6 +15,8 @@ function Invoke-ListServiceHealthIssues { $TenantFilter = $Request.Query.tenantFilter # Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants. $UseReportDB = $Request.Query.UseReportDB -eq $true + # Set to true to return only unresolved issues (open incidents and advisories). Resolved issues carry their full post history, so this keeps the dashboard payload small. + $Open = $Request.Query.Open -eq $true if ($TenantFilter -eq 'AllTenants' -or $UseReportDB) { try { @@ -29,6 +31,7 @@ function Invoke-ListServiceHealthIssues { foreach ($Row in $RowsByTenant[$Tenant]) { $Parsed = try { [CIPP.CippJson]::ConvertFromJson($Row.Data, $null) } catch { continue } foreach ($Record in @($Parsed)) { + if ($Open -and $Record.isResolved -eq $true) { continue } $Entry = $ById[$Record.id] if (-not $Entry) { $Entry = @{ Record = $Record; Tenants = [System.Collections.Generic.List[string]]::new(); Details = [System.Collections.Generic.List[object]]::new(); CacheTimestamp = $Row.Timestamp } @@ -67,7 +70,9 @@ function Invoke-ListServiceHealthIssues { } try { - $Results = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/admin/serviceAnnouncement/issues' -tenantid $TenantFilter + $Uri = 'https://graph.microsoft.com/v1.0/admin/serviceAnnouncement/issues' + if ($Open) { $Uri = "$Uri`?`$filter=isResolved eq false" } + $Results = New-GraphGetRequest -uri $Uri -tenantid $TenantFilter $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-CippException -Exception $_ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddStandardsDeploy.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddStandardsDeploy.ps1 index 605485f670..45c3d221e1 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddStandardsDeploy.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddStandardsDeploy.ps1 @@ -45,14 +45,16 @@ Function Invoke-AddStandardsDeploy { Write-LogMessage -headers $Request.Headers -tenant $tenant -API 'Standards' -message 'Successfully added standards deployment' -Sev 'Info' $body = [pscustomobject]@{'Results' = 'Successfully added standards deployment' } + $StatusCode = [HttpStatusCode]::OK } catch { Write-LogMessage -headers $Request.Headers -API 'Standards' -message "Standards API failed. Error:$($_.Exception.Message)" -Sev 'Error' $body = [pscustomobject]@{'Results' = "Failed to add standard: $($_.Exception.Message)" } + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $body }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddStandardsTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddStandardsTemplate.ps1 index 2da4a43ee3..dae9952355 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddStandardsTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddStandardsTemplate.ps1 @@ -10,10 +10,23 @@ function Invoke-AddStandardsTemplate { $APIName = $Request.Params.CIPPEndpoint $Headers = $Request.Headers + + # Clean up corrupted data - tenantFilter should be an array of tenants, not the literal string 'tenantFilter' if ($Request.Body.tenantFilter -eq 'tenantFilter') { throw 'Invalid Tenant Selection. A standard must be assigned to at least 1 tenant.' } + # Clean up excludedTenants if it contains corrupted data + if ($Request.Body.excludedTenants) { + if ($Request.Body.excludedTenants -eq 'excludedTenants') { + $Request.Body.excludedTenants = @() + } elseif ($Request.Body.excludedTenants -is [array]) { + $Request.Body.excludedTenants = @($Request.Body.excludedTenants | Where-Object { + $_ -and $_ -ne 'excludedTenants' -and $_ -ne 'tenantFilter' + }) + } + } + # tenantFilter is a *list* (and may include AllTenants or tenant groups), so this endpoint is # AnyTenant and validates the whole list here: standards runs execute app-level without # re-checking custom-role access, so this is the boundary that stops a scoped caller assigning @@ -57,11 +70,21 @@ function Invoke-AddStandardsTemplate { } $GUID = $Request.body.GUID ? $request.body.GUID : (New-Guid).GUID - #updatedBy = $request.headers.'x-ms-client-principal' - #updatedAt = (Get-Date).ToUniversalTime() + $request.body | Add-Member -NotePropertyName 'GUID' -NotePropertyValue $GUID -Force $request.body | Add-Member -NotePropertyName 'createdAt' -NotePropertyValue ($Request.body.createdAt ? $Request.body.createdAt : (Get-Date).ToUniversalTime()) -Force - $Request.body | Add-Member -NotePropertyName 'updatedBy' -NotePropertyValue ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($request.headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails -Force + + # Safely decode the user principal header + $updatedBy = 'Unknown' + try { + if ($request.headers.'x-ms-client-principal') { + $decodedPrincipal = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($request.headers.'x-ms-client-principal')) | ConvertFrom-Json + $updatedBy = $decodedPrincipal.userDetails + } + } catch { + Write-Host "Failed to decode client principal: $_" + } + $Request.body | Add-Member -NotePropertyName 'updatedBy' -NotePropertyValue $updatedBy -Force $Request.body | Add-Member -NotePropertyName 'updatedAt' -NotePropertyValue (Get-Date).ToUniversalTime() -Force # Drop standards toggled on but left with no instances (empty array) - e.g. a template standard diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-BestPracticeAnalyser_List.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-BestPracticeAnalyser_List.ps1 new file mode 100644 index 0000000000..3163f5c9ac --- /dev/null +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-BestPracticeAnalyser_List.ps1 @@ -0,0 +1,47 @@ +Function Invoke-BestPracticeAnalyser_List { + <# + .FUNCTIONALITY + Entrypoint,AnyTenant + .ROLE + Tenant.BestPracticeAnalyser.Read + #> + [CmdletBinding()] + param($Request, $TriggerMetadata) + $Tenants = Get-Tenants + $Table = get-cipptable 'cachebpa' + + # Build OData filter for allowed tenants instead of loading all data + $TenantIds = @($Tenants.customerId | Where-Object { $_ }) + if ($TenantIds.Count -gt 0) { + # Build filter: RowKey eq 'id1' or RowKey eq 'id2' ... + # OData has limits, so for large tenant counts we may need to chunk + if ($TenantIds.Count -le 50) { + $FilterParts = $TenantIds | ForEach-Object { "RowKey eq '$_'" } + $Filter = $FilterParts -join ' or ' + $Results = Get-CIPPAzDataTableEntity @Table -Filter $Filter + } else { + # For large tenant counts, fall back to full scan + filter (rare case) + $Results = Get-CIPPAzDataTableEntity @Table | Where-Object { $_.RowKey -in $TenantIds } + } + } else { + $Results = @() + } + + # Process UnusedLicenseList JSON + $Results = @($Results | ForEach-Object { + $_.UnusedLicenseList = @(ConvertFrom-Json -ErrorAction SilentlyContinue -InputObject $_.UnusedLicenseList) + $_ + }) + + if (!$Results -or $Results.Count -eq 0) { + $Results = @{ + Tenant = 'The BPA has not yet run.' + } + } + + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = @($Results) + }) + +} diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecStandardsRun.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecStandardsRun.ps1 index 3294de543f..fed55134c8 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecStandardsRun.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecStandardsRun.ps1 @@ -36,16 +36,18 @@ function Invoke-ExecStandardsRun { $RunMode = if ($RunManually) { ' (Manual Only)' } else { '' } $Results = "Successfully started Standards Run for tenant: $TenantFilter - Template: $TemplateName$RunMode" Write-LogMessage -headers $Headers -tenant $TenantFilter -API $APIName -message $Results -Sev 'Info' + $StatusCode = [HttpStatusCode]::OK } catch { $ErrorMessage = Get-CippException -Exception $_ $Results = "Failed to start standards run for tenant: $TenantFilter. Error: $($ErrorMessage.NormalizedError)" Write-LogMessage -headers $Headers -tenant $TenantFilter -API $APIName -message $Results -Sev 'Error' -LogData $ErrorMessage + $StatusCode = [HttpStatusCode]::InternalServerError } $Results = [pscustomobject]@{'Results' = "$Results" } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Results }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecUpdateDriftDeviation.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecUpdateDriftDeviation.ps1 index 49b3236cea..41f3ca8f62 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecUpdateDriftDeviation.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecUpdateDriftDeviation.ps1 @@ -56,6 +56,8 @@ function Invoke-ExecUpdateDriftDeviation { try { $TenantFilter = $Request.Body.TenantFilter + $Total = 0 + $Failed = 0 if ($Request.Body.RemoveDriftCustomization) { $Table = Get-CippTable -tablename 'tenantDrift' @@ -81,6 +83,7 @@ function Invoke-ExecUpdateDriftDeviation { if ([string]::IsNullOrWhiteSpace($Justification)) { $Justification = 'Denied and deleted from CIPP drift review' } if ($Justification.Length -gt 1024) { $Justification = $Justification.Substring(0, 1024) } $Justification = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($Justification)) + $Total = @($Deviations).Count $Results = foreach ($Deviation in $Deviations) { try { $user = $request.headers.'x-ms-client-principal' @@ -311,6 +314,7 @@ function Invoke-ExecUpdateDriftDeviation { } Write-LogMessage -tenant $TenantFilter -Headers $Request.Headers -API $APINAME -message "Updated drift deviation status for $($Deviation.standardName) to $($Deviation.status) with reason: $Reason" -Sev 'Info' } catch { + $Failed++ [PSCustomObject]@{ standardName = $Deviation.standardName success = $false @@ -324,14 +328,14 @@ function Invoke-ExecUpdateDriftDeviation { $Body = @{ Results = @($Results) } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = Get-CippBulkStatusCode -Total $Total -Failed $Failed Body = $Body }) } catch { Write-LogMessage -Headers $Request.Headers -API $APINAME -message "Failed to update drift deviation: $($_.Exception.Message)" -Sev 'Error' return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::BadRequest + StatusCode = [HttpStatusCode]::InternalServerError Body = @{error = $_.Exception.Message } }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListStandardsCompare.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListStandardsCompare.ps1 index e7486b4849..2767a8d4c5 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListStandardsCompare.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListStandardsCompare.ps1 @@ -3,7 +3,7 @@ function Invoke-ListStandardsCompare { .FUNCTIONALITY Entrypoint .ROLE - Tenant.Standards.Read + Tenant.BestPracticeAnalyser.Read .DESCRIPTION Compares current tenant configuration against applied standards, showing compliance status and drift for each standard. #> diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListTenantAlignment.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListTenantAlignment.ps1 index d74b06b336..1b2da8b5a0 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListTenantAlignment.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListTenantAlignment.ps1 @@ -6,6 +6,7 @@ function Invoke-ListTenantAlignment { Tenant.Standards.Read .DESCRIPTION Lists tenant alignment data showing how well tenants conform to their assigned standards templates. + A caller restricted to specific tenants only receives those tenants, including the summary. Pass summary=true for the estate roll-up only: per-tenant averages collapsed into score buckets, the overall average, the lowest-scoring tenants and the pending-deviation totals. @@ -22,8 +23,9 @@ function Invoke-ListTenantAlignment { # Granular flattens to one row per standard; it is a detail view and never a summary source. if ($Summary) { $Granular = $false } try { - # Use the new Get-CIPPTenantAlignment function to get alignment data - $AlignmentData = Get-CIPPTenantAlignment + # The table holds every tenant. Narrow it before the summary or the row list is built, + # so a role allowed one tenant cannot see the rest of the estate. + $AlignmentData = @(Get-CIPPTenantAlignment | Select-CippAllowedTenantData -TenantProperty 'TenantFilter') # Build a GUID -> displayName lookup from the templates table for all template types $TemplateLookup = @{} @@ -44,6 +46,8 @@ function Invoke-ListTenantAlignment { } } + $Total = 0 + $Failed = 0 $Results = if ($Granular) { # Flatten ComparisonResults into one row per tenant+standard $AlignmentData | ForEach-Object { @@ -53,6 +57,7 @@ function Invoke-ListTenantAlignment { $StandardType = $Row.standardType ? $Row.standardType : 'Classic Standard' $Row.ComparisonDetails | ForEach-Object { $Detail = $_ + $Total++ try { $StandardId = $Detail.StandardName $FriendlyType = $StandardType @@ -97,6 +102,7 @@ function Invoke-ListTenantAlignment { latestDataCollection = $Row.LatestDataCollection } } catch { + $Failed++ Write-LogMessage -API $APIName -tenant $Row.TenantFilter -message "Failed to flatten alignment row for $($Row.TenantFilter)/$($Detail.StandardName): $($_.Exception.Message)" -sev Warning } } @@ -182,7 +188,7 @@ function Invoke-ListTenantAlignment { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = Get-CippBulkStatusCode -Total $Total -Failed $Failed Body = @($Results) }) } catch { diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-listStandardTemplates.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-listStandardTemplates.ps1 index 4fd84eba12..2b0a4fd0d8 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-listStandardTemplates.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-listStandardTemplates.ps1 @@ -15,7 +15,10 @@ function Invoke-listStandardTemplates { $Filter = "PartitionKey eq 'StandardsTemplateV2'" $RepoTable = Get-CippTable -tablename 'CommunityRepos' $Repos = @(Get-CIPPAzDataTableEntity @RepoTable -Filter "PartitionKey eq 'CommunityRepos'") + $Total = 0 + $Failed = 0 $Templates = (Get-CIPPAzDataTableEntity @Table -Filter $Filter) | ForEach-Object { + $Total++ $RowKey = $_.RowKey $RowSHA = $_.SHA $RowSource = $_.Source @@ -29,6 +32,7 @@ function Invoke-listStandardTemplates { $RepairedJSON = Repair-CippStandardsTemplate -Json $JSON -Reference $RowKey } catch { Write-LogMessage -headers $Request.Headers -API 'Standards' -message "Standards template '$($RowKey)' was omitted from the response: $($_.Exception.Message)" -Sev 'Error' + $Failed++ return } $Data = $RepairedJSON | ConvertFrom-Json -Depth 100 @@ -49,6 +53,7 @@ function Invoke-listStandardTemplates { Write-LogMessage -headers $Request.Headers -API 'Standards' -message "Standards template '$($RowKey)' contained corrupt data (case-duplicate keys) and was automatically repaired and re-saved." -Sev 'Warning' } catch { Write-LogMessage -headers $Request.Headers -API 'Standards' -message "Standards template '$($RowKey)' was repaired but could not be re-saved, so it was omitted from the response: $($_.Exception.Message)" -Sev 'Error' + $Failed++ return } } @@ -135,7 +140,7 @@ function Invoke-listStandardTemplates { if ($ID) { $Templates = $Templates | Where-Object GUID -EQ $ID } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $ID ? [HttpStatusCode]::OK : (Get-CippBulkStatusCode -Total $Total -Failed $Failed) Body = @($Templates) }) diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/invoke-DomainAnalyser_List.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/invoke-DomainAnalyser_List.ps1 index cf1643dd5e..740779e92c 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/invoke-DomainAnalyser_List.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/invoke-DomainAnalyser_List.ps1 @@ -7,17 +7,16 @@ Function Invoke-DomainAnalyser_List { Entrypoint,AnyTenant .ROLE Tenant.DomainAnalyser.Read - .DESCRIPTION - Returns the cached Domain Analyser results: the DNS health of each tenant's domains, covering MX, SPF, DKIM, DMARC and DNSSEC. Populated by a scheduled job, so this reads the last run rather than resolving DNS live. tenantFilter=AllTenants returns every tenant's domains. #> [CmdletBinding()] param($Request, $TriggerMetadata) $DomainTable = Get-CIPPTable -Table 'Domains' - # Get all the things - + # Get all the things - always filter by PartitionKey for performance if ($Request.Query.tenantFilter -ne 'AllTenants') { - $DomainTable.Filter = "TenantId eq '{0}'" -f $Request.Query.tenantFilter + $DomainTable.Filter = "PartitionKey eq 'TenantDomains' and TenantId eq '{0}'" -f $Request.Query.tenantFilter + } else { + $DomainTable.Filter = "PartitionKey eq 'TenantDomains'" } try { diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-AddTestReport.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-AddTestReport.ps1 index b7bd9969cc..7adec9a89f 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-AddTestReport.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-AddTestReport.ps1 @@ -11,16 +11,23 @@ function Invoke-AddTestReport { $APIName = $TriggerMetadata.FunctionName Write-LogMessage -user $Request.Headers.'x-ms-client-principal' -API $APIName -message 'Accessed this API' -Sev 'Debug' - try { - $Body = $Request.Body + $Body = $Request.Body - # Validate required fields - if ([string]::IsNullOrEmpty($Body.name)) { - throw 'Report name is required' - } - if ($Body.name.Length -gt 256) { - throw 'Report name must be 256 characters or fewer' - } + # Validate required fields + if ([string]::IsNullOrEmpty($Body.name)) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = ConvertTo-Json -InputObject @{ Results = 'Failed to save report: Report name is required' } + }) + } + if ($Body.name.Length -gt 256) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = ConvertTo-Json -InputObject @{ Results = 'Failed to save report: Report name must be 256 characters or fewer' } + }) + } + + try { $IsUpdate = -not [string]::IsNullOrWhiteSpace([string]$Body.ReportId) $ReportTable = Get-CippTable -tablename 'CippReportTemplates' @@ -35,7 +42,10 @@ function Invoke-AddTestReport { if ($IsUpdate) { $ExistingReport = Get-CIPPAzDataTableEntity @ReportTable -Filter "PartitionKey eq 'Report' and RowKey eq '$ReportId'" if (-not $ExistingReport) { - throw 'Custom report not found' + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = ConvertTo-Json -InputObject @{ Results = 'Failed to save report: Custom report not found' } + }) } $CreatedAt = [string]($ExistingReport.CreatedAt ?? (Get-Date).ToString('o')) } @@ -69,7 +79,7 @@ function Invoke-AddTestReport { $Body = [PSCustomObject]@{ Results = "Failed to save report: $($ErrorMessage.NormalizedError)" } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-DeleteTestReport.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-DeleteTestReport.ps1 index 888c676e94..455e27191e 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-DeleteTestReport.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-DeleteTestReport.ps1 @@ -29,7 +29,7 @@ function Invoke-DeleteTestReport { $Body = [PSCustomObject]@{ Results = "Failed to delete report: $($ErrorMessage.NormalizedError)" } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ExecCustomTestRun.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ExecCustomTestRun.ps1 index 7e02d1911c..0a40322bca 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ExecCustomTestRun.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ExecCustomTestRun.ps1 @@ -37,7 +37,7 @@ function Invoke-ExecCustomTestRun { } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -tenant $TenantFilter -message "Failed to start custom test run: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError $Body = [PSCustomObject]@{ Results = "Failed to start custom test run: $($ErrorMessage.NormalizedError)" } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ExecTestRun.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ExecTestRun.ps1 index c080efaa09..ce739d6613 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ExecTestRun.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ExecTestRun.ps1 @@ -75,7 +75,7 @@ function Invoke-ExecTestRun { } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -tenant $TenantFilter -message "Failed to start data collection/test run: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError $Body = @{ Message = "Failed to start data collection/test run for $TenantFilter" } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListAvailableTests.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListAvailableTests.ps1 index 09a7f49492..6928f5d3ed 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListAvailableTests.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListAvailableTests.ps1 @@ -124,7 +124,7 @@ function Invoke-ListAvailableTests { $Body = [PSCustomObject]@{ Results = "Failed to list available tests: $($ErrorMessage.NormalizedError)" } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTestReports.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTestReports.ps1 index 1d0ac36a87..bf59c1ec10 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTestReports.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTestReports.ps1 @@ -18,7 +18,10 @@ function Invoke-ListTestReports { try { # Get reports from JSON files in test folders $ReportsRootPath = Join-Path $env:CIPPRootPath 'Modules\CIPPTests\Public\Tests' + $Total = 0 + $Failed = 0 $FileReports = [System.IO.Directory]::EnumerateFiles($ReportsRootPath, 'report.json', [System.IO.SearchOption]::AllDirectories) | ForEach-Object { + $Total++ try { $ReportContent = [System.IO.File]::ReadAllText($_) | ConvertFrom-Json $FolderName = [System.IO.Path]::GetFileName([System.IO.Path]::GetDirectoryName($_)) @@ -31,6 +34,7 @@ function Invoke-ListTestReports { type = $FolderName } } catch { + $Failed++ $CurrentFolder = [System.IO.Path]::GetFileName([System.IO.Path]::GetDirectoryName($_)) Write-LogMessage -API $APIName -message "Error reading report.json from $CurrentFolder $($_.Exception.Message)" -sev Warning } @@ -85,13 +89,13 @@ function Invoke-ListTestReports { $Reports = @($FileReports) + @($DatabaseReports) - $StatusCode = [HttpStatusCode]::OK + $StatusCode = Get-CippBulkStatusCode -Total ($Total + $DatabaseReports.Count) -Failed $Failed $Body = @($Reports) } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -message "Error retrieving test reports: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError $Body = @{ Error = $ErrorMessage.NormalizedError } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTestResultsTenants.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTestResultsTenants.ps1 index ca20281615..8ca1a549f9 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTestResultsTenants.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTestResultsTenants.ps1 @@ -76,7 +76,14 @@ function Invoke-ListTestResultsTenants { # permitted customerIds, or 'AllTenants' for unrestricted users. Passed into the query so # disallowed tenants are dropped before any counting or row building — a post-hoc filter # would leak estate size through the counts and burn time filtering rows at scale. - $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList + try { + $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList + } catch { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::Forbidden + Body = @{ Error = $_.Exception.Message } + }) + } if ($AllowedTenants -notcontains 'AllTenants') { $Params.AllowedTenantIds = @($AllowedTenants | Where-Object { $_ }) } @@ -92,7 +99,7 @@ function Invoke-ListTestResultsTenants { } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -message "Error retrieving cross-tenant test results: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError $Body = @{ Error = $ErrorMessage.NormalizedError } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTests.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTests.ps1 index 7427329e72..5405cab851 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTests.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTests.ps1 @@ -14,17 +14,20 @@ function Invoke-ListTests { $APIName = $TriggerMetadata.FunctionName - try { - $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter - $ReportId = $Request.Query.reportId ?? $Request.Body.reportId - # When true, return only the aggregated TestCounts (per-type pass/fail/etc totals) and skip - # the per-result markdown/metadata enrichment and the SecureScore/MFAState/License DB reads. - $SummaryOnly = ($Request.Query.summaryOnly -eq $true) -or ($Request.Body.summaryOnly -eq $true) - - if (-not $TenantFilter) { - throw 'TenantFilter parameter is required' - } + $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter + $ReportId = $Request.Query.reportId ?? $Request.Body.reportId + # When true, return only the aggregated TestCounts (per-type pass/fail/etc totals) and skip + # the per-result markdown/metadata enrichment and the SecureScore/MFAState/License DB reads. + $SummaryOnly = ($Request.Query.summaryOnly -eq $true) -or ($Request.Body.summaryOnly -eq $true) + + if (-not $TenantFilter) { + return ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::BadRequest + Body = @{ Error = 'TenantFilter parameter is required' } + }) + } + try { $TestResultsData = Get-CIPPTestResults -TenantFilter $TenantFilter $IdentityTotal = 0 @@ -208,6 +211,13 @@ function Invoke-ListTests { } } + # Add descriptions from cache (fast O(1) lookup) + foreach ($TestResult in $TestResultsData.TestResults) { + if ($global:CIPPTestDescriptionCache.ContainsKey($TestResult.RowKey)) { + $TestResult | Add-Member -NotePropertyName 'Description' -NotePropertyValue $global:CIPPTestDescriptionCache[$TestResult.RowKey] -Force + } + } + $TestCounts = @{ Identity = @{ Passed = @($IdentityResults | Where-Object { $_.Status -eq 'Passed' }).Count @@ -267,7 +277,7 @@ function Invoke-ListTests { } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -tenant $TenantFilter -message "Error retrieving tests: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError $Body = @{ Error = $ErrorMessage.NormalizedError } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tools/Invoke-ExecGraphExplorerPreset.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tools/Invoke-ExecGraphExplorerPreset.ps1 index c49bae8d88..eb125d57c1 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tools/Invoke-ExecGraphExplorerPreset.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tools/Invoke-ExecGraphExplorerPreset.ps1 @@ -4,8 +4,6 @@ function Invoke-ExecGraphExplorerPreset { Entrypoint .ROLE CIPP.Core.Read - .DESCRIPTION - Manages the caller's saved Graph Explorer presets. The action field selects the operation: Copy duplicates a preset, Save creates or updates one, and Delete removes one. Save and Delete modify stored data despite the Read role on this endpoint, and a caller may only modify presets they own. #> [CmdletBinding()] param($Request, $TriggerMetadata) @@ -106,7 +104,7 @@ function Invoke-ExecGraphExplorerPreset { } catch { $Success = $false $Message = $_.Exception.Message - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } if ($Action -in @('Save', 'Delete', 'Copy')) { diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-AddCustomScript.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-AddCustomScript.ps1 index 292dc54aec..a4a902ad77 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-AddCustomScript.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-AddCustomScript.ps1 @@ -1,7 +1,7 @@ function Invoke-AddCustomScript { <# .FUNCTIONALITY - Entrypoint, AnyTenant + Entrypoint .ROLE CIPP.Tests.ReadWrite #> @@ -18,6 +18,7 @@ function Invoke-AddCustomScript { if ($Action) { if ([string]::IsNullOrWhiteSpace($ScriptGuid)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'ScriptGuid is required for action operations' } @@ -25,16 +26,19 @@ function Invoke-AddCustomScript { $Filter = "PartitionKey eq 'CustomScript' and ScriptGuid eq '{0}'" -f $ScriptGuid $ExistingVersions = @(Get-CIPPAzDataTableEntity @Table -Filter $Filter) if (-not $ExistingVersions -or $ExistingVersions.Count -eq 0) { + $FailCode = [HttpStatusCode]::NotFound throw "Script with GUID '$ScriptGuid' not found" } $LatestVersion = $ExistingVersions | Sort-Object -Property Version -Descending | Select-Object -First 1 $CurrentEnabled = if ($LatestVersion.PSObject.Properties['Enabled']) { [bool]$LatestVersion.Enabled } else { $true } $CurrentAlertOnFailure = if ($LatestVersion.PSObject.Properties['AlertOnFailure']) { [bool]$LatestVersion.AlertOnFailure } else { $false } + $CurrentAlertStatuses = if ($LatestVersion.PSObject.Properties['AlertStatuses'] -and -not [string]::IsNullOrWhiteSpace($LatestVersion.AlertStatuses)) { $LatestVersion.AlertStatuses } else { '[]' } $CurrentResultMode = if ($LatestVersion.PSObject.Properties['ResultMode'] -and -not [string]::IsNullOrWhiteSpace($LatestVersion.ResultMode)) { $LatestVersion.ResultMode } else { 'Auto' } $NewEnabled = $CurrentEnabled $NewAlertOnFailure = $CurrentAlertOnFailure + $NewAlertStatuses = $CurrentAlertStatuses $NewResultMode = $CurrentResultMode switch ($Action) { @@ -46,14 +50,19 @@ function Invoke-AddCustomScript { } 'EnableAlerts' { $NewAlertOnFailure = $true + if ($NewAlertStatuses -eq '[]') { + $NewAlertStatuses = @('Failed') | ConvertTo-Json -Compress + } } 'DisableAlerts' { $NewAlertOnFailure = $false + $NewAlertStatuses = '[]' } 'SetResultMode' { $RequestedMode = $Request.Body.ResultMode $ValidResultModes = @('Auto', 'AlwaysPass', 'AlwaysInfo', 'AlwaysInvestigate') if ([string]::IsNullOrWhiteSpace($RequestedMode) -or $RequestedMode -notin $ValidResultModes) { + $FailCode = [HttpStatusCode]::BadRequest throw "ResultMode must be one of: $($ValidResultModes -join ', ')" } $NewResultMode = $RequestedMode @@ -65,6 +74,7 @@ function Invoke-AddCustomScript { RowKey = $LatestVersion.RowKey Enabled = $NewEnabled AlertOnFailure = $NewAlertOnFailure + AlertStatuses = $NewAlertStatuses ResultMode = $NewResultMode } @@ -80,6 +90,7 @@ function Invoke-AddCustomScript { elseif ($RestoreToVersion) { if ([string]::IsNullOrWhiteSpace($ScriptGuid)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'ScriptGuid is required for restore operation' } @@ -89,6 +100,7 @@ function Invoke-AddCustomScript { $TargetScript = $ExistingScripts | Where-Object { $_.Version -eq $RestoreToVersion } if (-not $TargetScript) { + $FailCode = [HttpStatusCode]::NotFound throw "Version $RestoreToVersion not found for script GUID '$ScriptGuid'" } @@ -115,7 +127,7 @@ function Invoke-AddCustomScript { $UserImpact = $Request.Body.UserImpact $Enabled = $Request.Body.Enabled $AlertOnFailure = $Request.Body.AlertOnFailure - $AlertStatuses = $Request.Body.AlertStatuses + $AlertStatuses = if ($Request.Body.AlertStatuses) { $Request.Body.AlertStatuses | ConvertTo-Json -Compress } else { '[]' } $ReturnType = $Request.Body.ReturnType $MarkdownTemplate = $Request.Body.MarkdownTemplate $ResultSchema = $Request.Body.ResultSchema @@ -130,46 +142,56 @@ function Invoke-AddCustomScript { } if ([string]::IsNullOrWhiteSpace($ScriptName)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'ScriptName is required' } if ([string]::IsNullOrWhiteSpace($Pillar)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'Pillar is required' } if ([string]::IsNullOrWhiteSpace($UserImpact)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'UserImpact is required' } if ([string]::IsNullOrWhiteSpace($ImplementationEffort)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'ImplementationEffort is required' } $ValidReturnTypes = @('JSON', 'Markdown') if ($ReturnType -notin $ValidReturnTypes) { + $FailCode = [HttpStatusCode]::BadRequest throw "ReturnType must be one of: $($ValidReturnTypes -join ', ')" } $ValidResultModes = @('Auto', 'AlwaysPass', 'AlwaysInfo', 'AlwaysInvestigate') if ($ResultMode -notin $ValidResultModes) { + $FailCode = [HttpStatusCode]::BadRequest throw "ResultMode must be one of: $($ValidResultModes -join ', ')" } $ValidPillars = @('Identity', 'Devices', 'Data') if ($Pillar -notin $ValidPillars) { + $FailCode = [HttpStatusCode]::BadRequest throw "Pillar must be one of: $($ValidPillars -join ', ')" } $ValidImpactAndEffort = @('Low', 'Medium', 'High') if ($UserImpact -notin $ValidImpactAndEffort) { + $FailCode = [HttpStatusCode]::BadRequest throw "UserImpact must be one of: $($ValidImpactAndEffort -join ', ')" } if ($ImplementationEffort -notin $ValidImpactAndEffort) { + $FailCode = [HttpStatusCode]::BadRequest throw "ImplementationEffort must be one of: $($ValidImpactAndEffort -join ', ')" } if ($ScriptName -notmatch '^[a-zA-Z0-9\s\-_]+$') { + $FailCode = [HttpStatusCode]::BadRequest throw 'ScriptName can only contain letters, numbers, spaces, hyphens, and underscores. Spaces are allowed but may affect command-line usage.' } @@ -179,6 +201,7 @@ function Invoke-AddCustomScript { $Filter = "PartitionKey eq 'CustomScript' and ScriptGuid eq '{0}'" -f $ScriptGuid $ExistingVersions = Get-CIPPAzDataTableEntity @Table -Filter $Filter if (-not $ExistingVersions) { + $FailCode = [HttpStatusCode]::NotFound throw "Script with GUID '$ScriptGuid' not found" } @@ -198,6 +221,7 @@ function Invoke-AddCustomScript { } if ([string]::IsNullOrWhiteSpace($ScriptContent)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'ScriptContent is required' } @@ -205,7 +229,7 @@ function Invoke-AddCustomScript { $ResultSchema = '' } - Test-CustomScriptSecurity -ScriptContent $ScriptContent + try { Test-CustomScriptSecurity -ScriptContent $ScriptContent } catch { $FailCode = [HttpStatusCode]::BadRequest; throw } $RowKey = '{0}-v{1}' -f $ScriptGuid, $Version $Entity = @{ @@ -246,7 +270,7 @@ function Invoke-AddCustomScript { } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -headers $Headers -message "Failed to create custom script: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = $FailCode ?? [HttpStatusCode]::InternalServerError $Body = @{ Error = $ErrorMessage.NormalizedError } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-ExecCustomScript.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-ExecCustomScript.ps1 index edc4d0b130..119614b43b 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-ExecCustomScript.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-ExecCustomScript.ps1 @@ -16,10 +16,12 @@ function Invoke-ExecCustomScript { $Parameters = $Request.Body.Parameters ?? @{} if ([string]::IsNullOrWhiteSpace($ScriptGuid)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'ScriptGuid is required' } if ([string]::IsNullOrWhiteSpace($TenantFilter)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'TenantFilter is required' } @@ -53,7 +55,7 @@ function Invoke-ExecCustomScript { } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -tenant $TenantFilter -user $Request.Headers.'x-ms-client-principal-name' -message "Failed to execute custom script: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = $FailCode ?? (Get-CippErrorStatusCode -ErrorRecord $_) $Body = @{ Error = $ErrorMessage.NormalizedError Tenant = $TenantFilter diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-ListCustomScripts.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-ListCustomScripts.ps1 index ef80a2a72f..d9ea938ecb 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-ListCustomScripts.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-ListCustomScripts.ps1 @@ -49,7 +49,7 @@ function Invoke-ListCustomScripts { } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -headers $Headers -message "Failed to list custom scripts: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError $Body = @{ Error = $ErrorMessage.NormalizedError } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-RemoveCustomScript.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-RemoveCustomScript.ps1 index c64b1b10d3..844cf77132 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-RemoveCustomScript.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-RemoveCustomScript.ps1 @@ -15,6 +15,7 @@ function Invoke-RemoveCustomScript { $ScriptGuid = $Request.Query.ScriptGuid ?? $Request.Body.ScriptGuid if ([string]::IsNullOrWhiteSpace($ScriptGuid)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'ScriptGuid is required' } @@ -25,6 +26,7 @@ function Invoke-RemoveCustomScript { $Scripts = Get-CIPPAzDataTableEntity @Table -Filter $Filter if (-not $Scripts) { + $FailCode = [HttpStatusCode]::NotFound throw "Script with GUID '$ScriptGuid' not found" } @@ -85,7 +87,7 @@ function Invoke-RemoveCustomScript { } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API $APIName -headers $Headers -message "Failed to remove custom script: $($ErrorMessage.NormalizedError)" -sev 'Error' -LogData $ErrorMessage - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = $FailCode ?? [HttpStatusCode]::InternalServerError $Body = @{ Error = $ErrorMessage.NormalizedError } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ExecCommunityRepo.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ExecCommunityRepo.ps1 index 9555b800f2..18201ddcf9 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ExecCommunityRepo.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ExecCommunityRepo.ps1 @@ -140,7 +140,12 @@ function Invoke-ExecCommunityRepo { } 'UploadTemplate' { $Branch = $RepoEntity.UploadBranch ?? $RepoEntity.DefaultBranch - $Results = Push-CIPPTemplateToRepo -GUID $Request.Body.GUID -FullName $Request.Body.FullName -Message $Request.Body.Message -Branch $Branch + try { + $Results = Push-CIPPTemplateToRepo -GUID $Request.Body.GUID -FullName $Request.Body.FullName -Message $Request.Body.Message -Branch $Branch + } catch { + $StatusCode = Get-CippErrorStatusCode -ErrorRecord $_ + $Results = @{ resultText = $_.Exception.Message; state = 'error' } + } } 'UploadBaseline' { # A baseline is not a templates-table row: Export-CIPPBaselineTemplate @@ -149,7 +154,12 @@ function Invoke-ExecCommunityRepo { # their current members). Related templates are separate files, exactly the # shape UploadTemplate writes, so they import through the untouched path. $Branch = $RepoEntity.UploadBranch ?? $RepoEntity.DefaultBranch - $Results = Push-CIPPBaselineToRepo -GUID $Request.Body.GUID -FullName $Request.Body.FullName -Message $Request.Body.Message -Branch $Branch + try { + $Results = Push-CIPPBaselineToRepo -GUID $Request.Body.GUID -FullName $Request.Body.FullName -Message $Request.Body.Message -Branch $Branch + } catch { + $StatusCode = Get-CippErrorStatusCode -ErrorRecord $_ + $Results = @{ resultText = $_.Exception.Message; state = 'error' } + } } 'SetBranch' { if (!$RepoEntity) { diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ExecGitHubAction.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ExecGitHubAction.ps1 index 7ee5c0d77f..8f4584f315 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ExecGitHubAction.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ExecGitHubAction.ps1 @@ -25,6 +25,7 @@ function Invoke-ExecGitHubAction { $SplatParams = $Parameters | Select-Object -ExcludeProperty Action, TenantFilter | ConvertTo-Json | ConvertFrom-Json -AsHashtable + $StatusCode = [HttpStatusCode]::OK switch ($Action) { 'Search' { $SearchResults = Search-GitHub @SplatParams @@ -42,6 +43,7 @@ function Invoke-ExecGitHubAction { $Orgs = Invoke-GitHubApiRequest -Path 'user/orgs' $Results = @($Orgs) } catch { + $StatusCode = [HttpStatusCode]::InternalServerError $Results = @{ resultText = 'You may not have permission to view organizations, check your PAT scopes and try again - {0}' -f $_.Exception.Message state = 'error' @@ -58,6 +60,7 @@ function Invoke-ExecGitHubAction { $ResultText = if ($Results -is [string]) { $Results } elseif ($Results.resultText) { $Results.resultText } else { 'Template imported' } Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $ResultText -Sev 'Info' } catch { + $StatusCode = [HttpStatusCode]::InternalServerError $ErrorMessage = Get-CippException -Exception $_ $Results = @{ resultText = "Error importing template: $($ErrorMessage.NormalizedError)" @@ -95,6 +98,7 @@ function Invoke-ExecGitHubAction { } } catch { Write-Information (Get-CippException -Exception $_ | ConvertTo-Json) + $StatusCode = [HttpStatusCode]::InternalServerError $Results = @{ resultText = 'You may not have permission to create repositories, check your PAT scopes and try again - {0}' -f $_.Exception.Message state = 'error' @@ -103,6 +107,7 @@ function Invoke-ExecGitHubAction { } } default { + $StatusCode = [HttpStatusCode]::BadRequest $Results = @{ resultText = "Unknown action '$Action'" state = 'error' @@ -118,7 +123,7 @@ function Invoke-ExecGitHubAction { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepoTemplates.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepoTemplates.ps1 index a9fecda7b4..0d0fde9904 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepoTemplates.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepoTemplates.ps1 @@ -21,7 +21,9 @@ function Invoke-ListCommunityRepoTemplates { if (!$Branch) { $Branch = 'main' } $File = Get-GitHubFileContents -FullName $Request.Query.FullName -Path $Request.Query.Path -Branch $Branch $Body = @{ Results = $File } + $StatusCode = [HttpStatusCode]::OK } catch { + $StatusCode = [HttpStatusCode]::InternalServerError $Body = @{ Results = @(@{ resultText = "Unable to retrieve file contents: $($_.Exception.Message)" @@ -30,7 +32,7 @@ function Invoke-ListCommunityRepoTemplates { } } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = $StatusCode Body = $Body }) } @@ -101,6 +103,7 @@ function Invoke-ListCommunityRepoTemplates { $CatalogItems = [System.Collections.Generic.List[object]]::new() $RepoMetadata = [System.Collections.Generic.List[object]]::new() + $Failed = 0 foreach ($Repo in $Repos) { $Branch = $Repo.DefaultBranch if ([string]::IsNullOrEmpty($Branch)) { $Branch = 'main' } @@ -188,6 +191,7 @@ function Invoke-ListCommunityRepoTemplates { }) } } catch { + $Failed++ $Warnings.Add("Unable to list templates for $($Repo.FullName): $($_.Exception.Message)") } } @@ -201,7 +205,7 @@ function Invoke-ListCommunityRepoTemplates { } return ([HttpResponseContext]@{ - StatusCode = [HttpStatusCode]::OK + StatusCode = Get-CippBulkStatusCode -Total @($Repos).Count -Failed $Failed Body = $Body }) } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepos.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepos.ps1 index 0284a2c8a7..5061d698ae 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepos.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepos.ps1 @@ -17,7 +17,7 @@ function Invoke-ListCommunityRepos { if ($Request.Query.WriteAccess -eq $true) { $Filter = "PartitionKey eq 'CommunityRepos' and WriteAccess eq true" } else { - $Filter = '' + $Filter = "PartitionKey eq 'CommunityRepos'" } $Repos = Get-CIPPAzDataTableEntity @Table -Filter $Filter @@ -26,11 +26,9 @@ function Invoke-ListCommunityRepos { $CommunityRepos = Join-Path $env:CIPPRootPath 'Config\CommunityRepos.json' $DefaultCommunityRepos = [System.IO.File]::ReadAllText($CommunityRepos) | ConvertFrom-Json - $DefaultsChanged = $false + $DefaultsMissing = $false foreach ($Repo in $DefaultCommunityRepos) { - $TemplateTypesJson = [string](ConvertTo-Json -InputObject @($Repo.TemplateTypes) -Compress) - $Existing = $Repos | Where-Object { $_.URL -eq $Repo.URL } | Select-Object -First 1 - if (!$Existing) { + if ($Repos.Url -notcontains $Repo.Url -or $Repos.Buitin -notcontains $Repo.BuiltIn) { $Entity = [PSCustomObject]@{ PartitionKey = 'CommunityRepos' RowKey = $Repo.Id @@ -44,7 +42,6 @@ function Invoke-ListCommunityRepos { WriteAccess = $Repo.WriteAccess DefaultBranch = $Repo.DefaultBranch UploadBranch = $Repo.DefaultBranch - TemplateTypes = $TemplateTypesJson Permissions = [string]($Repo.RepoPermissions | ConvertTo-Json -ErrorAction SilentlyContinue -Compress) } Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force @@ -61,8 +58,8 @@ function Invoke-ListCommunityRepos { $DefaultsChanged = $true } } - if ($DefaultsChanged) { - $Repos = Get-CIPPAzDataTableEntity @Table + if ($DefaultsMissing) { + $Repos = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'CommunityRepos'" } } @@ -79,7 +76,6 @@ function Invoke-ListCommunityRepos { WriteAccess = $_.WriteAccess DefaultBranch = $_.DefaultBranch UploadBranch = $_.UploadBranch ?? $_.DefaultBranch - TemplateTypes = @(($_.TemplateTypes | ConvertFrom-Json -ErrorAction SilentlyContinue) ?? @()) RepoPermissions = ($_.Permissions | ConvertFrom-Json -ErrorAction SilentlyContinue) ?? @{} } } diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListGitHubReleaseNotes.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListGitHubReleaseNotes.ps1 index 992a798ecf..ad9a21118d 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListGitHubReleaseNotes.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListGitHubReleaseNotes.ps1 @@ -3,9 +3,8 @@ .SYNOPSIS Retrieves release notes for a GitHub repository. .DESCRIPTION - Returns release metadata for the provided repository. Results are cached and refreshed - when the cache has no entry for the running version - hotfix releases (e.g. v8.5.2) - publish their own notes, so a v8.5.0 entry no longer counts as current. + Returns release metadata for the provided repository and semantic version. Hotfix + versions (e.g. v8.5.2) map back to the base release tag (v8.5.0). .FUNCTIONALITY Entrypoint,AnyTenant .ROLE @@ -14,7 +13,7 @@ [CmdletBinding()] param($Request, $TriggerMetadata) - $Owner = 'CyberDrain' + $Owner = 'KelvinTegelaar' $Repository = 'CIPP' if (-not $Owner) { @@ -35,20 +34,26 @@ try { $Latest = $false if ($Rows) { - $CachedRow = $Rows | Select-Object -First 1 - $Releases = ConvertFrom-Json -InputObject $CachedRow.GitHubReleases -Depth 10 - $CurrentTag = 'v{0}' -f (($env:CippVersion ?? $env:APP_VERSION) -replace '^v', '') + $Releases = ConvertFrom-Json -InputObject $Rows.GitHubReleases -Depth 10 + $CurrentVersion = [semver]($env:CippVersion ?? $env:APP_VERSION) + $CurrentMajorMinor = "$($CurrentVersion.Major).$($CurrentVersion.Minor)" - # Hotfixes publish their own release, so the cache is only current when it holds an - # entry for the exact running version. Matching on major.minor kept serving v10.8.0's - # notes to a v10.8.2 build forever, because the .0 release is always in the cache. - $HasCurrentRelease = $null -ne ($Releases | Where-Object { $_.releaseTag -eq $CurrentTag } | Select-Object -First 1) + foreach ($Release in $Releases) { + $Version = $Release.releaseTag -replace 'v', '' + try { + $ReleaseVersion = [semver]$Version + $ReleaseMajorMinor = "$($ReleaseVersion.Major).$($ReleaseVersion.Minor)" - # Versions with no release of their own (nightly, local, or a bump that lands before - # the tag is published) would otherwise refetch on every page load, so they fall back - # to a 15 minute floor instead of hammering the GitHub API. - $MaxAge = $HasCurrentRelease ? (Get-Date).AddHours(-24) : (Get-Date).AddMinutes(-15) - $Latest = $CachedRow.Timestamp -gt $MaxAge + # Check if we have cached notes for the current major.minor version series + if ($ReleaseMajorMinor -eq $CurrentMajorMinor) { + $Latest = $true + break + } + } catch { + # Skip invalid semver versions + continue + } + } } if (-not $Latest) { @@ -74,13 +79,8 @@ } } catch { - # A failed refresh shouldn't 500 the dialog when we still hold a cached catalog - serve - # stale releases and let the log carry the reason the refresh failed. - if (-not $Releases) { - $ErrorMessage = "Failed to retrieve release information: $($_)" - throw $ErrorMessage - } - Write-LogMessage -API 'GitHub' -tenant 'CIPP' -Sev 'Warning' -message "Failed to refresh GitHub release notes, serving cached releases instead. Error: $($_.Exception.Message)" + $ErrorMessage = "Failed to retrieve release information: $($_)" + throw $ErrorMessage } if (-not $Releases) { diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecGenerateReportBuilderReport.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecGenerateReportBuilderReport.ps1 index 858ab00a5c..3c8086c3b1 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecGenerateReportBuilderReport.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecGenerateReportBuilderReport.ps1 @@ -17,6 +17,7 @@ function Invoke-ExecGenerateReportBuilderReport { if ($Action -eq 'delete') { if ([string]::IsNullOrEmpty($Body.ReportGUID)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'ReportGUID is required for deletion' } $ReportTable = Get-CippTable -tablename 'ReportBuilderReports' @@ -33,13 +34,14 @@ function Invoke-ExecGenerateReportBuilderReport { } else { $Result = @{ Results = 'Report not found' } } - $StatusCode = [HttpStatusCode]::OK + $StatusCode = $ExistingEntity ? [HttpStatusCode]::OK : [HttpStatusCode]::NotFound } else { $TenantFilter = $Body.TenantFilter ?? $Request.Query.TenantFilter $TemplateName = $Body.TemplateName ?? $Request.Query.TemplateName if ([string]::IsNullOrEmpty($TenantFilter)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'TenantFilter is required' } @@ -72,7 +74,7 @@ function Invoke-ExecGenerateReportBuilderReport { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -headers $Headers -API $APIName -message "Report generation error: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage $Result = @{ Results = "Error: $($ErrorMessage.NormalizedError)" } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = $FailCode ?? [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecReportBuilderTemplate.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecReportBuilderTemplate.ps1 index d26a7170c9..20d88ee46f 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecReportBuilderTemplate.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecReportBuilderTemplate.ps1 @@ -20,22 +20,18 @@ function Invoke-ExecReportBuilderTemplate { switch ($Action) { 'save' { if ([string]::IsNullOrEmpty($Body.Name)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'Template name is required' } if ($Body.Name.Length -gt 256) { + $FailCode = [HttpStatusCode]::BadRequest throw 'Template name must be 256 characters or fewer' } $GUID = if ($Body.GUID) { $Body.GUID } else { (New-Guid).GUID } - # Settings carries page setup for the template — page size, orientation, and which - # branding preset to render against. Stored as given: it is the browser that renders - # the PDF. Templates saved before cover/footer/watermark overrides were removed may - # still carry those keys; the renderer ignores them, so they are neither stripped - # here nor honoured. $JSON = ConvertTo-Json -InputObject @{ Name = $Body.Name Blocks = @($Body.Blocks) - Settings = $Body.Settings GUID = $GUID CreatedAt = (Get-Date).ToString('o') } -Depth 20 -Compress @@ -56,6 +52,7 @@ function Invoke-ExecReportBuilderTemplate { } 'delete' { if ([string]::IsNullOrEmpty($Body.GUID)) { + $FailCode = [HttpStatusCode]::BadRequest throw 'Template GUID is required for deletion' } @@ -65,10 +62,12 @@ function Invoke-ExecReportBuilderTemplate { Write-LogMessage -headers $Headers -API $APIName -message "Deleted report builder template '$($Body.GUID)'" -Sev 'Info' $Result = @{ Results = 'Successfully deleted report builder template' } } else { + $FailCode = [HttpStatusCode]::NotFound throw 'Template not found' } } default { + $FailCode = [HttpStatusCode]::BadRequest throw "Unknown action: $Action" } } @@ -78,7 +77,7 @@ function Invoke-ExecReportBuilderTemplate { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -headers $Headers -API $APIName -message "Report builder template error: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage $Result = @{ Results = "Error: $($ErrorMessage.NormalizedError)" } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = $FailCode ?? [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListBrandingPresets.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListBrandingPresets.ps1 index f0e671e41d..52ce02c72e 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListBrandingPresets.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListBrandingPresets.ps1 @@ -29,7 +29,7 @@ function Invoke-ListBrandingPresets { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -headers $Request.Headers -API $APIName -message "Failed to list branding presets: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage $Body = @{ Results = "Error: $($ErrorMessage.NormalizedError)" } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListGeneratedReports.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListGeneratedReports.ps1 index a49f2bb4d9..51124b9621 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListGeneratedReports.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListGeneratedReports.ps1 @@ -21,7 +21,7 @@ function Invoke-ListGeneratedReports { if ($ReportGUID) { # Fetch specific report - $ReportGUID = ConvertTo-CIPPODataFilterValue -Value $ReportGUID -Type 'Guid' + $ReportGUID = try { ConvertTo-CIPPODataFilterValue -Value $ReportGUID -Type 'Guid' } catch { $FailCode = [HttpStatusCode]::BadRequest; throw } $Filter = "RowKey eq '$ReportGUID'" $Entities = @(Get-CIPPAzDataTableEntity @Table -Filter $Filter) } elseif ($TenantFilter) { @@ -85,7 +85,7 @@ function Invoke-ListGeneratedReports { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -user $Request.Headers.'x-ms-client-principal' -API $APIName -message "Failed to list generated reports: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage $Body = @{ Results = "Error: $($ErrorMessage.NormalizedError)" } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = $FailCode ?? [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListReportBuilderTemplates.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListReportBuilderTemplates.ps1 index ae8955edce..a163c9882b 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListReportBuilderTemplates.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListReportBuilderTemplates.ps1 @@ -50,7 +50,7 @@ function Invoke-ListReportBuilderTemplates { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -user $Request.Headers.'x-ms-client-principal' -API $APIName -message "Failed to list report builder templates: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage $Body = @{ Results = "Error: $($ErrorMessage.NormalizedError)" } - $StatusCode = [HttpStatusCode]::BadRequest + $StatusCode = [HttpStatusCode]::InternalServerError } return ([HttpResponseContext]@{ diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1 index 9e09ff3428..001a837b19 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1 @@ -37,7 +37,7 @@ function Invoke-CIPPStandardAddDKIM { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDMARCToMOERA.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDMARCToMOERA.ps1 index 9503a9e903..9d8bfc6e78 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDMARCToMOERA.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDMARCToMOERA.ps1 @@ -34,7 +34,7 @@ function Invoke-CIPPStandardAddDMARCToMOERA { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1 index 9db1c34f31..9ca9fa4a9f 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1 @@ -77,7 +77,7 @@ function Invoke-CIPPStandardAntiPhishPolicy { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiSpamSafeList.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiSpamSafeList.ps1 index 9e3a71884d..687849fd55 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiSpamSafeList.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiSpamSafeList.ps1 @@ -34,7 +34,7 @@ function Invoke-CIPPStandardAntiSpamSafeList { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAssignmentFilterTemplate.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAssignmentFilterTemplate.ps1 index 4e63aaaa7d..79dbf12041 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAssignmentFilterTemplate.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAssignmentFilterTemplate.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardAssignmentFilterTemplate { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1 index 4f45ebba2f..ee5d240382 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1 @@ -36,7 +36,7 @@ function Invoke-CIPPStandardAtpPolicyForO365 { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -46,13 +46,6 @@ function Invoke-CIPPStandardAtpPolicyForO365 { if ($TestResult -eq $false) { return $true } #we're done. - - $MDOTestResult = Test-CIPPStandardLicense -StandardName 'AtpPolicyForO365' -TenantFilter $Tenant -Preset DefenderForOffice365 - - if ($MDOTestResult -eq $false) { - return $true - } #tenant lacks Microsoft Defender for Office 365 — Test-CIPPStandardLicense logs and sets LicenseAvailable=false. - try { $CurrentState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-AtpPolicyForO365' | Select-Object EnableATPForSPOTeamsODB, EnableSafeDocs, AllowSafeDocsOpen diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuditLog.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuditLog.ps1 index ab3781aa66..e1b3b8efe5 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuditLog.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuditLog.ps1 @@ -39,7 +39,7 @@ function Invoke-CIPPStandardAuditLog { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoAddProxy.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoAddProxy.ps1 index a85aec4a19..4f6c21e74d 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoAddProxy.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoAddProxy.ps1 @@ -28,7 +28,7 @@ function Invoke-CIPPStandardAutoAddProxy { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param( $Tenant, @@ -66,13 +66,13 @@ function Invoke-CIPPStandardAutoAddProxy { $MissingProxies = 0 foreach ($Domain in $Domains) { $ProcessMailboxes = @($AllMailboxes | Where-Object { - $AllAddresses = @($_.primarySmtpAddress) - if (-not [string]::IsNullOrWhiteSpace($_.AdditionalEmailAddresses)) { - $AllAddresses += @($_.AdditionalEmailAddresses -split ',\s*') - } - $HasDomain = $AllAddresses | Where-Object { $_ -like "*@$Domain" } - -not $HasDomain - }) + $AllAddresses = @($_.primarySmtpAddress) + if (-not [string]::IsNullOrWhiteSpace($_.AdditionalEmailAddresses)) { + $AllAddresses += @($_.AdditionalEmailAddresses -split ',\s*') + } + $HasDomain = $AllAddresses | Where-Object { $_ -like "*@$Domain" } + -not $HasDomain + }) $MissingProxies += $ProcessMailboxes.Count } @@ -103,13 +103,13 @@ function Invoke-CIPPStandardAutoAddProxy { } else { foreach ($Domain in $Domains) { $ProcessMailboxes = @($AllMailboxes | Where-Object { - $AllAddresses = @($_.primarySmtpAddress) - if (-not [string]::IsNullOrWhiteSpace($_.AdditionalEmailAddresses)) { - $AllAddresses += @($_.AdditionalEmailAddresses -split ',\s*') - } - $HasDomain = $AllAddresses | Where-Object { $_ -like "*@$Domain" } - -not $HasDomain - }) + $AllAddresses = @($_.primarySmtpAddress) + if (-not [string]::IsNullOrWhiteSpace($_.AdditionalEmailAddresses)) { + $AllAddresses += @($_.AdditionalEmailAddresses -split ',\s*') + } + $HasDomain = $AllAddresses | Where-Object { $_ -like "*@$Domain" } + -not $HasDomain + }) $bulkRequest = foreach ($Mailbox in $ProcessMailboxes) { if ([string]::IsNullOrWhiteSpace($Mailbox.UPN)) { continue } diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoArchive.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoArchive.ps1 index 1710f014c4..fc9a42bf98 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoArchive.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoArchive.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardAutoArchive { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoArchiveMailbox.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoArchiveMailbox.ps1 index 5feec15465..59be87defd 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoArchiveMailbox.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoArchiveMailbox.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardAutoArchiveMailbox { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoExpandArchive.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoExpandArchive.ps1 index 7ecb1416b5..698270463d 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoExpandArchive.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoExpandArchive.ps1 @@ -32,7 +32,7 @@ function Invoke-CIPPStandardAutoExpandArchive { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutomaticUserConsent.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutomaticUserConsent.ps1 new file mode 100644 index 0000000000..689ff93689 --- /dev/null +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutomaticUserConsent.ps1 @@ -0,0 +1,117 @@ +function Invoke-CIPPStandardAutomaticUserConsent { + <# + .FUNCTIONALITY + Internal + .COMPONENT + (APIName) AutomaticUserConsent + .SYNOPSIS + (Label) Sets automatic invitation redemption for cross-tenant access + .DESCRIPTION + (Helptext) Controls whether users automatically redeem invitations when accessing external organizations or when external users access your resources. When enabled, users don't see a consent prompt for first-time access. + (DocsDescription) Controls the automatic user consent settings in the cross-tenant access policy defaults. Inbound automatic consent means external users will automatically redeem invitations without a consent prompt. Outbound automatic consent means your users will automatically redeem invitations from other organizations. This is commonly used to streamline B2B collaboration and B2B Direct Connect experiences. + .NOTES + CAT + Entra (AAD) Standards + TAG + EXECUTIVETEXT + Controls automatic invitation redemption for cross-tenant collaboration. Enabling automatic consent provides a smoother experience for B2B collaborators by removing the manual invitation acceptance step, while disabling it ensures users explicitly agree before accessing external resources. + ADDEDCOMPONENT + {"type":"autoComplete","multiple":false,"creatable":false,"label":"Inbound automatic redemption","name":"standards.AutomaticUserConsent.inboundAllowed","options":[{"label":"Enabled","value":"true"},{"label":"Disabled","value":"false"}]} + {"type":"autoComplete","multiple":false,"creatable":false,"label":"Outbound automatic redemption","name":"standards.AutomaticUserConsent.outboundAllowed","options":[{"label":"Enabled","value":"true"},{"label":"Disabled","value":"false"}]} + IMPACT + Low Impact + ADDEDDATE + 2026-02-13 + POWERSHELLEQUIVALENT + Update-MgPolicyCrossTenantAccessPolicyDefault + RECOMMENDEDBY + UPDATECOMMENTBLOCK + Run the Tools\Update-StandardsComments.ps1 script to update this comment block + .LINK + https://docs.cipp.app/user-documentation/tenant/standards/list-standards + #> + + param($Tenant, $Settings) + + try { + $CurrentPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default?$select=automaticUserConsentSettings' -tenantid $Tenant + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get AutomaticUserConsent state for $Tenant. Error: $ErrorMessage" -Sev Error + return + } + + # Parse inbound setting + $inboundState = $Settings.inboundAllowed.value ?? $Settings.inboundAllowed + $WantedInbound = if ($inboundState -eq 'true') { $true } else { $false } + + # Parse outbound setting + $outboundState = $Settings.outboundAllowed.value ?? $Settings.outboundAllowed + $WantedOutbound = if ($outboundState -eq 'true') { $true } else { $false } + + # Validate at least one setting is provided + if (([string]::IsNullOrWhiteSpace($inboundState) -and [string]::IsNullOrWhiteSpace($outboundState)) -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'AutomaticUserConsent: No valid parameters set' -sev Error + return + } + + $CurrentInbound = $CurrentPolicy.automaticUserConsentSettings.inboundAllowed + $CurrentOutbound = $CurrentPolicy.automaticUserConsentSettings.outboundAllowed + + $InboundCorrect = [string]::IsNullOrWhiteSpace($inboundState) -or ($CurrentInbound -eq $WantedInbound) + $OutboundCorrect = [string]::IsNullOrWhiteSpace($outboundState) -or ($CurrentOutbound -eq $WantedOutbound) + $StateIsCorrect = $InboundCorrect -and $OutboundCorrect + + if ($Settings.remediate -eq $true) { + if ($StateIsCorrect) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Automatic user consent settings are already correct.' -sev Info + } else { + try { + $PatchBody = @{ + automaticUserConsentSettings = @{} + } + if (-not [string]::IsNullOrWhiteSpace($inboundState)) { + $PatchBody.automaticUserConsentSettings.inboundAllowed = $WantedInbound + } + if (-not [string]::IsNullOrWhiteSpace($outboundState)) { + $PatchBody.automaticUserConsentSettings.outboundAllowed = $WantedOutbound + } + $Body = ConvertTo-Json -Depth 10 -InputObject $PatchBody -Compress + $null = New-GraphPostRequest -tenantid $Tenant -Uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default' -Type PATCH -Body $Body -ContentType 'application/json' + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Set automatic user consent settings.' -sev Info + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to set automatic user consent settings. Error: $ErrorMessage" -sev Error + } + } + } + + if ($Settings.alert -eq $true) { + if ($StateIsCorrect) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Automatic user consent settings are correct.' -sev Info + } else { + $AlertDetails = @{ + currentInbound = $CurrentInbound + currentOutbound = $CurrentOutbound + wantedInbound = $WantedInbound + wantedOutbound = $WantedOutbound + } + Write-StandardsAlert -message 'Automatic user consent settings do not match the expected configuration' -object $AlertDetails -tenant $Tenant -standardName 'AutomaticUserConsent' -standardId $Settings.standardId + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Automatic user consent settings do not match.' -sev Info + } + } + + if ($Settings.report -eq $true) { + $CurrentValue = @{ + inboundAllowed = $CurrentInbound + outboundAllowed = $CurrentOutbound + } + $ExpectedValue = @{ + inboundAllowed = $WantedInbound + outboundAllowed = $WantedOutbound + } + + Set-CIPPStandardsCompareField -FieldName 'standards.AutomaticUserConsent' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant + Add-CIPPBPAField -FieldName 'AutomaticUserConsent' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant + } +} diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopilotProfile.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopilotProfile.ps1 index 2ae7b6a5ba..f0c763fbd5 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopilotProfile.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopilotProfile.ps1 @@ -43,7 +43,7 @@ function Invoke-CIPPStandardAutopilotProfile { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) $TestResult = Test-CIPPStandardLicense -StandardName 'AutopilotProfile' -TenantFilter $Tenant -Preset Intune diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopilotStatusPage.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopilotStatusPage.ps1 index 92827e9f7c..1dad57ad74 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopilotStatusPage.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopilotStatusPage.ps1 @@ -41,7 +41,7 @@ function Invoke-CIPPStandardAutopilotStatusPage { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) $TestResult = Test-CIPPStandardLicense -StandardName 'AutopilotStatusPage' -TenantFilter $Tenant -Preset Intune @@ -52,7 +52,7 @@ function Invoke-CIPPStandardAutopilotStatusPage { return $true } #we're done. try { - $CurrentConfig = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations?`$filter=deviceEnrollmentConfigurationType eq 'windows10EnrollmentCompletionPageConfiguration' and priority eq 0" -tenantid $Tenant | + $CurrentConfig = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations?`$expand=assignments&orderBy=priority&`$filter=deviceEnrollmentConfigurationType eq 'windows10EnrollmentCompletionPageConfiguration' and priority eq 0" -tenantid $Tenant | Select-Object -Property id, displayName, priority, showInstallationProgress, blockDeviceSetupRetryByUser, allowDeviceResetOnInstallFailure, allowLogCollectionOnInstallFailure, customErrorMessage, installProgressTimeoutInMinutes, allowDeviceUseOnInstallFailure, trackInstallProgressForAutopilotOnly, installQualityUpdates # Compatibility for standards made in v8.3.0 or before, which did not have the InstallWindowsUpdates setting diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardB2BCollaborationInbound.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardB2BCollaborationInbound.ps1 new file mode 100644 index 0000000000..3a7f72907e --- /dev/null +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardB2BCollaborationInbound.ps1 @@ -0,0 +1,95 @@ +function Invoke-CIPPStandardB2BCollaborationInbound { + <# + .FUNCTIONALITY + Internal + .COMPONENT + (APIName) B2BCollaborationInbound + .SYNOPSIS + (Label) Sets the default inbound B2B collaboration access policy + .DESCRIPTION + (Helptext) Controls whether external users from other organizations can be invited to access your resources through B2B collaboration (guest access) by default. This applies to all external organizations without a partner-specific configuration. + (DocsDescription) Controls whether external users from other organizations can be invited to access your resources through B2B collaboration (guest access) by default. When set to blocked, no external users can collaborate unless a partner-specific override is configured. + .NOTES + CAT + Entra (AAD) Standards + TAG + EXECUTIVETEXT + Manages the default inbound B2B collaboration policy, controlling whether external users from partner organizations can access company resources as guests. Restricting this to specific organizations reduces the attack surface while allowing necessary business collaboration. + ADDEDCOMPONENT + {"type":"autoComplete","multiple":false,"creatable":false,"label":"Default inbound B2B collaboration access","name":"standards.B2BCollaborationInbound.accessType","options":[{"label":"Allow (all external users)","value":"allowed"},{"label":"Block (no external users)","value":"blocked"}]} + IMPACT + Medium Impact + ADDEDDATE + 2026-02-13 + POWERSHELLEQUIVALENT + Update-MgPolicyCrossTenantAccessPolicyDefault + RECOMMENDEDBY + UPDATECOMMENTBLOCK + Run the Tools\Update-StandardsComments.ps1 script to update this comment block + .LINK + https://docs.cipp.app/user-documentation/tenant/standards/list-standards + #> + + param($Tenant, $Settings) + + try { + $CurrentPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default?$select=b2bCollaborationInbound' -tenantid $Tenant + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get B2B Collaboration Inbound state for $Tenant. Error: $ErrorMessage" -Sev Error + return + } + + $WantedAccessType = $Settings.accessType.value ?? $Settings.accessType + + if (([string]::IsNullOrWhiteSpace($WantedAccessType) -or $WantedAccessType -eq 'Select a value') -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'B2BCollaborationInbound: Invalid accessType parameter set' -sev Error + return + } + + $CurrentAccessType = $CurrentPolicy.b2bCollaborationInbound.usersAndGroups.accessType + $StateIsCorrect = ($CurrentAccessType -eq $WantedAccessType) + + if ($Settings.remediate -eq $true) { + if ($StateIsCorrect) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "B2B Collaboration Inbound is already set to $WantedAccessType." -sev Info + } else { + try { + $Body = @{ + b2bCollaborationInbound = @{ + usersAndGroups = @{ + accessType = $WantedAccessType + targets = @(@{ target = 'AllUsers'; targetType = 'user' }) + } + applications = @{ + accessType = $WantedAccessType + targets = @(@{ target = 'AllApplications'; targetType = 'application' }) + } + } + } | ConvertTo-Json -Depth 10 -Compress + $null = New-GraphPostRequest -tenantid $Tenant -Uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default' -Type PATCH -Body $Body -ContentType 'application/json' + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Set B2B Collaboration Inbound to $WantedAccessType." -sev Info + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to set B2B Collaboration Inbound to $WantedAccessType. Error: $ErrorMessage" -sev Error + } + } + } + + if ($Settings.alert -eq $true) { + if ($StateIsCorrect) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "B2B Collaboration Inbound is set to $WantedAccessType." -sev Info + } else { + Write-StandardsAlert -message "B2B Collaboration Inbound is not set to $WantedAccessType (currently: $CurrentAccessType)" -object $CurrentPolicy.b2bCollaborationInbound -tenant $Tenant -standardName 'B2BCollaborationInbound' -standardId $Settings.standardId + Write-LogMessage -API 'Standards' -tenant $Tenant -message "B2B Collaboration Inbound is not set to $WantedAccessType." -sev Info + } + } + + if ($Settings.report -eq $true) { + $CurrentValue = @{ accessType = $CurrentAccessType } + $ExpectedValue = @{ accessType = $WantedAccessType } + + Set-CIPPStandardsCompareField -FieldName 'standards.B2BCollaborationInbound' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant + Add-CIPPBPAField -FieldName 'B2BCollaborationInbound' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant + } +} diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardB2BCollaborationOutbound.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardB2BCollaborationOutbound.ps1 new file mode 100644 index 0000000000..6eb3caeadf --- /dev/null +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardB2BCollaborationOutbound.ps1 @@ -0,0 +1,95 @@ +function Invoke-CIPPStandardB2BCollaborationOutbound { + <# + .FUNCTIONALITY + Internal + .COMPONENT + (APIName) B2BCollaborationOutbound + .SYNOPSIS + (Label) Sets the default outbound B2B collaboration access policy + .DESCRIPTION + (Helptext) Controls whether your users can be invited to access resources in other organizations through B2B collaboration by default. This applies to all external organizations without a partner-specific configuration. + (DocsDescription) Controls whether your users can be invited to access resources in other organizations through B2B collaboration by default. When set to blocked, users cannot collaborate externally unless a partner-specific override is configured. + .NOTES + CAT + Entra (AAD) Standards + TAG + EXECUTIVETEXT + Manages the default outbound B2B collaboration policy, controlling whether company employees can accept invitations to collaborate in external organizations. This helps prevent data leakage by controlling where users can share information. + ADDEDCOMPONENT + {"type":"autoComplete","multiple":false,"creatable":false,"label":"Default outbound B2B collaboration access","name":"standards.B2BCollaborationOutbound.accessType","options":[{"label":"Allow (all users)","value":"allowed"},{"label":"Block (no users)","value":"blocked"}]} + IMPACT + Medium Impact + ADDEDDATE + 2026-02-13 + POWERSHELLEQUIVALENT + Update-MgPolicyCrossTenantAccessPolicyDefault + RECOMMENDEDBY + UPDATECOMMENTBLOCK + Run the Tools\Update-StandardsComments.ps1 script to update this comment block + .LINK + https://docs.cipp.app/user-documentation/tenant/standards/list-standards + #> + + param($Tenant, $Settings) + + try { + $CurrentPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default?$select=b2bCollaborationOutbound' -tenantid $Tenant + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get B2B Collaboration Outbound state for $Tenant. Error: $ErrorMessage" -Sev Error + return + } + + $WantedAccessType = $Settings.accessType.value ?? $Settings.accessType + + if (([string]::IsNullOrWhiteSpace($WantedAccessType) -or $WantedAccessType -eq 'Select a value') -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'B2BCollaborationOutbound: Invalid accessType parameter set' -sev Error + return + } + + $CurrentAccessType = $CurrentPolicy.b2bCollaborationOutbound.usersAndGroups.accessType + $StateIsCorrect = ($CurrentAccessType -eq $WantedAccessType) + + if ($Settings.remediate -eq $true) { + if ($StateIsCorrect) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "B2B Collaboration Outbound is already set to $WantedAccessType." -sev Info + } else { + try { + $Body = @{ + b2bCollaborationOutbound = @{ + usersAndGroups = @{ + accessType = $WantedAccessType + targets = @(@{ target = 'AllUsers'; targetType = 'user' }) + } + applications = @{ + accessType = $WantedAccessType + targets = @(@{ target = 'AllApplications'; targetType = 'application' }) + } + } + } | ConvertTo-Json -Depth 10 -Compress + $null = New-GraphPostRequest -tenantid $Tenant -Uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default' -Type PATCH -Body $Body -ContentType 'application/json' + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Set B2B Collaboration Outbound to $WantedAccessType." -sev Info + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to set B2B Collaboration Outbound to $WantedAccessType. Error: $ErrorMessage" -sev Error + } + } + } + + if ($Settings.alert -eq $true) { + if ($StateIsCorrect) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "B2B Collaboration Outbound is set to $WantedAccessType." -sev Info + } else { + Write-StandardsAlert -message "B2B Collaboration Outbound is not set to $WantedAccessType (currently: $CurrentAccessType)" -object $CurrentPolicy.b2bCollaborationOutbound -tenant $Tenant -standardName 'B2BCollaborationOutbound' -standardId $Settings.standardId + Write-LogMessage -API 'Standards' -tenant $Tenant -message "B2B Collaboration Outbound is not set to $WantedAccessType." -sev Info + } + } + + if ($Settings.report -eq $true) { + $CurrentValue = @{ accessType = $CurrentAccessType } + $ExpectedValue = @{ accessType = $WantedAccessType } + + Set-CIPPStandardsCompareField -FieldName 'standards.B2BCollaborationOutbound' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant + Add-CIPPBPAField -FieldName 'B2BCollaborationOutbound' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant + } +} diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardB2BDirectConnectInbound.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardB2BDirectConnectInbound.ps1 new file mode 100644 index 0000000000..5722e05fe5 --- /dev/null +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardB2BDirectConnectInbound.ps1 @@ -0,0 +1,95 @@ +function Invoke-CIPPStandardB2BDirectConnectInbound { + <# + .FUNCTIONALITY + Internal + .COMPONENT + (APIName) B2BDirectConnectInbound + .SYNOPSIS + (Label) Sets the default inbound B2B Direct Connect access policy + .DESCRIPTION + (Helptext) Controls whether external users can access your Teams shared channels through B2B Direct Connect by default. Direct Connect enables seamless collaboration without creating guest accounts. + (DocsDescription) Controls whether external users can access your Teams shared channels through B2B Direct Connect by default. When blocked, no external users can join shared channels unless a partner-specific override is configured. B2B Direct Connect is commonly used for Teams shared channels. + .NOTES + CAT + Entra (AAD) Standards + TAG + EXECUTIVETEXT + Controls whether external users can seamlessly join Teams shared channels through B2B Direct Connect. Blocking this by default and only allowing specific partner organizations reduces unauthorized access to sensitive team collaboration spaces. + ADDEDCOMPONENT + {"type":"autoComplete","multiple":false,"creatable":false,"label":"Default inbound B2B Direct Connect access","name":"standards.B2BDirectConnectInbound.accessType","options":[{"label":"Allow (all external users)","value":"allowed"},{"label":"Block (no external users)","value":"blocked"}]} + IMPACT + Medium Impact + ADDEDDATE + 2026-02-13 + POWERSHELLEQUIVALENT + Update-MgPolicyCrossTenantAccessPolicyDefault + RECOMMENDEDBY + UPDATECOMMENTBLOCK + Run the Tools\Update-StandardsComments.ps1 script to update this comment block + .LINK + https://docs.cipp.app/user-documentation/tenant/standards/list-standards + #> + + param($Tenant, $Settings) + + try { + $CurrentPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default?$select=b2bDirectConnectInbound' -tenantid $Tenant + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get B2B Direct Connect Inbound state for $Tenant. Error: $ErrorMessage" -Sev Error + return + } + + $WantedAccessType = $Settings.accessType.value ?? $Settings.accessType + + if (([string]::IsNullOrWhiteSpace($WantedAccessType) -or $WantedAccessType -eq 'Select a value') -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'B2BDirectConnectInbound: Invalid accessType parameter set' -sev Error + return + } + + $CurrentAccessType = $CurrentPolicy.b2bDirectConnectInbound.usersAndGroups.accessType + $StateIsCorrect = ($CurrentAccessType -eq $WantedAccessType) + + if ($Settings.remediate -eq $true) { + if ($StateIsCorrect) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "B2B Direct Connect Inbound is already set to $WantedAccessType." -sev Info + } else { + try { + $Body = @{ + b2bDirectConnectInbound = @{ + usersAndGroups = @{ + accessType = $WantedAccessType + targets = @(@{ target = 'AllUsers'; targetType = 'user' }) + } + applications = @{ + accessType = $WantedAccessType + targets = @(@{ target = 'AllApplications'; targetType = 'application' }) + } + } + } | ConvertTo-Json -Depth 10 -Compress + $null = New-GraphPostRequest -tenantid $Tenant -Uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default' -Type PATCH -Body $Body -ContentType 'application/json' + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Set B2B Direct Connect Inbound to $WantedAccessType." -sev Info + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to set B2B Direct Connect Inbound to $WantedAccessType. Error: $ErrorMessage" -sev Error + } + } + } + + if ($Settings.alert -eq $true) { + if ($StateIsCorrect) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "B2B Direct Connect Inbound is set to $WantedAccessType." -sev Info + } else { + Write-StandardsAlert -message "B2B Direct Connect Inbound is not set to $WantedAccessType (currently: $CurrentAccessType)" -object $CurrentPolicy.b2bDirectConnectInbound -tenant $Tenant -standardName 'B2BDirectConnectInbound' -standardId $Settings.standardId + Write-LogMessage -API 'Standards' -tenant $Tenant -message "B2B Direct Connect Inbound is not set to $WantedAccessType." -sev Info + } + } + + if ($Settings.report -eq $true) { + $CurrentValue = @{ accessType = $CurrentAccessType } + $ExpectedValue = @{ accessType = $WantedAccessType } + + Set-CIPPStandardsCompareField -FieldName 'standards.B2BDirectConnectInbound' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant + Add-CIPPBPAField -FieldName 'B2BDirectConnectInbound' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant + } +} diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardB2BDirectConnectOutbound.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardB2BDirectConnectOutbound.ps1 new file mode 100644 index 0000000000..bf7e29ac8b --- /dev/null +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardB2BDirectConnectOutbound.ps1 @@ -0,0 +1,95 @@ +function Invoke-CIPPStandardB2BDirectConnectOutbound { + <# + .FUNCTIONALITY + Internal + .COMPONENT + (APIName) B2BDirectConnectOutbound + .SYNOPSIS + (Label) Sets the default outbound B2B Direct Connect access policy + .DESCRIPTION + (Helptext) Controls whether your users can access external Teams shared channels through B2B Direct Connect by default. This applies to all external organizations without a partner-specific configuration. + (DocsDescription) Controls whether your users can access external Teams shared channels through B2B Direct Connect by default. When blocked, users cannot join external shared channels unless a partner-specific override is configured. + .NOTES + CAT + Entra (AAD) Standards + TAG + EXECUTIVETEXT + Controls whether employees can join external Teams shared channels through B2B Direct Connect. Blocking outbound Direct Connect by default and only allowing specific partners prevents uncontrolled data sharing through external collaboration channels. + ADDEDCOMPONENT + {"type":"autoComplete","multiple":false,"creatable":false,"label":"Default outbound B2B Direct Connect access","name":"standards.B2BDirectConnectOutbound.accessType","options":[{"label":"Allow (all users)","value":"allowed"},{"label":"Block (no users)","value":"blocked"}]} + IMPACT + Medium Impact + ADDEDDATE + 2026-02-13 + POWERSHELLEQUIVALENT + Update-MgPolicyCrossTenantAccessPolicyDefault + RECOMMENDEDBY + UPDATECOMMENTBLOCK + Run the Tools\Update-StandardsComments.ps1 script to update this comment block + .LINK + https://docs.cipp.app/user-documentation/tenant/standards/list-standards + #> + + param($Tenant, $Settings) + + try { + $CurrentPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default?$select=b2bDirectConnectOutbound' -tenantid $Tenant + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get B2B Direct Connect Outbound state for $Tenant. Error: $ErrorMessage" -Sev Error + return + } + + $WantedAccessType = $Settings.accessType.value ?? $Settings.accessType + + if (([string]::IsNullOrWhiteSpace($WantedAccessType) -or $WantedAccessType -eq 'Select a value') -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'B2BDirectConnectOutbound: Invalid accessType parameter set' -sev Error + return + } + + $CurrentAccessType = $CurrentPolicy.b2bDirectConnectOutbound.usersAndGroups.accessType + $StateIsCorrect = ($CurrentAccessType -eq $WantedAccessType) + + if ($Settings.remediate -eq $true) { + if ($StateIsCorrect) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "B2B Direct Connect Outbound is already set to $WantedAccessType." -sev Info + } else { + try { + $Body = @{ + b2bDirectConnectOutbound = @{ + usersAndGroups = @{ + accessType = $WantedAccessType + targets = @(@{ target = 'AllUsers'; targetType = 'user' }) + } + applications = @{ + accessType = $WantedAccessType + targets = @(@{ target = 'AllApplications'; targetType = 'application' }) + } + } + } | ConvertTo-Json -Depth 10 -Compress + $null = New-GraphPostRequest -tenantid $Tenant -Uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default' -Type PATCH -Body $Body -ContentType 'application/json' + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Set B2B Direct Connect Outbound to $WantedAccessType." -sev Info + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to set B2B Direct Connect Outbound to $WantedAccessType. Error: $ErrorMessage" -sev Error + } + } + } + + if ($Settings.alert -eq $true) { + if ($StateIsCorrect) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "B2B Direct Connect Outbound is set to $WantedAccessType." -sev Info + } else { + Write-StandardsAlert -message "B2B Direct Connect Outbound is not set to $WantedAccessType (currently: $CurrentAccessType)" -object $CurrentPolicy.b2bDirectConnectOutbound -tenant $Tenant -standardName 'B2BDirectConnectOutbound' -standardId $Settings.standardId + Write-LogMessage -API 'Standards' -tenant $Tenant -message "B2B Direct Connect Outbound is not set to $WantedAccessType." -sev Info + } + } + + if ($Settings.report -eq $true) { + $CurrentValue = @{ accessType = $CurrentAccessType } + $ExpectedValue = @{ accessType = $WantedAccessType } + + Set-CIPPStandardsCompareField -FieldName 'standards.B2BDirectConnectOutbound' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant + Add-CIPPBPAField -FieldName 'B2BDirectConnectOutbound' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant + } +} diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBlockMSNSignIn.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBlockMSNSignIn.ps1 new file mode 100644 index 0000000000..15be1029f6 --- /dev/null +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBlockMSNSignIn.ps1 @@ -0,0 +1,85 @@ +function Invoke-CIPPStandardBlockMSNSignIn { + <# + .FUNCTIONALITY + Internal + .COMPONENT + (APIName) BlockMSNSignIn + .SYNOPSIS + (Label) Block personal Microsoft account (MSN) sign-in + .DESCRIPTION + (Helptext) Controls whether personal Microsoft accounts (MSN/Outlook.com/Hotmail) can be used to sign in. Blocking MSN sign-in prevents users from using personal accounts to access organizational resources. + (DocsDescription) Controls whether personal Microsoft accounts (MSN/Outlook.com/Hotmail) can be used to sign in to the tenant. When enabled, users cannot use personal Microsoft accounts to access organizational resources, improving security by ensuring only managed accounts are used. + .NOTES + CAT + Entra (AAD) Standards + TAG + EXECUTIVETEXT + Prevents users from signing in with personal Microsoft accounts (Outlook.com, Hotmail, etc.), ensuring that only organizational or approved external accounts can access company resources. This reduces shadow IT risks and maintains compliance with identity governance policies. + ADDEDCOMPONENT + {"type":"autoComplete","multiple":false,"creatable":false,"label":"Block MSN sign-in","name":"standards.BlockMSNSignIn.state","options":[{"label":"Enabled (block personal accounts)","value":"true"},{"label":"Disabled (allow personal accounts)","value":"false"}]} + IMPACT + Low Impact + ADDEDDATE + 2026-02-13 + POWERSHELLEQUIVALENT + Update-MgPolicyAuthorizationPolicy + RECOMMENDEDBY + UPDATECOMMENTBLOCK + Run the Tools\Update-StandardsComments.ps1 script to update this comment block + .LINK + https://docs.cipp.app/user-documentation/tenant/standards/list-standards + #> + + param($Tenant, $Settings) + + try { + $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $Tenant + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get BlockMSNSignIn state for $Tenant. Error: $ErrorMessage" -Sev Error + return + } + + $state = $Settings.state.value ?? $Settings.state + $WantedState = if ($state -eq 'true') { $true } else { $false } + $StateMessage = if ($WantedState) { 'blocked' } else { 'allowed' } + + if (([string]::IsNullOrWhiteSpace($state) -or $state -eq 'Select a value') -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'BlockMSNSignIn: Invalid state parameter set' -sev Error + return + } + + $StateIsCorrect = ($CurrentState.blockMsnSignIn -eq $WantedState) + + if ($Settings.remediate -eq $true) { + if ($StateIsCorrect) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "MSN sign-in is already $StateMessage." -sev Info + } else { + try { + $Body = @{ blockMsnSignIn = $WantedState } | ConvertTo-Json -Compress + $null = New-GraphPostRequest -tenantid $Tenant -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -Type PATCH -Body $Body -ContentType 'application/json' + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Set MSN sign-in to $StateMessage." -sev Info + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to set MSN sign-in to $StateMessage. Error: $ErrorMessage" -sev Error + } + } + } + + if ($Settings.alert -eq $true) { + if ($StateIsCorrect) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "MSN sign-in is $StateMessage." -sev Info + } else { + Write-StandardsAlert -message "MSN sign-in is not $StateMessage" -object @{ blockMsnSignIn = $CurrentState.blockMsnSignIn } -tenant $Tenant -standardName 'BlockMSNSignIn' -standardId $Settings.standardId + Write-LogMessage -API 'Standards' -tenant $Tenant -message "MSN sign-in is not $StateMessage." -sev Info + } + } + + if ($Settings.report -eq $true) { + $CurrentValue = @{ blockMsnSignIn = $CurrentState.blockMsnSignIn } + $ExpectedValue = @{ blockMsnSignIn = $WantedState } + + Set-CIPPStandardsCompareField -FieldName 'standards.BlockMSNSignIn' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant + Add-CIPPBPAField -FieldName 'BlockMSNSignIn' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant + } +} diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBookings.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBookings.ps1 index 9d01ba66c8..85691ff5fa 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBookings.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBookings.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardBookings { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -47,12 +47,6 @@ function Invoke-CIPPStandardBookings { # Get state value using null-coalescing operator $state = $Settings.state.value ?? $Settings.state - # Input validation. Cast to string so a bool $state never coerces 'Select a value' to $true - if (([string]::IsNullOrWhiteSpace($state) -or [string]$state -eq 'Select a value') -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) { - Write-LogMessage -API 'Standards' -tenant $Tenant -message 'BookingsEnabled: Invalid state parameter set' -sev Error - return - } - try { $CurrentState = (New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OrganizationConfig').BookingsEnabled } catch { @@ -71,11 +65,16 @@ function Invoke-CIPPStandardBookings { } if ($Settings.report -eq $true) { + $state = $StateIsCorrect ? $true : $CurrentState Set-CIPPStandardsCompareField -FieldName 'standards.Bookings' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant - # Default is not set, not set means it's enabled if ($null -eq $CurrentState ) { $CurrentState = $true } } + # Input validation + if (([string]::IsNullOrWhiteSpace($state) -or $state -eq 'Select a value') -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'BookingsEnabled: Invalid state parameter set' -sev Error + return + } if ($Settings.remediate -eq $true) { if ($StateIsCorrect -eq $false) { try { diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBranding.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBranding.ps1 index 89b00ce1a4..1a9673b95a 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBranding.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBranding.ps1 @@ -36,12 +36,12 @@ function Invoke-CIPPStandardBranding { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) - $TestResult = Test-CIPPStandardLicense -StandardName 'Branding' -TenantFilter $Tenant -Preset Entra -RequiredCapabilities @('OFFICE_BUSINESS') + $TestResult = Test-CIPPStandardLicense -StandardName 'Branding' -TenantFilter $Tenant -RequiredCapabilities @('AAD_PREMIUM', 'AAD_PREMIUM_P2', 'OFFICE_BUSINESS') if ($TestResult -eq $false) { return $true @@ -49,7 +49,7 @@ function Invoke-CIPPStandardBranding { ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'Branding' - $TenantId = Get-Tenants -TenantFilter $Tenant + $TenantId = Get-Tenants | Where-Object -Property defaultDomainName -EQ $Tenant $Localizations = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/organization/$($TenantId.customerId)/branding/localizations" -tenantID $Tenant -AsApp $true # Get layoutTemplateType value using null-coalescing operator diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1 index 5f4bc419a0..47f793a702 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardCloudMessageRecall { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCollaborationDomainRestriction.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCollaborationDomainRestriction.ps1 index afc2518471..581d841eb9 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCollaborationDomainRestriction.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCollaborationDomainRestriction.ps1 @@ -13,7 +13,7 @@ function Invoke-CIPPStandardCollaborationDomainRestriction { CAT Entra (AAD) Standards TAG - "CIS M365 6.0.1 (5.1.6.1)" + "CIS M365 7.0.0 (5.1.6.1)" EXECUTIVETEXT Restricts external collaboration invitations to approved domains only, preventing users from sharing data with unapproved external organizations. This reduces the risk of data exfiltration and ensures that collaboration occurs only with trusted business partners. ADDEDCOMPONENT @@ -23,7 +23,7 @@ function Invoke-CIPPStandardCollaborationDomainRestriction { ADDEDDATE 2026-05-06 POWERSHELLEQUIVALENT - Graph API PATCH https://graph.microsoft.com/beta/policies/b2bManagementPolicies/{id} + Graph API PATCH https://graph.microsoft.com/beta/policies/b2bManagementPolicies/default RECOMMENDEDBY "CIS" REQUIREDCAPABILITIES @@ -35,40 +35,21 @@ function Invoke-CIPPStandardCollaborationDomainRestriction { param($Tenant, $Settings) - # b2bManagementPolicies is a collection keyed by GUID - there is no 'default' singleton. - # The policy inherits from stsPolicy, so the actual settings live in definition[0] as a JSON string: - # {"B2BManagementPolicy":{"InvitationsAllowedAndBlockedDomainsPolicy":{"AllowedDomains":[],"BlockedDomains":[]},"AutoRedeemPolicy":{...}}} - $Uri = 'https://graph.microsoft.com/beta/policies/b2bManagementPolicies' + $Uri = 'https://graph.microsoft.com/beta/policies/b2bManagementPolicies/default' try { - $Policies = @(New-GraphGetRequest -Uri $Uri -tenantid $Tenant) - $CurrentState = $Policies | Where-Object { $_.isOrganizationDefault -eq $true } | Select-Object -First 1 - if (-not $CurrentState) { $CurrentState = $Policies | Select-Object -First 1 } + $CurrentState = New-GraphGetRequest -Uri $Uri -tenantid $Tenant } catch { $ErrorMessage = Get-CippException -Exception $_ Write-LogMessage -API 'Standards' -tenant $Tenant -message "Could not get B2B management policy. Error: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage return } - # Parse the definition blob. Keep the whole object around so remediation can preserve sibling - # settings such as AutoRedeemPolicy instead of overwriting the entire definition. - $Definition = $null - if ($CurrentState.definition) { - try { - $Definition = @($CurrentState.definition)[0] | ConvertFrom-Json - } catch { - $ErrorMessage = Get-CippException -Exception $_ - Write-LogMessage -API 'Standards' -tenant $Tenant -message "Could not parse the B2B management policy definition. Error: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage - return - } - } - - $DomainPolicy = $Definition.B2BManagementPolicy.InvitationsAllowedAndBlockedDomainsPolicy - $CurrentDomains = [PSCustomObject]@{ - allowedDomains = @($DomainPolicy.AllowedDomains) - blockedDomains = @($DomainPolicy.BlockedDomains) - } - $HasRestrictions = ($CurrentDomains.allowedDomains.Count -gt 0) -or ($CurrentDomains.blockedDomains.Count -gt 0) + $CurrentDomains = $CurrentState.invitationsAllowedAndBlockedDomainsPolicy + $HasRestrictions = $CurrentDomains -and ( + ($CurrentDomains.allowedDomains -and $CurrentDomains.allowedDomains.Count -gt 0) -or + ($CurrentDomains.blockedDomains -and $CurrentDomains.blockedDomains.Count -gt 0) + ) $DesiredDomains = @() if ($Settings.allowedDomains) { @@ -78,7 +59,7 @@ function Invoke-CIPPStandardCollaborationDomainRestriction { if ($DesiredDomains.Count -gt 0) { $CurrentAllowed = @($CurrentDomains.allowedDomains | Sort-Object) $DesiredSorted = @($DesiredDomains | Sort-Object) - $StateIsCorrect = ($CurrentAllowed -join ',') -eq ($DesiredSorted -join ',') + $StateIsCorrect = ($null -ne $CurrentDomains) -and ($CurrentAllowed -join ',') -eq ($DesiredSorted -join ',') } else { $StateIsCorrect = $HasRestrictions } @@ -90,29 +71,13 @@ function Invoke-CIPPStandardCollaborationDomainRestriction { Write-LogMessage -API 'Standards' -tenant $Tenant -message 'B2B collaboration domain restrictions are already configured correctly.' -sev Info } else { try { - # Rebuild the definition on top of the existing one so AutoRedeemPolicy and any other - # settings inside the blob survive. AllowedDomains and BlockedDomains are mutually - # exclusive in the portal, so setting an allow list clears the block list. - if ($null -eq $Definition) { $Definition = [PSCustomObject]@{} } - if ($null -eq $Definition.B2BManagementPolicy) { - $Definition | Add-Member -NotePropertyName 'B2BManagementPolicy' -NotePropertyValue ([PSCustomObject]@{}) -Force - } - $Definition.B2BManagementPolicy | Add-Member -NotePropertyName 'InvitationsAllowedAndBlockedDomainsPolicy' -NotePropertyValue ([PSCustomObject]@{ - AllowedDomains = @($DesiredDomains) - BlockedDomains = @() - }) -Force - $Body = @{ - displayName = 'B2BManagementPolicy' - definition = @(($Definition | ConvertTo-Json -Depth 10 -Compress)) - isOrganizationDefault = $true + invitationsAllowedAndBlockedDomainsPolicy = @{ + allowedDomains = $DesiredDomains + } } | ConvertTo-Json -Depth 10 -Compress - if ($CurrentState.id) { - $null = New-GraphPostRequest -Uri "$Uri/$($CurrentState.id)" -Body $Body -TenantID $Tenant -Type PATCH -ContentType 'application/json' - } else { - $null = New-GraphPostRequest -Uri $Uri -Body $Body -TenantID $Tenant -Type POST -ContentType 'application/json' - } + $null = New-GraphPostRequest -Uri $Uri -Body $Body -TenantID $Tenant -Type PATCH -ContentType 'application/json' Write-LogMessage -API 'Standards' -tenant $Tenant -message "Successfully set B2B collaboration allowed domains to: $($DesiredDomains -join ', ')" -sev Info } catch { $ErrorMessage = Get-CippException -Exception $_ diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCrossTenantTrustCompliant.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCrossTenantTrustCompliant.ps1 new file mode 100644 index 0000000000..7d3a729bd1 --- /dev/null +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCrossTenantTrustCompliant.ps1 @@ -0,0 +1,85 @@ +function Invoke-CIPPStandardCrossTenantTrustCompliant { + <# + .FUNCTIONALITY + Internal + .COMPONENT + (APIName) CrossTenantTrustCompliant + .SYNOPSIS + (Label) Sets the Cross-tenant access setting to trust compliant devices + .DESCRIPTION + (Helptext) Sets the state of the Cross-tenant access setting to trust compliant devices from external organizations. This allows guest users to satisfy your device compliance Conditional Access policies using their home tenant's Intune compliance status. + (DocsDescription) Sets the state of the Cross-tenant access setting to trust compliant devices from external organizations. When enabled, your Conditional Access policies that require compliant devices will accept device compliance claims from partner organizations managed through Intune. + .NOTES + CAT + Entra (AAD) Standards + TAG + EXECUTIVETEXT + Enables trusting device compliance status from partner organizations, allowing external collaborators with Intune-managed compliant devices to access company resources without additional device enrollment. This streamlines cross-organization collaboration while maintaining device security requirements. + ADDEDCOMPONENT + {"type":"autoComplete","multiple":false,"creatable":false,"label":"Trust compliant devices from external tenants","name":"standards.CrossTenantTrustCompliant.state","options":[{"label":"Enabled","value":"true"},{"label":"Disabled","value":"false"}]} + IMPACT + Low Impact + ADDEDDATE + 2026-02-13 + POWERSHELLEQUIVALENT + Update-MgPolicyCrossTenantAccessPolicyDefault + RECOMMENDEDBY + UPDATECOMMENTBLOCK + Run the Tools\Update-StandardsComments.ps1 script to update this comment block + .LINK + https://docs.cipp.app/user-documentation/tenant/standards/list-standards + #> + + param($Tenant, $Settings) + + try { + $CurrentPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default?$select=inboundTrust' -tenantid $Tenant + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get CrossTenantTrustCompliant state for $Tenant. Error: $ErrorMessage" -Sev Error + return + } + + $state = $Settings.state.value ?? $Settings.state + $WantedState = if ($state -eq 'true') { $true } else { $false } + $StateMessage = if ($WantedState) { 'enabled' } else { 'disabled' } + + if (([string]::IsNullOrWhiteSpace($state) -or $state -eq 'Select a value') -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'CrossTenantTrustCompliant: Invalid state parameter set' -sev Error + return + } + + if ($Settings.remediate -eq $true) { + if ($CurrentPolicy.inboundTrust.isCompliantDeviceAccepted -eq $WantedState) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Cross-tenant compliant device trust is already $StateMessage." -sev Info + } else { + try { + $NewBody = $CurrentPolicy + $NewBody.inboundTrust.isCompliantDeviceAccepted = $WantedState + $NewBody = ConvertTo-Json -Depth 10 -InputObject $NewBody -Compress + $null = New-GraphPostRequest -tenantid $Tenant -Uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default' -Type PATCH -Body $NewBody -ContentType 'application/json' + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Set cross-tenant compliant device trust to $StateMessage." -sev Info + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to set cross-tenant compliant device trust to $StateMessage. Error: $ErrorMessage" -sev Error + } + } + } + + if ($Settings.alert -eq $true) { + if ($CurrentPolicy.inboundTrust.isCompliantDeviceAccepted -eq $WantedState) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Cross-tenant compliant device trust is $StateMessage." -sev Info + } else { + Write-StandardsAlert -message "Cross-tenant compliant device trust is not $StateMessage" -object $CurrentPolicy.inboundTrust -tenant $Tenant -standardName 'CrossTenantTrustCompliant' -standardId $Settings.standardId + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Cross-tenant compliant device trust is not $StateMessage." -sev Info + } + } + + if ($Settings.report -eq $true) { + $CurrentValue = @{ isCompliantDeviceAccepted = $CurrentPolicy.inboundTrust.isCompliantDeviceAccepted } + $ExpectedValue = @{ isCompliantDeviceAccepted = $WantedState } + + Set-CIPPStandardsCompareField -FieldName 'standards.CrossTenantTrustCompliant' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant + Add-CIPPBPAField -FieldName 'CrossTenantTrustCompliant' -FieldValue $CurrentPolicy.inboundTrust.isCompliantDeviceAccepted -StoreAs bool -Tenant $Tenant + } +} diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCrossTenantTrustHybridJoin.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCrossTenantTrustHybridJoin.ps1 new file mode 100644 index 0000000000..583c25d9c7 --- /dev/null +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCrossTenantTrustHybridJoin.ps1 @@ -0,0 +1,85 @@ +function Invoke-CIPPStandardCrossTenantTrustHybridJoin { + <# + .FUNCTIONALITY + Internal + .COMPONENT + (APIName) CrossTenantTrustHybridJoin + .SYNOPSIS + (Label) Sets the Cross-tenant access setting to trust hybrid Azure AD joined devices + .DESCRIPTION + (Helptext) Sets the state of the Cross-tenant access setting to trust Microsoft Entra hybrid joined devices from external organizations. This allows guest users to satisfy your Conditional Access policies that require hybrid joined devices using their home tenant's device status. + (DocsDescription) Sets the state of the Cross-tenant access setting to trust Microsoft Entra hybrid joined devices from external organizations. When enabled, your Conditional Access policies that require hybrid Azure AD joined devices will accept claims from partner organizations. + .NOTES + CAT + Entra (AAD) Standards + TAG + EXECUTIVETEXT + Enables trusting hybrid Azure AD joined device claims from partner organizations, allowing external collaborators with domain-joined devices to access company resources without additional requirements. This supports cross-organization collaboration for enterprises using hybrid identity. + ADDEDCOMPONENT + {"type":"autoComplete","multiple":false,"creatable":false,"label":"Trust hybrid Azure AD joined devices from external tenants","name":"standards.CrossTenantTrustHybridJoin.state","options":[{"label":"Enabled","value":"true"},{"label":"Disabled","value":"false"}]} + IMPACT + Low Impact + ADDEDDATE + 2026-02-13 + POWERSHELLEQUIVALENT + Update-MgPolicyCrossTenantAccessPolicyDefault + RECOMMENDEDBY + UPDATECOMMENTBLOCK + Run the Tools\Update-StandardsComments.ps1 script to update this comment block + .LINK + https://docs.cipp.app/user-documentation/tenant/standards/list-standards + #> + + param($Tenant, $Settings) + + try { + $CurrentPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default?$select=inboundTrust' -tenantid $Tenant + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get CrossTenantTrustHybridJoin state for $Tenant. Error: $ErrorMessage" -Sev Error + return + } + + $state = $Settings.state.value ?? $Settings.state + $WantedState = if ($state -eq 'true') { $true } else { $false } + $StateMessage = if ($WantedState) { 'enabled' } else { 'disabled' } + + if (([string]::IsNullOrWhiteSpace($state) -or $state -eq 'Select a value') -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'CrossTenantTrustHybridJoin: Invalid state parameter set' -sev Error + return + } + + if ($Settings.remediate -eq $true) { + if ($CurrentPolicy.inboundTrust.isHybridAzureADJoinedDeviceAccepted -eq $WantedState) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Cross-tenant hybrid join trust is already $StateMessage." -sev Info + } else { + try { + $NewBody = $CurrentPolicy + $NewBody.inboundTrust.isHybridAzureADJoinedDeviceAccepted = $WantedState + $NewBody = ConvertTo-Json -Depth 10 -InputObject $NewBody -Compress + $null = New-GraphPostRequest -tenantid $Tenant -Uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default' -Type PATCH -Body $NewBody -ContentType 'application/json' + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Set cross-tenant hybrid join trust to $StateMessage." -sev Info + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to set cross-tenant hybrid join trust to $StateMessage. Error: $ErrorMessage" -sev Error + } + } + } + + if ($Settings.alert -eq $true) { + if ($CurrentPolicy.inboundTrust.isHybridAzureADJoinedDeviceAccepted -eq $WantedState) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Cross-tenant hybrid join trust is $StateMessage." -sev Info + } else { + Write-StandardsAlert -message "Cross-tenant hybrid join trust is not $StateMessage" -object $CurrentPolicy.inboundTrust -tenant $Tenant -standardName 'CrossTenantTrustHybridJoin' -standardId $Settings.standardId + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Cross-tenant hybrid join trust is not $StateMessage." -sev Info + } + } + + if ($Settings.report -eq $true) { + $CurrentValue = @{ isHybridAzureADJoinedDeviceAccepted = $CurrentPolicy.inboundTrust.isHybridAzureADJoinedDeviceAccepted } + $ExpectedValue = @{ isHybridAzureADJoinedDeviceAccepted = $WantedState } + + Set-CIPPStandardsCompareField -FieldName 'standards.CrossTenantTrustHybridJoin' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant + Add-CIPPBPAField -FieldName 'CrossTenantTrustHybridJoin' -FieldValue $CurrentPolicy.inboundTrust.isHybridAzureADJoinedDeviceAccepted -StoreAs bool -Tenant $Tenant + } +} diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCustomBannedPasswordList.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCustomBannedPasswordList.ps1 index a1ca3f72d4..4448baf7e2 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCustomBannedPasswordList.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCustomBannedPasswordList.ps1 @@ -38,7 +38,7 @@ function Invoke-CIPPStandardCustomBannedPasswordList { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefaultPlatformRestrictions.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefaultPlatformRestrictions.ps1 index 7646077895..ddf104fc7d 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefaultPlatformRestrictions.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefaultPlatformRestrictions.ps1 @@ -51,7 +51,7 @@ function Invoke-CIPPStandardDefaultPlatformRestrictions { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -61,14 +61,9 @@ function Invoke-CIPPStandardDefaultPlatformRestrictions { return $true } #we're done. - # The default policy is identified by its id suffix, not by deviceEnrollmentConfigurationType. - # Graph currently reports that type as either 'platformRestrictions' or 'singlePlatformRestriction' - # for the same object depending on the filter used, and per-platform policies expose a single - # 'platformRestriction' property instead of the per-OS ones this standard reads. try { - $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations?$top=999' -tenantID $Tenant -AsApp $true | - Where-Object { $_.id -like '*_DefaultPlatformRestrictions' } | - Select-Object -First 1 -Property id, androidForWorkRestriction, androidRestriction, iosRestriction, macOSRestriction, windowsRestriction + $CurrentState = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations?`$expand=assignments&orderBy=priority&`$filter=deviceEnrollmentConfigurationType eq 'SinglePlatformRestriction'" -tenantID $Tenant -AsApp $true | + Select-Object -Property id, androidForWorkRestriction, androidRestriction, iosRestriction, macOSRestriction, windowsRestriction } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DefaultPlatformRestrictions state for $Tenant. Error: $ErrorMessage" -Sev Error @@ -217,5 +212,6 @@ function Invoke-CIPPStandardDefaultPlatformRestrictions { if ($Settings.report -eq $true) { Set-CIPPStandardsCompareField -FieldName 'standards.DefaultPlatformRestrictions' -CurrentValue $CompareField -ExpectedValue $ExpectedValue -TenantFilter $Tenant + Add-CIPPBPAField -FieldName 'DefaultPlatformRestrictions' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $Tenant } } diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefaultSharingLink.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefaultSharingLink.ps1 index ad4b641eab..7a21a84933 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefaultSharingLink.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefaultSharingLink.ps1 @@ -42,7 +42,7 @@ function Invoke-CIPPStandardDefaultSharingLink { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1 index 5c881d748e..d9d169c34d 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardDelegateSentItems { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeletedUserRentention.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeletedUserRentention.ps1 index 672445e29e..d1e0b223bf 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeletedUserRentention.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeletedUserRentention.ps1 @@ -35,7 +35,7 @@ function Invoke-CIPPStandardDeletedUserRentention { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1 index 9db33b2bda..8b5173fffd 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1 @@ -30,6 +30,7 @@ function Invoke-CIPPStandardDeployCheckChromeExtension { {"type":"autoComplete","multiple":true,"creatable":true,"required":false,"freeSolo":true,"name":"standards.DeployCheckChromeExtension.urlAllowlist","label":"URL Allowlist","placeholder":"e.g. https://example.com/*","helperText":"Enter URLs to allowlist in the extension. Press enter to add each URL. Wildcards are allowed. This should be used for sites that are being blocked by the extension but are known to be safe."} {"type":"switch","name":"standards.DeployCheckChromeExtension.domainSquattingEnabled","label":"Enable domain squatting detection","defaultValue":true} {"type":"textField","name":"standards.DeployCheckChromeExtension.companyName","label":"Company Name","placeholder":"YOUR-COMPANY","required":false} + {"type":"textField","name":"standards.DeployCheckChromeExtension.companyURL","label":"Company URL","placeholder":"https://yourcompany.com","required":false} {"type":"textField","name":"standards.DeployCheckChromeExtension.productName","label":"Product Name","placeholder":"YOUR-PRODUCT-NAME","required":false} {"type":"textField","name":"standards.DeployCheckChromeExtension.supportEmail","label":"Support Email","placeholder":"support@yourcompany.com","required":false} {"type":"textField","name":"standards.DeployCheckChromeExtension.supportUrl","label":"Support URL","placeholder":"https://support.yourcompany.com","required":false} @@ -39,7 +40,6 @@ function Invoke-CIPPStandardDeployCheckChromeExtension { {"type":"textField","name":"standards.DeployCheckChromeExtension.logoUrl","label":"Logo URL","placeholder":"https://yourcompany.com/logo.png","required":false} {"name":"AssignTo","label":"Who should this app be assigned to?","type":"radio","options":[{"label":"Do not assign","value":"On"},{"label":"Assign to all users","value":"allLicensedUsers"},{"label":"Assign to all devices","value":"AllDevices"},{"label":"Assign to all users and devices","value":"AllDevicesAndUsers"},{"label":"Assign to Custom Group","value":"customGroup"}]} {"type":"textField","required":false,"name":"customGroup","label":"Enter the custom group name if you selected 'Assign to Custom Group'. Wildcards are allowed."} - {"name":"excludeGroup","label":"Exclude Groups","type":"textField","required":false,"helpText":"Enter the group name(s) to exclude from the assignment. Wildcards are allowed. Multiple group names are comma-separated."} IMPACT Low Impact ADDEDDATE @@ -57,7 +57,7 @@ function Invoke-CIPPStandardDeployCheckChromeExtension { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -107,7 +107,7 @@ function Invoke-CIPPStandardDeployCheckChromeExtension { $SupportUrl = $Settings.supportUrl ?? '' $PrivacyPolicyUrl = $Settings.privacyPolicyUrl ?? '' $AboutUrl = $Settings.aboutUrl ?? '' - $PrimaryColor = if ($Settings.primaryColor) { '#{0}' -f ($Settings.primaryColor -replace '^#+', '') } else { '#F77F00' } + $PrimaryColor = if ($Settings.primaryColor) { $Settings.primaryColor } else { '#F77F00' } $LogoUrl = $Settings.logoUrl ?? '' ########################################################################## @@ -372,7 +372,6 @@ exit 0 if ($Settings.remediate -eq $true) { $AssignTo = $Settings.AssignTo ?? 'AllDevices' if ($Settings.customGroup) { $AssignTo = $Settings.customGroup } - $ExcludeGroup = $Settings.excludeGroup # Clean up legacy OMA-URI configuration policies from the old approach $LegacyPolicies = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations?$select=id,displayName' -tenantid $Tenant | Where-Object { @@ -430,7 +429,7 @@ exit 0 if ($NewApp -and $AssignTo -ne 'On') { Start-Sleep -Milliseconds 500 - Set-CIPPAssignedApplication -ApplicationId $NewApp.Id -TenantFilter $Tenant -GroupName $AssignTo -ExcludeGroup $ExcludeGroup -Intent 'Required' -AppType 'Win32Lob' -APIName 'Standards' + Set-CIPPAssignedApplication -ApplicationId $NewApp.Id -TenantFilter $Tenant -GroupName $AssignTo -Intent 'Required' -AppType 'Win32Lob' -APIName 'Standards' } Write-LogMessage -API 'Standards' -tenant $Tenant -message "Successfully deployed $AppDisplayName" -sev Info @@ -452,7 +451,7 @@ exit 0 if ($NewApp -and $AssignTo -ne 'On') { Start-Sleep -Milliseconds 500 - Set-CIPPAssignedApplication -ApplicationId $NewApp.Id -TenantFilter $Tenant -GroupName $AssignTo -ExcludeGroup $ExcludeGroup -Intent 'Required' -AppType 'Win32Lob' -APIName 'Standards' + Set-CIPPAssignedApplication -ApplicationId $NewApp.Id -TenantFilter $Tenant -GroupName $AssignTo -Intent 'Required' -AppType 'Win32Lob' -APIName 'Standards' } Write-LogMessage -API 'Standards' -tenant $Tenant -message "Successfully deployed $AppDisplayName" -sev Info diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployContactTemplates.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployContactTemplates.ps1 index 0fa614dc1e..8f76f7a476 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployContactTemplates.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployContactTemplates.ps1 @@ -36,7 +36,7 @@ function Invoke-CIPPStandardDeployContactTemplates { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -127,6 +127,7 @@ function Invoke-CIPPStandardDeployContactTemplates { # Check if the contact already exists (using DisplayName as key) $ExistingContact = $CurrentContacts | Where-Object { $_.DisplayName -eq $Template.displayName } + # If the contact exists, we'll overwrite it; if not, we'll create it if ($ExistingContact) { # Fetch extended properties (Company/City/Phone/etc. live on Get-Contact, not Get-MailContact) $ExtendedContact = $null @@ -197,7 +198,6 @@ function Invoke-CIPPStandardDeployContactTemplates { $StateIsCorrect = $false $Action = 'Create' $Missing = $true - $Differences = $null } [PSCustomObject]@{ @@ -206,13 +206,12 @@ function Invoke-CIPPStandardDeployContactTemplates { Action = $Action Template = $Template TemplateGUID = $TemplateGUID - Differences = $Differences } } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message $Message = "Failed to process template $TemplateGUID, Error: $ErrorMessage" Write-LogMessage -API $APIName -tenant $tenant -message $Message -sev 'Error' - continue + return $Message } } @@ -342,7 +341,7 @@ function Invoke-CIPPStandardDeployContactTemplates { $PropertyMap = @{ 'Company' = $Template.companyName 'StateOrProvince' = $Template.state - 'StreetAddress' = $Template.streetAddress + 'Office' = $Template.streetAddress 'Phone' = $Template.businessPhone 'WebPage' = $Template.website 'Title' = $Template.jobTitle @@ -412,20 +411,19 @@ function Invoke-CIPPStandardDeployContactTemplates { if ($AlertEnabled) { $MissingContacts = ($CompareList | Where-Object { $_.missing }).Count - $ContactsNeedingUpdate = ($CompareList | Where-Object { -not $_.missing -and -not $_.StateIsCorrect }).Count + $ExistingContacts = ($CompareList | Where-Object { -not $_.missing }).Count - if ($MissingContacts -gt 0 -or $ContactsNeedingUpdate -gt 0) { - foreach ($Contact in $CompareList | Where-Object { -not $_.StateIsCorrect }) { + if ($MissingContacts -gt 0 -or $ExistingContacts -gt 0) { + foreach ($Contact in $CompareList) { if ($Contact.missing) { $CurrentInfo = $Contact.Template | Select-Object -Property displayName, email, missing - Write-StandardsAlert -message "Mail contact $($Contact.Template.displayName) from template $($Contact.TemplateGUID) is missing." -object $CurrentInfo -tenant $Tenant -standardName 'DeployContactTemplates' + Write-StandardsAlert -message "Mail contact $($Contact.Template.displayName) from template $($Contact.TemplateGUID) is missing." -object $CurrentInfo -tenant $Tenant -standardName 'DeployContactTemplate' } else { $CurrentInfo = $CurrentContacts | Where-Object -Property DisplayName -EQ $Contact.Template.displayName | Select-Object -Property DisplayName, ExternalEmailAddress, FirstName, LastName - $DiffList = ($Contact.Differences -join ', ') - Write-StandardsAlert -message "Mail contact $($Contact.Template.displayName) from template $($Contact.TemplateGUID) does not match template (differences: $DiffList)." -object $CurrentInfo -tenant $Tenant -standardName 'DeployContactTemplates' + Write-StandardsAlert -message "Mail contact $($Contact.Template.displayName) from template $($Contact.TemplateGUID) will be updated to match template." -object $CurrentInfo -tenant $Tenant -standardName 'DeployContactTemplate' } } - Write-LogMessage -API $APIName -tenant $Tenant -message "DeployContactTemplate: $MissingContacts missing, $ContactsNeedingUpdate to update" -sev Info + Write-LogMessage -API $APIName -tenant $Tenant -message "DeployContactTemplate: $MissingContacts missing, $ExistingContacts to update" -sev Info } else { Write-LogMessage -API $APIName -tenant $Tenant -message 'DeployContactTemplate: No contacts need processing' -sev Info } @@ -435,24 +433,19 @@ function Invoke-CIPPStandardDeployContactTemplates { $ExpectedValue = [PSCustomObject]@{ state = 'Correctly configured' } - $AllCorrect = -not ($CompareList | Where-Object { -not $_.StateIsCorrect }) - $CurrentValue = if ($AllCorrect) { + $CurrentValue = if ($CompareList.StateIsCorrect -eq $true) { [PSCustomObject]@{ state = 'Correctly configured' } } else { [PSCustomObject]@{ - MissingContacts = @($CompareList | Where-Object { $_.missing } | ForEach-Object { - $_.Template | Select-Object -Property displayName, Email - }) - ContactsToUpdate = @($CompareList | Where-Object { -not $_.missing -and -not $_.StateIsCorrect } | ForEach-Object { - [PSCustomObject]@{ - displayName = $_.Template.displayName - Email = $_.Template.email - Differences = $_.Differences - } - }) + MissingContacts = $CompareList | Where-Object { $_.missing } | ForEach-Object { + $_.Template | Select-Object -Property displayName, Email + } + ContactsToUpdate = $CompareList | Where-Object { -not $_.missing } | ForEach-Object { + $_.Template | Select-Object -Property displayName, Email + } } } - Set-CIPPStandardsCompareField -FieldName 'standards.DeployContactTemplates' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant + Set-CIPPStandardsCompareField -FieldName 'standards.DeployContactTemplate' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant } } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployMailContact.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployMailContact.ps1 index a891f21fdf..23b6cc71d4 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployMailContact.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployMailContact.ps1 @@ -37,7 +37,7 @@ function Invoke-CIPPStandardDeployMailContact { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAddShortcutsToOneDrive.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAddShortcutsToOneDrive.ps1 index 8f8c2904db..7577418f2a 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAddShortcutsToOneDrive.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAddShortcutsToOneDrive.ps1 @@ -35,7 +35,7 @@ function Invoke-CIPPStandardDisableAddShortcutsToOneDrive { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAdditionalStorageProviders.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAdditionalStorageProviders.ps1 index bfff0c85dc..e6481cbfdf 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAdditionalStorageProviders.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAdditionalStorageProviders.ps1 @@ -36,7 +36,7 @@ function Invoke-CIPPStandardDisableAdditionalStorageProviders { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1 index 64967c1d9e..d84a2798e5 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1 @@ -38,7 +38,7 @@ function Invoke-CIPPStandardDisableBasicAuthSMTP { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -50,7 +50,7 @@ function Invoke-CIPPStandardDisableBasicAuthSMTP { ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableBasicAuthSMTP' try { - $CurrentInfo = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoTransportConfig' | Select-Object -First 1 + $CurrentInfo = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-TransportConfig' $SMTPusers = New-CippDbRequest -TenantFilter $Tenant -Type 'CASMailbox' | Where-Object { ($_.SmtpClientAuthenticationDisabled -eq $false) } } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEWS.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEWS.ps1 index 74c99a75ea..ec2ca01336 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEWS.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEWS.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardDisableEWS { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEmail.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEmail.ps1 index e26cacff1a..3b6926d3e7 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEmail.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEmail.ps1 @@ -28,7 +28,7 @@ function Invoke-CIPPStandardDisableEmail { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableExternalCalendarSharing.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableExternalCalendarSharing.ps1 index 7894750bcf..bc2cb328e4 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableExternalCalendarSharing.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableExternalCalendarSharing.ps1 @@ -37,7 +37,7 @@ function Invoke-CIPPStandardDisableExternalCalendarSharing { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableOutlookAddins.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableOutlookAddins.ps1 index 176c2cbb6a..9eb03b9888 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableOutlookAddins.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableOutlookAddins.ps1 @@ -38,7 +38,7 @@ function Invoke-CIPPStandardDisableOutlookAddins { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableQRCodePin.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableQRCodePin.ps1 index ac15f88c71..27fd7d706f 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableQRCodePin.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableQRCodePin.ps1 @@ -26,7 +26,7 @@ function Invoke-CIPPStandardDisableQRCodePin { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableReshare.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableReshare.ps1 index 83e70bcdc4..db10a77aa1 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableReshare.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableReshare.ps1 @@ -41,7 +41,7 @@ function Invoke-CIPPStandardDisableReshare { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableResourceMailbox.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableResourceMailbox.ps1 index 45a2e3418d..d8daf9a8b0 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableResourceMailbox.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableResourceMailbox.ps1 @@ -35,7 +35,7 @@ function Invoke-CIPPStandardDisableResourceMailbox { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -54,6 +54,7 @@ function Invoke-CIPPStandardDisableResourceMailbox { ($null -eq $_.assignedLicenses -or $_.assignedLicenses.Count -eq 0) -and $_.userType -eq 'Member' } + $AllUsers = $null $ResourceMailboxList = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-Mailbox' -cmdParams @{ Filter = "RecipientTypeDetails -eq 'RoomMailbox' -or RecipientTypeDetails -eq 'EquipmentMailbox'" } -Select 'UserPrincipalName,DisplayName,RecipientTypeDetails,ExternalDirectoryObjectId' | Where-Object { $_.ExternalDirectoryObjectId -in $UserList.id } } catch { diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSMS.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSMS.ps1 index 860ad448cd..7960d12954 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSMS.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSMS.ps1 @@ -31,7 +31,7 @@ function Invoke-CIPPStandardDisableSMS { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSelfServiceLicenses.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSelfServiceLicenses.ps1 index 8ed1c4364c..589de02eed 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSelfServiceLicenses.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSelfServiceLicenses.ps1 @@ -28,7 +28,7 @@ function Invoke-CIPPStandardDisableSelfServiceLicenses { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSharePointLegacyAuth.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSharePointLegacyAuth.ps1 index afe654b1ab..5446171ae7 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSharePointLegacyAuth.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSharePointLegacyAuth.ps1 @@ -43,7 +43,7 @@ function Invoke-CIPPStandardDisableSharePointLegacyAuth { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSharedMailbox.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSharedMailbox.ps1 index 90b0f39215..e367507ae1 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSharedMailbox.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSharedMailbox.ps1 @@ -31,7 +31,7 @@ function Invoke-CIPPStandardDisableSharedMailbox { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableTNEF.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableTNEF.ps1 index 73873c6c43..1c138f87c9 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableTNEF.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableTNEF.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardDisableTNEF { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param ($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableUserSiteCreate.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableUserSiteCreate.ps1 index f251bad1c7..b0b0c2f19d 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableUserSiteCreate.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableUserSiteCreate.ps1 @@ -34,7 +34,7 @@ function Invoke-CIPPStandardDisableUserSiteCreate { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableVoice.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableVoice.ps1 index 4affebd6fd..90762544b4 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableVoice.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableVoice.ps1 @@ -31,7 +31,7 @@ function Invoke-CIPPStandardDisableVoice { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisablex509Certificate.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisablex509Certificate.ps1 index cb26d483bb..ee5f030a12 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisablex509Certificate.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisablex509Certificate.ps1 @@ -26,7 +26,7 @@ function Invoke-CIPPStandardDisablex509Certificate { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXODisableAutoForwarding.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXODisableAutoForwarding.ps1 index 2ed3f98f4f..a9891c0b15 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXODisableAutoForwarding.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXODisableAutoForwarding.ps1 @@ -39,7 +39,7 @@ function Invoke-CIPPStandardEXODisableAutoForwarding { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXOOutboundSpamLimits.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXOOutboundSpamLimits.ps1 index ddc2120fde..bf96e37f4a 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXOOutboundSpamLimits.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXOOutboundSpamLimits.ps1 @@ -39,7 +39,7 @@ function Invoke-CIPPStandardEXOOutboundSpamLimits { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEmptyFilterIPAllowList.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEmptyFilterIPAllowList.ps1 index a17cad6f82..2a3fe34379 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEmptyFilterIPAllowList.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEmptyFilterIPAllowList.ps1 @@ -13,7 +13,7 @@ function Invoke-CIPPStandardEmptyFilterIPAllowList { CAT Defender Standards TAG - "CIS M365 6.0.1 (2.1.12)" + "CIS M365 7.0.0 (2.1.12)" EXECUTIVETEXT Ensures the Exchange Online connection filter IP allow list is empty, preventing any IP addresses from bypassing spam filtering, spoofing checks, and sender authentication. Keeping this list empty ensures all inbound email undergoes full security scanning, reducing the risk of phishing and malware delivery through trusted-but-compromised sources. ADDEDCOMPONENT diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableFIDO2.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableFIDO2.ps1 index 50d04ba984..af689476d4 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableFIDO2.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableFIDO2.ps1 @@ -40,7 +40,7 @@ function Invoke-CIPPStandardEnableFIDO2 { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableHardwareOAuth.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableHardwareOAuth.ps1 index 183fb9d3b7..344d079ebf 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableHardwareOAuth.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableHardwareOAuth.ps1 @@ -26,7 +26,7 @@ function Invoke-CIPPStandardEnableHardwareOAuth { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableLitigationHold.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableLitigationHold.ps1 index 890813f840..87827df501 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableLitigationHold.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableLitigationHold.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardEnableLitigationHold { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1 index 63309d9c0b..823728ea48 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1 @@ -37,7 +37,7 @@ function Invoke-CIPPStandardEnableMailTips { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1 index c0df6094d1..c909842d97 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1 @@ -42,7 +42,7 @@ function Invoke-CIPPStandardEnableMailboxAuditing { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableOnlineArchiving.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableOnlineArchiving.ps1 index 99bb9c9bbf..1f78c6d22c 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableOnlineArchiving.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableOnlineArchiving.ps1 @@ -34,7 +34,7 @@ function Invoke-CIPPStandardEnableOnlineArchiving { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnforcePrivateGroups.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnforcePrivateGroups.ps1 index a5fcba87c0..b8b4fafb53 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnforcePrivateGroups.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnforcePrivateGroups.ps1 @@ -8,12 +8,12 @@ function Invoke-CIPPStandardEnforcePrivateGroups { (Label) Enforce Private M365 Groups .DESCRIPTION (Helptext) Sets all public Microsoft 365 groups to private automatically. Groups can be excluded by display name keyword. - (DocsDescription) Ensures only organisation-managed or approved public groups exist by automatically switching public Microsoft 365 (Unified) groups to private visibility. Groups whose display name matches any of the configured exclusion keywords are left unchanged. This aligns with CIS M365 6.0.1 benchmark control 1.2.1. + (DocsDescription) Ensures only organisation-managed or approved public groups exist by automatically switching public Microsoft 365 (Unified) groups to private visibility. Groups whose display name matches any of the configured exclusion keywords are left unchanged. This aligns with CIS M365 7.0.0 benchmark control 1.2.1. .NOTES CAT Entra (AAD) Standards TAG - "CIS M365 6.0.1 (1.2.1)" + "CIS M365 7.0.0 (1.2.1)" EXECUTIVETEXT Enforces private visibility on all Microsoft 365 groups to prevent unauthorised external access to group resources such as Teams, SharePoint sites, and Planner boards. Approved public groups can be excluded by name, ensuring governance while retaining flexibility for intentionally public collaboration spaces. ADDEDCOMPONENT @@ -42,7 +42,8 @@ function Invoke-CIPPStandardEnforcePrivateGroups { param($Tenant, $Settings) - $TestResult = Test-CIPPStandardLicense -StandardName 'EnforcePrivateGroups' -TenantFilter $Tenant -Preset SharePoint + $TestResult = Test-CIPPStandardLicense -StandardName 'EnforcePrivateGroups' -TenantFilter $Tenant ` + -Preset SharePoint if ($TestResult -eq $false) { return $true } # Parse exclusion keywords from settings diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration.ps1 index 8d4f734f8c..2339a92bc4 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration.ps1 @@ -28,8 +28,6 @@ function Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration { {"type":"switch","name":"standards.EnrollmentWindowsHelloForBusinessConfiguration.unlockWithBiometricsEnabled","label":"Allow biometric authentication","default":true} {"type":"autoComplete","name":"standards.EnrollmentWindowsHelloForBusinessConfiguration.enhancedBiometricsState","label":"Use enhanced anti-spoofing when available","multiple":false,"options":[{"label":"Not configured","value":"notConfigured"},{"label":"Enabled","value":"enabled"},{"label":"Disabled","value":"disabled"}]} {"type":"switch","name":"standards.EnrollmentWindowsHelloForBusinessConfiguration.remotePassportEnabled","label":"Allow phone sign-in","default":true} - {"type":"autoComplete","name":"standards.EnrollmentWindowsHelloForBusinessConfiguration.enhancedSignInSecurity","label":"Enable enhanced sign-in security","multiple":false,"options":[{"label":"Not configured","value":"0"},{"label":"Enabled on capable hardware","value":"1"},{"label":"Disabled on all systems","value":"2"}]} - {"type":"autoComplete","name":"standards.EnrollmentWindowsHelloForBusinessConfiguration.securityKeyForSignIn","label":"Use security keys for sign-in","multiple":false,"options":[{"label":"Not configured","value":"notConfigured"},{"label":"Enabled","value":"enabled"},{"label":"Disabled","value":"disabled"}]} IMPACT Low Impact ADDEDDATE @@ -46,7 +44,7 @@ function Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -57,16 +55,14 @@ function Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration { } #we're done. try { - $CurrentState = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations?`$orderby=priority&`$filter=deviceEnrollmentConfigurationType eq 'WindowsHelloForBusiness'" -tenantID $Tenant -AsApp $true | - Select-Object -First 1 -Property id, pinMinimumLength, pinMaximumLength, pinUppercaseCharactersUsage, pinLowercaseCharactersUsage, pinSpecialCharactersUsage, state, securityDeviceRequired, unlockWithBiometricsEnabled, remotePassportEnabled, pinPreviousBlockCount, pinExpirationInDays, enhancedBiometricsState, enhancedSignInSecurity, securityKeyForSignIn + $CurrentState = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations?`$expand=assignments&orderBy=priority&`$filter=deviceEnrollmentConfigurationType eq 'WindowsHelloForBusiness'" -tenantID $Tenant -AsApp $true | + Select-Object -Property id, pinMinimumLength, pinMaximumLength, pinUppercaseCharactersUsage, pinLowercaseCharactersUsage, pinSpecialCharactersUsage, state, securityDeviceRequired, unlockWithBiometricsEnabled, remotePassportEnabled, pinPreviousBlockCount, pinExpirationInDays, enhancedBiometricsState } catch { - $ErrorMessage = Get-CippException -Exception $_ - Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the EnrollmentWindowsHelloForBusinessConfiguration state for $Tenant. Error: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the EnrollmentWindowsHelloForBusinessConfiguration state for $Tenant. Error: $ErrorMessage" -Sev Error return } - $EnhancedSignInSecurity = if ($null -ne $Settings.enhancedSignInSecurity) { [int]$Settings.enhancedSignInSecurity.value } else { $null } - $StateIsCorrect = ($CurrentState.pinMinimumLength -eq $Settings.pinMinimumLength) -and ($CurrentState.pinMaximumLength -eq $Settings.pinMaximumLength) -and ($CurrentState.pinUppercaseCharactersUsage -eq $Settings.pinUppercaseCharactersUsage.value) -and @@ -78,10 +74,7 @@ function Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration { ($CurrentState.remotePassportEnabled -eq $Settings.remotePassportEnabled) -and ($CurrentState.pinPreviousBlockCount -eq $Settings.pinPreviousBlockCount) -and ($CurrentState.pinExpirationInDays -eq $Settings.pinExpirationInDays) -and - ($CurrentState.enhancedBiometricsState -eq $Settings.enhancedBiometricsState.value) -and - (($null -eq $Settings.enhancedSignInSecurity) -or ($CurrentState.enhancedSignInSecurity -eq $EnhancedSignInSecurity)) -and - (($null -eq $Settings.securityKeyForSignIn) -or ($CurrentState.securityKeyForSignIn -eq $Settings.securityKeyForSignIn.value)) - # Backwards compatibility for when newer settings were not yet added + ($CurrentState.enhancedBiometricsState -eq $Settings.enhancedBiometricsState.value) $CompareField = [PSCustomObject]@{ pinMinimumLength = $CurrentState.pinMinimumLength @@ -98,14 +91,6 @@ function Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration { enhancedBiometricsState = $CurrentState.enhancedBiometricsState } - if ($null -ne $Settings.enhancedSignInSecurity) { - $CompareField | Add-Member -NotePropertyName enhancedSignInSecurity -NotePropertyValue $CurrentState.enhancedSignInSecurity - } - - if ($null -ne $Settings.securityKeyForSignIn) { - $CompareField | Add-Member -NotePropertyName securityKeyForSignIn -NotePropertyValue $CurrentState.securityKeyForSignIn - } - $ExpectedValue = [PSCustomObject]@{ pinMinimumLength = $Settings.pinMinimumLength pinMaximumLength = $Settings.pinMaximumLength @@ -121,14 +106,6 @@ function Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration { enhancedBiometricsState = $Settings.enhancedBiometricsState.value } - if ($null -ne $Settings.enhancedSignInSecurity) { - $ExpectedValue | Add-Member -NotePropertyName enhancedSignInSecurity -NotePropertyValue $EnhancedSignInSecurity - } - - if ($null -ne $Settings.securityKeyForSignIn) { - $ExpectedValue | Add-Member -NotePropertyName securityKeyForSignIn -NotePropertyValue $Settings.securityKeyForSignIn.value - } - if ($Settings.remediate -eq $true) { if ($StateIsCorrect -eq $true) { Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'EnrollmentWindowsHelloForBusinessConfiguration is already applied correctly.' -Sev Info @@ -153,8 +130,6 @@ function Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration { pinPreviousBlockCount = $Settings.pinPreviousBlockCount pinExpirationInDays = $Settings.pinExpirationInDays enhancedBiometricsState = $Settings.enhancedBiometricsState.value - enhancedSignInSecurity = ($EnhancedSignInSecurity ?? $CurrentState.enhancedSignInSecurity) - securityKeyForSignIn = ($Settings.securityKeyForSignIn.value ?? $CurrentState.securityKeyForSignIn) } | ConvertTo-Json -Compress -Depth 10 } try { diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExchangeConnectorTemplate.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExchangeConnectorTemplate.ps1 index 0cca444ddd..ac6672dc0d 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExchangeConnectorTemplate.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExchangeConnectorTemplate.ps1 @@ -31,7 +31,7 @@ function Invoke-CIPPStandardExchangeConnectorTemplate { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) $TestResult = Test-CIPPStandardLicense -StandardName 'ExConnector' -TenantFilter $Tenant -Preset Exchange #No Foundation because that does not allow powershell access diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExcludedfileExt.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExcludedfileExt.ps1 index e3f87a6861..4040c73066 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExcludedfileExt.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExcludedfileExt.ps1 @@ -35,7 +35,7 @@ function Invoke-CIPPStandardExcludedfileExt { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFocusedInbox.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFocusedInbox.ps1 index 7b212193d9..3808b34655 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFocusedInbox.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFocusedInbox.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardFocusedInbox { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGlobalQuarantineNotifications.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGlobalQuarantineNotifications.ps1 index 4e4ab96bb6..25ad04ef4a 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGlobalQuarantineNotifications.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGlobalQuarantineNotifications.ps1 @@ -31,7 +31,7 @@ function Invoke-CIPPStandardGlobalQuarantineNotifications { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param ($Tenant, $Settings) $TestResult = Test-CIPPStandardLicense -StandardName 'GlobalQuarantineNotifications' -TenantFilter $Tenant -Preset Exchange #No Foundation because that does not allow powershell access diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGlobalQuarantineSettings.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGlobalQuarantineSettings.ps1 index 912e917221..706d9af20a 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGlobalQuarantineSettings.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGlobalQuarantineSettings.ps1 @@ -37,7 +37,7 @@ function Invoke-CIPPStandardGlobalQuarantineSettings { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) $TestResult = Test-CIPPStandardLicense -StandardName 'QuarantineTemplate' -TenantFilter $Tenant -Preset Exchange #No Foundation because that does not allow powershell access diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGroupTemplate.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGroupTemplate.ps1 index 447e249335..39f3dc41a2 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGroupTemplate.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGroupTemplate.ps1 @@ -31,7 +31,7 @@ function Invoke-CIPPStandardGroupTemplate { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -110,7 +110,7 @@ function Invoke-CIPPStandardGroupTemplate { # Check if Exchange license is required for distribution groups if ($groupobj.groupType -in @('distribution', 'dynamicdistribution')) { - $TestResult = Test-CIPPStandardLicense -StandardName 'GroupTemplate' -TenantFilter $Tenant -Preset Exchange -SkipLog + $TestResult = Test-CIPPStandardLicense -StandardName 'GroupTemplate' -TenantFilter $Tenant -RequiredCapabilities @('EXCHANGE_S_STANDARD', 'EXCHANGE_S_ENTERPRISE', 'EXCHANGE_LITE') -SkipLog if (!$TestResult) { Write-LogMessage -API 'Standards' -tenant $tenant -message "Cannot create group $($groupobj.displayname) as the tenant is not licensed for Exchange." -Sev 'Error' continue @@ -127,8 +127,17 @@ function Invoke-CIPPStandardGroupTemplate { } else { $ActionType = 'update' + # Extract groupType value - handle both string and object with .value property + $GroupTypeValue = if ($groupobj.groupType.value) { + $groupobj.groupType.value + } elseif ($groupobj.groupType -is [string]) { + $groupobj.groupType + } else { + [string]$groupobj.groupType + } + # Normalize group type like New-CIPPGroup does - $NormalizedGroupType = switch -Wildcard ($groupobj.groupType.ToLower()) { + $NormalizedGroupType = switch -Wildcard ($GroupTypeValue.ToLower()) { '*dynamicdistribution*' { 'DynamicDistribution'; break } '*dynamic*' { 'Dynamic'; break } '*generic*' { 'Generic'; break } @@ -177,7 +186,7 @@ function Invoke-CIPPStandardGroupTemplate { } else { # Handle Exchange Online groups (Distribution, DynamicDistribution) - $TestResult = Test-CIPPStandardLicense -StandardName 'GroupTemplate' -TenantFilter $Tenant -Preset Exchange -SkipLog + $TestResult = Test-CIPPStandardLicense -StandardName 'GroupTemplate' -TenantFilter $Tenant -RequiredCapabilities @('EXCHANGE_S_STANDARD', 'EXCHANGE_S_ENTERPRISE', 'EXCHANGE_LITE') -SkipLog if (!$TestResult) { Write-LogMessage -API 'Standards' -tenant $tenant -message "Cannot update group $($groupobj.displayName) as the tenant is not licensed for Exchange." -Sev 'Error' continue diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGuestUserRole.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGuestUserRole.ps1 new file mode 100644 index 0000000000..0cd54928b1 --- /dev/null +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGuestUserRole.ps1 @@ -0,0 +1,92 @@ +function Invoke-CIPPStandardGuestUserRole { + <# + .FUNCTIONALITY + Internal + .COMPONENT + (APIName) GuestUserRole + .SYNOPSIS + (Label) Sets the guest user default access level + .DESCRIPTION + (Helptext) Sets the default access level for guest users in the directory. Choose between member-level access, default guest access, or the most restrictive setting that blocks directory enumeration. This is a more flexible alternative to the DisableGuestDirectory standard. + (DocsDescription) Controls what permissions guest users have in the directory. The most restrictive option prevents guests from enumerating users and group memberships. The default option limits guest access but allows basic directory browsing. The least restrictive option gives guests the same access as member users. + .NOTES + CAT + Entra (AAD) Standards + TAG + "EIDSCA.AP14" + EXECUTIVETEXT + Controls the level of directory access granted to external guest users, balancing collaboration needs with security requirements. Setting appropriate guest permissions prevents unauthorized discovery of organizational structure and employee information. + ADDEDCOMPONENT + {"type":"autoComplete","required":true,"multiple":false,"creatable":false,"label":"Guest user access level","name":"standards.GuestUserRole.guestUserRoleId","options":[{"label":"Same access as member users (least restrictive)","value":"a0b1b346-4d3e-4e8b-98f8-753987be4970"},{"label":"Limited access - default guest access","value":"10dae51f-b6af-4016-8d66-8c2a99b929b3"},{"label":"Restricted access - cannot enumerate directory (most restrictive)","value":"2af84b1e-32c8-42b7-82bc-daa82404023b"}]} + IMPACT + Medium Impact + ADDEDDATE + 2026-02-13 + POWERSHELLEQUIVALENT + Update-MgPolicyAuthorizationPolicy + RECOMMENDEDBY + UPDATECOMMENTBLOCK + Run the Tools\Update-StandardsComments.ps1 script to update this comment block + .LINK + https://docs.cipp.app/user-documentation/tenant/standards/list-standards + #> + + param($Tenant, $Settings) + + try { + $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $Tenant + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get GuestUserRole state for $Tenant. Error: $ErrorMessage" -Sev Error + return + } + + $WantedRoleId = $Settings.guestUserRoleId.value ?? $Settings.guestUserRoleId + + if (([string]::IsNullOrWhiteSpace($WantedRoleId) -or $WantedRoleId -eq 'Select a value') -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'GuestUserRole: Invalid guestUserRoleId parameter set' -sev Error + return + } + + $RoleLabels = @{ + 'a0b1b346-4d3e-4e8b-98f8-753987be4970' = 'Same as members' + '10dae51f-b6af-4016-8d66-8c2a99b929b3' = 'Limited access (default)' + '2af84b1e-32c8-42b7-82bc-daa82404023b' = 'Restricted access' + } + $WantedLabel = $RoleLabels[$WantedRoleId] ?? $WantedRoleId + + $StateIsCorrect = ($CurrentState.guestUserRoleId -eq $WantedRoleId) + + if ($Settings.remediate -eq $true) { + if ($StateIsCorrect) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Guest user role is already set to $WantedLabel." -sev Info + } else { + try { + $Body = @{ guestUserRoleId = $WantedRoleId } | ConvertTo-Json -Compress + $null = New-GraphPostRequest -tenantid $Tenant -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -Type PATCH -Body $Body -ContentType 'application/json' + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Set guest user role to $WantedLabel." -sev Info + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to set guest user role to $WantedLabel. Error: $ErrorMessage" -sev Error + } + } + } + + if ($Settings.alert -eq $true) { + if ($StateIsCorrect) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Guest user role is set to $WantedLabel." -sev Info + } else { + $CurrentLabel = $RoleLabels[$CurrentState.guestUserRoleId] ?? $CurrentState.guestUserRoleId + Write-StandardsAlert -message "Guest user role is not set to $WantedLabel (currently: $CurrentLabel)" -object @{ guestUserRoleId = $CurrentState.guestUserRoleId } -tenant $Tenant -standardName 'GuestUserRole' -standardId $Settings.standardId + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Guest user role is not set to $WantedLabel." -sev Info + } + } + + if ($Settings.report -eq $true) { + $CurrentValue = @{ guestUserRoleId = $CurrentState.guestUserRoleId } + $ExpectedValue = @{ guestUserRoleId = $WantedRoleId } + + Set-CIPPStandardsCompareField -FieldName 'standards.GuestUserRole' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant + Add-CIPPBPAField -FieldName 'GuestUserRole' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant + } +} diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneComplianceSettings.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneComplianceSettings.ps1 index 45fa04f16a..91b332c659 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneComplianceSettings.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneComplianceSettings.ps1 @@ -34,7 +34,7 @@ function Invoke-CIPPStandardIntuneComplianceSettings { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneWindowsDiagnostic.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneWindowsDiagnostic.ps1 index b82b044760..924473a76a 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneWindowsDiagnostic.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneWindowsDiagnostic.ps1 @@ -34,7 +34,7 @@ Function Invoke-CIPPStandardIntuneWindowsDiagnostic { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> [CmdletBinding()] param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMDMEnrollmentDuringRegistration.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMDMEnrollmentDuringRegistration.ps1 index ecc6d03391..61913f97e6 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMDMEnrollmentDuringRegistration.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMDMEnrollmentDuringRegistration.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardMDMEnrollmentDuringRegistration { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMDMScope.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMDMScope.ps1 index e129ba20ae..b0fab7ae78 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMDMScope.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMDMScope.ps1 @@ -34,7 +34,7 @@ function Invoke-CIPPStandardMDMScope { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMailContacts.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMailContacts.ps1 index e9f4b09809..da4a39af41 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMailContacts.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMailContacts.ps1 @@ -30,7 +30,7 @@ function Invoke-CIPPStandardMailContacts { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMailboxRecipientLimits.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMailboxRecipientLimits.ps1 index d088a397a9..fdc09cea31 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMailboxRecipientLimits.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMailboxRecipientLimits.ps1 @@ -34,7 +34,7 @@ function Invoke-CIPPStandardMailboxRecipientLimits { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1 index f4d34222e4..e016a35758 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1 @@ -54,7 +54,7 @@ function Invoke-CIPPStandardMalwareFilterPolicy { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMessageExpiration.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMessageExpiration.ps1 index 03bd5dbf86..5e47117be9 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMessageExpiration.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMessageExpiration.ps1 @@ -30,7 +30,7 @@ function Invoke-CIPPStandardMessageExpiration { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -41,8 +41,7 @@ function Invoke-CIPPStandardMessageExpiration { } #we're done. try { - $TransportConfig = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoTransportConfig' | Select-Object -First 1 - $MessageExpiration = $TransportConfig.messageExpiration + $MessageExpiration = (New-ExoRequest -tenantid $Tenant -cmdlet 'Get-TransportConfig').messageExpiration } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the MessageExpiration state for $Tenant. Error: $ErrorMessage" -Sev Error diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1 index feccce2f58..261e01f2a5 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardNudgeMFA { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOMEBranding.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOMEBranding.ps1 index 558d01163e..a295685e51 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOMEBranding.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOMEBranding.ps1 @@ -37,7 +37,7 @@ function Invoke-CIPPStandardOMEBranding { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOWAAttachmentRestrictions.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOWAAttachmentRestrictions.ps1 index 72de963e64..d7430e5eca 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOWAAttachmentRestrictions.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOWAAttachmentRestrictions.ps1 @@ -38,7 +38,7 @@ function Invoke-CIPPStandardOWAAttachmentRestrictions { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1 index 21f818a044..5f2a7917b5 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1 @@ -43,7 +43,7 @@ function Invoke-CIPPStandardOauthConsent { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($tenant, $settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOauthConsentLowSec.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOauthConsentLowSec.ps1 index d9340b2e63..cc187a0052 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOauthConsentLowSec.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOauthConsentLowSec.ps1 @@ -26,7 +26,7 @@ function Invoke-CIPPStandardOauthConsentLowSec { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOutBoundSpamAlert.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOutBoundSpamAlert.ps1 index fcf98050bd..b7b6f2da99 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOutBoundSpamAlert.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOutBoundSpamAlert.ps1 @@ -35,7 +35,7 @@ function Invoke-CIPPStandardOutBoundSpamAlert { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1 index 26f7b65f2d..9e3655d282 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1 @@ -42,13 +42,13 @@ function Invoke-CIPPStandardPWdisplayAppInformationRequiredState { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) try { - $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/microsoftAuthenticator' -tenantid $Tenant -AsApp $True + $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/microsoftAuthenticator' -tenantid $Tenant } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the PWdisplayAppInformationRequiredState state for $Tenant. Error: $ErrorMessage" -Sev Error diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPerUserMFA.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPerUserMFA.ps1 index 5a51ec7a3f..eed9f529ca 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPerUserMFA.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPerUserMFA.ps1 @@ -38,7 +38,7 @@ function Invoke-CIPPStandardPerUserMFA { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -50,6 +50,7 @@ function Invoke-CIPPStandardPerUserMFA { $_.accountEnabled -eq $true -and $_.displayName -ne 'On-Premises Directory Synchronization Service Account' } + $AllUsers = $null } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the PerUserMFA state for $Tenant. Error: $ErrorMessage" -Sev Error diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishProtection.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishProtection.ps1 index 09def9619a..f7bb973e7b 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishProtection.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishProtection.ps1 @@ -33,18 +33,18 @@ function Invoke-CIPPStandardPhishProtection { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) - $TestResult = Test-CIPPStandardLicense -StandardName 'PhishProtection' -TenantFilter $Tenant -Preset Entra -RequiredCapabilities @('OFFICE_BUSINESS') + $TestResult = Test-CIPPStandardLicense -StandardName 'PhishProtection' -TenantFilter $Tenant -RequiredCapabilities @('AAD_PREMIUM', 'AAD_PREMIUM_P2', 'OFFICE_BUSINESS') if ($TestResult -eq $false) { return $true } #we're done. - $TenantId = Get-Tenants -TenantFilter $Tenant + $TenantId = Get-Tenants | Where-Object -Property defaultDomainName -EQ $Tenant $Table = Get-CIPPTable -TableName Config $CippConfig = (Get-CIPPAzDataTableEntity @Table) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishSimSpoofIntelligence.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishSimSpoofIntelligence.ps1 index 9858fd6e0d..95385d1b07 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishSimSpoofIntelligence.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishSimSpoofIntelligence.ps1 @@ -32,7 +32,7 @@ function Invoke-CIPPStandardPhishSimSpoofIntelligence { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishingSimulations.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishingSimulations.ps1 index 1419e7707d..3176feec8d 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishingSimulations.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishingSimulations.ps1 @@ -34,7 +34,7 @@ function Invoke-CIPPStandardPhishingSimulations { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardProfilePhotos.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardProfilePhotos.ps1 index 2828bc5442..bd3b297d6f 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardProfilePhotos.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardProfilePhotos.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardProfilePhotos { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardQuarantineRequestAlert.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardQuarantineRequestAlert.ps1 index d61be32cd1..2a78b39e92 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardQuarantineRequestAlert.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardQuarantineRequestAlert.ps1 @@ -34,7 +34,7 @@ function Invoke-CIPPStandardQuarantineRequestAlert { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param ($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardQuarantineTemplate.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardQuarantineTemplate.ps1 index 337cb11514..63ecc8f0e1 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardQuarantineTemplate.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardQuarantineTemplate.ps1 @@ -44,7 +44,7 @@ function Invoke-CIPPStandardQuarantineTemplate { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -63,14 +63,6 @@ function Invoke-CIPPStandardQuarantineTemplate { # Compare the settings from standard with the current policies $CompareList = foreach ($Policy in $Settings) { try { - # displayName comes from an autoComplete, so it is normally an object with a .value. - # Drift remediation and hand-built templates can pass it as a plain string. - $PolicyDisplayName = $Policy.displayName.value ?? [string]$Policy.displayName - if ([string]::IsNullOrWhiteSpace($PolicyDisplayName)) { - Write-LogMessage -API $APIName -tenant $Tenant -message 'Skipping a Quarantine policy entry with no display name.' -sev 'Warning' - continue - } - # Create hashtable with desired Quarantine Setting $EndUserQuarantinePermissions = @{ # ViewHeader and Download are set to false because the value 0 or 1 does nothing per Microsoft documentation @@ -85,13 +77,13 @@ function Invoke-CIPPStandardQuarantineTemplate { } # If the Quarantine Policy already exists - if ($PolicyDisplayName -in $CurrentPolicies.Name) { + if ($Policy.displayName.value -in $CurrentPolicies.Name) { #Get the current policy and convert EndUserQuarantinePermissions from string to hashtable for compare - $ExistingPolicy = $CurrentPolicies | Where-Object -Property Name -EQ $PolicyDisplayName + $ExistingPolicy = $CurrentPolicies | Where-Object -Property Name -EQ $Policy.displayName.value $ExistingPolicyEndUserQuarantinePermissions = Convert-QuarantinePermissionsValue -InputObject $ExistingPolicy.EndUserQuarantinePermissions -ErrorAction Stop #Compare the current policy - $StateIsCorrect = ($ExistingPolicy.Name -eq $PolicyDisplayName) -and + $StateIsCorrect = ($ExistingPolicy.Name -eq $Policy.displayName.value) -and ($ExistingPolicy.ESNEnabled -eq $Policy.ESNEnabled) -and ($ExistingPolicy.IncludeMessagesFromBlockedSenderAddress -eq $Policy.IncludeMessagesFromBlockedSenderAddress) -and (!(Compare-Object @($ExistingPolicyEndUserQuarantinePermissions.values) @($EndUserQuarantinePermissions.values))) @@ -102,7 +94,7 @@ function Invoke-CIPPStandardQuarantineTemplate { missing = $false StateIsCorrect = $StateIsCorrect Action = 'None' - displayName = $PolicyDisplayName + displayName = $Policy.displayName.value EndUserQuarantinePermissions = $EndUserQuarantinePermissions ESNEnabled = $Policy.ESNEnabled IncludeMessagesFromBlockedSenderAddress = $Policy.IncludeMessagesFromBlockedSenderAddress @@ -117,7 +109,7 @@ function Invoke-CIPPStandardQuarantineTemplate { missing = $false StateIsCorrect = $StateIsCorrect Action = 'Update' - displayName = $PolicyDisplayName + displayName = $Policy.displayName.value EndUserQuarantinePermissions = $EndUserQuarantinePermissions ESNEnabled = $Policy.ESNEnabled IncludeMessagesFromBlockedSenderAddress = $Policy.IncludeMessagesFromBlockedSenderAddress @@ -133,7 +125,7 @@ function Invoke-CIPPStandardQuarantineTemplate { missing = $true StateIsCorrect = $false Action = 'Create' - displayName = $PolicyDisplayName + displayName = $Policy.displayName.value EndUserQuarantinePermissions = $EndUserQuarantinePermissions ESNEnabled = $Policy.ESNEnabled IncludeMessagesFromBlockedSenderAddress = $Policy.IncludeMessagesFromBlockedSenderAddress @@ -144,7 +136,7 @@ function Invoke-CIPPStandardQuarantineTemplate { } } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - $Message = "Failed to compare Quarantine policy $PolicyDisplayName, Error: $ErrorMessage" + $Message = "Failed to compare Quarantine policy $($Policy.displayName.value), Error: $ErrorMessage" Write-LogMessage -API $APIName -tenant $tenant -message $Message -sev 'Error' return $Message } diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRestrictThirdPartyStorageServices.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRestrictThirdPartyStorageServices.ps1 index 0a87a5983c..a9831be376 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRestrictThirdPartyStorageServices.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRestrictThirdPartyStorageServices.ps1 @@ -36,7 +36,7 @@ function Invoke-CIPPStandardRestrictThirdPartyStorageServices { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param ($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionPolicyTag.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionPolicyTag.ps1 index 0d76e2540f..5b312630aa 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionPolicyTag.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionPolicyTag.ps1 @@ -34,7 +34,7 @@ function Invoke-CIPPStandardRetentionPolicyTag { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRotateDKIM.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRotateDKIM.ps1 index 74a7698828..f49c9e3417 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRotateDKIM.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRotateDKIM.ps1 @@ -35,7 +35,7 @@ function Invoke-CIPPStandardRotateDKIM { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPAzureB2B.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPAzureB2B.ps1 index a3d24d8356..0e0ca9d684 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPAzureB2B.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPAzureB2B.ps1 @@ -36,7 +36,7 @@ function Invoke-CIPPStandardSPAzureB2B { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDirectSharing.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDirectSharing.ps1 index 6b728761e7..57c8bee3ec 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDirectSharing.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDirectSharing.ps1 @@ -36,7 +36,7 @@ function Invoke-CIPPStandardSPDirectSharing { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableCustomScripts.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableCustomScripts.ps1 index 7348436374..d8b15f748a 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableCustomScripts.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableCustomScripts.ps1 @@ -35,7 +35,7 @@ function Invoke-CIPPStandardSPDisableCustomScripts { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableLegacyWorkflows.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableLegacyWorkflows.ps1 index 144250ccfa..a028c6e318 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableLegacyWorkflows.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableLegacyWorkflows.ps1 @@ -34,7 +34,7 @@ function Invoke-CIPPStandardSPDisableLegacyWorkflows { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) $TestResult = Test-CIPPStandardLicense -StandardName 'SPDisableLegacyWorkflows' -TenantFilter $Tenant -Preset SharePoint diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableStoreAccess.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableStoreAccess.ps1 index b034a89d4d..65f0165ca6 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableStoreAccess.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableStoreAccess.ps1 @@ -35,7 +35,7 @@ function Invoke-CIPPStandardSPDisableStoreAccess { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisallowInfectedFiles.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisallowInfectedFiles.ps1 index 0716abaf1c..954a0052d8 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisallowInfectedFiles.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisallowInfectedFiles.ps1 @@ -40,7 +40,7 @@ function Invoke-CIPPStandardSPDisallowInfectedFiles { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPEmailAttestation.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPEmailAttestation.ps1 index c3577b71f9..ace93228b4 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPEmailAttestation.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPEmailAttestation.ps1 @@ -41,7 +41,7 @@ function Invoke-CIPPStandardSPEmailAttestation { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPExternalUserExpiration.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPExternalUserExpiration.ps1 index 0aaecff1fe..0383c64e03 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPExternalUserExpiration.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPExternalUserExpiration.ps1 @@ -41,7 +41,7 @@ function Invoke-CIPPStandardSPExternalUserExpiration { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPFileRequests.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPFileRequests.ps1 index ca43b3eed3..b270d0ef30 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPFileRequests.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPFileRequests.ps1 @@ -37,7 +37,7 @@ function Invoke-CIPPStandardSPFileRequests { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1 index a694ca4d96..20ed666ca7 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1 @@ -128,7 +128,7 @@ function Invoke-CIPPStandardSPOVersionControl { @{ Type = 'Int32'; Value = $DesiredExpireVersionsAfterDays } ) } - $CurrentState | Set-CIPPSPOTenant -MethodName 'SetFileVersionPolicy' -MethodParameters $MethodParams -UseCertificate + $null = $CurrentState | Set-CIPPSPOTenant -MethodName 'SetFileVersionPolicy' -MethodParameters $MethodParams -UseCertificate Write-LogMessage -API 'Standards' -tenant $Tenant -message "Successfully configured SharePoint version control ($ExpectedDescription)" -sev Info # Apply to all existing sites and their document libraries @@ -136,13 +136,17 @@ function Invoke-CIPPStandardSPOVersionControl { $Sites = @(New-GraphGetRequest -uri "https://graph.microsoft.com/beta/sites/getAllSites?`$select=webUrl&`$top=999" -tenantid $Tenant -AsApp $true) Write-LogMessage -API 'Standards' -tenant $Tenant -message "Applying version policy to $($Sites.Count) existing sites" -sev Info + # SharePoint only queues the existing-library job for an explicit policy; leaving out ApplyToNewDocumentLibraries keeps new libraries inheriting the tenant $SiteProperties = @{ - InheritVersionPolicyFromTenant = $true + InheritVersionPolicyFromTenant = $false EnableAutoExpirationVersionTrim = $DesiredAutoTrim - ApplyToNewDocumentLibraries = $true ApplyToExistingDocumentLibraries = $true } - if (-not $DesiredAutoTrim) { + if ($DesiredAutoTrim) { + $SiteProperties.MajorVersionLimit = -1 + $SiteProperties.ExpireVersionsAfterDays = -1 + $SiteProperties.MajorWithMinorVersionsLimit = -1 + } else { $SiteProperties.MajorVersionLimit = $DesiredMajorVersionLimit $SiteProperties.ExpireVersionsAfterDays = $DesiredExpireVersionsAfterDays } @@ -154,7 +158,7 @@ function Invoke-CIPPStandardSPOVersionControl { foreach ($FailedSite in $FailedSites) { Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to set version policy for site $($FailedSite.SiteUrl): $($FailedSite.Error)" -sev Error } - Write-LogMessage -API 'Standards' -tenant $Tenant -message "Finished applying version policy to $($Sites.Count - $FailedSites.Count) of $($Sites.Count) existing sites" -sev Info + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Queued the version policy for existing document libraries on $($Sites.Count - $FailedSites.Count) of $($Sites.Count) sites. SharePoint applies it in the background, which can take up to 24 hours." -sev Info } } catch { $ErrorMessage = Get-CippException -Exception $_ diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPSyncButtonState.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPSyncButtonState.ps1 index 1216c72a8f..664df45548 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPSyncButtonState.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPSyncButtonState.ps1 @@ -35,7 +35,7 @@ function Invoke-CIPPStandardSPSyncButtonState { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1 index caa4121bf5..17d986547e 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1 @@ -43,7 +43,7 @@ function Invoke-CIPPStandardSafeAttachmentPolicy { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -53,165 +53,180 @@ function Invoke-CIPPStandardSafeAttachmentPolicy { return $true } #we're done. - $MDOTestResult = Test-CIPPStandardLicense -StandardName 'SafeAttachmentPolicy' -TenantFilter $Tenant -Preset DefenderForOffice365 - - if ($MDOTestResult -eq $false) { - return $true - } #tenant lacks Microsoft Defender for Office 365 — Test-CIPPStandardLicense logs and sets LicenseAvailable=false. - - # Cache all Safe Attachment Policies to avoid duplicate API calls - try { - $AllSafeAttachmentPolicies = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-SafeAttachmentPolicy' - } catch { - $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SafeAttachmentPolicy state for $Tenant. Error: $ErrorMessage" -Sev Error - return - } - # Cache all Safe Attachment Rules to avoid duplicate API calls - try { - $AllSafeAttachmentRule = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-SafeAttachmentRule' - } catch { - $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message - Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SafeAttachmentRule state for $Tenant. Error: $ErrorMessage" -Sev Error - return - } + $TenantCapabilities = Get-CIPPTenantCapabilities -TenantFilter $Tenant + $MDOLicensed = $TenantCapabilities.ATP_ENTERPRISE -eq $true + + if ($MDOLicensed) { + # Cache all Safe Attachment Policies to avoid duplicate API calls + try { + $AllSafeAttachmentPolicies = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-SafeAttachmentPolicy' + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SafeAttachmentPolicy state for $Tenant. Error: $ErrorMessage" -Sev Error + return + } + # Cache all Safe Attachment Rules to avoid duplicate API calls + try { + $AllSafeAttachmentRule = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-SafeAttachmentRule' + } catch { + $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message + Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SafeAttachmentRule state for $Tenant. Error: $ErrorMessage" -Sev Error + return + } - # Use custom name if provided, otherwise use default for backward compatibility - $PolicyName = if ($Settings.name) { $Settings.name } else { 'CIPP Default Safe Attachment Policy' } - $PolicyList = @($PolicyName, 'CIPP Default Safe Attachment Policy', 'Default Safe Attachment Policy') - $ExistingPolicy = $AllSafeAttachmentPolicies | Where-Object -Property Name -In $PolicyList | Select-Object -First 1 - if ($null -eq $ExistingPolicy.Name) { - # No existing policy - use the configured/default name + # Use custom name if provided, otherwise use default for backward compatibility $PolicyName = if ($Settings.name) { $Settings.name } else { 'CIPP Default Safe Attachment Policy' } - } else { - # Use existing policy name if found - $PolicyName = $ExistingPolicy.Name - } - # Derive rule name from policy name, but check for old names for backward compatibility - $DesiredRuleName = "$PolicyName Rule" - $RuleList = @($DesiredRuleName, 'CIPP Default Safe Attachment Rule', 'CIPP Default Safe Attachment Policy') - $ExistingRule = $AllSafeAttachmentRule | Where-Object -Property Name -In $RuleList | Select-Object -First 1 - if ($null -eq $ExistingRule.Name) { - # No existing rule - use the derived name - $RuleName = $DesiredRuleName - } else { - # Use existing rule name if found - $RuleName = $ExistingRule.Name - } + $PolicyList = @($PolicyName, 'CIPP Default Safe Attachment Policy', 'Default Safe Attachment Policy') + $ExistingPolicy = $AllSafeAttachmentPolicies | Where-Object -Property Name -In $PolicyList | Select-Object -First 1 + if ($null -eq $ExistingPolicy.Name) { + # No existing policy - use the configured/default name + $PolicyName = if ($Settings.name) { $Settings.name } else { 'CIPP Default Safe Attachment Policy' } + } else { + # Use existing policy name if found + $PolicyName = $ExistingPolicy.Name + } + # Derive rule name from policy name, but check for old names for backward compatibility + $DesiredRuleName = "$PolicyName Rule" + $RuleList = @($DesiredRuleName, 'CIPP Default Safe Attachment Rule', 'CIPP Default Safe Attachment Policy') + $ExistingRule = $AllSafeAttachmentRule | Where-Object -Property Name -In $RuleList | Select-Object -First 1 + if ($null -eq $ExistingRule.Name) { + # No existing rule - use the derived name + $RuleName = $DesiredRuleName + } else { + # Use existing rule name if found + $RuleName = $ExistingRule.Name + } - $CurrentState = $AllSafeAttachmentPolicies | - Where-Object -Property Name -EQ $PolicyName | - Select-Object Name, Enable, Action, QuarantineTag, Redirect, RedirectAddress + $CurrentState = $AllSafeAttachmentPolicies | + Where-Object -Property Name -EQ $PolicyName | + Select-Object Name, Enable, Action, QuarantineTag, Redirect, RedirectAddress - $StateIsCorrect = ($CurrentState.Name -eq $PolicyName) -and - ($CurrentState.Enable -eq $true) -and - ($CurrentState.Action -eq $Settings.SafeAttachmentAction) -and - ($CurrentState.QuarantineTag -eq $Settings.QuarantineTag) -and - ($CurrentState.Redirect -eq $Settings.Redirect) -and - (($null -eq $Settings.RedirectAddress) -or ($CurrentState.RedirectAddress -eq $Settings.RedirectAddress)) + $StateIsCorrect = ($CurrentState.Name -eq $PolicyName) -and + ($CurrentState.Enable -eq $true) -and + ($CurrentState.Action -eq $Settings.SafeAttachmentAction) -and + ($CurrentState.QuarantineTag -eq $Settings.QuarantineTag) -and + ($CurrentState.Redirect -eq $Settings.Redirect) -and + (($null -eq $Settings.RedirectAddress) -or ($CurrentState.RedirectAddress -eq $Settings.RedirectAddress)) - $AcceptedDomains = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-AcceptedDomain' + $AcceptedDomains = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-AcceptedDomain' - $RuleState = $AllSafeAttachmentRule | + $RuleState = $AllSafeAttachmentRule | Where-Object -Property Name -EQ $RuleName | Select-Object Name, SafeAttachmentPolicy, Priority, RecipientDomainIs - $RuleStateIsCorrect = ($RuleState.Name -eq $RuleName) -and - ($RuleState.SafeAttachmentPolicy -eq $PolicyName) -and - ($RuleState.Priority -eq 0) -and - (!(Compare-Object -ReferenceObject $RuleState.RecipientDomainIs -DifferenceObject $AcceptedDomains.Name)) + $RuleStateIsCorrect = ($RuleState.Name -eq $RuleName) -and + ($RuleState.SafeAttachmentPolicy -eq $PolicyName) -and + ($RuleState.Priority -eq 0) -and + (!(Compare-Object -ReferenceObject $RuleState.RecipientDomainIs -DifferenceObject $AcceptedDomains.Name)) - if ($Settings.remediate -eq $true) { + if ($Settings.remediate -eq $true) { - if ($StateIsCorrect -eq $true) { - Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Safe Attachment Policy already correctly configured' -sev Info - } else { - $cmdParams = @{ - Enable = $true - Action = $Settings.SafeAttachmentAction - QuarantineTag = $Settings.QuarantineTag - Redirect = $Settings.Redirect - RedirectAddress = $Settings.RedirectAddress - } - - if ($CurrentState.Name -eq $PolicyName) { - try { - $cmdParams.Add('Identity', $PolicyName) - New-ExoRequest -tenantid $Tenant -cmdlet 'Set-SafeAttachmentPolicy' -cmdParams $cmdParams -UseSystemMailbox $true - Write-LogMessage -API 'Standards' -tenant $Tenant -message "Updated Safe Attachment policy $PolicyName." -sev Info - } catch { - Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to update Safe Attachment policy $PolicyName." -sev Error -LogData $_ - } + if ($StateIsCorrect -eq $true) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Safe Attachment Policy already correctly configured' -sev Info } else { - try { - $cmdParams.Add('Name', $PolicyName) - New-ExoRequest -tenantid $Tenant -cmdlet 'New-SafeAttachmentPolicy' -cmdParams $cmdParams -UseSystemMailbox $true - Write-LogMessage -API 'Standards' -tenant $Tenant -message "Created Safe Attachment policy $PolicyName." -sev Info - } catch { - Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to create Safe Attachment policy $PolicyName." -sev Error -LogData $_ + $cmdParams = @{ + Enable = $true + Action = $Settings.SafeAttachmentAction + QuarantineTag = $Settings.QuarantineTag + Redirect = $Settings.Redirect + RedirectAddress = $Settings.RedirectAddress } - } - } - if ($RuleStateIsCorrect -eq $false) { - $cmdParams = @{ - Priority = 0 - RecipientDomainIs = ConvertTo-SafeArray -Field $AcceptedDomains.Name + if ($CurrentState.Name -eq $PolicyName) { + try { + $cmdParams.Add('Identity', $PolicyName) + New-ExoRequest -tenantid $Tenant -cmdlet 'Set-SafeAttachmentPolicy' -cmdParams $cmdParams -UseSystemMailbox $true + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Updated Safe Attachment policy $PolicyName." -sev Info + } catch { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to update Safe Attachment policy $PolicyName." -sev Error -LogData $_ + } + } else { + try { + $cmdParams.Add('Name', $PolicyName) + New-ExoRequest -tenantid $Tenant -cmdlet 'New-SafeAttachmentPolicy' -cmdParams $cmdParams -UseSystemMailbox $true + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Created Safe Attachment policy $PolicyName." -sev Info + } catch { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to create Safe Attachment policy $PolicyName." -sev Error -LogData $_ + } + } } - if ($RuleState.SafeAttachmentPolicy -ne $PolicyName) { - $cmdParams.Add('SafeAttachmentPolicy', $PolicyName) - } + if ($RuleStateIsCorrect -eq $false) { + $cmdParams = @{ + Priority = 0 + RecipientDomainIs = ConvertTo-SafeArray -Field $AcceptedDomains.Name + } - if ($RuleState.Name -eq $RuleName) { - try { - $cmdParams.Add('Identity', $RuleName) - New-ExoRequest -tenantid $Tenant -cmdlet 'Set-SafeAttachmentRule' -cmdParams $cmdParams -UseSystemMailbox $true - Write-LogMessage -API 'Standards' -tenant $Tenant -message "Updated Safe Attachment rule $RuleName." -sev Info - } catch { - Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to update Safe Attachment rule $RuleName." -sev Error -LogData $_ + if ($RuleState.SafeAttachmentPolicy -ne $PolicyName) { + $cmdParams.Add('SafeAttachmentPolicy', $PolicyName) } - } else { - try { - $cmdParams.Add('Name', $RuleName) - New-ExoRequest -tenantid $Tenant -cmdlet 'New-SafeAttachmentRule' -cmdParams $cmdParams -UseSystemMailbox $true - Write-LogMessage -API 'Standards' -tenant $Tenant -message "Created Safe Attachment rule $RuleName." -sev Info - } catch { - Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to create Safe Attachment rule $RuleName." -sev Error -LogData $_ + + if ($RuleState.Name -eq $RuleName) { + try { + $cmdParams.Add('Identity', $RuleName) + New-ExoRequest -tenantid $Tenant -cmdlet 'Set-SafeAttachmentRule' -cmdParams $cmdParams -UseSystemMailbox $true + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Updated Safe Attachment rule $RuleName." -sev Info + } catch { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to update Safe Attachment rule $RuleName." -sev Error -LogData $_ + } + } else { + try { + $cmdParams.Add('Name', $RuleName) + New-ExoRequest -tenantid $Tenant -cmdlet 'New-SafeAttachmentRule' -cmdParams $cmdParams -UseSystemMailbox $true + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Created Safe Attachment rule $RuleName." -sev Info + } catch { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to create Safe Attachment rule $RuleName." -sev Error -LogData $_ + } } } } - } - if ($Settings.alert -eq $true) { + if ($Settings.alert -eq $true) { - if ($StateIsCorrect -eq $true) { - Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Safe Attachment Policy is enabled' -sev Info - } else { - Write-StandardsAlert -message 'Safe Attachment Policy is not enabled' -object $CurrentState -tenant $Tenant -standardName 'SafeAttachmentPolicy' -standardId $Settings.standardId - Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Safe Attachment Policy is not enabled' -sev Info + if ($StateIsCorrect -eq $true) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Safe Attachment Policy is enabled' -sev Info + } else { + Write-StandardsAlert -message 'Safe Attachment Policy is not enabled' -object $CurrentState -tenant $Tenant -standardName 'SafeAttachmentPolicy' -standardId $Settings.standardId + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Safe Attachment Policy is not enabled' -sev Info + } } - } - if ($Settings.report -eq $true) { + if ($Settings.report -eq $true) { + Add-CIPPBPAField -FieldName 'SafeAttachmentPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant + + $CurrentValue = @{ + name = $CurrentState.Name + enable = $CurrentState.Enable + action = $CurrentState.Action + quarantineTag = $CurrentState.QuarantineTag + redirect = $CurrentState.Redirect + redirectAddress = $CurrentState.RedirectAddress + } + + $ExpectedValue = @{ + name = $PolicyName + enable = $true + action = $Settings.SafeAttachmentAction + quarantineTag = $Settings.QuarantineTag + redirect = $Settings.Redirect + redirectAddress = "$($Settings.RedirectAddress)" + } + Set-CIPPStandardsCompareField -FieldName 'standards.SafeAttachmentPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant + } + } else { + if ($Settings.remediate -eq $true) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Failed to create Safe Attachment policy: Tenant does not have Microsoft Defender for Office 365 license' -sev Error + } - $CurrentValue = @{ - name = $CurrentState.Name - enable = $CurrentState.Enable - action = $CurrentState.Action - quarantineTag = $CurrentState.QuarantineTag - redirect = $CurrentState.Redirect - redirectAddress = $CurrentState.RedirectAddress + if ($Settings.alert -eq $true) { + Write-StandardsAlert -message 'Safe Attachment Policy is not enabled: Tenant does not have Microsoft Defender for Office 365 license' -object $MDOLicensed -tenant $Tenant -standardName 'SafeAttachmentPolicy' -standardId $Settings.standardId + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Safe Attachment Policy is not enabled: Tenant does not have Microsoft Defender for Office 365 license' -sev Info } - $ExpectedValue = @{ - name = $PolicyName - enable = $true - action = $Settings.SafeAttachmentAction - quarantineTag = $Settings.QuarantineTag - redirect = $Settings.Redirect - redirectAddress = "$($Settings.RedirectAddress)" + if ($Settings.report -eq $true) { + $state = @{ License = 'Failed to set policy: This tenant might not be licensed for this feature' } + Add-CIPPBPAField -FieldName 'SafeAttachmentPolicy' -FieldValue $false -StoreAs bool -Tenant $tenant + Set-CIPPStandardsCompareField -FieldName 'standards.SafeAttachmentPolicy' -FieldValue $state -Tenant $Tenant } - Set-CIPPStandardsCompareField -FieldName 'standards.SafeAttachmentPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant } } diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksTemplatePolicy.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksTemplatePolicy.ps1 index f3514da94b..64891fc578 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksTemplatePolicy.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksTemplatePolicy.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardSafeLinksTemplatePolicy { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -45,10 +45,10 @@ function Invoke-CIPPStandardSafeLinksTemplatePolicy { Write-LogMessage -API 'Standards' -tenant $Tenant -message "Processing SafeLinks template with settings: $($Settings | ConvertTo-Json -Compress)" -sev Debug - $MDOTestResult = Test-CIPPStandardLicense -StandardName 'SafeLinksTemplatePolicy' -TenantFilter $Tenant -Preset DefenderForOffice365 - if ($MDOTestResult -eq $false) { + # Verify tenant has necessary license + if (-not (Test-MDOLicense -Tenant $Tenant -Settings $Settings)) { return - } #tenant lacks Microsoft Defender for Office 365 — Test-CIPPStandardLicense logs and sets LicenseAvailable=false. + } # Normalize template list property $TemplateList = Get-NormalizedTemplateList -Settings $Settings @@ -71,6 +71,35 @@ function Invoke-CIPPStandardSafeLinksTemplatePolicy { } } +function Test-MDOLicense { + param($Tenant, $Settings) + + $TenantCapabilities = Get-CIPPTenantCapabilities -TenantFilter $Tenant + $MDOLicensed = $TenantCapabilities.ATP_ENTERPRISE -eq $true + + if (-not $MDOLicensed) { + $Message = 'Tenant does not have Microsoft Defender for Office 365 license' + + if ($Settings.remediate -eq $true) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to apply SafeLinks templates: $Message" -sev Error + } + + if ($Settings.alert -eq $true) { + Write-StandardsAlert -message "SafeLinks templates could not be applied: $Message" -object $MDOLicensed -tenant $Tenant -standardName 'SafeLinksTemplatePolicy' -standardId $Settings.standardId + Write-LogMessage -API 'Standards' -tenant $Tenant -message "SafeLinks templates could not be applied: $Message" -sev Info + } + + if ($Settings.report -eq $true) { + Add-CIPPBPAField -FieldName 'SafeLinksTemplatePolicy' -FieldValue $false -StoreAs bool -Tenant $Tenant + Set-CIPPStandardsCompareField -FieldName 'standards.SafeLinksTemplatePolicy' -FieldValue $false -Tenant $Tenant + } + + return $false + } + + return $true +} + function Get-NormalizedTemplateList { param($Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeSendersDisable.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeSendersDisable.ps1 index de271d07ab..7252c9623a 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeSendersDisable.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeSendersDisable.ps1 @@ -35,7 +35,7 @@ function Invoke-CIPPStandardSafeSendersDisable { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSecureScoreRemediation.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSecureScoreRemediation.ps1 index 8ea46d6c33..4159a29b46 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSecureScoreRemediation.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSecureScoreRemediation.ps1 @@ -28,7 +28,7 @@ function Invoke-CIPPStandardSecureScoreRemediation { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSendFromAlias.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSendFromAlias.ps1 index 6a7fa70fb6..83d5c6a68e 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSendFromAlias.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSendFromAlias.ps1 @@ -34,7 +34,7 @@ function Invoke-CIPPStandardSendFromAlias { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSendReceiveLimitTenant.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSendReceiveLimitTenant.ps1 index 4a1a6ffa33..f14904d494 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSendReceiveLimitTenant.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSendReceiveLimitTenant.ps1 @@ -34,7 +34,7 @@ function Invoke-CIPPStandardSendReceiveLimitTenant { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardShortenMeetings.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardShortenMeetings.ps1 index 54fcf82730..9d80d930a1 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardShortenMeetings.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardShortenMeetings.ps1 @@ -35,7 +35,7 @@ function Invoke-CIPPStandardShortenMeetings { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpoofWarn.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpoofWarn.ps1 index 21fd5bdfd0..0215f24813 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpoofWarn.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpoofWarn.ps1 @@ -40,7 +40,7 @@ function Invoke-CIPPStandardSpoofWarn { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -70,7 +70,7 @@ function Invoke-CIPPStandardSpoofWarn { # Test if all entries in the AllowListAdd variable are in the AllowList $AllowListCorrect = $true - if ($null -eq $AllowListAdd -or $AllowListAdd.Count -eq 0) { + if ($AllowListAdd -eq $null -or $AllowListAdd.Count -eq 0) { $AllowListAdd = @{'@odata.type' = '#Exchange.GenericHashTable'; Add = @() } } else { $AllowListAddEntries = foreach ($entry in $AllowListAdd) { diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardStaleEntraDevices.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardStaleEntraDevices.ps1 index 5e6a8177e3..5cfac6a20d 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardStaleEntraDevices.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardStaleEntraDevices.ps1 @@ -34,7 +34,7 @@ function Invoke-CIPPStandardStaleEntraDevices { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTAP.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTAP.ps1 index f9d47d0c01..dff155863a 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTAP.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTAP.ps1 @@ -37,7 +37,7 @@ function Invoke-CIPPStandardTAP { UPDATECOMMENTBLOCK Run the tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsChatProtection.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsChatProtection.ps1 index 2e3e899dd8..50c822ae1c 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsChatProtection.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsChatProtection.ps1 @@ -35,7 +35,7 @@ function Invoke-CIPPStandardTeamsChatProtection { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsEmailIntegration.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsEmailIntegration.ps1 index 0a81f12698..f7fd7c7ec0 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsEmailIntegration.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsEmailIntegration.ps1 @@ -35,7 +35,7 @@ function Invoke-CIPPStandardTeamsEmailIntegration { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsEnrollUser.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsEnrollUser.ps1 index f86b1cb2e6..3b9aae3853 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsEnrollUser.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsEnrollUser.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardTeamsEnrollUser { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalAccessPolicy.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalAccessPolicy.ps1 index 922bae79dd..e0413d9a97 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalAccessPolicy.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalAccessPolicy.ps1 @@ -35,7 +35,7 @@ function Invoke-CIPPStandardTeamsExternalAccessPolicy { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalChatWithAnyone.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalChatWithAnyone.ps1 index 1218ae3c6a..04875b41a8 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalChatWithAnyone.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalChatWithAnyone.ps1 @@ -34,7 +34,7 @@ function Invoke-CIPPStandardTeamsExternalChatWithAnyone { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalFileSharing.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalFileSharing.ps1 index 04221175b1..06afaadb93 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalFileSharing.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalFileSharing.ps1 @@ -39,7 +39,7 @@ function Invoke-CIPPStandardTeamsExternalFileSharing { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsFilesPolicy.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsFilesPolicy.ps1 new file mode 100644 index 0000000000..4bff3d6fa6 --- /dev/null +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsFilesPolicy.ps1 @@ -0,0 +1,96 @@ +function Invoke-CIPPStandardTeamsFilesPolicy { + <# + .FUNCTIONALITY + Internal + .COMPONENT + (APIName) TeamsFilesPolicy + .SYNOPSIS + (Label) Global Files Policy for Microsoft Teams + .DESCRIPTION + (Helptext) Sets the properties of the Global Teams files policy, including file sharing in external (federated) chats. + (DocsDescription) Sets the properties of the Global Teams files policy. File sharing in external chats controls whether users can attach files in 1:1, group and meeting chats with people from other organizations. Native file entry points controls the OneDrive and SharePoint attach options in chats and channels, and SharePoint channel files tab controls the SharePoint Files tab in channels. + .NOTES + CAT + Teams Standards + TAG + EXECUTIVETEXT + Controls whether employees can attach files directly in Microsoft Teams chats with people outside the organization. Microsoft is enabling this by default for all tenants, including those that had turned it off, so managing it as a standard keeps the organization's chosen external sharing posture in place. + ADDEDCOMPONENT + {"type":"autoComplete","multiple":false,"creatable":false,"name":"standards.TeamsFilesPolicy.FileSharingInChatsWithExternalUsers","label":"File sharing in external chats","options":[{"label":"Don't change","value":"donotconfigure"},{"label":"Enabled","value":"Enabled"},{"label":"Disabled","value":"Disabled"}],"defaultValue":"Disabled"} + {"type":"autoComplete","multiple":false,"creatable":false,"name":"standards.TeamsFilesPolicy.NativeFileEntryPoints","label":"OneDrive and SharePoint file entry points","options":[{"label":"Don't change","value":"donotconfigure"},{"label":"Enabled","value":"Enabled"},{"label":"Disabled","value":"Disabled"}],"defaultValue":"donotconfigure"} + {"type":"autoComplete","multiple":false,"creatable":false,"name":"standards.TeamsFilesPolicy.SPChannelFilesTab","label":"SharePoint channel files tab","options":[{"label":"Don't change","value":"donotconfigure"},{"label":"Enabled","value":"Enabled"},{"label":"Disabled","value":"Disabled"}],"defaultValue":"donotconfigure"} + IMPACT + Low Impact + ADDEDDATE + 2026-09-28 + POWERSHELLEQUIVALENT + Set-CsTeamsFilesPolicy -Identity Global -FileSharingInChatsWithExternalUsers Disabled + RECOMMENDEDBY + "CIPP" + REQUIREDCAPABILITIES + "MCOSTANDARD" + "MCOEV" + "MCOIMP" + "TEAMS1" + "Teams_Room_Standard" + UPDATECOMMENTBLOCK + Run the Tools\Update-StandardsComments.ps1 script to update this comment block + .LINK + https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + #> + + param($Tenant, $Settings) + $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsFilesPolicy' -TenantFilter $Tenant -Preset Teams + + if ($TestResult -eq $false) { + return $true + } #we're done. + + try { + $CurrentState = New-TeamsRequestV2 -TenantFilter $Tenant -Type 'TeamsFilesPolicy' -Action Get -Identity 'Global' + } catch { + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the Teams files policy state for $Tenant. Error: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage + return + } + + # Only settings the admin picked are managed; blank or "Don't change" leaves the tenant value alone + $ExpectedValue = @{} + foreach ($Name in @('FileSharingInChatsWithExternalUsers', 'NativeFileEntryPoints', 'SPChannelFilesTab')) { + $Value = $Settings.$Name.value ?? $Settings.$Name + if ([string]::IsNullOrWhiteSpace($Value) -or $Value -eq 'donotconfigure') { continue } + $ExpectedValue[$Name] = [string]$Value + } + $CurrentValue = @{} + foreach ($Name in $ExpectedValue.Keys) { $CurrentValue[$Name] = $CurrentState.$Name } + $StateIsCorrect = @($ExpectedValue.Keys | Where-Object { $CurrentValue[$_] -ne $ExpectedValue[$_] }).Count -eq 0 + + if ($Settings.remediate -eq $true) { + if ($StateIsCorrect -eq $true) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Global Teams files policy already configured.' -sev Info + } else { + $cmdParams = @{ Identity = 'Global' } + $ExpectedValue + + try { + $null = New-TeamsRequestV2 -TenantFilter $Tenant -Type 'TeamsFilesPolicy' -Action Set -Parameters $cmdParams + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Updated global Teams files policy: $(($ExpectedValue.GetEnumerator() | ForEach-Object { "$($_.Key)=$($_.Value)" }) -join ', ')" -sev Info + } catch { + $ErrorMessage = Get-CippException -Exception $_ + Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to configure global Teams files policy. Error: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage + } + } + } + + if ($Settings.alert -eq $true) { + if ($StateIsCorrect -eq $true) { + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Global Teams files policy is configured correctly.' -sev Info + } else { + Write-StandardsAlert -message 'Global Teams files policy is not configured correctly.' -object $CurrentValue -tenant $Tenant -standardName 'TeamsFilesPolicy' -standardId $Settings.standardId + Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Global Teams files policy is not configured correctly.' -sev Info + } + } + + if ($Settings.report -eq $true) { + Set-CIPPStandardsCompareField -FieldName 'standards.TeamsFilesPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant + } +} diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsGlobalMeetingPolicy.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsGlobalMeetingPolicy.ps1 index 56e1691a71..d056cf91a7 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsGlobalMeetingPolicy.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsGlobalMeetingPolicy.ps1 @@ -22,7 +22,7 @@ function Invoke-CIPPStandardTeamsGlobalMeetingPolicy { EXECUTIVETEXT Establishes security-focused default settings for Teams meetings, controlling who can join meetings, present content, and participate in chats. These policies balance collaboration needs with security requirements, ensuring meetings remain productive while protecting against unauthorized access and disruption. ADDEDCOMPONENT - {"type":"autoComplete","required":true,"multiple":false,"creatable":false,"name":"standards.TeamsGlobalMeetingPolicy.DesignatedPresenterRoleMode","label":"Default value of the `Who can present?`","options":[{"label":"Everyone","value":"EveryoneUserOverride"},{"label":"People in my organization","value":"EveryoneInCompanyUserOverride"},{"label":"Only organizer","value":"OrganizerOnlyUserOverride"}]} + {"type":"autoComplete","required":true,"multiple":false,"creatable":false,"name":"standards.TeamsGlobalMeetingPolicy.DesignatedPresenterRoleMode","label":"Default value of the `Who can present?`","options":[{"label":"Everyone","value":"EveryoneUserOverride"},{"label":"People in my organization","value":"EveryoneInCompanyUserOverride"},{"label":"People in my organization and trusted organizations","value":"EveryoneInSameAndFederatedCompanyUserOverride"},{"label":"Only organizer","value":"OrganizerOnlyUserOverride"}]} {"type":"switch","name":"standards.TeamsGlobalMeetingPolicy.AllowAnonymousUsersToJoinMeeting","label":"Allow anonymous users to join meeting"} {"type":"switch","name":"standards.TeamsGlobalMeetingPolicy.AllowAnonymousUsersToStartMeeting","label":"Allow anonymous users to start meeting"} {"type":"autoComplete","required":false,"multiple":false,"creatable":false,"name":"standards.TeamsGlobalMeetingPolicy.AutoAdmittedUsers","label":"Who can bypass the lobby?","helperText":"If left blank, the current value will not be changed.","options":[{"label":"Only organizers and co-organizers","value":"OrganizerOnly"},{"label":"People in organization excluding guests","value":"EveryoneInCompanyExcludingGuests"},{"label":"People in same or federated organizations","value":"EveryoneInSameAndFederatedCompany"},{"label":"People who were invited","value":"InvitedUsers"},{"label":"Everyone","value":"Everyone"}]} @@ -49,7 +49,7 @@ function Invoke-CIPPStandardTeamsGlobalMeetingPolicy { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsGlobalMeetingPolicy' -TenantFilter $Tenant -Preset Teams @@ -69,14 +69,6 @@ function Invoke-CIPPStandardTeamsGlobalMeetingPolicy { $MeetingChatEnabledType = $Settings.MeetingChatEnabledType.value ?? $Settings.MeetingChatEnabledType $DesignatedPresenterRoleMode = $Settings.DesignatedPresenterRoleMode.value ?? $Settings.DesignatedPresenterRoleMode - - # Microsoft retired EveryoneInSameAndFederatedCompanyUserOverride; the ConfigApi now rejects it with a 400. - # Templates saved before it was removed from the picker still carry the value, so fail with a clear reason. - $ValidPresenterRoleModes = @('OrganizerOnlyUserOverride', 'EveryoneInCompanyUserOverride', 'EveryoneUserOverride') - if ($DesignatedPresenterRoleMode -and $DesignatedPresenterRoleMode -notin $ValidPresenterRoleModes) { - Write-LogMessage -API 'Standards' -tenant $Tenant -message "TeamsGlobalMeetingPolicy: '$DesignatedPresenterRoleMode' is no longer a valid value for 'Who can present?'. Microsoft retired this option; select one of $($ValidPresenterRoleModes -join ', ') in the standards template." -sev Error - return - } $AutoAdmittedUsers = $Settings.AutoAdmittedUsers.value ?? $Settings.AutoAdmittedUsers ?? $CurrentState.AutoAdmittedUsers # Default to current state if not set, for backward compatibility pre v8.6.0 # Untoggled switches are absent from the settings; default them to $false (the CIS recommended value) so we never send null to the ConfigApi diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsGuestAccess.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsGuestAccess.ps1 index b249068fdc..2de0a79714 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsGuestAccess.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsGuestAccess.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardTeamsGuestAccess { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingRecordingExpiration.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingRecordingExpiration.ps1 index 7c35b8f123..cfcae7f4a1 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingRecordingExpiration.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingRecordingExpiration.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardTeamsMeetingRecordingExpiration { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingVerification.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingVerification.ps1 index b2a8bbcbfd..2641789a37 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingVerification.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingVerification.ps1 @@ -34,7 +34,7 @@ function Invoke-CIPPStandardTeamsMeetingVerification { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1 index 869f373bce..26c9640187 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardTeamsMeetingsByDefault { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMessagingPolicy.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMessagingPolicy.ps1 index ea83336d3f..500a7450af 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMessagingPolicy.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMessagingPolicy.ps1 @@ -25,6 +25,7 @@ function Invoke-CIPPStandardTeamsMessagingPolicy { {"type":"switch","name":"standards.TeamsMessagingPolicy.DeleteCustomEmojis","label":"Allow Deleting Custom Emojis","defaultValue":false} {"type":"switch","name":"standards.TeamsMessagingPolicy.AllowSecurityEndUserReporting","label":"Allow reporting message as security concern","defaultValue":true} {"type":"switch","name":"standards.TeamsMessagingPolicy.AllowCommunicationComplianceEndUserReporting","label":"Allow reporting message as inappropriate content","defaultValue":true} + {"type":"autoComplete","multiple":false,"creatable":false,"name":"standards.TeamsMessagingPolicy.AutoShareFilesInExternalChats","label":"Automatically share files attached in external chats","options":[{"label":"Don't change","value":"donotconfigure"},{"label":"Enabled","value":"Enabled"},{"label":"Disabled","value":"Disabled"}],"defaultValue":"donotconfigure"} IMPACT Medium Impact ADDEDDATE @@ -41,7 +42,7 @@ function Invoke-CIPPStandardTeamsMessagingPolicy { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -69,6 +70,10 @@ function Invoke-CIPPStandardTeamsMessagingPolicy { if ($null -eq $Settings.AllowCommunicationComplianceEndUserReporting) { $Settings.AllowCommunicationComplianceEndUserReporting = $CurrentState.AllowCommunicationComplianceEndUserReporting } $ReadReceiptsEnabledType = $Settings.ReadReceiptsEnabledType.value ?? $Settings.ReadReceiptsEnabledType + # Optional, "Don't change" keeps the tenant value (and keeps it out of the Set body) + $AutoShareFilesInExternalChats = $Settings.AutoShareFilesInExternalChats.value ?? $Settings.AutoShareFilesInExternalChats + $ManageAutoShare = -not ([string]::IsNullOrWhiteSpace($AutoShareFilesInExternalChats) -or $AutoShareFilesInExternalChats -eq 'donotconfigure') + if (-not $ManageAutoShare) { $AutoShareFilesInExternalChats = $CurrentState.AutoShareFilesInExternalChats } $StateIsCorrect = ($CurrentState.AllowOwnerDeleteMessage -eq $Settings.AllowOwnerDeleteMessage) -and ($CurrentState.AllowUserDeleteMessage -eq $Settings.AllowUserDeleteMessage) -and @@ -78,7 +83,8 @@ function Invoke-CIPPStandardTeamsMessagingPolicy { ($CurrentState.CreateCustomEmojis -eq $Settings.CreateCustomEmojis) -and ($CurrentState.DeleteCustomEmojis -eq $Settings.DeleteCustomEmojis) -and ($CurrentState.AllowSecurityEndUserReporting -eq $Settings.AllowSecurityEndUserReporting) -and - ($CurrentState.AllowCommunicationComplianceEndUserReporting -eq $Settings.AllowCommunicationComplianceEndUserReporting) + ($CurrentState.AllowCommunicationComplianceEndUserReporting -eq $Settings.AllowCommunicationComplianceEndUserReporting) -and + ($CurrentState.AutoShareFilesInExternalChats -eq $AutoShareFilesInExternalChats) if ($Settings.remediate -eq $true) { if ($StateIsCorrect -eq $true) { @@ -96,6 +102,7 @@ function Invoke-CIPPStandardTeamsMessagingPolicy { AllowSecurityEndUserReporting = $Settings.AllowSecurityEndUserReporting AllowCommunicationComplianceEndUserReporting = $Settings.AllowCommunicationComplianceEndUserReporting } + if ($ManageAutoShare) { $cmdParams.AutoShareFilesInExternalChats = $AutoShareFilesInExternalChats } try { $null = New-TeamsRequestV2 -TenantFilter $Tenant -Type 'TeamsMessagingPolicy' -Action Set -Parameters $cmdParams @@ -128,6 +135,7 @@ function Invoke-CIPPStandardTeamsMessagingPolicy { DeleteCustomEmojis = $CurrentState.DeleteCustomEmojis AllowSecurityEndUserReporting = $CurrentState.AllowSecurityEndUserReporting AllowCommunicationComplianceEndUserReporting = $CurrentState.AllowCommunicationComplianceEndUserReporting + AutoShareFilesInExternalChats = $CurrentState.AutoShareFilesInExternalChats } $ExpectedValue = @{ AllowOwnerDeleteMessage = $Settings.AllowOwnerDeleteMessage @@ -139,6 +147,7 @@ function Invoke-CIPPStandardTeamsMessagingPolicy { DeleteCustomEmojis = $Settings.DeleteCustomEmojis AllowSecurityEndUserReporting = $Settings.AllowSecurityEndUserReporting AllowCommunicationComplianceEndUserReporting = $Settings.AllowCommunicationComplianceEndUserReporting + AutoShareFilesInExternalChats = $AutoShareFilesInExternalChats } Set-CIPPStandardsCompareField -FieldName 'standards.TeamsMessagingPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant } diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsZAP.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsZAP.ps1 index 7e25e51fb2..c601d073c5 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsZAP.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsZAP.ps1 @@ -8,12 +8,12 @@ function Invoke-CIPPStandardTeamsZAP { (Label) Ensure Zero-hour auto purge for Microsoft Teams is on .DESCRIPTION (Helptext) Ensures Zero-hour auto purge (ZAP) is enabled for Microsoft Teams, automatically removing malicious messages after delivery. - (DocsDescription) Zero-hour auto purge (ZAP) for Microsoft Teams retroactively detects and neutralises malicious messages that have already been delivered in Teams chats. Enabling ZAP ensures that phishing, malware, and high confidence phishing messages are automatically purged even after initial delivery, aligning with CIS M365 6.0.1 benchmark control 2.4.4. + (DocsDescription) Zero-hour auto purge (ZAP) for Microsoft Teams retroactively detects and neutralises malicious messages that have already been delivered in Teams chats. Enabling ZAP ensures that phishing, malware, and high confidence phishing messages are automatically purged even after initial delivery, aligning with CIS M365 7.0.0 benchmark control 2.4.4. .NOTES CAT Defender Standards TAG - "CIS M365 6.0.1 (2.4.4)" + "CIS M365 7.0.0 (2.4.4)" EXECUTIVETEXT Enables Zero-hour auto purge for Microsoft Teams to automatically detect and remove malicious messages after delivery. This provides an additional layer of protection against phishing and malware that may bypass initial scanning, ensuring threats are neutralised even after they reach users. ADDEDCOMPONENT diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantAllowBlockListTemplate.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantAllowBlockListTemplate.ps1 index 5df3ed8091..277b5fff51 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantAllowBlockListTemplate.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantAllowBlockListTemplate.ps1 @@ -31,7 +31,7 @@ function Invoke-CIPPStandardTenantAllowBlockListTemplate { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -44,8 +44,8 @@ function Invoke-CIPPStandardTenantAllowBlockListTemplate { $Table = Get-CippTable -tablename 'templates' $TemplateId = $Settings.TenantAllowBlockListTemplate.value - $ResolvedTemplates = @(foreach ($Id in @($TemplateId)) { - $TemplateId = $Id + $ResolvedTemplates = @(foreach ($_ in @($TemplateId)) { + $TemplateId = $_ $Filter = "PartitionKey eq 'TenantAllowBlockListTemplate' and RowKey eq '$TemplateId'" $TemplateEntity = Get-CIPPAzDataTableEntity @Table -Filter $Filter diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantDefaultTimezone.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantDefaultTimezone.ps1 index 8903679dbf..044e5d99fd 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantDefaultTimezone.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantDefaultTimezone.ps1 @@ -35,7 +35,7 @@ function Invoke-CIPPStandardTenantDefaultTimezone { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTransportRuleTemplate.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTransportRuleTemplate.ps1 index 4c6801d28e..4f82cc7a36 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTransportRuleTemplate.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTransportRuleTemplate.ps1 @@ -32,7 +32,7 @@ function Invoke-CIPPStandardTransportRuleTemplate { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) $TestResult = Test-CIPPStandardLicense -StandardName 'TransportRuleTemplate' -TenantFilter $Tenant -Preset Exchange #No Foundation because that does not allow powershell access diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTwoClickEmailProtection.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTwoClickEmailProtection.ps1 index 1f84826aa8..e5a2a87a9b 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTwoClickEmailProtection.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTwoClickEmailProtection.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardTwoClickEmailProtection { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUserPreferredLanguage.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUserPreferredLanguage.ps1 index c7294f042e..7f174a63cc 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUserPreferredLanguage.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUserPreferredLanguage.ps1 @@ -25,7 +25,7 @@ function Invoke-CIPPStandardUserPreferredLanguage { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -39,6 +39,7 @@ function Invoke-CIPPStandardUserPreferredLanguage { $_.userType -eq 'Member' -and $_.onPremisesSyncEnabled -ne $true } + $AllUsers = $null } catch { $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the UserPreferredLanguage state for $Tenant. Error: $ErrorMessage" -Sev Error diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUserSubmissions.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUserSubmissions.ps1 index 5b7fb17ec5..630dcbca39 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUserSubmissions.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUserSubmissions.ps1 @@ -35,7 +35,7 @@ function Invoke-CIPPStandardUserSubmissions { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardWindowsBackupRestore.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardWindowsBackupRestore.ps1 index 9470677110..fa114cc707 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardWindowsBackupRestore.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardWindowsBackupRestore.ps1 @@ -33,7 +33,7 @@ function Invoke-CIPPStandardWindowsBackupRestore { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> [CmdletBinding()] diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardallowOAuthTokens.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardallowOAuthTokens.ps1 index 0d8332355a..3421c49768 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardallowOAuthTokens.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardallowOAuthTokens.ps1 @@ -28,7 +28,7 @@ function Invoke-CIPPStandardallowOAuthTokens { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardallowOTPTokens.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardallowOTPTokens.ps1 index 6d80029fd6..a2469bcacf 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardallowOTPTokens.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardallowOTPTokens.ps1 @@ -28,7 +28,7 @@ function Invoke-CIPPStandardallowOTPTokens { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardcalDefault.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardcalDefault.ps1 index a606dbfb28..e46d3ea406 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardcalDefault.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardcalDefault.ps1 @@ -35,7 +35,7 @@ function Invoke-CIPPStandardcalDefault { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings, $QueueItem) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandarddisableMacSync.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandarddisableMacSync.ps1 index bbec836f6a..15f94ede97 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandarddisableMacSync.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandarddisableMacSync.ps1 @@ -34,7 +34,7 @@ function Invoke-CIPPStandarddisableMacSync { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneBrandingProfile.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneBrandingProfile.ps1 index 0693daae42..c07670ea43 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneBrandingProfile.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneBrandingProfile.ps1 @@ -42,7 +42,7 @@ function Invoke-CIPPStandardintuneBrandingProfile { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceReg.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceReg.ps1 index 5736ef01bf..65b1b766d8 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceReg.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceReg.ps1 @@ -36,7 +36,7 @@ function Invoke-CIPPStandardintuneDeviceReg { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceRetirementDays.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceRetirementDays.ps1 index 47cab7f26e..d59a12c332 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceRetirementDays.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceRetirementDays.ps1 @@ -34,7 +34,7 @@ function Invoke-CIPPStandardintuneDeviceRetirementDays { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1 index ed8f8d5b39..3b3fcff7f6 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1 @@ -27,7 +27,7 @@ function Invoke-CIPPStandardintuneRestrictUserDeviceRegistration { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingCapability.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingCapability.ps1 index ce083ddf38..5de451f06c 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingCapability.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingCapability.ps1 @@ -42,7 +42,7 @@ function Invoke-CIPPStandardsharingCapability { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1 index 42964b7836..e487a0e051 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1 @@ -41,7 +41,7 @@ function Invoke-CIPPStandardsharingDomainRestriction { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) @@ -120,13 +120,13 @@ function Invoke-CIPPStandardsharingDomainRestriction { $CurrentValue = @{ sharingDomainRestrictionMode = $CurrentState.sharingDomainRestrictionMode - sharingAllowedDomainList = @($CurrentState.sharingAllowedDomainList ?? @()) - sharingBlockedDomainList = @($CurrentState.sharingBlockedDomainList ?? @()) + sharingAllowedDomainList = $CurrentState.sharingAllowedDomainList + sharingBlockedDomainList = $CurrentState.sharingBlockedDomainList } $ExpectedValue = @{ sharingDomainRestrictionMode = $mode - sharingAllowedDomainList = @(if ($mode -eq 'allowList') { $SelectedDomains } else { @() }) - sharingBlockedDomainList = @(if ($mode -eq 'blockList') { $SelectedDomains } else { @() }) + sharingAllowedDomainList = if ($mode -eq 'allowList') { $SelectedDomains } else { @() } + sharingBlockedDomainList = if ($mode -eq 'blockList') { $SelectedDomains } else { @() } } Set-CIPPStandardsCompareField -FieldName 'standards.sharingDomainRestriction' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant } diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardunmanagedSync.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardunmanagedSync.ps1 index 351c083bf4..603fb64671 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardunmanagedSync.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardunmanagedSync.ps1 @@ -38,7 +38,7 @@ function Invoke-CIPPStandardunmanagedSync { UPDATECOMMENTBLOCK Run the Tools\Update-StandardsComments.ps1 script to update this comment block .LINK - https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards + https://docs.cipp.app/user-documentation/tenant/standards/list-standards #> param($Tenant, $Settings) diff --git a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1 b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1 index d762a104a8..b8cdc19e6b 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1 @@ -42,7 +42,7 @@ function Invoke-CippTestCIS_1_1_1 { } } - $PrivilegedUsers = $Users.Where({ $PrivilegedUserIds.Contains($_.id) }) + $PrivilegedUsers = $Users | Where-Object { $PrivilegedUserIds.Contains($_.id) } if (-not $PrivilegedUsers) { Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_1_1_1' -TestType 'Identity' -Status 'Passed' -ResultMarkdown 'No privileged users found.' -Risk 'High' -Name 'Administrative accounts are cloud-only' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Privileged Access' diff --git a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_2.ps1 b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_2.ps1 index 6ba82dcf1b..e41b1d96d2 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_2.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_2.ps1 @@ -19,7 +19,7 @@ function Invoke-CippTestCIS_1_1_2 { return } - $GA = $Roles.Where({ $_.displayName -eq 'Global Administrator' }, 'First', 1)[0] + $GA = $Roles | Where-Object { $_.displayName -eq 'Global Administrator' } | Select-Object -First 1 if (-not $GA) { Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_1_1_2' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'Global Administrator role not found in tenant role definitions.' -Risk 'High' -Name 'Two emergency access accounts have been defined' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Privileged Access' return @@ -42,9 +42,9 @@ function Invoke-CippTestCIS_1_1_2 { } } - $GAUsers = $Users.Where({ $GAUserIds.Contains($_.id) }) + $GAUsers = $Users | Where-Object { $GAUserIds.Contains($_.id) } $BreakGlassPattern = 'breakglass|break-glass|emergency|cipp-bg|bg-admin' - $LikelyBG = $GAUsers.Where({ $_.userPrincipalName -match $BreakGlassPattern -and $_.onPremisesSyncEnabled -ne $true }) + $LikelyBG = $GAUsers | Where-Object { $_.userPrincipalName -match $BreakGlassPattern -and $_.onPremisesSyncEnabled -ne $true } if ($LikelyBG.Count -ge 2) { $Status = 'Passed' diff --git a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_4.ps1 b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_4.ps1 index 9b0eaedac7..20180b9bf1 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_4.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_4.ps1 @@ -15,6 +15,9 @@ function Invoke-CippTestCIS_1_1_4 { return } + # SkuPartNumbers that are acceptable for admin accounts: Entra ID P1/P2 only + $AcceptableSkus = @('AAD_PREMIUM', 'AAD_PREMIUM_P2', 'EMS', 'EMSPREMIUM') + $PrivilegedRoleIds = [System.Collections.Generic.HashSet[string]]::new() $PrivilegedUserIds = [System.Collections.Generic.HashSet[string]]::new() @@ -37,17 +40,17 @@ function Invoke-CippTestCIS_1_1_4 { } } - $PrivilegedUsers = $Users.Where({ $PrivilegedUserIds.Contains($_.id) }) + $PrivilegedUsers = $Users | Where-Object { $PrivilegedUserIds.Contains($_.id) } - $LicensedAdmins = $PrivilegedUsers.Where({ - $_.assignedLicenses -and $_.assignedLicenses.Count -gt 0 - }) + $LicensedAdmins = $PrivilegedUsers | Where-Object { + $_.assignedLicenses -and $_.assignedLicenses.Count -gt 0 + } - $ProductivityServices = [System.Collections.Generic.HashSet[string]]::new([string[]]@('exchange', 'SharePoint', 'MicrosoftCommunicationsOnline', 'TeamspaceAPI')) - $NonCompliant = $LicensedAdmins.Where({ - $hasProductivity = $_.assignedPlans.Where({ $ProductivityServices.Contains($_.service) -and $_.capabilityStatus -eq 'Enabled' }, 'First', 1) - [bool]$hasProductivity.Count - }) + $NonCompliant = $LicensedAdmins | Where-Object { + $skus = ($_.assignedPlans | ForEach-Object { $_.servicePlanId }) -join ',' + $hasProductivity = $_.assignedPlans | Where-Object { $_.service -in @('exchange', 'SharePoint', 'MicrosoftCommunicationsOnline', 'TeamspaceAPI') -and $_.capabilityStatus -eq 'Enabled' } + [bool]$hasProductivity + } if (-not $LicensedAdmins) { $Status = 'Passed' diff --git a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_1.ps1 b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_1.ps1 index 2b9250d907..94961c4d07 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_1.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_1.ps1 @@ -17,13 +17,13 @@ function Invoke-CippTestCIS_1_2_1 { if (-not $PublicGroups -or $PublicGroups.Count -eq 0) { $Status = 'Passed' - $Result = [System.Text.StringBuilder]::new('No public Microsoft 365 (Unified) groups found in the tenant.') + $Result = 'No public Microsoft 365 (Unified) groups found in the tenant.' } else { $Status = 'Failed' - $Result = [System.Text.StringBuilder]::new("Found $($PublicGroups.Count) public Microsoft 365 group(s). Each public group's contents are visible to every user in the tenant — convert them to Private unless explicitly approved.`n`n") - $null = $Result.Append("| Display Name | Mail |`n| :----------- | :--- |`n") + $Result = "Found $($PublicGroups.Count) public Microsoft 365 group(s). Each public group's contents are visible to every user in the tenant — convert them to Private unless explicitly approved.`n`n" + $Result += "| Display Name | Mail |`n| :----------- | :--- |`n" foreach ($G in ($PublicGroups | Select-Object -First 25)) { - $null = $Result.Append("| $($G.displayName) | $($G.mail) |`n") + $Result += "| $($G.displayName) | $($G.mail) |`n" } } diff --git a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_2.ps1 b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_2.ps1 index 13ccd0cb2d..aac4cd3857 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_2.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_2.ps1 @@ -21,19 +21,11 @@ function Invoke-CippTestCIS_1_2_2 { return } - $UsersById = @{} - $UsersByUpn = @{} - foreach ($U in $Users) { - if ($U.id) { $UsersById[$U.id] = $U } - if ($U.userPrincipalName) { $UsersByUpn[$U.userPrincipalName] = $U } - } - $EnabledShared = [System.Collections.Generic.List[object]]::new() + $EnabledShared = @() foreach ($SM in $SharedMailboxes) { - $User = $null - if ($SM.UserPrincipalName -and $UsersByUpn.ContainsKey($SM.UserPrincipalName)) { $User = $UsersByUpn[$SM.UserPrincipalName] } - elseif ($SM.ExternalDirectoryObjectId -and $UsersById.ContainsKey($SM.ExternalDirectoryObjectId)) { $User = $UsersById[$SM.ExternalDirectoryObjectId] } + $User = $Users | Where-Object { $_.userPrincipalName -eq $SM.UserPrincipalName -or $_.id -eq $SM.ExternalDirectoryObjectId } | Select-Object -First 1 if ($User -and $User.accountEnabled -eq $true) { - $EnabledShared.Add($User) + $EnabledShared += $User } } diff --git a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_3_1.ps1 b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_3_1.ps1 index 84d64f46ab..4c9e71f799 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_3_1.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_3_1.ps1 @@ -17,12 +17,12 @@ function Invoke-CippTestCIS_1_3_1 { if (-not $Failing -or $Failing.Count -eq 0) { $Status = 'Passed' - $Result = [System.Text.StringBuilder]::new("All $($Domains.Count) domain(s) have password expiration disabled (passwordValidityPeriodInDays = 2147483647).") + $Result = "All $($Domains.Count) domain(s) have password expiration disabled (passwordValidityPeriodInDays = 2147483647)." } else { $Status = 'Failed' - $Result = [System.Text.StringBuilder]::new("$($Failing.Count) domain(s) still expire passwords:`n`n| Domain | Validity (days) |`n| :----- | :-------------- |`n") + $Result = "$($Failing.Count) domain(s) still expire passwords:`n`n| Domain | Validity (days) |`n| :----- | :-------------- |`n" foreach ($D in $Failing) { - $null = $Result.Append("| $($D.id) | $($D.passwordValidityPeriodInDays) |`n") + $Result += "| $($D.id) | $($D.passwordValidityPeriodInDays) |`n" } } diff --git a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_10.ps1 b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_10.ps1 index bf59195816..5a24cbe491 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_10.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_10.ps1 @@ -19,12 +19,12 @@ function Invoke-CippTestCIS_2_1_10 { if (-not $Failing -or $Failing.Count -eq 0) { $Status = 'Passed' - $Result = [System.Text.StringBuilder]::new("All $($Results.Count) domain(s) have a DMARC record with p=quarantine or p=reject.") + $Result = "All $($Results.Count) domain(s) have a DMARC record with p=quarantine or p=reject." } else { $Status = 'Failed' - $Result = [System.Text.StringBuilder]::new("$($Failing.Count) of $($Results.Count) domain(s) are missing a compliant DMARC record:`n`n| Domain | DMARCPresent | DMARCActionPolicy |`n| :----- | :----------- | :---------------- |`n") + $Result = "$($Failing.Count) of $($Results.Count) domain(s) are missing a compliant DMARC record:`n`n| Domain | DMARCPresent | DMARCActionPolicy |`n| :----- | :----------- | :---------------- |`n" foreach ($D in ($Failing | Select-Object -First 25)) { - $null = $Result.Append("| $($D.Domain) | $($D.DMARCPresent) | $($D.DMARCActionPolicy) |`n") + $Result += "| $($D.Domain) | $($D.DMARCPresent) | $($D.DMARCActionPolicy) |`n" } } diff --git a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_14.ps1 b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_14.ps1 index 4ba4a8b4db..fe6fdc46bb 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_14.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_14.ps1 @@ -17,12 +17,12 @@ function Invoke-CippTestCIS_2_1_14 { if (-not $Offending) { $Status = 'Passed' - $Result = [System.Text.StringBuilder]::new("All $($Inbound.Count) inbound anti-spam policy/policies have no allowed sender domains.") + $Result = "All $($Inbound.Count) inbound anti-spam policy/policies have no allowed sender domains." } else { $Status = 'Failed' - $Result = [System.Text.StringBuilder]::new("$($Offending.Count) inbound anti-spam policy/policies have allowed sender domains configured:`n`n") + $Result = "$($Offending.Count) inbound anti-spam policy/policies have allowed sender domains configured:`n`n" foreach ($P in $Offending) { - $null = $Result.Append("- **$($P.Identity)**: $($P.AllowedSenderDomains -join ', ')`n") + $Result += "- **$($P.Identity)**: $($P.AllowedSenderDomains -join ', ')`n" } } diff --git a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_5.ps1 b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_5.ps1 index 75a2c40b2a..778b757857 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_5.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_5.ps1 @@ -26,10 +26,10 @@ function Invoke-CippTestCIS_2_1_5 { EnableSafeDocs = $true AllowSafeDocsOpen = $false } - $Failures = [System.Collections.Generic.List[string]]::new() + $Failures = @() foreach ($key in $Required.Keys) { if ($Cfg.$key -ne $Required[$key]) { - $Failures.Add("$key = $($Cfg.$key) (expected $($Required[$key]))") + $Failures += "$key = $($Cfg.$key) (expected $($Required[$key]))" } } diff --git a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_8.ps1 b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_8.ps1 index 3660a5daea..0474f8963b 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_8.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_8.ps1 @@ -17,12 +17,12 @@ function Invoke-CippTestCIS_2_1_8 { if (-not $Failing -or $Failing.Count -eq 0) { $Status = 'Passed' - $Result = [System.Text.StringBuilder]::new("All $($Results.Count) domain(s) have an SPF record published.") + $Result = "All $($Results.Count) domain(s) have an SPF record published." } else { $Status = 'Failed' - $Result = [System.Text.StringBuilder]::new("$($Failing.Count) of $($Results.Count) domain(s) are missing a valid SPF record:`n`n| Domain | SPF Record |`n| :----- | :--------- |`n") + $Result = "$($Failing.Count) of $($Results.Count) domain(s) are missing a valid SPF record:`n`n| Domain | SPF Record |`n| :----- | :--------- |`n" foreach ($D in ($Failing | Select-Object -First 25)) { - $null = $Result.Append("| $($D.Domain) | $($D.ActualSPFRecord) |`n") + $Result += "| $($D.Domain) | $($D.ActualSPFRecord) |`n" } } diff --git a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_9.ps1 b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_9.ps1 index 0118728ebe..c62e1e54ec 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_9.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_9.ps1 @@ -14,24 +14,22 @@ function Invoke-CippTestCIS_2_1_9 { return } - $Sending = $Accepted.Where({ -not $_.SendingFromDomainDisabled -and $_.DomainName -notlike '*onmicrosoft.com' }) - $DkimByDomain = $Dkim | Group-Object Domain -AsHashTable -AsString - $Failed = [System.Collections.Generic.List[object]]::new() + $Sending = $Accepted | Where-Object { -not $_.SendingFromDomainDisabled -and $_.DomainName -notlike '*onmicrosoft.com' } + $Failed = @() foreach ($D in $Sending) { - $Cfg = $null - if ($DkimByDomain.ContainsKey($D.DomainName)) { $Cfg = @($DkimByDomain[$D.DomainName])[0] } + $Cfg = $Dkim | Where-Object { $_.Domain -eq $D.DomainName } | Select-Object -First 1 if (-not $Cfg -or $Cfg.Enabled -ne $true) { - $Failed.Add([PSCustomObject]@{ Domain = $D.DomainName; Enabled = $Cfg.Enabled }) + $Failed += [PSCustomObject]@{ Domain = $D.DomainName; Enabled = $Cfg.Enabled } } } if ($Failed.Count -eq 0) { $Status = 'Passed' - $Result = [System.Text.StringBuilder]::new("DKIM is enabled for all $($Sending.Count) sending domain(s).") + $Result = "DKIM is enabled for all $($Sending.Count) sending domain(s)." } else { $Status = 'Failed' - $Result = [System.Text.StringBuilder]::new("DKIM is not enabled for $($Failed.Count) sending domain(s):`n`n| Domain | DKIM Enabled |`n| :----- | :----------- |`n") - foreach ($F in $Failed) { $null = $Result.Append("| $($F.Domain) | $($F.Enabled) |`n") } + $Result = "DKIM is not enabled for $($Failed.Count) sending domain(s):`n`n| Domain | DKIM Enabled |`n| :----- | :----------- |`n" + foreach ($F in $Failed) { $Result += "| $($F.Domain) | $($F.Enabled) |`n" } } Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_2_1_9' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'DKIM is enabled for all Exchange Online Domains' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Email Authentication' diff --git a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_3_2_2.ps1 b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_3_2_2.ps1 index 0ea340c90a..e0e99e1a52 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_3_2_2.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_3_2_2.ps1 @@ -17,7 +17,7 @@ function Invoke-CippTestCIS_3_2_2 { $_.Mode -eq 'Enable' -and $_.Enabled -eq $true -and ( $_.TeamsLocation -or $_.Workload -match 'Teams' -or - $_.TeamsLocationException + $_.TeamsLocationException -ne $null ) } diff --git a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_4_2.ps1 b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_4_2.ps1 index db763eb1c1..bf6ce23b2d 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_4_2.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_4_2.ps1 @@ -21,11 +21,11 @@ function Invoke-CippTestCIS_4_2 { return } - $Failures = [System.Collections.Generic.List[string]]::new() + $Failures = @() foreach ($P in @('androidForWorkRestriction', 'androidRestriction', 'iosRestriction', 'macOSRestriction', 'windowsRestriction')) { $r = $DefaultPlatform.$P if ($r -and $r.personalDeviceEnrollmentBlocked -ne $true -and $r.platformBlocked -ne $true) { - $Failures.Add("$P : personal enrollment NOT blocked") + $Failures += "$P : personal enrollment NOT blocked" } } diff --git a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_5_1_6_1.ps1 b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_5_1_6_1.ps1 index 33152b7f1b..c2b5a1b5d0 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_5_1_6_1.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_5_1_6_1.ps1 @@ -14,24 +14,20 @@ function Invoke-CippTestCIS_5_1_6_1 { return } - # Inspect B2B management policy AllowedDomains / BlockedDomains. - # b2bManagementPolicy inherits from stsPolicy, so the settings live in definition[0] as a JSON string. - $Cfg = $B2B | Where-Object { $_.isOrganizationDefault -eq $true } | Select-Object -First 1 - if (-not $Cfg) { $Cfg = $B2B | Select-Object -First 1 } + # Inspect B2B management policy AllowedDomains / BlockedDomains + $Cfg = $B2B | Select-Object -First 1 if ($Cfg) { - $Domains = $null - if ($Cfg.definition) { - $Definition = @($Cfg.definition)[0] | ConvertFrom-Json -ErrorAction SilentlyContinue - $Domains = $Definition.B2BManagementPolicy.InvitationsAllowedAndBlockedDomainsPolicy - } - $AllowedDomains = @($Domains.AllowedDomains) - $BlockedDomains = @($Domains.BlockedDomains) + $Allowed = $Cfg.allowInvitesFrom + $Domains = $Cfg.invitationsAllowedAndBlockedDomainsPolicy - $Pass = ($AllowedDomains.Count -gt 0) -or ($BlockedDomains.Count -gt 0) + $Pass = $Domains -and ( + ($Domains.allowedDomains -and $Domains.allowedDomains.Count -gt 0) -or + ($Domains.blockedDomains -and $Domains.blockedDomains.Count -gt 0) + ) if ($Pass) { $Status = 'Passed' - $Result = "B2B invitations are scoped by an allow/block list (allowed: $($AllowedDomains -join ', '); blocked: $($BlockedDomains -join ', '))." + $Result = "B2B invitations are scoped by an allow/block list (allowed: $($Domains.allowedDomains -join ', '); blocked: $($Domains.blockedDomains -join ', '))." } else { $Status = 'Failed' $Result = 'B2B invitations are not constrained by an allow / block list. Configure invitationsAllowedAndBlockedDomainsPolicy.' diff --git a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_5_2_3_4.ps1 b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_5_2_3_4.ps1 index 83ea94413d..fa0ccd8cff 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_5_2_3_4.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_5_2_3_4.ps1 @@ -14,20 +14,12 @@ function Invoke-CippTestCIS_5_2_3_4 { return } - $Members = $Users.Where({ $_.userType -eq 'Member' -and $_.accountEnabled -eq $true }) - $RegById = @{} - $RegByUpn = @{} - foreach ($R in $Reg) { - if ($R.id) { $RegById[$R.id] = $R } - if ($R.userPrincipalName) { $RegByUpn[$R.userPrincipalName] = $R } - } - $NotCapable = [System.Collections.Generic.List[object]]::new() + $Members = $Users | Where-Object { $_.userType -eq 'Member' -and $_.accountEnabled -eq $true } + $NotCapable = @() foreach ($U in $Members) { - $R = $null - if ($U.id -and $RegById.ContainsKey($U.id)) { $R = $RegById[$U.id] } - elseif ($U.userPrincipalName -and $RegByUpn.ContainsKey($U.userPrincipalName)) { $R = $RegByUpn[$U.userPrincipalName] } + $R = $Reg | Where-Object { $_.id -eq $U.id -or $_.userPrincipalName -eq $U.userPrincipalName } | Select-Object -First 1 if (-not $R -or $R.isMfaCapable -ne $true) { - $NotCapable.Add($U) + $NotCapable += $U } } diff --git a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_6_5_4.ps1 b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_6_5_4.ps1 index 871b7d1f43..68a260f430 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_6_5_4.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_6_5_4.ps1 @@ -6,10 +6,10 @@ function Invoke-CippTestCIS_6_5_4 { param($Tenant) try { - $Org = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoTransportConfig' + $Org = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoOrganizationConfig' if (-not $Org) { - Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_6_5_4' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'ExoTransportConfig cache not found.' -Risk 'High' -Name 'SMTP AUTH is disabled' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authentication' + Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_6_5_4' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'ExoOrganizationConfig cache not found.' -Risk 'High' -Name 'SMTP AUTH is disabled' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authentication' return } diff --git a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_8_1_1.ps1 b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_8_1_1.ps1 index 01b08e8f81..4fc9f3b78a 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_8_1_1.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_8_1_1.ps1 @@ -14,12 +14,12 @@ function Invoke-CippTestCIS_8_1_1 { } $Cfg = $Client | Select-Object -First 1 - $Enabled = [System.Collections.Generic.List[string]]::new() - if ($Cfg.AllowDropbox) { $Enabled.Add('Dropbox') } - if ($Cfg.AllowBox) { $Enabled.Add('Box') } - if ($Cfg.AllowGoogleDrive) { $Enabled.Add('GoogleDrive') } - if ($Cfg.AllowShareFile) { $Enabled.Add('ShareFile') } - if ($Cfg.AllowEgnyte) { $Enabled.Add('Egnyte') } + $Enabled = @() + if ($Cfg.AllowDropbox) { $Enabled += 'Dropbox' } + if ($Cfg.AllowBox) { $Enabled += 'Box' } + if ($Cfg.AllowGoogleDrive) { $Enabled += 'GoogleDrive' } + if ($Cfg.AllowShareFile) { $Enabled += 'ShareFile' } + if ($Cfg.AllowEgnyte) { $Enabled += 'Egnyte' } if ($Enabled.Count -eq 0) { $Status = 'Passed' diff --git a/backend/Modules/CIPPTests/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO141.ps1 b/backend/Modules/CIPPTests/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO141.ps1 index e8117ad8db..2a05f24fca 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO141.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO141.ps1 @@ -26,14 +26,14 @@ function Invoke-CippTestCISAMSEXO141 { $FailedPolicies = $SpamPolicies | Where-Object { $_.HighConfidenceSpamAction -ne 'Quarantine' } if ($FailedPolicies.Count -eq 0) { - $Result = [System.Text.StringBuilder]::new("✅ **Pass**: All $($SpamPolicies.Count) anti-spam policy/policies quarantine high confidence spam.") + $Result = "✅ **Pass**: All $($SpamPolicies.Count) anti-spam policy/policies quarantine high confidence spam." $Status = 'Passed' } else { - $Result = [System.Text.StringBuilder]::new("❌ **Fail**: $($FailedPolicies.Count) of $($SpamPolicies.Count) anti-spam policy/policies do not quarantine high confidence spam:`n`n") - $null = $Result.Append("| Policy Name | Current Action | Expected |`n") - $null = $Result.Append("| :---------- | :------------- | :------- |`n") + $Result = "❌ **Fail**: $($FailedPolicies.Count) of $($SpamPolicies.Count) anti-spam policy/policies do not quarantine high confidence spam:`n`n" + $Result += "| Policy Name | Current Action | Expected |`n" + $Result += "| :---------- | :------------- | :------- |`n" foreach ($Policy in $FailedPolicies) { - $null = $Result.Append("| $($Policy.Name) | $($Policy.HighConfidenceSpamAction) | Quarantine |`n") + $Result += "| $($Policy.Name) | $($Policy.HighConfidenceSpamAction) | Quarantine |`n" } $Status = 'Failed' } diff --git a/backend/Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady003.ps1 b/backend/Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady003.ps1 index a73b499233..aa2fc5f723 100644 --- a/backend/Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady003.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady003.ps1 @@ -80,15 +80,15 @@ function Invoke-CippTestCopilotReady003 { if ($DesktopPercent -ge $DesktopThresholdPercent) { $Status = 'Passed' - $Result = [System.Text.StringBuilder]::new("**$DesktopCount of $TotalUsers licensed users ($DesktopPercent%)** have Microsoft 365 Apps activated on a desktop platform (Windows or Mac) — above the $DesktopThresholdPercent% threshold.`n`n") - $null = $Result.Append("These users can access Copilot features in desktop Word, Excel, PowerPoint, and Outlook.") + $Result = "**$DesktopCount of $TotalUsers licensed users ($DesktopPercent%)** have Microsoft 365 Apps activated on a desktop platform (Windows or Mac) — above the $DesktopThresholdPercent% threshold.`n`n" + $Result += "These users can access Copilot features in desktop Word, Excel, PowerPoint, and Outlook." } else { $Status = 'Failed' - $Result = [System.Text.StringBuilder]::new("Only **$DesktopCount of $TotalUsers licensed users ($DesktopPercent%)** have Microsoft 365 Apps activated on a desktop platform — below the $DesktopThresholdPercent% threshold.`n`n") - $null = $Result.Append("Copilot in Word, Excel, PowerPoint, and Outlook requires the M365 desktop application. ") - $null = $Result.Append("Users with only web or mobile activations, or who have never activated at all, cannot use Copilot's in-document features.`n`n") + $Result = "Only **$DesktopCount of $TotalUsers licensed users ($DesktopPercent%)** have Microsoft 365 Apps activated on a desktop platform — below the $DesktopThresholdPercent% threshold.`n`n" + $Result += "Copilot in Word, Excel, PowerPoint, and Outlook requires the M365 desktop application. " + $Result += "Users with only web or mobile activations, or who have never activated at all, cannot use Copilot's in-document features.`n`n" if ($NoDesktopUsers.Count -gt 0 -and $NoDesktopUsers.Count -le 20) { - $null = $Result.Append("**Users without desktop activation:**`n") + $Result += "**Users without desktop activation:**`n" foreach ($User in $NoDesktopUsers) { if ($User.neverActivated) { $PlatformStr = ' (never activated)' @@ -97,13 +97,13 @@ function Invoke-CippTestCopilotReady003 { if ([int]($User.android ?? 0) -gt 0 -or [int]($User.ios ?? 0) -gt 0) { $Platforms += 'Mobile' } $PlatformStr = if ($Platforms) { " ($(($Platforms -join ', ')) only)" } else { ' (no activations)' } } - $null = $Result.Append("- $($User.displayName) ($($User.userPrincipalName))$PlatformStr`n") + $Result += "- $($User.displayName) ($($User.userPrincipalName))$PlatformStr`n" } } elseif ($NoDesktopUsers.Count -gt 20) { $NeverActivated = @($NoDesktopUsers | Where-Object { $_.neverActivated }).Count - $null = $Result.Append("**$($NoDesktopUsers.Count) users** have no desktop M365 Apps activation") - if ($NeverActivated -gt 0) { $null = $Result.Append(" ($NeverActivated have never activated on any platform)") } - $null = $Result.Append(".`n") + $Result += "**$($NoDesktopUsers.Count) users** have no desktop M365 Apps activation" + if ($NeverActivated -gt 0) { $Result += " ($NeverActivated have never activated on any platform)" } + $Result += ".`n" } } diff --git a/backend/Modules/CIPPTests/Public/Tests/Custom/Invoke-CippTestCustomScripts.ps1 b/backend/Modules/CIPPTests/Public/Tests/Custom/Invoke-CippTestCustomScripts.ps1 index f22c62b234..c9ab3230c8 100644 --- a/backend/Modules/CIPPTests/Public/Tests/Custom/Invoke-CippTestCustomScripts.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/Custom/Invoke-CippTestCustomScripts.ps1 @@ -16,19 +16,9 @@ function Invoke-CippTestCustomScripts { return } - # Pick the latest version per ScriptGuid in a single pass instead of the - # original Group-Object | ForEach-Object { Sort-Object | Select -First 1 } - # pipeline (item 8). - $LatestByGuid = @{} - foreach ($S in $Scripts) { - $Guid = $S.ScriptGuid - if (-not $Guid) { continue } - $Existing = $LatestByGuid[$Guid] - if (-not $Existing -or [int]$S.Version -gt [int]$Existing.Version) { - $LatestByGuid[$Guid] = $S - } + $LatestScripts = $Scripts | Group-Object -Property ScriptGuid | ForEach-Object { + $_.Group | Sort-Object -Property Version -Descending | Select-Object -First 1 } - $LatestScripts = @($LatestByGuid.Values) if (-not [string]::IsNullOrWhiteSpace($ScriptGuid) -and $LatestScripts.Count -eq 0) { Write-Information "No latest custom script found for ScriptGuid: $ScriptGuid" @@ -36,39 +26,25 @@ function Invoke-CippTestCustomScripts { } foreach ($Script in $LatestScripts) { - # Cache PSObject property lookups once per script so we don't pay the - # member-resolution cost repeatedly inside the hot loop (item 13). - $Props = $Script.PSObject.Properties - $EnabledProp = $Props['Enabled'] - $AlertProp = $Props['AlertOnFailure'] - $ResultModeProp = $Props['ResultMode'] - $AlertStatusesProp = $Props['AlertStatuses'] - # We can't prefilter this on table lookup as each script version has its own Enabled property, so we need to check here if the latest version is enabled - $IsEnabled = if ($EnabledProp) { [bool]$EnabledProp.Value } else { $true } + $IsEnabled = if ($Script.PSObject.Properties['Enabled']) { [bool]$Script.Enabled } else { $true } if (-not $IsEnabled) { continue } - $ShouldAlert = if ($AlertProp) { [bool]$AlertProp.Value } else { $false } + $ShouldAlert = $false + if ($Script.PSObject.Properties['AlertOnFailure']) { + $ShouldAlert = [bool]$Script.AlertOnFailure + } - $ResultMode = if ($ResultModeProp -and -not [string]::IsNullOrWhiteSpace($ResultModeProp.Value)) { $ResultModeProp.Value } else { 'Auto' } + $ResultMode = if ($Script.PSObject.Properties['ResultMode'] -and -not [string]::IsNullOrWhiteSpace($Script.ResultMode)) { $Script.ResultMode } else { 'Auto' } $TestId = "CustomScript-$($Script.ScriptGuid)" $ScriptName = if ([string]::IsNullOrWhiteSpace($Script.ScriptName)) { $TestId } else { $Script.ScriptName } - $AllStatuses = @('Passed', 'Failed', 'Info', 'Investigate') $AlertStatuses = @('Failed') - if ($AlertStatusesProp -and -not [string]::IsNullOrWhiteSpace($AlertStatusesProp.Value)) { - $RawAlertStatuses = [string]$AlertStatusesProp.Value - if ($RawAlertStatuses.TrimStart().StartsWith('[')) { - $AlertStatuses = @($RawAlertStatuses | ConvertFrom-Json) - } else { - $AlertStatuses = @($RawAlertStatuses) - } - } - # 'All' alerts on every result status. - if ($AlertStatuses -contains 'All') { - $AlertStatuses = $AllStatuses + if ($Script.PSObject.Properties['AlertStatuses'] -and + -not [string]::IsNullOrWhiteSpace($Script.AlertStatuses)) { + $AlertStatuses = $Script.AlertStatuses | ConvertFrom-Json } try { @@ -115,24 +91,7 @@ function Invoke-CippTestCustomScripts { Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Custom' -Status $FinalStatus -ResultDataJson $ResultDataJson -ResultMarkdown $ResultMarkdown -Risk ($Script.Risk ?? 'Medium') -Name $ScriptName -Pillar $Script.Pillar -UserImpact $Script.UserImpact -ImplementationEffort $Script.ImplementationEffort -Category 'Custom Script' if ($ShouldAlert -and $FinalStatus -in $AlertStatuses) { - # Logbook entry for the UI/audit trail. Uses API 'CustomTests' + a non-alert - # severity so Push-SchedulerCIPPNotifications does not re-ship it. - Write-LogMessage -API 'CustomTests' -tenant $Tenant -message "Custom script test '$ScriptName' returned status '$FinalStatus' ($($Script.ScriptGuid))" -sev Info - # Emit an alert record. Delivery is batched per-tenant by Invoke-CIPPTestCollection - # after the whole suite runs (Send-CIPPCustomTestAlert). Manual single-test runs - # via Push-CIPPTest discard this, so they intentionally do not ship an alert. - [PSCustomObject]@{ - CippCustomTestAlert = $true - TestId = $TestId - ScriptGuid = $Script.ScriptGuid - ScriptName = $ScriptName - Status = $FinalStatus - Risk = $Script.Risk ?? 'Medium' - Pillar = $Script.Pillar - FailedRows = $FailedRows - ResultMarkdown = $ResultMarkdown - ErrorMessage = $null - } + Write-AlertMessage -tenant $Tenant -message "Custom script test failed: $ScriptName ($($Script.ScriptGuid))" } } catch { $ErrorMessage = Get-CippException -Exception $_ @@ -144,19 +103,7 @@ function Invoke-CippTestCustomScripts { } Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Custom' -Status $FinalStatus -ResultMarkdown "Custom script execution failed: $($ErrorMessage.NormalizedError)" -Risk ($Script.Risk ?? 'Medium') -Name $ScriptName -Pillar $Script.Pillar -UserImpact $Script.UserImpact -ImplementationEffort $Script.ImplementationEffort -Category 'Custom Script' if ($ShouldAlert -and $FinalStatus -in $AlertStatuses) { - Write-LogMessage -API 'CustomTests' -tenant $Tenant -message "Custom script execution failed: $ScriptName ($($Script.ScriptGuid)) - $($ErrorMessage.NormalizedError)" -sev Warning - [PSCustomObject]@{ - CippCustomTestAlert = $true - TestId = $TestId - ScriptGuid = $Script.ScriptGuid - ScriptName = $ScriptName - Status = $FinalStatus - Risk = $Script.Risk ?? 'Medium' - Pillar = $Script.Pillar - FailedRows = @() - ResultMarkdown = '' - ErrorMessage = $ErrorMessage.NormalizedError - } + Write-AlertMessage -tenant $Tenant -message "Custom script execution failed: $ScriptName ($($Script.ScriptGuid)) - $($ErrorMessage.NormalizedError)" } } } diff --git a/backend/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA103.ps1 b/backend/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA103.ps1 index ff2fa2fe11..db8d52edd2 100644 --- a/backend/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA103.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA103.ps1 @@ -45,16 +45,16 @@ function Invoke-CippTestORCA103 { if ($FailedPolicies.Count -eq 0) { $Status = 'Passed' - $Result = [System.Text.StringBuilder]::new("All outbound spam filter policies are configured correctly.`n`n") - $null = $Result.Append("**Compliant Policies:** $($PassedPolicies.Count)") + $Result = "All outbound spam filter policies are configured correctly.`n`n" + $Result += "**Compliant Policies:** $($PassedPolicies.Count)" } else { $Status = 'Failed' - $Result = [System.Text.StringBuilder]::new("$($FailedPolicies.Count) outbound spam filter policies are not configured correctly.`n`n") - $null = $Result.Append("**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n") - $null = $Result.Append("| Policy Name | Issues |`n") - $null = $Result.Append("|------------|--------|`n") + $Result = "$($FailedPolicies.Count) outbound spam filter policies are not configured correctly.`n`n" + $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n" + $Result += "| Policy Name | Issues |`n" + $Result += "|------------|--------|`n" foreach ($Failed in $FailedPolicies) { - $null = $Result.Append("| $($Failed.Policy.Identity) | $($Failed.Issues -join '
') |`n") + $Result += "| $($Failed.Policy.Identity) | $($Failed.Issues -join '
') |`n" } } diff --git a/backend/Modules/CIPPTests/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24548.ps1 b/backend/Modules/CIPPTests/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24548.ps1 index 8196f6053a..d595185153 100644 --- a/backend/Modules/CIPPTests/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24548.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24548.ps1 @@ -33,18 +33,18 @@ function Invoke-CippTestZTNA24548 { $Passed = $AssignedPolicies.Count -gt 0 if ($Passed) { - $ResultMarkdown = [System.Text.StringBuilder]::new("✅ At least one iOS app protection policy exists and is assigned.`n`n") + $ResultMarkdown = "✅ At least one iOS app protection policy exists and is assigned.`n`n" } else { - $ResultMarkdown = [System.Text.StringBuilder]::new("❌ iOS app protection policies exist but none are assigned.`n`n") + $ResultMarkdown = "❌ iOS app protection policies exist but none are assigned.`n`n" } - $null = $ResultMarkdown.Append("## iOS App Protection Policies`n`n") - $null = $ResultMarkdown.Append("| Policy Name | Assigned |`n") - $null = $ResultMarkdown.Append("| :---------- | :------- |`n") + $ResultMarkdown += "## iOS App Protection Policies`n`n" + $ResultMarkdown += "| Policy Name | Assigned |`n" + $ResultMarkdown += "| :---------- | :------- |`n" foreach ($policy in $IosPolicies) { $assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' } - $null = $ResultMarkdown.Append("| $($policy.displayName) | $assigned |`n") + $ResultMarkdown += "| $($policy.displayName) | $assigned |`n" } $Status = if ($Passed) { 'Passed' } else { 'Failed' } diff --git a/backend/Modules/CIPPTests/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24549.ps1 b/backend/Modules/CIPPTests/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24549.ps1 index b2ef4a25e3..861434fcb1 100644 --- a/backend/Modules/CIPPTests/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24549.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24549.ps1 @@ -33,18 +33,18 @@ function Invoke-CippTestZTNA24549 { $Passed = $AssignedPolicies.Count -gt 0 if ($Passed) { - $ResultMarkdown = [System.Text.StringBuilder]::new("✅ At least one Android app protection policy exists and is assigned.`n`n") + $ResultMarkdown = "✅ At least one Android app protection policy exists and is assigned.`n`n" } else { - $ResultMarkdown = [System.Text.StringBuilder]::new("❌ Android app protection policies exist but none are assigned.`n`n") + $ResultMarkdown = "❌ Android app protection policies exist but none are assigned.`n`n" } - $null = $ResultMarkdown.Append("## Android App Protection Policies`n`n") - $null = $ResultMarkdown.Append("| Policy Name | Assigned |`n") - $null = $ResultMarkdown.Append("| :---------- | :------- |`n") + $ResultMarkdown += "## Android App Protection Policies`n`n" + $ResultMarkdown += "| Policy Name | Assigned |`n" + $ResultMarkdown += "| :---------- | :------- |`n" foreach ($policy in $AndroidPolicies) { $assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' } - $null = $ResultMarkdown.Append("| $($policy.displayName) | $assigned |`n") + $ResultMarkdown += "| $($policy.displayName) | $assigned |`n" } $Status = if ($Passed) { 'Passed' } else { 'Failed' } diff --git a/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21813.ps1 b/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21813.ps1 index 5221f3137d..be1777c45c 100644 --- a/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21813.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21813.ps1 @@ -98,13 +98,13 @@ function Invoke-CippTestZTNA21813 { $HasHighRatio = $true } - $MdInfo = [System.Text.StringBuilder]::new("`n## Privileged role assignment summary`n`n") - $null = $MdInfo.Append("**Global administrator role count:** $GARoleAssignmentCount ($GAPercentage%) - $StatusIndicator`n`n") - $null = $MdInfo.Append("**Other privileged role count:** $PrivilegedRoleAssignmentCount ($OtherPercentage%)`n`n") + $MdInfo = "`n## Privileged role assignment summary`n`n" + $MdInfo += "**Global administrator role count:** $GARoleAssignmentCount ($GAPercentage%) - $StatusIndicator`n`n" + $MdInfo += "**Other privileged role count:** $PrivilegedRoleAssignmentCount ($OtherPercentage%)`n`n" - $null = $MdInfo.Append("## User privileged role assignments`n`n") - $null = $MdInfo.Append("| User | Global administrator | Other Privileged Role(s) |`n") - $null = $MdInfo.Append("| :--- | :------------------- | :------ |`n") + $MdInfo += "## User privileged role assignments`n`n" + $MdInfo += "| User | Global administrator | Other Privileged Role(s) |`n" + $MdInfo += "| :--- | :------------------- | :------ |`n" $SortedUsers = $UserRoleMap.Values | Sort-Object @{Expression = { -not $_.IsGA } }, @{Expression = { $_.User.displayName } } @@ -116,11 +116,11 @@ function Invoke-CippTestZTNA21813 { $RolesList = if ($OtherRoles.Count -gt 0) { ($OtherRoles -join ', ') } else { '-' } $UserLink = "https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/AdministrativeRole/userId/$($User.id)/hidePreviewBanner~/true" - $null = $MdInfo.Append("| [$($User.displayName)]($UserLink) | $IsGA | $RolesList |`n") + $MdInfo += "| [$($User.displayName)]($UserLink) | $IsGA | $RolesList |`n" } if ($UserRoleMap.Count -eq 0) { - $null = $MdInfo.Append("| No privileged users found | - | - |`n") + $MdInfo += "| No privileged users found | - | - |`n" } if ($TotalPrivilegedRoleAssignmentCount -eq 0) { diff --git a/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21816.ps1 b/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21816.ps1 index 23ac636141..689af69779 100644 --- a/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21816.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21816.ps1 @@ -24,32 +24,18 @@ function Invoke-CippTestZTNA21816 { $Users = Get-CIPPTestData -TenantFilter $Tenant -Type 'Users' $Groups = Get-CIPPTestData -TenantFilter $Tenant -Type 'Groups' - $EligibleGAs = $RoleEligibilitySchedules.Where({ $_.roleDefinitionId -eq $GlobalAdminRoleId }) + $EligibleGAs = $RoleEligibilitySchedules | Where-Object { $_.roleDefinitionId -eq $GlobalAdminRoleId } $EligibleGAUsers = 0 - # Build id-keyed lookups once to avoid O(N*M) Where-Object scans - $UsersById = @{} - foreach ($U in $Users) { $UsersById[$U.id] = $U } - $GroupsById = @{} - foreach ($G in $Groups) { $GroupsById[$G.id] = $G } - # Composite-key lookup: principalId|roleDefinitionId - $AssignmentByPrincipalRole = @{} - foreach ($A in $RoleAssignmentScheduleInstances) { - $key = '{0}|{1}' -f $A.principalId, $A.roleDefinitionId - if (-not $AssignmentByPrincipalRole.ContainsKey($key)) { - $AssignmentByPrincipalRole[$key] = $A - } - } - foreach ($EligibleGA in $EligibleGAs) { - $Principal = $UsersById[$EligibleGA.principalId] + $Principal = $Users | Where-Object { $_.id -eq $EligibleGA.principalId } | Select-Object -First 1 if ($Principal) { $EligibleGAUsers++ } else { - $GroupPrincipal = $GroupsById[$EligibleGA.principalId] - if ($GroupPrincipal -and $GroupPrincipal.members) { - $MemberSet = [System.Collections.Generic.HashSet[string]]::new([string[]]$GroupPrincipal.members) - foreach ($U in $Users) { if ($MemberSet.Contains($U.id)) { $EligibleGAUsers++ } } + $GroupPrincipal = $Groups | Where-Object { $_.id -eq $EligibleGA.principalId } | Select-Object -First 1 + if ($GroupPrincipal) { + $GroupMembers = $Users | Where-Object { $_.id -in $GroupPrincipal.members } + $EligibleGAUsers = $EligibleGAUsers + $GroupMembers.Count } } } @@ -62,7 +48,9 @@ function Invoke-CippTestZTNA21816 { $RoleMembers = Get-CippDbRoleMembers -TenantFilter $Tenant -RoleTemplateId $Role.RoletemplateId foreach ($Member in $RoleMembers) { - $Assignment = $AssignmentByPrincipalRole['{0}|{1}' -f $Member.id, $Role.RoletemplateId] + $Assignment = $RoleAssignmentScheduleInstances | Where-Object { + $_.principalId -eq $Member.id -and $_.roleDefinitionId -eq $Role.RoletemplateId + } | Select-Object -First 1 if (-not $Assignment -or ($Assignment.assignmentType -eq 'Assigned' -and $null -eq $Assignment.endDateTime)) { $MemberInfo = [PSCustomObject]@{ @@ -86,7 +74,9 @@ function Invoke-CippTestZTNA21816 { $GAMembers = Get-CippDbRoleMembers -TenantFilter $Tenant -RoleTemplateId $GlobalAdminRoleId foreach ($Member in $GAMembers) { - $Assignment = $AssignmentByPrincipalRole['{0}|{1}' -f $Member.id, $GlobalAdminRoleId] + $Assignment = $RoleAssignmentScheduleInstances | Where-Object { + $_.principalId -eq $Member.id -and $_.roleDefinitionId -eq $GlobalAdminRoleId + } | Select-Object -First 1 if (-not $Assignment -or ($Assignment.assignmentType -eq 'Assigned' -and $null -eq $Assignment.endDateTime)) { $MemberInfo = [PSCustomObject]@{ @@ -100,7 +90,7 @@ function Invoke-CippTestZTNA21816 { } if ($Member.'@odata.type' -eq '#microsoft.graph.user') { - $UserDetail = $UsersById[$Member.id] + $UserDetail = $Users | Where-Object { $_.id -eq $Member.id } | Select-Object -First 1 if ($UserDetail) { $MemberInfo.onPremisesSyncEnabled = $UserDetail.onPremisesSyncEnabled } @@ -108,11 +98,10 @@ function Invoke-CippTestZTNA21816 { } elseif ($Member.'@odata.type' -eq '#microsoft.graph.group') { $PermanentGAGroupList.Add($MemberInfo) - $Group = $GroupsById[$Member.id] - if ($Group -and $Group.members) { - $MemberSet = [System.Collections.Generic.HashSet[string]]::new([string[]]$Group.members) - foreach ($GroupMember in $Users) { - if (-not $MemberSet.Contains($GroupMember.id)) { continue } + $Group = $Groups | Where-Object { $_.id -eq $Member.id } | Select-Object -First 1 + if ($Group) { + $GroupMembers = $Users | Where-Object { $_.id -in $Group.members } + foreach ($GroupMember in $GroupMembers) { $GroupMemberInfo = [PSCustomObject]@{ displayName = $GroupMember.displayName userPrincipalName = $GroupMember.userPrincipalName @@ -136,53 +125,53 @@ function Invoke-CippTestZTNA21816 { if (-not $HasPIMUsage) { $Passed = $false - $ResultMarkdown = [System.Text.StringBuilder]::new('No eligible Global Administrator assignments found. PIM usage cannot be confirmed.') + $ResultMarkdown = 'No eligible Global Administrator assignments found. PIM usage cannot be confirmed.' } elseif ($HasNonPIMPrivileged) { $Passed = $false - $ResultMarkdown = [System.Text.StringBuilder]::new('Found Microsoft Entra privileged role assignments that are not managed with PIM.') + $ResultMarkdown = 'Found Microsoft Entra privileged role assignments that are not managed with PIM.' } elseif ($PermanentGACount -gt 2) { $Passed = $false $CustomStatus = 'Investigate' - $ResultMarkdown = [System.Text.StringBuilder]::new('Three or more accounts are permanently assigned the Global Administrator role. Review to determine whether these are emergency access accounts.') + $ResultMarkdown = 'Three or more accounts are permanently assigned the Global Administrator role. Review to determine whether these are emergency access accounts.' } else { $Passed = $true - $ResultMarkdown = [System.Text.StringBuilder]::new('All Microsoft Entra privileged role assignments are managed with PIM with the exception of up to two standing Global Administrator accounts.') + $ResultMarkdown = 'All Microsoft Entra privileged role assignments are managed with PIM with the exception of up to two standing Global Administrator accounts.' } - $null = $ResultMarkdown.Append("`n`n## Assessment summary`n`n") - $null = $ResultMarkdown.Append("| Metric | Count |`n") - $null = $ResultMarkdown.Append("| :----- | :---- |`n") - $null = $ResultMarkdown.Append("| Privileged roles found | $($PrivilegedRoles.Count) |`n") - $null = $ResultMarkdown.Append("| Eligible Global Administrators | $EligibleGAUsers |`n") - $null = $ResultMarkdown.Append("| Non-PIM privileged users | $($NonPIMPrivilegedUsers.Count) |`n") - $null = $ResultMarkdown.Append("| Non-PIM privileged groups | $($NonPIMPrivilegedGroups.Count) |`n") - $null = $ResultMarkdown.Append("| Permanent Global Administrator users | $($PermanentGAUserList.Count) |`n") + $ResultMarkdown += "`n`n## Assessment summary`n`n" + $ResultMarkdown += "| Metric | Count |`n" + $ResultMarkdown += "| :----- | :---- |`n" + $ResultMarkdown += "| Privileged roles found | $($PrivilegedRoles.Count) |`n" + $ResultMarkdown += "| Eligible Global Administrators | $EligibleGAUsers |`n" + $ResultMarkdown += "| Non-PIM privileged users | $($NonPIMPrivilegedUsers.Count) |`n" + $ResultMarkdown += "| Non-PIM privileged groups | $($NonPIMPrivilegedGroups.Count) |`n" + $ResultMarkdown += "| Permanent Global Administrator users | $($PermanentGAUserList.Count) |`n" if ($NonPIMPrivilegedUsers.Count -gt 0 -or $NonPIMPrivilegedGroups.Count -gt 0) { - $null = $ResultMarkdown.Append("`n## Non-PIM managed privileged role assignments`n`n") - $null = $ResultMarkdown.Append("| Display name | User principal name | Role name | Assignment type |`n") - $null = $ResultMarkdown.Append("| :----------- | :------------------ | :-------- | :-------------- |`n") + $ResultMarkdown += "`n## Non-PIM managed privileged role assignments`n`n" + $ResultMarkdown += "| Display name | User principal name | Role name | Assignment type |`n" + $ResultMarkdown += "| :----------- | :------------------ | :-------- | :-------------- |`n" foreach ($User in $NonPIMPrivilegedUsers) { $UserLink = "https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/AdministrativeRole/userId/$($User.id)/hidePreviewBanner~/true" - $null = $ResultMarkdown.Append("| [$($User.displayName)]($UserLink) | $($User.userPrincipalName) | $($User.roleName) | $($User.assignmentType) |`n") + $ResultMarkdown += "| [$($User.displayName)]($UserLink) | $($User.userPrincipalName) | $($User.roleName) | $($User.assignmentType) |`n" } foreach ($Group in $NonPIMPrivilegedGroups) { $GroupLink = "https://entra.microsoft.com/#view/Microsoft_AAD_IAM/GroupDetailsMenuBlade/~/RolesAndAdministrators/groupId/$($Group.id)/menuId/" - $null = $ResultMarkdown.Append("| [$($Group.displayName)]($GroupLink) | N/A (Group) | $($Group.roleName) | $($Group.assignmentType) |`n") + $ResultMarkdown += "| [$($Group.displayName)]($GroupLink) | N/A (Group) | $($Group.roleName) | $($Group.assignmentType) |`n" } } if ($PermanentGAUserList.Count -gt 0) { - $null = $ResultMarkdown.Append("`n## Permanent Global Administrator assignments`n`n") - $null = $ResultMarkdown.Append("| Display name | User principal name | Assignment type | On-Premises synced |`n") - $null = $ResultMarkdown.Append("| :----------- | :------------------ | :-------------- | :----------------- |`n") + $ResultMarkdown += "`n## Permanent Global Administrator assignments`n`n" + $ResultMarkdown += "| Display name | User principal name | Assignment type | On-Premises synced |`n" + $ResultMarkdown += "| :----------- | :------------------ | :-------------- | :----------------- |`n" foreach ($User in $PermanentGAUserList) { $SyncStatus = if ($null -ne $User.onPremisesSyncEnabled) { $User.onPremisesSyncEnabled } else { 'N/A' } $UserLink = "https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/AdministrativeRole/userId/$($User.id)/hidePreviewBanner~/true" - $null = $ResultMarkdown.Append("| [$($User.displayName)]($UserLink) | $($User.userPrincipalName) | $($User.assignmentType) | $SyncStatus |`n") + $ResultMarkdown += "| [$($User.displayName)]($UserLink) | $($User.userPrincipalName) | $($User.assignmentType) | $SyncStatus |`n" } } diff --git a/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21818.ps1 b/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21818.ps1 index 1830d74434..fd76d22ce1 100644 --- a/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21818.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21818.ps1 @@ -95,19 +95,19 @@ function Invoke-CippTestZTNA21818 { } if ($Passed) { - $ResultMarkdown = [System.Text.StringBuilder]::new("Role notifications are properly configured for privileged role.`n`n") + $ResultMarkdown = "Role notifications are properly configured for privileged role.`n`n" } else { - $ResultMarkdown = [System.Text.StringBuilder]::new("Role notifications are not properly configured.`n`nNote: To save time, this check stops when it finds the first role that does not have notifications. After fixing this role and all other roles, we recommend running the check again to verify.`n`n") + $ResultMarkdown = "Role notifications are not properly configured.`n`nNote: To save time, this check stops when it finds the first role that does not have notifications. After fixing this role and all other roles, we recommend running the check again to verify.`n`n" } - $null = $ResultMarkdown.Append("## Notifications for high privileged roles`n`n") - $null = $ResultMarkdown.Append("| Role Name | Notification Scenario | Notification Type | Default Recipients Enabled | Additional Recipients |`n") - $null = $ResultMarkdown.Append("| :-------- | :-------------------- | :---------------- | :------------------------- | :-------------------- |`n") + $ResultMarkdown += "## Notifications for high privileged roles`n`n" + $ResultMarkdown += "| Role Name | Notification Scenario | Notification Type | Default Recipients Enabled | Additional Recipients |`n" + $ResultMarkdown += "| :-------- | :-------------------- | :---------------- | :------------------------- | :-------------------- |`n" foreach ($NotificationRule in $NotificationRules) { $MatchingNotification = $Notifications | Where-Object { $_.RuleId -eq $NotificationRule.id } $Recipients = if ($NotificationRule.notificationRecipients) { ($NotificationRule.notificationRecipients -join ', ') } else { '' } - $null = $ResultMarkdown.Append("| $($NotificationRule.roleDisplayName) | $($MatchingNotification.notificationScenario) | $($MatchingNotification.notificationType) | $($NotificationRule.isDefaultRecipientsEnabled) | $Recipients |`n") + $ResultMarkdown += "| $($NotificationRule.roleDisplayName) | $($MatchingNotification.notificationScenario) | $($MatchingNotification.notificationType) | $($NotificationRule.isDefaultRecipientsEnabled) | $Recipients |`n" } $Status = if ($Passed) { 'Passed' } else { 'Failed' } diff --git a/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21819.ps1 b/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21819.ps1 index 30e4ff7adc..139eda5675 100644 --- a/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21819.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21819.ps1 @@ -52,13 +52,13 @@ function Invoke-CippTestZTNA21819 { } if ($Passed -eq 'Passed') { - $ResultMarkdown = [System.Text.StringBuilder]::new("Activation alerts are configured for Global Administrator role.`n`n") + $ResultMarkdown = "Activation alerts are configured for Global Administrator role.`n`n" } else { - $ResultMarkdown = [System.Text.StringBuilder]::new("Activation alerts are missing or improperly configured for Global Administrator role.`n`n") + $ResultMarkdown = "Activation alerts are missing or improperly configured for Global Administrator role.`n`n" } - $null = $ResultMarkdown.Append("| Role display name | Default recipients | Additional recipients |`n") - $null = $ResultMarkdown.Append("| :---------------- | :----------------- | :------------------- |`n") + $ResultMarkdown += "| Role display name | Default recipients | Additional recipients |`n" + $ResultMarkdown += "| :---------------- | :----------------- | :------------------- |`n" $RoleLink = 'https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RolesManagementMenuBlade/~/AllRoles' $DisplayNameLink = "[$($GlobalAdminRole.displayName)]($RoleLink)" @@ -77,7 +77,7 @@ function Invoke-CippTestZTNA21819 { $Recipients } - $null = $ResultMarkdown.Append("| $DisplayNameLink | $DefaultRecipientsStatus | $RecipientsDisplay |`n") + $ResultMarkdown += "| $DisplayNameLink | $DefaultRecipientsStatus | $RecipientsDisplay |`n" Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'Low' -Name 'Activation alert for Global Administrator role assignment' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Privileged access' diff --git a/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21820.ps1 b/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21820.ps1 index ecb621ade6..521fae3597 100644 --- a/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21820.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21820.ps1 @@ -72,15 +72,15 @@ function Invoke-CippTestZTNA21820 { } if ($RolesWithIssues.Count -eq 0) { - $ResultMarkdown = [System.Text.StringBuilder]::new('Activation alerts are configured for privileged role assignments.') + $ResultMarkdown = 'Activation alerts are configured for privileged role assignments.' } else { - $ResultMarkdown = [System.Text.StringBuilder]::new('Activation alerts are missing or improperly configured for privileged roles.') + $ResultMarkdown = 'Activation alerts are missing or improperly configured for privileged roles.' } if ($RolesWithIssues.Count -gt 0) { - $null = $ResultMarkdown.Append("`n`n## Roles with missing or misconfigured alerts`n`n") - $null = $ResultMarkdown.Append("| Role display name | Default recipients | Additional recipients |`n") - $null = $ResultMarkdown.Append("| :---------------- | :----------------- | :------------------- |`n") + $ResultMarkdown += "`n`n## Roles with missing or misconfigured alerts`n`n" + $ResultMarkdown += "| Role display name | Default recipients | Additional recipients |`n" + $ResultMarkdown += "| :---------------- | :----------------- | :------------------- |`n" foreach ($RoleIssue in $RolesWithIssues) { $Role = $RoleIssue.Role @@ -94,9 +94,9 @@ function Invoke-CippTestZTNA21820 { } $Recipients = $RoleIssue.NotificationRecipients - $null = $ResultMarkdown.Append("| $DisplayNameLink | $DefaultRecipientsStatus | $Recipients |`n") + $ResultMarkdown += "| $DisplayNameLink | $DefaultRecipientsStatus | $Recipients |`n" } - $null = $ResultMarkdown.Append("`n`n*Not all misconfigured roles may be listed. For performance reasons, this assessment stops at the first detected issue.*`n") + $ResultMarkdown += "`n`n*Not all misconfigured roles may be listed. For performance reasons, this assessment stops at the first detected issue.*`n" } Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'Low' -Name 'Activation alert for all privileged role assignments' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Privileged access' diff --git a/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21835.ps1 b/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21835.ps1 index 6077b5469d..3289e67d6d 100644 --- a/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21835.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21835.ps1 @@ -129,27 +129,27 @@ function Invoke-CippTestZTNA21835 { $AccountCount = $EmergencyAccessAccounts.Count $Passed = 'Failed' - $ResultMarkdown = [System.Text.StringBuilder]::new() + $ResultMarkdown = '' if ($AccountCount -lt 2) { - $ResultMarkdown = [System.Text.StringBuilder]::new("Fewer than two emergency access accounts were identified based on cloud-only state, registered phishing-resistant credentials and Conditional Access policy exclusions.`n`n") + $ResultMarkdown = "Fewer than two emergency access accounts were identified based on cloud-only state, registered phishing-resistant credentials and Conditional Access policy exclusions.`n`n" } elseif ($AccountCount -ge 2 -and $AccountCount -le 4) { $Passed = 'Passed' - $ResultMarkdown = [System.Text.StringBuilder]::new("Emergency access accounts appear to be configured as per Microsoft guidance based on cloud-only state, registered phishing-resistant credentials and Conditional Access policy exclusions.`n`n") + $ResultMarkdown = "Emergency access accounts appear to be configured as per Microsoft guidance based on cloud-only state, registered phishing-resistant credentials and Conditional Access policy exclusions.`n`n" } else { - $ResultMarkdown = [System.Text.StringBuilder]::new("$AccountCount emergency access accounts appear to be configured based on cloud-only state, registered phishing-resistant credentials and Conditional Access policy exclusions. Review these accounts to determine whether this volume is excessive for your organization.`n`n") + $ResultMarkdown = "$AccountCount emergency access accounts appear to be configured based on cloud-only state, registered phishing-resistant credentials and Conditional Access policy exclusions. Review these accounts to determine whether this volume is excessive for your organization.`n`n" } - $null = $ResultMarkdown.Append("**Summary:**`n") - $null = $ResultMarkdown.Append("- Total permanent Global Administrators: $($PermanentGAMembers.Count)`n") - $null = $ResultMarkdown.Append("- Cloud-only GAs with phishing-resistant auth: $($EmergencyAccountCandidates.Count)`n") - $null = $ResultMarkdown.Append("- Emergency access accounts (excluded from all CA): $AccountCount`n") - $null = $ResultMarkdown.Append("- Enabled Conditional Access policies: $($EnabledCAPolicies.Count)`n`n") + $ResultMarkdown += "**Summary:**`n" + $ResultMarkdown += "- Total permanent Global Administrators: $($PermanentGAMembers.Count)`n" + $ResultMarkdown += "- Cloud-only GAs with phishing-resistant auth: $($EmergencyAccountCandidates.Count)`n" + $ResultMarkdown += "- Emergency access accounts (excluded from all CA): $AccountCount`n" + $ResultMarkdown += "- Enabled Conditional Access policies: $($EnabledCAPolicies.Count)`n`n" if ($EmergencyAccessAccounts.Count -gt 0) { - $null = $ResultMarkdown.Append("## Emergency access accounts`n`n") - $null = $ResultMarkdown.Append("| Display name | UPN | Synced from on-premises | Authentication methods |`n") - $null = $ResultMarkdown.Append("| :----------- | :-- | :---------------------- | :--------------------- |`n") + $ResultMarkdown += "## Emergency access accounts`n`n" + $ResultMarkdown += "| Display name | UPN | Synced from on-premises | Authentication methods |`n" + $ResultMarkdown += "| :----------- | :-- | :---------------------- | :--------------------- |`n" foreach ($Account in $EmergencyAccessAccounts) { $SyncStatus = if ($Account.OnPremisesSyncEnabled -ne $true) { 'No' } else { 'Yes' } @@ -158,15 +158,15 @@ function Invoke-CippTestZTNA21835 { }) -join ', ' $PortalLink = "https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/overview/userId/$($Account.Id)" - $null = $ResultMarkdown.Append("| $($Account.DisplayName) | [$($Account.UserPrincipalName)]($PortalLink) | $SyncStatus | $AuthMethodDisplay |`n") + $ResultMarkdown += "| $($Account.DisplayName) | [$($Account.UserPrincipalName)]($PortalLink) | $SyncStatus | $AuthMethodDisplay |`n" } - $null = $ResultMarkdown.Append("`n") + $ResultMarkdown += "`n" } if ($PermanentGAMembers.Count -gt 0) { - $null = $ResultMarkdown.Append("## All permanent Global Administrators`n`n") - $null = $ResultMarkdown.Append("| Display name | UPN | Cloud only | All CA excluded | Phishing resistant auth |`n") - $null = $ResultMarkdown.Append("| :----------- | :-- | :--------: | :---------: | :---------------------: |`n") + $ResultMarkdown += "## All permanent Global Administrators`n`n" + $ResultMarkdown += "| Display name | UPN | Cloud only | All CA excluded | Phishing resistant auth |`n" + $ResultMarkdown += "| :----------- | :-- | :--------: | :---------: | :---------------------: |`n" $UserSummary = [System.Collections.Generic.List[object]]::new() foreach ($Member in $PermanentGAMembers) { @@ -196,10 +196,10 @@ function Invoke-CippTestZTNA21835 { } foreach ($UserSum in $UserSummary) { - $null = $ResultMarkdown.Append("| $($UserSum.DisplayName) | [$($UserSum.UserPrincipalName)]($($UserSum.PortalLink)) | $($UserSum.CloudOnly) | $($UserSum.CAExcluded) | $($UserSum.PhishingResistant) |`n") + $ResultMarkdown += "| $($UserSum.DisplayName) | [$($UserSum.UserPrincipalName)]($($UserSum.PortalLink)) | $($UserSum.CloudOnly) | $($UserSum.CAExcluded) | $($UserSum.PhishingResistant) |`n" } - $null = $ResultMarkdown.Append("`n") + $ResultMarkdown += "`n" } Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Emergency access accounts are configured appropriately' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Application management' diff --git a/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21836.ps1 b/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21836.ps1 index aef4e53a6c..8700176859 100644 --- a/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21836.ps1 +++ b/backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21836.ps1 @@ -42,24 +42,24 @@ function Invoke-CippTestZTNA21836 { } $Passed = 'Passed' - $ResultMarkdown = [System.Text.StringBuilder]::new() + $ResultMarkdown = '' if ($WorkloadIdentitiesWithPrivilegedRoles.Count -gt 0) { $Passed = 'Failed' - $ResultMarkdown = [System.Text.StringBuilder]::new("**Found workload identities assigned to privileged roles.**`n") - $null = $ResultMarkdown.Append("| Service Principal Name | Privileged Role | Assignment Type |`n") - $null = $ResultMarkdown.Append("| :--- | :--- | :--- |`n") + $ResultMarkdown = "**Found workload identities assigned to privileged roles.**`n" + $ResultMarkdown += "| Service Principal Name | Privileged Role | Assignment Type |`n" + $ResultMarkdown += "| :--- | :--- | :--- |`n" $SortedAssignments = $WorkloadIdentitiesWithPrivilegedRoles | Sort-Object -Property PrincipalDisplayName foreach ($Assignment in $SortedAssignments) { $SPLink = "https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/$($Assignment.PrincipalId)/appId/$($Assignment.AppId)" - $null = $ResultMarkdown.Append("| [$($Assignment.PrincipalDisplayName)]($SPLink) | $($Assignment.RoleDisplayName) | $($Assignment.AssignmentType) |`n") + $ResultMarkdown += "| [$($Assignment.PrincipalDisplayName)]($SPLink) | $($Assignment.RoleDisplayName) | $($Assignment.AssignmentType) |`n" } - $null = $ResultMarkdown.Append("`n") - $null = $ResultMarkdown.Append("`n**Recommendation:** Review and remove privileged role assignments from workload identities unless absolutely necessary. Use least-privilege principles and consider alternative approaches like managed identities with specific API permissions instead of directory roles.`n") + $ResultMarkdown += "`n" + $ResultMarkdown += "`n**Recommendation:** Review and remove privileged role assignments from workload identities unless absolutely necessary. Use least-privilege principles and consider alternative approaches like managed identities with specific API permissions instead of directory roles.`n" } else { - $ResultMarkdown = [System.Text.StringBuilder]::new("✅ **No workload identities found with privileged role assignments.**`n") + $ResultMarkdown = "✅ **No workload identities found with privileged role assignments.**`n" } Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Workload Identities are not assigned privileged roles' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application management' diff --git a/backend/Modules/CippExtensions/Public/Extension Functions/Remove-ExtensionAPIKey.ps1 b/backend/Modules/CippExtensions/Public/Extension Functions/Remove-ExtensionAPIKey.ps1 index 1dfb46fcb6..bbde370e6e 100644 --- a/backend/Modules/CippExtensions/Public/Extension Functions/Remove-ExtensionAPIKey.ps1 +++ b/backend/Modules/CippExtensions/Public/Extension Functions/Remove-ExtensionAPIKey.ps1 @@ -19,7 +19,7 @@ function Remove-ExtensionAPIKey { Write-Information "No existing DevSecrets row found for '$Extension' to delete." } } else { - $keyvaultname = Get-CippKeyVaultName + $keyvaultname = ($env:WEBSITE_DEPLOYMENT_ID -split '-')[0] try { $null = Remove-CippKeyVaultSecret -VaultName $keyvaultname -Name $Extension } catch { diff --git a/backend/Modules/CippExtensions/Public/Hudu/Invoke-HuduExtensionSync.ps1 b/backend/Modules/CippExtensions/Public/Hudu/Invoke-HuduExtensionSync.ps1 index 593594eefc..0651aaa3ae 100644 --- a/backend/Modules/CippExtensions/Public/Hudu/Invoke-HuduExtensionSync.ps1 +++ b/backend/Modules/CippExtensions/Public/Hudu/Invoke-HuduExtensionSync.ps1 @@ -966,7 +966,7 @@ function Invoke-HuduExtensionSync { if ($EnableCIPP) { $CIPPLinksFormatted.add((Get-HuduLinkBlock -URL "$($CIPPURL)/identity/administration/users/user?tenantFilter=$($Tenant.defaultDomainName)&userId=$($User.id)" -Icon 'far fa-eye' -Title 'CIPP - View User')) $CIPPLinksFormatted.add((Get-HuduLinkBlock -URL "$($CIPPURL)/identity/administration/users/user/edit?tenantFilter=$($Tenant.defaultDomainName)&userId=$($User.id)" -Icon 'fas fa-user-cog' -Title 'CIPP - Edit User')) - $CIPPLinksFormatted.add((Get-HuduLinkBlock -URL "$($CIPPURL)/identity/administration/bec/case?tenantFilter=$($Tenant.defaultDomainName)&userId=$($User.id)" -Icon 'fas fa-user-secret' -Title 'CIPP - BEC Tool')) + $CIPPLinksFormatted.add((Get-HuduLinkBlock -URL "$($CIPPURL)/identity/administration/users/user/bec?tenantFilter=$($Tenant.defaultDomainName)&userId=$($User.id))" -Icon 'fas fa-user-secret' -Title 'CIPP - BEC Tool')) } [System.Collections.Generic.List[PSCustomObject]]$UserLinksFormatted = @() @@ -991,7 +991,7 @@ function Invoke-HuduExtensionSync { # Hash is calculated before the timestamp is added, otherwise every asset would be rewritten on every sync $NewHash = Get-StringHash -String $UserBody $UserAssetFields = @{ - microsoft_365 = "$UserBody
Last Updated: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')
" + microsoft_365 = "
Last Updated: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')
$UserBody" email_address = $user.userPrincipalName licenses = $userLicenses } @@ -1129,7 +1129,7 @@ function Invoke-HuduExtensionSync { foreach ($Status in $MatchingStatuses) { Write-Information "Processing Status for Device $($device.deviceName), Policy $($Policy.displayName)" # Filter out invalid statuses - if ($Status.status -and $Status.status -ne 'unknown' -and $null -ne $Status.status) { + if ($Status.status -and $Status.status -ne 'unknown' -and $Status.status -ne $null) { try { $LastReport = if ($Status.lastReportedDateTime) { (Get-Date $Status.lastReportedDateTime -Format 'yyyy-MM-dd HH:mm:ss') @@ -1213,7 +1213,7 @@ function Invoke-HuduExtensionSync { $DeviceIntuneDetailshtml = "
$DeviceLinksBlock
$($DeviceOverviewBlock)$($DeviceHardwareBlock)$($DeviceEnrollmentBlock)$($DevicePolicyBlock)$($DeviceAppsBlock)$($DeviceGroupsBlock)
" $DeviceAssetFields = @{ - microsoft_365 = "$DeviceIntuneDetailshtml
Last Updated: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')
" + microsoft_365 = "
Last Updated: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')
$DeviceIntuneDetailshtml" } # Exclude the timestamp from the hash so unchanged assets are not rewritten on every sync. $DeviceHashMaterial = $DeviceIntuneDetailshtml @@ -1266,7 +1266,7 @@ function Invoke-HuduExtensionSync { $RetrieveLAPSPassword = $IsNewHuduDevice -or -not $ExistingLAPSCredentialPresent -or [string]::IsNullOrWhiteSpace($ExistingLAPSBackupDate) -or $ExistingLAPSBackupDate -ne $LAPSBackupDate if ($RetrieveLAPSPassword) { - $LAPSResult = Get-CIPPLapsPassword -Device $Device.azureADDeviceId -TenantFilter $TenantFilter -ErrorAction Stop + $LAPSResult = try { Get-CIPPLapsPassword -Device $Device.azureADDeviceId -TenantFilter $TenantFilter -ErrorAction Stop } catch [System.Management.Automation.ItemNotFoundException] { $null } if ($LAPSResult -isnot [string] -and $LAPSResult.state -eq 'success' -and -not [string]::IsNullOrWhiteSpace([string]$LAPSResult.accountName) -and -not [string]::IsNullOrWhiteSpace([string]$LAPSResult.copyField) -and -not [string]::IsNullOrWhiteSpace([string]$LAPSResult.backupDateTime)) { $LAPSAccount = ([string]$LAPSResult.accountName) -replace '^\.\\', '' $LAPSBackupDate = [string]$LAPSResult.backupDateTime @@ -1274,7 +1274,7 @@ function Invoke-HuduExtensionSync { $DeviceAssetFields.laps_password = [string]$LAPSResult.copyField $CredentialFieldsChanged = $true $DeviceAssetFields.laps_backup_date = $LAPSBackupDate - } elseif ([string]$LAPSResult -like 'No LAPS password found*') { + } elseif ($null -eq $LAPSResult) { $LAPSAccount = '' $LAPSBackupDate = '' $DeviceAssetFields.laps_account = '' diff --git a/backend/Modules/CippExtensions/Public/NinjaOne/Get-NinjaOneFieldMapping.ps1 b/backend/Modules/CippExtensions/Public/NinjaOne/Get-NinjaOneFieldMapping.ps1 index 402f12c512..850aaa3817 100644 --- a/backend/Modules/CippExtensions/Public/NinjaOne/Get-NinjaOneFieldMapping.ps1 +++ b/backend/Modules/CippExtensions/Public/NinjaOne/Get-NinjaOneFieldMapping.ps1 @@ -92,11 +92,11 @@ function Get-NinjaOneFieldMapping { $Token = Get-NinjaOneToken -configuration $Configuration - $NinjaCustomFieldsNodeRaw = (Invoke-WebRequest -Uri "https://$($Configuration.Instance)/api/v2/device-custom-fields?scopes=node" -Method GET -Headers @{Authorization = "Bearer $($token.access_token)" } -ContentType 'application/json').content | ConvertFrom-Json -Depth 100 + $NinjaCustomFieldsNodeRaw = (Invoke-WebRequest -Uri "https://$($Configuration.Instance)/api/v2/device-custom-fields?scopes=node" -Method GET -Headers @{Authorization = "Bearer $($token.access_token)" } -ContentType 'application/json').content | ConvertFrom-Json -Depth 20 [System.Collections.Generic.List[object]]$NinjaCustomFieldsNode = $NinjaCustomFieldsNodeRaw | Where-Object { $_.apiPermission -eq 'READ_WRITE' -and $_.type -in $CIPPFields.Type } | Select-Object @{n = 'name'; e = { $_.label } }, @{n = 'value'; e = { $_.name } }, type, @{n = 'FieldType'; e = { 'Device' } } - $NinjaCustomFieldsOrgRaw = (Invoke-WebRequest -Uri "https://$($Configuration.Instance)/api/v2/device-custom-fields?scopes=organization" -Method GET -Headers @{Authorization = "Bearer $($token.access_token)" } -ContentType 'application/json').content | ConvertFrom-Json -Depth 100 + $NinjaCustomFieldsOrgRaw = (Invoke-WebRequest -Uri "https://$($Configuration.Instance)/api/v2/device-custom-fields?scopes=organization" -Method GET -Headers @{Authorization = "Bearer $($token.access_token)" } -ContentType 'application/json').content | ConvertFrom-Json -Depth 20 [System.Collections.Generic.List[object]]$NinjaCustomFieldsOrg = $NinjaCustomFieldsOrgRaw | Where-Object { $_.apiPermission -eq 'READ_WRITE' -and $_.type -in $CIPPFields.Type } | Select-Object @{n = 'name'; e = { $_.label } }, @{n = 'value'; e = { $_.name } }, type, @{n = 'FieldType'; e = { 'Organization' } } diff --git a/backend/Modules/CippExtensions/Public/NinjaOne/Get-NinjaOneOrgMapping.ps1 b/backend/Modules/CippExtensions/Public/NinjaOne/Get-NinjaOneOrgMapping.ps1 index f6e789ee08..5334fb138f 100644 --- a/backend/Modules/CippExtensions/Public/NinjaOne/Get-NinjaOneOrgMapping.ps1 +++ b/backend/Modules/CippExtensions/Public/NinjaOne/Get-NinjaOneOrgMapping.ps1 @@ -34,7 +34,7 @@ function Get-NinjaOneOrgMapping { $After = 0 $PageSize = 1000 $NinjaOrgs = do { - $Result = (Invoke-WebRequest -Uri "https://$($Configuration.Instance)/api/v2/organizations?pageSize=$PageSize&after=$After" -Method GET -Headers @{Authorization = "Bearer $($token.access_token)" } -ContentType 'application/json').content | ConvertFrom-Json -Depth 100 + $Result = (Invoke-WebRequest -Uri "https://$($Configuration.Instance)/api/v2/organizations?pageSize=$PageSize&after=$After" -Method GET -Headers @{Authorization = "Bearer $($token.access_token)" } -ContentType 'application/json').content | ConvertFrom-Json -Depth 20 $Result | Select-Object name, @{n = 'value'; e = { $_.id } } $ResultCount = ($Result.id | Measure-Object -Maximum) $After = $ResultCount.maximum diff --git a/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneDeviceWebhook.ps1 b/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneDeviceWebhook.ps1 index a5e8cae010..eb17be9418 100644 --- a/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneDeviceWebhook.ps1 +++ b/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneDeviceWebhook.ps1 @@ -70,7 +70,7 @@ function Invoke-NinjaOneDeviceWebhook { } else { $_.Exception.message } - Write-Error "Failed NinjaOne Device Webhook for: $($Data | ConvertTo-Json -Depth 100) Linenumber: $($_.InvocationInfo.ScriptLineNumber) Error: $Message" + Write-Error "Failed NinjaOne Device Webhook for: $($Data | ConvertTo-Json -Depth 20) Linenumber: $($_.InvocationInfo.ScriptLineNumber) Error: $Message" Write-LogMessage -API 'NinjaOneSync' -message "Failed NinjaOne Device Webhook Linenumber: $($_.InvocationInfo.ScriptLineNumber) Error: $Message" -Sev 'Error' } } else { @@ -85,7 +85,7 @@ function Invoke-NinjaOneDeviceWebhook { } else { $_.Exception.message } - Write-Error "Failed NinjaOne Device Webhook for: $($Data | ConvertTo-Json -Depth 100) Linenumber: $($_.InvocationInfo.ScriptLineNumber) Error: $Message" + Write-Error "Failed NinjaOne Device Webhook for: $($Data | ConvertTo-Json -Depth 20) Linenumber: $($_.InvocationInfo.ScriptLineNumber) Error: $Message" Write-LogMessage -API 'NinjaOneSync' -message "Failed NinjaOne Device Webhook Linenumber: $($_.InvocationInfo.ScriptLineNumber) Error: $Message" -Sev 'Error' } diff --git a/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneDocumentTemplate.ps1 b/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneDocumentTemplate.ps1 index edfff14bd7..4b58f64162 100644 --- a/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneDocumentTemplate.ps1 +++ b/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneDocumentTemplate.ps1 @@ -31,8 +31,8 @@ function Invoke-NinjaOneDocumentTemplate { $Body = $Template | ConvertTo-Json -Depth 100 $NinjaDocumentTemplate = (Invoke-WebRequest @SessionParams -Uri "https://$($Configuration.Instance)/api/v2/document-templates/" -Method POST -Headers @{Authorization = "Bearer $($token.access_token)" } -ContentType 'application/json' -Body $Body).content | ConvertFrom-Json -Depth 100 } else { - $NinjaDocumentTemplate = $DocumentTemplate | Sort-Object { [int64]$_.id } | Select-Object -First 1 - Write-Warning "Multiple NinjaOne document templates named '$($Template.name)' found ($MatchedCount). Using the oldest (id $($NinjaDocumentTemplate.id)). Remove the duplicate template(s) in NinjaOne." + # Matched multiple templates. Should be impossible but lets check anyway :D + Throw 'Multiple Documents Matched the Provided Criteria' } return $NinjaDocumentTemplate diff --git a/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneExtensionScheduler.ps1 b/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneExtensionScheduler.ps1 index 4782747258..d78e49c085 100644 --- a/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneExtensionScheduler.ps1 +++ b/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneExtensionScheduler.ps1 @@ -32,6 +32,8 @@ function Invoke-NinjaOneExtensionScheduler { $CIPPMapping = Get-CIPPTable -TableName CippMapping $Filter = "PartitionKey eq 'NinjaOneMapping'" $TenantsToProcess = Get-AzDataTableEntity @CIPPMapping -Filter $Filter | Where-Object { $Null -ne $_.IntegrationId -and $_.IntegrationId -ne '' } + # Names each queued sync after its tenant (mapping rows only carry the tenant id). + $TenantDomains = @{} # Same check as the integration test button, once, before queuing a task per mapped tenant. $ApiCheck = { @@ -46,8 +48,10 @@ function Invoke-NinjaOneExtensionScheduler { Write-LogMessage -API 'NinjaOneSync' -message "NinjaOne API check failed, daily synchronization not queued for $(($TenantsToProcess | Measure-Object).count) tenants. Test the NinjaOne integration in Extensions." -Sev 'Error' $TenantsToProcess = @() } + if ($TenantsToProcess) { foreach ($T in Get-Tenants -IncludeErrors) { $TenantDomains[$T.customerId] = $T.defaultDomainName } } $Batch = foreach ($Tenant in $TenantsToProcess | Sort-Object lastEndTime) { [PSCustomObject]@{ + 'TenantFilter' = $TenantDomains[$Tenant.RowKey] ?? $Tenant.RowKey 'NinjaAction' = 'SyncTenant' 'MappedTenant' = $Tenant 'FunctionName' = 'NinjaOneQueue' @@ -94,8 +98,10 @@ function Invoke-NinjaOneExtensionScheduler { Write-LogMessage -API 'NinjaOneSync' -message "NinjaOne API check failed, catchup synchronization not queued for $(($CatchupTenants | Measure-Object).count) tenants. Test the NinjaOne integration in Extensions." -Sev 'Warning' $CatchupTenants = @() } + if ($CatchupTenants) { foreach ($T in Get-Tenants -IncludeErrors) { $TenantDomains[$T.customerId] = $T.defaultDomainName } } $Batch = foreach ($Tenant in $CatchupTenants) { [PSCustomObject]@{ + TenantFilter = $TenantDomains[$Tenant.RowKey] ?? $Tenant.RowKey NinjaAction = 'SyncTenant' MappedTenant = $Tenant FunctionName = 'NinjaOneQueue' diff --git a/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneOrgMapping.ps1 b/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneOrgMapping.ps1 index 8acf6cc7e1..d458e9fbaf 100644 --- a/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneOrgMapping.ps1 +++ b/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneOrgMapping.ps1 @@ -26,7 +26,7 @@ function Invoke-NinjaOneOrgMapping { $After = 0 $PageSize = 1000 $NinjaOrgs = do { - $Result = (Invoke-WebRequest -Uri "https://$($Configuration.Instance)/api/v2/organizations?pageSize=$PageSize&after=$After" -Method GET -Headers @{Authorization = "Bearer $($token.access_token)" } -ContentType 'application/json').content | ConvertFrom-Json -Depth 100 + $Result = (Invoke-WebRequest -Uri "https://$($Configuration.Instance)/api/v2/organizations?pageSize=$PageSize&after=$After" -Method GET -Headers @{Authorization = "Bearer $($token.access_token)" } -ContentType 'application/json').content | ConvertFrom-Json -Depth 20 $Result $ResultCount = ($Result.id | Measure-Object -Maximum) $After = $ResultCount.maximum @@ -51,7 +51,7 @@ function Invoke-NinjaOneOrgMapping { $After = 0 $PageSize = 1000 $NinjaDevicesRaw = do { - $Result = (Invoke-WebRequest -Uri "https://$($Configuration.Instance)/api/v2/devices-detailed?pageSize=$PageSize&after=$After" -Method GET -Headers @{Authorization = "Bearer $($token.access_token)" } -ContentType 'application/json').content | ConvertFrom-Json -Depth 100 + $Result = (Invoke-WebRequest -Uri "https://$($Configuration.Instance)/api/v2/devices-detailed?pageSize=$PageSize&after=$After" -Method GET -Headers @{Authorization = "Bearer $($token.access_token)" } -ContentType 'application/json').content | ConvertFrom-Json -Depth 20 $Result $ResultCount = ($Result.id | Measure-Object -Maximum) $After = $ResultCount.maximum @@ -96,6 +96,7 @@ function Invoke-NinjaOneOrgMapping { $Batch = Foreach ($Tenant in $Tenants | Where-Object { $_.customerId -notin $MatchedM365Tenants.customerId }) { [PSCustomObject]@{ 'NinjaAction' = 'AutoMapTenant' + 'TenantFilter' = $Tenant.defaultDomainName 'M365Tenant' = $Tenant 'NinjaOrgs' = $NinjaOrgs | Where-Object { $_.id -notin $MatchedNinjaOrgs } 'NinjaDevices' = $ParsedNinjaDevices diff --git a/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneSync.ps1 b/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneSync.ps1 index b51284eb76..5269c7d73d 100644 --- a/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneSync.ps1 +++ b/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneSync.ps1 @@ -14,8 +14,11 @@ function Invoke-NinjaOneSync { } + $TenantDomains = @{} + foreach ($T in Get-Tenants -IncludeErrors) { $TenantDomains[$T.customerId] = $T.defaultDomainName } $Batch = foreach ($Tenant in $TenantsToProcess) { [PSCustomObject]@{ + 'TenantFilter' = $TenantDomains[$Tenant.RowKey] ?? $Tenant.RowKey 'NinjaAction' = 'SyncTenant' 'MappedTenant' = $Tenant 'FunctionName' = 'NinjaOneQueue' diff --git a/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneTenantSync.ps1 b/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneTenantSync.ps1 index 8e7b915698..cc68dd77a7 100644 --- a/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneTenantSync.ps1 +++ b/backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneTenantSync.ps1 @@ -32,6 +32,10 @@ function Invoke-NinjaOneTenantSync { # Check for active instances for this tenant $CurrentItem = $CurrentMap | Where-Object { $_.RowKey -eq $MappedTenant.RowKey } + if (-not $CurrentItem) { + throw "No NinjaOne mapping entry found for tenant $($MappedTenant.RowKey). The mapping may have been removed. Re-map this tenant in the NinjaOne extension settings." + } + $StartDate = try { Get-Date($CurrentItem.lastStartTime) } catch { $Null } $EndDate = try { Get-Date($CurrentItem.lastEndTime) } catch { $Null } @@ -46,7 +50,9 @@ function Invoke-NinjaOneTenantSync { if ($Null -ne $CurrentItem.lastEndTime -and $CurrentItem.lastEndTime -ne '' ) { $CurrentItem.lastEndTime = ([string]$(($CurrentItem.lastEndTime).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ'))) } - Add-CIPPAzDataTableEntity @MappingTable -Entity $CurrentItem -Force + # Convert to hashtable to strip PSObject wrappers that AzBobbyTables cannot serialize + $CleanEntity = $CurrentItem | ConvertTo-Json -Depth 5 -Compress | ConvertFrom-Json -AsHashtable + Add-CIPPAzDataTableEntity @MappingTable -Entity $CleanEntity -Force # Fetch Custom NinjaOne Settings @@ -1110,7 +1116,8 @@ function Invoke-NinjaOneTenantSync { $UserLic = $_ try { $SkuPartNumber = $LicenseBySku.Find($UserLic).SkuPartNumber - '
  • ' + "$($SkuPartNumber)
    • " + $FriendlySku = if ($SkuPartNumber) { (Get-Culture).TextInfo.ToTitleCase((convert-skuname -skuname $SkuPartNumber).ToLower()) } else { $SkuPartNumber } + '
  • ' + "$($FriendlySku)
    • " } catch {} }) -join '' @@ -2575,7 +2582,9 @@ function Invoke-NinjaOneTenantSync { # Set Last End Time $CurrentItem | Add-Member -NotePropertyName lastEndTime -NotePropertyValue ([string]$((Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ'))) -Force $CurrentItem | Add-Member -NotePropertyName lastStatus -NotePropertyValue 'Completed' -Force - Add-CIPPAzDataTableEntity @MappingTable -Entity $CurrentItem -Force + # Convert to hashtable to strip PSObject wrappers that AzBobbyTables cannot serialize + $CleanEntity = $CurrentItem | ConvertTo-Json -Depth 5 -Compress | ConvertFrom-Json -AsHashtable + Add-CIPPAzDataTableEntity @MappingTable -Entity $CleanEntity -Force Write-LogMessage -tenant $Customer.defaultDomainName -API 'NinjaOneSync' -message "Completed NinjaOne Sync for $($Customer.displayName). Queued for $((New-TimeSpan -Start $StartQueueTime -End $StartTime).TotalSeconds) seconds. Data fetched in $((New-TimeSpan -Start $StartTime -End $FetchEnd).TotalSeconds) seconds. Total processing time $((New-TimeSpan -Start $StartTime -End (Get-Date)).TotalSeconds) seconds" -Sev 'info' @@ -2586,11 +2595,16 @@ function Invoke-NinjaOneTenantSync { } else { $_.Exception.message } - Write-Error "Failed NinjaOne Processing for $($Customer.displayName) Linenumber: $($_.InvocationInfo.ScriptLineNumber) Error: $Message" - Write-LogMessage -tenant $Customer.defaultDomainName -API 'NinjaOneSync' -message "Failed NinjaOne Processing for $($Customer.displayName) Linenumber: $($_.InvocationInfo.ScriptLineNumber) Error: $Message" -Sev 'Error' - $CurrentItem | Add-Member -NotePropertyName lastEndTime -NotePropertyValue ([string]$((Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ'))) -Force - $CurrentItem | Add-Member -NotePropertyName lastStatus -NotePropertyValue 'Failed' -Force - Add-CIPPAzDataTableEntity @MappingTable -Entity $CurrentItem -Force + $TenantName = if ($Customer.displayName) { $Customer.displayName } else { $MappedTenant.RowKey } + $TenantDomain = if ($Customer.defaultDomainName) { $Customer.defaultDomainName } else { 'None' } + Write-Error "Failed NinjaOne Processing for $TenantName Linenumber: $($_.InvocationInfo.ScriptLineNumber) Error: $Message" + Write-LogMessage -tenant $TenantDomain -API 'NinjaOneSync' -message "Failed NinjaOne Processing for $TenantName Linenumber: $($_.InvocationInfo.ScriptLineNumber) Error: $Message" -Sev 'Error' + if ($CurrentItem) { + $CurrentItem | Add-Member -NotePropertyName lastEndTime -NotePropertyValue ([string]$((Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ'))) -Force + $CurrentItem | Add-Member -NotePropertyName lastStatus -NotePropertyValue 'Failed' -Force + $CleanEntity = $CurrentItem | ConvertTo-Json -Depth 5 -Compress | ConvertFrom-Json -AsHashtable + Add-CIPPAzDataTableEntity @MappingTable -Entity $CleanEntity -Force + } } finally { $NinjaSession.Dispose() } diff --git a/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebAuthentication.ps1 b/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebAuthentication.ps1 deleted file mode 100644 index a137e8bdc7..0000000000 --- a/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebAuthentication.ps1 +++ /dev/null @@ -1,20 +0,0 @@ -function Get-SherwebAuthentication { - $Table = Get-CIPPTable -TableName Extensionsconfig - $Config = ((Get-CIPPAzDataTableEntity @Table).config | ConvertFrom-Json).Sherweb - $APIKey = Get-ExtensionAPIKey -Extension 'Sherweb' - - $AuthBody = @{ - client_id = $Config.clientId - client_secret = $APIKey - scope = 'service-provider' - grant_type = 'client_credentials' - } - - $Token = (Invoke-RestMethod -Uri 'https://api.sherweb.com/auth/oidc/connect/token' -Method POST -Body $AuthBody).access_token - $authHeader = @{ - Authorization = "Bearer $Token" - 'Ocp-Apim-Subscription-Key' = $Config.SubscriptionKey - } - - return $authHeader -} diff --git a/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebCatalog.ps1 b/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebCatalog.ps1 deleted file mode 100644 index e1970e058b..0000000000 --- a/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebCatalog.ps1 +++ /dev/null @@ -1,21 +0,0 @@ -function Get-SherwebCatalog { - param( - [Parameter(Mandatory = $false)] - [string]$CustomerId, - [string]$TenantFilter - ) - - if ($TenantFilter) { - $TenantFilter = (Get-Tenants -TenantFilter $TenantFilter).customerId - $CustomerId = Get-ExtensionMapping -Extension 'Sherweb' | Where-Object { $_.RowKey -eq $TenantFilter } | Select-Object -ExpandProperty IntegrationId - } - - if (![string]::IsNullOrEmpty($CustomerId)) { - Write-Information "Getting catalog for $CustomerId" - $AuthHeader = Get-SherwebAuthentication - $SubscriptionsList = Invoke-RestMethod -Uri "https://api.sherweb.com/service-provider/v1/customer-catalogs/$CustomerId" -Method GET -Headers $AuthHeader - return $SubscriptionsList.catalogItems - } else { - throw 'No Sherweb mapping found' - } -} diff --git a/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebCurrentSubscription.ps1 b/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebCurrentSubscription.ps1 deleted file mode 100644 index bfdbf623ca..0000000000 --- a/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebCurrentSubscription.ps1 +++ /dev/null @@ -1,32 +0,0 @@ -function Get-SherwebCurrentSubscription { - param( - [Parameter(Mandatory = $false)] - [string]$TenantFilter, - [string]$CustomerId, - [string]$SKU, - [string]$ProductName - ) - if ($TenantFilter) { - $TenantFilter = (Get-Tenants -TenantFilter $TenantFilter).customerId - $CustomerId = Get-ExtensionMapping -Extension 'Sherweb' | Where-Object { $_.RowKey -eq $TenantFilter } | Select-Object -ExpandProperty IntegrationId - } - - if ([string]::IsNullOrEmpty($CustomerId)) { - throw 'No Sherweb mapping found' - } - - Write-Information "Getting current subscription for $CustomerId" - $AuthHeader = Get-SherwebAuthentication - $Uri = "https://api.sherweb.com/service-provider/v1/billing/subscriptions/details?customerId=$CustomerId" - $SubscriptionDetails = Invoke-RestMethod -Uri $Uri -Method GET -Headers $AuthHeader - - $AllSubscriptions = $SubscriptionDetails.items - - if ($SKU) { - return $AllSubscriptions | Where-Object { $_.sku -eq $SKU } - } elseif ($ProductName) { - return $AllSubscriptions | Where-Object { $_.productName -eq $ProductName } - } else { - return $AllSubscriptions - } -} diff --git a/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebCustomerConfiguration.ps1 b/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebCustomerConfiguration.ps1 deleted file mode 100644 index d59d5e1683..0000000000 --- a/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebCustomerConfiguration.ps1 +++ /dev/null @@ -1,21 +0,0 @@ -function Get-SherwebCustomerConfiguration { - param( - [Parameter(Mandatory = $true)] - [string]$CustomerId, - [string]$TenantFilter - ) - if ($TenantFilter) { - $TenantFilter = (Get-Tenants -TenantFilter $TenantFilter).customerId - $CustomerId = Get-ExtensionMapping -Extension 'Sherweb' | Where-Object { $_.RowKey -eq $TenantFilter } | Select-Object -ExpandProperty IntegrationId - } - $AuthHeader = Get-SherwebAuthentication - $Uri = "https://api.sherweb.com/service-provider/v1/customers/$($CustomerId)/platforms-configurations/" - $CustomerConfig = Invoke-RestMethod -Uri $Uri -Method GET -Headers $AuthHeader - $customerPlatforms = foreach ($Config in $CustomerConfig.configuredPlatforms) { - #https://api.sherweb.com/service-provider/v1/customers/{customerId}/platforms/{platformId}/details - $Uri = "https://api.sherweb.com/service-provider/v1/customers/$($CustomerId)/platforms/$($Config.id)/details" - Invoke-RestMethod -Uri $Uri -Method GET -Headers $AuthHeader - } - return $customerPlatforms - -} diff --git a/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebCustomers.ps1 b/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebCustomers.ps1 deleted file mode 100644 index 53af35e197..0000000000 --- a/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebCustomers.ps1 +++ /dev/null @@ -1,5 +0,0 @@ -function Get-SherwebCustomers { - $AuthHeader = Get-SherwebAuthentication - $CustomersList = Invoke-RestMethod -Uri 'https://api.sherweb.com/service-provider/v1/customers' -Method GET -Headers $AuthHeader - return $CustomersList.items -} diff --git a/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebMapping.ps1 b/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebMapping.ps1 deleted file mode 100644 index 1fa0f5cbb0..0000000000 --- a/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebMapping.ps1 +++ /dev/null @@ -1,47 +0,0 @@ -function Get-SherwebMapping { - [CmdletBinding()] - param ( - $CIPPMapping - ) - - $ExtensionMappings = Get-ExtensionMapping -Extension 'Sherweb' - - $Tenants = Get-Tenants -IncludeErrors - $Mappings = foreach ($Mapping in $ExtensionMappings) { - $Tenant = $Tenants | Where-Object { $_.customerId -eq $Mapping.RowKey } - if ($Tenant) { - [PSCustomObject]@{ - TenantId = $Tenant.customerId - Tenant = $Tenant.displayName - TenantDomain = $Tenant.defaultDomainName - IntegrationId = $Mapping.IntegrationId - IntegrationName = $Mapping.IntegrationName - } - } - } - try { - $SherwebCustomers = Get-SherwebCustomers | ForEach-Object { - [PSCustomObject]@{ - name = $_.displayName - value = "$($_.id)" - } - } - } catch { - $Message = if ($_.ErrorDetails.Message) { - Get-NormalizedError -Message $_.ErrorDetails.Message - } else { - $_.Exception.message - } - - Write-LogMessage -Message "Could not get Sherweb Companies, error: $Message " -Level Error -tenant 'CIPP' -API 'SherwebMapping' - $SherwebCustomers = @(@{name = "Could not get Sherweb Companies, error: $Message"; value = '-1' }) - } - - $MappingObj = [PSCustomObject]@{ - Companies = @($SherwebCustomers) - Mappings = @($Mappings) - } - - return $MappingObj - -} diff --git a/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebOrderStatus.ps1 b/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebOrderStatus.ps1 deleted file mode 100644 index ca5a91cd71..0000000000 --- a/backend/Modules/CippExtensions/Public/Sherweb/Get-SherwebOrderStatus.ps1 +++ /dev/null @@ -1,10 +0,0 @@ -function Get-SherwebOrderStatus { - param( - [Parameter(Mandatory = $true)] - [string]$RequestTrackingId - ) - $AuthHeader = Get-SherwebAuthentication - $Uri = "https://api.sherweb.com/service-provider/v1/tracking/$RequestTrackingId" - $Tracking = Invoke-RestMethod -Uri $Uri -Method GET -Headers $AuthHeader - return $Tracking -} diff --git a/backend/Modules/CippExtensions/Public/Sherweb/Invoke-SherwebMigration.ps1 b/backend/Modules/CippExtensions/Public/Sherweb/Invoke-SherwebMigration.ps1 deleted file mode 100644 index 3d5dd1cd2a..0000000000 --- a/backend/Modules/CippExtensions/Public/Sherweb/Invoke-SherwebMigration.ps1 +++ /dev/null @@ -1,115 +0,0 @@ -function Invoke-SherwebMigration { - [CmdletBinding()] - param ( - $TenantFilter - ) - - $Table = Get-CIPPTable -TableName Extensionsconfig - $ExtensionConfig = (Get-CIPPAzDataTableEntity @Table).config | ConvertFrom-Json - $Config = $ExtensionConfig.Sherweb - - if ($Config.Enabled -ne $true) { - Write-Information "Sherweb extension is disabled, skipping migration check for $TenantFilter" - return - } - - if ($Config.AutoMigrations -ne $true) { - Write-Information "Sherweb automated migration is disabled, skipping migration check for $TenantFilter" - return - } - - # Get licenses within the transfer window (renewing within 7 days) - $Licenses = Get-CIPPLicenseOverview -TenantFilter $TenantFilter | Where-Object { - $null -ne $_.TermInfo -and ($_.TermInfo | Where-Object { $_.DaysUntilRenew -le 7 -and $_.DaysUntilRenew -ge 0 }) - } - - if (-not $Licenses) { return } - - # Check if the exact count of licenses is available at Sherweb, if not, we need to migrate them. - $SherwebLicenses = Get-SherwebCurrentSubscription -TenantFilter $TenantFilter - $LicencesToMigrate = foreach ($License in $Licenses) { - foreach ($Term in $License.TermInfo) { - if ($Term.DaysUntilRenew -gt 7 -or $Term.DaysUntilRenew -lt 0) { continue } - $matchedSherweb = $SherwebLicenses | Where-Object { $_.quantity -eq $Term.TotalLicenses -and $_.commitmentTerm.termEndDate -eq $Term.NextLifecycle } - if (-not $matchedSherweb) { - [PSCustomObject]@{ - LicenseName = $License.License - SkuId = $License.skuId - SubscriptionId = $Term.SubscriptionId - Term = $Term.Term - NextLifecycle = $Term.NextLifecycle - DaysUntilRenew = $Term.DaysUntilRenew - TotalLicensesAtUnknownCSP = $Term.TotalLicenses - TotalLicensesAvailableInM365 = $License.TotalLicenses - } - } - } - } - - if (-not $LicencesToMigrate) { return } - - # migrationMethods and migrateToLicense are autoComplete fields, stored as { label, value } - # objects (older configs may hold a bare string). Match on the value only: wildcard-matching - # the whole object stringifies the label too, and every method label contains 'cancellation - # window', so notify-only and buy-and-notify would both wrongly trigger the cancel branch. - $MigrationMethod = if ($null -ne $Config.migrationMethods.value) { $Config.migrationMethods.value } else { $Config.migrationMethods } - $MigrateToLicense = if ($null -ne $Config.migrateToLicense.value) { $Config.migrateToLicense.value } else { $Config.migrateToLicense } - - switch -wildcard ($MigrationMethod) { - '*notify*' { - $Subject = "Sherweb Migration: $($TenantFilter) - $($LicencesToMigrate.Count) licenses to migrate" - $HTMLContent = New-CIPPAlertTemplate -Data $LicencesToMigrate -Format 'html' -InputObject 'sherwebmig' - $JSONContent = New-CIPPAlertTemplate -Data $LicencesToMigrate -Format 'json' -InputObject 'sherwebmig' - Send-CIPPAlert -Type 'email' -Title $Subject -HTMLContent $HTMLContent.htmlcontent -TenantFilter $TenantFilter -APIName 'Alerts' - Send-CIPPAlert -Type 'psa' -Title $Subject -HTMLContent $HTMLContent.htmlcontent -TenantFilter $TenantFilter -APIName 'Alerts' - Send-CIPPAlert -Type 'webhook' -JSONContent $JSONContent -TenantFilter $TenantFilter -APIName 'Alerts' - } - '*buy*' { - try { - foreach ($MigLicense in $LicencesToMigrate) { - $PotentialLicense = Get-SherwebCatalog -TenantFilter $TenantFilter | Where-Object { $_.microsoftSkuId -eq $MigLicense.SkuId -and $_.sku -like "*$MigrateToLicense" } | Select-Object -First 1 - if (-not $PotentialLicense) { - throw "Cannot buy new license: no matching license found in catalog for SKU $($MigLicense.SkuId)" - } - Set-SherwebSubscription -TenantFilter $TenantFilter -SKU $PotentialLicense.sku -Quantity $MigLicense.TotalLicensesAtUnknownCSP - } - } catch { - $Subject = "Sherweb Migration: $($TenantFilter) - Failed to buy licenses." - $HTMLContent = New-CIPPAlertTemplate -Data $LicencesToMigrate -Format 'html' -InputObject 'sherwebmigBuyFail' - $JSONContent = New-CIPPAlertTemplate -Data $LicencesToMigrate -Format 'json' -InputObject 'sherwebmigBuyFail' - Send-CIPPAlert -Type 'email' -Title $Subject -HTMLContent $HTMLContent.htmlcontent -TenantFilter $TenantFilter -APIName 'Alerts' - Send-CIPPAlert -Type 'psa' -Title $Subject -HTMLContent $HTMLContent.htmlcontent -TenantFilter $TenantFilter -APIName 'Alerts' - Send-CIPPAlert -Type 'webhook' -JSONContent $JSONContent -TenantFilter $TenantFilter -APIName 'Alerts' - } - } - '*cancel*' { - try { - $TenantId = (Get-Tenants -TenantFilter $TenantFilter).customerId - $Pax8Config = $ExtensionConfig.Pax8 - $Pax8ClientId = $Pax8Config.clientId - $Pax8ClientSecret = Get-ExtensionAPIKey -Extension 'Pax8' - $paxBody = @{ - client_id = $Pax8ClientId - client_secret = $Pax8ClientSecret - audience = 'https://api.pax8.com' - grant_type = 'client_credentials' - } - $Token = Invoke-RestMethod -Uri 'https://api.pax8.com/v1/token' -Method POST -Body $paxBody -ContentType 'application/x-www-form-urlencoded' - $Pax8Headers = @{ Authorization = "Bearer $($Token.access_token)" } - $cancelSubList = (Invoke-RestMethod -Uri "https://api.pax8.com/v1/subscriptions?page=0&size=100&status=Active&companyId=$($TenantId)" -Method GET -Headers $Pax8Headers).content | Where-Object { $_.productId -in $LicencesToMigrate.SkuId } - foreach ($Sub in $cancelSubList) { - #Cancelbody can be NULL, or a date in the format of 2000-10-31T01:30:00.000-05:00. This used to just be $null - $cancelBody = @{ cancellationDate = (Get-Date).ToString('yyyy-MM-ddTHH:mm:ss.fffzzz') } - $null = Invoke-RestMethod -Uri "https://api.pax8.com/v1/subscriptions/$($Sub.id)" -Method DELETE -Headers $Pax8Headers -ContentType 'application/json' -Body ($cancelBody | ConvertTo-Json) - } - } catch { - $Subject = "Sherweb Migration: $($TenantFilter) - Pax8 cancellation failed." - $HTMLContent = New-CIPPAlertTemplate -Data $LicencesToMigrate -Format 'html' -InputObject 'sherwebmigfailcancel' - $JSONContent = New-CIPPAlertTemplate -Data $LicencesToMigrate -Format 'json' -InputObject 'sherwebmigfailcancel' - Send-CIPPAlert -Type 'email' -Title $Subject -HTMLContent $HTMLContent.htmlcontent -TenantFilter $TenantFilter -APIName 'Alerts' - Send-CIPPAlert -Type 'psa' -Title $Subject -HTMLContent $HTMLContent.htmlcontent -TenantFilter $TenantFilter -APIName 'Alerts' - Send-CIPPAlert -Type 'webhook' -JSONContent $JSONContent -TenantFilter $TenantFilter -APIName 'Alerts' - } - } - } -} diff --git a/backend/Modules/CippExtensions/Public/Sherweb/Remove-SherwebSubscription.ps1 b/backend/Modules/CippExtensions/Public/Sherweb/Remove-SherwebSubscription.ps1 deleted file mode 100644 index 83bcd58aec..0000000000 --- a/backend/Modules/CippExtensions/Public/Sherweb/Remove-SherwebSubscription.ps1 +++ /dev/null @@ -1,57 +0,0 @@ -function Remove-SherwebSubscription { - param( - [Parameter(Mandatory = $false)] - [string]$CustomerId, - [Parameter(Mandatory = $true)] - [string[]]$SubscriptionIds, - [string]$TenantFilter, - $Headers - ) - - if ($Headers) { - # Get extension config and check for AllowedCustomRoles - $Table = Get-CIPPTable -TableName Extensionsconfig - $ExtensionConfig = (Get-CIPPAzDataTableEntity @Table).config | ConvertFrom-Json - $Config = $ExtensionConfig.Sherweb - - $AllowedRoles = $Config.AllowedCustomRoles.value - if ($AllowedRoles) { - # Resolve caller roles for both interactive users and direct API clients, - # mirroring the principal detection Test-CIPPAccess/Test-CippApiClientRoleGrant use. - if ($Headers.'x-ms-client-principal-idp' -eq 'aad' -and $Headers.'x-ms-client-principal-name' -match '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$') { - $Client = Get-CippApiClient -AppId $Headers.'x-ms-client-principal-name' - $CallerRoles = if ($Client.Role) { @($Client.Role) } else { @('cipp-api') } - } elseif ($Headers.'x-ms-client-principal') { - $CallerRoles = @(Get-CIPPAccessRole -Headers $Headers) - } else { - $CallerRoles = @() - } - - $Allowed = $false - foreach ($Role in $CallerRoles) { - if ($AllowedRoles -contains $Role) { - Write-Information "Caller has allowed CIPP role: $Role" - $Allowed = $true - break - } - } - if (-not $Allowed) { - throw 'This caller is not allowed to modify Sherweb Licenses.' - } - } - } - - - if ($TenantFilter) { - $TenantFilter = (Get-Tenants -TenantFilter $TenantFilter).customerId - $CustomerId = Get-ExtensionMapping -Extension 'Sherweb' | Where-Object { $_.RowKey -eq $TenantFilter } | Select-Object -ExpandProperty IntegrationId - } - $AuthHeader = Get-SherwebAuthentication - $Body = ConvertTo-Json -Depth 10 -InputObject @{ - subscriptionIds = @($SubscriptionIds) - } - - $Uri = "https://api.sherweb.com/service-provider/v1/billing/subscriptions/cancellations?customerId=$CustomerId" - $Cancel = Invoke-RestMethod -Uri $Uri -Method POST -Headers $AuthHeader -Body $Body -ContentType 'application/json' - return $Cancel -} diff --git a/backend/Modules/CippExtensions/Public/Sherweb/Set-SherwebMapping.ps1 b/backend/Modules/CippExtensions/Public/Sherweb/Set-SherwebMapping.ps1 deleted file mode 100644 index 98397cefa5..0000000000 --- a/backend/Modules/CippExtensions/Public/Sherweb/Set-SherwebMapping.ps1 +++ /dev/null @@ -1,26 +0,0 @@ -function Set-SherwebMapping { - [CmdletBinding()] - param ( - $CIPPMapping, - $APIName, - $Request - ) - Get-CIPPAzDataTableEntity @CIPPMapping -Filter "PartitionKey eq 'SherwebMapping'" | ForEach-Object { - Remove-CIPPAzDataTableEntity -Force @CIPPMapping -Entity $_ - } - foreach ($Mapping in $Request.Body) { - Write-Host "Adding mapping for $($mapping.IntegrationId)" - $AddObject = @{ - PartitionKey = 'SherwebMapping' - RowKey = "$($mapping.TenantId)" - IntegrationId = "$($mapping.IntegrationId)" - IntegrationName = "$($mapping.IntegrationName)" - } - - Add-CIPPAzDataTableEntity @CIPPMapping -Entity $AddObject -Force - Write-LogMessage -API $APINAME -headers $Request.Headers -message "Added mapping for $($mapping.name)." -Sev 'Info' - } - $Result = [pscustomobject]@{'Results' = 'Successfully edited mapping table.' } - - Return $Result -} diff --git a/backend/Modules/CippExtensions/Public/Sherweb/Set-SherwebSubscription.ps1 b/backend/Modules/CippExtensions/Public/Sherweb/Set-SherwebSubscription.ps1 deleted file mode 100644 index b2a6766bd8..0000000000 --- a/backend/Modules/CippExtensions/Public/Sherweb/Set-SherwebSubscription.ps1 +++ /dev/null @@ -1,107 +0,0 @@ -function Set-SherwebSubscription { - param( - [Parameter(Mandatory = $false)] - [string]$CustomerId, - [Parameter(Mandatory = $true)] - [string]$SKU, - [int]$Quantity, - [int]$Add, - [int]$Remove, - [string]$TenantFilter, - $Headers - ) - - if ($Headers) { - # Get extension config and check for AllowedCustomRoles - $Table = Get-CIPPTable -TableName Extensionsconfig - $ExtensionConfig = (Get-CIPPAzDataTableEntity @Table).config | ConvertFrom-Json - $Config = $ExtensionConfig.Sherweb - - $AllowedRoles = $Config.AllowedCustomRoles.value - if ($AllowedRoles) { - # Resolve caller roles for both interactive users and direct API clients, - # mirroring the principal detection Test-CIPPAccess/Test-CippApiClientRoleGrant use. - if ($Headers.'x-ms-client-principal-idp' -eq 'aad' -and $Headers.'x-ms-client-principal-name' -match '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$') { - $Client = Get-CippApiClient -AppId $Headers.'x-ms-client-principal-name' - $CallerRoles = if ($Client.Role) { @($Client.Role) } else { @('cipp-api') } - } elseif ($Headers.'x-ms-client-principal') { - $CallerRoles = @(Get-CIPPAccessRole -Headers $Headers) - } else { - $CallerRoles = @() - } - - $Allowed = $false - foreach ($Role in $CallerRoles) { - if ($AllowedRoles -contains $Role) { - Write-Information "Caller has allowed CIPP role: $Role" - $Allowed = $true - break - } - } - if (-not $Allowed) { - throw 'This caller is not allowed to modify Sherweb subscriptions.' - } - } - } - - if ($TenantFilter) { - $TenantFilter = (Get-Tenants -TenantFilter $TenantFilter).customerId - $CustomerId = Get-ExtensionMapping -Extension 'Sherweb' | Where-Object { $_.RowKey -eq $TenantFilter } | Select-Object -ExpandProperty IntegrationId - } - $AuthHeader = Get-SherwebAuthentication - $ExistingSubscription = Get-SherwebCurrentSubscription -CustomerId $CustomerId -SKU $SKU - - if (-not $ExistingSubscription) { - if ($Add -or $Remove) { - throw "Unable to Add or Remove. No existing subscription with SKU '$SKU' found." - } - - if (-not $Quantity -or $Quantity -le 0) { - throw 'A valid Quantity must be specified to create a new subscription when none currently exists.' - } - $OrderBody = ConvertTo-Json -Depth 10 -InputObject @{ - cartItems = @( - @{ - sku = $SKU - quantity = $Quantity - } - ) - orderedBy = 'CIPP-API' - } - $OrderUri = "https://api.sherweb.com/service-provider/v1/orders?customerId=$CustomerId" - $Order = Invoke-RestMethod -Uri $OrderUri -Method POST -Headers $AuthHeader -Body $OrderBody -ContentType 'application/json' - if ($Order -match 'Internal Server Error' -and $Add -gt 0) { - throw 'An error occurred while attempting to create a new subscription. Please check the Cumulus portal to ensure this customer has been provisioned for Microsoft 365.' - } - return $Order - - } else { - $SubscriptionId = $ExistingSubscription[0].id - $CurrentQuantity = $ExistingSubscription[0].quantity - - if ($Add) { - $FinalQuantity = $CurrentQuantity + $Add - } elseif ($Remove) { - $FinalQuantity = $CurrentQuantity - $Remove - if ($FinalQuantity -lt 0) { - throw "Cannot remove more licenses than currently allocated. Current: $CurrentQuantity, Attempting to remove: $Remove." - } - } else { - if (-not $Quantity -or $Quantity -le 0) { - throw 'A valid Quantity must be specified if Add/Remove are not used.' - } - $FinalQuantity = $Quantity - } - $Body = ConvertTo-Json -Depth 10 -InputObject @{ - subscriptionAmendmentParameters = @( - @{ - subscriptionId = $SubscriptionId - newQuantity = $FinalQuantity - } - ) - } - $Uri = "https://api.sherweb.com/service-provider/v1/billing/subscriptions/amendments?customerId=$CustomerId" - $Update = Invoke-RestMethod -Uri $Uri -Method POST -Headers $AuthHeader -Body $Body -ContentType 'application/json' - return $Update - } -} diff --git a/backend/Modules/HuduAPI/2.4.9/HuduAPI.psm1 b/backend/Modules/HuduAPI/2.4.9/HuduAPI.psm1 index c348bb06a1..0d73c70971 100644 --- a/backend/Modules/HuduAPI/2.4.9/HuduAPI.psm1 +++ b/backend/Modules/HuduAPI/2.4.9/HuduAPI.psm1 @@ -1,4 +1,4 @@ -#Region './Private/ArgumentCompleters/AssetLayoutCompleter.ps1' -1 +#Region './Private/ArgumentCompleters/AssetLayoutCompleter.ps1' -1 $AssetLayoutCompleter = { param ( @@ -2423,7 +2423,7 @@ function New-HuduRelation { $Relation.relation.add('is_inverse', $ISInverse) } - $JSON = $Relation | ConvertTo-Json -Depth 100 + $JSON = $Relation | ConvertTo-Json -Depth 20 if ($PSCmdlet.ShouldProcess($FromableType)) { Invoke-HuduRequest -Method post -Resource '/api/v1/relations' -Body $JSON diff --git a/backend/Tests/ActivityTriggers/Push-BECRun.Tests.ps1 b/backend/Tests/ActivityTriggers/Push-BECRun.Tests.ps1 index ab0399cae1..d9304a67d0 100644 --- a/backend/Tests/ActivityTriggers/Push-BECRun.Tests.ps1 +++ b/backend/Tests/ActivityTriggers/Push-BECRun.Tests.ps1 @@ -413,6 +413,23 @@ Describe 'Push-BECRun' { $script:Saved.Properties.Status | Should -Be 'Completed' } + It 'uses the 30-day window for a tenant with Entra ID P1 or P2' { + Mock Get-CIPPTenantCapabilities { [pscustomobject]@{ AAD_PREMIUM = $true } } + Invoke-BecRun -Item $script:Item + $script:Saved.Results.AnalysisWindowDays | Should -Be 30 + Should -Invoke Get-CIPPBecMessageTrace -ParameterFilter { ($EndDate - $StartDate).TotalDays -eq 30 } + } + + It 'keeps the 7-day window without Entra ID P1 or P2, or when the plan read fails' { + Mock Get-CIPPTenantCapabilities { [pscustomobject]@{ INTUNE_A = $true } } + Invoke-BecRun -Item $script:Item + $script:Saved.Results.AnalysisWindowDays | Should -Be 7 + + Mock Get-CIPPTenantCapabilities { throw 'CacheCapabilities unavailable' } + Invoke-BecRun -Item $script:Item + $script:Saved.Results.AnalysisWindowDays | Should -Be 7 + } + It 'classifies a user without a mailbox as skipped mailbox checks, not failed ones' { Mock Get-CIPPBecMailboxInventory { $E = New-CIPPBecCollectorResult -Data @() -Error 'Get-Mailbox: Ex41BAF5|Microsoft.Exchange.Configuration.Tasks.ManagementObjectNotFoundException|The specified mailbox doesn''t exist.'; [pscustomobject]@{ MailboxState = $E; Delegations = $E; AddIns = $E } } Invoke-BecRun -Item $script:Item diff --git a/backend/Tests/Api/GetCippAlertsUpdateNotice.Tests.ps1 b/backend/Tests/Api/GetCippAlertsUpdateNotice.Tests.ps1 index 0c7d85c52f..c1cdffc0df 100644 --- a/backend/Tests/Api/GetCippAlertsUpdateNotice.Tests.ps1 +++ b/backend/Tests/Api/GetCippAlertsUpdateNotice.Tests.ps1 @@ -30,7 +30,7 @@ Describe 'Invoke-GetCippAlerts update notice' { It 'names the scheduled restart time in the banner and the logbook when the container updates itself' { Mock Sync-CippContainerUpdateState { [pscustomobject]@{ AutoUpdate = 'true'; CheckInterval = '1h'; CheckTime = '23' } } - $Alert = (Invoke-GetCippAlerts -Request $script:Request).Body | Where-Object { $_.title -eq 'CIPP API Out of Date' } + $Alert = (Invoke-GetCippAlerts -Request $script:Request).Body | Where-Object { $_.title -eq 'Manage365 API Behind Upstream' } $Alert.Alert | Should -Match "scheduled restart time, 23:00 \(Europe/Amsterdam\)" Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $sev -eq 'Alert' -and $message -like "*scheduled restart time, 23:00 (Europe/Amsterdam)*" } } @@ -43,7 +43,7 @@ Describe 'Invoke-GetCippAlerts update notice' { )) { $script:Settings = $Settings Mock Sync-CippContainerUpdateState { $script:Settings } - $Alert = (Invoke-GetCippAlerts -Request $script:Request).Body | Where-Object { $_.title -eq 'CIPP API Out of Date' } + $Alert = (Invoke-GetCippAlerts -Request $script:Request).Body | Where-Object { $_.title -eq 'Manage365 API Behind Upstream' } $Alert.Alert | Should -Match 'Please update to the latest version\.' } } @@ -51,7 +51,7 @@ Describe 'Invoke-GetCippAlerts update notice' { It 'does not read the container schedule outside a container instance' { $env:CIPPNG = $null Mock Sync-CippContainerUpdateState { throw 'should not be called' } - $Alert = (Invoke-GetCippAlerts -Request $script:Request).Body | Where-Object { $_.title -eq 'CIPP API Out of Date' } + $Alert = (Invoke-GetCippAlerts -Request $script:Request).Body | Where-Object { $_.title -eq 'Manage365 API Behind Upstream' } $Alert.Alert | Should -Match 'Please update to the latest version\.' Should -Invoke Sync-CippContainerUpdateState -Times 0 } diff --git a/backend/Tests/Api/OpenApiSpec.Tests.ps1 b/backend/Tests/Api/OpenApiSpec.Tests.ps1 index 2d6410357c..d179825ac5 100644 --- a/backend/Tests/Api/OpenApiSpec.Tests.ps1 +++ b/backend/Tests/Api/OpenApiSpec.Tests.ps1 @@ -265,6 +265,7 @@ Describe 'the real spec through the real projection' { . (Join-Path $McpRoot $Leaf) } function Get-CippMcpSpec { return $script:Spec } + function Get-CippRequestAllowedPermissions { $null } # The catalog is the whole projected surface. tools/list advertises only the # five-tool gateway in front of it, which is asserted separately below. $script:Tools = @(Get-CippMcpToolCatalog -Force -InformationAction SilentlyContinue) diff --git a/backend/Tests/Baselines/BaselineCreateSharedMailbox.Tests.ps1 b/backend/Tests/Baselines/BaselineCreateSharedMailbox.Tests.ps1 new file mode 100644 index 0000000000..1a1d84ef8f --- /dev/null +++ b/backend/Tests/Baselines/BaselineCreateSharedMailbox.Tests.ps1 @@ -0,0 +1,156 @@ +# CreateSharedMailbox is an instance standard: one configured address, graded on existence +# only. These tests pin the two decisions that fail silently - the case-insensitive match +# against the cached primary address OR UPN (a case mismatch would be permanent drift that +# New-Mailbox can never clear), and the executor's live guard that stops a stale Mailboxes +# cache from re-creating a mailbox that already exists - plus the create -> wait 3s -> +# Graph disable sequence itself. + +BeforeAll { + $script:RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $Baselines = Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Baselines' + + function New-CIPPDbRequest { param($TenantFilter, $Type) } + function Write-LogMessage { param($API, $tenant, $message, $Sev, $LogData) } + function New-ExoRequest { param($tenantid, $cmdlet, $cmdParams, $UseSystemMailbox) } + function New-GraphPostRequest { param($uri, $tenantid, $type, $body) } + function Get-CippException { param($Exception) [PSCustomObject]@{ NormalizedError = "$($Exception.Exception.Message)" } } + + . (Join-Path $Baselines 'Get-CIPPBaselineCreateSharedMailboxState.ps1') + . (Join-Path $Baselines 'Invoke-CIPPBaselineCreateSharedMailbox.ps1') + + $script:Tenant = 'contoso.onmicrosoft.com' + function ConvertTo-Cached { param([Parameter(ValueFromPipeline = $true)]$InputObject) process { $InputObject | ConvertTo-Json -Depth 10 | ConvertFrom-Json } } + $script:Mailboxes = @( + [PSCustomObject]@{ primarySmtpAddress = 'Info@contoso.com'; UPN = 'info@contoso.com'; displayName = 'Info'; recipientTypeDetails = 'SharedMailbox'; AccountDisabled = $true; ExternalDirectoryObjectId = 'obj-info' } + [PSCustomObject]@{ primarySmtpAddress = 'alice@contoso.com'; UPN = 'alice@contoso.com'; displayName = 'Alice'; recipientTypeDetails = 'UserMailbox'; AccountDisabled = $false; ExternalDirectoryObjectId = 'obj-alice' } + [PSCustomObject]@{ primarySmtpAddress = 'sales@contoso.com'; UPN = 'sales@contoso.onmicrosoft.com'; displayName = 'Sales'; recipientTypeDetails = 'SharedMailbox'; AccountDisabled = $false; ExternalDirectoryObjectId = 'obj-sales' } + ) | ConvertTo-Cached + function Invoke-Hook { + param($Variables) + Get-CIPPBaselineCreateSharedMailboxState -Item ([PSCustomObject]@{ Variables = $Variables }) -TenantFilter $script:Tenant + } +} + +Describe 'Get-CIPPBaselineCreateSharedMailboxState' { + BeforeEach { Mock New-CIPPDbRequest { $script:Mailboxes } } + + It 'drifts when no mailbox carries the configured address' { + $Prepared = Invoke-Hook ([PSCustomObject]@{ primarySmtpAddress = 'support@contoso.com'; displayName = 'Support' }) + $Prepared.Expected.exists | Should -BeTrue + $Prepared.Current.exists | Should -BeFalse + $Prepared.Current.primarySmtpAddress | Should -Be 'support@contoso.com' + } + + It 'matches the primary address case-insensitively and carries the mailbox facts ungraded' { + $Prepared = Invoke-Hook ([PSCustomObject]@{ primarySmtpAddress = 'INFO@contoso.com'; displayName = 'Info' }) + $Prepared.Current.exists | Should -BeTrue + $Prepared.Current.displayName | Should -Be 'Info' + $Prepared.Current.recipientTypeDetails | Should -Be 'SharedMailbox' + $Prepared.Current.accountDisabled | Should -BeTrue + $Prepared.Current.externalDirectoryObjectId | Should -Be 'obj-info' + @($Prepared.Expected.PSObject.Properties.Name) | Should -Be @('exists') + } + + It 'also matches on the UPN so a mailbox addressed under the onmicrosoft domain is found' { + $Prepared = Invoke-Hook ([PSCustomObject]@{ primarySmtpAddress = 'sales@contoso.onmicrosoft.com'; displayName = 'Sales' }) + $Prepared.Current.exists | Should -BeTrue + } + + It 'grades existence only - a user mailbox occupying the address is compliant, not drift' { + $Prepared = Invoke-Hook ([PSCustomObject]@{ primarySmtpAddress = 'alice@contoso.com'; displayName = 'Alice' }) + $Prepared.Current.exists | Should -BeTrue + $Prepared.Current.recipientTypeDetails | Should -Be 'UserMailbox' + } + + It 'accepts the {label, value} wrapper and surrounding whitespace on the address' { + $Prepared = Invoke-Hook ([PSCustomObject]@{ primarySmtpAddress = [PSCustomObject]@{ label = ' info@contoso.com '; value = ' info@contoso.com ' }; displayName = 'Info' }) + $Prepared.Current.exists | Should -BeTrue + } + + It 'returns a null Current on an empty mailbox cache so the engine collects instead of grading' { + Mock New-CIPPDbRequest { @() } + $Prepared = Invoke-Hook ([PSCustomObject]@{ primarySmtpAddress = 'info@contoso.com'; displayName = 'Info' }) + $Prepared.Current | Should -BeNullOrEmpty + } + + It 'returns No Data with a reason for an address that is not an email address' { + $Prepared = Invoke-Hook ([PSCustomObject]@{ primarySmtpAddress = 'not an address'; displayName = 'Info' }) + $Prepared.Current | Should -BeNullOrEmpty + $Prepared.NoDataReason | Should -Match 'not a valid email address' + } + + It 'returns a null Current when the address is blank' { + $Prepared = Invoke-Hook ([PSCustomObject]@{ primarySmtpAddress = ''; displayName = 'Info' }) + $Prepared.Current | Should -BeNullOrEmpty + } +} + +Describe 'Invoke-CIPPBaselineCreateSharedMailbox' { + BeforeEach { + Mock Start-Sleep {} + Mock New-GraphPostRequest { $null } + Mock New-ExoRequest { + if ($cmdlet -eq 'Get-Mailbox') { throw "The operation couldn't be performed because object '$($cmdParams.Identity)' couldn't be found." } + if ($cmdlet -eq 'New-Mailbox') { [PSCustomObject]@{ ExternalDirectoryObjectId = 'new-obj-id'; Guid = 'mbx-guid' } } + } + $script:Remediate = [PSCustomObject]@{ primarySmtpAddress = 'support@contoso.com'; displayName = 'Support Desk' } + $script:Missing = [PSCustomObject]@{ exists = $false; primarySmtpAddress = 'support@contoso.com' } + } + + It 'creates the shared mailbox, waits three seconds, then disables the account through Graph' { + $Output = Invoke-CIPPBaselineCreateSharedMailbox -Remediate $script:Remediate -TenantFilter $script:Tenant -Current $script:Missing + $Output | Should -BeNullOrEmpty + Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter { + $cmdlet -eq 'New-Mailbox' -and $cmdParams.Shared -eq $true -and $cmdParams.displayName -eq 'Support Desk' -and + $cmdParams.primarySMTPAddress -eq 'support@contoso.com' -and $cmdParams.name -eq 'support' -and $tenantid -eq $script:Tenant + } + Should -Invoke Start-Sleep -Times 1 -Exactly -ParameterFilter { $Seconds -eq 3 } + Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter { + $type -eq 'PATCH' -and $uri -eq 'https://graph.microsoft.com/v1.0/users/new-obj-id' -and + ($body | ConvertFrom-Json).accountEnabled -eq $false -and $tenantid -eq $script:Tenant + } + } + + It 'skips the create and reports Changed=$false when the mailbox already exists live (stale cache)' { + Mock New-ExoRequest { + if ($cmdlet -eq 'Get-Mailbox') { [PSCustomObject]@{ Identity = 'support'; PrimarySmtpAddress = 'support@contoso.com' } } + if ($cmdlet -eq 'New-Mailbox') { throw 'New-Mailbox must not run for an existing address' } + } + $Output = Invoke-CIPPBaselineCreateSharedMailbox -Remediate $script:Remediate -TenantFilter $script:Tenant -Current $script:Missing + $Output.Changed | Should -BeFalse + Should -Invoke New-ExoRequest -Times 0 -ParameterFilter { $cmdlet -eq 'New-Mailbox' } + Should -Invoke New-GraphPostRequest -Times 0 + Should -Invoke Start-Sleep -Times 0 + } + + It 'falls back to the address as the Graph user key when the create response has no object id' { + Mock New-ExoRequest { + if ($cmdlet -eq 'Get-Mailbox') { throw 'not found' } + if ($cmdlet -eq 'New-Mailbox') { [PSCustomObject]@{ Guid = 'mbx-guid' } } + } + Invoke-CIPPBaselineCreateSharedMailbox -Remediate $script:Remediate -TenantFilter $script:Tenant -Current $script:Missing + Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter { $uri -eq 'https://graph.microsoft.com/v1.0/users/support@contoso.com' } + } + + It 'unwraps {label, value} option objects on both variables' { + $Wrapped = [PSCustomObject]@{ + primarySmtpAddress = [PSCustomObject]@{ label = 'support@contoso.com'; value = 'support@contoso.com' } + displayName = [PSCustomObject]@{ label = 'Support Desk'; value = 'Support Desk' } + } + Invoke-CIPPBaselineCreateSharedMailbox -Remediate $Wrapped -TenantFilter $script:Tenant -Current $script:Missing + Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter { $cmdlet -eq 'New-Mailbox' -and $cmdParams.displayName -eq 'Support Desk' -and $cmdParams.primarySMTPAddress -eq 'support@contoso.com' } + } + + It 'throws when the sign-in block fails after the create, naming the address' { + Mock New-GraphPostRequest { throw 'Request_ResourceNotFound' } + { Invoke-CIPPBaselineCreateSharedMailbox -Remediate $script:Remediate -TenantFilter $script:Tenant -Current $script:Missing } | + Should -Throw -ExpectedMessage "*support@contoso.com*failed to block sign-in*" + Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter { $cmdlet -eq 'New-Mailbox' } + } + + It 'refuses to run without a display name or with an invalid address, before touching Exchange' { + { Invoke-CIPPBaselineCreateSharedMailbox -Remediate ([PSCustomObject]@{ primarySmtpAddress = 'support@contoso.com'; displayName = '' }) -TenantFilter $script:Tenant -Current $script:Missing } | Should -Throw + { Invoke-CIPPBaselineCreateSharedMailbox -Remediate ([PSCustomObject]@{ primarySmtpAddress = 'support'; displayName = 'Support' }) -TenantFilter $script:Tenant -Current $script:Missing } | Should -Throw -ExpectedMessage '*not a valid email address*' + Should -Invoke New-ExoRequest -Times 0 + } +} diff --git a/backend/Tests/Baselines/BaselineExchangeBatch.Tests.ps1 b/backend/Tests/Baselines/BaselineExchangeBatch.Tests.ps1 index 56c544125e..a4cc2842fd 100644 --- a/backend/Tests/Baselines/BaselineExchangeBatch.Tests.ps1 +++ b/backend/Tests/Baselines/BaselineExchangeBatch.Tests.ps1 @@ -11,7 +11,7 @@ BeforeAll { function Write-LogMessage { param($API, $tenant, $message, $Sev, $LogData) } function Get-CIPPDbItem { param($TenantFilter, $Type, [switch]$CountsOnly) } function New-ExoRequest { param($tenantid, $cmdlet, $cmdParams, $useSystemMailbox) } - function New-ExoBulkRequest { param($tenantid, $cmdletArray, $useSystemMailbox, $ReturnWithCommand) } + function New-ExoBulkRequest { param($tenantid, $cmdletArray, $useSystemMailbox, $ReturnWithCommand, $MaxConcurrency, [switch]$AnchorPerMailbox) } function Get-CIPPTextReplacement { param($TenantFilter, $Text) $Text } function Get-NormalizedError { param($Message) "$Message" } @@ -339,3 +339,58 @@ Describe 'Get-CIPPBaselineSpamFilterPolicyState block-list write params' { $Prepared.Current.extraPolicyParams.BulkMovesEnabled | Should -BeExactly 'On' } } + +Describe 'Get-CIPPBaselineMailboxDefaultAuditSetState' { + BeforeAll { + . (Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineMailboxDefaultAuditSetState.ps1') + . (Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineMailboxDefaultAuditSet.ps1') + $script:AuditMailboxes = @( + @{ UPN = 'default@contoso.com'; recipientTypeDetails = 'UserMailbox'; DefaultAuditSet = @('Admin', 'Delegate', 'Owner') } + @{ UPN = 'owner@contoso.com'; recipientTypeDetails = 'UserMailbox'; DefaultAuditSet = @('Admin', 'Delegate') } + @{ UPN = 'shared@contoso.com'; recipientTypeDetails = 'SharedMailbox'; DefaultAuditSet = @() } + @{ UPN = 'room@contoso.com'; recipientTypeDetails = 'RoomMailbox'; DefaultAuditSet = @('Owner') } + @{ UPN = 'discovery@contoso.com'; recipientTypeDetails = 'DiscoveryMailbox'; DefaultAuditSet = @() } + ) | ConvertTo-Cached + } + + It 'offends every mailbox type it can write that is missing any default sign-in type' { + Mock New-CIPPDbRequest { $script:AuditMailboxes } + $Prepared = Get-CIPPBaselineMailboxDefaultAuditSetState -Item ([PSCustomObject]@{}) -TenantFilter $script:Tenant + $Prepared.Current.offenders | Should -Be @('owner@contoso.com', 'room@contoso.com', 'shared@contoso.com') + (Get-Verdict -Expected ([PSCustomObject]@{ offenders = @() }) -Current $Prepared.Current).Count | Should -BeGreaterThan 0 + } + + It 'is compliant when every mailbox still uses the default set' { + Mock New-CIPPDbRequest { @($script:AuditMailboxes[0]) } + $Prepared = Get-CIPPBaselineMailboxDefaultAuditSetState -Item ([PSCustomObject]@{}) -TenantFilter $script:Tenant + (Get-Verdict -Expected ([PSCustomObject]@{ offenders = @() }) -Current $Prepared.Current).Count | Should -Be 0 + } + + It 'reports No Data when the cache is empty' { + Mock New-CIPPDbRequest { @() } + (Get-CIPPBaselineMailboxDefaultAuditSetState -Item ([PSCustomObject]@{}) -TenantFilter $script:Tenant).Current | Should -BeNullOrEmpty + } + + It 'writes Set-Mailbox -DefaultAuditSet Admin,Delegate,Owner anchored to each mailbox, concurrently' { + Mock New-ExoBulkRequest {} + $Current = [PSCustomObject]@{ targets = @([PSCustomObject]@{ id = 'a@contoso.com' }, [PSCustomObject]@{ id = 'b@contoso.com' }) } + Invoke-CIPPBaselineMailboxDefaultAuditSet -Remediate $null -TenantFilter $script:Tenant -Current $Current + Should -Invoke New-ExoBulkRequest -Times 1 -ParameterFilter { + $AnchorPerMailbox -and $MaxConcurrency -eq 10 -and @($cmdletArray).Count -eq 2 -and + @($cmdletArray)[1].OperationGuid -eq 'b@contoso.com' -and + @($cmdletArray)[1].CmdletInput.CmdletName -eq 'Set-Mailbox' -and + @($cmdletArray)[1].CmdletInput.Parameters.Identity -eq 'b@contoso.com' -and + (@($cmdletArray)[1].CmdletInput.Parameters.DefaultAuditSet -join ',') -eq 'Admin,Delegate,Owner' + } + } + + It 'continues past a failed mailbox and throws only when every write failed' { + Mock Write-LogMessage {} + $Current = [PSCustomObject]@{ targets = @([PSCustomObject]@{ id = 'a@contoso.com' }, [PSCustomObject]@{ id = 'b@contoso.com' }) } + Mock New-ExoBulkRequest { @([PSCustomObject]@{ error = 'proxy'; OperationGuid = 'a@contoso.com' }, [PSCustomObject]@{ Success = $true; OperationGuid = 'b@contoso.com' }) } + { Invoke-CIPPBaselineMailboxDefaultAuditSet -Remediate $null -TenantFilter $script:Tenant -Current $Current } | Should -Not -Throw + Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $message -like '*1 of 2*a@contoso.com -> proxy*' } + Mock New-ExoBulkRequest { @([PSCustomObject]@{ error = 'proxy'; OperationGuid = 'a@contoso.com' }, [PSCustomObject]@{ error = 'proxy'; OperationGuid = 'b@contoso.com' }) } + { Invoke-CIPPBaselineMailboxDefaultAuditSet -Remediate $null -TenantFilter $script:Tenant -Current $Current } | Should -Throw '*all 2 writes failed*a@contoso.com -> proxy*' + } +} diff --git a/backend/Tests/Baselines/BaselineGlobalSecureAccess.Tests.ps1 b/backend/Tests/Baselines/BaselineGlobalSecureAccess.Tests.ps1 new file mode 100644 index 0000000000..96a7aef738 --- /dev/null +++ b/backend/Tests/Baselines/BaselineGlobalSecureAccess.Tests.ps1 @@ -0,0 +1,218 @@ +# GlobalSecureAccessCompliantNetwork: the decisions that fail silently and lock people out. + +BeforeAll { + $script:RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $Baselines = Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Baselines' + + function New-CIPPDbRequest { param($TenantFilter, $Type, $Fields) } + function Write-LogMessage { param($API, $tenant, $message, $Sev, $LogData) } + function Get-CIPPDbItem { param($TenantFilter, $Type, [switch]$CountsOnly) } + function New-GraphGetRequest { param($uri, $tenantid, $AsApp) } + function New-GraphPostRequest { param($uri, $tenantid, $type, $body, $AsApp) } + function Add-CIPPW32ScriptApplication { param($TenantFilter, $Properties) } + function Set-CIPPAssignedApplication { param($ApplicationId, $TenantFilter, $GroupName, $ExcludeGroup, $Intent, $AppType, $APIName) } + function Add-CIPPMacOSShellScript { param($TenantFilter, $DisplayName, $Description, $ScriptContent, $ExecutionFrequency) } + function Set-CIPPAssignedPolicy { param($PolicyId, $Type, $GroupName, $ExcludeGroup, $TenantFilter, $AssignmentMode, $APIName) } + function Set-CIPPIntunePolicy { param($TemplateType, $DisplayName, $Description, $RawJSON, $TenantFilter, $APIName, $AssignmentMode, $AssignTo, $ExcludeGroup) } + function New-CIPPCAPolicy { param($RawJSON, $TenantFilter, $State, $Overwrite, $ReplacePattern, $APIName) } + function Set-CIPPDBCacheNetworkAccess { param($TenantFilter) } + function Set-CIPPDBCacheConditionalAccessPolicies { param($TenantFilter) } + function Set-CIPPDBCacheIntuneMobileApps { param($TenantFilter) } + function Set-CIPPDBCacheIntuneScripts { param($TenantFilter) } + function Set-CIPPDBCacheIntuneConfigurationPolicies { param($TenantFilter) } + function Set-CIPPDBCacheIntunePolicies { param($TenantFilter) } + + . (Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCABreakGlassCandidate.ps1') + . (Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Get-CIPPIntuneCompareExclusions.ps1') + . (Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Compare-CIPPIntuneObject.ps1') + . (Join-Path $Baselines 'Get-CIPPBaselineCacheRows.ps1') + . (Join-Path $Baselines 'Test-CIPPBaselineCacheCollected.ps1') + . (Join-Path $Baselines 'Get-CIPPBaselineGlobalSecureAccessCompliantNetworkState.ps1') + . (Join-Path $Baselines 'Invoke-CIPPBaselineGlobalSecureAccessCompliantNetwork.ps1') + + $script:Tenant = 'contoso.onmicrosoft.com' + function ConvertTo-Cached { param([Parameter(ValueFromPipeline = $true)]$InputObject) process { $InputObject | ConvertTo-Json -Depth 25 | ConvertFrom-Json } } + function Get-Verdict { + param($Expected, $Current) + $Projected = [PSCustomObject]@{} + foreach ($Key in $Expected.PSObject.Properties.Name) { $Projected | Add-Member -NotePropertyName $Key -NotePropertyValue $Current.$Key } + @(Compare-CIPPIntuneObject -ReferenceObject $Expected -DifferenceObject $Projected | Where-Object { $_ }) + } + Mock Get-CIPPDbItem { [PSCustomObject]@{ RowKey = 'X-Count'; DataCount = 1 } } + + $script:GlobalAdmin = '62e90394-69f5-4237-9190-012177145e10' + $script:PolicyName = 'CIPP: Require compliant network (Global Secure Access)' + $script:Location = @{ '@odata.type' = '#microsoft.graph.compliantNetworkNamedLocation'; id = 'loc-cn'; displayName = 'All Compliant Network locations' } + $script:M365 = @{ id = 'prof-m365'; state = 'enabled'; trafficForwardingType = 'm365'; isCustomProfile = $false; servicePrincipalId = 'sp-m365'; appRoleAssignmentRequired = $false; policies = @(@{ id = 'link-exo'; state = 'enabled' }) } + $script:TenantRow = @{ id = 'networkAccess'; onboarded = $true; signalingStatus = 'enabled'; profiles = @($script:M365) } + $script:Policy = @{ id = 'ca-1'; displayName = $script:PolicyName; state = 'enabledForReportingButNotEnforced'; conditions = @{ users = @{ includeUsers = @('All'); excludeUsers = @('u-bg'); excludeGroups = @(); excludeRoles = @($script:GlobalAdmin) } } } +} + +Describe 'Get-CIPPBaselineGlobalSecureAccessCompliantNetworkState' { + It 'grades a never-onboarded tenant as drift on every tenant flag' { + Mock New-CIPPDbRequest { if ($Type -eq 'NetworkAccess') { @(@{ id = 'networkAccess'; onboarded = $false; profiles = @() } | ConvertTo-Cached) } else { @() } } + $P = Get-CIPPBaselineGlobalSecureAccessCompliantNetworkState -Item ([PSCustomObject]@{ Variables = [PSCustomObject]@{} }) -TenantFilter $script:Tenant + foreach ($Key in 'onboarded', 'microsoftProfileEnabled', 'profileAssignedToAllUsers', 'signalingEnabled', 'compliantNetworkLocationPresent', 'policyPresent') { $P.Current.$Key | Should -BeFalse -Because $Key } + $P.Current.policyDrift | Should -BeTrue + } + + It 'grades a complete tenant compliant, with policy roles as a subset and the configured state' { + Mock New-CIPPDbRequest { + switch ($Type) { + 'NetworkAccess' { @($script:TenantRow | ConvertTo-Cached) } + 'NamedLocations' { @($script:Location | ConvertTo-Cached) } + 'IntuneMobileApps' { @(@{ displayName = 'Global Secure Access Client (Windows)' } | ConvertTo-Cached) } + 'ConditionalAccessPolicies' { @($script:Policy | ConvertTo-Cached) } + default { @() } + } + } + $Variables = [PSCustomObject]@{ deployMacOS = $false; enforce = $false; excludeAdminRoles = @([PSCustomObject]@{ value = $script:GlobalAdmin }) } + $P = Get-CIPPBaselineGlobalSecureAccessCompliantNetworkState -Item ([PSCustomObject]@{ Variables = $Variables }) -TenantFilter $script:Tenant + (Get-Verdict -Expected $P.Expected -Current $P.Current).Count | Should -Be 0 + $P.Current.policyDrift | Should -BeFalse + $P.Expected.PSObject.Properties.Name | Should -Not -Contain 'macOSScriptDeployed' + + $Variables.enforce = $true + $P = Get-CIPPBaselineGlobalSecureAccessCompliantNetworkState -Item ([PSCustomObject]@{ Variables = $Variables }) -TenantFilter $script:Tenant + $P.Expected.policyState | Should -Be 'enabled' + $P.Current.policyDrift | Should -BeTrue + } + + It 'returns No Data when the NetworkAccess cache was never collected' { + Mock New-CIPPDbRequest { @() } + (Get-CIPPBaselineGlobalSecureAccessCompliantNetworkState -Item ([PSCustomObject]@{ Variables = [PSCustomObject]@{} }) -TenantFilter $script:Tenant).Current | Should -BeNullOrEmpty + } +} + +Describe 'Invoke-CIPPBaselineGlobalSecureAccessCompliantNetwork' { + BeforeEach { + Mock Start-Sleep { } + Mock New-GraphPostRequest { } + Mock Set-CIPPAssignedApplication { } + Mock Set-CIPPAssignedPolicy { } + Mock Set-CIPPIntunePolicy { } + Mock Add-CIPPMacOSShellScript { [PSCustomObject]@{ id = 'scr-1' } } + Mock New-CIPPCAPolicy { } + $script:Deployed = $null + Mock Add-CIPPW32ScriptApplication { $script:Deployed = $Properties; [PSCustomObject]@{ Id = 'app-new' } } + $script:LiveStatus = 'onboarded' + $script:LiveSignaling = 'enabled' + $script:LiveLocations = @([PSCustomObject]$script:Location) + $script:LiveApps = @() + $script:LivePolicies = @() + Mock New-GraphGetRequest { + switch -Wildcard ($uri) { + '*networkAccess/tenantStatus' { [PSCustomObject]@{ onboardingStatus = $script:LiveStatus } } + '*networkAccess/forwardingProfiles*' { @([PSCustomObject]@{ id = 'prof-m365'; state = 'enabled'; trafficForwardingType = 'm365'; servicePrincipal = [PSCustomObject]@{ id = 'sp-m365' }; policies = @([PSCustomObject]@{ id = 'link-exo'; state = 'enabled' }) }) } + '*networkAccess/settings/conditionalAccess' { [PSCustomObject]@{ signalingStatus = $script:LiveSignaling } } + '*servicePrincipals/sp-m365?*' { [PSCustomObject]@{ appRoleAssignmentRequired = $false } } + '*namedLocations' { $script:LiveLocations } + '*mobileApps*' { $script:LiveApps } + '*conditionalAccess/policies*' { $script:LivePolicies } + '*users?*' { @([PSCustomObject]@{ id = 'u-bg'; displayName = 'Break Glass'; userPrincipalName = 'breakglass@contoso.com' }) } + default { @() } + } + } + $script:Configured = [PSCustomObject]@{ policyDrift = $false } + } + + It 'writes nothing and reports Changed=false on a configured tenant with unchanged client objects' { + Invoke-CIPPBaselineGlobalSecureAccessCompliantNetwork -Remediate ([PSCustomObject]@{ deployMacOS = $false }) -TenantFilter $script:Tenant -Current $script:Configured | Out-Null + $Hash = $script:Deployed.description -replace '.*\[cfg:([0-9A-F]{16})\].*', '$1' + $script:LiveApps = @([PSCustomObject]@{ id = 'app-1'; '@odata.type' = '#microsoft.graph.win32LobApp'; description = "x [cfg:$Hash]" }) + $Result = Invoke-CIPPBaselineGlobalSecureAccessCompliantNetwork -Remediate ([PSCustomObject]@{ deployMacOS = $false }) -TenantFilter $script:Tenant -Current $script:Configured + $Result.Changed | Should -BeFalse + Should -Invoke Add-CIPPW32ScriptApplication -Times 1 -Exactly + Should -Invoke New-GraphPostRequest -Times 0 -Exactly + Should -Invoke New-CIPPCAPolicy -Times 0 -Exactly + } + + It 'onboards, enables signaling and creates the named location the way the admin center does, never disabling anything' { + $script:LiveStatus = 'offboarded' + $script:LiveSignaling = 'disabled' + $script:LiveLocations = @() + Mock New-GraphPostRequest { + if ($uri -like '*networkaccess.onboard') { $script:LiveStatus = 'onboarded' } + if ($uri -like '*namedLocations') { [PSCustomObject]$script:Location } + } + Invoke-CIPPBaselineGlobalSecureAccessCompliantNetwork -Remediate ([PSCustomObject]@{ deployWindows = $false; useDetectedBreakGlass = $false }) -TenantFilter $script:Tenant -Current $null | Out-Null + Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter { $uri -like '*networkaccess.onboard' } + Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter { $uri -like '*settings/conditionalAccess' -and $body -like '*"signalingStatus":"enabled"*' } + Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter { $uri -like '*namedLocations' -and $type -eq 'POST' -and $body -like '*compliantNetworkNamedLocation*' } + Should -Invoke New-GraphPostRequest -Times 0 -Exactly -ParameterFilter { $body -like '*disabled*' } + } + + It 'renders the Windows scripts from the settings with no placeholder left' { + Invoke-CIPPBaselineGlobalSecureAccessCompliantNetwork -Remediate ([PSCustomObject]@{ deployMacOS = $false; lockDownClient = $false; preferIPv4 = $false }) -TenantFilter $script:Tenant -Current $script:Configured | Out-Null + $script:Deployed.installScript | Should -Match '-Value 0 -Type DWord' + $script:Deployed.installScript | Should -Match 'if \(\$false\)' + $script:Deployed.detectionScript | Should -Match '-ne 0\)' + foreach ($Text in $script:Deployed.installScript, $script:Deployed.uninstallScript, $script:Deployed.detectionScript) { + $Text | Should -Not -Match 'LOCKDOWN|PREFERIPV4|%' + } + Should -Invoke Set-CIPPAssignedApplication -Times 1 -Exactly -ParameterFilter { $GroupName -eq 'AllDevices' -and $Intent -eq 'Required' } + } + + It 'assigns the macOS script in replace mode (append reads a route Graph rejects for shell scripts) and deploys the three profiles' { + Invoke-CIPPBaselineGlobalSecureAccessCompliantNetwork -Remediate ([PSCustomObject]@{ deployWindows = $false; assignTo = 'AllUsers' }) -TenantFilter $script:Tenant -Current $script:Configured | Out-Null + Should -Invoke Add-CIPPMacOSShellScript -Times 1 -Exactly -ParameterFilter { $ExecutionFrequency -eq 'P1D' -and $ScriptContent -notmatch 'CONFIGHASH' } + Should -Invoke Set-CIPPAssignedPolicy -Times 1 -Exactly -ParameterFilter { $Type -eq 'deviceShellScripts' -and $GroupName -eq 'allLicensedUsers' -and $AssignmentMode -eq 'replace' } + Should -Invoke Set-CIPPIntunePolicy -Times 3 -Exactly -ParameterFilter { $AssignTo -eq 'allLicensedUsers' -and $Description -match '\[cfg:' } + Should -Invoke Set-CIPPIntunePolicy -Times 1 -Exactly -ParameterFilter { $TemplateType -eq 'Catalog' -and $RawJSON -like '*com.apple.system-extension-policy_allowedsystemextensions*' -and $RawJSON -like '*UBF8T346G9*' } + } + + It 'refuses to enable the policy with no break-glass exclusion, but still deploys report-only' { + $Remediate = [PSCustomObject]@{ deployMacOS = $false; enforce = $true; useDetectedBreakGlass = $false } + { Invoke-CIPPBaselineGlobalSecureAccessCompliantNetwork -Remediate $Remediate -TenantFilter $script:Tenant -Current $null } | Should -Throw '*Refusing to enable*' + Should -Invoke New-CIPPCAPolicy -Times 0 -Exactly + + $Remediate.enforce = $false + Invoke-CIPPBaselineGlobalSecureAccessCompliantNetwork -Remediate $Remediate -TenantFilter $script:Tenant -Current $null | Out-Null + Should -Invoke New-CIPPCAPolicy -Times 1 -Exactly -ParameterFilter { $State -eq 'enabledForReportingButNotEnforced' -and $Overwrite -eq $true } + } + + It 'builds the documented policy: block, any location except the compliant network BY ID, Intune excluded, roles and resolved break-glass excluded' { + $script:Json = $null + Mock New-CIPPCAPolicy { $script:Json = $RawJSON | ConvertFrom-Json } + $Remediate = [PSCustomObject]@{ deployMacOS = $false; enforce = $true; excludeAdminRoles = @($script:GlobalAdmin); excludeUsers = @('breakglass@contoso.com'); useDetectedBreakGlass = $false } + Invoke-CIPPBaselineGlobalSecureAccessCompliantNetwork -Remediate $Remediate -TenantFilter $script:Tenant -Current $null | Out-Null + $script:Json.state | Should -Be 'enabled' + $script:Json.grantControls.builtInControls | Should -Be @('block') + $script:Json.conditions.users.includeUsers | Should -Be @('All') + $script:Json.conditions.users.excludeUsers | Should -Be @('u-bg') + $script:Json.conditions.users.excludeRoles | Should -Be @($script:GlobalAdmin) + $script:Json.conditions.applications.includeApplications | Should -Be @('All') + @($script:Json.conditions.applications.excludeApplications) | Should -Contain '0000000a-0000-0000-c000-000000000000' + $script:Json.conditions.locations.includeLocations | Should -Be @('All') + $script:Json.conditions.locations.excludeLocations | Should -Be @('loc-cn') + } + + It 'refreshes exactly the caches it wrote to, so the next compare does not flap on stale copies' { + Mock Set-CIPPDBCacheNetworkAccess { } + Mock Set-CIPPDBCacheConditionalAccessPolicies { } + Mock Set-CIPPDBCacheIntuneMobileApps { } + Mock Set-CIPPDBCacheIntuneScripts { } + Mock Set-CIPPDBCacheIntuneConfigurationPolicies { } + Mock Set-CIPPDBCacheIntunePolicies { } + Invoke-CIPPBaselineGlobalSecureAccessCompliantNetwork -Remediate ([PSCustomObject]@{ deployMacOS = $false; useDetectedBreakGlass = $false }) -TenantFilter $script:Tenant -Current $null | Out-Null + Should -Invoke Set-CIPPDBCacheIntuneMobileApps -Times 1 -Exactly + Should -Invoke Set-CIPPDBCacheConditionalAccessPolicies -Times 1 -Exactly + Should -Invoke Set-CIPPDBCacheNetworkAccess -Times 0 -Exactly + Should -Invoke Set-CIPPDBCacheIntuneScripts -Times 0 -Exactly + + $script:LiveApps = @([PSCustomObject]@{ id = 'app-1'; '@odata.type' = '#microsoft.graph.win32LobApp'; description = $script:Deployed.description }) + Invoke-CIPPBaselineGlobalSecureAccessCompliantNetwork -Remediate ([PSCustomObject]@{ deployMacOS = $false }) -TenantFilter $script:Tenant -Current $script:Configured | Out-Null + Should -Invoke Set-CIPPDBCacheIntuneMobileApps -Times 1 -Exactly + Should -Invoke Set-CIPPDBCacheConditionalAccessPolicies -Times 1 -Exactly + } + + It 'takes the break-glass account the tenant already excludes elsewhere' { + $script:LivePolicies = @( + [PSCustomObject]@{ displayName = 'Require MFA'; state = 'enabled'; conditions = [PSCustomObject]@{ users = [PSCustomObject]@{ includeUsers = @('All'); excludeUsers = @('u-detected'); excludeGroups = @() } } } + ) + $script:Json = $null + Mock New-CIPPCAPolicy { $script:Json = $RawJSON | ConvertFrom-Json } + Invoke-CIPPBaselineGlobalSecureAccessCompliantNetwork -Remediate ([PSCustomObject]@{ deployMacOS = $false; enforce = $true }) -TenantFilter $script:Tenant -Current $null | Out-Null + $script:Json.conditions.users.excludeUsers | Should -Be @('u-detected') + } +} diff --git a/backend/Tests/Baselines/BaselineMigrationValueMaps.Tests.ps1 b/backend/Tests/Baselines/BaselineMigrationValueMaps.Tests.ps1 index f1c5cef0e7..987a8ad7f3 100644 --- a/backend/Tests/Baselines/BaselineMigrationValueMaps.Tests.ps1 +++ b/backend/Tests/Baselines/BaselineMigrationValueMaps.Tests.ps1 @@ -49,6 +49,22 @@ Describe 'Invoke-CIPPBaselineMigration value maps' { } } + Context "Teams 'Don''t change'" { + # V2 stores 'donotconfigure'; V3 only prunes a BLANK omitWhenBlank value. A literal + # 'donotconfigure' would reach the Set body as the value. + It 'migrates the donotconfigure sentinel to blank and keeps real picks' { + $Result = Invoke-Migration @{ + TeamsFilesPolicy = @{ action = @('warn'); standards = @{ TeamsFilesPolicy = @{ FileSharingInChatsWithExternalUsers = @{ label = 'Disabled'; value = 'Disabled' }; NativeFileEntryPoints = @{ label = "Don't change"; value = 'donotconfigure' }; SPChannelFilesTab = 'donotconfigure' } } } + TeamsMessagingPolicy = @{ action = @('warn'); standards = @{ TeamsMessagingPolicy = @{ AutoShareFilesInExternalChats = @{ label = "Don't change"; value = 'donotconfigure' } } } } + } + $Files = ($Result.Configs | Where-Object standard -EQ 'TeamsFilesPolicy').variables + $Files.FileSharingInChatsWithExternalUsers | Should -BeExactly 'Disabled' + "$($Files.NativeFileEntryPoints)" | Should -BeExactly '' + "$($Files.SPChannelFilesTab)" | Should -BeExactly '' + "$(($Result.Configs | Where-Object standard -EQ 'TeamsMessagingPolicy').variables.AutoShareFilesInExternalChats)" | Should -BeExactly '' + } + } + Context 'DefaultSharingLink' { It 'translates the V2 enum names to the SPO numerics the definition compares against' { $Internal = Invoke-Migration @{ DefaultSharingLink = @{ action = @('warn'); standards = @{ DefaultSharingLink = @{ SharingLinkType = @{ label = 'Internal - Only people in your organization'; value = 'Internal' } } } } } diff --git a/backend/Tests/Baselines/BaselineOddballs.Tests.ps1 b/backend/Tests/Baselines/BaselineOddballs.Tests.ps1 index bc1c8a685d..3e1a3a2180 100644 --- a/backend/Tests/Baselines/BaselineOddballs.Tests.ps1 +++ b/backend/Tests/Baselines/BaselineOddballs.Tests.ps1 @@ -27,7 +27,7 @@ BeforeAll { . (Join-Path $Baselines 'Get-CIPPBaselineCacheRows.ps1') . (Join-Path $Baselines 'Test-CIPPBaselineCacheCollected.ps1') foreach ($Name in @('PhishProtection', 'ColleagueImpersonationAlert', 'DisableOutlookAddins', - 'RestrictThirdPartyStorageServices', 'IntuneAppTemplateDeploy')) { + 'RestrictThirdPartyStorageServices', 'IntuneAppTemplateDeploy', 'MFAPushApps')) { . (Join-Path $Baselines "Get-CIPPBaseline${Name}State.ps1") . (Join-Path $Baselines "Invoke-CIPPBaseline${Name}.ps1") } @@ -224,6 +224,41 @@ Describe 'Get-CIPPBaselineRestrictThirdPartyStorageServicesState' { } } +Describe 'Get-CIPPBaselineMFAPushAppsState' { + BeforeAll { + $script:ClientId = '981f26a1-7f43-403b-a875-f8b09b8cd720' + $script:ConnectorId = '1f5530b3-261a-47a9-b357-ded261e17918' + } + + It 'missing service principals grade enabled - the platform default' { + Mock New-CIPPDbRequest { @(@{ appId = 'other'; accountEnabled = $false } | ConvertTo-Cached) } + $Prepared = Get-CIPPBaselineMFAPushAppsState -Item ([PSCustomObject]@{ Variables = [PSCustomObject]@{ Enabled = $true } }) -TenantFilter $script:Tenant + Get-Verdict -Expected $Prepared.Expected -Current $Prepared.Current | Should -BeNullOrEmpty + } + + It 'grades each app on its own accountEnabled against the configured state' { + Mock New-CIPPDbRequest { @(@{ appId = $script:ClientId; accountEnabled = $false }, @{ appId = $script:ConnectorId; accountEnabled = $true } | ConvertTo-Cached) } + $Prepared = Get-CIPPBaselineMFAPushAppsState -Item ([PSCustomObject]@{ Variables = [PSCustomObject]@{ Enabled = $true } }) -TenantFilter $script:Tenant + $Prepared.Current.mfaClientEnabled | Should -BeFalse + $Prepared.Current.mfaConnectorEnabled | Should -BeTrue + $Prepared.Expected.mfaClientEnabled | Should -BeTrue + $Disable = Get-CIPPBaselineMFAPushAppsState -Item ([PSCustomObject]@{ Variables = [PSCustomObject]@{ Enabled = $false } }) -TenantFilter $script:Tenant + $Disable.Expected.mfaConnectorEnabled | Should -BeFalse + } + + It 'writes the configured state to both apps through the appId upsert' -TestCases @(@{ Enabled = 'True'; Wire = $true }, @{ Enabled = $false; Wire = $false }) { + param($Enabled, $Wire) + Mock New-GraphPostRequest { } + Invoke-CIPPBaselineMFAPushApps -Remediate ([PSCustomObject]@{ enabled = $Enabled }) -TenantFilter $script:Tenant -Current $null + foreach ($AppId in @($script:ClientId, $script:ConnectorId)) { + Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter { + $type -eq 'PATCH' -and $uri -like "*servicePrincipals(appId='$AppId')" -and + $AddedHeaders.Prefer -eq 'create-if-missing' -and ($body | ConvertFrom-Json).accountEnabled -eq $Wire + } + } + } +} + Describe 'Get-CIPPBaselineDlpCompliancePolicyTemplateState' { BeforeAll { function Compare-CIPPDlpCompliancePolicy { param($TenantFilter, $Template) } diff --git a/backend/Tests/Baselines/BaselineOneOffStandards.Tests.ps1 b/backend/Tests/Baselines/BaselineOneOffStandards.Tests.ps1 index ec18ab3c23..75fac372b1 100644 --- a/backend/Tests/Baselines/BaselineOneOffStandards.Tests.ps1 +++ b/backend/Tests/Baselines/BaselineOneOffStandards.Tests.ps1 @@ -226,6 +226,92 @@ Describe 'Get-CIPPBaselineEnableAppConsentRequestsState' { $type -eq 'PUT' -and ([regex]::Matches($body, '33333333-dddd-eeee-ffff-444444444444')).Count -eq 1 -and $body -match '62e90394-69f5-4237-9190-012177145e10' } } + + It 'grades a configured reviewer group present when the admin center shape carries its id' { + # The portal's Groups option writes /v1.0/groups/{id}/transitiveMembers/microsoft.graph.user; + # before groups were a variable this was a hand-added reviewer the merge preserved but + # the operator could not declare. + Mock New-CIPPDbRequest { + if ($Type -eq 'Groups') { + @(@{ id = '55555555-aaaa-bbbb-cccc-666666666666'; displayName = 'Consent Reviewers' } | ConvertTo-Cached) + } else { + @(@{ isEnabled = $true; reviewers = @( + @{ query = "/beta/roleManagement/directory/roleAssignments?`$filter=roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'" }, + @{ query = '/v1.0/groups/55555555-aaaa-bbbb-cccc-666666666666/transitiveMembers/microsoft.graph.user' } + ) } | ConvertTo-Cached) + } + } + $Item = [PSCustomObject]@{ Variables = [PSCustomObject]@{ ReviewerGroups = @([PSCustomObject]@{ label = 'Consent Reviewers'; value = 'Consent Reviewers' }) } } + $Prepared = Get-CIPPBaselineEnableAppConsentRequestsState -Item $Item -TenantFilter $script:Tenant + @($Prepared.Current.missingReviewerGroups).Count | Should -Be 0 + (Get-Verdict -Expected $Prepared.Expected -Current $Prepared.Current).Count | Should -Be 0 + } + + It 'reports drift when the configured group is absent from the reviewers or does not exist' { + Mock New-CIPPDbRequest { + if ($Type -eq 'Groups') { + @(@{ id = '55555555-aaaa-bbbb-cccc-666666666666'; displayName = 'Consent Reviewers' } | ConvertTo-Cached) + } else { + @(@{ isEnabled = $true; reviewers = @() } | ConvertTo-Cached) + } + } + $Item = [PSCustomObject]@{ Variables = [PSCustomObject]@{ ReviewerGroups = @('Consent Reviewers', 'Ghost Group') } } + $Prepared = Get-CIPPBaselineEnableAppConsentRequestsState -Item $Item -TenantFilter $script:Tenant + $Prepared.Current.missingReviewerGroups | Should -Contain 'Consent Reviewers' + $Prepared.Current.missingReviewerGroups | Should -Contain 'Ghost Group' + } + + It 'leaves an unconfigured reviewer group alone instead of grading it' { + # A tenant where someone set a group reviewer by hand used to look like drift the + # merge could never clear. No ReviewerGroups configured means no group grade at all. + Mock New-CIPPDbRequest { @(@{ isEnabled = $true; reviewers = @( + @{ query = "/beta/roleManagement/directory/roleAssignments?`$filter=roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'" }, + @{ query = '/v1.0/groups/55555555-aaaa-bbbb-cccc-666666666666/transitiveMembers/microsoft.graph.user' } + ) } | ConvertTo-Cached) } + $Item = [PSCustomObject]@{ Variables = [PSCustomObject]@{} } + $Prepared = Get-CIPPBaselineEnableAppConsentRequestsState -Item $Item -TenantFilter $script:Tenant + @($Prepared.Current.missingReviewerGroups).Count | Should -Be 0 + Should -Invoke New-CIPPDbRequest -Times 0 -ParameterFilter { $Type -eq 'Groups' } + (Get-Verdict -Expected $Prepared.Expected -Current $Prepared.Current).Count | Should -Be 0 + } + + It 'resolves reviewer groups by display name, writes the admin center shape and does not duplicate one already present' { + Mock New-GraphGetRequest { + if ($uri -match '/groups\?') { + @(@{ id = '55555555-aaaa-bbbb-cccc-666666666666'; displayName = 'Consent Reviewers' } | ConvertTo-Cached) + } else { + @{ isEnabled = $false; notifyReviewers = $false; remindersEnabled = $false; requestDurationInDays = 0; reviewers = @( + @{ query = '/v1.0/groups/55555555-aaaa-bbbb-cccc-666666666666/transitiveMembers/microsoft.graph.user'; queryType = 'MicrosoftGraph'; queryRoot = 'null' }, + @{ query = '/v1.0/users/keepme@contoso.com'; queryType = 'MicrosoftGraph'; queryRoot = 'null' } + ) } | ConvertTo-Cached + } + } + Mock New-GraphPostRequest { } + Invoke-CIPPBaselineEnableAppConsentRequests -Remediate ([PSCustomObject]@{ reviewerRoles = @(); reviewerGroups = @('Consent Reviewers') }) -TenantFilter $script:Tenant -Current $null + Should -Invoke New-GraphGetRequest -Times 0 -ParameterFilter { $uri -match '/users\?' } + Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter { + $type -eq 'PUT' -and + ([regex]::Matches($body, '55555555-aaaa-bbbb-cccc-666666666666')).Count -eq 1 -and + $body -match '/v1\.0/groups/55555555-aaaa-bbbb-cccc-666666666666/transitiveMembers/microsoft\.graph\.user' -and + $body -match 'keepme@contoso.com' -and + $body -match '62e90394-69f5-4237-9190-012177145e10' + } + } + + It 'skips a reviewer group name that matches no group and still writes the roles' { + Mock New-GraphGetRequest { + if ($uri -match '/groups\?') { @() } else { + @{ isEnabled = $false; notifyReviewers = $false; remindersEnabled = $false; requestDurationInDays = 0; reviewers = @() } | ConvertTo-Cached + } + } + Mock New-GraphPostRequest { } + Mock Write-LogMessage { } + Invoke-CIPPBaselineEnableAppConsentRequests -Remediate ([PSCustomObject]@{ reviewerRoles = @(); reviewerGroups = @('Ghost Group') }) -TenantFilter $script:Tenant -Current $null + Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $Sev -eq 'Warning' -and $message -match 'Ghost Group' } + Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter { + $type -eq 'PUT' -and $body -notmatch '/groups/' -and $body -match '62e90394-69f5-4237-9190-012177145e10' + } + } } Describe 'Get-CIPPBaselineTeamsFederationConfigurationState' { diff --git a/backend/Tests/Baselines/BaselineSharePointBatch.Tests.ps1 b/backend/Tests/Baselines/BaselineSharePointBatch.Tests.ps1 index dacd79f4f5..e1f068031f 100644 --- a/backend/Tests/Baselines/BaselineSharePointBatch.Tests.ps1 +++ b/backend/Tests/Baselines/BaselineSharePointBatch.Tests.ps1 @@ -171,9 +171,27 @@ Describe 'Get-CIPPBaselineSPOVersionControlState' { { Invoke-CIPPBaselineSPOVersionControl -Remediate ([PSCustomObject]@{ enableAutoTrim = $true; applyToExistingSites = $true }) -TenantFilter $script:Tenant -Current $null } | Should -Not -Throw Should -Invoke Set-CIPPSPOSiteBulk -Times 1 -Exactly Should -Invoke Set-CIPPSPOSiteBulk -Times 1 -Exactly -ParameterFilter { - @($Sites).Count -eq 2 -and @($Sites | Where-Object { $_.SiteUrl -like '*good' -and $_.Properties.InheritVersionPolicyFromTenant -eq $true }).Count -eq 1 + @($Sites).Count -eq 2 -and @($Sites | Where-Object { $_.SiteUrl -like '*good' -and $_.Properties.InheritVersionPolicyFromTenant -eq $false }).Count -eq 1 } } + + It 'queues existing libraries with an explicit policy and leaves new libraries inheriting' { + Mock Get-CIPPSPOTenant { [PSCustomObject]@{ _ObjectIdentity_ = 'fresh'; TenantFilter = $script:Tenant } } + Mock Set-CIPPSPOTenant { } + Mock New-GraphGetRequest { @([PSCustomObject]@{ webUrl = 'https://c.sharepoint.com/sites/a' }) } + $script:Sent = $null + Mock Set-CIPPSPOSiteBulk { $script:Sent = $Sites[0].Properties; @([PSCustomObject]@{ SiteUrl = $Sites[0].SiteUrl; Success = $true }) } + + Invoke-CIPPBaselineSPOVersionControl -Remediate ([PSCustomObject]@{ enableAutoTrim = $true; applyToExistingSites = $true }) -TenantFilter $script:Tenant -Current $null + $script:Sent.ApplyToExistingDocumentLibraries | Should -BeTrue + $script:Sent.ContainsKey('ApplyToNewDocumentLibraries') | Should -BeFalse + @($script:Sent.MajorVersionLimit, $script:Sent.ExpireVersionsAfterDays, $script:Sent.MajorWithMinorVersionsLimit) | Should -Be @(-1, -1, -1) + + Invoke-CIPPBaselineSPOVersionControl -Remediate ([PSCustomObject]@{ enableAutoTrim = $false; majorVersionLimit = 100; expireVersionsAfterDays = 0; applyToExistingSites = $true }) -TenantFilter $script:Tenant -Current $null + $script:Sent.EnableAutoExpirationVersionTrim | Should -BeFalse + $script:Sent.MajorVersionLimit | Should -Be 100 + $script:Sent.ContainsKey('MajorWithMinorVersionsLimit') | Should -BeFalse + } } Describe 'Get-CIPPBaselineMailContactsState' { diff --git a/backend/Tests/Baselines/BaselineTemplateFamilies.Tests.ps1 b/backend/Tests/Baselines/BaselineTemplateFamilies.Tests.ps1 index c2d5a6b8f7..8933d230b1 100644 --- a/backend/Tests/Baselines/BaselineTemplateFamilies.Tests.ps1 +++ b/backend/Tests/Baselines/BaselineTemplateFamilies.Tests.ps1 @@ -261,6 +261,52 @@ Describe 'Get-CIPPBaselineTransportRuleTemplateState' { @($Prepared.Current.ruleBodies).Count | Should -Be 1 $Prepared.Current.ruleBodies[0].FromScope | Should -Be 'InOrganization' } + + It 'overwrites an existing rule without Enabled and applies the state with ' -ForEach @( + @{ Enabled = $true; Expected = 'Enable-TransportRule' } + @{ Enabled = $false; Expected = 'Disable-TransportRule' } + ) { + Mock New-ExoRequest { } + $Current = [PSCustomObject]@{ ruleBodies = @([PSCustomObject]@{ name = 'Tag'; PrependSubject = '[EXT] '; Enabled = $Enabled }); deployedNames = @('Tag') } + Invoke-CIPPBaselineTransportRuleTemplate -Remediate ([PSCustomObject]@{ overwrite = $true }) -TenantFilter $script:Tenant -Current $Current + Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter { + $cmdlet -eq 'Set-TransportRule' -and -not $cmdParams.ContainsKey('Enabled') -and $cmdParams.Identity -eq 'Tag' + } + Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter { $cmdlet -eq $Expected -and $cmdParams.Identity -eq 'Tag' } + } + + It 'updates a rule the stale cache missed when overwrite is on, and leaves it when off (overwrite )' -ForEach @( + @{ Overwrite = $true; SetCalls = 1 } + @{ Overwrite = $false; SetCalls = 0 } + ) { + Mock New-ExoRequest { throw "|System.ArgumentException|A rule with this name already exists. (Parameter 'Name')" } -ParameterFilter { $cmdlet -eq 'New-TransportRule' } + Mock New-ExoRequest { } + $Current = [PSCustomObject]@{ ruleBodies = @([PSCustomObject]@{ name = 'Tag'; PrependSubject = '[EXT] ' }); deployedNames = @() } + { Invoke-CIPPBaselineTransportRuleTemplate -Remediate ([PSCustomObject]@{ overwrite = $Overwrite }) -TenantFilter $script:Tenant -Current $Current } | Should -Not -Throw + Should -Invoke New-ExoRequest -Times $SetCalls -Exactly -ParameterFilter { $cmdlet -eq 'Set-TransportRule' -and $cmdParams.Identity -eq 'Tag' } + } + + It 'still fails a create that errors for another reason' { + Mock New-ExoRequest { throw 'Access denied' } + $Current = [PSCustomObject]@{ ruleBodies = @([PSCustomObject]@{ name = 'Tag' }); deployedNames = @() } + { Invoke-CIPPBaselineTransportRuleTemplate -Remediate ([PSCustomObject]@{ overwrite = $true }) -TenantFilter $script:Tenant -Current $Current } | Should -Throw '*Access denied*' + } + + It 'grades and deploys the template under its resolved %variables%' { + Mock Get-CIPPTextReplacement { $Text -replace '%tenantname%', 'Contoso' } + Mock Get-CIPPAzDataTableEntity { [PSCustomObject]@{ RowKey = 'tpl-t'; JSON = '{"name":"%tenantname% Block Autoforward","PrependSubject":"[%tenantname%] "}' } } + Mock New-CIPPDbRequest { @(@{ Identity = 'x'; DisplayName = 'Contoso Block Autoforward'; Name = 'y' } | ConvertTo-Cached) } + $Prepared = Get-CIPPBaselineTransportRuleTemplateState -Item $script:TransportItem -TenantFilter $script:Tenant + (Get-Verdict -Expected $Prepared.Expected -Current $Prepared.Current).Count | Should -Be 0 + + Mock New-CIPPDbRequest { @() } + Mock New-ExoRequest { } + $Prepared = Get-CIPPBaselineTransportRuleTemplateState -Item $script:TransportItem -TenantFilter $script:Tenant + Invoke-CIPPBaselineTransportRuleTemplate -Remediate ([PSCustomObject]@{}) -TenantFilter $script:Tenant -Current $Prepared.Current + Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter { + $cmdlet -eq 'New-TransportRule' -and $cmdParams.name -eq 'Contoso Block Autoforward' -and $cmdParams.PrependSubject -eq '[Contoso] ' + } + } } Describe 'Template family executors' { diff --git a/backend/Tests/Baselines/BaselineTemplateFamilies2.Tests.ps1 b/backend/Tests/Baselines/BaselineTemplateFamilies2.Tests.ps1 index f3ed06eee9..bfda25d6ab 100644 --- a/backend/Tests/Baselines/BaselineTemplateFamilies2.Tests.ps1 +++ b/backend/Tests/Baselines/BaselineTemplateFamilies2.Tests.ps1 @@ -18,7 +18,7 @@ BeforeAll { function New-CIPPGroup { param($GroupObject, $TenantFilter, $APIName) } function New-GraphPostRequest { param($uri, $tenantid, $type, $body) } function New-ExoRequest { param($tenantid, $cmdlet, $cmdParams, $useSystemMailbox, $Select, $Compliance, $AsApp) } - function Get-CIPPTextReplacement { param($Text, $TenantFilter) $Text } + function Get-CIPPTextReplacement { param($Text, $TenantFilter, [switch]$EscapeForJson) $Text } function Test-CIPPStandardLicense { param($StandardName, $TenantFilter, $Preset, [switch]$SkipLog) $true } function Set-CIPPQuarantinePolicy { param($identity, $action, $EndUserQuarantinePermissions, $ESNEnabled, $IncludeMessagesFromBlockedSenderAddress, $tenantFilter, $APIName) } @@ -161,6 +161,16 @@ Describe 'Get-CIPPBaselineGroupTemplateState' { (Get-CIPPBaselineGroupTemplateState -Item $Item -TenantFilter $script:Tenant).Current.deployed | Should -BeTrue } + It 'matches a %token% name by its resolved value and hands the executor the resolved body' { + Mock Get-CIPPAzDataTableEntity { [PSCustomObject]@{ RowKey = 'tpl-g'; JSON = '{"displayName":"%shortname%-Sec","groupType":"security"}' } } + Mock Get-CIPPTextReplacement { $Text -replace '%shortname%', 'ctso' } + Mock New-CIPPDbRequest { @(@{ id = 'g1'; displayName = 'ctso-Sec' } | ConvertTo-Cached) } + $Item = [PSCustomObject]@{ Variables = [PSCustomObject]@{ groupTemplate = 'tpl-g' } } + $Prepared = Get-CIPPBaselineGroupTemplateState -Item $Item -TenantFilter $script:Tenant + $Prepared.Current.deployed | Should -BeTrue + $Prepared.Current.templateBody.displayName | Should -Be 'ctso-Sec' + } + It 'reports a missing group as drift' { Mock Get-CIPPAzDataTableEntity { [PSCustomObject]@{ RowKey = 'tpl-g'; JSON = '{"displayName":"Sec Group","groupType":"security"}' } } Mock New-CIPPDbRequest { @(@{ id = 'g2'; displayName = 'Other' } | ConvertTo-Cached) } diff --git a/backend/Tests/Baselines/Invoke-CIPPBaselineGraduation.Tests.ps1 b/backend/Tests/Baselines/Invoke-CIPPBaselineGraduation.Tests.ps1 index 4458fe2a18..1fed803ea0 100644 --- a/backend/Tests/Baselines/Invoke-CIPPBaselineGraduation.Tests.ps1 +++ b/backend/Tests/Baselines/Invoke-CIPPBaselineGraduation.Tests.ps1 @@ -9,6 +9,9 @@ BeforeAll { function Add-CIPPAzDataTableEntity { param($TableName, $Entity, [switch]$Force) } function Add-CIPPBaselineHistoryEvent { param($TenantFilter, $Standard, $Mode, $TriggeredBy, $Outcome, $Detail) } function Write-LogMessage { param($API, $tenant, $message, $Sev) } + function Get-CIPPAzDataTableEntity { param($TableName, $Filter) } + function ConvertTo-CIPPODataFilterValue { param($Value) $Value } + function Expand-CIPPBaselineTemplatePackage { param($Definition, $Config) } $script:Baseline = [pscustomobject]@{ GUID = 'b1' @@ -50,4 +53,43 @@ Describe 'Invoke-CIPPBaselineGraduation' { Should -Invoke Get-CIPPBaseline -Times 1 -ParameterFilter { $ID -eq 'b1' } Should -Invoke Add-CIPPBaselineHistoryEvent -Times 1 -ParameterFilter { $TriggeredBy -eq 'admin@contoso.com' } } + + Context 'success condition' { + BeforeEach { + $script:Baseline = [pscustomobject]@{ + GUID = 'b2' + templateName = 'Rollout' + stages = @( + [pscustomobject]@{ name = 'Pilot'; conditions = @(); standardsConfig = @([pscustomobject]@{ instance = 'standards.A' }, [pscustomobject]@{ instance = 'standards.B' }) } + [pscustomobject]@{ name = 'Next'; logic = 'and'; conditions = @([pscustomobject]@{ type = 'success' }) } + ) + tenantStates = @([pscustomobject]@{ tenantFilter = 't.onmicrosoft.com'; currentStage = 1; totalStages = 2; stageName = 'Pilot'; enteredStageAt = 1 }) + } + Mock Get-CIPPBaseline { $script:Baseline } + } + + It 'treats a standard the tenant cannot license as aligned instead of blocking the stage' { + Mock Get-CIPPAzDataTableEntity { + @( + [pscustomobject]@{ StandardName = 'standards.A'; Status = 'Compliant' } + [pscustomobject]@{ StandardName = 'standards.B'; Status = 'Skipped - No License' } + ) + } + $Result = @(Invoke-CIPPBaselineGraduation -TemplateId 'b2')[0] + $Result.Advanced | Should -BeTrue + $Result.Stage | Should -Be 2 + } + + It 'still holds the stage while a licensable standard drifts' { + Mock Get-CIPPAzDataTableEntity { + @( + [pscustomobject]@{ StandardName = 'standards.A'; Status = 'Drift' } + [pscustomobject]@{ StandardName = 'standards.B'; Status = 'Skipped - No License' } + ) + } + $Result = @(Invoke-CIPPBaselineGraduation -TemplateId 'b2')[0] + $Result.Advanced | Should -BeFalse + $Result.Unmet | Should -Be @('success') + } + } } diff --git a/backend/Tests/Baselines/TeamsGlobalMeetingPolicy.ExternalBots.Tests.ps1 b/backend/Tests/Baselines/TeamsGlobalMeetingPolicy.ExternalBots.Tests.ps1 new file mode 100644 index 0000000000..5a45d7916b --- /dev/null +++ b/backend/Tests/Baselines/TeamsGlobalMeetingPolicy.ExternalBots.Tests.ps1 @@ -0,0 +1,43 @@ +# ExternalBotAccessMode is an omitWhenBlank variable: existing baselines (blank) must neither +# compare nor write it, and only an explicit choice reaches Set-CsTeamsMeetingPolicy. + +BeforeAll { + $script:RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $script:Definition = Get-Content (Join-Path $script:RepoRoot 'Config/BaselineStandards/Teams Standards/TeamsGlobalMeetingPolicy.json') -Raw | ConvertFrom-Json + + # $Render is a scriptblock local to Invoke-CIPPBaselineStandard; lift it out of the real + # source so the test exercises the production pruning, not a copy. + $Ast = [System.Management.Automation.Language.Parser]::ParseFile((Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineStandard.ps1'), [ref]$null, [ref]$null) + $Assign = $Ast.Find({ param($n) $n -is [System.Management.Automation.Language.AssignmentStatementAst] -and $n.Left.Extent.Text -eq '$Render' }, $true) + $script:Render = [scriptblock]::Create($Assign.Right.Expression.Extent.Text.Trim('{', '}')) + function Get-CIPPTextReplacement { param($TenantFilter, $Text, [switch]$EscapeForJson) $Text } + function Invoke-Render { param($Template, $Variables) $Definition = $script:Definition; & $script:Render $Template $Variables } +} + +Describe 'TeamsGlobalMeetingPolicy ExternalBotAccessMode' { + It 'is declared omitWhenBlank with a blank default and both Microsoft values' { + $Variable = $script:Definition.variables.ExternalBotAccessMode + $Variable.omitWhenBlank | Should -BeTrue + $Variable.default | Should -Be '' + @($Variable.options.value) | Should -Contain 'RequireApprovalWhenDetected' + @($Variable.options.value) | Should -Contain 'AllowAllBots' + } + + It 'is wired into expected and the Set-CsTeamsMeetingPolicy params' { + $script:Definition.expected.ExternalBotAccessMode | Should -Be '%ExternalBotAccessMode%' + $script:Definition.remediate.cmdlets[0].cmdlet | Should -Be 'Set-CsTeamsMeetingPolicy' + $script:Definition.remediate.cmdlets[0].params.ExternalBotAccessMode | Should -Be '%ExternalBotAccessMode%' + } + + It 'omits the parameter from expected and params when blank' { + $Variables = [PSCustomObject]@{ ExternalBotAccessMode = '' } + (Invoke-Render $script:Definition.expected $Variables).PSObject.Properties.Name | Should -Not -Contain 'ExternalBotAccessMode' + (Invoke-Render $script:Definition.remediate.cmdlets[0].params $Variables).PSObject.Properties.Name | Should -Not -Contain 'ExternalBotAccessMode' + } + + It 'includes the chosen value in expected and params' { + $Variables = [PSCustomObject]@{ ExternalBotAccessMode = 'AllowAllBots' } + (Invoke-Render $script:Definition.expected $Variables).ExternalBotAccessMode | Should -Be 'AllowAllBots' + (Invoke-Render $script:Definition.remediate.cmdlets[0].params $Variables).ExternalBotAccessMode | Should -Be 'AllowAllBots' + } +} diff --git a/backend/Tests/Build/Build-OpenApi.Tests.ps1 b/backend/Tests/Build/Build-OpenApi.Tests.ps1 index 9fe1549f01..926894bb64 100644 --- a/backend/Tests/Build/Build-OpenApi.Tests.ps1 +++ b/backend/Tests/Build/Build-OpenApi.Tests.ps1 @@ -170,6 +170,24 @@ function Invoke-ListThings { Body = @($Tenant, $Filter) }) } +'@ + + # Status comes from the bulk helper, never spelled out as [HttpStatusCode]::MultiStatus. + Set-Content -Path (Join-Path $FixtureRoot 'Invoke-ExecFixtureBulk.ps1') -Value @' +function Invoke-ExecFixtureBulk { + <# + .FUNCTIONALITY + Entrypoint + .ROLE + Identity.User.ReadWrite + #> + param($Request, $TriggerMetadata) + $Users = $Request.Body.users + return ([HttpResponseContext]@{ + StatusCode = Get-CippBulkStatusCode -Total $Users.Count -Failed 0 + Body = @{ 'Results' = 'done' } + }) +} '@ # Not an endpoint: no Entrypoint marker. @@ -473,6 +491,13 @@ Describe 'responses' { # ExecAliased has no BadRequest path $script:Spec.paths['/api/ExecAliased'].post.responses.Keys | Should -Not -Contain '400' } + + It 'documents 207 and 500 for an endpoint whose status comes from Get-CippBulkStatusCode' { + $Responses = $script:Spec.paths['/api/ExecFixtureBulk'].post.responses + $Responses.Keys | Should -Contain '207' + $Responses.Keys | Should -Contain '500' + $Responses.'207'.description | Should -Not -Be 'MultiStatus' + } } Describe 'response records from frontend columns' { diff --git a/backend/Tests/Endpoint/Get-CIPPTempFileScan.Tests.ps1 b/backend/Tests/Endpoint/Get-CIPPTempFileScan.Tests.ps1 new file mode 100644 index 0000000000..a5daeff6ea --- /dev/null +++ b/backend/Tests/Endpoint/Get-CIPPTempFileScan.Tests.ps1 @@ -0,0 +1,128 @@ +# Pester tests for the Temp File Cleanup scan engine. +# Focus: delta-based enumeration (large-folder performance), classifier rules, and the +# graceful fallback to recursive scanning when delta fails. + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot) + $GraphDir = Join-Path $RepoRoot 'Modules/CIPPCore/Public/GraphHelper' + + function New-GraphGetRequest { param($uri, $tenantid, $AsApp, $NoAuthCheck, $scope, $ComplexFilter) } + + . (Join-Path $GraphDir 'Test-CIPPTempFileMatch.ps1') + . (Join-Path $GraphDir 'Get-CIPPDriveTempFile.ps1') + . (Join-Path $GraphDir 'Get-TempFilesRecursive.ps1') + . (Join-Path $GraphDir 'Get-CIPPTempFileScan.ps1') + + $script:AllFilters = [PSCustomObject]@{ + officeTemp = $true + tempFiles = $true + zeroByteFiles = $true + systemJunk = $true + backupFiles = $true + } + + function New-DeltaListing { + @( + [PSCustomObject]@{ id = 'root'; name = 'root'; folder = @{ childCount = 3 }; file = $null; parentReference = @{}; size = 0 } + [PSCustomObject]@{ id = 'folderA'; name = 'Folder A'; folder = @{ childCount = 2 }; file = $null; parentReference = @{ path = '/drives/D/root:' }; size = 0 } + [PSCustomObject]@{ id = 'office'; name = '~$report.docx'; file = @{ mimeType = 'application/msword' }; folder = $null; parentReference = @{ path = '/drives/D/root:/Folder A' }; size = 1024; webUrl = 'https://c/o'; lastModifiedDateTime = '2024-01-01T00:00:00Z' } + [PSCustomObject]@{ id = 'tmp'; name = 'data.TMP'; file = @{ mimeType = 'application/octet-stream' }; folder = $null; parentReference = @{ path = '/drive/root:' }; size = 2048; webUrl = 'https://c/t'; lastModifiedDateTime = '2024-01-01T00:00:00Z' } + [PSCustomObject]@{ id = 'zero'; name = 'empty.dat'; file = @{ mimeType = 'application/octet-stream' }; folder = $null; parentReference = @{ path = '/drive/root:/Folder A' }; size = 0; webUrl = 'https://c/z'; lastModifiedDateTime = '2024-01-01T00:00:00Z' } + [PSCustomObject]@{ id = 'junk'; name = 'Thumbs.db'; file = @{ mimeType = 'application/octet-stream' }; folder = $null; parentReference = @{ path = '/drive/root:' }; size = 50; webUrl = 'https://c/j'; lastModifiedDateTime = '2024-01-01T00:00:00Z' } + [PSCustomObject]@{ id = 'keep'; name = 'keep.docx'; file = @{ mimeType = 'application/msword' }; folder = $null; parentReference = @{ path = '/drive/root:' }; size = 100; webUrl = 'https://c/k'; lastModifiedDateTime = '2024-01-01T00:00:00Z' } + [PSCustomObject]@{ id = 'gone'; name = 'old.TMP'; file = @{ mimeType = 'application/octet-stream' }; folder = $null; parentReference = @{ path = '/drive/root:' }; size = 10; deleted = @{ state = 'deleted' } } + ) + } +} + +Describe 'Test-CIPPTempFileMatch' { + It 'detects Office lock/temp files' { + $m = Test-CIPPTempFileMatch -Item ([PSCustomObject]@{ name = '~$book.xlsx'; size = 10 }) -Filters $script:AllFilters + $m | Should -Contain 'officeTemp' + } + It 'detects .TMP/.temp files case-insensitively' { + (Test-CIPPTempFileMatch -Item ([PSCustomObject]@{ name = 'x.tmp'; size = 1 }) -Filters $script:AllFilters) | Should -Contain 'tempFiles' + (Test-CIPPTempFileMatch -Item ([PSCustomObject]@{ name = 'x.TEMP'; size = 1 }) -Filters $script:AllFilters) | Should -Contain 'tempFiles' + } + It 'detects zero-byte files' { + (Test-CIPPTempFileMatch -Item ([PSCustomObject]@{ name = 'a.bin'; size = 0 }) -Filters $script:AllFilters) | Should -Contain 'zeroByteFiles' + } + It 'detects system junk' { + (Test-CIPPTempFileMatch -Item ([PSCustomObject]@{ name = '.DS_Store'; size = 5 }) -Filters $script:AllFilters) | Should -Contain 'systemJunk' + } + It 'respects disabled filters' { + $f = [PSCustomObject]@{ officeTemp = $false; tempFiles = $false; zeroByteFiles = $false; systemJunk = $false; backupFiles = $false } + @(Test-CIPPTempFileMatch -Item ([PSCustomObject]@{ name = 'x.tmp'; size = 0 }) -Filters $f) | Should -BeNullOrEmpty + } + It 'returns empty for a normal file' { + @(Test-CIPPTempFileMatch -Item ([PSCustomObject]@{ name = 'report.docx'; size = 100 }) -Filters $script:AllFilters) | Should -BeNullOrEmpty + } +} + +Describe 'Get-CIPPDriveTempFile' { + BeforeEach { + Mock New-GraphGetRequest { @() } + Mock New-GraphGetRequest -ParameterFilter { $uri -match 'root/delta' } -MockWith { New-DeltaListing } + } + + It 'enumerates the whole drive in a single delta call' { + $r = @(Get-CIPPDriveTempFile -TenantFilter 't' -DriveId 'D' -Filters $script:AllFilters) + Should -Invoke New-GraphGetRequest -Times 1 -ParameterFilter { $uri -match 'root/delta' } + } + + It 'returns only matching files and skips folders, normal files, and deleted items' { + $r = @(Get-CIPPDriveTempFile -TenantFilter 't' -DriveId 'D' -Filters $script:AllFilters) + $r.Count | Should -Be 4 + $r.name | Should -Not -Contain 'keep.docx' + $r.name | Should -Not -Contain 'old.TMP' + $r.name | Should -Not -Contain 'Folder A' + } + + It 'reconstructs library-relative paths for both path prefixes' { + $r = @(Get-CIPPDriveTempFile -TenantFilter 't' -DriveId 'D' -Filters $script:AllFilters) + ($r | Where-Object { $_.name -eq '~$report.docx' }).path | Should -Be '/Folder A/~$report.docx' + ($r | Where-Object { $_.name -eq 'data.TMP' }).path | Should -Be '/data.TMP' + } + + It 'returns nothing when all filters are disabled' { + $f = [PSCustomObject]@{ officeTemp = $false; tempFiles = $false; zeroByteFiles = $false; systemJunk = $false; backupFiles = $false } + @(Get-CIPPDriveTempFile -TenantFilter 't' -DriveId 'D' -Filters $f) | Should -BeNullOrEmpty + Should -Invoke New-GraphGetRequest -Times 0 -ParameterFilter { $uri -match 'root/delta' } + } +} + +Describe 'Get-CIPPTempFileScan' { + BeforeEach { + Mock New-GraphGetRequest { @() } + Mock New-GraphGetRequest -ParameterFilter { $uri -match '/sites/S$' } -MockWith { + [PSCustomObject]@{ id = 'S'; displayName = 'Marketing'; webUrl = 'https://c/sites/m' } + } + Mock New-GraphGetRequest -ParameterFilter { $uri -match '/sites/S/drive$' } -MockWith { + [PSCustomObject]@{ id = 'D'; webUrl = 'https://c/sites/m/drive' } + } + Mock New-GraphGetRequest -ParameterFilter { $uri -match 'root/delta' } -MockWith { New-DeltaListing } + } + + It 'scans a site via delta and aggregates results with site metadata' { + $r = Get-CIPPTempFileScan -TenantFilter 't' -Scope 'site' -SiteId 'S' -Filters $script:AllFilters + $r.TotalCount | Should -Be 4 + ($r.Results | Select-Object -First 1).SiteName | Should -Be 'Marketing' + Should -Invoke New-GraphGetRequest -Times 1 -ParameterFilter { $uri -match 'root/delta' } + } + + It 'falls back to recursive scanning when delta fails' { + Mock Get-CIPPDriveTempFile { throw 'delta unavailable' } + Mock Get-TempFilesRecursive { @(@{ id = 'r1'; name = 'fallback.tmp'; size = 5; type = 'tempFiles'; matchTypes = @('tempFiles') }) } + $r = Get-CIPPTempFileScan -TenantFilter 't' -Scope 'site' -SiteId 'S' -Filters $script:AllFilters + Should -Invoke Get-TempFilesRecursive -Times 1 + $r.TotalCount | Should -Be 1 + ($r.Results | Select-Object -First 1).name | Should -Be 'fallback.tmp' + } + + It 'continues when both delta and recursive scans fail for a drive' { + Mock Get-CIPPDriveTempFile { throw 'delta unavailable' } + Mock Get-TempFilesRecursive { throw 'recursive failed too' } + $r = Get-CIPPTempFileScan -TenantFilter 't' -Scope 'site' -SiteId 'S' -Filters $script:AllFilters + $r.TotalCount | Should -Be 0 + } +} diff --git a/backend/Tests/Endpoint/Invoke-AddPIMRoleSettingsTemplate.Tests.ps1 b/backend/Tests/Endpoint/Invoke-AddPIMRoleSettingsTemplate.Tests.ps1 index 71a2386045..c0e053b7d4 100644 --- a/backend/Tests/Endpoint/Invoke-AddPIMRoleSettingsTemplate.Tests.ps1 +++ b/backend/Tests/Endpoint/Invoke-AddPIMRoleSettingsTemplate.Tests.ps1 @@ -196,10 +196,10 @@ Describe 'Invoke-AddPIMRoleSettingsTemplate' { Should -Invoke Write-LogMessage -Times 3 -ParameterFilter { $Sev -eq 'Warning' -and $message -match 'raised to the secure floor' } } - It 'returns 400 when the role has no PIM policy in the tenant' { + It 'returns 404 when the role has no PIM policy in the tenant' { Mock Get-CIPPPIMRolePolicies { @() } $Response = Invoke-AddPIMRoleSettingsTemplate -Request (New-TemplateRequest -Body $script:CaptureBody) - $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest) + $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::NotFound) ($Response.Body.Results -join ' ') | Should -Match 'No PIM role management policy' Should -Invoke Add-CIPPAzDataTableEntity -Times 0 -Exactly } diff --git a/backend/Tests/Endpoint/Invoke-ExecApiClient.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExecApiClient.Tests.ps1 index 34fdaf9f20..3492401b4c 100644 --- a/backend/Tests/Endpoint/Invoke-ExecApiClient.Tests.ps1 +++ b/backend/Tests/Endpoint/Invoke-ExecApiClient.Tests.ps1 @@ -2,7 +2,7 @@ # # Split-app model: an MCPAllowed API client is an OAuth *client* (the app a connector signs in as), # and the dedicated CIPP-MCP app is the shared resource. Several MCPAllowed clients may coexist, each -# with its own role/IP/redirects/CA, so saving one must NOT clear MCP Access on the others. Enabling +# with its own redirects, so saving one must NOT clear MCP Access on the others. Enabling # MCP on a client configures it via Set-CIPPMCPClientApp. BeforeAll { diff --git a/backend/Tests/Endpoint/Invoke-ExecBECRemediate.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExecBECRemediate.Tests.ps1 index d644f1f7de..3f8dd49fd9 100644 --- a/backend/Tests/Endpoint/Invoke-ExecBECRemediate.Tests.ps1 +++ b/backend/Tests/Endpoint/Invoke-ExecBECRemediate.Tests.ps1 @@ -36,7 +36,9 @@ Describe 'Invoke-ExecBECRemediate' { $Response = Invoke-ExecBECRemediate -Request (New-Request @{ tenantFilter = 'contoso.com'; userid = 'u1'; username = 'victim@contoso.com'; Confirmation = 'Victim@Contoso.com' }) -TriggerMetadata $null $Response.StatusCode | Should -Be 200 $Response.Body.Results[0].state | Should -Be 'success' - Should -Invoke Invoke-CIPPBecContainment -Times 1 -ParameterFilter { $Confirmed.IsPresent -and @($Actions).Count -eq 0 -and $UserPrincipalName -eq 'victim@contoso.com' } + Should -Invoke Invoke-CIPPBecContainment -Times 1 -ParameterFilter { $Confirmed.IsPresent -and $Actions -contains 'ResetPassword' -and $Actions -notcontains 'DisableInboxRules' -and $UserPrincipalName -eq 'victim@contoso.com' } + Should -Invoke Start-CIPPBecContainmentJob -Times 1 -ParameterFilter { @($Actions) -join ',' -eq 'DisableInboxRules' } + ($Response.Body.Results | Where-Object { $_.Action -eq 'DisableInboxRules' }).resultText | Should -Match 'queued for background processing' } It 'returns 400 and runs nothing when a Critical action is selected without the typed UPN' { diff --git a/backend/Tests/Endpoint/Invoke-ExecEmptySiteRecycleBin.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExecEmptySiteRecycleBin.Tests.ps1 index 7cf4917211..ae745970e7 100644 --- a/backend/Tests/Endpoint/Invoke-ExecEmptySiteRecycleBin.Tests.ps1 +++ b/backend/Tests/Endpoint/Invoke-ExecEmptySiteRecycleBin.Tests.ps1 @@ -29,6 +29,7 @@ BeforeAll { } function Write-LogMessage { param($Headers, $API, $tenant, $message, $sev, $LogData) } function Get-CippException { param($Exception) [PSCustomObject]@{ NormalizedError = $Exception.Message } } + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CippBulkStatusCode.ps1') . $ExecPath . $SummaryPath @@ -37,6 +38,11 @@ BeforeAll { Describe 'Invoke-ExecEmptySiteRecycleBin' { BeforeEach { $script:GraphPostCalls = 0 + $script:GraphGetCalls = 0 + $script:RecycleBinItems = @( + [PSCustomObject]@{ Id = '1'; Size = 100; ItemState = 1 } + [PSCustomObject]@{ Id = '2'; Size = 200; ItemState = 1 } + ) function global:New-GraphPostRequest { param( $uri, $tenantid, $scope, $type, $body, $contentType, $AddedHeaders, @@ -44,6 +50,9 @@ Describe 'Invoke-ExecEmptySiteRecycleBin' { $AsApp ) $script:GraphPostCalls++ + if ($uri -like '*deleteAll*') { + $script:RecycleBinItems = @() + } } function global:New-GraphGetRequest { param( @@ -52,6 +61,10 @@ Describe 'Invoke-ExecEmptySiteRecycleBin' { [bool]$noPagination, [switch]$SkipValueExtraction ) + $script:GraphGetCalls++ + [PSCustomObject]@{ + value = @($script:RecycleBinItems) + } } } @@ -80,25 +93,54 @@ Describe 'Invoke-ExecEmptySiteRecycleBin' { $Response.Body.Results | Should -Match 'Invalid Stage' } - It 'calls deleteAll endpoints for Both' { + It 'verifies deletion and returns accurate counts' { + $Response = Invoke-ExecEmptySiteRecycleBin -Request ([pscustomobject]@{ + Params = @{ CIPPEndpoint = 'ExecEmptySiteRecycleBin' } + Headers = @{} + Body = [pscustomobject]@{ + tenantFilter = 'contoso.onmicrosoft.com' + SiteUrl = 'https://contoso.sharepoint.com/sites/a' + Stage = 'First' + } + }) + + $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK) + $script:GraphGetCalls | Should -BeGreaterThan 0 + $Response.Body.itemsBefore | Should -Be 2 + $Response.Body.itemsDeleted | Should -Be 2 + $Response.Body.itemsRemaining | Should -Be 0 + $Response.Body.bytesFreed | Should -Be 300 + $Response.Body.Results | Should -Match 'Successfully emptied' + } + + It 'reports partial success when items remain' { + $script:RecycleBinItems = @( + [PSCustomObject]@{ Id = '1'; Size = 100; ItemState = 1 } + ) + function global:New-GraphPostRequest { + param($uri, $tenantid, $scope, $type, $body, $contentType, $AddedHeaders, [switch]$UseCertificate, $AsApp) + $script:GraphPostCalls++ + } + $Response = Invoke-ExecEmptySiteRecycleBin -Request ([pscustomobject]@{ Params = @{ CIPPEndpoint = 'ExecEmptySiteRecycleBin' } Headers = @{} Body = [pscustomobject]@{ tenantFilter = 'contoso.onmicrosoft.com' SiteUrl = 'https://contoso.sharepoint.com/sites/a' - Stage = 'Both' + Stage = 'First' } }) $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK) - $script:GraphPostCalls | Should -Be 2 - $Response.Body.Results | Should -Match 'Emptied recycle bin' + $Response.Body.itemsRemaining | Should -BeGreaterThan 0 + $Response.Body.Results | Should -Match 'may be held by retention policy' } } Describe 'Invoke-ListSiteRecycleBinSummary' { BeforeEach { + $script:GetRequestCount = 0 function global:New-GraphGetRequest { param( $uri, $tenantid, $scope, $AsApp, $extraHeaders, @@ -106,12 +148,18 @@ Describe 'Invoke-ListSiteRecycleBinSummary' { [bool]$noPagination, [switch]$SkipValueExtraction ) - [PSCustomObject]@{ - value = @( - [PSCustomObject]@{ Id = '1'; Size = 100; ItemState = 1 } - [PSCustomObject]@{ Id = '2'; Size = 50; ItemState = 2 } - ) - '@odata.nextLink' = $null + $script:GetRequestCount++ + if ($uri -match '\$skip=0') { + [PSCustomObject]@{ + value = @( + [PSCustomObject]@{ Id = '1'; Size = 100; ItemState = 1 } + [PSCustomObject]@{ Id = '2'; Size = 50; ItemState = 2 } + ) + } + } else { + [PSCustomObject]@{ + value = @() + } } } } @@ -145,4 +193,40 @@ Describe 'Invoke-ListSiteRecycleBinSummary' { ($Response.Body.Results.PSObject.Properties.Name -contains 'Title') | Should -BeFalse ($Response.Body.Results.PSObject.Properties.Name -contains 'LeafName') | Should -BeFalse } + + It 'uses skip-based pagination beyond first page' { + $script:GetRequestCount = 0 + $script:RequestUris = @() + function global:New-GraphGetRequest { + param($uri, $tenantid, $scope, $AsApp, $extraHeaders, [switch]$UseCertificate, [bool]$noPagination, [switch]$SkipValueExtraction) + $script:GetRequestCount++ + $script:RequestUris += $uri + + if ($uri -match '\$skip=0') { + $Items = 1..500 | ForEach-Object { [PSCustomObject]@{ Id = $_; Size = 100; ItemState = 1 } } + [PSCustomObject]@{ value = @($Items) } + } elseif ($uri -match '\$skip=500') { + $Items = 501..550 | ForEach-Object { [PSCustomObject]@{ Id = $_; Size = 100; ItemState = 1 } } + [PSCustomObject]@{ value = @($Items) } + } else { + [PSCustomObject]@{ value = @() } + } + } + + $Response = Invoke-ListSiteRecycleBinSummary -Request ([pscustomobject]@{ + Params = @{ CIPPEndpoint = 'ListSiteRecycleBinSummary' } + Headers = @{} + Query = @{ + tenantFilter = 'contoso.onmicrosoft.com' + SiteUrl = 'https://contoso.sharepoint.com/sites/a' + MaxItems = 600 + } + Body = @{} + }) + + $script:GetRequestCount | Should -BeGreaterThan 1 + $Response.Body.Results.itemCount | Should -Be 550 + $Response.Body.Results.capped | Should -BeFalse + ($script:RequestUris | Where-Object { $_ -match '\$skip=500' }).Count | Should -BeGreaterThan 0 + } } diff --git a/backend/Tests/Endpoint/Invoke-ExecJITAdmin.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExecJITAdmin.Tests.ps1 new file mode 100644 index 0000000000..f3c0171686 --- /dev/null +++ b/backend/Tests/Endpoint/Invoke-ExecJITAdmin.Tests.ps1 @@ -0,0 +1,123 @@ +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + class HttpResponseContext { [int]$StatusCode; [object]$Body } + $TypeAccelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators') + if (-not ([System.Management.Automation.PSTypeName]'HttpStatusCode').Type) { + $TypeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode]) + } + function Get-CippTable { param($tablename) @{ TableName = $tablename } } + function Get-CIPPAzDataTableEntity { param($TableName, $Filter) } + function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) } + function Get-CIPPJITAdminAllowedRoles { param($Headers) [pscustomobject]@{ Restricted = $false } } + function Add-CIPPScheduledTask { param($Task, $hidden, [switch]$RunNow) } + function Set-CIPPUserJITAdmin { param($TenantFilter, $User, $Roles, $Groups, $Action, $Expiration, $StartDate, $Reason, $Headers, $APIName) } + function Set-CIPPUserJITAdminProperties { param($TenantFilter, $UserId, $Expiration, $StartDate, $Reason, $CreatedBy) } + function Get-CIPPJITAdminApprovalRequirement { param($Roles) } + function Add-CIPPAzDataTableEntity { param($TableName, $Entity, [switch]$Force) } + function Update-AzDataTableEntity { param($TableName, $Entity) } + function Send-CIPPJITAdminApprovalNotification { param($ApprovalRequest, $Status, $Note, $Results) } + . (Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ExecJITAdmin.ps1' | Select-Object -First 1).FullName + + function New-Request { + param([int]$StartOffsetSeconds) + $Now = [DateTimeOffset]::UtcNow + $Principal = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('{"userDetails":"admin@contoso.com"}')) + [pscustomobject]@{ + Params = [pscustomobject]@{ CIPPEndpoint = 'ExecJITAdmin' } + Headers = @{ 'x-ms-client-principal' = $Principal } + Body = [pscustomobject]@{ + tenantFilter = 'contoso.com' + userAction = 'existing' + existingUser = [pscustomobject]@{ value = 'jit@contoso.com' } + AdminRoles = @([pscustomobject]@{ value = '62e90394-69f5-4237-9190-012177145e10' }) + ExpireAction = [pscustomobject]@{ value = 'RemoveRoles' } + Reason = 'Break glass' + StartDate = $Now.AddSeconds($StartOffsetSeconds).ToUnixTimeSeconds() + EndDate = $Now.AddDays(1).ToUnixTimeSeconds() + PostExecution = @([pscustomobject]@{ value = 'webhook' }, [pscustomobject]@{ value = 'Push' }) + } + } + } +} + +Describe 'Invoke-ExecJITAdmin enable scheduling' { + BeforeEach { + Mock Add-CIPPScheduledTask { } + Mock Set-CIPPUserJITAdmin { } + Mock Set-CIPPUserJITAdminProperties { } + } + + It 'queues the enable task to run now with the requested notification channels when the start is immediate' { + $Response = Invoke-ExecJITAdmin -Request (New-Request -StartOffsetSeconds 0) -TriggerMetadata $null + $Response.StatusCode | Should -Be 200 + Should -Invoke Set-CIPPUserJITAdmin -Times 0 + Should -Invoke Add-CIPPScheduledTask -Times 1 -ParameterFilter { + $RunNow -and $Task.Name -like 'JIT Admin (enable)*' -and $Task.PostExecution.Webhook -and $Task.PostExecution.Push -and -not $Task.PostExecution.Email + } + Should -Invoke Add-CIPPScheduledTask -Times 1 -ParameterFilter { -not $RunNow -and $Task.Name -like 'JIT Admin (RemoveRoles)*' } + } + + It 'keeps a future start as a scheduled enable task plus the disable task' { + $Response = Invoke-ExecJITAdmin -Request (New-Request -StartOffsetSeconds 3600) -TriggerMetadata $null + $Response.StatusCode | Should -Be 200 + Should -Invoke Set-CIPPUserJITAdmin -Times 0 + Should -Invoke Set-CIPPUserJITAdminProperties -Times 1 + Should -Invoke Add-CIPPScheduledTask -Times 1 -ParameterFilter { -not $RunNow -and $Task.Name -like 'JIT Admin (enable)*' } + Should -Invoke Add-CIPPScheduledTask -Times 1 -ParameterFilter { -not $RunNow -and $Task.Name -like 'JIT Admin (RemoveRoles)*' } + Should -Invoke Add-CIPPScheduledTask -Times 2 + } +} + +Describe 'Invoke-ExecJITAdmin approval' { + BeforeEach { + Mock Add-CIPPScheduledTask { } + Mock Set-CIPPUserJITAdminProperties { } + Mock Add-CIPPAzDataTableEntity { } + Mock Update-AzDataTableEntity { } + Mock Send-CIPPJITAdminApprovalNotification { } + } + + It 'stores a pending request and notifies instead of provisioning when approval is required' { + Mock Get-CIPPJITAdminApprovalRequirement { [pscustomobject]@{ ApproverRoles = @('admin'); RequiredApprovals = 2 } } + $Response = Invoke-ExecJITAdmin -Request (New-Request -StartOffsetSeconds 3600) -TriggerMetadata $null + $Response.StatusCode | Should -Be 200 + $Response.Body.Results[0] | Should -BeLike '*submitted for approval*' + Should -Invoke Add-CIPPAzDataTableEntity -Times 1 -ParameterFilter { + $Entity.State -eq 'Pending' -and $Entity.RequestedBy -eq 'admin@contoso.com' -and $Entity.RequiredApprovals -eq 2 -and + $Entity.RoleIds -eq '["62e90394-69f5-4237-9190-012177145e10"]' -and $Entity.ApproverRoles -eq '["admin"]' + } + Should -Invoke Send-CIPPJITAdminApprovalNotification -Times 1 -ParameterFilter { $Status -eq 'Requested' } + Should -Invoke Add-CIPPScheduledTask -Times 0 + Should -Invoke Set-CIPPUserJITAdminProperties -Times 0 + } + + It 'provisions the stored request body, not the posted one, once approved' { + Mock Get-CIPPJITAdminApprovalRequirement { [pscustomobject]@{ ApproverRoles = @('admin'); RequiredApprovals = 1 } } + $Stored = New-Request -StartOffsetSeconds 0 + Mock Get-CIPPAzDataTableEntity -ParameterFilter { $Filter -like "*JITAdminRequest*" } { + [pscustomobject]@{ PartitionKey = 'JITAdminRequest'; RowKey = '11111111-1111-1111-1111-111111111111'; State = 'Approved'; RequestedBy = 'admin@contoso.com'; ETag = '1'; RequestBody = ($Stored.Body | ConvertTo-Json -Depth 10) } + } + $Request = New-Request -StartOffsetSeconds 0 + $Request.Body = [pscustomobject]@{ ApprovalRequestId = '11111111-1111-1111-1111-111111111111'; AdminRoles = @([pscustomobject]@{ value = 'other-role' }) } + + $Response = Invoke-ExecJITAdmin -Request $Request -TriggerMetadata $null + $Response.StatusCode | Should -Be 200 + Should -Invoke Update-AzDataTableEntity -ParameterFilter { $Entity.State -eq 'Completed' -and $Entity.ETag -eq '1' } + Should -Invoke Add-CIPPAzDataTableEntity -Times 0 + Should -Invoke Add-CIPPScheduledTask -Times 1 -ParameterFilter { + $RunNow -and $Task.Parameters.ApprovalRequestId -eq '11111111-1111-1111-1111-111111111111' -and $Task.Parameters.Roles -contains '62e90394-69f5-4237-9190-012177145e10' + } + } + + It 'refuses a request id that is not approved' { + Mock Get-CIPPAzDataTableEntity -ParameterFilter { $Filter -like "*JITAdminRequest*" } { + [pscustomobject]@{ PartitionKey = 'JITAdminRequest'; RowKey = '11111111-1111-1111-1111-111111111111'; State = 'Pending'; RequestedBy = 'admin@contoso.com'; ETag = '1' } + } + $Request = New-Request -StartOffsetSeconds 0 + $Request.Body | Add-Member -NotePropertyName ApprovalRequestId -NotePropertyValue '11111111-1111-1111-1111-111111111111' + $Response = Invoke-ExecJITAdmin -Request $Request -TriggerMetadata $null + $Response.StatusCode | Should -Be 400 + Should -Invoke Update-AzDataTableEntity -Times 0 + Should -Invoke Add-CIPPScheduledTask -Times 0 + } +} diff --git a/backend/Tests/Endpoint/Invoke-ExecJITAdminRequestDecision.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExecJITAdminRequestDecision.Tests.ps1 new file mode 100644 index 0000000000..a7b0f00519 --- /dev/null +++ b/backend/Tests/Endpoint/Invoke-ExecJITAdminRequestDecision.Tests.ps1 @@ -0,0 +1,112 @@ +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + class HttpResponseContext { [int]$StatusCode; [object]$Body } + $TypeAccelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators') + if (-not ([System.Management.Automation.PSTypeName]'HttpStatusCode').Type) { + $TypeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode]) + } + function Get-CippTable { param($tablename) @{ TableName = $tablename } } + function Get-CIPPAzDataTableEntity { param($TableName, $Filter) } + function Update-AzDataTableEntity { param($TableName, $Entity) } + function Get-CIPPAccessRole { param($Request, $Headers) } + function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) } + function Send-CIPPJITAdminApprovalNotification { param($ApprovalRequest, $Status, $Note, $Results) } + function Invoke-ExecJITAdmin { param($Request, $TriggerMetadata) } + . (Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ExecJITAdminRequestDecision.ps1' | Select-Object -First 1).FullName + + $RequestId = '11111111-1111-1111-1111-111111111111' + + function New-DecisionRequest { + param([string]$Caller, [string]$Decision, [string]$Note) + $Principal = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes((@{ userDetails = $Caller } | ConvertTo-Json))) + [pscustomobject]@{ + Params = [pscustomobject]@{ CIPPEndpoint = 'ExecJITAdminRequestDecision' } + Headers = @{ 'x-ms-client-principal' = $Principal } + Body = [pscustomobject]@{ tenantFilter = 'contoso.com'; RequestId = $RequestId; Decision = $Decision; Note = $Note } + } + } + + function New-Row { + param([int]$RequiredApprovals = 1, [string]$Decisions = '[]') + [pscustomobject]@{ + PartitionKey = 'JITAdminRequest' + RowKey = $RequestId + ETag = '1' + State = 'Pending' + Tenant = 'contoso.com' + TargetUser = 'jit@contoso.com' + RequestedBy = 'tech@msp.com' + RequesterHeaders = '{"x-ms-client-principal":"abc"}' + ApproverRoles = '["admin","Approvers"]' + RequiredApprovals = $RequiredApprovals + Decisions = $Decisions + EndDate = [string][DateTimeOffset]::UtcNow.AddDays(1).ToUnixTimeSeconds() + } + } +} + +Describe 'Invoke-ExecJITAdminRequestDecision' { + BeforeEach { + Mock Get-CIPPAzDataTableEntity { New-Row } + Mock Get-CIPPAccessRole { @('Approvers') } + Mock Update-AzDataTableEntity { } + Mock Send-CIPPJITAdminApprovalNotification { } + Mock Invoke-ExecJITAdmin { [HttpResponseContext]@{ StatusCode = 200; Body = @{ Results = @('Queued') } } } + } + + It 'does not let the requester approve their own request' { + Mock Get-CIPPAccessRole { @('admin') } + $Response = Invoke-ExecJITAdminRequestDecision -Request (New-DecisionRequest -Caller 'tech@msp.com' -Decision 'Approve') -TriggerMetadata $null + $Response.StatusCode | Should -Be 403 + $Response.Body.Results[0] | Should -BeLike '*your own request*' + Should -Invoke Update-AzDataTableEntity -Times 0 + } + + It 'refuses a caller without an approver role' { + Mock Get-CIPPAccessRole { @('editor') } + $Response = Invoke-ExecJITAdminRequestDecision -Request (New-DecisionRequest -Caller 'other@msp.com' -Decision 'Approve') -TriggerMetadata $null + $Response.StatusCode | Should -Be 403 + Should -Invoke Update-AzDataTableEntity -Times 0 + } + + It 'requires a note to reject' { + $Response = Invoke-ExecJITAdminRequestDecision -Request (New-DecisionRequest -Caller 'boss@msp.com' -Decision 'Reject') -TriggerMetadata $null + $Response.StatusCode | Should -Be 400 + Should -Invoke Update-AzDataTableEntity -Times 0 + } + + It 'ends the request on a rejection and tells the requester' { + $Response = Invoke-ExecJITAdminRequestDecision -Request (New-DecisionRequest -Caller 'boss@msp.com' -Decision 'Reject' -Note 'Not needed') -TriggerMetadata $null + $Response.StatusCode | Should -Be 200 + Should -Invoke Update-AzDataTableEntity -Times 1 -ParameterFilter { $Entity.State -eq 'Rejected' -and $Entity.ETag -eq '1' } + Should -Invoke Send-CIPPJITAdminApprovalNotification -Times 1 -ParameterFilter { $Status -eq 'Rejected' -and $Note -eq 'Not needed' } + Should -Invoke Invoke-ExecJITAdmin -Times 0 + } + + It 'records an approval without provisioning until enough approvals are in' { + Mock Get-CIPPAzDataTableEntity { New-Row -RequiredApprovals 2 } + $Response = Invoke-ExecJITAdminRequestDecision -Request (New-DecisionRequest -Caller 'boss@msp.com' -Decision 'Approve') -TriggerMetadata $null + $Response.StatusCode | Should -Be 200 + $Response.Body.Results[0] | Should -Be 'Approval recorded (1 of 2).' + Should -Invoke Update-AzDataTableEntity -Times 1 -ParameterFilter { $Entity.State -eq 'Pending' } + Should -Invoke Invoke-ExecJITAdmin -Times 0 + } + + It 'does not count the same approver twice' { + Mock Get-CIPPAzDataTableEntity { New-Row -RequiredApprovals 2 -Decisions '[{"By":"boss@msp.com","Decision":"Approve"}]' } + $Response = Invoke-ExecJITAdminRequestDecision -Request (New-DecisionRequest -Caller 'boss@msp.com' -Decision 'Approve') -TriggerMetadata $null + $Response.StatusCode | Should -Be 400 + Should -Invoke Invoke-ExecJITAdmin -Times 0 + } + + It 'provisions as the requester once the last approval is in' { + Mock Get-CIPPAzDataTableEntity { New-Row -RequiredApprovals 2 -Decisions '[{"By":"boss@msp.com","Decision":"Approve"}]' } + $Response = Invoke-ExecJITAdminRequestDecision -Request (New-DecisionRequest -Caller 'second@msp.com' -Decision 'Approve') -TriggerMetadata $null + $Response.StatusCode | Should -Be 200 + Should -Invoke Update-AzDataTableEntity -ParameterFilter { $Entity.State -eq 'Approved' -and $Entity.ETag -eq '1' } + Should -Invoke Invoke-ExecJITAdmin -Times 1 -ParameterFilter { + $Request.Body.ApprovalRequestId -eq $RequestId -and $Request.Headers.'x-ms-client-principal' -eq 'abc' + } + Should -Invoke Send-CIPPJITAdminApprovalNotification -Times 1 -ParameterFilter { $Status -eq 'Approved' } + } +} diff --git a/backend/Tests/Endpoint/Invoke-ExecJITAdminSettings.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExecJITAdminSettings.Tests.ps1 new file mode 100644 index 0000000000..bf8503ef64 --- /dev/null +++ b/backend/Tests/Endpoint/Invoke-ExecJITAdminSettings.Tests.ps1 @@ -0,0 +1,35 @@ +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + class HttpResponseContext { [int]$StatusCode; [object]$Body } + $TypeAccelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators') + if (-not ([System.Management.Automation.PSTypeName]'HttpStatusCode').Type) { + $TypeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode]) + } + function Get-CippTable { param($TableName) @{ TableName = $TableName } } + function Get-CIPPAzDataTableEntity { param($TableName, $Filter) } + function Add-CIPPAzDataTableEntity { param($TableName, $Entity, [switch]$Force) } + function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) } + . (Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ExecJITAdminSettings.ps1' | Select-Object -First 1).FullName +} + +Describe 'Invoke-ExecJITAdminSettings Set' { + It 'saves with no maximum duration over a stored row, which has no MaxDuration column' { + Mock Get-CIPPAzDataTableEntity { [pscustomobject]@{ PartitionKey = 'JITAdminSettings'; RowKey = 'JITAdminSettings'; RequireApproval = $true } } + Mock Add-CIPPAzDataTableEntity { } + $Request = [pscustomobject]@{ + Params = [pscustomobject]@{ CIPPEndpoint = 'ExecJITAdminSettings' } + Headers = @{} + Body = [pscustomobject]@{ + Action = 'Set' + MaxDuration = $null + RequireApproval = $true + ApprovalTriggerRoles = @() + ApproverRoles = @([pscustomobject]@{ value = 'superadmin' }) + RequiredApprovals = 2 + } + } + $Response = Invoke-ExecJITAdminSettings -Request $Request + "$($Response.Body.Results)" | Should -Not -BeLike 'Error*' + Should -Invoke Add-CIPPAzDataTableEntity -Times 1 -Exactly -ParameterFilter { $Entity.RequiredApprovals -eq 2 -and $null -eq $Entity.MaxDuration } + } +} diff --git a/backend/Tests/Endpoint/Invoke-ExecMailboxSafeSender.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExecMailboxSafeSender.Tests.ps1 new file mode 100644 index 0000000000..31aab543cb --- /dev/null +++ b/backend/Tests/Endpoint/Invoke-ExecMailboxSafeSender.Tests.ps1 @@ -0,0 +1,45 @@ +# Pester tests for Invoke-ExecMailboxSafeSender response shape + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $FunctionPath = Join-Path $RepoRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecMailboxSafeSender.ps1' + $ToolsDir = Join-Path $RepoRoot 'Modules/CIPPCore/Public/Tools' + + class HttpResponseContext { + [int]$StatusCode + [object]$Body + } + + Add-Type -AssemblyName System.Net.Primitives + Add-Type -AssemblyName System.Net.Http + $typeAccelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators') + if (-not $typeAccelerators::Get.Keys.Contains('HttpStatusCode')) { + $typeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode]) + } + + function Write-LogMessage { param($headers, $API, $message, $sev) } + function Get-CippException { param($Exception) @{ NormalizedError = $Exception.Message } } + function New-ExoRequest { param($tenantid, $cmdlet, $cmdParams) $true } + + Get-ChildItem -Path $ToolsDir -Filter '*Quarantine*.ps1' | ForEach-Object { . $_.FullName } + . $FunctionPath +} + +Describe 'Invoke-ExecMailboxSafeSender' { + It 'returns a success Results message when mailbox and sender are provided' { + $request = [pscustomobject]@{ + Params = @{ CIPPEndpoint = 'ExecMailboxSafeSender' } + Headers = @{} + Body = @{ + tenantFilter = 'contoso.onmicrosoft.com' + mailbox = 'user@contoso.com' + sender = 'sender@example.com' + } + } + + $response = Invoke-ExecMailboxSafeSender -Request $request -TriggerMetadata $null + + $response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK) + $response.Body.Results | Should -Match 'Added sender@example.com' + } +} diff --git a/backend/Tests/Endpoint/Invoke-ExecModifyMBPerms.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExecModifyMBPerms.Tests.ps1 index cf12187b65..1e504a0255 100644 --- a/backend/Tests/Endpoint/Invoke-ExecModifyMBPerms.Tests.ps1 +++ b/backend/Tests/Endpoint/Invoke-ExecModifyMBPerms.Tests.ps1 @@ -38,6 +38,7 @@ BeforeAll { . $PermissionFunctionPath . $FunctionPath + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CippBulkStatusCode.ps1') # Build a request in the bulk 'mailboxRequests' shape. function New-ModifyRequest { @@ -183,6 +184,7 @@ Describe 'Invoke-ExecModifyMBPerms' { $response = Invoke-ExecModifyMBPerms -Request $req -TriggerMetadata $null ($response.Body.Results -join "`n") | Should -Match 'Error processing FullAccess for user@contoso.com on shared@contoso.com: boom' + $response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::InternalServerError) } It 'falls back to individual New-ExoRequest calls when the bulk request throws' { @@ -246,6 +248,7 @@ Describe 'Invoke-ExecModifyMBPerms' { $response = Invoke-ExecModifyMBPerms -Request $req -TriggerMetadata $null ($response.Body.Results -join "`n") | Should -Match 'Could not find user ghost@contoso.com' + $response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::MultiStatus) } } diff --git a/backend/Tests/Endpoint/Invoke-ExecOffboardUser.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExecOffboardUser.Tests.ps1 index a29f313a3b..10695f93ac 100644 --- a/backend/Tests/Endpoint/Invoke-ExecOffboardUser.Tests.ps1 +++ b/backend/Tests/Endpoint/Invoke-ExecOffboardUser.Tests.ps1 @@ -30,6 +30,7 @@ BeforeAll { function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) } . $FunctionPath + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CippBulkStatusCode.ps1') function New-OffboardRequest { param([hashtable]$Body = @{}, [string[]]$Users = @('sseck@contoso.com')) @@ -258,7 +259,7 @@ Describe 'Invoke-ExecOffboardUser' { It 'refuses a task that belongs to another tenant' { $Response = Invoke-ExecOffboardUser -Request (New-RerunRequest -Action 'Rerun' -Body @{ tenantFilter = 'other.com' }) - $Response.StatusCode | Should -Be ([HttpStatusCode]::BadRequest) + $Response.StatusCode | Should -Be ([HttpStatusCode]::NotFound) Should -Invoke Add-CIPPScheduledTask -Times 0 -Exactly } @@ -267,7 +268,7 @@ Describe 'Invoke-ExecOffboardUser' { $Response = Invoke-ExecOffboardUser -Request (New-RerunRequest -Action 'RerunStep' -Body @{ StepIndex = 1 }) - $Response.StatusCode | Should -Be ([HttpStatusCode]::BadRequest) + $Response.StatusCode | Should -Be ([HttpStatusCode]::NotFound) Should -Invoke Add-CIPPScheduledTask -Times 0 -Exactly } } @@ -292,7 +293,7 @@ Describe 'Invoke-ExecOffboardUser' { $Response = Invoke-ExecOffboardUser -Request $Request Should -Invoke Add-CIPPScheduledTask -Times 3 -Exactly - $Response.StatusCode | Should -Be ([HttpStatusCode]::Forbidden) + $Response.StatusCode | Should -Be ([HttpStatusCode]::MultiStatus) $Response.Body.Results | Should -Contain 'scheduler unavailable' } } diff --git a/backend/Tests/Endpoint/Invoke-ExecOneDriveShortCut.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExecOneDriveShortCut.Tests.ps1 index e9e2116044..b40233888d 100644 --- a/backend/Tests/Endpoint/Invoke-ExecOneDriveShortCut.Tests.ps1 +++ b/backend/Tests/Endpoint/Invoke-ExecOneDriveShortCut.Tests.ps1 @@ -5,8 +5,9 @@ BeforeAll { if (-not ([System.Management.Automation.PSTypeName]'HttpStatusCode').Type) { $TypeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode]) } - function New-CIPPOneDriveShortCut { param($Username, $UserId, $URL, $TenantFilter, $APIName, $Headers, $Destination) } + function New-CIPPOneDriveShortCut { param($Username, $UserId, $URL, $TenantFilter, $APIName, $Headers, $Destination, $ShortcutName) } . (Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ExecOneDriveShortCut.ps1' | Select-Object -First 1).FullName + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CippBulkStatusCode.ps1') function New-Request { param($Body) @@ -43,7 +44,7 @@ Describe 'Invoke-ExecOneDriveShortCut' { $Body = @((New-Entry 'one@contoso.com'), (New-Entry 'two@contoso.com'), (New-Entry 'three@contoso.com')) $Response = Invoke-ExecOneDriveShortCut -Request (New-Request -Body $Body) -TriggerMetadata $null - $Response.StatusCode | Should -Be 200 + $Response.StatusCode | Should -Be 207 Should -Invoke New-CIPPOneDriveShortCut -Times 3 -Exactly $Results = @($Response.Body.Results) $Results.Count | Should -Be 4 @@ -78,6 +79,16 @@ Describe 'Invoke-ExecOneDriveShortCut' { $Results[0].resultText | Should -Match 'one@contoso.com' } + It 'passes shortcutName through, and an empty string when absent' { + $Named = New-Entry 'one@contoso.com' + $Named | Add-Member -NotePropertyName shortcutName -NotePropertyValue 'Team Docs' + $null = Invoke-ExecOneDriveShortCut -Request (New-Request -Body $Named) -TriggerMetadata $null + Should -Invoke New-CIPPOneDriveShortCut -Times 1 -ParameterFilter { $ShortcutName -eq 'Team Docs' } + + $null = Invoke-ExecOneDriveShortCut -Request (New-Request -Body (New-Entry 'three@contoso.com')) -TriggerMetadata $null + Should -Invoke New-CIPPOneDriveShortCut -Times 1 -ParameterFilter { $Username -eq 'three@contoso.com' -and $ShortcutName -eq '' } + } + It 'defaults a missing destination to root' { $Entry = New-Entry 'one@contoso.com' $Entry.destination = $null diff --git a/backend/Tests/Endpoint/Invoke-ExecPIMRoleAssignment.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExecPIMRoleAssignment.Tests.ps1 index 73108f933a..efd6eafef6 100644 --- a/backend/Tests/Endpoint/Invoke-ExecPIMRoleAssignment.Tests.ps1 +++ b/backend/Tests/Endpoint/Invoke-ExecPIMRoleAssignment.Tests.ps1 @@ -23,6 +23,7 @@ BeforeAll { function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) } function Get-CippException { param($Exception) @{ NormalizedError = "$Exception" } } + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CippErrorStatusCode.ps1') . $FunctionPath function New-PimRequest { @@ -152,12 +153,19 @@ Describe 'Invoke-ExecPIMRoleAssignment' { Should -Invoke Invoke-CIPPPIMAssignmentAction -Times 1 -Exactly -ParameterFilter { $Action -eq 'Remove' } } - It 'returns 400 with the refusal message when the action throws' { - Mock Invoke-CIPPPIMAssignmentAction { throw 'Refusing: last active Global Administrator' } + It 'returns 400 with the refusal message when the action refuses' { + Mock Invoke-CIPPPIMAssignmentAction { throw [System.ArgumentException]::new('Refusing: last active Global Administrator') } $Response = Invoke-ExecPIMRoleAssignment -Request (New-PimRequest @{ Action = 'Remove'; Duration = $null }) $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest) $Response.Body.Results[0].state | Should -Be 'error' $Response.Body.Results[0].resultText | Should -Match 'last active Global Administrator' } + + It 'returns 500 when the Graph call fails' { + Mock Invoke-CIPPPIMAssignmentAction { throw 'Graph: InternalServerError' } + $Response = Invoke-ExecPIMRoleAssignment -Request (New-PimRequest @{ Action = 'Remove'; Duration = $null }) + $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::InternalServerError) + $Response.Body.Results[0].state | Should -Be 'error' + } } } diff --git a/backend/Tests/Endpoint/Invoke-ExecPushSubscription.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExecPushSubscription.Tests.ps1 index 30167d334a..be43c34a88 100644 --- a/backend/Tests/Endpoint/Invoke-ExecPushSubscription.Tests.ps1 +++ b/backend/Tests/Endpoint/Invoke-ExecPushSubscription.Tests.ps1 @@ -73,7 +73,7 @@ Describe 'Invoke-ExecPushSubscription' { It 'refuses every action while impersonating' { $Response = Invoke-ExecPushSubscription -Request (New-Request -Impersonate 'readonly' -Body ([pscustomobject]@{ Action = 'Subscribe'; Subscription = $script:Subscription })) - $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::BadRequest) + $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::Forbidden) $Response.Body.Results | Should -Match 'impersonating' Should -Invoke Add-CIPPAzDataTableEntity -Times 0 } @@ -81,7 +81,7 @@ Describe 'Invoke-ExecPushSubscription' { It 'only removes a device that belongs to the caller' { Mock Get-CIPPAzDataTableEntity { $null } $Response = Invoke-ExecPushSubscription -Request (New-Request -Body ([pscustomobject]@{ Action = 'Unsubscribe'; RowKey = 'someone-elses' })) - $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::BadRequest) + $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::NotFound) Should -Invoke Get-CIPPAzDataTableEntity -Times 1 -ParameterFilter { $Filter -eq "PartitionKey eq 'tech@msp.example' and RowKey eq 'someone-elses'" } Should -Invoke Remove-AzDataTableEntity -Times 0 diff --git a/backend/Tests/Endpoint/Invoke-ExecScheduleGroupMembershipVacation.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExecScheduleGroupMembershipVacation.Tests.ps1 new file mode 100644 index 0000000000..2a78d77d39 --- /dev/null +++ b/backend/Tests/Endpoint/Invoke-ExecScheduleGroupMembershipVacation.Tests.ps1 @@ -0,0 +1,114 @@ +# Pester tests for Invoke-ExecScheduleGroupMembershipVacation. +# +# Each selected group gets one add task at the start date and one remove task at the end date, +# both carrying the same MembershipKey so the remove only takes out the users the add put in. + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $FunctionPath = Join-Path $RepoRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecScheduleGroupMembershipVacation.ps1' + if (-not (Test-Path $FunctionPath)) { throw "Could not locate Invoke-ExecScheduleGroupMembershipVacation.ps1 at $FunctionPath" } + + class HttpResponseContext { + [object]$StatusCode + [object]$Body + } + $Accelerators = [PSObject].Assembly.GetType('System.Management.Automation.TypeAccelerators') + if (-not ('HttpStatusCode' -as [type])) { + $Accelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode]) + } + + function Add-CIPPScheduledTask { param($Task, $hidden, $Headers, $DisallowDuplicateName) } + function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) } + function Get-CippException { param($Exception) @{ NormalizedError = "$Exception" } } + + . $FunctionPath + + function New-VacationRequest { + param([hashtable]$Body = @{}) + $RequestBody = [pscustomobject]@{ + tenantFilter = 'contoso.com' + startDate = 1785000000 + endDate = 1786000000 + reference = 'Trip-42' + postExecution = @('Email') + Users = @( + [pscustomobject]@{ value = 'guid-1'; addedFields = [pscustomobject]@{ userPrincipalName = 'one@contoso.com' } } + [pscustomobject]@{ value = 'guid-2'; addedFields = [pscustomobject]@{ userPrincipalName = 'two@contoso.com' } } + ) + Groups = @( + [pscustomobject]@{ value = 'group-1'; label = 'Travel Exclusions'; addedFields = [pscustomobject]@{} } + ) + } + foreach ($Key in $Body.Keys) { + $RequestBody | Add-Member -NotePropertyName $Key -NotePropertyValue $Body[$Key] -Force + } + [pscustomobject]@{ + Body = $RequestBody + Headers = @{} + Params = @{ CIPPEndpoint = 'ExecScheduleGroupMembershipVacation' } + } + } +} + +Describe 'Invoke-ExecScheduleGroupMembershipVacation' { + BeforeEach { + Mock -CommandName Write-LogMessage -MockWith { } + $script:ScheduledTasks = [System.Collections.Generic.List[object]]::new() + Mock -CommandName Add-CIPPScheduledTask -MockWith { + $script:ScheduledTasks.Add(($Task | ConvertTo-Json -Depth 10 | ConvertFrom-Json)) + } + } + + It 'schedules one add and one remove per group sharing a membership key' { + $Response = Invoke-ExecScheduleGroupMembershipVacation -Request (New-VacationRequest) + + $Response.StatusCode | Should -Be ([HttpStatusCode]::OK) + Should -Invoke Add-CIPPScheduledTask -Times 2 -Exactly -ParameterFilter { $hidden -eq $false } + + $AddTask = $script:ScheduledTasks | Where-Object { $_.Parameters.Action -eq 'Add' } + $RemoveTask = $script:ScheduledTasks | Where-Object { $_.Parameters.Action -eq 'Remove' } + @($AddTask).Count | Should -Be 1 + @($RemoveTask).Count | Should -Be 1 + + $AddTask.Command.value | Should -Be 'Set-CIPPVacationGroupMembership' + $RemoveTask.Command.value | Should -Be 'Set-CIPPVacationGroupMembership' + $AddTask.ScheduledTime | Should -Be 1785000000 + $RemoveTask.ScheduledTime | Should -Be 1786000000 + $AddTask.Parameters.MembershipKey | Should -Not -BeNullOrEmpty + $RemoveTask.Parameters.MembershipKey | Should -Be $AddTask.Parameters.MembershipKey + $AddTask.Parameters.GroupId | Should -Be 'group-1' + $AddTask.Parameters.Users | Should -Be @('one@contoso.com', 'two@contoso.com') + $AddTask.Name | Should -Be 'Add Group Membership Vacation Mode: Travel Exclusions - one@contoso.com, two@contoso.com' + $RemoveTask.Name | Should -Be 'Remove Group Membership Vacation Mode: Travel Exclusions - one@contoso.com, two@contoso.com' + $AddTask.Reference | Should -Be 'Trip-42' + } + + It 'gives each group its own membership key' { + $Request = New-VacationRequest -Body @{ + Groups = @( + [pscustomobject]@{ value = 'group-1'; label = 'One' } + [pscustomobject]@{ value = 'group-2'; label = 'Two' } + ) + } + + $null = Invoke-ExecScheduleGroupMembershipVacation -Request $Request + + $script:ScheduledTasks.Count | Should -Be 4 + @($script:ScheduledTasks.Parameters.MembershipKey | Select-Object -Unique).Count | Should -Be 2 + } + + It 'schedules nothing without users' { + $Response = Invoke-ExecScheduleGroupMembershipVacation -Request (New-VacationRequest -Body @{ Users = @() }) + + $script:ScheduledTasks.Count | Should -Be 0 + "$($Response.Body.Results)" | Should -BeLike '*At least one user is required*' + } + + It 'schedules nothing without groups' { + $Response = Invoke-ExecScheduleGroupMembershipVacation -Request (New-VacationRequest -Body @{ Groups = @() }) + + $script:ScheduledTasks.Count | Should -Be 0 + $Response.StatusCode | Should -Be ([HttpStatusCode]::InternalServerError) + "$($Response.Body.Results)" | Should -BeLike '*At least one group is required*' + } +} diff --git a/backend/Tests/Endpoint/Invoke-ExecSetCASMailbox.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExecSetCASMailbox.Tests.ps1 new file mode 100644 index 0000000000..3901885d5e --- /dev/null +++ b/backend/Tests/Endpoint/Invoke-ExecSetCASMailbox.Tests.ps1 @@ -0,0 +1,106 @@ +# The Exchange card and user actions post a short protocol name plus enable. +# The mailbox CAS report posts Set-CASMailbox parameter names. Both must reach Set-CASMailbox. + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $FunctionPath = Join-Path $RepoRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetCASMailbox.ps1' + + class HttpResponseContext { + [object]$StatusCode + [object]$Body + } + + $Accelerators = [psobject].Assembly.GetType('System.Management.Automation.TypeAccelerators') + if (-not $Accelerators::Get.ContainsKey('HttpStatusCode')) { + $Accelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode]) + } + + function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) } + function New-ExoRequest { param($tenantid, $cmdlet, $cmdParams) } + + . $FunctionPath +} + +Describe 'Invoke-ExecSetCASMailbox' { + BeforeEach { + Mock Write-LogMessage {} + Mock New-ExoRequest {} + } + + It 'enables ActiveSync from the short name the Exchange card sends' { + $Request = [pscustomobject]@{ + Params = [pscustomobject]@{ CIPPEndpoint = 'ExecSetCASMailbox' } + Headers = @{} + Body = [pscustomobject]@{ + user = 'ada@contoso.com' + tenantFilter = 'contoso.com' + protocol = 'ActiveSync' + enable = $true + } + } + + $Response = Invoke-ExecSetCASMailbox -Request $Request + + $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK) + Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter { + $cmdlet -eq 'Set-CASMailbox' -and + $cmdParams.Identity -eq 'ada@contoso.com' -and + $cmdParams.ActiveSyncEnabled -eq $true + } + } + + It 'disables several short names sent together' { + $Request = [pscustomobject]@{ + Params = [pscustomobject]@{ CIPPEndpoint = 'ExecSetCASMailbox' } + Headers = @{} + Body = [pscustomobject]@{ + user = 'ada@contoso.com' + tenantFilter = 'contoso.com' + protocols = '!IMAP,POP' + enable = $false + } + } + + $Response = Invoke-ExecSetCASMailbox -Request $Request + + $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK) + Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter { + $cmdParams.IMAPEnabled -eq $false -and $cmdParams.POPEnabled -eq $false + } + } + + It 'still accepts the Set-CASMailbox parameter names' { + $Request = [pscustomobject]@{ + Params = [pscustomobject]@{ CIPPEndpoint = 'ExecSetCASMailbox' } + Headers = @{} + Body = [pscustomobject]@{ + Identity = 'mailbox-guid' + tenantFilter = 'contoso.com' + ActiveSyncEnabled = $false + } + } + + $Response = Invoke-ExecSetCASMailbox -Request $Request + + $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK) + Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter { + $cmdParams.Identity -eq 'mailbox-guid' -and $cmdParams.ActiveSyncEnabled -eq $false + } + } + + It 'returns 400 when no protocol was supplied' { + $Request = [pscustomobject]@{ + Params = [pscustomobject]@{ CIPPEndpoint = 'ExecSetCASMailbox' } + Headers = @{} + Body = [pscustomobject]@{ + user = 'ada@contoso.com' + tenantFilter = 'contoso.com' + } + } + + $Response = Invoke-ExecSetCASMailbox -Request $Request + + $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest) + Should -Invoke New-ExoRequest -Times 0 -Exactly + } +} diff --git a/backend/Tests/Endpoint/Invoke-ExecSetSharePointMember.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExecSetSharePointMember.Tests.ps1 index 026d100861..8c2b306a66 100644 --- a/backend/Tests/Endpoint/Invoke-ExecSetSharePointMember.Tests.ps1 +++ b/backend/Tests/Endpoint/Invoke-ExecSetSharePointMember.Tests.ps1 @@ -30,6 +30,8 @@ BeforeAll { . $FunctionPath . $HelperPath + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CippErrorStatusCode.ps1') + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CippBulkStatusCode.ps1') function New-TestRequest { param($Body) @@ -74,12 +76,12 @@ Describe 'Invoke-ExecSetSharePointMember' { $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::OK) @($Response.Body.Results).Count | Should -Be 2 - $Response.Body.Results | Should -Contain 'Successfully added a@contoso.com as a member of https://contoso.sharepoint.com/sites/hr.' + $Response.Body.Results.resultText | Should -Contain 'Successfully added a@contoso.com as a member of https://contoso.sharepoint.com/sites/hr.' Should -Invoke New-GraphPostRequest -Times 2 -Exactly -ParameterFilter { $uri -like '*/web/associatedmembergroup/users' } Should -Invoke Resolve-CIPPSharePointRestContext -Times 1 -Exactly } - It 'keeps going when one user fails and reports each outcome' { + It 'keeps going when one user fails, reports each outcome and returns MultiStatus' { Mock -CommandName New-GraphPostRequest -MockWith { throw 'User not found' } -ParameterFilter { $uri -like '*/ensureuser' -and $body -like '*bad@contoso.com*' } $Request = New-TestRequest @{ tenantFilter = 'contoso.onmicrosoft.com'; Add = $true; Role = 'Visitors'; SharePointType = 'Sts' @@ -89,12 +91,14 @@ Describe 'Invoke-ExecSetSharePointMember' { $Response = Invoke-ExecSetSharePointMember -Request $Request -TriggerMetadata $null - $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::OK) - $Response.Body.Results[0] | Should -BeLike 'Failed to add bad@contoso.com*' - $Response.Body.Results[1] | Should -Be 'Successfully added good@contoso.com as a visitor of https://contoso.sharepoint.com/sites/hr.' + $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::MultiStatus) + $Response.Body.Results[0].resultText | Should -BeLike 'Failed to add bad@contoso.com*' + $Response.Body.Results[0].state | Should -Be 'error' + $Response.Body.Results[1].resultText | Should -Be 'Successfully added good@contoso.com as a visitor of https://contoso.sharepoint.com/sites/hr.' + $Response.Body.Results[1].state | Should -Be 'success' } - It 'returns BadRequest when every user fails' { + It 'returns InternalServerError when every user fails' { Mock -CommandName New-GraphPostRequest -MockWith { throw 'User not found' } -ParameterFilter { $uri -like '*/ensureuser' } $Request = New-TestRequest @{ tenantFilter = 'contoso.onmicrosoft.com'; Add = $true; Role = 'Members'; SharePointType = 'Sts' @@ -104,7 +108,7 @@ Describe 'Invoke-ExecSetSharePointMember' { $Response = Invoke-ExecSetSharePointMember -Request $Request -TriggerMetadata $null - $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::BadRequest) + $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::InternalServerError) $Response.Body.Results | Should -BeLike '*Failed to add x@contoso.com*Failed to add y@contoso.com*' } @@ -138,6 +142,21 @@ Describe 'Invoke-ExecSetSharePointMember' { Should -Invoke Add-CIPPGroupMember -Times 1 -Exactly -ParameterFilter { $GroupID -eq '11111111-2222-3333-4444-555555555555' } } + It 'encodes a guest UPN before looking the owner up in Graph' { + $Guest = 'guest_partner.com#EXT#@contoso.onmicrosoft.com' + $Request = New-TestRequest @{ + tenantFilter = 'contoso.onmicrosoft.com'; Add = $true; Role = 'Owners'; SharePointType = 'Group' + GroupID = '11111111-2222-3333-4444-555555555555' + user = @((New-UserOption $Guest)) + } + + $Response = Invoke-ExecSetSharePointMember -Request $Request -TriggerMetadata $null + + $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::OK) + $Encoded = [System.Web.HttpUtility]::UrlEncode($Guest) + Should -Invoke New-GraphGetRequest -Times 1 -Exactly -ParameterFilter { $uri -like "*/users/$Encoded`?*" } + } + It 'adds each user as an owner of the M365 group on a group-connected site' { $Request = New-TestRequest @{ tenantFilter = 'contoso.onmicrosoft.com'; Add = $true; Role = 'Owners'; SharePointType = 'Group' @@ -163,7 +182,7 @@ Describe 'Invoke-ExecSetSharePointMember' { $Response = Invoke-ExecSetSharePointMember -Request $Request -TriggerMetadata $null $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::OK) - $Response.Body.Results | Should -Be 'Successfully removed c@contoso.com as an owner of https://contoso.sharepoint.com/sites/team.' + $Response.Body.Results.resultText | Should -Be 'Successfully removed c@contoso.com as an owner of https://contoso.sharepoint.com/sites/team.' Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter { $uri -like '*/web/associatedownergroup/users/removebyid(7)' } Should -Invoke Remove-CIPPGroupMember -Times 0 -Exactly } @@ -176,4 +195,16 @@ Describe 'Invoke-ExecSetSharePointMember' { $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::BadRequest) $Response.Body.Results | Should -BeLike '*No user was selected*' } + + It 'returns BadRequest when a classic site has no site URL' { + $Request = New-TestRequest @{ + tenantFilter = 'contoso.onmicrosoft.com'; Add = $true; Role = 'Members'; SharePointType = 'Sts' + user = @((New-UserOption 'a@contoso.com')) + } + + $Response = Invoke-ExecSetSharePointMember -Request $Request -TriggerMetadata $null + + $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::BadRequest) + $Response.Body.Results | Should -BeLike '*No site URL was provided for this site.' + } } diff --git a/backend/Tests/Endpoint/Invoke-ExecSetSiteProperties.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExecSetSiteProperties.Tests.ps1 new file mode 100644 index 0000000000..cf3c25f819 --- /dev/null +++ b/backend/Tests/Endpoint/Invoke-ExecSetSiteProperties.Tests.ps1 @@ -0,0 +1,101 @@ +# Pester tests for Invoke-ExecSetSiteProperties: classic-site detection from the CSOM GroupId +# and the lock-state ordering a locked site needs. + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ExecSetSiteProperties.ps1' -File -ErrorAction SilentlyContinue | + Select-Object -First 1 -ExpandProperty FullName + if (-not $FunctionPath) { throw 'Could not locate Invoke-ExecSetSiteProperties.ps1 under Modules/' } + + class HttpResponseContext { + [int]$StatusCode + [object]$Body + } + $Accelerators = [PSObject].Assembly.GetType('System.Management.Automation.TypeAccelerators') + if (-not ('HttpStatusCode' -as [type])) { + $Accelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode]) + } + + function Get-CIPPSPOSite { param($TenantFilter, $SiteUrl) } + function Set-CIPPSPOSite { param($TenantFilter, $SiteUrl, $Properties) } + function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) } + function Get-CippException { param($Exception) } + + . $FunctionPath + + function Invoke-SetSite { + param($Body) + $Body['tenantFilter'] = 'contoso.onmicrosoft.com' + $Body['SiteUrl'] = 'https://contoso.sharepoint.com/sites/Team' + Invoke-ExecSetSiteProperties -Request ([pscustomobject]@{ + Params = @{ CIPPEndpoint = 'ExecSetSiteProperties' } + Headers = @{} + Body = [pscustomobject]$Body + }) + } +} + +Describe 'Invoke-ExecSetSiteProperties' { + BeforeEach { + $script:Sent = [System.Collections.Generic.List[string]]::new() + $script:Site = [pscustomobject]@{ GroupId = '/Guid(00000000-0000-0000-0000-000000000000)/'; LockState = 'Unlock' } + Mock -CommandName Write-LogMessage -MockWith { } + Mock -CommandName Get-CippException -MockWith { [pscustomobject]@{ NormalizedError = "$($Exception.Exception.Message)" } } + Mock -CommandName Get-CIPPSPOSite -MockWith { $script:Site } + Mock -CommandName Set-CIPPSPOSite -MockWith { + $script:Sent.Add((@($Properties.Keys) | Sort-Object) -join ',') + if ($script:Site.LockState -ne 'Unlock' -and $Properties.Keys -contains 'Title') { + return [pscustomobject]@{ ErrorInfo = [pscustomobject]@{ ErrorMessage = 'Access is denied.' } } + } + if ($Properties.Keys -contains 'LockState') { $script:Site.LockState = $Properties['LockState'] } + } + } + + It 'treats an all-zero /Guid()/ GroupId as a classic site' { + $R = Invoke-SetSite @{ Title = 'Team' } + $R.StatusCode | Should -Be 200 + $script:Sent | Should -Be @('Title') + } + + It 'still filters classic-only properties on a group-connected site' { + $script:Site.GroupId = '/Guid(338e9db4-1ee3-45e6-be66-4a71ca70b247)/' + $R = Invoke-SetSite @{ Title = 'Team'; SharingCapability = 'Disabled' } + $script:Sent | Should -Be @('SharingCapability') + $R.Body.Results | Should -Match 'Skipped \(not supported on group-connected sites\): Title' + } + + It 'unlocks a locked site before applying the other properties' { + $script:Site.LockState = 'ReadOnly' + $R = Invoke-SetSite @{ Title = 'Team'; SharingCapability = 'Disabled'; LockState = 'Unlock' } + $R.StatusCode | Should -Be 200 + $script:Sent | Should -Be @('LockState', 'SharingCapability,Title') + } + + It 'applies the other properties before locking' { + $R = Invoke-SetSite @{ Title = 'Team'; LockState = 'NoAccess' } + $R.StatusCode | Should -Be 200 + $script:Sent | Should -Be @('Title', 'LockState') + } + + It 'changes only the lock while the site stays locked and reports what it skipped' { + $script:Site.LockState = 'ReadOnly' + $R = Invoke-SetSite @{ Title = 'Team'; LockState = 'NoAccess' } + $R.StatusCode | Should -Be 200 + $script:Sent | Should -Be @('LockState') + $R.Body.Results | Should -Match 'Skipped while the site is locked \(ReadOnly\), unlock it to change: Title' + } + + It 'rejects a change to a locked site that does not touch the lock' { + $script:Site.LockState = 'NoAccess' + $R = Invoke-SetSite @{ Title = 'Team' } + $R.StatusCode | Should -Be 400 + $script:Sent.Count | Should -Be 0 + $R.Body.Results | Should -Match 'Unlock it before changing: Title' + } + + It 'sends a single request when the lock does not change' { + $R = Invoke-SetSite @{ Title = 'Team'; LockState = 'Unlock' } + $script:Sent | Should -Be @('LockState,Title') + $R.Body.Results | Should -Match 'Title=Team' + } +} diff --git a/backend/Tests/Endpoint/Invoke-ExecSharePointImageVersionCleanup.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExecSharePointImageVersionCleanup.Tests.ps1 new file mode 100644 index 0000000000..1d95450531 --- /dev/null +++ b/backend/Tests/Endpoint/Invoke-ExecSharePointImageVersionCleanup.Tests.ps1 @@ -0,0 +1,139 @@ +# Pester tests for the standalone SharePoint version cleanup HTTP entrypoint. +# Focus: result messaging must never report a deletion that did not happen (dry run) and +# must never report generic success when some/all files failed; inputs are de-duplicated. + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot) + $EntryPoint = Join-Path $RepoRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointImageVersionCleanup.ps1' + + # The Functions worker supplies [HttpResponseContext] and `using namespace System.Net` + # (so [HttpStatusCode] resolves). Shim both for unit testing. + if (-not ('HttpResponseContext' -as [type])) { + class HttpResponseContext { + [object]$StatusCode + [object]$Body + } + } + $Accelerators = [PSObject].Assembly.GetType('System.Management.Automation.TypeAccelerators') + if (-not ('HttpStatusCode' -as [type])) { + $Accelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode]) + } + + function Remove-CIPPDriveItemVersion { param($TenantFilter, $DriveId, $DriveItemId, $CleanupMode, $WhatIf) } + function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) } + function Get-CippException { param($Exception) [PSCustomObject]@{ NormalizedError = $Exception.Exception.Message } } + + . $EntryPoint + + function New-Request { + param($Body) + [PSCustomObject]@{ + Body = $Body + Query = [PSCustomObject]@{} + Params = [PSCustomObject]@{ CIPPEndpoint = 'ExecSharePointImageVersionCleanup' } + Headers = @{} + } + } + + # A clean (no-error) cleanup result that removed 2 old versions. + function New-CleanupOk { + [PSCustomObject]@{ + VersionCountBefore = 3 + VersionsDeleted = 2 + Warnings = [System.Collections.Generic.List[string]]::new() + Errors = [System.Collections.Generic.List[string]]::new() + } + } + # A failed cleanup result. + function New-CleanupFail { + $r = [PSCustomObject]@{ + VersionCountBefore = 3 + VersionsDeleted = 0 + Warnings = [System.Collections.Generic.List[string]]::new() + Errors = [System.Collections.Generic.List[string]]::new() + } + $r.Errors.Add('Access denied') + $r + } +} + +Describe 'Invoke-ExecSharePointImageVersionCleanup' { + Context 'validation' { + It 'requires a tenant filter' { + $resp = Invoke-ExecSharePointImageVersionCleanup -Request (New-Request ([PSCustomObject]@{ Files = @('a') })) + $resp.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest) + } + It 'requires at least one file' { + $resp = Invoke-ExecSharePointImageVersionCleanup -Request (New-Request ([PSCustomObject]@{ TenantFilter = 't'; Files = @() })) + $resp.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest) + } + It 'rejects an invalid cleanup mode' { + $body = [PSCustomObject]@{ TenantFilter = 't'; CleanupMode = 'nuke'; Files = @(@{ id = 'a'; driveId = 'd' }) } + $resp = Invoke-ExecSharePointImageVersionCleanup -Request (New-Request $body) + $resp.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest) + } + } + + Context 'dry run (WhatIf)' { + It 'never claims a deletion happened' { + Mock Remove-CIPPDriveItemVersion { New-CleanupOk } + $body = [PSCustomObject]@{ TenantFilter = 't'; CleanupMode = 'recycle'; WhatIf = $true; Files = @(@{ id = 'a'; driveId = 'd' }) } + $resp = Invoke-ExecSharePointImageVersionCleanup -Request (New-Request $body) + $resp.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK) + $resp.Body.Results | Should -Match 'Dry run' + $resp.Body.Results | Should -Not -Match 'Deleted \d' + $resp.Body.WhatIf | Should -BeTrue + } + } + + Context 'live runs' { + It 'reports plain success when all files succeed' { + Mock Remove-CIPPDriveItemVersion { New-CleanupOk } + $body = [PSCustomObject]@{ TenantFilter = 't'; CleanupMode = 'recycle'; WhatIf = $false; Files = @(@{ id = 'a'; driveId = 'd' }, @{ id = 'b'; driveId = 'd' }) } + $resp = Invoke-ExecSharePointImageVersionCleanup -Request (New-Request $body) + $resp.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK) + $resp.Body.Errors | Should -Be 0 + $resp.Body.Succeeded | Should -Be 2 + $resp.Body.VersionsDeleted | Should -Be 4 + $resp.Body.Results | Should -Be 'Deleted 4 version(s) across 2 file(s).' + } + + It 'does NOT report generic success when every file fails (status reflects failure)' { + Mock Remove-CIPPDriveItemVersion { New-CleanupFail } + $body = [PSCustomObject]@{ TenantFilter = 't'; CleanupMode = 'permanent'; WhatIf = $false; Files = @(@{ id = 'a'; driveId = 'd' }, @{ id = 'b'; driveId = 'd' }) } + $resp = Invoke-ExecSharePointImageVersionCleanup -Request (New-Request $body) + $resp.StatusCode | Should -Be ([System.Net.HttpStatusCode]::InternalServerError) + $resp.Body.Results | Should -Match 'failed for all' + $resp.Body.Succeeded | Should -Be 0 + $resp.Body.Errors | Should -Be 2 + } + + It 'reports partial failure clearly' { + $script:call = 0 + Mock Remove-CIPPDriveItemVersion { + $script:call++ + if ($script:call -eq 1) { New-CleanupOk } else { New-CleanupFail } + } + $body = [PSCustomObject]@{ TenantFilter = 't'; CleanupMode = 'recycle'; WhatIf = $false; Files = @(@{ id = 'a'; driveId = 'd' }, @{ id = 'b'; driveId = 'd' }) } + $resp = Invoke-ExecSharePointImageVersionCleanup -Request (New-Request $body) + $resp.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK) + $resp.Body.Succeeded | Should -Be 1 + $resp.Body.Errors | Should -Be 1 + $resp.Body.Results | Should -Match 'file\(s\) failed' + } + } + + Context 'de-duplication' { + It 'processes each unique drive item only once' { + Mock Remove-CIPPDriveItemVersion { New-CleanupOk } + $body = [PSCustomObject]@{ TenantFilter = 't'; CleanupMode = 'recycle'; WhatIf = $false; Files = @( + @{ id = 'a'; driveId = 'd' }, + @{ id = 'a'; driveId = 'd' }, + @{ id = 'b'; driveId = 'd' } + ) } + $resp = Invoke-ExecSharePointImageVersionCleanup -Request (New-Request $body) + Should -Invoke Remove-CIPPDriveItemVersion -Times 2 -Exactly + $resp.Body.ProcessedCount | Should -Be 2 + } + } +} diff --git a/backend/Tests/Endpoint/Invoke-ExecSiteBrowserLibraryCopy.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExecSiteBrowserLibraryCopy.Tests.ps1 index 0c855f76b7..c2661685a5 100644 --- a/backend/Tests/Endpoint/Invoke-ExecSiteBrowserLibraryCopy.Tests.ps1 +++ b/backend/Tests/Endpoint/Invoke-ExecSiteBrowserLibraryCopy.Tests.ps1 @@ -31,6 +31,7 @@ BeforeAll { . $ExecPath . $ListPath + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CippErrorStatusCode.ps1') } Describe 'Invoke-ExecSiteBrowserLibraryCopy' { @@ -67,6 +68,29 @@ Describe 'Invoke-ExecSiteBrowserLibraryCopy' { $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK) Should -Invoke Start-CIPPSharePointLibraryCopy -Times 1 -Exactly } + + It 'returns when the helper throws ' -ForEach @( + @{ Kind = 'a business-rule refusal'; Exception = [System.ArgumentException]::new('Source library has no eligible content to copy.'); Expected = [System.Net.HttpStatusCode]::BadRequest } + @{ Kind = 'an upstream failure'; Exception = [System.Exception]::new('Graph 503'); Expected = [System.Net.HttpStatusCode]::InternalServerError } + ) { + $Thrown = $Exception + Mock Start-CIPPSharePointLibraryCopy { throw $Thrown } + + $Response = Invoke-ExecSiteBrowserLibraryCopy -Request ([pscustomobject]@{ + Params = @{ CIPPEndpoint = 'ExecSiteBrowserLibraryCopy' } + Headers = @{} + Body = [pscustomobject]@{ + Action = 'StartLibraryCopy' + tenantFilter = 'contoso.com' + SourceSiteId = 'site-a' + SourceListId = 'list-a' + DestSiteId = 'site-b' + DestListId = 'list-b' + } + }) + + $Response.StatusCode | Should -Be $Expected + } } Describe 'Invoke-ListSiteBrowserLibraryCopy' { @@ -102,4 +126,16 @@ Describe 'Invoke-ListSiteBrowserLibraryCopy' { $Response.Body.Results.Status | Should -Be 'Processing' $Response.Body.Results.JobsTotal | Should -Be 2 } + + It 'returns NotFound when the operation does not exist' { + Mock Update-CIPPSharePointLibraryCopyStatus { throw [System.Management.Automation.ItemNotFoundException]::new('Library copy operation not found.') } + + $Response = Invoke-ListSiteBrowserLibraryCopy -Request ([pscustomobject]@{ + Params = @{ CIPPEndpoint = 'ListSiteBrowserLibraryCopy' } + Headers = @{} + Query = @{ tenantFilter = 'contoso.com'; OperationId = 'missing' } + }) + + $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::NotFound) + } } diff --git a/backend/Tests/Endpoint/Invoke-ExportMailQuarantine.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ExportMailQuarantine.Tests.ps1 new file mode 100644 index 0000000000..bd3b8c91bc --- /dev/null +++ b/backend/Tests/Endpoint/Invoke-ExportMailQuarantine.Tests.ps1 @@ -0,0 +1,80 @@ +# Pester tests for Invoke-ExportMailQuarantine response shape + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $FunctionPath = Join-Path $RepoRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExportMailQuarantine.ps1' + $ToolsDir = Join-Path $RepoRoot 'Modules/CIPPCore/Public/Tools' + + class HttpResponseContext { + [int]$StatusCode + [object]$Body + } + + Add-Type -AssemblyName System.Net.Primitives + Add-Type -AssemblyName System.Net.Http + $typeAccelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators') + if (-not $typeAccelerators::Get.Keys.Contains('HttpStatusCode')) { + $typeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode]) + } + + function Get-NormalizedError { param($Message) $Message } + + Get-ChildItem -Path $ToolsDir -Filter '*Quarantine*.ps1' | ForEach-Object { . $_.FullName } + . $FunctionPath +} + +Describe 'Invoke-ExportMailQuarantine' { + BeforeEach { + Mock -CommandName Invoke-CippQuarantineExoRequest -MockWith { + @( + [pscustomobject]@{ + Identity = 'q-1' + MessageId = '' + ReceivedTime = [datetime]'2026-06-01T10:00:00Z' + Subject = 'Invoice test' + SenderAddress = 'sender@example.com' + RecipientAddress = 'user@contoso.com' + Type = 'Spam' + ReleaseStatus = 'NotReleased' + PolicyName = 'Default' + PolicyType = 'HostedContentFilterPolicy' + } + ) + } + } + + It 'returns CSV export metadata with raw row scan details' { + $request = [pscustomobject]@{ + Body = @{ + tenantFilter = 'contoso.onmicrosoft.com' + days = 7 + subject = 'invoice' + format = 'csv' + } + } + + $response = Invoke-ExportMailQuarantine -Request $request -TriggerMetadata $null + + $response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK) + $response.Body.Metadata.format | Should -Be 'csv' + $response.Body.Metadata.HasPostFilters | Should -Be $true + $response.Body.Metadata.RawRowsScanned | Should -BeGreaterThan 0 + $response.Body.Results | Should -Match 'Invoice test' + } + + It 'returns JSON export payload with filtered row count' { + $request = [pscustomobject]@{ + Body = @{ + tenantFilter = 'contoso.onmicrosoft.com' + days = 7 + format = 'json' + } + } + + $response = Invoke-ExportMailQuarantine -Request $request -TriggerMetadata $null + + $response.Body.Metadata.format | Should -Be 'json' + $response.Body.Results.Count | Should -Be 1 + $response.Body.Results[0].ReleaseStatus | Should -Be 'NOTRELEASED' + } +} diff --git a/backend/Tests/Endpoint/Invoke-GetMailQuarantineMessage.Tests.ps1 b/backend/Tests/Endpoint/Invoke-GetMailQuarantineMessage.Tests.ps1 new file mode 100644 index 0000000000..71f1824ba9 --- /dev/null +++ b/backend/Tests/Endpoint/Invoke-GetMailQuarantineMessage.Tests.ps1 @@ -0,0 +1,75 @@ +# Pester tests for Invoke-GetMailQuarantineMessage response shape + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $FunctionPath = Join-Path $RepoRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-GetMailQuarantineMessage.ps1' + $ToolsDir = Join-Path $RepoRoot 'Modules/CIPPCore/Public/Tools' + + class HttpResponseContext { + [int]$StatusCode + [object]$Body + } + + Add-Type -AssemblyName System.Net.Primitives + Add-Type -AssemblyName System.Net.Http + $typeAccelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators') + if (-not $typeAccelerators::Get.Keys.Contains('HttpStatusCode')) { + $typeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode]) + } + + function Get-NormalizedError { param($Message) $Message } + function ConvertTo-AuthenticationSummary { param($DetailEntries) @{ SPF = @{ result = 'Pass' } } } + function New-ExoRequest { param($TenantId, $Cmdlet, $CmdParams) $null } + + Get-ChildItem -Path $ToolsDir -Filter '*Quarantine*.ps1' | ForEach-Object { . $_.FullName } + . $FunctionPath +} + +Describe 'Invoke-GetMailQuarantineMessage' { + BeforeEach { + Mock -CommandName Invoke-CippQuarantineExoRequest -MockWith { + param($TenantId, $Cmdlet, $CmdParams) + [pscustomobject]@{ + Identity = $CmdParams.Identity + MessageId = '' + ReceivedTime = [datetime]'2026-06-01T10:00:00Z' + Subject = 'Test subject' + SenderAddress = 'sender@example.com' + RecipientAddress = 'user@contoso.com' + Type = 'Spam' + ReleaseStatus = 'NotReleased' + PolicyName = 'Default' + PolicyType = 'HostedContentFilterPolicy' + } + } + } + + It 'returns a structured Results object for detail panels' { + $request = [pscustomobject]@{ + Query = @{ + tenantFilter = 'contoso.onmicrosoft.com' + Identity = 'q-identity-1' + } + } + + $response = Invoke-GetMailQuarantineMessage -Request $request -TriggerMetadata $null + + $response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK) + $response.Body.Results | Should -BeOfType [pscustomobject] + $response.Body.Results.Identity | Should -Be 'q-identity-1' + $response.Body.Results.ReleaseStatus | Should -Be 'NOTRELEASED' + } + + It 'returns BadRequest when Identity is missing' { + $request = [pscustomobject]@{ + Query = @{ + tenantFilter = 'contoso.onmicrosoft.com' + } + } + + $response = Invoke-GetMailQuarantineMessage -Request $request -TriggerMetadata $null + + $response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest) + $response.Body.Results | Should -Match 'Identity is required' + } +} diff --git a/backend/Tests/Endpoint/Invoke-ImageOptimizerEndpoints.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ImageOptimizerEndpoints.Tests.ps1 new file mode 100644 index 0000000000..96104d5ca1 --- /dev/null +++ b/backend/Tests/Endpoint/Invoke-ImageOptimizerEndpoints.Tests.ps1 @@ -0,0 +1,168 @@ +# Pester tests for the SharePoint Image Optimizer HTTP entrypoints: +# - Invoke-ExecSharePointImageOptimize (queues a background job) +# - Invoke-ListImageOptimizerResults (polls queue + cached result) +# Focus: request validation, queueing contract, and the poll state machine +# (Running -> Completed/error) including cached-error and not-found handling. + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot) + $EntryDir = Join-Path $RepoRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint' + + # The Functions worker supplies [HttpResponseContext] and `using namespace System.Net`. + if (-not ('HttpResponseContext' -as [type])) { + class HttpResponseContext { + [object]$StatusCode + [object]$Body + } + } + $Accelerators = [PSObject].Assembly.GetType('System.Management.Automation.TypeAccelerators') + if (-not ('HttpStatusCode' -as [type])) { + $Accelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode]) + } + + function New-CippQueueEntry { param($Name, $Link, $Reference, $TotalTasks) } + function Add-CippQueueMessage { param($Cmdlet, $Parameters) } + function Get-CIPPQueueData { param($QueueId) } + function Get-CippTable { param($tablename) } + function Get-CIPPAzDataTableEntity { param($Filter) } + function ConvertTo-CIPPODataFilterValue { param($Value, $Type) $Value } + function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) } + function Get-CippException { param($Exception) [PSCustomObject]@{ NormalizedError = $Exception.Exception.Message } } + + . (Join-Path $EntryDir 'Invoke-ExecSharePointImageOptimize.ps1') + . (Join-Path $EntryDir 'Invoke-ListImageOptimizerResults.ps1') + + function New-Request { + param($Body = $null, $Query = $null) + [PSCustomObject]@{ + Body = $Body ?? ([PSCustomObject]@{}) + Query = $Query ?? ([PSCustomObject]@{}) + Params = [PSCustomObject]@{ CIPPEndpoint = 'ImageOptimizer' } + Headers = @{} + } + } +} + +Describe 'Invoke-ExecSharePointImageOptimize' { + BeforeEach { + Mock New-CippQueueEntry { [PSCustomObject]@{ RowKey = 'queue-123' } } + Mock Add-CippQueueMessage { $true } + Mock Write-LogMessage {} + Mock Get-CippException { [PSCustomObject]@{ NormalizedError = $Exception.Exception.Message } } + } + + It 'requires a tenant filter' { + $resp = Invoke-ExecSharePointImageOptimize -Request (New-Request ([PSCustomObject]@{ DriveId = 'D' })) + $resp.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest) + } + + It 'requires a target (DriveId, SiteId, or SiteUrl)' { + $resp = Invoke-ExecSharePointImageOptimize -Request (New-Request ([PSCustomObject]@{ TenantFilter = 't' })) + $resp.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest) + } + + It 'rejects an invalid mode' { + $body = [PSCustomObject]@{ TenantFilter = 't'; DriveId = 'D'; Mode = 'Nuke' } + $resp = Invoke-ExecSharePointImageOptimize -Request (New-Request $body) + $resp.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest) + } + + It 'queues a job and returns the QueueId' { + $body = [PSCustomObject]@{ TenantFilter = 't'; DriveId = 'D'; Mode = 'Audit' } + $resp = Invoke-ExecSharePointImageOptimize -Request (New-Request $body) + $resp.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK) + $resp.Body.Queued | Should -BeTrue + $resp.Body.QueueId | Should -Be 'queue-123' + Should -Invoke Add-CippQueueMessage -Times 1 -Exactly + } + + It 'forces VersionCleanupMode to none unless mode is CompressAndCleanup' { + $body = [PSCustomObject]@{ TenantFilter = 't'; DriveId = 'D'; Mode = 'Compress'; VersionCleanupMode = 'permanent' } + Invoke-ExecSharePointImageOptimize -Request (New-Request $body) | Out-Null + Should -Invoke Add-CippQueueMessage -Times 1 -Exactly -ParameterFilter { $Parameters.VersionCleanupMode -eq 'none' } + } + + It 'preserves VersionCleanupMode for CompressAndCleanup' { + $body = [PSCustomObject]@{ TenantFilter = 't'; DriveId = 'D'; Mode = 'CompressAndCleanup'; VersionCleanupMode = 'recycle' } + Invoke-ExecSharePointImageOptimize -Request (New-Request $body) | Out-Null + Should -Invoke Add-CippQueueMessage -Times 1 -Exactly -ParameterFilter { $Parameters.VersionCleanupMode -eq 'recycle' } + } + + It 'defaults WhatIf to true (fail safe) when omitted' { + $body = [PSCustomObject]@{ TenantFilter = 't'; DriveId = 'D'; Mode = 'Compress' } + Invoke-ExecSharePointImageOptimize -Request (New-Request $body) | Out-Null + Should -Invoke Add-CippQueueMessage -Times 1 -Exactly -ParameterFilter { $Parameters.WhatIf -eq $true } + } + + It 'returns 500 when queueing fails' { + Mock Add-CippQueueMessage { $false } + $body = [PSCustomObject]@{ TenantFilter = 't'; DriveId = 'D'; Mode = 'Audit' } + $resp = Invoke-ExecSharePointImageOptimize -Request (New-Request $body) + $resp.StatusCode | Should -Be ([System.Net.HttpStatusCode]::InternalServerError) + } +} + +Describe 'Invoke-ListImageOptimizerResults' { + BeforeEach { + Mock Get-CippTable { @{ TableName = 'CacheImageOptimizer' } } + Mock Write-LogMessage {} + Mock Get-CippException { [PSCustomObject]@{ NormalizedError = $Exception.Exception.Message } } + Mock Get-CIPPAzDataTableEntity { $null } + } + + It 'requires a queueId' { + $resp = Invoke-ListImageOptimizerResults -Request (New-Request -Query ([PSCustomObject]@{})) + $resp.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest) + } + + It 'returns 404 when the queue entry does not exist' { + Mock Get-CIPPQueueData { $null } + $resp = Invoke-ListImageOptimizerResults -Request (New-Request -Query ([PSCustomObject]@{ queueId = 'q1' })) + $resp.StatusCode | Should -Be ([System.Net.HttpStatusCode]::NotFound) + } + + It 'reports Running while the job is still processing' { + Mock Get-CIPPQueueData { [PSCustomObject]@{ Status = 'Running' } } + $resp = Invoke-ListImageOptimizerResults -Request (New-Request -Query ([PSCustomObject]@{ queueId = 'q1' })) + $resp.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK) + $resp.Body.Status | Should -Be 'Running' + } + + It 'reports Running when completed but the cache has not been written yet' { + Mock Get-CIPPQueueData { [PSCustomObject]@{ Status = 'Completed' } } + Mock Get-CIPPAzDataTableEntity { $null } + $resp = Invoke-ListImageOptimizerResults -Request (New-Request -Query ([PSCustomObject]@{ queueId = 'q1' })) + $resp.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK) + $resp.Body.Status | Should -Be 'Running' + } + + It 'returns the completed result payload from cache' { + Mock Get-CIPPQueueData { [PSCustomObject]@{ Status = 'Completed' } } + $payload = @{ + Mode = 'Audit' + WhatIf = $true + SiteUrl = 'https://c/sites/m' + Library = 'Documents' + Folder = $null + Summary = @{ FilesScanned = 5; EligibleFiles = 3 } + Results = @(@{ FileName = 'a.jpg' }, $null, @{ FileName = 'b.jpg' }) + Warnings = @('w1', $null) + } | ConvertTo-Json -Depth 10 + Mock Get-CIPPAzDataTableEntity { [PSCustomObject]@{ Data = $payload } } + $resp = Invoke-ListImageOptimizerResults -Request (New-Request -Query ([PSCustomObject]@{ queueId = 'q1'; tenantFilter = 't' })) + $resp.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK) + $resp.Body.Status | Should -Be 'Completed' + $resp.Body.Summary.EligibleFiles | Should -Be 3 + # Null entries must be stripped from the serialized arrays. + @($resp.Body.Results).Count | Should -Be 2 + @($resp.Body.Warnings).Count | Should -Be 1 + } + + It 'returns 500 when the cached job recorded an error' { + Mock Get-CIPPQueueData { [PSCustomObject]@{ Status = 'Completed (with errors)' } } + Mock Get-CIPPAzDataTableEntity { [PSCustomObject]@{ Error = 'boom' } } + $resp = Invoke-ListImageOptimizerResults -Request (New-Request -Query ([PSCustomObject]@{ queueId = 'q1' })) + $resp.StatusCode | Should -Be ([System.Net.HttpStatusCode]::InternalServerError) + $resp.Body.Results | Should -Match 'boom' + } +} diff --git a/backend/Tests/Endpoint/Invoke-ListAutopilotconfig.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ListAutopilotconfig.Tests.ps1 index 24f9c61bd0..7d32add739 100644 --- a/backend/Tests/Endpoint/Invoke-ListAutopilotconfig.Tests.ps1 +++ b/backend/Tests/Endpoint/Invoke-ListAutopilotconfig.Tests.ps1 @@ -106,12 +106,12 @@ Describe 'Invoke-ListAutopilotconfig ApProfile' { @($Response.Body) | Should -HaveCount 0 } - It 'surfaces a Graph error on the profile request as Forbidden' { + It 'surfaces a Graph error on the profile request as a server error' { $script:ProfileStatus = 403 $Response = Invoke-ListAutopilotconfig -Request (New-ListAPRequest -Type 'ApProfile') -TriggerMetadata $null - $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::Forbidden) + $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::InternalServerError) $Response.Body | Should -Be 'Graph said no' } } diff --git a/backend/Tests/Endpoint/Invoke-ListMessageTrace.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ListMessageTrace.Tests.ps1 index 8a64d94f69..98cd069ff8 100644 --- a/backend/Tests/Endpoint/Invoke-ListMessageTrace.Tests.ps1 +++ b/backend/Tests/Endpoint/Invoke-ListMessageTrace.Tests.ps1 @@ -144,3 +144,24 @@ Describe 'Invoke-ListMessageTrace messageId sweep' { Should -Invoke -CommandName New-GraphGetRequest -Times 1 -Exactly } } + +Describe 'Invoke-ListMessageTrace Get-MessageTraceV2 fallback' { + BeforeEach { + Mock -CommandName New-GraphPostRequest -MockWith { } + Mock -CommandName Write-LogMessage -MockWith { } + Mock -CommandName New-ExoRequest -MockWith { + @([pscustomobject]@{ MessageTraceId = 'v2trace'; MessageId = 'msg1'; Status = 'Delivered'; Subject = 'hi'; RecipientAddress = 'to@contoso.com'; SenderAddress = 'from@contoso.com'; Received = (Get-Date).ToUniversalTime(); Size = 100; FromIP = '1.1.1.1'; ToIP = '2.2.2.2' }) + } + } + + It 'falls back when Graph does not serve message trace for a GCC tenant' { + Mock -CommandName New-GraphGetRequest -MockWith { throw 'Graph API is not currently supported for MS365 GCC tenants.' } + + $response = Invoke-ListMessageTrace -Request (New-MessageTraceRequest -Body @{ days = 2 }) -TriggerMetadata $null + + $response.StatusCode | Should -Be 200 + $response.Body.Metadata.Source | Should -Be 'Get-MessageTraceV2' + Should -Invoke -CommandName New-ExoRequest -ParameterFilter { $Cmdlet -eq 'Get-MessageTraceV2' } + Should -Invoke -CommandName New-GraphPostRequest -Times 0 -Exactly -Because 'an unsupported cloud is not a missing service principal' + } +} diff --git a/backend/Tests/Endpoint/Invoke-ListTenantAlignment.Summary.Tests.ps1 b/backend/Tests/Endpoint/Invoke-ListTenantAlignment.Summary.Tests.ps1 index 77f0ccdcbf..ccb8a8ec7a 100644 --- a/backend/Tests/Endpoint/Invoke-ListTenantAlignment.Summary.Tests.ps1 +++ b/backend/Tests/Endpoint/Invoke-ListTenantAlignment.Summary.Tests.ps1 @@ -26,9 +26,27 @@ BeforeAll { function Get-CIPPAzDataTableEntity { [CmdletBinding()] param($Table, $Filter, $Property) @() } function Get-Tenants { [CmdletBinding()] param($TenantFilter, [switch]$IncludeErrors, [switch]$IncludeAll) } function Write-LogMessage { [CmdletBinding()] param($API, $tenant, $message, $sev, $LogData) } + # Pass-through unless a test sets RestrictTo. The real filter lives in CIPPCore and reads + # the request's allowed-tenant scope; this stub stands in for that scope. + function Select-CippAllowedTenantData { + param( + [Parameter(ValueFromPipeline = $true)] + $InputObject, + [string[]]$TenantProperty = @('Tenant', 'TenantId'), + [switch]$AllowPartner + ) + process { + foreach ($Item in @($InputObject)) { + if ($null -eq $Item) { continue } + if ($script:RestrictTo -and $script:RestrictTo -notcontains [string]$Item.TenantFilter) { continue } + $Item + } + } + } function Get-CippException { [CmdletBinding()] param($Exception) @{ NormalizedError = $Exception.Exception.Message } } . $FunctionPath + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CippBulkStatusCode.ps1') $script:Tenants = @( [pscustomobject]@{ defaultDomainName = 'alpha.onmicrosoft.com'; displayName = 'Alpha'; customerId = 'aaaa-1111' } @@ -53,6 +71,7 @@ BeforeAll { Describe 'Invoke-ListTenantAlignment summary mode' { BeforeEach { + $script:RestrictTo = $null Mock -CommandName Get-CIPPTenantAlignment -MockWith { $script:Alignment } Mock -CommandName Get-Tenants -MockWith { $script:Tenants } Mock -CommandName Write-LogMessage -MockWith { } @@ -107,6 +126,21 @@ Describe 'Invoke-ListTenantAlignment summary mode' { @($Result.Body)[0].tenantFilter | Should -BeExactly 'alpha.onmicrosoft.com' } + It 'limits the summary and the row list to the caller''s tenants' { + $script:RestrictTo = @('alpha.onmicrosoft.com') + + $Summary = (Invoke-ListTenantAlignment -Request (script:New-AlignmentRequest @{ summary = $true }) -TriggerMetadata @{}).Body + $Summary.ScoredTenantCount | Should -Be 1 + $Summary.Average | Should -Be 95 + $Summary.PendingDeviations | Should -Be 5 + $Summary.Lowest[0].Tenant | Should -BeExactly 'alpha.onmicrosoft.com' + $Summary.Lowest[0].Name | Should -BeExactly 'Alpha' + + $Rows = Invoke-ListTenantAlignment -Request (script:New-AlignmentRequest @{}) -TriggerMetadata @{} + @($Rows.Body).Count | Should -Be 2 + @($Rows.Body).tenantFilter | Should -BeExactly @('alpha.onmicrosoft.com', 'alpha.onmicrosoft.com') + } + It 'handles an estate with no alignment data' { Mock -CommandName Get-CIPPTenantAlignment -MockWith { @() } diff --git a/backend/Tests/Endpoint/Invoke-SharePointImageOptimizer.Tests.ps1 b/backend/Tests/Endpoint/Invoke-SharePointImageOptimizer.Tests.ps1 new file mode 100644 index 0000000000..2a2f48bf0e --- /dev/null +++ b/backend/Tests/Endpoint/Invoke-SharePointImageOptimizer.Tests.ps1 @@ -0,0 +1,361 @@ +# Pester tests for the SharePoint Image Optimizer feature. +# Covers audit filtering, threshold, WhatIf safety, savings rules, version cleanup safety, +# throttling retry, permission failure, and empty library handling. + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot) + $ImgDir = Join-Path $RepoRoot 'Modules/CIPPCore/Public/SharePoint/Image Optimizer' + + # Stub the external dependencies so Pester can Mock them. + function New-GraphGetRequest { param($uri, $tenantid, $AsApp, $NoAuthCheck, $scope) } + function New-GraphPOSTRequest { param($uri, $tenantid, $type, $AsApp, $NoAuthCheck, $scope, $Body, $ContentType, $AddedHeaders) } + function Get-GraphToken { param($tenantid, $AsApp) } + function Get-SharePointAdminLink { param($Public, $TenantFilter) } + function Set-CippQueueTask { param($QueueId, $Name, $Status, $TaskId) } + function Update-CippQueueEntry { param($RowKey, $Status) } + function Get-CippTable { param($tablename) } + function Add-CIPPAzDataTableEntity { param($Entity, [switch]$Force) } + function Write-LogMessage { param($API, $tenant, $message, $Sev, $LogData, $headers) } + function Get-CippException { param($Exception) } + + . (Join-Path $ImgDir 'Compress-CIPPImage.ps1') + . (Join-Path $ImgDir 'Get-CIPPSharePointImageCandidate.ps1') + . (Join-Path $ImgDir 'Get-CIPPSharePointFolderList.ps1') + . (Join-Path $ImgDir 'Remove-CIPPDriveItemVersion.ps1') + . (Join-Path $ImgDir 'Invoke-CIPPSharePointImageOptimizer.ps1') + . (Join-Path $ImgDir 'Start-CIPPSharePointImageOptimizer.ps1') + + # Default sizes; individual tests override. + $script:DownloadSize = 1000000 + $script:CompressedSize = 300000 + + function New-RootListing { + @( + [PSCustomObject]@{ id = 'big'; name = 'big.jpg'; size = 10485760; file = @{ mimeType = 'image/jpeg' }; folder = $null; parentReference = @{ id = 'root'; path = '/drive/root:' }; webUrl = 'https://c/big.jpg'; lastModifiedDateTime = '2024-01-01T00:00:00Z'; createdDateTime = '2024-01-01T00:00:00Z' } + [PSCustomObject]@{ id = 'small'; name = 'small.jpg'; size = 1048576; file = @{ mimeType = 'image/jpeg' }; folder = $null; parentReference = @{ id = 'root'; path = '/drive/root:' }; webUrl = 'https://c/small.jpg'; lastModifiedDateTime = '2024-01-01T00:00:00Z'; createdDateTime = '2024-01-01T00:00:00Z' } + [PSCustomObject]@{ id = 'pic'; name = 'pic.JPEG'; size = 8388608; file = @{ mimeType = 'image/jpeg' }; folder = $null; parentReference = @{ id = 'root'; path = '/drive/root:' }; webUrl = 'https://c/pic.JPEG'; lastModifiedDateTime = '2024-01-01T00:00:00Z'; createdDateTime = '2024-01-01T00:00:00Z' } + [PSCustomObject]@{ id = 'notes'; name = 'notes.txt'; size = 6291456; file = @{ mimeType = 'text/plain' }; folder = $null; parentReference = @{ id = 'root'; path = '/drive/root:' }; webUrl = 'https://c/notes.txt'; lastModifiedDateTime = '2024-01-01T00:00:00Z'; createdDateTime = '2024-01-01T00:00:00Z' } + [PSCustomObject]@{ id = 'FOLDER1'; name = 'Sub'; size = 0; file = $null; folder = @{ childCount = 1 }; parentReference = @{ id = 'root'; path = '/drive/root:' }; webUrl = 'https://c/Sub'; lastModifiedDateTime = '2024-01-01T00:00:00Z'; createdDateTime = '2024-01-01T00:00:00Z' } + ) + } + function New-SubListing { + @( + [PSCustomObject]@{ id = 'nested'; name = 'nested.jpg'; size = 9437184; file = @{ mimeType = 'image/jpeg' }; folder = $null; parentReference = @{ id = 'FOLDER1'; path = '/drive/root:/Sub' }; webUrl = 'https://c/Sub/nested.jpg'; lastModifiedDateTime = '2024-01-01T00:00:00Z'; createdDateTime = '2024-01-01T00:00:00Z' } + ) + } +} + +Describe 'Get-CIPPSharePointImageCandidate' { + BeforeEach { + Mock New-GraphGetRequest { @() } + Mock New-GraphGetRequest -ParameterFilter { $uri -match 'items/root/children' } -MockWith { New-RootListing } + Mock New-GraphGetRequest -ParameterFilter { $uri -match 'items/FOLDER1/children' } -MockWith { New-SubListing } + } + + It 'returns only .jpg and .jpeg files' { + $r = Get-CIPPSharePointImageCandidate -TenantFilter 't' -DriveId 'D' -MinimumFileSizeMB 5 + $r.Candidates.FileName | Should -Not -Contain 'notes.txt' + ($r.Candidates | Where-Object { $_.Extension -notin @('jpg', 'jpeg') }) | Should -BeNullOrEmpty + } + + It 'is case-insensitive on the extension' { + $r = Get-CIPPSharePointImageCandidate -TenantFilter 't' -DriveId 'D' -MinimumFileSizeMB 5 + ($r.Candidates | Where-Object { $_.FileName -eq 'pic.JPEG' }) | Should -Not -BeNullOrEmpty + } + + It 'marks files below the threshold as not eligible' { + $r = Get-CIPPSharePointImageCandidate -TenantFilter 't' -DriveId 'D' -MinimumFileSizeMB 5 + $small = $r.Candidates | Where-Object { $_.FileName -eq 'small.jpg' } + $small.Eligible | Should -BeFalse + $small.SkipReason | Should -Be 'Skipped: below threshold' + } + + It 'recurses subfolders and counts scanned files' { + $r = Get-CIPPSharePointImageCandidate -TenantFilter 't' -DriveId 'D' -MinimumFileSizeMB 5 + ($r.Candidates | Where-Object { $_.FileName -eq 'nested.jpg' }) | Should -Not -BeNullOrEmpty + $r.FilesScanned | Should -Be 5 + @($r.Candidates | Where-Object { $_.Eligible }).Count | Should -Be 3 + } + + It 'does not recurse when IncludeSubfolders is false' { + $r = Get-CIPPSharePointImageCandidate -TenantFilter 't' -DriveId 'D' -MinimumFileSizeMB 5 -IncludeSubfolders $false + ($r.Candidates | Where-Object { $_.FileName -eq 'nested.jpg' }) | Should -BeNullOrEmpty + } + + It 'MaxFiles caps the number of ELIGIBLE files collected' { + $r = Get-CIPPSharePointImageCandidate -TenantFilter 't' -DriveId 'D' -MinimumFileSizeMB 5 -MaxFiles 2 + @($r.Candidates | Where-Object { $_.Eligible }).Count | Should -Be 2 + # The third eligible image (nested.jpg, in the subfolder) is past the budget. + ($r.Candidates | Where-Object { $_.FileName -eq 'nested.jpg' }) | Should -BeNullOrEmpty + } + + It 'does not let below-threshold files starve the eligible budget' { + # Two small (ineligible) images appear before the large ones. With the old + # total-candidate cap a MaxFiles of 1 would have returned only a small file. + Mock New-GraphGetRequest -ParameterFilter { $uri -match 'items/root/children' } -MockWith { + @( + [PSCustomObject]@{ id = 's1'; name = 's1.jpg'; size = 1048576; file = @{ mimeType = 'image/jpeg' }; folder = $null; parentReference = @{ id = 'root'; path = '/drive/root:' }; webUrl = 'https://c/s1.jpg' } + [PSCustomObject]@{ id = 's2'; name = 's2.jpg'; size = 1048576; file = @{ mimeType = 'image/jpeg' }; folder = $null; parentReference = @{ id = 'root'; path = '/drive/root:' }; webUrl = 'https://c/s2.jpg' } + [PSCustomObject]@{ id = 'b1'; name = 'b1.jpg'; size = 10485760; file = @{ mimeType = 'image/jpeg' }; folder = $null; parentReference = @{ id = 'root'; path = '/drive/root:' }; webUrl = 'https://c/b1.jpg' } + [PSCustomObject]@{ id = 'b2'; name = 'b2.jpg'; size = 10485760; file = @{ mimeType = 'image/jpeg' }; folder = $null; parentReference = @{ id = 'root'; path = '/drive/root:' }; webUrl = 'https://c/b2.jpg' } + ) + } + $r = Get-CIPPSharePointImageCandidate -TenantFilter 't' -DriveId 'D' -MinimumFileSizeMB 5 -MaxFiles 1 + $eligible = @($r.Candidates | Where-Object { $_.Eligible }) + $eligible.Count | Should -Be 1 + $eligible[0].FileName | Should -Be 'b1.jpg' + } + + It 'MaxScan bounds the total number of files inspected' { + $r = Get-CIPPSharePointImageCandidate -TenantFilter 't' -DriveId 'D' -MinimumFileSizeMB 5 -MaxScan 2 + $r.FilesScanned | Should -Be 2 + } +} + +Describe 'Compress-CIPPImage' { + It 'returns failure for empty input' { + $r = Compress-CIPPImage -ImageBytes ([byte[]]::new(0)) -Quality 82 + $r.Success | Should -BeFalse + $r.Error | Should -Be 'No image data supplied.' + } + + It 'warns when metadata preservation is requested' { + $r = Compress-CIPPImage -ImageBytes ([byte[]]::new(0)) -Quality 82 -StripMetadata $false + $r.Warning | Should -Match 'preservation is not supported' + } +} + +Describe 'Invoke-CIPPImageHttpWithRetry' { + It 'retries on throttling then succeeds' { + Mock Start-Sleep {} + $script:calls = 0 + $result = Invoke-CIPPImageHttpWithRetry -ScriptBlock { + $script:calls++ + if ($script:calls -lt 2) { throw 'Too many requests' } + 'ok' + } + $result | Should -Be 'ok' + $script:calls | Should -Be 2 + } + + It 'does not retry non-throttling errors' { + Mock Start-Sleep {} + $script:calls = 0 + { Invoke-CIPPImageHttpWithRetry -ScriptBlock { $script:calls++; throw 'Access denied' } } | Should -Throw + $script:calls | Should -Be 1 + } +} + +Describe 'Remove-CIPPDriveItemVersion' { + BeforeEach { + Mock New-GraphGetRequest { @() } + Mock New-GraphGetRequest -ParameterFilter { $uri -match '/versions' } -MockWith { + @( + [PSCustomObject]@{ id = '3.0'; lastModifiedDateTime = '2024-03-01T00:00:00Z'; size = 100 } + [PSCustomObject]@{ id = '2.0'; lastModifiedDateTime = '2024-02-01T00:00:00Z'; size = 100 } + [PSCustomObject]@{ id = '1.0'; lastModifiedDateTime = '2024-01-01T00:00:00Z'; size = 100 } + ) + } + Mock New-GraphGetRequest -ParameterFilter { $uri -match 'sharepointIds' } -MockWith { + [PSCustomObject]@{ id = 'f'; name = 'f.jpg'; webUrl = 'https://c/f.jpg'; sharepointIds = @{ siteUrl = 'https://c/sites/m'; listItemUniqueId = '11111111-1111-1111-1111-111111111111' } } + } + Mock Get-SharePointAdminLink { [PSCustomObject]@{ SharePointUrl = 'https://c'; AdminUrl = 'https://c-admin'; TenantName = 'c' } } + Mock New-GraphPOSTRequest { $null } + } + + It 'is a no-op when CleanupMode is none' { + $r = Remove-CIPPDriveItemVersion -TenantFilter 't' -DriveId 'D' -DriveItemId 'f' -CleanupMode 'none' -WhatIf $false + $r.VersionsDeleted | Should -Be 0 + Should -Invoke New-GraphPOSTRequest -Times 0 + } + + It 'deletes all old versions but keeps the current (count - 1)' { + $r = Remove-CIPPDriveItemVersion -TenantFilter 't' -DriveId 'D' -DriveItemId 'f' -CleanupMode 'recycle' -WhatIf $false + $r.VersionCountBefore | Should -Be 3 + $r.VersionsDeleted | Should -Be 2 + Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter { $uri -match 'recycleAll' } + } + + It 'uses deleteAll for permanent mode' { + $r = Remove-CIPPDriveItemVersion -TenantFilter 't' -DriveId 'D' -DriveItemId 'f' -CleanupMode 'permanent' -WhatIf $false + Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter { $uri -match 'deleteAll' } + $r.VersionsDeleted | Should -Be 2 + } + + It 'does not call SharePoint REST during WhatIf' { + $r = Remove-CIPPDriveItemVersion -TenantFilter 't' -DriveId 'D' -DriveItemId 'f' -CleanupMode 'recycle' -WhatIf $true + Should -Invoke New-GraphPOSTRequest -Times 0 + $r.VersionsDeleted | Should -Be 2 + } + + It 'does nothing when only the current version exists' { + Mock New-GraphGetRequest -ParameterFilter { $uri -match '/versions' } -MockWith { + @([PSCustomObject]@{ id = '1.0'; lastModifiedDateTime = '2024-01-01T00:00:00Z'; size = 100 }) + } + $r = Remove-CIPPDriveItemVersion -TenantFilter 't' -DriveId 'D' -DriveItemId 'f' -CleanupMode 'permanent' -WhatIf $false + $r.VersionsDeleted | Should -Be 0 + Should -Invoke New-GraphPOSTRequest -Times 0 + } +} + +Describe 'Invoke-CIPPSharePointImageOptimizer' { + BeforeEach { + $script:DownloadSize = 1000000 + $script:CompressedSize = 300000 + + Mock New-GraphGetRequest { @() } + Mock New-GraphGetRequest -ParameterFilter { $uri -match 'items/root/children' } -MockWith { New-RootListing } + Mock New-GraphGetRequest -ParameterFilter { $uri -match 'items/FOLDER1/children' } -MockWith { New-SubListing } + Mock New-GraphGetRequest -ParameterFilter { $uri -match 'downloadUrl' } -MockWith { + [PSCustomObject]@{ id = 'x'; name = 'x.jpg'; '@microsoft.graph.downloadUrl' = 'https://dl/x' } + } + Mock New-GraphGetRequest -ParameterFilter { $uri -match '/versions' } -MockWith { + @( + [PSCustomObject]@{ id = '3.0'; lastModifiedDateTime = '2024-03-01T00:00:00Z'; size = 100 } + [PSCustomObject]@{ id = '2.0'; lastModifiedDateTime = '2024-02-01T00:00:00Z'; size = 100 } + [PSCustomObject]@{ id = '1.0'; lastModifiedDateTime = '2024-01-01T00:00:00Z'; size = 100 } + ) + } + Mock New-GraphGetRequest -ParameterFilter { $uri -match 'sharepointIds' } -MockWith { + [PSCustomObject]@{ id = 'f'; sharepointIds = @{ siteUrl = 'https://c/sites/m'; listItemUniqueId = '11111111-1111-1111-1111-111111111111' } } + } + Mock Get-GraphToken { @{ access_token = 'token' } } + Mock Get-SharePointAdminLink { [PSCustomObject]@{ SharePointUrl = 'https://c' } } + Mock New-GraphPOSTRequest { $null } + Mock Start-Sleep {} + Mock Invoke-WebRequest { [System.IO.File]::WriteAllBytes($OutFile, [byte[]]::new($script:DownloadSize)) } + Mock Invoke-RestMethod { $null } + Mock Compress-CIPPImage { + [PSCustomObject]@{ Success = $true; Engine = 'Test'; OriginalBytes = $ImageBytes.Length; CompressedBytes = $script:CompressedSize; Data = [byte[]]::new($script:CompressedSize); Warning = $null; Error = $null } + } + } + + It 'audit mode returns only jpgs and never compresses' { + $r = Invoke-CIPPSharePointImageOptimizer -TenantFilter 't' -SiteId 'S' -DriveId 'D' -Mode 'Audit' -MinimumFileSizeMB 5 + $r.Summary.FilesScanned | Should -Be 5 + $r.Summary.EligibleFiles | Should -Be 3 + @($r.Results).Count | Should -Be 4 + Should -Invoke Compress-CIPPImage -Times 0 + Should -Invoke Invoke-RestMethod -Times 0 -ParameterFilter { $Method -eq 'PUT' } + } + + It 'WhatIf compress does not upload or delete versions' { + $r = Invoke-CIPPSharePointImageOptimizer -TenantFilter 't' -SiteId 'S' -DriveId 'D' -Mode 'CompressAndCleanup' -MinimumFileSizeMB 5 -WhatIf $true -VersionCleanupMode 'recycle' + $r.Summary.FilesCompressed | Should -Be 3 + Should -Invoke Invoke-RestMethod -Times 0 -ParameterFilter { $Method -eq 'PUT' } + Should -Invoke New-GraphPOSTRequest -Times 0 + ($r.Results | Where-Object { $_.Status -eq 'Compressed' }).Count | Should -Be 3 + } + + It 'skips files when the compressed result is larger than the original' { + $script:CompressedSize = 1200000 + $r = Invoke-CIPPSharePointImageOptimizer -TenantFilter 't' -SiteId 'S' -DriveId 'D' -Mode 'Compress' -MinimumFileSizeMB 5 -WhatIf $false + $r.Summary.FilesCompressed | Should -Be 0 + ($r.Results | Where-Object { $_.Status -eq 'Skipped: compression savings too small' }).Count | Should -Be 3 + Should -Invoke Invoke-RestMethod -Times 0 -ParameterFilter { $Method -eq 'PUT' } + } + + It 'respects the minimum savings percent' { + $script:CompressedSize = 950000 # only 5% savings, below default 15% + $r = Invoke-CIPPSharePointImageOptimizer -TenantFilter 't' -SiteId 'S' -DriveId 'D' -Mode 'Compress' -MinimumFileSizeMB 5 -MinimumSavingsPercent 15 -WhatIf $false + $r.Summary.FilesCompressed | Should -Be 0 + ($r.Results | Where-Object { $_.Status -eq 'Skipped: compression savings too small' }).Count | Should -Be 3 + } + + It 'uploads compressed files on a live Compress run without touching versions' { + $r = Invoke-CIPPSharePointImageOptimizer -TenantFilter 't' -SiteId 'S' -DriveId 'D' -Mode 'Compress' -MinimumFileSizeMB 5 -WhatIf $false + $r.Summary.FilesCompressed | Should -Be 3 + Should -Invoke Invoke-RestMethod -Times 3 -ParameterFilter { $Method -eq 'PUT' } + Should -Invoke New-GraphPOSTRequest -Times 0 + ($r.Results | Where-Object { $_.Status -eq 'Compressed' }).Count | Should -Be 3 + } + + It 'compresses and cleans versions on a live CompressAndCleanup run' { + $r = Invoke-CIPPSharePointImageOptimizer -TenantFilter 't' -SiteId 'S' -DriveId 'D' -Mode 'CompressAndCleanup' -MinimumFileSizeMB 5 -WhatIf $false -VersionCleanupMode 'recycle' + $r.Summary.FilesCompressed | Should -Be 3 + $r.Summary.VersionsDeleted | Should -Be 6 + Should -Invoke New-GraphPOSTRequest -Times 3 -ParameterFilter { $uri -match 'recycleAll' } + ($r.Results | Where-Object { $_.Status -eq 'Compressed and versions cleaned' }).Count | Should -Be 3 + } + + It 'returns a clear per-file error when upload is denied' { + Mock Invoke-RestMethod { throw 'Access denied (403)' } + $r = Invoke-CIPPSharePointImageOptimizer -TenantFilter 't' -SiteId 'S' -DriveId 'D' -Mode 'Compress' -MinimumFileSizeMB 5 -WhatIf $false + $r.Summary.FilesCompressed | Should -Be 0 + $r.Summary.Errors | Should -Be 3 + ($r.Results | Where-Object { $_.Status -eq 'Failed' -and $_.Error -match 'Upload failed' }).Count | Should -Be 3 + } + + It 'returns a successful empty result for an empty library' { + Mock New-GraphGetRequest -ParameterFilter { $uri -match 'items/root/children' } -MockWith { @() } + $r = Invoke-CIPPSharePointImageOptimizer -TenantFilter 't' -SiteId 'S' -DriveId 'D' -Mode 'Compress' -MinimumFileSizeMB 5 -WhatIf $false + $r.Summary.FilesScanned | Should -Be 0 + $r.Summary.EligibleFiles | Should -Be 0 + @($r.Results).Count | Should -Be 0 + } + + It 'scans only the chosen folder when FolderId is supplied' { + $r = Invoke-CIPPSharePointImageOptimizer -TenantFilter 't' -SiteId 'S' -DriveId 'D' -FolderId 'FOLDER1' -Mode 'Audit' -MinimumFileSizeMB 5 + $r.Summary.FilesScanned | Should -Be 1 + $r.Summary.EligibleFiles | Should -Be 1 + Should -Invoke New-GraphGetRequest -Times 0 -ParameterFilter { $uri -match 'items/root/children' } + } + + It 'resolves a FolderPath to a folder id before scanning' { + Mock New-GraphGetRequest -ParameterFilter { $uri -match 'root:/Sub' } -MockWith { + [PSCustomObject]@{ id = 'FOLDER1'; name = 'Sub'; folder = @{ childCount = 1 } } + } + $r = Invoke-CIPPSharePointImageOptimizer -TenantFilter 't' -SiteId 'S' -DriveId 'D' -FolderPath 'Sub' -Mode 'Audit' -MinimumFileSizeMB 5 + $r.Summary.FilesScanned | Should -Be 1 + $r.Folder | Should -Be 'Sub' + } +} + +Describe 'Get-CIPPSharePointFolderList' { + BeforeEach { + Mock New-GraphGetRequest { @() } + Mock New-GraphGetRequest -ParameterFilter { $uri -match 'items/root/children' } -MockWith { New-RootListing } + Mock New-GraphGetRequest -ParameterFilter { $uri -match 'items/FOLDER1/children' } -MockWith { New-SubListing } + } + + It 'returns folders with library-relative paths' { + $f = @(Get-CIPPSharePointFolderList -TenantFilter 't' -DriveId 'D') + $f.Count | Should -Be 1 + $f[0].path | Should -Be 'Sub' + $f[0].id | Should -Be 'FOLDER1' + } +} + +Describe 'Start-CIPPSharePointImageOptimizer' { + BeforeEach { + Mock Set-CippQueueTask { [PSCustomObject]@{ RowKey = 'task1' } } + Mock Update-CippQueueEntry {} + Mock Get-CippTable { @{ TableName = 'CacheImageOptimizer' } } + Mock Add-CIPPAzDataTableEntity {} + Mock Write-LogMessage {} + Mock Get-CippException { [PSCustomObject]@{ NormalizedError = $Exception.Exception.Message } } + Mock Invoke-CIPPSharePointImageOptimizer { + [PSCustomObject]@{ + Mode = 'Audit' + WhatIf = $true + Summary = [PSCustomObject]@{ FilesScanned = 2; EligibleFiles = 1; FilesCompressed = 0; FilesSkipped = 1; VersionsDeleted = 0; Errors = 0 } + Results = @() + Warnings = @() + } + } + } + + It 'runs the optimizer and caches a completed result' { + Start-CIPPSharePointImageOptimizer -QueueId 'q1' -TenantFilter 't' -SiteId 'S' -DriveId 'D' -Mode 'Audit' + Should -Invoke Invoke-CIPPSharePointImageOptimizer -Times 1 + Should -Invoke Add-CIPPAzDataTableEntity -Times 1 + Should -Invoke Update-CippQueueEntry -Times 1 -ParameterFilter { $Status -eq 'Completed' } + } + + It 'marks the queue failed and caches the error when the optimizer throws' { + Mock Invoke-CIPPSharePointImageOptimizer { throw 'boom' } + Start-CIPPSharePointImageOptimizer -QueueId 'q1' -TenantFilter 't' -SiteId 'S' -DriveId 'D' -Mode 'Audit' + Should -Invoke Update-CippQueueEntry -Times 1 -ParameterFilter { $Status -eq 'Failed' } + Should -Invoke Add-CIPPAzDataTableEntity -Times 1 + } +} diff --git a/backend/Tests/Extensions/Invoke-NinjaOneExtensionScheduler.Tests.ps1 b/backend/Tests/Extensions/Invoke-NinjaOneExtensionScheduler.Tests.ps1 index 82a88d7755..ea533e4005 100644 --- a/backend/Tests/Extensions/Invoke-NinjaOneExtensionScheduler.Tests.ps1 +++ b/backend/Tests/Extensions/Invoke-NinjaOneExtensionScheduler.Tests.ps1 @@ -10,6 +10,7 @@ BeforeAll { function Get-NinjaOneToken { param($Configuration) } function Start-CIPPOrchestrator { param($InputObject) } function Write-LogMessage { param($API, $message, $Sev, $tenant, $Headers) } + function Get-Tenants { param([switch]$IncludeErrors) } } Describe 'NinjaOne sync fan-out API check' { @@ -18,6 +19,7 @@ Describe 'NinjaOne sync fan-out API check' { Mock Add-AzDataTableEntity { } Mock Write-LogMessage { } Mock Start-CIPPOrchestrator { 'instance-1' } + Mock Get-Tenants { [pscustomobject]@{ customerId = 't1'; defaultDomainName = 'a.onmicrosoft.com' } } Mock Get-AzDataTableEntity { switch ($TableName) { 'NinjaOneSettings' { $script:Settings } @@ -88,4 +90,15 @@ Describe 'NinjaOne sync fan-out API check' { Should -Invoke Start-CIPPOrchestrator -Times 1 -Exactly -ParameterFilter { $InputObject.Batch.Count -eq 2 } } + + It 'names each queued tenant sync after its tenant, so the queue does not list them as unknown' { + Mock Get-NinjaOneToken { [pscustomobject]@{ access_token = 'tok' } } + + Invoke-NinjaOneExtensionScheduler + Invoke-NinjaOneSync + + Should -Invoke Start-CIPPOrchestrator -Times 2 -Exactly -ParameterFilter { + (@($InputObject.Batch.TenantFilter | Sort-Object) -join ',') -eq 'a.onmicrosoft.com,t2' + } + } } diff --git a/backend/Tests/GitHub/Push-CIPPBaselineToRepo.Tests.ps1 b/backend/Tests/GitHub/Push-CIPPBaselineToRepo.Tests.ps1 index 291d17d866..64494e5d99 100644 --- a/backend/Tests/GitHub/Push-CIPPBaselineToRepo.Tests.ps1 +++ b/backend/Tests/GitHub/Push-CIPPBaselineToRepo.Tests.ps1 @@ -64,10 +64,10 @@ Describe 'Push-CIPPBaselineToRepo' { $Rollout.LocalChanges | Should -Be $false } - It 'returns an error result when the baseline does not exist' { + It 'throws ItemNotFoundException when the baseline does not exist' { Mock -CommandName Export-CIPPBaselineTemplate -MockWith { $null } - $Result = Push-CIPPBaselineToRepo -GUID 'missing' -FullName 'Org/repo' -Message 'push it' -Branch 'main' - $Result.state | Should -Be 'error' + { Push-CIPPBaselineToRepo -GUID 'missing' -FullName 'Org/repo' -Message 'push it' -Branch 'main' } | + Should -Throw -ExceptionType ([System.Management.Automation.ItemNotFoundException]) -ExpectedMessage "Baseline 'missing' not found" Should -Invoke Add-CIPPAzDataTableEntity -Times 0 } diff --git a/backend/Tests/GitHub/Push-CIPPTemplateToRepo.Tests.ps1 b/backend/Tests/GitHub/Push-CIPPTemplateToRepo.Tests.ps1 index f9598af67a..34575a7675 100644 --- a/backend/Tests/GitHub/Push-CIPPTemplateToRepo.Tests.ps1 +++ b/backend/Tests/GitHub/Push-CIPPTemplateToRepo.Tests.ps1 @@ -57,10 +57,10 @@ Describe 'Push-CIPPTemplateToRepo' { $script:Written.ContainsKey('JSON') | Should -BeFalse } - It 'returns an error result and does not stamp when the template is not found' { + It 'throws ItemNotFoundException and does not stamp when the template is not found' { Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { $null } - $Result = Push-CIPPTemplateToRepo -GUID 'missing' -FullName 'Org/repo' -Message 'push it' -Branch 'main' - $Result.state | Should -Be 'error' + { Push-CIPPTemplateToRepo -GUID 'missing' -FullName 'Org/repo' -Message 'push it' -Branch 'main' } | + Should -Throw -ExceptionType ([System.Management.Automation.ItemNotFoundException]) -ExpectedMessage "Template 'missing' not found" Should -Invoke Add-CIPPAzDataTableEntity -Times 0 } diff --git a/backend/Tests/GraphHelper/New-CIPPMFAConnectorToken.Tests.ps1 b/backend/Tests/GraphHelper/New-CIPPMFAConnectorToken.Tests.ps1 index e34ac330e0..b5c9f2f573 100644 --- a/backend/Tests/GraphHelper/New-CIPPMFAConnectorToken.Tests.ps1 +++ b/backend/Tests/GraphHelper/New-CIPPMFAConnectorToken.Tests.ps1 @@ -62,6 +62,49 @@ Describe 'New-CIPPMFAConnectorToken secret caching' { Should -Invoke New-GraphPostRequest -Times 1 -Exactly Should -Invoke Add-CIPPAzDataTableEntity -Times 1 -Exactly } + + It 'surfaces the Entra error description when the token exchange keeps failing' { + Mock Get-CIPPAzDataTableEntity { $null } + Mock Start-Sleep {} + Mock Invoke-RestMethod { + $Record = [System.Management.Automation.ErrorRecord]::new([System.Exception]::new('Response status code does not indicate success: 400 (Bad Request).'), 'Token', 'InvalidOperation', $null) + $Record.ErrorDetails = [System.Management.Automation.ErrorDetails]::new('{"error":"invalid_request","error_description":"AADSTS53003: Access has been blocked by Conditional Access policies."}') + throw $Record + } + + { New-CIPPMFAConnectorToken -TenantFilter $script:TenantGuid } | Should -Throw -ExpectedMessage '*AADSTS53003*' + Should -Not -Invoke Add-CIPPAzDataTableEntity + } + + It 'names the disabled app and the baseline for , without reprovisioning or retrying' -TestCases @( + @{ Code = 'AADSTS7000112'; Expected = 'The Azure Multi-Factor Auth Client app (981f26a1-7f43-403b-a875-f8b09b8cd720) is disabled in this tenant. Enable it with the ''Azure MFA push notification apps'' baseline standard, or in Entra under Enterprise applications.' } + @{ Code = 'AADSTS500014'; Expected = 'The Azure Multi-Factor Auth Connector app (1f5530b3-261a-47a9-b357-ded261e17918) is disabled in this tenant. Enable it with the ''Azure MFA push notification apps'' baseline standard, or in Entra under Enterprise applications.' } + ) { + param($Code, $Expected) + Mock Get-CIPPAzDataTableEntity { [pscustomobject]@{ SecretValue = 'CACHEDSECRET' } } + Mock Start-Sleep {} + Mock Invoke-RestMethod { + $Record = [System.Management.Automation.ErrorRecord]::new([System.Exception]::new('400 (Bad Request).'), 'Token', 'InvalidOperation', $null) + $Record.ErrorDetails = [System.Management.Automation.ErrorDetails]::new((@{ error = 'unauthorized_client'; error_description = "${Code}: Application is disabled. Trace ID: abc Correlation ID: def Timestamp: 2026-10-06 04:15:04Z" } | ConvertTo-Json)) + throw $Record + } + + { New-CIPPMFAConnectorToken -TenantFilter $script:TenantGuid } | Should -Throw -ExpectedMessage $Expected + Should -Invoke Invoke-RestMethod -Times 1 -Exactly + Should -Not -Invoke New-GraphPostRequest + } + + It 'strips the Entra trace trailer from an unmapped error' { + Mock Get-CIPPAzDataTableEntity { $null } + Mock Start-Sleep {} + Mock Invoke-RestMethod { + $Record = [System.Management.Automation.ErrorRecord]::new([System.Exception]::new('400 (Bad Request).'), 'Token', 'InvalidOperation', $null) + $Record.ErrorDetails = [System.Management.Automation.ErrorDetails]::new('{"error":"invalid_request","error_description":"AADSTS53003: Access has been blocked by Conditional Access policies. Trace ID: abc\r\nCorrelation ID: def\r\nTimestamp: 2026-10-06 04:15:04Z"}') + throw $Record + } + + { New-CIPPMFAConnectorToken -TenantFilter $script:TenantGuid } | Should -Throw -ExpectedMessage 'Failed to get a token for the Azure Multi-Factor Auth Client app: AADSTS53003: Access has been blocked by Conditional Access policies.' + } } Describe 'New-CIPPMFAConnectorToken Key Vault (production) storage path' { diff --git a/backend/Tests/Mcp/Get-CippMcpToolCatalog.Tests.ps1 b/backend/Tests/Mcp/Get-CippMcpToolCatalog.Tests.ps1 index 265b541d15..897807be96 100644 --- a/backend/Tests/Mcp/Get-CippMcpToolCatalog.Tests.ps1 +++ b/backend/Tests/Mcp/Get-CippMcpToolCatalog.Tests.ps1 @@ -20,6 +20,9 @@ BeforeAll { # Get-CippMcpSpec reads $env:CIPPRootPath at runtime; the projection only needs a # parsed document, so it is stubbed per-test with whatever fixture is in play. function Get-CippMcpSpec { return $script:FixtureSpec } + # The caller's permissions; $null (no request context) leaves the catalog unfiltered + function Get-CippRequestAllowedPermissions { , $script:AllowedPermissions } + $script:AllowedPermissions = $null function Get-OperationFixture { param( @@ -364,3 +367,37 @@ Describe 'tool identity' { $Tools[0]._method | Should -Be 'POST' } } + +Describe 'listing only what the caller may run' { + BeforeAll { + Initialize-FixtureSpec -Paths @{ + '/api/ListUsers' = @{ get = (Get-OperationFixture -Role 'Identity.User.Read') } + '/api/ListMailbox' = @{ get = (Get-OperationFixture -Role 'Exchange.Mailbox.Read' -Tag 'Email-Exchange > Administration') } + } + } + AfterEach { $script:AllowedPermissions = $null } + + It 'keeps only tools whose role the caller holds' { + $script:AllowedPermissions = @('Identity.User.Read', 'Identity.User.ReadWrite') + (Get-ToolList).name | Should -Be @('ListUsers') + } + + It 'matches the role regardless of case' { + $script:AllowedPermissions = @('exchange.mailbox.read') + (Get-ToolList).name | Should -Be @('ListMailbox') + } + + It 'lists nothing for a caller whose roles grant nothing' { + $script:AllowedPermissions = @() + (Get-ToolList).Count | Should -Be 0 + } + + It 'is unfiltered outside a request' { + (Get-ToolList).Count | Should -Be 2 + } + + It 'never filters the unscoped catalog the gateway passthroughs use' { + $script:AllowedPermissions = @() + @(Get-CippMcpToolCatalog -InformationAction SilentlyContinue).Count | Should -Be 2 + } +} diff --git a/backend/Tests/Mcp/McpGateway.Tests.ps1 b/backend/Tests/Mcp/McpGateway.Tests.ps1 index 80b2c7e5b1..98dace7f3f 100644 --- a/backend/Tests/Mcp/McpGateway.Tests.ps1 +++ b/backend/Tests/Mcp/McpGateway.Tests.ps1 @@ -21,6 +21,9 @@ BeforeAll { } function Get-CippMcpSpec { return $script:FixtureSpec } + # The caller's permissions; $null (no request context) leaves the catalog unfiltered + function Get-CippRequestAllowedPermissions { , $script:AllowedPermissions } + $script:AllowedPermissions = $null function Initialize-FixtureSpec { param([hashtable]$Paths) diff --git a/backend/Tests/Private/Add-CIPPGroupMember.Tests.ps1 b/backend/Tests/Private/Add-CIPPGroupMember.Tests.ps1 index 8b76beacdd..5fa9839a7d 100644 --- a/backend/Tests/Private/Add-CIPPGroupMember.Tests.ps1 +++ b/backend/Tests/Private/Add-CIPPGroupMember.Tests.ps1 @@ -198,7 +198,7 @@ Describe 'Add-CIPPGroupMember' { $Result | Should -Be 'Successfully added Nested SG to group Contoso Group.' } - It 'reports both the successes and the failures of a mixed batch without throwing' { + It 'counts a member who is already in the group as a success' { Mock -CommandName New-GraphBulkRequest -MockWith { New-AddResponse -Results @( @{ id = 'user-1'; status = 204 } @@ -208,7 +208,7 @@ Describe 'Add-CIPPGroupMember' { $Result = Add-CIPPGroupMember -GroupType 'Security' -GroupId 'group-guid' -Member @('ok@contoso.com', 'bad@contoso.com') -TenantFilter 'contoso.com' - $Result | Should -Be 'Successfully added ok@contoso.com to group Contoso Group. Failed to add bad@contoso.com (One or more added object references already exist).' + $Result | Should -Be 'Successfully added ok@contoso.com, bad@contoso.com to group Contoso Group.' } It 'throws when every member of the batch failed' { diff --git a/backend/Tests/Private/Get-CIPPBecMessageTrace.Tests.ps1 b/backend/Tests/Private/Get-CIPPBecMessageTrace.Tests.ps1 index 416a014ba1..2ac12effd3 100644 --- a/backend/Tests/Private/Get-CIPPBecMessageTrace.Tests.ps1 +++ b/backend/Tests/Private/Get-CIPPBecMessageTrace.Tests.ps1 @@ -39,6 +39,19 @@ Describe 'Get-CIPPBecMessageTrace' { $script:Calls[0].Keys | Should -Not -Contain 'RecipientAddress' } + It 'splits a window longer than 10 days into 10-day queries, newest first' { + Mock New-ExoRequest { $script:Calls.Add(($cmdParams.Clone())); @(New-TraceRow -Index $script:Calls.Count) } + $End = [datetime]::new(2026, 8, 31, 0, 0, 0, [DateTimeKind]::Utc) + $Result = Get-CIPPBecMessageTrace -TenantFilter 'contoso.com' -SenderAddress 'user@contoso.com' -StartDate $End.AddDays(-25) -EndDate $End -PageSize 5 + $Result.Complete | Should -BeTrue + $Result.Rows.Count | Should -Be 3 + @($script:Calls | ForEach-Object { "$($_.StartDate)..$($_.EndDate)" }) | Should -Be @( + '2026-08-21T00:00:00..2026-08-31T00:00:00' + '2026-08-11T00:00:00..2026-08-21T00:00:00' + '2026-08-06T00:00:00..2026-08-11T00:00:00' + ) + } + It 'walks the cursor using the last row''s Received as EndDate and its recipient as StartingRecipientAddress' { Mock New-ExoRequest { $script:Calls.Add(($cmdParams.Clone())) diff --git a/backend/Tests/Private/Get-CIPPFeatureFlag.SuperAdminNG.Tests.ps1 b/backend/Tests/Private/Get-CIPPFeatureFlag.SuperAdminNG.Tests.ps1 new file mode 100644 index 0000000000..9934b2fbc5 --- /dev/null +++ b/backend/Tests/Private/Get-CIPPFeatureFlag.SuperAdminNG.Tests.ps1 @@ -0,0 +1,50 @@ +# CIPP-NG containers show Manage365 Users in the nav because ListFeatureFlags forces +# SuperAdminNG on. The request gate must use the same override, or ListCIPPUsers stays +# disabled while the page is visible. + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + + function Get-CippTable { param($TableName) @{ Context = $TableName } } + function Get-CIPPAzDataTableEntity { param($Context, $Filter, $Property) } + function Add-CIPPAzDataTableEntity { param($Context, $Entity, [switch]$Force) } + + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CIPPFeatureFlag.ps1') + + $ConfigDir = Join-Path $TestDrive 'Config' + New-Item -ItemType Directory -Path $ConfigDir -Force | Out-Null + @( + @{ Id = 'SuperAdminNG'; Name = 'Super Admin'; Description = 'Additional super admin pages'; Enabled = $false; AllowUserToggle = $false; Timers = @(); Endpoints = @('ListCIPPUsers'); Pages = @('/cipp/advanced/authentication/cipp-users'); Hidden = $true } + ) | ConvertTo-Json -Depth 5 -AsArray | Set-Content -Path (Join-Path $ConfigDir 'FeatureFlags.json') + $env:CIPPRootPath = $TestDrive +} + +Describe 'Get-CIPPFeatureFlag SuperAdminNG on CIPP-NG' { + BeforeEach { + Mock Add-CIPPAzDataTableEntity {} + Mock Get-CIPPAzDataTableEntity { + @([PSCustomObject]@{ PartitionKey = 'FeatureFlag'; RowKey = 'SuperAdminNG'; Enabled = $false }) + } + } + + AfterEach { + Remove-Item Env:CIPPNG -ErrorAction SilentlyContinue + } + + It 'enables the pages on a CIPP-NG container without rewriting the stored row' { + $env:CIPPNG = 'true' + + $Flag = Get-CIPPFeatureFlag -Id 'SuperAdminNG' + + $Flag.Enabled | Should -BeTrue + Should -Invoke Add-CIPPAzDataTableEntity -Times 0 -Exactly + } + + It 'keeps the stored off state when the container is not CIPP-NG' { + Remove-Item Env:CIPPNG -ErrorAction SilentlyContinue + + $Flag = Get-CIPPFeatureFlag -Id 'SuperAdminNG' + + $Flag.Enabled | Should -BeFalse + } +} diff --git a/backend/Tests/Private/Get-CIPPJITAdminApprovalRequirement.Tests.ps1 b/backend/Tests/Private/Get-CIPPJITAdminApprovalRequirement.Tests.ps1 new file mode 100644 index 0000000000..b2bb7d8b97 --- /dev/null +++ b/backend/Tests/Private/Get-CIPPJITAdminApprovalRequirement.Tests.ps1 @@ -0,0 +1,32 @@ +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + function Get-CIPPTable { param($TableName) @{ TableName = $TableName } } + function Get-CIPPAzDataTableEntity { param($TableName, $Filter) } + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CIPPJITAdminApprovalRequirement.ps1') + + $GlobalAdmin = '62e90394-69f5-4237-9190-012177145e10' + function New-Settings { + param([bool]$RequireApproval = $true, [string]$TriggerRoles = '[]') + [pscustomobject]@{ RequireApproval = $RequireApproval; ApprovalTriggerRoles = $TriggerRoles; ApproverRoles = '["admin","Approvers"]'; RequiredApprovals = 2 } + } +} + +Describe 'Get-CIPPJITAdminApprovalRequirement' { + It 'requires nothing when approval is off' { + Mock Get-CIPPAzDataTableEntity { New-Settings -RequireApproval $false } + Get-CIPPJITAdminApprovalRequirement -Roles @($GlobalAdmin) | Should -BeNullOrEmpty + } + + It 'requires approval for every request when no trigger roles are set' { + Mock Get-CIPPAzDataTableEntity { New-Settings } + $Requirement = Get-CIPPJITAdminApprovalRequirement -Roles @() + $Requirement.RequiredApprovals | Should -Be 2 + $Requirement.ApproverRoles | Should -Be @('admin', 'Approvers') + } + + It 'only requires approval when a trigger role is requested' { + Mock Get-CIPPAzDataTableEntity { New-Settings -TriggerRoles "[{`"label`":`"Global Administrator`",`"value`":`"$GlobalAdmin`"}]" } + Get-CIPPJITAdminApprovalRequirement -Roles @('other-role') | Should -BeNullOrEmpty + Get-CIPPJITAdminApprovalRequirement -Roles @('other-role', $GlobalAdmin) | Should -Not -BeNullOrEmpty + } +} diff --git a/backend/Tests/Private/Get-CIPPLapsPassword.Tests.ps1 b/backend/Tests/Private/Get-CIPPLapsPassword.Tests.ps1 new file mode 100644 index 0000000000..3156b9ef5f --- /dev/null +++ b/backend/Tests/Private/Get-CIPPLapsPassword.Tests.ps1 @@ -0,0 +1,29 @@ +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CIPPLAPSPassword.ps1') + + function New-GraphGetRequest { param($NoAuthCheck, $uri, $tenantid) } + function Write-LogMessage { param($headers, $API, $message, $Sev, $tenant, $LogData) } + function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = [string]$Exception.Exception.Message } } +} + +Describe 'Get-CIPPLapsPassword' { + It 'returns the credential when one exists' { + Mock New-GraphGetRequest { [pscustomobject]@{ credentials = @([pscustomobject]@{ accountName = 'Administrator'; passwordBase64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('secret')); BackupDateTime = '2026-09-01' }) } } + $Result = Get-CIPPLapsPassword -Device 'dev-1' -TenantFilter 'contoso.com' + $Result.state | Should -Be 'success' + $Result.copyField | Should -Be 'secret' + } + + It 'throws ItemNotFoundException when the device has no LAPS password' { + Mock New-GraphGetRequest { [pscustomobject]@{ credentials = @() } } + { Get-CIPPLapsPassword -Device 'dev-1' -TenantFilter 'contoso.com' } | Should -Throw 'No LAPS password found for dev-1' -ExceptionType ([System.Management.Automation.ItemNotFoundException]) + } + + It 'throws an untyped error when Graph fails' { + Mock New-GraphGetRequest { throw 'Forbidden' } + $Err = { Get-CIPPLapsPassword -Device 'dev-1' -TenantFilter 'contoso.com' } | Should -Throw 'Could not retrieve LAPS password for dev-1. Error: Forbidden' -PassThru + $Err.Exception | Should -Not -BeOfType ([System.Management.Automation.ItemNotFoundException]) + $Err.Exception | Should -Not -BeOfType ([System.ArgumentException]) + } +} diff --git a/backend/Tests/Private/Get-CIPPLicensePrice.Tests.ps1 b/backend/Tests/Private/Get-CIPPLicensePrice.Tests.ps1 index 92a273468c..e7d9c00255 100644 --- a/backend/Tests/Private/Get-CIPPLicensePrice.Tests.ps1 +++ b/backend/Tests/Private/Get-CIPPLicensePrice.Tests.ps1 @@ -173,3 +173,81 @@ Describe 'Get-CIPPLicensePrice - multi-currency' { (Get-CIPPLicensePrice -SkuId $script:E5 -Currency 'USD').Source | Should -Be 'Estimate' } } + +Describe 'Get-CIPPLicensePrice - SKU ID normalization' { + BeforeEach { + $script:DirtyE5 = "$($script:E5)$([char]0xA0)" + Mock -CommandName Test-Path -MockWith { $true } + Mock -CommandName Get-Content -MockWith { + "Product_Display_Name,String_Id,GUID`nOffice 365 E5,ENTERPRISEPREMIUM,$($script:DirtyE5)" + } + Mock -CommandName Get-CIPPLicenseCatalog -MockWith { + [pscustomobject]@{ + products = @( + [pscustomobject]@{ skuId = $script:DirtyE5; skuPartNumber = 'ENTERPRISEPREMIUM'; name = 'Office 365 E5'; prices = [pscustomobject]@{ GBP = 30.0 } } + ) + } + } + Mock -CommandName Get-CIPPTable -MockWith { @{ Context = 'fake' } } + Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { @() } + } + + It 'trims nonbreaking whitespace from the shipped SKU list, catalog, and lookup input' { + Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { + @([pscustomobject]@{ PartitionKey = 'Price'; RowKey = "$($script:DirtyE5)-gbp"; skuPartNumber = 'ENTERPRISEPREMIUM'; Product_Display_Name = 'Office 365 E5'; MonthlyPrice = 21.0; Currency = 'GBP' }) + } + + $Result = Get-CIPPLicensePrice -SkuId $script:DirtyE5 -Currency 'GBP' + $List = @(Get-CIPPLicensePrice -Currency 'GBP' -IncludeUnknown) + + $Result.skuId | Should -Be $script:E5 + $Result.MonthlyPrice | Should -Be 21.0 + $Result.Source | Should -Be 'Override' + $List.Count | Should -Be 1 + $List[0].skuId | Should -Be $script:E5 + } + + It 'trims nonbreaking whitespace from the stored skuId field' { + Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { + @([pscustomobject]@{ PartitionKey = 'Price'; RowKey = "$($script:E5)-gbp"; skuId = $script:DirtyE5; skuPartNumber = 'ENTERPRISEPREMIUM'; Product_Display_Name = 'Office 365 E5'; MonthlyPrice = 21.0; Currency = 'GBP' }) + } + + $Result = Get-CIPPLicensePrice -SkuId $script:E5 -Currency 'GBP' + + $Result.skuId | Should -Be $script:E5 + $Result.MonthlyPrice | Should -Be 21.0 + $Result.Source | Should -Be 'Override' + } +} + +Describe 'Get-CIPPLicensePrice - FailOnError' { + BeforeEach { + Mock -CommandName Test-Path -MockWith { $true } + Mock -CommandName Get-Content -MockWith { + "Product_Display_Name,String_Id,GUID`nOffice 365 E5,ENTERPRISEPREMIUM,$($script:E5)" + } + Mock -CommandName Get-CIPPLicenseCatalog -MockWith { + [pscustomobject]@{ products = @([pscustomobject]@{ skuId = $script:E5; skuPartNumber = 'ENTERPRISEPREMIUM'; name = 'Office 365 E5'; prices = [pscustomobject]@{ GBP = 30.0 } }) } + } + Mock -CommandName Get-CIPPTable -MockWith { @{ Context = 'fake' } } + Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { @() } + } + + It 'throws when the license catalog cannot be read' { + Mock -CommandName Get-CIPPLicenseCatalog -MockWith { Write-Error 'catalog unavailable' } + + { Get-CIPPLicensePrice -Currency 'GBP' -IncludeUnknown -FailOnError } | Should -Throw '*failed to read the license catalog*' + } + + It 'throws when license price overrides cannot be read' { + Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { Write-Error 'table unavailable' } + + { Get-CIPPLicensePrice -Currency 'GBP' -IncludeUnknown -FailOnError } | Should -Throw '*failed to read override table*' + } + + It 'throws when the SKU list is unavailable' { + Mock -CommandName Test-Path -MockWith { $false } + + { Get-CIPPLicensePrice -Currency 'GBP' -IncludeUnknown -FailOnError } | Should -Throw '*failed to read the SKU list*' + } +} diff --git a/backend/Tests/Private/Get-CippBulkStatusCode.Tests.ps1 b/backend/Tests/Private/Get-CippBulkStatusCode.Tests.ps1 new file mode 100644 index 0000000000..a69b5955d4 --- /dev/null +++ b/backend/Tests/Private/Get-CippBulkStatusCode.Tests.ps1 @@ -0,0 +1,16 @@ +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CippBulkStatusCode.ps1') +} + +Describe 'Get-CippBulkStatusCode' { + It 'returns for of failed' -ForEach @( + @{ Total = 3; Failed = 0; Expected = 'OK' } + @{ Total = 3; Failed = 1; Expected = 'MultiStatus' } + @{ Total = 3; Failed = 3; Expected = 'InternalServerError' } + @{ Total = 1; Failed = 1; Expected = 'InternalServerError' } + @{ Total = 0; Failed = 0; Expected = 'OK' } + ) { + Get-CippBulkStatusCode -Total $Total -Failed $Failed | Should -Be ([System.Net.HttpStatusCode]::$Expected) + } +} diff --git a/backend/Tests/Private/Get-CippErrorStatusCode.Tests.ps1 b/backend/Tests/Private/Get-CippErrorStatusCode.Tests.ps1 new file mode 100644 index 0000000000..0a08566db3 --- /dev/null +++ b/backend/Tests/Private/Get-CippErrorStatusCode.Tests.ps1 @@ -0,0 +1,27 @@ +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CippErrorStatusCode.ps1') + + function Get-CaughtStatus([scriptblock]$Thrower) { + try { & $Thrower } catch { Get-CippErrorStatusCode -ErrorRecord $_ } + } +} + +Describe 'Get-CippErrorStatusCode' { + It 'maps a typed ArgumentException thrown by a helper to 400' { + Get-CaughtStatus { throw [System.ArgumentException]::new('SiteUrl is required.') } | Should -Be ([System.Net.HttpStatusCode]::BadRequest) + } + + It 'maps an ItemNotFoundException to 404' { + Get-CaughtStatus { throw [System.Management.Automation.ItemNotFoundException]::new('Template not found') } | Should -Be ([System.Net.HttpStatusCode]::NotFound) + } + + It 'maps a plain string throw, as Graph helpers raise, to 500' { + Get-CaughtStatus { throw 'Graph returned 503' } | Should -Be ([System.Net.HttpStatusCode]::InternalServerError) + } + + It 'finds the typed exception when PowerShell wraps it' { + # A script block run through a .NET method surfaces as MethodInvocationException -> RuntimeException -> ArgumentException + Get-CaughtStatus { { throw [System.ArgumentException]::new('bad') }.Invoke() } | Should -Be ([System.Net.HttpStatusCode]::BadRequest) + } +} diff --git a/backend/Tests/Private/Get-CippRequestAllowedPermissions.Tests.ps1 b/backend/Tests/Private/Get-CippRequestAllowedPermissions.Tests.ps1 new file mode 100644 index 0000000000..35744390e7 --- /dev/null +++ b/backend/Tests/Private/Get-CippRequestAllowedPermissions.Tests.ps1 @@ -0,0 +1,67 @@ +# The caller's permissions are resolved once per request into a CIPPCore request-context slot that +# Initialize-CippRequestContext resets, so a worker reused for the next request never inherits them. +# Loaded as the real module and called from another one, the way CIPPHTTP's ExecMcp reaches it. + +BeforeAll { + $script:ModulesRoot = Join-Path (Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))) 'Modules' + Import-Module (Join-Path $script:ModulesRoot 'CIPPCore/CIPPCore.psd1') -Force 3>$null + $script:Core = Get-Module CIPPCore + + New-Module -Name PermissionProbeHttp -ScriptBlock { + function Invoke-PermissionProbe { , (Get-CippRequestAllowedPermissions) } + Export-ModuleMember -Function Invoke-PermissionProbe + } | Import-Module + + # What New-CippCoreRequest + Test-CIPPAccess leave behind for a request, run inside CIPPCore + function Enter-ProbeRequest($Roles) { + & $script:Core { + param($R) + Initialize-CippRequestContext + $script:CippAccessUserContext = if ($null -ne $R) { [pscustomobject]@{ User = 'probe'; Roles = @($R) } } else { $null } + } $Roles + } +} + +AfterAll { + Remove-Module PermissionProbeHttp, CIPPCore -Force -ErrorAction SilentlyContinue +} + +Describe 'Get-CippRequestAllowedPermissions' { + BeforeEach { + Mock -ModuleName CIPPCore Get-CippAllowedPermissions { @("$($UserRoles[0]).Perm.Read") } + } + + It 'resolves the permissions of the roles the access check found' { + Enter-ProbeRequest @('readonly') + Invoke-PermissionProbe | Should -Be @('readonly.Perm.Read') + Should -Invoke -ModuleName CIPPCore Get-CippAllowedPermissions -Times 1 -Exactly -ParameterFilter { $UserRoles -contains 'readonly' } + } + + It 'resolves once per request' { + Enter-ProbeRequest @('readonly') + $null = Invoke-PermissionProbe + $null = Invoke-PermissionProbe + Should -Invoke -ModuleName CIPPCore Get-CippAllowedPermissions -Times 1 -Exactly + } + + It 'does not carry one caller''s permissions into the next request' { + Enter-ProbeRequest @('superadmin') + $null = Invoke-PermissionProbe + Enter-ProbeRequest @('readonly') + Invoke-PermissionProbe | Should -Be @('readonly.Perm.Read') + } + + It 'returns an empty list, not $null, for a caller whose roles grant nothing' { + Enter-ProbeRequest @() + $Result = Invoke-PermissionProbe + $null -eq $Result | Should -BeFalse + @($Result).Count | Should -Be 0 + Should -Invoke -ModuleName CIPPCore Get-CippAllowedPermissions -Times 0 -Exactly + } + + It 'returns $null outside an authenticated request' { + Enter-ProbeRequest $null + Invoke-PermissionProbe | Should -BeNullOrEmpty + $null -eq (Invoke-PermissionProbe) | Should -BeTrue + } +} diff --git a/backend/Tests/Private/Import-CommunityTemplate.Tests.ps1 b/backend/Tests/Private/Import-CommunityTemplate.Tests.ps1 index a96af217e6..838dc41b2e 100644 --- a/backend/Tests/Private/Import-CommunityTemplate.Tests.ps1 +++ b/backend/Tests/Private/Import-CommunityTemplate.Tests.ps1 @@ -20,7 +20,7 @@ BeforeAll { function Get-RepoTemplate { param([string]$Description = 'Description from the repo') [PSCustomObject]@{ - RowKey = '7f3a91c2-4d1e-4b8a-9c3f-2e5d6a8b1f04' + RowKey = ('7f3a91c2' + '-4d1e-4b8a' + '-9c3f-2e5d' + '6a8b1f04') PartitionKey = 'IntuneTemplate' JSON = (@{ Displayname = 'Baseline'; Description = $Description } | ConvertTo-Json -Compress) } @@ -29,7 +29,7 @@ BeforeAll { function Get-RepoStandardsTemplate { param([string]$Description = 'Description from the repo') [PSCustomObject]@{ - RowKey = '9a1b2c3d-4e5f-6071-8293-a4b5c6d7e8f9' + RowKey = '9a1b2c3d' + '-4e5f-6071' + '-8293-a4b5' + 'c6d7e8f9' PartitionKey = 'StandardsTemplateV2' JSON = (@{ templateName = 'Baseline'; Description = $Description } | ConvertTo-Json -Compress) } @@ -42,7 +42,7 @@ Describe 'Import-CommunityTemplate direct-write path' { BeforeEach { Mock Get-CIPPAzDataTableEntity { [PSCustomObject]@{ - RowKey = '7f3a91c2-4d1e-4b8a-9c3f-2e5d6a8b1f04' + RowKey = ('7f3a91c2' + '-4d1e-4b8a' + '-9c3f-2e5d' + '6a8b1f04') PartitionKey = 'IntuneTemplate' SHA = 'abc123' JSON = (@{ Displayname = 'Baseline'; Description = 'Edited in CIPP' } | ConvertTo-Json -Compress) @@ -71,7 +71,7 @@ Describe 'Import-CommunityTemplate direct-write path' { It 'imports it' { Mock Get-CIPPAzDataTableEntity { [PSCustomObject]@{ - RowKey = '7f3a91c2-4d1e-4b8a-9c3f-2e5d6a8b1f04' + RowKey = ('7f3a91c2' + '-4d1e-4b8a' + '-9c3f-2e5d' + '6a8b1f04') PartitionKey = 'IntuneTemplate' SHA = 'abc123' JSON = (@{ Displayname = 'Baseline' } | ConvertTo-Json -Compress) @@ -98,7 +98,7 @@ Describe 'Import-CommunityTemplate direct-write path' { It 'stamps SourcePath when passed' { Mock Get-CIPPAzDataTableEntity { [PSCustomObject]@{ - RowKey = '7f3a91c2-4d1e-4b8a-9c3f-2e5d6a8b1f04' + RowKey = ('7f3a91c2' + '-4d1e-4b8a' + '-9c3f-2e5d' + '6a8b1f04') PartitionKey = 'IntuneTemplate' SHA = 'abc123' JSON = (@{ Displayname = 'Baseline' } | ConvertTo-Json -Compress) @@ -146,7 +146,7 @@ Describe 'Import-CommunityTemplate direct-write path' { It 'is kept when the repo file does not carry it' { Mock Get-CIPPAzDataTableEntity { [PSCustomObject]@{ - RowKey = '7f3a91c2-4d1e-4b8a-9c3f-2e5d6a8b1f04' + RowKey = ('7f3a91c2' + '-4d1e-4b8a' + '-9c3f-2e5d' + '6a8b1f04') PartitionKey = 'IntuneTemplate' SHA = 'abc123' Package = 'Baseline Package' diff --git a/backend/Tests/Private/Invoke-CIPPBecContainment.Tests.ps1 b/backend/Tests/Private/Invoke-CIPPBecContainment.Tests.ps1 index 92cdc58343..c646969696 100644 --- a/backend/Tests/Private/Invoke-CIPPBecContainment.Tests.ps1 +++ b/backend/Tests/Private/Invoke-CIPPBecContainment.Tests.ps1 @@ -215,6 +215,15 @@ Describe 'Invoke-CIPPBecContainment' { Should -Invoke Set-CIPPMobileDevice -Times 1 -ParameterFilter { $Quarantine -eq 'true' -and $DeviceId -eq 'dev-1' -and $Guid -eq 'guid-1' } } + It 'records a failed mobile device block as an error row and keeps going' { + Mock Set-CIPPMobileDevice { throw 'Failed to Block Active Sync Device for victim@contoso.com: denied' } + $Rows = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('BlockMobileDevices', 'ResetPassword') -Confirmed -RunResults $script:Run -Parameters @{ MobileDeviceIds = @('dev-1') } + $Row = $Rows | Where-Object { $_.Target -eq 'dev-1' } + $Row.state | Should -Be 'error' + $Row.resultText | Should -Match 'Failed to Block Active Sync Device' + Should -Invoke Set-CIPPResetPassword -Times 1 + } + It 'sets and clears the case log context' { $null = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('RevokeSessions') -CaseId 'BEC-9' Should -Invoke Set-CippBecCaseContext -Times 1 -ParameterFilter { $CaseId -eq 'BEC-9' } diff --git a/backend/Tests/Private/Invoke-CIPPPIMAssignmentAction.Tests.ps1 b/backend/Tests/Private/Invoke-CIPPPIMAssignmentAction.Tests.ps1 index f8e14f355e..a220a89608 100644 --- a/backend/Tests/Private/Invoke-CIPPPIMAssignmentAction.Tests.ps1 +++ b/backend/Tests/Private/Invoke-CIPPPIMAssignmentAction.Tests.ps1 @@ -80,7 +80,7 @@ Describe 'Invoke-CIPPPIMAssignmentAction' { It 'refuses on a tenant without Entra ID P2 and posts nothing' { Mock Test-CIPPStandardLicense { $false } - { Invoke-Convert } | Should -Throw '*not licensed for Entra ID P2*' + { Invoke-Convert } | Should -Throw '*not licensed for Entra ID P2*' -ExceptionType ([System.ArgumentException]) Should -Invoke New-GraphPOSTRequest -Times 0 -Exactly } @@ -90,7 +90,7 @@ Describe 'Invoke-CIPPPIMAssignmentAction' { if ($PrincipalId) { $Rows = $Rows | Where-Object { $_.PrincipalId -eq $PrincipalId } } @($Rows) } - { Invoke-Convert } | Should -Throw '*last active Global Administrator*' + { Invoke-Convert } | Should -Throw '*last active Global Administrator*' -ExceptionType ([System.ArgumentException]) Should -Invoke New-GraphPOSTRequest -Times 0 -Exactly } @@ -100,7 +100,7 @@ Describe 'Invoke-CIPPPIMAssignmentAction' { if ($PrincipalId) { $Rows = $Rows | Where-Object { $_.PrincipalId -eq $PrincipalId } } @($Rows) } - { Invoke-CIPPPIMAssignmentAction -TenantFilter 'contoso.onmicrosoft.com' -Action Remove -PrincipalId 'user-1' -RoleDefinitionId $script:GA -AssignmentType Permanent -Justification 'test' } | Should -Throw '*last active Global Administrator*' + { Invoke-CIPPPIMAssignmentAction -TenantFilter 'contoso.onmicrosoft.com' -Action Remove -PrincipalId 'user-1' -RoleDefinitionId $script:GA -AssignmentType Permanent -Justification 'test' } | Should -Throw '*last active Global Administrator*' -ExceptionType ([System.ArgumentException]) Should -Invoke New-GraphPOSTRequest -Times 0 -Exactly } @@ -140,14 +140,15 @@ Describe 'Invoke-CIPPPIMAssignmentAction' { It 'leaves the active assignment alone when the eligibility cannot be confirmed' { Mock New-GraphGetRequest { @() } - { Invoke-Convert } | Should -Throw '*could not be confirmed*' + $Err = { Invoke-Convert } | Should -Throw '*could not be confirmed*' -PassThru + $Err.Exception | Should -Not -BeOfType ([System.ArgumentException]) $script:Posts.Count | Should -Be 1 $script:Posts[0].Body.action | Should -Be 'adminAssign' } It 'refuses an eligibility lifetime above the policy cap instead of clamping it' { Mock Get-CIPPPIMRolePolicies { [pscustomobject]@{ RoleDefinitionId = $script:GA; PolicyId = 'pol'; Settings = [pscustomobject]@{ eligibilityMaxDuration = 'P180D'; activeAssignmentMaxDuration = 'P180D' } } } - { Invoke-Convert @{ Duration = 'P365D' } } | Should -Throw '*exceeds the maximum allowed*' + { Invoke-Convert @{ Duration = 'P365D' } } | Should -Throw '*exceeds the maximum allowed*' -ExceptionType ([System.ArgumentException]) Should -Invoke New-GraphPOSTRequest -Times 0 -Exactly } @@ -172,12 +173,12 @@ Describe 'Invoke-CIPPPIMAssignmentAction' { It 'applies the JIT admin maximum duration as a cap' { Mock Get-CIPPAzDataTableEntity { [pscustomobject]@{ MaxDuration = 'PT2H' } } Mock Get-CIPPPIMRoleAssignments { @((New-Row -Principal 'user-1' -Type 'Eligible'), (New-Row -Principal 'user-2')) | Where-Object { -not $PrincipalId -or $_.PrincipalId -eq $PrincipalId } } - { Invoke-CIPPPIMAssignmentAction -TenantFilter 'contoso.onmicrosoft.com' -Action GrantActive -PrincipalId 'user-1' -RoleDefinitionId $script:GA -AssignmentType Eligible -Duration 'PT4H' -Justification 'test' } | Should -Throw '*exceeds the maximum allowed*' + { Invoke-CIPPPIMAssignmentAction -TenantFilter 'contoso.onmicrosoft.com' -Action GrantActive -PrincipalId 'user-1' -RoleDefinitionId $script:GA -AssignmentType Eligible -Duration 'PT4H' -Justification 'test' } | Should -Throw '*exceeds the maximum allowed*' -ExceptionType ([System.ArgumentException]) Should -Invoke New-GraphPOSTRequest -Times 0 -Exactly } It 'refuses without an expiration' { - { Invoke-CIPPPIMAssignmentAction -TenantFilter 'contoso.onmicrosoft.com' -Action GrantActive -PrincipalId 'user-1' -RoleDefinitionId $script:GA -AssignmentType Eligible -Justification 'test' } | Should -Throw '*needs a Duration or EndDateTime*' + { Invoke-CIPPPIMAssignmentAction -TenantFilter 'contoso.onmicrosoft.com' -Action GrantActive -PrincipalId 'user-1' -RoleDefinitionId $script:GA -AssignmentType Eligible -Justification 'test' } | Should -Throw '*needs a Duration or EndDateTime*' -ExceptionType ([System.ArgumentException]) Should -Invoke New-GraphPOSTRequest -Times 0 -Exactly } diff --git a/backend/Tests/Private/New-CIPPMcpResourceApp.Tests.ps1 b/backend/Tests/Private/New-CIPPMcpResourceApp.Tests.ps1 index 2c96d96b76..3a4fcac6bd 100644 --- a/backend/Tests/Private/New-CIPPMcpResourceApp.Tests.ps1 +++ b/backend/Tests/Private/New-CIPPMcpResourceApp.Tests.ps1 @@ -107,4 +107,20 @@ Describe 'New-CIPPMcpResourceApp' { $uri -eq 'https://graph.microsoft.com/v1.0/applications' -and $type -eq 'POST' } } + + It 'retries the resource app patch when Entra has not replicated the new registration yet' { + $script:PatchAttempts = 0 + Mock -CommandName Start-Sleep -MockWith { } + Mock -CommandName New-GraphPOSTRequest -ParameterFilter { $type -eq 'PATCH' -and $uri -like '*/applications/res-obj' } -MockWith { + $script:PatchAttempts++ + if ($script:PatchAttempts -eq 1) { + throw "Resource '697d8170-d31c-4ef6-9807-549583c72e21' does not exist or one of its queried reference-property objects are not present." + } + } + + $Result = New-CIPPMcpResourceApp -Headers @{} + + $Result.AppId | Should -Be 'res-app' + $script:PatchAttempts | Should -Be 2 + } } diff --git a/backend/Tests/Private/New-CIPPOneDriveShortCut.Name.Tests.ps1 b/backend/Tests/Private/New-CIPPOneDriveShortCut.Name.Tests.ps1 new file mode 100644 index 0000000000..4993101e9a --- /dev/null +++ b/backend/Tests/Private/New-CIPPOneDriveShortCut.Name.Tests.ps1 @@ -0,0 +1,106 @@ +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'New-CIPPOneDriveShortCut.ps1' -File | + Select-Object -First 1 -ExpandProperty FullName + if (-not $FunctionPath) { throw 'Could not locate New-CIPPOneDriveShortCut.ps1 under Modules/' } + + function Get-CIPPSPOTenant { param($TenantFilter) } + function New-GraphGetRequest { param($uri, $tenantid, $asapp) } + function New-GraphPOSTRequest { param($uri, $body, $type, $tenantid, $asapp) } + function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) } + function Get-CippException { param($Exception) @{ NormalizedError = "$($Exception.Exception.Message)" } } + . $FunctionPath +} + +Describe 'New-CIPPOneDriveShortCut shortcut name' { + BeforeEach { + Mock Get-CIPPSPOTenant { [pscustomobject]@{ DisableAddToOneDrive = $false } } + Mock Write-LogMessage { } + Mock New-GraphPOSTRequest { if ($type -ne 'PATCH') { [pscustomobject]@{ id = 'new1'; name = 'Sales - Documents' } } } + Mock New-GraphGetRequest { + if ($uri -match '/drives\?') { return @([pscustomobject]@{ id = 'd1'; name = 'Documents'; webUrl = 'https://contoso.sharepoint.com/sites/Sales/Shared Documents' }) } + if ($uri -match '/drives/d1/root\?') { return [pscustomobject]@{ id = 'item1'; name = 'root' } } + [pscustomobject]@{ id = 's1'; displayName = 'Sales'; webUrl = 'https://contoso.sharepoint.com/sites/Sales' } + } + } + + BeforeAll { + function Invoke-Shortcut { + param($Name, $Url = 'https://contoso.sharepoint.com/sites/Sales/Shared Documents') + New-CIPPOneDriveShortCut -Username 'a@contoso.com' -UserId 'u1' -URL $Url -TenantFilter 'contoso.com' -ShortcutName $Name + } + } + + It 'uses the custom name as the body name and in the result' { + $Result = Invoke-Shortcut -Name 'Team Docs' + $Result | Should -Match 'called Team Docs in' + Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter { ($body | ConvertFrom-Json).name -eq 'Team Docs' } + } + + It 'uses the custom name for a site-root shortcut' { + $null = Invoke-Shortcut -Name 'Sales Site' -Url 'https://contoso.sharepoint.com/sites/Sales' + Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter { ($body | ConvertFrom-Json).name -eq 'Sales Site' } + } + + It 'keeps the derived name when blank or whitespace' { + foreach ($Blank in @($null, '', ' ')) { + $Result = Invoke-Shortcut -Name $Blank + $Result | Should -Match 'called Sales - Documents in' + } + Should -Invoke New-GraphPOSTRequest -Times 3 -ParameterFilter { ($body | ConvertFrom-Json).name -eq 'Documents' } + } + + It 'rejects without calling Graph' -ForEach @( + @{ Why = 'a forbidden character'; Name = 'a:b'; Match = 'cannot contain' } + @{ Why = 'a quote'; Name = 'a"b'; Match = 'cannot contain' } + @{ Why = 'a backslash'; Name = 'a\b'; Match = 'cannot contain' } + @{ Why = 'a slash'; Name = 'a/b'; Match = 'cannot contain' } + @{ Why = 'a pipe'; Name = 'a|b'; Match = 'cannot contain' } + @{ Why = 'an asterisk'; Name = 'a*b'; Match = 'cannot contain' } + @{ Why = 'a question mark'; Name = 'a?b'; Match = 'cannot contain' } + @{ Why = 'angle brackets'; Name = 'a'; Match = 'cannot contain' } + @{ Why = 'a leading space'; Name = ' ab'; Match = 'start or end with a space' } + @{ Why = 'a trailing space'; Name = 'ab '; Match = 'start or end with a space' } + @{ Why = 'a trailing period'; Name = 'ab.'; Match = 'end with a period' } + @{ Why = '256 characters'; Name = ('a' * 256); Match = '255 characters' } + ) { + { Invoke-Shortcut -Name $Name } | Should -Throw "*$Match*" + Should -Invoke New-GraphPOSTRequest -Times 0 + Should -Invoke New-GraphGetRequest -Times 0 + } + + It 'accepts a 255 character name and a mid-name period' { + { Invoke-Shortcut -Name ('a' * 255) } | Should -Not -Throw + { Invoke-Shortcut -Name 'v1.2 docs' } | Should -Not -Throw + } + + Context 'rename after create' { + It 'PATCHes the created item when OneDrive changed the name' { + $Result = Invoke-Shortcut -Name 'Team Docs' + Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter { + $type -eq 'PATCH' -and $uri -match '/users/a@contoso.com/drive/items/new1$' -and ($body | ConvertFrom-Json).name -eq 'Team Docs' + } + $Result | Should -Match 'called Team Docs in' + } + + It 'does not PATCH when the created name already matches' { + Mock New-GraphPOSTRequest { if ($type -ne 'PATCH') { [pscustomobject]@{ id = 'new1'; name = 'Team Docs' } } } + $null = Invoke-Shortcut -Name 'Team Docs' + Should -Invoke New-GraphPOSTRequest -Times 0 -ParameterFilter { $type -eq 'PATCH' } + } + + It 'does not PATCH for a blank name and reports the name OneDrive stored' { + $Result = Invoke-Shortcut -Name '' + Should -Invoke New-GraphPOSTRequest -Times 0 -ParameterFilter { $type -eq 'PATCH' } + $Result | Should -Match 'called Sales - Documents in' + } + + It 'keeps the shortcut and warns when the rename fails' { + Mock New-GraphPOSTRequest { if ($type -eq 'PATCH') { throw 'nameAlreadyExists' } else { [pscustomobject]@{ id = 'new1'; name = 'Sales - Documents' } } } + $Result = $null + { $script:Result = Invoke-Shortcut -Name 'Team Docs' } | Should -Not -Throw + $script:Result | Should -Match 'called Sales - Documents in.*renaming it to Team Docs failed: nameAlreadyExists' + Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $Sev -eq 'Warning' } + } + } +} diff --git a/backend/Tests/Private/New-CippCustomScriptExecution.Tests.ps1 b/backend/Tests/Private/New-CippCustomScriptExecution.Tests.ps1 new file mode 100644 index 0000000000..5820f139aa --- /dev/null +++ b/backend/Tests/Private/New-CippCustomScriptExecution.Tests.ps1 @@ -0,0 +1,46 @@ +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/New-CippCustomScriptExecution.ps1') + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CippErrorStatusCode.ps1') + + function Get-CippTable { param($tablename) @{ Context = 'ctx' } } + function Get-CIPPAzDataTableEntity { param($Context, $Filter) } + function Get-CIPPTextReplacement { param($TenantFilter, $Text) $Text } + function Test-CustomScriptSecurity { param($ScriptContent) } + function Get-CippSandboxData { param($ScriptContent, $TenantFilter) } + function Invoke-CippSandboxScript { param($ScriptContent, $SandboxData, $ScriptParameters) } + function Write-LogMessage { param($API, $tenant, $message, $sev) } + + function Get-CaughtStatus([scriptblock]$Thrower) { + try { & $Thrower } catch { [int](Get-CippErrorStatusCode -ErrorRecord $_) } + } +} + +Describe 'New-CippCustomScriptExecution error contract' { + BeforeEach { + Mock Get-CIPPAzDataTableEntity { [pscustomobject]@{ ScriptGuid = 'g'; Version = 1; ScriptContent = 'Get-Thing' } } + } + + It 'throws ItemNotFoundException (404) when the script does not exist' { + Mock Get-CIPPAzDataTableEntity { $null } + { New-CippCustomScriptExecution -ScriptGuid 'missing' -TenantFilter 't' } | + Should -Throw -ExceptionType ([System.Management.Automation.ItemNotFoundException]) -ExpectedMessage "Script with GUID 'missing' not found" + Get-CaughtStatus { New-CippCustomScriptExecution -ScriptGuid 'missing' -TenantFilter 't' } | Should -Be 404 + } + + It 'throws ArgumentException (400) with the same message when the script fails the security check' { + Mock Test-CustomScriptSecurity { throw "Security violation at line 1: Command 'Remove-Item' is not in the allowed list." } + { New-CippCustomScriptExecution -ScriptGuid 'g' -TenantFilter 't' } | + Should -Throw -ExceptionType ([System.ArgumentException]) -ExpectedMessage "Security violation at line 1: Command 'Remove-Item' is not in the allowed list." + } + + It 'keeps an execution failure as a plain error (500)' { + Mock Invoke-CippSandboxScript { [pscustomobject]@{ Output = $null; Errors = @('boom'); Terminating = $true; HadErrors = $true } } + Get-CaughtStatus { New-CippCustomScriptExecution -ScriptGuid 'g' -TenantFilter 't' } | Should -Be 500 + } + + It 'returns the script output on success' { + Mock Invoke-CippSandboxScript { [pscustomobject]@{ Output = @('row'); Errors = @(); Terminating = $false; HadErrors = $false } } + New-CippCustomScriptExecution -ScriptGuid 'g' -TenantFilter 't' | Should -Be 'row' + } +} diff --git a/backend/Tests/Private/New-ExoBulkRequest.Tests.ps1 b/backend/Tests/Private/New-ExoBulkRequest.Tests.ps1 new file mode 100644 index 0000000000..45def82dd5 --- /dev/null +++ b/backend/Tests/Private/New-ExoBulkRequest.Tests.ps1 @@ -0,0 +1,50 @@ +# Mailbox-store writes (e.g. Set-Mailbox -DefaultAuditSet) fail with CmdletProxyNotAvailableException +# unless the POST is routed to the mailbox's own server, and a $batch routes as a whole. + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + Add-Type -Path (Join-Path $RepoRoot 'Shared/CIPPSharp/bin/CIPPSharp.dll') + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/GraphHelper/New-ExoBulkRequest.ps1') + + function Get-AuthorisedRequest { param($TenantID) $true } + function Get-GraphToken { param($Tenantid, $scope, $AsApp) @{ Authorization = 'Bearer x' } } + function Get-Tenants { param([switch]$IncludeErrors, $TenantFilter) [PSCustomObject]@{ customerId = 'cid'; initialDomainName = 'contoso.onmicrosoft.com' } } + function Get-CIPPTextReplacement { param($TenantFilter, $Text) $Text } + function Invoke-CIPPRestMethod { param($Uri, $Method, $Body, $Headers, $ContentType, $TimeoutSec, $ResponseHeadersVariable) } + + $script:Cmdlets = foreach ($Upn in 'a@contoso.com', 'b@contoso.com') { + @{ CmdletInput = @{ CmdletName = 'Set-Mailbox'; Parameters = @{ Identity = $Upn } }; OperationGuid = $Upn } + } + $script:Respond = { param($Body, $Status) @{ responses = @(($Body | ConvertFrom-Json).requests | ForEach-Object { [PSCustomObject]@{ id = $_.id; status = $Status; body = [PSCustomObject]@{} } }) } } +} + +Describe 'New-ExoBulkRequest -AnchorPerMailbox' { + BeforeEach { + $script:Posts = [System.Collections.Generic.List[object]]::new() + $script:Throttle = $false + Mock Start-Sleep {} + Mock Invoke-CIPPRestMethod { + $script:Posts.Add(@{ Anchor = $Headers['X-AnchorMailbox']; Size = @(($Body | ConvertFrom-Json).requests).Count }) + $Status = if ($script:Throttle -and $script:Posts.Count -eq 1) { 429 } else { 200 } + & $script:Respond $Body $Status + } + } + + It 'sends one POST per cmdlet, each routed to its own mailbox' { + $null = New-ExoBulkRequest -tenantid 'contoso.onmicrosoft.com' -cmdletArray @($script:Cmdlets) -AnchorPerMailbox + $script:Posts.Anchor | Should -Be @('UPN:a@contoso.com', 'UPN:b@contoso.com') + $script:Posts.Size | Should -Be @(1, 1) + } + + It 'retries a throttled cmdlet routed to the same mailbox' { + $script:Throttle = $true + $null = New-ExoBulkRequest -tenantid 'contoso.onmicrosoft.com' -cmdletArray @($script:Cmdlets) -AnchorPerMailbox + $script:Posts.Anchor | Should -Be @('UPN:a@contoso.com', 'UPN:b@contoso.com', 'UPN:a@contoso.com') + } + + It 'keeps the default: one system-mailbox-routed batch' { + $null = New-ExoBulkRequest -tenantid 'contoso.onmicrosoft.com' -cmdletArray @($script:Cmdlets) + $script:Posts.Size | Should -Be @(2) + $script:Posts[0].Anchor | Should -BeLike 'APP:SystemMailbox*' + } +} diff --git a/backend/Tests/Private/Set-CIPPMCPClientApp.Tests.ps1 b/backend/Tests/Private/Set-CIPPMCPClientApp.Tests.ps1 index efdb0545a6..a5e315bc5f 100644 --- a/backend/Tests/Private/Set-CIPPMCPClientApp.Tests.ps1 +++ b/backend/Tests/Private/Set-CIPPMCPClientApp.Tests.ps1 @@ -16,7 +16,7 @@ BeforeAll { . $FunctionPath $script:GraphResourceId = '00000003-0000-0000-c000-000000000000' - $script:OfflineAccess = '7427e0e9-2fba-42fe-b0c0-848c9e6a8182' + $script:OfflineAccess = '7427e0e9-2fba-42fe-b0c0-' + '848c9e6a8182' } Describe 'Set-CIPPMCPClientApp' { @@ -120,4 +120,52 @@ Describe 'Set-CIPPMCPClientApp' { $Result = Set-CIPPMCPClientApp -AppId $script:AppId -Headers @{} $Result.Success | Should -BeTrue } + + It 'drops a required permission whose app no longer has a service principal' { + Mock -CommandName New-GraphGetRequest -MockWith { + [PSCustomObject]@{ + id = $script:AppObjectId + appId = $script:AppId + identifierUris = @("api://$script:AppId") + web = [PSCustomObject]@{ redirectUris = @() } + spa = [PSCustomObject]@{ redirectUris = @() } + publicClient = [PSCustomObject]@{ redirectUris = @() } + requiredResourceAccess = @( + [PSCustomObject]@{ + resourceAppId = 'gone-app' + resourceAccess = @([PSCustomObject]@{ id = 'stale-scope'; type = 'Scope' }) + } + ) + } + } + Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*servicePrincipals(appId=''gone-app'')*' } -MockWith { + throw "Resource 'gone-app' does not exist or one of its queried reference-property objects are not present." + } + + Set-CIPPMCPClientApp -AppId $script:AppId -Headers @{} + + Should -Invoke -CommandName New-GraphPOSTRequest -ParameterFilter { + $type -eq 'PATCH' -and + $( + $Rra = @(($body | ConvertFrom-Json).requiredResourceAccess) + -not ($Rra.resourceAppId -contains 'gone-app') + ) + } + } + + It 'retries the client patch when Entra has not replicated the app yet' { + $script:PatchAttempts = 0 + Mock -CommandName Start-Sleep -MockWith { } + Mock -CommandName New-GraphPOSTRequest -ParameterFilter { $type -eq 'PATCH' } -MockWith { + $script:PatchAttempts++ + if ($script:PatchAttempts -eq 1) { + throw "Resource '697d8170-d31c-4ef6-9807-549583c72e21' does not exist or one of its queried reference-property objects are not present." + } + } + + $Result = Set-CIPPMCPClientApp -AppId $script:AppId -Headers @{} + + $Result.Success | Should -BeTrue + $script:PatchAttempts | Should -Be 2 + } } diff --git a/backend/Tests/Private/Set-CIPPMobileDevice.Tests.ps1 b/backend/Tests/Private/Set-CIPPMobileDevice.Tests.ps1 new file mode 100644 index 0000000000..0687d2911d --- /dev/null +++ b/backend/Tests/Private/Set-CIPPMobileDevice.Tests.ps1 @@ -0,0 +1,24 @@ +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Set-CIPPMobileDevice.ps1') + + function New-ExoRequest { param($tenant, $tenantid, $cmdlet, $cmdParams, $UseSystemMailbox) } + function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) } + function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = [string]$Exception.Exception.Message } } +} + +Describe 'Set-CIPPMobileDevice' { + It 'returns the success message when Exchange accepts the change' { + Mock New-ExoRequest { } + Set-CIPPMobileDevice -UserId 'user@contoso.com' -DeviceId 'dev-1' -Quarantine 'true' -TenantFilter 'contoso.com' | Should -Be 'Blocked Active Sync Device for user@contoso.com' + } + + It 'throws the failure message instead of returning it: ' -ForEach @( + @{ Name = 'block'; Params = @{ Quarantine = 'true' }; Message = 'Failed to Block Active Sync Device for user@contoso.com: denied' } + @{ Name = 'allow'; Params = @{ Quarantine = 'false' }; Message = 'Failed to Allow Active Sync Device for user@contoso.com: denied' } + @{ Name = 'delete'; Params = @{ Delete = 'true'; Guid = 'guid-1' }; Message = 'Failed to delete Mobile Device guid-1: denied' } + ) { + Mock New-ExoRequest { throw 'denied' } + { Set-CIPPMobileDevice -UserId 'user@contoso.com' -DeviceId 'dev-1' -TenantFilter 'contoso.com' @Params } | Should -Throw $Message + } +} diff --git a/backend/Tests/Private/Set-CIPPSPOTenant.Tests.ps1 b/backend/Tests/Private/Set-CIPPSPOTenant.Tests.ps1 new file mode 100644 index 0000000000..10d12885ba --- /dev/null +++ b/backend/Tests/Private/Set-CIPPSPOTenant.Tests.ps1 @@ -0,0 +1,43 @@ +# Pester tests for Set-CIPPSPOTenant: CSOM rejects a write with HTTP 200 and ErrorInfo in the body. + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Set-CIPPSPOTenant.ps1' -File -ErrorAction SilentlyContinue | + Select-Object -First 1 -ExpandProperty FullName + if (-not $FunctionPath) { throw 'Could not locate Set-CIPPSPOTenant.ps1 under Modules/' } + + function Get-SharePointAdminLink { param($Public, $tenantFilter) } + function New-GraphPostRequest { param($scope, $tenantid, $Uri, $Type, $Body, $ContentType, $AddedHeaders, $AsApp, $UseCertificate) } + function Get-CIPPTable { param($tablename) } + function ConvertTo-CIPPODataFilterValue { param($Value, $Type) $Value } + function Get-CIPPAzDataTableEntity { param($Filter) } + function Remove-CIPPAzDataTableEntity { param($Entity) } + + . $FunctionPath + + $script:State = [pscustomobject]@{ _ObjectIdentity_ = 'id'; TenantFilter = 'contoso.onmicrosoft.com'; SharepointPrefix = 'contoso'; SharepointDomain = 'sharepoint.com' } + $script:Params = @(@{ Type = 'Boolean'; Value = $false }, @{ Type = 'Int32'; Value = 100 }, @{ Type = 'Int32'; Value = 5 }) +} + +Describe 'Set-CIPPSPOTenant' { + BeforeEach { + Mock -CommandName Get-CIPPTable -MockWith { @{} } + Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { [pscustomobject]@{ RowKey = 'contoso.onmicrosoft.com' } } + Mock -CommandName Remove-CIPPAzDataTableEntity -MockWith { } + } + + It 'throws the CSOM error when SharePoint rejects the write' { + Mock -CommandName New-GraphPostRequest -MockWith { + @([pscustomobject]@{ SchemaVersion = '15.0.0.0'; ErrorInfo = [pscustomobject]@{ ErrorMessage = 'The value of ExpireVersionsAfterDays must be set to 0' } }) + } + { $script:State | Set-CIPPSPOTenant -MethodName 'SetFileVersionPolicy' -MethodParameters $script:Params } | Should -Throw '*ExpireVersionsAfterDays must be set to 0*' + Should -Invoke -CommandName Remove-CIPPAzDataTableEntity -Times 0 -Exactly + } + + It 'returns the response and clears the cache on success' { + Mock -CommandName New-GraphPostRequest -MockWith { @([pscustomobject]@{ SchemaVersion = '15.0.0.0'; ErrorInfo = $null }) } + $R = $script:State | Set-CIPPSPOTenant -Properties @{ EmailAttestationRequired = $true } + $R.SchemaVersion | Should -Be '15.0.0.0' + Should -Invoke -CommandName Remove-CIPPAzDataTableEntity -Times 1 -Exactly + } +} diff --git a/backend/Tests/Private/Set-CIPPSharePointPerms.Tests.ps1 b/backend/Tests/Private/Set-CIPPSharePointPerms.Tests.ps1 new file mode 100644 index 0000000000..c821171703 --- /dev/null +++ b/backend/Tests/Private/Set-CIPPSharePointPerms.Tests.ps1 @@ -0,0 +1,50 @@ +# Pester tests for Set-CIPPSharePointPerms: one countable { resultText, state } item per user + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $FunctionPath = Join-Path $RepoRoot 'Modules/CIPPCore/Public/Set-CIPPSharePointPerms.ps1' + if (-not (Test-Path $FunctionPath)) { throw "Could not locate $FunctionPath" } + + function New-GraphGetRequest { param($uri, $asapp, $tenantid) } + function New-GraphPostRequest { param($uri, $tenantid, $scope, $type, $body, $AddedHeaders, $ContentType, [switch]$UseCertificate, $AsApp) } + function Resolve-CIPPSharePointPermissionScope { param($SiteUrl, $TenantFilter) } + function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = $Exception.Exception.Message } } + function Get-CIPPSharePointErrorMessage { param($ErrorMessage) $ErrorMessage } + function Write-LogMessage { param($headers, $API, $message, $Sev, $tenant, $LogData) } + + . $FunctionPath +} + +Describe 'Set-CIPPSharePointPerms' { + BeforeEach { + Mock Resolve-CIPPSharePointPermissionScope { [pscustomobject]@{ BaseUri = "$SiteUrl/_api"; Scope = 'scope'; Headers = @{} } } + Mock New-GraphPostRequest { + if ($uri -like '*/ensureuser') { + if ($body -like '*bad@contoso.com*') { throw 'User not found' } + return [pscustomobject]@{ Id = 7 } + } + } + } + + It 'returns a success and an error item when one of two users fails' { + $Results = @(Set-CIPPSharePointPerms -TenantFilter 'contoso.com' -URL 'https://contoso.sharepoint.com/sites/hr' -OnedriveAccessUser @('good@contoso.com', 'bad@contoso.com')) + + $Results.Count | Should -Be 2 + $Results[0].state | Should -Be 'success' + $Results[0].resultText | Should -Be 'Successfully added good@contoso.com as a site collection admin of https://contoso.sharepoint.com/sites/hr' + $Results[1].state | Should -Be 'error' + $Results[1].resultText | Should -BeLike 'Failed to change access for bad@contoso.com on https://contoso.sharepoint.com/sites/hr - *' + } + + It 'throws ArgumentException when no user is supplied' { + { Set-CIPPSharePointPerms -TenantFilter 'contoso.com' -URL 'https://contoso.sharepoint.com/sites/hr' -OnedriveAccessUser @('') } | + Should -Throw -ExceptionType ([System.ArgumentException]) -ExpectedMessage 'No valid user was supplied to grant or remove OneDrive access for.' + } + + It 'throws ItemNotFoundException when the user has no OneDrive' { + Mock New-GraphGetRequest { [pscustomobject]@{ sharepointIds = @{} } } + + { Set-CIPPSharePointPerms -TenantFilter 'contoso.com' -UserId 'user@contoso.com' -OnedriveAccessUser 'admin@contoso.com' } | + Should -Throw -ExceptionType ([System.Management.Automation.ItemNotFoundException]) -ExpectedMessage 'Failed to process SharePoint permissions. Error: Could not determine the OneDrive site URL for user@contoso.com*' + } +} diff --git a/backend/Tests/Private/Set-CIPPUserJITAdmin.Approval.Tests.ps1 b/backend/Tests/Private/Set-CIPPUserJITAdmin.Approval.Tests.ps1 new file mode 100644 index 0000000000..5263d1ffb6 --- /dev/null +++ b/backend/Tests/Private/Set-CIPPUserJITAdmin.Approval.Tests.ps1 @@ -0,0 +1,47 @@ +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + function Get-CIPPTable { param($TableName) @{ TableName = $TableName } } + function Get-CIPPAzDataTableEntity { param($TableName, $Filter) } + function Get-CIPPJITAdminApprovalRequirement { param($Roles) } + function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) } + . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1') + + $RequestId = '11111111-1111-1111-1111-111111111111' + $Role = '62e90394-69f5-4237-9190-012177145e10' + $Grant = @{ TenantFilter = 'contoso.com'; User = @{ UserPrincipalName = 'jit@contoso.com' }; Roles = @($Role); Action = 'AddRoles' } +} + +Describe 'Set-CIPPUserJITAdmin approval guard' { + BeforeEach { + Mock Get-CIPPJITAdminApprovalRequirement { [pscustomobject]@{ ApproverRoles = @('admin'); RequiredApprovals = 1 } } + Mock Get-CIPPAzDataTableEntity { + [pscustomobject]@{ State = 'Completed'; Tenant = 'contoso.com'; TargetUser = 'jit@contoso.com'; RoleIds = "[`"$Role`"]"; GroupIds = '[]' } + } + } + + It 'blocks an elevation with no approved request' { + { Set-CIPPUserJITAdmin @Grant -WhatIf } | Should -Throw '*no approved JIT Admin request*' + } + + It 'blocks an elevation that adds roles beyond the approved request' { + $Wider = $Grant.Clone(); $Wider.Roles = @($Role, 'other-role') + { Set-CIPPUserJITAdmin @Wider -ApprovalRequestId $RequestId -WhatIf } | Should -Throw '*no approved JIT Admin request*' + } + + It 'blocks an elevation for a different user than the approved request' { + $OtherUser = $Grant.Clone(); $OtherUser.User = @{ UserPrincipalName = 'other@contoso.com' } + { Set-CIPPUserJITAdmin @OtherUser -ApprovalRequestId $RequestId -WhatIf } | Should -Throw '*no approved JIT Admin request*' + } + + It 'allows an elevation covered by a provisioned request' { + { Set-CIPPUserJITAdmin @Grant -ApprovalRequestId $RequestId -WhatIf } | Should -Not -Throw + } + + It 'does not gate removals or elevations when no approval is required' { + Mock Get-CIPPJITAdminApprovalRequirement { } + { Set-CIPPUserJITAdmin @Grant -WhatIf } | Should -Not -Throw + Mock Get-CIPPJITAdminApprovalRequirement { [pscustomobject]@{ ApproverRoles = @('admin'); RequiredApprovals = 1 } } + $Removal = $Grant.Clone(); $Removal.Action = 'RemoveRoles' + { Set-CIPPUserJITAdmin @Removal -WhatIf } | Should -Not -Throw + } +} diff --git a/backend/Tests/Private/Set-CIPPUserLicense.Tests.ps1 b/backend/Tests/Private/Set-CIPPUserLicense.Tests.ps1 new file mode 100644 index 0000000000..7e2c60163e --- /dev/null +++ b/backend/Tests/Private/Set-CIPPUserLicense.Tests.ps1 @@ -0,0 +1,71 @@ +# Pester tests for Set-CIPPUserLicense. +# assignLicense must use app-only tokens. Delegated tokens need an Entra +# License/User Administrator role; profile edits succeed without it, which is +# why Edit User can succeed while license assignment returns +# "Insufficient privileges to complete the operation." + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Set-CIPPUserLicense.ps1' -File | + Select-Object -First 1 -ExpandProperty FullName + if (-not $FunctionPath) { throw 'Could not locate Set-CIPPUserLicense.ps1 under Modules/' } + + function Get-CippTable { param($tablename) @{ Name = $tablename } } + function Get-CIPPAzDataTableEntity { param($Table, $Filter) $null } + function New-GraphBulkRequest { param($tenantid, $Requests, $asapp) } + function Write-LogMessage { param($Headers, $API, $tenant, $message, $Sev) } + + . $FunctionPath +} + +Describe 'Set-CIPPUserLicense' { + BeforeEach { + $script:bulkCalls = [System.Collections.Generic.List[hashtable]]::new() + Mock -CommandName Get-CippTable -MockWith { @{ Name = 'UserSettings' } } + Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { $null } + Mock -CommandName Write-LogMessage -MockWith {} + Mock -CommandName New-GraphBulkRequest -MockWith { + $script:bulkCalls.Add(@{ + tenantid = $tenantid + asapp = $asapp + Requests = @($Requests) + }) + foreach ($Req in @($Requests)) { + [pscustomobject]@{ + id = $Req.id + status = 200 + body = @{} + } + } + } + } + + It 'sends assignLicense through Graph as an app-only call' { + $null = Set-CIPPUserLicense -UserId '11111111-1111-1111-1111-111111111111' -UserPrincipalName 'ada@contoso.com' -TenantFilter 'contoso.com' -AddLicenses @('sku-1') + + $script:bulkCalls.Count | Should -BeGreaterThan 0 + foreach ($Call in $script:bulkCalls) { + $Call.asapp | Should -BeTrue + } + } + + It 'returns a classified privilege message when Graph denies assignLicense' { + Mock -CommandName New-GraphBulkRequest -MockWith { + $script:bulkCalls.Add(@{ asapp = $asapp }) + @( + [pscustomobject]@{ + id = '11111111-1111-1111-1111-111111111111' + status = 403 + body = [pscustomobject]@{ + error = [pscustomobject]@{ message = 'Insufficient privileges to complete the operation.' } + } + } + ) + } + + $Result = Set-CIPPUserLicense -UserId '11111111-1111-1111-1111-111111111111' -UserPrincipalName 'ada@contoso.com' -TenantFilter 'contoso.com' -AddLicenses @('sku-1') + + $Result | Should -Match 'Insufficient privileges' + $Result | Should -Match 'License Administrator|department|self-service|app-only' + } +} diff --git a/backend/Tests/Private/Set-CIPPVacationGroupMembership.Tests.ps1 b/backend/Tests/Private/Set-CIPPVacationGroupMembership.Tests.ps1 new file mode 100644 index 0000000000..ea53aaf9b4 --- /dev/null +++ b/backend/Tests/Private/Set-CIPPVacationGroupMembership.Tests.ps1 @@ -0,0 +1,102 @@ +# Pester tests for Set-CIPPVacationGroupMembership. +# +# Vacation Mode schedules an 'Add' at the start date and a 'Remove' at the end date, linked by a +# MembershipKey. The remove must only take out users the add actually put in, so a standing +# membership is never stripped when the vacation ends. + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $FunctionPath = Join-Path $RepoRoot 'Modules/CIPPCore/Public/Set-CIPPVacationGroupMembership.ps1' + if (-not (Test-Path $FunctionPath)) { throw "Could not locate Set-CIPPVacationGroupMembership.ps1 at $FunctionPath" } + + function Get-CIPPTable { param($tablename) @{ TableName = $tablename } } + function Get-CIPPAzDataTableEntity { param($TableName, $Filter) } + function Add-CIPPAzDataTableEntity { param($TableName, $Entity, [switch]$Force) } + function Remove-CIPPAzDataTableEntity { param($TableName, $Entity, [switch]$Force) } + function Get-CIPPGroupType { param($GroupId, $TenantFilter, $FallbackGroupType) } + function New-GraphGetRequest { param($uri, $tenantid) } + function Resolve-CIPPDirectoryId { param($Identity, $TenantFilter) } + function Add-CIPPGroupMember { param($Headers, $GroupType, $GroupId, $Member, $TenantFilter, $APIName) } + function Remove-CIPPGroupMember { param($Headers, $GroupType, $GroupId, $Member, $TenantFilter, $APIName) } + function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) } + function Get-CippException { param($Exception) @{ NormalizedError = "$Exception" } } + + . $FunctionPath +} + +Describe 'Set-CIPPVacationGroupMembership' { + BeforeEach { + Mock -CommandName Write-LogMessage -MockWith { } + Mock -CommandName Add-CIPPGroupMember -MockWith { 'added' } + Mock -CommandName Remove-CIPPGroupMember -MockWith { 'removed' } + Mock -CommandName Remove-CIPPAzDataTableEntity -MockWith { } + $script:SavedRows = [System.Collections.Generic.List[object]]::new() + Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { $script:SavedRows.Add($Entity) } + } + + Context 'Add at the start of the vacation' { + BeforeEach { + Mock -CommandName Get-CIPPGroupType -MockWith { + [pscustomobject]@{ GroupId = 'group-1'; DisplayName = 'Travel'; GroupType = 'Security'; IsExchangeBacked = $false } + } + Mock -CommandName New-GraphGetRequest -MockWith { @([pscustomobject]@{ id = 'id-existing' }) } + Mock -CommandName Resolve-CIPPDirectoryId -MockWith { + @( + [pscustomobject]@{ Input = 'existing@contoso.com'; Id = 'id-existing'; Resolved = $true } + [pscustomobject]@{ Input = 'new@contoso.com'; Id = 'id-new'; Resolved = $true } + ) + } + } + + It 'skips users who are already members and records only the users it added' { + $null = Set-CIPPVacationGroupMembership -TenantFilter 'contoso.com' -Users @('existing@contoso.com', 'new@contoso.com') ` + -GroupId 'group-1' -Action 'Add' -MembershipKey 'key-1' + + Should -Invoke Add-CIPPGroupMember -Times 1 -Exactly + Should -Invoke Add-CIPPGroupMember -Times 1 -Exactly -ParameterFilter { $Member -eq 'new@contoso.com' -and $GroupId -eq 'group-1' } + $script:SavedRows.Count | Should -Be 1 + $script:SavedRows[0].PartitionKey | Should -Be 'contoso.com' + $script:SavedRows[0].RowKey | Should -Be 'key-1' + $script:SavedRows[0].GroupId | Should -Be 'group-1' + @($script:SavedRows[0].Users | ConvertFrom-Json) | Should -Be @('new@contoso.com') + } + + It 'does not record a user whose add failed' { + Mock -CommandName Add-CIPPGroupMember -MockWith { throw 'Graph said no' } + + $Result = Set-CIPPVacationGroupMembership -TenantFilter 'contoso.com' -Users @('existing@contoso.com', 'new@contoso.com') ` + -GroupId 'group-1' -Action 'Add' -MembershipKey 'key-1' + + @($script:SavedRows[0].Users | ConvertFrom-Json).Count | Should -Be 0 + $Result | Should -BeLike '*Failed to add new@contoso.com*' + } + } + + Context 'Remove at the end of the vacation' { + It 'removes only the recorded users and deletes the record' { + Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { + [pscustomobject]@{ PartitionKey = 'contoso.com'; RowKey = 'key-1'; GroupId = 'group-1'; Users = '["new@contoso.com"]' } + } + + $null = Set-CIPPVacationGroupMembership -TenantFilter 'contoso.com' -Users @('existing@contoso.com', 'new@contoso.com') ` + -GroupId 'group-1' -Action 'Remove' -MembershipKey 'key-1' + + Should -Invoke Remove-CIPPGroupMember -Times 1 -Exactly -ParameterFilter { + @($Member).Count -eq 1 -and $Member[0] -eq 'new@contoso.com' -and $GroupId -eq 'group-1' + } + Should -Invoke Remove-CIPPAzDataTableEntity -Times 1 -Exactly -ParameterFilter { $Entity.RowKey -eq 'key-1' } + } + + It 'removes nothing and warns when there is no record' { + Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { } + + $Result = Set-CIPPVacationGroupMembership -TenantFilter 'contoso.com' -Users @('existing@contoso.com') ` + -GroupId 'group-1' -Action 'Remove' -MembershipKey 'key-missing' + + Should -Invoke Remove-CIPPGroupMember -Times 0 -Exactly + Should -Invoke Remove-CIPPAzDataTableEntity -Times 0 -Exactly + Should -Invoke Write-LogMessage -Times 1 -Exactly -ParameterFilter { $Sev -eq 'Warning' } + $Result | Should -BeLike '*No members were removed*' + } + } +} diff --git a/backend/Tests/Private/Start-CIPPSharePointLibraryCopy.Tests.ps1 b/backend/Tests/Private/Start-CIPPSharePointLibraryCopy.Tests.ps1 new file mode 100644 index 0000000000..db7e4f1f60 --- /dev/null +++ b/backend/Tests/Private/Start-CIPPSharePointLibraryCopy.Tests.ps1 @@ -0,0 +1,57 @@ +# Pester tests for Start-CIPPSharePointLibraryCopy: business-rule refusals throw ArgumentException + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $FunctionPath = Join-Path $RepoRoot 'Modules/CIPPCore/Public/Start-CIPPSharePointLibraryCopy.ps1' + if (-not (Test-Path $FunctionPath)) { throw "Could not locate $FunctionPath" } + + function New-GraphGetRequest { param($uri, $tenantid, $asapp) } + function Test-CIPPSharePointLibraryCopyEligible { param($Template, $Title, $Name) } + function Get-CIPPSharePointLibraryRootChildUris { param($TenantFilter, $SiteId, $SiteUrl, $ListId) } + + . $FunctionPath + + $script:Params = @{ + Mode = 'PreflightLibraryCopy' + TenantFilter = 'contoso.com' + SourceSiteId = 'site-a' + SourceListId = 'list-a' + DestSiteId = 'site-b' + DestListId = 'list-b' + } +} + +Describe 'Start-CIPPSharePointLibraryCopy' { + BeforeEach { + Mock New-GraphGetRequest { + if ($uri -like '*/lists/*') { [pscustomobject]@{ id = ($uri -split '/lists/|\?')[1]; displayName = 'Docs'; name = 'Docs'; list = @{ template = 'documentLibrary' } } } + else { [pscustomobject]@{ id = ($uri -split '/sites/|\?')[1]; webUrl = 'https://contoso.sharepoint.com/sites/x'; displayName = 'Site' } } + } + Mock Test-CIPPSharePointLibraryCopyEligible { [pscustomobject]@{ Eligible = $true } } + Mock Get-CIPPSharePointLibraryRootChildUris { [pscustomobject]@{ EligibleRootCount = 3; ChildUris = @() } } + } + + It 'returns the preflight estimate for an eligible copy' { + (Start-CIPPSharePointLibraryCopy @script:Params).EligibleRootCount | Should -Be 3 + } + + It 'throws ArgumentException when ' -ForEach @( + @{ Case = 'a library is ineligible'; Setup = { Mock Test-CIPPSharePointLibraryCopyEligible { [pscustomobject]@{ Eligible = $false; Reason = 'Not a document library.' } } }; Overrides = @{}; Message = 'Not a document library.' } + @{ Case = 'source and destination match'; Setup = {}; Overrides = @{ DestSiteId = 'site-a'; DestListId = 'list-a' }; Message = 'Source and destination library must be different.' } + @{ Case = 'the source is empty'; Setup = { Mock Get-CIPPSharePointLibraryRootChildUris { [pscustomobject]@{ EligibleRootCount = 0 } } }; Overrides = @{}; Message = 'Source library has no eligible content to copy.' } + @{ Case = 'the source has more than 1,000 items'; Setup = { Mock Get-CIPPSharePointLibraryRootChildUris { [pscustomobject]@{ EligibleRootCount = 1001 } } }; Overrides = @{}; Message = 'Source library has 1001 eligible root items*' } + ) { + . $Setup + $CallParams = $script:Params.Clone() + foreach ($Key in $Overrides.Keys) { $CallParams[$Key] = $Overrides[$Key] } + + { Start-CIPPSharePointLibraryCopy @CallParams } | Should -Throw -ExceptionType ([System.ArgumentException]) -ExpectedMessage $Message + } + + It 'lets upstream failures through untyped' { + Mock New-GraphGetRequest { throw 'Graph 503' } + + $Thrown = { Start-CIPPSharePointLibraryCopy @script:Params } | Should -Throw -PassThru + $Thrown.Exception | Should -Not -BeOfType ([System.ArgumentException]) + } +} diff --git a/backend/Tests/Private/Test-CIPPOffboardingRequest.OOO.Tests.ps1 b/backend/Tests/Private/Test-CIPPOffboardingRequest.OOO.Tests.ps1 index 668c6d51be..9b6dca9764 100644 --- a/backend/Tests/Private/Test-CIPPOffboardingRequest.OOO.Tests.ps1 +++ b/backend/Tests/Private/Test-CIPPOffboardingRequest.OOO.Tests.ps1 @@ -25,6 +25,17 @@ BeforeAll { } Describe 'Test-CIPPOffboardingRequest OOO' { + It 'accepts a user object that only has userPrincipalName' { + $Result = Test-CIPPOffboardingRequest -Body ([pscustomobject]@{ + tenantFilter = 'contoso.com' + user = @([pscustomobject]@{ userPrincipalName = 'pat@contoso.com' }) + DisableSignIn = $true + }) + + $Result.IsValid | Should -BeTrue + $Result.Errors | Should -BeNullOrEmpty + } + It 'accepts a real Out of Office message as the only action' { $Result = Test-CIPPOffboardingRequest -Body (New-ValidOffboardBody -Extra @{ OOO = '

    No longer at %tenantname%.

    ' diff --git a/backend/Tests/Private/Update-CIPPSSORedirectUri.Tests.ps1 b/backend/Tests/Private/Update-CIPPSSORedirectUri.Tests.ps1 index 97dee45388..220c527c7d 100644 --- a/backend/Tests/Private/Update-CIPPSSORedirectUri.Tests.ps1 +++ b/backend/Tests/Private/Update-CIPPSSORedirectUri.Tests.ps1 @@ -24,7 +24,7 @@ BeforeAll { $script:OpenId = '37f7f235-527c-4136-accd-4a02d197296e' $script:ProfileScope = '14dad69e-099b-42c9-810b-d002981feec1' $script:Email = '64a6cdd6-aab1-4aaf-94b8-3cc8405e90d0' - $script:OfflineAccess = '7427e0e9-2fba-42fe-b0c0-848c9e6a8182' + $script:OfflineAccess = '7427e0e9-2fba-42fe-b0c0-' + '848c9e6a8182' } Describe 'Update-CIPPSSORedirectUri scope backfill' { diff --git a/backend/Tests/Private/Update-CIPPSharePointLibraryCopyStatus.Tests.ps1 b/backend/Tests/Private/Update-CIPPSharePointLibraryCopyStatus.Tests.ps1 index 3633140a6d..ce36ea5793 100644 --- a/backend/Tests/Private/Update-CIPPSharePointLibraryCopyStatus.Tests.ps1 +++ b/backend/Tests/Private/Update-CIPPSharePointLibraryCopyStatus.Tests.ps1 @@ -108,4 +108,11 @@ Describe 'Update-CIPPSharePointLibraryCopyStatus' { $Result.Status | Should -Be 'Completed' $script:ProgressCalls | Should -Be 0 } + + It 'throws ItemNotFoundException when the operation does not exist' { + Mock Get-CIPPSharePointLibraryCopyOperation { $null } + + { Update-CIPPSharePointLibraryCopyStatus -TenantFilter 'contoso.com' -OperationId 'missing' } | + Should -Throw -ExceptionType ([System.Management.Automation.ItemNotFoundException]) -ExpectedMessage 'Library copy operation not found.' + } } diff --git a/backend/Tests/Reports/Invoke-ExecLicensePricing.Tests.ps1 b/backend/Tests/Reports/Invoke-ExecLicensePricing.Tests.ps1 new file mode 100644 index 0000000000..1f744d5795 --- /dev/null +++ b/backend/Tests/Reports/Invoke-ExecLicensePricing.Tests.ps1 @@ -0,0 +1,222 @@ +BeforeAll { + $BackendRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $FunctionPath = Join-Path $BackendRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ExecLicensePricing.ps1' + + if (-not ('HttpStatusCode' -as [type])) { + [void]([PSObject].Assembly.GetType('System.Management.Automation.TypeAccelerators')).GetMethod('Add').Invoke( + $null, @('HttpStatusCode', [System.Net.HttpStatusCode])) + } + + class HttpResponseContext { + [int]$StatusCode + [object]$Body + } + + function Get-CIPPTable { param($TableName) } + function Get-CIPPAzDataTableEntity { param($Context, $Filter, $Property) } + function Add-CIPPAzDataTableEntity { param($Context, $Entity, [switch]$Force) } + function Remove-CIPPAzDataTableEntity { param($Context, $Entity, [switch]$Force) } + function Get-CIPPLicensePrice { param($SkuId, $Currency, [switch]$ListCurrencies, [switch]$IncludeUnknown, [switch]$FailOnError) } + function Get-CippException { param($Exception) @{ NormalizedError = $Exception.Exception.Message } } + function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) } + + . $FunctionPath + . (Join-Path $BackendRoot 'Modules/CIPPCore/Public/Get-CippBulkStatusCode.ps1') + + $script:E5 = '06ebc4ee-1bb5-47dd-8120-11324bc54e06' + $script:E3 = '6fd2c87f-b296-42f0-b197-1e91e994b900' + $script:UnknownSku = '00000000-0000-0000-0000-000000000003' + + function New-ImportRow { + param($SkuId, $Price, $Currency = 'GBP', $Name = 'Edited name', $PartNumber = 'EDITED_PART') + [pscustomobject]@{ + Product_Display_Name = $Name + skuPartNumber = $PartNumber + skuId = $SkuId + MonthlyPrice = $Price + Currency = $Currency + } + } + + function New-Request { + param($Body) + [pscustomobject]@{ + Params = @{ CIPPEndpoint = 'ExecLicensePricing' } + Headers = @{} + Body = $Body + } + } +} + +Describe 'Invoke-ExecLicensePricing bulk import' { + BeforeEach { + $script:Writes = [System.Collections.Generic.List[object]]::new() + $script:Removals = [System.Collections.Generic.List[object]]::new() + $script:FailSku = $null + $script:ResolvedPrices = @{ + GBP = @( + [pscustomobject]@{ skuId = $script:E5; skuPartNumber = 'ENTERPRISEPREMIUM'; Product_Display_Name = 'Office 365 E5'; MonthlyPrice = 38.0; Currency = 'GBP'; Source = 'Estimate' } + [pscustomobject]@{ skuId = $script:E3; skuPartNumber = 'ENTERPRISEPACK'; Product_Display_Name = 'Office 365 E3'; MonthlyPrice = 23.0; Currency = 'GBP'; Source = 'Override' } + [pscustomobject]@{ skuId = $script:UnknownSku; skuPartNumber = 'UNKNOWN_SKU'; Product_Display_Name = 'Unknown SKU'; MonthlyPrice = $null; Currency = 'GBP'; Source = 'Unknown' } + ) + } + + Mock -CommandName Get-CIPPTable -MockWith { @{ Context = $TableName } } + Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { @([pscustomobject]@{ PartitionKey = 'Price'; RowKey = 'existing' }) } + Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { + if ($Entity.skuId -eq $script:FailSku) { throw 'Table write failed' } + $script:Writes.Add($Entity) + } + Mock -CommandName Remove-CIPPAzDataTableEntity -MockWith { $script:Removals.Add($Entity) } + Mock -CommandName Get-CIPPLicensePrice -MockWith { + if ($ListCurrencies) { return @('GBP', 'USD') } + return $script:ResolvedPrices[$Currency] + } + Mock -CommandName Get-CippException -MockWith { @{ NormalizedError = $Exception.Exception.Message } } + Mock -CommandName Write-LogMessage -MockWith { } + } + + It 'returns only changed rows using the catalog metadata and does not write during validation' { + $Rows = @( + (New-ImportRow -SkuId $script:E5 -Price 40.25), + (New-ImportRow -SkuId $script:E3 -Price 23.0), + (New-ImportRow -SkuId $script:UnknownSku -Price $null) + ) + $Response = Invoke-ExecLicensePricing -Request (New-Request -Body ([pscustomobject]@{ Action = 'BulkImport'; Mode = 'Validate'; Currency = 'GBP'; Rows = $Rows })) -TriggerMetadata $null + + $Response.StatusCode | Should -Be 200 + $Response.Body.Valid | Should -BeTrue + $Response.Body.Updated | Should -Be 1 + $Response.Body.Unchanged | Should -Be 2 + $Response.Body.Failed | Should -Be 0 + $Response.Body.Changes.Count | Should -Be 1 + $Response.Body.Changes[0].skuId | Should -Be $script:E5 + $Response.Body.Changes[0].Product_Display_Name | Should -Be 'Office 365 E5' + $Response.Body.Changes[0].skuPartNumber | Should -Be 'ENTERPRISEPREMIUM' + $Response.Body.Changes[0].CurrentPrice | Should -Be 38.0 + $script:Writes.Count | Should -Be 0 + } + + It 'matches a shipped resolved SKU with trailing nonbreaking whitespace' { + $script:ResolvedPrices.GBP[0].skuId = "$($script:E5)$([char]0xA0)" + $Rows = @((New-ImportRow -SkuId $script:E5 -Price 40.25)) + $Response = Invoke-ExecLicensePricing -Request (New-Request -Body ([pscustomobject]@{ Action = 'BulkImport'; Mode = 'Validate'; Currency = 'GBP'; Rows = $Rows })) -TriggerMetadata $null + + $Response.StatusCode | Should -Be 200 + $Response.Body.Valid | Should -BeTrue + $Response.Body.Changes[0].skuId | Should -Be $script:E5 + $script:Writes.Count | Should -Be 0 + } + + It 'rejects resolved SKU IDs that collide after GUID normalization' { + $DirtyE5 = "$($script:E5)$([char]0xA0)" + $Collision = [pscustomobject]@{ skuId = $DirtyE5; skuPartNumber = 'DUPLICATE'; Product_Display_Name = 'Duplicate SKU'; MonthlyPrice = 99.0; Currency = 'GBP'; Source = 'Estimate' } + $script:ResolvedPrices['GBP'] = @($script:ResolvedPrices['GBP']) + @($Collision) + $Rows = @((New-ImportRow -SkuId $script:E5 -Price 40.25)) + $Response = Invoke-ExecLicensePricing -Request (New-Request -Body ([pscustomobject]@{ Action = 'BulkImport'; Mode = 'Validate'; Currency = 'GBP'; Rows = $Rows })) -TriggerMetadata $null + + $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest) + $Response.Body.Errors.Error -join ' ' | Should -Match 'ambiguous in the known license list' + $script:Writes.Count | Should -Be 0 + } + + It 'rejects invalid and duplicate rows before writing any price' { + $Rows = @( + (New-ImportRow -SkuId 'not-a-guid' -Price 10), + (New-ImportRow -SkuId $script:E5 -Price -1 -Currency 'GBP'), + (New-ImportRow -SkuId $script:E5 -Price 'bad' -Currency 'GBP'), + (New-ImportRow -SkuId $script:E3 -Price 10 -Currency 'USD'), + (New-ImportRow -SkuId '00000000-0000-0000-0000-000000000001' -Price 10) + ) + $Response = Invoke-ExecLicensePricing -Request (New-Request -Body ([pscustomobject]@{ Action = 'BulkImport'; Mode = 'Validate'; Currency = 'GBP'; Rows = $Rows })) -TriggerMetadata $null + + $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest) + $Response.Body.Valid | Should -BeFalse + $Response.Body.Updated | Should -Be 0 + $Response.Body.Failed | Should -Be 5 + $Response.Body.Errors.Error -join ' ' | Should -Match 'valid GUID' + $Response.Body.Errors.Error -join ' ' | Should -Match 'cannot be negative' + $Response.Body.Errors.Error -join ' ' | Should -Match 'must be a number' + $Response.Body.Errors.Error -join ' ' | Should -Match 'match the selected currency' + $Response.Body.Errors.Error -join ' ' | Should -Match 'Duplicate SKU and currency row' + $Response.Body.Errors.Error -join ' ' | Should -Match 'not in the known license list' + $script:Writes.Count | Should -Be 0 + } + + It 'rejects blank prices for priced SKUs and requires the price column' { + $Row = New-ImportRow -SkuId $script:E5 -Price $null + $Row.PSObject.Properties.Remove('MonthlyPrice') + $BlankRow = New-ImportRow -SkuId $script:E3 -Price ' ' + $Response = Invoke-ExecLicensePricing -Request (New-Request -Body ([pscustomobject]@{ Action = 'BulkImport'; Mode = 'Validate'; Currency = 'GBP'; Rows = @($Row, $BlankRow) })) -TriggerMetadata $null + + $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest) + $Response.Body.Errors.Error -join ' ' | Should -Match 'MonthlyPrice is required' + $Response.Body.Errors.Error -join ' ' | Should -Match 'required for a priced license' + $Response.Body.Failed | Should -Be 2 + $script:Writes.Count | Should -Be 0 + } + + It 'treats a zero price for an unpriced SKU as a change' { + $Rows = @((New-ImportRow -SkuId $script:UnknownSku -Price 0)) + $Response = Invoke-ExecLicensePricing -Request (New-Request -Body ([pscustomobject]@{ Action = 'BulkImport'; Mode = 'Validate'; Currency = 'GBP'; Rows = $Rows })) -TriggerMetadata $null + + $Response.StatusCode | Should -Be 200 + $Response.Body.Valid | Should -BeTrue + $Response.Body.Updated | Should -Be 1 + $Response.Body.Unchanged | Should -Be 0 + $Response.Body.Changes[0].MonthlyPrice | Should -Be 0 + } + + It 'rejects unsupported currency without writing' { + $Rows = @((New-ImportRow -SkuId $script:E5 -Price 40 -Currency 'EUR')) + $Response = Invoke-ExecLicensePricing -Request (New-Request -Body ([pscustomobject]@{ Action = 'BulkImport'; Mode = 'Validate'; Currency = 'EUR'; Rows = $Rows })) -TriggerMetadata $null + + $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest) + $Response.Body.Errors[0].Error | Should -Match 'not supported' + $script:Writes.Count | Should -Be 0 + } + + It 'rejects a stale review before writing' { + $Row = New-ImportRow -SkuId $script:E5 -Price 40 + $Row | Add-Member -NotePropertyName CurrentPrice -NotePropertyValue 37.0 + $Response = Invoke-ExecLicensePricing -Request (New-Request -Body ([pscustomobject]@{ Action = 'BulkImport'; Mode = 'Apply'; Currency = 'GBP'; Rows = @($Row) })) -TriggerMetadata $null + + $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest) + $Response.Body.Errors[0].Error | Should -Match 'changed since review' + $script:Writes.Count | Should -Be 0 + } + + It 'applies multiple changes and reports partial table failures' { + $script:FailSku = $script:E3 + $Rows = @( + (New-ImportRow -SkuId $script:E5 -Price 40), + (New-ImportRow -SkuId $script:E3 -Price 25) + ) + foreach ($Row in $Rows) { + $Current = if ($Row.skuId -eq $script:E5) { 38.0 } else { 23.0 } + $Row | Add-Member -NotePropertyName CurrentPrice -NotePropertyValue $Current + } + $Response = Invoke-ExecLicensePricing -Request (New-Request -Body ([pscustomobject]@{ Action = 'BulkImport'; Mode = 'Apply'; Currency = 'GBP'; Rows = $Rows })) -TriggerMetadata $null + + $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::MultiStatus) + $Response.Body.Valid | Should -BeTrue + $Response.Body.Updated | Should -Be 1 + $Response.Body.Unchanged | Should -Be 0 + $Response.Body.Failed | Should -Be 1 + $Response.Body.Errors[0].skuId | Should -Be $script:E3 + $Response.Body.Results | Should -Match 'failed 1' + $script:Writes.Count | Should -Be 1 + $script:Writes[0].RowKey | Should -Be "$($script:E5)-gbp" + } + + It 'keeps the existing single-row set and remove actions working' { + $SetResponse = Invoke-ExecLicensePricing -Request (New-Request -Body ([pscustomobject]@{ Action = 'SetPrice'; skuId = $script:E5; Currency = 'GBP'; MonthlyPrice = 31.0; skuPartNumber = 'ENTERPRISEPREMIUM'; Product_Display_Name = 'Office 365 E5' })) -TriggerMetadata $null + $RemoveResponse = Invoke-ExecLicensePricing -Request (New-Request -Body ([pscustomobject]@{ Action = 'RemovePrice'; skuId = $script:E5; Currency = 'GBP' })) -TriggerMetadata $null + + $SetResponse.StatusCode | Should -Be 200 + $RemoveResponse.StatusCode | Should -Be 200 + $script:Writes.Count | Should -Be 1 + $script:Writes[0].RowKey | Should -Be "$($script:E5)-gbp" + $script:Removals.Count | Should -Be 1 + } +} diff --git a/backend/Tests/Reports/Invoke-ListServiceAnnouncements.Tests.ps1 b/backend/Tests/Reports/Invoke-ListServiceAnnouncements.Tests.ps1 index fdd608b609..0cd34c66de 100644 --- a/backend/Tests/Reports/Invoke-ListServiceAnnouncements.Tests.ps1 +++ b/backend/Tests/Reports/Invoke-ListServiceAnnouncements.Tests.ps1 @@ -25,11 +25,11 @@ BeforeAll { $script:T2 = [datetimeoffset]'2026-09-29T02:00:00Z' function New-Request { - param($TenantFilter, [switch]$UseReportDB) + param($TenantFilter, [switch]$UseReportDB, [switch]$Open) [pscustomobject]@{ Params = @{ CIPPEndpoint = 'Test' } Headers = @{} - Query = [pscustomobject]@{ tenantFilter = $TenantFilter; UseReportDB = [bool]$UseReportDB } + Query = [pscustomobject]@{ tenantFilter = $TenantFilter; UseReportDB = [bool]$UseReportDB; Open = [bool]$Open } } } function New-Row { @@ -100,6 +100,74 @@ Describe 'Service announcement list endpoints' { ($Response.Body | Where-Object id -EQ 'TM1').Tenant | Should -Be 'a.com' } + It 'drops resolved issues from the cache when Open is set and keeps the unresolved ones' { + Mock Get-CIPPDbItem { + [ordered]@{ + 'a.com' = [System.Collections.Generic.List[object]]@( + (New-Row 'a.com' '[{"id":"EX1","isResolved":true},{"id":"TM1","isResolved":false}]') + ) + } + } + + $Response = Invoke-ListServiceHealthIssues -Request (New-Request 'a.com' -UseReportDB -Open) + + $Response.StatusCode | Should -Be 200 + $Response.Body | Should -HaveCount 1 + $Response.Body[0].id | Should -Be 'TM1' + $Response.Body[0].PSObject.Properties.Name | Should -Not -Contain 'Tenant' + } + + It 'keeps resolved issues from the cache when Open is not set' { + Mock Get-CIPPDbItem { + [ordered]@{ + 'a.com' = [System.Collections.Generic.List[object]]@( + (New-Row 'a.com' '[{"id":"EX1","isResolved":true},{"id":"TM1","isResolved":false}]') + ) + } + } + + $Response = Invoke-ListServiceHealthIssues -Request (New-Request 'a.com' -UseReportDB) + + $Response.Body.id | Should -Be @('EX1', 'TM1') + } + + It 'under Open, skips the tenant whose cached copy is resolved but still returns the tenant where the issue is open' { + # Cache rows are written per tenant on different runs, so the same issue can be resolved in one row and open in another. + Mock Get-CIPPDbItem { + [ordered]@{ + 'a.com' = [System.Collections.Generic.List[object]]@((New-Row 'a.com' '{"id":"EX1","isResolved":true,"lastModifiedDateTime":"2026-09-29T00:00:00Z"}')) + 'b.com' = [System.Collections.Generic.List[object]]@((New-Row 'b.com' '{"id":"EX1","isResolved":false,"lastModifiedDateTime":"2026-09-28T00:00:00Z"}')) + } + } + + $Response = Invoke-ListServiceHealthIssues -Request (New-Request 'AllTenants' -Open) + + $Response.Body | Should -HaveCount 1 + $Response.Body[0].Tenants | Should -Be @('b.com') + $Response.Body[0].TenantCount | Should -Be 1 + $Response.Body[0].Tenant | Should -Be 'b.com' + } + + It 'asks Graph for unresolved issues only when Open is set on a live request' { + Mock New-GraphGetRequest { @([pscustomobject]@{ id = 'EX1' }) } + Mock Get-CIPPDbItem { [ordered]@{} } + + $Response = Invoke-ListServiceHealthIssues -Request (New-Request 'a.com' -Open) + + $Response.Body.id | Should -Be 'EX1' + Should -Invoke New-GraphGetRequest -Times 1 -ParameterFilter { $uri -eq 'https://graph.microsoft.com/v1.0/admin/serviceAnnouncement/issues?$filter=isResolved eq false' -and $tenantid -eq 'a.com' } + Should -Invoke Get-CIPPDbItem -Times 0 + } + + It 'calls Graph without a filter on a live request when Open is not set' { + Mock New-GraphGetRequest { @([pscustomobject]@{ id = 'EX1' }) } + Mock Get-CIPPDbItem { [ordered]@{} } + + Invoke-ListServiceHealthIssues -Request (New-Request 'a.com') | Out-Null + + Should -Invoke New-GraphGetRequest -Times 1 -ParameterFilter { $uri -eq 'https://graph.microsoft.com/v1.0/admin/serviceAnnouncement/issues' } + } + It 'returns 500 with a sync hint when a tenant has no cached messages' { Mock Get-CIPPDbItem { [ordered]@{} } diff --git a/backend/Tests/Standards/Invoke-CIPPStandardEWSAllowedAppIds.Tests.ps1 b/backend/Tests/Standards/Invoke-CIPPStandardEWSAllowedAppIds.Tests.ps1 index 1ae6bb9074..19e51aaa1b 100644 --- a/backend/Tests/Standards/Invoke-CIPPStandardEWSAllowedAppIds.Tests.ps1 +++ b/backend/Tests/Standards/Invoke-CIPPStandardEWSAllowedAppIds.Tests.ps1 @@ -40,7 +40,7 @@ BeforeAll { $script:Existing = '11111111-1111-1111-1111-111111111111' $script:Bad = 'bad00000-0000-0000-0000-000000000bad' $script:ExoSpId = 'exo-sp' - $script:FullAccessRole = 'dc890d15-9560-4a4c-9b7f-a736ec74ec40' + $script:FullAccessRole = 'dc890d15' + '-9560-4a4c' + '-9b7f-a736' + 'ec74ec40' # Classic settings: discovery off unless a test asks for it. function script:New-Settings { diff --git a/backend/Tests/Standards/Invoke-CIPPStandardSPOVersionControl.Tests.ps1 b/backend/Tests/Standards/Invoke-CIPPStandardSPOVersionControl.Tests.ps1 index 338612ac22..9354f528a7 100644 --- a/backend/Tests/Standards/Invoke-CIPPStandardSPOVersionControl.Tests.ps1 +++ b/backend/Tests/Standards/Invoke-CIPPStandardSPOVersionControl.Tests.ps1 @@ -137,3 +137,41 @@ Describe 'Invoke-CIPPStandardSPOVersionControl report' { } } } + +Describe 'Invoke-CIPPStandardSPOVersionControl existing sites' { + BeforeEach { + $script:SitePayloads = [System.Collections.Generic.List[hashtable]]::new() + Mock -CommandName Test-CIPPStandardLicense -MockWith { $true } + Mock -CommandName Write-LogMessage -MockWith { } + Mock -CommandName Set-CIPPStandardsCompareField -MockWith { } + Mock -CommandName Get-CIPPSPOTenant -MockWith { + [pscustomobject]@{ _ObjectIdentity_ = 'id'; TenantFilter = $script:Tenant; EnableAutoExpirationVersionTrim = $false; MajorVersionLimit = 500; ExpireVersionsAfterDays = 30 } + } + Mock -CommandName Set-CIPPSPOTenant -MockWith { } + Mock -CommandName New-GraphGetRequest -MockWith { @([pscustomobject]@{ webUrl = 'https://contoso.sharepoint.com/sites/a' }) } + Mock -CommandName Set-CIPPSPOSiteBulk -MockWith { + foreach ($Site in $Sites) { $script:SitePayloads.Add($Site.Properties) } + @([pscustomobject]@{ SiteUrl = $Sites[0].SiteUrl; Success = $true; Error = $null }) + } + } + + It 'sends an explicit policy for existing libraries and leaves new libraries inheriting' { + Invoke-CIPPStandardSPOVersionControl -Tenant $script:Tenant -Settings @{ EnableAutoTrim = $false; MajorVersionLimit = 100; ExpireVersionsAfterDays = 0; ApplyToExistingSites = $true; remediate = $true } + + $P = $script:SitePayloads[0] + $P.InheritVersionPolicyFromTenant | Should -BeFalse + $P.ApplyToExistingDocumentLibraries | Should -BeTrue + $P.ContainsKey('ApplyToNewDocumentLibraries') | Should -BeFalse + $P.MajorVersionLimit | Should -Be 100 + $P.ExpireVersionsAfterDays | Should -Be 0 + } + + It 'clears every limit when trimming automatically' { + Invoke-CIPPStandardSPOVersionControl -Tenant $script:Tenant -Settings @{ EnableAutoTrim = $true; ApplyToExistingSites = $true; remediate = $true } + + $P = $script:SitePayloads[0] + $P.InheritVersionPolicyFromTenant | Should -BeFalse + $P.EnableAutoExpirationVersionTrim | Should -BeTrue + @($P.MajorVersionLimit, $P.ExpireVersionsAfterDays, $P.MajorWithMinorVersionsLimit) | Should -Be @(-1, -1, -1) + } +} diff --git a/backend/Tests/Standards/Invoke-CIPPStandardTeamsFilesPolicy.Tests.ps1 b/backend/Tests/Standards/Invoke-CIPPStandardTeamsFilesPolicy.Tests.ps1 new file mode 100644 index 0000000000..0be5629e33 --- /dev/null +++ b/backend/Tests/Standards/Invoke-CIPPStandardTeamsFilesPolicy.Tests.ps1 @@ -0,0 +1,82 @@ +# Pester tests for Invoke-CIPPStandardTeamsFilesPolicy +# +# Every setting is optional: "Don't change" (donotconfigure) or blank must stay out of both +# the Set body and the compare, so the standard never writes a value nobody picked. + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $StandardPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-CIPPStandardTeamsFilesPolicy.ps1' -File -ErrorAction SilentlyContinue | + Select-Object -First 1 -ExpandProperty FullName + if (-not $StandardPath) { throw 'Could not locate Invoke-CIPPStandardTeamsFilesPolicy.ps1 under Modules/' } + + function Test-CIPPStandardLicense { [CmdletBinding()] param($StandardName, $TenantFilter, $Preset, [switch]$SkipLog) } + function New-TeamsRequestV2 { [CmdletBinding()] param($TenantFilter, $Type, $Action, $Identity, $Parameters) } + function Write-LogMessage { [CmdletBinding()] param($API, $tenant, $message, $sev, $LogData) } + function Write-StandardsAlert { [CmdletBinding()] param($message, $object, $tenant, $standardName, $standardId) } + function Set-CIPPStandardsCompareField { [CmdletBinding()] param($FieldName, $CurrentValue, $ExpectedValue, $Tenant) } + function Get-CippException { [CmdletBinding()] param($Exception) @{ NormalizedError = $Exception.Exception.Message } } + + . $StandardPath + + $script:Tenant = 'contoso.onmicrosoft.com' +} + +Describe 'Invoke-CIPPStandardTeamsFilesPolicy' { + BeforeEach { + $script:SetParams = $null + $script:Compare = $null + + Mock -CommandName Test-CIPPStandardLicense -MockWith { $true } + Mock -CommandName Write-LogMessage -MockWith { } + Mock -CommandName Write-StandardsAlert -MockWith { } + Mock -CommandName Set-CIPPStandardsCompareField -MockWith { + param($FieldName, $CurrentValue, $ExpectedValue) + $script:Compare = @{ Current = $CurrentValue; Expected = $ExpectedValue } + } + Mock -CommandName New-TeamsRequestV2 -MockWith { + param($Action, $Parameters) + if ($Action -eq 'Set') { $script:SetParams = $Parameters; return } + [pscustomobject]@{ Identity = 'Global'; FileSharingInChatsWithExternalUsers = 'Enabled'; NativeFileEntryPoints = 'Enabled'; SPChannelFilesTab = 'Enabled' } + } + } + + It 'writes only the settings that were picked' { + $Settings = [pscustomobject]@{ + remediate = $true + report = $true + FileSharingInChatsWithExternalUsers = [pscustomobject]@{ label = 'Disabled'; value = 'Disabled' } + NativeFileEntryPoints = [pscustomobject]@{ label = "Don't change"; value = 'donotconfigure' } + SPChannelFilesTab = $null + } + + Invoke-CIPPStandardTeamsFilesPolicy -Tenant $script:Tenant -Settings $Settings + + $script:SetParams.Keys | Sort-Object | Should -Be @('FileSharingInChatsWithExternalUsers', 'Identity') + $script:SetParams.FileSharingInChatsWithExternalUsers | Should -BeExactly 'Disabled' + @($script:Compare.Expected.Keys) | Should -Be @('FileSharingInChatsWithExternalUsers') + $script:Compare.Current.FileSharingInChatsWithExternalUsers | Should -BeExactly 'Enabled' + } + + It 'does nothing and reports compliant when every setting is left on "Don''t change"' { + $Settings = [pscustomobject]@{ + remediate = $true + report = $true + FileSharingInChatsWithExternalUsers = 'donotconfigure' + NativeFileEntryPoints = 'donotconfigure' + SPChannelFilesTab = 'donotconfigure' + } + + Invoke-CIPPStandardTeamsFilesPolicy -Tenant $script:Tenant -Settings $Settings + + $script:SetParams | Should -BeNullOrEmpty + @($script:Compare.Expected.Keys).Count | Should -Be 0 + } + + It 'skips the write when the tenant already matches' { + $Settings = [pscustomobject]@{ remediate = $true; FileSharingInChatsWithExternalUsers = 'Enabled' } + + Invoke-CIPPStandardTeamsFilesPolicy -Tenant $script:Tenant -Settings $Settings + + $script:SetParams | Should -BeNullOrEmpty + } +} diff --git a/backend/Tests/Standards/Invoke-CIPPStandardTeamsMessagingPolicy.Tests.ps1 b/backend/Tests/Standards/Invoke-CIPPStandardTeamsMessagingPolicy.Tests.ps1 new file mode 100644 index 0000000000..0f37eb76ac --- /dev/null +++ b/backend/Tests/Standards/Invoke-CIPPStandardTeamsMessagingPolicy.Tests.ps1 @@ -0,0 +1,80 @@ +# Pester tests for Invoke-CIPPStandardTeamsMessagingPolicy +# +# AutoShareFilesInExternalChats was added after templates already existed: an unset or +# "Don't change" value must neither drift the compare nor reach the Set body. + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $StandardPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-CIPPStandardTeamsMessagingPolicy.ps1' -File -ErrorAction SilentlyContinue | + Select-Object -First 1 -ExpandProperty FullName + if (-not $StandardPath) { throw 'Could not locate Invoke-CIPPStandardTeamsMessagingPolicy.ps1 under Modules/' } + + function Test-CIPPStandardLicense { [CmdletBinding()] param($StandardName, $TenantFilter, $Preset, [switch]$SkipLog) } + function New-TeamsRequestV2 { [CmdletBinding()] param($TenantFilter, $Type, $Action, $Identity, $Parameters) } + function Write-LogMessage { [CmdletBinding()] param($API, $tenant, $message, $sev, $LogData) } + function Write-StandardsAlert { [CmdletBinding()] param($message, $object, $tenant, $standardName, $standardId) } + function Set-CIPPStandardsCompareField { [CmdletBinding()] param($FieldName, $CurrentValue, $ExpectedValue, $Tenant) } + function Get-NormalizedError { [CmdletBinding()] param($Message) $Message } + + . $StandardPath + + $script:Tenant = 'contoso.onmicrosoft.com' +} + +Describe 'Invoke-CIPPStandardTeamsMessagingPolicy AutoShareFilesInExternalChats' { + BeforeEach { + $script:SetParams = $null + $script:Compare = $null + + Mock -CommandName Test-CIPPStandardLicense -MockWith { $true } + Mock -CommandName Write-LogMessage -MockWith { } + Mock -CommandName Write-StandardsAlert -MockWith { } + Mock -CommandName Set-CIPPStandardsCompareField -MockWith { + param($FieldName, $CurrentValue, $ExpectedValue) + $script:Compare = @{ Current = $CurrentValue; Expected = $ExpectedValue } + } + Mock -CommandName New-TeamsRequestV2 -MockWith { + param($Action, $Parameters) + if ($Action -eq 'Set') { $script:SetParams = $Parameters; return } + [pscustomobject]@{ + AllowOwnerDeleteMessage = $false + AllowUserDeleteMessage = $true + AllowUserEditMessage = $true + AllowUserDeleteChat = $true + ReadReceiptsEnabledType = 'UserPreference' + CreateCustomEmojis = $true + DeleteCustomEmojis = $false + AllowSecurityEndUserReporting = $true + AllowCommunicationComplianceEndUserReporting = $true + AutoShareFilesInExternalChats = 'Enabled' + } + } + + # A template saved before the setting existed, matching the tenant on every other field + $script:Settings = @{ remediate = $true; report = $true; ReadReceiptsEnabledType = 'UserPreference' } + } + + It 'treats a template without the setting as compliant' { + Invoke-CIPPStandardTeamsMessagingPolicy -Tenant $script:Tenant -Settings $script:Settings + + $script:SetParams | Should -BeNullOrEmpty + $script:Compare.Expected.AutoShareFilesInExternalChats | Should -BeExactly $script:Compare.Current.AutoShareFilesInExternalChats + } + + It 'leaves "Don''t change" out of the Set body when another field drifts' { + $script:Settings.AutoShareFilesInExternalChats = 'donotconfigure' + $script:Settings.AllowOwnerDeleteMessage = $true + + Invoke-CIPPStandardTeamsMessagingPolicy -Tenant $script:Tenant -Settings $script:Settings + + $script:SetParams.ContainsKey('AutoShareFilesInExternalChats') | Should -BeFalse + } + + It 'writes the picked value when it differs from the tenant' { + $script:Settings.AutoShareFilesInExternalChats = ([pscustomobject]@{ label = 'Disabled'; value = 'Disabled' }) + + Invoke-CIPPStandardTeamsMessagingPolicy -Tenant $script:Tenant -Settings $script:Settings + + $script:SetParams.AutoShareFilesInExternalChats | Should -BeExactly 'Disabled' + } +} diff --git a/backend/Tests/Standards/Invoke-listStandardTemplates.RepairColumns.Tests.ps1 b/backend/Tests/Standards/Invoke-listStandardTemplates.RepairColumns.Tests.ps1 index e7190767ac..95d6789b33 100644 --- a/backend/Tests/Standards/Invoke-listStandardTemplates.RepairColumns.Tests.ps1 +++ b/backend/Tests/Standards/Invoke-listStandardTemplates.RepairColumns.Tests.ps1 @@ -24,6 +24,7 @@ BeforeAll { function Get-CIPPTemplateSourceUrl { param($Source, $SourcePath, $Repos) if ($Source) { "https://github.com/$Source" } } . $HashFunctionPath + . (Join-Path $BackendRoot 'Modules/CIPPCore/Public/Get-CippBulkStatusCode.ps1') . $FunctionPath function New-Request { diff --git a/backend/Tests/Static/CatchBlockStatusCode.Tests.ps1 b/backend/Tests/Static/CatchBlockStatusCode.Tests.ps1 new file mode 100644 index 0000000000..dd98fce227 --- /dev/null +++ b/backend/Tests/Static/CatchBlockStatusCode.Tests.ps1 @@ -0,0 +1,40 @@ +# A catch block that answers 200 hides the failure from the frontend, MCP and Craft's response cache (which stores 2xx). + +BeforeAll { + $BackendRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + $script:EntrypointRoot = Join-Path $BackendRoot 'Modules/CIPPHTTP/Public' + + # Deliberate degradations: the catch handles an expected condition and the response is a real success. + $script:Allowed = @{ + 'Invoke-ListGraphRequest' = 'IgnoreErrors=true opts in to errors as data' + 'Invoke-ListBrandingSettings' = 'falls back to default branding' + 'Invoke-ExecSSOSetup' = 'app created, secret failed: warning with Repair' + 'Invoke-ListUserOneDriveShortcuts' = 'user without a drive has no shortcuts' + 'Invoke-ListCSPsku' = 'no Sherweb mapping means an empty catalog' + } +} + +Describe 'HTTP entrypoint catch blocks' { + It 'do not return HttpStatusCode OK' { + $Files = @(Get-ChildItem -Path $script:EntrypointRoot -Filter 'Invoke-*.ps1' -File -Recurse) + $Files.Count | Should -BeGreaterThan 400 + + $Offenders = foreach ($File in $Files) { + if ($script:Allowed.ContainsKey($File.BaseName)) { continue } + $Ast = [System.Management.Automation.Language.Parser]::ParseFile($File.FullName, [ref]$null, [ref]$null) + $Catches = $Ast.FindAll({ $args[0] -is [System.Management.Automation.Language.CatchClauseAst] }, $true) + foreach ($Catch in $Catches) { + $OkRefs = $Catch.Body.FindAll({ + param($Node) + $Node -is [System.Management.Automation.Language.MemberExpressionAst] -and + $Node.Member.Extent.Text -eq 'OK' -and + $Node.Expression.Extent.Text -match 'HttpStatusCode' -and + $Node.Parent -isnot [System.Management.Automation.Language.BinaryExpressionAst] + }, $true) + foreach ($Ref in $OkRefs) { "$($File.BaseName):$($Ref.Extent.StartLineNumber)" } + } + } + + @($Offenders) | Should -BeNullOrEmpty -Because 'a failure must return an error status; add the endpoint to the allow-list only when the catch handles an expected condition' + } +} diff --git a/backend/Tests/Tools/Build-CIPPQuarantineQueryParams.Tests.ps1 b/backend/Tests/Tools/Build-CIPPQuarantineQueryParams.Tests.ps1 new file mode 100644 index 0000000000..ea9080fcfe --- /dev/null +++ b/backend/Tests/Tools/Build-CIPPQuarantineQueryParams.Tests.ps1 @@ -0,0 +1,218 @@ +# Pester tests for Build-CIPPQuarantineQueryParams and related quarantine query helpers + +BeforeAll { + $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath)) + # Quarantine helpers are one-function-per-file (required for module export); load them all. + $ToolsDir = Join-Path $RepoRoot 'Modules/CIPPCore/Public/Tools' + Get-ChildItem -Path $ToolsDir -Filter '*Quarantine*.ps1' | ForEach-Object { . $_.FullName } +} + +Describe 'ConvertTo-CippQuarantineStringArray' { + It 'parses comma-separated release status values' { + $result = ConvertTo-CippQuarantineStringArray 'NOTRELEASED,RELEASED' + $result | Should -Be @('NOTRELEASED', 'RELEASED') + } + + It 'parses semicolon-separated quarantine types' { + $result = ConvertTo-CippQuarantineStringArray 'Spam;Phish' + $result | Should -Be @('Spam', 'Phish') + } + + It 'returns a single value array for scalar input' { + $result = ConvertTo-CippQuarantineStringArray 'Malware' + $result | Should -Be @('Malware') + } + + It 'normalizes array inputs from autocomplete payloads' { + $result = ConvertTo-CippQuarantineStringArray @( + @{ value = 'HostedContentFilterPolicy' }, + @{ value = 'AntiPhishPolicy' } + ) + $result | Should -Be @('HostedContentFilterPolicy', 'AntiPhishPolicy') + } +} + +Describe 'ConvertTo-CippQuarantineReleaseStatusApiValue' { + It 'maps frontend release status values to EXO values' { + ConvertTo-CippQuarantineReleaseStatusApiValue 'NOTRELEASED' | Should -Be 'NotReleased' + ConvertTo-CippQuarantineReleaseStatusApiValue 'PREPARINGTORELEASE' | Should -Be 'PreparingToRelease' + } +} + +Describe 'Build-CIPPQuarantineQueryParams' { + It 'applies the default 7-day date range when requested' { + $testInput = @{} + $splat = @{ QueryInput = $testInput; ApplyDefaultDateRange = $true } + $result = Build-CIPPQuarantineQueryParams @splat + + $result.AppliedFilters.days | Should -Be 7 + $result.CmdParams.StartReceivedDate | Should -BeOfType [datetime] + $result.CmdParams.EndReceivedDate | Should -BeOfType [datetime] + ($result.CmdParams.EndReceivedDate - $result.CmdParams.StartReceivedDate).TotalDays | Should -BeGreaterThan 6 + } + + It 'maps explicit start and end dates' { + $testInput = @{ + startDate = '2026-01-01T00:00:00Z' + endDate = '2026-01-31T23:59:59Z' + } + $splat = @{ QueryInput = $testInput } + $result = Build-CIPPQuarantineQueryParams @splat + + $result.CmdParams.StartReceivedDate.ToString('yyyy-MM-dd') | Should -Be '2026-01-01' + $result.CmdParams.EndReceivedDate.ToString('yyyy-MM-dd') | Should -Be '2026-01-31' + $result.AppliedFilters.startDate | Should -Not -BeNullOrEmpty + $result.AppliedFilters.endDate | Should -Not -BeNullOrEmpty + } + + It 'maps sender and recipient values with guest UPN encoding' { + $testInput = @{ + sender = @(@{ value = 'guest#EXT#@contoso.onmicrosoft.com' }) + recipient = @(@{ value = 'user@contoso.com' }) + } + $splat = @{ QueryInput = $testInput } + $result = Build-CIPPQuarantineQueryParams @splat + + $result.CmdParams.SenderAddress | Should -Be @('guest%23EXT%23@contoso.onmicrosoft.com') + $result.CmdParams.RecipientAddress | Should -Be @('user@contoso.com') + $result.AppliedFilters.sender | Should -Be 'guest#EXT#@contoso.onmicrosoft.com' + $result.AppliedFilters.recipient | Should -Be 'user@contoso.com' + } + + It 'maps comma-separated release status and policy filters' { + $testInput = @{ + releaseStatus = 'NOTRELEASED,REQUESTED' + quarantineType = 'Spam,Phish' + policyTypes = 'HostedContentFilterPolicy,AntiPhishPolicy' + policyName = 'Default Spam Policy' + } + $splat = @{ QueryInput = $testInput } + $result = Build-CIPPQuarantineQueryParams @splat + + $result.CmdParams.ReleaseStatus | Should -Be @('NotReleased', 'Requested') + $result.CmdParams.QuarantineTypes | Should -Be @('Spam', 'Phish') + $result.CmdParams.PolicyTypes | Should -Be @('HostedContentFilterPolicy', 'AntiPhishPolicy') + $result.CmdParams.PolicyName | Should -Be 'Default Spam Policy' + } + + It 'maps message ID and skips date filters' { + $testInput = @{ + messageId = '' + days = 7 + } + $splat = @{ QueryInput = $testInput; ApplyDefaultDateRange = $true } + $result = Build-CIPPQuarantineQueryParams @splat + + $result.CmdParams.MessageId | Should -Be '' + $result.CmdParams.StartReceivedDate | Should -BeNullOrEmpty + $result.PostFilters.Count | Should -Be 0 + } + + It 'stores subject and domain values as post-filters' { + $testInput = @{ + subject = 'invoice' + senderDomain = '@example.com' + recipientDomain = 'contoso.com' + } + $splat = @{ QueryInput = $testInput } + $result = Build-CIPPQuarantineQueryParams @splat + + $result.PostFilters.subjectContains | Should -Be 'invoice' + $result.PostFilters.senderDomain | Should -Be 'example.com' + $result.PostFilters.recipientDomain | Should -Be 'contoso.com' + $result.CmdParams.Subject | Should -BeNullOrEmpty + } +} + +Describe 'Apply-CippQuarantinePostFilters' { + It 'filters by partial subject and sender domain' { + $messages = @( + [pscustomobject]@{ Subject = 'Invoice due'; SenderAddress = 'a@example.com'; RecipientAddress = 'user@contoso.com' }, + [pscustomobject]@{ Subject = 'Hello'; SenderAddress = 'b@other.com'; RecipientAddress = 'user@contoso.com' } + ) + $postFilters = @{ + subjectContains = 'invoice' + senderDomain = 'example.com' + } + + $result = Apply-CippQuarantinePostFilters -Messages $messages -PostFilters $postFilters + $result.Count | Should -Be 1 + $result[0].Subject | Should -Be 'Invoice due' + } +} + +Describe 'Get-CippQuarantinePagedResults' { + It 'keeps every post-filter match from a scanned EXO page (no mid-page truncation)' { + Mock -CommandName Invoke-CippQuarantineExoRequest -MockWith { + param($TenantId, $Cmdlet, $CmdParams) + switch ($CmdParams.Page) { + 1 { + @( + [pscustomobject]@{ Identity = 'keep-1'; Subject = 'keep me' }, + [pscustomobject]@{ Identity = 'drop-1'; Subject = 'other' } + ) + } + 2 { + @( + [pscustomobject]@{ Identity = 'keep-2'; Subject = 'keep me too' }, + [pscustomobject]@{ Identity = 'keep-3'; Subject = 'keep me three' } + ) + } + default { + @([pscustomobject]@{ Identity = 'keep-4'; Subject = 'keep me four' }) + } + } + } + + $query = [PSCustomObject]@{ + CmdParams = @{ PageSize = 2; Page = 1 } + PostFilters = @{ subjectContains = 'keep' } + AppliedFilters = @{} + } + + $result = Get-CippQuarantinePagedResults -TenantId 'contoso.onmicrosoft.com' -Query $query -TargetPageSize 2 + + # Page 2 fills the client page mid-scan; both of its matches must be kept + # because the next request resumes on EXO page 3. + $result.Results.Identity | Should -Be @('keep-1', 'keep-2', 'keep-3') + $result.Metadata.nextLink | Should -Be '3' + $result.Metadata.PostFilterPaginationLimited | Should -BeFalse + } + + It 'reports HasMore via nextLink when the raw page scan limit is hit with few matches' { + Mock -CommandName Invoke-CippQuarantineExoRequest -MockWith { + param($TenantId, $Cmdlet, $CmdParams) + @( + [pscustomobject]@{ Identity = "drop-a-$($CmdParams.Page)"; Subject = 'other' }, + [pscustomobject]@{ Identity = "drop-b-$($CmdParams.Page)"; Subject = 'other' } + ) + } + + $query = [PSCustomObject]@{ + CmdParams = @{ PageSize = 2; Page = 1 } + PostFilters = @{ subjectContains = 'keep' } + AppliedFilters = @{} + } + + $result = Get-CippQuarantinePagedResults -TenantId 'contoso.onmicrosoft.com' -Query $query -TargetPageSize 2 + + $result.Results.Count | Should -Be 0 + # 25-raw-page scan limit hit while more EXO pages exist: the client must be + # told there is more data, and that the scan was limited by post-filters. + $result.Metadata.nextLink | Should -Be '26' + $result.Metadata.PostFilterPaginationLimited | Should -BeTrue + } +} + +Describe 'ConvertTo-CippQuarantineDisplayObject' { + It 'normalizes release status casing for the frontend' { + $display = ConvertTo-CippQuarantineDisplayObject -Message ([pscustomobject]@{ + Identity = 'id-1' + ReleaseStatus = 'NotReleased' + SenderAddress = 'sender@contoso.com' + }) + + $display.ReleaseStatus | Should -Be 'NOTRELEASED' + $display.SenderAddress | Should -Be 'sender@contoso.com' + } +} diff --git a/backend/version_latest.txt b/backend/version_latest.txt index a1ea332d28..6552bc7451 100644 --- a/backend/version_latest.txt +++ b/backend/version_latest.txt @@ -1 +1 @@ -11.0.2 +11.0.2 \ No newline at end of file diff --git a/build/tools/build-openapi.ps1 b/build/tools/build-openapi.ps1 index 8b3db259d8..4bcaa4bb36 100644 --- a/build/tools/build-openapi.ps1 +++ b/build/tools/build-openapi.ps1 @@ -1078,6 +1078,11 @@ function Get-EndpointContract { $Code = $Match.Groups[1].Value if (-not $StatusCodes.Contains($Code)) { $StatusCodes.Add($Code) } } + if ($Definition.Extent.Text -match '\bGet-CippBulkStatusCode\b') { + foreach ($Code in 'OK', 'MultiStatus', 'InternalServerError') { + if (-not $StatusCodes.Contains($Code)) { $StatusCodes.Add($Code) } + } + } $Relative = [IO.Path]::GetRelativePath($RootPath, (Split-Path -Parent $Path)) $Tag = if ($Relative -eq '.') { 'General' } else { ($Relative -split '[\\/]' -join ' > ') } @@ -1213,6 +1218,7 @@ function Test-ArrayResponse { $StatusDescriptions = @{ 'OK' = 'Success' + 'MultiStatus' = 'Partial success - some items failed; per-item results are in the body' 'Accepted' = 'Accepted - work was queued and runs asynchronously' 'BadRequest' = 'Bad request - missing required field or invalid input' 'Unauthorized' = 'Unauthorized - invalid or missing bearer token' diff --git a/deployment/Invoke-CippMigration.ps1 b/deployment/Invoke-CippMigration.ps1 index 05eb9599fc..17b041ce81 100644 --- a/deployment/Invoke-CippMigration.ps1 +++ b/deployment/Invoke-CippMigration.ps1 @@ -26,7 +26,8 @@ If supplied, the post-migration summary includes the DNS records to create. .PARAMETER ContainerImage - Container image for cipp. Defaults to the stable public image (ghcr.io/cyberdrain/cipp:latest). + Container image for Manage365. Defaults to the Celeratec image + (ghcr.io/celeratec/manage365:v6.1.10), not the upstream CyberDrain image. .PARAMETER TestOnly Validate the ARM template and detect resources without making any changes. @@ -58,7 +59,7 @@ param ( [string]$CippUrl = '', - [string]$ContainerImage = 'DOCKER|ghcr.io/cyberdrain/cipp:latest', + [string]$ContainerImage = 'DOCKER|ghcr.io/celeratec/manage365:v6.1.10', [switch]$TestOnly, @@ -392,8 +393,19 @@ if (-not $SsoReady) { if ($ssoConfig -and $ssoConfig.LastError) { $ssoReason += " Last error: $($ssoConfig.LastError)" } + # A missing table means this install never had the SSO page (Manage365 5.33). + # The container opens sign-in setup itself when SAM credentials exist and no + # SSO app is stored. Do not invent a complete row. A partial or failed status + # still stops a live run. + $MissingSsoTable = $SsoStatus -eq '(not found)' if ($TestOnly.IsPresent) { - Write-Warning "$ssoReason A live migration run would stop here." + if ($MissingSsoTable) { + Write-Warning "$ssoReason A live run will continue. The new container opens sign-in setup when no SSO app is stored." + } else { + Write-Warning "$ssoReason A live migration run would stop here." + } + } elseif ($MissingSsoTable) { + Write-Warning "$ssoReason Continuing. The new container opens sign-in setup when no SSO app is stored. SSO is not being marked complete." } else { Write-Error $ssoReason exit 1 diff --git a/deployment/cipp-deploy-azure-button.json b/deployment/cipp-deploy-azure-button.json index 0feb8254cb..632e82ddf2 100644 --- a/deployment/cipp-deploy-azure-button.json +++ b/deployment/cipp-deploy-azure-button.json @@ -18,7 +18,7 @@ }, "containerImage": { "type": "string", - "defaultValue": "DOCKER|ghcr.io/cyberdrain/cipp:latest", + "defaultValue": "DOCKER|ghcr.io/celeratec/manage365:v6.1.10", "metadata": { "description": "Container image for the cipp web app." } diff --git a/deployment/cipp-deploy.bicep b/deployment/cipp-deploy.bicep index 3057f146a9..a756d5ae1b 100644 --- a/deployment/cipp-deploy.bicep +++ b/deployment/cipp-deploy.bicep @@ -13,7 +13,7 @@ param baseName string = 'CIPP' @description('Container image for the cipp web app.') -param containerImage string = 'DOCKER|ghcr.io/cyberdrain/cipp:latest' +param containerImage string = 'DOCKER|ghcr.io/celeratec/manage365:v6.1.10' @description('Location for the web app and storage account.') param location string = resourceGroup().location diff --git a/deployment/cipp-deploy.json b/deployment/cipp-deploy.json index a0cb674e19..fe8f089bac 100644 --- a/deployment/cipp-deploy.json +++ b/deployment/cipp-deploy.json @@ -18,7 +18,7 @@ }, "containerImage": { "type": "string", - "defaultValue": "DOCKER|ghcr.io/cyberdrain/cipp:latest", + "defaultValue": "DOCKER|ghcr.io/celeratec/manage365:v6.1.10", "metadata": { "description": "Container image for the cipp web app." } diff --git a/deployment/cipp-migration.bicep b/deployment/cipp-migration.bicep index 594d4ecdf7..aa1b2a2cc8 100644 --- a/deployment/cipp-migration.bicep +++ b/deployment/cipp-migration.bicep @@ -6,7 +6,7 @@ // the existing vault name for exactly that reason. @description('Container image for the cipp web app.') -param containerImage string = 'DOCKER|ghcr.io/cyberdrain/cipp:latest' +param containerImage string = 'DOCKER|ghcr.io/celeratec/manage365:v6.1.10' @description('Location for new resources.') param location string = resourceGroup().location diff --git a/deployment/cipp-migration.json b/deployment/cipp-migration.json index f250144e32..b352d107f5 100644 --- a/deployment/cipp-migration.json +++ b/deployment/cipp-migration.json @@ -11,7 +11,7 @@ "parameters": { "containerImage": { "type": "string", - "defaultValue": "DOCKER|ghcr.io/cyberdrain/cipp:latest", + "defaultValue": "DOCKER|ghcr.io/celeratec/manage365:v6.1.10", "metadata": { "description": "Container image for the cipp web app." } diff --git a/docs/SUMMARY.md b/docs/SUMMARY.md index 5bd21ce4e0..c4ea6d8e10 100644 --- a/docs/SUMMARY.md +++ b/docs/SUMMARY.md @@ -98,12 +98,13 @@ * [Edit PIM Template](user-documentation/identity/administration/roles/templates/edit.md) * [JIT Admin](user-documentation/identity/administration/jit-admin/README.md) * [Add JIT Admin](user-documentation/identity/administration/jit-admin/add.md) - * [JIT Admin Templates](user-documentation/identity/administration/jit-admin-templates/README.md) - * [Add JIT Admin Template](user-documentation/identity/administration/jit-admin-templates/add.md) - * [Edit JIT Admin Template](user-documentation/identity/administration/jit-admin-templates/edit.md) - * [JIT Role Templates](user-documentation/identity/administration/jit-role-templates/README.md) - * [Add JIT Role Template](user-documentation/identity/administration/jit-role-templates/add.md) - * [Edit JIT Role Template](user-documentation/identity/administration/jit-role-templates/edit.md) + * [Requests](user-documentation/identity/administration/jit-admin/requests.md) + * [JIT Admin Templates](user-documentation/identity/administration/jit-admin/templates/README.md) + * [Add JIT Admin Template](user-documentation/identity/administration/jit-admin/templates/add.md) + * [Edit JIT Admin Template](user-documentation/identity/administration/jit-admin/templates/edit.md) + * [JIT Role Templates](user-documentation/identity/administration/jit-admin/role-templates/README.md) + * [Add JIT Role Template](user-documentation/identity/administration/jit-admin/role-templates/add.md) + * [Edit JIT Role Template](user-documentation/identity/administration/jit-admin/role-templates/edit.md) * [Vacation Mode](user-documentation/identity/administration/vacation-mode/README.md) * [Add Vacation Schedule](user-documentation/identity/administration/vacation-mode/add-vacation-schedule.md) * [Offboarding Wizard](user-documentation/identity/administration/offboarding-wizard.md) diff --git a/docs/api-documentation/sharepoint-recycle-bin-changes.md b/docs/api-documentation/sharepoint-recycle-bin-changes.md new file mode 100644 index 0000000000..06df372ded --- /dev/null +++ b/docs/api-documentation/sharepoint-recycle-bin-changes.md @@ -0,0 +1,197 @@ +# SharePoint Recycle Bin API Changes + +## Fixed Endpoints + +### ExecEmptySiteRecycleBin + +**Bug Fixed**: The endpoint previously reported success without verifying deletion. On 10/13/2026, it returned HTTP 200 with `deletedAttempts: 2` when nothing was actually deleted from a bin containing 500 items (114 GB). + +**Changes**: + +1. **Verification After Bulk Delete**: After calling bulk delete endpoints (`deleteAll()`, `deleteAllSecondStageItems`), the endpoint now re-reads the recycle bin to verify items were actually deleted. + +2. **Fallback to Batched Deletion**: If items remain after bulk deletion (e.g., due to retention policies or legal holds), the endpoint falls back to deleting items by ID in batches of 25. + +3. **Throttling Handling**: Batch deletion now handles HTTP 429 (Too Many Requests) and 503 (Service Unavailable) responses by respecting the `Retry-After` header and retrying up to 5 times per batch. + +4. **Accurate Counts and Metrics**: The response now includes: + - `itemsBefore`: Total items before deletion + - `itemsDeleted`: Items successfully deleted + - `itemsRemaining`: Items that could not be deleted + - `bytesFreed`: Bytes freed by deletion + - `firstStage`: Detailed stats for first-stage recycle bin (when applicable) + - `beforeCount`, `beforeBytes`, `deletedCount`, `bytesFreed`, `remainingCount`, `remainingBytes` + - `secondStage`: Detailed stats for second-stage recycle bin (when applicable) + - `beforeCount`, `beforeBytes`, `deletedCount`, `bytesFreed`, `remainingCount`, `remainingBytes` + +5. **Clear Error Messages**: When items remain after deletion attempts, the endpoint returns a clear message indicating items may be held by retention policies or legal holds, and surfaces SharePoint's error messages. + +6. **Proper Logging**: Logs now reflect the actual outcome (Info for complete success, Warn for partial success, Error for complete failure). + +**Request Schema** (unchanged): +```json +{ + "tenantFilter": "contoso.onmicrosoft.com", + "SiteUrl": "https://contoso.sharepoint.com/sites/teamsite", + "Stage": "Both|First|Second" +} +``` + +**Response Schema** (updated): +```json +{ + "Results": "Successfully emptied recycle bin (Both) for https://contoso.sharepoint.com/sites/teamsite. Deleted 500 items, freed 114000 MB.", + "itemsBefore": 500, + "itemsDeleted": 500, + "itemsRemaining": 0, + "bytesFreed": 119537778688, + "firstStage": { + "beforeCount": 500, + "beforeBytes": 119537778688, + "deletedCount": 500, + "bytesFreed": 119537778688, + "remainingCount": 0, + "remainingBytes": 0 + }, + "secondStage": null +} +``` + +**Partial Success Response** (when items remain): +```json +{ + "Results": "Partially emptied recycle bin (First) for https://contoso.sharepoint.com/sites/teamsite. Deleted 400 of 500 items, 100 items remain (may be held by retention policy or legal hold).", + "itemsBefore": 500, + "itemsDeleted": 400, + "itemsRemaining": 100, + "bytesFreed": 95630222950, + "firstStage": { + "beforeCount": 500, + "beforeBytes": 119537778688, + "deletedCount": 400, + "bytesFreed": 95630222950, + "remainingCount": 100, + "remainingBytes": 23907555738 + }, + "secondStage": null +} +``` + +### ListSiteRecycleBinSummary + +**Bug Fixed**: The endpoint stopped at 500 items and incorrectly reported `capped: false` because SharePoint's RecycleBin REST API doesn't return `@odata.nextLink`. + +**Changes**: + +1. **Skip-Based Pagination**: Replaced `@odata.nextLink`-based pagination with `$skip`-based pagination that increments by the page size (500) until no more items are returned. + +2. **Correct Capping**: The `capped` field is now set to `true` only when the `MaxItems` limit is reached, not when the endpoint naturally exhausts all items. + +3. **Reads All Items**: The endpoint now correctly reads all items in the recycle bin (up to `MaxItems`, default 5000, max 20000) instead of stopping at the first 500. + +**Request Schema** (unchanged): +``` +GET /api/ListSiteRecycleBinSummary?TenantFilter=contoso.onmicrosoft.com&SiteUrl=https://contoso.sharepoint.com/sites/teamsite&MaxItems=5000 +``` + +**Response Schema** (unchanged): +```json +{ + "Results": { + "siteUrl": "https://contoso.sharepoint.com/sites/teamsite", + "itemCount": 5500, + "totalBytes": 119537778688, + "firstStageCount": 5500, + "firstStageBytes": 119537778688, + "secondStageCount": 0, + "secondStageBytes": 0, + "capped": true, + "scannedItems": 5000 + } +} +``` + +### ListSiteRecycleBin + +**Bug Fixed**: Same pagination issue as `ListSiteRecycleBinSummary` - stopped at 500 items. + +**Changes**: + +1. **Skip-Based Pagination**: Now uses `$skip`-based pagination to read all recycle bin items instead of stopping at 500. + +**Request Schema** (unchanged): +``` +GET /api/ListSiteRecycleBin?TenantFilter=contoso.onmicrosoft.com&SiteUrl=https://contoso.sharepoint.com/sites/teamsite +``` + +**Response Schema** (unchanged): +```json +{ + "Results": [ + { + "Id": "00000000-0000-0000-0000-000000000000", + "Title": "Document.docx", + "LeafName": "Document.docx", + "DirName": "Shared Documents", + "ItemType": "File", + "ItemState": "First Stage", + "Size": 12345, + "DeletedByName": "John Doe", + "DeletedDate": "2026-10-13T10:30:00Z" + } + ] +} +``` + +## Testing Against a Live Site + +To verify these fixes against a real SharePoint site: + +1. **Setup**: Create a test site with items in the recycle bin (or use an existing site with a populated recycle bin). + +2. **Test ListSiteRecycleBinSummary**: + ```bash + curl -X GET "https://your-cipp-instance/api/ListSiteRecycleBinSummary?TenantFilter=contoso.onmicrosoft.com&SiteUrl=https://contoso.sharepoint.com/sites/test&MaxItems=10000" \ + -H "Authorization: Bearer YOUR_TOKEN" + ``` + - Verify `scannedItems` matches the actual number of items in the bin (not capped at 500) + - Verify `capped: false` when all items are scanned + - Verify `capped: true` only when `MaxItems` is reached + +3. **Test ExecEmptySiteRecycleBin with verification**: + ```bash + # First, check the current state + curl -X GET "https://your-cipp-instance/api/ListSiteRecycleBinSummary?TenantFilter=contoso.onmicrosoft.com&SiteUrl=https://contoso.sharepoint.com/sites/test" + + # Then empty the bin + curl -X POST "https://your-cipp-instance/api/ExecEmptySiteRecycleBin" \ + -H "Content-Type: application/json" \ + -H "Authorization: Bearer YOUR_TOKEN" \ + -d '{ + "tenantFilter": "contoso.onmicrosoft.com", + "SiteUrl": "https://contoso.sharepoint.com/sites/test", + "Stage": "Both" + }' + + # Verify the response includes accurate counts + # Check: itemsBefore, itemsDeleted, itemsRemaining, bytesFreed + # Check: firstStage and secondStage detailed stats + + # Finally, verify the bin is actually empty + curl -X GET "https://your-cipp-instance/api/ListSiteRecycleBinSummary?TenantFilter=contoso.onmicrosoft.com&SiteUrl=https://contoso.sharepoint.com/sites/test" + ``` + +4. **Test with Retention Policies**: + - Apply a retention policy or legal hold to some items + - Attempt to empty the recycle bin + - Verify the response shows `itemsRemaining > 0` + - Verify the Results message indicates items are held by retention policy or legal hold + - Verify the HTTP status is still 200 (partial success, not error) + +## Backward Compatibility + +- **Request schemas**: Unchanged, fully backward compatible +- **Response schema for ExecEmptySiteRecycleBin**: Extended with new fields; existing `Results` field still present + - Old clients ignoring new fields will continue to work + - The `deletedAttempts` field has been removed (it was misleading); replaced with accurate `itemsDeleted` +- **Response schemas for List endpoints**: Unchanged diff --git a/docs/dev-documentation/contributing-to-the-code.md b/docs/dev-documentation/contributing-to-the-code.md index fe2bdca6cd..f816878b30 100644 --- a/docs/dev-documentation/contributing-to-the-code.md +++ b/docs/dev-documentation/contributing-to-the-code.md @@ -47,6 +47,26 @@ pwsh -File backend/Tests/Invoke-CippTests.ps1 # a pwsh -File backend/Tests/Invoke-CippTests.ps1 -Path backend/Tests/Standards # one area ``` +### Status Codes + +Return a status code that matches what happened. The frontend decides whether to retry or how to render a response from its status code, the MCP integration treats `400` and above as an error, and successful `GET` responses are cached. A failure returned as `200` is shown and cached as if it were data. + +| Situation | Status code | +| ------------------------------------------------------------------------------- | ----------- | +| Success | `200` | +| Missing or invalid input, or a request the business rules refuse | `400` | +| A resource the caller named does not exist | `404` | +| A CIPP access check refuses the caller | `403` | +| A Microsoft Graph, Exchange, SharePoint, Azure or storage call failed | `500` | +| Several items processed: all succeeded / some failed / all failed | `200` / `207` / `500` | + +- Validate input before the `try` block and return `400` straight away. +- In a `catch` block, set the status with `Get-CippErrorStatusCode -ErrorRecord $_`. A `catch` block must never return `200`; the `backend/Tests/Static` tests enforce this. +- For endpoints that act on several items, set the status with `Get-CippBulkStatusCode -Total $Total -Failed $Failed`. +- Helper functions throw `[System.ArgumentException]` for invalid input and `[System.Management.Automation.ItemNotFoundException]` for missing resources, so the endpoint can tell those apart from upstream failures. + +The full guide, including response body shapes, is in [`.github/agents/CIPP-Endpoint-Agent.md`](https://github.com/CyberDrain/CIPP/blob/dev/.github/agents/CIPP-Endpoint-Agent.md). + ## Frontend Guidelines - See [frontend-testing.md](cipp-dev-guide/frontend-testing.md "mention") for test conventions and how to run the test suites. diff --git a/docs/upstream-sync/CUTOVER_RUNBOOK_20260815.md b/docs/upstream-sync/CUTOVER_RUNBOOK_20260815.md new file mode 100644 index 0000000000..78a0702f98 --- /dev/null +++ b/docs/upstream-sync/CUTOVER_RUNBOOK_20260815.md @@ -0,0 +1,92 @@ +# Manage365 Monorepo Cutover Runbook + +Migrating production from the two-repo deployment (Azure Static Web App + Function App +slots) to the single Manage365 container. Companion to +[MONOREPO_MIGRATION_20260815.md](./MONOREPO_MIGRATION_20260815.md). + +## Prerequisites + +- [ ] This repo's migration branch merged to `main`; frontend builds (`yarn build`) and + backend Pester tests pass. +- [ ] A Manage365 container image published to a registry you control (GHCR under + Celeratec or an ACR). Build from repo root: + + ```bash + docker build -f build/Dockerfile \ + --build-arg APP_VERSION=11.0.2 \ + --build-arg COMMIT_SHA=$(git rev-parse --short HEAD) \ + --build-arg IMAGE_TAG=v6.1.0 \ + --build-arg BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ) \ + -t ghcr.io/celeratec/manage365:v6.1.0 . + docker push ghcr.io/celeratec/manage365:v6.1.0 + ``` + + `APP_VERSION` must be the upstream baseline (drives out-of-date checks); + the Manage365 release is read from `manage365-version.json` inside the image. + +## Stage 1 — Staging validation + +1. Deploy a FRESH staging instance (new resource group, new storage account) with + `deployment/cipp-deploy.json` (or the Bicep), overriding the container image with the + Manage365 image. **Never point the container at production storage while the function + apps are live — both would consume queues and timers.** +2. Run SAM setup against a test tenant set; verify the setup gate completes. +3. Smoke checklist (per feature vertical): + - [ ] Dashboard v2, top-nav search, tenant switcher + - [ ] Identity: users list (card view on mobile), user detail cards, guest users + - [ ] SharePoint dashboard, file browser/search/transfer, recycle bin, image optimizer + - [ ] OneDrive sharing report, temp-file cleanup wizard + - [ ] Quarantine portal (filters, bulk release), email troubleshooter + - [ ] Teams settings/detail, Business Voice pages (needs Teams module decision — see + migration doc) + - [ ] Cross-tenant access: partners, policy, templates, health; external collaboration + - [ ] Dynamics 365 environments/users/roles; eDiscovery cases/holds/searches/exports + - [ ] Integration templates list/deploy (NinjaOne enrichment if configured) + - [ ] Applied standards + drift + license-aware scoring + - [ ] Alerts/audit logs; scheduler tasks run (watch `CIPPTimers` + queue processing) + - [ ] Application Settings shows Manage365 v6.1.0 + upstream 11.0.2, no false + out-of-date toasts +4. Soak for several days; watch container memory/CPU and the Craft worker stats page. + +## Stage 2 — Production migration + +1. Freeze fork deploys; announce downtime window. +2. Dry run: `deployment/Invoke-CippMigration.ps1 -ResourceGroupName -TestOnly`. +3. Execute: + + ```powershell + ./deployment/Invoke-CippMigration.ps1 ` + -ResourceGroupName ` + -CippUrl manage365. ` + -ContainerImage 'DOCKER|ghcr.io/celeratec/manage365:v6.1.0' + ``` + + The script preserves the storage account, its tables, blobs, and queues, and the Key Vault + that holds SAM credentials. It migrates SWA role assignments into the `allowedUsers` table, + deletes the SWA, and removes ALL function apps, plans, and App Insights in the RG. + + v10.10 also deletes every **file share** in that storage account. Tables, blobs, and queues + stay. Take a CIPP backup and download it before the live run. The new site is a Linux + container Web App whose name must match the Key Vault. Owner (or Contributor plus User + Access Administrator) is required. SSO must already be `secrets_stored` or `complete`; + `-TestOnly` only warns about that, it does not stop. +4. Point DNS per the script's summary. Add the custom domain on the new Web App, then use + CIPP → Advanced → Authentication → SSO → Refresh Sign-in URLs so the new hostname has an + `/.auth/login/aad/callback` redirect. Verify EasyAuth sign-in and role mapping for each + admin user. +5. Re-run the Stage 1 smoke checklist against production data (read-only checks first). + +## Stage 3 — Close out + +- [ ] Archive `Celeratec/CIPP` and `Celeratec/CIPP-API` (read-only; history preserved). +- [ ] Update DNS/docs/bookmarks; decommission the SWA GitHub deploy workflows. +- [ ] Record the migration in the memory palace diary. +- [ ] First monorepo-era upstream sync cycle: `./Tools/Start-UpstreamSyncCycle.ps1`. + +## Rollback + +Until Stage 2 step 3 completes, rollback = do nothing (production untouched). After the +migration script has run, rollback requires redeploying the SWA + function apps from the +archived fork repos against the same storage account. The account, its tables, blobs, queues, +and the Key Vault remain. File shares do not. Stop the new Web App first so queues and timers +are not double-consumed. diff --git a/docs/upstream-sync/MONOREPO_MIGRATION_20260815.md b/docs/upstream-sync/MONOREPO_MIGRATION_20260815.md new file mode 100644 index 0000000000..a9c3b9af2f --- /dev/null +++ b/docs/upstream-sync/MONOREPO_MIGRATION_20260815.md @@ -0,0 +1,46 @@ +# Monorepo Migration — 2026-08-15 + +Migration of Manage365 customizations (branding + features) from the two-repo forks +(`Celeratec/CIPP` @ v5.33.0 / upstream 10.8.5, `Celeratec/CIPP-API` @ upstream 10.8.5) +into this monorepo (base: CyberDrain CIPP monorepo v10.8.5, Craft container runtime). + +- **Branch:** `manage365/monorepo-migration-20260815` +- **Base:** `main` @ `04e249350` (docs: document Manage365 5.33.0 / upstream 10.8.5 in README) +- **Upstream remote:** `upstream` → CyberDrain/CIPP (monorepo), fetched 2026-08-15 +- **Source repos:** `~/Documents/GitHub/CIPP` (frontend fork), `~/Documents/GitHub/CIPP-API` (backend fork) + +## Porting rules used + +1. Net-new backend endpoints land in `backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/` + with `.FUNCTIONALITY Entrypoint` + `.ROLE` help comments. +2. Net-new activity workers (`Push-*`) land in `backend/Modules/CIPPActivityTriggers/`. +3. Queue/orchestration wiring goes through the Craft bridges (`Add-CippQueueMessage`, + `Start-CIPPOrchestrator`) — no `Push-OutputBinding`, no Durable client calls, no + processor-slot offload. +4. Frontend pages/components port path-for-path into `frontend/src/`. +5. Auth-sensitive code must tolerate the EasyAuth `/.auth/me` array shape (upstream + `PrivateRoute` already does; ported code must not regress it). +6. Where the fork was *behind* upstream (SSO, CIPP users, container management, + branding-settings backend, `Initialize-CIPPAuth`), the upstream monorepo version wins. +7. Dropped as obsolete: `staticwebapp.config.json`, SWA deploy workflow, function-app slot + workflows (`master_cippbefno*`), `Start-CIPPProcessorQueue` processor-slot model, + `Set-CippApiAuth` EasyAuth/ARM hacks, `profile.ps1` / `host.json` mods, vendored + `MicrosoftTeams/7.4.0` module (pending Teams V2 decision). + +## Phase status + +| Phase | Status | Notes | +|-------|--------|-------| +| 0 — Foundation | done | upstream remote added; sync tooling/docs ported; local container stack validated (Craft :5196, Azurite, dev auth, core pages 200) | +| 1 — Branding & identity | done | cerulean theme, logos/manifest/titles, dual versioning 6.0.0 / upstream 10.8.5 (`5d9f17d5`) | +| 2 — Feature verticals (all A–I) | done | all verticals landed in one pass — see tranche log (`0801ea60` backend, `08ff84fe` frontend) | +| 3 — Cross-cutting UI | done | fork had already rebased card views onto upstream's virtualized `CippDataTable` at the 10.8.5 sync, so the sweep carried them; organized nav merged with monorepo-only entries | +| 4 — Hooked logic | done | BEC/Ninja/quarantine match fork tip; `Test-CIPPAccess`, `Set-CIPPUser`, `Invoke-ExecMcp` kept as monorepo versions, which contain the fork semantics (fail-closed roles, scheduled edits, MCPAllowed) plus newer hardening | +| 5 — Cutover | runbook ready | see `CUTOVER_RUNBOOK_20260815.md`; staging deploy, production migration (`deployment/Invoke-CippMigration.ps1`), and fork-repo archiving are operational steps to run at cutover time — do **not** archive the forks while production still runs on them | + +## Tranche log + +- 2026-08-15 `1bad0c7b` — Phase 0: sync process/tooling/history ported to monorepo. +- 2026-08-15 `5d9f17d5` — Phase 1: Manage365 identity (logos, icons, theme, titles, dual versioning). +- 2026-08-15 `0801ea60` — Phase 2/4 backend: 691-file modified sweep + 128 fork-only endpoints/helpers/standards, Sherweb removal, config merges (standards 207 entries, SAMManifest +10 perms/+3 resource apps, IntegrationTemplates), Craft adaptations, Pester tests. All PowerShell parses clean. +- 2026-08-15 `08ff84fe` — Phase 2/3 frontend: 418-file modified sweep + 93 fork-only pages/components, 98 deletions (dead template sections, Sherweb pages), nav merge, standards.json synced with backend. Kept monorepo versions of auth flow, onboarding wizard, super-admin pages, and the refactored PDF/report suite (fork's report buttons predate upstream's `CippPdf` primitives). Build green: 406 static pages, no import warnings; new routes smoke-tested 200 on the local stack. diff --git a/docs/upstream-sync/PROCESS.md b/docs/upstream-sync/PROCESS.md new file mode 100644 index 0000000000..7aacdb4a14 --- /dev/null +++ b/docs/upstream-sync/PROCESS.md @@ -0,0 +1,172 @@ +# Manage365 Upstream Sync Process (Monorepo) + +This document defines how Manage365 reviews the [CyberDrain CIPP monorepo](https://github.com/CyberDrain/CIPP) on a regular cadence and ports advantageous changes **without** overwriting fork-specific features. + +Manage365 previously tracked the split `KelvinTegelaar/CIPP` and `KelvinTegelaar/CIPP-API` repos. Those cycles (through v10.8.5 / Manage365 v5.33.0, August 2026) are archived under [history-cipp/](./history-cipp/) and [history-cipp-api/](./history-cipp-api/). The principles are unchanged; only the mechanics moved to a single repo and a container deployment. + +**Related artifacts** + +| Document | Purpose | +|----------|---------| +| [history-cipp/CUSTOM_FEATURE_MAP_20260617.md](./history-cipp/CUSTOM_FEATURE_MAP_20260617.md) | Protected fork areas — refresh each cycle | +| [history-cipp/PROCESS.md](./history-cipp/PROCESS.md) | Pre-monorepo (two-repo) edition of this process | +| [README.md](./README.md) | Index of cycle-specific tracking docs | + +--- + +## Principles + +1. **Selective intake, not wholesale merge** — cherry-pick or surgical port; never blind `Sync fork → Discard commits`. +2. **Fork features are protected by default** — see `CUSTOM_FEATURE_MAP`. When in doubt, adapt upstream logic into fork files instead of replacing them. +3. **Frontend + backend move together** — the monorepo makes this natural: a feature's `frontend/` and `backend/` changes ship in the same branch, or the whole feature is deferred. +4. **Explicit approval gates** — no production merge without review checklist and version bump. +5. **GitHub "Sync fork" badge is cosmetic** — a large behind-count is expected with selective intake. + +--- + +## Cadence + +| Cycle type | When | Duration | Goal | +|------------|------|----------|------| +| **Light delta** | Monthly (or when upstream patch releases) | 2–4 hours | Low-risk bugfixes, data JSON, tests, isolated endpoints | +| **Major cycle** | Quarterly (or after upstream minor) | 1–3 days | Full delta inventory, feature intake decisions, dependency review | +| **Feature intake** | As needed (backlog) | 1–5 days each | New upstream capabilities — design first, then port | +| **Hotfix** | Within 48h of critical upstream security fix | Hours | Cherry-pick specific SHA(s), fast deploy | + +--- + +## Cycle workflow + +```mermaid +flowchart TD + A[0. Plan] --> B[1. Protect] + B --> C[2. Inventory] + C --> D[3. Triage] + D --> E[4. Apply mini-batches] + E --> F[5. Verify] + F --> G[6. Checkpoint + PR] + G --> H[7. Version + deploy] + H --> I[8. Close cycle] +``` + +### Phase 0 — Plan + +- [ ] Decide cycle type (light / major / feature intake / hotfix) +- [ ] Record last sync base SHA (from previous checkpoint or tag) +- [ ] For **feature intake**: complete design Q&A before coding + +### Phase 1 — Protect + +```powershell +# From the repo root +./Tools/Start-UpstreamSyncCycle.ps1 +``` + +- [ ] Backup tag on `main` tip (`backup/pre-upstream-sync-manage365-YYYYMMDD`) +- [ ] Sync branch created (`manage365/upstream-sync-YYYYMMDD`); never commit directly to `main` during review +- [ ] Working tree clean + +### Phase 2 — Inventory + +```bash +git log --oneline BASE..upstream/main +git rev-list --left-right --count main...upstream/main +``` + +Generate (or update agent-assisted): + +- `UPSTREAM_DELTA_YYYYMMDD.md` — commits since last base +- Refresh `CUSTOM_FEATURE_MAP_YYYYMMDD.md` if protected areas changed + +### Phase 3 — Triage + +Classify **every candidate** into one outcome: + +| Outcome | Meaning | +|---------|---------| +| **Apply** | Clean cherry-pick or copy; no protected-path conflict | +| **Adapt** | Port logic surgically; do not replace whole fork files | +| **Already implemented** | Fork already has equivalent behavior — document evidence | +| **Defer** | Worth doing later; needs design or conflict resolution | +| **Skip** | Wrong for fork (hosted-only, removes customization, low value) | + +**Protected-path rule:** If any file in `CUSTOM_FEATURE_MAP` is touched, outcome must be **Adapt** or **Defer** — never blind **Apply**. + +### Phase 4 — Apply mini-batches + +- Work in batches of **3–5 commits**, low-risk first +- Order: tests → data JSON → isolated bugfixes → shared components → protected areas last +- After each batch: build/test (see Phase 5) +- Record in `APPLIED_COMMITS_YYYYMMDD.md` (upstream SHA | fork SHA | outcome | notes) +- If cherry-pick conflicts: abort, switch to **Adapt** manual port + +### Phase 5 — Verify + +**Frontend** + +```bash +cd frontend && yarn build +``` + +**Backend** — as applicable: + +- Pester tests for touched modules (`backend/Tests`, `backend/Modules/*/Tests`) +- Local container smoke via `build/docker-compose-all.yml` (`docker compose -p cipp -f build/docker-compose-all.yml up --pull always --watch`) for changed endpoints + +**Manual smoke** (adjust per cycle): + +- Applied standards / drift +- Quarantine + email troubleshooter (protected) +- Top-nav search + dashboard v2 +- Any feature touched in this cycle + +### Phase 6 — Checkpoint + PR + +Write `SYNC_CHECKPOINT_YYYYMMDD.md` with: + +- Branch name, base SHA, tip SHA, backup tag +- Mini-batches table (upstream → outcome) +- Applied / adapted / deferred / skipped lists +- Known concerns and follow-ups +- **Recommendation:** ready for PR / needs more work / stop + +### Phase 7 — Version + deploy + +After merge to `main`: + +```powershell +./Tools/Update-Version.ps1 -UpstreamVersion 10.8.5 -Manage365Version 5.33.0 +``` + +- [ ] Bump `frontend/public/version.json` + `frontend/public/manage365-version.json` + `frontend/package.json` + `backend/version_latest.txt` (via script) +- [ ] Update README **Upstream Integration** section +- [ ] Build and push the container image, passing the upstream baseline as `APP_VERSION` (`build/Dockerfile` injects it into `out/version.json`) +- [ ] Deploy the image to the App Service container (staging slot first if configured) +- [ ] Confirm Application Settings → version page shows green / no false out-of-date toasts + +### Phase 8 — Close cycle + +- [ ] Tag sync completion: `sync/manage365-YYYYMMDD` on merged tip +- [ ] Record new **sync base SHA** in checkpoint (becomes next cycle's `BASE`) +- [ ] Archive deferred items into next cycle's triage queue + +--- + +## Decision guide: merge vs cherry-pick vs adapt + +| Situation | Action | +|-----------|--------| +| Upstream fix in a file we never customized | Cherry-pick **Apply** | +| Upstream changed same file as fork (CippDataTable, applied-standards, quarantine) | **Adapt** surgical diff | +| Upstream new feature, no fork overlap | Port files + wire nav/API | +| Upstream dependency major bump | **Major cycle** only; full build/test | +| Full upstream merge | Separate project; conflict marathon; not default | + +--- + +## Revision history + +| Date | Change | +|------|--------| +| 2026-06-09 | Initial formal process (two-repo era; see history-cipp/PROCESS.md) | +| 2026-08-15 | Monorepo edition — single repo, container deploy, Craft runtime | diff --git a/docs/upstream-sync/QUARANTINE_FEATURES.md b/docs/upstream-sync/QUARANTINE_FEATURES.md new file mode 100644 index 0000000000..6a9162c547 --- /dev/null +++ b/docs/upstream-sync/QUARANTINE_FEATURES.md @@ -0,0 +1,79 @@ +# Quarantine Feature Support Notes + +Manage365/CIPP quarantine features (v5.13.0) use **Exchange Online PowerShell** via `New-ExoRequest`, not Microsoft Graph or Defender REST quarantine APIs. + +See also the [Manage365 README](https://github.com/Celeratec/CIPP) Quarantine Portal section for UI behavior and navigation. + +## Supported via `Get-QuarantineMessage` + +- Time received range (max 30 days per query; default list uses last 7 days) +- Sender / recipient email address +- Exact subject match (`-Subject`) +- Partial subject match (client-side post-filter) +- Quarantine reason (`-QuarantineTypes`) +- Release status (`-ReleaseStatus`) +- Policy type (`-PolicyTypes`) +- Policy name (`-PolicyName`) +- Message / Internet Message ID (`-MessageId`) +- Server-side pagination (`-Page`, `-PageSize` up to 1000) + +## Post-filters (not native EXO parameters) + +- Sender domain / recipient domain (parsed from email addresses) +- Subject contains (partial match) + +When post-filters are active, `ListMailQuarantine` scans multiple raw EXO pages per request and returns metadata such as `HasPostFilters`, `RawRowsScanned`, `FilteredRowsReturned`, and `PostFilterPaginationLimited`. Export remains the most reliable way to review a large filtered result set. + +## Supported actions + +| Action | EXO cmdlet | UI status | +|---|---|---| +| Release to all recipients | `Release-QuarantineMessage -ReleaseToAll` | Wired | +| Release to specific users | `Release-QuarantineMessage -User` | API/backend only | +| Deny | `Release-QuarantineMessage -ActionType Deny` | Wired | +| Delete | `Delete-QuarantineMessage` | Wired | +| Submit to Microsoft (false positive) | `Release-QuarantineMessage -ReportFalsePositive` | Wired | +| Preview / download | `Export-QuarantineMessage` | Wired via EML preview | +| Tenant allow/block sender or domain | `New-TenantAllowBlockListItems` | Wired | +| Mailbox safe sender | `Set-MailboxJunkEmailConfiguration` | Backend endpoint only (`ExecMailboxSafeSender`) | + +## Not supported / limited + +| Defender portal feature | Status | +|---|---| +| Sender display name filter | Not available on `Get-QuarantineMessage` | +| Recipient display name filter | Not available | +| Sending IP on quarantine list | Message trace only (`Get-MessageTraceV2 -FromIP`) | +| Threat Explorer in-app | External deep link only | +| Attachment/URL sandbox verdict in list | Parse EML on preview; not in list API | +| Admin submission portal queue UI | No dedicated EXO cmdlet exposed in CIPP | +| Transport rule creation from quarantine | Use existing transport rule pages only | +| Graph `/security/quarantineMessages` | Not used | + +## Permissions + +Requires `Exchange.Manage` delegated consent (SAM) and GDAP roles such as Security Administrator / Exchange Administrator in the client tenant. CIPP internal roles: + +- `Exchange.SpamFilter.Read` — list/detail/export +- `Exchange.SpamFilter.ReadWrite` — release, deny, delete, allow/block +- `Exchange.TransportRule.Read` — Email Troubleshooter trace leg +- `Exchange.Mailbox.Read` — message trace details + +## Performance defaults + +- `ListMailQuarantine` returns one paginated page (100 rows, 7-day window) when called with `manualPagination=true` +- Legacy full-dump behavior requires `fetchAll=true`; the old implicit single-call full dump without `fetchAll` is no longer the default +- Detail metadata fetched only via `GetMailQuarantineMessage` on row open +- EML exported only via `ListMailQuarantineMessage` on preview +- AllTenants cache paginates up to 5 pages × 1000 rows per tenant (30-day window) + +## Export behavior + +- `ExportMailQuarantine` scans up to 5,000 **raw** EXO rows, then applies post-filters +- `Metadata.truncated` reflects the raw EXO row cap, not the final filtered export count +- `Metadata.FilteredRowsReturned` reports the number of rows in the downloaded file + +## API query notes + +- Quarantine Management sends multi-select GET filters (`releaseStatus`, `quarantineType`, `policyTypes`) as comma-separated strings +- Email Troubleshooter uses POST bodies and may send arrays directly diff --git a/docs/upstream-sync/README.md b/docs/upstream-sync/README.md new file mode 100644 index 0000000000..400e277e2d --- /dev/null +++ b/docs/upstream-sync/README.md @@ -0,0 +1,17 @@ +# Upstream Sync Tracking + +Cycle-specific tracking documents for Manage365's selective intake from the [CyberDrain CIPP monorepo](https://github.com/CyberDrain/CIPP). + +- **[PROCESS.md](./PROCESS.md)** — the sync process (monorepo edition). Start here. +- **`UPSTREAM_DELTA_YYYYMMDD.md`** — commit inventory for a cycle +- **`SYNC_CHECKPOINT_YYYYMMDD.md`** — cycle results and next sync base +- **`APPLIED_COMMITS_YYYYMMDD.md`** — per-commit outcomes + +## Pre-monorepo history + +Before August 2026, Manage365 tracked the split `KelvinTegelaar/CIPP` and `KelvinTegelaar/CIPP-API` repos and deployed to Azure Static Web Apps + Function App slots. Those cycle documents are preserved: + +- [history-cipp/](./history-cipp/) — frontend (CIPP) cycles through v10.8.5 / Manage365 v5.33.0 +- [history-cipp-api/](./history-cipp-api/) — backend (CIPP-API) cycles through v10.8.5 + +The migration of Manage365 customizations into this monorepo is documented in [MONOREPO_MIGRATION_20260815.md](./MONOREPO_MIGRATION_20260815.md). diff --git a/docs/upstream-sync/SHAREPOINT_IMAGE_OPTIMIZER.md b/docs/upstream-sync/SHAREPOINT_IMAGE_OPTIMIZER.md new file mode 100644 index 0000000000..b6ccec4187 --- /dev/null +++ b/docs/upstream-sync/SHAREPOINT_IMAGE_OPTIMIZER.md @@ -0,0 +1,247 @@ +# SharePoint Image Optimizer + +Tenant-scoped tool that helps MSP admins reduce SharePoint Online storage consumed by +oversized JPG/JPEG images. It can audit large images, compress them server-side, replace the +original file, and (optionally) remove old file versions so the space is actually reclaimed. + +> **Frontend:** Teams & SharePoint → SharePoint → **Image Optimizer** +> (`/teams-share/sharepoint/image-optimizer`) +> **Backend:** PowerShell Azure Functions in `Modules/CIPPHTTP/.../Teams-Sharepoint/` and helpers +> in `Modules/CIPPCore/Public/SharePoint/Image Optimizer/`. + +--- + +## 1. Purpose + +Large, un-optimized JPGs (camera originals, marketing assets, scanned documents) frequently +dominate SharePoint storage. This feature lets an admin find those files in a specific document +library and shrink them with a conservative, auditable, opt-in workflow. + +## 2. What it does + +- **Runs in the background (queued).** Scanning/compressing a real library easily exceeds the + ~230-second Azure HTTP gateway limit, so a run is **queued** and processed by a background worker + (`Start-CIPPSharePointImageOptimizer`); the UI polls for status/results. This is the same pattern + used by Temp File Cleanup and is what prevents the "it spins then fails" timeout. +- **Folder targeting.** A run can be scoped to a **specific folder** (with or without subfolders) + instead of always scanning the whole library from the root — both for usability and to keep runs + well under the timeout. +- **Audit** — recursively scans a document library (drive), or a chosen folder, for `.jpg` / + `.jpeg` files at or above a size threshold and reports each candidate. +- **Compress** — downloads each eligible JPG, re-encodes it server-side at a configurable quality, + compares sizes, and (when not a dry run) uploads the smaller copy over the original. +- **Version cleanup** (optional, destructive) — after a successful compression, removes old file + versions so version history stops holding the original large bytes. +- **Reports** per-file and summary results, exportable to CSV/JSON. + +## 3. What it does **not** do + +- It does not process non-JPG files. Only `.jpg` / `.jpeg` (case-insensitive). +- It does not upload a result that is larger than the original, or that fails the minimum savings + threshold. +- It does not modify any file or delete any version while **Dry run (WhatIf)** is enabled. +- It does not delete the current/latest version of a file — only previous versions. +- It does not empty the site recycle bin. Recycled versions still occupy storage until the recycle + bin is purged or its retention expires. +- It does not preserve EXIF/metadata. Re-encoding removes it (see limitations). +- It is **not** intended for source/archival photography libraries without client approval. + +## 4. Storage warning about version history + +**Replacing a JPG does not immediately reclaim SharePoint storage.** When versioning is enabled +(the default for most libraries), uploading a compressed copy creates a new version while the +previous, larger version is retained. Real storage savings require either: + +1. Deleting old versions (this tool's version cleanup), **and/or** +2. Waiting for the recycle bin / version retention to expire. + +Use **Compress and delete old versions** with the **permanent** cleanup mode to reclaim space +immediately, understanding it is not recoverable. + +## 5. Recommended settings + +| Setting | Recommended | Notes | +|---|---|---| +| Mode | `Audit only` first | Always preview before changing data. | +| Dry run (WhatIf) | `On` for the first compress run | Confirms savings before writing. | +| File size threshold | `5 MB` | Raise for libraries with many medium images. | +| JPEG quality | `82` | Range 60–95. 80–85 is visually near-lossless for most photos. | +| Minimum savings % | `15%` | Skips files that barely shrink. | +| Strip EXIF metadata | `On` | Smaller files; removes camera/GPS metadata. | +| Version cleanup | `Recycle` | Recoverable. Use `Permanent` only when space must be reclaimed now. | +| Max files | set a cap on first live run | Limits blast radius / throttling. | + +Equivalent ImageMagick intent (for reference): `magick input.jpg -strip -interlace Plane -sampling-factor 4:2:0 -quality 82 output.jpg`. + +## 6. Permissions + +The feature reuses CIPP's existing SAM permissions — **no new SAMManifest entries are required**. +Capabilities used (least privilege that satisfies the operations): + +| Operation | API | Permission (already in `SAMManifest.json`) | +|---|---|---| +| List sites / drives, read items, read versions | Microsoft Graph (app-only) | `Sites.Read.All` (Role) | +| Download & overwrite file content | Microsoft Graph (app-only) | `Files.ReadWrite.All` / `Sites.ReadWrite.All` (Role) | +| Delete/recycle old file versions | **SharePoint REST** `_api/web/GetFileById(...)/versions/...` (**delegated**) | `AllSites.FullControl` (Scope) on SharePoint Online (`00000003-0000-0ff1-ce00-000000000000`) | + +### Why version cleanup uses SharePoint REST (delegated), not Graph + +Microsoft Graph officially supports **list / get / download / restore** of `driveItemVersion`, +but **does not officially support deleting a specific version** (the unofficial +`DELETE /drives/{id}/items/{id}/versions/{id}` is not supported and is unreliable). The supported, +reliable mechanism is the SharePoint REST file-versions API: + +``` +POST {siteUrl}/_api/web/GetFileById('{uniqueId}')/versions/recycleAll() # recycle (recoverable) +POST {siteUrl}/_api/web/GetFileById('{uniqueId}')/versions/deleteAll() # permanent (reclaims now) +``` + +Per the CIPP `sharepoint-api-auth` convention, site-level `_api/web/*` is **delegated-only** +(no `-AsApp`); the SAM refresh token is used with scope `{SharePointUrl}/.default`. + +If the app/account lacks the delegated permission, **compression can still succeed while version +cleanup fails** — the UI surfaces this with a per-file status of +`Compressed, version cleanup failed` and a permission warning banner. + +## 7. Known limitations + +- Version cleanup may be blocked by **retention policies, retention labels, legal hold, or + insufficient permissions**. Those files report an error and are skipped, without aborting the run. +- **Recycle-bin deletion does not immediately reclaim storage** until the recycle bin retention + clears or the recycle bin is emptied. Only `permanent` (`deleteAll`) reclaims immediately. +- **Compression strips EXIF metadata** when enabled, removing camera, GPS, and creation metadata. + "Preserve modified metadata" is intentionally disabled — re-encoding cannot preserve it safely. +- **Some already-optimized JPGs will not shrink** and are skipped by the minimum-savings rule. +- This feature should not be run against **source/archival photography libraries** without client + approval. +- The image engine requires **SkiaSharp** (preferred) or **System.Drawing.Common** (Windows-only + fallback) to be available in the Function runtime. See *Image engine deployment* below. + +### Image engine deployment + +`Compress-CIPPImage` tries, in order: + +1. **SkiaSharp** — cross-platform. If the `SkiaSharp.dll` (plus its native runtime asset) is + bundled with the Function app it is loaded automatically; this is the recommended engine for + Linux/container hosting. +2. **System.Drawing.Common** — built into the runtime but **only supported on Windows**. Acts as a + zero-dependency fallback on the standard Windows Functions plan. + +If neither is available the affected files return `Failed` with a clear engine-unavailable error; +no data is modified. + +## 8. Throttling guidance + +- Graph reads/writes use `New-GraphGetRequest` / `New-GraphPOSTRequest`, which already retry on + HTTP 429/503 with backoff and honor `Retry-After`. +- File download/upload (`Invoke-RestMethod`) is wrapped in an exponential-backoff retry for + 429/503. +- Audit lists pages of 200 items and follows `@odata.nextLink` automatically. +- Use **Max files** and the per-run hard cap (500) to keep batches small. For very large + libraries, run in batches rather than all at once. + +## 9. Retention / records management warning + +Deleting old versions changes recovery expectations. If a library is subject to retention policies, +retention labels, or legal hold, version deletion may be **blocked** (reported per file) or may +**conflict with compliance requirements**. Confirm with the client's records-management policy +before using `permanent` cleanup. The current version is always preserved. + +## 10. Test plan + +### Automated (Pester) + +`Tests/Endpoint/Invoke-SharePointImageOptimizer.Tests.ps1` covers: + +1. Audit returns only `.jpg` / `.jpeg`. +2. Files below the threshold are skipped. +3. WhatIf does not upload or delete versions. +4. A compressed result larger than the original is skipped. +5. Minimum savings percent is respected. +6. Version cleanup never deletes the current version. +7. Throttling retry behavior (`Invoke-CIPPImageHttpWithRetry`). +8. Permission failure returns a clear per-file error. +9. Empty library returns a successful empty result. + +Run: `Invoke-Pester -Path Tests/Endpoint/Invoke-SharePointImageOptimizer.Tests.ps1 -Output Detailed` + +### Manual smoke test + +1. Create a test SharePoint site and document library. +2. Upload several large JPGs (> threshold). +3. Enable versioning on the library. +4. Upload multiple versions of at least one JPG. +5. Run **Audit only** — confirm only large JPGs are listed. +6. Run **Compress only** with **Dry run = on** — confirm projected savings, no changes. +7. Run **Compress only** with **Dry run = off** — confirm file is smaller and opens correctly. +8. Confirm old versions still exist (cleanup not selected). +9. Run **Compress and delete old versions** on the test file(s). +10. Confirm old versions are removed per the selected cleanup mode (recycle vs permanent). +11. Confirm storage behavior; document any recycle-bin delay for `recycle` mode. + +## Result shape + +```json +{ + "Tenant": "contoso.onmicrosoft.com", + "SiteUrl": "https://contoso.sharepoint.com/sites/Marketing", + "Library": "Documents", + "Mode": "CompressAndCleanup", + "WhatIf": false, + "Summary": { + "FilesScanned": 1200, + "EligibleFiles": 83, + "FilesCompressed": 80, + "FilesSkipped": 3, + "OriginalBytes": 987654321, + "CompressedBytes": 296296296, + "EstimatedSavingsBytes": 691358025, + "VersionsDeleted": 240, + "Errors": 0 + }, + "Results": [ + { + "FileName": "example.jpg", + "WebUrl": "https://contoso.sharepoint.com/sites/Marketing/Documents/example.jpg", + "DriveItemId": "01ABC...", + "DriveId": "b!xyz...", + "OriginalBytes": 10485760, + "CompressedBytes": 3145728, + "SavingsBytes": 7340032, + "SavingsPercent": 70.0, + "VersionCountBefore": 12, + "VersionsDeleted": 11, + "Status": "Compressed and versions cleaned", + "Error": null + } + ], + "Warnings": [] +} +``` + +### Per-file statuses + +`Found`, `Skipped: below threshold`, `Skipped: compression savings too small`, +`Skipped: locked`, `Compressed`, `Compressed, version cleanup failed`, +`Compressed and versions cleaned`, `Failed`. + +## Endpoints + +| Endpoint | Method | Role | Purpose | +|---|---|---|---| +| `/api/ListSites` (existing) | GET | `Sharepoint.Site.Read` | Site picker | +| `/api/ListSharePointDocumentLibraries` | GET | `Sharepoint.Site.Read` | Library picker | +| `/api/ListSharePointFolders` | GET | `Sharepoint.Site.Read` | Folder picker (scope a run to one folder) | +| `/api/ListSharePointImageCandidates` | GET/POST | `Sharepoint.Site.Read` | Standalone audit (read-only) | +| `/api/ExecSharePointImageOptimize` | POST | `Sharepoint.Site.ReadWrite` | **Queues** a job: Audit / Compress / CompressAndCleanup. Returns `{ Queued, QueueId }`. | +| `/api/ListImageOptimizerResults` | GET | `Sharepoint.Site.ReadWrite` | Poll a queued job by `queueId`; returns `Status` (`Running`/`Completed`) and the full result. | +| `/api/ExecSharePointImageVersionCleanup` | POST | `Sharepoint.Site.ReadWrite` | Standalone version cleanup for selected files | + +### Async run flow + +1. UI `POST /api/ExecSharePointImageOptimize` → endpoint calls `New-CippQueueEntry` + + `Add-CippQueueMessage -Cmdlet 'Start-CIPPSharePointImageOptimizer'` and returns `{ Queued, QueueId }`. +2. The `CIPPQueueTrigger` runs `Start-CIPPSharePointImageOptimizer`, which calls + `Invoke-CIPPSharePointImageOptimizer` and writes the result to the `CacheImageOptimizer` table. +3. UI polls `GET /api/ListCippQueue?QueueId=...` until the queue entry is `Completed`/`Failed`, then + `GET /api/ListImageOptimizerResults?queueId=...` to retrieve the cached result. diff --git a/docs/upstream-sync/UPSTREAM_DELTA_20261005.md b/docs/upstream-sync/UPSTREAM_DELTA_20261005.md new file mode 100644 index 0000000000..338dbf4146 --- /dev/null +++ b/docs/upstream-sync/UPSTREAM_DELTA_20261005.md @@ -0,0 +1,67 @@ +# Upstream Delta — Manage365 — 2026-10-05 + +Cycle: **Major** — CyberDrain CIPP **10.8.5 → 11.0.2**, applied on the monorepo only. Production `Celeratec/CIPP` and `Celeratec/CIPP-API` are unchanged. + +| | SHA / version | +|--|--| +| Sync base | `e8bfee212` (Manage365 `main`, upstream baseline **10.8.5**) | +| Backup tag | `backup/pre-upstream-sync-manage365-20261005` | +| Sync branch | `manage365/upstream-sync-20261005` | +| Step 1 | `v10.9.1` (`8bf90d4a6`) | +| Step 2 | `v10.10.3` | +| Step 3 | `v11.0.2` (`220099ead`) | + +## v10.9.1 triage + +315 commits. 114 conflicts. Outcomes: + +| Area | Outcome | Notes | +|------|---------|-------| +| CyberDrain-only workflows (`CodeQL_Analyser`, issue comment/label) | **Skip** | Kept deleted by the fork CI commit | +| Hosted add-subscription page | **Skip** | Still deleted | +| Sherweb licence-report nav item | **Skip** | Page was removed in the August port; the path does not exist. Gated Sherweb fields on Add User stay, because they only render when the integration is enabled | +| Quarantine list, management, all-tenant sync, quarantine page | **Adapt** | Kept the Manage365 EXO portal (filters, export, bulk actions, deterministic row keys) | +| Version card, release notes, product title | **Adapt** | Manage365 version source and title kept. Took upstream release-note picker and mobile footer | +| `standards.json` (backend and frontend) | **Adapt** | Union of names. Kept Manage365 TAP help text. Took "Microsoft managed" and the device-preparation label | +| Navigation (`config.js`, top nav, side nav) | **Adapt** | Union of both menus. Baselines stay feature-flag gated and off | +| Group add | **Adapt** | Upstream directory-id resolver, plus already-a-member counted as success | +| Guest users | **Adapt** | Upstream list contract, plus `lastSignIn`, `isStale`, `neverSignedIn` and summary cards | +| Domain analyser cache, text replacement, Intune policy, custom roles, Halo, community repo | **Apply** | Upstream side of the conflict was the fix | +| Report list pages | **Adapt** | Shared report-database sync. Manage365 card views, drawers, and custom actions kept | +| CippDataTable, toolbar, user actions, offboarding wizard | **Adapt** | Both card/action behavior and upstream mobile, filter, and new actions | + +## v10.10.3 triage + +Merged onto the v10.9.1 result. Conflicts were files both sides changed after 10.9.1 (MUI 9 renames to `.jsx`, Graph message trace, JIT/PIM, GDAP templates). + +| Area | Outcome | Notes | +|------|---------|-------| +| CyberDrain workflows, dashboard v1, add-subscription, Sherweb licence report and migration | **Skip** | Kept deleted | +| Quarantine page | **Adapt** | Manage365 EXO portal kept | +| Standards catalog and standards/drift pages | **Adapt** | Union. Baselines flag left off. Standards pages stay available | +| Navigation and version card | **Adapt** | Union of menus. Manage365 version card kept | +| Message trace, JIT/PIM, GDAP templates, report pagination | **Apply** | Upstream behavior, with Manage365 card views and action categories kept | +| Retired `.js` pages (`404`, roles, message trace, bulk add, GDAP roles, icon registry) | **Apply** | Removed where a `.jsx` page or redirect already covers the route | +| Cutover script | **Apply** | Upstream script is in-tree. Runbook updated: live run deletes file shares; storage account, tables, blobs, queues, and Key Vault stay. Script was not executed | + +## v11.0.2 triage + +Merged onto the v10.10.3 result. 83 conflicts. + +| Area | Outcome | Notes | +|------|---------|-------| +| CyberDrain workflows (`CodeQL_Analyser`, `auto_comments`, `pr_check`) | **Skip** | Kept deleted | +| BPA report pages, remediation card, BEC user page, report-builder PDF | **Adapt** | Kept. Upstream had deleted them. Standards still record while the Baselines flag is off | +| SAM manifest and permission translator | **Adapt** | Union. Dynamics, BAP, and Power Platform resource apps kept, plus the new upstream app | +| Standards catalog | **Adapt** | All names kept. Passkey value aligned to `FIDO2` | +| Security Simulations, Service Health, MCP client, NinjaOne sync | **Apply** | Upstream behavior, with Manage365 labels and the NinjaOne mapping guard | +| Baselines feature flag | **Skip** | Not enabled. Standards and drift stay available | + +## 24 Aug identity/BEC hotfix + +`Disable-CIPPUserInboxRules.ps1` was not copied. v11 `Disable-CIPPInboxRules` already disables processable rules and skips Exchange delegate rules. The HTTP remediator still ran that work inside the request, so an inline `ExecBECRemediate` call now queues only `DisableInboxRules` and returns the rest immediately. License assignment uses an app-only Graph token, and a privilege denial explains department SKUs, CPV, and GDAP. + +## Still open in this cycle + +- Baselines feature flag stays off so existing standards keep running. +- This alignment is not deployed. Production stays on the two-repo stack until a separate cutover. diff --git a/docs/upstream-sync/history-cipp-api/APPLIED_COMMITS_CIPP_API_20260617.md b/docs/upstream-sync/history-cipp-api/APPLIED_COMMITS_CIPP_API_20260617.md new file mode 100644 index 0000000000..77f88df39a --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/APPLIED_COMMITS_CIPP_API_20260617.md @@ -0,0 +1,81 @@ +# Applied Commits Tracking — CIPP-API (Backend) + +Generated: 2026-06-17 +Branch: `manage365/upstream-sync-cipp-api-20260617` +Backup tag: `backup/pre-upstream-sync-cipp-api-20260617` + +Branch tip (after Batch 8): `5aba18061` + +## Summary + +| Status | Count | +|--------|-------| +| Applied cleanly | 11 | +| Applied with adaptation | 4 | +| Applied with adaptation (partial) | 0 | +| Skipped | 0 | +| Deferred (pending decision/adaptation) | 3 | +| Already implemented | 5 | +| Review complete | See `DEFERRED_REVIEW_CIPP_API_20260617.md` | + +## Commit Log + +| Upstream SHA | Applied SHA | Status | Reason | Files | Tests | Notes | +|--------------|-------------|--------|--------|-------|-------|-------| +| `2b4412449f1905c0bd8d5f89e93dcdeaac736d39` | `365937de821318968bda27b9b44180160afef4b1` | Applied cleanly | Low-risk test/helper addition; no custom overlap | `Modules/CIPPCore/Private/Get-CIPPLevenshteinDistance.ps1`, `Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1` | Pester: 34 passed (`Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1`) | Cherry-pick `-x` succeeded with no conflicts | +| `133f929555f5d26a17757802d22ceaa8b3f6b926` | `05f48e4fb` | Applied with adaptation | Partial apply only — Levenshtein test path fallback; skipped fuzzy-match test file | `Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1` | Pester: 34 passed (Levenshtein), 13 passed (`Tests/Tools`) | Full cherry-pick conflicted on modify/delete of `Tests/Private/Find-CIPPFuzzyPolicyMatch.Tests.ps1` (not in fork). Skipped fuzzy-match test path change and did not add upstream fuzzy-match helper. Added `Public/Tools/` → `Private/` path fallback per upstream intent. | +| `6aa66c744b8c755f48b75044ca5c876e9e2c90e3` | `1784ccb993fdb316e37bf768168941deeea587f2` | Applied cleanly | Custom test alert-on-status feature; no protected-area overlap | `Invoke-AddCustomScript.ps1`, `Invoke-CippTestCustomScripts.ps1` | Pester: 47 passed (Levenshtein + `Tests/Tools` regression) | Adds configurable `AlertStatuses` for custom script test failures. No dedicated Pester suite for custom scripts. | +| `ee0b82294a849bf992ec3ff7ce09b517f4e17fba` | — | Deferred | **Conflict:** upstream modifies `CippReportingDB` cleanup rule; block absent in fork | `Start-TableCleanup.ps1` | Not run | Deferred review: **Skip cherry-pick** — needs product decision on cache TTL, not missing feature. See `DEFERRED_REVIEW_CIPP_API_20260617.md` §A. | +| `fdf313e5cfb08b2da7bba256201daf2de9ba15ff` | — | Deferred | **Conflict:** removes `PartitionKey eq 'Search'` on `CippReportingDB` cleanup; block absent | `Start-TableCleanup.ps1` | Not run | Deferred review: **Skip cherry-pick** — unfiltered 30-day delete unsafe verbatim. See §A. | +| `5ccf15a9197c67cb8fdde40606dd7b26a476ae1a` | `5d08be470412057bc8cba5fee192e374eacbe8fb` | Applied cleanly | Intune policy definition fallback when bulk Graph returns non-200; no protected-area overlap | `Invoke-ListIntunePolicy.ps1` | Pester: 47/47 passed (Levenshtein + `Tests/Tools` regression) | Adds template-based fallback for missing `settingDefinitions` on configuration policies. No Intune-specific Pester suite. | +| `9ba48711c614be8e2452ffff2e539b5b1a11b534` | `a091f6f42` | Applied cleanly | Fixes Intune compliance check-in default (130→120) to match max validator | `Config/standards.json`, `Invoke-CIPPStandardIntuneComplianceSettings.ps1` | Batch regression: 47/47 passed | Default was invalid (130 > max 120). Standards config change only. | +| `897dfaa4f07443e0f05f8f2aefa5b0a92fc91a9c` | `69e5f37d9` | Applied cleanly | Standards bugfix #5997 — verify spam filter rule is Enabled; re-enable if Disabled | `Invoke-CIPPStandardSpamFilterPolicy.ps1` | Batch regression: 47/47 passed | Uses `New-ExoRequest` in standards deploy path (not quarantine/message trace HTTP endpoints). | +| `23c8994da9a523a6fbce594181f0c74e5fb1a69e` | `d1a696258` | Applied cleanly | Typo fix #5990 — Edge toolbar unpinned state `hidden` → `default_hidden` | `Invoke-CIPPStandardDeployCheckChromeExtension.ps1` | Batch regression: 47/47 passed | Single-line standards constant fix. | +| `4214bc7de39c563d0979b2717239e9acda4752e7` | — | Already implemented | Merge commit (#2054) whose substantive change is upstream `5ccf15a9`, already applied as `5d08be470` | `Invoke-ListIntunePolicy.ps1` (same 34-line fix) | Not run | Did not cherry-pick merge commit. Superseded by prior batch 2 apply of `5ccf15a9`. | +| `57b7de1f31bcffa3ebc3ba1f05d5d47fa1b6bffe` | — | Deferred | **Conflict:** rename inside usage-tracking block absent in fork | `Invoke-ListIntuneTemplates.ps1` | Not run | Deferred review: **Skip** — frontend uses neither property. See §B. | +| `ecbc9a50ac0584e0d0ce59259214ebe6d9cf525a` | `6698dded1` | Applied cleanly | Graceful skip + Warning log when standard function missing from CIPPStandards module | `CIPPActivityTriggers/.../Push-CIPPStandard.ps1`, `CIPPCore/.../Push-CIPPStandard.ps1` (mirror) | Batch regression: 47/47 passed | Upstream cherry-pick to ActivityTriggers; **Adapted mirror fix to CIPPCore** in follow-up commit. Changes failure mode from invoke error to early return with Warning. | +| `781930205c67fc17a5ca887755361987a407012a` | `b6ced9be6` | Applied cleanly | Fixes `$Item` variable shadowing in orchestrator batch retrieval loop | `CIPPActivityTriggers/.../Push-OrchestratorBatchItems.ps1`, `CIPPCore/.../Push-OrchestratorBatchItems.ps1` (mirror) | Batch regression: 47/47 passed | Upstream cherry-pick to ActivityTriggers; **Adapted mirror fix to CIPPCore** in follow-up commit. Renames inner loop variable to `$BatchItem`. | +| `785e71c530a39b46f56cea7c598f7d609d8a8518` | — | Deferred | **Conflict:** fork `"$null"` string locale vs upstream Graph locale/language fix | `Set-CIPPDefaultAPDeploymentProfile.ps1` | Not run | Deferred review: **Needs product decision**. See `DEFERRED_REVIEW_CIPP_API_20260617.md` §C. | +| `95d48d1fe90a2e57c7459afa1330290ef659ff02` | `7bccfcdb5` | Applied cleanly | Copilot Readiness test uses correct desktop activations cache field | `Invoke-CippTestCopilotReady003.ps1` | Batch regression: 47/47 passed | Tests-only; 1 file. | +| `f5f7ae7064404c314d6cd5694ee1260d1e543c0f` | `55e95d467` | Applied cleanly | Dedup batch table writes by PartitionKey+RowKey; scope test discovery to CIPPTests module | `Add-CIPPAzDataTableEntity.ps1`, `Invoke-CIPPTestCollection.ps1` | Batch regression: 47/47 passed | Prevents duplicate test result rows. Table dedup affects all small-entity batch writes — monitor for side effects. | +| `ddc264a771b27807a35d12fd3645d4693b4a21f8` | `29750b377` | Applied with adaptation | Manual 100→500 licensed-user display cap in fork GenericTest002 implementation | `Invoke-CippTestGenericTest002.ps1` | Batch 7 regression: 47/47 passed | Batch 7 adapted apply — no cherry-pick. Upstream commit is cap-only; fork retains LicenseOverview cache logic. | +| `64836c02a801a3718c2bd2e598bcf206c973541d` | — | Already implemented | Equivalent logic on `master` as `d9a8c33b5` (`LastScheduledTime` scheduled-task rerun detection) | `Test-CIPPRerun.ps1` | Not run | Deferred review 2026-06-17: skip cherry-pick. See `DEFERRED_REVIEW_CIPP_API_20260617.md` §E. | +| `2ab0e0e27c77d146301b427365e0d305e813137d` | — | Already implemented | Equivalent logic on `master` as `76b390f1a` (`Add-Member -Force` on rerun cache entities) | `Test-CIPPRerun.ps1` | Not run | Deferred review 2026-06-17: skip cherry-pick. See `DEFERRED_REVIEW_CIPP_API_20260617.md` §E. | +| `cbcc61b5afd8c7ea9bb9bef1da7878465afc5610` | — | Already implemented | ORCA103 test fix already present from v10.5.2 intake (`2699da195 Fixes ORCA103`) | `Invoke-CippTestORCA103.ps1` | Not run | Cherry-pick produced empty patch; skipped. | +| `503eac5bdb6322f1e42b8e90cc48ab9f3b4c4c5b` | `29750b377` | Applied with adaptation (test-only) | CIS 1.3.4 reads `AppsAndServices` cache first with Settings fallback; cache hunk skipped — fork bulk fetch already implements `AppsAndServices` type | `Invoke-CippTestCIS_1_3_4.ps1` | Batch 7 regression: 47/47 passed | Did not modify `Set-CIPPDBCacheSettings.ps1`. See deferred review §F. | +| `961462f346d5b8fe357dc322e550dee95a644232` | `29750b377` + Batch 8 | Applied with adaptation | Role-assignment test fixes — `RoleAssignmentScheduleInstances` + role member discovery | `Invoke-CippTestCIS_1_1_1.ps1` (Batch 7), `Invoke-CippTestCIS_1_1_2.ps1`, `Invoke-CippTestCIS_1_1_3.ps1`, `Invoke-CippTestCIS_1_1_4.ps1`, `Invoke-CippTestZTNA21782.ps1` (Batch 8) | Pester 47/47 after each file | Batch 7: CIS_1_1_1 uses `Get-CippDbRole`. Batch 8: CIS_1_1_2/3 use GA `members` + schedule instances; CIS_1_1_4 mirrors CIS_1_1_1 privileged discovery; ZTNA21782 filters privileged principals only, preserves fork markdown output. No live-tenant Pester for individual CIPPTests — requires cached Roles/Users/UserRegistrationDetails. | +| `fd6e30f62fb209f2b706b359bd1b91f5ef368081` | `610cb089b` | Applied cleanly | Narrow standards bugfix — read/write `azureADRegistration.allowedToRegister` instead of `azureADJoin.allowedToJoin`; skip remediate when `isAdminConfigurable` is false | `Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1` | Batch regression: 47/47 passed | Device registration standard only. Log message wording updated. Validate intuneRestrictUserDeviceRegistration deploy in test tenant. | + +## Proposed Next 10 Low-Risk Candidates + +| Priority | SHA | Title | Files | Risk | Why safe | Dependencies | +|----------|-----|-------|-------|------|----------|--------------| +| 1 | `95d48d1f` | Fix desktop activations copilot ready test | 1 test | Low | Tests-only | None — **applied** | +| 2 | `ddc264a7` | Update Invoke-CippTestGenericTest002.ps1 | 1 test | Low | Tests-only | **Deferred — conflict** | +| 3 | `f5f7ae70` | fixes duplicate test calls | 2 (test infra) | Low | Test dedup + module-scoped discovery | None — **applied** | +| 4 | `64836c02` | fix: rerun detection on scheduled tasks | 1 | Low | Scheduled-task rerun fix | Pair with `2ab0e0e2`; **deferred — conflict** | +| 5 | `2ab0e0e2` | fix: rerun issue | 1 | Low | Refines Test-CIPPRerun | After `64836c02` review | +| 6 | `0640f07c` | Fixes ORCA179 | 1 test | Low | ORCA test-only | May overlap v10.5.2 ORCA intake — verify first | +| 7 | `503eac5b` | fix: apps and services test | 2 | Low | CIS test + cache settings | Cache touch — review diff | +| 8 | `fd6e30f6` | fix(standards): azureADRegistration target | 1 standard | Low-Med | Isolated standards bugfix | Standards deploy behavior change | +| 9 | `961462f3` | fix: role assignment checks | 5 tests | Low | Test assertion fixes | 5 files but tests-only | +| 10 | `55ddb18b` | Update Invoke-ExecTestRun.ps1 | 1 | Low-Med | Test runner endpoint | 55-line diff — inspect before apply | + +## Batch 8 Validation (2026-06-17) + +| File | Pester after change | Live tenant | +|------|---------------------|-------------| +| `Invoke-CippTestCIS_1_1_2.ps1` | 47/47 passed | Requires Roles, Users, RoleAssignmentScheduleInstances cache | +| `Invoke-CippTestCIS_1_1_3.ps1` | 47/47 passed | Requires Roles, RoleAssignmentScheduleInstances cache | +| `Invoke-CippTestCIS_1_1_4.ps1` | 47/47 passed | Requires Get-CippDbRole, Users, RoleAssignmentScheduleInstances cache | +| `Invoke-CippTestZTNA21782.ps1` | 47/47 passed | Requires UserRegistrationDetails, Roles, RoleAssignmentScheduleInstances cache | + +## Next Steps + +1. **Batch 8 complete** — all `961462f3` role-assignment test adaptations applied. +2. **Product decisions:** `CippReportingDB` retention (`ee0b8229`/`fdf313e5`), Autopilot language (`785e71c5`), Intune template usage feature (`57b7de1f` chain). +3. **Tenant smoke test:** Run CIS 1.1.x and ZTNA21782 against a tenant with refreshed cache to validate role member + PIM schedule discovery. +4. **Skip permanently:** rerun commits (`64836c02`, `2ab0e0e2`), template rename (`57b7de1f`), AppsAndServices cache hunk (`503eac5b`). +5. **Smoke test:** `intuneRestrictUserDeviceRegistration` (`610cb089b`) — checklist in deferred review doc. +6. **Follow-up:** Mirror or remove stale `CIPPCore/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1` duplicate; stale `CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21782.ps1` mirror may need sync review. +7. CIPP frontend parked at `3c0ef6904` checkpoint — resume mini-batch 3 when ready. diff --git a/docs/upstream-sync/history-cipp-api/BASELINES_INTAKE_20260814.md b/docs/upstream-sync/history-cipp-api/BASELINES_INTAKE_20260814.md new file mode 100644 index 0000000000..f25c2fe520 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/BASELINES_INTAKE_20260814.md @@ -0,0 +1,25 @@ +# Baselines Feature Intake — 2026-08-14 + +Cycle type: **Feature intake** within major 10.8.x sync. Per [PROCESS.md](PROCESS.md). + +## Feature: Baselines (drift-first engine) + +- Upstream refs: `Modules/CIPPCore/Public/Baselines/*` (29), `Set-CippBaselineRunContext.ps1`, `Start-CIPPBaselineOrchestrator`, HTTP Baseline* entrypoints, `Config/BaselineStandards/**`, FE `src/pages/tenant/baselines/**` + `CippBaselines/*`, FeatureFlags `Baselines`, timer `9f2c7b1e-4a6d-4c3f-8b9a-5e1d2f7c0a44` +- Fork gap: no baselines pages/APIs/modules +- Protected conflicts: Applied Standards / drift UI — baselines are **parallel**, not a replacement; Adapt any shared Intune compare helpers +- Scope: **capability** on existing SWA + Function App Durable — no Craft, no EasyAuth migration +- Hosting: Azure Tables (`Baselines`, `BaselineRollouts`, `BaselineAlignment`, history/trend/locks) + existing `Start-CIPPOrchestrator` / standards processor slot +- Flag behavior: `Enabled: false` by default; flag gates **scheduled timer only**; pages/on-demand work when flag off (upstream design). Manage365 keeps flag off until smoke; optionally hide nav until enabled +- Phases: design → API modules/config/HTTP/orch → FE pages/components → verify → PR → deploy → enable flag after smoke +- Approval: [x] design (approved via major-cycle plan execute) [x] implement [ ] deploy (enable) + +## Branding (sibling Adapt) + +- Upstream: `ListBrandingSettings`, `ListBrandingPresets`, `Get-CIPPBranding*`, PDF cover helpers +- Fork: keep Manage365 `CippBrandingSettings` / `customBranding`; surgical merge only — do not wipe branding UX + +## Explicit non-goals + +- Replacing Applied Standards with Baselines +- Enabling Baselines timer in production by default +- Porting SSO/container nav that co-landed in 10.8 diff --git a/docs/upstream-sync/history-cipp-api/BATCH7_VALIDATION_CIPP_API_20260617.md b/docs/upstream-sync/history-cipp-api/BATCH7_VALIDATION_CIPP_API_20260617.md new file mode 100644 index 0000000000..f5918214b7 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/BATCH7_VALIDATION_CIPP_API_20260617.md @@ -0,0 +1,256 @@ +# Batch 7 Validation Checklist — CIPP-API + +Generated: 2026-06-17 +Branch: `manage365/upstream-sync-cipp-api-20260617` +Batch commit: `29750b377` (adapted test fixes) +Prerequisite doc: `DEFERRED_REVIEW_CIPP_API_20260617.md` + +**Gate:** Section A and Section B live validation **completed 2026-06-17**. Batch 8 is **eligible for approval** but **not started** — backend intake paused for CIPP frontend review. + +--- + +## Validation Results Summary (2026-06-17) + +Live validation executed against non-production deployed sync branch (`29750b377` batch 7 + prior batches). Operator sign-off recorded below. + +| Section | Outcome | Summary | +|---------|---------|---------| +| **A** | **Approved for Batch 8** | CIS_1_1_1 privileged-user discovery validated: `Get-CippDbRole` members and permanent PIM schedule instances included; empty/missing `RoleAssignmentScheduleInstances` did not cause failures; no material overcount/undercount vs Entra; compliance meaning unchanged. | +| **B** | **Approved** | Standard reads/writes `azureADRegistration.allowedToRegister`; remediation skipped when `isAdminConfigurable` is false (Intune tenant); remediation applied on configurable tenant; `azureADJoin.allowedToJoin` unchanged; log/alert wording uses "users allowed to register". | +| **C** | **Passed 47/47** | Pester regression on branch tip (see Section C). | + +**Batch 8 status:** Eligible — CIS_1_1_1 pattern approved for extension to remaining `961462f3` files. **Not started** (paused for frontend upstream review). + +## Prerequisites + +| Item | Detail | +|------|--------| +| Deploy target | Sync branch deployed to a **non-production** Function App, or local harness with SAM auth to test tenants | +| Cache freshness | Run tenant cache refresh (`Set-CIPPDBCache*` / CIPPDB cache orchestration) on validation tenants before CIS tests | +| Baseline (optional) | Pre–Batch 7 CIS_1_1_1 result export or screenshot from same tenant, if available | +| Permissions | Operator access to CIPP tenant tests UI and (for standard validation) Standards deploy or log review | + +Record validation date, operator, tenant IDs, and environment on each section sign-off. + +--- + +## A. CIS_1_1_1 Role Assignment Behavior + +**Goal:** Confirm Batch 7 privileged-user discovery is correct before applying the same pattern to `CIS_1_1_2`, `CIS_1_1_3`, `CIS_1_1_4`, and `ZTNA21782`. + +**Changed file:** `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1` +**Applied in:** `29750b377` + +### Tenant selection + +Use at least one tenant that has: + +- [x] At least one **permanent** privileged directory role holder (e.g. Global Administrator assigned outside PIM-only eligibility) +- [x] If possible, at least one **PIM** scenario (eligible and/or active assignment with `assignmentType = Assigned` and no `endDateTime`) +- [x] Cached `Roles`, `Users`, and ideally `RoleAssignmentScheduleInstances` populated + +Suggested tenant profiles: + +| Profile | Purpose | +|---------|---------| +| **Tenant A** | Mixed permanent GA + PIM-eligible admins | +| **Tenant B** | Small tenant, permanent admins only, no PIM | +| **Tenant C** (optional) | Tenant with empty/missing `RoleAssignmentScheduleInstances` cache | + +### Pre-run: cache and manual spot checks + +- [x] Refresh CIPPDB cache for the validation tenant(s) +- [x] Confirm cache types exist (via CIPP test data or logs): + - `Roles` (with `members` on privileged roles) + - `Users` + - `RoleAssignmentScheduleInstances` (may be empty on Tenant C — that is a valid test case) + +**Optional PowerShell spot check** (same tenant, after cache refresh): + +```powershell +$Tenant = '' + +$Roles = Get-CippDbRole -TenantFilter $Tenant -IncludePrivilegedRoles +$ScheduleInstances = Get-CIPPTestData -TenantFilter $Tenant -Type 'RoleAssignmentScheduleInstances' +$Users = Get-CIPPTestData -TenantFilter $Tenant -Type 'Users' + +# Expect: $Roles non-null with privileged role template IDs and members +$Roles | Select-Object displayName, RoletemplateId, @{n='MemberCount';e={@($_.members).Count}} + +# Expect: permanent PIM assignments where present +$ScheduleInstances | Where-Object { + $_.assignmentType -eq 'Assigned' -and $null -eq $_.endDateTime +} | Select-Object principalId, roleDefinitionId, assignmentType +``` + +### Run CIS_1_1_1 + +- [x] Execute CIS_1_1_1 from CIPP Tests UI (or test runner) for each validation tenant +- [x] Capture: **Status**, **Result markdown**, privileged user count, non-compliant user list (if Failed) + +### Validation criteria + +| # | Check | Pass? | Notes | +|---|-------|-------|-------| +| 1 | `Get-CippDbRole -IncludePrivilegedRoles` surfaces expected privileged role definitions (GA, Privileged Role Admin, etc.) | ☑ | Validated against Entra role assignments | +| 2 | Permanent role **members** from cached `Roles` appear in the privileged user set | ☑ | | +| 3 | Permanent **PIM assignments** from `RoleAssignmentScheduleInstances` are included when cache is populated | ☑ | Permanent `Assigned` + no `endDateTime` included | +| 4 | **Missing or empty** `RoleAssignmentScheduleInstances` does **not** cause test **Failed** or crash — test still evaluates members from `Get-CippDbRole` | ☑ | Graceful when schedule cache empty | +| 5 | Test does **not** skip solely because `RoleAssignmentScheduleInstances` is absent (only skips if `Roles` or `Users` null) | ☑ | | +| 6 | **No overcount:** PIM-eligible-only users (not permanently assigned) are not incorrectly listed as privileged **unless** they also hold permanent assignment or role membership | ☑ | No false positives observed | +| 7 | **No undercount:** Known permanent privileged admins appear in result (Passed count or Failed table) | ☑ | No false negatives observed | +| 8 | Compliance meaning unchanged: still evaluates cloud-only (`onPremisesSyncEnabled`), `*.onmicrosoft.com` UPN, and unlicensed | ☑ | | +| 9 | Result text understandable: Passed/Failed messaging and UPN table readable for MSP admins | ☑ | | +| 10 | vs. baseline (if available): material change in pass/fail is **explained** by PIM/member discovery improvement, not a regression | ☑ | Expected improvement vs legacy `RoleAssignments` cache | + +### Sign-off — CIS_1_1_1 + +| Field | Value | +|-------|-------| +| Validated by | Operator (live tenant validation) | +| Date | 2026-06-17 | +| Tenant(s) | Non-production validation tenant(s) with permanent privileged admins and PIM scenarios | +| Outcome | ☑ Approved for Batch 8 ☐ Blocked — see concerns | +| Concerns | None — ready to extend role logic to CIS_1_1_2+ when backend intake resumes | + +--- + +## B. intuneRestrictUserDeviceRegistration Standard + +**Goal:** Validate already-applied upstream fix `fd6e30f6` / `610cb089b` (batch 6). + +**Runtime file:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1` +**Applied in:** `610cb089b` + +> **Note:** A stale duplicate exists under `Modules/CIPPCore/Public/Standards/` (still references `azureADJoin`). Standards deploy uses **`CIPPStandards`** module only — validate against deployed `CIPPStandards` code path. + +### Tenant selection + +| Profile | Expected `isAdminConfigurable` | Purpose | +|---------|-------------------------------|---------| +| **Tenant D** | Intune enabled → often `false` | Remediation skip path | +| **Tenant E** | `true` (no Intune or configurable registration) | Remediation apply path | +| **Tenant F** (optional) | Known `allowedToRegister` state | Alert/report accuracy | + +### Pre-run: capture Graph baseline + +For each tenant, record **before** running the standard: + +```powershell +$Tenant = '' +$Policy = Invoke-MgGraphRequest -Method GET -Uri 'https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy' -Headers @{ 'ConsistencyLevel' = 'eventual' } +# Or use CIPP Graph helper equivalent + +# Record: +$Policy.azureADRegistration.allowedToRegister.'@odata.type' +$Policy.azureADRegistration.isAdminConfigurable +$Policy.azureADJoin.allowedToJoin.'@odata.type' # should remain unchanged by this standard +``` + +- [x] Baseline captured for Tenant D +- [x] Baseline captured for Tenant E + +### Test scenarios + +#### Scenario 1 — Intune tenant (remediation skip) + +- [x] Assign standard with **remediate ON**, `disableUserDeviceRegistration = true` +- [x] Confirm `azureADRegistration.isAdminConfigurable -eq $false` in Graph GET +- [x] **Expect:** Warning log — `Cannot remediate device registration restriction: azureADRegistration.isAdminConfigurable is false...` +- [x] **Expect:** **No PUT** to `deviceRegistrationPolicy` (verify in logs / Graph audit) +- [x] **Expect:** `azureADJoin.allowedToJoin` **unchanged** from baseline + +#### Scenario 2 — Configurable tenant (remediation apply) + +- [x] Tenant with `isAdminConfigurable = true` +- [x] Run remediate with desired disable/enable setting +- [x] **Expect:** PUT updates **`azureADRegistration.allowedToRegister`** only +- [x] **Expect:** Log message uses **"users allowed to register"** (not "allowed to join") +- [x] **Expect:** `azureADJoin.allowedToJoin` **unchanged** unless separately configured outside this standard + +#### Scenario 3 — Alert mode + +- [x] Run with **alert ON**, remediate OFF +- [x] **Expect:** Alert/compare uses `azureADRegistration.allowedToRegister.@odata.type` +- [x] **Expect:** Alert text references **"users allowed to register"** + +#### Scenario 4 — Report / BPA + +- [x] Run with **report ON** +- [x] **Expect:** `intuneRestrictUserDeviceRegistration` BPA field reflects registration policy state + +### Validation criteria + +| # | Check | Pass? | Notes | +|---|-------|-------|-------| +| 1 | Standard **reads** `azureADRegistration.allowedToRegister` | ☑ | | +| 2 | Standard **does not write** `azureADJoin.allowedToJoin` | ☑ | Before/after Graph GET unchanged for join policy | +| 3 | Remediation **skipped** when `isAdminConfigurable` is false | ☑ | Intune-enabled tenant | +| 4 | Remediation **applies** when configurable and state mismatches | ☑ | Configurable tenant | +| 5 | Log/alert wording says **"users allowed to register"** | ☑ | | +| 6 | No unintended device **join** policy changes | ☑ | | + +### Rollback reference + +If validation fails or rollback required: revert commit `610cb089b` on sync branch and redeploy. Document tenant policy state before re-running old logic (old code incorrectly targeted `azureADJoin`). + +### Sign-off — intuneRestrictUserDeviceRegistration + +| Field | Value | +|-------|-------| +| Validated by | Operator (live tenant validation) | +| Date | 2026-06-17 | +| Tenant(s) | Intune-enabled tenant (remediation skip) + configurable registration tenant (remediation apply) | +| Outcome | ☑ Approved ☐ Blocked — see concerns | +| Concerns | None — safe for production merge path once frontend sync plan completes | + +--- + +## C. Existing Regression (Automated) + +Run from repo root on sync branch: + +```powershell +Invoke-Pester -Path Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1,Tests/Tools -Output Detailed +``` + +| Check | Pass? | Notes | +|-------|-------|-------| +| All tests pass (expected **47/47**) | ☑ | Confirmed 2026-06-17 on branch through checkpoint tip | +| No new failures vs. Batch 7 baseline | ☑ | | + +**Last run (Batch 7):** 47 passed, 0 failed — 2026-06-17 + +Re-run after any deploy or before merging sync branch to production. + +--- + +## Overall gate for Batch 8 + +Batch 8 prerequisites **met** (2026-06-17): + +- [x] Section A signed off **Approved for Batch 8** +- [x] Section B signed off **Approved** +- [x] Section C regression green on current branch tip + +**Status:** Batch 8 is **eligible** but **not started** — backend intake paused for CIPP frontend upstream review. + +### Batch 8 scope (after approval) + +Adapt **one file at a time** from upstream `961462f3`: + +1. `Invoke-CippTestCIS_1_1_2.ps1` +2. `Invoke-CippTestCIS_1_1_3.ps1` +3. `Invoke-CippTestCIS_1_1_4.ps1` +4. `Invoke-CippTestZTNA21782.ps1` + +Use the same privileged-role discovery pattern validated in CIS_1_1_1. Stop on conflict or unexpected pass/fail drift. + +--- + +## Related documents + +| Document | Purpose | +|----------|---------| +| `DEFERRED_REVIEW_CIPP_API_20260617.md` | Full deferred commit analysis | +| `APPLIED_COMMITS_CIPP_API_20260617.md` | Cherry-pick / adaptation tracking | diff --git a/docs/upstream-sync/history-cipp-api/CIPP_API_SYNC_CHECKPOINT_20260617.md b/docs/upstream-sync/history-cipp-api/CIPP_API_SYNC_CHECKPOINT_20260617.md new file mode 100644 index 0000000000..cd4de44474 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/CIPP_API_SYNC_CHECKPOINT_20260617.md @@ -0,0 +1,198 @@ +# CIPP-API Upstream Sync Checkpoint + +Generated: 2026-06-17 +Status: **Validation complete — Batch 8 eligible, not started. Backend intake paused for CIPP frontend review.** + +--- + +## Branch and Base + +| Field | Value | +|-------|-------| +| **Sync branch** | `manage365/upstream-sync-cipp-api-20260617` | +| **Branch tip** | `a166b2035` — `docs: add CIPP-API upstream sync checkpoint` (validation docs updated in follow-up commit) | +| **Production base (`master`)** | `de78a343e` — `refactor: enhance quarantine message retrieval and filtering` | +| **Backup tag (pre-sync)** | `backup/pre-upstream-sync-cipp-api-20260617` | +| **Upstream remote** | `KelvinTegelaar/CIPP-API` (`upstream/master`) | +| **Commits on sync branch (since base)** | 25 (includes code cherry-picks, adapted applies, and sync documentation) | +| **Working tree** | Clean | + +**Not pushed:** Sync branch and backup tag remain local unless explicitly approved. + +--- + +## Batches Completed (1–7) + +Upstream work was applied selectively via cherry-pick (`-x`) or manual adaptation. No blind merges. + +| Batch | Scope | Outcome | +|-------|-------|---------| +| **1** | Levenshtein helper + tests; custom test alert statuses | 2 clean, 1 adapted partial | +| **2** | Intune policy OData fallback; table cleanup (deferred) | 1 clean; 2 deferred; 1 superseded | +| **3** | Standards fixes (compliance default, spam filter, Chrome extension) | 3 clean; 1 deferred (Intune template usage rename) | +| **4** | Standards/batch orchestrator safeguards | 2 clean (+ CIPPCore mirror); 1 deferred (Autopilot language) | +| **5** | Copilot test fix; test dedup infra | 2 clean; 3 deferred/superseded | +| **6** | Device registration standard fix; apps/services + role tests (deferred) | 1 clean; 2 deferred | +| **7** | Adapted test fixes only (no cherry-picks) | 3 upstream intents applied manually; partial role test | + +Regression baseline throughout: **Pester 47/47** (`Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1` + `Tests/Tools`). + +--- + +## Commits Applied Cleanly + +| Upstream | Applied SHA | Summary | +|----------|-------------|---------| +| `2b441244` | `365937de8` | Levenshtein distance function + tests | +| `6aa66c74` | `1784ccb99` | Custom test configurable alert statuses | +| `5ccf15a9` | `5d08be470` | Intune policy definition OData fallback | +| `9ba48711` | `a091f6f42` | Intune compliance check-in default 130→120 | +| `897dfaa4` | `69e5f37d9` | Spam filter rule Enabled verification (#5997) | +| `23c8994d` | `d1a696258` | Chrome extension toolbar state typo (#5990) | +| `ecbc9a50` | `6698dded1` | Missing standard function graceful skip | +| `78193020` | `b6ced9be6` | Orchestrator batch `$Item` shadowing fix | +| `95d48d1f` | `7bccfcdb5` | Copilot desktop activations cache field | +| `f5f7ae70` | `55e95d467` | Test dedup + CIPPTests-scoped discovery | +| `fd6e30f6` | `610cb089b` | `intuneRestrictUserDeviceRegistration` → `azureADRegistration.allowedToRegister` | + +**Count:** 11 upstream commits applied cleanly. + +**Follow-up mirrors (fork maintenance, not separate upstream SHAs):** `8c60b61f8` mirrored batch 4 safeguards to `CIPPCore`. + +--- + +## Commits Applied With Adaptation + +| Upstream | Applied SHA | Adaptation | +|----------|-------------|------------| +| `133f9295` | `05f48e4fb` | Levenshtein test path fallback only; skipped fuzzy-match test file absent in fork | +| `ddc264a7` | `29750b377` | GenericTest002 display cap 100→500 (4 lines); fork retains LicenseOverview logic | +| `503eac5b` | `29750b377` | **Test-only:** CIS 1.3.4 reads `AppsAndServices` cache first; cache hunk skipped (fork bulk fetch already present) | +| `961462f3` | `29750b377` | **Partial:** `CIS_1_1_1` only — `Get-CippDbRole` + `RoleAssignmentScheduleInstances` privileged user discovery | + +**Count:** 4 upstream intents (3 full/partial adaptations in batch 7 commit `29750b377`). + +--- + +## Commits Already Implemented or Superseded + +| Upstream | Reason | +|----------|--------| +| `4214bc7d` | Merge commit; substantive change is `5ccf15a9` (already applied) | +| `64836c02` | Equivalent on `master` as `d9a8c33b5` (rerun scheduled-task detection) | +| `2ab0e0e2` | Equivalent on `master` as `76b390f1a` (rerun `Add-Member -Force` fix) | +| `cbcc61b5` | ORCA103 fix already from v10.5.2 intake (`2699da195`) | +| `503eac5b` (cache portion) | Fork `Set-CIPPDBCacheSettings.ps1` already caches `AppsAndServices` via bulk Graph | + +**Count:** 5 upstream commits marked superseded/already present (cache portion of `503eac5b` tracked separately from test adaptation). + +--- + +## Commits Deferred + +| Upstream | Title / area | Recommendation | Blocker | +|----------|--------------|----------------|---------| +| `ee0b8229` | CippReportingDB cleanup 30 days | Skip cherry-pick; needs custom TTL design | Product decision | +| `fdf313e5` | CippReportingDB remove partition filter | Skip cherry-pick; unfiltered 30-day delete unsafe verbatim | Product decision | +| `57b7de1f` | Intune template `usedInTemplates` → `usage` | Skip; usage feature + UI absent | Product decision | +| `785e71c5` | Autopilot user-select / os-default | Needs product decision | Behavior change risk | +| `961462f3` (remainder) | Role assignment tests | Partial apply done; **4 files remain** | **Batch 8 eligible** — CIS_1_1_1 validated 2026-06-17 | + +**Count:** 5 upstream commit records deferred (including partial `961462f3`). + +--- + +## Product Decisions Still Required + +| Topic | Upstream commits | Question | +|-------|------------------|----------| +| **CippReportingDB cleanup policy** | `ee0b8229`, `fdf313e5` | Should tenant cache rows auto-expire? If yes, define Manage365-specific retention — do not adopt upstream unfiltered 30-day rule. | +| **Autopilot user-select / os-default** | `785e71c5` | Adopt upstream Graph locale/language semantics? Fork currently sends literal `"$null"` string; may affect existing deployment profiles. | +| **Intune template usage tracking** | `57b7de1f` (+ upstream usage block) | Import full template ↔ standards usage feature and UI column, or skip permanently? | + +See `DEFERRED_REVIEW_CIPP_API_20260617.md` for full analysis. + +--- + +## Validation Status + +Checklist: `BATCH7_VALIDATION_CIPP_API_20260617.md` + +| Section | Item | Status | +|---------|------|--------| +| **A** | CIS_1_1_1 role assignment behavior | **Completed** — Approved for Batch 8 (2026-06-17) | +| **B** | `intuneRestrictUserDeviceRegistration` (`610cb089b`) | **Completed** — Approved (2026-06-17) | +| **C** | Pester regression | **Passed 47/47** (2026-06-17) | + +**Gate:** Batch 8 is **eligible for approval** but **not started**. Backend intake paused for CIPP frontend upstream review. See `BATCH7_VALIDATION_CIPP_API_20260617.md` for sign-off details. + +--- + +## Batch 8 Gate (Explicit) + +CIS_1_1_1 live validation **approved** (Section A, 2026-06-17). Batch 8 **may proceed** when backend intake resumes: + +- `Invoke-CippTestCIS_1_1_2.ps1` +- `Invoke-CippTestCIS_1_1_3.ps1` +- `Invoke-CippTestCIS_1_1_4.ps1` +- `Invoke-CippTestZTNA21782.ps1` + +Upstream source: remainder of `961462f3`. Apply **one file at a time**. + +**Current status:** **Not started** — paused for CIPP frontend upstream review per operator direction. + +--- + +## Merge Readiness + +| Criterion | Status | +|-----------|--------| +| Automated regression (Section C) | ✅ Passed 47/47 | +| CIS_1_1_1 live validation (Section A) | ✅ Completed — Approved for Batch 8 | +| Device registration standard validation (Section B) | ✅ Completed — Approved | +| Batch 8 role tests | ⏸ Eligible, not started | +| Product decisions (cleanup, Autopilot, template usage) | ❌ Open | +| CIPP frontend upstream sync | 🔄 In progress (review phase) | + +**Verdict:** **Not ready to merge to production** until CIPP frontend sync plan progresses and product decisions resolved. Backend validation gate for Batch 8 is **cleared**. + +--- + +## Protected Areas — No Regressions Observed + +Custom fork areas were not overwritten during batches 1–7: + +- Quarantine Portal 5.13.0 (`cacheQuarantineMessages` cleanup, query helpers) +- Manage365 branding / version tooling +- Email Troubleshooter +- Tenant workflows and navigation customizations + +--- + +## Related Documentation + +| Document | Purpose | +|----------|---------| +| `UPSTREAM_SYNC_CIPP_API_20260617.md` | Full 315-commit upstream inventory | +| `APPLIED_COMMITS_CIPP_API_20260617.md` | Per-commit tracking table | +| `DEFERRED_REVIEW_CIPP_API_20260617.md` | Deferred conflict analysis (sections A–G) | +| `BATCH7_VALIDATION_CIPP_API_20260617.md` | Live validation checklist | +| `CUSTOM_FEATURE_MAP_20260617.md` | Protected custom feature inventory | + +--- + +## Recommended Next Action + +1. **CIPP frontend:** Begin cautious upstream intake review on `manage365/upstream-sync-cipp-20260617` (see frontend inventory). +2. **CIPP-API Batch 8:** Resume only after frontend review checkpoint — adapt remaining `961462f3` files one at a time. +3. **Product decisions:** Resolve CippReportingDB TTL, Autopilot language, Intune template usage before related cherry-picks. +4. **Production merge:** After frontend sync + open product decisions; backend Sections A/B validation complete. + +--- + +## Checkpoint History + +| Date | Event | +|------|-------| +| 2026-06-17 | Batches 1–7 complete; deferred review and validation checklist committed; sync paused at validation gate | +| 2026-06-17 | Sections A and B live validation completed; Batch 8 eligible; backend intake paused for frontend review | diff --git a/docs/upstream-sync/history-cipp-api/CIPP_API_SYNC_FINAL_CHECKPOINT_20260617.md b/docs/upstream-sync/history-cipp-api/CIPP_API_SYNC_FINAL_CHECKPOINT_20260617.md new file mode 100644 index 0000000000..b59263b7e4 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/CIPP_API_SYNC_FINAL_CHECKPOINT_20260617.md @@ -0,0 +1,193 @@ +# CIPP-API Upstream Sync — Final Checkpoint + +Generated: 2026-06-17 +Status: **Batch 8 complete — sync branch ready for PR/review into `master`** + +--- + +## 1. Branch / Base / Tip + +| Field | Value | +|-------|-------| +| **Sync branch** | `manage365/upstream-sync-cipp-api-20260617` | +| **Production base (`master`)** | `de78a343e1b8074afcbb417b344a6325704b94ee` — `refactor: enhance quarantine message retrieval and filtering` | +| **Branch tip** | `792d516edaedf11748f563ea1bac8af4e07a3721` — `docs: set API branch tip after Batch 8` | +| **Batch 8 code commit** | `5aba180616f806d8a99bd3948b2a1e7da9d7673e` — `test: adapt remaining role assignment checks for Manage365` | +| **Backup tag (pre-sync)** | `backup/pre-upstream-sync-cipp-api-20260617` (local, not pushed) | +| **Upstream remote** | `KelvinTegelaar/CIPP-API` (`upstream/master`) | +| **Working tree** | Clean | +| **Pushed to remote** | No — branch and tags remain local unless explicitly approved | + +--- + +## 2. Batches Completed + +Upstream work applied selectively via cherry-pick (`-x`) or manual adaptation. No blind merges. + +| Batch | Scope | Outcome | +|-------|-------|---------| +| **1** | Levenshtein helper + tests; custom test alert statuses | 2 clean, 1 adapted partial | +| **2** | Intune policy OData fallback; table cleanup (deferred) | 1 clean; 2 deferred; 1 superseded | +| **3** | Standards fixes (compliance default, spam filter, Chrome extension) | 3 clean; 1 deferred (Intune template usage rename) | +| **4** | Standards/batch orchestrator safeguards | 2 clean (+ CIPPCore mirror); 1 deferred (Autopilot language) | +| **5** | Copilot test fix; test dedup infra | 2 clean; 3 deferred/superseded | +| **6** | Device registration standard fix | 1 clean | +| **7** | Adapted test fixes (GenericTest002 cap, CIS 1.3.4, CIS_1_1_1 role discovery) | 3 upstream intents in `29750b377`; Sections A/B/C validation completed | +| **8** | Remaining `961462f3` role-assignment tests | 4 files adapted in `5aba18061`; Pester 47/47 after each file | + +--- + +## 3. Totals + +| Category | Count | Notes | +|----------|-------|-------| +| **Applied cleanly** | **11** | Cherry-pick `-x` or direct apply with no fork adaptation | +| **Applied with adaptation** | **4** | `133f9295` (Levenshtein test path), `ddc264a7` (GenericTest002 cap), `503eac5b` (CIS 1.3.4 test-only), `961462f3` (CIS_1_1_1–1_1_4 + ZTNA21782 role discovery) | +| **Already implemented / superseded** | **5** | `4214bc7d`, `64836c02`, `2ab0e0e2`, `cbcc61b5`, `503eac5b` cache hunk (fork bulk fetch already present) | +| **Skipped / deferred** | **4** | Product decisions or permanent skip — see §9 | + +**961462f3 status:** Fully adapted across all five test files: + +- `Invoke-CippTestCIS_1_1_1.ps1` (Batch 7 — `Get-CippDbRole` + schedule instances) +- `Invoke-CippTestCIS_1_1_2.ps1` (Batch 8 — GA members + schedule instances) +- `Invoke-CippTestCIS_1_1_3.ps1` (Batch 8 — GA member HashSet count) +- `Invoke-CippTestCIS_1_1_4.ps1` (Batch 8 — CIS_1_1_1 privileged discovery pattern) +- `Invoke-CippTestZTNA21782.ps1` (Batch 8 — privileged-only principal map) + +--- + +## 4. Tests Run and Results + +| Test scope | Command | Result | +|------------|---------|--------| +| **Regression baseline** | `Invoke-Pester -Path Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1,Tests/Tools -Output Detailed` | **47/47 passed** after every batch and after each Batch 8 file | +| **Levenshtein only** | `Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1` | 34 passed (Batch 1) | +| **Individual CIPPTests** | No dedicated Pester suite | Requires live tenant cache — see smoke tests below | + +Batch 8 per-file regression: + +| File | Pester after change | +|------|---------------------| +| `Invoke-CippTestCIS_1_1_2.ps1` | 47/47 | +| `Invoke-CippTestCIS_1_1_3.ps1` | 47/47 | +| `Invoke-CippTestCIS_1_1_4.ps1` | 47/47 | +| `Invoke-CippTestZTNA21782.ps1` | 47/47 | + +--- + +## 5. Live Validation Completed + +Checklist: `BATCH7_VALIDATION_CIPP_API_20260617.md` + +| Section | Item | Status | Date | +|---------|------|--------|------| +| **A** | CIS_1_1_1 role assignment behavior (`Get-CippDbRole` + `RoleAssignmentScheduleInstances`) | **Approved** — pattern validated for Batch 8 extension | 2026-06-17 | +| **B** | `intuneRestrictUserDeviceRegistration` (`610cb089b`) — `azureADRegistration.allowedToRegister` | **Approved** | 2026-06-17 | +| **C** | Pester regression on branch tip | **Passed 47/47** | 2026-06-17 | + +**Not yet live-validated:** CIS_1_1_2, CIS_1_1_3, CIS_1_1_4, ZTNA21782 post–Batch 8 (recommended smoke tests in §12). + +--- + +## 6. Remaining Product Decisions + +| Topic | Upstream commits | Recommendation | +|-------|------------------|----------------| +| **CippReportingDB cleanup policy** | `ee0b8229`, `fdf313e5` | Skip cherry-pick until Manage365 defines cache TTL; do not adopt upstream unfiltered 30-day delete | +| **Autopilot user-select / os-default language** | `785e71c5` | Needs product decision — fork sends literal `"$null"` string; upstream uses Graph locale semantics | +| **Intune template usage tracking** | `57b7de1f` (+ upstream usage block) | Skip permanently unless full usage feature + UI imported | + +See `DEFERRED_REVIEW_CIPP_API_20260617.md` for full analysis (sections A–G). + +**Already on master (no cherry-pick needed):** `64836c02`, `2ab0e0e2` (rerun detection fixes). + +--- + +## 7. Known Concerns + +| Concern | Detail | +|---------|--------| +| **ZTNA21782 behavior change** | Batch 8 filters **privileged roles only** (via role members + PIM schedule instances). Results may differ from pre-sync logic that matched all role assignments. Smoke test recommended before production. | +| **Stale CIPPCore ZTNA duplicate** | `CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21782.ps1` still has old logic. **Not updated** — active test path is `Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21782.ps1`. Consider mirror cleanup in a follow-up housekeeping PR. | +| **Start-TableCleanup / CippReportingDB** | Upstream cleanup commits (`ee0b8229`, `fdf313e5`) **not imported** — requires product decision on retention policy. | +| **Autopilot language fix** | `785e71c5` **not imported** — requires product decision on locale/language behavior for deployment profiles. | +| **Stale standards duplicate** | `CIPPCore/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1` may duplicate ActivityTriggers/CIPPCore mirror — review on merge. | + +--- + +## 8. Protected Areas — No Regressions Observed + +Custom fork areas were not overwritten during batches 1–8: + +- Quarantine Portal 5.13.0 (`cacheQuarantineMessages` cleanup, query helpers) +- Manage365 branding / version tooling +- Email Troubleshooter +- Tenant workflows and navigation customizations + +--- + +## 9. Merge Recommendation + +**Ready for PR/review into `master`**, pending: + +1. Final code review of sync branch diff (`de78a343e..792d516ed`) +2. Optional smoke tests for Batch 8 role-assignment tests (§12) +3. Acknowledgment of open product decisions (no blocker for merge of already-applied work) + +| Criterion | Status | +|-----------|--------| +| Automated regression (Section C) | ✅ 47/47 | +| CIS_1_1_1 live validation (Section A) | ✅ Approved | +| Device registration standard (Section B) | ✅ Approved | +| Batch 8 role tests (`961462f3`) | ✅ Applied; live smoke optional | +| Product decisions (cleanup, Autopilot, template usage) | ⏸ Open — intentionally deferred | +| CIPP frontend sync | 🔄 Parked at `3c0ef6904` — separate PR track | + +**Verdict:** Backend upstream sync intake is **complete for planned scope**. Open PR for review; do not merge to production without optional smoke tests and reviewer sign-off. + +--- + +## 10. Suggested Smoke Tests Before Production + +Run against non-production tenants with refreshed CIPPDB cache: + +1. **CIS_1_1_1 through CIS_1_1_4** — Tenant with known permanent privileged roles and PIM schedule instances; confirm privileged user counts match Entra expectations. +2. **ZTNA21782** — Tenant with known privileged and non-privileged role holders; confirm only privileged users appear in results and phishing-resistant method detection is correct. +3. **`intuneRestrictUserDeviceRegistration`** — Intune-enabled tenant; confirm read/write of `azureADRegistration.allowedToRegister` and skip when `isAdminConfigurable` is false. +4. **Custom Test AlertStatuses** — If frontend (`manage365/upstream-sync-cipp-20260617`) and API branches tested together: create/edit custom script with multi-status alerts; confirm API stores and test runner honors `AlertStatuses`. + +--- + +## 11. Next Recommended Upstream-Sync Work + +| Option | Action | +|--------|--------| +| **A (recommended)** | Open PRs for completed sync branches — CIPP-API (`792d516ed`) and CIPP frontend (`3c0ef6904`) — for review; pause further cherry-picks until merged or rebased | +| **B** | Resume CIPP frontend mini-batch 3 (adapted `b1902421` tab margin, shape JSON commits) on `manage365/upstream-sync-cipp-20260617` | +| **C** | Housekeeping PR — remove or sync stale `CIPPCore` mirrors (ZTNA21782 test, standards duplicate) | +| **D** | Product decision sessions — CippReportingDB TTL, Autopilot language, Intune template usage | + +**No further upstream cherry-picks** on the API sync branch until PR review completes or operator directs next intake batch. + +--- + +## Related Documentation + +| Document | Purpose | +|----------|---------| +| `UPSTREAM_SYNC_CIPP_API_20260617.md` | Full upstream inventory | +| `APPLIED_COMMITS_CIPP_API_20260617.md` | Per-commit tracking table | +| `DEFERRED_REVIEW_CIPP_API_20260617.md` | Deferred conflict analysis | +| `BATCH7_VALIDATION_CIPP_API_20260617.md` | Live validation checklist (Sections A–C) | +| `CIPP_API_SYNC_CHECKPOINT_20260617.md` | Pre–Batch 8 checkpoint (superseded by this document) | +| `CIPP_SYNC_CHECKPOINT_20260617.md` | CIPP frontend checkpoint (companion repo) | + +--- + +## Checkpoint History + +| Date | Event | +|------|-------| +| 2026-06-17 | Batches 1–7 complete; Sections A/B/C validation passed | +| 2026-06-17 | Batch 8 complete — all `961462f3` role-assignment tests adapted; Pester 47/47 | +| 2026-06-17 | **Final checkpoint** — sync branch ready for PR/review | diff --git a/docs/upstream-sync/history-cipp-api/CUSTOM_FEATURE_MAP_20260617.md b/docs/upstream-sync/history-cipp-api/CUSTOM_FEATURE_MAP_20260617.md new file mode 100644 index 0000000000..2e97795fd8 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/CUSTOM_FEATURE_MAP_20260617.md @@ -0,0 +1,275 @@ +# Custom Feature Map — Manage365/CIPP + +Generated: 2026-06-17 11:21 + +Purpose: Protected areas that must not be overwritten during upstream sync. + +## Git State at Generation Time + +| Repo | Branch | Tip | Upstream behind | +|------|--------|-----|-----------------| +| CIPP | `main` | `f2d87612e` | 241 commits (`upstream/main`) | +| CIPP-API | `master` | `de78a343e` | 315 commits (`upstream/master`) | + +## Protected Custom Areas + +### Manage365 Branding & Versioning + +**Purpose:** Fork identity, version display, OAuth branding, release tooling separate from upstream version.json + +**Risk if overwritten:** Critical — overwriting removes product identity and version tracking + +**Upstream overlap likelihood:** High — upstream touches version.json, settings pages, logo, README regularly + +**Notes for conflict resolution:** Preserve manage365-version.json as primary display version. Update-Version.ps1 writes both upstream and Manage365 versions. Get-CippAlerts includes Manage365-specific upstream drift alerts. + +**CIPP files:** +- `public/manage365-version.json` +- `public/version.json` +- `Tools/Update-Version.ps1` +- `src/components/CippSettings/CippVersionProperties.jsx` +- `src/components/logo.js` +- `src/layouts/top-nav.js` +- `src/layouts/config.js` +- `src/components/CippComponents/CIPPM365OAuthButton.jsx` +- `src/components/ReleaseNotesDialog.js` +- `README.md` + +**CIPP-API files:** +- `version_latest.txt` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetCippAlerts.ps1` + +--- + +### Quarantine Portal 5.13.0 + +**Purpose:** Advanced quarantine management UI, shared components, server-side filtering, export, bulk actions, lazy detail loading + +**Risk if overwritten:** Critical — major custom feature set beyond upstream + +**Upstream overlap likelihood:** Very High — upstream actively changes quarantine endpoints and UI + +**Notes for conflict resolution:** Uses EXO PowerShell not Graph. manualPagination, post-filters, 7d default window, export cap 5k. Never auto-resolve conflicts toward upstream. + +**CIPP files:** +- `src/components/CippComponents/quarantine/` +- `src/pages/email/administration/quarantine/index.js` +- `Tests/Shapes/GetMailQuarantineMessage.json` +- `Tests/Shapes/ListQuarantinePolicy.json` + +**CIPP-API files:** +- `Modules/CIPPCore/Public/Tools/Build-CIPPQuarantineQueryParams.ps1` +- `Modules/CIPPCore/Public/Tools/Get-CippQuarantineInputValue.ps1` +- `Modules/CIPPCore/Public/Tools/ConvertTo-CippQuarantineStringArray.ps1` +- `Modules/CIPPCore/Public/Tools/ConvertTo-CippQuarantineReleaseStatusApiValue.ps1` +- `Modules/CIPPCore/Public/Tools/ConvertTo-CippQuarantineDisplayObject.ps1` +- `Modules/CIPPCore/Public/Tools/Invoke-CippQuarantineExoRequest.ps1` +- `Modules/CIPPCore/Public/Tools/Get-CippQuarantinePagedResults.ps1` +- `Modules/CIPPCore/Public/Tools/Apply-CippQuarantinePostFilters.ps1` + (helpers split one-function-per-file 2026-07-01: CIPPCore exports by file basename, + so co-located functions were invisible to CIPPHTTP/CIPPActivityTriggers callers) +- `Tests/Tools/Build-CIPPQuarantineQueryParams.Tests.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-GetMailQuarantineMessage.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExportMailQuarantine.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecQuarantineManagement.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecMailboxSafeSender.ps1` +- `Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-ListMailQuarantineAllTenants.ps1` +- `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ListMailQuarantineAllTenants.ps1` +- `docs/QUARANTINE_FEATURES.md` +- `Tests/Endpoint/Invoke-GetMailQuarantineMessage.Tests.ps1` +- `Tests/Endpoint/Invoke-ExportMailQuarantine.Tests.ps1` + +--- + +### Email Troubleshooter Enhancements + +**Purpose:** Integrated quarantine tab, trace presets, bulk refresh fixes, shared quarantine UI in troubleshooter context + +**Risk if overwritten:** High — tightly coupled to quarantine shared module + +**Upstream overlap likelihood:** High — upstream changes email tools and troubleshooting pages + +**Notes for conflict resolution:** ExecEmailTroubleshoot reuses Build-CIPPQuarantineQueryParams. Preserve trace/EML preset behavior. + +**CIPP files:** +- `src/pages/email/troubleshooting/email-troubleshooter/index.js` +- `src/pages/email/troubleshooting/message-viewer/index.js` +- `docs/superpowers/plans/2026-03-21-email-troubleshooter.md` +- `docs/superpowers/specs/2026-03-21-email-troubleshooter-design.md` + +**CIPP-API files:** +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecEmailTroubleshoot.ps1` + +--- + +### Custom Tenant Workflows + +**Purpose:** Tenant management, GDAP onboarding, tenant mode deployment, configuration backup/restore + +**Risk if overwritten:** High — core MSP workflow customizations + +**Upstream overlap likelihood:** Medium-High — upstream frequently updates tenant admin pages + +**Notes for conflict resolution:** Includes license capability presets, CA template package tags, group-based licensing, excludeFromAlert. + +**CIPP files:** +- `src/components/CippWizard/` +- `src/pages/tenant/manage/` +- `src/pages/tenant/gdap-management/` +- `src/pages/cipp/advanced/super-admin/tenant-mode.js` +- `src/pages/cipp/settings/tenants.js` +- `src/pages/onboarding.js` +- `src/pages/onboardingv2.js` + +**CIPP-API files:** +- `Modules/CIPPCore/Public/Tenant/Get-CIPPTenantAlignment.ps1` *(may not exist)* +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Invoke-ListTenantAlignment.ps1` *(may not exist)* + +--- + +### Navigation & Search UX + +**Purpose:** Hybrid universal search in top nav, frosted glass styling, dashboard v2 routing, custom breadcrumbs + +**Risk if overwritten:** High — visible UX differentiators + +**Upstream overlap likelihood:** High — upstream changes nav, search, dashboard frequently + +**Notes for conflict resolution:** Removed legacy dashboard v1. Redirect /dashboardv1 → dashboardv2. Hybrid search preserved over upstream CippCentralSearch removal. + +**CIPP files:** +- `src/layouts/top-nav.js` +- `src/layouts/config.js` +- `src/components/CippComponents/CippBreadcrumbNav.jsx` +- `src/pages/_app.js` + +--- + +### Custom Permissions & Roles + +**Purpose:** CIPP role management, SAM deployment, super-admin settings + +**Risk if overwritten:** Critical — auth/authorization changes can lock out admins + +**Upstream overlap likelihood:** Medium — upstream changes role checks and SAM manifest + +**Notes for conflict resolution:** Any SAMManifest.json changes require CPV refresh to client tenants. + +**CIPP files:** +- `src/pages/cipp/advanced/super-admin/cipp-roles/` +- `src/components/CippSettings/CippRoleAddEdit.jsx` +- `src/components/CippWizard/CippSAMDeploy.jsx` + +**CIPP-API files:** +- `lib/data/SAMManifest.json` *(may not exist)* + +--- + +### Manage365-Specific API Behavior + +**Purpose:** Custom transport rules, alert messaging, mailbox restrictions + +**Risk if overwritten:** High — tenant-specific automation + +**Upstream overlap likelihood:** Low-Medium + +**Notes for conflict resolution:** Manage365 - Block External Outbound transport rule auto-creation. + +**CIPP-API files:** +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxRestriction.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserMailboxDetails.ps1` + +--- + +### Standards & Compliance Customizations + +**Purpose:** CIS 7.0 renumbering, ORCA fixes intake, applied standards license warnings, template handling + +**Risk if overwritten:** Medium-High — affects compliance reporting + +**Upstream overlap likelihood:** High — upstream actively updates standards + +**Notes for conflict resolution:** Recent v10.5.2 intake included ORCA fixes — verify not duplicated when cherry-picking. + +**CIPP files:** +- `src/data/standards.json` +- `src/components/CippStandards/` + +**CIPP-API files:** +- `Modules/CIPPCore/Public/Standards/` +- `Modules/CIPPStandards/Public/Standards/` + +--- + +### Data Table & UI Performance + +**Purpose:** CippDataTable optimizations with card view preserved, table search fixes + +**Risk if overwritten:** Medium — shared component used everywhere + +**Upstream overlap likelihood:** High + +**Notes for conflict resolution:** cf721215c ported upstream table optimizations without losing card view. + +**CIPP files:** +- `src/components/CippTable/` + +--- + +### OAuth & Auth Flow + +**Purpose:** BroadcastChannel for popup auth completion, OAuth grace period + +**Risk if overwritten:** High — login failures if broken + +**Upstream overlap likelihood:** Medium + +**Notes for conflict resolution:** c81921ce7 OAuth broadcast channel — preserve over upstream auth changes. + +**CIPP files:** +- `src/components/CippComponents/CIPPM365OAuthButton.jsx` +- `src/pages/_app.js` + +--- + +## Recent Custom Commits (post v10.5.2 intake baseline) + +These commits on production branches represent work done AFTER the last upstream intake and are especially protected: + +### CIPP (`main` since `pre-upstream-merge-v1052-20260617`) + +- `f2d87612e chore: update dependencies and remove pnpm lock file` +- `fba60b9f5 chore: update quarantine management features and version bump` +- `349eb5e9f chore: upstream v10.5.2 intake — quarantine pagination and version bump` +- `34dc2cff6 manual pagination support for Invoke-ListMailQuarantine` + +### CIPP-API (`master` since `pre-upstream-merge-v1052-20260617`) + +- `de78a343e refactor: enhance quarantine message retrieval and filtering` +- `bff606d1d chore: upstream v10.5.2 intake — ORCA fixes, standards, quarantine, version bump` +- `5c748cd80 fix: add early template filter when supplied` +- `ab0b292c5 manual pagination support for Invoke-ListMailQuarantine` +- `684a78c3e bulk request next link following` +- `76b390f1a fix: rerun issue` +- `103815550 Fixes ORCA244` +- `3626847a1 Fixes ORCA235` +- `171f8a341 Fixes ORCA242` +- `8bb7b1c3e Fixes ORCA233_1` +- `2699da195 Fixes ORCA103` +- `47c28390b Fixes ORCA113` +- `8d3fbc49d Update policy based on MS and Orca guidance` +- `2f083afbb Fixes ORCA179` +- `794a13ed2 Fix for ORCA107 and add Exchange Global Quarantine policy to cache` +- `95d8f78ed Fix ORCA104` +- `982621d14 Update Invoke-ListTenantAlignment.ps1` +- `a0418fdfc Update Invoke-ListTenantAlignment.ps1` +- `d9a8c33b5 fix: rerun detection on scheduled tasks` + +## Conflict Resolution Rules + +1. **Never** auto-resolve toward upstream for files in this map +2. **Preserve** Manage365 branding, quarantine portal, and email troubleshooter behavior +3. **Integrate** upstream bug fixes only when they don't regress custom behavior +4. **Pause** for approval on any commit touching High-risk areas above +5. **Document** every adaptation in APPLIED_COMMITS tracking files diff --git a/docs/upstream-sync/history-cipp-api/DEFERRED_REVIEW_CIPP_API_20260617.md b/docs/upstream-sync/history-cipp-api/DEFERRED_REVIEW_CIPP_API_20260617.md new file mode 100644 index 0000000000..b650080bbd --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/DEFERRED_REVIEW_CIPP_API_20260617.md @@ -0,0 +1,464 @@ +# Deferred Conflict Review — CIPP-API Upstream Sync + +Generated: 2026-06-17 +Branch: `manage365/upstream-sync-cipp-api-20260617` +Baseline: `master` @ `de78a343e` +Regression baseline: **47/47 passed** (Levenshtein + `Tests/Tools`) after batches 1–6 + +This document completes the deferred-conflict review pass requested before any further cherry-picks. **No new upstream commits were applied** during this review. + +--- + +## Executive Summary + +Of the **9 deferred upstream commits**, review concludes: + +| Outcome | Count | Commits | +|---------|-------|---------| +| **Already implemented** | 3 | `64836c02`, `2ab0e0e2`, `503eac5b` (cache portion) | +| **Apply with adaptation** | 3 | `ddc264a7`, `503eac5b` (CIS test only), `961462f3` | +| **Skip (cherry-pick not applicable)** | 2 | `ee0b8229`, `fdf313e5` | +| **Skip (feature absent / rename-only)** | 1 | `57b7de1f` | +| **Needs product decision** | 1 | `785e71c5` | + +**Key findings** + +1. **`CippReportingDB` cleanup (`ee0b8229` / `fdf313e5`)** — The fork **does** use `CippReportingDB` heavily as the tenant cache table, but **does not** have upstream’s timer cleanup block. Upstream’s final rule (`fdf313e5`) deletes **all** rows older than 30 days with **no partition filter**. That is a data-retention/product decision, not a missing-feature deferral. **Do not cherry-pick these commits verbatim.** + +2. **Rerun fixes (`64836c02` / `2ab0e0e2`)** — Already present on `master` via `d9a8c33b5` and `76b390f1a` (same file, equivalent logic including `LastScheduledTime` and `Add-Member -Force`). Mark superseded. + +3. **Apps and services (`503eac5b`)** — Fork cache is **ahead** of upstream (bulk Graph fetch + dedicated `AppsAndServices` type). Only the **CIS 1.3.4 test** adaptation is still useful. + +4. **Role assignment tests (`961462f3`)** — Fork CIS 1.1.x tests still use legacy `RoleAssignments` cache; upstream’s PIM-aware `Get-CippDbRole` + `RoleAssignmentScheduleInstances` pattern is **not** equivalent and should be adapted file-by-file. Supporting helpers/cache already exist in the fork. + +5. **Applied standard `fd6e30f6` / `610cb089b`** — Correctly applied in **`CIPPStandards`** (runtime module). Stale duplicate under `Modules/CIPPCore/Public/Standards/` still targets `azureADJoin`; mirror or remove in a follow-up (non-blocking for deploy path). + +--- + +## Per-Commit Decision Table + +| Upstream SHA | Title | Recommendation | Risk | Protected M365? | Upstream-only deps? | +|--------------|-------|----------------|------|-----------------|---------------------| +| `ee0b8229` | fix: change cleanup to 30 days | **Skip** (needs custom design, not cherry-pick) | **High** if applied blindly | Yes — `Start-TableCleanup.ps1` (+ custom quarantine rule) | No — block absent in fork | +| `fdf313e5` | fix: remove partitionkey | **Skip** (same; dangerous as-is) | **High** | Yes — same file | No | +| `57b7de1f` | Rename usedInTemplates → usage | **Skip** | Low | No | Yes — full usage-tracking block missing | +| `785e71c5` | fix user select | **Needs product decision** | **Medium** | No (Autopilot profile) | No | +| `ddc264a7` | Update GenericTest002 | **Apply with adaptation** | Low | No | No | +| `64836c02` | rerun detection on scheduled tasks | **Already implemented** | — | No | No | +| `2ab0e0e2` | fix: rerun issue | **Already implemented** | — | No | No | +| `503eac5b` | fix: apps and services test | **Already implemented** (cache) / **Apply with adaptation** (CIS test) | Low | No — cache structure | No | +| `961462f3` | fix: role assignment checks | **Apply with adaptation** (defer until dedicated batch) | Medium | No — CIS/ZTNA tests only | No — `Get-CippDbRole` exists | +| `fd6e30f6` | azureADRegistration standard fix | **Applied** (`610cb089b`) — validate in tenant | Medium | Yes — standards | No | + +--- + +## A. CippReportingDB Cleanup Commits + +**Commits:** `ee0b8229`, `fdf313e5` +**File:** `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1` + +### What upstream changed + +| Commit | Change | +|--------|--------| +| `ee0b8229` | On existing `CippReportingDB` cleanup rule: `AddHours(-30)` → `AddDays(-30)` (fixes a typo — 30 hours was almost certainly meant to be 30 days). Filter still `PartitionKey eq 'Search'`. | +| `fdf313e5` | Removes `PartitionKey eq 'Search'` filter entirely. Final upstream rule: delete **all** `CippReportingDB` entities with `Timestamp` older than 30 days. | + +Upstream current `master` places this rule **second** in the batch (after `webhookTable`), before `AuditLogSearches`. + +### What our fork currently does + +- **No** `CippReportingDB` entry in `Start-TableCleanup.ps1`. +- **Does** use `CippReportingDB` extensively as the **primary tenant-scoped read cache** (`Add-CIPPDbItem`, `New-CIPPDbRequest`, nightly `Set-CIPPDBCache*` functions). Partition keys are **tenant IDs**, not `'Search'`. +- **Does** clean `AuditLogSearches` with `PartitionKey eq 'Search'` at **12 hours** (line 22–27) — separate table from `CippReportingDB`. +- **Custom protected rule:** `cacheQuarantineMessages` 1-day retention (Manage365 quarantine portal). + +No fork code writes `PartitionKey = 'Search'` into `CippReportingDB`. Search-partition entities live in `AuditLogSearches` / audit webhook flows. + +### Conflict cause + +Cherry-pick expects an existing `CippReportingDB` cleanup block to modify. Block never existed in the fork (diverged before upstream added it, or fork never adopted upstream reporting-DB timer cleanup). + +### Risk assessment + +| Action | Risk | +|--------|------| +| Cherry-pick `ee0b8229` alone | N/A — nothing to patch | +| Add upstream block with `Search` partition only | **Low effect** — likely no-op (no such rows in our table) | +| Add upstream block after `fdf313e5` (no partition filter, 30-day TTL) | **High** — deletes **all** tenant cache snapshots older than 30 days across every partition. Nightly refresh usually rewrites cache, but failed/inactive tenants or long-lived row keys could cause standards/tests to skip until manual cache refresh. | + +### Protected Manage365 areas + +Touches `Start-TableCleanup.ps1` — **protected** (custom quarantine cleanup must be preserved). + +### Upstream-only dependencies + +None — table and cache infrastructure exist in fork; only the **timer retention policy** is missing. + +### Recommendation + +**Skip both commits as cherry-picks.** This is **not** “defer until reporting DB feature chain arrives” — the cache table is already central to the fork. Instead: + +1. **Product decision:** Should `CippReportingDB` rows ever expire automatically? If yes, define Manage365-specific retention (e.g., tenant-partition scoped, align with cache refresh cadence, exclude `-Count` rows, etc.). +2. **Do not** add upstream’s post-`fdf313e5` rule verbatim. +3. If retention is desired later, implement a **new adapted block** — do not replay `ee0b8229` → `fdf313e5` sequence. + +--- + +## B. Intune Templates Property Rename + +**Commit:** `57b7de1f` +**File:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneTemplates.ps1` + +### What upstream changed + +Single-line rename inside a **~60-line standards usage-tracking block** (not in fork): + +```powershell +# upstream (inside StandardsTemplateV2 lookup loop) +$Tpl | Add-Member -NotePropertyName 'usage' -NotePropertyValue @($Usage) -Force +# was: usedInTemplates +``` + +### What our fork currently does + +Fork `Invoke-ListIntuneTemplates.ps1` (98 lines) lists templates from Azure Table `templates` partition — **no** `$Usage` computation, **no** `usedInTemplates` or `usage` property on returned objects. + +### Frontend expectation (CIPP `main` @ sync baseline) + +File: `src/pages/endpoint/MEM/list-templates/index.js` + +```javascript +const simpleColumns = ["displayName", "isSynced", "package", "description", "Type"]; +``` + +Repo-wide search: **no** references to `usedInTemplates` or template-level `.usage`. Unrelated `usageLocation` fields exist elsewhere. + +**Conclusion:** Frontend expects **neither** `usedInTemplates` **nor** `usage`. + +### Conflict cause + +Rename sits inside upstream-only usage block; fork file ends before that block. + +### Is upstream’s larger usage-tracking block required? + +**Yes.** The rename alone is meaningless without: + +- Standards template cross-reference (`StandardsTemplateV2` / package tags) +- Population of `$Usage` array per template GUID + +### Recommendation + +**Skip permanently** unless Manage365 intentionally imports the full Intune template ↔ standards usage feature (API + UI column). Renaming in isolation provides no value. + +**Risk:** Low +**Protected areas:** No +**Defer until feature chain:** Only if product wants usage column in MEM templates UI — treat as a **feature import**, not a bugfix cherry-pick. + +--- + +## C. Autopilot User-Select Behavior + +**Commit:** `785e71c5` +**File:** `Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1` + +### Fork behavior (current) + +```powershell +if ($Language -in @('user-select', 'os-default')) { $Language = "$null" } +# ... +'locale' = "$($Language)" # JSON serializes as string "$null" for both modes +``` + +Both `user-select` and `os-default` become the **literal string** `"$null"` in the Graph body (PowerShell double-quoted expansion of `$null`). + +### Upstream behavior + +```powershell +if ($Language -eq 'os-default') { $Language = $null } +# locale = "$($Language)" → omitted/null for os-default +if ($Language -eq 'user-select') { + $ObjBody.locale = '' + $ObjBody | Add-Member -Name 'language' -Value '' -Force +} +``` + +- **`os-default`** → `$null` locale (OS default during OOBE) +- **`user-select`** → empty `locale` + empty `language` (user chooses during OOBE; Graph treats empty string differently from null) + +### Safety analysis + +| Mode | Fork (likely Graph effect) | Upstream (intended) | Safer | +|------|---------------------------|---------------------|-------| +| `os-default` | String `"$null"` in locale | Null / omitted locale | **Upstream** | +| `user-select` | Same string `"$null"` | Empty locale + language | **Upstream** | + +Fork behavior is almost certainly **incorrect** for both modes — `"$null"` is not a valid locale tag and may confuse Autopilot OOBE language selection. + +**Behavior change risk:** Tenants with profiles already created under fork logic may have `"$null"` stored as locale. PATCH after fix could change OOBE language behavior on **profile update** (not retroactive on enrolled devices until profile reapplied). + +### Recommendation + +**Needs product decision** before apply. + +- **Technical direction:** Upstream fix aligns with Graph API semantics; fork `"$null"` string is a bug. +- **Operational concern:** Audit existing Autopilot deployment profiles for `"$null"` locale before mass remediate; communicate to clients using `user-select` / `os-default`. +- **Do not apply** until stakeholders accept potential profile locale migration. + +**Risk:** Medium +**Protected areas:** No (shared Autopilot helper, not quarantine/custom branding) + +--- + +## D. Generic Test Conflict + +**Commit:** `ddc264a7` +**File:** `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest002.ps1` + +### What upstream changed + +Display cap only: **100 → 500** licensed users in markdown output (4 lines). + +### What our fork currently does + +Fork implementation **diverged** (LicenseOverview cache, `UserLicenseMap` hashtable, string `$Result` vs upstream `StringBuilder`) but **still uses cap 100** at lines 57–61. + +Cherry-pick conflict is structural (different surrounding code), not logical opposition. + +### Recommendation + +**Apply with adaptation** — manual 4-line change; no need for full cherry-pick. + +**Minimal patch:** + +```powershell +# line ~57 +if ($DisplayCount -ge 500) { break } +# line ~60-61 +if ($UserLicenseMap.Count -gt 500) { + $Result += "`n*Showing 500 of $($UserLicenseMap.Count) licensed users.*`n" +``` + +**Risk:** Low (informational test output only) +**Protected areas:** No + +--- + +## E. Rerun Logic (Combined Review) + +**Commits:** `64836c02`, `2ab0e0e2` +**File:** `Modules/CIPPCore/Public/Test-CIPPRerun.ps1` + +### What upstream changed + +| Commit | Change | +|--------|--------| +| `64836c02` | Track `LastScheduledTime`; when `$BaseTime` differs from cached value, treat as new execution (fixes scheduled-task rerun false positives). | +| `2ab0e0e2` | Use `Add-Member -Force` instead of direct property assignment on table entities (Azure Table entity objects). | + +### What our fork currently does + +`Test-CIPPRerun.ps1` on sync branch **already contains both behaviors** (lines 66–79, `Add-Member -Force` pattern throughout). + +Present on `master` before sync branch: + +- `d9a8c33b5` — fix: rerun detection on scheduled tasks +- `76b390f1a` — fix: rerun issue + +`git diff 64836c02 HEAD -- Test-CIPPRerun.ps1` shows only the `Add-Member` delta (already applied). `git diff 2ab0e0e2 HEAD` is empty. + +### Conflict cause at cherry-pick time + +Fork already had v10.5.2-intake equivalents; upstream SHAs patch an older baseline → conflict, not missing logic. + +### Recommendation + +**Already implemented** — mark superseded in tracking; **skip** cherry-picks. + +**Risk if re-applied:** Low conflict noise; no functional gain +**v10.5.2 intake:** Compatible — fixes were absorbed pre-sync + +--- + +## F. Apps and Services Cache / Test + +**Commit:** `503eac5b` +**Files:** `Set-CIPPDBCacheSettings.ps1`, `Invoke-CippTestCIS_1_3_4.ps1` + +### What upstream changed + +1. **Cache:** Separate `New-GraphGetRequest` to `/admin/appsAndServices` → `Add-CIPPDbItem -Type 'AppsAndServices'`. +2. **Test:** Read `AppsAndServices` type first; fall back to nested object in `Settings` cache; stricter property presence check. + +### What our fork currently does + +**Cache (`Set-CIPPDBCacheSettings.ps1`):** Already caches `AppsAndServices` via **bulk Graph request** (lines 28–66), plus `FormsSettings` — **more complete** than upstream commit. + +**Test (`Invoke-CippTestCIS_1_3_4.ps1`):** Still reads **only** `Settings` cache and extracts `appsAndServices` child — upstream test improvement **not** yet applied. + +### Does CIS 1.3.4 need the dedicated cache type? + +**Not strictly** — fork bulk cache also writes `Settings` with full directory settings. Test can pass today **if** `appsAndServices` appears in Settings payload. + +**Adapted test still valuable:** Prefer dedicated `AppsAndServices` type (already populated) with Settings fallback — matches upstream intent and avoids false skips if Settings shape changes. + +### Conflict cause + +Fork restructured cache function (bulk + Forms); upstream added sequential block → textual conflict. Feature not missing. + +### Recommendation + +| Part | Action | +|------|--------| +| Cache portion of `503eac5b` | **Already implemented differently** — skip | +| CIS test portion | **Apply with adaptation** (manual merge of test file only) | + +**Minimal patch for `Invoke-CippTestCIS_1_3_4.ps1`:** Replace Settings-only lookup with upstream’s AppsAndServices-first + fallback + property guard (see `503eac5b` diff). + +**Risk:** Low +**Protected areas:** No (standard cache file, not quarantine) + +--- + +## G. Role Assignment Checks + +**Commit:** `961462f3` +**Files:** `Invoke-CippTestCIS_1_1_1.ps1`, `_1_1_2`, `_1_1_3`, `_1_1_4`, `Invoke-CippTestZTNA21782.ps1` + +### What upstream changed + +Replaces legacy `RoleAssignments` cache joins with: + +- `Get-CippDbRole -IncludePrivilegedRoles` (role members from DB role objects) +- `RoleAssignmentScheduleInstances` cache (PIM permanent assignments, `assignmentType -eq 'Assigned'`, no `endDateTime`) +- HashSet-based privileged user ID aggregation + +### What our fork currently does + +| File | Fork pattern | +|------|--------------| +| CIS 1.1.1–1.1.4 | `Get-CIPPTestData -Type 'Roles'` + `RoleAssignments` + `-in` filters | +| ZTNA21782 | `RoleAssignments` join with `UserRegistrationDetails` | +| Other ZTNA tests (21815, 21816, etc.) | **Already** use `Get-CippDbRole` + `RoleAssignmentScheduleInstances` | + +Fork **has** `Get-CippDbRole`, `Get-CippDbRoleMembers`, `Set-CIPPDBCacheRoleAssignmentScheduleInstances` — infrastructure exists; CIS 1.1.x not migrated. + +### Equivalent logic? + +**No.** Legacy `RoleAssignments` can miss PIM schedule nuances and uses different role ID fields (`roleDefinitionId` vs `roleTemplateId`). Upstream fix addresses false negatives/positives for privileged user detection. + +### Conflict cause + +Partial migration — fork ZTNA tests updated in v10.5.2 intake; CIS 1.1.x left on old pattern; upstream patch overlaps both → 4/5 file conflicts. + +### Recommendation + +**Apply with adaptation** in a dedicated batch — **file-by-file manual merge**, do not blind cherry-pick. + +Suggested order: `CIS_1_1_1` → `_1_1_2` → `_1_1_3` → `_1_1_4` → `ZTNA21782` (mirror patterns from existing `Invoke-CippTestZTNA21816.ps1`). + +**Risk:** Medium (test assertions only; may change pass/fail for tenants using PIM) +**Protected areas:** No +**Dependencies:** Ensure `RoleAssignmentScheduleInstances` cache refresh runs (`Set-CIPPDBCacheRoleAssignmentScheduleInstances`). + +--- + +## Applied Standard Validation: `fd6e30f6` / `610cb089b` + +**File (runtime):** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1` +**Applied SHA:** `610cb089b` (batch 6, clean cherry-pick) + +### What changed + +| Before | After | +|--------|-------| +| Read/write `azureADJoin.allowedToJoin` | Read/write `azureADRegistration.allowedToRegister` | +| Always remediate | Skip remediate when `azureADRegistration.isAdminConfigurable -eq $false` (common when Intune enabled) | + +### Is the `azureADRegistration` change safe? + +**Yes, technically correct.** Standard name and helptext describe **device registration**, not Entra join. Prior behavior targeted the wrong Graph sub-object and could report/remediate the wrong policy surface. + +**Caveats:** + +1. **Intune-enabled tenants:** Remediation skipped with Warning — alert/report still evaluate `azureADRegistration` state. Operators may see alerts they cannot auto-remediate (expected). +2. **Stale duplicate:** `Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1` still uses `azureADJoin` — **not invoked** by `Push-CIPPStandard` (loads `CIPPStandards` module). Schedule mirror cleanup to avoid future confusion. + +### Rollback concern + +Revert `610cb089b` restores incorrect `azureADJoin` targeting. If remediation ran on a tenant **before** apply, re-running old code would again write join policy instead of registration policy — document tenant state if rollback needed. + +### Live-tenant smoke test steps + +1. **Pre-check:** `GET beta/policies/deviceRegistrationPolicy` — note `azureADRegistration.allowedToRegister.@odata.type` and `isAdminConfigurable`. +2. **Tenant without Intune** (or `isAdminConfigurable = true`): + - Enable standard with remediate ON, `disableUserDeviceRegistration = true`. + - Confirm PUT sets `azureADRegistration.allowedToRegister` to `#microsoft.graph.noDeviceRegistrationMembership`. + - Confirm `azureADJoin.allowedToJoin` unchanged unless separately configured. +3. **Intune-enabled tenant** (`isAdminConfigurable = false`): + - Run remediate — expect **Warning** skip, no PUT. + - Alert/report modes still produce meaningful compare output. +4. **Disable path:** Set `disableUserDeviceRegistration = false` — verify `#microsoft.graph.allDeviceRegistrationMembership` when remediate allowed. +5. **Log review:** Search `Standards` API logs for updated message strings (“users allowed to register”). + +--- + +## Recommended Next Adapted-Apply Batch (max 3 commits) + +| Priority | Item | Action | Rationale | +|----------|------|--------|-----------| +| 1 | `ddc264a7` | Manual 4-line cap 100→500 | Trivial, zero conflict risk, tests-only | +| 2 | `503eac5b` (test only) | Manual merge `Invoke-CippTestCIS_1_3_4.ps1` | Cache already done; improves test resilience | +| 3 | `961462f3` | Adapted file-by-file (start `CIS_1_1_1`) | Real correctness fix; use existing `Get-CippDbRole` infra | + +**Do not include** in next batch: cleanup commits, template rename, Autopilot language (pending decision), rerun commits (done). + +--- + +## Recommended Skips + +| SHA | Reason | +|-----|--------| +| `ee0b8229` | No block to patch; wrong to add without retention design | +| `fdf313e5` | Blanket 30-day delete on entire cache table — unsafe verbatim | +| `57b7de1f` | Rename-only; usage feature + UI absent | +| `64836c02` | Superseded by `d9a8c33b5` on master | +| `2ab0e0e2` | Superseded by `76b390f1a` on master | +| `503eac5b` (cache hunk) | Fork bulk implementation already superior | + +--- + +## Product Decisions Needed + +1. **`CippReportingDB` retention** — Should cache rows auto-expire? If yes, define partition/type scope and TTL (not upstream’s unfiltered 30-day rule). +2. **Autopilot `user-select` / `os-default` (`785e71c5`)** — Accept upstream Graph semantics and plan audit of existing profiles with `"$null"` locale? +3. **Intune template usage tracking** — Import full upstream usage block + UI column, or permanently skip `57b7de1f` chain? + +--- + +## Smoke Test Checklist — Applied Standards Changes + +### `intuneRestrictUserDeviceRegistration` (`610cb089b`) + +- [ ] Graph GET deviceRegistrationPolicy on test tenant — capture before state +- [ ] Remediate ON, non-Intune tenant — verify `azureADRegistration.allowedToRegister` changes +- [ ] Remediate ON, Intune tenant — verify skip + Warning (no PUT) +- [ ] Alert mode — alert fires when registration policy mismatches desired state +- [ ] Report/BPA — `intuneRestrictUserDeviceRegistration` field reflects new read path +- [ ] Confirm `azureADJoin.allowedToJoin` not modified by standard run +- [ ] Rollback plan documented if revert required + +### Post–batch 7 (when adapted applies land) + +- [ ] Run GenericTest002 on tenant with >100 licensed users — confirm 500 cap +- [ ] CIS 1.3.4 — pass/skip with AppsAndServices cache only (Settings fallback) +- [ ] CIS 1.1.1 — compare results before/after on tenant with PIM GA assignments +- [ ] Full regression: `Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1` + `Tests/Tools` (47 tests) + +--- + +## Document History + +| Date | Action | +|------|--------| +| 2026-06-17 | Initial deferred review complete; cherry-picks remain paused pending approval of batch 7 plan | diff --git a/docs/upstream-sync/history-cipp-api/FIRST_PASS_REPORT_20260617.md b/docs/upstream-sync/history-cipp-api/FIRST_PASS_REPORT_20260617.md new file mode 100644 index 0000000000..dbd078e04d --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/FIRST_PASS_REPORT_20260617.md @@ -0,0 +1,249 @@ +# Upstream Sync — First Pass Inspection Report + +Generated: 2026-06-17 +Phase: **Setup complete — CIPP-API cherry-picks in progress** + +--- + +## 1. Git State Summary + +### CIPP (Frontend) + +| Item | Value | +|------|-------| +| Current branch | `main` | +| Working tree | Clean | +| vs origin | Ahead by 1 commit (unpushed) | +| Current tip | `f2d87612e` — chore: update dependencies and remove pnpm lock file | +| Upstream remote | `upstream` → `KelvinTegelaar/CIPP.git` ✓ | +| Upstream tracking branch | `upstream/main` | +| Upstream tip | `0d8ca9d2f` — Merge pull request #6153 from KelvinTegelaar/dev | +| Merge base | `0710355e2` | +| **Commits behind upstream** | **241** | + +### CIPP-API (Backend) + +| Item | Value | +|------|-------| +| Current branch | `master` | +| Working tree | Clean | +| vs origin | Up to date | +| Current tip | `de78a343e` — refactor: enhance quarantine message retrieval and filtering | +| Upstream remote | `upstream` → `KelvinTegelaar/CIPP-API.git` ✓ | +| Upstream tracking branch | `upstream/master` | +| Upstream tip | `5a0ddb29c` — Dev to hotfix (#2088) | +| Merge base | `6871d267e` | +| **Commits behind upstream** | **315** | + +### Remotes (both repos) + +| Remote | CIPP | CIPP-API | +|--------|------|----------| +| `origin` | `Celeratec/CIPP.git` | `Celeratec/CIPP-API.git` | +| `upstream` | `KelvinTegelaar/CIPP.git` | `KelvinTegelaar/CIPP-API.git` | + +Upstream fetch completed successfully during this inspection. + +--- + +## 2. Protective Setup + +## 2. Protective Setup + +Sync branches and backup tags created on 2026-06-17: + +| Repo | Production branch | Backup tag | Sync branch | +|------|-------------------|------------|-------------| +| CIPP | `main` @ pushed tip | `backup/pre-upstream-sync-cipp-20260617` | `manage365/upstream-sync-cipp-20260617` | +| CIPP-API | `master` | `backup/pre-upstream-sync-cipp-api-20260617` | `manage365/upstream-sync-cipp-api-20260617` | + +Tags and sync branches are local only (not pushed to origin unless approved). + +--- + +--- + +## 3. Documents Generated + +| Document | Location | +|----------|----------| +| CIPP upstream inventory (241 commits) | `docs/upstream-sync/UPSTREAM_SYNC_CIPP_20260617.md` | +| CIPP-API upstream inventory (315 commits) | `docs/upstream-sync/UPSTREAM_SYNC_CIPP_API_20260617.md` | +| Custom feature map | `docs/upstream-sync/CUSTOM_FEATURE_MAP_20260617.md` (both repos) | +| Applied commits tracker (empty) | `docs/upstream-sync/APPLIED_COMMITS_CIPP_20260617.md` | +| Applied commits tracker (empty) | `docs/upstream-sync/APPLIED_COMMITS_CIPP_API_20260617.md` | + +--- + +## 4. Inventory Statistics + +### CIPP — 241 upstream commits + +| Risk | Count | +|------|-------| +| Low | 11 | +| Medium | 80 | +| High | 150 | + +| Recommendation | Count | +|----------------|-------| +| Needs manual review | 200 | +| Cherry-pick with adaptation | 30 | +| Cherry-pick (clean) | 11 | + +**Notable buckets:** 136 dependency/build, 157 potentially breaking, 15 touch protected custom areas. + +### CIPP-API — 315 upstream commits + +| Risk | Count | +|------|-------| +| Low | 48 | +| Medium | 37 | +| High | 230 | + +| Recommendation | Count | +|----------------|-------| +| Needs manual review | 228 | +| Cherry-pick with adaptation | 39 | +| Cherry-pick (clean) | 48 | + +**Notable buckets:** 49 tests-only, 216 dependency/build tagged, 11 touch protected custom areas. + +--- + +## 5. Custom Features at Risk + +See `CUSTOM_FEATURE_MAP_20260617.md` for full detail. Highest-risk protected areas: + +1. **Quarantine Portal 5.13.0** — Very high upstream overlap; 20+ custom API files + shared frontend module +2. **Manage365 Branding/Versioning** — `manage365-version.json`, dual version tooling, drift alerts +3. **Email Troubleshooter** — Shares quarantine components; `Invoke-ExecEmailTroubleshoot.ps1` +4. **Navigation/Search UX** — Hybrid top-nav search, dashboard v2 routing (upstream changes nav frequently) +5. **Tenant Workflows** — GDAP, tenant mode, alignment with custom license/CA template logic +6. **OAuth Auth Flow** — BroadcastChannel popup completion (custom, not upstream) + +**Recent post-intake commits (especially protected):** + +CIPP (`main` since `pre-upstream-merge-v1052-20260617`): +- Quarantine management features + version bump +- v10.5.2 intake (quarantine pagination) +- manual pagination for ListMailQuarantine +- Dependency update (unpushed on main) + +CIPP-API (`master` since `pre-upstream-merge-v1052-20260617`): +- Quarantine message retrieval refactor +- v10.5.2 intake (ORCA fixes, standards, quarantine) +- ORCA standards fixes (ORCA103–244) +- Tenant alignment updates + +--- + +## 6. First Pass Results + +| Metric | CIPP | CIPP-API | Total | +|--------|------|----------|-------| +| Upstream commits reviewed | 241 | 315 | **556** | +| Applied | 0 | 0 | 0 | +| Adapted | 0 | 0 | 0 | +| Skipped | 0 | 0 | 0 | +| Deferred | 0 | 0 | 0 | +| Conflicts encountered | 0 | 0 | 0 | +| Tests run | 0 | 0 | 0 | + +--- + +## 7. Recommended First Batch (Low-Risk) + +Apply **only after** creating sync branches and backup tags. Review each commit against `CUSTOM_FEATURE_MAP` before cherry-picking. + +### CIPP-API — Start here (more clean test/bugfix commits) + +Priority order — tests and isolated bugfixes with ≤2 files, no protected-path overlap: + +| # | SHA | Title | Category | +|---|-----|-------|----------| +| 1 | `2b441244` | feat: Add Levenshtein distance function and tests | Tests | +| 2 | `133f9295` | test: fix helper paths after tools folder move | Tests | +| 3 | `6aa66c74` | Custom Test - Alert on X statuses | Tests | +| 4 | `ee0b8229` | fix: change cleanup to 30 days | Bugfix | +| 5 | `fdf313e5` | fix: remove partitionkey | Bugfix | +| 6 | `ecbc9a50` | fix: Add error handling for missing standard functions | Bugfix | +| 7 | `57b7de1f` | fix: Rename 'usedInTemplates' to 'usage' | Bugfix | +| 8 | `23c8994d` | fixes defaultr_hidden vs hidden #5990 | Bugfix | +| 9 | `897dfaa4` | fixed #5997 | Bugfix | +| 10 | `5ccf15a9` | fix: missing odata path error in returned json | Bugfix | +| 11 | `9ba48711` | correct incorrect default value | Bugfix | +| 12 | `4214bc7d` | Fix: Fix missing OData path error in JSON response (#2054) | Bugfix | +| 13 | `71afcdd2` | ExoTransportConfig cache type - fix for missing data | Tests | + +**Checkpoint before:** `1aa55cff` (Intune standard change detection), `affac9d0` (standards run errors), `12bb4f69` (caching cleanup) — these touch standards/cache and need review. + +### CIPP — Smaller first batch (many upstream commits are dependency/build) + +| # | SHA | Title | Category | Notes | +|---|-----|-------|----------|-------| +| 1 | `98d5d94a` | Custom Test - Alert on X statuses | Tests | Low overlap | +| 2 | `1e59d2d4` | Update ListTests.json | Tests | Verify shape compatibility | +| 3 | `e3ed1818` | fix alert mode | Bugfix | 1 file | +| 4 | `60a50738` | fixes tenantfilter property | Bugfix | Review tenant context | +| 5 | `0a8252e3` | fix: version encoding | Bugfix | **Checkpoint** — touches version | +| 6 | `707873e3` | fix: Fix tab title showing as undefined | Bugfix | UI, low risk | +| 7 | `89abbf50` | fix: improve stale issue and close messages | Bugfix | GitHub workflow | +| 8 | `5709f856` | fix: update terminology Temporary Access Password | Bugfix | i18n only | + +**Skip/defer in CIPP first batch:** +- `983b48a1` / `bde8ad3c` — worktrees cleanup (may already exist on `fix/remove-claude-worktrees` branch; verify) +- `c8d61c07` — JIT admin fix (**Already implemented differently** at `7e1bab525`) +- `1ea0324e` — search-on-load fix (verify against our table search fix at `18c21fc6b`) +- `f768330c` — CIS standards tag move (**conflicts with our CIS 7.0 renumbering**) +- `fe4bd7f9` — alltenants sync (review tenant context) +- All Dependabot / package.json commits — **explicit approval required** + +--- + +## 8. Commits Requiring Approval Before Any Apply + +Any upstream commit touching these areas must pause for review (see inventory Notes column for full list): + +- Quarantine / spamfilter / `Build-CIPPQuarantineQueryParams` +- Email Troubleshooter / `ExecEmailTroubleshoot` +- Exchange Online / mailbox / transport +- Authentication / OAuth / SAM / roles / `SAMManifest.json` +- Tenant switching / tenantFilter / GDAP / alignment +- Branding / version.json / manage365-version +- Navigation / config.js / top-nav +- Shared API helpers (`New-GraphPostRequest`, etc.) +- Dependency upgrades / build tooling +- Large refactors (>5 files or "refactor" in title) + +--- + +## 9. Known Risks + +1. **Prior partial intake** — v10.5 / v10.5.2 selective intake already applied many upstream commits with adaptation. Some inventory commits may be **already implemented differently** (e.g., JIT admin, table search, quarantine pagination). +2. **High dependency churn in CIPP** — 136 of 241 commits touch package.json/CI; batching these blindly risks breaking the SWA build. +3. **Standards divergence** — CIS 7.0 renumbering and ORCA fixes on our side may conflict with upstream standards.json changes. +4. **Quarantine active development** — Both forks and upstream are changing quarantine simultaneously; highest conflict risk. +5. **Unpushed CIPP commit** — `main` is 1 commit ahead of origin (`f2d87612e` dependency update); push or include in sync branch baseline. + +--- + +## 10. Recommended Next Steps + +1. **Approve** creation of sync branches + backup tags (commands in §2) +2. **Review** this report and the first-batch table +3. **Begin CIPP-API** with test-only commits (`2b441244`, `133f9295`, `6aa66c74`) +4. **Run Pester** after each API batch: `Invoke-Pester -Path Tests/Tools,Tests/Endpoint -Output Detailed` +5. **CIPP second** — start with test commits, defer all dependency bumps +6. **Schedule checkpoint reviews** for quarantine, auth, tenant, and standards batches + +--- + +## 11. Remaining Manual Decisions + +- [ ] Confirm date stamp for sync branches (`20260617` vs `20260617` — branch history uses 20260617) +- [ ] Push unpushed CIPP commit before sync branch creation? +- [ ] Whether to skip upstream commits already implemented differently (JIT admin, search fixes) +- [ ] Dependency upgrade strategy — individual bumps vs grouped batch with build verification +- [ ] Standards/ORCA commits — merge vs skip given recent v10.5.2 intake +- [ ] Quarantine upstream delta — full diff review before any quarantine cherry-picks diff --git a/docs/upstream-sync/history-cipp-api/MCP_INTAKE_20260803.md b/docs/upstream-sync/history-cipp-api/MCP_INTAKE_20260803.md new file mode 100644 index 0000000000..15fc7b34be --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/MCP_INTAKE_20260803.md @@ -0,0 +1,47 @@ +# MCP Feature Intake — 2026-08-03 + +Cycle type: **Feature intake** per [PROCESS.md](PROCESS.md). + +## Feature: MCP Server (internal team) + +- Upstream refs: `Invoke-ExecMcp.ps1`, `Modules/CIPPCore/Public/MCP/*`, `Set-CIPPMCPClientApp.ps1`, `Config/openapi.json`, MCPAllowed wiring in ApiClient + auth +- Fork gap: Feature flag `MCPServer` existed (disabled) and `New-CippCoreRequest` already mapped MCP principals; missing endpoint, MCP helpers, OpenAPI spec, UI toggle +- Protected conflicts: Adapt `Set-CippApiAuth` / `CippApiClientManagement` — preserve SWA auth path and Manage365 branding (do not take CIPPNG/SSO EasyAuth rewrite) +- Scope: **capability only** — `MCPServer` remains **Enabled: false** until ops validates; internal team use +- Phases: backend → frontend → tab hygiene → verify → PR +- Approval: [x] design [x] implement [x] deploy (enable flag after smoke) + +## Also in this intake + +- Super-admin tab hygiene: removed 404 links for CIPP Users, SSO, Container Management from `tabOptions.json` +- Container management / logs / worker health: **not** intaken (Craft bridges required) +- Teams V2: **unchanged deferred** + +## Taken + +### CIPP-API + +- `Modules/CIPPCore/Public/MCP/{Get-CippMcpSpec,Get-CippMcpToolList,Get-CippMcpToolResult}.ps1` +- `Modules/CIPPHTTP/.../CIPP/MCP/Invoke-ExecMcp.ps1` +- `Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1` +- `Config/openapi.json` (upstream baseline for tool projection) +- `Get-CippApiClient` projects `MCPAllowed` +- `Invoke-ExecApiClient` persists MCPAllowed, configures MCP app on enable, SaveToAzure passes `McpClientIds` + PRM scope app setting +- `Set-CippApiAuth` gains optional `-McpClientIds` host/appId audiences (fork ARM path kept) + +### CIPP + +- `CippApiClientManagement.jsx`: MCPAllowed switch + warning, MCP API URL chip, table column +- `super-admin/tabOptions.json`: dropped CIPP Users / SSO / Container Management tabs + +## Enablement (post-deploy) + +1. Deploy all Function slots + SWA +2. Create/enable an API client with **MCP Access Allowed**, then **Save to Azure** +3. Toggle feature flag **MCP Server** on in CIPP settings / Feature Flags +4. Smoke: POST `tools/list` then one `.Read` tool via MCP client against `/api/ExecMcp` + +## Verification + +- PowerShell AST parse: all new/changed MCP and auth files OK +- `MCPServer.Enabled` remains `false` in `Config/FeatureFlags.json` diff --git a/docs/upstream-sync/history-cipp-api/README.md b/docs/upstream-sync/history-cipp-api/README.md new file mode 100644 index 0000000000..476d1030ca --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/README.md @@ -0,0 +1,13 @@ +# Upstream sync (CIPP-API) + +Manage365 upstream sync process is documented in the **CIPP** repo: + +**[../../CIPP/docs/upstream-sync/PROCESS.md](../../CIPP/docs/upstream-sync/PROCESS.md)** (sibling repo when checked out as `GitHub/CIPP` + `GitHub/CIPP-API`) + +Start a backend cycle from this repo root: + +```powershell +../CIPP/Tools/Start-UpstreamSyncCycle.ps1 -Repo CIPP-API +``` + +Cycle-specific API docs for June 2026 live in this folder (`CIPP_API_SYNC_CHECKPOINT_*.md`, etc.). diff --git a/docs/upstream-sync/history-cipp-api/SYNC_20260701.md b/docs/upstream-sync/history-cipp-api/SYNC_20260701.md new file mode 100644 index 0000000000..1876775045 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/SYNC_20260701.md @@ -0,0 +1,9 @@ +# Upstream Sync Checkpoint — July 1, 2026 (Light Delta) + +Baseline moved: CIPP-API **10.5.2 → 10.5.6**. 56 commits applied on +`manage365/upstream-sync-cipp-api-20260701` (backup tag `backup/pre-upstream-sync-cipp-api-20260701`). + +Full details (taken/deferred/adapted, both repos) live in the CIPP repo: +`docs/upstream-sync/SYNC_20260701.md`. + +Verification: PowerShell parser clean on all 81 changed script files; JSON valid; no conflict markers. diff --git a/docs/upstream-sync/history-cipp-api/SYNC_20260803.md b/docs/upstream-sync/history-cipp-api/SYNC_20260803.md new file mode 100644 index 0000000000..018ea52bd2 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/SYNC_20260803.md @@ -0,0 +1,60 @@ +# Upstream Sync Checkpoint — 2026-08-03 + +Cycle type: **Light/medium delta** (upstream **10.7.3 → 10.7.5**). + +| Repo | From | To | Upstream tip | +|---|---|---|---| +| CIPP (frontend) | 10.7.3 (`d72c1e21b`) | **10.7.5** | `upstream/main` @ `274880fd0` | +| CIPP-API | 10.7.3 (`f1b2c93d5`) | **10.7.5** | `upstream/master` @ `245d9d35b` | + +Branches: `manage365/upstream-sync-cipp-20260803` / +`manage365/upstream-sync-cipp-api-20260803`. +Backup tags: `backup/pre-upstream-sync-cipp-20260803` / +`backup/pre-upstream-sync-cipp-api-20260803`. + +Delta docs: [UPSTREAM_DELTA_CIPP_20260803.md](./UPSTREAM_DELTA_CIPP_20260803.md), +CIPP-API `docs/upstream-sync/UPSTREAM_DELTA_CIPP_API_20260803.md`. + +## Applied + +| Batch | Theme | Outcome | +|---|---|---| +| 1 | AzBobbyTables 3.6.2 + `Add`/`Get`/`Remove-CIPPAzDataTableEntity` + call-site renames + ConversionTable | **Apply** | +| 2 | Intune template drift helpers (`Get-CIPPIntunePolicyName`, `Merge-CIPPIntuneTemplateIdentity`, `Select-CIPPIntuneAvailableSetting`), standard/compare updates, SafeLinks, Get-CIPPDrift Microsoft-managed skip | **Apply** (31/31 Intune helper Pester) | +| 3 | `disableNesting` (New-CIPPGroup + FE form), EditGroup `AddDevice` + MEM device action + adapted groups edit dialog, SAM `RoleManagement.Read.Exchange` Scope | **Adapt** (preserved fork groupType/mailNickname + redesigned edit page) | +| 4–5 | Snooze Reason (FE+API), default Home test suite, partner webhook stale-URL + `Get-CIPPHostname`, M365Licenses.json, audit log V2 + webhook tests | **Apply / Adapt** (21/21 `Test-CIPPAuditLogRules` Pester) | + +## Skipped / Deferred + +| Item | Outcome | Why | +|---|---|---| +| SSO preconsent / `CippSSOSettings` / `Invoke-ExecSSOSetup` | **Skip** | SSO family — SWA/Craft (2026-07-15 decision) | +| `CippAppServiceDomains` / `ExecAppServiceDomains` | **Defer** | No App Service custom-domain hosting in fork | +| `Start-SchedulerOrchestrator` `$ValidTypes` destructive cleanup | **Still defer** | Carryover from 07-28 | +| Teams V2, MCP, Worker health, container management, Purview DLP | Unchanged backlog | See PROCESS.md Feature intake backlog | + +## Verification + +- Frontend: `npm run build` — pass +- Pester: Intune helpers 31/31; `Test-CIPPAuditLogRules` 21/21 +- AST parse: all newly ported `.ps1` files OK +- SAMManifest JSON valid after Scope union-merge + +## Versions + +- Manage365 **5.30.0 → 5.31.0**; upstream baseline **10.7.3 → 10.7.5** +- API `version_latest.txt` and `Config/version_latest.txt` both **10.7.5** + +## Post-deploy actions + +1. Deploy Static Web App +2. Deploy **all** Function App slots (AzBobbyTables + CIPPCore changes) +3. **CPV refresh** — new Graph delegated Scope `RoleManagement.Read.Exchange` (`3bc15058-…`) +4. Smoke: Intune template drift, MEM device Add-to-Group, group create with disableNesting, partner webhook page, snooze with reason + +## Next cycle base SHAs + +| Repo | Base | +|---|---| +| CIPP | `274880fd0` (upstream/main) | +| CIPP-API | `245d9d35b` (upstream/master) | diff --git a/docs/upstream-sync/history-cipp-api/SYNC_20260814.md b/docs/upstream-sync/history-cipp-api/SYNC_20260814.md new file mode 100644 index 0000000000..f2a8e2fe67 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/SYNC_20260814.md @@ -0,0 +1,66 @@ +# Upstream Sync Checkpoint — 2026-08-14 + +Cycle type: **Major** (upstream **10.7.5 → 10.8.5**; plan scoped as 10.8.4, tip advanced). + +| Repo | From | To | Upstream tip | +|---|---|---|---| +| CIPP | 10.7.5 (`274880fd0`) | **10.8.5** | `upstream/main` @ `a1b620403` | +| CIPP-API | 10.7.5 (`245d9d35b`) | **10.8.5** | `upstream/master` @ `e02ac3724` | + +Branches: `manage365/upstream-sync-cipp-20260814` / +`manage365/upstream-sync-cipp-api-20260814`. +Backup tags: `backup/pre-upstream-sync-cipp-20260814` / +`backup/pre-upstream-sync-cipp-api-20260814`. + +Delta: [UPSTREAM_DELTA_CIPP_20260814.md](./UPSTREAM_DELTA_CIPP_20260814.md), +API `docs/upstream-sync/UPSTREAM_DELTA_CIPP_API_20260814.md`. +Baselines: [BASELINES_INTAKE_20260814.md](./BASELINES_INTAKE_20260814.md). + +## Applied + +| Batch | Theme | Outcome | +|---|---|---| +| 1 | ConversionTable, ListSecureScoreReport + Get-CIPPSecureScoreReport, FE securescore + AllTenants helpers | **Apply / Adapt** | +| 2 | ListIntuneApprovalRequests + alert + retry; BitLocker search page + nested ExecBitlockerSearch; FE MAA + BitLocker nav | **Apply** | +| 3 | ListRoles (nested), ListTenantAllowBlockList (Spamfilter), TABL helpers, ExecSetDefaultMFAMethod, CA/EXO PowerShell/DisableM365GroupUsers standards | **Apply** | +| 4 | Baselines modules (29) + Set-CippBaselineRunContext + orch + activities + 9 HTTP + BaselineStandards (81) + FeatureFlags/Timers (flag **off**) + FE pages/components; nav commented | **Feature intake** | +| 5 | ListBrandingSettings/Presets + Get-CIPPBranding*; ListCommunityRepoTemplates + catalog/CippTemplateCatalog (nav not fully rewired) | **Apply (partial)** | +| — | M365Licenses.json | **Apply** | + +## Skipped / Deferred + +| Item | Outcome | Why | +|---|---|---| +| SSO / authentication nav / container-management / ForcedSsoMigration | **Skip** | SWA/Craft | +| Node/jsdom engine bumps, wholesale yarn.lock | **Defer** | After ports settle | +| Full BEC / user detail rewrite; Default MFA **UI** wire into fork user page | **Defer Adapt** | API ported; FE surgical later | +| Full community-repos index.js rework | **Defer Adapt** | Catalog API + page present | +| Full branding settings JSX replace | **Defer Adapt** | List APIs ported; keep Manage365 branding UI | +| CVE report rewrite | **Skip** | Fork removed CVE surface on origin | +| Teams V2 | Unchanged deferred | | +| PublicMcpRegister | **Defer** | MCP already intaken separately | + +## Verification + +- PowerShell AST: Baselines/*.ps1 + key new HTTP entrypoints OK +- `Baselines.Enabled` = **false** in FeatureFlags +- SAMManifest: no new permission IDs this cycle + +## Versions + +- Manage365 **5.32.2 → 5.33.0**; upstream baseline **10.7.5 → 10.8.5** +- API `version_latest.txt` / `Config/version_latest.txt` → **10.8.5** + +## Post-deploy + +1. Deploy SWA + **all** Function slots (esp. standards processor for baseline timer when enabled) +2. Smoke: MAA Requests, BitLocker search, Secure Score, `/tenant/baselines` (direct URL) +3. Enable `Baselines` flag only after orchestrator smoke +4. Optional: uncomment Baselines nav in `src/layouts/config.js` + +## Next cycle base SHAs + +| Repo | Base | +|---|---| +| CIPP | `a1b620403` (upstream/main) | +| CIPP-API | `e02ac3724` (upstream/master) | diff --git a/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_20260814.md b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_20260814.md new file mode 100644 index 0000000000..be8a8ad841 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_20260814.md @@ -0,0 +1,33 @@ +# Upstream Delta — CIPP (frontend) — 2026-08-14 + +Cycle: **Major** — upstream **10.7.5 → 10.8.5** (plan drafted as 10.8.4; tip advanced). + +| | SHA / version | +|--|--| +| Last sync base | `274880fd0` (upstream tip at 10.7.5) | +| Upstream tip | `a1b620403` (`upstream/main`, **10.8.5**) | +| Fork production at cycle start | `68dda9809` (`origin/main`) | +| Sync branch | `manage365/upstream-sync-cipp-20260814` | +| Backup tag | `backup/pre-upstream-sync-cipp-20260814` | + +Noise excluded from triage: `public/intune-definitions/**` churn, bulk Vitest scaffolding (port only if a batch needs it). + +## Triage themes + +| Theme | Outcome | Notes | +|-------|---------|-------| +| Baselines pages (`src/pages/tenant/baselines/**`, `CippBaselines/*`) | **Feature intake** | Pair with API; flag off; nav commented upstream — wire carefully | +| Branding settings/PDF presets | **Adapt** | Preserve Manage365 `CippBrandingSettings` / `customBranding` | +| Intune approval requests | **Apply** | New page + API | +| BitLocker search page | **Apply** | New route; search helper already in fork | +| Secure Score report / AllTenants | **Adapt** | Pair with `ListSecureScoreReport` | +| Default MFA method on user page | **Adapt** | Surgical into fork user detail | +| Community repos catalog | **Adapt** | Large FE rework — surgical | +| BEC / user detail | **Adapt** | Protected-rich fork UI | +| Auth nav → authentication/container-management, SSO dialogs | **Skip** | SWA/Craft | +| Node/jsdom engine bumps, wholesale yarn.lock | **Defer** | After feature ports | +| CippDataTable / top-nav / standards accordion | **Adapt only** | Protected | + +## Protected map refresh note + +Still authoritative: [CUSTOM_FEATURE_MAP_20260617.md](./CUSTOM_FEATURE_MAP_20260617.md). This cycle adds: Baselines parallel to Applied Standards (do not replace drift UI); branding Adapt-not-replace; skip auth nav split. diff --git a/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260617.md b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260617.md new file mode 100644 index 0000000000..5a803c2df5 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260617.md @@ -0,0 +1,358 @@ +# Upstream Delta Inventory — CIPP-API (Backend) + +Generated: 2026-06-17 +Production branch: `master` @ `88ddf5da5` +Upstream: `KelvinTegelaar/CIPP-API` @ `5a0ddb29c` + +## Delta summary + +| Metric | Count | +|--------|-------| +| Fork-only commits (ahead of upstream) | 436 | +| Upstream commits not in `master` (behind) | 315 | +| Upstream commits since sync base `de78a343e` | 315 | + +**Interpretation:** The branch is behind upstream by design after the first selective sync (~31 commits merged). Remaining delta is expected unpicked upstream work plus items explicitly deferred. + +### Recommendation distribution + +- **Cherry-pick with review:** 254 +- **Already applied (sync 2026-06-17):** 19 +- **Skip or Defer:** 17 +- **Cherry-pick:** 15 +- **Defer:** 10 + +### Risk distribution + +- **Medium:** 247 +- **Low:** 45 +- **High:** 23 + +## Carried-forward deferred items (from sync 2026-06-17) + +| Item | Status | +|------|--------| +| UserReportedPhishing backend + `ThreatSubmission.ReadWrite.All` | Defer — paired import | +| Autopilot user-select / os-default / locale (`785e71c5`) | Needs product decision | +| CippReportingDB cleanup (`ee0b8229`, `fdf313e5`) | Needs product decision | +| Intune template usage tracking (`57b7de1f` chain) | Defer — feature absent in fork | + +## Commit inventory + +| SHA | Title | Author | Date | Risk | Area | Protected overlap | Recommendation | Dependency notes | Files | +|-----|-------|--------|------|------|------|-------------------|----------------|------------------|-------| +| `5a0ddb29` | Dev to hotfix (#2088) | John Duprey | 2026-06-10 | Medium | General | None | Cherry-pick with review | | | +| `8f2198e7` | chore: bump version to 10.5.2 | John Duprey | 2026-06-10 | High | General, Permissions/build | Build/host config | Skip or Defer — protected-area overlap | | host.json, version_latest.txt | +| `e9bc5ad5` | fix: add early template filter when supplied | John Duprey | 2026-06-10 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1 | +| `abcbb60a` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | John Duprey | 2026-06-10 | Medium | General | None | Cherry-pick with review | | | +| `f37d68ad` | Fixes ORCA235 | Zacgoose | 2026-06-11 | Low | Tests | None | Cherry-pick — test-only | | Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA235.ps1 | +| `28ba94b4` | Fixes ORCA242 | Zacgoose | 2026-06-11 | Medium | General, Tests | None | Cherry-pick — test-only | | Config/CIPPDBCacheTypes.json, Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoProtectionAlert.ps1 (+1) | +| `2851db0f` | Fixes ORCA233_1 | Zacgoose | 2026-06-11 | Medium | General, Tests | None | Cherry-pick — test-only | | Config/CIPPDBCacheTypes.json, Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoInboundConnector.ps1 (+1) | +| `cbcc61b5` | Fixes ORCA103 | Zacgoose | 2026-06-11 | Low | Tests | None | Already applied (sync 2026-06-17) | | Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA103.ps1 | +| `a556b98b` | Fixes ORCA113 | Zacgoose | 2026-06-11 | Low | Tests | None | Cherry-pick — test-only | | Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA113.ps1 | +| `db3de75a` | Fixes ORCA244 | Zacgoose | 2026-06-11 | Low | Tests | None | Cherry-pick — test-only | | Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA244.ps1 | +| `0640f07c` | Fixes ORCA179 | Zacgoose | 2026-06-11 | Low | Tests | None | Cherry-pick — test-only | | Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA179.ps1 | +| `238001c1` | Update policy based on MS and Orca guidance | Zacgoose | 2026-06-11 | Low | Standards deploy, Tests | None | Cherry-pick — test-only | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1, Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA102.ps1 | +| `2ab0e0e2` | fix: rerun issue | John Duprey | 2026-06-10 | Medium | General | None | Already applied (sync 2026-06-17) | | Modules/CIPPCore/Public/Test-CIPPRerun.ps1 | +| `8cd8d1d9` | Fix for ORCA107 and add Exchange Global Quarantine policy to cache | Zacgoose | 2026-06-10 | High | General, Tests | Quarantine | Skip or Defer — protected-area overlap | | Config/CIPPDBCacheTypes.json, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoQuarantinePolicy.ps1, Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA107.ps1 | +| `cc84a49d` | Fix ORCA104 | Zacgoose | 2026-06-10 | Low | Tests | None | Cherry-pick — test-only | | Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA104.ps1 | +| `9f0bacd6` | manual pagination support for Invoke-ListMailQuarantine | Zacgoose | 2026-06-10 | High | General | Quarantine | Skip or Defer — protected-area overlap | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1 | +| `83b13034` | bulk request next link following | Zacgoose | 2026-06-10 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/GraphHelper/New-ExoBulkRequest.ps1 | +| `b8fefcfd` | Update Invoke-ExecMcp.ps1 | Zacgoose | 2026-06-10 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1 | +| `e8d13427` | audit log detailed logging for debugging | Zacgoose | 2026-06-10 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/AuditLogs/New-CippAuditLogSearch.ps1, Modules/CIPPCore/Public/GraphHelper/New-GraphPOSTRequest.ps1 | +| `a0a79852` | Update Invoke-ListTenantAlignment.ps1 | Zacgoose | 2026-06-10 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListTenantAlignment.ps1 | +| `9dd0e567` | Update Invoke-ListTenantAlignment.ps1 | Zacgoose | 2026-06-10 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListTenantAlignment.ps1 | +| `64836c02` | fix: rerun detection on scheduled tasks | John Duprey | 2026-06-09 | Medium | General | None | Already applied (sync 2026-06-17) | | Modules/CIPPCore/Public/Test-CIPPRerun.ps1 | +| `14346161` | Dev to hotfix (#2085) | John Duprey | 2026-06-09 | Medium | General | None | Cherry-pick with review | | | +| `39e1a34e` | chore: bump version to 10.5.1 | John Duprey | 2026-06-09 | High | General, Permissions/build | Build/host config | Skip or Defer — protected-area overlap | | host.json, version_latest.txt | +| `6c897f52` | fixes group addition in user page and vacation mode | Zacgoose | 2026-06-09 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Add-CIPPGroupMember.ps1, Modules/CIPPCore/Public/New-CIPPUserTask.ps1 | +| `2511c6e5` | add limits for tools copilot studio | KelvinTegelaar | 2026-06-09 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/MCP/Get-CippMcpToolList.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1 | +| `8f1069cf` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | John Duprey | 2026-06-09 | Medium | General | None | Cherry-pick with review | | | +| `280b3b9d` | fix: add CippExtensions to allowlist | John Duprey | 2026-06-09 | Medium | General | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1, Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1, profile.ps1 | +| `b79c296f` | sherweb migration fixes | KelvinTegelaar | 2026-06-09 | Medium | General | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1, Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1, Modules/CippExtensions/Public/Extension Functions/Register-CippExtensionScheduledTasks.ps1 (+2) | +| `2925643d` | push endpoint over to export job endpoint | Zacgoose | 2026-06-09 | Medium | General | None | Cherry-pick with review | | Config/CIPPTimers.json, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-IntuneReportExportSubmit.ps1, Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-IntuneReportExportOrchestrator.ps1 (+1) | +| `c215631c` | Fix: Message trace role and variable casing in message trace function (#2083) | KelvinTegelaar | 2026-06-09 | Medium | General | None | Cherry-pick with review | | | +| `2138ec6d` | Fix: Improve conversion for EnableAutoTrim setting (#2084) | KelvinTegelaar | 2026-06-09 | Medium | General | None | Cherry-pick with review | | | +| `3f9aab05` | api version file fixes | Zacgoose | 2026-06-09 | Medium | General | None | Cherry-pick with review | | Config/version_latest.txt, Modules/CIPPCore/Public/Authentication/Get-CippAllowedPermissions.ps1, Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPStatsTimer.ps1 | +| `3e33fdb1` | fix: more robust conversion for EnableAutoTrim setting | Bobby | 2026-06-08 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1 | +| `c0f663ca` | fix: update role and fix variable casing in message trace function | Bobby | 2026-06-08 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListMessageTrace.ps1 | +| `fc76e111` | sso app repair and fix migration failures | Zacgoose | 2026-06-09 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Authentication/Add-CIPPSSOAppSecret.ps1, Modules/CIPPCore/Public/Authentication/New-CIPPSSOApp.ps1, Modules/CIPPCore/Public/Authentication/Set-CIPPSSOStoredCredentials.ps1 (+1) | +| `b36a32b0` | shuffle file locations | Zacgoose | 2026-06-09 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/MCP/Get-CippMcpSpec.ps1, Modules/CIPPCore/Public/MCP/Get-CippMcpToolList.ps1, Modules/CIPPCore/Public/MCP/Get-CippMcpToolResult.ps1 (+1) | +| `4f8bc79c` | Dev to release (#2081) | KelvinTegelaar | 2026-06-08 | Medium | General | None | Cherry-pick with review | | | +| `a52f002d` | 10.5.0 version up | KelvinTegelaar | 2026-06-08 | Medium | General | None | Cherry-pick with review — single file | | version_latest.txt | +| `e4455d3f` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-06-08 | Medium | General | None | Cherry-pick with review | | | +| `bfb0c17a` | tools update | KelvinTegelaar | 2026-06-08 | Medium | General | None | Cherry-pick with review | | Tools/Configuration/1.6.0/Configuration.psd1, Tools/Configuration/1.6.0/Configuration.psm1, Tools/Configuration/1.6.0/PSGetModuleInfo.xml (+7) | +| `34112ffd` | temporary 1 day to clear old ips | KelvinTegelaar | 2026-06-08 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Get-CIPPGeoIPLocation.ps1 | +| `64f30df6` | Update Start-DurableCleanup.ps1 | Zacgoose | 2026-06-08 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-DurableCleanup.ps1 | +| `2a63cfc7` | Update Get-CIPPAlertQuotaUsed.ps1 | Zacgoose | 2026-06-08 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuotaUsed.ps1 | +| `ddc264a7` | Update Invoke-CippTestGenericTest002.ps1 | Zacgoose | 2026-06-08 | Low | Tests | None | Already applied (sync 2026-06-17) | | Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest002.ps1 | +| `d3d98923` | cache middleware changes | Zacgoose | 2026-06-07 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1, Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPDBTestsRun.ps1, Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-UserTasksOrchestrator.ps1 (+3) | +| `336909e8` | extra module dep | Zacgoose | 2026-06-07 | Medium | General | None | Cherry-pick with review | | Tools/Build-DevApiModules.ps1, Tools/Metadata/1.5.7/Metadata.psd1, Tools/Metadata/1.5.7/Metadata.psm1 (+1) | +| `431d2929` | extra module dep | Zacgoose | 2026-06-07 | Medium | General | None | Cherry-pick with review | | Tools/Build-DevApiModules.ps1, Tools/Configuration/1.6.0/Configuration.psd1, Tools/Configuration/1.6.0/Configuration.psm1 (+1) | +| `65ba7a78` | embed module into pipeline actions | Zacgoose | 2026-06-07 | Medium | General | None | Cherry-pick with review | | Tools/Build-DevApiModules.ps1, Tools/ModuleBuilder/3.1.8/ModuleBuilder.psd1, Tools/ModuleBuilder/3.1.8/ModuleBuilder.psm1 (+2) | +| `5df315b6` | improved open api spec for ai | KelvinTegelaar | 2026-06-06 | Medium | General | None | Cherry-pick with review — single file | | openapi.json | +| `da10bf92` | renumber for cis7 | KelvinTegelaar | 2026-06-06 | Low | Tests | None | Cherry-pick — test-only | | Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.md, Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1, Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_2.md (+296) | +| `d817b6d2` | fix: cis test 1_3_5 | John Duprey | 2026-06-05 | Medium | General, Tests | None | Cherry-pick — test-only | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSettings.ps1, Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_3_5.ps1 | +| `ee1884f7` | add permissions for new settings endpoint | John Duprey | 2026-06-05 | High | Permissions/build | SAM/permissions manifest | Defer — SAM permission chain review required | | Config/SAMManifest.json | +| `503eac5b` | fix: apps and services test | John Duprey | 2026-06-05 | Medium | General, Tests | None | Already applied (sync 2026-06-17) | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSettings.ps1, Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_3_4.ps1 | +| `961462f3` | fix: role assignment checks | John Duprey | 2026-06-05 | Low | Tests | None | Already applied (sync 2026-06-17) | | Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1, Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_2.ps1, Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_3.ps1 (+2) | +| `f0f361d4` | restart helper | Zacgoose | 2026-06-05 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1, Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-ContainerUpdateCheck.ps1, Modules/CIPPCore/Public/Functions/Request-CIPPRestart.ps1 (+2) | +| `612ba54c` | Update Get-CIPPTenantAlignment.ps1 | Zacgoose | 2026-06-05 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1 | +| `c040658a` | Update FeatureFlags.json | Zacgoose | 2026-06-05 | Medium | General | None | Cherry-pick with review — single file | | Config/FeatureFlags.json | +| `ed47810f` | Update Test-CIPPAccess.ps1 | Zacgoose | 2026-06-05 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1 | +| `f7f51cc1` | remove duplicate non gated cache collection items | Zacgoose | 2026-06-05 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1 | +| `2b093c37` | fixes issue with CA compare and a weird blank line | KelvinTegelaar | 2026-06-05 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1 | +| `9cab0663` | CA expansion for tags | KelvinTegelaar | 2026-06-05 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1, Modules/CIPPCore/Public/Get-CIPPDrift.ps1 | +| `4435ea38` | CA expansion for tags | KelvinTegelaar | 2026-06-05 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1, Modules/CIPPCore/Public/Get-CIPPDrift.ps1, Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1 (+1) | +| `2b3a1c81` | Fix for manually run standards being excluded from applied standards report page | Zacgoose | 2026-06-05 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListStandardsCompare.ps1 | +| `3fa0ee6c` | Pipe character escaping in names | Zacgoose | 2026-06-05 | Medium | General, Tests | None | Cherry-pick — test-only | | Modules/CIPPCore/Public/Tools/Push-ExecGenerateReportBuilderReport.ps1, Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest004.ps1, Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest005.ps1 (+1) | +| `90e45ead` | pass timing to stop queue rerun protection drift | Zacgoose | 2026-06-05 | Medium | General | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandard.ps1, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandardsList.ps1 | +| `2bbcfcc8` | This endpoint is silly, we are going to manually try paging | Zacgoose | 2026-06-05 | High | General | Quarantine | Skip or Defer — protected-area overlap | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ListMailQuarantineAllTenants.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1 | +| `d4ddd3d6` | fix: additional protections for choco app deployment | John Duprey | 2026-06-04 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/New-CIPPIntuneAppDeployment.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddChocoApp.ps1 | +| `c5849381` | fix: fallback to app version if one is not specified | John Duprey | 2026-06-04 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Assert-CippVersion.ps1 | +| `c5d15588` | fix: version check | John Duprey | 2026-06-04 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Assert-CippVersion.ps1 | +| `65659c21` | fix: remove headers parameter from scheduler details/list | John Duprey | 2026-06-04 | Medium | General | None | Cherry-pick with review | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItemDetails.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItems.ps1 | +| `7902097a` | add missing return | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecUpdateRefreshToken.ps1 | +| `3ca58875` | updated descriptions. | KelvinTegelaar | 2026-06-04 | High | General | Quarantine | Skip or Defer — protected-area overlap | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListAdminPortalLicenses.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListApiTest.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListCustomDataMappings.ps1 (+157) | +| `4909e9c2` | dbcache desc | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListDBCache.ps1 | +| `6a1c3733` | fixes issue with all tenants retrieval | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListDBCache.ps1 | +| `c7cebfeb` | better descriptions | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListCalendarPermissions.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListHVEAccounts.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListOAuthApps.ps1 | +| `53db433c` | better descriptions | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListCalendarPermissions.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListHVEAccounts.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxRules.ps1 (+18) | +| `ae921278` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review | | | +| `2b3a7bb5` | resolves #6096 | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditUser.ps1 | +| `a8e7aa5e` | Feat: Add Email as alternate login ID standard (#2075) | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review | | | +| `593911e1` | Feat: Add Invoke-ExecSetCASMailbox function for CAS settings management (#2076) | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review | | | +| `9a176cc7` | feat: Add Group-Based Licensing support (#2063) | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review | | | +| `adba8fa7` | add excludeFromAlert to licenses. | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review | | Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertExpiringLicenses.ps1, Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertOverusedLicenses.ps1, Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUnusedLicenses.ps1 (+5) | +| `4288bd80` | exclude partner tenant | Zacgoose | 2026-06-04 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/TenantGroups/Get-TenantGroups.ps1, Modules/CIPPCore/Public/TenantGroups/Update-CIPPDynamicTenantGroups.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCreateDefaultGroups.ps1 (+1) | +| `bc6aee43` | fix: quarantine deny action | John Duprey | 2026-06-03 | High | General | Quarantine | Skip or Defer — protected-area overlap | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecQuarantineManagement.ps1 | +| `77073ba3` | role change | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1 | +| `7800b3cb` | Fix | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1 | +| `72c277d7` | Allow MCP client | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1 | +| `23506364` | add tot non-ng | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1 | +| `49e8af8b` | feat: add Invoke-ExecSetCASMailbox function for CAS settings management | Bobby | 2026-06-03 | Medium | General | None | Cherry-pick with review | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetCASMailbox.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListMailboxCAS.ps1 | +| `ec2eb836` | add logging to mcp reation. | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 | +| `0cd6f9d2` | MCP client updates to support client auth | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1, Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 | +| `6fc7d357` | Revert custom well known | KelvinTegelaar | 2026-06-03 | High | General, Permissions/build | Build/host config | Skip or Defer — protected-area overlap | | CIPPHttpTrigger/function.json, CIPPWellKnown/function.json, Modules/CIPPCore/Public/Authentication/Set-CIPPSSOEasyAuth.ps1 (+4) | +| `5c81043c` | change resource usage to craft well known | KelvinTegelaar | 2026-06-03 | High | General, Permissions/build | Build/host config | Skip or Defer — protected-area overlap | | CIPPHttpTrigger/function.json, CIPPWellKnown/function.json, Modules/CIPPCore/Public/Authentication/Set-CIPPSSOEasyAuth.ps1 (+4) | +| `1fc42631` | feat: add Email as alternate login ID standard | Bobby | 2026-06-03 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEmailAsAlternateLoginId.ps1 | +| `a2c2524c` | oauth prm | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 | +| `3e99e667` | add mcp allowed | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Authentication/Get-CippApiClient.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 | +| `a9be2729` | Update Invoke-CIPPStandardEnableExchangeCloudManagement.ps1 | Zacgoose | 2026-06-03 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableExchangeCloudManagement.ps1 | +| `64efbd97` | Apply multiple fixes to the add member to exo groups flow including adding new users with auto retry | Zacgoose | 2026-06-03 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Add-CIPPGroupMember.ps1, Modules/CIPPCore/Public/New-CIPPUserTask.ps1 | +| `2edc7592` | Handle PendingAcceptance guests and update reporting | Zacgoose | 2026-06-03 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableGuests.ps1 | +| `058da5e0` | rework mail contact standard and lazy load modules when needed | Zacgoose | 2026-06-03 | Medium | General, Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployContactTemplates.ps1 | +| `6eeb31b4` | Pluralize standard name and continue on error | Zacgoose | 2026-06-03 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployContactTemplates.ps1 | +| `1167ff5b` | caching bump | Zacgoose | 2026-06-03 | Medium | General | None | Cherry-pick with review | | Shared/CIPPSharp/CIPPTestDataCache.cs, Shared/CIPPSharp/bin/CIPPSharp.dll | +| `55ddb18b` | Update Invoke-ExecTestRun.ps1 | Zacgoose | 2026-06-03 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecTestRun.ps1 | +| `3f842abc` | fix: explicitly remove tenant from the table instead of using -cleanold | John Duprey | 2026-06-02 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Invoke-ExecOffboardTenant.ps1 | +| `3f9dbd9f` | new licence report endpoint and revert old endpoint | Zacgoose | 2026-06-02 | Medium | General | None | Cherry-pick with review | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListLicenses.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicensesReport.ps1 | +| `28752144` | unique | KelvinTegelaar | 2026-06-02 | Medium | General | None | Cherry-pick with review — single file | | Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneTenantSync.ps1 | +| `2492ad4f` | customsubject fix | KelvinTegelaar | 2026-06-02 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Webhooks/Invoke-CIPPWebhookProcessing.ps1 | +| `5a3b4259` | fix: Update endpoint roles to use Autopilot.Read (#2068) | KelvinTegelaar | 2026-06-02 | Medium | General | None | Defer — Autopilot language/locale (product decision) | | | +| `0c54cd16` | fix: move New-CIPPCoreRequest back to CIPPCore | John Duprey | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1 | +| `55a97db2` | added logging | KelvinTegelaar | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Invoke-ExecOffboardTenant.ps1 | +| `0c5d2bb8` | Fix TenantAllowBlockListTemplate always reporting non-compliant (#2069) | KelvinTegelaar | 2026-06-01 | Medium | General | None | Cherry-pick with review | | | +| `256e9fc4` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | John Duprey | 2026-06-01 | Medium | General | None | Cherry-pick with review | | | +| `235bd855` | fix: validate and sanitize msp/choco app params | John Duprey | 2026-06-01 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/ConvertTo-CIPPSafePwshArg.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddChocoApp.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddMSPApp.ps1 | +| `468fb307` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-06-01 | Medium | General | None | Cherry-pick with review | | | +| `ac338417` | add featureflag for mcp | KelvinTegelaar | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Config/FeatureFlags.json | +| `a9797cd9` | chore: cleanup redundant tenant check in listexorequest | John Duprey | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListExoRequest.ps1 | +| `139b0c60` | fix: sanitize more odata paths for tables | John Duprey | 2026-06-01 | Medium | General | None | Cherry-pick with review | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItemDetails.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecWebhookSubscriptions.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxRules.ps1 (+2) | +| `679c3905` | fix: validate token exchange url is microsoft | John Duprey | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecTokenExchange.ps1 | +| `648127f7` | fix: role for EditIntunePolicy | John Duprey | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-EditIntunePolicy.ps1 | +| `3c19e629` | fix: ip restriction logic | John Duprey | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1 | +| `a40683c5` | fix: access issues related to undefined roles | John Duprey | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1 | +| `9d8f1a0d` | correct incorrect pathing | Zacgoose | 2026-06-02 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Add-CIPPW32ScriptApplication.ps1 | +| `f3393cb9` | Update Invoke-ExecUniversalSearchV2.ps1 | Zacgoose | 2026-06-02 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecUniversalSearchV2.ps1 | +| `4b4a2d1d` | Update Set-CIPPDBCacheSharePointSiteUsage.ps1 | Zacgoose | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointSiteUsage.ps1 | +| `c16557ff` | Guarding for cache collection items | Zacgoose | 2026-06-01 | Medium | General | None | Cherry-pick with review | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheOneDriveUsage.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointSiteUsage.ps1 | +| `54a3a082` | api auth save and get changes | Zacgoose | 2026-06-01 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Authentication/Get-CippApiAuth.ps1, Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1 | +| `fad627f8` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-06-01 | Medium | General | None | Cherry-pick with review | | | +| `72f7882f` | fixes another add member | KelvinTegelaar | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1 | +| `acf4bf33` | Add or update the Azure App Service build and deployment workflow config | KelvinTegelaar | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | .github/workflows/dev_cippjta72.yml | +| `2a2851b5` | sso auth | KelvinTegelaar | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Set-CIPPSSOEasyAuth.ps1 | +| `26a87b27` | add-member force | KelvinTegelaar | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1 | +| `8341f49d` | Test | KelvinTegelaar | 2026-05-31 | Medium | General | None | Cherry-pick with review | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Get-CippMcpSpec.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Get-CippMcpToolList.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Get-CippMcpToolResult.ps1 (+1) | +| `44780652` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-05-31 | Medium | General | None | Cherry-pick with review | | | +| `7b341600` | update openapi spec with generated one | KelvinTegelaar | 2026-05-31 | Medium | General | None | Cherry-pick with review — single file | | openapi.json | +| `999f0283` | Fix TenantAllowBlockListTemplate always reporting non-compliant | Chris Dewey | 2026-05-31 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantAllowBlockListTemplate.ps1 | +| `518855cc` | test optimisation | Zacgoose | 2026-05-30 | Low | Tests | None | Cherry-pick — test-only | | Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_2.ps1, Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_5.ps1, Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_9.ps1 (+30) | +| `dd8952e4` | reduce memory | Zacgoose | 2026-05-30 | Medium | General | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-SchedulerCIPPNotifications.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListLogs.ps1 | +| `11e613aa` | cleanup | Zacgoose | 2026-05-30 | Medium | General, Tests | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/CIPPDBCache/Push-ExecCIPPDBCache.ps1, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTest.ps1, Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1 | +| `7caadb22` | fixes | Zacgoose | 2026-05-30 | Medium | General | None | Cherry-pick with review | | Shared/CIPPSharp/CIPPSharp.csproj, Shared/CIPPSharp/bin/CIPPSharp.dll | +| `f5f37368` | Optimize CIPP DB orchestration | Zacgoose | 2026-05-30 | Medium | General, Tests | None | Cherry-pick — test-only | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/CIPPDBCache/Push-ExecCIPPDBCache.ps1, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTest.ps1, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsList.ps1 (+204) | +| `2ed3f94c` | chore: remove write host | John Duprey | 2026-05-29 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecTokenExchange.ps1 | +| `da7bd8c4` | chore: add devsecrets to restricted tables | John Duprey | 2026-05-29 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRestoreBackup.ps1 | +| `c69e2ce1` | fix: allow for command without .value | John Duprey | 2026-05-29 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1 | +| `c18bda87` | fix: optimize checks | John Duprey | 2026-05-29 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1 | +| `38e3ae9e` | chore: block arbitrary cmdlets not in CIPP modules | John Duprey | 2026-05-29 | Medium | General | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1, Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1, Modules/CIPPCore/Public/Tools/Get-CIPPSchedulerBlockedCommands.ps1 | +| `e98445f2` | chore: sanitize cippid in public webhooks | John Duprey | 2026-05-29 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-PublicWebhooks.ps1 | +| `0fd3315b` | chore: disable cippcommand action | John Duprey | 2026-05-29 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Webhooks/Invoke-CIPPWebhookProcessing.ps1 | +| `a17137cb` | chore: remove cipp processor queue | John Duprey | 2026-05-29 | Medium | General | None | Cherry-pick with review | | Config/CIPPTimers.json, Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPProcessorQueue.ps1 | +| `e3d57cf0` | Update Invoke-CIPPStandardDeployCheckChromeExtension.ps1 | Zacgoose | 2026-05-29 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1 | +| `e0f45f20` | Backup excluded tenants config | Zacgoose | 2026-05-29 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/New-CIPPBackup.ps1 | +| `3f03634f` | Update Initialize-CIPPAuth.ps1 | Zacgoose | 2026-05-29 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1 | +| `1ac506d7` | fix: update endpoint roles to use Autopilot.Read | Bobby | 2026-05-28 | Medium | General | None | Defer — Autopilot language/locale (product decision) | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAndroidEnrollmentProfiles.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppleEnrollmentProfiles.ps1 | +| `1f9fb1fd` | test invocation optimisations | Zacgoose | 2026-05-28 | Medium | General, Tests | None | Cherry-pick with review | | Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListWorkerHealth.ps1, Shared/CIPPSharp/CIPPTestDataCache.cs (+1) | +| `55fea61a` | Feat: Add online archive report functionality for mailboxes (#2067) | KelvinTegelaar | 2026-05-28 | Medium | General | None | Cherry-pick with review | | | +| `a1179a21` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-05-28 | Medium | General | None | Cherry-pick with review | | | +| `fc080e4a` | new auth methods single standard | KelvinTegelaar | 2026-05-28 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthenticationMethods.ps1 | +| `0cdc2e81` | new auth methods single standard | KelvinTegelaar | 2026-05-28 | Medium | General, Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPCore/Public/Set-CIPPAuthenticationPolicy.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthenticationMethods.ps1 | +| `99dd88c5` | optimisation | Zacgoose | 2026-05-28 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BPA/Push-BPACollectData.ps1, Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderMalware.ps1, Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderStatus.ps1 (+5) | +| `25e2b0f2` | tweaks | Zacgoose | 2026-05-28 | Medium | General | None | Cherry-pick with review | | Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAdminPassword.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListWorkerHealth.ps1 | +| `25fcdc1c` | add 404 detection for non-existing roles | KelvinTegelaar | 2026-05-28 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Set-CIPPSAMAdminRoles.ps1 | +| `aefa69b0` | add compliance admin by default | KelvinTegelaar | 2026-05-28 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/GraphHelper/Get-NormalizedError.ps1, Modules/CIPPCore/Public/Set-CIPPSAMAdminRoles.ps1 | +| `5b7c5a96` | Update Invoke-ListWorkerHealth.ps1 | Zacgoose | 2026-05-28 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListWorkerHealth.ps1 | +| `e41d5322` | Update Add-CIPPDbItem.ps1 | Zacgoose | 2026-05-28 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Add-CIPPDbItem.ps1 | +| `0ebb1880` | implement autopatch | KelvinTegelaar | 2026-05-27 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopatchGroup.ps1 | +| `829ced81` | feat(mailboxes): cache mailbox and archive usage metrics | Bobby | 2026-05-27 | Medium | General | None | Cherry-pick with review | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheMailboxes.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxes.ps1 | +| `e563aea9` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-05-27 | Medium | General | None | Cherry-pick with review | | | +| `bdd86024` | Add version cleanup | KelvinTegelaar | 2026-05-27 | Medium | General, Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSPOVersionCleanup.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1 | +| `8a536fe8` | Fix: Update terminology from "Temporary Access Password" to "Temporary Access Pass" (#2066) | KelvinTegelaar | 2026-05-27 | Medium | General | None | Cherry-pick with review | | | +| `b7c72180` | fix: update terminology from "Temporary Access Password" to "Temporary Access Pass" | Bobby | 2026-05-27 | Medium | General, Standards config | None | Cherry-pick with review | | Config/standards.json, Modules/CIPPCore/Public/New-CIPPTAP.ps1 | +| `b7d4f5e2` | Sharepoint management functionality. | KelvinTegelaar | 2026-05-27 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1 | +| `f85963b7` | Sharepoint management functionality. | KelvinTegelaar | 2026-05-27 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPCore/Public/Get-CIPPSPOSite.ps1, Modules/CIPPCore/Public/Set-CIPPSPOSite.ps1, Modules/CIPPCore/Public/Set-CIPPSPOTenant.ps1 (+2) | +| `c5a8a207` | smart lockout standard | KelvinTegelaar | 2026-05-27 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSmartLockout.ps1 | +| `c5b0e592` | smart lockout standard | KelvinTegelaar | 2026-05-27 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSmartLockout.ps1 | +| `49153019` | use top 500 to minimise requests | Zacgoose | 2026-05-27 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewRiskyUsers.ps1 | +| `7d3b480e` | Update Invoke-CIPPStandardDefenderCompliancePolicy.ps1 | Zacgoose | 2026-05-27 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderCompliancePolicy.ps1 | +| `122aec8f` | fix for template id casing | Zacgoose | 2026-05-27 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecStandardsRun.ps1 | +| `a6fdfe23` | Make all tenants list for SPO sites fast | Zacgoose | 2026-05-27 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Get-CIPPSharePointSiteUsageReport.ps1 | +| `95d48d1f` | Fix for desktop activations copilot ready test | Zacgoose | 2026-05-27 | Low | Tests | None | Already applied (sync 2026-06-17) | | Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady003.ps1 | +| `5561a5b1` | Fix: tenant groups cache issue (#2065) | KelvinTegelaar | 2026-05-27 | Medium | General | None | Cherry-pick with review | | | +| `22902b0b` | api fixes | Zacgoose | 2026-05-27 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Authentication/New-CIPPAPIConfig.ps1, Modules/CIPPCore/Public/Authentication/Repair-CippApiIdentifierUri.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 | +| `49d629e5` | Update Get-CippApiAuth.ps1 | Zacgoose | 2026-05-27 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Get-CippApiAuth.ps1 | +| `359633a4` | fix: ensure tenant groups skips cache so they dont alternate anymore when refreshed | Bobby | 2026-05-26 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListTenantDetails.ps1 | +| `97dc672c` | user sync | Zacgoose | 2026-05-26 | Medium | General | None | Cherry-pick with review | | Config/CIPPTimers.json, Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-UserSyncTimer.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCIPPUsers.ps1 (+1) | +| `e6b800b1` | remove rerun from alert | Zacgoose | 2026-05-26 | High | General | Quarantine | Skip or Defer — protected-area overlap | | Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuarantineReleaseRequests.ps1 | +| `59a0e15d` | update application content type handling | Zacgoose | 2026-05-26 | Medium | General | None | Cherry-pick with review | | Shared/CIPPSharp/CIPPRestClient.cs, Shared/CIPPSharp/bin/CIPPSharp.dll | +| `1e63ebf0` | Update Invoke-CIPPStandardsharingDomainRestriction.ps1 | Zacgoose | 2026-05-26 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1 | +| `71afcdd2` | ExoTransportConfig cache type - fix for missing data used in test suites | Zacgoose | 2026-05-26 | Medium | General, Standards deploy, Tests | None | Cherry-pick — test-only | | Config/CIPPDBCacheTypes.json, Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoTransportConfig.ps1 (+3) | +| `443e16a3` | feat: ability to add/remove nested groups in group memberships (#2056) | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review | | | +| `a7b7d4da` | feat: Add Apple ADE and Android enrollment profile endpoints (#2053) | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review | | | +| `4214bc7d` | Fix: Fix missing OData path error in JSON response (#2054) | KelvinTegelaar | 2026-05-25 | Medium | General | None | Already applied (sync 2026-06-17) | | | +| `a7e30d7a` | feat: Add DLP via DCS standard (#2062) | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review | | | +| `05ce60f3` | Feat: Add function to remove users from admin roles (#2064) | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review | | | +| `46015ce7` | Add APv2 profile | KelvinTegelaar | 2026-05-25 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDevicePrepProfile.ps1 | +| `cb31997c` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review | | | +| `d854e22d` | feat: add function to remove users from admin roles | Bobby | 2026-05-25 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecRemoveAdminRole.ps1 | +| `08b972cc` | timezone changes | Zacgoose | 2026-05-25 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Authentication/Initialize-CIPPTimezone.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTimeSettings.ps1 | +| `a0dab59a` | domain fixes | Zacgoose | 2026-05-25 | Medium | General | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserTenant.ps1, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-GetTenantDomains.ps1 | +| `f09ce56a` | Update New-TeamsRequest.ps1 | Zacgoose | 2026-05-25 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/GraphHelper/New-TeamsRequest.ps1 | +| `03abdad4` | add global var showing | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCippReplacemap.ps1 | +| `33512c39` | FIDO2 profile standards | KelvinTegelaar | 2026-05-25 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFIDO2PasskeyProfiles.ps1 | +| `c81b6a5c` | add filtering | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review | | Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppCertificateExpiry.ps1, Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppSecretExpiry.ps1 | +| `08ab039c` | add filtering | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review | | Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppCertificateExpiry.ps1, Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppSecretExpiry.ps1 | +| `df847779` | implement standards template deployment for intune apps | KelvinTegelaar | 2026-05-24 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Applications/Push-UploadApplication.ps1, Modules/CIPPCore/Public/New-CIPPIntuneAppDeployment.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneAppTemplateDeploy.ps1 | +| `fa5f4de6` | remove sso setup from featureflag | John Duprey | 2026-05-24 | Medium | General | None | Cherry-pick with review — single file | | Config/FeatureFlags.json | +| `9bb2f6bc` | Update Build-DevApiModules.ps1 | Zacgoose | 2026-05-24 | Medium | General | None | Cherry-pick with review — single file | | Tools/Build-DevApiModules.ps1 | +| `dcf382aa` | Update Build-DevApiModules.ps1 | Zacgoose | 2026-05-24 | Medium | General | None | Cherry-pick with review — single file | | Tools/Build-DevApiModules.ps1 | +| `4ab85c75` | CIPP Hosted Notices | Zacgoose | 2026-05-24 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1 | +| `77a4be64` | fixes #6027 | KelvinTegelaar | 2026-05-23 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTenantGroup.ps1 | +| `7fbb8edf` | Feat: Split Intune device join and registration standards (#2057) | KelvinTegelaar | 2026-05-23 | Medium | General | None | Cherry-pick with review | | | +| `bb2ebc6a` | fix: Add missing options for Windows Hello standard (#2061) | KelvinTegelaar | 2026-05-23 | Medium | General | None | Cherry-pick with review | | | +| `a89c2b93` | Add Group-Based Licensing support | Luis Mengel | 2026-05-23 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/New-CIPPGroup.ps1, Modules/CIPPCore/Public/Remove-CIPPGroup.ps1, Modules/CIPPCore/Public/Set-CIPPGroupLicense.ps1 (+3) | +| `cfa144d6` | Update Invoke-ListWorkerHealth.ps1 | Zacgoose | 2026-05-22 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListWorkerHealth.ps1 | +| `1e02bfcb` | feat(standards): add DLP via DCS standard | Bobby | 2026-05-20 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpViaDcsEnabled.ps1 | +| `9fce7e77` | feat: add in missing options for Windows Hello standard | Bobby | 2026-05-20 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration.ps1 | +| `73f83719` | add logging to geoip lookip | Zacgoose | 2026-05-19 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Get-CIPPGeoIPLocation.ps1 | +| `9ba48711` | correct incorrect default value | Zacgoose | 2026-05-19 | Low | Standards config, Standards deploy | None | Already applied (sync 2026-06-17) | | Config/standards.json, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneComplianceSettings.ps1 | +| `e3e82cd9` | Cache Security Defaults | Zacgoose | 2026-05-19 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPCore/Public/New-CIPPCAPolicy.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheConditionalAccessPolicies.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1 | +| `6b8ebd48` | refactor calls to use new onepass method to store DB data | Zacgoose | 2026-05-19 | High | General | Quarantine | Skip or Defer — protected-area overlap | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheAdminConsentRequestPolicy.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheAppRoleAssignments.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheApps.ps1 (+83) | +| `1b1ee689` | cache PowerShell enabled status and use cached data for standard | Zacgoose | 2026-05-19 | Medium | General, Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheMailboxes.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableExchangeOnlinePowerShell.ps1 | +| `ab5e5155` | Switch to app auth for authentication changes standard | Zacgoose | 2026-05-18 | Medium | General, Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPCore/Public/Set-CIPPAuthenticationPolicy.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1 | +| `d7cda8a3` | Update Initialize-CIPPAuth.ps1 | Zacgoose | 2026-05-18 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1 | +| `ab83a2bb` | Update Update-CIPPSAMRedirectUri.ps1 | Zacgoose | 2026-05-18 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Update-CIPPSAMRedirectUri.ps1 | +| `90b6457d` | Add AutoExpandingArchiveScope property showing org-level vs mailbox-level enablement | Zacgoose | 2026-05-18 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserMailboxDetails.ps1 | +| `c67bc8dd` | feat(standards): add intuneRestrictUserDeviceJoin standard | Bobby | 2026-05-15 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceJoin.ps1 | +| `fd6e30f6` | fix(standards): target azureADRegistration in intuneRestrictUserDeviceRegistration | Bobby | 2026-05-15 | Low | Standards deploy | None | Already applied (sync 2026-06-17) | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1 | +| `7ae35c2b` | post exec tweaks for dedupe queue names | Zacgoose | 2026-05-15 | Medium | General, Tests | None | Cherry-pick with review | | Config/FeatureFlags.json, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheApplyBatch.ps1, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsApplyBatch.ps1 (+3) | +| `5289a309` | feat: ability to add/remove nested groups in group memberships | Integrated Solutions | 2026-05-15 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListUsersAndGroups.ps1 | +| `5901014f` | Merge pull request #100 from KelvinTegelaar/dev | Integrated Solutions | 2026-05-15 | Medium | General | None | Cherry-pick with review | | | +| `5ccf15a9` | fix: missing odata path error in the returned json | Bobby | 2026-05-14 | Medium | General | None | Already applied (sync 2026-06-17) | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntunePolicy.ps1 | +| `ee0398db` | feat(endpoint): add Apple ADE and Android enrollment profile listing and deletion endpoints | Bobby | 2026-05-14 | Medium | General | None | Cherry-pick with review | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecRemoveEnrollmentProfile.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAndroidEnrollmentProfiles.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppleEnrollmentProfiles.ps1 (+1) | +| `bc7de0c1` | when running a standard manually still process all standards for precedence overrides | Zacgoose | 2026-05-14 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1 | +| `dbd7fcb3` | logging improvements | Zacgoose | 2026-05-14 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListContainerLogs.ps1 | +| `b4a52152` | Fix tenant group scope cache | Zacgoose | 2026-05-14 | Medium | General | None | Cherry-pick with review | | Config/FeatureFlags.json, Modules/CIPPCore/Public/TenantGroups/Get-TenantGroups.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListContainerLogs.ps1 | +| `c097631e` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | Zacgoose | 2026-05-14 | Medium | General | None | Cherry-pick with review | | | +| `f5f7ae70` | fixes duplicate test calls in some cases | Zacgoose | 2026-05-14 | Medium | General, Tests | None | Already applied (sync 2026-06-17) | | Modules/CIPPCore/Public/Add-CIPPAzDataTableEntity.ps1, Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1 | +| `e060fa22` | implements #5981 | KelvinTegelaar | 2026-05-13 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/New-CIPPCAPolicy.ps1, Modules/CIPPCore/Public/New-CIPPCATemplate.ps1 | +| `b1363008` | #5997 | KelvinTegelaar | 2026-05-13 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1 | +| `897dfaa4` | fixed #5997 | KelvinTegelaar | 2026-05-13 | Low | Standards deploy | None | Already applied (sync 2026-06-17) | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1 | +| `9011dd63` | Nice CA policy editor and template creator/editor | Zacgoose | 2026-05-13 | Medium | General | None | Cherry-pick with review | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecCreateCATemplate.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecEditCAPolicyFull.ps1 | +| `d480cf74` | Add Apps and SP to universal search | Zacgoose | 2026-05-13 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Search-CIPPDbData.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecUniversalSearchV2.ps1 | +| `2d33e020` | strip return characters | Zacgoose | 2026-05-13 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/New-CIPPAlertTemplate.ps1 | +| `93c80812` | skip replacement if not value set for variable | Zacgoose | 2026-05-13 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Get-CIPPTextReplacement.ps1 | +| `3adade45` | Featureflag configs and timer changes | Zacgoose | 2026-05-13 | Medium | General | None | Cherry-pick with review | | Config/CIPPTimers.json, Config/FeatureFlags.json, Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-ContainerUpdateCheck.ps1 (+2) | +| `2dbc4803` | auth configs | Zacgoose | 2026-05-13 | Medium | General | None | Cherry-pick with review | | Config/FeatureFlags.json, Modules/CIPPCore/Public/Authentication/Get-CippApiAuth.ps1, Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1 (+12) | +| `2c5d0c9a` | feat: Add license capability presets (#2040) | KelvinTegelaar | 2026-05-12 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1 | +| `6a81a086` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-05-12 | Medium | General | None | Cherry-pick with review | | | +| `785e71c5` | fix user select | KelvinTegelaar | 2026-05-12 | Medium | General | None | Defer — Autopilot language/locale (product decision) | | Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1 | +| `78193020` | fix name | John Duprey | 2026-05-12 | Medium | General | None | Already applied (sync 2026-06-17) | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-OrchestratorBatchItems.ps1 | +| `5f864e3f` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | Zacgoose | 2026-05-12 | Medium | General | None | Cherry-pick with review | | | +| `35437558` | Update Viva standard | Zacgoose | 2026-05-12 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableViva.ps1 | +| `ddb498fe` | chore: bump version to 10.4.5 | John Duprey | 2026-05-12 | High | General, Permissions/build | Build/host config | Skip or Defer — protected-area overlap | | host.json, version_latest.txt | +| `2869564f` | Add AlertUserReportPhising | KelvinTegelaar | 2026-05-12 | High | General, Permissions/build | SAM/permissions manifest | Defer — paired with frontend + ThreatSubmission SAM/CPV | | Config/SAMManifest.json, Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUserReportedPhishing.ps1 | +| `ad0d096c` | OneDrive Sharing disable | KelvinTegelaar | 2026-05-12 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Invoke-CIPPOffboardingJob.ps1, Modules/CIPPCore/Public/Set-CIPPOneDriveSharing.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECRemediate.ps1 (+1) | +| `23c8994d` | fixes defaultr_hidden vs hidden #5990 | KelvinTegelaar | 2026-05-12 | Low | Standards deploy | None | Already applied (sync 2026-06-17) | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1 | +| `7fd7d097` | fixes sharepoint response stuff | KelvinTegelaar | 2026-05-12 | Medium | General | None | Cherry-pick with review | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointSiteUsage.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSites.ps1 | +| `57b7de1f` | fix: Rename 'usedInTemplates' property to 'usage' for clarity in Invoke-ListIntuneTemplates | John Duprey | 2026-05-12 | Medium | General | None | Defer — Intune template usage tracking | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneTemplates.ps1 | +| `ecbc9a50` | fix: Add error handling for missing standard functions in Push-CIPPStandard | John Duprey | 2026-05-11 | Medium | General | None | Already applied (sync 2026-06-17) | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandard.ps1 | +| `f5702f41` | feat: Enhance Invoke-ListIntuneTemplates to include usage tracking for standards templates | John Duprey | 2026-05-11 | Medium | General | None | Defer — Intune template usage tracking | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneTemplates.ps1 | +| `bc4abb53` | feat: add DefenderForOffice365 preset to license tests | Bobby | 2026-05-11 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPCore/Public/Functions/Test-CIPPStandardLicense.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoPresetSecurityPolicy.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1 (+3) | +| `21526416` | fix: add the presets to the rest of the standards | Bobby | 2026-05-11 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneAppProtectionPolicies.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneApplications.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneAssignmentFilters.ps1 (+8) | +| `5995ad77` | Merge branch 'dev' into testlicense-presets | Kristian Kjærgård | 2026-05-11 | High | Documentation, General, Standards deploy | Quarantine | Skip or Defer — protected-area overlap | | .github/instructions/standards.instructions.md, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1, Modules/CIPPCore/Public/Get-CIPPDrift.ps1 (+120) | +| `12bb4f69` | Fix: Fix cleanup mistake in caching functions (#2048) | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review | | | +| `affac9d0` | Fix/standards run errors (#2037) | KelvinTegelaar | 2026-05-11 | Low | Standards deploy | None | Cherry-pick with review | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1 (+2) | +| `0c633110` | fix: fix my cleanup mistake | Bobby | 2026-05-11 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Get-CIPPSitesReport.ps1, Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSites.ps1 | +| `ddf0a4c6` | feat: Add allTenants support for Teams SharePoint pages (#2022) | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1 | +| `d996babb` | Merge branch 'dev' of https://github.com/kris6673/CIPP-API into alltenants-SP | Bobby | 2026-05-11 | Medium | General | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1, Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1 | +| `75699ff1` | feat: Add fuzzy matching for Intune policies using Levenshtein distance (#1945) | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review | | | +| `b0232eca` | Feat conditional access policy package tags (#1979) | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review | | | +| `fdf313e5` | fix: remove partitionkey | John Duprey | 2026-05-11 | High | Reporting DB cleanup | None | Defer — CippReportingDB cleanup policy (product decision) | | Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1 | +| `59da6e6b` | Merge branch 'dev' into testlicense-presets | Kristian Kjærgård | 2026-05-11 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandardsList.ps1, Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertIntunePolicyConflicts.ps1, Modules/CIPPCore/Public/Get-CIPPDrift.ps1 (+8) | +| `d8be4455` | Merge branch 'dev' into levenshtein-distance | Kristian Kjærgård | 2026-05-11 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1 | +| `dd413bfe` | Add AAD Premium license gate to ExternalMFATrusted standard (#2046) | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review | | | +| `b6c2a436` | Feat: Add support for AllTenants in Intune pages (#2021) | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1 | +| `ee0b8229` | fix: change cleanup to 30 days | John Duprey | 2026-05-11 | High | Reporting DB cleanup | None | Defer — CippReportingDB cleanup policy (product decision) | | Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1 | +| `0c045c72` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | John Duprey | 2026-05-11 | Medium | General | None | Cherry-pick with review | | | +| `1aa55cff` | fix: intune standard change detection queries | John Duprey | 2026-05-11 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandardsList.ps1 | +| `5f3b26e5` | tablecleanup update | KelvinTegelaar | 2026-05-11 | High | Reporting DB cleanup | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1 | +| `2753661e` | implements #5986 | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditTenantAllowBlockListTemplate.ps1 | +| `c29746a1` | eclusions everywhere | KelvinTegelaar | 2026-05-11 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Applications/Push-UploadApplication.ps1, Modules/CIPPCore/Public/Set-CIPPAssignedApplication.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1 (+2) | +| `377b83e6` | HVE user management and cache | Zacgoose | 2026-05-12 | Medium | General | None | Cherry-pick with review | | Config/CIPPDBCacheTypes.json, Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheHVEAccounts.ps1 (+2) | +| `61bac43f` | Greatly speed up listing of intune policies for alltenants | Zacgoose | 2026-05-12 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Add-CIPPDbItem.ps1, Modules/CIPPCore/Public/Get-CIPPIntunePolicyReport.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecRemoveMailboxRule.ps1 | +| `f87f7da9` | implemenets #5948 | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1 | +| `6a96bab8` | Update Invoke-ListLicenses.ps1 | Zacgoose | 2026-05-11 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicenses.ps1 | +| `dad97f7c` | Restore Invoke-AddCustomScript.ps1 | James Tarran | 2026-05-11 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-AddCustomScript.ps1 | +| `dc3f0f45` | Merge branch 'dev' into Feat-Conditional-access-policy-package-tags | James Tarran | 2026-05-11 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-AddCustomScript.ps1 | +| `6aa66c74` | Custom Test - Alert on X statuses | Zacgoose | 2026-05-11 | Medium | General, Tests | None | Already applied (sync 2026-06-17) | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-AddCustomScript.ps1, Modules/CIPPTests/Public/Tests/Custom/Invoke-CippTestCustomScripts.ps1 | +| `be25c764` | Squashed commit of the following: | James Tarran | 2026-05-11 | High | Documentation, General, Permissions/build | Build/host config; Quarantine | Defer — SAM permission chain review required | | .github/instructions/auth-model.instructions.md, .github/instructions/cippdb.instructions.md, .github/workflows/PR_Branch_Check.yml (+900) | +| `61c938aa` | standards use function | KelvinTegelaar | 2026-05-10 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitiveInfoTypeTemplate.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitivityLabelTemplate.ps1 | +| `ec7f5649` | Single deployment from function now that its all rigged up | KelvinTegelaar | 2026-05-10 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPCore/Public/ConvertTo-CIPPComplianceSetParams.ps1, Modules/CIPPCore/Public/Set-CIPPDlpCompliancePolicy.ps1, Modules/CIPPCore/Public/Set-CIPPRetentionCompliancePolicy.ps1 (+9) | +| `96727eb4` | fixes to purview setup | KelvinTegelaar | 2026-05-10 | Medium | General, Standards config, Standards deploy | None | Cherry-pick with review | | Config/standards.json, Modules/CIPPCore/Public/Format-CIPPCompliancePolicyParams.ps1, Modules/CIPPCore/Public/New-CIPPSitRulePackXml.ps1 (+11) | +| `a187a17a` | set warn to true. | KelvinTegelaar | 2026-05-10 | Low | Standards deploy | None | Cherry-pick with review | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpCompliancePolicyTemplate.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionCompliancePolicyTemplate.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitiveInfoTypeTemplate.ps1 (+1) | +| `b7f32e7a` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-05-10 | Medium | General | None | Cherry-pick with review | | | +| `07f29839` | purview adding | KelvinTegelaar | 2026-05-10 | Medium | General, Standards config, Standards deploy | None | Cherry-pick with review | | Config/standards.json, Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-AddDlpCompliancePolicy.ps1 (+10) | +| `9683b790` | Fix standards run errors for Retention and MDO standards | Brian Simpson | 2026-05-03 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoPresetSecurityPolicy.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionPolicyTag.ps1 (+3) | +| `b8b26a27` | Update standards docs URLs to alignment/templates path | Brian Simpson | 2026-05-03 | High | Documentation, General, Standards deploy | Quarantine | Skip or Defer — protected-area overlap | | .github/instructions/standards.instructions.md, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1 (+179) | +| `106f7463` | Add AAD Premium license gate to ExternalMFATrusted standard | Brian Simpson | 2026-05-08 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1 | +| `daa8d242` | Merge pull request #95 from KelvinTegelaar/dev | Integrated Solutions | 2026-05-05 | Medium | General | None | Cherry-pick with review | | | +| `29685d69` | feat(api): add license capability presets | Bobby | 2026-05-04 | High | Documentation, General, Standards deploy | Quarantine | Skip or Defer — protected-area overlap | | .github/agents/CIPP-Alert-Agent.md, .github/agents/CIPP-Standards-Agent.md, .github/instructions/alerts.instructions.md (+135) | +| `7e9f7192` | feat: Add allTenants support for all the Teams SharePoint pages | Bobby | 2026-04-26 | Medium | General | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/CIPPDBCache/Push-ExecCIPPDBCache.ps1, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1, Modules/CIPPCore/Public/Get-CIPPSitesReport.ps1 (+13) | +| `2a2772b4` | feat: add allTenants support for multiple intune pages | Bobby | 2026-04-25 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Get-CIPPAssignmentFilterReport.ps1, Modules/CIPPCore/Public/Get-CIPPIntuneAppProtectionPolicyReport.ps1, Modules/CIPPCore/Public/Get-CIPPIntuneApplicationReport.ps1 (+17) | +| `e210c484` | Merge branch 'dev' into Feat-Conditional-access-policy-package-tags | James Tarran | 2026-04-22 | Medium | General | None | Cherry-pick with review | | | +| `886e9b33` | Merge branch 'dev' into Feat-Conditional-access-policy-package-tags | James Tarran | 2026-04-22 | High | General, Standards deploy | Build/host config | Skip or Defer — protected-area overlap | | Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetPackageTag.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListCAtemplates.ps1 (+1) | +| `1dd59c5c` | Merge pull request #46 from KelvinTegelaar/dev | pull[bot] | 2026-04-21 | Medium | General | None | Cherry-pick with review | | | +| `6c1da764` | Merge pull request #45 from KelvinTegelaar/dev | pull[bot] | 2026-04-21 | Medium | General | None | Cherry-pick with review | | | +| `631cb269` | Merge pull request #44 from KelvinTegelaar/dev | pull[bot] | 2026-04-20 | Medium | General | None | Cherry-pick with review | | | +| `133f9295` | test: fix helper paths after tools folder move | Bobby | 2026-04-16 | Low | Tests | None | Already applied (sync 2026-06-17) | | Tests/Private/Find-CIPPFuzzyPolicyMatch.Tests.ps1, Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1 | +| `7c524eda` | Merge remote-tracking branch 'upstream/dev' into levenshtein-distance | Bobby | 2026-04-16 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPCore/Public/Tools/Find-CIPPFuzzyPolicyMatch.ps1, Modules/CIPPCore/Public/Tools/Get-CIPPLevenshteinDistance.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1 | +| `131a95ac` | Merge pull request #93 from KelvinTegelaar/dev | Integrated Solutions | 2026-04-15 | Medium | General | None | Cherry-pick with review | | | +| `5d43bea7` | Use template displayName for labels | James Tarran | 2026-04-03 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1 | +| `5ef7bbc0` | Add support for CA template package tags | James Tarran | 2026-04-03 | High | General, Standards deploy | Build/host config | Skip or Defer — protected-area overlap | | Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetPackageTag.ps1, Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListCAtemplates.ps1, Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1 (+3) | +| `54b9af07` | feat: add configurable fuzzy Intune policy matching for standards deployments | Bobby | 2026-03-20 | Medium | General, Standards deploy, Tests | None | Cherry-pick — test-only | | Modules/CIPPCore/Private/Find-CIPPFuzzyPolicyMatch.ps1, Modules/CIPPCore/Public/Set-CIPPIntunePolicy.ps1, Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1 (+1) | +| `2b441244` | feat: Add Levenshtein distance function and tests | Kristian Kjærgård | 2026-03-20 | Medium | General, Tests | None | Already applied (sync 2026-06-17) | | Modules/CIPPCore/Private/Get-CIPPLevenshteinDistance.ps1, Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1 | +| `b0e1f0c9` | Merge pull request #89 from KelvinTegelaar/dev | Integrated Solutions | 2026-03-20 | Medium | General | None | Cherry-pick with review | | | +| `c8419545` | Merge pull request #85 from KelvinTegelaar/dev | Integrated Solutions | 2026-03-10 | Medium | General | None | Cherry-pick with review | | | diff --git a/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260727.md b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260727.md new file mode 100644 index 0000000000..2394ad01d2 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260727.md @@ -0,0 +1,107 @@ +# Upstream Delta — CIPP-API — 2026-07-27 + +Cycle type: **Major delta** (upstream 10.6.1 → **10.7.2**). +Sync base: tag `10.6.1` (last cycle July 13) → `upstream/master` @ `d63b7fae3`. +86 commits in range (72 non-merge + release squashes). + +## Structural change upstream + +Upstream development moved to the **CyberDrain org**. Releases 10.7.0 +(`edd3481be`), 10.7.1 (`9d43278ec`) and 10.7.2 (`d63b7fae3`) each landed on +master as **single-parent squash commits** on top of the individually merged +dev commits. Triage therefore splits into: + +1. **True commits** (2026-07-13 → 07-21) — cherry-pickable individually. +2. **Squash-only content** (10.7.x) — ported as path-scoped diffs vs + `upstream/master` per feature area. + +Headline squash content: SAM/auth access-scope rework, **removal of the +vendored `Modules/MicrosoftTeams` module** (139 files, ~477k lines) replaced by +a direct `New-TeamsRequestV2` API layer, SharePoint permissions +report/editor family, SharePoint templated deployments hardening, Intune app +template deploy standard, CIPPSharp REST client. + +## Triage — Apply (cherry-pick, low/medium risk) + +| Upstream | Subject | Notes | +|---|---|---| +| `b2985a6f0` | assignments default append | Fork adapted Set-CIPPAssignedPolicy/Application (direction-scoped) — watch conflicts | +| `ad9caf3ff` | OneDrive root permissions cache boilerplate | New files; previously deferred, now cheap | +| `610ec61e7` | Get-GraphToken AppCache drift | Fork took upstream Get-GraphToken at SAM-cert intake | +| `176d43baa` | partner webhook external URI | | +| `5b42363cd` | nudge-mfa group targeting + auth method selection | New Set-CIPPRegistrationCampaign + ExecRegistrationCampaign; FE pair `ffbca69a5` | +| `2da187218` | snooze to new permission | Fork has snooze endpoints | +| `8f1dd767a` | smart lockout normalize | standards.json part = curated adapt | +| `25f38c58f` | CISA EXO 1.4.1 output | | +| `285685273` | ORCA121 ZAP actions | | +| `2bc0c8e26` | retention days integer cast | | +| `45bd6c996` | test data field projection + CIPPSharp | Fork CIPPSharp aligned upstream | +| `98f0778d8` | CIS/ZTNA test field refs | | +| `003e39f6b` | drift Intune name pairings + tests | | +| `01242ff57` | Set-CIPPUser group routing | Fork has Set-CIPPUser | +| `9368bca07` | SharePoint tests | With SP-templates family | +| `eddef9284` | Set-CIPPSAMAdminRoles cleanup | | +| `ffab43e1a`+`077c0689d` | Site (in)activity cache + report + single lookup | CIPPDBCacheTypes.json adapt; FE pair `bfc83afd7` | +| `996e75c98` | CPV retry guard removal | | +| `ed577f689` | quota alert mailbox types | FE pair `3ac0596f0` | +| `9b5bdd844` | schema extension status | | +| `fd245427d` | app-approval linked permission set | FE pair `3bea4e3b2` | +| `cb1876962` | TeamsDisableResourceAccounts standard | FE pair `0b879d130` | +| `ffd1d69ec` | CA template licenseAvailable P2 | | +| `1072570b5` | DisableM365GroupUsers AllowedToCreateGroups | FE pair `1f4dc9175` | +| `532fff7c6` | MAM deviceAppManagement endpoints | Set-CIPPAssignedPolicy fork-adapted — adapt | +| `1cfa4bfbf` | stale alert cutoff | | +| `0c13c98d0` | writeback reset synced user | | +| `7403b2f60` | community repo #6319 | | +| `6413f0325`+`2ddca8eaa` | JSON validation CI | FE pair `c259fe4ea` | +| `d348de650` | CSP license / Sherweb #6390 | FE pair `b4373e540` | +| `99787a04a` | drift: exclude SP admin center deviations | | +| `4ee94dcba` | GDAP age group in tenant groups | FE pair `341b4555e` | +| `206f9b155` | shadow AI tools alert | FE pair `01180c005` | +| `e704077c8` | audit log token denial = disable | Fork has V2 pipeline | +| `06025c8c6` | QuarantineRequestAlert write-alert typo | Standards file, not quarantine portal | +| `9e518828c` | CA GuestsOrExternalUsers spelling | | +| `ac5a198d8` | standards remediation error logging (13 auth-method standards) | | +| `b4133f874` | Intune false App Protection drift | | +| `784cff5af` | preserve @odata.type on synced App Protection | | +| `951f831f5` | Sherweb migration stop after disable | | +| `15efd3dbb` | inactive licensed users alert enrichment | | +| `7d16571f7` | PWdisplayAppInformation self-check | | +| `a27aff5f4` | CA guests selector constant | | +| `f4dd2a772` | Teams switches default $false | Uses existing New-TeamsRequest (v1) — fine | +| `e0060db51` | compare policy null results | FE pair `c4bf26c4d` | +| `32c387893`+`9609ac929`+`e569d2fc2` | SharePoint templated deployments v1 + steps + skip-exists | New AsyncDeployment framework; FE pair `fcf936ddd`+`84584329f` | +| `d14159589` | autopilot profile name validation | FE pair `da107ebf2` | +| `986de0254` | standards.json align | Adapt into curated fork standards.json | +| `ba8232e2f` | PIM role cache app token | SAMManifest merge (protected) + CPV note | +| `e247438fc` | copilot policy permissions | SAMManifest merge (protected) + CPV note; fork took Copilot intake 07-15 | +| `8cde47ba5` | skip SharingLinks in DB cache run | Push-CIPPDBCacheData fork-custom — adapt | +| `5a08c2c5f` | IDictionary request inputs | Take ListMailboxes half; skip MCP half (no MCP module) | + +## Triage — squash-only content to port by path diff + +| Area | Outcome | Notes | +|---|---|---| +| SharePoint permissions family (`Push-DBCacheSharePointPermissionsBatch`, `Push-StoreSharePointPermissions`, `Set-CIPPDBCacheSharePointPermissions`, `Resolve-CIPPSharePointPermissionScope`, `Set-CIPPSharePointObjectPermission`, `Get-CIPPSharePointErrorMessage`, `New-CIPPSharepointSite`, `New-CIPPSharePointLibrary`, `Invoke-ListSharePointPermissions`, `Invoke-ListSitePermissions`, `Invoke-ListSiteRoleDefinitions`, `Invoke-ListSiteUserAccess`, `Invoke-ExecRemoveLibraryPermission`, `Invoke-ExecSetLibraryInheritance`, `Invoke-ExecSetLibraryPermission`) | **Apply** | Mostly new files; SAM cert prereq already in fork; FE pair = permissions-report page + PDF components | +| SP templated deployments squash hardening (`Invoke-CIPPSharePointTemplateDeploy`, `Invoke-ExecSharePointTemplate`, `Push-ExecSharePointTemplateDeploy`, `Invoke-ListSharePointTemplates`) | **Apply** | Take at upstream tip state | +| `Invoke-CIPPStandardDisableInactiveUsers` (new standard) | **Apply** | + curated standards.json entry | +| Intune app template deploy (`New-CIPPIntuneAppDeployment`, `Get-CIPPOfficeAppBody`, `Invoke-CIPPStandardIntuneAppTemplateDeploy`, `Invoke-AddOfficeApp`, `Invoke-AddStoreApp`) | **Apply** | New standard family | +| `Invoke-CIPPStandardIntuneTemplate` squash changes | **Apply** | Diff-port | +| Teams V2 (`New-TeamsRequestV2`, Teams Voice endpoints, Cs* DBCache setters, **MicrosoftTeams module deletion**) | **Defer — feature intake** | Fork has ~20 standards + DBCache on vendored module; needs dedicated migration + smoke tests | +| SAM/auth access-scope rework (`Get-CippRequestContext`, `Initialize-CippRequestContext`, access-scope cache family, `Test-CIPPAccess`, `Set-CIPPAccessRole`, `New-CippCoreRequest`, GraphHelper touch-ups) | **Defer — feature intake** | Auth-critical protected area; pairs with SSO/CIPP-user family already in backlog | +| `Invoke-ExecAppServiceDomains` + custom-domains UI | **Defer** | Self-host oriented; super-admin pages family already deferred | +| CIPPSharp `CIPPRestClient.cs` + binary | **Defer** | Bundled with auth rework | + +## Triage — Skip / Already implemented / Deferred (unchanged families) + +| Upstream | Outcome | Reason | +|---|---|---| +| `24db2c55c`+`9c9208669` | Skip | NinjaOne CVE group added then reverted — net zero | +| `32ab1c860`, `bc7ace6da`, `98d824463` (version part) | Skip | version_latest.txt bumps (fork versioning protected) | +| `98d824463` host.json change | Review | Check diff during batch E | +| `8c4cf8d94` | Skip | MCP module not in fork (deferred family) | +| `096abcf5b`, `bcc920892` (FE) | Defer | SSO family — planned intake | +| `835972e1a`, `6bd008143`, `cf9fc1d2f` | Skip | Container management — fork has no container endpoints (Azure Functions hosting) | +| `f697a54c6` | Defer | DLP advanced-rule files not in fork (Purview DLP family deferred) | +| `b183e48b3` | Skip | Get-CIPPCVEReport not in fork (CVE management family deferred) | +| 10.7.2 squash | Skip | version_latest.txt only | diff --git a/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260803.md b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260803.md new file mode 100644 index 0000000000..0a99ec99e4 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260803.md @@ -0,0 +1,48 @@ +# Upstream Delta — CIPP-API — 2026-08-03 + +Cycle type: **Light/medium delta** (upstream **10.7.3 → 10.7.5**). +Sync base: `f1b2c93d5` (upstream/master at 07-28 cycle) → `upstream/master` @ `245d9d35b`. +Branch: `manage365/upstream-sync-cipp-api-20260803` +Backup tag: `backup/pre-upstream-sync-cipp-api-20260803` + +3 merge commits (CyberDrain #103, #115, #132). Large surface: AzBobbyTables upgrade, +Intune template drift fixes, audit-log V2, groups/device membership, SSO/custom-domain +additions (skipped). + +## Commits + +| SHA | Date | Subject | +|-----|------|---------| +| `019f62b7a` | 2026-07-29 | Merge PR #103 from CyberDrain/dev | +| `82ab2621f` | 2026-07-29 | Merge PR #115 from CyberDrain/dev | +| `245d9d35b` | 2026-07-30 | Merge PR #132 from CyberDrain/dev → **10.7.5** | + +## Triage — Apply + +| Theme | Paths | Notes | +|---|---|---| +| AzBobbyTables 3.6.2 | `Modules/AzBobbyTables/3.6.2/**` | Drop 3.6.0 if present; fork has 3.4.0/3.5.1 | +| Table wrappers | `Add-CIPPAzDataTableEntity.ps1`, `Get-CIPPAzDatatableEntity.ps1`, new `Remove-CIPPAzDataTableEntity.ps1` | Thin wrappers over large-entity cmdlets | +| Call-site renames | Many `Remove-AzDataTableEntity` → `Remove-CIPPAzDataTableEntity` | Mechanical after wrappers land | +| ConversionTable | `Config/ConversionTable.csv` | Data-only | +| Intune template drift | `Get-CIPPIntunePolicyName`, `Merge-CIPPIntuneTemplateIdentity`, `Select-CIPPIntuneAvailableSetting`, `Invoke-CIPPStandardIntuneTemplate`, `Set-CIPPIntunePolicy`, `Compare-CIPPIntuneObject`, `Repair-CIPPIntuneTemplateNesting`, `Invoke-ExecCompareIntunePolicy` + tests | High value | +| Groups | `New-CIPPGroup.ps1` (`disableNesting`), `Invoke-EditGroup.ps1` (`AddDevice`) | Pair with FE | +| Audit log V2 | `Test-CIPPAuditLogRules`, `Push-AuditLogDownloadV2`, `Push-AuditLogTenantProcessV2`, related + webhook tests | Apply with Pester | +| SafeLinks | `Invoke-CIPPStandardSafeLinksPolicy.ps1` | Low risk | +| Partner webhook | `Invoke-ExecPartnerWebhook.ps1` + new `Get-CIPPHostname.ps1` | Adapt — SWA-safe without SSO | +| SAM | `Config/SAMManifest.json` Scope `3bc15058-…` | Union-merge; CPV after deploy | + +## Triage — Skip / Defer + +| Theme | Outcome | Why | +|---|---|---| +| `Update-CIPPSSOPreconsent.ps1`, `Initialize-CIPPAuth` SSO hook, `Invoke-ExecSSOSetup`, SSO tests | **Skip** | SSO family — SWA lockout / Craft | +| `Invoke-ExecAppServiceDomains.ps1` | **Defer** | No App Service custom-domain UI in fork | +| `Start-SchedulerOrchestrator` `$ValidTypes` destructive cleanup | **Still defer** | Carryover from 07-28 | +| `version_latest.txt` | **Chore** | Bump with Manage365 release at end | + +## Deferred feature backlog (unchanged stance) + +SSO/CIPP Users Skip · MCP Planned (design first) · Worker health Deferred · Teams V2 Defer · +Custom domains Defer · Container Skip · Purview DLP next feature intake · Custom Test Alerting +after CLM settle. diff --git a/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260814.md b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260814.md new file mode 100644 index 0000000000..35c403163b --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260814.md @@ -0,0 +1,38 @@ +# Upstream Delta — CIPP-API — 2026-08-14 + +Cycle: **Major** — upstream **10.7.5 → 10.8.5**. + +| | SHA / version | +|--|--| +| Last sync base | `245d9d35b` | +| Upstream tip | `e02ac3724` (`upstream/master`, **10.8.5**) | +| Fork production at cycle start | `b5f73e2c9` | +| Sync branch | `manage365/upstream-sync-cipp-api-20260814` | +| Backup tag | `backup/pre-upstream-sync-cipp-api-20260814` | + +`Config/SAMManifest.json`: **no new permission IDs** required for planned Apply/Baselines batches (existing Roles/UserAuth/BitLocker scopes suffice). + +## New HTTP entrypoints (selected) + +| Endpoint | Outcome | +|----------|---------| +| `ListIntuneApprovalRequests` | Apply | +| `ListSecureScoreReport` | Apply | +| `ListTenantAllowBlockList` (Spamfilter path) | Adapt/Apply over fork flat | +| `ListRoles` (nested rewrite) | Adapt | +| `ExecSetDefaultMFAMethod` | Apply | +| `ListBrandingSettings` / `ListBrandingPresets` | Adapt with branding intake | +| Baseline List/Add/Run/Stage/Override/Alignment/Remove + ListBaselineStandards | Feature intake | +| `ListCommunityRepoTemplates` | Adapt | +| `PublicMcpRegister` | Defer/skip unless needed (MCP already intaken) | +| SSO / AppService / Container / WorkerHealth | Skip | + +## Baselines backend bundle + +- `Modules/CIPPCore/Public/Baselines/*.ps1` (29) + `Set-CippBaselineRunContext.ps1` +- Orchestrator `Start-CIPPBaselineOrchestrator` + activities `Push-CIPPBaselineStandard`, `Push-CIPPBaselineCacheRefresh` +- `Config/BaselineStandards/**` (~81 JSON) +- Feature flag `Baselines` (Enabled: false) + timer `9f2c7b1e-…` +- Helpers if missing: `Get-CIPPIntuneCompareExclusions`, `Get-CIPPIntunePolicyGraphPath` + +SWA-safe: Durable + Azure Tables only (no Craft). diff --git a/docs/upstream-sync/history-cipp-api/UPSTREAM_SYNC_CIPP_API_20260617.md b/docs/upstream-sync/history-cipp-api/UPSTREAM_SYNC_CIPP_API_20260617.md new file mode 100644 index 0000000000..ab76069756 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/UPSTREAM_SYNC_CIPP_API_20260617.md @@ -0,0 +1,5713 @@ +# Upstream Sync Inventory — CIPP-API (Backend) + +Generated: 2026-06-17 11:21 + +## Summary + +| Field | Value | +|-------|-------| +| Our branch tip | `de78a343e1b8074afcbb417b344a6325704b94ee` | +| Upstream branch | `upstream/master` | +| Upstream tip | `5a0ddb29c3770525813aefea5e356fc56b088eeb` | +| Merge base | `6871d267ebec580b5097f44e7623c0d71c2c5581` | +| Commits to review | **315** | + +### Risk Distribution + +- **Low**: 48 +- **Medium**: 37 +- **High**: 230 + +### Recommendation Distribution + +- **Needs manual review**: 228 +- **Cherry-pick**: 48 +- **Cherry-pick with adaptation**: 39 + +### Review Buckets + +- **Potentially breaking changes**: 236 +- **Dependency/build changes**: 216 +- **Tests-only**: 49 +- **Other**: 21 +- **Bug fixes**: 8 +- **Security fixes**: 4 +- **Documentation-only**: 4 +- **Tenant management changes**: 4 +- **Authentication/permissions changes**: 4 +- **Exchange/Email changes**: 3 +- **Intune changes**: 2 + +--- + +## Commit Inventory + +### 1. `c8419545` — Merge pull request #85 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `c84195451eeb8c3a5033fe9b13a0cc238f2d657f` | +| Author | Integrated Solutions | +| Date | 2026-03-10 09:02:26 +1000 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 2. `b0e1f0c9` — Merge pull request #89 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `b0e1f0c9bf991e7abb6a40b3d3ead2e33be1c97e` | +| Author | Integrated Solutions | +| Date | 2026-03-20 09:47:35 +1000 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 3. `2b441244` — feat: Add Levenshtein distance function and tests + +| Field | Value | +|-------|-------| +| SHA | `2b4412449f1905c0bd8d5f89e93dcdeaac736d39` | +| Author | Kristian Kjærgård | +| Date | 2026-03-20 14:00:40 +0100 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPCore/Private/Get-CIPPLevenshteinDistance.ps1`, `Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1` + +--- + +### 4. `54b9af07` — feat: add configurable fuzzy Intune policy matching for standards deployments + +| Field | Value | +|-------|-------| +| SHA | `54b9af07ddd21f9af745dd9fd6480e71cb13c7d5` | +| Author | Bobby | +| Date | 2026-03-20 20:29:47 +0100 | +| Files changed | 4 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPCore/Private/Find-CIPPFuzzyPolicyMatch.ps1`, `Modules/CIPPCore/Public/Set-CIPPIntunePolicy.ps1`, `Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1`, `Tests/Private/Find-CIPPFuzzyPolicyMatch.Tests.ps1` + +--- + +### 5. `5ef7bbc0` — Add support for CA template package tags + +| Field | Value | +|-------|-------| +| SHA | `5ef7bbc019961bc9019aa239a0c4f89f31780d50` | +| Author | James Tarran | +| Date | 2026-04-03 09:06:35 +0100 | +| Files changed | 6 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Standards/Alignment Custom; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetPackageTag.ps1`, `Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListCAtemplates.ps1`, `Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1`, `Modules/CIPPCore/Public/Get-CIPPDrift.ps1`, `Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1`, `Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1` + +--- + +### 6. `5d43bea7` — Use template displayName for labels + +| Field | Value | +|-------|-------| +| SHA | `5d43bea7d24ba8832650aff443743526d2796357` | +| Author | James Tarran | +| Date | 2026-04-03 16:41:22 +0100 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1` + +--- + +### 7. `131a95ac` — Merge pull request #93 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `131a95ac9ce54fc37123dccf8efa810ed5ed09e3` | +| Author | Integrated Solutions | +| Date | 2026-04-15 14:38:50 +1000 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 8. `7c524eda` — Merge remote-tracking branch 'upstream/dev' into levenshtein-distance + +| Field | Value | +|-------|-------| +| SHA | `7c524edaefaedb5946e23cd2d2d80e2ffc716fa3` | +| Author | Bobby | +| Date | 2026-04-16 12:35:06 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 9. `133f9295` — test: fix helper paths after tools folder move + +| Field | Value | +|-------|-------| +| SHA | `133f929555f5d26a17757802d22ceaa8b3f6b926` | +| Author | Bobby | +| Date | 2026-04-16 12:38:41 +0200 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Tests/Private/Find-CIPPFuzzyPolicyMatch.Tests.ps1`, `Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1` + +--- + +### 10. `631cb269` — Merge pull request #44 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `631cb2690239d9823abc996a5864ad8837facdb7` | +| Author | pull[bot] | +| Date | 2026-04-20 17:36:34 +0000 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 11. `6c1da764` — Merge pull request #45 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `6c1da7642d064ea5e6fc6e0bc24c15d59285c246` | +| Author | pull[bot] | +| Date | 2026-04-21 05:36:29 +0000 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 12. `1dd59c5c` — Merge pull request #46 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `1dd59c5cc0be2e5a76e5afd638b6102d7f9d674d` | +| Author | pull[bot] | +| Date | 2026-04-21 11:36:33 +0000 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 13. `886e9b33` — Merge branch 'dev' into Feat-Conditional-access-policy-package-tags + +| Field | Value | +|-------|-------| +| SHA | `886e9b331531cf255b7d0ee0f22175121331e9a6` | +| Author | James Tarran | +| Date | 2026-04-22 08:44:29 +0100 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** (none) + +--- + +### 14. `e210c484` — Merge branch 'dev' into Feat-Conditional-access-policy-package-tags + +| Field | Value | +|-------|-------| +| SHA | `e210c484d0788780e07a9c5fac00256e382a8a9e` | +| Author | James Tarran | +| Date | 2026-04-22 08:47:13 +0100 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** (none) + +--- + +### 15. `2a2772b4` — feat: add allTenants support for multiple intune pages + +| Field | Value | +|-------|-------| +| SHA | `2a2772b424c958f2fab0d4fd6131c8e5e31f3203` | +| Author | Bobby | +| Date | 2026-04-25 01:32:32 +0200 | +| Files changed | 20 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Get-CIPPAssignmentFilterReport.ps1`, `Modules/CIPPCore/Public/Get-CIPPIntuneAppProtectionPolicyReport.ps1`, `Modules/CIPPCore/Public/Get-CIPPIntuneApplicationReport.ps1`, `Modules/CIPPCore/Public/Get-CIPPIntuneCompliancePolicyReport.ps1`, `Modules/CIPPCore/Public/Get-CIPPIntuneReusableSettingsReport.ps1`, `Modules/CIPPCore/Public/Get-CIPPIntuneScriptReport.ps1`, `Modules/CIPPCore/Public/Get-CIPPManagedDevicesReport.ps1`, `Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneAppProtectionPolicies.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneApplications.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneAssignmentFilters.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneCompliancePolicies.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneReusableSettings.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneScripts.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListApps.ps1` … (+5 more) + +--- + +### 16. `7e9f7192` — feat: Add allTenants support for all the Teams SharePoint pages + +| Field | Value | +|-------|-------| +| SHA | `7e9f7192d35568af060d0152e77458ea58930bcf` | +| Author | Bobby | +| Date | 2026-04-26 19:13:53 +0200 | +| Files changed | 16 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/CIPPDBCache/Push-ExecCIPPDBCache.ps1`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1`, `Modules/CIPPCore/Public/Get-CIPPSitesReport.ps1`, `Modules/CIPPCore/Public/Get-CIPPTeamsActivityReport.ps1`, `Modules/CIPPCore/Public/Get-CIPPTeamsReport.ps1`, `Modules/CIPPCore/Public/Get-CIPPTeamsVoiceReport.ps1`, `Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSites.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheTeams.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheTeamsActivity.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheTeamsVoice.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSites.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeams.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsActivity.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsVoice.ps1` … (+1 more) + +--- + +### 17. `29685d69` — feat(api): add license capability presets + +| Field | Value | +|-------|-------| +| SHA | `29685d69b00fcc1cb774ae60600cd7607d2520b1` | +| Author | Bobby | +| Date | 2026-05-04 22:54:54 +0200 | +| Files changed | 138 | +| Risk | **High** | +| Area | Docs | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal, Permissions/Roles/Auth; Buckets: Documentation-only, Potentially breaking changes | + +**Files:** `.github/agents/CIPP-Alert-Agent.md`, `.github/agents/CIPP-Standards-Agent.md`, `.github/instructions/alerts.instructions.md`, `.github/instructions/cippdb.instructions.md`, `.github/instructions/standards.instructions.md`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandardsList.ps1`, `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertIntunePolicyConflicts.ps1`, `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuarantineReleaseRequests.ps1`, `Modules/CIPPCore/Public/Functions/Test-CIPPStandardLicense.ps1`, `Modules/CIPPCore/Public/Get-CIPPDrift.ps1`, `Modules/CIPPCore/Public/Test-CIPPAccessTenant.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheConditionalAccessPolicies.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheDlpCompliancePolicies.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntunePolicies.ps1` … (+123 more) + +--- + +### 18. `daa8d242` — Merge pull request #95 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `daa8d2424300e2cacbb4a8ca22fd34dbebe43641` | +| Author | Integrated Solutions | +| Date | 2026-05-05 14:39:04 +1000 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 19. `106f7463` — Add AAD Premium license gate to ExternalMFATrusted standard + +| Field | Value | +|-------|-------| +| SHA | `106f7463478cab7e254eef55fd686badecdbf40b` | +| Author | Brian Simpson | +| Date | 2026-05-08 12:53:49 -0500 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1` + +--- + +### 20. `b8b26a27` — Update standards docs URLs to alignment/templates path + +| Field | Value | +|-------|-------| +| SHA | `b8b26a2768a4eba69a7e8ccb69664e8292de3c5a` | +| Author | Brian Simpson | +| Date | 2026-05-03 11:34:58 -0500 | +| Files changed | 182 | +| Risk | **High** | +| Area | Docs | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal, Permissions/Roles/Auth; Buckets: Documentation-only, Potentially breaking changes | + +**Files:** `.github/instructions/standards.instructions.md`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDMARCToMOERA.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAdminSSPR.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAnonReportDisable.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiSpamSafeList.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAppDeploy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAppManagementPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAssignmentFilterTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuditLog.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthMethodsPolicyMigration.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthMethodsSettings.ps1` … (+167 more) + +--- + +### 21. `9683b790` — Fix standards run errors for Retention and MDO standards + +| Field | Value | +|-------|-------| +| SHA | `9683b79002ef95d7b070e5729f8edeee6098475b` | +| Author | Brian Simpson | +| Date | 2026-05-03 11:35:26 -0500 | +| Files changed | 6 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoPresetSecurityPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionPolicyTag.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksTemplatePolicy.ps1` + +--- + +### 22. `07f29839` — purview adding + +| Field | Value | +|-------|-------| +| SHA | `07f2983924a0075e46abff211b781593d9b7c6cf` | +| Author | KelvinTegelaar | +| Date | 2026-05-10 01:26:02 +0200 | +| Files changed | 13 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/standards.json`, `Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-AddDlpCompliancePolicy.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-AddDlpCompliancePolicyTemplate.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-AddRetentionCompliancePolicy.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-AddRetentionCompliancePolicyTemplate.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-AddSensitiveInfoType.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-AddSensitiveInfoTypeTemplate.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-AddSensitivityLabel.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpCompliancePolicyTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionCompliancePolicyTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitiveInfoTypeTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitivityLabelTemplate.ps1` + +--- + +### 23. `b7f32e7a` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `b7f32e7ae720b8c4e7ab1be0ff060d6ab7ca86cf` | +| Author | KelvinTegelaar | +| Date | 2026-05-10 01:26:06 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 24. `a187a17a` — set warn to true. + +| Field | Value | +|-------|-------| +| SHA | `a187a17a3ac8670df9d4d6ad7b722024834e818e` | +| Author | KelvinTegelaar | +| Date | 2026-05-10 13:50:19 +0200 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpCompliancePolicyTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionCompliancePolicyTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitiveInfoTypeTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitivityLabelTemplate.ps1` + +--- + +### 25. `96727eb4` — fixes to purview setup + +| Field | Value | +|-------|-------| +| SHA | `96727eb4922a5eb3277b44a81b3f8f57a52fbaa3` | +| Author | KelvinTegelaar | +| Date | 2026-05-10 14:49:13 +0200 | +| Files changed | 14 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/standards.json`, `Modules/CIPPCore/Public/Format-CIPPCompliancePolicyParams.ps1`, `Modules/CIPPCore/Public/New-CIPPSitRulePackXml.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-AddDlpCompliancePolicy.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-AddDlpCompliancePolicyTemplate.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-AddRetentionCompliancePolicy.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-AddRetentionCompliancePolicyTemplate.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-AddSensitiveInfoType.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-AddSensitivityLabel.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-AddSensitivityLabelTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpCompliancePolicyTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionCompliancePolicyTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitiveInfoTypeTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitivityLabelTemplate.ps1` + +--- + +### 26. `ec7f5649` — Single deployment from function now that its all rigged up + +| Field | Value | +|-------|-------| +| SHA | `ec7f5649f70b0df55c21da4580b23aa636960719` | +| Author | KelvinTegelaar | +| Date | 2026-05-10 22:12:56 +0200 | +| Files changed | 12 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/ConvertTo-CIPPComplianceSetParams.ps1`, `Modules/CIPPCore/Public/Set-CIPPDlpCompliancePolicy.ps1`, `Modules/CIPPCore/Public/Set-CIPPRetentionCompliancePolicy.ps1`, `Modules/CIPPCore/Public/Set-CIPPSensitiveInfoType.ps1`, `Modules/CIPPCore/Public/Set-CIPPSensitivityLabel.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-AddDlpCompliancePolicy.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-AddRetentionCompliancePolicy.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-AddSensitiveInfoType.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-AddSensitivityLabel.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpCompliancePolicyTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionCompliancePolicyTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitivityLabelTemplate.ps1` + +--- + +### 27. `61c938aa` — standards use function + +| Field | Value | +|-------|-------| +| SHA | `61c938aabf2ddf5d6718647f2ddc721d42ecab61` | +| Author | KelvinTegelaar | +| Date | 2026-05-10 22:14:32 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitiveInfoTypeTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitivityLabelTemplate.ps1` + +--- + +### 28. `be25c764` — Squashed commit of the following: + +| Field | Value | +|-------|-------| +| SHA | `be25c76405478de24fc6018cb187375d9b1ab873` | +| Author | James Tarran | +| Date | 2026-05-11 14:48:10 +0100 | +| Files changed | 903 | +| Risk | **High** | +| Area | Docs | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal, Tenant Workflows, Permissions/Roles/Auth, Custom API Endpoints, Standards/Alignment Custom; Buckets: Documentation-only, Potentially breaking changes | + +**Files:** `.github/instructions/auth-model.instructions.md`, `.github/instructions/cippdb.instructions.md`, `.github/workflows/PR_Branch_Check.yml`, `.github/workflows/publish_release.yml`, `.github/workflows/upload_dev.yml`, `.gitignore`, `Config/CIPPDBCacheTypes.json`, `Config/CIPPTimers.json`, `Config/CommunityRepos.json`, `Config/SAMManifest.json`, `Config/TemplateEmail.html`, `Config/cipp-roles.json`, `Config/intuneCollection.json`, `Config/standards.json`, `Config/version_latest.txt` … (+888 more) + +--- + +### 29. `6aa66c74` — Custom Test - Alert on X statuses + +| Field | Value | +|-------|-------| +| SHA | `6aa66c744b8c755f48b75044ca5c876e9e2c90e3` | +| Author | Zacgoose | +| Date | 2026-05-11 21:49:47 +0800 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-AddCustomScript.ps1`, `Modules/CIPPTests/Public/Tests/Custom/Invoke-CippTestCustomScripts.ps1` + +--- + +### 30. `dc3f0f45` — Merge branch 'dev' into Feat-Conditional-access-policy-package-tags + +| Field | Value | +|-------|-------| +| SHA | `dc3f0f458131bfc256b3ab938aeeadc8cf4d4e6f` | +| Author | James Tarran | +| Date | 2026-05-11 14:55:06 +0100 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** (none) + +--- + +### 31. `dad97f7c` — Restore Invoke-AddCustomScript.ps1 + +| Field | Value | +|-------|-------| +| SHA | `dad97f7c19da50facd311f1a225699621010be64` | +| Author | James Tarran | +| Date | 2026-05-11 14:59:06 +0100 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-AddCustomScript.ps1` + +--- + +### 32. `6a96bab8` — Update Invoke-ListLicenses.ps1 + +| Field | Value | +|-------|-------| +| SHA | `6a96bab87febde97fd8abd188f35cc8850bc6ef7` | +| Author | Zacgoose | +| Date | 2026-05-11 23:14:58 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicenses.ps1` + +--- + +### 33. `f87f7da9` — implemenets #5948 + +| Field | Value | +|-------|-------| +| SHA | `f87f7da97aeb2dc21b45647151fa2d62ca9366de` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 19:58:56 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1` + +--- + +### 34. `61bac43f` — Greatly speed up listing of intune policies for alltenants + +| Field | Value | +|-------|-------| +| SHA | `61bac43f6551f1af488b8372dffd04718bc39b86` | +| Author | Zacgoose | +| Date | 2026-05-12 02:03:13 +0800 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Add-CIPPDbItem.ps1`, `Modules/CIPPCore/Public/Get-CIPPIntunePolicyReport.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecRemoveMailboxRule.ps1` + +--- + +### 35. `377b83e6` — HVE user management and cache + +| Field | Value | +|-------|-------| +| SHA | `377b83e68241023ee4440b0836fdd86600abcf1a` | +| Author | Zacgoose | +| Date | 2026-05-12 02:05:12 +0800 | +| Files changed | 5 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/CIPPDBCacheTypes.json`, `Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheHVEAccounts.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecHVEUser.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListHVEAccounts.ps1` + +--- + +### 36. `c29746a1` — eclusions everywhere + +| Field | Value | +|-------|-------| +| SHA | `c29746a16c2cf84b7908f94039c70317aaaf1988` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 20:13:43 +0200 | +| Files changed | 5 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Applications/Push-UploadApplication.ps1`, `Modules/CIPPCore/Public/Set-CIPPAssignedApplication.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ExecAssignApp.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1` + +--- + +### 37. `2753661e` — implements #5986 + +| Field | Value | +|-------|-------| +| SHA | `2753661e99deccb851c92738a9e54b1d416514fe` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 20:43:04 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditTenantAllowBlockListTemplate.ps1` + +--- + +### 38. `5f3b26e5` — tablecleanup update + +| Field | Value | +|-------|-------| +| SHA | `5f3b26e5a5192fb34757d5518f53a0dc1ff8b450` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:02:00 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1` + +--- + +### 39. `1aa55cff` — fix: intune standard change detection queries + +| Field | Value | +|-------|-------| +| SHA | `1aa55cffb7ad70e9a11a4b2e70f8feeb80e775fe` | +| Author | John Duprey | +| Date | 2026-05-11 15:02:46 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandardsList.ps1` + +--- + +### 40. `0c045c72` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `0c045c7272f56be6bb812a38580a521ff8a2696c` | +| Author | John Duprey | +| Date | 2026-05-11 15:02:53 -0400 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 41. `ee0b8229` — fix: change cleanup to 30 days + +| Field | Value | +|-------|-------| +| SHA | `ee0b82294a849bf992ec3ff7ce09b517f4e17fba` | +| Author | John Duprey | +| Date | 2026-05-11 15:05:40 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1` + +--- + +### 42. `b6c2a436` — Feat: Add support for AllTenants in Intune pages (#2021) + +| Field | Value | +|-------|-------| +| SHA | `b6c2a4360917ecd1150da3ea9a643749319748ed` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:12:56 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** (none) + +--- + +### 43. `dd413bfe` — Add AAD Premium license gate to ExternalMFATrusted standard (#2046) + +| Field | Value | +|-------|-------| +| SHA | `dd413bfe119e48b011f65ddcc377e250decd93d4` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:14:06 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 44. `d8be4455` — Merge branch 'dev' into levenshtein-distance + +| Field | Value | +|-------|-------| +| SHA | `d8be4455b25bb488529e62bceee689ff6ea30a58` | +| Author | Kristian Kjærgård | +| Date | 2026-05-11 21:20:31 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 45. `59da6e6b` — Merge branch 'dev' into testlicense-presets + +| Field | Value | +|-------|-------| +| SHA | `59da6e6b312467bce245585d321fd0ce6cc64546` | +| Author | Kristian Kjærgård | +| Date | 2026-05-11 21:21:21 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** (none) + +--- + +### 46. `fdf313e5` — fix: remove partitionkey + +| Field | Value | +|-------|-------| +| SHA | `fdf313e5cfb08b2da7bba256201daf2de9ba15ff` | +| Author | John Duprey | +| Date | 2026-05-11 15:23:32 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1` + +--- + +### 47. `b0232eca` — Feat conditional access policy package tags (#1979) + +| Field | Value | +|-------|-------| +| SHA | `b0232eca376e913a1c8705a6a53cccb4b4fa20a4` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:28:49 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** (none) + +--- + +### 48. `75699ff1` — feat: Add fuzzy matching for Intune policies using Levenshtein distance (#1945) + +| Field | Value | +|-------|-------| +| SHA | `75699ff1b967bd314ed0e9c06cf219ebcbb19dcc` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:33:25 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 49. `d996babb` — Merge branch 'dev' of https://github.com/kris6673/CIPP-API into alltenants-SP + +| Field | Value | +|-------|-------| +| SHA | `d996babb5590423e7b48116a809df541ee6ec01e` | +| Author | Bobby | +| Date | 2026-05-11 21:26:15 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 50. `ddf0a4c6` — feat: Add allTenants support for Teams SharePoint pages (#2022) + +| Field | Value | +|-------|-------| +| SHA | `ddf0a4c628b9172be770066bfe3d0a9d0e5afe76` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:37:30 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** (none) + +--- + +### 51. `0c633110` — fix: fix my cleanup mistake + +| Field | Value | +|-------|-------| +| SHA | `0c6331101751d4d598a6796c58b32743c77fff29` | +| Author | Bobby | +| Date | 2026-05-11 21:46:45 +0200 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Get-CIPPSitesReport.ps1`, `Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSites.ps1` + +--- + +### 52. `affac9d0` — Fix/standards run errors (#2037) + +| Field | Value | +|-------|-------| +| SHA | `affac9d0978c5e30b3da8b6b852fcf1d1f23b5bd` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:47:38 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** (none) + +--- + +### 53. `12bb4f69` — Fix: Fix cleanup mistake in caching functions (#2048) + +| Field | Value | +|-------|-------| +| SHA | `12bb4f69566a2a81aeddafcaffdbf02eec0b5cee` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:48:16 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** (none) + +--- + +### 54. `5995ad77` — Merge branch 'dev' into testlicense-presets + +| Field | Value | +|-------|-------| +| SHA | `5995ad7778c9e0f6a4e9e350302b06f6306aa1b9` | +| Author | Kristian Kjærgård | +| Date | 2026-05-11 21:51:47 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** (none) + +--- + +### 55. `21526416` — fix: add the presets to the rest of the standards + +| Field | Value | +|-------|-------| +| SHA | `2152641640709ecfe211f3c38752edad0d3f5f13` | +| Author | Bobby | +| Date | 2026-05-11 22:01:50 +0200 | +| Files changed | 11 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneAppProtectionPolicies.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneApplications.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneAssignmentFilters.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneCompliancePolicies.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneReusableSettings.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneScripts.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoAddProxy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEmptyFilterIPAllowList.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnforcePrivateGroups.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsZAP.ps1` + +--- + +### 56. `bc4abb53` — feat: add DefenderForOffice365 preset to license tests + +| Field | Value | +|-------|-------| +| SHA | `bc4abb53441d530ef84896da8f2a8414b744840c` | +| Author | Bobby | +| Date | 2026-05-11 22:23:28 +0200 | +| Files changed | 6 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPCore/Public/Functions/Test-CIPPStandardLicense.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoPresetSecurityPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksTemplatePolicy.ps1` + +--- + +### 57. `f5702f41` — feat: Enhance Invoke-ListIntuneTemplates to include usage tracking for standards templates + +| Field | Value | +|-------|-------| +| SHA | `f5702f41f1fa33ab7cfa8be9989c913d88d7d880` | +| Author | John Duprey | +| Date | 2026-05-11 23:57:27 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneTemplates.ps1` + +--- + +### 58. `ecbc9a50` — fix: Add error handling for missing standard functions in Push-CIPPStandard + +| Field | Value | +|-------|-------| +| SHA | `ecbc9a50ac0584e0d0ce59259214ebe6d9cf525a` | +| Author | John Duprey | +| Date | 2026-05-11 23:58:56 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandard.ps1` + +--- + +### 59. `57b7de1f` — fix: Rename 'usedInTemplates' property to 'usage' for clarity in Invoke-ListIntuneTemplates + +| Field | Value | +|-------|-------| +| SHA | `57b7de1f31bcffa3ebc3ba1f05d5d47fa1b6bffe` | +| Author | John Duprey | +| Date | 2026-05-12 00:07:30 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneTemplates.ps1` + +--- + +### 60. `7fd7d097` — fixes sharepoint response stuff + +| Field | Value | +|-------|-------| +| SHA | `7fd7d097882ad258695905e15c19addd288d493c` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 14:28:11 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointSiteUsage.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSites.ps1` + +--- + +### 61. `23c8994d` — fixes defaultr_hidden vs hidden #5990 + +| Field | Value | +|-------|-------| +| SHA | `23c8994da9a523a6fbce594181f0c74e5fb1a69e` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 14:33:28 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1` + +--- + +### 62. `ad0d096c` — OneDrive Sharing disable + +| Field | Value | +|-------|-------| +| SHA | `ad0d096c727ec2b881f0ea8a4e5ff33a8950f0a8` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 16:03:49 +0200 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Invoke-CIPPOffboardingJob.ps1`, `Modules/CIPPCore/Public/Set-CIPPOneDriveSharing.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECRemediate.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetOneDriveSharing.ps1` + +--- + +### 63. `2869564f` — Add AlertUserReportPhising + +| Field | Value | +|-------|-------| +| SHA | `2869564fb904deced3eb5c076f19519db12c3769` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 16:32:19 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/SAMManifest.json`, `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUserReportedPhishing.ps1` + +--- + +### 64. `ddb498fe` — chore: bump version to 10.4.5 + +| Field | Value | +|-------|-------| +| SHA | `ddb498fe81df0262aa834db9617ed08dad38aeed` | +| Author | John Duprey | +| Date | 2026-05-12 11:32:15 -0400 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `host.json`, `version_latest.txt` + +--- + +### 65. `35437558` — Update Viva standard + +| Field | Value | +|-------|-------| +| SHA | `35437558e4699479e303f4245fe14d3e258cdba2` | +| Author | Zacgoose | +| Date | 2026-05-12 23:39:36 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableViva.ps1` + +--- + +### 66. `5f864e3f` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `5f864e3ff517b8e292ce0d7bb7d6080ea297c2cf` | +| Author | Zacgoose | +| Date | 2026-05-12 23:39:38 +0800 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 67. `78193020` — fix name + +| Field | Value | +|-------|-------| +| SHA | `781930205c67fc17a5ca887755361987a407012a` | +| Author | John Duprey | +| Date | 2026-05-12 12:20:47 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-OrchestratorBatchItems.ps1` + +--- + +### 68. `785e71c5` — fix user select + +| Field | Value | +|-------|-------| +| SHA | `785e71c530a39b46f56cea7c598f7d609d8a8518` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 18:26:46 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1` + +--- + +### 69. `6a81a086` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `6a81a086d4b109ae6d59dc73b6b47308091e5f64` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 18:26:48 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 70. `2c5d0c9a` — feat: Add license capability presets (#2040) + +| Field | Value | +|-------|-------| +| SHA | `2c5d0c9a9c3df6447e8ae17f17aa929c7457fb82` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 20:24:52 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 71. `2dbc4803` — auth configs + +| Field | Value | +|-------|-------| +| SHA | `2dbc480336773976fb1140194c4c5de348afe170` | +| Author | Zacgoose | +| Date | 2026-05-13 04:19:45 +0800 | +| Files changed | 15 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Config/FeatureFlags.json`, `Modules/CIPPCore/Public/Authentication/Get-CippApiAuth.ps1`, `Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1`, `Modules/CIPPCore/Public/Authentication/New-CIPPSSOApp.ps1`, `Modules/CIPPCore/Public/Authentication/Remove-CIPPMigrationAppSetting.ps1`, `Modules/CIPPCore/Public/Authentication/Set-CIPPSSOEasyAuth.ps1`, `Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1`, `Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1`, `Modules/CIPPCore/Public/Authentication/Update-CIPPSSORedirectUri.ps1`, `Modules/CIPPCore/Public/GraphHelper/Update-AppManagementPolicy.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListFeatureFlags.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCIPPUsers.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecContainerManagement.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCIPPUsers.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecSSOSetup.ps1` + +--- + +### 72. `3adade45` — Featureflag configs and timer changes + +| Field | Value | +|-------|-------| +| SHA | `3adade45c14529810607f8a251d56a9c2c0ac44b` | +| Author | Zacgoose | +| Date | 2026-05-13 14:21:10 +0800 | +| Files changed | 5 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/CIPPTimers.json`, `Config/FeatureFlags.json`, `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-ContainerUpdateCheck.ps1`, `Modules/CIPPCore/Public/Get-CIPPFeatureFlag.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecContainerManagement.ps1` + +--- + +### 73. `93c80812` — skip replacement if not value set for variable + +| Field | Value | +|-------|-------| +| SHA | `93c80812f29762f375ed0ea28b03e59f8d956017` | +| Author | Zacgoose | +| Date | 2026-05-13 15:52:56 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Get-CIPPTextReplacement.ps1` + +--- + +### 74. `2d33e020` — strip return characters + +| Field | Value | +|-------|-------| +| SHA | `2d33e020ee90330209b90a1538b419c3a71ab4c2` | +| Author | Zacgoose | +| Date | 2026-05-13 16:47:18 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/New-CIPPAlertTemplate.ps1` + +--- + +### 75. `d480cf74` — Add Apps and SP to universal search + +| Field | Value | +|-------|-------| +| SHA | `d480cf74f7bea7180136c74d1e351b4b93b7d06a` | +| Author | Zacgoose | +| Date | 2026-05-13 17:06:47 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Search-CIPPDbData.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecUniversalSearchV2.ps1` + +--- + +### 76. `9011dd63` — Nice CA policy editor and template creator/editor + +| Field | Value | +|-------|-------| +| SHA | `9011dd63e2a4ac6aef393aab54893b791e06caa0` | +| Author | Zacgoose | +| Date | 2026-05-13 18:53:59 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecCreateCATemplate.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecEditCAPolicyFull.ps1` + +--- + +### 77. `897dfaa4` — fixed #5997 + +| Field | Value | +|-------|-------| +| SHA | `897dfaa4f07443e0f05f8f2aefa5b0a92fc91a9c` | +| Author | KelvinTegelaar | +| Date | 2026-05-13 21:18:48 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1` + +--- + +### 78. `b1363008` — #5997 + +| Field | Value | +|-------|-------| +| SHA | `b1363008db683132524711ec2932afe9a12f0342` | +| Author | KelvinTegelaar | +| Date | 2026-05-13 21:19:03 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1` + +--- + +### 79. `e060fa22` — implements #5981 + +| Field | Value | +|-------|-------| +| SHA | `e060fa22b10156d59bed43c7b22f965a768379e5` | +| Author | KelvinTegelaar | +| Date | 2026-05-13 21:47:17 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/New-CIPPCAPolicy.ps1`, `Modules/CIPPCore/Public/New-CIPPCATemplate.ps1` + +--- + +### 80. `f5f7ae70` — fixes duplicate test calls in some cases + +| Field | Value | +|-------|-------| +| SHA | `f5f7ae7064404c314d6cd5694ee1260d1e543c0f` | +| Author | Zacgoose | +| Date | 2026-05-14 15:09:35 +1000 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPCore/Public/Add-CIPPAzDataTableEntity.ps1`, `Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1` + +--- + +### 81. `c097631e` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `c097631e9c9a30468a858e222256894c9a95122c` | +| Author | Zacgoose | +| Date | 2026-05-14 15:09:50 +1000 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 82. `b4a52152` — Fix tenant group scope cache + +| Field | Value | +|-------|-------| +| SHA | `b4a5215251751201733eb04fda5a464e462b88d8` | +| Author | Zacgoose | +| Date | 2026-05-14 15:37:16 +1000 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/FeatureFlags.json`, `Modules/CIPPCore/Public/TenantGroups/Get-TenantGroups.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListContainerLogs.ps1` + +--- + +### 83. `dbd7fcb3` — logging improvements + +| Field | Value | +|-------|-------| +| SHA | `dbd7fcb3486342ae02f5cc914343052a7bdec645` | +| Author | Zacgoose | +| Date | 2026-05-14 18:09:21 +1000 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListContainerLogs.ps1` + +--- + +### 84. `bc7de0c1` — when running a standard manually still process all standards for precedence overrides + +| Field | Value | +|-------|-------| +| SHA | `bc7de0c1a41134baa87c8d45ee2f13fb8d96b979` | +| Author | Zacgoose | +| Date | 2026-05-14 18:09:59 +1000 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1` + +--- + +### 85. `ee0398db` — feat(endpoint): add Apple ADE and Android enrollment profile listing and deletion endpoints + +| Field | Value | +|-------|-------| +| SHA | `ee0398db8fb1dc0f3e068d57044486d90b03c992` | +| Author | Bobby | +| Date | 2026-05-14 11:28:32 +0200 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecRemoveEnrollmentProfile.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAndroidEnrollmentProfiles.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppleEnrollmentProfiles.ps1`, `cspell.json` + +--- + +### 86. `5ccf15a9` — fix: missing odata path error in the returned json + +| Field | Value | +|-------|-------| +| SHA | `5ccf15a9197c67cb8fdde40606dd7b26a476ae1a` | +| Author | Bobby | +| Date | 2026-05-14 20:23:40 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntunePolicy.ps1` + +--- + +### 87. `5901014f` — Merge pull request #100 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `5901014f4622cc7a47a923716a2974df1f8e0923` | +| Author | Integrated Solutions | +| Date | 2026-05-15 11:39:46 +1000 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 88. `5289a309` — feat: ability to add/remove nested groups in group memberships + +| Field | Value | +|-------|-------| +| SHA | `5289a3092d34df70035ab12a2cc70daabeb2e77f` | +| Author | Integrated Solutions | +| Date | 2026-05-15 15:57:00 +1000 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListUsersAndGroups.ps1` + +--- + +### 89. `7ae35c2b` — post exec tweaks for dedupe queue names + +| Field | Value | +|-------|-------| +| SHA | `7ae35c2bd5c8f11169722651e69c18224dc8fde8` | +| Author | Zacgoose | +| Date | 2026-05-15 02:28:44 -0500 | +| Files changed | 6 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Config/FeatureFlags.json`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheApplyBatch.ps1`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsApplyBatch.ps1`, `Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPDBTestsRun.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListWorkerHealth.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecTestRun.ps1` + +--- + +### 90. `fd6e30f6` — fix(standards): target azureADRegistration in intuneRestrictUserDeviceRegistration + +| Field | Value | +|-------|-------| +| SHA | `fd6e30f62fb209f2b706b359bd1b91f5ef368081` | +| Author | Bobby | +| Date | 2026-05-15 20:29:45 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1` + +--- + +### 91. `c67bc8dd` — feat(standards): add intuneRestrictUserDeviceJoin standard + +| Field | Value | +|-------|-------| +| SHA | `c67bc8dd9b892ebfaeaf80a9037941d46d53d745` | +| Author | Bobby | +| Date | 2026-05-15 20:29:46 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceJoin.ps1` + +--- + +### 92. `90b6457d` — Add AutoExpandingArchiveScope property showing org-level vs mailbox-level enablement + +| Field | Value | +|-------|-------| +| SHA | `90b6457d590ea6f6b96c62e8e0315ccd1f56f640` | +| Author | Zacgoose | +| Date | 2026-05-18 07:16:57 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserMailboxDetails.ps1` + +--- + +### 93. `ab83a2bb` — Update Update-CIPPSAMRedirectUri.ps1 + +| Field | Value | +|-------|-------| +| SHA | `ab83a2bb5dbcfba32770827466b17a882398898d` | +| Author | Zacgoose | +| Date | 2026-05-18 07:56:08 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Update-CIPPSAMRedirectUri.ps1` + +--- + +### 94. `d7cda8a3` — Update Initialize-CIPPAuth.ps1 + +| Field | Value | +|-------|-------| +| SHA | `d7cda8a309a9c133e98de54257482bb4ef399abc` | +| Author | Zacgoose | +| Date | 2026-05-18 07:57:41 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1` + +--- + +### 95. `ab5e5155` — Switch to app auth for authentication changes standard + +| Field | Value | +|-------|-------| +| SHA | `ab5e5155681acb8e14994a80fd287a17f1aa3544` | +| Author | Zacgoose | +| Date | 2026-05-18 09:24:48 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Set-CIPPAuthenticationPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1` + +--- + +### 96. `1b1ee689` — cache PowerShell enabled status and use cached data for standard + +| Field | Value | +|-------|-------| +| SHA | `1b1ee689e9442896d9767f1cba736d6aa8b5d56f` | +| Author | Zacgoose | +| Date | 2026-05-19 07:20:16 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheMailboxes.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableExchangeOnlinePowerShell.ps1` + +--- + +### 97. `6b8ebd48` — refactor calls to use new onepass method to store DB data + +| Field | Value | +|-------|-------| +| SHA | `6b8ebd4814625fa4902844dca619cb6deb1720eb` | +| Author | Zacgoose | +| Date | 2026-05-19 07:40:37 -0400 | +| Files changed | 86 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal, Tenant Workflows, Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheAdminConsentRequestPolicy.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheAppRoleAssignments.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheApps.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheAuthenticationFlowsPolicy.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheAuthenticationMethodsPolicy.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheAuthorizationPolicy.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheB2BManagementPolicy.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheBitlockerKeys.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheConditionalAccessPolicies.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCopilotReadinessActivity.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCopilotUsageUserDetail.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCopilotUserCountSummary.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCopilotUserCountTrend.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCredentialUserRegistrationDetails.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCrossTenantAccessPolicy.ps1` … (+71 more) + +--- + +### 98. `e3e82cd9` — Cache Security Defaults + +| Field | Value | +|-------|-------| +| SHA | `e3e82cd95b9597706f1edc3ccde5776695abe820` | +| Author | Zacgoose | +| Date | 2026-05-19 07:51:16 -0400 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/New-CIPPCAPolicy.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheConditionalAccessPolicies.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1` + +--- + +### 99. `9ba48711` — correct incorrect default value + +| Field | Value | +|-------|-------| +| SHA | `9ba48711c614be8e2452ffff2e539b5b1a11b534` | +| Author | Zacgoose | +| Date | 2026-05-19 10:01:24 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/standards.json`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneComplianceSettings.ps1` + +--- + +### 100. `73f83719` — add logging to geoip lookip + +| Field | Value | +|-------|-------| +| SHA | `73f83719d8d6123db9e450248f55dc97acfdc0ea` | +| Author | Zacgoose | +| Date | 2026-05-19 10:01:41 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Get-CIPPGeoIPLocation.ps1` + +--- + +### 101. `9fce7e77` — feat: add in missing options for Windows Hello standard + +| Field | Value | +|-------|-------| +| SHA | `9fce7e77b7d7cf29692fa3aa869a373e076f7658` | +| Author | Bobby | +| Date | 2026-05-20 22:10:20 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration.ps1` + +--- + +### 102. `1e02bfcb` — feat(standards): add DLP via DCS standard + +| Field | Value | +|-------|-------| +| SHA | `1e02bfcb198406e9caa408acad12d79c7646ce6f` | +| Author | Bobby | +| Date | 2026-05-20 23:42:04 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpViaDcsEnabled.ps1` + +--- + +### 103. `cfa144d6` — Update Invoke-ListWorkerHealth.ps1 + +| Field | Value | +|-------|-------| +| SHA | `cfa144d6b00b6641720c18bde34537227965a7fd` | +| Author | Zacgoose | +| Date | 2026-05-22 12:51:10 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListWorkerHealth.ps1` + +--- + +### 104. `a89c2b93` — Add Group-Based Licensing support + +| Field | Value | +|-------|-------| +| SHA | `a89c2b9333ba7a1bca50fda53145894835de8f80` | +| Author | Luis Mengel | +| Date | 2026-05-23 15:20:47 +0200 | +| Files changed | 6 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/New-CIPPGroup.ps1`, `Modules/CIPPCore/Public/Remove-CIPPGroup.ps1`, `Modules/CIPPCore/Public/Set-CIPPGroupLicense.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-AddGroupTemplate.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-EditGroup.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroupTemplates.ps1` + +--- + +### 105. `bb2ebc6a` — fix: Add missing options for Windows Hello standard (#2061) + +| Field | Value | +|-------|-------| +| SHA | `bb2ebc6a76533e893d88fd024b7f73529cc764a0` | +| Author | KelvinTegelaar | +| Date | 2026-05-23 16:41:12 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** (none) + +--- + +### 106. `7fbb8edf` — Feat: Split Intune device join and registration standards (#2057) + +| Field | Value | +|-------|-------| +| SHA | `7fbb8edfed242ac6c80d7e684102df20bc6bce02` | +| Author | KelvinTegelaar | +| Date | 2026-05-23 16:42:43 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Intune | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Intune changes | + +**Files:** (none) + +--- + +### 107. `77a4be64` — fixes #6027 + +| Field | Value | +|-------|-------| +| SHA | `77a4be6499e8e93d41a932983f03799275071893` | +| Author | KelvinTegelaar | +| Date | 2026-05-23 18:10:15 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTenantGroup.ps1` + +--- + +### 108. `4ab85c75` — CIPP Hosted Notices + +| Field | Value | +|-------|-------| +| SHA | `4ab85c751fe6aad0c93d41ce43eb1e7755ae12c4` | +| Author | Zacgoose | +| Date | 2026-05-24 09:13:56 +1000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1` + +--- + +### 109. `dcf382aa` — Update Build-DevApiModules.ps1 + +| Field | Value | +|-------|-------| +| SHA | `dcf382aaa03539256b17454a49371ac7fda6485e` | +| Author | Zacgoose | +| Date | 2026-05-24 09:33:25 +1000 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Tools/Build-DevApiModules.ps1` + +--- + +### 110. `9bb2f6bc` — Update Build-DevApiModules.ps1 + +| Field | Value | +|-------|-------| +| SHA | `9bb2f6bc962c1fbb89801b6e50295407672ca829` | +| Author | Zacgoose | +| Date | 2026-05-24 09:38:26 +1000 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Tools/Build-DevApiModules.ps1` + +--- + +### 111. `fa5f4de6` — remove sso setup from featureflag + +| Field | Value | +|-------|-------| +| SHA | `fa5f4de6f54e7efc2473687e705d5b6caf20b1aa` | +| Author | John Duprey | +| Date | 2026-05-24 14:46:53 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Settings | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `Config/FeatureFlags.json` + +--- + +### 112. `df847779` — implement standards template deployment for intune apps + +| Field | Value | +|-------|-------| +| SHA | `df8477792bb4970416689b732c43a95e3537be7b` | +| Author | KelvinTegelaar | +| Date | 2026-05-24 22:41:08 +0200 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Applications/Push-UploadApplication.ps1`, `Modules/CIPPCore/Public/New-CIPPIntuneAppDeployment.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneAppTemplateDeploy.ps1` + +--- + +### 113. `08ab039c` — add filtering + +| Field | Value | +|-------|-------| +| SHA | `08ab039ccdaa149d3c0698d1dba627acd668ee58` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 00:22:59 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppCertificateExpiry.ps1`, `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppSecretExpiry.ps1` + +--- + +### 114. `c81b6a5c` — add filtering + +| Field | Value | +|-------|-------| +| SHA | `c81b6a5c57a49d9dfec2728706fb7cc2098d5dfa` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 00:23:02 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppCertificateExpiry.ps1`, `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppSecretExpiry.ps1` + +--- + +### 115. `33512c39` — FIDO2 profile standards + +| Field | Value | +|-------|-------| +| SHA | `33512c39360bd618749adf423d132b764e62db1f` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 01:34:04 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFIDO2PasskeyProfiles.ps1` + +--- + +### 116. `03abdad4` — add global var showing + +| Field | Value | +|-------|-------| +| SHA | `03abdad414c58c3a3502068465c1ff6441fcc140` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 01:58:21 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCippReplacemap.ps1` + +--- + +### 117. `f09ce56a` — Update New-TeamsRequest.ps1 + +| Field | Value | +|-------|-------| +| SHA | `f09ce56acc6efba45ee1cb0b9dcbcf43c1224ac5` | +| Author | Zacgoose | +| Date | 2026-05-25 11:58:16 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/GraphHelper/New-TeamsRequest.ps1` + +--- + +### 118. `a0dab59a` — domain fixes + +| Field | Value | +|-------|-------| +| SHA | `a0dab59a9091949721e42bd2f4c8cf78acc927cc` | +| Author | Zacgoose | +| Date | 2026-05-25 14:35:20 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserTenant.ps1`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-GetTenantDomains.ps1` + +--- + +### 119. `08b972cc` — timezone changes + +| Field | Value | +|-------|-------| +| SHA | `08b972ccac96794551db5c6dca9c2135914144e3` | +| Author | Zacgoose | +| Date | 2026-05-25 15:33:49 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Initialize-CIPPTimezone.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTimeSettings.ps1` + +--- + +### 120. `d854e22d` — feat: add function to remove users from admin roles + +| Field | Value | +|-------|-------| +| SHA | `d854e22d853449c8f45b44ed31c5e385508aba55` | +| Author | Bobby | +| Date | 2026-05-25 11:49:28 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecRemoveAdminRole.ps1` + +--- + +### 121. `cb31997c` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `cb31997c9c07694c84a072d49b6910db20e80c07` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 12:24:15 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 122. `46015ce7` — Add APv2 profile + +| Field | Value | +|-------|-------| +| SHA | `46015ce7394fb954d357f8ebf26ef77a827626ad` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:29:29 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDevicePrepProfile.ps1` + +--- + +### 123. `05ce60f3` — Feat: Add function to remove users from admin roles (#2064) + +| Field | Value | +|-------|-------| +| SHA | `05ce60f365de65170d3aa37ca2287b94678361b5` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:31:38 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 124. `a7e30d7a` — feat: Add DLP via DCS standard (#2062) + +| Field | Value | +|-------|-------| +| SHA | `a7e30d7a7f63662b40e3daad87d6de971fc7fbfc` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:32:45 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 125. `4214bc7d` — Fix: Fix missing OData path error in JSON response (#2054) + +| Field | Value | +|-------|-------| +| SHA | `4214bc7de39c563d0979b2717239e9acda4752e7` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:34:33 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** (none) + +--- + +### 126. `a7b7d4da` — feat: Add Apple ADE and Android enrollment profile endpoints (#2053) + +| Field | Value | +|-------|-------| +| SHA | `a7b7d4daeca7b247fa017d722b29e019f0d8f885` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:35:47 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Intune | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Intune changes | + +**Files:** (none) + +--- + +### 127. `443e16a3` — feat: ability to add/remove nested groups in group memberships (#2056) + +| Field | Value | +|-------|-------| +| SHA | `443e16a34e7b0c72cc513000b69b852987b8fe04` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 22:43:43 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 128. `71afcdd2` — ExoTransportConfig cache type - fix for missing data used in test suites + +| Field | Value | +|-------|-------| +| SHA | `71afcdd2be483a31473fcadaf239888671548787` | +| Author | Zacgoose | +| Date | 2026-05-26 11:54:49 +0800 | +| Files changed | 6 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Config/CIPPDBCacheTypes.json`, `Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoTransportConfig.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMessageExpiration.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_6_5_4.ps1` + +--- + +### 129. `1e63ebf0` — Update Invoke-CIPPStandardsharingDomainRestriction.ps1 + +| Field | Value | +|-------|-------| +| SHA | `1e63ebf0fc6b61a4873d4eb2f4f1b389f034676a` | +| Author | Zacgoose | +| Date | 2026-05-26 15:09:22 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1` + +--- + +### 130. `59a0e15d` — update application content type handling + +| Field | Value | +|-------|-------| +| SHA | `59a0e15d1c11b1c8c33e0d04f3f6cd9dd96e23b0` | +| Author | Zacgoose | +| Date | 2026-05-26 15:12:33 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Shared/CIPPSharp/CIPPRestClient.cs`, `Shared/CIPPSharp/bin/CIPPSharp.dll` + +--- + +### 131. `e6b800b1` — remove rerun from alert + +| Field | Value | +|-------|-------| +| SHA | `e6b800b1c93bd1236bef7c6aacd194f4de8289f7` | +| Author | Zacgoose | +| Date | 2026-05-26 15:34:21 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuarantineReleaseRequests.ps1` + +--- + +### 132. `97dc672c` — user sync + +| Field | Value | +|-------|-------| +| SHA | `97dc672c748a5152c5a7438588f6ab6847b4ac26` | +| Author | Zacgoose | +| Date | 2026-05-26 23:33:37 +0800 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/CIPPTimers.json`, `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-UserSyncTimer.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCIPPUsers.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCIPPUsers.ps1` + +--- + +### 133. `359633a4` — fix: ensure tenant groups skips cache so they dont alternate anymore when refreshed + +| Field | Value | +|-------|-------| +| SHA | `359633a42f5c208fd3b7e85f5903833e96e9c1c4` | +| Author | Bobby | +| Date | 2026-05-26 17:58:54 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListTenantDetails.ps1` + +--- + +### 134. `49d629e5` — Update Get-CippApiAuth.ps1 + +| Field | Value | +|-------|-------| +| SHA | `49d629e51778c237f1e5fb4580493e32eb93937c` | +| Author | Zacgoose | +| Date | 2026-05-27 00:31:43 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Get-CippApiAuth.ps1` + +--- + +### 135. `22902b0b` — api fixes + +| Field | Value | +|-------|-------| +| SHA | `22902b0b81b33f8785715fd37ad176e60afade3b` | +| Author | Zacgoose | +| Date | 2026-05-27 01:51:03 +0800 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/New-CIPPAPIConfig.ps1`, `Modules/CIPPCore/Public/Authentication/Repair-CippApiIdentifierUri.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1` + +--- + +### 136. `5561a5b1` — Fix: tenant groups cache issue (#2065) + +| Field | Value | +|-------|-------| +| SHA | `5561a5b1363311d67761ec65644a23476d5ceb41` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 01:09:31 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** (none) + +--- + +### 137. `95d48d1f` — Fix for desktop activations copilot ready test + +| Field | Value | +|-------|-------| +| SHA | `95d48d1fe90a2e57c7459afa1330290ef659ff02` | +| Author | Zacgoose | +| Date | 2026-05-27 13:58:17 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady003.ps1` + +--- + +### 138. `a6fdfe23` — Make all tenants list for SPO sites fast + +| Field | Value | +|-------|-------| +| SHA | `a6fdfe23eb387354bb0c1bd461e8d807e06dcee5` | +| Author | Zacgoose | +| Date | 2026-05-27 13:59:27 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Get-CIPPSharePointSiteUsageReport.ps1` + +--- + +### 139. `122aec8f` — fix for template id casing + +| Field | Value | +|-------|-------| +| SHA | `122aec8f757ac9e96e515b19cd5965c7d8f3e5d3` | +| Author | Zacgoose | +| Date | 2026-05-27 15:00:16 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecStandardsRun.ps1` + +--- + +### 140. `7d3b480e` — Update Invoke-CIPPStandardDefenderCompliancePolicy.ps1 + +| Field | Value | +|-------|-------| +| SHA | `7d3b480edb21d46cea9ae0d21196eab2c670b358` | +| Author | Zacgoose | +| Date | 2026-05-27 16:29:11 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderCompliancePolicy.ps1` + +--- + +### 141. `49153019` — use top 500 to minimise requests + +| Field | Value | +|-------|-------| +| SHA | `491530194c73d6fea5256666d3b46a93ce83a74c` | +| Author | Zacgoose | +| Date | 2026-05-27 16:41:48 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewRiskyUsers.ps1` + +--- + +### 142. `c5b0e592` — smart lockout standard + +| Field | Value | +|-------|-------| +| SHA | `c5b0e59221366cb68a8233590fbc38ee3e5321c6` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 14:23:59 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSmartLockout.ps1` + +--- + +### 143. `c5a8a207` — smart lockout standard + +| Field | Value | +|-------|-------| +| SHA | `c5a8a20739f1cc1265dbb6f0d8cf399e63df51b4` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 14:24:02 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSmartLockout.ps1` + +--- + +### 144. `f85963b7` — Sharepoint management functionality. + +| Field | Value | +|-------|-------| +| SHA | `f85963b72168e37d8820de7a7f469240dc968fd0` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 17:03:21 +0200 | +| Files changed | 5 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Get-CIPPSPOSite.ps1`, `Modules/CIPPCore/Public/Set-CIPPSPOSite.ps1`, `Modules/CIPPCore/Public/Set-CIPPSPOTenant.ps1`, `Modules/CIPPCore/Public/Start-CIPPSiteVersionCleanup.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1` + +--- + +### 145. `b7d4f5e2` — Sharepoint management functionality. + +| Field | Value | +|-------|-------| +| SHA | `b7d4f5e2ca653947ec0ffb8f6403f1ba7407eb6b` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 17:03:26 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1` + +--- + +### 146. `b7c72180` — fix: update terminology from "Temporary Access Password" to "Temporary Access Pass" + +| Field | Value | +|-------|-------| +| SHA | `b7c72180ac5963a3c41211bc2a14e1a9a6bce796` | +| Author | Bobby | +| Date | 2026-05-27 17:11:35 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/standards.json`, `Modules/CIPPCore/Public/New-CIPPTAP.ps1` + +--- + +### 147. `8a536fe8` — Fix: Update terminology from "Temporary Access Password" to "Temporary Access Pass" (#2066) + +| Field | Value | +|-------|-------| +| SHA | `8a536fe8b906400e6401947c94aeff40c5884dd6` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 18:56:01 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** (none) + +--- + +### 148. `bdd86024` — Add version cleanup + +| Field | Value | +|-------|-------| +| SHA | `bdd86024c2b7de08eacc764076ef13b66b87fcca` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 20:24:44 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSPOVersionCleanup.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1` + +--- + +### 149. `e563aea9` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `e563aea970d41ad282f7ef587f849097086b5c89` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 20:24:55 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 150. `829ced81` — feat(mailboxes): cache mailbox and archive usage metrics + +| Field | Value | +|-------|-------| +| SHA | `829ced812ed7c07f63842f63eb6d91f84e326594` | +| Author | Bobby | +| Date | 2026-05-27 22:43:03 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheMailboxes.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxes.ps1` + +--- + +### 151. `0ebb1880` — implement autopatch + +| Field | Value | +|-------|-------| +| SHA | `0ebb18803a9580b06c7bfedd4b07103e2ab2da41` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 23:50:41 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopatchGroup.ps1` + +--- + +### 152. `e41d5322` — Update Add-CIPPDbItem.ps1 + +| Field | Value | +|-------|-------| +| SHA | `e41d5322c698c331c3740b6d9d8d62ceec818971` | +| Author | Zacgoose | +| Date | 2026-05-28 12:49:03 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Add-CIPPDbItem.ps1` + +--- + +### 153. `5b7c5a96` — Update Invoke-ListWorkerHealth.ps1 + +| Field | Value | +|-------|-------| +| SHA | `5b7c5a964b81876324525794b66387574d583c2b` | +| Author | Zacgoose | +| Date | 2026-05-28 13:56:30 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListWorkerHealth.ps1` + +--- + +### 154. `aefa69b0` — add compliance admin by default + +| Field | Value | +|-------|-------| +| SHA | `aefa69b052ed5d74d0a965f9918ac358f44a668d` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 12:31:02 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/GraphHelper/Get-NormalizedError.ps1`, `Modules/CIPPCore/Public/Set-CIPPSAMAdminRoles.ps1` + +--- + +### 155. `25fcdc1c` — add 404 detection for non-existing roles + +| Field | Value | +|-------|-------| +| SHA | `25fcdc1cf1ba33c650e1030ba0b6aa46e4a743eb` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 13:16:55 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Set-CIPPSAMAdminRoles.ps1` + +--- + +### 156. `25e2b0f2` — tweaks + +| Field | Value | +|-------|-------| +| SHA | `25e2b0f2cfa9f73ab3e61d630574b0fe91ce9498` | +| Author | Zacgoose | +| Date | 2026-05-28 20:50:50 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAdminPassword.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListWorkerHealth.ps1` + +--- + +### 157. `99dd88c5` — optimisation + +| Field | Value | +|-------|-------| +| SHA | `99dd88c54197a92ba31c5f03b312c7931bac936b` | +| Author | Zacgoose | +| Date | 2026-05-28 21:00:14 +0800 | +| Files changed | 8 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BPA/Push-BPACollectData.ps1`, `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderMalware.ps1`, `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderStatus.ps1`, `Modules/CIPPCore/Public/Add-CIPPBPAField.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-AddAPDevice.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBranding.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishProtection.ps1`, `Modules/CippExtensions/Public/New-CippExtAlert.ps1` + +--- + +### 158. `0cdc2e81` — new auth methods single standard + +| Field | Value | +|-------|-------| +| SHA | `0cdc2e813bf8e713b8f0402f4735ff93b695e6ca` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 15:21:15 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Set-CIPPAuthenticationPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthenticationMethods.ps1` + +--- + +### 159. `fc080e4a` — new auth methods single standard + +| Field | Value | +|-------|-------| +| SHA | `fc080e4afdecd4076e5a68fe581c75515ce34f26` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 15:21:19 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthenticationMethods.ps1` + +--- + +### 160. `a1179a21` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `a1179a21a4a78cea0e68715ff383095e7e77e1e8` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 15:21:20 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 161. `55fea61a` — Feat: Add online archive report functionality for mailboxes (#2067) + +| Field | Value | +|-------|-------| +| SHA | `55fea61a0667b35c9ca1302fb8f609322d9b45e2` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 16:21:11 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Email | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Exchange/Email changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 162. `1f9fb1fd` — test invocation optimisations + +| Field | Value | +|-------|-------| +| SHA | `1f9fb1fd96197138746753ebede0ed11c6df92cc` | +| Author | Zacgoose | +| Date | 2026-05-28 23:44:50 +0800 | +| Files changed | 4 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListWorkerHealth.ps1`, `Shared/CIPPSharp/CIPPTestDataCache.cs`, `Shared/CIPPSharp/bin/CIPPSharp.dll` + +--- + +### 163. `1ac506d7` — fix: update endpoint roles to use Autopilot.Read + +| Field | Value | +|-------|-------| +| SHA | `1ac506d73e26a4f6f12653ff5cc3b797064b582d` | +| Author | Bobby | +| Date | 2026-05-28 21:23:47 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAndroidEnrollmentProfiles.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppleEnrollmentProfiles.ps1` + +--- + +### 164. `3f03634f` — Update Initialize-CIPPAuth.ps1 + +| Field | Value | +|-------|-------| +| SHA | `3f03634f66cfaf0abd9fce128e5f6e0167d68c8f` | +| Author | Zacgoose | +| Date | 2026-05-29 08:11:21 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1` + +--- + +### 165. `e0f45f20` — Backup excluded tenants config + +| Field | Value | +|-------|-------| +| SHA | `e0f45f2035c77c7b8916a605a8d2e13ccd1c80d9` | +| Author | Zacgoose | +| Date | 2026-05-29 14:41:44 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/New-CIPPBackup.ps1` + +--- + +### 166. `e3d57cf0` — Update Invoke-CIPPStandardDeployCheckChromeExtension.ps1 + +| Field | Value | +|-------|-------| +| SHA | `e3d57cf0ae0ef981173205cf0eaa6d5b26e3f371` | +| Author | Zacgoose | +| Date | 2026-05-29 17:43:32 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1` + +--- + +### 167. `a17137cb` — chore: remove cipp processor queue + +| Field | Value | +|-------|-------| +| SHA | `a17137cbe0abe8418d43791ed751300b0ed84723` | +| Author | John Duprey | +| Date | 2026-05-29 14:19:45 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/CIPPTimers.json`, `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPProcessorQueue.ps1` + +--- + +### 168. `0fd3315b` — chore: disable cippcommand action + +| Field | Value | +|-------|-------| +| SHA | `0fd3315b9d405ed4d459ac3c8f740a640fb74099` | +| Author | John Duprey | +| Date | 2026-05-29 14:31:14 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Webhooks/Invoke-CIPPWebhookProcessing.ps1` + +--- + +### 169. `e98445f2` — chore: sanitize cippid in public webhooks + +| Field | Value | +|-------|-------| +| SHA | `e98445f25614437873439fe27a2b0f0e95d5dc69` | +| Author | John Duprey | +| Date | 2026-05-29 15:07:33 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-PublicWebhooks.ps1` + +--- + +### 170. `38e3ae9e` — chore: block arbitrary cmdlets not in CIPP modules + +| Field | Value | +|-------|-------| +| SHA | `38e3ae9e070ba05968a07647d137efc0ae2491b3` | +| Author | John Duprey | +| Date | 2026-05-29 15:27:21 -0400 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1`, `Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1`, `Modules/CIPPCore/Public/Tools/Get-CIPPSchedulerBlockedCommands.ps1` + +--- + +### 171. `c18bda87` — fix: optimize checks + +| Field | Value | +|-------|-------| +| SHA | `c18bda8795693324d834f54fe9235959e0e3372f` | +| Author | John Duprey | +| Date | 2026-05-29 15:31:19 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1` + +--- + +### 172. `c69e2ce1` — fix: allow for command without .value + +| Field | Value | +|-------|-------| +| SHA | `c69e2ce19d7c8c0df0cd2c4f2de9db936da5c736` | +| Author | John Duprey | +| Date | 2026-05-29 15:33:15 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1` + +--- + +### 173. `da7bd8c4` — chore: add devsecrets to restricted tables + +| Field | Value | +|-------|-------| +| SHA | `da7bd8c459ab0e75abbcc9a0be96224848a11284` | +| Author | John Duprey | +| Date | 2026-05-29 15:43:15 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRestoreBackup.ps1` + +--- + +### 174. `2ed3f94c` — chore: remove write host + +| Field | Value | +|-------|-------| +| SHA | `2ed3f94c91dcfabbc1dbd773c25120bc712801d7` | +| Author | John Duprey | +| Date | 2026-05-29 15:44:24 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecTokenExchange.ps1` + +--- + +### 175. `f5f37368` — Optimize CIPP DB orchestration + +| Field | Value | +|-------|-------| +| SHA | `f5f373681cd6e48c3b27b7140d46115c18f828a7` | +| Author | Zacgoose | +| Date | 2026-05-30 12:18:36 +0800 | +| Files changed | 207 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/CIPPDBCache/Push-ExecCIPPDBCache.ps1`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTest.ps1`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsList.ps1`, `Modules/CIPPCore/Public/Add-CIPPDbItem.ps1`, `Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPDBTestsRun.ps1`, `Modules/CIPPCore/Public/Get-CIPPDbItem.ps1`, `Modules/CIPPCore/Public/Get-CIPPDomainAnalyser.ps1`, `Modules/CIPPCore/Public/Get-CippDbRole.ps1`, `Modules/CIPPCore/Public/Get-CippDbRoleMembers.ps1`, `Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1`, `Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1`, `Modules/CIPPCore/Public/New-CIPPDbRequest.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDbCacheTestData.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_2.ps1` … (+192 more) + +--- + +### 176. `7caadb22` — fixes + +| Field | Value | +|-------|-------| +| SHA | `7caadb22cd4a5525adf2959f158301836e8ba0ce` | +| Author | Zacgoose | +| Date | 2026-05-30 14:42:49 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Shared/CIPPSharp/CIPPSharp.csproj`, `Shared/CIPPSharp/bin/CIPPSharp.dll` + +--- + +### 177. `11e613aa` — cleanup + +| Field | Value | +|-------|-------| +| SHA | `11e613aab2d6886caa68e5ceb80f39e0a25293f0` | +| Author | Zacgoose | +| Date | 2026-05-30 15:55:25 +0800 | +| Files changed | 3 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/CIPPDBCache/Push-ExecCIPPDBCache.ps1`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTest.ps1`, `Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1` + +--- + +### 178. `dd8952e4` — reduce memory + +| Field | Value | +|-------|-------| +| SHA | `dd8952e4e9b458a33ba232d09d5103df9267016f` | +| Author | Zacgoose | +| Date | 2026-05-30 18:57:49 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-SchedulerCIPPNotifications.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListLogs.ps1` + +--- + +### 179. `518855cc` — test optimisation + +| Field | Value | +|-------|-------| +| SHA | `518855cc2af7527eea203002c643ef0a687caeb0` | +| Author | Zacgoose | +| Date | 2026-05-30 23:27:13 +0800 | +| Files changed | 33 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_2.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_5.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_9.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_4_2.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_5_2_3_4.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_8_1_1.ps1`, `Modules/CIPPTests/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO111.ps1`, `Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady015.ps1`, `Modules/CIPPTests/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAS04.ps1`, `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest004.ps1`, `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest005.ps1`, `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest006.ps1`, `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest007.ps1`, `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest008.ps1`, `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest011.ps1` … (+18 more) + +--- + +### 180. `999f0283` — Fix TenantAllowBlockListTemplate always reporting non-compliant + +| Field | Value | +|-------|-------| +| SHA | `999f0283f8a7e273cd34c48978b6ff8cefef7ddb` | +| Author | Chris Dewey | +| Date | 2026-05-31 12:20:16 +0100 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantAllowBlockListTemplate.ps1` + +--- + +### 181. `7b341600` — update openapi spec with generated one + +| Field | Value | +|-------|-------| +| SHA | `7b341600ea66916a6393af4882ed9e2e55a58a51` | +| Author | KelvinTegelaar | +| Date | 2026-05-31 22:52:53 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `openapi.json` + +--- + +### 182. `44780652` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `44780652e874f77b413ecbf15053873d1ab66036` | +| Author | KelvinTegelaar | +| Date | 2026-05-31 22:53:22 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 183. `8341f49d` — Test + +| Field | Value | +|-------|-------| +| SHA | `8341f49d863900a36070225eb9c39b0813c91c94` | +| Author | KelvinTegelaar | +| Date | 2026-05-31 23:15:16 +0200 | +| Files changed | 4 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Get-CippMcpSpec.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Get-CippMcpToolList.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Get-CippMcpToolResult.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1` + +--- + +### 184. `26a87b27` — add-member force + +| Field | Value | +|-------|-------| +| SHA | `26a87b279488aa2375d055e1aefbf5c20f33004a` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 00:49:42 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1` + +--- + +### 185. `2a2851b5` — sso auth + +| Field | Value | +|-------|-------| +| SHA | `2a2851b57a7a19f2105f2d892cab3c1b94df953d` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 00:58:30 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Set-CIPPSSOEasyAuth.ps1` + +--- + +### 186. `acf4bf33` — Add or update the Azure App Service build and deployment workflow config + +| Field | Value | +|-------|-------| +| SHA | `acf4bf337f4545c5fc5fce2b93c540023c100c91` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 01:05:53 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `.github/workflows/dev_cippjta72.yml` + +--- + +### 187. `72f7882f` — fixes another add member + +| Field | Value | +|-------|-------| +| SHA | `72f7882fe5c042f4e05353e8fe27a10c6d4a5456` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 01:16:02 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1` + +--- + +### 188. `fad627f8` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `fad627f85ab6b1b3541c3d0c5de18649c358a7bf` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 01:16:04 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 189. `54a3a082` — api auth save and get changes + +| Field | Value | +|-------|-------| +| SHA | `54a3a0821de35a718357f26c98be908f3bbf1a7b` | +| Author | Zacgoose | +| Date | 2026-06-01 12:39:14 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Get-CippApiAuth.ps1`, `Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1` + +--- + +### 190. `c16557ff` — Guarding for cache collection items + +| Field | Value | +|-------|-------| +| SHA | `c16557ff6587406decf70f6d47d7fe3014da473b` | +| Author | Zacgoose | +| Date | 2026-06-01 22:26:01 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheOneDriveUsage.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointSiteUsage.ps1` + +--- + +### 191. `4b4a2d1d` — Update Set-CIPPDBCacheSharePointSiteUsage.ps1 + +| Field | Value | +|-------|-------| +| SHA | `4b4a2d1d7e97aa30525e84a11ef3fc8c89d9dae9` | +| Author | Zacgoose | +| Date | 2026-06-01 23:01:23 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointSiteUsage.ps1` + +--- + +### 192. `f3393cb9` — Update Invoke-ExecUniversalSearchV2.ps1 + +| Field | Value | +|-------|-------| +| SHA | `f3393cb9b163ff916b8882dbaaaaf981d3ae80c8` | +| Author | Zacgoose | +| Date | 2026-06-02 00:09:02 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecUniversalSearchV2.ps1` + +--- + +### 193. `9d8f1a0d` — correct incorrect pathing + +| Field | Value | +|-------|-------| +| SHA | `9d8f1a0dafc1dff686e1501e0bdf9e493b3dea3b` | +| Author | Zacgoose | +| Date | 2026-06-02 00:12:25 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Add-CIPPW32ScriptApplication.ps1` + +--- + +### 194. `a40683c5` — fix: access issues related to undefined roles + +| Field | Value | +|-------|-------| +| SHA | `a40683c560c66ebcd4164515fda9bcf68715bc37` | +| Author | John Duprey | +| Date | 2026-06-01 13:51:15 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1` + +--- + +### 195. `3c19e629` — fix: ip restriction logic + +| Field | Value | +|-------|-------| +| SHA | `3c19e6299a87afa75b05726e2609e9b6da2734d8` | +| Author | John Duprey | +| Date | 2026-06-01 13:59:15 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1` + +--- + +### 196. `648127f7` — fix: role for EditIntunePolicy + +| Field | Value | +|-------|-------| +| SHA | `648127f731f598547988e5dd3c581ae1eef225e1` | +| Author | John Duprey | +| Date | 2026-06-01 14:01:03 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-EditIntunePolicy.ps1` + +--- + +### 197. `679c3905` — fix: validate token exchange url is microsoft + +| Field | Value | +|-------|-------| +| SHA | `679c390558470782a3b6badc7942484049840817` | +| Author | John Duprey | +| Date | 2026-06-01 14:13:52 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecTokenExchange.ps1` + +--- + +### 198. `139b0c60` — fix: sanitize more odata paths for tables + +| Field | Value | +|-------|-------| +| SHA | `139b0c606ac3d6ed23af64001ab25bd4d70c0806` | +| Author | John Duprey | +| Date | 2026-06-01 14:30:43 -0400 | +| Files changed | 5 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItemDetails.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecWebhookSubscriptions.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxRules.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListKnownIPDb.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPInvite.ps1` + +--- + +### 199. `a9797cd9` — chore: cleanup redundant tenant check in listexorequest + +| Field | Value | +|-------|-------| +| SHA | `a9797cd95bb25a536e1172b3e2595c6fc8c592ea` | +| Author | John Duprey | +| Date | 2026-06-01 14:41:56 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListExoRequest.ps1` + +--- + +### 200. `ac338417` — add featureflag for mcp + +| Field | Value | +|-------|-------| +| SHA | `ac3384171d30463c06baff35679b63d33959585a` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 21:05:23 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Settings | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `Config/FeatureFlags.json` + +--- + +### 201. `468fb307` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `468fb30702f3e6ae2fdd39a751319a4de2648c9f` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 21:05:25 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 202. `235bd855` — fix: validate and sanitize msp/choco app params + +| Field | Value | +|-------|-------| +| SHA | `235bd855f2eb1e041198a767926bd70b5f279849` | +| Author | John Duprey | +| Date | 2026-06-01 15:07:38 -0400 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/ConvertTo-CIPPSafePwshArg.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddChocoApp.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddMSPApp.ps1` + +--- + +### 203. `256e9fc4` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `256e9fc4762663bd50f4eaa886a069ca0c7810c0` | +| Author | John Duprey | +| Date | 2026-06-01 15:16:54 -0400 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 204. `0c5d2bb8` — Fix TenantAllowBlockListTemplate always reporting non-compliant (#2069) + +| Field | Value | +|-------|-------| +| SHA | `0c5d2bb8f9b105c933ce717edd2a768c32309749` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 22:51:46 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** (none) + +--- + +### 205. `55a97db2` — added logging + +| Field | Value | +|-------|-------| +| SHA | `55a97db2c4165b456b2c210d9bf0eff3c5f364bd` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 23:31:28 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Invoke-ExecOffboardTenant.ps1` + +--- + +### 206. `0c54cd16` — fix: move New-CIPPCoreRequest back to CIPPCore + +| Field | Value | +|-------|-------| +| SHA | `0c54cd16abf70bbebcd5711acf308e66bdfc8847` | +| Author | John Duprey | +| Date | 2026-06-01 18:21:07 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1` + +--- + +### 207. `5a3b4259` — fix: Update endpoint roles to use Autopilot.Read (#2068) + +| Field | Value | +|-------|-------| +| SHA | `5a3b42599f2005ffe20ea5629b7ae7eb35cdbbd1` | +| Author | KelvinTegelaar | +| Date | 2026-06-02 00:24:06 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 208. `2492ad4f` — customsubject fix + +| Field | Value | +|-------|-------| +| SHA | `2492ad4ffa3c17c8d79a8e8e7b0e09e6e969a0ba` | +| Author | KelvinTegelaar | +| Date | 2026-06-02 00:44:44 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Webhooks/Invoke-CIPPWebhookProcessing.ps1` + +--- + +### 209. `28752144` — unique + +| Field | Value | +|-------|-------| +| SHA | `287521447902e5611303f14e46045279b0abeca7` | +| Author | KelvinTegelaar | +| Date | 2026-06-02 00:47:14 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneTenantSync.ps1` + +--- + +### 210. `3f9dbd9f` — new licence report endpoint and revert old endpoint + +| Field | Value | +|-------|-------| +| SHA | `3f9dbd9fcbc26fb671950ba00162f89ebade7472` | +| Author | Zacgoose | +| Date | 2026-06-02 07:30:18 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListLicenses.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicensesReport.ps1` + +--- + +### 211. `3f842abc` — fix: explicitly remove tenant from the table instead of using -cleanold + +| Field | Value | +|-------|-------| +| SHA | `3f842abc805d82fcd12f3d526b1dd66fa5cb9764` | +| Author | John Duprey | +| Date | 2026-06-02 10:13:12 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Invoke-ExecOffboardTenant.ps1` + +--- + +### 212. `55ddb18b` — Update Invoke-ExecTestRun.ps1 + +| Field | Value | +|-------|-------| +| SHA | `55ddb18b23e73d0ed21f12c7ceadb40d87822c7a` | +| Author | Zacgoose | +| Date | 2026-06-03 07:12:50 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecTestRun.ps1` + +--- + +### 213. `1167ff5b` — caching bump + +| Field | Value | +|-------|-------| +| SHA | `1167ff5bd293fccad0a5c51919c85449982636fc` | +| Author | Zacgoose | +| Date | 2026-06-03 08:09:45 +0800 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Shared/CIPPSharp/CIPPTestDataCache.cs`, `Shared/CIPPSharp/bin/CIPPSharp.dll` + +--- + +### 214. `6eeb31b4` — Pluralize standard name and continue on error + +| Field | Value | +|-------|-------| +| SHA | `6eeb31b4661478bf527d3ef1fa3543f99d18f60a` | +| Author | Zacgoose | +| Date | 2026-06-03 12:12:23 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployContactTemplates.ps1` + +--- + +### 215. `058da5e0` — rework mail contact standard and lazy load modules when needed + +| Field | Value | +|-------|-------| +| SHA | `058da5e0d615c944b4cc6a11878a1d4602c3397d` | +| Author | Zacgoose | +| Date | 2026-06-03 12:51:53 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployContactTemplates.ps1` + +--- + +### 216. `2edc7592` — Handle PendingAcceptance guests and update reporting + +| Field | Value | +|-------|-------| +| SHA | `2edc759287485c1e4cec76e345a04323457a63c3` | +| Author | Zacgoose | +| Date | 2026-06-03 14:11:33 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableGuests.ps1` + +--- + +### 217. `64efbd97` — Apply multiple fixes to the add member to exo groups flow including adding new users with auto retry + +| Field | Value | +|-------|-------| +| SHA | `64efbd97477f8fe0ce907f7534c253d6b7239d01` | +| Author | Zacgoose | +| Date | 2026-06-03 14:38:32 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Add-CIPPGroupMember.ps1`, `Modules/CIPPCore/Public/New-CIPPUserTask.ps1` + +--- + +### 218. `a9be2729` — Update Invoke-CIPPStandardEnableExchangeCloudManagement.ps1 + +| Field | Value | +|-------|-------| +| SHA | `a9be2729d883ffeceb8c6eaf06998fc4e6175c40` | +| Author | Zacgoose | +| Date | 2026-06-03 14:39:44 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableExchangeCloudManagement.ps1` + +--- + +### 219. `3e99e667` — add mcp allowed + +| Field | Value | +|-------|-------| +| SHA | `3e99e667d8fe5e6326cc465fa45264df817e5938` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 13:37:04 +0200 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Get-CippApiClient.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1` + +--- + +### 220. `a2c2524c` — oauth prm + +| Field | Value | +|-------|-------| +| SHA | `a2c2524c02ad0a6e66440beef1091f7a05714808` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 16:16:02 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1` + +--- + +### 221. `1fc42631` — feat: add Email as alternate login ID standard + +| Field | Value | +|-------|-------| +| SHA | `1fc4263123219960af1ec87558f8cd73b7a62a7f` | +| Author | Bobby | +| Date | 2026-06-03 16:54:13 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEmailAsAlternateLoginId.ps1` + +--- + +### 222. `5c81043c` — change resource usage to craft well known + +| Field | Value | +|-------|-------| +| SHA | `5c81043c08757d3b340414b9fe2d865c1a1ca612` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 17:41:01 +0200 | +| Files changed | 7 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `CIPPHttpTrigger/function.json`, `CIPPWellKnown/function.json`, `Modules/CIPPCore/Public/Authentication/Set-CIPPSSOEasyAuth.ps1`, `Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1`, `Modules/CippEntrypoints/CippEntrypoints.psm1`, `host.json` + +--- + +### 223. `6fc7d357` — Revert custom well known + +| Field | Value | +|-------|-------| +| SHA | `6fc7d357ee34ea694b96028815d2f9eacfc715e5` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 18:18:49 +0200 | +| Files changed | 7 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `CIPPHttpTrigger/function.json`, `CIPPWellKnown/function.json`, `Modules/CIPPCore/Public/Authentication/Set-CIPPSSOEasyAuth.ps1`, `Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1`, `Modules/CippEntrypoints/CippEntrypoints.psm1`, `host.json` + +--- + +### 224. `0cd6f9d2` — MCP client updates to support client auth + +| Field | Value | +|-------|-------| +| SHA | `0cd6f9d2d630e1c9561103fa4f3c1fefa95d33a5` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 19:25:55 +0200 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1`, `Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1` + +--- + +### 225. `ec2eb836` — add logging to mcp reation. + +| Field | Value | +|-------|-------| +| SHA | `ec2eb836f775584f85f06de10d8ad53d59e07334` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 20:05:50 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1` + +--- + +### 226. `49e8af8b` — feat: add Invoke-ExecSetCASMailbox function for CAS settings management + +| Field | Value | +|-------|-------| +| SHA | `49e8af8b9d9b867c9a44f12bfc536c02890e4af7` | +| Author | Bobby | +| Date | 2026-06-03 19:24:52 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetCASMailbox.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListMailboxCAS.ps1` + +--- + +### 227. `23506364` — add tot non-ng + +| Field | Value | +|-------|-------| +| SHA | `235063643757177c83cc380d14af2464f921f897` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 20:38:08 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1` + +--- + +### 228. `72c277d7` — Allow MCP client + +| Field | Value | +|-------|-------| +| SHA | `72c277d77f26595a99f65af7726029e6ea87e362` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 20:56:18 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1` + +--- + +### 229. `7800b3cb` — Fix + +| Field | Value | +|-------|-------| +| SHA | `7800b3cb14db994b1867a4f6f5bb1116e818e336` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 21:22:27 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1` + +--- + +### 230. `77073ba3` — role change + +| Field | Value | +|-------|-------| +| SHA | `77073ba369222e427671f8c75ba07facfbb08a2e` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 23:49:53 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1` + +--- + +### 231. `bc6aee43` — fix: quarantine deny action + +| Field | Value | +|-------|-------| +| SHA | `bc6aee43b74cd0672d858b9d31effbda6283847a` | +| Author | John Duprey | +| Date | 2026-06-03 21:33:32 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecQuarantineManagement.ps1` + +--- + +### 232. `4288bd80` — exclude partner tenant + +| Field | Value | +|-------|-------| +| SHA | `4288bd80f1d901e73c9054c887f8b9d3d2068da3` | +| Author | Zacgoose | +| Date | 2026-06-04 16:04:01 +0800 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/TenantGroups/Get-TenantGroups.ps1`, `Modules/CIPPCore/Public/TenantGroups/Update-CIPPDynamicTenantGroups.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCreateDefaultGroups.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTenantGroup.ps1` + +--- + +### 233. `adba8fa7` — add excludeFromAlert to licenses. + +| Field | Value | +|-------|-------| +| SHA | `adba8fa7febc74db4fe15f8e06941a9ce3d58540` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:21:33 +0200 | +| Files changed | 8 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertExpiringLicenses.ps1`, `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertOverusedLicenses.ps1`, `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUnusedLicenses.ps1`, `Modules/CIPPCore/Public/Get-CIPPLicenseOverview.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecExcludeLicenses.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListExcludedLicenses.ps1`, `Modules/CippExtensions/Public/Extension Functions/Sync-CippExtensionData.ps1`, `Modules/CippExtensions/Public/Gradient/New-GradientServiceSyncRun.ps1` + +--- + +### 234. `9a176cc7` — feat: Add Group-Based Licensing support (#2063) + +| Field | Value | +|-------|-------| +| SHA | `9a176cc7b6a3177b1ff04d8261273b6a863ff9ca` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:26:32 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 235. `593911e1` — Feat: Add Invoke-ExecSetCASMailbox function for CAS settings management (#2076) + +| Field | Value | +|-------|-------| +| SHA | `593911e1ca62e68f21ee7ed971b39d63b1818406` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:36:51 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Email | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Exchange/Email changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 236. `a8e7aa5e` — Feat: Add Email as alternate login ID standard (#2075) + +| Field | Value | +|-------|-------| +| SHA | `a8e7aa5eac2e442cb7354faa214420d9bede3379` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:37:04 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Email | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Exchange/Email changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 237. `2b3a7bb5` — resolves #6096 + +| Field | Value | +|-------|-------| +| SHA | `2b3a7bb50bc8c42c79dd9147baa46ef9e2e2ae1f` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:40:42 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditUser.ps1` + +--- + +### 238. `ae921278` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `ae921278dbba126ac8aad7c25bb5cc2b00dbd5a6` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:40:44 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 239. `53db433c` — better descriptions + +| Field | Value | +|-------|-------| +| SHA | `53db433cdee8008bd93188053151e692abdba4e0` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 13:49:57 +0200 | +| Files changed | 21 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows, Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListCalendarPermissions.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListHVEAccounts.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxRules.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxes.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListmailboxPermissions.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListMailboxForwarding.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListApps.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppProtectionPolicies.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAssignmentFilters.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListCompliancePolicies.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntunePolicy.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneReusableSettings.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneScript.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroups.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Reports/Invoke-ListMFAUsers.ps1` … (+6 more) + +--- + +### 240. `c7cebfeb` — better descriptions + +| Field | Value | +|-------|-------| +| SHA | `c7cebfeb4ff1cb4565926cf653b62c92a96cd505` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 13:50:07 +0200 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListCalendarPermissions.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListHVEAccounts.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListOAuthApps.ps1` + +--- + +### 241. `6a1c3733` — fixes issue with all tenants retrieval + +| Field | Value | +|-------|-------| +| SHA | `6a1c373363007e65c6cd2cac5ee6bd568d608c3e` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 15:08:35 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListDBCache.ps1` + +--- + +### 242. `4909e9c2` — dbcache desc + +| Field | Value | +|-------|-------| +| SHA | `4909e9c2094e9ad497d2c5decfe3f3d1070f6a26` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 15:09:37 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListDBCache.ps1` + +--- + +### 243. `3ca58875` — updated descriptions. + +| Field | Value | +|-------|-------| +| SHA | `3ca58875ac346e65937655ced8cf044603df75ca` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 15:17:52 +0200 | +| Files changed | 160 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal, Tenant Workflows, Permissions/Roles/Auth, Standards/Alignment Custom; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListAdminPortalLicenses.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListApiTest.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListCustomDataMappings.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListDiagnosticsPresets.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListDirectoryObjects.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListFeatureFlags.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphBulkRequest.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphRequest.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListSnoozedAlerts.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/invoke-ListEmptyResults.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ListExtensionSync.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItemDetails.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItems.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCIPPUsers.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListContainerLogs.ps1` … (+145 more) + +--- + +### 244. `7902097a` — add missing return + +| Field | Value | +|-------|-------| +| SHA | `7902097acf76faf4ee0b6a80f2dff8cf2b0c3abd` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 22:07:50 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecUpdateRefreshToken.ps1` + +--- + +### 245. `65659c21` — fix: remove headers parameter from scheduler details/list + +| Field | Value | +|-------|-------| +| SHA | `65659c21ffad84702b6a6f62e83a39a6e59a42d9` | +| Author | John Duprey | +| Date | 2026-06-04 16:23:35 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItemDetails.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItems.ps1` + +--- + +### 246. `c5d15588` — fix: version check + +| Field | Value | +|-------|-------| +| SHA | `c5d15588e31b2591514b2682d6301e9a60559c0a` | +| Author | John Duprey | +| Date | 2026-06-04 19:59:00 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Assert-CippVersion.ps1` + +--- + +### 247. `c5849381` — fix: fallback to app version if one is not specified + +| Field | Value | +|-------|-------| +| SHA | `c5849381984688f46eeb6c71e0f6ffc59acde285` | +| Author | John Duprey | +| Date | 2026-06-04 20:20:08 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Assert-CippVersion.ps1` + +--- + +### 248. `d4ddd3d6` — fix: additional protections for choco app deployment + +| Field | Value | +|-------|-------| +| SHA | `d4ddd3d6ff34f7a214bc58eae32eb7477b7b076e` | +| Author | John Duprey | +| Date | 2026-06-04 23:12:34 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/New-CIPPIntuneAppDeployment.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddChocoApp.ps1` + +--- + +### 249. `2bbcfcc8` — This endpoint is silly, we are going to manually try paging + +| Field | Value | +|-------|-------| +| SHA | `2bbcfcc825d0081fe7add434e41ee02ab3dbb468` | +| Author | Zacgoose | +| Date | 2026-06-05 16:50:55 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ListMailQuarantineAllTenants.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1` + +--- + +### 250. `90e45ead` — pass timing to stop queue rerun protection drift + +| Field | Value | +|-------|-------| +| SHA | `90e45eadaac33b4991b18038c78a3a44e161a05e` | +| Author | Zacgoose | +| Date | 2026-06-05 17:51:43 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandard.ps1`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandardsList.ps1` + +--- + +### 251. `3fa0ee6c` — Pipe character escaping in names + +| Field | Value | +|-------|-------| +| SHA | `3fa0ee6c412cec4e9a6a3dade4befa21dcffc885` | +| Author | Zacgoose | +| Date | 2026-06-05 18:20:42 +0800 | +| Files changed | 4 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPCore/Public/Tools/Push-ExecGenerateReportBuilderReport.ps1`, `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest004.ps1`, `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest005.ps1`, `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest006.ps1` + +--- + +### 252. `2b3a1c81` — Fix for manually run standards being excluded from applied standards report page + +| Field | Value | +|-------|-------| +| SHA | `2b3a1c818be171adbd6526f1069447a43f1801b0` | +| Author | Zacgoose | +| Date | 2026-06-05 18:27:17 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListStandardsCompare.ps1` + +--- + +### 253. `4435ea38` — CA expansion for tags + +| Field | Value | +|-------|-------| +| SHA | `4435ea380685a4bad5a9e7506aba54f0cfc861ae` | +| Author | KelvinTegelaar | +| Date | 2026-06-05 13:17:04 +0200 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Standards/Alignment Custom; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1`, `Modules/CIPPCore/Public/Get-CIPPDrift.ps1`, `Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-listStandardTemplates.ps1` + +--- + +### 254. `9cab0663` — CA expansion for tags + +| Field | Value | +|-------|-------| +| SHA | `9cab066385d0b71f0879a0a438e0e6ed4949a698` | +| Author | KelvinTegelaar | +| Date | 2026-06-05 13:17:13 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Standards/Alignment Custom; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1`, `Modules/CIPPCore/Public/Get-CIPPDrift.ps1` + +--- + +### 255. `2b093c37` — fixes issue with CA compare and a weird blank line + +| Field | Value | +|-------|-------| +| SHA | `2b093c37ad3444f546efec5ad157270e7b540ba9` | +| Author | KelvinTegelaar | +| Date | 2026-06-05 13:36:39 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1` + +--- + +### 256. `f7f51cc1` — remove duplicate non gated cache collection items + +| Field | Value | +|-------|-------| +| SHA | `f7f51cc192a3e11238deef55a38ed6e43dfaa076` | +| Author | Zacgoose | +| Date | 2026-06-05 21:00:58 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1` + +--- + +### 257. `ed47810f` — Update Test-CIPPAccess.ps1 + +| Field | Value | +|-------|-------| +| SHA | `ed47810fdf281fc4366eb76fea9fb843c8cdd108` | +| Author | Zacgoose | +| Date | 2026-06-05 21:47:33 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1` + +--- + +### 258. `c040658a` — Update FeatureFlags.json + +| Field | Value | +|-------|-------| +| SHA | `c040658ade0890d26514364d2d1f7ff5a4b528fe` | +| Author | Zacgoose | +| Date | 2026-06-05 21:59:25 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Settings | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `Config/FeatureFlags.json` + +--- + +### 259. `612ba54c` — Update Get-CIPPTenantAlignment.ps1 + +| Field | Value | +|-------|-------| +| SHA | `612ba54ca20e033be1dd5977efd3720f57b97f18` | +| Author | Zacgoose | +| Date | 2026-06-05 22:44:44 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Standards/Alignment Custom; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1` + +--- + +### 260. `f0f361d4` — restart helper + +| Field | Value | +|-------|-------| +| SHA | `f0f361d4b40b9bbab1116eb4aeb8c781afca57f1` | +| Author | Zacgoose | +| Date | 2026-06-05 23:28:22 +0800 | +| Files changed | 5 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1`, `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-ContainerUpdateCheck.ps1`, `Modules/CIPPCore/Public/Functions/Request-CIPPRestart.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecContainerManagement.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecSSOSetup.ps1` + +--- + +### 261. `961462f3` — fix: role assignment checks + +| Field | Value | +|-------|-------| +| SHA | `961462f346d5b8fe357dc322e550dee95a644232` | +| Author | John Duprey | +| Date | 2026-06-05 12:05:46 -0400 | +| Files changed | 5 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_2.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_3.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_4.ps1`, `Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21782.ps1` + +--- + +### 262. `503eac5b` — fix: apps and services test + +| Field | Value | +|-------|-------| +| SHA | `503eac5bdb6322f1e42b8e90cc48ab9f3b4c4c5b` | +| Author | John Duprey | +| Date | 2026-06-05 12:18:30 -0400 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSettings.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_3_4.ps1` + +--- + +### 263. `ee1884f7` — add permissions for new settings endpoint + +| Field | Value | +|-------|-------| +| SHA | `ee1884f7cc5e32fe77ae90d35028f5dfc0761e23` | +| Author | John Duprey | +| Date | 2026-06-05 12:22:09 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** `Config/SAMManifest.json` + +--- + +### 264. `d817b6d2` — fix: cis test 1_3_5 + +| Field | Value | +|-------|-------| +| SHA | `d817b6d2815abb63cd81c4ffcc31d5deb15b35a2` | +| Author | John Duprey | +| Date | 2026-06-05 12:45:31 -0400 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSettings.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_3_5.ps1` + +--- + +### 265. `da10bf92` — renumber for cis7 + +| Field | Value | +|-------|-------| +| SHA | `da10bf92a82e9c791d2c32f6dd0b7b057baac067` | +| Author | KelvinTegelaar | +| Date | 2026-06-06 00:46:28 +0200 | +| Files changed | 299 | +| Risk | **Low** | +| Area | Docs | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Medium | +| Notes | Buckets: Documentation-only | + +**Files:** `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.md`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_2.md`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_2.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_3.md`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_3.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_4.md`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_4.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_1.md`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_1.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_2.md`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_2.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_3_1.md`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_3_1.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_3_2.md` … (+284 more) + +--- + +### 266. `5df315b6` — improved open api spec for ai + +| Field | Value | +|-------|-------| +| SHA | `5df315b6c86356251eb341fbdb6aac773daf9e7d` | +| Author | KelvinTegelaar | +| Date | 2026-06-06 21:00:02 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `openapi.json` + +--- + +### 267. `65ba7a78` — embed module into pipeline actions + +| Field | Value | +|-------|-------| +| SHA | `65ba7a7880657dd81d745ba677a7c57f27f7ee50` | +| Author | Zacgoose | +| Date | 2026-06-07 13:24:52 +0800 | +| Files changed | 5 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Tools/Build-DevApiModules.ps1`, `Tools/ModuleBuilder/3.1.8/ModuleBuilder.psd1`, `Tools/ModuleBuilder/3.1.8/ModuleBuilder.psm1`, `Tools/ModuleBuilder/3.1.8/PSGetModuleInfo.xml`, `Tools/ModuleBuilder/3.1.8/en-US/about_ModuleBuilder.help.txt` + +--- + +### 268. `431d2929` — extra module dep + +| Field | Value | +|-------|-------| +| SHA | `431d29296def585602ede34296810881bc4d1d94` | +| Author | Zacgoose | +| Date | 2026-06-07 13:30:34 +0800 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Tools/Build-DevApiModules.ps1`, `Tools/Configuration/1.6.0/Configuration.psd1`, `Tools/Configuration/1.6.0/Configuration.psm1`, `Tools/Configuration/1.6.0/PSGetModuleInfo.xml` + +--- + +### 269. `336909e8` — extra module dep + +| Field | Value | +|-------|-------| +| SHA | `336909e8837a835b113a92d6db94b4b23d83e678` | +| Author | Zacgoose | +| Date | 2026-06-07 13:32:43 +0800 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Tools/Build-DevApiModules.ps1`, `Tools/Metadata/1.5.7/Metadata.psd1`, `Tools/Metadata/1.5.7/Metadata.psm1`, `Tools/Metadata/1.5.7/PSGetModuleInfo.xml` + +--- + +### 270. `d3d98923` — cache middleware changes + +| Field | Value | +|-------|-------| +| SHA | `d3d989239922033360844a522ef1c930b4949c9e` | +| Author | Zacgoose | +| Date | 2026-06-07 14:56:27 +0800 | +| Files changed | 6 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1`, `Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPDBTestsRun.ps1`, `Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-UserTasksOrchestrator.ps1`, `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-DurableCleanup.ps1`, `Shared/CIPPSharp/CIPPTestDataCache.cs`, `Shared/CIPPSharp/bin/CIPPSharp.dll` + +--- + +### 271. `ddc264a7` — Update Invoke-CippTestGenericTest002.ps1 + +| Field | Value | +|-------|-------| +| SHA | `ddc264a771b27807a35d12fd3645d4693b4a21f8` | +| Author | Zacgoose | +| Date | 2026-06-08 12:49:44 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest002.ps1` + +--- + +### 272. `2a63cfc7` — Update Get-CIPPAlertQuotaUsed.ps1 + +| Field | Value | +|-------|-------| +| SHA | `2a63cfc7eb0e457762a8fa3c50b9121821becb12` | +| Author | Zacgoose | +| Date | 2026-06-08 13:27:58 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuotaUsed.ps1` + +--- + +### 273. `64f30df6` — Update Start-DurableCleanup.ps1 + +| Field | Value | +|-------|-------| +| SHA | `64f30df6a54328ba3e886cd83d5b7417fb153ff2` | +| Author | Zacgoose | +| Date | 2026-06-08 14:51:46 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-DurableCleanup.ps1` + +--- + +### 274. `34112ffd` — temporary 1 day to clear old ips + +| Field | Value | +|-------|-------| +| SHA | `34112ffd912693d51f62e1f98e12a5009fc556fd` | +| Author | KelvinTegelaar | +| Date | 2026-06-08 11:30:26 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Get-CIPPGeoIPLocation.ps1` + +--- + +### 275. `bfb0c17a` — tools update + +| Field | Value | +|-------|-------| +| SHA | `bfb0c17a9ccd997e71218c4e5e71c68868fbd941` | +| Author | KelvinTegelaar | +| Date | 2026-06-08 11:31:26 +0200 | +| Files changed | 10 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Tools/Configuration/1.6.0/Configuration.psd1`, `Tools/Configuration/1.6.0/Configuration.psm1`, `Tools/Configuration/1.6.0/PSGetModuleInfo.xml`, `Tools/Metadata/1.5.7/Metadata.psd1`, `Tools/Metadata/1.5.7/Metadata.psm1`, `Tools/Metadata/1.5.7/PSGetModuleInfo.xml`, `Tools/ModuleBuilder/3.1.8/ModuleBuilder.psd1`, `Tools/ModuleBuilder/3.1.8/ModuleBuilder.psm1`, `Tools/ModuleBuilder/3.1.8/PSGetModuleInfo.xml`, `Tools/ModuleBuilder/3.1.8/en-US/about_ModuleBuilder.help.txt` + +--- + +### 276. `e4455d3f` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `e4455d3f176fdab57e3d0ff12f421894cf20246c` | +| Author | KelvinTegelaar | +| Date | 2026-06-08 11:31:28 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 277. `a52f002d` — 10.5.0 version up + +| Field | Value | +|-------|-------| +| SHA | `a52f002d5601c521998d84ca65544d561154e48e` | +| Author | KelvinTegelaar | +| Date | 2026-06-08 11:32:50 +0200 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `version_latest.txt` + +--- + +### 278. `4f8bc79c` — Dev to release (#2081) + +| Field | Value | +|-------|-------| +| SHA | `4f8bc79cec338f08dfc3374f95e014b42fbfe157` | +| Author | KelvinTegelaar | +| Date | 2026-06-08 14:25:19 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 279. `b36a32b0` — shuffle file locations + +| Field | Value | +|-------|-------| +| SHA | `b36a32b0a89397e211cd681ac62669efb79c79c5` | +| Author | Zacgoose | +| Date | 2026-06-09 00:04:52 +0800 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/MCP/Get-CippMcpSpec.ps1`, `Modules/CIPPCore/Public/MCP/Get-CippMcpToolList.ps1`, `Modules/CIPPCore/Public/MCP/Get-CippMcpToolResult.ps1`, `Modules/CIPPHTTP/Public/Invoke-ListObjectHistory.ps1` + +--- + +### 280. `fc76e111` — sso app repair and fix migration failures + +| Field | Value | +|-------|-------| +| SHA | `fc76e111b828b514e5abdd5fbe43a2fa90740468` | +| Author | Zacgoose | +| Date | 2026-06-09 01:03:56 +0800 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Add-CIPPSSOAppSecret.ps1`, `Modules/CIPPCore/Public/Authentication/New-CIPPSSOApp.ps1`, `Modules/CIPPCore/Public/Authentication/Set-CIPPSSOStoredCredentials.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecSSOSetup.ps1` + +--- + +### 281. `c0f663ca` — fix: update role and fix variable casing in message trace function + +| Field | Value | +|-------|-------| +| SHA | `c0f663ca436572f4a88571553d03a13b5ad9fc01` | +| Author | Bobby | +| Date | 2026-06-08 22:49:25 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListMessageTrace.ps1` + +--- + +### 282. `3e33fdb1` — fix: more robust conversion for EnableAutoTrim setting + +| Field | Value | +|-------|-------| +| SHA | `3e33fdb15b67daa52c8bb0651b737193787d5371` | +| Author | Bobby | +| Date | 2026-06-08 23:59:05 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1` + +--- + +### 283. `3f9aab05` — api version file fixes + +| Field | Value | +|-------|-------| +| SHA | `3f9aab05b0c73759016aef39ba6cd62416b92d0b` | +| Author | Zacgoose | +| Date | 2026-06-09 13:40:29 +0800 | +| Files changed | 3 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Config/version_latest.txt`, `Modules/CIPPCore/Public/Authentication/Get-CippAllowedPermissions.ps1`, `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPStatsTimer.ps1` + +--- + +### 284. `2138ec6d` — Fix: Improve conversion for EnableAutoTrim setting (#2084) + +| Field | Value | +|-------|-------| +| SHA | `2138ec6d13f531bce2f61b1dc3f110dd75935ce9` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 10:26:37 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** (none) + +--- + +### 285. `c215631c` — Fix: Message trace role and variable casing in message trace function (#2083) + +| Field | Value | +|-------|-------| +| SHA | `c215631c31f850630553c44f7e3aa5a78f4e1b7b` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 10:26:54 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 286. `2925643d` — push endpoint over to export job endpoint + +| Field | Value | +|-------|-------| +| SHA | `2925643d2f15f3a6d551a85a60255fbaae4d5e9c` | +| Author | Zacgoose | +| Date | 2026-06-09 17:09:03 +0800 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/CIPPTimers.json`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-IntuneReportExportSubmit.ps1`, `Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-IntuneReportExportOrchestrator.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheDetectedApps.ps1` + +--- + +### 287. `b79c296f` — sherweb migration fixes + +| Field | Value | +|-------|-------| +| SHA | `b79c296f0344bdd0783568896ced47bbce8380d4` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 13:57:18 +0200 | +| Files changed | 5 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1`, `Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1`, `Modules/CippExtensions/Public/Extension Functions/Register-CippExtensionScheduledTasks.ps1`, `Modules/CippExtensions/Public/Sherweb/Invoke-SherwebMigration.ps1`, `Modules/CippExtensions/Public/Sherweb/Test-SherwebMigrationAccounts.ps1` + +--- + +### 288. `280b3b9d` — fix: add CippExtensions to allowlist + +| Field | Value | +|-------|-------| +| SHA | `280b3b9d08578311a60d3baf501984b205356fb6` | +| Author | John Duprey | +| Date | 2026-06-09 07:57:29 -0400 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1`, `Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1`, `profile.ps1` + +--- + +### 289. `8f1069cf` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `8f1069cf56b4647c42b6e0538682b338d89824af` | +| Author | John Duprey | +| Date | 2026-06-09 07:57:31 -0400 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 290. `2511c6e5` — add limits for tools copilot studio + +| Field | Value | +|-------|-------| +| SHA | `2511c6e56640e03ed49000f7133cc027fcea1717` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 14:50:17 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/MCP/Get-CippMcpToolList.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1` + +--- + +### 291. `6c897f52` — fixes group addition in user page and vacation mode + +| Field | Value | +|-------|-------| +| SHA | `6c897f52f26b6a3a75c5a042b18e140f8e44d13c` | +| Author | Zacgoose | +| Date | 2026-06-09 21:17:48 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Add-CIPPGroupMember.ps1`, `Modules/CIPPCore/Public/New-CIPPUserTask.ps1` + +--- + +### 292. `39e1a34e` — chore: bump version to 10.5.1 + +| Field | Value | +|-------|-------| +| SHA | `39e1a34e3d33a7657f10c1d21eda71190596cdee` | +| Author | John Duprey | +| Date | 2026-06-09 10:35:41 -0400 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `host.json`, `version_latest.txt` + +--- + +### 293. `14346161` — Dev to hotfix (#2085) + +| Field | Value | +|-------|-------| +| SHA | `143461619d6f95588c7725c5110b915a2e676797` | +| Author | John Duprey | +| Date | 2026-06-09 10:39:33 -0400 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** (none) + +--- + +### 294. `64836c02` — fix: rerun detection on scheduled tasks + +| Field | Value | +|-------|-------| +| SHA | `64836c02a801a3718c2bd2e598bcf206c973541d` | +| Author | John Duprey | +| Date | 2026-06-09 12:15:57 -0400 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPCore/Public/Test-CIPPRerun.ps1` + +--- + +### 295. `9dd0e567` — Update Invoke-ListTenantAlignment.ps1 + +| Field | Value | +|-------|-------| +| SHA | `9dd0e56750810b7a85ef4fb079dbf6725b2b6ce0` | +| Author | Zacgoose | +| Date | 2026-06-10 14:27:26 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Standards/Alignment Custom; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListTenantAlignment.ps1` + +--- + +### 296. `a0a79852` — Update Invoke-ListTenantAlignment.ps1 + +| Field | Value | +|-------|-------| +| SHA | `a0a79852f89fb82c0f5bab15822b46870198956e` | +| Author | Zacgoose | +| Date | 2026-06-10 14:45:31 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Standards/Alignment Custom; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListTenantAlignment.ps1` + +--- + +### 297. `e8d13427` — audit log detailed logging for debugging + +| Field | Value | +|-------|-------| +| SHA | `e8d1342774427bee3572ebcb9f2aad8c0d30c800` | +| Author | Zacgoose | +| Date | 2026-06-10 15:03:18 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/AuditLogs/New-CippAuditLogSearch.ps1`, `Modules/CIPPCore/Public/GraphHelper/New-GraphPOSTRequest.ps1` + +--- + +### 298. `b8fefcfd` — Update Invoke-ExecMcp.ps1 + +| Field | Value | +|-------|-------| +| SHA | `b8fefcfdd085b5f25782f7f3da70324252f3c630` | +| Author | Zacgoose | +| Date | 2026-06-10 15:20:53 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1` + +--- + +### 299. `83b13034` — bulk request next link following + +| Field | Value | +|-------|-------| +| SHA | `83b130347aa81fb373cb77de32583dab9628e2e8` | +| Author | Zacgoose | +| Date | 2026-06-10 22:33:53 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/GraphHelper/New-ExoBulkRequest.ps1` + +--- + +### 300. `9f0bacd6` — manual pagination support for Invoke-ListMailQuarantine + +| Field | Value | +|-------|-------| +| SHA | `9f0bacd62c74d6e65ee0f51623884569de2eb8c1` | +| Author | Zacgoose | +| Date | 2026-06-10 22:49:50 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1` + +--- + +### 301. `cc84a49d` — Fix ORCA104 + +| Field | Value | +|-------|-------| +| SHA | `cc84a49df1633a1b5de2dfdeda991f9d8b7b660c` | +| Author | Zacgoose | +| Date | 2026-06-10 23:22:58 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA104.ps1` + +--- + +### 302. `8cd8d1d9` — Fix for ORCA107 and add Exchange Global Quarantine policy to cache + +| Field | Value | +|-------|-------| +| SHA | `8cd8d1d94e51ce793d79567822483073715392ad` | +| Author | Zacgoose | +| Date | 2026-06-10 23:51:56 +0800 | +| Files changed | 3 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Config/CIPPDBCacheTypes.json`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoQuarantinePolicy.ps1`, `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA107.ps1` + +--- + +### 303. `2ab0e0e2` — fix: rerun issue + +| Field | Value | +|-------|-------| +| SHA | `2ab0e0e27c77d146301b427365e0d305e813137d` | +| Author | John Duprey | +| Date | 2026-06-10 12:06:17 -0400 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPCore/Public/Test-CIPPRerun.ps1` + +--- + +### 304. `238001c1` — Update policy based on MS and Orca guidance + +| Field | Value | +|-------|-------| +| SHA | `238001c13e0d62a7f13b00d46c99c7be82c11cad` | +| Author | Zacgoose | +| Date | 2026-06-11 00:13:53 +0800 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1`, `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA102.ps1` + +--- + +### 305. `0640f07c` — Fixes ORCA179 + +| Field | Value | +|-------|-------| +| SHA | `0640f07ccdf22a8294a91502def41b987be84ab5` | +| Author | Zacgoose | +| Date | 2026-06-11 00:25:11 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA179.ps1` + +--- + +### 306. `db3de75a` — Fixes ORCA244 + +| Field | Value | +|-------|-------| +| SHA | `db3de75a6c6fc7cbf6e1c775ffb485e9ca2a215d` | +| Author | Zacgoose | +| Date | 2026-06-11 00:26:36 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA244.ps1` + +--- + +### 307. `a556b98b` — Fixes ORCA113 + +| Field | Value | +|-------|-------| +| SHA | `a556b98bdbd08fb9d97df79ae8c79f4d47011e39` | +| Author | Zacgoose | +| Date | 2026-06-11 00:34:47 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA113.ps1` + +--- + +### 308. `cbcc61b5` — Fixes ORCA103 + +| Field | Value | +|-------|-------| +| SHA | `cbcc61b5afd8c7ea9bb9bef1da7878465afc5610` | +| Author | Zacgoose | +| Date | 2026-06-11 00:48:34 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA103.ps1` + +--- + +### 309. `2851db0f` — Fixes ORCA233_1 + +| Field | Value | +|-------|-------| +| SHA | `2851db0f52d88c4a7b5ee0d1a739a7d9d95ea27b` | +| Author | Zacgoose | +| Date | 2026-06-11 01:17:20 +0800 | +| Files changed | 4 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Config/CIPPDBCacheTypes.json`, `Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoInboundConnector.ps1`, `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA233_1.ps1` + +--- + +### 310. `28ba94b4` — Fixes ORCA242 + +| Field | Value | +|-------|-------| +| SHA | `28ba94b43709b89dee2a349742f68c1df5ac1bf8` | +| Author | Zacgoose | +| Date | 2026-06-11 01:17:33 +0800 | +| Files changed | 4 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Config/CIPPDBCacheTypes.json`, `Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoProtectionAlert.ps1`, `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA242.ps1` + +--- + +### 311. `f37d68ad` — Fixes ORCA235 + +| Field | Value | +|-------|-------| +| SHA | `f37d68adfa17516f05cb9422fe01da589252ada9` | +| Author | Zacgoose | +| Date | 2026-06-11 01:26:09 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA235.ps1` + +--- + +### 312. `abcbb60a` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `abcbb60a5890f91b1d9c92be83ff5d4f2a72bdd2` | +| Author | John Duprey | +| Date | 2026-06-10 14:51:00 -0400 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 313. `e9bc5ad5` — fix: add early template filter when supplied + +| Field | Value | +|-------|-------| +| SHA | `e9bc5ad50bce44db439e9d271c37a0ec5b47a5ac` | +| Author | John Duprey | +| Date | 2026-06-10 16:51:47 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1` + +--- + +### 314. `8f2198e7` — chore: bump version to 10.5.2 + +| Field | Value | +|-------|-------| +| SHA | `8f2198e7cf303ec2726066c95a4ebacb55e75f27` | +| Author | John Duprey | +| Date | 2026-06-10 17:02:38 -0400 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `host.json`, `version_latest.txt` + +--- + +### 315. `5a0ddb29` — Dev to hotfix (#2088) + +| Field | Value | +|-------|-------| +| SHA | `5a0ddb29c3770525813aefea5e356fc56b088eeb` | +| Author | John Duprey | +| Date | 2026-06-10 17:25:40 -0400 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** (none) + +--- diff --git a/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_API_20260617.md b/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_API_20260617.md new file mode 100644 index 0000000000..aeab217c78 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_API_20260617.md @@ -0,0 +1,84 @@ +# UserReportedPhishing API — Upstream Import + +Generated: 2026-06-17 +Branch: `manage365/userreportedphishing-api-20260617` +Backup tag: `backup/pre-userreportedphishing-api-20260617` → `15df6c850` +Base: `master` @ `15df6c850` (docs: upstream delta inventory) + +## Upstream Commit + +| Field | Value | +|-------|-------| +| SHA | `2869564fb` (short: `2869564f`) | +| Title | Add AlertUserReportPhising | +| Author | KelvinTegelaar | +| Date | 2026-05-12 | + +## Pre-Apply Verification + +`git show --stat 2869564f` — 2 files, 51 insertions: + +- `Config/SAMManifest.json` +- `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUserReportedPhishing.ps1` + +No quarantine, Email Troubleshooter, tenant switching, auth flow, `Start-TableCleanup`, or unrelated standards files touched. + +## Apply Result + +| Status | Detail | +|--------|--------| +| **Applied with adaptation** | Cherry-pick `-x` conflicted on `Config/SAMManifest.json` (fork has additional Graph Role permissions after upstream insertion point). Resolved by keeping all fork permissions and appending the new Role at end of Microsoft Graph `resourceAccess`. Alert handler applied cleanly. | + +Applied commit on branch: cherry-pick of `2869564f` (amended to include lib/data manifest parity + this doc). + +## Files Changed + +| File | Change | +|------|--------| +| `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUserReportedPhishing.ps1` | **Added** — alert entrypoint | +| `Config/SAMManifest.json` | **Updated** — Graph application permission | +| `Modules/CIPPCore/lib/data/SAMManifest.json` | **Updated** — same permission for fork manifest parity | +| `docs/upstream-sync/USERREPORTEDPHISHING_API_20260617.md` | **Added** — this tracking doc | + +## Permission Added + +| GUID | Type | Permission | Translator | +|------|------|------------|------------| +| `d72bdbf4-a59b-405c-8b04-5995895819ac` | Role (Application) | `ThreatSubmission.ReadWrite.All` | Present in `Config/PermissionsTranslator.json` and `Modules/CIPPCore/lib/data/PermissionsTranslator.json` | + +**CPV/SAM:** `Get-CippSamPermissions` reads `Config/SAMManifest.json`. After merge, run Manage365 CPV permission refresh so client tenants receive `ThreatSubmission.ReadWrite.All` on the CIPP service principal. App registration in MSP tenant must also expose this permission (verify before prod deploy). + +## Implementation Notes + +- Alert follows CIPPAlerts pattern: `.FUNCTIONALITY Entrypoint`, `Write-AlertTrace`, try/catch with `Write-AlertMessage`. +- Uses app-only Graph: `New-GraphGetRequest ... -AsApp $true` against beta `security/threatSubmission/emailThreats`. +- Filters to user-reported submissions only (`source -eq 'user'`). +- Default lookback: 24 hours (`HoursBack` configurable via alert input). + +## Tests + +| Suite | Result | +|-------|--------| +| `Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1` | 34 passed | +| `Tests/Tools` | 13 passed | +| **Total** | **47/47 passed** | + +No dedicated SAM manifest shape tests in repo. + +## Frontend Dependency + +**Pending** — do not add CIPP frontend `7054bfc4` (`src/data/alerts.json` `UserReportedPhishing` entry) until: + +1. This API branch is reviewed and merged +2. SAM/CPV permission push path is confirmed in non-prod +3. Non-prod alert smoke test passes (or is explicitly waived) + +Alert name mapping when frontend is added: `UserReportedPhishing` → `Get-CIPPAlertUserReportedPhishing`. + +## Next Steps + +1. Open PR from `manage365/userreportedphishing-api-20260617` → `master` +2. Review SAM diff and confirm MSP app registration includes `ThreatSubmission.ReadWrite.All` +3. Merge API PR; trigger CPV permission update +4. Smoke test alert in non-prod tenant (Graph beta emailThreats + user source filter) +5. Then import frontend `7054bfc4` on paired CIPP branch diff --git a/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_FINAL_STATUS_20260617.md b/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_FINAL_STATUS_20260617.md new file mode 100644 index 0000000000..f6371fc54b --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_FINAL_STATUS_20260617.md @@ -0,0 +1,98 @@ +# UserReportedPhishing — Final Paired Workstream Status + +Generated: 2026-06-17 +Repos: Celeratec/CIPP-API + Celeratec/CIPP + +## Workstream Summary + +Paired upstream import of UserReportedPhishing alert support is **code-complete** on both repos. Operational rollout to production tenants is **partially complete** — backend validated; frontend exposed; first-tenant scheduler enablement pending. + +| Phase | Status | +|-------|--------| +| CIPP-API backend (PR #2) | **Merged** | +| SAM manifest + permission | **Merged** | +| CPV/consent validation | **Clean** (pre-frontend) | +| Backend smoke test | **Clean** (pre-frontend) | +| CIPP frontend (PR #9) | **Merged** | +| First-tenant SchedulerConfig enablement | **Not performed** | +| Global/bulk enablement | **Blocked** until one clean run documented | + +--- + +## CIPP-API + +| Field | Value | +|-------|--------| +| **PR** | https://github.com/Celeratec/CIPP-API/pull/2 | +| **Merge commit** | `4b00ffeb6` | +| **Feature commit** | `7fed45fd7` | +| **Master tip (docs)** | `61278a254` (rollout runbook) + post-merge docs | +| **Backup tag** | `backup/pre-userreportedphishing-api-20260617` → `15df6c850` | + +**Delivered:** + +- `Get-CIPPAlertUserReportedPhishing` alert handler +- `ThreatSubmission.ReadWrite.All` in `Config/SAMManifest.json` and `Modules/CIPPCore/lib/data/SAMManifest.json` +- Pester regression: 47/47 passed +- Rollout runbook: `USERREPORTEDPHISHING_ROLLOUT_RUNBOOK_20260617.md` + +**Validation completed before frontend exposure:** + +- SAM table merge and CPV path exercised +- Admin consent confirmed in test context +- Handler smoke test: `Get-CIPPAlertUserReportedPhishing -InputValue @{ HoursBack = 24 }` — clean + +--- + +## CIPP (Frontend) + +| Field | Value | +|-------|--------| +| **PR** | https://github.com/Celeratec/CIPP/pull/9 | +| **Merge commit** | `7050757b2` | +| **Feature commit** | `5b3ef362c` | +| **Backup tag** | `backup/pre-userreportedphishing-frontend-20260617` | + +**Delivered:** + +- `UserReportedPhishing` entry in `src/data/alerts.json` +- `HoursBack` input, `recommendedRunInterval: 4h` +- Maps to backend via `Get-CIPPAlertUserReportedPhishing` + +Upstream commit: `7054bfc4` (previously deferred in Cycle 1 sync until API rollout validated). + +--- + +## Remaining Operational Step + +**One-tenant SchedulerConfig enablement and production scheduler run validation.** + +Operator checklist: + +1. Confirm CIPP-API `master` and CIPP `main` (PR #9) deployed to target environment. +2. Enable `UserReportedPhishing` for **one test tenant** only (`HoursBack: 24`). +3. Wait for or trigger scheduler run (`recommendedRunInterval: 4h`). +4. Confirm alert trace output or clean no-op; no permission errors. +5. Document result (date, tenant, outcome). +6. **Do not bulk-enable globally** until step 5 is complete. + +--- + +## Documentation Index + +| Doc | Repo | Purpose | +|-----|------|---------| +| `USERREPORTEDPHISHING_API_20260617.md` | CIPP-API | Upstream import tracking | +| `USERREPORTEDPHISHING_POST_MERGE_20260617.md` | CIPP-API | Post-merge API validation record | +| `USERREPORTEDPHISHING_ROLLOUT_RUNBOOK_20260617.md` | CIPP-API | Operator SAM/CPV/smoke runbook | +| `USERREPORTEDPHISHING_FINAL_STATUS_20260617.md` | CIPP-API | This paired completion status | +| `USERREPORTEDPHISHING_FRONTEND_20260617.md` | CIPP | Frontend import tracking | +| `USERREPORTEDPHISHING_FRONTEND_POST_MERGE_20260617.md` | CIPP | Frontend post-merge status | + +--- + +## Safety Notes + +- Handler can remain dormant until SchedulerConfig enables the alert per tenant. +- Requires `ThreatSubmission.ReadWrite.All` on CIPP service principal in each tenant where enabled. +- Backup tags retained on both repos for rollback reference. diff --git a/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_POST_MERGE_20260617.md b/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_POST_MERGE_20260617.md new file mode 100644 index 0000000000..13da0397de --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_POST_MERGE_20260617.md @@ -0,0 +1,212 @@ +# UserReportedPhishing API — Post-Merge Validation + +Generated: 2026-06-17 +Repo: Celeratec/CIPP-API +Master tip: `4b00ffeb6` + +## Merge Summary + +| Field | Value | +|-------|--------| +| **PR** | https://github.com/Celeratec/CIPP-API/pull/2 | +| **Merge commit** | `4b00ffeb6` | +| **Feature commit** | `7fed45fd7` | +| **Title** | Add user reported phishing alert backend | +| **Backup tag (retained)** | `backup/pre-userreportedphishing-api-20260617` → `15df6c850` | + +## Files Merged + +| File | Change | +|------|--------| +| `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUserReportedPhishing.ps1` | New alert handler | +| `Config/SAMManifest.json` | +1 Graph application Role | +| `Modules/CIPPCore/lib/data/SAMManifest.json` | +1 Graph application Role (fork parity) | +| `docs/upstream-sync/USERREPORTEDPHISHING_API_20260617.md` | Import tracking doc | + +## Pester Regression + +| Suite | Result | +|-------|--------| +| `Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1` | 34 passed | +| `Tests/Tools` | 13 passed | +| **Total (post-merge re-run)** | **47/47 passed** | + +## SAM Manifest Status + +| Item | Status | +|------|--------| +| Permission GUID | `d72bdbf4-a59b-405c-8b04-5995895819ac` | +| Permission name | `ThreatSubmission.ReadWrite.All` | +| Graph resource app ID | `00000003-0000-0000-c000-000000000000` | +| Permission type | Role (Application) | +| In `Config/SAMManifest.json` | Yes | +| In `Modules/CIPPCore/lib/data/SAMManifest.json` | Yes | +| `PermissionsTranslator.json` mapping | Already present (no change required) | +| Roles removed vs pre-merge | **None** (append-only) | +| Roles added vs pre-merge | ThreatSubmission only (both manifests) | + +### Pre-existing SAM parity gap (unchanged by this PR) + +`Config/SAMManifest.json` contains Graph Role `7e05723c-0bb0-42da-be95-ae9f08a6e53c` that `Modules/CIPPCore/lib/data/SAMManifest.json` lacks. This PR did **not** widen the gap — both manifests received the same new permission. CPV runtime reads **`Config/SAMManifest.json`** via `Get-CippSamPermissions`. + +Graph Role counts after merge: Config **62**, lib/data **61**. + +## Frontend Status + +**Still deferred.** Do not add CIPP frontend `7054bfc4` (`src/data/alerts.json` `UserReportedPhishing` entry) until SAM/CPV rollout, tenant consent, and non-prod backend smoke test are complete (or explicitly waived). + +--- + +## Task 2 — SAM / CPV Permission Rollout Path + +### How permissions flow in this fork + +```text +Config/SAMManifest.json + │ + ▼ +Get-CippSamPermissions ← compares manifest vs AppPermissions table + │ + ├── MissingPermissions diff (dry-run signal) + │ + ▼ +Update-CippSamPermissions ← Invoke-ExecPermissionRepair (MSP table merge) + │ + ▼ +AppPermissions table (CIPP-SAM) + │ + ▼ +Start-UpdatePermissionsOrchestrator ← Invoke-ExecCPVRefresh (tenant push) + │ + ▼ +Push-UpdatePermissionsQueue per tenant + │ + ├── Add-CIPPApplicationPermission (CIPPDefaults → app Roles) + └── Add-CIPPDelegatedPermission +``` + +**Note:** `Modules/CIPPCore/lib/data/SAMManifest.json` is maintained for fork parity but is **not** read by `Get-CippSamPermissions`. Only `Config/SAMManifest.json` drives CPV. + +### Dry-run / read-only validation (recommended before any push) + +No dedicated `-WhatIf` / dry-run flag exists on CPV orchestration. Use these **read-only** steps in non-prod Manage365/CIPP: + +| Step | Endpoint / function | Purpose | +|------|---------------------|---------| +| 1 | `Invoke-ExecSAMAppPermissions` (GET, default action) | Returns `Get-CippSamPermissions` output including `MissingPermissions` | +| 2 | CIPP Settings → Access Check / `Test-CIPPAccessPermissions` | Surfaces missing SAM permissions and tenants needing CPV refresh | +| 3 | Local static validation (below) | Confirms manifest JSON, GUID, translator, no regressions | + +**Expected dry-run signal after deploy:** `MissingPermissions` for Microsoft Graph should include: + +```json +{ + "id": "d72bdbf4-a59b-405c-8b04-5995895819ac", + "value": "ThreatSubmission.ReadWrite.All" +} +``` + +until `Update-CippSamPermissions` merges it into the `AppPermissions` table. + +### Static validation (local, 2026-06-17) + +Executed against `master` @ `4b00ffeb6` without Azure connectivity: + +| Check | Result | +|-------|--------| +| Config JSON valid | Pass | +| lib/data JSON valid | Pass | +| Target GUID in Config | Pass | +| Target GUID in lib/data | Pass | +| Permission type Role | Pass | +| Graph resource app ID | Pass | +| PermissionsTranslator maps GUID → `ThreatSubmission.ReadWrite.All` | Pass | +| Config roles removed vs pre-merge | **None** | +| lib/data roles removed vs pre-merge | **None** | +| Config roles added | `d72bdbf4-...` only | +| lib/data roles added | `d72bdbf4-...` only | +| Pre-existing Config-only role `7e05723c-...` preserved | Pass | + +### Production push steps (operator — not executed in this session) + +Requires explicit approval and non-prod validation first: + +1. **Deploy** `master` @ `4b00ffeb6` to non-prod Function App. +2. **MSP SAM table merge:** CIPP Settings → Permission Repair (`Invoke-ExecPermissionRepair` / `Update-CippSamPermissions`). +3. **Verify** `ExecSAMAppPermissions` GET shows no missing Graph application permissions (or ThreatSubmission absent from `MissingPermissions`). +4. **CPV refresh (single test tenant first):** `Invoke-ExecCPVPermissions` for one internal tenant, or `Invoke-ExecCPVRefresh` for orchestrated rollout after test-tenant success. +5. **Confirm** CIPP service principal in test tenant has `ThreatSubmission.ReadWrite.All` app role assignment on Microsoft Graph resource SP. +6. **Prod rollout** only after non-prod smoke test passes. + +**Not run:** `Start-UpdatePermissionsOrchestrator` / tenant-wide CPV push (production side effect). + +--- + +## Task 3 — Test Tenant Readiness + +**Status: BLOCKED — requires deployed non-prod Function App** + +This validation session had no Azure Function App runtime, SAM tokens, or tenant credentials. Operator must complete in non-prod: + +| Check | How | +|-------|-----| +| Service principal can receive permission | Entra → Enterprise apps → CIPP SAM app → Permissions; confirm `ThreatSubmission.ReadWrite.All` listed | +| Admin consent completable | Grant admin consent in test tenant after CPV push | +| Existing permissions intact | Compare app role assignments before/after CPV on Graph resource SP | +| Graph beta endpoint reachable | App-only GET `https://graph.microsoft.com/beta/security/threatSubmission/emailThreats?$top=1` in test tenant | + +Suggested tenant: internal/non-production managed tenant with Defender for Office 365 reporting enabled. + +--- + +## Task 4 — Backend Smoke Test + +**Status: BLOCKED — requires deployed non-prod Function App** + +Safest execution paths (do **not** enable frontend alert globally): + +### Option A — Direct function invoke (non-prod only) + +```powershell +# After SAM auth and module import in Function App context or local harness with CIPPRootPath set +Get-CIPPAlertUserReportedPhishing -TenantFilter '' -InputValue @{ HoursBack = 24 } +``` + +### Option B — Scheduler bridge (only if alert enabled in SchedulerConfig for test tenant) + +`Push-SchedulerAlert` calls `Get-CIPPAlertUserReportedPhishing` when `UserReportedPhishing` is enabled in tenant alert config. **Do not enable globally** — use Option A or a one-off scheduler row for test tenant only. + +### Expected outcomes + +| Scenario | Expected | +|----------|----------| +| No user submissions in window | No alert trace; no fatal error | +| User submissions exist | `Write-AlertTrace` output with filtered records | +| Missing consent | Explicit Graph permission error via `Write-AlertMessage`; attributable to missing `ThreatSubmission.ReadWrite.All`, not code failure | + +**Not executed in this session.** + +--- + +## Frontend Gate Decision + +| Question | Answer | +|----------|--------| +| Can frontend alert proceed? | **No** | +| Blockers | (1) Non-prod deploy of merged API not confirmed in this session; (2) `Update-CippSamPermissions` + CPV push not run; (3) Test tenant consent not verified; (4) `Get-CIPPAlertUserReportedPhishing` live smoke test not run | + +### Unblock sequence + +1. Deploy `master` to non-prod Function App +2. Run SAM permission repair (MSP) → confirm ThreatSubmission in AppPermissions table +3. CPV refresh on one test tenant → grant admin consent +4. Smoke test handler (Option A above) +5. Operator sign-off or explicit waiver +6. Then open CIPP frontend PR for `7054bfc4` + +--- + +## Related Docs + +- Import tracking: `docs/upstream-sync/USERREPORTEDPHISHING_API_20260617.md` +- Upstream delta: `docs/upstream-sync/UPSTREAM_DELTA_CIPP_API_20260617.md` diff --git a/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_ROLLOUT_RUNBOOK_20260617.md b/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_ROLLOUT_RUNBOOK_20260617.md new file mode 100644 index 0000000000..fc787f042b --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_ROLLOUT_RUNBOOK_20260617.md @@ -0,0 +1,300 @@ +# UserReportedPhishing — Operational Rollout Runbook + +Generated: 2026-06-17 +Repo: Celeratec/CIPP-API +Related: PR #2 (merged), `USERREPORTEDPHISHING_POST_MERGE_20260617.md` + +Operator runbook for SAM/CPV permission rollout and backend smoke test **before** enabling the CIPP frontend alert (`7054bfc4`). + +--- + +## 1. Current Status + +| Item | Status | +|------|--------| +| API handler merged | Yes — `Get-CIPPAlertUserReportedPhishing` on `master` | +| Frontend alert enabled | **No** — `UserReportedPhishing` not in CIPP `alerts.json` | +| SAM manifest (Config) | `ThreatSubmission.ReadWrite.All` added | +| SAM manifest (lib/data) | Same permission added (fork parity copy) | +| CPV runtime manifest source | **`Config/SAMManifest.json`** via `Get-CippSamPermissions` | +| lib/data manifest | Parity copy only — **not** read by CPV | +| PermissionsTranslator | GUID already mapped — no change required | +| Production permission push | **Not executed** | +| Live backend smoke test | **Not executed** | +| Backup tag | `backup/pre-userreportedphishing-api-20260617` → `15df6c850` | + +**Master commits of record:** + +| SHA | Description | +|-----|-------------| +| `4b00ffeb6` | Merge PR #2 | +| `7fed45fd7` | Feature: alert handler + SAM manifests | +| `7b6ea11ff` | Post-merge validation doc | + +--- + +## 2. Permission Details + +| Field | Value | +|-------|--------| +| **Permission name** | `ThreatSubmission.ReadWrite.All` | +| **GUID** | `d72bdbf4-a59b-405c-8b04-5995895819ac` | +| **Resource** | Microsoft Graph | +| **Resource App ID** | `00000003-0000-0000-c000-000000000000` | +| **Type** | Application / Role | + +**Graph API used by alert handler:** + +```http +GET https://graph.microsoft.com/beta/security/threatSubmission/emailThreats?$filter=createdDateTime ge {Since} +Authorization: Bearer {app-only token} +``` + +Handler filters results to `source -eq 'user'`. + +--- + +## 3. Pre-Flight Read-Only Checks + +> **Safe:** These steps do not modify permissions or push CPV to tenants. + +### Prerequisites + +1. Deploy current `master` (includes PR #2) to **non-prod** Function App first. +2. Confirm MSP app registration exposes `ThreatSubmission.ReadWrite.All` in Entra (App registration → API permissions). + +### Check A — SAM manifest diff (Manage365 / CIPP UI) + +**UI:** CIPP → Advanced → Super Admin → **SAM App Permissions** +(`src/pages/cipp/advanced/super-admin/sam-app-permissions.js`) + +**API (read-only GET):** + +```http +GET /api/ExecSAMAppPermissions +``` + +**PowerShell equivalent (Function App Kudu / debug session with modules loaded):** + +```powershell +Get-CippSamPermissions +# Inspect: .MissingPermissions.'00000003-0000-0000-c000-000000000000'.applicationPermissions +``` + +**Expected before SAM table repair:** + +- `MissingPermissions` for Microsoft Graph may include: + +```json +{ + "id": "d72bdbf4-a59b-405c-8b04-5995895819ac", + "value": "ThreatSubmission.ReadWrite.All" +} +``` + +This is normal until `Update-CippSamPermissions` merges the manifest into the `AppPermissions` table. + +### Check B — Access permissions report + +**UI:** CIPP → Settings → **Permission Check** (Permissions tab) + +**API:** + +```http +POST /api/ExecAccessChecks?Type=Permissions&SkipCache=true +``` + +Runs `Test-CIPPAccessPermissions`, which calls `Get-CippSamPermissions` and reports: + +- `MissingPermissions` — SAM permissions not yet in AppPermissions table +- `CPVRefreshList` — tenants whose CPV timestamp is older than last SAM update +- `ErrorMessages` — auth/SAM configuration issues + +**Expected before repair:** + +- ThreatSubmission may appear under `MissingPermissions` +- Message may indicate tenants need CPV refresh (expected until rollout completes) + +### Check C — Local static validation (no Azure) + +From repo root on any machine: + +```powershell +$GraphAppId = '00000003-0000-0000-c000-000000000000' +$Guid = 'd72bdbf4-a59b-405c-8b04-5995895819ac' +$cfg = Get-Content Config/SAMManifest.json -Raw | ConvertFrom-Json +$graph = $cfg.requiredResourceAccess | Where-Object resourceAppId -eq $GraphAppId +$graph.resourceAccess | Where-Object { $_.id -eq $Guid -and $_.type -eq 'Role' } +``` + +Should return one Role entry. Repeat against `Modules/CIPPCore/lib/data/SAMManifest.json` for parity confirmation. + +--- + +## 4. Production-Side-Effect Steps + +> **WARNING:** Steps below modify MSP SAM configuration and/or tenant service principal permissions. +> **Require explicit operator approval** before execution. Complete Section 3 first. + +### Step 1 — SAM table merge (MSP partner tenant) + +Merges manifest permissions into Azure Table `AppPermissions` (`CIPP-SAM` row). + +**UI:** Permission Check → **Add Missing Permissions** button +**API:** + +```http +POST /api/ExecPermissionRepair +Content-Type: application/json + +{} +``` + +**Function:** `Update-CippSamPermissions` + +**Verify after:** + +```http +GET /api/ExecSAMAppPermissions +``` + +ThreatSubmission should be **absent** from `MissingPermissions`. + +### Step 2 — CPV refresh (test tenant first) + +**Preferred:** Single tenant before orchestrated rollout. + +**UI:** Tenant → CPV / Permissions refresh (or tenant settings equivalent) +**API (single tenant):** + +```http +POST /api/ExecCPVPermissions +Content-Type: application/json + +{ "tenantFilter": "" } +``` + +**Function:** `Set-CIPPCPVConsent` + `Add-CIPPApplicationPermission` + `Add-CIPPDelegatedPermission` + +**Tenant-wide orchestrator (use only after test tenant succeeds):** + +```http +POST /api/ExecCPVRefresh +Content-Type: application/json + +{} +``` + +**Function:** `Start-UpdatePermissionsOrchestrator` → `Push-UpdatePermissionsQueue` per tenant + +Internally calls `Add-CIPPApplicationPermission -RequiredResourceAccess 'CIPPDefaults'`, which reads merged permissions from `Get-CippSamPermissions -NoDiff` and grants missing app roles on the CIPP service principal in each tenant. + +### Step 3 — Admin consent (test tenant) + +After CPV push, in the **test tenant** Entra portal: + +1. Enterprise applications → CIPP SAM application +2. Permissions → confirm `ThreatSubmission.ReadWrite.All` appears +3. Grant admin consent if prompted +4. Verify existing application permissions unchanged except the new grant + +--- + +## 5. Test Tenant Smoke Plan + +Use **one** internal/non-production managed tenant with Defender reporting enabled. + +### 5.1 Permission validation + +| Step | Pass criteria | +|------|---------------| +| CPV push completed | No Failed results for ThreatSubmission grant | +| Entra SP permissions | `ThreatSubmission.ReadWrite.All` listed under Application permissions | +| Admin consent | Granted without removing existing roles | +| Existing permissions | Spot-check Graph app role assignments count ≥ pre-rollout count | + +### 5.2 Direct Graph probe (app-only) + +In Function App context or authenticated harness: + +```powershell +$Tenant = '' +$Since = (Get-Date).AddHours(-24).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') +$Uri = "https://graph.microsoft.com/beta/security/threatSubmission/emailThreats?`$filter=createdDateTime ge $Since&`$top=1" +New-GraphGetRequest -uri $Uri -tenantid $Tenant -AsApp $true +``` + +| Result | Meaning | +|--------|---------| +| 200 + array (possibly empty) | Permission and endpoint OK | +| 403 / Authorization_RequestDenied | Missing consent or app registration permission | +| Other 4xx | Investigate; likely not handler bug | + +### 5.3 Alert handler smoke + +**Do not** enable `UserReportedPhishing` in global SchedulerConfig. + +```powershell +Get-CIPPAlertUserReportedPhishing -TenantFilter '' -InputValue @{ HoursBack = 24 } +``` + +| Scenario | Expected | +|----------|----------| +| No user submissions in window | Completes without fatal error; no `Write-AlertTrace` output | +| User-reported submissions exist | `Write-AlertTrace` with filtered records (`source = user`) | +| Missing consent | `Write-AlertMessage` with explicit Graph permission error — **not** unhandled exception | + +### 5.4 Sign-off + +Record: date, operator, tenant ID/domain, Graph probe result, handler result. +Attach to this runbook or `USERREPORTEDPHISHING_POST_MERGE_20260617.md`. + +--- + +## 6. Frontend Gate + +Frontend CIPP commit **`7054bfc4`** (`src/data/alerts.json` → `UserReportedPhishing`) remains **blocked** until **all** of: + +- [ ] API deployed to target environment +- [ ] SAM table merge completed (`ExecPermissionRepair`) +- [ ] CPV refresh completed on test tenant (then prod rollout as approved) +- [ ] Test tenant admin consent confirmed +- [ ] Backend smoke test passed **or explicitly waived** + +Alert name mapping when enabled: `UserReportedPhishing` → `Get-CIPPAlertUserReportedPhishing`. + +--- + +## 7. Rollback / Safety + +| Control | Guidance | +|---------|----------| +| Dormant handler | Safe — backend function exists but produces no user-visible alerts without frontend + scheduler config | +| Scheduler config | **Do not** globally enable `UserReportedPhishing` until smoke test passes | +| Permission rollback | Removing app role assignment in tenant Entra is manual; test on one tenant before prod-wide CPV | +| Code rollback | Backup tag `backup/pre-userreportedphishing-api-20260617` marks pre-feature `master` (`15df6c850`); revert only if handler causes harm | +| Frontend | Keep `7054bfc4` out of CIPP until backend rollout sign-off | + +### Pre-existing manifest parity note + +`Config/SAMManifest.json` contains Graph Role `7e05723c-0bb0-42da-be95-ae9f08a6e53c` not present in `lib/data/SAMManifest.json`. This predates UserReportedPhishing and does not block rollout (CPV uses Config only). Address separately if full parity is required. + +--- + +## Quick Reference — Operator Command Summary + +| Action | Method | Side effects | +|--------|--------|--------------| +| Read SAM diff | `GET /api/ExecSAMAppPermissions` | None | +| Read access report | `POST /api/ExecAccessChecks?Type=Permissions&SkipCache=true` | None | +| Merge SAM table | `POST /api/ExecPermissionRepair` | **Yes** — MSP table | +| CPV single tenant | `POST /api/ExecCPVPermissions` + `{ tenantFilter }` | **Yes** — one tenant | +| CPV all tenants | `POST /api/ExecCPVRefresh` | **Yes** — all eligible tenants | +| Smoke handler | `Get-CIPPAlertUserReportedPhishing -TenantFilter ... -InputValue @{ HoursBack = 24 }` | Read-only Graph query | + +--- + +## Related Docs + +- `docs/upstream-sync/USERREPORTEDPHISHING_API_20260617.md` — import tracking +- `docs/upstream-sync/USERREPORTEDPHISHING_POST_MERGE_20260617.md` — post-merge validation record diff --git a/docs/upstream-sync/history-cipp/APPLIED_COMMITS_CIPP_20260617.md b/docs/upstream-sync/history-cipp/APPLIED_COMMITS_CIPP_20260617.md new file mode 100644 index 0000000000..214b56a32d --- /dev/null +++ b/docs/upstream-sync/history-cipp/APPLIED_COMMITS_CIPP_20260617.md @@ -0,0 +1,75 @@ +# Applied Commits Tracking — CIPP (Frontend) + +Generated: 2026-06-17 +Branch: `manage365/upstream-sync-cipp-20260617` +Backup tag: `backup/pre-upstream-sync-cipp-20260617` +Branch tip: latest on `manage365/upstream-sync-cipp-20260617` (checkpoint pass complete) + +## Summary + +| Status | Count | +|--------|-------| +| Applied cleanly | 7 | +| Applied with adaptation | 3 | +| Deferred / reverted from branch | 1 | +| Reverted (formatting-only / no net change) | 1 | +| Already implemented | 5 | +| Skipped (conflict) | 1 | +| Conflicts | 4 (`b1902421`, `1e7aef11`, `2e9b9fd5`, `d7e8b0b5` cherry-pick) | + +Mini-batch 1: `1e59d2d4`, `98d5d94a` applied; `c8d61c07` reverted after review. +Mini-batch 2: `7a85827e` applied; `cfbf3508`, `db57e52a` already present; `b1902421` conflict. +Mini-batch 3: `1cd1ef72` adapted manually (two commits); `4b9efd82`, `3734adee` cherry-picked on retry. +Mini-batch 4: `0c32a84e` cherry-picked cleanly; `1e7aef11` adapted after conflict; `7054bfc4` deferred (see below). +Post batch 4: `2e9b9fd5` drawer guard adapted after cherry-pick conflict. +Mini-batch 5: `d7e8b0b5` + `1cb6a11c` already implemented in fork `377ce394b`; verified parity, no code delta. + +## Commit Log + +| Upstream SHA | Applied SHA | Status | Reason | Files | Tests | Notes | +|--------------|-------------|--------|--------|-------|-------|-------| +| `1e59d2d43fab463a709d1dac2477f45cfacdfae6` | `623ac8590` | Applied cleanly | Shape test baseline update only | `Tests/Shapes/ListTests.json` | JSON parse OK | Adds `ExoTransportConfig` to ListTests shape. | +| `98d5d94a0d122d5fbc7380d5abe5cb02fba366fd` | `f3c917c1a` | Applied cleanly | Custom test alert-on-status UI; pairs with API `6aa66c74` | `src/pages/tools/custom-tests/add.jsx` | Static review | `AlertStatuses` multi-select gated on `AlertOnFailure`. | +| `c8d61c0757853359cde98f9a00e6e3ba6fe6e98e` | `aebf6ada5` → reverted `af5c9a905` | Already implemented before sync; reverted noisy formatting-only cherry-pick | JIT admin autocomplete creatable guard | `src/pages/identity/administration/jit-admin/add.jsx` | Static review post-revert | Fork already had `creatable={false}` on all five autocomplete fields. | +| `cfbf3508e1ede8b51ef6daff780356ea0379f083` | — | Already implemented | Duplicate `appliesToTest` merge | `src/data/standards.json` | JSON compare | Skipped cherry-pick. | +| `db57e52a207f3e9d77974832978d88963859bf83` | — | Already implemented | TemplateList optional + non-creatable | `src/data/standards.json` | JSON compare | Skipped cherry-pick. | +| `b19024214e96bd207640c5e63dcefb38d408e161` | — | Skipped (conflict) | Tab layout first-tab margin | `HeaderedTabbedLayout.jsx`, `TabbedLayout.jsx` | Not applied | Layout conflict; needs adapted apply. | +| `7a85827ef1072955a48cb1d48c3ce2aafe3ab88d` | `bb5150d99` | Applied cleanly | Bulk patch wizard contact/UPN fields | `src/pages/identity/administration/users/patch-wizard.jsx` | Static review | Cherry-pick `-x` succeeded. | +| `1cd1ef7223672170bdce1fffe88d8bb4ddb903d9` | `dc44bd9d1` + `1688fbca0` | Applied with adaptation (fully adapted) | TAP audit log template filter | `src/data/AuditLogTemplates.json` | JSON parse OK | Cherry-pick conflicted; manual adaptation: (1) `like` `"*"` → `"*PassId*"`; (2) duplicate `ne []` SecuredAccessPassData filter removed. | +| `4b9efd827d27a3498eca51b444934a99e78c634f` | `dce16f09c` | Applied cleanly | Licenses report `apiDataKey="Results"` | `src/pages/tenant/reports/list-licenses/index.js` | Static review | Cherry-pick `-x` succeeded on mini-batch 3 retry. | +| `3734adeeaec92e6d83974590c36a9e91bf024a98` | `7a6c71950` | Applied cleanly | User defaults license label casing | `src/pages/tenant/manage/user-defaults.js` | Static review | Cherry-pick `-x` succeeded; `AvailableUnits` → `availableUnits`. | +| `7054bfc42d67a7f3d86b23b036057ba98559d488` | `de565d5f9` → reverted `b0fcc3129` | **Deferred / reverted from frontend branch** | UserReportedPhishing alert definition | `src/data/alerts.json` | JSON parse OK | Cherry-picked in mini-batch 4, then removed: matching CIPP-API handler `Get-CIPPAlertUserReportedPhishing.ps1` and `ThreatSubmission.ReadWrite.All` SAM/CPV chain not imported yet. **Revisit only as paired frontend + CIPP-API feature import.** | +| `1e7aef11995feb42e9872ec4aefac39fc7ba67c5` | `ad8f64688` | Applied with adaptation | Quota alert run intervals `4h` → `1d` | `src/data/alerts.json` | JSON parse OK | Cherry-pick conflicted on fork `QuotaUsed` `multipleInput` schema; manually set SharePointQuota and OneDriveQuota to `1d`. QuotaUsed already `1d`. | +| `0c32a84eb21d3df3a719427b54d10821a94b40a4` | `52cf36559` | Applied cleanly | Hudu extension portal link toggles | `src/data/Extensions.json` | JSON parse OK | Data-only switches: Partner Center, Defender, Compliance (Purview). No navigation/branding changes. | +| `2e9b9fd508f2e9ae6fddffa9f03db7c8edb22881` | `ac59795fb` | Applied with adaptation | Hide open button when drawer is controlled | `CippTenantAllowBlockListTemplateDrawer.jsx` | Static review | Cherry-pick conflicted: fork lacks upstream `editData`/`isEditMode` controlled-drawer stack (`bc412396b`). Adapted: optional `drawerVisible: controlledDrawerVisible` prop + `controlledDrawerVisible === undefined` guard only. Uncontrolled page usage unchanged. | +| `d7e8b0b569c3f9243ff7e09a326ed74ccbd3a046` | `377ce394b` | **Already implemented** | Toggle button size/sx on alignment page | `standards/alignment/index.js` | Static review | Incorporated when fork ported by-standard view (`377ce394b`). Cherry-pick `-x` conflicted (formatting-only); verified identical `MuiToggleButton-root` sx on tenant filter and view-mode toggles. | +| `1cb6a11cf22c446b952976f5200f5a3f3df689f5` | `377ce394b` | **Already implemented** | Standard name retrieval priority | `standards/alignment/index.js` | Static review | `hasExactMatch` + label/`row.standardName`/`standardKey` fallback chain already present in `377ce394b`. No code delta on sync branch. | + +## Mini-batch 5 Validation — Standards Alignment Pair (2026-06-17) + +| Check | Result | +|-------|--------| +| Pre-check protected areas | Both commits touch only `src/pages/tenant/standards/alignment/index.js` — no protected overlap | +| `d7e8b0b5` cherry-pick | Conflict — fork already has toggle sx (`py: 0.25`, `px: 1`, `fontSize: 0.75rem`) on both ToggleButtonGroups | +| `1cb6a11c` cherry-pick | Not attempted separately — same file; logic already present | +| Toggle buttons | Still render; only size/style sx applied; no behavior change | +| Standard name retrieval | `hasExactMatch ? (label ?? row.standardName ?? key) : (row.standardName ?? label ?? key)` — safe fallbacks when fields missing | +| Data fetching / tenant / permissions | Unchanged | +| Full frontend build/lint | Not run — known pre-existing dependency blockers | + +## Proposed Next Candidates (post-checkpoint) + +| Priority | SHA | Title | Notes | +|----------|-----|-------|-------| +| 1 | `7054bfc4` + API pair | UserReportedPhishing alert | Paired with CIPP-API handler + SAM permission | +| 2 | `b1902421` | Tab layout first-tab margin | Adapted manual apply only | +| 3 | `bc412396b` / `20e2f554d` | Allow/block list edit mode | Full controlled-drawer stack | +| 4 | `4c0c058f` | Alerts schema change | Higher risk — review before apply | + +**Exclude:** `16b4503f`, dependency/build/search/table commits unless explicitly approved. + +## Next Steps + +1. Final code-review-only pass on sync branch diff vs `main`. +2. Open CIPP frontend PR paired with CIPP-API PR #1 review. +3. Do not continue upstream picks without explicit approval per candidate. diff --git a/docs/upstream-sync/history-cipp/APPLIED_COMMITS_CIPP_CYCLE2_20260617.md b/docs/upstream-sync/history-cipp/APPLIED_COMMITS_CIPP_CYCLE2_20260617.md new file mode 100644 index 0000000000..0783efac4e --- /dev/null +++ b/docs/upstream-sync/history-cipp/APPLIED_COMMITS_CIPP_CYCLE2_20260617.md @@ -0,0 +1,97 @@ +# CIPP Frontend — Upstream Sync Cycle 2 Mini-Batch (2026-06-17) + +**Branch:** `manage365/upstream-sync-cipp-cycle2-20260617` +**Base:** `main` @ `c88e7c9edc3dc8d14cf208884a8f69b9d0775bd2` +**Backup tag:** `backup/pre-upstream-sync-cipp-cycle2-20260617` (created) +**Pushed:** No + +## Summary + +| SHA | Subject | Status | Notes | +|-----|---------|--------|-------| +| `c15d1d0d` | fix: sherweb integration conditional fields | **Skipped (conflict)** | `Extensions.json` merge conflict — local fork has no Sherweb integration block; upstream patch targets Sherweb conditional `.value` field paths | +| `f768330c` | fix(standards): move CIS 5.1.4.1 and SMB1001 (2.8) tags to join standard | **Skipped (conflict / already implemented)** | Cherry-pick conflict on `standards.json`. Local `standards.intuneRestrictUserDeviceJoin` already carries `CIS_5_1_4_1` / `SMB1001_2_8` tags; registration standard tags already empty (CIS version string differs: local `CIS M365 7.0.0` vs upstream `6.0.1`) | +| `5709f856` | fix: update terminology from "Temporary Access Password" to "Temporary Access Pass" | **Applied (adapted)** | Manual UI-text port in `CippUserActions.jsx` only (label + confirmText). `standards.json` TAP strings already correct — **Already implemented**, no file change | + +**Applied commits:** `5709f856` (adapted, partial scope) +**Branch tip after cycle:** see `git log -1` on branch (code + docs) + +## Pre-checks (protected areas) + +All three commits touched only `src/data/Extensions.json`, `src/data/standards.json`, and/or `src/components/CippComponents/CippUserActions.jsx`. None modified Quarantine, Email Troubleshooter, branding/manage365-version, tenant switching, auth, navigation, `package.json`, ApiCall helpers, or dashboard v2. + +## Per-commit detail + +### `c15d1d0d` — Sherweb Extensions conditional fields + +- **Files:** `src/data/Extensions.json` +- **Protected-area check:** Pass +- **Action:** `git cherry-pick -x c15d1d0d` → **CONFLICT** in `src/data/Extensions.json` +- **Resolution:** Stopped per policy; `git cherry-pick --abort` +- **Do not retry** in cycle 2 without Sherweb block present. + +### `f768330c` — standards.json tag fix (CIS / SMB1001 join vs registration) + +- **Files:** `src/data/standards.json` +- **Protected-area check:** Pass +- **Action:** `git cherry-pick -x f768330c` → **CONFLICT** in `standards.json` +- **Resolution:** Stopped per policy; `git cherry-pick --abort` +- **Equivalence:** Tag move appears already reflected on `main` with updated CIS catalog version. +- **Do not retry** in cycle 2. + +### `5709f856` — TAP terminology + +- **Files (upstream):** `src/components/CippComponents/CippUserActions.jsx`, `src/data/standards.json` +- **Protected-area check:** Pass (component not in protected list) +- **Action:** Cherry-pick failed (conflict); **manual adapted apply** on 2026-06-17 +- **Changes:** + - `CippUserActions.jsx`: `Create Temporary Access Password` → `Create Temporary Access Pass`; confirm dialog wording updated to match + - `standards.json`: no edit — TAP labels/help already use "Temporary Access Pass" +- **Validation:** Diff limited to two user-visible strings; no logic, API URL, permissions, or field changes + +## JSON validation (post-cycle, working tree) + +Validated with `python3 -m json.tool` equivalent (`json.load`): + +| File | Result | +|------|--------| +| `src/data/Extensions.json` | OK | +| `src/data/standards.json` | OK | +| `src/data/AuditLogTemplates.json` | OK | + +## TAP terminology sweep (2026-06-17) + +Repo-wide search for user-facing legacy TAP wording in `src/` (excluding docs). + +### Findings + +| Location | String | Action | +|----------|--------|--------| +| `CippUserActions.jsx` | Create / confirm TAP strings | **Already fixed** (`943e57f11`, upstream `5709f856` adapted) | +| `users/index.js` `mobileQuickActions` | `Create Temporary Access Password` | **Fixed** → `Create Temporary Access Pass` (`722b2a025`) | +| `standards.json`, `AuditLogTemplates.json` | Temporary Access Pass | **Already correct** | +| `jit-admin/*.jsx` | `Generate TAP`, `UseTAP`, field names | **Left unchanged** — internal/API identifiers or standard TAP acronym | +| `/api/ExecCreateTAP` | endpoint path | **Left unchanged** — not a user-facing label | + +### Wording change (`722b2a025`) + +| File | Before | After | +|------|--------|-------| +| `users/index.js` | `"Create Temporary Access Password"` | `"Create Temporary Access Pass"` | + +### Validation + +- Single string in `mobileQuickActions`; no logic, permissions, or API changes. +- Matches `CippUserActions` action label so mobile quick-action filter works. +- No remaining user-facing `Temporary Access Password` in `src/`. + +## CIPP-API cycle 2 (paused) + +Branch `manage365/upstream-sync-cipp-api-cycle2-20260617` paused docs-only; ORCA mini-batches all empty/already implemented. No further ORCA/DB-cache work without explicit approval. + +## Issues / next steps + +1. **Sherweb (`c15d1d0d`):** Deferred — requires upstream Sherweb `Extensions.json` block. +2. **Standards tags (`f768330c`):** Deferred / satisfied on fork. +3. **PR:** Two small UI terminology commits ready — recommend opening a **small CIPP PR** now, or continue batching from delta inventory. + diff --git a/docs/upstream-sync/history-cipp/BASELINES_INTAKE_20260814.md b/docs/upstream-sync/history-cipp/BASELINES_INTAKE_20260814.md new file mode 100644 index 0000000000..f25c2fe520 --- /dev/null +++ b/docs/upstream-sync/history-cipp/BASELINES_INTAKE_20260814.md @@ -0,0 +1,25 @@ +# Baselines Feature Intake — 2026-08-14 + +Cycle type: **Feature intake** within major 10.8.x sync. Per [PROCESS.md](PROCESS.md). + +## Feature: Baselines (drift-first engine) + +- Upstream refs: `Modules/CIPPCore/Public/Baselines/*` (29), `Set-CippBaselineRunContext.ps1`, `Start-CIPPBaselineOrchestrator`, HTTP Baseline* entrypoints, `Config/BaselineStandards/**`, FE `src/pages/tenant/baselines/**` + `CippBaselines/*`, FeatureFlags `Baselines`, timer `9f2c7b1e-4a6d-4c3f-8b9a-5e1d2f7c0a44` +- Fork gap: no baselines pages/APIs/modules +- Protected conflicts: Applied Standards / drift UI — baselines are **parallel**, not a replacement; Adapt any shared Intune compare helpers +- Scope: **capability** on existing SWA + Function App Durable — no Craft, no EasyAuth migration +- Hosting: Azure Tables (`Baselines`, `BaselineRollouts`, `BaselineAlignment`, history/trend/locks) + existing `Start-CIPPOrchestrator` / standards processor slot +- Flag behavior: `Enabled: false` by default; flag gates **scheduled timer only**; pages/on-demand work when flag off (upstream design). Manage365 keeps flag off until smoke; optionally hide nav until enabled +- Phases: design → API modules/config/HTTP/orch → FE pages/components → verify → PR → deploy → enable flag after smoke +- Approval: [x] design (approved via major-cycle plan execute) [x] implement [ ] deploy (enable) + +## Branding (sibling Adapt) + +- Upstream: `ListBrandingSettings`, `ListBrandingPresets`, `Get-CIPPBranding*`, PDF cover helpers +- Fork: keep Manage365 `CippBrandingSettings` / `customBranding`; surgical merge only — do not wipe branding UX + +## Explicit non-goals + +- Replacing Applied Standards with Baselines +- Enabling Baselines timer in production by default +- Porting SSO/container nav that co-landed in 10.8 diff --git a/docs/upstream-sync/history-cipp/BEC_INTAKE_20260715.md b/docs/upstream-sync/history-cipp/BEC_INTAKE_20260715.md new file mode 100644 index 0000000000..187eeccfb6 --- /dev/null +++ b/docs/upstream-sync/history-cipp/BEC_INTAKE_20260715.md @@ -0,0 +1,64 @@ +# BEC (Compromise Remediation) Intake — July 15, 2026 + +Cycle type: **Feature intake** per [PROCESS.md](PROCESS.md). + +Upstream commits taken — frontend: `8359da60e` (sent messages check), `488541e0a` (recent inbox +rule changes), `a445e3981` (trusted/blocked senders checks), `cb81f1a07` (collapsible compact +check cards), `c1fb0f92a` (senders/sent-emails as tables). API: `15dc7816e` / `f95046cbe` +(inbox rule changes in `Push-BECRun`), plus retained `42087aefc` (message trace) which the fork +partially had. + +Fork version bumped **5.19.0 → 5.20.0** (upstream baseline unchanged at 10.6.1). + +## Taken + +### CIPP-API — `Push-BECRun.ps1` (both `CIPPActivityTriggers` and `CIPPCore` copies) + +- **Copies resynced.** The `CIPPCore` copy — the one the fork's `profile.ps1` actually loads — + was stale and missing the entire `SentMessages` (message trace) block, so the Sent Messages + data was never produced in production. Both copies are now identical. +- **Inbox rule changes** (upstream): a separate user-scoped `Search-UnifiedAuditLog` for + `New-InboxRule` / `Set-InboxRule` / `Remove-InboxRule` / `UpdateInboxRules`, surfaced as + `InboxRuleChanges`. Existing rules gain a `RecentlyChanged` flag when their name matches a + 7-day audit event. +- **Better failure logging** (upstream): rules/trace failures log through `Write-LogMessage` + with normalized errors; the error entity now carries `ExtractedAt`. +- **Fork customization preserved:** the extra `MailboxLogin` / `UserLoggedIn` operations in the + 7-day tenant-wide audit search. +- **Manage365 addition — safelist backend.** Upstream's UI ships a "Trusted & Blocked Senders" + check (Check 8) but **no upstream branch produces the fields** (`TrustedSenders`, + `BlockedSenders`, `SafelistChanges`) — upstream's check renders empty today. We implemented + the producer: `Get-MailboxJunkEmailConfiguration` for the current trusted/blocked lists and a + user-scoped audit search for `Set-MailboxJunkEmailConfiguration` events (7 days) shaped as + `{ Operation, UserKey, Date, Trusted, Blocked }` to match what the UI and PDF report render. + Watch for upstream shipping their own producer later; theirs should supersede ours if shapes + match. + +### CIPP — Compromise Remediation UI + +- **`bec.jsx`** — merged upstream's compact accordion layout into the fork's page: every check + is now a collapsed accordion with a count chip (amber when findings exist), lists cap at 300px + with scrolling, sent messages and trusted/blocked senders render as `CippDataTable` tables. + New content: inbox rule changes sub-section in Check 1 with `RecentlyChanged` sorting/labels, + Sent Messages (Check 5), Trusted & Blocked Senders (Check 8) with safelist change history. + Checks renumbered to match upstream (MFA 6, Passwords 7). + **Fork customizations preserved:** no-user-selected / user-not-found / loading-skeleton page + states, header `userActions`, `CippTimeAgo` subtitle, responsive grid (`xs`/`md` sizes), + theme-aware loading banner, memoized check card. +- **`BECRemediationReportButton.js`** — adopted upstream wholesale (fork's copy was an older + upstream version with no customizations). The PDF report now covers inbox rule changes and + trusted/blocked senders, and both feed the threat score. +- **`CippButtonCard.jsx`** — accordion header now stretches (`flexGrow: 1`) so check titles can + right-align their chips, and the stray divider between a collapsed accordion summary and its + details was removed (upstream change). Fork's hover-shadow interaction kept. + +## Verification + +- `yarn build` (Node 22): pass, no lint errors on the three touched frontend files. +- PowerShell parser on both `Push-BECRun.ps1` copies: 0 errors. +- `package.json` / `yarn.lock` intact after build (rm-removal holding). + +## Deferred + +- `c1fb0f92a`'s removal of per-item icons in favor of chips was taken; no part of the BEC family + remains deferred. diff --git a/docs/upstream-sync/history-cipp/CIPP_SYNC_CHECKPOINT_20260617.md b/docs/upstream-sync/history-cipp/CIPP_SYNC_CHECKPOINT_20260617.md new file mode 100644 index 0000000000..7106ab91ec --- /dev/null +++ b/docs/upstream-sync/history-cipp/CIPP_SYNC_CHECKPOINT_20260617.md @@ -0,0 +1,123 @@ +# CIPP Frontend Sync Checkpoint — 2026-06-17 + +## Branch + +| Field | Value | +|-------|-------| +| Branch | `manage365/upstream-sync-cipp-20260617` | +| Base | `main` @ `f2d87612ec80b9be24c303137c9604590992b144` | +| Tip | Latest — `docs: update CIPP frontend sync checkpoint` (run `git rev-parse HEAD` on branch) | +| Backup tag | `backup/pre-upstream-sync-cipp-20260617` (local, not pushed) | +| Working tree | Clean | +| Remote push | Nothing pushed | + +## Mini-batches Completed + +### Mini-batch 1 + +| Upstream | Title | Outcome | +|----------|-------|---------| +| `1e59d2d4` | Update ListTests.json | Applied → `623ac8590` | +| `98d5d94a` | Custom Test — Alert on X statuses | Applied → `f3c917c1a` | +| `c8d61c07` | JIT admin — remove creatable | Already implemented; noisy cherry-pick reverted → `af5c9a905` | + +### Mini-batch 2 + +| Upstream | Title | Outcome | +|----------|-------|---------| +| `cfbf3508` | Remove duplicate appliesToTest | Already implemented — skipped | +| `db57e52a` | TemplateList optional/non-creatable | Already implemented — skipped | +| `b1902421` | Tab layout first-tab margin | Skipped/deferred — layout conflict | +| `7a85827e` | Bulk patch wizard contact/UPN | Applied → `bb5150d99` | + +### Mini-batch 3 + +| Upstream | Title | Outcome | +|----------|-------|---------| +| `1cd1ef72` | TAP audit log template filter | Adapted → `dc44bd9d1` + `1688fbca0` | +| `4b9efd82` | Licenses report apiDataKey | Applied → `dce16f09c` | +| `3734adee` | User defaults license label | Applied → `7a6c71950` | + +### Mini-batch 4 + +| Upstream | Title | Outcome | +|----------|-------|---------| +| `7054bfc4` | UserReportedPhishing alert | Applied → `de565d5f9`, then deferred → `b0fcc3129` | +| `1e7aef11` | Quota alert intervals | Adapted → `ad8f64688` | +| `0c32a84e` | Extensions portal links | Applied → `52cf36559` | + +### Post mini-batch 4 + +| Upstream | Title | Outcome | +|----------|-------|---------| +| `2e9b9fd5` | Drawer button guard | Adapted → `ac59795fb` | + +### Mini-batch 5 — Standards alignment pair + +| Upstream | Title | Outcome | +|----------|-------|---------| +| `d7e8b0b5` | Toggle button size | Already implemented in `377ce394b` — verified parity | +| `1cb6a11c` | Standard name retrieval | Already implemented in `377ce394b` — verified parity | + +## Applied Commits (sync branch code) + +| Upstream | Applied SHA | Files | +|----------|-------------|-------| +| `1e59d2d4` | `623ac8590` | `Tests/Shapes/ListTests.json` | +| `98d5d94a` | `f3c917c1a` | `src/pages/tools/custom-tests/add.jsx` | +| `7a85827e` | `bb5150d99` | `src/pages/identity/administration/users/patch-wizard.jsx` | +| `1cd1ef72` | `dc44bd9d1`, `1688fbca0` | `src/data/AuditLogTemplates.json` | +| `4b9efd82` | `dce16f09c` | `src/pages/tenant/reports/list-licenses/index.js` | +| `3734adee` | `7a6c71950` | `src/pages/tenant/manage/user-defaults.js` | +| `1e7aef11` | `ad8f64688` | `src/data/alerts.json` | +| `0c32a84e` | `52cf36559` | `src/data/Extensions.json` | +| `2e9b9fd5` | `ac59795fb` | `CippTenantAllowBlockListTemplateDrawer.jsx` | + +## Adapted Commits + +| Upstream | Applied SHA | Adaptation | +|----------|-------------|------------| +| `1cd1ef72` | `dc44bd9d1` + `1688fbca0` | Manual TAP filter: `*PassId*` + remove duplicate `ne []` | +| `1e7aef11` | `ad8f64688` | Quota intervals only; fork `QuotaUsed` schema differs | +| `2e9b9fd5` | `ac59795fb` | Partial guard without full controlled/edit drawer stack | + +## Already Implemented (pre-sync or prior fork port) + +| Upstream / Fork | Title | Evidence | +|-----------------|-------|----------| +| `c8d61c07` | JIT creatable guard | Five `creatable={false}` on JIT admin autocompletes | +| `cfbf3508` | Duplicate appliesToTest | Single merged `appliesToTest` in standards.json | +| `db57e52a` | TemplateList optional/non-creatable | CA TemplateList already configured | +| `377ce394b` | By-standard alignment view + fixes | Includes `d7e8b0b5` toggle sx and `1cb6a11c` name retrieval | + +## Reverted / Deferred + +| Upstream | Applied then reverted | Reason | +|----------|----------------------|--------| +| `c8d61c07` | `aebf6ada5` → `af5c9a905` | Formatting-only cherry-pick; already implemented | +| `7054bfc4` | `de565d5f9` → `b0fcc3129` | No matching CIPP-API handler or ThreatSubmission SAM chain | + +## Skipped (conflict — not applied) + +| Upstream | Title | Reason | +|----------|-------|--------| +| `b1902421` | Tab layout first-tab margin | Layout conflict in tab components | + +## Known Concerns + +1. **UserReportedPhishing deferred** — Revisit only as paired frontend (`7054bfc4`) + CIPP-API (`Get-CIPPAlertUserReportedPhishing.ps1`, `ThreatSubmission.ReadWrite.All` SAM/CPV). +2. **`b1902421` tab margin** — Still deferred; needs adapted manual apply in fork responsive layout. +3. **`7a85827e` patch wizard** — Smoke test UPN suffix rebuild and bulk contact updates in a test tenant. +4. **Drawer guard partial** — `2e9b9fd5` adapted without full upstream controlled/edit drawer stack (`bc412396b` / `20e2f554d`). +5. **Build/lint** — Full frontend build/lint not validated; known pre-existing dependency/tooling blockers may remain. + +## Recommendation + +**Ready for frontend PR review** after a final code-review-only pass on the branch diff vs `main`. + +Do **not** continue upstream cherry-picks without explicit approval per candidate. Remaining isolated picks (`b1902421`, `7054bfc4`+API, allow/block edit mode, `4c0c058f`) should be triaged individually. + +## Tracking Docs + +- `docs/upstream-sync/APPLIED_COMMITS_CIPP_20260617.md` +- `docs/upstream-sync/UPSTREAM_SYNC_CIPP_20260617.md` diff --git a/docs/upstream-sync/history-cipp/COPILOT_AI_INTAKE_20260715.md b/docs/upstream-sync/history-cipp/COPILOT_AI_INTAKE_20260715.md new file mode 100644 index 0000000000..8eae08dab6 --- /dev/null +++ b/docs/upstream-sync/history-cipp/COPILOT_AI_INTAKE_20260715.md @@ -0,0 +1,84 @@ +# Copilot & AI Feature Intake — 2026-07-15 + +Dedicated feature intake cycle: ports the upstream **Copilot & AI** feature family +(deferred in the 2026-07-13 major sync) into Manage365, plus the upstream +**CIPP-API 10.6.2 hotfix**. + +- Frontend branch: `manage365/copilot-intake-20260715` (backup tag `backup/pre-copilot-intake-20260715`) +- API branch: `manage365/copilot-intake-20260715` (backup tag `backup/pre-copilot-intake-20260715`) +- Fork version: **5.18.0** (upstream baseline 10.6.1 frontend / 10.6.2 API) + +## CIPP-API — Copilot & AI + +Ported from upstream tip (files were near-fully additive, so taken wholesale +rather than by cherry-pick chain): + +| Area | Files | +| --- | --- | +| Shadow AI catalog | `Config/ShadowAI.json` (curated, PR-editable AI tool catalog) | +| HTTP endpoints | `Invoke-ListShadowAI`, `Invoke-ExecShadowAISanction`, `Invoke-ListCopilotSettings`, `Invoke-ExecCopilotSettings`, `Invoke-ListCopilotUsage`, `Invoke-ListAgent365Packages`, `Invoke-ListAgent365PackageDetail` (all under `Tenant/Standards`) | +| Standards | `Invoke-CIPPStandardCopilotSettings`, `Invoke-CIPPStandardCopilotLimitedMode` + their `Config/standards.json` entries (cat: "Copilot (M365) Standards") | +| DB cache setters | Refreshed the four `Set-CIPPDBCacheCopilot*` functions to upstream tip (consolidated `-AddCount` call pattern) | + +Already present from the 2026-07-13 sync (no action needed): CopilotReadiness +test suite (17 tests), the four Copilot DB cache types in +`Config/CIPPDBCacheTypes.json`, and the `CopilotUsage` group in +`Invoke-CIPPDBCacheCollection.ps1`. + +### SAM Manifest permissions added (both `Config/SAMManifest.json` and `Modules/CIPPCore/lib/data/SAMManifest.json`) + +| Permission | GUID | Type | +| --- | --- | --- | +| CopilotPackages.ReadWrite.All | `ed31732f-9495-47ed-ba3b-4ed0948c1c64` | Role | +| CopilotPackages.Read.All | `72f0655d-6228-4ddc-8e1b-164973b9213b` | Role | +| CopilotPolicySettings.Read | `556d5e2e-1081-4452-8147-26c3a1b06f58` | Role | + +**Action required:** add these three application permissions to the SAM app +registration in the MSP tenant and run a CPV refresh so they reach client +tenants. Graph endpoints used are `/beta/copilot/admin/*` and +`/beta/copilot/reports/*`. + +### Dependencies verified in fork + +`New-CIPPDbRequest`, `Get-CIPPDbItem -CountsOnly`, `Add-CIPPDbItem -AddCount`, +and the `DetectedApps` / `ServicePrincipals` / `OAuth2PermissionGrants` caches +all exist. Shadow AI sign-in enrichment degrades gracefully without Entra P1. + +## CIPP-API — 10.6.2 hotfix intake + +Cherry-picked from upstream `Dev to hf (#2140)`: + +- `610ec61e7` fix(graph): reconcile AppCache app id drift — merged into the + fork's `Get-GraphToken.ps1` **preserving the fork's shared token cache / + lock wrapper**; only the AppCache-vs-KeyVault reconcile block was adopted. +- `176d43baa` force external uri to be partner center (partner webhooks) +- `2da187218` move snooze endpoints to new `CIPP.AlertSnooze.*` permission +- Version bumped to **10.6.2** (`version_latest.txt` + `Config/version_latest.txt`) + +Skipped: + +- `ad9caf3ff` OneDrive root permissions cache — upstream marks it + "boilerplate, not implemented yet"; revisit when upstream wires it up. +- `8c4cf8d94` MCP resolver fix — fork has no MCP module yet (MCP intake still + deferred). + +## CIPP frontend — Copilot & AI + +- Ported all six pages under `src/pages/copilot/` (Shadow AI Discovery, + Copilot Settings, Agent365 Packages, Adoption / Trend / User Activity + reports) and `src/components/ShadowAIReportButton.js` from upstream tip. +- Added the **Copilot & AI** menu section to `src/layouts/config.js` between + Security & Compliance and Email & Exchange (upstream placement), restyled to + the fork's double-quote convention; added `SparklesIcon` import. +- All page dependencies (CippTablePage, CippChartCard, CippInfoBar, + CippApiDialog, CippOffCanvas, CippJSONView, use-dialog) already exist in the + fork. + +## Verification + +- `yarn build` (Node 22): success, all six `/copilot/*` routes emitted; + `package.json` / `yarn.lock` intact after build (per the 20260713 build + script fix). +- PowerShell parse check on all 13 added/changed API files plus + `Get-GraphToken.ps1`: clean. +- `Config/standards.json` and both SAM manifests validated as JSON. diff --git a/docs/upstream-sync/history-cipp/CUSTOM_FEATURE_MAP_20260617.md b/docs/upstream-sync/history-cipp/CUSTOM_FEATURE_MAP_20260617.md new file mode 100644 index 0000000000..385900e0ac --- /dev/null +++ b/docs/upstream-sync/history-cipp/CUSTOM_FEATURE_MAP_20260617.md @@ -0,0 +1,266 @@ +# Custom Feature Map — Manage365/CIPP + +Generated: 2026-06-17 11:21 + +Purpose: Protected areas that must not be overwritten during upstream sync. + +## Git State at Generation Time + +| Repo | Branch | Tip | Upstream behind | +|------|--------|-----|-----------------| +| CIPP | `main` | `f2d87612e` | 241 commits (`upstream/main`) | +| CIPP-API | `master` | `de78a343e` | 315 commits (`upstream/master`) | + +## Protected Custom Areas + +### Manage365 Branding & Versioning + +**Purpose:** Fork identity, version display, OAuth branding, release tooling separate from upstream version.json + +**Risk if overwritten:** Critical — overwriting removes product identity and version tracking + +**Upstream overlap likelihood:** High — upstream touches version.json, settings pages, logo, README regularly + +**Notes for conflict resolution:** Preserve manage365-version.json as primary display version. Update-Version.ps1 writes both upstream and Manage365 versions. Get-CippAlerts includes Manage365-specific upstream drift alerts. + +**CIPP files:** +- `public/manage365-version.json` +- `public/version.json` +- `Tools/Update-Version.ps1` +- `src/components/CippSettings/CippVersionProperties.jsx` +- `src/components/logo.js` +- `src/layouts/top-nav.js` +- `src/layouts/config.js` +- `src/components/CippComponents/CIPPM365OAuthButton.jsx` +- `src/components/ReleaseNotesDialog.js` +- `README.md` + +**CIPP-API files:** +- `version_latest.txt` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetCippAlerts.ps1` + +--- + +### Quarantine Portal 5.13.0 + +**Purpose:** Advanced quarantine management UI, shared components, server-side filtering, export, bulk actions, lazy detail loading + +**Risk if overwritten:** Critical — major custom feature set beyond upstream + +**Upstream overlap likelihood:** Very High — upstream actively changes quarantine endpoints and UI + +**Notes for conflict resolution:** Uses EXO PowerShell not Graph. manualPagination, post-filters, 7d default window, export cap 5k. Never auto-resolve conflicts toward upstream. + +**CIPP files:** +- `src/components/CippComponents/quarantine/` +- `src/pages/email/administration/quarantine/index.js` +- `Tests/Shapes/GetMailQuarantineMessage.json` +- `Tests/Shapes/ListQuarantinePolicy.json` + +**CIPP-API files:** +- `Modules/CIPPCore/Public/Tools/Build-CIPPQuarantineQueryParams.ps1` +- `Tests/Tools/Build-CIPPQuarantineQueryParams.Tests.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-GetMailQuarantineMessage.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExportMailQuarantine.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecQuarantineManagement.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecMailboxSafeSender.ps1` +- `Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-ListMailQuarantineAllTenants.ps1` +- `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ListMailQuarantineAllTenants.ps1` +- `docs/QUARANTINE_FEATURES.md` +- `Tests/Endpoint/Invoke-GetMailQuarantineMessage.Tests.ps1` +- `Tests/Endpoint/Invoke-ExportMailQuarantine.Tests.ps1` + +--- + +### Email Troubleshooter Enhancements + +**Purpose:** Integrated quarantine tab, trace presets, bulk refresh fixes, shared quarantine UI in troubleshooter context + +**Risk if overwritten:** High — tightly coupled to quarantine shared module + +**Upstream overlap likelihood:** High — upstream changes email tools and troubleshooting pages + +**Notes for conflict resolution:** ExecEmailTroubleshoot reuses Build-CIPPQuarantineQueryParams. Preserve trace/EML preset behavior. + +**CIPP files:** +- `src/pages/email/troubleshooting/email-troubleshooter/index.js` +- `src/pages/email/troubleshooting/message-viewer/index.js` +- `docs/superpowers/plans/2026-03-21-email-troubleshooter.md` +- `docs/superpowers/specs/2026-03-21-email-troubleshooter-design.md` + +**CIPP-API files:** +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecEmailTroubleshoot.ps1` + +--- + +### Custom Tenant Workflows + +**Purpose:** Tenant management, GDAP onboarding, tenant mode deployment, configuration backup/restore + +**Risk if overwritten:** High — core MSP workflow customizations + +**Upstream overlap likelihood:** Medium-High — upstream frequently updates tenant admin pages + +**Notes for conflict resolution:** Includes license capability presets, CA template package tags, group-based licensing, excludeFromAlert. + +**CIPP files:** +- `src/components/CippWizard/` +- `src/pages/tenant/manage/` +- `src/pages/tenant/gdap-management/` +- `src/pages/cipp/advanced/super-admin/tenant-mode.js` +- `src/pages/cipp/settings/tenants.js` +- `src/pages/onboarding.js` +- `src/pages/onboardingv2.js` + +**CIPP-API files:** +- `Modules/CIPPCore/Public/Tenant/Get-CIPPTenantAlignment.ps1` *(may not exist)* +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Invoke-ListTenantAlignment.ps1` *(may not exist)* + +--- + +### Navigation & Search UX + +**Purpose:** Hybrid universal search in top nav, frosted glass styling, dashboard v2 routing, custom breadcrumbs + +**Risk if overwritten:** High — visible UX differentiators + +**Upstream overlap likelihood:** High — upstream changes nav, search, dashboard frequently + +**Notes for conflict resolution:** Removed legacy dashboard v1. Redirect /dashboardv1 → dashboardv2. Hybrid search preserved over upstream CippCentralSearch removal. + +**CIPP files:** +- `src/layouts/top-nav.js` +- `src/layouts/config.js` +- `src/components/CippComponents/CippBreadcrumbNav.jsx` +- `src/pages/_app.js` + +--- + +### Custom Permissions & Roles + +**Purpose:** CIPP role management, SAM deployment, super-admin settings + +**Risk if overwritten:** Critical — auth/authorization changes can lock out admins + +**Upstream overlap likelihood:** Medium — upstream changes role checks and SAM manifest + +**Notes for conflict resolution:** Any SAMManifest.json changes require CPV refresh to client tenants. + +**CIPP files:** +- `src/pages/cipp/advanced/super-admin/cipp-roles/` +- `src/components/CippSettings/CippRoleAddEdit.jsx` +- `src/components/CippWizard/CippSAMDeploy.jsx` + +**CIPP-API files:** +- `lib/data/SAMManifest.json` *(may not exist)* + +--- + +### Manage365-Specific API Behavior + +**Purpose:** Custom transport rules, alert messaging, mailbox restrictions + +**Risk if overwritten:** High — tenant-specific automation + +**Upstream overlap likelihood:** Low-Medium + +**Notes for conflict resolution:** Manage365 - Block External Outbound transport rule auto-creation. + +**CIPP-API files:** +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxRestriction.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserMailboxDetails.ps1` + +--- + +### Standards & Compliance Customizations + +**Purpose:** CIS 7.0 renumbering, ORCA fixes intake, applied standards license warnings, template handling + +**Risk if overwritten:** Medium-High — affects compliance reporting + +**Upstream overlap likelihood:** High — upstream actively updates standards + +**Notes for conflict resolution:** Recent v10.5.2 intake included ORCA fixes — verify not duplicated when cherry-picking. + +**CIPP files:** +- `src/data/standards.json` +- `src/components/CippStandards/` + +**CIPP-API files:** +- `Modules/CIPPCore/Public/Standards/` +- `Modules/CIPPStandards/Public/Standards/` + +--- + +### Data Table & UI Performance + +**Purpose:** CippDataTable optimizations with card view preserved, table search fixes + +**Risk if overwritten:** Medium — shared component used everywhere + +**Upstream overlap likelihood:** High + +**Notes for conflict resolution:** cf721215c ported upstream table optimizations without losing card view. + +**CIPP files:** +- `src/components/CippTable/` + +--- + +### OAuth & Auth Flow + +**Purpose:** BroadcastChannel for popup auth completion, OAuth grace period + +**Risk if overwritten:** High — login failures if broken + +**Upstream overlap likelihood:** Medium + +**Notes for conflict resolution:** c81921ce7 OAuth broadcast channel — preserve over upstream auth changes. + +**CIPP files:** +- `src/components/CippComponents/CIPPM365OAuthButton.jsx` +- `src/pages/_app.js` + +--- + +## Recent Custom Commits (post v10.5.2 intake baseline) + +These commits on production branches represent work done AFTER the last upstream intake and are especially protected: + +### CIPP (`main` since `pre-upstream-merge-v1052-20260617`) + +- `f2d87612e chore: update dependencies and remove pnpm lock file` +- `fba60b9f5 chore: update quarantine management features and version bump` +- `349eb5e9f chore: upstream v10.5.2 intake — quarantine pagination and version bump` +- `34dc2cff6 manual pagination support for Invoke-ListMailQuarantine` + +### CIPP-API (`master` since `pre-upstream-merge-v1052-20260617`) + +- `de78a343e refactor: enhance quarantine message retrieval and filtering` +- `bff606d1d chore: upstream v10.5.2 intake — ORCA fixes, standards, quarantine, version bump` +- `5c748cd80 fix: add early template filter when supplied` +- `ab0b292c5 manual pagination support for Invoke-ListMailQuarantine` +- `684a78c3e bulk request next link following` +- `76b390f1a fix: rerun issue` +- `103815550 Fixes ORCA244` +- `3626847a1 Fixes ORCA235` +- `171f8a341 Fixes ORCA242` +- `8bb7b1c3e Fixes ORCA233_1` +- `2699da195 Fixes ORCA103` +- `47c28390b Fixes ORCA113` +- `8d3fbc49d Update policy based on MS and Orca guidance` +- `2f083afbb Fixes ORCA179` +- `794a13ed2 Fix for ORCA107 and add Exchange Global Quarantine policy to cache` +- `95d8f78ed Fix ORCA104` +- `982621d14 Update Invoke-ListTenantAlignment.ps1` +- `a0418fdfc Update Invoke-ListTenantAlignment.ps1` +- `d9a8c33b5 fix: rerun detection on scheduled tasks` + +## Conflict Resolution Rules + +1. **Never** auto-resolve toward upstream for files in this map +2. **Preserve** Manage365 branding, quarantine portal, and email troubleshooter behavior +3. **Integrate** upstream bug fixes only when they don't regress custom behavior +4. **Pause** for approval on any commit touching High-risk areas above +5. **Document** every adaptation in APPLIED_COMMITS tracking files diff --git a/docs/upstream-sync/history-cipp/EXCHANGE_FAMILY_INTAKE_20260715.md b/docs/upstream-sync/history-cipp/EXCHANGE_FAMILY_INTAKE_20260715.md new file mode 100644 index 0000000000..4b6f9abbf8 --- /dev/null +++ b/docs/upstream-sync/history-cipp/EXCHANGE_FAMILY_INTAKE_20260715.md @@ -0,0 +1,84 @@ +# Exchange/Mailbox Family Intake — 2026-07-15 + +Feature intake of the deferred upstream Exchange/mailbox page family (8 frontend commits) plus +their API dependencies. Fork frontend version bumped **5.20.0 → 5.21.0**. + +## Upstream commits taken + +| Commit | Summary | How it landed | +|---|---|---| +| `ed025994c` | Encode UPN + surface report errors in Mailbox Access card | Merged into fork `exchange.jsx` (guest `#EXT#` fix) | +| `6433cd3a2` | Merge Entra ID and Exchange proxy addresses, show drift | Merged into fork `exchange.jsx` | +| `fc446f8d0` | Opt-in mail-enabled security groups in permission dialogs, grouped picker | Dialogs adopted wholesale; page logic merged | +| `553e4cfc2` | Lint churn | **Skipped** (formatting only) | +| `a3d25bfbb` | Bulk remove mailbox permissions on report page | Page adopted wholesale (upstream version) | +| `605990cdb` | Mailbox Access card on exchange page | Merged into fork `exchange.jsx` | +| `b1838ab84` | Show SMTP auth state on user tab | Adapted to fork's interactive protocols card | +| `afca350cb` | Navigation links on dashboard cards | Adapted to fork's rewritten cards | + +## Frontend (CIPP) + +- **`src/pages/identity/administration/users/user/exchange.jsx`** (heavily customized in fork — surgical merge): + - New **Mailbox Access** banner card (inverse of Mailbox Permissions) fed from the cached + permission report, with per-row bulk removal. UPN is URL-encoded so guest users work; an + error state distinguishes "report failed to load" from "no access". + - **Proxy Addresses** card now merges Entra ID `proxyAddresses` with Exchange + `EmailAddresses` and shows a `Source` column ("Entra ID & Exchange" / "Entra ID only" / + "Exchange only") so directory drift is visible. Make Primary / Remove restricted to + `Type === "Alias"` rows. Alias actions also refresh the mailbox query. + - Permission pickers now have an opt-in **"Include mail-enabled security groups"** switch + (state resets when all dialogs close); options are grouped (System Users / Users / + Mail-enabled Security Groups). Groups query only fires when toggled on. + - **Preserved fork customizations**: `mail`-based recipient values with `.filter(user.mail)` + in calendar/contact pickers, memoized subtitle, `getPermissionInfo` resolver, all fork-only + cards (mailbox rules, junk email config) and layout sections. +- **Permission dialogs** (`CippMailboxPermissionsDialog`, `CippCalendarPermissionsDialog`, + `CippContactPermissionsDialog`): adopted upstream wholesale (fork copies were stale upstream + versions, no customizations). They render the include-groups switch and grouped autocomplete. +- **`src/pages/email/reports/mailbox-permissions/index.js`**: adopted upstream wholesale. Now + uses the shared `useCippReportDB` hook and adds **Bulk Remove Mailbox Permissions** actions in + both By User and By Mailbox views (grouped per tenant so AllTenants selections work). Fork's + bespoke sync/queue-tracker UI is superseded by the hook's controls. +- **`src/components/CippComponents/CippReportDBControls.jsx`**: adopted upstream wholesale + (per-tenant cache override + `Types: 'None'` on plain mailbox cache syncs). No fork-only + commits existed on this file. +- **`src/components/CippCards/CippExchangeInfoCard.jsx`** (fork's interactive rewrite — + adapted, not replaced): added **SMTP Auth** chip to the Legacy Protocols section. + `SmtpClientAuthenticationDisabled` is inverted in EXO: `false` = basic auth enabled (red, + clickable to disable), `true` = disabled (neutral), `null` = follows org default (neutral, + not clickable). "Disable Both" button now keys off IMAP/POP only. +- **Dashboard cards** (`AuthMethodCard`, `MFACard`, `SecureScoreCard`, `LicenseCard`): card + header titles are now clickable links to their report pages (mfa-report, securescore, + list-licenses). Fork's `LicenseCard` bars deep-link to the licenses report filtered on that + license. `CippSankey` renders `node.label ?? node.id` (upstream unique-id fix support). +- **`src/pages/tenant/reports/list-licenses/index.js`**: parses `?filters=` from the URL into + `initialFilters` for deep links. Still uses fork's `/api/ListLicenses` (upstream's + `ListLicensesReport` remains deferred). + +## API (CIPP-API) + +- **`Invoke-ExecModifyMBPerms.ps1`**: adopted upstream's refactor — permission-level → cmdlet + mapping now delegates to `Set-CIPPMailboxPermission -AsCmdletObject` (single source of + truth), and successful FullAccess/SendAs/SendOnBehalf ops call + `Sync-CIPPMailboxPermissionCache` so the cached report stays current after bulk changes + (required by the new bulk-remove UI). **Preserved fork's guest-UPN retry**: on + `InvalidExternalUserIdException` the op retries with the Entra object ID, now via a shared + `Invoke-ExoRequestWithGuestRetry` helper used in the bulk-result, fallback, and single-op + paths. +- **`Invoke-ExecSetCASMailbox.ps1`**: legacy (fork card) caller path now accepts `SMTP`, + mapping to `SmtpClientAuthenticationDisabled` with inverted boolean. +- `Sync-CIPPMailboxPermissionCache` and `Set-CIPPMailboxPermission -AsCmdletObject` already + existed in the fork (identical / near-identical to upstream); `ListMailboxPermissions` + already supported `ByUser`/`UseReportDB`. No SAM manifest changes needed. + +## Verification + +- All changed frontend files lint-clean; `yarn build` passes (67s). +- Both changed API files pass PowerShell parser validation. +- Backup tags: `backup/pre-exchange-intake-20260715` in both repos. + +## Still deferred from this family's neighborhood + +- `ListLicensesReport` API (`2f02befcd`) — fork keeps `/api/ListLicenses`. +- Upstream's Sankey-based `LicenseCard` — fork keeps its progress-bar rewrite. +- UserActions family, nested group memberships, MEM devices pages (separate intakes). diff --git a/docs/upstream-sync/history-cipp/FIRST_PASS_REPORT_20260617.md b/docs/upstream-sync/history-cipp/FIRST_PASS_REPORT_20260617.md new file mode 100644 index 0000000000..814bfca770 --- /dev/null +++ b/docs/upstream-sync/history-cipp/FIRST_PASS_REPORT_20260617.md @@ -0,0 +1,249 @@ +# Upstream Sync — First Pass Inspection Report + +Generated: 2026-06-17 +Phase: **Setup complete — CIPP-API cherry-picks in progress** + +--- + +## 1. Git State Summary + +### CIPP (Frontend) + +| Item | Value | +|------|-------| +| Current branch | `main` | +| Working tree | Clean | +| vs origin | Ahead by 1 commit (unpushed) | +| Current tip | `f2d87612e` — chore: update dependencies and remove pnpm lock file | +| Upstream remote | `upstream` → `KelvinTegelaar/CIPP.git` ✓ | +| Upstream tracking branch | `upstream/main` | +| Upstream tip | `0d8ca9d2f` — Merge pull request #6153 from KelvinTegelaar/dev | +| Merge base | `0710355e2` | +| **Commits behind upstream** | **241** | + +### CIPP-API (Backend) + +| Item | Value | +|------|-------| +| Current branch | `master` | +| Working tree | Clean | +| vs origin | Up to date | +| Current tip | `de78a343e` — refactor: enhance quarantine message retrieval and filtering | +| Upstream remote | `upstream` → `KelvinTegelaar/CIPP-API.git` ✓ | +| Upstream tracking branch | `upstream/master` | +| Upstream tip | `5a0ddb29c` — Dev to hotfix (#2088) | +| Merge base | `6871d267e` | +| **Commits behind upstream** | **315** | + +### Remotes (both repos) + +| Remote | CIPP | CIPP-API | +|--------|------|----------| +| `origin` | `Celeratec/CIPP.git` | `Celeratec/CIPP-API.git` | +| `upstream` | `KelvinTegelaar/CIPP.git` | `KelvinTegelaar/CIPP-API.git` | + +Upstream fetch completed successfully during this inspection. + +--- + +## 2. Protective Setup + +## 2. Protective Setup + +Sync branches and backup tags created on 2026-06-17: + +| Repo | Production branch | Backup tag | Sync branch | +|------|-------------------|------------|-------------| +| CIPP | `main` @ pushed tip | `backup/pre-upstream-sync-cipp-20260617` | `manage365/upstream-sync-cipp-20260617` | +| CIPP-API | `master` | `backup/pre-upstream-sync-cipp-api-20260617` | `manage365/upstream-sync-cipp-api-20260617` | + +Tags and sync branches are local only (not pushed to origin unless approved). + +--- + +--- + +## 3. Documents Generated + +| Document | Location | +|----------|----------| +| CIPP upstream inventory (241 commits) | `docs/upstream-sync/UPSTREAM_SYNC_CIPP_20260617.md` | +| CIPP-API upstream inventory (315 commits) | `docs/upstream-sync/UPSTREAM_SYNC_CIPP_API_20260617.md` | +| Custom feature map | `docs/upstream-sync/CUSTOM_FEATURE_MAP_20260617.md` (both repos) | +| Applied commits tracker (empty) | `docs/upstream-sync/APPLIED_COMMITS_CIPP_20260617.md` | +| Applied commits tracker (empty) | `docs/upstream-sync/APPLIED_COMMITS_CIPP_API_20260617.md` | + +--- + +## 4. Inventory Statistics + +### CIPP — 241 upstream commits + +| Risk | Count | +|------|-------| +| Low | 11 | +| Medium | 80 | +| High | 150 | + +| Recommendation | Count | +|----------------|-------| +| Needs manual review | 200 | +| Cherry-pick with adaptation | 30 | +| Cherry-pick (clean) | 11 | + +**Notable buckets:** 136 dependency/build, 157 potentially breaking, 15 touch protected custom areas. + +### CIPP-API — 315 upstream commits + +| Risk | Count | +|------|-------| +| Low | 48 | +| Medium | 37 | +| High | 230 | + +| Recommendation | Count | +|----------------|-------| +| Needs manual review | 228 | +| Cherry-pick with adaptation | 39 | +| Cherry-pick (clean) | 48 | + +**Notable buckets:** 49 tests-only, 216 dependency/build tagged, 11 touch protected custom areas. + +--- + +## 5. Custom Features at Risk + +See `CUSTOM_FEATURE_MAP_20260617.md` for full detail. Highest-risk protected areas: + +1. **Quarantine Portal 5.13.0** — Very high upstream overlap; 20+ custom API files + shared frontend module +2. **Manage365 Branding/Versioning** — `manage365-version.json`, dual version tooling, drift alerts +3. **Email Troubleshooter** — Shares quarantine components; `Invoke-ExecEmailTroubleshoot.ps1` +4. **Navigation/Search UX** — Hybrid top-nav search, dashboard v2 routing (upstream changes nav frequently) +5. **Tenant Workflows** — GDAP, tenant mode, alignment with custom license/CA template logic +6. **OAuth Auth Flow** — BroadcastChannel popup completion (custom, not upstream) + +**Recent post-intake commits (especially protected):** + +CIPP (`main` since `pre-upstream-merge-v1052-20260617`): +- Quarantine management features + version bump +- v10.5.2 intake (quarantine pagination) +- manual pagination for ListMailQuarantine +- Dependency update (unpushed on main) + +CIPP-API (`master` since `pre-upstream-merge-v1052-20260617`): +- Quarantine message retrieval refactor +- v10.5.2 intake (ORCA fixes, standards, quarantine) +- ORCA standards fixes (ORCA103–244) +- Tenant alignment updates + +--- + +## 6. First Pass Results + +| Metric | CIPP | CIPP-API | Total | +|--------|------|----------|-------| +| Upstream commits reviewed | 241 | 315 | **556** | +| Applied | 0 | 0 | 0 | +| Adapted | 0 | 0 | 0 | +| Skipped | 0 | 0 | 0 | +| Deferred | 0 | 0 | 0 | +| Conflicts encountered | 0 | 0 | 0 | +| Tests run | 0 | 0 | 0 | + +--- + +## 7. Recommended First Batch (Low-Risk) + +Apply **only after** creating sync branches and backup tags. Review each commit against `CUSTOM_FEATURE_MAP` before cherry-picking. + +### CIPP-API — Start here (more clean test/bugfix commits) + +Priority order — tests and isolated bugfixes with ≤2 files, no protected-path overlap: + +| # | SHA | Title | Category | +|---|-----|-------|----------| +| 1 | `2b441244` | feat: Add Levenshtein distance function and tests | Tests | +| 2 | `133f9295` | test: fix helper paths after tools folder move | Tests | +| 3 | `6aa66c74` | Custom Test - Alert on X statuses | Tests | +| 4 | `ee0b8229` | fix: change cleanup to 30 days | Bugfix | +| 5 | `fdf313e5` | fix: remove partitionkey | Bugfix | +| 6 | `ecbc9a50` | fix: Add error handling for missing standard functions | Bugfix | +| 7 | `57b7de1f` | fix: Rename 'usedInTemplates' to 'usage' | Bugfix | +| 8 | `23c8994d` | fixes defaultr_hidden vs hidden #5990 | Bugfix | +| 9 | `897dfaa4` | fixed #5997 | Bugfix | +| 10 | `5ccf15a9` | fix: missing odata path error in returned json | Bugfix | +| 11 | `9ba48711` | correct incorrect default value | Bugfix | +| 12 | `4214bc7d` | Fix: Fix missing OData path error in JSON response (#2054) | Bugfix | +| 13 | `71afcdd2` | ExoTransportConfig cache type - fix for missing data | Tests | + +**Checkpoint before:** `1aa55cff` (Intune standard change detection), `affac9d0` (standards run errors), `12bb4f69` (caching cleanup) — these touch standards/cache and need review. + +### CIPP — Smaller first batch (many upstream commits are dependency/build) + +| # | SHA | Title | Category | Notes | +|---|-----|-------|----------|-------| +| 1 | `98d5d94a` | Custom Test - Alert on X statuses | Tests | Low overlap | +| 2 | `1e59d2d4` | Update ListTests.json | Tests | Verify shape compatibility | +| 3 | `e3ed1818` | fix alert mode | Bugfix | 1 file | +| 4 | `60a50738` | fixes tenantfilter property | Bugfix | Review tenant context | +| 5 | `0a8252e3` | fix: version encoding | Bugfix | **Checkpoint** — touches version | +| 6 | `707873e3` | fix: Fix tab title showing as undefined | Bugfix | UI, low risk | +| 7 | `89abbf50` | fix: improve stale issue and close messages | Bugfix | GitHub workflow | +| 8 | `5709f856` | fix: update terminology Temporary Access Password | Bugfix | i18n only | + +**Skip/defer in CIPP first batch:** +- `983b48a1` / `bde8ad3c` — worktrees cleanup (may already exist on `fix/remove-claude-worktrees` branch; verify) +- `c8d61c07` — JIT admin fix (**Already implemented differently** at `7e1bab525`) +- `1ea0324e` — search-on-load fix (verify against our table search fix at `18c21fc6b`) +- `f768330c` — CIS standards tag move (**conflicts with our CIS 7.0 renumbering**) +- `fe4bd7f9` — alltenants sync (review tenant context) +- All Dependabot / package.json commits — **explicit approval required** + +--- + +## 8. Commits Requiring Approval Before Any Apply + +Any upstream commit touching these areas must pause for review (see inventory Notes column for full list): + +- Quarantine / spamfilter / `Build-CIPPQuarantineQueryParams` +- Email Troubleshooter / `ExecEmailTroubleshoot` +- Exchange Online / mailbox / transport +- Authentication / OAuth / SAM / roles / `SAMManifest.json` +- Tenant switching / tenantFilter / GDAP / alignment +- Branding / version.json / manage365-version +- Navigation / config.js / top-nav +- Shared API helpers (`New-GraphPostRequest`, etc.) +- Dependency upgrades / build tooling +- Large refactors (>5 files or "refactor" in title) + +--- + +## 9. Known Risks + +1. **Prior partial intake** — v10.5 / v10.5.2 selective intake already applied many upstream commits with adaptation. Some inventory commits may be **already implemented differently** (e.g., JIT admin, table search, quarantine pagination). +2. **High dependency churn in CIPP** — 136 of 241 commits touch package.json/CI; batching these blindly risks breaking the SWA build. +3. **Standards divergence** — CIS 7.0 renumbering and ORCA fixes on our side may conflict with upstream standards.json changes. +4. **Quarantine active development** — Both forks and upstream are changing quarantine simultaneously; highest conflict risk. +5. **Unpushed CIPP commit** — `main` is 1 commit ahead of origin (`f2d87612e` dependency update); push or include in sync branch baseline. + +--- + +## 10. Recommended Next Steps + +1. **Approve** creation of sync branches + backup tags (commands in §2) +2. **Review** this report and the first-batch table +3. **Begin CIPP-API** with test-only commits (`2b441244`, `133f9295`, `6aa66c74`) +4. **Run Pester** after each API batch: `Invoke-Pester -Path Tests/Tools,Tests/Endpoint -Output Detailed` +5. **CIPP second** — start with test commits, defer all dependency bumps +6. **Schedule checkpoint reviews** for quarantine, auth, tenant, and standards batches + +--- + +## 11. Remaining Manual Decisions + +- [ ] Confirm date stamp for sync branches (`20260617` vs `20260617` — branch history uses 20260617) +- [ ] Push unpushed CIPP commit before sync branch creation? +- [ ] Whether to skip upstream commits already implemented differently (JIT admin, search fixes) +- [ ] Dependency upgrade strategy — individual bumps vs grouped batch with build verification +- [ ] Standards/ORCA commits — merge vs skip given recent v10.5.2 intake +- [ ] Quarantine upstream delta — full diff review before any quarantine cherry-picks diff --git a/docs/upstream-sync/history-cipp/MCP_INTAKE_20260803.md b/docs/upstream-sync/history-cipp/MCP_INTAKE_20260803.md new file mode 100644 index 0000000000..28ba7286c3 --- /dev/null +++ b/docs/upstream-sync/history-cipp/MCP_INTAKE_20260803.md @@ -0,0 +1,47 @@ +# MCP Feature Intake — 2026-08-03 + +Cycle type: **Feature intake** per [PROCESS.md](PROCESS.md). + +## Feature: MCP Server (internal team) + +- Upstream refs: `Invoke-ExecMcp.ps1`, `Modules/CIPPCore/Public/MCP/*`, `Set-CIPPMCPClientApp.ps1`, `Config/openapi.json`, MCPAllowed wiring in ApiClient + auth +- Fork gap: Feature flag `MCPServer` existed (disabled) and `New-CippCoreRequest` already mapped MCP principals; missing endpoint, MCP helpers, OpenAPI spec, UI toggle +- Protected conflicts: Adapt `Set-CippApiAuth` / `CippApiClientManagement` — preserve SWA auth path and Manage365 branding (do not take CIPPNG/SSO EasyAuth rewrite) +- Scope: **capability only** — `MCPServer` remains **Enabled: false** until ops validates; internal team use +- Phases: backend → frontend → tab hygiene → verify → PR +- Approval: [x] design [x] implement [x] deploy (enable flag after smoke) + +## Also in this intake + +- Super-admin tab hygiene: removed 404 links for CIPP Users, SSO, Container Management from `tabOptions.json` +- Container management / logs / worker health: **not** intaken (Craft bridges required) +- Teams V2: **unchanged deferred** + +## Taken + +### CIPP-API + +- `Modules/CIPPCore/Public/MCP/{Get-CippMcpSpec,Get-CippMcpToolList,Get-CippMcpToolResult}.ps1` +- `Modules/CIPPHTTP/.../CIPP/MCP/Invoke-ExecMcp.ps1` +- `Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1` +- `Config/openapi.json` (upstream baseline for tool projection) +- `Get-CippApiClient` projects `MCPAllowed` +- `Invoke-ExecApiClient` persists MCPAllowed, configures MCP app on enable, SaveToAzure passes `McpClientIds` + PRM scope app setting +- `Set-CippApiAuth` gains optional `-McpClientIds` host/appId audiences (fork ARM path kept) + +### CIPP + +- `CippApiClientManagement.jsx`: MCPAllowed switch + warning, MCP API URL chip, table column +- `super-admin/tabOptions.json`: dropped CIPP Users / SSO / Container Management tabs + +## Enablement (post-deploy) + +1. Deploy all Function slots + SWA +2. Create/enable an API client with **MCP Access Allowed**, then **Save to Azure** +3. Toggle feature flag **MCP Server** on in CIPP settings / Feature Flags +4. Smoke: POST `tools/list` then one `.Read` tool via MCP client against `/api/ExecMcp` + +## Verification + +- PowerShell AST parse: all new/changed MCP and auth files OK +- `MCPServer.Enabled` remains `false` in `Config/FeatureFlags.json` diff --git a/docs/upstream-sync/history-cipp/MEMDEVICES_COMPONENTS_INTAKE_20260715.md b/docs/upstream-sync/history-cipp/MEMDEVICES_COMPONENTS_INTAKE_20260715.md new file mode 100644 index 0000000000..007fb8ef41 --- /dev/null +++ b/docs/upstream-sync/history-cipp/MEMDEVICES_COMPONENTS_INTAKE_20260715.md @@ -0,0 +1,105 @@ +# MEM Devices + Small Component Fixes Intake — 2026-07-15 + +**Type:** Feature intake (batch) +**Upstream baseline:** 10.6.1 (commits from upstream/main, late June – early July 2026) +**Fork version:** 5.22.0 → 5.23.0 +**Backup tag:** `backup/pre-memdevices-intake-20260715` +**Branch:** `manage365/memdevices-intake-20260715` + +## Upstream commits covered + +| Commit | Subject | Disposition | +| --- | --- | --- | +| `35a019f65` | Disable broken "Generate logs and ship to MEM" action | Taken (commented out, both pages) | +| `eb1935152` | refactor(devices): dedupe Intune device actions | Adapted — shared component built from the fork's richer action list | +| `b6d2de4d7` | chore: linting (device detail page) | Skipped — pure reformatting of a file we did not adopt wholesale | +| `9fd979ec9` | Defanged URL rendering fix | Taken | +| `690f7720a` | Bar chart tooltip/color fix | Taken | +| `0a3fe87d2` | Stable EMPTY_ARRAY default for `data` prop | Taken | +| `04d89c427` | Tenant correction on action click (#6268) | Taken (adapted to fork's categorized menu) | +| `0fc6459db` | Clear stale dialog results on reopen (#6265) | Taken (ApiDialog only; ApiResults diff was pure formatting) | +| `c4608b26c` | Search placeholder "Search input" → "Search..." | Skipped — fork already uses "Search items…" | + +## Changes + +### New shared component: `CippIntuneDeviceActions.jsx` + +Upstream deduplicated the ~19 Intune device actions that were copy-pasted between +the MEM devices list page and the View Device detail page. We adopted the same +shape (`getIntuneDeviceActions({ tenantFilter })`) but built the array from the +**fork's** action list, which is a superset of upstream's: + +- `category` (view/edit/manage/security/danger) driving the fork's grouped action menus +- `quickAction` flags for the table page's quick-action buttons +- The fork-only "View in Entra" link action +- Broken "Generate logs and ship to MEM" commented out per upstream `35a019f65` + +Both pages now consume the shared list: + +- `src/pages/endpoint/MEM/devices/index.js` — replaced the ~390-line inline array; unused icon imports removed. +- `src/pages/endpoint/MEM/devices/device/index.jsx` — replaced its ~370-line copy. This is a small + behavior upgrade for the detail page: its copy had drifted (still listed the broken + Generate-logs action, lacked quick-action flags). Link-type actions (`View Device`, + `View in Intune`, `View in Entra`) are filtered out of the detail page's ActionsMenu by + `components/actions-menu.js`, and the page header keeps its own View in Intune button, + so the `[id]` placeholder links never render there. + +### `src/utils/get-cipp-formatting.js` + +Strings starting with `http` are now only rendered as links when they parse as a +real absolute http(s) URL. Defanged URLs (e.g. `https[:]//bad.com` from Check) +previously rendered as links relative to the CIPP instance; they now show as +plain text with a copy button. + +### `src/components/CippCards/CippChartCard.jsx` + +Bar charts now use a single named series with `xaxis.categories` + +`plotOptions.bar.distributed`, so tooltips show the category name instead of +"series-1" and per-bar colors are preserved. Legend dots use modulo color +cycling to match ApexCharts. Fork customizations (customColors, compact, +horizontal layout, header icon) untouched. + +### `src/components/CippTable/CippDataTable.js` + +- `data = EMPTY_ARRAY` module-level default so an undefined `data` prop doesn't + create a fresh `[]` each render and loop the static-data sync effect. +- Row action clicks in AllTenants mode now only switch to the row's tenant for + immediately-executing paths (noConfirm customFunction, customComponent). The + standard dialog flow no longer eagerly switches, so cancelling a dialog no + longer leaves the wrong tenant selected (upstream #6268). Adapted into the + fork's categorized action menu. + +### `src/components/CippComponents/CippApiDialog.jsx` + +New effect on dialog open: clears streamed partial results, resets the POST +mutation, and clears the GET request state so a reopened dialog never shows +stale output from a previous action (upstream #6265). The fork already cleared +`partialResults` on close, but React Query retained the last mutation/query +result while the component stayed mounted. + +## Fork customizations preserved + +- MEM devices list page: card view, NinjaOne enrichment, compliance/ownership chips, + quick actions config, custom offcanvas hero — all untouched (only the actions array moved). +- Device detail page: header buttons, compliance/apps/groups tabs, property lists — untouched. +- Chart card: all fork layout props preserved. +- DataTable: fork's categorized menus, card view, sorting helpers preserved; changes were surgical. +- Toolbar search placeholder kept as the fork's "Search items…". + +## Verification + +- ESLint on all touched files: 0 errors (pre-existing exhaustive-deps warnings only). +- `yarn build`: passed (67s). + +## Still deferred (frontend) + +- Scheduled user edit UI, Dashboard Alerts card +- config.js menu changes, top-nav tweaks, PrivateRoute/login tweaks +- Shadow AI report button removal, tenant metrics grid style, build optimisations +- Container management, dependency bumps + +## Still deferred (API) + +- Custom Test Alerting overhaul, MCP support, Purview DLP standard, + Intune policy sync / device app collection, IP lookup + audit log improvements, + and the remaining small items listed in USERACTIONS_NESTEDGROUPS_INTAKE_20260715.md. diff --git a/docs/upstream-sync/history-cipp/ODDSENDS_INTAKE_20260715.md b/docs/upstream-sync/history-cipp/ODDSENDS_INTAKE_20260715.md new file mode 100644 index 0000000000..d3525305ca --- /dev/null +++ b/docs/upstream-sync/history-cipp/ODDSENDS_INTAKE_20260715.md @@ -0,0 +1,87 @@ +# Odds & Ends Intake (menu/config, deps, build) — 2026-07-15 + +**Type:** Light intake (batch) +**Upstream baseline:** 10.6.1 +**Fork version:** 5.24.0 → 5.25.0 +**Backup tag:** `backup/pre-oddsends-intake-20260715` +**Branch:** `manage365/oddsends-intake-20260715` + +## Upstream commits covered + +| Commit | Subject | Disposition | +| --- | --- | --- | +| `2d50bf858` | Add missing permission for Device Management menu | Taken | +| `612ef72b8` | Broaden menu section permissions | Taken (all four sections) | +| `c38010f5e` | `scope: 'global'` on Application Templates | Skipped — fork's menu does not have that item/scope pattern in nativeMenuItems | +| `2d0b8f271` | Nav tooltips + keyboard shortcut hints | Taken (adapted to fork top-nav) | +| `907075a91` | Build optimisations | Partially taken — build-trace skip only (see below) | +| Dependency bumps | react-query family, apexcharts, mui-tiptap, reduxjs/toolkit, dompurify | Taken | +| Blob upload action bump | GitHub Actions | Skipped — fork's SWA workflow doesn't use that action | + +## Changes + +### Menu permission fixes (`src/layouts/config.js`) + +Section-level menu permissions were narrower than their children, so users holding +only the child permission couldn't see the section at all: + +- **Device Management**: added `Endpoint.Device.*` (children use it for Managed Devices) +- **Transport**: added `Exchange.Connector.*` (Connectors / Connector Templates) +- **Spam Filter**: added `Exchange.ConnectionFilter.*` (Connection Filter items) +- **Resource Management**: added `Exchange.Room.*` (Rooms / Room Lists) + +### Top-nav polish (`src/layouts/top-nav.js`) + +- Both search icon buttons now use proper MUI `Tooltip`s with `aria-label`s + (previously plain `title` attributes). +- The "Manage365 Search" dialog title shows keyboard shortcut hints + (Pages: Ctrl/Cmd+K · Users: Ctrl/Cmd+Shift+F). + +### Build optimisation (`scripts/skip-export-build-traces.mjs` + `package.json`) + +Adopted upstream's Next.js build-trace skip: for `output: 'export'` builds Next +still runs @vercel/nft "Collecting build traces" even though the result is never +used without a server runtime. The script idempotently patches the installed Next +build to skip it. **Measured: build went from ~67s to ~24s locally.** + +Importantly, upstream's build script includes `rm -rf package.json yarn.lock` +(their SWA workaround that previously caused the fork's "deleted files" incident); +the fork's build script does **not** re-add that — only the trace-skip was taken: + +``` +"build": "node scripts/skip-export-build-traces.mjs && next build --webpack" +``` + +The script warns and proceeds unpatched if Next internals change, so CI can never +break from this. + +The rest of `907075a91` (lazy rich-text field extraction from CippFormComponent, +prism highlighter split, license/standards data modules, intuneCollection move) +touches heavily customized fork files and is **deferred** for a dedicated pass. + +### Dependency bumps (`package.json`) + +Aligned with upstream 10.6.x versions: + +- `@reduxjs/toolkit` ^2.11.2 → ^2.12.0 +- `@tanstack/react-query` / `-devtools` / `-persist-client` → ^5.101.2 (kept in lockstep) +- `apexcharts` 5.10.4 → 5.16.0, `react-apexcharts` 2.1.0 → 2.1.1 +- `mui-tiptap` ^1.30.0 → ^1.31.0 +- `dompurify` added as a **direct** dependency (^3.4.11) — it was imported in + several files but only resolved via the `resolutions` pin / transitive deps + +`yarn install` regenerated the lockfile cleanly. + +## Verification + +- ESLint on config.js/top-nav.js: no new problems (2 errors + 2 warnings pre-exist + on the clean tree — React Compiler memoization notes). +- `yarn build`: passed in 24s (trace skip confirmed active in output). + +## Still deferred + +- Remainder of `907075a91` (code-splitting refactors) +- Shadow AI report button changes (`6a1d7de99`), tenant metrics grid style (`495f38808`) +- PrivateRoute/login tweaks, container management +- API: Custom Test Alerting overhaul, MCP support, Purview DLP standard, Intune + policy sync, IP lookup + audit log improvements, Sherweb diff --git a/docs/upstream-sync/history-cipp/PROCESS.md b/docs/upstream-sync/history-cipp/PROCESS.md new file mode 100644 index 0000000000..e2db26cbef --- /dev/null +++ b/docs/upstream-sync/history-cipp/PROCESS.md @@ -0,0 +1,276 @@ +# Manage365 Upstream Sync Process + +This document defines how Manage365 reviews [KelvinTegelaar/CIPP](https://github.com/KelvinTegelaar/CIPP) and [KelvinTegelaar/CIPP-API](https://github.com/KelvinTegelaar/CIPP-API) on a regular cadence and ports advantageous changes **without** overwriting fork-specific features. + +**Related artifacts** + +| Document | Purpose | +|----------|---------| +| [CUSTOM_FEATURE_MAP_*.md](./CUSTOM_FEATURE_MAP_20260617.md) | Protected fork areas — refresh each cycle | +| [FIRST_PASS_REPORT_*.md](./FIRST_PASS_REPORT_20260617.md) | Example first-pass inspection output | +| [UPSTREAM_DELTA_*.md](./UPSTREAM_DELTA_CIPP_20260617.md) | Example delta since last sync base | +| [CIPP_SYNC_CHECKPOINT_*.md](./CIPP_SYNC_CHECKPOINT_20260617.md) | Example cycle checkpoint | +| [README.md](./README.md) | Index of cycle-specific tracking docs | + +--- + +## Principles + +1. **Selective intake, not wholesale merge** — cherry-pick or surgical port; never blind `Sync fork → Discard commits`. +2. **Fork features are protected by default** — see `CUSTOM_FEATURE_MAP`. When in doubt, adapt upstream logic into fork files instead of replacing them. +3. **Frontend + API move together** — if a feature needs both repos, plan and ship as a pair (or defer both). +4. **Explicit approval gates** — no production merge without review checklist and version bump. +5. **GitHub “Sync fork” badge is cosmetic** — a large behind-count is expected with selective intake. + +--- + +## Cadence + +| Cycle type | When | Duration | Goal | +|------------|------|----------|------| +| **Light delta** | Monthly (or when upstream patch releases) | 2–4 hours | Low-risk bugfixes, data JSON, tests, isolated endpoints | +| **Major cycle** | Quarterly (or after upstream minor e.g. v10.5 → v10.6) | 1–3 days | Full delta inventory, feature intake decisions, dependency review | +| **Feature intake** | As needed (backlog) | 1–5 days each | New upstream capabilities (e.g. SSO, MCP) — design first, then port | +| **Hotfix** | Within 48h of critical upstream security fix | Hours | Cherry-pick specific SHA(s), fast deploy | + +**Suggested calendar** + +- **1st week of month** — light delta review (optional skip if no upstream activity) +- **First month of quarter** — major cycle for both repos +- **Backlog grooming** — add upstream features to intake queue (see [Feature intake backlog](#feature-intake-backlog)) + +--- + +## Roles + +| Role | Responsibility | +|------|----------------| +| **Sync lead** | Runs cycle, owns checkpoint docs, approves apply/defer | +| **Reviewer** | Second pair of eyes on high-risk or protected-path changes | +| **Deployer** | Version bump, SWA + all Function App slot deploys | + +One person can fill all roles on a small team; the checklist still applies. + +--- + +## Cycle workflow (both repos) + +Each cycle uses the same phases. Run **CIPP-API first** when changes are backend-heavy; run in parallel only for independent JSON/test commits. + +```mermaid +flowchart TD + A[0. Plan] --> B[1. Protect] + B --> C[2. Inventory] + C --> D[3. Triage] + D --> E[4. Apply mini-batches] + E --> F[5. Verify] + F --> G[6. Checkpoint + PR] + G --> H[7. Version + deploy] + H --> I[8. Close cycle] +``` + +### Phase 0 — Plan + +- [ ] Decide cycle type (light / major / feature intake / hotfix) +- [ ] Record last sync base SHAs (from previous checkpoint or tag) +- [ ] For **feature intake**: complete design Q&A before coding (self-hosted SSO, MCP scope, etc.) + +### Phase 1 — Protect + +```powershell +# From each repo root — or use Tools/Start-UpstreamSyncCycle.ps1 in CIPP +$date = Get-Date -Format 'yyyyMMdd' +git fetch upstream +git tag "backup/pre-upstream-sync--$date" main # or master for API +git checkout -b "manage365/upstream-sync--$date" +``` + +- [ ] Backup tag on production branch tip +- [ ] Sync branch created (never commit directly to `main` / `master` during review) +- [ ] Working tree clean + +### Phase 2 — Inventory + +```bash +# Commits since last sync base (replace BASE with checkpoint merge-base or tag) +git log --oneline BASE..upstream/main # CIPP +git log --oneline BASE..upstream/master # CIPP-API + +# Divergence counts +git rev-list --left-right --count main...upstream/main +``` + +Generate (or update agent-assisted): + +- `UPSTREAM_DELTA_CIPP_YYYYMMDD.md` — commits since last base +- `UPSTREAM_DELTA_CIPP_API_YYYYMMDD.md` +- Refresh `CUSTOM_FEATURE_MAP_YYYYMMDD.md` if protected areas changed + +### Phase 3 — Triage + +Classify **every candidate** into one outcome: + +| Outcome | Meaning | +|---------|---------| +| **Apply** | Clean cherry-pick or copy; no protected-path conflict | +| **Adapt** | Port logic surgically; do not replace whole fork files | +| **Already implemented** | Fork already has equivalent behavior — document evidence | +| **Defer** | Worth doing later; needs design, API pair, or conflict resolution | +| **Skip** | Wrong for fork (hosted-only, removes customization, low value) | + +**Risk tags:** Low | Medium | High +**Area tags:** Security, Exchange, Intune, Standards, Auth, Nav/UI, Dependencies, Tests, Data/JSON + +**Protected-path rule:** If any file in `CUSTOM_FEATURE_MAP` is touched, outcome must be **Adapt** or **Defer** — never blind **Apply**. + +**Pairing rule:** Frontend-only or API-only commits are OK alone; cross-cutting features require both sides in the same release or explicit deferral. + +### Phase 4 — Apply mini-batches + +- Work in batches of **3–5 commits**, low-risk first +- Order: tests → data JSON → isolated bugfixes → shared components → protected areas last +- After each batch: build/test (see Phase 5) +- Record in `APPLIED_COMMITS_*_YYYYMMDD.md`: + + | Upstream SHA | Fork SHA | Outcome | Notes | + +- If cherry-pick conflicts: abort, switch to **Adapt** manual port +- **Do not continue** after a batch failure without fixing or deferring + +### Phase 5 — Verify + +**Frontend (CIPP)** + +```bash +npx next build --webpack +``` + +**Backend (CIPP-API)** — as applicable: + +- Pester tests for touched modules +- Local function host smoke test for changed endpoints + +**Manual smoke** (adjust per cycle): + +- Applied standards / drift +- Quarantine + email troubleshooter (protected) +- Top-nav search + dashboard v2 +- Tenant auth methods +- Any feature touched in this cycle + +### Phase 6 — Checkpoint + PR + +Write `CIPP_SYNC_CHECKPOINT_YYYYMMDD.md` (and API equivalent) with: + +- Branch name, base SHA, tip SHA, backup tag +- Mini-batches table (upstream → outcome) +- Applied / adapted / deferred / skipped lists +- Known concerns and follow-ups +- **Recommendation:** ready for PR / needs more work / stop + +PR requirements: + +- [ ] Summary references checkpoint doc +- [ ] Lists deferred items explicitly +- [ ] No unrelated changes +- [ ] Reviewer sign-off for High-risk or protected-path adapts + +### Phase 7 — Version + deploy + +After merge to `main` / `master`: + +```powershell +# CIPP — set upstream baseline + Manage365 release +./Tools/Update-Version.ps1 -UpstreamVersion 10.5.1 -Manage365Version 5.12.15 + +# CIPP-API — edit both files to same upstream baseline +# version_latest.txt +# Config/version_latest.txt +``` + +- [ ] Bump `public/version.json` + `manage365-version.json` (via script) +- [ ] Bump API `version_latest.txt` (both paths) +- [ ] Update README **Upstream Integration** section +- [ ] Deploy Static Web App +- [ ] Deploy **all** Function App slots (main, processor, standards, audit, user tasks) +- [ ] Confirm Application Settings → version page shows green / no false out-of-date toasts + +### Phase 8 — Close cycle + +- [ ] Tag sync completion: `sync/cipp-YYYYMMDD` / `sync/cipp-api-YYYYMMDD` on merged tip +- [ ] Record new **sync base SHA** in checkpoint (becomes next cycle's `BASE`) +- [ ] Archive deferred items into next cycle's triage queue +- [ ] Update feature intake backlog status + +--- + +## Feature intake backlog + +Use this for **new upstream capabilities** (not small delta fixes). Each item gets a short design before implementation. + +| Feature | Status | Design | Notes | +|---------|--------|--------|-------| +| Instance SSO (self-hosted, capability-only) | Planned | Pending spec | Super Admin SSO page + backend; no prod migration until chosen | +| MCP (internal team) | **Intaken** (flag off) | [MCP_INTAKE_20260803.md](./MCP_INTAKE_20260803.md) | API client toggle + ExecMcp; enable `MCPServer` after smoke | +| Baselines (drift-first engine) | **Intaken** (flag off) | [BASELINES_INTAKE_20260814.md](./BASELINES_INTAKE_20260814.md) | Timer gated; pages at `/tenant/baselines`; enable after orch smoke | +| Worker health page | Deferred | — | Needs WorkerMetricsBridge (Craft) | +| CIPP Users / Container super-admin pages | Hygiene done | — | 404 tabs removed from `tabOptions.json`; full pages still deferred | +| Teams V2 | Deferred | — | Large blast radius; module removal needs dedicated migration | + +**Intake template** (copy for new rows): + +```markdown +## Feature: [name] +- Upstream refs: [commits / files] +- Fork gap: [what we lack] +- Protected conflicts: [from CUSTOM_FEATURE_MAP] +- Scope: [capability vs migrate-now] +- Phases: [backend → frontend → verify] +- Approval: [ ] design [ ] implement [ ] deploy +``` + +--- + +## Decision guide: merge vs cherry-pick vs adapt + +| Situation | Action | +|-----------|--------| +| Upstream fix in a file we never customized | Cherry-pick **Apply** | +| Upstream changed same file as fork (CippDataTable, applied-standards, quarantine) | **Adapt** surgical diff | +| Upstream new feature, no fork overlap | Port files + wire nav/API | +| Upstream dependency major bump | **Major cycle** only; full build/test | +| GitHub “238 commits behind” | Ignore unless doing intentional merge for git hygiene | +| Full upstream merge | Separate project; conflict marathon; not default | + +--- + +## Agent / Cursor usage + +When asking an agent to help with upstream sync: + +1. Point it at this file and the latest `CUSTOM_FEATURE_MAP`. +2. Specify cycle type and **do not reduce fork functionality**. +3. Require checkpoint doc updates per mini-batch. +4. Use rule: `.cursor/rules/upstream-sync.mdc` + +--- + +## Quick start (new cycle today) + +```powershell +cd /path/to/CIPP +./Tools/Start-UpstreamSyncCycle.ps1 -Repo CIPP + +cd /path/to/CIPP-API +./Tools/Start-UpstreamSyncCycle.ps1 -Repo CIPP-API +``` + +Then run Phase 2 inventory commands and triage into `UPSTREAM_DELTA_*_YYYYMMDD.md`. + +--- + +## Revision history + +| Date | Change | +|------|--------| +| 2026-06-09 | Initial formal process (documents practice from June 2026 v10.5 intake + sync branches) | diff --git a/docs/upstream-sync/history-cipp/README.md b/docs/upstream-sync/history-cipp/README.md new file mode 100644 index 0000000000..5d1204f9bc --- /dev/null +++ b/docs/upstream-sync/history-cipp/README.md @@ -0,0 +1,55 @@ +# Upstream sync documentation + +Manage365 tracks upstream CIPP changes here. **Start with [PROCESS.md](./PROCESS.md)** for the repeatable cadence and checklist. + +## Active process + +| Doc | Description | +|-----|-------------| +| [PROCESS.md](./PROCESS.md) | **Master workflow** — cadence, phases, triage, version bump, deploy | + +## August 2026 cycles + +| Doc | Repo | Description | +|-----|------|-------------| +| [SYNC_20260814.md](./SYNC_20260814.md) | Both | **Latest** — 10.8.5 major: Baselines intake, MAA, BitLocker search, Secure Score report | +| [BASELINES_INTAKE_20260814.md](./BASELINES_INTAKE_20260814.md) | Both | Baselines feature intake (flag off) | +| [UPSTREAM_DELTA_CIPP_20260814.md](./UPSTREAM_DELTA_CIPP_20260814.md) | CIPP | Frontend triage for the 08-14 cycle | +| [MCP_INTAKE_20260803.md](./MCP_INTAKE_20260803.md) | Both | MCP feature intake + super-admin tab hygiene (Manage365 5.32.0) | +| [SYNC_20260803.md](./SYNC_20260803.md) | Both | 10.7.5 light/medium delta: AzBobbyTables 3.6.2, Intune drift, groups/devices, audit V2 | +| [UPSTREAM_DELTA_CIPP_20260803.md](./UPSTREAM_DELTA_CIPP_20260803.md) | CIPP | Frontend triage for the 08-03 cycle | + +## July 2026 cycles + +| Doc | Repo | Description | +|-----|------|-------------| +| [SYNC_20260728.md](./SYNC_20260728.md) | Both | 10.7.3 hotfix: cross-tenant cache leak (`Select-CippAllowedTenantData`) | +| [SYNC_20260727.md](./SYNC_20260727.md) | Both | 10.7.2 major delta — SharePoint permissions reports, templated deployments, policy compare | +| [UPSTREAM_DELTA_CIPP_20260727.md](./UPSTREAM_DELTA_CIPP_20260727.md) | CIPP | Delta triage for the 07-27 cycle | +| [SYNC_20260713.md](./SYNC_20260713.md) | Both | 10.6.1 baseline + feature intake series | +| [SYNC_20260701.md](./SYNC_20260701.md) | Both | 10.5.5 baseline | + +Individual feature-intake docs from the 07-15 series (`*_INTAKE_20260715.md`) are also in +this directory. + +## June 2026 cycle (reference) + +| Doc | Repo | Description | +|-----|------|-------------| +| [FIRST_PASS_REPORT_20260617.md](./FIRST_PASS_REPORT_20260617.md) | Both | Initial inspection | +| [CUSTOM_FEATURE_MAP_20260617.md](./CUSTOM_FEATURE_MAP_20260617.md) | Both | Protected fork areas | +| [UPSTREAM_SYNC_CIPP_20260617.md](./UPSTREAM_SYNC_CIPP_20260617.md) | CIPP | Full commit inventory | +| [UPSTREAM_DELTA_CIPP_20260617.md](./UPSTREAM_DELTA_CIPP_20260617.md) | CIPP | Delta since sync base | +| [CIPP_SYNC_CHECKPOINT_20260617.md](./CIPP_SYNC_CHECKPOINT_20260617.md) | CIPP | Cycle checkpoint | +| [APPLIED_COMMITS_CIPP_20260617.md](./APPLIED_COMMITS_CIPP_20260617.md) | CIPP | Applied tracker | +| [APPLIED_COMMITS_CIPP_CYCLE2_20260617.md](./APPLIED_COMMITS_CIPP_CYCLE2_20260617.md) | CIPP | Cycle 2 tracker | + +CIPP-API cycle docs live in the **CIPP-API** repo under `docs/upstream-sync/`. + +## Naming convention + +New cycle files use `YYYYMMDD` suffix: + +- `UPSTREAM_DELTA_CIPP_YYYYMMDD.md` +- `CIPP_SYNC_CHECKPOINT_YYYYMMDD.md` +- `APPLIED_COMMITS_CIPP_YYYYMMDD.md` diff --git a/docs/upstream-sync/history-cipp/SAMCERT_INTAKE_20260715.md b/docs/upstream-sync/history-cipp/SAMCERT_INTAKE_20260715.md new file mode 100644 index 0000000000..d3fb73305d --- /dev/null +++ b/docs/upstream-sync/history-cipp/SAMCERT_INTAKE_20260715.md @@ -0,0 +1,87 @@ +# SAM Certificate Authentication Intake — 2026-07-15 + +Dedicated feature intake: ports the upstream **SAM certificate authentication** +family (8 commits from 2026-07-09 plus follow-up fixes) into Manage365. This is +the foundational auth change that unblocks the deferred SharePoint site +management suite and parts of the SSO family. + +- API branch: `manage365/samcert-intake-20260715` (backup tag `backup/pre-samcert-intake-20260715`) +- Frontend: **no changes required** — upstream has no SAM-cert UI; the + certificate is managed by the API (setup wizard, weekly timer, and + `Invoke-ExecSAMCertificate` via ExecCippFunction). + +## What this adds + +Certificate-based app authentication alongside the existing client secret: + +- **Provisioning:** `Get-CIPPAuthentication` now preloads the SAM certificate + PFX from Key Vault (secret name `SAMCertificate`) and provisions one on first + run (guarded to at most once per process to prevent recursion loops). + `Invoke-ExecCreateSAMApp` also creates the certificate during initial setup. +- **Rotation:** `Start-UpdateTokensTimer` renews the certificate when close to + expiry, alongside the existing secret rotation. +- **Usage:** `Get-GraphToken`, `New-GraphGetRequest`, `New-GraphPOSTRequest`, + and `New-ExoRequest` accept an opt-in `-UseCertificate` switch. App-only uses + `Get-GraphTokenFromCert`; delegated keeps the refresh token but authenticates + the app with a signed JWT assertion (`New-CIPPCertificateAssertion`) instead + of the client secret. +- **App management policy:** `Update-AppManagementPolicy` now also exempts the + CIPP app from `asymmetricKeyLifetime` / `trustedCertificateAuthority` + restrictions so the 1-year self-signed certificate can be attached. + +**No existing call sites pass `-UseCertificate`** — the only upstream consumers +are the deferred SharePoint suite endpoints, so current auth behavior is +unchanged. The visible behavior change is one-time certificate provisioning on +authentication load (non-fatal on failure; retried weekly). + +## Files ported (upstream tip, wholesale) + +New: +- `Get-CIPPSAMCertificate`, `New-CIPPSAMCertificate`, `Set-CIPPSAMCertificate`, + `Update-CIPPSAMCertificate`, `Update-CIPPSAMCertificateEnvCache` +- `GraphHelper/New-CIPPCertificateAssertion` +- `Get-CippKeyVaultName`, `Get-CippOffloadSuffix` (single source of truth for + vault name; fixes the dashed-instance-name truncation bug) +- HTTP endpoint `Invoke-ExecSAMCertificate` (ROLE: `CIPP.AppSettings.ReadWrite`) + +Updated: +- `Get-GraphToken`, `Get-GraphTokenFromCert` (now shared-token-cache aware — + upstream's version is a superset of the fork's; verified the fork had no + unique lines beyond superseded keyvault-name derivation) +- `New-GraphGetRequest` (also brings `-Stream` / `-SkipValueExtraction` + pagination options), `New-GraphPOSTRequest`, `New-ExoRequest` +- `Get-CIPPAuthentication` (cert preload/provision + provision-loop fix + `5ae417185`), `Get/Set/Remove-CippKeyVaultSecret` (use `Get-CippKeyVaultName`, + skip KV 404 retries) +- `Start-UpdateTokensTimer`, `Update-AppManagementPolicy`, + `Invoke-ExecCreateSAMApp`, `Invoke-ExecCippFunction`, + `Get-CIPPSchedulerBlockedCommands` (cert functions blocked from scheduler) + +Removed: +- Stale duplicate `Modules/CIPPCore/Private/Get-CIPPSchedulerBlockedCommands.ps1` + (upstream keeps only the `Public/Tools` copy; fork copy had no unique entries) + +## Not taken (same upstream commit range) + +- `Set-CIPPDBCacheSharePointSharingLinks` streaming/OOM commits (`e7ed3a226`, + `6c86428cc`, `82ac60ee9`) — that cache setter is part of the deferred + SharePoint suite and does not exist in the fork. + +## Deployment notes + +- No SAM manifest / CPV changes required — the certificate is a credential on + the existing app registration, not a new permission. +- The Function App's managed identity must retain Key Vault set/get rights + (already required for secret rotation). +- On first run after deploy, expect an Info log "No SAM certificate found, + provisioning one now" and a new `SAMCertificate` secret in Key Vault. + +## Verification + +- PowerShell parse check on all 23 changed/added files: clean. +- Dependency scan: all helpers referenced by the new functions + (`Get-CIPPAzIdentityToken`, `Get-CippOffloadSuffix`, KV helpers, Graph + helpers) present in fork; `Get-CIPPAzIdentityToken` verified byte-identical + to upstream. +- `CIPPCore` exports via wildcard + recursive dot-sourcing, so new files are + picked up automatically. diff --git a/docs/upstream-sync/history-cipp/SCHEDULEDEDIT_ALERTS_INTAKE_20260715.md b/docs/upstream-sync/history-cipp/SCHEDULEDEDIT_ALERTS_INTAKE_20260715.md new file mode 100644 index 0000000000..175d8dd1dc --- /dev/null +++ b/docs/upstream-sync/history-cipp/SCHEDULEDEDIT_ALERTS_INTAKE_20260715.md @@ -0,0 +1,114 @@ +# Scheduled User Edit + Dashboard Alerts Card Intake — 2026-07-15 + +**Type:** Feature intake (batch) +**Upstream baseline:** 10.6.1 (commits from upstream main, late June – early July 2026) +**Fork version:** 5.23.0 → 5.24.0 +**Backup tags:** `backup/pre-schedulededit-alerts-intake-20260715` (CIPP), `backup/pre-schedulededit-intake-20260715` (CIPP-API) +**Branches:** `manage365/schedulededit-alerts-intake-20260715` (CIPP), `manage365/schedulededit-intake-20260715` (CIPP-API) + +## Upstream commits covered + +| Commit | Repo | Subject | Disposition | +| --- | --- | --- | --- | +| `506d75ab2` | CIPP | edit user schedule (show scheduling on edit form) | Taken (adapted to fork's FormSection layout) | +| `7b3514493` | CIPP | improve user data handling / clearable fields | Already integrated in an earlier intake — no action | +| `3db7206d0` / PR #6260 | CIPP | Alerts card on dashboard | Taken | +| `0fc6459db` (remainder) | CIPP | Bulk-result rollup in CippApiResults (#6265) | Taken (missed in the previous intake — see note) | +| upstream `Invoke-EditUser` refactor + `Set-CIPPUser` | CIPP-API | Schedulable user edits | Taken (Set-CIPPUser built from the fork's richer edit logic) | + +> Note: in the MEM devices intake, the `CippApiResults.jsx` part of `0fc6459db` was +> dismissed as formatting-only based on a prettier diff that silently produced empty +> output (broken `.prettierrc` reference — the repo uses `.prettierrc.json`). Re-diffing +> with the correct config surfaced a real feature: per-action grouping of bulk results +> plus a summary alert ("X of Y actions failed"). That is now included here. + +## Changes — CIPP (frontend) + +### Dashboard Alerts card + +- `src/components/CippComponents/AlertsOverviewCard.jsx` — **new**, adopted upstream + wholesale. Shows fired alert instances for the selected tenant: active alerts on + top (snoozable per item), snoozed alerts greyed at the bottom with time remaining + and who snoozed them. +- `src/utils/format-alert-item.js` — **new**, adopted upstream wholesale. Humanizes + alert cmdlet names and extracts display fields from alert items. +- `src/components/CippComponents/CippAlertSnoozeDialog.jsx` — adopted upstream + wholesale (fork copy was an older upstream revision with no fork-only commits). + Now renders a structured field preview via `format-alert-item` instead of a + single-line string. +- `src/pages/dashboardv2/index.js` — full-width Alerts section inserted between the + Tenant Overview and Identity sections, matching upstream placement. All fork + dashboard customizations (dynamic imports, portals menu, report toolbar) untouched. +- Backend endpoints required by the card (`ListAlertResults`, `ListSnoozedAlerts`, + `ExecRemoveSnooze`, `ExecSnoozeAlert`) already exist in the fork's API. + +### Scheduled user edit + +- `src/components/CippFormPages/CippAddEditUser.jsx` — the Scheduling section now + renders for both add and edit, with mode-appropriate labels ("Schedule this user + edit for later"). Fork's FormSection layout preserved (upstream's flat layout not + adopted). +- `src/pages/identity/administration/users/user/edit.jsx` — no change needed; the + fork already had the dirtyFields/clearProperties handling from upstream + `7b3514493`, plus its own license-name mapping. + +### Bulk result rollup + +- `src/components/CippComponents/CippApiResults.jsx` — results are tagged with the + index of the bulk action they came from (`groupIndex`); when more than one action + ran, a summary alert is shown ("All N actions completed successfully" / "X of N + actions failed, Y succeeded"). Fork's detail toggles, CSV download, and table + dialog untouched. + +## Changes — CIPP-API + +### `Modules/CIPPCore/Public/Set-CIPPUser.ps1` (new) + +Upstream extracted the user-edit logic out of `Invoke-EditUser` into a shared +`Set-CIPPUser` so scheduled tasks can run the same code. The fork's version is +built from the **fork's** `Invoke-EditUser` body, preserving: + +- Granular `$BodyToship` construction (only non-null fields PATCHed; hashtable style) +- `clearProperties` explicit-clear support (null scalars / empty collections) +- UPN/mail/proxyAddress conflict lookup with actionable error details +- License short-circuit when assignments already match, `businessPhones` filtering, + `otherMails` normalization, `UserDisplay` fallback logging + +Upstream's Sherweb license block was not carried over (Sherweb intake still deferred). + +### `Invoke-EditUser.ps1` (rewritten as thin wrapper) + +- Keeps the fork's no-user-ID 400 guard. +- `Scheduled.Enabled` requests now create a scheduled task via + `Add-CIPPScheduledTask` (Command = `Set-CIPPUser`, `DisallowDuplicateName`), + honoring `Scheduled.date`, `reference`, and webhook/email/PSA post-execution. +- Immediate edits delegate to `Set-CIPPUser`. + +### Tests + +- `Tests/Endpoint/Invoke-EditUser.Tests.ps1` updated to dot-source `Set-CIPPUser.ps1`. + All 5 clear-vs-omit tests pass. + +## Verification + +- Pester: 5/5 passed (`Invoke-EditUser.Tests.ps1`). +- PowerShell parse check: both changed .ps1 files clean. +- ESLint: no new errors (one pre-existing `set-state-in-effect` error in + CippApiResults exists on the clean tree too). +- `yarn build`: passed (66s, node 22.13.0 — note node 24 fails the engine check). + +## iCloud sync note + +Two more " 2" duplicate files appeared during this intake (checkpoint doc and +CippIntuneDeviceActions from the previous intake). Both were byte-identical and +deleted. Repos remain inside `~/Documents` (iCloud-synced); moving them is still +recommended. + +## Still deferred + +- **Frontend:** config.js menu changes, top-nav tweaks, PrivateRoute/login tweaks, + Shadow AI report button removal, tenant metrics grid style, build optimisations, + container management, dependency bumps. +- **API:** Custom Test Alerting overhaul, MCP support, Purview DLP standard, Intune + policy sync / device app collection, IP lookup + audit log improvements, Sherweb, + and the remaining small items listed in prior checkpoint docs. diff --git a/docs/upstream-sync/history-cipp/SPO_SUITE_INTAKE_20260715.md b/docs/upstream-sync/history-cipp/SPO_SUITE_INTAKE_20260715.md new file mode 100644 index 0000000000..e0d4ba8dea --- /dev/null +++ b/docs/upstream-sync/history-cipp/SPO_SUITE_INTAKE_20260715.md @@ -0,0 +1,141 @@ +# SharePoint Site Management Suite Intake — 2026-07-15 + +Dedicated feature intake: ports the upstream **SharePoint site management +suite** (7 API commits from 2026-07-09/10 plus the sharing-links streaming +fixes) into Manage365. This was the largest deferred family and depends on the +SAM certificate authentication intake completed earlier the same day — +certificate app-only tokens are what let SharePoint REST `_api/web/*` calls run +without a delegated token. + +- API branch: `manage365/spo-intake-20260715` (backup tag `backup/pre-spo-intake-20260715`) +- Frontend branch: `manage365/spo-intake-20260715` (backup tag `backup/pre-spo-intake-20260715`) +- Fork frontend version bumped to **5.19.0** (upstream baseline unchanged at 10.6.1 / API 10.6.2) + +## What this adds + +### API — net-new endpoints (upstream tip, wholesale) + +- **Sharing report:** `Invoke-ListSharePointSharing`, + `Invoke-ExecRemoveSharingLink`, `Invoke-ExecBulkRemoveSharingLinks` +- **Sharing links cache:** `Set-CIPPDBCacheSharePointSharingLinks` (includes + upstream's streaming/OOM fixes `e7ed3a226`/`6c86428cc`/`82ac60ee9`) plus its + activity workers `Push-DBCacheSharePointSiteSharingLinks` and + `Push-StoreSharePointSharingLinks` +- **External users:** `Get-CIPPSPOExternalUsers` (CSOM GetExternalUsers — + includes legacy spo:guest identities with no Entra object), + `Invoke-ListSharePointExternalUsers`, `Invoke-ExecRemoveSPOExternalUser` +- **Full site user removal:** `Remove-CIPPSPOSiteUser`, + `Invoke-ExecRemoveSiteUser` (removes a user from every site group and direct + permission grant at once) +- **Item-level recycle bin:** `Invoke-ListSiteRecycleBin`, + `Invoke-ExecRestoreRecycleBinItems` (new CIPP permission family + `Sharepoint.SiteRecycleBin.Read` / `.ReadWrite`) +- **Libraries:** `Invoke-ListSiteLibraries`, `Invoke-ExecSetLibraryPermission` +- **Version cleanup:** `Invoke-ExecSPOVersionCleanup` (fork already had + `Invoke-ListSPOVersionCleanup`) + +### API — merged with fork customizations + +- **`Invoke-ExecSetSharePointMember`** — adopted upstream's role-group model + (Owners/Members/Visitors via `associated*group` REST with `-UseCertificate + -AsApp $true`; group-connected sites keep managing Owners/Members through the + M365 group) while preserving the fork's protections: + - guest-UPN safety: prefers the picker's Entra object ID and encodes `#` as + `%23` in filter lookups (upstream used `/users/$UPN` paths that break on + `#EXT#`) + - single-quote escaping in the group OData lookup + - ensureuser force-add to the User Information List after group add (so new + members appear immediately in the members table) + - classified error messages (CPV token / cert-missing / access-denied + guidance for `CippApiResults`) +- **`Invoke-ListSiteMembers`** — adopted upstream's rewrite: real role-group + membership via cert REST, M365-group claim expansion through Graph, site + admins flagged, guest detection, with automatic fallback to the fork's old + User Information List approach when the cert/REST path is unavailable. +- **`Invoke-ExecSetSiteProperties`** — adopted upstream's version (superset of + fork's): filters group-connected sites to the supported property subset and + reports skipped properties. +- **`Push-ExecDeleteSharepointSite`** (fork's queued delete worker, both module + copies) — kept the fork's background-queue architecture, template protection, + and hub-site unregister, and applied upstream's auth findings: + - fixed a latent bug where `-extraHeaders` was passed to + `New-GraphPOSTRequest`, which has no such parameter (the POST calls would + fail at parameter binding) + - `SPO.Tenant` GET keeps `odata-version: 4.0` and now uses cert app-only + - manager POST endpoints no longer receive `odata-version` (SPO rejects it + with an "Elevated context" pipeline error) + - `SPSiteManager/delete` now uses `-UseCertificate -AsApp $true` (denies + delegated tokens with E_ACCESSDENIED) +- **`Push-CIPPDBCacheData`** (both module copies) — added the SharePoint + license gate + `SharePointSharingLinks` as its own activity (heavy: scans + every drive, spawns a child orchestrator). The CIPPCore copy previously had + no SharePoint group task at all; it now dispatches the grouped SharePoint + collection too. +- **`Config/CIPPDBCacheTypes.json`** — added the `SharePointSharingLinks` + entry; removed a pre-existing duplicate `SharePointSiteUsage` entry. +- `$MemberType` in ExecSetSharePointMember additionally reads + `$Request.Body.MemberType` so flat table-action mappings (site-details page) + can pass the member type without an addedFields object. + +### Frontend + +- **SharePoint Sites page (fork's customized page, actions added/updated):** + - Add Member: site role picker (Members/Owners/Visitors) + - Remove Member: now driven by `ListSiteMembers` (real role membership, + shows the member's role and dedupes) + - New: Remove User From Site, Revoke Sharing Links (Anonymous/External/All + scopes), Edit Site (consolidated property editor with prefill), Set + Library Permission, Start Version Cleanup Job, Check Cleanup Job Status, + item-level Recycle Bin dialog + - Off-canvas members table switched from the User Information List to + `ListSiteMembers` (role/type/guest/admin columns) + - Fork's existing quick actions (Lock/Unlock, Set Sharing Policy, Set + Storage Quota, Live Storage, Create Team from Site) untouched +- **Site Details page:** members table switched to `ListSiteMembers`; Remove + Member action now passes the member's role group and type +- **New pages:** `/teams-share/sharing-report` (charts + revoke links) and + `/teams-share/external-users` (tenant-wide external user inventory with + remove/purge actions), both wholesale from upstream +- **New components:** `CippEditSitePropertiesForm`, `CippSiteRecycleBinDialog` +- **Menu:** Sharing Report + External Users added to the SharePoint section + +### Kept fork implementations (upstream equivalents skipped) + +- **Deleted sites family** — fork's `Invoke-ListDeletedSites`, + `Invoke-ExecRestoreDeletedSite`, `Invoke-ExecRemoveDeletedSite` and the + `/teams-share/sharepoint/recycle-bin` page stay. Upstream's + `Get-CIPPSPODeletedSites` / `Restore-CIPPSPODeletedSite` / + `deleted-sites.js` were not taken (fork's version has feature parity plus + permanent-delete, which upstream lacks). +- Fork's per-property `ExecSetSiteProperty` quick actions remain alongside the + new consolidated Edit Site dialog. + +## Permissions + +- SharePoint `Sites.FullControl.All` application permission + (`678536fe-1083-478a-9c59-b99265e6b0d3` on `00000003-0000-0ff1-ce00-000000000000`) + was already present in both fork SAM manifests — no manifest change needed. + A CPV refresh is still recommended so client tenants pick up the SharePoint + app-only consent for the certificate token path. +- New CIPP RBAC roles surface automatically from the endpoint `.ROLE` + docstrings: `Sharepoint.SiteRecycleBin.Read` / `.ReadWrite`. + +## Deferred (unchanged) + +- `Invoke-ExecSetOneDriveSharing` (separate "OneDrive Sharing disable" commit) +- OneDrive root permissions cache (from the 10.6.2 hotfix range) +- License capability presets commit `29685d69b` (touches 140+ files; the + sharing-links task addition was adapted to the fork's existing license-check + style instead) + +## Verification + +- PowerShell parse check on all 25 changed/added API files: clean. +- Dependency scan of new functions: all referenced helpers + (`Get-SharePointAdminLink`, `Start-CIPPOrchestrator`, `New-GraphBulkRequest`, + KV/Graph helpers, `Get-CIPPIdentityLabel`/`Test-CIPPExternalIdentity` + defined in the sharing workers) resolve in the fork. +- `Config/CIPPDBCacheTypes.json` validates as JSON. +- Frontend production build (`yarn build`, Node 22): clean; new routes + `sharing-report.html` and `external-users.html` emitted. +- No linter errors on the seven touched frontend files. diff --git a/docs/upstream-sync/history-cipp/SSO_FAMILY_DECISION_20260715.md b/docs/upstream-sync/history-cipp/SSO_FAMILY_DECISION_20260715.md new file mode 100644 index 0000000000..5d2d02fcfc --- /dev/null +++ b/docs/upstream-sync/history-cipp/SSO_FAMILY_DECISION_20260715.md @@ -0,0 +1,83 @@ +# SSO / CIPP Users Family — Deferral Decision — July 15, 2026 + +Cycle type: **Feature intake (evaluated, declined)** per [PROCESS.md](PROCESS.md). + +The SSO / CIPP-user family was the largest remaining deferred item after the Copilot & AI, +SAM certificate, and SharePoint suite intakes. This cycle inventoried it fully and concluded it +**cannot be safely intaken** under Manage365's current hosting architecture. One standalone fix +from the same commit window was taken. + +## What the family is + +Upstream commits inventoried (CIPP-API): `2a2851b57` (sso auth), `fc76e111b` (app repair + +migration failures), `d2e54ee85` (app password policy), `168a11032` (manual cred input), +`405c55d08` (redirect URI), `9520792f4` (stats timer migration status), `fa5f4de6f` (feature +flag removal), plus the `be25c7640` squash that introduced `Invoke-ExecSSOSetup`, +`Invoke-ListCIPPUsers` / `Invoke-ExecCIPPUsers`, and `Start-UserSyncTimer`. + +Frontend counterparts: `src/pages/cipp/advanced/super-admin/sso.js`, `cipp-users.js`, +`CippSSOSettings.jsx`, `SsoMigrationDialog.jsx`, `ForcedSsoMigrationDialog.jsx`, and the +`unauthenticated.js` rewrite. + +Purpose: migrate CIPP instances **off Azure Static Web Apps built-in auth** onto a dedicated +CIPP-SSO Entra app with **EasyAuth configured directly on the app host**, with CIPP user/role +management moving from SWA invitations to an `allowedUsers` table synced from partner-tenant +Entra groups. + +## Why it was declined + +1. **Hard dependency on upstream's "Craft" container runtime.** Core files call + `[Craft.Services.AppLifecycleBridge]` / `[Craft.Services.AuthBridge]` — C# bridges that exist + only inside upstream's new hosted container image. They are **not** part of `CIPPSharp`. + Upstream's `Initialize-CIPPAuth.ps1` calls `AppLifecycleBridge::IsEasyAuthConfigured()` + unguarded at the top of warmup; adopting it would throw on every cold start of our Function + App. (The fork already carries a few `Craft.Services.*` call sites from earlier syncs, but all + are gated behind `$env:CIPPNG -eq 'true'` or try/catch, so they are inert.) +2. **The CIPP Users page would be a no-op.** `ExecCIPPUsers`/`ListCIPPUsers` manage the + `allowedUsers` table, but the only thing that *enforces* that table at auth time is + `Craft.Services.AuthBridge` inside the container host. Under our SWA auth, roles come from SWA + invitations plus Entra-group resolution in `Test-CIPPAccessUserRole` (which we already have, + identical to upstream). Shipping the page would present a user-management UI that silently + does nothing. +3. **Production lockout risk.** `Set-CIPPSSOEasyAuth` rewrites `authsettingsV2` on the live + Function App (`$env:WEBSITE_SITE_NAME`) via ARM, and the `Migrate` action in + `Invoke-ExecSSOSetup` is designed to move a SWA-authenticated instance onto EasyAuth. Running + any part of that against Manage365's SWA + linked Function App deployment risks breaking the + SWA→API auth handoff and locking us out. + +## Revisit condition + +Revisit **only** if/when Manage365 deliberately migrates hosting off SWA auth (e.g. upstream +fully deprecates the SWA model, or we adopt their container/self-host layout). At that point +this family is the migration path, not an optional feature — plan it as an infrastructure +change with rollback, not a code intake. + +Also skipped from the same window: + +- `Update-CIPPSAMRedirectUri` switch to `-AsApp $true` — depends on app-only + `Application.ReadWrite` behavior we haven't validated against our SAM app; the fork's + delegated version works today. +- `Start-CIPPStatsTimer` SSO-migration status fields — meaningless without the SSO stack. +- `Initialize-CIPPTimezone`, `Get-CIPPManagedIdentityResourceId`, + `Remove-CIPPMigrationAppSetting`, `Repair-CippApiIdentifierUri`, `Request-CIPPRestart` — + SSO/Craft support helpers with no consumer in the fork. + +## Taken (standalone fix from the same window) + +- **`Invoke-CIPPStandardDisableGuests` — PendingAcceptance handling** (upstream `2edc75928`): + guests who never redeemed their invite (`externalUserState -eq 'PendingAcceptance'`) are now + disabled once the invite is older than the threshold, alerts break counts into stale sign-ins + vs unredeemed invites, and the report fields gained `GuestsStaleSignInCount` / + `GuestsPendingAcceptanceCount` / `GuestsPendingAcceptanceDetails`. The `standards.json` entry + was already identical between fork and upstream, so this is a pure `.ps1` update. + +## Verification + +- PowerShell parser on the changed file: 0 errors. +- No frontend changes this cycle; no build needed. + +## Remaining deferred families (unchanged priority candidates) + +With SSO ruled out, the largest still-compatible deferred items are the BEC UI family, the +Exchange/mailbox page family, Custom Test Alerting overhaul, Intune Policy sync / device app +collection, scheduled user edit UI, and nested group memberships. diff --git a/docs/upstream-sync/history-cipp/SYNC_20260701.md b/docs/upstream-sync/history-cipp/SYNC_20260701.md new file mode 100644 index 0000000000..2e75b5bb58 --- /dev/null +++ b/docs/upstream-sync/history-cipp/SYNC_20260701.md @@ -0,0 +1,78 @@ +# Upstream Sync Checkpoint — July 1, 2026 (Light Delta) + +Cycle type: **Light delta** per [PROCESS.md](PROCESS.md). +Baseline moved: CIPP **10.5.2 → 10.5.5**, CIPP-API **10.5.2 → 10.5.6**. + +- CIPP: 42 commits applied on `manage365/upstream-sync-cipp-20260701` (backup tag `backup/pre-upstream-sync-cipp-20260701`) +- CIPP-API: 56 commits applied on `manage365/upstream-sync-cipp-api-20260701` (backup tag `backup/pre-upstream-sync-cipp-api-20260701`) + +## Verification + +- `yarn build` (Node 22.13.0): pass +- PowerShell parser on 81 changed `.ps1/.psd1` files: 0 errors +- JSON validation on all changed `.json` files: pass +- No stray conflict markers + +## Taken (highlights) + +### CIPP-API (10.5.2 → 10.5.6) + +- **Offboarding request validation** — new `Test-CIPPOffboardingRequest` rejects malformed payloads with 400 instead of silently no-oping. Extended to also accept fork-style `{ userPrincipalName }` user objects. +- **User-agent / task / standard contexts** — `Get-CippUserAgent`, `Set-CippUserAgentContext` for attributable Graph request user agents; fixes standards/scheduled-task logging. +- **Spam filter policy custom-name fixes** — matches legacy/default policy names only when no custom name is set; skips rule remediation for the built-in `Default` policy. +- **Email OTP for B2B guests** — `Set-CIPPAuthenticationPolicy` now supports `allowExternalIdToUseEmailOtp` and group exclusions (standard file itself not taken — fork does not have the new single AuthenticationMethods standard). +- **Intune policy clone + edit name/description endpoints** (`AddIntunePolicyClone`, improved `EditIntunePolicy` with odata-type normalization and settings-catalog `name` handling). +- **Mailbox rule removal hardening** for duplicate aliases (`MailboxObjectId` passthrough). +- **Excluded licenses**: `IncludeExcluded` list parameter + `ShowInLicenseDropdown` property. +- **Custom Test Engine CLM runtime**, ZTNA test expansion, run-standard logging fixes. +- **Permission repair improvements**, API client RBAC checks before creation, GDAP role mapping repair. +- Misc: New Licence updates, password generator wordlist cleanup, nextLink validation, release-notes owner/repo hardcode, NinjaOne sync moved to Reporting DB, table cleanup fixes, duplicate Intune standards fixes, CA template deployment logging, blank value fixes, EXO request fixes (incl. reverts), SharePoint Multi-Geo quota fix, Secure Score control update scoping. + +### CIPP (10.5.2 → 10.5.5) + +- **Timestamp parsing** — new `parseCippDate` util treats epoch-seconds values correctly in `CippTimeAgo`, `CippDataTable` sorting, and `getCippFormatting` (adapted into fork-protected files). +- **Intune policy actions** — Clone Policy and Edit Name & Description actions (ported in fork style into customized `CippIntunePolicyActions.jsx`). +- **Excluded licenses** — `IncludeExcluded` in license selectors; show/hide-in-dropdown actions on Excluded Licenses page. +- **ISO 639-1 / 3166-1 autocompletes** — new `LanguageCodeMultiSelect` / `CountryCodeMultiSelect` form types for spam filter block lists (adapted; fork keeps its own autoComplete case, new types recurse into it). +- **Contact fixes** — template creation/editing, edit page phone serialization + explicit-null clearing, `preserveNullValues` support in `CippFormPage`. +- **49GB shared mailbox conversion warning** in offboarding wizard (surgically ported into fork's customized wizard). +- **ListUsers → ListGraphRequest** migration for autopilot devices, business voice, room lists (fork's OneDrive page already migrated). +- **Teams default visibility now Private**, hideBulk on compliance actions, CA import/deploy drawer fixes, dynamic group nesting, phishing-resistant MFA card fix, permission repair UI, GDAP repair action, colliding query keys fix, "Selected Deviations" label, bookmark cleanup, alerts/M365Licenses/CIPPDBCacheTypes/standards.json data updates, `userType` column on Users list, `encodeURIComponent` on version alert query. + +## Deferred (revisit next cycle) + +### CIPP-API + +| Item | Reason | +|------|--------| +| Purview DLP Policy standard (`a9b3e404e`) | Large feature; conflicts with fork DLP files — needs dedicated intake | +| Custom Test Alerting overhaul (`0c3d4ba7e`, `05f5f1fce`) | Conflicts in ExecTestRun/custom scripts; test after CLM runtime settles | +| Intune Policy sync / device app collection (`a2dec4281`, `10f24789c`) | Conflicts; depends on Intune report-export orchestrator not in fork | +| IP lookup + Audit Log improvements (`eac806c72`) | Conflicts with fork audit log processing | +| 90-day cache cleanup (`739d3785d`), RG name resolution (`f690b6df4`) | Conflicts; low urgency | +| APISpec move to Config (`b560d158b`), stats props (`a938c36bf`), allowed modules (`5153adc62`) | Structural; fork layout differs | +| MTD role standard (`a8143b4b2` API side + standards.json) | standards.json conflict — pair with frontend intake | +| Schema-backed standards repair (`2c63d3174`), drift logging (`ee92936ef`), sensitivity label fixes (`5392acf40`), SPO version cleanup job (`151ef4649`), github template id sync (`d2655de84`), contact template deployment (`45b96d6af`), ListLicensesReport (`2f02befcd`), requirements clarification (`7dea7f40f`), write-information fix (`07ba3d02b`), files check (`484bff838`), App Insights toggle (`04b3e124a`), permissions removal (`116429034`), json-from-frontend (`e2b092bdd`), move file (`b75c1fe90`), timer start earlier (`d2e88c5a9`) | Conflicts with fork files or depend on deferred features | + +### CIPP + +| Item | Reason | +|------|--------| +| PrivateRoute/login tweaks (`539ef35d3`, `a79f4100e`, `5e8a4d941`, `e9e0147c4`) | Fork has custom fast-path PrivateRoute + unauthenticated page; revisit with SSO intake | +| SPO version cleanup UI (`5426c48b0`, `ca78e05c8`) | Backend pair deferred | +| Tenant metrics grid responsive style (`495f38808`) | Fork intentionally uses compact style | +| Build optimisations (`907075a91`) | Whole-tree refactor (standards-data, license catalog utils); fork-protected files | +| Copilot menu + pages (`cd773184c` / API `114f3c7f5`, `4160b5160`, `83c77358f`, `0a3409a5f`) | New feature area — schedule as feature intake | +| CIPP Users page (`cacd07688`), user auth/sync logic (API `920e3a1c3`), Initialize-CIPPAuth (`3cd0b3f5c`, `00597e40a`), SSO password policy (`d2e54ee85`), redirect uri patch (`504c21ae3`) | SSO/CIPP-user feature family — part of planned SSO intake | +| Container management (`024c3daaa`, `c12962d60`, `cc7e46839`) | Fork does not use container management | +| Dependency bumps (react-query-devtools, mui-tiptap, apexcharts, reduxjs/toolkit, dompurify, blob upload action) | Take deliberately with regression testing, not via cherry-pick | + +## Fork customizations verified intact + +- `CippDataTable` mobile card view (timestamp fix applied surgically) +- Custom offboarding wizard with risk coaching (49GB warning added inside it) +- Custom users index (mobile-aware; userType column added) +- Custom contacts edit page (Container layout preserved) +- `CippFormComponent` autoComplete row-placeholder substitution (new ISO types recurse into it) +- Custom PrivateRoute fast path, custom top-nav (bookmark hook cleanup applied; top-nav untouched) +- Fork error-guidance pattern in quarantine/guest-invite flows (untouched this cycle) diff --git a/docs/upstream-sync/history-cipp/SYNC_20260713.md b/docs/upstream-sync/history-cipp/SYNC_20260713.md new file mode 100644 index 0000000000..b9c1d4138d --- /dev/null +++ b/docs/upstream-sync/history-cipp/SYNC_20260713.md @@ -0,0 +1,128 @@ +# Upstream Sync Checkpoint — July 13, 2026 (Major Delta) + +Cycle type: **Major delta** per [PROCESS.md](PROCESS.md) — upstream shipped a full release cycle +(10.5.x → **10.6.1**, 187 API commits / 156 frontend commits inventoried, plus follow-ups). + +Baseline moved: CIPP **10.5.5 → 10.6.1**, CIPP-API **10.5.6 → 10.6.1**. + +- CIPP: 76 commits applied on `manage365/upstream-sync-cipp-20260713` (backup tag `backup/pre-upstream-sync-cipp-20260713`) +- CIPP-API: 119 commits applied on `manage365/upstream-sync-cipp-api-20260713` (backup tag `backup/pre-upstream-sync-cipp-api-20260713`) + +## Verification + +- `yarn build` (Node 22.13.0): pass +- PowerShell parser on 248 changed `.ps1/.psm1` files: 0 errors +- JSON validation on all changed `.json` files: pass +- No stray conflict markers +- `package.json` / `yarn.lock` disappearing mystery **solved**: upstream's build script ends with + `rm -rf package.json yarn.lock` (added in upstream `5b31bb6ea`, Mar 2025, for their Azure SWA + deploy flow). Every local `yarn build` deleted both files, and `git add -A` then committed the + deletions (this cycle's `e6f9dd989`, and June 24's `4e1c7d049`). Fixed by dropping the `rm` + from the fork's build script — safe because our SWA workflow deploys `out/` with + `skip_app_build: true`, so the root `package.json` never reaches Oryx. Watch for upstream + re-introducing the `rm` when cherry-picking future `package.json` changes. + +## Taken (highlights) + +### CIPP-API (10.5.6 → 10.6.1) + +- **Audit log V2 planner** — full rework for resilience: `Start-AuditLogPlannerV2` timers + (replaces old orchestrator entries in `Config/CIPPTimers.json`; fork processor queue timer kept), + manual search fixes, log-collection payload updates. +- **Direction-scoped Intune group assignment** — `Set-CIPPAssignedPolicy` / + `Set-CIPPAssignedApplication` accept `ExcludeGroupIds`/`ExcludeGroupNames` and an assignment + direction so Replace can edit one direction without wiping the other; square-bracket escaping in + group name matching. +- **Clearable fields in user edit** — `Invoke-EditUser` explicit `clearProperties` whitelist, + adapted into the fork's hashtable-based `$BodyToShip` (nulls for scalars, empty arrays for collections). +- **Group member handling** — enhanced add/remove logging with group names (fork's + already-a-member tolerance preserved); sec-group add fix; mail-enabled security group removal + during license removal (fork's actionable error messages preserved). +- **Auth method sub-settings** — `Set-CIPPAuthenticationPolicy` supports SMS/Voice/QRCodePin + sub-settings; upstream Email OTP implementation absorbed (already carried fork's B2B params). +- **SMTP client auth state** in `Invoke-ListUserMailboxDetails` (fork's BlockExternalInbound/ + Outbound fields preserved; AutoExpandingArchiveScope skipped). +- **Drift management** — stale-entry pruning, valid-standard tracking, package-map CA tag lookup, + template depth fix, deleted-template row cleanup. +- **CIPPSharp** aligned with upstream master (source + binary; no fork customizations existed). +- **Permission/RBAC hardening** — `Get-CippHttpPermissions`, role dedupe scoping, `.None` + exclusion, base-name permission matching, upstream's permission-repair reverts. +- **Group templates**: email aliases + hide-from-GAL support. +- Misc: EXO error preservation, JSON escaping for Intune policies, Graph POST retry-reason + logging, table read retry, AzBobbyTables bump, token timer secret cleanup, extension alert + watermark fix, DMARC onmicrosoft skip, BEC message trace, incident severity endpoint, Rogue App + List, ACSC Essential Eight test suite, test runner/scaffolder, OpenAPI enrichment, backup + replication, vacation-mode/offboarding fixes, curated `standards.json` refresh (upstream tip + minus standards without fork implementations). + +### CIPP (10.5.5 → 10.6.1) + +- **Audit log search UI** — upstream's rewritten searches page (V2 pipeline pairing), manual + searches restored, tabOptions update; legacy coverage page removed with upstream. +- **Intune assignment pickers** — include/exclude group pickers + assignment direction radio on + policy, script, and application assign actions (fork's color-coded action categories preserved); + per-field `condition` support in `CippApiDialog` (auto-merged). +- **User template switching fix** — template-driven fields are replaced/cleared on switch instead + of lingering (adapted into fork's FormSection-styled `CippAddEditUser`); array-notation + + business phone template fixes; `calculatedGroupType` passed on group add/remove options. +- **Clearable profile fields** — edit-user page reports actively-emptied fields via + `clearProperties` (dirty-field tracking with `useFormState`), pairing with the API change. +- **JIT admin roles** — dedicated `JitAdminRoles.json` (replaces GDAP catalog reuse), current + Entra role names, Microsoft 365 / Entra Backup roles added. +- **Entra terminology sweep** — Azure AD → Microsoft Entra in UI labels, GDAP role catalog, + device trust/join state rendering, managedDevice translation keys; Compliance Portal → Purview + Portal renames. +- **Backup replication card** + `ReplicationScopeCard` on settings/backup. +- **Group templates**: email aliases + hide-from-GAL fields integrated into fork's redesigned + add-group form (distribution + mail-enabled security). +- **Alerts/PSA UX family** — PSA Ticket Strategy on alert form, HaloPSA integration clarity, + helperText styling, audit alert presets for external forwarding/Exchange admin elevation. +- **Reports** — shared mailbox enabled report with allTenants + ReportDB, HVEAccounts cache type, + incident Set Severity + resolving comment, vacation mode task details, drift management + improvements, app registration improvements, delivery insights + paste input mode. +- Misc: `util-columnsFromAPI` refactor (fork's skipRecursion + prototype-pollution guard + reapplied), TabbedLayout advanced-tab gating, room calendar processing options, default calendar + permission warning, CippAutocomplete tenant-scoped query keys, bulk-action row counts, CA + session-control editing fix, stale Entra devices remediation action, standards/alerts JSON + refreshes. + +## Deferred (revisit next cycle / feature intake) + +Carried forward from July 1 (see [SYNC_20260701.md](SYNC_20260701.md)) plus new this cycle: + +### CIPP-API + +| Item | Reason | +|------|--------| +| SAM certificate auth family (`da30ffcad`, `bf76f2bd6`, `2e636ca54`, `5f2a3e3ec`, `2b3ec21dd`, `e7ed3a226`, `6c86428cc`, `82ac60ee9`) | Foundational auth change — dedicated feature intake with staged rollout | +| SharePoint full site management suite (`d50b71747`, `0fe9645a1`, `2bc15bf02`, `2e8531cf1`, `06d0bd80f`, `559036d6f`, `aa7e060b6`) | Depends on SAM cert auth; fork has protected non-group member management | +| Copilot feature area (`114f3c7f5`, `4160b5160`, `83c77358f`, `0a3409a5f`) | New feature area — schedule as feature intake | +| SSO / CIPP user family (`920e3a1c3`, `3cd0b3f5c`, `00597e40a`, `d2e54ee85`, `504c21ae3`) | Planned SSO intake (phases already scoped) | +| `915355cb9` Set-CIPPUser refactor of EditUser | Fork's custom `Invoke-EditUser.ps1`; needed for scheduled user *edits* — pair with next cycle | +| Purview DLP standard, Custom Test Alerting overhaul, Intune policy sync, IP lookup/audit improvements, cache cleanup, RG resolution, APISpec move, MTD role standard, schema-backed standards repair, sensitivity label color family, Sherweb API client fix | Same reasons as July 1 checkpoint | + +### CIPP + +| Item | Reason | +|------|--------| +| Scheduled user *edit* UI (`506d75ab2`) | Requires API `Set-CIPPUser` refactor (deferred above) | +| BEC UI family (`c1fb0f92a`, `cb81f1a07`, `a445e3981`, `8359da60e`, `488541e0a`) | Fork has 6 custom BEC commits incl. retry logic — adapt as a unit | +| Dashboard Alerts card (`3db7206d0`) | Fork dashboard has 18 custom commits; API endpoint (`93ea8ca12`) already taken | +| SharePoint UI family (deleted sites, external users, edit site properties, sharing report) | API dependencies on SAM cert auth | +| Exchange/mailbox page family (`ed025994c`, `6433cd3a2`, `fc446f8d0`, `553e4cfc2`, `a3d25bfbb`, `605990cdb`, `b1838ab84`, `afca350cb`) | Fork has 11–15 custom commits on these files — adapt as a unit | +| UserActions family (`01cff98d1`, `af1fe13ff`, `22f153f48`, `f66e74a07`) | Fork has 18 custom commits on `CippUserActions.jsx` | +| Nested group memberships (`456662835`, `1e60e5f2b`) | Fork `groups/edit.jsx` has group-based licensing customization | +| MEM devices page (`35a019f65`, `b6d2de4d7`, `eb1935152`), get-cipp-formatting (`9fd979ec9`), TableToptoolbar (`c4608b26c`), ChartCard (`690f7720a`), ApiDialog (`f543ba8cb`), config.js menu changes (`c38010f5e`, `2d50bf858`, `612ef72b8`), top-nav (`2d0b8f271`), DataTable (`0a3fe87d2`, `04d89c427`), ApiResults (`0fc6459db`) | Protected/heavily customized fork files — selective adaptation only | +| Shadow AI report button removal (`6a1d7de99`), coverage page removal already taken | — | +| PrivateRoute/login tweaks, SPO version cleanup UI, tenant metrics grid style, build optimisations, Copilot pages, CIPP Users page, container management, dependency bumps | Same reasons as July 1 checkpoint | + +## Fork customizations verified intact + +- `CippDataTable` mobile card view; custom users index; custom contacts edit page +- Custom offboarding wizard with risk coaching +- `CippFormComponent` autoComplete row-placeholder substitution +- Custom PrivateRoute fast path and top-nav +- Color-coded action categories (preserved through every adapted actions file) +- SharePoint non-group member management + guest `#EXT#` handling +- Fork error-guidance pattern (`CippApiResults` classification) +- Curated `standards.json` (upstream standards without fork implementations excluded) diff --git a/docs/upstream-sync/history-cipp/SYNC_20260727.md b/docs/upstream-sync/history-cipp/SYNC_20260727.md new file mode 100644 index 0000000000..0571cd66ae --- /dev/null +++ b/docs/upstream-sync/history-cipp/SYNC_20260727.md @@ -0,0 +1,106 @@ +# Upstream Sync Checkpoint — 2026-07-27 + +Cycle type: **Major delta**. Baseline moved: + +| Repo | From | To | Upstream ref | +|---|---|---|---| +| CIPP (frontend) | 10.6.1 (`17ed2b396`) | **10.7.2** | `upstream/main` @ `44ac45831` | +| CIPP-API | 10.6.1 (tag) | **10.7.2** | `upstream/master` @ `d63b7fae3` | + +Branches: `manage365/upstream-sync-cipp-20260727` / `manage365/upstream-sync-cipp-api-20260727`. +Backup tags: `backup/pre-upstream-sync-cipp-20260727` / `backup/pre-upstream-sync-cipp-api-20260727`. +Triage detail: `UPSTREAM_DELTA_CIPP_20260727.md` (this repo) and `UPSTREAM_DELTA_CIPP_API_20260727.md` (API repo). + +## Structural note + +Upstream moved to the **CyberDrain org**; releases 10.7.0–10.7.2 landed as +single-parent squash commits. Cycle was executed as: (1) cherry-pick true +commits individually, (2) port squash-only content per accepted feature area +via path-scoped diffs against the upstream tip. + +## Applied + +- **CIPP-API**: 54 commits on the sync branch (cherry-picks + squash ports). +- **CIPP**: 29 commits on the sync branch (cherry-picks + squash port + icon fix). + +### Highlights (both repos) + +- **SharePoint permissions report family** — new permissions-report page, PDF + report primitives (`CippPdf/`), `PermissionsReportButton`/`SharingReportButton`, + `CippLibraryPermissionsDialog` (Manage Permissions), `CippCheckUserAccessDialog` + (Check User Access) wired into the fork's `useCippSiteActions` hook. +- **SharePoint templated deployments v1 + hardening** — template builder, + deploy drawer with live job progress (new opt-in `jobProgress` prop grafted + into the fork's protected `CippApiResults`), `CippMultiQueueTracker`, + `CippQueryRefreshButton`, template schemas, nav entries. +- **Sharing report risk analytics** — anonymous-edit/never-expiring links, + folder shares, external recipients (page taken wholesale; verified verbatim + upstream-derived, no fork customization). +- **Policy compare** — new `CippPolicyDiffTable`/`CippPolicyCompareDialog`; + compare-policies page refactored onto the shared table, fork branding and + single-result fix preserved. +- **401 flash fix** — adapted surgically into the fork's fast-path + `PrivateRoute` (loading guard) + `authmecipp` persistence exclusion in `_app.js`. +- **Custom test save/run UX** — `useCippFormPageActions` context added to the + fork's `CippFormPage` (fork submit tooltip/cleaned-values pipeline kept). +- **Intune** — fuzzy policy matching (`Find-CIPPFuzzyPolicyMatch` + + levenshteinDistance), app template deploy standard, MAM endpoint fixes, + @odata.type preservation, append-default assignments. +- **Standards** — SmartLockout (Enforce), DisableInactiveUsers, + IntuneAppTemplateDeploy, NudgeMFA group targeting/registration campaign, + DisableM365GroupUsers AllowedGroupName/CreateGroup, ConditionalAccessTemplate + report/warn enabled, SPOVersionControl validators, Copilot settings/limited + mode surfaced in FE (API implementations exist from 07-15 intake). +- **Identity** — password writeback for synced-user resets (fork's password + parameter kept), reset-password helper text, group updates routed by + effective type. +- **Site (in)activity cache and report**, mailbox quota alert types, shadow AI + alerting, GDAP roles/age-group updates, CISA/ORCA/ZTNA test fixes. + +### Curated/protected merges + +- `Config/standards.json` (API) and `src/data/standards.json` (FE): union-merged, + fork formatting preserved (text-level edits, no reserialization). +- `Config/SAMManifest.json` / `PermissionsTranslator.json`: union merges (PIM + + CopilotPolicySettings permissions). CPV refresh required after deploy. +- Fork nav (`layouts/config.js`), `CippUserActions`, `CippAddEditUser`, + mailboxes and teams-activity pages: fork versions kept, upstream changes + applied surgically. + +## Skipped / Deferred (see delta docs for full list) + +- Sherweb migration tasks, CSP license page actions (fork excludes Sherweb/CSP). +- Container management (`CippContainerManagement`) — not in fork. +- Teams V2 (`New-TeamsRequestV2` + vendored MicrosoftTeams module removal) — deferred, large blast radius. +- SSO dialogs / forced SSO migration — deferred (SSO family intake). +- `custom-domains.js` + `ExecAppServiceDomains` — deferred. +- Upstream CI workflows (fork uses its own Azure SWA workflow), version bumps, + dashboard v1. +- `CippAnonymizedReportAlert` on mailboxes/teams-activity pages — partial: alert + component taken, integration into those two fork-customized pages deferred. + +## Cleanup + +- Removed 10 tracked `" 2"` Finder-duplicate files in CIPP-API from the 07-15 + Copilot intake (duplicate .ps1 files define functions twice at module load). + +## Verification + +- `yarn build` (Node 22.13.0): pass — all pages incl. new + permissions-report / sharepoint-templates / compare-policies routes. +- PowerShell AST parse of all 138 changed API .ps1 files: pass. +- JSON validation Config/* both repos: pass (pre-existing BOM on two + TransportRuleTemplate files and intentionally-empty blank.json noted, not + from this cycle). +- ESLint on all hand-merged files: clean. + +## Versions + +- Manage365 5.27.0 → **5.28.0**; upstream baseline 10.6.1 → **10.7.2** + (`package.json`, `public/version.json`, `public/manage365-version.json`, + API `version_latest.txt`). + +## Post-deploy actions + +1. CPV refresh to push new SAM permissions (PIM RoleManagement, Copilot policy) to client tenants. +2. Smoke test: SP permissions report, SP template deploy (job progress), sharing report sync, login flow (401 flash), reset password on a synced user. diff --git a/docs/upstream-sync/history-cipp/SYNC_20260728.md b/docs/upstream-sync/history-cipp/SYNC_20260728.md new file mode 100644 index 0000000000..1f0017533f --- /dev/null +++ b/docs/upstream-sync/history-cipp/SYNC_20260728.md @@ -0,0 +1,135 @@ +# Upstream Sync Checkpoint — 2026-07-28 + +Cycle type: **Hotfix** (critical upstream tenant-isolation fix). Baseline moved: + +| Repo | From | To | Upstream ref | +|---|---|---|---| +| CIPP (frontend) | 10.7.2 (`44ac45831`) | **10.7.3** | `upstream/main` @ `d72c1e21b` | +| CIPP-API | 10.7.2 (`d63b7fae3`) | **10.7.3** | `upstream/master` @ `f1b2c93d5` | + +Branches: `manage365/upstream-sync-cipp-20260727` (frontend, carries the action-menu +work) / `manage365/upstream-hotfix-cipp-api-20260728`. +Backup tag: `backup/pre-upstream-hotfix-cipp-api-20260728`. + +## Why this cycle exists + +Upstream shipped 10.7.3 as a **cross-tenant data leak fix**. A family of cached +`List*`/`Exec*List` endpoints reads a global cache table by `PartitionKey` and returns +the rows directly. On a cache hit `Get-Tenants` is never called, so the +`$script:CippAllowedTenantsStorage` scope that normally narrows a tenant-restricted +custom role was never applied — a restricted caller invoking one of these with +`tenantFilter=AllTenants` received **every managed tenant's data**. + +Affected surfaces: users, mailbox rules, transport rules, quarantine, MFA and basic-auth +reports, conditional access policies, licenses, JIT admin, Lighthouse device compliance, +and security alerts / incidents / MDO alerts. + +## Frontend delta: none + +`44ac45831..d72c1e21b` touches only `package.json` and `public/version.json`. There is no +frontend code in 10.7.3 — the entire fix is backend. The frontend branch therefore carries +only the baseline bump plus this cycle's own fork work (action-menu categories). + +## Applied — CIPP-API (6 commits) + +| Batch | Upstream | Outcome | Notes | +|---|---|---|---| +| 1 | PR #99, #100 | **Apply** (new files) | `Select-CippAllowedTenantData.ps1`, `Get-CippRequestContext.ps1`, `Tests/Private/Select-CippAllowedTenantData.Tests.ps1` | +| 2 | PR #99, #100 | **Apply** | JIT admin, alerts, incidents, MDO alerts — byte-identical to upstream, no fork customization | +| 3 | PR #99, #100 | **Adapt** | mailbox rules, transport rules, basic auth, MFA users, CA policies, Lighthouse compliance, ListUsers — all fork-customized, only the narrowing line ported | +| 4 | PR #99, #100 | **Adapt** | quarantine (protected) + licenses (path divergence) | +| 5 | PR #99, #100 | **Apply / Adapt** | four PSScriptAnalyzer suppressions | +| 6 | — | **Chore** | baseline → 10.7.3 | + +### Protected-path adaptations + +- **`Invoke-ListMailQuarantine.ps1`** is in the protected Quarantine Portal area. Only the + AllTenants cache-read line changed (`$Messages = $Rows` gained the narrowing pipe). + Pagination, post-filters, the 7d window and the export path are untouched. Narrowing + happens before rows are expanded, so returned counts stay consistent. +- **`Invoke-ListLicenses.ps1`** lives at `Tenant/Reports/` in the fork but at the + `HTTP Functions` root upstream. Applying upstream's file would have added a second copy + and defined the function twice at module load — the same duplicate-file class of bug the + 07-27 cycle cleaned up. Ported into the fork's path instead. +- **`Invoke-ListUsers.ps1`** cannot be narrowed: the deprecated `cacheusers` blob has no + reliable per-tenant column. A restricted caller now receives the existing deprecation + message instead of every tenant's users; unrestricted callers keep legacy behavior. + +### Module placement + +Both new helpers went to `Modules/CIPPCore/Public/Authentication/`, matching upstream's +explicit warning: `$script:CippAllowedTenantsStorage` is an AsyncLocal in **CIPPCore** +module scope, so a copy living in CIPPHTTP would read that module's own permanently-empty +variable and silently filter nothing. Verified before porting: + +- The fork's `Modules/CIPPCore/.../New-CippCoreRequest.ps1` defines all four storage slots + (`CippInvocationIdStorage`, `CippAllowedTenantsStorage`, `CippAllowedGroupsStorage`, + `CippUserRolesStorage`), so `Get-CippRequestContext` works verbatim. +- `Get-Tenants` exists only in CIPPCore and is already called from 75 CIPPHTTP endpoints, + confirming cross-module calls resolve the slot correctly. + +## Already implemented + +- **`Start-AuditLogIngestionV2.ps1`** — upstream added `RowKey` to two + `Get-CIPPAzDataTableEntity -Property` lists. The fork already passes + `@('PartitionKey', 'RowKey')` for the CacheWebhooks read and does not use `-Property` at + all for the ledger read (fetches all properties), so the fix is already satisfied. + +## Deferred + +- **`Start-SchedulerOrchestrator.ps1`** — upstream adds a `$ValidTypes` guard that + **deletes** legacy `Alert` partition rows via `Remove-AzDataTableEntity`. Destructive + against fork SchedulerConfig data; needs a review of what the fork actually stores in + that partition before adopting. Not security-related. +- **`Get-AuthorisedRequest.ps1`** — upstream changed `$Uri -like '*/organization'` to + `$Uri -match '/organization(\?|$)'`. The fork's partner-URI allowlist **has no + `/organization` clause at all**, so there is nothing to fix; adding the clause would + change which requests are treated as partner-context. Flagged for a deliberate decision + rather than absorbed silently. + +## Skipped + +- **`Test-CIPPAccess.ps1`** — one indentation fix and removal of a trailing period in an + error message. Cosmetic only, in a Critical-risk auth path the fork has customized. Not + worth the diff. + +## Verification + +- **Coverage check:** the fork's `Select-CippAllowedTenantData` call sites were diffed + against upstream's by basename — **12 files, identical call counts**, with licenses at + the fork's path. No upstream call site missed. +- **Fork-only gap check:** audited fork-only endpoints that read a `Cache*` table with + `AllTenants` handling for the same leak class. `Invoke-ExportMailQuarantine.ps1`, + `Invoke-GetMailQuarantineMessage.ps1` and `Invoke-ExecMailboxSafeSender.ps1` do not read + the AllTenants cache, so no fork-specific leak exists. +- **Pester:** `Tests/Private/Select-CippAllowedTenantData.Tests.ps1` — **8/8 pass** against + the fork (restricted scope, customerId vs domain matching, case-insensitivity, partner + rows, unrestricted pass-through, zero `Get-Tenants` calls when unrestricted). +- **AST parse:** all changed `.ps1` files parse clean. +- **Frontend:** `npm run build` pass; ESLint clean. + +## Versions + +- Manage365 5.29.0 → **5.30.0**; upstream baseline 10.7.2 → **10.7.3** + (`package.json`, `public/version.json`, `public/manage365-version.json`, API + `version_latest.txt` **and** `Config/version_latest.txt`). +- `Config/version_latest.txt` had drifted to **10.6.2** while the root file was at 10.7.2; + both are now 10.7.3. +- README "Last synced with upstream" was a cycle stale (still 10.6.1 / v5.25.0 after the + 07-27 cycle shipped 10.7.2); now reflects 10.7.3 / v5.30.0. + +## Post-deploy actions + +1. Deploy **all** Function App slots — the fix is backend-only and every slot loads CIPPCore. +2. No CPV refresh needed: no SAM permission changes this cycle. +3. Smoke test with a **tenant-restricted custom role**: call Users, Mailbox Rules, + Transport Rules, Quarantine, MFA report and CA policies with `tenantFilter=AllTenants` + and confirm only that role's tenants come back. Confirm an unrestricted admin still + sees everything. + +## Next cycle base SHAs + +| Repo | Base | +|---|---| +| CIPP | `d72c1e21b` (upstream/main) | +| CIPP-API | `f1b2c93d5` (upstream/master) | diff --git a/docs/upstream-sync/history-cipp/SYNC_20260803.md b/docs/upstream-sync/history-cipp/SYNC_20260803.md new file mode 100644 index 0000000000..ab71aab03a --- /dev/null +++ b/docs/upstream-sync/history-cipp/SYNC_20260803.md @@ -0,0 +1,60 @@ +# Upstream Sync Checkpoint — 2026-08-03 + +Cycle type: **Light/medium delta** (upstream **10.7.3 → 10.7.5**). + +| Repo | From | To | Upstream tip | +|---|---|---|---| +| CIPP (frontend) | 10.7.3 (`d72c1e21b`) | **10.7.5** | `upstream/main` @ `274880fd0` | +| CIPP-API | 10.7.3 (`f1b2c93d5`) | **10.7.5** | `upstream/master` @ `245d9d35b` | + +Branches: `manage365/upstream-sync-cipp-20260803` / +`manage365/upstream-sync-cipp-api-20260803`. +Backup tags: `backup/pre-upstream-sync-cipp-20260803` / +`backup/pre-upstream-sync-cipp-api-20260803`. + +Delta docs: [UPSTREAM_DELTA_CIPP_20260803.md](./UPSTREAM_DELTA_CIPP_20260803.md), +CIPP-API `docs/upstream-sync/UPSTREAM_DELTA_CIPP_API_20260803.md`. + +## Applied + +| Batch | Theme | Outcome | +|---|---|---| +| 1 | AzBobbyTables 3.6.2 + `Add`/`Get`/`Remove-CIPPAzDataTableEntity` + call-site renames + ConversionTable | **Apply** | +| 2 | Intune template drift helpers (`Get-CIPPIntunePolicyName`, `Merge-CIPPIntuneTemplateIdentity`, `Select-CIPPIntuneAvailableSetting`), standard/compare updates, SafeLinks, Get-CIPPDrift Microsoft-managed skip | **Apply** (31/31 Intune helper Pester) | +| 3 | `disableNesting` (New-CIPPGroup + FE form), EditGroup `AddDevice` + MEM device action + adapted groups edit dialog, SAM `RoleManagement.Read.Exchange` Scope | **Adapt** (preserved fork groupType/mailNickname + redesigned edit page) | +| 4–5 | Snooze Reason (FE+API), default Home test suite, partner webhook stale-URL + `Get-CIPPHostname`, M365Licenses.json, audit log V2 + webhook tests | **Apply / Adapt** (21/21 `Test-CIPPAuditLogRules` Pester) | + +## Skipped / Deferred + +| Item | Outcome | Why | +|---|---|---| +| SSO preconsent / `CippSSOSettings` / `Invoke-ExecSSOSetup` | **Skip** | SSO family — SWA/Craft (2026-07-15 decision) | +| `CippAppServiceDomains` / `ExecAppServiceDomains` | **Defer** | No App Service custom-domain hosting in fork | +| `Start-SchedulerOrchestrator` `$ValidTypes` destructive cleanup | **Still defer** | Carryover from 07-28 | +| Teams V2, MCP, Worker health, container management, Purview DLP | Unchanged backlog | See PROCESS.md Feature intake backlog | + +## Verification + +- Frontend: `npm run build` — pass +- Pester: Intune helpers 31/31; `Test-CIPPAuditLogRules` 21/21 +- AST parse: all newly ported `.ps1` files OK +- SAMManifest JSON valid after Scope union-merge + +## Versions + +- Manage365 **5.30.0 → 5.31.0**; upstream baseline **10.7.3 → 10.7.5** +- API `version_latest.txt` and `Config/version_latest.txt` both **10.7.5** + +## Post-deploy actions + +1. Deploy Static Web App +2. Deploy **all** Function App slots (AzBobbyTables + CIPPCore changes) +3. **CPV refresh** — new Graph delegated Scope `RoleManagement.Read.Exchange` (`3bc15058-…`) +4. Smoke: Intune template drift, MEM device Add-to-Group, group create with disableNesting, partner webhook page, snooze with reason + +## Next cycle base SHAs + +| Repo | Base | +|---|---| +| CIPP | `274880fd0` (upstream/main) | +| CIPP-API | `245d9d35b` (upstream/master) | diff --git a/docs/upstream-sync/history-cipp/SYNC_20260814.md b/docs/upstream-sync/history-cipp/SYNC_20260814.md new file mode 100644 index 0000000000..f2a8e2fe67 --- /dev/null +++ b/docs/upstream-sync/history-cipp/SYNC_20260814.md @@ -0,0 +1,66 @@ +# Upstream Sync Checkpoint — 2026-08-14 + +Cycle type: **Major** (upstream **10.7.5 → 10.8.5**; plan scoped as 10.8.4, tip advanced). + +| Repo | From | To | Upstream tip | +|---|---|---|---| +| CIPP | 10.7.5 (`274880fd0`) | **10.8.5** | `upstream/main` @ `a1b620403` | +| CIPP-API | 10.7.5 (`245d9d35b`) | **10.8.5** | `upstream/master` @ `e02ac3724` | + +Branches: `manage365/upstream-sync-cipp-20260814` / +`manage365/upstream-sync-cipp-api-20260814`. +Backup tags: `backup/pre-upstream-sync-cipp-20260814` / +`backup/pre-upstream-sync-cipp-api-20260814`. + +Delta: [UPSTREAM_DELTA_CIPP_20260814.md](./UPSTREAM_DELTA_CIPP_20260814.md), +API `docs/upstream-sync/UPSTREAM_DELTA_CIPP_API_20260814.md`. +Baselines: [BASELINES_INTAKE_20260814.md](./BASELINES_INTAKE_20260814.md). + +## Applied + +| Batch | Theme | Outcome | +|---|---|---| +| 1 | ConversionTable, ListSecureScoreReport + Get-CIPPSecureScoreReport, FE securescore + AllTenants helpers | **Apply / Adapt** | +| 2 | ListIntuneApprovalRequests + alert + retry; BitLocker search page + nested ExecBitlockerSearch; FE MAA + BitLocker nav | **Apply** | +| 3 | ListRoles (nested), ListTenantAllowBlockList (Spamfilter), TABL helpers, ExecSetDefaultMFAMethod, CA/EXO PowerShell/DisableM365GroupUsers standards | **Apply** | +| 4 | Baselines modules (29) + Set-CippBaselineRunContext + orch + activities + 9 HTTP + BaselineStandards (81) + FeatureFlags/Timers (flag **off**) + FE pages/components; nav commented | **Feature intake** | +| 5 | ListBrandingSettings/Presets + Get-CIPPBranding*; ListCommunityRepoTemplates + catalog/CippTemplateCatalog (nav not fully rewired) | **Apply (partial)** | +| — | M365Licenses.json | **Apply** | + +## Skipped / Deferred + +| Item | Outcome | Why | +|---|---|---| +| SSO / authentication nav / container-management / ForcedSsoMigration | **Skip** | SWA/Craft | +| Node/jsdom engine bumps, wholesale yarn.lock | **Defer** | After ports settle | +| Full BEC / user detail rewrite; Default MFA **UI** wire into fork user page | **Defer Adapt** | API ported; FE surgical later | +| Full community-repos index.js rework | **Defer Adapt** | Catalog API + page present | +| Full branding settings JSX replace | **Defer Adapt** | List APIs ported; keep Manage365 branding UI | +| CVE report rewrite | **Skip** | Fork removed CVE surface on origin | +| Teams V2 | Unchanged deferred | | +| PublicMcpRegister | **Defer** | MCP already intaken separately | + +## Verification + +- PowerShell AST: Baselines/*.ps1 + key new HTTP entrypoints OK +- `Baselines.Enabled` = **false** in FeatureFlags +- SAMManifest: no new permission IDs this cycle + +## Versions + +- Manage365 **5.32.2 → 5.33.0**; upstream baseline **10.7.5 → 10.8.5** +- API `version_latest.txt` / `Config/version_latest.txt` → **10.8.5** + +## Post-deploy + +1. Deploy SWA + **all** Function slots (esp. standards processor for baseline timer when enabled) +2. Smoke: MAA Requests, BitLocker search, Secure Score, `/tenant/baselines` (direct URL) +3. Enable `Baselines` flag only after orchestrator smoke +4. Optional: uncomment Baselines nav in `src/layouts/config.js` + +## Next cycle base SHAs + +| Repo | Base | +|---|---| +| CIPP | `a1b620403` (upstream/main) | +| CIPP-API | `e02ac3724` (upstream/master) | diff --git a/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260617.md b/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260617.md new file mode 100644 index 0000000000..2d3f1b2633 --- /dev/null +++ b/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260617.md @@ -0,0 +1,286 @@ +# Upstream Delta Inventory — CIPP (Frontend) + +Generated: 2026-06-17 +Production branch: `main` @ `81a5dc53b` +Upstream: `KelvinTegelaar/CIPP` @ `0d8ca9d2f` + +## Delta summary + +| Metric | Count | +|--------|-------| +| Fork-only commits (ahead of upstream) | 602 | +| Upstream commits not in `main` (behind) | 241 | +| Upstream commits since sync base `f2d87612e` | 241 | + +**Interpretation:** The branch is behind upstream by design. The first selective sync merged ~25 commits; the remaining delta is expected unpicked upstream work, not a failed merge. + +### Recommendation distribution + +- **Cherry-pick with review:** 113 +- **Skip:** 41 +- **Skip or Defer:** 40 +- **Cherry-pick:** 28 +- **Already applied (sync 2026-06-17):** 15 +- **Defer:** 4 + +### Risk distribution + +- **Medium:** 146 +- **High:** 61 +- **Low:** 34 + +## Carried-forward deferred items (from sync 2026-06-17) + +| Item | Status | +|------|--------| +| `7054bfc4` UserReportedPhishing frontend alert | Defer until CIPP-API handler + SAM permission | +| `b1902421` tab layout first-tab margin | Defer — layout conflict | +| `bc412396b` / `20e2f554d` allow/block edit/controlled drawer | Defer — partial guard only applied | +| `4c0c058f` alerts schema change | Defer — higher risk | +| Frontend dependency/lint debt | Pre-existing — not sync blocker | + +## Commit inventory + +| SHA | Title | Author | Date | Risk | Area | Protected overlap | Recommendation | Files | +|-----|-------|--------|------|------|------|-------------------|----------------|-------| +| `0d8ca9d2` | Merge pull request #6153 from KelvinTegelaar/dev | John Duprey | 2026-06-10 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `e0b0bdb8` | chore: bump version to 10.5.2 | John Duprey | 2026-06-10 | High | Data/config JSON, Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, public/version.json | +| `a4c56b26` | manual pagination support for Invoke-ListMailQuarantine | Zacgoose | 2026-06-10 | High | Protected feature | Quarantine Portal | Skip or Defer — protected-area overlap | src/pages/email/administration/quarantine/index.js | +| `f4448a56` | Merge pull request #6140 from KelvinTegelaar/dev | John Duprey | 2026-06-09 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `6a2e7b31` | chore: bump version to 10.5.1 | John Duprey | 2026-06-09 | High | Data/config JSON, Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, public/version.json | +| `0e10e08e` | Update index.js | Zacgoose | 2026-06-09 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/teams-share/sharepoint/index.js | +| `ae695a9f` | Update CippAddEditUser.jsx | Zacgoose | 2026-06-09 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippFormPages/CippAddEditUser.jsx | +| `91bb02b4` | Merge pull request #6071 from KelvinTegelaar/dependabot/npm_and_yarn/dev/react-virtuoso-4.18.7 | KelvinTegelaar | 2026-06-09 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `e53ab04d` | Merge pull request #6074 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tiptap/extension-heading-3.22.3 | KelvinTegelaar | 2026-06-09 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `87d543d4` | Merge pull request #6075 from KelvinTegelaar/dependabot/npm_and_yarn/dev/react-hook-form-7.76.1 | KelvinTegelaar | 2026-06-09 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `f1475e8e` | Merge pull request #6073 from KelvinTegelaar/dependabot/npm_and_yarn/dev/axios-1.16.1 | KelvinTegelaar | 2026-06-09 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `7ea75e76` | Merge pull request #6072 from KelvinTegelaar/dependabot/npm_and_yarn/dev/react-pdf/renderer-4.5.1 | KelvinTegelaar | 2026-06-09 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json | +| `8cfb8ca0` | Merge pull request #6138 from JNRavnIT/patch-1 | KelvinTegelaar | 2026-06-09 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `cfbf3508` | Removed dublicate appliesToTest key | JNRavnIT | 2026-06-09 | Low | Data/config JSON | None | Already applied (sync 2026-06-17) | src/data/standards.json | +| `0de0910a` | Merge pull request #6132 from kris6673/tables-search | KelvinTegelaar | 2026-06-09 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `1ea0324e` | fix: ensure search happens when data is done loading | Bobby | 2026-06-08 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippTable/CippDataTable.js | +| `580b66f9` | repair and fix failed SSO app creations and password addition failures | Zacgoose | 2026-06-09 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/ForcedSsoMigrationDialog.jsx, src/components/CippComponents/SsoMigrationDialog.jsx, src/components/CippSettings/CippSSOSettings.jsx | +| `4521af9d` | Merge pull request #6129 from KelvinTegelaar/dev | KelvinTegelaar | 2026-06-08 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `03048445` | Merge branch 'main' into dev | KelvinTegelaar | 2026-06-08 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `9c82a214` | 10.5.0 version up | KelvinTegelaar | 2026-06-08 | High | Data/config JSON, Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, public/version.json | +| `4df01a60` | Update unauthenticated.js | Zacgoose | 2026-06-08 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/unauthenticated.js | +| `4c0c058f` | Update alerts.json | Zacgoose | 2026-06-08 | Low | Data/config JSON | None | Defer — alerts schema change (higher risk) | src/data/alerts.json | +| `55e8eef2` | Update worker-health.js | Zacgoose | 2026-06-07 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/advanced/worker-health.js | +| `4c2843c7` | more secure pipeline configuration | Zacgoose | 2026-06-07 | Medium | General | None | Cherry-pick with review | .npmrc, .yarnrc | +| `e90b0ff9` | renumber for cis7 | KelvinTegelaar | 2026-06-06 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `6c968c4b` | fix: bad math | John Duprey | 2026-06-05 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/tenant/manage/applied-standards.js | +| `c15d1d0d` | fix: sherweb integration conditional fields | John Duprey | 2026-06-05 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/Extensions.json | +| `8ae6ad1f` | typo | Zacgoose | 2026-06-05 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/ForcedSsoMigrationDialog.jsx, src/components/CippComponents/SsoMigrationDialog.jsx | +| `7b0c8699` | Update SsoMigrationDialog.jsx | Zacgoose | 2026-06-05 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/SsoMigrationDialog.jsx | +| `a4aac4a1` | CA expansion for tags | KelvinTegelaar | 2026-06-05 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/tenant/manage/applied-standards.js | +| `98a96fcb` | CA expansion for tags | KelvinTegelaar | 2026-06-05 | Medium | General | None | Cherry-pick with review | src/pages/tenant/manage/applied-standards.js, src/pages/tenant/manage/policies-deployed.js | +| `c8d61c07` | fix: JIT admin, remove creatable on autocomplete | John Duprey | 2026-06-04 | Medium | General | None | Already applied (sync 2026-06-17) | src/pages/identity/administration/jit-admin/add.jsx | +| `0a8252e3` | fix: version encoding | John Duprey | 2026-06-04 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippSettings/CippVersionProperties.jsx | +| `4ed6ba02` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CIPPM365OAuthButton.jsx | +| `ffefbbb3` | Use broadcast channel | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CIPPM365OAuthButton.jsx, src/pages/authredirect.js | +| `5b09ef32` | fix: add popup grace period | John Duprey | 2026-06-04 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CIPPM365OAuthButton.jsx | +| `eb16c27a` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | KelvinTegelaar | 2026-06-04 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `67039061` | Auth changes to use sedndmessage | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/authredirect.js | +| `b7c051fa` | Auth changes to use sedndmessage | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CIPPM365OAuthButton.jsx, src/pages/authredirect.js | +| `0b4c3314` | Make breadcrumb text and > selectable/copyable | Zacgoose | 2026-06-04 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CippBreadcrumbNav.jsx | +| `c0f8e990` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | Zacgoose | 2026-06-04 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `3daf8b33` | Add named location editing to CA template editor | Zacgoose | 2026-06-04 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippCAPolicyBuilder.jsx, src/pages/tenant/conditional/list-template/create.jsx, src/pages/tenant/conditional/list-template/edit.jsx | +| `02db7307` | Merge pull request #6106 from kris6673/EmailAsAlternateLoginId | KelvinTegelaar | 2026-06-04 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `a9ed024d` | Merge pull request #6110 from kris6673/CAS-stuffs | KelvinTegelaar | 2026-06-04 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `11ecd334` | remove unneeded results key | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CippFormLicenseSelector.jsx | +| `cf30b4b1` | add excluded from alerts to licenses | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/settings/licenses.js | +| `a04ed1a6` | Merge pull request #6049 from luimen6/feat/group-license-management | KelvinTegelaar | 2026-06-04 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `72623261` | add excludeFromAlert to licenses. | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/settings/licenses.js | +| `a8048476` | Exclude partner tenant | Zacgoose | 2026-06-04 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippAddEditTenantGroups.jsx, src/pages/tenant/administration/tenants/groups/edit.js | +| `692c67d6` | fix: quarantine deny action | John Duprey | 2026-06-03 | High | Protected feature | Quarantine Portal | Skip or Defer — protected-area overlap | src/pages/email/administration/quarantine/index.js | +| `b2f8f803` | feat: add actions for managing mailbox client access protocols | Bobby | 2026-06-03 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/email/reports/mailbox-cas-settings/index.js | +| `38ac0c4a` | MCP warning | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippFormComponent.jsx, src/components/CippIntegrations/CippApiClientManagement.jsx | +| `e4009f28` | feat: add Email as alternate login ID standard | Bobby | 2026-06-03 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `51d2828b` | add mcp allowed | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippIntegrations/CippApiClientManagement.jsx | +| `4d88e456` | Update CippAutocomplete.jsx | Zacgoose | 2026-06-03 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CippAutocomplete.jsx | +| `cbd6faef` | Correct report builder permissions | Zacgoose | 2026-06-03 | Medium | General | None | Cherry-pick with review | src/pages/tools/report-builder/builder/index.js, src/pages/tools/report-builder/view/index.js | +| `d4570de5` | Update CippReportToolbar.jsx | Zacgoose | 2026-06-03 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CippReportToolbar.jsx | +| `069d6d6b` | Merge pull request #6101 from kris6673/stale | KelvinTegelaar | 2026-06-02 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `89abbf50` | fix: improve stale issue and close messages for clarity | Bobby | 2026-06-02 | Medium | General | None | Cherry-pick with review | .github/workflows/Close_Stale_Issues.yml | +| `f1703f04` | Update CippTenantModeDeploy.jsx | Zacgoose | 2026-06-02 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippWizard/CippTenantModeDeploy.jsx | +| `49cda6e0` | Update index.js | Zacgoose | 2026-06-02 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/tenant/reports/list-licenses/index.js | +| `d26084fb` | Merge pull request #6080 from kris6673/icons | KelvinTegelaar | 2026-06-02 | Medium | General | None | Cherry-pick with review — isolated UI | src/utils/icon-registry.js | +| `ee6f501e` | Merge pull request #6079 from kris6673/move-ADE | KelvinTegelaar | 2026-06-02 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `3734adee` | Fix template trigger | KelvinTegelaar | 2026-06-01 | Medium | General | None | Already applied (sync 2026-06-17) | src/pages/tenant/manage/user-defaults.js | +| `e2c39b26` | Update M365Licenses.json | Zacgoose | 2026-06-02 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/M365Licenses.json | +| `6737dcb7` | Licence Universal Search | Zacgoose | 2026-06-02 | High | Data/config JSON, General, Navigation/layout | None | Cherry-pick with review | src/components/CippCards/CippUniversalSearchV2.jsx, src/components/CippComponents/CippLicenseDetailsDrawer.jsx, src/data/M365Licenses.json, src/layouts/top-nav.js (+2) | +| `9e44f394` | Update worker-health.js | Zacgoose | 2026-05-30 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/advanced/worker-health.js | +| `c0bfd7df` | Update standards.json | Zacgoose | 2026-05-29 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `97d77727` | Expose missing standards and allow removal | Zacgoose | 2026-05-29 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippStandards/CippStandardAccordion.jsx | +| `707873e3` | fix: Fix tab title showing as undefined | Bobby | 2026-05-28 | Medium | General | None | Cherry-pick with review | src/pages/email/administration/exchange-retention/policies/index.js, src/pages/email/administration/exchange-retention/tags/index.js | +| `d0405ff4` | feat: Add icons to the tabs and remove dead tab | Bobby | 2026-05-28 | Medium | Data/config JSON, General | None | Cherry-pick with review | src/pages/cipp/advanced/super-admin/tabOptions.json, src/pages/cipp/custom-data/tabOptions.json, src/pages/cipp/settings/tabOptions.json, src/pages/dashboardv2/tabOptions.json (+18) | +| `063550f4` | chore: update tab paths and imports | Bobby | 2026-05-28 | Medium | Data/config JSON, General | None | Cherry-pick with review | src/pages/endpoint/autopilot/enrollment-profiles/android-enterprise.js, src/pages/endpoint/autopilot/enrollment-profiles/apple-ade.js, src/pages/endpoint/autopilot/enrollment-profiles/index.js, src/pages/endpoint/autopilot/enrollment-profiles/tabOptions.json (+1) | +| `605ecd82` | fix: move ADE pages | Bobby | 2026-05-28 | High | Data/config JSON, General, Navigation/layout | None | Cherry-pick with review | src/layouts/config.js, src/pages/endpoint/autopilot/enrollment-profiles/android-enterprise.js, src/pages/endpoint/autopilot/enrollment-profiles/apple-ade.js, src/pages/endpoint/autopilot/enrollment-profiles/index.js (+2) | +| `04f8575c` | Merge pull request #6070 from kris6673/6061 | KelvinTegelaar | 2026-05-28 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `8306a660` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | KelvinTegelaar | 2026-05-28 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `7e44aff8` | new auth methods single standard | KelvinTegelaar | 2026-05-28 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `ca43bc9e` | Update worker-health.js | Zacgoose | 2026-05-28 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/advanced/worker-health.js | +| `ab8de98d` | Update worker-health.js | Zacgoose | 2026-05-28 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/advanced/worker-health.js | +| `b8ece5c4` | Update worker-health.js | Zacgoose | 2026-05-28 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/advanced/worker-health.js | +| `0995677d` | chore(deps): bump react-hook-form from 7.72.0 to 7.76.1 | dependabot[bot] | 2026-05-28 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `c04cd7c9` | chore(deps): bump @tiptap/extension-heading from 3.20.5 to 3.22.3 | dependabot[bot] | 2026-05-28 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `49192881` | chore(deps): bump axios from 1.15.0 to 1.16.1 | dependabot[bot] | 2026-05-28 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `8316c600` | chore(deps): bump @react-pdf/renderer from 4.3.2 to 4.5.1 | dependabot[bot] | 2026-05-28 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `f256c253` | chore(deps): bump react-virtuoso from 4.18.5 to 4.18.7 | dependabot[bot] | 2026-05-28 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `072416dd` | new autopatch standard | KelvinTegelaar | 2026-05-28 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `d0f58cbe` | feat(mailboxes): show mailbox and archive size columns | Bobby | 2026-05-27 | Medium | General | None | Cherry-pick with review | src/pages/email/administration/mailboxes/index.js, src/utils/get-cipp-formatting.js | +| `de035243` | fixes #6065 | KelvinTegelaar | 2026-05-27 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/tenant/manage/user-defaults.js | +| `7a408542` | fix query keys | KelvinTegelaar | 2026-05-27 | Medium | General | None | Cherry-pick with review | src/pages/security/compliance/dlp/index.js, src/pages/security/compliance/labels/index.js, src/pages/security/compliance/retention/index.js, src/pages/security/compliance/sit/index.js | +| `635548af` | Add version cleanup | KelvinTegelaar | 2026-05-27 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/teams-share/sharepoint/index.js | +| `0abf5523` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | KelvinTegelaar | 2026-05-27 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `bf6056ba` | Add version cleanup | KelvinTegelaar | 2026-05-27 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/teams-share/sharepoint/index.js | +| `4102a13e` | Merge pull request #6064 from kris6673/TAP-typos | KelvinTegelaar | 2026-05-27 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `5709f856` | fix: update terminology from "Temporary Access Password" to "Temporary Access Pass" | Bobby | 2026-05-27 | Medium | Data/config JSON, General | None | Cherry-pick — data-only JSON | src/components/CippComponents/CippUserActions.jsx, src/data/standards.json | +| `0e527e50` | Sharepoint management functionality. | KelvinTegelaar | 2026-05-27 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `de70889f` | smart lockout standard | KelvinTegelaar | 2026-05-27 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `1b7797af` | Update standards.json | Zacgoose | 2026-05-27 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `fe4765e8` | Merge pull request #6059 from kris6673/permaDismiss | KelvinTegelaar | 2026-05-27 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `25f4caed` | feat: add permanent dismissal option for release notes | Bobby | 2026-05-27 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/ReleaseNotesDialog.js | +| `2f62bae9` | Update CippAuditLogSearchDrawer.jsx | Zacgoose | 2026-05-27 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CippAuditLogSearchDrawer.jsx | +| `d28e8ebf` | user sync | Zacgoose | 2026-05-26 | Medium | General | None | Cherry-pick with review | src/components/CippSettings/CippRoleAddEdit.jsx, src/components/CippSettings/CippUserManagement.jsx, src/pages/cipp/advanced/super-admin/cipp-users.js | +| `f3c8a79e` | Update yarn.lock | Zacgoose | 2026-05-26 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | yarn.lock | +| `ca150a28` | Better display standards that are missing licenses to be able to work | Zacgoose | 2026-05-26 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/tenant/manage/applied-standards.js | +| `1cd1ef72` | Update AuditLogTemplates.json | Zacgoose | 2026-05-26 | Low | Data/config JSON | None | Already applied (sync 2026-06-17) | src/data/AuditLogTemplates.json | +| `1e59d2d4` | Update ListTests.json | Zacgoose | 2026-05-26 | Low | Data/config JSON | None | Already applied (sync 2026-06-17) | Tests/Shapes/ListTests.json | +| `8145f585` | Merge pull request #6056 from KelvinTegelaar/copilot/move-enrollment-profile-tabs | Zacgoose | 2026-05-25 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `02c7a434` | Move EnrollmentProfileTabs to CippComponents folder and update imports | copilot-swe-agent[bot] | 2026-05-25 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/EnrollmentProfileTabs.jsx, src/pages/endpoint/MEM/enrollment-profiles/android-enterprise.js, src/pages/endpoint/MEM/enrollment-profiles/apple-ade.js, src/pages/endpoint/MEM/enrollment-profiles/index.js (+1) | +| `7d1c2096` | Move EnrollmentProfileTabs from pages to components and update imports | copilot-swe-agent[bot] | 2026-05-25 | Medium | General | None | Cherry-pick with review | src/components/EnrollmentProfileTabs.jsx, src/pages/endpoint/MEM/enrollment-profiles/android-enterprise.js, src/pages/endpoint/MEM/enrollment-profiles/apple-ade.js, src/pages/endpoint/MEM/enrollment-profiles/index.js (+1) | +| `a2d8f191` | react-dom | KelvinTegelaar | 2026-05-25 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json | +| `37778e28` | Merge pull request #6002 from KelvinTegelaar/dependabot/npm_and_yarn/dev/react-19.2.6 | KelvinTegelaar | 2026-05-25 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `6a51abf3` | demo data | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review | src/contexts/tutorial-context.js, src/data/dashboardv2-demo-data.js | +| `eac59c8a` | add tutorials to easy deployment of steps for Ashe. | KelvinTegelaar | 2026-05-25 | High | General, Navigation/layout | None | Cherry-pick with review | src/components/CippComponents/CippBreadcrumbNav.jsx, src/components/CippComponents/CippSpeedDial.jsx, src/components/CippComponents/CippTutorialDialog.jsx, src/contexts/tutorial-context.js (+3) | +| `ff9af7e0` | add tutorials to easy deployment of steps for Ashe. | KelvinTegelaar | 2026-05-25 | High | Data/config JSON, Dependencies/build, General | Build/dependencies | Skip or Defer — protected-area overlap | package.json, src/components/CippComponents/CippBreadcrumbNav.jsx, src/components/CippComponents/CippSpeedDial.jsx, src/components/CippComponents/CippTutorialDialog.jsx (+10) | +| `8a179d28` | moved autopilot ade etc | KelvinTegelaar | 2026-05-25 | High | Data/config JSON, General, Navigation/layout | None | Cherry-pick with review | src/layouts/config.js, src/pages/endpoint/MEM/enrollment-profiles/apple-ade.js, src/pages/endpoint/MEM/enrollment-profiles/index.js, src/pages/endpoint/MEM/enrollment-profiles/tabOptions.json | +| `83994360` | chore(deps): bump react from 19.2.5 to 19.2.6 | dependabot[bot] | 2026-05-25 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `0001b6c8` | Merge pull request #5999 from KelvinTegelaar/dependabot/npm_and_yarn/dev/dompurify-3.4.3 | KelvinTegelaar | 2026-05-25 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `4ffb7638` | Merge pull request #6000 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tiptap/extension-table-3.20.5 | KelvinTegelaar | 2026-05-25 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `2e1e3007` | Merge pull request #6001 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tiptap/core-3.22.3 | KelvinTegelaar | 2026-05-25 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `ac1190da` | Merge pull request #6003 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tanstack/react-query-5.100.10 | KelvinTegelaar | 2026-05-25 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `28ec38c1` | Merge pull request #6009 from kris6673/ade | KelvinTegelaar | 2026-05-25 | High | Navigation/layout | None | Cherry-pick with review — isolated UI | src/layouts/config.js | +| `d8c4988d` | Merge pull request #6039 from kris6673/DlpViaDcsEnabled | KelvinTegelaar | 2026-05-25 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `304e0e5a` | Merge pull request #6052 from kris6673/remove-adminroles | KelvinTegelaar | 2026-05-25 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `38e72f99` | Add APv2 profile | KelvinTegelaar | 2026-05-25 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `c1c5693c` | feat: add admin role member removal functionality | Bobby | 2026-05-25 | Medium | General | None | Cherry-pick with review | src/pages/identity/administration/roles/index.js, src/pages/identity/administration/users/user/index.jsx | +| `16b4503f` | login/out testing | Zacgoose | 2026-05-25 | High | Data/config JSON, Navigation/layout | None | Skip — auth/permissions overlap | src/layouts/account-popover.js, staticwebapp.config.json | +| `f591d479` | logout | Zacgoose | 2026-05-25 | High | General, Navigation/layout | None | Cherry-pick with review | src/components/CippComponents/SsoMigrationDialog.jsx, src/layouts/account-popover.js, src/layouts/index.js | +| `c43f6d9a` | Update unauthenticated.js | Zacgoose | 2026-05-25 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/unauthenticated.js | +| `3bdb9d5b` | add global var showing | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CippCustomVariables.jsx | +| `389babe3` | add global var showing | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CippCustomVariables.jsx | +| `8097e6ed` | FIDO2 profile standards | KelvinTegelaar | 2026-05-25 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `17bf1f8d` | fixes #5995 | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/tenant/manage/user-defaults.js | +| `ee0ab2ab` | add extendedValues | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review | src/components/CippFormPages/CippAddEditUser.jsx, src/pages/tenant/manage/user-defaults.js | +| `d4f458a1` | Third party text | KelvinTegelaar | 2026-05-24 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/integrations/index.js | +| `30455f27` | third party | KelvinTegelaar | 2026-05-24 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/integrations/index.js | +| `28cafc93` | added third party notice | KelvinTegelaar | 2026-05-24 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/integrations/index.js | +| `04c63849` | implement standards template deployment for intune apps | KelvinTegelaar | 2026-05-24 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `a3279044` | CIPP Hosted Notices | Zacgoose | 2026-05-24 | High | General, Navigation/layout | None | Cherry-pick with review | src/components/CippComponents/FailedPaymentDialog.jsx, src/components/CippComponents/SubscriptionEndedDialog.jsx, src/layouts/index.js | +| `bde8ad3c` | Merge pull request #6010 from Celeratec/fix/remove-claude-worktrees | KelvinTegelaar | 2026-05-23 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `96686d7e` | Merge pull request #6012 from jonwbstr/magicdash-addoptions | KelvinTegelaar | 2026-05-23 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `fad1cacf` | Merge pull request #6019 from kris6673/split-intune-join-registration | KelvinTegelaar | 2026-05-23 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `5574b477` | Merge pull request #6038 from kris6673/winhello | KelvinTegelaar | 2026-05-23 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `c74966b3` | Merge pull request #6018 from kris6673/bulk-edit | KelvinTegelaar | 2026-05-23 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `a6ae2610` | Add Group-Based Licensing support | Luis Mengel | 2026-05-23 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippFormLicenseSelector.jsx, src/components/CippFormPages/CippAddGroupForm.jsx, src/components/CippFormPages/CippAddGroupTemplateForm.jsx, src/components/CippWizard/CippWizardGroupTemplates.jsx (+2) | +| `131927b9` | Stats | Zacgoose | 2026-05-22 | High | General, Navigation/layout | None | Cherry-pick with review | src/components/PrivateRoute.js, src/layouts/index.js, src/pages/cipp/advanced/worker-health.js | +| `5b5302ca` | feat(standards): add DLP via DCS OWA standard | Bobby | 2026-05-20 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `766a3c52` | feat: add in missing options for Windows Hello standard | Bobby | 2026-05-20 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `fc246a54` | update default value for standard | Zacgoose | 2026-05-19 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `1e7aef11` | Update alerts.json | Zacgoose | 2026-05-19 | Low | Data/config JSON | None | Already applied (sync 2026-06-17) | src/data/alerts.json | +| `6db7e776` | Delete .claude directory | Zacgoose | 2026-05-18 | Medium | General | None | Cherry-pick with review | .claude/worktrees/blissful-golick-d405ab | +| `9d5ce402` | Org auto expanding archive property usage | Zacgoose | 2026-05-18 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippCards/CippExchangeInfoCard.jsx | +| `f768330c` | fix(standards): move CIS 5.1.4.1 and SMB1001 (2.8) tags to join standard | Bobby | 2026-05-15 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `8232e5c1` | feat(standards): add intuneRestrictUserDeviceJoin entry | Bobby | 2026-05-15 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `7a85827e` | feat(users): add bulk update contact and UPN fields | Bobby | 2026-05-15 | Medium | General | None | Already applied (sync 2026-06-17) | src/pages/identity/administration/users/patch-wizard.jsx | +| `186a2c6e` | audit log template tweak | Zacgoose | 2026-05-15 | High | Data/config JSON, General, Navigation/layout | None | Cherry-pick with review | src/data/AuditLogTemplates.json, src/layouts/config.js, src/pages/cipp/advanced/worker-health.js | +| `0c32a84e` | Add additional portal links to Invoke-HuduExtensionSync | jwebster@protectedtrust.com | 2026-05-14 | Low | Data/config JSON | None | Already applied (sync 2026-06-17) | src/data/Extensions.json | +| `983b48a1` | fix: Remove accidentally committed .claude/worktrees directory | Clint Thomon | 2026-05-14 | Medium | General | None | Cherry-pick with review | .claude/worktrees/blissful-golick-d405ab, .gitignore | +| `9b616499` | feat: Migrate to use shared icon registry for string to icon conversion | Bobby | 2026-05-14 | High | Data/config JSON, General, Navigation/layout | Navigation/tenant switching | Skip or Defer — protected-area overlap | src/components/CippCards/CippPropertyListCard.jsx, src/components/CippCards/CippUniversalSearchV2.jsx, src/components/CippComponents/CippTenantSelector.jsx, src/components/bulk-actions-menu.js (+4) | +| `6dab9339` | feat(tabs): support icons in tabbed layouts | Bobby | 2026-05-14 | High | Data/config JSON, General, Navigation/layout | None | Cherry-pick with review | src/layouts/HeaderedTabbedLayout.jsx, src/layouts/TabbedLayout.jsx, src/pages/endpoint/MEM/enrollment-profiles/tabOptions.json, src/utils/icon-registry.js | +| `b1902421` | feat: Bit more margin to make tabbed layout of first item less cramped | Bobby | 2026-05-14 | High | Navigation/layout | None | Defer — layout conflict (b1902421) | src/layouts/HeaderedTabbedLayout.jsx, src/layouts/TabbedLayout.jsx | +| `c9bfe909` | feat(endpoint): add MEM enrollment profiles page (Apple ADE, Android, Autopilot) | Bobby | 2026-05-14 | High | Data/config JSON, General, Navigation/layout | None | Cherry-pick with review | src/components/CippCards/CippUniversalSearchV2.jsx, src/components/CippComponents/CippBreadcrumbNav.jsx, src/layouts/config.js, src/pages/endpoint/MEM/enrollment-profiles/EnrollmentProfileTabs.jsx (+4) | +| `db20afa2` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | KelvinTegelaar | 2026-05-14 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `12a07270` | comingsoon | KelvinTegelaar | 2026-05-14 | Medium | Data/config JSON, General | None | Cherry-pick with review | public/assets/integrations/autotask.png, public/assets/integrations/connectwise.png, public/assets/integrations/kaseya.svg, src/data/Extensions.json (+1) | +| `b5d48bcd` | logging | Zacgoose | 2026-05-14 | Medium | Data/config JSON, General | None | Cherry-pick with review | src/data/ContainerLogPresets.json, src/pages/cipp/advanced/container-logs.js | +| `fd6a9e36` | Logs | Zacgoose | 2026-05-14 | High | General, Navigation/layout | None | Cherry-pick with review | src/layouts/config.js, src/pages/cipp/advanced/container-logs.js | +| `d392d1cf` | chore(deps): bump @tanstack/react-query from 5.96.2 to 5.100.10 | dependabot[bot] | 2026-05-13 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `2285d39c` | chore(deps): bump @tiptap/core from 3.20.5 to 3.22.3 | dependabot[bot] | 2026-05-13 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `a783d28a` | chore(deps): bump @tiptap/extension-table from 3.20.4 to 3.20.5 | dependabot[bot] | 2026-05-13 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `c9584010` | chore(deps): bump dompurify from 3.4.2 to 3.4.3 | dependabot[bot] | 2026-05-13 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `60a50738` | fixes tenantfilter property | KelvinTegelaar | 2026-05-13 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/email/administration/mailbox-rules/index.js | +| `41efc5b7` | Update CippCAPolicyBuilder.jsx | Zacgoose | 2026-05-13 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CippCAPolicyBuilder.jsx | +| `52a47639` | Nice CA policy editor and template creator/editor | Zacgoose | 2026-05-13 | Medium | Data/config JSON, General | None | Cherry-pick with review | src/components/CippComponents/CippCAPolicyBuilder.jsx, src/components/CippComponents/CippTemplateFieldRenderer.jsx, src/data/conditionalAccessSchema.json, src/pages/tenant/conditional/list-policies/edit.jsx (+4) | +| `8551ef5f` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | KelvinTegelaar | 2026-05-13 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `ba196dde` | expand side nav slightly for ux | KelvinTegelaar | 2026-05-13 | High | General, Navigation/layout | None | Cherry-pick with review | .claude/worktrees/blissful-golick-d405ab, src/layouts/side-nav.js | +| `72d8658d` | Add Apps and SP to universal search | Zacgoose | 2026-05-13 | Medium | General | None | Cherry-pick with review | src/components/CippCards/CippUniversalSearchV2.jsx, src/components/bulk-actions-menu.js | +| `c0946109` | Fix bulk mailbox rule changes | Zacgoose | 2026-05-13 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/identity/administration/users/user/exchange.jsx | +| `36071e54` | Module updates and import changes | Zacgoose | 2026-05-13 | High | Dependencies/build, General, Navigation/layout | Build/dependencies; Navigation/tenant switching | Skip or Defer — protected-area overlap | next.config.js, package.json, src/components/CippCards/CippStandardsDialog.jsx, src/components/CippComponents/CippAppPermissionBuilder.jsx (+9) | +| `19c48eab` | auth options | Zacgoose | 2026-05-13 | High | Data/config JSON, General, Navigation/layout | None | Cherry-pick with review | src/components/CippComponents/ForcedSsoMigrationDialog.jsx, src/components/CippComponents/SsoMigrationDialog.jsx, src/components/CippIntegrations/CippApiClientManagement.jsx, src/components/CippSettings/CippContainerManagement.jsx (+8) | +| `335e40ad` | Merge pull request #5907 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tanstack/react-query-persist-client-5.96.2 | KelvinTegelaar | 2026-05-12 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json | +| `d00ebb77` | chore: bump version to 10.4.5 | John Duprey | 2026-05-12 | High | Data/config JSON, Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, public/version.json | +| `7054bfc4` | Add AlertUserReportPhising | KelvinTegelaar | 2026-05-12 | Low | Data/config JSON | None | Already applied (sync 2026-06-17) | src/data/alerts.json | +| `6c55bc42` | OneDrive Sharing disable | KelvinTegelaar | 2026-05-12 | Medium | General | None | Cherry-pick with review | src/components/CippCards/CippRemediationCard.jsx, src/components/CippComponents/CippOffboardingDefaultSettings.jsx, src/components/CippComponents/CippUserActions.jsx, src/components/CippWizard/CippWizardOffboarding.jsx | +| `63c85df0` | OneDrive Sharing disable | KelvinTegelaar | 2026-05-12 | Medium | General | None | Cherry-pick with review | src/components/CippCards/CippRemediationCard.jsx, src/components/CippComponents/CippOffboardingDefaultSettings.jsx, src/components/CippComponents/CippUserActions.jsx, src/components/CippWizard/CippWizardOffboarding.jsx | +| `0a70010e` | fix: update translation keys and adjust template usage references | John Duprey | 2026-05-12 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippTranslations.jsx, src/pages/endpoint/MEM/list-templates/index.js | +| `4f2d4993` | feat: enhance intune template details display | John Duprey | 2026-05-11 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippTranslations.jsx, src/pages/endpoint/MEM/list-templates/index.js, src/utils/get-cipp-formatting.js | +| `6cd8c632` | chore: linting | John Duprey | 2026-05-11 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/tenant/standards/alignment/index.js | +| `1cb6a11c` | fix: enhance standard name retrieval logic for better matching | John Duprey | 2026-05-11 | Medium | General | None | Already applied (sync 2026-06-17) | src/pages/tenant/standards/alignment/index.js | +| `15939e2b` | feat: improve run standard now UX provide single action with autocomplete to select all tenants in template or individual tenant (expanded from alltenants/groups) | John Duprey | 2026-05-11 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippFormTemplateTenantSelector.jsx, src/pages/tenant/manage/applied-standards.js, src/pages/tenant/manage/drift.js, src/pages/tenant/manage/driftManagementActions.js (+3) | +| `d7e8b0b5` | fix: tweak toggle button size | John Duprey | 2026-05-11 | Medium | General | None | Already applied (sync 2026-06-17) | src/pages/tenant/standards/alignment/index.js | +| `fe4bd7f9` | fix: allow alltenants sync on onedrive/sharepoint | John Duprey | 2026-05-11 | Medium | General | None | Cherry-pick with review | src/pages/teams-share/onedrive/index.js, src/pages/teams-share/sharepoint/index.js | +| `a4915dff` | chore(deps): bump @tanstack/react-query-persist-client | dependabot[bot] | 2026-05-11 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `7dcb867b` | Merge pull request #5908 from KelvinTegelaar/dependabot/npm_and_yarn/dev/uiw/react-json-view-2.0.0-alpha.42 | KelvinTegelaar | 2026-05-11 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `06e16457` | Merge pull request #5904 from KelvinTegelaar/dependabot/npm_and_yarn/dev/recharts-3.8.1 | KelvinTegelaar | 2026-05-11 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `cef87445` | Merge pull request #5905 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tanstack/react-query-devtools-5.96.2 | KelvinTegelaar | 2026-05-11 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `7bcd507c` | Merge pull request #5906 from KelvinTegelaar/dependabot/npm_and_yarn/dev/mui-tiptap-1.30.0 | KelvinTegelaar | 2026-05-11 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json | +| `4b0800b8` | Merge pull request #5903 from KelvinTegelaar/dependabot/github_actions/dev/actions/setup-node-6.4.0 | KelvinTegelaar | 2026-05-11 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | .github/workflows/cipp_frontend_build.yml | +| `0fc7b3c6` | Merge pull request #5921 from kris6673/allTenants-SP | KelvinTegelaar | 2026-05-11 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `ccf4e9cf` | Merge pull request #5685 from kris6673/levenshtein-distance | KelvinTegelaar | 2026-05-11 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `fe722173` | Merge pull request #5794 from TecharyJames/Feat-Conditional-accesss-policy-package-tags | KelvinTegelaar | 2026-05-11 | Medium | Data/config JSON, General | None | Skip — merge commit; cherry-pick substantive commits instead | src/data/standards.json, src/pages/tenant/manage/drift.js | +| `fd23c0df` | Merge branch 'dev' into allTenants-SP | Kristian Kjærgård | 2026-05-11 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `2f849474` | Merge branch 'dev' into levenshtein-distance | Kristian Kjærgård | 2026-05-11 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `dd0ba6f1` | Merge pull request #5920 from kris6673/alltenants-intune | KelvinTegelaar | 2026-05-11 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `be88cc9c` | Merge branch 'dev' into levenshtein-distance | Kristian Kjærgård | 2026-05-11 | Medium | Data/config JSON, General | None | Cherry-pick — data-only JSON | src/components/CippStandards/CippStandardAccordion.jsx, src/data/standards.json | +| `5ca3e9ad` | Merge branch 'dev' into alltenants-intune | Bobby | 2026-05-11 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | src/components/CippComponents/CippReportDBControls.jsx, src/pages/endpoint/MEM/list-policies/index.js | +| `35711f89` | Merge branch 'dev' of https://github.com/kris6673/CIPP into allTenants-SP | Bobby | 2026-05-11 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | src/pages/teams-share/onedrive/index.js, src/pages/teams-share/sharepoint/index.js | +| `2a1b9128` | Merge pull request #5984 from kris6673/by-standards-view | KelvinTegelaar | 2026-05-11 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `2e9b9fd5` | fixed weird button | KelvinTegelaar | 2026-05-11 | High | Dependencies/build | None | Already applied (sync 2026-06-17) | src/components/CippComponents/CippTenantAllowBlockListTemplateDrawer.jsx | +| `8e99c018` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | KelvinTegelaar | 2026-05-11 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `bc412396` | implements #5986 | KelvinTegelaar | 2026-05-11 | High | Dependencies/build | None | Defer — allow/block controlled drawer stack | src/components/CippComponents/CippTenantAllowBlockListTemplateDrawer.jsx, src/pages/email/administration/tenant-allow-block-list-templates/index.js | +| `20e2f554` | implements #5986 | KelvinTegelaar | 2026-05-11 | High | Dependencies/build | None | Defer — allow/block controlled drawer stack | src/components/CippComponents/CippTenantAllowBlockListTemplateDrawer.jsx, src/pages/email/administration/tenant-allow-block-list-templates/index.js | +| `da6dc7fa` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | Zacgoose | 2026-05-12 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `08c793d7` | Update manifest.json | Zacgoose | 2026-05-12 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | public/manifest.json | +| `1b77b784` | Update manifest for PWA chrome install option | Zacgoose | 2026-05-12 | Medium | Data/config JSON, General | None | Cherry-pick with review | public/manifest.json, public/sw.js, src/pages/_app.js, src/pages/_document.js | +| `14461b4f` | eclusions everywhere | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippIntunePolicyActions.jsx, src/components/CippWizard/CippIntunePolicy.jsx, src/pages/endpoint/applications/templates/index.js | +| `9cee69d4` | eclusions everywhere | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippAppTemplateDrawer.jsx, src/components/CippComponents/CippApplicationDeployDrawer.jsx, src/components/CippComponents/CippIntunePolicyActions.jsx, src/components/CippComponents/CippPolicyDeployDrawer.jsx (+2) | +| `55dd9cc2` | HVE user page | Zacgoose | 2026-05-12 | High | Data/config JSON, General, Navigation/layout | None | Cherry-pick with review | src/components/CippComponents/CippHVEUserDrawer.jsx, src/components/CippComponents/CippNotificationForm.jsx, src/data/CIPPDBCacheTypes.json, src/layouts/config.js (+2) | +| `8b79d999` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | Zacgoose | 2026-05-12 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `445820dd` | Better intune policy support for alltenants list | Zacgoose | 2026-05-12 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippIntunePolicyDetails.jsx, src/components/CippFormPages/CippJSONView.jsx | +| `64e40807` | implemenets #5948 | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CippApplicationDeployDrawer.jsx | +| `0d42f679` | #5939 | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/tenant/reports/list-licenses/index.js | +| `cfe8c705` | adds #5939 | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/tenant/reports/list-licenses/index.js | +| `4b9efd82` | Update index.js | Zacgoose | 2026-05-11 | Medium | General | None | Already applied (sync 2026-06-17) | src/pages/tenant/reports/list-licenses/index.js | +| `98d5d94a` | Custom Test - Alert on X statuses | Zacgoose | 2026-05-11 | Low | Tests | None | Already applied (sync 2026-06-17) | src/pages/tools/custom-tests/add.jsx | +| `e3ed1818` | fix alert mode | KelvinTegelaar | 2026-05-10 | Medium | Data/config JSON, General | None | Cherry-pick with review | src/data/standards.json, src/pages/security/compliance/retention/index.js | +| `b8abed94` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | KelvinTegelaar | 2026-05-10 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `45f1d72b` | purview adding | KelvinTegelaar | 2026-05-10 | High | Data/config JSON, General, Navigation/layout | None | Cherry-pick with review | src/components/CippComponents/CippDeployCompliancePolicyDrawer.jsx, src/data/standards.json, src/layouts/config.js, src/pages/security/compliance/dlp-templates/index.js (+7) | +| `b05e0923` | feat(standards): add by-standard alignment summary view | Bobby | 2026-05-08 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippTranslations.jsx, src/components/CippTable/CippDataTable.js, src/components/CippTable/CippDataTableButton.jsx, src/pages/tenant/standards/alignment/index.js (+2) | +| `d7d36a31` | feat: Add allTenants support for all the Teams SharePoint pages | Bobby | 2026-04-26 | Medium | General | None | Cherry-pick with review | src/pages/teams-share/onedrive/index.js, src/pages/teams-share/sharepoint/index.js, src/pages/teams-share/teams/business-voice/index.js, src/pages/teams-share/teams/list-team/index.js (+1) | +| `1707506b` | feat: integrate useCippReportDB for data handling | Bobby | 2026-04-25 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippReportDBControls.jsx, src/pages/endpoint/MEM/assignment-filters/index.js, src/pages/endpoint/MEM/devices/index.js, src/pages/endpoint/MEM/list-appprotection-policies/index.js (+4) | +| `f86925dc` | Merge branch 'dev' of https://github.com/kris6673/CIPP into alltenants-intune | Bobby | 2026-04-25 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/endpoint/MEM/list-policies/index.js | +| `a5f2b74b` | feat: add allTenants support for multiple intune pages | Bobby | 2026-04-25 | Medium | General | None | Cherry-pick with review | src/pages/endpoint/MEM/assignment-filters/index.js, src/pages/endpoint/MEM/devices/index.js, src/pages/endpoint/MEM/list-appprotection-policies/index.js, src/pages/endpoint/MEM/list-compliance-policies/index.js (+4) | +| `c3c90afe` | chore(deps): bump @uiw/react-json-view | dependabot[bot] | 2026-04-22 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `c22177f7` | chore(deps): bump mui-tiptap from 1.29.1 to 1.30.0 | dependabot[bot] | 2026-04-22 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `93cfed20` | chore(deps): bump @tanstack/react-query-devtools from 5.91.3 to 5.96.2 | dependabot[bot] | 2026-04-22 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `9ae908d7` | chore(deps): bump recharts from 3.8.0 to 3.8.1 | dependabot[bot] | 2026-04-22 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `05b93261` | chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 | dependabot[bot] | 2026-04-22 | Medium | General | None | Cherry-pick with review | .github/workflows/Node_Project_Check.yml, .github/workflows/cipp_dev_build.yml, .github/workflows/cipp_frontend_build.yml | +| `b6438ee3` | Merge branch 'dev' into Feat-Conditional-accesss-policy-package-tags | KelvinTegelaar | 2026-04-04 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `83d657b8` | Lookup CA template names via API | James Tarran | 2026-04-03 | Medium | General | None | Cherry-pick with review | src/pages/tenant/manage/drift.js, src/pages/tenant/manage/policies-deployed.js | +| `db57e52a` | Mark TemplateList as optional and non-creatable | James Tarran | 2026-04-03 | Low | Data/config JSON | None | Already applied (sync 2026-06-17) | src/data/standards.json | +| `5ffd20e1` | Merge remote-tracking branch 'upstream/dev' into Feat-Conditional-accesss-policy-package-tags | James Tarran | 2026-04-03 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `88bc10a5` | Added UI Elements for adding conditional access policies to package tags | James Tarran | 2026-04-02 | Medium | Data/config JSON, General | None | Cherry-pick with review | src/data/standards.json, src/pages/tenant/conditional/list-template/index.js | +| `4fc1b57b` | feat: add warningMessage support standards | Bobby | 2026-03-20 | Medium | Data/config JSON, General | None | Cherry-pick — data-only JSON | src/components/CippStandards/CippStandardAccordion.jsx, src/data/standards.json | +| `7dffc4c6` | feat: add fuzzy match distance setting to Intune template based on Levenshtein distance | Bobby | 2026-03-20 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | diff --git a/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260727.md b/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260727.md new file mode 100644 index 0000000000..809995b237 --- /dev/null +++ b/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260727.md @@ -0,0 +1,77 @@ +# Upstream Delta — CIPP (frontend) — 2026-07-27 + +Cycle type: **Major delta** (upstream 10.6.1 → **10.6.4 + v10.7.0**). +Sync base: `17ed2b396` (upstream/main at last cycle, July 13) → `upstream/main` @ `44ac45831`. +96 commits in range (48 non-merge + release squashes from the CyberDrain org +transition — see API delta doc for the squash mechanics). + +Net delta: 109 files, +7,861 / −590. + +## Triage — Apply (cherry-pick) + +| Upstream | Subject | Notes | +|---|---|---| +| `48595d74c` | default assignment mode append | API pair `b2985a6f0` | +| `ffbca69a5` | registration campaign page + auth-methods tabs | API pair `5b42363cd`; new page | +| `082fe069c` | smart lockout Enforce | standards.json curated adapt | +| `5066c5ff6` | align standards.json with API | curated adapt | +| `0f4ddb085` | setup-node 7 | | +| `f1ce6b543` | prettier 3.9.5 | | +| `7dad7bcab` | diff 9.0.0 | | +| `16ad6b9b2` | restore typescript devDependency | eslint flat config needs it | +| `01d33ac1b` | anonymization alert for report pages | new CippAnonymizedReportAlert + report pages | +| `bfc83afd7` | SP site (in)activity report | API pair `ffab43e1a` | +| `f2f62df42` | custom test save/run UX | | +| `c7b079c97` | offcanvas markdown table scroll | | +| `21003f7af`, `54153656f`, `155b6b073` | GDAPRoles.json additions/fixes | fork still uses GDAPRoles for GDAP invites (JIT uses JitAdminRoles.json) | +| `3ac0596f0` | mailbox quota alert types | API pair `ed577f689` | +| `0b879d130` | resource accounts standard | curated standards.json adapt | +| `3bea4e3b2` | app-approval permission set refresh | API pair `fd245427d` | +| `1f4dc9175` | AllowedToCreateGroups | curated standards.json adapt | +| `c259fe4ea` | JSON validation workflow | | +| `b4373e540` | CSP licenses #6390 | API pair `d348de650` | +| `341b4555e` | GDAP age group option | API pair `4ee94dcba` | +| `01180c005` | shadow AI tools alert (alerts.json + ShadowAIReportButton) | API pair `206f9b155` | +| `c4bf26c4d` | MEM single compare policy result | API pair `e0060db51` | +| `f777572bf` | applicationTemplateId for cloud sync SP | tenants edit | +| `fcf936dd d`+`84584329f` | SharePoint templated deployments v1 + steps | new pages/components/schemas; menu wiring = adapt into fork config.js (protected) | +| `da107ebf2` | autopilot profile display name validation | API pair `d14159589` | +| `c5278d18a` | custom branding fix | inspect against fork branding (protected) before taking | +| `fc6a06db6` | cache buster version | | +| `b599f7ef6`+`bdf0a662f` | container settings | **Skip** — fork has no CippContainerManagement | + +## Triage — Adapt (protected fork files) + +| Upstream | File(s) | Notes | +|---|---|---| +| `ceebe9fcd` | CippAddEditUser.jsx | fork FormSection-styled page | +| `eff527422` | CippUserActions.jsx | 18 fork commits on this file | +| `35e83de15` | PrivateRoute.js | fork fast path — port 401-flash fix surgically | +| `f27ad344d` | settings/tenants.js | fork tenant workflows protected | +| squash | CippApiResults.jsx | fork error-guidance classification — surgical diff | +| squash | config.js / side-nav.js menu entries | fork nav protected — add SP templates / permissions report entries manually | +| squash | standards.json refresh | curated — only standards with fork implementations | + +## Triage — squash-only content (port by path diff, paired with API) + +| Area | Outcome | Notes | +|---|---|---| +| SharePoint permissions report family (`permissions-report` page, CippPdf report primitives, `PermissionsReportButton`, `SharingReportButton`, `CippSharePointPermissionEditor`, `CippLibraryPermissionsDialog`, `CippCheckUserAccessDialog`, sharepoint.svg/teams.svg logos + icons) | **Apply** | pairs with API SP permissions family | +| SP templates (builder, deploy drawer, `CippMultiQueueTracker`, `CippQueryRefreshButton`, sharePointTemplateSchemas.json, teams-share/sharepoint-templates pages) | **Apply** | | +| `CippPolicyCompareDialog` / `CippPolicyDiffTable` + compare-policies page | **Apply** | | +| Copilot pages updates (usage report, settings) | **Apply** | fork took Copilot intake 07-15 | +| Teams business-voice / teams-activity page changes | **Defer** | pairs with deferred API Teams V2 | +| SSO dialogs (`SsoMigrationDialog`, `ForcedSsoMigrationDialog`, `bcc920892`) | **Defer** | SSO family intake | +| `custom-domains.js` super-admin + `CippAppServiceDomains` | **Defer** | with API ExecAppServiceDomains | +| `dashboardv1.js` | **Skip** | fork removed dashboard v1 | +| `dashboardv2`, `CippUserActions`, mailboxes page, `CippAutocomplete`, `CippTenantSelector`, `CippFormPage`, `get-cipp-formatting` squash diffs | **Review individually** | protected/heavily customized — take only clean fixes | + +## Triage — Skip / Already implemented + +| Upstream | Outcome | Reason | +|---|---|---| +| `e502965a5` | Already | fork never had Detect_Duplicate_Issues.yml | +| `1b48ea16b` axios, `18400b05f` dompurify | Already | fork at 1.18.1 / 3.4.12 from July 24 security pass | +| `cc3903ce0`, `88c0487cf` | Skip | version bumps (fork versioning protected) | +| `bcc920892` | Defer | SSO | +| `b599f7ef6`, `bdf0a662f` | Skip | container management not in fork | diff --git a/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260803.md b/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260803.md new file mode 100644 index 0000000000..4cb5e2d7cc --- /dev/null +++ b/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260803.md @@ -0,0 +1,45 @@ +# Upstream Delta — CIPP (frontend) — 2026-08-03 + +Cycle type: **Light/medium delta** (upstream **10.7.3 → 10.7.5**). +Sync base: `d72c1e21b` (upstream/main at 07-28 cycle) → `upstream/main` @ `274880fd0`. +Branch: `manage365/upstream-sync-cipp-20260803` +Backup tag: `backup/pre-upstream-sync-cipp-20260803` + +3 merge commits (CyberDrain #103, #115, #132). Net: 19 files, +443 / −60. + +## Commits + +| SHA | Date | Subject | +|-----|------|---------| +| `f757a44fe` | 2026-07-29 | Merge PR #103 from CyberDrain/dev | +| `b49e04a51` | 2026-07-29 | Merge PR #115 from CyberDrain/dev | +| `274880fd0` | 2026-07-30 | Merge PR #132 from CyberDrain/dev → **10.7.5** | + +## Triage — Apply + +| Path / theme | Notes | +|---|---| +| `CippAlertSnoozeDialog.jsx`, `snooze-alert.js`, `snoozed-alerts.js` | Optional snooze reason field | +| `CippIntuneDeviceActions.jsx` | "Add to Group" action — pair with API `Invoke-EditGroup` AddDevice | +| `CippAddGroupForm.jsx` | `disableNesting` switch — pair with API `New-CIPPGroup` | +| `preferences.js`, `dashboardv2/*`, `CippReportToolbar.jsx` | Default Home test suite preference | +| `src/data/M365Licenses.json` | License catalog update | +| `partner-webhooks.js` | Stale webhook URL warning — pair with `Get-CIPPHostname` | + +## Triage — Adapt + +| Path | Notes | +|---|---| +| `groups/edit.jsx` | Fork redesigned page — port `disableNesting` surgically, do not replace whole file | + +## Triage — Skip / Defer + +| Path | Outcome | Why | +|---|---|---| +| `CippSSOSettings.jsx` | **Skip** | SSO family — SWA/Craft decision 2026-07-15 | +| `CippAppServiceDomains.jsx` | **Defer** | Fork has no custom-domains page; App Service hosting N/A | +| `package.json` / `version.json` / `manifest.json` | **Chore** | Baseline bump via `Update-Version.ps1` at end | + +## Already present / N/A + +- Fork already has `CippAlertSnoozeDialog`, `CippIntuneDeviceActions`, `CippReportToolbar`, `CippAddGroupForm`, partner-webhooks, preferences, dashboardv2 — taking diffs only. diff --git a/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260814.md b/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260814.md new file mode 100644 index 0000000000..be8a8ad841 --- /dev/null +++ b/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260814.md @@ -0,0 +1,33 @@ +# Upstream Delta — CIPP (frontend) — 2026-08-14 + +Cycle: **Major** — upstream **10.7.5 → 10.8.5** (plan drafted as 10.8.4; tip advanced). + +| | SHA / version | +|--|--| +| Last sync base | `274880fd0` (upstream tip at 10.7.5) | +| Upstream tip | `a1b620403` (`upstream/main`, **10.8.5**) | +| Fork production at cycle start | `68dda9809` (`origin/main`) | +| Sync branch | `manage365/upstream-sync-cipp-20260814` | +| Backup tag | `backup/pre-upstream-sync-cipp-20260814` | + +Noise excluded from triage: `public/intune-definitions/**` churn, bulk Vitest scaffolding (port only if a batch needs it). + +## Triage themes + +| Theme | Outcome | Notes | +|-------|---------|-------| +| Baselines pages (`src/pages/tenant/baselines/**`, `CippBaselines/*`) | **Feature intake** | Pair with API; flag off; nav commented upstream — wire carefully | +| Branding settings/PDF presets | **Adapt** | Preserve Manage365 `CippBrandingSettings` / `customBranding` | +| Intune approval requests | **Apply** | New page + API | +| BitLocker search page | **Apply** | New route; search helper already in fork | +| Secure Score report / AllTenants | **Adapt** | Pair with `ListSecureScoreReport` | +| Default MFA method on user page | **Adapt** | Surgical into fork user detail | +| Community repos catalog | **Adapt** | Large FE rework — surgical | +| BEC / user detail | **Adapt** | Protected-rich fork UI | +| Auth nav → authentication/container-management, SSO dialogs | **Skip** | SWA/Craft | +| Node/jsdom engine bumps, wholesale yarn.lock | **Defer** | After feature ports | +| CippDataTable / top-nav / standards accordion | **Adapt only** | Protected | + +## Protected map refresh note + +Still authoritative: [CUSTOM_FEATURE_MAP_20260617.md](./CUSTOM_FEATURE_MAP_20260617.md). This cycle adds: Baselines parallel to Applied Standards (do not replace drift UI); branding Adapt-not-replace; skip auth nav split. diff --git a/docs/upstream-sync/history-cipp/UPSTREAM_SYNC_CIPP_20260617.md b/docs/upstream-sync/history-cipp/UPSTREAM_SYNC_CIPP_20260617.md new file mode 100644 index 0000000000..41cba07758 --- /dev/null +++ b/docs/upstream-sync/history-cipp/UPSTREAM_SYNC_CIPP_20260617.md @@ -0,0 +1,4382 @@ +# Upstream Sync Inventory — CIPP (Frontend) + +Generated: 2026-06-17 11:21 + +## Summary + +| Field | Value | +|-------|-------| +| Our branch tip | `f2d87612ec80b9be24c303137c9604590992b144` | +| Upstream branch | `upstream/main` | +| Upstream tip | `0d8ca9d2f5f8511413b69a3064e055ac45024f33` | +| Merge base | `0710355e2adac37fffe4c7eef48d6f2c3a04993d` | +| Commits to review | **241** | + +### Risk Distribution + +- **Low**: 11 +- **Medium**: 80 +- **High**: 150 + +### Recommendation Distribution + +- **Needs manual review**: 200 +- **Cherry-pick with adaptation**: 30 +- **Cherry-pick**: 11 + +### Review Buckets + +- **Potentially breaking changes**: 157 +- **Dependency/build changes**: 136 +- **Other**: 44 +- **Tenant management changes**: 20 +- **Intune changes**: 9 +- **UI improvements**: 7 +- **Security fixes**: 6 +- **Exchange/Email changes**: 6 +- **Authentication/permissions changes**: 6 +- **Tests-only**: 4 +- **Bug fixes**: 2 +- **API endpoint changes**: 1 + +--- + +## Commit Inventory + +### 1. `7dffc4c6` — feat: add fuzzy match distance setting to Intune template based on Levenshtein distance + +| Field | Value | +|-------|-------| +| SHA | `7dffc4c64a9de48e0d6f3f59abdcc57f1634c019` | +| Author | Bobby | +| Date | 2026-03-20 20:27:59 +0100 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Intune | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Intune changes | + +**Files:** `src/data/standards.json` + +--- + +### 2. `4fc1b57b` — feat: add warningMessage support standards + +| Field | Value | +|-------|-------| +| SHA | `4fc1b57b65a49f832db2ded4e15563a21ac1ebfa` | +| Author | Bobby | +| Date | 2026-03-20 20:41:42 +0100 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippStandards/CippStandardAccordion.jsx`, `src/data/standards.json` + +--- + +### 3. `88bc10a5` — Added UI Elements for adding conditional access policies to package tags + +| Field | Value | +|-------|-------| +| SHA | `88bc10a527efe58a986bf96c551c07c74c3f6ab5` | +| Author | James Tarran | +| Date | 2026-04-02 19:03:48 +0100 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/data/standards.json`, `src/pages/tenant/conditional/list-template/index.js` + +--- + +### 4. `5ffd20e1` — Merge remote-tracking branch 'upstream/dev' into Feat-Conditional-accesss-policy-package-tags + +| Field | Value | +|-------|-------| +| SHA | `5ffd20e13c0d00dee4af844cff6affc6883c298e` | +| Author | James Tarran | +| Date | 2026-04-03 07:50:17 +0100 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** (none) + +--- + +### 5. `db57e52a` — Mark TemplateList as optional and non-creatable + +| Field | Value | +|-------|-------| +| SHA | `db57e52a207f3e9d77974832978d88963859bf83` | +| Author | James Tarran | +| Date | 2026-04-03 08:14:19 +0100 | +| Files changed | 1 | +| Risk | **Low** | +| Area | UI | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: UI improvements | + +**Files:** `src/data/standards.json` + +--- + +### 6. `83d657b8` — Lookup CA template names via API + +| Field | Value | +|-------|-------| +| SHA | `83d657b8390afb7853ddcf68e822efc7a92b1b28` | +| Author | James Tarran | +| Date | 2026-04-03 14:07:06 +0100 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/tenant/manage/drift.js`, `src/pages/tenant/manage/policies-deployed.js` + +--- + +### 7. `b6438ee3` — Merge branch 'dev' into Feat-Conditional-accesss-policy-package-tags + +| Field | Value | +|-------|-------| +| SHA | `b6438ee3c9874f2769542e4a9829fe88a87c799b` | +| Author | KelvinTegelaar | +| Date | 2026-04-04 02:14:49 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** (none) + +--- + +### 8. `05b93261` — chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 + +| Field | Value | +|-------|-------| +| SHA | `05b93261635e0c6c2859581c4be1ce058806b066` | +| Author | dependabot[bot] | +| Date | 2026-04-22 23:44:43 +0000 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `.github/workflows/Node_Project_Check.yml`, `.github/workflows/cipp_dev_build.yml`, `.github/workflows/cipp_frontend_build.yml` + +--- + +### 9. `9ae908d7` — chore(deps): bump recharts from 3.8.0 to 3.8.1 + +| Field | Value | +|-------|-------| +| SHA | `9ae908d73382e1f4da5ea85c968d9b1eb2a7455c` | +| Author | dependabot[bot] | +| Date | 2026-04-22 23:44:47 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 10. `93cfed20` — chore(deps): bump @tanstack/react-query-devtools from 5.91.3 to 5.96.2 + +| Field | Value | +|-------|-------| +| SHA | `93cfed20dca053f6077b1dd6783292847f503f17` | +| Author | dependabot[bot] | +| Date | 2026-04-22 23:45:03 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 11. `c22177f7` — chore(deps): bump mui-tiptap from 1.29.1 to 1.30.0 + +| Field | Value | +|-------|-------| +| SHA | `c22177f70624b2780c8079c60977f6aed7035c85` | +| Author | dependabot[bot] | +| Date | 2026-04-22 23:45:24 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 12. `c3c90afe` — chore(deps): bump @uiw/react-json-view + +| Field | Value | +|-------|-------| +| SHA | `c3c90afeda02f0dd9d20e7583aef1d7f51cdb284` | +| Author | dependabot[bot] | +| Date | 2026-04-22 23:55:54 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 13. `a5f2b74b` — feat: add allTenants support for multiple intune pages + +| Field | Value | +|-------|-------| +| SHA | `a5f2b74b69fa0e3847666c57dd19e072578b9466` | +| Author | Bobby | +| Date | 2026-04-25 01:32:34 +0200 | +| Files changed | 8 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/endpoint/MEM/assignment-filters/index.js`, `src/pages/endpoint/MEM/devices/index.js`, `src/pages/endpoint/MEM/list-appprotection-policies/index.js`, `src/pages/endpoint/MEM/list-compliance-policies/index.js`, `src/pages/endpoint/MEM/list-policies/index.js`, `src/pages/endpoint/MEM/list-scripts/index.jsx`, `src/pages/endpoint/MEM/reusable-settings/index.js`, `src/pages/endpoint/applications/list/index.js` + +--- + +### 14. `f86925dc` — Merge branch 'dev' of https://github.com/kris6673/CIPP into alltenants-intune + +| Field | Value | +|-------|-------| +| SHA | `f86925dc5ee5d3c8c875ff81577242cc206cf82c` | +| Author | Bobby | +| Date | 2026-04-25 20:57:51 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 15. `1707506b` — feat: integrate useCippReportDB for data handling + +| Field | Value | +|-------|-------| +| SHA | `1707506b0a39fbf7c0154b9608b9d90a69c19331` | +| Author | Bobby | +| Date | 2026-04-25 21:22:00 +0200 | +| Files changed | 8 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippReportDBControls.jsx`, `src/pages/endpoint/MEM/assignment-filters/index.js`, `src/pages/endpoint/MEM/devices/index.js`, `src/pages/endpoint/MEM/list-appprotection-policies/index.js`, `src/pages/endpoint/MEM/list-compliance-policies/index.js`, `src/pages/endpoint/MEM/list-scripts/index.jsx`, `src/pages/endpoint/MEM/reusable-settings/index.js`, `src/pages/endpoint/applications/list/index.js` + +--- + +### 16. `d7d36a31` — feat: Add allTenants support for all the Teams SharePoint pages + +| Field | Value | +|-------|-------| +| SHA | `d7d36a31eb86f6b6f011d483862024515f63757d` | +| Author | Bobby | +| Date | 2026-04-26 19:13:54 +0200 | +| Files changed | 5 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/teams-share/onedrive/index.js`, `src/pages/teams-share/sharepoint/index.js`, `src/pages/teams-share/teams/business-voice/index.js`, `src/pages/teams-share/teams/list-team/index.js`, `src/pages/teams-share/teams/teams-activity/index.js` + +--- + +### 17. `b05e0923` — feat(standards): add by-standard alignment summary view + +| Field | Value | +|-------|-------| +| SHA | `b05e0923d8afc286f7ca5591056bf847c8dbd755` | +| Author | Bobby | +| Date | 2026-05-08 22:36:34 +0200 | +| Files changed | 6 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippTranslations.jsx`, `src/components/CippTable/CippDataTable.js`, `src/components/CippTable/CippDataTableButton.jsx`, `src/pages/tenant/standards/alignment/index.js`, `src/utils/get-cipp-column-size.js`, `src/utils/get-cipp-formatting.js` + +--- + +### 18. `45f1d72b` — purview adding + +| Field | Value | +|-------|-------| +| SHA | `45f1d72bf7e1376fbc2e4f58ecc39d9a4c3e363b` | +| Author | KelvinTegelaar | +| Date | 2026-05-10 01:25:58 +0200 | +| Files changed | 11 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippDeployCompliancePolicyDrawer.jsx`, `src/data/standards.json`, `src/layouts/config.js`, `src/pages/security/compliance/dlp-templates/index.js`, `src/pages/security/compliance/dlp/index.js`, `src/pages/security/compliance/labels-templates/index.js`, `src/pages/security/compliance/labels/index.js`, `src/pages/security/compliance/retention-templates/index.js`, `src/pages/security/compliance/retention/index.js`, `src/pages/security/compliance/sit-templates/index.js`, `src/pages/security/compliance/sit/index.js` + +--- + +### 19. `b8abed94` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `b8abed94810020cd90175d56ea268215d990a37f` | +| Author | KelvinTegelaar | +| Date | 2026-05-10 01:26:05 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 20. `e3ed1818` — fix alert mode + +| Field | Value | +|-------|-------| +| SHA | `e3ed181822d69e25889251113ae8b3732b2d492d` | +| Author | KelvinTegelaar | +| Date | 2026-05-10 14:51:51 +0200 | +| Files changed | 2 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** `src/data/standards.json`, `src/pages/security/compliance/retention/index.js` + +--- + +### 21. `98d5d94a` — Custom Test - Alert on X statuses + +| Field | Value | +|-------|-------| +| SHA | `98d5d94a0d122d5fbc7380d5abe5cb02fba366fd` | +| Author | Zacgoose | +| Date | 2026-05-11 21:49:35 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `src/pages/tools/custom-tests/add.jsx` + +--- + +### 22. `4b9efd82` — Update index.js + +| Field | Value | +|-------|-------| +| SHA | `4b9efd827d27a3498eca51b444934a99e78c634f` | +| Author | Zacgoose | +| Date | 2026-05-11 23:14:49 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/tenant/reports/list-licenses/index.js` + +--- + +### 23. `cfe8c705` — adds #5939 + +| Field | Value | +|-------|-------| +| SHA | `cfe8c705025c918e34646f68bba815af2a0d04b2` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 19:51:43 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/tenant/reports/list-licenses/index.js` + +--- + +### 24. `0d42f679` — #5939 + +| Field | Value | +|-------|-------| +| SHA | `0d42f6798b69367401c33f692b541faa8f483651` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 19:51:47 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/tenant/reports/list-licenses/index.js` + +--- + +### 25. `64e40807` — implemenets #5948 + +| Field | Value | +|-------|-------| +| SHA | `64e408072e2cea57f098f49acbd84dd3d96187b2` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 19:58:59 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippApplicationDeployDrawer.jsx` + +--- + +### 26. `445820dd` — Better intune policy support for alltenants list + +| Field | Value | +|-------|-------| +| SHA | `445820dddc1438aa87d4b57d523784a9a5f2fb04` | +| Author | Zacgoose | +| Date | 2026-05-12 02:01:46 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippIntunePolicyDetails.jsx`, `src/components/CippFormPages/CippJSONView.jsx` + +--- + +### 27. `8b79d999` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `8b79d999788597e35b9e3440db71a98a304aaeaa` | +| Author | Zacgoose | +| Date | 2026-05-12 02:01:48 +0800 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 28. `55dd9cc2` — HVE user page + +| Field | Value | +|-------|-------| +| SHA | `55dd9cc22fab7e05f07214f55acc92743faf8829` | +| Author | Zacgoose | +| Date | 2026-05-12 02:04:38 +0800 | +| Files changed | 6 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippHVEUserDrawer.jsx`, `src/components/CippComponents/CippNotificationForm.jsx`, `src/data/CIPPDBCacheTypes.json`, `src/layouts/config.js`, `src/pages/email/administration/hve-accounts/index.js`, `src/pages/email/administration/mailboxes/index.js` + +--- + +### 29. `9cee69d4` — eclusions everywhere + +| Field | Value | +|-------|-------| +| SHA | `9cee69d460f246f83583316091ba86170f73f172` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 20:13:45 +0200 | +| Files changed | 6 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippAppTemplateDrawer.jsx`, `src/components/CippComponents/CippApplicationDeployDrawer.jsx`, `src/components/CippComponents/CippIntunePolicyActions.jsx`, `src/components/CippComponents/CippPolicyDeployDrawer.jsx`, `src/components/CippWizard/CippIntunePolicy.jsx`, `src/pages/endpoint/applications/templates/index.js` + +--- + +### 30. `14461b4f` — eclusions everywhere + +| Field | Value | +|-------|-------| +| SHA | `14461b4f68c5f6e3214512a575d585439d9cbbd7` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 20:13:49 +0200 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippIntunePolicyActions.jsx`, `src/components/CippWizard/CippIntunePolicy.jsx`, `src/pages/endpoint/applications/templates/index.js` + +--- + +### 31. `1b77b784` — Update manifest for PWA chrome install option + +| Field | Value | +|-------|-------| +| SHA | `1b77b7843ee3c86e746019d8ce0ecd2ded3ed6cf` | +| Author | Zacgoose | +| Date | 2026-05-12 02:28:27 +0800 | +| Files changed | 4 | +| Risk | **Medium** | +| Area | UI | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: UI improvements | + +**Files:** `public/manifest.json`, `public/sw.js`, `src/pages/_app.js`, `src/pages/_document.js` + +--- + +### 32. `08c793d7` — Update manifest.json + +| Field | Value | +|-------|-------| +| SHA | `08c793d77ab6449bd8ec7bbdebd9535d892d00f6` | +| Author | Zacgoose | +| Date | 2026-05-12 02:28:43 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `public/manifest.json` + +--- + +### 33. `da6dc7fa` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `da6dc7fad7915d6e82a1fd631047dd5047b22487` | +| Author | Zacgoose | +| Date | 2026-05-12 02:29:13 +0800 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 34. `20e2f554` — implements #5986 + +| Field | Value | +|-------|-------| +| SHA | `20e2f554df668843e44dc2e88671bb605aab7067` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 20:43:01 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippTenantAllowBlockListTemplateDrawer.jsx`, `src/pages/email/administration/tenant-allow-block-list-templates/index.js` + +--- + +### 35. `bc412396` — implements #5986 + +| Field | Value | +|-------|-------| +| SHA | `bc412396b99046eb487a838aaf213007f1db568e` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 20:43:06 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippTenantAllowBlockListTemplateDrawer.jsx`, `src/pages/email/administration/tenant-allow-block-list-templates/index.js` + +--- + +### 36. `8e99c018` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `8e99c01866d9f7f6bc78c6517e80db73ab1b0ca8` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 20:43:08 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 37. `2e9b9fd5` — fixed weird button + +| Field | Value | +|-------|-------| +| SHA | `2e9b9fd508f2e9ae6fddffa9f03db7c8edb22881` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 20:47:36 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippTenantAllowBlockListTemplateDrawer.jsx` + +--- + +### 38. `2a1b9128` — Merge pull request #5984 from kris6673/by-standards-view + +| Field | Value | +|-------|-------| +| SHA | `2a1b9128bb8177ca79e75d6faa078e6fcd84c7a5` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 20:49:29 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 39. `35711f89` — Merge branch 'dev' of https://github.com/kris6673/CIPP into allTenants-SP + +| Field | Value | +|-------|-------| +| SHA | `35711f89238acdd76b53fae5c9830346b5fa99db` | +| Author | Bobby | +| Date | 2026-05-11 20:59:51 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 40. `5ca3e9ad` — Merge branch 'dev' into alltenants-intune + +| Field | Value | +|-------|-------| +| SHA | `5ca3e9ad310e88e92ec7e6b44e54bab52f0ae57c` | +| Author | Bobby | +| Date | 2026-05-11 21:06:50 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** (none) + +--- + +### 41. `be88cc9c` — Merge branch 'dev' into levenshtein-distance + +| Field | Value | +|-------|-------| +| SHA | `be88cc9c54dd47a989fd3c3af7b4b8ff2fec537e` | +| Author | Kristian Kjærgård | +| Date | 2026-05-11 21:07:15 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 42. `dd0ba6f1` — Merge pull request #5920 from kris6673/alltenants-intune + +| Field | Value | +|-------|-------| +| SHA | `dd0ba6f1b07b33eb18dae67131341d2df35f6b30` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:13:11 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** (none) + +--- + +### 43. `2f849474` — Merge branch 'dev' into levenshtein-distance + +| Field | Value | +|-------|-------| +| SHA | `2f849474358af80c5da1a67048800baaf3d4bf4f` | +| Author | Kristian Kjærgård | +| Date | 2026-05-11 21:20:47 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 44. `fd23c0df` — Merge branch 'dev' into allTenants-SP + +| Field | Value | +|-------|-------| +| SHA | `fd23c0df0fd3c63fc7d5f1fc006bb60c8b8b788d` | +| Author | Kristian Kjærgård | +| Date | 2026-05-11 21:21:18 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** (none) + +--- + +### 45. `fe722173` — Merge pull request #5794 from TecharyJames/Feat-Conditional-accesss-policy-package-tags + +| Field | Value | +|-------|-------| +| SHA | `fe722173a80cb3ab719f90cfe1a49899e710c41c` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:29:08 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** (none) + +--- + +### 46. `ccf4e9cf` — Merge pull request #5685 from kris6673/levenshtein-distance + +| Field | Value | +|-------|-------| +| SHA | `ccf4e9cf01a4158c5cb6cad3264e84b855a3e194` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:33:48 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 47. `0fc7b3c6` — Merge pull request #5921 from kris6673/allTenants-SP + +| Field | Value | +|-------|-------| +| SHA | `0fc7b3c6123916874377ffad15fa6a7b3464a094` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:37:32 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** (none) + +--- + +### 48. `4b0800b8` — Merge pull request #5903 from KelvinTegelaar/dependabot/github_actions/dev/actions/setup-node-6.4.0 + +| Field | Value | +|-------|-------| +| SHA | `4b0800b8371802b36fadf269fe0ab99afa4dbdc0` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:55:32 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 49. `7bcd507c` — Merge pull request #5906 from KelvinTegelaar/dependabot/npm_and_yarn/dev/mui-tiptap-1.30.0 + +| Field | Value | +|-------|-------| +| SHA | `7bcd507c81e29aab1b8d2b9d0ef93c8e91a5c7cf` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:56:26 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 50. `cef87445` — Merge pull request #5905 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tanstack/react-query-devtools-5.96.2 + +| Field | Value | +|-------|-------| +| SHA | `cef87445b19b8a64c6289f67073dc77fb7d13abc` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:56:35 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 51. `06e16457` — Merge pull request #5904 from KelvinTegelaar/dependabot/npm_and_yarn/dev/recharts-3.8.1 + +| Field | Value | +|-------|-------| +| SHA | `06e16457eb9b9c872f746706eb591acc4834c2fe` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:56:54 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 52. `7dcb867b` — Merge pull request #5908 from KelvinTegelaar/dependabot/npm_and_yarn/dev/uiw/react-json-view-2.0.0-alpha.42 + +| Field | Value | +|-------|-------| +| SHA | `7dcb867bb354653fcfaa9218e81f1bcb96a83ef9` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:57:59 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 53. `a4915dff` — chore(deps): bump @tanstack/react-query-persist-client + +| Field | Value | +|-------|-------| +| SHA | `a4915dff719e75be54e3b786b27028b54aadc26d` | +| Author | dependabot[bot] | +| Date | 2026-05-11 20:01:47 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 54. `fe4bd7f9` — fix: allow alltenants sync on onedrive/sharepoint + +| Field | Value | +|-------|-------| +| SHA | `fe4bd7f9cdf6ff5188c8df9078d9b9a8d38ea979` | +| Author | John Duprey | +| Date | 2026-05-11 17:41:08 -0400 | +| Files changed | 2 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/teams-share/onedrive/index.js`, `src/pages/teams-share/sharepoint/index.js` + +--- + +### 55. `d7e8b0b5` — fix: tweak toggle button size + +| Field | Value | +|-------|-------| +| SHA | `d7e8b0b569c3f9243ff7e09a326ed74ccbd3a046` | +| Author | John Duprey | +| Date | 2026-05-11 19:03:48 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/tenant/standards/alignment/index.js` + +--- + +### 56. `15939e2b` — feat: improve run standard now UX provide single action with autocomplete to select all tenants in template or individual tenant (expanded from alltenants/groups) + +| Field | Value | +|-------|-------| +| SHA | `15939e2b9a9a9d229b3f0e33b0fbde1467222016` | +| Author | John Duprey | +| Date | 2026-05-11 22:48:47 -0400 | +| Files changed | 7 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippFormTemplateTenantSelector.jsx`, `src/pages/tenant/manage/applied-standards.js`, `src/pages/tenant/manage/drift.js`, `src/pages/tenant/manage/driftManagementActions.js`, `src/pages/tenant/manage/policies-deployed.js`, `src/pages/tenant/standards/templates/index.js`, `src/pages/tenant/standards/templates/template.jsx` + +--- + +### 57. `1cb6a11c` — fix: enhance standard name retrieval logic for better matching + +| Field | Value | +|-------|-------| +| SHA | `1cb6a11cf22c446b952976f5200f5a3f3df689f5` | +| Author | John Duprey | +| Date | 2026-05-11 22:54:17 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/tenant/standards/alignment/index.js` + +--- + +### 58. `6cd8c632` — chore: linting + +| Field | Value | +|-------|-------| +| SHA | `6cd8c632cc9273a5fd95b82dba4a99f81b442b59` | +| Author | John Duprey | +| Date | 2026-05-11 23:07:54 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/tenant/standards/alignment/index.js` + +--- + +### 59. `4f2d4993` — feat: enhance intune template details display + +| Field | Value | +|-------|-------| +| SHA | `4f2d4993fb2efb983bea8a38de5d527e5d87c369` | +| Author | John Duprey | +| Date | 2026-05-11 23:57:17 -0400 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippTranslations.jsx`, `src/pages/endpoint/MEM/list-templates/index.js`, `src/utils/get-cipp-formatting.js` + +--- + +### 60. `0a70010e` — fix: update translation keys and adjust template usage references + +| Field | Value | +|-------|-------| +| SHA | `0a70010e2185488a67f91f8e508f67f14f0708df` | +| Author | John Duprey | +| Date | 2026-05-12 00:07:31 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippTranslations.jsx`, `src/pages/endpoint/MEM/list-templates/index.js` + +--- + +### 61. `63c85df0` — OneDrive Sharing disable + +| Field | Value | +|-------|-------| +| SHA | `63c85df03c93f0172b357ccd3be0536f075210da` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 16:03:50 +0200 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippCards/CippRemediationCard.jsx`, `src/components/CippComponents/CippOffboardingDefaultSettings.jsx`, `src/components/CippComponents/CippUserActions.jsx`, `src/components/CippWizard/CippWizardOffboarding.jsx` + +--- + +### 62. `6c55bc42` — OneDrive Sharing disable + +| Field | Value | +|-------|-------| +| SHA | `6c55bc422c0e8d89c66dbd4de14b595babfd188f` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 16:03:54 +0200 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippCards/CippRemediationCard.jsx`, `src/components/CippComponents/CippOffboardingDefaultSettings.jsx`, `src/components/CippComponents/CippUserActions.jsx`, `src/components/CippWizard/CippWizardOffboarding.jsx` + +--- + +### 63. `7054bfc4` — Add AlertUserReportPhising + +| Field | Value | +|-------|-------| +| SHA | `7054bfc42d67a7f3d86b23b036057ba98559d488` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 16:32:20 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/alerts.json` + +--- + +### 64. `d00ebb77` — chore: bump version to 10.4.5 + +| Field | Value | +|-------|-------| +| SHA | `d00ebb77ca928c0fe06f5f728a78a459b76dd911` | +| Author | John Duprey | +| Date | 2026-05-12 11:32:16 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `public/version.json` + +--- + +### 65. `335e40ad` — Merge pull request #5907 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tanstack/react-query-persist-client-5.96.2 + +| Field | Value | +|-------|-------| +| SHA | `335e40ad0dbdf05dd9453eef6df89901932a2782` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 20:25:37 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 66. `19c48eab` — auth options + +| Field | Value | +|-------|-------| +| SHA | `19c48eabf7ff5779f683b6edf33ca24d9c76dae0` | +| Author | Zacgoose | +| Date | 2026-05-13 04:19:28 +0800 | +| Files changed | 12 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/ForcedSsoMigrationDialog.jsx`, `src/components/CippComponents/SsoMigrationDialog.jsx`, `src/components/CippIntegrations/CippApiClientManagement.jsx`, `src/components/CippSettings/CippContainerManagement.jsx`, `src/components/CippSettings/CippSSOSettings.jsx`, `src/components/CippSettings/CippUserManagement.jsx`, `src/layouts/TabbedLayout.jsx`, `src/layouts/index.js`, `src/pages/cipp/advanced/super-admin/cipp-users.js`, `src/pages/cipp/advanced/super-admin/container.js`, `src/pages/cipp/advanced/super-admin/sso.js`, `src/pages/cipp/advanced/super-admin/tabOptions.json` + +--- + +### 67. `36071e54` — Module updates and import changes + +| Field | Value | +|-------|-------| +| SHA | `36071e5403afe1bf5bc8426e49db987ce23a0bb8` | +| Author | Zacgoose | +| Date | 2026-05-13 14:20:34 +0800 | +| Files changed | 13 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `next.config.js`, `package.json`, `src/components/CippCards/CippStandardsDialog.jsx`, `src/components/CippComponents/CippAppPermissionBuilder.jsx`, `src/components/CippSettings/CippContainerManagement.jsx`, `src/components/CippStandards/CippStandardAccordion.jsx`, `src/components/CippStandards/CippStandardsSideBar.jsx`, `src/components/CippTable/CippDataTable.js`, `src/pages/cipp/advanced/super-admin/container.js`, `src/pages/cipp/settings/features.js`, `src/pages/tenant/standards/bpa-report/view.js`, `src/pages/tenant/standards/templates/template.jsx`, `yarn.lock` + +--- + +### 68. `c0946109` — Fix bulk mailbox rule changes + +| Field | Value | +|-------|-------| +| SHA | `c0946109c91b31ee9699ba7dbf377a8f299b1a55` | +| Author | Zacgoose | +| Date | 2026-05-13 16:47:42 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Email | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Exchange/Email changes, Potentially breaking changes | + +**Files:** `src/pages/identity/administration/users/user/exchange.jsx` + +--- + +### 69. `72d8658d` — Add Apps and SP to universal search + +| Field | Value | +|-------|-------| +| SHA | `72d8658d5ded1c0f47fddeacb3a384c5cbf0e38d` | +| Author | Zacgoose | +| Date | 2026-05-13 17:06:41 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippCards/CippUniversalSearchV2.jsx`, `src/components/bulk-actions-menu.js` + +--- + +### 70. `ba196dde` — expand side nav slightly for ux + +| Field | Value | +|-------|-------| +| SHA | `ba196dde059e16c53ee182a7d49eff8292073e27` | +| Author | KelvinTegelaar | +| Date | 2026-05-13 12:07:00 +0200 | +| Files changed | 2 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `.claude/worktrees/blissful-golick-d405ab`, `src/layouts/side-nav.js` + +--- + +### 71. `8551ef5f` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `8551ef5fd6d78da756930a5c41d783512063ec13` | +| Author | KelvinTegelaar | +| Date | 2026-05-13 12:07:14 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 72. `52a47639` — Nice CA policy editor and template creator/editor + +| Field | Value | +|-------|-------| +| SHA | `52a4763907144faafc70dfeb439c705679e24dc0` | +| Author | Zacgoose | +| Date | 2026-05-13 18:52:11 +0800 | +| Files changed | 8 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippCAPolicyBuilder.jsx`, `src/components/CippComponents/CippTemplateFieldRenderer.jsx`, `src/data/conditionalAccessSchema.json`, `src/pages/tenant/conditional/list-policies/edit.jsx`, `src/pages/tenant/conditional/list-policies/index.js`, `src/pages/tenant/conditional/list-template/create.jsx`, `src/pages/tenant/conditional/list-template/edit.jsx`, `src/pages/tenant/conditional/list-template/index.js` + +--- + +### 73. `41efc5b7` — Update CippCAPolicyBuilder.jsx + +| Field | Value | +|-------|-------| +| SHA | `41efc5b726d55036beeef036f6d2e2ac7a7e4e80` | +| Author | Zacgoose | +| Date | 2026-05-13 18:54:03 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippCAPolicyBuilder.jsx` + +--- + +### 74. `60a50738` — fixes tenantfilter property + +| Field | Value | +|-------|-------| +| SHA | `60a50738fc68fd8b17ea615343f785828c713209` | +| Author | KelvinTegelaar | +| Date | 2026-05-13 21:08:55 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/email/administration/mailbox-rules/index.js` + +--- + +### 75. `c9584010` — chore(deps): bump dompurify from 3.4.2 to 3.4.3 + +| Field | Value | +|-------|-------| +| SHA | `c958401045bf32a2326446cb24b4550e63b15f75` | +| Author | dependabot[bot] | +| Date | 2026-05-13 23:43:59 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 76. `a783d28a` — chore(deps): bump @tiptap/extension-table from 3.20.4 to 3.20.5 + +| Field | Value | +|-------|-------| +| SHA | `a783d28ab623dc69767ffd758e5cd140f171f2d5` | +| Author | dependabot[bot] | +| Date | 2026-05-13 23:44:16 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 77. `2285d39c` — chore(deps): bump @tiptap/core from 3.20.5 to 3.22.3 + +| Field | Value | +|-------|-------| +| SHA | `2285d39cfdfdbbdffe377fbcc357200763f27e84` | +| Author | dependabot[bot] | +| Date | 2026-05-13 23:44:34 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 78. `d392d1cf` — chore(deps): bump @tanstack/react-query from 5.96.2 to 5.100.10 + +| Field | Value | +|-------|-------| +| SHA | `d392d1cfebf3dd1fc82e50e0cc0fda449814d693` | +| Author | dependabot[bot] | +| Date | 2026-05-13 23:45:13 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 79. `fd6a9e36` — Logs + +| Field | Value | +|-------|-------| +| SHA | `fd6a9e36007839cbb51f850ac75b5585726724a0` | +| Author | Zacgoose | +| Date | 2026-05-14 15:38:27 +1000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/layouts/config.js`, `src/pages/cipp/advanced/container-logs.js` + +--- + +### 80. `b5d48bcd` — logging + +| Field | Value | +|-------|-------| +| SHA | `b5d48bcddaed40af6839e15ba7a9907c4b22ad33` | +| Author | Zacgoose | +| Date | 2026-05-14 18:09:04 +1000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/data/ContainerLogPresets.json`, `src/pages/cipp/advanced/container-logs.js` + +--- + +### 81. `12a07270` — comingsoon + +| Field | Value | +|-------|-------| +| SHA | `12a07270752ea03f3c94eb33f419fdd7336f5985` | +| Author | KelvinTegelaar | +| Date | 2026-05-14 14:34:30 +0200 | +| Files changed | 5 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `public/assets/integrations/autotask.png`, `public/assets/integrations/connectwise.png`, `public/assets/integrations/kaseya.svg`, `src/data/Extensions.json`, `src/pages/cipp/integrations/index.js` + +--- + +### 82. `db20afa2` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `db20afa205ae565262837d9c43c2fb5ccb3b268a` | +| Author | KelvinTegelaar | +| Date | 2026-05-14 14:34:41 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 83. `c9bfe909` — feat(endpoint): add MEM enrollment profiles page (Apple ADE, Android, Autopilot) + +| Field | Value | +|-------|-------| +| SHA | `c9bfe909582d9cc9d308903d7e74b44c6d926087` | +| Author | Bobby | +| Date | 2026-05-14 10:44:12 +0200 | +| Files changed | 8 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippCards/CippUniversalSearchV2.jsx`, `src/components/CippComponents/CippBreadcrumbNav.jsx`, `src/layouts/config.js`, `src/pages/endpoint/MEM/enrollment-profiles/EnrollmentProfileTabs.jsx`, `src/pages/endpoint/MEM/enrollment-profiles/android-enterprise.js`, `src/pages/endpoint/MEM/enrollment-profiles/index.js`, `src/pages/endpoint/MEM/enrollment-profiles/tabOptions.json`, `src/pages/endpoint/MEM/enrollment-profiles/windows-autopilot.js` + +--- + +### 84. `b1902421` — feat: Bit more margin to make tabbed layout of first item less cramped + +| Field | Value | +|-------|-------| +| SHA | `b19024214e96bd207640c5e63dcefb38d408e161` | +| Author | Bobby | +| Date | 2026-05-14 16:51:32 +0200 | +| Files changed | 2 | +| Risk | **Low** | +| Area | UI | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: UI improvements | + +**Files:** `src/layouts/HeaderedTabbedLayout.jsx`, `src/layouts/TabbedLayout.jsx` + +--- + +### 85. `6dab9339` — feat(tabs): support icons in tabbed layouts + +| Field | Value | +|-------|-------| +| SHA | `6dab9339978f195dc8e6db35633071da8f16eb8a` | +| Author | Bobby | +| Date | 2026-05-14 17:50:36 +0200 | +| Files changed | 4 | +| Risk | **Medium** | +| Area | Intune | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Intune changes | + +**Files:** `src/layouts/HeaderedTabbedLayout.jsx`, `src/layouts/TabbedLayout.jsx`, `src/pages/endpoint/MEM/enrollment-profiles/tabOptions.json`, `src/utils/icon-registry.js` + +--- + +### 86. `9b616499` — feat: Migrate to use shared icon registry for string to icon conversion + +| Field | Value | +|-------|-------| +| SHA | `9b6164999145da5dab8cb726cc2b4d6a25cba44b` | +| Author | Bobby | +| Date | 2026-05-14 18:46:23 +0200 | +| Files changed | 8 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippCards/CippPropertyListCard.jsx`, `src/components/CippCards/CippUniversalSearchV2.jsx`, `src/components/CippComponents/CippTenantSelector.jsx`, `src/components/bulk-actions-menu.js`, `src/data/portals.json`, `src/layouts/HeaderedTabbedLayout.jsx`, `src/layouts/TabbedLayout.jsx`, `src/utils/icon-registry.js` + +--- + +### 87. `983b48a1` — fix: Remove accidentally committed .claude/worktrees directory + +| Field | Value | +|-------|-------| +| SHA | `983b48a1b1c35c329c9ad8405635c26e6859b0b9` | +| Author | Clint Thomon | +| Date | 2026-05-14 13:59:43 -0500 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `.claude/worktrees/blissful-golick-d405ab`, `.gitignore` + +--- + +### 88. `0c32a84e` — Add additional portal links to Invoke-HuduExtensionSync + +| Field | Value | +|-------|-------| +| SHA | `0c32a84eb21d3df3a719427b54d10821a94b40a4` | +| Author | jwebster@protectedtrust.com | +| Date | 2026-05-14 16:26:44 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | API | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: API endpoint changes | + +**Files:** `src/data/Extensions.json` + +--- + +### 89. `186a2c6e` — audit log template tweak + +| Field | Value | +|-------|-------| +| SHA | `186a2c6ea22589ca28f655eba01526ceb74ec2d9` | +| Author | Zacgoose | +| Date | 2026-05-15 02:29:31 -0500 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/data/AuditLogTemplates.json`, `src/layouts/config.js`, `src/pages/cipp/advanced/worker-health.js` + +--- + +### 90. `7a85827e` — feat(users): add bulk update contact and UPN fields + +| Field | Value | +|-------|-------| +| SHA | `7a85827ef1072955a48cb1d48c3ce2aafe3ab88d` | +| Author | Bobby | +| Date | 2026-05-15 16:34:51 +0200 | +| Files changed | 1 | +| Risk | **Low** | +| Area | UI | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: UI improvements | + +**Files:** `src/pages/identity/administration/users/patch-wizard.jsx` + +--- + +### 91. `8232e5c1` — feat(standards): add intuneRestrictUserDeviceJoin entry + +| Field | Value | +|-------|-------| +| SHA | `8232e5c11b26c897151d6daaaaa74f8288f52110` | +| Author | Bobby | +| Date | 2026-05-15 20:30:01 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Intune | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Intune changes | + +**Files:** `src/data/standards.json` + +--- + +### 92. `f768330c` — fix(standards): move CIS 5.1.4.1 and SMB1001 (2.8) tags to join standard + +| Field | Value | +|-------|-------| +| SHA | `f768330cd45a2b2e1f6a7cae857b7a5e2ec7d999` | +| Author | Bobby | +| Date | 2026-05-15 20:30:31 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/data/standards.json` + +--- + +### 93. `9d5ce402` — Org auto expanding archive property usage + +| Field | Value | +|-------|-------| +| SHA | `9d5ce40275098a4a442d247fe42541958d08ba88` | +| Author | Zacgoose | +| Date | 2026-05-18 07:27:51 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippCards/CippExchangeInfoCard.jsx` + +--- + +### 94. `6db7e776` — Delete .claude directory + +| Field | Value | +|-------|-------| +| SHA | `6db7e7760fc02807df809897fcda40b48a8b365b` | +| Author | Zacgoose | +| Date | 2026-05-18 14:37:01 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `.claude/worktrees/blissful-golick-d405ab` + +--- + +### 95. `1e7aef11` — Update alerts.json + +| Field | Value | +|-------|-------| +| SHA | `1e7aef11995feb42e9872ec4aefac39fc7ba67c5` | +| Author | Zacgoose | +| Date | 2026-05-19 08:19:29 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/alerts.json` + +--- + +### 96. `fc246a54` — update default value for standard + +| Field | Value | +|-------|-------| +| SHA | `fc246a54ee6c1720f9d442f4cf22568b53add85d` | +| Author | Zacgoose | +| Date | 2026-05-19 10:02:02 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 97. `766a3c52` — feat: add in missing options for Windows Hello standard + +| Field | Value | +|-------|-------| +| SHA | `766a3c52814dcc09d9170c780b4caa5e59d7a343` | +| Author | Bobby | +| Date | 2026-05-20 22:10:11 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 98. `5b5302ca` — feat(standards): add DLP via DCS OWA standard + +| Field | Value | +|-------|-------| +| SHA | `5b5302ca907b971e86c5ed5fd8c1f56491f796c8` | +| Author | Bobby | +| Date | 2026-05-20 23:18:38 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 99. `131927b9` — Stats + +| Field | Value | +|-------|-------| +| SHA | `131927b943aebebd6844ba986fbcf30fb21ac8bc` | +| Author | Zacgoose | +| Date | 2026-05-22 12:51:00 -0400 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/PrivateRoute.js`, `src/layouts/index.js`, `src/pages/cipp/advanced/worker-health.js` + +--- + +### 100. `a6ae2610` — Add Group-Based Licensing support + +| Field | Value | +|-------|-------| +| SHA | `a6ae2610d2bf4977dc4ff0a63979d32f263cf440` | +| Author | Luis Mengel | +| Date | 2026-05-23 15:21:33 +0200 | +| Files changed | 6 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows, Standards/Alignment Custom; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippFormLicenseSelector.jsx`, `src/components/CippFormPages/CippAddGroupForm.jsx`, `src/components/CippFormPages/CippAddGroupTemplateForm.jsx`, `src/components/CippWizard/CippWizardGroupTemplates.jsx`, `src/pages/identity/administration/group-templates/edit.jsx`, `src/pages/identity/administration/groups/edit.jsx` + +--- + +### 101. `c74966b3` — Merge pull request #6018 from kris6673/bulk-edit + +| Field | Value | +|-------|-------| +| SHA | `c74966b3aeb084e181626cc9e7c3b91d05af5350` | +| Author | KelvinTegelaar | +| Date | 2026-05-23 16:39:33 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 102. `5574b477` — Merge pull request #6038 from kris6673/winhello + +| Field | Value | +|-------|-------| +| SHA | `5574b4779a5ca2600070ce3fc37e939d5a54a466` | +| Author | KelvinTegelaar | +| Date | 2026-05-23 16:41:22 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 103. `fad1cacf` — Merge pull request #6019 from kris6673/split-intune-join-registration + +| Field | Value | +|-------|-------| +| SHA | `fad1cacfe9936eef973d5dc6b41447e3220376bd` | +| Author | KelvinTegelaar | +| Date | 2026-05-23 16:42:33 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Intune | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Intune changes | + +**Files:** (none) + +--- + +### 104. `96686d7e` — Merge pull request #6012 from jonwbstr/magicdash-addoptions + +| Field | Value | +|-------|-------| +| SHA | `96686d7e90cc1dbd88ac6b30bebc74888dac4841` | +| Author | KelvinTegelaar | +| Date | 2026-05-23 16:46:30 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 105. `bde8ad3c` — Merge pull request #6010 from Celeratec/fix/remove-claude-worktrees + +| Field | Value | +|-------|-------| +| SHA | `bde8ad3cfea1197e04b2dff8ac0b93e944566f7f` | +| Author | KelvinTegelaar | +| Date | 2026-05-23 16:49:24 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** (none) + +--- + +### 106. `a3279044` — CIPP Hosted Notices + +| Field | Value | +|-------|-------| +| SHA | `a32790443fc1297fab6900acc498df9cff107aa0` | +| Author | Zacgoose | +| Date | 2026-05-24 09:13:35 +1000 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/FailedPaymentDialog.jsx`, `src/components/CippComponents/SubscriptionEndedDialog.jsx`, `src/layouts/index.js` + +--- + +### 107. `04c63849` — implement standards template deployment for intune apps + +| Field | Value | +|-------|-------| +| SHA | `04c63849f689bbd2686fb473cbaef1462a1d1b99` | +| Author | KelvinTegelaar | +| Date | 2026-05-24 22:41:10 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Intune | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Intune changes | + +**Files:** `src/data/standards.json` + +--- + +### 108. `28cafc93` — added third party notice + +| Field | Value | +|-------|-------| +| SHA | `28cafc931d46c705b3481a1e5bd185b39ca8879d` | +| Author | KelvinTegelaar | +| Date | 2026-05-24 23:06:16 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/integrations/index.js` + +--- + +### 109. `30455f27` — third party + +| Field | Value | +|-------|-------| +| SHA | `30455f273d7cfcba5add1012bc260bb789f7c405` | +| Author | KelvinTegelaar | +| Date | 2026-05-24 23:06:35 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/integrations/index.js` + +--- + +### 110. `d4f458a1` — Third party text + +| Field | Value | +|-------|-------| +| SHA | `d4f458a15b67d7c8cdd8b8095d3a638a040a9dd4` | +| Author | KelvinTegelaar | +| Date | 2026-05-24 23:07:33 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/integrations/index.js` + +--- + +### 111. `ee0ab2ab` — add extendedValues + +| Field | Value | +|-------|-------| +| SHA | `ee0ab2abe3341bd2f0270391f36e781f6f4ef8d2` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 00:13:35 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippFormPages/CippAddEditUser.jsx`, `src/pages/tenant/manage/user-defaults.js` + +--- + +### 112. `17bf1f8d` — fixes #5995 + +| Field | Value | +|-------|-------| +| SHA | `17bf1f8dbbd6fe16a63fa268c60dfa8fe8a0c053` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 00:14:08 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Tenant management changes, Potentially breaking changes | + +**Files:** `src/pages/tenant/manage/user-defaults.js` + +--- + +### 113. `8097e6ed` — FIDO2 profile standards + +| Field | Value | +|-------|-------| +| SHA | `8097e6ede3991b61e65b03bd21496dc55c96bc33` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 01:34:03 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 114. `389babe3` — add global var showing + +| Field | Value | +|-------|-------| +| SHA | `389babe3e5641be1363afed31b78eddd1a0e3949` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 01:58:14 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippCustomVariables.jsx` + +--- + +### 115. `3bdb9d5b` — add global var showing + +| Field | Value | +|-------|-------| +| SHA | `3bdb9d5b4de432f5a319d2c0e90b43462d4e82f1` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 01:58:18 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippCustomVariables.jsx` + +--- + +### 116. `c43f6d9a` — Update unauthenticated.js + +| Field | Value | +|-------|-------| +| SHA | `c43f6d9ab5f013d386dcb52237e61754efe3ee0d` | +| Author | Zacgoose | +| Date | 2026-05-25 08:02:23 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** `src/pages/unauthenticated.js` + +--- + +### 117. `f591d479` — logout + +| Field | Value | +|-------|-------| +| SHA | `f591d4790012f7fd747433f6eb65f1e30f7f6dd6` | +| Author | Zacgoose | +| Date | 2026-05-25 11:10:02 +0800 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/SsoMigrationDialog.jsx`, `src/layouts/account-popover.js`, `src/layouts/index.js` + +--- + +### 118. `16b4503f` — login/out testing + +| Field | Value | +|-------|-------| +| SHA | `16b4503f014b4d5b99ff0e49485dcc97544e3cee` | +| Author | Zacgoose | +| Date | 2026-05-25 11:29:56 +0800 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `src/layouts/account-popover.js`, `staticwebapp.config.json` + +--- + +### 119. `c1c5693c` — feat: add admin role member removal functionality + +| Field | Value | +|-------|-------| +| SHA | `c1c5693c09ef99c196b80d17b4b8aeb61f1d9852` | +| Author | Bobby | +| Date | 2026-05-25 11:49:27 +0200 | +| Files changed | 2 | +| Risk | **Medium** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** `src/pages/identity/administration/roles/index.js`, `src/pages/identity/administration/users/user/index.jsx` + +--- + +### 120. `38e72f99` — Add APv2 profile + +| Field | Value | +|-------|-------| +| SHA | `38e72f99f64ab21449ad7588becbd2c35fb80646` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:29:31 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 121. `304e0e5a` — Merge pull request #6052 from kris6673/remove-adminroles + +| Field | Value | +|-------|-------| +| SHA | `304e0e5a21017ffd1a384906891cdee6f2bcb472` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:31:34 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 122. `d8c4988d` — Merge pull request #6039 from kris6673/DlpViaDcsEnabled + +| Field | Value | +|-------|-------| +| SHA | `d8c4988d120bfe295699b783912d1987b5faf84c` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:32:40 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 123. `28ec38c1` — Merge pull request #6009 from kris6673/ade + +| Field | Value | +|-------|-------| +| SHA | `28ec38c1c67606d204e23cf26bec9acc11201292` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:35:36 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 124. `ac1190da` — Merge pull request #6003 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tanstack/react-query-5.100.10 + +| Field | Value | +|-------|-------| +| SHA | `ac1190da4417434b740ce99cee3de5f4ad9edc44` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:37:12 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 125. `2e1e3007` — Merge pull request #6001 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tiptap/core-3.22.3 + +| Field | Value | +|-------|-------| +| SHA | `2e1e30074fdc2db898f4449bcd93d69351e05344` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:37:31 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 126. `4ffb7638` — Merge pull request #6000 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tiptap/extension-table-3.20.5 + +| Field | Value | +|-------|-------| +| SHA | `4ffb7638952ef2ad242a073493fa7fb8c49a448d` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:37:42 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 127. `0001b6c8` — Merge pull request #5999 from KelvinTegelaar/dependabot/npm_and_yarn/dev/dompurify-3.4.3 + +| Field | Value | +|-------|-------| +| SHA | `0001b6c82cb49b7200904f89240c5028da5ef136` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:37:58 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 128. `83994360` — chore(deps): bump react from 19.2.5 to 19.2.6 + +| Field | Value | +|-------|-------| +| SHA | `839943607b846de806fb5f0694dd9dc479fcf7df` | +| Author | dependabot[bot] | +| Date | 2026-05-25 12:40:46 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 129. `8a179d28` — moved autopilot ade etc + +| Field | Value | +|-------|-------| +| SHA | `8a179d2886027c1cd9e17eb7277bbe1c6d08ea2a` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 15:05:27 +0200 | +| Files changed | 4 | +| Risk | **High** | +| Area | Intune | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Intune changes, Potentially breaking changes | + +**Files:** `src/layouts/config.js`, `src/pages/endpoint/MEM/enrollment-profiles/apple-ade.js`, `src/pages/endpoint/MEM/enrollment-profiles/index.js`, `src/pages/endpoint/MEM/enrollment-profiles/tabOptions.json` + +--- + +### 130. `ff9af7e0` — add tutorials to easy deployment of steps for Ashe. + +| Field | Value | +|-------|-------| +| SHA | `ff9af7e0d8de76f1902de17cd9b4cf7614b3c39d` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 18:30:53 +0200 | +| Files changed | 14 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `src/components/CippComponents/CippBreadcrumbNav.jsx`, `src/components/CippComponents/CippSpeedDial.jsx`, `src/components/CippComponents/CippTutorialDialog.jsx`, `src/contexts/tutorial-context.js`, `src/data/tutorials/dashboard-overview.json`, `src/data/tutorials/getting-started.json`, `src/data/tutorials/tenant-management.json`, `src/layouts/side-nav.js`, `src/layouts/top-nav.js`, `src/pages/_app.js`, `src/pages/dashboardv2/index.js`, `src/styles/tutorial-overrides.css`, `yarn.lock` + +--- + +### 131. `eac59c8a` — add tutorials to easy deployment of steps for Ashe. + +| Field | Value | +|-------|-------| +| SHA | `eac59c8ac8d55c4a2a4f81e3016f64747d85d4fc` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 18:31:00 +0200 | +| Files changed | 7 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippBreadcrumbNav.jsx`, `src/components/CippComponents/CippSpeedDial.jsx`, `src/components/CippComponents/CippTutorialDialog.jsx`, `src/contexts/tutorial-context.js`, `src/layouts/top-nav.js`, `src/pages/dashboardv2/index.js`, `src/styles/tutorial-overrides.css` + +--- + +### 132. `6a51abf3` — demo data + +| Field | Value | +|-------|-------| +| SHA | `6a51abf309207078b9429ed62eaa03eceb8280b3` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 20:37:52 +0200 | +| Files changed | 2 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/contexts/tutorial-context.js`, `src/data/dashboardv2-demo-data.js` + +--- + +### 133. `37778e28` — Merge pull request #6002 from KelvinTegelaar/dependabot/npm_and_yarn/dev/react-19.2.6 + +| Field | Value | +|-------|-------| +| SHA | `37778e2872d9b994494603f626c1a4acba3e4c7d` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 21:30:54 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 134. `a2d8f191` — react-dom + +| Field | Value | +|-------|-------| +| SHA | `a2d8f1918f67ed864a57e50e55f8fd3f949774a9` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 21:32:56 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json` + +--- + +### 135. `7d1c2096` — Move EnrollmentProfileTabs from pages to components and update imports + +| Field | Value | +|-------|-------| +| SHA | `7d1c2096f820f505684167d28bf38487534bd5ff` | +| Author | copilot-swe-agent[bot] | +| Date | 2026-05-25 23:09:50 +0000 | +| Files changed | 5 | +| Risk | **Medium** | +| Area | Intune | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Intune changes | + +**Files:** `src/components/EnrollmentProfileTabs.jsx`, `src/pages/endpoint/MEM/enrollment-profiles/android-enterprise.js`, `src/pages/endpoint/MEM/enrollment-profiles/apple-ade.js`, `src/pages/endpoint/MEM/enrollment-profiles/index.js`, `src/pages/endpoint/MEM/enrollment-profiles/windows-autopilot.js` + +--- + +### 136. `02c7a434` — Move EnrollmentProfileTabs to CippComponents folder and update imports + +| Field | Value | +|-------|-------| +| SHA | `02c7a4341ca6d9ceb016ed45d10f0e188bce6a26` | +| Author | copilot-swe-agent[bot] | +| Date | 2026-05-25 23:13:28 +0000 | +| Files changed | 5 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/EnrollmentProfileTabs.jsx`, `src/pages/endpoint/MEM/enrollment-profiles/android-enterprise.js`, `src/pages/endpoint/MEM/enrollment-profiles/apple-ade.js`, `src/pages/endpoint/MEM/enrollment-profiles/index.js`, `src/pages/endpoint/MEM/enrollment-profiles/windows-autopilot.js` + +--- + +### 137. `8145f585` — Merge pull request #6056 from KelvinTegelaar/copilot/move-enrollment-profile-tabs + +| Field | Value | +|-------|-------| +| SHA | `8145f585d73328645f2354a284bf769405a69092` | +| Author | Zacgoose | +| Date | 2026-05-25 19:14:54 -0400 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 138. `1e59d2d4` — Update ListTests.json + +| Field | Value | +|-------|-------| +| SHA | `1e59d2d43fab463a709d1dac2477f45cfacdfae6` | +| Author | Zacgoose | +| Date | 2026-05-26 11:54:57 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Tests/Shapes/ListTests.json` + +--- + +### 139. `1cd1ef72` — Update AuditLogTemplates.json + +| Field | Value | +|-------|-------| +| SHA | `1cd1ef7223672170bdce1fffe88d8bb4ddb903d9` | +| Author | Zacgoose | +| Date | 2026-05-26 12:30:37 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/AuditLogTemplates.json` + +--- + +### 140. `ca150a28` — Better display standards that are missing licenses to be able to work + +| Field | Value | +|-------|-------| +| SHA | `ca150a28cfcb3922d6de42cb4db54f2afcdf6e0e` | +| Author | Zacgoose | +| Date | 2026-05-26 15:08:56 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Tenant management changes, Potentially breaking changes | + +**Files:** `src/pages/tenant/manage/applied-standards.js` + +--- + +### 141. `f3c8a79e` — Update yarn.lock + +| Field | Value | +|-------|-------| +| SHA | `f3c8a79e42e97ad5b0cad9889ce15e4863f6bef8` | +| Author | Zacgoose | +| Date | 2026-05-26 15:09:04 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `yarn.lock` + +--- + +### 142. `d28e8ebf` — user sync + +| Field | Value | +|-------|-------| +| SHA | `d28e8ebfaa9517e5f2134bb1c339d294096dca91` | +| Author | Zacgoose | +| Date | 2026-05-26 23:33:43 +0800 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippSettings/CippRoleAddEdit.jsx`, `src/components/CippSettings/CippUserManagement.jsx`, `src/pages/cipp/advanced/super-admin/cipp-users.js` + +--- + +### 143. `2f62bae9` — Update CippAuditLogSearchDrawer.jsx + +| Field | Value | +|-------|-------| +| SHA | `2f62bae921c333f7a0b72f78ce02aab8b0980d55` | +| Author | Zacgoose | +| Date | 2026-05-27 00:13:18 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippAuditLogSearchDrawer.jsx` + +--- + +### 144. `25f4caed` — feat: add permanent dismissal option for release notes + +| Field | Value | +|-------|-------| +| SHA | `25f4caed93e9c722f359ea7d0f6ea3af75843716` | +| Author | Bobby | +| Date | 2026-05-27 00:37:35 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | UI | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Manage365 Branding/Versioning; Buckets: UI improvements, Potentially breaking changes | + +**Files:** `src/components/ReleaseNotesDialog.js` + +--- + +### 145. `fe4765e8` — Merge pull request #6059 from kris6673/permaDismiss + +| Field | Value | +|-------|-------| +| SHA | `fe4765e892bdd13c890781d8c9311116da355bf5` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 01:09:02 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 146. `1b7797af` — Update standards.json + +| Field | Value | +|-------|-------| +| SHA | `1b7797afd4f4c55e6a44157a87914daf8110068f` | +| Author | Zacgoose | +| Date | 2026-05-27 16:29:15 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 147. `de70889f` — smart lockout standard + +| Field | Value | +|-------|-------| +| SHA | `de70889fe1c4e157ac25eb1ef43751add88056fa` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 14:39:44 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 148. `0e527e50` — Sharepoint management functionality. + +| Field | Value | +|-------|-------| +| SHA | `0e527e50d858628dbe0943c33c0b67b18949d612` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 17:03:29 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Teams | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 149. `5709f856` — fix: update terminology from "Temporary Access Password" to "Temporary Access Pass" + +| Field | Value | +|-------|-------| +| SHA | `5709f85661a047dad29216739acccf6326c9231b` | +| Author | Bobby | +| Date | 2026-05-27 17:11:46 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippUserActions.jsx`, `src/data/standards.json` + +--- + +### 150. `4102a13e` — Merge pull request #6064 from kris6673/TAP-typos + +| Field | Value | +|-------|-------| +| SHA | `4102a13e6b58656cf4e29a9f36d3930df7a92fa1` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 18:56:03 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 151. `bf6056ba` — Add version cleanup + +| Field | Value | +|-------|-------| +| SHA | `bf6056baf362471dba4ecbb599e0b1c85091b8d0` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 20:24:47 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Teams | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/pages/teams-share/sharepoint/index.js` + +--- + +### 152. `0abf5523` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `0abf5523a012a07f73982ed92a41a7b5e063e005` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 20:24:57 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 153. `635548af` — Add version cleanup + +| Field | Value | +|-------|-------| +| SHA | `635548afd1d988518d8c392413828aec7e39eda5` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 20:25:01 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Teams | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/pages/teams-share/sharepoint/index.js` + +--- + +### 154. `7a408542` — fix query keys + +| Field | Value | +|-------|-------| +| SHA | `7a40854272a60617d57a28570406953a9cca913c` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 20:37:02 +0200 | +| Files changed | 4 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** `src/pages/security/compliance/dlp/index.js`, `src/pages/security/compliance/labels/index.js`, `src/pages/security/compliance/retention/index.js`, `src/pages/security/compliance/sit/index.js` + +--- + +### 155. `de035243` — fixes #6065 + +| Field | Value | +|-------|-------| +| SHA | `de035243aa1090ac818cc2d02e651007a90723e1` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 20:59:42 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Tenant management changes, Potentially breaking changes | + +**Files:** `src/pages/tenant/manage/user-defaults.js` + +--- + +### 156. `d0f58cbe` — feat(mailboxes): show mailbox and archive size columns + +| Field | Value | +|-------|-------| +| SHA | `d0f58cbebd48dbdeaddfcf3af0f68d7b4320bec8` | +| Author | Bobby | +| Date | 2026-05-27 22:43:01 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/email/administration/mailboxes/index.js`, `src/utils/get-cipp-formatting.js` + +--- + +### 157. `072416dd` — new autopatch standard + +| Field | Value | +|-------|-------| +| SHA | `072416dd95fb955625d466022ebb4a05847e76e3` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 00:54:29 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 158. `f256c253` — chore(deps): bump react-virtuoso from 4.18.5 to 4.18.7 + +| Field | Value | +|-------|-------| +| SHA | `f256c253bff5710aab52bbcb21d64d2775df27b7` | +| Author | dependabot[bot] | +| Date | 2026-05-28 00:38:36 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 159. `8316c600` — chore(deps): bump @react-pdf/renderer from 4.3.2 to 4.5.1 + +| Field | Value | +|-------|-------| +| SHA | `8316c600205322891849d6b211f01c7237971c62` | +| Author | dependabot[bot] | +| Date | 2026-05-28 00:38:54 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 160. `49192881` — chore(deps): bump axios from 1.15.0 to 1.16.1 + +| Field | Value | +|-------|-------| +| SHA | `49192881a81a4599d990755b85393a767c16acf8` | +| Author | dependabot[bot] | +| Date | 2026-05-28 00:39:08 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 161. `c04cd7c9` — chore(deps): bump @tiptap/extension-heading from 3.20.5 to 3.22.3 + +| Field | Value | +|-------|-------| +| SHA | `c04cd7c9f6d2c487440aa334d6d4f3a8c3773f67` | +| Author | dependabot[bot] | +| Date | 2026-05-28 00:39:27 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 162. `0995677d` — chore(deps): bump react-hook-form from 7.72.0 to 7.76.1 + +| Field | Value | +|-------|-------| +| SHA | `0995677d8e4f32b35699ffe220c3b8726f015356` | +| Author | dependabot[bot] | +| Date | 2026-05-28 00:39:39 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 163. `b8ece5c4` — Update worker-health.js + +| Field | Value | +|-------|-------| +| SHA | `b8ece5c448ee814f5400dacaaee9a3590c911cde` | +| Author | Zacgoose | +| Date | 2026-05-28 13:56:39 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/advanced/worker-health.js` + +--- + +### 164. `ab8de98d` — Update worker-health.js + +| Field | Value | +|-------|-------| +| SHA | `ab8de98d1c4c1ce1c8cd200962f13ebeae1416e6` | +| Author | Zacgoose | +| Date | 2026-05-28 15:21:20 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/advanced/worker-health.js` + +--- + +### 165. `ca43bc9e` — Update worker-health.js + +| Field | Value | +|-------|-------| +| SHA | `ca43bc9e04e0bc662de24be73466f1b9a18044eb` | +| Author | Zacgoose | +| Date | 2026-05-28 20:51:17 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/advanced/worker-health.js` + +--- + +### 166. `7e44aff8` — new auth methods single standard + +| Field | Value | +|-------|-------| +| SHA | `7e44aff88a1ff1fbb29e8d3a9fb9aa5c70c1b504` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 15:21:13 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** `src/data/standards.json` + +--- + +### 167. `8306a660` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `8306a660288391bfd031b6f51bc45e7de8aa6dc9` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 15:21:21 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 168. `04f8575c` — Merge pull request #6070 from kris6673/6061 + +| Field | Value | +|-------|-------| +| SHA | `04f8575caa54883b3256e920aa840e45d29cba1f` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 16:21:22 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 169. `605ecd82` — fix: move ADE pages + +| Field | Value | +|-------|-------| +| SHA | `605ecd8272e8e6c5d6eaba7692fa0d3ddb22c745` | +| Author | Bobby | +| Date | 2026-05-28 21:13:05 +0200 | +| Files changed | 6 | +| Risk | **High** | +| Area | Intune | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Intune changes, Potentially breaking changes | + +**Files:** `src/layouts/config.js`, `src/pages/endpoint/autopilot/enrollment-profiles/android-enterprise.js`, `src/pages/endpoint/autopilot/enrollment-profiles/apple-ade.js`, `src/pages/endpoint/autopilot/enrollment-profiles/index.js`, `src/pages/endpoint/autopilot/enrollment-profiles/tabOptions.json`, `src/pages/endpoint/autopilot/enrollment-profiles/windows-autopilot.js` + +--- + +### 170. `063550f4` — chore: update tab paths and imports + +| Field | Value | +|-------|-------| +| SHA | `063550f430ee43d716ae24a1e7834d10e2aa3014` | +| Author | Bobby | +| Date | 2026-05-28 21:20:53 +0200 | +| Files changed | 5 | +| Risk | **Medium** | +| Area | Intune | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Intune changes | + +**Files:** `src/pages/endpoint/autopilot/enrollment-profiles/android-enterprise.js`, `src/pages/endpoint/autopilot/enrollment-profiles/apple-ade.js`, `src/pages/endpoint/autopilot/enrollment-profiles/index.js`, `src/pages/endpoint/autopilot/enrollment-profiles/tabOptions.json`, `src/pages/endpoint/autopilot/enrollment-profiles/windows-autopilot.js` + +--- + +### 171. `d0405ff4` — feat: Add icons to the tabs and remove dead tab + +| Field | Value | +|-------|-------| +| SHA | `d0405ff45e5ad572438e007734a93f2b5a3b69f0` | +| Author | Bobby | +| Date | 2026-05-28 22:45:31 +0200 | +| Files changed | 22 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/advanced/super-admin/tabOptions.json`, `src/pages/cipp/custom-data/tabOptions.json`, `src/pages/cipp/settings/tabOptions.json`, `src/pages/dashboardv2/tabOptions.json`, `src/pages/email/administration/exchange-retention/tabOptions.json`, `src/pages/endpoint/MEM/devices/device/tabOptions.json`, `src/pages/identity/administration/groups/group/tabOptions.json`, `src/pages/identity/administration/users/user/devices.jsx`, `src/pages/identity/administration/users/user/tabOptions.json`, `src/pages/tenant/administration/alert-configuration/tabOptions.json`, `src/pages/tenant/administration/applications/app-registration/tabOptions.json`, `src/pages/tenant/administration/applications/enterprise-app/tabOptions.json`, `src/pages/tenant/administration/applications/tabOptions.json`, `src/pages/tenant/administration/audit-logs/tabOptions.json`, `src/pages/tenant/administration/securescore/tabOptions.json` … (+7 more) + +--- + +### 172. `707873e3` — fix: Fix tab title showing as undefined + +| Field | Value | +|-------|-------| +| SHA | `707873e31e3b9fae7504dea81643f7bf673a1bef` | +| Author | Bobby | +| Date | 2026-05-28 23:24:30 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/email/administration/exchange-retention/policies/index.js`, `src/pages/email/administration/exchange-retention/tags/index.js` + +--- + +### 173. `97d77727` — Expose missing standards and allow removal + +| Field | Value | +|-------|-------| +| SHA | `97d77727f602177fbb52643ff24697fe4c394717` | +| Author | Zacgoose | +| Date | 2026-05-29 16:31:56 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippStandards/CippStandardAccordion.jsx` + +--- + +### 174. `c0bfd7df` — Update standards.json + +| Field | Value | +|-------|-------| +| SHA | `c0bfd7df29808523b2ab94847fff8b7736681c43` | +| Author | Zacgoose | +| Date | 2026-05-29 17:43:25 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 175. `9e44f394` — Update worker-health.js + +| Field | Value | +|-------|-------| +| SHA | `9e44f394d5d975b69dcc1a096a101ab27720bcf9` | +| Author | Zacgoose | +| Date | 2026-05-30 22:49:02 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/advanced/worker-health.js` + +--- + +### 176. `6737dcb7` — Licence Universal Search + +| Field | Value | +|-------|-------| +| SHA | `6737dcb7df0ad4e21a4edf4979dfc2f30e49510f` | +| Author | Zacgoose | +| Date | 2026-06-02 00:08:49 +0800 | +| Files changed | 6 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippCards/CippUniversalSearchV2.jsx`, `src/components/CippComponents/CippLicenseDetailsDrawer.jsx`, `src/data/M365Licenses.json`, `src/layouts/top-nav.js`, `src/utils/get-cipp-license-catalog.js`, `src/utils/icon-registry.js` + +--- + +### 177. `e2c39b26` — Update M365Licenses.json + +| Field | Value | +|-------|-------| +| SHA | `e2c39b26d95394b3095a28f03e9dccb7a8085afa` | +| Author | Zacgoose | +| Date | 2026-06-02 00:09:49 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/M365Licenses.json` + +--- + +### 178. `3734adee` — Fix template trigger + +| Field | Value | +|-------|-------| +| SHA | `3734adeeaec92e6d83974590c36a9e91bf024a98` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 23:44:55 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Tenant management changes, Potentially breaking changes | + +**Files:** `src/pages/tenant/manage/user-defaults.js` + +--- + +### 179. `ee6f501e` — Merge pull request #6079 from kris6673/move-ADE + +| Field | Value | +|-------|-------| +| SHA | `ee6f501eadb0069a8260f61ba175767584cb353b` | +| Author | KelvinTegelaar | +| Date | 2026-06-02 00:23:58 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 180. `d26084fb` — Merge pull request #6080 from kris6673/icons + +| Field | Value | +|-------|-------| +| SHA | `d26084fb3923e10f615506e3585ae1c7027c4a7d` | +| Author | KelvinTegelaar | +| Date | 2026-06-02 00:24:29 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 181. `49cda6e0` — Update index.js + +| Field | Value | +|-------|-------| +| SHA | `49cda6e0b465ad7bb9a0a259a9ee31a2584e0835` | +| Author | Zacgoose | +| Date | 2026-06-02 07:28:27 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/tenant/reports/list-licenses/index.js` + +--- + +### 182. `f1703f04` — Update CippTenantModeDeploy.jsx + +| Field | Value | +|-------|-------| +| SHA | `f1703f041f517d7d07ca35074a89743f1991141f` | +| Author | Zacgoose | +| Date | 2026-06-02 15:15:54 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippWizard/CippTenantModeDeploy.jsx` + +--- + +### 183. `89abbf50` — fix: improve stale issue and close messages for clarity + +| Field | Value | +|-------|-------| +| SHA | `89abbf507b2f96ea9a9238536bd95fe99a1b3b37` | +| Author | Bobby | +| Date | 2026-06-02 19:03:13 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `.github/workflows/Close_Stale_Issues.yml` + +--- + +### 184. `069d6d6b` — Merge pull request #6101 from kris6673/stale + +| Field | Value | +|-------|-------| +| SHA | `069d6d6bb070af166c583fb59c224e21f16e6263` | +| Author | KelvinTegelaar | +| Date | 2026-06-02 23:40:55 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 185. `d4570de5` — Update CippReportToolbar.jsx + +| Field | Value | +|-------|-------| +| SHA | `d4570de5058eba87c7f9e122a39d41bdedbc401c` | +| Author | Zacgoose | +| Date | 2026-06-03 07:10:49 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippReportToolbar.jsx` + +--- + +### 186. `cbd6faef` — Correct report builder permissions + +| Field | Value | +|-------|-------| +| SHA | `cbd6faefb184a7ee611063726862d2663bb56d4b` | +| Author | Zacgoose | +| Date | 2026-06-03 13:15:25 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/tools/report-builder/builder/index.js`, `src/pages/tools/report-builder/view/index.js` + +--- + +### 187. `4d88e456` — Update CippAutocomplete.jsx + +| Field | Value | +|-------|-------| +| SHA | `4d88e456cf5e581dbbd30cc6e348059e410d7f9c` | +| Author | Zacgoose | +| Date | 2026-06-03 14:49:31 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippAutocomplete.jsx` + +--- + +### 188. `51d2828b` — add mcp allowed + +| Field | Value | +|-------|-------| +| SHA | `51d2828b77990f8a3d017d69206c7b0a3df0f832` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 13:37:01 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippIntegrations/CippApiClientManagement.jsx` + +--- + +### 189. `e4009f28` — feat: add Email as alternate login ID standard + +| Field | Value | +|-------|-------| +| SHA | `e4009f28e0aeb0f338cfeeed606b24fec26b05b7` | +| Author | Bobby | +| Date | 2026-06-03 16:54:12 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Email | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Exchange/Email changes, Potentially breaking changes | + +**Files:** `src/data/standards.json` + +--- + +### 190. `38ac0c4a` — MCP warning + +| Field | Value | +|-------|-------| +| SHA | `38ac0c4a46f6c1e5f405bd429bae7accd43a1917` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 19:25:42 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippFormComponent.jsx`, `src/components/CippIntegrations/CippApiClientManagement.jsx` + +--- + +### 191. `b2f8f803` — feat: add actions for managing mailbox client access protocols + +| Field | Value | +|-------|-------| +| SHA | `b2f8f80372d5c6a28ef57ea373708cd3287f3a8a` | +| Author | Bobby | +| Date | 2026-06-03 19:24:53 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Email | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Exchange/Email changes, Potentially breaking changes | + +**Files:** `src/pages/email/reports/mailbox-cas-settings/index.js` + +--- + +### 192. `692c67d6` — fix: quarantine deny action + +| Field | Value | +|-------|-------| +| SHA | `692c67d6451811f01fdcd7fd021a9b9273efd233` | +| Author | John Duprey | +| Date | 2026-06-03 21:33:18 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Email | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal; Buckets: Exchange/Email changes, Potentially breaking changes | + +**Files:** `src/pages/email/administration/quarantine/index.js` + +--- + +### 193. `a8048476` — Exclude partner tenant + +| Field | Value | +|-------|-------| +| SHA | `a80484765aea42b43c1e663d0a9a9295f3795ad9` | +| Author | Zacgoose | +| Date | 2026-06-04 16:03:41 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippAddEditTenantGroups.jsx`, `src/pages/tenant/administration/tenants/groups/edit.js` + +--- + +### 194. `72623261` — add excludeFromAlert to licenses. + +| Field | Value | +|-------|-------| +| SHA | `726232611922cf2c302a7e77254ba881e074f4d8` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:21:35 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/settings/licenses.js` + +--- + +### 195. `a04ed1a6` — Merge pull request #6049 from luimen6/feat/group-license-management + +| Field | Value | +|-------|-------| +| SHA | `a04ed1a6e283f55ccaedcd6214a65ad51633077f` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:24:44 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | UI | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: UI improvements | + +**Files:** (none) + +--- + +### 196. `cf30b4b1` — add excluded from alerts to licenses + +| Field | Value | +|-------|-------| +| SHA | `cf30b4b19c0feee4b4429777e51b1c06720d51c0` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:25:03 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/settings/licenses.js` + +--- + +### 197. `11ecd334` — remove unneeded results key + +| Field | Value | +|-------|-------| +| SHA | `11ecd3342338bf46f214a62137d6ad4482410ab3` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:25:26 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Standards/Alignment Custom; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippFormLicenseSelector.jsx` + +--- + +### 198. `a9ed024d` — Merge pull request #6110 from kris6673/CAS-stuffs + +| Field | Value | +|-------|-------| +| SHA | `a9ed024df2737538eedb25ba3d727be386727c10` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:36:45 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 199. `02db7307` — Merge pull request #6106 from kris6673/EmailAsAlternateLoginId + +| Field | Value | +|-------|-------| +| SHA | `02db7307dde8a9ed0e01e0d2a7b8badc7b31c0ed` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:37:08 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Email | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Exchange/Email changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 200. `3daf8b33` — Add named location editing to CA template editor + +| Field | Value | +|-------|-------| +| SHA | `3daf8b33cad3a4c9df81c87703758cab2d3150aa` | +| Author | Zacgoose | +| Date | 2026-06-04 20:49:15 +0800 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippCAPolicyBuilder.jsx`, `src/pages/tenant/conditional/list-template/create.jsx`, `src/pages/tenant/conditional/list-template/edit.jsx` + +--- + +### 201. `c0f8e990` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `c0f8e990e3680d80aa121bfbe0ceaff829dcdcec` | +| Author | Zacgoose | +| Date | 2026-06-04 20:49:18 +0800 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 202. `0b4c3314` — Make breadcrumb text and > selectable/copyable + +| Field | Value | +|-------|-------| +| SHA | `0b4c331444ef004e841ac1c1ba66d5974d1aab5e` | +| Author | Zacgoose | +| Date | 2026-06-04 23:28:04 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippBreadcrumbNav.jsx` + +--- + +### 203. `b7c051fa` — Auth changes to use sedndmessage + +| Field | Value | +|-------|-------| +| SHA | `b7c051fa865a06eaf3747be60635740f4837c4ac` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 21:52:25 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Manage365 Branding/Versioning, Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CIPPM365OAuthButton.jsx`, `src/pages/authredirect.js` + +--- + +### 204. `67039061` — Auth changes to use sedndmessage + +| Field | Value | +|-------|-------| +| SHA | `67039061cb901709c0cd35b2baa1fca1026cdc1e` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 21:52:28 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** `src/pages/authredirect.js` + +--- + +### 205. `eb16c27a` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `eb16c27aa32198ea5e6e9287860c7f3f84946969` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 21:52:30 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 206. `5b09ef32` — fix: add popup grace period + +| Field | Value | +|-------|-------| +| SHA | `5b09ef3264fef015af58826d1977c75e1960190f` | +| Author | John Duprey | +| Date | 2026-06-04 16:55:52 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Manage365 Branding/Versioning, Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CIPPM365OAuthButton.jsx` + +--- + +### 207. `ffefbbb3` — Use broadcast channel + +| Field | Value | +|-------|-------| +| SHA | `ffefbbb337754727297ecec9be79e1e7b16a4b32` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 23:24:15 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Manage365 Branding/Versioning, Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CIPPM365OAuthButton.jsx`, `src/pages/authredirect.js` + +--- + +### 208. `4ed6ba02` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `4ed6ba02a3ff4f510313e1b9926f3b5012e11393` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 23:25:34 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 209. `0a8252e3` — fix: version encoding + +| Field | Value | +|-------|-------| +| SHA | `0a8252e3a2a954a734f58637179e7eed91dcb16c` | +| Author | John Duprey | +| Date | 2026-06-04 20:15:21 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Manage365 Branding/Versioning; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippSettings/CippVersionProperties.jsx` + +--- + +### 210. `c8d61c07` — fix: JIT admin, remove creatable on autocomplete + +| Field | Value | +|-------|-------| +| SHA | `c8d61c0757853359cde98f9a00e6e3ba6fe6e98e` | +| Author | John Duprey | +| Date | 2026-06-04 23:13:18 -0400 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** `src/pages/identity/administration/jit-admin/add.jsx` + +--- + +### 211. `98a96fcb` — CA expansion for tags + +| Field | Value | +|-------|-------| +| SHA | `98a96fcbcf72717d266c53eeaca45ab4a074b28a` | +| Author | KelvinTegelaar | +| Date | 2026-06-05 13:17:15 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/tenant/manage/applied-standards.js`, `src/pages/tenant/manage/policies-deployed.js` + +--- + +### 212. `a4aac4a1` — CA expansion for tags + +| Field | Value | +|-------|-------| +| SHA | `a4aac4a128a847a5af059c4edc73f66af7014a60` | +| Author | KelvinTegelaar | +| Date | 2026-06-05 13:17:18 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Tenant management changes, Potentially breaking changes | + +**Files:** `src/pages/tenant/manage/applied-standards.js` + +--- + +### 213. `7b0c8699` — Update SsoMigrationDialog.jsx + +| Field | Value | +|-------|-------| +| SHA | `7b0c86990e1e5765992c31ad0650d1c63fcf7917` | +| Author | Zacgoose | +| Date | 2026-06-05 22:11:18 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/SsoMigrationDialog.jsx` + +--- + +### 214. `8ae6ad1f` — typo + +| Field | Value | +|-------|-------| +| SHA | `8ae6ad1fae73702c180047ba374b491542dc0b4d` | +| Author | Zacgoose | +| Date | 2026-06-05 22:19:13 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/ForcedSsoMigrationDialog.jsx`, `src/components/CippComponents/SsoMigrationDialog.jsx` + +--- + +### 215. `c15d1d0d` — fix: sherweb integration conditional fields + +| Field | Value | +|-------|-------| +| SHA | `c15d1d0df12c5aef9bd1d301a255ef5224c05f7d` | +| Author | John Duprey | +| Date | 2026-06-05 10:41:56 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** `src/data/Extensions.json` + +--- + +### 216. `6c968c4b` — fix: bad math + +| Field | Value | +|-------|-------| +| SHA | `6c968c4bd3eb95439caf2c669e63bc7f1dd2fdd7` | +| Author | John Duprey | +| Date | 2026-06-05 14:36:10 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Tenant management changes, Potentially breaking changes | + +**Files:** `src/pages/tenant/manage/applied-standards.js` + +--- + +### 217. `e90b0ff9` — renumber for cis7 + +| Field | Value | +|-------|-------| +| SHA | `e90b0ff971de99d70d5ee1e10a98c183dc1f97e7` | +| Author | KelvinTegelaar | +| Date | 2026-06-06 00:46:30 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/data/standards.json` + +--- + +### 218. `4c2843c7` — more secure pipeline configuration + +| Field | Value | +|-------|-------| +| SHA | `4c2843c74331a4af685b700ab82f20b4cdbe33b7` | +| Author | Zacgoose | +| Date | 2026-06-07 13:24:08 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `.npmrc`, `.yarnrc` + +--- + +### 219. `55e8eef2` — Update worker-health.js + +| Field | Value | +|-------|-------| +| SHA | `55e8eef2399713f966791554ee214f928cb72f81` | +| Author | Zacgoose | +| Date | 2026-06-07 15:06:59 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/advanced/worker-health.js` + +--- + +### 220. `4c0c058f` — Update alerts.json + +| Field | Value | +|-------|-------| +| SHA | `4c0c058f42dcd7cdb23fb83d64df0884a38493c4` | +| Author | Zacgoose | +| Date | 2026-06-08 13:28:09 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/alerts.json` + +--- + +### 221. `4df01a60` — Update unauthenticated.js + +| Field | Value | +|-------|-------| +| SHA | `4df01a60857ef84b8cf7085ddc1684aabc135767` | +| Author | Zacgoose | +| Date | 2026-06-08 14:16:54 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** `src/pages/unauthenticated.js` + +--- + +### 222. `9c82a214` — 10.5.0 version up + +| Field | Value | +|-------|-------| +| SHA | `9c82a214263d290a46901fb7f4e804b4bfb573b5` | +| Author | KelvinTegelaar | +| Date | 2026-06-08 11:32:48 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `public/version.json` + +--- + +### 223. `03048445` — Merge branch 'main' into dev + +| Field | Value | +|-------|-------| +| SHA | `03048445fc6037f0436363b7cec15ca3baacb7c9` | +| Author | KelvinTegelaar | +| Date | 2026-06-08 12:01:22 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 224. `4521af9d` — Merge pull request #6129 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `4521af9d115e4552f1eafabb94d604bb87415843` | +| Author | KelvinTegelaar | +| Date | 2026-06-08 14:25:04 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 225. `580b66f9` — repair and fix failed SSO app creations and password addition failures + +| Field | Value | +|-------|-------| +| SHA | `580b66f91e2d658e81516e6a7f298fd9688e544c` | +| Author | Zacgoose | +| Date | 2026-06-09 01:03:26 +0800 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/ForcedSsoMigrationDialog.jsx`, `src/components/CippComponents/SsoMigrationDialog.jsx`, `src/components/CippSettings/CippSSOSettings.jsx` + +--- + +### 226. `1ea0324e` — fix: ensure search happens when data is done loading + +| Field | Value | +|-------|-------| +| SHA | `1ea0324e5fe184ba493501e49657910bc21999de` | +| Author | Bobby | +| Date | 2026-06-08 22:56:55 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippTable/CippDataTable.js` + +--- + +### 227. `0de0910a` — Merge pull request #6132 from kris6673/tables-search + +| Field | Value | +|-------|-------| +| SHA | `0de0910aa769c348e33ac520c72d84e3587f48f9` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 00:12:03 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | UI | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: UI improvements | + +**Files:** (none) + +--- + +### 228. `cfbf3508` — Removed dublicate appliesToTest key + +| Field | Value | +|-------|-------| +| SHA | `cfbf3508e1ede8b51ef6daff780356ea0379f083` | +| Author | JNRavnIT | +| Date | 2026-06-09 10:19:54 +0200 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `src/data/standards.json` + +--- + +### 229. `8cfb8ca0` — Merge pull request #6138 from JNRavnIT/patch-1 + +| Field | Value | +|-------|-------| +| SHA | `8cfb8ca077a920d42556858d1aabe692c1d39748` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 10:24:55 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 230. `7ea75e76` — Merge pull request #6072 from KelvinTegelaar/dependabot/npm_and_yarn/dev/react-pdf/renderer-4.5.1 + +| Field | Value | +|-------|-------| +| SHA | `7ea75e76a5f2efa8332d22ecbad4507613992930` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 14:20:20 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 231. `f1475e8e` — Merge pull request #6073 from KelvinTegelaar/dependabot/npm_and_yarn/dev/axios-1.16.1 + +| Field | Value | +|-------|-------| +| SHA | `f1475e8e43f1880a34ffb9e4f6bd80838aa9c0ad` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 14:20:38 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 232. `87d543d4` — Merge pull request #6075 from KelvinTegelaar/dependabot/npm_and_yarn/dev/react-hook-form-7.76.1 + +| Field | Value | +|-------|-------| +| SHA | `87d543d43a3881aac46dd99bf4cfb4b4e5acabe2` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 14:21:07 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 233. `e53ab04d` — Merge pull request #6074 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tiptap/extension-heading-3.22.3 + +| Field | Value | +|-------|-------| +| SHA | `e53ab04dd4d8a93d8fa0983d223c4fb5346207cd` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 14:21:27 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 234. `91bb02b4` — Merge pull request #6071 from KelvinTegelaar/dependabot/npm_and_yarn/dev/react-virtuoso-4.18.7 + +| Field | Value | +|-------|-------| +| SHA | `91bb02b41faf27a0d586b92a0a7b1abc53540934` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 14:21:35 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 235. `ae695a9f` — Update CippAddEditUser.jsx + +| Field | Value | +|-------|-------| +| SHA | `ae695a9f3a1bec6b275b4dbcf4d1cc77abc1a8eb` | +| Author | Zacgoose | +| Date | 2026-06-09 21:48:31 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippFormPages/CippAddEditUser.jsx` + +--- + +### 236. `0e10e08e` — Update index.js + +| Field | Value | +|-------|-------| +| SHA | `0e10e08eb1826be1912569a3dd6e5e979c3da273` | +| Author | Zacgoose | +| Date | 2026-06-09 21:53:36 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Teams | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/pages/teams-share/sharepoint/index.js` + +--- + +### 237. `6a2e7b31` — chore: bump version to 10.5.1 + +| Field | Value | +|-------|-------| +| SHA | `6a2e7b31d1312e0f51f99f2f65b9ae32a5629304` | +| Author | John Duprey | +| Date | 2026-06-09 10:35:24 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `public/version.json` + +--- + +### 238. `f4448a56` — Merge pull request #6140 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `f4448a56afe9cbbe295450db33698864655359eb` | +| Author | John Duprey | +| Date | 2026-06-09 10:42:04 -0400 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 239. `a4c56b26` — manual pagination support for Invoke-ListMailQuarantine + +| Field | Value | +|-------|-------| +| SHA | `a4c56b26accd9374cc739dcc46934624fb5d1089` | +| Author | Zacgoose | +| Date | 2026-06-10 22:49:57 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Email | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal; Buckets: Exchange/Email changes, Potentially breaking changes | + +**Files:** `src/pages/email/administration/quarantine/index.js` + +--- + +### 240. `e0b0bdb8` — chore: bump version to 10.5.2 + +| Field | Value | +|-------|-------| +| SHA | `e0b0bdb85c9161edce9fa50263682b7a42ed1b44` | +| Author | John Duprey | +| Date | 2026-06-10 17:02:44 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `public/version.json` + +--- + +### 241. `0d8ca9d2` — Merge pull request #6153 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `0d8ca9d2f5f8511413b69a3064e055ac45024f33` | +| Author | John Duprey | +| Date | 2026-06-10 17:32:21 -0400 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- diff --git a/docs/upstream-sync/history-cipp/USERACTIONS_NESTEDGROUPS_INTAKE_20260715.md b/docs/upstream-sync/history-cipp/USERACTIONS_NESTEDGROUPS_INTAKE_20260715.md new file mode 100644 index 0000000000..689502c542 --- /dev/null +++ b/docs/upstream-sync/history-cipp/USERACTIONS_NESTEDGROUPS_INTAKE_20260715.md @@ -0,0 +1,65 @@ +# UserActions + Nested Group Memberships Intake — 2026-07-15 + +Feature intake batching two related upstream families that touch the identity-administration +surface. Fork frontend version bumped **5.21.0 → 5.22.0**. + +## Upstream commits taken + +| Commit | Summary | How it landed | +|---|---|---| +| `01cff98d1` | TAP generation: policy-aware form, error when TAP disabled | Merged into fork `CippUserActions.jsx` | +| `af1fe13ff` | Sign-in state: pre-select current, block no-op submit | Merged (radio validator row passthrough + action) | +| `22f153f48` | Source of authority: pre-select current state | Merged into user SOA action | +| `f66e74a07` | SOA refinements: hide when meaningless (users/groups/contacts) | Merged across 4 files | +| `456662835` | Add/remove nested groups in group memberships | Adapted to fork's redesigned edit page | +| `1e60e5f2b` | Missing dependency fix + label | Superseded by adaptation (labels included) | + +## Frontend (CIPP) + +- **`CippFormComponent.jsx`**: radio fields now pass the data `row` as the third argument to + custom `validate` functions (same contract autoComplete fields already had). +- **`CippUserActions.jsx`** (fork-customized hook — surgical merge): + - **Create Temporary Access Pass** now renders a `TemporaryAccessPassForm` child that queries + the tenant's TAP authentication-method policy: shows an error alert (with re-check button + and link to Authentication Methods) when TAP is disabled, validates lifetime against the + policy's min/max, and forces + locks the one-time-use switch when the policy enforces it. + Fork's `canWriteUser` condition, category, and quickAction flags preserved. + - **Set Sign In State** pre-selects the current state (blank when the selection has mixed + states) and rejects submitting an unchanged state. + - **Set Source of Authority** pre-selects the current state, rejects no-op submissions, and + is now hidden for cloud-native users (shown only when on-prem synced now or previously). +- **`groups/index.js`, `groups/group/index.jsx`, `contacts/index.js`**: same SOA + pre-select/no-op-guard treatment. Groups hide the action unless + `onPremisesSyncEnabled`/`onPremisesSamAccountName`; contacts require a `graphId` (cloud-native + mail contacts have no Graph counterpart). +- **`CippApiDialog.jsx`**: fork's "Add Another" button now evaluates function-form + `defaultvalues(row)` on reset (fork-only fix; the main reset paths already did). +- **`CippFormUserAndGroupSelector.jsx`**: adopted upstream wholesale (group-type labels + instead of a Users/Groups groupBy; no fork customizations existed). +- **`groups/edit.jsx`** (fork's redesigned page — adapted, not replaced): upstream changed its + AddMember autocomplete; the fork uses an Add Member dialog + members table instead, so the + equivalent was applied to that design: + - New `memberPickerField` backed by `/api/ListUsersAndGroups` with upstream's group-type + labels — the Add Member dialog can now add **nested groups** as members. The Add Owner + dialog keeps the users-only picker. + - Members table's Email column shows the group type for nested-group rows (no UPN). + - `EditGroup` API already binds members via `directoryObjects/{id}`, which accepts groups — + no API change needed for add/remove. + +## API (CIPP-API) + +- **`Invoke-ListUsersAndGroups.ps1`** (both `CIPPHTTP` and `CIPPCore` copies, kept in sync): + adopted upstream — groups now return `mailEnabled`/`securityEnabled`/`groupTypes`, exclude + Unified (M365) groups, and normalize `userPrincipalName`/`@odata.type` so pickers can + distinguish users from groups. + +## Verification + +- All changed files lint-clean; `yarn build` passes (63s). +- `Invoke-ListUsersAndGroups.ps1` passes PowerShell parser validation; both copies identical. +- Backup tags: `backup/pre-useractions-intake-20260715` in both repos. + +## Notes + +- `ExecCreateTAP`, `ExecDisableUser`, `ExecSetCloudManaged` endpoints already existed in the + fork and needed no changes; the TAP policy query goes through `ListGraphRequest`. diff --git a/docs/upstream-sync/history-cipp/USERREPORTEDPHISHING_FRONTEND_20260617.md b/docs/upstream-sync/history-cipp/USERREPORTEDPHISHING_FRONTEND_20260617.md new file mode 100644 index 0000000000..922e3deee7 --- /dev/null +++ b/docs/upstream-sync/history-cipp/USERREPORTEDPHISHING_FRONTEND_20260617.md @@ -0,0 +1,73 @@ +# UserReportedPhishing — Frontend Enablement + +Generated: 2026-06-17 +Branch: `manage365/userreportedphishing-frontend-20260617` +Backup tag: `backup/pre-userreportedphishing-frontend-20260617` +Base: `main` + +## Prerequisites (completed before this PR) + +| Gate | Status | +|------|--------| +| CIPP-API PR #2 merged | Yes — https://github.com/Celeratec/CIPP-API/pull/2 | +| Backend handler | `Get-CIPPAlertUserReportedPhishing` on CIPP-API `master` | +| SAM manifest | `ThreatSubmission.ReadWrite.All` in Config + lib/data SAM manifests | +| SAM/CPV/consent validation | Completed | +| Backend smoke test | Clean | + +## Upstream Commit + +| Field | Value | +|-------|--------| +| SHA | `7054bfc42` (short: `7054bfc4`) | +| Title | Add AlertUserReportPhising | +| Author | KelvinTegelaar | +| Date | 2026-05-12 | + +## Pre-Apply Verification + +`git show --stat 7054bfc4` — 1 file, 15 insertions: + +- `src/data/alerts.json` only + +No auth, tenant switching, quarantine, Email Troubleshooter, navigation, package/build, or API helper files touched. + +## Apply Result + +| Status | Detail | +|--------|--------| +| **Applied cleanly** | Cherry-pick `-x` succeeded with no conflicts | + +Previously deferred in Cycle 1 sync (`de565d5f9` → reverted `b0fcc3129`); now unblocked after API rollout validation. + +## Files Changed + +| File | Change | +|------|--------| +| `src/data/alerts.json` | Added `UserReportedPhishing` alert definition (+15 lines) | +| `docs/upstream-sync/USERREPORTEDPHISHING_FRONTEND_20260617.md` | This tracking doc | + +## Alert Definition Validation + +| Check | Result | +|-------|--------| +| JSON parses | Pass | +| Alert name/key | `UserReportedPhishing` | +| Backend handler resolution | `Get-CIPPAlertUserReportedPhishing` (via `Push-SchedulerAlert` naming) | +| `HoursBack` input | Present (`inputType: number`, `inputName: HoursBack`) | +| `recommendedRunInterval` | `4h` | +| Typo / handler mismatch | None | +| Other alerts modified | **No** — append-only entry at end of array | + +## Rollout Note + +This PR **exposes** the alert in the frontend catalog only. After merge: + +- Enable `UserReportedPhishing` in **SchedulerConfig / tenant alert settings in a controlled manner** (one test tenant first, then broader rollout). +- Do not bulk-enable globally without operator review. +- Requires `ThreatSubmission.ReadWrite.All` granted on CIPP service principal in each tenant where enabled. + +## Related Docs + +- CIPP-API: `USERREPORTEDPHISHING_API_20260617.md`, `USERREPORTEDPHISHING_POST_MERGE_20260617.md`, `USERREPORTEDPHISHING_ROLLOUT_RUNBOOK_20260617.md` +- Prior deferral: `APPLIED_COMMITS_CIPP_20260617.md` (row for `7054bfc4`) diff --git a/docs/upstream-sync/history-cipp/USERREPORTEDPHISHING_FRONTEND_POST_MERGE_20260617.md b/docs/upstream-sync/history-cipp/USERREPORTEDPHISHING_FRONTEND_POST_MERGE_20260617.md new file mode 100644 index 0000000000..65226427e5 --- /dev/null +++ b/docs/upstream-sync/history-cipp/USERREPORTEDPHISHING_FRONTEND_POST_MERGE_20260617.md @@ -0,0 +1,64 @@ +# UserReportedPhishing — Frontend Post-Merge Status + +Generated: 2026-06-17 +Repo: Celeratec/CIPP +Main tip: `7050757b2` + +## Merge Summary + +| Field | Value | +|-------|--------| +| **PR** | https://github.com/Celeratec/CIPP/pull/9 | +| **Merge commit** | `7050757b2` | +| **Feature commit** | `5b3ef362c` | +| **Title** | Expose user reported phishing alert | +| **Backup tag (retained)** | `backup/pre-userreportedphishing-frontend-20260617` → pre-PR `main` | + +## Files Changed (PR #9) + +| File | Change | +|------|--------| +| `src/data/alerts.json` | Added `UserReportedPhishing` alert definition (+15 lines) | +| `docs/upstream-sync/USERREPORTEDPHISHING_FRONTEND_20260617.md` | Import/enablement tracking doc | + +## Validation Summary + +| Check | Result | +|-------|--------| +| PR scope | 2 files only — `alerts.json` + tracking doc | +| `alerts.json` valid JSON | Pass | +| Alert name | `UserReportedPhishing` (maps to `Get-CIPPAlertUserReportedPhishing`) | +| `HoursBack` input | Present | +| `recommendedRunInterval` | `4h` | +| Other alerts modified | **No** — append-only | +| Upstream commit | `7054bfc4` cherry-picked cleanly | + +## Backend Dependency + +Satisfied by **CIPP-API PR #2** (merged): + +- https://github.com/Celeratec/CIPP-API/pull/2 +- Handler: `Get-CIPPAlertUserReportedPhishing` +- Permission: `ThreatSubmission.ReadWrite.All` (`d72bdbf4-a59b-405c-8b04-5995895819ac`) +- SAM/CPV/consent validated and backend smoke test clean **before** frontend PR #9 merged + +## Deployment Requirement + +Deploy **CIPP `main`** (includes PR #9) alongside **CIPP-API `master`** (includes PR #2). Frontend alert catalog entries have no effect until both are deployed to the target environment. + +## Operational Gate (remaining) + +**First-tenant production enablement not performed yet.** + +Before broader rollout: + +1. Deploy paired CIPP + CIPP-API to target environment (if not already). +2. Enable `UserReportedPhishing` in SchedulerConfig / tenant alert settings for **one test tenant first**. +3. Use **`HoursBack: 24`** for initial run. +4. Validate scheduler invokes `Get-CIPPAlertUserReportedPhishing` and produces expected trace (or clean no-op when no submissions). +5. **Do not bulk-enable globally** until one clean scheduler run is documented. + +## Related Docs + +- Import: `docs/upstream-sync/USERREPORTEDPHISHING_FRONTEND_20260617.md` +- CIPP-API: `USERREPORTEDPHISHING_API_20260617.md`, `USERREPORTEDPHISHING_POST_MERGE_20260617.md`, `USERREPORTEDPHISHING_ROLLOUT_RUNBOOK_20260617.md`, `USERREPORTEDPHISHING_FINAL_STATUS_20260617.md` diff --git a/docs/user-documentation/cipp/advanced/authentication/cipp-roles/add.md b/docs/user-documentation/cipp/advanced/authentication/cipp-roles/add.md index 26025d5e7a..60f37f731e 100644 --- a/docs/user-documentation/cipp/advanced/authentication/cipp-roles/add.md +++ b/docs/user-documentation/cipp/advanced/authentication/cipp-roles/add.md @@ -18,7 +18,7 @@ Select an Entra ID group to assign to this role. This will automatically assign {% step %} ### (Optional) JIT Role Template -Select a [JIT Role Template](../../../../identity/administration/jit-role-templates/README.md) to restrict which Entra ID directory roles members of this role can grant when creating a JIT Admin. Members will also only see existing JIT Admins whose roles fall entirely within the template. Leave blank to apply no restriction from this role. A template on any other role a user holds still applies, because restrictions combine rather than cancel out. +Select a [JIT Role Template](../../../../identity/administration/jit-admin/role-templates/README.md) to restrict which Entra ID directory roles members of this role can grant when creating a JIT Admin. Members will also only see existing JIT Admins whose roles fall entirely within the template. Leave blank to apply no restriction from this role. A template on any other role a user holds still applies, because restrictions combine rather than cancel out. {% endstep %} {% step %} diff --git a/docs/user-documentation/cipp/integrations/cipp-api.md b/docs/user-documentation/cipp/integrations/cipp-api.md index 3d2fbb1681..f473c9873c 100644 --- a/docs/user-documentation/cipp/integrations/cipp-api.md +++ b/docs/user-documentation/cipp/integrations/cipp-api.md @@ -18,7 +18,7 @@ If you're using a **hosted CIPP instance**, you can follow the instructions belo 2. Select the API Client from the list. 3. Ensure that you Enable the client in order to save it to the Function App authentication settings. 4. Optionally set the [#custom-roles](../../../setup/setting-up-cipp/roles.md#custom-roles "mention") and Allowed IP Ranges for additional security. - 5. Select if you want MCP Access Allowed for this client. Enabling MCP Access sets this client up as an MCP connector app (the app your AI signs in as); CIPP automatically creates and manages a separate shared **CIPP-MCP** resource app that the tokens are issued for. You can enable MCP Access on more than one client, each with its own role and IP range. MCP Access is only supported on the latest CIPP infrastructure. See [#enable-the-mcp-feature](cipp-api.md#enable-the-mcp-feature "mention") for more information. + 5. Select if you want MCP Access Allowed for this client. Enabling MCP Access sets this client up as an MCP connector app (the app your AI signs in as); CIPP automatically creates and manages a separate shared **CIPP-MCP** resource app that the tokens are issued for. You can enable MCP Access on more than one client. Connectors that sign a user in run with that user's own Manage365 role; the client's role and IP range only apply when the client calls with its own secret and no user. MCP Access is only supported on Manage365. See [#enable-the-mcp-feature](cipp-api.md#enable-the-mcp-feature "mention") for more information. 6. Submit the form to create the client. Remember to copy the Application secret to a secure location. 3. Once you have the API Client(s) configured, click Actions > Save to Azure, this updates the Function App authentication settings with the new Client IDs. @@ -100,13 +100,13 @@ Open the [cipp-api.md](cipp-api.md "mention") page and **Create New Client** (or | Field | Value | | ---------------------- | ------------------------------------------------------------------------------------------------ | -| **Role** | `Readonly` (recommended), or a custom read role. This becomes what the AI can do. The role must not carry its own IP restriction, for the same reason the client's IP range has to be `Any`. | +| **Role** | `Readonly` (recommended), or a custom read role. Only applies when something calls with this client's own ID and secret and no user signs in (client credentials). Connectors that sign a user in run with that user's own Manage365 role. | | **IP range** | `Any`. The connector calls in from your AI provider's servers, so you can't pin it to your office IPs. | | **Enable this client** | On | | **MCP Access Allowed** | **On** | {% hint style="warning" %} -**Don't put IP restrictions on an MCP-enabled client.** MCP requests arrive from your AI provider's cloud IPs (Anthropic, OpenAI, Microsoft), not your network, so any allowed-IP range, whether on the client's own **IP range** or on the **role** you assign it, blocks the connector with a 403. Leave the IP range as `Any` and use a role that has no IP restriction. CIPP flags this on the API Clients page and in the client dialog if it detects it. +**Watch IP restrictions with MCP.** MCP requests arrive from your AI provider's cloud IPs (Anthropic, OpenAI, Microsoft), not your network, so an allowed-IP range blocks the connector with a 403. For connectors that sign a user in, that's the IP restriction on the **user's** Manage365 role. For client-credentials calls, it's the client's own **IP range** and its **role**. Leave the client's IP range as `Any`, and make sure the roles your MCP users hold have no IP restriction. Manage365 flags restricted MCP clients on the API Clients page and in the client dialog. {% endhint %} {% endstep %} @@ -133,9 +133,9 @@ The instance restarts. Give it up to \~60 seconds before connecting. For AI prov Add CIPP as a custom connector in your AI and give it the MCP URL. That's all you need: no client ID and no secret. The URL is `https:///api/ExecMCP` and can be found on the API page. -Click **Connect**. You'll be redirected to your normal Microsoft / CIPP sign-in, so log in and approve. Your LLM completes the connection and CIPP's read tools appear. +Click **Connect**. You'll be redirected to your normal Microsoft / Manage365 sign-in, so log in and approve. Your LLM completes the connection and CIPP's read tools appear. The connector acts as you: every call runs with your own Manage365 role, so each person who connects needs a Manage365 role that covers the tools they use. -If you have **more than one** MCP client enabled, add `?client=` to the URL (for example `https:///api/ExecMCP?client=`) so the connector signs in as that specific client and gets its role and IP range. With a single MCP client the bare URL is fine. CIPP shows the exact per-client URL on the **MCP** tab of the CIPP-API integration. +If you have **more than one** MCP client enabled, add `?client=` to the URL (for example `https:///api/ExecMCP?client=`) so the connector signs in as that specific client. With a single MCP client the bare URL is fine. CIPP shows the exact per-client URL on the **MCP** tab of the CIPP-API integration. {% hint style="info" %} **Copilot Studio / Microsoft 365 Copilot agents are the exception.** They sign in as a confidential client with a secret, so follow [#copilot-studio-and-microsoft-365-copilot-agents](cipp-api.md#copilot-studio-and-microsoft-365-copilot-agents "mention") instead of this step. If your connection drops or the AI asks for a client ID, see the troubleshooting section below. @@ -158,7 +158,14 @@ If tools show up and return data, you're done. How MCP authentication works (two apps and Conditional Access) -**Two apps.** The API client you flag _MCP Access Allowed_ is the app the AI signs in as (the OAuth client); it carries the redirect URIs, and CIPP resolves each MCP session's role and IP restrictions from it. CIPP also creates and manages a single shared resource app, **CIPP-MCP**, which is the protected resource the token is issued for. Keeping the client and the resource separate is what lets your AI silently refresh its token in the background; if one app were both, Entra rejects the refresh (`AADSTS90009`, "requesting a token for itself") and the connection drops every \~60–90 minutes. It also gives MCP its own resource, separate from the app you use to sign in to the CIPP portal. You can flag more than one client for MCP, each with its own role and IP range. +**Two apps.** The API client you flag _MCP Access Allowed_ is the app the AI signs in as (the OAuth client); it carries the redirect URIs. CIPP also creates and manages a single shared resource app, **CIPP-MCP**, which is the protected resource the token is issued for. Keeping the client and the resource separate is what lets your AI silently refresh its token in the background; if one app were both, Entra rejects the refresh (`AADSTS90009`, "requesting a token for itself") and the connection drops every \~60–90 minutes. It also gives MCP its own resource, separate from the app you use to sign in to the CIPP portal. You can flag more than one client for MCP. + +**Which role applies.** It depends on how the token was obtained, not on which client was used: + +| How the connector signs in | Runs with | +| --- | --- | +| A user signs in (PKCE, as Claude, ChatGPT and VS Code do, or a client secret, as Copilot Studio does) | **That user's own Manage365 role** and its IP restrictions. The client's role is ignored. | +| The client's ID and secret only, no user (client credentials) | **The API client's role** and IP range. | **Conditional Access.** Entra evaluates CA "cloud apps" against the _resource_ a sign-in is for, so scope any MCP Conditional Access to the **CIPP-MCP** resource app. One policy covers every connector, whichever client it uses. Scoping CA to the client app does **not** govern MCP sign-ins. Avoid **device-compliance** or **named-location** controls on CIPP-MCP: MCP tokens come from the AI provider's cloud IPs on an unmanaged device, so those will block the connector (MFA is already satisfied at the interactive sign-in and carried in the refresh). Device-compliance CA on your portal-login app is unaffected, because MCP is a separate resource. @@ -197,6 +204,8 @@ Copilot Studio (and Microsoft 365 Copilot agents) is the one supported client th {% hint style="info" %} Do the [#cipp-mcp](cipp-api.md#cipp-mcp "mention") steps first (Enable MCP → create the MCP client → **Save to Azure**). Keep the **MCP client's Application (Client) ID** and its **secret** handy. If you didn't save the secret, reset it with **Actions → Reset Application Secret**. + +Copilot Studio still signs each user in, so every call runs with **that user's own Manage365 role**, not the client's role. Everyone who uses the agent needs a Manage365 role that covers the tools it calls; otherwise they get "the user does not have the required permission". {% endhint %} {% stepper %} diff --git a/docs/user-documentation/cipp/settings/README.md b/docs/user-documentation/cipp/settings/README.md index 01f9b56e0f..282e096e27 100644 --- a/docs/user-documentation/cipp/settings/README.md +++ b/docs/user-documentation/cipp/settings/README.md @@ -4,7 +4,7 @@ description: View and amend the settings for your CIPP instance. # Application Settings -The General tab of the application settings brings together the instance-wide controls for your CIPP deployment: version information, password generation, DNS resolution, caching, backups, retention periods, JIT admin limits, and the default BEC containment actions. Each card operates independently and saves on its own, so there is no single submit action for the page. +The General tab of the application settings brings together the instance-wide controls for your CIPP deployment: version information, password generation, DNS resolution, caching, backups, retention periods, JIT admin limits and approval, and the default BEC containment actions. Each card operates independently and saves on its own, so there is no single submit action for the page. ## Version @@ -112,18 +112,28 @@ A download link expires after the retention period that applied when its email w ## JIT Admin Settings -Caps how long a Just-In-Time admin account created through CIPP may remain active, which stops technicians from provisioning long-lived privileged accounts. +Caps how long a Just-In-Time admin account created through CIPP may remain active, which stops technicians from provisioning long-lived privileged accounts, and can require JIT Admin requests to be approved before they are carried out. | Field | Description | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Maximum Duration (ISO 8601) | The longest duration a JIT admin account may be granted. Presets range from 1 hour to 30 days, and a custom ISO 8601 duration such as `PT6H` or `P21D` can be typed directly. Leave empty for no limit. | +| Require approval for JIT Admin requests | Holds JIT Admin requests until they are approved, instead of carrying them out straight away. The fields below appear when this is on. | +| Roles that need approval | The Entra ID directory roles that trigger approval. A request including any of them needs approval, and a request without them goes ahead as before. Leave empty to require approval for every request, including one that only adds groups. | +| Approver roles | The CIPP roles, built-in or custom, whose users can approve or reject requests. Required when approval is on. | +| Approvals required | How many different approvers must approve a request before it is carried out. Defaults to 1. | -Select **Save Settings** to apply. The limit applies globally across all tenants, and any attempt to create a JIT admin account exceeding it is rejected. +Select **Save Settings** to apply. The settings apply globally across all tenants. Any attempt to create a JIT admin account exceeding the maximum duration is rejected. {% hint style="info" %} Custom values must be valid ISO 8601 durations, so use forms such as `PT1H`, `P1D` or `P28D`. An invalid value prevents the card from saving. {% endhint %} +When approval is on, a request is never approved by the person who submitted it, and a single rejection ends it. Approvers are notified through the [notifications.md](notifications.md "mention") settings, and on the new CIPP infrastructure by push to any device they have registered. Requests are approved and rejected on the [Requests](../../identity/administration/jit-admin/requests.md) tab of JIT Admin, which describes the whole flow. + +{% hint style="warning" %} +If the technicians who request JIT Admin access also hold an approver role, they can approve each other's requests, though never their own. Choose approver roles held by the people who should sign off on elevated access. +{% endhint %} + ## BEC Remediation Defaults Shows how many of the business email compromise containment actions are switched on by default, for example **6 of 21 actions on by default**. The defaults decide which actions start selected when a compromised user is contained, and which run when a user is contained automatically. diff --git a/docs/user-documentation/dashboard/README.md b/docs/user-documentation/dashboard/README.md index abf33dc169..b418a2ed7d 100644 --- a/docs/user-documentation/dashboard/README.md +++ b/docs/user-documentation/dashboard/README.md @@ -63,6 +63,8 @@ The portfolio average alignment score, with tenants grouped into bands of 90% an ### Operations and Triage +The band opens with **Service health**: the open Microsoft 365 incidents and advisories across the estate, each listed once with how many of your tenants it reached. Unlike the single-tenant card this reads from the nightly cache, so it can run up to a day behind Microsoft. **View all** opens the [issues.md](../tenant/administration/service-health/issues.md "mention") page filtered to open items. + Four tiles cover what needs attention right now. | Tile | Description | @@ -253,6 +255,16 @@ Every item the tenant's scripted alerts are currently reporting, with counts for
    +Service health + +Open Microsoft 365 incidents and advisories for the tenant, read live from Microsoft each time the dashboard loads, so a fresh outage shows here before it reaches any cache. Incidents are listed first. Each row shows the affected service, Microsoft's current status, and when the issue was last updated. When a customer reports something odd, check here before assuming the tenant is at fault. + +**View all** opens the [issues.md](../tenant/administration/service-health/issues.md "mention") page filtered to open items. The card's **Service health** heading opens the [service-health](../tenant/administration/service-health/ "mention") overview. + +
    + +
    + Secure Score The historical trend of the Microsoft Secure Score collected for the tenant. diff --git a/docs/user-documentation/email/administration/mailboxes.md b/docs/user-documentation/email/administration/mailboxes.md index 64456961ba..1c6608fab2 100644 --- a/docs/user-documentation/email/administration/mailboxes.md +++ b/docs/user-documentation/email/administration/mailboxes.md @@ -56,7 +56,7 @@ The row flyout and the page filters expose further properties, most usefully **A ## Table Actions -
    ActionDescriptionBulk Action Available
    Bulk Add Mailbox PermissionsGrants other users access to the selected mailbox(es). Full Access, Send As, and Send On Behalf are each granted to their own list of users, and automapping (which makes Outlook add the mailbox on its own) is on by default for Full Access.true
    Edit permissionsOpens the exchange.md for the mailbox's user, where existing permissions can be changed or removed.false
    Research Compromised Account

    Opens the case.md investigation for the account, which analyses indicators of compromise:

    • Sign-in patterns
    • Mail rules
    • Suspicious activities
    		false
    Send MFA PushOpens a dialog showing the user's registered MFA methods and sends a push notification to Microsoft Authenticator on confirm. If Authenticator push is not registered but a code-based method is, asks for a typed OTP code to verify instead. Confirm is disabled if neither is registered.true
    Convert MailboxConverts the mailbox to a different type: User Mailbox, Shared Mailbox, Room Mailbox or Equipment Mailbox.true
    Enable Online ArchiveCreates the online archive for the mailbox. Greyed out on a mailbox that already has one.true
    Set Retention PolicyApplies one of the tenant's messaging records management retention policies to the selected mailbox(es).true
    Enable Auto-Expanding ArchiveSwitches on auto-expanding archiving for the mailbox, letting the archive grow beyond its initial quota. Greyed out on a mailbox with no online archive, and cannot be undone once enabled.true
    Set Global Address List VisibilityHides or shows the mailbox in the Global Address List. Changes can take up to 72 hours to appear.true
    Start Managed Folder AssistantRuns the managed folder assistant against the mailbox, which applies its retention settings immediately rather than waiting for the next scheduled run.true
    Delete MailboxDeletes the mailbox and the account it belongs to.true
    Set Copy Sent Items for Delegated MailboxesControls whether mail sent as, or on behalf of, the mailbox is also saved to its Sent Items. Greyed out on anything other than a user or shared mailbox.true
    Set Litigation HoldPlaces the mailbox on litigation hold for a number of days, or indefinitely if left blank, and can disable an existing hold. Greyed out on a mailbox whose licence does not include litigation hold.true
    Set Retention HoldSuspends the processing of retention policies for the mailbox, or lifts an existing retention hold.true
    Set Mailbox LocaleSets the mailbox language and regional format, for example en-US, which also names the default folders.true
    Set Max Send/Receive SizeSets the largest message the mailbox can send and receive, from 1 to 150MB. Either can be left blank to leave it unchanged.true
    Set Send QuotaSets the size at which the mailbox is blocked from sending, for example 10GB.true
    Set Send and Receive QuotaSets the size at which the mailbox is blocked from both sending and receiving.true
    Set Quota Warning LevelSets the size at which the user is warned that the mailbox is filling up.true
    Set Calendar ProcessingConfigures how a resource handles booking requests: automatic processing and acceptance, conflict and recurrence rules, booking window and duration limits, what is kept of the original request, and the response text sent back. Greyed out on anything other than a room or equipment mailbox.true
    More InfoOpens the Extended Info flyout with the full details for the selected row.false
    +
    ActionDescriptionBulk Action Available
    Bulk Add Mailbox PermissionsGrants other users access to the selected mailbox(es). Full Access, Send As, and Send On Behalf are each granted to their own list of users, and automapping (which makes Outlook add the mailbox on its own) is on by default for Full Access.true
    Edit permissionsOpens the exchange.md for the mailbox's user, where existing permissions can be changed or removed.false
    Research Compromised Account

    Opens the case.md investigation for the account, which analyses indicators of compromise:

    • Sign-in patterns
    • Mail rules
    • Suspicious activities
    		false
    Send MFA PushOpens a dialog showing the user's registered MFA methods and sends a push notification to Microsoft Authenticator on confirm. If Authenticator push is not registered but a code-based method is, asks for a typed OTP code to verify instead. Confirm is disabled if neither is registered.true
    Convert MailboxConverts the mailbox to a different type: User Mailbox, Shared Mailbox, Room Mailbox or Equipment Mailbox. Picking Shared Mailbox warns when the mailbox or its archive is over 50 GB, or it is on litigation hold, as it then needs to keep a licence.true
    Enable Online ArchiveCreates the online archive for the mailbox. Greyed out on a mailbox that already has one.true
    Set Retention PolicyApplies one of the tenant's messaging records management retention policies to the selected mailbox(es).true
    Enable Auto-Expanding ArchiveSwitches on auto-expanding archiving for the mailbox, letting the archive grow beyond its initial quota. Greyed out on a mailbox with no online archive, and cannot be undone once enabled.true
    Set Global Address List VisibilityHides or shows the mailbox in the Global Address List. Changes can take up to 72 hours to appear.true
    Start Managed Folder AssistantRuns the managed folder assistant against the mailbox, which applies its retention settings immediately rather than waiting for the next scheduled run.true
    Delete MailboxDeletes the mailbox and the account it belongs to.true
    Set Copy Sent Items for Delegated MailboxesControls whether mail sent as, or on behalf of, the mailbox is also saved to its Sent Items. Greyed out on anything other than a user or shared mailbox.true
    Set Litigation HoldPlaces the mailbox on litigation hold for a number of days, or indefinitely if left blank, and can disable an existing hold. Greyed out on a mailbox whose licence does not include litigation hold.true
    Set Retention HoldSuspends the processing of retention policies for the mailbox, or lifts an existing retention hold.true
    Set Mailbox LocaleSets the mailbox language and regional format, for example en-US, which also names the default folders.true
    Set Max Send/Receive SizeSets the largest message the mailbox can send and receive, from 1 to 150MB. Either can be left blank to leave it unchanged.true
    Set Send QuotaSets the size at which the mailbox is blocked from sending, for example 10GB.true
    Set Send and Receive QuotaSets the size at which the mailbox is blocked from both sending and receiving.true
    Set Quota Warning LevelSets the size at which the user is warned that the mailbox is filling up.true
    Set Calendar ProcessingConfigures how a resource handles booking requests: automatic processing and acceptance, conflict and recurrence rules, booking window and duration limits, what is kept of the original request, and the response text sent back. Greyed out on anything other than a room or equipment mailbox.true
    More InfoOpens the Extended Info flyout with the full details for the selected row.false
    ## Anonymised Reports diff --git a/docs/user-documentation/endpoint/applications/list.md b/docs/user-documentation/endpoint/applications/list.md index 0107364aa6..d45492bf56 100644 --- a/docs/user-documentation/endpoint/applications/list.md +++ b/docs/user-documentation/endpoint/applications/list.md @@ -65,8 +65,16 @@ ConnectWise RMM, previously known as Command and before that Continuum. | ---------- | ---------------------------------------------------------------------------------- | | Client URL | Per tenant. The full download URL of the agent installer for that customer's site. | +**NinjaOne** + +| Field | Description | +| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Installer Token | Per tenant. The token for the customer organisation and location, from a generic installer in NinjaOne. Accepts a CIPP custom variable such as `%NinjaOneToken%` (type `%` to browse). | + +CIPP packages NinjaOne's generic installer and passes the token at install time, so one package serves every organisation. The install is skipped on devices that already run the NinjaOne agent. The tokens are generated as described in NinjaOne's [quick deployment guide](https://www.ninjaone.com/docs/new-to-ninjaone/getting-started/best-practice-guides/quick-deployment-guide/). + {% hint style="info" %} -Datto RMM, CW Automate and CW Command are community contributions and are not covered by a vendor sponsorship. CIPP shows a notice to this effect when one of them is selected, and support for these is through the Discord community rather than the vendor. +Datto RMM, CW Automate, CW Command and NinjaOne are community contributions and are not covered by a vendor sponsorship. CIPP shows a notice to this effect when one of them is selected, and support for these is through the Discord community rather than the vendor. {% endhint %} {% hint style="warning" %} diff --git a/docs/user-documentation/identity/administration/bec/case.md b/docs/user-documentation/identity/administration/bec/case.md index 5cdff83765..3af1136859 100644 --- a/docs/user-documentation/identity/administration/bec/case.md +++ b/docs/user-documentation/identity/administration/bec/case.md @@ -118,7 +118,7 @@ A check that failed outright shows **Couldn't check** with the reason. When any Most checks depend on the unified audit log. When it is disabled for the tenant, the warning above the groups says so and the checks that read from it come back empty rather than clean. An empty result in that state means nothing was available to search, not that nothing happened. {% endhint %} -Every check covers the seven days before the analysis ran, apart from the MFA methods, the Intune and registered device lists, the delegations, consents and add-ins, and the trusted and blocked sender lists, which show the account's current state regardless of age. Nothing is cut to a row count: every list is read to the end of the window, and a check that could not read its whole window says so. The **Report check** column gives the number each finding carries in the [PDF report](case.md#pdf-report). +Every check covers the seven days before the analysis ran, or 30 days for a tenant with Entra ID P1 or P2, whose sign-in and audit logs are kept that long. The exceptions are the MFA methods, the Intune and registered device lists, the delegations, consents and add-ins, and the trusted and blocked sender lists, which show the account's current state regardless of age. Nothing is cut to a row count: every list is read to the end of the window, and a check that could not read its whole window says so. The **Report check** column gives the number each finding carries in the [PDF report](case.md#pdf-report). ### Attacker IPs & activity diff --git a/docs/user-documentation/identity/administration/jit-admin/README.md b/docs/user-documentation/identity/administration/jit-admin/README.md index 553db264ce..b6617841bc 100644 --- a/docs/user-documentation/identity/administration/jit-admin/README.md +++ b/docs/user-documentation/identity/administration/jit-admin/README.md @@ -2,6 +2,19 @@ JIT Admin creates administrative accounts that expire on their own, so temporary elevation does not turn into a permanent standing privilege. Each account is created with a chosen set of roles and an expiry, and CIPP removes the roles or disables the account when the window closes. This page lists the accounts CIPP is tracking, whether they are currently active, and what they were created for. +JIT Admin is a tabbed page: + +| Tab | What it is for | +| ------------------- | ---------------------------------------------------------------------------------------------------- | +| JIT Admins | This list of JIT Admin accounts. | +| Requests | Requests waiting for approval, and the decisions made on earlier ones. See [requests.md](requests.md "mention"). | +| JIT Admin Templates | Saved settings for repeated grants. See [README.md](templates/README.md "mention"). | +| JIT Role Templates | Allow-lists of the roles a CIPP role can grant. See [README.md](role-templates/README.md "mention"). | + +{% hint style="info" %} +When JIT Admin approval is switched on, a request that needs approval only appears on this list once it has been approved and created. Until then it is on the [requests.md](requests.md "mention") tab. +{% endhint %} + ## Action Buttons {% content-ref url="add.md" %} @@ -38,7 +51,7 @@ Under All Tenants, the first time the list is opened CIPP queues a background jo {% endhint %} {% hint style="info" %} -If your CIPP role has a [JIT Role Template](../jit-role-templates/README.md "mention") assigned, this list is filtered to JIT Admins whose roles fall entirely within that template. An account holding any role outside your allow-list is left off the list rather than shown with roles hidden. +If your CIPP role has a [JIT Role Template](role-templates/README.md "mention") assigned, this list is filtered to JIT Admins whose roles fall entirely within that template. An account holding any role outside your allow-list is left off the list rather than shown with roles hidden. {% endhint %} ## Table Actions diff --git a/docs/user-documentation/identity/administration/jit-admin/add.md b/docs/user-documentation/identity/administration/jit-admin/add.md index 6aea04c30b..672181d085 100644 --- a/docs/user-documentation/identity/administration/jit-admin/add.md +++ b/docs/user-documentation/identity/administration/jit-admin/add.md @@ -7,7 +7,7 @@ This page grants time-limited administrative access. You choose who gets it, wha | Field | Description | | ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | Select a tenant to create the JIT Admin in | The tenant the access is granted in. Required, and it has to be chosen before the template list and the tenant's Temporary Access Pass policy can be read. | -| JIT Admin Template (optional) | Applies a saved template, filling in the rest of the form. Templates are managed on the [jit-admin-templates](../jit-admin-templates/ "mention") page. | +| JIT Admin Template (optional) | Applies a saved template, filling in the rest of the form. Templates are managed on the [README.md](templates/README.md "mention") page. | {% hint style="info" %} A default template is applied on its own once a tenant is selected. A template marked as the default for that specific tenant wins; failing that, a template marked as the default across All Tenants is used. Anything a template fills in can still be changed before submitting. A template can contain `%cipptechnician%` in its name, username or reason text, or `%cipptechnicianupn%` in its reason; those are replaced with your own signed-in account name as the template is applied. @@ -40,7 +40,7 @@ Changing the tenant clears the selected user, groups and Conditional Access poli | Field | Description | | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------- | -| Apply JIT Role Template | Picks one or more [JIT Role Templates](../jit-role-templates/README.md "mention") and adds their roles into Roles below. Selections are additive to whatever Roles already holds, and everything stays editable afterwards. | +| Apply JIT Role Template | Picks one or more [JIT Role Templates](role-templates/README.md "mention") and adds their roles into Roles below. Selections are additive to whatever Roles already holds, and everything stays editable afterwards. | | Roles | The Entra ID directory roles to assign for the duration of the access. | | Groups | The groups to add the account to for the duration of the access. | | Reason | Why the access was granted. Required, and it is shown on the JIT Admin list, which is what makes the list reviewable afterwards. | @@ -50,7 +50,7 @@ Apply least privilege here. Grant the narrowest role that covers the work rather {% endhint %} {% hint style="info" %} -If your CIPP role has a [JIT Role Template](../jit-role-templates/README.md "mention") assigned, Roles only offers the roles that template allows, and Apply JIT Role Template only offers roles you are permitted to grant. Requesting a role outside your allow-list is also rejected when you submit. A role with no template assigned is unaffected. +If your CIPP role has a [JIT Role Template](role-templates/README.md "mention") assigned, Roles only offers the roles that template allows, and Apply JIT Role Template only offers roles you are permitted to grant. Requesting a role outside your allow-list is also rejected when you submit. A role with no template assigned is unaffected. {% endhint %} ## Temporary Access Pass @@ -63,6 +63,16 @@ The pass lifetime is worked out from the access window rather than entered, then Temporary Access Pass has to be enabled in the tenant's authentication methods policy first. The **Enable Temporary Access Passes (TAP)** standard turns it on. {% endhint %} +## Approval + +If JIT Admin approval is switched on in the [application settings](../../../cipp/settings/README.md#jit-admin-settings) and the request includes a role that needs approval, submitting the form does not create anything. The request is saved on the [requests.md](requests.md "mention") tab, the approvers are notified, and the result says how many approvals it needs and from which CIPP roles. When no specific roles are set to need approval, every request needs it, including one that only adds groups. + +The duration limit and the roles you are allowed to grant are checked when you submit, and again when the request is approved. + +{% hint style="info" %} +When an approved request is created, no password or Temporary Access Pass is generated, even if **Generate TAP** was on, so the approver never sees the account's sign-in details. Once the request is approved, use **Create Temporary Access Pass** or **Reset Password** on the [README.md](README.md "mention") tab to sign in. +{% endhint %} + ## Expiry and notification | Field | Description | diff --git a/docs/user-documentation/identity/administration/jit-admin/requests.md b/docs/user-documentation/identity/administration/jit-admin/requests.md new file mode 100644 index 0000000000..1be27bd661 --- /dev/null +++ b/docs/user-documentation/identity/administration/jit-admin/requests.md @@ -0,0 +1,70 @@ +# Requests + +When JIT Admin approval is switched on, a JIT Admin request that needs approval waits here until enough approvers have agreed. Nothing is created or changed in the tenant while a request is pending. Approval is set up in the JIT Admin Settings card of the [application settings](../../../cipp/settings/README.md#jit-admin-settings), where you choose which roles need approval, which CIPP roles can approve, and how many approvals each request needs. + +## How a request is decided + +1. A technician submits the [add.md](add.md "mention") form. If the request includes a role that needs approval, it is saved here as **Pending** instead of being carried out, and the technician is told it was submitted for approval. +2. The approvers are notified. Each approval is recorded against the request, and each approver counts once. +3. Once the required number of approvals is reached, CIPP creates the JIT Admin exactly as it was requested. Fields cannot be changed during approval; to change a request, reject it and submit a new one. +4. A single rejection ends the request, whatever approvals it already has. A rejection always carries a note, which is passed to the requester. + +{% hint style="warning" %} +The person who submitted a request can never approve it, even when they hold an approver role. They can still reject their own request to withdraw it, provided they hold an approver role. +{% endhint %} + +The approver roles and the number of approvals are recorded on each request when it is submitted. Changing the approval settings afterwards only affects new requests, not the ones already waiting. + +## After approval + +The JIT Admin is created and scheduled in the same way as one created without approval, and then appears on the [README.md](README.md "mention") tab. + +* If a request is approved after its start date, the access begins at approval and still ends at the requested end date, so the window is shorter rather than moved. A request whose end date has already passed cannot be approved; reject it instead. +* No password or Temporary Access Pass is generated when a request is approved, so the approver never sees the new account's sign-in details. Once the request is approved, the requester uses **Create Temporary Access Pass** or **Reset Password** on the [README.md](README.md "mention") tab to sign in. +* The notification channels chosen on the request are used for the JIT Admin's own start and expiry, the same as for any JIT Admin. + +## Notifications + +| Event | Who is told | +| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Request submitted | Everyone set up in CIPP's [notifications.md](../../../cipp/settings/notifications.md "mention") settings: the email recipients, the webhook, and the PSA if **Send to integration** is on. On the new CIPP infrastructure, approvers also get a push notification on any device they have registered. The requester does not get a push notification for their own request. | +| Approved | The same notification settings, with the result of creating the JIT Admin. On the new CIPP infrastructure, the requester also gets a push notification. | +| Rejected | The same notification settings, with the rejection note. On the new CIPP infrastructure, the requester also gets a push notification. | + +{% hint style="info" %} +Push notifications go to devices registered on the **Preferences** page. Approvers are found from the users listed under CIPP Users, so an approver who signs in to CIPP without being listed there does not receive a push, but still receives the email, webhook and PSA notifications. +{% endhint %} + +## Filters + +| Filter | Shows | +| ------- | ----------------------------------------- | +| Pending | Requests still waiting for a decision. | + +## Table Details + +| Column | Description | +| ------------ | ----------------------------------------------------------------------------------------------------------------------------- | +| State | **Pending** while waiting, **Completed** once approved and created, **Rejected** after a rejection, or **Failed** if the JIT Admin could not be created after approval. | +| Tenant | The tenant the access was requested in. | +| Target User | The account the access is for. For a new account, this is the username that will be created. | +| Roles | The Entra ID directory roles requested. | +| Groups | The groups requested. | +| Start Date | When the access was requested to begin. | +| End Date | When the access was requested to end. | +| Reason | The reason given on the request. | +| Requested By | Who submitted the request. | +| Requested At | When the request was submitted. | +| Approvals | How many approvals the request has, out of how many it needs. | + +The **More Info** flyout also shows the approver roles, each decision with who made it, when, and any note, and the results of creating the JIT Admin. + +## Table Actions + +
    ActionDescriptionBulk Action Available
    ApproveRecords your approval, with an optional note. When it is the last approval needed, the JIT Admin is created and the results are shown. Only offered to approvers on a pending request they did not submit and have not already approved.false
    RejectEnds the request. A note is required and is sent to the requester. Only offered to approvers on a pending request.false
    More InfoOpens the Extended Info flyout with the full details for the selected row.false
    + +{% hint style="info" %} +While approval is on, CIPP also refuses to grant roles or groups through a JIT Admin that has no approved request behind it, such as a scheduled task set up directly. A JIT Admin scheduled to start in the future before approval was switched on is held to the same rule, so it does not activate when its start date arrives. +{% endhint %} + +{% include "../../../../../.gitbook/includes/feature-request.md" %} diff --git a/docs/user-documentation/identity/administration/jit-role-templates/README.md b/docs/user-documentation/identity/administration/jit-admin/role-templates/README.md similarity index 83% rename from docs/user-documentation/identity/administration/jit-role-templates/README.md rename to docs/user-documentation/identity/administration/jit-admin/role-templates/README.md index 1c62c9fcf1..5638328093 100644 --- a/docs/user-documentation/identity/administration/jit-role-templates/README.md +++ b/docs/user-documentation/identity/administration/jit-admin/role-templates/README.md @@ -1,6 +1,6 @@ # JIT Role Templates -A JIT Role Template is a named allow-list of Entra ID directory roles. Assigning one to a [CIPP custom role](../../../cipp/advanced/authentication/cipp-roles/README.md) restricts members of that role to only grant the roles in the template when creating a JIT Admin, and they can only see existing JIT Admins whose roles fall entirely within the template. +A JIT Role Template is a named allow-list of Entra ID directory roles. Assigning one to a [CIPP custom role](../../../../cipp/advanced/authentication/cipp-roles/README.md) restricts members of that role to only grant the roles in the template when creating a JIT Admin, and they can only see existing JIT Admins whose roles fall entirely within the template. {% hint style="info" %} Restriction combines the same way CIPP handles multiple custom roles elsewhere - restrictively, not additively. A custom role with no template assigned does not restrict anything on its own, but as soon as a user holds a role that has a template they are restricted, and their allowed roles are the intersection of every template they hold. An untemplated role cannot be used to bypass a template assigned alongside it. Admin and Super Admin users are unaffected, and if no template is assigned anywhere nothing changes, so existing configurations are not disturbed until you assign one. @@ -25,4 +25,4 @@ Restriction combines the same way CIPP handles multiple custom roles elsewhere -
    ActionDescriptionBulk Action Available
    Edit TemplateOpens the selected template for editing in edit.md.false
    Delete TemplateDeletes the template. A custom role still assigned this template is not reverted to unrestricted - it fails closed, so its members can no longer grant or see any roles via JIT Admin until a different template is assigned or the assignment is cleared.false
    -{% include "../../../../../.gitbook/includes/feature-request.md" %} +{% include "../../../../../../.gitbook/includes/feature-request.md" %} diff --git a/docs/user-documentation/identity/administration/jit-role-templates/add.md b/docs/user-documentation/identity/administration/jit-admin/role-templates/add.md similarity index 79% rename from docs/user-documentation/identity/administration/jit-role-templates/add.md rename to docs/user-documentation/identity/administration/jit-admin/role-templates/add.md index 07d931c72d..f7c04fc096 100644 --- a/docs/user-documentation/identity/administration/jit-role-templates/add.md +++ b/docs/user-documentation/identity/administration/jit-admin/role-templates/add.md @@ -8,7 +8,7 @@ Here you can create a JIT Role Template. Give the template a name, select the di | Allowed Roles | The Entra ID directory roles this template permits. CIPP custom roles assigned this template may only grant these roles via JIT Admin. | {% hint style="info" %} -The template only takes effect once it is assigned to a CIPP custom role on the [Add Role](../../../cipp/advanced/authentication/cipp-roles/add.md) page. A custom role with no template assigned can still grant all roles. +The template only takes effect once it is assigned to a CIPP custom role on the [Add Role](../../../../cipp/advanced/authentication/cipp-roles/add.md) page. A custom role with no template assigned can still grant all roles. {% endhint %} -{% include "../../../../../.gitbook/includes/feature-request.md" %} +{% include "../../../../../../.gitbook/includes/feature-request.md" %} diff --git a/docs/user-documentation/identity/administration/jit-role-templates/edit.md b/docs/user-documentation/identity/administration/jit-admin/role-templates/edit.md similarity index 88% rename from docs/user-documentation/identity/administration/jit-role-templates/edit.md rename to docs/user-documentation/identity/administration/jit-admin/role-templates/edit.md index 40590fb27a..b8fea446f6 100644 --- a/docs/user-documentation/identity/administration/jit-role-templates/edit.md +++ b/docs/user-documentation/identity/administration/jit-admin/role-templates/edit.md @@ -4,4 +4,4 @@ This page changes a saved JIT Role Template. It is reached from the **Edit Templ Saving overwrites the existing template in place rather than creating a second one, because the template keeps its identifier through the edit. Any CIPP custom role the template is assigned to picks up the change immediately - there is no separate step to re-apply it. -{% include "../../../../../.gitbook/includes/feature-request.md" %} +{% include "../../../../../../.gitbook/includes/feature-request.md" %} diff --git a/docs/user-documentation/identity/administration/jit-admin-templates/README.md b/docs/user-documentation/identity/administration/jit-admin/templates/README.md similarity index 97% rename from docs/user-documentation/identity/administration/jit-admin-templates/README.md rename to docs/user-documentation/identity/administration/jit-admin/templates/README.md index 0751e23551..c2b20f6584 100644 --- a/docs/user-documentation/identity/administration/jit-admin-templates/README.md +++ b/docs/user-documentation/identity/administration/jit-admin/templates/README.md @@ -34,4 +34,4 @@ This list is scoped to the tenant selected in the tenant selector, and shows tha Only one template should be marked as the default for a given tenant. Where both a tenant-specific default and an All Tenants default exist, the tenant-specific one is applied. {% endhint %} -{% include "../../../../../.gitbook/includes/feature-request.md" %} +{% include "../../../../../../.gitbook/includes/feature-request.md" %} diff --git a/docs/user-documentation/identity/administration/jit-admin-templates/add.md b/docs/user-documentation/identity/administration/jit-admin/templates/add.md similarity index 92% rename from docs/user-documentation/identity/administration/jit-admin-templates/add.md rename to docs/user-documentation/identity/administration/jit-admin/templates/add.md index b762f59c3e..0e6d236413 100644 --- a/docs/user-documentation/identity/administration/jit-admin-templates/add.md +++ b/docs/user-documentation/identity/administration/jit-admin/templates/add.md @@ -1,6 +1,6 @@ # Add JIT Admin Template -This page creates a JIT Admin template, which stores the settings for a just-in-time admin grant so the same elevation can be requested repeatedly without rebuilding it. Templates are selected on the [add.md](../jit-admin/add.md "mention") page, and everything a template fills in can still be changed before the grant is submitted. +This page creates a JIT Admin template, which stores the settings for a just-in-time admin grant so the same elevation can be requested repeatedly without rebuilding it. Templates are selected on the [add.md](../add.md "mention") page, and everything a template fills in can still be changed before the grant is submitted. {% hint style="info" %} The template is created for the tenant selected in the top menu; there is no tenant field on the form. Select All Tenants to create a template available everywhere. Changing the tenant in the top menu while the form is open clears the default user, groups, domain and Conditional Access policies, since they belong to the previous tenant. @@ -19,8 +19,8 @@ The template is created for the tenant selected in the top menu; there is no ten | Field | Description | | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | -| Apply JIT Role Template | Picks one or more [JIT Role Templates](../jit-role-templates/README.md "mention") and adds their roles into Default Roles below. Selections are additive to whatever Default Roles already holds, and everything stays editable afterwards. | -| Default Roles | The Entra ID directory roles the template assigns. If your CIPP role has a [JIT Role Template](../jit-role-templates/README.md "mention") assigned, only the roles it allows are offered here. | +| Apply JIT Role Template | Picks one or more [JIT Role Templates](../role-templates/README.md "mention") and adds their roles into Default Roles below. Selections are additive to whatever Default Roles already holds, and everything stays editable afterwards. | +| Default Roles | The Entra ID directory roles the template assigns. If your CIPP role has a [JIT Role Template](../role-templates/README.md "mention") assigned, only the roles it allows are offered here. | | Default Groups | The groups the account is added to. Not available on an All Tenants template, since group identifiers do not carry between tenants. | | Default Duration | How long the elevation lasts, which sets the end date on the JIT admin form. Optional. | | Default Expiration Action | What happens to the account when the elevation ends. Required. | @@ -44,7 +44,7 @@ The expiration action offers **Delete User** and **Disable User** whatever the s | Default Usage Location | The country the account is licensed in. Shown for a new user, and optional. | | Default User | The account the elevation is granted to. Shown when the template targets an existing user, and not available on an All Tenants template. | -When the template targets an existing user, it can also pre-set the Vacation Mode section of the JIT Admin form, which excludes the user from the chosen Conditional Access policies, location-based audit log alerts, or both, for the length of the grant plus a one-hour buffer. None of these are available on an All Tenants template. See [add.md](../jit-admin/add.md "mention") for what each exclusion does. +When the template targets an existing user, it can also pre-set the Vacation Mode section of the JIT Admin form, which excludes the user from the chosen Conditional Access policies, location-based audit log alerts, or both, for the length of the grant plus a one-hour buffer. None of these are available on an All Tenants template. See [add.md](../add.md "mention") for what each exclusion does. | Field | Description | | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | @@ -62,4 +62,4 @@ Default First Name, Default Last Name, Default Username and Reason Template acce An All Tenants template can only create a new user. The Existing User option is greyed out, because a specific account exists in one tenant and means nothing in the others. Domain and group selection are withdrawn for the same reason, so an All Tenants template covers the roles, timing and expiry behaviour while the tenant-specific details are supplied when the grant is made. {% endhint %} -{% include "../../../../../.gitbook/includes/feature-request.md" %} +{% include "../../../../../../.gitbook/includes/feature-request.md" %} diff --git a/docs/user-documentation/identity/administration/jit-admin-templates/edit.md b/docs/user-documentation/identity/administration/jit-admin/templates/edit.md similarity index 96% rename from docs/user-documentation/identity/administration/jit-admin-templates/edit.md rename to docs/user-documentation/identity/administration/jit-admin/templates/edit.md index 4f85ae2399..38afa43f42 100644 --- a/docs/user-documentation/identity/administration/jit-admin-templates/edit.md +++ b/docs/user-documentation/identity/administration/jit-admin/templates/edit.md @@ -20,4 +20,4 @@ Template names have to be unique within a tenant. Saving a name already used by Only the fields belonging to the selected **Default User Action** are kept. Switching a template from creating a new user to using an existing one discards the stored name, username, domain and usage location, and switching the other way discards the stored user and turns off the Vacation Mode defaults. Change this setting only when you intend to rebuild that part of the template. {% endhint %} -{% include "../../../../../.gitbook/includes/feature-request.md" %} +{% include "../../../../../../.gitbook/includes/feature-request.md" %} diff --git a/docs/user-documentation/identity/administration/offboarding-wizard.md b/docs/user-documentation/identity/administration/offboarding-wizard.md index ef63755596..06c4a84b22 100644 --- a/docs/user-documentation/identity/administration/offboarding-wizard.md +++ b/docs/user-documentation/identity/administration/offboarding-wizard.md @@ -66,7 +66,7 @@ Deleting the user removes the mailbox with it, so it cannot be combined with con {% endhint %} {% hint style="warning" %} -Converting a mailbox that is at or near 50 GB may fail, and a converted mailbox over that size stops receiving mail once its licence is removed unless an Exchange Online Plan 2 licence is assigned. The wizard checks the size of the selected mailboxes and warns before you submit. +Converting a mailbox that is at or near 50 GB may fail, and a converted mailbox over that size stops receiving mail once its licence is removed unless an Exchange Online Plan 2 licence is assigned. An archive over 50 GB, or a litigation hold, also needs the mailbox to keep a licence. The wizard checks the selected mailboxes against the overnight mailbox data and warns before you submit. {% endhint %} {% hint style="info" %} diff --git a/docs/user-documentation/identity/administration/users/README.md b/docs/user-documentation/identity/administration/users/README.md index 1fa0fc4834..e017135222 100644 --- a/docs/user-documentation/identity/administration/users/README.md +++ b/docs/user-documentation/identity/administration/users/README.md @@ -162,7 +162,7 @@ The properties returned are for the Graph resource type `user`. For more informa ## Table Actions -
    ActionDescriptionBulk Action Available
    View UserOpens the user page for the selected user.false
    Edit UserOpens the edit.md page, where properties, licences and group memberships can be changed.false
    View in EntraOpens the user in the Microsoft Entra admin center in a new tab.false
    Create Template from UserCreates a reusable user template from this account, copying its job title, department, location, licences and group memberships. Prompts for a template name and whether the template becomes the default for the tenant.true
    Research Compromised AccountOpens the case.md view, which gathers the common indicators of compromise for the account in one place.false
    Run BEC investigationQueues a Business Email Compromise investigation for each selected user. Each run is kept as a case and appears on the bec page as it finishes. Greyed out for guest accounts.true
    Create Temporary Access PassIssues a time limited passcode the user can sign in with, typically to enrol a passwordless method. The lifetime is validated against the tenant's policy, one-time use can be requested, and the pass can be set to become valid at a future date and time. Generate PwPush link returns a single-use passwordpusher.md link in place of the pass, so it can be handed to the user securely. It needs the Password Pusher integration to be enabled, and the plain pass is returned instead if no link can be created.true
    Re-require MFA registrationClears the user's registered multi-factor methods so they must register again.true
    Send MFA PushOpens a dialog showing the user's registered MFA methods and sends a push notification to Microsoft Authenticator on confirm. If Authenticator push is not registered but a code-based method is, asks for a typed OTP code to verify instead. Confirm is disabled if neither is registered.true
    Set Per-User MFASets the legacy per-user MFA state to Enforced, Enabled or Disabled, independently of any Conditional Access policy.true
    Convert MailboxConverts the mailbox to a User, Shared, Room or Equipment mailbox, keeping its existing content.true
    Enable Online ArchiveTurns on the archive mailbox so older mail can be moved out of the primary mailbox.true
    Set Out of OfficeSets automatic replies to Enabled, Disabled or Scheduled, with separate internal and external messages. When scheduled, the period can also block the user's calendar, decline new invitations, and decline and cancel meetings already booked. Selecting a single user pre-fills the form with their current settings; with several selected, it starts blank.true
    Add to GroupAdds the user to one or more groups in the tenant.true
    Manage LicensesAdds, removes or replaces licences on the account, with the option to remove or replace everything currently assigned.true
    Disable Email ForwardingClears any forwarding set on the mailbox, both internal and external.true
    Pre-provision OneDriveCreates the user's OneDrive ahead of their first sign-in, so it is ready when they need it.true
    Set OneDrive External SharingSets how far the user's OneDrive can be shared outside the organisation: no external sharing, signed-in guests only, anyone links, or existing guests only.true
    Add OneDrive ShortcutAdds a shortcut to a chosen SharePoint site into the user's OneDrive, either at the OneDrive root or inside the Shortcuts folder used by Microsoft's own OneDrive and SharePoint interfaces.true
    Migrate OneDrive ShortcutsMoves every shortcut currently sitting in the user's OneDrive root into the Shortcuts folder.true
    Set Sign In StateBlocks or restores the account's ability to sign in. The current state is pre-selected, and submitting an unchanged state is rejected.true
    Reset PasswordSets a new random password and returns it in the result, optionally requiring a change at the next sign-in.true
    Require Password Change at Next LogonRequires the user to change their password at next sign-in without resetting it. Not supported for directory-synced accounts.true
    Set Password ExpirationEnables or disables password expiry for the account. With expiry enabled, a password older than the organisation's expiry period prompts the user to change it at their next sign-in.true
    Clear On-Premises AttributesClears the on-premises attributes left behind after a tenant moves from directory sync to cloud-only: immutable ID, distinguished name, domain name, SAM account name, security identifier, on-premises UPN and object identifier. The dialog opens with all of them selected; untick any to keep. Greyed out unless the account is no longer synchronised and still carries at least one of these values. The previous values are recorded in the log entry so they can be restored if needed.true
    Set Source of AuthoritySwitches the account between Cloud Managed and On-Premises Managed. A move back to on-premises takes until the next sync cycle to appear. Greyed out for cloud-native accounts that have never been synchronised.true
    Reprocess License AssignmentsAsks Entra to re-evaluate the group-based licences that apply to the user, adding or removing licences as the group membership dictates.true
    Revoke all user sessionsInvalidates the account's refresh tokens so every device has to sign in again.true
    Delete UserDeletes the account. Deleted accounts remain recoverable from Deleted Items for 30 days.true
    Edit PropertiesOpens the patch-wizard.md with the selected users loaded, for changing the same properties across all of them.true
    More InfoOpens the Extended Info flyout with the full details for the selected row.false
    +
    ActionDescriptionBulk Action Available
    View UserOpens the user page for the selected user.false
    Edit UserOpens the edit.md page, where properties, licences and group memberships can be changed.false
    View in EntraOpens the user in the Microsoft Entra admin center in a new tab.false
    Create Template from UserCreates a reusable user template from this account, copying its job title, department, location, licences and group memberships. Prompts for a template name and whether the template becomes the default for the tenant.true
    Research Compromised AccountOpens the case.md view, which gathers the common indicators of compromise for the account in one place.false
    Run BEC investigationQueues a Business Email Compromise investigation for each selected user. Each run is kept as a case and appears on the bec page as it finishes. Greyed out for guest accounts.true
    Create Temporary Access PassIssues a time limited passcode the user can sign in with, typically to enrol a passwordless method. The lifetime is validated against the tenant's policy, one-time use can be requested, and the pass can be set to become valid at a future date and time. Generate PwPush link returns a single-use passwordpusher.md link in place of the pass, so it can be handed to the user securely. It needs the Password Pusher integration to be enabled, and the plain pass is returned instead if no link can be created.true
    Re-require MFA registrationClears the user's registered multi-factor methods so they must register again.true
    Send MFA PushOpens a dialog showing the user's registered MFA methods and sends a push notification to Microsoft Authenticator on confirm. If Authenticator push is not registered but a code-based method is, asks for a typed OTP code to verify instead. Confirm is disabled if neither is registered.true
    Set Per-User MFASets the legacy per-user MFA state to Enforced, Enabled or Disabled, independently of any Conditional Access policy.true
    Convert MailboxConverts the mailbox to a User, Shared, Room or Equipment mailbox, keeping its existing content. Picking Shared warns when the mailbox or its archive is over 50 GB, or it is on litigation hold, as it then needs to keep a licence.true
    Enable Online ArchiveTurns on the archive mailbox so older mail can be moved out of the primary mailbox.true
    Set Out of OfficeSets automatic replies to Enabled, Disabled or Scheduled, with separate internal and external messages. When scheduled, the period can also block the user's calendar, decline new invitations, and decline and cancel meetings already booked. Selecting a single user pre-fills the form with their current settings; with several selected, it starts blank.true
    Add to GroupAdds the user to one or more groups in the tenant.true
    Manage LicensesAdds, removes or replaces licences on the account, with the option to remove or replace everything currently assigned.true
    Disable Email ForwardingClears any forwarding set on the mailbox, both internal and external.true
    Pre-provision OneDriveCreates the user's OneDrive ahead of their first sign-in, so it is ready when they need it.true
    Set OneDrive External SharingSets how far the user's OneDrive can be shared outside the organisation: no external sharing, signed-in guests only, anyone links, or existing guests only.true
    Add OneDrive ShortcutAdds a shortcut to a chosen SharePoint site into the user's OneDrive, either at the OneDrive root or inside the Shortcuts folder used by Microsoft's own OneDrive and SharePoint interfaces. An optional shortcut name replaces the default library or site name, and with several users selected the same site, location and name apply to all of them. Every user is attempted, and any that fail, for example because the shortcut already exists, are listed in the results alongside a count of how many succeeded.true
    Migrate OneDrive ShortcutsMoves every shortcut currently sitting in the user's OneDrive root into the Shortcuts folder.true
    Set Sign In StateBlocks or restores the account's ability to sign in. The current state is pre-selected, and submitting an unchanged state is rejected.true
    Reset PasswordSets a new random password and returns it in the result, optionally requiring a change at the next sign-in.true
    Require Password Change at Next LogonRequires the user to change their password at next sign-in without resetting it. Not supported for directory-synced accounts.true
    Set Password ExpirationEnables or disables password expiry for the account. With expiry enabled, a password older than the organisation's expiry period prompts the user to change it at their next sign-in.true
    Clear On-Premises AttributesClears the on-premises attributes left behind after a tenant moves from directory sync to cloud-only: immutable ID, distinguished name, domain name, SAM account name, security identifier, on-premises UPN and object identifier. The dialog opens with all of them selected; untick any to keep. Greyed out unless the account is no longer synchronised and still carries at least one of these values. The previous values are recorded in the log entry so they can be restored if needed.true
    Set Source of AuthoritySwitches the account between Cloud Managed and On-Premises Managed. A move back to on-premises takes until the next sync cycle to appear. Greyed out for cloud-native accounts that have never been synchronised.true
    Reprocess License AssignmentsAsks Entra to re-evaluate the group-based licences that apply to the user, adding or removing licences as the group membership dictates.true
    Revoke all user sessionsInvalidates the account's refresh tokens so every device has to sign in again.true
    Delete UserDeletes the account. Deleted accounts remain recoverable from Deleted Items for 30 days.true
    Edit PropertiesOpens the patch-wizard.md with the selected users loaded, for changing the same properties across all of them.true
    More InfoOpens the Extended Info flyout with the full details for the selected row.false
    >>>>>>> bba52011d (feat(onedrive): allow a custom name when adding a OneDrive shortcut)>>>>>>> 21e16da83 (feat(mailboxes): warn when a converted shared mailbox still needs a license) {% hint style="info" %} Most of these actions present a confirmation dialog before anything is sent, and any options the action needs are set in that dialog. diff --git a/docs/user-documentation/tenant/reports/list-licenses/pricing.md b/docs/user-documentation/tenant/reports/list-licenses/pricing.md index f269db3300..4683c9929d 100644 --- a/docs/user-documentation/tenant/reports/list-licenses/pricing.md +++ b/docs/user-documentation/tenant/reports/list-licenses/pricing.md @@ -1,12 +1,67 @@ # Pricing -The License Pricing tab holds the monthly per-seat price of every licence, which the [optimization.md](optimization.md "mention") tab uses to cost a tenant's licences and value its suggestions. CIPP ships with estimated prices, and you can override any of them with what you actually pay. Prices are shared by every tenant, so the page is the same whichever tenant is selected. +The License Pricing tab lets you set the monthly price you pay for each licence. The [optimization.md](optimization.md "mention") tab uses these prices to calculate licence costs and potential savings. CIPP includes estimated prices to start with. A price you enter replaces the estimate and is labelled **Override**. Prices apply to all tenants in your CIPP instance. + +Saved prices remain after you refresh the page. Each currency has its own prices, so switching back to a currency shows the prices you saved for it. ## Action Buttons -### Currency +
    + +Currency + +Select the currency you want to view or edit. Changing currency does not convert prices: a licence with a USD price may have no GBP price. The list includes currencies with estimated or saved prices. CIPP remembers your choice in this browser and uses it on the Optimization tab too. + +
    + +
    + +Export pricing CSV + +Downloads all licence prices for the selected currency as a CSV file. Open it in Excel, change the prices, then upload the edited file using **Import CSV**. Licences without a price are included with an empty price cell. + +Keep these required columns: `Product_Display_Name`, `skuPartNumber`, `skuId`, `MonthlyPrice`, and `Currency`. The `skuId` identifies which licence to update. The optional `Source` column shows where the current price came from; changing it has no effect. + +
    + +
    + +Import CSV + +Uploads your edited CSV so you can change several prices at once. You review the changes before saving them. + +{% stepper %} +{% step %} + +### Edit the export + +Choose **Export pricing CSV** and open the downloaded file in Excel. Change the values in the `MonthlyPrice` column and leave the other columns unchanged. Enter zero or a positive number, for example `19.25`, using a decimal point without a currency symbol or thousands separator. Save the file as **CSV UTF-8 (Comma delimited)**. +{% endstep %} + +{% step %} + +### Upload and review + +In CIPP, select the same currency as the file. Choose **Import CSV**, then **Choose CSV**, and select your edited file. + +CIPP checks every row. It reports missing required fields, invalid or unknown SKU IDs, currencies it does not support or that differ from the selected currency, prices that are not numbers or are below zero, and repeated rows for the same SKU and currency. If any row has an error, nothing is saved. Correct the errors in the file, save it, and choose it again. + +The review shows only the prices you changed, with the licence name, SKU ID, old price, and new price. For example: Microsoft 365 Business Premium, GBP 18.10 to GBP 19.25. Prices you left unchanged keep their existing value and source. + +A price cell can be blank only if the licence already has no price. To remove a saved price, use **Remove override** on the pricing page. Deleting a price from the CSV does not remove it from CIPP. +{% endstep %} + +{% step %} + +### Confirm the changes + +Choose **Confirm** to save. If a current price has changed since you opened the review, CIPP asks you to upload the file again and review the latest prices. + +CIPP shows how many prices were updated, left unchanged, or failed to save. The pricing table refreshes automatically. If some updates fail, the successful ones stay saved. Correct the reported problems and import the file again; prices already saved are skipped. +{% endstep %} +{% endstepper %} -Chooses the currency the prices are shown and set in. The list offers every currency that has prices, either shipped estimates or your own overrides. Prices are held separately per currency and are never converted, so a licence priced only in another currency shows no price here. The choice is remembered in this browser and shared with the Optimization tab. +
    ## Table Details diff --git a/frontend/public/Main logo -CMYK.png b/frontend/public/Main logo -CMYK.png new file mode 100644 index 0000000000..f907d5d9b4 Binary files /dev/null and b/frontend/public/Main logo -CMYK.png differ diff --git a/frontend/public/android-chrome-192x192.png b/frontend/public/android-chrome-192x192.png index f2388ad944..446cc1d069 100644 Binary files a/frontend/public/android-chrome-192x192.png and b/frontend/public/android-chrome-192x192.png differ diff --git a/frontend/public/android-chrome-512x512.png b/frontend/public/android-chrome-512x512.png index 85f7bba00f..22a0adeb27 100644 Binary files a/frontend/public/android-chrome-512x512.png and b/frontend/public/android-chrome-512x512.png differ diff --git a/frontend/public/apple-touch-icon-120x120-precomposed.png b/frontend/public/apple-touch-icon-120x120-precomposed.png index 14e2314b3c..1b794e64df 100644 Binary files a/frontend/public/apple-touch-icon-120x120-precomposed.png and b/frontend/public/apple-touch-icon-120x120-precomposed.png differ diff --git a/frontend/public/apple-touch-icon-120x120.png b/frontend/public/apple-touch-icon-120x120.png index b324a237cc..1b794e64df 100644 Binary files a/frontend/public/apple-touch-icon-120x120.png and b/frontend/public/apple-touch-icon-120x120.png differ diff --git a/frontend/public/apple-touch-icon-152x152-precomposed.png b/frontend/public/apple-touch-icon-152x152-precomposed.png index 93327fb981..8f4cd187f3 100644 Binary files a/frontend/public/apple-touch-icon-152x152-precomposed.png and b/frontend/public/apple-touch-icon-152x152-precomposed.png differ diff --git a/frontend/public/apple-touch-icon-152x152.png b/frontend/public/apple-touch-icon-152x152.png index a2891cce39..8f4cd187f3 100644 Binary files a/frontend/public/apple-touch-icon-152x152.png and b/frontend/public/apple-touch-icon-152x152.png differ diff --git a/frontend/public/apple-touch-icon-180x180-precomposed.png b/frontend/public/apple-touch-icon-180x180-precomposed.png index e221217d8b..5a07cde99f 100644 Binary files a/frontend/public/apple-touch-icon-180x180-precomposed.png and b/frontend/public/apple-touch-icon-180x180-precomposed.png differ diff --git a/frontend/public/apple-touch-icon-180x180.png b/frontend/public/apple-touch-icon-180x180.png index 8c81e4e2c7..5a07cde99f 100644 Binary files a/frontend/public/apple-touch-icon-180x180.png and b/frontend/public/apple-touch-icon-180x180.png differ diff --git a/frontend/public/apple-touch-icon-60x60-precomposed.png b/frontend/public/apple-touch-icon-60x60-precomposed.png index ebefdaf402..06265589d6 100644 Binary files a/frontend/public/apple-touch-icon-60x60-precomposed.png and b/frontend/public/apple-touch-icon-60x60-precomposed.png differ diff --git a/frontend/public/apple-touch-icon-60x60.png b/frontend/public/apple-touch-icon-60x60.png index c482583bfd..06265589d6 100644 Binary files a/frontend/public/apple-touch-icon-60x60.png and b/frontend/public/apple-touch-icon-60x60.png differ diff --git a/frontend/public/apple-touch-icon-76x76-precomposed.png b/frontend/public/apple-touch-icon-76x76-precomposed.png index 404481afd4..94aabdb26d 100644 Binary files a/frontend/public/apple-touch-icon-76x76-precomposed.png and b/frontend/public/apple-touch-icon-76x76-precomposed.png differ diff --git a/frontend/public/apple-touch-icon-76x76.png b/frontend/public/apple-touch-icon-76x76.png index 11caae337d..94aabdb26d 100644 Binary files a/frontend/public/apple-touch-icon-76x76.png and b/frontend/public/apple-touch-icon-76x76.png differ diff --git a/frontend/public/apple-touch-icon-precomposed.png b/frontend/public/apple-touch-icon-precomposed.png index e221217d8b..5a07cde99f 100644 Binary files a/frontend/public/apple-touch-icon-precomposed.png and b/frontend/public/apple-touch-icon-precomposed.png differ diff --git a/frontend/public/apple-touch-icon.png b/frontend/public/apple-touch-icon.png index 31a8bad5c4..5a07cde99f 100644 Binary files a/frontend/public/apple-touch-icon.png and b/frontend/public/apple-touch-icon.png differ diff --git a/frontend/public/assets/illustrations/undraw-into-the-night-nd84.svg b/frontend/public/assets/illustrations/undraw-into-the-night-nd84.svg index a7d0516229..18fdf6dbed 100644 --- a/frontend/public/assets/illustrations/undraw-into-the-night-nd84.svg +++ b/frontend/public/assets/illustrations/undraw-into-the-night-nd84.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_analysis_dq08.svg b/frontend/public/assets/illustrations/undraw_analysis_dq08.svg index b769a4c4c2..85d1a495e2 100644 --- a/frontend/public/assets/illustrations/undraw_analysis_dq08.svg +++ b/frontend/public/assets/illustrations/undraw_analysis_dq08.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_apps_re_ienc.svg b/frontend/public/assets/illustrations/undraw_apps_re_ienc.svg index ffb8135ed6..ec7b66b5ee 100644 --- a/frontend/public/assets/illustrations/undraw_apps_re_ienc.svg +++ b/frontend/public/assets/illustrations/undraw_apps_re_ienc.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_articles_wbpb.svg b/frontend/public/assets/illustrations/undraw_articles_wbpb.svg index 9199f58c64..215435ea57 100644 --- a/frontend/public/assets/illustrations/undraw_articles_wbpb.svg +++ b/frontend/public/assets/illustrations/undraw_articles_wbpb.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_audio_conversation_re_3t38.svg b/frontend/public/assets/illustrations/undraw_audio_conversation_re_3t38.svg index 848571b94a..2cf9cc940d 100644 --- a/frontend/public/assets/illustrations/undraw_audio_conversation_re_3t38.svg +++ b/frontend/public/assets/illustrations/undraw_audio_conversation_re_3t38.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_bug_fixing_oc-7-a.svg b/frontend/public/assets/illustrations/undraw_bug_fixing_oc-7-a.svg index 540feb57a0..a66d4895cf 100644 --- a/frontend/public/assets/illustrations/undraw_bug_fixing_oc-7-a.svg +++ b/frontend/public/assets/illustrations/undraw_bug_fixing_oc-7-a.svg @@ -1 +1 @@ -bug fixing \ No newline at end of file +bug fixing \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_business_chat_re_gg4h.svg b/frontend/public/assets/illustrations/undraw_business_chat_re_gg4h.svg index 8f7e0d60af..7afab792a1 100644 --- a/frontend/public/assets/illustrations/undraw_business_chat_re_gg4h.svg +++ b/frontend/public/assets/illustrations/undraw_business_chat_re_gg4h.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_button_style_re_uctt.svg b/frontend/public/assets/illustrations/undraw_button_style_re_uctt.svg index de17287e0f..ece2aa7da6 100644 --- a/frontend/public/assets/illustrations/undraw_button_style_re_uctt.svg +++ b/frontend/public/assets/illustrations/undraw_button_style_re_uctt.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_cloud_hosting_7xb1.svg b/frontend/public/assets/illustrations/undraw_cloud_hosting_7xb1.svg index b7f44f8463..0e3ebb59fc 100644 --- a/frontend/public/assets/illustrations/undraw_cloud_hosting_7xb1.svg +++ b/frontend/public/assets/illustrations/undraw_cloud_hosting_7xb1.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_engineering_team_a7n2.svg b/frontend/public/assets/illustrations/undraw_engineering_team_a7n2.svg index 855f2096ba..0747bddf0d 100644 --- a/frontend/public/assets/illustrations/undraw_engineering_team_a7n2.svg +++ b/frontend/public/assets/illustrations/undraw_engineering_team_a7n2.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_experience_design_re_dmqq.svg b/frontend/public/assets/illustrations/undraw_experience_design_re_dmqq.svg index 6f45d18fa4..1d818f41be 100644 --- a/frontend/public/assets/illustrations/undraw_experience_design_re_dmqq.svg +++ b/frontend/public/assets/illustrations/undraw_experience_design_re_dmqq.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_innovative_re_rr5i.svg b/frontend/public/assets/illustrations/undraw_innovative_re_rr5i.svg index cf874d6d11..8c065da5c2 100644 --- a/frontend/public/assets/illustrations/undraw_innovative_re_rr5i.svg +++ b/frontend/public/assets/illustrations/undraw_innovative_re_rr5i.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_lost_re_xqjt.svg b/frontend/public/assets/illustrations/undraw_lost_re_xqjt.svg index 1db6ea1928..1e18edca80 100644 --- a/frontend/public/assets/illustrations/undraw_lost_re_xqjt.svg +++ b/frontend/public/assets/illustrations/undraw_lost_re_xqjt.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_mindfulness_8gqa.svg b/frontend/public/assets/illustrations/undraw_mindfulness_8gqa.svg index a3038a9feb..91a3949100 100644 --- a/frontend/public/assets/illustrations/undraw_mindfulness_8gqa.svg +++ b/frontend/public/assets/illustrations/undraw_mindfulness_8gqa.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_multitasking_re_ffpb.svg b/frontend/public/assets/illustrations/undraw_multitasking_re_ffpb.svg index c2fc2d09db..7c5338fd7e 100644 --- a/frontend/public/assets/illustrations/undraw_multitasking_re_ffpb.svg +++ b/frontend/public/assets/illustrations/undraw_multitasking_re_ffpb.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_not_found_re_bh2e.svg b/frontend/public/assets/illustrations/undraw_not_found_re_bh2e.svg index 8ba6f36dda..dc42be8394 100644 --- a/frontend/public/assets/illustrations/undraw_not_found_re_bh2e.svg +++ b/frontend/public/assets/illustrations/undraw_not_found_re_bh2e.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_online_test_re_kyfx.svg b/frontend/public/assets/illustrations/undraw_online_test_re_kyfx.svg index e6345e9590..91719cea40 100644 --- a/frontend/public/assets/illustrations/undraw_online_test_re_kyfx.svg +++ b/frontend/public/assets/illustrations/undraw_online_test_re_kyfx.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_open_note_6nva.svg b/frontend/public/assets/illustrations/undraw_open_note_6nva.svg index 31677b3f6c..32c568af3a 100644 --- a/frontend/public/assets/illustrations/undraw_open_note_6nva.svg +++ b/frontend/public/assets/illustrations/undraw_open_note_6nva.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_server_status_re_n8ln.svg b/frontend/public/assets/illustrations/undraw_server_status_re_n8ln.svg index edbc9c1f7f..1d6bd01c68 100644 --- a/frontend/public/assets/illustrations/undraw_server_status_re_n8ln.svg +++ b/frontend/public/assets/illustrations/undraw_server_status_re_n8ln.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_solution_mindset_re_57bf.svg b/frontend/public/assets/illustrations/undraw_solution_mindset_re_57bf.svg index 7bb3cd635f..70a3324ef1 100644 --- a/frontend/public/assets/illustrations/undraw_solution_mindset_re_57bf.svg +++ b/frontend/public/assets/illustrations/undraw_solution_mindset_re_57bf.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_speed_test_re_pe1f.svg b/frontend/public/assets/illustrations/undraw_speed_test_re_pe1f.svg index e1e3e3c800..a9f0d9c9db 100644 --- a/frontend/public/assets/illustrations/undraw_speed_test_re_pe1f.svg +++ b/frontend/public/assets/illustrations/undraw_speed_test_re_pe1f.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_undraw_undraw_undraw_sign_up_ln1s_-1-_s4bc_-1-_ee41_-1-_kf4d.svg b/frontend/public/assets/illustrations/undraw_undraw_undraw_undraw_sign_up_ln1s_-1-_s4bc_-1-_ee41_-1-_kf4d.svg index d1294e322e..edbc770151 100644 --- a/frontend/public/assets/illustrations/undraw_undraw_undraw_undraw_sign_up_ln1s_-1-_s4bc_-1-_ee41_-1-_kf4d.svg +++ b/frontend/public/assets/illustrations/undraw_undraw_undraw_undraw_sign_up_ln1s_-1-_s4bc_-1-_ee41_-1-_kf4d.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_website_ij0l.svg b/frontend/public/assets/illustrations/undraw_website_ij0l.svg index 4a35bd0177..ddb82d2614 100644 --- a/frontend/public/assets/illustrations/undraw_website_ij0l.svg +++ b/frontend/public/assets/illustrations/undraw_website_ij0l.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/illustrations/undraw_writer_q06d.svg b/frontend/public/assets/illustrations/undraw_writer_q06d.svg index 3f9f5facd4..798d371ba2 100644 --- a/frontend/public/assets/illustrations/undraw_writer_q06d.svg +++ b/frontend/public/assets/illustrations/undraw_writer_q06d.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/frontend/public/assets/integrations/cipp-api.png b/frontend/public/assets/integrations/cipp-api.png index 48b3e4f2f2..31b17114fe 100644 Binary files a/frontend/public/assets/integrations/cipp-api.png and b/frontend/public/assets/integrations/cipp-api.png differ diff --git a/frontend/public/assets/integrations/gradient_dark.png b/frontend/public/assets/integrations/gradient_dark.png index d5bf84946a..f75878af25 100644 Binary files a/frontend/public/assets/integrations/gradient_dark.png and b/frontend/public/assets/integrations/gradient_dark.png differ diff --git a/frontend/public/favicon-16x16.png b/frontend/public/favicon-16x16.png index 248f0b1011..34174400cc 100644 Binary files a/frontend/public/favicon-16x16.png and b/frontend/public/favicon-16x16.png differ diff --git a/frontend/public/favicon-32x32.png b/frontend/public/favicon-32x32.png index 374d45216f..84268ee3d7 100644 Binary files a/frontend/public/favicon-32x32.png and b/frontend/public/favicon-32x32.png differ diff --git a/frontend/public/favicon-dark.png b/frontend/public/favicon-dark.png new file mode 100644 index 0000000000..d78a35283e Binary files /dev/null and b/frontend/public/favicon-dark.png differ diff --git a/frontend/public/favicon-light.png b/frontend/public/favicon-light.png new file mode 100644 index 0000000000..84268ee3d7 Binary files /dev/null and b/frontend/public/favicon-light.png differ diff --git a/frontend/public/favicon.ico b/frontend/public/favicon.ico index ea04bf0fe4..5ad95f488f 100644 Binary files a/frontend/public/favicon.ico and b/frontend/public/favicon.ico differ diff --git a/frontend/public/logo-dark.png b/frontend/public/logo-dark.png new file mode 100644 index 0000000000..b27dfdf207 Binary files /dev/null and b/frontend/public/logo-dark.png differ diff --git a/frontend/public/logo-light.png b/frontend/public/logo-light.png new file mode 100644 index 0000000000..c343b98460 Binary files /dev/null and b/frontend/public/logo-light.png differ diff --git a/frontend/public/logo.png b/frontend/public/logo.png index 4c080e46ea..c39f75a7dd 100644 Binary files a/frontend/public/logo.png and b/frontend/public/logo.png differ diff --git a/frontend/public/manage365-version.json b/frontend/public/manage365-version.json new file mode 100644 index 0000000000..3db8e7cc61 --- /dev/null +++ b/frontend/public/manage365-version.json @@ -0,0 +1,4 @@ +{ + "upstreamBaseline": "11.0.2", + "version": "6.1.10" +} diff --git a/frontend/public/manifest.json b/frontend/public/manifest.json index 3650aa8958..4be360b2a7 100644 --- a/frontend/public/manifest.json +++ b/frontend/public/manifest.json @@ -1,6 +1,6 @@ { - "short_name": "CIPP", - "name": "CIPP - CyberDrain Improved Partner Portal", + "short_name": "Manage365", + "name": "Manage365 - Microsoft 365 Management Portal", "icons": [ { "src": "favicon.ico", diff --git a/frontend/public/sponsors/RoB-light.png b/frontend/public/sponsors/RoB-light.png index 788811e2d3..d57972ec60 100644 Binary files a/frontend/public/sponsors/RoB-light.png and b/frontend/public/sponsors/RoB-light.png differ diff --git a/frontend/public/sponsors/RoB-light.svg b/frontend/public/sponsors/RoB-light.svg index 0673b2a8a4..844e789140 100644 --- a/frontend/public/sponsors/RoB-light.svg +++ b/frontend/public/sponsors/RoB-light.svg @@ -1,17 +1,10 @@ - - - - - - - - - - - - - - - - - \ No newline at end of file + + + + + + + + + + diff --git a/frontend/public/sponsors/RoB.png b/frontend/public/sponsors/RoB.png index 37da39dea6..40becff797 100644 Binary files a/frontend/public/sponsors/RoB.png and b/frontend/public/sponsors/RoB.png differ diff --git a/frontend/public/sponsors/RoB.svg b/frontend/public/sponsors/RoB.svg index d188e1eb54..1b800a2283 100644 --- a/frontend/public/sponsors/RoB.svg +++ b/frontend/public/sponsors/RoB.svg @@ -1,25 +1,10 @@ - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + diff --git a/frontend/public/sponsors/augmentt-dark.png b/frontend/public/sponsors/augmentt-dark.png index e642669ef1..e7b616366d 100644 Binary files a/frontend/public/sponsors/augmentt-dark.png and b/frontend/public/sponsors/augmentt-dark.png differ diff --git a/frontend/public/sponsors/augmentt-light.png b/frontend/public/sponsors/augmentt-light.png index 53415a0d3f..12007a9526 100644 Binary files a/frontend/public/sponsors/augmentt-light.png and b/frontend/public/sponsors/augmentt-light.png differ diff --git a/frontend/public/sponsors/rewst.png b/frontend/public/sponsors/rewst.png index f1c2a948af..01ed21c551 100644 Binary files a/frontend/public/sponsors/rewst.png and b/frontend/public/sponsors/rewst.png differ diff --git a/frontend/public/sponsors/rewst_dark.png b/frontend/public/sponsors/rewst_dark.png index 3813505213..0458a670f9 100644 Binary files a/frontend/public/sponsors/rewst_dark.png and b/frontend/public/sponsors/rewst_dark.png differ diff --git a/frontend/public/sw.js b/frontend/public/sw.js index 2947d3494a..74fa017b34 100644 --- a/frontend/public/sw.js +++ b/frontend/public/sw.js @@ -1,12 +1,11 @@ -// Minimal service worker: no caching or offline support, every request passes -// through to the network. It exists so the site is installable and so Web Push -// has somewhere to land when the app is closed. +// Minimal service worker: no caching or offline support. Requests go to the +// network because this worker does not handle fetch. It exists so the site is +// installable and so Web Push has somewhere to land when the app is closed. self.addEventListener('install', () => self.skipWaiting()) self.addEventListener('activate', (event) => event.waitUntil(self.clients.claim()) ) -self.addEventListener('fetch', () => {}) self.addEventListener('push', (event) => { let data = {} @@ -16,7 +15,7 @@ self.addEventListener('push', (event) => { data = { body: event.data ? event.data.text() : '' } } event.waitUntil( - self.registration.showNotification(data.title || 'CIPP', { + self.registration.showNotification(data.title || 'Manage365', { body: data.body || '', icon: '/android-chrome-192x192.png', badge: '/android-chrome-192x192.png', diff --git a/frontend/src/api/ApiCall.jsx b/frontend/src/api/ApiCall.jsx index 973b0610e5..efd299eff9 100644 --- a/frontend/src/api/ApiCall.jsx +++ b/frontend/src/api/ApiCall.jsx @@ -1,4 +1,10 @@ -import { useInfiniteQuery, useMutation, useQuery, useQueryClient } from "@tanstack/react-query"; +import { + keepPreviousData as keepPreviousDataFn, + useInfiniteQuery, + useMutation, + useQuery, + useQueryClient, +} from "@tanstack/react-query"; import axios, { isAxiosError } from "axios"; import { useDispatch } from "react-redux"; import { showToast } from "../store/toasts"; @@ -6,11 +12,107 @@ import { getCippError } from "../utils/get-cipp-error"; import { buildVersionedHeaders } from "../utils/cippVersion"; import { impersonationCacheParams } from "../utils/impersonation"; +export const STALE_TIMES = { + FAST: 60000, + DEFAULT: 600000, + STABLE: 1800000, + STATIC: 3600000, + INFINITE: Infinity, +}; + const escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); const wildcardToRegExp = (pattern) => new RegExp(`^${pattern.split("*").map(escapeRegExp).join(".*")}$`); const matchesWildcardPattern = (queryKey, pattern) => wildcardToRegExp(pattern).test(queryKey); +const DEFAULT_GET_TIMEOUT_MS = 90000; +const AUTH_LOGIN_REDIRECT_PATH = "/.auth/login/aad"; + +const assertRelativeApiPath = (value) => { + if (typeof value !== "string" || value.trim().length === 0) { + throw new Error("Refusing empty API path"); + } + const trimmed = value.trim(); + if (trimmed.includes("://") || trimmed.startsWith("//") || trimmed.includes("\\")) { + throw new Error("Refusing non-relative API path"); + } + return trimmed.startsWith("/") ? trimmed : `/${trimmed}`; +}; +// 503 is omitted: Craft sheds a saturated worker with 503 and asks the client to retry. +// A 4xx fails the same way on every attempt, except a timeout (408) or throttle (429). +const isNoRetryStatus = (status) => + status === 302 || + status === 500 || + status === 502 || + status === 504 || + (status >= 400 && status < 500 && status !== 408 && status !== 429); + +// A row the server answered with an error status is reported next to the others instead of +// abandoning the rest of a bulk request; anything without a response (cancel, network) still throws. +const bulkRowFailure = (error) => { + if (!error?.response) throw error; + return { Results: [{ resultText: getCippError(error), state: "error" }] }; +}; + +const getRedirectLocation = (headers) => { + if (!headers) { + return ""; + } + if (typeof headers.get === "function") { + return headers.get("location") || headers.get("Location") || ""; + } + return headers.location || headers.Location || ""; +}; + +const isAuthRedirectError = (error) => { + if (!isAxiosError(error) || error.response?.status !== 302) { + return false; + } + return getRedirectLocation(error.response.headers).includes(AUTH_LOGIN_REDIRECT_PATH); +}; + +const isSessionExpiredNetworkError = (error) => + isAxiosError(error) && + !error.response && + error.code === "ERR_NETWORK" && + error.config?.url?.startsWith("/api/"); + +const isCancelledRequest = (error) => + isAxiosError(error) && (error.code === "ERR_CANCELED" || error.name === "CanceledError"); + +const createApiRetryFn = ({ maxRetries, queryClient, dispatch, toast, getToastTitle }) => { + return (failureCount, error) => { + let returnRetry = true; + + if (isCancelledRequest(error)) { + returnRetry = false; + } else if (failureCount >= maxRetries) { + returnRetry = false; + } else if (isAxiosError(error) && isNoRetryStatus(error.response?.status ?? 0)) { + if (isAuthRedirectError(error)) { + queryClient.invalidateQueries({ queryKey: ["authmecipp"] }); + } + returnRetry = false; + } else if (isSessionExpiredNetworkError(error)) { + queryClient.invalidateQueries({ queryKey: ["authmecipp"] }); + queryClient.invalidateQueries({ queryKey: ["authmeswa"] }); + returnRetry = false; + } + + if (returnRetry === false && toast) { + const title = getToastTitle ? getToastTitle(error) : "Error"; + dispatch( + showToast({ + message: `${getCippError(error)}`, + title, + ...(title === "Error" ? { toastError: error } : {}), + }), + ); + } + + return returnRetry; + }; +}; // The server's Retry-After (seconds) as ms, capped so a large hint can't hang a request indefinitely. const getRetryAfterMs = (error) => { if (!isAxiosError(error)) return null; @@ -41,64 +143,60 @@ export function ApiGetCall(props) { bulkRequest = false, toast = false, onResult, - staleTime = 300000, + staleTime = STALE_TIMES.DEFAULT, // Default to 10 minutes refetchOnWindowFocus = false, refetchOnMount = true, refetchOnReconnect = true, + // Off by default: showing the previous query's data while a new key loads + // can flash another tenant's rows in tenant-keyed queries. Callers that + // want smooth transitions (e.g. the tenant selector) opt in explicitly. keepPreviousData = false, refetchInterval = false, responseType = "json", convertToDataUrl = false, + timeout = DEFAULT_GET_TIMEOUT_MS, } = props; + const queryClient = useQueryClient(); const dispatch = useDispatch(); - const MAX_RETRIES = retry; - const HTTP_STATUS_TO_NOT_RETRY = [302, 401, 403, 404, 500]; - const retryFn = (failureCount, error) => { - if (isCanceledError(error)) return false; - let returnRetry = true; - if (failureCount >= MAX_RETRIES) { - returnRetry = false; - } - if (isAxiosError(error) && HTTP_STATUS_TO_NOT_RETRY.includes(error.response?.status ?? 0)) { - if ( - error.response?.status === 302 && - error.response?.headers.get("location").includes("/.auth/login/aad") - ) { - queryClient.invalidateQueries({ queryKey: ["authmecipp"] }); - } - returnRetry = false; - } - if (returnRetry === false && toast) { - dispatch( - showToast({ - message: `${getCippError(error)}`, - title: `${ - error.config?.params?.tenantFilter ? error.config?.params?.tenantFilter : "" - } Error`, - }), - ); - } - return returnRetry; - }; + const retryFn = createApiRetryFn({ + maxRetries: retry, + queryClient, + dispatch, + toast, + getToastTitle: (error) => { + const tenant = error.config?.params?.tenantFilter; + return tenant ? `${tenant} Error` : "Error"; + }, + }); const queryInfo = useQuery({ enabled: waiting, queryKey: [queryKey], queryFn: async ({ signal }) => { + const safeUrl = assertRelativeApiPath(url); if (bulkRequest && Array.isArray(data)) { const results = []; for (let i = 0; i < data.length; i++) { const element = data[i]; - const response = await axios.get(url, { - signal: signal, - params: { ...element, ...impersonationCacheParams() }, - headers: await buildVersionedHeaders(), - cippQueryKey: queryKey, - }); - results.push(response.data); - if (onResult) { - onResult(response.data); // Emit each result as it arrives + try { + const response = await axios.get(safeUrl, { + signal: signal, + params: { ...element, ...impersonationCacheParams() }, + headers: await buildVersionedHeaders(), + timeout, + cippQueryKey: queryKey, + }); + results.push(response.data); + if (onResult) { + onResult(response.data); + } + } catch (error) { + const failed = bulkRowFailure(error); + results.push(failed); + if (onResult) { + onResult(failed, { failed: true }); + } } } if (relatedQueryKeys) { @@ -129,11 +227,12 @@ export function ApiGetCall(props) { } return results; } else { - const response = await axios.get(url, { + const response = await axios.get(safeUrl, { signal: url === "/api/tenantFilter" ? null : signal, params: { ...data, ...impersonationCacheParams() }, headers: await buildVersionedHeaders(), responseType: responseType, + timeout, cippQueryKey: queryKey, }); @@ -184,7 +283,9 @@ export function ApiGetCall(props) { refetchOnWindowFocus: refetchOnWindowFocus, refetchOnMount: refetchOnMount, refetchOnReconnect: refetchOnReconnect, - keepPreviousData: keepPreviousData, + // TanStack Query v5 removed the `keepPreviousData` option; the equivalent + // is passing its helper as placeholderData. + placeholderData: keepPreviousData ? keepPreviousDataFn : undefined, refetchInterval: refetchInterval, retry: retryFn, retryDelay: retryDelayWithRetryAfter, @@ -198,20 +299,25 @@ export function ApiPostCall({ relatedQueryKeys, onResult }) { const mutation = useMutation({ mutationFn: async (props) => { const { url, data, bulkRequest, followUps } = props; + const safeUrl = assertRelativeApiPath(url); + // Timeout so long-running backend calls don't hang the app (e.g. large site delete, slow APIs). + const timeoutMs = props.timeout ?? 90000; // 90 seconds default + const requestConfig = { + headers: await buildVersionedHeaders(), + timeout: timeoutMs, + }; if (followUps?.length) { // A failed primary request throws as usual and nothing else is sent. Once it has // succeeded, a failed follow-up is reported next to it rather than raised, so the // primary's results are never hidden behind a follow-up error. - const primary = await axios.post(url, data, { headers: await buildVersionedHeaders() }); + const primary = await axios.post(safeUrl, data, requestConfig); if (onResult) { onResult(primary.data); } const results = [primary.data]; for (const followUp of followUps) { try { - const response = await axios.post(followUp.url, followUp.data, { - headers: await buildVersionedHeaders(), - }); + const response = await axios.post(assertRelativeApiPath(followUp.url), followUp.data, requestConfig); results.push(response.data); } catch (error) { results.push({ @@ -226,17 +332,23 @@ export function ApiPostCall({ relatedQueryKeys, onResult }) { const results = []; for (let i = 0; i < data.length; i++) { let element = data[i]; - const response = await axios.post(url, element, { - headers: await buildVersionedHeaders(), - }); - results.push(response.data); - if (onResult) { - onResult(response.data); // Emit each result as it arrives + try { + const response = await axios.post(safeUrl, element, requestConfig); + results.push(response.data); + if (onResult) { + onResult(response.data); + } + } catch (error) { + const failed = bulkRowFailure(error); + results.push(failed); + if (onResult) { + onResult(failed, { failed: true }); + } } } return results; } else { - const response = await axios.post(url, data, { headers: await buildVersionedHeaders() }); + const response = await axios.post(safeUrl, data, requestConfig); if (onResult) { onResult(response.data); // Emit each result as it arrives } @@ -301,48 +413,28 @@ export function ApiGetCallWithPagination({ data, toast = false, waiting = true, + refetchOnMount = false, + timeout = DEFAULT_GET_TIMEOUT_MS, }) { const dispatch = useDispatch(); const queryClient = useQueryClient(); - const MAX_RETRIES = retry; - const HTTP_STATUS_TO_NOT_RETRY = [302, 401, 403, 404, 500]; - - const retryFn = (failureCount, error) => { - if (isCanceledError(error)) return false; - let returnRetry = true; - if (failureCount >= MAX_RETRIES) { - returnRetry = false; - } - if (isAxiosError(error) && HTTP_STATUS_TO_NOT_RETRY.includes(error.response?.status ?? 0)) { - if ( - error.response?.status === 302 && - error.response?.headers.get("location").includes("/.auth/login/aad") - ) { - queryClient.invalidateQueries({ queryKey: ["authmecipp"] }); - } - returnRetry = false; - } - - if (returnRetry === false && toast) { - dispatch( - showToast({ - message: getCippError(error), - title: "Error", - toastError: error, - }), - ); - } - return returnRetry; - }; + const retryFn = createApiRetryFn({ + maxRetries: retry, + queryClient, + dispatch, + toast, + }); const queryInfo = useInfiniteQuery({ queryKey: [queryKey], enabled: waiting, queryFn: async ({ pageParam = null, signal }) => { - const response = await axios.get(url, { + const safeUrl = assertRelativeApiPath(url); + const response = await axios.get(safeUrl, { signal: signal, params: { ...data, ...pageParam, ...impersonationCacheParams() }, headers: await buildVersionedHeaders(), + timeout, cippQueryKey: queryKey, }); return response.data; @@ -358,8 +450,9 @@ export function ApiGetCallWithPagination({ } return lastPage?.Metadata?.nextLink ? { nextLink: lastPage.Metadata.nextLink } : undefined; }, - staleTime: 300000, + staleTime: STALE_TIMES.DEFAULT, refetchOnWindowFocus: false, + refetchOnMount: refetchOnMount, retry: retryFn, retryDelay: retryDelayWithRetryAfter, }); diff --git a/frontend/src/components/CippAllTenants/AllTenantsDashboard.jsx b/frontend/src/components/CippAllTenants/AllTenantsDashboard.jsx index 755f034eb1..db192e7813 100644 --- a/frontend/src/components/CippAllTenants/AllTenantsDashboard.jsx +++ b/frontend/src/components/CippAllTenants/AllTenantsDashboard.jsx @@ -5,6 +5,7 @@ import Link from 'next/link' import { Button } from '@mui/material' import { getCippError } from '../../utils/get-cipp-error' import { CippInfoBar } from '../CippCards/CippInfoBar' +import { ServiceHealthCard } from '../CippComponents/ServiceHealthCard' import { useAllTenantsDashboard } from './useAllTenantsDashboard' import { AllTenantsBandHeading, @@ -443,6 +444,12 @@ export const AllTenantsDashboard = () => { description="What is broken, expiring, or stuck right now" /> + {/* Outages first: a Microsoft incident explains the errors and failed checks below it. + AllTenants reads the nightly cache, each issue once with the tenants it reached. */} + + + + {canReadLogs && ( diff --git a/frontend/src/components/CippCards/CippBecRunStatusCard.jsx b/frontend/src/components/CippCards/CippBecRunStatusCard.jsx index 997fba06c2..d8bf42d1f1 100644 --- a/frontend/src/components/CippCards/CippBecRunStatusCard.jsx +++ b/frontend/src/components/CippCards/CippBecRunStatusCard.jsx @@ -42,7 +42,6 @@ export const CippBecRunStatusCard = ({ poll, onStart, startPending = false, - windowDays = 7, }) => { const progress = poll?.Progress const steps = Array.isArray(progress?.Steps) ? progress.Steps : [] @@ -160,9 +159,9 @@ export const CippBecRunStatusCard = ({ return to, report on and export evidence from. - The investigation reads the last {windowDays} days of audit records, - sign-ins, permissions, rules, consents, devices and trace headers - across 21 checks. It collects metadata only - never message content + The investigation reads the last 7 days (30 for tenants with Entra + ID P1 or P2) of audit records, sign-ins, permissions, rules, + consents, devices and trace headers across 21 checks. It collects metadata only - never message content - and usually takes a few minutes. diff --git a/frontend/src/components/CippCards/CippBecTriageHeader.jsx b/frontend/src/components/CippCards/CippBecTriageHeader.jsx index 4e71e3d989..12bc0eae08 100644 --- a/frontend/src/components/CippCards/CippBecTriageHeader.jsx +++ b/frontend/src/components/CippCards/CippBecTriageHeader.jsx @@ -128,6 +128,13 @@ export const CippBecTriageHeader = ({ label={`${score.Level} · ${score.Value}`} /> )} + {becData && ( + + )} } diff --git a/frontend/src/components/CippCards/CippButtonCard.jsx b/frontend/src/components/CippCards/CippButtonCard.jsx index d37c65569e..6efdda7daf 100644 --- a/frontend/src/components/CippCards/CippButtonCard.jsx +++ b/frontend/src/components/CippCards/CippButtonCard.jsx @@ -21,26 +21,39 @@ export default function CippButtonCard({ cardSx, cardActions, variant, - component = 'card', + component = "card", accordionExpanded = false, onAccordionChange, }) { - const [cardExpanded, setCardExpanded] = useState(accordionExpanded) + const [cardExpanded, setCardExpanded] = useState(accordionExpanded); useEffect(() => { if (accordionExpanded !== cardExpanded) { - setCardExpanded(accordionExpanded) + setCardExpanded(accordionExpanded); } - }, [accordionExpanded]) + }, [accordionExpanded]); useEffect(() => { if (onAccordionChange) { - onAccordionChange(cardExpanded) + onAccordionChange(cardExpanded); } - }, [cardExpanded]) + }, [cardExpanded]); + + const hasInteraction = !!CardButton || !!cardActions; return ( - - {component === 'card' && ( + theme.shadows[4], + }, + }), + ...cardSx, + }} + > + {component === "card" && ( <> {title && ( <> @@ -54,14 +67,14 @@ export default function CippButtonCard({ )} - + {isFetching ? : children} {CardButton && {CardButton}} )} - {component === 'accordion' && ( + {component === "accordion" && ( } @@ -70,7 +83,7 @@ export default function CippButtonCard({ - + {isFetching ? : children} {CardButton && {CardButton}} @@ -78,5 +91,5 @@ export default function CippButtonCard({ )} - ) + ); } diff --git a/frontend/src/components/CippCards/CippChartCard.jsx b/frontend/src/components/CippCards/CippChartCard.jsx index 799d0840dc..053fff3177 100644 --- a/frontend/src/components/CippCards/CippChartCard.jsx +++ b/frontend/src/components/CippCards/CippChartCard.jsx @@ -8,17 +8,26 @@ import { Skeleton, Stack, Typography, + useMediaQuery, } from "@mui/material"; import { useTheme } from "@mui/material/styles"; import { ActionsMenu } from "../actions-menu"; import { Chart } from "../chart"; +import { chartPink } from "../../theme/colors"; -const useChartOptions = (labels, chartType, colors, onSegmentClick) => { +const useChartOptions = (labels, chartType, customColors = null, onSegmentClick) => { const theme = useTheme(); const longBarLabels = chartType === "bar" && (labels.length > 6 || labels.some((label) => String(label ?? "").length > 18)); + const defaultColors = [ + theme.palette.success.main, + theme.palette.warning.main, + theme.palette.error.main, + chartPink, + ]; + return { chart: { background: "transparent", @@ -43,12 +52,7 @@ const useChartOptions = (labels, chartType, colors, onSegmentClick) => { }, }, }, - colors: colors ?? [ - theme.palette.success.main, - theme.palette.warning.main, - theme.palette.error.main, - theme.palette.neutral[200], - ], + colors: customColors || defaultColors, dataLabels: { enabled: false, }, @@ -126,13 +130,19 @@ export const CippChartCard = ({ chartType = "donut", title, actions, - headerAction, onClick, onSegmentClick, totalLabel = "Total", customTotal, - colors, + compact = false, + showHeaderDivider = true, + headerIcon = null, + horizontalLayout = false, + formatValue = null, + colors = null, }) => { + const theme = useTheme(); + const smDown = useMediaQuery(theme.breakpoints.down("sm")); const [range, setRange] = useState("Last 7 days"); const [barSeries, setBarSeries] = useState([]); // A stable handler so a parent re-render does not hand the chart new options to redraw. @@ -148,10 +158,22 @@ export const CippChartCard = ({ onSegmentClick ? handleSegment : undefined ); chartSeries = chartSeries.filter((item) => item !== null); - // Round to 2 decimals - summing fractional series values accumulates floating-point - // artifacts (e.g. 175.73000000000002). Integer series are unaffected. - const calculatedTotal = Math.round(chartSeries.reduce((acc, value) => acc + value, 0) * 100) / 100; + const calculatedTotal = chartSeries.reduce((acc, value) => acc + value, 0); const total = customTotal !== undefined ? customTotal : calculatedTotal; + const chartHeight = compact ? 200 : 280; + const contentPadding = compact ? 1.5 : 2; + const rowPadding = compact ? 0.5 : 1; + const labelVariant = compact ? "caption" : "body2"; + const totalVariant = compact ? "subtitle1" : "h5"; + const titleVariant = compact ? "subtitle1" : "h6"; + + // Helper to format display values + const displayValue = (value) => (formatValue ? formatValue(value) : value); + + // For horizontal layout, use smaller chart height to fit side by side + const horizontalChartHeight = compact ? 180 : 240; + const useHorizontal = horizontalLayout && !smDown; + useEffect(() => { if (chartType === "bar") { // Single named series with the labels supplied via xaxis.categories. This keeps the tooltip @@ -161,13 +183,80 @@ export const CippChartCard = ({ // eslint-disable-next-line react-hooks/exhaustive-deps }, [chartType, chartSeries.join(","), labels.join(","), totalLabel]); + const renderLegend = () => ( + + {isFetching ? ( + + ) : ( + <> + {labels.length > 0 && + chartSeries.map((item, index) => ( + + + + + {labels[index]} + + + + {displayValue(item)} + + + ))} + + )} + + ); + + const renderTotal = () => ( + + {labels.length > 0 && ( + <> + {totalLabel} + {isFetching ? "0" : displayValue(total)} + + )} + + ); + return ( ) : null } - title={title} - /> - - - { - //if the chartType is not defined or the data is fetching, show a skeleton; an empty - //series after loading is real data ("nothing to chart"), not a loading state - chartType === undefined || isFetching ? ( - - ) : chartSeries.length === 0 ? ( - - - No data to display - + title={ + headerIcon ? ( + + {headerIcon} + {title} ) : ( - + title ) } - - {labels.length > 0 && ( - <> - {totalLabel} - {isFetching ? "0" : total} - - )} - - - {isFetching ? ( - - ) : ( - <> - { - //only show the labels if there are labels - labels.length > 0 && - chartSeries.map((item, index) => ( - { - event.stopPropagation(); - onSegmentClick(labels[index], index); - } - : undefined - } - sx={{ - alignItems: "center", - justifyContent: "space-between", - py: 1, - ...(onSegmentClick && { - cursor: "pointer", - borderRadius: 1, - "&:hover": { bgcolor: "action.hover" }, - }), - }}> - {/* minWidth: 0 both here and on the label: labels are API free text - (recipient addresses, SharePoint URLs), and flexbox's min-width: - auto otherwise refuses to shrink them, pushing rows out of the card */} - - - - {labels[index]} - - - - {item} - - - )) - } - - )} - + sx={headerIcon ? { pb: compact ? 0.5 : 1 } : undefined} + /> + {showHeaderDivider && } + + {useHorizontal ? ( + // Horizontal layout: chart on left, legend on right + + + {chartType === undefined || isFetching ? ( + + ) : chartSeries.length === 0 ? ( + + + No data to display + + + ) : ( + + )} + + + {renderTotal()} + {renderLegend()} + + + ) : ( + // Vertical layout (default): chart on top, legend below + <> + {chartType === undefined || isFetching ? ( + + ) : chartSeries.length === 0 ? ( + + + No data to display + + + ) : ( + + )} + {renderTotal()} + {renderLegend()} + + )} ); diff --git a/frontend/src/components/CippCards/CippDomainCards.jsx b/frontend/src/components/CippCards/CippDomainCards.jsx index 465e570d9a..820101e9f4 100644 --- a/frontend/src/components/CippCards/CippDomainCards.jsx +++ b/frontend/src/components/CippCards/CippDomainCards.jsx @@ -12,6 +12,7 @@ import { Stack, Divider, FormControlLabel, + useTheme, } from "@mui/material"; import { Grid } from "@mui/system"; import { Controller, useForm } from "react-hook-form"; @@ -61,6 +62,7 @@ const ResultList = ({ passes = [], warns = [], fails = [] }) => ( // Custom MX Results Card component const MXResultsCard = ({ domain, mxData, isFetching }) => { const [visible, setVisible] = useState(false); + const theme = useTheme(); const handleDetailsClick = () => { setVisible(true); @@ -111,7 +113,7 @@ const MXResultsCard = ({ domain, mxData, isFetching }) => { Mail Provider: - + )} diff --git a/frontend/src/components/CippCards/CippExchangeInfoCard.jsx b/frontend/src/components/CippCards/CippExchangeInfoCard.jsx index 8395436f38..0e58e35d5f 100644 --- a/frontend/src/components/CippCards/CippExchangeInfoCard.jsx +++ b/frontend/src/components/CippCards/CippExchangeInfoCard.jsx @@ -1,8 +1,9 @@ -import PropTypes from 'prop-types' -import { CippIcons } from '../../utils/icon-registry' +import PropTypes from "prop-types"; +import { useState, useEffect } from "react"; +import { CippIcons } from "../../utils/icon-registry"; import { Card, - CardHeader, + CardContent, Divider, Skeleton, Chip, @@ -10,383 +11,1611 @@ import { Typography, CircularProgress, Alert, -} from '@mui/material' -import { PropertyList } from '../property-list' -import { PropertyListItem } from '../property-list-item' -import { getCippFormatting } from '../../utils/get-cipp-formatting' -import { LinearProgressWithLabel } from '../linearProgressWithLabel' -import { Stack, Grid } from '@mui/system' + Paper, + LinearProgress, + Tooltip, + Dialog, + DialogTitle, + DialogContent, + DialogContentText, + DialogActions, + Button, + Collapse, + TextField, +} from "@mui/material"; +import { getCippFormatting } from "../../utils/get-cipp-formatting"; +import { + Check as CheckIcon, + Close as CloseIcon, + Sync, + Mail, + Storage, + Forward, + Archive, + Security, + SettingsEthernet, + Warning, + CheckCircle, + Block, + VisibilityOff, + Info as InfoIcon, + ExpandMore, + ExpandLess, +} from "@mui/icons-material"; +import { Stack, Grid, Box } from "@mui/system"; +import { alpha, useTheme } from "@mui/material/styles"; +import { ApiPostCall } from "../../api/ApiCall"; +import { useSettings } from "../../hooks/use-settings"; +import { CippApiResults } from "../CippComponents/CippApiResults"; +import NextLink from "next/link"; + +// Section component for consistent styling +const InfoSection = ({ icon: Icon, title, children }) => ( + + + + + {title} + + + {children} + +); + +// Stat card component for key metrics +const StatCard = ({ icon: Icon, label, value, color = "primary", subtitle }) => { + const theme = useTheme(); + // Handle "default" color by using grey + const paletteColor = color === "default" ? theme.palette.grey[500] : theme.palette[color]?.main || theme.palette.grey[500]; + + return ( + + + + {label} + + + {value} + + {subtitle && ( + + {subtitle} + + )} + + ); +}; + +// Format camelCase or PascalCase strings to have spaces (e.g., "UserMailbox" -> "User Mailbox") +const formatMailboxType = (type) => { + if (!type) return "N/A"; + return type.replace(/([a-z])([A-Z])/g, "$1 $2"); +}; + +const LITIGATION_HOLD_ELIGIBLE_LICENSES = [ + "Microsoft 365 Business Premium", + "Microsoft 365 E3 or E5", + "Office 365 E3 or E5", + "Exchange Online Plan 2", + "Exchange Online Plan 1 plus Exchange Online Archiving add-on", +]; export const CippExchangeInfoCard = (props) => { - const { exchangeData, isLoading = false, isFetching = false, handleRefresh, ...other } = props - - // Define the protocols array - const protocols = [ - { name: 'EWS', enabled: exchangeData?.EWSEnabled }, - { name: 'MAPI', enabled: exchangeData?.MailboxMAPIEnabled }, - { name: 'OWA', enabled: exchangeData?.MailboxOWAEnabled }, - { name: 'IMAP', enabled: exchangeData?.MailboxImapEnabled }, - { name: 'POP', enabled: exchangeData?.MailboxPopEnabled }, - { name: 'ActiveSync', enabled: exchangeData?.MailboxActiveSyncEnabled }, + const { + exchangeData, + isLoading = false, + isFetching = false, + handleRefresh, + userPrincipalName, + userId, + ...other + } = props; + const theme = useTheme(); + const settings = useSettings(); + + // State for protocol toggle dialog (supports single protocol or array for "disable both") + const [protocolDialog, setProtocolDialog] = useState({ + open: false, + protocol: null, // Can be string or array of strings + currentlyEnabled: false, + }); + const [isToggling, setIsToggling] = useState(false); + + // State for GAL visibility dialog + const [galDialog, setGalDialog] = useState(false); + const [isTogglingGal, setIsTogglingGal] = useState(false); + + // State for spam status dialog + const [spamDialog, setSpamDialog] = useState(false); + const [isClearingSpam, setIsClearingSpam] = useState(false); + + // State for hold toggle dialog + const [holdDialog, setHoldDialog] = useState({ + open: false, + holdType: null, + currentlyEnabled: false, + }); + const [isTogglingHold, setIsTogglingHold] = useState(false); + const [litigationDays, setLitigationDays] = useState(""); + + const [restrictionDialog, setRestrictionDialog] = useState({ + open: false, + direction: null, + currentlyBlocked: false, + }); + const [isTogglingRestriction, setIsTogglingRestriction] = useState(false); + + // API call for toggling protocols + const toggleProtocol = ApiPostCall({ + urlFromData: true, + relatedQueryKeys: [`Mailbox-${exchangeData?.UserId}`], + }); + + // API call for toggling GAL visibility + const toggleGalVisibility = ApiPostCall({ + urlFromData: true, + relatedQueryKeys: [`Mailbox-${exchangeData?.UserId}`], + }); + + // API call for clearing spam status + const clearSpamStatus = ApiPostCall({ + urlFromData: true, + relatedQueryKeys: [`Mailbox-${exchangeData?.UserId}`], + }); + + // API call for toggling holds + const toggleHold = ApiPostCall({ + urlFromData: true, + relatedQueryKeys: [`Mailbox-${exchangeData?.UserId}`], + }); + + const toggleRestriction = ApiPostCall({ + urlFromData: true, + relatedQueryKeys: [`Mailbox-${exchangeData?.UserId}`], + }); + + const handleRestrictionClick = (direction, isBlocked) => { + toggleRestriction.reset(); + setRestrictionDialog({ open: true, direction, currentlyBlocked: isBlocked }); + }; + + const handleRestrictionDialogClose = () => { + setRestrictionDialog({ open: false, direction: null, currentlyBlocked: false }); + toggleRestriction.reset(); + }; + + const handleRestrictionToggle = async () => { + const { direction, currentlyBlocked } = restrictionDialog; + setIsTogglingRestriction(true); + + try { + await toggleRestriction.mutateAsync({ + url: "/api/ExecSetMailboxRestriction", + data: { + tenantFilter: settings.currentTenant, + UserId: userPrincipalName, + Direction: direction, + Enable: !currentlyBlocked, + }, + }); + if (handleRefresh) handleRefresh(); + handleRestrictionDialogClose(); + } catch (error) { + console.error("Failed to toggle mailbox restriction:", error); + } finally { + setIsTogglingRestriction(false); + } + }; + + const licensedForLitigationHold = exchangeData?.MailboxActionsData?.LicensedForLitigationHold; + + const handleHoldClick = (holdType, isEnabled) => { + toggleHold.reset(); + setLitigationDays(""); + setHoldDialog({ open: true, holdType, currentlyEnabled: isEnabled }); + }; + + const handleHoldDialogClose = () => { + setHoldDialog({ open: false, holdType: null, currentlyEnabled: false }); + setLitigationDays(""); + toggleHold.reset(); + }; + + const handleHoldToggle = async () => { + const { holdType, currentlyEnabled } = holdDialog; + setIsTogglingHold(true); + + const isLitigation = holdType === "Litigation"; + const url = isLitigation ? "/api/ExecSetLitigationHold" : "/api/ExecSetRetentionHold"; + const data = { + tenantFilter: settings.currentTenant, + Identity: userPrincipalName, + UPN: userPrincipalName, + disable: currentlyEnabled, + }; + if (isLitigation && !currentlyEnabled && litigationDays) { + data.days = parseInt(litigationDays, 10); + } + + try { + await toggleHold.mutateAsync({ url, data }); + if (handleRefresh) handleRefresh(); + handleHoldDialogClose(); + } catch (error) { + console.error("Failed to toggle hold:", error); + } finally { + setIsTogglingHold(false); + } + }; + + // Handle protocol chip click (supports single protocol or array for "disable both") + const handleProtocolClick = (protocol, isEnabled) => { + setProtocolDialog({ + open: true, + protocol, // Can be string or array + currentlyEnabled: isEnabled, + }); + }; + + // Handle dialog close + const handleDialogClose = () => { + setProtocolDialog({ + open: false, + protocol: null, + currentlyEnabled: false, + }); + }; + + // Handle protocol toggle confirmation + const handleProtocolToggle = async () => { + const { protocol, currentlyEnabled } = protocolDialog; + setIsToggling(true); + + try { + // Support both single protocol and multiple protocols + const isMultiple = Array.isArray(protocol); + await toggleProtocol.mutateAsync({ + url: "/api/ExecSetCASMailbox", + data: { + user: userPrincipalName, + tenantFilter: settings.currentTenant, + ...(isMultiple ? { protocols: protocol.join(",") } : { protocol: protocol }), + enable: !currentlyEnabled, + }, + }); + + // Refresh the data after successful toggle + if (handleRefresh) { + handleRefresh(); + } + } catch (error) { + console.error("Failed to toggle protocol:", error); + } finally { + setIsToggling(false); + handleDialogClose(); + } + }; + + // Handle GAL visibility toggle + const handleGalToggle = async () => { + setIsTogglingGal(true); + + try { + await toggleGalVisibility.mutateAsync({ + url: "/api/ExecHideFromGAL", + data: { + ID: userPrincipalName, + tenantFilter: settings.currentTenant, + HideFromGAL: !exchangeData?.HiddenFromAddressLists, + }, + }); + + // Refresh the data after successful toggle + if (handleRefresh) { + handleRefresh(); + } + } catch (error) { + console.error("Failed to toggle GAL visibility:", error); + } finally { + setIsTogglingGal(false); + setGalDialog(false); + } + }; + + // Handle clearing spam status + const handleClearSpam = async () => { + setIsClearingSpam(true); + + try { + await clearSpamStatus.mutateAsync({ + url: "/api/ExecRemoveRestrictedUser", + data: { + SenderAddress: userPrincipalName, + tenantFilter: settings.currentTenant, + }, + }); + + // Refresh the data after successful clear + if (handleRefresh) { + handleRefresh(); + } + } catch (error) { + console.error("Failed to clear spam status:", error); + } finally { + setIsClearingSpam(false); + setSpamDialog(false); + } + }; + + // Define the protocols array with detailed information + const protocolInfo = { + EWS: { + fullName: "Exchange Web Services", + affectedApps: "Outlook for Windows (older versions), Outlook for Mac (older versions), third-party apps using EWS API, calendar sync tools, and some backup solutions", + securityRisk: "medium", + recommendation: "Consider disabling if not needed. Modern Outlook uses REST/Graph API instead.", + }, + MAPI: { + fullName: "MAPI over HTTP", + affectedApps: "Outlook for Windows (desktop client), some third-party email clients, and legacy applications", + securityRisk: "low", + recommendation: "Generally safe to keep enabled for Outlook desktop users.", + }, + OWA: { + fullName: "Outlook on the Web", + affectedApps: "Outlook Web App (browser access), Outlook PWA (Progressive Web App)", + securityRisk: "low", + recommendation: "Keep enabled for web-based email access. Protected by modern authentication.", + }, + IMAP: { + fullName: "Internet Message Access Protocol", + affectedApps: "Apple Mail (macOS/iOS), Thunderbird, Android Gmail app, third-party email clients, and legacy applications", + securityRisk: "high", + recommendation: "Disable if not needed. Legacy protocol that may use basic authentication.", + }, + POP: { + fullName: "Post Office Protocol", + affectedApps: "Legacy email clients, some older mobile apps, and applications that download email locally", + securityRisk: "high", + recommendation: "Disable if not needed. Outdated protocol with security concerns.", + }, + ActiveSync: { + fullName: "Exchange ActiveSync", + affectedApps: "Native iOS Mail app, native Android Mail app, Windows Mail app, and mobile device management (MDM) solutions", + securityRisk: "medium", + recommendation: "Keep enabled for mobile device access unless using Outlook mobile app exclusively.", + }, + SMTP: { + fullName: "SMTP Client Authentication (Basic Auth)", + affectedApps: "Multifunction printers/scanners, line-of-business apps, and scripts that send mail with a username and password", + securityRisk: "high", + recommendation: "Disable unless a device or app must send mail with basic authentication.", + }, + }; + + // Modern protocols (recommended) + const modernProtocols = [ + { name: "EWS", enabled: exchangeData?.EWSEnabled, ...protocolInfo.EWS }, + { name: "MAPI", enabled: exchangeData?.MailboxMAPIEnabled, ...protocolInfo.MAPI }, + { name: "OWA", enabled: exchangeData?.MailboxOWAEnabled, ...protocolInfo.OWA }, + { name: "ActiveSync", enabled: exchangeData?.MailboxActiveSyncEnabled, ...protocolInfo.ActiveSync }, + ]; + + // Legacy protocols (security risk) + // SMTP client auth is inverted in EXO: SmtpClientAuthenticationDisabled true = secure, + // false = basic auth enabled (risk), null = follows the org-wide default (unknown here). + const legacyProtocols = [ + { name: "IMAP", enabled: exchangeData?.MailboxImapEnabled, ...protocolInfo.IMAP }, + { name: "POP", enabled: exchangeData?.MailboxPopEnabled, ...protocolInfo.POP }, { - // SMTP client auth is inverted: true = disabled (secure), false = enabled (risk), - // null = unknown. Label spells out the state so a green chip isn't misread as "on". - name: - exchangeData?.SmtpClientAuthenticationDisabled == null - ? 'SMTP Unknown' - : exchangeData?.SmtpClientAuthenticationDisabled === false - ? 'SMTP Enabled' - : 'SMTP Disabled', + name: "SMTP", enabled: exchangeData?.SmtpClientAuthenticationDisabled === false, unknown: exchangeData?.SmtpClientAuthenticationDisabled == null, - riskWhenEnabled: true, + ...protocolInfo.SMTP, }, - ] + ]; + + // Combined for dialog lookups + const protocols = [...modernProtocols, ...legacyProtocols]; + + // Track if any legacy protocol is enabled + const anyLegacyEnabled = legacyProtocols.some(p => p.enabled); + + // Track if both IMAP and POP are enabled (for "disable both" button) + const bothLegacyEnabled = legacyProtocols + .filter((p) => p.name === "IMAP" || p.name === "POP") + .every((p) => p.enabled); + + // State for legacy protocols section expansion + const [legacyProtocolsExpanded, setLegacyProtocolsExpanded] = useState(anyLegacyEnabled); + + // Auto-expand/collapse legacy section based on protocol status + useEffect(() => { + if (anyLegacyEnabled) { + setLegacyProtocolsExpanded(true); + } else { + setLegacyProtocolsExpanded(false); + } + }, [anyLegacyEnabled]); // Define mailbox hold types array const holds = [ - { name: 'Compliance Tag Hold', enabled: exchangeData?.ComplianceTagHold }, - { name: 'Retention Hold', enabled: exchangeData?.RetentionHold }, - { name: 'Litigation Hold', enabled: exchangeData?.LitigationHold }, - { name: 'In-Place Hold', enabled: exchangeData?.InPlaceHold }, - { name: 'eDiscovery Hold', enabled: exchangeData?.EDiscoveryHold }, - { name: 'Purview Retention Hold', enabled: exchangeData?.PurviewRetentionHold }, - { name: 'Excluded from Org-Wide Hold', enabled: exchangeData?.ExcludedFromOrgWideHold }, - ] + { name: "Litigation", enabled: exchangeData?.LitigationHold, toggleable: true }, + { name: "Retention", enabled: exchangeData?.RetentionHold, toggleable: true }, + { name: "Compliance Tag", enabled: exchangeData?.ComplianceTagHold, toggleable: false }, + { name: "In-Place", enabled: exchangeData?.InPlaceHold, toggleable: false }, + { name: "eDiscovery", enabled: exchangeData?.EDiscoveryHold, toggleable: false }, + { name: "Purview Retention", enabled: exchangeData?.PurviewRetentionHold, toggleable: false }, + ]; + + const activeHolds = holds.filter(h => h.enabled); + const enabledProtocols = protocols.filter(p => p.enabled); + + // Calculate usage percentage + const usagePercent = exchangeData?.TotalItemSize && exchangeData?.ProhibitSendReceiveQuota + ? Math.round((exchangeData.TotalItemSize / exchangeData.ProhibitSendReceiveQuota) * 100) + : 0; + + // Determine forwarding status + const forwardingAddress = exchangeData?.ForwardingAddress; + let forwardingType = "None"; + let cleanAddress = ""; + if (forwardingAddress) { + if (forwardingAddress.startsWith("smtp:")) { + forwardingType = "External"; + cleanAddress = forwardingAddress.replace("smtp:", ""); + } else { + forwardingType = "Internal"; + cleanAddress = forwardingAddress; + } + } + + if (isLoading) { + return ( + + + + + + + + + + ); + } return ( - - Exchange Information + + {/* Header */} + + + + + + Exchange Mailbox + + {isFetching ? ( ) : ( - - - + + + + + )} - } - /> - {exchangeData?.BlockedForSpam === true ? ( - - This mailbox is currently blocked for spam. - - ) : null} - - - - ) : ( - - - - Mailbox Type: - - - {exchangeData?.RecipientTypeDetails || 'N/A'} - - - - - Hidden from GAL: - - - {getCippFormatting( - exchangeData?.HiddenFromAddressLists, - 'HiddenFromAddressLists' - )} - - - - - Blocked For Spam: - - - {getCippFormatting(exchangeData?.BlockedForSpam, 'BlockedForSpam')} - - - - - Retention Policy: - - - {getCippFormatting(exchangeData?.RetentionPolicy, 'RetentionPolicy')} - - - - ) - } - /> - - ) : exchangeData?.TotalItemSize != null ? ( - + This mailbox is currently blocked for spam. + + )} + + {/* Quick Stats */} + + + + + + + + + 0 ? activeHolds.length : "None"} + color={activeHolds.length > 0 ? "warning" : "success"} + /> + + + + + + + + {/* Content */} + + {/* Storage Usage */} + + + + + Mailbox Size + + + {exchangeData?.TotalItemSize != null + ? `${Math.round(exchangeData.TotalItemSize * 100) / 100} GB` + : "N/A"} + {exchangeData?.ProhibitSendReceiveQuota && ( + + {" "}/ {Math.round(exchangeData.ProhibitSendReceiveQuota)} GB + + )} + + + 90 + ? theme.palette.error.main + : usagePercent > 75 + ? theme.palette.warning.main + : theme.palette.primary.main, + }, + }} /> - ) : ( - 'N/A' - ) - } - /> - - ) : ( - (() => { - const forwardingAddress = exchangeData?.ForwardingAddress - const forwardAndDeliver = exchangeData?.ForwardAndDeliver - - // Determine forwarding type and clean address - let forwardingType = 'None' - let cleanAddress = '' - - if (forwardingAddress) { - // Handle array of forwarding addresses - if (Array.isArray(forwardingAddress)) { - cleanAddress = forwardingAddress - .map((addr) => - typeof addr === 'string' ? addr.replace(/^smtp:/i, '') : String(addr) - ) - .join(', ') - // Check if any address has smtp: prefix (external) or contains @ (external email) - forwardingType = forwardingAddress.some( - (addr) => - (typeof addr === 'string' && addr.toLowerCase().startsWith('smtp:')) || - (typeof addr === 'string' && addr.includes('@')) - ) - ? 'External' - : 'Internal' - } - // Handle single string address - else if (typeof forwardingAddress === 'string') { - if (forwardingAddress.startsWith('smtp:')) { - forwardingType = 'External' - cleanAddress = forwardingAddress.replace(/^smtp:/i, '') - } else if (forwardingAddress.includes('@')) { - forwardingType = 'External' - cleanAddress = forwardingAddress - } else { - forwardingType = 'Internal' - cleanAddress = forwardingAddress - } - } - // Fallback for other types - else { - forwardingType = 'Internal' - cleanAddress = String(forwardingAddress) - } - } + + {usagePercent}% used + + + - return ( - - - - Forwarding Status: - - - {forwardingType === 'None' - ? getCippFormatting(false, 'ForwardingStatus') - : `${forwardingType} Forwarding`} - - - {forwardingType !== 'None' && ( - <> - - - Keep Copy in Mailbox: - - - {getCippFormatting(forwardAndDeliver, 'ForwardAndDeliver')} - - - - - Forwarding Address: - - {cleanAddress} - - - )} - - ); - })() - ) - } - /> - - {/* Archive section - always show status */} - + + + {/* Mailbox Settings */} + + + + + setGalDialog(true) : undefined} + sx={{ + p: 1.5, + cursor: userPrincipalName ? "pointer" : "default", + transition: "all 0.15s ease-in-out", + "&:hover": userPrincipalName ? { + borderColor: "primary.main", + bgcolor: (theme) => alpha(theme.palette.primary.main, 0.04), + } : {}, + }} + > + + {isTogglingGal ? ( + + ) : exchangeData?.HiddenFromAddressLists ? ( + + ) : ( + + )} + + + Address List + + + {exchangeData?.HiddenFromAddressLists ? "Hidden" : "Visible"} + + + + + + + + + setSpamDialog(true) : undefined} + sx={{ + p: 1.5, + cursor: exchangeData?.BlockedForSpam && userPrincipalName ? "pointer" : "default", + transition: "all 0.15s ease-in-out", + "&:hover": exchangeData?.BlockedForSpam && userPrincipalName ? { + borderColor: "error.main", + bgcolor: (theme) => alpha(theme.palette.error.main, 0.04), + } : {}, + }} + > + + {isClearingSpam ? ( + + ) : exchangeData?.BlockedForSpam ? ( + + ) : ( + + )} + + + Spam Status + + + {exchangeData?.BlockedForSpam ? "Blocked" : "Clear"} + + + + + + + + + handleRestrictionClick("Inbound", exchangeData?.BlockExternalInbound === true) : undefined} + sx={{ + p: 1.5, + cursor: userPrincipalName ? "pointer" : "default", + transition: "all 0.15s ease-in-out", + "&:hover": userPrincipalName ? { + borderColor: "primary.main", + bgcolor: (theme) => alpha(theme.palette.primary.main, 0.04), + } : {}, + }} + > + + {isTogglingRestriction && restrictionDialog.direction === "Inbound" ? ( + + ) : exchangeData?.BlockExternalInbound === true ? ( + + ) : ( + + )} + + + Ext. Inbound + + + {exchangeData?.BlockExternalInbound === true ? "Blocked" : "Allowed"} + + + + + + + + + handleRestrictionClick("Outbound", exchangeData?.BlockExternalOutbound === true) : undefined} + sx={{ + p: 1.5, + cursor: userPrincipalName ? "pointer" : "default", + transition: "all 0.15s ease-in-out", + "&:hover": userPrincipalName ? { + borderColor: "primary.main", + bgcolor: (theme) => alpha(theme.palette.primary.main, 0.04), + } : {}, + }} + > + + {isTogglingRestriction && restrictionDialog.direction === "Outbound" ? ( + + ) : exchangeData?.BlockExternalOutbound === true ? ( + + ) : ( + + )} + + + Ext. Outbound + + + {exchangeData?.BlockExternalOutbound === true ? "Blocked" : "Allowed"} + + + + + + + + {exchangeData?.RetentionPolicy && ( + + + Retention Policy + + + {exchangeData.RetentionPolicy} + + + )} + + + + + {/* Forwarding */} + + {forwardingType === "None" ? ( + + + + No forwarding configured + + ) : ( - - - - Archive Mailbox Enabled: + + + + + + + + To: {cleanAddress} - - {getCippFormatting(exchangeData?.ArchiveMailBox, 'ArchiveMailBox')} + + {exchangeData?.ForwardAndDeliver + ? "Copy kept in mailbox" + : "No copy kept in mailbox"} - - {exchangeData?.ArchiveMailBox && ( - <> - - - {exchangeData?.AutoExpandingArchiveScope === 'Organization' - ? 'Auto Expanding Archive: (org)' - : 'Auto Expanding Archive:'} - - - {getCippFormatting( - exchangeData?.AutoExpandingArchive, - 'AutoExpandingArchive' - )} - - - - - Total Archive Item Size: + + + )} + + + + + {/* Archive */} + {exchangeData?.ArchiveMailBox && ( + <> + + + + + + Archive Size - + {exchangeData?.TotalArchiveItemSize != null ? `${exchangeData.TotalArchiveItemSize} GB` - : 'N/A'} + : "N/A"} - - - - Total Archive Item Count: + + + + + + Archive Items - - {exchangeData?.TotalArchiveItemCount != null - ? exchangeData.TotalArchiveItemCount - : 'N/A'} + + {exchangeData?.TotalArchiveItemCount?.toLocaleString() || "N/A"} - - + + + + + : } + label="Auto-Expanding Archive" + color={exchangeData?.AutoExpandingArchive ? "success" : "default"} + variant="outlined" + size="small" + /> + + + + + + + )} + + {/* Protocols */} + + {/* Modern Protocols */} + + {modernProtocols.map((protocol) => ( + + : } + color={protocol.enabled ? "success" : "default"} + variant={protocol.enabled ? "filled" : "outlined"} + size="small" + onClick={userPrincipalName ? () => handleProtocolClick(protocol.name, protocol.enabled) : undefined} + sx={{ + fontWeight: 500, + cursor: userPrincipalName ? "pointer" : "default", + "&:hover": userPrincipalName ? { + opacity: 0.8, + transform: "scale(1.02)", + } : {}, + transition: "all 0.15s ease-in-out", + }} + /> + + ))} + + + {/* Legacy Protocols Section - Collapsible */} + + setLegacyProtocolsExpanded(!legacyProtocolsExpanded)} + sx={{ + p: 1.5, + cursor: "pointer", + display: "flex", + alignItems: "center", + justifyContent: "space-between", + "&:hover": { + bgcolor: anyLegacyEnabled + ? alpha(theme.palette.error.main, 0.08) + : alpha(theme.palette.grey[500], 0.08), + }, + }} + > + + + + Legacy Protocols {anyLegacyEnabled ? "(Security Risk)" : "(Secure)"} + + + {legacyProtocolsExpanded ? ( + + ) : ( + )} - - ) - } - /> - - - ) : ( -
    - {holds.map((hold) => ( + + + + {anyLegacyEnabled && ( + + These protocols can bypass MFA. Disable unless needed for legacy email clients. + + )} + + {legacyProtocols.map((protocol) => { + // SMTP uses inverted EXO semantics (SmtpClientAuthenticationDisabled) but + // can still be toggled per mailbox — enable = Disabled $false. + // null/unknown means inherit org TransportConfig; click sets an explicit override. + const isSmtp = protocol.name === "SMTP"; + const clickable = Boolean(userPrincipalName); + const tooltipTitle = !userPrincipalName + ? `${protocol.fullName} - User info not available` + : protocol.unknown + ? `${protocol.fullName} - Follows the organization default (click to set an explicit override)` + : `${protocol.fullName} - Click to ${protocol.enabled ? "disable" : "enable"}`; + return ( + + : } + color={protocol.unknown ? "default" : protocol.enabled ? "error" : "default"} + variant={protocol.enabled ? "filled" : "outlined"} + size="small" + onClick={clickable ? () => handleProtocolClick(protocol.name, protocol.enabled) : undefined} + sx={{ + fontWeight: 500, + cursor: clickable ? "pointer" : "default", + "&:hover": clickable ? { + opacity: 0.8, + transform: "scale(1.02)", + } : {}, + transition: "all 0.15s ease-in-out", + ...(protocol.enabled && { + bgcolor: alpha(theme.palette.error.main, 0.9), + "&:hover": clickable ? { + bgcolor: alpha(theme.palette.error.main, 0.75), + transform: "scale(1.02)", + } : {}, + }), + }} + /> + + ); + })} + {/* Disable Both button - only show when both are enabled */} + {bothLegacyEnabled && userPrincipalName && ( + + } + color="error" + variant="outlined" + size="small" + onClick={() => handleProtocolClick(["IMAP", "POP"], true)} + sx={{ + fontWeight: 600, + cursor: "pointer", + ml: 0.5, + borderStyle: "dashed", + "&:hover": { + bgcolor: alpha(theme.palette.error.main, 0.1), + borderStyle: "solid", + }, + transition: "all 0.15s ease-in-out", + }} + /> + + )} + + + + + + + + + {/* Holds */} + + + {holds.filter(h => h.toggleable).map((hold) => ( + : } - color={hold.enabled ? 'success' : 'default'} - variant="outlined" + icon={hold.enabled ? : } + color={hold.enabled ? "warning" : "default"} + variant={hold.enabled ? "filled" : "outlined"} size="small" - sx={{ mr: 1, mb: 1 }} + onClick={userPrincipalName ? () => handleHoldClick(hold.name, hold.enabled) : undefined} + sx={{ + fontWeight: 500, + cursor: userPrincipalName ? "pointer" : "default", + "&:hover": userPrincipalName ? { + opacity: 0.8, + transform: "scale(1.02)", + } : {}, + transition: "all 0.15s ease-in-out", + }} /> - ))} -
    - ) - } - /> - - ) : ( -
    - {protocols.map((protocol) => { - // For normal protocols, enabled = good (green). SMTP is inverted: - // enabled = risk (red), disabled = good (green). Unknown stays neutral. - const isGood = protocol.riskWhenEnabled ? !protocol.enabled : protocol.enabled - return ( + + ))} + + {holds.filter(h => !h.toggleable && h.enabled).length > 0 && ( + + {holds.filter(h => !h.toggleable && h.enabled).map((hold) => ( + : } - color={ - protocol.unknown - ? 'default' - : isGood - ? 'success' - : protocol.riskWhenEnabled - ? 'error' - : 'default' - } + label={hold.name} + icon={} + color="warning" variant="outlined" size="small" - sx={{ mr: 1, mb: 1 }} + sx={{ fontWeight: 500 }} /> - ) - })} -
    - ) - } - /> - + + ))} + + )} + {activeHolds.length === 0 && holds.filter(h => h.toggleable).every(h => !h.enabled) && ( + + + + No holds applied + + + )} + {exchangeData?.ExcludedFromOrgWideHold && ( + + This mailbox is excluded from organization-wide holds. + + )} +     + + + + {/* Protocol Toggle Confirmation Dialog */} + + {(() => { + const isMultiple = Array.isArray(protocolDialog.protocol); + const protocolDisplay = isMultiple + ? protocolDialog.protocol.join(" & ") + : protocolDialog.protocol; + const singleProtocol = isMultiple ? null : protocolDialog.protocol; + const protocolData = singleProtocol ? protocolInfo[singleProtocol] : null; + + return ( + <> + + {protocolDialog.currentlyEnabled + ? `Disable ${protocolDisplay}?` + : (protocolData?.securityRisk === "high" + ? `⚠️ Enable ${protocolDisplay}? (Not Recommended)` + : `Enable ${protocolDisplay}?`) + } + + + + {!isMultiple && protocolData && ( + + {protocolData.fullName} + + )} + + Are you sure you want to {protocolDialog.currentlyEnabled ? "disable" : "enable"}{" "} + {protocolDisplay} for this mailbox? + + {/* Disable warning - single protocol */} + {protocolDialog.currentlyEnabled && !isMultiple && protocolData && ( + + + The following applications will no longer be able to access this mailbox: + + + {protocolData.affectedApps} + + + )} + + {/* Disable warning - multiple protocols (disable both) */} + {protocolDialog.currentlyEnabled && isMultiple && ( + + + Recommended Security Action + + + Disabling both IMAP and POP will improve mailbox security by preventing + legacy authentication methods that can bypass MFA. + + + )} + + {/* Enable warning - single protocol */} + {!protocolDialog.currentlyEnabled && !isMultiple && protocolData && ( + <> + {protocolData.securityRisk === "high" && ( + + + Security Warning - Not Recommended + + + {protocolDisplay} is a legacy protocol that may use basic authentication, + which transmits credentials in a less secure manner. Enabling this protocol: + + +
      +
    • Decreases the overall security of the mailbox
      • +
    • May bypass modern authentication and MFA protections
      • +
    • Increases vulnerability to credential theft attacks
      • +
    • Is not recommended by Microsoft security best practices
      • +
    +     + + Only enable if the user requires a third-party email client (like Apple Mail or Thunderbird) + that does not support modern authentication. + +     + )} + + + + Enabling this protocol will allow access from: + + + {protocolData.affectedApps} + + + + )} +     + {toggleProtocol.isError && ( + + {toggleProtocol.error?.message || "Failed to update protocol setting"} + + )} +     + + + + + + ); + })()} +     + + {/* GAL Visibility Toggle Confirmation Dialog */} + setGalDialog(false)} + maxWidth="sm" + fullWidth + disableRestoreFocus + > + + {exchangeData?.HiddenFromAddressLists ? "Show in" : "Hide from"} Global Address List? + + + + Are you sure you want to {exchangeData?.HiddenFromAddressLists ? "show" : "hide"} this mailbox + {exchangeData?.HiddenFromAddressLists ? " in" : " from"} the Global Address List? + + {!exchangeData?.HiddenFromAddressLists ? ( + + + When hidden from the Global Address List: + + +
      +
    • Users will not be able to find this mailbox when searching the address book
      • +
    • The mailbox will not appear in Outlook's autocomplete suggestions
      • +
    • Users can still send email if they know the exact address
      • +
    +     +     + ) : ( + + + The mailbox will become visible in the Global Address List and users will be able to + find it when searching the address book. + + + )} + + {exchangeData?.onPremisesSyncEnabled && ( + + + Note: This mailbox is synced from Active Directory. Changes made here + may be overwritten on the next sync cycle. + + + )} +     + {toggleGalVisibility.isError && ( + + {toggleGalVisibility.error?.message || "Failed to update GAL visibility"} + + )} +     + + + + +     + + {/* Spam Status Clear Confirmation Dialog */} + setSpamDialog(false)} + maxWidth="sm" + fullWidth + disableRestoreFocus + > + + Clear Spam Block? + + + + This mailbox is currently blocked from sending email due to suspected spam activity. + + + + Before clearing this block, please ensure: + + +
      +
    • The user's account has not been compromised
      • +
    • The user's password has been reset if there's any suspicion of compromise
      • +
    • Any malicious mail rules or forwarding have been removed
      • +
    • MFA is enabled on the account
      • +
    +     +     + + + + Clearing this block will allow the user to send email again. If the spam behavior continues, + the mailbox may be automatically blocked again by Microsoft. + + +     + {clearSpamStatus.isError && ( + + {clearSpamStatus.error?.message || "Failed to clear spam status"} + + )} +     + + + + +     + + {/* Hold Toggle Confirmation Dialog */} + + + {holdDialog.currentlyEnabled ? "Disable" : "Enable"} {holdDialog.holdType} Hold? + + + + Are you sure you want to {holdDialog.currentlyEnabled ? "disable" : "enable"}{" "} + {holdDialog.holdType} Hold for this mailbox? + + {!holdDialog.currentlyEnabled && holdDialog.holdType === "Litigation" && ( + <> + {licensedForLitigationHold === false && ( + + + This mailbox is not licensed for Litigation Hold + + + Assign one of these licenses before enabling Litigation Hold: +
      + {LITIGATION_HOLD_ELIGIBLE_LICENSES.map((license) => ( +
    • {license}
      • + ))} +
    +     + {userId && ( + + )} +     + )} + + + Litigation Hold preserves all mailbox content + + +
      +
    • Deleted items and modified versions of items are retained
      • +
    • Items in the Recoverable Items folder are preserved
      • +
    • Users can still delete items, but they remain discoverable
      • +
    • Hold persists until explicitly removed
      • +
    +     +     + setLitigationDays(e.target.value)} + helperText="Leave blank for indefinite hold. Specify number of days to auto-expire." + sx={{ mt: 2 }} + slotProps={{ htmlInput: { min: 1 } }} + /> + + )} + + {!holdDialog.currentlyEnabled && holdDialog.holdType === "Retention" && ( + + + Retention Hold suspends retention policy processing + + +
      +
    • MRM retention policies will stop processing this mailbox
      • +
    • Items that would normally be deleted by retention are preserved
      • +
    • Useful when a user is temporarily unavailable (e.g., on leave)
      • +
    +     +     + )} + + {holdDialog.currentlyEnabled && ( + + + Disabling this hold may result in data loss + + + {holdDialog.holdType === "Litigation" + ? "Previously preserved items in the Recoverable Items folder may be permanently deleted by the Managed Folder Assistant." + : "Retention policies will resume processing, and items past their retention period may be deleted."} + + + )} +     + +     + + + + +     + + {/* External Mail Restriction Dialog */} + + + {restrictionDialog.currentlyBlocked ? "Allow" : "Block"} External{" "} + {restrictionDialog.direction} Mail? + + + + Are you sure you want to{" "} + {restrictionDialog.currentlyBlocked ? "allow" : "block"} external{" "} + {restrictionDialog.direction?.toLowerCase()} mail for this mailbox? + + {!restrictionDialog.currentlyBlocked && + restrictionDialog.direction === "Inbound" && ( + + + Blocking external inbound mail means: + + +
      +
    • + Only internal (authenticated) senders can email this + mailbox +
      • +
    • + External senders will receive a non-delivery report + (NDR) +
      • +
    • + This includes customers, vendors, and any sender outside + the organization +
      • +
    +     +     + )} + + {!restrictionDialog.currentlyBlocked && + restrictionDialog.direction === "Outbound" && ( + + + Blocking external outbound mail means: + + +
      +
    • + This mailbox will not be able to send email to external + recipients +
      • +
    • + The sender will receive a non-delivery report (NDR) when + attempting to send externally +
      • +
    • + A transport rule will be auto-created in the tenant to + enforce this restriction +
      • +
    +     +     + )} + + {restrictionDialog.currentlyBlocked && ( + + + {restrictionDialog.direction === "Inbound" + ? "This will allow external senders to email this mailbox again." + : "This will allow this mailbox to send email to external recipients again."} + + + )} +     + +     + + + + +     ); -} +}; CippExchangeInfoCard.propTypes = { exchangeData: PropTypes.object, isLoading: PropTypes.bool, isFetching: PropTypes.bool, handleRefresh: PropTypes.func, -} + userPrincipalName: PropTypes.string, + userId: PropTypes.string, +}; diff --git a/frontend/src/components/CippCards/CippInfoBar.jsx b/frontend/src/components/CippCards/CippInfoBar.jsx index 3432197ab3..686ad561f2 100644 --- a/frontend/src/components/CippCards/CippInfoBar.jsx +++ b/frontend/src/components/CippCards/CippInfoBar.jsx @@ -1,5 +1,4 @@ import React, { useState, Fragment } from 'react' -import { useRouter } from 'next/router' import { Box, Card, Stack, SvgIcon, Typography, Skeleton, Tooltip } from '@mui/material' import { Grid } from '@mui/system' import { CippOffCanvas } from '../CippComponents/CippOffCanvas' @@ -7,7 +6,6 @@ import { CippPropertyListCard } from './CippPropertyListCard' export const CippInfoBar = ({ data, isFetching }) => { const [visibleIndex, setVisibleIndex] = useState(null) - const router = useRouter() return ( @@ -16,19 +14,9 @@ export const CippInfoBar = ({ data, isFetching }) => { setVisibleIndex(index) - : item.link - ? () => router.push(item.link) - : undefined - } + onClick={item.offcanvas ? () => setVisibleIndex(index) : undefined} sx={{ - cursor: item.offcanvas || item.link ? 'pointer' : 'default', - '&:hover': - item.offcanvas || item.link - ? { backgroundColor: (theme) => theme.palette.action.hover } - : undefined, + cursor: item.offcanvas ? 'pointer' : 'default', borderBottom: (theme) => ({ xs: `1px solid ${theme.palette.divider}`, md: 'none', diff --git a/frontend/src/components/CippCards/CippInfoCard.jsx b/frontend/src/components/CippCards/CippInfoCard.jsx index d96d7795e6..4342b5520b 100644 --- a/frontend/src/components/CippCards/CippInfoCard.jsx +++ b/frontend/src/components/CippCards/CippInfoCard.jsx @@ -17,14 +17,21 @@ export const CippInfoCard = (props) => { const { isFetching, actionLink, actionText, value, icon, label, cardSize, ...other } = props; return ( - - + theme.shadows[8], + transform: "translateY(-2px)", + }, + }), + ...other.sx, + }} + > + { } /> - + @@ -85,7 +85,7 @@ export const CippListItemCard = ({     - + diff --git a/frontend/src/components/CippCards/CippPropertyListCard.jsx b/frontend/src/components/CippCards/CippPropertyListCard.jsx index d437c0487c..bbe732ed3c 100644 --- a/frontend/src/components/CippCards/CippPropertyListCard.jsx +++ b/frontend/src/components/CippCards/CippPropertyListCard.jsx @@ -7,19 +7,28 @@ import { SvgIcon, Stack, CardActions, -} from '@mui/material' -import { ActionList } from '../../components/action-list' -import { ActionListItem } from '../../components/action-list-item' -import { PropertyList } from '../../components/property-list' -import { PropertyListItem } from '../../components/property-list-item' -import { useDialog } from '../../hooks/use-dialog' -import { CippApiDialog } from '../CippComponents/CippApiDialog' -import { useState } from 'react' -import { getIconByName } from '../../utils/icon-registry' + Box, + Typography, + Collapse, + IconButton, + useMediaQuery, + useTheme, +} from "@mui/material"; +import KeyboardArrowUpIcon from "@mui/icons-material/KeyboardArrowUp"; +import KeyboardArrowDownIcon from "@mui/icons-material/KeyboardArrowDown"; +import { ActionList } from "../../components/action-list"; +import { ActionListItem } from "../../components/action-list-item"; +import { PropertyList } from "../../components/property-list"; +import { PropertyListItem } from "../../components/property-list-item"; +import { useDialog } from "../../hooks/use-dialog"; +import { CippApiDialog } from "../CippComponents/CippApiDialog"; +import { CippActionMenu } from "../CippComponents/CippActionMenu"; +import { useState } from "react"; +import { getIconByName } from "../../utils/icon-registry"; export const CippPropertyListCard = (props) => { const { - align = 'vertical', + align = "vertical", actionItems = [], propertyItems = [], isFetching, @@ -27,66 +36,77 @@ export const CippPropertyListCard = (props) => { actionButton, copyItems = false, data, - layout = 'single', + layout = "single", showDivider = true, cardButton, - cardSx = { width: '100%', height: '100%' }, + cardSx = { width: "100%", height: "100%" }, + useImprovedActions = true, // New prop to enable improved action menu + actionsCollapsedByDefault = false, ...other - } = props - const createDialog = useDialog() - const [actionData, setActionData] = useState({ - data: {}, - action: {}, - ready: false, - }) + } = props; + const theme = useTheme(); + const smDown = useMediaQuery(theme.breakpoints.down("sm")); + const createDialog = useDialog(); + const [actionData, setActionData] = useState({ data: {}, action: {}, ready: false }); + const [actionsOpen, setActionsOpen] = useState(!actionsCollapsedByDefault); - const half = Math.ceil(propertyItems.length / 2) - const firstHalf = propertyItems.slice(0, half) - const secondHalf = propertyItems.slice(half, propertyItems.length) + const half = Math.ceil(propertyItems.length / 2); + const firstHalf = propertyItems.slice(0, half); + const secondHalf = propertyItems.slice(half, propertyItems.length); const isLabelPresent = (item) => { - return ( - item?.label === '' || item?.label === undefined || item?.label === null - ) - } + return item?.label === "" || item?.label === undefined || item?.label === null; + }; - const setPadding = isLabelPresent ? { py: 0.5, px: { xs: 2, md: 3 } } : { py: 1.5, px: { xs: 2, md: 3 } } + const setPadding = isLabelPresent + ? { py: 0.5, px: { xs: 2, md: 3 } } + : { py: 1.5, px: { xs: 2, md: 3 } }; const handleActionDisabled = (row, action) => { if (action?.condition) { - return !action.condition(row) + return !action.condition(row); } - return false - } + return false; + }; const renderActionIcon = (icon) => { - if (!icon) return null - if (typeof icon === 'string') - return getIconByName(icon, { fontSize: 'small' }) - return {icon} - } + if (!icon) return null; + if (typeof icon === "string") return getIconByName(icon, { fontSize: "small" }); + return {icon}; + }; + + const hasInteraction = actionItems?.length > 0 || !!actionButton || !!cardButton; return ( <> - + - + - {layout === 'single' ? ( + {layout === "single" ? ( {isFetching ? ( <> - {Array.from({ length: propertyItems?.length || 3 }).map( - (_, index) => ( - } - sx={setPadding} - /> - ) - )} + {Array.from({ length: propertyItems?.length || 3 }).map((_, index) => ( + } + sx={setPadding} + /> + ))} ) : ( propertyItems.map((item, index) => ( @@ -105,13 +125,13 @@ export const CippPropertyListCard = (props) => { // Two-column layout *': { + "& > *": { width: { - md: '50%', + md: "50%", }, }, }} @@ -119,9 +139,7 @@ export const CippPropertyListCard = (props) => { {isFetching ? ( <> - {Array.from({ - length: Math.max(1, firstHalf?.length || 1), - }).map((_, index) => ( + {Array.from({ length: Math.max(1, firstHalf?.length || 1) }).map((_, index) => ( { {isFetching ? ( <> - {Array.from({ - length: Math.max(1, secondHalf?.length || 1), - }).map((_, index) => ( - } - /> - ))} + {Array.from({ length: Math.max(1, secondHalf?.length || 1) }).map( + (_, index) => ( + } + /> + ) + )} ) : ( secondHalf.map((item, index) => ( @@ -173,46 +191,73 @@ export const CippPropertyListCard = (props) => { )} - - {actionItems?.length > 0 && - actionItems - .filter( - // hideCondition removes the action for this record entirely (vs. - // condition, which renders it disabled). - (item) => - typeof item.hideCondition !== 'function' || - !item.hideCondition(data) - ) - .map((item, index) => ( - { - setActionData({ - data: data, - action: item, - ready: true, - }) - if (item?.noConfirm) { - item.customFunction(item, data, {}) - } else { - createDialog.handleOpen() - } - }} - disabled={handleActionDisabled(data, item)} - /> - ))} - + {/* Actions Section */} + {actionItems?.length > 0 && ( + useImprovedActions ? ( + + + + Actions + + setActionsOpen((open) => !open)} + aria-label={actionsOpen ? "Collapse actions" : "Expand actions"} + > + {actionsOpen ? : } + + + + + 6} + showCategories={actionItems.length > 4} + /> + + + + ) : ( + <> + + {actionItems.map((item, index) => ( + { + setActionData({ + data: data, + action: item, + ready: true, + }); + if (item?.noConfirm) { + item.customFunction(item, data, {}); + } else { + createDialog.handleOpen(); + } + }} + disabled={handleActionDisabled(data, item)} + /> + ))} + - {actionData.ready && ( - + {actionData.ready && ( + + )} + + ) )} {cardButton && ( <> @@ -222,5 +267,5 @@ export const CippPropertyListCard = (props) => { )} - ) -} + ); +}; diff --git a/frontend/src/components/CippCards/CippRemediationCard.jsx b/frontend/src/components/CippCards/CippRemediationCard.jsx new file mode 100644 index 0000000000..eba54061dc --- /dev/null +++ b/frontend/src/components/CippCards/CippRemediationCard.jsx @@ -0,0 +1,176 @@ +import { Button, Typography, List, ListItem, SvgIcon, Stack, Box } from "@mui/material"; +import CippButtonCard from "./CippButtonCard"; // Adjust the import path as needed +import { CippApiDialog } from "../CippComponents/CippApiDialog"; +import { useDialog } from "../../hooks/use-dialog"; +import { Sync, Key } from "@mui/icons-material"; +import { ShieldCheckIcon } from "@heroicons/react/24/outline"; + +export default function CippRemediationCard(props) { + const { userPrincipalName, isFetching, userId, tenantFilter, restartProcess } = props; + const createDialog = useDialog(); + const expirePasswordDialog = useDialog(); + return ( + + Business Email Compromise Overview - {userPrincipalName} + + } + CardButton={ + + {/* Desktop: Two rows of buttons */} + + {/* Row 1: Primary action */} + + {/* Row 2: Secondary actions */} + + + + + + + {/* Mobile: Stack all buttons vertically */} + + + + + + + } + isFetching={isFetching} + > + + Use this information as a guide to check if a tenant or e-mail address might have been + compromised. All data is retrieved from the last 7 days of logs. + + + + Hit the button below to execute the following tasks: + + + Block user sign-in + Reset user password + Disconnect all current sessions + Remove all MFA methods for the user + Disable all inbox rules for the user + + + + + ); +} diff --git a/frontend/src/components/CippCards/CippStandardsDialog.jsx b/frontend/src/components/CippCards/CippStandardsDialog.jsx index eb97060c04..08f0c8ef38 100644 --- a/frontend/src/components/CippCards/CippStandardsDialog.jsx +++ b/frontend/src/components/CippCards/CippStandardsDialog.jsx @@ -22,7 +22,7 @@ import { AccordionDetails, } from '@mui/material' import { SvgIcon } from '@mui/material' -import { getStandards } from '../../utils/standards-data' +import standards from '../../data/standards.json' const getCategoryIcon = (category) => { switch (category) { @@ -97,7 +97,7 @@ export const CippStandardsDialog = ({ open, onClose, standardsData, currentTenan // Combine standards from all applicable templates const combinedStandards = {} for (const template of applicableTemplates) { - for (const [standardKey, standardValue] of Object.entries(template.standards)) { + for (const [standardKey, standardValue] of Object.entries(template.standards || {})) { if (combinedStandards[standardKey]) { // If the standard already exists, we need to merge it const existing = combinedStandards[standardKey] @@ -122,7 +122,7 @@ export const CippStandardsDialog = ({ open, onClose, standardsData, currentTenan let totalStandardsCount = 0 Object.entries(combinedStandards).forEach(([standardKey, standardConfig]) => { - const standardInfo = getStandards().find((s) => s.name === `standards.${standardKey}`) + const standardInfo = standards.find((s) => s.name === `standards.${standardKey}`) if (standardInfo) { const category = standardInfo.cat if (!standardsByCategory[category]) { @@ -321,8 +321,8 @@ export const CippStandardsDialog = ({ open, onClose, standardsData, currentTenan {info.addedComponent.map((component, componentIndex) => { - const value = get(templateItem, component.name) - let displayValue = 'N/A' + const value = get(templateItem, component.name); + let displayValue = "N/A"; if (value) { if (typeof value === 'object' && value !== null) { @@ -453,7 +453,7 @@ export const CippStandardsDialog = ({ open, onClose, standardsData, currentTenan let extractedValue = null // Try direct access first - componentValue = get(config, component.name) + componentValue = get(config, component.name); // If direct access fails and component name contains dots (nested structure) if ( @@ -466,8 +466,8 @@ export const CippStandardsDialog = ({ open, onClose, standardsData, currentTenan // Handle structures like: standards.AuthMethodsSettings.ReportSuspiciousActivity if (pathParts[0] === 'standards' && config.standards) { // Remove 'standards.' prefix and try to find the value in config.standards - const nestedPath = pathParts.slice(1).join('.') - extractedValue = get(config.standards, nestedPath) + const nestedPath = pathParts.slice(1).join("."); + extractedValue = get(config.standards, nestedPath); // If still not found, try alternative nested structures // Some standards have double nesting like: config.standards.StandardName.fieldName @@ -476,8 +476,8 @@ export const CippStandardsDialog = ({ open, onClose, standardsData, currentTenan extractedValue === null) && pathParts.length >= 3 ) { - const standardName = pathParts[1] - const fieldPath = pathParts.slice(2).join('.') + const standardName = pathParts[1]; + const fieldPath = pathParts.slice(2).join("."); extractedValue = get( config.standards, `${standardName}.${fieldPath}` diff --git a/frontend/src/components/CippCards/CippUserInfoCard.jsx b/frontend/src/components/CippCards/CippUserInfoCard.jsx index fceb4c90d1..3683768336 100644 --- a/frontend/src/components/CippCards/CippUserInfoCard.jsx +++ b/frontend/src/components/CippCards/CippUserInfoCard.jsx @@ -3,37 +3,483 @@ import { CippIcons } from "../../utils/icon-registry"; import { Avatar, Card, - CardHeader, + CardContent, Divider, Skeleton, Typography, - Alert, IconButton, Tooltip, CircularProgress, + Chip, + Paper, + ButtonBase, + Dialog, + DialogTitle, + DialogContent, + DialogContentText, + DialogActions, + Button, + Alert, + FormControl, + Select, + MenuItem, } from "@mui/material"; -import { PropertyList } from "../property-list"; -import { PropertyListItem } from "../property-list-item"; +import { + AccountCircle, + PhotoCamera, + Delete, + PersonAddAlt1, + Work, + Phone, + LocationOn, + Badge, + CheckCircle, + Cancel, + Sync, + Cloud, + Business, + Email, + OpenInNew, + Close, + ContentCopy, + Check as CheckIcon, + Add, + Lightbulb, + Devices, +} from "@mui/icons-material"; import { getCippFormatting } from "../../utils/get-cipp-formatting"; -import { Stack, Grid, Box } from "@mui/system"; -import { useState, useRef, useCallback } from "react"; -import { ApiPostCall } from "../../api/ApiCall"; +import { getCippLicenseTranslation } from "../../utils/get-cipp-license-translation"; import { useLicenseBackfill } from "../../hooks/use-license-backfill"; +import { Stack, Grid, Box } from "@mui/system"; +import { useState, useRef, useMemo } from "react"; +import { ApiGetCall, ApiPostCall } from "../../api/ApiCall"; +import { alpha, useTheme } from "@mui/material/styles"; +import { useRouter } from "next/router"; +import { useQueryClient } from "@tanstack/react-query"; + +// Section component for consistent styling +const InfoSection = ({ icon: Icon, title, children, isEmpty = false }) => { + if (isEmpty) return null; + + return ( + + + + + {title} + + + {children} + + ); +}; + +// Info row component for label-value pairs +const InfoRow = ({ label, value, fullWidth = false }) => { + if (!value) return null; + + return ( + + + {label} + + + {value} + + + ); +}; export const CippUserInfoCard = (props) => { - const { user, tenant, isFetching = false, ...other } = props; + const { user, tenant, isFetching = false, onRefresh, ...other } = props; + const theme = useTheme(); + const router = useRouter(); + const queryClient = useQueryClient(); + const { updateTrigger } = useLicenseBackfill(); const [photoTimestamp, setPhotoTimestamp] = useState(Date.now()); const [uploadError, setUploadError] = useState(null); const [successMessage, setSuccessMessage] = useState(null); const fileInputRef = useRef(null); - // Hook to trigger re-render when license backfill completes - const { updateTrigger } = useLicenseBackfill(); + // License removal state + const [licenseDialog, setLicenseDialog] = useState({ + open: false, + license: null, + licenseName: null, + }); + const [isRemovingLicense, setIsRemovingLicense] = useState(false); + const [licenseError, setLicenseError] = useState(null); + const [copiedLicenseId, setCopiedLicenseId] = useState(null); + + // License add state + const [addLicenseDialogOpen, setAddLicenseDialogOpen] = useState(false); + const [selectedLicenseToAdd, setSelectedLicenseToAdd] = useState(""); + const [isAddingLicense, setIsAddingLicense] = useState(false); + const [addLicenseError, setAddLicenseError] = useState(null); + const [addLicenseSuccess, setAddLicenseSuccess] = useState(null); + const [removeLicenseSuccess, setRemoveLicenseSuccess] = useState(null); + + // Fetch user's registered devices + const registeredDevicesRequest = ApiGetCall({ + url: "/api/ListGraphRequest", + data: { + Endpoint: `users/${user?.id}/registeredDevices`, + tenantFilter: tenant, + $select: "id", + noPagination: true, + }, + queryKey: `UserRegisteredDevices-${user?.id}-${tenant}`, + waiting: !!user?.id && !!tenant && tenant !== "AllTenants", + staleTime: 1000 * 60 * 5, + }); + + // Fetch user's owned devices + const ownedDevicesRequest = ApiGetCall({ + url: "/api/ListGraphRequest", + data: { + Endpoint: `users/${user?.id}/ownedDevices`, + tenantFilter: tenant, + $select: "id", + noPagination: true, + }, + queryKey: `UserOwnedDevices-${user?.id}-${tenant}`, + waiting: !!user?.id && !!tenant && tenant !== "AllTenants", + staleTime: 1000 * 60 * 5, + }); + + // Helper to get device array from API response (backend may return Results or raw Graph value) + const getDeviceList = (data) => { + if (!data) return []; + const list = data.Results ?? data.value; + return Array.isArray(list) ? list : []; + }; + + // Compute deduplicated device count + const deviceCount = useMemo(() => { + const registered = getDeviceList(registeredDevicesRequest.data); + const owned = getDeviceList(ownedDevicesRequest.data); + const deviceIds = new Set(); + registered.forEach((d) => d?.id && deviceIds.add(d.id)); + owned.forEach((d) => d?.id && deviceIds.add(d.id)); + return deviceIds.size; + }, [registeredDevicesRequest.data, ownedDevicesRequest.data]); + + const devicesLoading = registeredDevicesRequest.isLoading || ownedDevicesRequest.isLoading; + const canShowDevices = !!user?.id && !!tenant && tenant !== "AllTenants"; + + // Fetch tenant's subscribed SKUs for license name mapping + const licensesRequest = ApiGetCall({ + url: `/api/ListLicenses?tenantFilter=${tenant}`, + queryKey: `Licenses-${tenant}`, + waiting: !!tenant && tenant !== "AllTenants", + staleTime: 1000 * 60 * 5, // Cache for 5 minutes + }); + + // Build a map from skuId to license display name + const licenseNameMap = useMemo(() => { + const map = new Map(); + const licenses = licensesRequest.data || []; + licenses.forEach((lic) => { + if (lic.skuId && lic.License) { + // License field contains the display name from backend + map.set(lic.skuId.toLowerCase(), lic.License); + } + }); + return map; + }, [licensesRequest.data]); + + // Get available licenses for adding (non-trial, with available units, not already assigned) + const availableLicenses = useMemo(() => { + const licenses = licensesRequest.data || []; + const assignedSkuIds = new Set( + (user?.assignedLicenses || []).map((lic) => lic.skuId?.toLowerCase()) + ); + + return licenses.filter((lic) => { + // Must have available units + const availableUnits = parseInt(lic.availableUnits, 10) || 0; + if (availableUnits <= 0) return false; + + // Exclude trial licenses (check TermInfo for IsTrial or license name contains "Trial") + const termInfoArray = Array.isArray(lic.TermInfo) ? lic.TermInfo : []; + const isTrial = termInfoArray.some((term) => term.IsTrial === true) || + (lic.License || "").toLowerCase().includes("trial"); + if (isTrial) return false; + + // Exclude already assigned licenses + if (assignedSkuIds.has(lic.skuId?.toLowerCase())) return false; + + return true; + }).sort((a, b) => (a.License || "").localeCompare(b.License || "")); + }, [licensesRequest.data, user?.assignedLicenses]); + + // License removal API + const removeLicenseMutation = ApiPostCall({ + urlFromData: true, + }); + + // License add API + const addLicenseMutation = ApiPostCall({ + urlFromData: true, + }); + + // Handle license chip click for removal + const handleLicenseClick = (license, licenseName) => { + setLicenseDialog({ + open: true, + license, + licenseName, + }); + setLicenseError(null); + }; + + // Handle dialog close + const handleLicenseDialogClose = () => { + setLicenseDialog({ + open: false, + license: null, + licenseName: null, + }); + setLicenseError(null); + }; + + // Handle license removal + const handleRemoveLicense = async () => { + const { license } = licenseDialog; + setIsRemovingLicense(true); + setLicenseError(null); + + try { + const response = await removeLicenseMutation.mutateAsync({ + url: "/api/ExecBulkLicense", + data: [{ + tenantFilter: tenant, + userIds: user.id, + LicenseOperation: "Remove", + Licenses: [{ value: license.skuId }], + }], + }); + + const results = response?.data?.Results || []; + const hasError = results.some((r) => typeof r === "string" && r.toLowerCase().includes("fail")); + + if (hasError) { + setLicenseError(results.join(" ")); + return; + } + + queryClient.invalidateQueries({ + predicate: (query) => { + const key = String(query.queryKey?.[0] || ""); + return key.startsWith(`ListUsers-${user?.id}`); + }, + }); + + if (onRefresh) { + onRefresh(); + } + + setRemoveLicenseSuccess(results[0] || "License removed successfully."); + handleLicenseDialogClose(); + setTimeout(() => setRemoveLicenseSuccess(null), 6000); + } catch (error) { + console.error("Failed to remove license:", error); + setLicenseError(error.message || "Failed to remove license"); + } finally { + setIsRemovingLicense(false); + } + }; + + // Handle copying license name + const handleCopyLicense = (licenseId, displayName) => { + navigator.clipboard.writeText(displayName).then(() => { + setCopiedLicenseId(licenseId); + setTimeout(() => setCopiedLicenseId(null), 2000); + }); + }; + + // Handle add license dialog open + const handleAddLicenseOpen = () => { + setAddLicenseDialogOpen(true); + setSelectedLicenseToAdd(""); + setAddLicenseError(null); + setAddLicenseSuccess(null); + }; + + // Handle add license dialog close + const handleAddLicenseClose = () => { + setAddLicenseDialogOpen(false); + setSelectedLicenseToAdd(""); + setAddLicenseError(null); + setAddLicenseSuccess(null); + }; + + // Handle adding a license + const handleAddLicense = async () => { + if (!selectedLicenseToAdd) return; + + setIsAddingLicense(true); + setAddLicenseError(null); + setAddLicenseSuccess(null); + + try { + const response = await addLicenseMutation.mutateAsync({ + url: "/api/ExecBulkLicense", + data: [{ + tenantFilter: tenant, + userIds: user.id, + LicenseOperation: "Add", + Licenses: [{ value: selectedLicenseToAdd }], + }], + }); + + const results = response?.data?.Results || []; + const hasError = results.some((r) => typeof r === "string" && r.toLowerCase().includes("fail")); + + if (hasError) { + setAddLicenseError(results.join(" ")); + return; + } + + queryClient.invalidateQueries({ + predicate: (query) => { + const key = String(query.queryKey?.[0] || ""); + return key.startsWith(`ListUsers-${user?.id}`); + }, + }); + queryClient.invalidateQueries({ queryKey: [`Licenses-${tenant}`] }); + + if (onRefresh) { + onRefresh(); + } + + setAddLicenseSuccess(results[0] || "License added successfully."); + } catch (error) { + console.error("Failed to add license:", error); + setAddLicenseError(error.message || "Failed to add license"); + } finally { + setIsAddingLicense(false); + } + }; + + // Get display name for selected license to add + const getSelectedLicenseDisplayName = () => { + if (!selectedLicenseToAdd) return ""; + const license = availableLicenses.find((lic) => lic.skuId === selectedLicenseToAdd); + return license?.License || ""; + }; + + // Get translated license names with skuId preserved + const getLicenseChips = () => { + if (!user?.assignedLicenses || user.assignedLicenses.length === 0) { + return null; + } + + return user.assignedLicenses.map((license, index) => { + const licenseId = license.skuId || index; + + // First, try to get the name from the tenant's subscribed SKUs (most accurate) + let displayName = null; + if (license.skuId && licenseNameMap.size > 0) { + displayName = licenseNameMap.get(license.skuId.toLowerCase()); + } + + // Fall back to static translation if not found in tenant SKUs + if (!displayName) { + const translatedNames = getCippLicenseTranslation([license]); + displayName = Array.isArray(translatedNames) ? translatedNames[0] : translatedNames; + } + + const isCopied = copiedLicenseId === licenseId; + + return ( + + {/* Copy button */} + + handleCopyLicense(licenseId, displayName)} + sx={{ + display: "flex", + alignItems: "center", + gap: 0.5, + px: 1, + py: 0.5, + minWidth: 0, + flex: 1, + justifyContent: "flex-start", + "&:hover": { + bgcolor: alpha(theme.palette.info.main, 0.08), + }, + }} + > + {isCopied ? ( + + ) : ( + + )} + + {displayName} + + + + + {/* Remove button */} + + handleLicenseClick(license, displayName)} + sx={{ + px: 0.75, + borderLeft: `1px solid ${alpha(theme.palette.info.main, 0.3)}`, + color: "text.secondary", + "&:hover": { + bgcolor: alpha(theme.palette.error.main, 0.08), + color: "error.main", + }, + }} + > + + + + + ); + }); + }; // API mutations const setPhotoMutation = ApiPostCall({ urlFromData: true }); const removePhotoMutation = ApiPostCall({ urlFromData: true }); + // Navigate to View User page + const handleViewUser = () => { + if (user?.id) { + router.push(`/identity/administration/users/user?userId=${user.id}`); + } + }; + // Helper function to check if a section has any data const hasWorkInfo = user?.jobTitle || user?.department || user?.manager?.displayName || user?.companyName; @@ -45,7 +491,7 @@ export const CippUserInfoCard = (props) => { // Handle image URL with timestamp for cache busting const imageUrl = user?.id && tenant - ? `/api/ListUserPhoto?TenantFilter=${tenant}&UserId=${user.id}&t=${photoTimestamp}` + ? `/api/ListUserPhoto?tenantFilter=${tenant}&UserID=${user.id}&t=${photoTimestamp}` : undefined; const handleFileSelect = async (event) => { @@ -54,6 +500,15 @@ export const CippUserInfoCard = (props) => { setSuccessMessage(null); if (!file) return; + + // Guard: Ensure user data is available before attempting upload + if (!user?.id || !tenant) { + setUploadError("Unable to upload photo - user data not available. Please refresh the page."); + if (fileInputRef.current) { + fileInputRef.current.value = ""; + } + return; + } // Validate file type const validTypes = ["image/jpeg", "image/jpg", "image/png"]; @@ -85,7 +540,7 @@ export const CippUserInfoCard = (props) => { }, }); setPhotoTimestamp(Date.now()); - setSuccessMessage("Profile picture updated successfully!"); + setSuccessMessage("Photo updated!"); setTimeout(() => setSuccessMessage(null), 3000); } catch (error) { setUploadError(error.message || "Failed to upload photo"); @@ -106,6 +561,12 @@ export const CippUserInfoCard = (props) => { setUploadError(null); setSuccessMessage(null); + // Guard: Ensure user data is available before attempting removal + if (!user?.id || !tenant) { + setUploadError("Unable to remove photo - user data not available. Please refresh the page."); + return; + } + try { await removePhotoMutation.mutateAsync({ url: "/api/ExecSetUserPhoto", @@ -116,7 +577,7 @@ export const CippUserInfoCard = (props) => { }, }); setPhotoTimestamp(Date.now()); - setSuccessMessage("Profile picture removed successfully!"); + setSuccessMessage("Photo removed!"); setTimeout(() => setSuccessMessage(null), 3000); } catch (error) { setUploadError(error.message || "Failed to remove photo"); @@ -125,382 +586,553 @@ export const CippUserInfoCard = (props) => { const isLoading = setPhotoMutation.isPending || removePhotoMutation.isPending; + if (isFetching) { + return ( + + + + + + + + + + + + + + + + ); + } + return ( - - - - - ) : ( - - {/* Avatar section — "auto" rather than a full row on xs: the picture is a - fixed 64px, so collapsing it to its own line only pushes the identity - fields down without making the picture any bigger. */} - - - - - - - {isLoading && ( - - )} - - {/* Photo management buttons */} - - - - fileInputRef.current?.click()} - disabled={isLoading} - sx={{ - backgroundColor: "action.hover", - "&:hover": { backgroundColor: "action.selected" }, - }} - > - - - - - - - - - - {/* Status messages */} - {successMessage && ( - - {successMessage} - - )} - {uploadError && ( - - {uploadError} - - )} - - - - {/* Status information section — grows into whatever the avatar leaves */} - - - - - Account Enabled: - - - {getCippFormatting(user?.accountEnabled, "accountEnabled")} - - - - - - Synced from AD: - - - {getCippFormatting(user?.onPremisesSyncEnabled, "onPremisesSyncEnabled")} - - - - - - ) - } - /> - - {/* Basic Identity Information */} - - ) : ( - - - - Display Name: - - - {getCippFormatting(user?.displayName, "displayName") || "N/A"} - - - - - Email Address: - - - {getCippFormatting(user?.proxyAddresses, "proxyAddresses") || "N/A"} - - - - - User Principal Name: - - - {getCippFormatting(user?.userPrincipalName, "userPrincipalName") || "N/A"} - - - - ) - } - /> - - {/* Licenses */} - - ) : !user?.assignedLicenses || user?.assignedLicenses.length === 0 ? ( - - No licenses assigned to this user - - ) : ( - getCippFormatting(user?.assignedLicenses, "assignedLicenses") - ) - } - /> - - {/* Work Information Section */} - - ) : !hasWorkInfo ? ( - - No work information available + + {/* Hero Section with Photo and Name */} + + + {/* Avatar with photo controls */} + + + + + + + + + {isLoading && ( + + )} + {/* Photo action buttons */} + + + + + fileInputRef.current?.click()} + disabled={isLoading || !user?.id || !tenant} + sx={{ + bgcolor: "background.paper", + boxShadow: 1, + width: 28, + height: 28, + "&:hover": { bgcolor: "action.hover" }, + }} + > + + + + + + + + + + + + + + + {/* Name and basic info */} + + + + {user?.displayName || "Unknown User"} + + + + + {user?.userPrincipalName} - ) : ( - - {user?.jobTitle && ( - - - Job Title: - - {user.jobTitle} - - )} - {user?.companyName && ( - - - Company Name: - - {user.companyName} - + + {/* Status chips */} + + + : } + label={user?.accountEnabled ? "Enabled" : "Disabled"} + color={user?.accountEnabled ? "success" : "error"} + size="small" + variant="outlined" + sx={{ height: 22 }} + /> + + {user?.onPremisesSyncEnabled && ( + + } + label="AD Synced" + color="info" + size="small" + variant="outlined" + sx={{ height: 22 }} + /> + )} - {user?.department && ( - - - Department: - - {user.department} - + {user?.userType === "Guest" && ( + + } + label="Guest" + color="warning" + size="small" + variant="outlined" + sx={{ height: 22 }} + /> + )} - {user?.manager?.displayName && ( - - - Manager: - - {user.manager.displayName} - + {canShowDevices && ( + devicesLoading ? ( + + } + label="Devices..." + size="small" + variant="outlined" + sx={{ height: 22 }} + /> + + ) : ( + + } + label={`${deviceCount} Device${deviceCount !== 1 ? "s" : ""}`} + color={deviceCount > 0 ? "primary" : "default"} + size="small" + variant="outlined" + sx={{ height: 22 }} + /> + + ) )} - - ) - } - /> - - {/* Contact Information Section */} - - ) : !hasContactInfo ? ( - - No contact information available - + + + {/* Photo status messages */} + {successMessage && ( + + {successMessage} + + )} + {uploadError && ( + + {uploadError} + + )} + + + + + {/* Content Sections */} + + {/* Licenses Section */} + + + + + + Licenses + + + {availableLicenses.length > 0 && ( + + )} + + {removeLicenseSuccess && ( + setRemoveLicenseSuccess(null)}> + {removeLicenseSuccess} + + )} + {!user?.assignedLicenses || user?.assignedLicenses.length === 0 ? ( + + + No licenses assigned + + ) : ( - - {user?.mobilePhone && ( - - - Mobile Phone: - - {user.mobilePhone} - - )} - {user?.businessPhones && user.businessPhones.length > 0 && ( - - - Business Phones: - - {user.businessPhones.join(", ")} - - )} - - ) - } - /> - - {/* Address Information Section */} - - ) : !hasAddressInfo ? ( - - No address information available + + {getLicenseChips()} + + )} + + + + + {/* Work Information */} + + + + + + + + + + {!hasWorkInfo && ( + + + + + No work information available + + + + )} + + {/* Contact Information */} + + + + 0 ? user.businessPhones.join(", ") : null} + /> + + + + {!hasContactInfo && ( + + + + + No contact information available + + + + )} + + {/* Address Information */} + + + + + + + + + + + {!hasAddressInfo && ( + + + + + No location information available + + + + )} + + + + {/* License Removal Confirmation Dialog */} + + + Remove License? + + + + Are you sure you want to remove the following license from{" "} + {user?.displayName}? + + + + {licenseDialog.licenseName} - ) : ( - - {user?.streetAddress && ( - - - Street Address: - - {user.streetAddress} - - )} - {user?.city && ( - - - City: - - {user.city} - - )} - {user?.postalCode && ( - - - Postal Code: + + + + This action will immediately remove the license from the user's account. + The user may lose access to associated services and features. + + + + {licenseError && ( + + {licenseError} + + )} + + + + + + + + {/* Add License Dialog */} + + + Add License + + + + Select a license to assign to {user?.displayName}. + + + + + Select License + + + + + {selectedLicenseToAdd && !addLicenseSuccess && ( + + + {getSelectedLicenseDisplayName()} will be assigned to this user. + + + )} + + {!addLicenseSuccess && ( + } + sx={{ + mt: 2, + backgroundColor: (theme) => alpha(theme.palette.info.main, 0.08), + '& .MuiAlert-icon': { + color: 'info.main', + }, + }} + > + + Tip: If you do not see the license you need, you will need to add it to the tenant first. + + + )} + + {addLicenseSuccess && ( + + {addLicenseSuccess} + + )} + + {addLicenseError && ( + + {addLicenseError} + + )} + + + + {!addLicenseSuccess && ( + + )} + + ); }; @@ -509,4 +1141,5 @@ CippUserInfoCard.propTypes = { user: PropTypes.object, tenant: PropTypes.string, isFetching: PropTypes.bool, + onRefresh: PropTypes.func, }; diff --git a/frontend/src/components/CippComponents/AppRegistrationActions.jsx b/frontend/src/components/CippComponents/AppRegistrationActions.jsx index 165c1bbebe..19d3f95083 100644 --- a/frontend/src/components/CippComponents/AppRegistrationActions.jsx +++ b/frontend/src/components/CippComponents/AppRegistrationActions.jsx @@ -12,6 +12,7 @@ const entraLinkActions = (forHeaderMenu) => { { icon: , label: 'View App Registration', + category: "view", link: `https://entra.microsoft.com/[Tenant]/#view/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/~/Overview/appId/[appId]/isMSAApp/`, pinned: true, color: 'info', @@ -23,6 +24,7 @@ const entraLinkActions = (forHeaderMenu) => { { icon: , label: 'View API Permissions', + category: "view", link: `https://entra.microsoft.com/[Tenant]/#view/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/~/CallAnAPI/appId/[appId]/isMSAApp/`, pinned: true, color: 'info', @@ -37,6 +39,7 @@ const entraLinkActions = (forHeaderMenu) => { const editInEntraAction = { icon: , label: 'Edit App Registration', + category: "edit", link: `https://entra.microsoft.com/[Tenant]/#view/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/~/AppRegSettings/appId/[appId]/isMSAApp/`, pinned: true, color: 'success', @@ -83,6 +86,7 @@ export const getAppRegistrationPostAndDestructiveActions = (canWriteApplication) { icon: , label: 'Create Enterprise App Template (Multi-Tenant)', + category: "manage", type: 'POST', color: 'info', multiPost: false, @@ -110,6 +114,7 @@ export const getAppRegistrationPostAndDestructiveActions = (canWriteApplication) { icon: , label: 'Create Manifest Template (Single-Tenant)', + category: "manage", type: 'POST', color: 'success', multiPost: false, @@ -163,6 +168,7 @@ export const getAppRegistrationPostAndDestructiveActions = (canWriteApplication) { icon: , label: 'Add Client Secret', + category: "security", type: 'POST', color: 'success', multiPost: false, @@ -182,6 +188,7 @@ export const getAppRegistrationPostAndDestructiveActions = (canWriteApplication) { icon: , label: 'Remove Password Credentials', + category: "security", type: 'POST', color: 'warning', multiPost: false, @@ -218,6 +225,7 @@ export const getAppRegistrationPostAndDestructiveActions = (canWriteApplication) { icon: , label: 'Remove Certificate Credentials', + category: "security", type: 'POST', color: 'warning', multiPost: false, @@ -236,6 +244,7 @@ export const getAppRegistrationPostAndDestructiveActions = (canWriteApplication) { icon: , label: 'Delete App Registration', + category: "danger", type: 'POST', color: 'error', multiPost: false, @@ -274,6 +283,7 @@ export const getAppRegistrationEditActions = (canWriteApplication) => [ { icon: , label: 'Edit Authentication', + category: "edit", type: 'POST', color: 'info', multiPost: false, @@ -367,7 +377,8 @@ export const getAppRegistrationEditActions = (canWriteApplication) => [ export const getAppRegistrationListActions = (canWriteApplication) => [ { icon: , - label: 'View in CIPP', + label: 'View in Manage365', + category: "view", link: '/tenant/administration/applications/app-registration?appId=[appId]&tenantFilter=[Tenant]', pinned: true, color: 'info', diff --git a/frontend/src/components/CippComponents/AssessmentCard.jsx b/frontend/src/components/CippComponents/AssessmentCard.jsx index 805808b3bf..bb73f0c8d1 100644 --- a/frontend/src/components/CippComponents/AssessmentCard.jsx +++ b/frontend/src/components/CippComponents/AssessmentCard.jsx @@ -1,386 +1,218 @@ -import { - Card, - CardHeader, - CardContent, - Box, - Typography, - Skeleton, - Tooltip, -} from "@mui/material"; -import { CippIcons } from "../../utils/icon-registry"; -import { useRouter } from "next/router"; +import { Card, CardHeader, CardContent, Box, Typography, Skeleton, Button, useMediaQuery, useTheme, Tooltip } from "@mui/material"; +import { Security as SecurityIcon, Refresh as RefreshIcon, Close as CloseIcon } from "@mui/icons-material"; +import { ResponsiveContainer, RadialBarChart, RadialBar, PolarAngleAxis } from "recharts"; import { CippTimeAgo } from "../CippComponents/CippTimeAgo"; +import CippFormComponent from "../CippComponents/CippFormComponent"; +import { CippAddTestReportDrawer } from "../CippComponents/CippAddTestReportDrawer"; +import { useState, useEffect, useRef, useCallback } from "react"; -// Each assessment category lines up with a dashboard tab, so its row links straight to the -// matching result list. Keys match the `key` values in testCategories below. -const categoryTabPaths = { - identity: "/dashboardv2/identity", - devices: "/dashboardv2/devices", - custom: "/dashboardv2/custom", -}; +export const AssessmentCard = ({ + data, + isLoading, + reports = [], + formControl, + onRefresh, + onDelete, + selectedReport +}) => { + const chartContainerRef = useRef(null); + const [containerReady, setContainerReady] = useState(false); + + // Check if container has valid dimensions - used both in effect and during render + const hasValidDimensions = useCallback(() => { + if (!chartContainerRef.current) return false; + const { width, height } = chartContainerRef.current.getBoundingClientRect(); + return width > 0 && height > 0; + }, []); -export const AssessmentCard = ({ data, isLoading, title, description }) => { - const router = useRouter(); + useEffect(() => { + const checkContainer = () => { + if (hasValidDimensions()) { + setContainerReady(true); + } else { + setContainerReady(false); + } + }; + + // Check immediately and after a short delay to handle layout timing + checkContainer(); + const timer = setTimeout(checkContainer, 100); + + // Also observe resize changes + const resizeObserver = new ResizeObserver(checkContainer); + if (chartContainerRef.current) { + resizeObserver.observe(chartContainerRef.current); + } + + return () => { + clearTimeout(timer); + resizeObserver.disconnect(); + }; + }, [isLoading, hasValidDimensions]); - // Jump to the category's tab, keeping the currently selected test suite (reportId) so the - // destination list stays in sync with what the card is summarising. - const navigateToCategory = (key) => { - const path = categoryTabPaths[key]; - if (!path) return; - const reportId = router.query?.reportId; - router.push(reportId ? { pathname: path, query: { reportId } } : path); - }; + // Synchronous check during render - if state says ready but dimensions are invalid, don't render chart + const canRenderChart = containerReady && hasValidDimensions(); // Extract data with null safety const identityPassed = data?.TestResultSummary?.IdentityPassed || 0; - const identityFailed = data?.TestResultSummary?.IdentityFailed || 0; - const identitySkipped = data?.TestResultSummary?.IdentitySkipped || 0; - const identityInformational = data?.TestResultSummary?.IdentityInformational || 0; - const identityNeedsAttention = data?.TestResultSummary?.IdentityNeedsAttention || 0; - const identityTotal = data?.TestResultSummary?.IdentityTotal || 0; + const identityTotal = data?.TestResultSummary?.IdentityTotal || 1; const devicesPassed = data?.TestResultSummary?.DevicesPassed || 0; - const devicesFailed = data?.TestResultSummary?.DevicesFailed || 0; - const devicesSkipped = data?.TestResultSummary?.DevicesSkipped || 0; - const devicesInformational = data?.TestResultSummary?.DevicesInformational || 0; - const devicesNeedsAttention = data?.TestResultSummary?.DevicesNeedsAttention || 0; const devicesTotal = data?.TestResultSummary?.DevicesTotal || 0; - const customPassed = data?.TestResultSummary?.CustomPassed || 0; - const customFailed = data?.TestResultSummary?.CustomFailed || 0; - const customSkipped = data?.TestResultSummary?.CustomSkipped || 0; - const customInformational = data?.TestResultSummary?.CustomInformational || 0; - const customNeedsAttention = data?.TestResultSummary?.CustomNeedsAttention || 0; - const customTotal = data?.TestResultSummary?.CustomTotal || 0; - const overallPassed = identityPassed + devicesPassed + customPassed; - const overallFailed = identityFailed + devicesFailed + customFailed; - const overallSkipped = identitySkipped + devicesSkipped + customSkipped; - const overallInformational = - identityInformational + devicesInformational + customInformational; - const overallNeedsAttention = - identityNeedsAttention + devicesNeedsAttention + customNeedsAttention; - const overallTotal = identityTotal + devicesTotal + customTotal; - - // Determine if we should show section - const hasIdentityTests = identityTotal > 0; + // Determine if we should show devices section const hasDeviceTests = devicesTotal > 0; - const hasCustomTests = customTotal > 0; - const testCategories = [ - { - key: "identity", - label: "Identity", - passed: identityPassed, - failed: identityFailed, - skipped: identitySkipped, - informational: identityInformational, - needsAttention: identityNeedsAttention, - total: identityTotal, - show: hasIdentityTests, - }, - { - key: "devices", - label: "Devices", - passed: devicesPassed, - failed: devicesFailed, - skipped: devicesSkipped, - informational: devicesInformational, - needsAttention: devicesNeedsAttention, - total: devicesTotal, - show: hasDeviceTests, - }, - { - key: "custom", - label: "Custom", - passed: customPassed, - failed: customFailed, - skipped: customSkipped, - informational: customInformational, - needsAttention: customNeedsAttention, - total: customTotal, - show: hasCustomTests, - }, - ].filter((category) => category.show); + // Calculate percentages for the radial chart + // If no device tests, set devices to 100% (complete) + const devicesPercentage = hasDeviceTests ? (devicesPassed / devicesTotal) * 100 : 100; + const identityPercentage = (identityPassed / identityTotal) * 100; - const overallCategory = { - label: "Overall", - passed: overallPassed, - failed: overallFailed, - skipped: overallSkipped, - informational: overallInformational, - needsAttention: overallNeedsAttention, - total: overallTotal, - show: overallTotal > 0, - }; - const overallTotalFromValues = - overallCategory.passed + - overallCategory.failed + - overallCategory.skipped + - overallCategory.informational + - overallCategory.needsAttention; - const overallDenominator = overallCategory.total > 0 ? overallCategory.total : overallTotalFromValues; - const overallPassWidth = overallDenominator > 0 ? (overallCategory.passed / overallDenominator) * 100 : 0; - const overallFailWidth = overallDenominator > 0 ? (overallCategory.failed / overallDenominator) * 100 : 0; - const overallSkipWidth = overallDenominator > 0 ? (overallCategory.skipped / overallDenominator) * 100 : 0; - const overallInfoWidth = - overallDenominator > 0 ? (overallCategory.informational / overallDenominator) * 100 : 0; - const overallNeedsAttentionWidth = - overallDenominator > 0 ? (overallCategory.needsAttention / overallDenominator) * 100 : 0; - const overallStatusItems = [ - { - key: "pass", - value: overallCategory.passed, - label: "Pass", - color: "success.main", - }, - { - key: "fail", - value: overallCategory.failed, - label: "Fail", - color: "error.main", - }, - { - key: "skip", - value: overallCategory.skipped, - label: "Skip", - color: "warning.main", - }, + const theme = useTheme(); + const smDown = useMediaQuery(theme.breakpoints.down("sm")); + + // Use theme-aware colors for the chart + const chartData = [ { - key: "info", - value: overallCategory.informational, - label: "Info", - color: "info.main", + name: "Devices", + value: devicesPercentage, + fill: "hsl(140, 55%, 48%)", // Green matching the design system }, { - key: "attention", - value: overallCategory.needsAttention, - label: "Attention", - color: "text.primary", + name: "Identity", + value: identityPercentage, + fill: "hsl(210, 65%, 55%)", // Blue matching the design system }, - ].filter((item) => item.value > 0); + ]; - const descriptionText = description || "No description available for the selected test suite."; + // Check if report controls are provided + const hasReportControls = formControl && reports.length > 0; return ( - + - - {title || "Assessment"} + + + Assessment } - sx={{ pb: 1 }} + sx={{ py: 1, px: 1.5 }} /> - - - - {isLoading ? ( - - - - - - - - - - - - + + {/* Report Controls */} + {hasReportControls && ( + + + + ({ + label: r.name, + value: r.id, + description: r.description, + }))} + placeholder="Select report" + size="small" + /> - ) : ( - - - - Description - - + + + + + + + + + + + + + + + + )} + + + + + Identity + + + {isLoading ? ( + + ) : ( + <> + + {identityPassed} + + /{identityTotal} - {descriptionText} - - - - {testCategories.length > 0 ? ( - - {testCategories.map((category) => { - const totalFromValues = - category.passed + - category.failed + - category.skipped + - category.informational + - category.needsAttention; - const denominator = category.total > 0 ? category.total : totalFromValues; - const passWidth = denominator > 0 ? (category.passed / denominator) * 100 : 0; - const failWidth = denominator > 0 ? (category.failed / denominator) * 100 : 0; - const skipWidth = denominator > 0 ? (category.skipped / denominator) * 100 : 0; - const infoWidth = denominator > 0 ? (category.informational / denominator) * 100 : 0; - const needsAttentionWidth = - denominator > 0 ? (category.needsAttention / denominator) * 100 : 0; - const statusItems = [ - { - key: "pass", - value: category.passed, - label: "Pass", - color: "success.main", - }, - { - key: "fail", - value: category.failed, - label: "Fail", - color: "error.main", - }, - { - key: "skip", - value: category.skipped, - label: "Skip", - color: "warning.main", - }, - { - key: "info", - value: category.informational, - label: "Info", - color: "info.main", - }, - { - key: "attention", - value: category.needsAttention, - label: "Attention", - color: "text.primary", - }, - ].filter((item) => item.value > 0); - - return ( - navigateToCategory(category.key)} - onKeyDown={(event) => { - if (event.key === "Enter" || event.key === " ") { - event.preventDefault(); - navigateToCategory(category.key); - } - }} - role="button" - tabIndex={0} - aria-label={`View ${category.label} test results`} - sx={{ - cursor: "pointer", - borderRadius: 1, - mx: -0.5, - px: 0.5, - transition: "background-color 0.15s ease-in-out", - "&:hover": { bgcolor: "action.hover" }, - "&:hover .assessment-category-label": { - color: "primary.main", - textDecoration: "underline", - }, - }} - > - - {category.label + ` (${category.total})`} - - - - - - - - - - {statusItems.length > 0 ? ( - statusItems.map((item, index) => ( - - {index > 0 ? " / " : ""} - - {item.value} {item.label} - - - )) - ) : ( - No results - )} - - - ); - })} - - ) : ( - - - No assessment tests available + color="text.secondary" + sx={{ ml: 0.5 }} + fontSize="0.65rem" + > + tests - + )} + + + {hasDeviceTests && ( + + + Devices + + + {isLoading ? ( + + ) : ( + <> + + {devicesPassed} + + /{devicesTotal} + + tests + + + )} + )} - - - - + Last Data Collection - + {isLoading ? ( - + ) : data?.ExecutedAt ? ( ) : ( @@ -388,53 +220,43 @@ export const AssessmentCard = ({ data, isLoading, title, description }) => { )} - + + {isLoading ? ( - - - - ) : overallCategory.show && ( - - - {overallCategory.label + ` (${overallCategory.total})`} - - - - - - - - - - {overallStatusItems.length > 0 ? ( - overallStatusItems.map((item, index) => ( - - {index > 0 ? " / " : ""} - - {item.value} {item.label} - - - )) - ) : ( - - No results - - )} - + + ) : canRenderChart ? ( + + + + + + + + ) : ( + )} diff --git a/frontend/src/components/CippComponents/AuthMethodCard.jsx b/frontend/src/components/CippComponents/AuthMethodCard.jsx index 02eea87ff4..d34fb903e0 100644 --- a/frontend/src/components/CippComponents/AuthMethodCard.jsx +++ b/frontend/src/components/CippComponents/AuthMethodCard.jsx @@ -3,8 +3,11 @@ import { CippIcons } from "../../utils/icon-registry"; import { CippSankey } from "./CippSankey"; import { useRouter } from "next/router"; -export const AuthMethodCard = ({ data, isLoading }) => { +export const AuthMethodCard = ({ data, isLoading, compact = false }) => { const router = useRouter(); + const chartHeight = compact ? 220 : 300; + const titleVariant = compact ? "subtitle1" : "h6"; + const descriptionVariant = compact ? "caption" : "body2"; const processData = () => { if (!data || !Array.isArray(data) || data.length === 0) { @@ -111,21 +114,21 @@ export const AuthMethodCard = ({ data, isLoading }) => { if (passkeyCount > 0) links.push({ source: "Phish resistant", target: "Passkey", value: passkeyCount }); - if (whfbCount > 0) links.push({ source: "Phish resistant", target: "WHfB", value: whfbCount }); + if (whfbCount > 0) links.push({ source: "Phish resistant", target: "Windows Hello", value: whfbCount }); const description = `${mfaPercentage}% of enabled users have MFA configured. ${phishResistantPercentage}% use phish-resistant authentication methods.`; return { nodes: [ - { id: "Users", nodeColor: "hsl(28, 100%, 53%)" }, - { id: "Single factor", nodeColor: "hsl(0, 100%, 50%)" }, - { id: "Multi factor", nodeColor: "hsl(200, 70%, 50%)" }, - { id: "Phishable", nodeColor: "hsl(39, 100%, 50%)" }, - { id: "Phone", nodeColor: "hsl(39, 100%, 45%)" }, - { id: "Authenticator", nodeColor: "hsl(39, 100%, 55%)" }, - { id: "Phish resistant", nodeColor: "hsl(99, 70%, 50%)" }, - { id: "Passkey", nodeColor: "hsl(140, 70%, 50%)" }, - { id: "WHfB", nodeColor: "hsl(160, 70%, 50%)" }, + { id: "Users", nodeColor: "hsl(220, 60%, 75%)" }, + { id: "Single factor", nodeColor: "hsl(0, 55%, 72%)" }, + { id: "Multi factor", nodeColor: "hsl(200, 55%, 72%)" }, + { id: "Phishable", nodeColor: "hsl(35, 65%, 75%)" }, + { id: "Phone", nodeColor: "hsl(35, 55%, 70%)" }, + { id: "Authenticator", nodeColor: "hsl(35, 60%, 78%)" }, + { id: "Phish resistant", nodeColor: "hsl(140, 50%, 72%)" }, + { id: "Passkey", nodeColor: "hsl(160, 50%, 72%)" }, + { id: "Windows Hello", nodeColor: "hsl(180, 50%, 72%)" }, ], links, description, @@ -214,7 +217,7 @@ export const AuthMethodCard = ({ data, isLoading }) => { }; return ( - + { "&:hover": { textDecoration: "underline" }, }} > - - All users auth methods + + All users auth methods } - sx={{ pb: 1 }} + sx={{ pb: compact ? 0.5 : 1, flexShrink: 0 }} /> - - + + {isLoading ? ( - + ) : processedData ? ( { width: "100%", }} > - + No authentication method data available @@ -264,10 +273,8 @@ export const AuthMethodCard = ({ data, isLoading }) => { {!isLoading && processedData?.description && ( - - + + {processedData.description} diff --git a/frontend/src/components/CippComponents/AuthMethodSankey.jsx b/frontend/src/components/CippComponents/AuthMethodSankey.jsx index 3bbffe5643..ac57a1d61a 100644 --- a/frontend/src/components/CippComponents/AuthMethodSankey.jsx +++ b/frontend/src/components/CippComponents/AuthMethodSankey.jsx @@ -119,7 +119,7 @@ export const AuthMethodSankey = ({ data }) => { // Add phish-resistant method breakdowns if (passkeyCount > 0) links.push({ source: "Phish resistant", target: "Passkey", value: passkeyCount }); - if (whfbCount > 0) links.push({ source: "Phish resistant", target: "WHfB", value: whfbCount }); + if (whfbCount > 0) links.push({ source: "Phish resistant", target: "Windows Hello", value: whfbCount }); const description = `${mfaPercentage}% of enabled users have MFA configured. ${phishResistantPercentage}% use phish-resistant authentication methods.`; @@ -161,7 +161,7 @@ export const AuthMethodSankey = ({ data }) => { nodeColor: "hsl(140, 70%, 50%)", }, { - id: "WHfB", + id: "Windows Hello", nodeColor: "hsl(160, 70%, 50%)", }, ], diff --git a/frontend/src/components/CippComponents/BPASyncDialog.jsx b/frontend/src/components/CippComponents/BPASyncDialog.jsx new file mode 100644 index 0000000000..3add79b46f --- /dev/null +++ b/frontend/src/components/CippComponents/BPASyncDialog.jsx @@ -0,0 +1,84 @@ +import { useState } from "react"; +import { + Dialog, + DialogContent, + DialogTitle, + Button, + DialogActions, +} from "@mui/material"; +import { Sync } from "@mui/icons-material"; +import { useForm, FormProvider } from "react-hook-form"; +import { CippFormTenantSelector } from "./CippFormTenantSelector"; +import { ApiPostCall } from "../../api/ApiCall"; +import { CippApiResults } from "./CippApiResults"; + +export const BPASyncDialog = ({ createDialog }) => { + const methods = useForm({ + defaultValues: { + tenantFilter: { + value: "AllTenants", + label: "*All Tenants", + }, + }, + }); + + // Use methods for form handling and control + const { handleSubmit, control } = methods; + + const [isSyncing, setIsSyncing] = useState(false); + const bpaSyncResults = ApiPostCall({ + urlFromData: true, + }); + + const handleForm = (values) => { + bpaSyncResults.mutate({ + url: "/api/ExecBPA", + queryKey: `bpa-sync-${values.tenantFilter}`, + data: values.tenantFilter ? { TenantFilter: values.tenantFilter } : {}, + }); + }; + + // Reset syncing state when dialog is closed + const handleClose = () => { + setIsSyncing(false); + createDialog.handleClose(); + }; + + return ( + + +
    + Force BPA Sync + +
    +

    + This will force a Best Practice Analyzer (BPA) sync. Select a tenant (or all + tenants) below. +

    + +
    + +     + + + + +
    +     +     + ); +}; diff --git a/frontend/src/components/CippComponents/CIPPDeviceCodeButton.js b/frontend/src/components/CippComponents/CIPPDeviceCodeButton.js new file mode 100644 index 0000000000..16711f8d13 --- /dev/null +++ b/frontend/src/components/CippComponents/CIPPDeviceCodeButton.js @@ -0,0 +1,252 @@ +import { useState, useEffect } from "react"; +import { + Alert, + Button, + Typography, + CircularProgress, + Box, +} from "@mui/material"; +import { ApiGetCall } from "../../api/ApiCall"; + +/** + * CIPPDeviceCodeButton - A button component for Microsoft 365 OAuth authentication using device code flow + * + * @param {Object} props - Component props + * @param {Function} props.onAuthSuccess - Callback function called when authentication is successful with token data + * @param {Function} props.onAuthError - Callback function called when authentication fails with error data + * @param {string} props.buttonText - Text to display on the button (default: "Login with Device Code") + * @param {boolean} props.showResults - Whether to show authentication results in the component (default: true) + * @returns {JSX.Element} The CIPPDeviceCodeButton component + */ +export const CIPPDeviceCodeButton = ({ + onAuthSuccess, + onAuthError, + buttonText = "Login with Device Code", + showResults = true, +}) => { + const [authInProgress, setAuthInProgress] = useState(false); + const [authError, setAuthError] = useState(null); + const [deviceCodeInfo, setDeviceCodeInfo] = useState(null); + const [currentStep, setCurrentStep] = useState(0); + const [pollInterval, setPollInterval] = useState(null); + const [tokens, setTokens] = useState({ + accessToken: null, + refreshToken: null, + accessTokenExpiresOn: null, + refreshTokenExpiresOn: null, + username: null, + tenantId: null, + onmicrosoftDomain: null, + }); + + // Get application ID information from API + const appIdInfo = ApiGetCall({ + url: `/api/ExecListAppId`, + queryKey: `ExecListAppId`, + waiting: true, + }); + + // Handle closing the error + const handleCloseError = () => { + setAuthError(null); + }; + + // Clear polling interval when component unmounts + useEffect(() => { + return () => { + if (pollInterval) { + clearInterval(pollInterval); + } + }; + }, [pollInterval]); + + // Start device code authentication + const startDeviceCodeAuth = async () => { + try { + setAuthInProgress(true); + setAuthError(null); + setDeviceCodeInfo(null); + setCurrentStep(1); + + // Call the API to start device code flow + const response = await fetch(`/api/ExecSAMSetup?CreateSAM=true`, { + method: 'GET', + headers: { + 'Content-Type': 'application/json', + }, + }); + + const data = await response.json(); + + if (response.ok && data.code) { + // Store device code info + setDeviceCodeInfo({ + user_code: data.code, + verification_uri: data.url, + expires_in: 900, // Default to 15 minutes if not provided + }); + + // Start polling for token + const interval = setInterval(checkAuthStatus, 5000); + setPollInterval(interval); + } else { + // Error getting device code + setAuthError({ + errorCode: "device_code_error", + errorMessage: data.message || "Failed to get device code", + timestamp: new Date().toISOString(), + }); + setAuthInProgress(false); + if (onAuthError) onAuthError(error); + } + } catch (error) { + console.error("Error starting device code authentication:", error); + setAuthError({ + errorCode: "device_code_error", + errorMessage: error.message || "An error occurred during device code authentication", + timestamp: new Date().toISOString(), + }); + setAuthInProgress(false); + if (onAuthError) onAuthError(error); + } + }; + + // Check authentication status + const checkAuthStatus = async () => { + try { + // Call the API to check auth status + const response = await fetch(`/api/ExecSAMSetup?CheckSetupProcess=true&step=1`, { + method: 'GET', + headers: { + 'Content-Type': 'application/json', + }, + }); + + const data = await response.json(); + + if (response.ok) { + if (data.step === 2) { + // Authentication successful + clearInterval(pollInterval); + setPollInterval(null); + + // Process token data + const tokenData = { + accessToken: "Successfully authenticated", + refreshToken: "Token stored on server", + accessTokenExpiresOn: new Date(Date.now() + 3600 * 1000), // 1 hour from now + refreshTokenExpiresOn: new Date(Date.now() + 90 * 24 * 60 * 60 * 1000), // 90 days from now + username: "authenticated user", + tenantId: data.tenantId || "unknown", + onmicrosoftDomain: null, + }; + + // Store tokens in component state + setTokens(tokenData); + setDeviceCodeInfo(null); + setCurrentStep(2); + + // Call the onAuthSuccess callback if provided + if (onAuthSuccess) onAuthSuccess(tokenData); + + // Update UI state + setAuthInProgress(false); + } + } else { + // Error checking auth status + clearInterval(pollInterval); + setPollInterval(null); + + setAuthError({ + errorCode: "auth_status_error", + errorMessage: data.message || "Failed to check authentication status", + timestamp: new Date().toISOString(), + }); + setAuthInProgress(false); + if (onAuthError) onAuthError({ + errorCode: "auth_status_error", + errorMessage: data.message || "Failed to check authentication status", + timestamp: new Date().toISOString(), + }); + } + } catch (error) { + console.error("Error checking auth status:", error); + // Don't stop polling on transient errors + } + }; + + return ( +
    + + + {!appIdInfo.isLoading && + !appIdInfo?.data?.applicationId && ( + + The Application ID is not valid. Please check your configuration. + + ) + } + + {showResults && ( + + {deviceCodeInfo && authInProgress ? ( + + Device Code Authentication + + To sign in, use a web browser to open the page {deviceCodeInfo.verification_uri} and enter the code {deviceCodeInfo.user_code} to authenticate. + + + Code expires in {Math.round(deviceCodeInfo.expires_in / 60)} minutes + + + ) : tokens.accessToken ? ( + + Authentication Successful + + You've successfully refreshed your token using device code flow. + + {tokens.tenantId && ( + + Tenant ID: {tokens.tenantId} + + )} + + ) : authError ? ( + + Authentication Error: {authError.errorCode} + {authError.errorMessage} + + Time: {authError.timestamp} + + + + + + ) : null} + + )} +
    + ); +}; + +export default CIPPDeviceCodeButton; \ No newline at end of file diff --git a/frontend/src/components/CippComponents/CIPPM365OAuthButton.jsx b/frontend/src/components/CippComponents/CIPPM365OAuthButton.jsx index 2ae25c9675..489f146d6e 100644 --- a/frontend/src/components/CippComponents/CIPPM365OAuthButton.jsx +++ b/frontend/src/components/CippComponents/CIPPM365OAuthButton.jsx @@ -8,23 +8,23 @@ import { CippApiDialog } from './CippApiDialog' export const CIPPM365OAuthButton = ({ onAuthSuccess, onAuthError, - buttonText = 'Login with Microsoft', + buttonText = "Login with Microsoft", showResults = true, showSuccessAlert = true, - scope = 'https://graph.microsoft.com/.default offline_access profile openid', + scope = "https://graph.microsoft.com/.default offline_access profile openid", useDeviceCode = false, applicationId = null, autoStartDeviceLogon = false, validateServiceAccount = true, promptBeforeAuth = false, - disabled = false, }) => { - const [authInProgress, setAuthInProgress] = useState(false) - const [authError, setAuthError] = useState(null) - const [deviceCodeInfo, setDeviceCodeInfo] = useState(null) - const [codeRetrievalInProgress, setCodeRetrievalInProgress] = useState(false) - const [isServiceAccount, setIsServiceAccount] = useState(true) - const [promptDialog, setPromptDialog] = useState({ open: false }) + const [authInProgress, setAuthInProgress] = useState(false); + const [authError, setAuthError] = useState(null); + const [deviceCodeInfo, setDeviceCodeInfo] = useState(null); + const [codeRetrievalInProgress, setCodeRetrievalInProgress] = useState(false); + const [isServiceAccount, setIsServiceAccount] = useState(true); + const [promptDialog, setPromptDialog] = useState({ open: false }); + const [deviceCodeRestart, setDeviceCodeRestart] = useState(false); const [tokens, setTokens] = useState({ accessToken: null, refreshToken: null, @@ -33,164 +33,112 @@ export const CIPPM365OAuthButton = ({ username: null, tenantId: null, onmicrosoftDomain: null, - }) + }); const appIdInfo = ApiGetCall({ url: `/api/ExecListAppId`, - queryKey: 'listAppId', + queryKey: "listAppId", waiting: true, - }) - - // Closing the device login window does not cancel anything - the device code stays - // valid server side until it expires and can be completed in any browser. So the - // watcher below never stops the poll; it only tracks whether the window is gone so - // the UI can offer a way back in instead of sitting on a disabled "Authenticating..." - // button for the full 15 minutes. - const devicePopupRef = useRef(null) - const devicePopupWatcherRef = useRef(null) - const devicePollIdRef = useRef(0) - const [devicePopupClosed, setDevicePopupClosed] = useState(false) - - const stopDevicePopupWatcher = () => { - if (devicePopupWatcherRef.current) { - clearInterval(devicePopupWatcherRef.current) - devicePopupWatcherRef.current = null - } - } - - const openDeviceLoginPopup = () => { - const width = 500 - const height = 600 - const left = window.screen.width / 2 - width / 2 - const top = window.screen.height / 2 - height / 2 - - const popup = window.open( - 'https://microsoft.com/devicelogin', - 'deviceLoginPopup', - `width=${width},height=${height},left=${left},top=${top}` - ) + }); - stopDevicePopupWatcher() - devicePopupRef.current = popup + // Auth flows are started from click handlers, not effects, so their + // BroadcastChannel, 10-minute timeout, and device-code polling would + // otherwise keep running after the component unmounts. + const isMountedRef = useRef(true); + const activeAuthCleanupRef = useRef(null); + const devicePollTimeoutRef = useRef(null); + const devicePopupWatchRef = useRef(null); - // A blocked popup is indistinguishable from a closed one as far as the user is - // concerned - both leave them with no window to sign in through. - if (!popup) { - setDevicePopupClosed(true) - return null - } - - setDevicePopupClosed(false) - devicePopupWatcherRef.current = setInterval(() => { - if (popup.closed) { - stopDevicePopupWatcher() - setDevicePopupClosed(true) + useEffect(() => { + isMountedRef.current = true; + return () => { + isMountedRef.current = false; + if (activeAuthCleanupRef.current) { + activeAuthCleanupRef.current(); + activeAuthCleanupRef.current = null; } - }, 1000) - - return popup - } - - const closeDeviceLoginPopup = () => { - stopDevicePopupWatcher() - const popup = devicePopupRef.current - if (popup && !popup.closed) { - popup.close() - } - devicePopupRef.current = null - setDevicePopupClosed(false) - } - - useEffect(() => stopDevicePopupWatcher, []) - - // Reopening the window is not offered: a user code is consumed the moment it is entered, - // so once someone has typed it in, re-entering the same code fails. Closing the window - // part way through a sign-in is therefore unrecoverable except with a fresh code. The - // poll is left running anyway, because the sign-in may still be getting finished at - // microsoft.com/devicelogin in another browser. - const canRestartDeviceLogin = useDeviceCode && authInProgress && devicePopupClosed - - const restartDeviceLogin = async () => { - // Supersede the in-flight poll before requesting a new code, or it would keep - // polling the old device_code alongside the new one. - devicePollIdRef.current += 1 - closeDeviceLoginPopup() - setAuthInProgress(false) - setAuthError(null) - setDeviceCodeInfo(null) - await retrieveDeviceCode() - } + if (devicePollTimeoutRef.current) { + clearTimeout(devicePollTimeoutRef.current); + devicePollTimeoutRef.current = null; + } + if (devicePopupWatchRef.current) { + clearInterval(devicePopupWatchRef.current); + devicePopupWatchRef.current = null; + } + }; + }, []); const handleCloseError = () => { - setAuthError(null) - } + setAuthError(null); + }; const checkIsServiceAccount = (username) => { - if (!username || !validateServiceAccount) return true // If no username or validation disabled, don't show warning + if (!username || !validateServiceAccount) return true; // If no username or validation disabled, don't show warning - const lowerUsername = username.toLowerCase() - return lowerUsername.includes('service') || lowerUsername.includes('cipp') - } + const lowerUsername = username.toLowerCase(); + return lowerUsername.includes("service") || lowerUsername.includes("cipp"); + }; // Function to retrieve device code const retrieveDeviceCode = async () => { - setCodeRetrievalInProgress(true) - setAuthError(null) + setCodeRetrievalInProgress(true); + setDeviceCodeRestart(false); + setAuthError(null); // Only refetch appId if not already present if (!applicationId && !appIdInfo?.data?.applicationId) { - await appIdInfo.refetch() + await appIdInfo.refetch(); } try { // Get the application ID to use const appId = - applicationId || appIdInfo?.data?.applicationId || '1b730954-1685-4b74-9bfd-dac224a7b894' // Default to MS Graph Explorer app ID + applicationId || appIdInfo?.data?.applicationId || "1b730954-1685-4b74-9bfd-dac224a7b894"; // Default to MS Graph Explorer app ID // Request device code from our API endpoint const deviceCodeResponse = await fetch( `/api/ExecDeviceCodeLogon?operation=getDeviceCode&clientId=${appId}&scope=${encodeURIComponent( - scope - )}` - ) - const deviceCodeData = await deviceCodeResponse.json() + scope, + )}`, + ); + const deviceCodeData = await deviceCodeResponse.json(); if (deviceCodeResponse.ok && deviceCodeData.user_code) { // Store device code info - setDeviceCodeInfo(deviceCodeData) + setDeviceCodeInfo(deviceCodeData); } else { // Error getting device code setAuthError({ - errorCode: deviceCodeData.error || 'device_code_error', - errorMessage: deviceCodeData.error_description || 'Failed to get device code', + errorCode: deviceCodeData.error || "device_code_error", + errorMessage: deviceCodeData.error_description || "Failed to get device code", timestamp: new Date().toISOString(), - }) + }); } } catch (error) { setAuthError({ - errorCode: 'device_code_error', - errorMessage: error.message || 'An error occurred retrieving device code', + errorCode: "device_code_error", + errorMessage: error.message || "An error occurred retrieving device code", timestamp: new Date().toISOString(), - }) + }); } finally { - setCodeRetrievalInProgress(false) + setCodeRetrievalInProgress(false); } - } + }; // Device code authentication function - opens popup and starts polling const handleDeviceCodeAuthentication = async () => { // Only refetch appId if not already present if (!applicationId && !appIdInfo?.data?.applicationId) { - await appIdInfo.refetch() + await appIdInfo.refetch(); } if (!deviceCodeInfo) { // If we don't have a device code yet, retrieve it first - await retrieveDeviceCode() - return + await retrieveDeviceCode(); + return; } - setAuthInProgress(true) + setAuthInProgress(true); setTokens({ accessToken: null, refreshToken: null, @@ -199,125 +147,159 @@ export const CIPPM365OAuthButton = ({ username: null, tenantId: null, onmicrosoftDomain: null, - }) + }); try { // Get the application ID to use - refetch already happened at the start of this function const appId = - applicationId || appIdInfo?.data?.applicationId || '1b730954-1685-4b74-9bfd-dac224a7b894' // Default to MS Graph Explorer app ID + applicationId || appIdInfo?.data?.applicationId || "1b730954-1685-4b74-9bfd-dac224a7b894"; // Default to MS Graph Explorer app ID + + // Open popup to device login page + const width = 500; + const height = 600; + const left = window.screen.width / 2 - width / 2; + const top = window.screen.height / 2 - height / 2; + + const popup = window.open( + "https://microsoft.com/devicelogin", + "deviceLoginPopup", + `width=${width},height=${height},left=${left},top=${top}`, + ); + + const stopDevicePoll = () => { + if (devicePollTimeoutRef.current) { + clearTimeout(devicePollTimeoutRef.current); + devicePollTimeoutRef.current = null; + } + }; - // Open popup to device login page. If it is closed or blocked the poll below keeps - // running - the button turns into "Reopen sign-in window" rather than locking up. - openDeviceLoginPopup() + // The device code is consumed once it is entered. A closed window cannot resume it. + if (popup) { + devicePopupWatchRef.current = setInterval(() => { + if (!isMountedRef.current || !popup.closed) { + return; + } + clearInterval(devicePopupWatchRef.current); + devicePopupWatchRef.current = null; + stopDevicePoll(); + setAuthInProgress(false); + setDeviceCodeRestart(true); + }, 1000); + } // Start polling for token - const pollInterval = deviceCodeInfo.interval || 5 - const expiresIn = deviceCodeInfo.expires_in || 900 - const startTime = Date.now() - // Identifies this attempt. Starting over bumps the ref, which retires this poll - // rather than leaving it chasing a device code the user has abandoned. - const pollId = ++devicePollIdRef.current + const pollInterval = deviceCodeInfo.interval || 5; + const expiresIn = deviceCodeInfo.expires_in || 900; + const startTime = Date.now(); const pollForToken = async () => { - if (devicePollIdRef.current !== pollId) return - + if (!isMountedRef.current) { + return; + } // Check if we've exceeded the expiration time if (Date.now() - startTime >= expiresIn * 1000) { - closeDeviceLoginPopup() + if (popup && !popup.closed) { + popup.close(); + } setAuthError({ - errorCode: 'timeout', - errorMessage: 'Device code authentication timed out', + errorCode: "timeout", + errorMessage: "Device code authentication timed out", timestamp: new Date().toISOString(), - }) - setAuthInProgress(false) - return + }); + setAuthInProgress(false); + return; } try { - // Poll for token using our API endpoint. The scope has to match the one the device - // code was issued for - omitting it here left the poll falling back to the API's - // default instead. + // Poll for token using our API endpoint const tokenResponse = await fetch( - `/api/ExecDeviceCodeLogon?operation=checkToken&clientId=${appId}&deviceCode=${ - deviceCodeInfo.device_code - }&scope=${encodeURIComponent(scope)}` - ) - const tokenData = await tokenResponse.json() - - if (tokenResponse.ok && tokenData.status === 'success') { + `/api/ExecDeviceCodeLogon?operation=checkToken&clientId=${appId}&deviceCode=${deviceCodeInfo.device_code}`, + ); + const tokenData = await tokenResponse.json(); + + if (tokenResponse.ok && tokenData.status === "success") { + if (devicePopupWatchRef.current) { + clearInterval(devicePopupWatchRef.current); + devicePopupWatchRef.current = null; + } // Successfully got token - closeDeviceLoginPopup() - handleTokenResponse(tokenData) + if (popup && !popup.closed) { + popup.close(); + } + handleTokenResponse(tokenData); } else if ( - tokenData.error === 'authorization_pending' || - tokenData.status === 'pending' + tokenData.error === "authorization_pending" || + tokenData.status === "pending" ) { // User hasn't completed authentication yet, continue polling - setTimeout(pollForToken, pollInterval * 1000) - } else if (tokenData.error === 'slow_down') { + devicePollTimeoutRef.current = setTimeout(pollForToken, pollInterval * 1000); + } else if (tokenData.error === "slow_down") { // Server asking us to slow down polling - setTimeout(pollForToken, (pollInterval + 5) * 1000) + devicePollTimeoutRef.current = setTimeout(pollForToken, (pollInterval + 5) * 1000); } else { // Other error - closeDeviceLoginPopup() + if (popup && !popup.closed) { + popup.close(); + } setAuthError({ - errorCode: tokenData.error || 'token_error', - errorMessage: tokenData.error_description || 'Failed to get token', + errorCode: tokenData.error || "token_error", + errorMessage: tokenData.error_description || "Failed to get token", timestamp: new Date().toISOString(), - }) - setAuthInProgress(false) + }); + setAuthInProgress(false); } } catch (error) { - setTimeout(pollForToken, pollInterval * 1000) + devicePollTimeoutRef.current = setTimeout(pollForToken, pollInterval * 1000); } - } + }; // Start polling - setTimeout(pollForToken, pollInterval * 1000) + devicePollTimeoutRef.current = setTimeout(pollForToken, pollInterval * 1000); } catch (error) { setAuthError({ - errorCode: 'device_code_error', - errorMessage: error.message || 'An error occurred during device code authentication', + errorCode: "device_code_error", + errorMessage: error.message || "An error occurred during device code authentication", timestamp: new Date().toISOString(), - }) - setAuthInProgress(false) + }); + setAuthInProgress(false); } - } + }; // Process token response (common for both auth methods) const handleTokenResponse = (tokenData) => { // Extract token information - const accessTokenExpiresOn = new Date(Date.now() + tokenData.expires_in * 1000) + const accessTokenExpiresOn = new Date(Date.now() + tokenData.expires_in * 1000); // Refresh tokens typically last for 90 days, but this can vary - const refreshTokenExpiresOn = new Date(Date.now() + 90 * 24 * 60 * 60 * 1000) + const refreshTokenExpiresOn = new Date(Date.now() + 90 * 24 * 60 * 60 * 1000); // Extract information from ID token if available - let username = 'unknown user' - let tenantId = 'unknown tenant' - let onmicrosoftDomain = null + let username = "unknown user"; + let tenantId = "unknown tenant"; + let onmicrosoftDomain = null; if (tokenData.id_token) { try { - const idTokenPayload = JSON.parse(atob(tokenData.id_token.split('.')[1])) + const idTokenPayload = JSON.parse(atob(tokenData.id_token.split(".")[1])); username = idTokenPayload.preferred_username || idTokenPayload.email || idTokenPayload.upn || idTokenPayload.name || - 'unknown user' + "unknown user"; if (idTokenPayload.tid) { - tenantId = idTokenPayload.tid + tenantId = idTokenPayload.tid; } - // Only accept the domain part when it actually ends in .onmicrosoft.com; a plain - // substring check would also match user@evil.onmicrosoft.com.example. - const domainPart = username && username.includes('@') ? username.split('@')[1] : '' - if (domainPart && domainPart.toLowerCase().endsWith('.onmicrosoft.com')) { - onmicrosoftDomain = domainPart + if (username && username.includes("@")) { + const domain = username.split("@")[1]; + // Validate domain ends with .onmicrosoft.com (not just contains it) + if (domain && domain.toLowerCase().endsWith(".onmicrosoft.com")) { + onmicrosoftDomain = domain; + } } - setIsServiceAccount(checkIsServiceAccount(username)) + setIsServiceAccount(checkIsServiceAccount(username)); } catch (error) {} } @@ -330,25 +312,25 @@ export const CIPPM365OAuthButton = ({ username: username, tenantId: tenantId, onmicrosoftDomain: onmicrosoftDomain, - } + }; - setTokens(tokenResult) - setDeviceCodeInfo(null) + setTokens(tokenResult); + setDeviceCodeInfo(null); - if (onAuthSuccess) onAuthSuccess(tokenResult) + if (onAuthSuccess) onAuthSuccess(tokenResult); // Update UI state - setAuthInProgress(false) - setIsServiceAccount(checkIsServiceAccount(username)) - } + setAuthInProgress(false); + setIsServiceAccount(checkIsServiceAccount(username)); + }; // MSAL-like authentication function const handleMsalAuthentication = async (retryCount = 0) => { - const maxRetries = 3 + const maxRetries = 3; // Clear previous authentication state when starting a new authentication - setAuthInProgress(true) - setAuthError(null) + setAuthInProgress(true); + setAuthError(null); setTokens({ accessToken: null, refreshToken: null, @@ -357,200 +339,160 @@ export const CIPPM365OAuthButton = ({ username: null, tenantId: null, onmicrosoftDomain: null, - }) + }); // Only refetch app ID if not already present if (!applicationId && !appIdInfo?.data?.applicationId) { - await appIdInfo.refetch() + await appIdInfo.refetch(); } // Get the application ID to use - const appId = applicationId || appIdInfo?.data?.applicationId + const appId = applicationId || appIdInfo?.data?.applicationId; // Generate MSAL-like authentication parameters const msalConfig = { auth: { clientId: appId, - authority: `https://login.microsoftonline.com/organizations`, + authority: `https://login.microsoftonline.com/common`, redirectUri: `${window.location.origin}/authredirect`, }, - } + }; // Define the request object similar to MSAL const loginRequest = { scopes: [scope], - } - - // crypto.subtle is only exposed in a secure context. Without this guard an instance - // served over plain HTTP fails on the digest below with an opaque TypeError. - if (!window.crypto?.subtle) { - const error = { - errorCode: 'insecure_context', - errorMessage: - 'Authentication requires a secure context. Serve CIPP over HTTPS (or localhost) and try again.', - timestamp: new Date().toISOString(), - } - setAuthError(error) - if (onAuthError) onAuthError(error) - setAuthInProgress(false) - return - } - - const base64UrlEncode = (bytes) => - btoa(String.fromCharCode(...new Uint8Array(bytes))) - .replace(/\+/g, '-') - .replace(/\//g, '_') - .replace(/=+$/, '') - - const randomUrlSafeString = (byteLength) => { - const array = new Uint8Array(byteLength) - window.crypto.getRandomValues(array) - return base64UrlEncode(array) - } + }; + + // Generate PKCE code verifier and challenge + const generateCodeVerifier = () => { + const array = new Uint8Array(32); + window.crypto.getRandomValues(array); + return Array.from(array, (byte) => ("0" + (byte & 0xff).toString(16)).slice(-2)).join(""); + }; + + const codeVerifier = generateCodeVerifier(); + const codeChallenge = codeVerifier; + const state = Math.random().toString(36).substring(2, 15); + const authUrl = + `https://login.microsoftonline.com/common/oauth2/v2.0/authorize?` + + `client_id=${appId}` + + `&response_type=code` + + `&redirect_uri=${encodeURIComponent(window.location.origin)}/authredirect` + + `&scope=${encodeURIComponent(scope)}` + + `&code_challenge=${codeChallenge}` + + `&code_challenge_method=plain` + + `&state=${state}` + + `&prompt=select_account`; - const width = 500 - const height = 600 - const left = window.screen.width / 2 - width / 2 - const top = window.screen.height / 2 - height / 2 + // Open a blank popup first, then navigate it. This keeps the window reference stable and + // avoids treating slow Microsoft page loads as an immediate user cancellation. + const width = 500; + const height = 600; + const left = window.screen.width / 2 - width / 2; + const top = window.screen.height / 2 - height / 2; - // Open the window before computing the challenge below. window.open only succeeds - // while the click's user activation is still live, and awaiting the SHA-256 digest - // first spends it - browsers then treat the call as an unsolicited popup and block - // it. Open a blank window synchronously and navigate it once the URL is ready. const popup = window.open( - '', - 'msalAuthPopup', - `width=${width},height=${height},left=${left},top=${top}` - ) + "about:blank", + "msalAuthPopup", + `width=${width},height=${height},left=${left},top=${top}`, + ); - // A null reference means the browser blocked the popup outright - nothing will - // ever post back, so fail fast instead of sitting on the 10-minute timeout. if (!popup) { const error = { - errorCode: 'popup_blocked', + errorCode: "popup_blocked", errorMessage: - 'The sign-in popup was blocked by the browser. Allow popups for this site and try again.', + "Authentication popup was blocked by the browser. Please allow popups and try again.", timestamp: new Date().toISOString(), - } - setAuthError(error) - if (onAuthError) onAuthError(error) - setAuthInProgress(false) - return + }; + setAuthError(error); + if (onAuthError) onAuthError(error); + setAuthInProgress(false); + return; } - // Generate PKCE code verifier and S256 challenge - const codeVerifier = randomUrlSafeString(32) - const codeChallenge = base64UrlEncode( - await window.crypto.subtle.digest('SHA-256', new TextEncoder().encode(codeVerifier)) - ) - const state = randomUrlSafeString(16) - // prompt=login, not select_account: this flow mints the refresh token CIPP runs on, and - // Entra stamps that token with the authentication context of the sign-in that created it - // (including the protocol flow, which Conditional Access re-evaluates on every redemption). - // select_account can complete via SSO from an existing session - including the one the - // device code step establishes at microsoft.com/devicelogin in this same browser - which - // would carry a device-code-flow marker forward instead of clearing it. - // /organizations, not /common: CIPP-SAM is signInAudience AzureADMultipleOrgs, so it - // supports work and school accounts only. /common additionally advertises personal - // Microsoft accounts, letting someone pick one and fail later with a confusing error - // instead of being told up front that the account cannot be used. It also matches the - // authority the device code flow uses. - const authUrl = - `https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?` + - `client_id=${appId}` + - `&response_type=code` + - `&redirect_uri=${encodeURIComponent(window.location.origin)}/authredirect` + - `&scope=${encodeURIComponent(scope)}` + - `&code_challenge=${codeChallenge}` + - `&code_challenge_method=S256` + - `&state=${state}` + - `&prompt=login` - - popup.location = authUrl + if (popup.location) { + popup.location.href = authUrl; + } + let codeReceived = false; + let popupWatch = null; + let closeGrace = null; // Function to actually exchange the authorization code for tokens const handleAuthorizationCode = async (code, receivedState) => { // Verify the state parameter matches what we sent (security check) if (receivedState !== state) { - const errorMessage = 'State mismatch in auth response - possible CSRF attack' + const errorMessage = "State mismatch in auth response - possible CSRF attack"; const error = { - errorCode: 'state_mismatch', + errorCode: "state_mismatch", errorMessage: errorMessage, timestamp: new Date().toISOString(), - } - setAuthError(error) - if (onAuthError) onAuthError(error) - setAuthInProgress(false) - return + }; + setAuthError(error); + if (onAuthError) onAuthError(error); + setAuthInProgress(false); + return; } try { // Prepare the token request const tokenRequest = { - grant_type: 'authorization_code', + grant_type: "authorization_code", client_id: appId, code: code, redirect_uri: `${window.location.origin}/authredirect`, code_verifier: codeVerifier, - } + }; // Make the token request through our API proxy to avoid origin header issues // Retry logic for AADSTS650051 (service principal already exists) - let retryCount = 0 - const maxRetries = 3 - let tokenResponse - let tokenData + let retryCount = 0; + const maxRetries = 3; + let tokenResponse; + let tokenData; while (retryCount <= maxRetries) { tokenResponse = await fetch(`/api/ExecTokenExchange`, { - method: 'POST', + method: "POST", headers: { - 'Content-Type': 'application/json', + "Content-Type": "application/json", }, body: JSON.stringify({ tokenRequest, - tokenUrl: 'https://login.microsoftonline.com/organizations/oauth2/v2.0/token', + tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token", tenantId: appId, // Pass the tenant ID to retrieve the correct client secret }), - }) + }); // Parse the token response - tokenData = await tokenResponse.json() + tokenData = await tokenResponse.json(); - // AADSTS650051: service principal already exists. - // AADSTS7000215: the client secret is not valid *yet*. The wizard mints a new - // secret on the previous step and arrives here seconds later, but Entra can take - // minutes to replicate it. Retrying covers the fast case; the message below covers - // the rest, since waiting it out would outlive the authorization code. + // Check if it's the AADSTS650051 error (service principal already exists) if ( - tokenData.error === 'invalid_client' && - (tokenData.error_description?.includes('AADSTS650051') || - tokenData.error_description?.includes('AADSTS7000215')) + tokenData.error === "invalid_client" && + tokenData.error_description?.includes("AADSTS650051") ) { - retryCount++ + retryCount++; if (retryCount <= maxRetries) { // Wait before retrying (exponential backoff) - await new Promise((resolve) => setTimeout(resolve, 2000 * retryCount)) - continue + await new Promise((resolve) => setTimeout(resolve, 2000 * retryCount)); + continue; } } // If no error or different error, break out of retry loop - break + break; } // Check if the response contains an error if (tokenData.error) { - const secretNotReady = tokenData.error_description?.includes('AADSTS7000215') const error = { - errorCode: tokenData.error || 'token_error', - errorMessage: secretNotReady - ? 'The application secret created for CIPP is not active yet. Microsoft can take several minutes to replicate a new secret across Entra ID. Wait a few minutes and run this step again - nothing needs to be recreated.' - : tokenData.error_description || 'Failed to exchange authorization code for tokens', + errorCode: tokenData.error || "token_error", + errorMessage: + tokenData.error_description || "Failed to exchange authorization code for tokens", timestamp: new Date().toISOString(), - } - setAuthError(error) - if (onAuthError) onAuthError(error) - setAuthInProgress(false) - return + }; + setAuthError(error); + if (onAuthError) onAuthError(error); + setAuthInProgress(false); + return; } if (tokenResponse.ok) { @@ -558,13 +500,13 @@ export const CIPPM365OAuthButton = ({ if (tokenData.refresh_token) { try { // Extract tid from access_token jwt base64 - const accessTokenParts = tokenData.access_token.split('.') - const accessTokenPayload = JSON.parse(atob(accessTokenParts[1] || '')) - tokenData.tid = accessTokenPayload.tid + const accessTokenParts = tokenData.access_token.split("."); + const accessTokenPayload = JSON.parse(atob(accessTokenParts[1] || "")); + tokenData.tid = accessTokenPayload.tid; const refreshResponse = await fetch(`/api/ExecUpdateRefreshToken`, { - method: 'POST', + method: "POST", headers: { - 'Content-Type': 'application/json', + "Content-Type": "application/json", }, body: JSON.stringify({ tenantId: tokenData.tid, @@ -572,59 +514,65 @@ export const CIPPM365OAuthButton = ({ tenantMode: tokenData.tenantMode, allowPartnerTenantManagement: tokenData.allowPartnerTenantManagement, }), - }) + }); if (!refreshResponse.ok) { - console.warn('Failed to store refresh token, but continuing with authentication') + console.warn("Failed to store refresh token, but continuing with authentication"); } else { // Invalidate the listAppId and tenants-table queryKeys to refresh data - appIdInfo.refetch() + appIdInfo.refetch(); } } catch (error) { - console.error('Failed to store refresh token:', error) + console.error("Failed to store refresh token:", error); } } - handleTokenResponse(tokenData) + handleTokenResponse(tokenData); } else { // Handle token error - display in error box instead of throwing const error = { - errorCode: tokenData.error || 'token_error', + errorCode: tokenData.error || "token_error", errorMessage: - tokenData.error_description || 'Failed to exchange authorization code for tokens', + tokenData.error_description || "Failed to exchange authorization code for tokens", timestamp: new Date().toISOString(), - } - setAuthError(error) - if (onAuthError) onAuthError(error) + }; + setAuthError(error); + if (onAuthError) onAuthError(error); } } catch (error) { const errorObj = { - errorCode: 'token_exchange_error', - errorMessage: error.message || 'Failed to exchange authorization code for tokens', + errorCode: "token_exchange_error", + errorMessage: error.message || "Failed to exchange authorization code for tokens", timestamp: new Date().toISOString(), - } - setAuthError(errorObj) - if (onAuthError) onAuthError(errorObj) + }; + setAuthError(errorObj); + if (onAuthError) onAuthError(errorObj); } finally { + // Close the popup window if it's still open + if (popup && !popup.closed) { + popup.close(); + } + // Update UI state - setAuthInProgress(false) + setAuthInProgress(false); } - } + }; // Listen for auth result via BroadcastChannel (works regardless of COOP) - const channel = new BroadcastChannel('cipp_auth') - let resultReceived = false + const channel = new BroadcastChannel("cipp_auth"); const authTimeout = setTimeout(() => { - // If no response after 10 minutes, treat as cancelled - cleanup() + if (codeReceived) { + return; + } + cleanup(); const error = { - errorCode: 'timeout', - errorMessage: 'Authentication timed out. Please try again.', + errorCode: "timeout", + errorMessage: "Authentication timed out. Please try again.", timestamp: new Date().toISOString(), - } - setAuthError(error) - if (onAuthError) onAuthError(error) + }; + setAuthError(error); + if (onAuthError) onAuthError(error); setTokens({ accessToken: null, refreshToken: null, @@ -633,79 +581,77 @@ export const CIPPM365OAuthButton = ({ username: null, tenantId: null, onmicrosoftDomain: null, - }) - setAuthInProgress(false) - }, 600000) + }); + setAuthInProgress(false); + }, 600000); channel.onmessage = (event) => { - if (event.data?.type === 'auth_code') { - resultReceived = true - cleanup() - handleAuthorizationCode(event.data.code, event.data.state) - } else if (event.data?.type === 'auth_error') { - resultReceived = true - cleanup() - - // Check if it's the AADSTS650051 error (service principal already exists during consent) + if (event.data?.type === "auth_code") { + codeReceived = true; + cleanup(); + handleAuthorizationCode(event.data.code, event.data.state); + } else if (event.data?.type === "auth_error") { + codeReceived = true; + cleanup(); + if ( - event.data.error === 'invalid_client' && - event.data.errorDescription?.includes('AADSTS650051') && + event.data.error === "invalid_client" && + event.data.errorDescription?.includes("AADSTS650051") && retryCount < maxRetries ) { - setAuthInProgress(false) - setTimeout(() => handleMsalAuthentication(retryCount + 1), 2000 * (retryCount + 1)) - return + setAuthInProgress(false); + setTimeout(() => handleMsalAuthentication(retryCount + 1), 2000 * (retryCount + 1)); + return; } const error = { - errorCode: event.data.error || 'auth_error', - errorMessage: event.data.errorDescription || 'Unknown authentication error', + errorCode: event.data.error || "auth_error", + errorMessage: event.data.errorDescription || "Unknown authentication error", timestamp: new Date().toISOString(), - } - setAuthError(error) - if (onAuthError) onAuthError(error) - setAuthInProgress(false) + }; + setAuthError(error); + if (onAuthError) onAuthError(error); + setAuthInProgress(false); } - } + }; - // The /authredirect callback posts its result and then closes the popup, so - // closure is also part of the happy path - give the BroadcastChannel message - // a short grace period before treating it as a cancellation. Without this, - // closing the sign-in window left the button stuck on "Authenticating..." - // until the 10-minute timeout. - let closeGraceTimer = null - const popupWatcher = setInterval(() => { - if (popup.closed) { - clearInterval(popupWatcher) - closeGraceTimer = setTimeout(() => { - if (!resultReceived) { - cleanup() - const error = { - errorCode: 'popup_closed', - errorMessage: - 'The sign-in window was closed before authentication completed. Please try again.', - timestamp: new Date().toISOString(), - } - setAuthError(error) - if (onAuthError) onAuthError(error) - setAuthInProgress(false) - } - }, 2000) + const cleanup = () => { + channel.close(); + clearTimeout(authTimeout); + if (popupWatch) clearInterval(popupWatch); + if (closeGrace) clearTimeout(closeGrace); + popupWatch = null; + closeGrace = null; + if (activeAuthCleanupRef.current === cleanup) { + activeAuthCleanupRef.current = null; } - }, 1000) + }; - const cleanup = () => { - channel.close() - clearTimeout(authTimeout) - clearInterval(popupWatcher) - // The grace timer was previously left running. On the happy path - where the - // callback posts its result and then closes the popup - it would still be pending - // after cleanup, and if the user started another attempt inside that window it - // fired against the new one, clearing its progress state and reporting a - // cancellation for a sign-in that was still going. - clearTimeout(closeGraceTimer) - } - } + // A closed window is not an immediate cancel: the redirect posts its result, then + // the popup closes itself. The 2s grace lets that result win. + popupWatch = setInterval(() => { + if (!isMountedRef.current || codeReceived || !popup.closed || closeGrace) { + return; + } + closeGrace = setTimeout(() => { + if (codeReceived || !isMountedRef.current) { + return; + } + cleanup(); + const error = { + errorCode: "popup_closed", + errorMessage: "The sign-in window was closed before authentication finished.", + timestamp: new Date().toISOString(), + }; + setAuthError(error); + if (onAuthError) onAuthError(error); + setAuthInProgress(false); + }, 2000); + }, 1000); + + // Register so an unmount mid-auth tears down the channel and timeout. + activeAuthCleanupRef.current = cleanup; + }; // Auto-start device code retrieval if requested useEffect(() => { @@ -717,7 +663,7 @@ export const CIPPM365OAuthButton = ({ !tokens.accessToken && appIdInfo?.data ) { - retrieveDeviceCode() + retrieveDeviceCode(); } }, [ useDeviceCode, @@ -726,7 +672,16 @@ export const CIPPM365OAuthButton = ({ deviceCodeInfo, tokens.accessToken, appIdInfo?.data, - ]) + ]); + + // A device-code attempt that already has a code or an error can be started again. + const canRestartDeviceLogin = Boolean( + deviceCodeRestart || + (useDeviceCode && + (authError || deviceCodeInfo) && + !authInProgress && + !codeRetrievalInProgress), + ); return (
    @@ -734,7 +689,7 @@ export const CIPPM365OAuthButton = ({ !appIdInfo.isLoading && appIdInfo?.data?.applicationId && // Only check if applicationId is present in data !/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/.test( - appIdInfo?.data?.applicationId + appIdInfo?.data?.applicationId, ) && ( The Application ID is not valid. Please check your configuration. @@ -751,35 +706,28 @@ export const CIPPM365OAuthButton = ({ {authInProgress ? ( <> - When asked to log onto an account, please use a{' '} - CIPP Service Account. Enter this code to authenticate:{' '} + When asked to log onto an account, please use a{" "} + Manage365 Service Account. Enter this code to authenticate:{" "} ) : ( <> Click the button below to authenticate. When asked to log onto an account, - please use a CIPP Service Account. You will need to enter this - code:{' '} + please use a Manage365 Service Account. You will need to enter this + code:{" "} )} - {authInProgress && devicePopupClosed ? ( - <> - The sign-in window was closed. If you are still finishing at{' '} - microsoft.com/devicelogin in another browser, CIPP is still - waiting. If you had already entered the code, it cannot be used again - start - over below to get a new one. - - ) : authInProgress ? ( + {authInProgress ? ( <> - If the popup was blocked or you closed it, you can also go to{' '} + If the popup was blocked or you closed it, you can also go to{" "} microsoft.com/devicelogin manually and enter the code shown above. ) : ( <> - When you click the button below, a popup will open to{' '} + When you click the button below, a popup will open to{" "} microsoft.com/devicelogin where you'll enter this code. )} @@ -789,6 +737,11 @@ export const CIPPM365OAuthButton = ({ }}> Code expires in {Math.round(deviceCodeInfo.expires_in / 60)} minutes + {deviceCodeRestart && ( + + That code cannot be used again. Start over to get a new one. + + )} ) : tokens.accessToken ? ( <> @@ -803,7 +756,7 @@ export const CIPPM365OAuthButton = ({ Tenant ID: {tokens.tenantId} {tokens.onmicrosoftDomain && ( <> - {' '} + {" "} | Domain: {tokens.onmicrosoftDomain} )} @@ -820,7 +773,7 @@ export const CIPPM365OAuthButton = ({ Service Account Required - CIPP requires a service account for authentication. The account you're using ( + Manage365 requires a service account for authentication. The account you're using ( {tokens.username}) does not appear to be a service account. @@ -855,21 +808,21 @@ export const CIPPM365OAuthButton = ({ {promptBeforeAuth !== false && ( setPromptDialog({ open: false }), }} api={{ - type: 'POST', + type: "POST", confirmText: promptBeforeAuth, noConfirm: false, customFunction: () => { - setPromptDialog({ open: false }) + setPromptDialog({ open: false }); const authFunction = useDeviceCode ? handleDeviceCodeAuthentication - : handleMsalAuthentication - authFunction() + : handleMsalAuthentication; + authFunction(); }, }} fields={[]} @@ -879,28 +832,27 @@ export const CIPPM365OAuthButton = ({
    ); -} +}; diff --git a/frontend/src/components/CippComponents/CippAccessTypeGuide.jsx b/frontend/src/components/CippComponents/CippAccessTypeGuide.jsx new file mode 100644 index 0000000000..d2f64cc56e --- /dev/null +++ b/frontend/src/components/CippComponents/CippAccessTypeGuide.jsx @@ -0,0 +1,331 @@ +import { useState } from "react"; +import { + Alert, + AlertTitle, + Box, + Button, + Card, + CardContent, + Chip, + Collapse, + Stack, + Tooltip, + Typography, +} from "@mui/material"; +import { ExpandMore, ExpandLess, OpenInNew, InfoOutlined } from "@mui/icons-material"; +import Link from "next/link"; +import { ACCESS_TYPES, ACCESS_TYPE_CONTEXTS, DECISION_TREE } from "../../data/accessTypes"; + +const SettingsLinks = ({ links }) => { + if (!links?.length) return null; + return ( + + {links.map((link) => ( + + + + ))} + + ); +}; + +const AccessTypeColumn = ({ typeKey, highlighted }) => { + const t = ACCESS_TYPES[typeKey]; + if (!t) return null; + return ( + theme.palette[t.chipColor]?.main + "08" : "transparent", + }} + > + + + + {t.microsoftTerm} + + + + {t.shortDescription} + + + {t.characteristics.map((item, i) => ( + + {item} + + ))} + + + + ); +}; + +const ChipVariant = ({ type }) => { + const t = ACCESS_TYPES[type]; + if (!t) return null; + return ( + + + {t.label} ({t.microsoftTerm}) + + {t.shortDescription} +     + } + arrow + placement="top" + > + } + label={t.label} + size="small" + color={t.chipColor} + variant="outlined" + sx={{ height: 22, fontSize: "0.7rem", "& .MuiChip-label": { px: 0.5 } }} + /> + + ); +}; + +const BannerVariant = ({ type, context, showSettingsLinks }) => { + const t = ACCESS_TYPES[type]; + const ctx = context ? ACCESS_TYPE_CONTEXTS[context] : null; + if (!t) return null; + + const description = ctx?.note || t.fullDescription; + const severity = t.chipColor === "warning" ? "warning" : "info"; + + return ( + + + {t.label} ({t.microsoftTerm}) + + {description} + {showSettingsLinks && } + + ); +}; + +const PanelVariant = ({ context, showSettingsLinks }) => { + const [expanded, setExpanded] = useState(false); + const ctx = context ? ACCESS_TYPE_CONTEXTS[context] : null; + + const typesToShow = ctx?.showBoth + ? ["guest", "external"] + : ctx?.secondary + ? [ctx.primary, ctx.secondary] + : ctx?.primary + ? [ctx.primary, ctx.primary === "guest" ? "external" : "guest"] + : ["guest", "external"]; + + const primaryType = ctx?.primary || null; + + return ( + + setExpanded((prev) => !prev)} + > + + + + Understanding Access Types: Guest Access vs External Access + + + {expanded ? : } + + + + {ctx?.note && ( + + {ctx.note} + + )} + + {typesToShow.map((typeKey) => ( + + ))} + + + + + ); +}; + +const DecisionTreeResult = ({ result }) => ( + + + + + + + {result.title} + + + + {result.description} + + {result.supported?.length > 0 && ( + + + Supported: + + + {result.supported.map((item, i) => ( + + {item} + + ))} + + + )} + {result.notSupported?.length > 0 && ( + + + Not Supported: + + + {result.notSupported.map((item, i) => ( + + {item} + + ))} + + + )} + {result.nextSteps?.length > 0 && ( + + + Next Steps: + + + {result.nextSteps.map((step, i) => ( + + {step} + + ))} + + + )} + + + +); + +const DecisionTreeInteractive = ({ tree }) => { + const [path, setPath] = useState([]); + + const getCurrentNode = () => { + let node = tree; + for (const idx of path) { + if (node.options && node.options[idx]) { + node = node.options[idx]; + } + } + return node; + }; + + const currentNode = getCurrentNode(); + const hasResult = Boolean(currentNode.result); + const hasQuestion = Boolean(currentNode.question) && !hasResult; + + const handleSelect = (idx) => { + setPath([...path, idx]); + }; + + const handleReset = () => { + setPath([]); + }; + + return ( + + {path.length > 0 && ( + + )} + {hasQuestion && ( + + {currentNode.question} + {currentNode.options.map((option, idx) => ( + + ))} + + )} + {hasResult && } + + ); +}; + +/** + * Reusable access type coaching component with four rendering modes. + * + * @param {"guest"|"external"} type - Which access type (for chip/banner variants) + * @param {"chip"|"banner"|"panel"|"decision"} variant - Rendering mode + * @param {string} [context] - Context key from ACCESS_TYPE_CONTEXTS or DECISION_TREE + * @param {boolean} [showSettingsLinks=true] - Whether to show navigation links + */ +const CippAccessTypeGuide = ({ type, variant = "chip", context, showSettingsLinks = true }) => { + switch (variant) { + case "chip": + return ; + case "banner": + return ; + case "panel": + return ; + case "decision": { + const tree = DECISION_TREE[context] || DECISION_TREE.general; + if (tree.result) { + return ; + } + return ; + } + default: + return null; + } +}; + +export default CippAccessTypeGuide; diff --git a/frontend/src/components/CippComponents/CippActionMenu.jsx b/frontend/src/components/CippComponents/CippActionMenu.jsx new file mode 100644 index 0000000000..c62e523f29 --- /dev/null +++ b/frontend/src/components/CippComponents/CippActionMenu.jsx @@ -0,0 +1,587 @@ +import { useState, useMemo } from "react"; +import { + Box, + Button, + Collapse, + Divider, + IconButton, + List, + ListItem, + ListItemButton, + ListItemIcon, + ListItemText, + Paper, + SvgIcon, + TextField, + InputAdornment, + Typography, + useTheme, + useMediaQuery, + Chip, + Tooltip, + alpha, +} from "@mui/material"; +import { + Search, + ExpandMore, + ExpandLess, + Visibility, + Edit, + Security, + Settings, + Delete, + MoreHoriz, +} from "@mui/icons-material"; +import { useRouter } from "next/router"; +import { getSafeInternalRoute, openSafeExternalUrl } from "../../utils/safe-navigation"; +import { useDialog } from "../../hooks/use-dialog"; +import { CippApiDialog } from "./CippApiDialog"; +import { useSettings } from "../../hooks/use-settings"; +import { resolvePaletteMainColor } from "../../theme/utils"; +import { + getActionColor, + getActionPaletteColor, + getCategoryChipColor, + getCategoryColor, + getCategoryLabel, + getCategoryOrder, +} from "../../utils/action-categories"; + +// Larger icons for this menu style; headings, colours and ordering all come +// from the shared action-categories util so every menu agrees. +const categoryIcons = { + view: , + edit: , + security: , + manage: , + danger: , + other: , +}; + +// Helper to determine category from action +const getActionCategory = (action) => { + if (action.category) return action.category; + + // Auto-detect category from label/type + const label = (action.label || "").toLowerCase(); + + if (label.includes("view") || label.includes("see") || action.link) { + return "view"; + } + if (label.includes("edit") || label.includes("rename") || label.includes("change") || label.includes("set") || label.includes("update")) { + return "edit"; + } + if (label.includes("delete") || label.includes("remove") || label.includes("wipe") || label.includes("reset") || action.color === "danger") { + return "danger"; + } + if (label.includes("security") || label.includes("password") || label.includes("key") || label.includes("defender") || label.includes("scan")) { + return "security"; + } + if (label.includes("sync") || label.includes("refresh") || label.includes("restart") || label.includes("reboot")) { + return "manage"; + } + + return "other"; +}; + +export const CippActionMenu = ({ + actions = [], + data, + variant = "list", // "list" | "compact" | "grid" + showSearch = true, + showCategories = true, + maxVisibleActions = 0, // 0 = show all + onActionClick, + disabled = false, +}) => { + const theme = useTheme(); + const router = useRouter(); + const smDown = useMediaQuery(theme.breakpoints.down("sm")); + const [searchTerm, setSearchTerm] = useState(""); + const [expandedCategories, setExpandedCategories] = useState({}); + const [actionData, setActionData] = useState({ data: {}, action: {}, ready: false }); + const createDialog = useDialog(); + const settings = useSettings(); + + // Filter and group actions + const { groupedActions, filteredActions, visibleCount } = useMemo(() => { + // Filter out disabled actions and apply search + let filtered = actions.filter((action) => { + // Unavailable actions stay visible and disabled so the menu shows why they cannot run. + if (searchTerm) { + return action.label?.toLowerCase().includes(searchTerm.toLowerCase()); + } + return true; + }); + + // Group by category + const grouped = {}; + filtered.forEach((action) => { + const category = getActionCategory(action); + if (!grouped[category]) { + grouped[category] = []; + } + grouped[category].push(action); + }); + + // Sort categories by order + const sortedGrouped = {}; + Object.keys(grouped) + .sort((a, b) => getCategoryOrder(a) - getCategoryOrder(b)) + .forEach((key) => { + sortedGrouped[key] = grouped[key]; + }); + + return { + groupedActions: sortedGrouped, + filteredActions: filtered, + visibleCount: filtered.length, + }; + }, [actions, data, searchTerm]); + + const toggleCategory = (category) => { + setExpandedCategories((prev) => ({ + ...prev, + [category]: !prev[category], + })); + }; + + const handleActionClick = (action) => { + if (disabled) return; + + // Handle tenant switching for AllTenants mode + if (settings.currentTenant === "AllTenants" && data?.Tenant) { + settings.handleUpdate({ + currentTenant: data.Tenant, + }); + } + + // Handle custom function with no confirm + if (action.noConfirm && action.customFunction) { + action.customFunction(data, action, {}); + if (onActionClick) onActionClick(action); + return; + } + + // Handle link actions + if (action.link) { + let link = action.link.replace(/\[([^\]]+)\]/g, (_, key) => + encodeURIComponent(data?.[key] ?? "") + ); + + if (action.external || action.target === "_blank") { + window.open(link, "_blank"); + } else { + router.push(link); + } + if (onActionClick) onActionClick(action); + return; + } + + // Standard dialog flow + setActionData({ + data: data, + action: action, + ready: true, + }); + createDialog.handleOpen(); + if (onActionClick) onActionClick(action); + }; + + const renderAction = (action, index, inCategory = false) => { + const isDisabled = disabled || (action.condition && !action.condition(data)); + const isDanger = getActionCategory(action) === "danger"; + + return ( + + handleActionClick(action)} + disabled={isDisabled} + sx={{ + py: smDown ? 1.5 : 1, + px: 2, + borderRadius: 1, + minHeight: smDown ? 56 : 48, + "&:hover": { + bgcolor: isDanger + ? alpha(theme.palette.error.main, 0.08) + : "action.hover", + }, + }} + > + + resolvePaletteMainColor( + theme, + getActionColor(action, getActionCategory(action)) + ), + }} + > + {action.icon} + + + {action.link && ( + + )} + + + ); + }; + + const renderCategoryGroup = (category, categoryActions) => { + const categoryIcon = categoryIcons[category] || categoryIcons.other; + const isExpanded = expandedCategories[category] !== false; // Default expanded + const isDanger = category === "danger"; + + return ( + + toggleCategory(category)} + sx={{ + py: 0.75, + px: 1.5, + borderRadius: 1, + bgcolor: isDanger + ? alpha(theme.palette.error.main, 0.04) + : alpha(theme.palette.primary.main, 0.04), + "&:hover": { + bgcolor: isDanger + ? alpha(theme.palette.error.main, 0.08) + : alpha(theme.palette.primary.main, 0.08), + }, + }} + > + resolvePaletteMainColor(theme, getCategoryColor(category)), + }} + > + {categoryIcon} + + + + {isExpanded ? : } + + + + {categoryActions.map((action, index) => renderAction(action, index, true))} + + + + ); + }; + + // Compact mode - just icons in a row + if (variant === "compact") { + const visibleActions = maxVisibleActions > 0 + ? filteredActions.slice(0, maxVisibleActions) + : filteredActions; + + return ( + + {visibleActions.map((action, index) => { + const isDisabled = disabled || (action.condition && !action.condition(data)); + const category = getActionCategory(action); + const isDanger = category === "danger"; + + return ( + + + { + e.stopPropagation(); + handleActionClick(action); + }} + disabled={isDisabled} + sx={{ + color: isDanger + ? "error.main" + : action.color === "success" + ? "success.main" + : "text.secondary", + "&:hover": { + bgcolor: isDanger + ? alpha(theme.palette.error.main, 0.1) + : "action.hover", + }, + }} + > + {action.icon} + + + + ); + })} + {actionData.ready && ( + + )} + + ); + } + + return ( + + {/* Search bar for many actions */} + {showSearch && filteredActions.length > 5 && ( + setSearchTerm(e.target.value)} + sx={{ mb: 2 }} + InputProps={{ + startAdornment: ( + + + + ), + }} + /> + )} + + {/* Results count when searching */} + {searchTerm && ( + + {visibleCount} action{visibleCount !== 1 ? "s" : ""} found + + )} + + {/* Action list */} + + {showCategories && !searchTerm && Object.keys(groupedActions).length > 1 ? ( + // Grouped view + Object.entries(groupedActions).map(([category, categoryActions]) => + renderCategoryGroup(category, categoryActions) + ) + ) : ( + // Flat list (search results or single category) + filteredActions.map((action, index) => renderAction(action, index)) + )} + + + {/* No results */} + {filteredActions.length === 0 && ( + + + {searchTerm ? "No actions match your search" : "No actions available"} + + + )} + + {/* Action dialog */} + {actionData.ready && ( + + )} + + ); +}; + +// Quick actions component for cards +export const CippQuickActions = ({ + actions = [], + data, + maxActions = 3, + size = "small", + showOnHover = false, + onActionClick, + onOffCanvasClick, // Callback to open offCanvas panel + variant = "icon", // "icon" | "button" +}) => { + const theme = useTheme(); + const router = useRouter(); + const smDown = useMediaQuery(theme.breakpoints.down("sm")); + const [actionData, setActionData] = useState({ data: {}, action: {}, ready: false }); + const createDialog = useDialog(); + const settings = useSettings(); + + // Get quick actions - those marked as quickAction or first few actions + const quickActions = useMemo(() => { + const marked = actions.filter((a) => a.quickAction && (!a.condition || a.condition(data))); + if (marked.length > 0) { + return marked.slice(0, maxActions); + } + // Fallback: get first few non-danger actions + return actions + .filter((a) => getActionCategory(a) !== "danger" && (!a.condition || a.condition(data))) + .slice(0, maxActions); + }, [actions, data, maxActions]); + + const handleActionClick = (action, e) => { + e.stopPropagation(); + + // Handle tenant switching + if (settings.currentTenant === "AllTenants" && data?.Tenant) { + settings.handleUpdate({ currentTenant: data.Tenant }); + } + + // Handle offCanvas action - opens the details flyout panel + if (action.offCanvasAction && onOffCanvasClick) { + onOffCanvasClick(data); + if (onActionClick) onActionClick(action); + return; + } + + if (action.noConfirm && action.customFunction) { + action.customFunction(data, action, {}); + if (onActionClick) onActionClick(action); + return; + } + + if (action.link) { + let link = action.link.replace(/\[([^\]]+)\]/g, (_, key) => + encodeURIComponent(data?.[key] ?? "") + ); + if (action.external || action.target === "_blank") { + openSafeExternalUrl(link); + } else { + const safeRoute = getSafeInternalRoute(link); + if (safeRoute) { + router.push(safeRoute); + } + } + if (onActionClick) onActionClick(action); + return; + } + + setActionData({ data, action, ready: true }); + createDialog.handleOpen(); + if (onActionClick) onActionClick(action); + }; + + if (quickActions.length === 0) return null; + + return ( + e.stopPropagation()} + > + {quickActions.map((action, index) => { + const category = getActionCategory(action); + // Same category colours as the grouped menus, so a card's quick actions + // and its overflow menu agree on what "edit" or "danger" looks like + const buttonColor = getActionPaletteColor(action, category); + const mainColor = theme.palette[buttonColor].main; + + if (variant === "button") { + return ( + + + + ); + } + + return ( + + handleActionClick(action, e)} + sx={{ + bgcolor: alpha(mainColor, 0.08), + border: `1px solid ${alpha(mainColor, 0.3)}`, + color: mainColor, + borderRadius: 1, + transition: "all 0.2s ease", + "&:hover": { + bgcolor: alpha(mainColor, 0.15), + borderColor: mainColor, + transform: "scale(1.05)", + }, + // Touch-friendly sizing + minWidth: smDown ? 36 : 32, + minHeight: smDown ? 36 : 32, + p: 0.75, + }} + > + + {action.icon} + + + + ); + })} + + {actionData.ready && ( + + )} + + ); +}; + +export default CippActionMenu; diff --git a/frontend/src/components/CippComponents/CippAddContactDrawer.jsx b/frontend/src/components/CippComponents/CippAddContactDrawer.jsx index 0a36047493..6b1d1781fb 100644 --- a/frontend/src/components/CippComponents/CippAddContactDrawer.jsx +++ b/frontend/src/components/CippComponents/CippAddContactDrawer.jsx @@ -1,4 +1,4 @@ -import React, { useState, useEffect } from "react"; +import React, { useState, useEffect } from "react"; import { Button, Divider } from "@mui/material"; import { CippIcons } from "../../utils/icon-registry" import { Grid } from "@mui/system"; @@ -243,18 +243,20 @@ export const CippAddContactDrawer = ({ {/* Phone Numbers */} diff --git a/frontend/src/components/CippComponents/CippAddEditTenantGroups.jsx b/frontend/src/components/CippComponents/CippAddEditTenantGroups.jsx index 2ead662a5c..4208c18eaf 100644 --- a/frontend/src/components/CippComponents/CippAddEditTenantGroups.jsx +++ b/frontend/src/components/CippComponents/CippAddEditTenantGroups.jsx @@ -83,12 +83,6 @@ const CippAddEditTenantGroups = ({ formControl, initialValues, title, backButton compareType="is" compareValue="dynamic" > - setDrawerVisible(true)} - startIcon={isEditMode ? : } + startIcon={!iconOnly ? (isEditMode ? : ) : undefined} disabled={disabled} + {...buttonProps} > - - {buttonText} - + {iconOnly ? : buttonText} )} { const [drawerVisible, setDrawerVisible] = useState(false); // Bumped after each successful create. The form fields only auto-populate on mount @@ -34,6 +35,7 @@ export const CippAddUserDrawer = ({ defaultValues: { tenantFilter: userSettingsDefaults.currentTenant, usageLocation: userSettingsDefaults.usageLocation, + disableLegacyProtocols: true, }, }); @@ -79,9 +81,9 @@ export const CippAddUserDrawer = ({ const resetValues = { tenantFilter: userSettingsDefaults.currentTenant, usageLocation: userSettingsDefaults.usageLocation, + disableLegacyProtocols: true, }; - // Preserve the default template if it exists const currentTemplate = formControl.getValues("userTemplate"); if (currentTemplate?.addedFields?.defaultForTenant) { resetValues.userTemplate = currentTemplate; @@ -121,9 +123,9 @@ export const CippAddUserDrawer = ({ const resetValues = { tenantFilter: userSettingsDefaults.currentTenant, usageLocation: userSettingsDefaults.usageLocation, + disableLegacyProtocols: true, }; - // Preserve the default template if it exists const currentTemplate = formControl.getValues("userTemplate"); if (currentTemplate?.addedFields?.defaultForTenant) { resetValues.userTemplate = currentTemplate; @@ -153,6 +155,7 @@ export const CippAddUserDrawer = ({ {...(PermissionButton !== Button ? { requiredPermissions } : {})} onClick={handleOpenDrawer} startIcon={} + {...buttonProps} > {buttonText} diff --git a/frontend/src/components/CippComponents/CippAddVacationModeDrawer.jsx b/frontend/src/components/CippComponents/CippAddVacationModeDrawer.jsx new file mode 100644 index 0000000000..bd6b4397d5 --- /dev/null +++ b/frontend/src/components/CippComponents/CippAddVacationModeDrawer.jsx @@ -0,0 +1,359 @@ +import { useState, useEffect } from "react"; +import { Alert, Button, Typography, Divider, Stack } from "@mui/material"; +import { Grid } from "@mui/system"; +import { useForm, useWatch, useFormState } from "react-hook-form"; +import { EventAvailable } from "@mui/icons-material"; +import { CippOffCanvas } from "./CippOffCanvas"; +import CippFormComponent from "./CippFormComponent"; +import { CippApiResults } from "./CippApiResults"; +import { CippFormUserSelector } from "./CippFormUserSelector"; +import { CippFormTenantSelector } from "./CippFormTenantSelector"; +import { ApiPostCall, ApiGetCallWithPagination } from "../../api/ApiCall"; +import CippJsonView from "../CippFormPages/CippJSONView"; + +export const CippAddVacationModeDrawer = ({ + buttonText = "Add Vacation Schedule", + requiredPermissions = [], + PermissionButton = Button, +}) => { + const [drawerVisible, setDrawerVisible] = useState(false); + const [caPoliciesWaiting, setCaPoliciesWaiting] = useState(false); + + const formControl = useForm({ + mode: "onChange", + defaultValues: { + vacation: true, + tenantFilter: null, + Users: [], + PolicyId: null, + startDate: null, + endDate: null, + reference: null, + postExecution: [], + excludeLocationAuditAlerts: false, + }, + }); + + const { isValid } = useFormState({ control: formControl.control }); + + // Watch the selected tenant to update dependent fields + const selectedTenant = useWatch({ control: formControl.control, name: "tenantFilter" }); + const selectedPolicy = useWatch({ control: formControl.control, name: "PolicyId" }); + const tenantDomain = selectedTenant?.value || selectedTenant; + + const addVacationMode = ApiPostCall({ + urlFromData: true, + relatedQueryKeys: ["VacationMode"], + }); + + const caPolicies = ApiGetCallWithPagination({ + url: "/api/ListGraphRequest", + data: { + tenantFilter: tenantDomain, + Endpoint: "conditionalAccess/policies", + }, + queryKey: `ListConditionalAccessPolicies-${tenantDomain}`, + waiting: caPoliciesWaiting, + }); + + // Selected policy object & whether it targets locations (include or exclude) + const selectedPolicyObject = (caPolicies?.data?.pages || []) + .flatMap((page) => page?.Results || []) + .find((p) => p.id === selectedPolicy?.value); + const guidRegex = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/; + const locationSets = selectedPolicyObject?.conditions?.locations; + const allLocationIds = [ + ...(locationSets?.includeLocations || []), + ...(locationSets?.excludeLocations || []), + ]; + const policyHasLocationTarget = allLocationIds.some((loc) => guidRegex.test(loc)); + + useEffect(() => { + // monitor changes to selectedTenant, if null change waiting to false on caPolicies + if (!selectedTenant?.value === null || selectedTenant?.value === undefined) { + setCaPoliciesWaiting(false); + } else { + setCaPoliciesWaiting(true); + } + }, [selectedTenant]); + + // Reset form fields on successful creation + useEffect(() => { + if (addVacationMode.isSuccess) { + formControl.reset({ + vacation: true, + tenantFilter: tenantDomain, + Users: [], + PolicyId: null, + startDate: null, + endDate: null, + reference: null, + postExecution: [], + excludeLocationAuditAlerts: false, + }); + } + }, [addVacationMode.isSuccess, formControl]); + + const handleSubmit = () => { + formControl.trigger(); + // Check if the form is valid before proceeding + if (!isValid) { + return; + } + + const formData = formControl.getValues(); + const shippedValues = { + tenantFilter: formData.tenantFilter?.value || formData.tenantFilter, + Users: formData.Users, + PolicyId: formData.PolicyId?.value, + StartDate: formData.startDate, + EndDate: formData.endDate, + vacation: true, + reference: formData.reference || null, + postExecution: formData.postExecution || [], + excludeLocationAuditAlerts: formData.excludeLocationAuditAlerts || false, + }; + + addVacationMode.mutate({ + url: "/api/ExecCAExclusion", + data: shippedValues, + relatedQueryKeys: ["VacationMode"], + }); + }; + + const handleCloseDrawer = () => { + setDrawerVisible(false); + formControl.reset({ + vacation: true, + tenantFilter: null, + Users: [], + PolicyId: null, + startDate: null, + endDate: null, + reference: null, + postExecution: [], + }); + }; + + return ( + <> + setDrawerVisible(true)} + startIcon={} + > + {buttonText} + + + +
    + + +
    + + } + > + + + Vacation mode adds scheduled tasks to add and remove users from Conditional Access (CA) + exclusions for a specific period of time. Select the CA policy and the date range. If + the CA policy targets a named location, you now have the ability to exclude the targeted + users from location-based audit log alerts. + + + Note: Vacation mode has recently been updated to use Group based exclusions for better + reliability. Existing vacation mode entries will continue to function as before, but it + is recommended to recreate them to take advantage of the new functionality. The + exclusion group follows the format: 'Vacation Exclusion - $Policy.displayName' + + + + + + + + + + {/* User Selector */} + + + + + {/* Conditional Access Policy Selector */} + + `${option.displayName}`, + valueField: "id", + showRefresh: true, + } + : null + } + multiple={false} + formControl={formControl} + validators={{ + validate: (option) => { + if (!option?.value) { + return "Picking a policy is required"; + } + return true; + }, + }} + required={true} + disabled={!tenantDomain} + /> + + + {/* Start Date Picker */} + + { + if (!value) { + return "Start date is required"; + } + return true; + }, + }} + /> + + + {/* End Date Picker */} + + { + const startDate = formControl.getValues("startDate"); + if (!value) { + return "End date is required"; + } + if (startDate && value && new Date(value * 1000) < new Date(startDate * 1000)) { + return "End date must be after start date"; + } + return true; + }, + }} + /> + + + {/* Post Execution Actions */} + + + + + + + + {policyHasLocationTarget && ( + + + + )} + + policy.id === selectedPolicy?.value + )[0] || {} + } + title="Selected Policy JSON" + /> + + + +     + + ); +}; diff --git a/frontend/src/components/CippComponents/CippAliasDialog.jsx b/frontend/src/components/CippComponents/CippAliasDialog.jsx index d5ef19b5e8..0ac33106eb 100644 --- a/frontend/src/components/CippComponents/CippAliasDialog.jsx +++ b/frontend/src/components/CippComponents/CippAliasDialog.jsx @@ -4,7 +4,7 @@ import { Typography, Box, Button, TextField, Chip, Stack } from "@mui/material"; import { useWatch } from "react-hook-form"; import { CippFormDomainSelector } from "./CippFormDomainSelector"; -const CippAliasDialog = ({ formHook }) => { +const CippAliasDialog = ({ formHook, entityLabel = "user" }) => { const [aliasPrefix, setAliasPrefix] = useState(""); // Initialize the form field if it doesn't exist @@ -77,10 +77,8 @@ const CippAliasDialog = ({ formHook }) => { return ( <> - - Add proxy addresses (aliases) for this user. Enter a prefix, choose a verified tenant + + Add proxy addresses (aliases) for this {entityLabel}. Enter a prefix, choose a verified tenant domain, and click Add or press Enter. { const { @@ -36,69 +40,67 @@ export const CippApiDialog = (props) => { relatedQueryKeys, dialogAfterEffect, allowResubmit = false, + allowAddAnother = false, + addAnotherLabel = "Add Another", children, defaultvalues, - // Optional. Supplying a form lets the caller watch and drive the dialog's fields while it is - // open - the custom variables page uses it to default a variable's type from how the same name - // is typed elsewhere. Omitted, the dialog owns its form exactly as before. - formHook: externalFormHook, + onActionSuccess, ...other - } = props - const router = useRouter() - const linkOpenedRef = useRef(false) - const [addedFieldData, setAddedFieldData] = useState({}) - const [partialResults, setPartialResults] = useState([]) - const [isFormSubmitted, setIsFormSubmitted] = useState(false) - const mdDown = useMediaQuery((theme) => theme.breakpoints.down('md')) + } = props; + const router = useRouter(); + const linkOpenedRef = useRef(false); + const [addedFieldData, setAddedFieldData] = useState({}); + const [partialResults, setPartialResults] = useState([]); + const [isFormSubmitted, setIsFormSubmitted] = useState(false); + const mdDown = useMediaQuery((theme) => theme.breakpoints.down("md")); if (mdDown) { - other.fullScreen = true + other.fullScreen = true; } - const internalFormHook = useForm({ - defaultValues: typeof defaultvalues === 'function' ? defaultvalues(row) : defaultvalues || {}, - mode: 'onChange', // Enable real-time validation - }) - const formHook = externalFormHook ?? internalFormHook + const formHook = useForm({ + defaultValues: typeof defaultvalues === "function" ? defaultvalues(row) : defaultvalues || {}, + mode: "onChange", // Enable real-time validation + }); // Get form state for validation - const { isValid } = useFormState({ control: formHook.control }) + const { isValid } = useFormState({ control: formHook.control }); useEffect(() => { if (createDialog.open) { - setIsFormSubmitted(false) - formHook.reset(typeof defaultvalues === 'function' ? defaultvalues(row) : defaultvalues || {}) + setIsFormSubmitted(false); + formHook.reset(typeof defaultvalues === "function" ? defaultvalues(row) : defaultvalues || {}); } - }, [createDialog.open, defaultvalues]) + }, [createDialog.open, defaultvalues]); const [getRequestInfo, setGetRequestInfo] = useState({ - url: '', + url: "", waiting: false, - queryKey: '', + queryKey: "", relatedQueryKeys: relatedQueryKeys ?? api.relatedQueryKeys ?? title, bulkRequest: api.multiPost === false, onResult: (result) => setPartialResults((prev) => [...prev, result]), - }) + }); const actionPostRequest = ApiPostCall({ urlFromData: true, relatedQueryKeys: relatedQueryKeys ?? api.relatedQueryKeys ?? title, bulkRequest: api.multiPost === false, - onResult: (result) => { - setPartialResults((prev) => [...prev, result]) - api?.onSuccess?.(result) + onResult: (result, meta) => { + setPartialResults((prev) => [...prev, result]); + if (!meta?.failed) api?.onSuccess?.(result); }, - }) + }); const actionGetRequest = ApiGetCall({ ...getRequestInfo, relatedQueryKeys: relatedQueryKeys ?? api.relatedQueryKeys ?? title, bulkRequest: api.multiPost === false, - onResult: (result) => { - setPartialResults((prev) => [...prev, result]) - api?.onSuccess?.(result) + onResult: (result, meta) => { + setPartialResults((prev) => [...prev, result]); + if (!meta?.failed) api?.onSuccess?.(result); }, - }) + }); // Whenever the dialog is (re)opened, discard any results from a previous run // so a freshly created window never shows stale output from an earlier action. @@ -106,48 +108,48 @@ export const CippApiDialog = (props) => { // stays mounted, so clear both alongside the streamed partial results. useEffect(() => { if (createDialog.open) { - setPartialResults([]) - actionPostRequest.reset() - setGetRequestInfo((prev) => ({ ...prev, waiting: false, queryKey: '' })) + setPartialResults([]); + actionPostRequest.reset(); + setGetRequestInfo((prev) => ({ ...prev, waiting: false, queryKey: "" })); } - }, [createDialog.open]) + }, [createDialog.open]); const processActionData = (dataObject, row, replacementBehaviour) => { - if (typeof api?.dataFunction === 'function') return api.dataFunction(row, dataObject) + if (typeof api?.dataFunction === "function") return api.dataFunction(row, dataObject); - let newData = {} + let newData = {}; if (api?.postEntireRow) { - return row + return row; } if (!dataObject) { - return dataObject + return dataObject; } Object.keys(dataObject).forEach((key) => { - const value = dataObject[key] - - if (typeof value === 'string' && value.startsWith('!')) { - newData[key] = value.slice(1) - } else if (typeof value === 'string') { - const nested = getRowPath(row, value) - newData[key] = nested !== undefined ? nested : value - } else if (typeof value === 'boolean') { - newData[key] = value - } else if (typeof value === 'object' && value !== null) { - const processedValue = processActionData(value, row, replacementBehaviour) - if (replacementBehaviour !== 'removeNulls' || Object.keys(processedValue).length > 0) { - newData[key] = processedValue + const value = dataObject[key]; + + if (typeof value === "string" && value.startsWith("!")) { + newData[key] = value.slice(1); + } else if (typeof value === "string") { + const nested = getRowPath(row, value); + newData[key] = nested !== undefined ? nested : value; + } else if (typeof value === "boolean") { + newData[key] = value; + } else if (typeof value === "object" && value !== null) { + const processedValue = processActionData(value, row, replacementBehaviour); + if (replacementBehaviour !== "removeNulls" || Object.keys(processedValue).length > 0) { + newData[key] = processedValue; } - } else if (replacementBehaviour !== 'removeNulls') { - newData[key] = value + } else if (replacementBehaviour !== "removeNulls") { + newData[key] = value; } - }) + }); - return newData - } + return newData; + }; - const tenantFilter = useSettings().currentTenant + const tenantFilter = useSettings().currentTenant; const handleActionClick = (row, action, rawFormData) => { setIsFormSubmitted(true) @@ -160,18 +162,18 @@ export const CippApiDialog = (props) => { finalData = api.customDataformatter(row, action, resolvedFormData) isBulkRequest = Array.isArray(finalData) } else { - if (action.multiPost === undefined) action.multiPost = false + if (action.multiPost === undefined) action.multiPost = false; if (api.customFunction) { - action.customFunction(row, action, resolvedFormData) - createDialog.handleClose() - return + action.customFunction(row, action, resolvedFormData); + createDialog.handleClose(); + return; } - const processedActionData = processActionData(action.data, row, action.replacementBehaviour) + const processedActionData = processActionData(action.data, row, action.replacementBehaviour); if (!processedActionData || Object.keys(processedActionData).length === 0) { - console.warn('No data to process for action:', action) + console.warn("No data to process for action:", action); } else { // MULTI ROW CASES if (Array.isArray(row)) { @@ -180,34 +182,35 @@ export const CippApiDialog = (props) => { tenantFilter: getRowTenant(singleRow, tenantFilter), ...resolvedFormData, ...addedFieldData, - } - const itemData = { ...commonData } + }; + const itemData = { ...commonData }; Object.keys(processedActionData).forEach((key) => { - const mapped = processedActionData[key] - const rowValue = - typeof mapped === 'string' ? getRowPath(singleRow, mapped) : undefined - itemData[key] = rowValue !== undefined ? rowValue : mapped - }) - return itemData - }) + const mapped = processedActionData[key]; + const rowValue = typeof mapped === "string" ? getRowPath(singleRow, mapped) : undefined; + itemData[key] = rowValue !== undefined ? rowValue : mapped; + }); + return itemData; + }); const payload = { url: action.url, bulkRequest: !action.multiPost, data: arrayData, - } + }; - if (action.type === 'POST') { - actionPostRequest.mutate(payload) - } else if (action.type === 'GET') { + if (action.type === "POST") { + actionPostRequest.mutate(payload, { + onSuccess: (response) => onActionSuccess?.(response), + }); + } else if (action.type === "GET") { setGetRequestInfo({ ...payload, waiting: true, queryKey: Date.now(), - }) + }); } - return + return; } } @@ -216,94 +219,100 @@ export const CippApiDialog = (props) => { tenantFilter: getRowTenant(row, tenantFilter), ...resolvedFormData, ...addedFieldData, - } + }; finalData = { ...commonData, ...processedActionData, - } + }; } - if (action.type === 'POST') { - actionPostRequest.mutate({ - url: action.url, - bulkRequest: isBulkRequest, - data: finalData, - }) - } else if (action.type === 'GET') { + if (action.type === "POST") { + actionPostRequest.mutate( + { + url: action.url, + bulkRequest: isBulkRequest, + data: finalData, + }, + { onSuccess: (response) => onActionSuccess?.(response) } + ); + } else if (action.type === "GET") { setGetRequestInfo({ url: action.url, waiting: true, queryKey: Date.now(), bulkRequest: isBulkRequest, data: finalData, - }) + }); } - } + }; useEffect(() => { if (dialogAfterEffect && (actionPostRequest.isSuccess || actionGetRequest.isSuccess)) { - dialogAfterEffect(actionPostRequest.data?.data || actionGetRequest.data) + dialogAfterEffect(actionPostRequest.data?.data || actionGetRequest.data); } - }, [actionPostRequest.isSuccess, actionGetRequest.isSuccess]) + }, [actionPostRequest.isSuccess, actionGetRequest.isSuccess]); - const onSubmit = (data) => handleActionClick(row, api, data) - const selectedType = api.type === 'POST' ? actionPostRequest : actionGetRequest + const onSubmit = (data) => handleActionClick(row, api, data); + const selectedType = api.type === "POST" ? actionPostRequest : actionGetRequest; useEffect(() => { if (api?.setDefaultValues && createDialog.open) { fields.forEach((field) => { - const targetName = field.name.replace(/\[(\w+)\]/g, '.$1') + const targetName = field.name.replace(/\[(\w+)\]/g, ".$1"); const val = targetName - .split('.') - .reduce((acc, key) => (acc != null ? acc[key] : undefined), row) + .split(".") + .reduce((acc, key) => (acc != null ? acc[key] : undefined), row); if ( - (typeof val === 'string' && field.type === 'textField') || - (typeof val === 'boolean' && field.type === 'switch') + (typeof val === "string" && field.type === "textField") || + (typeof val === "boolean" && field.type === "switch") ) { - formHook.setValue(targetName, val) - } else if (Array.isArray(val) && field.type === 'autoComplete') { + formHook.setValue(targetName, val); + } else if (Array.isArray(val) && field.type === "autoComplete") { const values = val .map((el) => el?.label && el?.value ? el - : typeof el === 'string' || typeof el === 'number' + : typeof el === "string" || typeof el === "number" ? { label: el, value: el } - : null + : null, ) - .filter(Boolean) - formHook.setValue(targetName, values) - } else if (field.type === 'autoComplete' && val) { + .filter(Boolean); + formHook.setValue(targetName, values); + } else if (field.type === "autoComplete" && val) { formHook.setValue( targetName, - typeof val === 'string' + typeof val === "string" ? { label: val, value: val } : val.label && val.value ? val - : undefined - ) + : undefined, + ); } - }) + }); } - }, [createDialog.open, api?.setDefaultValues]) + }, [createDialog.open, api?.setDefaultValues]); const escapeHtml = (text) => { - if (typeof text !== 'string') return text - const div = document.createElement('div') - div.textContent = text - return div.innerHTML - } + if (typeof text !== "string") return text; + return text + .replace(/&/g, "&") + .replace(//g, ">") + .replace(/"/g, """) + .replace(/'/g, "'"); + }; const getRawNestedValue = (obj, path) => { return path - .split('.') - .reduce((acc, key) => (acc && acc[key] !== undefined ? acc[key] : undefined), obj) - } + .split(".") + .reduce((acc, key) => (acc && acc[key] !== undefined ? acc[key] : undefined), obj); + }; const getNestedValue = (obj, path) => { - const value = getRawNestedValue(obj, path) - return typeof value === 'string' ? escapeHtml(value) : value - } + const value = getRawNestedValue(obj, path); + return typeof value === "string" ? escapeHtml(value) : value; + }; // Handle link actions - opens the link when dialog opens, using ref to prevent duplicates useEffect(() => { @@ -314,86 +323,92 @@ export const CippApiDialog = (props) => { Object.keys(row).length > 0 && !linkOpenedRef.current ) { - linkOpenedRef.current = true - const placeholder = /\[([^\]]+)\]/g - const hasValue = (value) => value !== undefined && value !== null && value !== '' - if (api.link.startsWith('/') && !api?.external) { - // Internal routes only ever substitute ids and query values, so encode them: the row - // is tenant data and must not be able to inject path segments or a second origin. + linkOpenedRef.current = true; + const placeholder = /\[([^\]]+)\]/g; + const hasValue = (value) => value !== undefined && value !== null && value !== ""; + if (api.link.startsWith("/") && !api?.external) { const internalLink = api.link.replace(placeholder, (_, key) => { - const value = getRawNestedValue(row, key) - return hasValue(value) ? encodeURIComponent(String(value)) : `[${key}]` - }) - router.push(internalLink, undefined, { shallow: true }) + const value = getRawNestedValue(row, key); + return hasValue(value) ? encodeURIComponent(String(value)) : `[${key}]`; + }); + const safeRoute = getSafeInternalRoute(internalLink); + if (safeRoute) { + router.push(safeRoute, undefined, { shallow: true }); + } else { + console.warn(`Refusing to navigate to unsafe or unresolved link: ${internalLink}`); + } } else { - // External links may substitute a whole URL (e.g. [webUrl]) and are left as-is. const externalLink = api.link.replace(placeholder, (_, key) => { - const value = getRawNestedValue(row, key) - return hasValue(value) ? value : `[${key}]` - }) - window.open(externalLink, api.target || '_blank') + const value = getRawNestedValue(row, key); + return hasValue(value) ? value : `[${key}]`; + }); + openSafeExternalUrl(externalLink, api.target || "_blank"); } - createDialog.handleClose() + createDialog.handleClose(); } - }, [api.link, createDialog.open, row, router]) + }, [api.link, createDialog.open, row, router]); // Reset the ref when dialog closes so the same link can be opened again useEffect(() => { if (!createDialog.open) { - linkOpenedRef.current = false + linkOpenedRef.current = false; } - }, [createDialog.open]) + }, [createDialog.open]); useEffect(() => { if (api.noConfirm && !api.link) { - formHook.handleSubmit(onSubmit)() - createDialog.handleClose() + formHook.handleSubmit(onSubmit)(); + createDialog.handleClose(); } - }, [api.noConfirm, api.link]) + }, [api.noConfirm, api.link]); const handleClose = () => { - createDialog.handleClose() - setPartialResults([]) - } + createDialog.handleClose(); + setPartialResults([]); + }; - let confirmText - if (typeof api?.confirmText === 'string') { + let confirmText; + if (typeof api?.confirmText === "string") { if (!Array.isArray(row)) { confirmText = api.confirmText.replace( /\[([^\]]+)\]/g, - (_, key) => getNestedValue(row, key) || `[${key}]` - ) + (_, key) => getNestedValue(row, key) || `[${key}]`, + ); } else if (row.length > 1) { - confirmText = api.confirmText.replace(/\[([^\]]+)\]/g, `the ${row.length} selected rows`) + confirmText = api.confirmText.replace(/\[([^\]]+)\]/g, `the ${row.length} selected rows`); } else if (row.length === 1) { confirmText = api.confirmText.replace( /\[([^\]]+)\]/g, - (_, key) => getNestedValue(row[0], key) || `[${key}]` - ) + (_, key) => getNestedValue(row[0], key) || `[${key}]`, + ); } } else { const replaceTextInElement = (element) => { - if (!element) return element - if (typeof element === 'string') { + if (!element) return element; + if (typeof element === "string") { if (Array.isArray(row)) { return row.length > 1 ? element.replace(/\[([^\]]+)\]/g, `the ${row.length} selected rows`) : element.replace( /\[([^\]]+)\]/g, - (_, key) => getNestedValue(row[0], key) || `[${key}]` + (_, key) => getNestedValue(row[0], key) || `[${key}]`, ); } return element.replace(/\[([^\]]+)\]/g, (_, key) => getNestedValue(row, key) || `[${key}]`); } if (React.isValidElement(element)) { - const newChildren = React.Children.map(element.props.children, replaceTextInElement) - return React.cloneElement(element, {}, newChildren) + const newChildren = React.Children.map(element.props.children, replaceTextInElement); + return React.cloneElement(element, {}, newChildren); } - return element - } - confirmText = replaceTextInElement(api?.confirmText) + return element; + }; + confirmText = replaceTextInElement(api?.confirmText); } + const theme = useTheme(); + // Destructive actions are marked with category "danger" and/or colour + // "danger"/"error" depending on the page, so accept any of them here + const isDanger = isDangerAction(api); // Optional typed confirmation: api.confirmPhrase is a string (with [field] interpolation from // the row) or a function of the row / selected rows returning the phrase, or null/'' to skip. // While set, the Confirm button stays disabled until the user types the phrase exactly. @@ -418,16 +433,55 @@ export const CippApiDialog = (props) => { return ( <> {!api?.link && ( - +
    - {title} - - {confirmText} + + {isDanger && } + {title} + + + {isDanger ? ( + + {confirmText} + + ) : ( + {confirmText} + )} {children ? ( - typeof children === 'function' ? ( + typeof children === "function" ? ( children({ formHook, row, @@ -438,62 +492,55 @@ export const CippApiDialog = (props) => { ) : ( <> {fields?.map((fieldProps, i) => { - const { condition, component, csvColumn, ...rest } = fieldProps + const { condition, component, csvColumn, ...rest } = fieldProps; - if (csvColumn && rest.type === 'autoComplete') { - const csvFieldName = `${rest.name}__csv` - const origValidate = rest.validators?.validate + if (csvColumn && rest.type === "autoComplete") { + const csvFieldName = `${rest.name}__csv`; + const origValidate = rest.validators?.validate; rest.validators = { ...rest.validators, validate: (value, formValues) => { - const hasAC = normalizeAutoCompleteValues(value).length > 0 - const csvRows = formValues[csvFieldName] - const csvValues = extractCsvColumnValues(csvRows, csvColumn) - const hasCsvValues = csvValues.length > 0 - const hasCsvRows = - Array.isArray(csvRows) && csvRows.length > 0 + const hasAC = normalizeAutoCompleteValues(value).length > 0; + const csvRows = formValues[csvFieldName]; + const csvValues = extractCsvColumnValues(csvRows, csvColumn); + const hasCsvValues = csvValues.length > 0; + const hasCsvRows = Array.isArray(csvRows) && csvRows.length > 0; if (hasAC || hasCsvValues) { - if (typeof origValidate === 'function' && hasAC) { - return origValidate(value, formValues) + if (typeof origValidate === "function" && hasAC) { + return origValidate(value, formValues); } - return true + return true; } if (hasCsvRows) { - return `CSV must include a ${csvColumn} column with at least one value` + return `CSV must include a ${csvColumn} column with at least one value`; } - return `Select at least one option or upload a CSV with a ${csvColumn} column` + return `Select at least one option or upload a CSV with a ${csvColumn} column`; }, deps: [csvFieldName], - } + }; } if (rest.api) { - let nextApi = rest.api - if ( - nextApi.processFieldData && - nextApi.data && - row && - !Array.isArray(row) - ) { - const processedData = processActionData(nextApi.data, row) + let nextApi = rest.api; + if (nextApi.processFieldData && nextApi.data && row && !Array.isArray(row)) { + const processedData = processActionData(nextApi.data, row); nextApi = { ...nextApi, data: processedData, queryKey: - nextApi.queryKey ?? - `${nextApi.url}-${JSON.stringify(processedData)}`, - } + nextApi.queryKey ?? `${nextApi.url}-${JSON.stringify(processedData)}`, + }; } if (nextApi.tenantFilter === undefined && nextApi.url) { nextApi = { ...nextApi, tenantFilter: getRowTenant(row, tenantFilter), - } + }; } - rest.api = nextApi + rest.api = nextApi; } - const FieldComponent = component ?? CippFormComponent + const FieldComponent = component ?? CippFormComponent; const fieldElement = ( { row={row} {...rest} /> - ) + ); const csvElement = csvColumn ? ( @@ -513,10 +560,10 @@ export const CippApiDialog = (props) => { formControl={formHook} /> - ) : null + ) : null; return ( - + {condition ? ( {fieldElement} @@ -529,7 +576,7 @@ export const CippApiDialog = (props) => { )} - ) + ); })} )} @@ -554,21 +601,39 @@ export const CippApiDialog = (props) => { - + + {allowAddAnother && isFormSubmitted && ( + + )}
    )} - ) -} + ); +}; diff --git a/frontend/src/components/CippComponents/CippApiLogsDrawer.jsx b/frontend/src/components/CippComponents/CippApiLogsDrawer.jsx index 65916f798e..ecddfd66af 100644 --- a/frontend/src/components/CippComponents/CippApiLogsDrawer.jsx +++ b/frontend/src/components/CippComponents/CippApiLogsDrawer.jsx @@ -62,6 +62,7 @@ export const CippApiLogsDrawer = ({ pinned: true, icon: , color: 'primary', + category: "view", }, ] @@ -77,12 +78,7 @@ export const CippApiLogsDrawer = ({ > {buttonText} - + { - const results = [] + const results = []; const getSeverity = (text) => { - if (typeof text !== 'string') return 'success' - return /error|failed|exception|not found|invalid_grant/i.test(text) ? 'error' : 'success'; - } + if (typeof text !== "string") return "success"; + return /error|failed|exception|not found|invalid_grant/i.test(text) ? "error" : "success"; + }; const processResultItem = (item) => { - if (typeof item === 'string') { + if (typeof item === "string") { return { text: item, copyField: item, severity: getSeverity(item), - } + }; } - if (item && typeof item === 'object') { - const text = item.resultText || '' - const copyField = item.copyField || '' - const severity = - typeof item.state === 'string' ? item.state : getSeverity(item) ? 'error' : 'success' - const details = item.details || null + if (item && typeof item === "object") { + const text = item.resultText || ""; + const copyField = item.copyField || ""; + const severity = typeof item.state === "string" ? item.state : getSeverity(text); + const details = item.details || null; if (text) { return { @@ -55,104 +53,492 @@ const extractAllResults = (data, extraIgnoreKeys = []) => { severity, details, ...item, - } + }; } } - return null - } + return null; + }; const extractFrom = (obj) => { - if (!obj) return + if (!obj) return; if (Array.isArray(obj)) { - obj.forEach((item) => extractFrom(item)) - return + obj.forEach((item) => extractFrom(item)); + return; } - if (typeof obj === 'string') { - results.push({ text: obj, copyField: obj, severity: getSeverity(obj) }) - return + if (typeof obj === "string") { + results.push({ text: obj, copyField: obj, severity: getSeverity(obj) }); + return; } if (obj?.resultText) { - const processed = processResultItem(obj) + const processed = processResultItem(obj); if (processed) { - results.push(processed) + results.push(processed); } } else { - const ignoreKeys = ['metadata', 'Metadata', 'severity', ...extraIgnoreKeys] + const ignoreKeys = ["metadata", "Metadata", "severity", ...extraIgnoreKeys]; - if (typeof obj === 'object') { + if (typeof obj === "object") { Object.keys(obj).forEach((key) => { - const value = obj[key] - if (ignoreKeys.includes(key)) return - if (['Results', 'Result', 'results', 'result'].includes(key)) { + const value = obj[key]; + if (ignoreKeys.includes(key)) return; + if (["Results", "Result", "results", "result"].includes(key)) { if (Array.isArray(value)) { value.forEach((valItem) => { - const processed = processResultItem(valItem) + const processed = processResultItem(valItem); if (processed) { - results.push(processed) + results.push(processed); } else { - extractFrom(valItem) + extractFrom(valItem); } - }) - } else if (typeof value === 'object') { - const processed = processResultItem(value) + }); + } else if (typeof value === "object") { + const processed = processResultItem(value); if (processed) { - results.push(processed) + results.push(processed); } else { - extractFrom(value) + extractFrom(value); } - } else if (typeof value === 'string') { + } else if (typeof value === "string") { results.push({ text: value, copyField: value, severity: getSeverity(value), - }) + }); } } else { - extractFrom(value) + extractFrom(value); } - }) + }); } } + }; + + extractFrom(data); + return results; +}; + +// Format result messages for readability +const FormattedResultText = ({ text, severity }) => { + if (typeof text !== "string") { + return {String(text)}; } - extractFrom(data) - return results -} + // Pattern: SharePoint token / CPV error — render structured guidance + const isSharePointTokenError = + text.includes("Failed to obtain a SharePoint token") || + text.includes("SharePoint denied access"); + if (isSharePointTokenError) { + const colonIdx = text.indexOf(":"); + const preamble = + colonIdx > 0 && colonIdx < 80 ? text.slice(0, colonIdx) : null; + const detail = preamble ? text.slice(colonIdx + 1).trim() : text; + return ( + + {preamble && ( + + {preamble} + + )} + {detail} + + Suggested steps: + + +
      +
    1. + Run a CPV Refresh for this tenant from the tenant overview page +
      2. +
    2. Verify the site does not have restricted or unique permissions in SharePoint
      3. +
    3. + If the issue persists, check that the Manage365 SAM app has the necessary SharePoint + delegated permissions +
      4. +
    +     +     + ); + } + + // Pattern: Graph assignLicense privilege / department-SKU denials + const isAssignLicensePrivilegeError = + (text.includes("Failed to assign licenses") || text.includes("Failed to remove licenses")) && + text.includes("Insufficient privileges"); + if (isAssignLicensePrivilegeError) { + return ( + + + License assignment was denied + + {text} + + Suggested steps: + + +
      +
    1. + Confirm the SKU is not a department or self-service license — those + cannot be assigned directly +
      2. +
    2. + Run a CPV Refresh for this tenant so the Manage365 app has{" "} + User.ReadWrite.All +
      3. +
    3. + Confirm GDAP includes License Administrator or{" "} + User Administrator +
      4. +
    +     +     + ); + } + + // Pattern: Litigation Hold license errors from Exchange Online + const isLitigationHoldLicenseError = + (text.includes("LitigationHold") || + text.includes("litigation hold") || + text.includes("Litigation Hold")) && + (text.includes("license") || + text.includes("License") || + text.includes("doesn't permit") || + text.includes("does not permit")); + if (isLitigationHoldLicenseError) { + const errorSplit = text.match(/^(.+?)\.\s*Error:\s*(.+)$/s); + const heading = errorSplit ? errorSplit[1] : "Litigation Hold update failed"; + const errorDetail = errorSplit ? errorSplit[2].trim() : text; + + return ( + + + {heading} + + {errorDetail} + + Eligible licenses for Litigation Hold: + + +
      +
    • Microsoft 365 Business Premium
      • +
    • Microsoft 365 E3 or E5
      • +
    • Office 365 E3 or E5
      • +
    • Exchange Online Plan 2
      • +
    • Exchange Online Plan 1 plus Exchange Online Archiving add-on
      • +
    +     + + Suggested steps: + + +
      +
    1. + Open the user's Edit User page and assign an eligible license +
      2. +
    2. Wait a few minutes for Exchange Online to sync the new license
      3. +
    3. Retry enabling Litigation Hold on this mailbox
      4. +
    +     +     + ); + } + + // Pattern: eDiscovery permission / license errors + const isEdiscoveryError = + (text.includes("eDiscovery") || text.includes("ediscovery")) && + (text.includes("Authorization_RequestDenied") || + text.includes("403") || + text.includes("Forbidden") || + text.includes("not found") || + text.includes("license")); + if (isEdiscoveryError) { + const isPermission = + text.includes("Authorization_RequestDenied") || + text.includes("403") || + text.includes("Forbidden"); + const isLicense = text.includes("license") || text.includes("SKU"); + return ( + + + {isPermission + ? "eDiscovery Permission Error" + : isLicense + ? "eDiscovery License Error" + : "eDiscovery Error"} + + {text} + + Suggested steps: + + +
      + {isPermission && ( + <> +
    1. + Run a CPV Refresh from Manage365 Settings to push eDiscovery + permissions to this tenant +
      2. +
    2. + Assign the eDiscovery Administrator role to the Manage365 service + principal in the tenant's{" "} + Purview portal > Roles & Scopes > Permissions +
      3. + + )} + {isLicense && ( +
    3. + This tenant requires a Microsoft 365 E3 or E5 license with + eDiscovery capabilities +
      4. + )} +
    4. + If the issue persists, verify the Manage365 SAM app registration includes{" "} + eDiscovery.ReadWrite.All application permission +
      5. +
    +     +     + ); + } + + // Pattern: error with Diagnostics section from backend policy checks + if (text.includes("Diagnostics:")) { + const [prelude, ...diagParts] = text.split(/Diagnostics:\s*/); + const diagText = diagParts.join("Diagnostics: "); + + const preludeMatch = prelude.trim().match(/^(.+?)\.\s*Error:\s*(.+)$/s); + const heading = preludeMatch ? preludeMatch[1] : null; + const errorDetail = preludeMatch ? preludeMatch[2].trim() : prelude.trim(); + + const diagItems = diagText + .split(/\n\n|\r?\n(?=\[)/) + .map((s) => s.trim()) + .filter(Boolean); + + const parseDiagItem = (item) => { + const catMatch = item.match(/^\[([^\]]+)\]\s*/); + const category = catMatch ? catMatch[1] : null; + const rest = catMatch ? item.slice(catMatch[0].length) : item; + const settingsMatch = rest.match(/\s*CIPP Settings:\s*(\S+)\s*$/); + const message = settingsMatch ? rest.slice(0, settingsMatch.index).trim() : rest.trim(); + const settingsPath = settingsMatch ? settingsMatch[1] : null; + return { category, message, settingsPath }; + }; + + return ( + + {heading && ( + + {heading} + + )} + {errorDetail && ( + + {errorDetail} + + )} + {diagItems.length > 0 && ( + <> + + Diagnostics: + + + {diagItems.map((item, i) => { + const { category, message, settingsPath } = parseDiagItem(item); + return ( + + + {category && ( + + )} + + + {message} + + {settingsPath && ( + + )} + + ); + })} + + + )} + + ); + } + + // Pattern: UPN/email conflict with identified conflicting object + const conflictMatch = text.match( + /^(.+?Another object with the same value for property \S+ already exists\.)\s*Conflict:\s*(.+)$/s + ); + if (conflictMatch) { + const errorMsg = conflictMatch[1]; + const conflictDetail = conflictMatch[2]; + + const nameMatch = conflictDetail.match(/Conflicting ([^:]+):\s*'([^']+)'/); + const upnMatch = conflictDetail.match(/\(UPN:\s*([^)]+)\)/); + const mailMatch = conflictDetail.match(/\(Mail:\s*([^)]+)\)/); + const idMatch = conflictDetail.match(/\[ID:\s*([^\]]+)\]/); + const statusMatch = conflictDetail.match(/Account is (enabled|disabled)/); + + return ( + + + {errorMsg} + + + Conflicting object details: + + + {nameMatch && ( +
  • + + Type: {nameMatch[1]} — Name:{" "} + {nameMatch[2]} + +
    • + )} + {upnMatch && ( +
  • + + UPN: {upnMatch[1]} + +
    • + )} + {mailMatch && ( +
  • + + Email: {mailMatch[1]} + +
    • + )} + {idMatch && ( +
  • + + Object ID: {idMatch[1]} + +
    • + )} + {statusMatch && ( +
  • + + Status: Account is {statusMatch[1]} + +
    • + )} +     + + To resolve this conflict: + + +
      +
    1. + Rename or remove the conflicting object listed above +
      2. +
    2. + If the conflicting account is disabled or no longer needed, consider deleting it +
      3. +
    3. + If it is a soft-deleted object, purge it from the Entra ID recycle bin +
      4. +
    +     +     + ); + } + + // Pattern: "Failed to X. Error: Y" or "Successfully X. Message: Y" + const errorSplit = text.match(/^(.+?)\.\s*Error:\s*(.+)$/s); + if (errorSplit) { + return ( + + + {errorSplit[1]} + + + {errorSplit[2]} + + + ); + } + + // Pattern: quoted names like 'SiteName' or "SiteName" — bold them + const hasQuotedNames = /['"][^'"]+['"]/.test(text); + if (hasQuotedNames) { + const parts = text.split(/(['"][^'"]+['"])/g); + return ( + + {parts.map((part, i) => + /^['"]/.test(part) ? ( + {part} + ) : ( + {part} + ) + )} + + ); + } + + return ( + + {text} + + ); +}; export const CippApiResults = (props) => { - const { apiObject, errorsOnly = false, alertSx = {}, jobProgress = null } = props + const { apiObject, errorsOnly = false, alertSx = {}, jobProgress = null } = props; - const [errorVisible, setErrorVisible] = useState(false) - const [fetchingVisible, setFetchingVisible] = useState(false) - const [finalResults, setFinalResults] = useState([]) - const [showDetails, setShowDetails] = useState({}) - const [jobId, setJobId] = useState(null) - const [jobPollActive, setJobPollActive] = useState(false) - const tableDialog = useDialog() + const [errorVisible, setErrorVisible] = useState(false); + const [fetchingVisible, setFetchingVisible] = useState(false); + const [finalResults, setFinalResults] = useState([]); + const [showDetails, setShowDetails] = useState({}); + const [jobId, setJobId] = useState(null); + const [jobPollActive, setJobPollActive] = useState(false); + const tableDialog = useDialog(); // Optional live job progress: when the mutation result carries jobProgress.idField, poll // jobProgress.url(id) until every row reaches a terminal state, then call jobProgress.onComplete(rows). // Pass a memoized jobProgress: a new object each render re-arms the poll. const jobIdField = jobProgress?.idField ?? 'JobId' useEffect(() => { - if (!jobProgress) return + if (!jobProgress) return; if (apiObject.isPending) { - setJobId(null) - setJobPollActive(false) - return + setJobId(null); + setJobPollActive(false); + return; } - if (!apiObject.isSuccess) return - const raw = apiObject?.data?.data ?? apiObject?.data - const item = Array.isArray(raw) ? raw[0] : raw - const id = item?.[jobIdField] + if (!apiObject.isSuccess) return; + const raw = apiObject?.data?.data ?? apiObject?.data; + const item = Array.isArray(raw) ? raw[0] : raw; + const id = item?.[jobIdField]; if (id) { - setJobId(id) - setJobPollActive(true) + setJobId(id); + setJobPollActive(true); } - }, [jobProgress, jobIdField, apiObject.isPending, apiObject.isSuccess, apiObject.data]) + }, [jobProgress, jobIdField, apiObject.isPending, apiObject.isSuccess, apiObject.data]); const jobStatus = ApiGetCall({ url: jobProgress && jobId ? jobProgress.url(jobId) : null, @@ -184,83 +570,86 @@ export const CippApiResults = (props) => { }, [jobPollActive, jobRows, jobStatus.dataUpdatedAt, jobProgress]) const pageTitle = `${document.title} - Results` const correctResultObj = useMemo(() => { - if (!apiObject.isSuccess) return + if (!apiObject.isSuccess) return; - const data = apiObject?.data - const dataData = data?.data + const data = apiObject?.data; + const dataData = data?.data; if (dataData !== undefined && dataData !== null) { if (dataData?.Results) { - return dataData.Results - } else if (typeof dataData === 'object' && dataData !== null && !('metadata' in dataData)) { - return dataData - } else if (typeof dataData === 'string') { - return dataData + return dataData.Results; + } else if (typeof dataData === "object" && dataData !== null && !("metadata" in dataData)) { + return dataData; + } else if (typeof dataData === "string") { + return dataData; } else { - return 'This API has not sent the correct output format.' + return "This API has not sent the correct output format."; } } if (data?.Results) { - return data.Results - } else if (typeof data === 'object' && data !== null && !('metadata' in data)) { - return data - } else if (typeof data === 'string') { - return data + return data.Results; + } else if (typeof data === "object" && data !== null && !("metadata" in data)) { + return data; + } else if (typeof data === "string") { + return data; } - return 'This API has not sent the correct output format.' - }, [apiObject]) + return "This API has not sent the correct output format."; + }, [apiObject]); const allResults = useMemo(() => { - const sourceItems = Array.isArray(correctResultObj) ? correctResultObj : [correctResultObj] + // Tag every result with the index of the action (bulk request item) it came from, + // so multi-action runs can be rolled up into a summary alert. + const sourceItems = Array.isArray(correctResultObj) ? correctResultObj : [correctResultObj]; // Don't render the job id (e.g. DeploymentId) as a result alert of its own. - const jobIgnoreKeys = jobProgress ? [jobIdField] : [] + const jobIgnoreKeys = jobProgress ? [jobIdField] : []; const apiResults = sourceItems.flatMap((item, groupIndex) => - extractAllResults(item, jobIgnoreKeys).map((r) => ({ ...r, groupIndex })) - ) + extractAllResults(item, jobIgnoreKeys).map((r) => ({ ...r, groupIndex })), + ); // Also extract error results if there's an error if (apiObject.isError && apiObject.error) { - const errorData = apiObject.error.response?.data - const errorItems = Array.isArray(errorData) ? errorData : [errorData] + const errorData = apiObject.error?.response?.data; + const errorItems = Array.isArray(errorData) ? errorData : [errorData]; const errorResults = errorItems.flatMap((item, index) => extractAllResults(item).map((r) => ({ ...r, - severity: 'error', + severity: "error", groupIndex: sourceItems.length + index, - })) - ) + })), + ); if (errorResults.length > 0) { - // Mark all error results with error severity and merge with success results - return [...apiResults, ...errorResults] + return [...apiResults, ...errorResults]; } // Fallback to getCippError if extraction didn't work - const processedError = getCippError(apiObject.error) - if (typeof processedError === 'string') { + const processedError = getCippError(apiObject.error); + if (typeof processedError === "string") { return [ ...apiResults, { text: processedError, copyField: processedError, - severity: 'error', + severity: "error", groupIndex: sourceItems.length, }, - ] + ]; } } - return apiResults - }, [correctResultObj, apiObject.isError, apiObject.error, jobProgress, jobIdField]) + return apiResults; + }, [correctResultObj, apiObject.isError, apiObject.error, jobProgress, jobIdField]); useEffect(() => { - setErrorVisible(!!apiObject.isError) + setErrorVisible(!!apiObject.isError); if (apiObject.isFetching || (apiObject.isIdle === false && apiObject.isPending === true)) { - setFetchingVisible(true) + setFetchingVisible(true); } else { - setFetchingVisible(false) + setFetchingVisible(false); } - const resultsToShow = errorsOnly ? allResults.filter((r) => r.severity === 'error') : allResults + const resultsToShow = errorsOnly + ? allResults.filter((r) => r.severity === "error") + : allResults; if (resultsToShow.length > 0) { setFinalResults( @@ -271,10 +660,10 @@ export const CippApiResults = (props) => { severity: res.severity, visible: true, ...res, - })) - ) + })), + ); } else { - setFinalResults([]) + setFinalResults([]); } }, [ apiObject.isError, @@ -283,48 +672,51 @@ export const CippApiResults = (props) => { apiObject.isIdle, allResults, errorsOnly, - ]) + ]); const handleCloseResult = useCallback((id) => { - setFinalResults((prev) => prev.map((r) => (r.id === id ? { ...r, visible: false } : r))) - }, []) + setFinalResults((prev) => prev.map((r) => (r.id === id ? { ...r, visible: false } : r))); + }, []); const handleCloseAllResults = useCallback(() => { setFinalResults((prev) => prev.map((r) => ({ ...r, visible: false }))) }, []) const toggleDetails = useCallback((id) => { - setShowDetails((prev) => ({ ...prev, [id]: !prev[id] })) - }, []) + setShowDetails((prev) => ({ ...prev, [id]: !prev[id] })); + }, []); const handleDownloadCsv = useCallback(() => { - if (!finalResults?.length) return + if (!finalResults?.length) return; - const baseName = document.title.toLowerCase().replace(/[^a-z0-9]/g, '-') - const fileName = `${baseName}-results.csv` + const baseName = document.title.toLowerCase().replace(/[^a-z0-9]/g, "-"); + const fileName = `${baseName}-results.csv`; - const headers = Object.keys(finalResults[0]) + const headers = Object.keys(finalResults[0]); const rows = finalResults.map((item) => - headers.map((header) => `"${item[header] || ''}"`).join(',') - ) - const csvContent = [headers.join(','), ...rows].join('\n') - const blob = new Blob([csvContent], { type: 'text/csv;charset=utf-8;' }) - const url = URL.createObjectURL(blob) - const link = document.createElement('a') - link.setAttribute('href', url) - link.setAttribute('download', fileName) - document.body.appendChild(link) - link.click() - document.body.removeChild(link) - }, [finalResults, apiObject]) - - const hasVisibleResults = finalResults.some((r) => r.visible) - const actionGroups = [...new Set(finalResults.map((r) => r.groupIndex ?? r.id))] - const actionCount = actionGroups.length + headers.map((header) => `"${item[header] || ""}"`).join(","), + ); + const csvContent = [headers.join(","), ...rows].join("\n"); + const blob = new Blob([csvContent], { type: "text/csv;charset=utf-8;" }); + const url = URL.createObjectURL(blob); + const link = document.createElement("a"); + link.setAttribute("href", url); + link.setAttribute("download", fileName); + document.body.appendChild(link); + link.click(); + document.body.removeChild(link); + }, [finalResults, apiObject]); + + const hasVisibleResults = finalResults.some((r) => r.visible); + + // Roll bulk results up by originating action so the user sees "X of Y actions failed". + const actionGroups = [...new Set(finalResults.map((r) => r.groupIndex ?? r.id))]; + const actionCount = actionGroups.length; const failedActionCount = actionGroups.filter((group) => - finalResults.some((r) => (r.groupIndex ?? r.id) === group && r.severity === 'error') - ).length - const successActionCount = actionCount - failedActionCount + finalResults.some((r) => (r.groupIndex ?? r.id) === group && r.severity === "error"), + ).length; + const successActionCount = actionCount - failedActionCount; + return ( {/* Loading alert */} @@ -357,7 +749,7 @@ export const CippApiResults = (props) => { sx={alertSx} variant="outlined" severity={ - failedActionCount === 0 ? 'success' : successActionCount === 0 ? 'error' : 'warning' + failedActionCount === 0 ? "success" : successActionCount === 0 ? "error" : "warning" } action={ @@ -376,7 +768,7 @@ export const CippApiResults = (props) => { {failedActionCount === 0 ? `All ${actionCount} actions completed successfully` : `${failedActionCount} of ${actionCount} actions failed${ - successActionCount > 0 ? `, ${successActionCount} succeeded` : '' + successActionCount > 0 ? `, ${successActionCount} succeeded` : "" }`}     @@ -390,21 +782,21 @@ export const CippApiResults = (props) => { {resultObj.severity === 'error' && ( @@ -414,10 +806,15 @@ export const CippApiResults = (props) => { color="secondary" startIcon={} onClick={() => { - const searchUrl = `https://docs.cipp.app/?q=Help+with:+${encodeURIComponent( - resultObj.copyField || resultObj.text - )}&ask=true` - window.open(searchUrl, '_blank') + const docsUrl = new URL("https://docs.cipp.app/"); + docsUrl.searchParams.set( + "q", + `Help with: ${resultObj.copyField || resultObj.text || ""}`, + ); + docsUrl.searchParams.set("ask", "true"); + if (docsUrl.origin === "https://docs.cipp.app") { + window.open(docsUrl.href, "_blank", "noopener,noreferrer"); + } }} sx={{ ml: 1, @@ -444,13 +841,13 @@ export const CippApiResults = (props) => { {resultObj.details && ( toggleDetails(resultObj.id)} - aria-label={showDetails[resultObj.id] ? 'Hide Details' : 'Show Details'} + aria-label={showDetails[resultObj.id] ? "Hide Details" : "Show Details"} > {showDetails[resultObj.id] ? ( @@ -472,8 +869,8 @@ export const CippApiResults = (props) => { } > - - {resultObj.text} + + {resultObj.details && ( { }}> { title={pageTitle} data={finalResults} noCard={true} - simpleColumns={['severity', 'text', 'copyField']} + simpleColumns={["severity", "text", "copyField"]} /> )}     ); -} +}; diff --git a/frontend/src/components/CippComponents/CippAppPermissionBuilder.jsx b/frontend/src/components/CippComponents/CippAppPermissionBuilder.jsx index c429ce06f3..ac9892b4e2 100644 --- a/frontend/src/components/CippComponents/CippAppPermissionBuilder.jsx +++ b/frontend/src/components/CippComponents/CippAppPermissionBuilder.jsx @@ -24,7 +24,7 @@ import CippFormComponent from "./CippFormComponent"; import { useWatch } from "react-hook-form"; import { CippCardTabPanel } from "./CippCardTabPanel"; import { CippApiResults } from "./CippApiResults"; -import { isEqual } from "lodash"; +import isEqual from "lodash/isEqual"; import { CippCodeBlock } from "./CippCodeBlock"; import { CippOffCanvas } from "./CippOffCanvas"; import { FileDropzone } from "../file-dropzone"; @@ -616,6 +616,7 @@ const CippAppPermissionBuilder = ({ noConfirm: true, condition: (row) => !row.required, customFunction: (row) => handleRemoveRow("applicationPermissions", row), + category: "danger", }, ]} isFetching={spInfoFetching} @@ -682,6 +683,7 @@ const CippAppPermissionBuilder = ({ noConfirm: true, condition: (row) => !row.required, customFunction: (row) => handleRemoveRow("delegatedPermissions", row), + category: "danger", }, ]} isFetching={spInfoFetching} @@ -976,7 +978,7 @@ const CippAppPermissionBuilder = ({ }> Extra permissions present on the {appDisplayName} app registration that - are not part of the CIPP defaults or your additional permissions + are not part of the Manage365 defaults or your additional permissions (review and remove manually if not required) {appIds.map((perm) => diff --git a/frontend/src/components/CippComponents/CippAppTemplateDrawer.jsx b/frontend/src/components/CippComponents/CippAppTemplateDrawer.jsx index 93973f09e6..06645888f9 100644 --- a/frontend/src/components/CippComponents/CippAppTemplateDrawer.jsx +++ b/frontend/src/components/CippComponents/CippAppTemplateDrawer.jsx @@ -217,11 +217,6 @@ export const CippAppTemplateDrawer = ({ if (repoMatch) config.customRepo = repoMatch[1] } } - // Canonical spelling only, same as ApplicationName above. Leaving 'assignTo' next to - // 'AssignTo' puts both on the form and stores both on save, and PowerShell's ConvertFrom-Json - // cannot read an object holding two casings of one key. - if (!config.AssignTo && config.assignTo) config.AssignTo = config.assignTo - delete config.assignTo formControl.reset({ appType: config.appType }) setTimeout(() => { Object.entries(config).forEach(([key, value]) => { @@ -411,6 +406,7 @@ export const CippAppTemplateDrawer = ({ { value: 'huntress', label: 'Huntress' }, { value: 'automate', label: 'CW Automate' }, { value: 'cwcommand', label: 'CW Command' }, + { value: 'ninja', label: 'NinjaOne' }, ]} formControl={formControl} multiple={false} @@ -427,7 +423,7 @@ export const CippAppTemplateDrawer = ({ Enter tenant-specific parameters (keys, URLs, IDs) below. You can enter a literal - value that is the same for every tenant, or reference a CIPP custom variable like{' '} + value that is the same for every tenant, or reference a Manage365 custom variable like{' '} %DattoSiteID% (type % to browse). Variables are resolved per tenant at deployment, so define the value once per tenant in your CIPP custom variables and reuse this template everywhere. @@ -550,6 +546,23 @@ export const CippAppTemplateDrawer = ({ /> + + {/* NinjaOne */} + + + + + {/* Store/WinGet App Fields */} @@ -1068,21 +1081,6 @@ export const CippAppTemplateDrawer = ({ /> - - - - - {/* Add App Button */} {applicationType?.value && ( diff --git a/frontend/src/components/CippComponents/CippApplicationDeployDrawer.jsx b/frontend/src/components/CippComponents/CippApplicationDeployDrawer.jsx index 52f7bac4a5..cfe6af04c2 100644 --- a/frontend/src/components/CippComponents/CippApplicationDeployDrawer.jsx +++ b/frontend/src/components/CippComponents/CippApplicationDeployDrawer.jsx @@ -17,14 +17,14 @@ import languageList from '../../data/languageList.json' import { ApiPostCall } from '../../api/ApiCall' export const CippApplicationDeployDrawer = ({ - buttonText = 'Add Application', + buttonText = "Add Application", requiredPermissions = [], PermissionButton = Button, }) => { - const [drawerVisible, setDrawerVisible] = useState(false) + const [drawerVisible, setDrawerVisible] = useState(false); const formControl = useForm({ - mode: 'onChange', - }) + mode: "onChange", + }); const selectedTenants = useWatch({ control: formControl.control, @@ -45,31 +45,31 @@ export const CippApplicationDeployDrawer = ({ const applicationType = useWatch({ control: formControl.control, - name: 'appType', - }) + name: "appType", + }); const searchQuerySelection = useWatch({ control: formControl.control, - name: 'packageSearch', - }) + name: "packageSearch", + }); const updateSearchSelection = useCallback( (searchQuerySelection) => { if (searchQuerySelection) { - formControl.setValue('packagename', searchQuerySelection.value.packagename) - formControl.setValue('applicationName', searchQuerySelection.value.applicationName) - formControl.setValue('description', searchQuerySelection.value.description) + formControl.setValue("packagename", searchQuerySelection.value.packagename); + formControl.setValue("applicationName", searchQuerySelection.value.applicationName); + formControl.setValue("description", searchQuerySelection.value.description); searchQuerySelection.value.customRepo - ? formControl.setValue('customRepo', searchQuerySelection.value.customRepo) - : null + ? formControl.setValue("customRepo", searchQuerySelection.value.customRepo) + : null; } }, - [formControl.setValue] - ) + [formControl.setValue], + ); useEffect(() => { - updateSearchSelection(searchQuerySelection) - }, [updateSearchSelection, searchQuerySelection]) + updateSearchSelection(searchQuerySelection); + }, [updateSearchSelection, searchQuerySelection]); const postUrl = { mspApp: '/api/AddMSPApp', @@ -83,34 +83,34 @@ export const CippApplicationDeployDrawer = ({ const ChocosearchResults = ApiPostCall({ urlFromData: true, - }) + }); const winGetSearchResults = ApiPostCall({ urlFromData: true, - }) + }); const deployApplication = ApiPostCall({ urlFromData: true, - relatedQueryKeys: ['Queued Applications'], - }) + relatedQueryKeys: ["Queued Applications"], + }); const searchApp = (searchText, type) => { - if (type === 'choco') { + if (type === "choco") { ChocosearchResults.mutate({ url: `/api/ListAppsRepository`, data: { search: searchText }, queryKey: `SearchApp-${searchText}-${type}`, - }) + }); } - if (type === 'StoreApp') { + if (type === "StoreApp") { winGetSearchResults.mutate({ url: `/api/ListPotentialApps`, - data: { searchString: searchText, type: 'WinGet' }, + data: { searchString: searchText, type: "WinGet" }, queryKey: `SearchApp-${searchText}-${type}`, - }) + }); } - } + }; const handleSubmit = () => { const formData = formControl.getValues() @@ -119,19 +119,19 @@ export const CippApplicationDeployDrawer = ({ formattedData.selectedTenants = selectedTenants.map((tenant) => ({ defaultDomainName: tenant.value, customerId: tenant.addedFields.customerId, - })) + })); deployApplication.mutate({ url: postUrl[applicationType?.value], data: formattedData, - relatedQueryKeys: ['Queued Applications'], - }) - } + relatedQueryKeys: ["Queued Applications"], + }); + }; const handleCloseDrawer = () => { - setDrawerVisible(false) - formControl.reset() - } + setDrawerVisible(false); + formControl.reset(); + }; return ( <> @@ -148,7 +148,7 @@ export const CippApplicationDeployDrawer = ({ onClose={handleCloseDrawer} size="xl" footer={ -
    +
    } > + + + { const [drawerVisible, setDrawerVisible] = useState(false); const [addRowDialogOpen, setAddRowDialogOpen] = useState(false); const initialState = useSettings(); - // Bulk user creation targets a single tenant. Under "All Tenants" the tenant does not resolve, - // and the Graph write helpers silently no-op while the endpoint still reports success, so guard - // the submit rather than letting it appear to succeed while creating nothing. - const isAllTenants = - !initialState?.currentTenant || initialState.currentTenant === "AllTenants"; - const addedFields = initialState?.defaultAttributes ? initialState.userAttributes.map((item) => item.label) : []; @@ -37,7 +33,6 @@ export const CippBulkUserDrawer = ({ "surName", "displayName", "mailNickName", - "domain", "JobTitle", "streetAddress", "PostalCode", @@ -82,10 +77,12 @@ export const CippBulkUserDrawer = ({ usageLocation: initialState.usageLocation || "US", bulkUser: [], licenses: [], + disableLegacyProtocols: true, }, }); const bulkUserData = useWatch({ control: formControl.control, name: "bulkUser" }); + const isAllTenants = !initialState?.currentTenant || initialState.currentTenant === "AllTenants"; const createBulkUsers = ApiPostCall({ urlFromData: true, @@ -123,6 +120,13 @@ export const CippBulkUserDrawer = ({ const handleSubmit = () => { const formData = formControl.getValues(); + const selectedDomain = formData.primDomain?.value || formData.primDomain; + if (selectedDomain && Array.isArray(formData.bulkUser)) { + formData.bulkUser = formData.bulkUser.map((user) => ({ + ...user, + domain: user.domain || selectedDomain, + })); + } createBulkUsers.mutate({ url: "/api/AddUserBulk", data: formData, @@ -137,25 +141,28 @@ export const CippBulkUserDrawer = ({ usageLocation: initialState.usageLocation || "US", bulkUser: [], licenses: [], + disableLegacyProtocols: true, }); }; const actions = [ { - icon: , + icon: , label: "Delete Row", confirmText: "Are you sure you want to delete this row?", customFunction: handleRemoveItem, noConfirm: true, + category: "danger", }, ]; return ( <> setDrawerVisible(true)} - startIcon={} + startIcon={} + {...buttonProps} > {buttonText} @@ -189,16 +196,13 @@ export const CippBulkUserDrawer = ({
    } > + {isAllTenants && ( + + User creation is single-tenant only. Select a specific tenant using the tenant + selector before adding users — with "All Tenants" selected no users will be created. + + )} - {isAllTenants && ( - - - Bulk user creation is single-tenant only. Select a specific tenant using the tenant - selector before adding users — with "All Tenants" selected no users will be created. - - - )} - + + + + + + + + import("@monaco-editor/react").then((m) => m.Editor), { - ssr: false, - loading: () => null, -}); -const CippPrismHighlighter = dynamic(() => import("./CippPrismHighlighter"), { +// Register only the languages actually used in the codebase +// (plain text / unregistered languages render without highlighting by default) +SyntaxHighlighter.registerLanguage("json", json); +SyntaxHighlighter.registerLanguage("JSON", json); +SyntaxHighlighter.registerLanguage("powershell", powershell); + +// Lazy-load Monaco Editor (~2MB) only when type="editor" is used +const Editor = dynamic(() => import("@monaco-editor/react").then((mod) => mod.Editor), { ssr: false, - loading: () => null, + loading: () => , }); const CodeContainer = styled("div")` @@ -77,14 +83,16 @@ export const CippCodeBlock = (props) => { /> )} {type === "syntax" && ( - + > + {code} + )} ); diff --git a/frontend/src/components/CippComponents/CippComponentDialog.jsx b/frontend/src/components/CippComponents/CippComponentDialog.jsx index 03d4d64dcd..fd7afae3df 100644 --- a/frontend/src/components/CippComponents/CippComponentDialog.jsx +++ b/frontend/src/components/CippComponents/CippComponentDialog.jsx @@ -4,7 +4,7 @@ export const CippComponentDialog = (props) => { const { children, createDialog, title, ...other } = props; return ( - +
    {title} {children} diff --git a/frontend/src/components/CippComponents/CippCopyToClipboard.jsx b/frontend/src/components/CippComponents/CippCopyToClipboard.jsx index 54bd42df2f..57809d2830 100644 --- a/frontend/src/components/CippComponents/CippCopyToClipboard.jsx +++ b/frontend/src/components/CippComponents/CippCopyToClipboard.jsx @@ -56,14 +56,24 @@ export const CippCopyToClipBoard = (props) => { if (type === "chip") { return ( - + diff --git a/frontend/src/components/CippComponents/CippCsvExportButton.jsx b/frontend/src/components/CippComponents/CippCsvExportButton.jsx index 70070cd601..84fb433b2e 100644 --- a/frontend/src/components/CippComponents/CippCsvExportButton.jsx +++ b/frontend/src/components/CippComponents/CippCsvExportButton.jsx @@ -1,64 +1,81 @@ -import { IconButton, Tooltip } from "@mui/material"; -import { CippIcons } from "../../utils/icon-registry"; -import { mkConfig, generateCsv, download } from "export-to-csv"; +import { Button, IconButton, Tooltip } from '@mui/material' +import { CippIcons } from '../../utils/icon-registry' +import { mkConfig, generateCsv, download } from 'export-to-csv' // Utility to flatten nested objects -const flattenObject = (obj, parent = "", res = {}) => { +const flattenObject = (obj, parent = '', res = {}) => { for (let key in obj) { - const propName = parent ? `${parent}.${key}` : key; - if (typeof obj[key] === "object" && obj[key] !== null) { - flattenObject(obj[key], propName, res); + const propName = parent ? `${parent}.${key}` : key + if (typeof obj[key] === 'object' && obj[key] !== null) { + flattenObject(obj[key], propName, res) } else { - res[propName] = obj[key]; + res[propName] = obj[key] } } - return res; -}; + return res +} -export const CippCsvExportButton = ({ rawData, reportName = "Export", includeFields = [] }) => { +export const CippCsvExportButton = ({ + rawData, + reportName = 'Export', + includeFields = [], + label, +}) => { const handleExport = () => { if (!rawData || rawData.length === 0) { - console.warn("No raw data available for export."); - return; + console.warn('No raw data available for export.') + return } // Flatten and process raw data - const flattenedData = rawData.map((item) => flattenObject(item)); + const flattenedData = rawData.map((item) => flattenObject(item)) // Optionally filter specific fields const exportData = includeFields.length ? flattenedData.map((row) => includeFields.reduce((filteredRow, field) => { if (row[field] !== undefined) { - filteredRow[field] = row[field]; + filteredRow[field] = row[field] } - return filteredRow; + return filteredRow }, {}) ) - : flattenedData; + : flattenedData // Generate CSV configuration const csvConfig = mkConfig({ - fieldSeparator: ",", - decimalSeparator: ".", + fieldSeparator: ',', + decimalSeparator: '.', useKeysAsHeaders: true, - filename: `${reportName}_${new Date().toISOString()}.csv`, - }); + filename: `${reportName}_${new Date().toISOString()}`, + }) // Generate and download CSV - const csv = generateCsv(csvConfig)(exportData); - download(csvConfig)(csv); - }; + const csv = generateCsv(csvConfig)(exportData) + download(csvConfig)(csv) + } + + if (label) { + return ( + + ) + } return ( - + - ); -}; + ) +} -export default CippCsvExportButton; +export default CippCsvExportButton diff --git a/frontend/src/components/CippComponents/CippDeployCompliancePolicyDrawer.jsx b/frontend/src/components/CippComponents/CippDeployCompliancePolicyDrawer.jsx index 1b83c6756f..5e5c2ed6c8 100644 --- a/frontend/src/components/CippComponents/CippDeployCompliancePolicyDrawer.jsx +++ b/frontend/src/components/CippComponents/CippDeployCompliancePolicyDrawer.jsx @@ -61,17 +61,12 @@ const MODE_CONFIG = { listTemplatesUrl: "/api/ListSensitivityLabelTemplates", templateQueryKey: "TemplateListSensitivityLabel", relatedQueryKeys: ["ListSensitivityLabel", "ListSensitivityLabelTemplates"], - supportsLabelColor: true, - // Sensitivity label templates store DisplayName/Name (Purview casing); the other template - // types store a lowercase 'name', which is the default label field below. - templateLabelField: (option) => option.DisplayName ?? option.Name ?? option.name, placeholder: `{ "Name": "Confidential", "DisplayName": "Confidential", "Tooltip": "Confidential data, do not share externally", "Comment": "Internal-only confidential classification", "ContentType": "File, Email", - "AdvancedSettings": { "color": "#40E0D0" }, "ApplyContentMarkingHeaderEnabled": true, "ApplyContentMarkingHeaderText": "Confidential - Internal Use Only", "ApplyContentMarkingHeaderFontColor": "#FF0000", @@ -96,41 +91,22 @@ const MODE_CONFIG = { listTemplatesUrl: "/api/ListSensitiveInfoTypeTemplates", templateQueryKey: "TemplateListSensitiveInfoType", relatedQueryKeys: ["ListSensitiveInfoType", "ListSensitiveInfoTypeTemplates"], - placeholder: `// Simple mode — backend wraps the regex in a rule pack for you -{ - "Name": "Acme Employee ID", - "Description": "Matches Acme employee IDs in the format EMP-NNNNN", + placeholder: `{ + "Name": "Custom Employee ID", + "Description": "Internal Employee ID format EMP-NNNNN", "Pattern": "EMP-\\\\d{5}", - "Confidence": 85, - "PatternsProximity": 300, - "PublisherName": "Acme Corp" + "Confidence": "High", + "Recommended": true } -// Advanced mode — provide your own rule pack XML, base64-encoded +// Or with a base64-encoded XML rule pack: // { -// "Name": "Acme Custom Rule Pack", -// "Description": "Multi-pattern rule pack", -// "FileDataBase64": "" +// "Name": "Custom Rule Pack", +// "FileDataBase64": "" // }`, }, }; -// A sensitivity label's custom color lives in the 'color' advanced setting. On stored templates it is -// either an explicit AdvancedSettings object or, for templates captured from Get-Label, an entry in the -// read-only Settings array ({Key, Value} object or the serialized string '[color, #RRGGBB]'). -const extractLabelColor = (template) => { - if (!template) return ""; - if (template.AdvancedSettings?.color) return template.AdvancedSettings.color; - for (const entry of template.Settings || []) { - if (entry?.Key?.toLowerCase?.() === "color") return entry.Value || ""; - if (typeof entry === "string") { - const match = entry.match(/^\[\s*color\s*,\s*(.*?)\s*\]$/i); - if (match) return match[1]; - } - } - return ""; -}; - export const CippDeployCompliancePolicyDrawer = ({ mode, buttonText, @@ -147,7 +123,6 @@ export const CippDeployCompliancePolicyDrawer = ({ selectedTenants: [], TemplateList: null, PowerShellCommand: "", - labelColor: "", }, }); @@ -158,11 +133,8 @@ export const CippDeployCompliancePolicyDrawer = ({ useEffect(() => { if (templateListVal?.value) { formControl.setValue("PowerShellCommand", JSON.stringify(templateListVal.value)); - if (config?.supportsLabelColor) { - formControl.setValue("labelColor", extractLabelColor(templateListVal.value)); - } } - }, [templateListVal, formControl, config?.supportsLabelColor]); + }, [templateListVal, formControl]); const deployPolicy = ApiPostCall({ urlFromData: true, @@ -175,7 +147,6 @@ export const CippDeployCompliancePolicyDrawer = ({ selectedTenants: [], TemplateList: null, PowerShellCommand: "", - labelColor: "", }); } }, [deployPolicy.isSuccess, formControl]); @@ -187,21 +158,9 @@ export const CippDeployCompliancePolicyDrawer = ({ const handleSubmit = () => { formControl.trigger(); if (!isValid) return; - const { labelColor, ...values } = formControl.getValues(); - if (config.supportsLabelColor && labelColor) { - // Merge the picked color into the JSON as the 'color' advanced setting; an explicit color - // already typed into the JSON is overridden by the picker since it is the visible control. - try { - const parsed = JSON.parse(values.PowerShellCommand); - parsed.AdvancedSettings = { ...(parsed.AdvancedSettings || {}), color: labelColor }; - values.PowerShellCommand = JSON.stringify(parsed, null, 2); - } catch { - // Invalid JSON in the textarea - submit unchanged and let the backend report the parse error. - } - } deployPolicy.mutate({ url: config.postUrl, - data: values, + data: formControl.getValues(), }); }; @@ -211,7 +170,6 @@ export const CippDeployCompliancePolicyDrawer = ({ selectedTenants: [], TemplateList: null, PowerShellCommand: "", - labelColor: "", }); }; @@ -275,7 +233,7 @@ export const CippDeployCompliancePolicyDrawer = ({ multiple={false} api={{ queryKey: config.templateQueryKey, - labelField: config.templateLabelField ?? "name", + labelField: "name", valueField: (option) => option, url: config.listTemplatesUrl, }} @@ -285,18 +243,6 @@ export const CippDeployCompliancePolicyDrawer = ({ - {config.supportsLabelColor && ( - - - - )} - { + const [copied, setCopied] = useState(false); + + const handleCopy = async () => { + if (!value) return; + try { + await navigator.clipboard.writeText(value); + setCopied(true); + setTimeout(() => setCopied(false), 2000); + } catch (err) { + console.error("Failed to copy:", err); + } + }; + + return ( + + + {copied ? : } + + + ); +}; + +const SecretCell = ({ secret }) => { + const [visible, setVisible] = useState(false); + + if (!secret) { + return -; + } + + return ( + + + {visible ? secret : "••••••••••••••••"} + + + setVisible(!visible)}> + {visible ? : } + + + + + ); +}; + +export const CippDeploymentResults = ({ deploymentId, onComplete }) => { + const theme = useTheme(); + const [pollInterval, setPollInterval] = useState(2000); + + const deploymentQuery = ApiGetCall({ + url: "/api/ListIntegrationDeployments", + data: { deploymentId }, + queryKey: ["IntegrationDeployment", deploymentId], + refetchInterval: (data) => { + if (data?.status === "Complete") { + return false; + } + return pollInterval; + }, + }); + + const isComplete = deploymentQuery.data?.status === "Complete"; + const results = deploymentQuery.data?.results || []; + const successCount = deploymentQuery.data?.successCount || 0; + const failedCount = deploymentQuery.data?.failedCount || 0; + + useEffect(() => { + if (isComplete && onComplete) { + onComplete(deploymentQuery.data); + } + }, [isComplete, onComplete, deploymentQuery.data]); + + const handleExportCSV = () => { + const csvContent = [ + ["Tenant", "App Name", "Application ID", "Tenant ID", "Client Secret", "Secret Expiration", "Status"], + ...results.map((r) => [ + r.displayName || r.tenantName, + r.appName || "", + r.appId || "", + r.tenantId || "", + r.clientSecret || "", + r.secretExpiration || "", + r.status, + ]), + ] + .map((row) => row.map((cell) => `"${(cell || "").replace(/"/g, '""')}"`).join(",")) + .join("\n"); + + const blob = new Blob([csvContent], { type: "text/csv;charset=utf-8;" }); + const url = URL.createObjectURL(blob); + const link = document.createElement("a"); + link.href = url; + link.download = `integration-deployment-${deploymentId}.csv`; + link.click(); + URL.revokeObjectURL(url); + }; + + const handleCopyAll = async () => { + const text = results + .filter((r) => r.status === "Success") + .map( + (r) => + `Tenant: ${r.displayName || r.tenantName}\nApplication ID: ${r.appId}\nTenant ID: ${r.tenantId}\nClient Secret: ${r.clientSecret}\n` + ) + .join("\n---\n\n"); + + try { + await navigator.clipboard.writeText(text); + } catch (err) { + console.error("Failed to copy:", err); + } + }; + + if (deploymentQuery.isLoading && !deploymentQuery.data) { + return ( + + + + Loading deployment status... + + + ); + } + + if (deploymentQuery.isError) { + return ( + + Failed to load deployment status: {deploymentQuery.error?.message || "Unknown error"} + + ); + } + + return ( + + + + {isComplete ? ( + + ) : ( + + )} + + + {isComplete ? "Deployment Complete" : "Deployment In Progress"} + + + {isComplete + ? `${successCount} succeeded, ${failedCount} failed` + : `Processing ${deploymentQuery.data?.completedCount || 0} of ${deploymentQuery.data?.totalCount || 0} tenants...`} + + + + {isComplete && successCount > 0 && ( + + Important: Client secrets are shown only once. Copy them now or export to + CSV before leaving this page. + + )} + + {results.length > 0 && ( + <> + + + + + + + + + + Tenant + App Name + Application (Client) ID + Directory (Tenant) ID + Client Secret + Status + + + + {results.map((result, index) => ( + + + + {result.displayName || result.tenantName} + + + + {result.appName || "-"} + + + {result.appId ? ( + + + {result.appId} + + + + ) : ( + "-" + )} + + + {result.tenantId ? ( + + + {result.tenantId} + + + + ) : ( + "-" + )} + + + + + + + ) : ( + + ) + } + label={result.status} + size="small" + color={result.status === "Success" ? "success" : "error"} + variant="outlined" + /> + {result.status === "Failed" && result.message && ( + + {result.message} + + )} + + + ))} + +
    +     + + )} +     + ); +}; + +export default CippDeploymentResults; diff --git a/frontend/src/components/CippComponents/CippDomainMigrationDialog.jsx b/frontend/src/components/CippComponents/CippDomainMigrationDialog.jsx new file mode 100644 index 0000000000..ae4493e7c5 --- /dev/null +++ b/frontend/src/components/CippComponents/CippDomainMigrationDialog.jsx @@ -0,0 +1,415 @@ +import { useState, useMemo, useCallback, useEffect } from "react"; +import { + Alert, + Box, + Button, + Checkbox, + Chip, + CircularProgress, + Dialog, + DialogActions, + DialogContent, + DialogTitle, + Divider, + FormControlLabel, + Stack, + Switch, + Table, + TableBody, + TableCell, + TableContainer, + TableHead, + TableRow, + Typography, + useMediaQuery, +} from "@mui/material"; +import { SwapHoriz } from "@mui/icons-material"; +import { ApiGetCall, ApiPostCall } from "../../api/ApiCall"; +import { CippApiResults } from "./CippApiResults"; +import { useSettings } from "../../hooks/use-settings"; +import CippFormComponent from "./CippFormComponent"; +import { useForm, useWatch } from "react-hook-form"; + +export const CippDomainMigrationDialog = ({ open, onClose, targetDomain }) => { + const [sourceDomain, setSourceDomain] = useState(null); + const [selectedUserIds, setSelectedUserIds] = useState(new Set()); + const [selectedGroupIds, setSelectedGroupIds] = useState(new Set()); + const [includeGroups, setIncludeGroups] = useState(false); + const fullScreen = useMediaQuery((theme) => theme.breakpoints.down("md")); + const userSettings = useSettings(); + const tenantFilter = userSettings.currentTenant; + const formControl = useForm({ mode: "onChange" }); + + const watchedSourceDomain = useWatch({ + control: formControl.control, + name: "sourceDomain", + }); + + useEffect(() => { + const newValue = watchedSourceDomain?.value || null; + if (newValue !== sourceDomain) { + setSourceDomain(newValue); + setSelectedUserIds(new Set()); + setSelectedGroupIds(new Set()); + } + }, [watchedSourceDomain]); + + const domainListQuery = ApiGetCall({ + url: "/api/ListGraphRequest", + data: { + Endpoint: "domains", + tenantFilter: tenantFilter, + }, + queryKey: `DomainMigration-Domains-${tenantFilter}`, + waiting: open, + }); + + const userListQuery = ApiGetCall({ + url: "/api/ListGraphRequest", + data: { + Endpoint: "users", + tenantFilter: tenantFilter, + $count: true, + $select: "id,displayName,userPrincipalName,mail,accountEnabled,proxyAddresses", + $filter: `endsWith(userPrincipalName,'@${sourceDomain}') or endsWith(mail,'@${sourceDomain}')`, + }, + queryKey: `DomainMigration-Users-${tenantFilter}-${sourceDomain}`, + waiting: !!sourceDomain, + }); + + const groupListQuery = ApiGetCall({ + url: "/api/ListGraphRequest", + data: { + Endpoint: "groups", + tenantFilter: tenantFilter, + $count: true, + $select: "id,displayName,mail,groupTypes,mailEnabled,securityEnabled", + $filter: `endsWith(mail,'@${sourceDomain}')`, + }, + queryKey: `DomainMigration-Groups-${tenantFilter}-${sourceDomain}`, + waiting: !!sourceDomain && includeGroups, + }); + + const migrationRequest = ApiPostCall({ + urlFromData: true, + relatedQueryKeys: ["ListUsers*"], + }); + + const availableDomains = useMemo(() => { + if (!domainListQuery.data?.Results) return []; + return domainListQuery.data.Results.filter( + (d) => d.isVerified && d.id !== targetDomain + ).map((d) => ({ label: d.id, value: d.id })); + }, [domainListQuery.data, targetDomain]); + + const users = useMemo(() => { + if (!userListQuery.data?.Results) return []; + return userListQuery.data.Results.filter( + (u) => + u.userPrincipalName && + !u.userPrincipalName.includes("#EXT#") && + (u.userPrincipalName.endsWith(`@${sourceDomain}`) || + u.mail?.endsWith(`@${sourceDomain}`)) + ); + }, [userListQuery.data, sourceDomain]); + + const groups = useMemo(() => { + if (!groupListQuery.data?.Results) return []; + return groupListQuery.data.Results.filter((g) => g.mail); + }, [groupListQuery.data]); + + const getGroupType = useCallback((group) => { + if (group.groupTypes?.includes("Unified")) return "Microsoft 365 Group"; + if (group.mailEnabled && group.securityEnabled) return "Mail-Enabled Security"; + if (group.mailEnabled) return "Distribution List"; + return "Security Group"; + }, []); + + const handleClose = () => { + setSourceDomain(null); + setSelectedUserIds(new Set()); + setSelectedGroupIds(new Set()); + setIncludeGroups(false); + formControl.reset(); + migrationRequest.reset(); + onClose(); + }; + + const toggleUser = (id) => { + setSelectedUserIds((prev) => { + const next = new Set(prev); + if (next.has(id)) next.delete(id); + else next.add(id); + return next; + }); + }; + + const toggleAllUsers = () => { + if (selectedUserIds.size === users.length) { + setSelectedUserIds(new Set()); + } else { + setSelectedUserIds(new Set(users.map((u) => u.id))); + } + }; + + const toggleGroup = (id) => { + setSelectedGroupIds((prev) => { + const next = new Set(prev); + if (next.has(id)) next.delete(id); + else next.add(id); + return next; + }); + }; + + const toggleAllGroups = () => { + if (selectedGroupIds.size === groups.length) { + setSelectedGroupIds(new Set()); + } else { + setSelectedGroupIds(new Set(groups.map((g) => g.id))); + } + }; + + const handleSubmit = () => { + const selectedUsers = users + .filter((u) => selectedUserIds.has(u.id)) + .map((u) => ({ + id: u.id, + userPrincipalName: u.userPrincipalName, + mail: u.mail, + displayName: u.displayName, + })); + + const selectedGroups = includeGroups + ? groups + .filter((g) => selectedGroupIds.has(g.id)) + .map((g) => ({ + id: g.id, + mail: g.mail, + displayName: g.displayName, + groupType: getGroupType(g), + })) + : []; + + migrationRequest.mutate({ + url: "/api/ExecDomainMigration", + data: { + tenantFilter, + sourceDomain, + targetDomain, + users: selectedUsers, + groups: selectedGroups, + }, + }); + }; + + const totalSelected = + selectedUserIds.size + (includeGroups ? selectedGroupIds.size : 0); + + return ( + + + + + Migrate to {targetDomain} + + + + + + This will change the primary email and sign-in for selected users/groups to @ + {targetDomain}. Existing email addresses will be kept as aliases to preserve mail + delivery. + + + + + {sourceDomain && ( + <> + + + + Users on @{sourceDomain} + + {userListQuery.isFetching && } + + + {users.length > 0 ? ( + + + + + + 0 && + selectedUserIds.size < users.length + } + checked={selectedUserIds.size === users.length} + onChange={toggleAllUsers} + /> + + Display Name + Current UPN + Primary Email + Status + + + + {users.map((user) => ( + toggleUser(user.id)} + sx={{ cursor: "pointer" }} + > + + + + {user.displayName} + {user.userPrincipalName} + {user.mail} + + + + + ))} + +
    +     + ) : ( + !userListQuery.isFetching && ( + No users found on @{sourceDomain} + ) + )} + + + { + setIncludeGroups(e.target.checked); + setSelectedGroupIds(new Set()); + }} + /> + } + label="Include groups (M365 Groups, Distribution Lists)" + /> + + {includeGroups && ( + <> + + + Groups on @{sourceDomain} + + {groupListQuery.isFetching && } + + + {groups.length > 0 ? ( + + + + + + 0 && + selectedGroupIds.size < groups.length + } + checked={selectedGroupIds.size === groups.length} + onChange={toggleAllGroups} + /> + + Group Name + Current Email + Type + + + + {groups.map((group) => ( + toggleGroup(group.id)} + sx={{ cursor: "pointer" }} + > + + + + {group.displayName} + {group.mail} + + + + + ))} + +
    +     + ) : ( + !groupListQuery.isFetching && ( + + No mail-enabled groups found on @{sourceDomain} + + ) + )} + + )} + + {totalSelected > 0 && ( + + {selectedUserIds.size} user{selectedUserIds.size !== 1 ? "s" : ""} + {includeGroups && selectedGroupIds.size > 0 + ? ` and ${selectedGroupIds.size} group${selectedGroupIds.size !== 1 ? "s" : ""}` + : ""}{" "} + will be migrated from @{sourceDomain} to @{targetDomain} + + )} + + + + )} +     +     + + {migrationRequest.isSuccess ? ( + + ) : ( + <> + + + + )} + +     + ); +}; diff --git a/frontend/src/components/CippComponents/CippDriftManagementActions.jsx b/frontend/src/components/CippComponents/CippDriftManagementActions.jsx index 41f202b9ad..4bf74d1f49 100644 --- a/frontend/src/components/CippComponents/CippDriftManagementActions.jsx +++ b/frontend/src/components/CippComponents/CippDriftManagementActions.jsx @@ -25,6 +25,7 @@ export const createDriftManagementActions = ({ label: 'Refresh Data', icon: , noConfirm: true, + category: 'manage', customFunction: onRefresh, }, ] @@ -35,6 +36,7 @@ export const createDriftManagementActions = ({ label: 'Generate Report', icon: , noConfirm: true, + category: 'manage', customFunction: onGenerateReport, }) } @@ -48,6 +50,7 @@ export const createDriftManagementActions = ({ pinned: true, icon: , color: 'info', + category: 'edit', noConfirm: true, customFunction: () => { // Use Next.js router for internal navigation @@ -58,8 +61,15 @@ export const createDriftManagementActions = ({ ) }) .catch(() => { - // Fallback to window.location if router is not available - window.location.href = `/tenant/standards/templates/template?id=${templateId}&type=${templateType}` + const id = String(templateId ?? "") + const type = String(templateType ?? "") + if (!/^[\w-]+$/.test(id) || !/^[\w-]+$/.test(type)) { + return + } + const url = new URL("/tenant/standards/templates/template", window.location.origin) + url.searchParams.set("id", id) + url.searchParams.set("type", type) + window.location.assign(`${url.pathname}${url.search}`) }) }, }) @@ -87,6 +97,20 @@ export const createDriftManagementActions = ({ confirmText: 'Are you sure you want to force a run of this standard?', allowResubmit: true, multiPost: false, + category: 'manage', + }) + actions.push({ + label: 'Run Standard Now (All Tenants in Template)', + type: 'GET', + url: '/api/ExecStandardsRun', + icon: , + data: { + TemplateId: templateId, + tenantFilter: 'allTenants', + }, + confirmText: 'Are you sure you want to force a run of this standard for every tenant in the template?', + multiPost: false, + category: 'manage', }) } diff --git a/frontend/src/components/CippComponents/CippDropzone.jsx b/frontend/src/components/CippComponents/CippDropzone.jsx index 451e047881..72a1e2a6b7 100644 --- a/frontend/src/components/CippComponents/CippDropzone.jsx +++ b/frontend/src/components/CippComponents/CippDropzone.jsx @@ -2,7 +2,7 @@ import PropTypes from "prop-types"; //import { CippContentCard } from 'src/components/layout' import { useDropzone } from "react-dropzone"; import { styled } from "@mui/material/styles"; -import { useSystemPrefersDark } from "../../hooks/use-system-prefers-dark"; +import { useMediaPredicate } from "react-media-hook"; //import { useSelector } from "react-redux"; //import { FontAwesomeIcon } from '@fortawesome/react-fontawesome' @@ -21,7 +21,9 @@ const getColor = (props) => { const BackgroundColor = () => { const currentTheme = useSelector((state) => state.app.currentTheme); - const preferredTheme = useSystemPrefersDark() ? "impact" : "cyberdrain"; + const preferredTheme = useMediaPredicate("(prefers-color-scheme: dark)") + ? "impact" + : "cyberdrain"; const isDark = currentTheme === "impact" || (currentTheme === "default" && preferredTheme === "impact"); diff --git a/frontend/src/components/CippComponents/CippExchangeActions.jsx b/frontend/src/components/CippComponents/CippExchangeActions.jsx index fe4511dca2..35efe7be04 100644 --- a/frontend/src/components/CippComponents/CippExchangeActions.jsx +++ b/frontend/src/components/CippComponents/CippExchangeActions.jsx @@ -1,7 +1,8 @@ -import { CippIcons } from "../../utils/icon-registry" +import { CippIcons } from "../../utils/icon-registry" import { useSettings } from "../../hooks/use-settings.js"; import { useMemo } from "react"; import { MfaVerifyForm } from "./CippMfaVerifyForm"; +import { CippSharedMailboxLicenseAlert } from "./CippSharedMailboxLicenseAlert"; export const CippExchangeActions = () => { const tenant = useSettings().currentTenant; @@ -25,8 +26,9 @@ export const CippExchangeActions = () => { ); return [ - { +{ label: "Bulk Add Mailbox Permissions", + category: "edit", type: "POST", url: "/api/ExecModifyMBPerms", icon: , @@ -126,20 +128,23 @@ export const CippExchangeActions = () => { }, color: "primary", }, - { +{ label: "Edit permissions", + category: "view", link: "/identity/administration/users/user/exchange?userId=[ExternalDirectoryObjectId]", color: "info", icon: , }, - { +{ label: "Research Compromised Account", + category: "view", link: "/identity/administration/bec/case?userId=[ExternalDirectoryObjectId]", color: "info", icon: , }, - { +{ label: "Send MFA Push", + category: "security", type: "POST", url: "/api/ExecSendPush", data: { @@ -149,8 +154,9 @@ export const CippExchangeActions = () => { confirmText: "Send an MFA request to [UPN]?", icon: , }, - { +{ label: "Convert Mailbox", + category: "edit", type: "POST", icon: , url: "/api/ExecConvertMailbox", @@ -168,13 +174,15 @@ export const CippExchangeActions = () => { ], validators: { required: "Please select a mailbox type" }, }, + { name: "sharedMailboxLicenseWarning", component: CippSharedMailboxLicenseAlert }, ], confirmText: "Pick the type of mailbox you want to convert [UPN] of mailbox type [recipientTypeDetails] to:", multiPost: false, }, - { +{ label: "Enable Online Archive", + category: "manage", type: "POST", icon: , url: "/api/ExecEnableArchive", @@ -183,8 +191,9 @@ export const CippExchangeActions = () => { multiPost: false, condition: (row) => row.ArchiveGuid === "00000000-0000-0000-0000-000000000000", }, - { +{ label: "Set Retention Policy", + category: "manage", type: "POST", url: "/api/ExecSetMailboxRetentionPolicies", icon: , @@ -227,8 +236,9 @@ export const CippExchangeActions = () => { }, color: "primary", }, - { +{ label: "Enable Auto-Expanding Archive", + category: "manage", type: "POST", icon: , url: "/api/ExecEnableAutoExpandingArchive", @@ -238,7 +248,7 @@ export const CippExchangeActions = () => { multiPost: false, condition: (row) => row.ArchiveGuid !== "00000000-0000-0000-0000-000000000000", }, - { +{ label: "Set Global Address List Visibility", type: "POST", url: "/api/ExecHideFromGAL", @@ -261,8 +271,9 @@ export const CippExchangeActions = () => { confirmText: "Are you sure you want to set the global address list state for [UPN]? Changes can take up to 72 hours to take effect.", }, - { +{ label: "Start Managed Folder Assistant", + category: "manage", type: "POST", url: "/api/ExecStartManagedFolderAssistant", icon: , @@ -272,8 +283,9 @@ export const CippExchangeActions = () => { }, confirmText: "Are you sure you want to start the managed folder assistant for [UPN]?", }, - { +{ label: "Delete Mailbox", + category: "danger", type: "POST", icon: , url: "/api/RemoveUser", @@ -281,8 +293,9 @@ export const CippExchangeActions = () => { confirmText: "Are you sure you want to delete [UPN]?", multiPost: false, }, - { +{ label: "Set Copy Sent Items for Delegated Mailboxes", + category: "manage", type: "POST", icon: , condition: (row) => @@ -303,8 +316,9 @@ export const CippExchangeActions = () => { ], confirmText: "Are you sure you want to set Copy Sent Items for [UPN]?", }, - { +{ label: "Set Litigation Hold", + category: "manage", type: "POST", url: "/api/ExecSetLitigationHold", data: { UPN: "UPN", Identity: "Id" }, @@ -325,8 +339,9 @@ export const CippExchangeActions = () => { }, ], }, - { +{ label: "Set Retention Hold", + category: "manage", type: "POST", url: "/api/ExecSetRetentionHold", data: { UPN: "UPN", Identity: "Id" }, @@ -340,8 +355,9 @@ export const CippExchangeActions = () => { }, ], }, - { +{ label: "Set Mailbox Locale", + category: "edit", type: "POST", url: "/api/ExecSetMailboxLocale", data: { user: "UPN", ProhibitSendQuota: true }, @@ -357,8 +373,9 @@ export const CippExchangeActions = () => { }, ], }, - { +{ label: "Set Max Send/Receive Size", + category: "edit", type: "POST", url: "/api/ExecSetMailboxEmailSize", data: { UPN: "UPN", id: "ExternalDirectoryObjectId" }, @@ -379,8 +396,9 @@ export const CippExchangeActions = () => { }, ], }, - { +{ label: "Set Send Quota", + category: "manage", type: "POST", url: "/api/ExecSetMailboxQuota", data: { user: "UPN", ProhibitSendQuota: true }, @@ -396,8 +414,9 @@ export const CippExchangeActions = () => { }, ], }, - { +{ label: "Set Send and Receive Quota", + category: "manage", type: "POST", url: "/api/ExecSetMailboxQuota", data: { @@ -416,8 +435,9 @@ export const CippExchangeActions = () => { }, ], }, - { +{ label: "Set Quota Warning Level", + category: "manage", type: "POST", url: "/api/ExecSetMailboxQuota", data: { user: "UPN", IssueWarningQuota: true }, @@ -433,8 +453,9 @@ export const CippExchangeActions = () => { }, ], }, - { +{ label: "Set Calendar Processing", + category: "edit", type: "POST", url: "/api/ExecSetCalendarProcessing", data: { UPN: "UPN" }, @@ -536,7 +557,7 @@ export const CippExchangeActions = () => { }, ], }, - ]; +]; }; export default CippExchangeActions; diff --git a/frontend/src/components/CippComponents/CippFolderNavigation.jsx b/frontend/src/components/CippComponents/CippFolderNavigation.jsx new file mode 100644 index 0000000000..5904a70b06 --- /dev/null +++ b/frontend/src/components/CippComponents/CippFolderNavigation.jsx @@ -0,0 +1,428 @@ +import { useState, useMemo } from "react"; +import { + Box, + Typography, + List, + ListItem, + ListItemIcon, + ListItemText, + ListItemButton, + Breadcrumbs, + Link, + Stack, + TextField, + InputAdornment, + IconButton, + Chip, + Slide, + Button, +} from "@mui/material"; +import { + Folder, + InsertDriveFile, + Search, + Clear, + NavigateNext, + Home, + Visibility, + SubdirectoryArrowLeft, +} from "@mui/icons-material"; +import { alpha, styled } from "@mui/material/styles"; + +const StyledListItem = styled(ListItemButton)(({ theme }) => ({ + borderRadius: theme.shape.borderRadius, + margin: theme.spacing(0.25, 0), + padding: theme.spacing(1, 2), + "&:hover": { + backgroundColor: alpha(theme.palette.primary.main, 0.08), + }, + "&.Mui-selected": { + backgroundColor: alpha(theme.palette.primary.main, 0.12), + "&:hover": { + backgroundColor: alpha(theme.palette.primary.main, 0.16), + }, + }, +})); + +const FileListItem = styled(Box)(({ theme }) => ({ + padding: theme.spacing(1, 2), + border: `1px solid ${theme.palette.divider}`, +})); + +const NavigationContainer = styled(Box)(({ theme }) => ({ + position: "relative", + overflow: "hidden", + height: "100%", + minHeight: 400, + backgroundColor: theme.palette.background.paper, + borderRadius: theme.shape.borderRadius, + border: `1px solid ${theme.palette.divider}`, + display: "flex", + flexDirection: "column", +})); + +const SlideView = styled(Box)(({ theme }) => ({ + position: "absolute", + top: 0, + left: 0, + right: 0, + bottom: 0, + backgroundColor: theme.palette.background.paper, + display: "flex", + flexDirection: "column", +})); + +export const CippFolderNavigation = ({ + data = [], + onFileSelect, + selectedFile = null, + searchable = true, + showFileInfo = true, + onImportFile, + onViewFile, + isImporting = false, +}) => { + const [currentPath, setCurrentPath] = useState([]); + const [searchTerm, setSearchTerm] = useState(""); + const [slideDirection, setSlideDirection] = useState("left"); + + // Build folder structure from flat file list + const folderStructure = useMemo(() => { + const structure = { folders: {}, files: [] }; + + data.forEach((file) => { + const pathParts = file.path.split("/"); + let current = structure; + + // Build folder hierarchy + for (let i = 0; i < pathParts.length - 1; i++) { + const folderName = pathParts[i]; + if (!current.folders[folderName]) { + current.folders[folderName] = { + folders: {}, + files: [], + name: folderName, + path: pathParts.slice(0, i + 1).join("/"), + }; + } + current = current.folders[folderName]; + } + + // Add file to the final folder + current.files.push({ + ...file, + name: pathParts[pathParts.length - 1], + }); + }); + + return structure; + }, [data]); + + // Get current folder based on currentPath + const getCurrentFolder = () => { + let current = folderStructure; + for (const pathPart of currentPath) { + current = current.folders[pathPart]; + if (!current) break; + } + return current || { folders: {}, files: [] }; + }; + + // Filter files based on search term (only when searching) + const getFilteredContent = () => { + if (!searchTerm) { + return getCurrentFolder(); + } + + // When searching, show all matching files across all folders + const allFiles = data.filter((file) => + file.path.toLowerCase().includes(searchTerm.toLowerCase()) + ); + + return { + folders: {}, + files: allFiles.map((file) => ({ + ...file, + name: file.path.split("/").pop(), + })), + }; + }; + + const currentFolder = getFilteredContent(); + + const navigateToFolder = (folderName) => { + setSlideDirection("left"); + setCurrentPath((prev) => [...prev, folderName]); + }; + + const navigateBack = () => { + if (currentPath.length > 0) { + setSlideDirection("right"); + setCurrentPath((prev) => prev.slice(0, -1)); + } + }; + + const navigateTo = (index) => { + if (index < currentPath.length) { + const direction = index < currentPath.length - 1 ? "right" : "left"; + setSlideDirection(direction); + setCurrentPath((prev) => prev.slice(0, index + 1)); + } else if (index === -1) { + setSlideDirection("right"); + setCurrentPath([]); + } + }; + + const handleFileClick = (file) => { + if (onFileSelect) { + onFileSelect(file); + } + }; + + const formatFileSize = (bytes) => { + if (bytes === 0) return "0 B"; + const k = 1024; + const sizes = ["B", "KB", "MB", "GB"]; + const i = Math.floor(Math.log(bytes) / Math.log(k)); + return `${parseFloat((bytes / Math.pow(k, i)).toFixed(1))} ${sizes[i]}`; + }; + + const getFileIcon = (fileName) => { + return ; + }; + + const clearSearch = () => { + setSearchTerm(""); + }; + + const folders = Object.values(currentFolder.folders || {}); + const files = currentFolder.files || []; + + return ( + + {searchable && ( + + setSearchTerm(e.target.value)} + InputProps={{ + startAdornment: ( + + + + ), + endAdornment: searchTerm && ( + + + + + + ), + }} + /> + + )} + + + + + {/* Header with navigation */} + + {searchTerm ? ( + Search Results ({files.length}) + ) : ( + } + sx={{ fontSize: "0.875rem" }} + > + navigateTo(-1)} + sx={{ + display: "flex", + alignItems: "center", + textDecoration: "none", + "&:hover": { textDecoration: "underline" }, + }} + > + + + {currentPath.map((folder, index) => ( + navigateTo(index)} + sx={{ + textDecoration: "none", + "&:hover": { textDecoration: "underline" }, + }} + > + {folder} + + ))} + + )} + + + {/* Content */} + + + {/* Show ".." folder for navigation back when not at root and not searching */} + {!searchTerm && currentPath.length > 0 && ( + + + + + + + + Parent folder + + + } + /> + + + )} + + {/* Show folders first (only when not searching) */} + {!searchTerm && + folders.map((folder) => ( + navigateToFolder(folder.name)}> + + + + + {folder.name} + {folder.files.length > 0 && ( + + )} + + } + /> + + + ))} + + {/* Show files */} + {files.map((file) => ( + + + {/* File Icon and Info */} + handleFileClick(file)} + > + + {getFileIcon(file.name)} + + + + {file.name} + + + {searchTerm && ( + <> + + {file.path.substring(0, file.path.lastIndexOf("/")) || "root"} + + + • + + + )} + {showFileInfo && ( + + {formatFileSize(file.size)} + + )} + + + + + {/* Action Buttons */} + + + + + + + ))} + + {/* Empty state */} + {folders.length === 0 && files.length === 0 && ( + + + {searchTerm + ? `No files found matching "${searchTerm}"` + : "This folder is empty"} + + + )} + + + + + + + {!searchTerm && data.length === 0 && ( + + + No files available + + + )} + + ); +}; diff --git a/frontend/src/components/CippComponents/CippFormCondition.jsx b/frontend/src/components/CippComponents/CippFormCondition.jsx index 54fb0b4966..6bb07dc790 100644 --- a/frontend/src/components/CippComponents/CippFormCondition.jsx +++ b/frontend/src/components/CippComponents/CippFormCondition.jsx @@ -92,8 +92,16 @@ export const CippFormCondition = (props) => { case "regex": return watcher?.match?.(new RegExp(compareValue)); case "is": + // Handle object values from autoComplete (extract .value property) + if (typeof watchedValue === "object" && watchedValue !== null && "value" in watchedValue) { + return isEqual(watchedValue.value, compareTargetValue); + } return isEqual(watchedValue, compareTargetValue); case "isNot": + // Handle object values from autoComplete (extract .value property) + if (typeof watchedValue === "object" && watchedValue !== null && "value" in watchedValue) { + return !isEqual(watchedValue.value, compareTargetValue); + } return !isEqual(watchedValue, compareTargetValue); case "contains": if (Array.isArray(watcher)) { @@ -200,7 +208,11 @@ export const CippFormCondition = (props) => { ); return false; } - return compareValue.some((value) => isEqual(watchedValue, value)); + // Handle object values from autoComplete (extract .value property) + const valueToCheckOneOf = typeof watchedValue === "object" && watchedValue !== null && "value" in watchedValue + ? watchedValue.value + : watchedValue; + return compareValue.some((value) => isEqual(valueToCheckOneOf, value)); case "isNotOneOf": // Check if the watched value is NOT one of the values in the compareValue array if (!Array.isArray(compareValue)) { @@ -209,7 +221,11 @@ export const CippFormCondition = (props) => { ); return false; } - return !compareValue.some((value) => isEqual(watchedValue, value)); + // Handle object values from autoComplete (extract .value property) + const valueToCheckNotOneOf = typeof watchedValue === "object" && watchedValue !== null && "value" in watchedValue + ? watchedValue.value + : watchedValue; + return !compareValue.some((value) => isEqual(valueToCheckNotOneOf, value)); default: return false; } diff --git a/frontend/src/components/CippComponents/CippFormLicenseSelector.jsx b/frontend/src/components/CippComponents/CippFormLicenseSelector.jsx index 1877b51503..c4e5c5a281 100644 --- a/frontend/src/components/CippComponents/CippFormLicenseSelector.jsx +++ b/frontend/src/components/CippComponents/CippFormLicenseSelector.jsx @@ -1,6 +1,6 @@ -import { CippFormComponent } from './CippFormComponent' -import { getCippLicenseTranslation } from '../../utils/get-cipp-license-translation' -import { useSettings } from '../../hooks/use-settings' +import { CippFormComponent } from "./CippFormComponent"; +import { getCippLicenseTranslation } from "../../utils/get-cipp-license-translation"; +import { useSettings } from "../../hooks/use-settings"; export const CippFormLicenseSelector = ({ formControl, @@ -12,7 +12,7 @@ export const CippFormLicenseSelector = ({ showRefresh = false, ...other }) => { - const userSettingsDefaults = useSettings() + const userSettingsDefaults = useSettings(); return ( - `${getCippLicenseTranslation([option])} (${option?.availableUnits} available)`, - valueField: 'skuId', + url: "/api/ListLicenses", + labelField: (option) => { + // Use License field from API response (already translated by backend) + // Fall back to static translation if License field is missing + const licenseName = option?.License || getCippLicenseTranslation([option])?.[0] || option?.skuPartNumber || "Unknown License"; + return `${licenseName} (${option?.availableUnits ?? 0} available)`; + }, + valueField: "skuId", queryKey: `ListLicenses-${userSettingsDefaults?.currentTenant ?? undefined}`, data: { - Endpoint: 'subscribedSkus', + Endpoint: "subscribedSkus", $count: true, IncludeExcluded: true, }, showRefresh, }} /> - ) -} + ); +}; diff --git a/frontend/src/components/CippComponents/CippFormTenantSelector.jsx b/frontend/src/components/CippComponents/CippFormTenantSelector.jsx index 4f39e48868..8d485307f5 100644 --- a/frontend/src/components/CippComponents/CippFormTenantSelector.jsx +++ b/frontend/src/components/CippComponents/CippFormTenantSelector.jsx @@ -16,9 +16,12 @@ export const CippFormTenantSelector = ({ preselectedEnabled = false, removeOptions = [], includeGroups = false, + includeTenantDefaults = false, + // Deprecated alias for includeTenantDefaults. includeOffboardingDefaults = false, ...other }) => { + const includeDefaults = includeTenantDefaults || includeOffboardingDefaults; const validators = () => { if (required) { return { @@ -28,6 +31,7 @@ export const CippFormTenantSelector = ({ return {}; }; const currentTenant = useSettings()?.currentTenant; + const selectedValue = formControl?.watch(name); // Build the API URL with query parameters to support tenant specific offboarding config const buildApiUrl = () => { @@ -38,8 +42,8 @@ export const CippFormTenantSelector = ({ params.append("AllTenantSelector", "true"); } - if (includeOffboardingDefaults) { - params.append("IncludeOffboardingDefaults", "true"); + if (includeDefaults) { + params.append("IncludeTenantDefaults", "true"); } return params.toString() @@ -51,8 +55,8 @@ export const CippFormTenantSelector = ({ const tenantList = ApiGetCall({ url: buildApiUrl(), queryKey: allTenants - ? `ListTenants-FormAllTenantSelector${includeOffboardingDefaults ? "-WithOffboarding" : ""}` - : `ListTenants-FormnotAllTenants${includeOffboardingDefaults ? "-WithOffboarding" : ""}`, + ? `ListTenants-FormAllTenantSelector${includeDefaults ? "-WithDefaults" : ""}` + : `ListTenants-FormnotAllTenants${includeDefaults ? "-WithDefaults" : ""}`, }); // Fetch tenant group list if includeGroups is true @@ -76,8 +80,9 @@ export const CippFormTenantSelector = ({ defaultDomainName: tenant.defaultDomainName, displayName: tenant.displayName, customerId: tenant.customerId, - ...(includeOffboardingDefaults && { + ...(includeDefaults && { offboardingDefaults: tenant.offboardingDefaults, + vacationDefaults: tenant.vacationDefaults, }), }, })) @@ -94,14 +99,14 @@ export const CippFormTenantSelector = ({ setOptions([...tenantData, ...groupData]); } - }, [tenantList.isSuccess, tenantGroupList.isSuccess, includeGroups, includeOffboardingDefaults]); + }, [tenantList.isSuccess, tenantGroupList.isSuccess, includeGroups, includeDefaults]); return ( option.type} renderGroup={(params) => (
  • diff --git a/frontend/src/components/CippComponents/CippForwardingSection.jsx b/frontend/src/components/CippComponents/CippForwardingSection.jsx index 24a18345dd..56ce97893d 100644 --- a/frontend/src/components/CippComponents/CippForwardingSection.jsx +++ b/frontend/src/components/CippComponents/CippForwardingSection.jsx @@ -5,19 +5,27 @@ import { Grid } from "@mui/system"; import { CippApiResults } from "./CippApiResults"; import { getCippValidator } from "../../utils/get-cipp-validator"; -const CippForwardingSection = ({ formControl, usersList, contactsList, postRequest, handleSubmit }) => { +const getGroupTypeLabel = (group) => { + if (group.groupTypes?.includes("Unified")) return "M365 Group"; + if (group.securityEnabled) return "Mail-enabled Security Group"; + return "Distribution List"; +}; + +const CippForwardingSection = ({ formControl, usersList, contactsList, groupsList, postRequest, handleSubmit }) => { const internalAddressOptions = [ - // Add users ...(usersList?.data?.Results?.map((user) => ({ value: user.userPrincipalName, label: `${user.displayName} (${user.userPrincipalName}) - User`, })) || []), - // Add contacts ...(contactsList?.data?.Results?.map((contact) => ({ value: contact.mail || contact.emailAddress, label: `${contact.displayName} (${contact.mail || contact.emailAddress}) - Contact`, - })) || []) + })) || []), + ...(groupsList?.data?.Results?.filter((group) => group.mail)?.map((group) => ({ + value: group.mail, + label: `${group.displayName} (${group.mail}) - ${getGroupTypeLabel(group)}`, + })) || []), ]; return ( @@ -44,7 +52,7 @@ const CippForwardingSection = ({ formControl, usersList, contactsList, postReque > [ - { +{ label: "View Relationship", + category: "view", link: "/tenant/gdap-management/relationships/relationship?id=[id]", pinned: true, color: "primary", icon: , }, - { +{ label: "Start Onboarding", + category: "manage", link: "/tenant/gdap-management/onboarding/start?id=[id]", color: "primary", icon: , showInActionsMenu: true, }, - { +{ label: "Open Relationship in Partner Center", + category: "view", link: "https://partner.microsoft.com/en-us/dashboard/commerce2/customers/[customer.tenantId]/adminrelationships/[id]", color: "info", icon: , showInActionsMenu: true, }, - { +{ label: "Enable automatic extension", + category: "manage", type: "POST", url: "/api/ExecAutoExtendGDAP", data: { ID: "id" }, @@ -33,8 +37,9 @@ export const CippGdapActions = () => [ color: "info", icon: , }, - { +{ label: "Remove Global Administrator from Relationship", + category: "danger", type: "POST", url: "/api/ExecGDAPRemoveGArole", data: { GDAPID: "id" }, @@ -42,8 +47,9 @@ export const CippGdapActions = () => [ color: "danger", icon: , }, - { +{ label: "Reset Role Mapping", + category: "manage", type: "POST", url: "/api/ExecGDAPAccessAssignment", icon: , @@ -93,8 +99,9 @@ export const CippGdapActions = () => [ ), }, - { +{ label: "Terminate Relationship", + category: "danger", type: "POST", url: "/api/ExecDeleteGDAPRelationship", data: { GDAPID: "id" }, diff --git a/frontend/src/components/CippComponents/CippGuestInviteDialog.jsx b/frontend/src/components/CippComponents/CippGuestInviteDialog.jsx new file mode 100644 index 0000000000..dfea9daa26 --- /dev/null +++ b/frontend/src/components/CippComponents/CippGuestInviteDialog.jsx @@ -0,0 +1,1046 @@ +import { + Alert, + Box, + Button, + Chip, + CircularProgress, + Collapse, + Dialog, + DialogActions, + DialogContent, + DialogTitle, + Divider, + Stack, + Typography, +} from "@mui/material"; +import { alpha, useTheme } from "@mui/material/styles"; +import { + Send, + OpenInNew, + ErrorOutline, + CheckCircle, + Search, + WarningAmber, + PersonAdd, +} from "@mui/icons-material"; +import { useForm } from "react-hook-form"; +import { useEffect, useState, useCallback } from "react"; +import { ApiPostCall } from "../../api/ApiCall"; +import CippFormComponent from "./CippFormComponent"; +import CippAccessTypeGuide from "./CippAccessTypeGuide"; +import Link from "next/link"; +import axios from "axios"; +import { buildVersionedHeaders } from "../../utils/cippVersion"; + +/** + * Detects whether an error message is a domain collaboration restriction. + */ +const isDomainCollaborationError = (messages) => { + if (!messages || !Array.isArray(messages)) return false; + return messages.some( + (msg) => + typeof msg === "string" && + (msg.toLowerCase().includes("does not allow collaboration") || + msg.toLowerCase().includes("collaboration with the domain")) + ); +}; + +/** + * Client-side diagnostic engine. Fetches External Collaboration settings and + * context-specific settings (SharePoint sharing or Teams guest access), then + * analyzes them against the blocked domain. + * @param {"sharepoint"|"teams"} context - Which resource type we're inviting to + */ +const runClientDiagnostics = async (tenantFilter, domain, context = "sharepoint") => { + const findings = []; + const headers = await buildVersionedHeaders(); + + // --- Fetch Entra External Collaboration settings --- + try { + const collabResp = await axios.get("/api/ListExternalCollaboration", { + params: { tenantFilter }, + headers, + }); + const collab = collabResp.data?.Results; + + if (collab) { + // Check if invitations are completely disabled + if (collab.allowInvitesFrom === "none") { + findings.push({ + source: "Entra External Collaboration", + issue: "Guest invitations are completely disabled", + detail: + "The 'Guest invite restrictions' setting is set to 'No one in the organization can invite guest users including admins'. All guest invitations are blocked regardless of domain.", + fix: "Change the guest invite restrictions to allow at least admins and users in the Guest Inviter role to send invitations.", + settingsPage: "/tenant/administration/cross-tenant-access/external-collaboration", + severity: "error", + }); + } + + // Check domain allow/block lists + const domainPolicy = + collab.domainRestrictions?.InvitationsAllowedAndBlockedDomainsPolicy; + + if (domainPolicy) { + const allowed = domainPolicy.AllowedDomains || []; + const blocked = domainPolicy.BlockedDomains || []; + + if (allowed.length > 0 && !allowed.includes(domain)) { + findings.push({ + source: "Entra External Collaboration", + issue: `Domain '${domain}' is not in the allowed domains list`, + detail: `The tenant uses a domain allow-list for guest invitations. Only users from these domains can be invited. The domain '${domain}' is not on this list.`, + fix: `Add '${domain}' to the allowed domains list in External Collaboration settings, or switch to a block-list approach.`, + settingsPage: "/tenant/administration/cross-tenant-access/external-collaboration", + severity: "error", + currentList: allowed, + listType: "allowList", + canQuickFix: true, + }); + } + + if (blocked.length > 0 && blocked.includes(domain)) { + findings.push({ + source: "Entra External Collaboration", + issue: `Domain '${domain}' is explicitly blocked`, + detail: `The domain '${domain}' appears in the blocked domains list for guest invitations. Users from this domain cannot be invited.`, + fix: `Remove '${domain}' from the blocked domains list in External Collaboration settings.`, + settingsPage: "/tenant/administration/cross-tenant-access/external-collaboration", + severity: "error", + currentList: blocked, + listType: "blockList", + canQuickFix: true, + }); + } + + // Policy exists but empty lists — restriction is somewhere else + if (allowed.length === 0 && blocked.length === 0) { + findings.push({ + source: "Entra External Collaboration", + issue: "No domain restrictions found in B2B Management Policy", + detail: + "The B2B Management Policy exists but has no domain allow-list or block-list configured. The restriction blocking this invitation may be configured directly in the Azure portal under External Identities > External collaboration settings > Collaboration restrictions, or through a Conditional Access policy.", + fix: `Open External Collaboration settings and set up an allow-list that includes '${domain}', or check the Azure portal directly.`, + settingsPage: "/tenant/administration/cross-tenant-access/external-collaboration", + severity: "error", + canQuickFix: true, + }); + } + } else { + // No B2B Management Policy found — the domain restriction is configured + // through the Azure portal or another mechanism that the Graph legacy + // policies API doesn't expose. This is the most common scenario when + // restrictions were set up via the Azure portal UI. + findings.push({ + source: "Entra External Collaboration", + issue: `Domain '${domain}' is blocked by a collaboration restriction`, + detail: + "This tenant has a domain collaboration restriction that is blocking this invitation. The restriction was likely configured in the Azure portal (External Identities > External collaboration settings > Collaboration restrictions) and is not currently managed through Manage365. You can take over management of this setting in Manage365 by configuring the domain restrictions below.", + fix: `Open External Collaboration settings and configure a domain allow-list that includes '${domain}'. This will create the policy through the Graph API so Manage365 can manage it going forward.`, + settingsPage: "/tenant/administration/cross-tenant-access/external-collaboration", + severity: "error", + canQuickFix: true, + }); + } + } + } catch { + // External Collaboration endpoint not available + findings.push({ + source: "Entra External Collaboration", + issue: "Could not retrieve External Collaboration settings", + detail: + "The External Collaboration settings API returned an error. Check permissions or try viewing the settings page directly.", + fix: "Open External Collaboration settings to review domain restrictions manually.", + settingsPage: "/tenant/administration/cross-tenant-access/external-collaboration", + severity: "warning", + }); + } + + if (context === "teams") { + // --- Fetch Teams guest access settings --- + try { + const teamsResp = await axios.get("/api/ListTeamsSettings", { + params: { tenantFilter }, + headers, + }); + const teamsData = teamsResp.data; + + if (teamsData && teamsData.allowGuestUser === false) { + findings.push({ + source: "Teams Guest Access", + issue: "Guest access is disabled for Microsoft Teams", + detail: + "The Teams tenant setting 'Allow guest access' is currently disabled. Guests cannot be added to any teams until this is enabled.", + fix: "Enable guest access in Teams Settings > Guest & Cloud Storage, or use the Manage365 Teams Settings page.", + settingsPage: "/teams-share/teams/teams-settings", + severity: "error", + }); + } + } catch { + // Teams settings not available - non-critical + } + } else { + // --- Fetch SharePoint Sharing settings --- + try { + const spResp = await axios.get("/api/ListSharepointSettings", { + params: { tenantFilter }, + headers, + }); + const spData = Array.isArray(spResp.data) ? spResp.data[0] : spResp.data; + + if (spData) { + if (spData.sharingCapability === "disabled") { + findings.push({ + source: "SharePoint Sharing Settings", + issue: "External sharing is completely disabled for SharePoint", + detail: + "SharePoint external sharing is set to 'Only people in your organization'. Even if the guest is invited to the tenant, they cannot access SharePoint content.", + fix: "Enable external sharing in SharePoint Sharing Settings. At minimum, set it to 'Existing guests' or 'New and existing guests'.", + settingsPage: "/teams-share/sharepoint/sharing-settings", + severity: "warning", + }); + } + + if (spData.sharingDomainRestrictionMode === "allowList") { + const spAllowed = spData.sharingAllowedDomainList || []; + if (spAllowed.length > 0 && !spAllowed.includes(domain)) { + findings.push({ + source: "SharePoint Sharing Settings", + issue: `Domain '${domain}' is not in the SharePoint allowed domains list`, + detail: `SharePoint uses a separate domain allow-list for external sharing. The domain '${domain}' is not on this list, so even if the guest is invited to the tenant, they won't be able to access SharePoint content.`, + fix: `Add '${domain}' to the SharePoint sharing allowed domains list.`, + settingsPage: "/teams-share/sharepoint/sharing-settings", + severity: "warning", + currentList: spAllowed, + listType: "allowList", + }); + } + } else if (spData.sharingDomainRestrictionMode === "blockList") { + const spBlocked = spData.sharingBlockedDomainList || []; + if (spBlocked.length > 0 && spBlocked.includes(domain)) { + findings.push({ + source: "SharePoint Sharing Settings", + issue: `Domain '${domain}' is blocked in SharePoint sharing settings`, + detail: `The domain '${domain}' appears in the SharePoint blocked domains list.`, + fix: `Remove '${domain}' from the SharePoint sharing blocked domains list.`, + settingsPage: "/teams-share/sharepoint/sharing-settings", + severity: "warning", + currentList: spBlocked, + listType: "blockList", + }); + } + } + } + } catch { + // SharePoint settings not available - non-critical + } + } + + return findings; +}; + +const CippGuestInviteDialog = ({ + open, + onClose, + tenantFilter, + groupId, + webUrl, + sharePointType, + teamId, + teamName, + relatedQueryKeys = [], +}) => { + const theme = useTheme(); + const [diagnostics, setDiagnostics] = useState(null); + const [blockedDomain, setBlockedDomain] = useState(null); + const [resultMessages, setResultMessages] = useState([]); + const [status, setStatus] = useState("idle"); // idle | loading | success | error + const [diagLoading, setDiagLoading] = useState(false); + const [quickFixStatus, setQuickFixStatus] = useState("idle"); // idle | loading | success | error + const [quickFixMessage, setQuickFixMessage] = useState(""); + const [quickFixAttempted, setQuickFixAttempted] = useState(false); + const [nonGroupSiteWarning, setNonGroupSiteWarning] = useState(false); + const [teamsAddWarning, setTeamsAddWarning] = useState(false); + const [preflightResult, setPreflightResult] = useState(null); + const [preflightLoading, setPreflightLoading] = useState(false); + + const isTeamsMode = Boolean(teamId); + const diagContext = isTeamsMode ? "teams" : "sharepoint"; + const isNonGroupSite = !isTeamsMode && sharePointType && !sharePointType.includes("Group"); + + const formHook = useForm({ + defaultValues: { + displayName: "", + mail: "", + redirectUri: "", + sendInvite: true, + }, + mode: "onChange", + }); + + const inviteApi = ApiPostCall({ + relatedQueryKeys, + }); + + const resetForNewGuest = useCallback(() => { + setDiagnostics(null); + setBlockedDomain(null); + setResultMessages([]); + setStatus("idle"); + setDiagLoading(false); + setQuickFixStatus("idle"); + setQuickFixMessage(""); + setNonGroupSiteWarning(false); + setTeamsAddWarning(false); + setPreflightResult(null); + setPreflightLoading(false); + formHook.reset({ + displayName: "", + mail: "", + redirectUri: "", + sendInvite: true, + }); + }, [formHook]); + + const runPreflight = useCallback( + async (email) => { + if (!email || !email.includes("@") || !tenantFilter) return; + setPreflightLoading(true); + setPreflightResult(null); + try { + const headers = await buildVersionedHeaders(); + const resp = await axios.post("/api/ExecValidateExternalDomain", { + email, + tenantFilter, + context: isTeamsMode ? "teams-standard" : "sharepoint", + }, { headers }); + setPreflightResult(resp.data?.Results); + } catch { + // Pre-flight is best-effort + } finally { + setPreflightLoading(false); + } + }, + [tenantFilter, isTeamsMode] + ); + + const watchedEmail = formHook.watch("mail"); + useEffect(() => { + if (!watchedEmail || !watchedEmail.includes("@") || !/^[^@]+@[^@]+\.[^@]+$/.test(watchedEmail)) { + setPreflightResult(null); + return; + } + const timer = setTimeout(() => { + runPreflight(watchedEmail); + }, 800); + return () => clearTimeout(timer); + }, [watchedEmail, runPreflight]); + + // Reset state when dialog opens/closes + useEffect(() => { + if (open) { + setQuickFixAttempted(false); + resetForNewGuest(); + } + }, [open]); + + const runDiagnostics = useCallback( + async (errorMessages, email, fixWasAttempted) => { + const domain = email?.split("@")[1]; + if (!domain || !isDomainCollaborationError(errorMessages)) return; + + setBlockedDomain(domain); + setDiagLoading(true); + + const contextLabel = isTeamsMode ? "Teams Settings" : "SharePoint Sharing settings"; + + try { + if (fixWasAttempted) { + setDiagnostics([ + { + source: "Microsoft Entra Admin Center", + issue: `Domain '${domain}' is blocked by an Azure-managed restriction`, + detail: + "The domain allow-list was updated through the Graph API, but the invitation is still blocked. This means the collaboration restriction for this tenant is managed directly by Azure and cannot be modified through the Graph API. You need to change it in the Microsoft Entra admin center.", + fix: `In the Entra admin center, go to External Identities > External collaboration settings > Collaboration restrictions. Change the setting to either 'Allow invitations to any domain' or add '${domain}' to the allowed domains list.`, + severity: "error", + entraPortalLink: true, + }, + ]); + } else { + const findings = await runClientDiagnostics(tenantFilter, domain, diagContext); + const actionable = findings.filter((f) => f.severity !== "info"); + setDiagnostics(actionable.length > 0 ? actionable : findings); + } + } catch { + setDiagnostics([ + { + source: "Diagnostic Engine", + issue: "Diagnostics failed", + detail: "Could not retrieve tenant settings to diagnose the issue.", + fix: `Check External Collaboration settings and ${contextLabel} manually.`, + settingsPage: "/tenant/administration/cross-tenant-access/external-collaboration", + severity: "warning", + }, + ]); + } finally { + setDiagLoading(false); + } + }, + [tenantFilter, isTeamsMode, diagContext] + ); + + /** + * Quick-fix: adds the blocked domain to the External Collaboration allow-list + * (or removes it from the block-list), then retries the invitation. + */ + const handleQuickFix = useCallback(async () => { + if (!blockedDomain) return; + + setQuickFixStatus("loading"); + setQuickFixMessage(""); + + try { + const headers = await buildVersionedHeaders(); + + // First, read the current External Collaboration settings + const collabResp = await axios.get("/api/ListExternalCollaboration", { + params: { tenantFilter }, + headers, + }); + const collab = collabResp.data?.Results; + const domainPolicy = + collab?.domainRestrictions?.InvitationsAllowedAndBlockedDomainsPolicy; + + // Determine the fix action + let allowedDomains = domainPolicy?.AllowedDomains || []; + let blockedDomains = domainPolicy?.BlockedDomains || []; + + if (blockedDomains.includes(blockedDomain)) { + // Remove from block list + blockedDomains = blockedDomains.filter((d) => d !== blockedDomain); + } else if (allowedDomains.length > 0 && !allowedDomains.includes(blockedDomain)) { + // Add to existing allow list + allowedDomains = [...allowedDomains, blockedDomain]; + } else { + // No existing lists — create an allow-list with this domain + // We also need common domains, so let's just add this one and let + // the admin review further + allowedDomains = [blockedDomain]; + } + + // Apply the fix + await axios.post( + "/api/EditExternalCollaboration", + { + tenantFilter, + domainRestrictions: { + InvitationsAllowedAndBlockedDomainsPolicy: { + AllowedDomains: allowedDomains, + BlockedDomains: blockedDomains, + }, + }, + }, + { headers } + ); + + setQuickFixStatus("success"); + setQuickFixAttempted(true); + setQuickFixMessage( + `Added '${blockedDomain}' to the allowed domains list. You can now retry the invitation.` + ); + + // Clear the error state so the user can retry + setDiagnostics(null); + setResultMessages([]); + setStatus("idle"); + } catch (err) { + setQuickFixStatus("error"); + const errMsg = + err?.response?.data?.Results || + err?.message || + "Failed to update domain restrictions."; + setQuickFixMessage( + typeof errMsg === "string" ? errMsg : Array.isArray(errMsg) ? errMsg.join(" ") : String(errMsg) + ); + } + }, [blockedDomain, tenantFilter]); + + const onSubmit = (data) => { + setStatus("loading"); + setDiagnostics(null); + setBlockedDomain(null); + setResultMessages([]); + setDiagLoading(false); + setTeamsAddWarning(false); + + const payload = isTeamsMode + ? { tenantFilter, TeamID: teamId, ...data } + : { tenantFilter, groupId, URL: webUrl, SharePointType: sharePointType, ...data }; + + inviteApi.mutate( + { + url: "/api/ExecSharePointInviteGuest", + data: payload, + }, + { + onSuccess: (response) => { + const results = response?.data?.Results || []; + setResultMessages(results); + setStatus("success"); + if (response?.data?.NonGroupSiteWarning) { + setNonGroupSiteWarning(true); + } + if (response?.data?.TeamsAddWarning) { + setTeamsAddWarning(true); + } + }, + onError: (error) => { + const responseData = error?.response?.data; + const results = responseData?.Results || [ + error?.message || "An unexpected error occurred.", + ]; + setResultMessages(results); + setStatus("error"); + + // Check if backend provided specific diagnostics (not fallback) + const backendDiags = responseData?.Diagnostics; + const hasRealDiag = + backendDiags?.length > 0 && + !backendDiags.every((d) => d.source === "Unknown Policy"); + + if (hasRealDiag && !quickFixAttempted) { + setDiagnostics(backendDiags); + setBlockedDomain(responseData?.BlockedDomain); + } else { + // Run client-side diagnostics - more reliable since it uses + // the same API endpoints as the settings pages + runDiagnostics(results, data.mail, quickFixAttempted); + } + }, + } + ); + }; + + const handleClose = () => { + onClose(); + }; + + const fields = [ + { + type: "textField", + name: "displayName", + label: "Display Name", + placeholder: "Guest user's display name", + validators: { required: "Display name is required" }, + }, + { + type: "textField", + name: "mail", + label: "Email Address", + placeholder: "guest@externaldomain.com", + validators: { + required: "Email address is required", + pattern: { + value: /^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}$/i, + message: "Please enter a valid email address", + }, + }, + }, + { + type: "textField", + name: "redirectUri", + label: "Redirect URL (Optional)", + placeholder: "https://myapps.microsoft.com", + }, + { + type: "switch", + name: "sendInvite", + label: "Send email invitation to guest", + }, + ]; + + const hasDiagnostics = diagnostics && diagnostics.length > 0; + + return ( + + + + + + Invite External Guest + + + + + + {isTeamsMode + ? `Invite an external guest user to this Team${teamName ? ` (${teamName})` : ""}. The guest will be invited to the tenant and automatically added as a team member.` + : "Invite an external guest user to this SharePoint site. The guest will be invited to the tenant and automatically added as a site member."} + + + + + {/* Form Fields */} + + + + {fields.map((fieldProps, i) => ( + + + + ))} + + {preflightLoading && ( + + + + Validating domain... + + + )} + {preflightResult && !preflightLoading && ( + + {preflightResult.domainType === "consumer" && ( + + + {preflightResult.domain} is a personal email domain. The user will authenticate via Email One-Time Passcode (OTP). + + + )} + {preflightResult.existingGuest && ( + + + This user already exists as a guest: {preflightResult.existingGuest.displayName} ({preflightResult.existingGuest.externalUserState || "Active"}) + + + )} + {preflightResult.policyChecks?.filter((c) => c.status === "fail").map((check, i) => ( + + + {check.source}: {check.detail} + {check.fix && <> — {check.fix}} + + + ))} + {preflightResult.policyChecks?.filter((c) => c.status === "warning").map((check, i) => ( + + + {check.source}: {check.detail} + + + ))} + {preflightResult.canProceed === false && ( + + + This invitation will likely fail due to the policy issues above. Fix them first or use the Sharing Troubleshooter for more details. + + + )} + + )} + + + + {/* Loading State */} + + + + + + Inviting guest... + + + + + + {/* Success State */} + + + + {resultMessages.map((msg, i) => { + const isGraphFallback = + typeof msg === "string" && msg.includes("Graph API fallback"); + const isWarning = + typeof msg === "string" && + !isGraphFallback && + (msg.includes("could not add") || msg.includes("not available for automatic")); + const isSharePointAccessError = + typeof msg === "string" && + !isGraphFallback && + (msg.includes("Failed to obtain a SharePoint token") || msg.includes("SharePoint denied access")); + return ( + : isWarning ? : } + > + {isSharePointAccessError ? ( + + + Guest invited to tenant, but could not add to site members. + + {msg} + + Suggested steps: + + +
      +
    1. + Run a CPV Refresh for this tenant from the tenant + overview page +
      2. +
    2. + Verify the site does not have restricted or unique permissions in + SharePoint +
      3. +
    3. + If the issue persists, check that the Manage365 SAM app has the necessary + SharePoint delegated permissions +
      4. +
    +     +     + ) : isGraphFallback ? ( + + + Guest added via fallback method + + + The SharePoint REST API denied access, so document library access was granted + via the Graph API instead. The guest can access the site's document + library, but may not have full site membership. Consider running a{" "} + CPV Refresh to resolve the underlying permission issue. + + + ) : ( + {msg} + )} +     + ); + })} + {teamsAddWarning && ( + + + The guest was invited to the tenant but could not be added to the Team + automatically. You can add them manually using the Add Member{" "} + button in the Members section. + + + )} + {nonGroupSiteWarning && !resultMessages.some((m) => typeof m === "string" && (m.includes("Failed to obtain a SharePoint token") || m.includes("SharePoint denied access"))) && webUrl && ( + + + This is a non-group-connected site, so automatic membership assignment was not + possible. You can add the guest manually using the Add Member{" "} + button in the Site Members table, or assign permissions directly in SharePoint. + + + + )} + {!nonGroupSiteWarning && !teamsAddWarning && ( + + + {isTeamsMode + ? "It may take a minute or two for the guest to appear in the Members list while Teams syncs the membership." + : "It may take a minute or two for the guest to appear in the Site Members table while SharePoint syncs the membership."} + + + )} +     +     +     + + {/* Error State */} + + + + {/* Error messages */} + {resultMessages.map((msg, i) => ( + }> + {msg} + + ))} + + {/* Diagnostics Loading */} + {diagLoading && ( + + + + + Analyzing tenant settings to identify the cause... + + + + )} + + {/* Diagnostics Panel */} + {hasDiagnostics && !diagLoading && ( + + {/* Diagnostics Header */} + + + + + Root Cause Analysis + + {blockedDomain && ( + + )} + + + {(() => { + const errorCount = diagnostics.filter( + (d) => d.severity === "error" + ).length; + const warnCount = diagnostics.filter( + (d) => d.severity === "warning" + ).length; + if (errorCount > 0) + return `${errorCount} policy ${errorCount === 1 ? "restriction" : "restrictions"} identified that ${errorCount === 1 ? "is" : "are"} blocking this invitation:`; + if (warnCount > 0) + return `${warnCount} potential ${warnCount === 1 ? "issue" : "issues"} found — review the settings below:`; + return "Review the following settings:"; + })()} + + + + {/* Individual Diagnostics */} + }> + {diagnostics.map((diag, idx) => ( + + + + {diag.severity === "error" ? ( + + ) : ( + + )} + + + + {diag.issue} + + + + Source: {diag.source} + + + + {diag.detail} + + + {diag.currentList && diag.currentList.length > 0 && ( + + + Current{" "} + {diag.listType === "allowList" ? "allowed" : "blocked"}{" "} + domains: + + + {diag.currentList.map((domain, di) => ( + + ))} + + + )} + + + + How to fix: {diag.fix} + + + + + {diag.entraPortalLink && ( + + )} + {diag.canQuickFix && blockedDomain && !quickFixAttempted && ( + + )} + {diag.settingsPage && ( + + )} + + + + + ))} + + + )} + + {/* Quick-fix result */} + {quickFixStatus === "success" && quickFixMessage && ( + }> + {quickFixMessage} + + )} + {quickFixStatus === "error" && quickFixMessage && ( + }> + {quickFixMessage} + + )} + + + + + + + {(status === "idle" || status === "loading") && ( + + )} + {status === "success" && ( + + )} + {status === "error" && ( + + )} + + +     + ); +}; + +export default CippGuestInviteDialog; diff --git a/frontend/src/components/CippComponents/CippHVEUserDrawer.jsx b/frontend/src/components/CippComponents/CippHVEUserDrawer.jsx index 6a6b0fd863..d5ca7215e1 100644 --- a/frontend/src/components/CippComponents/CippHVEUserDrawer.jsx +++ b/frontend/src/components/CippComponents/CippHVEUserDrawer.jsx @@ -98,8 +98,7 @@ export const CippHVEUserDrawer = ({ HVE SMTP Configuration Settings:
  • - Server: smtp.hve.mx.microsoft (recommended) or - smtp-hve.office365.com (deprecated) + Server: smtp-hve.office365.com
  • Port: 587 @@ -110,12 +109,9 @@ export const CippHVEUserDrawer = ({
  • TLS Support: TLS 1.2 and TLS 1.3
    • -
  • - Authentication: HVE account credentials or OAuth token -
    • - Use these settings to configure your application or device for HVE access. + Use these settings to configure your email client for HVE access.     diff --git a/frontend/src/components/CippComponents/CippIntuneDeviceActions.jsx b/frontend/src/components/CippComponents/CippIntuneDeviceActions.jsx index d6be362c30..5425cb30ad 100644 --- a/frontend/src/components/CippComponents/CippIntuneDeviceActions.jsx +++ b/frontend/src/components/CippComponents/CippIntuneDeviceActions.jsx @@ -6,16 +6,18 @@ import { CippIcons } from '../../utils/icon-registry' // filtered out of the detail page's ActionsMenu (see components/actions-menu.js), // so a single array is safe to reuse as-is. export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ - { +{ label: 'View Device', + category: "view", link: `/endpoint/MEM/devices/device?deviceId=[id]`, pinned: true, color: 'info', icon: , multiPost: false, }, - { +{ label: 'View in Intune', + category: "view", link: `https://intune.microsoft.com/${tenantFilter}/#view/Microsoft_Intune_Devices/DeviceSettingsMenuBlade/~/overview/mdmDeviceId/[id]`, pinned: true, color: 'info', @@ -24,8 +26,19 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ multiPost: false, external: true, }, + { + label: 'View in Entra', + link: `https://entra.microsoft.com/${tenantFilter}/#view/Microsoft_AAD_Devices/DeviceDetailsMenuBlade/~/Properties/objectId/[azureADDeviceId]/deviceId/`, + color: 'info', + icon: , + target: '_blank', + multiPost: false, + external: true, + category: 'view', + }, { label: 'Change Primary User', + category: "edit", type: 'POST', icon: , url: '/api/ExecDeviceAction', @@ -61,8 +74,9 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ ], confirmText: 'Select the User to set as the primary user for [deviceName]', }, - { +{ label: 'Add to Group', + category: "edit", type: 'POST', icon: , url: '/api/EditGroup', @@ -116,8 +130,10 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ multiPost: false, allowResubmit: true, }, - { +{ label: 'Rename Device', + quickAction: true, + category: "edit", type: 'POST', icon: , url: '/api/ExecDeviceAction', @@ -135,8 +151,10 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ }, ], }, - { +{ label: 'Sync Device', + quickAction: true, + category: "manage", type: 'POST', icon: , url: '/api/ExecDeviceAction', @@ -146,8 +164,10 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ }, confirmText: 'Are you sure you want to sync [deviceName]?', }, - { +{ label: 'Reboot Device', + quickAction: true, + category: "manage", type: 'POST', icon: , url: '/api/ExecDeviceAction', @@ -157,8 +177,9 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ }, confirmText: 'Are you sure you want to reboot [deviceName]?', }, - { +{ label: 'Locate Device', + category: "manage", type: 'POST', icon: , url: '/api/ExecDeviceAction', @@ -168,8 +189,10 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ }, confirmText: 'Are you sure you want to locate [deviceName]?', }, - { +{ label: 'Retrieve LAPS password', + quickAction: true, + category: "security", type: 'POST', icon: , url: '/api/ExecGetLocalAdminPassword', @@ -179,8 +202,9 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ hideCondition: (row) => row.operatingSystem !== 'Windows', confirmText: 'Are you sure you want to retrieve the local admin password for [deviceName]?', }, - { +{ label: 'Rotate Local Admin Password', + category: "security", type: 'POST', icon: , url: '/api/ExecDeviceAction', @@ -191,7 +215,7 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ hideCondition: (row) => row.operatingSystem !== 'Windows', confirmText: 'Are you sure you want to rotate the password for [deviceName]?', }, - { +{ label: 'Retrieve BIOS Password', type: 'POST', icon: , @@ -204,8 +228,10 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ hideCondition: (row) => row.operatingSystem !== 'Windows', confirmText: 'Are you sure you want to retrieve the BIOS password for [deviceName]?', }, - { +{ label: 'Retrieve BitLocker Keys', + quickAction: true, + category: "security", type: 'POST', icon: , url: '/api/ExecGetRecoveryKey', @@ -216,8 +242,9 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ hideCondition: (row) => row.operatingSystem !== 'Windows', confirmText: 'Are you sure you want to retrieve the BitLocker keys for [deviceName]?', }, - { +{ label: 'Retrieve FileVault Key', + category: "security", type: 'POST', icon: , url: '/api/ExecGetRecoveryKey', @@ -228,8 +255,9 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ hideCondition: (row) => row.operatingSystem !== 'macOS', confirmText: 'Are you sure you want to retrieve the FileVault key for [deviceName]?', }, - { +{ label: 'Reset Passcode', + category: "security", type: 'POST', icon: , url: '/api/ExecDevicePasscodeAction', @@ -241,8 +269,9 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ confirmText: 'Are you sure you want to reset the passcode for [deviceName]? A new passcode will be generated and displayed.', }, - { +{ label: 'Remove Passcode', + category: "security", type: 'POST', icon: , url: '/api/ExecDevicePasscodeAction', @@ -254,8 +283,9 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ confirmText: 'Are you sure you want to remove the passcode from [deviceName]? This will remove the device passcode requirement.', }, - { +{ label: 'Windows Defender Full Scan', + category: "security", type: 'POST', icon: , url: '/api/ExecDeviceAction', @@ -266,8 +296,9 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ }, confirmText: 'Are you sure you want to perform a full scan on [deviceName]?', }, - { +{ label: 'Windows Defender Quick Scan', + category: "security", type: 'POST', icon: , url: '/api/ExecDeviceAction', @@ -278,8 +309,9 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ }, confirmText: 'Are you sure you want to perform a quick scan on [deviceName]?', }, - { +{ label: 'Update Windows Defender', + category: "security", type: 'POST', icon: , url: '/api/ExecDeviceAction', @@ -290,8 +322,9 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ confirmText: 'Are you sure you want to update the Windows Defender signatures for [deviceName]?', }, - { +{ label: 'Offboard from Defender for Endpoint', + category: "security", type: 'POST', icon: , url: '/api/ExecDeviceAction', @@ -303,7 +336,6 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ confirmText: 'Are you sure you want to offboard [deviceName] from Microsoft Defender for Endpoint? This queues an offboarding action via the MDE API and cannot be undone without re-onboarding the device.', }, - // This endpoint currently does not work, Graph just returns an error. Leaving this here for now in case it is fixed in the future. -Zac // { // label: 'Generate logs and ship to MEM', // type: 'POST', @@ -341,8 +373,9 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ hideCondition: (row) => row.operatingSystem !== 'Windows', confirmText: 'Are you sure you want to Fresh Start [deviceName]?', }, - { +{ label: 'Wipe Device', + category: "danger", type: 'POST', icon: , url: '/api/ExecDeviceAction', @@ -385,8 +418,9 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ confirmText: 'Are you sure you want to wipe [deviceName]? This removes all user data on the device. Use Fresh Start to keep user files.', }, - { +{ label: 'Wipe Device', + category: "danger", type: 'POST', icon: , url: '/api/ExecDeviceAction', @@ -405,8 +439,9 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ confirmText: 'Are you sure you want to wipe [deviceName]? This erases all content and settings and cannot be undone. Intel Macs without a T2 security chip require the recovery PIN to unlock the device after the wipe. This removes all user data on the device.', }, - { +{ label: 'Autopilot Reset', + category: "danger", type: 'POST', icon: , url: '/api/ExecDeviceAction', @@ -420,7 +455,7 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ confirmText: 'Are you sure you want to Autopilot Reset [deviceName]? This wipes the device and keeps enrollment data, removes all user data on the device, and the device will re-provision through Windows Autopilot.', }, - { +{ label: 'Delete Device', type: 'POST', icon: , @@ -431,8 +466,9 @@ export const getIntuneDeviceActions = ({ tenantFilter } = {}) => [ }, confirmText: 'Are you sure you want to delete [deviceName]?', }, - { +{ label: 'Retire device', + category: "danger", type: 'POST', icon: , url: '/api/ExecDeviceAction', diff --git a/frontend/src/components/CippComponents/CippIntunePolicyActions.jsx b/frontend/src/components/CippComponents/CippIntunePolicyActions.jsx index 1169d162b0..55c98d8667 100644 --- a/frontend/src/components/CippComponents/CippIntunePolicyActions.jsx +++ b/frontend/src/components/CippComponents/CippIntunePolicyActions.jsx @@ -253,6 +253,7 @@ export const useCippIntunePolicyActions = (tenant, policyType, options = {}) => icon: , color: 'info', multiPost: false, + category: 'manage', }) } @@ -287,6 +288,7 @@ export const useCippIntunePolicyActions = (tenant, policyType, options = {}) => description: row.description, }), confirmText: 'Enter the new name and description for this policy.', + category: 'edit', }) } @@ -322,6 +324,7 @@ export const useCippIntunePolicyActions = (tenant, policyType, options = {}) => }), confirmText: 'Enter a name for the cloned policy. The name must be different from the original policy and assignments are not copied to the clone.', + category: 'manage', }) } @@ -343,6 +346,7 @@ export const useCippIntunePolicyActions = (tenant, policyType, options = {}) => confirmText: 'Are you sure you want to assign "[displayName]" to all users?', icon: , color: 'info', + category: 'edit', }) // Assign to All Devices @@ -363,6 +367,7 @@ export const useCippIntunePolicyActions = (tenant, policyType, options = {}) => confirmText: 'Are you sure you want to assign "[displayName]" to all devices?', icon: , color: 'info', + category: 'edit', }) // Assign Globally (All Users / All Devices) @@ -383,6 +388,7 @@ export const useCippIntunePolicyActions = (tenant, policyType, options = {}) => confirmText: 'Are you sure you want to assign "[displayName]" to all users and devices?', icon: , color: 'info', + category: 'edit', }) // Assign to Custom Group @@ -397,6 +403,7 @@ export const useCippIntunePolicyActions = (tenant, policyType, options = {}) => multiPost: false, fields: getCustomGroupFields(), customDataformatter: getCustomDataFormatterForGroups(), + category: 'edit', }) // Delete action @@ -412,6 +419,7 @@ export const useCippIntunePolicyActions = (tenant, policyType, options = {}) => confirmText: 'Are you sure you want to delete this policy?', icon: , color: 'danger', + category: 'danger', }) } diff --git a/frontend/src/components/CippComponents/CippInviteGuestDrawer.jsx b/frontend/src/components/CippComponents/CippInviteGuestDrawer.jsx index ed63099b67..ea903d314e 100644 --- a/frontend/src/components/CippComponents/CippInviteGuestDrawer.jsx +++ b/frontend/src/components/CippComponents/CippInviteGuestDrawer.jsx @@ -1,19 +1,27 @@ -import { useState, useEffect } from "react"; -import { CippIcons } from "../../utils/icon-registry"; -import { Button } from "@mui/material"; +import { useState, useEffect, useMemo } from "react"; +import { Alert, Box, Button, Typography } from "@mui/material"; import { Grid } from "@mui/system"; import { useForm, useFormState } from "react-hook-form"; +import { Send } from "@mui/icons-material"; import { CippOffCanvas } from "./CippOffCanvas"; import CippFormComponent from "./CippFormComponent"; import { CippApiResults } from "./CippApiResults"; +import CippAccessTypeGuide from "./CippAccessTypeGuide"; import { useSettings } from "../../hooks/use-settings"; import { ApiPostCall } from "../../api/ApiCall"; import { getCippValidator } from "../../utils/get-cipp-validator"; +const CONSUMER_DOMAINS = new Set([ + "gmail.com", "yahoo.com", "outlook.com", "hotmail.com", "aol.com", + "icloud.com", "live.com", "msn.com", "protonmail.com", "zoho.com", + "ymail.com", "mail.com", "gmx.com", "fastmail.com", +]); + export const CippInviteGuestDrawer = ({ buttonText = "Invite Guest", requiredPermissions = [], PermissionButton = Button, + buttonProps = {}, }) => { const [drawerVisible, setDrawerVisible] = useState(false); const userSettingsDefaults = useSettings(); @@ -32,6 +40,13 @@ export const CippInviteGuestDrawer = ({ const { isValid } = useFormState({ control: formControl.control }); + const watchedEmail = formControl.watch("mail"); + const consumerDomain = useMemo(() => { + if (!watchedEmail || !watchedEmail.includes("@")) return null; + const domain = watchedEmail.split("@")[1]?.toLowerCase(); + return domain && CONSUMER_DOMAINS.has(domain) ? domain : null; + }, [watchedEmail]); + const inviteGuest = ApiPostCall({ urlFromData: true, relatedQueryKeys: [`Users-${userSettingsDefaults.currentTenant}`], @@ -85,9 +100,10 @@ export const CippInviteGuestDrawer = ({ return ( <> } + startIcon={} + {...buttonProps} > {buttonText} @@ -116,6 +132,14 @@ export const CippInviteGuestDrawer = ({
    } > + + + + {consumerDomain && ( + + + + {consumerDomain} is a personal email domain. The guest will authenticate via Email One-Time Passcode (OTP) instead of a Microsoft account. + + + + )} , url: '/api/ExecSetLibraryPermission', @@ -164,6 +165,7 @@ export const CippLibraryPermissionsDialog = ({ }, { label: 'Remove Permission', + category: "danger", type: 'POST', icon: , url: '/api/ExecRemoveLibraryPermission', diff --git a/frontend/src/components/CippComponents/CippMemberAuditDialog.jsx b/frontend/src/components/CippComponents/CippMemberAuditDialog.jsx new file mode 100644 index 0000000000..1227171ce7 --- /dev/null +++ b/frontend/src/components/CippComponents/CippMemberAuditDialog.jsx @@ -0,0 +1,432 @@ +import { + Alert, + Box, + Button, + Chip, + CircularProgress, + Dialog, + DialogActions, + DialogContent, + DialogTitle, + Divider, + LinearProgress, + Stack, + Typography, +} from "@mui/material"; +import { + CheckCircle, + WarningAmber, + Info, + Build, + Refresh, + AutoFixHigh, +} from "@mui/icons-material"; +import { useState, useEffect, useCallback, useRef } from "react"; +import axios from "axios"; +import { useQueryClient } from "@tanstack/react-query"; +import { buildVersionedHeaders } from "../../utils/cippVersion"; + +const ISSUE_META = { + NOT_SYNCED: { + label: "Not Synced", + color: "warning", + fixLabel: "Sync to SharePoint", + }, + ORPHANED: { + label: "Not in Group", + color: "info", + fixLabel: "Add to Group", + }, + DRIVE_ONLY: { + label: "Drive-Only Access", + color: "warning", + fixLabel: "Promote to Member", + }, + NO_ROLE: { + label: "No Permissions", + color: "info", + fixLabel: "Assign Role", + }, +}; + +export default function CippMemberAuditDialog({ + open, + onClose, + tenantFilter, + siteId, + siteUrl, + groupId, + sharePointType, + relatedQueryKeys = [], +}) { + const queryClient = useQueryClient(); + const [loading, setLoading] = useState(false); + const [auditResult, setAuditResult] = useState(null); + const [repairingIndex, setRepairingIndex] = useState(null); + const [repairingAll, setRepairingAll] = useState(false); + const [repairMessages, setRepairMessages] = useState({}); + const [error, setError] = useState(null); + const pendingTimerRef = useRef(null); + + const invalidateRelated = useCallback(() => { + relatedQueryKeys.forEach((key) => { + queryClient.invalidateQueries({ queryKey: [key] }); + }); + }, [queryClient, relatedQueryKeys]); + + const runAudit = useCallback(async () => { + if (!tenantFilter || !siteId) return; + setLoading(true); + setAuditResult(null); + setError(null); + setRepairMessages({}); + setRepairingIndex(null); + setRepairingAll(false); + + try { + const headers = await buildVersionedHeaders(); + const resp = await axios.post( + "/api/ExecSharePointMemberAudit", + { + tenantFilter, + siteId, + siteUrl, + groupId, + sharePointType, + action: "audit", + }, + { headers, timeout: 60000 } + ); + const data = resp.data?.Results; + if (data?.error) { + setError(data.error); + } else { + setAuditResult(data); + } + } catch (err) { + setError( + err.response?.data?.Results?.error || + err.message || + "Audit request failed." + ); + } finally { + setLoading(false); + } + }, [tenantFilter, siteId, siteUrl, groupId, sharePointType]); + + useEffect(() => { + if (open) { + runAudit(); + } else { + if (pendingTimerRef.current) { + clearTimeout(pendingTimerRef.current); + pendingTimerRef.current = null; + } + setAuditResult(null); + setError(null); + setRepairMessages({}); + setRepairingAll(false); + } + }, [open, runAudit]); + + const repairSingle = async (issue, index) => { + setRepairingIndex(index); + setRepairMessages((prev) => ({ ...prev, [index]: null })); + + try { + const headers = await buildVersionedHeaders(); + const resp = await axios.post( + "/api/ExecSharePointMemberAudit", + { + tenantFilter, + siteId, + siteUrl, + groupId, + sharePointType, + action: "repair", + repairType: issue.repairAction, + userEmail: issue.userEmail, + userId: issue.userId, + drivePermissionId: issue.drivePermissionId, + }, + { headers, timeout: 60000 } + ); + const results = resp.data?.Results?.results || []; + setRepairMessages((prev) => ({ + ...prev, + [index]: { success: true, text: results.join(" ") || "Fixed." }, + })); + invalidateRelated(); + } catch (err) { + const msg = + err.response?.data?.Results?.error || err.message || "Repair failed."; + setRepairMessages((prev) => ({ + ...prev, + [index]: { success: false, text: msg }, + })); + } finally { + setRepairingIndex(null); + } + }; + + const repairAll = async () => { + if (!auditResult?.issues?.length) return; + setRepairingAll(true); + setRepairMessages({}); + + try { + const headers = await buildVersionedHeaders(); + const resp = await axios.post( + "/api/ExecSharePointMemberAudit", + { + tenantFilter, + siteId, + siteUrl, + groupId, + sharePointType, + action: "repair", + repairType: "repair_all", + userEmail: "_all", + issues: auditResult.issues, + }, + { headers, timeout: 120000 } + ); + const results = resp.data?.Results?.results || []; + setRepairMessages({ + all: { + success: true, + text: results.join(" ") || "All issues repaired.", + }, + }); + invalidateRelated(); + pendingTimerRef.current = setTimeout(() => { + pendingTimerRef.current = null; + runAudit(); + }, 1500); + } catch (err) { + const msg = + err.response?.data?.Results?.error || + err.message || + "Repair all failed."; + setRepairMessages({ all: { success: false, text: msg } }); + setRepairingAll(false); + } + }; + + const issues = auditResult?.issues || []; + const hasIssues = issues.length > 0; + + return ( + + + + + Member Audit + + + Checks for members with incorrect or incomplete permissions and offers + repairs. + + + + + {loading && ( + + + + Auditing site membership... + + + )} + + {error && !loading && ( + + {error} + + )} + + {auditResult && !loading && ( + <> + {!hasIssues && ( + } + sx={{ mb: 1 }} + > + All members have correct permissions. No issues detected. + + )} + + {hasIssues && ( + + + + Found{" "} + + {issues.length} issue{issues.length !== 1 ? "s" : ""} + {" "} + ({auditResult.siteType} site) + + {issues.length > 1 && ( + + )} + + + {repairMessages.all && ( + + + {repairMessages.all.text} + + + )} + + + + {issues.map((issue, idx) => { + const meta = ISSUE_META[issue.type] || { + label: issue.type, + color: "default", + fixLabel: "Fix", + }; + const msg = repairMessages[idx]; + + return ( + + + + + {issue.severity === "warning" ? ( + + ) : ( + + )} + + {issue.userName || issue.userEmail} + + + + + {issue.userEmail} + + + {issue.description} + + + + + + + {msg && !msg.success && ( + + {msg.text} + + )} + + {idx < issues.length - 1 && } + + ); + })} + + )} + + )} + + + + + + + + + ); +} diff --git a/frontend/src/components/CippComponents/CippMultiQueueTracker.jsx b/frontend/src/components/CippComponents/CippMultiQueueTracker.jsx index 35666b5cb2..3e3642632b 100644 --- a/frontend/src/components/CippComponents/CippMultiQueueTracker.jsx +++ b/frontend/src/components/CippComponents/CippMultiQueueTracker.jsx @@ -48,10 +48,7 @@ export const CippMultiQueueTracker = ({ queueIds = [], relatedQueryKeys = [], la data: { QueueIds: idKey }, queryKey: `CippQueues-${idKey || 'none'}`, waiting: ids.length > 0, - // TanStack Query v5 hands this callback the Query object, not the data. Reading the data - // off query.state is what makes the interval actually return false on completion - with - // the v4 (data) signature the status is never found and the poll runs forever. - refetchInterval: (query) => (isFinished(query?.state?.data?.Summary?.Status) ? false : 3000), + refetchInterval: (data) => (isFinished(data?.Summary?.Status) ? false : 3000), refetchOnWindowFocus: false, staleTime: 0, }) diff --git a/frontend/src/components/CippComponents/CippOffboardingDefaultSettings.jsx b/frontend/src/components/CippComponents/CippOffboardingDefaultSettings.jsx index 6d134060dd..2ca4c40b63 100644 --- a/frontend/src/components/CippComponents/CippOffboardingDefaultSettings.jsx +++ b/frontend/src/components/CippComponents/CippOffboardingDefaultSettings.jsx @@ -242,7 +242,7 @@ export const CippOffboardingDefaultSettings = (props) => { display: 'block', mb: 1.5 }}> - Leave blank to not set. CIPP %variable% tokens (for example %tenantname%) are resolved + Leave blank to not set. Manage365 %variable% tokens (for example %tenantname%) are resolved when the offboarding job runs. %username% is not the offboarded user. } links - Navigation links to related pages + */ +const CippRelatedSettings = ({ severity = "info", title, description, links = [] }) => { + return ( + + {title && {title}} + 0 ? 1.5 : 0 }}> + {description} + + {links.length > 0 && ( + + {links.map((link) => ( + + + + ))} + + )} + + ); +}; + +export default CippRelatedSettings; diff --git a/frontend/src/components/CippComponents/CippRemovableTenantChips.jsx b/frontend/src/components/CippComponents/CippRemovableTenantChips.jsx new file mode 100644 index 0000000000..dbdf3aea81 --- /dev/null +++ b/frontend/src/components/CippComponents/CippRemovableTenantChips.jsx @@ -0,0 +1,315 @@ +import React, { useState } from "react"; +import PropTypes from "prop-types"; +import { + Chip, + Stack, + Dialog, + DialogTitle, + DialogContent, + DialogContentText, + DialogActions, + Button, + CircularProgress, + Alert, + Tooltip, + Typography, + Box, +} from "@mui/material"; +import { Close, Business } from "@mui/icons-material"; +import { alpha, useTheme } from "@mui/material/styles"; +import { ApiPostCall } from "../../api/ApiCall"; +import { useQueryClient } from "@tanstack/react-query"; + +/** + * Component that displays tenants as chips with an X button to remove them. + * Used for managing tenants in templates (both included and excluded tenants). + */ +export const CippRemovableTenantChips = ({ + tenants, + templateId, + templateName, + templateData, + fieldName, // 'tenantFilter' or 'excludedTenants' + queryKey, + maxDisplay = 5, + emptyMessage = "None", +}) => { + const theme = useTheme(); + const queryClient = useQueryClient(); + const [removeDialog, setRemoveDialog] = useState({ + open: false, + tenant: null, + }); + const [isRemoving, setIsRemoving] = useState(false); + const [error, setError] = useState(null); + const [showAll, setShowAll] = useState(false); + + const updateTemplateMutation = ApiPostCall({ + urlFromData: true, + relatedQueryKeys: [queryKey], + }); + + // Normalize tenants to array + const tenantList = React.useMemo(() => { + if (!tenants) return []; + if (Array.isArray(tenants)) return tenants; + if (typeof tenants === "string") { + // Could be a single tenant or comma-separated list + if (tenants === "AllTenants") return ["AllTenants"]; + return [tenants]; + } + return []; + }, [tenants]); + + const handleRemoveClick = (tenant, e) => { + e.stopPropagation(); + setRemoveDialog({ open: true, tenant }); + setError(null); + }; + + const handleDialogClose = () => { + setRemoveDialog({ open: false, tenant: null }); + setError(null); + }; + + // Helper to filter out corrupted/invalid tenant entries + const cleanTenantArray = (tenants, tenantToRemove) => { + if (!tenants) return []; + const arr = Array.isArray(tenants) ? tenants : [tenants]; + return arr.filter((t) => { + // Filter out the tenant being removed + if (t === tenantToRemove || t?.value === tenantToRemove) return false; + // Filter out corrupted data (field names stored as values) + if (t === "excludedTenants" || t === "tenantFilter") return false; + // Filter out empty/null values + if (!t) return false; + return true; + }); + }; + + const handleRemoveTenant = async () => { + const { tenant } = removeDialog; + setIsRemoving(true); + setError(null); + + try { + // Create updated template data + const updatedTemplate = { ...templateData }; + + if (fieldName === "tenantFilter") { + updatedTemplate.tenantFilter = cleanTenantArray(updatedTemplate.tenantFilter, tenant); + } else if (fieldName === "excludedTenants") { + updatedTemplate.excludedTenants = cleanTenantArray(updatedTemplate.excludedTenants, tenant); + } + + // Also clean the other field to remove any corrupted data + if (updatedTemplate.excludedTenants) { + updatedTemplate.excludedTenants = cleanTenantArray(updatedTemplate.excludedTenants, null); + } + + await updateTemplateMutation.mutateAsync({ + url: "/api/AddStandardsTemplate", + data: updatedTemplate, + }); + + // Invalidate queries to refresh data + queryClient.invalidateQueries({ queryKey: [queryKey] }); + + handleDialogClose(); + } catch (err) { + console.error("Failed to remove tenant:", err); + setError(err.message || "Failed to remove tenant from template"); + } finally { + setIsRemoving(false); + } + }; + + // Get display name for tenant + const getTenantDisplayName = (tenant) => { + if (typeof tenant === "object" && tenant !== null) { + return tenant.label || tenant.value || tenant.displayName || "Unknown"; + } + return tenant || "Unknown"; + }; + + // Get tenant value for comparison + const getTenantValue = (tenant) => { + if (typeof tenant === "object" && tenant !== null) { + return tenant.value || tenant.label || tenant.displayName; + } + return tenant; + }; + + if (tenantList.length === 0) { + return ( + + {emptyMessage} + + ); + } + + const displayTenants = showAll ? tenantList : tenantList.slice(0, maxDisplay); + const hiddenCount = tenantList.length - maxDisplay; + const isExcludedField = fieldName === "excludedTenants"; + + return ( + <> + + {displayTenants.map((tenant, index) => { + const displayName = getTenantDisplayName(tenant); + const isAllTenants = displayName === "AllTenants"; + + return ( + + } + label={isAllTenants ? "All Tenants" : displayName} + variant="outlined" + color={isExcludedField ? "warning" : "default"} + onDelete={isAllTenants ? undefined : (e) => handleRemoveClick(tenant, e)} + deleteIcon={ + + } + sx={{ + maxWidth: 200, + "& .MuiChip-label": { + overflow: "hidden", + textOverflow: "ellipsis", + whiteSpace: "nowrap", + }, + ...(isAllTenants && { + bgcolor: alpha(theme.palette.info.main, 0.1), + borderColor: alpha(theme.palette.info.main, 0.3), + }), + }} + /> + + ); + })} + {!showAll && hiddenCount > 0 && ( + setShowAll(true)} + sx={{ + cursor: "pointer", + "&:hover": { + bgcolor: alpha(theme.palette.primary.main, 0.1), + }, + }} + /> + )} + {showAll && tenantList.length > maxDisplay && ( + setShowAll(false)} + sx={{ + cursor: "pointer", + "&:hover": { + bgcolor: alpha(theme.palette.primary.main, 0.1), + }, + }} + /> + )} + + + {/* Remove Tenant Confirmation Dialog */} + e.stopPropagation()} + > + + Remove Tenant from {isExcludedField ? "Exclusions" : "Template"}? + + + + Are you sure you want to remove{" "} + {getTenantDisplayName(removeDialog.tenant)} from{" "} + {isExcludedField ? ( + <> + the excluded tenants list of template{" "} + {templateName}? + + This tenant will now be included when the template is applied to "All Tenants". + + + ) : ( + <> + template {templateName}? + + This template will no longer apply to this tenant. Make sure this is intentional. + + + )} + + + {error && ( + + {error} + + )} + + + + + + + + ); +}; + +CippRemovableTenantChips.propTypes = { + tenants: PropTypes.oneOfType([ + PropTypes.array, + PropTypes.string, + ]), + templateId: PropTypes.string.isRequired, + templateName: PropTypes.string, + templateData: PropTypes.object.isRequired, + fieldName: PropTypes.oneOf(["tenantFilter", "excludedTenants"]).isRequired, + queryKey: PropTypes.string.isRequired, + maxDisplay: PropTypes.number, + emptyMessage: PropTypes.string, +}; + +export default CippRemovableTenantChips; diff --git a/frontend/src/components/CippComponents/CippReportDBControls.jsx b/frontend/src/components/CippComponents/CippReportDBControls.jsx index 7f599bb95d..f43545ff4a 100644 --- a/frontend/src/components/CippComponents/CippReportDBControls.jsx +++ b/frontend/src/components/CippComponents/CippReportDBControls.jsx @@ -127,7 +127,7 @@ export function useCippReportDB(config) { // Tooltip text const tooltipText = !allowToggle - ? 'This page always uses cached data from the CIPP reporting database.' + ? 'This page always uses cached data from the Manage365 reporting database.' : isAllTenants ? 'AllTenants always uses cached data' : useReportDB diff --git a/frontend/src/components/CippComponents/CippRestoreBackupDrawer.jsx b/frontend/src/components/CippComponents/CippRestoreBackupDrawer.jsx index eaa5d98184..625d9209ca 100644 --- a/frontend/src/components/CippComponents/CippRestoreBackupDrawer.jsx +++ b/frontend/src/components/CippComponents/CippRestoreBackupDrawer.jsx @@ -97,7 +97,7 @@ export const CippRestoreBackupDrawer = ({ const shippedValues = { TenantFilter: tenantFilterValue, - Name: `CIPP Restore ${tenantFilterValue}`, + Name: `Manage365 Restore ${tenantFilterValue}`, Command: { value: `New-CIPPRestore` }, Parameters: { Type: 'Scheduled', @@ -320,7 +320,7 @@ export const CippRestoreBackupDrawer = ({ {/* CIPP */} - CIPP + Manage365 }> Confirm Restore - This will overwrite your current CIPP configuration for the selected categories. This + This will overwrite your current Manage365 configuration for the selected categories. This action cannot be undone. )} diff --git a/frontend/src/components/CippComponents/CippRichTextEditor.jsx b/frontend/src/components/CippComponents/CippRichTextEditor.jsx new file mode 100644 index 0000000000..11b9e51ee3 --- /dev/null +++ b/frontend/src/components/CippComponents/CippRichTextEditor.jsx @@ -0,0 +1,92 @@ +import React from "react"; +import { Typography } from "@mui/material"; +import { Controller } from "react-hook-form"; +import get from "lodash/get"; +import { + MenuButtonBold, + MenuButtonItalic, + MenuControlsContainer, + MenuDivider, + MenuSelectHeading, + RichTextEditor, +} from "mui-tiptap"; +import StarterKit from "@tiptap/starter-kit"; + +const CippRichTextEditor = ({ + convertedName, + formControl, + validators, + label, + errors, + ...other +}) => { + const editorInstanceRef = React.useRef(null); + const lastSetValue = React.useRef(null); + + return ( + <> +
    + { + const { value, onChange, ref } = field; + + // Update content when value changes externally + React.useEffect(() => { + if ( + editorInstanceRef.current && + typeof value === "string" && + value !== lastSetValue.current + ) { + editorInstanceRef.current.commands.setContent(value || "", false); + lastSetValue.current = value; + } + }, [value]); + + return ( + <> + {label} + { + editorInstanceRef.current = editor; + // Set initial content when editor is created + if (typeof value === "string") { + editor.commands.setContent(value || "", false); + lastSetValue.current = value; + } + }} + onUpdate={({ editor }) => { + const newValue = editor.getHTML(); + lastSetValue.current = newValue; + onChange(newValue); + }} + label={label} + renderControls={() => ( + + + + + + + )} + /> + + ); + }} + /> +
    + + {get(errors, convertedName, {}).message} + + + ); +}; + +export default CippRichTextEditor; diff --git a/frontend/src/components/CippComponents/CippRiskAlert.jsx b/frontend/src/components/CippComponents/CippRiskAlert.jsx new file mode 100644 index 0000000000..0943219aaf --- /dev/null +++ b/frontend/src/components/CippComponents/CippRiskAlert.jsx @@ -0,0 +1,29 @@ +import { Alert, AlertTitle, Collapse, Typography } from "@mui/material"; + +/** + * Inline risk coaching alert that appears next to a setting control when a risky value is selected. + * Uses MUI Collapse for smooth animated show/hide. + * + * @param {boolean} visible - Whether the alert is shown (controls Collapse) + * @param {"error"|"warning"|"info"} severity - Risk level + * @param {string} title - Short label like "High Risk" or "Not Recommended" + * @param {string} description - What could go wrong + * @param {string} [recommendation] - Safer alternative (rendered bold) + */ +const CippRiskAlert = ({ visible, severity = "warning", title, description, recommendation }) => { + return ( + + + {title && {title}} + {description} + {recommendation && ( + + Recommendation: {recommendation} + + )} + + + ); +}; + +export default CippRiskAlert; diff --git a/frontend/src/components/CippComponents/CippRiskSummaryDialog.jsx b/frontend/src/components/CippComponents/CippRiskSummaryDialog.jsx new file mode 100644 index 0000000000..c980493e82 --- /dev/null +++ b/frontend/src/components/CippComponents/CippRiskSummaryDialog.jsx @@ -0,0 +1,113 @@ +import { + Alert, + AlertTitle, + Box, + Button, + Dialog, + DialogActions, + DialogContent, + DialogTitle, + Stack, + Typography, + useTheme, +} from "@mui/material"; +import { alpha } from "@mui/material/styles"; +import { WarningAmber } from "@mui/icons-material"; + +/** + * Confirmation dialog that displays all active risk warnings before saving. + * Groups risks by severity (error first, then warning, then info). + * If no risks are provided, this component does not render. + * + * @param {boolean} open + * @param {function} onClose - Called when user cancels + * @param {function} onConfirm - Called when user confirms save despite risks + * @param {Array<{severity: string, title: string, description: string}>} risks + */ +const CippRiskSummaryDialog = ({ open, onClose, onConfirm, risks = [] }) => { + const theme = useTheme(); + const hasHighRisk = risks.some((r) => r.severity === "error"); + + const severityOrder = { error: 0, warning: 1, info: 2 }; + const sortedRisks = [...risks].sort( + (a, b) => (severityOrder[a.severity] ?? 3) - (severityOrder[b.severity] ?? 3) + ); + + const highCount = risks.filter((r) => r.severity === "error").length; + const mediumCount = risks.filter((r) => r.severity === "warning").length; + + return ( + + + + Review Risk Warnings Before Saving + + + + The current configuration includes{" "} + {highCount > 0 && ( + + {highCount} high-risk {highCount === 1 ? "setting" : "settings"} + + )} + {highCount > 0 && mediumCount > 0 && " and "} + {mediumCount > 0 && ( + + {mediumCount} moderate-risk {mediumCount === 1 ? "setting" : "settings"} + + )} + {highCount === 0 && mediumCount === 0 && settings that may need review}. + Please review the following before proceeding: + + + {sortedRisks.map((risk, idx) => ( + + {risk.title} + {risk.description} + + ))} + + + + + + + + ); +}; + +export default CippRiskSummaryDialog; diff --git a/frontend/src/components/CippComponents/CippSankey.jsx b/frontend/src/components/CippComponents/CippSankey.jsx index e24f30ad47..49f8251be7 100644 --- a/frontend/src/components/CippComponents/CippSankey.jsx +++ b/frontend/src/components/CippComponents/CippSankey.jsx @@ -1,8 +1,17 @@ +import dynamic from "next/dynamic"; import { useMemo } from "react"; -import { ResponsiveSankey } from "@nivo/sankey"; -import { Box, ButtonBase, Typography, useTheme } from "@mui/material"; +import { Box, ButtonBase, Skeleton, Typography, useTheme } from "@mui/material"; import { useIsMobileLayout } from "../../hooks/use-breakpoint"; +// Lazy-load the Nivo Sankey chart library +const ResponsiveSankey = dynamic( + () => import("@nivo/sankey").then((mod) => mod.ResponsiveSankey), + { + ssr: false, + loading: () => , + } +); + // A node's weight: what flows in, or out if nothing flows in (the leftmost column). const nodeTotals = (data) => { const incoming = new Map(); diff --git a/frontend/src/components/CippComponents/CippScheduledTaskActions.jsx b/frontend/src/components/CippComponents/CippScheduledTaskActions.jsx index a8081063e8..9d8c679c6b 100644 --- a/frontend/src/components/CippComponents/CippScheduledTaskActions.jsx +++ b/frontend/src/components/CippComponents/CippScheduledTaskActions.jsx @@ -2,21 +2,32 @@ import { CippIcons } from "../../utils/icon-registry" import { usePermissions } from "../../hooks/use-permissions"; +const schedulerJobUrl = (rowKey, clone = false) => { + const id = String(rowKey ?? ""); + if (!/^[\w-]+$/.test(id)) return null; + const url = new URL("/cipp/scheduler/job", window.location.origin); + url.searchParams.set("id", id); + if (clone) url.searchParams.set("Clone", "True"); + return `${url.pathname}${url.search}`; +}; + export const CippScheduledTaskActions = (drawerHandlers = {}, { hideActions = [] } = {}) => { const { checkPermissions } = usePermissions(); const canWriteScheduler = checkPermissions(["CIPP.Scheduler.ReadWrite"]); const canReadScheduler = checkPermissions(["CIPP.Scheduler.Read", "CIPP.Scheduler.ReadWrite"]); return [ - { +{ label: "View Task Details", + category: "view", link: "/cipp/scheduler/task?id=[RowKey]", pinned: true, icon: , condition: () => canReadScheduler, }, - { +{ label: "Run Now", + category: "manage", type: "POST", url: "/api/AddScheduledItem", data: { RowKey: "RowKey", RunNow: true }, @@ -25,13 +36,14 @@ export const CippScheduledTaskActions = (drawerHandlers = {}, { hideActions = [] allowResubmit: true, condition: () => canWriteScheduler, }, - { +{ label: "Edit Job", pinned: true, customFunction: drawerHandlers.openEditDrawer || ((row) => { - window.location.href = `/cipp/scheduler/job?id=${row.RowKey}`; + const next = schedulerJobUrl(row.RowKey); + if (next) window.location.assign(next); }), multiPost: false, icon: , @@ -40,12 +52,13 @@ export const CippScheduledTaskActions = (drawerHandlers = {}, { hideActions = [] noConfirm: true, condition: () => canWriteScheduler, }, - { +{ label: "Clone Job", customFunction: drawerHandlers.openCloneDrawer || ((row) => { - window.location.href = `/cipp/scheduler/job?id=${row.RowKey}&Clone=True`; + const next = schedulerJobUrl(row.RowKey, true); + if (next) window.location.assign(next); }), multiPost: false, icon: , @@ -54,8 +67,9 @@ export const CippScheduledTaskActions = (drawerHandlers = {}, { hideActions = [] noConfirm: true, condition: () => canWriteScheduler, }, - { +{ label: "Delete Job", + category: "danger", icon: , type: "POST", url: "/api/RemoveScheduledItem", @@ -64,7 +78,7 @@ export const CippScheduledTaskActions = (drawerHandlers = {}, { hideActions = [] multiPost: false, condition: () => canWriteScheduler, }, - ].filter((action) => !hideActions.includes(action.label)); +].filter((action) => !hideActions.includes(action.label)); }; export default CippScheduledTaskActions; diff --git a/frontend/src/components/CippComponents/CippSettingsSideBar.jsx b/frontend/src/components/CippComponents/CippSettingsSideBar.jsx index 9be01f5058..6a1b01032a 100644 --- a/frontend/src/components/CippComponents/CippSettingsSideBar.jsx +++ b/frontend/src/components/CippComponents/CippSettingsSideBar.jsx @@ -86,6 +86,7 @@ export const CippSettingsSideBar = (props) => { Compliance_Portal: formValues.portalLinks?.Compliance_Portal, Power_Platform_Portal: formValues.portalLinks?.Power_Platform_Portal, Power_BI_Portal: formValues.portalLinks?.Power_BI_Portal, + Login_Hint: formValues.portalLinks?.Login_Hint, }, // Offboarding Defaults diff --git a/frontend/src/components/CippComponents/CippSharePointLibraryCopyDialog.jsx b/frontend/src/components/CippComponents/CippSharePointLibraryCopyDialog.jsx index fcc2c09c6d..f213160118 100644 --- a/frontend/src/components/CippComponents/CippSharePointLibraryCopyDialog.jsx +++ b/frontend/src/components/CippComponents/CippSharePointLibraryCopyDialog.jsx @@ -25,6 +25,7 @@ import { Grid } from '@mui/system' import { ApiGetCall, ApiPostCall } from '../../api/ApiCall' import { usePermissions } from '../../hooks/use-permissions' import { buildVersionedHeaders } from '../../utils/cippVersion' +import { getCippError } from '../../utils/get-cipp-error' import { filterEligibleCopyLibraries } from '../../utils/sharepoint-library-copy-eligible' const POLL_MS = 20000 @@ -554,7 +555,7 @@ export const CippSharePointLibraryCopyDialog = ({ setPreflight(result) setConfirmOpen(true) } catch (e) { - setError(e?.message ?? 'Preflight failed.') + setError(getCippError(e) ?? 'Preflight failed.') } } @@ -573,7 +574,7 @@ export const CippSharePointLibraryCopyDialog = ({ } setOperationId(result.OperationId) } catch (e) { - setError(e?.message ?? 'Failed to start copy.') + setError(getCippError(e) ?? 'Failed to start copy.') } } @@ -620,7 +621,7 @@ export const CippSharePointLibraryCopyDialog = ({ } } catch (e) { if (manual || !pollStoppedRef.current) { - setError(e?.message ?? 'Status poll failed.') + setError(getCippError(e) ?? 'Status poll failed.') if (!manual) stopPolling() } } finally { diff --git a/frontend/src/components/CippComponents/CippSharedMailboxLicenseAlert.jsx b/frontend/src/components/CippComponents/CippSharedMailboxLicenseAlert.jsx new file mode 100644 index 0000000000..6e63211015 --- /dev/null +++ b/frontend/src/components/CippComponents/CippSharedMailboxLicenseAlert.jsx @@ -0,0 +1,58 @@ +import { Alert, AlertTitle } from '@mui/material' +import { useWatch } from 'react-hook-form' +import { ApiGetCall } from '../../api/ApiCall' +import { useSettings } from '../../hooks/use-settings.js' + +// Unlicensed shared mailboxes and their archives are capped at 50 GiB; warn at 49 GiB. +const SHARED_MAILBOX_WARN_BYTES = 49 * 1024 ** 3 +const toGB = (bytes) => (Number(bytes) / 1024 ** 3).toFixed(1) + +// Why a cached mailbox row still needs a license once converted to shared; empty when it doesn't. +export const getSharedMailboxLicenseReasons = (mb) => { + const reasons = [] + const bytes = Number(mb?.storageUsedInBytes) + if (Number.isFinite(bytes) && bytes >= SHARED_MAILBOX_WARN_BYTES) { + reasons.push(`${toGB(bytes)} GB mailbox`) + } + const archiveBytes = Number(mb?.ArchiveSize) + if (mb?.ArchiveEnabled === true && archiveBytes >= SHARED_MAILBOX_WARN_BYTES) { + reasons.push(`${toGB(archiveBytes)} GB archive`) + } + if (mb?.LitigationHoldEnabled === true) { + reasons.push('litigation hold') + } + return reasons +} + +// Cached mailbox rows for a tenant, shared by every shared-mailbox license check. +export const useSharedMailboxLicenseData = (tenant, enabled) => + ApiGetCall({ + url: '/api/ListMailboxes', + data: { tenantFilter: tenant, UseReportDB: true }, + queryKey: `SharedMailboxLicenseCheck-${tenant}`, + waiting: !!enabled && !!tenant, + }) + +// Rendered as a field component in the Convert Mailbox dialog; shows once Shared is picked. +export const CippSharedMailboxLicenseAlert = ({ formControl, row }) => { + const tenantFilter = useSettings().currentTenant + const rowData = Array.isArray(row) ? row[0] : row + const tenant = tenantFilter === 'AllTenants' && rowData?.Tenant ? rowData.Tenant : tenantFilter + const upn = (rowData?.userPrincipalName ?? rowData?.UPN)?.toString().toLowerCase() + const isShared = useWatch({ control: formControl.control, name: 'MailboxType' }) === 'Shared' + const mailboxes = useSharedMailboxLicenseData(tenant, isShared && !!upn) + + if (!isShared || !Array.isArray(mailboxes.data)) return null + const mailbox = mailboxes.data.find((mb) => mb?.UPN?.toString().toLowerCase() === upn) + const reasons = getSharedMailboxLicenseReasons(mailbox) + if (!reasons.length) return null + + return ( + + Keep a license on this mailbox + This mailbox has {reasons.join('; ')}. A shared mailbox needs a license if its mailbox or + archive is over 50 GB, or it is on litigation hold. Unless a license is kept, converting may + fail or the mailbox may stop receiving mail. + + ) +} diff --git a/frontend/src/components/CippComponents/CippSiteActions.jsx b/frontend/src/components/CippComponents/CippSiteActions.jsx new file mode 100644 index 0000000000..0e9a002157 --- /dev/null +++ b/frontend/src/components/CippComponents/CippSiteActions.jsx @@ -0,0 +1,1093 @@ +import { useMemo } from "react"; +import { Alert, Button, Dialog, DialogActions, DialogContent, DialogTitle } from "@mui/material"; +import { + AdminPanelSettings, + Assessment, + CleaningServices, + DataUsage, + Delete, + DriveFileRenameOutline, + FolderShared, + Groups, + Hub, + Info, + Language, + Lock, + ManageAccounts, + NoAccounts, + PersonAdd, + PersonRemove, + PersonSearch, + QueryStats, + RestoreFromTrash, + Send, + Settings, + Share, +} from "@mui/icons-material"; +import { ApiGetCall } from "../../api/ApiCall"; +import { useSettings } from "../../hooks/use-settings"; +import CippFormComponent from "./CippFormComponent"; +import { CippFormCondition } from "./CippFormCondition"; +import { CippPropertyList } from "./CippPropertyList"; +import { CippEditSitePropertiesForm } from "./CippEditSitePropertiesForm"; +import { CippSiteRecycleBinDialog } from "./CippSiteRecycleBinDialog"; +import { CippLibraryPermissionsDialog } from "./CippLibraryPermissionsDialog"; +import { CippCheckUserAccessDialog } from "./CippCheckUserAccessDialog"; + +// Friendly labels for the SharePoint version cleanup (trim) job progress fields. +const VERSION_CLEANUP_LABELS = { + Status: "Status", + BatchDeleteMode: "Cleanup Mode", + RequestTimeInUTC: "Requested (UTC)", + LastProcessTimeInUTC: "Last Processed (UTC)", + CompleteTimeInUTC: "Completed (UTC)", + ListsProcessed: "Lists Processed", + ListsUpdated: "Lists Updated", + ListsFailed: "Lists Failed", + FilesProcessed: "Files Processed", + VersionsProcessed: "Versions Processed", + VersionsDeleted: "Versions Deleted", + VersionsFailed: "Versions Failed", + StorageReleased: "Storage Released (bytes)", + ErrorMessage: "Error Message", + WorkItemId: "Work Item ID", +}; +// Order in which the fields are shown. +const VERSION_CLEANUP_FIELDS = Object.keys(VERSION_CLEANUP_LABELS); + +// Renders the body of the status modal based on the fetched job progress. +const VersionCleanupStatusBody = ({ statusApi }) => { + const progress = statusApi.data?.Results; + + if (statusApi.isError) { + return Failed to load cleanup job status.; + } + + // No job: either an empty/blank response, or the API's explicit "NoRequestFound" status. + if ( + !statusApi.isFetching && + (progress === undefined || + progress === null || + (typeof progress === "string" && progress.trim() === "") || + progress?.Status === "NoRequestFound") + ) { + return No cleanup job found for this site.; + } + + // Backend couldn't parse the payload and returned the raw string. + if (!statusApi.isFetching && typeof progress === "string") { + return {progress}; + } + + const propertyItems = VERSION_CLEANUP_FIELDS.filter( + (key) => progress?.[key] !== undefined && progress?.[key] !== "" + ).map((key) => ({ + label: VERSION_CLEANUP_LABELS[key], + value: String(progress[key]), + })); + + return ( + ({ label: VERSION_CLEANUP_LABELS[key], value: "" })) + } + /> + ); +}; + +// Custom-component action modal: opens directly (no confirmation step) and fetches the trim +// job status for the selected site, rendering it as a property list. +const VersionCleanupStatusModal = ({ row, tenantFilter, drawerVisible, setDrawerVisible }) => { + const siteRow = Array.isArray(row) ? row[0] : row; + const siteUrl = siteRow?.webUrl; + const statusApi = ApiGetCall({ + url: "/api/ListSPOVersionCleanup", + data: { + tenantFilter: siteRow?.Tenant ?? tenantFilter, + SiteUrl: siteUrl, + }, + queryKey: `SPOVersionCleanupStatus-${siteUrl}`, + waiting: !!drawerVisible && !!siteUrl, + }); + + return ( + setDrawerVisible(false)}> + + Cleanup Job Status{siteRow?.displayName ? ` — ${siteRow.displayName}` : ""} + + + + + + + + + ); +}; + +export const useCippSiteActions = () => { + const tenantFilter = useSettings().currentTenant; + + return useMemo( + () => [ + { + label: "View Details", + type: "link", + icon: , + link: "/teams-share/sharepoint/site-details?siteId=[siteId]&displayName=[displayName]&webUrl=[webUrl]&rootWebTemplate=[rootWebTemplate]&ownerPrincipalName=[ownerPrincipalName]&ownerDisplayName=[ownerDisplayName]&storageUsedInGigabytes=[storageUsedInGigabytes]&storageAllocatedInGigabytes=[storageAllocatedInGigabytes]&fileCount=[fileCount]&lastActivityDate=[lastActivityDate]&createdDateTime=[createdDateTime]&reportRefreshDate=[reportRefreshDate]", + category: "view", + quickAction: true, + }, + { + label: "Open Site", + type: "link", + icon: , + link: "[webUrl]", + external: true, + category: "view", + quickAction: true, + }, + { + label: "Add Member", + type: "POST", + icon: , + url: "/api/ExecSetSharePointMember", + data: { + groupId: "ownerPrincipalName", + add: true, + URL: "webUrl", + SharePointType: "rootWebTemplate", + }, + confirmText: "Select the User to add and the site role to add them to.", + relatedQueryKeys: ["site-members-*"], + fields: [ + { + type: "autoComplete", + name: "user", + label: "Select User", + multiple: false, + creatable: false, + api: { + url: "/api/ListGraphRequest", + data: { + Endpoint: "users", + $select: "id,displayName,userPrincipalName", + $top: 999, + $count: true, + }, + queryKey: "ListUsersAutoComplete", + dataKey: "Results", + labelField: (user) => `${user.displayName} (${user.userPrincipalName})`, + valueField: "userPrincipalName", + addedField: { + id: "id", + }, + showRefresh: true, + }, + }, + { + type: "radio", + name: "Role", + label: "Site Role", + options: [ + { label: "Members", value: "Members" }, + { label: "Owners", value: "Owners" }, + { label: "Visitors", value: "Visitors" }, + ], + }, + ], + defaultvalues: { + Role: "Members", + }, + allowResubmit: true, + multiPost: false, + category: "edit", + quickAction: true, + }, + { + label: "Remove Member", + type: "POST", + icon: , + url: "/api/ExecSetSharePointMember", + data: { + groupId: "ownerPrincipalName", + add: false, + URL: "webUrl", + SharePointType: "rootWebTemplate", + }, + confirmText: "Select the user to remove from their site role.", + relatedQueryKeys: ["site-members-*"], + category: "edit", + children: ({ formHook, row }) => { + const siteRow = Array.isArray(row) ? row[0] : row; + return ( + + `${member.Title} (${member.UserPrincipalName}) — ${member.Group}`, + valueField: "UserPrincipalName", + addedField: { + Group: "Group", + Type: "Type", + }, + dataFilter: (options) => + options.filter( + (option, index, all) => + option.value && + ["Owners", "Members", "Visitors"].includes(option.addedFields?.Group) && + all.findIndex( + (o) => + o.value === option.value && + o.addedFields?.Group === option.addedFields?.Group + ) === index + ), + showRefresh: true, + }} + /> + ); + }, + allowResubmit: true, + multiPost: false, + quickAction: true, + }, + { + label: "Remove User From Site", + type: "POST", + icon: , + url: "/api/ExecRemoveSiteUser", + data: { + SiteUrl: "webUrl", + }, + confirmText: + "Remove a user from the entire site: this removes them from every site group and direct permission grant at once. Sharing links they received are not revoked.", + relatedQueryKeys: ["site-members-*"], + category: "edit", + children: ({ formHook, row }) => { + const siteRow = Array.isArray(row) ? row[0] : row; + return ( + + `${member.Title} (${member.UserPrincipalName})${ + member.IsGuest ? " — Guest" : "" + } — ${member.Group}`, + valueField: "UserPrincipalName", + addedField: { + LoginName: "LoginName", + Type: "Type", + }, + dataFilter: (options) => + options.filter( + (option, index, all) => + option.value && + option.addedFields?.Type === "User" && + all.findIndex((o) => o.value === option.value) === index + ), + showRefresh: true, + }} + /> + ); + }, + multiPost: false, + }, + { + label: "Revoke Sharing Links", + type: "POST", + icon: , + url: "/api/ExecBulkRemoveSharingLinks", + data: { + SiteUrl: "webUrl", + }, + confirmText: + "Bulk revoke sharing links on [displayName]. This uses the sharing report cache: links created since the last sharing sync are not covered - run a sync from the Sharing Report page first for full coverage.", + category: "security", + fields: [ + { + type: "radio", + name: "Scope", + label: "Which links to revoke", + options: [ + { label: "Anonymous links only (anyone with the link)", value: "Anonymous" }, + { label: "Anonymous + external user shares", value: "External" }, + { label: "All sharing links, including internal", value: "All" }, + ], + }, + ], + defaultvalues: { + Scope: "Anonymous", + }, + multiPost: false, + }, + { + label: "Add Site Admin", + type: "POST", + icon: , + url: "/api/ExecSharePointPerms", + data: { + UPN: "ownerPrincipalName", + RemovePermission: false, + URL: "webUrl", + }, + confirmText: "Select the User to add to the Site Admins permissions", + relatedQueryKeys: ["site-members-*"], + fields: [ + { + type: "autoComplete", + name: "user", + label: "Select User", + multiple: false, + creatable: false, + api: { + url: "/api/ListGraphRequest", + data: { + Endpoint: "users", + $select: "id,displayName,userPrincipalName", + $top: 999, + $count: true, + }, + queryKey: "ListUsersAutoComplete", + dataKey: "Results", + labelField: (user) => `${user.displayName} (${user.userPrincipalName})`, + valueField: "userPrincipalName", + addedField: { + id: "id", + }, + showRefresh: true, + }, + }, + ], + multiPost: false, + category: "security", + quickAction: true, + }, + { + label: "Remove Site Admin", + type: "POST", + icon: , + url: "/api/ExecSharePointPerms", + data: { + UPN: "ownerPrincipalName", + RemovePermission: true, + URL: "webUrl", + }, + confirmText: "Select the Site Admin to remove from this site.", + fields: [ + { + type: "autoComplete", + name: "user", + label: "Select Site Admin", + multiple: false, + creatable: false, + api: { + url: "/api/ListGraphRequest", + data: { + Endpoint: "sites/[siteId]/lists/User%20Information%20List/items", + AsApp: "true", + $expand: "fields", + $filter: "fields/ContentType eq 'Person'", + }, + queryKey: "ListSiteAdminsAutoComplete", + dataKey: "Results", + labelField: (item) => + `${item.fields?.Title || "Unknown"} (${item.fields?.EMail || "No email"})`, + valueField: (item) => item.fields?.EMail || item.fields?.UserName, + showRefresh: true, + // Filter for site admins client-side (IsSiteAdmin is not indexed in SharePoint) + dataFilter: (data) => + data.filter((item) => { + const email = item.fields?.EMail; + const title = (item.fields?.Title || "").toLowerCase(); + const isSiteAdmin = item.fields?.IsSiteAdmin === true || item.fields?.IsSiteAdmin === "1" || item.fields?.IsSiteAdmin === 1; + const excludedTitles = ["system account", "sharepoint app", "nt service", "everyone"]; + const isSystemAccount = excludedTitles.some((ex) => title.includes(ex) || title.startsWith("nt ")); + return email && isSiteAdmin && !isSystemAccount; + }), + }, + }, + ], + multiPost: false, + relatedQueryKeys: ["site-members-*"], + category: "security", + quickAction: true, + }, + { + label: "Lock / Unlock Site", + type: "POST", + icon: , + url: "/api/ExecSetSiteProperty", + data: { + SiteId: "siteId", + DisplayName: "displayName", + }, + confirmText: + "Set the lock state for '[displayName]'. 'Read Only' prevents edits, 'No Access' blocks all users, and 'Unlock' restores normal access.", + fields: [ + { + type: "autoComplete", + name: "LockState", + label: "Lock State", + multiple: false, + creatable: false, + options: [ + { label: "Unlock (normal access)", value: "Unlock" }, + { label: "Read Only", value: "ReadOnly" }, + { label: "No Access", value: "NoAccess" }, + ], + required: true, + }, + ], + multiPost: false, + category: "security", + quickAction: true, + }, + { + label: "Set Sharing Policy", + type: "POST", + icon: , + url: "/api/ExecSetSiteProperty", + data: { + SiteId: "siteId", + DisplayName: "displayName", + }, + confirmText: + "Set the external sharing policy for '[displayName]'. This controls who can access content shared from this site.", + fields: [ + { + type: "autoComplete", + name: "SharingCapability", + label: "Sharing Policy", + multiple: false, + creatable: false, + options: [ + { label: "Disabled (no external sharing)", value: 0 }, + { label: "Existing external users only", value: 3 }, + { label: "New and existing external users (sign-in required)", value: 1 }, + { label: "Anyone (including anonymous guest links)", value: 2 }, + ], + required: true, + }, + ], + multiPost: false, + category: "security", + quickAction: true, + }, + { + label: "Set Default Sharing Link", + type: "POST", + icon: , + url: "/api/ExecSetSiteProperty", + data: { + SiteId: "siteId", + DisplayName: "displayName", + }, + confirmText: + "Set the default sharing link type and permission for '[displayName]'. These control what kind of link the Share dialog creates by default on this site.", + fields: [ + { + type: "autoComplete", + name: "DefaultSharingLinkType", + label: "Default Link Type", + multiple: false, + creatable: false, + options: [ + { label: "Tenant default", value: 0 }, + { label: "Direct — specific people", value: 1 }, + { label: "Internal — people in the organization", value: 2 }, + { label: "Anyone — anonymous access link", value: 3 }, + ], + required: true, + }, + { + type: "autoComplete", + name: "DefaultLinkPermission", + label: "Default Link Permission", + multiple: false, + creatable: false, + options: [ + { label: "Tenant default", value: 0 }, + { label: "View", value: 1 }, + { label: "Edit", value: 2 }, + ], + }, + { + type: "number", + name: "AnonymousLinkExpirationInDays", + label: "Anonymous Link Expiration (days, optional — overrides tenant policy)", + }, + ], + multiPost: false, + category: "security", + }, + { + label: "Restrict Access to Members", + type: "POST", + icon: , + url: "/api/ExecSetSiteProperty", + data: { + SiteId: "siteId", + DisplayName: "displayName", + }, + confirmText: + "Toggle restricted access control for '[displayName]'. When enabled, only members of the site (or its Microsoft 365 group) can access content, even if items were shared more broadly. Requires SharePoint Advanced Management licensing.", + fields: [ + { + type: "radio", + name: "RestrictedAccessControl", + label: "Restricted Access Control", + options: [ + { label: "Enable (members only)", value: true }, + { label: "Disable", value: false }, + ], + }, + ], + defaultvalues: { RestrictedAccessControl: true }, + multiPost: false, + category: "security", + }, + { + label: "Set Storage Quota", + type: "POST", + icon: , + url: "/api/ExecSetSiteProperty", + data: { + SiteId: "siteId", + DisplayName: "displayName", + }, + confirmText: + "Set the storage quota for '[displayName]'. Values are in GB. The warning level triggers a notification to site admins. Note: per-site limits only apply when the tenant uses manual site storage limits (SharePoint admin center → Settings → Site storage limits).", + fields: [ + { + type: "textField", + name: "StorageMaximumLevelGB", + label: "Maximum Storage (GB)", + required: true, + }, + { + type: "textField", + name: "StorageWarningLevelGB", + label: "Warning Level (GB, optional — defaults to 90% of max)", + }, + ], + multiPost: false, + category: "edit", + quickAction: true, + }, + { + label: "Get Live Storage", + type: "POST", + icon: , + url: "/api/ListSiteLiveStorage", + data: { + SiteId: "siteId", + DisplayName: "displayName", + }, + confirmText: + "Fetch real-time storage data for '[displayName]' directly from the SharePoint Admin API. This bypasses the usage reports cache and returns current values.", + multiPost: false, + category: "view", + quickAction: true, + }, + { + label: "Notify Site Owner", + type: "POST", + icon: , + url: "/api/ExecNotifySiteOwner", + data: { + DisplayName: "displayName", + SiteUrl: "webUrl", + OwnerEmail: "ownerPrincipalName", + StorageUsedGB: "storageUsedInGigabytes", + StorageAllocatedGB: "storageAllocatedInGigabytes", + }, + confirmText: + "Send a notification email to the owner of '[displayName]' ([ownerPrincipalName]) from the Manage365 notification mailbox.", + fields: [ + { + type: "radio", + name: "Type", + label: "Notification Type", + options: [ + { label: "Storage critical — ask owner to clean up", value: "StorageCritical" }, + { label: "Inactivity — ask if the site is still needed", value: "Inactivity" }, + { label: "Custom message", value: "Custom" }, + ], + }, + { + type: "textField", + name: "CustomMessage", + label: "Custom Message (required for Custom type)", + multiline: true, + rows: 4, + }, + ], + defaultvalues: { Type: "StorageCritical" }, + condition: (row) => !!row.ownerPrincipalName, + relatedQueryKeys: ["SharePointSiteUsage-*"], + multiPost: false, + category: "edit", + }, + { + label: "Create Team from Site", + type: "POST", + icon: , + url: "/api/ExecTeamFromGroup", + data: { + SiteId: "siteId", + DisplayName: "displayName", + }, + confirmText: + "Create a Microsoft Team for '[displayName]'? This will team-enable the existing Microsoft 365 Group behind this site, preserving the current site, membership, and content. Full Team provisioning may take a few minutes.", + multiPost: false, + condition: (row) => row.rootWebTemplate?.includes("Group"), + category: "edit", + quickAction: true, + }, + { + label: "Edit Site", + type: "POST", + icon: , + url: "/api/ExecSetSiteProperties", + confirmText: + "Edit site properties for [displayName]. Fields are prefilled with the current values.", + children: ({ formHook, row }) => ( + + ), + customDataformatter: (row, action, formData) => { + const siteRow = Array.isArray(row) ? row[0] : row; + const isGroupSite = siteRow?.rootWebTemplate === "Group"; + const v = (x) => (x && typeof x === "object" && "value" in x ? x.value : x); + const payload = { + tenantFilter: siteRow.Tenant ?? tenantFilter, + SiteUrl: siteRow.webUrl, + SharingCapability: v(formData.SharingCapability), + DefaultSharingLinkType: v(formData.DefaultSharingLinkType), + DefaultLinkPermission: v(formData.DefaultLinkPermission), + LockState: v(formData.LockState), + }; + if (!isGroupSite) { + payload.Title = formData.Title; + payload.SharingDomainRestrictionMode = v(formData.SharingDomainRestrictionMode); + payload.OverrideTenantAnonymousLinkExpirationPolicy = + !!formData.OverrideTenantAnonymousLinkExpirationPolicy; + payload.InheritVersionPolicyFromTenant = !!formData.InheritVersionPolicyFromTenant; + } + if (!isGroupSite && v(formData.SharingDomainRestrictionMode) === "AllowList") { + payload.SharingAllowedDomainList = formData.SharingAllowedDomainList; + } + if (!isGroupSite && v(formData.SharingDomainRestrictionMode) === "BlockList") { + payload.SharingBlockedDomainList = formData.SharingBlockedDomainList; + } + if (!isGroupSite && formData.OverrideTenantAnonymousLinkExpirationPolicy) { + payload.AnonymousLinkExpirationInDays = parseInt( + formData.AnonymousLinkExpirationInDays ?? 0, + 10 + ); + } + const storageMax = parseInt(formData.StorageMaximumLevel, 10); + const storageWarn = parseInt(formData.StorageWarningLevel, 10); + if (!isNaN(storageMax) && storageMax > 0) payload.StorageMaximumLevel = storageMax; + if (!isNaN(storageWarn) && storageWarn > 0) payload.StorageWarningLevel = storageWarn; + if (!isGroupSite && !formData.InheritVersionPolicyFromTenant) { + payload.ApplyToNewDocumentLibraries = true; + payload.EnableAutoExpirationVersionTrim = !!formData.EnableAutoExpirationVersionTrim; + if (!formData.EnableAutoExpirationVersionTrim) { + payload.MajorVersionLimit = parseInt(formData.MajorVersionLimit ?? 0, 10); + payload.ExpireVersionsAfterDays = parseInt(formData.ExpireVersionsAfterDays ?? 0, 10); + } + } + return payload; + }, + multiPost: false, + allowResubmit: true, + category: "edit", + }, + { + label: "Rename Site", + type: "POST", + icon: , + url: "/api/ExecSiteRename", + data: { + SiteId: "siteId", + SiteUrl: "webUrl", + DisplayName: "displayName", + }, + confirmText: + "Rename '[displayName]'. Leave a field empty to keep it unchanged. Changing the URL queues a background rename job — SharePoint creates a redirect from the old URL. For group-connected sites, the display name follows the Microsoft 365 group.", + fields: [ + { type: "textField", name: "NewTitle", label: "New Site Title (optional)" }, + { type: "textField", name: "NewUrl", label: "New Site URL (optional, full URL e.g. https://contoso.sharepoint.com/sites/newname)" }, + ], + relatedQueryKeys: ["SharePointSiteUsage-*"], + multiPost: false, + category: "edit", + }, + { + label: "Hub Site Association", + type: "POST", + icon: , + url: "/api/ExecHubSiteAssociation", + data: { + SiteUrl: "webUrl", + DisplayName: "displayName", + }, + confirmText: + "Connect '[displayName]' to a hub site, or disconnect it from its current hub. Hub association shares navigation, branding, and search scope.", + fields: [ + { + type: "radio", + name: "Disconnect", + label: "Action", + options: [ + { label: "Join a hub site", value: "false" }, + { label: "Disconnect from current hub", value: "true" }, + ], + }, + { + type: "autoComplete", + name: "HubSiteId", + label: "Hub Site", + multiple: false, + creatable: false, + api: { + url: "/api/ListHubSites", + dataKey: "Results", + labelField: (hub) => `${hub.Title} (${hub.SiteUrl})`, + valueField: "ID", + queryKey: "ListHubSites", + showRefresh: true, + }, + }, + ], + defaultvalues: { Disconnect: "false" }, + relatedQueryKeys: ["SharePointSiteUsage-*"], + multiPost: false, + category: "edit", + }, + { + label: "Set Library Permission", + type: "POST", + icon: , + url: "/api/ExecSetLibraryPermission", + confirmText: + "Grant users or groups a permission level on a document library of [displayName].", + category: "security", + children: ({ formHook, row }) => { + const siteRow = Array.isArray(row) ? row[0] : row; + return ( + <> + library.Title, + valueField: "Id", + showRefresh: true, + }} + /> + `${user.displayName} (${user.userPrincipalName})`, + valueField: "userPrincipalName", + addedField: { + id: "id", + }, + showRefresh: true, + }} + /> + + group.mail ? `${group.displayName} (${group.mail})` : group.displayName, + valueField: "id", + addedField: { + securityEnabled: "securityEnabled", + groupTypes: "groupTypes", + }, + showRefresh: true, + }} + /> + + + ); + }, + defaultvalues: { + PermissionLevel: "read", + }, + customDataformatter: (row, action, formData) => { + const siteRow = Array.isArray(row) ? row[0] : row; + return { + tenantFilter: siteRow.Tenant ?? tenantFilter, + SiteUrl: siteRow.webUrl, + ListId: formData.library?.value, + LibraryName: formData.library?.label, + PermissionLevel: formData.PermissionLevel, + Users: formData.users ?? [], + Groups: formData.groups ?? [], + }; + }, + multiPost: false, + }, + { + label: "Start Version Cleanup Job", + type: "POST", + icon: , + url: "/api/ExecSPOVersionCleanup", + data: { + SiteUrl: "webUrl", + }, + confirmText: + "Start a file version cleanup job for [displayName]. This will trim old file versions based on the selected mode.", + category: "edit", + children: ({ formHook }) => ( + <> + + + + + + + + + + ), + defaultvalues: { + BatchDeleteMode: "2", + }, + customDataformatter: (row, action, formData) => { + const formatRow = (singleRow) => ({ + tenantFilter: singleRow.Tenant ?? tenantFilter, + SiteUrl: singleRow.webUrl, + BatchDeleteMode: parseInt(formData.BatchDeleteMode, 10), + DeleteOlderThanDays: + formData.BatchDeleteMode === "0" ? parseInt(formData.DeleteOlderThanDays, 10) : -1, + MajorVersionLimit: + formData.BatchDeleteMode === "1" ? parseInt(formData.MajorVersionLimit, 10) : -1, + MajorWithMinorVersionsLimit: + formData.BatchDeleteMode === "1" + ? parseInt(formData.MajorWithMinorVersionsLimit, 10) + : -1, + }); + // When multiple rows are selected, row is an array. Returning an array + // makes CippApiDialog send one request per row (bulk request mode). + return Array.isArray(row) ? row.map(formatRow) : formatRow(row); + }, + multiPost: false, + }, + { + label: "Check Cleanup Job Status", + icon: , + customComponent: (row, { drawerVisible, setDrawerVisible }) => ( + + ), + multiPost: false, + category: "view", + }, + { + label: "Recycle Bin", + icon: , + customComponent: (row, { drawerVisible, setDrawerVisible }) => ( + + ), + multiPost: false, + category: "view", + }, + { + // Read access is enough to open this: the dialog gates every change on write access, + // so a read-only admin can still inspect who has what. + label: "Manage Permissions", + icon: , + customComponent: (row, { drawerVisible, setDrawerVisible }) => ( + + ), + multiPost: false, + hideBulk: true, + category: "security", + }, + { + // Answers "does this person have access, and how" rather than "who holds permissions". + label: "Check User Access", + icon: , + customComponent: (row, { drawerVisible, setDrawerVisible }) => ( + + ), + multiPost: false, + category: "security", + }, + { + label: "Delete Site", + type: "POST", + icon: , + url: "/api/DeleteSharepointSite", + data: { + SiteId: "siteId", + DisplayName: "displayName", + }, + confirmText: + "Are you sure you want to delete this SharePoint site? This action cannot be undone. The site will be moved to the recycle bin for 93 days before permanent deletion. Deletion runs in the background—for large sites it may take several minutes; you can continue using the app.", + color: "error", + multiPost: false, + category: "danger", + quickAction: true, + }, + ], + [tenantFilter] + ); +}; diff --git a/frontend/src/components/CippComponents/CippSiteRecycleBinDialog.jsx b/frontend/src/components/CippComponents/CippSiteRecycleBinDialog.jsx index 9e3f4b5a7f..ee02182d40 100644 --- a/frontend/src/components/CippComponents/CippSiteRecycleBinDialog.jsx +++ b/frontend/src/components/CippComponents/CippSiteRecycleBinDialog.jsx @@ -20,6 +20,7 @@ export const CippSiteRecycleBinDialog = ({ const actions = [ { label: 'Restore Item', + category: "manage", type: 'POST', icon: , url: '/api/ExecRestoreRecycleBinItems', diff --git a/frontend/src/components/CippComponents/CippTableDialog.jsx b/frontend/src/components/CippComponents/CippTableDialog.jsx index d1c2e80766..c3d9c804da 100644 --- a/frontend/src/components/CippComponents/CippTableDialog.jsx +++ b/frontend/src/components/CippComponents/CippTableDialog.jsx @@ -14,6 +14,7 @@ export const CippTableDialog = (props) => { maxWidth="lg" onClose={createDialog.handleClose} open={createDialog.open} + disableRestoreFocus > {title} diff --git a/frontend/src/components/CippComponents/CippTablePage.jsx b/frontend/src/components/CippComponents/CippTablePage.jsx index af4881a97b..a229c316c7 100644 --- a/frontend/src/components/CippComponents/CippTablePage.jsx +++ b/frontend/src/components/CippComponents/CippTablePage.jsx @@ -4,7 +4,6 @@ import { CippDataTable } from "../CippTable/CippDataTable"; import { useSettings } from "../../hooks/use-settings"; import { useTableViewMode } from "../../hooks/use-breakpoint"; import { CippHead } from "./CippHead"; -import { useState, useEffect } from "react"; export const CippTablePage = (props) => { const { @@ -27,6 +26,9 @@ export const CippTablePage = (props) => { filters, initialFilters, sx = {}, + spacing = 2, + dataFreshnessField, + apiDataFilter, ...other } = props; const tenant = useSettings().currentTenant; @@ -56,11 +58,13 @@ export const CippTablePage = (props) => { url: apiUrl, data: { tenantFilter: tenant, ...apiData }, dataKey: apiDataKey, + ...(apiDataFilter && { dataFilter: apiDataFilter }), }} columns={columns} columnsFromApi={columnsFromApi} offCanvas={offCanvas} filters={activeFilters} + dataFreshnessField={dataFreshnessField} onChange={onChange} {...other} /> @@ -71,7 +75,7 @@ export const CippTablePage = (props) => { - + {tableFilter} {tenantInTitle && (!tenant || tenant === null) && ( diff --git a/frontend/src/components/CippComponents/CippTemplateCatalog.jsx b/frontend/src/components/CippComponents/CippTemplateCatalog.jsx index 73dc1b71e2..7057156bce 100644 --- a/frontend/src/components/CippComponents/CippTemplateCatalog.jsx +++ b/frontend/src/components/CippComponents/CippTemplateCatalog.jsx @@ -623,8 +623,10 @@ export const CippTemplateCatalog = ({ ] ) - const warnings = Array.isArray(catalog.data?.Metadata?.Warnings) - ? catalog.data.Metadata.Warnings + // When every repository fails the catalog is an error response that still carries the warnings + const catalogBody = catalog.data ?? catalog.error?.response?.data + const warnings = Array.isArray(catalogBody?.Metadata?.Warnings) + ? catalogBody.Metadata.Warnings : [] const toOptions = (values, labelFn) => diff --git a/frontend/src/components/CippComponents/CippTemplateEditor.jsx b/frontend/src/components/CippComponents/CippTemplateEditor.jsx index 65e2aeff4f..bcbbd10022 100644 --- a/frontend/src/components/CippComponents/CippTemplateEditor.jsx +++ b/frontend/src/components/CippComponents/CippTemplateEditor.jsx @@ -313,4 +313,4 @@ const CippTemplateEditor = ({ ); }; -export default CippTemplateEditor; \ No newline at end of file +export default CippTemplateEditor; diff --git a/frontend/src/components/CippComponents/CippTenantAllowBlockListTemplateDrawer.jsx b/frontend/src/components/CippComponents/CippTenantAllowBlockListTemplateDrawer.jsx index 5b566fe6a2..4c40efba39 100644 --- a/frontend/src/components/CippComponents/CippTenantAllowBlockListTemplateDrawer.jsx +++ b/frontend/src/components/CippComponents/CippTenantAllowBlockListTemplateDrawer.jsx @@ -23,41 +23,14 @@ export const CippTenantAllowBlockListTemplateDrawer = ({ buttonText = 'Add Template', requiredPermissions = [], PermissionButton = Button, - editData = null, drawerVisible: controlledDrawerVisible, - setDrawerVisible: controlledSetDrawerVisible, }) => { - const [internalDrawerVisible, internalSetDrawerVisible] = useState(false) - const drawerVisible = - controlledDrawerVisible !== undefined ? controlledDrawerVisible : internalDrawerVisible - const setDrawerVisible = - controlledSetDrawerVisible !== undefined ? controlledSetDrawerVisible : internalSetDrawerVisible - - const isEditMode = !!editData - + const [drawerVisible, setDrawerVisible] = useState(false) const formControl = useForm({ mode: 'onChange', defaultValues, }) - useEffect(() => { - if (editData && drawerVisible) { - formControl.reset({ - templateName: editData.templateName || '', - entries: Array.isArray(editData.entries) - ? editData.entries.join(', ') - : editData.entries || '', - notes: editData.notes || '', - listType: editData.listType ? { label: editData.listType, value: editData.listType } : null, - listMethod: editData.listMethod - ? { label: editData.listMethod, value: editData.listMethod } - : null, - NoExpiration: editData.NoExpiration || false, - RemoveAfter: editData.RemoveAfter || false, - }) - } - }, [editData, drawerVisible, formControl]) - const { isValid } = useFormState({ control: formControl.control }) const noExpiration = useWatch({ control: formControl.control, name: 'NoExpiration' }) @@ -225,18 +198,10 @@ export const CippTenantAllowBlockListTemplateDrawer = ({ RemoveAfter: values.RemoveAfter, } - if (isEditMode && editData?.GUID) { - payload.GUID = editData.GUID - saveTemplate.mutate({ - url: '/api/EditTenantAllowBlockListTemplate', - data: payload, - }) - } else { - saveTemplate.mutate({ - url: '/api/AddTenantAllowBlockListTemplate', - data: payload, - }) - } + saveTemplate.mutate({ + url: '/api/AddTenantAllowBlockListTemplate', + data: payload, + }) }) const handleCloseDrawer = () => { @@ -246,7 +211,7 @@ export const CippTenantAllowBlockListTemplateDrawer = ({ return ( <> - {!isEditMode && controlledDrawerVisible === undefined && ( + {controlledDrawerVisible === undefined && ( setDrawerVisible(true)} @@ -257,11 +222,7 @@ export const CippTenantAllowBlockListTemplateDrawer = ({ )} + } + sx={{ pb: 1 }} + /> + + {renderBody()} + + ) +} diff --git a/frontend/src/components/CippComponents/SetupGatePage.jsx b/frontend/src/components/CippComponents/SetupGatePage.jsx index 18f0ef8fa6..3b6bb7ffbb 100644 --- a/frontend/src/components/CippComponents/SetupGatePage.jsx +++ b/frontend/src/components/CippComponents/SetupGatePage.jsx @@ -4,6 +4,7 @@ import { useRouter } from 'next/router' import { Alert, Box, Container, Stack, Typography } from '@mui/material' import { useQueryClient } from '@tanstack/react-query' import { ApiGetCall } from '../../api/ApiCall' +import { Logo } from '../logo' const OnboardingWizardPage = dynamic(() => import('../CippWizard/OnboardingWizardPage.jsx'), { ssr: false, @@ -56,18 +57,18 @@ const SetupGatePage = () => { - - Welcome to CIPP + + Welcome to Manage365 - CIPP needs to be connected to your Microsoft tenants before it can be used. Complete + Manage365 needs to be connected to your Microsoft tenants before it can be used. Complete this setup wizard to unlock the rest of the application. { purgePersistedCache() diff --git a/frontend/src/components/CippComponents/SetupPendingPage.jsx b/frontend/src/components/CippComponents/SetupPendingPage.jsx index 8bb530114d..756f23368c 100644 --- a/frontend/src/components/CippComponents/SetupPendingPage.jsx +++ b/frontend/src/components/CippComponents/SetupPendingPage.jsx @@ -12,8 +12,8 @@ const SetupPendingPage = () => { return ( { if (isErrorState) { return ( - CIPP Single Sign-On Setup Incomplete + Manage365 Single Sign-On Setup Incomplete The CIPP-SSO app registration could not be set up automatically, so the migration is @@ -116,17 +116,17 @@ export const SsoMigrationDialog = ({ meData }) => { return ( - Prepare for CIPP Single Sign-On + Prepare for Manage365 Single Sign-On {!submitted ? ( <> - CIPP will soon be moving to a dedicated Single Sign-On model, giving you full control + Manage365 will soon be moving to a dedicated Single Sign-On model, giving you full control over Conditional Access policies, MFA requirements, and session management for your - CIPP users. + Manage365 users. - To get ready, CIPP needs to create an app registration in your tenant called + To get ready, Manage365 needs to create an app registration in your tenant called CIPP-SSO with minimal permissions (OpenID, Profile, Email, Offline Access only). This won't change how you log in today — it just prepares your tenant for when diff --git a/frontend/src/components/CippComponents/TenantInfoCard.jsx b/frontend/src/components/CippComponents/TenantInfoCard.jsx index 3c256d4612..d8fed34526 100644 --- a/frontend/src/components/CippComponents/TenantInfoCard.jsx +++ b/frontend/src/components/CippComponents/TenantInfoCard.jsx @@ -19,64 +19,52 @@ export const TenantInfoCard = ({ data, isLoading, tenantFilter }) => { Tenant } - sx={{ pb: 1.5 }} + sx={{ py: 1, px: 1.5 }} /> - - + + - + Name {isLoading ? ( - + ) : ( - + {data?.displayName || "Not Available"} )} - + Tenant ID - + {isLoading ? ( - + ) : data?.id ? ( ) : ( - + Not Available )} - + Primary Domain - + {isLoading ? ( - + ) : data?.verifiedDomains?.find((d) => d.isDefault)?.name ? ( d.isDefault).name} type="chip" /> ) : ( - + Not Available )} diff --git a/frontend/src/components/CippComponents/quarantine/CippQuarantineBulkToolbar.jsx b/frontend/src/components/CippComponents/quarantine/CippQuarantineBulkToolbar.jsx new file mode 100644 index 0000000000..877a331648 --- /dev/null +++ b/frontend/src/components/CippComponents/quarantine/CippQuarantineBulkToolbar.jsx @@ -0,0 +1,125 @@ +import { Alert, Button, Stack, Typography } from "@mui/material"; +import { Block, Delete, Done, DoneAll, FileDownload, Report } from "@mui/icons-material"; +import { QUARANTINE_ACTION_WARNINGS } from "./quarantineConstants"; + +const confirmBulkAction = (count, actionLabel) => { + if (count > 50) { + return window.confirm( + `WARNING: You are about to ${actionLabel} ${count} messages. This may take a while and could have significant impact. Continue?` + ); + } + if (count > 10) { + return window.confirm(`You are about to ${actionLabel} ${count} messages. Are you sure?`); + } + return window.confirm(`${actionLabel} ${count} selected message(s)?`); +}; + +const CippQuarantineBulkToolbar = ({ + selectedRows = [], + onRelease, + onDeny, + onReleaseAllow, + onDelete, + onSubmitToMicrosoft, + onBlockSenders, + onExportSelected, + isProcessing = false, +}) => { + if (!selectedRows.length) return null; + + const count = selectedRows.length; + + const handle = (callback, label, warning) => { + if (!confirmBulkAction(count, label)) return; + if (warning && !window.confirm(warning)) return; + callback?.(selectedRows); + }; + + return ( + + + + {count} selected: + + + + + + + + + + + Bulk actions affect {count} quarantined message(s). Review selections carefully before + proceeding. + + + ); +}; + +export default CippQuarantineBulkToolbar; diff --git a/frontend/src/components/CippComponents/quarantine/CippQuarantineDetailPanel.jsx b/frontend/src/components/CippComponents/quarantine/CippQuarantineDetailPanel.jsx new file mode 100644 index 0000000000..d069e6f232 --- /dev/null +++ b/frontend/src/components/CippComponents/quarantine/CippQuarantineDetailPanel.jsx @@ -0,0 +1,207 @@ +import { useEffect, useState } from "react"; +import { + Alert, + Box, + Button, + Chip, + CircularProgress, + Divider, + Paper, + Stack, + Typography, +} from "@mui/material"; +import { ContentCopy, Email, Security } from "@mui/icons-material"; +import { ApiGetCall } from "../../../api/ApiCall"; +import { getCippFormatting } from "../../../utils/get-cipp-formatting"; +import { + getQuarantineReasonLabel, + getReleaseStatusLabel, + getSenderDisplay, + QUARANTINE_ACTION_WARNINGS, + RELEASE_STATUS_COLOR_MAP, +} from "./quarantineConstants"; + +const DetailRow = ({ label, value }) => { + if (!value) return null; + return ( + + + {label} + + + {value} + + + ); +}; + +const AuthSummaryChips = ({ summary }) => { + if (!summary) return null; + const items = [ + { label: "SPF", result: summary.SPF?.result }, + { label: "DKIM", result: summary.DKIM?.result }, + { label: "DMARC", result: summary.DMARC?.result }, + { label: "CompAuth", result: summary.CompAuth?.result }, + ].filter((item) => item.result && item.result !== "Unknown"); + if (!items.length) return null; + + return ( + + {items.map((item) => ( + + ))} + + ); +}; + +const CippQuarantineDetailPanel = ({ row, tenantFilter, onPreview, onRunTrace }) => { + const [detail, setDetail] = useState(row); + const identity = row?.Identity; + + const detailApi = ApiGetCall({ + url: "/api/GetMailQuarantineMessage", + data: { tenantFilter, Identity: identity }, + waiting: !!identity && !!tenantFilter, + queryKey: `GetMailQuarantineMessage-${identity}`, + }); + + useEffect(() => { + if (!detailApi.isSuccess) { + setDetail(row); + return; + } + + const results = detailApi.data?.Results; + if (results && typeof results === "object" && !Array.isArray(results)) { + setDetail({ ...row, ...results }); + } else if (typeof results === "string" && results.trim()) { + setDetail(row); + } else { + setDetail(row); + } + }, [detailApi.isSuccess, detailApi.data, row]); + + if (!row) { + return ( + + Select a quarantined message to view details. + + ); + } + + const status = detail?.ReleaseStatus; + const statusColor = RELEASE_STATUS_COLOR_MAP[status] || "default"; + + return ( + + + + + + {detail?.Subject || "No Subject"} + + + + + {getSenderDisplay(detail)} → {detail?.RecipientAddress} + + + + {detailApi.isFetching && ( + + + Loading message metadata... + + )} + + {detailApi.isError && ( + + Could not load extended metadata. Showing list data only. + + )} + + {detailApi.isSuccess && + typeof detailApi.data?.Results === "string" && + detailApi.data.Results.trim() && ( + {detailApi.data.Results} + )} + + + + Message Details + + + + + + + + + + + + + + + + + + + {detailApi.data?.AuthSummary && ( + <> + + + + Authentication Results + + + + + )} + + }> + Sending IP, URL reputation, and attachment sandbox details are available via message trace + and EML preview when exposed by Exchange Online. They are not returned in the quarantine + list API. + + + + {onPreview && ( + + )} + {onRunTrace && detail?.MessageId && ( + + )} + + + + + {QUARANTINE_ACTION_WARNINGS.release} + + + ); +}; + +export default CippQuarantineDetailPanel; diff --git a/frontend/src/components/CippComponents/quarantine/CippQuarantineFilterPanel.jsx b/frontend/src/components/CippComponents/quarantine/CippQuarantineFilterPanel.jsx new file mode 100644 index 0000000000..8056ce82b8 --- /dev/null +++ b/frontend/src/components/CippComponents/quarantine/CippQuarantineFilterPanel.jsx @@ -0,0 +1,298 @@ +import { useState } from "react"; +import { Button, Collapse, Grid, Stack, Typography } from "@mui/material"; +import { ClearAll, ExpandLess, ExpandMore, Search } from "@mui/icons-material"; +import CippFormComponent from "../CippFormComponent"; +import CippButtonCard from "../../CippCards/CippButtonCard"; +import { + POLICY_TYPE_OPTIONS, + QUARANTINE_DAYS_OPTIONS, + QUARANTINE_TIME_PRESETS, + QUARANTINE_TYPE_OPTIONS, + RELEASE_STATUS_OPTIONS, +} from "./quarantineConstants"; + +const isIPAddress = { + validate: (value) => + !value || + /^(25[0-5]|2[0-4]\d|[01]?\d\d?)\.(25[0-5]|2[0-4]\d|[01]?\d\d?)\.(25[0-5]|2[0-4]\d|[01]?\d\d?)\.(25[0-5]|2[0-4]\d|[01]?\d\d?)$/.test( + value + ) || + /^([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$/.test(value) || + "Invalid IP address", +}; + +const CippQuarantineFilterPanel = ({ + formControl, + onSearch, + onClear, + onPreset, + activePreset, + showTraceFilters = false, + disabled = false, + title = "Search Quarantine", +}) => { + const [showAdvanced, setShowAdvanced] = useState(false); + const isMessageIdSet = !!formControl.watch("messageId"); + + return ( + + + + Quick ranges: + + {QUARANTINE_TIME_PRESETS.map((preset) => ( + + ))} + + + + + + + + {formControl.watch("dateFilter") === "relative" && ( + + + + )} + {formControl.watch("dateFilter") === "startEnd" && ( + <> + + + + + + + + )} + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + {showTraceFilters && ( + <> + + + + + + + + + + + )} + + + + + + + + + + + + ); +}; + +export default CippQuarantineFilterPanel; diff --git a/frontend/src/components/CippComponents/quarantine/CippQuarantineGrid.jsx b/frontend/src/components/CippComponents/quarantine/CippQuarantineGrid.jsx new file mode 100644 index 0000000000..a71acf634d --- /dev/null +++ b/frontend/src/components/CippComponents/quarantine/CippQuarantineGrid.jsx @@ -0,0 +1,101 @@ +import { Chip } from "@mui/material"; +import { getCippFormatting } from "../../../utils/get-cipp-formatting"; +import { + getQuarantineReasonLabel, + getReleaseStatusLabel, + getSenderDisplay, + RELEASE_STATUS_COLOR_MAP, +} from "./quarantineConstants"; + +export const buildQuarantineColumns = ({ showTenant = false } = {}) => { + const columns = [ + { + header: "Time Received", + accessorKey: "ReceivedTime", + Cell: ({ row }) => getCippFormatting(row.original.ReceivedTime, "ReceivedTime"), + enableSorting: true, + }, + { + header: "Subject", + accessorKey: "Subject", + enableSorting: true, + }, + { + header: "Sender", + accessorFn: (row) => getSenderDisplay(row), + enableSorting: true, + }, + { + header: "Quarantine Reason", + accessorFn: (row) => getQuarantineReasonLabel(row), + enableSorting: true, + }, + { + header: "Recipient", + accessorKey: "RecipientAddress", + enableSorting: true, + }, + { + header: "Sender Address", + accessorKey: "SenderAddress", + enableSorting: true, + }, + { + header: "Release Status", + accessorKey: "ReleaseStatus", + enableSorting: true, + Cell: ({ row }) => { + const status = row.original.ReleaseStatus; + return ( + + ); + }, + }, + { + header: "Policy Type", + accessorKey: "PolicyType", + enableSorting: true, + }, + { + header: "Expiration", + accessorKey: "Expires", + Cell: ({ row }) => getCippFormatting(row.original.Expires, "Expires"), + enableSorting: true, + }, + { + header: "Policy Name", + accessorKey: "PolicyName", + enableSorting: true, + }, + ]; + + if (showTenant) { + columns.push({ + header: "Tenant", + accessorKey: "Tenant", + enableSorting: true, + }); + } + + return columns; +}; + +export const QUARANTINE_SIMPLE_COLUMNS = [ + "ReceivedTime", + "Subject", + "SenderAddress", + "Type", + "RecipientAddress", + "ReleaseStatus", + "PolicyType", + "Expires", + "PolicyName", + "Tenant", +]; + +export default buildQuarantineColumns; diff --git a/frontend/src/components/CippComponents/quarantine/buildQuarantineActions.js b/frontend/src/components/CippComponents/quarantine/buildQuarantineActions.js new file mode 100644 index 0000000000..4a73923fa0 --- /dev/null +++ b/frontend/src/components/CippComponents/quarantine/buildQuarantineActions.js @@ -0,0 +1,278 @@ +import { Block, CheckCircle, ContentCopy, Done, DoneAll } from "@mui/icons-material"; +import { EyeIcon, DocumentTextIcon } from "@heroicons/react/24/outline"; +import { QUARANTINE_ACTION_WARNINGS } from "./quarantineConstants"; + +const summarizeSenderAddresses = (senders, limit = 5) => { + const preview = senders.slice(0, limit).join(", "); + if (senders.length > limit) { + return `${preview}, and ${senders.length - limit} more`; + } + return preview; +}; + +export const handleBulkBlockSenders = ({ + rows, + tenantFilter, + mutate, + dispatch, + showToast, + sourceLabel = "Quarantine Management", + onComplete, +}) => { + const uniqueSenders = [ + ...new Set(rows.map((row) => row.SenderAddress?.trim()).filter(Boolean)), + ]; + const missingCount = rows.filter((row) => !row.SenderAddress?.trim()).length; + + if (!uniqueSenders.length) { + dispatch( + showToast({ + message: "No sender addresses were found in the selected rows.", + title: "Block Senders", + }) + ); + return; + } + + const confirmLines = [ + `Block ${uniqueSenders.length} unique sender address(es)?`, + "", + summarizeSenderAddresses(uniqueSenders), + ]; + if (missingCount > 0) { + confirmLines.push( + "", + `${missingCount} selected row(s) have no sender address and will be skipped.` + ); + } + confirmLines.push("", QUARANTINE_ACTION_WARNINGS.blockSender, "Continue?"); + if (!window.confirm(confirmLines.join("\n"))) { + return; + } + + mutate( + { + url: "/api/AddTenantAllowBlockList", + data: { + tenantID: tenantFilter, + entries: uniqueSenders, + listType: "Sender", + listMethod: "Block", + notes: `Blocked via ${sourceLabel} bulk action`, + NoExpiration: true, + }, + }, + { + onSuccess: (response) => { + const resultMessages = Array.isArray(response?.data?.Results) + ? response.data.Results + : [response?.data?.Results].filter(Boolean); + const failures = resultMessages.filter((message) => + String(message).toLowerCase().includes("failed") + ); + + if (failures.length) { + dispatch( + showToast({ + message: + failures.length === resultMessages.length + ? failures.join(" ") + : `Blocked ${uniqueSenders.length - failures.length} of ${uniqueSenders.length} sender(s). ${failures.join(" ")}`, + title: failures.length === resultMessages.length ? "Block Senders Failed" : "Partial Success", + ...(failures.length === resultMessages.length ? { toastError: { message: failures.join(" ") } } : {}), + }) + ); + } else { + dispatch( + showToast({ + message: `Blocked ${uniqueSenders.length} sender address(es).`, + title: "Block Senders", + }) + ); + } + onComplete?.(); + }, + onError: (error) => { + dispatch( + showToast({ + message: error?.response?.data?.Results || error?.message || "Failed to block senders.", + title: "Block Senders Failed", + toastError: error, + }) + ); + }, + } + ); +}; + +export const buildQuarantineActions = ({ + tenantFilter, + onPreview, + onViewTrace, + onViewTimeline, + includeExplorerLink = false, +}) => { + const actions = [ + { + label: "View Message", + noConfirm: true, + customFunction: onPreview, + icon: , + category: "view", + }, + ]; + + if (onViewTimeline) { + actions.push({ + label: "View Delivery Timeline", + noConfirm: true, + customFunction: onViewTimeline, + icon: , + category: "view", + }); + } + + if (onViewTrace) { + actions.push({ + label: "View Message Trace", + noConfirm: true, + customFunction: onViewTrace, + icon: , + category: "view", + }); + } + + if (includeExplorerLink) { + actions.push({ + label: "View in Explorer", + noConfirm: true, + link: `https://security.microsoft.com/realtimereportsv3?tid=${tenantFilter}&dltarget=Explorer&dlstorage=Url&viewid=allemail&query-NetworkMessageId=[MessageId]`, + icon: , + category: "view", + }); + } + + actions.push( + { + label: "Release", + type: "POST", + url: "/api/ExecQuarantineManagement", + multiPost: true, + data: { Identity: "Identity", Type: "!Release" }, + confirmText: `${QUARANTINE_ACTION_WARNINGS.release} Continue?`, + icon: , + condition: (row) => row.ReleaseStatus !== "RELEASED", + category: "manage", + }, + { + label: "Deny", + type: "POST", + url: "/api/ExecQuarantineManagement", + data: { Identity: "Identity", Type: "!Deny", RecipientAddress: "RecipientAddress" }, + confirmText: "Are you sure you want to deny this message?", + icon: , + condition: (row) => row.ReleaseStatus !== "DENIED", + category: "security", + }, + { + label: "Release & Allow Sender", + type: "POST", + url: "/api/ExecQuarantineManagement", + data: { Identity: "Identity", Type: "!Release", AllowSender: true }, + confirmText: `${QUARANTINE_ACTION_WARNINGS.allowSender} Continue?`, + icon: , + condition: (row) => row.ReleaseStatus !== "RELEASED", + category: "security", + }, + { + label: "Release & Add Allow Entry", + type: "POST", + url: "/api/ExecQuarantineManagement", + data: { Identity: "Identity", Type: "!Release", AddAllowEntry: true }, + confirmText: `${QUARANTINE_ACTION_WARNINGS.allowSender} Continue?`, + icon: , + condition: (row) => row.ReleaseStatus !== "RELEASED", + category: "security", + }, + { + label: "Submit to Microsoft", + type: "POST", + url: "/api/ExecQuarantineManagement", + data: { Identity: "Identity", Type: "!Release", ReportFalsePositive: true }, + confirmText: `${QUARANTINE_ACTION_WARNINGS.submitToMicrosoft} Continue?`, + icon: , + condition: (row) => row.ReleaseStatus !== "RELEASED", + category: "security", + }, + { + label: "Delete", + type: "POST", + url: "/api/ExecQuarantineManagement", + data: { Identity: "Identity", Type: "!Delete" }, + confirmText: `${QUARANTINE_ACTION_WARNINGS.delete} Continue?`, + icon: , + category: "security", + }, + { + label: "Allow Sender", + type: "POST", + url: "/api/AddTenantAllowBlockList", + data: { + tenantID: tenantFilter, + entries: "SenderAddress", + listType: "!Sender", + listMethod: "!Allow", + notes: "!Allowed via Quarantine Management", + RemoveAfter: true, + }, + confirmText: `${QUARANTINE_ACTION_WARNINGS.allowSender} Continue?`, + icon: , + category: "security", + }, + { + label: "Allow Sender Domain", + type: "POST", + url: "/api/ExecQuarantineManagement", + data: { Identity: "Identity", Type: "!AllowDomain" }, + confirmText: `${QUARANTINE_ACTION_WARNINGS.allowDomain} Continue?`, + icon: , + category: "security", + }, + { + label: "Block Sender", + type: "POST", + url: "/api/AddTenantAllowBlockList", + data: { + tenantID: tenantFilter, + entries: "SenderAddress", + listType: "!Sender", + listMethod: "!Block", + notes: "!Blocked via Quarantine Management", + NoExpiration: true, + }, + confirmText: `${QUARANTINE_ACTION_WARNINGS.blockSender} Continue?`, + icon: , + category: "security", + }, + { + label: "Block Sender Domain", + type: "POST", + url: "/api/ExecQuarantineManagement", + data: { Identity: "Identity", Type: "!BlockDomain" }, + confirmText: `${QUARANTINE_ACTION_WARNINGS.blockDomain} Continue?`, + icon: , + category: "security", + }, + { + label: "Copy Message ID", + noConfirm: true, + customFunction: (row) => navigator.clipboard.writeText(row.MessageId || row.Identity || ""), + icon: , + category: "view", + } + ); + + return actions; +}; + +export default buildQuarantineActions; diff --git a/frontend/src/components/CippComponents/quarantine/index.js b/frontend/src/components/CippComponents/quarantine/index.js new file mode 100644 index 0000000000..d4880b9f19 --- /dev/null +++ b/frontend/src/components/CippComponents/quarantine/index.js @@ -0,0 +1,9 @@ +import { buildQuarantineActions } from "./buildQuarantineActions"; + +export { default as CippQuarantineBulkToolbar } from "./CippQuarantineBulkToolbar"; +export { default as CippQuarantineDetailPanel } from "./CippQuarantineDetailPanel"; +export { default as CippQuarantineFilterPanel } from "./CippQuarantineFilterPanel"; +export { default as buildQuarantineColumns, QUARANTINE_SIMPLE_COLUMNS } from "./CippQuarantineGrid"; +export { buildQuarantineActions, handleBulkBlockSenders } from "./buildQuarantineActions"; +export * from "./quarantineConstants"; +export { default as useQuarantineFilters } from "./useQuarantineFilters"; diff --git a/frontend/src/components/CippComponents/quarantine/quarantineConstants.js b/frontend/src/components/CippComponents/quarantine/quarantineConstants.js new file mode 100644 index 0000000000..7a07418280 --- /dev/null +++ b/frontend/src/components/CippComponents/quarantine/quarantineConstants.js @@ -0,0 +1,169 @@ +export const QUARANTINE_DAYS_OPTIONS = [ + { label: "Last 24 hours", value: 1 }, + { label: "Last 7 days", value: 7 }, + { label: "Last 30 days", value: 30 }, +]; + +export const QUARANTINE_TIME_PRESETS = [ + { key: "24h", label: "Last 24 hours", days: 1 }, + { key: "7d", label: "Last 7 days", days: 7 }, + { key: "30d", label: "Last 30 days", days: 30 }, +]; + +export const QUARANTINE_TYPE_OPTIONS = [ + { label: "Spam", value: "Spam" }, + { label: "Bulk", value: "Bulk" }, + { label: "Phish", value: "Phish" }, + { label: "High Confidence Phish", value: "HighConfPhish" }, + { label: "Malware", value: "Malware" }, + { label: "Transport Rule", value: "TransportRule" }, + { label: "Data Loss Prevention", value: "DataLossPrevention" }, +]; + +export const RELEASE_STATUS_OPTIONS = [ + { label: "Not Released", value: "NOTRELEASED" }, + { label: "Released", value: "RELEASED" }, + { label: "Release Requested", value: "REQUESTED" }, + { label: "Denied", value: "DENIED" }, + { label: "Failed", value: "ERROR" }, + { label: "Approved", value: "APPROVED" }, + { label: "Preparing to Release", value: "PREPARINGTORELEASE" }, +]; + +export const POLICY_TYPE_OPTIONS = [ + { label: "Anti-spam policy", value: "HostedContentFilterPolicy" }, + { label: "Anti-phishing policy", value: "AntiPhishPolicy" }, + { label: "Anti-malware policy", value: "AntiMalwarePolicy" }, + { label: "Safe attachments", value: "SafeAttachmentPolicy" }, + { label: "Transport rule", value: "ExchangeTransportRule" }, + { label: "DLP rule", value: "DataLossPreventionRule" }, +]; + +export const RELEASE_STATUS_COLOR_MAP = { + RELEASED: "success", + DENIED: "error", + NOTRELEASED: "warning", + REQUESTED: "info", + ERROR: "error", + APPROVED: "success", + PREPARINGTORELEASE: "info", +}; + +export const RELEASE_STATUS_LABELS = { + RELEASED: "Released", + DENIED: "Denied", + NOTRELEASED: "Not Released", + REQUESTED: "Release Requested", + ERROR: "Failed", + APPROVED: "Approved", + PREPARINGTORELEASE: "Preparing to Release", +}; + +export const QUARANTINE_ACTION_WARNINGS = { + allowSender: + "Adding a sender to the tenant allow list may allow future messages from that sender to bypass some protections. Prefer allowing a specific sender over a whole domain where possible.", + allowDomain: + "Adding a sender domain to the allow list may allow future malicious messages from that domain to bypass some protections. Prefer allowing a specific sender where possible.", + blockSender: "Blocking this sender will reject future messages from this address for all users in the tenant.", + blockDomain: + "Blocking this domain will reject future messages from any address at this domain for all users in the tenant.", + release: "Releasing this message will deliver it to the original recipient(s).", + delete: "Deleting removes the message from quarantine permanently. This cannot be undone.", + submitToMicrosoft: + "This submits the message to Microsoft for review as a potential false positive while releasing it.", +}; + +export const getReleaseStatusLabel = (status) => + RELEASE_STATUS_LABELS[status] || status || "Unknown"; + +export const getQuarantineReasonLabel = (row) => row?.QuarantineReason || row?.Type || "Unknown"; + +export const getSenderDisplay = (row) => row?.SenderName || row?.SenderAddress || "Unknown"; + +const serializeArrayFilterForGet = (value) => { + if (!value) return undefined; + if (Array.isArray(value)) { + const normalized = value + .map((item) => (typeof item === "object" ? item?.value ?? item?.label : item)) + .filter(Boolean); + return normalized.length ? normalized.join(",") : undefined; + } + return value; +}; + +export const buildQuarantineSearchPayload = (values, tenantFilter, overrides = {}) => { + const merged = { ...values, ...overrides }; + const data = { tenantFilter }; + + if (merged.messageId) { + data.messageId = merged.messageId; + return data; + } + + if (merged.sender?.length) data.sender = merged.sender; + if (merged.recipient?.length) data.recipient = merged.recipient; + if (merged.status?.length) data.status = merged.status[0]?.value ?? merged.status[0]; + if (merged.fromIP) data.fromIP = merged.fromIP; + if (merged.toIP) data.toIP = merged.toIP; + if (merged.subject) data.subject = merged.subject; + if (merged.subjectExact) data.subjectExact = merged.subjectExact; + if (merged.senderDomain) data.senderDomain = merged.senderDomain; + if (merged.recipientDomain) data.recipientDomain = merged.recipientDomain; + if (merged.policyName) data.policyName = merged.policyName; + + if (merged.quarantineType?.length) { + data.quarantineType = merged.quarantineType.map((item) => item?.value ?? item); + } + if (merged.releaseStatus?.length) { + data.releaseStatus = merged.releaseStatus.map((item) => item?.value ?? item); + } + if (merged.policyTypes?.length) { + data.policyTypes = merged.policyTypes.map((item) => item?.value ?? item); + } + + if (merged.dateFilter === "relative") { + data.days = merged.days?.value ?? merged.days ?? 7; + } else { + data.startDate = merged.startDate; + data.endDate = merged.endDate; + } + + return data; +}; + +export const buildQuarantineListQuery = (filters, tenantFilter) => { + const payload = buildQuarantineSearchPayload(filters, tenantFilter); + const { quarantineType, releaseStatus, policyTypes, ...rest } = payload; + + return { + tenantFilter, + manualPagination: true, + pageSize: 100, + days: rest.days ?? 7, + ...rest, + ...(quarantineType ? { quarantineType: serializeArrayFilterForGet(quarantineType) } : {}), + ...(releaseStatus ? { releaseStatus: serializeArrayFilterForGet(releaseStatus) } : {}), + ...(policyTypes ? { policyTypes: serializeArrayFilterForGet(policyTypes) } : {}), + }; +}; + +export const buildQuarantineExportFilename = (tenantFilter, format, label = null) => { + const tenant = (tenantFilter || "tenant").replace(/[^a-zA-Z0-9.-]+/g, "_"); + const timestamp = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19); + const extension = format.replace(/^\./, ""); + const suffix = label ? `-${label}` : ""; + return `quarantine-${tenant}-${timestamp}${suffix}.${extension}`; +}; + +export const triggerQuarantineFileDownload = (content, mimeType, filename) => { + const blob = new Blob([content], { type: mimeType }); + const url = URL.createObjectURL(blob); + const link = document.createElement("a"); + link.href = url; + link.download = filename; + link.click(); + URL.revokeObjectURL(url); +}; + +export const hasQuarantinePostFilters = (values = {}) => + Boolean(values.subject || values.senderDomain || values.recipientDomain); diff --git a/frontend/src/components/CippComponents/quarantine/useQuarantineFilters.js b/frontend/src/components/CippComponents/quarantine/useQuarantineFilters.js new file mode 100644 index 0000000000..e0f15c1b13 --- /dev/null +++ b/frontend/src/components/CippComponents/quarantine/useQuarantineFilters.js @@ -0,0 +1,103 @@ +import { useCallback, useEffect, useMemo, useState } from "react"; +import { useRouter } from "next/router"; +import debounce from "lodash/debounce"; +import { QUARANTINE_DAYS_OPTIONS } from "./quarantineConstants"; + +const DEFAULT_FILTER_VALUES = { + dateFilter: "relative", + days: QUARANTINE_DAYS_OPTIONS[1], + startDate: null, + endDate: null, + sender: [], + recipient: [], + messageId: "", + subject: "", + subjectExact: "", + senderDomain: "", + recipientDomain: "", + policyName: "", + status: [], + fromIP: "", + toIP: "", + quarantineType: [], + releaseStatus: [], + policyTypes: [], +}; + +const parseRouterValue = (value) => { + if (!value) return value; + if (Array.isArray(value)) return value[0]; + return value; +}; + +export const useQuarantineFilters = ({ formControl, enabled = true } = {}) => { + const router = useRouter(); + const [debouncedSubject, setDebouncedSubject] = useState(""); + + const debouncedSetSubject = useMemo( + () => + debounce((value) => { + setDebouncedSubject(value); + }, 300), + [] + ); + + useEffect(() => () => debouncedSetSubject.cancel(), [debouncedSetSubject]); + + useEffect(() => { + if (!enabled || !router.isReady || !formControl) return; + + const query = router.query; + if (query.days) { + const daysValue = parseInt(parseRouterValue(query.days), 10); + const daysOption = + QUARANTINE_DAYS_OPTIONS.find((option) => option.value === daysValue) || + QUARANTINE_DAYS_OPTIONS[1]; + formControl.setValue("dateFilter", "relative"); + formControl.setValue("days", daysOption); + } + if (query.sender) formControl.setValue("sender", [{ label: query.sender, value: query.sender }]); + if (query.recipient) { + formControl.setValue("recipient", [{ label: query.recipient, value: query.recipient }]); + } + if (query.subject) formControl.setValue("subject", parseRouterValue(query.subject)); + if (query.messageId) formControl.setValue("messageId", parseRouterValue(query.messageId)); + }, [enabled, formControl, router.isReady, router.query]); + + const syncFiltersToUrl = useCallback( + (values) => { + if (!enabled) return; + const nextQuery = { ...router.query }; + const setOrDelete = (key, value) => { + if (value === undefined || value === null || value === "") delete nextQuery[key]; + else nextQuery[key] = value; + }; + + if (values.messageId) { + setOrDelete("messageId", values.messageId); + } else { + delete nextQuery.messageId; + if (values.dateFilter === "relative") { + setOrDelete("days", values.days?.value ?? values.days); + } + const sender = values.sender?.[0]?.value ?? values.sender?.[0]; + const recipient = values.recipient?.[0]?.value ?? values.recipient?.[0]; + setOrDelete("sender", sender); + setOrDelete("recipient", recipient); + setOrDelete("subject", values.subject); + } + + router.replace({ pathname: router.pathname, query: nextQuery }, undefined, { shallow: true }); + }, + [enabled, router] + ); + + return { + defaultFilterValues: DEFAULT_FILTER_VALUES, + debouncedSubject, + debouncedSetSubject, + syncFiltersToUrl, + }; +}; + +export default useQuarantineFilters; diff --git a/frontend/src/components/CippFormPages/CippAddEditContact.jsx b/frontend/src/components/CippFormPages/CippAddEditContact.jsx index 1e038f8231..4afbccefb5 100644 --- a/frontend/src/components/CippFormPages/CippAddEditContact.jsx +++ b/frontend/src/components/CippFormPages/CippAddEditContact.jsx @@ -153,18 +153,20 @@ const ContactFormLayout = ({ formControl, formType = "add" }) => { {/* Phone Numbers */} diff --git a/frontend/src/components/CippFormPages/CippAddEditUser.jsx b/frontend/src/components/CippFormPages/CippAddEditUser.jsx index e39becf7c3..331792751f 100644 --- a/frontend/src/components/CippFormPages/CippAddEditUser.jsx +++ b/frontend/src/components/CippFormPages/CippAddEditUser.jsx @@ -815,6 +815,18 @@ const CippAddEditUser = (props) => { formControl={formControl} />     + + {formType === 'add' && ( + + + + )} {formType === 'add' && ( ( - - - -); +import { + Alert, + Box, + Divider, + InputAdornment, + Typography, + Link, + Accordion, + AccordionSummary, + AccordionDetails, + Chip, + Stack, + IconButton, + Tooltip, +} from '@mui/material' +import { ExpandMore, ContentCopy, Lightbulb } from '@mui/icons-material' +import { Grid } from '@mui/system' +import CippFormComponent from '../CippComponents/CippFormComponent' +import { CippFormCondition } from '../CippComponents/CippFormCondition' +import { CippFormDomainSelector } from '../CippComponents/CippFormDomainSelector' +import { CippFormUserSelector } from '../CippComponents/CippFormUserSelector' +import { CippFormLicenseSelector } from '../CippComponents/CippFormLicenseSelector' +import { useWatch } from 'react-hook-form' +import { useState } from 'react' + +// Common dynamic membership rule examples +const dynamicRuleExamples = [ + { + category: 'Department-Based', + examples: [ + { + name: 'Single Department', + rule: '(user.department -eq "Sales")', + description: 'All users in the Sales department', + }, + { + name: 'Multiple Departments', + rule: '(user.department -eq "Sales") -or (user.department -eq "Marketing")', + description: 'Users in Sales OR Marketing departments', + }, + { + name: 'Department Contains', + rule: '(user.department -contains "Engineering")', + description: "Users whose department contains 'Engineering'", + }, + ], + }, + { + category: 'Job Title & Role', + examples: [ + { + name: 'Specific Job Title', + rule: '(user.jobTitle -eq "Manager")', + description: "All users with 'Manager' job title", + }, + { + name: 'Job Title Contains', + rule: '(user.jobTitle -contains "Director")', + description: "Users whose title contains 'Director'", + }, + { + name: 'Multiple Titles', + rule: '(user.jobTitle -eq "CEO") -or (user.jobTitle -eq "CFO") -or (user.jobTitle -eq "CTO")', + description: 'C-level executives only', + }, + ], + }, + { + category: 'Location-Based', + examples: [ + { + name: 'Specific Country', + rule: '(user.country -eq "United States")', + description: 'All users located in the United States', + }, + { + name: 'Specific Office', + rule: '(user.officeLocation -eq "New York")', + description: 'Users in the New York office', + }, + { + name: 'Usage Location', + rule: '(user.usageLocation -eq "US")', + description: 'Users with US usage location (for licensing)', + }, + ], + }, + { + category: 'Account Status', + examples: [ + { + name: 'Enabled Accounts Only', + rule: '(user.accountEnabled -eq true)', + description: 'Only enabled user accounts', + }, + { + name: 'Guest Users', + rule: '(user.userType -eq "Guest")', + description: 'All guest/external users', + }, + { + name: 'Member Users', + rule: '(user.userType -eq "Member")', + description: 'All member (internal) users', + }, + ], + }, + { + category: 'Combined Rules', + examples: [ + { + name: 'Department + Enabled', + rule: '(user.department -eq "IT") -and (user.accountEnabled -eq true)', + description: 'Enabled IT department users only', + }, + { + name: 'Manager in Location', + rule: '(user.jobTitle -contains "Manager") -and (user.country -eq "United States")', + description: 'Managers located in the US', + }, + { + name: 'Exclude Specific Users', + rule: '(user.department -eq "Sales") -and (user.jobTitle -ne "Intern")', + description: 'Sales department excluding interns', + }, + ], + }, + { + category: 'Extension Attributes', + examples: [ + { + name: 'Extension Attribute', + rule: '(user.extensionAttribute1 -eq "FullTime")', + description: 'Users with specific extension attribute value', + }, + { + name: 'Extension Not Null', + rule: '(user.extensionAttribute1 -ne null)', + description: 'Users where extension attribute has any value', + }, + ], + }, +] + +// Dynamic Distribution Group filter examples (Exchange recipient filters) +const dynamicDistributionExamples = [ + { + category: 'Recipient Type', + examples: [ + { + name: 'All Mailboxes', + rule: "RecipientType -eq 'UserMailbox'", + description: 'All user mailboxes in the organization', + }, + { + name: 'All Mail Users', + rule: "RecipientTypeDetails -eq 'MailUser'", + description: 'All mail-enabled users', + }, + ], + }, + { + category: 'Department & Company', + examples: [ + { + name: 'Single Department', + rule: "Department -eq 'Sales'", + description: 'All recipients in the Sales department', + }, + { + name: 'Specific Company', + rule: "Company -eq 'Contoso'", + description: 'All recipients from Contoso company', + }, + { + name: 'Department + Company', + rule: "(Department -eq 'Engineering') -and (Company -eq 'Contoso')", + description: 'Engineering at Contoso only', + }, + ], + }, + { + category: 'Location', + examples: [ + { + name: 'State or Province', + rule: "StateOrProvince -eq 'California'", + description: 'Recipients in California', + }, + { + name: 'Country', + rule: "CountryOrRegion -eq 'United States'", + description: 'Recipients in the United States', + }, + { + name: 'Office Location', + rule: "Office -eq 'Building A'", + description: 'Recipients in Building A', + }, + ], + }, + { + category: 'Custom Attributes', + examples: [ + { + name: 'Custom Attribute', + rule: "CustomAttribute1 -eq 'ProjectTeam'", + description: 'Recipients with specific custom attribute', + }, + { + name: 'Multiple Conditions', + rule: "(CustomAttribute1 -eq 'VIP') -and (RecipientType -eq 'UserMailbox')", + description: 'VIP mailboxes only', + }, + ], + }, +] + +// Group type definitions with descriptions +const groupTypeOptions = [ + { + label: 'Security Group', + value: 'generic', + description: + 'Control access to resources like SharePoint sites, applications, and Azure resources. No email capabilities.', + }, + { + label: 'Microsoft 365 Group', + value: 'm365', + description: 'Collaborative group with shared mailbox, calendar, files, and Teams integration.', + }, + { + label: 'Distribution List', + value: 'distribution', + description: 'Email distribution group for sending messages to multiple recipients.', + }, + { + label: 'Mail Enabled Security Group', + value: 'security', + description: + 'Security group that can also receive email. Combines access control with email distribution.', + }, + { + label: 'Dynamic Group', + value: 'dynamic', + description: + 'Security group with automatic membership based on user attributes (e.g., department, job title).', + }, + { + label: 'Dynamic Distribution Group', + value: 'dynamicdistribution', + description: + 'Email distribution group with automatic membership based on recipient attributes.', + }, + { + label: 'Azure Role Group', + value: 'azurerole', + description: + 'Privileged group that can be assigned to Azure AD roles. Use for administrative access.', + }, +] + +// Helper function to get description for selected group type +const getGroupTypeDescription = (groupType) => { + const option = groupTypeOptions.find((opt) => opt.value === groupType) + return option?.description || '' +} + +// Collapsible component showing dynamic rule examples +const DynamicRuleExamplesAccordion = ({ formControl, selectedGroupType }) => { + const [copiedRule, setCopiedRule] = useState(null) + + const handleCopyRule = (rule) => { + navigator.clipboard.writeText(rule) + setCopiedRule(rule) + setTimeout(() => setCopiedRule(null), 2000) + } + + const handleUseRule = (rule) => { + formControl.setValue('membershipRules', rule, { shouldValidate: true }) + } + + // Choose examples based on group type + const examples = + selectedGroupType === 'dynamicdistribution' ? dynamicDistributionExamples : dynamicRuleExamples + + const syntaxGuide = + selectedGroupType === 'dynamicdistribution' ? ( + <> + + Exchange Recipient Filter Syntax + + +
  • + -eq = equals +
    • +
  • + -ne = not equals +
    • +
  • + -like = wildcard match (use * for wildcards) +
    • +
  • + -and / -or = combine conditions +
    • +     + + Common attributes: Department, Company,{' '} + StateOrProvince,CountryOrRegion, Office,{' '} + Title, CustomAttribute1-15 + + + ) : ( + <> + + OData Filter Syntax + + +
  • + -eq = equals +
    • +
  • + -ne = not equals +
    • +
  • + -contains = string contains +
    • +
  • + -match = regex match +
    • +
  • + -and / -or = combine conditions +
    • +     + + Common attributes: user.department, user.jobTitle,{' '} + user.country,user.accountEnabled, user.userType,{' '} + user.extensionAttribute1-15 + + + ) + + return ( + + } + sx={{ + minHeight: 48, + '&.Mui-expanded': { minHeight: 48 }, + }} + > + + + Rule Examples & Syntax Guide + + + + {/* Syntax Guide */} + + {syntaxGuide} + + + {/* Examples by Category */} + {examples.map((category) => ( + + } + sx={{ + minHeight: 40, + px: 1, + '&.Mui-expanded': { minHeight: 40 }, + }} + > + + {category.category} + + + + + {category.examples.map((example) => ( + + + + + {example.name} + + + {example.description} + + + {example.rule} + + + + + handleCopyRule(example.rule)} + color={copiedRule === example.rule ? 'success' : 'default'} + > + + + + handleUseRule(example.rule)} + sx={{ cursor: 'pointer' }} + /> + + + + ))} + + + + ))} + + {/* Additional Resources */} + + + Need more help?{' '} + {selectedGroupType === 'dynamicdistribution' ? ( + + Exchange Dynamic Distribution Groups Documentation + + ) : ( + + Microsoft Entra Dynamic Group Rules Documentation + + )} + + + + + ) +} const CippAddGroupForm = (props) => { - const { formControl } = props; + const { formControl } = props + const groupTypeWatch = useWatch({ control: formControl.control, name: 'groupType' }) + // Handle both object format from autoComplete and string format + const selectedGroupType = groupTypeWatch?.value || groupTypeWatch return ( - - - - - - - - @ } }} - /> - - - - - + {/* Section 1: Group Type Selection */} - + + Group Type + + + Select the type of group you want to create. This determines the available features and + settings. + - - - ({ label, value }))} + multiple={false} + required={true} + placeholder="Choose a group type..." /> + + {/* Show description for selected group type */} + {selectedGroupType && ( + + + + + {groupTypeOptions.find((opt) => opt.value === selectedGroupType)?.label}: + {' '} + {getGroupTypeDescription(selectedGroupType)} + + + + )} + { /> - - - + {/* Section 2: Basic Information */} + + + + Basic Information + + + + + + + + + + + + {/* Section 3: Email Settings - Only for email-enabled groups */} + - - - - - + + + + Email Settings + + + + + @, + }} + helperText="The part before @ in the group's email address" + /> + + + + + + + {/* Email aliases + GAL visibility - distribution and mail-enabled security groups */} + - - - - - + + + + + + + + + {/* Section 4: Dynamic Membership Rules - Only for dynamic groups */} + -     - - + + + + Dynamic Membership Rules + + + Define rules to automatically add or remove members based on user attributes.{' '} + + Learn more about dynamic membership rules + + + + + + + + + {/* Collapsible Examples Section */} + + + + + + - - - - - + + + + Licenses + + + Optionally assign licenses to this security group. They will be applied to all + members. + + + + + + + + {/* Section 5: Members & Owners - Only for non-dynamic groups */} + -     - - - - + + + + Members & Owners + + + Add owners to manage the group and members who will be part of it. You can also add + members later. + + + + + + + Owners can manage group membership and settings + + + + + + + Members will have access to group resources + + + + + {/* Section 6: Additional Settings */} + + field="groupType" + compareType="isOneOf" + compareValue={['distribution', 'dynamicdistribution', 'm365']} + > + + + + Additional Settings + + + + + {/* External senders option for distribution groups */} + + + + + When enabled, people outside your organization can send email to this group + + + + + {/* Subscribe members option for M365 groups */} + + + + + Members will automatically receive copies of group conversations in their inbox + + + + + )} + + {/* Initial prompt when no group type selected */} + {!selectedGroupType && ( + + + + Select a group type above to continue + + - + )}     - ); -}; + ) +} -export default CippAddGroupForm; +export default CippAddGroupForm diff --git a/frontend/src/components/CippFormPages/CippExchangeSettingsForm.jsx b/frontend/src/components/CippFormPages/CippExchangeSettingsForm.jsx index 5d665383cf..af1149f65e 100644 --- a/frontend/src/components/CippFormPages/CippExchangeSettingsForm.jsx +++ b/frontend/src/components/CippFormPages/CippExchangeSettingsForm.jsx @@ -64,6 +64,18 @@ const CippExchangeSettingsForm = (props) => { queryKey: `TenantContacts-${userSettingsDefaults.currentTenant}`, }); + const groupsList = ApiGetCall({ + url: "/api/ListGraphRequest", + data: { + Endpoint: `groups`, + tenantFilter: userSettingsDefaults.currentTenant, + $filter: "mailEnabled eq true", + $select: "id,displayName,mail,groupTypes,securityEnabled", + $top: 999, + }, + queryKey: `MailEnabledGroups-${userSettingsDefaults.currentTenant}`, + }); + const postRequest = ApiPostCall({ datafromUrl: true, relatedQueryKeys: relatedQueryKeys, @@ -180,6 +192,7 @@ const CippExchangeSettingsForm = (props) => { formControl={formControl} usersList={usersList} contactsList={contactsList} + groupsList={groupsList} postRequest={postRequest} handleSubmit={handleSubmit} /> diff --git a/frontend/src/components/CippFormPages/CippFormPage.jsx b/frontend/src/components/CippFormPages/CippFormPage.jsx index d8d95e46a9..6400eb011c 100644 --- a/frontend/src/components/CippFormPages/CippFormPage.jsx +++ b/frontend/src/components/CippFormPages/CippFormPage.jsx @@ -1,5 +1,4 @@ import { useRouter } from 'next/router' -import { CippIcons } from '../../utils/icon-registry' import { useTabNavigation, useTitleClaimedByTabPicker } from '../../layouts/tab-navigation-context' import { Box, @@ -11,17 +10,39 @@ import { Card, CardContent, CardActions, -} from '@mui/material' -import { ApiPostCall } from '../../api/ApiCall' -import { CippApiResults } from '../CippComponents/CippApiResults' -import { createContext, useContext, useEffect } from 'react' -import { useFormState } from 'react-hook-form' -import { CippHead } from '../CippComponents/CippHead' + Tooltip, +} from "@mui/material"; +import ArrowLeftIcon from "@mui/icons-material/ArrowLeft"; +import { ApiPostCall } from "../../api/ApiCall"; +import { CippApiResults } from "../CippComponents/CippApiResults"; +import { createContext, useContext, useEffect } from "react"; +import { useFormState } from "react-hook-form"; +import { CippHead } from "../CippComponents/CippHead"; // Lets a page render its own Save button somewhere inside `children` (e.g. next to a // Run Test button) while reusing this component's submit pipeline. Pair with hideSubmit. -const CippFormPageContext = createContext(null) -export const useCippFormPageActions = () => useContext(CippFormPageContext) +const CippFormPageContext = createContext(null); +export const useCippFormPageActions = () => useContext(CippFormPageContext); + +const getSubmitTooltip = ({ isPending, isValid, isDirty, allowResubmit }) => { + if (isPending) return "Submitting..."; + if (!isValid) return "Please fix the validation errors before submitting"; + if (!allowResubmit && !isDirty) return "Make a change to the form to enable submission"; + return ""; +}; + +const SubmitButton = ({ disabled, isPending, isValid, isDirty, allowResubmit, onClick }) => { + const tooltip = getSubmitTooltip({ isPending, isValid, isDirty, allowResubmit }); + return ( + + + + + + ); +}; const CippFormPage = (props) => { const { @@ -102,44 +123,49 @@ const CippFormPage = (props) => { const followUps = followUpRequests?.(formControl.getValues()) const values = customDataformatter ? customDataformatter(formControl.getValues()) - : formControl.getValues() + : formControl.getValues(); //remove all empty values or blanks (recursively) //when preserveNullValues is set, explicit nulls are kept so the API can //distinguish "clear this field" from "field omitted" const isEmptyValue = (value) => - value === '' || value === undefined || (!preserveNullValues && value === null) + value === "" || value === undefined || (!preserveNullValues && value === null); const removeEmpty = (obj) => { if (Array.isArray(obj)) { return obj - .map((item) => (item && typeof item === 'object' ? removeEmpty(item) : item)) - .filter((item) => !isEmptyValue(item)) + .map((item) => (item && typeof item === "object" ? removeEmpty(item) : item)) + .filter((item) => { + if (isEmptyValue(item)) return false; + if (Array.isArray(item)) return item.length > 0; + if (item !== null && typeof item === "object") return Object.keys(item).length > 0; + return true; + }); } Object.keys(obj).forEach((key) => { if (isEmptyValue(obj[key])) { - delete obj[key] - } else if (obj[key] !== null && typeof obj[key] === 'object') { - obj[key] = removeEmpty(obj[key]) - if (!Array.isArray(obj[key]) && Object.keys(obj[key]).length === 0) { - delete obj[key] + delete obj[key]; + } else if (obj[key] !== null && typeof obj[key] === "object") { + obj[key] = removeEmpty(obj[key]); + if (Array.isArray(obj[key]) ? obj[key].length === 0 : Object.keys(obj[key]).length === 0) { + delete obj[key]; } } - }) - return obj - } - removeEmpty(values) + }); + return obj; + }; + const cleanedValues = removeEmpty(values); postCall.mutate({ url: postUrl, - data: values, + data: cleanedValues, followUps, - }) - } + }); + }; const formPageActions = { submit: formControl.handleSubmit(handleSubmit), isSubmitting: postCall.isPending, isValid, isDirty, allowResubmit, - } + }; return ( @@ -161,13 +187,11 @@ const CippFormPage = (props) => { + sx={{ columnGap: 2, rowGap: 1 }} + > {!hidePageType && <>{formPageType} - } {title} @@ -197,14 +221,14 @@ const CippFormPage = (props) => { }} > {addedButtons && addedButtons} - + /> )} @@ -213,7 +237,7 @@ const CippFormPage = (props) => { - ); + ) } export default CippFormPage diff --git a/frontend/src/components/CippFormPages/CippPIMRoleSettingsTemplateForm.jsx b/frontend/src/components/CippFormPages/CippPIMRoleSettingsTemplateForm.jsx index 7557238f10..0ae05fd566 100644 --- a/frontend/src/components/CippFormPages/CippPIMRoleSettingsTemplateForm.jsx +++ b/frontend/src/components/CippFormPages/CippPIMRoleSettingsTemplateForm.jsx @@ -33,7 +33,7 @@ export const activeAssignmentDurationOptions = [ export const roleScopeOptions = [ { label: - 'Privileged roles (CIPP list: Global, Security, Exchange, ... administrators)', + 'Privileged roles (Manage365 list: Global, Security, Exchange, ... administrators)', value: 'PrivilegedRoles', }, { label: 'All directory roles', value: 'AllRoles' }, @@ -213,7 +213,7 @@ export const CippPIMRoleSettingsTemplateForm = ({ formControl }) => { - CIPP enforces a secure floor: activation always requires a + Manage365 enforces a secure floor: activation always requires a justification and either MFA or an authentication context, activations end within 24 hours, and eligible or active assignments end within a year. Templates below the floor are refused, not adjusted. diff --git a/frontend/src/components/CippIntegrations/CippApiClientManagement.jsx b/frontend/src/components/CippIntegrations/CippApiClientManagement.jsx index ba66053a8e..976e0fb596 100644 --- a/frontend/src/components/CippIntegrations/CippApiClientManagement.jsx +++ b/frontend/src/components/CippIntegrations/CippApiClientManagement.jsx @@ -1,4 +1,4 @@ -import { Button, Stack, SvgIcon, Menu, MenuItem, ListItemText, Alert } from "@mui/material"; +import { Alert, Button, ListItemText, Menu, MenuItem, Stack, SvgIcon, Tooltip } from "@mui/material"; import { CippIcons } from "../../utils/icon-registry" import { useState, useEffect, useMemo } from "react"; import isEqual from "lodash/isEqual"; @@ -11,6 +11,7 @@ import { CippApiDialog } from "../CippComponents/CippApiDialog"; import { CippPropertyListCard } from "../CippCards/CippPropertyListCard"; import { CippCopyToClipBoard } from "../CippComponents/CippCopyToClipboard"; import { Box } from "@mui/system"; +import { getCippError } from "../../utils/get-cipp-error"; // IP entries that impose no real restriction; a role with only these (or none) is unrestricted, // matching the backend collapsing an empty list to "Any". @@ -29,8 +30,8 @@ const getRestrictiveRanges = (ranges) => .map((r) => String(r?.value ?? r).trim()) .filter((r) => r && !ALLOW_ALL_IP_TOKENS.has(r.toLowerCase())); -// Dialog warning (advisory, not enforced): MCP connectors call in from the AI provider's cloud IPs, -// so an IP restriction on the client itself OR on its role will most likely block them (403). +// Dialog warning (advisory, not enforced): client-credentials MCP calls come from the AI provider's +// cloud IPs, so an IP restriction on the client itself OR on its role will most likely block them (403). const McpRoleIpWarning = ({ formControl }) => { const mcpAllowed = useWatch({ control: formControl.control, name: "MCPAllowed" }); const roleValue = useWatch({ control: formControl.control, name: "Role" }); @@ -52,8 +53,9 @@ const McpRoleIpWarning = ({ formControl }) => { return ( - MCP connectors call in from your AI provider's cloud IPs, so IP restrictions on an MCP client - will most likely block it (403). + Calls made with this client's own secret come from your AI provider's cloud IPs, so IP + restrictions on the client or its role will most likely block them (403). Connectors that sign + a user in use that user's role instead. {clientRanges.length > 0 && <> This client's IP range only allows {clientRanges.join(", ")}.} {roleRanges.length > 0 && ( <> @@ -130,8 +132,8 @@ const CippApiClientManagement = () => { }); }, [apiClients.data, egressUsage.data]); - // MCP-enabled clients with an IP restriction — on the client's own IP range or on its role. MCP - // connectors call in from the AI provider's cloud IPs, so either will most likely block them (403). + // MCP-enabled clients with an IP restriction — on the client's own IP range or on its role. These + // apply to client-credentials calls, which come from the AI provider's cloud IPs (403). const mcpRoleIpWarnings = useMemo(() => { if (!apiClients.isSuccess || !customRoles.isSuccess) return []; const roles = customRoles.data ?? []; @@ -204,7 +206,7 @@ const CippApiClientManagement = () => { handleMenuClose(); if ( !window.confirm( - "Saving to Azure will restart the CIPP instance. Changes may take up to 60 seconds to reflect. Do you want to continue?" + "Saving to Azure will restart the Manage365 instance. Changes may take up to 60 seconds to reflect. Do you want to continue?" ) ) { return; @@ -260,7 +262,7 @@ const CippApiClientManagement = () => { multiple: false, creatable: false, label: "Select Role", - placeholder: "Choose a role from the CIPP Role list.", + placeholder: "Choose a role from the Manage365 Role list.", api: { url: "/api/ListCustomRole", queryKey: "CustomRoleList", @@ -294,7 +296,7 @@ const CippApiClientManagement = () => { name: "mcpAccessWarning", severity: "warning", label: - "Enabling MCP Access sets this client up as an MCP connector sign-in app — AI clients (Claude, ChatGPT, Copilot Studio, VS Code) sign in as it, and the shared CIPP-MCP resource app is created automatically. You can enable multiple MCP clients, each with its own role, IP range and Conditional Access. MCP is only supported on CIPP-NG.", + "Enabling MCP Access sets this client up as an MCP connector sign-in app — AI clients (Claude, ChatGPT, Copilot Studio, VS Code) sign in as it, and the shared CIPP-MCP resource app is created automatically. Connectors that sign a user in run with that user's own Manage365 role; this client's role and IP range only apply to calls made with its own secret and no user. You can enable multiple MCP clients, each with its own role, IP range and Conditional Access. MCP is only supported on Manage365.", }, { name: "mcpRoleIpWarning", @@ -428,6 +430,22 @@ const CippApiClientManagement = () => { "Not Available" ), }, + { + label: "MCP API URL", + value: azureConfig.data?.Results?.ApiUrl ? ( + <> + + + + + + ) : ( + "Not Available" + ), + }, { label: "Token URL", value: azureConfig.data?.Results?.TenantID ? ( @@ -465,6 +483,13 @@ const CippApiClientManagement = () => { )} )} + {azureConfig.isError && ( + + + Could not get the Azure authentication settings: {getCippError(azureConfig.error)} + + + )} {azureConfig.isSuccess && azureConfig.data?.Results?.Enabled === false && ( @@ -476,9 +501,10 @@ const CippApiClientManagement = () => { {mcpRoleIpWarnings.length > 0 && ( - These MCP-enabled clients have an IP restriction (on the client or its role). MCP - connectors call in from your AI provider's cloud IPs, so this will most likely block - them (403). Consider setting the IP range to Any and using a role with no IP + These MCP-enabled clients have an IP restriction (on the client or its role). Calls + made with the client's own secret come from your AI provider's cloud IPs, so this will + most likely block them (403); connectors that sign a user in use that user's role + instead. Consider setting the IP range to Any and using a role with no IP restriction:
      {mcpRoleIpWarnings.map((warning) => ( @@ -495,7 +521,7 @@ const CippApiClientManagement = () => { { @@ -555,7 +581,7 @@ const CippApiClientManagement = () => { valueField: "RoleName", showRefresh: true, }, - placeholder: "Choose a role from the CIPP Role list.", + placeholder: "Choose a role from the Manage365 Role list.", }, { type: "autoComplete", @@ -582,7 +608,7 @@ const CippApiClientManagement = () => { name: "mcpAccessWarning", severity: "warning", label: - "Enabling MCP Access sets this client up as an MCP connector sign-in app — AI clients (Claude, ChatGPT, Copilot Studio, VS Code) sign in as it, and the shared CIPP-MCP resource app is created automatically. You can enable multiple MCP clients, each with its own role, IP range and Conditional Access. MCP is only supported on CIPP-NG.", + "Enabling MCP Access sets this client up as an MCP connector sign-in app — AI clients (Claude, ChatGPT, Copilot Studio, VS Code) sign in as it, and the shared CIPP-MCP resource app is created automatically. Connectors that sign a user in run with that user's own Manage365 role; this client's role and IP range only apply to calls made with its own secret and no user. You can enable multiple MCP clients, each with its own role, IP range and Conditional Access. MCP is only supported on Manage365.", }, { name: "mcpRoleIpWarning", @@ -633,7 +659,7 @@ const CippApiClientManagement = () => { multiple: false, creatable: false, label: "Select Role", - placeholder: "Choose a role from the CIPP Role list.", + placeholder: "Choose a role from the Manage365 Role list.", api: { url: "/api/ListCustomRole", queryKey: "CustomRoleList", @@ -667,7 +693,7 @@ const CippApiClientManagement = () => { name: "mcpAccessWarning", severity: "warning", label: - "Enabling MCP Access sets this client up as an MCP connector sign-in app — AI clients (Claude, ChatGPT, Copilot Studio, VS Code) sign in as it, and the shared CIPP-MCP resource app is created automatically. You can enable multiple MCP clients, each with its own role, IP range and Conditional Access. MCP is only supported on CIPP-NG.", + "Enabling MCP Access sets this client up as an MCP connector sign-in app — AI clients (Claude, ChatGPT, Copilot Studio, VS Code) sign in as it, and the shared CIPP-MCP resource app is created automatically. Connectors that sign a user in run with that user's own Manage365 role; this client's role and IP range only apply to calls made with its own secret and no user. You can enable multiple MCP clients, each with its own role, IP range and Conditional Access. MCP is only supported on Manage365.", }, { name: "mcpRoleIpWarning", diff --git a/frontend/src/components/CippIntegrations/CippApiDocumentation.jsx b/frontend/src/components/CippIntegrations/CippApiDocumentation.jsx index 176795ada0..19d424d0db 100644 --- a/frontend/src/components/CippIntegrations/CippApiDocumentation.jsx +++ b/frontend/src/components/CippIntegrations/CippApiDocumentation.jsx @@ -99,7 +99,7 @@ const CippApiDocumentation = () => { Beta. This documentation is generated automatically - from the CIPP source. Request and response schemas are inferred, so some + from the Manage365 source. Request and response schemas are inferred, so some fields may be missing, loosely typed, or described only in part — treat it as a strong guide rather than a guarantee, and report anything that looks wrong. diff --git a/frontend/src/components/CippIntegrations/CippIntegrationTenantMapping.jsx b/frontend/src/components/CippIntegrations/CippIntegrationTenantMapping.jsx index ef283c2103..279c114c99 100644 --- a/frontend/src/components/CippIntegrations/CippIntegrationTenantMapping.jsx +++ b/frontend/src/components/CippIntegrations/CippIntegrationTenantMapping.jsx @@ -49,11 +49,8 @@ const CippIntegrationSettings = ({ children }) => { defaultValues: mappings?.data, }); - // Server-side automap writes the mappings itself, so the list has to be refetched or the - // table keeps showing the pre-automap rows and the new mappings look like they failed. const automapPostCall = ApiPostCall({ datafromUrl: true, - relatedQueryKeys: [`IntegrationTenantMapping-${router.query.id}`], }); const postCall = ApiPostCall({ @@ -109,32 +106,12 @@ const CippIntegrationSettings = ({ children }) => { formControl.setValue("integrationCompany", null); }; - // Companies often differ from the GDAP tenant name only by case or legal suffix - // ("Company A LTD" vs "Company a Ltd" vs "Company A Limited"), so compare on a - // normalized form: lowercased, punctuation stripped, trailing legal suffixes removed. - const normalizeCompanyName = (name) => { - if (!name) return ""; - let normalized = name - .toLowerCase() - .replace(/[.,'()&]/g, " ") - .replace(/\s+/g, " ") - .trim(); - const legalSuffixes = /\s(ltd|limited|llc|llp|inc|incorporated|plc|pty|corp|corporation|gmbh|bv|co)$/; - while (legalSuffixes.test(normalized)) { - normalized = normalized.replace(legalSuffixes, "").trim(); - } - return normalized; - }; - const handleAutoMap = () => { const newTableData = []; tenantList.data?.pages[0]?.forEach((tenant) => { - const normalizedTenant = normalizeCompanyName(tenant.displayName); - const matchingCompanies = mappings.data.Companies.filter( - (company) => normalizeCompanyName(company.name) === normalizedTenant + const matchingCompany = mappings.data.Companies.find( + (company) => company.name === tenant.displayName ); - // More than one company collapsing to the same name is ambiguous - leave it manual. - const matchingCompany = matchingCompanies.length === 1 ? matchingCompanies[0] : null; if ( Array.isArray(tableData) && tableData?.find((item) => item.TenantId === tenant.customerId) @@ -210,6 +187,7 @@ const CippIntegrationSettings = ({ children }) => { icon: , confirmText: "Are you sure you want to delete this mapping?", customFunction: handleRemoveItem, + category: "danger", }, ]; @@ -218,13 +196,11 @@ const CippIntegrationSettings = ({ children }) => { return Array.isArray(tableData) ? tableData.map((item) => item.TenantId) : []; }, [tableData]); - // isSuccess only goes false -> true once, so depending on it alone meant a refetch never - // reached the table and server-side automap results stayed hidden until a page reload. useEffect(() => { if (mappings.isSuccess) { setTableData(mappings.data.Mappings ?? []); } - }, [mappings.isSuccess, mappings.data]); + }, [mappings.isSuccess]); return ( <> @@ -345,7 +321,7 @@ const CippIntegrationSettings = ({ children }) => { reportTitle={`${extension.id}-tenant-map`} data={tableData} simple={false} - simpleColumns={["IntegrationName", "Tenant", "TenantDomain", "TenantId"]} + simpleColumns={["IntegrationName", "Tenant", "TenantDomain"]} isFetching={mappings.isFetching} refreshFunction={() => mappings.refetch()} /> diff --git a/frontend/src/components/CippIntegrations/CippMcpManagement.jsx b/frontend/src/components/CippIntegrations/CippMcpManagement.jsx index 69b00e66fc..57e6aa4b1a 100644 --- a/frontend/src/components/CippIntegrations/CippMcpManagement.jsx +++ b/frontend/src/components/CippIntegrations/CippMcpManagement.jsx @@ -115,8 +115,8 @@ const McpClientCard = ({ client, baseMcpUrl }) => { // MCP connector management: the shared CIPP-MCP resource app (the token audience CIPP creates and // manages) plus a section per MCPAllowed client app. Kept on its own tab so it doesn't clutter API -// client management. Enabling MCP on a client, and its role/IP, live with the client on the API -// Clients tab; here you check the resource app and each client's connector URL and redirect URIs. +// client management. Enabling MCP on a client lives with the client on the API Clients tab; here +// you check the resource app and each client's connector URL and redirect URIs. const CippMcpManagement = () => { // Shared query keys with the API Clients tab — react-query dedupes, so no extra network calls. const azureConfig = ApiGetCall({ diff --git a/frontend/src/components/CippSettings/CippAppServiceDomains.jsx b/frontend/src/components/CippSettings/CippAppServiceDomains.jsx index b6f265e8e3..c2381bcc19 100644 --- a/frontend/src/components/CippSettings/CippAppServiceDomains.jsx +++ b/frontend/src/components/CippSettings/CippAppServiceDomains.jsx @@ -273,7 +273,7 @@ const DomainWizard = ({ open, onClose, siteInfo, initialDomain }) => { helperText={ hostname.length > 0 && !hostnameValid ? "Enter a fully qualified domain name (e.g. portal.contoso.com)." - : "The fully qualified domain you want CIPP to answer on." + : "The fully qualified domain you want Manage365 to answer on." } /> @@ -550,7 +550,7 @@ export const CippAppServiceDomains = () => { ), color: "error.main", confirmText: - "Remove the custom domain '[Hostname]' from the CIPP App Service? Any managed certificate for it will also be removed. The default *.azurewebsites.net hostname is unaffected.", + "Remove the custom domain '[Hostname]' from the Manage365 App Service? Any managed certificate for it will also be removed. The default *.azurewebsites.net hostname is unaffected.", url: "/api/ExecAppServiceDomains", type: "POST", data: { Action: "Remove", Hostname: "Hostname" }, @@ -649,7 +649,7 @@ export const CippAppServiceDomains = () => { ) : ( - Map custom domains to the App Service that hosts this CIPP instance. Each domain needs a + Map custom domains to the App Service that hosts this Manage365 instance. Each domain needs a DNS alias record, a hostname binding, and (optionally) a free managed TLS certificate — the wizard walks through all three and can be reopened at any time to finish or fix a domain. The default *.azurewebsites.net hostname always remains available. diff --git a/frontend/src/components/CippSettings/CippBackupRetentionSettings.jsx b/frontend/src/components/CippSettings/CippBackupRetentionSettings.jsx index 78b151e65d..2f49f94312 100644 --- a/frontend/src/components/CippSettings/CippBackupRetentionSettings.jsx +++ b/frontend/src/components/CippSettings/CippBackupRetentionSettings.jsx @@ -88,7 +88,7 @@ const CippBackupRetentionSettings = () => { } > - Configure how long to keep backup files. Both CIPP system backups and tenant backups will be + Configure how long to keep backup files. Both Manage365 system backups and tenant backups will be automatically deleted after this period. Minimum retention is 7 days, default is 30 days. Cleanup runs daily at 2:00 AM. diff --git a/frontend/src/components/CippSettings/CippBackupSettings.jsx b/frontend/src/components/CippSettings/CippBackupSettings.jsx index d57988e189..6ed1a17875 100644 --- a/frontend/src/components/CippSettings/CippBackupSettings.jsx +++ b/frontend/src/components/CippSettings/CippBackupSettings.jsx @@ -34,7 +34,7 @@ const CippBackupSettings = () => { <> }> - Manage the system configuration backups for CIPP. This will not include authentication + Manage the system configuration backups for Manage365. This will not include authentication information or extension configuration. You can also set an automated daily backup schedule. diff --git a/frontend/src/components/CippSettings/CippBrandingSettings.jsx b/frontend/src/components/CippSettings/CippBrandingSettings.jsx index 3589fef680..0a7bcaf65a 100644 --- a/frontend/src/components/CippSettings/CippBrandingSettings.jsx +++ b/frontend/src/components/CippSettings/CippBrandingSettings.jsx @@ -77,19 +77,19 @@ const roleColourValues = (source) => // Which of the tenant's names a report prints on its cover, in its prose and as %tenantname%. // "alias" is what CIPP shows for the tenant - an alias when one is set - and was the only choice. const TENANT_LABEL_OPTIONS = [ - { label: "Name as shown in CIPP (alias when set)", value: "alias" }, + { label: "Name as shown in Manage365 (alias when set)", value: "alias" }, { label: "Microsoft 365 organisation name", value: "name" }, { label: "Default domain", value: "domain" }, ]; const TENANT_LABEL_TOOLTIP = - "How reports refer to the tenant: on the cover, in the text and wherever %tenantname% is used. The name shown in CIPP is the tenant's alias when one is set; the organisation name is what Microsoft 365 holds regardless of any alias."; + "How reports refer to the tenant: on the cover, in the text and wherever %tenantname% is used. The name shown in Manage365 is the tenant's alias when one is set; the organisation name is what Microsoft 365 holds regardless of any alias."; const FOOTER_TOOLTIP = - "Text shown at the bottom of every report page. Type % for CIPP's variables, plus %reportname% and %reportdate% which reports add. Report templates can override this or switch it off individually."; + "Text shown at the bottom of every report page. Type % for Manage365's variables, plus %reportname% and %reportdate% which reports add. Report templates can override this or switch it off individually."; const WATERMARK_TOOLTIP = - "Diagonal text drawn faintly across every page of a report except the cover. Type % for CIPP's variables (e.g. %tenantname%), or a static mark such as DRAFT. Typing text is enough to show it; the toggle only exists to switch it off without losing the wording."; + "Diagonal text drawn faintly across every page of a report except the cover. Type % for Manage365's variables (e.g. %tenantname%), or a static mark such as DRAFT. Typing text is enough to show it; the toggle only exists to switch it off without losing the wording."; const REPORT_DEFAULTS_TOOLTIP = "Which preset each report reaches for when nothing else says otherwise. A report template with its own preset still wins over this, and this still wins over the default branding above."; @@ -332,7 +332,7 @@ const CippBrandingSettings = () => { const formControl = useForm({ mode: "onChange", defaultValues: { - colour: branding.colour || "#F77F00", + colour: branding.colour || "#007BA7", secondaryColour: branding.secondaryColour || "", footerText: branding.footerText || "", coverFooterText: branding.coverFooterText || "", @@ -349,7 +349,7 @@ const CippBrandingSettings = () => { // Everything the sync effect and Reset need to put back on the form, in one place — the two // paths drifting apart is how a field ends up saving but not reloading. const reportChromeValues = (source) => ({ - colour: source.colour || "#F77F00", + colour: source.colour || "#007BA7", secondaryColour: source.secondaryColour || "", footerText: source.footerText || "", coverFooterText: source.coverFooterText || "", @@ -454,7 +454,7 @@ const CippBrandingSettings = () => { // eslint-disable-next-line react-hooks/exhaustive-deps -- sync when server branding payload changes }, [activePresetId, uploadPending, brandingQuery.isSuccess, brandingQuery.dataUpdatedAt]); - const brandColour = formControl.watch("colour") || "#F77F00"; + const brandColour = formControl.watch("colour") || "#007BA7"; const previewReportTypeValue = formControl.watch("previewReportType"); const previewReportType = previewReportTypeValue?.value || previewReportTypeValue || reportTypeOptions[0]?.value; diff --git a/frontend/src/components/CippSettings/CippCacheSettings.jsx b/frontend/src/components/CippSettings/CippCacheSettings.jsx index 0a238e16fc..59734e508d 100644 --- a/frontend/src/components/CippSettings/CippCacheSettings.jsx +++ b/frontend/src/components/CippSettings/CippCacheSettings.jsx @@ -51,7 +51,7 @@ const CippCacheSettings = () => { CardButton={} > - Use this button to clear the caches used by CIPP. This will slow down some aspects of the + Use this button to clear the caches used by Manage365. This will slow down some aspects of the application, and should only be used when instructed to do so by support. @@ -68,7 +68,7 @@ const CippCacheSettings = () => { api={{ url: "/api/ListTenants", confirmText: - "This will clear the cache used by CIPP. This will slow down some aspects of the application, and should only be used when instructed to do so by support. This will delete any cache tables including pending audit logs that have not yet been processed. Are you sure you want to continue?", + "This will clear the cache used by Manage365. This will slow down some aspects of the application, and should only be used when instructed to do so by support. This will delete any cache tables including pending audit logs that have not yet been processed. Are you sure you want to continue?", type: "POST", data: { ClearCache: true }, replacementBehaviour: "removeNulls", diff --git a/frontend/src/components/CippSettings/CippContainerManagement.jsx b/frontend/src/components/CippSettings/CippContainerManagement.jsx index 519583b50f..13181ec7ee 100644 --- a/frontend/src/components/CippSettings/CippContainerManagement.jsx +++ b/frontend/src/components/CippSettings/CippContainerManagement.jsx @@ -567,7 +567,7 @@ export const CippContainerManagement = () => { Check for updates? - CIPP will ask the container registry whether a newer image has been + Manage365 will ask the container registry whether a newer image has been published on the {channelInfo.label} channel. {/* A manual check is not read-only when auto-restart is on: the backend calls @@ -614,7 +614,7 @@ export const CippContainerManagement = () => { Restart container? - CIPP will be briefly unavailable while the container restarts. The + Manage365 will be briefly unavailable while the container restarts. The newest image on the {channelInfo.label} channel is pulled as it comes back up — a restart always updates to the latest image on the channel, whatever the reason for it. diff --git a/frontend/src/components/CippSettings/CippGDAP/CippGDAPTrace.jsx b/frontend/src/components/CippSettings/CippGDAP/CippGDAPTrace.jsx index e7a0e689cc..4f0d3df376 100644 --- a/frontend/src/components/CippSettings/CippGDAP/CippGDAPTrace.jsx +++ b/frontend/src/components/CippSettings/CippGDAP/CippGDAPTrace.jsx @@ -45,9 +45,8 @@ export function useCippGDAPTrace() { icon: , noConfirm: true, customFunction: (row) => ref.current?.open(row), - // Direct tenants have no GDAP relationship to trace. - condition: (row) => - row.displayName !== "*Partner Tenant" && row.delegatedPrivilegeStatus !== "directTenant", + condition: (row) => row.displayName !== "*Partner Tenant", + category: "view", }), [] ); diff --git a/frontend/src/components/CippSettings/CippGDAPResults.jsx b/frontend/src/components/CippSettings/CippGDAPResults.jsx index b7d69cbbcf..12fa67c179 100644 --- a/frontend/src/components/CippSettings/CippGDAPResults.jsx +++ b/frontend/src/components/CippSettings/CippGDAPResults.jsx @@ -89,8 +89,8 @@ export const CippGDAPResults = (props) => { matchProperty: "displayName", match: "^M365 GDAP.+", count: 15, - successMessage: "User is a member of the 15 CIPP Recommended GDAP groups", - failureMessage: "User is not a member of the 15 CIPP Recommended GDAP groups", + successMessage: "User is a member of the 15 Manage365 Recommended GDAP groups", + failureMessage: "User is not a member of the 15 Manage365 Recommended GDAP groups", }, { resultProperty: "GDAPIssues", diff --git a/frontend/src/components/CippSettings/CippJitAdminSettings.jsx b/frontend/src/components/CippSettings/CippJitAdminSettings.jsx index d69b7d1849..550b4460ee 100644 --- a/frontend/src/components/CippSettings/CippJitAdminSettings.jsx +++ b/frontend/src/components/CippSettings/CippJitAdminSettings.jsx @@ -4,7 +4,8 @@ import CippButtonCard from "../CippCards/CippButtonCard"; import { ApiGetCall, ApiPostCall } from "../../api/ApiCall"; import { CippApiResults } from "../CippComponents/CippApiResults"; import CippFormComponent from "../CippComponents/CippFormComponent"; -import { useForm } from "react-hook-form"; +import { useForm, useWatch } from "react-hook-form"; +import jitAdminRoles from "../../data/JitAdminRoles.json"; import { useEffect } from "react"; const CippJitAdminSettings = () => { @@ -22,13 +23,22 @@ const CippJitAdminSettings = () => { mode: "onChange", defaultValues: { MaxDuration: "", + RequireApproval: false, + ApprovalTriggerRoles: [], + ApproverRoles: [], + RequiredApprovals: 1, }, }); + const requireApproval = useWatch({ control: formControl.control, name: "RequireApproval" }); useEffect(() => { if (jitSettings.isSuccess && jitSettings.data) { formControl.reset({ MaxDuration: jitSettings.data?.MaxDuration || "", + RequireApproval: jitSettings.data?.RequireApproval ?? false, + ApprovalTriggerRoles: jitSettings.data?.ApprovalTriggerRoles ?? [], + ApproverRoles: jitSettings.data?.ApproverRoles ?? [], + RequiredApprovals: jitSettings.data?.RequiredApprovals ?? 1, }); } }, [jitSettings.isSuccess, jitSettings.data]); @@ -40,6 +50,10 @@ const CippJitAdminSettings = () => { data: { Action: "Set", MaxDuration: formData.MaxDuration || null, + RequireApproval: formData.RequireApproval, + ApprovalTriggerRoles: formData.ApprovalTriggerRoles, + ApproverRoles: formData.ApproverRoles, + RequiredApprovals: formData.RequiredApprovals, }, queryKey: "jitAdminSettingsPost", }); @@ -118,6 +132,63 @@ const CippJitAdminSettings = () => { + + + Approval + + + {requireApproval && ( + + ({ label: role.Name, value: role.ObjectId }))} + multiple={true} + creatable={false} + formControl={formControl} + /> + + !requireApproval || value?.length > 0 || "Select at least one approver role", + }} + /> + + + Approvers are notified through the configured notification methods and by push if + they have it enabled. The requester cannot approve their own request, and any + rejection ends the request. + + + )} + + {/* API Results */} diff --git a/frontend/src/components/CippSettings/CippLogRetentionSettings.jsx b/frontend/src/components/CippSettings/CippLogRetentionSettings.jsx index c4fb81a488..7437dfbd26 100644 --- a/frontend/src/components/CippSettings/CippLogRetentionSettings.jsx +++ b/frontend/src/components/CippSettings/CippLogRetentionSettings.jsx @@ -8,7 +8,7 @@ const CippLogRetentionSettings = ({ title = "Log Retention", endpoint = "ExecLogRetentionConfig", defaultDays = 90, - description = "Configure how long to keep CIPP log entries. Logs will be automatically deleted after this period.", + description = "Configure how long to keep Manage365 log entries. Logs will be automatically deleted after this period.", }) => { const retentionSetting = ApiGetCall({ url: `/api/${endpoint}?List=true`, diff --git a/frontend/src/components/CippSettings/CippPermissionCheck.jsx b/frontend/src/components/CippSettings/CippPermissionCheck.jsx index 3e4f1e7728..aaec1372d2 100644 --- a/frontend/src/components/CippSettings/CippPermissionCheck.jsx +++ b/frontend/src/components/CippSettings/CippPermissionCheck.jsx @@ -116,7 +116,7 @@ const CippPermissionCheck = (props) => { const responseText = typeof responseData === "string" ? responseData : responseData ? JSON.stringify(responseData) : ""; const shouldShowApiResponse = responseText.includes( - "Access to this CIPP API endpoint is not allowed", + "Access to this Manage365 API endpoint is not allowed", ); const checkErrorMessage = shouldShowApiResponse diff --git a/frontend/src/components/CippSettings/CippPermissionReport.jsx b/frontend/src/components/CippSettings/CippPermissionReport.jsx index b26a7ca747..e7b07d0c43 100644 --- a/frontend/src/components/CippSettings/CippPermissionReport.jsx +++ b/frontend/src/components/CippSettings/CippPermissionReport.jsx @@ -80,17 +80,15 @@ export const CippPermissionReport = (props) => { "DisplayName", "DefaultDomainName", "UserPrincipalName", - "ServiceAccount", "IPAddress", - "AssignedRoles", - "GDAPRoles", // reports exported before AssignedRoles was renamed + "GDAPRoles", ]; if (formData.redactCustomerData) { report.Tenants.Results = report?.Tenants?.Results?.map((tenant) => { customerProps.forEach((prop) => { if (tenant?.[prop]) { - if (prop === "AssignedRoles" || prop === "GDAPRoles") { + if (prop === "GDAPRoles") { tenant[prop] = tenant[prop].map((role) => { if (Array.isArray(role?.Group)) { role.Group = role.Group.map((group) => group?.split("@")[0]); diff --git a/frontend/src/components/CippSettings/CippRoleAddEdit.jsx b/frontend/src/components/CippSettings/CippRoleAddEdit.jsx index e213ebb888..ba5d5fbfe9 100644 --- a/frontend/src/components/CippSettings/CippRoleAddEdit.jsx +++ b/frontend/src/components/CippSettings/CippRoleAddEdit.jsx @@ -653,9 +653,9 @@ export const CippRoleAddEdit = ({ selectedRole }) => { )} {cippApiRoleSelected && ( - This is the default role for all API clients in the CIPP-API integration. If you + This is the default role for all API clients in the Manage365 API integration. If you would like different permissions for specific applications, create a role per - application and select it from the CIPP-API integrations page. + application and select it from the Manage365 API integrations page. )} { @@ -26,13 +37,13 @@ const CippRoles = () => { label: "Impersonate Role", icon: ( - + ), confirmText: ( - Impersonate this role? CIPP will reload and behave as if you only hold this + Impersonate this role? Manage365 will reload and behave as if you only hold this role — including its tenant restrictions — until you click Exit in the banner at the top of the page. IP restrictions are not simulated. @@ -57,19 +68,20 @@ const CippRoles = () => { : []), { label: "Edit", - pinned: true, icon: ( - + ), link: "/cipp/advanced/authentication/cipp-roles/edit?role=[RoleName]", + color: "info", + category: "edit", }, { label: "Clone", icon: ( - + ), type: "POST", @@ -92,12 +104,14 @@ const CippRoles = () => { relatedQueryKeys: ["customRoleList", "customRoleTable"], confirmText: "Are you sure you want to clone this custom role?", condition: (row) => row?.Type === "Custom", + color: "success", + category: "manage", }, { label: "Delete", icon: ( - + ), confirmText: "Are you sure you want to delete this custom role?", @@ -109,6 +123,145 @@ const CippRoles = () => { }, condition: (row) => row?.Type === "Custom", relatedQueryKeys: ["customRoleList", "customRoleTable"], + color: "error", + category: "danger", + }, + ]; + + // Custom columns with better formatting + const columns = [ + { + header: "Role Name", + id: "RoleName", + accessorKey: "RoleName", + Cell: ({ row }) => ( + + + {row.original.Type === "Custom" ? ( + + ) : ( + + )} + + + {row.original.RoleName} + + + ), + }, + { + header: "Type", + id: "Type", + accessorKey: "Type", + Cell: ({ row }) => ( + + ), + }, + { + header: "Entra Group", + id: "EntraGroup", + accessorKey: "EntraGroup", + Cell: ({ row }) => { + const group = row.original.EntraGroup; + if (!group || group.length === 0) { + return ( + + Not assigned + + ); + } + return ( + + + {group} + + ); + }, + }, + { + header: "Allowed Tenants", + id: "AllowedTenants", + accessorKey: "AllowedTenants", + Cell: ({ row }) => { + const tenants = row.original.AllowedTenants; + if (!tenants || tenants.length === 0) { + return ( + } + /> + ); + } + if (Array.isArray(tenants)) { + return ( + + {tenants.slice(0, 2).map((tenant, idx) => ( + + ))} + {tenants.length > 2 && ( + + )} + + ); + } + return {tenants}; + }, + }, + { + header: "Blocked Tenants", + id: "BlockedTenants", + accessorKey: "BlockedTenants", + Cell: ({ row }) => { + const tenants = row.original.BlockedTenants; + if (!tenants || tenants.length === 0) { + return ( + + None + + ); + } + if (Array.isArray(tenants)) { + return ( + + {tenants.slice(0, 2).map((tenant, idx) => ( + } + /> + ))} + {tenants.length > 2 && ( + + )} + + ); + } + return {tenants}; + }, }, ]; @@ -132,9 +285,7 @@ const CippRoles = () => { properties.push({ label: "Permission Rules", value: ( - + {rules.Include.map((pattern, idx) => ( ))} @@ -169,39 +320,38 @@ const CippRoles = () => { title="Role Details" propertyItems={properties} actionItems={actions} + data={data} /> ); }, }; return ( - - - - - } - component={NextLink} - href="/cipp/advanced/authentication/cipp-roles/add" - > - Add Role - - } - api={{ - url: "/api/ListCustomRole", - }} - queryKey="customRoleTable" - simpleColumns={["RoleName", "Type", "EntraGroup", "AllowedTenants", "BlockedTenants"]} - offCanvas={offCanvas} - /> - + + + + } + component={NextLink} + href="/cipp/advanced/authentication/cipp-roles/add" + > + Add Role + + } + api={{ + url: "/api/ListCustomRole", + }} + queryKey="customRoleTable" + columns={columns} + offCanvas={offCanvas} + /> ); }; diff --git a/frontend/src/components/CippSettings/CippSSOSettings.jsx b/frontend/src/components/CippSettings/CippSSOSettings.jsx index a229e15530..778b9a7dc3 100644 --- a/frontend/src/components/CippSettings/CippSSOSettings.jsx +++ b/frontend/src/components/CippSettings/CippSSOSettings.jsx @@ -40,12 +40,12 @@ const ssoAppPermissions = [ { name: "profile", reason: - "Reads the signed-in user's display name, object ID and tenant ID, so CIPP knows which account signed in.", + "Reads the signed-in user's display name, object ID and tenant ID, so Manage365 knows which account signed in.", }, { name: "email", reason: - "Reads the signed-in user's UPN, which CIPP matches against the CIPP Users list to decide their roles.", + "Reads the signed-in user's UPN, which Manage365 matches against the Manage365 Users list to decide their roles.", }, { name: "offline_access", @@ -69,7 +69,7 @@ const samPermissionsUsed = [ { name: "Policy.ReadWrite.ApplicationConfiguration", reason: - "Exempts CIPP from a tenant app management policy that blocks adding client secrets — only used when such a policy is in force.", + "Exempts Manage365 from a tenant app management policy that blocks adding client secrets — only used when such a policy is in force.", }, ]; @@ -251,7 +251,7 @@ export const CippSSOSettings = () => { const handleUpdate = () => { if ( !window.confirm( - "Updating SSO settings will restart the CIPP instance. Changes may take up to 60 seconds to reflect. Do you want to continue?" + "Updating SSO settings will restart the Manage365 instance. Changes may take up to 60 seconds to reflect. Do you want to continue?" ) ) { return; @@ -335,19 +335,19 @@ export const CippSSOSettings = () => { - CIPP signs users in through an app registration called CIPP-SSO{" "} - in your own partner tenant, which puts CIPP sign-in under your Conditional + Manage365 signs users in through an app registration called CIPP-SSO{" "} + in your own partner tenant, which puts Manage365 sign-in under your Conditional Access policies, MFA requirements and session controls. The app only proves who - you are — it has no access to any data in your tenant. Everything CIPP does + you are — it has no access to any data in your tenant. Everything Manage365 does against Microsoft 365 still runs through the CIPP-SAM app and your GDAP relationships. You do not need Entra ID Global Administrator to run this - setup, and there is no separate enterprise app for anyone to approve. CIPP - creates the app itself using permissions your tenant consented to when CIPP was - installed. A CIPP superadmin or admin role is all that is required. + setup, and there is no separate enterprise app for anyone to approve. Manage365 + creates the app itself using permissions your tenant consented to when Manage365 was + installed. A Manage365 superadmin or admin role is all that is required.
      @@ -366,13 +366,13 @@ export const CippSSOSettings = () => { without a signed-in user. None of these scopes grant access to mail, files, Teams or directory data — they are the standard OpenID Connect sign-in scopes plus offline_access to renew the session, all classed by Microsoft as low - impact. Who can actually reach CIPP is still controlled by the CIPP Users list. + impact. Who can actually reach Manage365 is still controlled by the Manage365 Users list.
      - Permissions CIPP uses to create it + Permissions Manage365 uses to create it { mt: 1 }}> These are part of the standard CIPP-SAM permission set and were consented when - CIPP was installed — nothing new is requested during setup. If setup fails on + Manage365 was installed — nothing new is requested during setup. If setup fails on one of these steps, your CIPP-SAM consent predates that permission and needs re-consenting from the SAM App Permissions page. @@ -395,7 +395,7 @@ export const CippSSOSettings = () => { The most common blocker is a tenant app management policy that forbids adding - client secrets. Repair retries it, and CIPP will try to exempt + client secrets. Repair retries it, and Manage365 will try to exempt itself from the policy. If it still fails, an Entra administrator can create the CIPP-SSO app registration by hand and you can store its credentials under{" "} Manual configuration below — the documentation has the exact @@ -617,7 +617,7 @@ export const CippSSOSettings = () => { Enter an existing Application (client) ID and client secret to store them directly in Key Vault — for example to rotate the secret by hand, or to point SSO at an app registration an Entra administrator created for you because a tenant policy blocks - CIPP from creating one. The instance must be restarted for the change to take + Manage365 from creating one. The instance must be restarted for the change to take effect.{" "} Settings to use when creating the app manually diff --git a/frontend/src/components/CippSettings/CippSiemSettings.jsx b/frontend/src/components/CippSettings/CippSiemSettings.jsx index a607497c5f..f4b299c0ae 100644 --- a/frontend/src/components/CippSettings/CippSiemSettings.jsx +++ b/frontend/src/components/CippSettings/CippSiemSettings.jsx @@ -30,7 +30,7 @@ const CippSiemSettings = () => { return ( { > - Generate a read-only SAS token for the CIPP Logs table. This token can be used to query + Generate a read-only SAS token for the Manage365 Logs table. This token can be used to query log data from external SIEM tools or scripts using the Azure Table Storage REST API. Note that generating a new URL does not invalidate previous URLs. diff --git a/frontend/src/components/CippSettings/CippTenantResults.jsx b/frontend/src/components/CippSettings/CippTenantResults.jsx index ff3251d061..13ae35802b 100644 --- a/frontend/src/components/CippSettings/CippTenantResults.jsx +++ b/frontend/src/components/CippSettings/CippTenantResults.jsx @@ -14,25 +14,21 @@ export const CippTenantResults = (props) => { actions={[]} simpleColumns={[ "TenantName", - "TenantType", "LastRun", "GraphStatus", "ExchangeStatus", "MissingRoles", - "AssignedRoles", + "GDAPRoles", ]} offCanvas={{ extendedInfoFields: [ "TenantName", "TenantId", - "TenantType", "DefaultDomainName", - "ServiceAccount", - "ServiceAccountLastAuth", "LastRun", "GraphTest", "ExchangeTest", - "OrgManagementRepairNeeded", + "OrgManagementRepairNeeeded", "OrgManagementRoles", "OrgManagementRolesMissing", ], @@ -60,6 +56,7 @@ export const CippTenantResults = (props) => { confirmText: "Execute the access check for the selected tenant(s)?", relatedQueryKeys: "ExecAccessChecks-Tenants", multiPost: false, + category: "view", }, { label: "Repair Exchange Roles", @@ -69,26 +66,22 @@ export const CippTenantResults = (props) => { icon: , confirmText: "Repair Exchange roles for [TenantName]?", condition: (row) => row.OrgManagementRepairNeeded === true, + category: "manage", }, ]} simpleColumns={[ "TenantName", - "TenantType", - "ServiceAccount", "LastRun", "GraphStatus", "ExchangeStatus", "MissingRoles", - "AssignedRoles", + "GDAPRoles", ]} offCanvas={{ extendedInfoFields: [ "TenantName", "TenantId", - "TenantType", "DefaultDomainName", - "ServiceAccount", - "ServiceAccountLastAuth", "LastRun", "GraphTest", "ExchangeTest", diff --git a/frontend/src/components/CippSettings/CippUserManagement.jsx b/frontend/src/components/CippSettings/CippUserManagement.jsx index 9175c210b3..ed1926b211 100644 --- a/frontend/src/components/CippSettings/CippUserManagement.jsx +++ b/frontend/src/components/CippSettings/CippUserManagement.jsx @@ -115,7 +115,7 @@ export const CippUserManagement = () => { ), - confirmText: "Are you sure you want to remove this user's access to CIPP?", + confirmText: "Are you sure you want to remove this user's access to Manage365?", url: "/api/ExecCIPPUsers", type: "POST", data: { @@ -284,7 +284,7 @@ export const CippUserManagement = () => { ? `Bulk Edit Roles — ${bulkEditUsers.length} users` : editingUser ? `Edit Roles — ${editingUser.UPN}` - : "Add CIPP User"} + : "Add Manage365 User"} diff --git a/frontend/src/components/CippSettings/CippVersionProperties.jsx b/frontend/src/components/CippSettings/CippVersionProperties.jsx index edc6ff8307..9003d02227 100644 --- a/frontend/src/components/CippSettings/CippVersionProperties.jsx +++ b/frontend/src/components/CippSettings/CippVersionProperties.jsx @@ -1,8 +1,38 @@ -import { Box, Button, Stack, SvgIcon } from "@mui/material"; -import { CippIcons } from "../../utils/icon-registry"; -import { CippPropertyListCard } from "../CippCards/CippPropertyListCard"; +import { useState } from "react"; +import { + Accordion, + AccordionDetails, + AccordionSummary, + Box, + Button, + SvgIcon, + Tooltip, + Typography, + Card, + CardHeader, + CardContent, + CardActions, + Chip, + Stack, + Divider, + alpha, + useTheme, + CircularProgress, +} from "@mui/material"; +import { + CheckCircle, + Warning, + Sync, + Refresh, + Delete, + Computer, + Cloud, + Storage, + Hub, + ExpandMore, +} from "@mui/icons-material"; import { ApiGetCall } from "../../api/ApiCall"; -import { useEffect, useState } from "react"; +import { useEffect } from "react"; const formatUtc = (value) => { if (!value) return null; @@ -12,7 +42,13 @@ const formatUtc = (value) => { }; const CippVersionProperties = () => { - const [copied, setCopied] = useState(false); + const theme = useTheme(); + const [cleaningUp, setCleaningUp] = useState(false); + + const manage365Version = ApiGetCall({ + url: "/manage365-version.json", + queryKey: "Manage365Version", + }); const version = ApiGetCall({ url: "/version.json", @@ -32,30 +68,155 @@ const CippVersionProperties = () => { } }, [version, cippVersion]); - const CippVersionComponent = (version, availableVersion, outOfDate) => { + // Cleanup stale versions and refresh + const handleCleanupAndRefresh = async () => { + setCleaningUp(true); + try { + // Call API with cleanup flag + await fetch( + `/api/GetVersion?LocalVersion=${encodeURIComponent(version?.data?.version ?? "")}&CleanupStale=true` + ); + // Refetch to get updated data + await cippVersion.refetch(); + } catch (error) { + console.error("Failed to cleanup stale versions:", error); + } finally { + setCleaningUp(false); + } + }; + + // Version badge component + const VersionBadge = ({ version, latestVersion, isOutOfDate, label, icon }) => { + const isUpToDate = !isOutOfDate; + return ( - - - {outOfDate === true ? : } - - v{version}{" "} - {outOfDate === true ? `(v${availableVersion} is available)` : ""} + + + + {icon} + + + + {label} + + + {version ? `v${version}` : "Unknown"} + + + + + {isOutOfDate && ( + + )} + + {isUpToDate ? : } + + + + ); + }; + + // Backend app version row + const BackendVersionRow = ({ app, isLast }) => { + const isOutOfSync = app?.OutOfSync; + + return ( + + + + + + + {app.FriendlyName || app.Name} + + + + + v{app?.Version || "?"} + + {isOutOfSync ? ( + + + + + + ) : ( + + + + + + )} + ); }; + const backendVersions = cippVersion?.data?.BackendVersions || []; const hosting = cippVersion?.data?.Hosting; const lastUpdate = cippVersion?.data?.LastUpdate; + const [copied, setCopied] = useState(false); const lastUpdateText = lastUpdate - ? `v${lastUpdate.PreviousVersion} → v${lastUpdate.NewVersion} (${formatUtc( - lastUpdate.RecordedAt - )})` + ? `v${lastUpdate.PreviousVersion} → v${lastUpdate.NewVersion} (${formatUtc(lastUpdate.RecordedAt)})` : "No update recorded yet"; const handleCopy = async () => { const versionLine = (label, local, remote, outOfDate) => `${label}: v${local ?? "Unknown"}${outOfDate === true ? ` (v${remote} available)` : ""}`; - const text = [ + const ticket = [ + `Manage365: v${manage365Version?.data?.version ?? "Unknown"}`, versionLine( "Frontend", version?.data?.version, @@ -71,89 +232,223 @@ const CippVersionProperties = () => { `Hosting: ${hosting?.HostingType ?? "Unknown"}`, `SKU: ${hosting?.SKU ?? "Unknown"}`, `Runtime: ${hosting?.RuntimeStack ?? "Unknown"}`, - `Last update: ${ - lastUpdate - ? `v${lastUpdate.PreviousVersion} → v${lastUpdate.NewVersion} (${formatUtc( - lastUpdate.RecordedAt - )})` - : "none recorded" - }`, + `Last update: ${lastUpdateText}`, ].join("\n"); try { - await navigator.clipboard.writeText(text); + await navigator.clipboard.writeText(ticket); setCopied(true); setTimeout(() => setCopied(false), 2000); - } catch (err) { - console.error("Failed to copy version info: ", err); + } catch (error) { + console.error("Failed to copy version info:", error); } }; return ( - - + + + ) : null + } + /> + + + + {/* Manage365 Fork Version */} + + + + + + + + Manage365 + + + {manage365Version?.data?.version + ? `v${manage365Version.data.version}${ + manage365Version.data.upstreamBaseline + ? ` (upstream baseline v${manage365Version.data.upstreamBaseline})` + : "" + }` + : "Unknown"} + + + + } + label="Fork" + size="small" + color="info" + variant="outlined" + sx={{ height: 22, fontSize: "0.7rem" }} + /> + + + {/* Upstream CIPP section */} + + Upstream CIPP + + + {/* Frontend Version */} + } + /> + + {/* Backend Version */} + } + /> + + + + Hosting + + Type: {hosting?.HostingType ?? "Unknown"} + App Service SKU: {hosting?.SKU ?? "Unknown"} + Runtime: {hosting?.RuntimeStack ?? "Unknown"} + Last updated: {lastUpdateText} + + {/* Backend Function Apps -- collapsible, auto-expands when out of sync */} + {backendVersions.length > 0 && (() => { + const outOfSyncCount = backendVersions.filter((app) => app.OutOfSync).length; + const hasOutOfSync = outOfSyncCount > 0; + + return ( + + } + sx={{ + minHeight: 44, + px: 1.5, + bgcolor: hasOutOfSync + ? alpha(theme.palette.warning.main, 0.06) + : "transparent", + "& .MuiAccordionSummary-content": { my: 0.75 }, + }} + > + + + Function Apps ({backendVersions.length}) + + {hasOutOfSync ? ( + } + label={`${outOfSyncCount} out of sync`} + size="small" + color="warning" + variant="outlined" + sx={{ height: 22, fontSize: "0.7rem", ml: "auto" }} + /> + ) : ( + } + label="All in sync" + size="small" + color="success" + variant="outlined" + sx={{ height: 22, fontSize: "0.7rem", ml: "auto" }} + /> + )} + + + + {backendVersions.map((app, index) => ( + + ))} + + + ); + })()} + + + + + + + - - } - title="Version" - isFetching={cippVersion.isFetching} - cardSx={{ display: "flex", flexDirection: "column", height: "100%", width: "100%" }} - propertyItems={[ - { - label: "Frontend", - value: CippVersionComponent( - version?.data?.version, - cippVersion?.data?.RemoteCIPPVersion, - cippVersion?.data?.OutOfDateCIPP - ), - }, - { - label: "Backend", - value: CippVersionComponent( - cippVersion?.data?.LocalCIPPAPIVersion, - cippVersion?.data?.RemoteCIPPAPIVersion, - cippVersion?.data?.OutOfDateCIPPAPI - ), - }, - { - label: "Hosting", - value: hosting?.HostingType ?? "Unknown", - }, - { - label: "App Service SKU", - value: hosting?.SKU ?? "Unknown", - }, - { - label: "Runtime Stack", - value: hosting?.RuntimeStack ?? "Unknown", - }, - { - label: "Last Updated", - value: lastUpdateText, - }, - ].map((item) => ({ ...item, sx: { py: 0.5, px: { xs: 2, md: 3 } } }))} - /> + + + ); }; diff --git a/frontend/src/components/CippStandards/CippStandardAccordion.jsx b/frontend/src/components/CippStandards/CippStandardAccordion.jsx index 857c1e49f1..c5ea1f3f73 100644 --- a/frontend/src/components/CippStandards/CippStandardAccordion.jsx +++ b/frontend/src/components/CippStandards/CippStandardAccordion.jsx @@ -3,7 +3,6 @@ import { CippIcons } from "../../utils/icon-registry"; import { Card, Stack, - Alert, Avatar, Box, Typography, @@ -22,10 +21,24 @@ import { Checkbox, ListItemText, } from "@mui/material"; +import { + ExpandMore as ExpandMoreIcon, + Delete, + Add, + Public, + Search, + Close, + FilterAlt, + NotificationImportant, + Assignment, + Construction, +} from "@mui/icons-material"; import { Grid } from "@mui/system"; import CippFormComponent from "../CippComponents/CippFormComponent"; import { useWatch, useFormState } from "react-hook-form"; -import { get, isEqual, cloneDeep } from "lodash"; +import get from "lodash/get"; +import isEqual from "lodash/isEqual"; +import cloneDeep from "lodash/cloneDeep"; import Microsoft from "../../icons/iconly/bulk/microsoft"; import Azure from "../../icons/iconly/bulk/azure"; import Exchange from "../../icons/iconly/bulk/exchange"; @@ -33,7 +46,7 @@ import Defender from "../../icons/iconly/bulk/defender"; import Intune from "../../icons/iconly/bulk/intune"; import GDAPRoles from "../../data/GDAPRoles"; import timezoneList from "../../data/timezoneList"; -import { getStandards } from "../../utils/standards-data"; +import standards from "../../data/standards.json"; import { CippFormCondition } from "../CippComponents/CippFormCondition"; import { CippPolicyImportDrawer } from "../CippComponents/CippPolicyImportDrawer"; import ReactMarkdown from "react-markdown"; @@ -47,9 +60,8 @@ const getAvailableActions = (disabledFeatures) => { return allActions.filter((action) => !disabledFeatures?.[action.value.toLowerCase()]); }; -const CippAddedComponent = React.memo(({ standardName, component, formControl, currentValue }) => { +const CippAddedComponent = React.memo(({ standardName, component, formControl }) => { const updatedComponent = { ...component }; - const fieldName = `${standardName}.${updatedComponent.name}`; if (component.type === "AdminRolesMultiSelect") { updatedComponent.type = "autoComplete"; @@ -68,30 +80,15 @@ const CippAddedComponent = React.memo(({ standardName, component, formControl, c updatedComponent.type = component.type; } - const warningThreshold = Number(updatedComponent.warningThreshold); - const numericValue = Number(currentValue); - const showThresholdWarning = - Number.isFinite(warningThreshold) && - !Number.isNaN(numericValue) && - `${currentValue}`.trim() !== "" && - numericValue > warningThreshold; - - const warningMessage = - updatedComponent.warningMessage || - `Values above ${warningThreshold} can match unrelated policies. Use with caution.`; - return ( - - - {showThresholdWarning && {warningMessage}} - + ); }); @@ -113,7 +110,7 @@ const CippStandardAccordion = ({ const [searchQuery, setSearchQuery] = useState(""); const [savedValues, setSavedValues] = useState({}); const [originalValues, setOriginalValues] = useState({}); - const [bulkAnchorEl, setBulkAnchorEl] = useState(null); + const [actionsMenuAnchor, setActionsMenuAnchor] = useState(null); const [bulkActions, setBulkActions] = useState([]); const watchedValues = useWatch({ @@ -306,9 +303,9 @@ const CippStandardAccordion = ({ const updated = { ...prev }; removedKeys.forEach((k) => delete updated[k]); addedKeys.forEach((k) => { - const currentValues = get(watchedValues, k); + const currentValues = _.get(watchedValues, k); if (currentValues) { - updated[k] = cloneDeep(currentValues); + updated[k] = _.cloneDeep(currentValues); } }); return updated; @@ -320,7 +317,7 @@ const CippStandardAccordion = ({ addedKeys.forEach((k) => { const baseStandardName = k.split("[")[0]; const standard = providedStandards.find((s) => s.name === baseStandardName); - const currentValues = get(watchedValues, k); + const currentValues = _.get(watchedValues, k); if (standard && currentValues) { updated[k] = isStandardConfigured(k, standard, currentValues); } @@ -367,48 +364,47 @@ const CippStandardAccordion = ({ formControl.setValue(`${standardName}.action`, action); }; - // Apply the selected action set to every standard in the template - const handleBulkSetActions = () => { - // Collapse any expanded accordion so the action change isn't edited underneath the user - if (expanded) { - handleAccordionToggle(null); - } - - const newSaved = {}; - const newConfigured = {}; + // Cancel changes for a standard + const toggleBulkAction = (action) => { + setBulkActions((prev) => + prev.some((item) => item.value === action.value) + ? prev.filter((item) => item.value !== action.value) + : [...prev, action], + ); + }; + // Apply the picked actions to every selected standard, keeping only the actions that + // standard allows. Deprecated and unknown standards are left alone, and a standard + // with no overlap keeps its current action instead of being written empty. + const applyBulkActions = () => { Object.keys(selectedStandards).forEach((standardName) => { const baseStandardName = standardName.split("[")[0]; - const standard = providedStandards.find((s) => s.name === baseStandardName); - if (!standard) return; // unknown/removed standard — skip - if (standard.deprecated) return; // deprecated standards can't be configured + const standard = providedStandards.find((item) => item.name === baseStandardName); + if (!standard || standard._unknown || standard.deprecated) return; - // Replace the action selection, keeping only actions this standard supports - const nextActions = getAvailableActions(standard.disabledFeatures).filter((action) => - bulkActions.includes(action.value), + const available = getAvailableActions(standard.disabledFeatures); + const picked = bulkActions.filter((action) => + available.some((item) => item.value === action.value), ); - if (nextActions.length === 0) return; + if (picked.length === 0) return; - formControl.setValue(`${standardName}.action`, nextActions, { shouldDirty: true }); - - // Only the action is saved — any other unsaved edits stay unsaved so Cancel still reverts them - const previous = get(savedValues, standardName); - const merged = previous - ? { ...cloneDeep(previous), action: nextActions } - : { action: nextActions }; - newSaved[standardName] = merged; - newConfigured[standardName] = isStandardConfigured(standardName, standard, merged); + formControl.setValue(`${standardName}.action`, picked); + setSavedValues((prev) => { + const existing = prev[standardName]; + if (!existing) return prev; + return { ...prev, [standardName]: { ...existing, action: picked } }; + }); }); - setSavedValues((prev) => ({ ...prev, ...newSaved })); - setConfiguredState((prev) => ({ ...prev, ...newConfigured })); - setBulkAnchorEl(null); + if (expanded) { + handleAccordionToggle(null); + } + setActionsMenuAnchor(null); }; - // Cancel changes for a standard const handleCancel = (standardName) => { - // Get the last saved values - const savedValue = get(savedValues, standardName); + // Saved values are keyed by the full standard path, which contains dots. + const savedValue = savedValues[standardName] ?? get(savedValues, standardName); if (!savedValue) return; // Set the entire standard's value at once to ensure proper handling of nested objects and arrays @@ -440,25 +436,9 @@ const CippStandardAccordion = ({ Object.keys(selectedStandards).forEach((standardName) => { const baseStandardName = standardName.split("[")[0]; const standard = providedStandards.find((s) => s.name === baseStandardName); + if (!standard) return; - if (!standard) { - // Unknown/deprecated standard — surface it so the user can remove it - const unknownCategory = "Unknown Standards"; - if (!result[unknownCategory]) { - result[unknownCategory] = []; - } - result[unknownCategory].push({ - standardName, - standard: { - _unknown: true, - name: baseStandardName, - label: baseStandardName, - }, - }); - return; - } - - const standardInfo = getStandards().find((s) => s.name === baseStandardName); + const standardInfo = standards.find((s) => s.name === baseStandardName); const category = standardInfo?.cat || "Other Standards"; if (!result[category]) { @@ -613,6 +593,31 @@ const CippStandardAccordion = ({ }} /> + + setActionsMenuAnchor(null)} + > + {getAvailableActions().map((action) => ( + toggleBulkAction(action)}> + item.value === action.value)} + tabIndex={-1} + disableRipple + /> + {action.label} + + ))} + Apply to all standards + - {!isDriftMode && ( - <> - - setBulkAnchorEl(null)} - > - {getAvailableActions({}).map((action) => ( - - setBulkActions((prev) => - prev.includes(action.value) - ? prev.filter((v) => v !== action.value) - : [...prev, action.value], - ) - } - > - - - - ))} - - - - - - - )} {!hasFilteredStandards && ( @@ -829,8 +788,8 @@ const CippStandardAccordion = ({ const accordionTitle = templateDisplayName ? `${standard.label} - ${templateDisplayName}` : selectedTemplateName && get(selectedTemplateName, "label") - ? `${standard.label} - ${get(selectedTemplateName, "label")}` - : standard.label; + ? `${standard.label} - ${get(selectedTemplateName, "label")}` + : standard.label; // Get current values and check if they differ from saved values const current = get(watchedValues, standardName); @@ -1149,10 +1108,6 @@ const CippStandardAccordion = ({ standardName={standardName} component={component} formControl={formControl} - currentValue={get( - watchedValues, - `${standardName}.${component.name}`, - )} /> ) : ( @@ -1161,10 +1116,6 @@ const CippStandardAccordion = ({ standardName={standardName} component={component} formControl={formControl} - currentValue={get( - watchedValues, - `${standardName}.${component.name}`, - )} /> ), )} @@ -1215,10 +1166,6 @@ const CippStandardAccordion = ({ standardName={standardName} component={component} formControl={formControl} - currentValue={get( - watchedValues, - `${standardName}.${component.name}`, - )} /> ) : ( @@ -1227,10 +1174,6 @@ const CippStandardAccordion = ({ standardName={standardName} component={component} formControl={formControl} - currentValue={get( - watchedValues, - `${standardName}.${component.name}`, - )} /> ), )} diff --git a/frontend/src/components/CippStandards/CippStandardsSideBar.jsx b/frontend/src/components/CippStandards/CippStandardsSideBar.jsx index ea4693b47d..009c8cba44 100644 --- a/frontend/src/components/CippStandards/CippStandardsSideBar.jsx +++ b/frontend/src/components/CippStandards/CippStandardsSideBar.jsx @@ -27,7 +27,7 @@ import { ActionList } from "../action-list"; import { ActionListItem } from "../action-list-item"; import { useWatch } from "react-hook-form"; import { useEffect, useState } from "react"; -import { get } from "lodash"; +import get from "lodash/get"; import CippFormComponent from "../CippComponents/CippFormComponent"; import { CippFormTenantSelector } from "../CippComponents/CippFormTenantSelector"; import { CippApiDialog } from "../CippComponents/CippApiDialog"; @@ -57,9 +57,9 @@ export const buildSyncedTemplateFields = ({ let warning; let severity = "warning"; if (!canSaveToGitHub) { - warning = `This ${kind} is synchronized from ${source}, which you cannot push to. Saving here keeps your changes in CIPP only, and the next sync will replace them if the repository file changes upstream. To keep a copy that upstream never touches, use ${cloneAction} from the ${list} instead.`; + warning = `This ${kind} is synchronized from ${source}, which you cannot push to. Saving here keeps your changes in Manage365 only, and the next sync will replace them if the repository file changes upstream. To keep a copy that upstream never touches, use ${cloneAction} from the ${list} instead.`; } else if (hasLocalChanges) { - warning = `This ${kind} already has changes that are not in ${source}. Turn on Save to GitHub to push them with this save, or they stay in CIPP only.`; + warning = `This ${kind} already has changes that are not in ${source}. Turn on Save to GitHub to push them with this save, or they stay in Manage365 only.`; } else { warning = `This ${kind} is synchronized from ${source}. Saving here does not push your changes upstream; the repository copy stays out of date until you save it to GitHub.`; severity = hasLocalChanges === false ? "info" : "warning"; @@ -242,7 +242,7 @@ const CippStandardsSideBar = ({ }; // Enhanced drift validation using CIPP patterns with group support - const validateDrift = async (tenants, excludedTenants) => { + const validateDrift = async (tenants) => { if (!isDriftMode || !tenants || tenants.length === 0) { setDriftError(""); onDriftConflictChange?.(false); @@ -268,9 +268,6 @@ const CippStandardsSideBar = ({ // Expand selected tenants (including group members) const selectedTenantList = expandGroupsToTenants(tenants, groups); - // Expand excluded tenants the same way; a tenant excluded here can never overlap - const excludedTenantSet = new Set(expandGroupsToTenants(excludedTenants || [], groups)); - // Simple conflict check const conflicts = []; @@ -295,21 +292,17 @@ const CippStandardsSideBar = ({ const template = uniqueTemplates[templateId]; const templateTenants = template.tenants; - // Template tenants come from ListTenantAlignment rows, which already have that - // template's own exclusions applied — only this form's exclusions need subtracting - const selectedHasAllTenants = selectedTenantList.includes("AllTenants"); - const hasConflict = templateTenants.some( - (templateTenant) => - !excludedTenantSet.has(templateTenant) && - (selectedHasAllTenants || - templateTenant === "AllTenants" || - selectedTenantList.some( - (selectedTenant) => - selectedTenant !== "AllTenants" && - !excludedTenantSet.has(selectedTenant) && - selectedTenant === templateTenant, - )), - ); + const hasConflict = selectedTenantList.some((selectedTenant) => { + // Check if any template tenant matches the selected tenant + const conflict = templateTenants.some((templateTenant) => { + if (selectedTenant === "AllTenants" || templateTenant === "AllTenants") { + return true; + } + const match = selectedTenant === templateTenant; + return match; + }); + return conflict; + }); if (hasConflict) { conflicts.push(template.standardName || "Unknown Template"); @@ -338,17 +331,11 @@ const CippStandardsSideBar = ({ if (!isDriftMode) return; const timeoutId = setTimeout(() => { - validateDrift(watchForm.tenantFilter, watchForm.excludedTenants); + validateDrift(watchForm.tenantFilter); }, 500); return () => clearTimeout(timeoutId); - }, [ - watchForm.tenantFilter, - watchForm.excludedTenants, - isDriftMode, - driftValidationApi.data, - tenantGroupsApi.data, - ]); + }, [watchForm.tenantFilter, isDriftMode, driftValidationApi.data, tenantGroupsApi.data]); useEffect(() => { const stepsStatus = { @@ -442,7 +429,7 @@ const CippStandardsSideBar = ({ }}> • Monitors all security standards, Conditional Access policies, and Intune policies
      - • Detects changes made outside of CIPP + • Detects changes made outside of Manage365
      • Configurable webhook and email notifications
      • Granular control over deviation acceptance diff --git a/frontend/src/components/CippTable/CIPPTableToptoolbar.jsx b/frontend/src/components/CippTable/CIPPTableToptoolbar.jsx index 4d1053d7e2..8b191e8f1c 100644 --- a/frontend/src/components/CippTable/CIPPTableToptoolbar.jsx +++ b/frontend/src/components/CippTable/CIPPTableToptoolbar.jsx @@ -19,8 +19,11 @@ import { ListSubheader, Divider, IconButton, + ToggleButton, + ToggleButtonGroup, Tooltip, Typography, + Chip, Checkbox, SvgIcon, Dialog, @@ -28,9 +31,40 @@ import { DialogContent, DialogActions, } from '@mui/material' +import { + Search as SearchIcon, + FilterList as FilterListIcon, + ViewColumn as ViewColumnIcon, + FileDownload as ExportIcon, + KeyboardArrowDown as ArrowDownIcon, + Code as CodeIcon, + PictureAsPdf as PdfIcon, + TableChart as CsvIcon, + Sync, + Check as CheckIcon, + MoreVert as MoreVertIcon, + Fullscreen as FullscreenIcon, + ViewAgenda, + ViewModule as ViewModuleIcon, + TableRows as TableRowsIcon, + Schedule as ScheduleIcon, + SevereCold, +} from '@mui/icons-material' +import { + ExclamationCircleIcon, + ChevronDownIcon, +} from '@heroicons/react/24/outline' import { PDFExportButton, exportRowsToPdf } from '../pdfExportButton' import { CSVExportButton, exportRowsToCsv } from '../csvExportButton' import { getCippTranslation } from '../../utils/get-cipp-translation' +import { alpha } from '@mui/material/styles' +import { resolvePaletteMainColor } from '../../theme/utils' +import { + getCategoryColor, + getCategoryIcon, + getCategoryLabel, + sortCategoryEntries, +} from '../../utils/action-categories' import { useMediaQuery } from '@mui/material' import { CippQueueTracker } from './CippQueueTracker' import { usePopover } from '../../hooks/use-popover' @@ -38,8 +72,7 @@ import { useDialog } from '../../hooks/use-dialog' import { CippApiDialog } from '../CippComponents/CippApiDialog' import { useSettings } from '../../hooks/use-settings' import { attachParentRow } from '../../utils/resolve-row-templates' -import { fetchBrandingSettings } from '../CippPdf/useBrandingSettings' -import { useQueryClient } from '@tanstack/react-query' +import { useBrandingSettings } from '../CippPdf/useBrandingSettings' import { useRouter } from 'next/router' import { CippOffCanvas } from '../CippComponents/CippOffCanvas' import { CippCodeBlock } from '../CippComponents/CippCodeBlock' @@ -50,6 +83,7 @@ import { Stack } from '@mui/system' import { CippMobileTableControls } from './CippMobileTableControls' import { CippTableFilterSheet } from './CippTableFilterSheet' import { useSheetHandoff } from '../../hooks/use-sheet-handoff' + import { ModernSearchContainer, ModernSearchInput, @@ -107,6 +141,16 @@ export const CIPPTableToptoolbar = React.memo( searchFocusRef, persistenceKey, parentRow, + // Manage365 card view: the parent already renders the card list, so this + // instance stays a toolbar (search, filters, freshness) instead of a second card list. + isCardView = false, + cardConfigAvailable = false, + onViewModeChange, + dataFreshnessField = null, + rowActionQueueIds = [], + onRemoveRowActionQueueId, + onSearchChange, + setColumnFilters, }) => { const popover = usePopover() const [filtersAnchor, setFiltersAnchor] = useState(null) @@ -119,7 +163,7 @@ export const CIPPTableToptoolbar = React.memo( const mdDown = useMediaQuery((theme) => theme.breakpoints.down('md')) const settings = useSettings() - const queryClient = useQueryClient() + const brandingSettings = useBrandingSettings() const router = useRouter() const createDialog = useDialog() const [actionData, setActionData] = useState({ @@ -173,6 +217,21 @@ export const CIPPTableToptoolbar = React.memo( showBulkExportAction && exportEnabled && selectedRows.length > 0 const customBulkActions = getBulkActions(actions, selectedRows) const showBulkActionsButton = hasSelection && customBulkActions.length > 0 + const groupedBulkActions = sortCategoryEntries( + Object.entries( + customBulkActions.reduce((acc, action) => { + const category = + typeof action.category === 'string' && action.category.trim().length > 0 + ? action.category.trim() + : 'Other' + if (!acc[category]) { + acc[category] = [] + } + acc[category].push(action) + return acc + }, {}) + ) + ) const handleExportSelectedToCsv = () => { if (!selectedRows.length) { @@ -186,7 +245,7 @@ export const CIPPTableToptoolbar = React.memo( }) } - const handleExportSelectedToPdf = async () => { + const handleExportSelectedToPdf = () => { if (!selectedRows.length) { return } @@ -195,10 +254,21 @@ export const CIPPTableToptoolbar = React.memo( columns: usedColumns, reportName: `${title}`, columnVisibility, - brandingSettings: await fetchBrandingSettings(queryClient), + brandingSettings, }) } + // Parent owns the cards/table flip. Prefer its toggle; fall back to the mode setter. + const handleViewToggle = () => { + if (typeof onViewToggle === 'function') { + onViewToggle() + return + } + if (typeof onViewModeChange === 'function') { + onViewModeChange(viewMode === 'cards' ? 'table' : 'cards') + } + } + // Shared refresh dispatch — desktop refresh button and the mobile filter sheet. const handleRefresh = () => { if (typeof refreshFunction === 'object') { @@ -241,15 +311,10 @@ export const CIPPTableToptoolbar = React.memo( // api.noConfirm true, and its mount effect auto-submits into the same customFunction // being called here — every selected row's action fired twice. if (action?.noConfirm && action.customFunction) { - // multiPost actions expect the full selection in one call (e.g. Edit Properties - // stores users in sessionStorage then navigates). Per-row invocation would - // overwrite that state with only the last selected row. if (action.multiPost) { action.customFunction(selectedData, action, {}) } else { - eligibleRows.forEach((row) => - action.customFunction(wrapActionRow(row.original.original ?? row.original), action, {}) - ) + eligibleRows.forEach((row) => action.customFunction(wrapActionRow(row.original.original ?? row.original), action, {})) } // Deliberately no closeMenu() here — that matches the behaviour this branch had // before; the only thing being fixed is the duplicate invocation. @@ -360,6 +425,12 @@ export const CIPPTableToptoolbar = React.memo( const leftContainerWidth = leftContainerRef.current.offsetWidth const leftContainerScrollWidth = leftContainerRef.current.scrollWidth const actionsWidth = actionsContainerRef.current.scrollWidth + // jsdom and the first paint report 0. Collapsing on that hides Columns + // before the toolbar has a real width. + if (!leftContainerWidth) { + setUseCompactMode(false) + return + } const isOverflowing = leftContainerScrollWidth > leftContainerWidth const shouldBeCompact = isOverflowing || actionsWidth > leftContainerWidth * 0.6 // Actions taking > 60% of left container @@ -420,6 +491,7 @@ export const CIPPTableToptoolbar = React.memo( table.setGlobalFilter(last.value) // Keep the visible search box in sync with the filter it now represents setSearchValue(typeof last.value === 'string' ? last.value : '') + onSearchChange?.(typeof last.value === 'string' ? last.value : '') setActiveFilters((prev) => ({ ...prev, table: { id: last.id, name: last.name, type: last.type }, @@ -476,7 +548,10 @@ export const CIPPTableToptoolbar = React.memo( const handleSearchChange = useCallback( (event) => { const value = event.target.value - setSearchValue(value) + setSearchValue?.(value) + if (typeof onSearchChange === 'function') { + onSearchChange(value) + } // Clear any pending debounce timer. if (searchDebounceRef.current) { @@ -488,7 +563,7 @@ export const CIPPTableToptoolbar = React.memo( table.setGlobalFilter(value) }, 200) }, - [table] + [table, setSearchValue, onSearchChange] ) @@ -617,29 +692,22 @@ export const CIPPTableToptoolbar = React.memo( } return [k, v] }) - ); - } - - // Show one column by name. The name comes from preset data, so it is added through - // Object.fromEntries (which defines the property directly) rather than a computed key - // in a spread literal, keeping a value such as '__proto__' away from the prototype chain. - const showColumn = (name) => { - const key = String(name).trim() - if (!usedColumns.includes(key)) return false - setColumnVisibility((prev) => Object.fromEntries([...Object.entries(prev), [key, true]])) - return true + ) } // Shared function for setting nested column visibility const setNestedVisibility = (col) => { if (typeof col === 'object' && col !== null) { Object.keys(col).forEach((key) => { - if (showColumn(key)) { + if (usedColumns.includes(key.trim())) { + setColumnVisibility((prev) => ({ ...prev, [key.trim()]: true })) setNestedVisibility(col[key]) } }) } else { - showColumn(col) + if (usedColumns.includes(col.trim())) { + setColumnVisibility((prev) => ({ ...prev, [col.trim()]: true })) + } } } @@ -653,10 +721,7 @@ export const CIPPTableToptoolbar = React.memo( if (table?.type === 'global' && typeof table.value !== 'string') { return { graph: last.graph ?? null, table: null } } - // corrupted echo can persist graph.value as a bare guid string instead of an object - const graph = - last.graph && typeof last.graph.value !== 'object' ? null : last.graph ?? null - return { graph, table } + return { graph: last.graph ?? null, table } } // legacy single-slot {type, value, name} if (last.type === 'graph') { @@ -693,14 +758,10 @@ export const CIPPTableToptoolbar = React.memo( settings.setLastUsedFilter(pageName, updater(current)) } - // Columns any preset drives with a non-default `filterFn` (e.g. 'notEquals', 'notContains'), - // mapped to a plain 'contains' baseline. material-react-table's per-column filter mode is a - // sticky mutation on the column definition — switching it away from the default only takes - // when the new state.columnFilterFns entry is itself explicit, so clearing to `{}` after a - // preset like this leaves the override stuck. Passing this map on every column-preset click - // (falling back to 'contains' for any id not driven by the current preset) forces that - // mutation to reset every time, so manual searches on the column behave normally again once - // a different preset — or Reset — is applied. + // Columns any preset drives with a non-default filterFn (notEquals, notContains), mapped + // to a plain contains baseline. material-react-table's per-column filter mode sticks on + // the column until columnFilterFns names it again, so clearing to {} leaves the override + // in place. Passing this map on every column-preset click forces the reset. const filterFnDefaults = useMemo(() => { const ids = new Set() filters.forEach((f) => { @@ -717,13 +778,17 @@ export const CIPPTableToptoolbar = React.memo( if (filterType === 'global' || filterType === undefined) { if (activeFilters.table?.type === 'column') { table.resetColumnFilters() + if (typeof setColumnFilters === 'function') { + setColumnFilters([]) + } } // The search box IS the global filter's visible form — a pending debounced // keystroke or stale text would silently overwrite this preset otherwise. if (searchDebounceRef.current) { clearTimeout(searchDebounceRef.current) } - setSearchValue(typeof filter === 'string' ? filter : '') + setSearchValue?.(typeof filter === 'string' ? filter : '') + onSearchChange?.(typeof filter === 'string' ? filter : '') table.setGlobalFilter(filter) setActiveFilters((prev) => ({ ...prev, @@ -749,31 +814,27 @@ export const CIPPTableToptoolbar = React.memo( if (searchDebounceRef.current) { clearTimeout(searchDebounceRef.current) } - setSearchValue('') + setSearchValue?.('') + onSearchChange?.('') } if (viewMode !== 'cards') { // Card view renders no header row for the filter inputs to appear in table.setShowColumnFilters(true) } - // A preset can request a non-default comparison (e.g. 'notEquals', 'notContains') - // for a column via `filterFn` on its value entry. Start from filterFnDefaults so - // every column any preset ever overrides gets an explicit entry here — falling - // back to 'contains' — then layer this preset's own overrides on top. - // Built via Map.set + Object.fromEntries rather than a bracket-assignment reduce: - // a preset entry's id ends up as a computed object key, and `acc[f.id] = ...` - // resolves to Object.prototype's __proto__ setter for that one key value — Map - // keys never touch the prototype chain, and Object.fromEntries defines properties - // directly rather than going through a property setter. + // A preset can request notEquals or notContains via filterFn on its value entry. + // Start from the contains baseline so a later plain preset on the same column + // is not left inverted. const filterFnOverrides = Array.isArray(filter) - ? Object.fromEntries( - filter.reduce((acc, f) => { - if (f?.id && f?.filterFn) acc.set(f.id, f.filterFn) - return acc - }, new Map()) - ) + ? filter.reduce((acc, f) => { + if (f?.id && f?.filterFn) acc[f.id] = f.filterFn + return acc + }, {}) : {} table.setColumnFilterFns({ ...filterFnDefaults, ...filterFnOverrides }) table.setColumnFilters(filter) + if (typeof setColumnFilters === 'function') { + setColumnFilters(filter) + } setActiveFilters((prev) => ({ ...prev, table: { @@ -799,7 +860,8 @@ export const CIPPTableToptoolbar = React.memo( if (searchDebounceRef.current) { clearTimeout(searchDebounceRef.current) } - setSearchValue('') + setSearchValue?.('') + onSearchChange?.('') if (api?.data) { setGraphFilterData({}) resetToDefaultVisibility() @@ -880,9 +942,13 @@ export const CIPPTableToptoolbar = React.memo( if (searchDebounceRef.current) { clearTimeout(searchDebounceRef.current) } - setSearchValue('') + setSearchValue?.('') + onSearchChange?.('') } else { table.resetColumnFilters() + if (typeof setColumnFilters === 'function') { + setColumnFilters([]) + } } } persistFilterSlots((cur) => ({ ...cur, [layer]: null })) @@ -970,7 +1036,7 @@ export const CIPPTableToptoolbar = React.memo( primary={ {activeFilters[layer]?.id === presetKey(filter) && ( - + )} {filter.filterName} @@ -1002,7 +1068,7 @@ export const CIPPTableToptoolbar = React.memo( ref={popover.anchorRef} startIcon={ - + } variant="outlined" @@ -1047,7 +1113,7 @@ export const CIPPTableToptoolbar = React.memo( return ( <> - {viewMode === 'cards' ? ( + {viewMode === 'cards' && !isCardView ? ( ) : undefined } @@ -1150,9 +1218,9 @@ export const CIPPTableToptoolbar = React.memo( }} > {getRequestData?.isFetchNextPageError ? ( - + ) : ( - + )} @@ -1162,7 +1230,7 @@ export const CIPPTableToptoolbar = React.memo( {/* Search Input */} - + + {/* Manage365 card/table switch. Hidden when this table has no card config. */} + {cardConfigAvailable && onViewModeChange && !mdDown && ( + { + if (newMode) onViewModeChange(newMode) + }} + size="small" + sx={{ + height: 40, + flexShrink: 0, + '& .MuiToggleButton-root': { + px: 1.5, + border: (theme) => `1px solid ${theme.palette.divider}`, + '&.Mui-selected': { + bgcolor: 'primary.main', + color: 'primary.contrastText', + '&:hover': { + bgcolor: 'primary.dark', + }, + }, + }, + }} + > + + + + + + + + + + + + )} + {/* Desktop Buttons - always render for measurement, hide when in compact mode */} {!mdDown && ( {/* Filters Button */} } - endIcon={} + startIcon={} + endIcon={} onClick={(event) => setFiltersAnchor(event.currentTarget)} sx={{ color: @@ -1206,8 +1312,8 @@ export const CIPPTableToptoolbar = React.memo( {/* Columns Button */} } - endIcon={} + startIcon={} + endIcon={} onClick={(event) => setColumnsAnchor(event.currentTarget)} > Columns @@ -1216,13 +1322,13 @@ export const CIPPTableToptoolbar = React.memo( anchorEl={columnsAnchor} open={Boolean(columnsAnchor)} onClose={() => setColumnsAnchor(null)} - slotProps={{ - paper: { sx: { + PaperProps={{ + sx: { mt: 1, borderRadius: 2, minWidth: 250, maxHeight: 400, - } }, + }, }} > @@ -1260,8 +1366,8 @@ export const CIPPTableToptoolbar = React.memo( {/* Export Button */} {exportEnabled && ( } - endIcon={} + startIcon={} + endIcon={} onClick={(event) => setExportAnchor(event.currentTarget)} > Export @@ -1272,15 +1378,12 @@ export const CIPPTableToptoolbar = React.memo( {/* Compact Action Button — desktop compact mode only, the phone table uses the filter sheet */} {!mdDown && useCompactMode && !hasSelection && ( - - setActionMenuAnchor(event.currentTarget)} - sx={{ flexShrink: 0 }} - > - - - + setActionMenuAnchor(event.currentTarget)} + sx={{ flexShrink: 0 }} + > + + )} {/* phones keep the kebab open regardless of selection, the only route to the @@ -1302,10 +1405,10 @@ export const CIPPTableToptoolbar = React.memo( > {mdDown ? ( - + ) : ( - + )} )} @@ -1314,13 +1417,13 @@ export const CIPPTableToptoolbar = React.memo( {tableViewActive && showReturnToCards && ( {/* destination icon: tapping here returns to cards */} - + @@ -1331,12 +1434,12 @@ export const CIPPTableToptoolbar = React.memo( anchorEl={actionMenuAnchor} open={Boolean(actionMenuAnchor)} onClose={() => setActionMenuAnchor(null)} - slotProps={{ - paper: { sx: { + PaperProps={{ + sx: { mt: 1, borderRadius: 2, minWidth: 180, - } }, + }, }} > {/* Anchor the nested menus to the stable overflow IconButton — anchoring to @@ -1349,7 +1452,7 @@ export const CIPPTableToptoolbar = React.memo( }} > - + Columns @@ -1361,7 +1464,7 @@ export const CIPPTableToptoolbar = React.memo( }} > - + Export @@ -1373,7 +1476,7 @@ export const CIPPTableToptoolbar = React.memo( }} > - + {table.getState().isFullScreen @@ -1381,6 +1484,21 @@ export const CIPPTableToptoolbar = React.memo( : 'Fullscreen'} + {cardConfigAvailable && onViewModeChange && ( + { + onViewModeChange(viewMode === 'cards' ? 'table' : 'cards') + setActionMenuAnchor(null) + }} + > + + {viewMode === 'cards' ? : } + + + {viewMode === 'cards' ? 'Switch to Table View' : 'Switch to Card View'} + + + )} {/* Filters Menu */} @@ -1388,12 +1506,12 @@ export const CIPPTableToptoolbar = React.memo( anchorEl={filtersAnchor} open={Boolean(filtersAnchor)} onClose={() => setFiltersAnchor(null)} - slotProps={{ - paper: { sx: { + PaperProps={{ + sx: { mt: 1, borderRadius: 2, minWidth: 200, - } }, + }, }} > setColumnsAnchor(null)} - slotProps={{ - paper: { sx: { + PaperProps={{ + sx: { mt: 1, borderRadius: 2, minWidth: 250, maxHeight: 400, - } }, + }, }} > @@ -1499,12 +1617,12 @@ export const CIPPTableToptoolbar = React.memo( anchorEl={exportAnchor} open={Boolean(exportAnchor)} onClose={() => setExportAnchor(null)} - slotProps={{ - paper: { sx: { + PaperProps={{ + sx: { mt: 1, borderRadius: 2, minWidth: 180, - } }, + }, }} > - + @@ -1533,7 +1651,7 @@ export const CIPPTableToptoolbar = React.memo( }} > - + @@ -1547,7 +1665,7 @@ export const CIPPTableToptoolbar = React.memo( }} > - + @@ -1558,7 +1676,7 @@ export const CIPPTableToptoolbar = React.memo( }} > - + @@ -1576,7 +1694,7 @@ export const CIPPTableToptoolbar = React.memo( }} > - + @@ -1600,11 +1718,36 @@ export const CIPPTableToptoolbar = React.memo( {/* Selected rows indicator + Bulk Actions - inline, unless portaled into the header */} {!bulkActionsSlot && bulkActionsContent} - {/* Queue tracker */} + + {dataFreshnessField && usedData?.length > 0 && usedData[0]?.[dataFreshnessField] && ( + + } + label={`Data as of ${new Date(usedData[0][dataFreshnessField]).toLocaleDateString(undefined, { month: 'short', day: 'numeric', year: 'numeric' })}`} + size="small" + variant="outlined" + sx={{ + height: 28, + fontSize: '0.75rem', + '& .MuiChip-icon': { ml: 0.5 }, + borderStyle: 'dashed', + }} + /> + + )} + {getRequestData?.data?.pages?.[0]?.Metadata?.ColdStart === true && ( + + + + )} @@ -1665,32 +1808,77 @@ export const CIPPTableToptoolbar = React.memo( horizontal: 'right', vertical: 'bottom', }} + MenuListProps={{ + dense: true, + sx: { p: 1 }, + }} onClose={popover.handleClose} open={popover.open} transformOrigin={{ horizontal: 'right', vertical: 'top', }} - slotProps={{ - list: { - dense: true, - sx: { p: 1 }, - } - }} > {actions && - customBulkActions.map((action, index) => ( - handleBulkAction(action, popover.handleClose)} - > - - {action.icon} - - {action.label} - - ))} + groupedBulkActions.map(([category, categoryActions], groupIndex) => { + const categoryColor = getCategoryColor(category) + const headerBgColor = + categoryColor === 'text.secondary' + ? (theme) => alpha(theme.palette.grey[500], 0.08) + : (theme) => alpha(resolvePaletteMainColor(theme, categoryColor), 0.08) + const headerTextColor = + categoryColor === 'text.secondary' + ? 'text.secondary' + : (theme) => resolvePaletteMainColor(theme, categoryColor) + return ( + + 0 ? 0.5 : 0, + py: 0.5, + }} + > + {getCategoryIcon(category)} + {getCategoryLabel(category)} + + {categoryActions.map((action, index) => { + const actionColor = action.color || categoryColor + const iconSx = + actionColor === 'text.secondary' + ? { minWidth: '30px', color: actionColor } + : { + minWidth: '30px', + color: (theme) => resolvePaletteMainColor(theme, actionColor), + } + return ( + handleBulkAction(action, popover.handleClose)} + > + + {action.icon} + + {action.label} + + ) + })} + + ) + })} {/* API Response Off-Canvas - only show when not in dialog mode */} @@ -1819,7 +2007,7 @@ export const CIPPTableToptoolbar = React.memo( )} - ); + ) } ) diff --git a/frontend/src/components/CippTable/CippDataTable.jsx b/frontend/src/components/CippTable/CippDataTable.jsx index e8968a05a8..b1e7089b1c 100644 --- a/frontend/src/components/CippTable/CippDataTable.jsx +++ b/frontend/src/components/CippTable/CippDataTable.jsx @@ -1,124 +1,182 @@ +import { MaterialReactTable, useMaterialReactTable } from "material-react-table"; import { - MaterialReactTable, - useMaterialReactTable, - getColumnId, - getDefaultColumnFilterFn, -} from 'material-react-table' -import { CippIcons } from '../../utils/icon-registry' -import { - alpha, Card, CardContent, CardHeader, - Chip, Divider, ListItemIcon, ListItemText, - Menu, + ListSubheader, MenuItem, - MenuList, + Menu, SvgIcon, - Tooltip, + useMediaQuery, + useTheme, + Avatar, Typography, -} from '@mui/material' -import { ResourceUnavailable } from '../resource-unavailable' -import { ResourceError } from '../resource-error' -import { Scrollbar } from '../scrollbar' -import { useCallback, useEffect, useMemo, useState, useRef } from 'react' -import { useRouter } from 'next/router' -import { ApiGetCallWithPagination } from '../../api/ApiCall' -import { utilTableMode } from './util-tablemode' + Chip, + Stack, + IconButton, + TextField, + InputAdornment, + Skeleton, + Grid, + ToggleButton, + ToggleButtonGroup, + Tooltip, + CircularProgress, + ClickAwayListener, + Checkbox, + Button, +} from "@mui/material"; +import { alpha } from "@mui/material/styles"; +import { ResourceUnavailable } from "../resource-unavailable"; +import { ResourceError } from "../resource-error"; +import { Scrollbar } from "../scrollbar"; +import { useEffect, useMemo, useState, useCallback, isValidElement, useRef } from "react"; +import { useRouter } from "next/router"; +import { ApiGetCallWithPagination, ApiPostCall } from "../../api/ApiCall"; +import { utilTableMode } from "./util-tablemode"; +import { utilColumnsFromAPI, resolveSimpleColumnVariables } from "./util-columnsFromAPI"; +import { CIPPTableToptoolbar } from "./CIPPTableToptoolbar"; +import { + Info, + More, + MoreHoriz, + Search, + CheckCircle, + Cancel, + Refresh, + ViewModule, + TableChart, + Email, + Phone, + Business, + CalendarToday, + Badge, + Visibility, + Edit, + Security, + Settings, + Warning, + Circle, + CheckBox, + CheckBoxOutlineBlank, + IndeterminateCheckBox, +} from "@mui/icons-material"; +import { ChevronDownIcon } from "@heroicons/react/24/outline"; +import { CippOffCanvas } from "../CippComponents/CippOffCanvas"; +import { useDialog } from "../../hooks/use-dialog"; +import { CippApiDialog } from "../CippComponents/CippApiDialog"; +import { getCippError } from "../../utils/get-cipp-error"; +import { CippQuickActions } from "../CippComponents/CippActionMenu"; +import { Box } from "@mui/system"; +import { useSettings } from "../../hooks/use-settings"; +import { parseCippDate } from "../../utils/parse-cipp-date"; +import { isEqual } from "lodash"; +import { getCippTranslation } from "../../utils/get-cipp-translation"; +import CippUserAvatar from "../CippComponents/CippUserAvatar"; +import { useLicenseBackfill } from "../../hooks/use-license-backfill"; +import { resolvePaletteMainColor } from "../../theme/utils"; import { - utilColumnsFromAPI, - resolveSimpleColumnVariables, -} from './util-columnsFromAPI' -import { CIPPTableToptoolbar } from './CIPPTableToptoolbar' -import { CippOffCanvas } from '../CippComponents/CippOffCanvas' -import { useDialog } from '../../hooks/use-dialog' -import { CippApiDialog } from '../CippComponents/CippApiDialog' -import { getCippError } from '../../utils/get-cipp-error' -import { Box, Stack } from '@mui/system' -import { useSettings } from '../../hooks/use-settings' -import { parseCippDate } from '../../utils/parse-cipp-date' -import { isEqual } from 'lodash' // Import lodash for deep comparison -import { useLicenseBackfill } from '../../hooks/use-license-backfill' -import { licenseIncludesFilterFn } from '../../utils/get-cipp-filter-variant' -import { useTableViewMode, useIsNarrowForTables } from '../../hooks/use-breakpoint' -import { CippMobileCardList } from './CippMobileCardList' -import { CippPageActionsFab } from '../CippComponents/CippPageActionsFab' -import CippDataTableButton from './CippDataTableButton' -import { CippTableCardButton } from './CippTableCardButton' + getCategoryColor, + getCategoryIcon, + getCategoryLabel, + sortCategoryEntries, +} from "../../utils/action-categories"; +import { useTableViewMode, useIsNarrowForTables } from "../../hooks/use-breakpoint"; +import { CippMobileCardList } from "./CippMobileCardList"; +import { CippPageActionsFab } from "../CippComponents/CippPageActionsFab"; +import CippDataTableButton from "./CippDataTableButton"; +import { CippTableCardButton } from "./CippTableCardButton"; import { subTableIsSelected, subTableShowsCachedColumn, resolveSubTableSimpleColumns, getSubTableDisplayColumnIds, - getInactiveSubTableColumnIds, - sanitizeColumnOrder, -} from './util-subTables' -import { attachParentRow, getRowTenant } from '../../utils/resolve-row-templates' -import { - dispatchRowOpen, - partitionRowMenuActions, - filterVisibleRowActions, - rowOpenEnabled, - rowOpenSupportsNewTab, -} from './util-row-open' -import { - hasTextSelection, - isRowTextInteraction, -} from './util-row-text-interaction' - -const ROW_CONTEXT_MENU_MAX_HEIGHT = 360 + columnOrderHasStaleIds, +} from "./util-subTables"; +import { attachParentRow, getRowTenant } from "../../utils/resolve-row-templates"; +// Helper functions for row action category grouping and styling // Resolve dot-delimited property paths against arbitrary data objects. const getNestedValue = (source, path) => { if (!source) { - return undefined + return undefined; } if (!path) { - return source + return source; } - return path.split('.').reduce((acc, key) => { + return path.split(".").reduce((acc, key) => { if (acc === undefined || acc === null) { - return undefined + return undefined; } - if (typeof acc !== 'object') { - return undefined + if (typeof acc !== "object") { + return undefined; } - return acc[key] - }, source) -} + return acc[key]; + }, source); +}; + +// Recursively test whether any string/number leaf within a value contains the +// (already lower-cased) search term. Traverses nested objects and arrays so card +// view search matches nested fields (e.g. manager.displayName) and array entries +// (e.g. proxyAddresses), matching the breadth of the table's global filter. +// Depth-capped and cycle-guarded to keep large rows performant and safe. +const valueContainsTerm = (value, term, depth = 0, seen = null) => { + if (value === null || value === undefined) { + return false; + } + const type = typeof value; + if (type === "string") { + return value.toLowerCase().includes(term); + } + if (type === "number" || type === "boolean") { + return String(value).toLowerCase().includes(term); + } + if (type !== "object" || depth > 4) { + return false; + } + const visited = seen || new Set(); + if (visited.has(value)) { + return false; + } + visited.add(value); + if (Array.isArray(value)) { + return value.some((entry) => valueContainsTerm(entry, term, depth + 1, visited)); + } + return Object.values(value).some((entry) => valueContainsTerm(entry, term, depth + 1, visited)); +}; // Resolve dot-delimited column ids against the original row data so nested fields can sort/filter properly. const getRowValueByColumnId = (row, columnId) => { if (!row?.original || !columnId) { - return undefined + return undefined; } - if (columnId.includes('@odata')) { - return row.original[columnId] + if (columnId.includes("@odata")) { + return row.original[columnId]; } - return getNestedValue(row.original, columnId) -} + return getNestedValue(row.original, columnId); +}; const compareNullable = (aVal, bVal) => { if (aVal === null && bVal === null) { - return 0 + return 0; } if (aVal === null) { - return 1 + return 1; } if (bVal === null) { - return -1 + return -1; } if (aVal === bVal) { - return 0 + return 0; } - return aVal > bVal ? 1 : -1 -} + return aVal > bVal ? 1 : -1; +}; // walk up from the card surface to the page's scrolling ancestor (LayoutContainer, // overflowY auto) and align the surface with its top. the table flips in at the same @@ -126,34 +184,34 @@ const compareNullable = (aVal, bVal) => { // and pages with content above the table keep the table in view const scrollNodeToScrollableAncestorTop = (node) => { if (!node) { - return + return; } - let ancestor = node.parentElement + let ancestor = node.parentElement; while (ancestor && ancestor !== document.body) { - const overflowY = window.getComputedStyle(ancestor).overflowY - if (overflowY === 'auto' || overflowY === 'scroll') { - ancestor.scrollTop += node.getBoundingClientRect().top - ancestor.getBoundingClientRect().top - return + const overflowY = window.getComputedStyle(ancestor).overflowY; + if (overflowY === "auto" || overflowY === "scroll") { + ancestor.scrollTop += node.getBoundingClientRect().top - ancestor.getBoundingClientRect().top; + return; } - ancestor = ancestor.parentElement + ancestor = ancestor.parentElement; } - window.scrollTo(0, window.scrollY + node.getBoundingClientRect().top) -} + window.scrollTo(0, window.scrollY + node.getBoundingClientRect().top); +}; /** * Column order for a user-curated selection: the selected ids first, in selection order, * then everything else in its existing order. Exported for tests. * * MRT only reads initialState.columnOrder once, so when the graph filter swaps in a new - * \$select list after mount, the new columns (dot-delimited nested fields included) were + * $select list after mount, the new columns (dot-delimited nested fields included) were * appended last — and the card view's three detail slots are filled in column order, so a * field the user explicitly selected was exactly the one that overflowed into "+N more". */ export const orderColumnsBySelection = (allIds, selectedIds) => { - const selected = selectedIds.filter((id) => allIds.includes(id)) - const rest = allIds.filter((id) => !selected.includes(id)) - return [...selected, ...rest] -} + const selected = selectedIds.filter((id) => allIds.includes(id)); + const rest = allIds.filter((id) => !selected.includes(id)); + return [...selected, ...rest]; +}; // ── Module-level constants ────────────────────────────────────────────────── // These never change between renders, so extracting them avoids creating new @@ -161,8 +219,9 @@ export const orderColumnsBySelection = (allIds, selectedIds) => { // Stable ref so an undefined `data` prop doesn't create a fresh [] each render // and loop the static-data sync effect. -const EMPTY_ARRAY = [] +const EMPTY_ARRAY = []; +// Stable MRT helpers — module-level to avoid new object refs each render. const buildSubTableColumn = (sub) => ({ id: sub.id, header: sub.header ?? sub.id, @@ -172,10 +231,10 @@ const buildSubTableColumn = (sub) => ({ enableColumnFilter: false, enableGlobalFilter: false, accessorFn: (row) => { - if (typeof sub.label === 'function') { - return sub.label(row) + if (typeof sub.label === "function") { + return sub.label(row); } - return sub.label ?? 'View' + return sub.label ?? "View"; }, Cell: ({ row }) => ( ({ {...(sub.table ?? {})} /> ), -}) +}); const SORTING_FNS = { dateTimeNullsLast: (a, b, id) => { - const aRaw = getRowValueByColumnId(a, id) - const bRaw = getRowValueByColumnId(b, id) - const aDate = aRaw ? parseCippDate(aRaw) : null - const bDate = bRaw ? parseCippDate(bRaw) : null - const aTime = - aDate && !Number.isNaN(aDate.getTime()) ? aDate.getTime() : null - const bTime = - bDate && !Number.isNaN(bDate.getTime()) ? bDate.getTime() : null - - return compareNullable(aTime, bTime) + const aRaw = getRowValueByColumnId(a, id); + const bRaw = getRowValueByColumnId(b, id); + const aDate = aRaw ? parseCippDate(aRaw) : null; + const bDate = bRaw ? parseCippDate(bRaw) : null; + const aTime = aDate && !Number.isNaN(aDate.getTime()) ? aDate.getTime() : null; + const bTime = bDate && !Number.isNaN(bDate.getTime()) ? bDate.getTime() : null; + + return compareNullable(aTime, bTime); }, number: (a, b, id) => { - const aRaw = getRowValueByColumnId(a, id) - const bRaw = getRowValueByColumnId(b, id) - const aNum = typeof aRaw === 'number' ? aRaw : Number(aRaw) - const bNum = typeof bRaw === 'number' ? bRaw : Number(bRaw) - const aVal = Number.isNaN(aNum) ? null : aNum - const bVal = Number.isNaN(bNum) ? null : bNum - - return compareNullable(aVal, bVal) + const aRaw = getRowValueByColumnId(a, id); + const bRaw = getRowValueByColumnId(b, id); + const aNum = typeof aRaw === "number" ? aRaw : Number(aRaw); + const bNum = typeof bRaw === "number" ? bRaw : Number(bRaw); + const aVal = Number.isNaN(aNum) ? null : aNum; + const bVal = Number.isNaN(bNum) ? null : bNum; + + return compareNullable(aVal, bVal); }, boolean: (a, b, id) => { - const aRaw = getRowValueByColumnId(a, id) - const bRaw = getRowValueByColumnId(b, id) + const aRaw = getRowValueByColumnId(a, id); + const bRaw = getRowValueByColumnId(b, id); const toBool = (value) => { if (value === null || value === undefined) { - return null + return null; } - if (typeof value === 'boolean') { - return value + if (typeof value === "boolean") { + return value; } - if (typeof value === 'string') { - const lower = value.toLowerCase() - if (lower === 'true' || lower === 'yes') { - return true + if (typeof value === "string") { + const lower = value.toLowerCase(); + if (lower === "true" || lower === "yes") { + return true; } - if (lower === 'false' || lower === 'no') { - return false + if (lower === "false" || lower === "no") { + return false; } } - if (typeof value === 'number') { - return value !== 0 + if (typeof value === "number") { + return value !== 0; } - return null - } + return null; + }; - const aBool = toBool(aRaw) - const bBool = toBool(bRaw) - const aNumeric = aBool === null ? null : aBool ? 1 : 0 - const bNumeric = bBool === null ? null : bBool ? 1 : 0 + const aBool = toBool(aRaw); + const bBool = toBool(bRaw); + const aNumeric = aBool === null ? null : aBool ? 1 : 0; + const bNumeric = bBool === null ? null : bBool ? 1 : 0; - return compareNullable(aNumeric, bNumeric) + return compareNullable(aNumeric, bNumeric); }, -} +}; const FILTER_FNS = { - // TanStack has no built-in "includes" filter fn (only "includesString"); columns built by - // get-cipp-filter-variant.js use this name, so it must be registered here to resolve. - includes: (row, columnId, value) => { - const rowValue = row.getValue(columnId) - if (rowValue === null || rowValue === undefined) { - return false - } - return String(rowValue).toLowerCase().includes(String(value).toLowerCase()) - }, - licenseIncludes: licenseIncludesFilterFn, notContains: (row, columnId, value) => { - const rowValue = row.getValue(columnId) + const rowValue = row.getValue(columnId); if (rowValue === null || rowValue === undefined) { - return false + return false; } - const stringValue = String(rowValue) + const stringValue = String(rowValue); if ( - stringValue.includes('[object Object]') || + stringValue.includes("[object Object]") || !stringValue.toLowerCase().includes(value.toLowerCase()) ) { - return true - } else { - return false + return true; } + return false; }, regex: (row, columnId, value) => { try { - const regex = new RegExp(value, 'i') - const rowValue = row.getValue(columnId) - if ( - typeof rowValue === 'string' && - !rowValue.includes('[object Object]') - ) { - return regex.test(rowValue) + const regex = new RegExp(value, "i"); + const rowValue = row.getValue(columnId); + if (typeof rowValue === "string" && !rowValue.includes("[object Object]")) { + return regex.test(rowValue); } - return false - } catch (error) { - // If regex is invalid, don't filter - return true + return false; + } catch { + return true; } }, -} - -// Labels for the filterFn names in FILTER_FNS above (and MRT's own custom filter modes) that -// MRT's built-in localization has no entry for — without these the filter helper text reads -// "Filter Mode: undefined". -const MRT_LOCALIZATION_OVERRIDES = { - filterIncludes: 'Contains', - filterNotContains: 'Does Not Contain', - filterRegex: 'Regex', - filterLicenseIncludes: 'Includes', - filterCustom: 'Custom', -} - -// A multi-select column filter (e.g. Assigned Licenses) is a native MUI Select under the -// hood, not an Autocomplete — filterVariant only switches to the Autocomplete component for -// 'autocomplete'. MRT's own multi-select renderValue draws one Chip per pick with no -// wrapping room, so past the first chip the rest are clipped from the header. Override it -// (via the Select's slotProps.select.renderValue MRT forwards from muiFilterTextFieldProps) -// to collapse 2+ picks into a single "N selected" chip whose Tooltip lists every label. -const getFilterSelectOptionLabel = (options, value) => { - const match = options?.find((opt) => - typeof opt === 'string' ? opt === value : opt?.value === value - ) - if (match === undefined) { - return String(value) - } - return typeof match === 'string' ? match : match.label ?? String(value) -} +}; -const MUI_FILTER_TEXT_FIELD_PROPS = ({ column }) => { - if (column.columnDef.filterVariant !== 'multi-select') { - return {} +const computeSchemaKey = (data) => { + if (!Array.isArray(data) || data.length === 0) { + return ""; } - const options = column.columnDef.filterSelectOptions - const clearSelection = () => column.setFilterValue([]) - const stopMouseDown = (e) => e.stopPropagation() - return { - slotProps: { - select: { - renderValue: (selected) => { - if (!Array.isArray(selected) || selected.length === 0) { - return ( - - {`Filter by ${column.columnDef.header ?? column.id}`} - - ) - } - if (selected.length === 1) { - return ( - - - - ) - } - const labels = selected.map((value) => getFilterSelectOptionLabel(options, value)) - return ( - -
      {label}
      )}> - -       -       - ) - }, - }, - }, + const sample = data.slice(0, 3); + const keys = new Set(); + for (const row of sample) { + if (row && typeof row === "object") { + for (const key of Object.keys(row)) { + keys.add(key); + } + } } -} + return `${[...keys].sort().join(",")}|${data.length}`; +}; -// Mirrors MRT's own columnFilterFns seeding (useMaterialReactTable's initial useState), -// so a column not yet in state resolves to the same mode name MRT would have picked itself. -const resolveColumnFilterFnName = (col) => { - if (typeof col.filterFn === 'function') { - return col.filterFn.name || 'custom' - } - return col.filterFn ?? getDefaultColumnFilterFn(col) -} +const getColumnKey = (col) => col?.id ?? col?.accessorKey; -const MUI_TABLE_HEAD_CELL_PROPS = { - sx: { - '& .MuiTableCell-root': { - padding: '8px 16px', - }, - '& .MuiAutocomplete-root': { - width: '100%', - }, - '& .MuiAutocomplete-root .MuiInputBase-root': { - height: '40px !important', - overflow: 'hidden', - textOverflow: 'ellipsis', - whiteSpace: 'nowrap', - display: 'flex', - flexWrap: 'nowrap', - }, - '& .MuiAutocomplete-root .MuiInputBase-root .MuiInputBase-input': { - height: '24px', - minHeight: '24px', - maxHeight: '24px', - }, - '& .MuiInputBase-root': { - height: '40px !important', - }, - '& .MuiInputBase-input': { - height: '24px', - minHeight: '24px', - maxHeight: '24px', - }, - '& .MuiChip-label.MuiChip-labelMedium': { - maxWidth: '80px', - overflow: 'hidden', - textOverflow: 'ellipsis', - whiteSpace: 'nowrap', - padding: '0 4px', - }, - '& .MuiChip-root': { - height: '24px', - maxHeight: '24px', - '&::before': { - content: 'attr(data-label)', - display: 'none', - }, - '&:hover::before': { - display: 'block', - position: 'absolute', - top: '-25px', - left: '0', - backgroundColor: 'rgba(0, 0, 0, 0.8)', - color: 'white', - padding: '4px 8px', - borderRadius: '4px', - fontSize: '12px', - whiteSpace: 'nowrap', - zIndex: 9999, - }, - }, - // MRT gives pinned cells `opacity: 0.97` (getCommonMRTCellStyles) so the row scrolling - // underneath a sticky column shows faintly through it; pin it back to opaque here. - '&[data-pinned="true"]': { - opacity: 1, - backgroundColor: 'background.paper', - }, - }, -} - -// Stable keys for row context — reference equality breaks after React Query refetches. -const ROW_CONTEXT_KEY_FIELDS = [ - 'id', - 'RowKey', - 'GUID', - 'userId', - 'appId', - 'azureAdUserId', - 'tenantId', -] - -const getRowContextKey = (row) => { - if (!row || typeof row !== 'object') { - return null +// Get initials from a name string +const getInitials = (name) => { + if (!name || typeof name !== "string") return "?"; + const parts = name.trim().split(/\s+/); + if (parts.length === 1) { + return parts[0].charAt(0).toUpperCase(); } - for (const field of ROW_CONTEXT_KEY_FIELDS) { - const value = row[field] - if (value != null && value !== '') { - return String(value) - } + return (parts[0].charAt(0) + parts[parts.length - 1].charAt(0)).toUpperCase(); +}; + +// Generate a consistent color from a string +const stringToColor = (string) => { + if (!string) return "#757575"; + let hash = 0; + for (let i = 0; i < string.length; i++) { + hash = string.charCodeAt(i) + ((hash << 5) - hash); } - return null -} + const colors = [ + "#1976d2", "#388e3c", "#d32f2f", "#7b1fa2", "#c2185b", + "#0288d1", "#00796b", "#f57c00", "#5d4037", "#455a64", + ]; + return colors[Math.abs(hash) % colors.length]; +}; + +// Default cards per page for pagination +const DEFAULT_CARDS_PER_PAGE = 12; +const PAGE_SIZE_OPTIONS = [12, 21, 50, "All"]; + +// Unified Card View Component (works for both mobile and desktop) +const CardView = ({ + data, + config, + isLoading, + searchTerm, + searchInput, + onSearchChange, + onRefresh, + title, + isMobile = false, + actions = [], + tenant = null, + showSearch = true, + offCanvas = null, + setOffCanvasData = null, + setOffCanvasRowIndex = null, + setOffcanvasVisible = null, + onCardClick = null, + editApiUrl = null, + queryKey = null, + columnFilters = [], + // Lazy loading props for server-side pagination + hasNextPage = false, + onLoadMore = null, + isFetchingNextPage = false, +}) => { + const theme = useTheme(); + const router = useRouter(); + + // Pagination state + const [currentPage, setCurrentPage] = useState(0); + const [pageSize, setPageSize] = useState(DEFAULT_CARDS_PER_PAGE); + + // Selection state for bulk actions + const [selectedItems, setSelectedItems] = useState(new Set()); + const [bulkActionAnchor, setBulkActionAnchor] = useState(null); + + // Inline editing state: { itemId: { fieldName: { editing: bool, value: string, saving: bool } } } + const [editingFields, setEditingFields] = useState({}); + const editInputRef = useRef(null); + + // State for emptyAction dialog (e.g., manager picker) + const [emptyActionData, setEmptyActionData] = useState({ item: null, action: null, ready: false }); + const emptyActionDialog = useDialog(); + + // State for bulk action dialog + const [bulkActionData, setBulkActionData] = useState({ data: [], action: null, ready: false }); + const bulkActionDialog = useDialog(); + + // API mutation for inline edits + const editMutation = ApiPostCall({ + relatedQueryKeys: queryKey ? [queryKey] : [], + }); + + // Selection helpers for bulk actions - basic helpers that don't depend on paginatedData + const getItemId = useCallback((item) => item.id || item.userPrincipalName || item.RowKey || JSON.stringify(item), []); + + const toggleItemSelection = useCallback((item) => { + const itemId = getItemId(item); + setSelectedItems(prev => { + const newSet = new Set(prev); + if (newSet.has(itemId)) { + newSet.delete(itemId); + } else { + newSet.add(itemId); + } + return newSet; + }); + }, [getItemId]); + + const clearSelection = useCallback(() => { + setSelectedItems(new Set()); + }, []); + + const isItemSelected = useCallback((item) => { + return selectedItems.has(getItemId(item)); + }, [selectedItems, getItemId]); + + // Get bulk actions (actions that support bulk operations) + const bulkActions = useMemo(() => { + return actions?.filter((action) => !action.link && !action?.hideBulk) || []; + }, [actions]); + + // Get selected items data + const selectedItemsData = useMemo(() => { + if (!data || selectedItems.size === 0) return []; + return data.filter(item => selectedItems.has(getItemId(item))); + }, [data, selectedItems, getItemId]); + + const formatFieldValue = (value) => { + if (value === null || value === undefined) return ""; + if (Array.isArray(value)) { + return value.length ? value.join(", ") : ""; + } + if (typeof value === "object") { + if (value.displayName) return String(value.displayName); + if (value.name) return String(value.name); + return JSON.stringify(value); + } + return String(value); + }; -const rowsMatchContext = (a, b) => { - if (a === b) { - return true - } - const keyA = getRowContextKey(a) - const keyB = getRowContextKey(b) - if (keyA && keyB) { - return keyA === keyB - } - return false -} + const getPrimaryFieldValue = (value) => String(value).split(/[;,]/)[0]?.trim(); -const isRowClickTarget = (event) => - event.target?.closest?.( - 'button, a, input, textarea, select, [role="button"], [role="menuitem"], [data-no-row-click="true"]' - ) + const getFieldHref = (field, value) => { + if (!value) return null; + if (typeof field?.href === "function") { + return field.href(value); + } + if (field?.linkType === "email") { + return `mailto:${getPrimaryFieldValue(value)}`; + } + if (field?.linkType === "tel") { + return `tel:${getPrimaryFieldValue(value).replace(/[^+\d]/g, "")}`; + } + return null; + }; + + // Inline editing helpers + const startEditing = (itemId, fieldName, currentValue) => { + setEditingFields(prev => ({ + ...prev, + [itemId]: { + ...prev[itemId], + [fieldName]: { editing: true, value: currentValue || "", saving: false } + } + })); + // Focus the input after state update + setTimeout(() => editInputRef.current?.focus(), 50); + }; + + const cancelEditing = (itemId, fieldName) => { + // Prevent prototype pollution by validating keys + const dangerousKeys = ['__proto__', 'constructor', 'prototype']; + if (dangerousKeys.includes(itemId) || dangerousKeys.includes(fieldName)) { + return; + } + setEditingFields(prev => { + const newState = { ...prev }; + if (Object.hasOwn(newState, itemId) && newState[itemId]) { + delete newState[itemId][fieldName]; + if (Object.keys(newState[itemId]).length === 0) { + delete newState[itemId]; + } + } + return newState; + }); + }; + + const updateEditValue = (itemId, fieldName, value) => { + setEditingFields(prev => ({ + ...prev, + [itemId]: { + ...prev[itemId], + [fieldName]: { ...prev[itemId]?.[fieldName], value } + } + })); + }; + + const saveEdit = async (item, field, newValue) => { + const itemId = item.id || item.userPrincipalName; + const fieldName = field.editField || field.field; + + if (!editApiUrl || !fieldName) { + cancelEditing(itemId, fieldName); + return; + } -const MUI_TABLE_BODY_CELL_ON_COPY = (e) => { - const sel = window.getSelection()?.toString() ?? '' - if (sel) { - e.preventDefault() - e.stopPropagation() - e.nativeEvent?.stopImmediatePropagation?.() - e.clipboardData.setData('text/plain', sel) - if (navigator.clipboard?.writeText) { - navigator.clipboard.writeText(sel).catch(() => {}) + // Mark as saving + setEditingFields(prev => ({ + ...prev, + [itemId]: { + ...prev[itemId], + [fieldName]: { ...prev[itemId]?.[fieldName], saving: true } + } + })); + + try { + // Handle array fields (like businessPhones) - wrap single value in array + let valueToSave = newValue; + const originalValue = getNestedValue(item, field.field || fieldName); + if (Array.isArray(originalValue) || fieldName === "businessPhones") { + valueToSave = newValue ? [newValue] : []; + } + + await editMutation.mutateAsync({ + url: editApiUrl, + data: { + tenantFilter: tenant, + id: item.id, + userPrincipalName: item.userPrincipalName, + [fieldName]: valueToSave, + }, + }); + // Update the item in local state (data is from parent, so this update is optimistic display only) + // The queryKey invalidation in ApiPostCall should refresh the data + } catch (error) { + console.error("Failed to save edit:", error); + } finally { + cancelEditing(itemId, fieldName); + } + }; + + const getEditState = (itemId, fieldName) => { + return editingFields[itemId]?.[fieldName] || { editing: false, value: "", saving: false }; + }; + + const CARD_HEIGHT = "100%"; + // Max card width sized to fit 8 quick-action icon buttons in a single row + // Calculation: 8 buttons × 34px + 7 gaps × 6px + 32px padding + 5px borders ≈ 351px → 360px + const CARD_MAX_WIDTH = 360; + + // Render badge based on config + const renderBadge = (badge, item, badgeIndex, isCompact = false, router = null) => { + let fieldValue = getNestedValue(item, badge.field); + + // Apply transform function if provided + if (badge.transform && typeof badge.transform === "function") { + fieldValue = badge.transform(fieldValue, item); + } + + let badgeConfig = null; + + if (badge.conditions) { + const key = + fieldValue === true + ? "true" + : fieldValue === false + ? "false" + : String(fieldValue); + badgeConfig = badge.conditions[key] || badge.conditions[fieldValue]; } - } -} - -const MUI_TABLE_BODY_CELL_PROPS = { - onCopy: MUI_TABLE_BODY_CELL_ON_COPY, - sx: { - cursor: 'inherit', - // grid-no-grow: allow plain text to shrink so CSS ellipsis can clip to column width - overflow: 'hidden', - minWidth: 0, - '& .cipp-cell-text': { - cursor: 'text', - userSelect: 'text', - display: 'block', - maxWidth: '100%', - overflow: 'hidden', - textOverflow: 'ellipsis', - whiteSpace: 'nowrap', - }, - '& .MuiSvgIcon-root': { - cursor: 'inherit', - }, - '& a, & button, & [role="button"], & .MuiChip-root, & .MuiIconButton-root, & .MuiButton-root, & .MuiCheckbox-root': - { - cursor: 'pointer', - }, - // MRT gives pinned cells `opacity: 0.97` (getCommonMRTCellStyles) so the row scrolling - // underneath a sticky column shows faintly through it; pin it back to opaque here. - '&[data-pinned="true"]': { - opacity: 1, - backgroundColor: 'background.paper', - }, - }, -} - -const MRT_THEME = (theme) => ({ - baseBackgroundColor: theme.palette.background.paper, -}) - -// MUI 9 dropped Checkbox's legacy `inputProps`, but MRT_SelectCheckbox still sets it — -// it leaks onto the DOM as `inputprops="[object Object]"` and the real `` loses -// its aria-label. Null it out and restore the label via `slotProps.input` instead. -const MUI_SELECT_CHECKBOX_PROPS = ({ table }) => ({ - inputProps: undefined, - slotProps: { - input: { 'aria-label': table.options.localization.toggleSelectRow }, - }, -}) -const MUI_SELECT_ALL_CHECKBOX_PROPS = ({ table }) => ({ - inputProps: undefined, - slotProps: { - input: { 'aria-label': table.options.localization.toggleSelectAll }, - }, -}) + if (!badgeConfig) return null; -// Compute a lightweight "schema key" from data to decide whether columns need recomputing. -// Only looks at the keys of the first few rows rather than deep-comparing the full dataset. -const computeSchemaKey = (data) => { - if (!Array.isArray(data) || data.length === 0) return '' - const sample = data.slice(0, 3) - const keys = new Set() - for (const row of sample) { - if (row && typeof row === 'object') { - for (const k of Object.keys(row)) keys.add(k) + // Helper to resolve link template with item data + const resolveLink = (linkTemplate) => { + if (!linkTemplate) return null; + return linkTemplate.replace(/\[(\w+)\]/g, (match, key) => { + return item[key] || ""; + }); + }; + + // Get the link if badge has one and condition is met + const badgeLink = badge.link ? resolveLink(badge.link) : null; + const isClickable = !!badgeLink && router; + + // Wrapper for clickable badges + const wrapWithClick = (element) => { + if (!isClickable) return element; + return ( + { + e.stopPropagation(); + router.push(badgeLink); + }} + sx={{ + cursor: "pointer", + display: "inline-flex", + alignItems: "center", + "&:hover": { opacity: 0.8 }, + }} + > + {element} + + ); + }; + + if (badge.iconOnly && badgeConfig.icon && isValidElement(badgeConfig.icon)) { + // Prefer condition-specific tooltip/label over generic badge tooltip + const tooltipText = badgeConfig.tooltip || badgeConfig.label || badge.tooltip || getCippTranslation(badge.field); + const color = + badgeConfig.color === "success" + ? "success.main" + : badgeConfig.color === "error" + ? "error.main" + : badgeConfig.color === "warning" + ? "warning.main" + : badgeConfig.color === "info" + ? "info.main" + : badgeConfig.color === "primary" + ? "primary.main" + : badgeConfig.color === "secondary" + ? "secondary.main" + : "text.secondary"; + + const badgeElement = ( + + + + {badgeConfig.icon} + + + + ); + return wrapWithClick(badgeElement); + } + + if (badgeConfig.icon === "check") { + // Prefer condition-specific tooltip/label over generic badge tooltip + const tooltipText = badgeConfig.tooltip || badgeConfig.label || badge.tooltip || getCippTranslation(badge.field); + const badgeElement = ( + + + + ); + return wrapWithClick(badgeElement); + } else if (badgeConfig.icon === "cancel") { + // Prefer condition-specific tooltip/label over generic badge tooltip + const tooltipText = badgeConfig.tooltip || badgeConfig.label || badge.tooltip || getCippTranslation(badge.field); + const badgeElement = ( + + + + ); + return wrapWithClick(badgeElement); + } + + const badgeElement = ( + + ); + return wrapWithClick(badgeElement); + }; + + // Filter and sort data based on search term, column filters, and custom sorting + const filteredData = useMemo(() => { + let result = data; + + // Apply column filters first + if (columnFilters && columnFilters.length > 0 && result) { + result = result.filter((item) => { + // Each active filter must match + return columnFilters.every((filter) => { + // Handle filters that have nested value array (from filter definitions) + // e.g., { filterName: "...", value: [{ id: "field", value: "val" }] } + if (filter.value && Array.isArray(filter.value) && filter.value[0]?.id) { + return filter.value.every((condition) => { + const fieldValue = getNestedValue(item, condition.id); + // Handle special cases for different field types + if (condition.id === "assignedLicenses") { + const hasLicenses = Array.isArray(fieldValue) && fieldValue.length > 0; + return condition.value === "licensed" ? hasLicenses : !hasLicenses; + } + if (condition.id === "accountEnabled") { + const isEnabled = fieldValue === true || fieldValue === "Yes"; + return condition.value === "Yes" ? isEnabled : !isEnabled; + } + // Default string comparison + return String(fieldValue).toLowerCase() === String(condition.value).toLowerCase(); + }); + } + // Handle simple {id, value} format (from MRT state) + if (filter.id) { + const fieldValue = getNestedValue(item, filter.id); + // Handle special cases + if (filter.id === "assignedLicenses") { + const hasLicenses = Array.isArray(fieldValue) && fieldValue.length > 0; + return filter.value === "licensed" ? hasLicenses : !hasLicenses; + } + if (filter.id === "accountEnabled") { + const isEnabled = fieldValue === true || fieldValue === "Yes"; + return filter.value === "Yes" ? isEnabled : !isEnabled; + } + // Default: check if value matches or contains + if (Array.isArray(filter.value)) { + return filter.value.some(v => + String(fieldValue).toLowerCase().includes(String(v).toLowerCase()) + ); + } + return String(fieldValue).toLowerCase().includes(String(filter.value).toLowerCase()); + } + return true; + }); + }); + } + + // Apply search filter - search across all relevant fields + if (searchTerm && result) { + const term = searchTerm.toLowerCase(); + result = result.filter((item) => { + const titleValue = getNestedValue(item, config.title); + const subtitleValue = config.subtitle ? getNestedValue(item, config.subtitle) : null; + + // Deep-search every field (including nested objects and arrays) so matches + // aren't limited to top-level string/number values. + const searchAllFields = () => valueContainsTerm(item, term); + + return ( + (titleValue && formatFieldValue(titleValue).toLowerCase().includes(term)) || + (subtitleValue && formatFieldValue(subtitleValue).toLowerCase().includes(term)) || + searchAllFields() + ); + }); + } + + // Apply custom sorting if provided + if (config.sortFn && result) { + result = [...result].sort(config.sortFn); + } + + return result; + }, [data, searchTerm, config, columnFilters]); + + // Reset to first page when search term or filters change (user-initiated actions). + // We intentionally exclude data?.length because: + // 1. Pagination loading more items increases length but shouldn't reset to page 0 + // 2. Data reference changes are handled by the isEqual check in parent component + useEffect(() => { + setCurrentPage(0); + }, [searchTerm, columnFilters]); + + // Clear selection when data changes (e.g., tenant switch, filter change) + useEffect(() => { + setSelectedItems(new Set()); + }, [data]); + + // Calculate pagination values + const totalItems = filteredData?.length || 0; + const effectivePageSize = pageSize === "All" ? totalItems : pageSize; + const totalPages = effectivePageSize > 0 ? Math.ceil(totalItems / effectivePageSize) : 1; + const startIndex = currentPage * effectivePageSize; + const endIndex = pageSize === "All" ? totalItems : Math.min(startIndex + effectivePageSize, totalItems); + + // Get paginated data - only render cards for the current page (or all if "All" selected) + const paginatedData = useMemo(() => { + if (!filteredData) return []; + if (pageSize === "All") return filteredData; + return filteredData.slice(startIndex, endIndex); + }, [filteredData, startIndex, endIndex, pageSize]); + + // Selection helpers that depend on paginatedData + const selectAllVisible = useCallback(() => { + if (!paginatedData) return; + const newSet = new Set(selectedItems); + paginatedData.forEach(item => newSet.add(getItemId(item))); + setSelectedItems(newSet); + }, [paginatedData, getItemId, selectedItems]); + + const allVisibleSelected = useMemo(() => { + if (!paginatedData || paginatedData.length === 0) return false; + return paginatedData.every(item => selectedItems.has(getItemId(item))); + }, [paginatedData, selectedItems, getItemId]); + + // Handle bulk action click + const handleBulkAction = useCallback((action) => { + setBulkActionAnchor(null); + + if (typeof action.customBulkHandler === "function") { + action.customBulkHandler({ + rows: selectedItemsData.map(item => ({ original: item })), + data: selectedItemsData, + closeMenu: () => setBulkActionAnchor(null), + clearSelection: clearSelection, + }); + return; + } + + setBulkActionData({ + data: selectedItemsData, + action: action, + ready: true, + }); + + if (action?.noConfirm && action.customFunction) { + selectedItemsData.forEach(item => action.customFunction(item, action, {})); + } else { + bulkActionDialog.handleOpen(); + } + }, [selectedItemsData, clearSelection, bulkActionDialog]); + + // Pagination handlers with lazy loading support + const handlePreviousPage = useCallback(() => { + setCurrentPage((prev) => Math.max(0, prev - 1)); + }, []); + + const handleNextPage = useCallback(() => { + const nextPage = currentPage + 1; + const nextPageStartIndex = nextPage * effectivePageSize; + + // Check if we need to load more data for the next page + if (nextPageStartIndex >= totalItems && hasNextPage && onLoadMore && !isFetchingNextPage) { + // We need more data - fetch it, but also advance the page + // The new data will be available after the fetch completes + onLoadMore(); + } + + // Allow navigation if we have data for the next page OR if we're fetching more + if (nextPage < totalPages || hasNextPage) { + setCurrentPage(nextPage); } + }, [currentPage, effectivePageSize, totalItems, hasNextPage, onLoadMore, isFetchingNextPage, totalPages]); + + const handlePageChange = useCallback((newPage) => { + const targetStartIndex = newPage * effectivePageSize; + + // Check if we need to load more data for the target page + if (targetStartIndex >= totalItems && hasNextPage && onLoadMore && !isFetchingNextPage) { + onLoadMore(); + } + + // Allow navigation if we have the data or are fetching + if (newPage < totalPages || (hasNextPage && newPage === totalPages)) { + setCurrentPage(Math.max(0, newPage)); + } else { + setCurrentPage(Math.max(0, Math.min(totalPages - 1, newPage))); + } + }, [effectivePageSize, totalItems, hasNextPage, onLoadMore, isFetchingNextPage, totalPages]); + + const handlePageSizeChange = useCallback((newSize) => { + setPageSize(newSize); + setCurrentPage(0); // Reset to first page when changing page size + }, []); + + // Filter actions for mobile - use mobileQuickActions if defined, otherwise first 4 + const cardActions = useMemo(() => { + if (!actions || actions.length === 0) return []; + + if (isMobile && config.mobileQuickActions) { + // Filter to only mobile-specific actions + return actions.filter(a => + config.mobileQuickActions.includes(a.label) && + (!a.condition || a.condition) + ); + } + + return actions; + }, [actions, isMobile, config.mobileQuickActions]); + + const renderedCards = useMemo(() => { + return paginatedData?.map((item, index) => { + const titleValue = getNestedValue(item, config.title) || "Unknown"; + const subtitleValue = config.subtitle ? getNestedValue(item, config.subtitle) : null; + const avatarField = config.avatar?.field + ? getNestedValue(item, config.avatar.field) + : titleValue; + + // Get fields to display + const desktopFields = !isMobile && config.desktopFields ? config.desktopFields : []; + const extraFields = config.extraFields || []; + + // Check license status for visual indicator + const isLicensed = item.assignedLicenses && item.assignedLicenses.length > 0; + + const gridProps = { + xs: 12, + sm: isMobile ? 12 : 6, + md: 4, + lg: 3, + ...(config.cardGridProps || {}), + }; + + // Get dynamic card styles if cardSx function is provided + const dynamicCardSx = typeof config.cardSx === "function" ? config.cardSx(item) : {}; + + return ( + + + + {/* Selection checkbox - shown when bulk actions are available */} + {bulkActions.length > 0 && ( + { + e.stopPropagation(); + toggleItemSelection(item); + }} + onClick={(e) => e.stopPropagation()} + sx={{ + position: "absolute", + top: 4, + right: 4, + p: 0.25, + zIndex: 1, + bgcolor: "background.paper", + borderRadius: 0.5, + opacity: isItemSelected(item) ? 1 : 0.6, + "&:hover": { + opacity: 1, + bgcolor: "background.paper", + }, + }} + /> + )} + + {/* Header: Avatar + Name + Badges + Info Icon */} + {/* Only load photos when showing 12 or 21 items to optimize performance */} + + {config.avatar?.photoField && tenant && item.id && (pageSize === 12 || pageSize === 21) ? ( + onCardClick(item) : undefined} + /> + ) : config.avatar?.customRender ? ( + onCardClick(item) : undefined} + sx={{ + flexShrink: 0, + cursor: onCardClick ? "pointer" : "default", + "& .MuiAvatar-root": { width: 48, height: 48 }, + }} + > + {config.avatar.customRender(avatarField, item)} + + ) : config.avatar?.icon ? ( + onCardClick(item) : undefined} + sx={{ + bgcolor: stringToColor(avatarField), + width: 48, + height: 48, + flexShrink: 0, + cursor: onCardClick ? "pointer" : "default", + }} + > + {typeof config.avatar.icon === "function" + ? config.avatar.icon(item) + : config.avatar.icon} + + ) : ( + onCardClick(item) : undefined} + sx={{ + bgcolor: stringToColor(avatarField), + width: 48, + height: 48, + fontSize: "1rem", + fontWeight: 600, + flexShrink: 0, + cursor: onCardClick ? "pointer" : "default", + }} + > + {getInitials(avatarField)} + + )} + + + + + onCardClick(item) : undefined} + sx={{ + fontWeight: 600, + overflow: "hidden", + textOverflow: "ellipsis", + whiteSpace: "nowrap", + flex: 1, + minWidth: 0, + cursor: onCardClick ? "pointer" : "default", + "&:hover": onCardClick ? { + textDecoration: "underline", + color: "primary.main", + } : {}, + }} + > + {titleValue} + + + {/* Compact badges */} + {config.badges?.length > 0 && ( + + {config.badges.map((badge, badgeIndex) => + renderBadge(badge, item, badgeIndex, true, router) + )} + + )} + {/* Info icon to open offCanvas panel */} + {offCanvas && setOffCanvasData && setOffcanvasVisible && ( + + { + e.stopPropagation(); + setOffCanvasData(item); + const idx = filteredData?.findIndex(r => r === item) ?? 0; + if (setOffCanvasRowIndex) setOffCanvasRowIndex(idx); + setOffcanvasVisible(true); + }} + sx={{ + ml: 0.5, + p: 0.5, + color: "info.main", + "&:hover": { + bgcolor: "info.lighter", + }, + }} + > + + + + )} + + + {subtitleValue && ( + + + {formatFieldValue(subtitleValue)} + + + )} + + + + {/* Custom Content Section - rendered as separate row if customContentInline is false */} + {typeof config.customContent === "function" && !config.customContentInline && config.customContent(item)} + + {/* Info Section */} + + {/* Extra fields (job title, department) */} + {/* Inline custom content row - only renders when NO extraFields are defined */} + {config.customContentInline && typeof config.customContent === "function" && extraFields.length === 0 && ( + (() => { + const inlineContent = config.customContent(item); + if (inlineContent) { + return ( + + {inlineContent} + + ); + } + return null; + })() + )} + {extraFields.length > 0 && ( + + {extraFields.slice(0, config.extraFieldsMax ?? 2).map((fieldOrRow, fieldIndex) => { + // Check if this is an array (paired fields in a row) + const isPairedRow = Array.isArray(fieldOrRow); + const fieldsInRow = isPairedRow ? fieldOrRow : [fieldOrRow]; + + // Check if this is the first field (for inline custom content) + const isFirstField = fieldIndex === 0; + + const inlineContent = isFirstField && + config.customContentInline && + typeof config.customContent === "function" + ? config.customContent(item) + : null; + + // Render a single field + const renderField = (field, isPaired = false, isLast = false) => { + const itemId = item.id || item.userPrincipalName; + const editFieldName = field.editField || field.field; + const rawValue = getNestedValue(item, field.field || field); + const formattedValue = + typeof field.formatter === "function" + ? field.formatter(rawValue, item) + : rawValue; + const value = formatFieldValue(formattedValue); + const hasValue = !!value; + const editState = getEditState(itemId, editFieldName); + const canEdit = field.editable && editApiUrl && !hasValue; + // Check for emptyAction (e.g., manager picker) + const hasEmptyAction = field.emptyAction && !hasValue; + + // Editing mode + if (editState.editing) { + const isRightAlignedEdit = field.align === "right"; + return ( + saveEdit(item, field, editState.value)}> + + {field.icon && ( + + {field.icon} + + )} + updateEditValue(itemId, editFieldName, e.target.value)} + onKeyDown={(e) => { + if (e.key === "Enter") { + saveEdit(item, field, editState.value); + } else if (e.key === "Escape") { + cancelEditing(itemId, editFieldName); + } + }} + disabled={editState.saving} + placeholder={field.label || editFieldName} + sx={{ + flex: 1, + "& .MuiInput-input": { + fontSize: "0.75rem", + py: 0, + }, + }} + InputProps={{ + endAdornment: editState.saving ? ( + + + + ) : null, + }} + /> + + + ); + } + + // Display mode + const isClickable = canEdit || hasEmptyAction; + const tooltipText = hasEmptyAction + ? `Click to ${field.emptyAction.label?.toLowerCase() || 'set value'}` + : canEdit + ? "Click to add" + : (value || ""); + + const handleFieldClick = () => { + if (hasEmptyAction) { + // Open emptyAction dialog (e.g., manager picker) + setEmptyActionData({ + item: item, + action: field.emptyAction, + ready: true, + }); + emptyActionDialog.handleOpen(); + } else if (canEdit) { + startEditing(itemId, editFieldName, ""); + } + }; + + const isRightAligned = field.align === "right"; + + return ( + + + {field.icon && ( + + {field.icon} + + )} + + {value || "—"} + + + + ); + }; + + return ( + + {isPairedRow ? ( + // Paired fields - each takes up to 50% width + <> + {fieldsInRow.map((f, i) => renderField(f, true, i === fieldsInRow.length - 1))} + + ) : ( + // Single field row + + {renderField(fieldsInRow[0], false, true)} + + )} + {inlineContent} + + ); + })} + + )} + + {/* Desktop-only additional info in compact grid */} + {!isMobile && desktopFields.length > 0 && ( + + {config.desktopFieldsLayout === "column" ? ( + + {desktopFields.slice(0, config.desktopFieldsMax ?? 4).map((field, fieldIndex) => { + const itemId = item.id || item.userPrincipalName; + const editFieldName = field.editField || field.field; + const rawValue = getNestedValue(item, field.field || field); + const formattedValue = + typeof field.formatter === "function" + ? field.formatter(rawValue, item) + : rawValue; + const value = formatFieldValue(formattedValue); + const hasValue = !!value; + const href = hasValue ? getFieldHref(field, value) : null; + const editState = getEditState(itemId, editFieldName); + const canEdit = field.editable && editApiUrl && !hasValue; + + // Editing mode for desktop fields + if (editState.editing) { + return ( + saveEdit(item, field, editState.value)}> + + {field.icon && ( + + {field.icon} + + )} + updateEditValue(itemId, editFieldName, e.target.value)} + onKeyDown={(e) => { + if (e.key === "Enter") { + saveEdit(item, field, editState.value); + } else if (e.key === "Escape") { + cancelEditing(itemId, editFieldName); + } + }} + disabled={editState.saving} + placeholder={field.label || editFieldName} + sx={{ + flex: 1, + "& .MuiInput-input": { + fontSize: "0.7rem", + py: 0, + }, + }} + InputProps={{ + endAdornment: editState.saving ? ( + + + + ) : null, + }} + /> + + + ); + } + + return ( + + startEditing(itemId, editFieldName, "") : undefined} + sx={{ + minWidth: 0, + width: "100%", + overflow: "hidden", + minHeight: 18, + cursor: canEdit ? "pointer" : "default", + borderRadius: 0.5, + px: canEdit ? 0.5 : 0, + mx: canEdit ? -0.5 : 0, + "&:hover": canEdit ? { + bgcolor: "action.hover", + } : {}, + }} + > + {field.icon && ( + + {field.icon} + + )} + e.stopPropagation() : undefined} + sx={{ + fontSize: "0.7rem", + overflow: "hidden", + textOverflow: "ellipsis", + whiteSpace: "nowrap", + minWidth: 0, + flex: 1, + color: href ? "primary.main" : hasValue ? "text.secondary" : "info.main", + opacity: hasValue || href ? 1 : 0.6, + textDecoration: href ? "underline" : "none", + fontStyle: hasValue ? "normal" : "italic", + }} + > + {value || "—"} + + + + ); + })} + + ) : ( + + {desktopFields.slice(0, config.desktopFieldsMax ?? 4).map((field, fieldIndex) => { + const rawValue = getNestedValue(item, field.field || field); + const value = formatFieldValue(rawValue); + const hasValue = !!value; + const href = hasValue ? getFieldHref(field, value) : null; + + return ( + + + + {field.icon && ( + + {field.icon} + + )} + e.stopPropagation() : undefined} + sx={{ + fontSize: "0.7rem", + overflow: "hidden", + textOverflow: "ellipsis", + whiteSpace: "nowrap", + minWidth: 0, + flex: 1, + color: href ? "primary.main" : hasValue ? "text.secondary" : "info.main", + opacity: hasValue || href ? 1 : 0.6, + textDecoration: href ? "underline" : "none", + fontStyle: hasValue ? "normal" : "italic", + }} + > + {value || "—"} + + + + + ); + })} + + )} + + )} + + + {/* Quick Actions - Always at bottom */} + {cardActions && cardActions.length > 0 && ( + e.stopPropagation()} + > + { + setOffCanvasData(itemData); + // Find index for navigation + const idx = filteredData?.findIndex(r => r === itemData) ?? 0; + setOffCanvasRowIndex(idx); + setOffcanvasVisible(true); + } : undefined} + /> + + )} + + + + ); + }); + // Performance-critical render of the full card grid. The omitted inline helpers + // (getFieldHref/saveEdit/getEditState) and props (editApiUrl/onCardClick/router/ + // filteredData) are re-created each render; including them would recompute every + // card on every render. paginatedData (derived from filteredData) is the meaningful + // trigger, and the helpers close over the state they need at call time. + // eslint-disable-next-line react-hooks/exhaustive-deps + }, [ + paginatedData, + pageSize, + config, + isMobile, + tenant, + theme, + cardActions, + offCanvas, + setOffCanvasData, + setOffCanvasRowIndex, + setOffcanvasVisible, + emptyActionDialog, + bulkActions, + isItemSelected, + toggleItemSelection, + ]); + + // Fixed card height for uniform appearance + if (isLoading) { + return ( + + + {[1, 2, 3, 4, 5, 6].map((i) => ( + + + + + + + + + + + {!isMobile && ( + + + + + )} + + + + ))} + + + ); } - return [...keys].sort().join(',') + '|' + data.length -} - -// ── Module-level render helpers for filter mode menus ────────────────────── -function renderGlobalFilterModeMenuItemsFn({ - internalFilterOptions, - onSelectFilterMode, -}) { - const customFilterOptions = [ - { - option: 'regex', - label: 'Regex', - symbol: '(.*)', - }, - ] - customFilterOptions.forEach((filterOption) => { - if ( - !internalFilterOptions.some( - (option) => option.option === filterOption.option - ) - ) { - internalFilterOptions.push(filterOption) - } - }) - - return internalFilterOptions.map((filterOption) => ( - onSelectFilterMode(filterOption.option)} - sx={{ - display: 'flex', - alignItems: 'center', - gap: '0.5rem', - }} - > - - {filterOption.symbol} - - {filterOption.label} - - )) -} - -function renderColumnFilterModeMenuItemsFn({ - internalFilterOptions, - onSelectFilterMode, -}) { - const customFilterOptions = [ - { - option: 'notContains', - label: 'Not Contains', - symbol: '!*', - }, - { - option: 'regex', - label: 'Regex', - symbol: '(.*)', - }, - ] - - const combinedFilterOptions = [ - ...internalFilterOptions, - ...customFilterOptions, - ] - - return combinedFilterOptions.map((filterOption) => ( - onSelectFilterMode(filterOption.option)} - sx={{ - display: 'flex', - alignItems: 'center', - gap: '0.5rem', - }} - > - - {filterOption.symbol} - - {filterOption.label} - - )) -} + return ( + + {/* Search and Refresh Bar */} + {showSearch && ( + + {/* Selection checkbox for visible items */} + {bulkActions.length > 0 && paginatedData?.length > 0 && ( + + 0 && !allVisibleSelected} + onChange={() => { + if (allVisibleSelected) { + // Deselect all visible items + const visibleIds = new Set(paginatedData.map(item => getItemId(item))); + setSelectedItems(prev => { + const newSet = new Set(prev); + visibleIds.forEach(id => newSet.delete(id)); + return newSet; + }); + } else { + selectAllVisible(); + } + }} + sx={{ p: 0.5 }} + /> + + )} + + onSearchChange(e.target.value)} + sx={{ flex: 1, minWidth: 200, maxWidth: isMobile ? "100%" : 350 }} + InputProps={{ + startAdornment: ( + + + + ), + }} + /> + + {/* Selection indicator and bulk actions */} + {selectedItems.size > 0 && ( + <> + + + {selectedItems.size} selected + + {bulkActions.length > 0 && selectedItems.size >= 2 && ( + + )} + + + )} + + + {onRefresh && ( + + + + )} + {/* Page size selector */} + + + Show: + + {PAGE_SIZE_OPTIONS.map((option) => ( + handlePageSizeChange(option)} + variant={pageSize === option ? "filled" : "outlined"} + color={pageSize === option ? "primary" : "default"} + sx={{ + minWidth: option === "All" ? 40 : 32, + height: 24, + fontSize: "0.75rem", + cursor: "pointer", + "& .MuiChip-label": { px: 1 }, + }} + /> + ))} + + + + {pageSize === "All" + ? `${totalItems} ${totalItems === 1 ? "result" : "results"}` + : totalItems > effectivePageSize + ? `${startIndex + 1}-${endIndex} of ${totalItems}` + : `${totalItems} ${totalItems === 1 ? "result" : "results"}` + } + + + + )} + + {/* Selection action bar for desktop card view: the search header (which + normally hosts the selection indicator + bulk actions) is hidden when + showSearch is false, yet per-card checkboxes are still shown. Without + this bar, selected cards would be a dead-end with no way to act on them. */} + {!showSearch && bulkActions.length > 0 && selectedItems.size > 0 && ( + + + {selectedItems.size} selected + + {selectedItems.size >= 2 && ( + + )} + + + )} + + {/* Card Grid - Uniform sizing */} + + + {renderedCards} + + + {/* Show loading indicator when fetching more data for current page */} + {isFetchingNextPage && paginatedData?.length === 0 && ( + + + + Loading more data... + + + )} + + {filteredData?.length === 0 && !isFetchingNextPage && ( + + + {searchTerm ? `No results found for "${searchTerm}"` : "No data available"} + + + )} + + {/* Pagination Controls - hidden when "All" is selected */} + {/* Show pagination if we have multiple pages OR if there's more data to load */} + {pageSize !== "All" && (totalPages > 1 || hasNextPage) && ( + + + ← + + + + {/* Show page numbers with ellipsis for large page counts */} + {/* When hasNextPage is true, we show "..." to indicate more pages available */} + {Array.from({ length: Math.min(totalPages, 7) }, (_, i) => { + let pageNum; + if (totalPages <= 7) { + pageNum = i; + } else if (currentPage < 4) { + pageNum = i < 5 ? i : (i === 5 ? -1 : totalPages - 1); + } else if (currentPage > totalPages - 5) { + pageNum = i === 0 ? 0 : (i === 1 ? -1 : totalPages - 6 + i); + } else { + pageNum = i === 0 ? 0 : (i === 1 ? -1 : (i === 5 ? -1 : (i === 6 ? totalPages - 1 : currentPage - 2 + i))); + } + + if (pageNum === -1) { + return ...; + } + + return ( + handlePageChange(pageNum)} + disabled={isFetchingNextPage} + size="small" + sx={{ + minWidth: 32, + height: 32, + borderRadius: 1, + bgcolor: currentPage === pageNum ? "primary.main" : "transparent", + color: currentPage === pageNum ? "primary.contrastText" : "text.primary", + "&:hover": { + bgcolor: currentPage === pageNum ? "primary.dark" : "action.hover", + }, + }} + > + {pageNum + 1} + + ); + })} + {/* Show ellipsis and loading indicator if more data is available */} + {hasNextPage && ( + <> + ... + {isFetchingNextPage && ( + + )} + + )} + + + = totalPages - 1 && !hasNextPage) || isFetchingNextPage} + size="small" + sx={{ + border: 1, + borderColor: "divider", + "&:disabled": { opacity: 0.5 }, + }} + > + {isFetchingNextPage ? ( + + ) : ( + → + )} + + + )} + + + {/* EmptyAction Dialog (e.g., manager picker) */} + {emptyActionData.ready && ( + + )} + + {/* Bulk Actions Menu */} + setBulkActionAnchor(null)} + anchorOrigin={{ + horizontal: "right", + vertical: "bottom", + }} + transformOrigin={{ + horizontal: "right", + vertical: "top", + }} + PaperProps={{ + sx: { + mt: 1, + borderRadius: 2, + minWidth: 200, + }, + }} + > + {bulkActions.map((action, index) => { + // Check if action is disabled based on condition + const isDisabled = action.condition + ? !selectedItemsData.every((item) => action.condition({ original: item })) + : false; + + return ( + handleBulkAction(action)} + > + {action.icon && ( + + {action.icon} + + )} + {action.label} + + ); + })} + + + {/* Bulk Action Dialog */} + {bulkActionData.ready && ( + { + setBulkActionData({ data: [], action: null, ready: false }); + clearSelection(); + }} + /> + )} + + ); +}; + +// Legacy wrapper for backward compatibility +const MobileCardView = (props) => ; export const CippDataTable = (props) => { const { @@ -663,348 +2045,438 @@ export const CippDataTable = (props) => { // Whole-array transform applied after dataFilter/dataMap (e.g. grouping All Tenants rows). dataTransform, actions, - title = 'Report', + title = "Report", simple = false, cardButton, offCanvas = false, offCanvasOnRowClick = false, - rowOpen, noCard = false, hideTitle = false, refreshFunction, - incorrectDataMessage = 'Data not in correct format', + incorrectDataMessage = "Data not in correct format", onChange, filters, - maxHeightOffset = '380px', + maxHeightOffset = "380px", defaultSorting = [], isInDialog = false, showBulkExportAction = true, + cardConfig = null, // Configuration for card view (renamed from mobileCardConfig) + mobileCardConfig = null, // Deprecated: use cardConfig instead + defaultViewMode = "cards", // Default view mode: 'cards' or 'table' + viewModeStorageKey: viewModeStorageKeyOverride = null, + showRowActionsMenu = true, + rowSx = null, // Optional row styling callback (row) => sx object + onCardClick = null, // Callback when card avatar/title is clicked for navigation + dataFreshnessField = null, // Field name to extract data freshness date from first row (e.g. "reportRefreshDate") + initialColumnFilters = null, // Optional initial column filters (e.g. [{ id: "assignedLicenses", value: "licensed" }]) viewMode: viewModeProp, mobileCard, dataSourceControls, subTables = EMPTY_ARRAY, persistenceKey, parentRow, - } = props + } = props; - // Create a map of column IDs to their filterType for quick lookup. - // Built via Map.set + Object.fromEntries rather than `acc[v.id] = ...`: the column id is - // a computed key from preset data, and a bracket assignment would route a value such as - // '__proto__' through Object.prototype's setter. Map keys never touch the prototype chain. - const filterTypeMap = useMemo(() => { - if (!filters || !Array.isArray(filters)) return {} - return Object.fromEntries( - filters.reduce((acc, filter) => { - if (filter.value && Array.isArray(filter.value)) { - filter.value.forEach((v) => { - if (v.id && filter.filterType) { - acc.set(v.id, filter.filterType) - } - }) - } - return acc - }, new Map()) - ) - }, [filters]) + const { updateTrigger } = useLicenseBackfill(); - // Track if initial filters have been applied - const filtersInitializedRef = useRef(false) - const previousFiltersRef = useRef(null) - - const [columnVisibility, setColumnVisibility] = useState( - initialColumnVisibility - ) - const [configuredSimpleColumns, setConfiguredSimpleColumns] = - useState(simpleColumns) - const [usedData, setUsedData] = useState(data) - const [usedColumns, setUsedColumns] = useState([]) - // Controlled so we can drop stale ids (membersCsv ↔ members) in the same render - // as displayColumns changes — a post-render setColumnOrder is too late; MRT throws first. - const [columnOrder, setColumnOrder] = useState(() => [...simpleColumns]) - const lastOrderedSelectionRef = useRef(null) - const [offcanvasVisible, setOffcanvasVisible] = useState(false) - const [offCanvasData, setOffCanvasData] = useState({}) - const [offCanvasRowIndex, setOffCanvasRowIndex] = useState(0) - const [contextRow, setContextRow] = useState(null) - const [rowContextMenu, setRowContextMenu] = useState(null) - const rowClickStartRef = useRef(null) - const [customComponentData, setCustomComponentData] = useState({}) - const [customComponentVisible, setCustomComponentVisible] = useState(false) - const [actionData, setActionData] = useState({ - data: {}, - action: {}, - ready: false, - }) - const [graphFilterData, setGraphFilterData] = useState({}) - const [sorting, setSorting] = useState([]) - const [columnFilters, setColumnFilters] = useState([]) - // MRT seeds its own columnFilterFns state once, from whatever `columns` it was given on - // the very first render — here that's always [] (columns arrive async from the API), so - // it's permanently stuck at {} and every filter's helper text reads "Filter Mode: - // undefined". Track and control it ourselves so it re-derives as real columns arrive. - const [columnFilterFns, setColumnFilterFns] = useState({}) - const waitingBool = api?.url ? true : false - - const [activeFilters, setActiveFilters] = useState({ graph: null, table: null }) - const [searchValue, setSearchValue] = useState('') - const restoredFiltersRef = useRef(new Set()) - const searchFocusRef = useRef(null) - - const settings = useSettings() - const router = useRouter() - const routerPageName = router.pathname.split('/').slice(1).join('/') - const pageName = persistenceKey ?? (isInDialog ? '' : routerPageName) + // Create a map of column IDs to their filterType for quick lookup + const filterTypeMap = useMemo(() => { + if (!filters || !Array.isArray(filters)) return {}; + return filters.reduce((acc, filter) => { + if (filter.value && Array.isArray(filter.value)) { + filter.value.forEach((v) => { + if (v.id && filter.filterType) { + acc[v.id] = filter.filterType; + } + }); + } + return acc; + }, {}); + }, [filters]); + + const [columnVisibility, setColumnVisibility] = useState(initialColumnVisibility); + const [configuredSimpleColumns, setConfiguredSimpleColumns] = useState(simpleColumns); + const [usedData, setUsedData] = useState(data); + const [usedColumns, setUsedColumns] = useState([]); + const [offcanvasVisible, setOffcanvasVisible] = useState(false); + const [offCanvasData, setOffCanvasData] = useState({}); + const [offCanvasRowIndex, setOffCanvasRowIndex] = useState(0); + const [filteredRows, setFilteredRows] = useState([]); + const [customComponentData, setCustomComponentData] = useState({}); + const [customComponentVisible, setCustomComponentVisible] = useState(false); + const [actionData, setActionData] = useState({ data: {}, action: {}, ready: false }); + const [rowActionQueueIds, setRowActionQueueIds] = useState([]); + const [graphFilterData, setGraphFilterData] = useState({}); + const [sorting, setSorting] = useState([]); + const [columnFilters, setColumnFilters] = useState(() => { + if (initialColumnFilters && Array.isArray(initialColumnFilters) && initialColumnFilters.length > 0) { + return initialColumnFilters; + } + // Stories and callers pass a column-filter list ({ id, value }) through `filters`. + // Preset menus use filterName, so those stay out of the initial filter state. + if ( + Array.isArray(filters) && + filters.length > 0 && + filters.every((filter) => filter?.id && !filter.filterName && !Array.isArray(filter.value)) + ) { + return filters; + } + return []; + }); + const [cardSearchInput, setCardSearchInput] = useState(""); + const [debouncedCardSearchTerm, setDebouncedCardSearchTerm] = useState(""); + const waitingBool = api?.url ? true : false; + + const settings = useSettings(); + const prevSchemaKeyRef = useRef(""); + const prevDataRef = useRef(data); + const theme = useTheme(); + const router = useRouter(); + const isMobile = useMediaQuery(theme.breakpoints.down("sm")); + const isTablet = useMediaQuery(theme.breakpoints.down("md")); + + // Merge cardConfig and mobileCardConfig (cardConfig takes precedence) + const effectiveCardConfig = cardConfig || mobileCardConfig; + const lastOrderedSelectionRef = useRef(null); + + // The cards branch and the renderTopToolbar branch are two alternating CIPPTableToptoolbar + // instances (only one is ever mounted), so state that must survive the cards<->table flip + // lives here and is passed down as props to both. + const [activeFilters, setActiveFilters] = useState({ graph: null, table: null }); + const [searchValue, setSearchValue] = useState(""); + const restoredFiltersRef = useRef(new Set()); + const searchFocusRef = useRef(null); + + const routerPageName = router.pathname.split("/").slice(1).join("/"); + const pageName = persistenceKey ?? (isInDialog ? "" : routerPageName); // The user's saved column selection for this page. Always layered over a full default // map, never used as the whole visibility state: TanStack treats a column with no entry // as visible, so a preference saved on a tenant whose data lacked a field would reveal // that field the moment another tenant's data contains it. const preferredColumnVisibility = pageName ? settings?.columnDefaults?.[pageName] - : undefined + : undefined; // 'cards' below the md breakpoint (or when forced via settings/prop), 'table' otherwise. // simple tables always resolve to 'table'. - const resolvedViewMode = useTableViewMode({ viewMode: viewModeProp, simple }) + const resolvedViewMode = useTableViewMode({ viewMode: viewModeProp, simple }); // same pivot as the cards/table auto mode, so the FAB and the card list agree on width - const isNarrowViewport = useIsNarrowForTables() + const isNarrowViewport = useIsNarrowForTables(); // viewMode prop or simple is a hard force, the toggle never overrides it - const toggleAllowed = !viewModeProp && !simple + const toggleAllowed = !viewModeProp && !simple; // Mobile select mode: checkboxes on cards + the bottom bulk bar. Lives here so the // toolbar (which renders the Select toggle) and the card list stay in sync. Picker // tables (onChange) force it on — selection is their entire purpose. - const [mobileSelectMode, setMobileSelectMode] = useState(false) + const [mobileSelectMode, setMobileSelectMode] = useState(false); // portal target for the header's bulk-actions slot, set by the CardHeader's ref callback - const [headerBulkSlot, setHeaderBulkSlot] = useState(null) + const [headerBulkSlot, setHeaderBulkSlot] = useState(null); // transient cards<->table override, session-only, never persisted - const [viewOverride, setViewOverride] = useState(null) - const effectiveViewMode = toggleAllowed ? (viewOverride ?? resolvedViewMode) : resolvedViewMode - const isCardView = effectiveViewMode === 'cards' - const tableViewActive = effectiveViewMode === 'table' - const CardViewSurface = noCard ? Box : Card - const [narrowTableMaxHeight, setNarrowTableMaxHeight] = useState(null) + const [viewOverride, setViewOverride] = useState(null); + const effectiveViewMode = toggleAllowed ? viewOverride ?? resolvedViewMode : resolvedViewMode; + const isCardView = effectiveViewMode === "cards"; + const tableViewActive = effectiveViewMode === "table"; + const CardViewSurface = noCard ? Box : Card; + const [narrowTableMaxHeight, setNarrowTableMaxHeight] = useState(null); // way back button: table is only up because of the override, phone default is still cards - const showReturnToCards = toggleAllowed && tableViewActive && resolvedViewMode === 'cards' + const showReturnToCards = toggleAllowed && tableViewActive && resolvedViewMode === "cards"; + + // Generate storage key for view mode preference + const viewModeStorageKey = + viewModeStorageKeyOverride || `cipp-view-mode-${router.pathname}`; + + // Initialize view mode from localStorage or default + const [viewMode, setViewMode] = useState(() => { + if (typeof window !== 'undefined') { + const stored = localStorage.getItem(viewModeStorageKey); + if (stored === 'cards' || stored === 'table') { + return stored; + } + } + return defaultViewMode; + }); + + // Persist view mode to localStorage + const handleViewModeChange = useCallback((newMode) => { + if (newMode && (newMode === 'cards' || newMode === 'table')) { + setViewMode(newMode); + if (typeof window !== 'undefined') { + localStorage.setItem(viewModeStorageKey, newMode); + } + } + }, [viewModeStorageKey]); + + // Debounce card search to avoid filtering on every keystroke + useEffect(() => { + const timer = setTimeout(() => { + setDebouncedCardSearchTerm(cardSearchInput); + }, 200); + return () => clearTimeout(timer); + }, [cardSearchInput]); + - // Hook to trigger re-render when license backfill completes - const { updateTrigger } = useLicenseBackfill() + // Determine if we should show card view + // On mobile: always show cards if config exists + // On desktop: respect viewMode setting + const showCardView = effectiveCardConfig && (isMobile || viewMode === 'cards'); + + // Legacy alias for backward compatibility + const showMobileCardView = isMobile && effectiveCardConfig; - // Ref to track previous schema key so we only recompute columns when the data shape changes. - const prevSchemaKeyRef = useRef('') - // Ref to track previous data reference for the static-data sync effect. - const prevDataRef = useRef(data) + // Compute effective query key - used consistently for fetching and cache invalidation + const effectiveQueryKey = queryKey ? queryKey : title; const getRequestData = ApiGetCallWithPagination({ url: api.url, data: { ...api.data }, - queryKey: queryKey ? queryKey : title, + queryKey: effectiveQueryKey, waiting: waitingBool, ...graphFilterData, - }) + }); - useEffect(() => { - // Only set initial filters if they haven't been set yet OR if the filters prop has actually changed - const filtersChanged = !isEqual(filters, previousFiltersRef.current) + // Note: The `filters` prop contains filter OPTIONS for the dropdown menu, not active filters. + // Active filters are applied via setTableFilter in CIPPTableToptoolbar when user selects a filter. + // Do NOT auto-apply filters here as it breaks filtering functionality. - if ( - filters && - Array.isArray(filters) && - filters.length > 0 && - (!filtersInitializedRef.current || filtersChanged) - ) { - // Only auto-apply filters that are in MRT column-filter format ({ id, value }). - // Preset objects ({ filterName, value, type }) are toolbar buttons only — applying them - // directly sets id=undefined which causes MRT to throw. - const columnFormatFilters = filters.filter((f) => f.id !== undefined) - - if (columnFormatFilters.length > 0) { - const processedFilters = columnFormatFilters.map((filter) => { - if (filter.filterType === 'equal') { - return { - ...filter, - value: Array.isArray(filter.value) - ? filter.value - : [filter.value], - } - } - return filter - }) - setColumnFilters(processedFilters) - } - - filtersInitializedRef.current = true - previousFiltersRef.current = filters + useEffect(() => { + if (Array.isArray(data) && !api?.url && data !== prevDataRef.current) { + prevDataRef.current = data; + setUsedData(data); } - }, [filters]) + }, [data, api?.url]); - // Sync static data prop into usedData (only when not using API). - // We avoid including usedData in the dependency array to prevent the expensive - // isEqual check from running on every API-driven data change. + // Auto-pagination: automatically fetch all pages for table view. + // For card view, we use lazy loading instead - only fetch when user needs more data. useEffect(() => { - if (Array.isArray(data) && !api?.url) { - // Only update if the data prop reference actually changed. - if (data !== prevDataRef.current) { - prevDataRef.current = data - setUsedData(data) - } + // Skip auto-pagination when in card view mode - CardView handles its own pagination + if (showCardView) { + return; + } + + // Stop auto-paginating if a page fetch errored. A failed page is NOT appended + // to data.pages, so the last *successful* page still carries its nextLink. Without + // this guard the effect would call fetchNextPage() again on every render, retrying + // the failing page forever. On large tenants (tens of thousands of users paged 999 + // at a time) Graph throttling/timeouts make such failures likely, which is what + // leaves the refresh indicator spinning and the list never finishing loading. + if (getRequestData.isError || getRequestData.isFetchNextPageError) { + return; } - }, [data, api?.url]) - useEffect(() => { if (api?.url && getRequestData.isSuccess && !getRequestData.isFetching) { - const lastPage = - getRequestData.data?.pages[getRequestData.data.pages.length - 1] - const nextLinkExists = lastPage?.Metadata?.nextLink - if (nextLinkExists) { - getRequestData.fetchNextPage() + const pages = getRequestData.data?.pages; + if (pages && pages.length > 0) { + const lastPage = pages[pages.length - 1]; + const nextLinkExists = lastPage?.Metadata?.nextLink; + if (nextLinkExists) { + getRequestData.fetchNextPage(); + } } } - }, [api?.url, getRequestData.data?.pages?.length, getRequestData.isFetching, queryKey]) + // Keyed to the specific request-state fields that should drive pagination. The + // `getRequestData` object is a new reference every render, so depending on it + // directly would re-run (and re-fetch) on every render. + // eslint-disable-next-line react-hooks/exhaustive-deps + }, [ + api?.url, + getRequestData.data?.pages?.length, + getRequestData.isFetching, + getRequestData.isError, + getRequestData.isFetchNextPageError, + queryKey, + showCardView, + ]); useEffect(() => { - if (api?.url && getRequestData.isSuccess) { - const allPages = getRequestData.data.pages + if (api?.url && getRequestData.isSuccess && getRequestData.data?.pages) { + const allPages = getRequestData.data.pages; - const combinedResults = allPages.flatMap((page) => { - const nestedData = getNestedValue(page, api.dataKey) + let combinedResults = allPages.flatMap((page) => { + const nestedData = getNestedValue(page, api.dataKey); if (nestedData !== undefined) { - return nestedData + return nestedData; } // dataKey miss on a bare-array page: the endpoint served the legacy shape. - return Array.isArray(page) ? page : [] - }) - const filtered = dataFilter - ? combinedResults.filter(dataFilter) - : combinedResults + return Array.isArray(page) ? page : []; + }); + + // Deduplicate across paginated pages. Microsoft Graph (and other + // cursor-paginated APIs) can return the same record in adjacent pages + // when ordering by a non-unique field (e.g. $orderby=displayName) or + // when the underlying data shifts during pagination. Without this, + // duplicates appear in both the card and table views. + if (Array.isArray(combinedResults) && combinedResults.length > 1) { + const seen = new Set(); + const deduped = []; + let hadDuplicates = false; + for (const item of combinedResults) { + if (!item || typeof item !== "object") { + deduped.push(item); + continue; + } + const dedupKey = item.id ?? item.RowKey ?? null; + if (dedupKey === null || dedupKey === undefined || dedupKey === "") { + deduped.push(item); + continue; + } + const compositeKey = `${typeof dedupKey}:${dedupKey}`; + if (seen.has(compositeKey)) { + hadDuplicates = true; + continue; + } + seen.add(compositeKey); + deduped.push(item); + } + if (hadDuplicates) { + combinedResults = deduped; + } + } + + // Apply dataFilter if provided in api config + if (api.dataFilter && typeof api.dataFilter === "function") { + combinedResults = api.dataFilter(combinedResults); + } + + const filtered = dataFilter ? combinedResults.filter(dataFilter) : combinedResults; const mapped = - typeof dataMap === 'function' + typeof dataMap === "function" ? filtered.map((row) => dataMap(row, { parentRow })) - : filtered - setUsedData(typeof dataTransform === 'function' ? dataTransform(mapped) : mapped) + : filtered; + const transformed = + typeof dataTransform === "function" ? dataTransform(mapped) : mapped; + + // Only update state if data has actually changed to prevent infinite re-renders. + // React Query returns a new object reference on every fetch even if data is identical, + // so we must deep-compare before updating state. + setUsedData((prevData) => { + if (isEqual(prevData, transformed)) { + return prevData; + } + return transformed; + }); } + // Keyed to the specific api fields actually used (dataKey/dataFilter) plus the + // request status. The `api` object itself is re-created every render by the parent, + // so depending on it would re-run this dedupe pass needlessly each render. + // eslint-disable-next-line react-hooks/exhaustive-deps }, [ api?.url, getRequestData.isSuccess, getRequestData.data, api.dataKey, + api.dataFilter, getRequestData.isFetching, queryKey, dataFilter, dataMap, dataTransform, parentRow, - ]) + ]); // Derive columns from data — only when the data schema actually changes. useEffect(() => { if ( !Array.isArray(usedData) || usedData.length === 0 || - typeof usedData[0] !== 'object' || + typeof usedData[0] !== "object" || usedData === null || usedData === undefined ) { - return + return; } - const schemaKey = computeSchemaKey(usedData) - // Skip expensive column generation if the schema hasn't changed. + const schemaKey = computeSchemaKey(usedData); if (schemaKey === prevSchemaKeyRef.current && usedColumns.length > 0) { - return + return; } - prevSchemaKeyRef.current = schemaKey + prevSchemaKeyRef.current = schemaKey; - const apiColumns = utilColumnsFromAPI(usedData) + const apiColumns = utilColumnsFromAPI(usedData); // Apply custom filterFn to columns that have filterType === 'equal' const enhancedApiColumns = apiColumns.map((col) => { - if (filterTypeMap[col.id] === 'equal') { + const colKey = getColumnKey(col); + if (colKey && filterTypeMap[colKey] === "equal") { return { ...col, - filterFn: 'equals', - } + filterFn: "equals", + }; } - return col - }) + return col; + }); - let finalColumns = [] - let newVisibility = { ...columnVisibility } + let finalColumns = []; + let newVisibility = { ...columnVisibility }; // Check if we're in AllTenants mode and data has Tenant property - const isAllTenants = settings?.currentTenant === 'AllTenants' + const isAllTenants = settings?.currentTenant === "AllTenants"; const hasTenantProperty = usedData.some( - (row) => row && typeof row === 'object' && 'Tenant' in row - ) - const shouldShowTenant = isAllTenants && hasTenantProperty + (row) => row && typeof row === "object" && "Tenant" in row, + ); + const shouldShowTenant = isAllTenants && hasTenantProperty; if (columns.length === 0 && configuredSimpleColumns.length === 0) { - finalColumns = enhancedApiColumns + finalColumns = enhancedApiColumns; enhancedApiColumns.forEach((col) => { - newVisibility[col.id] = true - }) + const colKey = getColumnKey(col); + if (colKey) { + newVisibility[colKey] = true; + } + }); } else if (configuredSimpleColumns.length > 0) { // Resolve any variables in the simple columns before checking visibility const resolvedSimpleColumns = resolveSubTableSimpleColumns( - resolveSimpleColumnVariables( - configuredSimpleColumns, - usedData - ), + resolveSimpleColumnVariables(configuredSimpleColumns, usedData), subTables, usedData - ) + ); // Add Tenant to resolved columns if in AllTenants mode and not already included - let finalResolvedColumns = [...resolvedSimpleColumns] - if (shouldShowTenant && !resolvedSimpleColumns.includes('Tenant')) { - finalResolvedColumns = [...resolvedSimpleColumns, 'Tenant'] + let finalResolvedColumns = [...resolvedSimpleColumns]; + if (shouldShowTenant && !resolvedSimpleColumns.includes("Tenant")) { + finalResolvedColumns = [...resolvedSimpleColumns, "Tenant"]; } - finalColumns = enhancedApiColumns + finalColumns = enhancedApiColumns; finalColumns.forEach((col) => { - if (col.id !== undefined) { - newVisibility[col.id] = finalResolvedColumns.includes(col.id) + const colKey = getColumnKey(col); + if (colKey) { + newVisibility[colKey] = finalResolvedColumns.includes(colKey); } - }) + }); // Selection order wins over data-key order — but only when the resolved selection // changed (including subTable cachedColumn swaps), so a data refetch doesn't // stomp a manual column reorder. - const resolvedOrderKey = finalResolvedColumns.join('|') + const resolvedOrderKey = finalResolvedColumns.join("|"); if (lastOrderedSelectionRef.current !== resolvedOrderKey) { - lastOrderedSelectionRef.current = resolvedOrderKey - const subTableIds = getSubTableDisplayColumnIds( - subTables, - configuredSimpleColumns, - usedData - ) + lastOrderedSelectionRef.current = resolvedOrderKey; + const subTableIds = getSubTableDisplayColumnIds(subTables, configuredSimpleColumns, usedData); const allIds = [ - ...new Set([ - ...finalColumns.map((col) => col.id).filter(Boolean), - ...subTableIds, - ]), - ] - setColumnOrder(orderColumnsBySelection(allIds, finalResolvedColumns)) + ...new Set([...finalColumns.map((col) => col.id).filter(Boolean), ...subTableIds]), + ]; + table.setColumnOrder(orderColumnsBySelection(allIds, finalResolvedColumns)); } } else { const providedColumnKeys = new Set( - columns.map((col) => col.id || col.header) - ) + columns.map((col) => getColumnKey(col) || col.header).filter(Boolean), + ); finalColumns = [ ...columns, - ...enhancedApiColumns.filter((col) => !providedColumnKeys.has(col.id)), - ] + ...enhancedApiColumns.filter((col) => !providedColumnKeys.has(getColumnKey(col))), + ]; finalColumns.forEach((col) => { - const key = col.id ?? col.accessorKey - if (key !== undefined) { - newVisibility[key] = providedColumnKeys.has(col.id) + const colKey = getColumnKey(col); + if (colKey) { + newVisibility[colKey] = providedColumnKeys.has(colKey); } - }) + }); // Handle Tenant column for custom columns case if (shouldShowTenant) { - const tenantColumn = finalColumns.find((col) => col.id === 'Tenant') + const tenantColumn = finalColumns.find((col) => col.id === "Tenant"); if (tenantColumn) { // Make tenant visible - newVisibility['Tenant'] = true + newVisibility["Tenant"] = true; } } } @@ -1017,10 +2489,15 @@ export const CippDataTable = (props) => { Object.assign(newVisibility, preferredColumnVisibility) } if (defaultSorting?.length > 0) { - setSorting(defaultSorting) + setSorting(defaultSorting); } - setUsedColumns(finalColumns) - setColumnVisibility(newVisibility) + setUsedColumns(finalColumns); + setColumnVisibility(newVisibility); + // Intentionally rebuilds columns only when the data schema/tenant/query changes + // (guarded above by schemaKey). columnVisibility/columns/configuredSimpleColumns/ + // defaultSorting are read as the latest values but are deliberately not triggers: + // this effect sets columnVisibility, so depending on it would risk a rebuild loop. + // eslint-disable-next-line react-hooks/exhaustive-deps }, [ columns.length, usedData, @@ -1029,49 +2506,49 @@ export const CippDataTable = (props) => { filterTypeMap, subTables, preferredColumnVisibility, - ]) + ]); // Previous-value refs for the guards below: CippDataTable is the single owner of this // state across both toolbar instances, so an effect can compare against the last value // it actually saw rather than firing unconditionally on every render. - const prevTenantRef = useRef(settings?.currentTenant) - const prevQueryKeyRef = useRef(queryKey || title) - const prevPageNameRef = useRef(pageName) - const appliedColumnDefaultsRef = useRef({}) + const prevTenantRef = useRef(settings?.currentTenant); + const prevQueryKeyRef = useRef(queryKey || title); + const prevPageNameRef = useRef(pageName); + const appliedColumnDefaultsRef = useRef({}); // if the currentTenant switches, remove graph filters and the active-filter highlight useEffect(() => { - const currentTenant = settings?.currentTenant + const currentTenant = settings?.currentTenant; if (prevTenantRef.current === currentTenant) { - return + return; } - prevTenantRef.current = currentTenant + prevTenantRef.current = currentTenant; if (currentTenant) { - setGraphFilterData({}) - setActiveFilters({ graph: null, table: null }) - restoredFiltersRef.current.delete(`${pageName}-graph`) + setGraphFilterData({}); + setActiveFilters({ graph: null, table: null }); + restoredFiltersRef.current.delete(`${pageName}-graph`); } - }, [settings?.currentTenant, pageName]) + }, [settings?.currentTenant, pageName]); // clear the active-filter highlight when the effective query key changes (tenant swap, // different queryKey/title) useEffect(() => { - const effectiveKey = queryKey || title + const effectiveKey = queryKey || title; if (prevQueryKeyRef.current === effectiveKey) { - return + return; } - prevQueryKeyRef.current = effectiveKey - setActiveFilters({ graph: null, table: null }) - }, [queryKey, title]) + prevQueryKeyRef.current = effectiveKey; + setActiveFilters({ graph: null, table: null }); + }, [queryKey, title]); // clear persisted-filter restoration tracking only when the page actually changes useEffect(() => { if (prevPageNameRef.current === pageName) { - return + return; } - prevPageNameRef.current = pageName - restoredFiltersRef.current.clear() - }, [pageName]) + prevPageNameRef.current = pageName; + restoredFiltersRef.current.clear(); + }, [pageName]); // apply preferred columns once per page, and again whenever the saved preference's // identity changes. Nested dialog tables must not read or write the parent page key. @@ -1080,25 +2557,24 @@ export const CippDataTable = (props) => { // the defaults just computed for every field the preference does not mention. useEffect(() => { if (!pageName) { - return + return; } - const preferred = preferredColumnVisibility + const preferred = preferredColumnVisibility; if ( preferred && Object.keys(preferred).length > 0 && appliedColumnDefaultsRef.current[pageName] !== preferred ) { - appliedColumnDefaultsRef.current[pageName] = preferred - setColumnVisibility((previous) => ({ ...previous, ...preferred })) + appliedColumnDefaultsRef.current[pageName] = preferred; + setColumnVisibility((previous) => ({ ...previous, ...preferred })); } - }, [preferredColumnVisibility, pageName]) + }, [preferredColumnVisibility, pageName]); - const createDialog = useDialog() - const hasActions = !!actions - const hasOffCanvas = !!offCanvas - const hasOnChange = !!onChange + const createDialog = useDialog(); + const hasActions = !!actions; + const hasOffCanvas = !!offCanvas; + const hasOnChange = !!onChange; - // Compute modeInfo via useMemo so it stays stable but updates when relevant inputs change. const modeInfo = useMemo( () => utilTableMode( @@ -1111,9 +2587,12 @@ export const CippDataTable = (props) => { maxHeightOffset, settings, effectiveViewMode, - isNarrowViewport, - exportEnabled + isNarrowViewport ), + // Intentionally keyed to stable boolean proxies (hasActions/hasOffCanvas/hasOnChange) + // and the page-size setting rather than the raw actions/offCanvas/onChange/settings + // objects, which are re-created every render and would defeat this memo. + // eslint-disable-next-line react-hooks/exhaustive-deps [ simple, hasActions, @@ -1123,27 +2602,30 @@ export const CippDataTable = (props) => { settings?.tablePageSize?.value, effectiveViewMode, isNarrowViewport, - exportEnabled, ] - ) + ); + const memoizedColumns = useMemo(() => usedColumns, [usedColumns]); // Include updateTrigger in data memo to force re-render when license backfill completes. // Also refresh data identity when derived columns change so TanStack re-runs filtering // for searches entered before columns are available. const memoizedData = useMemo( () => (Array.isArray(usedData) ? usedData.slice() : usedData), + // updateTrigger and usedColumns are intentional cache-busters (license backfill + // completion + derived-column changes) even though they aren't read in the callback. + // eslint-disable-next-line react-hooks/exhaustive-deps [usedData, updateTrigger, usedColumns] - ) + ); - // Sanitize columnVisibility to remove any undefined/invalid keys before passing to MRT const sanitizedColumnVisibility = useMemo(() => { - const result = {} + const result = {}; for (const key of Object.keys(columnVisibility)) { - if (key !== 'undefined' && key !== undefined) - result[key] = columnVisibility[key] + if (key !== "undefined" && key !== undefined) { + result[key] = columnVisibility[key]; + } } - return result - }, [columnVisibility]) + return result; + }, [columnVisibility]); const displayColumns = useMemo(() => { if (!Array.isArray(subTables) || subTables.length === 0) { @@ -1151,9 +2633,6 @@ export const CippDataTable = (props) => { } const cachedHeaders = new Map() const injected = [] - const excludedIds = new Set( - getInactiveSubTableColumnIds(subTables, configuredSimpleColumns, usedData) - ) for (const sub of subTables) { if (!subTableIsSelected(sub, configuredSimpleColumns)) { continue @@ -1167,85 +2646,15 @@ export const CippDataTable = (props) => { const columns = cachedHeaders.size ? usedColumns.map((col) => cachedHeaders.has(col.id) - ? { ...col, header: cachedHeaders.get(col.id) } - : col - ) - : usedColumns - const injectedById = new Map(injected.map((col) => [col.id, col])) - const replaced = columns.map((col) => injectedById.get(col.id) ?? col) - const existing = new Set(columns.map((col) => col.id)) - return [...replaced, ...injected.filter((col) => !existing.has(col.id))].filter( - (col) => !excludedIds.has(col.id) - ) - }, [usedColumns, usedData, subTables, configuredSimpleColumns]) - - const displayColumnIds = useMemo( - () => displayColumns.map((col) => col.id).filter(Boolean), - [displayColumns] - ) - - // The default filter-mode name for every currently-displayed column (see - // resolveColumnFilterFnName above). Recomputed whenever the column set changes so newly - // arrived columns get a mode name without waiting on a user click. - const derivedColumnFilterFns = useMemo(() => { - const map = {} - for (const col of displayColumns) { - const id = col.id ?? getColumnId(col) - if (id) { - map[id] = resolveColumnFilterFnName(col) - } - } - return map - }, [displayColumns]) - - // Seed columnFilterFns for ids that don't have one yet — a user-picked mode (from the - // filter-mode menu, via onColumnFilterFnsChange below) is never overwritten here. - useEffect(() => { - setColumnFilterFns((prev) => { - let changed = false - const next = { ...prev } - for (const [id, fn] of Object.entries(derivedColumnFilterFns)) { - if (next[id] === undefined) { - next[id] = fn - changed = true - } - } - return changed ? next : prev - }) - }, [derivedColumnFilterFns]) - - // Remount MRT when the visible column identity set changes (cache↔live). MRT's - // column virtualizer memoizes pinned indexes without depending on column count; - // without a remount, TableHeadRow maps a sparse virtual item and reads `.index` - // on undefined. - const mrtColumnSetKey = useMemo(() => displayColumnIds.join('|'), [displayColumnIds]) - - const preferredColumnOrderIds = useMemo( - () => - resolveSubTableSimpleColumns( - configuredSimpleColumns, - subTables, - usedData - ).filter((id) => displayColumnIds.includes(id)), - [configuredSimpleColumns, subTables, usedData, displayColumnIds] - ) - - // Same-render sanitize: toggling ReportDB cache↔live swaps membersCsv↔members (and - // drops CacheTimestamp). MRT column virtualization reads virtualItem.index during - // render and throws if columnOrder still names the old ids ("can't access property - // index, e is undefined" in Firefox). A useEffect setColumnOrder runs too late. - const safeColumnOrder = useMemo( - () => - sanitizeColumnOrder(columnOrder, displayColumnIds, preferredColumnOrderIds), - [columnOrder, displayColumnIds, preferredColumnOrderIds] - ) - - useEffect(() => { - if (safeColumnOrder === columnOrder) { - return - } - setColumnOrder(safeColumnOrder) - }, [safeColumnOrder, columnOrder]) + ? { ...col, header: cachedHeaders.get(col.id) } + : col + ) + : usedColumns + const injectedById = new Map(injected.map((col) => [col.id, col])) + const replaced = columns.map((col) => injectedById.get(col.id) ?? col) + const existing = new Set(columns.map((col) => col.id)) + return [...replaced, ...injected.filter((col) => !existing.has(col.id))] + }, [usedColumns, usedData, subTables, configuredSimpleColumns]) useEffect(() => { if (!Array.isArray(subTables) || subTables.length === 0) { @@ -1273,90 +2682,74 @@ export const CippDataTable = (props) => { const handleActionDisabled = useCallback((row, action) => { const actionRow = attachParentRow(row, parentRow) if (action?.condition) { - return !action.condition(actionRow) + return !action.condition(actionRow); } - return false - }, [parentRow]) + return false; + }, [parentRow]); const getActionRow = useCallback( (rowOriginal) => attachParentRow(rowOriginal, parentRow), [parentRow] - ) + ); - // Stable callback for sorting changes. const handleSortingChange = useCallback((newSorting) => { - setSorting(newSorting ?? []) - }, []) + setSorting(newSorting ?? []); + }, []); - // Stable callback for muiTablePaperProps. - const muiTablePaperProps = useCallback( + const muiTablePaperPropsCallback = useCallback( ({ table }) => ({ sx: { ...(table.getState().isFullScreen && { - position: 'fixed !important', - top: '64px !important', - bottom: '0 !important', + position: "fixed !important", + top: "64px !important", + bottom: "0 !important", left: { - xs: '0 !important', - lg: settings?.sidebarCollapse - ? '73px !important' - : '270px !important', + xs: "0 !important", + lg: settings?.sidebarCollapse ? "73px !important" : "270px !important", }, - right: '0 !important', - zIndex: '1300 !important', - m: '0 !important', - p: '16px !important', - overflow: 'auto', - bgcolor: 'background.paper', - maxWidth: 'none !important', - width: 'auto !important', - height: 'auto !important', + right: "0 !important", + zIndex: "1300 !important", + m: "0 !important", + p: "16px !important", + overflow: "auto", + bgcolor: "background.paper", + maxWidth: "none !important", + width: "auto !important", + height: "auto !important", }), }, }), - [settings?.sidebarCollapse] - ) + [settings?.sidebarCollapse], + ); - // Memoize the empty-rows fallback renderer. - const queueMessage = getRequestData.data?.pages?.[0]?.Metadata?.QueueMessage - const renderEmptyRowsFallback = useCallback( - ({ table }) => + const queueMessage = getRequestData.data?.pages?.[0]?.Metadata?.QueueMessage; + const renderEmptyRowsFallbackCallback = useCallback( + () => queueMessage ? (
      - {queueMessage} + {queueMessage}
      ) : undefined, - [queueMessage] - ) + [queueMessage], + ); - // Compute the skeletons state value. const showSkeletons = getRequestData.isFetchingNextPage ? false : getRequestData.isFetching ? getRequestData.isFetching - : isFetching + : isFetching; - // Memoize state object to avoid creating a new reference every render when values haven't changed. const tableState = useMemo( () => ({ columnVisibility: sanitizedColumnVisibility, - columnOrder: safeColumnOrder, sorting, columnFilters, - columnFilterFns, showSkeletons, }), - [ - sanitizedColumnVisibility, - safeColumnOrder, - sorting, - columnFilters, - columnFilterFns, - showSkeletons, - ] - ) + [sanitizedColumnVisibility, sorting, columnFilters, showSkeletons], + ); // Single row-action dispatch used by BOTH the desktop row menu and the mobile action // sheet — the two presentations must not drift. @@ -1407,193 +2800,13 @@ export const CippDataTable = (props) => { // position taken from it stops matching the list the moment a column is sorted. const openRowOffCanvas = useCallback((rowOriginal) => { setOffCanvasData(rowOriginal) - setContextRow(rowOriginal) const navigable = table.getSortedRowModel().rows - const indexInList = navigable.findIndex((r) => - rowsMatchContext(r.original, rowOriginal) - ) + const indexInList = navigable.findIndex((r) => r.original === rowOriginal) setOffCanvasRowIndex(indexInList >= 0 ? indexInList : 0) setOffcanvasVisible(true) // eslint-disable-next-line react-hooks/exhaustive-deps }, []) - const closeRowOffCanvas = useCallback(() => { - setOffcanvasVisible(false) - setContextRow(null) - }, []) - - const handleRowOpenNewTab = useCallback( - (rowOriginal) => { - const actionRow = getActionRow(rowOriginal) - const tenant = getRowTenant(actionRow, settings.currentTenant) - const rowTenant = - tenant && tenant !== 'AllTenants' ? tenant : undefined - const dispatchOptions = { - fallbackTenant: rowTenant, - currentTenant: settings.currentTenant, - newTab: true, - } - if (!rowOpenSupportsNewTab(rowOpen, actionRow, dispatchOptions)) { - return - } - dispatchRowOpen(rowOpen, actionRow, router, dispatchOptions) - }, - [rowOpen, getActionRow, settings, router] - ) - - const closeRowContextMenu = useCallback(() => { - setRowContextMenu(null) - }, []) - - const getRowOpenDispatchOptions = useCallback( - (rowOriginal) => { - const actionRow = getActionRow(rowOriginal) - const tenant = getRowTenant(actionRow, settings.currentTenant) - const rowTenant = - tenant && tenant !== 'AllTenants' ? tenant : undefined - return { - actionRow, - rowTenant, - dispatchOptions: { - fallbackTenant: rowTenant, - currentTenant: settings.currentTenant, - }, - } - }, - [getActionRow, settings] - ) - - const getRowMenuActions = useCallback( - (rowOriginal) => { - const { actionRow, dispatchOptions } = - getRowOpenDispatchOptions(rowOriginal) - const visible = filterVisibleRowActions(actions, actionRow) - const { pinnedActions, menuActions } = partitionRowMenuActions(visible) - return { pinnedActions, menuActions, actionRow, dispatchOptions } - }, - [actions, rowOpen, getRowOpenDispatchOptions] - ) - - // Desktop: middle-click or Ctrl/Cmd+click opens the resolved rowOpen href in a new - // tab; right-click opens the row context menu. Plain clicks only act on pages that - // opt in with offCanvasOnRowClick, where a single click opens the extended-info - // offcanvas. That preview is also in the context menu, the row ⋮ menu, and mobile tap. - const muiTableBodyRowProps = useMemo(() => { - const newTabOpen = Boolean(rowOpen?.link || rowOpen?.onOpen) - const clickOpensOffCanvas = Boolean(offCanvasOnRowClick && offCanvas) - const hasContextMenu = Boolean( - (actions && actions.length > 0) || offCanvas || newTabOpen - ) - - if (!hasContextMenu && !newTabOpen && !clickOpensOffCanvas) { - return undefined - } - - return ({ row }) => { - const actionRow = getActionRow(row.original) - const canOpen = newTabOpen && rowOpenEnabled(rowOpen, actionRow) - const isContextRow = - Boolean(offCanvas) && rowsMatchContext(contextRow, row.original) - - const rowProps = { - onContextMenu: (event) => { - if (!hasContextMenu) { - return - } - if (isRowClickTarget(event) || hasTextSelection()) { - return - } - event.preventDefault() - setRowContextMenu({ - mouseX: event.clientX + 2, - mouseY: event.clientY - 6, - rowOriginal: row.original, - }) - }, - sx: { - cursor: clickOpensOffCanvas ? 'pointer' : undefined, - borderLeft: (theme) => - isContextRow - ? `3px solid ${theme.palette.primary.main}` - : '3px solid transparent', - ...(isContextRow && { - bgcolor: (theme) => - alpha( - theme.palette.primary.main, - theme.palette.mode === 'dark' ? 0.14 : 0.08 - ), - '&:hover': { - bgcolor: (theme) => - alpha( - theme.palette.primary.main, - theme.palette.mode === 'dark' ? 0.22 : 0.12 - ), - }, - }), - ...(!isContextRow && { - '&:hover': { - backgroundColor: 'action.hover', - }, - }), - }, - } - - if (newTabOpen || clickOpensOffCanvas) { - Object.assign(rowProps, { - onMouseDown: (event) => { - if (isRowClickTarget(event)) { - return - } - if (event.button === 1) { - event.preventDefault() - } - rowClickStartRef.current = { x: event.clientX, y: event.clientY } - }, - onClick: (event) => { - if (isRowClickTarget(event)) { - return - } - if (event.ctrlKey || event.metaKey) { - if (canOpen) { - event.preventDefault() - handleRowOpenNewTab(row.original) - } - return - } - if (!clickOpensOffCanvas) { - return - } - if ( - isRowTextInteraction(rowClickStartRef.current, event) || - hasTextSelection() - ) { - return - } - openRowOffCanvas(row.original) - }, - onAuxClick: (event) => { - if (event.button !== 1 || isRowClickTarget(event) || !canOpen) { - return - } - event.preventDefault() - handleRowOpenNewTab(row.original) - }, - }) - } - - return rowProps - } - }, [ - offCanvas, - offCanvasOnRowClick, - rowOpen, - actions, - contextRow, - getActionRow, - handleRowOpenNewTab, - openRowOffCanvas, - ]) - // the flipped table shows whatever columns are visible; horizontal scroll covers the width const cardViewSurfaceRef = useRef(null) const handleViewToggle = useCallback(() => { @@ -1604,178 +2817,271 @@ export const CippDataTable = (props) => { } }, [effectiveViewMode, isNarrowViewport]) - // Memoize renderRowActionMenuItems to avoid re-creating on each render. - const renderRowActionMenuItems = useMemo(() => { - if (actions) { - return ({ closeMenu, row }) => { - const { actionRow } = getRowOpenDispatchOptions(row.original) - const visible = filterVisibleRowActions(actions, actionRow) - // Pinned actions stay in the order they are declared in the actions array. - const { pinnedActions, menuActions } = partitionRowMenuActions(visible) - return [ - pinnedActions.map((action, index) => ( - dispatchRowAction(action, row.original, closeMenu)} - disabled={handleActionDisabled(row.original, action)} - > - - {action.icon} - - {action.label} - - )), - menuActions.map((action, index) => ( - dispatchRowAction(action, row.original, closeMenu)} - disabled={handleActionDisabled(row.original, action)} - > - - {action.icon} - - {action.label} - - )), - offCanvas && ( + const table = useMaterialReactTable({ + layoutMode: "grid-no-grow", + enableRowVirtualization: true, + enableColumnVirtualization: true, + enableColumnResizing: true, + columnResizeMode: "onChange", + rowVirtualizerOptions: { + overscan: 5, + }, + // Enable density toggle so users can switch to compact on mobile + enableDensityToggle: true, + muiTableBodyCellProps: { + onCopy: (e) => { + const sel = window.getSelection()?.toString() ?? ""; + if (sel) { + e.preventDefault(); + e.stopPropagation(); + e.nativeEvent?.stopImmediatePropagation?.(); + e.clipboardData.setData("text/plain", sel); + if (navigator.clipboard?.writeText) { + navigator.clipboard.writeText(sel).catch(() => {}); + } + } + }, + sx: { + // Better touch targets on mobile + ...(isMobile && { + padding: '12px 8px', + fontSize: '0.875rem', + }), + }, + }, + mrtTheme: (theme) => ({ + baseBackgroundColor: theme.palette.background.paper, + }), + muiTablePaperProps: muiTablePaperPropsCallback, + muiTableBodyRowProps: + offCanvasOnRowClick && offCanvas + ? ({ row }) => { + const customSx = + typeof rowSx === "function" ? rowSx(row.original) : rowSx ? rowSx : {}; + return { + onClick: (event) => { + if ( + event.target?.closest?.( + 'button, a, input, textarea, select, [role="button"], [role="menuitem"], [data-no-row-click="true"]', + ) + ) { + return; + } + setOffCanvasData(row.original); + const filteredRowsArray = table.getFilteredRowModel().rows; + const indexInFiltered = filteredRowsArray.findIndex( + (r) => r.original === row.original, + ); + setOffCanvasRowIndex(indexInFiltered >= 0 ? indexInFiltered : 0); + setOffcanvasVisible(true); + }, + sx: { + cursor: "pointer", + "&:hover": { + backgroundColor: "action.hover", + }, + ...customSx, + }, + }; + } + : rowSx + ? ({ row }) => ({ + sx: typeof rowSx === "function" ? rowSx(row.original) : rowSx, + }) + : undefined, + // Add global styles to target the specific filter components + enableColumnFilterModes: true, + muiTableHeadCellProps: { + sx: { + // Target the filter row cells + "& .MuiTableCell-root": { + padding: "8px 16px", + }, + // Target the Autocomplete component in filter cells + "& .MuiAutocomplete-root": { + width: "100%", + }, + // Force the tags container to be single line with ellipsis + "& .MuiAutocomplete-root .MuiInputBase-root": { + height: "40px !important", + overflow: "hidden", + textOverflow: "ellipsis", + whiteSpace: "nowrap", + display: "flex", + flexWrap: "nowrap", + }, + // Target the tags container specifically + "& .MuiAutocomplete-root .MuiInputBase-root .MuiInputBase-input": { + height: "24px", + minHeight: "24px", + maxHeight: "24px", + }, + // Target regular input fields (not in Autocomplete) + "& .MuiInputBase-root": { + height: "40px !important", + }, + // Ensure all input fields have consistent styling + "& .MuiInputBase-input": { + height: "24px", + minHeight: "24px", + maxHeight: "24px", + }, + // Target the specific chip class mentioned + "& .MuiChip-label.MuiChip-labelMedium": { + maxWidth: "80px", + overflow: "hidden", + textOverflow: "ellipsis", + whiteSpace: "nowrap", + padding: "0 4px", + }, + // Make chips smaller overall and add title attribute for tooltip + "& .MuiChip-root": { + height: "24px", + maxHeight: "24px", + // This adds a tooltip effect using the browser's native tooltip + "&::before": { + content: "attr(data-label)", + display: "none", + }, + "&:hover::before": { + display: "block", + position: "absolute", + top: "-25px", + left: "0", + backgroundColor: "rgba(0, 0, 0, 0.8)", + color: "white", + padding: "4px 8px", + borderRadius: "4px", + fontSize: "12px", + whiteSpace: "nowrap", + zIndex: 9999, + }, + }, + }, + }, + // Initialize the filter chips with data attributes for tooltips + initialState: { + columnFilters: columnFilters, + columnVisibility: sanitizedColumnVisibility, + }, + columns: displayColumns, + data: memoizedData ?? EMPTY_ARRAY, + state: tableState, + onSortingChange: handleSortingChange, + onColumnFiltersChange: setColumnFilters, + renderEmptyRowsFallback: renderEmptyRowsFallbackCallback, + onColumnVisibilityChange: setColumnVisibility, + ...modeInfo, + enableRowActions: showRowActionsMenu && (actions || offCanvas) ? true : false, + renderRowActionMenuItems: actions && showRowActionsMenu + ? ({ closeMenu, row }) => { + // Group actions by category + const groupedActions = actions.reduce((acc, action) => { + const category = + typeof action.category === "string" && action.category.trim().length > 0 + ? action.category.trim() + : "Other"; + if (!acc[category]) { + acc[category] = []; + } + acc[category].push(action); + return acc; + }, {}); + + const categoryEntries = sortCategoryEntries(Object.entries(groupedActions)); + + return [ + ...categoryEntries.flatMap(([category, categoryActions], groupIndex) => { + const categoryColor = getCategoryColor(category); + const headerBgColor = categoryColor === "text.secondary" + ? (theme) => alpha(theme.palette.grey[500], 0.08) + : (theme) => alpha(resolvePaletteMainColor(theme, categoryColor), 0.08); + const headerTextColor = categoryColor === "text.secondary" + ? "text.secondary" + : (theme) => resolvePaletteMainColor(theme, categoryColor); + + return [ + + {getCategoryIcon(category)} + {getCategoryLabel(category)} + , + ...categoryActions + .filter( + (action) => + typeof action.hideCondition !== "function" || + !action.hideCondition(getActionRow(row.original)) + ) + .map((action, index) => { + const actionColor = action.color || categoryColor; + const iconSx = + actionColor === "text.secondary" + ? { minWidth: "30px", color: actionColor } + : { minWidth: "30px", color: (theme) => resolvePaletteMainColor(theme, actionColor) }; + + return ( + dispatchRowAction(action, row.original, closeMenu)} + disabled={handleActionDisabled(row.original, action)} + > + + {action.icon} + + {action.label} + + ); + }), + ]; + }), + offCanvas && ( + { + closeMenu(); + openRowOffCanvas(row.original); + }} + > + + + + More Info + + ), + ]; + } + : offCanvas + ? ({ closeMenu, row }) => [ { - closeMenu() - openRowOffCanvas(row.original) + closeMenu(); + openRowOffCanvas(row.original); }} > - - - - More Info - - ), - ] - } - } - - if (offCanvas) { - // Must return an array: MRT only renders the row-actions toggle when the - // returned value has a length. - return ({ closeMenu, row }) => [ - { - closeMenu() - openRowOffCanvas(row.original) - }} - > - - - - More Info - , - ] - } - - return undefined - }, [ - actions, - offCanvas, - dispatchRowAction, - openRowOffCanvas, - handleActionDisabled, - getRowOpenDispatchOptions, - ]) - - const rowContextMenuContent = useMemo(() => { - if (!rowContextMenu) { - return null - } - const rowOriginal = rowContextMenu.rowOriginal - const { pinnedActions, menuActions } = getRowMenuActions(rowOriginal) - const hasPinned = Boolean(offCanvas) || pinnedActions.length > 0 - const items = [] - - pinnedActions.forEach((action, index) => { - items.push( - - dispatchRowAction(action, rowOriginal, closeRowContextMenu) - } - disabled={handleActionDisabled(rowOriginal, action)} - > - - {action.icon} - - {action.label} - - ) - }) - if (offCanvas) { - items.push( - { - closeRowContextMenu() - openRowOffCanvas(rowOriginal) - }} - > - - - - More Info - - ) - } - if (hasPinned && menuActions.length > 0) { - items.push() - } - if (menuActions.length > 0) { - items.push( - - {menuActions.map((action, index) => ( - - dispatchRowAction(action, rowOriginal, closeRowContextMenu) - } - disabled={handleActionDisabled(rowOriginal, action)} - > - - {action.icon} + + - {action.label} - - ))} - - ) - } - - return items - }, [ - rowContextMenu, - offCanvas, - getRowMenuActions, - closeRowContextMenu, - openRowOffCanvas, - dispatchRowAction, - handleActionDisabled, - ]) - - // Stable renderTopToolbar — memoized so MaterialReactTable doesn't re-create the toolbar - // component on every parent render. - const renderTopToolbar = useCallback( - ({ table }) => { + More Info + , + ] + : undefined, + renderTopToolbar: ({ table }) => { return ( <> {!simple && ( @@ -1787,7 +3093,7 @@ export const CippDataTable = (props) => { data={data} columnVisibility={columnVisibility} getRequestData={getRequestData} - usedColumns={displayColumns} + usedColumns={displayColumns ?? memoizedColumns} usedData={memoizedData ?? EMPTY_ARRAY} title={title} actions={actions} @@ -1800,10 +3106,21 @@ export const CippDataTable = (props) => { setGraphFilterData={setGraphFilterData} setConfiguredSimpleColumns={setConfiguredSimpleColumns} queueMetadata={getRequestData.data?.pages?.[0]?.Metadata} - persistenceKey={persistenceKey} - parentRow={parentRow} + rowActionQueueIds={rowActionQueueIds} + onRemoveRowActionQueueId={(id) => + setRowActionQueueIds((prev) => prev.filter((qid) => qid !== id)) + } isInDialog={isInDialog} showBulkExportAction={showBulkExportAction} + viewMode={effectiveViewMode} + onViewModeChange={handleViewModeChange} + cardConfigAvailable={!!effectiveCardConfig} + dataFreshnessField={dataFreshnessField} + searchValue={searchValue || cardSearchInput} + onSearchChange={setCardSearchInput} + setSearchValue={setSearchValue} + persistenceKey={persistenceKey} + parentRow={parentRow} onViewToggle={toggleAllowed ? handleViewToggle : undefined} tableViewActive={toggleAllowed ? tableViewActive : undefined} showReturnToCards={showReturnToCards} @@ -1811,100 +3128,96 @@ export const CippDataTable = (props) => { dataSourceControls={dataSourceControls} activeFilters={activeFilters} setActiveFilters={setActiveFilters} - searchValue={searchValue} - setSearchValue={setSearchValue} restoredFiltersRef={restoredFiltersRef} searchFocusRef={searchFocusRef} /> )} - ) - }, - [ - simple, - api, - queryKey, - simpleColumns, - data, - columnVisibility, - getRequestData, - usedColumns, - displayColumns, - memoizedData, - title, - actions, - exportEnabled, - refreshFunction, - filters, - graphFilterData, - isInDialog, - showBulkExportAction, - toggleAllowed, - handleViewToggle, - tableViewActive, - showReturnToCards, - isNarrowViewport, - headerBulkSlot, - dataSourceControls, - activeFilters, - searchValue, - ] - ) - - const table = useMaterialReactTable({ - layoutMode: 'grid-no-grow', - enableRowVirtualization: true, - enableColumnVirtualization: true, - enableColumnResizing: true, - columnResizeMode: 'onChange', - rowVirtualizerOptions: { - overscan: 5, - }, - muiTableBodyCellProps: MUI_TABLE_BODY_CELL_PROPS, - mrtTheme: MRT_THEME, - muiTablePaperProps, - muiTableBodyRowProps, - enableColumnFilterModes: true, - muiTableHeadCellProps: MUI_TABLE_HEAD_CELL_PROPS, - initialState: { - columnFilters: columnFilters, - columnVisibility: sanitizedColumnVisibility, + ); }, - columns: displayColumns, - data: memoizedData ?? EMPTY_ARRAY, - state: tableState, - onSortingChange: handleSortingChange, - onColumnFiltersChange: setColumnFilters, - onColumnFilterFnsChange: setColumnFilterFns, - renderEmptyRowsFallback, - onColumnVisibilityChange: setColumnVisibility, - onColumnOrderChange: setColumnOrder, - ...modeInfo, - // narrow table views size their scroll viewport from measurement (see the effect below), - // the modeInfo calc budget only holds for desktop chrome ...(isNarrowViewport && - effectiveViewMode === 'table' && { + effectiveViewMode === "table" && { muiTableContainerProps: { ...modeInfo.muiTableContainerProps, sx: { ...modeInfo.muiTableContainerProps?.sx, - maxHeight: narrowTableMaxHeight ? `${narrowTableMaxHeight}px` : 'none', + maxHeight: narrowTableMaxHeight ? `${narrowTableMaxHeight}px` : "none", }, }, }), - renderRowActionMenuItems, - renderTopToolbar, sortingFns: SORTING_FNS, filterFns: FILTER_FNS, - globalFilterFn: 'contains', + globalFilterFn: "contains", enableGlobalFilterModes: true, - renderGlobalFilterModeMenuItems: renderGlobalFilterModeMenuItemsFn, - renderColumnFilterModeMenuItems: renderColumnFilterModeMenuItemsFn, - localization: MRT_LOCALIZATION_OVERRIDES, - muiSelectCheckboxProps: MUI_SELECT_CHECKBOX_PROPS, - muiSelectAllCheckboxProps: MUI_SELECT_ALL_CHECKBOX_PROPS, - muiFilterTextFieldProps: MUI_FILTER_TEXT_FIELD_PROPS, - }) + renderGlobalFilterModeMenuItems: ({ internalFilterOptions, onSelectFilterMode }) => { + // add custom filter options + const customFilterOptions = [ + { + option: "regex", + label: "Regex", + symbol: "(.*)", + }, + ]; + + // add to the internalFilterOptions if not already present + customFilterOptions.forEach((filterOption) => { + if (!internalFilterOptions.some((option) => option.option === filterOption.option)) { + internalFilterOptions.push(filterOption); + } + }); + + return internalFilterOptions.map((filterOption) => ( + onSelectFilterMode(filterOption.option)} + sx={{ + display: "flex", + alignItems: "center", + gap: "0.5rem", + }} + > + {filterOption.symbol} + {filterOption.label} + + )); + }, + renderColumnFilterModeMenuItems: ({ internalFilterOptions, onSelectFilterMode }) => { + // add custom filter options + const customFilterOptions = [ + { + option: "notContains", + label: "Not Contains", + symbol: "!*", + }, + { + option: "regex", + label: "Regex", + symbol: "(.*)", + }, + ]; + + // combine default and custom filter options + const combinedFilterOptions = [...internalFilterOptions, ...customFilterOptions]; + + return combinedFilterOptions.map((filterOption) => ( + onSelectFilterMode(filterOption.option)} + sx={{ + display: "flex", + alignItems: "center", + gap: "0.5rem", + }} + > + {filterOption.symbol} + {filterOption.label} + + )); + }, + }); + + // Note: Filter application is handled by setTableFilter in CIPPTableToptoolbar when user selects a filter. + // The `filters` prop contains filter OPTIONS for the dropdown menu, not active filters to apply. // deselect all rows when the underlying data set actually changes, guarded so a toolbar // remount (cards<->table flip) does not wipe an in-progress selection @@ -1917,6 +3230,29 @@ export const CippDataTable = (props) => { table.toggleAllRowsSelected(false) }, [memoizedData]) + // utilTableMode seeds columnOrder from simpleColumns (e.g. "members"), but cached report + // data shows membersCsv instead — MRT crashes if order references ids that are not in + // displayColumns. + useEffect(() => { + if (!Array.isArray(subTables) || subTables.length === 0) { + return + } + const displayIds = displayColumns.map((col) => col.id).filter(Boolean) + if (displayIds.length === 0) { + return + } + const currentOrder = table.getState().columnOrder ?? [] + if (!columnOrderHasStaleIds(currentOrder, displayIds)) { + return + } + const selectedForOrder = resolveSubTableSimpleColumns( + configuredSimpleColumns, + subTables, + usedData + ).filter((id) => displayIds.includes(id)) + table.setColumnOrder(orderColumnsBySelection(displayIds, selectedForOrder)) + }, [configuredSimpleColumns, displayColumns, subTables, usedData, table]) + // size the narrow table's scroll viewport from where it actually sits: viewport height // minus the container's measured top, the real footer height and the chrome below the // paper. the desktop calc assumes chrome heights that phone layouts do not have. @@ -2014,9 +3350,7 @@ export const CippDataTable = (props) => { // identity alone would strand the position — and is clamped so a list that shrank under // it can't report "6 of 2". const derivedRowIndex = offcanvasVisible - ? navigationRows.findIndex((row) => - rowsMatchContext(row.original, offCanvasData) - ) + ? navigationRows.findIndex((row) => row.original === offCanvasData) : -1 const currentRowIndex = derivedRowIndex >= 0 @@ -2047,17 +3381,91 @@ export const CippDataTable = (props) => { }, [table]) useEffect(() => { - if (onChange && table.getSelectedRowModel().rows) { - onChange(table.getSelectedRowModel().rows.map((row) => row.original)) + if (table?.setGlobalFilter) { + table.setGlobalFilter(cardSearchInput); + } + }, [cardSearchInput, table]); + + // Extract the selected-row model so the dependency is statically analyzable. + const selectedRowModelRows = table.getSelectedRowModel().rows; + useEffect(() => { + if (onChange && selectedRowModelRows) { + onChange(selectedRowModelRows.map((row) => row.original)); + } + // Intentionally keyed only to the selection. `onChange` is a caller-supplied prop + // that is frequently re-created each render; including it would re-fire on every + // parent render (and risk render loops) without changing the selection. + // eslint-disable-next-line react-hooks/exhaustive-deps + }, [selectedRowModelRows]); + + // Extract table state slices to keep the dependency array statically analyzable. + const { columnFilters: tableColumnFilters, globalFilter: tableGlobalFilter, sorting: tableSorting } = + table.getState(); + useEffect(() => { + // Update filtered rows whenever table filtering/sorting changes + if (table && table.getFilteredRowModel) { + const rows = table.getFilteredRowModel().rows; + setFilteredRows(rows.map((row) => row.original)); } - }, [table.getSelectedRowModel().rows]) + }, [table, tableColumnFilters, tableGlobalFilter, tableSorting]); useEffect(() => { //check if the simplecolumns are an array, if (Array.isArray(simpleColumns) && simpleColumns.length > 0) { - setConfiguredSimpleColumns(simpleColumns) + setConfiguredSimpleColumns(simpleColumns); } - }, [simpleColumns]) + }, [simpleColumns]); + + // Render the standalone toolbar for card view (not embedded in table) + const renderStandaloneToolbar = () => { + if (simple) return null; + return ( + + setRowActionQueueIds((prev) => prev.filter((qid) => qid !== id)) + } + isInDialog={isInDialog} + showBulkExportAction={showBulkExportAction} + viewMode={viewMode} + onViewModeChange={handleViewModeChange} + cardConfigAvailable={!!effectiveCardConfig} + isCardView={true} + dataFreshnessField={dataFreshnessField} + searchValue={searchValue || cardSearchInput} + onSearchChange={setCardSearchInput} + setSearchValue={setSearchValue} + setColumnFilters={setColumnFilters} + persistenceKey={persistenceKey} + parentRow={parentRow} + activeFilters={activeFilters} + setActiveFilters={setActiveFilters} + restoredFiltersRef={restoredFiltersRef} + onViewToggle={toggleAllowed ? handleViewToggle : undefined} + dataSourceControls={dataSourceControls} + /> + ); + }; const selectModeActive = hasOnChange ? true : mobileSelectMode @@ -2070,7 +3478,64 @@ export const CippDataTable = (props) => { return ( <> - {isCardView ? ( + {/* Card View (mobile or desktop when card mode selected) */} + {showCardView ? ( + + {cardButton || !hideTitle ? ( + <> + + + + ) : null} + {/* Standalone toolbar for card view on desktop */} + {!isMobile && ( + + {renderStandaloneToolbar()} + + )} + {getRequestData.isError && !getRequestData.isFetchNextPageError ? ( + + getRequestData.refetch()} + message={`Error Loading data: ${getCippError(getRequestData.error)}`} + /> + + ) : ( + getRequestData.refetch() : null)} + title={title} + isMobile={isMobile} + actions={actions} + tenant={settings?.currentTenant} + showSearch={isMobile || simple} + offCanvas={offCanvas} + setOffCanvasData={setOffCanvasData} + setOffCanvasRowIndex={setOffCanvasRowIndex} + setOffcanvasVisible={setOffcanvasVisible} + onCardClick={onCardClick} + editApiUrl={effectiveCardConfig?.editApiUrl} + queryKey={effectiveQueryKey} + columnFilters={columnFilters} + // Lazy loading props - only fetch more data when user navigates past loaded data + hasNextPage={getRequestData.hasNextPage} + onLoadMore={getRequestData.fetchNextPage} + isFetchingNextPage={getRequestData.isFetchingNextPage} + /> + )} + + ) : isCardView ? ( // same paper surface as the table path; overflow visible keeps the controls bar sticky { {Array.isArray(usedData) && !showSkeletons && ( + color="text.secondary" + sx={{ flexShrink: 0 }} + > {table.getFilteredRowModel().rows.length} results )} @@ -2186,9 +3650,9 @@ export const CippDataTable = (props) => { ) : ( <> - {(getRequestData.isSuccess || - getRequestData.data?.pages.length >= 0 || - data) && } + {(getRequestData.isSuccess || getRequestData.data?.pages?.length >= 0 || data) && ( + + )} )} {getRequestData.isError && !getRequestData.isFetchNextPageError && ( @@ -2213,9 +3677,7 @@ export const CippDataTable = (props) => { /> {/* narrow viewports carry these in the Table options sheet */} {dataSourceControls && !isNarrowViewport ? ( - + {dataSourceControls} {headerAction} @@ -2239,7 +3701,7 @@ export const CippDataTable = (props) => { {(getRequestData.isSuccess || getRequestData.data?.pages.length >= 0 || (data && !getRequestData.isError)) && ( - + )} )} @@ -2258,25 +3720,10 @@ export const CippDataTable = (props) => { )} )} - - {rowContextMenuContent} - setOffcanvasVisible(false)} extendedData={offCanvasData} extendedInfoFields={offCanvas?.extendedInfoFields} title={offCanvasData?.Name || offCanvas?.title || 'Extended Info'} @@ -2290,19 +3737,15 @@ export const CippDataTable = (props) => { onNavigateUp={() => { const newIndex = currentRowIndex - 1 if (newIndex >= 0 && navigationRows[newIndex]) { - const nextRow = navigationRows[newIndex].original setOffCanvasRowIndex(newIndex) - setOffCanvasData(nextRow) - setContextRow(nextRow) + setOffCanvasData(navigationRows[newIndex].original) } }} onNavigateDown={() => { const newIndex = currentRowIndex + 1 if (navigationRows[newIndex]) { - const nextRow = navigationRows[newIndex].original setOffCanvasRowIndex(newIndex) - setOffCanvasData(nextRow) - setContextRow(nextRow) + setOffCanvasData(navigationRows[newIndex].original) } }} canNavigateUp={currentRowIndex > 0} @@ -2320,7 +3763,7 @@ export const CippDataTable = (props) => { {/* Render custom component */} {customComponentVisible && customComponentData?.action && - typeof customComponentData.action.customComponent === 'function' && + typeof customComponentData.action.customComponent === "function" && customComponentData.action.customComponent(customComponentData.data, { drawerVisible: customComponentVisible, setDrawerVisible: setCustomComponentVisible, @@ -2331,10 +3774,9 @@ export const CippDataTable = (props) => { {useMemo(() => { if ( !actionData.ready || - (actionData.action && - typeof actionData.action.customComponent === 'function') + (actionData.action && typeof actionData.action.customComponent === "function") ) - return null + return null; return ( { api={actionData.action} row={actionData.data} {...actionData.action} + onActionSuccess={(response) => { + if (response?.data?.Queued && response?.data?.QueueId) { + setRowActionQueueIds((prev) => [...prev, response.data.QueueId]); + } + }} relatedQueryKeys={[ ...(queryKey ? [queryKey] : title ? [title] : []), ...(Array.isArray(actionData.action?.relatedQueryKeys) @@ -2352,15 +3799,8 @@ export const CippDataTable = (props) => { : []), ].filter(Boolean)} /> - ) - }, [ - actionData.ready, - createDialog, - actionData.action, - actionData.data, - queryKey, - title, - ])} + ); + }, [actionData.ready, createDialog, actionData.action, actionData.data, queryKey, title])} ); -} +}; diff --git a/frontend/src/components/CippTable/CippDiagnosticsFilter.jsx b/frontend/src/components/CippTable/CippDiagnosticsFilter.jsx index cea4a4806a..b94a0da174 100644 --- a/frontend/src/components/CippTable/CippDiagnosticsFilter.jsx +++ b/frontend/src/components/CippTable/CippDiagnosticsFilter.jsx @@ -183,7 +183,7 @@ const CippDiagnosticsFilter = ({ onSubmitFilter }) => { Requirements - • Application Insights must be deployed for your CIPP environment + • Application Insights must be deployed for your Manage365 environment
      • The Function App's managed identity must have Reader{" "} permissions on the Application Insights resource
      • Queries are executed using Kusto Query Language (KQL) diff --git a/frontend/src/components/CippTable/CippGraphExplorerFilter.jsx b/frontend/src/components/CippTable/CippGraphExplorerFilter.jsx index b018d84b76..4e71712445 100644 --- a/frontend/src/components/CippTable/CippGraphExplorerFilter.jsx +++ b/frontend/src/components/CippTable/CippGraphExplorerFilter.jsx @@ -25,6 +25,7 @@ const CippGraphExplorerFilter = ({ selectedPreset = null, onPresetSelect, hideButtons = false, + initialValues = null, }) => { const [offCanvasOpen, setOffCanvasOpen] = useState(false) const [cardExpanded, setCardExpanded] = useState(true) @@ -60,6 +61,12 @@ const CippGraphExplorerFilter = ({ }, }) + useEffect(() => { + if (initialValues && !selectedPreset) { + formControl.reset({ ...formControl.getValues(), ...initialValues }, { keepDefaultValues: true }) + } + }, []) + const defaultGraphExplorerTitle = 'Graph Explorer' // Accordion (the Graph Explorer page) lays fields out two-up; the card variant used in @@ -217,48 +224,61 @@ const CippGraphExplorerFilter = ({ if (option.value !== selectedPresets?.value) { presetControl.setValue('reportTemplate', option) } - // selectedPreset?.value covers the autocomplete option shape (no id/filterName keys) }, [selectedPreset?.id, selectedPreset?.filterName, selectedPreset?.value, presetOptions]) useEffect(() => { if (selectedPresets?.addedFields?.params) { setPresetOwner(selectedPresets?.addedFields?.IsMyPreset ?? false) + Object.keys(selectedPresets.addedFields.params).forEach( + (key) => + selectedPresets.addedFields.params[key] == null && + delete selectedPresets.addedFields.params[key] + ) + //if $select is a blank array, set it to a string. + if ( + selectedPresets.addedFields.params.$select && + selectedPresets.addedFields.params.$select.length === 0 + ) { + selectedPresets.addedFields.params.$select = '' + } - // normalize on a copy, addedFields.params is shared state (defaultPresets module / react-query cache) - const params = { ...selectedPresets.addedFields.params } - Object.keys(params).forEach((key) => { - if (params[key] == null) { - delete params[key] - } - }) - - // $select arrives as comma string (built-in presets) or array (saved presets), form needs [{label,value}] - if (Array.isArray(params.$select)) { - params.$select = params.$select.map((item) => - typeof item === 'string' ? { label: item, value: item } : item - ) - } else if (typeof params.$select === 'string' && params.$select !== '') { - params.$select = params.$select.split(',').map((item) => ({ label: item, value: item })) - } else { - params.$select = [] + // if $select is an array, extract the values and comma separate + if ( + Array.isArray(selectedPresets.addedFields.params.$select) && + selectedPresets.addedFields.params.$select.length > 0 + ) { + selectedPresets.addedFields.params.$select = selectedPresets.addedFields.params.$select + .map((item) => (typeof item === 'string' ? item : item?.value)) + .filter(Boolean) + .join(',') } + selectedPresets.addedFields.params.$select !== '' + ? (selectedPresets.addedFields.params.$select = selectedPresets.addedFields.params?.$select + ?.split(',') + .map((item) => ({ label: item, value: item }))) + : (selectedPresets.addedFields.params.$select = []) // Convert version string to autocomplete object format, default to beta if not present - if (params.version) { + if (selectedPresets.addedFields.params.version) { const versionValue = - typeof params.version === 'string' ? params.version : params.version.value - params.version = { label: versionValue, value: versionValue } + typeof selectedPresets.addedFields.params.version === 'string' + ? selectedPresets.addedFields.params.version + : selectedPresets.addedFields.params.version.value + selectedPresets.addedFields.params.version = { + label: versionValue, + value: versionValue, + } } else { - params.version = { label: 'beta', value: 'beta' } + selectedPresets.addedFields.params.version = { label: 'beta', value: 'beta' } } - params.id = selectedPresets.value + selectedPresets.addedFields.params.id = selectedPresets.value setSelectedPreset(selectedPresets.value) - params.name = selectedPresets.label + selectedPresets.addedFields.params.name = selectedPresets.label // save last preset title setLastPresetTitle(selectedPresets.label) - formControl.reset(params, { keepDefaultValues: true }) + formControl.reset(selectedPresets?.addedFields?.params, { keepDefaultValues: true }) // Notify parent only on user-driven changes, not the sync effect echoing selectedPreset back if (onPresetSelect && selectedPresets.value !== selectedPreset?.id) { @@ -486,9 +506,8 @@ const CippGraphExplorerFilter = ({ } // Handle filter form submission const onSubmit = (values) => { - if (Array.isArray(values.$select)) { - // empty array joins to '', removed by the null/empty cleanup below - values.$select = values.$select.map((item) => item.value).join(',') + if (values.$select && Array.isArray(values.$select) && values.$select.length > 0) { + values.$select = values?.$select?.map((item) => item.value)?.join(',') } if (values.version && values.version.value) { values.version = values.version.value @@ -497,6 +516,7 @@ const CippGraphExplorerFilter = ({ } if (values.ReverseTenantLookup === false) { delete values.ReverseTenantLookup + delete values.ReverseTenantLookupProperty } if (values.NoPagination === false) { delete values.NoPagination @@ -513,14 +533,16 @@ const CippGraphExplorerFilter = ({ delete values.id delete values.IsShared delete values.reportTemplate - delete values.manualPagination - if (!values.ReverseTenantLookup) { - // property only means something with the lookup enabled - delete values.ReverseTenantLookupProperty + if (values.manualPagination === false) { + delete values.manualPagination } Object.keys(values).forEach((key) => { - if (values[key] === null || values[key] === '') { + if ( + values[key] === null || + values[key] === '' || + (Array.isArray(values[key]) && values[key].length === 0) + ) { delete values[key] } }) diff --git a/frontend/src/components/CippTable/CippGraphExplorerSimpleFilter.jsx b/frontend/src/components/CippTable/CippGraphExplorerSimpleFilter.jsx index 03578f8296..37c120b7a2 100644 --- a/frontend/src/components/CippTable/CippGraphExplorerSimpleFilter.jsx +++ b/frontend/src/components/CippTable/CippGraphExplorerSimpleFilter.jsx @@ -59,10 +59,9 @@ const CippGraphExplorerSimpleFilter = ({ }, [defaultPresets, presetList.isSuccess, presetList.data]); const handleRunPreset = () => { - // re-run the last applied query from the edit drawer, preset change clears it - if (currentFilterValues) { - onSubmitFilter(currentFilterValues); - return; + if (!selectedPreset?.addedFields?.params) { + if (currentFilterValues) onSubmitFilter(currentFilterValues) + return } if (selectedPreset?.addedFields?.params) { const params = selectedPreset.addedFields.params; @@ -73,7 +72,7 @@ const CippGraphExplorerSimpleFilter = ({ values.$select = values.$select .map((item) => (typeof item === "string" ? item : item.value)) .join(","); - } else if (!values.$select || values.$select.length === 0) { + } else if (values.$select === "") { delete values.$select; } @@ -98,12 +97,16 @@ const CippGraphExplorerSimpleFilter = ({ delete values.AsApp; } - // Remove non-API fields and null/empty values (presets saved from the form carry id/name/IsShared in params) + // The mounted query editor writes the preset's id and name onto params so it + // can save them. They are not part of the Graph request. delete values.id; delete values.name; delete values.IsShared; + delete values.reportTemplate; + + // Remove null/empty values Object.keys(values).forEach((key) => { - if (values[key] === null || values[key] === "") { + if (values[key] === null || values[key] === "" || (Array.isArray(values[key]) && values[key].length === 0)) { delete values[key]; } }); @@ -125,15 +128,9 @@ const CippGraphExplorerSimpleFilter = ({ }; const handlePresetChange = (preset) => { - setCurrentFilterValues(null); presetControl.setValue("reportTemplate", preset); }; - // preset picked directly in the bar, discard drawer edits so Run uses the pristine preset - useEffect(() => { - setCurrentFilterValues(null); - }, [selectedPreset?.value]); - return ( <> {/* This sits on a page with no Card, so at 390px there is ~358px for a query field @@ -207,10 +204,10 @@ const CippGraphExplorerSimpleFilter = ({ setOffCanvasVisible(false)} contentPadding={1} - keepMounted={true} > diff --git a/frontend/src/components/CippTable/CippQueueTracker.jsx b/frontend/src/components/CippTable/CippQueueTracker.jsx index a3b3f7322e..1bfc132e46 100644 --- a/frontend/src/components/CippTable/CippQueueTracker.jsx +++ b/frontend/src/components/CippTable/CippQueueTracker.jsx @@ -1,235 +1,211 @@ -import React, { useState, useEffect } from "react"; -import { CippIcons } from "../../utils/icon-registry"; -import { IconButton, Tooltip, Badge, Typography, LinearProgress, Box, Stack } from "@mui/material"; +import React, { useState, useEffect, useCallback, useRef } from "react"; +import { + IconButton, + Tooltip, + Badge, + Typography, + LinearProgress, + Box, + Stack, + Chip, +} from "@mui/material"; +import { Timeline, Circle } from "@mui/icons-material"; import { CippOffCanvas } from "../CippComponents/CippOffCanvas"; import { ApiGetCall } from "../../api/ApiCall"; import { useQueryClient } from "@tanstack/react-query"; +import { useDispatch } from "react-redux"; +import { showToast } from "../../store/toasts"; -export const CippQueueTracker = ({ queueId, queryKey, title, onQueueComplete }) => { - const queryClient = useQueryClient(); - const [queueCanvasVisible, setQueueCanvasVisible] = useState(false); - const [persistentQueueData, setPersistentQueueData] = useState(null); - const [lastProcessedQueueId, setLastProcessedQueueId] = useState(null); - const [queueQueryKey, setQueueQueryKey] = useState(null); - const [hasAutoRefreshed, setHasAutoRefreshed] = useState(false); - - const hasQueueData = !!queueId; - const currentQueryKey = queryKey || title; - - // Show queue if we have current queue data OR persistent queue data from the same query key - // If query key changed and we don't have an active queueId, don't show the tracker - const shouldShowQueue = - hasQueueData || (!!persistentQueueData && queueQueryKey === currentQueryKey); +/** + * Polls a single queue entry and calls back on status changes. + * Renders nothing — purely a polling side-effect hook wrapper. + */ +const QueuePoller = ({ queueId, onData, onComplete }) => { + const [isCompleted, setIsCompleted] = useState(false); - // Check if queue is in a completed state based on persistent data only (to avoid circular dependency) - const isQueueCompleted = - persistentQueueData?.Status === "Completed" || - persistentQueueData?.Status === "Failed" || - persistentQueueData?.Status === "Completed (with errors)"; - - const effectiveQueueId = queueId || lastProcessedQueueId; - - const queuePolling = ApiGetCall({ + const polling = ApiGetCall({ url: `/api/ListCippQueue`, - data: { QueueId: effectiveQueueId }, - queryKey: `CippQueue-${effectiveQueueId || "unknown"}`, - waiting: shouldShowQueue && !!effectiveQueueId && !isQueueCompleted, - refetchInterval: (query) => { - // TanStack Query v5 hands this callback the Query object, not the data - the response - // has to be read off query.state or the completion check below never matches. - const currentData = query?.state?.data?.[0]; - const isCurrentCompleted = - currentData?.Status === "Completed" || - currentData?.Status === "Failed" || - currentData?.Status === "Completed (with errors)"; - - // Also check persistent data - const isPersistentCompleted = - persistentQueueData?.Status === "Completed" || - persistentQueueData?.Status === "Failed" || - persistentQueueData?.Status === "Completed (with errors)"; - - // Stop polling if either shows completion - if (isCurrentCompleted || isPersistentCompleted || !shouldShowQueue || !effectiveQueueId) { + data: { QueueId: queueId }, + queryKey: `CippQueue-${queueId}`, + waiting: !!queueId && !isCompleted, + refetchInterval: (data) => { + const d = data?.[0]; + if ( + d?.Status === "Completed" || + d?.Status === "Failed" || + d?.Status === "Completed (with errors)" + ) { return false; } - return 3000; }, refetchOnMount: true, refetchOnWindowFocus: false, }); - const queueData = queuePolling.data?.[0]; + const queueData = polling.data?.[0]; - // Handle queue data persistence - only update persistent queue data when we get a new QueueId - // and ensure it's pinned to the current query key useEffect(() => { - const currentQueryKey = queryKey || title; + if (!queueData) return; + onData(queueId, queueData); - // If query key changed, clear all queue data - if (queueQueryKey && queueQueryKey !== currentQueryKey) { - setPersistentQueueData(null); - setLastProcessedQueueId(null); - setQueueQueryKey(currentQueryKey); - setHasAutoRefreshed(false); - return; - } + const terminal = + queueData.Status === "Completed" || + queueData.Status === "Failed" || + queueData.Status === "Completed (with errors)"; - // Set query key if not set - if (!queueQueryKey) { - setQueueQueryKey(currentQueryKey); + if (terminal && !isCompleted) { + setIsCompleted(true); + onComplete(queueId, queueData); } + }, [queueData, queueId, onData, onComplete, isCompleted]); - // Only process new QueueId if we actually have one and it's different - if (queueId && queueId !== lastProcessedQueueId) { - // New QueueId detected, clear old persistent data and set new QueueId - setPersistentQueueData(null); - setLastProcessedQueueId(queueId); - setHasAutoRefreshed(false); // Reset auto-refresh flag for new queue - } + return null; +}; - // Don't clear persistent data if queueId is temporarily null (during table refresh) - // Only clear if we explicitly get a different QueueId or change query/page - }, [queueId, lastProcessedQueueId, queryKey, title, queueQueryKey]); +export const CippQueueTracker = ({ + queueIds = [], + queueId: legacySingleId, + queryKey, + title, + onQueueComplete, + onSingleQueueComplete, +}) => { + const queryClient = useQueryClient(); + const dispatch = useDispatch(); + const [queueCanvasVisible, setQueueCanvasVisible] = useState(false); - // Update persistent queue data when new queue data is available - useEffect(() => { - const currentQueryKey = queryKey || title; + // Merge legacy single-id prop with the array prop for backwards compat + const allIds = [ + ...queueIds, + ...(legacySingleId && !queueIds.includes(legacySingleId) ? [legacySingleId] : []), + ]; - // Only update if we're on the same query key where the queue was initiated - if (queueData && queueId === lastProcessedQueueId && queueQueryKey === currentQueryKey) { - setPersistentQueueData(queueData); - } - }, [queueData, queueId, lastProcessedQueueId, queryKey, title, queueQueryKey]); + // Map queueId -> latest data + const [queueDataMap, setQueueDataMap] = useState({}); + const completedToastRef = useRef(new Set()); - // Auto-refresh table when queue reaches 100% completion - useEffect(() => { - const currentQueryKey = queryKey || title; + const handleData = useCallback((id, data) => { + setQueueDataMap((prev) => ({ ...prev, [id]: data })); + }, []); + + const handleComplete = useCallback( + (id, data) => { + // Fire toast once per queue + if (!completedToastRef.current.has(id)) { + completedToastRef.current.add(id); - // Only auto-refresh if we're on the same query key where the queue was initiated - // and we haven't already auto-refreshed for this queue completion - if ( - !hasAutoRefreshed && - (persistentQueueData?.Status === "Completed" || - persistentQueueData?.Status === "Failed" || - persistentQueueData?.Status === "Completed (with errors)") && - queueQueryKey === currentQueryKey - ) { - // Queue is complete, invalidate the table query to refresh data - if (currentQueryKey) { - queryClient.invalidateQueries({ queryKey: [currentQueryKey] }); - setHasAutoRefreshed(true); // Mark that we've auto-refreshed - // Call callback if provided + const queueName = data?.Name || "Background task"; + if (data?.Status === "Completed") { + dispatch(showToast({ message: `${queueName} completed successfully.`, title: "Task Complete" })); + } else if (data?.Status === "Failed") { + dispatch(showToast({ message: `${queueName} failed.`, title: "Task Failed" })); + } else if (data?.Status === "Completed (with errors)") { + dispatch( + showToast({ + message: `${queueName} completed with errors (${data?.FailedTasks} failed).`, + title: "Task Complete (with errors)", + }) + ); + } + + // Refresh the table data + const currentQueryKey = queryKey || title; + if (currentQueryKey) { + queryClient.invalidateQueries({ queryKey: [currentQueryKey] }); + } + + // Notify parent so it can remove this id from its array + if (onSingleQueueComplete) { + onSingleQueueComplete(id); + } + // Legacy callback if (onQueueComplete) { - onQueueComplete(); + onQueueComplete(id); } } - } - }, [ - hasAutoRefreshed, - persistentQueueData?.PercentComplete, - persistentQueueData?.Status, - queryKey, - title, - queryClient, - queueQueryKey, - onQueueComplete, - ]); + }, + [dispatch, queryClient, queryKey, title, onSingleQueueComplete, onQueueComplete] + ); - // Don't render anything if we don't have queue data to show - // Check for valid queueId or persistent queue data - if (!shouldShowQueue || (!queueId && !lastProcessedQueueId && !persistentQueueData)) { - return null; - } + // Clean stale entries from the map when allIds changes (entries removed by parent) + useEffect(() => { + setQueueDataMap((prev) => { + const next = {}; + for (const id of allIds) { + if (prev[id]) next[id] = prev[id]; + } + return next; + }); + }, [allIds.join(",")]); // eslint-disable-line react-hooks/exhaustive-deps + + if (allIds.length === 0) return null; + + // Aggregate status across all tracked queues + const allData = allIds.map((id) => queueDataMap[id]).filter(Boolean); + const activeCount = allData.filter( + (d) => d.Status !== "Completed" && d.Status !== "Failed" && d.Status !== "Completed (with errors)" + ).length; + const failedCount = allData.filter( + (d) => d.Status === "Failed" || d.Status === "Completed (with errors)" + ).length; + const completedCount = allData.filter((d) => d.Status === "Completed").length; + const totalCount = allIds.length; + + const overallColor = + activeCount > 0 + ? "primary.main" + : failedCount > 0 + ? "error.main" + : "success.main"; + + const badgeColor = + activeCount > 0 + ? "warning.main" + : failedCount > 0 + ? "error.main" + : "success.main"; + + const tooltipText = + activeCount > 0 + ? `${activeCount} task${activeCount > 1 ? "s" : ""} running (${completedCount} done, ${failedCount} failed)` + : failedCount > 0 + ? `All tasks finished — ${failedCount} failed, ${completedCount} succeeded` + : `All ${completedCount} task${completedCount > 1 ? "s" : ""} completed`; return ( <> - + {/* Render one poller per tracked queue */} + {allIds.map((id) => ( + + ))} + + - ) : (persistentQueueData || queueData)?.Status === "Completed (with errors)" ? ( - - ) : (persistentQueueData || queueData)?.Status === "Failed" ? ( - - ) : (persistentQueueData || queueData)?.RunningTasks > 0 ? ( - + totalCount > 1 ? ( + totalCount ) : ( - + ) } + color={activeCount > 0 ? "warning" : failedCount > 0 ? "error" : "success"} overlap="circular" - anchorOrigin={{ - vertical: "top", - horizontal: "right", - }} + anchorOrigin={{ vertical: "top", horizontal: "right" }} > setQueueCanvasVisible(true)} sx={{ - animation: - (persistentQueueData || queueData)?.Status !== "Completed" && - (persistentQueueData || queueData)?.Status !== "Completed (with errors)" && - (persistentQueueData || queueData)?.Status !== "Failed" - ? "pulse 2s infinite" - : "none", + animation: activeCount > 0 ? "pulse 2s infinite" : "none", "@keyframes pulse": { - "0%": { - transform: "scale(1)", - opacity: 1, - }, - "50%": { - transform: "scale(1.1)", - opacity: 0.8, - }, - "100%": { - transform: "scale(1)", - opacity: 1, - }, + "0%": { transform: "scale(1)", opacity: 1 }, + "50%": { transform: "scale(1.1)", opacity: 0.8 }, + "100%": { transform: "scale(1)", opacity: 1 }, }, - color: - (persistentQueueData || queueData)?.Status === "Completed" - ? "success.main" - : (persistentQueueData || queueData)?.Status === "Completed (with errors)" - ? "warning.main" - : (persistentQueueData || queueData)?.Status === "Failed" - ? "error.main" - : (persistentQueueData || queueData)?.RunningTasks > 0 - ? "warning.main" - : "primary.main", + color: overallColor, }} > - + @@ -237,226 +213,161 @@ export const CippQueueTracker = ({ queueId, queryKey, title, onQueueComplete }) {/* Queue Status OffCanvas */} setQueueCanvasVisible(false)} > - {persistentQueueData || queueData ? ( - <> - {(persistentQueueData || queueData).Name} - - - - Progress: {(persistentQueueData || queueData).PercentComplete?.toFixed(1)}% - complete - - - - - - - Total Tasks: {(persistentQueueData || queueData).TotalTasks || 0} - - - Completed:{" "} - {(persistentQueueData || queueData).CompletedTasks || 0} - - - Running: {(persistentQueueData || queueData).RunningTasks || 0} - - - Failed: {(persistentQueueData || queueData).FailedTasks || 0} - - - - - Status: {(persistentQueueData || queueData).Status} - - - {(persistentQueueData || queueData).Tasks && - (persistentQueueData || queueData).Tasks.length > 0 && ( - <> - - Task Details - + {allIds.length === 0 ? ( + No background tasks + ) : ( + + theme.palette.mode === "dark" ? "rgba(255,255,255,0.1)" : "rgba(0,0,0,0.1)", + borderRadius: 4, + }, + "&::-webkit-scrollbar-thumb": { + backgroundColor: (theme) => + theme.palette.mode === "dark" ? "rgba(255,255,255,0.3)" : "rgba(0,0,0,0.3)", + borderRadius: 4, + "&:hover": { + backgroundColor: (theme) => + theme.palette.mode === "dark" + ? "rgba(255,255,255,0.5)" + : "rgba(0,0,0,0.5)", + }, + }, + }} + > + + {allIds.map((id) => { + const data = queueDataMap[id]; + if (!data) { + return ( + + + Loading... + + + ); + } + const isTerminal = + data.Status === "Completed" || + data.Status === "Failed" || + data.Status === "Completed (with errors)"; + return ( ({ + p: 2, + border: 1, + borderColor: + theme.palette.mode === "dark" ? "rgba(255,255,255,0.12)" : "divider", + borderRadius: 1, + backgroundColor: + data.Status === "Completed" + ? theme.palette.mode === "dark" + ? "rgba(102, 187, 106, 0.15)" + : "success.light" + : data.Status === "Failed" + ? theme.palette.mode === "dark" + ? "rgba(244, 67, 54, 0.15)" + : "error.light" + : data.Status === "Completed (with errors)" + ? theme.palette.mode === "dark" + ? "rgba(255, 152, 0, 0.15)" + : "warning.light" + : theme.palette.mode === "dark" + ? "rgba(255,255,255,0.05)" + : "grey.100", + transition: "all 0.2s ease-in-out", + })} > - - theme.palette.mode === "dark" - ? "rgba(255,255,255,0.1)" - : "rgba(0,0,0,0.1)", - borderRadius: 4, - }, - "&::-webkit-scrollbar-thumb": { - backgroundColor: (theme) => - theme.palette.mode === "dark" - ? "rgba(255,255,255,0.3)" - : "rgba(0,0,0,0.3)", - borderRadius: 4, - "&:hover": { - backgroundColor: (theme) => - theme.palette.mode === "dark" - ? "rgba(255,255,255,0.5)" - : "rgba(0,0,0,0.5)", - }, - }, - }} - > - {(persistentQueueData || queueData).Tasks.map((task, index) => ( - ({ - p: 2, - border: 1, - borderColor: - theme.palette.mode === "dark" - ? "rgba(255,255,255,0.12)" - : "divider", - borderRadius: 1, - backgroundColor: - task.Status === "Completed" - ? theme.palette.mode === "dark" - ? "rgba(102, 187, 106, 0.15)" - : "success.light" - : task.Status === "Failed" - ? theme.palette.mode === "dark" - ? "rgba(244, 67, 54, 0.15)" - : "error.light" - : task.Status === "Running" - ? theme.palette.mode === "dark" - ? "rgba(255, 152, 0, 0.15)" - : "warning.light" - : theme.palette.mode === "dark" - ? "rgba(255,255,255,0.05)" - : "grey.100", - transition: "all 0.2s ease-in-out", - "&:hover": { - transform: "translateY(-1px)", - boxShadow: - theme.palette.mode === "dark" - ? "0 4px 8px rgba(0,0,0,0.3)" - : "0 4px 8px rgba(0,0,0,0.1)", - }, - })} - > - - {/* Task names are tenant domains — one unbreakable token — so - without minWidth: 0 the row's min-content width exceeds a - phone-width card and shoves the status pill off its edge. */} - - {task.Name} - - ({ - flexShrink: 0, - whiteSpace: "nowrap", - px: 1.5, - py: 0.5, - borderRadius: 2, - backgroundColor: - theme.palette.mode === "dark" - ? "rgba(255,255,255,0.1)" - : "background.paper", - border: - theme.palette.mode === "dark" - ? "1px solid rgba(255,255,255,0.2)" - : "none", - fontWeight: "medium", - textTransform: "uppercase", - fontSize: "0.7rem", - letterSpacing: "0.5px", - color: - task.Status === "Completed" - ? "success.main" - : task.Status === "Failed" + + + {data.Name} + + + + {!isTerminal && ( + + + + {data.PercentComplete?.toFixed(0)}% — {data.CompletedTasks || 0}/ + {data.TotalTasks || 0} tasks + + + )} + {isTerminal && data.FailedTasks > 0 && ( + + {data.FailedTasks} task{data.FailedTasks > 1 ? "s" : ""} failed + + )} + {data.Tasks && data.Tasks.length > 0 && ( + + Task Details + {data.Tasks.map((task, i) => ( + + + + {task.Name} + + - {task.Status} - - - {task.Timestamp && ( - - {new Date(task.Timestamp).toLocaleDateString(undefined, { - year: "numeric", - month: "short", - day: "numeric", - })}{" "} - {new Date(task.Timestamp).toLocaleTimeString(undefined, { - hour: "2-digit", - minute: "2-digit", - second: "2-digit", - })} - - )} - - ))} - + ? "warning.main" + : "text.secondary", + }} + > + {task.Status} + + + + ))} + + )} - - )} - - ) : queuePolling.isLoading ? ( - Loading queue data... - ) : queuePolling.isError ? ( - - Error loading queue data: {queuePolling.error?.message} - - ) : ( - No queue data available + ); + })} + + )} diff --git a/frontend/src/components/CippTable/util-columnsFromAPI.js b/frontend/src/components/CippTable/util-columnsFromAPI.js index a2c9bfeb61..602afe39f4 100644 --- a/frontend/src/components/CippTable/util-columnsFromAPI.js +++ b/frontend/src/components/CippTable/util-columnsFromAPI.js @@ -3,7 +3,15 @@ import { getCippFormatting } from '../../utils/get-cipp-formatting' import { formatCellText } from './CippCellText' import { getCippTranslation } from '../../utils/get-cipp-translation' import { getCippColumnSize } from '../../utils/get-cipp-column-size' -import { SKIP_RECURSION_KEYS as skipRecursion } from '../../utils/skip-recursion-keys' +import { SKIP_RECURSION_KEYS } from '../../utils/skip-recursion-keys' + +// Manage365 also skips standards payloads so column discovery does not recurse into them. +const skipRecursion = [ + ...SKIP_RECURSION_KEYS, + 'standards', + 'Standard', + 'LogData', +] // Number of rows to sample when measuring column content width. const MAX_SIZE_SAMPLE = 30 diff --git a/frontend/src/components/CippTestDetail/CippTestDetailOffCanvas.jsx b/frontend/src/components/CippTestDetail/CippTestDetailOffCanvas.jsx index ece5325d5f..46d45d2c3b 100644 --- a/frontend/src/components/CippTestDetail/CippTestDetailOffCanvas.jsx +++ b/frontend/src/components/CippTestDetail/CippTestDetailOffCanvas.jsx @@ -4,7 +4,7 @@ import { Card, CardContent, Box, Stack, Chip, Typography } from "@mui/material"; import ReactMarkdown from "react-markdown"; import remarkGfm from "remark-gfm"; import { Grid } from "@mui/system"; -import { getStandards } from "../../utils/standards-data"; +import standardsData from "../../data/standards.json"; import { CippCodeBlock } from "../CippComponents/CippCodeBlock"; import { renderCustomScriptMarkdownTemplate } from "../../utils/customScriptTemplate"; @@ -54,7 +54,7 @@ const getImpactColor = (impact) => { // row's RowKey is the same TestId, so this is an exact lookup. const getMatchingStandards = (testName) => { if (!testName) return []; - return getStandards().filter( + return standardsData.filter( (standard) => Array.isArray(standard.appliesToTest) && standard.appliesToTest.includes(testName) ); diff --git a/frontend/src/components/CippWizard/CippAddTenantTypeSelection.jsx b/frontend/src/components/CippWizard/CippAddTenantTypeSelection.jsx index a4b5d959cf..eb560e971b 100644 --- a/frontend/src/components/CippWizard/CippAddTenantTypeSelection.jsx +++ b/frontend/src/components/CippWizard/CippAddTenantTypeSelection.jsx @@ -100,7 +100,7 @@ export const CippAddTenantTypeSelection = (props) => { value: 'IndirectReseller', label: 'Get Reseller Invite Link', description: - 'Generate a reseller relationship invite link to send to a customer. This does not add the tenant to CIPP, but may be used by other vendors to populate their customer list.', + 'Generate a reseller relationship invite link to send to a customer. This does not add the tenant to Manage365, but may be used by other vendors to populate their customer list.', icon: , partnerOnly: true, }, @@ -113,7 +113,7 @@ export const CippAddTenantTypeSelection = (props) => { - Choose how you want to add the tenant to your CIPP environment. + Choose how you want to add the tenant to your Manage365 environment.       diff --git a/frontend/src/components/CippWizard/CippAlertsStep.jsx b/frontend/src/components/CippWizard/CippAlertsStep.jsx index c1a764cc87..f80096cab0 100644 --- a/frontend/src/components/CippWizard/CippAlertsStep.jsx +++ b/frontend/src/components/CippWizard/CippAlertsStep.jsx @@ -34,7 +34,7 @@ export const CippAlertsStep = (props) => {
      • - CIPP has the ability to send alerts to your PSA, Webhook or Email. You can configure + Manage365 has the ability to send alerts to your PSA, Webhook or Email. You can configure these settings under > Tenant Administration > Alert Configuration.
      @@ -47,13 +47,13 @@ export const CippAlertsStep = (props) => {
    • - If you want to use our integrations, you should set these up under > CIPP > + If you want to use our integrations, you should set these up under > Manage365 > Integrations. Some examples are CSP integrations, Password Pusher, PSA, and more.
    • - Adding more users to CIPP? you can do this via CIPP > Advanced > Super Admin. + Adding more users to Manage365? you can do this via Manage365 > Advanced > Super Admin.
      diff --git a/frontend/src/components/CippWizard/CippBaselinesStep.jsx b/frontend/src/components/CippWizard/CippBaselinesStep.jsx index 0343e8a33f..9a4aa83652 100644 --- a/frontend/src/components/CippWizard/CippBaselinesStep.jsx +++ b/frontend/src/components/CippWizard/CippBaselinesStep.jsx @@ -16,12 +16,12 @@ export const CippBaselinesStep = (props) => { at Tools - Community Repositories - Downloading these baselines will create templates in your CIPP instance. These templates + Downloading these baselines will create templates in your Manage365 instance. These templates won't make any changes to your environment, but can be used as examples on how to setup environments. Each template library contains multiple templates,
      • - CIPP Templates by CyberDrain contain several example standards, including low, + Manage365 Templates by CyberDrain contain several example standards, including low, medium, and high priority standards
      • diff --git a/frontend/src/components/CippWizard/CippCertificateAuthStep.jsx b/frontend/src/components/CippWizard/CippCertificateAuthStep.jsx index b028a738be..aea2a19021 100644 --- a/frontend/src/components/CippWizard/CippCertificateAuthStep.jsx +++ b/frontend/src/components/CippWizard/CippCertificateAuthStep.jsx @@ -45,7 +45,7 @@ export const CippCertificateAuthStep = (props) => { - Switch this existing install to authenticate CIPP's application with the SAM certificate + Switch this existing install to authenticate Manage365's application with the SAM certificate instead of the client secret, for every Graph and Exchange Online call. The client secret is kept in Key Vault as a rollback - turn this off to switch back at any time. @@ -78,7 +78,7 @@ export const CippCertificateAuthStep = (props) => { {certStatus.isSuccess && !registered && ( The SAM certificate is not registered on the application yet. When you finish the wizard, - CIPP will generate and register it before enabling certificate authentication. If that + Manage365 will generate and register it before enabling certificate authentication. If that step fails, the client secret stays in use and nothing breaks. )} diff --git a/frontend/src/components/CippWizard/CippGDAPTenantSetup.jsx b/frontend/src/components/CippWizard/CippGDAPTenantSetup.jsx index cdcb443560..39065ae049 100644 --- a/frontend/src/components/CippWizard/CippGDAPTenantSetup.jsx +++ b/frontend/src/components/CippWizard/CippGDAPTenantSetup.jsx @@ -119,7 +119,7 @@ export const CippGDAPTenantSetup = (props) => { {createDefaults && ( - The CIPP Defaults template is missing from the GDAP Role Templates. Create it now? + The Manage365 Defaults template is missing from the GDAP Role Templates. Create it now? diff --git a/frontend/src/components/CippWizard/CippIndirectResellerLink.jsx b/frontend/src/components/CippWizard/CippIndirectResellerLink.jsx index 23ff7ae073..12e5202e7a 100644 --- a/frontend/src/components/CippWizard/CippIndirectResellerLink.jsx +++ b/frontend/src/components/CippWizard/CippIndirectResellerLink.jsx @@ -58,7 +58,7 @@ export const CippIndirectResellerLink = (props) => { color: "text.secondary" }}> Generate an invite link to send to a customer so they can authorize you as their indirect - reseller. This does not add the tenant to CIPP — it only provides the + reseller. This does not add the tenant to Manage365 — it only provides the Microsoft Admin Portal invitation link. @@ -76,7 +76,7 @@ export const CippIndirectResellerLink = (props) => { {linkData.isError && ( - Failed to load relationship link from the Partner Center API. Ensure your CIPP application + Failed to load relationship link from the Partner Center API. Ensure your Manage365 application has the required Partner Center permissions. )} diff --git a/frontend/src/components/CippWizard/CippNotificationsStep.jsx b/frontend/src/components/CippWizard/CippNotificationsStep.jsx index 64ac650593..6b47cc2ad6 100644 --- a/frontend/src/components/CippWizard/CippNotificationsStep.jsx +++ b/frontend/src/components/CippWizard/CippNotificationsStep.jsx @@ -11,7 +11,7 @@ export const CippNotificationsStep = (props) => { Notification Settings Configure your notification settings. These settings will determine how you receive alerts - from CIPP. You can test your configuration using the "Send Test Alert" button. Don't want + from Manage365. You can test your configuration using the "Send Test Alert" button. Don't want to setup notifications yet? You can skip this step and configure it later via Application Settings - Notifications diff --git a/frontend/src/components/CippWizard/CippSAMDeploy.jsx b/frontend/src/components/CippWizard/CippSAMDeploy.jsx index 348249eb49..58e85ab467 100644 --- a/frontend/src/components/CippWizard/CippSAMDeploy.jsx +++ b/frontend/src/components/CippWizard/CippSAMDeploy.jsx @@ -109,7 +109,7 @@ export const CippSAMDeploy = (props) => { { value: "certificate", label: - "Certificate (recommended) - no client secret; CIPP generates and auto-rotates it.", + "Certificate (recommended) - no client secret; Manage365 generates and auto-rotates it.", }, { value: "secret", @@ -121,7 +121,7 @@ export const CippSAMDeploy = (props) => { To run this setup you will need the following prerequisites:
      • - A CIPP Service Account. For more information on how to create a service account, click{" "} + A Manage365 Service Account. For more information on how to create a service account, click{" "} {
      • User Administrator
      • - Multi-factor authentication enabled for the CIPP Service Account, with no trusted + Multi-factor authentication enabled for the Manage365 Service Account, with no trusted locations or other exclusions.
        • -
      • - Device code sign-in permitted in your partner tenant. Security defaults and Conditional - Access authentication flow policies can block it, which will stop this step from - completing. -
        • - - - This step only creates the CIPP-SAM application registration. The token CIPP runs on is - created by the sign-in on the next step. {authStatus.error && ( diff --git a/frontend/src/components/CippWizard/CippTenantModeDeploy.jsx b/frontend/src/components/CippWizard/CippTenantModeDeploy.jsx index c6701c5b46..fafe6b3676 100644 --- a/frontend/src/components/CippWizard/CippTenantModeDeploy.jsx +++ b/frontend/src/components/CippWizard/CippTenantModeDeploy.jsx @@ -108,7 +108,7 @@ export const CippTenantModeDeploy = (props) => { - CIPP uses the partner center to automatically retrieve your tenants, however you can also + Manage365 uses the partner center to automatically retrieve your tenants, however you can also authenticate to individual tenants. @@ -117,7 +117,7 @@ export const CippTenantModeDeploy = (props) => { button below. - Please remember to log onto a service account dedicated for CIPP. More info? Check out the{" "} + Please remember to log onto a service account dedicated for Manage365. More info? Check out the{" "} { const { @@ -12,19 +14,49 @@ export const CippTenantStep = (props) => { currentStep, onPreviousStep, preText, + includeTenantDefaults = false, includeOffboardingDefaults = false, } = props; + const theme = useTheme(); + const smDown = useMediaQuery(theme.breakpoints.down("sm")); return ( - + {preText} - + {/* Header */} + + + + + + {type === "multiple" ? "Select Tenants" : "Select a Tenant"} + + + {type === "multiple" + ? "Choose one or more tenants to apply this action to" + : "Start typing to search and select a tenant" + } + + row.displayName !== "*Partner Tenant", + category: "edit", }, { label: "Include Tenants", @@ -38,6 +39,7 @@ export const CippTenantTable = ({ confirmText: "Are you sure you want to include [displayName]?", multiPost: false, condition: (row) => row.displayName !== "*Partner Tenant", + category: "edit", }, { label: "Refresh CPV Permissions", @@ -47,6 +49,7 @@ export const CippTenantTable = ({ data: { tenantFilter: "customerId" }, confirmText: "Are you sure you want to refresh the CPV permissions for [displayName]?", multiPost: false, + category: "manage", }, { label: "Reset CPV Permissions", @@ -59,6 +62,7 @@ export const CippTenantTable = ({ multiPost: false, condition: (row) => row.displayName !== "*Partner Tenant" && row.delegatedPrivilegeStatus !== "directTenant", + category: "manage", }, { label: "Remove Tenant", @@ -70,9 +74,10 @@ export const CippTenantTable = ({ "Are you sure you want to remove [displayName]? If this is a Direct Tenant, this will no longer be accessible until you add it via the Setup Wizard.", multiPost: false, condition: (row) => row.displayName !== "*Partner Tenant", + category: "danger", }, { - label: "Refresh CIPPDB Cache", + label: "Refresh Manage365 DB Cache", type: "GET", url: `/api/ExecCIPPDBCache`, icon: , @@ -105,6 +110,7 @@ export const CippTenantTable = ({ TenantFilter: tenantFilter, }; }, + category: "manage", }, ]; diff --git a/frontend/src/components/CippWizard/CippWizard.jsx b/frontend/src/components/CippWizard/CippWizard.jsx index 0c35ce677d..4b2ca69ee3 100644 --- a/frontend/src/components/CippWizard/CippWizard.jsx +++ b/frontend/src/components/CippWizard/CippWizard.jsx @@ -1,5 +1,6 @@ import { useCallback, useMemo, useState } from "react"; -import { Card, CardContent, Container, Stack } from "@mui/material"; +import { Card, CardContent, Container, Stack, useMediaQuery, LinearProgress, Box, Typography, Chip } from "@mui/material"; +import { useTheme } from "@mui/material/styles"; import { Grid } from "@mui/system"; import { WizardSteps } from "./wizard-steps"; import { useForm, useWatch } from "react-hook-form"; @@ -12,6 +13,8 @@ export const CippWizard = (props) => { contentMaxWidth = "md", } = props; + const theme = useTheme(); + const smDown = useMediaQuery(theme.breakpoints.down("sm")); const formControl = useForm({ mode: "onChange", defaultValues: props.initialState }); const formWatcher = useWatch({ control: formControl.control, @@ -30,21 +33,32 @@ export const CippWizard = (props) => { }, [steps, formWatcher]); const [activeStep, setActiveStep] = useState(0); + // Navigation clamps against the *visible* step list: conditional steps can + // shrink it below the stored index (e.g. a form change hides a later step). const handleBack = useCallback(() => { - setActiveStep((prevState) => (prevState > 0 ? prevState - 1 : prevState)); - }, []); + setActiveStep((prevState) => { + const current = Math.min(prevState, stepsWithVisibility.length - 1); + return current > 0 ? current - 1 : current; + }); + }, [stepsWithVisibility.length]); // Counts against the VISIBLE steps. `steps` is the unfiltered prop — the onboarding // wizard passes 14 and shows 3-7 — so clamping against it let activeStep run past the // end of stepsWithVisibility, and the render below then read `.component` of undefined. const handleNext = useCallback(() => { - setActiveStep((prevState) => - prevState < stepsWithVisibility.length - 1 ? prevState + 1 : prevState - ); + setActiveStep((prevState) => { + const current = Math.min(prevState, stepsWithVisibility.length - 1); + return current < stepsWithVisibility.length - 1 ? current + 1 : current; + }); }, [stepsWithVisibility.length]); + // Conditional steps can shrink the visible list below the current index + // (e.g. a form change hides a later step while it is active). Clamp at + // render time so we never index past the filtered list and crash. + const boundedStep = Math.min(activeStep, Math.max(stepsWithVisibility.length - 1, 0)); + const content = useMemo(() => { - const currentStep = stepsWithVisibility[activeStep]; + const currentStep = stepsWithVisibility[boundedStep]; const StepComponent = currentStep.component; return ( @@ -53,7 +67,7 @@ export const CippWizard = (props) => { onPreviousStep={handleBack} formControl={formControl} lastStep={stepsWithVisibility.length - 1} - currentStep={activeStep} + currentStep={boundedStep} postUrl={postUrl} options={currentStep.componentProps?.options} title={currentStep.componentProps?.title} @@ -62,23 +76,59 @@ export const CippWizard = (props) => { {...currentStep.componentProps} /> ); - }, [activeStep, handleNext, handleBack, stepsWithVisibility, formControl, postUrl]); + }, [boundedStep, handleNext, handleBack, stepsWithVisibility, formControl, postUrl]); // Get the maxWidth for the current step, fallback to global setting const currentStepMaxWidth = useMemo(() => { - const currentStep = stepsWithVisibility[activeStep]; + const currentStep = stepsWithVisibility[boundedStep]; return currentStep.maxWidth ?? contentMaxWidth; - }, [activeStep, stepsWithVisibility, contentMaxWidth]); + }, [boundedStep, stepsWithVisibility, contentMaxWidth]); + + // Calculate progress percentage + const progressPercentage = useMemo(() => { + return ((boundedStep + 1) / stepsWithVisibility.length) * 100; + }, [boundedStep, stepsWithVisibility.length]); + + // Get summary of selected values for display + const selectedSummary = useMemo(() => { + const summary = []; + const tenant = formWatcher?.tenantFilter; + const user = formWatcher?.user; + + if (tenant?.label || tenant?.value) { + summary.push({ label: "Tenant", value: tenant.label || tenant.value }); + } + if (user) { + const userCount = Array.isArray(user) ? user.length : 1; + summary.push({ label: "Users", value: `${userCount} selected` }); + } + return summary; + }, [formWatcher?.tenantFilter, formWatcher?.user]); return ( - + + {/* Phone progress. Desktop keeps the stepper; this bar is the mobile replacement. */} + {smDown && ( + + )} + {orientation === "vertical" ? ( - - + + @@ -89,28 +139,44 @@ export const CippWizard = (props) => { ) : ( - + {/* 48px under a three-line stepper is right; under the compact mobile header it is dead space. */} - -
        + + + {/* Selection summary chips - hidden on mobile as info is shown differently */} + {selectedSummary.length > 0 && activeStep > 0 && !smDown && ( + + {selectedSummary.map((item) => ( + + ))} + + )} + + {/* Below md this Container clamps nothing — maxWidth is md/lg — and its gutters only duplicate the ones CardContent already pays. disableGutters with px at md restores exactly Container's own value from md up. */} - + {content} -
        +         )} diff --git a/frontend/src/components/CippWizard/CippWizardAutoComplete.jsx b/frontend/src/components/CippWizard/CippWizardAutoComplete.jsx index 7012b80c5a..ae49c3826b 100644 --- a/frontend/src/components/CippWizard/CippWizardAutoComplete.jsx +++ b/frontend/src/components/CippWizard/CippWizardAutoComplete.jsx @@ -1,6 +1,8 @@ -import { Stack } from "@mui/material"; +import { Stack, Typography, useMediaQuery, Box, alpha } from "@mui/material"; +import { useTheme } from "@mui/material/styles"; import { CippWizardStepButtons } from "./CippWizardStepButtons"; import CippFormComponent from "../CippComponents/CippFormComponent"; +import { People } from "@mui/icons-material"; export const CippWizardAutoComplete = (props) => { const { @@ -13,19 +15,51 @@ export const CippWizardAutoComplete = (props) => { formControl, currentStep, onPreviousStep, + icon: CustomIcon, + subtext, } = props; const currentTenant = formControl.watch("tenantFilter"); + const theme = useTheme(); + const smDown = useMediaQuery(theme.breakpoints.down("sm")); + + // Use custom icon if provided, otherwise default to People + const IconComponent = CustomIcon || People; return ( - - + + {/* Header - more compact on mobile */} + + + + + + {title} + + {!smDown && ( + + {subtext || (type === "single" ? "Choose an option to continue" : "Choose one or more options to continue")} + + )} + { confirmText: 'Are you sure you want to delete this row?', customFunction: handleRemoveItem, noConfirm: true, + category: 'danger', }, ] diff --git a/frontend/src/components/CippWizard/CippWizardBulkOptions.jsx b/frontend/src/components/CippWizard/CippWizardBulkOptions.jsx new file mode 100644 index 0000000000..e0903ebe8d --- /dev/null +++ b/frontend/src/components/CippWizard/CippWizardBulkOptions.jsx @@ -0,0 +1,191 @@ +import { + Stack, + Box, + Typography, + Card, + CardContent, + alpha, + useMediaQuery, +} from "@mui/material"; +import { useTheme } from "@mui/material/styles"; +import { Grid } from "@mui/system"; +import CippWizardStepButtons from "./CippWizardStepButtons"; +import CippFormComponent from "../CippComponents/CippFormComponent"; +import { CippFormDomainSelector } from "../CippComponents/CippFormDomainSelector"; +import countryList from "../../data/countryList.json"; +import { CippFormLicenseSelector } from "../CippComponents/CippFormLicenseSelector"; +import { Tune, Public, CardMembership, Security, Domain } from "@mui/icons-material"; + +export const CippWizardBulkOptions = (props) => { + const { postUrl, formControl, onPreviousStep, onNextStep, currentStep } = props; + const theme = useTheme(); + const smDown = useMediaQuery(theme.breakpoints.down("sm")); + + return ( + + {/* Header */} + + + + + + Bulk Options + + + Configure usage location and license assignments for users + + + + + + + + + + + + + Primary Domain + + + + + This domain will be used for all users that don't have a domain specified in the CSV + + + + + + + + + Usage Location + + + ({ + label: Name, + value: Code, + }))} + formControl={formControl} + /> + + + + + + + + License Assignment + + + + + + + + + + + Security Options + + + + + Disabling IMAP and POP improves mailbox security by blocking insecure authentication methods + + + + + + + + + ); +}; diff --git a/frontend/src/components/CippWizard/CippWizardCSVImport.jsx b/frontend/src/components/CippWizard/CippWizardCSVImport.jsx index 41ce19ee3d..3e25dc55c1 100644 --- a/frontend/src/components/CippWizard/CippWizardCSVImport.jsx +++ b/frontend/src/components/CippWizard/CippWizardCSVImport.jsx @@ -1,10 +1,26 @@ -import { Button, Link, Stack, Dialog, DialogActions, DialogContent, DialogTitle } from "@mui/material"; -import { CippIcons } from "../../utils/icon-registry" +import { + Button, + Link, + Stack, + Dialog, + DialogActions, + DialogContent, + DialogTitle, + Box, + Typography, + Card, + CardContent, + Chip, + alpha, + useMediaQuery, +} from "@mui/material"; +import { useTheme } from "@mui/material/styles"; import { Grid } from "@mui/system"; import { CippWizardStepButtons } from "./CippWizardStepButtons"; import CippFormComponent from "../CippComponents/CippFormComponent"; import { CippDataTable } from "../CippTable/CippDataTable"; import { useWatch } from "react-hook-form"; +import { Delete, UploadFile, Add, Download, TableChart } from "@mui/icons-material"; import { useEffect, useState } from "react"; import { getCippTranslation } from "../../utils/get-cipp-translation"; @@ -20,6 +36,8 @@ export const CippWizardCSVImport = (props) => { nameToCSVMapping, fileName = "BulkUser", } = props; + const theme = useTheme(); + const smDown = useMediaQuery(theme.breakpoints.down("sm")); const tableData = useWatch({ control: formControl.control, name: name }); const [newTableData, setTableData] = useState([]); const [open, setOpen] = useState(false); @@ -55,71 +73,162 @@ export const CippWizardCSVImport = (props) => { const actions = [ { - icon: , + icon: , label: "Delete Row", confirmText: "Are you sure you want to delete this row?", customFunction: handleRemoveItem, noConfirm: true, + category: "danger", }, ]; + const rowCount = tableData?.length || 0; + return ( - - - Download Example CSV - - + + {/* Header */} + + + + + + Import Data + + + Upload a CSV file or manually add entries below + + + + {/* Upload Card */} + + + + + + + + + CSV Upload + + + + + + + + + + + {/* Manual Entry */} {manualFields && ( - - {fields.map((field) => ( - <> - - { - if (e.key === "Enter") { - if (e.target.value === "") return false; - handleAddItem(); - setTimeout(() => { - formControl.setValue(`addrow.${field}`, ""); - }, 500); - } - }} - /> + + + + + + + + Manual Entry + + + + + + {fields.map((field) => ( + + { + if (e.key === "Enter") { + if (e.target.value === "") return false; + handleAddItem(); + setTimeout(() => { + formControl.setValue(`addrow.${field}`, ""); + }, 500); + } + }} + /> + + ))} + + - - ))} - - - - + +         +         )} + {!manualFields && ( - <> - - - - - - setOpen(false)}> - Add a new row + + + setOpen(false)} maxWidth="sm" fullWidth> + Add New Entry - + {fields.map((field) => ( { ))} - + - - + )} - + {/* Data Preview */} + + + + + + + + + Data Preview + + + 0 ? "success" : "default"} + variant="outlined" + /> + + + + + { + const keyLower = key.toLowerCase(); + if (keyLower.includes('email') || keyLower.includes('mail') || keyLower.includes('forward') || keyLower.includes('ooo')) { + return ; + } + if (keyLower.includes('schedule') || keyLower.includes('date') || keyLower.includes('time')) { + return ; + } + if (keyLower.includes('security') || keyLower.includes('mfa') || keyLower.includes('password') || keyLower.includes('session')) { + return ; + } + if (keyLower.includes('license') || keyLower.includes('group') || keyLower.includes('access')) { + return ; + } + return ; +}; + +// PowerShell type patterns that indicate unserialized data +const powershellTypePatterns = [ + "System.Collections.Hashtable", + "System.Object[]", + "System.Collections.ArrayList", + "System.Collections.Generic.List", + "System.Collections.Generic.Dictionary", + "System.Management.Automation.PSCustomObject", +]; + +// Helper to check if a value is an unserialized PowerShell type +const isPowerShellTypeString = (value) => { + if (typeof value !== 'string') return false; + return powershellTypePatterns.some(pattern => value.includes(pattern)); +}; + +// Helper to format value for display +const formatDisplayValue = (value, key) => { + if (value === true) return { text: "Yes", isBoolean: true, enabled: true }; + if (value === false) return { text: "No", isBoolean: true, enabled: false }; + if (value === null || value === undefined) return { text: "Not set", isBoolean: false }; + + // Handle PowerShell type strings that weren't properly serialized + if (isPowerShellTypeString(value)) { + return { text: "Complex data", isBoolean: false }; + } + + if (typeof value === 'object') { + if (Array.isArray(value)) { + return { text: `${value.length} item${value.length !== 1 ? 's' : ''} selected`, isBoolean: false }; + } + if (value.label) return { text: value.label, isBoolean: false }; + if (value.value) return { text: value.value, isBoolean: false }; + } + return { text: String(value), isBoolean: false }; +}; export const CippWizardConfirmation = (props) => { const { @@ -23,10 +95,15 @@ export const CippWizardConfirmation = (props) => { onPreviousStep, onNextStep, currentStep, - jobProgress, // Optional live progress polling after submit, see CippApiResults - columns = 2 // Default to 2 columns for backward compatibility + columns = 2, + replacementBehaviour, + queryKeys, + jobProgress, } = props; + const theme = useTheme(); + const smDown = useMediaQuery(theme.breakpoints.down("sm")); + const mdDown = useMediaQuery(theme.breakpoints.down("md")); const formValues = formControl.getValues(); const formEntries = Object.entries(formValues); @@ -40,13 +117,21 @@ export const CippWizardConfirmation = (props) => { "RAWJson", "TemplateList", "addrow", + "Scheduled", + "postExecution", + "userTemplate", // Contains template object with addedFields + "userProperties", // Contains copied user properties + "copyFrom", // User selector for copying groups + "defaultAttributes", // Complex custom attributes object + "customData", // Custom data mappings ]; - // Filter out null values and undefined values which could be from hidden conditional fields + // Filter and categorize entries const filteredFormEntries = formEntries.filter( - ([_, value]) => value !== null && value !== undefined + ([key, value]) => value !== null && value !== undefined && !key.startsWith('HIDDEN_') ); + // Extract special entries const tenantEntry = filteredFormEntries.find( ([key]) => key === "tenantFilter" || key === "tenant" ); @@ -54,108 +139,285 @@ export const CippWizardConfirmation = (props) => { ["user", "userPrincipalName", "username"].includes(key) ); - const filteredEntries = formEntries.filter( - ([key]) => + // Get scheduling info + const scheduledEnabled = formValues?.Scheduled?.enabled; + const scheduledDate = formValues?.Scheduled?.date; + + // Filter settings entries (boolean switches and other settings) + const settingsEntries = formEntries.filter( + ([key, value]) => !blacklist.includes(key) && key !== "tenantFilter" && key !== "tenant" && !["user", "userPrincipalName", "username"].includes(key) && - !key.startsWith('HIDDEN_') + !key.startsWith('HIDDEN_') && + value !== null && + value !== undefined && + !isPowerShellTypeString(value) // Filter out unserialized PowerShell types ); - // Calculate total entries including special ones for even distribution - const totalEntries = filteredEntries.length + (tenantEntry ? 1 : 0) + (userEntry ? 1 : 0); + // Separate boolean settings from other settings + const booleanSettings = settingsEntries.filter(([_, value]) => typeof value === 'boolean'); + const otherSettings = settingsEntries.filter(([_, value]) => + typeof value !== 'boolean' && !isPowerShellTypeString(value) + ); - // Dynamically split entries based on columns prop with special entries distributed - const splitEntries = () => { - const result = Array.from({ length: columns }, () => []); + // Count enabled settings + const enabledCount = booleanSettings.filter(([_, value]) => value === true).length; - // Add special entries to different columns first - if (tenantEntry) { - result[0].push(tenantEntry); - } - if (userEntry && result[1]) { - result[1].push(userEntry); - } - - // Distribute remaining entries across columns to balance them - filteredEntries.forEach((entry) => { - // Find the column with the fewest entries - let targetColumn = 0; - let minLength = result[0].length; - - for (let i = 1; i < columns; i++) { - if (result[i].length < minLength) { - minLength = result[i].length; - targetColumn = i; - } - } - - result[targetColumn].push(entry); - }); - - return result; + // Get user count + const getUserCount = () => { + const user = userEntry?.[1]; + if (!user) return 0; + if (Array.isArray(user)) return user.length; + return 1; }; - const columnEntries = splitEntries(); - - // Calculate Grid sizes based on number of columns - const getGridSize = () => { - const sizes = { - 1: { lg: 12, md: 12, xs: 12 }, - 2: { lg: 6, md: 6, xs: 12 }, - 3: { lg: 4, md: 6, xs: 12 }, - 4: { lg: 3, md: 6, xs: 12 }, - 6: { lg: 2, md: 4, xs: 12 }, - }; - - return sizes[columns] || sizes[2]; // Default to 2 columns - }; + return ( + + {/* Header */} + + + + + + Ready to Submit + + + Review your selections below before submitting + + - const gridSize = getGridSize(); + {/* Target Summary Card */} + {(tenantEntry || userEntry) && ( + + + {tenantEntry && ( + + + + + + + + Target Tenant + + + {tenantEntry[1]?.label || tenantEntry[1]?.value || tenantEntry[1]} + + + + + )} + {userEntry && ( + + + + + + + + {getUserCount() === 1 ? 'Target User' : 'Target Users'} + + + {getUserCount()} {getUserCount() === 1 ? 'user' : 'users'} selected + + + + + )} + + + )} - // The summary folds away on submit so the results and any live progress take the space. - const [summaryOpen, setSummaryOpen] = useState(true); + {/* Scheduling Info */} + {scheduledEnabled && ( + + + + + + + + Scheduled Execution + + + {scheduledDate ? new Date(scheduledDate * 1000).toLocaleString() : 'Date not set'} + + + + + )} - return ( - - {filteredEntries.length === 0 ? ( + {/* Settings Summary */} + {booleanSettings.length > 0 && ( - - - You've completed the steps in this wizard. Hit submit to save your changes. - - + + + + + + Settings + + + 0 ? "primary" : "default"} + variant="outlined" + /> + + + + + {booleanSettings.map(([key, value]) => ( + 2 ? 4 : 6 }}> + + {value ? ( + + ) : ( + + )} + + {getCippTranslation(key)} + + + + ))} + + + + )} + + {/* Other Settings */} + {otherSettings.length > 0 && ( + + + + + + Additional Options + + + + + {otherSettings.map(([key, value], index) => { + const formatted = formatDisplayValue(value, key); + return ( + + + {getSettingIcon(key)} + + + + ); + })} + - ) : ( - setSummaryOpen(open)} + )} + + {/* Empty state */} + {settingsEntries.length === 0 && !tenantEntry && !userEntry && ( + - }> - Selected options - - - - {columnEntries.map((columnData, index) => ( - - - {columnData.map(([key, value]) => ( - - ))} - - - ))} - - - + + + You've completed all the steps. Click submit to save your changes. + + )} { onNextStep={onNextStep} formControl={formControl} noSubmitButton={formValues?.noSubmitButton} + replacementBehaviour={replacementBehaviour} + queryKeys={queryKeys} jobProgress={jobProgress} - onSubmit={() => setSummaryOpen(false)} /> ); diff --git a/frontend/src/components/CippWizard/CippWizardOffboarding.jsx b/frontend/src/components/CippWizard/CippWizardOffboarding.jsx index 3252dc835d..2d7c5be96c 100644 --- a/frontend/src/components/CippWizard/CippWizardOffboarding.jsx +++ b/frontend/src/components/CippWizard/CippWizardOffboarding.jsx @@ -1,5 +1,6 @@ import { Alert, + AlertTitle, Box, Stack, Typography, @@ -16,9 +17,11 @@ import { useEffect, useMemo, useState } from 'react' import { Grid } from '@mui/system' import { useSettings } from '../../hooks/use-settings' import { ApiGetCall } from '../../api/ApiCall' - -// Shared mailboxes are capped at 50 GiB without a license; warn at 49 GiB. -const SHARED_MAILBOX_WARN_BYTES = 49 * 1024 ** 3 +import CippRiskAlert from '../CippComponents/CippRiskAlert' +import { + getSharedMailboxLicenseReasons, + useSharedMailboxLicenseData, +} from '../CippComponents/CippSharedMailboxLicenseAlert' export const CippWizardOffboarding = (props) => { const { postUrl, formControl, onPreviousStep, onNextStep, currentStep } = props @@ -29,6 +32,10 @@ export const CippWizardOffboarding = (props) => { const userOffboardingDefaults = settings?.offboardingDefaults const disableForwarding = useWatch({ control: formControl.control, name: 'disableForwarding' }) const deleteUser = useWatch({ control: formControl.control, name: 'DeleteUser' }) + const watchRemoveGroups = useWatch({ control: formControl.control, name: 'RemoveGroups' }) + const watchRemoveLicenses = useWatch({ control: formControl.control, name: 'RemoveLicenses' }) + const watchClearImmutableId = useWatch({ control: formControl.control, name: 'ClearImmutableId' }) + const watchRemoveMFADevices = useWatch({ control: formControl.control, name: 'RemoveMFADevices' }) const convertToShared = useWatch({ control: formControl.control, name: 'ConvertToShared' }) // The HaloPSA ticket box is only meaningful when that integration is configured. @@ -52,16 +59,13 @@ export const CippWizardOffboarding = (props) => { !notificationSettings.isLoading && notificationSettings.data?.sendtoIntegration !== true - // Pull cached mailbox sizes (storageUsedInBytes, keyed by UPN) only when relevant - const mailboxUsage = ApiGetCall({ - url: '/api/ListMailboxes', - data: { tenantFilter: currentTenant?.value, UseReportDB: true }, - queryKey: `OffboardingMailboxUsage-${currentTenant?.value}`, - waiting: !!convertToShared && !!currentTenant?.value && selectedUsers?.length > 0, - }) + const mailboxUsage = useSharedMailboxLicenseData( + currentTenant?.value, + !!convertToShared && selectedUsers?.length > 0, + ) - // Selected mailboxes whose cached size would exceed the shared-mailbox limit - const oversizedMailboxes = useMemo(() => { + // Selected mailboxes that still need a license once shared: primary or archive at the 50 GB limit, or litigation hold + const mailboxesNeedingLicense = useMemo(() => { if (!convertToShared || !mailboxUsage.isSuccess || !Array.isArray(mailboxUsage.data)) { return [] } @@ -69,20 +73,9 @@ export const CippWizardOffboarding = (props) => { (u?.value ?? u)?.toString().toLowerCase(), ) return mailboxUsage.data - .filter((mb) => { - const upn = mb?.UPN?.toString().toLowerCase() - const bytes = Number(mb?.storageUsedInBytes) - return ( - upn && - selectedUpns.includes(upn) && - Number.isFinite(bytes) && - bytes >= SHARED_MAILBOX_WARN_BYTES - ) - }) - .map((mb) => ({ - upn: mb.UPN, - sizeGB: (Number(mb.storageUsedInBytes) / 1024 ** 3).toFixed(1), - })) + .filter((mb) => selectedUpns.includes(mb?.UPN?.toString().toLowerCase())) + .map((mb) => ({ upn: mb.UPN, reasons: getSharedMailboxLicenseReasons(mb) })) + .filter((mb) => mb.reasons.length > 0) }, [convertToShared, mailboxUsage.isSuccess, mailboxUsage.data, selectedUsers]) useEffect(() => { @@ -197,6 +190,21 @@ export const CippWizardOffboarding = (props) => { formControl={formControl} disabled={!!deleteUser} /> + {convertToShared && mailboxesNeedingLicense.length > 0 && ( + + Keep a license on these mailboxes + A shared mailbox needs a license if its mailbox or archive is over 50 GB, or it is on + litigation hold. Unless a license is kept, converting may fail or the mailbox may + stop receiving mail: + + {mailboxesNeedingLicense.map((mb) => ( +
      • + {mb.upn} ({mb.reasons.join('; ')}) +
        • + ))} +         +         + )} { formControl={formControl} disabled={!!deleteUser} /> + { formControl={formControl} disabled={!!deleteUser} /> + { formControl={formControl} disabled={!!deleteUser} /> + { formControl={formControl} disabled={!!deleteUser} /> + { type="switch" formControl={formControl} /> + {deleteUser && ( Deleting the user will remove the associated mailbox, this will prevent actions @@ -544,25 +587,10 @@ export const CippWizardOffboarding = (props) => { display: 'block', mt: 1 }}> - CIPP %variable% tokens (for example %tenantname%) stay literal here and are + Manage365 %variable% tokens (for example %tenantname%) stay literal here and are resolved when the offboarding job runs. %username% is not the offboarded user.         - {convertToShared && oversizedMailboxes.length > 0 && ( - - The following mailbox{oversizedMailboxes.length > 1 ? 'es' : ''} exceed or are near - the 50 GB shared mailbox limit. Converting to shared may fail, or the mailbox may - stop receiving mail once unlicensed, unless an Exchange Online Plan 2 license is - retained: - - {oversizedMailboxes.map((mb) => ( -
      • - {mb.upn} ({mb.sizeGB} GB) -
        • - ))} -         -         - )} diff --git a/frontend/src/components/CippWizard/CippWizardOptionsList.jsx b/frontend/src/components/CippWizard/CippWizardOptionsList.jsx index 206e1cbf84..c8fc72ab95 100644 --- a/frontend/src/components/CippWizard/CippWizardOptionsList.jsx +++ b/frontend/src/components/CippWizard/CippWizardOptionsList.jsx @@ -1,6 +1,17 @@ -import { Avatar, Card, CardContent, Stack, SvgIcon, Typography } from "@mui/material"; +import { + Box, + Card, + CardContent, + Stack, + SvgIcon, + Typography, + alpha, + useMediaQuery, +} from "@mui/material"; +import { useTheme } from "@mui/material/styles"; import { useEffect, useState } from "react"; import { CippWizardStepButtons } from "./CippWizardStepButtons"; +import { Checklist, Check } from "@mui/icons-material"; export const CippWizardOptionsList = (props) => { const { @@ -13,7 +24,10 @@ export const CippWizardOptionsList = (props) => { onPreviousStep, name = "selectedOption", } = props; + const theme = useTheme(); + const smDown = useMediaQuery(theme.breakpoints.down("sm")); const [selectedOption, setSelectedOption] = useState(null); + // Register the name field in react-hook-form formControl.register(name, { required: true, @@ -38,54 +52,125 @@ export const CippWizardOptionsList = (props) => { }; return ( - - - {title} - + + {/* Header */} + + + + + + {title} + + {subtext} - - + + + {/* Options */} + {options.map((option) => { - const isSelected = selectedOption === option.value; // Check if the option is selected + const isSelected = selectedOption === option.value; return ( handleOptionClick(option.value)} // Handle option click + onClick={() => handleOptionClick(option.value)} variant="outlined" sx={{ cursor: "pointer", + transition: "all 0.2s ease-in-out", + position: "relative", + overflow: "visible", ...(isSelected && { - boxShadow: (theme) => `0px 0px 0px 2px ${theme.palette.primary.main}`, + borderColor: "primary.main", + borderWidth: 2, + bgcolor: alpha(theme.palette.primary.main, 0.02), }), "&:hover": { - ...(isSelected ? {} : { boxShadow: 8 }), // Hover effect + borderColor: isSelected ? "primary.main" : "primary.light", + transform: "translateY(-2px)", + boxShadow: theme.shadows[4], }, }} > - - - + + + )} + + + - {option.icon} - - - {option.label} - {option.description} + {option.icon} + + + + {option.label} + + + {option.description} + @@ -93,6 +178,7 @@ export const CippWizardOptionsList = (props) => { ); })} + { - const router = useRouter(); const { postUrl, initialState, diff --git a/frontend/src/components/CippWizard/CippWizardStepButtons.jsx b/frontend/src/components/CippWizard/CippWizardStepButtons.jsx index 891f164bc1..4f8a401eb8 100644 --- a/frontend/src/components/CippWizard/CippWizardStepButtons.jsx +++ b/frontend/src/components/CippWizard/CippWizardStepButtons.jsx @@ -1,8 +1,10 @@ -import { Button } from "@mui/material"; +import { Button, useMediaQuery, Box, CircularProgress } from "@mui/material"; +import { useTheme } from "@mui/material/styles"; import { useFormState } from "react-hook-form"; import { createPortal } from "react-dom"; import { ApiPostCall } from "../../api/ApiCall"; import { CippApiResults } from "../CippComponents/CippApiResults"; +import { ArrowBack, ArrowForward, Check, Refresh } from "@mui/icons-material"; import { useCippWizardDialog } from "./CippWizardDialogContext"; import { CippWizardActionsRow } from "./CippWizardActionsRow"; @@ -19,10 +21,13 @@ export const CippWizardStepButtons = (props) => { nextButtonDisabled = false, replacementBehaviour, queryKeys, + sticky = false, jobProgress, onSubmit, ...other } = props; + const theme = useTheme(); + const smDown = useMediaQuery(theme.breakpoints.down("sm")); const { isValid, isSubmitted, isSubmitting } = useFormState({ control: formControl.control }); const dialogContext = useCippWizardDialog(); const mergedQueryKeys = [ @@ -50,7 +55,13 @@ export const CippWizardStepButtons = (props) => { sendForm.mutate({ url: postUrl, data: newData }); }; - const buttonStack = ( + // Mobile-optimized button styles with proper touch targets (min 44px) + const mobileButtonSx = { + minHeight: 48, + fontSize: "1rem", + }; + + const buttonContent = ( {dialogContext?.onClose && ( )} {currentStep > 0 && ( - )} @@ -75,14 +94,33 @@ export const CippWizardStepButtons = (props) => { onClick={onNextStep} type="submit" variant="contained" + fullWidth={smDown} + endIcon={} + sx={smDown ? mobileButtonSx : {}} > Next Step )} {!noSubmitButton && currentStep === lastStep && ( -
        -
        )} @@ -102,7 +140,32 @@ export const CippWizardStepButtons = (props) => { return ( <> - {dialogContext?.actionsEl ? createPortal(buttonStack, dialogContext.actionsEl) : buttonStack} + {dialogContext?.actionsEl ? ( + createPortal(buttonContent, dialogContext.actionsEl) + ) : sticky ? ( + + {buttonContent} + + ) : ( + + {buttonContent} + + )} ); }; diff --git a/frontend/src/components/CippWizard/CippWizardVacationActions.jsx b/frontend/src/components/CippWizard/CippWizardVacationActions.jsx index cdf8130ea2..7a2170e04c 100644 --- a/frontend/src/components/CippWizard/CippWizardVacationActions.jsx +++ b/frontend/src/components/CippWizard/CippWizardVacationActions.jsx @@ -1,6 +1,7 @@ -import { useEffect } from 'react' +import { useEffect, useState } from 'react' import { Alert, + Chip, Skeleton, Stack, Typography, @@ -14,6 +15,7 @@ import CippWizardStepButtons from './CippWizardStepButtons' import CippFormComponent from '../CippComponents/CippFormComponent' import { CippFormCondition } from '../CippComponents/CippFormCondition' import { CippFormUserSelector } from '../CippComponents/CippFormUserSelector' +import { CippFormGroupSelector } from '../CippComponents/CippFormGroupSelector' import { useWatch } from 'react-hook-form' import { ApiGetCall } from '../../api/ApiCall' import { getCippValidator } from '../../utils/get-cipp-validator' @@ -25,6 +27,9 @@ export const CippWizardVacationActions = (props) => { const currentTenant = useWatch({ control: formControl.control, name: 'tenantFilter' }) const tenantDomain = currentTenant?.value || currentTenant + const tenantId = currentTenant?.value ?? currentTenant + const [droppedPolicies, setDroppedPolicies] = useState([]) + const enableCA = useWatch({ control: formControl.control, name: 'enableCAExclusion' }) const enableLocationAlertExclusion = useWatch({ control: formControl.control, @@ -33,13 +38,41 @@ export const CippWizardVacationActions = (props) => { const enableMailbox = useWatch({ control: formControl.control, name: 'enableMailboxPermissions' }) const enableForwarding = useWatch({ control: formControl.control, name: 'enableForwarding' }) const enableOOO = useWatch({ control: formControl.control, name: 'enableOOO' }) + const enableGroupMembership = useWatch({ + control: formControl.control, + name: 'enableGroupMembership', + }) + const vacationGroups = useWatch({ control: formControl.control, name: 'vacationGroups' }) + const dynamicGroups = (Array.isArray(vacationGroups) ? vacationGroups : []).filter((group) => + group?.addedFields?.groupTypes?.includes('DynamicMembership') + ) const atLeastOneEnabled = - enableCA || enableLocationAlertExclusion || enableMailbox || enableForwarding || enableOOO + enableCA || + enableLocationAlertExclusion || + enableMailbox || + enableForwarding || + enableOOO || + enableGroupMembership const users = useWatch({ control: formControl.control, name: 'Users' }) const firstUser = Array.isArray(users) && users.length > 0 ? users[0] : null const firstUserUpn = firstUser?.addedFields?.userPrincipalName || firstUser?.value || null const forwardOption = useWatch({ control: formControl.control, name: 'forwardOption' }) + const createTravelPolicy = useWatch({ control: formControl.control, name: 'createTravelPolicy' }) + const addUsageLocation = useWatch({ control: formControl.control, name: 'addUsageLocation' }) + const defaultsSource = useWatch({ control: formControl.control, name: 'HIDDEN_defaultsSource' }) + + // Same query key as the policy picker, so this shares its cache entry. + const caPolicies = ApiGetCall({ + url: '/api/ListGraphRequest', + data: { + tenantFilter: tenantDomain, + Endpoint: 'conditionalAccess/policies', + AsApp: true, + }, + queryKey: `ListConditionalAccessPolicies-${tenantDomain}`, + waiting: !!tenantDomain, + }) const oooData = ApiGetCall({ url: '/api/ListOoO', @@ -117,6 +150,75 @@ export const CippWizardVacationActions = (props) => { } }, [oooData.isSuccess, oooData.data, formControl]) + // Apply tenant defaults once per tenant; later edits by the technician are never overwritten. + useEffect(() => { + if (!tenantId || formControl.getValues('HIDDEN_appliedDefaultsForTenant') === tenantId) return + const defaults = currentTenant?.addedFields?.vacationDefaults + setDroppedPolicies([]) + if (defaults) { + const policies = Array.isArray(defaults.PolicyId) ? defaults.PolicyId : [] + formControl.setValue('enableCAExclusion', policies.length > 0) + formControl.setValue('PolicyId', policies) + formControl.setValue('createTravelPolicy', !!defaults.createTravelPolicy) + formControl.setValue('addUsageLocation', !!defaults.addUsageLocation) + formControl.setValue('excludeLocationAuditAlerts', !!defaults.excludeLocationAuditAlerts) + formControl.setValue('HIDDEN_defaultsSource', 'tenant') + } else { + formControl.setValue('HIDDEN_defaultsSource', null) + } + formControl.setValue('HIDDEN_appliedDefaultsForTenant', tenantId) + }, [tenantId, currentTenant, formControl]) + + // Drop default policies that no longer exist, but only once the policy list has really loaded. + useEffect(() => { + const policyList = caPolicies.data?.Results + if ( + !tenantId || + defaultsSource !== 'tenant' || + formControl.getValues('HIDDEN_staleCheckedForTenant') === tenantId || + !caPolicies.isSuccess || + caPolicies.isFetching || + !Array.isArray(policyList) || + policyList.length === 0 + ) { + return + } + const known = new Set(policyList.map((policy) => policy.id)) + const selected = formControl.getValues('PolicyId') || [] + const dropped = selected.filter((policy) => !known.has(policy.value)) + if (dropped.length > 0) { + formControl.setValue( + 'PolicyId', + selected.filter((policy) => known.has(policy.value)) + ) + setDroppedPolicies(dropped.map((policy) => policy.label || policy.value)) + } + formControl.setValue('HIDDEN_staleCheckedForTenant', tenantId) + }, [tenantId, defaultsSource, caPolicies.isSuccess, caPolicies.isFetching, caPolicies.data, formControl]) + + // Seed the users' home countries into the travel destinations, once per code, so a code the + // technician removes by hand is not added back. + useEffect(() => { + if (!createTravelPolicy || !addUsageLocation || !Array.isArray(users)) return + const validCodes = new Map(countryList.map(({ Code, Name }) => [Code, Name])) + const seeded = formControl.getValues('HIDDEN_seededUsageLocations') || [] + const fresh = [ + ...new Set( + users + .map((user) => user?.addedFields?.usageLocation?.toUpperCase()) + .filter((code) => validCodes.has(code) && !seeded.includes(code)) + ), + ] + if (fresh.length === 0) return + const current = formControl.getValues('travelCountries') || [] + const missing = fresh.filter((code) => !current.some((option) => option.value === code)) + formControl.setValue('travelCountries', [ + ...current, + ...missing.map((code) => ({ value: code, label: validCodes.get(code) })), + ]) + formControl.setValue('HIDDEN_seededUsageLocations', [...seeded, ...fresh]) + }, [users, createTravelPolicy, addUsageLocation, formControl]) + useEffect(() => { if (enableForwarding && !forwardOption) { formControl.setValue('forwardOption', 'internalAddress') @@ -128,7 +230,14 @@ export const CippWizardVacationActions = (props) => { {/* CA Policy Exclusion Section */} + Conditional Access Policy Exclusion + {defaultsSource === 'tenant' && ( + + )} +         + } subheader="Temporarily exclude users from a CA policy during their vacation" /> @@ -152,12 +261,17 @@ export const CippWizardVacationActions = (props) => { Vacation mode uses group-based exclusions for reliability. The exclusion group - follows the format: 'Vacation Exclusion - $Policy.displayName'. For - longer policy names the name is shortened and suffixed with the start of the - policy ID, e.g. 'Vacation Exclusion - CA005-RegisterSecurityInfo: Require... - [a1b2c3d4]' + follows the format: 'Vacation Exclusion - $Policy.displayName' + {droppedPolicies.length > 0 && ( + + + These default policies no longer exist in this tenant and were removed:{' '} + {droppedPolicies.join(', ')} + + + )} { policy named 'Travel Policy <users> - <start date> - <end date>' are created, blocking sign-ins for the selected users from every location except the travel destination. At the end date, the policy and - the named location are deleted automatically. + the named location are deleted automatically. Adding the users' home country + keeps them signed in from home. + + + { + {/* Group Membership Section */} + + + + + + + + + + + The users are added to the selected groups at the start date and removed again at + the end date. Users who are already members of a group are left untouched. + Dynamic membership groups cannot take direct members. + + + {dynamicGroups.length > 0 && ( + + {dynamicGroups.map((group) => group.label).join(', ')} use dynamic membership, + so the users cannot be added to them directly. + + )} + + + + + + {/* Mailbox Permissions Section */} { const mailboxVacation = ApiPostCall({ relatedQueryKeys: ['VacationMode'] }) const forwardingVacation = ApiPostCall({ relatedQueryKeys: ['VacationMode'] }) const oooVacation = ApiPostCall({ relatedQueryKeys: ['VacationMode'] }) + const groupMembershipVacation = ApiPostCall({ relatedQueryKeys: ['VacationMode'] }) const tenantFilter = values.tenantFilter?.value || values.tenantFilter const isSubmitting = @@ -34,13 +35,15 @@ export const CippWizardVacationConfirmation = (props) => { auditExclusion.isPending || mailboxVacation.isPending || forwardingVacation.isPending || - oooVacation.isPending + oooVacation.isPending || + groupMembershipVacation.isPending const hasSubmitted = caExclusion.isSuccess || auditExclusion.isSuccess || mailboxVacation.isSuccess || forwardingVacation.isSuccess || - oooVacation.isSuccess + oooVacation.isSuccess || + groupMembershipVacation.isSuccess const handleSubmit = () => { if (values.enableCAExclusion) { @@ -160,6 +163,21 @@ export const CippWizardVacationConfirmation = (props) => { data: oooData, }) } + + if (values.enableGroupMembership) { + groupMembershipVacation.mutate({ + url: '/api/ExecScheduleGroupMembershipVacation', + data: { + tenantFilter, + Users: values.Users, + Groups: values.vacationGroups, + startDate: values.startDate, + endDate: values.endDate, + reference: values.reference || null, + postExecution: values.postExecution || [], + }, + }) + } } const formatDate = (epoch) => { @@ -256,6 +274,7 @@ export const CippWizardVacationConfirmation = (props) => { values.enableMailboxPermissions, values.enableForwarding, values.enableOOO, + values.enableGroupMembership, ].filter(Boolean).length const mdSize = enabledCount >= 4 ? 3 : enabledCount === 3 ? 4 : enabledCount === 2 ? 6 : 12 return ( @@ -493,6 +512,35 @@ export const CippWizardVacationConfirmation = (props) => { )} + + {values.enableGroupMembership && ( + + + } + /> + + + +
        + + Groups + + {formatUsers(values.vacationGroups)} +
        + + Users who are already members are left untouched + +         +         +         +         + )} ); })()} @@ -503,6 +551,7 @@ export const CippWizardVacationConfirmation = (props) => { {values.enableMailboxPermissions && } {values.enableForwarding && } {values.enableOOO && } + {values.enableGroupMembership && } {/* Navigation + Custom Submit */} diff --git a/frontend/src/components/CippWizard/CustomerForm.jsx b/frontend/src/components/CippWizard/CustomerForm.jsx index 7eedc7a7e4..22097bfbfb 100644 --- a/frontend/src/components/CippWizard/CustomerForm.jsx +++ b/frontend/src/components/CippWizard/CustomerForm.jsx @@ -11,7 +11,7 @@ export const CustomerForm = (props) => { { name: "FirstName", label: "First Name", type: "textField", required: true }, { name: "LastName", label: "Last Name", type: "textField", required: true }, { name: "Email", label: "Email", type: "email", required: true }, - { name: "PhoneNumber", label: "Phone Number", type: "textField", required: true }, + { name: "PhoneNumber", label: "Phone Number", type: "phone", required: true, defaultCountry: "US" }, { name: "Country", label: "Country", type: "textField", required: true }, { name: "City", label: "City", type: "textField", required: true }, { name: "State", label: "State", type: "textField", required: true }, diff --git a/frontend/src/components/CippWizard/OnboardingWizardPage.jsx b/frontend/src/components/CippWizard/OnboardingWizardPage.jsx index e0a1775149..ba67962469 100644 --- a/frontend/src/components/CippWizard/OnboardingWizardPage.jsx +++ b/frontend/src/components/CippWizard/OnboardingWizardPage.jsx @@ -108,7 +108,7 @@ const OnboardingWizardPage = ({ mode, samAppPresent, completionButton }) => { componentProps: { title: 'Select your setup method', subtext: - 'This wizard will guide you through setting up CIPPs access to your client tenants. If this is your first time setting up CIPP you will want to choose the option "First Setup".', + "This wizard will guide you through setting up Manage365's access to your client tenants. If this is your first time setting up Manage365 you will want to choose the option \"First Setup\".", valuesKey: 'SyncTool', options: visibleOptions, }, diff --git a/frontend/src/components/CippWizard/TempFileCleanup/StepConfigureFilters.jsx b/frontend/src/components/CippWizard/TempFileCleanup/StepConfigureFilters.jsx new file mode 100644 index 0000000000..2698936301 --- /dev/null +++ b/frontend/src/components/CippWizard/TempFileCleanup/StepConfigureFilters.jsx @@ -0,0 +1,96 @@ +import { + Stack, + Typography, + FormGroup, + FormControlLabel, + Checkbox, + Button, + Box, + Paper, +} from "@mui/material"; + +const filterOptions = [ + { + key: "officeTemp", + label: "Office temp files (~$*)", + description: "Created when editing Word, Excel, PowerPoint", + defaultChecked: true, + }, + { + key: "tempFiles", + label: "Temporary files (*.TMP, *.temp)", + description: "System and app temp files", + defaultChecked: true, + }, + { + key: "zeroByteFiles", + label: "Zero-byte files", + description: "Empty files that serve no purpose", + defaultChecked: true, + }, + { + key: "systemJunk", + label: "System junk (Thumbs.db, .DS_Store, desktop.ini)", + description: "OS-generated metadata files", + defaultChecked: true, + }, + { + key: "backupFiles", + label: "Backup files (*.bak, *.old)", + description: "May be intentional - review carefully", + defaultChecked: false, + }, +]; + +export const StepConfigureFilters = ({ data, onUpdate, onNext, onBack }) => { + const handleFilterChange = (key) => (event) => { + onUpdate({ + filters: { + ...data.filters, + [key]: event.target.checked, + }, + }); + }; + + const hasAnyFilter = data.filters && Object.values(data.filters).some(Boolean); + + return ( + + + Select which file types to scan for. We recommend starting with the common ones. + + + + {filterOptions.map((option) => ( + + + } + label={ + + {option.label} + + {option.description} + + + } + /> + + ))} + + + + + + + + ); +}; + +export default StepConfigureFilters; diff --git a/frontend/src/components/CippWizard/TempFileCleanup/StepConfirmDelete.jsx b/frontend/src/components/CippWizard/TempFileCleanup/StepConfirmDelete.jsx new file mode 100644 index 0000000000..6de3f06c50 --- /dev/null +++ b/frontend/src/components/CippWizard/TempFileCleanup/StepConfirmDelete.jsx @@ -0,0 +1,235 @@ +import { + Stack, + Typography, + Button, + Box, + Card, + CardContent, + Checkbox, + FormControlLabel, + Alert, + Divider, + CircularProgress, + List, + ListItem, + ListItemIcon, + ListItemText, + Chip, +} from "@mui/material"; +import { DeleteForever, CheckCircle, Error as ErrorIcon, Warning } from "@mui/icons-material"; +import { useState } from "react"; +import { ApiPostCall } from "../../../api/ApiCall"; +import { getCippError } from "../../../utils/get-cipp-error"; + +const formatFileSize = (bytes) => { + if (bytes === 0 || bytes === null || bytes === undefined) return "0 B"; + const units = ["B", "KB", "MB", "GB", "TB"]; + const k = 1024; + const i = Math.floor(Math.log(bytes) / Math.log(k)); + const size = bytes / Math.pow(k, i); + return `${size.toFixed(i > 0 ? 2 : 0)} ${units[i]}`; +}; + +export const StepConfirmDelete = ({ data, onBack }) => { + const [confirmed, setConfirmed] = useState(false); + const [isDeleting, setIsDeleting] = useState(false); + const [results, setResults] = useState(null); + const [error, setError] = useState(null); + + // Defend against null entries (an empty array can serialize to JSON null on the Functions + // runtime and surface here as [null]). + const selectedFiles = (data.selectedFiles || []).filter(Boolean); + + const deleteMutation = ApiPostCall({ urlFromData: true }); + + const handleDelete = () => { + setIsDeleting(true); + setError(null); + + const fileCount = selectedFiles.length; + const deleteTimeoutMs = Math.min(300000, Math.max(120000, fileCount * 2000)); + + deleteMutation.mutate( + { + url: "/api/ExecTempFileCleanup", + timeout: deleteTimeoutMs, + data: { + tenantFilter: data.tenant?.value, + files: selectedFiles.map((f) => ({ + id: f.id, + driveId: f.driveId, + name: f.name, + })), + }, + }, + { + onSuccess: (response) => { + setIsDeleting(false); + setResults(response?.data); + }, + onError: (err) => { + setIsDeleting(false); + setError(getCippError(err) || "Deletion failed. Please try again."); + }, + } + ); + }; + + const selectedSize = selectedFiles.reduce((sum, f) => sum + (f?.size || 0), 0); + const affectedSites = [...new Set(selectedFiles.map((f) => f.SiteName).filter(Boolean))]; + + if (results) { + const summary = results.Summary; + const deleteResults = (results.Results || []).filter(Boolean); + const failedFiles = deleteResults.filter((r) => r.status === "failed"); + + return ( + + Cleanup Complete + + {summary && ( + 0 ? "warning" : "success"} + icon={summary.Failed > 0 ? : } + > + + Successfully deleted {summary.Success} of {summary.Total} files. + + {summary.Failed > 0 && ( + + {summary.Failed} file{summary.Failed !== 1 ? "s" : ""} could not be deleted. + + )} + + )} + + {error && ( + }> + {typeof error === "string" ? error : JSON.stringify(error)} + + )} + + {failedFiles.length > 0 && ( + + + + Failed Deletions + + + {failedFiles.slice(0, 10).map((file, idx) => ( + + + + + + + ))} + {failedFiles.length > 10 && ( + + ... and {failedFiles.length - 10} more + + )} + + + + )} + + + Deleted files can be recovered from the SharePoint/OneDrive recycle bin for 93 days. + + + ); + } + + return ( + + + Review and confirm the files to be deleted. + + + + + + + Files to delete: + + + + + Total size: + {formatFileSize(selectedSize)} + + + + Affected locations: + {affectedSites.length} + + {affectedSites.length > 0 && affectedSites.length <= 5 && ( + + {affectedSites.map((site) => ( + + {site} + + ))} + + )} + + + + + }> + This action will move the selected files to the recycle bin. This cannot be undone from + Manage365, but files can be restored manually from SharePoint/OneDrive for 93 days. + + + setConfirmed(e.target.checked)} + color="error" + disabled={isDeleting} + /> + } + label={ + + I understand these {selectedFiles.length} files will be moved to the recycle bin + + } + /> + + {error && ( + }> + {typeof error === "string" ? error : JSON.stringify(error)} + + )} + + + + + + + ); +}; + +export default StepConfirmDelete; diff --git a/frontend/src/components/CippWizard/TempFileCleanup/StepScanResults.jsx b/frontend/src/components/CippWizard/TempFileCleanup/StepScanResults.jsx new file mode 100644 index 0000000000..f85408c935 --- /dev/null +++ b/frontend/src/components/CippWizard/TempFileCleanup/StepScanResults.jsx @@ -0,0 +1,267 @@ +import { + Stack, + Typography, + Button, + Box, + LinearProgress, + Alert, + Card, + CardContent, +} from "@mui/material"; +import { useEffect, useState, useRef, useCallback } from "react"; +import { ApiGetCall, ApiPostCall } from "../../../api/ApiCall"; +import { getCippError } from "../../../utils/get-cipp-error"; + +const SCAN_TIMEOUT_MS = 30000; +const QUEUE_POLL_INTERVAL_MS = 3000; + +const formatFileSize = (bytes) => { + if (bytes === 0 || bytes === null || bytes === undefined) return "0 B"; + const units = ["B", "KB", "MB", "GB", "TB"]; + const k = 1024; + const i = Math.floor(Math.log(bytes) / Math.log(k)); + const size = bytes / Math.pow(k, i); + return `${size.toFixed(i > 0 ? 2 : 0)} ${units[i]}`; +}; + +export const StepScanResults = ({ data, onUpdate, onNext, onBack }) => { + const [isScanning, setIsScanning] = useState(false); + const [error, setError] = useState(null); + const [queueId, setQueueId] = useState(null); + const [fetchResults, setFetchResults] = useState(false); + const scanStartedRef = useRef(false); + + const scanMutation = ApiPostCall({}); + + const applyScanResults = useCallback( + (results) => { + setIsScanning(false); + // Defend against null entries (an empty array can serialize to JSON null on the + // Functions runtime, surfacing as [null] here). + const clean = Array.isArray(results) ? results.filter(Boolean) : []; + onUpdate({ + scanResults: clean, + selectedFiles: clean, + }); + }, + [onUpdate] + ); + + const queuePoll = ApiGetCall({ + url: "/api/ListCippQueue", + data: { QueueId: queueId }, + queryKey: `TempFileScanQueue-${queueId}`, + waiting: !!queueId && isScanning && !fetchResults, + refetchInterval: (pollData) => { + const status = pollData?.[0]?.Status; + if ( + status === "Completed" || + status === "Failed" || + status === "Completed (with errors)" + ) { + return false; + } + return QUEUE_POLL_INTERVAL_MS; + }, + refetchOnMount: true, + refetchOnWindowFocus: false, + }); + + const resultsPoll = ApiGetCall({ + url: "/api/ListTempFileScanResults", + data: { queueId, tenantFilter: data.tenant?.value }, + queryKey: `TempFileScanResults-${queueId}`, + waiting: fetchResults && !!queueId, + refetchInterval: (pollData) => { + if (pollData?.Status === "Completed" || pollData?.Results) { + return false; + } + return QUEUE_POLL_INTERVAL_MS; + }, + refetchOnMount: true, + refetchOnWindowFocus: false, + }); + + const startScan = () => { + setIsScanning(true); + setError(null); + setQueueId(null); + setFetchResults(false); + + scanMutation.mutate( + { + url: "/api/ExecTempFileScan", + timeout: SCAN_TIMEOUT_MS, + data: { + tenantFilter: data.tenant?.value, + scope: data.scope, + siteId: data.siteId?.value, + userId: data.userId?.value, + filters: data.filters, + }, + }, + { + onSuccess: (response) => { + const body = response?.data; + if (body?.Queued && body?.QueueId) { + setQueueId(body.QueueId); + return; + } + + const results = body?.Results || []; + applyScanResults(results); + }, + onError: (err) => { + setIsScanning(false); + const errorMsg = getCippError(err); + const status = err?.response?.status; + const statusText = err?.response?.statusText; + const isTimeout = + err?.code === "ECONNABORTED" || + /timeout/i.test(err?.message || "") || + status === 504; + + if (isTimeout) { + setError( + "The scan could not be started in time. Please try again." + ); + } else if (status) { + setError( + `${errorMsg || "Scan failed"} (HTTP ${status}${statusText ? `: ${statusText}` : ""})` + ); + } else { + setError( + errorMsg || err?.message || "Scan failed - please check your connection" + ); + } + }, + } + ); + }; + + useEffect(() => { + if (!scanStartedRef.current) { + scanStartedRef.current = true; + startScan(); + } + }, []); + + useEffect(() => { + const queueStatus = queuePoll.data?.[0]?.Status; + if (!queueStatus || !isScanning || fetchResults) return; + + if (queueStatus === "Completed") { + setFetchResults(true); + return; + } + + if (queueStatus === "Failed" || queueStatus === "Completed (with errors)") { + setIsScanning(false); + setError("Temp file scan failed. Please try again or choose a smaller scope."); + } + }, [queuePoll.data, isScanning, fetchResults]); + + useEffect(() => { + if (!fetchResults || !resultsPoll.data) return; + + const payload = resultsPoll.data; + if (payload?.Status === "Running") return; + + if (payload?.Status === "Completed" || Array.isArray(payload?.Results)) { + applyScanResults(payload.Results || []); + return; + } + + const errorMsg = getCippError({ response: { data: payload } }); + if (errorMsg) { + setIsScanning(false); + setError( + typeof errorMsg === "string" + ? errorMsg + : "Temp file scan failed. Please try again." + ); + } + }, [resultsPoll.data, fetchResults, applyScanResults]); + + const totalSize = + data.scanResults?.reduce((sum, file) => sum + (file?.size || 0), 0) || 0; + const fileCount = data.scanResults?.length || 0; + const queueStatus = queuePoll.data?.[0]?.Status; + const queueProgress = queuePoll.data?.[0]?.PercentComplete; + + return ( + + + {isScanning + ? "Scanning... Large sites may take several minutes." + : error + ? "Scan Failed" + : "Scan Complete"} + + + {isScanning && ( + + + + {queueId + ? queueStatus === "Running" || queueStatus === "Queued" + ? "Scan running in the background..." + : fetchResults + ? "Loading scan results..." + : "Searching for temp files..." + : "Starting scan..."} + + + )} + + {error && ( + + {error} + + + + + )} + + {!isScanning && !error && scanStartedRef.current && fileCount > 0 && ( + + + + Found {fileCount} file{fileCount !== 1 ? "s" : ""} ( + {formatFileSize(totalSize)}) + + + matching your criteria + + + + )} + + {!isScanning && fileCount === 0 && !error && scanStartedRef.current && ( + + No temp files found! Your storage is clean. + + )} + + + + + + + ); +}; + +export default StepScanResults; diff --git a/frontend/src/components/CippWizard/TempFileCleanup/StepSelectFiles.jsx b/frontend/src/components/CippWizard/TempFileCleanup/StepSelectFiles.jsx new file mode 100644 index 0000000000..74cea31370 --- /dev/null +++ b/frontend/src/components/CippWizard/TempFileCleanup/StepSelectFiles.jsx @@ -0,0 +1,383 @@ +import { + Stack, + Typography, + Button, + Box, + Chip, + TextField, + InputAdornment, + Paper, + Menu, + MenuItem, + Divider, +} from "@mui/material"; +import { Search, FilterList, CheckBox, CheckBoxOutlineBlank } from "@mui/icons-material"; +import { MaterialReactTable, useMaterialReactTable } from "material-react-table"; +import { useState, useMemo, useCallback } from "react"; + +const typeLabels = { + officeTemp: "Office Temp", + tempFiles: "Temp File", + zeroByteFiles: "Zero Byte", + systemJunk: "System Junk", + backupFiles: "Backup", +}; + +const typeColors = { + officeTemp: "primary", + tempFiles: "secondary", + zeroByteFiles: "warning", + systemJunk: "info", + backupFiles: "error", +}; + +const formatFileSize = (bytes) => { + if (bytes === 0 || bytes === null || bytes === undefined) return "0 B"; + const units = ["B", "KB", "MB", "GB", "TB"]; + const k = 1024; + const i = Math.floor(Math.log(bytes) / Math.log(k)); + const size = bytes / Math.pow(k, i); + return `${size.toFixed(i > 0 ? 1 : 0)} ${units[i]}`; +}; + +const formatDate = (dateString) => { + if (!dateString) return "-"; + try { + return new Date(dateString).toLocaleDateString(undefined, { + year: "numeric", + month: "short", + day: "numeric", + hour: "2-digit", + minute: "2-digit", + }); + } catch { + return dateString; + } +}; + +export const StepSelectFiles = ({ data, onUpdate, onNext, onBack }) => { + const [search, setSearch] = useState(""); + const [filterMenuAnchor, setFilterMenuAnchor] = useState(null); + + const scanResults = (data.scanResults || []).filter(Boolean); + const selectedFiles = (data.selectedFiles || []).filter(Boolean); + + const rowSelection = useMemo(() => { + const selection = {}; + selectedFiles.forEach((file) => { + selection[file.id] = true; + }); + return selection; + }, [selectedFiles]); + + const filteredFiles = useMemo(() => { + if (!search) return scanResults; + const searchLower = search.toLowerCase(); + return scanResults.filter( + (file) => + file.name?.toLowerCase().includes(searchLower) || + file.path?.toLowerCase().includes(searchLower) || + typeLabels[file.type]?.toLowerCase().includes(searchLower) + ); + }, [scanResults, search]); + + const handleRowSelectionChange = useCallback( + (updaterOrValue) => { + const newSelection = + typeof updaterOrValue === "function" ? updaterOrValue(rowSelection) : updaterOrValue; + + const newSelectedFiles = scanResults.filter((file) => newSelection[file.id]); + onUpdate({ selectedFiles: newSelectedFiles }); + }, + [scanResults, rowSelection, onUpdate] + ); + + const handleSelectAll = () => { + onUpdate({ selectedFiles: [...scanResults] }); + }; + + const handleSelectNone = () => { + onUpdate({ selectedFiles: [] }); + }; + + const handleSelectByType = (type) => { + const filesOfType = scanResults.filter((f) => f.type === type); + const currentIds = new Set(selectedFiles.map((f) => f.id)); + const allOfTypeSelected = filesOfType.every((f) => currentIds.has(f.id)); + + let newSelection; + if (allOfTypeSelected) { + newSelection = selectedFiles.filter((f) => f.type !== type); + } else { + const typeIds = new Set(filesOfType.map((f) => f.id)); + const existingOther = selectedFiles.filter((f) => !typeIds.has(f.id)); + newSelection = [...existingOther, ...filesOfType]; + } + onUpdate({ selectedFiles: newSelection }); + setFilterMenuAnchor(null); + }; + + const selectedSize = useMemo( + () => selectedFiles.reduce((sum, f) => sum + (f?.size || 0), 0), + [selectedFiles] + ); + + const typeCounts = useMemo(() => { + const counts = {}; + scanResults.forEach((file) => { + counts[file.type] = (counts[file.type] || 0) + 1; + }); + return counts; + }, [scanResults]); + + const selectedTypeCounts = useMemo(() => { + const counts = {}; + selectedFiles.forEach((file) => { + counts[file.type] = (counts[file.type] || 0) + 1; + }); + return counts; + }, [selectedFiles]); + + const columns = useMemo( + () => [ + { + accessorKey: "name", + header: "Name", + size: 200, + Cell: ({ cell }) => ( + + {cell.getValue()} + + ), + }, + { + accessorKey: "path", + header: "Path", + size: 250, + Cell: ({ cell }) => ( + + {cell.getValue() || "/"} + + ), + }, + { + accessorKey: "size", + header: "Size", + size: 100, + Cell: ({ cell }) => formatFileSize(cell.getValue()), + sortingFn: "basic", + }, + { + accessorKey: "type", + header: "Type", + size: 120, + Cell: ({ cell }) => { + const type = cell.getValue(); + return ( + + ); + }, + filterVariant: "select", + filterSelectOptions: Object.entries(typeLabels).map(([value, label]) => ({ + value, + label, + })), + }, + { + accessorKey: "lastModifiedDateTime", + header: "Modified", + size: 180, + Cell: ({ cell }) => formatDate(cell.getValue()), + sortingFn: "datetime", + }, + ], + [] + ); + + const table = useMaterialReactTable({ + columns, + data: filteredFiles, + enableRowSelection: true, + enableSelectAll: true, + getRowId: (row) => row.id, + onRowSelectionChange: handleRowSelectionChange, + state: { + rowSelection, + }, + enableColumnFilters: true, + enableGlobalFilter: false, + enablePagination: true, + initialState: { + pagination: { pageSize: 25, pageIndex: 0 }, + density: "compact", + }, + muiTableContainerProps: { + sx: { maxHeight: "400px" }, + }, + muiTableBodyRowProps: ({ row }) => ({ + sx: { + cursor: "pointer", + "&:hover": { backgroundColor: "action.hover" }, + }, + }), + enableStickyHeader: true, + enableTopToolbar: false, + enableBottomToolbar: true, + positionToolbarAlertBanner: "none", + }); + + return ( + + + Review and Select Files + + Uncheck any files you want to keep. All checked files will be deleted. + + + + + + setSearch(e.target.value)} + size="small" + sx={{ minWidth: 250 }} + InputProps={{ + startAdornment: ( + + + + ), + }} + /> + + + + + + + + setFilterMenuAnchor(null)} + > + {Object.entries(typeLabels).map(([type, label]) => { + const count = typeCounts[type] || 0; + const selectedCount = selectedTypeCounts[type] || 0; + if (count === 0) return null; + return ( + handleSelectByType(type)}> + + + {selectedCount}/{count} selected + + + ); + })} + + + + + {Object.entries(typeCounts).map(([type, count]) => { + const selectedCount = selectedTypeCounts[type] || 0; + return ( + 0 ? "filled" : "outlined"} + onClick={() => handleSelectByType(type)} + sx={{ cursor: "pointer" }} + /> + ); + })} + + + + + + + + + + + {selectedFiles.length} of {scanResults.length} files selected + + + Total size to delete: {formatFileSize(selectedSize)} + + + {selectedFiles.length > 0 && ( + + These files will be permanently deleted + + )} + + + + + + + + ); +}; + +export default StepSelectFiles; diff --git a/frontend/src/components/CippWizard/TempFileCleanup/StepSelectScope.jsx b/frontend/src/components/CippWizard/TempFileCleanup/StepSelectScope.jsx new file mode 100644 index 0000000000..44d6eba202 --- /dev/null +++ b/frontend/src/components/CippWizard/TempFileCleanup/StepSelectScope.jsx @@ -0,0 +1,152 @@ +import { + Stack, + Typography, + RadioGroup, + FormControlLabel, + Radio, + Button, + Box, + Alert, +} from "@mui/material"; +import { CippAutoComplete } from "../../CippComponents/CippAutocomplete"; + +export const StepSelectScope = ({ data, onUpdate, onNext }) => { + const handleScopeChange = (event) => { + onUpdate({ scope: event.target.value, siteId: null, userId: null }); + }; + + const canProceed = + data.tenant && + ((data.scope === "site" && data.siteId) || + (data.scope === "user" && data.userId) || + data.scope === "allSites" || + data.scope === "allOneDrives"); + + return ( + + + Let's find those temp files! First, choose where to look. + + + + `${tenant.displayName} (${tenant.defaultDomainName})`, + valueField: "defaultDomainName", + addedField: { + displayName: "displayName", + customerId: "customerId", + }, + }} + label="Select Tenant" + value={data.tenant} + onChange={(value) => onUpdate({ tenant: value, siteId: null, userId: null })} + multiple={false} + disableClearable + required + /> + + {data.tenant && ( + <> + Scope + + } + label="Specific SharePoint site" + /> + } + label="Specific user's OneDrive" + /> + } + label="All SharePoint sites" + /> + } + label="All OneDrives" + /> + + + {data.scope === "site" && ( + + site.displayName || site.webUrl || site.siteId, + valueField: "siteId", + addedField: { + webUrl: "webUrl", + displayName: "displayName", + }, + }} + label="Select SharePoint Site" + value={data.siteId} + onChange={(value) => onUpdate({ siteId: value })} + multiple={false} + creatable={false} + /> + )} + + {data.scope === "user" && ( + + `${user.displayName} (${user.userPrincipalName})`, + valueField: "id", + addedField: { + displayName: "displayName", + userPrincipalName: "userPrincipalName", + }, + }} + label="Select User" + value={data.userId} + onChange={(value) => onUpdate({ userId: value })} + multiple={false} + creatable={false} + /> + )} + + {(data.scope === "allSites" || data.scope === "allOneDrives") && ( + + Scanning all {data.scope === "allSites" ? "sites" : "OneDrives"}{" "} + may take several minutes for large tenants. + + )} + + )} + + + + + + ); +}; + +export default StepSelectScope; diff --git a/frontend/src/components/CippWizard/TempFileCleanup/index.js b/frontend/src/components/CippWizard/TempFileCleanup/index.js new file mode 100644 index 0000000000..386542b439 --- /dev/null +++ b/frontend/src/components/CippWizard/TempFileCleanup/index.js @@ -0,0 +1,5 @@ +export { StepSelectScope } from "./StepSelectScope"; +export { StepConfigureFilters } from "./StepConfigureFilters"; +export { StepScanResults } from "./StepScanResults"; +export { StepSelectFiles } from "./StepSelectFiles"; +export { StepConfirmDelete } from "./StepConfirmDelete"; diff --git a/frontend/src/components/CippWizard/wizard-steps.jsx b/frontend/src/components/CippWizard/wizard-steps.jsx index e4c077ba2e..379a70ec66 100644 --- a/frontend/src/components/CippWizard/wizard-steps.jsx +++ b/frontend/src/components/CippWizard/wizard-steps.jsx @@ -1,5 +1,5 @@ import PropTypes from "prop-types"; -import { CippIcons } from "../../utils/icon-registry"; +import CheckIcon from "@heroicons/react/24/outline/CheckIcon"; import { useIsMobileLayout } from "../../hooks/use-breakpoint"; import { CippWizardProgressHeader } from "./CippWizardProgressHeader"; import { @@ -18,14 +18,14 @@ import { ClearIcon } from "@mui/x-date-pickers"; const WizardStepConnector = styled(StepConnector)(({ theme }) => ({ [`&.${stepConnectorClasses.vertical}`]: { - marginLeft: 16, + marginLeft: 14, }, - [`&.${stepConnectorClasses.vertical} > .${stepConnectorClasses.line}`]: { + [`& .${stepConnectorClasses.lineVertical}`]: { borderColor: theme.palette.mode === "dark" ? theme.palette.neutral[800] : theme.palette.neutral[200], borderLeftWidth: 2, }, - [`&.${stepConnectorClasses.horizontal} > .${stepConnectorClasses.line}`]: { + [`& .${stepConnectorClasses.lineHorizontal}`]: { borderColor: theme.palette.mode === "dark" ? theme.palette.neutral[800] : theme.palette.neutral[200], borderTopWidth: 2, @@ -33,7 +33,9 @@ const WizardStepConnector = styled(StepConnector)(({ theme }) => ({ })); const WizardStepIcon = (props) => { - const { active, completed, error, loading } = props; + const { active, completed, error, compact = false, loading } = props; + const size = compact ? 28 : 36; + const innerSize = compact ? 8 : 12; if (loading) { return ( @@ -64,9 +66,9 @@ const WizardStepIcon = (props) => { borderRadius: "50%", color: "primary.contrastText", display: "flex", - height: 36, + height: size, justifyContent: "center", - width: 36, + width: size, }} > @@ -86,17 +88,17 @@ const WizardStepIcon = (props) => { borderWidth: 2, color: "primary.main", display: "flex", - height: 36, + height: size, justifyContent: "center", - width: 36, + width: size, }} > @@ -111,13 +113,13 @@ const WizardStepIcon = (props) => { borderRadius: "50%", color: "primary.contrastText", display: "flex", - height: 36, + height: size, justifyContent: "center", - width: 36, + width: size, }} > - + ); @@ -130,8 +132,8 @@ const WizardStepIcon = (props) => { borderRadius: "50%", borderStyle: "solid", borderWidth: 2, - height: 36, - width: 36, + height: size, + width: size, }} /> ); @@ -139,8 +141,14 @@ const WizardStepIcon = (props) => { export const WizardSteps = (props) => { const { activeStep = 1, orientation = "vertical", steps = [] } = props; + const isHorizontal = orientation === "horizontal"; const isMobile = useIsMobileLayout(); + // Create a custom step icon component that passes the compact prop + const CompactStepIcon = (stepIconProps) => ( + + ); + // Only the horizontal stepper is wizard navigation. The vertical one is a status list — // GDAP onboarding feeds it server-side steps where each step's message and pass/fail // state IS the content, so collapsing it to a progress bar would delete that. @@ -154,6 +162,13 @@ export const WizardSteps = (props) => { orientation={orientation} activeStep={activeStep} connector={} + sx={{ + ...(isHorizontal && { + '& .MuiStepLabel-root': { + py: 0, + }, + }), + }} > {/* Onboarding's steps carry only a description, so keying on title alone made every key undefined and reconciliation index-driven by accident. */} @@ -161,15 +176,23 @@ export const WizardSteps = (props) => { - - {`Step ${steps.indexOf(step) ? steps.indexOf(step) + 1 : 1}`} - - + {step.description} diff --git a/frontend/src/components/ReleaseNotesDialog.jsx b/frontend/src/components/ReleaseNotesDialog.jsx index 2fdc7e1a9c..0603a3f94b 100644 --- a/frontend/src/components/ReleaseNotesDialog.jsx +++ b/frontend/src/components/ReleaseNotesDialog.jsx @@ -42,7 +42,7 @@ import { CippAutoComplete } from './CippComponents/CippAutocomplete' const RELEASE_COOKIE_KEY = 'cipp_release_notice' const RELEASE_PERMANENT_HIDE_KEY = 'cipp_release_notice_permanently_hidden' -const RELEASE_OWNER = 'CyberDrain' +const RELEASE_OWNER = 'KelvinTegelaar' const RELEASE_REPO = 'CIPP' const secureFlag = () => { @@ -81,20 +81,8 @@ const setCookie = (name, value, days = 365) => { )}; expires=${expires}; path=/; SameSite=Lax;${secureFlag()}` } -const deleteCookie = (name) => { - if (typeof document === 'undefined') { - return - } - - document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; SameSite=Lax;${secureFlag()}` -} - -// Hotfix and maintenance builds publish their own GitHub release (v10.8.1, v10.8.2, ...), so the -// running build's exact tag is both what we show and what we remember as dismissed. Collapsing -// patch releases back to vX.Y.0 here left the dismissal cookie - which stores the tag that was -// actually released - permanently unmatchable, so the dialog reopened on every page load. // baseTag (vX.Y.0) is what the dialog selects by default so the feature-release notes lead; -// hotfix notes stay reachable via the dropdown. +// hotfix notes stay reachable via the dropdown. Dismissal tracks the exact running tag. const buildReleaseMetadata = (version) => { const match = /^v?(\d+)\.(\d+)\.(\d+)/.exec(String(version ?? '')) const [major, minor, patch] = match ? match.slice(1) : ['0', '0', '0'] @@ -108,6 +96,14 @@ const buildReleaseMetadata = (version) => { } } +const deleteCookie = (name) => { + if (typeof document === 'undefined') { + return + } + + document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; SameSite=Lax;${secureFlag()}` +} + const formatReleaseBody = (body) => { if (!body) { return '' @@ -203,7 +199,7 @@ export const ReleaseNotesDialog = forwardRef((_props, ref) => { const releaseListQuery = ApiGetCall({ url: '/api/ListGitHubReleaseNotes', - queryKey: `list-github-release-options`, + queryKey: 'list-github-release-options', waiting: shouldFetchReleaseList, staleTime: 300000, }) @@ -312,9 +308,6 @@ export const ReleaseNotesDialog = forwardRef((_props, ref) => { }, [releaseCatalog, selectedReleaseTag, releaseMeta]) const handleDismissUntilNextRelease = () => { - // Store the same tag the eligibility check reads back - the tag of the build being run, not - // the newest tag on GitHub. Those differ for anyone not on the very latest release, and a - // cookie that can never match means "don't show until next release" never suppresses anything. window.localStorage.removeItem(RELEASE_PERMANENT_HIDE_KEY) setCookie(RELEASE_COOKIE_KEY, releaseMeta.releaseTag) setOpen(false) @@ -350,7 +343,7 @@ export const ReleaseNotesDialog = forwardRef((_props, ref) => { const requestedVersionLabel = selectedReleaseData?.releaseTag ?? selectedReleaseTag ?? releaseMeta.currentTag const releaseName = - selectedReleaseData?.name || selectedReleaseValue?.label || `CIPP ${releaseMeta.currentTag}` + selectedReleaseData?.name || selectedReleaseValue?.label || `Manage365 ${releaseMeta.currentTag}` const releaseHeading = releaseName || requestedVersionLabel const releaseBody = typeof selectedReleaseData?.body === 'string' ? selectedReleaseData.body : '' const releaseUrl = diff --git a/frontend/src/components/ReportBuilder/ReportBuilderPDF.jsx b/frontend/src/components/ReportBuilder/ReportBuilderPDF.jsx new file mode 100644 index 0000000000..5d033fc679 --- /dev/null +++ b/frontend/src/components/ReportBuilder/ReportBuilderPDF.jsx @@ -0,0 +1,772 @@ +import { useMemo } from 'react' +import { Document, Page, Text, View, StyleSheet, Image, Font } from '@react-pdf/renderer' +import { CippPdfPreview } from '../CippPdf/CippPdfPreview' + +/* ── Emoji support ───────────────────────────────────────── + * Helvetica has no emoji glyphs. react-pdf can render emojis + * as inline Twemoji images via Font.registerEmojiSource(). + * ───────────────────────────────────────────────────────── */ +Font.registerEmojiSource({ + format: 'png', + url: 'https://cdnjs.cloudflare.com/ajax/libs/twemoji/14.0.2/72x72/', +}) + +/** + * Styles matching the CIPP Executive Report design system exactly. + * Brand color drives accent throughout. + */ +const createStyles = (brandColor) => + StyleSheet.create({ + /* ── Cover page ────────────────────────────────────── */ + coverPage: { + flexDirection: 'column', + backgroundColor: '#FFFFFF', + fontFamily: 'Helvetica', + padding: 60, + justifyContent: 'space-between', + minHeight: '100%', + }, + coverHeader: { + flexDirection: 'row', + justifyContent: 'space-between', + alignItems: 'center', + marginBottom: 80, + }, + logoSection: { flexDirection: 'row', alignItems: 'center' }, + logo: { height: 100, marginRight: 12 }, + coverHero: { + flex: 1, + justifyContent: 'flex-start', + alignItems: 'flex-start', + paddingTop: 40, + }, + coverLabel: { + backgroundColor: brandColor, + color: '#FFFFFF', + fontSize: 10, + fontWeight: 'bold', + textTransform: 'uppercase', + letterSpacing: 1, + paddingHorizontal: 16, + paddingVertical: 8, + marginBottom: 30, + alignSelf: 'flex-start', + }, + mainTitle: { + fontWeight: 'bold', + color: '#1A202C', + lineHeight: 1.1, + marginBottom: 20, + letterSpacing: -1, + textTransform: 'uppercase', + }, + titleAccent: { color: brandColor }, + subtitle: { + fontSize: 14, + color: '#000000', + fontWeight: 'normal', + lineHeight: 1.5, + marginBottom: 40, + maxWidth: 400, + }, + tenantCard: { + backgroundColor: 'transparent', + padding: 0, + maxWidth: 400, + }, + tenantName: { + fontSize: 18, + fontWeight: 'bold', + color: '#000000', + marginBottom: 8, + }, + coverFooter: { textAlign: 'center', marginTop: 60 }, + confidential: { + fontSize: 9, + color: '#A0AEC0', + textTransform: 'uppercase', + letterSpacing: 1, + }, + dateStamp: { + fontSize: 9, + color: '#000000', + textTransform: 'uppercase', + letterSpacing: 0.5, + }, + coverBackground: { + position: 'absolute', + top: 0, + left: 0, + right: 0, + bottom: 0, + opacity: 0.5, + }, + + /* ── Content page ──────────────────────────────────── */ + page: { + flexDirection: 'column', + backgroundColor: '#FFFFFF', + fontFamily: 'Helvetica', + fontSize: 10, + lineHeight: 1.4, + color: '#2D3748', + padding: 40, + }, + pageHeader: { + paddingBottom: 12, + marginBottom: 0, + flexDirection: 'row', + justifyContent: 'space-between', + alignItems: 'flex-start', + }, + pageHeaderDivider: { + height: 1, + backgroundColor: brandColor, + marginBottom: 24, + }, + pageHeaderContent: { flex: 1 }, + pageTitle: { + fontSize: 20, + fontWeight: 'bold', + color: '#1A202C', + marginBottom: 8, + paddingTop: 4, + paddingBottom: 4, + }, + pageSubtitle: { fontSize: 11, color: '#4A5568', fontWeight: 'normal' }, + headerLogo: { height: 30 }, + + /* ── Sections ──────────────────────────────────────── */ + section: { + marginBottom: 24, + }, + sectionTitle: { + fontSize: 14, + fontWeight: 'bold', + color: brandColor, + marginBottom: 12, + paddingTop: 4, + paddingBottom: 4, + pageBreakAfter: 'avoid', + breakAfter: 'avoid', + orphans: 3, + widows: 3, + }, + statusText: { + fontSize: 9, + fontStyle: 'italic', + }, + statusPassed: { color: '#22543D' }, + statusFailed: { color: '#742A2A' }, + statusInvestigate: { color: '#744210' }, + statusSkipped: { color: '#718096' }, + bodyText: { + fontSize: 9, + color: '#2D3748', + lineHeight: 1.5, + marginBottom: 12, + textAlign: 'justify', + }, + + /* ── Tables ────────────────────────────────────────── */ + controlsTable: { + backgroundColor: '#FAFAFA', + marginBottom: 8, + }, + tableHeader: { + flexDirection: 'row', + backgroundColor: brandColor, + paddingVertical: 10, + paddingHorizontal: 12, + }, + headerCell: { + fontSize: 7, + fontWeight: 'bold', + color: '#FFFFFF', + textTransform: 'uppercase', + letterSpacing: 0.5, + flex: 1, + }, + tableRow: { + flexDirection: 'row', + paddingVertical: 8, + paddingHorizontal: 12, + alignItems: 'center', + backgroundColor: '#FFFFFF', + }, + tableRowAlt: { + flexDirection: 'row', + paddingVertical: 8, + paddingHorizontal: 12, + alignItems: 'center', + backgroundColor: '#F7FAFC', + }, + tableCell: { + flex: 1, + fontSize: 8, + color: '#2D3748', + lineHeight: 1.3, + }, + tableCellBold: { + flex: 1, + fontSize: 8, + fontWeight: 'bold', + color: '#2D3748', + }, + + /* ── Info boxes ─────────────────────────────────────── */ + infoBox: { + backgroundColor: '#F7FAFC', + paddingVertical: 12, + paddingHorizontal: 16, + marginBottom: 12, + }, + infoTitle: { + fontSize: 9, + fontWeight: 'bold', + color: '#2D3748', + marginBottom: 6, + }, + infoText: { fontSize: 8, color: '#4A5568', lineHeight: 1.4 }, + + /* ── Lists ─────────────────────────────────────────── */ + listItem: { + flexDirection: 'row', + alignItems: 'flex-start', + marginBottom: 3, + }, + listBullet: { + fontSize: 8, + color: brandColor, + marginRight: 6, + fontWeight: 'bold', + marginTop: 1, + width: 10, + }, + listText: { + fontSize: 9, + color: '#2D3748', + lineHeight: 1.5, + flex: 1, + }, + orderedBullet: { + fontSize: 8, + color: brandColor, + marginRight: 6, + fontWeight: 'bold', + marginTop: 1, + width: 14, + }, + + /* ── Markdown headings ─────────────────────────────── */ + heading1: { + fontSize: 16, + fontWeight: 'bold', + color: '#1A202C', + marginTop: 10, + marginBottom: 6, + paddingTop: 4, + paddingBottom: 2, + }, + heading2: { + fontSize: 14, + fontWeight: 'bold', + color: brandColor, + marginTop: 8, + marginBottom: 5, + paddingTop: 4, + paddingBottom: 2, + }, + heading3: { + fontSize: 12, + fontWeight: 'bold', + color: '#2D3748', + marginTop: 6, + marginBottom: 4, + paddingTop: 3, + paddingBottom: 2, + }, + + /* ── Code ──────────────────────────────────────────── */ + codeBlock: { + backgroundColor: '#F7FAFC', + padding: 8, + marginVertical: 6, + fontSize: 8, + fontFamily: 'Courier', + color: '#2D3748', + }, + horizontalRule: { + height: 1, + backgroundColor: '#E2E8F0', + marginVertical: 8, + }, + + footerText: { fontSize: 7, color: '#718096' }, + pageNumber: { fontSize: 7, color: '#718096', fontWeight: 'bold' }, + }) + +/* ── Text helpers ────────────────────────────────────────── */ + +const stripTags = (html) => { + if (!html) return '' + let result = html + let prev = '' + while (prev !== result) { + prev = result + result = result.replace(/&/g, '&') + } + do { + prev = result + result = result.replace(/<[^>]*>?/g, '') + } while (result !== prev) + return result + .replace(/</g, '<') + .replace(/>/g, '>') + .replace(/"/g, '"') + .replace(/'/g, "'") + .replace(/ /g, ' ') +} + +const processInline = (text) => + text + .replace(/\*\*\*(.*?)\*\*\*/g, '$1') + .replace(/\*\*(.*?)\*\*/g, '$1') + .replace(/\*(.*?)\*/g, '$1') + .replace(/`(.*?)`/g, '$1') + .replace(/\[(.*?)\]\(.*?\)/g, '$1') + +/** + * Convert HTML (from TipTap rich-text editor) to @react-pdf/renderer elements. + */ +const htmlToElements = (html, s) => { + if (!html) + return [ + + {' '} + , + ] + const elements = [] + let key = 0 + + // Extract and render tables first, replacing them with placeholders + let remaining = html + const tables = [] + const tableRegex = /]*>([\s\S]*?)<\/table>/gi + remaining = remaining.replace(tableRegex, (match) => { + const placeholder = `__TABLE_${tables.length}__` + tables.push(match) + return `

        ${placeholder}

        ` + }) + + const blocks = remaining + .split(/<\/p>|<\/h[1-6]>|<\/li>|<\/pre>|<\/blockquote>|/) + .filter((b) => b.trim()) + + for (const block of blocks) { + const cleaned = block.trim() + if (!cleaned) continue + + // Check for table placeholder + const tablePlaceholder = cleaned.match(/__TABLE_(\d+)__/) + if (tablePlaceholder) { + const tableIndex = parseInt(tablePlaceholder[1], 10) + const tableHtml = tables[tableIndex] + if (tableHtml) { + // Parse rows from HTML table + const allRows = [] + const rowRegex = /]*>([\s\S]*?)<\/tr>/gi + let rowMatch + while ((rowMatch = rowRegex.exec(tableHtml)) !== null) { + const cells = [] + const cellRegex = /<(?:td|th)[^>]*>([\s\S]*?)<\/(?:td|th)>/gi + let cellMatch + while ((cellMatch = cellRegex.exec(rowMatch[1])) !== null) { + cells.push(stripTags(cellMatch[1]).trim()) + } + if (cells.length > 0) allRows.push(cells) + } + + if (allRows.length > 0) { + const headerRow = allRows[0] + const dataRows = allRows.slice(1) + // Check if the first row was in (it's a header) + const hasHeader = / + {hasHeader && ( + + {headerRow.map((c, ci) => ( + + {processInline(c)} + + ))} + + )} + {(hasHeader ? dataRows : allRows).map((row, ri) => ( + + {row.map((c, ci) => ( + + {processInline(c)} + + ))} + + ))} + + ) + } + continue + } + } + + if (cleaned.match(/]*>/)) { + elements.push( + + {stripTags(cleaned.replace(/]*>/, ''))} + + ) + } else if (cleaned.match(/]*>/)) { + elements.push( + + {stripTags(cleaned.replace(/]*>/, ''))} + + ) + } else if (cleaned.match(/]*>/)) { + elements.push( + + {stripTags(cleaned.replace(/]*>/, ''))} + + ) + } else if (cleaned.match(/]*>/)) { + elements.push( + + {'\u2022'} + {stripTags(cleaned.replace(/]*>/, ''))} + + ) + } else if (cleaned.match(/]*>/)) { + elements.push( + + {stripTags(cleaned.replace(/]*>/, '').replace(/]*>/, ''))} + + ) + } else { + const text = stripTags(cleaned.replace(/]*>/, '')) + if (text.trim()) { + elements.push( + + {text} + + ) + } + } + } + return elements.length > 0 + ? elements + : [ + + {' '} + , + ] +} + +/** + * Convert Markdown to @react-pdf/renderer elements. + * Supports headings, lists, tables, code blocks, horizontal rules, and paragraphs. + */ +const markdownToElements = (markdown, s) => { + if (!markdown) + return [ + + {' '} + , + ] + const lines = markdown.split('\n') + const elements = [] + let key = 0 + let inCodeBlock = false + let codeContent = '' + let inTable = false + let tableRows = [] + + const flushTable = () => { + if (tableRows.length > 0) { + const header = tableRows[0] + const data = tableRows.slice(1) + elements.push( + + + {header.map((c, ci) => ( + + {processInline(c)} + + ))} + + {data.map((row, ri) => ( + + {row.map((c, ci) => ( + + {processInline(c)} + + ))} + + ))} + + ) + } + inTable = false + tableRows = [] + } + + for (let i = 0; i < lines.length; i++) { + const line = lines[i] + + if (line.trim().startsWith('```')) { + if (inCodeBlock) { + elements.push( + + {codeContent.trim()} + + ) + codeContent = '' + inCodeBlock = false + } else { + inCodeBlock = true + } + continue + } + if (inCodeBlock) { + codeContent += line + '\n' + continue + } + + if (line.trim().startsWith('|')) { + if (!inTable) { + inTable = true + tableRows = [] + } + if (line.trim().match(/^\|[\s-:|]+\|$/)) continue + tableRows.push( + line + .split('|') + .filter((c) => c.trim() !== '') + .map((c) => c.trim()) + ) + continue + } else if (inTable) { + flushTable() + } + + if (line.trim() === '') continue + + if (line.startsWith('### ')) { + elements.push( + + {processInline(line.slice(4))} + + ) + } else if (line.startsWith('## ')) { + elements.push( + + {processInline(line.slice(3))} + + ) + } else if (line.startsWith('# ')) { + elements.push( + + {processInline(line.slice(2))} + + ) + } else if (line.trim().match(/^[-*_]{3,}$/)) { + elements.push() + } else if (line.trim().match(/^[-*+]\s/)) { + elements.push( + + {'\u2022'} + {processInline(line.trim().replace(/^[-*+]\s/, ''))} + + ) + } else if (line.trim().match(/^\d+\.\s/)) { + const num = line.trim().match(/^(\d+)\./)[1] + elements.push( + + {num + '.'} + {processInline(line.trim().replace(/^\d+\.\s/, ''))} + + ) + } else { + elements.push( + + {processInline(line)} + + ) + } + } + + if (inTable) flushTable() + return elements.length > 0 + ? elements + : [ + + {' '} + , + ] +} + +/* ── Document ──────────────────────────────────────────────── */ + +export const ReportBuilderDocument = ({ + blocks = [], + tenantName, + templateName, + brandingSettings, + generatedDate, +}) => { + const brandColor = brandingSettings?.colour || '#F77F00' + const logo = brandingSettings?.logo || null + const s = createStyles(brandColor) + + const dateObj = generatedDate ? new Date(generatedDate) : new Date() + const currentDate = dateObj.toLocaleDateString('en-US', { + year: 'numeric', + month: 'long', + day: 'numeric', + }) + + const reportName = templateName || 'Report' + const safeBlocks = blocks || [] + + // Dynamic cover title: shrink font for long names, truncate beyond 50 chars + const coverTitle = reportName.length > 50 ? reportName.slice(0, 47) + '...' : reportName + const coverTitleFontSize = coverTitle.length <= 20 ? 48 : coverTitle.length <= 35 ? 36 : 28 + + return ( + + {/* ── Cover Page ── */} + + + + + + {logo && } + + {currentDate} + + + + ASSESSMENT REPORT + + {coverTitle.toUpperCase().split(' ').slice(0, -1).join(' ') || coverTitle.toUpperCase()} + {coverTitle.split(' ').length > 1 ? ( + <> + {'\n'} + + {coverTitle.toUpperCase().split(' ').slice(-1)[0]} + + + ) : null} + + + {tenantName || 'Organization'} + + + + + Confidential & Proprietary + + + + {/* ── Content Pages — blocks batched 5 per page ── */} + {(() => { + const BLOCKS_PER_PAGE = 5 + const groups = [] + for (let i = 0; i < safeBlocks.length; i += BLOCKS_PER_PAGE) { + groups.push(safeBlocks.slice(i, i + BLOCKS_PER_PAGE)) + } + if (groups.length === 0) groups.push([]) + return groups.map((group, pageIndex) => ( + + + + {reportName} + {currentDate} + + {logo && } + + + + {group.map((block, blockIndex) => { + const statusStyle = + block.status === 'Passed' + ? s.statusPassed + : block.status === 'Failed' + ? s.statusFailed + : block.status === 'Investigate' + ? s.statusInvestigate + : block.status === 'Skipped' + ? s.statusSkipped + : null + + return ( + + {block.title ? {block.title} : null} + {block.type === 'test' && block.status ? ( + Status: {block.status} + ) : null} + {block.type === 'database' && block.format && block.format !== 'text' ? ( + {block.content || ''} + ) : block.type === 'database' && (!block.format || block.format === 'text') ? ( + markdownToElements(block.content, s) + ) : block.type === 'blank' || (block.type === 'test' && block.static) ? ( + htmlToElements(block.content, s) + ) : ( + markdownToElements(block.content, s) + )} + + ) + })} + + )) + })()} + + ) +} + +/* ── Preview / Download wrapper ──────────────────────────── */ + +export const ReportBuilderPDF = ({ + blocks, + tenantName, + templateName, + brandingSettings, + generatedDate, + mode = 'preview', +}) => { + const document = useMemo( + () => ( + + ), + [blocks, tenantName, templateName, brandingSettings, generatedDate] + ) + + if (mode === 'preview') { + return ( + + {document} + + ) + } + return null +} diff --git a/frontend/src/components/actions-menu.jsx b/frontend/src/components/actions-menu.jsx index be62717a71..6d9d1f1721 100644 --- a/frontend/src/components/actions-menu.jsx +++ b/frontend/src/components/actions-menu.jsx @@ -1,8 +1,27 @@ +import ChevronDownIcon from "@heroicons/react/24/outline/ChevronDownIcon"; import PropTypes from "prop-types"; -import { CippIcons } from "../utils/icon-registry"; -import { Button, ListItemText, Menu, MenuItem, SvgIcon } from "@mui/material"; +import { + Button, + Divider, + ListItemText, + ListSubheader, + Menu, + MenuItem, + SvgIcon, + Box, + alpha, +} from "@mui/material"; +import { useMemo } from "react"; import { usePopover } from "../hooks/use-popover"; import { useActionsDispatch } from "../hooks/use-actions-dispatch"; +import { resolvePaletteMainColor } from "../theme/utils"; +import { + getActionColor, + getCategoryColor, + getCategoryIcon, + getCategoryLabel, + sortCategoryEntries, +} from "../utils/action-categories"; export const ActionsMenu = (props) => { const { actions = [], label = "Actions", data, queryKeys, ...other } = props; @@ -13,6 +32,20 @@ export const ActionsMenu = (props) => { queryKeys, }); + const groupedActions = useMemo(() => { + const grouped = visibleActions.reduce((acc, action) => { + const category = + typeof action.category === "string" && action.category.trim().length > 0 + ? action.category.trim() + : "Other"; + if (!acc[category]) { + acc[category] = []; + } + acc[category].push(action); + return acc; + }, {}); + return sortCategoryEntries(Object.entries(grouped)); + }, [visibleActions]); return ( <> diff --git a/frontend/src/components/resource-unavailable.jsx b/frontend/src/components/resource-unavailable.jsx index fde923f7f8..835ff6ac0e 100644 --- a/frontend/src/components/resource-unavailable.jsx +++ b/frontend/src/components/resource-unavailable.jsx @@ -1,69 +1,105 @@ import PropTypes from "prop-types"; -import { CippIcons } from "../utils/icon-registry"; -import { Box, Button, SvgIcon, Typography } from "@mui/material"; -import { styled } from "@mui/material/styles"; +import PlusIcon from "@heroicons/react/24/outline/PlusIcon"; +import { Box, Button, Stack, SvgIcon, Typography } from "@mui/material"; +import { styled, alpha } from "@mui/material/styles"; import { useTheme } from "@emotion/react"; const ResourceUnavailableRoot = styled("div")(({ theme }) => ({ alignItems: "center", backgroundColor: - theme.palette.mode === "dark" ? theme.palette.neutral[900] : theme.palette.neutral[50], + theme.palette.mode === "dark" + ? alpha(theme.palette.neutral[900], 0.5) + : alpha(theme.palette.neutral[100], 0.5), + borderRadius: theme.shape.borderRadius, display: "flex", flexDirection: "column", justifyContent: "center", - padding: theme.spacing(3), + padding: theme.spacing(6, 3), + minHeight: 200, })); export const ResourceUnavailable = (props) => { - const { message = "", onCreate, createButtonText, sx, type, target } = props; + const { + title, + message = "No data to display", + onCreate, + createButtonText, + sx, + type, + target, + icon, + } = props; const theme = useTheme(); return ( - - - - {message && ( - - {message} - - )} - {onCreate && ( - - )} + + {icon ? ( + + {icon} + + ) : ( + + + + )} + + {title && ( + + {title} + + )} + + {message} + + + {onCreate && ( + + )} + ); }; ResourceUnavailable.propTypes = { + title: PropTypes.string, message: PropTypes.string, onCreate: PropTypes.func, + createButtonText: PropTypes.string, sx: PropTypes.object, + type: PropTypes.string, + target: PropTypes.string, + icon: PropTypes.node, }; diff --git a/frontend/src/contexts/settings-context.jsx b/frontend/src/contexts/settings-context.jsx index de4f6d798b..7911a12ed9 100644 --- a/frontend/src/contexts/settings-context.jsx +++ b/frontend/src/contexts/settings-context.jsx @@ -56,40 +56,15 @@ const restoreSettings = () => { // that's why we catch the error } - return value ? stripPersistedBrandingBlobs(stripServerManagedSettings(value)) : null; + return value; }; const deleteSettings = () => { storage.removeItem(STORAGE_KEY); }; -/** - * Branding is server state now, read via `useBrandingSettings`. Anything a previous version - * persisted here is dropped on load rather than migrated - it is a stale copy, and its image - * payloads used to exhaust the localStorage quota. - */ -const stripPersistedBrandingBlobs = (settings) => { - if (!settings || typeof settings !== "object" || !("customBranding" in settings)) { - return settings; - } - - const { customBranding: _legacyBranding, ...rest } = settings; - return rest; -}; - const storeSettings = (value) => { - try { - storage.setItem(STORAGE_KEY, JSON.stringify(stripPersistedBrandingBlobs(value))); - } catch (err) { - console.error("[Settings Context] Failed to persist settings", err); - try { - // Drop a bloated legacy blob so future writes can succeed - storage.removeItem(STORAGE_KEY); - storage.setItem(STORAGE_KEY, JSON.stringify(stripPersistedBrandingBlobs(value))); - } catch (retryErr) { - console.error("[Settings Context] Failed to recover settings storage", retryErr); - } - } + storage.setItem(STORAGE_KEY, JSON.stringify(value)); }; const stripServerManagedSettings = (settings) => { @@ -101,20 +76,18 @@ const stripServerManagedSettings = (settings) => { return cleanedSettings; }; -// First visit (no stored preference): follow the OS. 'browser' resolves against -// prefers-color-scheme at render time in _app.js, so the app keeps tracking the -// system preference until the user explicitly picks a mode with the theme toggle. -const systemPrefersDark = - typeof window !== "undefined" && !!window.matchMedia?.("(prefers-color-scheme: dark)").matches; - const initialSettings = { direction: "ltr", - paletteMode: systemPrefersDark ? "dark" : "light", - currentTheme: { value: "browser", label: "Browser Default" }, + paletteMode: "light", + currentTheme: { value: "light", label: "light" }, pinNav: true, currentTenant: null, showDevtools: false, showAdvancedTools: false, + customBranding: { + colour: "#007BA7", + logo: null, + }, persistFilters: false, lastUsedFilters: {}, breadcrumbMode: "hierarchical", @@ -147,7 +120,7 @@ export const SettingsProvider = (props) => { const restored = restoreSettings(); if (restored) { - const cleanedRestored = restored; + const cleanedRestored = stripServerManagedSettings(restored); if (!cleanedRestored.currentTheme && cleanedRestored.paletteMode) { cleanedRestored.currentTheme = { diff --git a/frontend/src/data/CIPPDBCacheTypes.json b/frontend/src/data/CIPPDBCacheTypes.json index dcc86a3613..2737de2218 100644 --- a/frontend/src/data/CIPPDBCacheTypes.json +++ b/frontend/src/data/CIPPDBCacheTypes.json @@ -269,11 +269,6 @@ "friendlyName": "Mailboxes", "description": "All Exchange Online mailboxes" }, - { - "type": "HVEAccounts", - "friendlyName": "HVE Accounts", - "description": "High Volume Email accounts" - }, { "type": "CASMailboxes", "friendlyName": "CAS Mailboxes", @@ -411,6 +406,11 @@ "friendlyName": "Intune App Install Status", "description": "Per-application install status rollup (failed/installed/pending device counts) from the AppInstallStatusAggregate report" }, + { + "type": "HVEAccounts", + "friendlyName": "HVE Accounts", + "description": "High Volume Email accounts" + }, { "type": "DomainAnalyser", "friendlyName": "Domain Analyser", diff --git a/frontend/src/data/CIPPDefaultGDAPRoles.json b/frontend/src/data/CIPPDefaultGDAPRoles.json index 6325d10c4b..ba72446ba4 100644 --- a/frontend/src/data/CIPPDefaultGDAPRoles.json +++ b/frontend/src/data/CIPPDefaultGDAPRoles.json @@ -35,6 +35,10 @@ "label": "Intune Administrator", "value": "3a2c62db-5318-420d-8d74-23affee5d9d5" }, + { + "label": "Power Platform Administrator", + "value": "11648597-926c-4cf3-9c36-bcebb0ba8dcc" + }, { "label": "Privileged Authentication Administrator", "value": "7be44c8a-adaf-4e2a-84d6-ab2649e08a13" diff --git a/frontend/src/data/Extensions.json b/frontend/src/data/Extensions.json index 4d0ce5326d..fd380b2116 100644 --- a/frontend/src/data/Extensions.json +++ b/frontend/src/data/Extensions.json @@ -4,14 +4,15 @@ "id": "cippapi", "type": "CIPP-API", "cat": "API", - "logo": "/assets/integrations/cipp-api.png", + "logo": "/logo-light.png", + "logoDark": "/logo-dark.png", "forceSyncButton": false, "hideTestButton": true, - "description": "The CIPP API allows you to access CIPP data outside of CIPP using a RESTful API.", - "helpText": "This integration allows you to enable CIPP-API access outside of CIPP. This is useful for integrations with other systems or custom scripts.", + "description": "The Manage365 API allows you to access Manage365 data outside of Manage365 using a RESTful API.", + "helpText": "This integration allows you to enable API access outside of Manage365. This is useful for integrations with other systems or custom scripts.", "links": [ { - "name": "CIPP API Documentation", + "name": "Manage365 API Documentation", "url": "https://docs.cipp.app/api-documentation/setup-and-authentication" } ], @@ -24,8 +25,8 @@ "cat": "CSP", "logo": "/assets/integrations/sherweb.png", "logoDark": "/assets/integrations/sherweb_dark.png", - "description": "Enable the Sherweb integration to manage your CSP licensing from CIPP.", - "helpText": "This integration allows you to manage your CSP licensing from CIPP. Purchase new licenses while adding or editing users in CIPP. Not a Sherweb partner? Sign up for the Sherweb Cloud Services for MSPs program.", + "description": "Enable the Sherweb integration to manage your CSP licensing from Manage365.", + "helpText": "This integration allows you to manage your CSP licensing from Manage365. Purchase new licenses while adding or editing users in Manage365. Not a Sherweb partner? Sign up for the Sherweb Cloud Services for MSPs program.", "mappingRequired": true, "links": [ { @@ -81,7 +82,7 @@ { "type": "autoComplete", "name": "Sherweb.AllowedCustomRoles", - "label": "Select CIPP roles that are allowed to purchase licenses", + "label": "Select Manage365 roles that are allowed to purchase licenses", "api": { "url": "/api/ListCustomRole", "queryKey": "CustomRoles", @@ -353,7 +354,7 @@ "name": "HaloPSA.TicketType", "label": "HaloPSA Ticket Type", "placeholder": "Select your HaloPSA Ticket Type, leave blank for default", - "helperText": "The ticket type used for CIPP alert tickets. Sets the workflow, and the priorities and outcomes available below.", + "helperText": "The ticket type used for Manage365 alert tickets. Sets the workflow, and the priorities and outcomes available below.", "fullRow": true, "multiple": false, "api": { @@ -379,7 +380,7 @@ "name": "HaloPSA.RequestSource", "label": "HaloPSA Request Source", "placeholder": "Select a request source, leave blank for default", - "helperText": "Optional. Stamps every CIPP-generated ticket with this request source. Halo records tickets created over the API as Manual unless one is set, so create a CIPP request source in Halo to tell them apart.", + "helperText": "Optional. Stamps every Manage365-generated ticket with this request source. Halo records tickets created over the API as Manual unless one is set, so create a Manage365 request source in Halo to tell them apart.", "fullRow": true, "multiple": false, "api": { @@ -406,7 +407,7 @@ "dependsOn": "HaloPSA.TicketType", "label": "HaloPSA Default Priority", "placeholder": "Select a priority, leave blank for default", - "helperText": "Optional. Sets the priority on every CIPP-generated ticket. Restricted to priorities on the Ticket Type's SLA. Leave blank to use the SLA default.", + "helperText": "Optional. Sets the priority on every Manage365-generated ticket. Restricted to priorities on the Ticket Type's SLA. Leave blank to use the SLA default.", "fullRow": true, "multiple": false, "api": { @@ -588,8 +589,8 @@ "type": "textField", "name": "NinjaOne.CveSyncPrefix", "label": "CVE Sync Scan Group Prefix", - "placeholder": "CIPP-", - "helperText": "Scan groups will be named: [Prefix][tenant-domain] (e.g., CIPP-contoso.com)", + "placeholder": "Manage365-", + "helperText": "Scan groups will be named: [Prefix][tenant-domain] (e.g., Manage365-contoso.com)", "condition": { "field": "NinjaOne.CveSyncEnabled", "compareType": "is", @@ -1066,8 +1067,8 @@ "cat": "Source Control", "logo": "/assets/integrations/github.png", "logoDark": "/assets/integrations/github_dark.png", - "description": "Enable the GitHub integration to manage your repositories from CIPP.", - "helpText": "This integration allows you to manage GitHub repositories from CIPP, including the Community Repositories functionality. Requires a GitHub Personal Access Token (PAT) with a minimum of repo:public_repo permissions. If you plan on saving your templates to GitHub or accessing private/internal repositories, you will need to grant the whole repo scope. You can create a PAT in your GitHub account settings, see the GitHub Token documentation for more info. If you do not enable the extension, a read-only API will be provided.", + "description": "Enable the GitHub integration to manage your repositories from Manage365.", + "helpText": "This integration allows you to manage GitHub repositories from Manage365, including the Community Repositories functionality. Requires a GitHub Personal Access Token (PAT) with a minimum of repo:public_repo permissions. If you plan on saving your templates to GitHub or accessing private/internal repositories, you will need to grant the whole repo scope. You can create a PAT in your GitHub account settings, see the GitHub Token documentation for more info. If you do not enable the extension, a read-only API will be provided.", "links": [ { "name": "GitHub Token", diff --git a/frontend/src/data/GraphExplorerPresets.json b/frontend/src/data/GraphExplorerPresets.json index a6939606d2..70211f8b28 100644 --- a/frontend/src/data/GraphExplorerPresets.json +++ b/frontend/src/data/GraphExplorerPresets.json @@ -9,26 +9,6 @@ }, "isBuiltin": true }, - { - "name": "Licensed Users", - "id": "6aa4445d-1202-41bb-9d24-431869420d13", - "params": { - "endpoint": "/users", - "$filter": "assignedLicenses/$count ne 0", - "$count": true - }, - "isBuiltin": true - }, - { - "name": "Licensed and Enabled Users", - "id": "277f07f1-17d5-4339-bc3f-c95c904ae794", - "params": { - "endpoint": "/users", - "$filter": "assignedLicenses/$count ne 0 and accountEnabled eq true", - "$count": true - }, - "isBuiltin": true - }, { "name": "All Devices listing ID, Displayname, and registration status", "id": "e7fdc49a-72a9-4a70-9dbf-a74152495d80", diff --git a/frontend/src/data/accessTypes.js b/frontend/src/data/accessTypes.js new file mode 100644 index 0000000000..0893fc4137 --- /dev/null +++ b/frontend/src/data/accessTypes.js @@ -0,0 +1,231 @@ +export const ACCESS_TYPES = { + guest: { + key: "guest", + label: "Guest Access", + microsoftTerm: "B2B Collaboration", + shortDescription: + "External users are invited to your tenant as guest accounts. They appear in your directory and are subject to your Conditional Access policies.", + fullDescription: + "Guest Access (B2B Collaboration) creates a guest user object in your Entra ID directory. The guest authenticates using their home organization credentials or Email One-Time Passcode for personal accounts (Gmail, Outlook.com, etc.). Guests are subject to your Conditional Access policies and appear in your directory.", + characteristics: [ + "Creates a guest account in your directory", + "Subject to your Conditional Access policies", + "Supports organizational and personal email addresses (Gmail, Outlook.com via Email OTP)", + "Requires Entra External Collaboration settings to allow invitations", + "Used for: Teams channels (standard & private), SharePoint sites, M365 Groups", + ], + settingsLinks: [ + { + label: "External Collaboration", + href: "/tenant/administration/cross-tenant-access/external-collaboration", + }, + { + label: "Cross-Tenant Access (B2B Collaboration)", + href: "/tenant/administration/cross-tenant-access/policy", + }, + { + label: "Teams Guest Access", + href: "/teams-share/teams/teams-settings", + }, + ], + chipColor: "info", + }, + external: { + key: "external", + label: "External Access", + microsoftTerm: "B2B Direct Connect", + shortDescription: + "External users access shared channels directly from their own tenant. No guest account is created — they have no directory footprint.", + fullDescription: + "External Access (B2B Direct Connect) allows users from other M365 organizations to participate in Teams shared channels without being added to your directory. They authenticate in their home tenant and access resources directly. No guest object is created.", + characteristics: [ + "No guest account created — no directory footprint in your tenant", + "NOT subject to your Conditional Access policies (unless inbound trust is configured)", + "Requires a work or school account — personal emails (Gmail, etc.) are NOT supported", + "Requires cross-tenant access policies configured on BOTH tenants", + "Used for: Teams shared channels only", + ], + settingsLinks: [ + { + label: "Cross-Tenant Access (B2B Direct Connect)", + href: "/tenant/administration/cross-tenant-access/policy", + }, + { + label: "Teams Federation", + href: "/teams-share/teams/teams-settings", + }, + ], + chipColor: "warning", + }, +}; + +export const ACCESS_TYPE_CONTEXTS = { + teamsSharedChannel: { + primary: "external", + secondary: "guest", + note: "Shared channels use External Access (B2B Direct Connect). Only work or school accounts from other M365 organizations can be added. Personal email addresses like Gmail are not supported. Existing guest users in your directory can also be added.", + }, + teamsPrivateChannel: { + primary: "guest", + note: "Private channels use Guest Access (B2B Collaboration). External email addresses are invited as guest accounts. Both organizational and personal emails (Gmail, Outlook.com, etc.) are supported — personal emails authenticate via Email One-Time Passcode.", + }, + teamsStandardChannel: { + primary: "guest", + note: "Standard channels use Guest Access (B2B Collaboration). External users must be invited as guests and added to the parent Team.", + }, + sharepoint: { + primary: "guest", + note: "SharePoint uses Guest Access (B2B Collaboration). External users are invited as guest accounts and added to the site. Sharing links ('Anyone' links) bypass the guest invitation flow entirely.", + }, + userManagement: { + primary: "guest", + note: "Guest accounts shown here were created via B2B Collaboration invitations. External Access (B2B Direct Connect) users do not appear in your directory.", + }, + crossTenantAccess: { + showBoth: true, + note: "Cross-tenant access policies control both Guest Access (B2B Collaboration) and External Access (B2B Direct Connect). These are separate settings layers that can be configured independently.", + }, + externalCollaboration: { + primary: "guest", + note: "External Collaboration settings control Guest Access (B2B Collaboration) only — who can invite guests, which domains are allowed, and what permissions guests have. These settings do not affect External Access (B2B Direct Connect) for shared channels, which is controlled by cross-tenant access policies.", + }, + teamsGuestSettings: { + primary: "guest", + note: "These settings control whether guest users (B2B Collaboration) can use Teams. Shared channel access for external users (B2B Direct Connect) is controlled separately by cross-tenant access policies.", + }, +}; + +export const DECISION_TREE = { + general: { + question: "What type of email address does the external user have?", + options: [ + { + label: "Personal email (Gmail, Yahoo, Outlook.com, etc.)", + result: { + accessType: "guest", + title: "Use Guest Access (B2B Collaboration)", + description: "Personal email addresses must use Guest Access. The user will be invited to your directory and authenticate via Email One-Time Passcode (OTP).", + supported: ["SharePoint sites", "Teams standard channels", "Teams private channels"], + notSupported: ["Teams shared channels — requires a work/school account from another M365 organization"], + nextSteps: [ + "Invite the user as a guest from the External Access Wizard or a site/team details page", + "Ensure Email OTP is enabled in Authentication Methods", + "Add the user to the target SharePoint site or Team", + ], + }, + }, + { + label: "Work/school email from another organization", + question: "What resource do they need access to?", + options: [ + { + label: "SharePoint site or Teams standard/private channel", + result: { + accessType: "guest", + title: "Recommended: Guest Access (B2B Collaboration)", + description: "Guest Access creates a directory object in your tenant, making the user subject to your Conditional Access policies. This provides the most control over the external user.", + supported: ["SharePoint sites", "Teams standard channels", "Teams private channels", "M365 Groups"], + notSupported: [], + nextSteps: [ + "Invite the user as a guest from the External Access Wizard", + "Ensure the user's domain is allowed in Entra External Collaboration settings", + "Add the user to the target resource", + ], + }, + }, + { + label: "Teams shared channel", + result: { + accessType: "external", + title: "Use External Access (B2B Direct Connect)", + description: "Shared channels require B2B Direct Connect. The external user accesses the channel directly from their own tenant — no guest account is created in your directory.", + supported: ["Teams shared channels"], + notSupported: ["SharePoint sites (use Guest Access instead)", "Standard/private channels (use Guest Access instead)"], + nextSteps: [ + "Configure a cross-tenant access partner policy for the external organization", + "Ensure B2B Direct Connect inbound is set to Allow", + "The external organization must also configure outbound B2B Direct Connect", + "Add the user to the shared channel", + ], + }, + }, + ], + }, + { + label: "Not sure / other", + result: { + accessType: "guest", + title: "Start with Guest Access (B2B Collaboration)", + description: "If you're unsure about the email type, Guest Access is the safest starting point. It works with both organizational and personal email addresses.", + supported: ["SharePoint sites", "Teams standard channels", "Teams private channels"], + notSupported: ["Teams shared channels (if the domain is personal)"], + nextSteps: [ + "Try inviting the user as a guest", + "If the invitation fails, check External Collaboration settings for domain restrictions", + "Use the Sharing Troubleshooter to diagnose any access issues", + ], + }, + }, + ], + }, + sharepoint: { + result: { + accessType: "guest", + title: "SharePoint uses Guest Access (B2B Collaboration)", + description: "External users are invited as guest accounts and added to the SharePoint site. Both organizational and personal email addresses are supported. Sharing links ('Anyone' links) can also be used to bypass the guest invitation flow entirely.", + supported: ["All external email types via guest invitation", "Anonymous access via sharing links"], + notSupported: ["B2B Direct Connect — SharePoint does not support External Access"], + nextSteps: [ + "Ensure SharePoint external sharing is enabled (at least 'Existing guests')", + "Check that the user's domain is allowed in both Entra and SharePoint domain lists", + "Invite the user and add them to the site, or create a sharing link", + ], + }, + }, + teamsStandard: { + result: { + accessType: "guest", + title: "Standard channels use Guest Access (B2B Collaboration)", + description: "External users must be invited as guests and added to the parent Team. They then have access to all standard channels. Both organizational and personal email addresses are supported.", + supported: ["Organizational emails", "Personal emails (via Email OTP)"], + notSupported: [], + nextSteps: [ + "Invite the user as a guest to the tenant", + "Add them to the Team", + "They will automatically have access to all standard channels", + ], + }, + }, + teamsPrivate: { + result: { + accessType: "guest", + title: "Private channels use Guest Access (B2B Collaboration)", + description: "Private channels use Guest Access. The guest must be a member of the parent Team first, then added to the private channel specifically. Both organizational and personal email addresses are supported.", + supported: ["Organizational emails", "Personal emails (via Email OTP)"], + notSupported: [], + nextSteps: [ + "Invite the user as a guest to the tenant", + "Add them to the parent Team first", + "Then add them to the specific private channel", + ], + }, + }, + teamsShared: { + result: { + accessType: "external", + title: "Shared channels use External Access (B2B Direct Connect)", + description: "Shared channels allow users from other M365 organizations to participate without being added to your directory. This requires cross-tenant access policies configured on BOTH tenants. Personal email addresses (Gmail, Yahoo, etc.) are NOT supported.", + supported: ["Work/school accounts from other M365 organizations"], + notSupported: [ + "Personal emails (Gmail, Yahoo, Outlook.com) — use a standard or private channel instead", + "Accounts from organizations without Microsoft 365", + ], + nextSteps: [ + "Verify the external user has a work/school account", + "Configure a cross-tenant access partner policy", + "Ensure B2B Direct Connect is allowed inbound AND the external org allows outbound", + "Add the user to the shared channel", + ], + }, + }, +}; diff --git a/frontend/src/data/alerts.json b/frontend/src/data/alerts.json index 74317dbdcd..743a67dee4 100644 --- a/frontend/src/data/alerts.json +++ b/frontend/src/data/alerts.json @@ -184,7 +184,7 @@ }, { "inputType": "textField", - "inputLabel": "Excluded mailbox UPNs (comma-separated). Supports custom variables like %excludefrommailboxalert% defined under CIPP > Settings > Custom Variables at tenant or AllTenants scope.", + "inputLabel": "Excluded mailbox UPNs (comma-separated). Supports custom variables like %excludefrommailboxalert% defined under Manage365 > Settings > Custom Variables at tenant or AllTenants scope.", "inputName": "QuotaUsedExcludedMailboxes" }, { @@ -215,7 +215,7 @@ }, { "inputType": "textField", - "inputLabel": "Excluded mailbox UPNs (comma-separated). Supports custom variables like %excludefromarchivealert% defined under CIPP > Settings > Custom Variables at tenant or AllTenants scope.", + "inputLabel": "Excluded mailbox UPNs (comma-separated). Supports custom variables like %excludefromarchivealert% defined under Manage365 > Settings > Custom Variables at tenant or AllTenants scope.", "inputName": "ArchiveQuotaExcludedMailboxes" } ], @@ -511,12 +511,6 @@ "inputLabel": "Days until expiry to alert (default: 30)", "inputName": "DaysUntilExpiry" }, - { - "name": "IntuneApprovalRequests", - "label": "Alert on Intune changes waiting for multi-admin approval", - "recommendedRunInterval": "1d", - "description": "Multi-admin approval holds a protected Intune change until a second administrator approves it, and nothing notifies the requestor. This reports requests still sitting in needsApproval." - }, { "name": "SoftDeletedMailboxes", "label": "Alert on soft deleted mailboxes", @@ -595,9 +589,9 @@ }, { "name": "HuntressRogueApps", - "label": "Alert on Huntress or CIPP Rogue Apps detected", + "label": "Alert on Huntress or Manage365 Rogue Apps detected", "recommendedRunInterval": "4h", - "description": "Huntress has provided a repository of known rogue apps that are commonly used in BEC, data exfiltration and other Microsoft 365 attacks. This alert will notify you if any of these apps are detected in the selected tenant(s). For more information, see https://huntresslabs.github.io/rogueapps/. CIPP also maintains its own curated list of rogue apps, so detections may include applications that are not on the Huntress site. See the CIPP documentation for the full list.", + "description": "Huntress has provided a repository of known rogue apps that are commonly used in BEC, data exfiltration and other Microsoft 365 attacks. This alert will notify you if any of these apps are detected in the selected tenant(s). For more information, see https://huntresslabs.github.io/rogueapps/. Manage365 also maintains its own curated list of rogue apps, so detections may include applications that are not on the Huntress site. See the documentation for the full list.", "requiresInput": true, "inputType": "switch", "inputLabel": "Ignore Disabled Apps?", @@ -659,7 +653,7 @@ "name": "NewRiskyUsers", "label": "Alert on new risky users (P2 License Required)", "recommendedRunInterval": "30m", - "description": "Monitors for new risky users in the tenant. Risky users are defined as users who have performed actions that are considered risky, such as password resets, MFA failures, or suspicious activity. Optionally runs the default BEC containment (set under CIPP Settings > BEC Remediation Defaults; out of the box: reset password, block sign-in, revoke sessions, remove MFA methods, disable inbox rules, block legacy mailbox protocols) automatically for users that newly appear at high risk - this locks the user out without a human in the loop, so enable it only where that is the agreed response.", + "description": "Monitors for new risky users in the tenant. Risky users are defined as users who have performed actions that are considered risky, such as password resets, MFA failures, or suspicious activity. Optionally runs the default BEC containment (set under Manage365 Settings > BEC Remediation Defaults; out of the box: reset password, block sign-in, revoke sessions, remove MFA methods, disable inbox rules, block legacy mailbox protocols) automatically for users that newly appear at high risk - this locks the user out without a human in the loop, so enable it only where that is the agreed response.", "requiresInput": true, "inputType": "switch", "inputLabel": "Automatically contain users that newly appear at high risk (default BEC containment)", @@ -700,7 +694,7 @@ "name": "QuarantineReleaseRequests", "label": "Alert on quarantine release requests", "recommendedRunInterval": "1h", - "description": "Monitors for user requests to release quarantined messages and provides a CIPP-native alternative to the external email forwarding method. This helps MSPs maintain secure configurations while getting timely notifications about quarantine activity. Links to the tenant's quarantine page are provided in alerts." + "description": "Monitors for user requests to release quarantined messages and provides a Manage365-native alternative to the external email forwarding method. This helps MSPs maintain secure configurations while getting timely notifications about quarantine activity. Links to the tenant's quarantine page are provided in alerts." }, { "name": "StaleEntraDevices", diff --git a/frontend/src/data/dashboardv2-demo-data.js b/frontend/src/data/dashboardv2-demo-data.js index 4f0db4c12a..a7432c5d97 100644 --- a/frontend/src/data/dashboardv2-demo-data.js +++ b/frontend/src/data/dashboardv2-demo-data.js @@ -1,8 +1,8 @@ // Demo data structure matching Zero Trust Assessment export const dashboardDemoData = { - ExecutedAt: '2025-12-16T10:00:00Z', - TenantName: 'Demo Tenant', - Domain: 'demo.contoso.com', + ExecutedAt: "2025-12-16T10:00:00Z", + TenantName: "Demo Tenant", + Domain: "demo.contoso.com", TestResultSummary: { IdentityPassed: 85, IdentityTotal: 100, @@ -13,100 +13,100 @@ export const dashboardDemoData = { }, TenantInfo: { TenantOverview: { - UserCount: 0, - GuestCount: 0, - GroupCount: 0, - ApplicationCount: 0, - DeviceCount: 0, - ManagedDeviceCount: 0, + UserCount: 1250, + GuestCount: 85, + GroupCount: 340, + ApplicationCount: 156, + DeviceCount: 765, + ManagedDeviceCount: 733, }, OverviewCaMfaAllUsers: { description: - 'Over the past 30 days, 68.5% of sign-ins were protected by conditional access policies enforcing multifactor authentication.', + "Over the past 30 days, 68.5% of sign-ins were protected by conditional access policies enforcing multifactor authentication.", nodes: [ - { source: 'User sign in', target: 'No CA applied', value: 394 }, - { source: 'User sign in', target: 'CA applied', value: 856 }, - { source: 'CA applied', target: 'No MFA', value: 146 }, - { source: 'CA applied', target: 'MFA', value: 710 }, + { source: "User sign in", target: "No CA applied", value: 394 }, + { source: "User sign in", target: "CA applied", value: 856 }, + { source: "CA applied", target: "No MFA", value: 146 }, + { source: "CA applied", target: "MFA", value: 710 }, ], }, OverviewCaDevicesAllUsers: { - description: 'Over the past 30 days, 71.2% of sign-ins were from compliant devices.', + description: "Over the past 30 days, 71.2% of sign-ins were from compliant devices.", nodes: [ - { source: 'User sign in', target: 'Unmanaged', value: 500 }, - { source: 'User sign in', target: 'Managed', value: 1150 }, - { source: 'Managed', target: 'Non-compliant', value: 260 }, - { source: 'Managed', target: 'Compliant', value: 890 }, + { source: "User sign in", target: "Unmanaged", value: 500 }, + { source: "User sign in", target: "Managed", value: 1150 }, + { source: "Managed", target: "Non-compliant", value: 260 }, + { source: "Managed", target: "Compliant", value: 890 }, ], }, OverviewAuthMethodsPrivilegedUsers: { - description: 'Authentication methods used by privileged users over the past 30 days.', + description: "Authentication methods used by privileged users over the past 30 days.", nodes: [ - { source: 'Users', target: 'Single factor', value: 5 }, - { source: 'Users', target: 'Phishable', value: 28 }, - { source: 'Users', target: 'Phish resistant', value: 15 }, - { source: 'Phishable', target: 'Phone', value: 8 }, - { source: 'Phishable', target: 'Authenticator', value: 20 }, - { source: 'Phish resistant', target: 'Passkey', value: 12 }, - { source: 'Phish resistant', target: 'WHfB', value: 3 }, + { source: "Users", target: "Single factor", value: 5 }, + { source: "Users", target: "Phishable", value: 28 }, + { source: "Users", target: "Phish resistant", value: 15 }, + { source: "Phishable", target: "Phone", value: 8 }, + { source: "Phishable", target: "Authenticator", value: 20 }, + { source: "Phish resistant", target: "Passkey", value: 12 }, + { source: "Phish resistant", target: "Windows Hello", value: 3 }, ], }, OverviewAuthMethodsAllUsers: { - description: 'Authentication methods used by all users over the past 30 days.', + description: "Authentication methods used by all users over the past 30 days.", nodes: [ - { source: 'Users', target: 'Single factor', value: 120 }, - { source: 'Users', target: 'Phishable', value: 580 }, - { source: 'Users', target: 'Phish resistant', value: 550 }, - { source: 'Phishable', target: 'Phone', value: 180 }, - { source: 'Phishable', target: 'Authenticator', value: 400 }, - { source: 'Phish resistant', target: 'Passkey', value: 450 }, - { source: 'Phish resistant', target: 'WHfB', value: 100 }, + { source: "Users", target: "Single factor", value: 120 }, + { source: "Users", target: "Phishable", value: 580 }, + { source: "Users", target: "Phish resistant", value: 550 }, + { source: "Phishable", target: "Phone", value: 180 }, + { source: "Phishable", target: "Authenticator", value: 400 }, + { source: "Phish resistant", target: "Passkey", value: 450 }, + { source: "Phish resistant", target: "Windows Hello", value: 100 }, ], }, DeviceOverview: { DesktopDevicesSummary: { - description: 'Desktop devices (Windows and macOS) by join type and compliance status.', + description: "Desktop devices (Windows and macOS) by join type and compliance status.", nodes: [ // Level 1: Desktop devices to OS - { source: 'Desktop devices', target: 'Windows', value: 585 }, - { source: 'Desktop devices', target: 'macOS', value: 75 }, + { source: "Desktop devices", target: "Windows", value: 585 }, + { source: "Desktop devices", target: "macOS", value: 75 }, // Level 2: Windows to join types - { source: 'Windows', target: 'Entra joined', value: 285 }, - { source: 'Windows', target: 'Entra registered', value: 100 }, - { source: 'Windows', target: 'Entra hybrid joined', value: 200 }, + { source: "Windows", target: "Entra joined", value: 285 }, + { source: "Windows", target: "Entra registered", value: 100 }, + { source: "Windows", target: "Entra hybrid joined", value: 200 }, // Level 3: Windows join types to compliance - { source: 'Entra joined', target: 'Compliant', value: 171 }, - { source: 'Entra joined', target: 'Non-compliant', value: 42 }, - { source: 'Entra joined', target: 'Unmanaged', value: 72 }, - { source: 'Entra hybrid joined', target: 'Compliant', value: 50 }, - { source: 'Entra hybrid joined', target: 'Non-compliant', value: 23 }, - { source: 'Entra hybrid joined', target: 'Unmanaged', value: 127 }, - { source: 'Entra registered', target: 'Compliant', value: 60 }, - { source: 'Entra registered', target: 'Non-compliant', value: 40 }, - { source: 'Entra registered', target: 'Unmanaged', value: 0 }, + { source: "Entra joined", target: "Compliant", value: 171 }, + { source: "Entra joined", target: "Non-compliant", value: 42 }, + { source: "Entra joined", target: "Unmanaged", value: 72 }, + { source: "Entra hybrid joined", target: "Compliant", value: 50 }, + { source: "Entra hybrid joined", target: "Non-compliant", value: 23 }, + { source: "Entra hybrid joined", target: "Unmanaged", value: 127 }, + { source: "Entra registered", target: "Compliant", value: 60 }, + { source: "Entra registered", target: "Non-compliant", value: 40 }, + { source: "Entra registered", target: "Unmanaged", value: 0 }, // Level 2: macOS directly to compliance - { source: 'macOS', target: 'Compliant', value: 56 }, - { source: 'macOS', target: 'Non-compliant', value: 15 }, - { source: 'macOS', target: 'Unmanaged', value: 4 }, + { source: "macOS", target: "Compliant", value: 56 }, + { source: "macOS", target: "Non-compliant", value: 15 }, + { source: "macOS", target: "Unmanaged", value: 4 }, ], }, MobileSummary: { - description: 'Mobile devices by compliance status.', + description: "Mobile devices by compliance status.", nodes: [ - { source: 'Mobile devices', target: 'Android', value: 105 }, - { source: 'Mobile devices', target: 'iOS', value: 75 }, - { source: 'Android', target: 'Android (Company)', value: 72 }, - { source: 'Android', target: 'Android (Personal)', value: 33 }, - { source: 'iOS', target: 'iOS (Company)', value: 58 }, - { source: 'iOS', target: 'iOS (Personal)', value: 17 }, - { source: 'Android (Company)', target: 'Compliant', value: 60 }, - { source: 'Android (Company)', target: 'Non-compliant', value: 12 }, - { source: 'Android (Personal)', target: 'Compliant', value: 10 }, - { source: 'Android (Personal)', target: 'Non-compliant', value: 23 }, - { source: 'iOS (Company)', target: 'Compliant', value: 52 }, - { source: 'iOS (Company)', target: 'Non-compliant', value: 6 }, - { source: 'iOS (Personal)', target: 'Compliant', value: 11 }, - { source: 'iOS (Personal)', target: 'Non-compliant', value: 6 }, + { source: "Mobile devices", target: "Android", value: 105 }, + { source: "Mobile devices", target: "iOS", value: 75 }, + { source: "Android", target: "Android (Company)", value: 72 }, + { source: "Android", target: "Android (Personal)", value: 33 }, + { source: "iOS", target: "iOS (Company)", value: 58 }, + { source: "iOS", target: "iOS (Personal)", value: 17 }, + { source: "Android (Company)", target: "Compliant", value: 60 }, + { source: "Android (Company)", target: "Non-compliant", value: 12 }, + { source: "Android (Personal)", target: "Compliant", value: 10 }, + { source: "Android (Personal)", target: "Non-compliant", value: 23 }, + { source: "iOS (Company)", target: "Compliant", value: 52 }, + { source: "iOS (Company)", target: "Non-compliant", value: 6 }, + { source: "iOS (Personal)", target: "Compliant", value: 11 }, + { source: "iOS (Personal)", target: "Non-compliant", value: 6 }, ], }, ManagedDevices: { @@ -128,4 +128,4 @@ export const dashboardDemoData = { }, }, }, -} +}; diff --git a/frontend/src/data/intuneCollection.json b/frontend/src/data/intuneCollection.json new file mode 100644 index 0000000000..879a69a8f4 --- /dev/null +++ b/frontend/src/data/intuneCollection.json @@ -0,0 +1 @@ +[{"id":".globalpreferences_.globalpreferences","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":".globalpreferences_com.apple.autologout.autologoutdelay","displayName":"Auto Log Out Delay","description":"The autologout delay, in seconds. A value of 0 means autologout is off. In some cases, this delay may be restricted to values between 5 minutes and 24 hours.","helpText":null,"infoUrls":[],"options":null},{"id":".globalpreferences_multiplesessionenabled","displayName":"Multiple Session Enabled","description":"If false, disables fast user switching.","helpText":null,"infoUrls":[],"options":[{"id":".globalpreferences_multiplesessionenabled_false","displayName":"False","description":null,"helpText":null},{"id":".globalpreferences_multiplesessionenabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"~policy~cat_edgeupdate~cat_applications~cat_microsoftedge_pol_targetversionprefixmicrosoftedge","displayName":"Target version override","description":"When this policy is enabled, and auto-update is enabled, Microsoft Edge will be updated to the version specified by this policy value.\r\n\r\nThe policy value must be a specific Microsoft Edge version, e.g. 83.0.499.12.\r\n\r\nIf a device has newer version of Microsoft Edge than the value specified, Microsoft Edge will remain on the newer version and not downgrade to the specified version.\r\n\r\nIf the specified version does not exist, or is improperly formatted, then Microsoft Edge will remain on its current version and not update to future versions automatically.","helpText":"","infoUrls":[],"options":[{"id":"~policy~cat_edgeupdate~cat_applications~cat_microsoftedge_pol_targetversionprefixmicrosoftedge_0","displayName":"Disabled","description":null,"helpText":null},{"id":"~policy~cat_edgeupdate~cat_applications~cat_microsoftedge_pol_targetversionprefixmicrosoftedge_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"~policy~cat_edgeupdate~cat_applications~cat_microsoftedge_pol_targetversionprefixmicrosoftedge_part_targetversionprefix","displayName":"Target version (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"~policy~cat_edgeupdate~cat_applications~cat_microsoftedgebeta_pol_targetversionprefixmicrosoftedgebeta","displayName":"Target version override","description":"When this policy is enabled, and auto-update is enabled, Microsoft Edge will be updated to the version specified by this policy value.\r\n\r\nThe policy value must be a specific Microsoft Edge version, e.g. 83.0.499.12.\r\n\r\nIf a device has newer version of Microsoft Edge than the value specified, Microsoft Edge will remain on the newer version and not downgrade to the specified version.\r\n\r\nIf the specified version does not exist, or is improperly formatted, then Microsoft Edge will remain on its current version and not update to future versions automatically.","helpText":"","infoUrls":[],"options":[{"id":"~policy~cat_edgeupdate~cat_applications~cat_microsoftedgebeta_pol_targetversionprefixmicrosoftedgebeta_0","displayName":"Disabled","description":null,"helpText":null},{"id":"~policy~cat_edgeupdate~cat_applications~cat_microsoftedgebeta_pol_targetversionprefixmicrosoftedgebeta_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"~policy~cat_edgeupdate~cat_applications~cat_microsoftedgebeta_pol_targetversionprefixmicrosoftedgebeta_part_targetversionprefix","displayName":"Target version (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"~policy~cat_edgeupdate~cat_applications~cat_microsoftedgecanary_pol_targetversionprefixmicrosoftedgecanary","displayName":"Target version override","description":"When this policy is enabled, and auto-update is enabled, Microsoft Edge will be updated to the version specified by this policy value.\r\n\r\nThe policy value must be a specific Microsoft Edge version, e.g. 83.0.499.12.\r\n\r\nIf a device has newer version of Microsoft Edge than the value specified, Microsoft Edge will remain on the newer version and not downgrade to the specified version.\r\n\r\nIf the specified version does not exist, or is improperly formatted, then Microsoft Edge will remain on its current version and not update to future versions automatically.","helpText":"","infoUrls":[],"options":[{"id":"~policy~cat_edgeupdate~cat_applications~cat_microsoftedgecanary_pol_targetversionprefixmicrosoftedgecanary_0","displayName":"Disabled","description":null,"helpText":null},{"id":"~policy~cat_edgeupdate~cat_applications~cat_microsoftedgecanary_pol_targetversionprefixmicrosoftedgecanary_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"~policy~cat_edgeupdate~cat_applications~cat_microsoftedgecanary_pol_targetversionprefixmicrosoftedgecanary_part_targetversionprefix","displayName":"Target version (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"~policy~cat_edgeupdate~cat_applications~cat_microsoftedgedev_pol_targetversionprefixmicrosoftedgedev","displayName":"Target version override","description":"When this policy is enabled, and auto-update is enabled, Microsoft Edge will be updated to the version specified by this policy value.\r\n\r\nThe policy value must be a specific Microsoft Edge version, e.g. 83.0.499.12.\r\n\r\nIf a device has newer version of Microsoft Edge than the value specified, Microsoft Edge will remain on the newer version and not downgrade to the specified version.\r\n\r\nIf the specified version does not exist, or is improperly formatted, then Microsoft Edge will remain on its current version and not update to future versions automatically.","helpText":"","infoUrls":[],"options":[{"id":"~policy~cat_edgeupdate~cat_applications~cat_microsoftedgedev_pol_targetversionprefixmicrosoftedgedev_0","displayName":"Disabled","description":null,"helpText":null},{"id":"~policy~cat_edgeupdate~cat_applications~cat_microsoftedgedev_pol_targetversionprefixmicrosoftedgedev_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"~policy~cat_edgeupdate~cat_applications~cat_microsoftedgedev_pol_targetversionprefixmicrosoftedgedev_part_targetversionprefix","displayName":"Target version (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"3~policy~microsoft_edge_targetblankimpliesnoopener","displayName":"Do not set window.opener for links targeting _blank (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 102.\r\n\r\nIf you enable this policy or leave it unset, the window.opener property is set to null unless the anchor specifies rel=\"opener\".\r\n\r\nIf you disable this policy, popups that target _blank are permitted to access (via JavaScript) the page that requested to open the popup.","helpText":"","infoUrls":[],"options":[{"id":"3~policy~microsoft_edge_targetblankimpliesnoopener_0","displayName":"Disabled","description":null,"helpText":null},{"id":"3~policy~microsoft_edge_targetblankimpliesnoopener_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"3~policy~microsoft_edge~httpauthentication_basicauthoverhttpenabled","displayName":"Allow Basic authentication for HTTP (User)","description":"If you enable this policy or leave it unset, Basic authentication challenges received over non-secure HTTP will be allowed.\r\n\r\nIf you disable this policy, non-secure HTTP requests from the Basic authentication scheme are blocked, and only secure HTTPS is allowed.","helpText":"","infoUrls":[],"options":[{"id":"3~policy~microsoft_edge~httpauthentication_basicauthoverhttpenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"3~policy~microsoft_edge~httpauthentication_basicauthoverhttpenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"ade_activatecellulardata","displayName":"Carrier activation server URL","description":"","helpText":"http://activation.carrier.net","infoUrls":[],"options":null},{"id":"ade_activatecellulardatachoices","displayName":"Activate cellular data","description":"Activates cellular data plans for devices enabled for eSIM. The carrier must enable activation for devices before you can use this command. You can also activate any time after device enrollment.","helpText":"","infoUrls":[],"options":[{"id":"ade_activatecellulardatachoices_0","displayName":"No","description":null,"helpText":null},{"id":"ade_activatecellulardatachoices_1","displayName":"Yes","description":null,"helpText":null}]},{"id":"ade_appledevicenametemplate","displayName":"Device name template","description":"Create a unique name for your devices. Names must be 63 characters or less, and can contain letters (a-z, A-Z), numbers (0-9), and hyphens.Variables supported: {{SERIAL}}, {{DEVICETYPE}}","helpText":"{{DEVICETYPE}}-{{SERIAL}}","infoUrls":[],"options":null},{"id":"ade_authenticationmethod","displayName":"Intune authentication method","description":"If your organization uses multifactor authentication, select Setup Assistant with modern authentication, which prompts users to authenticate based on settings in Entra.","helpText":"","infoUrls":[],"options":{"id":"ade_authenticationmethod_2","displayName":"Setup Assistant with modern authentication","description":null,"helpText":null}},{"id":"ade_awaitconfiguration_basic","displayName":"Await final configuration","description":"Keeps the device in Setup Assistant until the first sync between the device and Intune installs policies.","helpText":"","infoUrls":[],"options":[{"id":"ade_awaitconfiguration_basic_0","displayName":"No","description":null,"helpText":null},{"id":"ade_awaitconfiguration_basic_1","displayName":"Yes","description":null,"helpText":null}]},{"id":"ade_devicenametemplatechoices","displayName":"Apple device name template","description":"You can create a standard naming format to make it easier to name devices as they enroll in Intune. By default, Apple uses the device type (such as iPad or iPhone) and serial number to name ADE devices.","helpText":"","infoUrls":[],"options":[{"id":"ade_devicenametemplatechoices_0","displayName":"No","description":null,"helpText":null},{"id":"ade_devicenametemplatechoices_1","displayName":"Yes","description":null,"helpText":null}]},{"id":"ade_lockedenrollment","displayName":"Locked enrollment","description":"Blocks the user from removing the management profile through the iOS/iPadOS Settings menu.","helpText":"","infoUrls":[],"options":[{"id":"ade_lockedenrollment_0","displayName":"No","description":null,"helpText":null},{"id":"ade_lockedenrollment_1","displayName":"Yes","description":null,"helpText":null}]},{"id":"ade_maximumcachedusers","displayName":"Maximum cached users","description":"The maximum number of users that can use a Shared iPad. You can cache up to 24 users on a 32GB or 64GB device.","helpText":null,"infoUrls":[],"options":null},{"id":"ade_maximumsecondsafterscreenlockbeofrepasswordisrequired","displayName":"Maximum seconds after screen lock before password is required","description":"Available for Shared iPads. Maximum seconds after screen lock before password is required (0-14,400 seconds). If a device has a passcode, a change to a larger value doesn’t take effect until the user logs out or removes the passcode.","helpText":"Enter value","infoUrls":[],"options":null},{"id":"ade_maximumsecondsinactivityuntiltemporarysessionlogsout","displayName":"Maximum seconds of inactivity until temporary session logs out","description":"Available for devices running iPadOS versions 14.5 and later. Enter a value in seconds (minimum value to add is 30 seconds). If there isn't any activity after the value you enter, then the temporary session automatically signs out. If you set the value to anything between 0-29, then the temporary session stays signed in. ","helpText":"Enter value","infoUrls":[],"options":null},{"id":"ade_maximumsecondsinactivityuntiluserlogsout","displayName":"Maximum seconds of inactivity until user session logs out","description":"Available for devices running iPadOS versions 14.5 and later. Enter a value in seconds (minimum value to add is 30 seconds). If there isn't any activity after the value you enter, the user session automatically signs out. If you set the value to anything between 0-29, then the user session stays signed in.","helpText":"Enter value","infoUrls":[],"options":null},{"id":"ade_modernauth_awaitfinalconfiguration","displayName":"Await final configuration","description":"Keeps the device in Setup Assistant until the first sync between the device and Intune installs policies.","helpText":"","infoUrls":[],"options":[{"id":"ade_modernauth_awaitfinalconfiguration_0","displayName":"No","description":null,"helpText":null},{"id":"ade_modernauth_awaitfinalconfiguration_1","displayName":"Yes","description":null,"helpText":null}]},{"id":"ade_requiresharedipadtemporarysessiononly","displayName":"Require Shared iPad temporary session only","description":"Available for devices running iPadOS versions 14.5 and later. When set to Yes, users only see the Guest Welcome pane, and can only sign in as a guest user. Users can't sign in with a Managed Apple ID.","helpText":"","infoUrls":[],"options":[{"id":"ade_requiresharedipadtemporarysessiononly_0","displayName":"Not configured","description":null,"helpText":null},{"id":"ade_requiresharedipadtemporarysessiononly_1","displayName":"Yes","description":null,"helpText":null}]},{"id":"ade_setupassistant_actionbutton","displayName":"Action Button","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_actionbutton_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_actionbutton_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_androidmigration","displayName":"Android migration","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_androidmigration_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_androidmigration_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_appearance","displayName":"Appearance","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_appearance_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_appearance_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_appleid","displayName":"Apple ID","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_appleid_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_appleid_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_applepay","displayName":"Apple Pay","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_applepay_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_applepay_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_department","displayName":"Department","description":null,"helpText":"Appears to users on About Configuration screen","infoUrls":[],"options":null},{"id":"ade_setupassistant_departmentphone","displayName":"Department phone","description":null,"helpText":"Appears to users on About Configuration screen","infoUrls":[],"options":null},{"id":"ade_setupassistant_devicemigration","displayName":"Device to device migration","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_devicemigration_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_devicemigration_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_diagnosticsdata","displayName":"Diagnostics Data","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_diagnosticsdata_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_diagnosticsdata_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_enablelockdownmode","displayName":"Enable Lock down Mode","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_enablelockdownmode_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_enablelockdownmode_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_getstarted","displayName":"Get Started","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_getstarted_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_getstarted_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_imessagefacetime","displayName":"iMessage and FaceTime","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_imessagefacetime_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_imessagefacetime_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_intelligence","displayName":"Intelligence","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_intelligence_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_intelligence_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_locationservices","displayName":"Location services","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_locationservices_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_locationservices_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_passcode","displayName":"Passcode","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_passcode_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_passcode_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_privacy","displayName":"Privacy","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_privacy_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_privacy_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_restore","displayName":"Restore","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_restore_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_restore_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_restorecompleted","displayName":"Restore completed","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_restorecompleted_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_restorecompleted_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_safety","displayName":"Emergency SOS","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_safety_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_safety_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_screentime","displayName":"Screen Time","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_screentime_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_screentime_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_simsetup","displayName":"SIM setup","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_simsetup_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_simsetup_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_siri","displayName":"Siri","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_siri_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_siri_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_softwareupdate","displayName":"Software Update","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_softwareupdate_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_softwareupdate_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_softwareupdatecompleted","displayName":"Software Update completed","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_softwareupdatecompleted_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_softwareupdatecompleted_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_termsandconditions","displayName":"Terms and conditions","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_termsandconditions_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_termsandconditions_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_termsofaddress","displayName":"Terms of Address","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_termsofaddress_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_termsofaddress_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_touchfaceid","displayName":"Touch ID and Face ID","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_touchfaceid_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_touchfaceid_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_voiceselection","displayName":"Voice selection","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_voiceselection_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_voiceselection_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_setupassistant_watchmigration","displayName":"Watch migration","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"ade_setupassistant_watchmigration_0","displayName":"Hide","description":null,"helpText":null},{"id":"ade_setupassistant_watchmigration_1","displayName":"Show","description":null,"helpText":null}]},{"id":"ade_useraffinity","displayName":"User affinity","description":"User affinity associates devices with users. Users must authenticate to enroll with user affinity.","helpText":"","infoUrls":[],"options":[{"id":"ade_useraffinity_1","displayName":"Enroll with user affinity","description":null,"helpText":null},{"id":"ade_useraffinity_0","displayName":"Enroll without user affinity","description":null,"helpText":null},{"id":"ade_useraffinity_2","displayName":"Enroll with Microsoft Entra ID shared mode","description":null,"helpText":null},{"id":"ade_useraffinity_3","displayName":"Enroll with Shared iPad","description":null,"helpText":null}]},{"id":"ade_useraffinity_awaitfinalconfiguration","displayName":"Await final configuration","description":"Keeps the device in Setup Assistant until the first sync between the device and Intune installs policies.","helpText":"","infoUrls":[],"options":[{"id":"ade_useraffinity_awaitfinalconfiguration_0","displayName":"No","description":null,"helpText":null},{"id":"ade_useraffinity_awaitfinalconfiguration_1","displayName":"Yes","description":null,"helpText":null}]},{"id":"ade_useraffinitybasic","displayName":"User affinity","description":"User affinity associates devices with users. Users must authenticate to enroll with user affinity.","helpText":"","infoUrls":[],"options":{"id":"ade_useraffinitybasic_0","displayName":"Enroll without user affinity","description":null,"helpText":null}},{"id":"apple_customprofile_profile","displayName":"Profile","description":"A admin uploaded profile to install.","helpText":null,"infoUrls":[],"options":null},{"id":"audioaccessory_audioaccessory","displayName":"com.apple.configuration.audio-accessory.settings","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"audioaccessory_temporarypairing","displayName":"Temporary Pairing","description":"A dictionary that describes audio accessory temporary pairing behavior. The device enables temporary pairing when this key is present and the `Disabled` key isn't `false`. The device doesn't synchronize pairing information with iCloud when temporary pairing is active.","helpText":null,"infoUrls":[],"options":null},{"id":"audioaccessory_temporarypairing_configuration","displayName":"Configuration","description":"A dictionary providing configuration for temporary pairing. Required if `Disabled` isn't present or is `false`.","helpText":null,"infoUrls":[],"options":null},{"id":"audioaccessory_temporarypairing_configuration_unpairingtime","displayName":"Unpairing Time","description":"A dictionary that describes when the device automatically unpairs temporarily paired audio accessories.","helpText":null,"infoUrls":[],"options":null},{"id":"audioaccessory_temporarypairing_configuration_unpairingtime_hour","displayName":"Hour","description":"The local time hour (24-hour clock) when the device automatically unpairs temporarily paired audio accessories. Required when setting the `Policy` key to `Hour`.","helpText":null,"infoUrls":[],"options":null},{"id":"audioaccessory_temporarypairing_configuration_unpairingtime_policy","displayName":"Policy","description":"A string that specifies the device's unpairing policy.\n- `None`: The device doesn't automatically unpair. Use this only with a return to service device that you erase and reenroll when assigning it from one user to another.\n- `Hour`: The device automatically unpairs temporarily paired audio accessories at the local time that the `Hour` key specifies.","helpText":null,"infoUrls":[],"options":[{"id":"audioaccessory_temporarypairing_configuration_unpairingtime_policy_0","displayName":"None","description":null,"helpText":null},{"id":"audioaccessory_temporarypairing_configuration_unpairingtime_policy_1","displayName":"Hour","description":null,"helpText":null}]},{"id":"audioaccessory_temporarypairing_disabled","displayName":"Disabled","description":"If `true`, temporary pairing of audio accessories is disabled.","helpText":null,"infoUrls":[],"options":[{"id":"audioaccessory_temporarypairing_disabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"audioaccessory_temporarypairing_disabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.android.devicerestrictionpolicy.accountsblockmodification","displayName":"Block account changes","description":"If 'True', prevents users from updating or changing accounts when in kiosk mode. If 'False', Intune doesn't change or update this setting. By default, the OS might allow users to update user accounts on the device. Available for dedicated devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.accountsblockmodification_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.accountsblockmodification_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.appsallowinstallfromunknownsources","displayName":"Allow installation from unknown sources","description":"If 'True', allows users to enable unknown sources. This setting permits app installation from sources other than the Google Play Store, enabling users to side-load apps through alternative methods. If 'False', Intune doesn't change or update this setting. By default, the OS may prevent users from enabling unknown sources. Available for fully managed, dedicated, and corporate-owned work profile devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.appsallowinstallfromunknownsources_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.appsallowinstallfromunknownsources_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.appsautoupdatepolicy","displayName":"App auto-updates (work profile-level)","description":"Define the auto update policy for apps. Devices check for app updates daily. If set to 'User choice', the end user can set their preference in managed Google Play. If set to 'Never', apps will never auto-update. If set to 'Wi-Fi only', apps will only auto-update when the device is connected to Wi-Fi. If set to 'Always', apps will always auto-update. Available for fully managed, dedicated and corporate-owned work profile devices (at work profile level).","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.appsautoupdatepolicy_notconfigured","displayName":"Not configured","description":"Not configured; this value is ignored.","helpText":null},{"id":"com.android.devicerestrictionpolicy.appsautoupdatepolicy_userchoice","displayName":"User choice","description":"The user can control auto-updates.","helpText":null},{"id":"com.android.devicerestrictionpolicy.appsautoupdatepolicy_never","displayName":"Never","description":"Apps are never auto-updated.","helpText":null},{"id":"com.android.devicerestrictionpolicy.appsautoupdatepolicy_wifionly","displayName":"Wi-Fi only","description":"Apps are auto-updated over Wi-Fi only.","helpText":null},{"id":"com.android.devicerestrictionpolicy.appsautoupdatepolicy_always","displayName":"Always","description":"Apps are auto-updated at any time. Data charges may apply.","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.appsblockinstallfromunknownsourcesaosp","displayName":"Block user from turning on unknown sources","description":"If 'True', prevents users from sideloading apps. If 'False', Intune doesn't change or update this setting. By default, the OS might allow users to sideload apps from unknown sources.","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.appsblockinstallfromunknownsourcesaosp_false","displayName":"False","description":"False","helpText":null},{"id":"com.android.devicerestrictionpolicy.appsblockinstallfromunknownsourcesaosp_true","displayName":"True","description":"True","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.appsdefaultpermissionpolicy","displayName":"Default permission policy (work profile-level)","description":"Define the default permission policy for requests for runtime permissions. Available for fully managed, dedicated and corporate-owned work profile (at work profile level) devices.","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.appsdefaultpermissionpolicy_devicedefault","displayName":"Device default","description":"Device default value, no intent.","helpText":null},{"id":"com.android.devicerestrictionpolicy.appsdefaultpermissionpolicy_prompt","displayName":"Prompt","description":"Prompt.","helpText":null},{"id":"com.android.devicerestrictionpolicy.appsdefaultpermissionpolicy_autogrant","displayName":"Auto grant","description":"Auto grant.","helpText":null},{"id":"com.android.devicerestrictionpolicy.appsdefaultpermissionpolicy_autodeny","displayName":"Auto deny","description":"Auto deny.","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.appsrecommendskippingfirstusehints","displayName":"Skip first use hints","description":"If 'True', hides or skips suggestions from apps that step through tutorials, or hints when the app starts. If 'False', Intune doesn't change or update this setting. By default, the OS might show these suggestions when the app starts. Available for fully managed and dedicated devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.appsrecommendskippingfirstusehints_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.appsrecommendskippingfirstusehints_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.assistcontentpolicy","displayName":"Block assist content sharing with privileged apps","description":"If 'True', blocks assist content (such as screenshots and app details) to be sent to a privileged app, like an assistant app. The setting can be used to block Circle to Search (AI feature). If set to 'False', Intune doesn't change or update this setting. By default, the OS might allow sharing assist content with privileged apps. Available for fully managed, dedicated, and corporate-owned work profile devices (at work profile level).","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.assistcontentpolicy_false","displayName":"False","description":"Assist content is allowed to be sent to a privileged app.","helpText":null},{"id":"com.android.devicerestrictionpolicy.assistcontentpolicy_true","displayName":"True","description":"Assist content is blocked from being sent to a privileged app.","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.bluetoothblockconfiguration","displayName":"Block Bluetooth configuration","description":"If 'True', prevents users from configuring Bluetooth on the device. If 'False', Intune doesn't change or update this setting. By default, the OS might allow using Bluetooth on the device. Available for fully managed, dedicated and corporate-owned work profile devices. ","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.bluetoothblockconfiguration_false","displayName":"False","description":"False","helpText":null},{"id":"com.android.devicerestrictionpolicy.bluetoothblockconfiguration_true","displayName":"True","description":"True","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.bluetoothblockconfigurationaosp","displayName":"Block Bluetooth configuration","description":"If 'True', prevents users from configuring Bluetooth on the device. If 'False', Intune doesn't change or update this setting. By default, the OS might allow users to configure Bluetooth.","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.bluetoothblockconfigurationaosp_false","displayName":"False","description":"False","helpText":null},{"id":"com.android.devicerestrictionpolicy.bluetoothblockconfigurationaosp_true","displayName":"True","description":"True","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.bluetoothblockcontactsharing","displayName":"Block contact sharing via Bluetooth (work profile-level)","description":"If 'True', prevents sharing work profile contacts with paired Bluetooth devices, such as cars or mobile devices. If 'False', Intune doesn't change or update this setting. By default, the OS might allow users to share their contacts via Bluetooth. Available for corporate-owned work profile devices (at work profile level).","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.bluetoothblockcontactsharing_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.bluetoothblockcontactsharing_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.bluetoothblocked","displayName":"Block Bluetooth","description":"If 'True', disables Bluetooth entirely on the device. If 'False', Intune doesn't change or update this setting. By default, the OS might allow Bluetooth to be used. Available for fully managed, dedicated, and corporate-owned work profile devices. In comparison, Bluetooth configuration disables the user from making changes to the Bluetooth toggle. As a result, it might be either 'On' or 'Off' depending on the state of Bluetooth prior to applying a policy with Bluetooth configuration enabled.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.bluetoothblocked_true","displayName":"True","description":"True","helpText":null},{"id":"com.android.devicerestrictionpolicy.bluetoothblocked_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.bluetoothblockedaosp","displayName":"Block Bluetooth","description":"If 'True', disables Bluetooth on the device so that users can't pair with other devices. If 'False', Intune doesn't change or update this setting. By default, the OS might enable Bluetooth on the device.","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.bluetoothblockedaosp_false","displayName":"False","description":"False","helpText":null},{"id":"com.android.devicerestrictionpolicy.bluetoothblockedaosp_true","displayName":"True","description":"True","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.camerablocked","displayName":"Block access to camera (work profile-level)","description":"If 'True', prevents access to the camera on the device. If 'False', Intune doesn't change or update this setting. By default, the OS might allow access to the camera. Intune only manages access to the device camera. It doesn't have access to pictures or videos. Available for fully managed, dedicated and corporate-owned work profile (at work profile level) devices. ","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.camerablocked_false","displayName":"False","description":"False","helpText":null},{"id":"com.android.devicerestrictionpolicy.camerablocked_true","displayName":"True","description":"True","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.camerablockedaosp","displayName":"Block access to camera","description":"If 'True', prevents access to the camera on the device. If 'False', Intune doesn't change or update this setting. By default, the OS might allow access to the camera. Intune only manages access to the device camera. It doesn't have access to pictures or videos.","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.camerablockedaosp_false","displayName":"False","description":"False","helpText":null},{"id":"com.android.devicerestrictionpolicy.camerablockedaosp_true","displayName":"True","description":"True","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.cellularblockwifitethering","displayName":"Block tethering and access to hotspots","description":"If 'True', prevents tethering and access to portable hotspots. If 'False', Intune doesn't change or update this setting. By default, the OS might allow tethering and access to portable hotspots. Available for fully managed, dedicated and corporate-owned work profile devices. ","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.cellularblockwifitethering_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.cellularblockwifitethering_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.certificatecredentialconfigurationdisabled","displayName":"Block users from configuring credentials (work profile-level)","description":"If 'True', prevents users from configuring certificates assigned to devices, even devices that aren't associated with a user account. If 'False', Intune doesn't change or update this setting. By default, the OS might make it possible for users to configure or change their credentials when they access them in the keystore. Available for fully managed, dedicated and corporate-owned work profile devices (at work profile level).","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.certificatecredentialconfigurationdisabled_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.certificatecredentialconfigurationdisabled_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.crossprofilepoliciesallowcopypaste","displayName":"Allow copy and paste between work and personal profiles ","description":"If 'True', allows users copy and paste data between the work and personal profiles. If 'False', Intune doesn't change or update this setting. By default, the OS might prevent users from pasting text into the personal profile that's copied from the work profile, allow users to copy text from the personal profile, and paste into the work profile or allow users to copy text from the work profile, and paste into the work profile. Available for corporate-owned work profile devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.crossprofilepoliciesallowcopypaste_false","displayName":"False","description":"false","helpText":null},{"id":"com.android.devicerestrictionpolicy.crossprofilepoliciesallowcopypaste_true","displayName":"True","description":"true","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.crossprofilepoliciesallowdatasharing","displayName":"Data sharing between work and personal profile","description":"Choose if data can be shared between work and personal profiles. Available for corporate-owned work profile devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.crossprofilepoliciesallowdatasharing_notconfigured","displayName":"Device default","description":"Not configured; this value defaults to CROSS_PROFILE_DATA_SHARING_UNSPECIFIED.","helpText":null},{"id":"com.android.devicerestrictionpolicy.crossprofilepoliciesallowdatasharing_crossprofiledatasharingblocked","displayName":"Block all sharing between profiles","description":"Data cannot be shared from both the personal profile to work profile and the work profile to the personal profile.","helpText":null},{"id":"com.android.devicerestrictionpolicy.crossprofilepoliciesallowdatasharing_datasharingfromworktopersonalblocked","displayName":"Block sharing from work to personal profile","description":"Prevents users from sharing data from the work profile to apps in the personal profile. Personal data can be shared with work apps.","helpText":null},{"id":"com.android.devicerestrictionpolicy.crossprofilepoliciesallowdatasharing_crossprofiledatasharingallowed","displayName":"No restrictions on sharing","description":"Data from either profile can be shared with the other profile.","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.crossprofilepoliciesshowworkcontactsinpersonalprofile","displayName":"Block searching of work contacts and displaying work contact caller-id in personal profile","description":"In the personal profile, 'True' prevents users from searching work contacts, and showing work caller ID information. If 'False', Intune doesn't change or update this setting. By default, the OS might allow searching work contacts, and show work caller IDs. Available for corporate-owned work profile devices. Available in Android 8.0 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.crossprofilepoliciesshowworkcontactsinpersonalprofile_false","displayName":"False","description":"false","helpText":null},{"id":"com.android.devicerestrictionpolicy.crossprofilepoliciesshowworkcontactsinpersonalprofile_true","displayName":"True","description":"true","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.dataroamingblocked","displayName":"Block roaming data services","description":"If 'True', prevents data roaming over the cellular network. If 'False', Intune doesn't change or update this setting. By default, the OS might allow data roaming when the device is on a cellular network. Available for fully managed, dedicated and corporate-owned work profile devices. ","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.dataroamingblocked_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.dataroamingblocked_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.datetimeconfigurationblocked","displayName":"Block date and time changes","description":"If 'True', prevents users from manually setting the date and time. If False, Intune doesn't change or update this setting. By default, the OS might allow users to the set date and time on the device. Available for fully managed, dedicated and corporate-owned work profile (at work profile level) devices.","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.datetimeconfigurationblocked_false","displayName":"False","description":"False","helpText":null},{"id":"com.android.devicerestrictionpolicy.datetimeconfigurationblocked_true","displayName":"True","description":"True","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.enterprisedisplaynamevisibility","displayName":"Hide organization name","description":"If 'True', prevents the enterprise name from being displayed on the device (such as on the lock screen). If 'False', Intune doesn't change or update this setting. By default, the OS displays the enterprise name set during device setup. Available for fully managed, dedicated, and corporate-owned work profile devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.enterprisedisplaynamevisibility_false","displayName":"False","description":"False","helpText":null},{"id":"com.android.devicerestrictionpolicy.enterprisedisplaynamevisibility_true","displayName":"True","description":"True","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.factoryresetblocked","displayName":"Block factory reset","description":"If 'True', prevents users from using the factory reset option in the device's settings. If 'False', Intune doesn't change or update this setting. By default, the OS might allow users to use this setting on the device. Available for fully managed and dedicated devices.","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.factoryresetblocked_false","displayName":"False","description":"False","helpText":null},{"id":"com.android.devicerestrictionpolicy.factoryresetblocked_true","displayName":"True","description":"True","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.factoryresetblockedaosp","displayName":"Block factory reset","description":"If 'True', prevents users from using the factory reset option in the device's settings. If 'False', Intune doesn't change or update this setting. By default, the OS might allow external media on the device.","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.factoryresetblockedaosp_false","displayName":"False","description":"False","helpText":null},{"id":"com.android.devicerestrictionpolicy.factoryresetblockedaosp_true","displayName":"True","description":"True","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.locationmode","displayName":"Block location","description":"If 'True', disables the Location setting on the device and prevents users from turning it on. When this setting is disabled, then any other setting that depends on the device location is affected, including the Locate device remote action that admins use. If 'False', Intune doesn't change or update this setting. By default, the OS might allow using location on the device. Available for fully managed, dedicated and corporate-owned work profile devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.locationmode_notconfigured","displayName":"False","description":"No restrictions on the location setting and no specific behavior is set or enforced. This is the default.","helpText":null},{"id":"com.android.devicerestrictionpolicy.locationmode_disabled","displayName":"True","description":"Location setting is disabled on the device.","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.microphoneforcemute","displayName":"Block microphone adjustment","description":"If 'True', prevents users from unmuting the microphone and adjusting the microphone volume. If 'False', Intune doesn't change or update this setting. By default, the OS might allow users to use and adjust the volume of the microphone on the device. Available for fully managed, dedicated and corporate-owned work profile devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.microphoneforcemute_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.microphoneforcemute_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.networkescapehatchallowed","displayName":"Allow network escape hatch","description":"If 'True', allows users to turn on the network escape hatch feature. If a network connection can't be made at boot time, the escape hatch prompts the user to temporarily connect to a network in order to refresh the device policy. After applying policy, the temporary network will be forgotten and the device will continue booting. This prevents being unable to connect to a network if there is no suitable network in the last policy and the device boots into an app in lock task mode, or the user is otherwise unable to reach device settings. If 'False', Intune doesn't change or update this setting. By default, the OS might prevent users from turning on the network escape hatch feature on the device. Available for fully managed and dedicated devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.networkescapehatchallowed_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.networkescapehatchallowed_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.nfcblockoutgoingbeam","displayName":"Block beaming data from apps using NFC (work profile-level)","description":"If 'True', prevents using the Near Field Communication (NFC) technology to beam data from apps. If 'False', Intune doesn't change or update this setting. By default, the OS might allow using NFC to share data between devices. Available for fully managed, dedicated and corporate-owned work profile (at work profile level) devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.nfcblockoutgoingbeam_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.nfcblockoutgoingbeam_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.passwordblockkeyguard","displayName":"Disable lock screen","description":"If 'True', blocks all Keyguard lock screen features from being used. If 'False', Intune doesn't change or update this setting. By default, when the device is in lock screen, the OS might allow all the Keyguard features, such as camera, fingerprint unlock, and more. Available for fully managed and dedicated devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.passwordblockkeyguard_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordblockkeyguard_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.passwordexpirationdays","displayName":"Number of days until password expires","description":"Enter the number of days, until the device password must be changed, from 1-365. For example, enter 90 to expire the password after 90 days. When the password expires, users are prompted to create a new password. If the value is blank, Intune doesn't change or update this setting. Available for fully managed, dedicated and corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (1-365)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.passwordminimumlength","displayName":"Minimum password length","description":"Enter the minimum number of digits or characters the password must have, between 4 and 16 characters. Available for fully managed, dedicated and corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (4-16)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.passwordminimumlengthaosp","displayName":"Minimum password length","description":"Enter the minimum number of digits or characters the password must have, from 4 to 16.","helpText":"Enter a number (4-16)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.passwordminimumlettercharacters","displayName":"Number of characters required","description":"Enter the number of characters the password must have, between 1 and 16 characters. Available for fully managed, dedicated and corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (1-16)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.passwordminimumlowercasecharacters","displayName":"Number of lowercase characters required","description":"Enter the number of lowercase characters the password must have, between 1 and 16 characters. Available for fully managed, dedicated and corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (1-16)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.passwordminimumnonlettercharacters","displayName":"Number of non-letter characters required","description":"Enter the number of non-letters (anything other than letters in the alphabet) the password must have, between 1 and 16 characters. Available for fully managed, dedicated and corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (1-16)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.passwordminimumnumericcharacters","displayName":"Number of numeric characters required","description":"Enter the number of numeric characters (1, 2, 3, and so on) the password must have, between 1 and 16 characters. Available for fully managed, dedicated and corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (1-16)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.passwordminimumsymbolcharacters","displayName":"Number of symbol characters required","description":"Enter the number of symbol characters (&, #, %, and so on) the password must have, between 1 and 16 characters. Available for fully managed, dedicated and corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (1-16)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.passwordminimumuppercasecharacters","displayName":"Number of uppercase characters required","description":"Enter the number of uppercase characters the password must have, between 1 and 16 characters. Available for fully managed, dedicated and corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (1-16)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.passwordminutesofinactivitybeforescreentimeoutaosp","displayName":"Maximum minutes of inactivity until screen locks","description":"Enter the maximum length of time, from 1 minute to 1 hour, that devices can be idle before the screen is automatically locked. Users must enter their credentials to regain access. For example, enter 5 to lock the device after 5 minutes of inactivity. Ignored by device if new time is longer than what's currently set on device. If set to Immediately, devices will use the minimum possible value per device.","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.passwordminutesofinactivitybeforescreentimeoutaosp_1minute","displayName":"1 Minute","description":"Screen Timeout after 1 Minute of Inactivity","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordminutesofinactivitybeforescreentimeoutaosp_5minutes","displayName":"5 Minutes","description":"Screen Timeout after 5 Minutes of Inactivity","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordminutesofinactivitybeforescreentimeoutaosp_15minutes","displayName":"15 Minutes","description":"Screen Timeout after 15 Minutes of Inactivity","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordminutesofinactivitybeforescreentimeoutaosp_30minutes","displayName":"30 Minutes","description":"Screen Timeout after 30 Minutes of Inactivity","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordminutesofinactivitybeforescreentimeoutaosp_1hour","displayName":"1 Hour","description":"Screen Timeout after 1 Hour of Inactivity","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.passwordpreviouspasswordcounttoblock","displayName":"Number of passwords required before user can reuse a password","description":"Use this setting to restrict users from creating previously used passwords. Enter the number of previously used passwords that can't be used, from 1-24. For example, enter 5 so users can't set a new password to their current password or any of their previous four passwords. If the value is blank, Intune doesn't change or update this setting. Available for fully managed, dedicated and corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (1-24)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.passwordrequiredtype","displayName":"Required password type","description":"Set the password’s complexity requirements. Additional password requirements will become available based on your selection. Available for fully managed, dedicated and corporate-owned work profile devices (at work profile level). For more details, see the information provided in the ‘Learn More’ section below.","helpText":"","infoUrls":["https://learn.microsoft.com/en-us/mem/intune/configuration/device-restrictions-android-for-work?WT.mc_id=Portal-fx#device-password"],"options":[{"id":"com.android.devicerestrictionpolicy.passwordrequiredtype_devicedefault","displayName":"Device default","description":"Device default value, no intent.","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordrequiredtype_required","displayName":"Password required, no restrictions","description":"There must be a password set, but there are no restrictions on type.","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordrequiredtype_lowsecuritybiometric","displayName":"Weak Biometric","description":"Low security biometrics based password required.","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordrequiredtype_numeric","displayName":"Numeric","description":"At least numeric.","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordrequiredtype_numericcomplex","displayName":"Numeric Complex","description":"At least numeric with no repeating or ordered sequences.","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordrequiredtype_alphabetic","displayName":"Alphabetic","description":"At least alphabetic password.","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordrequiredtype_alphanumeric","displayName":"Alphanumeric","description":"At least alphanumeric password","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordrequiredtype_alphanumericwithsymbols","displayName":"Alphanumeric with symbols","description":"At least alphanumeric with symbols.","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.passwordrequiredtypeaosp","displayName":"Required password type","description":"Set the password’s complexity requirements. Additional password requirements will become available based on your selection. For more details, see the information provided in the ‘Learn More’ section below.","helpText":"","infoUrls":["https://learn.microsoft.com/en-us/mem/intune/configuration/device-restrictions-android-aosp#:~:text=Required%20password%20type"],"options":[{"id":"com.android.devicerestrictionpolicy.passwordrequiredtypeaosp_devicedefault","displayName":"Device default","description":"Device default value, no intent.","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordrequiredtypeaosp_required","displayName":"Password required, no restrictions","description":"There must be a password set, but there are no restrictions on type.","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordrequiredtypeaosp_lowsecuritybiometric","displayName":"Weak Biometric","description":"Low security biometrics based password required.","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordrequiredtypeaosp_numeric","displayName":"Numeric","description":"At least numeric.","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordrequiredtypeaosp_numericcomplex","displayName":"Numeric Complex","description":"At least numeric with no repeating or ordered sequences.","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordrequiredtypeaosp_alphabetic","displayName":"Alphabetic","description":"At least alphabetic password.","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordrequiredtypeaosp_alphanumeric","displayName":"Alphanumeric","description":"At least alphanumeric password","helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordrequiredtypeaosp_alphanumericwithsymbols","displayName":"Alphanumeric with symbols","description":"At least alphanumeric with symbols.","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.passwordrequireunlock","displayName":"Required unlock frequency","description":"Select how long users have before they're required to unlock the device using a strong authentication method (password, PIN, or pattern). Available for fully managed, dedicated and corporate-owned work profile devices (at work profile level).","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.passwordrequireunlock_devicedefault","displayName":"Device default","description":null,"helpText":null},{"id":"com.android.devicerestrictionpolicy.passwordrequireunlock_requiredpasswordunlockdailyoption","displayName":"24 hours since last PIN, password, or pattern unlock","description":null,"helpText":null}]},{"id":"com.android.devicerestrictionpolicy.passwordsigninfailurecountbeforefactoryreset","displayName":"Number of sign-in failures before wiping device","description":"Enter the number of wrong passwords allowed before the device is wiped, from 4-11. If the value is blank, Intune doesn't change or update this setting. Available for fully managed, dedicated and corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (4-11)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.passwordsigninfailurecountbeforefactoryresetaosp","displayName":"Number of sign-in failures before wiping device","description":"Enter the number of sign-in attempts allowed, from 4 to 11, before the device is wiped. 0 (zero) might disable the device wipe functionality. When the value is blank, Intune doesn't change or update this setting.","helpText":"Enter a number (4-11)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.personalprofileappsallowinstallfromunknownsources","displayName":"Allow users to enable app installation from unknown sources in the personal profile","description":"If 'True, allows users to install apps from unknown sources in the personal profile. It allows users to install apps from sources other than the Google Play Store. If 'False', Intune doesn't change or update this setting. By default, the OS might prevent users from installing apps from unknown sources in the personal profile. Available for corporate-owned work profile devices (at personal profile level).","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.personalprofileappsallowinstallfromunknownsources_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.personalprofileappsallowinstallfromunknownsources_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.personalprofilecamerablocked","displayName":"Block camera","description":"If 'True', prevents access to the camera during personal use. If 'False', Intune doesn't change or update this setting. By default, the OS might allow using the camera in the personal profile. Available for corporate-owned work profile devices (at personal profile level).","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.personalprofilecamerablocked_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.personalprofilecamerablocked_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.personalprofilescreencaptureblocked","displayName":"Block screen capture","description":"If 'True', prevents screen captures during personal and work use. If 'False', Intune doesn't change or update this setting. By default, the OS might allow users to get screen captures or screenshots in the personal and work profile. Available for corporate-owned work profile devices (applies at both work and personal profile level).","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.personalprofilescreencaptureblocked_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.personalprofilescreencaptureblocked_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.privatespacepolicy","displayName":"Block private space","description":"If 'True', prevents users from creating or using private spaces on the device, ensuring that all data is stored within the corporate profile. All existing private spaces will be deleted. If 'False', Intune doesn't change or update this setting. By default, the OS might allow the creation of private spaces for personal data. Available for corporate-owned work profile devices (at work profile level).","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.privatespacepolicy_allowed","displayName":"False","description":"Users can create a private space profile.","helpText":null},{"id":"com.android.devicerestrictionpolicy.privatespacepolicy_disallowed","displayName":"True","description":"Users cannot create a private space profile. Supported only for company-owned devices with a work profile. Caution: Any existing private space will be removed.","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.screencaptureblocked","displayName":"Block screen capture","description":"If 'True', prevents screenshots or screen captures on the device. It also prevents the content from being shown on display devices that don't have a secure video output. If 'False', Intune doesn't change or update this setting. By default, the OS might let users capture the screen contents as an image. Available for fully managed, dedicated and corporate-owned work profile devices (at work profile level).","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.screencaptureblocked_false","displayName":"False","description":"False","helpText":null},{"id":"com.android.devicerestrictionpolicy.screencaptureblocked_true","displayName":"True","description":"True","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.screencaptureblockedaosp","displayName":"Block screen capture","description":"If 'True', prevents screenshots or screen captures on the device. It also prevents the content from being shown on display devices that don't have a secure video output. If 'False', Intune doesn't change or update this setting. By default, the OS might let users capture the screen contents as an image.","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.screencaptureblockedaosp_false","displayName":"False","description":"False","helpText":null},{"id":"com.android.devicerestrictionpolicy.screencaptureblockedaosp_true","displayName":"True","description":"True","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.securityallowdebuggingfeaturesaosp","displayName":"Allow users to turn on debugging features","description":"If 'True', permits users to access the debugging features on the device. If 'False', Intune doesn't change or update this setting. By default, the OS might prevent users from using the debugging features on the device.","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.securityallowdebuggingfeaturesaosp_false","displayName":"False","description":"False","helpText":null},{"id":"com.android.devicerestrictionpolicy.securityallowdebuggingfeaturesaosp_true","displayName":"True","description":"True","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.securitycommoncriteriamodeenabled","displayName":"Require Common Criteria mode​","description":"If 'True', enables an elevated set of security standards on the device most often used in highly sensitive organizations, such as government establishments. If 'False', Intune doesn't change or update this setting. Available for fully managed, dedicated and corporate-owned work profile devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.securitycommoncriteriamodeenabled_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.securitycommoncriteriamodeenabled_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.securitydevelopersettingsenabled","displayName":"Allow access to developer settings","description":"If 'True', allow users access developer settings on the device. If 'False', Intune doesn't change or update this setting. By default, the OS might prevent users from accessing developer settings on the device. Available for fully managed, dedicated and corporate-owned work profile devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.securitydevelopersettingsenabled_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.securitydevelopersettingsenabled_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.securityrequireverifyapps","displayName":"Require threat scan on apps","description":"If 'True', enables Google Play Protect to scan apps before and after they're installed. If it detects a threat, it might warn users to remove the app from the device. If 'False', Intune doesn't change or update this setting. By default, the OS might not enable or run Google Play Protect to scan apps. Available for fully managed, dedicated and corporate-owned work profile devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.securityrequireverifyapps_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.securityrequireverifyapps_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.statusbarblocked","displayName":"Block access to status bar","description":"If 'True', prevents access to the status bar, including notifications and quick settings. If 'False', Intune doesn't change or update this setting. By default, the OS might allow users access to the status bar. Available for fully managed and dedicated devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.statusbarblocked_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.statusbarblocked_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.storageallowusb","displayName":"Allow USB storage","description":"If 'True', allow users to access USB storage on the device. If 'False', Intune doesn't change or update this setting. By default, the OS might prevent access to USB storage. Available for fully managed and dedicated devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.storageallowusb_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.storageallowusb_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.storageblockexternalmedia","displayName":"Block mounting of external media","description":"If 'True', prevents using or connecting any external media on the device. If 'False', Intune doesn't change or update this setting. By default, the OS might allow external media on the device. Available for fully managed, dedicated and corporate-owned work profile devices.","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.storageblockexternalmedia_false","displayName":"False","description":"False","helpText":null},{"id":"com.android.devicerestrictionpolicy.storageblockexternalmedia_true","displayName":"True","description":"True","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.storageblockexternalmediaaosp","displayName":"Block mounting of external media","description":"If 'True', prevents users from using or connecting any external media on the device. If 'False', Intune doesn't change or update this setting. By default, the OS might allow users to connect external media.","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.storageblockexternalmediaaosp_false","displayName":"False","description":"False","helpText":null},{"id":"com.android.devicerestrictionpolicy.storageblockexternalmediaaosp_true","displayName":"True","description":"True","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.storageblockusbfiletransferaosp","displayName":"Block USB file transfer","description":"If 'True', prevents users from transferring files over USB. If 'False', Intune doesn't change or update this setting. By default, the OS might allow users to transfer files.","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.storageblockusbfiletransferaosp_false","displayName":"False","description":"False","helpText":null},{"id":"com.android.devicerestrictionpolicy.storageblockusbfiletransferaosp_true","displayName":"True","description":"True","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.systemwindowsblocked","displayName":"Block notification windows","description":"If 'True', window notifications, including toasts, incoming calls, outgoing calls, system alerts, and system errors aren't shown on the device. If 'False', Intune doesn't change or update this setting. By default, the OS might show notifications. Available for fully managed and dedicated devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.systemwindowsblocked_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.systemwindowsblocked_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.usbdataaccess","displayName":"USB access","description":"Select what files and/or data can be transferred via USB. If you block file transfer, only files will be blocked from being transferred and other connection (such as mouse) will still be allowed. If you block USB data transfer, all data will be blocked. Available for fully managed, dedicated and corporate-owned work profile devices (at work profile level).","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.usbdataaccess_allowusbdatatransfer","displayName":"Allow USB data transfer","description":"All types of USB data transfers are allowed. usbFileTransferDisabled is ignored.","helpText":null},{"id":"com.android.devicerestrictionpolicy.usbdataaccess_disallowusbfiletransfer","displayName":"Disallow USB file transfer","description":"Transferring files over USB is disallowed. Other types of USB data connections, such as mouse and keyboard connection, are allowed. usbFileTransferDisabled is ignored.","helpText":null},{"id":"com.android.devicerestrictionpolicy.usbdataaccess_disallowusbdatatransfer","displayName":"Disallow USB data transfer","description":"When set, all types of USB data transfers are prohibited. Supported for devices running Android 12 or above with USB HAL 1.3 or above. If the setting is not supported, DISALLOW_USB_FILE_TRANSFER will be set. A NonComplianceDetail with API_LEVEL is reported if the Android version is less than 12. A NonComplianceDetail with DEVICE_INCOMPATIBLE is reported if the device does not have USB HAL 1.3 or above. usbFileTransferDisabled is ignored.","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.volumeblockadjustment","displayName":"Block volume changes","description":"If 'True', prevents users from changing the device's volume, and also mutes the main volume. If 'False', Intune doesn't change or update this setting. By default, the OS might allow using the volume settings on the device. Available for fully managed and dedicated devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.volumeblockadjustment_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.volumeblockadjustment_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.wifiblockeditconfigurations","displayName":"Block Wi-Fi access point configuration","description":"If 'True', prevents users from creating or changing any Wi-Fi configurations. If 'False', Intune doesn't change or update this setting. By default, the OS might allow users to change the Wi-Fi settings on the device. Available for fully managed, dedicated and corporate-owned work profile devices. ","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.wifiblockeditconfigurations_false","displayName":"False","description":"False","helpText":null},{"id":"com.android.devicerestrictionpolicy.wifiblockeditconfigurations_true","displayName":"True","description":"True","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.wifiblockeditconfigurationsaosp","displayName":"Block Wi-Fi setting changes","description":"If 'True', prevents users from creating or changing any Wi-Fi configurations. If 'False', Intune doesn't change or update this setting. By default, the OS might allow users to change the Wi-Fi settings on the device.","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.wifiblockeditconfigurationsaosp_false","displayName":"False","description":"False","helpText":null},{"id":"com.android.devicerestrictionpolicy.wifiblockeditconfigurationsaosp_true","displayName":"True","description":"True","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.wifiblockeditpolicydefinedconfigurations","displayName":"Block Wi-Fi setting changes","description":"If 'True', prevents users from changing Wi-Fi settings created by the device owner. Users can create their own Wi-Fi configurations. If 'False', Intune doesn't change or update this setting. By default, the OS might allow users to change the Wi-Fi settings on the device. Available for fully managed and dedicated devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.wifiblockeditpolicydefinedconfigurations_true","displayName":"True","description":"true","helpText":null},{"id":"com.android.devicerestrictionpolicy.wifiblockeditpolicydefinedconfigurations_false","displayName":"False","description":"false","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.wifidirectsettings","displayName":"Block Wi-Fi Direct","description":"If 'True', blocks Wi-Fi Direct (a direct, peer-to-peer connection between devices using Wi-Fi frequencies). If set to 'False', Intune doesn't change or update this setting. By default, the OS might allow Wi-Fi Direct. Available for fully managed, dedicated, and corporate-owned work profile devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.wifidirectsettings_allowed","displayName":"False","description":"The user is allowed to use Wi-Fi direct.","helpText":null},{"id":"com.android.devicerestrictionpolicy.wifidirectsettings_disallowed","displayName":"True","description":"The user is not allowed to use Wi-Fi direct. A NonComplianceDetail with API_LEVEL is reported if the Android version is less than 13.","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordexpirationdays","displayName":"Number of days until password expires","description":"Enter the number of days, until the work profile password must be changed, from 1-365. For example, enter 90 to expire the password after 90 days. When the password expires, users are prompted to create a new password. If the value is blank, Intune doesn't change or update this setting. Available for corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (1-365)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordminimumlength","displayName":"Minimum password length","description":"Enter the minimum number of digits or characters the work profile password must have, between 4 and 16 characters. Available for corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (4-16)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordminimumlettercharacters","displayName":"Number of characters required","description":"Enter the number of characters the work profile password must have, between 1 and 16 characters. Available for fully managed, dedicated and corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (1-16)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordminimumlowercasecharacters","displayName":"Number of lowercase characters required","description":"Enter the number of lowercase characters the work profile password must have, between 1 and 16 characters. Available for corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (1-16)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordminimumnonlettercharacters","displayName":"Number of non-letter characters required","description":"Enter the number of non-letters (anything other than letters in the alphabet) the work profile password must have, between 1 and 16 characters. Available for corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (1-16)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordminimumnumericcharacters","displayName":"Number of numeric characters required","description":"Enter the number of numeric characters (1, 2, 3, and so on) the work profile password must have, between 1 and 16 characters. Available for corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (1-16)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordminimumsymbolcharacters","displayName":"Number of symbol characters required","description":"Enter the number of symbol characters (&, #, %, and so on) the work profile password must have, between 1 and 16 characters. Available for corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (1-16)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordminimumuppercasecharacters","displayName":"Number of uppercase characters required","description":"Enter the number of uppercase characters the work profile password must have, between 1 and 16 characters. Available for corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (1-16)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordpreviouspasswordcounttoblock","displayName":"Number of passwords required before user can reuse a password","description":"Use this setting to restrict users from creating previously used work profile passwords. Enter the number of previously used passwords that can't be used, from 1-24. For example, enter 5 so users can't set a new password to their current password or any of their previous four passwords. If the value is blank, Intune doesn't change or update this setting. Available for corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (1-24)","infoUrls":[],"options":null},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordrequiredtype","displayName":"Required password type","description":"Set the work profile password’s complexity requirements. Additional password requirements will become available based on your selection. Available for corporate-owned work profile devices (at work profile level). For more details, see the information provided in the ‘Learn More’ section below.","helpText":"","infoUrls":["https://learn.microsoft.com/en-us/mem/intune/configuration/device-restrictions-android-for-work?WT.mc_id=Portal-fx#device-password:~:text=owned%20work%20profiles.-,Required%20password%20type%3A,-Enter%20the%20required"],"options":[{"id":"com.android.devicerestrictionpolicy.workprofilepasswordrequiredtype_devicedefault","displayName":"Device default","description":"Device default value, no intent.","helpText":null},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordrequiredtype_required","displayName":"Password required, no restrictions","description":"There must be a password set, but there are no restrictions on type.","helpText":null},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordrequiredtype_lowsecuritybiometric","displayName":"Weak Biometric","description":"Low security biometrics based password required.","helpText":null},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordrequiredtype_numeric","displayName":"Numeric","description":"At least numeric.","helpText":null},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordrequiredtype_numericcomplex","displayName":"Numeric Complex","description":"At least numeric with no repeating or ordered sequences.","helpText":null},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordrequiredtype_alphabetic","displayName":"Alphabetic","description":"At least alphabetic password.","helpText":null},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordrequiredtype_alphanumeric","displayName":"Alphanumeric","description":"At least alphanumeric password","helpText":null},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordrequiredtype_alphanumericwithsymbols","displayName":"Alphanumeric with symbols","description":"At least alphanumeric with symbols.","helpText":null}]},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordrequireunlock","displayName":"Required unlock frequency","description":"Select how long users have before they're required to unlock the work profile using a strong authentication method (password, PIN, or pattern). Available for corporate-owned work profile devices (at work profile level).","helpText":"","infoUrls":[],"options":[{"id":"com.android.devicerestrictionpolicy.workprofilepasswordrequireunlock_devicedefault","displayName":"Device default","description":null,"helpText":null},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordrequireunlock_requiredpasswordunlockdailyoption","displayName":"24 hours since last PIN, password, or pattern unlock","description":null,"helpText":null}]},{"id":"com.android.devicerestrictionpolicy.workprofilepasswordsigninfailurecountbeforefactoryreset","displayName":"Number of sign-in failures before wiping device","description":"Enter the number of wrong passwords allowed before the work profile is wiped, from 4-11. If the value is blank, Intune doesn't change or update this setting. Available for corporate-owned work profile devices (at work profile level).","helpText":"Enter a number (4-11)","infoUrls":[],"options":null},{"id":"com.apple.airplay_allowlist","displayName":"Allow List","description":"If present, only AirPlay destinations in this list are available to the device. This allow list applies to supervised devices.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.airplay_allowlist_item_deviceid","displayName":"Device ID (Deprecated)","description":"The device ID of the AirPlay destination in the format xx:xx:xx:xx:xx:xx. This field isn’t case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.airplay_allowlist_item_devicename","displayName":"Device Name","description":"The name of the AirPlay device.\n\nThe system limits the list of visible AirPlay destinations to devices that are present in the `AllowList` field of all installed AirPlay payloads.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.airplay_com.apple.airplay","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.airplay_passwords","displayName":"Password","description":"The password for the AirPlay destination.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.airplay_passwords_item_deviceid","displayName":"Device ID","description":"The device ID of the AirPlay destination; used in macOS.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.airplay_passwords_item_devicename","displayName":"Device Name","description":"The name of the AirPlay destination; used in iOS.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.airplay_passwords_item_password","displayName":"Password","description":"The password for the AirPlay destination.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.airprint_airprint","displayName":"Printers","description":"A list of AirPrint printers that are presented to the user.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.airprint_airprint_item_forcetls","displayName":"Force TLS","description":"If true, AirPrint connections are secured by Transport Layer Security (TLS). Available only in iOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.airprint_airprint_item_forcetls_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.airprint_airprint_item_forcetls_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.airprint_airprint_item_ipaddress","displayName":"IP Address","description":"The IP address or hostname of the AirPrint destination.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.airprint_airprint_item_port","displayName":"Port","description":"The listening port of the AirPrint destination. Available only in iOS 11 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.airprint_airprint_item_resourcepath","displayName":"Resource Path","description":"The resource path associated with the printer. This path corresponds to the rp parameter of the _ipps.tcp Bonjour record. For example: printers/Canon_MG5300_series, printers/Xerox_Phaser_7600, ipp/print, Epson_IPP_Printer","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.airprint_com.apple.airprint","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.app.lock_app","displayName":"App","description":"A dictionary that contains information about the app.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.app.lock_app_identifier","displayName":"App Identifier","description":"The bundle identifier of the app.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.app.lock_app_options","displayName":"Options","description":"A dictionary of options that the user cannot change.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.app.lock_app_options_disableautolock","displayName":"Disable Auto Lock","description":"If true, the device doesn't automatically go to sleep after an idle period.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.app.lock_app_options_disableautolock_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.app.lock_app_options_disableautolock_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.app.lock_app_options_disabledevicerotation","displayName":"Disable Device Rotation","description":"If true, disables device rotation sensing.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.app.lock_app_options_disabledevicerotation_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.app.lock_app_options_disabledevicerotation_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.app.lock_app_options_disableringerswitch","displayName":"Disable Ringer Switch","description":"If true, disables the ringer switch. When disabled, the ringer behavior depends on what position the switch was in when it was first disabled.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.app.lock_app_options_disableringerswitch_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.app.lock_app_options_disableringerswitch_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.app.lock_app_options_disablesleepwakebutton","displayName":"Disable Sleep Wake Button","description":"If true, disables the sleep/wake button.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.app.lock_app_options_disablesleepwakebutton_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.app.lock_app_options_disablesleepwakebutton_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.app.lock_app_options_disabletouch","displayName":"Disable Touch","description":"If true, disables the touch screen.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.app.lock_app_options_disabletouch_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.app.lock_app_options_disabletouch_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.app.lock_app_options_disablevolumebuttons","displayName":"Disable Volume Buttons","description":"If true, disables the volume buttons.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.app.lock_app_options_disablevolumebuttons_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.app.lock_app_options_disablevolumebuttons_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.app.lock_app_options_enableassistivetouch","displayName":"Enable Assistive Touch","description":"If true, enables Assistive Touch.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.app.lock_app_options_enableassistivetouch_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.app.lock_app_options_enableassistivetouch_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.app.lock_app_options_enableinvertcolors","displayName":"Enable Invert Colors","description":"If true, enables Invert Colors. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.app.lock_app_options_enableinvertcolors_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.app.lock_app_options_enableinvertcolors_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.app.lock_app_options_enablemonoaudio","displayName":"Enable Mono Audio","description":"If true, enables Mono Audio.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.app.lock_app_options_enablemonoaudio_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.app.lock_app_options_enablemonoaudio_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.app.lock_app_options_enablespeakselection","displayName":"Enable Speak Selection","description":"If true, enables Speak Selection.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.app.lock_app_options_enablespeakselection_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.app.lock_app_options_enablespeakselection_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.app.lock_app_options_enablevoicecontrol","displayName":"Enable Voice Control","description":"If true, enables Voice Control.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.app.lock_app_options_enablevoicecontrol_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.app.lock_app_options_enablevoicecontrol_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.app.lock_app_options_enablevoiceover","displayName":"Enable Voice Over","description":"If true, enables Voice Over.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.app.lock_app_options_enablevoiceover_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.app.lock_app_options_enablevoiceover_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.app.lock_app_options_enablezoom","displayName":"Enable Zoom","description":"If true, enables Zoom. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.app.lock_app_options_enablezoom_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.app.lock_app_options_enablezoom_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.app.lock_app_userenabledoptions","displayName":"User Enabled Options","description":"A dictionary of user-editable options.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.app.lock_app_userenabledoptions_assistivetouch","displayName":"Assistive Touch","description":"If true, allows the user to toggle Assistive Touch.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.app.lock_app_userenabledoptions_assistivetouch_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.app.lock_app_userenabledoptions_assistivetouch_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.app.lock_app_userenabledoptions_invertcolors","displayName":"Invert Colors","description":"If true, allows the user to toggle Invert Colors. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.app.lock_app_userenabledoptions_invertcolors_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.app.lock_app_userenabledoptions_invertcolors_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.app.lock_app_userenabledoptions_voicecontrol","displayName":"Voice Control","description":"If true, allows the user to toggle Voice Control.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.app.lock_app_userenabledoptions_voicecontrol_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.app.lock_app_userenabledoptions_voicecontrol_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.app.lock_app_userenabledoptions_voiceover","displayName":"Voice Over","description":"If true, allows the user to toggle Voice Over. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.app.lock_app_userenabledoptions_voiceover_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.app.lock_app_userenabledoptions_voiceover_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.app.lock_app_userenabledoptions_zoom","displayName":"Zoom","description":"If true, allows the user to toggle Zoom. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.app.lock_app_userenabledoptions_zoom_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.app.lock_app_userenabledoptions_zoom_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.app.lock_com.apple.app.lock","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.applicationaccess_allowaccountmodification","displayName":"Allow Account Modification","description":"If false, disables account modification. Requires a supervised device. Available in iOS 7 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowaccountmodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowaccountmodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowactivitycontinuation","displayName":"Allow Activity Continuation","description":"If false, disables activity continuation. Available in iOS 8 and later, and macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowactivitycontinuation_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowactivitycontinuation_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowaddinggamecenterfriends","displayName":"Allow Adding Game Center Friends","description":"If false, prohibits adding friends to Game Center. As of iOS 13, requires a supervised device. Available in iOS 4.2.1 and later, and macOS 10.13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowaddinggamecenterfriends_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowaddinggamecenterfriends_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowairdrop","displayName":"Allow AirDrop","description":"If false, disables AirDrop. Requires a supervised device. Available in iOS 7 and later, and macOS 10.13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowairdrop_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowairdrop_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowairplayincomingrequests","displayName":"Allow Air Play Incoming Requests","description":"If false, disables incoming AirPlay requests. Requires a supervised device. Available in macOS 12.3 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowairplayincomingrequests_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowairplayincomingrequests_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowairprint","displayName":"Allow AirPrint","description":"If false, disables AirPrint. Requires a supervised device. Available in iOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowairprint_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowairprint_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowairprintcredentialsstorage","displayName":"Allow AirPrint Credentials Storage","description":"If false, disables keychain storage of user name and password for AirPrint. Requires a supervised device. Available in iOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowairprintcredentialsstorage_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowairprintcredentialsstorage_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowairprintibeacondiscovery","displayName":"Allow AirPrint iBeacon Discovery","description":"If false, disables iBeacon discovery of AirPrint printers, which prevents spurious AirPrint Bluetooth beacons from phishing for network traffic. Requires a supervised device. Available in iOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowairprintibeacondiscovery_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowairprintibeacondiscovery_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowappcellulardatamodification","displayName":"Allow App Cellular Data Modification","description":"If false, disables changing settings for cellular data usage for apps. Requires a supervised device. Available in iOS 7 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowappcellulardatamodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowappcellulardatamodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowappclips","displayName":"Allow App Clips","description":"If false, prevents a user from adding any App Clips, and removes any existing App Clips on the device. Requires a supervised device. Available in iOS 14.0 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowappclips_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowappclips_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowappinstallation","displayName":"Allow App Installation","description":"If false, disables the App Store, and its icon is removed from the Home screen. Users are unable to install or update their apps. In iOS 10 and later, MDM commands can override this restriction. As of iOS 13, this restriction requires a supervised device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowappinstallation_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowappinstallation_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowappleintelligencereport","displayName":"Allow Apple Intelligence Report","description":"When false, disables Apple Intelligence reports.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowappleintelligencereport_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowappleintelligencereport_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowapplepersonalizedadvertising","displayName":"Allow Apple Personalized Advertising","description":"If false, limits Apple personalized advertising. Available in iOS 14 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowapplepersonalizedadvertising_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowapplepersonalizedadvertising_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowappremoval","displayName":"Allow App Removal","description":"If false, disables removal of apps from an iOS device. Requires a supervised device. Available in iOS 4.2.1 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowappremoval_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowappremoval_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowappstobehidden","displayName":"Allow Apps To Be Hidden","description":"If false, disables the ability for the user to hide apps. It does not affect the user's ability to leave it in the App Library, while removing it from the home screen.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowappstobehidden_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowappstobehidden_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowappstobelocked","displayName":"Allow Apps To Be Locked","description":"If false, disables the ability for the user to lock apps. Because hiding apps also requires locking them, disallowing locking also disallows hiding.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowappstobelocked_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowappstobelocked_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowardremotemanagementmodification","displayName":"Allow ARD Remote Management Modification","description":"If 'false', prevents modifying the Remote Management Sharing setting in System Settings.\nAvailable in macOS 14 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowardremotemanagementmodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowardremotemanagementmodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowassistant","displayName":"Allow Assistant","description":"If false, disables Siri. Available in iOS 5 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowassistant_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowassistant_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowassistantusergeneratedcontent","displayName":"Allow Assistant User Generated Content","description":"If false, prevents Siri from querying user-generated content from the web. Requires a supervised device. Available in iOS 7 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowassistantusergeneratedcontent_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowassistantusergeneratedcontent_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowassistantwhilelocked","displayName":"Allow Assistant While Locked","description":"If false, disables Siri when the device is locked. This restriction is ignored if the device doesn’t have a passcode set. Available in iOS 5.1 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowassistantwhilelocked_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowassistantwhilelocked_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowautocorrection","displayName":"Allow Auto Correction","description":"If false, disables keyboard autocorrection. Requires a supervised device. Available in iOS 8.1.3 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowautocorrection_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowautocorrection_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowautodim","displayName":"Allow Auto Dim","description":"If set to false, disables auto dim on iPads with OLED displays.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowautodim_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowautodim_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowautomaticappdownloads","displayName":"Allow Automatic App Downloads","description":"If false, prevents automatic downloading of apps purchased on other devices. This setting doesn’t affect updates to existing apps. Requires a supervised device. Available in iOS 9 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowautomaticappdownloads_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowautomaticappdownloads_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowautounlock","displayName":"Allow Auto Unlock","description":"If false, disallows auto unlock. Available in macOS 10.12 and later, and iOS 14.5 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowautounlock_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowautounlock_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowbluetoothmodification","displayName":"Allow Bluetooth Modification","description":"If false, prevents modification of Bluetooth settings. Requires a supervised device. Available in iOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowbluetoothmodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowbluetoothmodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowbluetoothsharingmodification","displayName":"Allow Bluetooth Sharing Modification","description":"If 'false', prevents modifying Bluetooth setting in System Settings.\nAvailable in macOS 14 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowbluetoothsharingmodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowbluetoothsharingmodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowbookstore","displayName":"Allow Bookstore","description":"If false, removes the Book Store tab from the Books app. Requires a supervised device. Available in iOS 6 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowbookstore_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowbookstore_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowbookstoreerotica","displayName":"Allow Bookstore Erotica","description":"If false, the user can’t download Apple Books media that is tagged as erotica. Available in iOS 6 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowbookstoreerotica_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowbookstoreerotica_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowcallrecording","displayName":"Allow Call Recording","description":"If false, call recording is disabled.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowcallrecording_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowcallrecording_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowcamera","displayName":"Allow Camera","description":"If false, disables the camera, and its icon is removed from the Home screen. Users are unable to take photographs. Requires a supervised device. Available in iOS 4 and later, and macOS 10.11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowcamera_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowcamera_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowcellularplanmodification","displayName":"Allow Cellular Plan Modification","description":"If false, users can’t change any settings related to their cellular plan. Requires a supervised device. Available in iOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowcellularplanmodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowcellularplanmodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowchat","displayName":"Allow Chat","description":"If false, disables the use of the iMessage with supervised devices. If the device supports text messaging, the user can still send and receive text messages. Requires a supervised device. Available in iOS 5 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowchat_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowchat_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowcloudaddressbook","displayName":"Allow Cloud Address Book","description":"If false, disables iCloud Address Book services. Available in macOS 10.12 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowcloudaddressbook_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowcloudaddressbook_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowcloudbackup","displayName":"Allow Cloud Backup","description":"If false, disables backing up the device to iCloud. Requires a supervised device. Available in iOS 5 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowcloudbackup_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowcloudbackup_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowcloudbookmarks","displayName":"Allow Cloud Bookmarks","description":"If false, disables iCloud Bookmark sync. Available in macOS 10.12 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowcloudbookmarks_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowcloudbookmarks_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowcloudcalendar","displayName":"Allow Cloud Calendar","description":"If false, disables iCloud Calendar services. Available in macOS 10.12 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowcloudcalendar_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowcloudcalendar_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowclouddesktopanddocuments","displayName":"Allow Cloud Desktop And Documents","description":"If false, disables cloud desktop and document services. Available in macOS 10.12.4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowclouddesktopanddocuments_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowclouddesktopanddocuments_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowclouddocumentsync","displayName":"Allow Cloud Document Sync","description":"If false, disables document and key-value syncing to iCloud. As of iOS 13, this restriction requires a supervised device. Available in iOS 5 and later, and macOS 10.11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowclouddocumentsync_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowclouddocumentsync_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowcloudfreeform","displayName":"Allow Cloud Freeform","description":"If 'false', disallows iCloud Freeform services.\nAvailable in macOS 14 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowcloudfreeform_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowcloudfreeform_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowcloudkeychainsync","displayName":"Allow Cloud Keychain Sync","description":"If false, disables iCloud keychain synchronization. Requires a supervised device. Available in iOS 7 and later and macOS 10.12 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowcloudkeychainsync_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowcloudkeychainsync_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowcloudmail","displayName":"Allow Cloud Mail","description":"If false, disables iCloud Mail services. Available in macOS 10.12 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowcloudmail_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowcloudmail_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowcloudnotes","displayName":"Allow Cloud Notes","description":"If false, disables iCloud Notes services. Available in macOS 10.12 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowcloudnotes_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowcloudnotes_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowcloudphotolibrary","displayName":"Allow Cloud Photo Library","description":"If false, disables iCloud Photo Library. Any photos not fully downloaded from iCloud Photo Library to the device are removed from local storage. Available in iOS 9 and later, and macOS 10.12 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowcloudphotolibrary_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowcloudphotolibrary_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowcloudprivaterelay","displayName":"Allow Cloud Private Relay","description":"If false, disables iCloud Private Relay. For iOS devices, this restriction requires a supervised device. Available in macOS 12 and later, and iOS 15 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowcloudprivaterelay_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowcloudprivaterelay_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowcloudreminders","displayName":"Allow Cloud Reminders","description":"If false, disables iCloud Reminder services. Available in macOS 10.12 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowcloudreminders_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowcloudreminders_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowcontentcaching","displayName":"Allow Content Caching","description":"If false, disables content caching. As of 10.13.4 this is included in the content caching payload. Available in macOS 10.13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowcontentcaching_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowcontentcaching_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowcontinuouspathkeyboard","displayName":"Allow Continuous Path Keyboard","description":"If false, disables QuickPath keyboard. Requires a supervised device. Available in iOS 13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowcontinuouspathkeyboard_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowcontinuouspathkeyboard_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowdefaultbrowsermodification","displayName":"Allow Default Browser Modification","description":"If false, disables default browser preference modification. The MDM Settings command to set the default browser preference will still work when this is applied.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowdefaultbrowsermodification_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowdefaultbrowsermodification_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowdefaultcallingappmodification","displayName":"Allow Default Calling App Modification","description":"If false, disables default calling app preference modification. The MDM Settings command to set the default calling app preference will still work when this is applied.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowdefaultcallingappmodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowdefaultcallingappmodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowdefaultmessagingappmodification","displayName":"Allow Default Messaging App Modification","description":"If false, disables default messaging app preference modification. The MDM Settings command to set the default messaging app preference will still work when this is applied.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowdefaultmessagingappmodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowdefaultmessagingappmodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowdefinitionlookup","displayName":"Allow Definition Lookup","description":"If false, disables definition lookup. Requires a supervised device on iOS. Available in iOS 8.1.3 and later and macOS 10.11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowdefinitionlookup_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowdefinitionlookup_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowdevicenamemodification","displayName":"Allow Device Name Modification","description":"If false, prevents the user from changing the device name. Requires a supervised device. Available in iOS 9 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowdevicenamemodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowdevicenamemodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowdiagnosticsubmission","displayName":"Allow Diagnostic Submission","description":"If false, prevents the device from automatically submitting diagnostic reports to Apple. Available in iOS 6 and later, and macOS 10.13 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowdiagnosticsubmission_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowdiagnosticsubmission_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowdiagnosticsubmissionmodification","displayName":"Allow Diagnostic Submission Modification","description":"If false, disables changing the diagnostic submission and app analytics settings in the Diagnostics & Usage UI in Settings. Requires a supervised device. Available in iOS 9.3.2 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowdiagnosticsubmissionmodification_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowdiagnosticsubmissionmodification_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowdictation","displayName":"Allow Dictation","description":"If false, disallows dictation input. Requires a supervised device. Available in iOS 10.3 and later, and macOS 10.13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowdictation_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowdictation_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowedcamerarestrictionbundleids","displayName":"Allowed Camera Restriction Bundle IDs","description":"If present, the system exempts apps with bundle IDs in the array from the `allowCamera` restriction. The system doesn't grant these apps access to the camera automatically; they're only exempted from the `allowCamera` restriction. This key has no effect when the camera isn't restricted. Multiple payloads combine using an intersect operation. Requires a supervised device.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.applicationaccess_allowedexternalintelligenceworkspaceids","displayName":"Allowed External Intelligence Workspace IDs","description":"An array of strings, but currently restricted to a single element. If present, Apple Intelligence allows use of only the given external integration workspace ID, and requires a sign-in to make requests. The user is required to sign in to integrations that support signing in. Multiple payloads combine using an intersect operation. This means the allowed set of workspace IDs can become the empty set if multiple payloads specify conflicting values.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.applicationaccess_allowenablingrestrictions","displayName":"Allow Enabling Restrictions","description":"If false, disables the “Enable Restrictions” option in the Restrictions UI in Settings. In iOS 12 or later, if false, disables the “Enable ScreenTime” option in the ScreenTime UI in Settings and disables ScreenTime if already enabled. Requires a supervised device. Available in iOS 8 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowenablingrestrictions_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowenablingrestrictions_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowenterpriseapptrust","displayName":"Allow Enterprise App Trust","description":"If false, removes the Trust Enterprise Developer button in Settings > General > Profiles & Device Management, preventing apps from being provisioned by universal provisioning profiles. This restriction applies to free developer accounts. However, it doesn’t apply to enterprise app developers who are trusted because their apps were pushed through MDM. It also doesn’t revoke previously granted trust. Available in iOS 9 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowenterpriseapptrust_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowenterpriseapptrust_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowenterprisebookbackup","displayName":"Allow Enterprise Book Backup","description":"If false, disables backup of Enterprise books. Available in iOS 8 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowenterprisebookbackup_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowenterprisebookbackup_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowenterprisebookmetadatasync","displayName":"Allow Enterprise Book Metadata Sync","description":"If false, disables sync of Enterprise books, notes, and highlights. Available in iOS 8 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowenterprisebookmetadatasync_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowenterprisebookmetadatasync_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowerasecontentandsettings","displayName":"Allow Erase Content And Settings","description":"If false, disables the Erase All Content And Settings option in the Reset UI. Requires a supervised device. Available in iOS 8 and later, and macOS 12 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowerasecontentandsettings_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowerasecontentandsettings_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowesimmodification","displayName":"Allow ESIM Modification","description":"If false, disables modifications to carrier plan related settings (only available on select carriers). Requires a supervised device. Available in iOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowesimmodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowesimmodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowesimoutgoingtransfers","displayName":"Allow ESIM Outgoing Transfers","description":"If 'false', prevents the transfer of an eSIM from the device on which the restriction is installed to a different device. Available in iOS 18 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowesimoutgoingtransfers_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowesimoutgoingtransfers_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowexplicitcontent","displayName":"Allow Explicit Content","description":"If false, hides explicit music or video content purchased from the iTunes Store. Explicit content is marked as such by content providers, such as record labels, when sold through the iTunes Store. As of iOS 13, requires a supervised device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowexplicitcontent_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowexplicitcontent_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowexternalintelligenceintegrations","displayName":"Allow External Intelligence Integrations","description":"If false, disables the use of external, cloud-based intelligence services with Siri.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowexternalintelligenceintegrations_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowexternalintelligenceintegrations_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowexternalintelligenceintegrationssignin","displayName":"Allow External Intelligence Integrations Sign In","description":"If false, forces external intelligence providers into anonymous mode. If a user is already signed in to an external intelligence provider, applying this restriction will cause them to be signed out.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowexternalintelligenceintegrationssignin_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowexternalintelligenceintegrationssignin_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowfilesharingmodification","displayName":"Allow File Sharing Modification","description":"If 'false', prevents modifying File Sharing setting in System Settings.\nAvailable in macOS 14 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowfilesharingmodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowfilesharingmodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowfilesnetworkdriveaccess","displayName":"Allow Files Network Drive Access","description":"If false, prevents connecting to network drives in the Files app. Requires a supervised device. Available in iOS 13.1 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowfilesnetworkdriveaccess_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowfilesnetworkdriveaccess_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowfilesusbdriveaccess","displayName":"Allow Files USB Drive Access","description":"If false, prevents connecting to any connected USB devices in the Files app. Requires a supervised device. Available in iOS 13.1 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowfilesusbdriveaccess_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowfilesusbdriveaccess_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowfindmydevice","displayName":"Allow Find My Device","description":"If false, disables Find My Device in the Find My app. Requires a supervised device. Available in iOS 13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowfindmydevice_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowfindmydevice_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowfindmyfriends","displayName":"Allow Find My Friends","description":"If false, disables Find My Friends in the Find My app. Requires a supervised device. Available in iOS 13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowfindmyfriends_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowfindmyfriends_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowfindmyfriendsmodification","displayName":"Allow Find My Friends Modification","description":"If false, disables changes to Find My Friends. Requires a supervised device. Available in iOS 7 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowfindmyfriendsmodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowfindmyfriendsmodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowfingerprintforunlock","displayName":"Allow Fingerprint For Unlock","description":"If false, prevents Touch ID or Face ID from unlocking a device. Available in iOS 7 and later, and macOS 10.12.4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowfingerprintforunlock_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowfingerprintforunlock_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowfingerprintmodification","displayName":"Allow Fingerprint Modification","description":"If false, prevents the user from modifying Touch ID or Face ID. Requires a supervised device. Available in iOS 8.3 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowfingerprintmodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowfingerprintmodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowgamecenter","displayName":"Allow Game Center","description":"If false, disables Game Center, and its icon is removed from the Home screen. Requires a supervised device. Available in iOS 6 and later, and macOS 10.13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowgamecenter_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowgamecenter_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowgenmoji","displayName":"Allow Genmoji","description":"When false, prohibits creating new Genmoji.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowgenmoji_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowgenmoji_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowglobalbackgroundfetchwhenroaming","displayName":"Allow Global Background Fetch When Roaming","description":"If false, disables global background fetch activity when an iOS phone is roaming. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowglobalbackgroundfetchwhenroaming_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowglobalbackgroundfetchwhenroaming_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowhostpairing","displayName":"Allow Host Pairing","description":"If false, disables host pairing with the exception of the supervision host. If no supervision host certificate has been configured, all pairing is disabled. Host pairing lets the administrator control if an iOS device can pair with a host Mac or PC. Requires a supervised device. Available in iOS 7 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowhostpairing_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowhostpairing_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowimageplayground","displayName":"Allow Image Playground","description":"If false, prohibits the use of image generation.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowimageplayground_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowimageplayground_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowimagewand","displayName":"Allow Image Wand","description":"When false, prohibits the use of Image Wand.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowimagewand_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowimagewand_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowinapppurchases","displayName":"Allow In App Purchases","description":"If false, prohibits in-app purchasing. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowinapppurchases_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowinapppurchases_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowinternetsharingmodification","displayName":"Allow Internet Sharing Modification","description":"If 'false', prevents modifying Internet Sharing setting in System Settings.\nAvailable in macOS 14 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowinternetsharingmodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowinternetsharingmodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowiphonemirroring","displayName":"Allow iPhone Mirroring","description":"If false, prohibits the use of iPhone Mirroring. When used on macOS, this prevents the Mac from mirroring any iPhone. When used on iOS, this prevents the iPhone from mirroring to any Mac.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowiphonemirroring_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowiphonemirroring_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowiphonewidgetsonmac","displayName":"Allow iPhone Widgets On Mac","description":"If 'false', disallows iPhone widgets on a Mac that has signed in the same AppleID for iCloud. Supervised only.\nAvailable on iOS 17 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowiphonewidgetsonmac_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowiphonewidgetsonmac_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowitunes","displayName":"Allow iTunes","description":"If false, disables the iTunes Music Store, and its icon is removed from the Home screen. Users cannot preview, purchase, or download content. As of iOS 13, requires a supervised device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowitunes_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowitunes_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowitunesfilesharing","displayName":"Allow iTunes File Sharing","description":"If false, disables iTunes file sharing services. Available in macOS 10.13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowitunesfilesharing_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowitunesfilesharing_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowkeyboardshortcuts","displayName":"Allow Keyboard Shortcuts","description":"If false, disables keyboard shortcuts. Requires a supervised device. Available in iOS 9 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowkeyboardshortcuts_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowkeyboardshortcuts_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowlistedappbundleids","displayName":"Allow Listed App Bundle IDs","description":"If present, this property allows only bundle IDs listed in the array to be shown or launchable. Include the value com.apple.webapp to allow all webclips. Requires a supervised device. Available in iOS 9.3 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.applicationaccess_allowlivevoicemail","displayName":"Allow Live Voicemail","description":"If set to false, disables live voicemail on the device.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowlivevoicemail_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowlivevoicemail_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowlocalusercreation","displayName":"Allow Local User Creation","description":"If 'false', prevents creating new users in System Settings.\nAvailable in macOS 14 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowlocalusercreation_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowlocalusercreation_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowlockscreencontrolcenter","displayName":"Allow Lock Screen Control Center","description":"If false, prevents Control Center from appearing on the Lock screen. Available in iOS 7 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowlockscreencontrolcenter_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowlockscreencontrolcenter_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowlockscreennotificationsview","displayName":"Allow Lock Screen Notifications View","description":"If false, disables the Notifications history view on the lock screen, so users can’t view past notifications. However, they can still see notifications when they arrive. Available in iOS 7 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowlockscreennotificationsview_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowlockscreennotificationsview_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowlockscreentodayview","displayName":"Allow Lock Screen Today View","description":"If false, disables the Today view in Notification Center on the lock screen. Available in iOS 7 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowlockscreentodayview_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowlockscreentodayview_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowmailprivacyprotection","displayName":"Allow Mail Privacy Protection","description":"If false, disables Mail Privacy Protection on the device. Available in iOS 15.2 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowmailprivacyprotection_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowmailprivacyprotection_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowmailsmartreplies","displayName":"Allow Mail Smart Replies","description":"If false, disables smart replies in Mail.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowmailsmartreplies_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowmailsmartreplies_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowmailsummary","displayName":"Allow Mail Summary","description":"If false, disables the ability to create summaries of email messages manually. This does not affect automatic summary generation.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowmailsummary_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowmailsummary_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowmanagedappscloudsync","displayName":"Allow Managed Apps Cloud Sync","description":"If false, prevents managed apps from using iCloud sync. Available in iOS 8 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowmanagedappscloudsync_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowmanagedappscloudsync_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowmanagedtowriteunmanagedcontacts","displayName":"Allow Managed To Write Unmanaged Contacts","description":"If true, managed apps can write contacts to unmanaged contacts accounts. If Allow Open From Managed To Unmanaged is true, this restriction has no effect. If this restriction is set to true, you must install the payload through MDM. Available in iOS 12 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowmanagedtowriteunmanagedcontacts_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowmanagedtowriteunmanagedcontacts_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowmarketplaceappinstallation","displayName":"Allow Marketplace App Installation","description":"When 'false', the device prevents installation of alternative marketplace apps from the web, and prevents any installed alternative marketplace apps from installing apps.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowmarketplaceappinstallation_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowmarketplaceappinstallation_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowmediasharingmodification","displayName":"Allow Media Sharing Modification","description":"If false, prevents modification of Media Sharing settings.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowmediasharingmodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowmediasharingmodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowmultiplayergaming","displayName":"Allow Multiplayer Gaming","description":"If false, prohibits multiplayer gaming. Requires a supervised device. Available in iOS 4.1 and later, and macOS 10.13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowmultiplayergaming_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowmultiplayergaming_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowmusicservice","displayName":"Allow Music Service","description":"If false, disables the Music service, and the Music app reverts to classic mode. Requires a supervised device. Available in iOS 9.3 and later, and macOS 10.12 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowmusicservice_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowmusicservice_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allownews","displayName":"Allow News","description":"If false, disables News. Requires a supervised device. Available in iOS 9 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allownews_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allownews_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allownfc","displayName":"Allow NFC","description":"If false, disables NFC. Requires a supervised device. Available in iOS 14.2 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allownfc_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allownfc_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allownotestranscription","displayName":"Allow Notes Transcription","description":"If false, disables transcription in Notes.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allownotestranscription_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allownotestranscription_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allownotestranscriptionsummary","displayName":"Allow Notes Transcription Summary","description":"If `false`, disables transcription summarization in Notes.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allownotestranscriptionsummary_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allownotestranscriptionsummary_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allownotificationsmodification","displayName":"Allow Notifications Modification","description":"If false, disables modification of notification settings. Requires a supervised device. Available in iOS 9.3 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allownotificationsmodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allownotificationsmodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowopenfrommanagedtounmanaged","displayName":"Allow Open From Managed To Unmanaged","description":"If false, documents in managed apps and accounts only open in other managed apps and accounts. Available in iOS 7 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowopenfrommanagedtounmanaged_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowopenfrommanagedtounmanaged_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowopenfromunmanagedtomanaged","displayName":"Allow Open From Unmanaged To Managed","description":"If false, documents in unmanaged apps and accounts only open in other unmanaged apps and accounts. Available in iOS 7 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowopenfromunmanagedtomanaged_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowopenfromunmanagedtomanaged_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowotapkiupdates","displayName":"Allow OTAPKI Updates","description":"If false, disables over-the-air PKI updates. Setting this restriction to false doesn’t disable CRL and OCSP checks. Available in iOS 7 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowotapkiupdates_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowotapkiupdates_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowpairedwatch","displayName":"Allow Paired Watch","description":"If false, disables pairing with an Apple Watch. Any currently paired Apple Watch is unpaired and the watch’s content is erased. Requires a supervised device. Available in iOS 9 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowpairedwatch_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowpairedwatch_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowpassbookwhilelocked","displayName":"Allow Passbook While Locked","description":"If false, hides Passbook notifications from the lock screen. Available in iOS 6 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowpassbookwhilelocked_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowpassbookwhilelocked_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowpasscodemodification","displayName":"Allow Passcode Modification","description":"If false, prevents the device passcode from being added, changed, or removed. This restriction is ignored by Shared iPads. Requires a supervised device. Available in iOS 9 and later, and macOS 10.13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowpasscodemodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowpasscodemodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowpasswordautofill","displayName":"Allow Password Auto Fill","description":"If false, disables the AutoFill Passwords feature in iOS (with Keychain and third-party password managers) and the user isn’t prompted to use a saved password in Safari or in apps. This restriction also disables Automatic Strong Passwords, and strong passwords are no longer suggested to users. It doesn’t prevent AutoFill for contact info and credit cards in Safari. Requires a supervised device. Available in iOS 12 and later, and macOS 10.14 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowpasswordautofill_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowpasswordautofill_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowpasswordproximityrequests","displayName":"Allow Password Proximity Requests","description":"If false, disables requesting passwords from nearby devices. Requires a supervised device. Available in iOS 12 and later, and macOS 10.14 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowpasswordproximityrequests_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowpasswordproximityrequests_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowpasswordsharing","displayName":"Allow Password Sharing","description":"If false, disables sharing passwords with the Airdrop Passwords feature. Requires a supervised device. Available in iOS 12 and later, and macOS 10.14 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowpasswordsharing_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowpasswordsharing_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowpersonalhotspotmodification","displayName":"Allow Personal Hotspot Modification","description":"If false, disables modifications of the personal hotspot setting. Requires a supervised device. Available in iOS 12.2 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowpersonalhotspotmodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowpersonalhotspotmodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowpersonalizedhandwritingresults","displayName":"Allow Personalized Handwriting Results","description":"If false, prevents the system from generating text in the user's handwriting.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowpersonalizedhandwritingresults_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowpersonalizedhandwritingresults_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowphotostream","displayName":"Allow Photo Stream (Deprecated)","description":"If false, disables Photo Stream. Available in iOS 5 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowphotostream_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowphotostream_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowpodcasts","displayName":"Allow Podcasts","description":"If false, disables podcasts. Requires a supervised device. Available in iOS 8 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowpodcasts_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowpodcasts_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowpredictivekeyboard","displayName":"Allow Predictive Keyboard","description":"If false, disables predictive keyboards. Requires a supervised device. Available in iOS 8.1.3 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowpredictivekeyboard_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowpredictivekeyboard_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowprintersharingmodification","displayName":"Allow Printer Sharing Modification","description":"If 'false', prevents modifying Printer Sharing setting in System Settings.\nAvailable in macOS 14 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowprintersharingmodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowprintersharingmodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowproximitysetuptonewdevice","displayName":"Allow Proximity Setup To New Device","description":"If false, disables the prompt to set up new devices that are nearby. Requires a supervised device. Available in iOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowproximitysetuptonewdevice_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowproximitysetuptonewdevice_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowradioservice","displayName":"Allow Radio Service","description":"If false, disables Apple Music Radio. Requires a supervised device. Available in iOS 9.3 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowradioservice_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowradioservice_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowrapidsecurityresponseinstallation","displayName":"Allow Background Security Improvement Installation (Deprecated)","description":"If false, Rapid Security Response will be disabled. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowrapidsecurityresponseinstallation_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowrapidsecurityresponseinstallation_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowrapidsecurityresponseremoval","displayName":"Allow Background Security Improvement Removal (Deprecated)","description":"If false, users are unable to remove the Rapid Security Response option.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowrapidsecurityresponseremoval_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowrapidsecurityresponseremoval_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowrcsmessaging","displayName":"Allow RCS Messaging","description":"If false, prevents the use of RCS messaging.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowrcsmessaging_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowrcsmessaging_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowremoteappleeventsmodification","displayName":"Allow Remote Apple Events Modification","description":"If 'false', prevents modifying Remote Apple Events Sharing setting in System Settings.\nAvailable in macOS 14 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowremoteappleeventsmodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowremoteappleeventsmodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowremotescreenobservation","displayName":"Allow Remote Screen Observation","description":"If false, disables remote screen observation by the Classroom app. If Allow Screen Shot is set to false, the Classroom app doesn't observe remote screens. Required a supervised device until iOS 13 and macOS 10.15. Available in iOS 12 and later, and macOS 10.14.4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowremotescreenobservation_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowremotescreenobservation_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowrosettausageawareness","displayName":"Allow Rosetta Usage Awareness","description":"If `false`, disables Rosetta usage awareness. When Rosetta usage awareness is active, a pop-up dialog is displayed to the user when an app that is using Rosetta is launched. The pop-up dialog indicates that Rosetta will be removed in a future version of the operating system so that the user can contact the app vendor regarding a replacement for the current app.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowrosettausageawareness_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowrosettausageawareness_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowsafari","displayName":"Allow Safari","description":"If false, disables the Safari web browser app, and its icon is removed from the Home screen. This setting also prevents users from opening web clips. As of iOS 13, requires a supervised device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowsafari_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowsafari_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowsafarihistoryclearing","displayName":"Allow Safari History Clearing","description":"If `false`, the system disables the ability to clear browsing history in Safari.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowsafarihistoryclearing_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowsafarihistoryclearing_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowsafariprivatebrowsing","displayName":"Allow Safari Private Browsing","description":"If `false`, the system disables the ability to use private browsing in Safari.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowsafariprivatebrowsing_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowsafariprivatebrowsing_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowsafarisummary","displayName":"Allow Safari Summary","description":"If false, disables the ability to summarize content in Safari.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowsafarisummary_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowsafarisummary_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowsatelliteconnection","displayName":"Allow Satellite Connection","description":"If `false`, the system prohibits the connection to and use of satellite services.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowsatelliteconnection_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowsatelliteconnection_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowscreenshot","displayName":"Allow Screen Shot","description":"If false, disables saving a screenshot of the display and capturing a screen recording. It also disables the Classroom app from observing remote screens. Available in iOS 4 and later, and macOS 10.14.4 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowscreenshot_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowscreenshot_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowshareddevicetemporarysession","displayName":"Allow Shared Device Temporary Session","description":"If false, temporary sessions aren’t available on Shared iPad. Available in iOS 13.4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowshareddevicetemporarysession_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowshareddevicetemporarysession_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowsharedstream","displayName":"Allow Shared Stream","description":"If false, disables Shared Photo Stream. Available in iOS 6 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowsharedstream_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowsharedstream_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowspellcheck","displayName":"Allow Spell Check","description":"If false, disables keyboard spell-check. Requires a supervised device. Available in iOS 8.1.3 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowspellcheck_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowspellcheck_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowspotlightinternetresults","displayName":"Allow Spotlight Internet Results","description":"If false, disables Spotlight Internet search results in Siri Suggestions. Available in iOS 8 and later, and macOS 10.11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowspotlightinternetresults_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowspotlightinternetresults_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowstartupdiskmodification","displayName":"Allow Startup Disk Modification","description":"If 'false', prevents modification of Startup Disk setting in System Settings.\nAvailable in macOS 14 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowstartupdiskmodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowstartupdiskmodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowsystemappremoval","displayName":"Allow System App Removal","description":"If false, disables the removal of system apps from the device. Requires a supervised device. Available in iOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowsystemappremoval_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowsystemappremoval_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowtimemachinebackup","displayName":"Allow Time Machine Backup","description":"If 'false', prevents modification of Time Machine settings in System Settings.\nAvailable in macOS 14 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowtimemachinebackup_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowtimemachinebackup_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowuiappinstallation","displayName":"Allow UI App Installation","description":"If false, disables the App Store, and its icon is removed from the Home screen. However, users may continue to use host apps (iTunes, Configurator) to install or update their apps. In iOS 10 and later, MDM commands can override this restriction. Requires a supervised device. Available in iOS 9 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowuiappinstallation_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowuiappinstallation_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowuiconfigurationprofileinstallation","displayName":"Allow UI Configuration Profile Installation","description":"If false, prohibits the user from installing configuration profiles and certificates interactively. Requires a supervised device. Available in iOS 6 and later and macOS 13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowuiconfigurationprofileinstallation_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowuiconfigurationprofileinstallation_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowuniversalcontrol","displayName":"Allow Universal Control","description":"If false, disables Universal Control. Available in macOS 13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowuniversalcontrol_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowuniversalcontrol_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowunmanagedtoreadmanagedcontacts","displayName":"Allow Unmanaged To Read Managed Contacts","description":"If true, unmanaged apps can read from managed contacts accounts. If Allow Open From Managed To Unmanaged is true, this restriction has no effect. If this restriction is set to true, you must install the payload through MDM. Available in iOS 12 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowunmanagedtoreadmanagedcontacts_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowunmanagedtoreadmanagedcontacts_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowunpairedexternalboottorecovery","displayName":"Allow Unpaired External Boot To Recovery","description":"If true, allows devices to be booted into recovery by an unpaired device. Requires a supervised device. Available in iOS 14.5 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowunpairedexternalboottorecovery_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowunpairedexternalboottorecovery_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowuntrustedtlsprompt","displayName":"Allow Untrusted TLS Prompt","description":"If false, automatically rejects untrusted HTTPS certificates without prompting the user. Available in iOS 5 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowuntrustedtlsprompt_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowuntrustedtlsprompt_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowusbrestrictedmode","displayName":"Allow USB Restricted Mode","description":"If false, allows the device to always connect to USB accessories while locked. On macOS, allows new USB accessories to connect without authorization.\r\nRequires a supervised device. Available in iOS 11.4.1 and later and macOS 13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowusbrestrictedmode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowusbrestrictedmode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowvideoconferencing","displayName":"Allow Video Conferencing","description":"If false, hides the FaceTime app. As of iOS 13, requires a supervised device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowvideoconferencing_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowvideoconferencing_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowvideoconferencingremotecontrol","displayName":"Allow Video Conferencing Remote Control (Deprecated)","description":"If `false`, disables the ability for a remote FaceTime session to request control of the device.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowvideoconferencingremotecontrol_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowvideoconferencingremotecontrol_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowvisualintelligencesummary","displayName":"Allow Visual Intelligence Summary","description":"If `false`, the system disables visual intelligence summarization.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowvisualintelligencesummary_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowvisualintelligencesummary_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowvoicedialing","displayName":"Allow Voice Dialing (Deprecated)","description":"If false, disables voice dialing if the device is locked with a passcode. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowvoicedialing_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowvoicedialing_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowvpncreation","displayName":"Allow VPN Creation","description":"If false, disables the creation of VPN configurations. Requires a supervised device. Available in iOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowvpncreation_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowvpncreation_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowwallpapermodification","displayName":"Allow Wallpaper Modification","description":"If false, prevents wallpaper from being changed. Requires a supervised device. Available in iOS 9 and later, and macOS 10.13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowwallpapermodification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowwallpapermodification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowwebdistributionappinstallation","displayName":"Allow Web Distribution App Installation","description":"When 'false', the device prevents installation of apps directly from the web.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowwebdistributionappinstallation_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowwebdistributionappinstallation_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_allowwritingtools","displayName":"Allow Writing Tools","description":"If false, disables Apple Intelligence writing tools.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_allowwritingtools_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_allowwritingtools_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_autonomoussingleappmodepermittedappids","displayName":"Autonomous Single App Mode Permitted App IDs","description":"If present, allows apps identified by the bundle IDs listed in the array to autonomously enter Single App Mode. Requires a supervised device. Available in iOS 7 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.applicationaccess_blockedappbundleids","displayName":"Blocked App Bundle IDs","description":"If present, prevents bundle IDs listed in the array from being shown or launchable. Include the value com.apple.webapp to restrict all webclips. Requires a supervised device. Available in iOS 9.3 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.applicationaccess_com.apple.applicationaccess","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.applicationaccess_deniediccidsforimessagefacetime","displayName":"Denied ICCIDs For iMessage And FaceTime","description":"An array of strings representing ICCIDs of cellular plans. The device prevents use of any matching cellular networks in iMessage and FaceTime. The array must contain no more than 4 ICCID strings.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.applicationaccess_deniediccidsforrcs","displayName":"Denied ICCIDs For RCS","description":"An array of strings representing ICCIDs of cellular plans. The device prevents use of any matching cellular networks with RCS messaging. The array must contain no more than 4 ICCID strings.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.applicationaccess_enforcedfingerprinttimeout","displayName":"Enforced Fingerprint Timeout","description":"The value, in seconds, after which the fingerprint unlock will require a password to authenticate. The default value is 48 hours.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.applicationaccess_enforcedsoftwareupdatedelay","displayName":"Enforced Software Update Delay (Deprecated)","description":"Sets how many days to delay a software update on the device. With this restriction in place, the user doesn't see a software update until the specified number of days after the software update release date. This value is used by Force Delayed App Software Updates and Force Delayed Software Updates. Requires a supervised device in iOS. Available in iOS 11.3 and later, and macOS 10.13.4 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.applicationaccess_enforcedsoftwareupdatemajorosdeferredinstalldelay","displayName":"Enforced Software Update Major OS Deferred Install Delay (Deprecated)","description":"This restriction allows the admin to set how many days to delay a major software update on the device. When this restriction is in place the user sees a software update only after the specified delay after the release of the software update. This value controls the delay for Force Delayed Major Software Updates. Available in macOS 11.3 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.applicationaccess_enforcedsoftwareupdateminorosdeferredinstalldelay","displayName":"Enforced Software Update Minor OS Deferred Install Delay (Deprecated)","description":"This restriction allows the admin to set how many days to delay a minor OS software update on the device. When this restriction is in place the user see a software update only after the specified delay after the release of the software update. This value controls the delay for Force Delayed Software Updates. Available in macOS 11.3 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.applicationaccess_enforcedsoftwareupdatenonosdeferredinstalldelay","displayName":"Enforced Software Update Non OS Deferred Install Delay (Deprecated)","description":"This restriction allows the admin to set how many days to delay an app software update on the device. When this restriction is in place the user sees a non-OS software update only after the specified delay after the release of the software. This value controls the delay for Force Delayed App Software Updates. Available in macOS 11.3 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.applicationaccess_forceairdropunmanaged","displayName":"Force AirDrop Unmanaged","description":"If true, causes AirDrop to be considered an unmanaged drop target. Available in iOS 9 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forceairdropunmanaged_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forceairdropunmanaged_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forceairplayoutgoingrequestspairingpassword","displayName":"Force AirPlay Outgoing Requests Pairing Password","description":"If true, forces all devices receiving AirPlay requests from this device to use a pairing password. Available in iOS 7.1 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forceairplayoutgoingrequestspairingpassword_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forceairplayoutgoingrequestspairingpassword_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forceairprinttrustedtlsrequirement","displayName":"Force AirPrint Trusted TLS Requirement","description":"If true, requires trusted certificates for TLS printing communication. Requires a supervised device. Available in iOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forceairprinttrustedtlsrequirement_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forceairprinttrustedtlsrequirement_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forceassistantprofanityfilter","displayName":"Force Assistant Profanity Filter","description":"If true, forces the use of the profanity filter assistant. Requires a supervised device. Available in iOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forceassistantprofanityfilter_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forceassistantprofanityfilter_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forceauthenticationbeforeautofill","displayName":"Force Authentication Before Auto Fill","description":"If true, the user must authenticate before passwords or credit card information can be autofilled in Safari and Apps. If this restriction isn’t enforced, the user can toggle this feature in Settings. Only supported on devices with Face ID or Touch ID. Requires a supervised device. Available in iOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forceauthenticationbeforeautofill_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forceauthenticationbeforeautofill_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forceautomaticdateandtime","displayName":"Force Automatic Date And Time","description":"If true, enables the Set Automatically feature in Date & Time and can’t be disabled by the user. The device’s time zone is updated only when the device can determine its location using a cellular connection or Wi-Fi with location services enabled. Requires a supervised device. Available in iOS 12 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forceautomaticdateandtime_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forceautomaticdateandtime_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forcebypassscreencapturealert","displayName":"Force Bypass Screen Capture Alert","description":"If set to true, then the presentation of a screen capture alert will be bypassed.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forcebypassscreencapturealert_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forcebypassscreencapturealert_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forceclassroomautomaticallyjoinclasses","displayName":"Force Classroom Automatically Join Classes","description":"If true, automatically gives permission to the teacher’s requests without prompting the student. Requires a supervised device. Available in iOS 11 and later, and macOS 10.14.4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forceclassroomautomaticallyjoinclasses_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forceclassroomautomaticallyjoinclasses_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forceclassroomrequestpermissiontoleaveclasses","displayName":"Force Classroom Request Permission To Leave Classes","description":"If true, a student enrolled in an unmanaged course through Classroom requests permission from the teacher when attempting to leave the course. Requires a supervised device. Available in iOS 11.3 and later, and macOS 10.14.4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forceclassroomrequestpermissiontoleaveclasses_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forceclassroomrequestpermissiontoleaveclasses_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forceclassroomunpromptedappanddevicelock","displayName":"Force Classroom Unprompted App And Device Lock","description":"If true, allows the teacher to lock apps or the device without prompting the student. Requires a supervised device. Available in iOS 11 and later, and macOS 10.14.4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forceclassroomunpromptedappanddevicelock_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forceclassroomunpromptedappanddevicelock_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forceclassroomunpromptedscreenobservation","displayName":"Force Classroom Unprompted Screen Observation","description":"If `true` and `ScreenObservationPermissionModificationAllowed` is also `true` in the Education payload, a student enrolled in a managed course through the Classroom app automatically gives permission to that course teacher's requests to observe the student's screen without prompting the student.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forceclassroomunpromptedscreenobservation_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forceclassroomunpromptedscreenobservation_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forcedelayedappsoftwareupdates","displayName":"Force Delayed App Software Updates (Deprecated)","description":"If set to true, delays user visibility of major OS Software Updates. Available in macOS 11.3 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forcedelayedappsoftwareupdates_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forcedelayedappsoftwareupdates_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forcedelayedmajorsoftwareupdates","displayName":"Force Delayed Major Software Updates (Deprecated)","description":"If true, delays user visibility of non-OS Software Updates. Requires a supervised device. Visibility of Operating System updates is controlled through Force Delayed Software Updates. The delay is 30 days unless Enforced Software Update Delay is set to another value. Available in macOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forcedelayedmajorsoftwareupdates_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forcedelayedmajorsoftwareupdates_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forcedelayedsoftwareupdates","displayName":"Force Delayed Software Updates (Deprecated)","description":"If true, delays user visibility of software updates. In macOS, seed build updates are allowed, without delay. The delay is 30 days unless Enforced Software Update Delay is set to another value. Available in iOS 11.3 and later, and macOS 10.13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forcedelayedsoftwareupdates_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forcedelayedsoftwareupdates_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forceencryptedbackup","displayName":"Force Encrypted Backup","description":"If true, encrypts all backups. Available in iOS 4 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forceencryptedbackup_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forceencryptedbackup_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forceitunesstorepasswordentry","displayName":"Force iTunes Store Password Entry (Deprecated)","description":"If true, forces the user to enter their iTunes password for each transaction. Available in iOS 6 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forceitunesstorepasswordentry_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forceitunesstorepasswordentry_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forcelimitadtracking","displayName":"Force Limit Ad Tracking","description":"If true, limits ad tracking. Additionally, it disables app tracking and the Allow Apps To Request To Track setting. Available in iOS 7 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forcelimitadtracking_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forcelimitadtracking_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forceondeviceonlydictation","displayName":"Force On Device Only Dictation","description":"If true, disables connections to Siri servers for the purposes of dictation. Available in iOS 14.5 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forceondeviceonlydictation_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forceondeviceonlydictation_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forceondeviceonlytranslation","displayName":"Force On Device Only Translation","description":"If true, the device won’t connect to Siri servers for the purposes of translation. Available in iOS 15 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forceondeviceonlytranslation_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forceondeviceonlytranslation_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forcepreserveesimonerase","displayName":"Force Preserve ESIM On Erase","description":"If set to true, eSIM will be preserved when a device is erased due to too many failed password attempt or the \"Erase All Content and Settings\" option in Settings > General > Reset. eSIM will not be preserved if the device is erased by FindMy.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forcepreserveesimonerase_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forcepreserveesimonerase_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forcewatchwristdetection","displayName":"Force Watch Wrist Detection","description":"If true, forces a paired Apple Watch to use Wrist Detection. Available in iOS 8.2 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forcewatchwristdetection_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forcewatchwristdetection_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forcewifipoweron","displayName":"Force WiFi Power On","description":"If true, prevents Wi-Fi from being turned off in Settings or Control Center, even by entering or leaving Airplane Mode. It doesn’t prevent selecting which Wi-Fi network to use. Requires a supervised device. Available in iOS 13.0 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forcewifipoweron_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forcewifipoweron_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_forcewifitoallowednetworksonly","displayName":"Force WiFi To Allowed Networks Only","description":"If true, limits device to only join Wi-Fi networks set-up via configuration profile. Requires a supervised device. Available in iOS 14.5 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_forcewifitoallowednetworksonly_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_forcewifitoallowednetworksonly_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingappsau","displayName":"Rating Apps - Australia","description":"The maximum level of app content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingappsau_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_1","displayName":"1+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_2","displayName":"2+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_3","displayName":"3+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_4","displayName":"4+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_5","displayName":"5+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_6","displayName":"6+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_7","displayName":"7+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_8","displayName":"8+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_9","displayName":"9+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_10","displayName":"10+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_11","displayName":"11+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_12","displayName":"12+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_13","displayName":"13+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_14","displayName":"14+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_15","displayName":"15+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_16","displayName":"16+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_17","displayName":"17+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_18","displayName":"18+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_19","displayName":"19+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_20","displayName":"20+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_21","displayName":"21+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsau_22","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingappsca","displayName":"Rating Apps - Canada","description":"The maximum level of app content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingappsca_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_1","displayName":"1+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_2","displayName":"2+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_3","displayName":"3+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_4","displayName":"4+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_5","displayName":"5+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_6","displayName":"6+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_7","displayName":"7+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_8","displayName":"8+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_9","displayName":"9+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_10","displayName":"10+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_11","displayName":"11+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_12","displayName":"12+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_13","displayName":"13+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_14","displayName":"14+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_15","displayName":"15+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_16","displayName":"16+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_17","displayName":"17+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_18","displayName":"18+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_19","displayName":"19+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_20","displayName":"20+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_21","displayName":"21+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsca_22","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingappsde","displayName":"Rating Apps - Germany","description":"The maximum level of app content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingappsde_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_1","displayName":"1+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_2","displayName":"2+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_3","displayName":"3+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_4","displayName":"4+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_5","displayName":"5+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_6","displayName":"6+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_7","displayName":"7+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_8","displayName":"8+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_9","displayName":"9+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_10","displayName":"10+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_11","displayName":"11+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_12","displayName":"12+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_13","displayName":"13+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_14","displayName":"14+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_15","displayName":"15+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_16","displayName":"16+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_17","displayName":"17+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_18","displayName":"18+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_19","displayName":"19+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_20","displayName":"20+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_21","displayName":"21+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsde_22","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingappsexemptedbundleids","displayName":"Rating Apps Exempted Bundle IDs","description":"If present, the system exempts apps with bundle IDs in the array from age-based rating restrictions. The system uses intersection combine rules to combine multiple payloads and any exceptions that parental control apps provide, including ScreenTime.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.applicationaccess_ratingappsfr","displayName":"Rating Apps - France","description":"The maximum level of app content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingappsfr_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_1","displayName":"1+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_2","displayName":"2+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_3","displayName":"3+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_4","displayName":"4+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_5","displayName":"5+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_6","displayName":"6+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_7","displayName":"7+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_8","displayName":"8+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_9","displayName":"9+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_10","displayName":"10+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_11","displayName":"11+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_12","displayName":"12+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_13","displayName":"13+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_14","displayName":"14+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_15","displayName":"15+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_16","displayName":"16+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_17","displayName":"17+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_18","displayName":"18+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_19","displayName":"19+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_20","displayName":"20+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_21","displayName":"21+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsfr_22","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingappsgb","displayName":"Rating Apps - Great Britain","description":"The maximum level of app content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingappsgb_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_1","displayName":"1+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_2","displayName":"2+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_3","displayName":"3+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_4","displayName":"4+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_5","displayName":"5+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_6","displayName":"6+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_7","displayName":"7+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_8","displayName":"8+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_9","displayName":"9+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_10","displayName":"10+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_11","displayName":"11+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_12","displayName":"12+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_13","displayName":"13+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_14","displayName":"14+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_15","displayName":"15+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_16","displayName":"16+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_17","displayName":"17+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_18","displayName":"18+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_19","displayName":"19+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_20","displayName":"20+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_21","displayName":"21+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsgb_22","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingappsie","displayName":"Rating Apps - Ireland","description":"The maximum level of app content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingappsie_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_1","displayName":"1+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_2","displayName":"2+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_3","displayName":"3+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_4","displayName":"4+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_5","displayName":"5+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_6","displayName":"6+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_7","displayName":"7+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_8","displayName":"8+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_9","displayName":"9+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_10","displayName":"10+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_11","displayName":"11+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_12","displayName":"12+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_13","displayName":"13+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_14","displayName":"14+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_15","displayName":"15+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_16","displayName":"16+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_17","displayName":"17+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_18","displayName":"18+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_19","displayName":"19+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_20","displayName":"20+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_21","displayName":"21+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsie_22","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingappsjp","displayName":"Rating Apps - Japan","description":"The maximum level of app content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingappsjp_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_1","displayName":"1+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_2","displayName":"2+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_3","displayName":"3+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_4","displayName":"4+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_5","displayName":"5+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_6","displayName":"6+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_7","displayName":"7+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_8","displayName":"8+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_9","displayName":"9+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_10","displayName":"10+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_11","displayName":"11+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_12","displayName":"12+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_13","displayName":"13+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_14","displayName":"14+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_15","displayName":"15+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_16","displayName":"16+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_17","displayName":"17+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_18","displayName":"18+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_19","displayName":"19+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_20","displayName":"20+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_21","displayName":"21+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsjp_22","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingappsnz","displayName":"Rating Apps - New Zealand","description":"The maximum level of app content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingappsnz_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_1","displayName":"1+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_2","displayName":"2+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_3","displayName":"3+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_4","displayName":"4+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_5","displayName":"5+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_6","displayName":"6+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_7","displayName":"7+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_8","displayName":"8+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_9","displayName":"9+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_10","displayName":"10+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_11","displayName":"11+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_12","displayName":"12+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_13","displayName":"13+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_14","displayName":"14+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_15","displayName":"15+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_16","displayName":"16+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_17","displayName":"17+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_18","displayName":"18+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_19","displayName":"19+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_20","displayName":"20+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_21","displayName":"21+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsnz_22","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingappsus","displayName":"Rating Apps - United States","description":"The maximum level of app content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingappsus_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsus_1","displayName":"4+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsus_2","displayName":"9+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsus_3","displayName":"12+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsus_4","displayName":"17+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingappsus_5","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingmoviesau","displayName":"Rating Movies - Australia","description":"The maximum level of movie content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingmoviesau_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesau_1","displayName":"G","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesau_2","displayName":"PG","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesau_3","displayName":"M","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesau_4","displayName":"MA15+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesau_5","displayName":"R18+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesau_6","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingmoviesca","displayName":"Rating Movies - Canada","description":"The maximum level of movie content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingmoviesca_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesca_1","displayName":"G","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesca_2","displayName":"PG","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesca_3","displayName":"14A","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesca_4","displayName":"18A","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesca_5","displayName":"R","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesca_6","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingmoviesde","displayName":"Rating Movies - Germany","description":"The maximum level of movie content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingmoviesde_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesde_1","displayName":"Ab 0 Jahren","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesde_2","displayName":"Ab 6 Jahren","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesde_3","displayName":"Ab 12 Jahren","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesde_4","displayName":"Ab 16 Jahren","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesde_5","displayName":"Ab 18 Jahren","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesde_6","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingmoviesfr","displayName":"Rating Movies - France","description":"The maximum level of movie content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingmoviesfr_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesfr_2","displayName":"10","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesfr_3","displayName":"12","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesfr_4","displayName":"16","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesfr_5","displayName":"18","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesfr_6","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingmoviesgb","displayName":"Rating Movies - Great Britain","description":"The maximum level of movie content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingmoviesgb_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesgb_1","displayName":"U","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesgb_2","displayName":"UC","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesgb_3","displayName":"PG","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesgb_4","displayName":"12","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesgb_5","displayName":"12A","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesgb_6","displayName":"15","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesgb_7","displayName":"18","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesgb_8","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingmoviesie","displayName":"Rating Movies - Ireland","description":"The maximum level of movie content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingmoviesie_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesie_1","displayName":"G","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesie_2","displayName":"PG","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesie_3","displayName":"12A","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesie_4","displayName":"15A","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesie_5","displayName":"16","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesie_6","displayName":"18","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesie_7","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingmoviesjp","displayName":"Rating Movies - Japan","description":"The maximum level of movie content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingmoviesjp_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesjp_1","displayName":"G","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesjp_2","displayName":"PG-12","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesjp_3","displayName":"R15+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesjp_4","displayName":"R18+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesjp_5","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingmoviesnz","displayName":"Rating Movies - New Zealand","description":"The maximum level of movie content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingmoviesnz_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesnz_1","displayName":"G","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesnz_2","displayName":"PG","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesnz_3","displayName":"M","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesnz_4","displayName":"R13","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesnz_5","displayName":"R15","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesnz_6","displayName":"R16","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesnz_7","displayName":"R18","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesnz_8","displayName":"R","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesnz_9","displayName":"RP16","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesnz_10","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingmoviesus","displayName":"Rating Movies - United States","description":"The maximum level of movie content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingmoviesus_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesus_1","displayName":"G","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesus_2","displayName":"PG","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesus_3","displayName":"PG-13","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesus_4","displayName":"R","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesus_5","displayName":"NC-17","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingmoviesus_6","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingregion","displayName":"Rating Region","description":"The country key that profile tools use to display the proper ratings for the given region. This data isn’t recognized or reported by the client.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingregion_0","displayName":"United States","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingregion_1","displayName":"Australia","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingregion_2","displayName":"Canada","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingregion_3","displayName":"Germany","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingregion_4","displayName":"France","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingregion_5","displayName":"Ireland","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingregion_6","displayName":"Japan","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingregion_7","displayName":"New Zealand","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingregion_8","displayName":"Great Britain","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingtvshowsau","displayName":"Rating TV Shows - Australia","description":"The maximum level of TV content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingtvshowsau_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsau_1","displayName":"P","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsau_2","displayName":"C","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsau_3","displayName":"G","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsau_4","displayName":"PG","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsau_5","displayName":"M","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsau_6","displayName":"MA15+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsau_7","displayName":"AV15+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsau_8","displayName":"All","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsau_9","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingtvshowsca","displayName":"Rating TV Shows - Canada","description":"The maximum level of TV content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingtvshowsca_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsca_1","displayName":"C","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsca_2","displayName":"C8","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsca_3","displayName":"G","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsca_4","displayName":"PG","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsca_5","displayName":"14+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsca_6","displayName":"18+","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsca_7","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingtvshowsde","displayName":"Rating TV Shows - Germany","description":"The maximum level of TV content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingtvshowsde_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsde_1","displayName":"Ab 0 Jahren","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsde_2","displayName":"Ab 6 Jahren","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsde_3","displayName":"Ab 12 Jahren","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsde_4","displayName":"Ab 16 Jahren","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsde_5","displayName":"Ab 18 Jahren","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsde_7","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingtvshowsfr","displayName":"Rating TV Shows - France","description":"The maximum level of TV content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingtvshowsfr_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsfr_1","displayName":"-10","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsfr_2","displayName":"-12","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsfr_3","displayName":"-16","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsfr_4","displayName":"-18","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsfr_5","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingtvshowsgb","displayName":"Rating TV Shows - Great Britain","description":"The maximum level of TV content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingtvshowsgb_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsgb_1","displayName":"Caution","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsgb_2","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingtvshowsie","displayName":"Rating TV Shows - Ireland","description":"The maximum level of TV content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingtvshowsie_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsie_1","displayName":"GA","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsie_2","displayName":"CH","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsie_3","displayName":"YA","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsie_4","displayName":"PS","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsie_5","displayName":"MA","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsie_6","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingtvshowsjp","displayName":"Rating TV Shows - Japan","description":"The maximum level of TV content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingtvshowsjp_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsjp_1","displayName":"Explicit Allowed","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsjp_2","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingtvshowsnz","displayName":"Rating TV Shows - New Zealand","description":"The maximum level of TV content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingtvshowsnz_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsnz_1","displayName":"G","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsnz_2","displayName":"PGR","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsnz_3","displayName":"AO","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsnz_4","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_ratingtvshowsus","displayName":"Rating TV Shows - United States","description":"The maximum level of TV content allowed on the device. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_ratingtvshowsus_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsus_1","displayName":"TV-Y","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsus_2","displayName":"TV-Y7","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsus_3","displayName":"TV-G","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsus_4","displayName":"TV-PG","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsus_5","displayName":"TV-14","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsus_6","displayName":"TB-MA","description":null,"helpText":null},{"id":"com.apple.applicationaccess_ratingtvshowsus_7","displayName":"All","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_requiremanagedpasteboard","displayName":"Require Managed Pasteboard","description":"If true, copy and paste functionality respects the Allow Open From Managed To Unmanaged and Allow Open From Unmanaged To Managed restrictions. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_requiremanagedpasteboard_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_requiremanagedpasteboard_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_safariacceptcookies","displayName":"Safari Accept Cookies","description":"This value defines the conditions under which the device accepts cookies. The user-facing settings changed in iOS 11, although the possible values remain the same. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_safariacceptcookies_0","displayName":"Prevent Cross-Site Tracking and Block All Cookies are enabled and the user canʼt disable either setting.","description":null,"helpText":null},{"id":"com.apple.applicationaccess_safariacceptcookies_1","displayName":"Prevent Cross-Site Tracking is enabled and the user canʼt disable it. Block All Cookies is not enabled, although the user can enable it.","description":null,"helpText":null},{"id":"com.apple.applicationaccess_safariacceptcookies_2","displayName":"Prevent Cross-Site Tracking is enabled and Block All Cookies is not enabled. The user can toggle either setting.","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_safariallowautofill","displayName":"Safari Allow Autofill","description":"If false, disables Safari AutoFill for passwords, contact info, and credit cards and also prevents the Keychain from being used for AutoFill. Though third-party password managers are allowed and apps can use AutoFill. As of iOS 13, requires a supervised device. Available in iOS 4 and later, and macOS 10.13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_safariallowautofill_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_safariallowautofill_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_safariallowjavascript","displayName":"Safari Allow Java Script","description":"If false, Safari doesn’t execute JavaScript. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_safariallowjavascript_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_safariallowjavascript_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_safariallowpopups","displayName":"Safari Allow Popups","description":"If false, Safari doesn’t allow pop-up windows. Available in iOS 4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_safariallowpopups_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_safariallowpopups_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess_safariforcefraudwarning","displayName":"Safari Force Fraud Warning","description":"If true, enables Safari fraud warning. Available in iOS 4 and later. Also available for user enrollment.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess_safariforcefraudwarning_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess_safariforcefraudwarning_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.applicationaccess.new_com.apple.applicationaccess.new","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.applicationaccess.new_familycontrolsenabled","displayName":"Family Controls Enabled","description":"If true, enables app access restrictions.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.applicationaccess.new_familycontrolsenabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.applicationaccess.new_familycontrolsenabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.appstore_com.apple.appstore","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.appstore_disablesoftwareupdatenotifications","displayName":"Disable Software Update Notifications","description":"If true, disables software update notifications. Available in macOS 10.10 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.appstore_disablesoftwareupdatenotifications_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.appstore_disablesoftwareupdatenotifications_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.appstore_restrict-store-disable-app-adoption","displayName":"Restrict-store-disable-app-adoption","description":"If true, disables app adoption by users. Available in macOS 10.10 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.appstore_restrict-store-disable-app-adoption_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.appstore_restrict-store-disable-app-adoption_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.appstore_restrict-store-softwareupdate-only","displayName":"Restrict Store Software Update Only","description":"If true, prevents App Store from launching. Available in macOS 10.14 and later. Restricts installations to software updates only in macOS 10.10 - 10.13.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.appstore_restrict-store-softwareupdate-only_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.appstore_restrict-store-softwareupdate-only_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.asam_allowedapplications","displayName":"Allowed Applications","description":"An array of dictionaries that specifies the apps that can be granted access to the Accessibility APIs.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.asam_allowedapplications_item_bundleidentifier","displayName":"Bundle Identifier","description":"The unique bundle identifier. If two dictionaries contain the same Bundle Identifier value but a different Team Identifier value, this will be considered an error and the profile won't be installed.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.asam_allowedapplications_item_teamidentifier","displayName":"Team Identifier","description":"The developer's team identifier, used when the app was signed.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.asam_com.apple.asam","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.assetcache.managed_allowcachedelete","displayName":"Allow Cache Delete","description":"Allow the system to purge content from the cache automatically when it needs disk space for other apps (i.e. when free disk space runs low on the computer). Customers who want Content Caching to be as effective as possible should turn this setting off.\r\nAvailable in macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.assetcache.managed_allowcachedelete_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_allowcachedelete_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.assetcache.managed_allowpersonalcaching","displayName":"Allow Personal Caching","description":"If true, caches the user's iCloud data. Clients may take some time (hours or days) to react to changes to this setting; it doesn't have an immediate effect.\r\nAt least one of the Allow Personal Caching or Allow Shared Caching settings must be true.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.assetcache.managed_allowpersonalcaching_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_allowpersonalcaching_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.assetcache.managed_allowsharedcaching","displayName":"Allow Shared Caching","description":"If true, caches non-iCloud content, such as apps and software updates. Clients may take some time (hours, days) to react to changes to this setting; it does not have an immediate effect.\r\nAt least one of the Allow Personal Caching or Allow Shared Caching settings must be true. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.assetcache.managed_allowsharedcaching_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_allowsharedcaching_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.assetcache.managed_autoactivation","displayName":"Auto Activation","description":"If true, automatically activates the content cache when possible and prevents it from being disabled. If the Allow Content Caching restriction is set to false, Auto Activation is also false.\r\nRemoving a profile that set Auto Activation to true does not deactivate the Content Cache.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.assetcache.managed_autoactivation_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_autoactivation_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.assetcache.managed_autoenabletetheredcaching","displayName":"Auto Enable Tethered Caching","description":"Automatically enable Internet connection sharing when possible and prevent disabling Internet connection sharing. Deny Tethered Caching overrides Auto Enable Tethered Caching. Tethered caching requires Content Caching. Available in macOS 10.15.4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.assetcache.managed_autoenabletetheredcaching_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_autoenabletetheredcaching_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.assetcache.managed_cachelimit","displayName":"Cache Limit","description":"The maximum number of bytes of disk space that will be used for the content cache. A value of 0 means unlimited disk space.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.assetcache.managed_com.apple.assetcache.managed","displayName":"Top Level Setting Group Collection","description":"com.apple.AssetCache.managed","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.assetcache.managed_datapath","displayName":"Data Path","description":"The path to the directory used to store cached content. Changing this setting manually doesn't automatically move cached content from the old location to the new one. To move content automatically, use the Sharing preference's Content Caching pane. The value must be (or end with) /Library/Application Support/Apple/AssetCache/Data.\r\nA directory and its intermediates are created for the given data path if it doesn't already exist. The directory is owned by _assetcache:_assetcache and has mode 0750. Its immediate parent directory (.../Library/Application Support/Apple/AssetCache) is owned by _assetcache:_assetcache and has mode 0755. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.assetcache.managed_denytetheredcaching","displayName":"Deny Tethered Caching","description":"If true, disables tethered caching.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.assetcache.managed_denytetheredcaching_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_denytetheredcaching_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.assetcache.managed_displayalerts","displayName":"Display Alerts","description":"If true, Content Caching displays exceptional conditions (alerts) as system notifications in the upper corner of the screen. Alerts were automatically displayed starting in macOS 10.13. In macOS 10.15 the alerts are off by default, but still available via this setting.\r\nAvailable in macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.assetcache.managed_displayalerts_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_displayalerts_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.assetcache.managed_keepawake","displayName":"Keep Awake","description":"If true, prevents the computer from sleeping as long as Content Caching is on (System Preferences > Sharing > Content Caching is on). Customers who want Content Caching to be as available as musch as possible should turn this setting on.\r\nAvailable in macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.assetcache.managed_keepawake_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_keepawake_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.assetcache.managed_listenranges","displayName":"Listen Ranges","description":"The range of client IP addresses to serve.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.assetcache.managed_listenranges_item_first","displayName":"First","description":"The first IP address in the range.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.assetcache.managed_listenranges_item_last","displayName":"Last","description":"The last IP address in the range.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.assetcache.managed_listenranges_item_type","displayName":"IP Address Type","description":"The IP address type.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.assetcache.managed_listenranges_item_type_0","displayName":"IPv4","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_listenranges_item_type_1","displayName":"IPv6","description":null,"helpText":null}]},{"id":"com.apple.assetcache.managed_listenrangesonly","displayName":"Listen Ranges Only","description":"If true, the content cache provides content to the clients in the Listen Ranges.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.assetcache.managed_listenrangesonly_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_listenrangesonly_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.assetcache.managed_listenwithpeersandparents","displayName":"Listen With Peers And Parents","description":"If true, the content cache provides content to the clients in the union of the Listen Ranges, Peer Listen Ranges and Parents.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.assetcache.managed_listenwithpeersandparents_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_listenwithpeersandparents_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.assetcache.managed_localsubnetsonly","displayName":"Local Subnets Only","description":"If true, the content cache offers content to clients only on the same immediate local network only. No content is offered to clients on other networks reachable by the content cache. If LocalSubnetsOnly is set to true, ListenRanges will be ignored.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.assetcache.managed_localsubnetsonly_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_localsubnetsonly_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.assetcache.managed_logclientidentity","displayName":"Log Client Identity","description":"If true, the Content Cache logs the IP address and port number of the clients that request content. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.assetcache.managed_logclientidentity_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_logclientidentity_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.assetcache.managed_parents","displayName":"Parents","description":"An array of the local IP addresses of other content caches that this cache should download from or upload to, instead of downloading from or uploading to Apple directly. Invalid addresses and addresses of computers that aren't content caches are ignored. Parent caches that become unavailable are skipped. If all parent content caches become unavailable, the content cache downloads from or uploads to Apple directly, until a parent content cache becomes available again.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.assetcache.managed_parentselectionpolicy","displayName":"Parent Selection Policy","description":"The policy to implement when choosing among more than one configured parent content cache. With every policy, parent caches that are temporarily unavailable are skipped.\r\nfirst-available: Always use the first available parent in the Parents list. Use this policy to designate permanent primary, secondary, and subsequent parents.\r\n\r\nurl-path-hash: Hash the path part of the requested URL so that the same parent is always used for the same URL. This is useful for maximizing the size of the combined caches of the parents.\r\n\r\nrandom: Choose a parent at random. Use this policy for load balancing.\r\n\r\nround-robin: Rotate through the parents in order. Use this policy for load balancing.\r\n\r\nsticky-available: Use the first available parent that is available in the Parents list until it becomes unavailable, then advance to the next one. Use this policy for designating floating primary, secondary, and subsequent parents. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.assetcache.managed_parentselectionpolicy_0","displayName":"first-available","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_parentselectionpolicy_1","displayName":"url-path-hash","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_parentselectionpolicy_2","displayName":"random","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_parentselectionpolicy_3","displayName":"round-robin","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_parentselectionpolicy_4","displayName":"sticky-available","description":null,"helpText":null}]},{"id":"com.apple.assetcache.managed_peerfilterranges","displayName":"Peer Filter Ranges","description":"The ranges of peer IP addresses that the content cache uses to filter its list of peers to query for content. The content cache only queries peers in Peer Filter Ranges. When Peer Filter Ranges is an empty array, the content cache doesn't query any peers.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.assetcache.managed_peerfilterranges_item_first","displayName":"First","description":"The first IP address in the range.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.assetcache.managed_peerfilterranges_item_last","displayName":"Last","description":"The last IP address in the range.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.assetcache.managed_peerfilterranges_item_type","displayName":"IP Address Type","description":"The IP address type.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.assetcache.managed_peerfilterranges_item_type_0","displayName":"IPv4","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_peerfilterranges_item_type_1","displayName":"IPv6","description":null,"helpText":null}]},{"id":"com.apple.assetcache.managed_peerlistenranges","displayName":"Peer Listen Ranges","description":"The ranges of peer IP addresses the content cache responds to. When Peer Listen Ranges is an empty array, the content cache responds with an error to all cache queries.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.assetcache.managed_peerlistenranges_item_first","displayName":"First","description":"The first IP address in the range.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.assetcache.managed_peerlistenranges_item_last","displayName":"Last","description":"The last IP address in the range.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.assetcache.managed_peerlistenranges_item_type","displayName":"IP Address Type","description":"The IP address type.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.assetcache.managed_peerlistenranges_item_type_0","displayName":"IPv4","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_peerlistenranges_item_type_1","displayName":"IPv6","description":null,"helpText":null}]},{"id":"com.apple.assetcache.managed_peerlocalsubnetsonly","displayName":"Peer Local Subnets Only","description":"If true, the content cache only peers with other content caches on the same immediate local network, rather than with content caches that use the same public IP address as the device. When Peer Local Subnets Only is true, it overrides the configuration of Peer Filter Ranges and Peer Listen Ranges. If the network changes, the local network peering restrictions update appropriately. If false, the content cache defers to Peer Filter Ranges and Peer Listen Ranges for configuring the peering restrictions.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.assetcache.managed_peerlocalsubnetsonly_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_peerlocalsubnetsonly_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.assetcache.managed_port","displayName":"Port","description":"The TCP port number on which the content cache accepts requests for uploads or downloads. Set the port to 0 to pick a random, available port.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.assetcache.managed_publicranges","displayName":"Public Ranges","description":"The ranges of public IP addresses that the cloud servers should use for matching clients to content caches.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.assetcache.managed_publicranges_item_first","displayName":"First","description":"The first IP address in the range.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.assetcache.managed_publicranges_item_last","displayName":"Last","description":"The last IP address in the range.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.assetcache.managed_publicranges_item_type","displayName":"IP Address Type","description":"The IP address type.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.assetcache.managed_publicranges_item_type_0","displayName":"IPv4","description":null,"helpText":null},{"id":"com.apple.assetcache.managed_publicranges_item_type_1","displayName":"IPv6","description":null,"helpText":null}]},{"id":"com.apple.associated-domains_com.apple.associated-domains","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.associated-domains_configuration","displayName":"Configuration","description":"Map apps to their associated domains.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.associated-domains_configuration_item_applicationidentifier","displayName":"Application Identifier","description":"The app identifier to associate the domains with.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.associated-domains_configuration_item_associateddomains","displayName":"Associated Domains","description":"The domains to be associated with the app. Each string is in the form of \"service:domain\". Domains should be fully qualified hostnames, like www.example.com.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.associated-domains_configuration_item_enabledirectdownloads","displayName":"Enable Direct Downloads","description":"If true, data for this domain should be downloaded directly instead of through a CDN. The entitlement value for this domain must be set to service:domain?mode=managed or this value will be ignored. Available in macOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.associated-domains_configuration_item_enabledirectdownloads_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.associated-domains_configuration_item_enabledirectdownloads_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.caldav.account_caldavaccountdescription","displayName":"Cal DAV Account Description","description":"The description of the account.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.caldav.account_caldavhostname","displayName":"Cal DAV Host Name","description":"The server’s address.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.caldav.account_caldavpassword","displayName":"Cal DAV Password","description":"The user’s password. This is only used with encrypted profiles.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.caldav.account_caldavport","displayName":"Cal DAV Port","description":"The server’s port.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.caldav.account_caldavprincipalurl","displayName":"Cal DAV Principal URL","description":"The base URL to the user’s calendar.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.caldav.account_caldavusername","displayName":"Cal DAV Username","description":"The user name for logins.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.caldav.account_caldavusessl","displayName":"Cal DAV Use SSL","description":"If true, enables SSL.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.caldav.account_caldavusessl_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.caldav.account_caldavusessl_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.caldav.account_com.apple.caldav.account","displayName":"Top Level Setting Group Collection","description":"com.apple.caldav.account","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.carddav.account_carddavaccountdescription","displayName":"Card DAV Account Description","description":"The description of the account.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.carddav.account_carddavhostname","displayName":"Card DAV Host Name","description":"The server’s address.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.carddav.account_carddavpassword","displayName":"Card DAV Password","description":"The user’s password.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.carddav.account_carddavport","displayName":"Card DAV Port","description":"The server’s port.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.carddav.account_carddavprincipalurl","displayName":"Card DAV Principal URL","description":"The base URL to the user’s address book.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.carddav.account_carddavusername","displayName":"Card DAV Username","description":"The user name for logins.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.carddav.account_carddavusessl","displayName":"Card DAV Use SSL","description":"If true, enables SSL.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.carddav.account_carddavusessl_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.carddav.account_carddavusessl_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.carddav.account_com.apple.carddav.account","displayName":"Top Level Setting Group Collection","description":"com.apple.carddav.account","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellular_apns","displayName":"APNs","description":"An array of access point dictionaries.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellular_apns_item_allowedprotocolmask","displayName":"Allowed Protocol Mask","description":"The supported Internet Protocol versions. Available in iOS 10.3 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.cellular_apns_item_allowedprotocolmask_0","displayName":"IPv4","description":null,"helpText":null},{"id":"com.apple.cellular_apns_item_allowedprotocolmask_1","displayName":"IPv6","description":null,"helpText":null},{"id":"com.apple.cellular_apns_item_allowedprotocolmask_2","displayName":"Both","description":null,"helpText":null}]},{"id":"com.apple.cellular_apns_item_allowedprotocolmaskindomesticroaming","displayName":"Allowed Protocol Mask In Domestic Roaming","description":"The supported Internet Protocol versions while roaming domestically. Available in iOS 10.3 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.cellular_apns_item_allowedprotocolmaskindomesticroaming_0","displayName":"IPv4","description":null,"helpText":null},{"id":"com.apple.cellular_apns_item_allowedprotocolmaskindomesticroaming_1","displayName":"IPv6","description":null,"helpText":null},{"id":"com.apple.cellular_apns_item_allowedprotocolmaskindomesticroaming_2","displayName":"Both","description":null,"helpText":null}]},{"id":"com.apple.cellular_apns_item_allowedprotocolmaskinroaming","displayName":"Allowed Protocol Mask In Roaming","description":"The supported Internet Protocol versions while roaming. Available in iOS 10.3 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.cellular_apns_item_allowedprotocolmaskinroaming_0","displayName":"IPv4","description":null,"helpText":null},{"id":"com.apple.cellular_apns_item_allowedprotocolmaskinroaming_1","displayName":"IPv6","description":null,"helpText":null},{"id":"com.apple.cellular_apns_item_allowedprotocolmaskinroaming_2","displayName":"Both","description":null,"helpText":null}]},{"id":"com.apple.cellular_apns_item_authenticationtype","displayName":"Authentication Type","description":"The authentication type for logging in.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.cellular_apns_item_authenticationtype_0","displayName":"CHAP","description":null,"helpText":null},{"id":"com.apple.cellular_apns_item_authenticationtype_1","displayName":"PAP","description":null,"helpText":null}]},{"id":"com.apple.cellular_apns_item_enablexlat464","displayName":"Enable XLAT464","description":"If true, enables XLAT464. Available in iOS 16 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.cellular_apns_item_enablexlat464_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.cellular_apns_item_enablexlat464_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.cellular_apns_item_name","displayName":"Name","description":"The name for this configuration.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellular_apns_item_password","displayName":"Password","description":"The user's password for the APN.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellular_apns_item_proxyport","displayName":"Proxy Port","description":"The proxy server's port number.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellular_apns_item_proxyserver","displayName":"Proxy Server","description":"The proxy server's address.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellular_apns_item_username","displayName":"Username","description":"The user name for the APN.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellular_attachapn","displayName":"Attach APN","description":"A configuration dictionary.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellular_attachapn_allowedprotocolmask","displayName":"Allowed Protocol Mask","description":"The supported Internet Protocol versions.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.cellular_attachapn_allowedprotocolmask_0","displayName":"IPv4","description":null,"helpText":null},{"id":"com.apple.cellular_attachapn_allowedprotocolmask_1","displayName":"IPv6","description":null,"helpText":null},{"id":"com.apple.cellular_attachapn_allowedprotocolmask_2","displayName":"Both","description":null,"helpText":null}]},{"id":"com.apple.cellular_attachapn_authenticationtype","displayName":"Authentication Type","description":"The authentication type for logging in.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.cellular_attachapn_authenticationtype_0","displayName":"CHAP","description":null,"helpText":null},{"id":"com.apple.cellular_attachapn_authenticationtype_1","displayName":"PAP","description":null,"helpText":null}]},{"id":"com.apple.cellular_attachapn_name","displayName":"Name","description":"The name for this configuration.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellular_attachapn_password","displayName":"Password","description":"The password for the APN.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellular_attachapn_username","displayName":"Username","description":"The user name for the APN.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellular_com.apple.cellular","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellularprivatenetwork.managed_cellulardatapreferred","displayName":"Cellular Data Preferred","description":"Set to `true` to prefer this private network over Wi-Fi.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.cellularprivatenetwork.managed_cellulardatapreferred_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.cellularprivatenetwork.managed_cellulardatapreferred_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.cellularprivatenetwork.managed_com.apple.cellularprivatenetwork.managed","displayName":"com.apple.cellularprivatenetwork.managed","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellularprivatenetwork.managed_csgnetworkidentifier","displayName":"Csg Network Identifier","description":"A string using the 3GPP \"CSG_ID\" format (defined in 3GPP 23.003, Section 4.7). The device uses this value to match a SIM present on the device.\n\nAll combinations of `NetworkIdentifier` and `CsgNetworkIdentifier` must be unique across all profiles installed on the device.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellularprivatenetwork.managed_datasetname","displayName":"Data Set Name","description":"The name of the private network configuration data set.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellularprivatenetwork.managed_enablenrstandalone","displayName":"Enable NR Standalone","description":"Set to `true` if this private network is NR Standalone.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.cellularprivatenetwork.managed_enablenrstandalone_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.cellularprivatenetwork.managed_enablenrstandalone_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.cellularprivatenetwork.managed_geofences","displayName":"Geofences","description":"A list of up to 1000 geofences for private networks. Geofencing is only used on iPhone.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellularprivatenetwork.managed_geofences_item_geofenceid","displayName":"Geofence Id","description":"A geofence identifier that's unique within a list of geofences.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellularprivatenetwork.managed_geofences_item_latitude","displayName":"Latitude","description":"The latitude of the geofence.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellularprivatenetwork.managed_geofences_item_longitude","displayName":"Longitude","description":"The longitude of the geofence.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellularprivatenetwork.managed_geofences_item_radius","displayName":"Radius","description":"Specifies the radius of the geofence in meters. Set this value slightly greater than the private cellular network coverage area.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellularprivatenetwork.managed_networkidentifier","displayName":"Network Identifier","description":"A string using the 3GPP \"Coordinated NID\" (option 1 or option 2) format (defined in 3GPP 31.102, Section 12.7.1). The device uses this value to match a SIM present on the device.\n\nAll combinations of `NetworkIdentifier` and `CsgNetworkIdentifier` must be unique across all profiles installed on the device.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.cellularprivatenetwork.managed_versionnumber","displayName":"Version Number","description":"The version number of this dataset that the system uses to track updates.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.configurationprofile.identification_com.apple.configurationprofile.identification","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.configurationprofile.identification_payloadidentification","displayName":"Payload Identification (Deprecated)","description":"The dictionary containing details about the user.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.configurationprofile.identification_payloadidentification_authmethod","displayName":"Auth Method","description":"The authorization method. Either the password is supplied in the profile or the user supplies it. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.configurationprofile.identification_payloadidentification_authmethod_0","displayName":"Password","description":null,"helpText":null},{"id":"com.apple.configurationprofile.identification_payloadidentification_authmethod_1","displayName":"UserEnteredPassword","description":null,"helpText":null}]},{"id":"com.apple.configurationprofile.identification_payloadidentification_emailaddress","displayName":"Email Address","description":"The address for the account.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.configurationprofile.identification_payloadidentification_fullname","displayName":"Full Name","description":"The full name of the account.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.configurationprofile.identification_payloadidentification_password","displayName":"Password","description":"The password for the account. Required when the Auth Method is of type password.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.configurationprofile.identification_payloadidentification_prompt","displayName":"Prompt","description":"The custom instructions for the user, if needed.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.configurationprofile.identification_payloadidentification_promptmessage","displayName":"Prompt Message","description":"The additional descriptive text for the user prompt.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.configurationprofile.identification_payloadidentification_username","displayName":"User Name","description":"The UNIX user name for the accounts.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.desktop_com.apple.desktop","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.desktop_override-picture-path","displayName":"Override Picture Path","description":"The path to the desktop picture. If set, this picture is always locked.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dictionary_com.apple.dictionary","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dictionary_parentalcontrol","displayName":"Parental Control","description":"If true, enables parental controls dictionary restrictions.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dictionary_parentalcontrol_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dictionary_parentalcontrol_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_adallowmultidomainauth","displayName":"AD Allow Multi Domain Auth","description":"If true, allows authentication from any domain in the namespace.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_adallowmultidomainauth_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_adallowmultidomainauth_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_adallowmultidomainauthflag","displayName":"AD Allow Multi Domain Auth Flag","description":"If true, enables the AD Allow Multi Domain Auth key.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_adallowmultidomainauthflag_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_adallowmultidomainauthflag_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_adcreatemobileaccountatlogin","displayName":"AD Create Mobile Account At Login","description":"If true, creates a mobile account at login.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_adcreatemobileaccountatlogin_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_adcreatemobileaccountatlogin_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_adcreatemobileaccountatloginflag","displayName":"AD Create Mobile Account At Login Flag","description":"If true, enables the AD Create Mobile Account At Login key.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_adcreatemobileaccountatloginflag_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_adcreatemobileaccountatloginflag_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_addefaultusershell","displayName":"AD Default User Shell","description":"The default user shell. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.directoryservice.managed_addefaultusershellflag","displayName":"AD Default User Shell Flag","description":"If true, enables the AD Default User Shell key.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_addefaultusershellflag_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_addefaultusershellflag_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_addomainadmingrouplist","displayName":"AD Domain Admin Group List","description":"The list of Active Directory groups that are granted admin access.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.directoryservice.managed_addomainadmingrouplistflag","displayName":"AD Domain Admin Group List Flag","description":"If true, enables the AD Domain Admin Group List key.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_addomainadmingrouplistflag_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_addomainadmingrouplistflag_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_adforcehomelocal","displayName":"AD Force Home Local","description":"If true, forces a local home directory.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_adforcehomelocal_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_adforcehomelocal_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_adforcehomelocalflag","displayName":"AD Force Home Local Flag","description":"If true, enables the AD Force Home Local key.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_adforcehomelocalflag_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_adforcehomelocalflag_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_admapggidattribute","displayName":"AD Map GGID Attribute","description":"The map group GID to attribute.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.directoryservice.managed_admapggidattributeflag","displayName":"AD Map GGID Attribute Flag","description":"If true, enables the AD Map GGID Attribute Flag key.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_admapggidattributeflag_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_admapggidattributeflag_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_admapgidattribute","displayName":"AD Map GID Attribute","description":"The map GID to attribute.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.directoryservice.managed_admapgidattributeflag","displayName":"AD Map GID Attribute Flag","description":"If true, enables the AD Map GID Attribute key.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_admapgidattributeflag_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_admapgidattributeflag_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_admapuidattribute","displayName":"AD Map UID Attribute","description":"The map UID to attribute.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.directoryservice.managed_admapuidattributeflag","displayName":"AD Map UID Attribute Flag","description":"If true, enables the AD Map UID Attribute key.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_admapuidattributeflag_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_admapuidattributeflag_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_admountstyle","displayName":"AD Mount Style","description":"The network home protocol to use: afp or smb.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_admountstyle_0","displayName":"afp","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_admountstyle_1","displayName":"smb","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_adnamespace","displayName":"AD Namespace","description":"The primary user account naming convention; either forest or domain.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_adnamespace_0","displayName":"forest","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_adnamespace_1","displayName":"domain","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_adnamespaceflag","displayName":"AD Namespace Flag","description":"If true, enables the AD Namespace key.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_adnamespaceflag_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_adnamespaceflag_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_adorganizationalunit","displayName":"AD Organizational Unit","description":"The organizational unit where the joining computer object is added.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.directoryservice.managed_adpacketencrypt","displayName":"AD Packet Encrypt","description":"The packet encryption policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.directoryservice.managed_adpacketencryptflag","displayName":"AD Packet Encrypt Flag","description":"If true, enables the AD Packet Encrypt key.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_adpacketencryptflag_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_adpacketencryptflag_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_adpacketsign","displayName":"AD Packet Sign","description":"The packet signing policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.directoryservice.managed_adpacketsignflag","displayName":"AD Packet Sign Flag","description":"If true, enables the AD Packet Sign key.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_adpacketsignflag_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_adpacketsignflag_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_adpreferreddcserver","displayName":"AD Preferred DC Server","description":"The preferred domain server.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.directoryservice.managed_adpreferreddcserverflag","displayName":"AD Preferred DC Server Flag","description":"If true, enables the AD Preferred DC Server key.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_adpreferreddcserverflag_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_adpreferreddcserverflag_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_adrestrictddns","displayName":"AD Restrict DDNS","description":"If true, allows authentication from any domain in the namespace. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.directoryservice.managed_adrestrictddnsflag","displayName":"AD Restrict DDNS Flag","description":"If true, enables the AD Restrict DDNS key.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_adrestrictddnsflag_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_adrestrictddnsflag_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_adtrustchangepassintervaldays","displayName":"AD Trust Change Pass Interval Days","description":"The number of days before requiring a change of the computer trust account password. 0 disables the feature.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.directoryservice.managed_adtrustchangepassintervaldaysflag","displayName":"AD Trust Change Pass Interval Days Flag","description":"If true, enables the AD Trust Change Pass Interval Days key.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_adtrustchangepassintervaldaysflag_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_adtrustchangepassintervaldaysflag_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_adusewindowsuncpath","displayName":"AD Use Windows UNC Path","description":"If true, uses the UNC path from Active Directory to derive the network home location.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_adusewindowsuncpath_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_adusewindowsuncpath_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_adusewindowsuncpathflag","displayName":"AD Use Windows UNC Path Flag","description":"If true, enables the AD Use Windows UNC Path key.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_adusewindowsuncpathflag_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_adusewindowsuncpathflag_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_adwarnuserbeforecreatingma","displayName":"AD Warn User Before Creating MA","description":"If true, enables the warning before creating the mobile account.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_adwarnuserbeforecreatingma_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_adwarnuserbeforecreatingma_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_adwarnuserbeforecreatingmaflag","displayName":"AD Warn User Before Creating MA Flag","description":"If true, enables the AD Warn User Before Creating MA key.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.directoryservice.managed_adwarnuserbeforecreatingmaflag_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.directoryservice.managed_adwarnuserbeforecreatingmaflag_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.directoryservice.managed_clientid","displayName":"Client ID","description":"The client's identifier.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.directoryservice.managed_com.apple.directoryservice.managed","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.directoryservice.managed_description","displayName":"Description","description":"The directory service description.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.directoryservice.managed_hostname","displayName":"Host Name","description":"The Active Directory domain to join.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.directoryservice.managed_password","displayName":"Password","description":"The password of the account for the domain.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.directoryservice.managed_username","displayName":"User Name","description":"The user name of the account for the domain.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.discrecording_burnsupport","displayName":"Burn Support","description":"If off, disables disc burning. If on, allows normal default operation. Setting this key to on doesn't enable disc burn support if it has already been disabled by other mechanisms or preferences. It also must be enabled with the Finder profile. If authenticate, requires authentication.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.discrecording_burnsupport_0","displayName":"off","description":null,"helpText":null},{"id":"com.apple.discrecording_burnsupport_1","displayName":"authenticate","description":null,"helpText":null},{"id":"com.apple.discrecording_burnsupport_2","displayName":"on","description":null,"helpText":null}]},{"id":"com.apple.discrecording_com.apple.discrecording","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dnssettings.managed_com.apple.dnssettings.managed","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dnssettings.managed_dnssettings","displayName":"DNS Settings","description":"A dictionary that defines a configuration for an encrypted DNS server.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dnssettings.managed_dnssettings_dnsprotocol","displayName":"DNS Protocol","description":"The encrypted transport protocol used to communicate with the DNS server.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dnssettings.managed_dnssettings_dnsprotocol_0","displayName":"HTTPS","description":null,"helpText":null},{"id":"com.apple.dnssettings.managed_dnssettings_dnsprotocol_1","displayName":"TLS","description":null,"helpText":null}]},{"id":"com.apple.dnssettings.managed_dnssettings_serveraddresses","displayName":"Server Addresses","description":"An unordered list of DNS server IP address strings. These IP addresses can be a mixture of IPv4 and IPv6 addresses.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dnssettings.managed_dnssettings_servername","displayName":"Server Name","description":"The hostname of a DNS-over-TLS server used to validate the server certificate, as defined in RFC 7858. If no ServerAddresses are provided, the hostname will be used to determine the server addresses. This key must be present only if the DNSProtocol is TLS.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dnssettings.managed_dnssettings_serverurl","displayName":"Server URL","description":"The URI template of a DNS-over-HTTPS server, as defined in RFC 8484. This URL must use the https:// scheme, and the hostname or address in the URL will be used to validate the server certificate. If no ServerAddresses are provided, the hostname or address in the URL will be used to determine the server addresses. This key must be present only if the DNSProtocol is HTTPS.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dnssettings.managed_dnssettings_supplementalmatchdomains","displayName":"Supplemental Match Domains","description":"A list of domain strings used to determine which DNS queries will use the DNS server. If this array is not provided, all domains will use the DNS server.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dnssettings.managed_ondemandrules","displayName":"On Demand Rules","description":"An array of rules defining the DNS settings. If rules are not present, the system always applies the DNS settings. These rules are identical to the OnDemandRules array in VPN payloads.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dnssettings.managed_ondemandrules_item_action","displayName":"Action","description":"The action to take if this dictionary matches the current network.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dnssettings.managed_ondemandrules_item_action_0","displayName":"Connect","description":null,"helpText":null},{"id":"com.apple.dnssettings.managed_ondemandrules_item_action_1","displayName":"Disconnect","description":null,"helpText":null},{"id":"com.apple.dnssettings.managed_ondemandrules_item_action_2","displayName":"Evaluate Connection","description":null,"helpText":null}]},{"id":"com.apple.dnssettings.managed_ondemandrules_item_actionparameters","displayName":"Action Parameters","description":"A dictionary that provides per-connection rules.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dnssettings.managed_ondemandrules_item_actionparameters_domainaction","displayName":"Domain Action (Deprecated)","description":" The DNS settings behavior for the specified domains.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dnssettings.managed_ondemandrules_item_actionparameters_domainaction_0","displayName":"Never Connect","description":null,"helpText":null},{"id":"com.apple.dnssettings.managed_ondemandrules_item_actionparameters_domainaction_1","displayName":"Connect If Needed","description":null,"helpText":null}]},{"id":"com.apple.dnssettings.managed_ondemandrules_item_actionparameters_domains","displayName":"Domains (Deprecated)","description":"The domains for which this evaluation applies.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dnssettings.managed_ondemandrules_item_actionparameters_item_domainaction","displayName":"Domain Action","description":"The DNS settings behavior for the specified domains. Allowed values:\n\n* 'NeverConnect': Don't use the DNS Settings for the specified domains.\n* 'ConnectIfNeeded': Allow using the DNS Settings for the specified domains.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dnssettings.managed_ondemandrules_item_actionparameters_item_domainaction_0","displayName":"NeverConnect","description":null,"helpText":null},{"id":"com.apple.dnssettings.managed_ondemandrules_item_actionparameters_item_domainaction_1","displayName":"ConnectIfNeeded","description":null,"helpText":null}]},{"id":"com.apple.dnssettings.managed_ondemandrules_item_actionparameters_item_domains","displayName":"Domains","description":"The domains for which this evaluation applies.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dnssettings.managed_ondemandrules_item_dnsdomainmatch","displayName":"DNS Domain Match","description":"An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device’s search domains list.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dnssettings.managed_ondemandrules_item_dnsserveraddressmatch","displayName":"DNS Server Address Match","description":"An array of IP addresses. This rule matches if any of the network’s specified DNS servers match any entry in the array.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dnssettings.managed_ondemandrules_item_interfacetypematch","displayName":"Interface Type Match","description":"An interface type. If specified, this rule matches only if the primary network interface hardware matches the specified type.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dnssettings.managed_ondemandrules_item_interfacetypematch_0","displayName":"Ethernet","description":null,"helpText":null},{"id":"com.apple.dnssettings.managed_ondemandrules_item_interfacetypematch_1","displayName":"WiFi","description":null,"helpText":null},{"id":"com.apple.dnssettings.managed_ondemandrules_item_interfacetypematch_2","displayName":"Cellular","description":null,"helpText":null}]},{"id":"com.apple.dnssettings.managed_ondemandrules_item_ssidmatch","displayName":"SSID Match","description":"An array of SSIDs to match against the current network. If the network is not a Wi-Fi network or if the SSID does not appear in this array, the match fails. Omit this key and the corresponding array to match against any SSID.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dnssettings.managed_ondemandrules_item_urlstringprobe","displayName":"URL String Probe","description":"A URL to probe. If this URL is successfully fetched (returning a 200 HTTP status code) without redirection, this rule matches.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dnssettings.managed_prohibitdisablement","displayName":"Prohibit Disablement","description":"If true, prohibits users from disabling DNS settings. This key is only available on supervised devices.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dnssettings.managed_prohibitdisablement_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.dnssettings.managed_prohibitdisablement_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.dock_allowdockfixupoverride","displayName":"Allow Dock Fixup Override","description":"If true, use the file in /Library/Preferences/com.apple.dockfixup.plist when a new user or migrated user logs in. This option has no effect for existing users. Available in macOS 10.12 and later. Only available on the device channel.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_allowdockfixupoverride_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_allowdockfixupoverride_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_autohide","displayName":"Auto Hide","description":"If true, enables \"Automatically hide and show the dock.\"","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_autohide_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_autohide_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_autohide-immutable","displayName":"Auto Hide Immutable","description":"If true, locks \"Automatically hide.\"","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_autohide-immutable_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_autohide-immutable_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_com.apple.dock","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_contents-immutable","displayName":"Contents Immutable","description":"If true, disables changes to the dock.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_contents-immutable_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_contents-immutable_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_dblclickbehavior","displayName":"Double Click Behavior","description":"The behavior when the window's title bar is double-clicked.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_dblclickbehavior_0","displayName":"Minimize","description":null,"helpText":null},{"id":"com.apple.dock_dblclickbehavior_1","displayName":"Maximize","description":null,"helpText":null},{"id":"com.apple.dock_dblclickbehavior_2","displayName":"None","description":null,"helpText":null}]},{"id":"com.apple.dock_dblclickbehavior-immutable","displayName":"Double Click Behavior Immutable","description":"If true, locks \"Double-click a window's title bar.\"","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_dblclickbehavior-immutable_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_dblclickbehavior-immutable_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_largesize","displayName":"Large Size","description":"The size of the largest magnification. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_launchanim","displayName":"Launch Animation","description":"If true, enables \"Animate opening applications.\"","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_launchanim_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_launchanim_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_launchanim-immutable","displayName":"Launch Animation Immutable","description":"If true, locks \"Animate opening applications.\"","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_launchanim-immutable_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_launchanim-immutable_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_magnification","displayName":"Magnification","description":"If true, enables magnification.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_magnification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_magnification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_magnify-immutable","displayName":"Magnify Immutable","description":"If true, locks magnification.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_magnify-immutable_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_magnify-immutable_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_magsize-immutable","displayName":"Magnification Size Immutable","description":"If true, locks the magnification slider.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_magsize-immutable_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_magsize-immutable_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_mcxdockspecialfolders","displayName":"MCX Dock Special Folders","description":"One or more special folders that may be created at user login time and placed in the dock.\n\nThe 'My Applications' item is only used for Simple Finder environments. The 'Original Network Home' item is only used for mobile account users.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_mineffect","displayName":"Minimize Effect","description":"The minimize effect.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_mineffect_0","displayName":"Genie","description":null,"helpText":null},{"id":"com.apple.dock_mineffect_1","displayName":"Scale","description":null,"helpText":null}]},{"id":"com.apple.dock_mineffect-immutable","displayName":"Minimize Effect Immutable","description":"If true, locks \"Minimize windows using.\"","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_mineffect-immutable_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_mineffect-immutable_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_minimize-to-application","displayName":"Minimize To Application","description":"If true, enables \"Minimize windows into application icon.\"","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_minimize-to-application_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_minimize-to-application_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_minintoapp-immutable","displayName":"Minimize Into Application Immutable","description":"If true, disables the \"Minimize windows into application icon\" checkbox.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_minintoapp-immutable_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_minintoapp-immutable_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_orientation","displayName":"Orientation","description":"The orientation of the dock. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_orientation_0","displayName":"Bottom","description":null,"helpText":null},{"id":"com.apple.dock_orientation_1","displayName":"Left","description":null,"helpText":null},{"id":"com.apple.dock_orientation_2","displayName":"Right","description":null,"helpText":null}]},{"id":"com.apple.dock_persistent-apps","displayName":"Persistent Apps","description":"Dock items located on the Applications side of the Dock that can be removed.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_persistent-apps_item_tile-data","displayName":"Tile Data","description":"The information about the Dock item.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_persistent-apps_item_tile-data_file-type","displayName":"File Type","description":"The type of file","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_persistent-apps_item_tile-data_file-type_0","displayName":"URL","description":null,"helpText":null},{"id":"com.apple.dock_persistent-apps_item_tile-data_file-type_1","displayName":"File","description":null,"helpText":null},{"id":"com.apple.dock_persistent-apps_item_tile-data_file-type_2","displayName":"Directory","description":null,"helpText":null}]},{"id":"com.apple.dock_persistent-apps_item_tile-data_label","displayName":"Label","description":"The label of the Dock item.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_persistent-apps_item_tile-data_url","displayName":"URL","description":"The URL string.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_persistent-apps_item_tile-type","displayName":"Tile Type","description":"The type of tile.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_persistent-apps_item_tile-type_0","displayName":"File","description":null,"helpText":null},{"id":"com.apple.dock_persistent-apps_item_tile-type_1","displayName":"Directory","description":null,"helpText":null},{"id":"com.apple.dock_persistent-apps_item_tile-type_2","displayName":"URL","description":null,"helpText":null}]},{"id":"com.apple.dock_persistent-others","displayName":"Persistent Others","description":"Dock items located on the Documents side of the Dock that can be removed.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_persistent-others_item_tile-data","displayName":"Tile Data","description":"The information about the Dock item.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_persistent-others_item_tile-data_file-type","displayName":"File Type","description":"The type of file","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_persistent-others_item_tile-data_file-type_0","displayName":"URL","description":null,"helpText":null},{"id":"com.apple.dock_persistent-others_item_tile-data_file-type_1","displayName":"File","description":null,"helpText":null},{"id":"com.apple.dock_persistent-others_item_tile-data_file-type_2","displayName":"Directory","description":null,"helpText":null}]},{"id":"com.apple.dock_persistent-others_item_tile-data_label","displayName":"Label","description":"The label of the Dock item.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_persistent-others_item_tile-data_url","displayName":"URL","description":"The URL string","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_persistent-others_item_tile-type","displayName":"Tile Type","description":"The type of tile.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_persistent-others_item_tile-type_0","displayName":"File","description":null,"helpText":null},{"id":"com.apple.dock_persistent-others_item_tile-type_1","displayName":"Directory","description":null,"helpText":null},{"id":"com.apple.dock_persistent-others_item_tile-type_2","displayName":"URL","description":null,"helpText":null}]},{"id":"com.apple.dock_position-immutable","displayName":"Position Immutable","description":"If true, locks the position.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_position-immutable_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_position-immutable_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_show-process-indicators","displayName":"Show Process Indicators","description":"If true, shows the process indicator.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_show-process-indicators_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_show-process-indicators_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_show-recents","displayName":"Show Recents","description":"If true, enables \"Show recent items.\"","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_show-recents_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_show-recents_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_showindicators-immutable","displayName":"Show Indicators Immutable","description":"If true, locks \"Show indicators.\"","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_showindicators-immutable_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_showindicators-immutable_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_showrecents-immutable","displayName":"Show Recents Immutable","description":"If true, disables \"Show recent applications\" checkbox.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_showrecents-immutable_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_showrecents-immutable_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_size-immutable","displayName":"Size Immutable","description":"If true, locks the size slider.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_size-immutable_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_size-immutable_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_static-apps","displayName":"Static Apps","description":"Dock items located on the Applications side of the Dock and cannot be removed from that location.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_static-apps_item_tile-data","displayName":"Tile Data","description":"The information about the Dock item.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_static-apps_item_tile-data_file-type","displayName":"File Type","description":"The type of file","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_static-apps_item_tile-data_file-type_0","displayName":"URL","description":null,"helpText":null},{"id":"com.apple.dock_static-apps_item_tile-data_file-type_1","displayName":"File","description":null,"helpText":null},{"id":"com.apple.dock_static-apps_item_tile-data_file-type_2","displayName":"Directory","description":null,"helpText":null}]},{"id":"com.apple.dock_static-apps_item_tile-data_label","displayName":"Label","description":"The label of the Dock item.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_static-apps_item_tile-data_url","displayName":"URL","description":"The URL string","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_static-apps_item_tile-type","displayName":"Tile Type","description":"The type of tile.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_static-apps_item_tile-type_0","displayName":"File","description":null,"helpText":null},{"id":"com.apple.dock_static-apps_item_tile-type_1","displayName":"Directory","description":null,"helpText":null},{"id":"com.apple.dock_static-apps_item_tile-type_2","displayName":"URL","description":null,"helpText":null}]},{"id":"com.apple.dock_static-only","displayName":"Static Only","description":"If true, uses the Static Apps and Static Others dictionaries for the dock and ignores any items in the Persistent Apps and Persistent Others dictionaries. If false, the contents are merged with the static items listed first.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_static-only_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_static-only_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.dock_static-others","displayName":"Static Others","description":"Dock items located on the Documents side of the Dock and cannot be removed from that location.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_static-others_item_tile-data","displayName":"Tile Data","description":"The information about the Dock item.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_static-others_item_tile-data_file-type","displayName":"File Type","description":"The type of file","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_static-others_item_tile-data_file-type_0","displayName":"URL","description":null,"helpText":null},{"id":"com.apple.dock_static-others_item_tile-data_file-type_1","displayName":"File","description":null,"helpText":null},{"id":"com.apple.dock_static-others_item_tile-data_file-type_2","displayName":"Directory","description":null,"helpText":null}]},{"id":"com.apple.dock_static-others_item_tile-data_label","displayName":"Label","description":"The label of the Dock item.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_static-others_item_tile-data_url","displayName":"URL","description":"The URL string","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_static-others_item_tile-type","displayName":"Tile Type","description":"The type of tile.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_static-others_item_tile-type_0","displayName":"File","description":null,"helpText":null},{"id":"com.apple.dock_static-others_item_tile-type_1","displayName":"Directory","description":null,"helpText":null},{"id":"com.apple.dock_static-others_item_tile-type_2","displayName":"URL","description":null,"helpText":null}]},{"id":"com.apple.dock_tilesize","displayName":"Tile Size","description":"The tile size. Values must be in the range of 16 to 128.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.dock_windowtabbing","displayName":"Window Tabbing","description":"Set the \"Prefer tabs when opening documents\" to the provided value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_windowtabbing_0","displayName":"Manual","description":null,"helpText":null},{"id":"com.apple.dock_windowtabbing_1","displayName":"Always","description":null,"helpText":null},{"id":"com.apple.dock_windowtabbing_2","displayName":"Full Screen","description":null,"helpText":null}]},{"id":"com.apple.dock_windowtabbing-immutable","displayName":"Window Tabbing Immutable","description":"If true, disables \"Prefer tabs when opening documents\" checkbox.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.dock_windowtabbing-immutable_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.dock_windowtabbing-immutable_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.domains_com.apple.domains","displayName":"Top Level Setting Group Collection","description":"com.apple.domains","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.domains_crosssitetrackingpreventionrelaxedapps","displayName":"Cross Site Tracking Prevention Relaxed Apps","description":"An array of up to 10 strings representing app bundle-ids. Apps matching the bundle-ids listed here have relaxed enforcement of cross-site tracking prevention for the domains listed in `CrossSiteTrackingPreventionRelaxedDomains`.\n\nAvailable in iOS 18 and later and macOS 15 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.domains_crosssitetrackingpreventionrelaxeddomains","displayName":"Cross Site Tracking Prevention Relaxed Domains","description":"Specify an array of up to ten domains \r\nwhen cross-site tracking is required for functionality.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.domains_emaildomains","displayName":"Email Domains","description":"An array of domains. Email addresses that lack a suffix matching any of these strings are considered out of domain and marked in Mail.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.domains_safaripasswordautofilldomains","displayName":"Safari Password Auto Fill Domains","description":"An array of domains. Users can only save passwords in Safari from URLs matching the patterns listed here. This property doesn’t disable the autofill feature itself. Supervised devices or Shared iPads need this property to enable saving passwords in Safari. Available in iOS 9.3 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.domains_webdomains","displayName":"Web Domains","description":"An array of domains. URLs matching the patterns listed here are considered managed.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_authenticationmethod","displayName":"Authentication Method (Deprecated)","description":"The Platform SSO authentication method the extension uses. Requires that the SSO Extension also supports the method.\nAvailable in macOS 13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_authenticationmethod_0","displayName":"Password","description":null,"helpText":null},{"id":"com.apple.extensiblesso_authenticationmethod_1","displayName":"UserSecureEnclaveKey","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_com.apple.extensiblesso","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_com.apple.extensiblesso-kerberos_kerberos","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_deniedbundleidentifiers","displayName":"Denied Bundle Identifiers","description":"An array of bundle identifiers of apps that don't use SSO provided by this extension.\nAvailable in iOS 15 and later and macOS 12 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata","displayName":"Extension Data","description":"A dictionary of arbitrary data passed through to the app extension.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_allowautomaticlogin_kerberos","displayName":"Allow Automatic Login","description":"If false, passwords are not allowed to be saved to the keychain.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_allowautomaticlogin_kerberos_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_allowautomaticlogin_kerberos_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_allowpassword_kerberos","displayName":"Allow Password","description":"If set to true, the user to switch the user interface to Password mode. (macOS only)","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_allowpassword_kerberos_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_allowpassword_kerberos_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_allowpasswordchange_kerberos","displayName":"Allow Password Change","description":"If false, disables password changes. Available in macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_allowpasswordchange_kerberos_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_allowpasswordchange_kerberos_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_allowplatformssoauthfallback_kerberos","displayName":"Allow Platform SSO OAuth Fallback","description":"If `true` and `usePlatformSSOTGT` is `true`, the system allows the user to manually sign in. Available in macOS 13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_allowplatformssoauthfallback_kerberos_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_allowplatformssoauthfallback_kerberos_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_allowsmartcard_kerberos","displayName":"Allow Smart Card","description":"If set to true, the user to switch the user interface to SmartCard mode. (macOS only)","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_allowsmartcard_kerberos_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_allowsmartcard_kerberos_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_credentialbundleidacl_kerberos","displayName":"Credential Bundle ID ACL","description":"A list of bundle IDs allowed to access the ticket-granting ticket (TGT).","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_credentialusemode_kerberos","displayName":"Credential Use Mode","description":"This setting affects how the Kerberos Extension credential is used by other processes.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_credentialusemode_kerberos_0","displayName":"Always","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_credentialusemode_kerberos_1","displayName":"When Not Specified","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_credentialusemode_kerberos_2","displayName":"Kerberos Default ","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_customusernamelabel_kerberos","displayName":"Custom Username Label","description":"The custom user name label used in the Kerberos extension instead of “Username”. For example, “Company ID”. Available in macOS 11 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_delayusersetup_kerberos","displayName":"Delay User Setup","description":"If true, doesn’t prompt the user to setup the Kerberos extension until either the administrator enables it with the app-sso tool or a Kerberos challenge is received. Available in macOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_delayusersetup_kerberos_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_delayusersetup_kerberos_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_domainrealmmapping_generickey_kerberos_keytobereplaced","displayName":"Realm","description":"The name of the realm.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_domainrealmmapping_generickey_kerberos_string","displayName":"Domain Realm Mapping","description":"An array of DNS Suffixes that map to the realm.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_domainrealmmapping_kerberos","displayName":"Domain Realm Mapping","description":"A custom domain-realm mapping for Kerberos. This is used when the DNS name of hosts do not match the realm name. Most administrators will not need to customize this.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_domainrealmmapping_realm_kerberos","displayName":"Realm (Deprecated)","description":"The key should be the name of the realm, and the value is an array of DNS suffixes that map to the realm.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_generickey_boolean","displayName":"Value","description":"Keys and values to pass to the app extension.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_generickey_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_generickey_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_generickey_integer","displayName":"Value","description":"Keys and values to pass to the app extension.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_generickey_keytobereplaced","displayName":"Key","description":"Additional extension-specific data to pass to the app extension.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_generickey_string","displayName":"Value","description":"Keys and values to pass to the app extension.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_helptext_kerberos","displayName":"Help Text","description":"The text to be displayed to the user at the bottom of the Kerberos login window. It can be used to display help information or disclaimer text. Available in iOS 14 and later and macOS 11 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_identityissuerautoselectfilter_kerberos","displayName":"Identity Issuer Auto Select Filter","description":"A string with wildcards that can use used to filter the list of available SmartCards by issuer. e.g \"*My CA2*\". If there is one remaining, it will be auto-selected. If there more than one remaining, then the list is shorter. (macOS only)","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_includekerberosappsinbundleidacl_kerberos","displayName":"Include Kerberos Apps In Bundle ID ACL","description":"If true, the Kerberos extension allows the standard kerberos utilities including TicketViewer and klist to access and use the credential. This is in addition to Include Managed Apps In Bundle ID ACL or the Credential Bundle ID ACL, if it is specified.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_includekerberosappsinbundleidacl_kerberos_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_includekerberosappsinbundleidacl_kerberos_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_includemanagedappsinbundleidacl_kerberos","displayName":"Include Managed Apps In Bundle ID ACL","description":"If true, the Kerberos extension allows only managed apps to access and use the credential. This is in addition to the Credential Bundle ID ACL, if it is specified. Available in iOS 14 and later, and macOS 12 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_includemanagedappsinbundleidacl_kerberos_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_includemanagedappsinbundleidacl_kerberos_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_isdefaultrealm_kerberos","displayName":"Is Default Realm","description":"This property specifies it is the default realm if there is more than one Kerberos extension configuration.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_isdefaultrealm_kerberos_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_isdefaultrealm_kerberos_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_kerberos","displayName":"Extension Data","description":"This is the dictionary used by the Apple built-in Kerberos extension.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_monitorcredentialscache_kerberos","displayName":"Monitor Credentials Cache","description":"If false, the credential is requested on the next matching Kerberos challenge or network state change. If the credential is expired or missing, a new one will be created. Available in macOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_monitorcredentialscache_kerberos_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_monitorcredentialscache_kerberos_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_performkerberosonly_kerberos","displayName":"Perform Kerberos Only","description":"If true, the Kerberos Extension handles Kerberos requests only. It doesn’t check for password expiration, show the password expiration in the menu, check for external password changes, perform password sync, or retrieve the home directory. Available in macOS 13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_performkerberosonly_kerberos_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_performkerberosonly_kerberos_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_preferredkdcs_kerberos","displayName":"Preferred KDCs","description":"The ordered list of perferred Key Distribution Centers (KDCs) to use for Kerberos traffic. Use this if the servers are not discoverable via DNS. If the servers are specified, then they are used for both connectivity checks and attempted first for Kerberos traffic. If the servers do not respond, then the device falls back to DNS discovery. Each entry is formatted the same as it would be in a krb5.conf file.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_principalname_kerberos","displayName":"Principal Name","description":"The principal (aka username) to use. You do not need to include the realm.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_pwchangeurl_kerberos","displayName":"Password Change URL","description":"This URL will launch in the user’s default web browser when they initiate a password change. Available in macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_pwnotificationdays_kerberos","displayName":"Password Notification Days","description":"The number of days prior to password expiration when a notification of password expiration will be sent to the user. Available in macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_pwreqcomplexity_kerberos","displayName":"Password Req Complexity","description":"If true, passwords must meet Active Directory's definition of \"complex\". Available in macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_pwreqcomplexity_kerberos_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_pwreqcomplexity_kerberos_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_pwreqhistory_kerberos","displayName":"Password Req History","description":"The number of prior passwords that cannot be re-used on this domain. Available in macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_pwreqlength_kerberos","displayName":"Password Req Length","description":"The minimum length of passwords on the domain. Available in macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_pwreqminage_kerberos","displayName":"Password Req Min Age","description":"The minimum age of passwords before they can be changed on this domain. Available in macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_pwreqtext_kerberos","displayName":"Password Req Text","description":"The text version of the domain's password requirements. Only for use if Password Req Complexity or Password Req Length aren’t specified. Available in macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_requiretlsforldap_kerberos","displayName":"Require TLS For LDAP","description":"Require that LDAP connections use TLS. Available in macOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_requiretlsforldap_kerberos_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_requiretlsforldap_kerberos_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_requireuserpresence_kerberos","displayName":"Require User Presence","description":"If true, requires the user to provide Touch ID, Face ID or their passcode to access the keychain entry.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_requireuserpresence_kerberos_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_requireuserpresence_kerberos_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_sitecode_kerberos","displayName":"Site Code","description":"The name of the Active Directory site the Kerberos extension should use. Most administrators will never need to modify this value, as the Kerberos extension can normally find the site automatically.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensiondata_startinsmartcardmode_kerberos","displayName":"Start In Smart Card Mode","description":"If set to true, the user interface will start in SmartCard mode. (macOS only)","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_startinsmartcardmode_kerberos_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_startinsmartcardmode_kerberos_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_synclocalpassword_kerberos","displayName":"Sync Local Password","description":"If false, disables password sync. Note that this will not work if the user is logged in with a mobile account. Available in macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_synclocalpassword_kerberos_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_synclocalpassword_kerberos_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_useplatformssotgt_kerberos","displayName":"Use Platform SSOTGT","description":"If `true`, the system requires this configuration uses a TGT from Platform SSO instead of requesting a new one. Available in macOS 13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_useplatformssotgt_kerberos_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_useplatformssotgt_kerberos_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensiondata_usesiteautodiscovery_kerberos","displayName":"Use Site Auto Discovery","description":"If false, the Kerberos extension doesn't automatically use LDAP and DNS to determine its AD site name.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_extensiondata_usesiteautodiscovery_kerberos_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.extensiblesso_extensiondata_usesiteautodiscovery_kerberos_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_extensionidentifier","displayName":"Extension Identifier","description":"The bundle identifier of the app extension that performs SSO for the specified URLs.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_extensionidentifier_kerberos","displayName":"Extension Identifier","description":"This value must be com.apple.AppSSOKerberos.KerberosExtension for this extension.","helpText":null,"infoUrls":[],"options":{"id":"com.apple.extensiblesso_extensionidentifier_kerberos_0","displayName":"com.apple.AppSSOKerberos.KerberosExtension","description":null,"helpText":null}},{"id":"com.apple.extensiblesso_hosts","displayName":"Hosts","description":"An array of host names or domain names that apps can authenticate through the app extension.\r\nRequired for Credential payloads. Ignored for Redirect payloads.\r\n\r\nHost or domain names are matched case-insensitively, and all the host/domain names of all installed Extensible SSO payloads must be unique.\r\n\r\nHosts that begin with a “.” are wildcard suffixes and match all subdomains; otherwise the host must be an exact match.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_hosts_kerberos","displayName":"Hosts","description":"One or more host or domain names for which the app extension performs SSO. Host or domain names are matched case-insensitively, and all the host/domain names of all installed Extensible SSO payloads must be unique. Hosts that begin with a “.” are wildcard suffixes and will match all subdomains, otherwise the host must be an exact match.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_ignored_$typepicker","displayName":"Type","description":"Keys and values to pass to the app extension.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_ignored_0","displayName":"String","description":"String","helpText":null},{"id":"com.apple.extensiblesso_ignored_1","displayName":"Integer","description":"Integer","helpText":null},{"id":"com.apple.extensiblesso_ignored_2","displayName":"Boolean","description":"Boolean","helpText":null}]},{"id":"com.apple.extensiblesso_ignored_kerberos_$typepicker","displayName":"IGNORED","description":null,"helpText":null,"infoUrls":[],"options":{"id":"com.apple.extensiblesso_ignored_kerberos_0","displayName":"Array","description":null,"helpText":null}},{"id":"com.apple.extensiblesso_platformsso","displayName":"Platform SSO","description":"This is the dictionary used to configure PlatformSSO.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_accountdisplayname","displayName":"Account Display Name","description":"The display name for the account in notifications and authentication requests.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_additionalgroups","displayName":"Additional Groups","description":"The list of groups that are created and do not have administrator access.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_administratorgroups","displayName":"Administrator Groups","description":"The list of groups that are used for administrator access. Membership will be requested during authentication.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_allowdeviceidentifiersinattestation","displayName":"Allow Device Identifiers In Attestation","description":"If `true`, the system includes the device UDID and serial number in Platform SSO attestations.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_platformsso_allowdeviceidentifiersinattestation_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.extensiblesso_platformsso_allowdeviceidentifiersinattestation_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_platformsso_authenticationgraceperiod","displayName":"Authentication Grace Period","description":"The amount of time after a 'FileVaultPolicy', 'LoginPolicy', or 'UnlockPolicy' is received or updated that unregistered local accounts can be used. Required when 'AllowAuthenticationGracePeriod' is set.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_authenticationmethod","displayName":"Authentication Method","description":"The Platform SSO authentication method to be used with the extension. Requires that the SSO Extension also support the method.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_platformsso_authenticationmethod_0","displayName":"Password","description":null,"helpText":null},{"id":"com.apple.extensiblesso_platformsso_authenticationmethod_1","displayName":"UserSecureEnclaveKey","description":null,"helpText":null},{"id":"com.apple.extensiblesso_platformsso_authenticationmethod_2","displayName":"SmartCard","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_platformsso_authorizationgroups","displayName":"Authorization Groups","description":"The pairing of Authorization Rights to group names. The Authorization Right will be updated to use the group when used.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_authorizationgroups_authorization right","displayName":"Authorization Right (Deprecated)","description":"The Authorization Right to update.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_authorizationgroups_generickey","displayName":"ANY","description":"The key is an access right value, the value is the group to be associated with that access right.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_authorizationgroups_generickey_keytobereplaced","displayName":"Authorization Groups","description":"The pairing of Authorization Rights to group names. When using this, the system updates the Authorization Right to use the group.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_authorizationgroups_group","displayName":"Group (Deprecated)","description":"The group to use for the Authorization Right.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_enableauthorization","displayName":"Enable Authorization","description":"Enables using identity provider accounts at authorization prompts. Requires 'UseSharedDeviceKeys' is true. The account will be assigned groups using the 'AdministratorGroups', 'AdditionalGroups', or 'AuthorizationGroups'.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_platformsso_enableauthorization_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.extensiblesso_platformsso_enableauthorization_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_platformsso_enablecreateuseratlogin","displayName":"Enable Create User At Login","description":"Enables creating new users at the login window with either Passwords or SmartCards. Requires 'UseSharedDeviceKeys' is true.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_platformsso_enablecreateuseratlogin_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.extensiblesso_platformsso_enablecreateuseratlogin_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_platformsso_filevaultpolicy","displayName":"FileVault Policy","description":"The policy to apply when using Platform SSO at FileVault unlock on Apple Silicon Macs. Applies when 'AuthenticationMethod' is `Password`.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_loginfrequency","displayName":"Login Frequency","description":"The frequency where a full login is required instead of a refresh. Default is 18 hours. Must be > 1 hour.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_loginpolicy","displayName":"Login Policy","description":"The policy to apply when using Platform SSO at the login window. Applies when 'AuthenticationMethod' is `Password`.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_newuserauthorizationmode","displayName":"New User Authorization Mode","description":"This setting affects the permissions for accounts created at login by Platform SSO. It is only used when the account is created. Use of the following:\n* Standard\n The account will be a standard user.\n* Admin\n The account will be added to the local administrators group.\n* Groups\n The account will be assigned groups using the 'AdministratorGroups', 'AdditionalGroups', or 'AuthorizationGroups'.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_platformsso_newuserauthorizationmode_0","displayName":"Standard","description":null,"helpText":null},{"id":"com.apple.extensiblesso_platformsso_newuserauthorizationmode_1","displayName":"Admin","description":null,"helpText":null},{"id":"com.apple.extensiblesso_platformsso_newuserauthorizationmode_2","displayName":"Groups","description":null,"helpText":null},{"id":"com.apple.extensiblesso_platformsso_newuserauthorizationmode_3","displayName":"Temporary","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_platformsso_nonplatformssoaccounts","displayName":"Non Platform SSO Accounts","description":"The list of local accounts that are not subject to the 'FileVaultPolicy', 'LoginPolicy', or 'UnlockPolicy'. The accounts are also not prompted to register for Platform SSO.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_offlinegraceperiod","displayName":"Offline Grace Period","description":"The amount of time after the last successful Platform SSO login a local account password can be used offline. Required when 'AllowOfflineGracePeriod' is set.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_tokentousermapping","displayName":"Token To User Mapping","description":"The attribute mapping used when creating new users or for authorization.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_tokentousermapping_accountname","displayName":"Account Name","description":"The claim name to use for the user's account name.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_tokentousermapping_fullname","displayName":"Full Name","description":"The claim name to use for the user's full name.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_unlockpolicy","displayName":"Unlock Policy","description":"The policy to apply when using Platform SSO at screensaver unlock. Applies when 'AuthenticationMethod' is `Password`.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_platformsso_userauthorizationmode","displayName":"User Authorization Mode","description":"This setting affects the permissions after authentication by Platform SSO. It is applied each time user authenticates. Use of the following:\n* Standard\n The account will be a standard user. It will be removed from the 'admin' group.\n* Admin\n The account will be added to the local administrators group.\n* Groups\n The account will be assigned groups using the 'AdministratorGroups', 'AdditionalGroups', or 'AuthorizationGroups'.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_platformsso_userauthorizationmode_0","displayName":"Standard","description":null,"helpText":null},{"id":"com.apple.extensiblesso_platformsso_userauthorizationmode_1","displayName":"Admin","description":null,"helpText":null},{"id":"com.apple.extensiblesso_platformsso_userauthorizationmode_2","displayName":"Groups","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_platformsso_useshareddevicekeys","displayName":"Use Shared Device Keys","description":"If set to true, Platform SSO will use the same signing and encryption keys for all users.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_platformsso_useshareddevicekeys_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.extensiblesso_platformsso_useshareddevicekeys_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_realm","displayName":"Realm","description":"The realm name for Credential payloads. Use proper capitalization for this value. This key is ignored for Redirect payloads.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_realm_kerberos","displayName":"Realm","description":"The Kerberos realm, which should be properly capitalized. If in an Active Directory forest, this is the realm where the user logs in.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_registrationtoken","displayName":"Registration Token","description":"The token this device uses for registration with Platform SSO. Use it for silent registration with the Identity Provider. Requires that 'AuthenticationMethod' isn't empty.\nAvailable in macOS 13 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_screenlockedbehavior","displayName":"Screen Locked Behavior","description":"When set to Do Not Handle, the request continues without SSO. Available in iOS 15 and later and macOS 12 and later.","helpText":null,"infoUrls":[],"options":{"id":"com.apple.extensiblesso_screenlockedbehavior_0","displayName":"Do Not Handle","description":null,"helpText":null}},{"id":"com.apple.extensiblesso_teamidentifier","displayName":"Team Identifier","description":"The team identifier of the app extension. This key is required on macOS and ignored elsewhere.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.extensiblesso_teamidentifier_kerberos","displayName":"Team Identifier","description":"This value must be apple for the Kerberos extension.","helpText":null,"infoUrls":[],"options":{"id":"com.apple.extensiblesso_teamidentifier_kerberos_0","displayName":"apple","description":null,"helpText":null}},{"id":"com.apple.extensiblesso_type","displayName":"Type","description":"The type of SSO.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.extensiblesso_type_0","displayName":"Credential","description":null,"helpText":null},{"id":"com.apple.extensiblesso_type_1","displayName":"Redirect","description":null,"helpText":null}]},{"id":"com.apple.extensiblesso_type_kerberos","displayName":"Type","description":"This value must be Credential for the Kerberos extension.","helpText":null,"infoUrls":[],"options":{"id":"com.apple.extensiblesso_type_kerberos_0","displayName":"Credential","description":null,"helpText":null}},{"id":"com.apple.extensiblesso_urls","displayName":"URLs","description":"An array of URL prefixes of identity providers where the app extension performs SSO. Required for Redirect payloads. Ignored for Credential payloads. The URLs must begin with http:// or https://, the scheme and host name are matched case-insensitively, query parameters and URL fragments are not allowed, and the URLs of all installed Extensible SSO payloads must be unique.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.contentfilter_com.apple.familycontrols.contentfilter","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.contentfilter_filterblacklist","displayName":"Filter Blocklist (Deprecated)","description":"The array of URLs that defines a deny list. When Restrict Web and Use Content Filter are enabled, no URLs in the deny list are available to the user.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.contentfilter_filterdenylist","displayName":"Filter Deny List","description":"The array of URLs that defines a deny list. When `restrictWeb` and `useContentFilter` are enabled, no URLs in the deny list are available to the user.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.contentfilter_filterwhitelist","displayName":"Filter Allowlist","description":"The array of URLs that defines an allow list. When Restrict Web and Use Content Filter are enabled, only URLs in the allow list are available to the user.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.contentfilter_restrictweb","displayName":"Restrict Web","description":"If true, enables web content filters.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.familycontrols.contentfilter_restrictweb_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.familycontrols.contentfilter_restrictweb_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.familycontrols.contentfilter_sitewhitelist","displayName":"Site Allowlist","description":"An array of sites that defines an allow list. If specified, this defines additional allowed sites besides those in the automated allow list and deny list, including disallowed adult sites. This key is required if Allow List Enabled is true.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.contentfilter_sitewhitelist_item_address","displayName":"Address","description":"The site prefix, including http(s) scheme.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.contentfilter_sitewhitelist_item_pagetitle","displayName":"Page Title","description":"The site page title.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.contentfilter_usecontentfilter","displayName":"Use Content Filter","description":"If true, filters content automatically. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.familycontrols.contentfilter_usecontentfilter_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.familycontrols.contentfilter_usecontentfilter_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.familycontrols.contentfilter_whitelistenabled","displayName":"Allowlist Enabled","description":"If true, enables web content filters.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.familycontrols.contentfilter_whitelistenabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.familycontrols.contentfilter_whitelistenabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.familycontrols.timelimits.v2_com.apple.familycontrols.timelimits.v2","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.timelimits.v2_familycontrolsenabled","displayName":"Family Controls Enabled","description":"If true, enables time limits. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.familycontrols.timelimits.v2_familycontrolsenabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.familycontrols.timelimits.v2_familycontrolsenabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.familycontrols.timelimits.v2_time-limits","displayName":"Time Limits","description":"The time limits to enforce if Family Controls Enabled is enabled. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-allowance","displayName":"Weekday Allowance","description":"The weekday allowance settings.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-allowance_enabled","displayName":"Enabled","description":"If true, enable these settings. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-allowance_enabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-allowance_enabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-allowance_end","displayName":"End","description":"The curfew end time, in the format %d:%d:%d.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-allowance_rangetype","displayName":"Range Type","description":"The type of day range.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-allowance_rangetype_0","displayName":"Weekday","description":null,"helpText":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-allowance_rangetype_1","displayName":"Weekend","description":null,"helpText":null}]},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-allowance_secondsperday","displayName":"Seconds Per Day","description":"The allowance for that day, in seconds. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-allowance_start","displayName":"Start","description":"The curfew start time, in the format %d:%d:%d.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-curfew","displayName":"Weekday Curfew","description":"The weekday curfew settings.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-curfew_enabled","displayName":"Enabled","description":"If true, enable these settings. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-curfew_enabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-curfew_enabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-curfew_end","displayName":"End","description":"The curfew end time, in the format %d:%d:%d.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-curfew_rangetype","displayName":"Range Type","description":"The type of day range.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-curfew_rangetype_0","displayName":"Weekday","description":null,"helpText":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-curfew_rangetype_1","displayName":"Weekend","description":null,"helpText":null}]},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-curfew_secondsperday","displayName":"Seconds Per Day","description":"The allowance for that day, in seconds. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekday-curfew_start","displayName":"Start","description":"The curfew start time, in the format %d:%d:%d.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-allowance","displayName":"Weekend Allowance","description":"The weekend allowance settings.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-allowance_enabled","displayName":"Enabled","description":"If true, enable these settings. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-allowance_enabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-allowance_enabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-allowance_end","displayName":"End","description":"The curfew end time, in the format %d:%d:%d.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-allowance_rangetype","displayName":"Range Type","description":"The type of day range.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-allowance_rangetype_0","displayName":"Weekday","description":null,"helpText":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-allowance_rangetype_1","displayName":"Weekend","description":null,"helpText":null}]},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-allowance_secondsperday","displayName":"Seconds Per Day","description":"The allowance for that day, in seconds. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-allowance_start","displayName":"Start","description":"The curfew start time, in the format %d:%d:%d.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-curfew","displayName":"Weekend Curfew","description":"The weekend curfew settings.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-curfew_enabled","displayName":"Enabled","description":"If true, enable these settings. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-curfew_enabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-curfew_enabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-curfew_end","displayName":"End","description":"The curfew end time, in the format %d:%d:%d.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-curfew_rangetype","displayName":"Range Type","description":"The type of day range.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-curfew_rangetype_0","displayName":"Weekday","description":null,"helpText":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-curfew_rangetype_1","displayName":"Weekend","description":null,"helpText":null}]},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-curfew_secondsperday","displayName":"Seconds Per Day","description":"The allowance for that day, in seconds. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.familycontrols.timelimits.v2_time-limits_weekend-curfew_start","displayName":"Start","description":"The curfew start time, in the format %d:%d:%d.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.fileproviderd_allowmanagedfileproviderstorequestattribution","displayName":"Allow Managed File Providers To Request Attribution","description":"If true, enables file providers access to the path of the requesting process.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.fileproviderd_allowmanagedfileproviderstorequestattribution_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.fileproviderd_allowmanagedfileproviderstorequestattribution_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.fileproviderd_com.apple.fileproviderd","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.fileproviderd_managementallowsexternalvolumesyncing","displayName":"Management Allows External Volume Syncing","description":"If `false`, the device only allows File Provider extension volume synchronization for the system \"home\" volume and any data separated volume, and prevents synchronization with any other volumes. If `true``, the device allows File Provider extension volume synchronization for the system \"home\" volume, any data separated volume, and any encrypted APFS volumes (on either internal or external media).","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.fileproviderd_managementallowsexternalvolumesyncing_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.fileproviderd_managementallowsexternalvolumesyncing_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.fileproviderd_managementallowsknownfoldersyncing","displayName":"Management Allows Known Folder Syncing","description":"If `false`, the device prevents the File Provider extension from using desktop and documents synchronization in any app. This does not impact the ability for apps to utilize the File Provider extension for file and folder syncing with remote storage.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.fileproviderd_managementallowsknownfoldersyncing_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.fileproviderd_managementallowsknownfoldersyncing_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.fileproviderd_managementallowsremotesyncing","displayName":"Management Allows Remote Syncing","description":"If `false`, the device prevents the File Provider extension from using synchronization in any app. Also, none of the other options will be evaluated. Synchronization will be totally disabled for any application.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.fileproviderd_managementallowsremotesyncing_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.fileproviderd_managementallowsremotesyncing_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.fileproviderd_managementdomainautoenablementlist","displayName":"Management Domain Auto Enablement List","description":"An array of strings representing the composed identifiers of apps. The device automatically enables the File Provider domains for the corresponding apps. The device doesn't enable existing domains if enrollment happens after they are created. The device doesn't prevent the user from disabling these File Provider domains. Users need to manually enable File Provider domains in the Finder if their corresponding apps aren't listed here. The format of the app identifiers is \"Bundle-ID (Team-ID)\", for example `com.example.app (ABCD1234)`.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.fileproviderd_managementexternalvolumesyncingallowlist","displayName":"Management External Volume Syncing Allow List","description":"An array of strings representing the composed identifiers of apps. The device allows the corresponding apps to use File Provider extension volume synchronization. If present, and `ManagementAllowsExternalVolumeSyncing` is set to `true`, the device allows only the apps in this list to use volume synchronization. This key is ignored if `ManagementAllowsExternalVolumeSyncing` is set to `false`. The format of the app identifiers is \"Bundle-ID (Team-ID)\", for example `com.example.app (ABCD1234)`.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.fileproviderd_managementknownfoldersyncingallowlist","displayName":"Management Known Folder Syncing Allow List","description":"An array of strings representing the composed identifiers of apps. The device allows the corresponding apps to use File Provider extension desktop and documents synchronization. If present, and `ManagementAllowsKnownFolderSyncing` is set to `true`, the device allows only the apps in this list to use desktop and documents synchronization. This key is ignored if `ManagementAllowsKnownFolderSyncing` is set to `false`. This setting does not impact the ability for apps to use File Provider extension volume access. The format of the app identifiers is \"Bundle-ID (Team-ID)\", for example `com.example.app (ABCD1234)`.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.fileproviderd_managementremotesyncingallowlist","displayName":"Management Remote Syncing Allow List","description":"An array of strings representing the composed identifiers of apps. The device allows the corresponding apps to use File Provider extension synchronization. If present, and `ManagementAllowsRemoteSyncing` is set to `true`, the device allows only the apps in this list to use synchronization. This key is ignored if `ManagementAllowsRemoteSyncing` is set to `false`. If present, the other options will only be evaluated for the apps in this list. The format of the app identifiers is \"Bundle-ID (Team-ID)\", for example `com.example.app (ABCD1234)`.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.finder_com.apple.finder","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.finder_prohibitburn","displayName":"Prohibit Burn","description":"If true, disables the Finder's burn support.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.finder_prohibitburn_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.finder_prohibitburn_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.finder_prohibitconnectto","displayName":"Prohibit Connect To","description":"If true, prohibits users from using a dialog that lets them view, select, or manually connect to servers on the local network or on the internet.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.finder_prohibitconnectto_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.finder_prohibitconnectto_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.finder_prohibiteject","displayName":"Prohibit Eject","description":"If true, users are prevented from ejecting any mounted volumes or media attached to the Mac.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.finder_prohibiteject_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.finder_prohibiteject_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.finder_prohibitgotofolder","displayName":"Prohibit Go To Folder","description":"If true, users are prevented from opening a folder or file by typing the path to that item. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.finder_prohibitgotofolder_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.finder_prohibitgotofolder_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.finder_showexternalharddrivesondesktop","displayName":"Show External Hard Drives On Desktop","description":"If false, mounted servers can not appear on the desktop.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.finder_showexternalharddrivesondesktop_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.finder_showexternalharddrivesondesktop_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.finder_showharddrivesondesktop","displayName":"Show Hard Drives On Desktop","description":"If true, hard drives can appear on the desktop.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.finder_showharddrivesondesktop_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.finder_showharddrivesondesktop_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.finder_showmountedserversondesktop","displayName":"Show Mounted Servers On Desktop","description":"If true, mounted servers can appear on the desktop.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.finder_showmountedserversondesktop_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.finder_showmountedserversondesktop_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.finder_showremovablemediaondesktop","displayName":"Show Removable Media On Desktop","description":"If false, removable media can not appear on the desktop.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.finder_showremovablemediaondesktop_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.finder_showremovablemediaondesktop_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.finder_warnonemptytrash","displayName":"Warn On Empty Trash","description":"If false, the warning before a user empties the Trash can be disabled.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.finder_warnonemptytrash_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.finder_warnonemptytrash_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.font_com.apple.font","displayName":"com.apple.font","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.font_font","displayName":"Font","description":"The contents of the font file.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.font_name","displayName":"Name","description":"The user-visible name for the font. This field is replaced by the actual name of the font after installation. Each payload must contain exactly one font file in trueType (.ttf) or OpenType (.otf) format. Collection formats (.ttc or .otc) are not supported.\n\nFonts are identified by their embedded PostScript names. Two fonts with the same PostScript name are considered to be the same font even if their contents differ. Installing two different fonts with the same PostScript name isn't supported, and the resulting behavior is undefined.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.gamed_com.apple.gamed","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.gamed_gkfeatureaccountmodificationallowed","displayName":"GK Feature Account Modification Allowed","description":"If true, allows account modifications.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.gamed_gkfeatureaccountmodificationallowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.gamed_gkfeatureaccountmodificationallowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.ldap.account_com.apple.ldap.account","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.ldap.account_ldapaccountdescription","displayName":"LDAP Account Description","description":"The description of the account.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.ldap.account_ldapaccounthostname","displayName":"LDAP Account Host Name","description":"The server’s address.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.ldap.account_ldapaccountpassword","displayName":"LDAP Account Password","description":"The user’s password. The password is enabled only with encrypted profiles.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.ldap.account_ldapaccountusername","displayName":"LDAP Account User Name","description":"The user name.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.ldap.account_ldapaccountusessl","displayName":"LDAP Account Use SSL","description":"If true, enables SSL.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.ldap.account_ldapaccountusessl_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.ldap.account_ldapaccountusessl_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.ldap.account_ldapsearchsettings","displayName":"LDAP Search Settings","description":"An array of search settings dictionaries.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.ldap.account_ldapsearchsettings_item_ldapsearchsettingdescription","displayName":"LDAP Search Setting Description","description":"The description of this search setting.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.ldap.account_ldapsearchsettings_item_ldapsearchsettingscope","displayName":"LDAP Search Setting Scope","description":"The type of recursion to use in the search. It is one of the following values:\r\n\r\nBase: Only the immediate node that the search base points to.\r\n\r\nOne Level: The node plus its immediate children.\r\n\r\nSubtree: The node plus all children, regardless of depth.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.ldap.account_ldapsearchsettings_item_ldapsearchsettingscope_0","displayName":"Base","description":null,"helpText":null},{"id":"com.apple.ldap.account_ldapsearchsettings_item_ldapsearchsettingscope_1","displayName":"OneLevel","description":null,"helpText":null},{"id":"com.apple.ldap.account_ldapsearchsettings_item_ldapsearchsettingscope_2","displayName":"Subtree","description":null,"helpText":null}]},{"id":"com.apple.ldap.account_ldapsearchsettings_item_ldapsearchsettingsearchbase","displayName":"LDAP Search Setting Search Base","description":"The path to the node where a search should start. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.loginitems.managed_autolaunchedapplicationdictionary-managed","displayName":"Auto Launch Items","description":"Auto Launch Login Items","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.loginitems.managed_autolaunchedapplicationdictionary-managed_item_hide","displayName":"Hide","description":"If true, hide this item in the Users & Groups login items list.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.loginitems.managed_autolaunchedapplicationdictionary-managed_item_hide_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.loginitems.managed_autolaunchedapplicationdictionary-managed_item_hide_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.loginitems.managed_autolaunchedapplicationdictionary-managed_item_path","displayName":"Path","description":"The URL or path string to the item's location.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.loginitems.managed_com.apple.loginitems.managed","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.loginwindow_adminhostinfo","displayName":"Admin Host Info","description":"If this key is included in the payload, its value is displayed in the login window as additional computer information. Before macOS 10.10, this string could contain only certain information (host name, system version, or IP address). After macOS 10.10, setting this key to any value allows the user to click the time area of the menu bar to toggle through various computer information values.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.loginwindow_allowlist","displayName":"Allow List","description":"The list of user GUIDs or group GUIDs of users that are allowed to log in. An asterisk '*' string specifies all users or groups.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.loginwindow_autologinpassword","displayName":"Autologin Password","description":"Optional user password when setting up auto login. If this key does not exist, and a user name was specified, auto login will be set up the next time the specified user logs in to the client.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.loginwindow_autologinusername","displayName":"Autologin Username","description":"Sets up auto login with the specified short user name.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.loginwindow_com.apple.loginwindow","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.loginwindow_denylist","displayName":"Deny List","description":"The list of user GUIDs or group GUIDs of users that cannot log in. This list takes priority over the list in the Allow List key.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.loginwindow_disableconsoleaccess","displayName":"Disable Console Access","description":"If true, disregards the >console special user name, which will provide a command line UI.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.loginwindow_disableconsoleaccess_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.loginwindow_disableconsoleaccess_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.loginwindow_disablescreenlockimmediate","displayName":"Disable Screen Lock Immediate","description":"If true, disables the immediate Screen Lock functions. Available in macOS 10.13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.loginwindow_disablescreenlockimmediate_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.loginwindow_disablescreenlockimmediate_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.loginwindow_hideadminusers","displayName":"Hide Admin Users","description":"If true, hides administrator users when showing a user list.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.loginwindow_hideadminusers_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.loginwindow_hideadminusers_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.loginwindow_hidelocalusers","displayName":"Hide Local Users","description":"If true, shows only network and system users when showing a user list.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.loginwindow_hidelocalusers_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.loginwindow_hidelocalusers_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.loginwindow_includenetworkuser","displayName":"Include Network User","description":"If true, shows network users when showing a user list.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.loginwindow_includenetworkuser_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.loginwindow_includenetworkuser_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.loginwindow_loginwindowtext","displayName":"Login Window Text","description":"The text to display in the Login Window.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.loginwindow_logoutdisabledwhileloggedin","displayName":"Log Out Disabled While Logged In","description":"If true, disables the Log Out menu item when the user is logged in. Available in macOS 10.13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.loginwindow_logoutdisabledwhileloggedin_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.loginwindow_logoutdisabledwhileloggedin_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.loginwindow_poweroffdisabledwhileloggedin","displayName":"Power Off Disabled While Logged In","description":"If true, disables the Power Off menu item when the user is logged in.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.loginwindow_poweroffdisabledwhileloggedin_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.loginwindow_poweroffdisabledwhileloggedin_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.loginwindow_restartdisabled","displayName":"Restart Disabled","description":"If true, disables the Restart item.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.loginwindow_restartdisabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.loginwindow_restartdisabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.loginwindow_restartdisabledwhileloggedin","displayName":"Restart Disabled While Logged In","description":"If true, disables the Restart menu item when the user is logged in.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.loginwindow_restartdisabledwhileloggedin_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.loginwindow_restartdisabledwhileloggedin_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.loginwindow_showfullname","displayName":"Show Full Name","description":"If true, shows the name and password dialog; if false, displays a list of users. Enabling this setting overrides the behavior of \"Show other users managed\". It's recommended to only use either \"Show full name\" or \"Show other users managed\", but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.loginwindow_showfullname_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.loginwindow_showfullname_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.loginwindow_showinputmenu","displayName":"Show Input Menu","description":"If `true`, the system shows the Input Menu in the Login Window.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.loginwindow_showinputmenu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.loginwindow_showinputmenu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.loginwindow_showotherusers_managed","displayName":"Show Other Users Managed","description":"If true, displays Other... when showing a list of users.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.loginwindow_showotherusers_managed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.loginwindow_showotherusers_managed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.loginwindow_shutdowndisabled","displayName":"Shut Down Disabled","description":"If true, disables the Shut Down button.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.loginwindow_shutdowndisabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.loginwindow_shutdowndisabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.loginwindow_shutdowndisabledwhileloggedin","displayName":"Shut Down Disabled While Logged In","description":"If true, disables the Shut Down menu item when the user is logged in.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.loginwindow_shutdowndisabledwhileloggedin_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.loginwindow_shutdowndisabledwhileloggedin_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.loginwindow_sleepdisabled","displayName":"Sleep Disabled","description":"If true, disables the Sleep button.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.loginwindow_sleepdisabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.loginwindow_sleepdisabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_aadwebsitessousingthisprofileenabled","displayName":"Single sign-on for work or school sites using this profile enabled","description":"'Allow single sign-on for work or school sites using this profile' option allows non-AAD profiles to be able to use single sign-on for work or school sites using work or school credentials present on the machine. This option shows up for end-users as a toggle in Settings -> Profiles -> Profile Preferences for non-AAD profiles only.\n\nIf you enable or disable this policy, 'Intelligent enablement of Single sign-on (SSO) for all Windows Azure Active Directory (Azure AD) accounts for users with a single non-Azure AD Microsoft Edge profile' will be turned off.\n\nIf you don't configure this policy, users can control whether to use SSO using other credentials present on the machine in edge://settings/profiles/multiProfileSettings.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#aadwebsitessousingthisprofileenabled"],"options":[{"id":"com.apple.managedclient.preferences_aadwebsitessousingthisprofileenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_aadwebsitessousingthisprofileenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_accesscontrolallowmethodsincorspreflightspecconformant","displayName":"Make Access-Control-Allow-Methods matching in CORS preflight spec conformant","description":"This policy controls whether request methods are uppercased when matching with Access-Control-Allow-Methods response headers in CORS preflight.\n\nIf you disable this policy, request methods are uppercased. This is the behavior on or before Microsoft Edge 108.\n\nIf you enable or don't configure this policy, request methods are not uppercased, unless matching case-insensitively with DELETE, GET, HEAD, OPTIONS, POST, or PUT.\n\nThis would reject fetch(url, {method: 'Foo'}) + \"Access-Control-Allow-Methods: FOO\" response header,\nand would accept fetch(url, {method: 'Foo'}) + \"Access-Control-Allow-Methods: Foo\" response header.\n\nNote: request methods \"post\" and \"put\" are not affected, while \"patch\" is affected.\n\nThis policy is intended to be temporary and will be removed in the future.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#accesscontrolallowmethodsincorspreflightspecconformant"],"options":[{"id":"com.apple.managedclient.preferences_accesscontrolallowmethodsincorspreflightspecconformant_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_accesscontrolallowmethodsincorspreflightspecconformant_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_accessibilityimagelabelsenabled","displayName":"Let screen reader users get image descriptions from Microsoft","description":"Lets screen reader users get descriptions of unlabeled images on the web.\n\nIf you enable or don't configure this policy, users have the option of using an anonymous Microsoft service. This service provides automatic descriptions for unlabeled images users encounter on the web when they're using a screen reader.\n\nIf you disable this policy, users can't enable the Get Image Descriptions from Microsoft feature.\n\nWhen this feature is enabled, the content of images that need a generated description is sent to Microsoft servers to generate a description.\n\nNo cookies or other user data is sent to Microsoft, and Microsoft doesn't save or log any image content.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#accessibilityimagelabelsenabled"],"options":[{"id":"com.apple.managedclient.preferences_accessibilityimagelabelsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_accessibilityimagelabelsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_acknowledgeddatacollectionpolicy","displayName":"Automatically acknowledge data collection policy","description":"Suppress the Required Data Collection policy dialog from being shown to users.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/deployoffice/privacy/mac-privacy-preferences#preference-setting-for-the-required-data-notice-dialog-for-microsoft-autoupdate"],"options":[{"id":"com.apple.managedclient.preferences_acknowledgeddatacollectionpolicy_0","displayName":"Acknowledge - send required data","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_acknowledgeddatacollectionpolicy_1","displayName":"Acknowledge - send required and optional data (Deprecated)","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_additionalsearchboxenabled","displayName":"Enable additional search box in browser","description":"A search box is an additional text input field located next to the address bar in a web browser. It allows users to perform web searches directly from the browser interface.\n\nIf you enable or don't configure this policy, the search box will be visible and available for use.\nUsers can toggle the search box in Edge Settings page edge://settings/appearance#SearchBoxInToolbar.\n\nIf you disable this policy, search box will not be visible, and users will have to use the address bar or navigate to a search engine to perform web searches.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#additionalsearchboxenabled"],"options":[{"id":"com.apple.managedclient.preferences_additionalsearchboxenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_additionalsearchboxenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_addressbarmicrosoftsearchinbingproviderenabled","displayName":"Enable Microsoft Search in Bing suggestions in the address bar (Deprecated)","description":"Enables the display of relevant Microsoft Search in Bing suggestions in the address bar's suggestion list when the user types a search string in the address bar. If you enable or don't configure this policy, users can see internal results powered by Microsoft Search in Bing in the Microsoft Edge address bar suggestion list. To see the Microsoft Search in Bing results, the user must be signed into Microsoft Edge with their Azure AD account for that organization.\nIf you disable this policy, users can't see internal results in the Microsoft Edge address bar suggestion list.\nIf you have enabled the set of policies which forces a default search provider (\"DefaultSearchProviderEnabled\", \"DefaultSearchProviderName\" and \"DefaultSearchProviderSearchURL\"), and the search provider specified is not Bing, then this policy is not applicable and there will be no Microsoft Search in Bing suggestions in the address bar's suggestion list.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#addressbarmicrosoftsearchinbingproviderenabled"],"options":[{"id":"com.apple.managedclient.preferences_addressbarmicrosoftsearchinbingproviderenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_addressbarmicrosoftsearchinbingproviderenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_adssettingforintrusiveadssites","displayName":"Ads setting for sites with intrusive ads","description":"Controls whether ads are blocked on sites with intrusive ads. You can set this policy to one of the following options:\n\n* 1 = Allow ads on all sites.\n\n* 2 = Block ads on sites with intrusive ads (Default value).","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#adssettingforintrusiveadssites"],"options":[{"id":"com.apple.managedclient.preferences_adssettingforintrusiveadssites_0","displayName":"Allow ads on all sites","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_adssettingforintrusiveadssites_1","displayName":"Block ads on sites with intrusive ads. (Default value)","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_adstransparencyenabled","displayName":"Configure if the ads transparency feature is enabled","description":"Lets you decide whether the ads transparency feature is enabled. This behavior only applies to the \"balanced\" mode of tracking prevention, and does not impact \"basic\" or \"strict\" modes. Your users' tracking prevention level can be configured using the \"TrackingPrevention\" policy. AdsTransparencyEnabled will only have an effect if \"TrackingPrevention\" is set to TrackingPreventionBalanced or is not configured.\n\nIf you enable or don't configure this policy, transparency metadata provided by ads will be available to the user when the feature is active.\n\nWhen the feature is enabled, Tracking Prevention will enable exceptions for the associated ad providers that have met Microsoft's privacy standards.\n\nIf you disable this policy, Tracking Prevention will not adjust its behavior even when transparency metadata is provided by ads.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#adstransparencyenabled"],"options":[{"id":"com.apple.managedclient.preferences_adstransparencyenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_adstransparencyenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_aigenthemesenabled","displayName":"Enables DALL-E themes generation","description":"This policy lets you generate browser themes using DALL-E and apply them to Microsoft Edge.\n\nIf you enable or don't configure this policy, the AI generated themes will be enabled.\n\nIf you disable this policy, the AI generated themes will be disabled for your organization.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#aigenthemesenabled"],"options":[{"id":"com.apple.managedclient.preferences_aigenthemesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_aigenthemesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_allhttpauthschemesallowedfororigins","displayName":"List of origins that allow all HTTP authentication","description":"Set this policy to specify which origins allow all the HTTP authentication schemes Microsoft Edge supports regardless of the \"AuthSchemes\" policy.\n\nFormat the origin pattern according to this format (https://support.google.com/chrome/a?p=url_blocklist_filter_format). Up to 1,000 exceptions can be defined in \"AllHttpAuthSchemesAllowedForOrigins\".\nWildcards are allowed for the whole origin or parts of the origin. Parts include the scheme, host, or port.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#allhttpauthschemesallowedfororigins"],"options":null},{"id":"com.apple.managedclient.preferences_allowbackforwardcacheforcachecontrolnostorepageenabled","displayName":"Allow pages with Cache-Control: no-store header to enter back/forward cache","description":"This policy controls if a page with Cache-Control: no-store header can be stored in back/forward cache. The website setting this header may not expect the page to be restored from back/forward cache since some sensitive information could still be displayed after the restoration even if it is no longer accessible.\n\nIf you enable or don't configure this policy, the page with Cache-Control: no-store header might be restored from back/forward cache unless the cache eviction is triggered (e.g. when there is HTTP-only cookie change to the site).\n\nIf you disable this policy, the page with Cache-Control: no-store header will not be stored in back/forward cache.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#allowbackforwardcacheforcachecontrolnostorepageenabled"],"options":[{"id":"com.apple.managedclient.preferences_allowbackforwardcacheforcachecontrolnostorepageenabled_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_allowbackforwardcacheforcachecontrolnostorepageenabled_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_allowcertswithoutmatchingemailaddress","displayName":"Allow S/MIME certificates without a matching email address","description":"Allow users to decrypt and encrypt S/MIME messages when the S/MIME certificate does not match the email address.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#allow-smime-certificates-without-a-matching-email-address"],"options":[{"id":"com.apple.managedclient.preferences_allowcertswithoutmatchingemailaddress_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_allowcertswithoutmatchingemailaddress_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_allowcrossoriginauthprompt","displayName":"Allow cross-origin HTTP Basic Auth prompts","description":"Controls whether third-party sub-content on a page can open an HTTP Basic Auth dialog box.\n\nTypically, this is disabled as a phishing defense. If you don't configure this policy, it's disabled and third-party sub-content can't open a HTTP Basic Auth dialog box.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#allowcrossoriginauthprompt"],"options":[{"id":"com.apple.managedclient.preferences_allowcrossoriginauthprompt_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_allowcrossoriginauthprompt_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_allowdeletingbrowserhistory","displayName":"Enable deleting browser and download history","description":"Enables deleting browser history and download history and prevents users from changing this setting.\n\nNote that even with this policy is disabled, the browsing and download history aren't guaranteed to be retained: users can edit or delete the history database files directly, and the browser itself may remove (based on expiration period) or archive any or all history items at any time.\n\nIf you enable this policy or don't configure it, users can delete the browsing and download history.\n\nIf you disable this policy, users can't delete browsing and download history.\n\nIf you enable this policy, don't enable the \"ClearBrowsingDataOnExit\" policy, because they both deal with deleting data. If you enable both, the \"ClearBrowsingDataOnExit\" policy takes precedence and deletes all data when Microsoft Edge closes, regardless of how this policy is configured.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#allowdeletingbrowserhistory"],"options":[{"id":"com.apple.managedclient.preferences_allowdeletingbrowserhistory_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_allowdeletingbrowserhistory_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_alloweddomainsforapps","displayName":"Define domains allowed to access Google Workspace","description":"Setting the policy on Microsoft Edge turns on the restricted sign-in feature in Google Workspace and prevents users from changing this setting. Users can only access Google tools using accounts from the specified domains. To allow gmail or googlemail accounts, add consumer_accounts to the list of domains. This policy is based on the Chrome policy of the same name.\n\nIf you don't provide a domain name or leave this policy unset, users can access Google Workspace with any account.\n\nUsers cannot change or override this setting.\n\nNote: This policy causes the X-GoogApps-Allowed-Domains header to be appended to all HTTP and HTTPS requests to all google.com domains, as described in https://go.microsoft.com/fwlink/?linkid=2197973.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#alloweddomainsforapps"],"options":null},{"id":"com.apple.managedclient.preferences_allowedemaildomains","displayName":"Allowed Email Domains","description":"Specify a list of email domains that are allowed to be added to the Outlook profile (e.g. contoso.com). Subdomains will be automatically included (e.g. specifying contoso.com will also allow foo.contoso.com).","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#allow-only-corporate-mailboxes-to-be-added"],"options":null},{"id":"com.apple.managedclient.preferences_allowedthreats","displayName":"Allowed threats","description":"List of threats (identified by their name) that are not blocked by the product and are instead allowed to run.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#allowed-threats"],"options":null},{"id":"com.apple.managedclient.preferences_allowfileselectiondialogs","displayName":"Allow file selection dialogs","description":"Allow access to local files by letting Microsoft Edge display file selection dialogs.\n\nIf you enable or don't configure this policy, users can open file selection dialogs as normal.\n\nIf you disable this policy, whenever the user performs an action that triggers a file selection dialog (like importing favorites, uploading files, or saving links), a message is displayed instead, and the user is assumed to have clicked Cancel on the file selection dialog.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#allowfileselectiondialogs"],"options":[{"id":"com.apple.managedclient.preferences_allowfileselectiondialogs_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_allowfileselectiondialogs_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_allowpopupsduringpageunload","displayName":"Allows a page to show popups during its unloading","description":"This policy allows an admin to specify that a page can show popups during its unloading.\n\nWhen the policy is set to enabled, pages are allowed to show popups while they're being unloaded.\n\nWhen the policy is set to disabled or unset, pages aren't allowed to show popups while they're being unloaded. This is as per the spec: (https://html.spec.whatwg.org/#apis-for-creating-and-navigating-browsing-contexts-by-name).\n\nThis policy will be removed in the future.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#allowpopupsduringpageunload"],"options":[{"id":"com.apple.managedclient.preferences_allowpopupsduringpageunload_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_allowpopupsduringpageunload_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_allowsurfgame","displayName":"Allow surf game","description":"If you disable this policy, users won't be able to play the surf game when the device is offline or if the user navigates to edge://surf.\n\nIf you enable or don't configure this policy, users can play the surf game.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#allowsurfgame"],"options":[{"id":"com.apple.managedclient.preferences_allowsurfgame_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_allowsurfgame_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_allowsyncxhrinpagedismissal","displayName":"Allow pages to send synchronous XHR requests during page dismissal","description":"This policy lets you specify that a page can send synchronous XHR requests during page dismissal.\n\nIf you enable this policy, pages can send synchronous XHR requests during page dismissal.\n\nIf you disable this policy or don't configure this policy, pages aren't allowed to send synchronous XHR requests during page dismissal.\n\nThis policy is temporary and will be removed in a future release.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#allowsyncxhrinpagedismissal"],"options":[{"id":"com.apple.managedclient.preferences_allowsyncxhrinpagedismissal_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_allowsyncxhrinpagedismissal_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_allowtrackingforurls","displayName":"Configure tracking prevention exceptions for specific sites","description":"Configure the list of URL patterns that are excluded from tracking prevention.\n\nIf you configure this policy, the list of configured URL patterns is excluded from tracking prevention.\n\nIf you don't configure this policy, the global default value from the \"Block tracking of users' web-browsing activity\" policy (if set) or the user's personal configuration is used for all sites.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#allowtrackingforurls"],"options":null},{"id":"com.apple.managedclient.preferences_allowvisualbasictobindtosystem","displayName":"Allow Visual Basic macros to use system APIs","description":"Allow Visual Basic macros to use DECLARE to bind to the system() OS API. Recommended: false.","helpText":null,"infoUrls":["https://aka.ms/macvbpref"],"options":[{"id":"com.apple.managedclient.preferences_allowvisualbasictobindtosystem_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_allowvisualbasictobindtosystem_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_allowwebauthnwithbrokentlscerts","displayName":"Allow Web Authentication requests on sites with broken TLS certificates.","description":"If you enable this policy, Microsoft Edge will allow Web Authentication requests on websites that have TLS certificates with errors (i.e. websites considered not secure).\n\nIf you disable or don't configure this policy, the default behavior of blocking such requests will apply.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#allowwebauthnwithbrokentlscerts"],"options":[{"id":"com.apple.managedclient.preferences_allowwebauthnwithbrokentlscerts_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_allowwebauthnwithbrokentlscerts_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_alternateerrorpagesenabled","displayName":"Suggest similar pages when a webpage can’t be found","description":"Allow Microsoft Edge to issue a connection to a web service to generate URL and search suggestions for connectivity issues such as DNS errors.\n\nIf you enable this policy, a web service is used to generate url and search suggestions for network errors.\n\nIf you disable this policy, no calls to the web service are made and a standard error page is shown.\n\nIf you don't configure this policy, Microsoft Edge respects the user preference that's set under Services at edge://settings/privacy.\nSpecifically, there's a **Suggest similar pages when a webpage can’t be found** toggle, which the user can switch on or off. Note that if you have enable this policy (AlternateErrorPagesEnabled), the Suggest similar pages when a webpage can’t be found setting is turned on, but the user can't change the setting by using the toggle. If you disable this policy, the Suggest similar pages when a webpage can’t be found setting is turned off, and the user can't change the setting by using the toggle.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#alternateerrorpagesenabled"],"options":[{"id":"com.apple.managedclient.preferences_alternateerrorpagesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_alternateerrorpagesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_alwaysopenpdfexternally","displayName":"Always open PDF files externally","description":"Disables the internal PDF viewer in Microsoft Edge.\n\nIf you enable this policy Microsoft Edge treats PDF files as downloads and lets users open them with the default application.\n\nIf you don't configure this policy or disable it, Microsoft Edge will open PDF files (unless the user disables it).","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#alwaysopenpdfexternally"],"options":[{"id":"com.apple.managedclient.preferences_alwaysopenpdfexternally_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_alwaysopenpdfexternally_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_ambientauthenticationinprivatemodesenabled","displayName":"Enable Ambient Authentication for InPrivate and Guest profiles","description":"Configure this policy to allow/disallow ambient authentication for InPrivate and Guest profiles in Microsoft Edge.\n\nAmbient Authentication is http authentication with default credentials when explicit credentials aren't provided via NTLM/Kerberos/Negotiate challenge/response schemes.\n\nIf you set the policy to RegularOnly (value 0), it allows ambient authentication for Regular sessions only. InPrivate and Guest sessions won't be allowed to ambiently authenticate.\n\nIf you set the policy to InPrivateAndRegular (value 1), it allows ambient authentication for InPrivate and Regular sessions. Guest sessions won't be allowed to ambiently authenticate.\n\nIf you set the policy to GuestAndRegular (value 2), it allows ambient authentication for Guest and Regular sessions. InPrivate sessions won't be allowed to ambiently authenticate\n\nIf you set the policy to All (value 3), it allows ambient authentication for all sessions.\n\nNote that ambient authentication is always allowed on regular profiles.\n\nIf you don't configure this policy, InPrivate and Guest sessions will not be able to ambiently authenticate in future releases of Microsoft Edge, because they will be disallowed.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#ambientauthenticationinprivatemodesenabled"],"options":[{"id":"com.apple.managedclient.preferences_ambientauthenticationinprivatemodesenabled_0","displayName":"Enable ambient authentication in regular sessions only.","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_ambientauthenticationinprivatemodesenabled_1","displayName":"Enable ambient authentication in InPrivate and regular sessions","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_ambientauthenticationinprivatemodesenabled_2","displayName":"Enable ambient authentication in guest and regular sessions","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_ambientauthenticationinprivatemodesenabled_3","displayName":"Enable ambient authentication in regular, InPrivate and guest sessions","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_appcacheforceenabled","displayName":"Allows the AppCache feature to be re-enabled, even if it's turned off by default","description":"If you set this policy to true, the AppCache is enabled, even when AppCache in Microsoft Edge is not available by default.\n\nIf you set this policy to false, or don't set it, AppCache will follow Microsoft Edge's defaults.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#appcacheforceenabled"],"options":[{"id":"com.apple.managedclient.preferences_appcacheforceenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_appcacheforceenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem","displayName":"Applications","description":null,"helpText":null,"infoUrls":["https://github.com/pbowden-msft/Payloads"],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_company portal.app","displayName":"Company Portal","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_company portal.app_application id","displayName":"Company Portal Application ID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_company portal.app_channelname","displayName":"Channel Name (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_company portal.app_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_company portal.app_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_company portal.app_channelname_2","displayName":"Beta Channel","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_company portal.app_lcid","displayName":"Company Portal LCID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_company portal.app_manifestserver","displayName":"Update channel override","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_company portal.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_company portal.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_company portal.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_company portal.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender atp.app","displayName":"Microsoft Defender ATP (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender atp.app_application id","displayName":"Microsoft Defender ATP Application ID (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender atp.app_channelname","displayName":"Channel Name (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender atp.app_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender atp.app_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender atp.app_channelname_2","displayName":"Beta Channel","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender atp.app_lcid","displayName":"Microsoft Defender ATP LCID (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender atp.app_manifestserver","displayName":"Update channel override (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender atp.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender atp.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender atp.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender atp.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender.app","displayName":"Microsoft Defender","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender.app_application id","displayName":"Microsoft Defender Application ID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender.app_channelname","displayName":"Channel Name (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender.app_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender.app_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender.app_channelname_2","displayName":"Beta Channel","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender.app_lcid","displayName":"Microsoft Defender LCID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender.app_manifestserver","displayName":"Update channel override","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft defender.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge beta.app","displayName":"Microsoft Edge Beta (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge beta.app_application id","displayName":"Microsoft Edge Beta Application ID (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge beta.app_channelname","displayName":"Channel Name (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge beta.app_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge beta.app_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge beta.app_channelname_2","displayName":"Beta Channel","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge beta.app_lcid","displayName":"Microsoft Edge Beta LCID (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge beta.app_manifestserver","displayName":"Update channel override (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge beta.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge beta.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge beta.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge beta.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge canary.app","displayName":"Microsoft Edge Canary (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge canary.app_application id","displayName":"Microsoft Edge Canary Application ID (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge canary.app_channelname","displayName":"Channel Name (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge canary.app_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge canary.app_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge canary.app_channelname_2","displayName":"Beta Channel","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge canary.app_lcid","displayName":"Microsoft Edge Canary LCID (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge canary.app_manifestserver","displayName":"Update channel override (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge canary.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge canary.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge canary.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge canary.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge dev.app","displayName":"Microsoft Edge Dev (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge dev.app_application id","displayName":"Microsoft Edge Dev Application ID (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge dev.app_channelname","displayName":"Channel Name (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge dev.app_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge dev.app_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge dev.app_channelname_2","displayName":"Beta Channel","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge dev.app_lcid","displayName":"Microsoft Edge Dev LCID (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge dev.app_manifestserver","displayName":"Update channel override (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge dev.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge dev.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge dev.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge dev.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge.app","displayName":"Microsoft Edge (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge.app_application id","displayName":"Microsoft Edge Application ID (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge.app_channelname","displayName":"Channel Name (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge.app_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge.app_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge.app_channelname_2","displayName":"Beta Channel","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge.app_lcid","displayName":"Microsoft Edge LCID (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge.app_manifestserver","displayName":"Update channel override (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft edge.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft excel.app","displayName":"Microsoft Excel","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft excel.app_application id","displayName":"Microsoft Excel Application ID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft excel.app_channelname","displayName":"Channel Name (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft excel.app_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft excel.app_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft excel.app_channelname_2","displayName":"Beta Channel","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft excel.app_lcid","displayName":"Microsoft Excel LCID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft excel.app_manifestserver","displayName":"Update channel override","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft excel.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft excel.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft excel.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft excel.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft onenote.app","displayName":"Microsoft OneNote","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft onenote.app_application id","displayName":"Microsoft OneNote Application ID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft onenote.app_channelname","displayName":"Channel Name (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft onenote.app_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft onenote.app_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft onenote.app_channelname_2","displayName":"Beta Channel","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft onenote.app_lcid","displayName":"Microsoft OneNote LCID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft onenote.app_manifestserver","displayName":"Update channel override","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft onenote.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft onenote.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft onenote.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft onenote.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft outlook.app","displayName":"Microsoft Outlook","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft outlook.app_application id","displayName":"Microsoft Outlook Application ID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft outlook.app_channelname","displayName":"Channel Name (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft outlook.app_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft outlook.app_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft outlook.app_channelname_2","displayName":"Beta Channel","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft outlook.app_lcid","displayName":"Microsoft Outlook LCID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft outlook.app_manifestserver","displayName":"Update channel override","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft outlook.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft outlook.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft outlook.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft outlook.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft powerpoint.app","displayName":"Microsoft PowerPoint","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft powerpoint.app_application id","displayName":"Microsoft PowerPoint Application ID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft powerpoint.app_channelname","displayName":"Channel Name (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft powerpoint.app_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft powerpoint.app_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft powerpoint.app_channelname_2","displayName":"Beta Channel","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft powerpoint.app_lcid","displayName":"Microsoft PowerPoint LCID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft powerpoint.app_manifestserver","displayName":"Update channel override","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft powerpoint.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft powerpoint.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft powerpoint.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft powerpoint.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft remote desktop.app","displayName":"Microsoft Remote Desktop (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft remote desktop.app_application id","displayName":"Microsoft Remote Desktop Application ID (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft remote desktop.app_channelname","displayName":"Channel Name (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft remote desktop.app_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft remote desktop.app_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft remote desktop.app_channelname_2","displayName":"Beta Channel","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft remote desktop.app_lcid","displayName":"Microsoft Remote Desktop LCID (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft remote desktop.app_manifestserver","displayName":"Update channel override (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft remote desktop.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft remote desktop.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft remote desktop.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft remote desktop.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams (work or school).app","displayName":"Microsoft Teams (work or school).app","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams (work or school).app_application id","displayName":"Microsoft Teams (work or school) Application ID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams (work or school).app_lcid","displayName":"Microsoft Teams (work or school) LCID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams (work or school).app_manifestserver","displayName":"Update channel override","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams (work or school).app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams (work or school).app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams (work or school).app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams (work or school).app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams classic.app","displayName":"Microsoft Teams classic","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams classic.app_application id","displayName":"ApplicationsSystem//Applications/Microsoft Teams classic.app/Application ID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams classic.app_lcid","displayName":"Microsoft Teams classic LCID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams classic.app_manifestserver","displayName":"Update channel override","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams classic.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams classic.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams classic.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams classic.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams.app","displayName":"Microsoft Teams (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams.app_application id","displayName":"Microsoft Teams Application ID (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams.app_channelname","displayName":"Channel Name (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams.app_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams.app_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams.app_channelname_2","displayName":"Beta Channel","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams.app_lcid","displayName":"Microsoft Teams LCID (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams.app_manifestserver","displayName":"Update channel override (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft teams.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft word.app","displayName":"Microsoft Word","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft word.app_application id","displayName":"Microsoft Word Application ID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft word.app_channelname","displayName":"Channel Name (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft word.app_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft word.app_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft word.app_channelname_2","displayName":"Beta Channel","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft word.app_lcid","displayName":"Microsoft Word LCID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft word.app_manifestserver","displayName":"Update channel override","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft word.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft word.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft word.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_microsoft word.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_onedrive.app","displayName":"OneDrive","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_onedrive.app_application id","displayName":"OneDrive Application ID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_onedrive.app_channelname","displayName":"Channel Name (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_onedrive.app_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_onedrive.app_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_onedrive.app_channelname_2","displayName":"Beta Channel","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_onedrive.app_lcid","displayName":"OneDrive LCID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_onedrive.app_manifestserver","displayName":"Update channel override","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_onedrive.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_onedrive.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_onedrive.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_onedrive.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_skype for business.app","displayName":"Skype for Business","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_skype for business.app_application id","displayName":"Skype for Business Application ID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_skype for business.app_channelname","displayName":"Channel Name (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_skype for business.app_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_skype for business.app_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_skype for business.app_channelname_2","displayName":"Beta Channel","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_skype for business.app_lcid","displayName":"Skype for Business LCID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_skype for business.app_manifestserver","displayName":"Update channel override","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_skype for business.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_skype for business.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_skype for business.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_skype for business.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_windows app.app","displayName":"Windows App","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_windows app.app_application id","displayName":"Application ID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_windows app.app_channelname","displayName":"Channel Name","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_windows app.app_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_windows app.app_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_windows app.app_channelname_2","displayName":"Beta Channel","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_windows app.app_lcid","displayName":"LCID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_windows app.app_manifestserver","displayName":"Manifest Server","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_applications_windows app.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_windows app.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_windows app.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_applications_windows app.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_library_application support_microsoft_mau2.0_microsoft autoupdate.app","displayName":"Microsoft Auto Update","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_library_application support_microsoft_mau2.0_microsoft autoupdate.app_application id","displayName":"Microsoft AutoUpdate Application ID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_library_application support_microsoft_mau2.0_microsoft autoupdate.app_channelname","displayName":"Channel Name (Deprecated)","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_library_application support_microsoft_mau2.0_microsoft autoupdate.app_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_library_application support_microsoft_mau2.0_microsoft autoupdate.app_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_library_application support_microsoft_mau2.0_microsoft autoupdate.app_channelname_2","displayName":"Beta Channel","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_applicationssystem_library_application support_microsoft_mau2.0_microsoft autoupdate.app_lcid","displayName":"Microsoft AutoUpdate LCID","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_applicationssystem_library_application support_microsoft_mau2.0_microsoft autoupdate.app_manifestserver","displayName":"Update channel override","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_applicationssystem_library_application support_microsoft_mau2.0_microsoft autoupdate.app_manifestserver_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_library_application support_microsoft_mau2.0_microsoft autoupdate.app_manifestserver_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_library_application support_microsoft_mau2.0_microsoft autoupdate.app_manifestserver_2","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_applicationssystem_library_application support_microsoft_mau2.0_microsoft autoupdate.app_manifestserver_3","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_askbeforecloseenabled","displayName":"Get user confirmation before closing a browser window with multiple tabs","description":"This policy lets you configure whether users see a confirmation dialog before closing a browser window with multiple tabs. This dialog asks users to confirm that the browser window can be closed.\n\nIf you enable this policy, users will be presented with a confirmation dialog when closing a browser window with multiple tabs.\n\nIf you disable or don't configure this policy, a browser window with multiple tabs will close immediately without user confirmation.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#askbeforecloseenabled"],"options":[{"id":"com.apple.managedclient.preferences_askbeforecloseenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_askbeforecloseenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_audiocaptureallowed","displayName":"Allow or block audio capture","description":"Allows you to set whether a user is prompted to grant a website access to their audio capture device. This policy applies to all URLs except for those configured in the \"AudioCaptureAllowedUrls\" list.\n\nIf you enable this policy or don't configure it (the default setting), the user is prompted for audio capture access except from the URLs in the \"AudioCaptureAllowedUrls\" list. These listed URLs are granted access without prompting.\n\nIf you disable this policy, the user is not prompted, and audio capture is accessible only to the URLs configured in \"AudioCaptureAllowedUrls\".\n\nThis policy affects all types of audio inputs, not only the built-in microphone.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#audiocaptureallowed"],"options":[{"id":"com.apple.managedclient.preferences_audiocaptureallowed_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_audiocaptureallowed_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_audiocaptureallowedurls","displayName":"Sites that can access audio capture devices without requesting permission","description":"Specify websites, based on URL patterns, that can use audio capture devices without asking the user for permission. Patterns in this list are matched against the security origin of the requesting URL. If they match, the site is automatically granted access to audio capture devices.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#audiocaptureallowedurls"],"options":null},{"id":"com.apple.managedclient.preferences_audiosandboxenabled","displayName":"Allow the audio sandbox to run","description":"This policy controls the audio process sandbox.\n\nIf you enable this policy, the audio process will run sandboxed.\n\nIf you disable this policy, the audio process will run unsandboxed and the WebRTC audio-processing module will run in the renderer process.\nThis leaves users open to security risks related to running the audio subsystem unsandboxed.\n\nIf you don't configure this policy, the default configuration for the audio sandbox will be used, which might differ based on the platform.\n\nThis policy is intended to give enterprises flexibility to disable the audio sandbox if they use security software setups that interfere with the sandbox.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#audiosandboxenabled"],"options":[{"id":"com.apple.managedclient.preferences_audiosandboxenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_audiosandboxenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_authnegotiatedelegateallowlist","displayName":"Specifies a list of servers that Microsoft Edge can delegate user credentials to","description":"Configure the list of servers that Microsoft Edge can delegate to.\n\nSeparate multiple server names with commas. Wildcards (*) are allowed.\n\nIf you don't configure this policy Microsoft Edge won't delegate user credentials even if a server is detected as Intranet.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#authnegotiatedelegateallowlist"],"options":null},{"id":"com.apple.managedclient.preferences_authschemes","displayName":"Supported authentication schemes","description":"Specifies which HTTP authentication schemes are supported.\n\nYou can configure the policy by using these values: 'basic', 'digest', 'ntlm', and 'negotiate'. Separate multiple values with commas.\n\nIf you don't configure this policy, all four schemes are used.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#authschemes"],"options":null},{"id":"com.apple.managedclient.preferences_authserverallowlist","displayName":"Configure list of allowed authentication servers","description":"Specifies which servers to enable for integrated authentication. Integrated authentication is only enabled when Microsoft Edge receives an authentication challenge from a proxy or from a server in this list.\n\nSeparate multiple server names with commas. Wildcards (*) are allowed.\n\nIf you don't configure this policy, Microsoft Edge tries to detect if a server is on the intranet - only then will it respond to IWA requests. If the server is on the internet, IWA requests from it are ignored by Microsoft Edge.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#authserverallowlist"],"options":null},{"id":"com.apple.managedclient.preferences_autodiscardsleepingtabsenabled","displayName":"Configure auto discard sleeping tabs","description":"Setting this policy enables inactive (sleeping) tabs to be automatically discarded after 1.5 days of inactivity. This is done to save memory. When the user switches back to a discarded tab, the tab will need to be reloaded.\n\nIf the \"SleepingTabsEnabled\" policy is enabled, then this feature will be enabled by default.\n\nIf the \"SleepingTabsEnabled\" is disabled, then this feature will be disabled by default and cannot be enabled.\n\nIf enabled, idle background tabs will be discarded after 1.5 days.\n\nIf disabled, idle background tab will not be discarded after 1.5 days. Tabs can still be discarded for other reasons if this policy is disabled.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#autodiscardsleepingtabsenabled"],"options":[{"id":"com.apple.managedclient.preferences_autodiscardsleepingtabsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_autodiscardsleepingtabsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_autofilladdressenabled","displayName":"Enable AutoFill for addresses","description":"Enables the AutoFill feature and allows users to auto-complete address information in web forms using previously stored information.\n\nIf this policy is enabled or not configured, users can manage AutoFill for addresses in Microsoft Edge settings. AutoFill allows users to complete address fields in web forms using previously saved information.\n\nIf this policy is disabled, Microsoft Edge does not suggest, fill in, or save address information. AutoFill is also disabled for all web forms except payment and password fields, and previously saved addresses are not available.\n\nDisabling this policy also turns off \"EdgeAutofillMlEnabled\".\n\nNote that if you disable this policy you also stop all activity for all web forms, except payment and password forms. No further entries are saved, and Microsoft Edge won't suggest or AutoFill any previous entries.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#autofilladdressenabled"],"options":[{"id":"com.apple.managedclient.preferences_autofilladdressenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_autofilladdressenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_autofillcreditcardenabled","displayName":"Enable AutoFill for credit cards","description":"Enables Microsoft Edge's AutoFill feature and lets users auto complete credit card information in web forms using previously stored information.\n\nIf you disable this policy, AutoFill never suggests or fills credit card information, nor will it save additional credit card information that users might submit while browsing the web.\n\nIf you enable this policy or don't configure it, users can control AutoFill for credit cards.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#autofillcreditcardenabled"],"options":[{"id":"com.apple.managedclient.preferences_autofillcreditcardenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_autofillcreditcardenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_autofillmembershipsenabled","displayName":"Save and fill memberships","description":"This policy lets you decide whether users can have their membership info (for example, program name and membership number) automatically saved and used to fill form fields while using Microsoft Edge. By default, users can choose whether to enable it or not.\n\nIf you enable this policy, users can only have their membership info automatically saved and used to fill form fields while using Microsoft Edge.\n\nIf you don't configure this policy, users can choose whether to have their membership info automatically saved and used to fill form fields while using Microsoft Edge.\n\nIf you disable this policy, users can't have their membership info automatically saved and used to fill form fields while using Microsoft Edge.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#autofillmembershipsenabled"],"options":[{"id":"com.apple.managedclient.preferences_autofillmembershipsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_autofillmembershipsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_autoimportatfirstrun","displayName":"Automatically import another browser's data and settings at first run","description":"If you enable this policy, all supported datatypes and settings from the specified browser will be silently and automatically imported at first run. During the First Run Experience, the import section will also be skipped.\n\nThe browser data from Microsoft Edge Legacy will always be silently migrated at the first run, irrespective of the value of this policy. You can use the following values for this policy:\n\n* 0 = Automatically imports all supported datatypes and settings from the default browser\n\n* 1 = Automatically imports all supported datatypes and settings from Internet Explorer\n\n* 2 = Automatically imports all supported datatypes and settings from Google Chrome\n\n* 3 = Automatically imports all supported datatypes and settings from Safari\n\n* 4 = Disables automatic import, and the import section of the first-run experience is skipped\n\n* 5 = Automatically imports all supported datatypes and settings from Mozilla Firefox\n\nIf this policy is set to the default value (0), then the datatypes corresponding to the default browser on the managed device will be imported.\n\nIf the browser specified as the value of this policy is not present in the managed device, Microsoft Edge will simply skip the import without any notification to the user.\n\nIf you set this policy to 'DisabledAutoImport' (4), the import section of the first-run experience is skipped entirely and Microsoft Edge doesn't import browser data and settings automatically.\n\nIf this policy is set to the value of Internet Explorer (1), the following datatypes will be imported from Internet Explorer:\n1. Favorites or bookmarks\n2. Saved passwords\n3. Search engines\n4. Browsing history\n5. Home page\n\nIf this policy is set to the value of Google Chrome (2), the following datatypes will be imported from Google Chrome:\n1. Favorites\n2. Saved passwords\n3. Addresses and more\n4. Payment info\n5. Browsing history\n6. Settings\n7. Pinned and Open tabs\n8. Extensions\n9. Cookies\n\nNote: For more details on what is imported from Google Chrome, please see https://go.microsoft.com/fwlink/?linkid=2120835\n\nIf this policy is set to the value of Safari (3), user data is no longer imported into Microsoft Edge. This is due to the way Full Disk Access works on Mac.\nOn macOS Mojave and above, it's no longer possible to have automated and unattended import of Safari data into Microsoft Edge.\n\nStarting with Microsoft Edge version 83, if this policy is set to the value of Mozilla Firefox (5), the following datatypes will be imported from Mozilla Firefox:\n1. Favorites or bookmarks\n2. Saved passwords\n3. Addresses and more\n4. Browsing History\n\nIf you want to restrict specific datatypes from getting imported on the managed devices, you can use this policy with other policies such as \"ImportAutofillFormData\", \"ImportBrowserSettings\", \"ImportFavorites\", and etc.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#autoimportatfirstrun"],"options":[{"id":"com.apple.managedclient.preferences_autoimportatfirstrun_0","displayName":"Automatically imports all supported datatypes and settings from the default browser","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_autoimportatfirstrun_1","displayName":"Automatically imports all supported datatypes and settings from Internet Explorer","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_autoimportatfirstrun_2","displayName":"Automatically imports all supported datatypes and settings from Google Chrome","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_autoimportatfirstrun_3","displayName":"Automatically imports all supported datatypes and settings from Safari","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_autoimportatfirstrun_4","displayName":"Disables automatic import, and the import section of the first-run experience is skipped","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_autoimportatfirstrun_5","displayName":"Automatically imports all supported datatypes and settings from Mozilla Firefox","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_autolaunchprotocolscomponentenabled","displayName":"AutoLaunch Protocols Component Enabled","description":"Specifies whether the AutoLaunch Protocols component should be enabled. This component allows Microsoft to provide a list similar to that of the \"AutoLaunchProtocolsFromOrigins\" policy, allowing certain external protocols to launch without prompt or blocking certain protocols (on specified origins). By default, this component is enabled.\n\nIf you enable or don't configure this policy, the AutoLaunch Protocols component is enabled.\n\nIf you disable this policy, the AutoLaunch Protocols component is disabled.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#autolaunchprotocolscomponentenabled"],"options":[{"id":"com.apple.managedclient.preferences_autolaunchprotocolscomponentenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_autolaunchprotocolscomponentenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_automaticallydownloadexternalcontent","displayName":"Download embedded images","description":"Automatically downloading images will provide users with a better messaging experience. However, be aware of the privacy considerations if you are enabling this setting.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#specify-when-pictures-are-downloaded-for-email"],"options":[{"id":"com.apple.managedclient.preferences_automaticallydownloadexternalcontent_0","displayName":"Never download images","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_automaticallydownloadexternalcontent_1","displayName":"Automatically download images from users in the address book","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_automaticallydownloadexternalcontent_2","displayName":"Always download images regardless of sender","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_automaticdefinitionupdateenabled","displayName":"Automatic security intelligence updates","description":"Determines whether security intelligence updates are installed automatically:","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#enable--disable-automatic-security-intelligence-updates"],"options":[{"id":"com.apple.managedclient.preferences_automaticdefinitionupdateenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_automaticdefinitionupdateenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_automaticdownloadsallowedforurls","displayName":"Allow multiple automatic downloads in quick succession on specific sites","description":"Define a list of sites, based on URL patterns, that are allowed to perform multiple successive automatic downloads.\nIf you don't configure this policy, \"DefaultAutomaticDownloadsSetting\" applies for all sites, if it's set. If it isn't set, then the user's personal setting applies.\nFor more detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#automaticdownloadsallowedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_automaticdownloadsblockedforurls","displayName":"Block multiple automatic downloads in quick succession on specific sites","description":"Define a list of sites, based on URL patterns, where multiple successive automatic downloads aren't allowed.\nIf you don't configure this policy, \"DefaultAutomaticDownloadsSetting\" applies for all sites, if it's set. If it isn't set, then the user's personal setting applies.\nFor more detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#automaticdownloadsblockedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_automatichttpsdefault","displayName":"Configure Automatic HTTPS (Deprecated)","description":"This policy lets you manage settings for \"AutomaticHttpsDefault\", which switches connections from HTTP to HTTPS.\n\nThis feature helps protect against man-in-the-middle attacks by enforcing more secure connections, but users might experience more connection errors.\n\nMicrosoft Edge attempts to upgrade some navigations from HTTP to HTTPS, when possible. This policy can be used to disable this behavior. If set to \"AlwaysUpgrade\" or left unset, this feature will be enabled by default.\n\nThe separate HttpAllowlist policy can be used to exempt specific hostnames or hostname patterns from being upgraded to HTTPS by this feature.\n\nStarting in Microsoft Edge 111, \"UpgradePossibleDomains\" is deprecated and is treated the same as \"DisableAutomaticHttps\". It won't work in Microsoft Edge version 114.\n\nPolicy options mapping:\n\n* DisableAutomaticHttps (0) = Automatic HTTPS functionality is disabled.\n\n* UpgradeCapableDomains (1) = (Deprecated) Navigations delivered over HTTP are switched to HTTPS, only on domains likely to support HTTPS.\n\n* AlwaysUpgrade (2) = All navigations delivered over HTTP are switched to HTTPS. Connection errors might occur more often.\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#automatichttpsdefault"],"options":[{"id":"com.apple.managedclient.preferences_automatichttpsdefault_0","displayName":"Automatic HTTPS functionality is disabled.","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_automatichttpsdefault_1","displayName":"(Deprecated) Navigations delivered over HTTP are switched to HTTPS, only on domains likely to support HTTPS.","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_automatichttpsdefault_2","displayName":"All navigations delivered over HTTP are switched to HTTPS. Connection errors might occur more often.","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_automaticsamplesubmission","displayName":"Enable / disable automatic sample submissions","description":"Determines whether suspicious samples (that are likely to contain threats) are sent to Microsoft. You are prompted if the submitted file is likely to contain personal information.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#enable--disable-automatic-sample-submissions"],"options":[{"id":"com.apple.managedclient.preferences_automaticsamplesubmission_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_automaticsamplesubmission_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_automaticsamplesubmissionconsent","displayName":"Automatic sample submission Consent","description":"Sends sample files to Microsoft to help protect device users and your organization from potential threats","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#enable--disable-automatic-sample-submissions"],"options":[{"id":"com.apple.managedclient.preferences_automaticsamplesubmissionconsent_0","displayName":"none","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_automaticsamplesubmissionconsent_1","displayName":"safe","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_automaticsamplesubmissionconsent_2","displayName":"all","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_automaticuploadbandwidthpercentage","displayName":"Automatic upload bandwidth percentage","description":"Enables the sync app to automatically set the amount of bandwidth used based on available bandwidth for uploading files. Accepted values are from 1 through 99.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#automaticuploadbandwidthpercentage"],"options":null},{"id":"com.apple.managedclient.preferences_autoopenallowedforurls","displayName":"URLs where AutoOpenFileTypes can apply","description":"A list of URLs to which \"AutoOpenFileTypes\" will apply to. This policy has no impact on automatically open values set by users via the download shelf ... > \"Always open files of this type\" menu entry.\n\nIf you set URLs in this policy, files will only automatically open by policy if the URL is part of this set and the file type is listed in \"AutoOpenFileTypes\". If either condition is false, the download won't automatically open by policy.\n\nIf you don't set this policy, all downloads where the file type is in \"AutoOpenFileTypes\" will automatically open.\n\nA URL pattern has to be formatted according to https://go.microsoft.com/fwlink/?linkid=2095322.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#autoopenallowedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_autoopenfiletypes","displayName":"List of file types that should be automatically opened on download","description":"This policy sets a list of file types that should be automatically opened on download. Note: The leading separator should not be included when listing the file type, so list \"txt\" instead of \".txt\".\n\nBy default, these file types will be automatically opened on all URLs. You can use the \"AutoOpenAllowedForURLs\" policy to restrict the URLs for which these file types will be automatically opened on.\n\nFiles with types that should be automatically opened will still be subject to the enabled Microsoft Defender SmartScreen checks and won't be opened if they fail those checks.\n\nFile types that a user has already specified to automatically be opened will continue to do so when downloaded. The user will continue to be able to specify other file types to be automatically opened.\n\nIf you don't set this policy, only file types that a user has already specified to automatically be opened will do so when downloaded.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#autoopenfiletypes"],"options":null},{"id":"com.apple.managedclient.preferences_autoplayallowed","displayName":"Allow media autoplay for websites","description":"This policy sets the media autoplay policy for websites.\n\nThe default setting, \"Not configured\" respects the current media autoplay settings and lets users configure their autoplay settings.\n\nSetting to \"Enabled\" sets media autoplay to \"Allow\". All websites are allowed to autoplay media. Users can’t override this policy.\n\nSetting to \"Disabled\" sets media autoplay to \"Block\". No websites are allowed to autoplay media. Users can’t override this policy.\n\nA tab will need to be closed and re-opened for this policy to take effect.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#autoplayallowed"],"options":[{"id":"com.apple.managedclient.preferences_autoplayallowed_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_autoplayallowed_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_autoplayallowlist","displayName":"Allow media autoplay on specific sites","description":"Define a list of sites, based on URL patterns, that are allowed to autoplay media.\n\nIf you don't configure this policy, the global default value from the \"AutoplayAllowed\" policy (if set) or the user's personal configuration is used for all sites.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.\n\nNote: * is not an accepted value for this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#autoplayallowlist"],"options":null},{"id":"com.apple.managedclient.preferences_autoselectcertificateforurls","displayName":"Automatically select client certificates for these sites","description":"Setting the policy lets you make a list of URL patterns that specify sites for which Microsoft Edge can automatically select a client certificate. The value is an array of stringified JSON dictionaries, each with the form { \"pattern\": \"$URL_PATTERN\", \"filter\" : $FILTER }, where $URL_PATTERN is a content setting pattern. $FILTER restricts the client certificates the browser automatically selects from. Independent of the filter, only certificates that match the server's certificate request are selected.\n\nExamples for the usage of the $FILTER section:\n\n* When $FILTER is set to { \"ISSUER\": { \"CN\": \"$ISSUER_CN\" } }, only client certificates issued by a certificate with the CommonName $ISSUER_CN are selected.\n\n* When $FILTER contains both the \"ISSUER\" and the \"SUBJECT\" sections, only client certificates that satisfy both conditions are selected.\n\n* When $FILTER contains a \"SUBJECT\" section with the \"O\" value, a certificate needs at least one organization matching the specified value to be selected.\n\n* When $FILTER contains a \"SUBJECT\" section with a \"OU\" value, a certificate needs at least one organizational unit matching the specified value to be selected.\n\n* When $FILTER is set to {}, the selection of client certificates is not additionally restricted. Note that filters provided by the web server still apply.\n\nIf you leave the policy unset, there's no autoselection for any site.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#autoselectcertificateforurls"],"options":null},{"id":"com.apple.managedclient.preferences_backgroundtemplatelistupdatesenabled","displayName":"Enables background updates to the list of available templates for Collections and other features that use templates","description":"Lets you enable or disable background updates to the list of available templates for Collections and other features that use templates. Templates are used to extract rich metadata from a webpage when the page is saved to a collection.\n\nIf you enable this setting or the setting is unconfigured, the list of available templates will be downloaded in the background from a Microsoft service every 24 hours.\n\nIf you disable this setting the list of available templates will be downloaded on demand. This type of download might result in small performance penalties for Collections and other features.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#backgroundtemplatelistupdatesenabled"],"options":[{"id":"com.apple.managedclient.preferences_backgroundtemplatelistupdatesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_backgroundtemplatelistupdatesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_basicauthoverhttpenabled","displayName":"Allow Basic authentication for HTTP","description":"If you enable this policy or leave it unset, Basic authentication challenges received over non-secure HTTP will be allowed.\n\nIf you disable this policy, non-secure HTTP requests from the Basic authentication scheme are blocked, and only secure HTTPS is allowed.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#basicauthoverhttpenabled"],"options":[{"id":"com.apple.managedclient.preferences_basicauthoverhttpenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_basicauthoverhttpenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_behaviormonitoring","displayName":"Behavior Monitoring","description":"Behavior Monitoring detections with Microsoft Defender for Endpoint.","helpText":null,"infoUrls":["https://learn.microsoft.com/en-us/defender-endpoint/behavior-monitor-macos"],"options":[{"id":"com.apple.managedclient.preferences_behaviormonitoring_0","displayName":"enabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_behaviormonitoring_1","displayName":"disabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_bingadssuppression","displayName":"Block all ads on Bing search results","description":"Enables an ad-free search experience on Bing.com\n\nIf you enable this policy, then a user can search on bing.com and have an ad-free search experience. At the same time, the SafeSearch setting will be set to 'Strict' and can't be changed by the user.\n\nIf you don't configure this policy, then the default experience will have ads in the search results on bing.com. SafeSearch will be set to 'Moderate' by default and can be changed by the user.\n\nThis policy is only available for K-12 SKUs that are identified as EDU tenants by Microsoft.\n\nPlease refer to https://go.microsoft.com/fwlink/?linkid=2119711 to learn more about this policy or if the following scenarios apply to you:\n\n* You have an EDU tenant, but the policy doesn't work.\n\n* You had your IP whitelisted for having an ad free search experience.\n\n* You were experiencing an ad-free search experience on Microsoft Edge Legacy and want to upgrade to the new version of Microsoft Edge.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#bingadssuppression"],"options":[{"id":"com.apple.managedclient.preferences_bingadssuppression_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_bingadssuppression_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_blockexternalextensions","displayName":"Blocks external extensions from being installed","description":"Control the installation of external extensions.\n\nIf you enable this setting, external extensions are blocked from being installed.\n\nIf you disable this setting or leave it unset, external extensions are allowed to be installed.\n\nExternal extensions and their installation are documented at https://docs.microsoft.com/microsoft-edge/extensions-chromium/developer-guide/alternate-distribution-options.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#blockexternalextensions"],"options":[{"id":"com.apple.managedclient.preferences_blockexternalextensions_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_blockexternalextensions_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_blockexternalsync","displayName":"Block external sync","description":"Prevents the sync app from syncing libraries and folders shared from other organizations.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#blockexternalsync"],"options":[{"id":"com.apple.managedclient.preferences_blockexternalsync_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_blockexternalsync_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_blockthirdpartycookies","displayName":"Block third party cookies","description":"This policy controls whether third-party cookies are blocked in regular browsing sessions.\n\nIf you enable this policy, web page elements that are not from the domain shown in the address bar can't set cookies.\n\nIf you disable this policy, third-party cookies are allowed, including from domains other than the one shown in the address bar.\n\nIf you don't configure this policy, third-party cookies are allowed by default, but users can change this setting.\n\nNote: This policy doesn't apply in InPrivate mode. In InPrivate, third-party cookies are blocked by default and can only be allowed at the site level using the CookiesAllowedForUrls policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#blockthirdpartycookies"],"options":[{"id":"com.apple.managedclient.preferences_blockthirdpartycookies_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_blockthirdpartycookies_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_blocktruncatedcookies","displayName":"Block truncated cookies (Deprecated)","description":"This policy provides a temporary opt-out for changes to how Microsoft Edge handles cookies set via JavaScript that contain certain control characters (NULL, carriage return, and line feed).\nPreviously, the presence of any of these characters in a cookie string would cause it to be truncated but still set.\nNow, the presence of these characters will cause the whole cookie string to be ignored.\n\nIf you enable or don't configure this policy, the new behavior is enabled.\n\nIf you disable this policy, the old behavior is enabled.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#blocktruncatedcookies"],"options":[{"id":"com.apple.managedclient.preferences_blocktruncatedcookies_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_blocktruncatedcookies_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_browseraddprofileenabled","displayName":"Enable profile creation from the Identity flyout menu or the Settings page","description":"Allows users to create new profiles, using the **Add profile** option.\nIf you enable this policy or don't configure it, Microsoft Edge allows users to use **Add profile** on the Identity flyout menu or the Settings page to create new profiles.\n\nIf you disable this policy, users cannot add new profiles from the Identity flyout menu or the Settings page.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#browseraddprofileenabled"],"options":[{"id":"com.apple.managedclient.preferences_browseraddprofileenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_browseraddprofileenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_browserguestmodeenabled","displayName":"Enable guest mode","description":"Enable the option to allow the use of guest profiles in Microsoft Edge. In a guest profile, the browser doesn't import browsing data from existing profiles, and it deletes browsing data when all guest profiles are closed.\n\nIf you enable this policy or don't configure it, Microsoft Edge lets users browse in guest profiles.\n\nIf you disable this policy, Microsoft Edge doesn't let users browse in guest profiles.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#browserguestmodeenabled"],"options":[{"id":"com.apple.managedclient.preferences_browserguestmodeenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_browserguestmodeenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_browsernetworktimequeriesenabled","displayName":"Allow queries to a Browser Network Time service","description":"Prevents Microsoft Edge from occasionally sending queries to a browser network time service to retrieve an accurate timestamp.\n\nIf you disable this policy, Microsoft Edge will stop sending queries to a browser network time service.\n\nIf you enable this policy or don't configure it, Microsoft Edge will occasionally send queries to a browser network time service.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#browsernetworktimequeriesenabled"],"options":[{"id":"com.apple.managedclient.preferences_browsernetworktimequeriesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_browsernetworktimequeriesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_browsersignin","displayName":"Browser sign-in settings","description":"Specify whether a user can sign into Microsoft Edge with their account and use account-related services like sync and single sign on. To control the availability of sync, use the \"SyncDisabled\" policy instead.\n\nIf you set this policy to 'Disable browser sign-in', make sure that you also set the \"NonRemovableProfileEnabled\" policy to disabled because \"NonRemovableProfileEnabled\" disables the creation of an automatically signed in browser profile. If both policies are set, Microsoft Edge will use the 'Disable browser sign-in' policy and behave as if \"NonRemovableProfileEnabled\" is set to disabled.\n\nIf you set this policy to 'Enable browser sign-in' (1), users can sign into the browser. Signing into the browser doesn't mean that sync is turned on by default; the user must separately opt-in to use this feature.\n\nIf you set this policy to 'Force browser sign-in' (2) users must sign into a profile to use the browser. By default, this will allow the user to choose whether they want to sync to their account, unless sync is disabled by the domain admin or with the \"SyncDisabled\" policy. The default value of \"BrowserGuestModeEnabled\" policy is set to false.\n\nIf you don't configure this policy users can decide if they want to enable the browser sign-in option and use it as they see fit.\n\n* 0 = Disable browser sign-in\n\n* 1 = Enable browser sign-in\n\n* 2 = Force users to sign-in to use the browser","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#browsersignin"],"options":[{"id":"com.apple.managedclient.preferences_browsersignin_0","displayName":"Disable browser sign-in","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_browsersignin_1","displayName":"Enable browser sign-in","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_browsersignin_2","displayName":"Force users to sign-in to use the browser","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_builtincertificateverifierenabled","displayName":"Determines whether the built-in certificate verifier will be used to verify server certificates","description":"This policy is deprecated because it's intended to serve only as a short-term mechanism to give enterprises more time to update their environments and report issues if they are found to be incompatible with the built-in certificate verifier.\n\nThis policy is scheduled to be removed in Microsoft Edge for Mac OS X version 87, when support for the legacy certificate verifier on Mac OS X is planned to be removed.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#builtincertificateverifierenabled"],"options":[{"id":"com.apple.managedclient.preferences_builtincertificateverifierenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_builtincertificateverifierenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_builtindnsclientenabled","displayName":"Use built-in DNS client","description":"Controls whether to use the built-in DNS client.\n\nThis does not affect which DNS servers are used; just the software stack which is used to communicate with them. For example if the operating system is configured to use an enterprise DNS server, that same server would be used by the built-in DNS client. It is however possible that the built-in DNS client will address servers in different ways by using more modern DNS-related protocols such as DNS-over-TLS.\n\nIf you enable this policy, the built-in DNS client is used, if it's available.\n\nIf you disable this policy, the client is never used.\n\nIf you don't configure this policy, the built-in DNS client is enabled by default on MacOS, and users can change whether to use the built-in DNS client by editing edge://flags or by specifying a command-line flag.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#builtindnsclientenabled"],"options":[{"id":"com.apple.managedclient.preferences_builtindnsclientenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_builtindnsclientenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_calendarfirstdayofweek","displayName":"Specify first day of the week","description":"Set the first day of week in calendar view.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#specify-calendar-first-day-of-week"],"options":[{"id":"com.apple.managedclient.preferences_calendarfirstdayofweek_0","displayName":"Sunday","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_calendarfirstdayofweek_1","displayName":"Monday","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_calendarfirstdayofweek_2","displayName":"Tuesday","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_calendarfirstdayofweek_3","displayName":"Wednesday","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_calendarfirstdayofweek_4","displayName":"Thursday","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_calendarfirstdayofweek_5","displayName":"Friday","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_calendarfirstdayofweek_6","displayName":"Saturday","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_certificatetransparencyenforcementdisabledforcas","displayName":"Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes","description":"Disables enforcement of Certificate Transparency requirements for a list of subjectPublicKeyInfo hashes.\n\nThis policy lets you disable Certificate Transparency disclosure requirements for certificate chains that contain certificates with one of the specified subjectPublicKeyInfo hashes. This allows certificates that would otherwise be untrusted because they were not properly publicly disclosed to still be used for Enterprise hosts.\n\nTo disable Certificate Transparency enforcement when this policy is set, one of the following sets of conditions must be met:\n1. The hash is of the server certificate's subjectPublicKeyInfo.\n2. The hash is of a subjectPublicKeyInfo that appears in a CA certificate in the certificate chain, that CA certificate is constrained via the X.509v3 nameConstraints extension, one or more directoryName nameConstraints are present in the permittedSubtrees, and the directoryName contains an organizationName attribute.\n3. The hash is of a subjectPublicKeyInfo that appears in a CA certificate in the certificate chain, the CA certificate has one or more organizationName attributes in the certificate Subject, and the server's certificate contains the same number of organizationName attributes, in the same order, and with byte-for-byte identical values.\n\nA subjectPublicKeyInfo hash is specified by concatenating the hash algorithm name, the \"/\" character, and the Base64 encoding of that hash algorithm applied to the DER-encoded subjectPublicKeyInfo of the specified certificate. This Base64 encoding is the same format as an SPKI Fingerprint, as defined in RFC 7469, Section 2.4. Unrecognized hash algorithms are ignored. The only supported hash algorithm at this time is \"sha256\".\n\nIf you disable this policy or don't configure it, any certificate that's required to be disclosed via Certificate Transparency will be treated as untrusted if it's not disclosed according to the Certificate Transparency policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#certificatetransparencyenforcementdisabledforcas"],"options":null},{"id":"com.apple.managedclient.preferences_certificatetransparencyenforcementdisabledforlegacycas","displayName":"Disable Certificate Transparency enforcement for a list of legacy certificate authorities (Deprecated)","description":"Disables enforcing Certificate Transparency requirements for a list of legacy certificate authorities (Cas).\n\nThis policy lets you disable Certificate Transparency disclosure requirements for certificate chains that contain certificates with one of the specified subjectPublicKeyInfo hashes. This allows certificates that would otherwise be untrusted because they were not properly publicly disclosed, continue to be used for enterprise hosts.\n\nIn order for Certificate Transparency enforcement to be disabled, you must set the hash to a subjectPublicKeyInfo appearing in a CA certificate that is recognized as a legacy certificate authority (CA). A legacy CA is a CA that has been publicly trusted by default by one or more operating systems supported by Microsoft Edge.\n\nYou specify a subjectPublicKeyInfo hash by concatenating the hash algorithm name, the \"/\" character, and the Base64 encoding of that hash algorithm applied to the DER-encoded subjectPublicKeyInfo of the specified certificate. This Base64 encoding is the same format as an SPKI Fingerprint, as defined in RFC 7469, Section 2.4. Unrecognized hash algorithms are ignored. The only supported hash algorithm at this time is \"sha256\".\n\nIf you don't configure this policy, any certificate that's required to be disclosed via Certificate Transparency will be treated as untrusted if it isn't disclosed according to the Certificate Transparency policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#certificatetransparencyenforcementdisabledforlegacycas"],"options":null},{"id":"com.apple.managedclient.preferences_certificatetransparencyenforcementdisabledforurls","displayName":"Disable Certificate Transparency enforcement for specific URLs","description":"Disables enforcing Certificate Transparency requirements for the listed URLs.\n\nThis policy lets you not disclose certificates for the hostnames in the specified URLs via Certificate Transparency. This lets you use certificates that would otherwise be untrusted, because they weren't properly publicly disclosed, but it makes it harder to detect mis-issued certificates for those hosts.\n\nForm your URL pattern according to https://go.microsoft.com/fwlink/?linkid=2095322. Because certificates are valid for a given hostname, independent of the scheme, port, or path, only the hostname part of the URL is considered. Wildcard hosts are not supported.\n\nIf you don't configure this policy, any certificate that should be disclosed via Certificate Transparency is treated as untrusted if it's not disclosed.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#certificatetransparencyenforcementdisabledforurls"],"options":null},{"id":"com.apple.managedclient.preferences_channelname","displayName":"Update channel","description":"Specifies the channel to receive updates. The most stable channel is the Current Channel, which is recommended for the majority of your fleet. Users subscribed to the Preview Channel will receive production-quality updates a week before Current Channel users. Users subscribed to the Beta Channel will receive unsupported nightly builds that are designed for testing.","helpText":null,"infoUrls":["https://support.microsoft.com/office/update-office-for-mac-automatically-bfd1e497-c24d-4754-92ab-910a4074d7c1"],"options":[{"id":"com.apple.managedclient.preferences_channelname_0","displayName":"Current Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_channelname_1","displayName":"Current Channel (Preview)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_channelname_2","displayName":"Current Channel (Deferred)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_channelname_3","displayName":"Beta Channel","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_channelname_4","displayName":"Current Channel (Monthly)","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_checkfordefinitionsupdate","displayName":"Check for definitions update","description":"Check for definitions update before initiating a scheduled scan","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_checkfordefinitionsupdate_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_checkfordefinitionsupdate_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_clearbrowsingdataonexit","displayName":"Clear browsing data when Microsoft Edge closes","description":"Microsoft Edge doesn't clear the browsing data by default when it closes. Browsing data includes information entered in forms, passwords, and even the websites visited.\n\nIf you enable this policy, all browsing data is deleted each time Microsoft Edge closes. Note that if you enable this policy, it takes precedence over how you configured \"DefaultCookiesSetting\"\n\nIf you disable or don't configure this policy, users can configure the Clear browsing data option in Settings.\n\nIf you enable this policy, don't enable the \"AllowDeletingBrowserHistory\" policy, because they both deal with deleting data. If you enable both, this policy takes precedence and deletes all data when Microsoft Edge closes, regardless of how you configured \"AllowDeletingBrowserHistory\".","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#clearbrowsingdataonexit"],"options":[{"id":"com.apple.managedclient.preferences_clearbrowsingdataonexit_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_clearbrowsingdataonexit_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_clearcachedimagesandfilesonexit","displayName":"Clear cached images and files when Microsoft Edge closes","description":"Microsoft Edge doesn't clear cached images and files by default when it closes.\n\nIf you enable this policy, cached images and files will be deleted each time Microsoft Edge closes.\n\nIf you disable this policy, users cannot configure the cached images and files option in edge://settings/clearBrowsingDataOnClose.\n\nIf you don't configure this policy, users can choose whether cached images and files are cleared on exit.\n\nIf you disable this policy, don't enable the \"ClearBrowsingDataOnExit\" policy, because they both deal with deleting data. If you configure both, the \"ClearBrowsingDataOnExit\" policy takes precedence and deletes all data when Microsoft Edge closes, regardless of how you configured \"ClearCachedImagesAndFilesOnExit\".","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#clearcachedimagesandfilesonexit"],"options":[{"id":"com.apple.managedclient.preferences_clearcachedimagesandfilesonexit_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_clearcachedimagesandfilesonexit_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_clipboardallowedforurls","displayName":"Allow clipboard use on specific sites","description":"Configure the list of URL patterns that specify which sites can use the clipboard site permission.\n\nSetting the policy lets you create a list of URL patterns that specify which sites can use the clipboard site permission. This doesn't include all clipboard operations on origins that match the patterns. For example, users will still be able to paste using keyboard shortcuts because this isn't controlled by the clipboard site permission.\n\nLeaving the policy unset means \"DefaultClipboardSetting\" applies for all sites if it's set. If it isn't set, the user's personal setting applies.\n\nFor more information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#clipboardallowedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_clipboardblockedforurls","displayName":"Block clipboard use on specific sites","description":"Configure the list of URL patterns that specify which sites can use the clipboard site permission.\n\nSetting the policy lets you create a list of URL patterns that specify sites that can't use the clipboard site permission. This doesn't include all clipboard operations on origins that match the patterns. For example, users will still be able to paste using keyboard shortcuts because this isn't controlled by the clipboard site permission.\n\nLeaving the policy unset means \"DefaultClipboardSetting\" applies for all sites if it's set. If it isn't set, the user's personal setting applies.\n\nFor more information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#clipboardblockedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_cloudblocklevel","displayName":"Cloud Block Level","description":"Determines how aggressive Defender for Endpoint will be in blocking and scanning suspicious files.","helpText":null,"infoUrls":["https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-preferences?view=o365-worldwide#configure-cloud-block-level"],"options":[{"id":"com.apple.managedclient.preferences_cloudblocklevel_0","displayName":"normal","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_cloudblocklevel_1","displayName":"moderate","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_cloudblocklevel_2","displayName":"high","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_cloudblocklevel_3","displayName":"high_plus","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_cloudblocklevel_4","displayName":"zero_tolerance","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_collectionsservicesandexportsblocklist","displayName":"Block access to a specified list of services and export targets in Collections","description":"List specific services and export targets that users can't access in the Collections feature in Microsoft Edge. This includes displaying additional data from Bing and exporting collections to Microsoft products or external partners.\n\nIf you enable this policy, services and export targets that match the given list are blocked.\n\nIf you don't configure this policy, no restrictions on the acceptable services and export targets are enforced.\n\nPolicy options mapping:\n\n* pinterest_suggestions (pinterest_suggestions) = Pinterest suggestions\n\n* collections_share (collections_share) = Sharing of Collections\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#collectionsservicesandexportsblocklist"],"options":null},{"id":"com.apple.managedclient.preferences_commandlineflagsecuritywarningsenabled","displayName":"Enable security warnings for command-line flags","description":"If disabled, this policy prevents security warnings from appearing when Microsoft Edge is launched with potentially dangerous command-line flags.\n\nIf enabled or unset, security warnings are displayed when these command-line flags are used to launch Microsoft Edge.\n\nFor example, the --disable-gpu-sandbox flag generates this warning: You're using an unsupported command-line flag: --disable-gpu-sandbox. This poses stability and security risks.\n\nOn Windows, this policy is only available on instances that are joined to a Microsoft Active Directory domain, or Windows 10 Pro (or Enterprise) instances that are enrolled for device management.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#commandlineflagsecuritywarningsenabled"],"options":[{"id":"com.apple.managedclient.preferences_commandlineflagsecuritywarningsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_commandlineflagsecuritywarningsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_componentupdatesenabled","displayName":"Enable component updates in Microsoft Edge","description":"If you enable or don't configure this policy, component updates are enabled in Microsoft Edge.\n\nIf you disable this policy or set it to false, component updates are disabled for all components in Microsoft Edge.\n\nHowever, some components are exempt from this policy. This includes any component that doesn't contain executable code, that doesn't significantly alter the behavior of the browser, or that's critical for security. That is, updates that are deemed \"critical for security\" are still applied even if you disable this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#componentupdatesenabled"],"options":[{"id":"com.apple.managedclient.preferences_componentupdatesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_componentupdatesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_composeinlineenabled","displayName":"Control access to Microsoft 365 Copilot writing assistance in Microsoft Edge for Business","description":"This policy controls whether users can use writing support features in Microsoft Edge for Business, such as Rewrite, which utilizes Microsoft 365 Copilot Chat. With Rewrite, users can receive help with drafting content, rewriting text, and adjusting style directly in their browser tab. In Edge, users can trigger it when highlighting editable content in their main browser through the right-click context menu.\n\nThis policy applies only to Microsoft Entra accounts and does not apply to Microsoft accounts.\n\nIf you enable this policy, users can use Rewrite in Microsoft Edge when logged in with an Entra account.\n\nIf you disable this policy, users within your tenant will not be able to use Rewrite.\n\nIf you don't configure this policy, the default behavior is as follows:\n\n- Rewrite is available to users\n\n- Users can enable or disable Microsoft 365 Copilot access to Microsoft Edge page content using the toggle in Microsoft Edge settings.\n\nNote: Rewrite is not available on pages protected by data loss prevention (DLP) policies to help maintain compliance.\n\nLearn more about Microsoft 365 Copilot Chat data, privacy, and security here: https://go.microsoft.com/fwlink/?linkid=2321816","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#composeinlineenabled"],"options":[{"id":"com.apple.managedclient.preferences_composeinlineenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_composeinlineenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_compressiondictionarytransportenabled","displayName":"Enable compression dictionary transport support","description":"This feature enables the use of dictionary-specific content encodings in the Accept-Encoding request header (\"sbr\" and \"zst-d\") when dictionaries are available for use.\n\nIf you enable this policy or don't configure it, Microsoft Edge will accept web contents using the compression dictionary transport feature.\n\nIf you disable this policy, Microsoft Edge will turn off the compression dictionary transport feature.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#compressiondictionarytransportenabled"],"options":[{"id":"com.apple.managedclient.preferences_compressiondictionarytransportenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_compressiondictionarytransportenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_configuredonottrack","displayName":"Configure Do Not Track","description":"Specify whether to send Do Not Track requests to websites that ask for tracking info. Do Not Track requests let the websites you visit know that you don't want your browsing activity to be tracked. By default, Microsoft Edge doesn't send Do Not Track requests, but users can turn on this feature to send them.\n\nIf you enable this policy, Do Not Track requests are always sent to websites asking for tracking info.\n\nIf you disable this policy, requests are never sent.\n\nIf you don't configure this policy, users can choose whether to send these requests.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#configuredonottrack"],"options":[{"id":"com.apple.managedclient.preferences_configuredonottrack_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_configuredonottrack_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_configurefriendlyurlformat","displayName":"Configure the default paste format of URLs copied from Microsoft Edge, and determine if additional formats will be available to users","description":"If FriendlyURLs are enabled, Microsoft Edge will compute additional representations of the URL and place them on the clipboard.\n\nThis policy configures what format will be pasted when the user pastes in external applications, or inside Microsoft Edge without the 'Paste as' context menu item.\n\nIf configured, this policy makes a choice on behalf of the user. The options in edge://settings/shareCopyPaste will be grayed out, and the options in the 'Paste As' context menu will not be available.\n\n* Not configured = The user will be able to choose their preferred paste format. By default, this is set to the friendly URL format. The 'Paste As' menu will be available in Microsoft Edge.\n\n* 1 = No additional formats will be stored on the clipboard. There will be no 'Paste as' context menu item in Microsoft Edge and the only format available to paste will be the plain text URL format. Effectively, the friendly URL feature will be disabled.\n\n* 3 = The user will get a friendly URL whenever they paste into surfaces that accept rich text. The plain URL will still be available for non-rich surfaces. There will be no 'Paste As' menu in Microsoft Edge.\n\n* 4 = (Not currently used)\n\nThe richer formats may not be well-supported in some paste destinations and/or websites. As such, if this policy is to be configured, then the plain URL option is recommended.\n\nPolicy options mapping:\n\n* PlainText (1) = The plain URL without any extra information, such as the page's title. This is the recommended option when this policy is configured. For more information, see the description.\n\n* TitledHyperlink (3) = Titled Hyperlink: A hyperlink that points to the copied URL, but whose visible text is the title of the destination page. This is the Friendly URL format.\n\n* WebPreview (4) = Coming soon. If set, behaves the same as 'Plain URL'.\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#configurefriendlyurlformat"],"options":[{"id":"com.apple.managedclient.preferences_configurefriendlyurlformat_0","displayName":"The plain URL without any extra information, such as the page's title. This is the recommended option when this policy is configured. For more information, see the description.","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_configurefriendlyurlformat_1","displayName":"Titled Hyperlink: A hyperlink that points to the copied URL, but whose visible text is the title of the destination page. This is the Friendly URL format.","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_configurefriendlyurlformat_2","displayName":"Coming soon. If set, behaves the same as 'Plain URL'.","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_configureonlinetexttospeech","displayName":"Configure Online Text To Speech","description":"Set whether the browser can leverage Online Text to Speech voice fonts, part of Azure Cognitive Services. These voice fonts are higher quality than the pre-installed system voice fonts.\n\nIf you enable or don't configure this policy, web-based applications that use the SpeechSynthesis API can use Online Text to Speech voice fonts.\n\nIf you disable this policy, the voice fonts aren't available.\n\nRead more about this feature here:\nSpeechSynthesis API: https://go.microsoft.com/fwlink/?linkid=2110038\nCognitive Services: https://go.microsoft.com/fwlink/?linkid=2110141","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#configureonlinetexttospeech"],"options":[{"id":"com.apple.managedclient.preferences_configureonlinetexttospeech_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_configureonlinetexttospeech_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_configureshare","displayName":"Configure the Share experience","description":"If you set this policy to 'ShareAllowed' (the default), users will be able to access the Share experience from the Settings and More Menu in Microsoft Edge to share with other apps on the system.\n\nIf you set this policy to 'ShareDisallowed', users won't be able to access the Share experience. If the Share button is on the toolbar, it will also be hidden.\n\nPolicy options mapping:\n\n* ShareAllowed (0) = Allow using the Share experience\n\n* ShareDisallowed (1) = Don't allow using the Share experience\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#configureshare"],"options":[{"id":"com.apple.managedclient.preferences_configureshare_0","displayName":"Allow using the Share experience","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_configureshare_1","displayName":"Don't allow using the Share experience","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_consumerexperience","displayName":"Control sign-in to consumer version","description":"Specify whether users can sign into the consumer version of Microsoft Defender","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#control-sign-in-to-consumer-version-of-microsoft-defender"],"options":[{"id":"com.apple.managedclient.preferences_consumerexperience_0","displayName":"enabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_consumerexperience_1","displayName":"disabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_controldefaultstateofallowextensionfromotherstoressettingenabled","displayName":"Configure default state of Allow extensions from other stores setting","description":"This policy allows you to control the default state of the Allow extensions from other stores setting.\nThis policy can't be used to stop installation of extensions from other stores such as Chrome Web Store.\nTo stop installation of extensions from other stores, use the Extension Settings policy: https://go.microsoft.com/fwlink/?linkid=2187098.\n\nWhen enabled, Allow extensions from other stores will be turned on. So, users won't have to turn on the flag manually\nwhile installing extensions from other supported stores such as Chrome Web Store. However a user can override this setting.\nIf the user has already turned on the setting and then turned it off, this setting may not work.\nIf the Admin first sets the policy as Enabled, but then changes it to not configured or disabled, it will have no impact on\nuser settings and the setting will remain as it is.\n\nWhen disabled or not configured, the user can manage the Allow extensions from other store setting.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#controldefaultstateofallowextensionfromotherstoressettingenabled"],"options":[{"id":"com.apple.managedclient.preferences_controldefaultstateofallowextensionfromotherstoressettingenabled_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_controldefaultstateofallowextensionfromotherstoressettingenabled_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_cookiesallowedforurls","displayName":"Allow cookies on specific sites","description":"Define a list of sites, based on URL patterns, that are allowed to set cookies.\n\nIf you don't configure this policy, the global default value from the \"DefaultCookiesSetting\" policy (if set) or the user's personal configuration is used for all sites.\n\nSee the \"CookiesBlockedForUrls\" and \"CookiesSessionOnlyForUrls\" policies for more information.\n\nNote there cannot be conflicting URL patterns set between these three policies:\n\n- \"CookiesBlockedForUrls\"\n\n- CookiesAllowedForUrls\n\n- \"CookiesSessionOnlyForUrls\"","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#cookiesallowedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_cookiesblockedforurls","displayName":"Block cookies on specific sites","description":"Define a list of sites, based on URL patterns, that can't set cookies.\n\nIf you don't configure this policy, the global default value from the \"DefaultCookiesSetting\" policy (if set) or the user's personal configuration is used for all sites.\n\nSee the \"CookiesAllowedForUrls\" and \"CookiesSessionOnlyForUrls\" policies for more information.\n\nNote there cannot be conflicting URL patterns set between these three policies:\n\n- CookiesBlockedForUrls\n\n- \"CookiesAllowedForUrls\"\n\n- \"CookiesSessionOnlyForUrls\"","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#cookiesblockedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_cookiessessiononlyforurls","displayName":"Limit cookies from specific websites to the current session","description":"Cookies created by websites that match a URL pattern you define are deleted when the session ends (when the window closes).\n\nCookies created by websites that don't match the pattern are controlled by the \"DefaultCookiesSetting\" policy (if set) or by the user's personal configuration. This is also the default behavior if you don't configure this policy.\n\nIf Microsoft Edge is running in background mode, the session might not close when the last window is closed, meaning the cookies won't be cleared when the window closes. See the \"BackgroundModeEnabled\" policy for information about configuring what happens when Microsoft Edge runs in background mode.\n\nYou can also use the \"CookiesAllowedForUrls\" and \"CookiesBlockedForUrls\" policies to control which websites can create cookies.\n\nNote there cannot be conflicting URL patterns set between these three policies:\n\n- \"CookiesBlockedForUrls\"\n\n- \"CookiesAllowedForUrls\"\n\n- CookiesSessionOnlyForUrls\n\nIf you set the \"RestoreOnStartup\" policy to restore URLs from previous sessions, this policy is ignored, and cookies are stored permanently for those sites.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#cookiessessiononlyforurls"],"options":null},{"id":"com.apple.managedclient.preferences_copilotpagecontext","displayName":"Control Copilot access to page context for Microsoft Entra ID profiles","description":"This policy controls access to page contents for Copilot in the Microsoft Edge sidebar when users are logged into their MSA Copilot account. This policy applies only to Microsoft Entra ID Microsoft Edge profiles. To summarize pages and interact with text selections, it needs to be able to access the page contents. This policy does not apply to MSA Microsoft Edge profiles. This policy doesn't control access for Copilot with enterprise data protection (EDP). Access for Copilot with enterprise data protection (EDP) is controlled by the \"EdgeEntraCopilotPageContext\" policy.\n\nIf you enable this policy, Copilot will have access to page content when logged in with Entra ID.\n\nIf this policy is not configured, the default behavior for non-EU countries is that access is initially enabled. For EU countries, the default behavior is that access is initially disabled. In both cases, if the policy is not configured, users can enable or disable Copilot's access to page content using the setting toggle in Microsoft Edge.\n\nIf you disable this policy, Copilot will not be able to access page context.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#copilotpagecontext"],"options":[{"id":"com.apple.managedclient.preferences_copilotpagecontext_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_copilotpagecontext_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_corsnonwildcardrequestheaderssupport","displayName":"CORS non-wildcard request header support enabled","description":"This policy lets you configure support of CORS non-wildcard request headers.\n\nMicrosoft Edge version 97 introduces support for CORS non-wildcard request headers. When a script makes a cross-origin network request via fetch() and XMLHttpRequest with a script-added Authorization header, the header must be explicitly allowed by the Access-Control-Allow-Headers header in the CORS preflight response. \"Explicitly\" here means that the wild card symbol \"*\" doesn't cover the Authorization header. See https://go.microsoft.com/fwlink/?linkid=2180022 for more detail.\n\nIf you enable or don't configure the policy, Microsoft Edge will support the CORS non-wildcard request headers and behave as previously described.\n\nIf you disable this policy, Microsoft Edge will allow the wildcard symbol (\"*\") in the Access-Control-Allow-Headers header in the CORS preflight response to cover the Authorization header.\n\nThis policy is a temporary workaround for the new CORS non-wildcard request header feature. It's intended to be removed in the future.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#corsnonwildcardrequestheaderssupport"],"options":[{"id":"com.apple.managedclient.preferences_corsnonwildcardrequestheaderssupport_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_corsnonwildcardrequestheaderssupport_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_csscustomstatedeprecatedsyntaxenabled","displayName":"Controls whether the deprecated :--foo syntax for CSS custom state is enabled (Deprecated)","description":"The :--foo syntax for the CSS custom state feature is being changed to :state(foo) in Microsoft Edge in order to comply with changes that have been made in Firefox and Safari. This policy lets the deprecated syntax to be used until Stable 133.\n\nThis deprecation might break some Microsoft Edge-only websites that use the deprecated :--foo syntax.\n\nIf you enable this policy, the deprecated syntax will be enabled.\n\nIf you disable this policy or don't set it, the deprecated syntax will be disabled.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#csscustomstatedeprecatedsyntaxenabled"],"options":[{"id":"com.apple.managedclient.preferences_csscustomstatedeprecatedsyntaxenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_csscustomstatedeprecatedsyntaxenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_customhelplink","displayName":"Specify custom help link","description":"Specify a link for the Help menu or the F1 key.\n\nIf you enable this policy, an admin can specify a link for the Help menu or the F1 key.\n\nIf you disable or don't configure this policy, the default link for the Help menu or the F1 key is used.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#customhelplink"],"options":null},{"id":"com.apple.managedclient.preferences_dailyconfiguration","displayName":"Daily and Hourly quick scan configuration","description":"Check for definitions update before initiating a scheduled scan","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_dailyconfiguration_interval","displayName":"Start time","description":"Specify how many hours should elapse before the next hourly quick scan. 0 indicates no hourly quick scan. 1 indicates a scan every hour. 24 indicates a scan once a day.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_dailyconfiguration_timeofday","displayName":"Time of day","description":"Specifies the time of day, as the number of minutes after midnight, to perform a daily quick scan.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_datalossprevention","displayName":"Use Data Loss Prevention","description":"Whether data loss prevention enforcement is enabled on the machine.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/compliance/data-loss-prevention-policies?view=o365-worldwide"],"options":[{"id":"com.apple.managedclient.preferences_datalossprevention_0","displayName":"enabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_datalossprevention_1","displayName":"disabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_dataurlinsvguseenabled","displayName":"Data URL support for SVGUseElement","description":"This policy enables Data URL support for SVGUseElement, which will be disabled\nby default starting in Edge stable version 119.\nIf this policy is Enabled, Data URLs will keep working in SVGUseElement.\nIf this policy is Disabled or left not set, Data URLs won't work in SVGUseElement.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#dataurlinsvguseenabled"],"options":[{"id":"com.apple.managedclient.preferences_dataurlinsvguseenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_dataurlinsvguseenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultautomaticdownloadssetting","displayName":"Default automatic downloads setting","description":"Administrators can use this policy to control whether websites can perform multiple downloads successively. Individual site behavior can be managed using the AutomaticDownloadsAllowedForUrls and AutomaticDownloadsBlockedForUrls policies.\n\nDefault behavior:\n\n- A user gesture is required for each additional download.\n\n- Users can modify their browser settings to disable successive downloads.\n\nPolicy options mapping:\n\n* AllowAutomaticDownloads (1) = Allow all websites to perform multiple downloads without requiring a user gesture between each download.\n\n* BlockAutomaticDownloads (2) = Prevent all websites from performing multiple downloads, even after a user gesture.\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultautomaticdownloadssetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultautomaticdownloadssetting_0","displayName":"Allow all websites to perform multiple downloads without requiring a user gesture between each download.","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultautomaticdownloadssetting_1","displayName":"Prevent all websites from performing multiple downloads, even after a user gesture.","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultbrowsersettingenabled","displayName":"Set Microsoft Edge as default browser","description":"Configures the default browser checks in Microsoft Edge and prevents users from changing them.\n\nIf you enable this policy, Microsoft Edge always checks on startup whether it is the default browser and automatically registers itself, if possible.\n\nIf you disable this policy, Microsoft Edge never checks and disables user controls for setting this option.\n\nIf you don't configure this policy, Microsoft Edge lets the user control whether it's the default browser and whether to show user notifications when it isn't.\n\nNote for Windows administrators: This policy only works for PCs running Windows 7. For later versions of Windows, you have to deploy a \"default application associations\" file that makes Microsoft Edge the handler for the https and http protocols (and, optionally, the ftp protocol and file formats such as .html, .htm, .pdf, .svg, .webp). See https://go.microsoft.com/fwlink/?linkid=2094932 for more information.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultbrowsersettingenabled"],"options":[{"id":"com.apple.managedclient.preferences_defaultbrowsersettingenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultbrowsersettingenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultclipboardsetting","displayName":"Default clipboard site permission","description":"This policy controls the default value for the clipboard site permission.\n\nSetting the policy to 2 blocks sites from using the clipboard site permission.\n\nSetting the policy to 3 or leaving it unset lets the user change the setting and decide if the clipboard APIs are available when a site wants to use an API.\n\nThis policy can be overridden for specific URL patterns using the \"ClipboardAllowedForUrls\" and \"ClipboardBlockedForUrls\" policies.\n\nThis policy only affects clipboard operations controlled by the clipboard site permission and doesn't affect sanitized clipboard writes or trusted copy and paste operations.\n\nPolicy options mapping:\n\n* BlockClipboard (2) = Do not allow any site to use the clipboard site permission\n\n* AskClipboard (3) = Allow sites to ask the user to grant the clipboard site permission\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultclipboardsetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultclipboardsetting_0","displayName":"Do not allow any site to use the clipboard site permission","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultclipboardsetting_1","displayName":"Allow sites to ask the user to grant the clipboard site permission","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultcookiessetting","displayName":"Configure cookies","description":"Control whether websites can create cookies on the user's device. This policy is all or nothing - you can let all websites create cookies, or no websites create cookies. You can't use this policy to enable cookies from specific websites.\n\nSet the policy to 'SessionOnly' (4) to clear cookies when the session closes. If Microsoft Edge is running in background mode, the session might not close when the last window is closed, meaning the cookies won't be cleared when the window closes. See \"BackgroundModeEnabled\" policy for information about configuring what happens when Microsoft Edge runs in background mode.\n\nIf you don't configure this policy, the default 'AllowCookies' (1) is used, and users can change this setting in Microsoft Edge Settings. (If you don't want users to be able to change this setting, set the policy.)\n\n* 1 = Let all sites create cookies\n\n* 2 = Don't let any site create cookies\n\n* 4 = Keep cookies for the duration of the session","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultcookiessetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultcookiessetting_0","displayName":"Let all sites create cookies","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultcookiessetting_1","displayName":"Don't let any site create cookies","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultcookiessetting_2","displayName":"Keep cookies for the duration of the session","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultemailaddressordomain","displayName":"Default domain name","description":"Specify the domain or full email address of the Microsoft 365 mailbox to be added on first launch (e.g. contoso.com or fred@contoso.com).","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#specify-microsoft-365-mailbox-to-be-added-on-first-launch"],"options":null},{"id":"com.apple.managedclient.preferences_defaultfilesystemreadguardsetting","displayName":"Control use of the File System API for reading","description":"If you set this policy to 3, websites can ask for read access to the host operating system's filesystem using the File System API. If you set this policy to 2, access is denied.\n\nIf you don't set this policy, websites can ask for access. Users can change this setting.\n\nPolicy options mapping:\n\n* BlockFileSystemRead (2) = Don't allow any site to request read access to files and directories via the File System API\n\n* AskFileSystemRead (3) = Allow sites to ask the user to grant read access to files and directories via the File System API\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultfilesystemreadguardsetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultfilesystemreadguardsetting_0","displayName":"Don't allow any site to request read access to files and directories via the File System API","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultfilesystemreadguardsetting_1","displayName":"Allow sites to ask the user to grant read access to files and directories via the File System API","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultfilesystemwriteguardsetting","displayName":"Control use of the File System API for writing","description":"If you set this policy to 3, websites can ask for write access to the host operating system's filesystem using the File System API. If you set this policy to 2, access is denied.\n\nIf you don't set this policy, websites can ask for access. Users can change this setting.\n\nPolicy options mapping:\n\n* BlockFileSystemWrite (2) = Don't allow any site to request write access to files and directories\n\n* AskFileSystemWrite (3) = Allow sites to ask the user to grant write access to files and directories\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultfilesystemwriteguardsetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultfilesystemwriteguardsetting_0","displayName":"Don't allow any site to request write access to files and directories","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultfilesystemwriteguardsetting_1","displayName":"Allow sites to ask the user to grant write access to files and directories","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultgeolocationsetting","displayName":"Default geolocation setting","description":"Set whether websites can track users' physical locations. You can allow tracking by default (1), deny it by default (2), or ask the user each time a website requests their location (3).\n\nIf you don't configure this policy, 'AskGeolocation' policy is used and the user can change it.\n\n* 1 = Allow sites to track users' physical location\n\n* 2 = Don't allow any site to track users' physical location\n\n* 3 = Ask whenever a site wants to track users' physical location","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultgeolocationsetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultgeolocationsetting_0","displayName":"Allow sites to track users' physical location","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultgeolocationsetting_1","displayName":"Don't allow any site to track users' physical location","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultgeolocationsetting_2","displayName":"Ask whenever a site wants to track users' physical location","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultimagessetting","displayName":"Default images setting","description":"Set whether websites can display images. You can allow images on all sites (1) or block them on all sites (2).\n\nIf you don't configure this policy, images are allowed by default, and the user can change this setting.\n\n* 1 = Allow all sites to show all images\n\n* 2 = Don't allow any site to show images","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultimagessetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultimagessetting_0","displayName":"Allow all sites to show all images","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultimagessetting_1","displayName":"Don't allow any site to show images","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultinsecurecontentsetting","displayName":"Control use of insecure content exceptions","description":"Allows you to set whether users can add exceptions to allow mixed content for specific sites.\n\nThis policy can be overridden for specific URL patterns using the \"InsecureContentAllowedForUrls\" and \"InsecureContentBlockedForUrls\" policies.\n\nIf this policy isn't set, users will be allowed to add exceptions to allow blockable mixed content and disable autoupgrades for optionally blockable mixed content.\n\n* 2 = Do not allow any site to load blockable mixed content\n\n* 3 = Allow users to add exceptions to allow blockable mixed content","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultinsecurecontentsetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultinsecurecontentsetting_0","displayName":"Do not allow any site to load mixed content","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultinsecurecontentsetting_1","displayName":"Allow users to add exceptions to allow mixed content","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultjavascriptjitsetting","displayName":"Control use of JavaScript JIT","description":"Allows you to set whether Microsoft Edge will run the v8 JavaScript engine with JIT (Just In Time) compiler enabled or not.\n\nDisabling the JavaScript JIT will mean that Microsoft Edge may render web content more slowly, and may also disable parts of JavaScript including WebAssembly. Disabling the JavaScript JIT may allow Microsoft Edge to render web content in a more secure configuration.\n\nThis policy can be overridden for specific URL patterns using the \"JavaScriptJitAllowedForSites\" and \"JavaScriptJitBlockedForSites\" policies.\n\nIf you don't configure this policy, JavaScript JIT is enabled.\n\nPolicy options mapping:\n\n* AllowJavaScriptJit (1) = Allow any site to run JavaScript JIT\n\n* BlockJavaScriptJit (2) = Do not allow any site to run JavaScript JIT\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultjavascriptjitsetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultjavascriptjitsetting_0","displayName":"Allow any site to run JavaScript JIT","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultjavascriptjitsetting_1","displayName":"Do not allow any site to run JavaScript JIT","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultjavascriptsetting","displayName":"Default JavaScript setting","description":"Set whether websites can run JavaScript. You can allow it for all sites (1) or block it for all sites (2).\n\nIf you don't configure this policy, all sites can run JavaScript by default, and the user can change this setting.\n\n* 1 = Allow all sites to run JavaScript\n\n* 2 = Don't allow any site to run JavaScript","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultjavascriptsetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultjavascriptsetting_0","displayName":"Allow all sites to run JavaScript","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultjavascriptsetting_1","displayName":"Don't allow any site to run JavaScript","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultnotificationssetting","displayName":"Default notification setting","description":"Set whether websites can display desktop notifications. You can allow them by default (1), deny them by default (2), or have the user be asked each time a website wants to show a notification (3).\n\nIf you don't configure this policy, notifications are allowed by default, and the user can change this setting.\n\n* 1 = Allow sites to show desktop notifications\n\n* 2 = Don't allow any site to show desktop notifications\n\n* 3 = Ask every time a site wants to show desktop notifications","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultnotificationssetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultnotificationssetting_0","displayName":"Allow sites to show desktop notifications","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultnotificationssetting_1","displayName":"Don't allow any site to show desktop notifications","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultnotificationssetting_2","displayName":"Ask every time a site wants to show desktop notifications","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultpluginssetting","displayName":"Default Adobe Flash setting","description":"Determines whether websites that aren't covered by \"PluginsAllowedForUrls\" or \"PluginsBlockedForUrls\" can automatically run the Adobe Flash plug-in. You can select 'BlockPlugins' (2) to block Adobe Flash on all sites, or you can select 'ClickToPlay' (3) to let Adobe Flash run but require the user to click the placeholder to start it. In any case, the \"PluginsAllowedForUrls\" and \"PluginsBlockedForUrls\" policies take precedence over 'DefaultPluginsSetting'.\n\nAutomatic playback is only allowed for domains explicitly listed in the \"PluginsAllowedForUrls\" policy. If you want to enable automatic playback for all sites, consider adding http://* and https://* to this list.\n\nIf you don't configure this policy, the user can change this setting manually.\n\n* 2 = Block the Adobe Flash plug-in\n\n* 3 = Click to play\n\nThe former '1' option set allow-all, but this functionality is now only handled by the \"PluginsAllowedForUrls\" policy. Existing policies using '1' will operate in Click-to-play mode.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultpluginssetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultpluginssetting_0","displayName":"Block the Adobe Flash plugin","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultpluginssetting_1","displayName":"Click to play","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultpopupssetting","displayName":"Default pop-up window setting","description":"Set whether websites can show pop-up windows. You can allow them on all websites (1) or block them on all sites (2).\n\nIf you don't configure this policy, pop-up windows are blocked by default, and users can change this setting.\n\n* 1 = Allow all sites to show pop-ups\n\n* 2 = Don't allow any site to show pop-up windows","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultpopupssetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultpopupssetting_0","displayName":"Allow all sites to show pop-ups","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultpopupssetting_1","displayName":"Do not allow any site to show popups","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultprinterselection","displayName":"Default printer selection rules","description":"Overrides Microsoft Edge default printer selection rules. This policy determines the rules for selecting the default printer in Microsoft Edge, which happens the first time a user tries to print a page.\n\nWhen this policy is set, Microsoft Edge tries to find a printer that matches all of the specified attributes and uses it as default printer. If there are multiple printers that meet the criteria, the first printer that matches is used.\n\nIf you don't configure this policy or no matching printers are found within the timeout, the printer defaults to the built-in PDF printer or no printer, if the PDF printer isn't available.\n\nThe value is parsed as a JSON object, conforming to the following schema: { \"type\": \"object\", \"properties\": { \"idPattern\": { \"description\": \"Regular expression to match printer id.\", \"type\": \"string\" }, \"namePattern\": { \"description\": \"Regular expression to match printer display name.\", \"type\": \"string\" } } }\n\nOmitting a field means all values match; for example, if you don't specify connectivity Print Preview starts discovering all kinds of local printers. Regular expression patterns must follow the JavaScript RegExp syntax and matches are case sensitive.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultprinterselection"],"options":null},{"id":"com.apple.managedclient.preferences_defaultsearchprovidercontextmenuaccessallowed","displayName":"Allow default search provider context menu search access","description":"Enables the use of a default search provider on the context menu.\n\nIf you set this policy to disabled the search context menu item that relies on your default search provider and sidebar search will not be available.\n\nIf this policy is set to enabled or not set, the context menu item for your default search provider and sidebar search will be available.\n\nThe policy value is only appled when the \"DefaultSearchProviderEnabled\" policy is enabled, and is not applicable otherwise.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultsearchprovidercontextmenuaccessallowed"],"options":[{"id":"com.apple.managedclient.preferences_defaultsearchprovidercontextmenuaccessallowed_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultsearchprovidercontextmenuaccessallowed_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultsearchproviderenabled","displayName":"Enable the default search provider","description":"Enables the use of a default search provider.\n\nIf you enable this policy, a user can search for a term by typing in the address bar (as long as what they type isn't a URL).\n\nYou can specify the default search provider to use by enabling the rest of the default search policies. If these are left empty (not configured), the user can choose the default provider.\n\nIf you disable this policy, the user can't search from the address bar.\n\nIf you enable or disable this policy, users can't change or override it.\n\nIf you don't configure this policy, the default search provider is enabled, and the user can choose the default search provider and set the search provider list.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances that are enrolled for device management.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultsearchproviderenabled"],"options":[{"id":"com.apple.managedclient.preferences_defaultsearchproviderenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultsearchproviderenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultsearchproviderencodings","displayName":"Default search provider encodings","description":"Specify the character encodings supported by the search provider. Encodings are code page names like UTF-8, GB2312, and ISO-8859-1. They are tried in the order provided.\n\nThis policy is optional. If not configured, the default, UTF-8, is used.\n\nThis policy is applied only if you enable the \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\" policies.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultsearchproviderencodings"],"options":null},{"id":"com.apple.managedclient.preferences_defaultsearchproviderimageurl","displayName":"Specifies the search-by-image feature for the default search provider","description":"Specifies the URL to the search engine used for image search. Search requests are sent using the GET method.\n\nThis policy is optional. If you don't configure it, image search isn't available.\n\nSpecify Bing's Image Search URL as:\n'{bing:baseURL}images/detail/search?iss=sbiupload&FORM=ANCMS1#enterInsights'.\n\nSpecify Google's Image Search URL as: '{google:baseURL}searchbyimage/upload'.\n\nSee \"DefaultSearchProviderImageURLPostParams\" policy to finish configuring image search.\n\nThis policy is applied only if you enable the \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\" policies.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultsearchproviderimageurl"],"options":null},{"id":"com.apple.managedclient.preferences_defaultsearchproviderimageurlpostparams","displayName":"Parameters for an image URL that uses POST","description":"If you enable this policy, it specifies the parameters used when an image search that uses POST is performed. The policy consists of comma-separated name/value pairs. If a value is a template parameter, like {imageThumbnail} in the preceding example, it’s replaced with real image thumbnail data. This policy is applied only if you enable the \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\" policies.\n\nSpecify Bing's Image Search URL Post Params as:\n'imageBin={google:imageThumbnailBase64}'.\n\nSpecify Google's Image Search URL Post Params as:\n'encoded_image={google:imageThumbnail},image_url={google:imageURL},sbisrc={google:imageSearchSource},original_width={google:imageOriginalWidth},original_height={google:imageOriginalHeight}'.\n\nIf you don’t set this policy, image search requests are sent using the GET method.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultsearchproviderimageurlpostparams"],"options":null},{"id":"com.apple.managedclient.preferences_defaultsearchproviderkeyword","displayName":"Default search provider keyword","description":"Specifies the keyword, which is the shortcut used in the Address Bar to trigger the search for this provider.\n\nThis policy is optional. If you don't configure it, no keyword activates the search provider.\n\nThis policy is applied only if you enable the \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\" policies.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultsearchproviderkeyword"],"options":null},{"id":"com.apple.managedclient.preferences_defaultsearchprovidername","displayName":"Default search provider name","description":"Specifies the name of the default search provider.\n\nIf you enable this policy, you set the name of the default search provider.\n\nIf you don't enable this policy or if you leave it empty, the host name specified by the search URL is used.\n\n'DefaultSearchProviderName' should be set to an organization-approved encrypted search provider that corresponds to the encrypted search provider set in DTBC-0008. This policy is applied only if you enable the \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\" policies.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultsearchprovidername"],"options":null},{"id":"com.apple.managedclient.preferences_defaultsearchprovidersearchurl","displayName":"Default search provider search URL","description":"Specifies the URL of the search engine used for a default search. The URL contains the string '{searchTerms}', which is replaced at query time by the terms the user is searching for.\n\nSpecify Bing's search URL as:\n\n'{bing:baseURL}search?q={searchTerms}'.\n\nSpecify Google's search URL as: '{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}ie={inputEncoding}'.\n\nThis policy is required when you enable the \"DefaultSearchProviderEnabled\" policy; if you don't enable the latter policy, this policy is ignored.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultsearchprovidersearchurl"],"options":null},{"id":"com.apple.managedclient.preferences_defaultsearchprovidersuggesturl","displayName":"Default search provider URL for suggestions","description":"Specifies the URL for the search engine used to provide search suggestions. The URL contains the string '{searchTerms}', which is replaced at query time by the text the user has entered so far.\n\nThis policy is optional. If you don't configure it, users won't see search suggestions; they will see suggestions from their browsing history and favorites.\n\nBing's suggest URL can be specified as:\n\n'{bing:baseURL}qbox?query={searchTerms}'.\n\nGoogle's suggest URL can be specified as: '{google:baseURL}complete/search?output=chrome&q={searchTerms}'.\n\nThis policy is applied only if you enable the \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\" policies.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultsearchprovidersuggesturl"],"options":null},{"id":"com.apple.managedclient.preferences_defaultsensorssetting","displayName":"Default sensors setting","description":"Set whether websites can access and use sensors such as motion and light sensors. You can completely block or allow websites to get access to sensors.\n\nSetting the policy to 1 lets websites access and use sensors. Setting the policy to 2 denies acess to sensors.\n\nYou can override this policy for specific URL patterns by using the \"SensorsAllowedForUrls\" and \"SensorsBlockedForUrls\" policies.\n\nIf you don't configure this policy, websites can access and use sensors, and users can change this setting. This is the global default for \"SensorsAllowedForUrls\" and \"SensorsBlockedForUrls\".\n\nPolicy options mapping:\n\n* AllowSensors (1) = Allow sites to access sensors\n\n* BlockSensors (2) = Do not allow any site to access sensors\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultsensorssetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultsensorssetting_0","displayName":"Allow sites to access sensors","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultsensorssetting_1","displayName":"Do not allow any site to access sensors","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultserialguardsetting","displayName":"Control use of the Serial API","description":"Set whether websites can access serial ports. You can completely block access or ask the user each time a website wants to get access to a serial port.\n\nSetting the policy to 3 lets websites ask for access to serial ports. Setting the policy to 2 denies access to serial ports.\n\nYou can override this policy for specific URL patterns by using the \"SerialAskForUrls\" and \"SerialBlockedForUrls\" policies.\n\nIf you don't configure this policy, by default, websites can ask users whether they can access a serial port, and users can change this setting.\n\nPolicy options mapping:\n\n* BlockSerial (2) = Do not allow any site to request access to serial ports via the Serial API\n\n* AskSerial (3) = Allow sites to ask for user permission to access a serial port\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultserialguardsetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultserialguardsetting_0","displayName":"Do not allow any site to request access to serial ports via the Serial API","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultserialguardsetting_1","displayName":"Allow sites to ask for user permission to access a serial port","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultshareadditionalosregionsetting","displayName":"Set the default \"share additional operating system region\" setting","description":"This policy controls the default value for the \"share additional operating system region\" setting in Microsoft Edge.\n\nThe \"share additional operating system region\" Microsoft Edge setting controls whether the OS Regional format setting will be shared with the web through the default JavaScript locale. If shared, websites will be able to query the OS Regional format using JavaScript code, for example; \"Intl.DateTimeFormat().resolvedOptions().locale\". The default value for the setting is \"Limited\".\n\nIf you set this policy to \"Limited\", the OS Regional format will only be shared if its language part matches the Microsoft Edge display language.\n\nIf you set this policy to \"Always\", the OS Regional format will always be shared. This value could cause unexpected website behavior if the OS Regional format language is different from the Microsoft Edge display language. For example, if a website uses the JavaScript default locale to format dates, the names of the days and months can be displayed in one language while the surrounding text is displayed in another language.\n\nIf you set this policy to \"Never\", the OS Regional format will never be shared.\n\nExample 1: In this example the OS Regional format is set to \"en-GB\" and the browser display language is set to \"en-US\". Then the OS Regional format will be shared if the policy is set to \"Limited\", or \"Always\".\n\nExample 2: In this example the OS Regional format is set to \"es-MX\" and the browser display language is set to \"en-US\". Then the OS Regional format will be shared if the policy is set to \"Always\" but will not if the policy is set to \"Limited\".\n\nFor more information about this setting, see https://go.microsoft.com/fwlink/?linkid=2222282\n\nPolicy options mapping:\n\n* Limited (0) = Limited\n\n* Always (1) = Always share the OS Regional format\n\n* Never (2) = Never share the OS Regional format\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultshareadditionalosregionsetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultshareadditionalosregionsetting_0","displayName":"Limited","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultshareadditionalosregionsetting_1","displayName":"Always share the OS Regional format","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultshareadditionalosregionsetting_2","displayName":"Never share the OS Regional format","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultstolocalopensave","displayName":"Default to local files for open/save","description":"Prefer the local file system when accessing the Open and Save dialogs.","helpText":null,"infoUrls":["https://learn.microsoft.com/deployoffice/mac/preferences-office"],"options":[{"id":"com.apple.managedclient.preferences_defaultstolocalopensave_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultstolocalopensave_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultthirdpartystoragepartitioningsetting","displayName":"Default setting for third-party storage partitioning (deprecated)","description":"This policy controls whether third-party storage partitioning is allowed by default.\n\nIf this policy is set to 1 - AllowPartitioning, or unset, third-party storage partitioning will be allowed by default. This default may be overridden for specific top-level origins by other means.\n\nIf this policy is set to 2 - BlockPartitioning, third-party storage partitioning will be disabled for all contexts.\n\nUse ThirdPartyStoragePartitioningBlockedForOrigins to disable third-party storage partitioning for specific top-level origins.\n\nThis feature will be removed starting in Microsoft Edge version 145. To ensure compatibility, use the requestStorageAccess method instead. For more information, see https://developer.mozilla.org/en-US/docs/Web/API/Document/requestStorageAccess.\n\nPolicy options mapping:\n\n* AllowPartitioning (1) = Allow third-party storage partitioning by default.\n\n* BlockPartitioning (2) = Disable third-party storage partitioning.\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultthirdpartystoragepartitioningsetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultthirdpartystoragepartitioningsetting_0","displayName":"Allow third-party storage partitioning by default.","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultthirdpartystoragepartitioningsetting_1","displayName":"Disable third-party storage partitioning.","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultweatherlocation","displayName":"Default weather location","description":"Sets the default weather location in the Calendar view. Enter the city and state or country (e.g. Redmond, WA or Paris, France)","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#specify-default-weather-location"],"options":null},{"id":"com.apple.managedclient.preferences_defaultwebbluetoothguardsetting","displayName":"Control use of the Web Bluetooth API","description":"Control whether websites can access nearby Bluetooth devices. You can completely block access or require the site to ask the user each time it wants to access a Bluetooth device.\n\nIf you don't configure this policy, the default value (3, meaning users are asked each time) is used and users can change it.\n\n* 2 = Don't allow any site to request access to Bluetooth devices by using the Web Bluetooth API\n\n* 3 = Allow sites to ask the user to grant access to a nearby Bluetooth device","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultwebbluetoothguardsetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultwebbluetoothguardsetting_0","displayName":"Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultwebbluetoothguardsetting_1","displayName":"Allow sites to ask the user to grant access to a nearby Bluetooth device","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultwebhidguardsetting","displayName":"Control use of the WebHID API","description":"Setting the policy to 3 lets websites ask for access to HID devices. Setting the policy to 2 denies access to HID devices.\n\nLeaving it unset lets websites ask for access, but users can change this setting.\n\nThis policy can be overridden for specific url patterns using the \"WebHidAskForUrls\" and \"WebHidBlockedForUrls\" policies.\n\nPolicy options mapping:\n\n* BlockWebHid (2) = Do not allow any site to request access to HID devices via the WebHID API\n\n* AskWebHid (3) = Allow sites to ask the user to grant access to a HID device\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultwebhidguardsetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultwebhidguardsetting_0","displayName":"Do not allow any site to request access to HID devices via the WebHID API","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultwebhidguardsetting_1","displayName":"Allow sites to ask the user to grant access to a HID device","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultwebusbguardsetting","displayName":"Control use of the WebUSB API","description":"Set whether websites can access connected USB devices. You can completely block access or ask the user each time a website wants to get access to connected USB devices.\n\nYou can override this policy for specific URL patterns by using the \"WebUsbAskForUrls\" and \"WebUsbBlockedForUrls\" policies.\n\nIf you don't configure this policy, sites can ask users whether they can access the connected USB devices (3) by default, and users can change this setting.\n\n* 2 = Don't allow any site to request access to USB devices via the WebUSB API\n\n* 3 = Allow sites to ask the user to grant access to a connected USB device","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultwebusbguardsetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultwebusbguardsetting_0","displayName":"Do not allow any site to request access to USB devices via the WebUSB API","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultwebusbguardsetting_1","displayName":"Allow sites to ask the user to grant access to a connected USB device","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_defaultwindowmanagementsetting","displayName":"Default Window Management permission setting","description":"Setting the policy to \"BlockWindowManagement\" (value 2) automatically denies the window management permission to sites by default. This limits the ability of sites to see information about the device's screens and use that information to open and place windows or request fullscreen on specific screens.\n\nSetting the policy to \"AskWindowManagement\" (value 3) by default prompts the user when the window management permission is requested. If users allow the permission, it extends the ability of sites to see information about the device's screens and use that information to open and place windows or request fullscreen on specific screens.\n\nNot configuring the policy means the \"AskWindowManagement\" policy applies, but users can change this setting.\n\nPolicy options mapping:\n\n* BlockWindowManagement (2) = Denies the Window Management permission on all sites by default\n\n* AskWindowManagement (3) = Ask every time a site wants obtain the Window Management permission\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#defaultwindowmanagementsetting"],"options":[{"id":"com.apple.managedclient.preferences_defaultwindowmanagementsetting_0","displayName":"Denies the Window Management permission on all sites by default","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_defaultwindowmanagementsetting_1","displayName":"Ask every time a site wants obtain the Window Management permission","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_definitionupdatedue","displayName":"Security intelligence update due (in days)","description":"Determines the number of days after which the last installed security intelligence updates are considered outdated.","helpText":null,"infoUrls":["https://learn.microsoft.com/en-us/defender-endpoint/mac-preferences#duration-for-security-intelligence-updates-due-in-days"],"options":null},{"id":"com.apple.managedclient.preferences_definitionupdatesinterval","displayName":"Security intelligence update interval (in seconds)","description":"Specifies the time interval (in seconds) after which security intelligence updates will be checked.","helpText":null,"infoUrls":["https://learn.microsoft.com/en-us/defender-endpoint/mac-preferences#security-intelligence-update-interval-in-seconds"],"options":null},{"id":"com.apple.managedclient.preferences_developertoolsavailability","displayName":"Control where developer tools can be used","description":"Control where developer tools can be used.\n\nIf you set this policy to 'DeveloperToolsDisallowedForForceInstalledExtensions' (0, the default), users can access the developer tools and the JavaScript console in general, but not in the context of extensions installed by enterprise policy.\n\nIf you set this policy to 'DeveloperToolsAllowed' (1), users can access the developer tools and the JavaScript console in all contexts, including extensions installed by enterprise policy.\n\nIf you set this policy to 'DeveloperToolsDisallowed' (2), users can't access the developer tools or inspect website elements. Keyboard shortcuts and menu or context menu entries that open the developer tools or the JavaScript Console are disabled.\n\n* 0 = Block the developer tools on extensions installed by enterprise policy, allow in other contexts\n\n* 1 = Allow using the developer tools\n\n* 2 = Don't allow using the developer tools","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#developertoolsavailability"],"options":[{"id":"com.apple.managedclient.preferences_developertoolsavailability_0","displayName":"Block the developer tools on extensions installed by enterprise policy, allow in other contexts","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_developertoolsavailability_1","displayName":"Allow using the developer tools","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_developertoolsavailability_2","displayName":"Don't allow using the developer tools","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_diagnosticdata","displayName":"Send required and optional diagnostic data about browser usage","description":"This policy controls sending required and optional diagnostic data about browser usage to Microsoft.\n\nRequired diagnostic data is collected keep Microsoft Edge secure, up to date and performing as expected.\n\nOptional diagnostic data includes data about how you use the browser, websites you visit and crash reports to Microsoft for product and service improvement.\n\nThis policy is not supported on Windows 10 devices. To control this data collection on Windows 10, IT admins must use the Windows diagnostic data group policy. This policy will either be 'Allow Telemetry' or 'Allow Diagnostic Data', depending on the version of Windows. Learn more about Windows 10 diagnostic data collection: https://go.microsoft.com/fwlink/?linkid=2099569\n\nUse one of the following settings to configure this policy:\n\n'Off' turns off required and optional diagnostic data collection. This option is not recommended.\n\n'RequiredData' sends required diagnostic data but turns off optional diagnostic data collection. Microsoft Edge will send required diagnostic data to keep Microsoft Edge secure, up to date and performing as expected.\n\n'OptionalData' sends optional diagnostic data includes data about browser usage, websites that are visited, crash reports sent to Microsoft for product and service improvement.\n\nOn Windows 7/macOS, this policy controls sending required and optional data to Microsoft.\n\nIf you don't configure this policy or disable it, Microsoft Edge will default to the user's preference.\n\nPolicy options mapping:\n\n* Off (0) = Off (Not recommended)\n\n* RequiredData (1) = Required data\n\n* OptionalData (2) = Optional data\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#diagnosticdata"],"options":[{"id":"com.apple.managedclient.preferences_diagnosticdata_0","displayName":"Off (Not recommended)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_diagnosticdata_1","displayName":"Required data","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_diagnosticdata_2","displayName":"Optional data","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_diagnosticdatatypepreference","displayName":"Diagnostic data level","description":"Controls the amount of telemetry data sent by apps.","helpText":null,"infoUrls":["https://aka.ms/macdiagpref"],"options":[{"id":"com.apple.managedclient.preferences_diagnosticdatatypepreference_0","displayName":"Required data only","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_diagnosticdatatypepreference_1","displayName":"Required and Optional data","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_diagnosticdatatypepreference_2","displayName":"Do not send data","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_diagnosticlevel","displayName":"Diagnostic collection level","description":"Diagnostic data is used to keep Microsoft Defender ATP secure and up-to-date, detect, diagnose and fix problems, and also make product improvements. This setting determines the level of diagnostics sent by the product to Microsoft.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#diagnostic-collection-level"],"options":[{"id":"com.apple.managedclient.preferences_diagnosticlevel_0","displayName":"optional","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_diagnosticlevel_1","displayName":"required","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disable3dapis","displayName":"Disable support for 3D graphics APIs","description":"Prevent web pages from accessing the graphics processing unit (GPU). Specifically, web pages can't access the WebGL API and plug-ins can't use the Pepper 3D API.\n\nIf you don't configure or disable this policy, it potentially allows web pages to use the WebGL API and plug-ins to use the Pepper 3D API. Microsoft Edge might, by default, still require command line arguments to be passed in order to use these APIs.\n\nIf \"HardwareAccelerationModeEnabled\" policy is set to false, the setting for 'Disable3DAPIs' policy is ignored - it's the equivalent of setting 'Disable3DAPIs' policy to true.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#disable3dapis"],"options":[{"id":"com.apple.managedclient.preferences_disable3dapis_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disable3dapis_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disableauthnegotiatecnamelookup","displayName":"Disable CNAME lookup when negotiating Kerberos authentication","description":"Determines whether the generated Kerberos SPN is based on the canonical DNS name (CNAME) or on the original name entered.\n\nIf you enable this policy, CNAME lookup is skipped and the server name (as entered) is used.\n\nIf you disable this policy or don't configure it, the canonical name of the server is used. This is determined through CNAME lookup.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#disableauthnegotiatecnamelookup"],"options":[{"id":"com.apple.managedclient.preferences_disableauthnegotiatecnamelookup_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disableauthnegotiatecnamelookup_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disableautoconfig","displayName":"Disable automatic sign in","description":"If you set this value to true the sync app is prevented from automatically signing in with an existing Azure AD credential that is made available to Microsoft applications.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#disableautoconfig"],"options":[{"id":"com.apple.managedclient.preferences_disableautoconfig_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disableautoconfig_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disablecloudfonts","displayName":"Disable cloud fonts","description":"Prevent users from selecting and downloading cloud-based fonts.","helpText":null,"infoUrls":["https://learn.microsoft.com/deployoffice/mac/preferences-office"],"options":[{"id":"com.apple.managedclient.preferences_disablecloudfonts_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disablecloudfonts_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disablednsovertcpparsing","displayName":"Disable DNS over TCP parsing","description":"Disables parsing of DNS over TCP","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_disablednsovertcpparsing_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disablednsovertcpparsing_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disablednsparsing","displayName":"Disable DNS parsing","description":"Disables parsing of DNS traffic","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_disablednsparsing_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disablednsparsing_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disabledonotforward","displayName":"Disable 'Do Not Forward' options","description":"Prevent users from applying the Do Not Forward option to emails when using Microsoft 365 Message Encryption.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#disable-do-not-forward"],"options":[{"id":"com.apple.managedclient.preferences_disabledonotforward_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disabledonotforward_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disableencryptonly","displayName":"Disable Microsoft 365 encryption options","description":"Prevent users from applying the Encrypt-Only option to emails when using Microsoft 365 Message Encryption.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#disable-encrypt-only"],"options":[{"id":"com.apple.managedclient.preferences_disableencryptonly_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disableencryptonly_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disableexport","displayName":"Disable export to OLM files","description":"Prevent users exporting data to the local file system.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#disable-export"],"options":[{"id":"com.apple.managedclient.preferences_disableexport_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disableexport_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disableftpparsing","displayName":"Disable FTP parsing","description":"Disables parsing of FTP traffic","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_disableftpparsing_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disableftpparsing_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disablehttpparsing","displayName":"Disable HTTP parsing","description":"Disables parsing of HTTP traffic","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_disablehttpparsing_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disablehttpparsing_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disablehydrationtoast","displayName":"Disable download toasts","description":"Prevents toasts from appearing when applications cause file contents to be downloaded.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#disablehydrationtoast"],"options":[{"id":"com.apple.managedclient.preferences_disablehydrationtoast_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disablehydrationtoast_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disableicmpparsing","displayName":"Disable ICMP parsing","description":"Disables parsing of ICMP traffic","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_disableicmpparsing_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disableicmpparsing_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disableimport","displayName":"Disable import from OLM and PST files","description":"Prevent users importing data from the local file system.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#disable-import"],"options":[{"id":"com.apple.managedclient.preferences_disableimport_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disableimport_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disableinboundconnectionfiltering","displayName":"Disable inbound connection filtering","description":"Disables filtering of inbound connections","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_disableinboundconnectionfiltering_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disableinboundconnectionfiltering_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disableinsidercheckbox","displayName":"Disable Office Insider membership","description":"Prevent users from changing to an Office Insider channel and obtaining Preview or Beta updates. The default value is false.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_disableinsidercheckbox_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disableinsidercheckbox_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disablepersonalsync","displayName":"Disable personal accounts","description":"Blocks users from signing in and syncing files in personal OneDrive accounts. If this key is set after a user has set up sync with a personal account, the user will be signed out.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#disablepersonalsync"],"options":[{"id":"com.apple.managedclient.preferences_disablepersonalsync_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disablepersonalsync_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disablerdpparsing","displayName":"Disable RDP parsing","description":"Disables parsing of RDP traffic","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_disablerdpparsing_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disablerdpparsing_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disablerespondtomeetingwithoutresponse","displayName":"Disable 'Do not send response'","description":"Prevent users from selecting 'Do not send response' when replying to a meeting request.","helpText":null,"infoUrls":["https://learn.microsoft.com/deployoffice/mac/preferences-outlook#disable-do-not-send-a-response"],"options":[{"id":"com.apple.managedclient.preferences_disablerespondtomeetingwithoutresponse_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disablerespondtomeetingwithoutresponse_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disablescreenshots","displayName":"Disable taking screenshots","description":"Controls if users can take screenshots of the browser page.\n\nIf enabled, user can't take screenshots by using keyboard shortcuts or extension APIs.\n\nIf disabled or don't configure this policy, users can take screenshots.\n\nPlease note this policy controls screenshots taken from within the browser itself. Even if you enable this policy, users might still be able to take screenshots using some method outside of the browser (like using an operating system feature or another application).","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#disablescreenshots"],"options":[{"id":"com.apple.managedclient.preferences_disablescreenshots_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disablescreenshots_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disablesignatures","displayName":"Disable email signatures","description":"Prevent users from adding, removing, and editing signatures","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#disable-signatures"],"options":[{"id":"com.apple.managedclient.preferences_disablesignatures_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disablesignatures_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disableskypemeeting","displayName":"Disable Skype for Business meeting support","description":"Prevent users from adding Skype for Business to meeting invites.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#disable-skype-for-business-online-meetings"],"options":[{"id":"com.apple.managedclient.preferences_disableskypemeeting_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disableskypemeeting_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disablesmimecompose","displayName":"Disable S/MIME","description":"Prevent users from applying S/MIME option to email messages.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#disable-smime"],"options":[{"id":"com.apple.managedclient.preferences_disablesmimecompose_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disablesmimecompose_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disablesmtpparsing","displayName":"Disable SMTP parsing","description":"Disables parsing of SMTP traffic","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_disablesmtpparsing_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disablesmtpparsing_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disablesshparsing","displayName":"Disable SSH parsing","description":"Disables parsing of SSH traffic","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_disablesshparsing_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disablesshparsing_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disableteamsmeeting","displayName":"Disable Microsoft Teams meeting support","description":"Prevent users from adding Teams to meeting invites.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#disable-teams-online-meetings"],"options":[{"id":"com.apple.managedclient.preferences_disableteamsmeeting_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disableteamsmeeting_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disabletlsparsing","displayName":"Disable TLS parsing","description":"Disables parsing of TLS traffic","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_disabletlsparsing_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disabletlsparsing_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disabletutorial","displayName":"Disable tutorial","description":"This setting prevents the tutorial from being shown to users after they set up OneDrive.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#disabletutorial"],"options":[{"id":"com.apple.managedclient.preferences_disabletutorial_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disabletutorial_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disablevisualbasicexternaldylibs","displayName":"Prevent Visual Basic macros from using external dynamic libraries","description":"Recommended: true, unless third-party add-ins and extensions are being used.","helpText":null,"infoUrls":["https://aka.ms/macvbpref"],"options":[{"id":"com.apple.managedclient.preferences_disablevisualbasicexternaldylibs_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disablevisualbasicexternaldylibs_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disablevisualbasicmacscript","displayName":"Prevent Visual Basic macros from using legacy MacScript","description":"Recommended: true.","helpText":null,"infoUrls":["https://aka.ms/macvbpref"],"options":[{"id":"com.apple.managedclient.preferences_disablevisualbasicmacscript_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disablevisualbasicmacscript_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disablevisualbasictobindtopopen","displayName":"Prevent Visual Basic macros from using pipes to communicate","description":"Recommended: true, unless third-party add-ins and extensions are being used.","helpText":null,"infoUrls":["https://aka.ms/macvbpref"],"options":[{"id":"com.apple.managedclient.preferences_disablevisualbasictobindtopopen_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_disablevisualbasictobindtopopen_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_disallowedthreatactions","displayName":"Disallowed threat actions","description":"Restricts the actions that the local user of a device can take when threats are detected. The actions included in this list are not displayed in the user interface.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#disallowed-threat-actions"],"options":null},{"id":"com.apple.managedclient.preferences_diskcachedir","displayName":"Set disk cache directory","description":"Configures the directory to use to store cached files.\n\nIf you enable this policy, Microsoft Edge uses the provided directory regardless of whether the user has specified the '--disk-cache-dir' flag. To avoid data loss or other unexpected errors, don't configure this policy to a volume's root directory or to a directory used for other purposes, because Microsoft Edge manages its contents.\n\nSee https://go.microsoft.com/fwlink/?linkid=2095041 for a list of variables you can use when specifying directories and paths.\n\nIf you don't configure this policy, the default cache directory is used, and users can override that default with the '--disk-cache-dir' command line flag.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#diskcachedir"],"options":null},{"id":"com.apple.managedclient.preferences_diskcachesize","displayName":"Set disk cache size, in bytes","description":"Configures the size of the cache, in bytes, used to store files on the disk.\n\nIf you enable this policy, Microsoft Edge uses the provided cache size regardless of whether the user has specified the '--disk-cache-size' flag. The value specified in this policy isn't a hard boundary but rather a suggestion to the caching system; any value below a few megabytes is too small and will be rounded up to a reasonable minimum.\n\nIf you set the value of this policy to 0, the default cache size is used, and users can't change it.\n\nIf you don't configure this policy, the default size is used, but users can override it with the '--disk-cache-size' flag.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#diskcachesize"],"options":null},{"id":"com.apple.managedclient.preferences_dnsinterceptionchecksenabled","displayName":"DNS interception checks enabled","description":"This policy configures a local switch that can be used to disable DNS interception checks. These checks attempt to discover whether the browser is behind a proxy that redirects unknown host names.\n\nThis detection might not be necessary in an enterprise environment where the network configuration is known. It can be disabled to avoid additional DNS and HTTP traffic on start-up and each DNS configuration change.\n\nIf you enable or don’t set this policy, the DNS interception checks are performed.\n\nIf you disable this policy, DNS interception checks aren’t performed.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#dnsinterceptionchecksenabled"],"options":[{"id":"com.apple.managedclient.preferences_dnsinterceptionchecksenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_dnsinterceptionchecksenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_dnsoverhttpsmode","displayName":"Control the mode of DNS-over-HTTPS","description":"Control the mode of the DNS-over-HTTPS resolver. Note that this policy will only set the default mode for each query. The mode can be overridden for special types of queries such as requests to resolve a DNS-over-HTTPS server hostname.\n\nThe \"off\" mode will disable DNS-over-HTTPS.\n\nThe \"automatic\" mode will send DNS-over-HTTPS queries first if a DNS-over-HTTPS server is available and may fallback to sending insecure queries on error.\n\nThe \"secure\" mode will only send DNS-over-HTTPS queries and will fail to resolve on error.\n\nIf you don't configure this policy, the browser might send DNS-over-HTTPS requests to a resolver associated with the user's configured system resolver.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#dnsoverhttpsmode"],"options":[{"id":"com.apple.managedclient.preferences_dnsoverhttpsmode_0","displayName":"Enable DNS-over-HTTPS with insecure fallback","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_dnsoverhttpsmode_1","displayName":"Disable DNS-over-HTTPS","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_dnsoverhttpsmode_2","displayName":"Enable DNS-over-HTTPS without insecure fallback","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_dnsoverhttpstemplates","displayName":"Specify URI template of desired DNS-over-HTTPS resolver","description":"The URI template of the desired DNS-over-HTTPS resolver. To specify multiple DNS-over-HTTPS resolvers, separate the corresponding URI templates with spaces.\n\nIf you set \"DnsOverHttpsMode\" to \"secure\" then this policy must be set and cannot be empty.\n\nIf you set \"DnsOverHttpsMode\" to \"automatic\" and this policy is set then the URI templates specified will be used. If you don't set this policy, then hardcoded mappings will be used to attempt to upgrade the user's current DNS resolver to a DoH resolver operated by the same provider.\n\nIf the URI template contains a dns variable, requests to the resolver will use GET; otherwise requests will use POST.\n\nIncorrectly formatted templates will be ignored.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#dnsoverhttpstemplates"],"options":null},{"id":"com.apple.managedclient.preferences_doubleclickclosetabenabled","displayName":"Double Click feature in Microsoft Edge enabled (only available in China)","description":"This policy lets you configure the double click feature in Microsoft Edge.\n\nDouble Click lets users close a tab by double clicking the left mouse button.\n\nIf you enable or don't configure this policy, you can use the double click feature to close a tab on Microsoft Edge to start using this feature.\n\nIf you disable this policy, you can't use the double click feature in Microsoft Edge.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#doubleclickclosetabenabled"],"options":[{"id":"com.apple.managedclient.preferences_doubleclickclosetabenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_doubleclickclosetabenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_downloadbandwidthlimited","displayName":"Set maximum download throughput","description":"Sets the maximum download throughput rate in kilobytes (KB)/sec for computers running the OneDrive sync app. The minimum rate is 50 KB/sec and the maximum rate is 100,000 KB/sec.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#downloadbandwidthlimited"],"options":null},{"id":"com.apple.managedclient.preferences_downloaddirectory","displayName":"Set download directory","description":"Configures the directory to use when downloading files.\n\nIf you enable this policy, Microsoft Edge uses the provided directory regardless of whether the user has specified one or chosen to be prompted for download location every time. See https://go.microsoft.com/fwlink/?linkid=2095041 for a list of variables that can be used.\n\nIf you disable or don't configure this policy, the default download directory is used, and the user can change it.\n\nIf you set an invalid path, Microsoft Edge will default to the user's default download directory.\n\nIf the folder specified by the path doesn't exist, the download will trigger a prompt that asks the user where they want to save their download.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#downloaddirectory"],"options":null},{"id":"com.apple.managedclient.preferences_downloadrestrictions","displayName":"Allow download restrictions","description":"Configures the type of downloads that Microsoft Edge completely blocks, without letting users override the security decision.\n\nSet 'Block dangerous downloads' (1) to allow all downloads except for those that carry Microsoft Defender SmartScreen warnings.\n\nSet 'Block potentially dangerous downloads' (2) to allow all downloads except for those that carry Microsoft Defender SmartScreen warnings of potentially dangerous downloads.\n\nSet 'Block all downloads' (3) to block all downloads.\n\nIf you don't configure this policy or set the 'No special restrictions' (0) option, the downloads go through the usual security restrictions based on Microsoft Defender SmartScreen analysis results.\n\nNote that these restrictions apply to downloads from web page content, as well as the 'download link...' context menu option. These restrictions don't apply to saving or downloading the currently displayed page, nor do they apply to the Save as PDF option from the printing options.\n\nSee https://go.microsoft.com/fwlink/?linkid=2094934 for more info on Microsoft Defender SmartScreen.\n\n* 0 = No special restrictions\n\n* 1 = Block dangerous downloads\n\n* 2 = Block potentially dangerous downloads\n\n* 3 = Block all downloads","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#downloadrestrictions"],"options":[{"id":"com.apple.managedclient.preferences_downloadrestrictions_0","displayName":"No special restrictions","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_downloadrestrictions_1","displayName":"Block dangerous downloads","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_downloadrestrictions_2","displayName":"Block potentially dangerous downloads","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_downloadrestrictions_3","displayName":"Block all downloads","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_downloadrestrictions_4","displayName":"Block malicious downloads","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_earlypreview","displayName":"Enable / disable early preview","description":"Whether EDR early preview features are enabled or not.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#enable--disable-early-preview"],"options":[{"id":"com.apple.managedclient.preferences_earlypreview_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_earlypreview_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_edgeassetdeliveryserviceenabled","displayName":"Allow features to download assets from the Asset Delivery Service","description":"The Asset Delivery Service is a general pipeline used to deliver assets to the Microsoft Edge Clients.\nThese assets can be config files or Machine Learning models that power the features that use this service.\n\nIf you enable or don't configure this policy, features can download assets from the Asset Delivery Service.\n\nIf you disable this policy, features won't be able to download assets needed for them to run correctly.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#edgeassetdeliveryserviceenabled"],"options":[{"id":"com.apple.managedclient.preferences_edgeassetdeliveryserviceenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_edgeassetdeliveryserviceenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_edgecollectionsenabled","displayName":"Enable the Collections feature","description":"Lets you allow users to access the Collections feature, where they can collect, organize, share, and export content more efficiently and with Office integration.\n\nIf you enable or don't configure this policy, users can access and use the Collections feature in Microsoft Edge.\n\nIf you disable this policy, users can't access and use Collections in Microsoft Edge.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#edgecollectionsenabled"],"options":[{"id":"com.apple.managedclient.preferences_edgecollectionsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_edgecollectionsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_edgedisabledialprotocolforcastdiscovery","displayName":"Disable DIAL protocol for cast device discovery","description":"Enable this policy to disable the DIAL (Discovery And Launch) protocol for cast device discovery. (If EnableMediaRouter is disabled, this policy will have no effect).\n\nEnable this policy to disable DIAL protocol.\n\nBy default, Cast device discovery will use DIAL protocol.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#edgedisabledialprotocolforcastdiscovery"],"options":[{"id":"com.apple.managedclient.preferences_edgedisabledialprotocolforcastdiscovery_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_edgedisabledialprotocolforcastdiscovery_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_edgeedropenabled","displayName":"Enable Drop feature in Microsoft Edge","description":"This policy lets you configure the Drop feature in Microsoft Edge.\n\nDrop lets users send messages or files to themselves.\n\nIf you enable or don't configure this policy, you can use the Drop feature in Microsoft Edge.\n\nIf you disable this policy, you can't use the Drop feature in Microsoft Edge.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#edgeedropenabled"],"options":[{"id":"com.apple.managedclient.preferences_edgeedropenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_edgeedropenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_edgeentracopilotpagecontext","displayName":"Control Copilot access to Microsoft Edge page content for Entra account user profiles when using Copilot in the Microsoft Edge sidepane","description":"This policy controls whether Copilot in the Microsoft Edge sidepane can access Microsoft Edge page content. This includes page summarization and similar contextual queries sent to Copilot.\n\nThis policy only applies to users who are signed in to Microsoft Edge with their Entra account and are using Copilot in the sidepane. This policy applies to all Copilot products in the Microsoft Edge sidepane - namely, Microsoft 365 Copilot Business Chat and Microsoft Copilot with enterprise data protection (EDP).\n\nIf you enable this policy, Copilot will be able to access Microsoft Edge page content when users ask a contextual query to Copilot in the Microsoft Edge sidepane.\n\nIf you disable this policy, Copilot will not be able to access Microsoft Edge page content.\n\nIf you don't configure this policy, the default behavior is as follows:\n\n- For non-EU countries, access is enabled by default.\n\n- For EU countries, access is disabled by default.\n\n- In both cases, if the policy is not configured, users can enable or disable Copilot access to Microsoft Edge page content using the toggle in Microsoft Edge settings.\n\nExceptions to the preceding behavior include when a page is protected using data loss prevention (DLP) measures. In that case, Copilot will not be able to access Microsoft Edge page content even when this policy is enabled. This behavior is to ensure the integrity of DLP.\n\nLearn more about Copilot's data usage and consent at https://go.microsoft.com/fwlink/?linkid=2288056","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#edgeentracopilotpagecontext"],"options":[{"id":"com.apple.managedclient.preferences_edgeentracopilotpagecontext_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_edgeentracopilotpagecontext_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_edgemanagementextensionsfeedbackenabled","displayName":"Microsoft Edge management extensions feedback enabled","description":"This setting controls whether Microsoft Edge sends data about blocked extensions to the Microsoft Edge management service.\n\nThe 'EdgeManagementEnabled' policy must also be enabled for this setting to take effect.\n\nIf you enable this policy, Microsoft Edge will send data to the Microsoft Edge service when a user tries to install a blocked extension.\n\nIf you disable or don't configure this policy, Microsoft Edge won't send any data to the Microsoft Edge service about blocked extensions.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#edgemanagementextensionsfeedbackenabled"],"options":[{"id":"com.apple.managedclient.preferences_edgemanagementextensionsfeedbackenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_edgemanagementextensionsfeedbackenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_edgemanagementpolicyoverridesplatformpolicy","displayName":"Microsoft Edge management service policy overrides platform policy.","description":"If you enable this policy, the cloud-based Microsoft Edge management service policy takes precedence if it conflicts with platform policy.\n\nIf you disable or don't configure this policy, platform policy takes precedence if it conflicts with the cloud-based Microsoft Edge management service policy.\n\nThis mandatory policy affects machine scope cloud-based Microsoft Edge management policies.\n\nMachine policies apply to all edge browser instances regardless of the user who is logged in.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#edgemanagementpolicyoverridesplatformpolicy"],"options":[{"id":"com.apple.managedclient.preferences_edgemanagementpolicyoverridesplatformpolicy_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_edgemanagementpolicyoverridesplatformpolicy_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_edgemanagementuserpolicyoverridescloudmachinepolicy","displayName":"Allow cloud-based Microsoft Edge management service user policies to override local user policies.","description":"If you enable this policy, cloud-based Microsoft Edge management service user policies takes precedence if it conflicts with local user policy.\n\nIf you disable or don't configure this policy, Microsoft Edge management service user policies will take precedence.\n\nThe policy can be combined with \"EdgeManagementPolicyOverridesPlatformPolicy\". If both policies are enabled, all cloud-based Microsoft Edge management service policies will take precedence over conflicting local service policies.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#edgemanagementuserpolicyoverridescloudmachinepolicy"],"options":[{"id":"com.apple.managedclient.preferences_edgemanagementuserpolicyoverridescloudmachinepolicy_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_edgemanagementuserpolicyoverridescloudmachinepolicy_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_edgeshoppingassistantenabled","displayName":"Shopping in Microsoft Edge Enabled","description":"This policy lets users compare the prices of a product they are looking at, get coupons from the website they're on, or auto-apply coupons during checkout.\n\nIf you enable or don't configure this policy, shopping features such as price comparison and coupons will be automatically applied for retail domains. Coupons for the current retailer and prices from other retailers will be fetched from a server.\n\nIf you disable this policy shopping features such as price comparison and coupons will not be automatically found for retail domains.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#edgeshoppingassistantenabled"],"options":[{"id":"com.apple.managedclient.preferences_edgeshoppingassistantenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_edgeshoppingassistantenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_edgesidebarappurlhostallowlist","displayName":"Allow specific apps to be opened in Microsoft Edge sidebar","description":"Define a list of sites, based on URL patterns, that are not subject to the \"EdgeSidebarAppUrlHostBlockList\".\n\nIf you don't configure this policy, a user can open any app in sidebar except the urls listed in \"EdgeSidebarAppUrlHostBlockList\".\n\nIf you configure this policy, the apps listed in the allow list could be opened in sidebar even if they are listed in the block list.\n\nBy default, all apps are allowed. However, if you prohibited apps by policy, you can use the list of allowed apps to change that policy.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2281313.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#edgesidebarappurlhostallowlist"],"options":null},{"id":"com.apple.managedclient.preferences_edgesidebarappurlhostblocklist","displayName":"Control which apps cannot be opened in Microsoft Edge sidebar","description":"Define a list of sites, based on URL patterns, that cannot be opened in sidebar.\n\nIf you don't configure this policy, a user can open any app in sidebar.\n\nIf the \"HubsSidebarEnabled\" policy is disabled, this list isn't used and no sidebar can be opened.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2281313.\n\nNote: A blocklist value of '*' means all apps are blocked unless they are explicitly listed in the \"EdgeSidebarAppUrlHostAllowList\" policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#edgesidebarappurlhostblocklist"],"options":null},{"id":"com.apple.managedclient.preferences_edgesidebarcustomizeenabled","displayName":"Enable sidebar customize","description":"Allow/Disallow to use sidebar customize.\n\nIf you enable or don't configure this policy, users will be able to access sidebar customize.\nIf you disable this policy, users will not be able to access the sidebar customize.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#edgesidebarcustomizeenabled"],"options":[{"id":"com.apple.managedclient.preferences_edgesidebarcustomizeenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_edgesidebarcustomizeenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_edgewalletetreeenabled","displayName":"Edge Wallet E-Tree Enabled","description":"The Edge Wallet E-Tree feature in Microsoft Edge allows users to plant a E-Tree for their own.\n\nIf you enable or don't configure this policy, users can use the Edge Wallet E-Tree feature.\n\nIf you disable this policy, users can't use the Edge Wallet E-Tree feature.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#edgewalletetreeenabled"],"options":[{"id":"com.apple.managedclient.preferences_edgewalletetreeenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_edgewalletetreeenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_edgeworkspacesenabled","displayName":"Enable Workspaces","description":"Microsoft Edge Workspaces helps improve productivity for users in your organization.\n\nIf you enable or don't configure this policy, users will be able to access the Microsoft Edge Workspaces feature.\nIf you disable this policy, users will not be able to access the Microsoft Edge Workspaces feature.\n\nTo learn more about the feature, see https://go.microsoft.com/fwlink/?linkid=2209950","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#edgeworkspacesenabled"],"options":[{"id":"com.apple.managedclient.preferences_edgeworkspacesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_edgeworkspacesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_editfavoritesenabled","displayName":"Allows users to edit favorites","description":"Enable this policy to let users add, remove, and modify favorites. This is the default behavior if you don't configure the policy.\n\nDisable this policy to stop users from adding, removing, or modifying favorites. They can still use existing favorites.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#editfavoritesenabled"],"options":[{"id":"com.apple.managedclient.preferences_editfavoritesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_editfavoritesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_efficiencymode","displayName":"Configure when efficiency mode should become active","description":"This policy setting lets you configure when efficiency mode becomes active. By default, efficiency mode is set to 'BalancedSavings'. On devices with no battery, efficiency mode is disabled by default and does not become active. Please note that Windows Energy Saver settings can influence when efficiency mode becomes active on all devices.\n\nIndividual sites may be blocked from participating in efficiency mode by configuring the policy \"SleepingTabsBlockedForUrls\".\n\nSet this policy to 'AlwaysActive' and efficiency mode is always active.\n\nSet this policy to 'NeverActive' and efficiency mode never becomes active.\n\nSet this policy to 'ActiveWhenUnplugged' and efficiency mode becomes active when the device is unplugged.\n\nSet this policy to 'ActiveWhenUnpluggedBatteryLow' and efficiency mode becomes active when the device is unplugged and the battery is low.\n\nSet this policy to 'BalancedSavings' and when the device is unplugged, efficiency mode takes moderate steps to save battery. When the device is unplugged and the battery is low, efficiency mode takes extra steps to save battery.\n\nSet this policy to 'MaximumSavings' and when the device is unplugged or unplugged and the battery is low, efficiency mode takes extra steps to save battery.\n\nIf the device does not have a battery, efficiency mode never becomes active in any mode other than 'AlwaysActive' unless the setting or \"EfficiencyModeEnabled\" policy is enabled.\n\nThis policy has no effect if the \"EfficiencyModeEnabled\" policy is disabled.\n\nLearn more about efficiency mode: https://go.microsoft.com/fwlink/?linkid=2173921\n\nLearn more about energy saver: https://learn.microsoft.com/en-us/windows-hardware/design/component-guidelines/energy-saver\n\nPolicy options mapping:\n\n* AlwaysActive (0) = Efficiency mode is always active\n\n* NeverActive (1) = Efficiency mode is never active\n\n* ActiveWhenUnplugged (2) = Efficiency mode is active when the device is unplugged\n\n* ActiveWhenUnpluggedBatteryLow (3) = Efficiency mode is active when the device is unplugged and the battery is low\n\n* BalancedSavings (4) = When the device is unplugged, efficiency mode takes moderate steps to save battery. When the device is unplugged and the battery is low, efficiency mode takes extra steps to save battery.\n\n* MaximumSavings (5) = When the device is unplugged or unplugged and the battery is low, efficiency mode takes extra steps to save battery.\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#efficiencymode"],"options":[{"id":"com.apple.managedclient.preferences_efficiencymode_0","displayName":"Efficiency mode is always active","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_efficiencymode_1","displayName":"Efficiency mode is never active","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_efficiencymode_2","displayName":"Efficiency mode is active when the device is unplugged","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_efficiencymode_3","displayName":"Efficiency mode is active when the device is unplugged and the battery is low","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_efficiencymode_4","displayName":"When the device is unplugged, efficiency mode takes moderate steps to save battery. When the device is unplugged and the battery is low, efficiency mode takes extra steps to save battery.","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_efficiencymode_5","displayName":"When the device is unplugged or unplugged and the battery is low, efficiency mode takes extra steps to save battery.","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_efficiencymodeenabled","displayName":"Efficiency mode enabled","description":"Enables efficiency mode which helps extend battery life by saving computer resources. By default, efficiency mode is enabled for devices with a battery and disabled otherwise.\n\nIf you enable this policy, efficiency mode will become active according to the setting chosen by the user. You can configure the efficiency mode setting using the \"EfficiencyMode\" policy. If the device does not have a battery, efficiency mode will always be active.\n\nIf you disable this policy, efficiency mode will never become active. The \"EfficiencyMode\" and \"EfficiencyModeOnPowerEnabled\" policies will have no effect.\n\nIf you don't configure this policy, efficiency mode will be enabled for devices with a battery and disabled otherwise. Users can choose the efficiency mode option they want in edge://settings/system.\n\nLearn more about efficiency mode: https://go.microsoft.com/fwlink/?linkid=2173921","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#efficiencymodeenabled"],"options":[{"id":"com.apple.managedclient.preferences_efficiencymodeenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_efficiencymodeenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_efficiencymodeonpowerenabled","displayName":"Enable efficiency mode when the device is connected to a power source","description":"Allows efficiency mode to become active when the device is connected to a power source. On devices with no battery, this policy has no effect.\n\nIf you enable this policy, efficiency mode will become active when the device is connected to a power source.\n\nIf you disable or don't configure this policy, efficiency mode will never become active when the device is connected to a power source.\n\nThis policy has no effect if the \"EfficiencyModeEnabled\" policy is disabled.\n\nLearn more about efficiency mode: https://go.microsoft.com/fwlink/?linkid=2173921","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#efficiencymodeonpowerenabled"],"options":[{"id":"com.apple.managedclient.preferences_efficiencymodeonpowerenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_efficiencymodeonpowerenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enableallocsiclients","displayName":"Enable simultaneous edits for Office apps","description":"This setting lets multiple users use the Microsoft 365 Apps for enterprise, Office 2019, or Office 2016 desktop apps to simultaneously edit an Office file stored in OneDrive. It also lets users share files from the Office desktop apps.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#enableallocsiclients"],"options":[{"id":"com.apple.managedclient.preferences_enableallocsiclients_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enableallocsiclients_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enableauthnegotiateport","displayName":"Include non-standard port in Kerberos SPN","description":"Specifies whether the generated Kerberos SPN should include a non-standard port.\n\nIf you enable this policy, and a user includes a non-standard port (a port other than 80 or 443) in a URL, that port is included in the generated Kerberos SPN.\n\nIf you don't configure or disable this policy, the generated Kerberos SPN won't include a port in any case.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#enableauthnegotiateport"],"options":[{"id":"com.apple.managedclient.preferences_enableauthnegotiateport_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enableauthnegotiateport_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enablebackgroundaccessibilitychecker","displayName":"Background accessibility checking","description":"The background accessibility checker automatically helps find and fix content in documents that may make it harder for people with disabilities to consume.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_enablebackgroundaccessibilitychecker_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enablebackgroundaccessibilitychecker_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enablecheckforupdatesbutton","displayName":"Enable check for updates","description":"Allow users to check for app updates. The default value is true.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_enablecheckforupdatesbutton_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enablecheckforupdatesbutton_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enabled","displayName":"Enable / disable cloud delivered protection","description":"Whether cloud delivered protection is enabled on the device or not. To improve the security of your services, we recommend keeping this feature turned on.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#enable--disable-cloud-delivered-protection"],"options":[{"id":"com.apple.managedclient.preferences_enabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enabledeprecatedwebplatformfeatures","displayName":"Re-enable deprecated web platform features for a limited time","description":"Specify a list of deprecated web platform features to temporarily re-enable.\n\nThis policy lets you re-enable deprecated web platform features for a limited time. Features are identified by a string tag.\n\nIf you don't configure this policy, if the list is empty, or if a feature doesn't match one of the supported string tags, all deprecated web platform features remain disabled.\n\nWhile the policy itself is supported on the above platforms, the feature it's enabling might not be available on all of those platforms. Not all deprecated Web Platform features can be re-enabled. Only those explicitly listed below can be re-enabled, and only for a limited period of time, which differs per feature. You can review the intent behind the Web Platform feature changes at https://bit.ly/blinkintents.\n\nThe general format of the string tag is [DeprecatedFeatureName]_EffectiveUntil[yyyymmdd].\n\n* \"ExampleDeprecatedFeature_EffectiveUntil20080902\" = Enable ExampleDeprecatedFeature API through 2008/09/02","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#enabledeprecatedwebplatformfeatures"],"options":null},{"id":"com.apple.managedclient.preferences_enabledomainactionsdownload","displayName":"Enable Domain Actions Download from Microsoft","description":"In Microsoft Edge, Domain Actions represent a series of compatibility features that help the browser work correctly on the web.\n\nMicrosoft keeps a list of actions to take on certain domains for compatibility reasons. For example, the browser may override the User Agent string on a website if that website is broken due to the new User Agent string on Microsoft Edge. Each of these actions is intended to be temporary while Microsoft tries to resolve the issue with the site owner.\n\nWhen the browser starts up and then periodically afterwards, the browser will contact the Experimentation and Configuration Service that contains the most up to date list of compatibility actions to perform. This list is saved locally after it is first retrieved so that subsequent requests will only update the list if the server's copy has changed.\n\nIf you enable this policy, the list of Domain Actions will continue to be downloaded from the Experimentation and Configuration Service.\n\nIf you disable this policy, the list of Domain Actions will no longer be downloaded from the Experimentation and Configuration Service.\n\nIf you don't configure this policy, the list of Domain Actions will continue to be downloaded from the Experimentation and Configuration Service.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#enabledomainactionsdownload"],"options":[{"id":"com.apple.managedclient.preferences_enabledomainactionsdownload_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enabledomainactionsdownload_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enablefilehashcomputation","displayName":"Enable file hash computation","description":"Enables or disables file hash computation feature. When this feature is enabled Windows defender will compute hashes for files it scans. This will help in improving the accuracy of Custom Indicator matches. However, enabling Enable file hash computation may impact device performance.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-preferences?view=o365-worldwide#configure-file-hash-computation-feature"],"options":[{"id":"com.apple.managedclient.preferences_enablefilehashcomputation_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enablefilehashcomputation_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enablemediarouter","displayName":"Enable Google Cast","description":"Enable this policy to enable Google Cast. Users will be able to launch it from the app menu, page context menus, media controls on Cast-enabled websites, and (if shown) the Cast toolbar icon.\n\nDisable this policy to disable Google Cast.\n\nBy default, Google Cast is enabled.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#enablemediarouter"],"options":[{"id":"com.apple.managedclient.preferences_enablemediarouter_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enablemediarouter_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enablenewoutlook","displayName":"Enable New Outlook","description":"Specify whether users should be allowed to switch between Classic and New Outlook.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#enable-new-outlook"],"options":[{"id":"com.apple.managedclient.preferences_enablenewoutlook_0","displayName":"Classic Outlook only","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enablenewoutlook_1","displayName":"Default to Classic Outlook. Users may switch to New Outlook","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enablenewoutlook_2","displayName":"Default to New Outlook. Users may revert to Classic Outlook","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enablenewoutlook_3","displayName":"New Outlook only","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enableodignore","displayName":"Ignore named files","description":"This setting lets you enter keywords to prevent the OneDrive sync app from uploading certain files to OneDrive or SharePoint. You can enter complete names, such as setup.bin or use the asterisk (*) as a wildcard character to represent a series of characters, such as *.eml. Keywords aren't case-sensitive.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#allow-only-corporate-mailboxes-to-be-added"],"options":null},{"id":"com.apple.managedclient.preferences_enableonlinerevocationchecks","displayName":"Enable online OCSP/CRL checks","description":"Online revocation checks don't provide a significant security benefit and are disabled by default.\n\nIf you enable this policy, Microsoft Edge will perform soft-fail, online OCSP/CRL checks. \"Soft fail\" means that if the revocation server can't be reached, the certificate will be considered valid.\n\nIf you disable the policy or don't configure it, Microsoft Edge won't perform online revocation checks.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#enableonlinerevocationchecks"],"options":[{"id":"com.apple.managedclient.preferences_enableonlinerevocationchecks_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enableonlinerevocationchecks_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enablerealtimeprotection","displayName":"Enable real-time protection (deprecated)","description":"Whether real-time protection (scan files as they are accessed) is enabled or not.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#enable--disable-real-time-protection"],"options":[{"id":"com.apple.managedclient.preferences_enablerealtimeprotection_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enablerealtimeprotection_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enablesetwarntoblock","displayName":"Enable set warn to block","description":"Converts warn determinations into blocks","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_enablesetwarntoblock_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enablesetwarntoblock_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enablesha1forlocalanchors","displayName":"Allow certificates signed using SHA-1 when issued by local trust anchors","description":"When this setting is enabled, Microsoft Edge allows connections secured by SHA-1 signed certificates so long as the the certificate chains to a locally-installed root certificate and is otherwise valid.\n\nNote that this policy depends on the operating system (OS) certificate verification stack allowing SHA-1 signatures. If an OS update changes the OS handling of SHA-1 certificates, this policy might no longer have effect. Further, this policy is intended as a temporary workaround to give enterprises more time to move away from SHA-1. This policy will be removed in Microsoft Edge 92 releasing in mid 2021.\n\nIf you don't set this policy or set it to false, or the SHA-1 certificate chains to a publicly trusted certificate root, then Microsoft Edge won't allow certificates signed by SHA-1.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#enablesha1forlocalanchors"],"options":[{"id":"com.apple.managedclient.preferences_enablesha1forlocalanchors_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enablesha1forlocalanchors_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_encryptedclienthelloenabled","displayName":"TLS Encrypted ClientHello Enabled","description":"Encrypted ClientHello (ECH) is an extension to TLS that encrypts the sensitive fields of ClientHello to improve privacy.\n\nIf ECH is enabled, Microsoft Edge might or might not use ECH depending on server support, the availability of the HTTPS DNS record, or the rollout status.\n\nIf you enable or do not configure this policy, Microsoft Edge will follow the default rollout process for ECH.\n\nIf this policy is disabled, Microsoft Edge will not enable ECH.\n\nBecause ECH is an evolving protocol, Microsoft Edge's implementation is subject to change.\n\nAs such, this policy is a temporary measure to control the initial experimental implementation. It will be replaced with final controls as the protocol finalizes.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#encryptedclienthelloenabled"],"options":[{"id":"com.apple.managedclient.preferences_encryptedclienthelloenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_encryptedclienthelloenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enforcementlevel","displayName":"Enforcement level","description":"Specifies if network protection is disabled, in audit mode, or enforced","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_enforcementlevel_0","displayName":"disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enforcementlevel_1","displayName":"audit","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enforcementlevel_2","displayName":"block","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enforcementlevel_antivirusengine","displayName":"Enforcement level","description":"Antivirus engine enforcement mode","helpText":null,"infoUrls":["https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-preferences#enforcement-level-for-antivirus-engine"],"options":[{"id":"com.apple.managedclient.preferences_enforcementlevel_antivirusengine_0","displayName":"passive","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enforcementlevel_antivirusengine_1","displayName":"on_demand","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enforcementlevel_antivirusengine_2","displayName":"real_time","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enforcementlevel_tamperprotection","displayName":"Enforcement level","description":"Specifies if tamper protection is disabled, in audit mode, or enforced","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_enforcementlevel_tamperprotection_0","displayName":"disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enforcementlevel_tamperprotection_1","displayName":"audit","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enforcementlevel_tamperprotection_2","displayName":"block","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enhancesecuritymode","displayName":"Enhance the security state in Microsoft Edge","description":"This policy lets you enhance the security state in Microsoft Edge.\n\nIf you set this policy to 'StandardMode', the enhanced mode will be turned off and Microsoft Edge will fallback to its standard security mode.\n\nIf you set this policy to 'BalancedMode', the security state will be in balanced mode.\n\nIf you set this policy to 'StrictMode', the security state will be in strict mode.\n\nIf you set this policy to 'BasicMode', the security state will be in basic mode.\n\nNote: Sites that use WebAssembly (WASM) are not supported on 32-bit systems when \"EnhanceSecurityMode\" is enabled. If you require access to a site that uses WASM, consider adding it to your exception list as described in https://go.microsoft.com/fwlink/?linkid=2183321.\n\nStarting in Microsoft Edge 113, 'BasicMode' is deprecated and is treated the same as 'BalancedMode'. It won't work in Microsoft Edge version 116.\n\nFor detailed information about Enhanced Security Mode, see https://go.microsoft.com/fwlink/?linkid=2185895\n\nPolicy options mapping:\n\n* StandardMode (0) = Standard mode\n\n* BalancedMode (1) = Balanced mode\n\n* StrictMode (2) = Strict mode\n\n* BasicMode (3) = (Deprecated) Basic mode\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#enhancesecuritymode"],"options":[{"id":"com.apple.managedclient.preferences_enhancesecuritymode_0","displayName":"Standard mode","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enhancesecuritymode_1","displayName":"Balanced mode","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enhancesecuritymode_2","displayName":"Strict mode","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enhancesecuritymode_3","displayName":"(Deprecated) Basic mode","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enhancesecuritymodebypasslistdomains","displayName":"Configure the list of domains for which enhance security mode will not be enforced","description":"Configure the list of enhance security trusted domains. This means that\nenhance security mode will not be enforced when loading the sites in trusted domains.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#enhancesecuritymodebypasslistdomains"],"options":null},{"id":"com.apple.managedclient.preferences_enhancesecuritymodeenforcelistdomains","displayName":"Configure the list of domains for which enhance security mode will always be enforced","description":"Configure the list of enhance security untrusted domains. This means that\nenhance security mode will always be enforced when loading the sites in untrusted domains.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#enhancesecuritymodeenforcelistdomains"],"options":null},{"id":"com.apple.managedclient.preferences_enhancesecuritymodeindicatoruienabled","displayName":"Manage the indicator UI of the Enhanced Security Mode (ESM) feature in Microsoft Edge","description":"This policy lets you manage whether the indicator User Interface (UI) for enhanced security mode is shown or not when ESM is turned on.\n\nIf you enable or don't configure this policy, the indicator UI is on.\n\nIf you disable this policy, the indicator UI is off.\n\nNote: If this policy is used, only the indicator User Interface experience is supressed - ESM is still turned on. For more information, see the \"EnhanceSecurityMode\" policy.\n\nFor detailed information about Enhanced Security Mode, see https://go.microsoft.com/fwlink/?linkid=2185895","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#enhancesecuritymodeindicatoruienabled"],"options":[{"id":"com.apple.managedclient.preferences_enhancesecuritymodeindicatoruienabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enhancesecuritymodeindicatoruienabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enhancesecuritymodeoptoutuxenabled","displayName":"Manage opt-out user experience for Enhanced Security Mode (ESM) in Microsoft Edge (Deprecated)","description":"This policy lets you manage whether the opt-out user experience for enhanced security mode is presented when ESM is turned on for Microsoft Edge.\n\nIf you enable or don't configure this policy, the UI for the opt-out user experience is on.\n\nIf you disable this policy, the UI for the opt-out user experience is off.\n\nNote: If this policy is used, only the User Interface for the opt-out experience is supressed - ESM is still turned on. For more information, see the \"EnhanceSecurityMode\" policy.\n\nFor detailed information about Enhanced Security Mode, see https://go.microsoft.com/fwlink/?linkid=2185895.\n\nAfter careful evaluation, we have determined that this experimental opt-out UX is not required. As a result, this policy will be deprecated and stop working after Edge version 130.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#enhancesecuritymodeoptoutuxenabled"],"options":[{"id":"com.apple.managedclient.preferences_enhancesecuritymodeoptoutuxenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enhancesecuritymodeoptoutuxenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_enterprisehardwareplatformapienabled","displayName":"Allow managed extensions to use the Enterprise Hardware Platform API","description":"When this policy is set to enabled, extensions installed by enterprise policy are allowed to use the Enterprise Hardware Platform API.\nWhen this policy is set to disabled or isn't set, no extensions are allowed to use the Enterprise Hardware Platform API.\nThis policy also applies to component extensions.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#enterprisehardwareplatformapienabled"],"options":[{"id":"com.apple.managedclient.preferences_enterprisehardwareplatformapienabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_enterprisehardwareplatformapienabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_exclusions","displayName":"Scan exclusions","description":"Entities that have been excluded from the scan. Exclusions can be specified by full paths, extensions, or file names.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#scan-exclusions"],"options":null},{"id":"com.apple.managedclient.preferences_exclusions_item_$type","displayName":"Type","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_exclusions_item_$type_0","displayName":"Path","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_exclusions_item_$type_1","displayName":"File extension","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_exclusions_item_$type_2","displayName":"File name","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_exclusions_item_args_tamperprotection","displayName":"Process's arguments","description":"Command line arguments","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_exclusions_item_extension","displayName":"File extension","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_exclusions_item_isdirectory","displayName":"Directory (selected) or file (not selected)","description":"Directory if selected, or file if not selected","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_exclusions_item_isdirectory_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_exclusions_item_isdirectory_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_exclusions_item_name","displayName":"Name","description":"Process name, either or full path or file name, wildcards supported","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_exclusions_item_path","displayName":"Path","description":"Path to exclude, wildcards are supported","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_exclusions_item_path_tamperprotection","displayName":"Process path","description":"Full and exact path to the process binary","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_exclusions_item_signingid_tamperprotection","displayName":"Process's Signing Identifier","description":"Code signature Identifier","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_exclusions_item_teamid_tamperprotection","displayName":"Process's TeamIdentifier","description":"Code signature TeamIdentifier","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_exclusions_tamperprotection","displayName":"Process exclusions","description":"Defines process that can interfere with Defender without considering it tampering","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_exclusionsmergepolicy","displayName":"Exclusions merge","description":"Specify the merge policy for exclusions. This can be a combination of administrator-defined and user-defined exclusions (merge) or only administrator-defined exclusions (admin_only). This setting can be used to restrict local users from defining their own exclusions.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#exclusion-merge-policy"],"options":[{"id":"com.apple.managedclient.preferences_exclusionsmergepolicy_0","displayName":"merge","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_exclusionsmergepolicy_1","displayName":"admin_only","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_exemptdomainfiletypepairsfromfiletypedownloadwarnings","displayName":"Disable download file type extension-based warnings for specified file types on domains","description":"You can enable this policy to create a dictionary of file type extensions with a corresponding list of domains that will be exempted from file type extension-based download warnings. This lets enterprise administrators block file type extension-based download warnings for files that are associated with a listed domain. For example, if the \"jnlp\" extension is associated with \"website1.com\", users would not see a warning when downloading \"jnlp\" files from \"website1.com\", but see a download warning when downloading \"jnlp\" files from \"website2.com\".\n\nFiles with file type extensions specified for domains identified by this policy will still be subject to non-file type extension-based security warnings such as mixed-content download warnings and Microsoft Defender SmartScreen warnings.\n\nIf you disable this policy or don't configure it, file types that trigger extension-based download warnings will show warnings to the user.\n\nIf you enable this policy:\n\n* The URL pattern should be formatted according to https://go.microsoft.com/fwlink/?linkid=2095322.\n* The file type extension entered must be in lower-cased ASCII. The leading separator should not be included when listing the file type extension, so list \"jnlp\" should be used instead of \".jnlp\".\n\nExample:\n\nThe following example value would prevent file type extension-based download warnings on swf, exe, and jnlp extensions for *.contoso.com domains. It will show the user a file type extension-based download warning on any other domain for exe and jnlp files, but not for swf files.\n\n[\n { \"file_extension\": \"jnlp\", \"domains\": [\"contoso.com\"] },\n { \"file_extension\": \"exe\", \"domains\": [\"contoso.com\"] },\n { \"file_extension\": \"swf\", \"domains\": [\"*\"] }\n]\n\nNote that while the preceding example shows the suppression of file type extension-based download warnings for \"swf\" files for all domains, applying suppression of such warnings for all domains for any dangerous file type extension is not recommended due to security concerns. It is shown in the example merely to demonstrate the ability to do so.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#exemptdomainfiletypepairsfromfiletypedownloadwarnings"],"options":null},{"id":"com.apple.managedclient.preferences_experimentationandconfigurationservicecontrol","displayName":"Control communication with the Experimentation and Configuration Service","description":"In Microsoft Edge, the Experimentation and Configuration Service is used to deploy Experimentation and Configuration payload.\n\nExperimentation payload consists of a list of early in development features that Microsoft is enabling for testing and feedback.\n\nConfiguration payload consists of a list of settings that Microsoft wants to deploy to Microsoft Edge to optimize user experience. For example, configuration payload may specify how often Microsoft Edge sends requests to the Experimentation and Configuration Service to retrieve the newest payload.\n\nIf you set this policy to \"Retrieve configurations and experiments\" mode, the full payload is downloaded from the Experimentation and Configuration Service. This includes both the experimentation and configuration payloads.\n\nIf you set this policy to \"Retrieve configurations only\" mode, only the configuration payload is delivered.\n\nIf you set this policy to \"Disable communication with the Experimentation and Configuration Service\" mode, the communication with the Experimentation and Configuration Service is stopped completely.\n\nIf you don't configure this policy, on a managed device on Stable and Beta channels the behavior is the same as the \"Retrieve configurations only\" mode.\n\nIf you don't configure this policy, on an unmanaged device the behavior is the same as the \"Retrieve configurations and experiments\" mode.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#experimentationandconfigurationservicecontrol"],"options":[{"id":"com.apple.managedclient.preferences_experimentationandconfigurationservicecontrol_0","displayName":"Retrieve configurations and experiments","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_experimentationandconfigurationservicecontrol_1","displayName":"Retrieve configurations only","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_experimentationandconfigurationservicecontrol_2","displayName":"Disable communication with the Experimentation and Configuration Service","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_explicitlyallowednetworkports","displayName":"Explicitly allowed network ports","description":"There is a list of restricted ports built into Microsoft Edge. Connections to these ports will fail. This policy allows bypassing that list. The set of ports is defined as a comma-separated list that outgoing connections should be permitted on.\n\nPorts are restricted to prevent Microsoft Edge from being used as a vector to exploit various network vulnerabilities. Setting this policy may expose your network to attacks. This policy is intended as a temporary workaround for error code \"ERR_UNSAFE_PORT\" while migrating a service running on a blocked port to a standard port (for example port 80 or 443).\n\nMalicious websites can easily detect that this policy is set, and for which ports, then use that information to target attacks.\n\nEach port listed in this policy is labeled with a date that it can be unblocked until. After that date the port will be restricted regardless of if it's specified by the value of this policy.\n\nLeaving the value empty or unset means that all restricted ports will be blocked. Invalid port values set through this policy will be ignored while valid ones will still be applied.\n\nThis policy overrides the \"--explicitly-allowed-ports\" command-line option.\n\nPolicy options mapping:\n\n* 554 (554) = port 554 (can be unblocked until 2021/10/15)\n\n* 10080 (10080) = port 10080 (can be unblocked until 2022/04/01)\n\n* 6566 (6566) = port 6566 (can be unblocked until 2021/10/15)\n\n* 989 (989) = port 989 (can be unblocked until 2022/02/01)\n\n* 990 (990) = port 990 (can be unblocked until 2022/02/01)\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#explicitlyallowednetworkports"],"options":null},{"id":"com.apple.managedclient.preferences_extendedlogging","displayName":"Enable extended logging","description":"Write verbose logging events to /Library/Logs/Microsoft/autoupdate.log","helpText":null,"infoUrls":["https://macadmins.software/docs/MAU_38.pdf"],"options":[{"id":"com.apple.managedclient.preferences_extendedlogging_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_extendedlogging_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_extensionallowedtypes","displayName":"Configure allowed extension types","description":"Controls which extension types can be installed and limits runtime access.\n\nThis setting defines the allowed types of extensions and which hosts they can interact with. The value is a list of strings, each of which should be one of the following: \"extension\", \"theme\", \"user_script\", and \"hosted_app\". See the Microsoft Edge extensions documentation for more information on these types.\n\nNote that this policy also affects extensions to be force-installed by using \"ExtensionInstallForcelist\" policy.\n\nIf you enable this policy, only extensions that match a type in the list are installed.\n\nIf you don't configure this policy, no restrictions on the acceptable extension types are enforced.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#extensionallowedtypes"],"options":null},{"id":"com.apple.managedclient.preferences_extensiondevelopermodesettings","displayName":"Control the availability of developer mode on extensions page","description":"Control if users can turn on Developer Mode on edge://extensions.\n\nIf the policy isn't set, users can turn on developer mode on the extension page unless DeveloperToolsAvailability policy is set to DeveloperToolsDisallowed (2).\nIf the policy is set to Allow (0), users can turn on developer mode on the extensions page.\nIf the policy is set to Disallow (1), users cannot turn on developer mode on the extensions page.\n\nIf this policy is set, DeveloperToolsAvailability can no longer control extensions developer mode.\n\nPolicy options mapping:\n\n* Allow (0) = Allow the usage of developer mode on extensions page\n\n* Disallow (1) = Do not allow the usage of developer mode on extensions page\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#extensiondevelopermodesettings"],"options":[{"id":"com.apple.managedclient.preferences_extensiondevelopermodesettings_0","displayName":"Allow the usage of developer mode on extensions page","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_extensiondevelopermodesettings_1","displayName":"Do not allow the usage of developer mode on extensions page","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_extensionextendedbackgroundlifetimeforportconnectionstourls","displayName":"Configure a list of origins that grant an extended background lifetime to connecting extensions.","description":"Extensions that connect to one of these origins will keep running as long as the port is connected.\nIf unset, the policy's default values are used. These are the app origins that offer SDKs that are known to not offer the possibility to restart a closed connection to a previous state:\n- Smart Card Connector\n- Citrix Receiver (stable, beta, back-up)\n- VMware Horizon (stable, beta)\n\nIf set, the default value list is extended with the newly configured values. The defaults and policy-provided entries will grant the exception to the connecting extensions, as long as the port is connected.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#extensionextendedbackgroundlifetimeforportconnectionstourls"],"options":null},{"id":"com.apple.managedclient.preferences_extensioninstallallowlist","displayName":"Allow specific extensions to be installed","description":"By default, all extensions are allowed. However, if you block all extensions by setting the 'ExtensionInstallBlockList' policy to \"*,\" users can only install extensions defined in this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#extensioninstallallowlist"],"options":null},{"id":"com.apple.managedclient.preferences_extensioninstallblocklist","displayName":"Control which extensions cannot be installed","description":"List specific extensions that users can NOT install in Microsoft Edge. When you deploy this policy, any extensions on this list that were previously installed will be disabled, and the user won't be able to enable them. If you remove an item from the list of blocked extensions, that extension is automatically re-enabled anywhere it was previously installed.\n\nUse \"*\" to block all extensions that aren't explicitly listed in the allow list.\n\nIf you don't configure this policy, users can install any extension in Microsoft Edge.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#extensioninstallblocklist"],"options":null},{"id":"com.apple.managedclient.preferences_extensioninstallforcelist","displayName":"Control which extensions are installed silently","description":"Specifies extensions that are installed silently, without user interaction, and that the users can't uninstall or disable (\"force-installed\"). All permissions requested by the extensions are granted implicitly, without user interaction, including any additional permissions requested by future versions of the extension. Furthermore, permissions are granted for the enterprise.deviceAttributes and enterprise.platformKeys extension APIs. (These two APIs are only available to extensions that are force-installed.)\n\nThis policy takes precedence over a potentially conflicting \"ExtensionInstallBlocklist\" policy. When you take an extension off of the force-installed list it's automatically uninstalled by Microsoft Edge.\n\nFor Windows devices that aren't joined to a Microsoft Active Directory domain, forced installation is limited to extensions available in the Microsoft Store.\n\nNote that users can modify the source code of any extension by using Developer Tools, potentially rendering the extension dysfunctional. If this is a concern, set the \"DeveloperToolsAvailability\" policy.\n\nUse the following format to add an extension to the list:\n\n[extensionID];[updateURL]\n\n- extensionID - the 32-letter string found on edge://extensions when in developer mode.\n\n- updateURL (optional) is the address of the Update Manifest XML document for the app or extension, as described at https://go.microsoft.com/fwlink/?linkid=2095043. If you don't set the updateURL, the Microsoft Store update URL is used (currently https://edge.microsoft.com/extensionwebstorebase/v1/crx). Note that the update URL set in this policy is only used for the initial installation; subsequent updates of the extension use the update URL indicated in the extension's manifest.\n\nFor example, gggmmkjegpiggikcnhidnjjhmicpibll;https://edge.microsoft.com/extensionwebstorebase/v1/crx installs the Microsoft Online app from the Microsoft Store \"update\" URL. For more information about hosting extensions, see: https://go.microsoft.com/fwlink/?linkid=2095044.\n\nIf you don't configure this policy, no extensions are installed automatically, and users can uninstall any extension in Microsoft Edge.\n\nNote that this policy doesn't apply to InPrivate mode.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#extensioninstallforcelist"],"options":null},{"id":"com.apple.managedclient.preferences_extensioninstallsources","displayName":"Configure extension and user script install sources","description":"Define URLs that can install extensions and themes.\n\nBy default, users have to download a *.crx file for each extension or script they want to install, and then drag it onto the Microsoft Edge settings page. This policy lets specific URLs use install the extension or script for the user.\n\nEach item in this list is an extension-style match pattern (see https://go.microsoft.com/fwlink/?linkid=2095039). Users can easily install items from any URL that matches an item in this list. Both the location of the *.crx file and the page where the download is started from (in other words, the referrer) must be allowed by these patterns.\n\nThe \"ExtensionInstallBlocklist\" policy takes precedence over this policy. Any extensions that's on the block list won't be installed, even if it comes from a site on this list.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#extensioninstallsources"],"options":null},{"id":"com.apple.managedclient.preferences_extensioninstalltypeblocklist","displayName":"Blocklist for extension install types","description":"The blocklist controls which extension install types are disallowed.\n\nSetting the \"command_line\" will block an extension from being loaded from command line.\n\nPolicy options mapping:\n\n* command_line (command_line) = Blocks extensions from being loaded from command line\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#extensioninstalltypeblocklist"],"options":null},{"id":"com.apple.managedclient.preferences_extensionmanifestv2availability","displayName":"Control Manifest v2 extension availability","description":"Control if Manifest v2 extensions can be used by browser.\n\nManifest v2 extensions support will be deprecated and all extensions need to be migrated to v3 in the future. More information about, and the timeline of the migration has not been established.\n\nIf the policy is set to Default or not set, v2 extension loading is decided by browser. This will follow the preceding timeline when it's established.\n\nIf the policy is set to Disable, v2 extensions installation are blocked, and existing ones are disabled. This option is going to be treated the same as if the policy is unset after v2 support is turned off by default.\n\nIf the policy is set to Enable, v2 extensions are allowed. The option is going to be treated the same as if the policy isn't set before v2 support is turned off by default.\n\nIf the policy is set to EnableForForcedExtensions, force installed v2 extensions are allowed. This includes extensions that are listed by \"ExtensionInstallForcelist\" or \"ExtensionSettings\" with installation_mode \"force_installed\" or \"normal_installed\". All other v2 extensions are disabled. The option is always available regardless of the manifest migration state.\n\nExtensions availabilities are still controlled by other policies.\n\nPolicy options mapping:\n\n* Default (0) = Default browser behavior\n\n* Disable (1) = Manifest v2 is disabled\n\n* Enable (2) = Manifest v2 is enabled\n\n* EnableForForcedExtensions (3) = Manifest v2 is enabled for forced extensions only\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#extensionmanifestv2availability"],"options":[{"id":"com.apple.managedclient.preferences_extensionmanifestv2availability_0","displayName":"Default browser behavior","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_extensionmanifestv2availability_1","displayName":"Manifest v2 is disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_extensionmanifestv2availability_2","displayName":"Manifest v2 is enabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_extensionmanifestv2availability_3","displayName":"Manifest v2 is enabled for forced extensions only","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_extensionsperformancedetectorenabled","displayName":"Extensions Performance Detector enabled","description":"This policy controls if users can access the Extensions Performance Detector Recommended Action feature in Browser Essentials. This feature alerts extension users if their extensions are causing performance regressions in the browser and allows them to take action to resolve the issue.\n\nIf you enable or don't configure this policy, users will receive Extensions Performance Detector notifications from Browser Essentials. When there is an active alert, users will be able to view the impact of extensions on their browser's performance and make an informed decision to disable impacting extensions. The detector will exclude browser-managed extensions, such as Google Docs offline, component extensions, and organization-managed extensions (ie. extensions that cannot be disabled).\n\nIf you disable this policy, users will not receive notifications or be able to view the Extensions Performance Detector Recommended Action.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#extensionsperformancedetectorenabled"],"options":[{"id":"com.apple.managedclient.preferences_extensionsperformancedetectorenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_extensionsperformancedetectorenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_externalprotocoldialogshowalwaysopencheckbox","displayName":"Show an \"Always open\" checkbox in external protocol dialog","description":"This policy controls whether the \"Always open\" checkbox is shown on external protocol launch confirmation prompts.\n\nIf you set this policy to True, when an external protocol confirmation prompt is shown, the user can select \"Always open\". The user won’t get any future confirmation prompts for this protocol.\n\nIf you set this policy to False, or the policy is unset, the \"Always open\" checkbox isn’t displayed. The user will be prompted for confirmation every time an external protocol is invoked.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#externalprotocoldialogshowalwaysopencheckbox"],"options":[{"id":"com.apple.managedclient.preferences_externalprotocoldialogshowalwaysopencheckbox_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_externalprotocoldialogshowalwaysopencheckbox_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_familysafetysettingsenabled","displayName":"Allow users to configure Family safety","description":"This policy disables and completely hides the Family safety page in Settings. Navigation to edge://settings/familysafety will also be blocked. The Family safety page describes what features are available for family groups and how to join a family group. Learn more about family safety here: (https://go.microsoft.com/fwlink/?linkid=2098432).\n\nIf you enable this policy or don't configure it, the Family safety page will be shown.\n\nIf you disable this policy, the Family safety page will not be shown.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#familysafetysettingsenabled"],"options":[{"id":"com.apple.managedclient.preferences_familysafetysettingsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_familysafetysettingsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_favoritesbarenabled","displayName":"Enable favorites bar","description":"Enables or disables the favorites bar.\n\nIf you enable this policy, users will see the favorites bar.\n\nIf you disable this policy, users won't see the favorites bar.\n\nIf this policy is not configured, then the user can decide to use the favorites bar or not.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#favoritesbarenabled"],"options":[{"id":"com.apple.managedclient.preferences_favoritesbarenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_favoritesbarenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_featureflagoverridescontrol","displayName":"Configure users ability to override feature flags","description":"Configures users ability to override state of feature flags.\nIf you set this policy to 'CommandLineOverridesEnabled', users can override state of feature flags using command line arguments but not edge://flags page.\n\nIf you set this policy to 'OverridesEnabled', users can override state of feature flags using command line arguments or edge://flags page.\n\nIf you set this policy to 'OverridesDisabled', users can't override state of feature flags using command line arguments or edge://flags page.\n\nIf you don't configure this policy, the behavior is the same as the 'OverridesEnabled'.\n\nPolicy options mapping:\n\n* CommandLineOverridesEnabled (2) = Allow users to override feature flags using command line arguments only\n\n* OverridesEnabled (1) = Allow users to override feature flags\n\n* OverridesDisabled (0) = Prevent users from overriding feature flags\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#featureflagoverridescontrol"],"options":[{"id":"com.apple.managedclient.preferences_featureflagoverridescontrol_0","displayName":"Prevent users from overriding feature flags","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_featureflagoverridescontrol_1","displayName":"Allow users to override feature flags","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_featureflagoverridescontrol_2","displayName":"Allow users to override feature flags using command line arguments only","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_fetchkeepalivedurationsecondsonshutdown","displayName":"Fetch keepalive duration on shutdown","description":"Controls the duration (in seconds) that keepalive requests are allowed to prevent the browser from completing its shutdown.\n\nIf you configure this policy, the browser will block completing shutdown while it processes any outstanding keepalive requests (see https://fetch.spec.whatwg.org/#request-keepalive-flag) up to the maximum period of time specified by this policy.\n\nIf you disable or don't configure this policy, the default value of 0 seconds is used and outstanding keepalive requests will be immediately cancelled during browser shutdown.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#fetchkeepalivedurationsecondsonshutdown"],"options":null},{"id":"com.apple.managedclient.preferences_fileordirectorypickerwithoutgestureallowedfororigins","displayName":"Allow file or directory picker APIs to be called without prior user gesture","description":"For security reasons, the showOpenFilePicker(), showSaveFilePicker() and showDirectoryPicker() web APIs require a prior user gesture (\"transient activation\") to be called or will otherwise fail.\n\nIf you enable this policy, admins can specify origins on which these APIs can be called without prior user gesture.\n\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.\n\nIf you disable or don't configure this policy, all origins will require a prior user gesture to call these APIs.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#fileordirectorypickerwithoutgestureallowedfororigins"],"options":null},{"id":"com.apple.managedclient.preferences_filesondemandenabled","displayName":"Enable Files On-Demand","description":"Specifies whether Files On-Demand is enabled. When set to true, new users who set up the sync app will download online-only files by default. When set to false, Files On-Demand will be disabled and users won't be able to turn it on. NOTE: This setting only applies to macOS Monterey 12.1 and earlier.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#filesondemandenabled"],"options":[{"id":"com.apple.managedclient.preferences_filesondemandenabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_filesondemandenabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_filesystemreadaskforurls","displayName":"Allow read access via the File System API on these sites","description":"Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them read access to files or directories in the host operating system's file system via the File System API.\n\nLeaving the policy unset means \"DefaultFileSystemReadGuardSetting\" applies for all sites, if it's set. If not, users' personal settings apply.\n\nURL patterns can't conflict with \"FileSystemReadBlockedForUrls\". Neither policy takes precedence if a URL matches with both.\n\nFor detailed information about valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#filesystemreadaskforurls"],"options":null},{"id":"com.apple.managedclient.preferences_filesystemreadblockedforurls","displayName":"Block read access via the File System API on these sites","description":"If you set this policy, you can list the URL patterns that specify which sites can't ask users to grant them read access to files or directories in the host operating system's file system via the File System API.\n\nIf you don't set this policy, \"DefaultFileSystemReadGuardSetting\" applies for all sites, if it's set. If not, users' personal settings apply.\n\nURL patterns can't conflict with \"FileSystemReadAskForUrls\". Neither policy takes precedence if a URL matches with both.\n\nFor detailed information about valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#filesystemreadblockedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_filesystemwriteaskforurls","displayName":"Allow write access to files and directories on these sites","description":"If you set this policy, you can list the URL patterns that specify which sites can ask users to grant them write access to files or directories in the host operating system's file system.\n\nIf you don't set this policy, \"DefaultFileSystemWriteGuardSetting\" applies for all sites, if it's set. If not, users' personal settings apply.\n\nURL patterns can't conflict with \"FileSystemWriteBlockedForUrls\". Neither policy takes precedence if a URL matches with both.\n\nFor detailed information about valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#filesystemwriteaskforurls"],"options":null},{"id":"com.apple.managedclient.preferences_filesystemwriteblockedforurls","displayName":"Block write access to files and directories on these sites","description":"If you set this policy, you can list the URL patterns that specify which sites can't ask users to grant them write access to files or directories in the host operating system's file system.\n\nIf you don't set this policy, \"DefaultFileSystemWriteGuardSetting\" applies for all sites, if it's set. If not, users' personal settings apply.\n\nURL patterns can't conflict with \"FileSystemWriteAskForUrls\". Neither policy takes precedence if a URL matches with both.\n\nFor detailed information about valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#filesystemwriteblockedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_forcebingsafesearch","displayName":"Enforce Bing SafeSearch","description":"Ensure that queries in Bing web search are done with SafeSearch set to the value specified. Users can't change this setting.\n\nIf you configure this policy to \"Off\", SafeSearch in Bing search falls back to the bing.com value.\n\nIf you configure this policy to \"Moderate\", the moderate setting is used in SafeSearch. The moderate setting filters adult videos and images but not text from search results.\n\nIf you configure this policy to \"Strict\", the strict setting in SafeSearch is used. The strict setting filters adult text, images, and videos.\n\nIf you disable this policy or don't configure it, SafeSearch in Bing search isn't enforced, and users can set the value they want on bing.com.\n\n* 0 = Don't configure search restrictions in Bing\n\n* 1 = Configure moderate search restrictions in Bing\n\n* 2 = Configure strict search restrictions in Bing","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#forcebingsafesearch"],"options":[{"id":"com.apple.managedclient.preferences_forcebingsafesearch_0","displayName":"Don't configure search restrictions in Bing","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_forcebingsafesearch_1","displayName":"Configure moderate search restrictions in Bing","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_forcebingsafesearch_2","displayName":"Configure strict search restrictions in Bing","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_forcecertificatepromptsonmultiplematches","displayName":"Configure whether Microsoft Edge should automatically select a certificate when there are multiple certificate matches for a site configured with \"AutoSelectCertificateForUrls\"","description":"Toggles whether users are prompted to select a certificate if there are multiple certificates available and a site is configured with \"AutoSelectCertificateForUrls\". If you don't configure \"AutoSelectCertificateForUrls\" for a site, the user will always be prompted to select a certificate.\n\nIf you set this policy to True, Microsoft Edge will prompt a user to select a certificate for sites on the list defined in \"AutoSelectCertificateForUrls\" if and only if there is more than one certificate.\n\nIf you set this policy to False or don't configure it, Microsoft Edge will automatically select a certificate even if there are multiple matches for a certificate. The user will not be prompted to select a certificate for sites on the list defined in \"AutoSelectCertificateForUrls\".","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#forcecertificatepromptsonmultiplematches"],"options":[{"id":"com.apple.managedclient.preferences_forcecertificatepromptsonmultiplematches_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_forcecertificatepromptsonmultiplematches_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_forceephemeralprofiles","displayName":"Enable use of ephemeral profiles","description":"Controls whether user profiles are switched to ephemeral mode. An ephemeral profile is created when a session begins, is deleted when the session ends, and is associated with the user's original profile.\n\nIf you enable this policy, profiles run in ephemeral mode. This lets users work from their own devices without saving browsing data to those devices. If you enable this policy as an OS policy (by using GPO on Windows, for example), it applies to every profile on the system.\n\nIf you disable this policy or don't configure it, users get their regular profiles when they sign in to the browser.\n\nIn ephemeral mode, profile data is saved on disk only for the length of the user session. Features like browser history, extensions and their data, web data like cookies, and web databases aren't saved after the browser is closed. This doesn't prevent a user from manually downloading any data to disk, or from saving pages or printing them. If the user has enabled sync, all data is preserved in their sync accounts just like with regular profiles. Users can also use InPrivate browsing in ephemeral mode unless you explicitly disable this.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#forceephemeralprofiles"],"options":[{"id":"com.apple.managedclient.preferences_forceephemeralprofiles_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_forceephemeralprofiles_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_forcegooglesafesearch","displayName":"Enforce Google SafeSearch","description":"Forces queries in Google Web Search to be performed with SafeSearch set to active, and prevents users from changing this setting.\n\nIf you enable this policy, SafeSearch in Google Search is always active.\n\nIf you disable this policy or don't configure it, SafeSearch in Google Search isn't enforced.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#forcegooglesafesearch"],"options":[{"id":"com.apple.managedclient.preferences_forcegooglesafesearch_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_forcegooglesafesearch_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_forcelegacydefaultreferrerpolicy","displayName":"Use a default referrer policy of no-referrer-when-downgrade.","description":"This enterprise policy is for short-term adaptation and will be removed in M82.\n\nMicrosoft Edge’s default referrer policy is being strengthened from its current value of no-referrer-when-downgrade to the more secure strict-origin-when-cross-origin through a gradual rollout targeting M80 stable.\n\nBefore the rollout, this enterprise policy will have no effect. After the rollout, when this enterprise policy is enabled, Microsoft Edge’s default referrer policy will be set to its pre-M80 value of no-referrer-when-downgrade.\n\nThis enterprise policy is disabled by default","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#forcelegacydefaultreferrerpolicy"],"options":[{"id":"com.apple.managedclient.preferences_forcelegacydefaultreferrerpolicy_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_forcelegacydefaultreferrerpolicy_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_forcepermissionpolicyunloaddefaultenabled","displayName":"Controls whether unload event handlers can be disabled.","description":"unload event handlers are being deprecated. Whether they fire depends on the unload Permissions-Policy.\nCurrently, they are allowed by policy by default. In the future they will gradually move to being disallowed by default and sites must explicitly enable them using Permissions-Policy headers.\nThis enterprise policy can be used to opt out of this gradual deprecation by forcing the default to stay enabled.\n\nPages might depend on unload event handlers to save data or signal the end of a user session to the server.\nThis is not recommended because it's unreliable and impacts performance by blocking use of BackForwardCache.\nRecommended alternatives exist, but the unload event has been used for a long time. Some applications might still rely on them.\n\nIf you disable this policy or don't configure it, unload event handlers will gradually be deprecated in-line with the deprecation rollout and sites which don't set Permissions-Policy header will stop firing `unload` events.\n\nIf you enable this policy then unload event handlers will continue to work by default.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#forcepermissionpolicyunloaddefaultenabled"],"options":[{"id":"com.apple.managedclient.preferences_forcepermissionpolicyunloaddefaultenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_forcepermissionpolicyunloaddefaultenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_forcesync","displayName":"Force synchronization of browser data and do not show the sync consent prompt","description":"Forces data synchronization in Microsoft Edge. This policy also prevents the user from turning sync off.\n\nIf you don't configure this policy, users will be able to turn sync on or off. If you enable this policy, users will not be able to turn sync off.\n\nFor this policy to work as intended,\n\"BrowserSignin\" policy must not be configured, or must be set to enabled. If \"BrowserSignin\" is set to disabled, then \"ForceSync\" will not take affect.\n\n\"SyncDisabled\" must not be configured or must be set to False. If this is set to True, \"ForceSync\" will not take affect.\n\n0 = Do not automatically start sync and show the sync consent (default)\n1 = Force sync to be turned on for Azure AD/Azure AD-Degraded user profile and do not show the sync consent prompt","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#forcesync"],"options":[{"id":"com.apple.managedclient.preferences_forcesync_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_forcesync_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_forcesynctypes","displayName":"Configure the list of types that are included for synchronization","description":"If you enable this policy all the specified data types will be included for synchronization for Azure AD/Azure AD-Degraded user profiles. This policy can be used to ensure the type of data uploaded to the Microsoft Edge synchronization service.\n\nYou can provide one of the following data types for this policy: \"favorites\", \"settings\", \"passwords\", \"addressesAndMore\", \"extensions\", \"history\", \"openTabs\", \"edgeWallet\", \"collections\", \"apps\", and \"edgeFeatureUsage\". The \"edgeFeatureUsage\" data type will be supported starting in Microsoft Edge version 134. Note that these data type names are case sensitive.\n\nUsers will not be able to override the enabled data types.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#forcesynctypes"],"options":null},{"id":"com.apple.managedclient.preferences_forceyoutuberestrict","displayName":"Force minimum YouTube Restricted Mode","description":"Enforces a minimum Restricted Mode on YouTube and prevents users from picking a less restricted mode.\n\nSet to Strict (2) to enforce Strict Restricted Mode on YouTube.\n\nSet to Moderate (1) to enforce the user to only use Moderate Restricted Mode and Strict Restricted Mode on YouTube. They can't disable Restricted Mode.\n\nSet to Off (0) or don't configure this policy to not enforce Restricted Mode on YouTube. External policies such as YouTube policies might still enforce Restricted Mode.\n\n* 0 = Do not enforce Restricted Mode on YouTube\n\n* 1 = Enforce at least Moderate Restricted Mode on YouTube\n\n* 2 = Enforce Strict Restricted Mode for YouTube","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#forceyoutuberestrict"],"options":[{"id":"com.apple.managedclient.preferences_forceyoutuberestrict_0","displayName":"Do not enforce Restricted Mode on YouTube","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_forceyoutuberestrict_1","displayName":"Enforce at least Moderate Restricted Mode on YouTube","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_forceyoutuberestrict_2","displayName":"Enforce Strict Restricted Mode for YouTube","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_globallyscopehttpauthcacheenabled","displayName":"Enable globally scoped HTTP auth cache","description":"This policy configures a single global per profile cache with HTTP server authentication credentials.\n\nIf you disable or don’t set this policy, the browser will use the default behavior of cross-site auth, which as of version 80, will be to scope HTTP server authentication credentials by top-level site. So, if two sites use resources from the same authenticating domain, credentials will need to be provided independently in the context of both sites. Cached proxy credentials will be reused across sites.\n\nIf you enable this policy HTTP auth credentials entered in the context of one site will automatically be used in the context of another site.\n\nEnabling this policy leaves sites open to some types of cross-site attacks, and allows users to be tracked across sites even without cookies by adding entries to the HTTP auth cache using credentials embedded in URLs.\n\nThis policy is intended to give enterprises depending on the legacy behavior a chance to update their login procedures and will be removed in the future.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#globallyscopehttpauthcacheenabled"],"options":[{"id":"com.apple.managedclient.preferences_globallyscopehttpauthcacheenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_globallyscopehttpauthcacheenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_gotointranetsiteforsinglewordentryinaddressbar","displayName":"Force direct intranet site navigation instead of searching on single word entries in the Address Bar","description":"If you enable this policy, the top auto-suggest result in the address bar suggestion list will navigate to intranet sites if the text entered in the address bar is a single word without punctuation.\n\nDefault navigation when typing a single word without punctuation will conduct a navigation to an intranet site matching the entered text.\n\nIf you enable this policy, the second auto-suggest result in the address bar suggestion list will conduct a web search exactly as it was entered, provided that this text is a single word without punctuation. The default search provider will be used unless a policy to prevent web search is also enabled.\n\nTwo effects of enabling this policy are:\n\nNavigation to sites in response to single word queries that would typically resolve to a history item will no longer happen. Instead, the browser will attempt navigate to internal sites that may not exist in an organization’s intranet. This will result in a 404 error.\n\nPopular, single-word search terms will require manual selection of search suggestions to properly conduct a search.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#gotointranetsiteforsinglewordentryinaddressbar"],"options":[{"id":"com.apple.managedclient.preferences_gotointranetsiteforsinglewordentryinaddressbar_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_gotointranetsiteforsinglewordentryinaddressbar_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_groupids","displayName":"Group identifier","description":"","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#group-identifiers"],"options":null},{"id":"com.apple.managedclient.preferences_guardagainstappmodification","displayName":"Guard against app modification","description":"Retain and reuse app clones after the update cycle. This allows for future delta updates even when the source app has been modified by a third-party tool.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_guardagainstappmodification_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_guardagainstappmodification_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_guidedswitchenabled","displayName":"Guided Switch Enabled","description":"Allows Microsoft Edge to prompt the user to switch to the appropriate profile when Microsoft Edge detects that a link is a personal or work link.\n\nIf you enable this policy, you'll be prompted to switch to another account if the current profile doesn't work for the requesting link.\n\nIf you disable this policy, you won't be prompted to switch to another account when there's a profile and link mismatch.\n\nIf this policy isn't configured, guided switch is turned on by default. A user can override this value in the browser settings.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#guidedswitchenabled"],"options":[{"id":"com.apple.managedclient.preferences_guidedswitchenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_guidedswitchenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_hardwareaccelerationmodeenabled","displayName":"Use hardware acceleration when available","description":"Specify to use hardware acceleration, if it's available. If you enable this policy or don't configure it, hardware acceleration is enabled unless a GPU feature is explicitly blocked.\n\nIf you disable this policy, hardware acceleration is disabled.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#hardwareaccelerationmodeenabled"],"options":[{"id":"com.apple.managedclient.preferences_hardwareaccelerationmodeenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_hardwareaccelerationmodeenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_headlessmodeenabled","displayName":"Control use of the Headless Mode","description":"This policy setting lets you decide whether users can launch Microsoft Edge in headless mode.\n\nIf you enable or don't configure this policy, Microsoft Edge allows use of the headless mode.\n\nIf you disable this policy, Microsoft Edge denies use of the headless mode.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#headlessmodeenabled"],"options":[{"id":"com.apple.managedclient.preferences_headlessmodeenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_headlessmodeenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_hidedockicon","displayName":"Hide dock icon","description":"Specifies whether the dock icon for OneDrive is hidden.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#hidedockicon"],"options":[{"id":"com.apple.managedclient.preferences_hidedockicon_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_hidedockicon_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_hidefirstrunexperience","displayName":"Hide the First-run experience and splash screen","description":"If you enable this policy, the First-run experience and the splash screen will not be shown to users when they run Microsoft Edge for the first time.\n\nFor the configuration options shown in the First Run Experience, the browser will default to the following:\n\n-On the New Tab Page, the feed type will be set to MSN News and the layout to Inspirational.\n\n-The user will still be automatically signed into Microsoft Edge if the Windows account is of AAD or MSA type.\n\n-Sync will not be enabled by default and users will be able to turn on sync from the sync settings.\n\nIf you disable or don't configure this policy, the First-run experience and the Splash screen will be shown.\n\nNote: The specific configuration options shown to the user in the First Run Experience, can also be managed by using other specific policies. You can use the HideFirstRunExperience policy in combination with these policies to configure a specific browser experience on your managed devices. Some of these other policies are:\n\n-\"AutoImportAtFirstRun\"\n\n-\"NewTabPageLocation\"\n\n-\"NewTabPageSetFeedType\"\n\n-\"SyncDisabled\"\n\n-\"BrowserSignin\"\n\n-\"NonRemovableProfileEnabled\"","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#hidefirstrunexperience"],"options":[{"id":"com.apple.managedclient.preferences_hidefirstrunexperience_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_hidefirstrunexperience_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_hidefoldersonmycomputerrootinfolderlist","displayName":"Hide On My Computer folders","description":"Disable local folder storage.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#hide-local-folders"],"options":[{"id":"com.apple.managedclient.preferences_hidefoldersonmycomputerrootinfolderlist_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_hidefoldersonmycomputerrootinfolderlist_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_hidestatusmenuicon","displayName":"Show / hide status menu icon","description":"Whether the status menu icon (shown in the top-right corner of the screen) is hidden or not.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#show--hide-status-menu-icon"],"options":[{"id":"com.apple.managedclient.preferences_hidestatusmenuicon_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_hidestatusmenuicon_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_homepageisnewtabpage","displayName":"Set the new tab page as the home page","description":"Configures the default home page in Microsoft Edge. You can set the home page to a URL you specify or to the new tab page.\n\nIf you enable this policy, the new tab page is always used for the home page, and the home page URL location is ignored.\n\nIf you disable this policy, the user's home page can't be the new tab page, unless the URL is set to 'edge://newtab'.\n\nIf not configured users can choose whether the new tab page is their home page.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances enrolled for device management.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#homepageisnewtabpage"],"options":[{"id":"com.apple.managedclient.preferences_homepageisnewtabpage_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_homepageisnewtabpage_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_homepagelocation","displayName":"Configure the home page URL","description":"Configures the default home page URL in Microsoft Edge.\n\nThe home page is the page opened by the Home button. The pages that open on startup are controlled by the \"RestoreOnStartup\" policies.\n\nYou can either set a URL here or set the home page to open the new tab page. If you select to open the new tab page, then this policy doesn't take effect.\n\nIf you enable this policy, users can't change their home page URL, but they can choose to use the new tab page as their home page.\n\nIf you disable or don't configure this policy, users can choose their own home page, as long as the \"HomepageIsNewTabPage\" policy isn't enabled.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances enrolled for device management.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#homepagelocation"],"options":null},{"id":"com.apple.managedclient.preferences_howtocheck","displayName":"Enable AutoUpdate","description":"Specifies whether AutoUpdate should download and install updates. This value should be true unless you need to temporarily halt all updates.","helpText":null,"infoUrls":["https://support.microsoft.com/office/update-office-for-mac-automatically-bfd1e497-c24d-4754-92ab-910a4074d7c1"],"options":[{"id":"com.apple.managedclient.preferences_howtocheck_0","displayName":"True","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_howtocheck_1","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_howtocheck_2","displayName":"Manual Check","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_hstspolicybypasslist","displayName":"Configure the list of names that will bypass the HSTS policy check","description":"Hostnames specified in this list will be exempt from the HSTS policy check that could potentially upgrade requests from \"http://\" to \"https://\". Only single-label hostnames are allowed in this policy. Hostnames must be canonicalized. Any IDNs must be converted to their A-label format, and all ASCII letters must be lowercase. This policy only applies to the specific hostnames specified; it doesn't apply to subdomains of the names in the list.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#hstspolicybypasslist"],"options":null},{"id":"com.apple.managedclient.preferences_httpallowlist","displayName":"HTTP Allowlist","description":"Setting the policy specifies a list of hostnames or hostname patterns (such as '[*.]example.com') that won't be upgraded to HTTPS. Organizations can use this policy to maintain access to servers that don't support HTTPS, without needing to disable \"HttpsUpgradesEnabled\".\n\nSupplied hostnames must be canonicalized: Any IDNs must be converted to their A-label format, and all ASCII letters must be lowercase.\n\nBlanket host wildcards (that is, \"*\" or \"[*]\") aren't allowed. Instead, HTTPS-First Mode and HTTPS Upgrades should be explicitly disabled via their specific policies.\n\nNote: This policy doesn't apply to HSTS upgrades.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#httpallowlist"],"options":null},{"id":"com.apple.managedclient.preferences_hubssidebarenabled","displayName":"Show Hubs Sidebar","description":"The Sidebar is a launcher bar located on the right side of Microsoft Edge.\n\nIf you enable this policy, the Sidebar is always visible.\n\nIf you disable this policy, the Sidebar is never shown.\n\nIf you don't configure this policy, the Sidebar's visibility follows the user's Microsoft Edge settings.\n\nAs of Microsoft Edge version 141, the \"Microsoft365CopilotChatIconEnabled\" policy is the only means of controlling the display of Copilot in the toolbar.\n\nNote: The recommended version of this policy-also known as the \"Default Settings (users can override)\" policy-is obsolete. This policy has never supported the recommended capability.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#hubssidebarenabled"],"options":[{"id":"com.apple.managedclient.preferences_hubssidebarenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_hubssidebarenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_ignoreexclusions","displayName":"Ignore exclusions","description":"Should exclusions be ignored during a scheduled scan","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_ignoreexclusions_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_ignoreexclusions_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_imagesallowedforurls","displayName":"Allow images on these sites","description":"Define a list of sites, based on URL patterns, that can display images.\n\nIf you don't configure this policy, the global default value is used for all sites either from the \"DefaultImagesSetting\" policy (if set) or the user's personal configuration.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#imagesallowedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_imagesblockedforurls","displayName":"Block images on specific sites","description":"Define a list of sites, based on URL patterns, that aren't allowed to display images.\n\nIf you don't configure this policy, the global default value from the \"DefaultImagesSetting\" policy (if set) or the user's personal configuration is used for all sites.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#imagesblockedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_importautofillformdata","displayName":"Allow importing of autofill form data","description":"Allows users to import autofill form data from another browser into Microsoft Edge.\n\nIf you enable this policy, the option to manually import autofill data is automatically selected.\n\nIf you disable this policy, autofill form data isn't imported at first run, and users can't import it manually.\n\nIf you don't configure this policy, autofill data is imported at first run, and users can choose whether to import this data manually during later browsing sessions.\n\nYou can set this policy as a recommendation. This means that Microsoft Edge will import autofill data on first run, but users can select or clear **autofill data** option during manual import.\n\n**Note**: This policy currently manages importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#importautofillformdata"],"options":[{"id":"com.apple.managedclient.preferences_importautofillformdata_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_importautofillformdata_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_importbrowsersettings","displayName":"Allow importing of browser settings","description":"Allows users to import browser settings from another browser into Microsoft Edge.\n\nIf you enable this policy, the **Browser settings** check box is automatically selected in the **Import browser data** dialog box.\n\nIf you disable this policy, browser settings aren't imported at first run, and users can’t import them manually.\n\nIf you don’t configure this policy, browser settings are imported at first run, and users can choose whether to import them manually during later browsing sessions.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports the settings on first run, but users can select or clear the **browser settings** option during manual import.\n\n**Note**: This policy currently manages importing Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#importbrowsersettings"],"options":[{"id":"com.apple.managedclient.preferences_importbrowsersettings_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_importbrowsersettings_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_importcookies","displayName":"Allow importing of Cookies","description":"Allows users to import Cookies from another browser into Microsoft Edge.\n\nIf you disable this policy, Cookies aren't imported on first run.\n\nIf you don’t configure this policy, Cookies are imported on first run.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports Cookies on first run.\n\n**Note**: This policy currently manages importing Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#importcookies"],"options":[{"id":"com.apple.managedclient.preferences_importcookies_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_importcookies_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_importextensions","displayName":"Allow importing of extensions","description":"Allows users to import extensions from another browser into Microsoft Edge.\n\nIf you enable this policy, the **Extensions** check box is automatically selected in the **Import browser data** dialog box.\n\nIf you disable this policy, extensions aren't imported at first run, and users can't import them manually.\n\nIf you don't configure this policy, extensions are imported at first run, and users can choose whether to import them manually during later browsing sessions.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports extensions on first run, but users can select or clear the **favorites** option during manual import.\n\n**Note**: This policy currently only supports importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#importextensions"],"options":[{"id":"com.apple.managedclient.preferences_importextensions_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_importextensions_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_importfavorites","displayName":"Allow importing of favorites","description":"Allows users to import favorites from another browser into Microsoft Edge.\n\nIf you enable this policy, the **Favorites** check box is automatically selected in the **Import browser data** dialog box.\n\nIf you disable this policy, favorites aren't imported at first run, and users can’t import them manually.\n\nIf you don’t configure this policy, favorites are imported at first run, and users can choose whether to import them manually during later browsing sessions.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports favorites on first run, but users can select or clear the **favorites** option during manual import.\n\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10), Google Chrome (on Windows 7, 8, and 10 and on macOS) and Apple Safari (on macOS) browsers.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#importfavorites"],"options":[{"id":"com.apple.managedclient.preferences_importfavorites_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_importfavorites_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_importhistory","displayName":"Allow importing of browsing history","description":"Allows users to import their browsing history from another browser into Microsoft Edge.\n\nIf you enable this policy, the **Browsing history** check box is automatically selected in the **Import browser data** dialog box.\n\nIf you disable this policy, browsing history data isn't imported at first run, and users can’t import this data manually.\n\nIf you don’t configure this policy, browsing history data is imported at first run, and users can choose whether to import it manually during later browsing sessions.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports browsing history on first run, but users can select or clear the **history** option during manual import.\n\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10), Google Chrome (on Windows 7, 8, and 10 and on macOS) and Apple Safari (macOS) browsers.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#importhistory"],"options":[{"id":"com.apple.managedclient.preferences_importhistory_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_importhistory_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_importhomepage","displayName":"Allow importing of home page settings","description":"Allows users to import their home page setting from another browser into Microsoft Edge.\n\nIf you enable this policy, the option to manually import the home page setting is automatically selected.\n\nIf you disable this policy, the home page setting isn’t imported at first run, and users can’t import it manually.\n\nIf you don’t configure this policy, the home page setting is imported at first run, and users can choose whether to import this data manually during later browsing sessions.\n\nYou can set this policy as a recommendation. This means that Microsoft Edge imports the home page setting on first run, but users can select or clear the **home page** option during manual import.\n\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10).","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#importhomepage"],"options":[{"id":"com.apple.managedclient.preferences_importhomepage_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_importhomepage_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_importopentabs","displayName":"Allow importing of open tabs","description":"Allows users to import open and pinned tabs from another browser into Microsoft Edge.\n\nIf you enable this policy, the **Open tabs** check box is automatically selected in the **Import browser data** dialog box.\n\nIf you disable this policy, open tabs aren't imported at first run, and users can't import them manually.\n\nIf you don't configure this policy, open tabs are imported at first run, and users can choose whether to import them manually during later browsing sessions.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports open tabs on first run, but users can select or clear the **Open tabs** option during manual import.\n\n**Note**: This policy currently only supports importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#importopentabs"],"options":[{"id":"com.apple.managedclient.preferences_importopentabs_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_importopentabs_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_importpaymentinfo","displayName":"Allow importing of payment info","description":"Allows users to import payment info from another browser into Microsoft Edge.\n\nIf you enable this policy, the **payment info** check box is automatically selected in the **Import browser data** dialog box.\n\nIf you disable this policy, payment info isn’t imported at first run, and users can’t import it manually.\n\nIf you don’t configure this policy, payment info is imported at first run, and users can choose whether to import it manually during later browsing sessions.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports payment info on first run, but users can select or clear the **payment info** option during manual import.\n\n**Note:** This policy currently manages importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#importpaymentinfo"],"options":[{"id":"com.apple.managedclient.preferences_importpaymentinfo_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_importpaymentinfo_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_importsavedpasswords","displayName":"Allow importing of saved passwords","description":"Allows users to import saved passwords from another browser into Microsoft Edge.\n\nIf you enable this policy, the option to manually import saved passwords is automatically selected.\n\nIf you disable this policy, saved passwords aren't imported on first run, and users can't import them manually.\n\nIf you don't configure this policy, passwords are imported at first run, and users can choose whether to import them manually during later browsing sessions.\n\nYou can set this policy as a recommendation. This means that Microsoft Edge imports passwords on first run, but users can select or clear the **passwords** option during manual import.\n\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10) and Google Chrome (on Windows 7, 8, and 10 and on macOS) browsers.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#importsavedpasswords"],"options":[{"id":"com.apple.managedclient.preferences_importsavedpasswords_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_importsavedpasswords_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_importsearchengine","displayName":"Allow importing of search engine settings","description":"Allows users to import search engine settings from another browser into Microsoft Edge.\n\nIf you enable, this policy, the option to import search engine settings is automatically selected.\n\nIf you disable this policy, search engine settings aren't imported at first run, and users can’t import them manually.\n\nIf you don’t configure this policy, search engine settings are imported at first run, and users can choose whether to import this data manually during later browsing sessions.\n\nYou can set this policy as a recommendation. This means that Microsoft Edge imports search engine settings on first run, but users can select or clear the **search engine** option during manual import.\n\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10).","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#importsearchengine"],"options":[{"id":"com.apple.managedclient.preferences_importsearchengine_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_importsearchengine_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_importshortcuts","displayName":"Allow importing of shortcuts","description":"Allows users to import Shortcuts from another browser into Microsoft Edge.\n\nIf you disable this policy, Shortcuts aren't imported on first run.\n\nIf you don’t configure this policy, Shortcuts are imported on first run.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports Shortcuts on first run.\n\n**Note**: This policy currently manages importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#importshortcuts"],"options":[{"id":"com.apple.managedclient.preferences_importshortcuts_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_importshortcuts_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_inappsupportenabled","displayName":"In-app support Enabled","description":"Microsoft Edge uses the in-app support feature (enabled by default) to allow users to contact our support agents directly from the browser. Also, by default, users can't disable (turn off) the in-app support feature.\n\nIf you enable this policy or don't configure it, users can invoke in-app support.\n\nIf you disable this policy, users can't invoke in-app support.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#inappsupportenabled"],"options":[{"id":"com.apple.managedclient.preferences_inappsupportenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_inappsupportenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_inprivatemodeavailability","displayName":"Configure InPrivate mode availability","description":"Specifies whether the user can open pages in InPrivate mode in Microsoft Edge.\n\nIf you don't configure this policy or set it to 'Enabled' (0), users can open pages in InPrivate mode.\n\nSet this policy to 'Disable' (1) to stop users from using InPrivate mode.\n\nSet this policy to 'Forced' (2) to always use InPrivate mode.\n\n* 0 = InPrivate mode available\n\n* 1 = InPrivate mode disabled\n\n* 2 = InPrivate mode forced","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#inprivatemodeavailability"],"options":[{"id":"com.apple.managedclient.preferences_inprivatemodeavailability_0","displayName":"InPrivate mode available","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_inprivatemodeavailability_1","displayName":"InPrivate mode disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_inprivatemodeavailability_2","displayName":"InPrivate mode forced","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_insecurecontentallowedforurls","displayName":"Allow insecure content on specified sites","description":"Create a list of URL patterns to specify sites that can display insecure mixed content (that is, HTTP content on HTTPS sites).\n\nIf you don't configure this policy, blockable mixed content will be blocked and optionally blockable mixed content will be upgraded. However, users will be allowed to set exceptions to allow insecure mixed content for specific sites.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#insecurecontentallowedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_insecurecontentblockedforurls","displayName":"Block insecure content on specified sites","description":"Create a list of URL patterns to specify sites that aren't allowed to display blockable (i.e. active) mixed content (that is, HTTP content on HTTPS sites) and for which optionally blockable mixed content upgrades will be disabled.\n\nIf you don't configure this policy, blockable mixed content will be blocked and optionally blockable mixed content will be upgraded. However, users will be allowed to set exceptions to allow insecure mixed content for specific sites.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#insecurecontentblockedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_insecureformswarningsenabled","displayName":"Enable warnings for insecure forms (deprecated)","description":"This policy controls the handling of insecure forms (forms submitted over HTTP) embedded in secure (HTTPS) sites in the browser.\nIf you enable this policy or don't set it, a full page warning will be shown when an insecure form is submitted. Additionally, a warning bubble will be shown next to the form fields when they are focused, and autofill will be disabled for those forms.\nIf you disable this policy, warnings will not be shown for insecure forms, and autofill will work normally.\n\nThis policy may be removed as soon as Edge 132. The feature is enabled by default since Edge 131.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#insecureformswarningsenabled"],"options":[{"id":"com.apple.managedclient.preferences_insecureformswarningsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_insecureformswarningsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_insecureprivatenetworkrequestsallowed","displayName":"Specifies whether to allow websites to make requests to any network endpoint in an insecure manner. (Deprecated)","description":"Controls whether websites are allowed to make requests to more-private network endpoints.\n\nWhen this policy is enabled, all Private Network Access checks are disabled for all origins. This may allow attackers to perform cross-site request forgery (CSRF) attacks on private network servers.\n\nWhen this policy is disabled or not configured, the default behavior for requests to more-private network endpoints will depend on the user's personal configuration for the BlockInsecurePrivateNetworkRequests, PrivateNetworkAccessSendPreflights, and PrivateNetworkAccessRespectPreflightResults feature flags. These flags may be controlled by experimentation or set via the command line.\n\nThis policy relates to the Private Network Access specification. See https://wicg.github.io/private-network-access/ for more details.\n\nA network endpoint is more private than another if:\n1) Its IP address is localhost and the other is not.\n2) Its IP address is private and the other is public.\nIn the future, depending on spec evolution, this policy might apply to all cross-origin requests directed at private IPs or localhost.\n\nWhen this policy enabled, websites are allowed to make requests to any network endpoint, subject to other cross-origin checks.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#insecureprivatenetworkrequestsallowed"],"options":[{"id":"com.apple.managedclient.preferences_insecureprivatenetworkrequestsallowed_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_insecureprivatenetworkrequestsallowed_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_insecureprivatenetworkrequestsallowedforurls","displayName":"Allow the listed sites to make requests to more-private network endpoints from in an insecure manner (Deprecated)","description":"List of URL patterns. Requests initiated from websites served by matching origins are not subject to Private Network Access checks.\n\nIf this policy is not set, this policy behaves as if set to the empty list.\n\nFor origins not covered by the patterns specified here, the global default value will be used either from the \"InsecurePrivateNetworkRequestsAllowed\" policy, if it is set, or the user's personal configuration otherwise.\n\nFor detailed information on valid URL patterns, see [Filter format for URL list-based policies](/DeployEdge/edge-learnmmore-url-list-filter%20format).","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#insecureprivatenetworkrequestsallowedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_intensivewakeupthrottlingenabled","displayName":"Control the IntensiveWakeUpThrottling feature","description":"When enabled the IntensiveWakeUpThrottling feature causes Javascript timers in background tabs to be aggressively throttled and coalesced, running no more than once per minute after a page has been backgrounded for 5 minutes or more.\n\nThis is a web standards compliant feature, but it may break functionality on some websites by causing certain actions to be delayed by up to a minute. However, it results in significant CPU and battery savings when enabled. See https://bit.ly/30b1XR4 for more details.\n\nIf you enable this policy, the feature will be force enabled, and users will not be able to override this setting.\nIf you disable this policy, the feature will be force disabled, and users will not be able to override this setting.\nIf you don't configure this policy, the feature will be controlled by its own internal logic. Users can manually configure this setting.\n\nNote that the policy is applied per renderer process, with the most recent value of the policy setting in force when a renderer process starts. A full restart is required to ensure that all the loaded tabs receive a consistent policy setting. It is harmless for processes to be running with different values of this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#intensivewakeupthrottlingenabled"],"options":[{"id":"com.apple.managedclient.preferences_intensivewakeupthrottlingenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_intensivewakeupthrottlingenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_intranetredirectbehavior","displayName":"Intranet Redirection Behavior","description":"This policy configures behavior for intranet redirection via DNS interception checks. The checks attempt to discover whether the browser is behind a proxy that redirects unknown host names.\n\nIf this policy isn't configured, the browser will use the default behavior of DNS interception checks and intranet redirect suggestions. In M88, they are enabled by default but will be disabled by default in the future release.\n\n\"DNSInterceptionChecksEnabled\" is a related policy that might also disable DNS interception checks. However, this policy is a more flexible version which might separately control intranet redirection infobars and might be expanded in the future.\nIf either \"DNSInterceptionChecksEnabled\" or this policy make a request to disable interception checks, the checks will be disabled.\nIf DNS interception checks are disabled by this policy but \"GoToIntranetSiteForSingleWordEntryInAddressBar\" is enabled, single word queries will still result in intranet navigations.\n\nPolicy options mapping:\n\n* Default (0) = Use default browser behavior.\n\n* DisableInterceptionChecksDisableInfobar (1) = Disable DNS interception checks and did-you-mean \"http://intranetsite/\" infobars.\n\n* DisableInterceptionChecksEnableInfobar (2) = Disable DNS interception checks; allow did-you-mean \"http://intranetsite/\" infobars.\n\n* EnableInterceptionChecksEnableInfobar (3) = Allow DNS interception checks and did-you-mean \"http://intranetsite/\" infobars.\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#intranetredirectbehavior"],"options":[{"id":"com.apple.managedclient.preferences_intranetredirectbehavior_0","displayName":"Use default browser behavior.","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_intranetredirectbehavior_1","displayName":"Disable DNS interception checks and did-you-mean \"http://intranetsite/\" infobars.","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_intranetredirectbehavior_2","displayName":"Disable DNS interception checks; allow did-you-mean \"http://intranetsite/\" infobars.","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_intranetredirectbehavior_3","displayName":"Allow DNS interception checks and did-you-mean \"http://intranetsite/\" infobars.","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_isolateorigins","displayName":"Enable site isolation for specific origins","description":"Specify origins to run in isolation, in their own process.\nThis policy also isolates origins named by subdomains - for example, specifying https://contoso.com/ will cause https://foo.contoso.com/ to be isolated as part of the https://contoso.com/ site.\nIf the policy is enabled, each of the named origins in a comma-separated list will run in its own process.\nIf you disable this policy, then both the 'IsolateOrigins' and 'SitePerProcess' features are disabled. Users can still enable 'IsolateOrigins' policy manually, via command line flags.\nIf you don't configure the policy, the user can change this setting.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#isolateorigins"],"options":null},{"id":"com.apple.managedclient.preferences_javascriptallowedforurls","displayName":"Allow JavaScript on specific sites","description":"Define a list of sites, based on URL patterns, that are allowed to run JavaScript.\n\nIf you don't configure this policy, the global default value from the \"DefaultJavaScriptSetting\" policy (if set) or the user's personal configuration is used for all sites.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#javascriptallowedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_javascriptblockedforurls","displayName":"Block JavaScript on specific sites","description":"Define a list of sites, based on URL patterns, that aren't allowed to run JavaScript.\n\nIf you don't configure this policy, the global default value from the \"DefaultJavaScriptSetting\" policy (if set) or the user's personal configuration is used for all sites.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#javascriptblockedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_javascriptjitallowedforsites","displayName":"Allow JavaScript to use JIT on these sites","description":"Allows you to set a list of site url patterns that specify sites which are allowed to run JavaScript with JIT (Just In Time) compiler enabled.\n\nFor detailed information on valid site url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.\n\nJavaScript JIT policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.contoso.com will not correctly apply to contoso.com or subdomain.contoso.com since they both resolve to the same eTLD+1 (contoso.com) for which there is no policy. In this case, policy must be set on contoso.com to apply correctly for both contoso.com and subdomain.contoso.com.\n\nThis policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if contoso.com is listed in the JavaScriptJitAllowedForSites policy but contoso.com loads a frame containing fabrikam.com then contoso.com will have JavaScript JIT enabled, but fabrikam.com will use the policy from \"DefaultJavaScriptJitSetting\", if set, or default to JavaScript JIT enabled.\n\nIf you don't configure this policy for a site then the policy from \"DefaultJavaScriptJitSetting\" applies to the site, if set, otherwise Javascript JIT is enabled for the site.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#javascriptjitallowedforsites"],"options":null},{"id":"com.apple.managedclient.preferences_javascriptjitblockedforsites","displayName":"Block JavaScript from using JIT on these sites","description":"Allows you to set a list of site url patterns that specify sites which are not allowed to run JavaScript JIT (Just In Time) compiler enabled.\n\nDisabling the JavaScript JIT will mean that Microsoft Edge may render web content more slowly, and may also disable parts of JavaScript including WebAssembly. Disabling the JavaScript JIT may allow Microsoft Edge to render web content in a more secure configuration.\n\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.\n\nJavaScript JIT policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.contoso.com will not correctly apply to contoso.com or subdomain.contoso.com since they both resolve to the same eTLD+1 (contoso.com) for which there is no policy. In this case, policy must be set on contoso.com to apply correctly for both contoso.com and subdomain.contoso.com.\n\nThis policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if contoso.com is listed in the JavaScriptJitBlockedForSites policy but contoso.com loads a frame containing fabrikam.com then contoso.com will have JavaScript JIT disabled, but fabrikam.com will use the policy from \"DefaultJavaScriptJitSetting\", if set, or default to JavaScript JIT enabled.\n\nIf you don't configure this policy for a site then the policy from \"DefaultJavaScriptJitSetting\" applies to the site, if set, otherwise JavaScript JIT is enabled for the site.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#javascriptjitblockedforsites"],"options":null},{"id":"com.apple.managedclient.preferences_keyboardfocusablescrollersenabled","displayName":"Enable keyboard focusable scrollers (Deprecated)","description":"This policy provides a temporary opt-out for the new keyboard focusable scrollers behavior.\n\nWhen this policy is Enabled or unset, scrollers without focusable children are keyboard focusable by default. Further, scrollers are click focusable and programmatically focusable by default.\n\nWhen this policy is Disabled, scrollers are not focusable by default.\n\nThis policy is a temporary workaround and will be removed in Edge Stable 135.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#keyboardfocusablescrollersenabled"],"options":[{"id":"com.apple.managedclient.preferences_keyboardfocusablescrollersenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_keyboardfocusablescrollersenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_kfmblockoptin","displayName":"Prevent users from using the Folder Backup feature (Known Folder Move)","description":"This setting prevents users from moving their Documents and Desktop folders to any OneDrive account.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#kfmblockoptin"],"options":[{"id":"com.apple.managedclient.preferences_kfmblockoptin_0","displayName":"No prevention","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_kfmblockoptin_1","displayName":"Prevent Folder Backup","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_kfmblockoptin_2","displayName":"Prevent Folder Backup and Redirect to local device","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_kfmblockoptout","displayName":"Force users to use the Folder Backup feature (Known Folder Move)","description":"This setting forces users to keep their Documents and Desktop folders directed to OneDrive.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#kfmblockoptout"],"options":[{"id":"com.apple.managedclient.preferences_kfmblockoptout_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_kfmblockoptout_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_kfmoptinwithwizard","displayName":"Prompt users to enable the Folder Backup feature (Known Folder Move)","description":"This setting displays a wizard that prompts users to move their Documents and Desktop folders to OneDrive. Enter your Microsoft 365 tenant ID to enable this feature.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#kfmoptinwithwizard"],"options":null},{"id":"com.apple.managedclient.preferences_kfmsilentoptin","displayName":"Automatically and silently enable the Folder Backup feature (Known Folder Move)","description":"Use this setting to redirect and move your users Documents and/or Desktop folders to OneDrive without any user interaction. Enter your Microsoft 365 tenant ID to enable this feature.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#kfmsilentoptin"],"options":null},{"id":"com.apple.managedclient.preferences_kfmsilentoptindesktop","displayName":"Include ~/Desktop in Folder Backup (Known Folder Move)","description":null,"helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#kfmsilentoptin"],"options":[{"id":"com.apple.managedclient.preferences_kfmsilentoptindesktop_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_kfmsilentoptindesktop_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_kfmsilentoptindocuments","displayName":"Include ~/Documents in Folder Backup (Known Folder Move)","description":null,"helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#kfmsilentoptin"],"options":[{"id":"com.apple.managedclient.preferences_kfmsilentoptindocuments_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_kfmsilentoptindocuments_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_kfmsilentoptinwithnotification","displayName":"Display a notification to users once their folders have been redirected","description":"Display a notification to users once their folders have been redirected","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#kfmsilentoptin"],"options":[{"id":"com.apple.managedclient.preferences_kfmsilentoptinwithnotification_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_kfmsilentoptinwithnotification_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_kioskaddressbareditingenabled","displayName":"Configure address bar editing for kiosk mode public browsing experience","description":"This policy only applies to Microsoft Edge kiosk mode while using the public browsing experience.\r\n\r\nIf you enable or don't configure this policy, users can change the URL in the address bar.\r\n\r\nIf you disable this policy, it prevents users from changing the URL in the address bar.\r\n\r\nFor detailed information on configuring kiosk Mode, see https://go.microsoft.com/fwlink/?linkid=2137578.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#kioskaddressbareditingenabled"],"options":[{"id":"com.apple.managedclient.preferences_kioskaddressbareditingenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_kioskaddressbareditingenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_legacysamesitecookiebehaviorenabled","displayName":"Enable default legacy SameSite cookie behavior setting","description":"Lets you revert all cookies to legacy SameSite behavior. Reverting to legacy behavior causes cookies that don't specify a SameSite attribute to be treated as if they were \"SameSite=None\", and removes the requirement for \"SameSite=None\" cookies to carry the \"Secure\" attribute.\n\nYou can set the following values for this policy:\n\n* 1 = Revert to legacy SameSite behavior for cookies on all sites\n\n* 2 = Use SameSite-by-default behavior for cookies on all sites\n\nIf you don't set this policy, the default behavior for cookies that don't specify a SameSite attribute will depend on other configuration sources for the SameSite-by-default feature. This feature might be set by a field trial or by enabling the same-site-by-default-cookies flag in edge://flags.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#legacysamesitecookiebehaviorenabled"],"options":[{"id":"com.apple.managedclient.preferences_legacysamesitecookiebehaviorenabled_0","displayName":"Revert to legacy SameSite behavior for cookies on all sites","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_legacysamesitecookiebehaviorenabled_1","displayName":"Use SameSite-by-default behavior for cookies on all sites","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_legacysamesitecookiebehaviorenabledfordomainlist","displayName":"Revert to legacy SameSite behavior for cookies on specified sites (Deprecated)","description":"Cookies set for domains match specified patterns will revert to legacy SameSite behavior.\n\nReverting to legacy behavior causes cookies that don't specify a SameSite attribute to be treated as if they were \"SameSite=None\", and removes the requirement for \"SameSite=None\" cookies to carry the \"Secure\" attribute.\n\nIf you don't set this policy, the global default value will be used. The global default will also be used for cookies on domains not covered by the patterns you specify.\n\nThe global default value can be configured using the \"LegacySameSiteCookieBehaviorEnabled\" policy. If \"LegacySameSiteCookieBehaviorEnabled\" is unset, the global default value falls back to other configuration sources.\n\nNote that patterns you list in this policy are treated as domains, not URLs, so you should not specify a scheme or port.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#legacysamesitecookiebehaviorenabledfordomainlist"],"options":null},{"id":"com.apple.managedclient.preferences_linkedaccountenabled","displayName":"Enable the linked account feature (Deprecated)","description":"Microsoft Edge guides a user to the account management page where they can link a Microsoft Account (MSA) to an Azure Active Directory (Azure AD) account.\n\nIf you enable or don't configure this policy, linked account information will be shown on a flyout. When the Azure AD profile doesn't have a linked account it will show \"Add account\".\n\nIf you disable this policy, linked accounts will be turned off and no extra information will be shown.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#linkedaccountenabled"],"options":[{"id":"com.apple.managedclient.preferences_linkedaccountenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_linkedaccountenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_localprovidersenabled","displayName":"Allow suggestions from local providers","description":"Allow suggestions from suggestion providers on the device (local providers), for example, Favorites and Browsing History, in Microsoft Edge's Address Bar and Auto-Suggest List.\n\nIf you enable this policy, suggestions from local providers are used.\n\nIf you disable this policy, suggestions from local providers are never used. Local history and local favorites suggestions will not appear.\n\nIf you do not configure this policy, suggestions from local providers are allowed but the user can change that using the settings toggle.\n\nNote that some features may not be available if a policy to disable this feature has been applied. For example, Browsing History suggestions will not be available if you enable the \"SavingBrowserHistoryDisabled\" policy.\n\nThis policy requires a browser restart to finish applying.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#localprovidersenabled"],"options":[{"id":"com.apple.managedclient.preferences_localprovidersenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_localprovidersenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_lowpriorityscheduledscan","displayName":"Low priority scheduled scan","description":"Should scheduled scan be run with low priority. (Scan might take longer to complete).","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_lowpriorityscheduledscan_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_lowpriorityscheduledscan_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_managedsearchengines","displayName":"Managed Search Engines","description":"Lets you configure a list of up to 10 search engines, one of which must be marked as the default search engine.\nYou do not need to specify the encoding. Starting in Microsoft Edge 80, the suggest_url and image_search_url parameters are optional. The optional parameter, image_search_post_params (consists of comma-separated name/value pairs), is available starting in Microsoft Edge 80.\n\nStarting in Microsoft Edge 83, you can enable search engine discovery with the allow_search_engine_discovery optional parameter. This parameter must be the first item in the list. If allow_search_engine_discovery is not specified, search engine discovery will be disabled by default. Starting in Microsoft Edge 84, you can set this policy as a recommended policy to allow search provider discovery. You do not need to add the allow_search_engine_discovery optional parameter.\n\nIf you enable this policy, users can't add, remove, or change any search engine in the list. Users can set their default search engine to any search engine in the list.\n\nIf you disable or don't configure this policy, users can modify the search engines list as desired.\n\nIf the \"DefaultSearchProviderSearchURL\" policy is set, this policy (ManagedSearchEngines) is ignored. The user must restart their browser to finish applying this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#managedsearchengines"],"options":null},{"id":"com.apple.managedclient.preferences_managedsearchengines_item_allow_search_engine_discovery","displayName":"Allow search engine discovery","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_managedsearchengines_item_allow_search_engine_discovery_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_managedsearchengines_item_allow_search_engine_discovery_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_managedsearchengines_item_encoding","displayName":"Encoding","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_managedsearchengines_item_image_search_post_params","displayName":"Image search post params","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_managedsearchengines_item_image_search_url","displayName":"Image search URL","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_managedsearchengines_item_is_default","displayName":"Is default","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_managedsearchengines_item_is_default_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_managedsearchengines_item_is_default_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_managedsearchengines_item_keyword","displayName":"Keyword","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_managedsearchengines_item_name","displayName":"Name","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_managedsearchengines_item_search_url","displayName":"Search URL","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_managedsearchengines_item_suggest_url","displayName":"Suggest URL","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_manifestserver","displayName":"Deferred updates (Deprecated)","description":"You can tell AutoUpdate to either a) wait for a number of days to pass before downloading updates from the Current Channel, or b) stop Office from advancing beyond a given version. Deferred updates only affects Word, Excel, PowerPoint, Outlook, and OneNote. Other applications such as Edge, Defender, and Company Portal will receive updates based on the regular Current Channel schedule.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_manifestserver_0","displayName":"Defer 3 days","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_1","displayName":"Defer 7 days","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_2","displayName":"Defer 14 days","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_3","displayName":"Defer 21 days","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_4","displayName":"Defer 28 days","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_5","displayName":"Defer 45 days","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_6","displayName":"Pause at 16.64 (August 2022 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_7","displayName":"Pause at 16.63 (July 2022 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_8","displayName":"Pause at 16.62 (June 2022 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_9","displayName":"Pause at 16.61 (May 2022 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_10","displayName":"Pause at 16.60 (April 2022 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_11","displayName":"Pause at 16.59 (March 2022 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_12","displayName":"Pause at 16.58 (February 2022 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_13","displayName":"Pause at 16.57 (January 2022 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_14","displayName":"Pause at 16.56 (December 2021 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_15","displayName":"Pause at 16.55 (November 2021 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_16","displayName":"Pause at 16.54 (October 2021 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_17","displayName":"Pause at 16.53 (September 2021 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_18","displayName":"Pause at 16.52 (August 2021 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_19","displayName":"Pause at 16.51 (July 2021 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_20","displayName":"Pause at 16.80 (December 2023 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_21","displayName":"Pause at 16.79 (November 2023 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_22","displayName":"Pause at 16.78 (October 2023 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_23","displayName":"Pause at 16.77 (September 2023 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_24","displayName":"Pause at 16.76 (August 2023 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_25","displayName":"Pause at 16.75 (July 2023 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_26","displayName":"Pause at 16.74 (June 2023 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_27","displayName":"Pause at 16.73 (May 2023 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_28","displayName":"Pause at 16.72 (April 2023 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_29","displayName":"Pause at 16.71 (March 2023 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_30","displayName":"Pause at 16.70 (February 2023 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_31","displayName":"Pause at 16.69 (January 2023 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_32","displayName":"Pause at 16.68 (December 2022 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_33","displayName":"Pause at 16.67 (November 2022 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_34","displayName":"Pause at 16.66 (October 2022 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_35","displayName":"Pause at 16.65 (September 2022 Release)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_manifestserver_36","displayName":"Change Freeze","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_maxconnectionsperproxy","displayName":"Maximum number of concurrent connections to the proxy server","description":"Specifies the maximum number of simultaneous connections to the proxy server.\n\nSome proxy servers can't handle a high number of concurrent connections per client - you can solve this by setting this policy to a lower value.\n\nThe value of this policy should be lower than 100 and higher than 6. The default value is 32.\n\nSome web apps are known to consume many connections with hanging GETs - lowering the maximum connections below 32 may lead to browser networking hangs if too many of these kind of web apps are open.\n\nIf you don't configure this policy, the default value (32) is used.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#maxconnectionsperproxy"],"options":null},{"id":"com.apple.managedclient.preferences_maximumondemandscanthreads","displayName":"Degree of parallelism for on-demand scans","description":"Specifies the degree of parallelism for on-demand scans. This corresponds to the number of threads used to perform the scan and impacts the CPU usage, as well as the duration of the on-demand scan.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-preferences?view=o365-worldwide#degree-of-parallelism-for-on-demand-scans"],"options":null},{"id":"com.apple.managedclient.preferences_mediaroutercastallowallips","displayName":"Allow Google Cast to connect to Cast devices on all IP addresses","description":"Enable this policy to let Google Cast connect to Cast devices on all IP addresses, not just RFC1918/RFC4193 private addresses.\n\nDisable this policy to restrict Google Cast to Cast devices on RFC1918/RFC4193 private addresses.\n\nIf you don't configure this policy, Google Cast connects to Cast devices on RFC1918/RFC4193 private addresses only, unless you enable the CastAllowAllIPs feature.\n\nIf the \"EnableMediaRouter\" policy is disabled, then this policy has no effect.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#mediaroutercastallowallips"],"options":[{"id":"com.apple.managedclient.preferences_mediaroutercastallowallips_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_mediaroutercastallowallips_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_merge_policy","displayName":"Performance profiles merge policy","description":"Specify the merge policy for performance profiles. This can be a combination of administrator-defined and user-defined profiles (merge) or only administrator-defined profiles (admin_only).","helpText":null,"infoUrls":["https://learn.microsoft.com/en-us/defender-endpoint/performance-profiles"],"options":[{"id":"com.apple.managedclient.preferences_merge_policy_0","displayName":"merge","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_merge_policy_1","displayName":"admin_only","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_metricsreportingenabled","displayName":"Enable usage and crash-related data reporting","description":"This policy enables reporting of usage and crash-related data about Microsoft Edge to Microsoft.\n\nEnable this policy to send reporting of usage and crash-related data to Microsoft. Disable this policy to not send the data to Microsoft. In both cases, users can't change or override the setting.\n\nOn Windows 10, Beta and Stable channels, if you don’t configure this policy, Microsoft Edge will default to the Windows diagnostic data setting. If you enable this policy, Microsoft Edge will only send usage data if the Windows Diagnostic data setting is set to Enhanced or Full. If you disable this policy, Microsoft Edge will not send usage data. Crash-related data is sent based on the Windows Diagnostic data setting. Learn more about Windows Diagnostic data settings at https://go.microsoft.com/fwlink/?linkid=2099569\n\nOn Windows 10, Canary and Dev channels, this policy controls sending usage data. If this policy is not configured, Microsoft Edge will default to the user's preference. Crash-related data is sent based on the Windows Diagnostic data setting. Learn more about Windows Diagnostic data settings: https://go.microsoft.com/fwlink/?linkid=2099569\n\nOn Windows 7, 8, and macOS, this policy controls sending usage and crash-related data. If you don’t configure this policy, Microsoft Edge will default to the user's preference.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#metricsreportingenabled"],"options":[{"id":"com.apple.managedclient.preferences_metricsreportingenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_metricsreportingenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_microsoftedgeinsiderpromotionenabled","displayName":"Microsoft Edge Insider Promotion Enabled","description":"Shows content promoting the Microsoft Edge Insider channels on the About Microsoft Edge settings page.\n\nIf you enable or don't configure this policy, the Microsoft Edge Insider promotion content will be shown on the About Microsoft Edge page.\n\nIf you disable this policy, the Microsoft Edge Insider promotion content will not be shown on the About Microsoft Edge page.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#microsoftedgeinsiderpromotionenabled"],"options":[{"id":"com.apple.managedclient.preferences_microsoftedgeinsiderpromotionenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_microsoftedgeinsiderpromotionenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_microsofteditorproofingenabled","displayName":"Spell checking provided by Microsoft Editor","description":"The Microsoft Editor service provides enhanced spell and grammar checking for editable text fields on web pages.\n\nIf you enable or don't configure this policy, Microsoft Editor spell check can be used for eligible text fields.\n\nIf you disable this policy, spell check can only be provided by local engines that use platform or Hunspell services. The results from these engines might be less informative than the results Microsoft Editor can provide.\n\nIf the \"SpellcheckEnabled\" policy is set to disabled, or the user disables spell checking in the settings page, this policy will have no effect.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#microsofteditorproofingenabled"],"options":[{"id":"com.apple.managedclient.preferences_microsofteditorproofingenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_microsofteditorproofingenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_microsofteditorsynonymsenabled","displayName":"Synonyms are provided when using Microsoft Editor spell checker","description":"The Microsoft Editor service provides enhanced spell and grammar checking for editable text fields on web pages, and synonyms can be suggested as an integrated feature.\n\nIf you enable this policy, Microsoft Editor spell checker will provide synonyms for suggestions for misspelled words.\n\nIf you disable or don't configure this policy, Microsoft Editor spell checker will not provide synonyms for suggestions for misspelled words.\n\nIf the \"SpellcheckEnabled\" policy or the \"MicrosoftEditorProofingEnabled\" policy are set to disabled, or the user disables spell checking or chooses not to use Microsoft Editor spell checker in the settings page, this policy will have no effect.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#microsofteditorsynonymsenabled"],"options":[{"id":"com.apple.managedclient.preferences_microsofteditorsynonymsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_microsofteditorsynonymsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_msawebsitessousingthisprofileallowed","displayName":"Allow single sign-on for Microsoft personal sites using this profile","description":"'Allow single sign-on for Microsoft personal sites using this profile' option allows non-MSA profiles to be able to use single sign-on for Microsoft sites using MSA credentials present on the machine. This option shows up for end-users as a toggle in Settings -> Profiles -> Profile Preferences for non-MSA profiles only.\n\nIf you disable this policy, non-MSA profiles will not be able to use single sign-on for Microsoft sites using MSA credentials present on the machine.\n\nIf you enable this policy or don't configure it, users will be able to use the Settings option to ensure non-MSA profiles are able to use single sign-on for Microsoft sites using MSA credentials present on the machine provided only a single MSA account exists on the machine.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#msawebsitessousingthisprofileallowed"],"options":[{"id":"com.apple.managedclient.preferences_msawebsitessousingthisprofileallowed_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_msawebsitessousingthisprofileallowed_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_mutationeventsenabled","displayName":"Enable deprecated/removed Mutation Events (Deprecated)","description":"This policy provides a temporary opt-in back to a deprecated and removed set of platform events named Mutation Events.\n\nIf you enable this policy, mutation events will continue to be fired, even if they've been disabled by default for normal web users.\n\nIf you disable or don't configure this policy, these events will not be fired.\n\nThis policy is a temporary workaround, and enterprises should still work to remove their dependencies on these mutation events.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#mutationeventsenabled"],"options":[{"id":"com.apple.managedclient.preferences_mutationeventsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_mutationeventsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_nativemessagingallowlist","displayName":"Control which native messaging hosts users can use","description":"List specific native messaging hosts that users can use in Microsoft Edge.\n\nBy default, all native messaging hosts are allowed. If you set the \"NativeMessagingBlocklist\" policy to *, all native messaging hosts are blocked, and only native messaging hosts listed in here are loaded.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#nativemessagingallowlist"],"options":null},{"id":"com.apple.managedclient.preferences_nativemessagingblocklist","displayName":"Configure native messaging block list","description":"Specifies which native messaging hosts that shouldn't be used.\n\nUse '*' to block all native messaging hosts unless they are explicitly listed in the allow list.\n\nIf you don't configure this policy, Microsoft Edge will load all installed native messaging hosts.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#nativemessagingblocklist"],"options":null},{"id":"com.apple.managedclient.preferences_nativemessaginguserlevelhosts","displayName":"Allow user-level native messaging hosts (installed without admin permissions)","description":"Enables user-level installation of native messaging hosts.\n\nIf you disable this policy, Microsoft Edge will only use native messaging hosts installed on the system level.\n\nBy default, if you don't configure this policy, Microsoft Edge will allow usage of user-level native messaging hosts.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#nativemessaginguserlevelhosts"],"options":[{"id":"com.apple.managedclient.preferences_nativemessaginguserlevelhosts_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_nativemessaginguserlevelhosts_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_networkpredictionoptions","displayName":"Enable network prediction","description":"Enables network prediction and prevents users from changing this setting.\n\nThis controls DNS prefetching, TCP and SSL preconnection, and prerendering of web pages.\n\nIf you don't configure this policy, network prediction is enabled but the user can change it.\n\n* 0 = Predict network actions on any network connection\n\n* 2 = Don't predict network actions on any network connection","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#networkpredictionoptions"],"options":[{"id":"com.apple.managedclient.preferences_networkpredictionoptions_0","displayName":"Predict network actions on any network connection","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_networkpredictionoptions_1","displayName":"Predict network actions on any network that is not cellular. (Deprecated in 50, removed in 52. After 52, if value 1 is set, it will be treated as 0 - predict network actions on any network connection.)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_networkpredictionoptions_2","displayName":"Don't predict network actions on any network connection","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_newpdfreaderenabled","displayName":"Microsoft Edge built-in PDF reader powered by Adobe Acrobat enabled","description":"The policy lets Microsoft Edge launch the new version of the built-in PDF reader that's powered by Adobe Acrobat's PDF rendering engine. The new PDF reader ensures that there's no loss of functionality and delivers an enhanced PDF experience. This experience includes richer rendering, improved performance, strong security for PDF handling, and greater accessibility.\n\nIf you enable this policy, Microsoft Edge will use the new Adobe Acrobat powered built-in PDF reader to open all PDF files.\n\nIf you disable or don't configure this policy, Microsoft Edge will use the existing PDF reader to open all PDF files.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#newpdfreaderenabled"],"options":[{"id":"com.apple.managedclient.preferences_newpdfreaderenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_newpdfreaderenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_newtabpageallowedbackgroundtypes","displayName":"Configure the background types allowed for the new tab page layout","description":"You can configure which types of background image that are allowed on the new tab page layout in Microsoft Edge.\n\nIf you don't configure this policy, all background image types on the new tab page are enabled.\n\nPolicy options mapping:\n\n* DisableImageOfTheDay (1) = Disable daily background image type\n\n* DisableCustomImage (2) = Disable custom background image type\n\n* DisableAll (3) = Disable all background image types\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#newtabpageallowedbackgroundtypes"],"options":[{"id":"com.apple.managedclient.preferences_newtabpageallowedbackgroundtypes_0","displayName":"Disable daily background image type","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_newtabpageallowedbackgroundtypes_1","displayName":"Disable custom background image type","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_newtabpageallowedbackgroundtypes_2","displayName":"Disable all background image types","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_newtabpageapplauncherenabled","displayName":"Hide App Launcher on Microsoft Edge new tab page","description":"By default, the App Launcher is shown every time a user opens a new tab page.\n\nIf you enable or don't configure this policy, there is no change on the Microsoft Edge new tab page and App Launcher is there for users.\n\nIf you disable this policy, App Launcher doesn't appear and users won't be able to launch M365 apps from Microsoft Edge new tab page via the App Launcher.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#newtabpageapplauncherenabled"],"options":[{"id":"com.apple.managedclient.preferences_newtabpageapplauncherenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_newtabpageapplauncherenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_newtabpagebingchatenabled","displayName":"Disable Bing chat entry-points on Microsoft Edge Enterprise new tab page","description":"By default, the Microsoft Edge new tab page includes three Bing Chat entry points: one inside the search box, one in the Bing autosuggest dropdown when users click or begin typing in the box, and one as a suggested prompt below the box.\n\nIf you enable or don't configure this policy, these Bing Chat entry points continue to appear on the new tab page.\n\nIf you disable this policy, all Bing Chat entry points are removed from the new tab page.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#newtabpagebingchatenabled"],"options":[{"id":"com.apple.managedclient.preferences_newtabpagebingchatenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_newtabpagebingchatenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_newtabpagecompanylogo","displayName":"New Tab Page Company Logo","description":"We are deprecating this policy because it doesn't work as expected and recommend that it not be used.\n\nSpecifies the company logo to use on the new tab page in Microsoft Edge.\n\nThe policy should be configured as a string that expresses the logo(s) in JSON format. For example: { \"default_logo\": { \"url\": \"https://www.contoso.com/logo.png\", \"hash\": \"cd0aa9856147b6c5b4ff2b7dfee5da20aa38253099ef1b4a64aced233c9afe29\" }, \"light_logo\": { \"url\": \"https://www.contoso.com/light_logo.png\", \"hash\": \"517d286edb416bb2625ccfcba9de78296e90da8e32330d4c9c8275c4c1c33737\" } }\n\nYou configure this policy by specifying the URL from which Microsoft Edge can download the logo and its cryptographic hash (SHA-256), which is used to verify the integrity of the download. The logo must be in PNG or SVG format, and its file size must not exceed 16 MB. The logo is downloaded and cached, and it will be redownloaded whenever the URL or the hash changes. The URL must be accessible without any authentication.\n\nThe 'default_logo' is required and will be used when there's no background image. If 'light_logo' is provided, it will be used when the user's new tab page has a background image. We recommend a horizontal logo with a transparent background that is left-aligned and vertically centered. The logo should have a minimum height of 32 pixels and an aspect ratio from 1:1 to 4:1. The 'default_logo' should have proper contrast against a white/black background while the 'light_logo' should have proper contrast against a background image.\n\nIf you enable this policy, Microsoft Edge downloads and shows the specified logo(s) on the new tab page. Users can't override or hide the logo(s).\n\nIf you disable or don't configure this policy, Microsoft Edge will show no company logo or a Microsoft logo on the new tab page.\n\nFor help with determining the SHA-256 hash, see https://docs.microsoft.com/powershell/module/microsoft.powershell.utility/get-filehash.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#newtabpagecompanylogo"],"options":null},{"id":"com.apple.managedclient.preferences_newtabpagecompanylogo_default_logo","displayName":"Default logo","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_newtabpagecompanylogo_default_logo_hash","displayName":"Hash","description":"The SHA-256 hash of the image.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_newtabpagecompanylogo_default_logo_url","displayName":"URL","description":"The URL from which the image can be downloaded.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_newtabpagecompanylogo_light_logo","displayName":"Light logo","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_newtabpagecompanylogo_light_logo_hash","displayName":"Hash","description":"The SHA-256 hash of the image.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_newtabpagecompanylogo_light_logo_url","displayName":"URL","description":"The URL from which the image can be downloaded.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_newtabpagecompanylogoenabled","displayName":"Hide the company logo on the Microsoft Edge new tab page","description":"By default, the company logo is shown on the new tab page if the company logo is configured in Admin Portal.\n\nIf you enable or don't configure this policy, there is no change on the Microsoft Edge new tab page and the company logo is there for users.\n\nIf you disable this policy, the company logo doesn't appear on Microsoft Edge new tab page.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#newtabpagecompanylogoenabled"],"options":[{"id":"com.apple.managedclient.preferences_newtabpagecompanylogoenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_newtabpagecompanylogoenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_newtabpagehidedefaulttopsites","displayName":"Hide the default top sites from the new tab page","description":"Hides the default top sites from the new tab page in Microsoft Edge.\n\nIf you set this policy to true, the default top site tiles are hidden.\n\nIf you set this policy to false or don't configure it, the default top site tiles remain visible.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#newtabpagehidedefaulttopsites"],"options":[{"id":"com.apple.managedclient.preferences_newtabpagehidedefaulttopsites_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_newtabpagehidedefaulttopsites_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_newtabpagelocation","displayName":"Configure the new tab page URL","description":"Configures the default URL for the new tab page.\n\nThis policy determines the page that's opened when new tabs are created (including when new windows are opened). It also affects the startup page if that's set to open to the new tab page.\n\nThis policy doesn't determine which page opens on startup; that's controlled by the \"RestoreOnStartup\" policy. It also doesn’t affect the home page if that’s set to open to the new tab page.\n\nIf you don't configure this policy, the default new tab page is used.\n\nIf you configure this policy *and* the \"NewTabPageSetFeedType\" policy, this policy has precedence.\n\nIf an invalid URL is provided, new tabs will open about://blank.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances that are enrolled for device management.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#newtabpagelocation"],"options":null},{"id":"com.apple.managedclient.preferences_newtabpagemanagedquicklinks","displayName":"New Tab Page Managed Quick Links","description":"By default, Microsoft Edge displays quick links on the new tab page from user-added shortcuts and top sites based on browsing history. With this policy, you can configure up to three quick link tiles on the new tab page, expressed as a JSON object:\n\n[ { \"url\": \"https://www.contoso.com\", \"title\": \"Contoso Portal\", \"pinned\": true/false }, ... ]\n\nThe 'url' field is required; 'title' and 'pinned' are optional. If 'title' is not provided, the URL is used as the default title. If 'pinned' is not provided, the default value is false.\n\nMicrosoft Edge presents these in the order listed, from left to right, with all pinned tiles displayed ahead of non-pinned tiles.\n\nIf the policy is set as mandatory, the 'pinned' field will be ignored and all tiles will be pinned. The tiles can't be deleted by the user and will always appear at the front of the quick links list.\n\nIf the policy is set as recommended, pinned tiles will remain in the list but the user has the ability to edit and delete them. Quick link tiles that aren't pinned behave like default top sites and are pushed off the list if other websites are visited more frequently. When applying non-pinned links via this policy to an existing browser profile, the links may not appear at all, depending on how they rank compared to the user's browsing history.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#newtabpagemanagedquicklinks"],"options":null},{"id":"com.apple.managedclient.preferences_newtabpagemanagedquicklinks_item_pinned","displayName":"Pinned","description":"0 - Not Pinned; 1 - Pinned.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_newtabpagemanagedquicklinks_item_pinned_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_newtabpagemanagedquicklinks_item_pinned_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_newtabpagemanagedquicklinks_item_title","displayName":"Title","description":"The title to display.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_newtabpagemanagedquicklinks_item_url","displayName":"URL","description":"The URL for the quick link.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_newtabpageprerenderenabled","displayName":"Enable preload of the new tab page for faster rendering","description":"If you configure this policy, preloading the New tab page is enabled, and users can't change this setting. If you don't configure this policy, preloading is enabled and a user can change this setting.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#newtabpageprerenderenabled"],"options":[{"id":"com.apple.managedclient.preferences_newtabpageprerenderenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_newtabpageprerenderenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_newtabpagequicklinksenabled","displayName":"Allow quick links on the new tab page","description":"If you enable or don't configure this policy, Microsoft Edge displays quick links on the new tab page, and the user can interact with the control, turning quick links on and off. Enabling this policy does not force quick links to be visible - the user can continue to turn quick links on and off.\n\nIf you disable this policy, Microsoft Edge hides quick links on the new tab page and disables the quick links control in the NTP settings flyout.\n\nThis policy only applies for Microsoft Edge local user profiles, profiles signed in using a Microsoft Account, and profiles signed in using Active Directory. To configure the Enterprise new tab page for profiles signed in using Azure Active Directory, use the M365 admin portal.\n\nRelated policies: \"NewTabPageAllowedBackgroundTypes\", \"NewTabPageContentEnabled\"","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#newtabpagequicklinksenabled"],"options":[{"id":"com.apple.managedclient.preferences_newtabpagequicklinksenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_newtabpagequicklinksenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_newtabpagesearchbox","displayName":"Configure the new tab page search box experience","description":"You can configure the new tab page search box to use \"Search box (Recommended)\" or \"Address bar\" to search on new tabs. This policy only works if you set the search engine to a value other than Bing by setting the following two policies: \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\".\n\n If you disable or don't configure this policy and:\n\n- If the address bar default search engine is Bing, the new tab page uses the search box to search on new tabs.\n- If the address bar default search engine is not Bing, users are offered an additional choice (use \"Address bar\") when searching on new tabs.\n\n\nIf you enable this policy and set it to:\n\n- \"Search box (Recommended)\" ('bing'), the new tab page uses the search box to search on new tabs.\n- \"Address bar\" ('redirect'), the new tab page search box uses the address bar to search on new tabs.\n\nPolicy options mapping:\n\n* bing (bing) = Search box (Recommended)\n\n* redirect (redirect) = Address bar\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#newtabpagesearchbox"],"options":[{"id":"com.apple.managedclient.preferences_newtabpagesearchbox_0","displayName":"Search box (Recommended)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_newtabpagesearchbox_1","displayName":"Address bar","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_newtabpagesetfeedtype","displayName":"Configure the Microsoft Edge new tab page experience","description":"Lets you choose either the Microsoft News or Office 365 feed experience for the new tab page.\n\nWhen you set this policy to Microsoft News feed experience (0), users will see the Microsoft News feed experience on the new tab page.\n\nWhen you set this policy to Office 365 feed experience (1), users with an Azure Active Directory browser sign-in will see the Office 365 feed experience on the new tab page.\n\nIf you disable or don't configure this policy:\n\n- Users with an Azure Active Directory browser sign-in are offered the Office 365 new tab page feed experience, as well as the standard new tab page feed experience.\n\n- Users without an Azure Active Directory browser sign-in will see the standard new tab page experience.\n\nIf you configure this policy *and* the \"NewTabPageLocation\" policy, \"NewTabPageLocation\" has precedence.\n\nDefault setting: Disabled or not configured.\n\n* 0 = Microsoft News feed experience\n\n* 1 = Office 365 feed experience","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#newtabpagesetfeedtype"],"options":[{"id":"com.apple.managedclient.preferences_newtabpagesetfeedtype_0","displayName":"Microsoft News feed experience","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_newtabpagesetfeedtype_1","displayName":"Office 365 feed experience","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_notificationsallowedforurls","displayName":"Allow notifications on specific sites","description":"Define a list of sites, based on URL patterns, that can display notifications.\n\nIf you don't configure this policy, the global default value from the \"DefaultNotificationsSetting\" policy (if set) or the user's personal configuration is used for all sites.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#notificationsallowedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_notificationsblockedforurls","displayName":"Block notifications on specific sites","description":"Allows you to create a list of url patterns to specify sites that are not allowed to display notifications.\n\nIf you don’t set this policy, the global default value will be used for all sites. This default value will be from the \"DefaultNotificationsSetting\" policy if it’s set, or from the user's personal configuration. For detailed information on valid url patterns, see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#notificationsblockedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_npssurveydisabled","displayName":"Disable user surveys","description":"Prevent survey and feedback dialogs from being shown to users.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_npssurveydisabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_npssurveydisabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_ntlmv2enabled","displayName":"Control whether NTLMv2 authentication is enabled","description":"Controls whether NTLMv2 is enabled.\n\nAll recent versions of Samba and Windows servers support NTLMv2. You should only disable NTLMv2 to address issues with backwards compatibility as it reduces the security of authentication.\n\nIf you don't configure this policy, NTLMv2 is enabled by default.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#ntlmv2enabled"],"options":[{"id":"com.apple.managedclient.preferences_ntlmv2enabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_ntlmv2enabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_officeactivationemailaddress","displayName":"Office Activation Email Address","description":"The sign in sheet for Word, Excel, PowerPoint, Outlook, and OneNote will be automatically populated with the specified value.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_officeautosignin","displayName":"Enable automatic sign-in","description":"Suppress first run and welcome dialogs when launching apps.","helpText":null,"infoUrls":["https://aka.ms/outlookprefs"],"options":[{"id":"com.apple.managedclient.preferences_officeautosignin_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_officeautosignin_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_officeexperiencesanalyzingcontentpreference","displayName":"Allow experiences and functionality that analyzes user content","description":"Examples: PowerPoint Designer, editing suggestions, Excel data insights.","helpText":null,"infoUrls":["https://aka.ms/macoce"],"options":[{"id":"com.apple.managedclient.preferences_officeexperiencesanalyzingcontentpreference_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_officeexperiencesanalyzingcontentpreference_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_officeexperiencesdownloadingcontentpreference","displayName":"Allow experiences and functionality that downloads user content","description":"Examples: Office document templates, online 3D models, online videos.","helpText":null,"infoUrls":["https://aka.ms/macoce"],"options":[{"id":"com.apple.managedclient.preferences_officeexperiencesdownloadingcontentpreference_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_officeexperiencesdownloadingcontentpreference_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_officewebaddindisableomexcatalog","displayName":"Disable third-party store add-in catalog","description":"Prevent users from accessing and downloading third-party add-ins from the Microsoft store (affects Word, Excel, and PowerPoint).","helpText":null,"infoUrls":["https://learn.microsoft.com/deployoffice/mac/preferences-add-ins"],"options":[{"id":"com.apple.managedclient.preferences_officewebaddindisableomexcatalog_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_officewebaddindisableomexcatalog_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_offlinedefinitionupdate","displayName":"Enable offline security intelligence updates","description":"Enables or disables offline security intelligence updates feature. When this feature is enabled Defender will use a local mirror server to update the signatures.","helpText":null,"infoUrls":["https://learn.microsoft.com/en-us/defender-endpoint/mac-support-offline-security-intelligence-update"],"options":[{"id":"com.apple.managedclient.preferences_offlinedefinitionupdate_0","displayName":"enabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_offlinedefinitionupdate_1","displayName":"disabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_offlinedefinitionupdatefallbacktocloud","displayName":"Fallback to Microsoft cloud updates","description":"Determine the Defender for Endpoint security intelligence update approach when offline mirror server fails to serve the update request. If set to true, the update is retried via the Microsoft cloud when offline security intelligence update failed.","helpText":null,"infoUrls":["https://learn.microsoft.com/en-us/defender-endpoint/mac-support-offline-security-intelligence-update#configure-the-endpoints"],"options":[{"id":"com.apple.managedclient.preferences_offlinedefinitionupdatefallbacktocloud_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_offlinedefinitionupdatefallbacktocloud_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_offlinedefinitionupdateurl","displayName":"URL for a security intelligence updates mirror server","description":"Sets the URL for a local offline security intelligence updates mirror server. When the feature is enabled Defender will use it to update the signatures.","helpText":null,"infoUrls":["https://learn.microsoft.com/en-us/defender-endpoint/mac-support-offline-security-intelligence-update#configure-the-endpoints"],"options":null},{"id":"com.apple.managedclient.preferences_offlinedefinitionupdateverifysig","displayName":"offline security intelligence updates signature verification","description":"Offline security intelligence updates signature verification with Microsoft Defender for Endpoint. It is recommended to keep this setting enabled when offline updates are enabled.","helpText":null,"infoUrls":["https://learn.microsoft.com/en-us/defender-endpoint/mac-support-offline-security-intelligence-update"],"options":[{"id":"com.apple.managedclient.preferences_offlinedefinitionupdateverifysig_0","displayName":"enabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_offlinedefinitionupdateverifysig_1","displayName":"disabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_oldisablejunkoptionsprefkey","displayName":"Disable Junk settings","description":"Prevent users from applying Junk options to emails.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#disable-junk-settings"],"options":[{"id":"com.apple.managedclient.preferences_oldisablejunkoptionsprefkey_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_oldisablejunkoptionsprefkey_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_openatlogin","displayName":"Open at login","description":"Specifies whether OneDrive starts automatically when the user logs in.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#openatlogin"],"options":[{"id":"com.apple.managedclient.preferences_openatlogin_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_openatlogin_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_optionalconnectedexperiencespreference","displayName":"Allow optional connected experiences","description":"Allow usage of third-party data controller services. Note: All Outlook add-ins will be disabled if the value is set to false.","helpText":null,"infoUrls":["https://aka.ms/macoce"],"options":[{"id":"com.apple.managedclient.preferences_optionalconnectedexperiencespreference_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_optionalconnectedexperiencespreference_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_organizationalbrandingonworkprofileuienabled","displayName":"Allow the use of your organization's branding assets from Microsoft Entra on the profile-related UI of a work or school profile","description":"Allow the use of your organization's branding assets from Entra, if any, on the profile-related UI of a profile that's signed in with an Entra ID (formerly known as Azure Active Directory) account. This requires a browser restart to take effect.\n\nIf you enable this policy, your organization's branding assets from Entra will be used.\n\nIf you disable or don't configure this policy, your organization's branding assets from Entra won't be used.\n\nFor more information about configuring your organization's branding assets on Entra, please visit https://go.microsoft.com/fwlink/?linkid=2254514.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#organizationalbrandingonworkprofileuienabled"],"options":[{"id":"com.apple.managedclient.preferences_organizationalbrandingonworkprofileuienabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_organizationalbrandingonworkprofileuienabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_organizationlogooverlayonappiconenabled","displayName":"Allow your organization's logo from Microsoft Entra to be overlaid on the Microsoft Edge app icon of a work or school profile","description":"Allow your organization's logo from Entra, if any, to be overlaid on the Microsoft Edge app icon of a profile that's signed in with an Entra ID (formerly known as Azure Active Directory) account. This requires a browser restart to take effect.\n\nIf you enable this policy, your organization's logo from Entra will be used.\n\nIf you disable or don't configure this policy, your organization's logo from Entra won't be used.\n\nFor more information about configuring your organization's logo on Entra, please visit https://go.microsoft.com/fwlink/?linkid=2254514.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#organizationlogooverlayonappiconenabled"],"options":[{"id":"com.apple.managedclient.preferences_organizationlogooverlayonappiconenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_organizationlogooverlayonappiconenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_originagentclusterdefaultenabled","displayName":"Origin-keyed agent clustering enabled by default","description":"The Origin-Agent-Cluster: HTTP header controls whether a document is isolated in an origin-keyed agent cluster or in a site-keyed agent cluster. This has security implications because an origin-keyed agent cluster allows isolating documents by origin. The consequence of this for developers is that the document.domain accessor can no longer be set when origin-keyed agent clustering is enabled.\n\nIf you enable or don't configure this policy, documents without the Origin-Agent-Cluster: header will be assigned to origin-keyed agent clustering by default. On these documents, the document.domain accessor will not be settable.\n\nIf you disable this policy, documents without the Origin-Agent-Cluster: header will be assigned to site-keyed agent clusters by default. On these documents, the document.domain accessor will be settable.\n\nSee https://go.microsoft.com/fwlink/?linkid=2191896 for additional details.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#originagentclusterdefaultenabled"],"options":[{"id":"com.apple.managedclient.preferences_originagentclusterdefaultenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_originagentclusterdefaultenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_overridesecurityrestrictionsoninsecureorigin","displayName":"Control where security restrictions on insecure origins apply","description":"Specifies a list of origins (URLs) or hostname patterns (like \"*.contoso.com\") for which security restrictions on insecure origins don't apply.\n\nThis policy allows you to specify permitted origins for legacy applications that cannot deploy TLS or for internal web development staging servers. It enables developers to test features requiring secure contexts without the need to configure TLS on the staging server. Patterns are only accepted for hostnames; URLs or origins with schemes must be exact matches. This policy also prevents the origin from being labeled \"Not Secure\" in the omnibox.\n\nSetting a list of URLs in this policy has the same effect as setting the command-line flag '--unsafely-treat-insecure-origin-as-secure' to a comma-separated list of the same URLs. If you enable this policy, it overrides the command-line flag.\n\nFor more information on secure contexts, see https://www.w3.org/TR/secure-contexts/.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#overridesecurityrestrictionsoninsecureorigin"],"options":null},{"id":"com.apple.managedclient.preferences_passivemode","displayName":"Enable passive mode (deprecated)","description":"Whether the antivirus engine runs in passive mode or not.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#enable--disable-passive-mode"],"options":[{"id":"com.apple.managedclient.preferences_passivemode_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_passivemode_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_passworddeleteonbrowsercloseenabled","displayName":"Prevent passwords from being deleted if any Edge settings is enabled to delete browsing data when Microsoft Edge closes","description":"When this policy is enabled, the passwords saved with Edge Password Manager are exempted from deletion when the browser closes. This policy is only effective when the \"ClearBrowsingDataOnExit\" policy is enabled.\n\nIf you enable this policy, passwords won't be cleared when the browser closes.\nIf you disable or don't configure this policy, the user's personal configuration is used.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#passworddeleteonbrowsercloseenabled"],"options":[{"id":"com.apple.managedclient.preferences_passworddeleteonbrowsercloseenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_passworddeleteonbrowsercloseenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_passwordmanagerenabled","displayName":"Enable saving passwords to the password manager","description":"Enable Microsoft Edge to save user passwords.\n\nIf you enable this policy, users can save their passwords in Microsoft Edge. The next time they visit the site, Microsoft Edge will enter the password automatically.\n\nIf you disable this policy, users can't save new passwords, but they can still use previously saved passwords.\n\nIf you enable or disable this policy, users can't change or override it in Microsoft Edge. If you don't configure it, users can save passwords, as well as turn this feature off.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#passwordmanagerenabled"],"options":[{"id":"com.apple.managedclient.preferences_passwordmanagerenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_passwordmanagerenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_passwordmanagerrestrictlengthenabled","displayName":"Restrict the length of passwords that can be saved in the Password Manager","description":"Make Microsoft Edge restrict the length of usernames and/or passwords that can be saved in the Password Manager.\n\nIf you enable this policy, Microsoft Edge will not let the user save credentials with usernames and/or passwords longer than 256 characters.\n\nIf you disable or don't configure this policy, Microsoft Edge will let the user save credentials with arbitrarily long usernames and/or passwords.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#passwordmanagerrestrictlengthenabled"],"options":[{"id":"com.apple.managedclient.preferences_passwordmanagerrestrictlengthenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_passwordmanagerrestrictlengthenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_passwordmonitorallowed","displayName":"Allow Microsoft Edge to monitor user passwords","description":"If you enable this policy and a user consents to enabling the policy, the user will get alerted if any of their passwords stored in Microsoft Edge are found to be unsafe. Microsoft Edge will show an alert and this information will also be available in Settings > Passwords > Password Monitor.\n\nIf you disable this policy, users will not be asked for permission to enable this feature and will not be alerted. Their passwords will not be scanned.\n\nIf you disable this policy, users can't change or override the policy. However, if you enable or don't configure the policy, users can turn this feature on or off.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#passwordmonitorallowed"],"options":[{"id":"com.apple.managedclient.preferences_passwordmonitorallowed_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_passwordmonitorallowed_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_passwordprotectionchangepasswordurl","displayName":"Configure the change password URL","description":"Configures the change password URL (HTTP and HTTPS schemes only).\n\nPassword protection service will send users to this URL to change their password after seeing a warning in the browser.\n\nIf you enable this policy, then password protection service sends users to this URL to change their password.\n\nIf you disable this policy or don't configure it, then password protection service will not redirect users to a change password URL.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances that are enrolled for device management.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#passwordprotectionchangepasswordurl"],"options":null},{"id":"com.apple.managedclient.preferences_passwordprotectionloginurls","displayName":"Configure the list of enterprise login URLs where password protection service should capture fingerprint of password","description":"Configure the list of enterprise login URLs (HTTP and HTTPS schemes only) where Microsoft Edge should capture the fingerprint of passwords and use it for password reuse detection.\n\nIf you enable this policy, the password protection service captures fingerprints of passwords on the defined URLs.\n\nIf you disable this policy or don't configure it, no password fingerprints are captured.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances that are enrolled for device management.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#passwordprotectionloginurls"],"options":null},{"id":"com.apple.managedclient.preferences_passwordprotectionwarningtrigger","displayName":"Configure password protection warning trigger","description":"Allows you to control when to trigger password protection warning. Password protection alerts users when they reuse their protected password on potentially suspicious sites.\n\nYou can use the \"PasswordProtectionLoginURLs\" and \"PasswordProtectionChangePasswordURL\" policies to configure which passwords to protect.\n\nExemptions: Passwords for the sites listed in \"PasswordProtectionLoginURLs\" and \"PasswordProtectionChangePasswordURL\", as well as for the sites listed in \"SmartScreenAllowListDomains\", will not trigger a password-protection warning.\n\nSet to 'PasswordProtectionWarningOff' (0) to not show password protection warningss.\n\nSet to 'PasswordProtectionWarningOnPasswordReuse' (1) to show password protection warnings when the user reuses their protected password on a non-whitelisted site.\n\nIf you disable or don't configure this policy, then the warning trigger is not shown.\n\n* 0 = Password protection warning is off.\n\n* 1 = Password protection warning is triggered by password reuse.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#passwordprotectionwarningtrigger"],"options":[{"id":"com.apple.managedclient.preferences_passwordprotectionwarningtrigger_0","displayName":"Password protection warning is off","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_passwordprotectionwarningtrigger_1","displayName":"Password protection warning is triggered by password reuse","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_passwordrevealenabled","displayName":"Enable Password reveal button","description":"Lets you configure the default display of the browser password reveal button for password input fields on websites.\n\nIf you enable or don't configure this policy, the browser user setting defaults to displaying the password reveal button.\n\nIf you disable this policy, the browser user setting won't display the password reveal button.\n\nFor accessibility, users can change the browser setting from the default policy.\n\nThis policy only affects the browser password reveal button, it doesn't affect websites' custom reveal buttons.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#passwordrevealenabled"],"options":[{"id":"com.apple.managedclient.preferences_passwordrevealenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_passwordrevealenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_paymentmethodqueryenabled","displayName":"Allow websites to query for available payment methods","description":"Allows you to set whether websites can check if the user has payment methods saved.\n\nIf you disable this policy, websites that use PaymentRequest.canMakePayment or PaymentRequest.hasEnrolledInstrument API will be informed that no payment methods are available.\n\nIf you enable this policy or don't set this policy, websites can check if the user has payment methods saved.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#paymentmethodqueryenabled"],"options":[{"id":"com.apple.managedclient.preferences_paymentmethodqueryenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_paymentmethodqueryenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_pdfsecuremode","displayName":"Secure mode and Certificate-based Digital Signature validation in native PDF reader","description":"The policy enables Digital Signature validation for PDF files in a secure environment, which shows the correct validation status of the signatures.\n\nIf you enable this policy, PDF files with Certificate-based digital signatures are opened with an option to view and verify the validity of the signatures with high security.\n\nIf you disable or don't configure this policy, the capability to view and verify the signature will not be available.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#pdfsecuremode"],"options":[{"id":"com.apple.managedclient.preferences_pdfsecuremode_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_pdfsecuremode_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_pdfxfaenabled","displayName":"XFA support in native PDF reader enabled","description":"Lets the Microsoft Edge browser enable XFA (XML Forms Architecture) support in the native PDF reader and allows users to open XFA PDF files in the browser.\n\nIf you enable this policy, XFA support in the native PDF reader will be enabled.\n\nIf you disable or don't configure this policy, Microsoft Edge will not enable XFA support in the native PDF reader.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#pdfxfaenabled"],"options":[{"id":"com.apple.managedclient.preferences_pdfxfaenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_pdfxfaenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_performancedetectorenabled","displayName":"Performance Detector Enabled","description":"The performance detector detects tab performance issues and recommends actions to fix the performance issues.\n\nIf you enable or don't configure this policy, performance detector is turned on.\n\nIf you disable this policy, performance detector is turned off.\n\nThe user can configure its behavior in edge://settings/system.\n\nLearn more about performance detector: https://aka.ms/EdgePerformanceDetector","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#performancedetectorenabled"],"options":[{"id":"com.apple.managedclient.preferences_performancedetectorenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_performancedetectorenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_performanceprofiles","displayName":"Performance Profiles","description":"Performance profiles","helpText":null,"infoUrls":["https://learn.microsoft.com/en-us/defender-endpoint/performance-profiles"],"options":[{"id":"com.apple.managedclient.preferences_performanceprofiles_0","displayName":"enabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_performanceprofiles_1","displayName":"disabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_personalizationreportingenabled","displayName":"Allow personalization of ads, search and news by sending browsing history to Microsoft","description":"This policy prevents Microsoft from collecting a user's Microsoft Edge browsing history to be used for personalizing advertising, search, news and other Microsoft services.\n\nThis setting is only available for users with a Microsoft account. This setting is not available for child accounts or enterprise accounts.\n\nIf you disable this policy, users can't change or override the setting. If this policy is enabled or not configured, Microsoft Edge will default to the user’s preference.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#personalizationreportingenabled"],"options":[{"id":"com.apple.managedclient.preferences_personalizationreportingenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_personalizationreportingenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_phoenixonboardingflowfrelaunched","displayName":"Hide the 'Personalize the new Outlook' dialog","description":"Suppress the welcome dialog that appears when users switch to New Outlook.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook"],"options":[{"id":"com.apple.managedclient.preferences_phoenixonboardingflowfrelaunched_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_phoenixonboardingflowfrelaunched_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_pictureinpictureoverlayenabled","displayName":"Enable Picture in Picture overlay feature on supported webpages in Microsoft Edge","description":"This policy lets you configure the Picture in Picture floating overlay button in Microsoft Edge.\n\nThe Picture in Picture floating overlay button lets user to watch videos in a floating window on top of other windows.\n\nIf you enable or don't configure this policy, you can use the Picture in Picture floating overlay button in Microsoft Edge.\n\nIf you disable this policy, you can't use the Picture in Picture floating overlay button in Microsoft Edge.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#pictureinpictureoverlayenabled"],"options":[{"id":"com.apple.managedclient.preferences_pictureinpictureoverlayenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_pictureinpictureoverlayenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_pinbrowseressentialstoolbarbutton","displayName":"Pin browser essentials toolbar button","description":"This policy lets you configure whether to pin the Browser essentials button on the toolbar.\n\nWhen the button is pinned, it will always appear on the toolbar.\n\nWhen the button isn't pinned, it will only appear when there's an alert. An example of this kind of alert is the performance detector alert that indicates the browser is using high CPU or memory.\n\nIf you enable or don't configure this policy, the Browser essentials button will be pinned on the toolbar.\n\nIf you disable this policy, the Browser essentials button won't be pinned on the toolbar.\n\nLearn more about browser essentials: https://go.microsoft.com/fwlink/?linkid=2240439","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#pinbrowseressentialstoolbarbutton"],"options":[{"id":"com.apple.managedclient.preferences_pinbrowseressentialstoolbarbutton_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_pinbrowseressentialstoolbarbutton_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_pluginsallowedforurls","displayName":"Allow the Adobe Flash plug-in on specific sites","description":"Define a list of sites, based on URL patterns, that can run the Adobe Flash plug-in.\n\nIf you don't configure this policy, the global default value from the \"DefaultPluginsSetting\" policy (if set) or the user's personal configuration is used for all sites.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#pluginsallowedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_pluginsblockedforurls","displayName":"Block the Adobe Flash plug-in on specific sites","description":"Define a list of sites, based on URL patterns, that are blocked from running Adobe Flash.\n\nIf you don't configure this policy, the global default value from the \"DefaultPluginsSetting\" policy (if set) or the user's personal configuration is used for all sites.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#pluginsblockedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_popupsallowedforurls","displayName":"Allow pop-up windows on specific sites","description":"Define a list of sites, based on URL patterns, that can open pop-up windows.\n\nIf you don't configure this policy, the global default value from the \"DefaultPopupsSetting\" policy (if set) or the user's personal configuration is used for all sites.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#popupsallowedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_popupsblockedforurls","displayName":"Block pop-up windows on specific sites","description":"Define a list of sites, based on URL patterns, that are blocked from opening pop-up windows.\n\nIf you don't configure this policy, the global default value from the \"DefaultPopupsSetting\" policy (if set) or the user's personal configuration is used for all sites.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#popupsblockedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_postquantumkeyagreementenabled","displayName":"Enable post-quantum key agreement for TLS","description":"This policy configures whether Microsoft Edge offers a post-quantum key agreement algorithm in TLS. This lets supporting servers protect user traffic from being decrypted by quantum computers.\n\nIf you enable or don't configure this policy, Microsoft Edge offers a post-quantum key agreement in TLS connections. TLS connections are protected from quantum computers when communicating with compatible servers.\n\nIf you disable this policy, Microsoft Edge will not offer a post-quantum key agreement in TLS connections. User traffic is unprotected from decryption by quantum computers.\n\nOffering a post-quantum key agreement is backwards-compatible. Existing TLS servers and networking middleware are expected to ignore the new option and continue selecting previous options.\n\nHowever, devices that don't implement TLS correctly may malfunction when offered the new option. For example, they might disconnect in response to unrecognized options or the resulting larger messages. These devices aren't post-quantum-ready and will interfere with an enterprise's post-quantum transition. If this issue is encountered, administrators should contact the vendor for a fix.\n\nThis policy is a temporary measure and will be removed in future versions of Microsoft Edge. You can enable it to test for issues and you can disable it while you resolve issues.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#postquantumkeyagreementenabled"],"options":[{"id":"com.apple.managedclient.preferences_postquantumkeyagreementenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_postquantumkeyagreementenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_preventsmartscreenpromptoverride","displayName":"Prevent bypassing Microsoft Defender SmartScreen prompts for sites","description":"This policy setting lets you decide whether users can override the Microsoft Defender SmartScreen warnings about potentially malicious websites.\n\nIf you enable this setting, users can't ignore Microsoft Defender SmartScreen warnings and they are blocked from continuing to the site.\n\nIf you disable or don't configure this setting, users can ignore Microsoft Defender SmartScreen warnings and continue to the site.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#preventsmartscreenpromptoverride"],"options":[{"id":"com.apple.managedclient.preferences_preventsmartscreenpromptoverride_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_preventsmartscreenpromptoverride_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_preventsmartscreenpromptoverrideforfiles","displayName":"Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads","description":"This policy lets you determine whether users can override Microsoft Defender SmartScreen warnings about unverified downloads.\n\nIf you enable this policy, users in your organization can't ignore Microsoft Defender SmartScreen warnings, and they're prevented from completing the unverified downloads.\n\nIf you disable or don't configure this policy, users can ignore Microsoft Defender SmartScreen warnings and complete unverified downloads.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#preventsmartscreenpromptoverrideforfiles"],"options":[{"id":"com.apple.managedclient.preferences_preventsmartscreenpromptoverrideforfiles_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_preventsmartscreenpromptoverrideforfiles_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_preventtyposquattingpromptoverride","displayName":"Prevent bypassing Edge Website Typo Protection prompts for sites","description":"This policy setting lets you decide whether users can override the Edge Website Typo Protection warnings about potential typosquatting websites.\n\nIf you enable this setting, users can't ignore Edge Website Typo Protection warnings and they are blocked from continuing to the site.\n\nIf you disable or don't configure this setting, users can ignore Edge Website Typo Protection warnings and continue to the site.\n\nThis will only take effect when TyposquattingCheckerEnabled policy is not set or set to enabled.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#preventtyposquattingpromptoverride"],"options":[{"id":"com.apple.managedclient.preferences_preventtyposquattingpromptoverride_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_preventtyposquattingpromptoverride_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_primarypasswordsetting","displayName":"Configures a setting that asks users to enter their device password while using password autofill","description":"The feature helps users add an additional layer of privacy to their online accounts by requiring device authentication (as a way of confirming the user's identity) before the saved password is auto-filled into a web form. This ensures that non-authorized persons can't use saved passwords for autofill. Note that this feature does not protect against locally-running malware.\n\nThis group policy configures the radio button selector that enables this feature for users. It also has a frequency control where users can specify how often they would like to be prompted for authentication.\n\nIf you set this policy to 'Automatically', disable this policy, or don't configure this policy, autofill will not have any authentication flow.\n\nIf you set this policy to 'WithDevicePassword', users will have to enter their device password (or preferred mode of authentication under Windows) to prove their identity before their password is auto filled. Authentication modes include Windows Hello, PIN, face recognition, or fingerprint. The frequency for authentication prompt will be set to 'Ask permission once per browsing session' by default. However, users can change it to the other option, which is 'Always ask permission'.\n\nIf you set this policy to 'WithCustomPrimaryPassword', users will be asked to create their custom password and then to be redirected to Settings. After the custom password is set, users can authenticate themselves using the custom password and their passwords will get auto-filled after successful authentication. The frequency for authentication prompt will be set to 'Ask permission once per browsing session' by default. However, users can change it to the other option, which is 'Always ask permission'.\n\nIf you set this policy to 'AutofillOff', saved passwords will no longer be suggested for autofill.\n\nPolicy options mapping:\n\n* Automatically (0) = Automatically\n\n* WithDevicePassword (1) = With device password\n\n* WithCustomPrimaryPassword (2) = With custom primary password\n\n* AutofillOff (3) = Autofill off\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#primarypasswordsetting"],"options":[{"id":"com.apple.managedclient.preferences_primarypasswordsetting_0","displayName":"Automatically","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_primarypasswordsetting_1","displayName":"With device password","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_primarypasswordsetting_2","displayName":"With custom primary password","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_primarypasswordsetting_3","displayName":"Autofill off","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_printertypedenylist","displayName":"Disable printer types on the deny list","description":"The printer types on the deny list won't be discovered or have their capabilities fetched.\n\nPlacing all printer types on the deny list effectively disables printing, because there's no print destination for documents.\n\nIf you don't configure this policy, or the printer list is empty, all printer types are discoverable.\n\nPrinter destinations include extension printers and local printers. Extension printers are also known as print provider destinations, and include any destination that belongs to a Microsoft Edge extension.\nLocal printers are also known as native printing destinations, and include destinations available to the local machine and shared network printers.\n\nPolicy options mapping:\n\n* privet (privet) = Zeroconf-based (mDNS + DNS-SD) protocol destinations\n\n* extension (extension) = Extension-based destinations\n\n* pdf (pdf) = The 'Save as PDF' destination\n\n* local (local) = Local printer destinations\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#printertypedenylist"],"options":null},{"id":"com.apple.managedclient.preferences_printheaderfooter","displayName":"Print headers and footers","description":"Force 'headers and footers' to be on or off in the printing dialog.\n\nIf you don't configure this policy, users can decide whether to print headers and footers.\n\nIf you disable this policy, users can't print headers and footers.\n\nIf you enable this policy, users always print headers and footers.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#printheaderfooter"],"options":[{"id":"com.apple.managedclient.preferences_printheaderfooter_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_printheaderfooter_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_printingallowedbackgroundgraphicsmodes","displayName":"Restrict background graphics printing mode","description":"Restricts background graphics printing mode. If this policy isn't set there's no restriction on printing background graphics.\n\nPolicy options mapping:\n\n* any (any) = Allow printing with and without background graphics\n\n* enabled (enabled) = Allow printing only with background graphics\n\n* disabled (disabled) = Allow printing only without background graphics\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#printingallowedbackgroundgraphicsmodes"],"options":[{"id":"com.apple.managedclient.preferences_printingallowedbackgroundgraphicsmodes_0","displayName":"Allow printing with and without background graphics","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_printingallowedbackgroundgraphicsmodes_1","displayName":"Allow printing only without background graphics","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_printingallowedbackgroundgraphicsmodes_2","displayName":"Allow printing only with background graphics","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_printingbackgroundgraphicsdefault","displayName":"Default background graphics printing mode","description":"Overrides the last used setting for printing background graphics.\nIf you enable this setting, background graphics printing is enabled.\nIf you disable this setting, background graphics printing is disabled.\n\nPolicy options mapping:\n\n* enabled (enabled) = Enable background graphics printing mode by default\n\n* disabled (disabled) = Disable background graphics printing mode by default\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#printingbackgroundgraphicsdefault"],"options":[{"id":"com.apple.managedclient.preferences_printingbackgroundgraphicsdefault_0","displayName":"Disable background graphics printing mode by default","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_printingbackgroundgraphicsdefault_1","displayName":"Enable background graphics printing mode by default","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_printingenabled","displayName":"Enable printing","description":"Enables printing in Microsoft Edge and prevents users from changing this setting.\n\nIf you enable this policy or don't configure it, users can print.\n\nIf you disable this policy, users can't print from Microsoft Edge. Printing is disabled in the wrench menu, extensions, JavaScript applications, and so on. Users can still print from plug-ins that bypass Microsoft Edge while printing. For example, certain Adobe Flash applications have the print option in their context menu, which isn't covered by this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#printingenabled"],"options":[{"id":"com.apple.managedclient.preferences_printingenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_printingenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_printingwebpagelayout","displayName":"Sets layout for printing","description":"Configuring this policy sets the layout for printing webpages.\n\nIf you disable or don't configure this policy, users can decide whether to print webpages in Portrait or Landscape layout.\n\nIf you enable this policy, the selected option is set as the layout option.\n\nPolicy options mapping:\n\n* portrait (0) = Sets layout option as portrait\n\n* landscape (1) = Sets layout option as landscape\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#printingwebpagelayout"],"options":[{"id":"com.apple.managedclient.preferences_printingwebpagelayout_0","displayName":"Sets layout option as portrait","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_printingwebpagelayout_1","displayName":"Sets layout option as landscape","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_printpdfasimagedefault","displayName":"Print PDF as Image Default","description":"Controls if Microsoft Edge makes the Print as image option the default when printing PDFs.\n\nIf you enable this policy, Microsoft Edge will default to setting the Print as image option in the Print Preview when printing a PDF.\n\nIf you disable or don't configure this policy, Microsoft Edge will not default to setting the Print as image option in the Print Preview when printing a PDF.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#printpdfasimagedefault"],"options":[{"id":"com.apple.managedclient.preferences_printpdfasimagedefault_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_printpdfasimagedefault_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_printpreviewusesystemdefaultprinter","displayName":"Set the system default printer as the default printer","description":"Tells Microsoft Edge to use the system default printer as the default choice in Print Preview instead of the most recently used printer.\n\nIf you disable this policy or don't configure it, Print Preview uses the most recently used printer as the default destination choice.\n\nIf you enable this policy, Print Preview uses the OS system default printer as the default destination choice.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#printpreviewusesystemdefaultprinter"],"options":[{"id":"com.apple.managedclient.preferences_printpreviewusesystemdefaultprinter_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_printpreviewusesystemdefaultprinter_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_printrasterizepdfdpi","displayName":"Print Rasterize PDF DPI","description":"Controls print image resolution when Microsoft Edge prints PDFs with rasterization.\n\nWhen printing a PDF using the Print to image option, it can be beneficial to specify a print resolution other than a device's printer setting or the PDF default. A high resolution will significantly increase the processing and printing time while a low resolution can lead to poor imaging quality.\n\nIf you set this policy, it allows a particular resolution to be specified for use when rasterizing PDFs for printing.\n\nIf you set this policy to zero or don't configure it, the system default resolution will be used during rasterization of page images.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#printrasterizepdfdpi"],"options":null},{"id":"com.apple.managedclient.preferences_printstickysettings","displayName":"Print preview sticky settings","description":"Specifies whether print preview should apply last used settings for Microsoft Edge PDF and webpages.\n\nIf you set this policy to 'EnableAll' or don't configure it, Microsoft Edge applies the last used print preview settings for both PDF and webpages.\n\nIf you set this policy to 'DisableAll', Microsoft Edge doesn't apply the last used print preview settings for both PDF and webpages.\n\nIf you set this policy to 'DisablePdf', Microsoft Edge doesn't apply the last used print preview settings for PDF printing and retains it for webpages.\n\nIf you set this policy to 'DisableWebpage', Microsoft Edge doesn't apply the last used print preview settings for webpage printing and retain it for PDF.\n\nThis policy is only available if you enable or don't configure the \"PrintingEnabled\" policy.\n\nPolicy options mapping:\n\n* EnableAll (0) = Enable sticky settings for PDF and Webpages\n\n* DisableAll (1) = Disable sticky settings for PDF and Webpages\n\n* DisablePdf (2) = Disable sticky settings for PDF\n\n* DisableWebpage (3) = Disable sticky settings for Webpages\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#printstickysettings"],"options":[{"id":"com.apple.managedclient.preferences_printstickysettings_0","displayName":"Enable sticky settings for PDF and Webpages","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_printstickysettings_1","displayName":"Disable sticky settings for PDF and Webpages","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_printstickysettings_2","displayName":"Disable sticky settings for PDF","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_printstickysettings_3","displayName":"Disable sticky settings for Webpages","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_privatenetworkaccessrestrictionsenabled","displayName":"Specifies whether to apply restrictions to requests to more private network endpoints (Deprecated)","description":"Specifies whether to apply restrictions to requests to more private\nnetwork endpoints\n\nWhen this policy is Enabled, any time when a warning is supposed to be displayed in the DevTools due to Private Network Access checks failing, the request is blocked.\n\nWhen this policy is Disabled or unset, all Private Network Access warnings are not enforced and the requests are not blocked.\n\nSee https://wicg.github.io/private-network-access/ for Private Network Access restrictions.\n\nNote: A network endpoint is more private than another if:\n1) Its IP address is localhost and the other is not.\n2) Its IP address is private and the other is public.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#privatenetworkaccessrestrictionsenabled"],"options":[{"id":"com.apple.managedclient.preferences_privatenetworkaccessrestrictionsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_privatenetworkaccessrestrictionsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_proactiveauthenabled","displayName":"Enable Proactive Authentication","description":"Lets you configure whether to turn on Proactive Authentication.\n\nIf you enable this policy, Microsoft Edge tries to proactively authenticate the signed-in user with Microsoft services. At regular intervals, Microsoft Edge checks with an online service for an updated manifest that contains the configuration that governs how to do this.\n\nIf you disable this policy, Microsoft Edge doesn't try to proactively authenticate the signed-in user with Microsoft services. Microsoft Edge no longer checks with an online service for an updated manifest that contains the configuration for doing this.\n\nIf you don't configure this policy, Proactive Authentication is turned on.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#proactiveauthenabled"],"options":[{"id":"com.apple.managedclient.preferences_proactiveauthenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_proactiveauthenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_proactiveauthworkflowenabled","displayName":"Enable proactive authentication","description":"This policy controls the proactive authentication in Microsoft Edge, that connects the signed-in user identity with Microsoft Bing, MSN and Copilot services for a smooth and consistent sign-in experience.\n\nIf you enable or don't configure this policy, Microsoft Edge authentication requests are automatically sent to the services using the account that is signed-in to the browser.\n\nIf you disable this policy, Microsoft Edge does not send authentications requests to these services and users will need to manually sign-in.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#proactiveauthworkflowenabled"],"options":[{"id":"com.apple.managedclient.preferences_proactiveauthworkflowenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_proactiveauthworkflowenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_profiles","displayName":"Performance Profiles","description":"Names of performance profiles to apply.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_promotionaltabsenabled","displayName":"Enable full-tab promotional content (deprecated)","description":"Control the presentation of full-tab promotional or educational content. This setting controls the presentation of welcome pages that help users sign into Microsoft Edge, choose their default browser, or learn about product features.\n\nIf you enable this policy (set it true) or don't configure it, Microsoft Edge can show full-tab content to users to provide product information.\n\nIf you disable (set to false) this policy, Microsoft Edge can't show full-tab content to users.\n\nThis is deprecated - use ShowRecommendationsEnabled instead.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#promotionaltabsenabled"],"options":[{"id":"com.apple.managedclient.preferences_promotionaltabsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_promotionaltabsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_promptfordownloadlocation","displayName":"Ask where to save downloaded files","description":"Set whether to ask where to save a file before downloading it.\n\nIf you enable this policy, the user is asked where to save each file before downloading; if you don't configure it, files are saved automatically to the default location, without asking the user.\n\nIf you don't configure this policy, the user will be able to change this setting.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#promptfordownloadlocation"],"options":[{"id":"com.apple.managedclient.preferences_promptfordownloadlocation_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_promptfordownloadlocation_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_promptonmultiplematchingcertificates","displayName":"Prompt the user to select a certificate when multiple certificates match","description":"This policy controls whether the user is prompted to select a client certificate when more than one certificate matches \"AutoSelectCertificateForUrls\".\nIf this policy is set to True, the user is prompted to select a client certificate whenever the auto-selection policy matches multiple certificates.\nIf this policy is set to False or not set, the user may only be prompted when no certificate matches the auto-selection.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#promptonmultiplematchingcertificates"],"options":[{"id":"com.apple.managedclient.preferences_promptonmultiplematchingcertificates_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_promptonmultiplematchingcertificates_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_proxy","displayName":"Set proxy for MDE communication","description":"Configure proxy for all MDE cloud communication. If not set, the system-wide proxy is used.","helpText":null,"infoUrls":["https://learn.microsoft.com/en-us/defender-endpoint/mac-preferences#proxy-for-defender-for-endpoint-communication"],"options":null},{"id":"com.apple.managedclient.preferences_proxybypasslist","displayName":"Configure proxy bypass rules","description":"Defines a list of hosts for which Microsoft Edge bypasses any proxy.\n\nThis policy is applied only if you have selected 'Use fixed proxy servers' in the \"ProxyMode\" policy. If you selected any other mode for configuring proxy policies, don't enable or configure this policy.\n\nIf you enable this policy, you can create a list of hosts for which Microsoft Edge doesn't use a proxy.\n\nIf you don't configure this policy, no list of hosts is created for which Microsoft Edge bypasses a proxy. Leave this policy unconfigured if you've specified any other method for setting proxy policies.\n\nFor more detailed examples go to https://go.microsoft.com/fwlink/?linkid=2094936.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#proxybypasslist"],"options":null},{"id":"com.apple.managedclient.preferences_proxymode","displayName":"Configure proxy server settings","description":"Specify the proxy server settings used by Microsoft Edge. If you enable this policy, users can't change the proxy settings.\n\nIf you choose to never use a proxy server and to always connect directly, all other options are ignored.\n\nIf you choose to use system proxy settings, all other options are ignored.\n\nIf you choose to auto detect the proxy server, all other options are ignored.\n\nIf you choose fixed server proxy mode, you can specify further options in \"ProxyServer\" and 'Comma-separated list of proxy bypass rules'.\n\nIf you choose to use a .pac proxy script, you must specify the URL to the script in 'URL to a proxy .pac file'.\n\nFor detailed examples, go to https://go.microsoft.com/fwlink/?linkid=2094936.\n\nIf you enable this policy, Microsoft Edge will ignore all proxy-related options specified from the command line.\n\nIf you don't configure this policy users can choose their own proxy settings.\n\n* \"direct\" = Never use a proxy\n\n* \"auto_detect\" = Auto detect proxy settings\n\n* \"pac_script\" = Use a .pac proxy script\n\n* \"fixed_servers\" = Use fixed proxy servers\n\n* \"system\" = Use system proxy settings","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#proxymode"],"options":[{"id":"com.apple.managedclient.preferences_proxymode_0","displayName":"Never use a proxy","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_proxymode_1","displayName":"Auto detect proxy settings","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_proxymode_2","displayName":"Use a .pac proxy script","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_proxymode_3","displayName":"Use fixed proxy servers","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_proxymode_4","displayName":"Use system proxy settings","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_proxypacurl","displayName":"Set the proxy .pac file URL","description":"Specifies the URL for a proxy auto-config (PAC) file.\n\nThis policy is applied only if you selected 'Use a .pac proxy script' in the \"ProxyMode\" policy. If you selected any other mode for configuring proxy policies, don't enable or configure this policy.\n\nIf you enable this policy, you can specify the URL for a PAC file, which defines how the browser automatically chooses the appropriate proxy server for fetching a particular website.\n\nIf you disable or don't configure this policy, no PAC file is specified. Leave this policy unconfigured if you've specified any other method for setting proxy policies.\n\nFor detailed examples, see https://go.microsoft.com/fwlink/?linkid=2094936.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#proxypacurl"],"options":null},{"id":"com.apple.managedclient.preferences_proxyserver","displayName":"Configure address or URL of proxy server","description":"Specifies the URL of the proxy server.\n\nThis policy is applied only if you have selected 'Use fixed proxy servers' in the \"ProxyMode\" policy. If you selected any other mode for configuring proxy policies, don't enable or configure this policy.\n\nIf you enable this policy, the proxy server configured by this policy will be used for all URLs.\n\nIf you disable or don't configure this policy, users can choose their own proxy settings while in this proxy mode. Leave this policy unconfigured if you've specified any other method for setting proxy policies.\n\nFor more options and detailed examples, see https://go.microsoft.com/fwlink/?linkid=2094936.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#proxyserver"],"options":null},{"id":"com.apple.managedclient.preferences_proxysettings","displayName":"Proxy Settings","description":"Configures the proxy settings for Microsoft Edge.\n\nIf you enable this policy, Microsoft Edge ignores all proxy-related options specified from the command line.\n\nIf you don't configure this policy, users can choose their own proxy settings.\n\nThis policy overrides the following individual policies:\n\n\"ProxyMode\"\n\"ProxyPacUrl\"\n\"ProxyServer\"\n\"ProxyBypassList\"\n\nThe ProxyMode field lets you specify the proxy server used by Microsoft Edge and prevents users from changing proxy settings.\n\nThe ProxyPacUrl field is a URL to a proxy .pac file.\n\nThe ProxyServer field is a URL for the proxy server.\n\nThe ProxyBypassList field is a list of proxy hosts that Microsoft Edge bypasses.\n\nIf you choose the 'direct' value as 'ProxyMode', a proxy is never used and all other fields are ignored.\n\nIf you choose the 'system' value as 'ProxyMode', the systems's proxy is used and all other fields are ignored.\n\nIf you choose the 'auto_detect' value as 'ProxyMode', all other fields are ignored.\n\nIf you choose the 'fixed_server' value as 'ProxyMode', the 'ProxyServer' and 'ProxyBypassList' fields are used.\n\nIf you choose the 'pac_script' value as 'ProxyMode', the 'ProxyPacUrl' and 'ProxyBypassList' fields are used.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#proxysettings"],"options":null},{"id":"com.apple.managedclient.preferences_proxysettings_proxybypasslist","displayName":"Proxy Bypass List","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_proxysettings_proxymode","displayName":"Proxy Mode","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_proxysettings_proxymode_0","displayName":"direct","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_proxysettings_proxymode_1","displayName":"auto_detect","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_proxysettings_proxymode_2","displayName":"pac_script","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_proxysettings_proxymode_3","displayName":"fixed_servers","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_proxysettings_proxymode_4","displayName":"system","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_proxysettings_proxypacurl","displayName":"Proxy PAC URL","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_proxysettings_proxyserver","displayName":"Proxy Server","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_qrcodegeneratorenabled","displayName":"Enable QR Code Generator","description":"This policy enables the QR Code generator feature in Microsoft Edge.\n\nIf you enable this policy or don't configure it, the QR Code Generator feature is enabled.\n\nIf you disable this policy, the QR Code Generator feature is disabled.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#qrcodegeneratorenabled"],"options":[{"id":"com.apple.managedclient.preferences_qrcodegeneratorenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_qrcodegeneratorenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_quicallowed","displayName":"Allow QUIC protocol","description":"Allows use of the QUIC protocol in Microsoft Edge.\n\nIf you enable this policy or don't configure it, the QUIC protocol is allowed.\n\nIf you disable this policy, the QUIC protocol is blocked.\n\nQUIC is a transport layer network protocol that can improve performance of web applications that currently use TCP.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#quicallowed"],"options":[{"id":"com.apple.managedclient.preferences_quicallowed_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_quicallowed_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_quicksearchshowminimenu","displayName":"Enables Microsoft Edge mini menu (Deprecated)","description":"Enables Microsoft Edge mini menu on websites and PDFs. The mini menu is triggered on text selection and has basic actions like copy and smart actions like definitions.\n\nIf you enable or don't config this policy, selecting text on websites and PDFs will show the Microsoft Edge mini menu.\n\nIf you disable this policy, the Microsoft Edge mini menu will not be shown when text on websites and PDFs is selected.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#quicksearchshowminimenu"],"options":[{"id":"com.apple.managedclient.preferences_quicksearchshowminimenu_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_quicksearchshowminimenu_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_quickviewofficefilesenabled","displayName":"Manage QuickView Office files capability in Microsoft Edge","description":"Allows you to set whether users can view publicly accessible Office files on the web that aren't on OneDrive or SharePoint. (For example: Word documents, PowerPoint presentations, and Excel spreadsheets)\n\nIf you enable or don't configure this policy, these files can be viewed in Microsoft Edge using Office Viewer instead of downloading the files.\n\nIf you disable this policy, these files will be downloaded to be viewed.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#quickviewofficefilesenabled"],"options":[{"id":"com.apple.managedclient.preferences_quickviewofficefilesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_quickviewofficefilesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_randomizescanstarttime","displayName":"Randomize scheduled scan start time","description":"Randomize the start time of a daily and weekly scheduled scan to any interval from 0 to 23 hours.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_readaloudenabled","displayName":"Enable Read Aloud feature in Microsoft Edge","description":"Enables the Read Aloud feature within Microsoft Edge.\nUsing this feature, users can listen to the content on the web page. This enables users to multi-task or improve their reading comprehension by hearing content at their own pace.\n\nIf you enable this policy or don't configure it, the Read Aloud option shows up in the address bar, right click context menu, more menu, on the PDF toolbar, and within Immersive Reader.\nIf you disable this policy, users can't access the Read Aloud feature from the address bar, right click context menu, more menu, on the PDF toolbar, and within Immersive Reader.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#readaloudenabled"],"options":[{"id":"com.apple.managedclient.preferences_readaloudenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_readaloudenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_registeredprotocolhandlers","displayName":"Registered Protocol Handlers","description":"Register a list of protocol handlers. Set the protocol property to the scheme (like 'mailto') and the url property to the URL pattern of the application that handles the scheme. The pattern can include a '%s', which will be replaced by the handled URL.\n\nYou can recommend a specific value for this policy, but you can't require that your users use it.\n\nThe protocol handlers registered by policy are merged with any handlers registered by the user, and both are available for use. The user can override the protocol handlers installed by policy by installing a new default handler, but they can't remove a protocol handler registered by policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#registeredprotocolhandlers"],"options":null},{"id":"com.apple.managedclient.preferences_registeredprotocolhandlers_item_default","displayName":"Default","description":"A boolean flag indicating if the protocol handler should be set as the default.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_registeredprotocolhandlers_item_default_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_registeredprotocolhandlers_item_default_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_registeredprotocolhandlers_item_protocol","displayName":"Protocol","description":"The protocol for the protocol handler.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_registeredprotocolhandlers_item_url","displayName":"URL","description":"The URL of the protocol handler.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_relatedmatchescloudserviceenabled","displayName":"Configure Related Matches in Find on Page (Deprecated)","description":"Specifies how the user receives related matches in Find on Page, which provides spellcheck, synonyms, and Q&A results in Microsoft Edge.\n\nIf you enable or don't configure this policy, users can receive related matches in Find on Page on all sites. The results are processed in a cloud service.\n\nIf you disable this policy, users can receive related matches in Find on Page on limited sites. The results are processed on the user's device.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#relatedmatchescloudserviceenabled"],"options":[{"id":"com.apple.managedclient.preferences_relatedmatchescloudserviceenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_relatedmatchescloudserviceenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_relatedwebsitesetsenabled","displayName":"Enable Related Website Sets (deprecated)","description":"This policy lets you control the enablement of the Related Website Sets feature. Related Website Sets (RWS) is a way for an organisation to declare relationships among sites, so that Microsoft Edge allows limited third-party cookie access for specific purposes across those sites.\n\nIf this policy set to True or unset, the Related Website Sets feature is enabled.\n\nIf this policy is set to False, the Related Website Sets feature is disabled.\n\nThis policy is deprecated as of Microsoft Edge version 144 with the deprecation of Related Website Sets.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#relatedwebsitesetsenabled"],"options":[{"id":"com.apple.managedclient.preferences_relatedwebsitesetsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_relatedwebsitesetsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_relaunchnotification","displayName":"Notify a user that a browser restart is recommended or required for pending updates","description":"Notify users that they need to restart Microsoft Edge to apply a pending update.\n\nIf you don't configure this policy, Microsoft Edge adds a recycle icon at the far right of the top menu bar to prompt users to restart the browser to apply the update.\n\nIf you enable this policy and set it to 'Recommended' (1), a recurring warning prompts users that a restart is recommended. Users can dismiss this warning and defer the restart.\n\nIf you set the policy to 'Required' (2), a recurring warning prompts users that the browser will be restarted automatically as soon as a notification period passes. The default period is seven days. You can configure this period with the \"RelaunchNotificationPeriod\" policy.\n\nThe user's session is restored when the browser restarts.\n\n* Recommended (1) = Show a recurring prompt to the user indicating that a restart is recommended\n\n* Required (2) = Show a recurring prompt to the user indicating that a restart is required","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#relaunchnotification"],"options":[{"id":"com.apple.managedclient.preferences_relaunchnotification_0","displayName":"Recommended - Show a recurring prompt to the user indicating that a restart is recommended","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_relaunchnotification_1","displayName":"Required - Show a recurring prompt to the user indicating that a restart is required","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_relaunchnotificationperiod","displayName":"Set the time period for update notifications","description":"Allows you to set the time period, in milliseconds, over which users are notified that Microsoft Edge must be relaunched or that a Microsoft Edge OS device must be restarted to apply a pending update.\n\nOver this time period, the user will be repeatedly informed of the need for an update. For Microsoft Edge OS devices, a restart notification appears in the system tray according to the RelaunchHeadsUpPeriod policy. For Microsoft Edge browsers, the app menu changes to indicate that a relaunch is needed once one third of the notification period passes. This notification changes color once two thirds of the notification period passes, and again once the full notification period has passed. The additional notifications enabled by the \"RelaunchNotification\" policy follow this same schedule.\n\nIf not set, the default period of 604800000 milliseconds (one week) is used.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#relaunchnotificationperiod"],"options":null},{"id":"com.apple.managedclient.preferences_remotedebuggingallowed","displayName":"Allow remote debugging","description":"Controls whether users may use remote debugging.\n\nIf you enable or don't configure this policy, users may use remote debugging by specifying --remote-debug-port and --remote-debugging-pipe command line switches.\n\nIf you disable this policy, users are not allowed to use remote debugging.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#remotedebuggingallowed"],"options":[{"id":"com.apple.managedclient.preferences_remotedebuggingallowed_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_remotedebuggingallowed_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_resolvenavigationerrorsusewebservice","displayName":"Enable resolution of navigation errors using a web service","description":"Allow Microsoft Edge to issue a dataless connection to a web service to probe networks for connectivity in cases like hotel and airport Wi-Fi.\n\nIf you enable this policy, a web service is used for network connectivity tests.\n\nIf you disable this policy, Microsoft Edge uses native APIs to try to resolve network connectivity and navigation issues.\n\n**Note**: Except on Windows 8 and later versions of Windows, Microsoft Edge *always* uses native APIs to resolve connectivity issues.\n\nIf you don't configure this policy, Microsoft Edge respects the user preference that's set under Services at edge://settings/privacy.\nSpecifically, there's a **Use a web service to help resolve navigation errors** toggle, which the user can switch on or off. Be aware that if you have enabled this policy (ResolveNavigationErrorsUseWebService), the **Use a web service to help resolve navigation errors** setting is turned on, but the user can't change the setting by using the toggle. If you have disabled this policy, the **Use a web service to help resolve navigation errors** setting is turned off, and the user can't change the setting by using the toggle.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#resolvenavigationerrorsusewebservice"],"options":[{"id":"com.apple.managedclient.preferences_resolvenavigationerrorsusewebservice_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_resolvenavigationerrorsusewebservice_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_restoreonstartup","displayName":"Action to take on startup","description":"Specify how Microsoft Edge behaves when it starts.\n\nIf you want a new tab to always open on startup, choose 'Open new tab' (5).\n\nIf you want to reopen URLs that were open the last time Microsoft Edge closed, choose 'Restore the last session' (1). The browsing session will be restored as it was. Note that this option disables some settings that rely on sessions or that perform actions on exit (such as Clear browsing data on exit or session-only cookies).\n\nIf you want to open a specific set of URLs, choose 'Open a list of URLs' (4).\n\nDisabling this setting is equivalent to leaving it not configured. Users will be able to change it in Microsoft Edge.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances enrolled for device management.\n\n* 5 = Open a new tab\n\n* 1 = Restore the last session\n\n* 4 = Open a list of URLs","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#restoreonstartup"],"options":[{"id":"com.apple.managedclient.preferences_restoreonstartup_0","displayName":"Restore the last session","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_restoreonstartup_1","displayName":"Open a list of URLs","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_restoreonstartup_2","displayName":"Open a new tab","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_restoreonstartup_3","displayName":"Open a list of URLs and restore the last session","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_restoreonstartupurls","displayName":"Sites to open when the browser starts","description":"Specify a list of websites to open automatically when the browser starts. If you don't configure this policy, no site is opened on startup.\n\nThis policy only works if you also set the \"RestoreOnStartup\" policy to 'Open a list of URLs' (4).\n\nThis policy is only available on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances that are enrolled for device management.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#restoreonstartupurls"],"options":null},{"id":"com.apple.managedclient.preferences_restoreonstartupuserurlsenabled","displayName":"Allow users to add and remove their own sites during startup when the RestoreOnStartupURLs policy is configured","description":"This policy only works if you set the \"RestoreOnStartup\" policy to 'Open a list of URLs' (4) and the \"RestoreOnStartupURLs\" policy as mandatory.\nIf you enable this policy, users are allowed to add and remove their own URLs to open when starting Edge while maintaining the admin specified mandatory list of sites specified by setting \"RestoreOnStartup\" policy to open a list of URLS and providing the list of sites in the \"RestoreOnStartupURLs\" policy.\n\nIf you disable or don't configure this policy, there is no change to how the \"RestoreOnStartup\" and \"RestoreOnStartupURLs\" policies work.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#restoreonstartupuserurlsenabled"],"options":[{"id":"com.apple.managedclient.preferences_restoreonstartupuserurlsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_restoreonstartupuserurlsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_restorepdfview","displayName":"Restore PDF view","description":"Enables PDF View Recovery in Microsoft Edge.\n\nIf you enable or don't configure this policy Microsoft Edge will recover the last state of PDF view and land users to the section where they ended reading in the last session.\n\nIf you disable this policy Microsoft Edge will recover the last state of PDF view and land users at the start of the PDF file.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#restorepdfview"],"options":[{"id":"com.apple.managedclient.preferences_restorepdfview_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_restorepdfview_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_restrictsignintopattern","displayName":"Restrict which accounts can be used as Microsoft Edge primary accounts","description":"Determines which accounts can be set as browser primary accounts in Microsoft Edge (the account that is chosen during the Sync opt-in flow).\n\nIf a user tries to set a browser primary account with a username that doesn't match this pattern, they are blocked and see an appropriate error message.\n\nIf you don't configure this policy or leave it blank, users can set any account as a browser primary account in Microsoft Edge.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#restrictsignintopattern"],"options":null},{"id":"com.apple.managedclient.preferences_runallflashinallowmode","displayName":"Extend Adobe Flash content setting to all content","description":"If you enable this policy, all Adobe Flash content embedded in websites that are set to allow Adobe Flash in the content settings -- either by the user or by enterprise policy -- will run. This includes content from other origins and/or small content.\n\nTo control which websites are allowed to run Adobe Flash, see the specifications in the \"DefaultPluginsSetting\", \"PluginsAllowedForUrls\", and \"PluginsBlockedForUrls\" policies.\n\nIf you disable this policy or don't configure it, Adobe Flash content from other origins (from sites that aren't specified in the three policies mentioned immediately above) or small content might be blocked.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#runallflashinallowmode"],"options":[{"id":"com.apple.managedclient.preferences_runallflashinallowmode_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_runallflashinallowmode_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_runscanwhenidle","displayName":"Run scheduled scan when idle","description":"Run scheduled scan when the device is idle. Only applicable for weekly full scans.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_runscanwhenidle_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_runscanwhenidle_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_sameorigintabcaptureallowedbyorigins","displayName":"Allow Same Origin Tab capture by these origins","description":"Setting the policy lets you set a list of URL patterns that can capture tabs with their same Origin.\n\nLeaving the policy unset means that sites will not be considered for an override at this scope of capture.\n\nIf a site matches a URL pattern in this policy, the following policies will not be considered: \"TabCaptureAllowedByOrigins\", \"WindowCaptureAllowedByOrigins\", \"ScreenCaptureAllowedByOrigins\", \"ScreenCaptureAllowed\".\n\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. This policy only matches based on origin, so any path in the URL pattern is ignored.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#sameorigintabcaptureallowedbyorigins"],"options":null},{"id":"com.apple.managedclient.preferences_sandboxexternalprotocolblocked","displayName":"Allow Microsoft Edge to block navigations to external protocols in a sandboxed iframe","description":"Microsoft Edge will block navigations to external protocols inside a\nsandboxed iframe.\n\nIf you enable or don't configure this policy, Microsoft Edge will block those navigations.\n\nIf you disable this policy, Microsoft Edge will not block those navigations.\n\nThis can be used by administrators who need more time to update their internal website affected by this new restriction. This Enterprise policy is temporary; it's intended to be removed after Microsoft Edge version 117.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#sandboxexternalprotocolblocked"],"options":[{"id":"com.apple.managedclient.preferences_sandboxexternalprotocolblocked_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_sandboxexternalprotocolblocked_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_savecookiesonexit","displayName":"Save cookies when Microsoft Edge closes","description":"When this policy is enabled, the specified set of cookies is exempt from deletion when the browser closes. This policy is only effective when:\n- The 'Cookies and other site data' toggle is configured in Settings/Privacy and services/Clear browsing data on close or\n- The policy \"ClearBrowsingDataOnExit\" is enabled or\n- The policy \"DefaultCookiesSetting\" is set to 'Keep cookies for the duration of the session'.\n\nYou can define a list of sites, based on URL patterns, that will have their cookies preserved across sessions.\n\nNote: Users can still edit the cookie site list to add or remove URLs. However, they can't remove URLs that have been added by an Admin.\n\nIf you enable this policy, the list of cookies won't be cleared when the browser closes.\n\nIf you disable or don't configure this policy, the user's personal configuration is used.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#savecookiesonexit"],"options":null},{"id":"com.apple.managedclient.preferences_savingbrowserhistorydisabled","displayName":"Disable saving browser history","description":"Disables saving browser history and prevents users from changing this setting.\n\nIf you enable this policy, browsing history isn't saved. This also disables tab syncing.\n\nIf you disable this policy or don't configure it, browsing history is saved.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#savingbrowserhistorydisabled"],"options":[{"id":"com.apple.managedclient.preferences_savingbrowserhistorydisabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_savingbrowserhistorydisabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_scanafterdefinitionupdate","displayName":"Run a scan after definitions are updated","description":"Specifies whether to start a process scan after new security intelligence updates are downloaded on the device. Enabling this setting will trigger an antivirus scan on the running processes of the device.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-preferences?view=o365-worldwide#run-a-scan-after-definitions-are-updated"],"options":[{"id":"com.apple.managedclient.preferences_scanafterdefinitionupdate_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_scanafterdefinitionupdate_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_scanarchives","displayName":"Scanning inside archive files","description":"If true, Defender will unpack archives and scan files inside them. Otherwise archive content will be skipped, that will improve scanning performance.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-preferences?view=o365-worldwide#scan-archives-on-demand-antivirus-scans-only"],"options":[{"id":"com.apple.managedclient.preferences_scanarchives_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_scanarchives_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_scanhistorymaximumitems","displayName":"Scan history size","description":"Specify the maximum number of entries to keep in the scan history. Entries include all on-demand scans performed in the past and all antivirus detections.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#maximum-number-of-items-in-the-antivirus-scan-history"],"options":null},{"id":"com.apple.managedclient.preferences_scanresultsretentiondays","displayName":"Scan results retention","description":"Specify the number of days that results are retained in the scan history on the device. Old scan results are removed from the history. Old quarantined files that are also removed from the disk.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#antivirus-scan-history-retention-in-days"],"options":null},{"id":"com.apple.managedclient.preferences_scheduledscan","displayName":"Scheduled Scan","description":"Schedule scans with Microsoft Defender for Endpoint.","helpText":null,"infoUrls":["https://learn.microsoft.com/en-us/defender-endpoint/mac-schedule-scan"],"options":[{"id":"com.apple.managedclient.preferences_scheduledscan_0","displayName":"enabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_scheduledscan_1","displayName":"disabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_screencaptureallowed","displayName":"Allow or deny screen capture","description":"If you enable this policy, or don't configure this policy, a web page can use screen-share APIs (for example, getDisplayMedia() or the Desktop Capture extension API) for a screen capture.\nIf you disable this policy, calls to screen-share APIs will fail. For example, if you're using a web-based online meeting, video or screen sharing will not work.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#screencaptureallowed"],"options":[{"id":"com.apple.managedclient.preferences_screencaptureallowed_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_screencaptureallowed_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_screencaptureallowedbyorigins","displayName":"Allow Desktop, Window, and Tab capture by these origins","description":"Setting the policy lets you set a list of URL patterns that can use Desktop, Window, and Tab Capture.\n\nLeaving the policy unset means that sites will not be considered for an override at this scope of Capture.\n\nThis policy is not considered if a site matches a URL pattern in any of the following policies: \"WindowCaptureAllowedByOrigins\", \"TabCaptureAllowedByOrigins\", \"SameOriginTabCaptureAllowedByOrigins\".\n\nIf a site matches a URL pattern in this policy, the \"ScreenCaptureAllowed\" will not be considered.\n\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. This policy only matches based on origin, so any path in the URL pattern is ignored.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#screencaptureallowedbyorigins"],"options":null},{"id":"com.apple.managedclient.preferences_screencapturewithoutgestureallowedfororigins","displayName":"Allow screen capture without prior user gesture","description":"For security reasons, the\ngetDisplayMedia() web API requires\na prior user gesture (\"transient activation\") to be called or the API will\nfail.\n\nWhen this policy is configured, admins can specify origins on which this API\ncan be called without prior user gesture.\n\nFor detailed information on valid url patterns, see\nhttps://go.microsoft.com/fwlink/?linkid=2095322. Note: * is not an accepted\nvalue for this policy.\n\nIf this policy is not configured, all origins require a prior user gesture to\ncall this API.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#screencapturewithoutgestureallowedfororigins"],"options":null},{"id":"com.apple.managedclient.preferences_scrolltotextfragmentenabled","displayName":"Enable scrolling to text specified in URL fragments","description":"This feature lets hyperlink and address bar URL navigations target specific text on a web page, which will be scrolled to after the web page finishes loading.\n​\nIf you enable or don't configure this policy, web page scrolling to specific text fragments via a URL will be enabled.​\n\nIf you disable this policy, web page scrolling to specific text fragments via a URL will be disabled.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#scrolltotextfragmentenabled"],"options":[{"id":"com.apple.managedclient.preferences_scrolltotextfragmentenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_scrolltotextfragmentenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_searchfiltersenabled","displayName":"Search Filters Enabled","description":"Lets you filter your autosuggestions by selecting a filter from the search filters ribbon. For example, if you select the \"Favorites\" filter, only favorites suggestions will be shown.\n\nIf you enable or don't configure this policy, the autosuggestion dropdown defaults to displaying the ribbon of available filters.\n\nIf you disable this policy, the autosuggestion dropdown won't display the ribbon of available filters.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#searchfiltersenabled"],"options":[{"id":"com.apple.managedclient.preferences_searchfiltersenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_searchfiltersenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_searchforimageenabled","displayName":"Search for image enabled","description":"This policy lets you configure the Image Search feature in the right-click context menu.\n\nIf you enable or don't configure this policy, then the \"Search the web for image\" option will be visible in the context menu.\n\nIf you disable this policy, then the \"Search the web for image\" will not be visible in the context menu.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#searchforimageenabled"],"options":[{"id":"com.apple.managedclient.preferences_searchforimageenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_searchforimageenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_searchinsidebarenabled","displayName":"Search in Sidebar enabled","description":"Search in Sidebar allows users to open search result in sidebar (including sidebar search for Progressive Web Apps).\n\nIf you configure this policy to 'EnableSearchInSidebar' or don't configure it, Search in sidebar will be enabled.\n\nIf you configure this policy to 'DisableSearchInSidebarForKidsMode', Search in sidebar will be disabled when in Kids mode. Some methods that would normally invoke sidebar search will invoke a traditional search instead.\n\nIf you configure this policy to 'DisableSearchInSidebar', Search in sidebar will be disabled. Some methods that would normally invoke sidebar search will invoke a traditional search instead.\n\nPolicy options mapping:\n\n* EnableSearchInSidebar (0) = Enable search in sidebar\n\n* DisableSearchInSidebarForKidsMode (1) = Disable search in sidebar for Kids Mode\n\n* DisableSearchInSidebar (2) = Disable search in sidebar\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#searchinsidebarenabled"],"options":[{"id":"com.apple.managedclient.preferences_searchinsidebarenabled_0","displayName":"Enable search in sidebar","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_searchinsidebarenabled_1","displayName":"Disable search in sidebar for Kids Mode","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_searchinsidebarenabled_2","displayName":"Disable search in sidebar","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_searchsuggestenabled","displayName":"Enable search suggestions","description":"Enables web search suggestions in Microsoft Edge's Address Bar and Auto-Suggest List and prevents users from changing this policy.\n\nIf you enable this policy, web search suggestions are used.\n\nIf you disable this policy, web search suggestions are never used, however local history and local favorites suggestions still appear. If you disable this policy, neither the typed characters, nor the URLs visited will be included in telemetry to Microsoft.\n\nIf this policy is left not set, search suggestions are enabled but the user can change that.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#searchsuggestenabled"],"options":[{"id":"com.apple.managedclient.preferences_searchsuggestenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_searchsuggestenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_securitykeypermitattestation","displayName":"Websites or domains that don't need permission to use direct Security Key attestation","description":"Specifies websites and domains that don't need explicit user permission when attestation certificates from security keys are requested. Additionally, a signal is sent to the security key indicating that it can use individual attestation. Without this, users are prompted each time a site requests attestation of security keys.\n\nSites (like https://contoso.com/some/path) only match as U2F appIDs. Domains (like contoso.com) only match as webauthn RP IDs. To cover both U2F and webauthn APIs for a given site, you need to list both the appID URL and domain.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#securitykeypermitattestation"],"options":null},{"id":"com.apple.managedclient.preferences_sendsiteinfotoimproveservices","displayName":"Send site information to improve Microsoft services","description":"This policy enables sending info about websites visited in Microsoft Edge to Microsoft to improve services like search.\n\nEnable this policy to send info about websites visited in Microsoft Edge to Microsoft. Disable this policy to not send info about websites visited in Microsoft Edge to Microsoft. In both cases, users can't change or override the setting.\n\nOn Windows 10, Beta and Stable if this policy is not configured, Microsoft Edge will default to the Windows diagnostic data setting. If this policy is enabled Microsoft Edge will only send info about websites visited in Microsoft Edge if the Windows Diagnostic data setting is set to Full. If this policy is disabled Microsoft Edge will not send info about websites visited. Learn more about Windows Diagnostic data settings: https://go.microsoft.com/fwlink/?linkid=2099569\n\nOn Windows 10, Canary and Dev channels, this policy controls sending info about websites visited. If this policy is not configured, Microsoft Edge will default to the user’s preference.\n\nOn Windows 7, 8, and Mac this policy controls sending info about websites visited. If this policy is not configured, Microsoft Edge will default to the user’s preference.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#sendsiteinfotoimproveservices"],"options":[{"id":"com.apple.managedclient.preferences_sendsiteinfotoimproveservices_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_sendsiteinfotoimproveservices_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_sensorsallowedforurls","displayName":"Allow access to sensors on specific sites","description":"Define a list of sites, based on URL patterns, that can access and use sensors such as motion and light sensors.\n\nIf you don't configure this policy, the global default value from the \"DefaultSensorsSetting\" policy (if set) or the user's personal configuration is used for all sites.\n\nFor URL patterns that don't match this policy, the following order of precedence is used: The \"SensorsBlockedForUrls\" policy (if there is a match), the \"DefaultSensorsSetting\" policy (if set), or the user's personal settings.\n\nThe URL patterns defined in this policy can't conflict with those configured in the \"SensorsBlockedForUrls\" policy. You can't allow and block a URL.\n\nFor detailed information about valid URL patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#sensorsallowedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_sensorsblockedforurls","displayName":"Block access to sensors on specific sites","description":"Define a list of sites, based on URL patterns, that can't access sensors such as motion and light sensors.\n\nIf you don't configure this policy, the global default value from the \"DefaultSensorsSetting\" policy (if set) or the user's personal configuration is used for all sites.\n\nFor URL patterns that don't match this policy, the following order of precedence is used: The \"SensorsAllowedForUrls\" policy (if there is a match), the \"DefaultSensorsSetting\" policy (if set), or the user's personal settings.\n\nThe URL patterns defined in this policy can't conflict with those configured in the \"SensorsAllowedForUrls\" policy. You can't allow and block a URL.\n\nFor detailed information about valid URL patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#sensorsblockedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_serialallowallportsforurls","displayName":"Automatically grant sites permission to connect all serial ports","description":"Setting the policy allows you to list sites which are automatically granted permission to access all available serial ports.\n\nThe URLs must be valid, or the policy is ignored. Only the origin (scheme, host, and port) of the URL is considered.\n\nThis policy overrides \"DefaultSerialGuardSetting\", \"SerialAskForUrls\", \"SerialBlockedForUrls\" and the user's preferences.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#serialallowallportsforurls"],"options":null},{"id":"com.apple.managedclient.preferences_serialaskforurls","displayName":"Allow the Serial API on specific sites","description":"Specifies URL patterns for sites that are allowed to request access to a serial port.\n\nIf not configured, Microsoft Edge uses the value from the DefaultSerialGuardSetting policy (if set), or the user's settings.\n\nFor unmatched sites, the following order applies:\n\n1. \"SerialBlockedForUrls\" (if matched).\n\n2. DefaultSerialGuardSetting (if set).\n\n3. User's settings.\n\nIf URL patterns in this policy conflict with those in \"SerialBlockedForUrls\", they will be ignored.\n\nFor detailed information about valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#serialaskforurls"],"options":null},{"id":"com.apple.managedclient.preferences_serialblockedforurls","displayName":"Block the Serial API on specific sites","description":"Specifies URL patterns for sites that aren't allowed to request access to a serial port.\n\nIf not configured, Microsoft Edge uses the value from the DefaultSerialGuardSetting policy (if set), or the user's settings.\n\nFor unmatched sites, the following order applies:\n\n1. SerialAskForUrls (if matched).\n\n2. DefaultSerialGuardSetting (if set).\n\n3. User's settings.\n\nURL patterns in this policy must not conflict with those in SerialAskForUrls. This policy takes precedence.\n\nFor detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#serialblockedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_sharedarraybufferunrestrictedaccessallowed","displayName":"Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context","description":"Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context. A SharedArrayBuffer is a binary data buffer that can be used to create views on shared memory. SharedArrayBuffers have a memory access vulnerability in several popular CPUs.\n\nIf you enable this policy, sites are allowed to use SharedArrayBuffers with no restrictions.\n\nIf you disable or don't configure this policy, sites are allowed to use SharedArrayBuffers only when cross-origin isolated.\n\nMicrosoft Edge will require cross-origin isolation when using SharedArrayBuffers from Microsoft Edge 91 onward for Web Compatibility reasons.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#sharedarraybufferunrestrictedaccessallowed"],"options":[{"id":"com.apple.managedclient.preferences_sharedarraybufferunrestrictedaccessallowed_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_sharedarraybufferunrestrictedaccessallowed_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_sharedlinksenabled","displayName":"Show links shared from Microsoft 365 apps in History","description":"Allows Microsoft Edge to display links recently shared by or shared with the user from Microsoft 365 apps in History.\n\nIf you enable or don't configure this policy, Microsoft Edge displays links recently shared by or shared with the user from Microsoft 365 apps in History.\n\nIf you disable this policy, Microsoft Edge does not display links recently shared by or shared with the user from Microsoft 365 apps in History. The control in Microsoft Edge settings is disabled and set to off.\n\nThis policy only applies for Microsoft Edge local user profiles and profiles signed in using Azure Active Directory.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#sharedlinksenabled"],"options":[{"id":"com.apple.managedclient.preferences_sharedlinksenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_sharedlinksenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_sharepointonpremfrontdoorurl","displayName":"SharePoint Server Front Door URL","description":"Specifies the SharePoint Server 2019 on-premises URL that the OneDrive sync app should try to authenticate and sync against.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#sharepointonpremfrontdoorurl"],"options":null},{"id":"com.apple.managedclient.preferences_sharepointonpremprioritizationpolicy","displayName":"SharePoint Prioritization","description":"For hybrid scenarios where the email is the same for both SharePoint Server on-premises and SharePoint Online, determines whether or not the client should set up sync for SharePoint Server or SharePoint Online first during the first-run scenario.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#sharepointonpremprioritizationpolicy"],"options":[{"id":"com.apple.managedclient.preferences_sharepointonpremprioritizationpolicy_0","displayName":"Prioritize SharePoint Online","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_sharepointonpremprioritizationpolicy_1","displayName":"Prioritize SharePoint Server","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_sharepointonpremtenantname","displayName":"SharePoint Server Tenant Name","description":"Specifies the name of the folder created for syncing the SharePoint Server 2019 files specified in the Front Door URL.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#sharepointonpremtenantname"],"options":null},{"id":"com.apple.managedclient.preferences_showacrobatsubscriptionbutton","displayName":"Shows button on native PDF viewer in Microsoft Edge that allows users to sign up for Adobe Acrobat subscription","description":"This policy lets the native PDF viewer in Microsoft Edge show a button that lets a user looking for advanced digital document features to discover and subscribe to premium offerings. This is done via the Acrobat extension.\n\nIf you enable or don't configure this policy, the button will show up on the native PDF viewer in Microsoft Edge. A user will be able to buy Adobe subscription to access their premium offerings.\n\nIf you disable this policy, the button won't be visible on the native PDF viewer in Microsoft Edge. A user won't be able to discover Adobe's advanced PDF tools or buy their subscriptions.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#showacrobatsubscriptionbutton"],"options":[{"id":"com.apple.managedclient.preferences_showacrobatsubscriptionbutton_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_showacrobatsubscriptionbutton_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_showcasticonintoolbar","displayName":"Show the cast icon in the toolbar","description":"Set this policy to true to show the Cast toolbar icon on the toolbar or the overflow menu. Users won't be able to remove it.\n\nIf you don't configure this policy or if you disable it, users can pin or remove the icon by using its contextual menu.\n\nIf you've also set the \"EnableMediaRouter\" policy to false, then this policy is ignored, and the toolbar icon isn't shown.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#showcasticonintoolbar"],"options":[{"id":"com.apple.managedclient.preferences_showcasticonintoolbar_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_showcasticonintoolbar_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_showdocstageonlaunch","displayName":"Show Template Gallery on app launch","description":"Show the template picker when launching Word, Excel, and PowerPoint.","helpText":null,"infoUrls":["https://learn.microsoft.com/deployoffice/mac/preferences-office"],"options":[{"id":"com.apple.managedclient.preferences_showdocstageonlaunch_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_showdocstageonlaunch_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_showdownloadsinsecurewarningsenabled","displayName":"Enable insecure download warnings","description":"Enables warnings when potentially dangerous content is downloaded over HTTP.\n\nIf you enable or don't configure this policy, when a user tries to download potentially dangerous content from an HTTP site, the user will receive a UI warning, such as \"Insecure download blocked.\" The user will still have an option to proceed and download the item.\n\nIf you disable this policy, the warnings for insecure downloads will be suppressed.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#showdownloadsinsecurewarningsenabled"],"options":[{"id":"com.apple.managedclient.preferences_showdownloadsinsecurewarningsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_showdownloadsinsecurewarningsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_showdownloadstoolbarbutton","displayName":"Show Downloads button on the toolbar","description":"Set this policy to always show the Downloads button on the toolbar.\n\nIf you enable this policy, the Downloads button is pinned to the toolbar.\n\nIf you disable or don't configure the policy, the Downloads button isn't shown on the toolbar by default. Users can toggle the Downloads button in edge://settings/appearance.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#showdownloadstoolbarbutton"],"options":[{"id":"com.apple.managedclient.preferences_showdownloadstoolbarbutton_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_showdownloadstoolbarbutton_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_showhistorythumbnails","displayName":"Show thumbnail images for browsing history","description":"This policy lets you configure whether the history thumbnail feature collects and saves images for the sites you visit. When enabled, this feature makes it easier to identify sites when you hover over your history results.\nIf you don't configure this policy, the thumbnail feature is turned on after a user visits the history hub twice in the past 7 days.\nIf you enable this policy, the history thumbnail collects and saves images for visited sites.\nIf you disable this policy, the history thumbnail doesn't collect and save images for visited sites.\nWhen the feature is disabled, existing images are deleted on a per user basis, and the feature no longer collects or saves images when a site is visited.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#showhistorythumbnails"],"options":[{"id":"com.apple.managedclient.preferences_showhistorythumbnails_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_showhistorythumbnails_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_showhomebutton","displayName":"Show Home button on toolbar","description":"Shows the Home button on Microsoft Edge's toolbar.\n\nEnable this policy to always show the Home button. Disable it to never show the button.\n\nIf you don't configure the policy, users can choose whether to show the home button.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#showhomebutton"],"options":[{"id":"com.apple.managedclient.preferences_showhomebutton_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_showhomebutton_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_showmicrosoftrewards","displayName":"Show Microsoft Rewards experiences","description":"Show Microsoft Rewards experience and notifications.\nIf you enable this policy:\n - Microsoft account users (excludes Azure AD accounts) in search and earn markets will see the Microsoft Rewards experience in their Microsoft Edge user profile.\n - The setting to enable Microsoft Rewards in Microsoft Edge settings will be enabled and toggled on.\n - The setting to enable Give mode will be enabled and respect the user's setting.\n\nIf you disable this policy:\n - Microsoft account users (excludes Azure AD accounts) in search and earn markets will not see the Microsoft Rewards experience in their Microsoft Edge user profile.\n - The setting to enable Microsoft Rewards in Microsoft Edge settings will be disabled and toggled off.\n\nIf you don't configure this policy:\n - Microsoft account users (excludes Azure AD accounts) in search and earn markets will see the Microsoft Rewards experience in their Microsoft Edge user profile.\n - The setting to enable Microsoft Rewards in Microsoft Edge settings will be enabled and toggled on.\n - The setting to enable Give mode will be enabled and respect the user's setting.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#showmicrosoftrewards"],"options":[{"id":"com.apple.managedclient.preferences_showmicrosoftrewards_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_showmicrosoftrewards_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_showofficeshortcutinfavoritesbar","displayName":"Show Microsoft Office shortcut in favorites bar","description":"Specifies whether to include a shortcut to Office.com in the favorites bar. For users signed into Microsoft Edge the shortcut takes users to their Microsoft Office apps and docs.\n\nIf this policy is enabled or not configure, users can choose whether to see the shortcut by changing the toggle in the favorites bar context menu.\n\nIf the policy is disabled, the shortcut won't be shown.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#showofficeshortcutinfavoritesbar"],"options":[{"id":"com.apple.managedclient.preferences_showofficeshortcutinfavoritesbar_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_showofficeshortcutinfavoritesbar_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_showpdfdefaultrecommendationsenabled","displayName":"Allow notifications to set Microsoft Edge as default PDF reader","description":"This policy setting lets you decide whether employees should receive recommendations to set Microsoft Edge as PDF handler.\n\nIf you enable or don't configure this setting, employees receive recommendations from Microsoft Edge to set itself as the default PDF handler.\n\nIf you disable this setting, employees will not receive any notifications from Microsoft Edge to set itself as the default PDF handler.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#showpdfdefaultrecommendationsenabled"],"options":[{"id":"com.apple.managedclient.preferences_showpdfdefaultrecommendationsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_showpdfdefaultrecommendationsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_showrecommendationsenabled","displayName":"Allow feature recommendations and browser assistance notifications from Microsoft Edge","description":"This setting controls the in-browser assistance notifications which are intended to help users get the most out of Microsoft Edge. This is done by recommending features and by helping them use browser features. These notifications take the form of dialog boxes, flyouts, coach marks and banners in the browser. An example of an assistance notification would be when a user has many tabs opened in the browser. In this instance Microsoft Edge may prompt the user to try out the vertical tabs feature which is designed to give better browser tab management.\n\nDisabling this policy will stop this message from appearing again even if the user has too many tabs open.\n Any features that have been disabled by a management policy are not suggested to users.\nIf you enable or don't configure this setting, users will receive recommendations or notifications from Microsoft Edge.\n If you disable this setting, users will not receive any recommendations or notifications from Microsoft Edge","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#showrecommendationsenabled"],"options":[{"id":"com.apple.managedclient.preferences_showrecommendationsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_showrecommendationsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_showwhatsnewonlaunch","displayName":"Show Whats New dialog","description":"Show the monthly Whats New dialog to users.","helpText":null,"infoUrls":["https://learn.microsoft.com/deployoffice/mac/preferences-office"],"options":[{"id":"com.apple.managedclient.preferences_showwhatsnewonlaunch_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_showwhatsnewonlaunch_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_signedhttpexchangeenabled","displayName":"Enable Signed HTTP Exchange (SXG) support","description":"Enable support for Signed HTTP Exchange (SXG).\n\nIf this policy isn't set or enabled, Microsoft Edge will accept web contents served as Signed HTTP Exchanges.\n\nIf this policy is set to disabled, Signed HTTP Exchanges can't be loaded.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#signedhttpexchangeenabled"],"options":[{"id":"com.apple.managedclient.preferences_signedhttpexchangeenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_signedhttpexchangeenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_siteperprocess","displayName":"Enable site isolation for every site","description":"The 'SitePerProcess' policy can be used to prevent users from opting out of the default behavior of isolating all sites. Note that you can also use the \"IsolateOrigins\" policy to isolate additional, finer-grained origins.\nIf you enable this policy, users can't opt out of the default behavior where each site runs in its own process.\nIf you disable or don’t configure this policy, a user can opt out of site isolation. (For example, by using \"Disable site isolation\" entry in edge://flags.) Disabling the policy or not configuring the policy doesn't turn off Site Isolation.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#siteperprocess"],"options":[{"id":"com.apple.managedclient.preferences_siteperprocess_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_siteperprocess_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_sleepingtabsblockedforurls","displayName":"Block Sleeping Tabs on specific sites","description":"Define a list of sites, based on URL patterns, that are not allowed to be put to sleep by Sleeping Tabs.\n\nIf the policy \"SleepingTabsEnabled\" is disabled, this list is not used and no sites will be put to sleep automatically.\n\nIf you don't configure this policy, all sites will be eligible to be put to sleep unless the user's personal configuration blocks them.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#sleepingtabsblockedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_sleepingtabsenabled","displayName":"Configure Sleeping Tabs","description":"This policy setting lets you configure whether to turn on Sleeping Tabs. Sleeping Tabs reduces CPU, battery, and memory usage by putting idle background tabs to sleep. Microsoft Edge uses heuristics to avoid putting tabs to sleep that do useful work in the background, such as display notifications, play sound, and stream video. By default, Sleeping Tabs is turned on.\n\nIndividual sites may be blocked from being put to sleep by configuring the policy \"SleepingTabsBlockedForUrls\".\n\nIf you enable this setting, Sleeping Tabs is turned on.\n\nIf you disable this setting, Sleeping Tabs is turned off.\n\nIf you don't configure this setting, users can choose whether to use Sleeping Tabs.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#sleepingtabsenabled"],"options":[{"id":"com.apple.managedclient.preferences_sleepingtabsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_sleepingtabsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_sleepingtabstimeout","displayName":"Set the background tab inactivity timeout for Sleeping Tabs","description":"This policy setting lets you configure the timeout, in seconds, after which inactive background tabs will be automatically put to sleep if Sleeping Tabs is enabled. By default, this timeout is 7,200 seconds (2 hours).\n\nTabs are only put to sleep automatically when the policy \"SleepingTabsEnabled\" is enabled or is not configured and the user has enabled the Sleeping Tabs setting.\n\nIf you don't configure this policy, users can choose the timeout value.\n\nPolicy options mapping:\n\n* 5Minutes (300) = 5 minutes of inactivity\n\n* 15Minutes (900) = 15 minutes of inactivity\n\n* 30Minutes (1800) = 30 minutes of inactivity\n\n* 1Hour (3600) = 1 hour of inactivity\n\n* 2Hours (7200) = 2 hours of inactivity\n\n* 3Hours (10800) = 3 hours of inactivity\n\n* 6Hours (21600) = 6 hours of inactivity\n\n* 12Hours (43200) = 12 hours of inactivity\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#sleepingtabstimeout"],"options":[{"id":"com.apple.managedclient.preferences_sleepingtabstimeout_0","displayName":"5 minutes of inactivity","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_sleepingtabstimeout_1","displayName":"15 minutes of inactivity","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_sleepingtabstimeout_2","displayName":"30 minutes of inactivity","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_sleepingtabstimeout_3","displayName":"1 hour of inactivity","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_sleepingtabstimeout_4","displayName":"2 hours of inactivity","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_sleepingtabstimeout_5","displayName":"3 hours of inactivity","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_sleepingtabstimeout_6","displayName":"6 hours of inactivity","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_sleepingtabstimeout_7","displayName":"12 hours of inactivity","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_sleepingtabstimeout_8","displayName":"12 hours of inactivity","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_smartactionsblocklist","displayName":"Block smart actions for a list of services","description":"List specific services, such as PDFs, and websites that don't show smart actions. (Smart actions are actions like \"define\" which are available in full and mini context menus in Microsoft Edge.)\n\nIf you enable the policy:\n - The smart action in the mini and full context menu will be disabled for all profiles for services that match the given list.\n - Users will not see the smart action in the mini and full context menu on text selection for services that match the given list.\n - In Microsoft Edge settings, the smart action in the mini and full context menu will be disabled for services that match the given list.\n\nIf you disable or don't configure this policy:\n - The smart action in the mini and full context menu will be enabled for all profiles.\n - Users will see the smart action in the mini and full context menu on text selection.\n - In Microsoft Edge settings, the smart action in the mini and full context menu will be enabled.\n\nPolicy options mapping:\n\n* smart_actions (smart_actions) = Smart actions in pdfs and on websites\n\n* smart_actions_website (smart_actions_website) = Smart actions on websites\n\n* smart_actions_pdf (smart_actions_pdf) = Smart actions in PDF\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#smartactionsblocklist"],"options":null},{"id":"com.apple.managedclient.preferences_smartscreenallowlistdomains","displayName":"Configure the list of domains for which Microsoft Defender SmartScreen won't trigger warnings","description":"Configure the list of Microsoft Defender SmartScreen trusted domains. This means:\nMicrosoft Defender SmartScreen won't check for potentially malicious resources like phishing software and other malware if the source URLs match these domains.\nThe Microsoft Defender SmartScreen download protection service won't check downloads hosted on these domains.\n\nIf you enable this policy, Microsoft Defender SmartScreen trusts these domains.\nIf you disable or don't set this policy, default Microsoft Defender SmartScreen protection is applied to all resources.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.\nAlso note that this policy does not apply if your organization has enabled Microsoft Defender Advanced Threat Protection. You must configure your allow and block lists in Microsoft Defender Security Center instead.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#smartscreenallowlistdomains"],"options":null},{"id":"com.apple.managedclient.preferences_smartscreendnsrequestsenabled","displayName":"Enable Microsoft Defender SmartScreen DNS requests","description":"This policy lets you configure whether to enable DNS requests made by Microsoft Defender SmartScreen. Note: Disabling DNS requests will prevent Microsoft Defender SmartScreen from getting IP addresses, and potentially impact the IP-based protections provided.\n\nIf you enable or don't configure this setting, Microsoft Defender SmartScreen will make DNS requests.\n\nIf you disable this setting, Microsoft Defender SmartScreen will not make any DNS requests.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#smartscreendnsrequestsenabled"],"options":[{"id":"com.apple.managedclient.preferences_smartscreendnsrequestsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_smartscreendnsrequestsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_smartscreenenabled","displayName":"Configure Microsoft Defender SmartScreen","description":"This policy setting lets you configure whether to turn on Microsoft Defender SmartScreen. Microsoft Defender SmartScreen provides warning messages to help protect your users from potential phishing scams and malicious software. By default, Microsoft Defender SmartScreen is turned on.\n\nIf you enable this setting, Microsoft Defender SmartScreen is turned on.\n\nIf you disable this setting, Microsoft Defender SmartScreen is turned off.\n\nIf you don't configure this setting, users can choose whether to use Microsoft Defender SmartScreen.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#smartscreenenabled"],"options":[{"id":"com.apple.managedclient.preferences_smartscreenenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_smartscreenenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_smartscreenpuaenabled","displayName":"Configure Microsoft Defender SmartScreen to block potentially unwanted apps","description":"This policy setting lets you configure whether to turn on blocking for potentially unwanted apps in Microsoft Defender SmartScreen. Potentially unwanted app blocking in Microsoft Defender SmartScreen provides warning messages to help protect users from adware, coin miners, bundleware, and other low-reputation apps that are hosted by websites. Potentially unwanted app blocking in Microsoft Defender SmartScreen is turned off by default.\n\nIf you enable this setting, potentially unwanted app blocking in Microsoft Defender SmartScreen is turned on.\n\nIf you disable this setting, potentially unwanted app blocking in Microsoft Defender SmartScreen is turned off.\n\nIf you don't configure this setting, users can choose whether to use potentially unwanted app blocking in Microsoft Defender SmartScreen.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#smartscreenpuaenabled"],"options":[{"id":"com.apple.managedclient.preferences_smartscreenpuaenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_smartscreenpuaenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_smimecertificateslookuporder","displayName":"Set the order in which S/MIME certificates are considered","description":"Set the order in which certificates will be used to decrypt and encrypt S/MIME messages.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#set-the-order-in-which-smime-certificates-are-considered"],"options":[{"id":"com.apple.managedclient.preferences_smimecertificateslookuporder_0","displayName":"Contacts","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_smimecertificateslookuporder_1","displayName":"Global Address List","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_smimecertificateslookuporder_2","displayName":"Device","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_smimecertificateslookuporder_3","displayName":"LDAP","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_speechrecognitionenabled","displayName":"Configure Speech Recognition","description":"Set whether websites can use the W3C Web Speech API to recognize speech from the user. The Microsoft Edge implementation of the Web Speech API uses Azure Cognitive Services, so voice data will leave the machine.\n\nIf you enable or don't configure this policy, web-based applications that use the Web Speech API can use Speech Recognition.\n\nIf you disable this policy, Speech Recognition is not available through the Web Speech API.\n\nRead more about this feature here:\nSpeechRecognition API: https://go.microsoft.com/fwlink/?linkid=2143388\nCognitive Services: https://go.microsoft.com/fwlink/?linkid=2143680","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#speechrecognitionenabled"],"options":[{"id":"com.apple.managedclient.preferences_speechrecognitionenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_speechrecognitionenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_spellcheckenabled","displayName":"Enable spellcheck","description":"If you enable or don't configure this policy, the user can use spellcheck.\n\nIf you disable this policy, the user can't use spellcheck and the \"SpellcheckLanguage\" and \"SpellcheckLanguageBlocklist\" policies are also disabled.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#spellcheckenabled"],"options":[{"id":"com.apple.managedclient.preferences_spellcheckenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_spellcheckenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_splitscreenenabled","displayName":"Enable split screen feature in Microsoft Edge","description":"This policy lets you configure the split screen feature in Microsoft Edge. This feature lets a user open two web pages in one tab.\n\nIf you enable or don't configure this policy, users can use the split screen feature in Microsoft Edge.\n\nIf you disable this policy, users can't use the split screen feature in Microsoft Edge.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#splitscreenenabled"],"options":[{"id":"com.apple.managedclient.preferences_splitscreenenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_splitscreenenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_sslerroroverrideallowed","displayName":"Allow users to proceed from the HTTPS warning page","description":"Microsoft Edge shows a warning page when users visit sites that have SSL errors.\n\nIf you enable or don't configure (default) this policy, users can click through these warning pages.\n\nIf you disable this policy, users are blocked from clicking through any warning page.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#sslerroroverrideallowed"],"options":[{"id":"com.apple.managedclient.preferences_sslerroroverrideallowed_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_sslerroroverrideallowed_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_sslerroroverrideallowedfororigins","displayName":"Allow users to proceed from the HTTPS warning page for specific origins","description":"Microsoft Edge shows a warning page when users visit sites that have SSL errors.\n\nIf you enable or don't configure the \"SSLErrorOverrideAllowed\" policy, this policy does nothing.\n\nIf you disable the \"SSLErrorOverrideAllowed\" policy, configuring this policy lets you configure a list of origin patterns for sites where users can continue to click through SSL error pages. Users can't click through SSL error pages on origins that are not on this list.\n\nIf you don't configure this policy, the \"SSLErrorOverrideAllowed\" policy applies for all sites.\n\nFor detailed information about valid origin patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy. This policy only matches based on origin, so any path or query in the URL pattern is ignored.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#sslerroroverrideallowedfororigins"],"options":null},{"id":"com.apple.managedclient.preferences_sslversionmin","displayName":"Minimum TLS version enabled","description":"Sets the minimum supported version of SSL. If you don't configure this policy, Microsoft Edge uses a default minimum version, TLS 1.0.\n\nIf you enable this policy, you can set the minimum version to one of the following values: \"tls1\", \"tls1.1\" or \"tls1.2\". When set, Microsoft Edge won't use any version of SSL/TLS lower than the specified version. Any unrecognized value is ignored.\n\n* \"tls1\" = TLS 1.0\n\n* \"tls1.1\" = TLS 1.1\n\n* \"tls1.2\" = TLS 1.2","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#sslversionmin"],"options":[{"id":"com.apple.managedclient.preferences_sslversionmin_0","displayName":"TLS 1.0","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_sslversionmin_1","displayName":"TLS 1.1","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_sslversionmin_2","displayName":"TLS 1.2","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_startdaemononapplaunch","displayName":"Register app on launch","description":"Force Office apps to register with AutoUpdate on each launch.","helpText":null,"infoUrls":["https://macadmins.software/docs/MAU_38.pdf"],"options":[{"id":"com.apple.managedclient.preferences_startdaemononapplaunch_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_startdaemononapplaunch_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_strictermixedcontenttreatmentenabled","displayName":"Enable stricter treatment for mixed content","description":"This policy controls the treatment for mixed content (HTTP content in HTTPS sites) in the browser.\n\nIf you set this policy to true or not set, audio and video mixed content will be automatically upgraded to HTTPS (that is, the URL will be rewritten as HTTPS, without a fallback if the resource isn’t available over HTTPS) and a 'Not Secure' warning will be shown in the URL bar for image mixed content.\n\nIf you set the policy to false, auto upgrades will be disabled for audio and video, and no warning will be shown for images.\n\nThis policy does not affect other types of mixed content other than audio, video, and images.\n\nThis policy will no longer take effect starting in Microsoft Edge 84.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#strictermixedcontenttreatmentenabled"],"options":[{"id":"com.apple.managedclient.preferences_strictermixedcontenttreatmentenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_strictermixedcontenttreatmentenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_suppresso365autodiscoveroverride","displayName":"Use domain-based autodiscover instead of Office 365","description":"When true, autodiscover will contact the endpoint for the mailbox domain instead of the Office 365 service. This is recommended for on-premises Exchange mailboxes.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook"],"options":[{"id":"com.apple.managedclient.preferences_suppresso365autodiscoveroverride_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_suppresso365autodiscoveroverride_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_suppressunsupportedoswarning","displayName":"Suppress the unsupported OS warning","description":"Suppresses the warning that appears when Microsoft Edge is running on a computer or operating system that is no longer supported.\n\nIf this policy is false or unset, the warnings will appear on such unsupported computers or operating systems.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#suppressunsupportedoswarning"],"options":[{"id":"com.apple.managedclient.preferences_suppressunsupportedoswarning_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_suppressunsupportedoswarning_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_switchintranetsitestoworkprofile","displayName":"Switch intranet sites to a work or school profile","description":"Allows Microsoft Edge to switch to the appropriate profile when Microsoft Edge detects that a URL is the intranet.\n\nIf you enable or don't configure this policy, navigations to intranet URLs will switch to the most recently used work or school profile if one exists.\n\nIf you disable this policy, navigations to intranet URLs will remain in the current browser profile.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#switchintranetsitestoworkprofile"],"options":[{"id":"com.apple.managedclient.preferences_switchintranetsitestoworkprofile_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_switchintranetsitestoworkprofile_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_syncdisabled","displayName":"Disable synchronization of data using Microsoft sync services","description":"Disables data synchronization in Microsoft Edge. This policy also prevents the sync consent prompt from appearing.\n\nIf you don't set this policy or apply it as recommended, users will be able to turn sync on or off. If you apply this policy as mandatory, users will not be able to turn sync on.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#syncdisabled"],"options":[{"id":"com.apple.managedclient.preferences_syncdisabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_syncdisabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_synctypeslistdisabled","displayName":"Configure the list of types that are excluded from synchronization","description":"If you enable this policy all the specified data types will be excluded from synchronization. This policy can be used to limit the type of data uploaded to the Microsoft Edge synchronization service.\n\nYou can provide one of the following data types for this policy: \"favorites\", \"settings\", \"passwords\", \"addressesAndMore\", \"extensions\", and “collections”. Note that these data type names are case sensitive.\n\nUsers will not be able to override the disabled data types.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#synctypeslistdisabled"],"options":null},{"id":"com.apple.managedclient.preferences_systemextensions","displayName":"Use System Extensions","description":"Whether system extensions are used on MacOS 10.15 (Catalina) or not.","helpText":null,"infoUrls":["https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-atp-for-mac-is-moving-to-system-extensions/ba-p/1608736"],"options":[{"id":"com.apple.managedclient.preferences_systemextensions_0","displayName":"enabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_systemextensions_1","displayName":"disabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_tabcaptureallowedbyorigins","displayName":"Allow Tab capture by these origins","description":"Setting the policy lets you set a list of URL patterns that can use Tab Capture.\n\nLeaving the policy unset means that sites will not be considered for an override at this scope of capture.\n\nThis policy is not considered if a site matches a URL pattern in the \"SameOriginTabCaptureAllowedByOrigins\" policy.\n\nIf a site matches a URL pattern in this policy, the following policies will not be considered: \"WindowCaptureAllowedByOrigins\", \"ScreenCaptureAllowedByOrigins\", \"ScreenCaptureAllowed\".\n\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. This policy only matches based on origin, so any path in the URL pattern is ignored.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#tabcaptureallowedbyorigins"],"options":null},{"id":"com.apple.managedclient.preferences_tabfreezingenabled","displayName":"Allow freezing of background tabs","description":"Controls whether Microsoft Edge can freeze tabs that are in the background for at least 5 minutes.\n\nTab freezing reduces CPU, battery, and memory usage. Microsoft Edge uses heuristics to avoid freezing tabs that do useful work in the background, such as display notifications, play sound, and stream video.\n\nIf you enable or don't configure this policy, tabs that have been in the background for at least 5 minutes might be frozen.\n\nIf you disable this policy, no tabs will be frozen.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#tabfreezingenabled"],"options":[{"id":"com.apple.managedclient.preferences_tabfreezingenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_tabfreezingenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_tabservicesenabled","displayName":"Enable tab organization suggestions","description":"This policy controls whether Microsoft Edge can use its tab organization service to help name or suggest tab groups to increase productivity.\n\nIf you enable or don't configure this policy, when a user creates a tab group or activates certain \"Group Similar Tabs\" features Microsoft Edge sends tab data to its tab organization service. This data includes URLs, page titles, and existing group information. The service uses this data to return suggestions for better groupings and group names.\n\nIf you disable this policy, no data will be sent to the tab organization service. Microsoft Edge won't suggest group names when a group is created and certain \"Group Similar Tabs\" features that rely on the service won't be available.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#tabservicesenabled"],"options":[{"id":"com.apple.managedclient.preferences_tabservicesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_tabservicesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_tags","displayName":"Device tags","description":null,"helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#device-tags"],"options":null},{"id":"com.apple.managedclient.preferences_tags_item_key","displayName":"Type of tag","description":"Specify a tag name and its value. The GROUP tag, tags the device with the specified value. The tag is reflected in the portal under the device page and can be used for filtering and grouping devices.","helpText":null,"infoUrls":[],"options":{"id":"com.apple.managedclient.preferences_tags_item_key_0","displayName":"GROUP","description":null,"helpText":null}},{"id":"com.apple.managedclient.preferences_tags_item_value","displayName":"Value of tag","description":"Only one value per tag type can be set. Type of tags are unique, and should not be repeated in the same configuration profile.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_targetblankimpliesnoopener","displayName":"Do not set window.opener for links targeting _blank","description":"If you enable this policy or leave it unset, the window.opener property is set to null unless the anchor specifies rel=\"opener\".\n\nIf you disable this policy, popups that target _blank are permitted to access (via JavaScript) the page that requested to open the popup.\n\nThis policy will be obsoleted in Microsoft Edge version 95.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#targetblankimpliesnoopener"],"options":[{"id":"com.apple.managedclient.preferences_targetblankimpliesnoopener_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_targetblankimpliesnoopener_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_taskmanagerendprocessenabled","displayName":"Enable ending processes in the Browser task manager","description":"If you enable or don't configure this policy, users can end processes in the Browser task manager. If you disable it, users can't end processes, and the End process button is disabled in the Browser task manager.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#taskmanagerendprocessenabled"],"options":[{"id":"com.apple.managedclient.preferences_taskmanagerendprocessenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_taskmanagerendprocessenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_textpredictionenabled","displayName":"Text prediction enabled by default","description":"The Microsoft Turing service uses natural language processing to generate predictions for long-form editable text fields on web pages.\n\nIf you enable or don't configure this policy, text predictions will be provided for eligible text fields.\n\nIf you disable this policy, text predictions will not be provided in eligible text fields. Sites may still provide their own text predictions.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#textpredictionenabled"],"options":[{"id":"com.apple.managedclient.preferences_textpredictionenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_textpredictionenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_thirdpartystoragepartitioningblockedfororigins","displayName":"Disable third-party storage partitioning for specific top-level origins (deprecated)","description":"This policy lets you set a list of URL patterns that specify top-level origins for which third-party storage partitioning (partitioning of cross-origin iframe storage) should be disabled.\n\nIf this policy isn't set or a top-level origin doesn't match one of the URL patterns, then the value from \"DefaultThirdPartyStoragePartitioningSetting\" will be used.\n\nNote that the patterns you list are treated as origins, not URLs, so you shouldn't specify a path. For detailed information about valid origin patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.\n\nThis feature will be removed starting in Microsoft Edge version 145. To ensure compatibility, use the requestStorageAccess method instead. For more information, see https://developer.mozilla.org/en-US/docs/Web/API/Document/requestStorageAccess.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#thirdpartystoragepartitioningblockedfororigins"],"options":null},{"id":"com.apple.managedclient.preferences_threattypesettings","displayName":"Threat type settings","description":"The threatTypeSettings preference in the antivirus engine is used to control how certain threat types are handled by the product.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#threat-type-settings"],"options":null},{"id":"com.apple.managedclient.preferences_threattypesettings_item_key","displayName":"Threat type","description":"Type of the threat for which the behavior is configured.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_threattypesettings_item_key_0","displayName":"potentially_unwanted_application","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_threattypesettings_item_key_1","displayName":"archive_bomb","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_threattypesettings_item_value","displayName":"Action to take","description":"Action to take when coming across a threat of the type specified in the preceding section.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_threattypesettings_item_value_0","displayName":"audit","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_threattypesettings_item_value_1","displayName":"block","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_threattypesettings_item_value_2","displayName":"off","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_threattypesettingsmergepolicy","displayName":"Threat type settings merge","description":"Specify the merge policy for threat type settings. This can be a combination of administrator-defined and user-defined settings (merge) or only administrator-defined settings (admin_only). This setting can be used to restrict local users from defining their own settings for different threat types.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#threat-type-settings-merge-policy"],"options":[{"id":"com.apple.managedclient.preferences_threattypesettingsmergepolicy_0","displayName":"merge","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_threattypesettingsmergepolicy_1","displayName":"admin_only","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_tls13hardeningforlocalanchorsenabled","displayName":"Enable a TLS 1.3 security feature for local trust anchors.","description":"This policy controls a security feature in TLS 1.3 that protects connections against downgrade attacks. It is backwards-compatible and will not affect connections to compliant TLS 1.2 servers or proxies. However, older versions of some TLS-intercepting proxies have an implementation flaw which causes them to be incompatible.\n\nIf you set this policy to True, Microsoft Edge will enable these security protections for all connections.\n\nIf you set this policy to False or don’t set it, Microsoft Edge will disable these security protections for connections authenticated with locally-installed CA certificates. These protections are always enabled for connections authenticated with publicly-trusted CA certificates.\n\nThis policy may be used to test for any affected proxies and upgrade them. Affected proxies are expected to fail connections with an error code of ERR_TLS13_DOWNGRADE_DETECTED. A later version of Microsoft Edge will enable this option by default.\n\nAfter it is enabled by default, administrators who need more time to upgrade affected proxies may use this policy to temporarily disable this security feature. This policy will be removed after version 85.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#tls13hardeningforlocalanchorsenabled"],"options":[{"id":"com.apple.managedclient.preferences_tls13hardeningforlocalanchorsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_tls13hardeningforlocalanchorsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_tlsciphersuitedenylist","displayName":"Specify the TLS cipher suites to disable","description":"Configure the list of cipher suites that are disabled for TLS connections.\n\nIf you configure this policy, the list of configured cipher suites will not be used when establishing TLS connections.\n\nIf you don't configure this policy, the browser will choose which TLS cipher suites to use.\n\nCipher suite values to be disabled are specified as 16-bit hexadecimal values. The values are assigned by the Internet Assigned Numbers Authority (IANA) registry.\n\nThe TLS 1.3 cipher suite TLS_AES_128_GCM_SHA256 (0x1301) is required for TLS 1.3 and can't be disabled by this policy.\n\nThis policy does not affect QUIC-based connections. QUIC can be turned off via the \"QuicAllowed\" policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#tlsciphersuitedenylist"],"options":null},{"id":"com.apple.managedclient.preferences_totalmemorylimitmb","displayName":"Set limit on megabytes of memory a single Microsoft Edge instance can use.","description":"Configures the amount of memory that a single Microsoft Edge instance can use before tabs start getting discarded to save memory. The memory used by the tab will be freed and the tab will have to be reloaded when switched to.\n\nIf you enable this policy, the browser will start to discard tabs to save memory once the limitation is exceeded. However, there is no guarantee that the browser is always running under the limit. Any value under 1024 will be rounded up to 1024.\n\nIf you don't set this policy, the browser will only attempt to save memory when it has detected that the amount of physical memory on its machine is low.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#totalmemorylimitmb"],"options":null},{"id":"com.apple.managedclient.preferences_trackingprevention","displayName":"Block tracking of users' web-browsing activity","description":"Lets you decide whether to block websites from tracking users' web-browsing activity.\n\nIf you enable this policy, you have the following options for setting the level of tracking prevention:\n\n* 0 = Off (no tracking prevention)\n\n* 1 = Basic (blocks harmful trackers, content and ads will be personalized)\n\n* 2 = Balanced (blocks harmful trackers and trackers from sites user has not visited; content and ads will be less personalized)\n\n* 3 = Strict (blocks harmful trackers and majority of trackers from all sites; content and ads will have minimal personalization. Some parts of sites might not work)\n\nIf you disable this policy or don't configure it, users can set their own level of tracking prevention.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#trackingprevention"],"options":[{"id":"com.apple.managedclient.preferences_trackingprevention_0","displayName":"Off (no tracking prevention)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_trackingprevention_1","displayName":"Basic (blocks harmful trackers, content and ads will be personalized)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_trackingprevention_2","displayName":"Balanced (blocks harmful trackers and trackers from sites user has not visited; content and ads will be less personalized)","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_trackingprevention_3","displayName":"Strict (blocks harmful trackers and majority of trackers from all sites; content and ads will have minimal personalization. Some parts of sites might not work)","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_translateenabled","displayName":"Enable Translate","description":"Enables the integrated Microsoft translation service on Microsoft Edge.\n\nIf you enable this policy, Microsoft Edge offers translation functionality to the user by showing an integrated translate flyout when appropriate, and a translate option on the right-click context menu.\n\nDisable this policy to disable all built-in translate features.\n\nIf you don't configure the policy, users can choose whether to use the translation functionality or not.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#translateenabled"],"options":[{"id":"com.apple.managedclient.preferences_translateenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_translateenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_trusto365autodiscoverredirect","displayName":"Trust Office 365 autodiscover redirects","description":"When true, users will not see a dialog if autodiscover redirects the client to a different server. Recommended: true.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook"],"options":[{"id":"com.apple.managedclient.preferences_trusto365autodiscoverredirect_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_trusto365autodiscoverredirect_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_typosquattingallowlistdomains","displayName":"Configure the list of domains for which Edge Website Typo Protection won't trigger warnings","description":"Configure the list of Edge Website Typo Protection trusted domains. This means:\nEdge Website Typo Protection won't check for potentially malicious typosquatting websites.\n\nIf you enable this policy, Edge Website Typo Protection trusts these domains.\nIf you disable or don't set this policy, default Edge Website Typo Protection protection is applied to all resources.\n\nThis will only take effect when TyposquattingCheckerEnabled policy is not set or set to enabled.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10/11 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.\nAlso note that this policy does not apply if your organization has enabled Microsoft Defender for Endpoint. You must configure your allow and block lists in Microsoft 365 Defender portal using Indicators (Settings > Endpoints > Indicators).","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#typosquattingallowlistdomains"],"options":null},{"id":"com.apple.managedclient.preferences_typosquattingcheckerenabled","displayName":"Configure Edge Website Typo Protection","description":"This policy setting lets you configure whether to turn on Edge Website Typo Protection. Edge Website Typo Protection provides warning messages to help protect your users from potential typosquatting sites. By default, Edge Website Typo Protection is turned on.\n\nIf you enable this policy, Edge Website Typo Protection is turned on.\n\nIf you disable this policy, Edge Website Typo Protection is turned off.\n\nIf you don't configure this policy, Edge Website Typo Protection is turned on but users can choose whether to use Edge Website Typo Protection.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#typosquattingcheckerenabled"],"options":[{"id":"com.apple.managedclient.preferences_typosquattingcheckerenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_typosquattingcheckerenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_unthrottlednestedtimeoutenabled","displayName":"JavaScript setTimeout will not be clamped until a higher nesting threshold is set (deprecated)","description":"This policy is deprecated because it is a temporary policy for web standards compliance. It won't work in Microsoft Edge as soon as version 107.\nIf you enable this policy, the JavaScript setTimeout and setInterval, with an interval smaller than 4ms, will not be clamped. This improves short horizon performance, but websites abusing the API will still eventually have their setTimeout usages clamped.\nIf you disable or don't configure policy, the JavaScript setTimeout and setInterval, with an interval smaller than 4ms, will be clamped.\n\nThis is a web standards compliancy feature that may change task ordering on a web page, leading to unexpected behavior on sites that are dependent on a certain ordering.\nIt also may affect sites with a lot of usage of a timeout of 0ms for setTimeout. For example, increasing CPU load.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#unthrottlednestedtimeoutenabled"],"options":[{"id":"com.apple.managedclient.preferences_unthrottlednestedtimeoutenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_unthrottlednestedtimeoutenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_updatecache","displayName":"Update cache server","description":"Specify the HTTP(S) URL of the server that you use for cached package updates (PKG files). You must include a trailing forward slash.","helpText":null,"infoUrls":["https://macadmins.software/docs/MAU_CachingServer.pdf"],"options":null},{"id":"com.apple.managedclient.preferences_updatecheckfrequency","displayName":"Update check frequency (mins)","description":"Specify how often AutoUpdate checks for updates. The allowed range is 240 minutes (4 hours) - 720 minutes (12 hours).","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_updatedeadline.daysbeforeforcedquit","displayName":"Days before forced updates","description":"Specify the maximum number of days that an update can be pending before the user is forced to update the app. Set the value to 0 to disable forced updates.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/deployoffice/mac/mau-deadline"],"options":null},{"id":"com.apple.managedclient.preferences_updatedeadline.finalcountdown","displayName":"Number of minutes for the final countdown timer","description":"Specify the number of minutes for the forced deadline countdown timer. The allowed range is 10 - 720 minutes (12 hours). The default is 60 minutes.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/deployoffice/mac/mau-deadline"],"options":null},{"id":"com.apple.managedclient.preferences_updatepolicyoverride","displayName":"Specifies how Microsoft Edge Update handles available updates from Microsoft Edge","description":"If you enable this policy, Microsoft Edge Update handles Microsoft Edge updates according to how you configure the following options:\n\n- Automatic silent updates only: Updates are applied only when they're found by the periodic update check.\n\n- Manual updates only: Updates are applied only when the user runs a manual update check. (Not all apps provide an interface for this option.)\n\nIf you select manual updates, make sure you periodically check for updates by using Microsoft Autoupdate.\n\nIf you don't enable and configure this policy, Microsoft Edge Update automatically checks for updates.\n\nPolicy options mapping:\n\n* automatic-silent-only (automatic-silent-only) = Updates are applied only when they're found by the periodic update check.\n\n* manual-only (manual-only) = Updates are applied only when the user runs a manual update check. (Not all apps provide an interface for this option.)\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#updatepolicyoverride"],"options":[{"id":"com.apple.managedclient.preferences_updatepolicyoverride_0","displayName":"silent-only - Updates are applied only when they're found by the periodic update check.","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_updatepolicyoverride_1","displayName":"only - Updates are applied only when the user runs a manual update check. (Not all apps provide an interface for this option.)","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_updateroptimization","displayName":"Updater optimization technique","description":"By default AutoUpdate will optimize for smaller packages on the network. However, this can cause larger CPU overheads when security agents (e.g. CrowdStrike) are installed. Alternatively, you can choose to lower the CPU overheads to process updates but accept larger download packages","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_updateroptimization_0","displayName":"Lower network overhead","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_updateroptimization_1","displayName":"Lower processor overhead","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_updateroptimization_2","displayName":"Always use full updates","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_uploadbandwidthlimited","displayName":"Set maximum upload throughput","description":"Sets the maximum upload throughput rate in kilobytes (KB)/sec for computers running the OneDrive sync app. The minimum rate is 50 KB/sec and the maximum rate is 100,000 KB/sec.","helpText":null,"infoUrls":["https://learn.microsoft.com/sharepoint/deploy-and-configure-on-macos#uploadbandwidthlimited"],"options":null},{"id":"com.apple.managedclient.preferences_uploadfromphoneenabled","displayName":"Enable upload files from mobile in Microsoft Edge desktop","description":"This policy lets you configure the \"Upload from mobile\" feature in Microsoft Edge.\n\nUpload from mobile lets users select file from mobile devices to desktop when user upload file in a webpage in Microsoft Edge.\n\nIf you enable or don't configure this policy, you can use the Upload from mobile feature in Microsoft Edge.\n\nIf you disable this policy, you can't use the Upload from mobile feature in Microsoft Edge.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#uploadfromphoneenabled"],"options":[{"id":"com.apple.managedclient.preferences_uploadfromphoneenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_uploadfromphoneenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_urlallowlist","displayName":"Define a list of allowed URLs","description":"Allow access to the listed URLs, as exceptions to the URL block list.\n\nFormat the URL pattern according to https://go.microsoft.com/fwlink/?linkid=2095322.\n\nYou can use this policy to open exceptions to restrictive block lists. For example, you can include '*' in the block list to block all requests, and then use this policy to allow access to a limited list of URLs. You can use this policy to open exceptions to certain schemes, subdomains of other domains, ports, or specific paths.\n\nThe most specific filter determines if a URL is blocked or allowed. The allowed list takes precedence over the block list.\n\nThis policy is limited to 1000 entries; subsequent entries are ignored.\n\nIf you don't configure this policy, there are no exceptions to the block list in the \"URLBlocklist\" policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#urlallowlist"],"options":null},{"id":"com.apple.managedclient.preferences_urlblocklist","displayName":"Block access to a list of URLs","description":"Define a list of sites, based on URL patterns, that are blocked (your users can't load them).\n\nFormat the URL pattern according to https://go.microsoft.com/fwlink/?linkid=2095322.\n\nYou can define exceptions in the \"URLAllowlist\" policy. These policies are limited to 1000 entries; subsequent entries are ignored.\n\nNote that blocking internal 'edge://*' URLs isn't recommended - this may lead to unexpected errors.\n\nThis policy doesn't prevent the page from updating dynamically through JavaScript. For example, if you block 'contoso.com/abc', users might still be able to visit 'contoso.com' and click on a link to visit 'contoso.com/abc', as long as the page doesn't refresh.\n\nIf you don't configure this policy, no URLs are blocked.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#urlblocklist"],"options":null},{"id":"com.apple.managedclient.preferences_useragentclienthintsenabled","displayName":"Enable the User-Agent Client Hints feature","description":"This policy is deprecated because it's only intended to be a short-term mechanism to give enterprises more time to update their web content if and when it's found to be incompatible with the User-Agent Client Hints feature. It won't work in Microsoft Edge version 89.\n\nWhen enabled the User-Agent Client Hints feature sends granular request headers that provide information about the user browser (for example, the browser version) and environment (for example, the system architecture).\n\nThis is an additive feature, but the new headers may break some websites that restrict the characters that requests may contain.\n\nIf you enable or don't configure this policy, the User-Agent Client Hints feature is enabled. If you disable this policy, this feature is unavailable.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#useragentclienthintsenabled"],"options":[{"id":"com.apple.managedclient.preferences_useragentclienthintsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_useragentclienthintsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_useragentreduction","displayName":"Enable or disable the User-Agent Reduction (deprecated)","description":"The User-Agent HTTP request header has been reduced by default since Microsoft Edge version 119. To continue receiving detailed platform information, migrate to User-Agent Client Hints, which replace the deprecated detailed User-Agent header. For more information, visit: https://web.dev/articles/migrate-to-ua-ch\n\nIf you don't configure this policy or set it to Default, the User-Agent header will be reduced and controlled by experimentation.\n\nSet this policy to 'ForceEnabled' to force the reduced version of the User-Agent request header for all origins.\n\nSet this policy to 'ForceDisabled' to always use the full (legacy) User-Agent header.\n\nTo learn more about the User-Agent string, read here:\n\nhttps://go.microsoft.com/fwlink/?linkid=2186267\n\nPolicy options mapping:\n\n* Default (0) = Reduced User Agent, or controlled by experimentation.\n\n* ForceDisabled (1) = Full (legacy) User Agent.\n\n* ForceEnabled (2) = Reduced User Agent.\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#useragentreduction"],"options":[{"id":"com.apple.managedclient.preferences_useragentreduction_0","displayName":"Reduced User Agent, or controlled by experimentation.","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_useragentreduction_1","displayName":"Full (legacy) User Agent.","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_useragentreduction_2","displayName":"Reduced User Agent.","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_userdatadir","displayName":"Set the user data directory","description":"Set the directory to use for storing user data.\n\nIf you enable this policy, Microsoft Edge uses the specified directory regardless of whether the user has set the '--user-data-dir' command-line flag.\n\nIf you don't enable this policy, the default profile path is used, but the user can override it by using the '--user-data-dir' flag. Users can find the directory for the profile at edge://version/ under profile path.\n\nTo avoid data loss or other errors, don't configure this policy to a volume's root directory or to a directory that's used for other purposes, because Microsoft Edge manages its contents.\n\nSee https://go.microsoft.com/fwlink/?linkid=2095041 for a list of variables that can be used.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#userdatadir"],"options":null},{"id":"com.apple.managedclient.preferences_userfeedbackallowed","displayName":"Allow user feedback","description":"Microsoft Edge uses the Edge Feedback feature (enabled by default) to allow users to send feedback, suggestions or customer surveys and to report any issues with the browser. Also, by default, users can't disable (turn off) the Edge Feedback feature.\n\nIf you enable this policy or don't configure it, users can invoke Edge Feedback.\n\nIf you disable this policy, users can't invoke Edge Feedback.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#userfeedbackallowed"],"options":[{"id":"com.apple.managedclient.preferences_userfeedbackallowed_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_userfeedbackallowed_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_userinitiatedfeedback","displayName":"User initiated feedback","description":"Specify whether users can submit feedback to Microsoft by going to Help > Send Feedback.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#diagnostic-collection-level"],"options":[{"id":"com.apple.managedclient.preferences_userinitiatedfeedback_0","displayName":"enabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_userinitiatedfeedback_1","displayName":"disabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_userpreference_apptheming","displayName":"Set theme","description":"Set the theme color.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook"],"options":[{"id":"com.apple.managedclient.preferences_userpreference_apptheming_0","displayName":"Blue","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_userpreference_apptheming_1","displayName":"Purple","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_userpreference_apptheming_2","displayName":"Pink","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_userpreference_apptheming_3","displayName":"Orange","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_userpreference_apptheming_4","displayName":"Red","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_userpreference_apptheming_5","displayName":"Green","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_userpreference_maxchecklistdisplaydurationmet","displayName":"Hide the 'Get started with Outlook' control in the task pane","description":"Suppress the task pane control that advertises access to toolbar customization, notification preferences, theme, and adding secondary accounts.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook"],"options":[{"id":"com.apple.managedclient.preferences_userpreference_maxchecklistdisplaydurationmet_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_userpreference_maxchecklistdisplaydurationmet_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_usesystemprintdialog","displayName":"Print using system print dialog","description":"Shows the system print dialog instead of print preview.\n\nIf you enable this policy, Microsoft Edge opens the system print dialog instead of the built-in print preview when a user prints a page.\n\nIf you don't configure or disable this policy, print commands trigger the Microsoft Edge print preview screen.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#usesystemprintdialog"],"options":[{"id":"com.apple.managedclient.preferences_usesystemprintdialog_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_usesystemprintdialog_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_vbaobjectmodelistrusted","displayName":"Allow macros to modify Visual Basic projects","description":"Allow Visual Basic macros to modify Visual Basic projects. Recommended: false.","helpText":null,"infoUrls":["https://aka.ms/macvbpref"],"options":[{"id":"com.apple.managedclient.preferences_vbaobjectmodelistrusted_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_vbaobjectmodelistrusted_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_verticaltabsallowed","displayName":"Configures availability of a vertical layout for tabs on the side of the browser","description":"Configures whether a user can access an alternative layout where tabs are vertically aligned on the side of the browser instead of at the top.\nWhen there are several tabs open, this layout provides better tab viewing and management. There's better visibility of the site titles,\nit's easier to scan aligned icons, and there's more space to manage and close tabs.\n\nIf you disable this policy, then the vertical tab layout will not be available as an option for users.\n\nIf you enable or don't configure this policy, the tab layout will still be at the top, but a user has the option to turn on vertical tabs on the side.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#verticaltabsallowed"],"options":[{"id":"com.apple.managedclient.preferences_verticaltabsallowed_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_verticaltabsallowed_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_videocaptureallowed","displayName":"Allow or block video capture","description":"Control whether sites can capture video.\n\nIf enabled or not configured (default), the user will be asked about video capture access for all sites except those with URLs configured in the \"VideoCaptureAllowedUrls\" policy list, which will be granted access without prompting.\n\nIf you disable this policy, the user isn't prompted, and video capture is only available to URLs configured in \"VideoCaptureAllowedUrls\" policy.\n\nThis policy affects all types of video inputs, not only the built-in camera.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#videocaptureallowed"],"options":[{"id":"com.apple.managedclient.preferences_videocaptureallowed_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_videocaptureallowed_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_videocaptureallowedurls","displayName":"Sites that can access video capture devices without requesting permission","description":"Specify websites, based on URL patterns, that can use video capture devices without asking the user for permission. Patterns in this list are matched against the security origin of the requesting URL. If they match, the site is automatically granted access to video capture devices.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#videocaptureallowedurls"],"options":null},{"id":"com.apple.managedclient.preferences_visualbasicentirelydisabled","displayName":"Prevent all Visual Basic macros from executing","description":"Prevent all Visual Basic code from running in Word, Excel, and PowerPoint - even from trusted locations like the default template. Requires 16.32 or later. Recommended: true, where macros should never be used.","helpText":null,"infoUrls":["https://aka.ms/macvbpref"],"options":[{"id":"com.apple.managedclient.preferences_visualbasicentirelydisabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_visualbasicentirelydisabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_visualbasicmacroexecutionstate","displayName":"Visual Basic macro policy","description":"Controls whether Visual Basic macros are allowed to execute in Word, Excel, and PowerPoint.","helpText":null,"infoUrls":["https://aka.ms/macvbpref"],"options":[{"id":"com.apple.managedclient.preferences_visualbasicmacroexecutionstate_0","displayName":"Macros disabled by default, with warning to enable","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_visualbasicmacroexecutionstate_1","displayName":"Disable all macros","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_visualbasicmacroexecutionstate_2","displayName":"Always allow macros to run (potentially dangerous)","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_visualsearchenabled","displayName":"Visual search enabled","description":"Visual search lets you quickly explore more related content about entities in an image.\n\nIf you enable or don't configure this policy, visual search will be enabled via image hover, context menu, and search in sidebar.\n\nIf you disable this policy, visual search will be disabled and you won't be able to get more info about images via hover, context menu, and search in sidebar.\n\nNote: Visual Search in Web Capture is still managed by \"WebCaptureEnabled\" policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#visualsearchenabled"],"options":[{"id":"com.apple.managedclient.preferences_visualsearchenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_visualsearchenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_walletdonationenabled","displayName":"Wallet Donation Enabled","description":"The Wallet Donation feature in Microsoft Edge allows users to view their donation summary, explore Nonprofit organizations (NPOs), donate to an NPO, manage their monthly donations, and view their donation history.\n\nIf you enable or don't configure this policy, users can use the Wallet Donation feature.\n\nIf you disable this policy, users can't use the Wallet Donation feature.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#walletdonationenabled"],"options":[{"id":"com.apple.managedclient.preferences_walletdonationenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_walletdonationenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_weather_update_automatically","displayName":"Disable automatic updating of weather location","description":"Prevent users from choosing Update Location Automatically for weather location.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployoffice/mac/preferences-outlook#disable-automatic-updating-of-weather-location"],"options":[{"id":"com.apple.managedclient.preferences_weather_update_automatically_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_weather_update_automatically_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_webappinstallforcelist","displayName":"Web App Install Force List","description":"Specifies a list of websites that are installed silently, without user interaction, and which can't be uninstalled or disabled by the user.\n\nEach list item of the policy is an object with the following members:\n - \"url\", which is mandatory. \"url\" should be the URL of the web app to install.\n\nValues for the optional members are:\n - \"launch_container\" should be either \"window\" or \"tab\" to indicate how the Web App will be opened after it's installed.\n - \"create_desktop_shortcut\" should be true if a desktop shortcut should be created on Windows.\n\nIf \"default_launch_container\" is omitted, the app will open in a tab by default. Regardless of the value of \"default_launch_container\", users can change which container the app will open in. If \"create_desktop_shortcuts\" is omitted, no desktop shortcuts will be created.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#webappinstallforcelist"],"options":null},{"id":"com.apple.managedclient.preferences_webappinstallforcelist_item_create_desktop_shortcut","displayName":"Create desktop shortcut","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_webappinstallforcelist_item_create_desktop_shortcut_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_webappinstallforcelist_item_create_desktop_shortcut_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_webappinstallforcelist_item_default_launch_container","displayName":"Default launch container","description":null,"helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_webappinstallforcelist_item_default_launch_container_0","displayName":"tab","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_webappinstallforcelist_item_default_launch_container_1","displayName":"window","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_webappinstallforcelist_item_url","displayName":"URL","description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_webcaptureenabled","displayName":"Enable web capture feature in Microsoft Edge","description":"Enables the web capture feature in Microsoft Edge that allows users to capture web content and annotate the capture using inking tools.\nIf you enable this policy or don't configure it, the Web capture option shows up in the context menu, Settings and more menu, and by using the keyboard shortcut, CTRL+SHIFT+S.\nIf you disable this policy, users can't access the web capture feature in Microsoft Edge.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#webcaptureenabled"],"options":[{"id":"com.apple.managedclient.preferences_webcaptureenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_webcaptureenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_webcomponentsv0enabled","displayName":"Re-enable Web Components v0 API until M84.","description":"The Web Components v0 APIs (Shadow DOM v0, Custom Elements v0, and HTML Imports) were deprecated in 2018, and have been disabled by default starting in M80. This policy allows these features to be selectively re-enabled until M84.\n\n If you set this policy is set to True, the Web Components v0 features will be enabled for all sites.\n\n If you set this policy to False or don't set this policy, the Web Components v0 features will be disabled by default, starting in M80.\n\n This policy will be removed after Microsoft Edge 84.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#webcomponentsv0enabled"],"options":[{"id":"com.apple.managedclient.preferences_webcomponentsv0enabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_webcomponentsv0enabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_webdriveroverridesincompatiblepolicies","displayName":"Allow WebDriver to Override Incompatible Policies","description":"This policy was removed in M83, because it is not necessary anymore as\nWebDriver is now compatible with all existing policies.\n\nThis policy allows users of the WebDriver feature to override\npolicies which can interfere with its operation.\n\nCurrently this policy disables \"SitePerProcess\" and \"IsolateOrigins\" policies.\n\nIf the policy is enabled, WebDriver will be able to override incomaptible\npolicies.\nIf the policy is disabled or not configured, WebDriver will not be allowed\nto override incompatible policies.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#webdriveroverridesincompatiblepolicies"],"options":[{"id":"com.apple.managedclient.preferences_webdriveroverridesincompatiblepolicies_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_webdriveroverridesincompatiblepolicies_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_webhidallowalldevicesforurls","displayName":"Allow listed sites to connect to any HID device","description":"This setting allows you to list sites which are automatically granted permission to access all available devices.\n\nThe URLs must be valid or the policy is ignored. Only the origin (scheme, host and port) of the URL is evaluated.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.\n\nThis policy overrides \"DefaultWebHidGuardSetting\", \"WebHidAskForUrls\", \"WebHidBlockedForUrls\" and the user's preferences.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#webhidallowalldevicesforurls"],"options":null},{"id":"com.apple.managedclient.preferences_webhidaskforurls","displayName":"Allow the WebHID API on these sites","description":"Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them access to a HID device.\n\nLeaving the policy unset means \"DefaultWebHidGuardSetting\" applies for all sites, if it's set. If not, users' personal settings apply.\n\nFor URL patterns that don't match the policy, the following values are applied in order of precedence:\n\n * \"WebHidBlockedForUrls\" (if there is a match),\n\n * \"DefaultWebHidGuardSetting\" (if set), or\n\n * Users' personal settings.\n\nURL patterns must not conflict with \"WebHidBlockedForUrls\". Neither policy takes precedence if a URL matches both patterns.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#webhidaskforurls"],"options":null},{"id":"com.apple.managedclient.preferences_webhidblockedforurls","displayName":"Block the WebHID API on these sites","description":"Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them access to a HID device.\n\nLeaving the policy unset means \"DefaultWebHidGuardSetting\" applies for all sites, if it's set. If not, users' personal settings apply.\n\nFor URL patterns that don't match the policy, the following values are applied in order of precedence:\n\n * \"WebHidAskForUrls\" (if there is a match),\n\n * \"DefaultWebHidGuardSetting\" (if set), or\n\n * Users' personal settings.\n\nURL patterns can't conflict with \"WebHidAskForUrls\". Neither policy takes precedence if a URL matches both patterns.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#webhidblockedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_webrtcallowlegacytlsprotocols","displayName":"Allow legacy TLS/DTLS downgrade in WebRTC","description":"If you enable this policy, WebRTC peer connections can downgrade to obsolete\nversions of the TLS/DTLS (DTLS 1.0, TLS 1.0 and TLS 1.1) protocols.\nIf you disable or don't set this policy, these TLS/DTLS versions are\ndisabled.\n\nThis policy is temporary and will be removed in a future version\nof Microsoft Edge.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#webrtcallowlegacytlsprotocols"],"options":[{"id":"com.apple.managedclient.preferences_webrtcallowlegacytlsprotocols_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_webrtcallowlegacytlsprotocols_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_webrtclocalhostiphandling","displayName":"Restrict exposure of local IP address by WebRTC","description":"Allows you to set whether or not WebRTC exposes the user's local IP address.\n\nIf you set this policy to \"AllowAllInterfaces\" ('default') or \"AllowPublicAndPrivateInterfaces\" ('default_public_and_private_interfaces'), WebRTC exposes the local IP address.\n\nIf you set this policy to \"AllowPublicInterfaceOnly\" ('default_public_interface_only') or \"DisableNonProxiedUdp\" ('disable_non_proxied_udp'), WebRTC doesn't expose the local IP address.\n\nIf you don't set this policy, or if you disable it, WebRTC exposes the local IP address.\n\n * 'default' = Allow all interfaces. This exposes the local IP address.\n * 'default_public_and_private_interfaces' = Allow public and private interfaces over http default route. This exposes the local IP address.\n * 'default_public_interface_only' = Allow public interface over http default route. This doesn't expose the local IP address.\n * 'disable_non_proxied_udp' = Use TCP unless proxy server supports UDP. This doesn't expose the local IP address.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#webrtclocalhostiphandling"],"options":[{"id":"com.apple.managedclient.preferences_webrtclocalhostiphandling_0","displayName":"Allow all interfaces. This exposes the local IP address","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_webrtclocalhostiphandling_1","displayName":"Allow public and private interfaces over http default route. This exposes the local IP address","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_webrtclocalhostiphandling_2","displayName":"Allow public interface over http default route. This doesn't expose the local IP address","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_webrtclocalhostiphandling_3","displayName":"Use TCP unless proxy server supports UDP. This doesn't expose the local IP address","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_webrtclocalipsallowedurls","displayName":"Manage exposure of local IP addressess by WebRTC","description":"Specifies a list of origins (URLs) or hostname patterns (like \"*contoso.com*\") for which local IP address should be exposed by WebRTC.\n\nIf you enable this policy and set a list of origins (URLs) or hostname patterns, when edge://flags/#enable-webrtc-hide-local-ips-with-mdns is Enabled, WebRTC will expose the local IP address for cases that match patterns in the list.\n\nIf you disable or don't configure this policy, and edge://flags/#enable-webrtc-hide-local-ips-with-mdns is Enabled, WebRTC will not expose local IP addresses. The local IP address is concealed with an mDNS hostname.\n\nIf you enable, disable, or don't configure this policy, and edge://flags/#enable-webrtc-hide-local-ips-with-mdns is Disabled, WebRTC will expose local IP addresses.\n\nPlease note that this policy weakens the protection of local IP addresses that might be needed by administrators.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#webrtclocalipsallowedurls"],"options":null},{"id":"com.apple.managedclient.preferences_webrtcudpportrange","displayName":"Restrict the range of local UDP ports used by WebRTC","description":"Restricts the UDP port range used by WebRTC to a specified port interval (endpoints included).\n\nBy configuring this policy, you specify the range of local UDP ports that WebRTC can use.\n\nIf you don't configure this policy, or if you set it to an empty string or invalid port range, WebRTC can use any available local UDP port.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#webrtcudpportrange"],"options":null},{"id":"com.apple.managedclient.preferences_webusbaskforurls","displayName":"Allow WebUSB on specific sites","description":"Define a list of sites, based on URL patterns, that can ask the user for access to a USB device.\n\nIf you don't configure this policy, the global default value from the \"DefaultWebUsbGuardSetting\" policy (if set) or the user's personal configuration is used for all sites.\n\nThe URL patterns defined in this policy can't conflict with those configured in the \"WebUsbBlockedForUrls\" policy - you can't both allow and block a URL.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#webusbaskforurls"],"options":null},{"id":"com.apple.managedclient.preferences_webusbblockedforurls","displayName":"Block WebUSB on specific sites","description":"Define a list of sites, based on URL patterns, that can't ask the user to grant them access to a USB device.\n\nIf you don't configure this policy, the global default value from the \"DefaultWebUsbGuardSetting\" policy (if set) or the user's personal configuration is used for all sites.\n\nURL patterns in this policy can't conflict with those configured in the \"WebUsbAskForUrls\" policy. You can't both allow and block a URL.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#webusbblockedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_weeklyconfiguration","displayName":"Weekly scheduled scan configuration","description":"Should scheduled scan be run with low priority. (Scan might take longer to complete).","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_weeklyconfiguration_dayofweek","displayName":"Day of week","description":"Specifies the day of the week to perform a weekly scan. 0 indicates never. 1-7 indicates Sunday - Saturday. 8 indicates every day.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_weeklyconfiguration_scantype","displayName":"Scan type","description":"Specifies the type of scan to perform.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.managedclient.preferences_weeklyconfiguration_scantype_0","displayName":"quick","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_weeklyconfiguration_scantype_1","displayName":"full","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_weeklyconfiguration_timeofday","displayName":"Time of day","description":"Specifies the time of day, as the number of minutes after midnight, to perform a weekly scan.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.managedclient.preferences_windowcaptureallowedbyorigins","displayName":"Allow Window and Tab capture by these origins","description":"Setting the policy lets you set a list of URL patterns that can use Window and Tab Capture.\n\nLeaving the policy unset means that sites will not be considered for an override at this scope of Capture.\n\nThis policy is not considered if a site matches a URL pattern in any of the following policies: \"TabCaptureAllowedByOrigins\", \"SameOriginTabCaptureAllowedByOrigins\".\n\nIf a site matches a URL pattern in this policy, the following policies will not be considered: \"ScreenCaptureAllowedByOrigins\", \"ScreenCaptureAllowed\".\n\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. This policy only matches based on origin, so any path in the URL pattern is ignored.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#windowcaptureallowedbyorigins"],"options":null},{"id":"com.apple.managedclient.preferences_windowmanagementallowedforurls","displayName":"Allow Window Management permission on specified sites","description":"Lets you configure a list of site url patterns that specify sites which will automatically grant the window management permission. This extends the ability of sites to see information about the device's screens. This information can be used to open and place windows or request fullscreen on specific screens.\n\nFor detailed information on valid site url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed. This policy only matches based on site origin, so any path in the URL pattern is ignored.\n\nIf this policy isn't configured for a site, then the policy from \"DefaultWindowManagementSetting\" applies to the site, if configured. Otherwise the permission will follow the browser's defaults and let users choose this permission per site.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#windowmanagementallowedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_windowmanagementblockedforurls","displayName":"Block Window Management permission on specified sites","description":"Lets you configure a list of site url patterns that specify sites which will automatically deny the window management permission. This limits the ability of sites to see information about the device's screens. This information can be used to open and place windows or request fullscreen on specific screens.\n\nFor detailed information on valid site url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed. This policy only matches based on site origin, so any path in the URL pattern is ignored.\n\nIf this policy isn't configured for a site, then the policy from \"DefaultWindowManagementSetting\" applies to the site, if configured. Otherwise the permission will follow the browser's defaults and let users choose this permission per site.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#windowmanagementblockedforurls"],"options":null},{"id":"com.apple.managedclient.preferences_wpadquickcheckenabled","displayName":"Set WPAD optimization","description":"Allows you to turn off WPAD (Web Proxy Auto-Discovery) optimization in Microsoft Edge.\n\nIf you disable this policy, WPAD optimization is disabled, which makes the browser wait longer for DNS-based WPAD servers.\n\nIf you enable or don't configure the policy, WPAD optimization is enabled.\n\nIndependent of whether or how this policy is enabled, the WPAD optimization setting cannot be changed by users.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#wpadquickcheckenabled"],"options":[{"id":"com.apple.managedclient.preferences_wpadquickcheckenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_wpadquickcheckenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.managedclient.preferences_zstdcontentencodingenabled","displayName":"Enable zstd content encoding support (Deprecated)","description":"This feature enables advertising \"zstd\" support in the Accept-Encoding request header and support for decompressing zstd web content.\n\nIf you enable or don't configure this policy, Microsoft Edge will accept server responses compressed with zstd.\n\nIf you disable this policy, the zstd content encoding feature will not be advertised or supported when processing server responses.\n\nThis policy is temporary and will be removed in the future.","helpText":null,"infoUrls":["https://docs.microsoft.com/deployedge/microsoft-edge-policies#zstdcontentencodingenabled"],"options":[{"id":"com.apple.managedclient.preferences_zstdcontentencodingenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.managedclient.preferences_zstdcontentencodingenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.mcx_cachedaccounts.askforsecuretokenauthbypass","displayName":"Ask For Secure Token Auth Bypass","description":"If true, bypasses the secure token authorization dialog. This dialog only appears on APFS volumes.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_cachedaccounts.askforsecuretokenauthbypass_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_cachedaccounts.askforsecuretokenauthbypass_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_cachedaccounts.expiry.delete.disusedseconds","displayName":"Expiry Delete Disused Seconds","description":"The minimum number of seconds a mobile account can exist before an automatic attempt is made to remove the mobile account. Set to 0 to try to remove it at next login or logout time. Set to -1 to never try to remove the mobile account.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_cachedaccounts.warnoncreate.allownever","displayName":"Warn On Create Allow Never","description":"If true, allows the user to stop the prompts about mobile account creation every time the user logs in. This key is only valid if Warn On Create is set to true.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_cachedaccounts.warnoncreate.allownever_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_cachedaccounts.warnoncreate.allownever_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.cachedaccounts.createatlogin","displayName":"Create At Login","description":"If true, creates the mobile account at login time.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.cachedaccounts.createatlogin_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.cachedaccounts.createatlogin_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.cachedaccounts.warnoncreate","displayName":"Warn On Create","description":"If true, asks the user if the mobile account should be created and allow the user to not create it.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.cachedaccounts.warnoncreate_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.cachedaccounts.warnoncreate_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower","displayName":"Desktop Power","description":"The settings for a desktop computer.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower_automatic restart on power loss","displayName":"Automatic Restart On Power Loss","description":"If true, enables \"Start up automatically after a power failure.\"","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower_automatic restart on power loss_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower_automatic restart on power loss_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower_disk sleep timer","displayName":"Disk Sleep Timer","description":"The disk sleep time, in minutes. A value of 0 means never.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower_display sleep timer","displayName":"Display Sleep Timer","description":"The display sleep time, in minutes. A value of 0 means never.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower_dynamic power step","displayName":"Dynamic Power Step","description":"May not be available on all systems.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower_dynamic power step_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower_dynamic power step_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower_reduce processor speed","displayName":"Reduce Processor Speed","description":"May not be available on all systems.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower_reduce processor speed_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower_reduce processor speed_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower_system sleep timer","displayName":"System Sleep Timer","description":"System sleep time, in minutes. A value of 0 means never.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower_wake on lan","displayName":"Wake on LAN","description":"If true, enables \"Wake for network access.\"","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower_wake on lan_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower_wake on lan_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower_wake on modem ring","displayName":"Wake On Modem Ring","description":"If true, enables \"Wake for modem ring.\"","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower_wake on modem ring_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.acpower_wake on modem ring_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule","displayName":"Desktop Schedule","description":"The schedule for turning a computer on and off.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweroff","displayName":"Repeating Power Off","description":"The schedule for turning the device off. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweroff_eventtype","displayName":"Event Type","description":"The type of action defined by this schedule.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweroff_eventtype_0","displayName":"Wake","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweroff_eventtype_1","displayName":"Power On","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweroff_eventtype_2","displayName":"Wake Power On","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweroff_eventtype_3","displayName":"Sleep","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweroff_eventtype_4","displayName":"Shutdown","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweroff_eventtype_5","displayName":"Restart","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweroff_time","displayName":"Time","description":"The time, in minutes, since midnight.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweroff_weekdays","displayName":"Weekdays","description":"One or more days of the week that the device will automatically shutdown. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweroff_weekdays_0","displayName":"Mon","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweroff_weekdays_1","displayName":"Tue","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweroff_weekdays_2","displayName":"Wed","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweroff_weekdays_3","displayName":"Thu","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweroff_weekdays_4","displayName":"Fri","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweroff_weekdays_5","displayName":"Sat","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweroff_weekdays_6","displayName":"Sun","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweron","displayName":"Repeating Power On","description":"The schedule for powering the device on. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweron_eventtype","displayName":"Event Type","description":"The type of action defined by this schedule.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweron_eventtype_0","displayName":"Wake","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweron_eventtype_1","displayName":"Power On","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweron_eventtype_2","displayName":"Wake Power On","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweron_eventtype_3","displayName":"Sleep","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweron_eventtype_4","displayName":"Shutdown","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweron_eventtype_5","displayName":"Restart","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweron_time","displayName":"Time","description":"The time, in minutes, since midnight.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweron_weekdays","displayName":"Weekdays","description":"One or more days of the week that the device will automatically power on.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweron_weekdays_0","displayName":"Mon","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweron_weekdays_1","displayName":"Tue","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweron_weekdays_2","displayName":"Wed","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweron_weekdays_3","displayName":"Thu","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweron_weekdays_4","displayName":"Fri","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweron_weekdays_5","displayName":"Sat","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.desktop.schedule_repeatingpoweron_weekdays_6","displayName":"Sun","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower","displayName":"Laptop Power","description":"The settings for a laptop computer using AC power. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower_automatic restart on power loss","displayName":"Automatic Restart On Power Loss","description":"If true, enables \"Start up automatically after a power failure.\"","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower_automatic restart on power loss_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower_automatic restart on power loss_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower_disk sleep timer","displayName":"Disk Sleep Timer","description":"The disk sleep time, in minutes. A value of 0 means never.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower_display sleep timer","displayName":"Display Sleep Timer","description":"The display sleep time, in minutes. A value of 0 means never.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower_dynamic power step","displayName":"Dynamic Power Step","description":"May not be available on all systems.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower_dynamic power step_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower_dynamic power step_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower_reduce processor speed","displayName":"Reduce Processor Speed","description":"May not be available on all systems.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower_reduce processor speed_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower_reduce processor speed_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower_system sleep timer","displayName":"System Sleep Timer","description":"System sleep time, in minutes. A value of 0 means never.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower_wake on lan","displayName":"Wake on LAN","description":"If true, enables \"Wake for network access.\"","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower_wake on lan_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower_wake on lan_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower_wake on modem ring","displayName":"Wake On Modem Ring","description":"If true, enables \"Wake for modem ring.\"","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower_wake on modem ring_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.portable.acpower_wake on modem ring_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower","displayName":"Laptop Battery Power","description":"The settings for a laptop computer using battery power.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower_automatic restart on power loss","displayName":"Automatic Restart On Power Loss","description":"If true, enables \"Start up automatically after a power failure.\"","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower_automatic restart on power loss_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower_automatic restart on power loss_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower_disk sleep timer","displayName":"Disk Sleep Timer","description":"The disk sleep time, in minutes. A value of 0 means never.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower_display sleep timer","displayName":"Display Sleep Timer","description":"The display sleep time, in minutes. A value of 0 means never.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower_dynamic power step","displayName":"Dynamic Power Step","description":"May not be available on all systems.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower_dynamic power step_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower_dynamic power step_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower_reduce processor speed","displayName":"Reduce Processor Speed","description":"May not be available on all systems.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower_reduce processor speed_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower_reduce processor speed_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower_system sleep timer","displayName":"System Sleep Timer","description":"System sleep time, in minutes. A value of 0 means never.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower_wake on lan","displayName":"Wake on LAN","description":"If true, enables \"Wake for network access.\"","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower_wake on lan_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower_wake on lan_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower_wake on modem ring","displayName":"Wake On Modem Ring","description":"If true, enables \"Wake for modem ring.\"","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower_wake on modem ring_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_com.apple.energysaver.portable.batterypower_wake on modem ring_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_com.apple.mcx-accounts","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.mcx-energysaver","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.mcx-fdefilevaultoptions","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.mcx-mobileaccounts","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_com.apple.mcx-timeserver","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_destroyfvkeyonstandby","displayName":"Destroy FV Key On Standby","description":"If true, prevents the OS from storing a temporary FileVault key in SMC or RAM for standby.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_destroyfvkeyonstandby_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_destroyfvkeyonstandby_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_disableguestaccount","displayName":"Disable Guest Account","description":"If true, disables the guest account. This property has no effect if Enable Guest Account is true.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_disableguestaccount_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_disableguestaccount_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_dontallowfdedisable","displayName":"Prevent FileVault From Being Disabled","description":"Set to true to prevent FileVault from being disabled.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_dontallowfdedisable_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_dontallowfdedisable_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_dontallowfdeenable","displayName":"Prevent FileVault From Being Enabled","description":"Set to true to prevent FileVault from being enabled.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_dontallowfdeenable_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_dontallowfdeenable_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_enableguestaccount","displayName":"Enable Guest Account","description":"If true, enables the guest account.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_enableguestaccount_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_enableguestaccount_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_sleepdisabled","displayName":"Sleep Disabled","description":"If true, disables sleep.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx_sleepdisabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx_sleepdisabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx_timeserver","displayName":"Time Server","description":"The NTP server to connect to. Use commas to separate multiple time servers.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx_timezone","displayName":"Time Zone","description":"The time zone path location string in /usr/share/zoneinfo/; for example, America/Denver or Zulu. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx.filevault2_com.apple.mcx.filevault2","displayName":"Top Level Setting Group Collection","description":"com.apple.MCX.FileVault2","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx.filevault2_defer","displayName":"Defer","description":"If true, defers enabling FileVault until the designated user logs out. For details, see fdesetup(8). The person enabling FileVault must be either a local user or a mobile account user.","helpText":null,"infoUrls":[],"options":{"id":"com.apple.mcx.filevault2_defer_true","displayName":"Enabled","description":null,"helpText":null}},{"id":"com.apple.mcx.filevault2_deferdontaskatuserlogout","displayName":"Defer Dont Ask At User Logout","description":"If true, prevents requests for enabling FileVault at user logout time.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx.filevault2_deferdontaskatuserlogout_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.mcx.filevault2_deferdontaskatuserlogout_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.mcx.filevault2_deferforceatuserloginmaxbypassattempts","displayName":"Defer Force At User Login Max Bypass Attempts","description":"The maximum number of times users can bypass enabling FileVault before being required to enable it to log in. If the value is 0, the user will be required to enabled FileVault the next time they attempt to log in. Setting this key to –1 disables the feature.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx.filevault2_enable","displayName":"Enable","description":"If true, enables FileVault.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx.filevault2_enable_0","displayName":"On","description":null,"helpText":null},{"id":"com.apple.mcx.filevault2_enable_1","displayName":"Off","description":null,"helpText":null}]},{"id":"com.apple.mcx.filevault2_forceenableinsetupassistant","displayName":"Force Enable In Setup Assistant","description":"If 'true', and installation of this payload occurs after enrolling with MDM in Setup Assistant, the system requests Setup Assistant to enable FileVault at setup time. In this case, the system also ignores all other keys in this payload, except for 'ShowRecoveryKey'.\nTo use this, enable the Await Device Configured DEP configuration option and send this profile with this key set, before sending the DeviceConfiguredCommand. An admin SecureToken user is required, otherwise the FileVault pane does not appear.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx.filevault2_forceenableinsetupassistant_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx.filevault2_forceenableinsetupassistant_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx.filevault2_outputpath","displayName":"Output Path","description":"The path to the location where the recovery key and computer information property list are stored.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx.filevault2_password","displayName":"Password","description":"The password of the Open Directory user to be added to FileVault. Use the 'UserEntersMissingInfo' key if you want to prompt for this information.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx.filevault2_recoverykeyrotationinmonths","displayName":"Recovery Key Rotation In Months","description":"The frequency to rotate the recovery key, in months","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx.filevault2_recoverykeyrotationinmonths_0","displayName":"Not configured","description":null,"helpText":null},{"id":"com.apple.mcx.filevault2_recoverykeyrotationinmonths_1","displayName":"1 month","description":null,"helpText":null},{"id":"com.apple.mcx.filevault2_recoverykeyrotationinmonths_2","displayName":"2 months","description":null,"helpText":null},{"id":"com.apple.mcx.filevault2_recoverykeyrotationinmonths_3","displayName":"3 months","description":null,"helpText":null},{"id":"com.apple.mcx.filevault2_recoverykeyrotationinmonths_4","displayName":"4 months","description":null,"helpText":null},{"id":"com.apple.mcx.filevault2_recoverykeyrotationinmonths_5","displayName":"5 months","description":null,"helpText":null},{"id":"com.apple.mcx.filevault2_recoverykeyrotationinmonths_6","displayName":"6 months","description":null,"helpText":null},{"id":"com.apple.mcx.filevault2_recoverykeyrotationinmonths_7","displayName":"7 months","description":null,"helpText":null},{"id":"com.apple.mcx.filevault2_recoverykeyrotationinmonths_8","displayName":"8 months","description":null,"helpText":null},{"id":"com.apple.mcx.filevault2_recoverykeyrotationinmonths_9","displayName":"9 months","description":null,"helpText":null},{"id":"com.apple.mcx.filevault2_recoverykeyrotationinmonths_10","displayName":"10 months","description":null,"helpText":null},{"id":"com.apple.mcx.filevault2_recoverykeyrotationinmonths_11","displayName":"11 months","description":null,"helpText":null},{"id":"com.apple.mcx.filevault2_recoverykeyrotationinmonths_12","displayName":"12 months","description":null,"helpText":null}]},{"id":"com.apple.mcx.filevault2_showrecoverykey","displayName":"Show Recovery Key","description":"If false, prevents display of the personal recovery key to the user after FileVault is enabled.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx.filevault2_showrecoverykey_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.mcx.filevault2_showrecoverykey_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.mcx.filevault2_usekeychain","displayName":"Use Keychain","description":"If 'true' and no certificate information is provided in this payload, the keychain created at '/Library/Keychains/FileVaultMaster.keychain' is used when the institutional recovery key is added.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx.filevault2_usekeychain_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.mcx.filevault2_usekeychain_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.mcx.filevault2_userecoverykey","displayName":"Use Recovery Key","description":"If true, creates a personal recovery key and displays it to the user.","helpText":null,"infoUrls":[],"options":{"id":"com.apple.mcx.filevault2_userecoverykey_true","displayName":"Enabled","description":null,"helpText":null}},{"id":"com.apple.mcx.filevault2_userentersmissinginfo","displayName":"User Enters Missing Info","description":"If true, enables a prompt for missing user name or password fields.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx.filevault2_userentersmissinginfo_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx.filevault2_userentersmissinginfo_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx.filevault2_username","displayName":"Username","description":"The user name of the Open Directory user to be added to FileVault.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx.timemachine_autobackup","displayName":"Auto Backup","description":"If true, performs automatic backups at regular intervals.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx.timemachine_autobackup_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx.timemachine_autobackup_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx.timemachine_backupallvolumes","displayName":"Backup All Volumes","description":"If true, backs up only the startup volume by default.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx.timemachine_backupallvolumes_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx.timemachine_backupallvolumes_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx.timemachine_backupdesturl","displayName":"Backup Destination URL","description":"The URL of the backup destination.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx.timemachine_backupsizemb","displayName":"Backup Size MB","description":"The backup size limit, in megabytes. Set to 0 for unlimited.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx.timemachine_backupskipsys","displayName":"Backup Skip System","description":"If true, skips system files and folders by default.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx.timemachine_backupskipsys_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx.timemachine_backupskipsys_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx.timemachine_basepaths","displayName":"Base Paths","description":"The list of paths to back up besides the startup volume.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx.timemachine_com.apple.mcx.timemachine","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcx.timemachine_mobilebackups","displayName":"Mobile Backups","description":"If true, create local backup snapshots when not connected to the network.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcx.timemachine_mobilebackups_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcx.timemachine_mobilebackups_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcx.timemachine_skippaths","displayName":"Skip Paths","description":"The path to skip from start volume.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcxmenuextras_airport.menu","displayName":"AirPort","description":"If true, enables the AirPort menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_airport.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_airport.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_battery.menu","displayName":"Battery","description":"If true, enables the Battery menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_battery.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_battery.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_bluetooth.menu","displayName":"Bluetooth","description":"If true, enables the Bluetooth menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_bluetooth.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_bluetooth.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_clock.menu","displayName":"Clock","description":"If true, enables the Clock menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_clock.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_clock.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_com.apple.mcxmenuextras","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcxmenuextras_cpu.menu","displayName":"CPU","description":"If true, enables the CPU menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_cpu.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_cpu.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_delayseconds","displayName":"Delay Seconds","description":"The number of seconds to delay after login before adding or removing menu extras. If the delay is too short, the menu extras don't appear, or disappear from the menu bar.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcxmenuextras_displays.menu","displayName":"Displays","description":"If true, enables the Displays menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_displays.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_displays.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_eject.menu","displayName":"Eject","description":"If true, enables the Eject menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_eject.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_eject.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_fax.menu","displayName":"Fax","description":"If true, enables the Fax menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_fax.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_fax.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_homesync.menu","displayName":"HomeSync","description":"If true, enables the HomeSync menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_homesync.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_homesync.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_ichat.menu","displayName":"iChat","description":"If true, enables the iChat menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_ichat.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_ichat.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_ink.menu","displayName":"Ink","description":"If true, enables the Ink menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_ink.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_ink.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_irda.menu","displayName":"IrDA","description":"If true, enables the IrDA menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_irda.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_irda.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_maxwaitseconds","displayName":"Max Wait Seconds","description":"The maximum wait, in seconds, for all menu extras to be added or removed.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcxmenuextras_pccard.menu","displayName":"PCCard","description":"If true, enables the PCCard menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_pccard.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_pccard.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_ppp.menu","displayName":"PPP","description":"If true, enables the PPP menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_ppp.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_ppp.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_pppoe.menu","displayName":"PPPoE","description":"If true, enables the PPPoE menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_pppoe.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_pppoe.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_remotedesktop.menu","displayName":"Remote Desktop","description":"If true, enables the Remote Desktop menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_remotedesktop.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_remotedesktop.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_script menu.menu","displayName":"Script Menu","description":"If true, enables the Script menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_script menu.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_script menu.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_spaces.menu","displayName":"Spaces","description":"If true, enables the Spaces menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_spaces.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_spaces.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_sync.menu","displayName":"Sync","description":"If true, enables the Sync menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_sync.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_sync.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_textinput.menu","displayName":"Text Input","description":"If true, enables the Text Input menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_textinput.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_textinput.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_timemachine.menu","displayName":"TimeMachine","description":"If true, enables the TimeMachine menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_timemachine.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_timemachine.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_universalaccess.menu","displayName":"Universal Access","description":"If true, enables the Universal Access menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_universalaccess.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_universalaccess.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_user.menu","displayName":"User","description":"If true, enables the User menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_user.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_user.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_volume.menu","displayName":"Volume","description":"If true, enables the Volume menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_volume.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_volume.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_vpn.menu","displayName":"VPN","description":"If true, enables the VPN menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_vpn.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_vpn.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxmenuextras_wwan.menu","displayName":"WWAN","description":"If true, enables the WWAN menu extra.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxmenuextras_wwan.menu_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxmenuextras_wwan.menu_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxprinting_allowlocalprinters","displayName":"Allow Local Printers","description":"If true, allows printers that connect directly to a user's computer.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxprinting_allowlocalprinters_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxprinting_allowlocalprinters_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxprinting_com.apple.mcxprinting","displayName":"Top Level Setting Group Collection","description":"com.apple.mcxprinting","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcxprinting_defaultprinter","displayName":"Default Printer","description":"The default printer for the user.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcxprinting_defaultprinter_deviceuri","displayName":"Device URI","description":"The device URI.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcxprinting_defaultprinter_displayname","displayName":"Display Name","description":"The display name.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcxprinting_footerfontname","displayName":"Footer Font Name","description":"The footer font name.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcxprinting_footerfontsize","displayName":"Footer Font Size","description":"The footer font size.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcxprinting_printfooter","displayName":"Print Footer","description":"If true, prints the page footer (including the user name and date).","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxprinting_printfooter_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxprinting_printfooter_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxprinting_printmacaddress","displayName":"Print MAC Address","description":"If true, includes the MAC address.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxprinting_printmacaddress_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxprinting_printmacaddress_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxprinting_requireadmintoaddprinters","displayName":"Require Admin To Add Printers","description":"If true, requires an administrator password to add printers.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxprinting_requireadmintoaddprinters_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxprinting_requireadmintoaddprinters_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxprinting_requireadmintoprintlocally","displayName":"Require Admin To Print Locally","description":"If true, requires an administrator password to print locally.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxprinting_requireadmintoprintlocally_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxprinting_requireadmintoprintlocally_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxprinting_showonlymanagedprinters","displayName":"Show Only Managed Printers","description":"If true, shows only managed printers.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxprinting_showonlymanagedprinters_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxprinting_showonlymanagedprinters_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mcxprinting_userprinterlist","displayName":"User Printer List","description":"The printers available to a user.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcxprinting_userprinterlist_printer","displayName":"Printer","description":"A dictionary of printer details.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcxprinting_userprinterlist_printer_deviceuri","displayName":"Device URI","description":"The device URI.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcxprinting_userprinterlist_printer_displayname","displayName":"Display Name","description":"The display name.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcxprinting_userprinterlist_printer_location","displayName":"Location","description":"The printer's location.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcxprinting_userprinterlist_printer_model","displayName":"Model","description":"The printer's model.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcxprinting_userprinterlist_printer_ppdurl","displayName":"PPD URL","description":"The printer's PPDURL.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mcxprinting_userprinterlist_printer_printerlocked","displayName":"Printer Locked","description":"If true, locks the printer.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mcxprinting_userprinterlist_printer_printerlocked_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mcxprinting_userprinterlist_printer_printerlocked_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mobiledevice.passwordpolicy_allowsimple","displayName":"Allow Simple Passcode","description":"If true, allows a simple passcode. A simple passcode contains repeated characters, or increasing or decreasing characters (such as 123 or CBA). Setting this value to false has the same result as setting Min Complex Characters to 1.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mobiledevice.passwordpolicy_allowsimple_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mobiledevice.passwordpolicy_allowsimple_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mobiledevice.passwordpolicy_changeatnextauth","displayName":"Change At Next Auth","description":"If true, causes a password reset to occur the next time the user tries to authenticate. If this key is set in a device profile, the setting takes effect for all users, and admin authentications may fail until the admin user password is also reset. Available in macOS 10.13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mobiledevice.passwordpolicy_changeatnextauth_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mobiledevice.passwordpolicy_changeatnextauth_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mobiledevice.passwordpolicy_com.apple.mobiledevice.passwordpolicy","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mobiledevice.passwordpolicy_customregex","displayName":"Custom Regex","description":"Specifies a regular expression, and its description, used to enforce password compliance. Use the simpler passcode restrictions whenever possible, and rely on regular expression matching only when necessary. Mistakes in regular expressions can lead to frustrating user experiences, such as unsatisfiable passcode policies, or policy descriptions that don't match the enforced policy.\n\nAvailable in macOS 14 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mobiledevice.passwordpolicy_customregex_passwordcontentdescription","displayName":"Password Content Description","description":"Contains a dictionary of keys for supported OS language IDs (for example, \"en-US\"), and whose values represent a localized description of the policy enforced by the regular expression. Use the special `default` key can for languages that aren't contained in the dictionary.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mobiledevice.passwordpolicy_customregex_passwordcontentdescription_generickey","displayName":"Description","description":"A localized description.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mobiledevice.passwordpolicy_customregex_passwordcontentdescription_generickey_keytobereplaced","displayName":"Password Content Description","description":"Contains a dictionary of keys for supported OS language IDs (for example, \"en-US\"), and whose values represent a localized description of the policy enforced by the regular expression. Use the special `default` key can for languages that aren't contained in the dictionary.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mobiledevice.passwordpolicy_customregex_passwordcontentregex","displayName":"Password Content Regex","description":"A regular expression string that they system matches against the password to determine whether it complies with a policy. The regular expression uses the ICU syntax (). The string must not exceed 2048 characters in length.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mobiledevice.passwordpolicy_forcepin","displayName":"Force PIN","description":"If true, forces the user to enter a PIN.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mobiledevice.passwordpolicy_forcepin_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mobiledevice.passwordpolicy_forcepin_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.mobiledevice.passwordpolicy_maxfailedattempts","displayName":"Max Failed Attempts","description":"The number of allowed failed attempts to enter the passcode at the device's lock screen. After six failed attempts, a time delay is imposed before a passcode can be entered again. The delay increases with each attempt. In macOS, set Minutes Until Failed Login Reset to define a delay before the next passcode can be entered. When this number is exceeded in macOS, the device is locked; in iOS, the device is wiped.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mobiledevice.passwordpolicy_maxgraceperiod","displayName":"Max Grace Period","description":"The maximum grace period, in minutes, to unlock the phone without entering a passcode. The default is 0, which is no grace period and requires a passcode immediately. In macOS, this grace period value is translated to screen-saver settings.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mobiledevice.passwordpolicy_maxinactivity","displayName":"Max Inactivity","description":"The maximum number of minutes for which the device can be idle, without being unlocked by the user, before it gets locked by the system. When this limit is reached, the device is locked and the passcode must be entered. The user can edit this setting, but the value cannot exceed the Max Inactivity value. In macOS, this inactivity value is translated to screen-saver settings.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mobiledevice.passwordpolicy_maxpinageindays","displayName":"Max PIN Age In Days","description":"The number of days for which the passcode can remain unchanged. After this number of days, the user is forced to change the passcode before the device is unlocked.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mobiledevice.passwordpolicy_mincomplexchars","displayName":"Min Complex Characters","description":"The minimum number of complex characters that a passcode must contain. A complex character is a character other than a number or a letter, such as & % $ #. This property is ignored for User Enrollments.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mobiledevice.passwordpolicy_minlength","displayName":"Min Length","description":"The minimum overall length of the passcode. This parameter is independent of the also optional Min Complex Characters argument.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mobiledevice.passwordpolicy_minutesuntilfailedloginreset","displayName":"Minutes Until Failed Login Reset","description":"The number of minutes before the login is reset after the maximum number of unsuccessful login attempts is reached. This key requires setting Max Failed Attempts. Available in macOS 10.10 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mobiledevice.passwordpolicy_pinhistory","displayName":"PIN History","description":"This value defines N, where the new passcode must be unique within the last N entries in the passcode history. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.mobiledevice.passwordpolicy_requirealphanumeric","displayName":"Require Alphanumeric Passcode","description":"If true, requires alphabetic characters (abcd) instead of only numeric characters.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.mobiledevice.passwordpolicy_requirealphanumeric_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.mobiledevice.passwordpolicy_requirealphanumeric_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.networkusagerules_applicationrules","displayName":"Application Rules","description":"An array of application rules, that apply to only managed apps.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.networkusagerules_applicationrules_item_allowcellulardata","displayName":"Allow Cellular Data","description":"If false, disables cellular data for all matching managed apps.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.networkusagerules_applicationrules_item_allowcellulardata_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.networkusagerules_applicationrules_item_allowcellulardata_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.networkusagerules_applicationrules_item_allowroamingcellulardata","displayName":"Allow Roaming Cellular Data","description":"If false, disables cellular data while roaming for all matching managed apps.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.networkusagerules_applicationrules_item_allowroamingcellulardata_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.networkusagerules_applicationrules_item_allowroamingcellulardata_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.networkusagerules_applicationrules_item_appidentifiermatches","displayName":"App Identifier Matches","description":"A list of managed app identifiers, as strings, that must follow the associated rules. If this key is missing, the rules apply to all managed apps on the device. Each string in the AppIdentifierMatches array may either be an exact app identifier match (for example, com.mycompany.myapp) or it may specify a prefix match for the bundle ID by using the * wildcard character. If used, this character must appear after a period (.) and may only appear once, at the end of the string; for example, com.mycompany.*.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.networkusagerules_com.apple.networkusagerules","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.networkusagerules_simrules","displayName":"SIM Rules","description":"An array of SIM rules, that apply to all apps.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.networkusagerules_simrules_item_iccids","displayName":"ICCI Ds","description":"One or more ICCIDs of SIM cards for which the `WiFiAssistPolicy` applies. All ICCIDs in all installed Network Usage Rules payloads must be unique. An example ICCID is `89310410106543789301`.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.networkusagerules_simrules_item_wifiassistpolicy","displayName":"Wi Fi Assist Policy","description":"The Wi-Fi Assist policy to apply to the SIM cards specified in the ICCIDs. See About Wi-Fi Assist to learn more.\n* '2': Use the default system policy for the specified SIM card(s).\n* '3': Make Wi-Fi Assist switch more aggressively from a poor Wi-Fi connection to cellular data for the specified SIM card(s). This setting may increase cellular data use and may impact battery life.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.networkusagerules_simrules_item_wifiassistpolicy_0","displayName":"2","description":null,"helpText":null},{"id":"com.apple.networkusagerules_simrules_item_wifiassistpolicy_1","displayName":"3","description":null,"helpText":null}]},{"id":"com.apple.notificationsettings_com.apple.notificationsettings","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.notificationsettings_notificationsettings","displayName":"Notification Settings","description":"An array of notification settings dictionaries.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.notificationsettings_notificationsettings_item_alerttype","displayName":"Alert Type","description":"The type of alert for notifications for this app. Available in iOS 9.3 and later and macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.notificationsettings_notificationsettings_item_alerttype_0","displayName":"None","description":null,"helpText":null},{"id":"com.apple.notificationsettings_notificationsettings_item_alerttype_1","displayName":"Temporary Banner","description":null,"helpText":null},{"id":"com.apple.notificationsettings_notificationsettings_item_alerttype_2","displayName":"Persistent Banner","description":null,"helpText":null}]},{"id":"com.apple.notificationsettings_notificationsettings_item_badgesenabled","displayName":"Badges Enabled","description":"If true, enables badges for this app. Available in iOS 9.3 and later and macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.notificationsettings_notificationsettings_item_badgesenabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.notificationsettings_notificationsettings_item_badgesenabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.notificationsettings_notificationsettings_item_bundleidentifier","displayName":"Bundle Identifier","description":"The bundle identifier of the app to which to apply these notification settings. Available in iOS 9.3 and later and macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.notificationsettings_notificationsettings_item_criticalalertenabled","displayName":"Critical Alert Enabled","description":"If true, enables critical alerts that can ignore Do Not Disturb and ringer settings for this app. Available in iOS 12 and later and macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.notificationsettings_notificationsettings_item_criticalalertenabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.notificationsettings_notificationsettings_item_criticalalertenabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.notificationsettings_notificationsettings_item_groupingtype","displayName":"Grouping Type","description":"The type of grouping for notifications for this app. Available in iOS 12 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.notificationsettings_notificationsettings_item_groupingtype_0","displayName":"Automatic: Group notifications into app-specified groups","description":null,"helpText":null},{"id":"com.apple.notificationsettings_notificationsettings_item_groupingtype_1","displayName":"By app: Group notifications into one group","description":null,"helpText":null},{"id":"com.apple.notificationsettings_notificationsettings_item_groupingtype_2","displayName":"Off: Don't group notifications","description":null,"helpText":null}]},{"id":"com.apple.notificationsettings_notificationsettings_item_notificationsenabled","displayName":"Notifications Enabled","description":"If true, enables notifications for this app. Available in iOS 9.3 and later and macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.notificationsettings_notificationsettings_item_notificationsenabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.notificationsettings_notificationsettings_item_notificationsenabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.notificationsettings_notificationsettings_item_previewtype","displayName":"Preview Type","description":"The type previews for notifications. This key overrides the value at Settings>Notifications>Show Previews. Available in iOS 14 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.notificationsettings_notificationsettings_item_previewtype_0","displayName":"Always: Previews will be shown when the device is locked and unlocked","description":null,"helpText":null},{"id":"com.apple.notificationsettings_notificationsettings_item_previewtype_1","displayName":"When Unlocked: Previews will only be shown when the device is unlocked","description":null,"helpText":null},{"id":"com.apple.notificationsettings_notificationsettings_item_previewtype_2","displayName":"Never: Previews will never be shown","description":null,"helpText":null}]},{"id":"com.apple.notificationsettings_notificationsettings_item_showincarplay","displayName":"Show In Car Play","description":"If true, enables notifications in CarPlay for this app. Available in iOS 12 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.notificationsettings_notificationsettings_item_showincarplay_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.notificationsettings_notificationsettings_item_showincarplay_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.notificationsettings_notificationsettings_item_showinlockscreen","displayName":"Show In Lock Screen","description":"If true, enables notifications on the lock screen for this app. Available in iOS 9.3 and later and macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.notificationsettings_notificationsettings_item_showinlockscreen_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.notificationsettings_notificationsettings_item_showinlockscreen_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.notificationsettings_notificationsettings_item_showinnotificationcenter","displayName":"Show In Notification Center","description":"If true, enables notifications in the notification center for this app. Available in iOS 9.3 and later and macOS 10.15 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.notificationsettings_notificationsettings_item_showinnotificationcenter_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.notificationsettings_notificationsettings_item_showinnotificationcenter_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.notificationsettings_notificationsettings_item_soundsenabled","displayName":"Sounds Enabled","description":"If true, enables sounds for this app.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.notificationsettings_notificationsettings_item_soundsenabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.notificationsettings_notificationsettings_item_soundsenabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.nsextension_allowedextensions","displayName":"Allowed Extensions","description":"An array of identifiers for extensions that are allowed to run on the system.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.nsextension_com.apple.nsextension","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.nsextension_deniedextensionpoints","displayName":"Denied Extension Points","description":"An array of extension points for extensions that aren't allowed to run on the system.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.nsextension_deniedextensions","displayName":"Denied Extensions","description":"An array of identifiers for extensions that aren't allowed to run on the system.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.preference.security_com.apple.preference.security","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.preference.security_dontallowfirewallui","displayName":"Do Not Allow Firewall UI","description":"If true, disables user changes to the firewall settings.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.preference.security_dontallowfirewallui_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.preference.security_dontallowfirewallui_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.preference.security_dontallowlockmessageui","displayName":"Do Not Allow Lock Message UI","description":"If true, disables user changes to the lock message. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.preference.security_dontallowlockmessageui_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.preference.security_dontallowlockmessageui_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.preference.security_dontallowpasswordresetui","displayName":"Do Not Allow Password Reset UI","description":"If true, disables user changes to the password.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.preference.security_dontallowpasswordresetui_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.preference.security_dontallowpasswordresetui_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.preference.users_com.apple.preference.users","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.preference.users_disableusingicloudpassword","displayName":"Disable Using iCloud Password","description":"If true, disables the iCloud password for local accounts.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.preference.users_disableusingicloudpassword_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.preference.users_disableusingicloudpassword_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.profileremovalpassword_com.apple.profileremovalpassword","displayName":"Top Level Setting Group Collection","description":"com.apple.profileRemovalPassword","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.profileremovalpassword_removalpassword","displayName":"Removal Password","description":"The password for allowing the profile to be removed.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.proxy.http.global_com.apple.proxy.http.global","displayName":"Top Level Setting Group Collection","description":"com.apple.proxy.http.global","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.proxy.http.global_proxycaptiveloginallowed","displayName":"Proxy Captive Login Allowed","description":"If true, allows the device to bypass the proxy server to display the login page for captive networks.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.proxy.http.global_proxycaptiveloginallowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.proxy.http.global_proxycaptiveloginallowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.proxy.http.global_proxypacfallbackallowed","displayName":"Proxy PAC Fallback Allowed","description":"If true, allows connecting directly to the destination if the proxy autoconfiguration (PAC) file is unreachable. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.proxy.http.global_proxypacfallbackallowed_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.proxy.http.global_proxypacfallbackallowed_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.proxy.http.global_proxypacurl","displayName":"Proxy PAC URL","description":"The URL of the PAC file that defines the proxy configuration. Starting in iOS 13 and macOS 10.15, only URLs that begin with http:// or https:// are allowed.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.proxy.http.global_proxypassword","displayName":"Proxy Password","description":"The password used to authenticate to the proxy server.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.proxy.http.global_proxyserver","displayName":"Proxy Server","description":"The proxy server's network address.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.proxy.http.global_proxyserverport","displayName":"Proxy Server Port","description":"The proxy server's port number.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.proxy.http.global_proxytype","displayName":"Proxy Type","description":"The proxy type. For a manual proxy type, the profile contains the proxy server address, including its port, and optionally a user name and password. For an auto proxy type, you can enter a PAC URL.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.proxy.http.global_proxytype_0","displayName":"Manual","description":null,"helpText":null},{"id":"com.apple.proxy.http.global_proxytype_1","displayName":"Auto","description":null,"helpText":null}]},{"id":"com.apple.proxy.http.global_proxyusername","displayName":"Proxy Username","description":"The user name used to authenticate to the proxy server.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.screensaver_askforpassword","displayName":"Ask For Password","description":"If true, the user is prompted for a password when the screen saver is unlocked or stopped. When you use this prompt, you must also provide Ask For Password Delay. Available in macOS 10.13 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.screensaver_askforpassword_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.screensaver_askforpassword_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.screensaver_askforpassworddelay","displayName":"Ask For Password Delay","description":"The number of seconds to delay before the password will be required to unlock or stop the screen saver (the grace period). A value of 2147483647 (for example, 0x7FFFFFFF) disables this requirement. To use this option, you must set Ask For Password to true. Available in macOS 10.13 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.screensaver_com.apple.screensaver","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.screensaver_loginwindowidletime","displayName":"Login Window Idle Time","description":"The number of seconds of inactivity before the screen saver activates (0 = Never activate). ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.screensaver_loginwindowmodulepath","displayName":"Login Window Module Path","description":"The full path to the screen-saver module to use. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.screensaver_modulename","displayName":"Module Name","description":"The name of the screen saver module.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.screensaver.user_com.apple.screensaver.user","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.screensaver.user_idletime","displayName":"Idle Time","description":"The number of seconds of inactivity before the screen saver activates (0 = Never activate).","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.screensaver.user_modulename","displayName":"Module Name","description":"The module name.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.screensaver.user_modulepath","displayName":"Module Path","description":"A full path to the screen saver module to use.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.security.fderecoverykeyescrow_com.apple.security.fderecoverykeyescrow","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.security.fderecoverykeyescrow_devicekey","displayName":"Device Key","description":"The string that's included in help text if the user appears to have forgotten the password. Site admins can use this key to look up the escrowed key for the particular computer. This key replaces the Record Number key used in the previous escrow mechanism. If the key is missing, the device serial number is used instead.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.security.fderecoverykeyescrow_location","displayName":"Location","description":"The description of the location where the recovery key will be escrowed. This text will be inserted into the message the user sees when enabling FileVault.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.security.firewall_allowsigned","displayName":"Allow Signed","description":"If true, allows built-in software to receive incoming connections. Available in macOS 12.3 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.security.firewall_allowsigned_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.security.firewall_allowsigned_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.security.firewall_allowsignedapp","displayName":"Allow Signed App","description":"If true, allows downloaded signed software to receive incoming connections. Available in macOS 12.3 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.security.firewall_allowsignedapp_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.security.firewall_allowsignedapp_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.security.firewall_applications","displayName":"Applications","description":"The list of apps with connections controlled by the firewall.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.security.firewall_applications_item_allowed","displayName":"Allowed","description":"If true, allows connections for the app.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.security.firewall_applications_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.security.firewall_applications_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.security.firewall_applications_item_bundleid","displayName":"Bundle ID","description":"The bundle identifier for an app.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.security.firewall_blockallincoming","displayName":"Block All Incoming","description":"If true, enables blocking of all incoming connections. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.security.firewall_blockallincoming_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.security.firewall_blockallincoming_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.security.firewall_com.apple.security.firewall","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.security.firewall_enablefirewall","displayName":"Enable Firewall","description":"If true, enables the firewall.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.security.firewall_enablefirewall_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.security.firewall_enablefirewall_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.security.firewall_enablelogging","displayName":"Enable Logging (Deprecated)","description":"If true, enables logging. Available in macOS 12 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.security.firewall_enablelogging_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.security.firewall_enablelogging_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.security.firewall_enablestealthmode","displayName":"Enable Stealth Mode","description":"If true, enables stealth mode. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.security.firewall_enablestealthmode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.security.firewall_enablestealthmode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.security.firewall_loggingoption","displayName":"Logging Option (Deprecated)","description":"This string specifies the type of logging. Available in macOS 12 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.security.firewall_loggingoption_0","displayName":"throttled","description":null,"helpText":null},{"id":"com.apple.security.firewall_loggingoption_1","displayName":"brief","description":null,"helpText":null},{"id":"com.apple.security.firewall_loggingoption_2","displayName":"detail","description":null,"helpText":null}]},{"id":"com.apple.security.smartcard_allowsmartcard","displayName":"Allow Smart Card","description":"If false, disables the SmartCard for logins, authorizations, and screen saver unlocking. It is still allowed for other functions, such as signing emails and accessing the web. A restart is required for a setting change to take effect. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.security.smartcard_allowsmartcard_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.security.smartcard_allowsmartcard_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.security.smartcard_checkcertificatetrust","displayName":"Check Certificate Trust","description":"Disable certificate trust check: Turns off certificate trust check.\r\n\r\nEnable certificate trust check and standard validity check: Turns on certificate trust check. A standard validity check is performed but doesn't include additional revocation checks.\r\n\r\nEnable certificate trust check and soft revocation check: Turns on certificate trust check. A soft revocation check is also performed. Until the certificate is explicitly rejected by CRL/OCSP, it's considered valid. This setting means that unavailable or unreachable CRL/OCSP allow this check to succeed.\r\n\r\nEnable certificate trust check and hard revocation check: Turns on certificate trust check. A hard revocation check is also performed. Unless CRL/OCSP explicitly says \"This certificate is OK,\" it's considered invalid. This option is the most secure.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.security.smartcard_checkcertificatetrust_0","displayName":"Disable certificate trust check","description":null,"helpText":null},{"id":"com.apple.security.smartcard_checkcertificatetrust_1","displayName":"Enable certificate trust check and standard validity check","description":null,"helpText":null},{"id":"com.apple.security.smartcard_checkcertificatetrust_2","displayName":"Enable certificate trust check and soft revocation check","description":null,"helpText":null},{"id":"com.apple.security.smartcard_checkcertificatetrust_3","displayName":"Enable certificate trust check and hard revocation check","description":null,"helpText":null}]},{"id":"com.apple.security.smartcard_com.apple.security.smartcard","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.security.smartcard_enforcesmartcard","displayName":"Enforce Smart Card","description":"If true, a user can only log in or authenticate with a SmartCard. Ensure that users have a SmartCard before being targeted with this setting, or they may not be able to access the device. Available in macOS 10.13.2 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.security.smartcard_enforcesmartcard_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.security.smartcard_enforcesmartcard_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.security.smartcard_onecardperuser","displayName":"One Card Per User","description":"If true, a user can pair with only one SmartCard, although existing pairings are allowed if already set up. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.security.smartcard_onecardperuser_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.security.smartcard_onecardperuser_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.security.smartcard_tokenremovalaction","displayName":"Token Removal Action","description":"If set to Enabled, the screen saver is enabled when the SmartCard is removed. Available in macOS 10.13.4 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.security.smartcard_tokenremovalaction_0","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.security.smartcard_tokenremovalaction_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.security.smartcard_userpairing","displayName":"User Pairing","description":"If false, users don't get the pairing dialog, although existing pairings still work. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.security.smartcard_userpairing_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.security.smartcard_userpairing_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.servicemanagement_com.apple.servicemanagement","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.servicemanagement_rules","displayName":"Rules","description":"An array of rule dictionaries.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.servicemanagement_rules_item_comment","displayName":"Comment","description":"An optional description of the rule.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.servicemanagement_rules_item_ruletype","displayName":"Rule Type","description":"The type of comparision to make.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.servicemanagement_rules_item_ruletype_0","displayName":"Bundle Identifier","description":null,"helpText":null},{"id":"com.apple.servicemanagement_rules_item_ruletype_1","displayName":"Bundle Identifier Prefix","description":null,"helpText":null},{"id":"com.apple.servicemanagement_rules_item_ruletype_2","displayName":"Label","description":null,"helpText":null},{"id":"com.apple.servicemanagement_rules_item_ruletype_3","displayName":"Label Prefix","description":null,"helpText":null},{"id":"com.apple.servicemanagement_rules_item_ruletype_4","displayName":"Team Identifier","description":null,"helpText":null}]},{"id":"com.apple.servicemanagement_rules_item_rulevalue","displayName":"Rule Value","description":"The value to compare with each login item's value, to determine a match to this rule.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.servicemanagement_rules_item_teamidentifier","displayName":"Team Identifier","description":"An additional constraint to limit the scope of the rule that is tested after matching the Rule Type and Rule Value.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.shareddeviceconfiguration_assettaginformation","displayName":"Asset Tag Information","description":"The asset tag information for the device, displayed in the Login Window and Lock Screen.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.shareddeviceconfiguration_com.apple.shareddeviceconfiguration","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.shareddeviceconfiguration_lockscreenfootnote","displayName":"Lock Screen Footnote","description":"The footnote displayed in the login window and Lock screen. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.softwareupdate_allowprereleaseinstallation","displayName":"Allow Pre Release Installation (Deprecated)","description":"If true, prerelease software can be installed on this computer. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.softwareupdate_allowprereleaseinstallation_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.softwareupdate_allowprereleaseinstallation_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.softwareupdate_automaticallyinstallappupdates","displayName":"Automatically Install App Updates (Deprecated)","description":"If false, deselects the \"Install app updates from the App Store\" option and prevents the user from changing the option. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.softwareupdate_automaticallyinstallappupdates_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.softwareupdate_automaticallyinstallappupdates_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.softwareupdate_automaticallyinstallmacosupdates","displayName":"Automatically Install Mac OS Updates (Deprecated)","description":"If false, restricts the \"Install macOS Updates\" option and prevents the user from changing the option.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.softwareupdate_automaticallyinstallmacosupdates_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.softwareupdate_automaticallyinstallmacosupdates_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.softwareupdate_automaticcheckenabled","displayName":"Automatic Check Enabled (Deprecated)","description":"If false, deselects the \"Check for updates\" option and prevents the user from changing the option.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.softwareupdate_automaticcheckenabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.softwareupdate_automaticcheckenabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.softwareupdate_automaticdownload","displayName":"Automatic Download (Deprecated)","description":"If false, deselects the \"Download new updates when available from the App Store\" option and prevents the user from changing the option.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.softwareupdate_automaticdownload_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.softwareupdate_automaticdownload_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.softwareupdate_com.apple.softwareupdate","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.softwareupdate_configdatainstall","displayName":"Config Data Install (Deprecated)","description":"If false, restricts the automatic installation of configuration data.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.softwareupdate_configdatainstall_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.softwareupdate_configdatainstall_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.softwareupdate_criticalupdateinstall","displayName":"Critical Update Install (Deprecated)","description":"If false, disables the automatic installation of critical updates and prevents the user from changing the \"Install system data files and security updates\" option.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.softwareupdate_criticalupdateinstall_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.softwareupdate_criticalupdateinstall_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.softwareupdate_restrict-software-update-require-admin-to-install","displayName":"Restrict Software Update Require Admin To Install (Deprecated)","description":"If true, restrict app installations to admin users. This key has the same function as the Restrict Store Require Admin To Install key in the App Store profile. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.softwareupdate_restrict-software-update-require-admin-to-install_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.softwareupdate_restrict-software-update-require-admin-to-install_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.subscribedcalendar.account_com.apple.subscribedcalendar.account","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.subscribedcalendar.account_subcalaccountdescription","displayName":"Account Description","description":"The description of the account.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.subscribedcalendar.account_subcalaccounthostname","displayName":"Account Host Name","description":"The server’s address.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.subscribedcalendar.account_subcalaccountpassword","displayName":"Account Password","description":"The user’s password.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.subscribedcalendar.account_subcalaccountusername","displayName":"Account Username","description":"The user's username.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.subscribedcalendar.account_subcalaccountusessl","displayName":"Account Use SSL","description":"If true, enables SSL.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.subscribedcalendar.account_subcalaccountusessl_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.subscribedcalendar.account_subcalaccountusessl_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.system-extension-policy_allowedsystemextensions","displayName":"Allowed System Extensions","description":"A dictionary of approved system extensions on the computer. The dictionary maps the team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension to install. It’s an error for the same team identifier to appear in both the AllowedTeamIdentifiers array and as a key in this dictionary.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system-extension-policy_allowedsystemextensions_generickey","displayName":"Allowed System Extensions","description":"The mapping of team identifiers to arrays of bundle identifiers, where the bundle identifier is that of the system extension to be installed.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system-extension-policy_allowedsystemextensions_generickey_keytobereplaced","displayName":"Team Identifier","description":"Add a Team Identifier of valid and signed system extensions to load. The team identifier must be alphanumeric (letters and numbers) and have 10 characters. For example, enter ABCDE12345.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system-extension-policy_allowedsystemextensiontypes","displayName":"Allowed System Extension Types","description":"A dictionary that maps a team identifier to an array of strings, where each string is a type of system extension that you can install for that team identifier. The allowed extension types are DriverExtension, NetworkExtension, and EndpointSecurityExtension. If there’s no entry for a specified team identifier in the dictionary, the system allows all extension types.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system-extension-policy_allowedsystemextensiontypes_generickey","displayName":"Allowed System Extension Types","description":"The mapping of team identifier to an array of strings, where each string is a type of system extension that may be installed for that team identifier.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system-extension-policy_allowedsystemextensiontypes_generickey_keytobereplaced","displayName":"Team Identifier","description":"Add a Team Identifier of valid and signed system extensions to load. The team identifier must be alphanumeric (letters and numbers) and have 10 characters. For example, enter ABCDE12345.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system-extension-policy_allowedteamidentifiers","displayName":"Allowed Team Identifiers","description":"An array of team identifiers that defines valid, signed system extensions that are allowable to load. Approved system extensions are those signed with any of the specified team identifiers. It’s an error for the same team identifier to appear in both this array and as a key in the Allowed System Extensions dictionary.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system-extension-policy_allowuseroverrides","displayName":"Allow User Overrides","description":"If false, restricts users from approving additional system extensions that configuration profiles don’t explicitly allow.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.system-extension-policy_allowuseroverrides_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.system-extension-policy_allowuseroverrides_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.system-extension-policy_com.apple.system-extension-policy","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system-extension-policy_nonremovablefromuisystemextensions","displayName":"Non Removable From UI System Extensions","description":"A dictionary of system extensions on the computer. The dictionary maps the team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension which cannot be disabled or uninstalled from System Settings or Finder. The set of system extensions between 'RemovableSystemExtensions' and 'NonRemovableFromUISystemExtensions' are allowed to overlap.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system-extension-policy_nonremovablefromuisystemextensions_generickey","displayName":"ANY","description":"System extension bundle identifiers","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system-extension-policy_nonremovablefromuisystemextensions_generickey_keytobereplaced","displayName":"Non Removable From UI System Extensions","description":"A dictionary of system extensions on the computer. The dictionary maps the team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension which cannot be disabled or uninstalled from System Settings or Finder. The set of system extensions between 'RemovableSystemExtensions' and 'NonRemovableFromUISystemExtensions' are allowed to overlap.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system-extension-policy_nonremovablesystemextensions","displayName":"Non Removable System Extensions","description":"A dictionary of system extensions on the computer. The dictionary maps the team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension which cannot be disabled or uninstalled when SIP is enabled. It's an error for the same mapping to appear in the dictionary values corresponding to 'RemovableSystemExtensions' and 'NonRemovableSystemExtensions' keys.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system-extension-policy_nonremovablesystemextensions_generickey","displayName":"ANY","description":"System extension bundle identifiers","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system-extension-policy_nonremovablesystemextensions_generickey_keytobereplaced","displayName":"Non Removable System Extensions","description":"A dictionary of system extensions on the computer. The dictionary maps the team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension which cannot be disabled or uninstalled when SIP is enabled. It's an error for the same mapping to appear in the dictionary values corresponding to 'RemovableSystemExtensions' and 'NonRemovableSystemExtensions' keys.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system-extension-policy_removablesystemextensions","displayName":"Removable System Extensions","description":"A dictionary of system extensions that are allowed to remove themselves from the machine. The dictionary maps team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension. An application using the OSSystemExtensionDeactivationRequest API can deactivate the specified system extensions without requiring an administrator to authorize the operation. Available in macOS 12 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system-extension-policy_removablesystemextensions_generickey","displayName":"Removable System Extensions","description":"The dictionary maps team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system-extension-policy_removablesystemextensions_generickey_keytobereplaced","displayName":"Team Identifier","description":"Add a Team Identifier of valid and signed system extensions to load. The team identifier must be alphanumeric (letters and numbers) and have 10 characters. For example, enter ABCDE12345.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system.logging_com.apple.system.logging","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system.logging_system","displayName":"System","description":"This dictionary has one key, Enable Private Data. Setting that value to true enables private data logging for the entire system.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.system.logging_system_enable-private-data","displayName":"Enable Private Data","description":"Setting this value to true enables private data logging for the entire system.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.system.logging_system_enable-private-data_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.system.logging_system_enable-private-data_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.systemconfiguration_com.apple.systemconfiguration","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systemconfiguration_proxies","displayName":"Proxies","description":"The dictionary containing all the proxies for this device.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systemconfiguration_proxies_exceptionslist","displayName":"Exceptions List","description":"The list of hosts and domains that should bypass proxy settings.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systemconfiguration_proxies_fallbackallowed","displayName":"Fall Back Allowed","description":"If true, enables fallback.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.systemconfiguration_proxies_fallbackallowed_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.systemconfiguration_proxies_fallbackallowed_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.systemconfiguration_proxies_ftpenable","displayName":"FTP Enable","description":"If true, enables FTP proxy.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.systemconfiguration_proxies_ftpenable_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.systemconfiguration_proxies_ftpenable_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.systemconfiguration_proxies_ftppassive","displayName":"FTP Passive","description":"If true, enables passive FTP mode. ","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.systemconfiguration_proxies_ftppassive_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.systemconfiguration_proxies_ftppassive_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.systemconfiguration_proxies_ftpport","displayName":"FTP Port","description":"The FTP proxy port.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systemconfiguration_proxies_ftpproxy","displayName":"FTP Proxy","description":"The host name or IP address for the FTP proxy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systemconfiguration_proxies_gopherenable","displayName":"Gopher Enable","description":"If true, enables gopher proxy.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.systemconfiguration_proxies_gopherenable_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.systemconfiguration_proxies_gopherenable_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.systemconfiguration_proxies_gopherport","displayName":"Gopher Port","description":"The gopher proxy port. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systemconfiguration_proxies_gopherproxy","displayName":"Gopher Proxy","description":"The host name or IP address for the gopher proxy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systemconfiguration_proxies_httpenable","displayName":"HTTP Enable","description":"If true, enables web proxy.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.systemconfiguration_proxies_httpenable_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.systemconfiguration_proxies_httpenable_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.systemconfiguration_proxies_httpport","displayName":"HTTP Port","description":"The web proxy port.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systemconfiguration_proxies_httpproxy","displayName":"HTTP Proxy","description":"The host name or IP address for the web proxy. ","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systemconfiguration_proxies_httpsenable","displayName":"HTTPS Enable","description":"If true, enables secure web proxy.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.systemconfiguration_proxies_httpsenable_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.systemconfiguration_proxies_httpsenable_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.systemconfiguration_proxies_httpsport","displayName":"HTTPS Port","description":"The secure web proxy port.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systemconfiguration_proxies_httpsproxy","displayName":"HTTPS Proxy","description":"The host name or IP address for the secure web proxy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systemconfiguration_proxies_proxyautoconfigenable","displayName":"Proxy Auto Config Enable","description":"If true, enables automatic proxy configuration.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.systemconfiguration_proxies_proxyautoconfigenable_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.systemconfiguration_proxies_proxyautoconfigenable_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.systemconfiguration_proxies_proxyautoconfigurlstring","displayName":"Proxy Auto Config URL String","description":"The automatic proxy configuration URL.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systemconfiguration_proxies_proxycaptiveloginallowed","displayName":"Proxy Captive Login Allowed","description":"If true, allows client to log into captive portal network.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.systemconfiguration_proxies_proxycaptiveloginallowed_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.systemconfiguration_proxies_proxycaptiveloginallowed_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.systemconfiguration_proxies_rtspenable","displayName":"RTSP Enable","description":"If true, enable streaming proxy.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.systemconfiguration_proxies_rtspenable_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.systemconfiguration_proxies_rtspenable_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.systemconfiguration_proxies_rtspport","displayName":"RTSP Port","description":"The streaming proxy port.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systemconfiguration_proxies_rtspproxy","displayName":"RTSP Proxy","description":"The host name or IP address for the streaming proxy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systemconfiguration_proxies_socksenable","displayName":"SOCKS Enable","description":"If true, enable the SOCKS proxy.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.systemconfiguration_proxies_socksenable_0","displayName":"False","description":null,"helpText":null},{"id":"com.apple.systemconfiguration_proxies_socksenable_1","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.systemconfiguration_proxies_socksportinteger","displayName":"SOCKS Port Integer","description":"The SOCKS proxy port.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systemconfiguration_proxies_socksproxy","displayName":"SOCKS Proxy","description":"The host name or IP address for the SOCKS proxy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systempolicy.control_allowidentifieddevelopers","displayName":"Allow Identified Developers","description":"If true, enables Gatekeeper's \"Mac App Store and identified developers\" option.\r\nIf false, enables Gatekeeper's \"Mac App Store\" option.\r\n\r\nIf the value of Enable Assessment isn't set to true, this key has no effect.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.systempolicy.control_allowidentifieddevelopers_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.systempolicy.control_allowidentifieddevelopers_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.systempolicy.control_com.apple.systempolicy.control","displayName":"Top Level Setting Group Collection","description":"com.apple.systempolicy.control","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systempolicy.control_enableassessment","displayName":"Enable Assessment","description":"If true, enables Gatekeeper.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.systempolicy.control_enableassessment_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.systempolicy.control_enableassessment_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.systempolicy.control_enablexprotectmalwareupload","displayName":"Enable XProtect Malware Upload","description":"If false, will prevent Gatekeeper from prompting the user to upload blocked malware to Apple for purposes of improving malware detection.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.systempolicy.control_enablexprotectmalwareupload_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.systempolicy.control_enablexprotectmalwareupload_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.systempolicy.managed_com.apple.systempolicy.managed","displayName":"Top Level Setting Group Collection","description":"com.apple.systempolicy.managed","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systempolicy.managed_disableoverride","displayName":"Disable Override","description":"If true, disables the Finder's contextual menu item.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.systempolicy.managed_disableoverride_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.systempolicy.managed_disableoverride_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.systempreferences_com.apple.systempreferences","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systempreferences_disabledpreferencepanes","displayName":"Disabled Preference Panes","description":"The list of disabled System Preferences panes.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.systempreferences_enabledpreferencepanes","displayName":"Enabled Preference Panes","description":"The list of enabled System Preferences panes.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_com.apple.tcc.configuration-profile-policy","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services","displayName":"Services","description":"A dictionary whose keys are limited to the privacy policy control services. In the case of conflicting specifications, the most restrictive setting (deny) is used.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_accessibility","displayName":"Accessibility","description":"Specifies the policies for the app via the Accessibility subsystem. The ability to grant access by this profile is deprecated as of macOS 26.2, and will be removed in macOS 27.0.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_accessibility_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_accessibility_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_accessibility_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_accessibility_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_accessibility_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_accessibility_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_accessibility_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_accessibility_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_accessibility_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_accessibility_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_accessibility_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_accessibility_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_accessibility_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_accessibility_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_accessibility_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_addressbook","displayName":"Address Book","description":"Specifies the policies for contact information managed by the Contacts.app.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_addressbook_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_addressbook_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_addressbook_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_addressbook_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_addressbook_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_addressbook_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_addressbook_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_addressbook_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_addressbook_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_addressbook_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_addressbook_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_addressbook_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_addressbook_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_addressbook_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_addressbook_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents","displayName":"Apple Events","description":"Specifies the policies for the app sending restricted AppleEvents to another process.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_aereceivercoderequirement","displayName":"AE Receiver Code Requirement","description":"The code requirement for the receiving binary.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_aereceiveridentifier","displayName":"AE Receiver Identifier","description":"The identifier of the process receiving an Apple Event sent by the Identifier process.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_aereceiveridentifiertype","displayName":"AE Receiver Identifier Type","description":"The type of AE Receiver Identifier value, either bundle ID or path.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_aereceiveridentifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_aereceiveridentifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_appleevents_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways","displayName":"Bluetooth Always","description":"Specifies the policies for the app to access Bluetooth devices.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_aereceivercoderequirement","displayName":"AE Receiver Code Requirement","description":"The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_aereceiveridentifier","displayName":"AE Receiver Identifier","description":"The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_aereceiveridentifiertype","displayName":"AE Receiver Identifier Type","description":"The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_aereceiveridentifiertype_0","displayName":"bundleID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_aereceiveridentifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_allowed","displayName":"Allowed","description":"If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.\n\n> Note:\n> Every payload needs to include either `Authorization` or `Allowed`, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_allowed_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_allowed_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_authorization","displayName":"Authorization","description":"The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:\n\n- `Allow`: Equivalent to a `true` value for the `Allowed` key\n- `Deny`: Equivalent to a `false` value for the `Allowed` key\n- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services\n\n> Note:\n> Every payload needs to include either `Authorization` or `Allowed`, but not both.\n\nAvailable in macOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_authorization_2","displayName":"AllowStandardUserToSetSystemService","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command ''codesign -display -r -''.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_comment","displayName":"Comment","description":"Not used.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_identifiertype_0","displayName":"bundleID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_staticcode","displayName":"Static Code","description":"If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_staticcode_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_bluetoothalways_item_staticcode_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_calendar","displayName":"Calendar","description":"Specifies the policies for calendar information managed by the Calendar.app.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_calendar_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_calendar_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_calendar_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_calendar_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_calendar_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_calendar_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_calendar_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_calendar_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_calendar_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_calendar_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_calendar_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_calendar_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_calendar_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_calendar_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_calendar_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_camera","displayName":"Camera","description":"A system camera. Access to the camera can't be given in a profile; it can only be denied.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_camera_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_camera_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_camera_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_camera_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_camera_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_camera_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_camera_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_camera_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_camera_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_camera_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_camera_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_camera_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_camera_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_camera_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_camera_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_fileproviderpresence","displayName":"File Provider Presence","description":"Allows a File Provider application to know when the user is using files managed by the File Provider.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_fileproviderpresence_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_fileproviderpresence_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_fileproviderpresence_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_fileproviderpresence_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_fileproviderpresence_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_fileproviderpresence_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_fileproviderpresence_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_fileproviderpresence_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_fileproviderpresence_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_fileproviderpresence_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_fileproviderpresence_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_fileproviderpresence_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_fileproviderpresence_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_fileproviderpresence_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_fileproviderpresence_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_listenevent","displayName":"Listen Event","description":"Allows the application to use CoreGraphics and HID APIs to listen to (receive) CGEvents and HID events from all processes. Access to these events can't be given in a profile; it can only be denied.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_listenevent_item_allowed","displayName":"Allowed (Deprecated)","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_listenevent_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_listenevent_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_listenevent_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_listenevent_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_listenevent_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_listenevent_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_listenevent_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_listenevent_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_listenevent_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_listenevent_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_listenevent_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_listenevent_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_listenevent_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_listenevent_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_medialibrary","displayName":"Media Library","description":"Allows the application to access Apple Music, music and video activity, and the media library.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_medialibrary_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_medialibrary_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_medialibrary_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_medialibrary_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_medialibrary_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_medialibrary_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_medialibrary_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_medialibrary_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_medialibrary_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_medialibrary_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_medialibrary_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_medialibrary_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_medialibrary_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_medialibrary_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_medialibrary_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_microphone","displayName":"Microphone","description":"A system microphone. Access to the microphone can't be given in a profile; it can only be denied.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_microphone_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_microphone_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_microphone_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_microphone_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_microphone_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_microphone_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_microphone_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_microphone_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_microphone_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_microphone_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_microphone_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_microphone_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_microphone_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_microphone_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_microphone_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_photos","displayName":"Photos","description":"The pictures managed by the Photos app in `~/Pictures/.photoslibrary`.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_photos_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_photos_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_photos_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_photos_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_photos_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_photos_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_photos_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_photos_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_photos_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_photos_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_photos_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_photos_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_photos_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_photos_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_photos_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_postevent","displayName":"Post Event","description":"Specifies the policies for the application to use CoreGraphics APIs to send CGEvents to the system event stream.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_postevent_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_postevent_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_postevent_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_postevent_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_postevent_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_postevent_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_postevent_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_postevent_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_postevent_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_postevent_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_postevent_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_postevent_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_postevent_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_postevent_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_postevent_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_reminders","displayName":"Reminders","description":"Specifies the policies for reminders information managed by the Reminders app.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_reminders_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_reminders_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_reminders_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_reminders_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_reminders_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_reminders_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_reminders_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_reminders_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_reminders_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_reminders_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_reminders_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_reminders_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_reminders_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_reminders_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_reminders_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_screencapture","displayName":"Screen Capture","description":"Allows the application to capture (read) the contents of the system display. Access to the contents can't be given in a profile; it can only be denied.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_screencapture_item_allowed","displayName":"Allowed (Deprecated)","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_screencapture_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_screencapture_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_screencapture_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_screencapture_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_screencapture_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_screencapture_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_screencapture_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_screencapture_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_screencapture_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_screencapture_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_screencapture_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_screencapture_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_screencapture_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_screencapture_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_speechrecognition","displayName":"Speech Recognition","description":"Allows the application to use the system Speech Recognition facility and to send speech data to Apple.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_speechrecognition_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_speechrecognition_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_speechrecognition_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_speechrecognition_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_speechrecognition_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_speechrecognition_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_speechrecognition_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_speechrecognition_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_speechrecognition_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_speechrecognition_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_speechrecognition_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_speechrecognition_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_speechrecognition_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_speechrecognition_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_speechrecognition_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyallfiles","displayName":"System Policy All Files","description":"Allows the application access to all protected files, including system administration files.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyallfiles_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyallfiles_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyallfiles_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyallfiles_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyallfiles_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyallfiles_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyallfiles_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyallfiles_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyallfiles_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyallfiles_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyallfiles_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyallfiles_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyallfiles_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyallfiles_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyallfiles_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappbundles","displayName":"System Policy App Bundles","description":"Allows the application to update or delete other apps. Available in macOS 13 and later.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappbundles_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappbundles_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappbundles_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappbundles_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappbundles_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappbundles_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappbundles_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappbundles_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappbundles_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappbundles_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappbundles_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappbundles_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappbundles_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappbundles_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappbundles_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappdata","displayName":"System Policy App Data","description":"Specifies the policies for the app to access the data of other apps.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappdata_item_allowed","displayName":"Allowed","description":"If 'true', access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappdata_item_allowed_false","displayName":"Blocked","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappdata_item_allowed_true","displayName":"Allowed","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappdata_item_authorization","displayName":"Authorization","description":"The 'Authorization' key is an optional replacement for the 'Allowed' key. Every payload must specify either 'Authorization' or 'Allowed', but not both.\n'Allow': Equivalent to a 'true' value for the 'Allowed' key.\n'Deny': Equivalent to a 'false' value for the 'Allowed' key.\n'AllowStandardUserToSetSystemService:' allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization. 'AllowStandardUserToSetSystemService' is only valid for the 'ListenEvent' and 'ScreenCapture' services.\nAvailable in macOS 11 and later.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappdata_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappdata_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappdata_item_authorization_2","displayName":"AllowStandardUserToSetSystemService","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappdata_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command ''codesign -display -r -''.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappdata_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappdata_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappdata_item_identifiertype_0","displayName":"bundleID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappdata_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappdata_item_staticcode","displayName":"Static Code","description":"If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappdata_item_staticcode_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyappdata_item_staticcode_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydesktopfolder","displayName":"System Policy Desktop Folder","description":"Allows the application to access files in the user's Desktop folder.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydesktopfolder_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydesktopfolder_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydesktopfolder_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydesktopfolder_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydesktopfolder_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydesktopfolder_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydesktopfolder_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydesktopfolder_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydesktopfolder_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydesktopfolder_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydesktopfolder_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydesktopfolder_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydesktopfolder_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydesktopfolder_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydesktopfolder_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydocumentsfolder","displayName":"System Policy Documents Folder","description":"Allows the application to access files in the user's Documents folder.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydocumentsfolder_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydocumentsfolder_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydocumentsfolder_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydocumentsfolder_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydocumentsfolder_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydocumentsfolder_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydocumentsfolder_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydocumentsfolder_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydocumentsfolder_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydocumentsfolder_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydocumentsfolder_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydocumentsfolder_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydocumentsfolder_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydocumentsfolder_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydocumentsfolder_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydownloadsfolder","displayName":"System Policy Downloads Folder","description":"Allows the application to access files in the user's Downloads folder.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydownloadsfolder_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydownloadsfolder_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydownloadsfolder_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydownloadsfolder_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydownloadsfolder_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydownloadsfolder_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydownloadsfolder_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydownloadsfolder_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydownloadsfolder_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydownloadsfolder_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydownloadsfolder_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydownloadsfolder_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydownloadsfolder_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydownloadsfolder_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicydownloadsfolder_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicynetworkvolumes","displayName":"System Policy Network Volumes","description":"Allows the application to access files on network volumes.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicynetworkvolumes_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicynetworkvolumes_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicynetworkvolumes_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicynetworkvolumes_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicynetworkvolumes_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicynetworkvolumes_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicynetworkvolumes_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicynetworkvolumes_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicynetworkvolumes_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicynetworkvolumes_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicynetworkvolumes_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicynetworkvolumes_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicynetworkvolumes_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicynetworkvolumes_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicynetworkvolumes_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyremovablevolumes","displayName":"System Policy Removable Volumes","description":"Allows the application to access files on removable volumes.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyremovablevolumes_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyremovablevolumes_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyremovablevolumes_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyremovablevolumes_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyremovablevolumes_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyremovablevolumes_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyremovablevolumes_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyremovablevolumes_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyremovablevolumes_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyremovablevolumes_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyremovablevolumes_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyremovablevolumes_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyremovablevolumes_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyremovablevolumes_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicyremovablevolumes_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicysysadminfiles","displayName":"System Policy Sys Admin Files","description":"Allows the application access to some files used in system administration.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicysysadminfiles_item_allowed","displayName":"Allowed","description":"If true, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicysysadminfiles_item_allowed_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicysysadminfiles_item_allowed_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicysysadminfiles_item_authorization","displayName":"Authorization","description":"The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicysysadminfiles_item_authorization_0","displayName":"Allow","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicysysadminfiles_item_authorization_1","displayName":"Deny","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicysysadminfiles_item_authorization_2","displayName":"Allow Standard User To Set System Service","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicysysadminfiles_item_coderequirement","displayName":"Code Requirement","description":"Obtained via the command \"codesign –display -r -\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicysysadminfiles_item_identifier","displayName":"Identifier","description":"The bundle ID or installation path of the binary.\n\n> Note:\n> This value is case-sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicysysadminfiles_item_identifiertype","displayName":"Identifier Type","description":"The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicysysadminfiles_item_identifiertype_0","displayName":"bundle ID","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicysysadminfiles_item_identifiertype_1","displayName":"path","description":null,"helpText":null}]},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicysysadminfiles_item_staticcode","displayName":"Static Code","description":"If true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicysysadminfiles_item_staticcode_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.tcc.configuration-profile-policy_services_systempolicysysadminfiles_item_staticcode_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.universalaccess_closeviewfarpoint","displayName":"Close View Far Point","description":"The minimum zoom level in the Zoom options.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.universalaccess_closeviewhotkeysenabled","displayName":"Close View Hotkeys Enabled","description":"If true, enables \"Use keyboard shortcuts\" in the Zoom options.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.universalaccess_closeviewhotkeysenabled_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.universalaccess_closeviewhotkeysenabled_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.universalaccess_closeviewnearpoint","displayName":"Close View Near Point","description":"The maximum zoom level in the Zoom options.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.universalaccess_closeviewscrollwheeltoggle","displayName":"Close View Scroll Wheel Toggle","description":"If true, enables \"Use scroll gesture\" in the Zoom options.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.universalaccess_closeviewscrollwheeltoggle_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.universalaccess_closeviewscrollwheeltoggle_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.universalaccess_closeviewsmoothimages","displayName":"Close View Smooth Images","description":"If true, enables \"Smooth images\" in the Zoom options.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.universalaccess_closeviewsmoothimages_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.universalaccess_closeviewsmoothimages_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.universalaccess_com.apple.universalaccess","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.universalaccess_contrast","displayName":"Contrast","description":"The contrast value in the Display options.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.universalaccess_flashscreen","displayName":"Flash Screen","description":"If true, enables \"Flash the screen\" in the Audio options.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.universalaccess_flashscreen_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.universalaccess_flashscreen_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.universalaccess_mousedriver","displayName":"Mouse Driver","description":"If true, enables Mouse Keys in the Mouse & Trackpad options.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.universalaccess_mousedriver_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.universalaccess_mousedriver_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.universalaccess_mousedrivercursorsize","displayName":"Mouse Driver Cursor Size","description":"The size of the cursor.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.universalaccess_mousedriverignoretrackpad","displayName":"Mouse Driver Ignore Trackpad","description":"If true, ignores the built-in trackpad.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.universalaccess_mousedriverignoretrackpad_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.universalaccess_mousedriverignoretrackpad_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.universalaccess_mousedriverinitialdelay","displayName":"Mouse Driver Initial Delay","description":"The initial delay before moving the mouse with Mouse Keys.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.universalaccess_mousedrivermaxspeed","displayName":"Mouse Driver Max Speed","description":"The maximum speed for the cursor when using Mouse Keys.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.universalaccess_slowkey","displayName":"Slow Key","description":"If true, enables \"Slow Keys\" in the Keyboard options.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.universalaccess_slowkey_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.universalaccess_slowkey_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.universalaccess_slowkeybeepon","displayName":"Slow Key Beep On","description":"If true, enables \"click key sounds\" for Slow Keys.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.universalaccess_slowkeybeepon_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.universalaccess_slowkeybeepon_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.universalaccess_slowkeydelay","displayName":"Slow Key Delay","description":"The acceptance delay, in milliseconds, for Slow Keys.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.universalaccess_stereoasmono","displayName":"Stereo as Mono","description":"If true, plays stereo audio as mono.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.universalaccess_stereoasmono_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.universalaccess_stereoasmono_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.universalaccess_stickykey","displayName":"Sticky Key","description":"If true, enables Sticky Keys in the Keyboard options.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.universalaccess_stickykey_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.universalaccess_stickykey_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.universalaccess_stickykeybeeponmodifier","displayName":"Sticky Key Beep On Modifier","description":"If true, enables the beep when a modifier key is set for Sticky Keys.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.universalaccess_stickykeybeeponmodifier_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.universalaccess_stickykeybeeponmodifier_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.universalaccess_stickykeyshowwindow","displayName":"Sticky Key Show Window","description":"If true, enables \"Display pressed keys on screen\" for Sticky Keys.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.universalaccess_stickykeyshowwindow_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.universalaccess_stickykeyshowwindow_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.universalaccess_voiceoveronoffkey","displayName":"Voice Over On Off Key","description":"If true, enables Voice Over.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.universalaccess_voiceoveronoffkey_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.universalaccess_voiceoveronoffkey_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.universalaccess_whiteonblack","displayName":"White On Black","description":"If true, enables Invert Colors in Display Accommodations.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.universalaccess_whiteonblack_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.universalaccess_whiteonblack_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.webcontent-filter_allowlistbookmarks","displayName":"Allow List Bookmarks","description":"An array of dictionaries defining the pages that the user can visit.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.webcontent-filter_allowlistbookmarks_item_title","displayName":"Title","description":"The title of the bookmark.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.webcontent-filter_allowlistbookmarks_item_url","displayName":"URL","description":"The URL of the bookmark in the allow list.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.webcontent-filter_autofilterenabled","displayName":"Auto Filter Enabled","description":"If true, automatic filtering is in an enabled state. This function evaluates each web page as it loads and attempts to identify and block content not suitable for children. The search algorithm is complex and may vary from release to release, but it’s basically looking for adult language.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.webcontent-filter_autofilterenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.webcontent-filter_autofilterenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.webcontent-filter_com.apple.webcontent-filter","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.webcontent-filter_denylisturls","displayName":"Deny List URLs","description":"An array of URLs that are inaccessible. Limit the number of these URLs to about 500.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.webcontent-filter_filterbrowsers","displayName":"Filter Browsers","description":"If true, enables the filtering of WebKit traffic.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.webcontent-filter_filterbrowsers_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.webcontent-filter_filterbrowsers_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.webcontent-filter_filterdataproviderbundleidentifier","displayName":"Filter Data Provider Bundle Identifier","description":"The bundle identifier string of the filter data provider system extension. This string identifies the filter data provider when the filter starts running. This field is a requirement if Filter Sockets is true.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.webcontent-filter_filterdataproviderdesignatedrequirement","displayName":"Filter Data Provider Designated Requirement","description":"The designated requirement string that the system embeds in the code signature of the filter data provider system extension. This string identifies the filter data provider when the filter starts running. This field is a requirement if Filter Sockets is true.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.webcontent-filter_filtergrade","displayName":"Filter Grade","description":"This value is for deriving the relative order of content filters. Filters with a grade of firewall see network traffic before filters with a grade of inspector. The system doesn’t define the order of filters within a grade.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.webcontent-filter_filtergrade_0","displayName":"firewall","description":null,"helpText":null},{"id":"com.apple.webcontent-filter_filtergrade_1","displayName":"inspector","description":null,"helpText":null}]},{"id":"com.apple.webcontent-filter_filterpacketproviderbundleidentifier","displayName":"Filter Packet Provider Bundle Identifier","description":"The bundle identifier string of the filter packet provider system extension. This string identifies the filter packet provider when the filter starts running. This field is a requirement if Filter Packets is true.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.webcontent-filter_filterpacketproviderdesignatedrequirement","displayName":"Filter Packet Provider Designated Requirement","description":"The designated requirement string that the system embeds in the code signature of the filter packet provider system extension. This string identifies the filter packet provider when the filter starts running. This field is a requirement if Filter Packets is true.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.webcontent-filter_filterpackets","displayName":"Filter Packets","description":"If this value is true, the property enables the filtering of network packets. Either Filter Packets or Filter Sockets must be true for the filter to have an effect.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.webcontent-filter_filterpackets_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.webcontent-filter_filterpackets_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.webcontent-filter_filtersockets","displayName":"Filter Sockets","description":"If true, enables the filtering of socket traffic.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.webcontent-filter_filtersockets_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.webcontent-filter_filtersockets_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.apple.webcontent-filter_filtertype","displayName":"Filter Type","description":"The type of filter, built-in or plug-in. In macOS, the system supports only the plug-in value.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.webcontent-filter_filtertype_0","displayName":"Built-in","description":null,"helpText":null},{"id":"com.apple.webcontent-filter_filtertype_1","displayName":"Plug-in","description":null,"helpText":null}]},{"id":"com.apple.webcontent-filter_hidedenylisturls","displayName":"Hide Deny List UR Ls","description":"If `true`, the device hides the `DenyListURLs` item in the profiles that display in Settings > General > VPN & Device Management.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.webcontent-filter_hidedenylisturls_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.webcontent-filter_hidedenylisturls_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.webcontent-filter_organization","displayName":"Organization","description":"The organization string that passes to the third-party plug-in.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.webcontent-filter_password","displayName":"Password","description":"The password for the service.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.webcontent-filter_permittedurls","displayName":"Permitted URLs","description":"An array or URLs that are accessible whether or not the automatic filter allows access. The system uses this array only when Auto Filter Enabled is true. Otherwise, it ignores this field.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.webcontent-filter_pluginbundleid","displayName":"Plugin Bundle ID","description":"The bundle ID of the plug-in that provides filtering service.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.webcontent-filter_safarihistoryretentionenabled","displayName":"Safari History Retention Enabled","description":"If `true`, this payload enforces a policy which requires retention of browsing history. This causes Safari to disable clearing of browsing history, and prevents the use of private browsing mode because that mode doesn't keep browsing history.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.webcontent-filter_safarihistoryretentionenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.apple.webcontent-filter_safarihistoryretentionenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.apple.webcontent-filter_serveraddress","displayName":"Server Address","description":"The server address, which may be the IP address, hostname, or URL.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.webcontent-filter_userdefinedname","displayName":"User Defined Name","description":"The display name for this filtering configuration.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.webcontent-filter_username","displayName":"User Name","description":"The user name for the service.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.xsan_com.apple.xsan","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.xsan_fsnameservers","displayName":"FS Name Servers","description":"An array of storage area network (SAN) File System Name Server coordinators. The list should contain the same addresses in the same order as the metadata controller (MDC) /Library/Preferences/Xsan/fsnameservers file. Xsan SAN clients automatically receive updates to the fsnameservers list from the SAN configuration servers whenever this list changes. StorNext administrators should update their profile whenever the fsnameservers list changes. This key is required for StorNext SANs.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.xsan_sanauthmethod","displayName":"San Auth Method","description":"The authentication method for the SAN. This key is required for all Xsan SANs. It's optional for StorNext SANs but should be set if the StorNext SAN uses an auth_secret file. Only one value is accepted: auth_secret","helpText":null,"infoUrls":[],"options":{"id":"com.apple.xsan_sanauthmethod_0","displayName":"auth_secret","description":null,"helpText":null}},{"id":"com.apple.xsan_sanconfigurls","displayName":"San Config URLs","description":"An array of LDAP URLs where Xsan systems can obtain SAN configuration updates. This key is required for all Xsan SANs. There should be one entry for each Xsan MDC. Example URL: ldaps://mdc1.example.com:389","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.xsan_sanname","displayName":"San Name","description":"The name of the SAN. This key is required for all Xsan SANs. The name must exactly match the name of the SAN defined in the metadata server.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.xsan_sharedsecret","displayName":"Shared Secret","description":"The shared secret used for Xsan network authentication. This key is required when the San Auth Method key is present. The value should equal the content of the MDC's /Library/Preferences/Xsan/.auth_secret file.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.xsan.preferences_com.apple.xsan.preferences","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.xsan.preferences_denydlc","displayName":"Deny DLC","description":"An array of StorNext volume names. If the Xsan client is attempting to mount a volume named in this array, the client only mounts the volume if its logical units (LUNs) are available through Fibre Channel. It doesn't attempt to mount the volume using Distributed LAN Client (DLC).","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.xsan.preferences_denymount","displayName":"Deny Mount","description":"An array of Xsan or StorNext volume names. If no Only Mount array is present, the Xsan client automatically attempts to mount all SAN volumes except the volumes in this array. The system administrator can mount those volumes manually by using the xsanctl(8) mount command.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.xsan.preferences_onlymount","displayName":"Only Mount","description":"An array of Xsan or StorNext volume names. The Xsan client attempts to automatically mount these volumes at startup. The system administrator can mount additional volumes manually by using the xsanctl(8) mount command.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.xsan.preferences_preferdlc","displayName":"Prefer DLC","description":"An array of StorNext volume names. If the Xsan client is attempting to mount a volume named in this array, the Xsan client attempts to mount the volume using DLC. If DLC isn't available, the client attempts to mount the volume if its LUNs are available through Fibre Channel. The volume name must not also appear in Deny DLC.","helpText":null,"infoUrls":[],"options":null},{"id":"com.apple.xsan.preferences_usedlc","displayName":"Use DLC","description":"If true, use the DLC for all volumes.","helpText":null,"infoUrls":[],"options":[{"id":"com.apple.xsan.preferences_usedlc_false","displayName":"False","description":null,"helpText":null},{"id":"com.apple.xsan.preferences_usedlc_true","displayName":"True","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.accesscontrolallowmethodsincorspreflightspecconformant","displayName":"Make Access-Control-Allow-Methods matching in CORS preflight spec conformant","description":"This policy controls whether request methods are uppercased when matching with Access-Control-Allow-Methods response headers in CORS preflight.\n\nIf you disable this policy, request methods are uppercased. This is the behavior on or before Microsoft Edge 108.\n\nIf you enable or don't configure this policy, request methods aren't uppercased, unless matching case-insensitively with DELETE, GET, HEAD, OPTIONS, POST, or PUT.\n\nThis would reject fetch(url, {method: 'Foo'}) + \"Access-Control-Allow-Methods: FOO\" response header,\nand would accept fetch(url, {method: 'Foo'}) + \"Access-Control-Allow-Methods: Foo\" response header.\n\nNote: request methods \"post\" and \"put\" aren't affected, while \"patch\" is affected.\n\nThis policy is intended to be temporary and will be removed in the future.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.accesscontrolallowmethodsincorspreflightspecconformant_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.accesscontrolallowmethodsincorspreflightspecconformant_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.accessibilityimagelabelsenabled","displayName":"Let screen reader users get image descriptions from Microsoft","description":"Lets screen reader users get descriptions of unlabeled images on the web.\n\nIf you enable or don't configure this policy, users have the option of using an anonymous Microsoft service. This service provides automatic descriptions for unlabeled images users encounter on the web when they're using a screen reader.\n\nIf you disable this policy, users can't enable the Get Image Descriptions from Microsoft feature.\n\nWhen this feature is enabled, the content of images that need a generated description is sent to Microsoft servers to generate a description.\n\nNo cookies or other user data is sent to Microsoft, and Microsoft doesn't save or log any image content.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.accessibilityimagelabelsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.accessibilityimagelabelsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.additionalsearchboxenabled","displayName":"Enable additional search box in browser","description":"A search box is an additional text input field located next to the address bar in a web browser. It allows users to perform web searches directly from the browser interface.\n\nIf you enable or don't configure this policy, the search box will be visible and available for use.\nUsers can toggle the search box in Edge Settings page edge://settings/appearance#SearchBoxInToolbar.\n\nIf you disable this policy, search box will not be visible, and users will have to use the address bar or navigate to a search engine to perform web searches.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.additionalsearchboxenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.additionalsearchboxenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.addressbareditingenabled","displayName":"Configure address bar editing","description":"If you enable or don't configure this policy, users can change the URL in the address bar.\n\nIf you disable this policy, it prevents users from changing the URL in the address bar.\n\nNote: This policy doesn't prevent the browser from navigating to any URL. Users can still navigate to any URL by using the search option in the default New Tab Page, or using any link that leads to a web search engine. To ensure that users can only go to sites you expect, consider configuring the following policies in addition to this policy:\n\n- \"NewTabPageLocation\"\n\n- \"HomepageLocation\"\n\n- \"HomepageIsNewTabPage\"\n\n- \"URLBlocklist\" and \"URLAllowlist\" to scope the pages that browser can navigate to.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.addressbareditingenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.addressbareditingenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.addressbarmicrosoftsearchinbingproviderenabled","displayName":"Enable Microsoft Search in Bing suggestions in the address bar (Obsolete)","description":"Enables the display of relevant Microsoft Search in Bing suggestions in the address bar's suggestion list when the user enters a search query in the address bar. If you enable or don't configure this policy, users can see internal results powered by Microsoft Search in Bing in the Microsoft Edge address bar suggestion list. To access Microsoft Search in Bing results, the user must be signed in to Microsoft Edge with their organization's Azure AD account.\n\nIf you disable this policy, users won't see internal results in the Microsoft Edge address bar suggestion list.\n\nStarting with Microsoft Edge version 89, Microsoft Search in Bing suggestions will be available even if Bing isn't the user's default search provider.\n\nThis policy is no longer applicable due to changes in access to work search through Bing-related endpoints.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.addressbarmicrosoftsearchinbingproviderenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.addressbarmicrosoftsearchinbingproviderenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.addressbartrendingsuggestenabled","displayName":"Enable Microsoft Bing trending suggestions in the address bar","description":"This policy controls whether Microsoft Bing trending suggestions appear in the address bar’s suggestion dropdown when users click the address bar while on a New Tab Page.\n\nIf this policy is enabled or not configured, Microsoft Bing trending suggestions will appear in the address bar suggestion dropdown.\n\nIf this policy is disabled, Microsoft Edge will not display Microsoft Bing trending suggestions when users click the address bar.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.addressbartrendingsuggestenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.addressbartrendingsuggestenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.addressbarworksearchresultsenabled","displayName":"Enable Work Search suggestions in the address bar","description":"Enables the display of relevant workplace suggestions in the address bar’s suggestion dropdown when users type a query in the address bar.\n\nIf this policy is enabled or not configured, users can view internal work-related suggestions, such as bookmarks, files, and people results powered by Microsoft 365, in the Microsoft Edge address bar suggestion dropdown. To access these results, users must be signed into Microsoft Edge with their Entra ID account associated with that organization.\n\nIf this policy is disabled, users will not see internal workplace results in the Microsoft Edge address bar suggestion dropdown.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.addressbarworksearchresultsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.addressbarworksearchresultsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.adssettingforintrusiveadssites","displayName":"Ads setting for sites with intrusive ads","description":"Controls whether ads are blocked on sites with intrusive ads.\n\nPolicy options mapping:\n\n* AllowAds (1) = Allow ads on all sites\n\n* BlockAds (2) = Block ads on sites with intrusive ads. (Default value)\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.adssettingforintrusiveadssites_allowads","displayName":"Allow ads on all sites","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.adssettingforintrusiveadssites_blockads","displayName":"Block ads on sites with intrusive ads. (Default value)","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.adstransparencyenabled","displayName":"Configure if the ads transparency feature is enabled","description":"Lets you decide whether the ads transparency feature is enabled. This behavior only applies to the \"balanced\" mode of tracking prevention, and doesn't impact \"basic\" or \"strict\" modes. Your users' tracking prevention level can be configured using the \"TrackingPrevention\" policy. AdsTransparencyEnabled will only have an effect if \"TrackingPrevention\" is set to TrackingPreventionBalanced or isn't configured.\n\nIf you enable or don't configure this policy, transparency metadata provided by ads are available to the user when the feature is active.\n\nWhen the feature is enabled, Tracking Prevention enables exceptions for the associated ad providers that have met Microsoft's privacy standards.\n\nIf you disable this policy, Tracking Prevention won't adjust its behavior even when transparency metadata is provided by ads.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.adstransparencyenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.adstransparencyenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.aigenthemesenabled","displayName":"Enables DALL-E themes generation","description":"This policy lets you generate browser themes using DALL-E and apply them to Microsoft Edge.\n\nIf you enable or don't configure this policy, the AI generated themes will be enabled.\n\nIf you disable this policy, the AI generated themes will be disabled for your organization.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.aigenthemesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.aigenthemesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowbackforwardcacheforcachecontrolnostorepageenabled","displayName":"Allow pages with Cache-Control: no-store header to enter back/forward cache","description":"This policy controls if a page with Cache-Control: no-store header can be stored in back/forward cache. The website setting this header may not expect the page to be restored from back/forward cache since some sensitive information could still be displayed after the restoration even if it is no longer accessible.\n\nIf you enable or don't configure this policy, the page with Cache-Control: no-store header might be restored from back/forward cache unless the cache eviction is triggered (e.g. when there is HTTP-only cookie change to the site).\n\nIf you disable this policy, the page with Cache-Control: no-store header will not be stored in back/forward cache.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowbackforwardcacheforcachecontrolnostorepageenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowbackforwardcacheforcachecontrolnostorepageenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowdeletingbrowserhistory","displayName":"Enable deleting browser and download history","description":"Enables deleting browser history and download history and prevents users from changing this setting.\n\nNote that even with this policy is disabled, the browsing and download history aren't guaranteed to be retained: users can edit or delete the history database files directly, and the browser itself may remove (based on expiration period) or archive any or all history items at any time.\n\nIf you enable this policy or don't configure it, users can delete the browsing and download history.\n\nIf you disable this policy, users can't delete browsing and download history. Disabling this policy will disable history sync and open tab sync.\n\nIf you enable this policy, don't enable the \"ClearBrowsingDataOnExit\" policy, because they both deal with deleting data. If you enable both, the \"ClearBrowsingDataOnExit\" policy takes precedence and deletes all data when Microsoft Edge closes, regardless of how this policy is configured.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowdeletingbrowserhistory_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowdeletingbrowserhistory_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.alloweddomainsforapps","displayName":"Define domains allowed to access Google Workspace","description":"Setting the policy on Microsoft Edge turns on the restricted sign-in feature in Google Workspace and prevents users from changing this setting. Users can only access Google tools using accounts from the specified domains. To allow gmail or googlemail accounts, add consumer_accounts to the list of domains. This policy is based on the Chrome policy of the same name.\n\nIf you don't provide a domain name or leave this policy unset, users can access Google Workspace with any account.\n\nUsers cannot change or override this setting.\n\nNote: This policy causes the X-GoogApps-Allowed-Domains header to be appended to all HTTP and HTTPS requests to all google.com domains, as described in https://go.microsoft.com/fwlink/?linkid=2197973.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowgamesmenu","displayName":"Allow users to access the games menu (Deprecated)","description":"This policy is deprecated because it can be managed using the \"HubsSidebarEnabled\" policy.\n\nIf you enable or don't configure this policy, users can access the games menu.\n\nIf you disable this policy, users won't be able to access the games menu.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowgamesmenu_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowgamesmenu_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowpopupsduringpageunload","displayName":"Allows a page to show popups during its unloading (Obsolete)","description":"This policy allows an admin to specify that a page can show popups during its unloading.\n\nWhen the policy is set to enabled, pages are allowed to show popups while they're being unloaded.\n\nWhen the policy is set to disabled or unset, pages aren't allowed to show popups while they're being unloaded. This is as per the spec: (https://html.spec.whatwg.org/#apis-for-creating-and-navigating-browsing-contexts-by-name).\n\nThis policy was removed in Microsoft Edge 88 and is ignored if set.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowpopupsduringpageunload_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowpopupsduringpageunload_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowsurfgame","displayName":"Allow surf game","description":"If you disable this policy, users won't be able to play the surf game when the device is offline or if the user navigates to edge://surf.\n\nIf you enable or don't configure this policy, users can play the surf game.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowsurfgame_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowsurfgame_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowsyncxhrinpagedismissal","displayName":"Allow pages to send synchronous XHR requests during page dismissal (Obsolete)","description":"This policy is obsolete because it was only intended to be a short-term mechanism to give enterprises more time to update their web content if and when it was found to be incompatible with the change to disallow synchronous XHR requests during page dismissal. It doesn't work in Microsoft Edge after version 99.\n\nThis policy lets you specify that a page can send synchronous XHR requests during page dismissal.\n\nIf you enable this policy, pages can send synchronous XHR requests during page dismissal.\n\nIf you disable this policy or don't configure this policy, pages aren't allowed to send synchronous XHR requests during page dismissal.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowsyncxhrinpagedismissal_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowsyncxhrinpagedismissal_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowsystemnotifications","displayName":"Allows system notifications","description":"Lets you use system notifications instead of Microsoft Edge's embedded Message Center on Windows and Linux.\n\nIf set to True or not set, Microsoft Edge is allowed to use system notifications.\n\nIf set to False, Microsoft Edge will not use system notifications. Microsoft Edge's embedded Message Center will be used as a fallback.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowsystemnotifications_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowsystemnotifications_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowtrackingforurls","displayName":"Configure tracking prevention exceptions for specific sites","description":"Configure the list of URL patterns that are excluded from tracking prevention.\n\nIf you configure this policy, the list of configured URL patterns is excluded from tracking prevention.\n\nIf you don't configure this policy, the global default value from the \"Block tracking of users' web-browsing activity\" policy (if set) or the user's personal configuration is used for all sites.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowwebauthnwithbrokentlscerts","displayName":"Allow Web Authentication requests on sites with broken TLS certificates.","description":"If you enable this policy, Microsoft Edge will allow Web Authentication requests on websites that have TLS certificates with errors (i.e. websites considered not secure).\n\nIf you disable or don't configure this policy, the default behavior of blocking such requests will apply.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowwebauthnwithbrokentlscerts_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.allowwebauthnwithbrokentlscerts_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.alternateerrorpagesenabled","displayName":"Suggest similar pages when a webpage can't be found","description":"Allow Microsoft Edge to issue a connection to a web service to generate URL and search suggestions for connectivity issues such as DNS errors.\n\nIf you enable this policy, a web service is used to generate url and search suggestions for network errors.\n\nIf you disable this policy, no calls to the web service are made and a standard error page is shown.\n\nIf you don't configure this policy, Microsoft Edge respects the user preference that's set under Services at edge://settings/privacy.\nSpecifically, there's a **Suggest similar pages when a webpage can't be found** toggle, which the user can switch on or off. Note that if you have enable this policy (AlternateErrorPagesEnabled), the Suggest similar pages when a webpage can't be found setting is turned on, but the user can't change the setting by using the toggle. If you disable this policy, the Suggest similar pages when a webpage can't be found setting is turned off, and the user can't change the setting by using the toggle.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.alternateerrorpagesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.alternateerrorpagesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.alternateerrorpagesenabled_recommended","displayName":"Suggest similar pages when a webpage can't be found (users can override)","description":"Allow Microsoft Edge to issue a connection to a web service to generate URL and search suggestions for connectivity issues such as DNS errors.\n\nIf you enable this policy, a web service is used to generate url and search suggestions for network errors.\n\nIf you disable this policy, no calls to the web service are made and a standard error page is shown.\n\nIf you don't configure this policy, Microsoft Edge respects the user preference that's set under Services at edge://settings/privacy.\nSpecifically, there's a **Suggest similar pages when a webpage can't be found** toggle, which the user can switch on or off. Note that if you have enable this policy (AlternateErrorPagesEnabled), the Suggest similar pages when a webpage can't be found setting is turned on, but the user can't change the setting by using the toggle. If you disable this policy, the Suggest similar pages when a webpage can't be found setting is turned off, and the user can't change the setting by using the toggle.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.alternateerrorpagesenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.alternateerrorpagesenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.alwaysopenpdfexternally","displayName":"Always open PDF files externally","description":"Disables the internal PDF viewer in Microsoft Edge.\n\nIf you enable this policy Microsoft Edge treats PDF files as downloads and lets users open them with the default application.\n\nIf Microsoft Edge is the default PDF reader, PDF files aren't downloaded and will continue to open in Microsoft Edge.\n\nIf you don't configure this policy or disable it, Microsoft Edge will open PDF files (unless the user disables it).","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.alwaysopenpdfexternally_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.alwaysopenpdfexternally_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.askbeforecloseenabled","displayName":"Get user confirmation before closing a browser window with multiple tabs","description":"This policy lets you configure whether users see a confirmation dialog before closing a browser window with multiple tabs. This dialog asks users to confirm that the browser window can be closed.\n\nIf you enable this policy, users will be presented with a confirmation dialog when closing a browser window with multiple tabs.\n\nIf you disable or don't configure this policy, a browser window with multiple tabs will close immediately without user confirmation.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.askbeforecloseenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.askbeforecloseenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.askbeforecloseenabled_recommended","displayName":"Get user confirmation before closing a browser window with multiple tabs (users can override)","description":"This policy lets you configure whether users see a confirmation dialog before closing a browser window with multiple tabs. This dialog asks users to confirm that the browser window can be closed.\n\nIf you enable this policy, users will be presented with a confirmation dialog when closing a browser window with multiple tabs.\n\nIf you disable or don't configure this policy, a browser window with multiple tabs will close immediately without user confirmation.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.askbeforecloseenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.askbeforecloseenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.audiocaptureallowedurls","displayName":"Sites that can access audio capture devices without requesting permission","description":"Specify websites, based on URL patterns, that can use audio capture devices without asking the user for permission. Patterns in this list are matched against the security origin of the requesting URL. If they match, the site is automatically granted access to audio capture devices. Note, however, that the pattern \"*\", which matches any URL, is not supported by this policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autodiscardsleepingtabsenabled","displayName":"Configure auto discard sleeping tabs","description":"Setting this policy enables inactive (sleeping) tabs to be automatically discarded after 1.5 days of inactivity. This is done to save memory. When the user switches back to a discarded tab, the tab will need to be reloaded.\n\nIf the \"SleepingTabsEnabled\" policy is enabled, then this feature will be enabled by default.\n\nIf the \"SleepingTabsEnabled\" is disabled, then this feature will be disabled by default and cannot be enabled.\n\nIf enabled, idle background tabs will be discarded after 1.5 days.\n\nIf disabled, idle background tab will not be discarded after 1.5 days. Tabs can still be discarded for other reasons if this policy is disabled.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.autodiscardsleepingtabsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autodiscardsleepingtabsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autodiscardsleepingtabsenabled_recommended","displayName":"Configure auto discard sleeping tabs (users can override)","description":"Setting this policy enables inactive (sleeping) tabs to be automatically discarded after 1.5 days of inactivity. This is done to save memory. When the user switches back to a discarded tab, the tab will need to be reloaded.\n\nIf the \"SleepingTabsEnabled\" policy is enabled, then this feature will be enabled by default.\n\nIf the \"SleepingTabsEnabled\" is disabled, then this feature will be disabled by default and cannot be enabled.\n\nIf enabled, idle background tabs will be discarded after 1.5 days.\n\nIf disabled, idle background tab will not be discarded after 1.5 days. Tabs can still be discarded for other reasons if this policy is disabled.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.autodiscardsleepingtabsenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autodiscardsleepingtabsenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autofilladdressenabled","displayName":"Enable AutoFill for addresses","description":"Enables the AutoFill feature and allows users to auto-complete address information in web forms using previously stored information.\n\nIf this policy is enabled or not configured, users can manage AutoFill for addresses in Microsoft Edge settings. AutoFill allows users to complete address fields in web forms using previously saved information.\n\nIf this policy is disabled, Microsoft Edge does not suggest, fill in, or save address information. AutoFill is also disabled for all web forms except payment and password fields, and previously saved addresses are not available.\n\nDisabling this policy also turns off \"EdgeAutofillMlEnabled\".\n\nNote that if you disable this policy you also stop all activity for all web forms, except payment and password forms. No further entries are saved, and Microsoft Edge won't suggest or AutoFill any previous entries.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.autofilladdressenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autofilladdressenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autofilladdressenabled_recommended","displayName":"Enable AutoFill for addresses (users can override)","description":"Enables the AutoFill feature and allows users to auto-complete address information in web forms using previously stored information.\n\nIf this policy is enabled or not configured, users can manage AutoFill for addresses in Microsoft Edge settings. AutoFill allows users to complete address fields in web forms using previously saved information.\n\nIf this policy is disabled, Microsoft Edge does not suggest, fill in, or save address information. AutoFill is also disabled for all web forms except payment and password fields, and previously saved addresses are not available.\n\nDisabling this policy also turns off \"EdgeAutofillMlEnabled\".\n\nNote that if you disable this policy you also stop all activity for all web forms, except payment and password forms. No further entries are saved, and Microsoft Edge won't suggest or AutoFill any previous entries.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.autofilladdressenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autofilladdressenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autofillcreditcardenabled","displayName":"Enable AutoFill for payment instruments","description":"Enables Microsoft Edge's AutoFill feature and lets users auto complete payment instruments like credit or debit cards in web forms using previously stored information. This includes suggesting new payment instruments like Buy Now Pay Later (BNPL) in web forms and Express Checkout.\n\nIf you enable this policy or don't configure it, users can control AutoFill for payment instruments.\n\nIf you disable this policy, AutoFill never suggests, fills, or recommends new payment Instruments. Additionally, it won't save any payment instrument information that users submit while browsing the web.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.autofillcreditcardenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autofillcreditcardenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autofillcreditcardenabled_recommended","displayName":"Enable AutoFill for payment instruments (users can override)","description":"Enables Microsoft Edge's AutoFill feature and lets users auto complete payment instruments like credit or debit cards in web forms using previously stored information. This includes suggesting new payment instruments like Buy Now Pay Later (BNPL) in web forms and Express Checkout.\n\nIf you enable this policy or don't configure it, users can control AutoFill for payment instruments.\n\nIf you disable this policy, AutoFill never suggests, fills, or recommends new payment Instruments. Additionally, it won't save any payment instrument information that users submit while browsing the web.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.autofillcreditcardenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autofillcreditcardenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autofillmembershipsenabled","displayName":"Save and fill memberships","description":"This policy lets you decide whether users can have their membership info (for example, program name and membership number) automatically saved and used to fill form fields while using Microsoft Edge. By default, users can choose whether to enable it or not.\n\nIf you enable this policy, users can only have their membership info automatically saved and used to fill form fields while using Microsoft Edge.\n\nIf you don't configure this policy, users can choose whether to have their membership info automatically saved and used to fill form fields while using Microsoft Edge.\n\nIf you disable this policy, users can't have their membership info automatically saved and used to fill form fields while using Microsoft Edge.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.autofillmembershipsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autofillmembershipsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autofillmembershipsenabled_recommended","displayName":"Save and fill memberships (users can override)","description":"This policy lets you decide whether users can have their membership info (for example, program name and membership number) automatically saved and used to fill form fields while using Microsoft Edge. By default, users can choose whether to enable it or not.\n\nIf you enable this policy, users can only have their membership info automatically saved and used to fill form fields while using Microsoft Edge.\n\nIf you don't configure this policy, users can choose whether to have their membership info automatically saved and used to fill form fields while using Microsoft Edge.\n\nIf you disable this policy, users can't have their membership info automatically saved and used to fill form fields while using Microsoft Edge.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.autofillmembershipsenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autofillmembershipsenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autolaunchprotocolscomponentenabled","displayName":"AutoLaunch Protocols Component Enabled","description":"Specifies whether the AutoLaunch Protocols component should be enabled. This component allows Microsoft to provide a list similar to that of the \"AutoLaunchProtocolsFromOrigins\" policy, allowing certain external protocols to launch without prompt or blocking certain protocols (on specified origins). By default, this component is enabled.\n\nIf you enable or don't configure this policy, the AutoLaunch Protocols component is enabled.\n\nIf you disable this policy, the AutoLaunch Protocols component is disabled.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.autolaunchprotocolscomponentenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autolaunchprotocolscomponentenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autolaunchprotocolsfromorigins","displayName":"Define a list of protocols that can launch an external application from listed origins without prompting the user","description":"Allows you to set a list of protocols, and for each protocol an associated list of allowed origin patterns, that can launch an external application without prompting the user. The trailing separator should not be included when listing the protocol and the protocol should be all lower case. For example, list \"skype\" instead of \"skype:\", \"skype://\" or \"Skype\".\n\nIf you configure this policy, a protocol will only be permitted to launch an external application without prompting by policy if:\n\n- the protocol is listed\n\n- the origin of the site trying to launch the protocol matches one of the origin patterns in that protocol's allowed_origins list.\n\nIf either condition is false, the external protocol launch prompt will not be omitted by policy.\n\nIf you don't configure this policy, no protocols can launch without a prompt. Users can opt out of prompts on a per-protocol/per-site basis unless the \"ExternalProtocolDialogShowAlwaysOpenCheckbox\" policy is set to Disabled. This policy has no impact on per-protocol/per-site prompt exemptions set by users.\n\nThe origin matching patterns use a similar format to those for the \"URLBlocklist\" policy, which are documented at https://go.microsoft.com/fwlink/?linkid=2095322.\n\nHowever, origin matching patterns for this policy cannot contain \"/path\" or \"@query\" elements. Any pattern that does contain a \"/path\" or \"@query\" element will be ignored.\n\nThis policy does not work as expected with file://* wildcards.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.automaticdownloadsallowedforurls","displayName":"Allow multiple automatic downloads in quick succession on specific sites","description":"Define a list of sites, based on URL patterns, that are allowed to perform multiple successive automatic downloads.\nIf you don't configure this policy, \"DefaultAutomaticDownloadsSetting\" applies for all sites, if it's set. If it isn't set, then the user's personal setting applies.\nFor more detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.automaticdownloadsblockedforurls","displayName":"Block multiple automatic downloads in quick succession on specific sites","description":"Define a list of sites, based on URL patterns, where multiple successive automatic downloads aren't allowed.\nIf you don't configure this policy, \"DefaultAutomaticDownloadsSetting\" applies for all sites, if it's set. If it isn't set, then the user's personal setting applies.\nFor more detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.automaticfullscreenallowedforurls","displayName":"Allow automatic full screen on specified sites","description":"For security reasons, the\nrequestFullscreen() web API\nrequires a prior user gesture (\"transient activation\") to be called or it will\nfail. Users' personal settings may allow certain origins to call this API\nwithout a prior user gesture.\n\nThis policy supersedes users' personal settings and allows matching origins to\ncall the API without a prior user gesture.\n\nFor detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.\nWildcards (*) are allowed.\n\nOrigins matching both blocked and allowed policy patterns will be blocked.\nOrigins not specified by policy or user settings will require a prior user\ngesture to call this API.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.automaticfullscreenblockedforurls","displayName":"Block automatic full screen on specified sites","description":"For security reasons, the\nrequestFullscreen() web API\nrequires a prior user gesture (\"transient activation\") to be called or it will\nfail. Users' personal settings may allow certain origins to call this API\nwithout a prior user gesture.\n\nThis policy supersedes users' personal settings and blocks matching origins\nfrom calling the API without a prior user gesture.\n\nFor detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.\nWildcards (*) are allowed.\n\nOrigins matching both blocked and allowed policy patterns will be blocked.\nOrigins not specified by policy or user settings will require a prior user\ngesture to call this API.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.automatichttpsdefault","displayName":"Configure Automatic HTTPS (Obsolete)","description":"This policy lets you manage settings for \"AutomaticHttpsDefault\", which switches connections from HTTP to HTTPS.\n\nThis feature helps protect against man-in-the-middle attacks by enforcing more secure connections, but users might experience more connection errors.\n\nMicrosoft Edge attempts to upgrade some navigations from HTTP to HTTPS, when possible. This policy can be used to disable this behavior. If set to \"AlwaysUpgrade\" or left unset, this feature will be enabled by default.\n\nThe separate HttpAllowlist policy can be used to exempt specific hostnames or hostname patterns from being upgraded to HTTPS by this feature.\n\nThis policy is obsolete, and has been replaced with the policy \"HttpsUpgradesEnabled\".\n\nPolicy options mapping:\n\n* DisableAutomaticHttps (0) = Automatic HTTPS functionality is disabled.\n\n* UpgradeCapableDomains (1) = (Deprecated) Navigations delivered over HTTP are switched to HTTPS, only on domains likely to support HTTPS.\n\n* AlwaysUpgrade (2) = All navigations delivered over HTTP are switched to HTTPS. Connection errors might occur more often.\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.automatichttpsdefault_disableautomatichttps","displayName":"Automatic HTTPS functionality is disabled.","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.automatichttpsdefault_upgradecapabledomains","displayName":"(Deprecated) Navigations delivered over HTTP are switched to HTTPS, only on domains likely to support HTTPS.","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.automatichttpsdefault_alwaysupgrade","displayName":"All navigations delivered over HTTP are switched to HTTPS. Connection errors might occur more often.","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.automatichttpsdefault_recommended","displayName":"Configure Automatic HTTPS (Obsolete) (users can override)","description":"This policy lets you manage settings for \"AutomaticHttpsDefault\", which switches connections from HTTP to HTTPS.\n\nThis feature helps protect against man-in-the-middle attacks by enforcing more secure connections, but users might experience more connection errors.\n\nMicrosoft Edge attempts to upgrade some navigations from HTTP to HTTPS, when possible. This policy can be used to disable this behavior. If set to \"AlwaysUpgrade\" or left unset, this feature will be enabled by default.\n\nThe separate HttpAllowlist policy can be used to exempt specific hostnames or hostname patterns from being upgraded to HTTPS by this feature.\n\nThis policy is obsolete, and has been replaced with the policy \"HttpsUpgradesEnabled\".\n\nPolicy options mapping:\n\n* DisableAutomaticHttps (0) = Automatic HTTPS functionality is disabled.\n\n* UpgradeCapableDomains (1) = (Deprecated) Navigations delivered over HTTP are switched to HTTPS, only on domains likely to support HTTPS.\n\n* AlwaysUpgrade (2) = All navigations delivered over HTTP are switched to HTTPS. Connection errors might occur more often.\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.automatichttpsdefault_recommended_disableautomatichttps","displayName":"Automatic HTTPS functionality is disabled.","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.automatichttpsdefault_recommended_upgradecapabledomains","displayName":"(Deprecated) Navigations delivered over HTTP are switched to HTTPS, only on domains likely to support HTTPS.","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.automatichttpsdefault_recommended_alwaysupgrade","displayName":"All navigations delivered over HTTP are switched to HTTPS. Connection errors might occur more often.","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autoopenallowedforurls","displayName":"URLs where AutoOpenFileTypes can apply","description":"A list of URLs to which \"AutoOpenFileTypes\" applies to. This policy has no impact on automatically open values set by users via the download shelf ... > \"Always open files of this type\" menu entry.\n\nIf you set URLs in this policy, files will only automatically open by policy if the URL is part of this set and the file type is listed in \"AutoOpenFileTypes\". If either condition is false, the download won't automatically open by policy.\n\nIf you don't set this policy, all downloads where the file type is in \"AutoOpenFileTypes\" automatically opens.\n\nA URL pattern has to be formatted according to https://go.microsoft.com/fwlink/?linkid=2095322.\n\nThis policy doesn't work as expected with file://* wildcards.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autoopenfiletypes","displayName":"List of file types that should be automatically opened on download","description":"This policy sets a list of file types that should be automatically opened on download. Note: The leading separator should not be included when listing the file type, so list \"txt\" instead of \".txt\".\n\nBy default, these file types will be automatically opened on all URLs. You can use the \"AutoOpenAllowedForURLs\" policy to restrict the URLs for which these file types will be automatically opened on.\n\nFiles with types that should be automatically opened will still be subject to the enabled Microsoft Defender SmartScreen checks and won't be opened if they fail those checks.\n\nFile types that a user has already specified to automatically be opened will continue to do so when downloaded. The user will continue to be able to specify other file types to be automatically opened.\n\nIf you don't set this policy, only file types that a user has already specified to automatically be opened will do so when downloaded.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory or instances that enrolled for device management.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autoplayallowed","displayName":"Allow media autoplay for websites","description":"This policy sets the media autoplay policy for websites.\n\nThe default setting, \"Not configured\" respects the current media autoplay settings and lets users configure their autoplay settings.\n\nSetting to \"Enabled\" sets media autoplay to \"Allow\". All websites are allowed to autoplay media. Users can't override this policy.\n\nSetting to \"Disabled\" sets media autoplay to \"Limit\". This limits websites that are allowed to autoplay media to webpages with high media engagement and active WebRTC streams. Prior to Microsoft Edge version 92, this would set media autoplay to \"Block\". Users can't override this policy.\n\nA tab will need to be closed and re-opened for this policy to take effect.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.autoplayallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autoplayallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autoplayallowlist","displayName":"Allow media autoplay on specific sites","description":"Define a list of sites, based on URL patterns, that are allowed to autoplay media.\n\nIf you don't configure this policy, the global default value from the \"AutoplayAllowed\" policy (if set) or the user's personal configuration is used for all sites.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.\n\nNote: * is not an accepted value for this policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.autoselectcertificateforurls","displayName":"Automatically select client certificates for these sites","description":"Setting the policy lets you make a list of URL patterns that specify sites for which Microsoft Edge can automatically select a client certificate. The value is an array of stringified JSON dictionaries, each with the form { \"pattern\": \"$URL_PATTERN\", \"filter\" : $FILTER }, where $URL_PATTERN is a content setting pattern. $FILTER restricts the client certificates the browser automatically selects from. Independent of the filter, only certificates that match the server's certificate request are selected.\n\nExamples for the usage of the $FILTER section:\n\n* When $FILTER is set to { \"ISSUER\": { \"CN\": \"$ISSUER_CN\" } }, only client certificates issued by a certificate with the CommonName $ISSUER_CN are selected.\n\n* When $FILTER contains both the \"ISSUER\" and the \"SUBJECT\" sections, only client certificates that satisfy both conditions are selected.\n\n* When $FILTER contains a \"SUBJECT\" section with the \"O\" value, a certificate needs at least one organization matching the specified value to be selected.\n\n* When $FILTER contains a \"SUBJECT\" section with a \"OU\" value, a certificate needs at least one organizational unit matching the specified value to be selected.\n\n* When $FILTER is set to {}, the selection of client certificates is not additionally restricted. Note that filters provided by the web server still apply.\n\nIf you leave the policy unset, there's no autoselection for any site.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.backgroundtemplatelistupdatesenabled","displayName":"Enables background updates to the list of available templates for Collections and other features that use templates (Deprecated)","description":"This policy is deprecated because we are moving to a new policy. It won't work in Microsoft Edge as soon as version 104. The new policy to use is \"EdgeAssetDeliveryServiceEnabled\".\n\nLets you enable or disable background updates to the list of available templates for Collections and other features that use templates. Templates are used to extract rich metadata from a webpage when the page is saved to a collection.\n\nIf you enable this setting or the setting is unconfigured, the list of available templates are downloaded in the background from a Microsoft service every 24 hours.\n\nIf you disable this setting the list of available templates are downloaded on demand. This type of download might result in small performance penalties for Collections and other features.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.backgroundtemplatelistupdatesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.backgroundtemplatelistupdatesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.beforeunloadeventcancelbypreventdefaultenabled","displayName":"Control the behavior for the cancel dialog produced by the beforeunload event (Obsolete)","description":"This policy provides a temporary opt-out for two related fixes to the behavior of the confirmation dialog that’s shown by the beforeunload event.\n\nWhen this policy is Enabled, the new (correct) behavior will be used.\nWhen this policy is Disabled, the old (legacy) behavior will be used.\nWhen this policy is left not set, the default behavior will be used.\nNote: This policy is a temporary workaround and will be removed in a future release.\n\nNew and correct behavior: In `beforeunload`, calling `event.preventDefault()` will trigger the confirmation dialog. Setting `event.returnValue` to the empty string won’t trigger the confirmation dialog.\n\nOld and legacy behavior: In `beforeunload`, calling `event.preventDefault()` won’t trigger the confirmation dialog. Setting `event.returnValue` to the empty string will trigger the confirmation dialog.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.beforeunloadeventcancelbypreventdefaultenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.beforeunloadeventcancelbypreventdefaultenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.blockexternalextensions","displayName":"Blocks external extensions from being installed","description":"Control the installation of external extensions.\n\nIf you enable this setting, external extensions are blocked from being installed.\n\nIf you disable this setting or leave it unset, external extensions are allowed to be installed.\n\nExternal extensions and their installation are documented at [Alternate extension distribution methods](/microsoft-edge/extensions-chromium/developer-guide/alternate-distribution-options).","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.blockexternalextensions_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.blockexternalextensions_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.blockthirdpartycookies","displayName":"Block third party cookies","description":"This policy controls whether third-party cookies are blocked in regular browsing sessions.\n\nIf you enable this policy, web page elements that are not from the domain shown in the address bar can't set cookies.\n\nIf you disable this policy, third-party cookies are allowed, including from domains other than the one shown in the address bar.\n\nIf you don't configure this policy, third-party cookies are allowed by default, but users can change this setting.\n\nNote: This policy doesn't apply in InPrivate mode. In InPrivate, third-party cookies are blocked by default and can only be allowed at the site level using the CookiesAllowedForUrls policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.blockthirdpartycookies_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.blockthirdpartycookies_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.blockthirdpartycookies_recommended","displayName":"Block third party cookies (users can override)","description":"This policy controls whether third-party cookies are blocked in regular browsing sessions.\n\nIf you enable this policy, web page elements that are not from the domain shown in the address bar can't set cookies.\n\nIf you disable this policy, third-party cookies are allowed, including from domains other than the one shown in the address bar.\n\nIf you don't configure this policy, third-party cookies are allowed by default, but users can change this setting.\n\nNote: This policy doesn't apply in InPrivate mode. In InPrivate, third-party cookies are blocked by default and can only be allowed at the site level using the CookiesAllowedForUrls policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.blockthirdpartycookies_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.blockthirdpartycookies_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.blocktruncatedcookies","displayName":"Block truncated cookies (Obsolete)","description":"This policy provides a temporary opt-out for changes to how Microsoft Edge handles cookies set via JavaScript that contain certain control characters (NULL, carriage return, and line feed).\nPreviously, the presence of any of these characters in a cookie string would cause it to be truncated but still set.\nNow, the presence of these characters will cause the whole cookie string to be ignored.\n\nIf you enable or don't configure this policy, the new behavior is enabled.\n\nIf you disable this policy, the old behavior is enabled.\n\nThis policy is obsolete because this policy was originally implemented as a safety measure in case of breakage, but none have been reported.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.blocktruncatedcookies_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.blocktruncatedcookies_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.browsernetworktimequeriesenabled","displayName":"Allow queries to a Browser Network Time service","description":"Prevents Microsoft Edge from occasionally sending queries to a browser network time service to retrieve an accurate timestamp.\n\nIf you disable this policy, Microsoft Edge will stop sending queries to a browser network time service.\n\nIf you enable this policy or don't configure it, Microsoft Edge will occasionally send queries to a browser network time service.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.browsernetworktimequeriesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.browsernetworktimequeriesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.browsingdatalifetime","displayName":"Browsing Data Lifetime Settings","description":"This policy controls how long specific types of browsing data are retained.\nIf Sync is enabled, this policy has no effect.\n\nYou can specify the following data types:\n'browsing_history'\n'download_history'\n'cookies_and_other_site_data'\n'cached_images_and_files'\n'password_signin'\n'autofill'\n'site_settings'\n'hosted_app_data'\n\nMicrosoft Edge periodically deletes data of the selected types that is older than the value set by 'time_to_live_in_hours'.\n\nExpired data is removed 15 seconds after browser startup and every hour while the browser is running.\n\nNote: Deleting cookies using this policy does not sign the user out of their profile, the user stays signed in.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.builtinaiapisenabled","displayName":"Allow pages to use the built-in AI APIs.","description":"Use this policy to control whether websites can access the built-in AI APIs, including the LanguageModel API, Summarization API, Writer API, and Rewriter API.\n\nEnable this policy to allow pages to use the APIs. If you don’t configure this policy, the APIs are still allowed.\n\nDisable this policy to block access to the APIs. The APIs will return an error when used.\n\nFor more information, see https://github.com/webmachinelearning/writing-assistance-apis/blob/main/README.md.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.builtinaiapisenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.builtinaiapisenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.cacertificatemanagementallowed","displayName":"Allow users to manage installed CA certificates.","description":"This policy determines the level of access users have when managing CA certificates in Microsoft Edge.\n\nSetting the policy to UserOnly (1) allows users to manage only user-imported certificates. Trust settings for built-in certificates cannot be changed.\n\nSetting the policy to None (2) lets users view certificates but not manage them.\n\nNote: The certificate management experience is available starting in Microsoft Edge version 136.\n\nPolicy options mapping:\n\n* All (0) = Allow users to manage all certificates\n\n* UserOnly (1) = Allow users to manage user certificates\n\n* None (2) = Disallow users from managing certificates\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.cacertificatemanagementallowed_all","displayName":"Allow users to manage all certificates","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.cacertificatemanagementallowed_useronly","displayName":"Allow users to manage user certificates","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.cacertificatemanagementallowed_none","displayName":"Disallow users from managing certificates","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.cacertificates","displayName":"TLS server certificates that should be trusted by Microsoft Edge","description":"This policy enables a list of TLS certificates that should be trusted by Microsoft Edge for server authentication.\nCertificates should be base64-encoded.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.cacertificateswithconstraints","displayName":"TLS certificates that should be trusted by Microsoft Edge for server authentication with constraints","description":"This policy enables a list of TLS certificates that should be trusted by Microsoft Edge for server authentication, with constraints added outside the certificate. If no constraint of a certain type is present, then any name of that type is allowed.\nCertificates should be base64-encoded. At least one constraint must be specified for each certificate.\n\nThe permitted_dns_names field is a list of DNS names that are allowed for the certificate. If the DNS name in the certificate request does not match one of the specified DNS names, the certificate will not be trusted.\n\nThe permitted_cidrs field is a list of CIDR (Classless Inter-Domain Routing) ranges that will be allowed for the certificate. If the IP address in the certificate request does not fall within one of the permitted CIDR ranges, the certificate will not be trusted.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.cadistrustedcertificates","displayName":"TLS certificates that should be distrusted by Microsoft Edge for server authentication","description":"This policy enables defining a list of certificate public keys that should be distrusted by Microsoft Edge for TLS server\nauthentication.\n\nThe policy value is a list of base64-encoded X.509 certificates. Any\ncertificate with a matching SPKI (SubjectPublicKeyInfo) will be distrusted.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.cahintcertificates","displayName":"TLS certificates that are not trusted or distrusted but can be used in path-building for server authentication","description":"This policy defines certificates that are not explicitly trusted or distrusted by Microsoft Edge but may be used as hints during certificate path-building.\n\nThe specified certificates will be considered as intermediates during path validation; the server's certificate must still chain to a trusted root to be considered valid.\n\nCertificates must be base64-encoded.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.caplatformintegrationenabled","displayName":"Use user-added TLS certificates from platform trust stores for server authentication","description":"If enabled (or unset), user-added TLS certificates from platform trust stores will be used in path-building for TLS server authentication.\n\nIf disabled, user-added TLS certificates from platform trust stores won't be used in path-building for TLS server authentication.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.caplatformintegrationenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.caplatformintegrationenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.certificatetransparencyenforcementdisabledforcas","displayName":"Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes","description":"Disables enforcement of Certificate Transparency requirements for a list of subjectPublicKeyInfo hashes.\n\nThis policy lets you disable Certificate Transparency disclosure requirements for certificate chains that contain certificates with one of the specified subjectPublicKeyInfo hashes. This allows certificates that would otherwise be untrusted because they were not properly publicly disclosed to still be used for Enterprise hosts.\n\nTo disable Certificate Transparency enforcement when this policy is set, one of the following sets of conditions must be met:\n1. The hash is of the server certificate's subjectPublicKeyInfo.\n2. The hash is of a subjectPublicKeyInfo that appears in a CA certificate in the certificate chain, that CA certificate is constrained via the X.509v3 nameConstraints extension, one or more directoryName nameConstraints are present in the permittedSubtrees, and the directoryName contains an organizationName attribute.\n3. The hash is of a subjectPublicKeyInfo that appears in a CA certificate in the certificate chain, the CA certificate has one or more organizationName attributes in the certificate Subject, and the server's certificate contains the same number of organizationName attributes, in the same order, and with byte-for-byte identical values.\n\nA subjectPublicKeyInfo hash is specified by concatenating the hash algorithm name, the \"/\" character, and the Base64 encoding of that hash algorithm applied to the DER-encoded subjectPublicKeyInfo of the specified certificate. This Base64 encoding is the same format as an SPKI Fingerprint, as defined in RFC 7469, Section 2.4. Unrecognized hash algorithms are ignored. The only supported hash algorithm at this time is \"sha256\".\n\nIf you disable this policy or don't configure it, any certificate that's required to be disclosed via Certificate Transparency will be treated as untrusted if it's not disclosed according to the Certificate Transparency policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.certificatetransparencyenforcementdisabledforlegacycas","displayName":"Disable Certificate Transparency enforcement for a list of legacy certificate authorities (Obsolete)","description":"Disables enforcing Certificate Transparency requirements for a list of legacy certificate authorities (Cas).\n\nThis policy lets you disable Certificate Transparency disclosure requirements for certificate chains that contain certificates with one of the specified subjectPublicKeyInfo hashes. This allows certificates that would otherwise be untrusted because they were not properly publicly disclosed, continue to be used for enterprise hosts.\n\nIn order for Certificate Transparency enforcement to be disabled, you must set the hash to a subjectPublicKeyInfo appearing in a CA certificate that is recognized as a legacy certificate authority (CA). A legacy CA is a CA that has been publicly trusted by default by one or more operating systems supported by Microsoft Edge.\n\nYou specify a subjectPublicKeyInfo hash by concatenating the hash algorithm name, the \"/\" character, and the Base64 encoding of that hash algorithm applied to the DER-encoded subjectPublicKeyInfo of the specified certificate. This Base64 encoding is the same format as an SPKI Fingerprint, as defined in RFC 7469, Section 2.4. Unrecognized hash algorithms are ignored. The only supported hash algorithm at this time is \"sha256\".\n\nIf you don't configure this policy, any certificate that's required to be disclosed via Certificate Transparency will be treated as untrusted if it isn't disclosed according to the Certificate Transparency policy.\n\nThis policy is obsolete because the feature to disable Certificate Transparency enforcement for legacy certificates has been removed.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.clearbrowsingdataonexit","displayName":"Clear browsing data when Microsoft Edge closes","description":"Microsoft Edge doesn't clear the browsing data by default when it closes. Browsing data includes information entered in forms, passwords, and even the websites visited.\n\nIf you enable this policy, all browsing data is deleted each time Microsoft Edge closes. Note that if you enable this policy, it takes precedence over how you configured \"DefaultCookiesSetting\"\n\nIf you disable or don't configure this policy, users can configure the Clear browsing data option in Settings.\n\nIf you enable this policy, don't configure the \"AllowDeletingBrowserHistory\" or the \"ClearCachedImagesAndFilesOnExit\" policy, because they all deal with deleting browsing data. If you configure the preceding policies and this policy, all browsing data is deleted when Microsoft Edge closes, regardless of how you configured \"AllowDeletingBrowserHistory\" or \"ClearCachedImagesAndFilesOnExit\".\n\nTo exclude cookies from being deleted on exit, configure the \"SaveCookiesOnExit\" policy.\nTo exclude passwords from being deleted on exit, configure the \"PasswordDeleteOnBrowserCloseEnabled\" policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.clearbrowsingdataonexit_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.clearbrowsingdataonexit_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.clearbrowsingdataonexit_recommended","displayName":"Clear browsing data when Microsoft Edge closes (users can override)","description":"Microsoft Edge doesn't clear the browsing data by default when it closes. Browsing data includes information entered in forms, passwords, and even the websites visited.\n\nIf you enable this policy, all browsing data is deleted each time Microsoft Edge closes. Note that if you enable this policy, it takes precedence over how you configured \"DefaultCookiesSetting\"\n\nIf you disable or don't configure this policy, users can configure the Clear browsing data option in Settings.\n\nIf you enable this policy, don't configure the \"AllowDeletingBrowserHistory\" or the \"ClearCachedImagesAndFilesOnExit\" policy, because they all deal with deleting browsing data. If you configure the preceding policies and this policy, all browsing data is deleted when Microsoft Edge closes, regardless of how you configured \"AllowDeletingBrowserHistory\" or \"ClearCachedImagesAndFilesOnExit\".\n\nTo exclude cookies from being deleted on exit, configure the \"SaveCookiesOnExit\" policy.\nTo exclude passwords from being deleted on exit, configure the \"PasswordDeleteOnBrowserCloseEnabled\" policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.clearbrowsingdataonexit_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.clearbrowsingdataonexit_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.clearcachedimagesandfilesonexit","displayName":"Clear cached images and files when Microsoft Edge closes","description":"Microsoft Edge doesn't clear cached images and files by default when it closes.\n\nIf you enable this policy, cached images and files will be deleted each time Microsoft Edge closes.\n\nIf you disable this policy, users cannot configure the cached images and files option in edge://settings/clearBrowsingDataOnClose.\n\nIf you don't configure this policy, users can choose whether cached images and files are cleared on exit.\n\nIf you disable this policy, don't enable the \"ClearBrowsingDataOnExit\" policy, because they both deal with deleting data. If you configure both, the \"ClearBrowsingDataOnExit\" policy takes precedence and deletes all data when Microsoft Edge closes, regardless of how you configured \"ClearCachedImagesAndFilesOnExit\".","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.clearcachedimagesandfilesonexit_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.clearcachedimagesandfilesonexit_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.clearcachedimagesandfilesonexit_recommended","displayName":"Clear cached images and files when Microsoft Edge closes (users can override)","description":"Microsoft Edge doesn't clear cached images and files by default when it closes.\n\nIf you enable this policy, cached images and files will be deleted each time Microsoft Edge closes.\n\nIf you disable this policy, users cannot configure the cached images and files option in edge://settings/clearBrowsingDataOnClose.\n\nIf you don't configure this policy, users can choose whether cached images and files are cleared on exit.\n\nIf you disable this policy, don't enable the \"ClearBrowsingDataOnExit\" policy, because they both deal with deleting data. If you configure both, the \"ClearBrowsingDataOnExit\" policy takes precedence and deletes all data when Microsoft Edge closes, regardless of how you configured \"ClearCachedImagesAndFilesOnExit\".","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.clearcachedimagesandfilesonexit_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.clearcachedimagesandfilesonexit_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.clipboardallowedforurls","displayName":"Allow clipboard use on specific sites","description":"Configure the list of URL patterns that specify which sites can use the clipboard site permission.\n\nSetting the policy lets you create a list of URL patterns that specify which sites can use the clipboard site permission. This doesn't include all clipboard operations on origins that match the patterns. For example, users will still be able to paste using keyboard shortcuts because this isn't controlled by the clipboard site permission.\n\nLeaving the policy unset means \"DefaultClipboardSetting\" applies for all sites if it's set. If it isn't set, the user's personal setting applies.\n\nFor more information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.clipboardblockedforurls","displayName":"Block clipboard use on specific sites","description":"Configure the list of URL patterns that specify which sites can use the clipboard site permission.\n\nSetting the policy lets you create a list of URL patterns that specify sites that can't use the clipboard site permission. This doesn't include all clipboard operations on origins that match the patterns. For example, users will still be able to paste using keyboard shortcuts because this isn't controlled by the clipboard site permission.\n\nLeaving the policy unset means \"DefaultClipboardSetting\" applies for all sites if it's set. If it isn't set, the user's personal setting applies.\n\nFor more information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.collectionsservicesandexportsblocklist","displayName":"Block access to a specified list of services and export targets in Collections","description":"List specific services and export targets that users can't access in the Collections feature in Microsoft Edge. This includes displaying additional data from Bing and exporting collections to Microsoft products or external partners.\n\nIf you enable this policy, services and export targets that match the given list are blocked.\n\nIf you don't configure this policy, no restrictions on the acceptable services and export targets are enforced.\n\nPolicy options mapping:\n\n* pinterest_suggestions (pinterest_suggestions) = Pinterest suggestions\n\n* collections_share (collections_share) = Sharing of Collections\n\n* local_pdf (local_pdf) = Save local PDFs in Collections to OneDrive\n\n* send_word (send_word) = Send collection to Microsoft Word\n\n* send_excel (send_excel) = Send collection to Microsoft Excel\n\n* send_onenote (send_onenote) = Send collection to Microsoft OneNote\n\n* send_pinterest (send_pinterest) = Send collection to Pinterest\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.collectionsservicesandexportsblocklist_pinterest_suggestions","displayName":"Pinterest suggestions","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.collectionsservicesandexportsblocklist_collections_share","displayName":"Sharing of Collections","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.collectionsservicesandexportsblocklist_local_pdf","displayName":"Save local PDFs in Collections to OneDrive","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.collectionsservicesandexportsblocklist_send_word","displayName":"Send collection to Microsoft Word","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.collectionsservicesandexportsblocklist_send_excel","displayName":"Send collection to Microsoft Excel","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.collectionsservicesandexportsblocklist_send_onenote","displayName":"Send collection to Microsoft OneNote","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.collectionsservicesandexportsblocklist_send_pinterest","displayName":"Send collection to Pinterest","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.composeinlineenabled","displayName":"Control access to Microsoft 365 Copilot writing assistance in Microsoft Edge for Business","description":"This policy controls whether users can use writing support features in Microsoft Edge for Business, such as Rewrite, which utilizes Microsoft 365 Copilot Chat. With Rewrite, users can receive help with drafting content, rewriting text, and adjusting style directly in their browser tab. In Edge, users can trigger it when highlighting editable content in their main browser through the right-click context menu.\n\nThis policy applies only to Microsoft Entra accounts and does not apply to Microsoft accounts.\n\nIf you enable this policy, users can use Rewrite in Microsoft Edge when logged in with an Entra account.\n\nIf you disable this policy, users within your tenant will not be able to use Rewrite.\n\nIf you don't configure this policy, the default behavior is as follows:\n\n- Rewrite is available to users\n\n- Users can enable or disable Microsoft 365 Copilot access to Microsoft Edge page content using the toggle in Microsoft Edge settings.\n\nNote: Rewrite is not available on pages protected by data loss prevention (DLP) policies to help maintain compliance.\n\nLearn more about Microsoft 365 Copilot Chat data, privacy, and security here: https://go.microsoft.com/fwlink/?linkid=2321816","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.composeinlineenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.composeinlineenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.compressiondictionarytransportenabled","displayName":"Enable compression dictionary transport support","description":"This feature enables the use of dictionary-specific content encodings in the Accept-Encoding request header (\"sbr\" and \"zst-d\") when dictionaries are available for use.\n\nIf you enable this policy or don't configure it, Microsoft Edge will accept web contents using the compression dictionary transport feature.\n\nIf you disable this policy, Microsoft Edge will turn off the compression dictionary transport feature.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.compressiondictionarytransportenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.compressiondictionarytransportenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.configuredonottrack","displayName":"Configure Do Not Track","description":"Specify whether to send Do Not Track requests to websites that ask for tracking info. Do Not Track requests let the websites you visit know that you don't want your browsing activity to be tracked. By default, Microsoft Edge doesn't send Do Not Track requests, but users can turn on this feature to send them.\n\nIf you enable this policy, Do Not Track requests are always sent to websites asking for tracking info.\n\nIf you disable this policy, requests are never sent.\n\nIf you don't configure this policy, users can choose whether to send these requests.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.configuredonottrack_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.configuredonottrack_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.configurefriendlyurlformat","displayName":"Configure the default paste format of URLs copied from Microsoft Edge, and determine if additional formats will be available to users","description":"If FriendlyURLs are enabled, Microsoft Edge computes more representations of the URL and places them on the clipboard.\n\nThis policy configures what format is pasted when the user pastes in external applications or inside Microsoft Edge without the 'Paste as' context menu item.\n\nIf you configure this policy, it makes a choice on behalf of the user. The options in edge://settings/shareCopyPaste will be grayed out, and the options in the 'Paste As' context menu won't be available.\n\n* Not configured = The users are able to choose their preferred paste format. By default, this is set to the friendly URL format. The 'Paste As' menu will be available in Microsoft Edge.\n\n* 1 = No additional formats are stored on the clipboard. There will be no 'Paste as' context menu item in Microsoft Edge, and the only format available to paste will be the plain text URL format. Effectively, the friendly URL feature will be disabled.\n\n* 3 = The user gets a friendly URL whenever they paste into surfaces that accept rich text. The plain URL is still be available for non-rich surfaces. There will be no 'Paste As' menu in Microsoft Edge.\n\n* 4 = (Not currently used)\n\nThe richer formats may not be supported in some paste destinations and/or websites. In these scenarios, the plain URL option is recommended when configuring this policy.\n\nThe recommended policy is available in Microsoft Edge 105 or later.\n\nPolicy options mapping:\n\n* PlainText (1) = The plain URL without any extra information, such as the page's title. This is the recommended option when this policy is configured. For more information, see the description.\n\n* TitledHyperlink (3) = Titled Hyperlink: A hyperlink that points to the copied URL but whose visible text is the title of the destination page. This is the Friendly URL format.\n\n* WebPreview (4) = Coming soon. If set, behaves the same as 'Plain URL'.\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.configurefriendlyurlformat_plaintext","displayName":"The plain URL without any extra information, such as the page's title. This is the recommended option when this policy is configured. For more information, see the description.","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.configurefriendlyurlformat_titledhyperlink","displayName":"Titled Hyperlink: A hyperlink that points to the copied URL but whose visible text is the title of the destination page. This is the Friendly URL format.","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.configurefriendlyurlformat_webpreview","displayName":"Coming soon. If set, behaves the same as 'Plain URL'.","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.configurefriendlyurlformat_recommended","displayName":"Configure the default paste format of URLs copied from Microsoft Edge, and determine if additional formats will be available to users (users can override)","description":"If FriendlyURLs are enabled, Microsoft Edge computes more representations of the URL and places them on the clipboard.\n\nThis policy configures what format is pasted when the user pastes in external applications or inside Microsoft Edge without the 'Paste as' context menu item.\n\nIf you configure this policy, it makes a choice on behalf of the user. The options in edge://settings/shareCopyPaste will be grayed out, and the options in the 'Paste As' context menu won't be available.\n\n* Not configured = The users are able to choose their preferred paste format. By default, this is set to the friendly URL format. The 'Paste As' menu will be available in Microsoft Edge.\n\n* 1 = No additional formats are stored on the clipboard. There will be no 'Paste as' context menu item in Microsoft Edge, and the only format available to paste will be the plain text URL format. Effectively, the friendly URL feature will be disabled.\n\n* 3 = The user gets a friendly URL whenever they paste into surfaces that accept rich text. The plain URL is still be available for non-rich surfaces. There will be no 'Paste As' menu in Microsoft Edge.\n\n* 4 = (Not currently used)\n\nThe richer formats may not be supported in some paste destinations and/or websites. In these scenarios, the plain URL option is recommended when configuring this policy.\n\nThe recommended policy is available in Microsoft Edge 105 or later.\n\nPolicy options mapping:\n\n* PlainText (1) = The plain URL without any extra information, such as the page's title. This is the recommended option when this policy is configured. For more information, see the description.\n\n* TitledHyperlink (3) = Titled Hyperlink: A hyperlink that points to the copied URL but whose visible text is the title of the destination page. This is the Friendly URL format.\n\n* WebPreview (4) = Coming soon. If set, behaves the same as 'Plain URL'.\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.configurefriendlyurlformat_recommended_plaintext","displayName":"The plain URL without any extra information, such as the page's title. This is the recommended option when this policy is configured. For more information, see the description.","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.configurefriendlyurlformat_recommended_titledhyperlink","displayName":"Titled Hyperlink: A hyperlink that points to the copied URL but whose visible text is the title of the destination page. This is the Friendly URL format.","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.configurefriendlyurlformat_recommended_webpreview","displayName":"Coming soon. If set, behaves the same as 'Plain URL'.","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.configurekeyboardshortcuts","displayName":"Configure the list of commands for which to disable keyboard shortcuts","description":"Configure the list of Microsoft Edge commands for which keyboard shortcuts must be disabled.\n\nSee https://go.microsoft.com/fwlink/?linkid=2186950 for a list of possible commands to disable.\n\nIf you enable this policy, commands in the 'disabled' list are no longer activated by keyboard shortcuts.\n\nIf you disable this policy, all keyboard shortcuts behave as usual.\n\nNote: Disabling a command only removes its shortcut mapping. Commands in the 'disabled' list still function if accessed via browser UI.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.configureonlinetexttospeech","displayName":"Configure Online Text To Speech","description":"Set whether the browser can leverage Online Text to Speech voice fonts, part of Azure Cognitive Services. These voice fonts are higher quality than the pre-installed system voice fonts.\n\nIf you enable or don't configure this policy, web-based applications that use the SpeechSynthesis API can use Online Text to Speech voice fonts.\n\nIf you disable this policy, the voice fonts aren't available.\n\nRead more about this feature here:\nSpeechSynthesis API: https://go.microsoft.com/fwlink/?linkid=2110038\nCognitive Services: https://go.microsoft.com/fwlink/?linkid=2110141","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.configureonlinetexttospeech_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.configureonlinetexttospeech_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.configureshare","displayName":"Configure the Share experience","description":"If you set this policy to 'ShareAllowed' (the default), users will be able to access the Share experience from the Settings and More Menu in Microsoft Edge to share with other apps on the system.\n\nIf you set this policy to 'ShareDisallowed', users won't be able to access the Share experience. If the Share button is on the toolbar, it will also be hidden.\n\nPolicy options mapping:\n\n* ShareAllowed (0) = Allow using the Share experience\n\n* ShareDisallowed (1) = Don't allow using the Share experience\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.configureshare_shareallowed","displayName":"Allow using the Share experience","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.configureshare_sharedisallowed","displayName":"Don't allow using the Share experience","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.controldefaultstateofallowextensionfromotherstoressettingenabled","displayName":"Configure default state of Allow extensions from other stores setting","description":"This policy allows you to control the default state of the Allow extensions from other stores setting.\nThis policy can't be used to stop installation of extensions from other stores such as Chrome Web Store.\nTo stop installation of extensions from other stores, use the Extension Settings policy: https://go.microsoft.com/fwlink/?linkid=2187098.\n\nWhen enabled, Allow extensions from other stores will be turned on. So, users won't have to turn on the flag manually\nwhile installing extensions from other supported stores such as Chrome Web Store. However a user can override this setting.\nIf the user has already turned on the setting and then turned it off, this setting may not work.\nIf the Admin first sets the policy as Enabled, but then changes it to not configured or disabled, it will have no impact on\nuser settings and the setting will remain as it is.\n\nWhen disabled or not configured, the user can manage the Allow extensions from other store setting.\n","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.controldefaultstateofallowextensionfromotherstoressettingenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.controldefaultstateofallowextensionfromotherstoressettingenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.controldefaultstateofallowextensionfromotherstoressettingenabled_recommended","displayName":"Configure default state of Allow extensions from other stores setting (users can override)","description":"This policy allows you to control the default state of the Allow extensions from other stores setting.\nThis policy can't be used to stop installation of extensions from other stores such as Chrome Web Store.\nTo stop installation of extensions from other stores, use the Extension Settings policy: https://go.microsoft.com/fwlink/?linkid=2187098.\n\nWhen enabled, Allow extensions from other stores will be turned on. So, users won't have to turn on the flag manually\nwhile installing extensions from other supported stores such as Chrome Web Store. However a user can override this setting.\nIf the user has already turned on the setting and then turned it off, this setting may not work.\nIf the Admin first sets the policy as Enabled, but then changes it to not configured or disabled, it will have no impact on\nuser settings and the setting will remain as it is.\n\nWhen disabled or not configured, the user can manage the Allow extensions from other store setting.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.controldefaultstateofallowextensionfromotherstoressettingenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.controldefaultstateofallowextensionfromotherstoressettingenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.cookiesallowedforurls","displayName":"Allow cookies on specific sites","description":"Define a list of sites, based on URL patterns, that are allowed to set cookies. URL patterns may be a single URL indicating that the site may use cookies on all top-level sites. Patterns may also be two URLs delimited by a comma. The first specifies the site that should be allowed to use cookies. The second specifies the top-level site that the first value should be applied on. If you use a pair of URLs, the first value in the pair supports * but the second value does not. Using * for the first value indicates that all sites may use cookies when the second URL is the top-level site.\n\nIf you don't configure this policy, the global default value from the \"DefaultCookiesSetting\" policy (if set) or the user's personal configuration is used for all sites.\n\nSee the \"CookiesBlockedForUrls\" and \"CookiesSessionOnlyForUrls\" policies for more information.\n\nNote there cannot be conflicting URL patterns set between these three policies:\n\n- \"CookiesBlockedForUrls\"\n\n- CookiesAllowedForUrls\n\n- \"CookiesSessionOnlyForUrls\"\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.\n\nTo allow third-party cookies to be set, specify a pair of URL patterns delimited by a comma. The first value in the pair specifies the third-party site that should be allowed to use cookies. The second value in the pair specifies the top-level site that the first value should be applied on. The first value in the pair supports * but the second value does not.\n\nTo exclude cookies from being deleted on exit, configure the \"SaveCookiesOnExit\" policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.cookiesblockedforurls","displayName":"Block cookies on specific sites","description":"Define a list of sites, based on URL patterns, that can't set cookies.\n\nIf you don't configure this policy, the global default value from the \"DefaultCookiesSetting\" policy (if set) or the user's personal configuration is used for all sites.\n\nSee the \"CookiesAllowedForUrls\" and \"CookiesSessionOnlyForUrls\" policies for more information.\n\nNote there can't be conflicting URL patterns set between these three policies:\n\n- CookiesBlockedForUrls\n\n- \"CookiesAllowedForUrls\"\n\n- \"CookiesSessionOnlyForUrls\"\n\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. * isn't an accepted value for this policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.cookiessessiononlyforurls","displayName":"Limit cookies from specific websites to the current session","description":"Cookies created by websites that match a URL pattern you define are deleted when the session ends (when the window closes).\n\nCookies created by websites that don't match the pattern are controlled by the \"DefaultCookiesSetting\" policy (if set) or by the user's personal configuration. This is also the default behavior if you don't configure this policy.\n\nYou can also use the \"CookiesAllowedForUrls\" and \"CookiesBlockedForUrls\" policies to control which websites can create cookies.\n\nNote there cannot be conflicting URL patterns set between these three policies:\n\n- \"CookiesBlockedForUrls\"\n\n- \"CookiesAllowedForUrls\"\n\n- CookiesSessionOnlyForUrls\n\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.\n\nIf you set the \"RestoreOnStartup\" policy to restore URLs from previous sessions, this policy is ignored, and cookies are stored permanently for those sites.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.copilotcdppagecontext","displayName":"Control Copilot with Commercial Data Protection access to page context for Microsoft Entra ID profiles (Obsolete)","description":"This policy has been obsoleted as of Edge 133. Instead of this obsolete policy, we recommend using \"EdgeEntraCopilotPageContext\".\n\nThis policy controls access to page contents for Copilot with Commercial Data Protection in the Edge sidebar. This policy applies only to Microsoft Entra ID profiles. To summarize pages and interact with text selections, it needs to be able to access the page contents. This policy doesn't apply to MSA profiles. This policy doesn't control access for Copilot without Commercial Data Protection. Access for Copilot without Commercial Data Protection is controlled by the policy CopilotPageContext.\n\nIf you enable this policy, Copilot with Commercial Data Protection will have access to page context.\n\nIf you don't configure this policy, a user can enable access to page context for Copilot with Commercial Data Protection using the setting toggle in Edge.\n\nIf you disable this policy, Copilot with Commercial Data Protection won't be able to access page context.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.copilotcdppagecontext_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.copilotcdppagecontext_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.copilotpagecontext","displayName":"Control Copilot access to page context for Microsoft Entra ID profiles","description":"This policy controls access to page contents for Copilot in the Microsoft Edge sidebar when users are logged into their MSA Copilot account. This policy applies only to Microsoft Entra ID Microsoft Edge profiles. To summarize pages and interact with text selections, it needs to be able to access the page contents. This policy doesn't apply to MSA Microsoft Edge profiles. This policy doesn't control access for Copilot with enterprise data protection (EDP). Access for Copilot with EDP is controlled by the \"EdgeEntraCopilotPageContext\" policy.\n\nIf you enable this policy, Copilot will have access to page content when logged in with Entra ID.\n\nIf this policy isn't configured, the default behavior for non-EU countries/regions is that access is initially enabled. For EU countries/regions, the default behavior is that access is initially disabled. In both cases, if the policy isn't configured, users can enable or disable Copilot's access to page content using the setting toggle in Microsoft Edge.\n\nIf you disable this policy, Copilot won't be able to access page context.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.copilotpagecontext_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.copilotpagecontext_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.corsnonwildcardrequestheaderssupport","displayName":"CORS non-wildcard request header support enabled","description":"This policy lets you configure support of CORS non-wildcard request headers.\n\nMicrosoft Edge version 97 introduces support for CORS non-wildcard request headers. When a script makes a cross-origin network request via fetch() and XMLHttpRequest with a script-added Authorization header, the header must be explicitly allowed by the Access-Control-Allow-Headers header in the CORS preflight response. \"Explicitly\" here means that the wild card symbol \"*\" doesn't cover the Authorization header. See https://go.microsoft.com/fwlink/?linkid=2180022 for more detail.\n\nIf you enable or don't configure the policy, Microsoft Edge will support the CORS non-wildcard request headers and behave as previously described.\n\nIf you disable this policy, Microsoft Edge will allow the wildcard symbol (\"*\") in the Access-Control-Allow-Headers header in the CORS preflight response to cover the Authorization header.\n\nThis policy is a temporary workaround for the new CORS non-wildcard request header feature. It's intended to be removed in the future.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.corsnonwildcardrequestheaderssupport_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.corsnonwildcardrequestheaderssupport_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.createpasskeysinicloudkeychain","displayName":"Control whether passkey creation will default to iCloud Keychain.","description":"Microsoft Edge may direct\npasskey/WebAuthn creation requests directly to iCloud Keychain on macOS 13.5\nor later. If iCloud Keychain syncing is not enabled yet, this will\nprompt the user to sign in with iCloud, or might prompt them to enable iCloud\nKeychain syncing.\n\nIf this policy is set to \"true\" then iCloud Keychain will be the default\nwhenever the WebAuthn request is compatible with that choice.\n\nIf this policy isn't set then the default behavior depends on factors such as\nwhether iCloud Drive is enabled, or whether the user has recently used or\ncreated a credential in their\nMicrosoft Edge profile.\n\nIf this policy is set to false, iCloud Keychain will not be used by default\nand the previous behavior (of creating the credential in the Microsoft Edge profile) may be used\ninstead. Users will still be able to select iCloud Keychain as an option, and\nmay still see iCloud Keychain credentials when signing in.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.createpasskeysinicloudkeychain_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.createpasskeysinicloudkeychain_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.crossoriginwebassemblymodulesharingenabled","displayName":"Specifies whether WebAssembly modules can be sent cross-origin (Obsolete)","description":"Specifies whether WebAssembly modules can be sent to another window or worker cross-origin. Cross-origin WebAssembly module sharing was deprecated as part of the efforts to deprecate document.domain, see https://github.com/mikewest/deprecating-document-domain. This policy allowed re-enabling of cross-origin WebAssembly module sharing. This policy is obsolete because it was intended to offer a longer transition period in the deprecation process.\n\nIf you enable this policy, sites can send WebAssembly modules cross-origin\nwithout restrictions.\n\nIf you disable or don't configure this policy, sites can only send\nWebAssembly modules to windows and workers in the same origin.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.crossoriginwebassemblymodulesharingenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.crossoriginwebassemblymodulesharingenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.cryptowalletenabled","displayName":"Enable CryptoWallet feature (Obsolete)","description":"This policy is obsoleted because this feature will no longer be supported, starting in Microsoft Edge 128. There is no replacement for this policy.\n Enables CryptoWallet feature in Microsoft Edge.\n\n If you enable this policy or don't configure it, users can use CryptoWallet feature which allows users to securely store, manage and transact digital assets such as Bitcoin, Ethereum and other cryptocurrencies. Therefore, Microsoft Edge may access Microsoft servers to communicate with the web3 world during the use of the CryptoWallet feature.\n\n If you disable this policy, users can't use CryptoWallet feature.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.cryptowalletenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.cryptowalletenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.csscustomstatedeprecatedsyntaxenabled","displayName":"Controls whether the deprecated :--foo syntax for CSS custom state is enabled (Obsolete)","description":"The :--foo syntax for the CSS custom state feature is being changed to :state(foo) in Microsoft Edge in order to comply with changes that have been made in Firefox and Safari. This policy lets the deprecated syntax to be used until Stable 132.\n\nThis deprecation might break some Microsoft Edge-only websites that use the deprecated :--foo syntax.\n\nIf you enable this policy, the deprecated syntax will be enabled.\n\nIf you disable this policy or don't set it, the deprecated syntax will be disabled.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.csscustomstatedeprecatedsyntaxenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.csscustomstatedeprecatedsyntaxenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.customhelplink","displayName":"Specify custom help link","description":"Specify a link for the Help menu or the F1 key.\n\nIf you enable this policy, an admin can specify a link for the Help menu or the F1 key.\n\nIf you disable or don't configure this policy, the default link for the Help menu or the F1 key is used.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.dataurlinsvguseenabled","displayName":"Data URL support for SVGUseElement","description":"This policy enables Data URL support for SVGUseElement, which will be disabled\nby default starting in Edge stable version 119.\nIf this policy is Enabled, Data URLs will keep working in SVGUseElement.\nIf this policy is Disabled or left not set, Data URLs won't work in SVGUseElement.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.dataurlinsvguseenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.dataurlinsvguseenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultautomaticdownloadssetting","displayName":"Default automatic downloads setting","description":"Administrators can use this policy to control whether websites can perform multiple downloads successively. Individual site behavior can be managed using the AutomaticDownloadsAllowedForUrls and AutomaticDownloadsBlockedForUrls policies.\n\nDefault behavior:\n\n- A user gesture is required for each additional download.\n\n- Users can modify their browser settings to disable successive downloads.\n\nPolicy options mapping:\n\n* AllowAutomaticDownloads (1) = Allow all websites to perform multiple downloads without requiring a user gesture between each download.\n\n* BlockAutomaticDownloads (2) = Prevent all websites from performing multiple downloads, even after a user gesture.\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultautomaticdownloadssetting_allowautomaticdownloads","displayName":"Allow all websites to perform multiple downloads without requiring a user gesture between each download.","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultautomaticdownloadssetting_blockautomaticdownloads","displayName":"Prevent all websites from performing multiple downloads, even after a user gesture.","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultclipboardsetting","displayName":"Default clipboard site permission","description":"This policy controls the default value for the clipboard site permission.\n\nSetting the policy to 2 blocks sites from using the clipboard site permission.\n\nSetting the policy to 3 or leaving it unset lets the user change the setting and decide if the clipboard APIs are available when a site wants to use an API.\n\nThis policy can be overridden for specific URL patterns using the \"ClipboardAllowedForUrls\" and \"ClipboardBlockedForUrls\" policies.\n\nThis policy only affects clipboard operations controlled by the clipboard site permission and doesn't affect sanitized clipboard writes or trusted copy and paste operations.\n\nPolicy options mapping:\n\n* BlockClipboard (2) = Do not allow any site to use the clipboard site permission\n\n* AskClipboard (3) = Allow sites to ask the user to grant the clipboard site permission\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultclipboardsetting_blockclipboard","displayName":"Do not allow any site to use the clipboard site permission","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultclipboardsetting_askclipboard","displayName":"Allow sites to ask the user to grant the clipboard site permission","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultcookiessetting","displayName":"Configure cookies","description":"Control whether websites can create cookies on the user's device. This policy is all or nothing - you can let all websites create cookies, or no websites create cookies. You can't use this policy to enable cookies from specific websites.\n\nSet the policy to 'SessionOnly' to clear cookies when the session closes.\n\nIf you don't configure this policy, the default 'AllowCookies' is used, and users can change this setting in Microsoft Edge Settings. (If you don't want users to be able to change this setting, set the policy.)\n\nPolicy options mapping:\n\n* AllowCookies (1) = Let all sites create cookies\n\n* BlockCookies (2) = Don't let any site create cookies\n\n* SessionOnly (4) = Keep cookies for the duration of the session, except ones listed in \"SaveCookiesOnExit\"\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultcookiessetting_allowcookies","displayName":"Let all sites create cookies","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultcookiessetting_blockcookies","displayName":"Don't let any site create cookies","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultcookiessetting_sessiononly","displayName":"Keep cookies for the duration of the session, except ones listed in \"SaveCookiesOnExit\"","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultfilesystemreadguardsetting","displayName":"Control use of the File System API for reading","description":"If you set this policy to 3, websites can ask for read access to the host operating system's filesystem using the File System API. If you set this policy to 2, access is denied.\n\nIf you don't set this policy, websites can ask for access. Users can change this setting.\n\nPolicy options mapping:\n\n* BlockFileSystemRead (2) = Don't allow any site to request read access to files and directories via the File System API\n\n* AskFileSystemRead (3) = Allow sites to ask the user to grant read access to files and directories via the File System API\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultfilesystemreadguardsetting_blockfilesystemread","displayName":"Don't allow any site to request read access to files and directories via the File System API","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultfilesystemreadguardsetting_askfilesystemread","displayName":"Allow sites to ask the user to grant read access to files and directories via the File System API","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultfilesystemwriteguardsetting","displayName":"Control use of the File System API for writing","description":"If you set this policy to 3, websites can ask for write access to the host operating system's filesystem using the File System API. If you set this policy to 2, access is denied.\n\nIf you don't set this policy, websites can ask for access. Users can change this setting.\n\nPolicy options mapping:\n\n* BlockFileSystemWrite (2) = Don't allow any site to request write access to files and directories\n\n* AskFileSystemWrite (3) = Allow sites to ask the user to grant write access to files and directories\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultfilesystemwriteguardsetting_blockfilesystemwrite","displayName":"Don't allow any site to request write access to files and directories","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultfilesystemwriteguardsetting_askfilesystemwrite","displayName":"Allow sites to ask the user to grant write access to files and directories","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultgeolocationsetting","displayName":"Default geolocation setting","description":"Set whether websites can track users' physical locations. You can allow tracking by default ('AllowGeolocation'), deny it by default ('BlockGeolocation'), or ask the user each time a website requests their location ('AskGeolocation').\n\nIf you don't configure this policy, 'AskGeolocation' is used and the user can change it.\n\nPolicy options mapping:\n\n* AllowGeolocation (1) = Allow sites to track users' physical location\n\n* BlockGeolocation (2) = Don't allow any site to track users' physical location\n\n* AskGeolocation (3) = Ask whenever a site wants to track users' physical location\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultgeolocationsetting_allowgeolocation","displayName":"Allow sites to track users' physical location","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultgeolocationsetting_blockgeolocation","displayName":"Don't allow any site to track users' physical location","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultgeolocationsetting_askgeolocation","displayName":"Ask whenever a site wants to track users' physical location","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultidledetectionsetting","displayName":"Default idle detection setting","description":"Setting this policy to 1 - AllowIdleDetection allows websites to use the Idle Detection API without requesting user permission.\n\nSetting this policy to 2 - BlockIdleDetection prevents websites from using the Idle Detection API.\n\nSetting this policy to 3 - AskIdleDetection requires websites to request user permission each time before using the Idle Detection API.\n\nIf you do not configure this policy, users can decide whether to allow the Idle Detection API and can change this setting themselves.\n\nPolicy options mapping:\n\n* AllowIdleDetection (1) = Allow sites to detect idle state without asking the user\n\n* BlockIdleDetection (2) = Do not allow any site to detect the user's idle state\n\n* AskIdleDetection (3) = Ask every time a site wants to detect the user's idle state\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultidledetectionsetting_allowidledetection","displayName":"Allow sites to detect idle state without asking the user","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultidledetectionsetting_blockidledetection","displayName":"Do not allow any site to detect the user's idle state","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultidledetectionsetting_askidledetection","displayName":"Ask every time a site wants to detect the user's idle state","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultimagessetting","displayName":"Default images setting","description":"Set whether websites can display images. You can allow images on all sites ('AllowImages') or block them on all sites ('BlockImages').\n\nIf you don't configure this policy, images are allowed by default, and the user can change this setting.\n\nPolicy options mapping:\n\n* AllowImages (1) = Allow all sites to show all images\n\n* BlockImages (2) = Don't allow any site to show images\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultimagessetting_allowimages","displayName":"Allow all sites to show all images","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultimagessetting_blockimages","displayName":"Don't allow any site to show images","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultinsecurecontentsetting","displayName":"Control use of insecure content exceptions","description":"Allows you to set whether users can add exceptions to allow mixed content for specific sites.\n\nThis policy can be overridden for specific URL patterns using the \"InsecureContentAllowedForUrls\" and \"InsecureContentBlockedForUrls\" policies.\n\nIf this policy isn't set, users will be allowed to add exceptions to allow blockable mixed content and disable autoupgrades for optionally blockable mixed content.\n\nPolicy options mapping:\n\n* BlockInsecureContent (2) = Do not allow any site to load mixed content\n\n* AllowExceptionsInsecureContent (3) = Allow users to add exceptions to allow mixed content\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultinsecurecontentsetting_blockinsecurecontent","displayName":"Do not allow any site to load mixed content","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultinsecurecontentsetting_allowexceptionsinsecurecontent","displayName":"Allow users to add exceptions to allow mixed content","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultjavascriptjitsetting","displayName":"Control use of JavaScript JIT","description":"Allows you to set whether Microsoft Edge will run the v8 JavaScript engine with JIT (Just In Time) compiler enabled or not.\n\nDisabling the JavaScript JIT will mean that Microsoft Edge may render web content more slowly, and may also disable parts of JavaScript including WebAssembly. Disabling the JavaScript JIT may allow Microsoft Edge to render web content in a more secure configuration.\n\nThis policy can be overridden for specific URL patterns using the \"JavaScriptJitAllowedForSites\" and \"JavaScriptJitBlockedForSites\" policies.\n\nIf you don't configure this policy, JavaScript JIT is enabled.\n\nPolicy options mapping:\n\n* AllowJavaScriptJit (1) = Allow any site to run JavaScript JIT\n\n* BlockJavaScriptJit (2) = Do not allow any site to run JavaScript JIT\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultjavascriptjitsetting_allowjavascriptjit","displayName":"Allow any site to run JavaScript JIT","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultjavascriptjitsetting_blockjavascriptjit","displayName":"Do not allow any site to run JavaScript JIT","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultjavascriptoptimizersetting","displayName":"Control use of JavaScript optimizers","description":"Allows you to set whether Microsoft Edge will run the v8 JavaScript engine with more advanced JavaScript optimizations enabled.\n\nDisabling JavaScript optimizations (by setting this policy's value to 2) will mean that Microsoft Edge may render web content more slowly.\n\nThis policy can be overridden for specific URL patterns using the \"JavaScriptOptimizerAllowedForSites\" and \"JavaScriptOptimizerBlockedForSites\" policies.\n\nIf you don't configure this policy, JavaScript optimizations are enabled.\n\nPolicy options mapping:\n\n* AllowJavaScriptOptimizer (1) = Enable advanced JavaScript optimizations on all sites\n\n* BlockJavaScriptOptimizer (2) = Disable advanced JavaScript optimizations on all sites\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultjavascriptoptimizersetting_allowjavascriptoptimizer","displayName":"Enable advanced JavaScript optimizations on all sites","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultjavascriptoptimizersetting_blockjavascriptoptimizer","displayName":"Disable advanced JavaScript optimizations on all sites","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultjavascriptsetting","displayName":"Default JavaScript setting","description":"Set whether websites can run JavaScript. You can allow it for all sites ('AllowJavaScript') or block it for all sites ('BlockJavaScript').\n\nIf you don't configure this policy, all sites can run JavaScript by default, and the user can change this setting.\n\nPolicy options mapping:\n\n* AllowJavaScript (1) = Allow all sites to run JavaScript\n\n* BlockJavaScript (2) = Don't allow any site to run JavaScript\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultjavascriptsetting_allowjavascript","displayName":"Allow all sites to run JavaScript","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultjavascriptsetting_blockjavascript","displayName":"Don't allow any site to run JavaScript","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultnotificationssetting","displayName":"Default notification setting","description":"Set whether websites can display desktop notifications. You can allow them by default ('AllowNotifications'), deny them by default ('BlockNotifications'), or have the user be asked each time a website wants to show a notification ('AskNotifications').\n\nIf you don't configure this policy, notifications are allowed by default, and the user can change this setting.\n\nPolicy options mapping:\n\n* AllowNotifications (1) = Allow sites to show desktop notifications\n\n* BlockNotifications (2) = Don't allow any site to show desktop notifications\n\n* AskNotifications (3) = Ask every time a site wants to show desktop notifications\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultnotificationssetting_allownotifications","displayName":"Allow sites to show desktop notifications","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultnotificationssetting_blocknotifications","displayName":"Don't allow any site to show desktop notifications","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultnotificationssetting_asknotifications","displayName":"Ask every time a site wants to show desktop notifications","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultpluginssetting","displayName":"Default Adobe Flash setting (Obsolete)","description":"This policy doesn't work because Flash is no longer supported by Microsoft Edge.\n\n\"PluginsAllowedForUrls\" and \"PluginsBlockedForUrls\" are checked first, then this policy. The options are 'ClickToPlay' and 'BlockPlugins'. If you set this policy to 'BlockPlugins', this plugin is denied for all websites. 'ClickToPlay' lets the Flash plugin run, but users click the placeholder to start it.\n\nIf you don't configure this policy, the user can change this setting manually.\n\nNote: Automatic playback is only for domains explicitly listed in the \"PluginsAllowedForUrls\" policy. To turn automatic playback on for all sites, add http://* and https://* to the allowed list of URLs.\n\nPolicy options mapping:\n\n* BlockPlugins (2) = Block the Adobe Flash plugin\n\n* ClickToPlay (3) = Click to play\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultpluginssetting_blockplugins","displayName":"Block the Adobe Flash plugin","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultpluginssetting_clicktoplay","displayName":"Click to play","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultpopupssetting","displayName":"Default pop-up window setting","description":"Set whether websites can show pop-up windows. You can allow them on all websites ('AllowPopups') or block them on all sites ('BlockPopups').\n\nIf you don't configure this policy, pop-up windows are blocked by default, and users can change this setting.\n\nPolicy options mapping:\n\n* AllowPopups (1) = Allow all sites to show pop-ups\n\n* BlockPopups (2) = Do not allow any site to show popups\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultpopupssetting_allowpopups","displayName":"Allow all sites to show pop-ups","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultpopupssetting_blockpopups","displayName":"Do not allow any site to show popups","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultprinterselection","displayName":"Default printer selection rules","description":"Overrides Microsoft Edge default printer selection rules. This policy determines the rules for selecting the default printer in Microsoft Edge, which happens the first time a user tries to print a page.\n\nWhen this policy is set, Microsoft Edge tries to find a printer that matches all of the specified attributes and uses it as default printer. If there are multiple printers that meet the criteria, the first printer that matches is used.\n\nIf you don't configure this policy or no matching printers are found within the timeout, the printer defaults to the built-in PDF printer or no printer, if the PDF printer isn't available.\n\nThe value is parsed as a JSON object, conforming to the following schema: { \"type\": \"object\", \"properties\": { \"idPattern\": { \"description\": \"Regular expression to match printer id.\", \"type\": \"string\" }, \"namePattern\": { \"description\": \"Regular expression to match printer display name.\", \"type\": \"string\" } } }\n\nOmitting a field means all values match; for example, if you don't specify connectivity Print Preview starts discovering all kinds of local printers. Regular expression patterns must follow the JavaScript RegExp syntax and matches are case sensitive.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchprovidercontextmenuaccessallowed","displayName":"Allow default search provider context menu search access","description":"Enables the use of a default search provider on the context menu.\n\nIf you set this policy to disabled the search context menu item that relies on your default search provider and sidebar search will not be available.\n\nIf this policy is set to enabled or not set, the context menu item for your default search provider and sidebar search will be available.\n\nThe policy value is only applied when the \"DefaultSearchProviderEnabled\" policy is enabled, and is not applicable otherwise.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchprovidercontextmenuaccessallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchprovidercontextmenuaccessallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchproviderenabled","displayName":"Enable the default search provider","description":"Enables the ability to use a default search provider.\n\nIf you enable this policy, a user can search for a term by typing in the address bar (as long as what they type isn't a URL).\n\nYou can specify the default search provider to use by enabling the rest of the default search policies. If these are left empty (not configured) or configured incorrectly, the user can choose the default provider.\n\nIf you disable this policy, the user can't search from the address bar.\n\nIf you enable or disable this policy, users can't change or override it.\n\nIf you don't configure this policy, the default search provider is enabled, and the user can choose the default search provider and set the search provider list.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is available only on instances that are managed via MDM or joined to a domain via MCX.\n\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchproviderenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchproviderenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchproviderenabled_recommended","displayName":"Enable the default search provider (users can override)","description":"Enables the ability to use a default search provider.\n\nIf you enable this policy, a user can search for a term by typing in the address bar (as long as what they type isn't a URL).\n\nYou can specify the default search provider to use by enabling the rest of the default search policies. If these are left empty (not configured) or configured incorrectly, the user can choose the default provider.\n\nIf you disable this policy, the user can't search from the address bar.\n\nIf you enable or disable this policy, users can't change or override it.\n\nIf you don't configure this policy, the default search provider is enabled, and the user can choose the default search provider and set the search provider list.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is available only on instances that are managed via MDM or joined to a domain via MCX.\n\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchproviderenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchproviderenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchproviderencodings","displayName":"Default search provider encodings","description":"Specify the character encodings supported by the search provider. Encodings are code page names like UTF-8, GB2312, and ISO-8859-1. They're tried in the order provided.\n\nThis policy is optional. If not configured, the default, UTF-8, is used.\n\nThis policy is applied only if you enable the \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\" policies.\n\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy won't be added to the list of search providers the user can choose from. If this is the desired behavior, use the \"ManagedSearchEngines\" policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchproviderencodings_recommended","displayName":"Default search provider encodings (users can override)","description":"Specify the character encodings supported by the search provider. Encodings are code page names like UTF-8, GB2312, and ISO-8859-1. They're tried in the order provided.\n\nThis policy is optional. If not configured, the default, UTF-8, is used.\n\nThis policy is applied only if you enable the \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\" policies.\n\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy won't be added to the list of search providers the user can choose from. If this is the desired behavior, use the \"ManagedSearchEngines\" policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchproviderimageurl","displayName":"Specifies the search-by-image feature for the default search provider","description":"Specifies the URL to the search engine used for image search. Search requests are sent using the GET method.\n\nThis policy is optional. If you don't configure it, image search isn't available.\n\nSpecify Bing's Image Search URL as:\n'{bing:baseURL}images/detail/search?iss=sbiupload&FORM=ANCMS1#enterInsights'.\n\nSpecify Google's Image Search URL as: '{google:baseURL}searchbyimage/upload'.\n\nSee \"DefaultSearchProviderImageURLPostParams\" policy to finish configuring image search.\n\nThis policy is applied only if you enable the \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\" policies.\n\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the \"ManagedSearchEngines\" policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchproviderimageurl_recommended","displayName":"Specifies the search-by-image feature for the default search provider (users can override)","description":"Specifies the URL to the search engine used for image search. Search requests are sent using the GET method.\n\nThis policy is optional. If you don't configure it, image search isn't available.\n\nSpecify Bing's Image Search URL as:\n'{bing:baseURL}images/detail/search?iss=sbiupload&FORM=ANCMS1#enterInsights'.\n\nSpecify Google's Image Search URL as: '{google:baseURL}searchbyimage/upload'.\n\nSee \"DefaultSearchProviderImageURLPostParams\" policy to finish configuring image search.\n\nThis policy is applied only if you enable the \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\" policies.\n\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the \"ManagedSearchEngines\" policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchproviderimageurlpostparams","displayName":"Parameters for an image URL that uses POST","description":"If you enable this policy, it specifies the parameters used when an image search that uses POST is performed. The policy consists of comma-separated name/value pairs. If a value is a template parameter, like {imageThumbnail} in the preceding example, it's replaced with real image thumbnail data. This policy is applied only if you enable the \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\" policies.\n\nSpecify Bing's Image Search URL Post Params as:\n'imageBin={google:imageThumbnailBase64}'.\n\nSpecify Google's Image Search URL Post Params as:\n'encoded_image={google:imageThumbnail},image_url={google:imageURL},sbisrc={google:imageSearchSource},original_width={google:imageOriginalWidth},original_height={google:imageOriginalHeight}'.\n\nIf you don't set this policy, image search requests are sent using the GET method.\n\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the \"ManagedSearchEngines\" policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchproviderimageurlpostparams_recommended","displayName":"Parameters for an image URL that uses POST (users can override)","description":"If you enable this policy, it specifies the parameters used when an image search that uses POST is performed. The policy consists of comma-separated name/value pairs. If a value is a template parameter, like {imageThumbnail} in the preceding example, it's replaced with real image thumbnail data. This policy is applied only if you enable the \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\" policies.\n\nSpecify Bing's Image Search URL Post Params as:\n'imageBin={google:imageThumbnailBase64}'.\n\nSpecify Google's Image Search URL Post Params as:\n'encoded_image={google:imageThumbnail},image_url={google:imageURL},sbisrc={google:imageSearchSource},original_width={google:imageOriginalWidth},original_height={google:imageOriginalHeight}'.\n\nIf you don't set this policy, image search requests are sent using the GET method.\n\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the \"ManagedSearchEngines\" policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchproviderkeyword","displayName":"Default search provider keyword","description":"Specifies the keyword, which is the shortcut used in the Address Bar to trigger the search for this provider.\n\nThis policy is optional. If you don't configure it, no keyword activates the search provider.\n\nThis policy is applied only if you enable the \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\" policies.\n\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the \"ManagedSearchEngines\" policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchproviderkeyword_recommended","displayName":"Default search provider keyword (users can override)","description":"Specifies the keyword, which is the shortcut used in the Address Bar to trigger the search for this provider.\n\nThis policy is optional. If you don't configure it, no keyword activates the search provider.\n\nThis policy is applied only if you enable the \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\" policies.\n\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the \"ManagedSearchEngines\" policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchprovidername","displayName":"Default search provider name","description":"Specifies the name of the default search provider.\n\nIf you enable this policy, you set the name of the default search provider.\n\nIf you don't enable this policy or if you leave it empty, the host name specified by the search URL is used.\n\n'DefaultSearchProviderName' should be set to an organization-approved encrypted search provider that corresponds to the encrypted search provider set in DTBC-0008. This policy is applied only if you enable the \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\" policies.\n\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the \"ManagedSearchEngines\" policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchprovidername_recommended","displayName":"Default search provider name (users can override)","description":"Specifies the name of the default search provider.\n\nIf you enable this policy, you set the name of the default search provider.\n\nIf you don't enable this policy or if you leave it empty, the host name specified by the search URL is used.\n\n'DefaultSearchProviderName' should be set to an organization-approved encrypted search provider that corresponds to the encrypted search provider set in DTBC-0008. This policy is applied only if you enable the \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\" policies.\n\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the \"ManagedSearchEngines\" policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchprovidersearchurl","displayName":"Default search provider search URL","description":"Specifies the URL of the search engine used for a default search. The URL contains the string '{searchTerms}', which is replaced at query time by the terms the user is searching for.\n\nSpecify Bing's search URL as:\n\n'{bing:baseURL}search?q={searchTerms}'.\n\nSpecify Google's search URL as: '{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}ie={inputEncoding}'.\n\nThis policy is required when you enable the \"DefaultSearchProviderEnabled\" policy; if you don't enable the latter policy, this policy is ignored.\n\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy won't be added to the list of search providers the user can choose from. If this is the desired behavior, use the \"ManagedSearchEngines\" policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchprovidersearchurl_recommended","displayName":"Default search provider search URL (users can override)","description":"Specifies the URL of the search engine used for a default search. The URL contains the string '{searchTerms}', which is replaced at query time by the terms the user is searching for.\n\nSpecify Bing's search URL as:\n\n'{bing:baseURL}search?q={searchTerms}'.\n\nSpecify Google's search URL as: '{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}ie={inputEncoding}'.\n\nThis policy is required when you enable the \"DefaultSearchProviderEnabled\" policy; if you don't enable the latter policy, this policy is ignored.\n\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy won't be added to the list of search providers the user can choose from. If this is the desired behavior, use the \"ManagedSearchEngines\" policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchprovidersuggesturl","displayName":"Default search provider URL for suggestions","description":"Specifies the URL for the search engine used to provide search suggestions. The URL contains the string '{searchTerms}', which is replaced at query time by the text the user has entered so far.\n\nThis policy is optional. If you don't configure it, users won't see search suggestions; they will see suggestions from their browsing history and favorites.\n\nBing's suggest URL can be specified as:\n\n'{bing:baseURL}qbox?query={searchTerms}'.\n\nGoogle's suggest URL can be specified as: '{google:baseURL}complete/search?output=chrome&q={searchTerms}'.\n\nThis policy is applied only if you enable the \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\" policies.\n\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the \"ManagedSearchEngines\" policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsearchprovidersuggesturl_recommended","displayName":"Default search provider URL for suggestions (users can override)","description":"Specifies the URL for the search engine used to provide search suggestions. The URL contains the string '{searchTerms}', which is replaced at query time by the text the user has entered so far.\n\nThis policy is optional. If you don't configure it, users won't see search suggestions; they will see suggestions from their browsing history and favorites.\n\nBing's suggest URL can be specified as:\n\n'{bing:baseURL}qbox?query={searchTerms}'.\n\nGoogle's suggest URL can be specified as: '{google:baseURL}complete/search?output=chrome&q={searchTerms}'.\n\nThis policy is applied only if you enable the \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\" policies.\n\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the \"ManagedSearchEngines\" policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsensorssetting","displayName":"Default sensors setting","description":"Set whether websites can access and use sensors such as motion and light sensors. You can completely block or allow websites to get access to sensors.\n\nSetting the policy to 1 lets websites access and use sensors. Setting the policy to 2 denies access to sensors.\n\nYou can override this policy for specific URL patterns by using the \"SensorsAllowedForUrls\" and \"SensorsBlockedForUrls\" policies.\n\nIf you don't configure this policy, websites can access and use sensors, and users can change this setting. This is the global default for \"SensorsAllowedForUrls\" and \"SensorsBlockedForUrls\".\n\nPolicy options mapping:\n\n* AllowSensors (1) = Allow sites to access sensors\n\n* BlockSensors (2) = Do not allow any site to access sensors\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsensorssetting_allowsensors","displayName":"Allow sites to access sensors","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultsensorssetting_blocksensors","displayName":"Do not allow any site to access sensors","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultserialguardsetting","displayName":"Control use of the Serial API","description":"Set whether websites can access serial ports. You can completely block access or ask the user each time a website wants to get access to a serial port.\n\nSetting the policy to 3 lets websites ask for access to serial ports. Setting the policy to 2 denies access to serial ports.\n\nYou can override this policy for specific URL patterns by using the \"SerialAskForUrls\" and \"SerialBlockedForUrls\" policies.\n\nIf you don't configure this policy, by default, websites can ask users whether they can access a serial port, and users can change this setting.\n\nPolicy options mapping:\n\n* BlockSerial (2) = Do not allow any site to request access to serial ports via the Serial API\n\n* AskSerial (3) = Allow sites to ask for user permission to access a serial port\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultserialguardsetting_blockserial","displayName":"Do not allow any site to request access to serial ports via the Serial API","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultserialguardsetting_askserial","displayName":"Allow sites to ask for user permission to access a serial port","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultshareadditionalosregionsetting","displayName":"Set the default \"share additional operating system region\" setting","description":"This policy controls the default value for the \"share additional operating system region\" setting in Microsoft Edge.\n\nThe \"share additional operating system region\" Microsoft Edge setting controls whether the OS Regional format setting will be shared with the web through the default JavaScript locale. If shared, websites will be able to query the OS Regional format using JavaScript code, for example; \"Intl.DateTimeFormat().resolvedOptions().locale\". The default value for the setting is \"Limited\".\n\nIf you set this policy to \"Limited\", the OS Regional format will only be shared if its language part matches the Microsoft Edge display language.\n\nIf you set this policy to \"Always\", the OS Regional format will always be shared. This value could cause unexpected website behavior if the OS Regional format language is different from the Microsoft Edge display language. For example, if a website uses the JavaScript default locale to format dates, the names of the days and months can be displayed in one language while the surrounding text is displayed in another language.\n\nIf you set this policy to \"Never\", the OS Regional format will never be shared.\n\nExample 1: In this example the OS Regional format is set to \"en-GB\" and the browser display language is set to \"en-US\". Then the OS Regional format will be shared if the policy is set to \"Limited\", or \"Always\".\n\nExample 2: In this example the OS Regional format is set to \"es-MX\" and the browser display language is set to \"en-US\". Then the OS Regional format will be shared if the policy is set to \"Always\" but will not if the policy is set to \"Limited\".\n\nFor more information about this setting, see https://go.microsoft.com/fwlink/?linkid=2222282\n\nPolicy options mapping:\n\n* Limited (0) = Limited\n\n* Always (1) = Always share the OS Regional format\n\n* Never (2) = Never share the OS Regional format\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultshareadditionalosregionsetting_limited","displayName":"Limited","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultshareadditionalosregionsetting_always","displayName":"Always share the OS Regional format","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultshareadditionalosregionsetting_never","displayName":"Never share the OS Regional format","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultshareadditionalosregionsetting_recommended","displayName":"Set the default \"share additional operating system region\" setting (users can override)","description":"This policy controls the default value for the \"share additional operating system region\" setting in Microsoft Edge.\n\nThe \"share additional operating system region\" Microsoft Edge setting controls whether the OS Regional format setting will be shared with the web through the default JavaScript locale. If shared, websites will be able to query the OS Regional format using JavaScript code, for example; \"Intl.DateTimeFormat().resolvedOptions().locale\". The default value for the setting is \"Limited\".\n\nIf you set this policy to \"Limited\", the OS Regional format will only be shared if its language part matches the Microsoft Edge display language.\n\nIf you set this policy to \"Always\", the OS Regional format will always be shared. This value could cause unexpected website behavior if the OS Regional format language is different from the Microsoft Edge display language. For example, if a website uses the JavaScript default locale to format dates, the names of the days and months can be displayed in one language while the surrounding text is displayed in another language.\n\nIf you set this policy to \"Never\", the OS Regional format will never be shared.\n\nExample 1: In this example the OS Regional format is set to \"en-GB\" and the browser display language is set to \"en-US\". Then the OS Regional format will be shared if the policy is set to \"Limited\", or \"Always\".\n\nExample 2: In this example the OS Regional format is set to \"es-MX\" and the browser display language is set to \"en-US\". Then the OS Regional format will be shared if the policy is set to \"Always\" but will not if the policy is set to \"Limited\".\n\nFor more information about this setting, see https://go.microsoft.com/fwlink/?linkid=2222282\n\nPolicy options mapping:\n\n* Limited (0) = Limited\n\n* Always (1) = Always share the OS Regional format\n\n* Never (2) = Never share the OS Regional format\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultshareadditionalosregionsetting_recommended_limited","displayName":"Limited","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultshareadditionalosregionsetting_recommended_always","displayName":"Always share the OS Regional format","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultshareadditionalosregionsetting_recommended_never","displayName":"Never share the OS Regional format","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultthirdpartystoragepartitioningsetting","displayName":"Default setting for third-party storage partitioning (Deprecated)","description":"This policy controls whether third-party storage partitioning is allowed by default.\n\nIf this policy is set to 1 - AllowPartitioning, or unset, third-party storage partitioning will be allowed by default. This default may be overridden for specific top-level origins by other means.\n\nIf this policy is set to 2 - BlockPartitioning, third-party storage partitioning will be disabled for all contexts.\n\nUse ThirdPartyStoragePartitioningBlockedForOrigins to disable third-party storage partitioning for specific top-level origins.\n\nThis feature will be removed starting in Microsoft Edge version 145. To ensure compatibility, use the requestStorageAccess method instead. For more information, see https://developer.mozilla.org/en-US/docs/Web/API/Document/requestStorageAccess.\n\nPolicy options mapping:\n\n* AllowPartitioning (1) = Allow third-party storage partitioning by default.\n\n* BlockPartitioning (2) = Disable third-party storage partitioning.\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultthirdpartystoragepartitioningsetting_allowpartitioning","displayName":"Allow third-party storage partitioning by default.","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultthirdpartystoragepartitioningsetting_blockpartitioning","displayName":"Disable third-party storage partitioning.","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultwebbluetoothguardsetting","displayName":"Control use of the Web Bluetooth API","description":"Control whether websites can access nearby Bluetooth devices. You can completely block access or require the site to ask the user each time it wants to access a Bluetooth device.\n\nIf you don't configure this policy, the default value ('AskWebBluetooth', meaning users are asked each time) is used and users can change it.\n\nPolicy options mapping:\n\n* BlockWebBluetooth (2) = Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API\n\n* AskWebBluetooth (3) = Allow sites to ask the user to grant access to a nearby Bluetooth device\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultwebbluetoothguardsetting_blockwebbluetooth","displayName":"Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultwebbluetoothguardsetting_askwebbluetooth","displayName":"Allow sites to ask the user to grant access to a nearby Bluetooth device","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultwebhidguardsetting","displayName":"Control use of the WebHID API","description":"Setting the policy to 3 lets websites ask for access to HID devices. Setting the policy to 2 denies access to HID devices.\n\nLeaving it unset lets websites ask for access, but users can change this setting.\n\nThis policy can be overridden for specific url patterns using the \"WebHidAskForUrls\" and \"WebHidBlockedForUrls\" policies.\n\nPolicy options mapping:\n\n* BlockWebHid (2) = Do not allow any site to request access to HID devices via the WebHID API\n\n* AskWebHid (3) = Allow sites to ask the user to grant access to a HID device\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultwebhidguardsetting_blockwebhid","displayName":"Do not allow any site to request access to HID devices via the WebHID API","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultwebhidguardsetting_askwebhid","displayName":"Allow sites to ask the user to grant access to a HID device","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultwebusbguardsetting","displayName":"Control use of the WebUSB API","description":"Set whether websites can access connected USB devices. You can completely block access or ask the user each time a website wants to get access to connected USB devices.\n\nYou can override this policy for specific URL patterns by using the \"WebUsbAskForUrls\" and \"WebUsbBlockedForUrls\" policies.\n\nIf you don't configure this policy, sites can ask users whether they can access the connected USB devices ('AskWebUsb') by default, and users can change this setting.\n\nPolicy options mapping:\n\n* BlockWebUsb (2) = Do not allow any site to request access to USB devices via the WebUSB API\n\n* AskWebUsb (3) = Allow sites to ask the user to grant access to a connected USB device\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultwebusbguardsetting_blockwebusb","displayName":"Do not allow any site to request access to USB devices via the WebUSB API","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultwebusbguardsetting_askwebusb","displayName":"Allow sites to ask the user to grant access to a connected USB device","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultwindowmanagementsetting","displayName":"Default Window Management permission setting","description":"Setting the policy to \"BlockWindowManagement\" (value 2) automatically denies the window management permission to sites by default. This limits the ability of sites to see information about the device's screens and use that information to open and place windows or request fullscreen on specific screens.\n\nSetting the policy to \"AskWindowManagement\" (value 3) by default prompts the user when the window management permission is requested. If users allow the permission, it extends the ability of sites to see information about the device's screens and use that information to open and place windows or request fullscreen on specific screens.\n\nNot configuring the policy means the \"AskWindowManagement\" policy applies, but users can change this setting.\n\nPolicy options mapping:\n\n* BlockWindowManagement (2) = Denies the Window Management permission on all sites by default\n\n* AskWindowManagement (3) = Ask every time a site wants obtain the Window Management permission\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultwindowmanagementsetting_blockwindowmanagement","displayName":"Denies the Window Management permission on all sites by default","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.defaultwindowmanagementsetting_askwindowmanagement","displayName":"Ask every time a site wants obtain the Window Management permission","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.definepreferredlanguages","displayName":"Define an ordered list of preferred languages that websites should display in if the site supports the language","description":"Configures the language variants that Microsoft Edge sends to websites as part of the Accept-Language request HTTP header and prevents users from adding, removing, or changing the order of preferred languages in Microsoft Edge settings. Users who want to change the languages Microsoft Edge displays in or offers to translate pages to will be limited to the languages configured in this policy.\n\nIf you enable this policy, websites will appear in the first language in the list that they support unless other site-specific logic is used to determine the display language. The language variants defined in this policy override the languages configured as part of the \"SpellcheckLanguage\" policy.\n\nIf you don't configure or disable this policy, Microsoft Edge sends websites the user-specified preferred languages as part of the Accept-Language request HTTP header.\n\nFor detailed information on valid language variants, see https://go.microsoft.com/fwlink/?linkid=2148854.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.delaynavigationsforinitialsitelistdownload","displayName":"Require that the Enterprise Mode Site List is available before tab navigation","description":"Lets you specify whether Microsoft Edge tabs wait to navigate until the browser has downloaded the initial Enterprise Mode Site List. This setting is intended for the scenario where the browser home page should load in Internet Explorer mode, and it is important that is does so on browser first run after IE mode is enabled. If this scenario does not exist, we recommend not enabling this setting because it can negatively impact the performance of loading the home page. The setting only applies when Microsoft Edge does not have a cached Enterprise Mode Site List, such as on browser first run after IE mode is enabled.\n\nThis setting works in conjunction with:\n\"InternetExplorerIntegrationLevel\" is set to 'IEMode'\nand one of either the\n\"InternetExplorerIntegrationSiteList\" or the \"InternetExplorerIntegrationCloudSiteList\" policy where the list has at least one entry.\n\nThe timeout behavior of this policy can be configured with the \"NavigationDelayForInitialSiteListDownloadTimeout\" policy.\n\nIf you set this policy to 'All', when Microsoft Edge does not have a cached version of the Enterprise Mode Site List, tabs delay navigating until the browser has downloaded the site list. Sites configured to open in Internet Explorer mode by the site list will load in Internet Explorer mode, even during the initial navigation of the browser. Sites that cannot possibly be configured to open in Internet Explorer, such as any site with a scheme other than http:, https:, file:, or ftp: do not delay navigating and load immediately in Edge mode.\n\nWhen used in conjunction with the \"InternetExplorerIntegrationCloudSiteList\" policy, during first launch of Microsoft Edge, there is a delay because implicit sign-in needs to finish before Microsoft Edge attempts to download the site list from the Microsoft cloud, since this requires authentication to the cloud service.\n\nIf you set this policy to 'None' or don't configure it, when Microsoft Edge does not have a cached version of the Enterprise Mode Site List, tabs will navigate immediately, and not wait for the browser to download the Enterprise Mode Site List. Sites configured to open in Internet Explorer mode by the site list will open in Microsoft Edge mode until the browser has finished downloading the Enterprise Mode Site List.\n\nPolicy options mapping:\n\n* None (0) = None\n\n* All (1) = All eligible navigations\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.delaynavigationsforinitialsitelistdownload_none","displayName":"None","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.delaynavigationsforinitialsitelistdownload_all","displayName":"All eligible navigations","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.deletingundecryptablepasswordsenabled","displayName":"Enable deleting undecryptable passwords","description":"This policy controls whether the built-in password manager can delete undecryptable passwords from its database. This is required to restore the full functionality of the built-in password manager, but it may include a permanent data loss. Undecryptable password values don't become decryptable on their own.\n\nIf fixing them is possible, it usually requires complex user actions.\n\nEnabling this policy or leaving it unset means that users with undecryptable passwords saved to the built-in password manager will lose them. Passwords that are still in a working state remain untouched.\n\nDisabling this policy means users will have their password manager data untouched but will experience a broken password manager functionality.\n\nIf the policy is set, users can't override it in Microsoft Edge.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.deletingundecryptablepasswordsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.deletingundecryptablepasswordsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.developertoolsavailability","displayName":"Control where developer tools can be used","description":"Control where developer tools can be used.\n\nIf you set this policy to 'DeveloperToolsDisallowedForForceInstalledExtensions' (the default), users can access the developer tools and the JavaScript console in general but not in the context of extensions installed by enterprise policy.\n\nIf you set this policy to 'DeveloperToolsAllowed', users can access the developer tools and the JavaScript console in all contexts, including extensions installed by enterprise policy.\n\nIf you set this policy to 'DeveloperToolsDisallowed', users can't access the developer tools or inspect website elements. Keyboard shortcuts and menu or context menu entries that open the developer tools or the JavaScript Console are disabled.\n\nAs of Microsoft Edge version 99, this setting also controls entry points for the 'View page source' feature. If you set this policy to 'DeveloperToolsDisallowed', users can't access source viewing via keyboard shortcut or the context menu. To fully block source viewing, you must also add 'view-source:*' to the \"URLBlocklist\" policy.\n\nAs of Microsoft Edge version 119, this setting also controls whether developer mode for Isolated Web Apps can be activated and used.\n\nAs of Microsoft Edge version 128, this setting won't control developer mode on extensions page if \"ExtensionDeveloperModeSettings\" policy is set.\n\nPolicy options mapping:\n\n* DeveloperToolsDisallowedForForceInstalledExtensions (0) = Block the developer tools on extensions installed by enterprise policy, allow in other contexts\n\n* DeveloperToolsAllowed (1) = Allow using the developer tools\n\n* DeveloperToolsDisallowed (2) = Don't allow using the developer tools\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.developertoolsavailability_developertoolsdisallowedforforceinstalledextensions","displayName":"Block the developer tools on extensions installed by enterprise policy, allow in other contexts","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.developertoolsavailability_developertoolsallowed","displayName":"Allow using the developer tools","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.developertoolsavailability_developertoolsdisallowed","displayName":"Don't allow using the developer tools","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.disable3dapis","displayName":"Disable support for 3D graphics APIs","description":"Prevent web pages from accessing the graphics processing unit (GPU). Specifically, web pages can't access the WebGL API and plug-ins can't use the Pepper 3D API.\n\nIf you don't configure or disable this policy, it potentially allows web pages to use the WebGL API and plug-ins to use the Pepper 3D API. Microsoft Edge might, by default, still require command line arguments to be passed in order to use these APIs.\n\nIf \"HardwareAccelerationModeEnabled\" policy is set to false, the setting for 'Disable3DAPIs' policy is ignored - it's the equivalent of setting 'Disable3DAPIs' policy to true.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.disable3dapis_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.disable3dapis_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.discoverpagecontextenabled","displayName":"Enable Discover access to page contents for AAD profiles (Obsolete)","description":"This policy has been obsoleted as of Edge 127. Two new Edge Policies have taken its place. Those policies are CopilotPageContext (Control Copilot access to page contents for AAD profiles), and CopilotCDPPageContext (Control Copilot with Commercial Data Protection access to page contents for AAD profiles).\n\nThis policy did not allow for separate control of Copilot and Copilot with Commercial Data Protection. The new policies allow separate control of these versions of Copilot. The new policies also allow admins to force-enable Copilot access to Edge page contents by enabling the policy, whereas DiscoverPageContextEnabled only allowed force-disabling of Copilot page access.\n\nThis policy controls Discover access to page contents for AAD profiles. Discover is an extension that hosts Bing Chat. In order to summarize pages and interact with text selections, it needs to be able to access the page contents. When enabled, page contents will be sent to Bing. This policy does not affect MSA profiles.\n\nIf you enable or don't configure this policy, Discover will have access to page contents.\n\nIf you disable this policy, Discover will not be able to access page contents.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.discoverpagecontextenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.discoverpagecontextenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.displaycapturepermissionspolicyenabled","displayName":"Specifies whether the display-capture permissions-policy is checked or skipped (Obsolete)","description":"This policy is obsolete. The policy was a temporary workaround for non-spec-compliant enterprise applications.\n\nThis policy stopped working in Microsoft Edge 107 and was obsoleted in Microsoft Edge 110.\n\nThe display-capture permissions-policy gates access to getDisplayMedia(),\nas per this spec:\nhttps://www.w3.org/TR/screen-capture/#feature-policy-integration\nHowever, if this policy is Disabled, this requirement is not enforced,\nand getDisplayMedia() is allowed from contexts that would otherwise be\nforbidden.\n\nIf you enable or don't configure this policy, sites can only call getDisplayMedia() from\ncontexts which are allowlisted by the display-capture permissions-policy.\n\nIf you disable this policy, sites can call getDisplayMedia() even from contexts\nwhich are not allowlisted by the display-capture permissions policy.\nNote that other restrictions may still apply.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.displaycapturepermissionspolicyenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.displaycapturepermissionspolicyenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.donotsilentlyblockprotocolsfromorigins","displayName":"Define a list of protocols that can not be silently blocked by anti-flood protection","description":"Allows you to create a list of protocols, and for each protocol an associated list of allowed origin patterns. These origins won't be silently blocked from launching an external application by anti-flood protection. The trailing separator shouldn't be included when listing the protocol. For example, list \"skype\" instead of \"skype:\" or \"skype://\".\n\nIf you configure this policy, a protocol will only be permitted to bypass being silently blocked by anti-flood protection if:\n\n- the protocol is listed\n\n- the origin of the site trying to launch the protocol matches one of the origin patterns in that protocol's allowed_origins list.\n\nIf either condition is false, the external protocol launch may be blocked by anti-flood protection.\n\nIf you don't configure this policy, no protocols can bypass being silently blocked.\n\nThe origin matching patterns use a similar format to those for the \"URLBlocklist\" policy, that are documented at https://go.microsoft.com/fwlink/?linkid=2095322.\n\nHowever, origin matching patterns for this policy cannot contain \"/path\" or \"@query\" elements. Any pattern that does contain a \"/path\" or \"@query\" element will be ignored.\n\nThis policy doesn't work as expected with file://* wildcards.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.doubleclickclosetabenabled","displayName":"Double Click feature in Microsoft Edge enabled (only available in China)","description":"This policy lets you configure the double click feature in Microsoft Edge.\n\nDouble Click lets users close a tab by double clicking the left mouse button.\n\nIf you enable or don't configure this policy, you can use the double click feature to close a tab on Microsoft Edge to start using this feature.\n\nIf you disable this policy, you can't use the double click feature in Microsoft Edge.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.doubleclickclosetabenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.doubleclickclosetabenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.downloaddirectory","displayName":"Set download directory","description":"Configures the directory to use when downloading files.\n\nIf you enable this policy, Microsoft Edge uses the provided directory regardless of whether the user has specified one or chosen to be prompted for download location every time. See https://go.microsoft.com/fwlink/?linkid=2095041 for a list of variables that can be used.\n\nIf you disable or don't configure this policy, the default download directory is used, and the user can change it.\n\nIf you set an invalid path, Microsoft Edge will default to the user's default download directory.\n\nIf the folder specified by the path doesn't exist, the download will trigger a prompt that asks the user where they want to save their download.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.downloaddirectory_recommended","displayName":"Set download directory (users can override)","description":"Configures the directory to use when downloading files.\n\nIf you enable this policy, Microsoft Edge uses the provided directory regardless of whether the user has specified one or chosen to be prompted for download location every time. See https://go.microsoft.com/fwlink/?linkid=2095041 for a list of variables that can be used.\n\nIf you disable or don't configure this policy, the default download directory is used, and the user can change it.\n\nIf you set an invalid path, Microsoft Edge will default to the user's default download directory.\n\nIf the folder specified by the path doesn't exist, the download will trigger a prompt that asks the user where they want to save their download.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.downloadrestrictions","displayName":"Allow download restrictions","description":"Configures the type of downloads that Microsoft Edge completely blocks, without letting users override the security decision.\n\nSet 'BlockDangerousDownloads' to allow all downloads except for those that carry Microsoft Defender SmartScreen warnings of known dangerous downloads or that have dangerous file type extensions.\n\nSet 'BlockPotentiallyDangerousDownloads' to allow all downloads except for those that carry Microsoft Defender SmartScreen warnings of potentially dangerous or unwanted downloads or that have dangerous file type extensions.\n\nSet 'BlockAllDownloads' to block all downloads.\n\nSet 'BlockMaliciousDownloads' to allow all downloads except for those that carry Microsoft Defender SmartScreen warnings of known malicious downloads.\n\nIf you don't configure this policy or set the 'DefaultDownloadSecurity' option, the downloads go through the usual security restrictions based on Microsoft Defender SmartScreen analysis results.\n\nNote that these restrictions apply to downloads from web page content, as well as the 'download link...' context menu option. These restrictions don't apply to saving or downloading the currently displayed page, nor do they apply to the Save as PDF option from the printing options.\n\nSee https://go.microsoft.com/fwlink/?linkid=2094934 for more info on Microsoft Defender SmartScreen.\n\nPolicy options mapping:\n\n* DefaultDownloadSecurity (0) = No special restrictions\n\n* BlockDangerousDownloads (1) = Block malicious downloads and dangerous file types\n\n* BlockPotentiallyDangerousDownloads (2) = Block potentially dangerous or unwanted downloads and dangerous file types\n\n* BlockAllDownloads (3) = Block all downloads\n\n* BlockMaliciousDownloads (4) = Block malicious downloads\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.downloadrestrictions_defaultdownloadsecurity","displayName":"No special restrictions","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.downloadrestrictions_blockdangerousdownloads","displayName":"Block malicious downloads and dangerous file types","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.downloadrestrictions_blockpotentiallydangerousdownloads","displayName":"Block potentially dangerous or unwanted downloads and dangerous file types","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.downloadrestrictions_blockalldownloads","displayName":"Block all downloads","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.downloadrestrictions_blockmaliciousdownloads","displayName":"Block malicious downloads","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.downloadrestrictions_recommended","displayName":"Allow download restrictions (users can override)","description":"Configures the type of downloads that Microsoft Edge completely blocks, without letting users override the security decision.\n\nSet 'BlockDangerousDownloads' to allow all downloads except for those that carry Microsoft Defender SmartScreen warnings of known dangerous downloads or that have dangerous file type extensions.\n\nSet 'BlockPotentiallyDangerousDownloads' to allow all downloads except for those that carry Microsoft Defender SmartScreen warnings of potentially dangerous or unwanted downloads or that have dangerous file type extensions.\n\nSet 'BlockAllDownloads' to block all downloads.\n\nSet 'BlockMaliciousDownloads' to allow all downloads except for those that carry Microsoft Defender SmartScreen warnings of known malicious downloads.\n\nIf you don't configure this policy or set the 'DefaultDownloadSecurity' option, the downloads go through the usual security restrictions based on Microsoft Defender SmartScreen analysis results.\n\nNote that these restrictions apply to downloads from web page content, as well as the 'download link...' context menu option. These restrictions don't apply to saving or downloading the currently displayed page, nor do they apply to the Save as PDF option from the printing options.\n\nSee https://go.microsoft.com/fwlink/?linkid=2094934 for more info on Microsoft Defender SmartScreen.\n\nPolicy options mapping:\n\n* DefaultDownloadSecurity (0) = No special restrictions\n\n* BlockDangerousDownloads (1) = Block malicious downloads and dangerous file types\n\n* BlockPotentiallyDangerousDownloads (2) = Block potentially dangerous or unwanted downloads and dangerous file types\n\n* BlockAllDownloads (3) = Block all downloads\n\n* BlockMaliciousDownloads (4) = Block malicious downloads\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.downloadrestrictions_recommended_defaultdownloadsecurity","displayName":"No special restrictions","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.downloadrestrictions_recommended_blockdangerousdownloads","displayName":"Block malicious downloads and dangerous file types","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.downloadrestrictions_recommended_blockpotentiallydangerousdownloads","displayName":"Block potentially dangerous or unwanted downloads and dangerous file types","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.downloadrestrictions_recommended_blockalldownloads","displayName":"Block all downloads","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.downloadrestrictions_recommended_blockmaliciousdownloads","displayName":"Block malicious downloads","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeassetdeliveryserviceenabled","displayName":"Allow features to download assets from the Asset Delivery Service","description":"The Asset Delivery Service is a general pipeline used to deliver assets to the Microsoft Edge Clients.\nThese assets can be config files or Machine Learning models that power the features that use this service.\n\nIf you enable or don't configure this policy, features can download assets from the Asset Delivery Service.\n\nIf you disable this policy, features won't be able to download assets needed for them to run correctly.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeassetdeliveryserviceenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeassetdeliveryserviceenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeassetdeliveryserviceenabled_recommended","displayName":"Allow features to download assets from the Asset Delivery Service (users can override)","description":"The Asset Delivery Service is a general pipeline used to deliver assets to the Microsoft Edge Clients.\nThese assets can be config files or Machine Learning models that power the features that use this service.\n\nIf you enable or don't configure this policy, features can download assets from the Asset Delivery Service.\n\nIf you disable this policy, features won't be able to download assets needed for them to run correctly.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeassetdeliveryserviceenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeassetdeliveryserviceenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeautofillmlenabled","displayName":"Machine learning powered autofill suggestions","description":"Allows ML technology to predict and fill in forms and text fields for better browsing. Your personal data is secure and will not be used elsewhere.\n\nIf you enable this policy or don't configure it, users can benefit from machine learning powered autofill suggestions, which improve efficiency by offering more accurate, context aware form recommendations based on historical autofill data.\n\nIf you disable this policy, machine learning powered autofill suggestions will not be shown, and autofill will no longer use cloud-based machine learning models to enhance form filling with smarter, context aware suggestions. Instead, autofill will rely on basic form data without the benefits of machine learning.\n\nThis policy will be disabled if you disable \"AutofillAddressEnabled\"..","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeautofillmlenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeautofillmlenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeautofillmlenabled_recommended","displayName":"Machine learning powered autofill suggestions (users can override)","description":"Allows ML technology to predict and fill in forms and text fields for better browsing. Your personal data is secure and will not be used elsewhere.\n\nIf you enable this policy or don't configure it, users can benefit from machine learning powered autofill suggestions, which improve efficiency by offering more accurate, context aware form recommendations based on historical autofill data.\n\nIf you disable this policy, machine learning powered autofill suggestions will not be shown, and autofill will no longer use cloud-based machine learning models to enhance form filling with smarter, context aware suggestions. Instead, autofill will rely on basic form data without the benefits of machine learning.\n\nThis policy will be disabled if you disable \"AutofillAddressEnabled\"..","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeautofillmlenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeautofillmlenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgecollectionsenabled","displayName":"Enable the Collections feature","description":"Lets you allow users to access the Collections feature, where they can collect, organize, share, and export content more efficiently and with Office integration.\n\nIf you enable or don't configure this policy, users can access and use the Collections feature in Microsoft Edge.\n\nIf you disable this policy, users can't access and use Collections in Microsoft Edge.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgecollectionsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgecollectionsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgediscoverenabled","displayName":"Discover feature In Microsoft Edge (Obsolete)","description":"This policy doesn't work because Discover is now contained within the Edge Sidebar and can be managed using the \"HubsSidebarEnabled\" policy.\n\nThis policy lets you configure the Discover feature in Microsoft Edge.\n\nWorking in the background when enabled, this feature sends URLs to Microsoft Bing to search for related recommendations.\n\nIf you enable or don't configure this policy, you can use the Discover button on Microsoft Edge to start using this feature.\n\nIf you disable this policy, you can't use the Discover feature in Microsoft Edge.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgediscoverenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgediscoverenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgediscoverenabled_recommended","displayName":"Discover feature In Microsoft Edge (Obsolete) (users can override)","description":"This policy doesn't work because Discover is now contained within the Edge Sidebar and can be managed using the \"HubsSidebarEnabled\" policy.\n\nThis policy lets you configure the Discover feature in Microsoft Edge.\n\nWorking in the background when enabled, this feature sends URLs to Microsoft Bing to search for related recommendations.\n\nIf you enable or don't configure this policy, you can use the Discover button on Microsoft Edge to start using this feature.\n\nIf you disable this policy, you can't use the Discover feature in Microsoft Edge.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgediscoverenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgediscoverenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeedropenabled","displayName":"Enable Drop feature in Microsoft Edge","description":"This policy lets you configure the Drop feature in Microsoft Edge.\n\nDrop lets users send messages or files to themselves.\n\nIf you enable or don't configure this policy, you can use the Drop feature in Microsoft Edge.\n\nIf you disable this policy, you can't use the Drop feature in Microsoft Edge.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeedropenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeedropenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeenhanceimagesenabled","displayName":"Enhance images enabled (Obsolete)","description":"The enhance images feature is deprecated and starting in 122 this policy will be removed. Set whether Microsoft Edge can automatically enhance images to show you sharper images with better color, lighting, and contrast.\n\nIf you enable this policy or don't configure the policy, Microsoft Edge will automatically enhance images on specific web applications.\n\nIf you disable this policy, Microsoft Edge will not enhance images.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeenhanceimagesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeenhanceimagesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeentracopilotpagecontext","displayName":"Control Copilot access to Microsoft Edge page content for Entra account user profiles when using Copilot in the Microsoft Edge sidepane","description":"This policy controls whether Copilot in the Microsoft Edge sidepane can access Microsoft Edge page content. This includes page summarization and similar contextual queries sent to Copilot.\n\nThis policy only applies to users who are signed in to Microsoft Edge with their Entra account and are using Copilot in the sidepane. This policy applies to all Copilot products in the Microsoft Edge sidepane - namely, Microsoft 365 Copilot Business Chat and Microsoft Copilot with enterprise data protection (EDP).\n\nIf you enable this policy, Copilot will be able to access Microsoft Edge page content when users ask a contextual query to Copilot in the Microsoft Edge sidepane.\n\nIf you disable this policy, Copilot will not be able to access Microsoft Edge page content.\n\nIf you don't configure this policy, the default behavior is as follows:\n\n- For non-EU countries, access is enabled by default.\n\n- For EU countries, access is disabled by default.\n\n- In both cases, if the policy is not configured, users can enable or disable Copilot access to Microsoft Edge page content using the toggle in Microsoft Edge settings.\n\nExceptions to the preceding behavior include when a page is protected using data loss prevention (DLP) measures. In that case, Copilot will not be able to access Microsoft Edge page content even when this policy is enabled. This behavior is to ensure the integrity of DLP.\n\nLearn more about Copilot's data usage and consent at https://go.microsoft.com/fwlink/?linkid=2288056","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeentracopilotpagecontext_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeentracopilotpagecontext_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgefollowenabled","displayName":"Enable Follow service in Microsoft Edge (Obsolete)","description":"Lets Microsoft Edge browser enable Follow service and apply it to users.\n\nUsers can use the Follow feature for an influencer, site, or topic in Microsoft Edge..\n\nIf you enable or don't configure this policy, Follow in Microsoft Edge can be applied.\n\nIf you disable this policy, Microsoft Edge will not communicate with Follow service to provide the follow feature.\n\nThis policy is obsolete after version 126.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgefollowenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgefollowenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgehistoryaisearchenabled","displayName":"Control access to AI-enhanced search in History","description":"This policy controls whether users can use AI-enhanced search in their browsing history in Microsoft Edge.\n\nWhen enabled or not configured, users can search using synonyms, natural language phrases, and minor spelling errors to find previously visited pages.\n\nWhen disabled, users can only perform exact match (verbatim) searches in their history.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgehistoryaisearchenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgehistoryaisearchenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgemanagementextensionsfeedbackenabled","displayName":"Microsoft Edge management extensions feedback enabled","description":"This setting controls whether Microsoft Edge sends data about blocked extensions to the Microsoft Edge management service.\n\nThe 'EdgeManagementEnabled' policy must also be enabled for this setting to take effect.\n\nIf you enable this policy, Microsoft Edge will send data to the Microsoft Edge service when a user tries to install a blocked extension.\n\nIf you disable or don't configure this policy, Microsoft Edge won't send any data to the Microsoft Edge service about blocked extensions.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgemanagementextensionsfeedbackenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgemanagementextensionsfeedbackenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgesafehostingextensionenabled","displayName":"Control Microsoft Edge Safe Hosting Extension","description":"This policy controls whether the Microsoft Edge Safe Hosting component extension is installed automatically when users visit supported Microsoft services, such as Microsoft 365 Copilot app.\n\nThe Microsoft Edge Safe Hosting extension provides additional security capabilities for these services. When a user accesses a supported service, the extension installs automatically to enable those protections.\n\nIf you enable or don't configure this policy, the extension installs automatically and remains installed for 90 days after the user's last visit, then is removed if no further activity occurs.\n\nIf you disable this policy, the extension won't install automatically. If it’s already installed, it will be removed.\n\nNote: This policy controls only automatic installation. It doesn’t prevent users from manually installing other extensions from the Microsoft Edge Add-ons website.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgesafehostingextensionenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgesafehostingextensionenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeshoppingassistantenabled","displayName":"Shopping in Microsoft Edge Enabled","description":"This policy lets users compare the prices of a product they are looking at, get coupons or rebates from the website they're on, auto-apply coupons and help checkout faster using autofill data.\n\nIf you enable or don't configure this policy, shopping features such as price comparison, coupons, rebates and express checkout will be automatically applied for retail domains. Coupons for the current retailer and prices from other retailers will be fetched from a server.\n\nIf you disable this policy shopping features such as price comparison, coupons, rebates and express checkout will not be automatically found for retail domains.\n\nStarting in version 90.0.818.56, the behavior of the messaging letting users know that there is a coupon, rebate, price comparison or price history available on shopping domains is also done through a horizontal banner below the address bar. Previously this messaging was done on the address bar.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeshoppingassistantenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeshoppingassistantenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeshoppingassistantenabled_recommended","displayName":"Shopping in Microsoft Edge Enabled (users can override)","description":"This policy lets users compare the prices of a product they are looking at, get coupons or rebates from the website they're on, auto-apply coupons and help checkout faster using autofill data.\n\nIf you enable or don't configure this policy, shopping features such as price comparison, coupons, rebates and express checkout will be automatically applied for retail domains. Coupons for the current retailer and prices from other retailers will be fetched from a server.\n\nIf you disable this policy shopping features such as price comparison, coupons, rebates and express checkout will not be automatically found for retail domains.\n\nStarting in version 90.0.818.56, the behavior of the messaging letting users know that there is a coupon, rebate, price comparison or price history available on shopping domains is also done through a horizontal banner below the address bar. Previously this messaging was done on the address bar.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeshoppingassistantenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeshoppingassistantenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgesidebarappurlhostallowlist","displayName":"Allow specific apps to be opened in Microsoft Edge sidebar","description":"Define a list of sites, based on URL patterns, that aren't subject to the \"EdgeSidebarAppUrlHostBlockList\".\n\nIf you don't configure this policy, a user can open any app in sidebar except the urls listed in \"EdgeSidebarAppUrlHostBlockList\".\n\nIf you configure this policy, the apps listed in the allow list could be opened in sidebar even if they are listed in the block list.\n\nBy default, all apps are allowed. However, if you prohibited apps by policy, you can use the list of allowed apps to change that policy.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2281313.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgesidebarappurlhostblocklist","displayName":"Control which apps cannot be opened in Microsoft Edge sidebar","description":"Define a list of sites, based on URL patterns, that cannot be opened in sidebar.\n\nIf you don't configure this policy, a user can open any app in sidebar.\n\nIf the \"HubsSidebarEnabled\" policy is disabled, this list isn't used and no sidebar can be opened.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2281313.\n\nNote: A blocklist value of '*' means all apps are blocked unless they are explicitly listed in the \"EdgeSidebarAppUrlHostAllowList\" policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgesidebarappurlhostforcelist","displayName":"Control which apps are forced to be shown in Microsoft Edge sidebar","description":"Define a list of sites, based on URL, that are forced to be shown in sidebar.\n\nIf you don't configure this policy, no app is forced to be shown in sidebar.\n\nIf the \"HubsSidebarEnabled\" policy is disabled, this list isn't used, and no sidebar can be shown.\n\nFor detailed information about valid URL, see https://go.microsoft.com/fwlink/?linkid=2281313.\n\nNote: URL patterns aren't supported in this policy. You should provide the exact URL of the app.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgewalletcheckoutenabled","displayName":"Enable Wallet Checkout feature","description":"Enables Wallet Checkout feature in Microsoft Edge.\n\nIf you enable or don't configure this policy, users can choose whether to use wallet checkout while shopping on Microsoft Edge.\n\nIf you disable this policy, users can't use wallet checkout while shopping on Microsoft Edge.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgewalletcheckoutenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgewalletcheckoutenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgewalletcheckoutenabled_recommended","displayName":"Enable Wallet Checkout feature (users can override)","description":"Enables Wallet Checkout feature in Microsoft Edge.\n\nIf you enable or don't configure this policy, users can choose whether to use wallet checkout while shopping on Microsoft Edge.\n\nIf you disable this policy, users can't use wallet checkout while shopping on Microsoft Edge.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgewalletcheckoutenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgewalletcheckoutenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgewalletetreeenabled","displayName":"Edge Wallet E-Tree Enabled","description":"The Edge Wallet E-Tree feature in Microsoft Edge allows users to plant a E-Tree for their own.\n\nIf you enable or don't configure this policy, users can use the Edge Wallet E-Tree feature.\n\nIf you disable this policy, users can't use the Edge Wallet E-Tree feature.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgewalletetreeenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgewalletetreeenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgewalletetreeenabled_recommended","displayName":"Edge Wallet E-Tree Enabled (users can override)","description":"The Edge Wallet E-Tree feature in Microsoft Edge allows users to plant a E-Tree for their own.\n\nIf you enable or don't configure this policy, users can use the Edge Wallet E-Tree feature.\n\nIf you disable this policy, users can't use the Edge Wallet E-Tree feature.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgewalletetreeenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgewalletetreeenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeworkspacesenabled","displayName":"Enable Workspaces","description":"Microsoft Edge Workspaces helps improve productivity for users in your organization.\n\nIf you enable or don't configure this policy, users can access the Microsoft Edge Workspaces feature.\nIf you disable this policy, users won't be able to access the Microsoft Edge Workspaces feature.\n\nTo learn more about the feature, see https://go.microsoft.com/fwlink/?linkid=2209950","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeworkspacesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.edgeworkspacesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.editfavoritesenabled","displayName":"Allows users to edit favorites","description":"Enable this policy to let users add, remove, and modify favorites. This is the default behavior if you don't configure the policy.\n\nDisable this policy to stop users from adding, removing, or modifying favorites. They can still use existing favorites.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.editfavoritesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.editfavoritesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.editprofileenabled","displayName":"Enable editing profile in settings","description":"This policy controls whether users can modify profile properties (such as profile avatar) from the profile settings page.\n\nIf you enable or don't configure this policy, users can edit profile properties. The edit button is available on the profile settings page.\n\nIf you disable this policy, users can't edit profile properties. The edit button is disabled on the profile settings page.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.editprofileenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.editprofileenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enabledeprecatedwebplatformfeatures","displayName":"Re-enable deprecated web platform features for a limited time (Obsolete)","description":"This policy is obsolete because dedicated web platform policies are now used to manage individual web platform feature deprecations.\n\nSpecify a list of deprecated web platform features to temporarily re-enable.\n\nThis policy lets you re-enable deprecated web platform features for a limited time. Features are identified by a string tag.\n\nIf you don't configure this policy, if the list is empty, or if a feature doesn't match one of the supported string tags, all deprecated web platform features remain disabled.\n\nWhile the policy itself is supported on the above platforms, the feature it's enabling might not be available on all of those platforms. Not all deprecated Web Platform features can be re-enabled. Only those explicitly listed below can be re-enabled, and only for a limited period of time, which differs per feature. You can review the intent behind the Web Platform feature changes at https://bit.ly/blinkintents.\n\nThe general format of the string tag is [DeprecatedFeatureName]_EffectiveUntil[yyyymmdd].\n\nPolicy options mapping:\n\n* ExampleDeprecatedFeature (ExampleDeprecatedFeature_EffectiveUntil20080902) = Enable ExampleDeprecatedFeature API through 2008/09/02\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":{"id":"com.microsoft.edge.mamedgeappconfigsettings.enabledeprecatedwebplatformfeatures_exampledeprecatedfeature","displayName":"Enable ExampleDeprecatedFeature API through 2008/09/02","description":null,"helpText":null}},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enablemediarouter","displayName":"Enable Google Cast","description":"Enable this policy to enable Google Cast. Users will be able to launch it from the app menu, page context menus, media controls on Cast-enabled websites, and (if shown) the Cast toolbar icon.\n\nDisable this policy to disable Google Cast.\n\nBy default, Google Cast is enabled.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.enablemediarouter_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enablemediarouter_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymode","displayName":"Enhance the security state in Microsoft Edge","description":"This policy lets you enhance the security state in Microsoft Edge.\n\nIf you set this policy to 'StandardMode', the enhanced mode will be turned off and Microsoft Edge will fallback to its standard security mode.\n\nIf you set this policy to 'BalancedMode', the security state will be in balanced mode.\n\nIf you set this policy to 'StrictMode', the security state will be in strict mode.\n\nIf you set this policy to 'BasicMode', the security state will be in basic mode.\n\nNote: Sites that use WebAssembly (WASM) are not supported on 32-bit systems when \"EnhanceSecurityMode\" is enabled. If you require access to a site that uses WASM, consider adding it to your exception list as described in https://go.microsoft.com/fwlink/?linkid=2183321.\n\nStarting in Microsoft Edge 113, 'BasicMode' is deprecated and is treated the same as 'BalancedMode'. It won't work in Microsoft Edge version 116.\n\nFor detailed information about Enhanced Security Mode, see https://go.microsoft.com/fwlink/?linkid=2185895\n\nPolicy options mapping:\n\n* StandardMode (0) = Standard mode\n\n* BalancedMode (1) = Balanced mode\n\n* StrictMode (2) = Strict mode\n\n* BasicMode (3) = (Deprecated) Basic mode\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymode_standardmode","displayName":"Standard mode","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymode_balancedmode","displayName":"Balanced mode","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymode_strictmode","displayName":"Strict mode","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymode_basicmode","displayName":"(Deprecated) Basic mode","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymodeallowuserbypass","displayName":"Allow users to bypass Enhanced Security Mode","description":"Microsoft Edge will let users bypass Enhanced Security Mode on a site via Settings page or PageInfo flyout. This policy lets you configure whether users can bypass Enhanced Security Mode.\n\nIf you disable this policy, Microsoft Edge won't allow users to bypass Enhanced Security Mode.\n\nIf you enable or don't configure this policy, Microsoft Edge will allow users to bypass Enhanced Security Mode.\n\nFor detailed information about Enhanced Security Mode, see https://go.microsoft.com/fwlink/?linkid=2185895","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymodeallowuserbypass_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymodeallowuserbypass_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymodebypassintranet","displayName":"Enhanced Security Mode configuration for Intranet zone sites","description":"Microsoft Edge will apply Enhanced Security Mode on Intranet zone sites by default. This may lead to Intranet zone sites acting in an unexpected manner.\n\nIf you enable this policy, Microsoft Edge won't apply Enhanced Security Mode on Intranet zone sites.\n\nIf you disable or don't configure this policy, Microsoft Edge will apply Enhanced Security Mode on Intranet zone sites.\n\nFor detailed information about Enhanced Security Mode, see https://go.microsoft.com/fwlink/?linkid=2185895","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymodebypassintranet_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymodebypassintranet_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymodebypasslistdomains","displayName":"Configure the list of domains for which enhance security mode will not be enforced","description":"Configure the list of enhance security trusted domains. This means that\nenhance security mode will not be enforced when loading the sites in trusted domains.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymodeenforcelistdomains","displayName":"Configure the list of domains for which enhance security mode will always be enforced","description":"Configure the list of enhance security untrusted domains. This means that\nenhance security mode will always be enforced when loading the sites in untrusted domains.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymodeindicatoruienabled","displayName":"Manage the indicator UI of the Enhanced Security Mode (ESM) feature in Microsoft Edge","description":"This policy lets you manage whether the indicator User Interface (UI) for enhanced security mode is shown or not when ESM is turned on.\n\nIf you enable or don't configure this policy, the indicator UI is on.\n\nIf you disable this policy, the indicator UI is off.\n\nNote: If this policy is used, only the indicator User Interface experience is supressed - ESM is still turned on. For more information, see the \"EnhanceSecurityMode\" policy.\n\nFor detailed information about Enhanced Security Mode, see https://go.microsoft.com/fwlink/?linkid=2185895","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymodeindicatoruienabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymodeindicatoruienabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymodeoptoutuxenabled","displayName":"Manage opt-out user experience for Enhanced Security Mode (ESM) in Microsoft Edge (Obsolete)","description":"This policy is obsolete because we have determined that this experimental opt-out UX is not required.\n\nThis policy lets you manage whether the opt-out user experience for enhanced security mode is presented when ESM is turned on for Microsoft Edge.\n\nIf you enable or don't configure this policy, the UI for the opt-out user experience is on.\n\nIf you disable this policy, the UI for the opt-out user experience is off.\n\nNote: If this policy is used, only the User Interface for the opt-out experience is supressed - ESM is still turned on. For more information, see the \"EnhanceSecurityMode\" policy.\n\nFor detailed information about Enhanced Security Mode, see https://go.microsoft.com/fwlink/?linkid=2185895.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymodeoptoutuxenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enhancesecuritymodeoptoutuxenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enterprisehardwareplatformapienabled","displayName":"Allow managed extensions to use the Enterprise Hardware Platform API","description":"When this policy is set to enabled, extensions installed by enterprise policy are allowed to use the Enterprise Hardware Platform API.\nWhen this policy is set to disabled or isn't set, no extensions are allowed to use the Enterprise Hardware Platform API.\nThis policy also applies to component extensions.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.enterprisehardwareplatformapienabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enterprisehardwareplatformapienabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enterprisemodesitelistmanagerallowed","displayName":"Allow access to the Enterprise Mode Site List Manager tool","description":"Allows you to set whether Enterprise Mode Site List Manager is available to users.\n\nIf you enable this policy, users can see the Enterprise Mode Site List Manager nav button on edge://compat page, navigate to the tool and use it.\n\nIf you disable or don't configure this policy, users won't see the Enterprise Mode Site List Manager nav button and won't be able to use it.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.enterprisemodesitelistmanagerallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.enterprisemodesitelistmanagerallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.eventpathenabled","displayName":"Re-enable the Event.path API until Microsoft Edge version 115 (Obsolete)","description":"Starting in Microsoft Edge version 109, the non-standard API Event.path will be removed to improve web compatibility. This policy re-enables the API until version 115.\n\nIf you enable this policy, the Event.path API will be available.\n\nIf you disable this policy, the Event.path API will be unavailable.\n\nIf this policy is not set, the Event.path API will be in the following default states: available before version 109, and unavailable in version 109 to version 114.\n\nThis policy will be made obsolete after Microsoft Edge version 115.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.eventpathenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.eventpathenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.exemptdomainfiletypepairsfromfiletypedownloadwarnings","displayName":"Disable download file type extension-based warnings for specified file types on domains (Obsolete)","description":"This policy has been obsoleted in favor of \"ExemptFileTypeDownloadWarnings\" because of a type mismatch that caused errors in Mac.\n\nYou can enable this policy to create a dictionary of file type extensions with a corresponding list of domains that will be exempted from file type extension-based download warnings. This lets enterprise administrators block file type extension-based download warnings for files that are associated with a listed domain. For example, if the \"jnlp\" extension is associated with \"website1.com\", users would not see a warning when downloading \"jnlp\" files from \"website1.com\", but see a download warning when downloading \"jnlp\" files from \"website2.com\".\n\nFiles with file type extensions specified for domains identified by this policy will still be subject to non-file type extension-based security warnings such as mixed-content download warnings and Microsoft Defender SmartScreen warnings.\n\nIf you disable this policy or don't configure it, file types that trigger extension-based download warnings will show warnings to the user.\n\nIf you enable this policy:\n\n* The URL pattern should be formatted according to https://go.microsoft.com/fwlink/?linkid=2095322.\n* The file type extension entered must be in lower-cased ASCII. The leading separator should not be included when listing the file type extension, so list \"jnlp\" should be used instead of \".jnlp\".\n\nExample:\n\nThe following example value would prevent file type extension-based download warnings on swf, exe, and jnlp extensions for *.contoso.com domains. It will show the user a file type extension-based download warning on any other domain for exe and jnlp files, but not for swf files.\n\n[\n { \"file_extension\": \"jnlp\", \"domains\": [\"contoso.com\"] },\n { \"file_extension\": \"exe\", \"domains\": [\"contoso.com\"] },\n { \"file_extension\": \"swf\", \"domains\": [\"*\"] }\n]\n\nNote that while the preceding example shows the suppression of file type extension-based download warnings for \"swf\" files for all domains, applying suppression of such warnings for all domains for any dangerous file type extension is not recommended due to security concerns. It is shown in the example merely to demonstrate the ability to do so.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.exemptfiletypedownloadwarnings","displayName":"Disable download file type extension-based warnings for specified file types on domains","description":"You can enable this policy to create a dictionary of file type extensions with a corresponding list of domains that will be exempted from file type extension-based download warnings. This lets enterprise administrators block file type extension-based download warnings for files that are associated with a listed domain. For example, if the \"jnlp\" extension is associated with \"website1.com\", users would not see a warning when downloading \"jnlp\" files from \"website1.com\", but see a download warning when downloading \"jnlp\" files from \"website2.com\".\n\nFiles with file type extensions specified for domains identified by this policy will still be subject to non-file type extension-based security warnings such as mixed-content download warnings and Microsoft Defender SmartScreen warnings.\n\nIf you disable this policy or don't configure it, file types that trigger extension-based download warnings will show warnings to the user.\n\nIf you enable this policy:\n\n* The URL pattern should be formatted according to https://go.microsoft.com/fwlink/?linkid=2095322.\n* The file type extension entered must be in lower-cased ASCII. The leading separator should not be included when listing the file type extension, so list \"jnlp\" should be used instead of \".jnlp\".\n\nExample:\n\nThe following example value would prevent file type extension-based download warnings on swf, exe, and jnlp extensions for *.contoso.com domains. It will show the user a file type extension-based download warning on any other domain for exe and jnlp files, but not for swf files.\n\n[\n { \"file_extension\": \"jnlp\", \"domains\": [\"contoso.com\"] },\n { \"file_extension\": \"exe\", \"domains\": [\"contoso.com\"] },\n { \"file_extension\": \"swf\", \"domains\": [\"*\"] }\n]\n\nNote that while the preceding example shows the suppression of file type extension-based download warnings for \"swf\" files for all domains, applying suppression of such warnings for all domains for any dangerous file type extension is not recommended due to security concerns. It is shown in the example merely to demonstrate the ability to do so.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.exemptsmartscreendownloadwarnings","displayName":"Disable SmartScreen AppRep based warnings for specified file types on specified domains","description":"You can enable this policy to create a dictionary of file type extensions with a corresponding list of domains that are exempted from SmartScreen AppRep warnings. For example, if the `vbe` extension is associated with \"contoso.com,\" users wouldn't see a SmartScreen AppRep warning when downloading `vbe` files from \"contoso.com.\" They might, however, see a download warning when downloading `vbe` files from \"fabrikam.com.\"\n\nFiles with file type extensions specified for domains identified by this policy are still subject to file type extension-based security warnings and mixed-content download warnings.\n\nIf you disable this policy or don't configure it, files that trigger SmartScreen AppRep download warnings show warnings to the user.\n\nIf you enable this policy:\n\n* The URL pattern should be formatted according to https://go.microsoft.com/fwlink/?linkid=2095322.\n* The file type extension entered must be in lower-cased ASCII. The leading separator shouldn't be included when listing the file type extension, so `vbe` should be used instead of `.vbe`.\n\nExample:\n\nThe following example would prevent SmartScreen AppRep warnings on msi, exe, and vbe extensions for *.contoso.com domains. It might show the user a SmartScreen AppRep warning on any other domain for exe and msi files, but not for vbe files.\n\n[\n { \"file_extension\": \"msi\", \"domains\": [\"contoso.com\"] },\n { \"file_extension\": \"exe\", \"domains\": [\"contoso.com\"] },\n { \"file_extension\": \"vbe\", \"domains\": [\"*\"] }\n]\n\nNote: While the preceding example shows the suppression of SmartScreen AppRep download warnings for `vbe` files for all domains, applying suppression of such warnings for all domains isn't recommended due to security concerns. The ability to suppress warnings for all domains is shown in the example merely to demonstrate the ability to do so.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionallowedtypes","displayName":"Configure allowed extension types","description":"Setting the policy controls which apps and extensions may be installed in Microsoft Edge, which hosts they can interact with, and limits runtime access.\n\nIf you don't set this policy, there aren't any restrictions on acceptable extension and app types.\n\nExtensions and apps which have a type that's not on the list won't be installed. Each value should be one of these strings:\n\n* \"extension\"\n\n* \"theme\"\n\n* \"user_script\"\n\n* \"hosted_app\"\n\nSee the Microsoft Edge extensions documentation for more information about these types.\n\nNote: This policy also affects extensions and apps to be force-installed using \"ExtensionInstallForcelist\".\n\nPolicy options mapping:\n\n* extension (extension) = Extension\n\n* theme (theme) = Theme\n\n* user_script (user_script) = User script\n\n* hosted_app (hosted_app) = Hosted app\n\n* legacy_packaged_app (legacy_packaged_app) = Legacy packaged app\n\n* platform_app (platform_app) = Platform app\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionallowedtypes_extension","displayName":"Extension","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionallowedtypes_theme","displayName":"Theme","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionallowedtypes_user_script","displayName":"User script","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionallowedtypes_hosted_app","displayName":"Hosted app","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionallowedtypes_legacy_packaged_app","displayName":"Legacy packaged app","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionallowedtypes_platform_app","displayName":"Platform app","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensiondevelopermodesettings","displayName":"Control the availability of developer mode on extensions page","description":"Control if users can turn on Developer Mode on edge://extensions.\n\nIf the policy isn't set, users can turn on developer mode on the extension page unless DeveloperToolsAvailability policy is set to DeveloperToolsDisallowed (2).\nIf the policy is set to Allow (0), users can turn on developer mode on the extensions page.\nIf the policy is set to Disallow (1), users cannot turn on developer mode on the extensions page.\n\nIf this policy is set, DeveloperToolsAvailability can no longer control extensions developer mode.\n\nPolicy options mapping:\n\n* Allow (0) = Allow the usage of developer mode on extensions page\n\n* Disallow (1) = Do not allow the usage of developer mode on extensions page\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensiondevelopermodesettings_allow","displayName":"Allow the usage of developer mode on extensions page","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensiondevelopermodesettings_disallow","displayName":"Do not allow the usage of developer mode on extensions page","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionextendedbackgroundlifetimeforportconnectionstourls","displayName":"Configure a list of origins that grant an extended background lifetime to connecting extensions.","description":"Extensions that connect to one of these origins will keep running as long as the port is connected.\nIf unset, the policy's default values are used. These are the app origins that offer SDKs that are known to not offer the possibility to restart a closed connection to a previous state:\n- Smart Card Connector\n- Citrix Receiver (stable, beta, back-up)\n- VMware Horizon (stable, beta)\n\nIf set, the default value list is extended with the newly configured values. The defaults and policy-provided entries will grant the exception to the connecting extensions, as long as the port is connected.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensioninstallallowlist","displayName":"Allow specific extensions to be installed","description":"Setting this policy specifies which extensions are not subject to the blocklist.\n\nA blocklist value of * means all extensions are blocked and users can only install extensions listed in the allow list.\n\nBy default, all extensions are allowed. However, if you prohibited extensions by policy, you can use the list of allowed extensions to change that policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensioninstallblocklist","displayName":"Control which extensions cannot be installed","description":"Lets you specify which extensions the users CANNOT install. Extensions already installed will be disabled if blocked, without a way for the user to enable them. After a disabled extension is removed from the blocklist it will automatically get re-enabled.\n\nA blocklist value of '*' means all extensions are blocked unless they are explicitly listed in the allowlist.\n\nIf this policy isn't set, the user can install any extension in Microsoft Edge.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensioninstallforcelist","displayName":"Control which extensions are installed silently","description":"Set this policy to specify a list of apps and extensions that install silently, without user interaction. Users can't uninstall or turn off this setting. Permissions are granted implicitly, including the enterprise.deviceAttributes and enterprise.platformKeys extension APIs. Note: These 2 APIs aren't available to apps and extensions that aren't force-installed.\n\nIf you don't set this policy, no apps or extensions are autoinstalled and users can uninstall any app in Microsoft Edge.\n\nThis policy supercedes \"ExtensionInstallBlocklist\" policy. If a previously force-installed app or extension is removed from this list, Microsoft Edge automatically uninstalls it.\n\nFor Windows instances not joined to a Microsoft Active Directory domain, forced installation is limited to apps and extensions listed in the Microsoft Edge Add-ons website.\n\nOn macOS instances, apps and extensions from outside the Microsoft Edge Add-ons website can only be force installed if the instance is managed via MDM, or joined to a domain via MCX.\n\nThe source code of any extension can be altered by users with developer tools, potentially rendering the extension unfunctional. If this is a concern, configure the \"DeveloperToolsAvailability\" policy.\n\nEach list item of the policy is a string that contains an extension ID and, optionally, and an optional \"update\" URL separated by a semicolon (;). The extension ID is the 32-letter string found, for example, on edge://extensions when in Developer mode. If specified, the \"update\" URL should point to an Update Manifest XML document ( https://go.microsoft.com/fwlink/?linkid=2095043 ). The update URL should use one of the following schemes: http, https or file. By default, the Microsoft Edge Add-ons website's update URL is used. The \"update\" URL set in this policy is only used for the initial installation; subsequent updates of the extension use the update URL in the extension's manifest. The update url for subsequent updates can be overridden using the ExtensionSettings policy, see https://learn.microsoft.com/deployedge/microsoft-edge-manage-extensions-ref-guide.\n\nNote: This policy doesn't apply to InPrivate mode. Read about hosting extensions at [Publish and update extensions in the Microsoft Edge Add-ons website](/microsoft-edge/extensions-chromium/enterprise/hosting-and-updating).","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensioninstallsources","displayName":"Configure extension and user script install sources","description":"Define URLs that can install extensions and themes.\n\nDefine URLs that can install extensions and themes directly without having to drag and drop the packages to the edge://extensions page.\n\nEach item in this list is an extension-style match pattern (see https://go.microsoft.com/fwlink/?linkid=2095039). Users can easily install items from any URL that matches an item in this list. Both the location of the *.crx file and the page where the download is started from (in other words, the referrer) must be allowed by these patterns. Don't host the files at a location that requires authentication.\n\nThe \"ExtensionInstallBlocklist\" policy takes precedence over this policy. Any extensions that's on the blocklist won't be installed, even if it comes from a site on this list.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensioninstalltypeblocklist","displayName":"Blocklist for extension install types","description":"The blocklist controls which extension install types are disallowed.\n\nSetting the \"command_line\" will block an extension from being loaded from command line.\n\nPolicy options mapping:\n\n* command_line (command_line) = Blocks extensions from being loaded from command line\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensioninstalltypeblocklist_command_line","displayName":"Blocks extensions from being loaded from command line","description":null,"helpText":null}},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionmanifestv2availability","displayName":"Control Manifest v2 extension availability","description":"Control if Manifest v2 extensions can be used by browser.\n\nManifest v2 extensions support will be deprecated and all extensions need to be migrated to v3 in the future. More information about and the timeline of the migration hasn't been established.\n\nIf the policy is set to Default or not set, v2 extension loading is decided by browser. This follows the preceding timeline when it's established.\n\nIf the policy is set to Disable, v2 extensions installation are blocked, and existing ones are disabled. This option is going to be treated the same as if the policy is unset after v2 support is turned off by default.\n\nIf the policy is set to Enable, v2 extensions are allowed. The option is going to be treated the same as if the policy isn't set before v2 support is turned off by default.\n\nIf the policy is set to EnableForForcedExtensions, force installed v2 extensions are allowed. This includes extensions that are listed by \"ExtensionInstallForcelist\" or \"ExtensionSettings\" with installation_mode \"force_installed\" or \"normal_installed\". All other v2 extensions are disabled. The option is always available regardless of the manifest migration state.\n\nExtensions availabilities are still controlled by other policies.\n\nPolicy options mapping:\n\n* Default (0) = Default browser behavior\n\n* Disable (1) = Manifest v2 is disabled\n\n* Enable (2) = Manifest v2 is enabled\n\n* EnableForForcedExtensions (3) = Manifest v2 is enabled for forced extensions only\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionmanifestv2availability_default","displayName":"Default browser behavior","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionmanifestv2availability_disable","displayName":"Manifest v2 is disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionmanifestv2availability_enable","displayName":"Manifest v2 is enabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionmanifestv2availability_enableforforcedextensions","displayName":"Manifest v2 is enabled for forced extensions only","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionsettings","displayName":"Configure extension management settings","description":"Setting this policy controls extension management settings for Microsoft Edge, including any controlled by existing extension-related policies. This policy supersedes any legacy policies that might be set.\n\nThis policy maps an extension ID or an update URL to its specific setting only. A default configuration can be set for the special ID \"*\", which applies to all extensions without a custom configuration in this policy. With an update URL, configuration applies to extensions with the exact update URL stated in the extension manifest. If the 'override_update_url' flag is set to true, the extension is installed and updated using the update URL specified in the \"ExtensionInstallForcelist\" policy or in 'update_url' field in this policy. The flag 'override_update_url' is ignored if the 'update_url' is the Edge Add-ons website update URL. For more details, check out the detailed guide to ExtensionSettings policy available at https://go.microsoft.com/fwlink/?linkid=2161555.\n\nTo block extensions from a particular third party store, you only need to block the update_url for that store. For example, if you want to block extensions from Chrome Web Store, you can use the following JSON.\n\n{\"update_url:https://clients2.google.com/service/update2/crx\":{\"installation_mode\":\"blocked\"}}\n\nNote that you can still use \"ExtensionInstallForcelist\" and \"ExtensionInstallAllowlist\" to allow / force install specific extensions even if the store is blocked using the JSON in the previous example.\n\nIf the 'sidebar_auto_open_blocked' flag is set to true in an extension's configuration, the hub-app (sidebar app) corresponding to the specified extension will be prevented from automatically opening.\n\nOn Windows instances, apps and extensions from outside the Microsoft Edge Add-ons website can only be forced installed if the instance is joined to a Microsoft Active Directory domain or joined to Microsoft Azure Active Directory®`.\n\nOn macOS instances, apps and extensions from outside the Microsoft Edge Add-ons website can only be force installed if the instance is managed via MDM, joined to a domain via MCX.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionsperformancedetectorenabled","displayName":"Extensions Performance Detector enabled","description":"This policy controls if users can access the Extensions Performance Detector Recommended Action feature in Browser Essentials. This feature alerts extension users if their extensions are causing performance regressions in the browser and allows them to take action to resolve the issue.\n\nIf you enable or don't configure this policy, users receive Extensions Performance Detector notifications from Browser Essentials. When there is an active alert, users will be able to view the impact of extensions on their browser's performance and make an informed decision to disable impacting extensions. The detector will exclude browser-managed extensions, such as Google Docs offline, component extensions, and organization-managed extensions (that is, extensions that can't be disabled).\n\nIf you disable this policy, users won't receive notifications or be able to view the Extensions Performance Detector Recommended Action.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionsperformancedetectorenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionsperformancedetectorenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionsperformancedetectorenabled_recommended","displayName":"Extensions Performance Detector enabled (users can override)","description":"This policy controls if users can access the Extensions Performance Detector Recommended Action feature in Browser Essentials. This feature alerts extension users if their extensions are causing performance regressions in the browser and allows them to take action to resolve the issue.\n\nIf you enable or don't configure this policy, users receive Extensions Performance Detector notifications from Browser Essentials. When there is an active alert, users will be able to view the impact of extensions on their browser's performance and make an informed decision to disable impacting extensions. The detector will exclude browser-managed extensions, such as Google Docs offline, component extensions, and organization-managed extensions (that is, extensions that can't be disabled).\n\nIf you disable this policy, users won't receive notifications or be able to view the Extensions Performance Detector Recommended Action.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionsperformancedetectorenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.extensionsperformancedetectorenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.externalprotocoldialogshowalwaysopencheckbox","displayName":"Show an \"Always open\" checkbox in external protocol dialog","description":"This policy controls whether the \"Always allow this site to open links of this type\" checkbox is shown on external protocol launch confirmation prompts. This policy only applies to https:// links.\n\nIf you enable this policy, when an external protocol confirmation prompt is shown, the user can select \"Always allow\" to skip all future confirmation prompts for the protocol on this site.\n\nIf you disable this policy, the \"Always allow\" checkbox isn't displayed. The user will be prompted for confirmation every time an external protocol is invoked.\n\nPrior to Microsoft Edge 83, if you don't configure this policy, the \"Always allow\" checkbox isn't displayed. The user will be prompted for confirmation every time an external protocol is invoked.\n\nOn Microsoft Edge 83, if you don't configure this policy, the checkbox visibility is controlled by the \"Enable remembering protocol launch prompting preferences\" flag in edge://flags\n\nAs of Microsoft Edge 84, if you don't configure this policy, when an external protocol confirmation prompt is shown, the user can select \"Always allow\" to skip all future confirmation prompts for the protocol on this site.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.externalprotocoldialogshowalwaysopencheckbox_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.externalprotocoldialogshowalwaysopencheckbox_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.familysafetysettingsenabled","displayName":"Allow users to configure Family safety and Kids Mode","description":"This policy disables two family safety related features in the browser. This will hide the Family page inside Settings and navigation to edge://settings/family will be blocked. The family settings page describes what features are available with family groups with Microsoft Family Safety. Learn more about Family Safety here: (https://go.microsoft.com/fwlink/?linkid=2098432). Starting in Microsoft Edge 90, this policy also disables Kids Mode, a kid friendly browsing mode with custom themes and allow list browsing that requires the device password to exit. Learn more about Kids Mode here: (https://go.microsoft.com/fwlink/?linkid=2146910)\n\nIf you enable this policy or don't configure it, the family page in Settings will be shown and Kids Mode will be available.\n\nIf you disable this policy, the family page will not be shown, and Kids Mode will be hidden.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.familysafetysettingsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.familysafetysettingsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.favoritesbarenabled","displayName":"Enable favorites bar","description":"Enables or disables the favorites bar.\n\nIf you enable this policy, users will see the favorites bar.\n\nIf you disable this policy, users won't see the favorites bar.\n\nIf this policy is not configured, then the user can decide to use the favorites bar or not.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.favoritesbarenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.favoritesbarenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.favoritesbarenabled_recommended","displayName":"Enable favorites bar (users can override)","description":"Enables or disables the favorites bar.\n\nIf you enable this policy, users will see the favorites bar.\n\nIf you disable this policy, users won't see the favorites bar.\n\nIf this policy is not configured, then the user can decide to use the favorites bar or not.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.favoritesbarenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.favoritesbarenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.fetchkeepalivedurationsecondsonshutdown","displayName":"Fetch keepalive duration on shutdown","description":"Controls the duration (in seconds) that keepalive requests are allowed to prevent the browser from completing its shutdown.\n\nIf you configure this policy, the browser blocks completing shutdown while it processes any outstanding keepalive requests (see https://fetch.spec.whatwg.org/#request-keepalive-flag) up to the maximum period of time specified by this policy.\n\nIf you disable or don't configure this policy, the default value of 0 seconds is used, and the outstanding keepalive requests are immediately cancelled during browser shutdown.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.fileordirectorypickerwithoutgestureallowedfororigins","displayName":"Allow file or directory picker APIs to be called without prior user gesture","description":"For security reasons, the showOpenFilePicker(), showSaveFilePicker() and showDirectoryPicker() web APIs require a prior user gesture (\"transient activation\") to be called or will otherwise fail.\n\nIf you enable this policy, admins can specify origins on which these APIs can be called without prior user gesture.\n\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.\n\nIf you disable or don't configure this policy, all origins will require a prior user gesture to call these APIs.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.filesystemreadaskforurls","displayName":"Allow read access via the File System API on these sites","description":"Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them read access to files or directories in the host operating system's file system via the File System API.\n\nLeaving the policy unset means \"DefaultFileSystemReadGuardSetting\" applies for all sites, if it's set. If not, users' personal settings apply.\n\nURL patterns can't conflict with \"FileSystemReadBlockedForUrls\". Neither policy takes precedence if a URL matches with both.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.filesystemreadblockedforurls","displayName":"Block read access via the File System API on these sites","description":"If you set this policy, you can list the URL patterns that specify which sites can't ask users to grant them read access to files or directories in the host operating system's file system via the File System API.\n\nIf you don't set this policy, \"DefaultFileSystemReadGuardSetting\" applies for all sites, if it's set. If not, users' personal settings apply.\n\nURL patterns can't conflict with \"FileSystemReadAskForUrls\". Neither policy takes precedence if a URL matches with both.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.filesystemwriteaskforurls","displayName":"Allow write access to files and directories on these sites","description":"If you set this policy, you can list the URL patterns that specify which sites can ask users to grant them write access to files or directories in the host operating system's file system.\n\nIf you don't set this policy, \"DefaultFileSystemWriteGuardSetting\" applies for all sites, if it's set. If not, users' personal settings apply.\n\nURL patterns can't conflict with \"FileSystemWriteBlockedForUrls\". Neither policy takes precedence if a URL matches with both.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.filesystemwriteblockedforurls","displayName":"Block write access to files and directories on these sites","description":"If you set this policy, you can list the URL patterns that specify which sites can't ask users to grant them write access to files or directories in the host operating system's file system.\n\nIf you don't set this policy, \"DefaultFileSystemWriteGuardSetting\" applies for all sites, if it's set. If not, users' personal settings apply.\n\nURL patterns can't conflict with \"FileSystemWriteAskForUrls\". Neither policy takes precedence if a URL matches with both.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.forcebingsafesearch","displayName":"Enforce Bing SafeSearch","description":"Ensure that queries in Bing web search are done with SafeSearch set to the value specified. Users can't change this setting.\n\nIf you configure this policy to 'BingSafeSearchNoRestrictionsMode', SafeSearch in Bing search falls back to the bing.com value.\n\nIf you configure this policy to 'BingSafeSearchModerateMode', the moderate setting is used in SafeSearch. The moderate setting filters adult videos and images but not text from search results.\n\nIf you configure this policy to 'BingSafeSearchStrictMode', the strict setting in SafeSearch is used. The strict setting filters adult text, images, and videos.\n\nIf you disable this policy or don't configure it, SafeSearch in Bing search isn't enforced, and users can set the value they want on bing.com.\n\nPolicy options mapping:\n\n* BingSafeSearchNoRestrictionsMode (0) = Don't configure search restrictions in Bing\n\n* BingSafeSearchModerateMode (1) = Configure moderate search restrictions in Bing\n\n* BingSafeSearchStrictMode (2) = Configure strict search restrictions in Bing\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.forcebingsafesearch_bingsafesearchnorestrictionsmode","displayName":"Don't configure search restrictions in Bing","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.forcebingsafesearch_bingsafesearchmoderatemode","displayName":"Configure moderate search restrictions in Bing","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.forcebingsafesearch_bingsafesearchstrictmode","displayName":"Configure strict search restrictions in Bing","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.forceephemeralprofiles","displayName":"Enable use of ephemeral profiles","description":"Controls whether user profiles are switched to ephemeral mode. An ephemeral profile is created when a session begins, is deleted when the session ends, and is associated with the user's original profile.\n\nIf you enable this policy, profiles run in ephemeral mode. This lets users work from their own devices without saving browsing data to those devices. If you enable this policy as an OS policy (by using GPO on Windows, for example), it applies to every profile on the system.\n\nIf you disable this policy or don't configure it, users get their regular profiles when they sign in to the browser.\n\nIn ephemeral mode, profile data is saved on disk only for the length of the user session. Features like browser history, extensions and their data, web data like cookies, and web databases aren't saved after the browser is closed. This doesn't prevent a user from manually downloading any data to disk, or from saving pages or printing them. If the user has enabled sync, all data is preserved in their sync accounts just like with regular profiles. Users can also use InPrivate browsing in ephemeral mode unless you explicitly disable this.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.forceephemeralprofiles_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.forceephemeralprofiles_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.forcegooglesafesearch","displayName":"Enforce Google SafeSearch","description":"Forces queries in Google Web Search to be performed with SafeSearch set to active, and prevents users from changing this setting.\n\nIf you enable this policy, SafeSearch in Google Search is always active.\n\nIf you disable this policy or don't configure it, SafeSearch in Google Search isn't enforced.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.forcegooglesafesearch_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.forcegooglesafesearch_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.forcemajorversiontominorpositioninuseragent","displayName":"Enable or disable freezing the User-Agent string at major version 99 (Obsolete)","description":"This policy was removed in Microsoft Edge 118 and is ignored if configured.\n\nThis policy controls whether the User-Agent string major\nversion should be frozen at 99.\n\nThe User-Agent request header lets websites identify the application,\noperating system, vendor, and/or version of the requesting user agent.\nSome websites make assumptions about how this header is formatted and may\nencounter issues with version strings that include three digits in the\nmajor position (for example, 100.0.0.0).\n\nIf you set this policy to 'Default' or don't configure it, then it defaults to\nbrowser settings for the User-Agent string major version.\nIf you set this policy to 'ForceEnabled', the User-Agent string will always report the\nmajor version as 99 and include the browser's major version in the minor\nposition. For example, browser version 101.0.0.0 would send a User-Agent\nrequest header that reports version 99.101.0.0.\nIf you set this policy to 'ForceDisabled', the User-Agent string won't freeze the\nmajor version.\n\nThis policy is temporary and will be deprecated in the future. If this policy and\nUser-Agent Reduction are\nboth enabled, the User-Agent version string will always be 99.0.0.0.\n\nPolicy options mapping:\n\n* Default (0) = Default to browser settings for User-Agent string version.\n\n* ForceDisabled (1) = The User-Agent string won't freeze the major version.\n\n* ForceEnabled (2) = The User-Agent string will freeze the major version as 99 and include the browser's major version in the minor position.\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.forcemajorversiontominorpositioninuseragent_default","displayName":"Default to browser settings for User-Agent string version.","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.forcemajorversiontominorpositioninuseragent_forcedisabled","displayName":"The User-Agent string won't freeze the major version.","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.forcemajorversiontominorpositioninuseragent_forceenabled","displayName":"The User-Agent string will freeze the major version as 99 and include the browser's major version in the minor position.","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.forcesync","displayName":"Force synchronization of browser data and do not show the sync consent prompt","description":"Forces data synchronization in Microsoft Edge. This policy also prevents the user from turning sync off.\n\nIf you don't configure this policy, users will be able to turn sync on or off. If you enable this policy, users will not be able to turn sync off.\n\nFor this policy to work as intended,\n\"BrowserSignin\" policy must not be configured, or must be set to enabled. If \"BrowserSignin\" is set to disabled, then \"ForceSync\" will not take affect.\n\n\"SyncDisabled\" must not be configured or must be set to False. If this is set to True, \"ForceSync\" will not take affect. If you wish to ensure specific datatypes sync or do not sync, use the \"ForceSyncTypes\" policy and \"SyncTypesListDisabled\" policy.\n\n0 = Do not automatically start sync and show the sync consent (default)\n1 = Force sync to be turned on for Azure AD/Azure AD-Degraded user profile and do not show the sync consent prompt","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.forcesync_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.forcesync_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.forcesynctypes","displayName":"Configure the list of types that are included for synchronization","description":"If you enable this policy all the specified data types will be included for synchronization for Azure AD/Azure AD-Degraded user profiles. This policy can be used to ensure the type of data uploaded to the Microsoft Edge synchronization service.\n\nYou can provide one of the following data types for this policy: \"favorites\", \"settings\", \"passwords\", \"addressesAndMore\", \"extensions\", \"history\", \"openTabs\", \"edgeWallet\", \"collections\", \"apps\", and \"edgeFeatureUsage\". The \"edgeFeatureUsage\" data type will be supported starting in Microsoft Edge version 134. Note that these data type names are case sensitive.\n\nUsers will not be able to override the enabled data types.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.forceyoutuberestrict","displayName":"Force minimum YouTube Restricted Mode","description":"Enforces a minimum Restricted Mode on YouTube and prevents users from picking a less restricted mode.\n\nSet to 'Strict' to enforce Strict Restricted Mode on YouTube.\n\nSet to 'Moderate' to enforce the user to only use Moderate Restricted Mode and Strict Restricted Mode on YouTube. They can't disable Restricted Mode.\n\nSet to 'Off' or don't configure this policy to not enforce Restricted Mode on YouTube. External policies such as YouTube policies might still enforce Restricted Mode.\n\nPolicy options mapping:\n\n* Off (0) = Do not enforce Restricted Mode on YouTube\n\n* Moderate (1) = Enforce at least Moderate Restricted Mode on YouTube\n\n* Strict (2) = Enforce Strict Restricted Mode for YouTube\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.forceyoutuberestrict_off","displayName":"Do not enforce Restricted Mode on YouTube","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.forceyoutuberestrict_moderate","displayName":"Enforce at least Moderate Restricted Mode on YouTube","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.forceyoutuberestrict_strict","displayName":"Enforce Strict Restricted Mode for YouTube","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.fullscreenallowed","displayName":"Allow full screen mode","description":"Set the availability of full screen mode - all Microsoft Edge UI is hidden and only web content is visible.\n\nIf you enable this policy or don't configure it, the user, apps, and extensions with appropriate permissions can enter full screen mode.\n\nIf you disable this policy, users, apps, and extensions can't enter full screen mode.\n\nOpening Microsoft Edge in kiosk mode using the command line is unavailable when full screen mode is disabled.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.fullscreenallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.fullscreenallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.gamermodeenabled","displayName":"Enable Gamer Mode (Obsolete)","description":"Microsoft Edge Gamer Mode allows gamers to personalize their browser with gaming themes and gives them the option of enabling Efficiency Mode for PC gaming, the Gaming feed on new tabs, sidebar apps for gamers, and more.\n\nIf you enable or don't configure this policy, users can opt into Gamer Mode.\nIf you disable this policy, Gamer Mode is disabled.\nNote: Starting in Microsoft Edge version 141, this policy is obsolete because the Gamer Mode feature has been removed.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.gamermodeenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.gamermodeenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.gamermodeenabled_recommended","displayName":"Enable Gamer Mode (Obsolete) (users can override)","description":"Microsoft Edge Gamer Mode allows gamers to personalize their browser with gaming themes and gives them the option of enabling Efficiency Mode for PC gaming, the Gaming feed on new tabs, sidebar apps for gamers, and more.\n\nIf you enable or don't configure this policy, users can opt into Gamer Mode.\nIf you disable this policy, Gamer Mode is disabled.\nNote: Starting in Microsoft Edge version 141, this policy is obsolete because the Gamer Mode feature has been removed.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.gamermodeenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.gamermodeenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.geolocationblockedforurls","displayName":"Block geolocation on these sites","description":"Use this policy to define a list of URL patterns for sites that are blocked from accessing the user's geolocation. These sites also can't prompt the user for location permissions.\n\nIf you enable this policy, the list you provide determines which sites are blocked from requesting or accessing geolocation.\n\nIf you disable or don't configure this policy, DefaultGeolocationSetting applies to all sites, if configured. If it's not configured, the user’s personal browser setting is used.\n\nFor detailed information on valid url patterns, see the documentation on pattern formats: https://learn.microsoft.com/deployedge/edge-learnmmore-url-list-filter%20format.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.globallyscopehttpauthcacheenabled","displayName":"Enable globally scoped HTTP auth cache","description":"This policy configures a single global per profile cache with HTTP server authentication credentials.\n\nIf you disable or don't set this policy, the browser uses the default behavior of cross-site auth. This behavior is to scope HTTP server authentication credentials by top-level site. So, if two sites use resources from the same authenticating domain, credentials need to be provided independently in the context of both sites. Cached proxy credentials are reused across sites.\n\nIf you enable this policy HTTP auth credentials entered in the context of one site will automatically be used in the context of another site.\n\nEnabling this policy leaves sites open to some types of cross-site attacks, and allows users to be tracked across sites even without cookies by adding entries to the HTTP auth cache using credentials embedded in URLs.\n\nThis policy is intended to give enterprises depending on the legacy behavior a chance to update their login procedures and will be removed in the future.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.globallyscopehttpauthcacheenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.globallyscopehttpauthcacheenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.guidedswitchenabled","displayName":"Guided Switch Enabled","description":"Allows Microsoft Edge to prompt the user to switch to the appropriate profile when Microsoft Edge detects that a link is a personal or work link.\n\nIf you enable this policy, you'll be prompted to switch to another account if the current profile doesn't work for the requesting link.\n\nIf you disable this policy, you won't be prompted to switch to another account when there's a profile and link mismatch.\n\nIf this policy isn't configured, guided switch is turned on by default. A user can override this value in the browser settings.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.guidedswitchenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.guidedswitchenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.homepageisnewtabpage","displayName":"Set the new tab page as the home page","description":"Configures the default home page in Microsoft Edge. You can set the home page to a URL you specify or to the new tab page.\n\nIf you enable this policy, the Home button is set to the new tab page as configured by the user or with the policy \"NewTabPageLocation\" and the URL set with the policy \"HomepageLocation\" is not taken into consideration.\n\nIf you disable this policy, the Home button is the set URL as configured by the user or as configured in the policy \"HomepageLocation\".\n\nIf you don't configure this policy, users can choose whether the set URL or the new tab page is their home page.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is available only on instances that are managed via MDM or joined to a domain via MCX.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.homepageisnewtabpage_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.homepageisnewtabpage_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.homepageisnewtabpage_recommended","displayName":"Set the new tab page as the home page (users can override)","description":"Configures the default home page in Microsoft Edge. You can set the home page to a URL you specify or to the new tab page.\n\nIf you enable this policy, the Home button is set to the new tab page as configured by the user or with the policy \"NewTabPageLocation\" and the URL set with the policy \"HomepageLocation\" is not taken into consideration.\n\nIf you disable this policy, the Home button is the set URL as configured by the user or as configured in the policy \"HomepageLocation\".\n\nIf you don't configure this policy, users can choose whether the set URL or the new tab page is their home page.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is available only on instances that are managed via MDM or joined to a domain via MCX.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.homepageisnewtabpage_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.homepageisnewtabpage_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.homepagelocation","displayName":"Configure the home page URL","description":"Configures the default home page URL in Microsoft Edge.\n\nThe home page is the page opened by the Home button. The pages that open on startup are controlled by the \"RestoreOnStartup\" policies.\n\nYou can either set a URL here or set the home page to open the new tab page 'edge://newtab'. By default, the Home button will open the new tab page (as configured by the user or with the policy \"NewTabPageLocation\"), and the user will be able to choose between the URL configured by this policy and the new tab page.\n\nIf you enable this policy, users can't change their home page URL, but they can choose the behavior for the Home button to open either the set URL or the new tab page. If you wish to enforce the usage of the set URL you must also configure \"HomepageIsNewTabPage\"=Disabled.\n\nIf you disable or don't configure this policy, users can choose their own home page, as long as the \"HomepageIsNewTabPage\" policy isn't enabled.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is available only on instances that are managed via MDM or joined to a domain via MCX.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.homepagelocation_recommended","displayName":"Configure the home page URL (users can override)","description":"Configures the default home page URL in Microsoft Edge.\n\nThe home page is the page opened by the Home button. The pages that open on startup are controlled by the \"RestoreOnStartup\" policies.\n\nYou can either set a URL here or set the home page to open the new tab page 'edge://newtab'. By default, the Home button will open the new tab page (as configured by the user or with the policy \"NewTabPageLocation\"), and the user will be able to choose between the URL configured by this policy and the new tab page.\n\nIf you enable this policy, users can't change their home page URL, but they can choose the behavior for the Home button to open either the set URL or the new tab page. If you wish to enforce the usage of the set URL you must also configure \"HomepageIsNewTabPage\"=Disabled.\n\nIf you disable or don't configure this policy, users can choose their own home page, as long as the \"HomepageIsNewTabPage\" policy isn't enabled.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is available only on instances that are managed via MDM or joined to a domain via MCX.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.hstspolicybypasslist","displayName":"Configure the list of names that will bypass the HSTS policy check","description":"Setting the policy specifies a list of hostnames that bypass preloaded HSTS (HTTP Strict Transport Security) upgrades from http to https.\n\nOnly single-label hostnames are allowed in this policy, and this policy only applies to static HSTS-preloaded entries (for example, \"app\", \"new\", \"search\", and \"play\"). This policy doesn't prevent HSTS upgrades for servers that have dynamically requested HSTS upgrades using a Strict-Transport-Security response header.\n\nSupplied hostnames must be canonicalized: Any IDNs must be converted to their A-label format, and all ASCII letters must be lowercase. This policy only applies to the specific single-label hostnames specified and not to subdomains of those names.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.httpallowlist","displayName":"HTTP Allowlist","description":"Setting the policy specifies a list of hostnames or hostname patterns (such as '[*.]example.com') that won't be upgraded to HTTPS. Organizations can use this policy to maintain access to servers that don't support HTTPS, without needing to disable \"HttpsUpgradesEnabled\".\n\nSupplied hostnames must be canonicalized: Any IDNs must be converted to their A-label format, and all ASCII letters must be lowercase.\n\nBlanket host wildcards (that is, \"*\" or \"[*]\") aren't allowed. Instead, HTTPS-First Mode and HTTPS Upgrades should be explicitly disabled via their specific policies.\n\nNote: This policy doesn't apply to HSTS upgrades.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.httpsonlymode","displayName":"Allow HTTPS-Only Mode to be enabled","description":"This policy controls whether users can enable HTTPS-Only Mode (Always Use Secure Connections) in Settings. HTTPS-Only Mode attempts to upgrade all navigations to HTTPS.\n\nIf this setting isn't set or is set to `allowed`, users are able to enable HTTPS-Only Mode.\nIf this setting is set to `disallowed`, HTTPS-Only Mode will be disabled.\nIf this setting is set to `force_enabled`, HTTPS-Only Mode is enabled in Strict mode.\nIf this setting is set to `force_balanced_enabled`, HTTPS-Only Mode is enabled in Balanced mode.\n\nThe settings `force_enabled` and `force_balanced_enabled` can be recommended to users. HTTPS-Only Mode will be set to Strict or Balanced initially, but users are allowed to change it.\n\nIf you set this policy to a value that isn't supported by the version of Microsoft Edge that receives the policy, Microsoft Edge defaults to the `allowed` setting.\n\nThe separate HttpAllowlist policy can be used to exempt specific hostnames or hostname patterns from being upgraded to HTTPS by this feature.\n\nPolicy options mapping:\n\n* allowed (allowed) = Don't restrict users' HTTPS-Only Mode setting\n\n* disallowed (disallowed) = Disable HTTPS-Only Mode\n\n* force_enabled (force_enabled) = Force enable HTTPS-Only Mode in Strict mode\n\n* force_balanced_enabled (force_balanced_enabled) = Force enable HTTPS-Only Mode in Balanced Mode\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.httpsonlymode_allowed","displayName":"Don't restrict users' HTTPS-Only Mode setting","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.httpsonlymode_disallowed","displayName":"Disable HTTPS-Only Mode","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.httpsonlymode_force_enabled","displayName":"Force enable HTTPS-Only Mode in Strict mode","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.httpsonlymode_force_balanced_enabled","displayName":"Force enable HTTPS-Only Mode in Balanced Mode","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.httpsonlymode_recommended","displayName":"Allow HTTPS-Only Mode to be enabled (users can override)","description":"This policy controls whether users can enable HTTPS-Only Mode (Always Use Secure Connections) in Settings. HTTPS-Only Mode attempts to upgrade all navigations to HTTPS.\n\nIf this setting isn't set or is set to `allowed`, users are able to enable HTTPS-Only Mode.\nIf this setting is set to `disallowed`, HTTPS-Only Mode will be disabled.\nIf this setting is set to `force_enabled`, HTTPS-Only Mode is enabled in Strict mode.\nIf this setting is set to `force_balanced_enabled`, HTTPS-Only Mode is enabled in Balanced mode.\n\nThe settings `force_enabled` and `force_balanced_enabled` can be recommended to users. HTTPS-Only Mode will be set to Strict or Balanced initially, but users are allowed to change it.\n\nIf you set this policy to a value that isn't supported by the version of Microsoft Edge that receives the policy, Microsoft Edge defaults to the `allowed` setting.\n\nThe separate HttpAllowlist policy can be used to exempt specific hostnames or hostname patterns from being upgraded to HTTPS by this feature.\n\nPolicy options mapping:\n\n* allowed (allowed) = Don't restrict users' HTTPS-Only Mode setting\n\n* disallowed (disallowed) = Disable HTTPS-Only Mode\n\n* force_enabled (force_enabled) = Force enable HTTPS-Only Mode in Strict mode\n\n* force_balanced_enabled (force_balanced_enabled) = Force enable HTTPS-Only Mode in Balanced Mode\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.httpsonlymode_recommended_allowed","displayName":"Don't restrict users' HTTPS-Only Mode setting","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.httpsonlymode_recommended_disallowed","displayName":"Disable HTTPS-Only Mode","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.httpsonlymode_recommended_force_enabled","displayName":"Force enable HTTPS-Only Mode in Strict mode","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.httpsonlymode_recommended_force_balanced_enabled","displayName":"Force enable HTTPS-Only Mode in Balanced Mode","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.httpsupgradesenabled","displayName":"Enable automatic HTTPS upgrades","description":"As of Microsoft Edge version 120, Microsoft Edge tries to upgrade HTTP navigations to HTTPS whenever possible to improve security. Navigations to captive portals, IP addresses, and non-unique hostnames are excluded from automatic upgrades.\n\nIf this policy is enabled or not configured, automatic HTTPS upgrades are turned on by default.\n\nIf this policy is disabled, Microsoft Edge won't attempt to upgrade HTTP connections to HTTPS.\n\nTo exempt specific hostnames or hostname patterns from being upgraded, use the HttpAllowlist policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.httpsupgradesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.httpsupgradesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.hubssidebarenabled","displayName":"Show Hubs Sidebar","description":"The Sidebar is a launcher bar located on the right side of Microsoft Edge.\n\nIf you enable this policy, the Sidebar is always visible.\n\nIf you disable this policy, the Sidebar is never shown.\n\nIf you don't configure this policy, the Sidebar's visibility follows the user's Microsoft Edge settings.\n\nAs of Microsoft Edge version 141, the \"Microsoft365CopilotChatIconEnabled\" policy is the only means of controlling the display of Copilot in the toolbar.\n\nNote: The recommended version of this policy-also known as the \"Default Settings (users can override)\" policy-is obsolete. This policy has never supported the recommended capability.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.hubssidebarenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.hubssidebarenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.hubssidebarenabled_recommended","displayName":"Show Hubs Sidebar (users can override)","description":"The Sidebar is a launcher bar located on the right side of Microsoft Edge.\n\nIf you enable this policy, the Sidebar is always visible.\n\nIf you disable this policy, the Sidebar is never shown.\n\nIf you don't configure this policy, the Sidebar's visibility follows the user's Microsoft Edge settings.\n\nAs of Microsoft Edge version 141, the \"Microsoft365CopilotChatIconEnabled\" policy is the only means of controlling the display of Copilot in the toolbar.\n\nNote: The recommended version of this policy-also known as the \"Default Settings (users can override)\" policy-is obsolete. This policy has never supported the recommended capability.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.hubssidebarenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.hubssidebarenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.idledetectionallowedforurls","displayName":"Allow idle detection on these sites","description":"Allows you to specify a list of URL patterns for sites that are allowed to use the Idle Detection API.\n\nIf you do not configure this policy, the default behavior applies to all sites. The default behavior is determined by the DefaultIdleDetectionSetting policy, if configured, or by the user’s personal settings otherwise.\n\nOnly the origin of the URL is evaluated. Any path specified in a URL pattern is ignored. Wildcards, *, are supported. For detailed information about valid URL pattern formats, see https://go.microsoft.com/fwlink/?linkid=209532.\n\nURL patterns specified in the blocklist take precedence over this allowlist. This allowlist takes precedence over the DefaultIdleDetectionSetting policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.idledetectionblockedforurls","displayName":"Block idle detection on these sites","description":"Allows you to specify a list of URL patterns for sites that are not allowed to use the Idle Detection API.\n\nOnly the origin of the URL is evaluated. Any path specified in a URL pattern is ignored. Wildcards, *, are supported.\n\nFor detailed information about valid URL pattern formats, see https://go.microsoft.com/fwlink/?linkid=2095322.\n\nIf you do not configure this policy, the default behavior applies to all sites. The default behavior is determined by the DefaultIdleDetectionSetting policy, if configured, or by the user’s personal settings otherwise.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.idletimeout","displayName":"Delay before running idle actions","description":"Triggers an action when the computer is idle.\n\nIf you set this policy, it specifies the length of time without user input (in minutes) before the browser runs actions configured via the IdleTimeoutActions policy.\n\nIf you do not set this policy, no action will run.\n\nThe minimum threshold is 1 minute.\n\n\"User input\" is defined by Operating System APIs, and includes things like moving the mouse or typing on the keyboard.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.idletimeoutactions","displayName":"Actions to run when the computer is idle","description":"When the timeout from the IdleTimeout policy is reached, the browser runs the actions configured in this policy.\n\nIf you don't configure the IdleTimeout policy, this policy has no effect.\n\nIf you don't configure this policy or no actions are selected, the IdleTimeout policy has no effect.\n\nSupported actions are:\n\n'close_browsers': close all browser windows and PWAs for this profile.\n\n'reload_pages': reload all webpages. For some pages, the user might be prompted for confirmation first.\n\n'sign_out': sign out of browser. (This action only applies to iOS.)\n\n'close_tabs': close all open tabs and create an NTP (New Tab Page). Supported in Android and iOS.\n\n'clear_browsing_history', 'clear_download_history', 'clear_cookies_and_other_site_data', 'clear_cached_images_and_files', 'clear_password_signing', 'clear_autofill', 'clear_site_settings': clear the corresponding browsing data. Deleting cookies using this policy doesn't sign the user out of their profile, the user stays signed in.\n\nSetting 'clear_browsing_history', 'clear_password_signing', 'clear_autofill', and 'clear_site_settings' disables sync for the respective data types if sync isn't already disabled by setting either the SyncDisabled policy or BrowserSignin to disabled.\n\nPolicy options mapping:\n\n* close_browsers (close_browsers) = Close Browsers\n\n* clear_browsing_history (clear_browsing_history) = Clear Browsing History\n\n* clear_download_history (clear_download_history) = Clear Download History\n\n* clear_cookies_and_other_site_data (clear_cookies_and_other_site_data) = Clear Cookies and Other Site Data\n\n* clear_cached_images_and_files (clear_cached_images_and_files) = Clear Cached Images and Files\n\n* clear_password_signin (clear_password_signin) = Clear Password sign in\n\n* clear_autofill (clear_autofill) = Clear Autofill\n\n* clear_site_settings (clear_site_settings) = Clear Site Settings\n\n* reload_pages (reload_pages) = Reload Pages\n\n* sign_out (sign_out) = Sign Out\n\n* close_tabs (close_tabs) = Close Tabs\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.idletimeoutactions_close_browsers","displayName":"Close Browsers","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.idletimeoutactions_clear_browsing_history","displayName":"Clear Browsing History","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.idletimeoutactions_clear_download_history","displayName":"Clear Download History","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.idletimeoutactions_clear_cookies_and_other_site_data","displayName":"Clear Cookies and Other Site Data","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.idletimeoutactions_clear_cached_images_and_files","displayName":"Clear Cached Images and Files","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.idletimeoutactions_clear_password_signin","displayName":"Clear Password sign in","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.idletimeoutactions_clear_autofill","displayName":"Clear Autofill","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.idletimeoutactions_clear_site_settings","displayName":"Clear Site Settings","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.idletimeoutactions_reload_pages","displayName":"Reload Pages","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.idletimeoutactions_sign_out","displayName":"Sign Out","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.idletimeoutactions_close_tabs","displayName":"Close Tabs","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.imagesallowedforurls","displayName":"Allow images on these sites","description":"Define a list of sites, based on URL patterns, that can display images.\n\nIf you don't configure this policy, the global default value is used for all sites either from the \"DefaultImagesSetting\" policy (if set) or the user's personal configuration.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards (*) are allowed.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.imagesblockedforurls","displayName":"Block images on specific sites","description":"Define a list of sites, based on URL patterns, that aren't allowed to display images.\n\nIf you don't configure this policy, the global default value from the \"DefaultImagesSetting\" policy (if set) or the user's personal configuration is used for all sites.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards (*) are allowed.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.immersivereadergrammartoolsenabled","displayName":"Enable Grammar Tools feature within Immersive Reader in Microsoft Edge (Obsolete)","description":"This policy is obsoleted because Grammar Tools is deprecated from Edge. This policy won't work in Microsoft Edge version 126. Enables the Grammar Tools feature within Immersive Reader in Microsoft Edge.\nThis helps improve reading comprehension by splitting words into syllables and highlighting nouns, verbs, adverbs, and adjectives.\n\nIf you enable this policy or don't configure it, the Grammar Tools option shows up within Immersive Reader.\nIf you disable this policy, users can't access the Grammar Tools feature within Immersive Reader.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.immersivereadergrammartoolsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.immersivereadergrammartoolsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.immersivereaderpicturedictionaryenabled","displayName":"Enable Picture Dictionary feature within Immersive Reader in Microsoft Edge (Obsolete)","description":"This Policy is obsoleted because Picture Dictionary is deprecated from Edge as of Sept, 2023. This policy won't work in Microsoft Edge Version 127. Enables the Picture Dictionary feature within Immersive Reader in Microsoft Edge.\nThis feature helps in reading comprehension by letting a user to click on any single word and see an illustration related to the meaning.\n\nIf you enable this policy or don't configure it, the Picture Dictionary option shows up within Immersive Reader.\nIf you disable this policy, users can't access the Picture Dictionary feature within Immersive Reader.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.immersivereaderpicturedictionaryenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.immersivereaderpicturedictionaryenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importautofillformdata","displayName":"Allow importing of autofill form data","description":"Allows users to import autofill form data from another browser into Microsoft Edge.\n\nIf you enable this policy, the option to manually import autofill data is automatically selected.\n\nIf you disable this policy, autofill form data isn't imported at first run, and users can't import it manually.\n\nIf you don't configure this policy, autofill data is imported at first run, and users can choose whether to import this data manually during later browsing sessions.\n\nYou can set this policy as a recommendation. This means that Microsoft Edge will import autofill data on first run, but users can select or clear **autofill data** option during manual import.\n\n**Note**: This policy currently manages importing from Google Chrome (on Windows 7, 8, and 10 and on macOS) and Mozilla Firefox (on Windows 7, 8, and 10 and on macOS) browsers.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importautofillformdata_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importautofillformdata_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importautofillformdata_recommended","displayName":"Allow importing of autofill form data (users can override)","description":"Allows users to import autofill form data from another browser into Microsoft Edge.\n\nIf you enable this policy, the option to manually import autofill data is automatically selected.\n\nIf you disable this policy, autofill form data isn't imported at first run, and users can't import it manually.\n\nIf you don't configure this policy, autofill data is imported at first run, and users can choose whether to import this data manually during later browsing sessions.\n\nYou can set this policy as a recommendation. This means that Microsoft Edge will import autofill data on first run, but users can select or clear **autofill data** option during manual import.\n\n**Note**: This policy currently manages importing from Google Chrome (on Windows 7, 8, and 10 and on macOS) and Mozilla Firefox (on Windows 7, 8, and 10 and on macOS) browsers.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importautofillformdata_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importautofillformdata_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importbrowsersettings","displayName":"Allow importing of browser settings","description":"Allows users to import browser settings from another browser into Microsoft Edge.\n\nIf you enable this policy, the **Browser settings** check box is automatically selected in the **Import browser data** dialog box.\n\nIf you disable this policy, browser settings aren't imported at first run, and users can't import them manually.\n\nIf you don't configure this policy, browser settings are imported at first run, and users can choose whether to import them manually during later browsing sessions.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports the settings on first run, but users can select or clear the **browser settings** option during manual import.\n\n**Note**: This policy currently manages importing Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importbrowsersettings_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importbrowsersettings_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importbrowsersettings_recommended","displayName":"Allow importing of browser settings (users can override)","description":"Allows users to import browser settings from another browser into Microsoft Edge.\n\nIf you enable this policy, the **Browser settings** check box is automatically selected in the **Import browser data** dialog box.\n\nIf you disable this policy, browser settings aren't imported at first run, and users can't import them manually.\n\nIf you don't configure this policy, browser settings are imported at first run, and users can choose whether to import them manually during later browsing sessions.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports the settings on first run, but users can select or clear the **browser settings** option during manual import.\n\n**Note**: This policy currently manages importing Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importbrowsersettings_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importbrowsersettings_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importcookies","displayName":"Allow importing of Cookies","description":"Allows users to import Cookies from another browser into Microsoft Edge.\n\nIf you disable this policy, Cookies aren't imported on first run.\n\nIf you don't configure this policy, Cookies are imported on first run.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports Cookies on first run.\n\n**Note**: This policy currently manages importing Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importcookies_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importcookies_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importcookies_recommended","displayName":"Allow importing of Cookies (users can override)","description":"Allows users to import Cookies from another browser into Microsoft Edge.\n\nIf you disable this policy, Cookies aren't imported on first run.\n\nIf you don't configure this policy, Cookies are imported on first run.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports Cookies on first run.\n\n**Note**: This policy currently manages importing Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importcookies_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importcookies_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importextensions","displayName":"Allow importing of extensions","description":"Allows users to import extensions from another browser into Microsoft Edge.\n\nIf you enable this policy, the **Extensions** check box is automatically selected in the **Import browser data** dialog box.\n\nIf you disable this policy, extensions aren't imported at first run, and users can't import them manually.\n\nIf you don't configure this policy, extensions are imported at first run, and users can choose whether to import them manually during later browsing sessions.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports extensions on first run, but users can select or clear the **extensions** option during manual import.\n\n**Note**: This policy currently only supports importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importextensions_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importextensions_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importextensions_recommended","displayName":"Allow importing of extensions (users can override)","description":"Allows users to import extensions from another browser into Microsoft Edge.\n\nIf you enable this policy, the **Extensions** check box is automatically selected in the **Import browser data** dialog box.\n\nIf you disable this policy, extensions aren't imported at first run, and users can't import them manually.\n\nIf you don't configure this policy, extensions are imported at first run, and users can choose whether to import them manually during later browsing sessions.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports extensions on first run, but users can select or clear the **extensions** option during manual import.\n\n**Note**: This policy currently only supports importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importextensions_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importextensions_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importfavorites","displayName":"Allow importing of favorites","description":"Allows users to import favorites from another browser into Microsoft Edge.\n\nIf you enable this policy, the **Favorites** check box is automatically selected in the **Import browser data** dialog box.\n\nIf you disable this policy, favorites aren't imported at first run, and users can't import them manually.\n\nIf you don't configure this policy, favorites are imported at first run, and users can choose whether to import them manually during later browsing sessions.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports favorites on first run, but users can select or clear the **favorites** option during manual import.\n\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10), Google Chrome (on Windows 7, 8, and 10 and on macOS), Mozilla Firefox (on Windows 7, 8, and 10 and on macOS), and Apple Safari (on macOS) browsers.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importfavorites_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importfavorites_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importfavorites_recommended","displayName":"Allow importing of favorites (users can override)","description":"Allows users to import favorites from another browser into Microsoft Edge.\n\nIf you enable this policy, the **Favorites** check box is automatically selected in the **Import browser data** dialog box.\n\nIf you disable this policy, favorites aren't imported at first run, and users can't import them manually.\n\nIf you don't configure this policy, favorites are imported at first run, and users can choose whether to import them manually during later browsing sessions.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports favorites on first run, but users can select or clear the **favorites** option during manual import.\n\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10), Google Chrome (on Windows 7, 8, and 10 and on macOS), Mozilla Firefox (on Windows 7, 8, and 10 and on macOS), and Apple Safari (on macOS) browsers.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importfavorites_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importfavorites_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importhistory","displayName":"Allow importing of browsing history","description":"Allows users to import their browsing history from another browser into Microsoft Edge.\n\nIf you enable this policy, the **Browsing history** check box is automatically selected in the **Import browser data** dialog box.\n\nIf you disable this policy, browsing history data isn't imported at first run, and users can't import this data manually.\n\nIf you don't configure this policy, browsing history data is imported at first run, and users can choose whether to import it manually during later browsing sessions.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports browsing history on first run, but users can select or clear the **history** option during manual import.\n\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10), Google Chrome (on Windows 7, 8, and 10 and on macOS), Mozilla Firefox (on Windows 7, 8, and 10 and on macOS), and Apple Safari (macOS) browsers.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importhistory_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importhistory_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importhistory_recommended","displayName":"Allow importing of browsing history (users can override)","description":"Allows users to import their browsing history from another browser into Microsoft Edge.\n\nIf you enable this policy, the **Browsing history** check box is automatically selected in the **Import browser data** dialog box.\n\nIf you disable this policy, browsing history data isn't imported at first run, and users can't import this data manually.\n\nIf you don't configure this policy, browsing history data is imported at first run, and users can choose whether to import it manually during later browsing sessions.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports browsing history on first run, but users can select or clear the **history** option during manual import.\n\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10), Google Chrome (on Windows 7, 8, and 10 and on macOS), Mozilla Firefox (on Windows 7, 8, and 10 and on macOS), and Apple Safari (macOS) browsers.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importhistory_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importhistory_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importhomepage","displayName":"Allow importing of home page settings","description":"Allows users to import their home page setting from another browser into Microsoft Edge.\n\nIf you enable this policy, the option to manually import the home page setting is automatically selected.\n\nIf you disable this policy, the home page setting isn't imported at first run, and users can't import it manually.\n\nIf you don't configure this policy, the home page setting is imported at first run, and users can choose whether to import this data manually during later browsing sessions.\n\nYou can set this policy as a recommendation. This means that Microsoft Edge imports the home page setting on first run, but users can select or clear the **home page** option during manual import.\n\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10).","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importhomepage_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importhomepage_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importoneachlaunch","displayName":"Allow import of data from other browsers on each Microsoft Edge launch","description":"If you enable this policy, users will see a prompt to import their browsing data from other browsers on each Microsoft Edge launch.\n\nIf you disable this policy, users will never see a prompt to import their browsing data from other browsers on each Microsoft Edge launch.\n\nIf the policy is left unconfigured, users can activate this feature from a Microsoft Edge prompt or from the Settings page.\n\nNote: A similar policy named \"AutoImportAtFirstRun\" exists. This policy should be used if you want to import supported data from other browsers only once while setting up your device.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importoneachlaunch_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importoneachlaunch_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importopentabs","displayName":"Allow importing of open tabs","description":"Allows users to import open and pinned tabs from another browser into Microsoft Edge.\n\nIf you enable this policy, the **Open tabs** check box is automatically selected in the **Import browser data** dialog box.\n\nIf you disable this policy, open tabs aren't imported at first run, and users can't import them manually.\n\nIf you don't configure this policy, open tabs are imported at first run, and users can choose whether to import them manually during later browsing sessions.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports open tabs on first run, but users can select or clear the **Open tabs** option during manual import.\n\n**Note**: This policy currently only supports importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importopentabs_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importopentabs_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importopentabs_recommended","displayName":"Allow importing of open tabs (users can override)","description":"Allows users to import open and pinned tabs from another browser into Microsoft Edge.\n\nIf you enable this policy, the **Open tabs** check box is automatically selected in the **Import browser data** dialog box.\n\nIf you disable this policy, open tabs aren't imported at first run, and users can't import them manually.\n\nIf you don't configure this policy, open tabs are imported at first run, and users can choose whether to import them manually during later browsing sessions.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports open tabs on first run, but users can select or clear the **Open tabs** option during manual import.\n\n**Note**: This policy currently only supports importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importopentabs_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importopentabs_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importpaymentinfo","displayName":"Allow importing of payment info","description":"Allows users to import payment info from another browser into Microsoft Edge.\n\nIf you enable this policy, the **payment info** check box is automatically selected in the **Import browser data** dialog box.\n\nIf you disable this policy, payment info isn't imported at first run, and users can't import it manually.\n\nIf you don't configure this policy, payment info is imported at first run, and users can choose whether to import it manually during later browsing sessions.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports payment info on first run, but users can select or clear the **payment info** option during manual import.\n\n**Note:** This policy currently manages importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importpaymentinfo_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importpaymentinfo_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importpaymentinfo_recommended","displayName":"Allow importing of payment info (users can override)","description":"Allows users to import payment info from another browser into Microsoft Edge.\n\nIf you enable this policy, the **payment info** check box is automatically selected in the **Import browser data** dialog box.\n\nIf you disable this policy, payment info isn't imported at first run, and users can't import it manually.\n\nIf you don't configure this policy, payment info is imported at first run, and users can choose whether to import it manually during later browsing sessions.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports payment info on first run, but users can select or clear the **payment info** option during manual import.\n\n**Note:** This policy currently manages importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importpaymentinfo_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importpaymentinfo_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importsavedpasswords","displayName":"Allow importing of saved passwords","description":"Allows users to import saved passwords from another browser into Microsoft Edge.\n\nIf you enable this policy, the option to manually import saved passwords is automatically selected.\n\nIf you disable this policy, saved passwords aren't imported on first run, and users can't import them manually.\n\nIf you don't configure this policy, no passwords are imported at first run, and users can choose whether to import them manually during later browsing sessions.\n\nYou can set this policy as a recommendation. This means that Microsoft Edge imports passwords on first run, but users can select or clear the **passwords** option during manual import.\n\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10), Google Chrome (on Windows 7, 8, and 10 and on macOS), and Mozilla Firefox (on Windows 7, 8, and 10 and on macOS) browsers.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importsavedpasswords_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importsavedpasswords_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importsavedpasswords_recommended","displayName":"Allow importing of saved passwords (users can override)","description":"Allows users to import saved passwords from another browser into Microsoft Edge.\n\nIf you enable this policy, the option to manually import saved passwords is automatically selected.\n\nIf you disable this policy, saved passwords aren't imported on first run, and users can't import them manually.\n\nIf you don't configure this policy, no passwords are imported at first run, and users can choose whether to import them manually during later browsing sessions.\n\nYou can set this policy as a recommendation. This means that Microsoft Edge imports passwords on first run, but users can select or clear the **passwords** option during manual import.\n\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10), Google Chrome (on Windows 7, 8, and 10 and on macOS), and Mozilla Firefox (on Windows 7, 8, and 10 and on macOS) browsers.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importsavedpasswords_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importsavedpasswords_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importsearchengine","displayName":"Allow importing of search engine settings","description":"Allows users to import search engine settings from another browser into Microsoft Edge.\n\nIf you enable, this policy, the option to import search engine settings is automatically selected.\n\nIf you disable this policy, search engine settings aren't imported at first run, and users can't import them manually.\n\nIf you don't configure this policy, search engine settings are imported at first run, and users can choose whether to import this data manually during later browsing sessions.\n\nYou can set this policy as a recommendation. This means that Microsoft Edge imports search engine settings on first run, but users can select or clear the **search engine** option during manual import.\n\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10).","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importsearchengine_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importsearchengine_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importsearchengine_recommended","displayName":"Allow importing of search engine settings (users can override)","description":"Allows users to import search engine settings from another browser into Microsoft Edge.\n\nIf you enable, this policy, the option to import search engine settings is automatically selected.\n\nIf you disable this policy, search engine settings aren't imported at first run, and users can't import them manually.\n\nIf you don't configure this policy, search engine settings are imported at first run, and users can choose whether to import this data manually during later browsing sessions.\n\nYou can set this policy as a recommendation. This means that Microsoft Edge imports search engine settings on first run, but users can select or clear the **search engine** option during manual import.\n\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10).","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importsearchengine_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importsearchengine_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importshortcuts","displayName":"Allow importing of shortcuts","description":"Allows users to import Shortcuts from another browser into Microsoft Edge.\n\nIf you disable this policy, Shortcuts aren't imported on first run.\n\nIf you don't configure this policy, Shortcuts are imported on first run.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports Shortcuts on first run.\n\n**Note**: This policy currently manages importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importshortcuts_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importshortcuts_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importshortcuts_recommended","displayName":"Allow importing of shortcuts (users can override)","description":"Allows users to import Shortcuts from another browser into Microsoft Edge.\n\nIf you disable this policy, Shortcuts aren't imported on first run.\n\nIf you don't configure this policy, Shortcuts are imported on first run.\n\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports Shortcuts on first run.\n\n**Note**: This policy currently manages importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importshortcuts_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importshortcuts_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importstartuppagesettings","displayName":"Allow importing of startup page settings","description":"Allows users to import Startup settings from another browser into Microsoft Edge.\n\nIf you enable this policy, the Startup settings are always imported.\n\nIf you disable this policy, startup settings aren't imported at first run or at manual import.\n\nIf you don't configure this policy, startup settings are imported at first run, and users can choose whether to import this data manually by selecting browser settings option during later browsing sessions.\n\nYou can set this policy as a recommendation. This means that Microsoft Edge will import startup settings on first run, but users can select or clear **browser settings** option during manual import.\n\n**Note**: This policy currently manages importing from Microsoft Edge Legacy and Google Chrome (on Windows 7, 8, and 10) browsers.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importstartuppagesettings_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importstartuppagesettings_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importstartuppagesettings_recommended","displayName":"Allow importing of startup page settings (users can override)","description":"Allows users to import Startup settings from another browser into Microsoft Edge.\n\nIf you enable this policy, the Startup settings are always imported.\n\nIf you disable this policy, startup settings aren't imported at first run or at manual import.\n\nIf you don't configure this policy, startup settings are imported at first run, and users can choose whether to import this data manually by selecting browser settings option during later browsing sessions.\n\nYou can set this policy as a recommendation. This means that Microsoft Edge will import startup settings on first run, but users can select or clear **browser settings** option during manual import.\n\n**Note**: This policy currently manages importing from Microsoft Edge Legacy and Google Chrome (on Windows 7, 8, and 10) browsers.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.importstartuppagesettings_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.importstartuppagesettings_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.inprivatemodeavailability","displayName":"Configure InPrivate mode availability","description":"Specifies whether the user can open pages in InPrivate mode in Microsoft Edge.\n\nIf you don't configure this policy or set it to 'Enabled', users can open pages in InPrivate mode.\n\nSet this policy to 'Disabled' to stop users from using InPrivate mode.\n\nSet this policy to 'Forced' to always use InPrivate mode.\n\nPolicy options mapping:\n\n* Enabled (0) = InPrivate mode available\n\n* Disabled (1) = InPrivate mode disabled\n\n* Forced (2) = InPrivate mode forced\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.inprivatemodeavailability_enabled","displayName":"InPrivate mode available","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.inprivatemodeavailability_disabled","displayName":"InPrivate mode disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.inprivatemodeavailability_forced","displayName":"InPrivate mode forced","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.insecurecontentallowedforurls","displayName":"Allow insecure content on specified sites","description":"Create a list of URL patterns to specify sites that can display or, as of version 94, download insecure mixed content (that is, HTTP content on HTTPS sites).\n\nIf you don't configure this policy, blockable mixed content will be blocked and optionally blockable mixed content will be upgraded. However, users will be allowed to set exceptions to allow insecure mixed content for specific sites.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards (*) are allowed.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.insecurecontentblockedforurls","displayName":"Block insecure content on specified sites","description":"Create a list of URL patterns to specify sites that aren't allowed to display blockable (i.e. active) mixed content (that is, HTTP content on HTTPS sites) and for which optionally blockable mixed content upgrades will be disabled.\n\nIf you don't configure this policy, blockable mixed content will be blocked and optionally blockable mixed content will be upgraded. However, users will be allowed to set exceptions to allow insecure mixed content for specific sites.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards (*) are allowed.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.insecureformswarningsenabled","displayName":"Enable warnings for insecure forms (Deprecated)","description":"This policy controls the handling of insecure forms (forms submitted over HTTP) embedded in secure (HTTPS) sites in the browser.\nIf you enable this policy or don't set it, a full page warning will be shown when an insecure form is submitted. Additionally, a warning bubble will be shown next to the form fields when they are focused, and autofill will be disabled for those forms.\nIf you disable this policy, warnings will not be shown for insecure forms, and autofill will work normally.\n\nThis policy may be removed as soon as Edge 132. The feature is enabled by default since Edge 131.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.insecureformswarningsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.insecureformswarningsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.insecureprivatenetworkrequestsallowed","displayName":"Specifies whether to allow websites to make requests to any network endpoint in an insecure manner. (Obsolete)","description":"Controls whether websites are allowed to make requests to more-private network endpoints.\n\nWhen this policy is enabled, all Private Network Access checks are disabled for all origins. This may allow attackers to perform cross-site request forgery (CSRF) attacks on private network servers.\n\nWhen this policy is disabled or not configured, the default behavior for requests to more-private network endpoints depend on the user's personal configuration for the BlockInsecurePrivateNetworkRequests, PrivateNetworkAccessSendPreflights, and PrivateNetworkAccessRespectPreflightResults feature flags. These flags may be controlled by experimentation or set via the command line.\n\nThis policy relates to the Private Network Access specification. See https://wicg.github.io/private-network-access/ for more details.\n\nA network endpoint is more private than another if:\n1) Its IP address is localhost and the other isn't.\n2) Its IP address is private and the other is public.\nIn the future, depending on spec evolution, this policy might apply to all cross-origin requests directed at private IPs or localhost.\n\nWhen this policy enabled, websites are allowed to make requests to any network endpoint, subject to other cross-origin checks.\n\nThis policy is obsolete. The previous blanket override has been replaced by the permission-based Local Network Access model, which blocks cross-space requests until users grant explicit consent.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.insecureprivatenetworkrequestsallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.insecureprivatenetworkrequestsallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.insecureprivatenetworkrequestsallowedforurls","displayName":"Allow the listed sites to make requests to more-private network endpoints from in an insecure manner (Obsolete)","description":"List of URL patterns. Requests initiated from websites served by matching origins aren't subject to Private Network Access checks.\n\nIf this policy isn't set, this policy behaves as if set to the empty list.\n\nFor origins not covered by the patterns specified here, the global default value is used either from the \"InsecurePrivateNetworkRequestsAllowed\" policy, if it's set, or the user's personal configuration otherwise.\n\nFor detailed information on valid URL patterns, see [Filter format for URL list-based policies](/DeployEdge/edge-learnmmore-url-list-filter%20format).\n\nThis policy is obsolete. The previous blanket override has been replaced by the permission-based Local Network Access model, which blocks cross-space requests until users grant explicit consent.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationalwaysuseoscapture","displayName":"Always use the OS capture engine to avoid issues with capturing Internet Explorer mode tabs","description":"Configure this policy to control whether Microsoft Edge will use the \"OS capture engine\" or the \"Browser capture engine\" when capturing browser windows in the same process using the screen-share APIs.\n\nYou should configure this policy if you want to capture the contents of Internet Explorer mode tabs. However, enabling this policy may negatively impact performance when capturing browser windows in the same process.\n\nThis policy only affects window capture, not tab capture. The contents of Internet Explorer mode tabs will not be captured when you choose to capture only a single tab, even if you configure this policy.\n\nIf you enable this policy, Microsoft Edge will always use the OS capture engine for window capture. Internet Explorer mode tabs will have their contents captured.\n\nIf you disable or don't configure this policy, Microsoft Edge will use the Browser capture engine for browser windows in the same process. Internet Explorer mode tabs in these windows will not have their contents captured.\n\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2174004","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationalwaysuseoscapture_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationalwaysuseoscapture_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationalwayswaitforunload","displayName":"Wait for Internet Explorer mode tabs to completely unload before ending the browser session","description":"This policy causes Microsoft Edge to continue running until all Internet Explorer tabs have completely finished unloading. This allows Internet Explorer plugins like ActiveX controls to perform other critical work even after the browser has been closed. However, this can cause stability and performance issues, and Microsoft Edge processes may remain active in the background with no visible windows if the webpage or plugin prevents Internet Explorer from unloading. This policy should only be used if your organization depends on a plugin that requires this behavior.\n\nIf you enable this policy, Microsoft Edge always waits for Internet Explorer mode tabs to fully unload before ending the browser session.\n\nIf you disable or don't configure this policy, Microsoft Edge won't always wait for Internet Explorer mode tabs to fully unload before ending the browser session.\n\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2174004","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationalwayswaitforunload_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationalwayswaitforunload_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationcloudneutralsitesreporting","displayName":"Configure reporting of potentially misconfigured neutral site URLs to the M365 Admin Center Site Lists app","description":"This setting lets you enable reporting of sites that might need to be configured as a neutral site on the Enterprise Mode Site List. The user must be signed into Microsoft Edge with a valid work or school account for reports to be sent, and the user's account tenant must match the tenant specified by the policy.\n\nIf you configure this policy, Microsoft Edge will send a report to the M365 Admin Center Site Lists app when a navigation appears stuck redirecting back and forth between the Microsoft Edge and Internet Explorer engines several times. This usually indicates that redirection to an authentication server is switching engines, which repeatedly fails in a loop. The report will show the URL of the site that is the redirect target, minus any query string or fragment. The user's identity isn't reported.\n\nFor this reporting to work correctly, you must have successfully visited the Microsoft Edge Site Lists app in the M365 Admin Center at least once. This activates a per-tenant storage account used to store these reports. Microsoft Edge will still attempt to send reports if this step hasn't been completed. However, the reports will not be stored in the Site Lists app.\n\nWhen enabling this policy, you must specify your O365 tenant ID. To learn more about finding your O365 tenant ID, see https://go.microsoft.com/fwlink/?linkid=2185668\n\nIf you disable or don't configure this policy, Microsoft Edge will never send reports about potentially misconfigured neutral sites to the Site Lists app.\n\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2165707","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationcloudsitelist","displayName":"Configure the Enterprise Mode Cloud Site List","description":"The Microsoft Edge Site Lists setting in the M365 Admin Center allows you to host your site list(s) in a compliant cloud location and manage the contents of your site list(s) through the built-in experience. This setting allows you to specify which site list within the M365 Admin Center to deploy to your users. The user must be signed into Microsoft Edge with a valid work or school account. Otherwise, Microsoft Edge will not download the site list from the cloud location.\n\nThis setting is applicable only when the \"InternetExplorerIntegrationLevel\" setting is configured.\n\nIf you configure this policy, Microsoft Edge will use the specified site list. When enabled, you can enter the identifier of the site list that you created and published to the cloud in M365 Admin Center.\n\nThis setting takes precedence over Microsoft Edge's \"InternetExplorerIntegrationSiteList\" policy as well as Internet Explorer's site list setting (Use the Enterprise mode IE website list). If you disable or don't configure this policy, Microsoft Edge will use the \"InternetExplorerIntegrationSiteList\" policy instead.\n\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2165707","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationcloudusersitesreporting","displayName":"Configure reporting of IE Mode user list entries to the M365 Admin Center Site Lists app","description":"This setting lets you enable reporting of sites that Microsoft Edge users add to their local IE Mode site list. The user must be signed into Microsoft Edge with a valid work or school account for reports to be sent, and the user's account tenant must match the tenant specified by the policy.\n\nIf you configure this policy, Microsoft Edge will send a report to the M365 Admin Center Site Lists app when a user adds a site to their local IE mode site list. The report will show the URL of the site the user added, minus any query string or fragment. The user's identity isn't reported.\n\nFor this reporting to work correctly, you must have successfully visited the Microsoft Edge Site Lists app in the M365 Admin Center at least once. This activates a per-tenant storage account used to store these reports. Microsoft Edge will still attempt to send reports if this step hasn't been completed. However, the reports will not be stored in the Site Lists app.\n\nWhen enabling this policy, you must specify your O365 tenant ID. To learn more about finding your O365 tenant ID, see https://go.microsoft.com/fwlink/?linkid=2185668\n\nIf you disable or don't configure this policy, Microsoft Edge will never send reports about URLs added to a user's local site list to the Site Lists app.\n\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2165707","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationcomplexnavdatatypes","displayName":"Configure whether form data and HTTP headers will be sent when entering or exiting Internet Explorer mode","description":"Starting with Microsoft Edge version 96, navigations that switch between Internet Explorer mode and Microsoft Edge will include form data.\n\nIf you enable this policy, you can specify which data types should be included in navigations between Microsoft Edge and Internet Explorer mode.\n\nIf you disable or don't configure this policy, Microsoft Edge will use the new behavior of including form data in navigations that change modes.\n\nTo learn more, see https://go.microsoft.com/fwlink/?linkid=2174004\n\nPolicy options mapping:\n\n* IncludeNone (0) = Do not send form data or headers\n\n* IncludeFormDataOnly (1) = Send form data only\n\n* IncludeHeadersOnly (2) = Send additional headers only\n\n* IncludeFormDataAndHeaders (3) = Send form data and additional headers\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationcomplexnavdatatypes_includenone","displayName":"Do not send form data or headers","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationcomplexnavdatatypes_includeformdataonly","displayName":"Send form data only","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationcomplexnavdatatypes_includeheadersonly","displayName":"Send additional headers only","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationcomplexnavdatatypes_includeformdataandheaders","displayName":"Send form data and additional headers","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationenhancedhangdetection","displayName":"Configure enhanced hang detection for Internet Explorer mode","description":"Enhanced hang detection is a more granular approach to detecting hung webpages in Internet Explorer mode than what standalone Internet Explorer uses. When a hung webpage is detected, the browser will apply a mitigation to prevent the rest of the browser from hanging.\n\nThis setting allows you to configure the use of enhanced hang detection in case you run into incompatible issues with any of your websites. We recommend disabling this policy only if you see notifications such as \"(website) is not responding\" in Internet Explorer mode but not in standalone Internet Explorer.\n\nThis setting works in conjunction with:\n\"InternetExplorerIntegrationLevel\" is set to 'IEMode'\nand\n\"InternetExplorerIntegrationSiteList\" policy where the list has at least one entry.\n\nIf you set this policy to 'Enabled' or don't configure it, websites running in Internet Explorer mode will use enhanced hang detection.\n\nIf you set this policy to 'Disabled', enhanced hang detection is disabled, and users will get the basic Internet Explorer hang detection behavior.\n\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210\n\nPolicy options mapping:\n\n* Disabled (0) = Enhanced hang detection disabled\n\n* Enabled (1) = Enhanced hang detection enabled\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationenhancedhangdetection_disabled","displayName":"Enhanced hang detection disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationenhancedhangdetection_enabled","displayName":"Enhanced hang detection enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationlevel","displayName":"Configure Internet Explorer integration","description":"For guidance about configuring the optimal experience for Internet Explorer mode see https://go.microsoft.com/fwlink/?linkid=2094210\n\nPolicy options mapping:\n\n* None (0) = None\n\n* IEMode (1) = Internet Explorer mode\n\n* NeedIE (2) = Internet Explorer 11\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationlevel_none","displayName":"None","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationlevel_iemode","displayName":"Internet Explorer mode","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationlevel_needie","displayName":"Internet Explorer 11","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationlocalfileallowed","displayName":"Allow launching of local files in Internet Explorer mode","description":"This policy controls the availability of the --ie-mode-file-url command line argument used to launch Microsoft Edge with a local file specified on the command line into Internet Explorer mode.\n\nThis setting works in conjunction with \"InternetExplorerIntegrationLevel\" (which is set to 'IEMode').\n\nIf this policy is set to \"true\", or don't configure it, the user is allowed to use the --ie-mode-file-url command line argument for launching local files in Internet Explorer mode.\n\nIf this policy is set to \"false\", the user isn't allowed to use the --ie-mode-file-url command line argument for launching local files in Internet Explorer mode.\n\nFor more information about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationlocalfileallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationlocalfileallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationlocalfileextensionallowlist","displayName":"Open local files in Internet Explorer mode file extension allow list","description":"This policy limits which file:// URLs are allowed to be launched into Internet Explorer mode based on file extension.\n\nThis setting works in conjunction with:\n\"InternetExplorerIntegrationLevel\" is set to 'IEMode'.\n\nWhen a file:// URL is requested to launch in Internet Explorer mode, the file extension of the URL must be present in this list in order for the URL to be allowed to launch in Internet Explorer mode. A URL which is blocked from opening in Internet Explorer mode will instead open in Edge mode.\n\nIf you set this policy to the special value \"*\" or don't configure it, all file extensions are allowed.\n\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationlocalfileshowcontextmenu","displayName":"Show context menu to open a file:// link in Internet Explorer mode","description":"This policy controls the visibility of the 'Open link in new Internet Explorer mode tab' option on the context menu for file:// links.\n\nThis setting works in conjunction with:\n\"InternetExplorerIntegrationLevel\" is set to 'IEMode'.\n\nIf you set this policy to true, the 'Open link in new Internet Explorer mode tab' context menu item will be available for file:// links.\n\nIf you set this policy to false or don't configure it, the context menu item will not be added.\n\nIf the \"InternetExplorerIntegrationReloadInIEModeAllowed\" policy allows users to reload sites in Internet Explorer mode, then the 'Open link in new Internet Explorer mode tab' context menu item will be available for all links, except links to sites explicitly configured by the site list to use Microsoft Edge mode. In this case, if you set this policy to true, the context menu item will be available for file:// links even for sites configured to use Microsoft Edge mode. If you set this policy to false or don't configure it, this policy has no effect.\n\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationlocalfileshowcontextmenu_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationlocalfileshowcontextmenu_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationlocalmhtfileallowed","displayName":"Allow local MHTML files to open automatically in Internet Explorer mode","description":"This policy controls whether local mht or mhtml files launched from the command line can open automatically in Internet Explorer mode based on the file content without specifying the --ie-mode-file-url command line.\n\nThis setting works in conjunction with:\n\"InternetExplorerIntegrationLevel\" is set to 'IEMode'\nand\n\"InternetExplorerIntegrationLocalFileAllowed\" is enabled or not configured.\n\nIf you enable or don't configure this policy, local mht or mhtml files can launch in Microsoft Edge or Internet Explorer mode to best view the file.\n\nIf you disable this policy, local mht or mhtml files will launch in Microsoft Edge.\n\nNote that if you use the --ie-mode-file-url command line argument for launching local mht or mhtml files, it takes precedence over how you configured this policy.\n\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationlocalmhtfileallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationlocalmhtfileallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationreloadiniemodeallowed","displayName":"Allow unconfigured sites to be reloaded in Internet Explorer mode","description":"This policy allows users to reload unconfigured sites (that are not configured in the Enterprise Mode Site List) in Internet Explorer mode when browsing in Microsoft Edge and a site requires Internet Explorer for compatibility.\n\nAfter a site has been reloaded in Internet Explorer mode, \"in-page\" navigations will stay in Internet Explorer mode (for example, a link, script, or form on the page, or a server-side redirect from another \"in-page\" navigation). Users can choose to exit from Internet Explorer mode, or Microsoft Edge will automatically exit from Internet Explorer mode when a navigation that isn't \"in-page\" occurs (for example, using the address bar, the back button, or a favorite link).\n\nUsers can also optionally tell Microsoft Edge to use Internet Explorer mode for the site in the future. This choice will be remembered for a length of time managed by the \"InternetExplorerIntegrationLocalSiteListExpirationDays\" policy.\n\nIf the \"InternetExplorerIntegrationLevel\" policy is set to 'IEMode', then sites explicitly configured by the \"InternetExplorerIntegrationSiteList\" policy's site list to use Microsoft Edge can't be reloaded in Internet Explorer mode, and sites configured by the site list or by the \"SendIntranetToInternetExplorer\" policy to use Internet Explorer mode can't exit from Internet Explorer mode.\n\nIf you enable this policy, users are allowed to reload unconfigured sites in Internet Explorer mode.\n\nIf you disable this policy, users aren't allowed to reload unconfigured sites in Internet Explorer mode.\n\nNote that if you enable this policy, it takes precedence over how you configured the \"InternetExplorerIntegrationTestingAllowed\" policy, and that policy will be disabled.\n\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationreloadiniemodeallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationreloadiniemodeallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationreloadiniemodeallowed_recommended","displayName":"Allow unconfigured sites to be reloaded in Internet Explorer mode (users can override)","description":"This policy allows users to reload unconfigured sites (that are not configured in the Enterprise Mode Site List) in Internet Explorer mode when browsing in Microsoft Edge and a site requires Internet Explorer for compatibility.\n\nAfter a site has been reloaded in Internet Explorer mode, \"in-page\" navigations will stay in Internet Explorer mode (for example, a link, script, or form on the page, or a server-side redirect from another \"in-page\" navigation). Users can choose to exit from Internet Explorer mode, or Microsoft Edge will automatically exit from Internet Explorer mode when a navigation that isn't \"in-page\" occurs (for example, using the address bar, the back button, or a favorite link).\n\nUsers can also optionally tell Microsoft Edge to use Internet Explorer mode for the site in the future. This choice will be remembered for a length of time managed by the \"InternetExplorerIntegrationLocalSiteListExpirationDays\" policy.\n\nIf the \"InternetExplorerIntegrationLevel\" policy is set to 'IEMode', then sites explicitly configured by the \"InternetExplorerIntegrationSiteList\" policy's site list to use Microsoft Edge can't be reloaded in Internet Explorer mode, and sites configured by the site list or by the \"SendIntranetToInternetExplorer\" policy to use Internet Explorer mode can't exit from Internet Explorer mode.\n\nIf you enable this policy, users are allowed to reload unconfigured sites in Internet Explorer mode.\n\nIf you disable this policy, users aren't allowed to reload unconfigured sites in Internet Explorer mode.\n\nNote that if you enable this policy, it takes precedence over how you configured the \"InternetExplorerIntegrationTestingAllowed\" policy, and that policy will be disabled.\n\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationreloadiniemodeallowed_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationreloadiniemodeallowed_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationsitelist","displayName":"Configure the Enterprise Mode Site List","description":"For guidance about configuring the optimal experience for Internet Explorer mode see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationsitelistrefreshinterval","displayName":"Configure how frequently the Enterprise Mode Site List is refreshed","description":"This setting lets you specify a custom refresh interval for the Enterprise Mode Site List. The refresh interval is specified in minutes. The minimum refresh interval is 30 minutes.\n\nThis setting is applicable only when the \"InternetExplorerIntegrationSiteList\" or \"InternetExplorerIntegrationCloudSiteList\" setting is configured.\n\nIf you configure this policy, Microsoft Edge attempts to retrieve an updated version of the configured Enterprise Mode Site List using the specified refresh interval.\n\nIf you disable or don't configure this policy, Microsoft Edge uses a default refresh interval, it's 10080 minutes (7 days) starting from version 110 or later, 120 minutes from version 93 to 110, and 30 minutes before version 93.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationsiteredirect","displayName":"Specify how \"in-page\" navigations to unconfigured sites behave when started from Internet Explorer mode pages","description":"An \"in-page\" navigation is started from a link, a script, or a form on the current page. It can also be a server-side redirect of a previous \"in-page\" navigation attempt. Conversely, a user can start a navigation that isn't \"in-page\" that's independent of the current page in several ways by using the browser controls. For example, using the address bar, the back button, or a favorite link.\n\nThis setting lets you specify whether navigations from pages loaded in Internet Explorer mode to unconfigured sites (that are not configured in the Enterprise Mode Site List) switch back to Microsoft Edge or remain in Internet Explorer mode.\n\nThis setting works in conjunction with:\n\"InternetExplorerIntegrationLevel\" is set to 'IEMode'\nand\n\"InternetExplorerIntegrationSiteList\" policy where the list has at least one entry.\n\nIf you disable or don't configure this policy, only sites configured to open in Internet Explorer mode will open in that mode. Any site not configured to open in Internet Explorer mode will be redirected back to Microsoft Edge.\n\nIf you set this policy to 'Default', only sites configured to open in Internet Explorer mode will open in that mode. Any site not configured to open in Internet Explorer mode will be redirected back to Microsoft Edge.\n\nIf you set this policy to 'AutomaticNavigationsOnly', you get the default experience except that all automatic navigations (such as 302 redirects) to unconfigured sites will be kept in Internet Explorer mode.\n\nIf you set this policy to 'AllInPageNavigations', all navigations from pages loaded in IE mode to unconfigured sites are kept in Internet Explorer mode (Least Recommended).\n\nIf the \"InternetExplorerIntegrationReloadInIEModeAllowed\" policy allows users to reload sites in Internet Explorer mode, then all in-page navigations from unconfigured sites that users have chosen to reload in Internet Explorer mode will be kept in Internet Explorer mode, regardless of how this policy is configured.\n\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2105106\n\nPolicy options mapping:\n\n* Default (0) = Default\n\n* AutomaticNavigationsOnly (1) = Keep only automatic navigations in Internet Explorer mode\n\n* AllInPageNavigations (2) = Keep all in-page navigations in Internet Explorer mode\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationsiteredirect_default","displayName":"Default","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationsiteredirect_automaticnavigationsonly","displayName":"Keep only automatic navigations in Internet Explorer mode","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationsiteredirect_allinpagenavigations","displayName":"Keep all in-page navigations in Internet Explorer mode","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationtestingallowed","displayName":"Allow Internet Explorer mode testing (Obsolete)","description":"This policy is obsolete because it has been superseded by an improved feature. It doesn't work in Microsoft Edge after version 94. To allow users to open applications in Internet Explorer mode, use the \"InternetExplorerIntegrationReloadInIEModeAllowed\" policy instead. Alternatively, users can still use the --ie-mode-test flag.\n\nThis policy allows users to test applications in Internet Explorer mode by opening an Internet Explorer mode tab in Microsoft Edge.\n\nUsers can do so from within the \"More tools\" menu by selecting 'Open sites in Internet Explorer mode'.\n\nAdditionally, users can test their applications in a modern browser without removing applications from the site list using the option 'Open sites in Edge mode'.\n\nThis setting works in conjunction with:\n\"InternetExplorerIntegrationLevel\" is set to 'IEMode'.\n\nIf you enable this policy, the option to 'Open sites in Internet Explorer mode' will be visible under \"More tools\". Users can view their sites in Internet Explorer mode on this tab. Another option to 'Open sites in Edge mode' will also be visible under \"More tools\" to help testing sites in a modern browser without removing them from the site list. Note that if the \"InternetExplorerIntegrationReloadInIEModeAllowed\" policy is enabled, it takes precedence and these options will not be visible under \"More tools\".\n\nIf you disable or don't configure this policy, users can't see the options 'Open in Internet Explorer mode' and 'Open in Edge mode' under \"More tools\" menu. However, users can configure these options with the --ie-mode-test flag.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationtestingallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationtestingallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationwindowopenheightadjustment","displayName":"Configure the pixel adjustment between window.open heights sourced from IE mode pages vs. Edge mode pages","description":"This setting lets you specify a custom adjustment to the height of popup windows generated via window.open from the Internet Explorer mode site.\n\nIf you configure this policy, Microsoft Edge will add the adjustment value to the height, in pixels. The exact difference depends on the UI configuration of both IE and Edge, but a typical difference is 5.\n\nIf you disable or don't configure this policy, Microsoft Edge will treat IE mode window.open the same as Edge mode window.open in window height calculations.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationwindowopenwidthadjustment","displayName":"Configure the pixel adjustment between window.open widths sourced from IE mode pages vs. Edge mode pages","description":"This setting lets you specify a custom adjustment to the width of popup windows generated via window.open from the Internet Explorer mode site.\n\nIf you configure this policy, Microsoft Edge will add the adjustment value to the width, in pixels. The exact difference depends on the UI configuration of both IE and Edge, but a typical difference is 4.\n\nIf you disable or don't configure this policy, Microsoft Edge will treat IE mode window.open the same as Edge mode window.open in window width calculations.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationzoneidentifiermhtfileallowed","displayName":"Automatically open downloaded MHT or MHTML files from the web in Internet Explorer mode","description":"This policy controls whether MHT or MHTML files that are downloaded from the web are automatically opened in Internet Explorer mode.\n\nIf you enable this policy, the MHT or MHTML files that are downloaded from the web can be opened in both Microsoft Edge and Internet Explorer mode to provide the best user experience.\n\nIf you disable or don't configure this policy, MHT or MHTML files that are downloaded from the web won't automatically open in Internet Explorer mode.\n\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationzoneidentifiermhtfileallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerintegrationzoneidentifiermhtfileallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorermodecleardataonexitenabled","displayName":"Clear history for IE and IE mode every time you exit","description":"This policy controls whether browsing history is deleted from Internet Explorer and Internet Explorer mode every time Microsoft Edge is closed.\n\nUsers can configure this setting in the 'Clear browsing data for Internet Explorer' option in the Privacy, search, and services menu of Settings.\n\nIf you enable this policy, on browser exit Internet Explorer browsing history will be cleared.\n\nIf you disable or do not configure this policy, Internet Explorer browsing history will not be cleared on browser exit.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorermodecleardataonexitenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorermodecleardataonexitenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorermodeenablesavepageas","displayName":"Allow Save page as in Internet Explorer mode","description":"This policy enables 'Save page as' functionality in Internet Explorer mode.\nUsers can use this option to save the current page in the browser. When a user reopens a saved page, it's loaded in the default browser.\n\nIf you enable this policy, the \"Save page as\" option is clickable in \"More tools\".\n\nIf you disable or don't configure this policy, users can't select the \"Save page as\" option in \"More tools\".\n\nNote: To make the \"Ctrl+S\" shortcut work, users must enable the Internet Explorer policy, namely 'Enable extended hot key in Internet Explorer mode'.\n\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorermodeenablesavepageas_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorermodeenablesavepageas_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorermodetabinedgemodeallowed","displayName":"Allow sites configured for Internet Explorer mode to open in Microsoft Edge","description":"This policy lets sites configured to open in Internet Explorer mode to be opened by Microsoft Edge for testing on a modern browser without removing them from the site list.\n\nUsers can configure this setting in the \"More tools\" menu by selecting 'Open sites in Microsoft Edge'.\n\nIf you enable this policy, the option to 'Open sites in Microsoft Edge' will be visible under \"More tools\". Users use this option to test IE mode sites on a modern browser.\n\nIf you disable or don't configure this policy, users can't see the option 'Open in Microsoft Edge' under the \"More tools\" menu. However, users can access this menu option with the --ie-mode-test flag.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorermodetabinedgemodeallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorermodetabinedgemodeallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorermodetoolbarbuttonenabled","displayName":"Show the Reload in Internet Explorer mode button in the toolbar","description":"Set this policy to show the Reload in Internet Explorer mode button in the toolbar. Users can hide the button in the toolbar through edge://settings/appearance. The button will only be shown on the toolbar when the \"InternetExplorerIntegrationReloadInIEModeAllowed\" policy is enabled or if the user has chosen to enable \"Allow sites to be reloaded in Internet Explorer mode\".\n\nIf you enable this policy, the Reload in Internet mode button is pinned to the toolbar.\n\nIf you disable or don't configure this policy, the Reload in Internet Explorer mode button isn't shown in the toolbar by default. Users can toggle the Show Internet Explorer mode button in edge://settings/appearance.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorermodetoolbarbuttonenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorermodetoolbarbuttonenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorermodetoolbarbuttonenabled_recommended","displayName":"Show the Reload in Internet Explorer mode button in the toolbar (users can override)","description":"Set this policy to show the Reload in Internet Explorer mode button in the toolbar. Users can hide the button in the toolbar through edge://settings/appearance. The button will only be shown on the toolbar when the \"InternetExplorerIntegrationReloadInIEModeAllowed\" policy is enabled or if the user has chosen to enable \"Allow sites to be reloaded in Internet Explorer mode\".\n\nIf you enable this policy, the Reload in Internet mode button is pinned to the toolbar.\n\nIf you disable or don't configure this policy, the Reload in Internet Explorer mode button isn't shown in the toolbar by default. Users can toggle the Show Internet Explorer mode button in edge://settings/appearance.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorermodetoolbarbuttonenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorermodetoolbarbuttonenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorersetforegroundwhenactive","displayName":"Keep the active Microsoft Edge window with an Internet Explorer mode tab always in the foreground.","description":"This policy controls whether to always keep the active Microsoft Edge window with an Internet Explorer mode tab in the foreground.\n\nIf you enable this policy, the active Microsoft Edge window with an Internet Explorer mode tab will always be in the foreground.\n\nIf you disable or don't configure this policy, the active Microsoft Edge window with an Internet Explorer mode tab will not be kept in the foreground.\n\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorersetforegroundwhenactive_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorersetforegroundwhenactive_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerzoomdisplay","displayName":"Display zoom in IE Mode tabs with DPI Scale included like it is in Internet Explorer","description":"Lets you display zoom in IE Mode tabs similar to how it was displayed in Internet Explorer, where the DPI scale of the display is factored in.\n\nFor example, if you have a page zoomed to 200% on a 100 DPI scale display and you change the display to 150 DPI, Microsoft Edge would still display the zoom as 200%. However, Internet Explorer factors in the DPI scale and displays 300%.\n\nIf you enable this policy, zoom values will be displayed with the DPI scale included for IE Mode tabs.\n\nIf you disable or don't configure this policy, zoom values will be displayed without DPI scale included for IE Mode tabs","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerzoomdisplay_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.internetexplorerzoomdisplay_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.intranetfilelinksenabled","displayName":"Allow intranet zone file URL links from Microsoft Edge to open in Windows File Explorer","description":"This setting allows file URL links to intranet zone files from intranet zone HTTPS websites to open Windows File Explorer for that file or directory.\n\nIf you enable this policy, intranet zone file URL links originating from intranet zone HTTPS pages will open Windows File Explorer to the parent directory of the file and select the file. Intranet zone directory URL links originating from intranet zone HTTPS pages will open Windows File Explorer to the directory with no items in the directory selected.\n\nIf you disable or don't configure this policy, file URL links will not open.\n\nMicrosoft Edge uses the definition of intranet zone as configured for Internet Explorer. Note that https://localhost/ is specifically blocked as an exception of allowed intranet zone host, while loopback addresses (127.0.0.*, [::1]) are considered internet zone by default.\n\nUsers may opt out of prompts on a per-protocol/per-site basis unless the \"ExternalProtocolDialogShowAlwaysOpenCheckbox\" policy is disabled.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.intranetfilelinksenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.intranetfilelinksenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.javascriptallowedforurls","displayName":"Allow JavaScript on specific sites","description":"Define a list of sites, based on URL patterns, that are allowed to run JavaScript.\n\nIf you don't configure this policy, \"DefaultJavaScriptSetting\" applies for all sites, if it's set. If not, the user's personal setting applies.\n\nFor detailed information about valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.javascriptblockedforurls","displayName":"Block JavaScript on specific sites","description":"Define a list of sites, based on URL patterns, that aren't allowed to run JavaScript.\n\nIf you don't configure this policy, \"DefaultJavaScriptSetting\" applies for all sites, if it's set. If not, the user's personal setting applies.\n\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.\n\nNote that this policy blocks JavaScript based on whether the origin of the top-level document (usually the page URL that is also displayed in the address bar) matches any of the patterns. Therefore this policy is not appropriate for mitigating web supply-chain attacks. For example, supplying the pattern `https://[*.]foo.com/` will not prevent a page hosted on, say, `https://contoso.com` from running a script loaded from `https://www.foo.com/example.js`. Furthermore, supplying the pattern `https://contoso.com/` will not prevent a document from `https://contoso.com` from running scripts if it is not the top-level document, but embedded as a sub-frame into a page hosted on another origin, say, `https://www.fabrikam.com`.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.javascriptjitallowedforsites","displayName":"Allow JavaScript to use JIT on these sites","description":"Allows you to set a list of site url patterns that specify sites which are allowed to run JavaScript with JIT (Just In Time) compiler enabled.\n\nFor detailed information on valid site url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.\n\nJavaScript JIT policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.contoso.com will not correctly apply to contoso.com or subdomain.contoso.com since they both resolve to the same eTLD+1 (contoso.com) for which there is no policy. In this case, policy must be set on contoso.com to apply correctly for both contoso.com and subdomain.contoso.com.\n\nThis policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if contoso.com is listed in the JavaScriptJitAllowedForSites policy but contoso.com loads a frame containing fabrikam.com then contoso.com will have JavaScript JIT enabled, but fabrikam.com will use the policy from \"DefaultJavaScriptJitSetting\", if set, or default to JavaScript JIT enabled.\n\nIf you don't configure this policy for a site then the policy from \"DefaultJavaScriptJitSetting\" applies to the site, if set, otherwise Javascript JIT is enabled for the site.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.javascriptjitblockedforsites","displayName":"Block JavaScript from using JIT on these sites","description":"Allows you to set a list of site url patterns that specify sites which are not allowed to run JavaScript JIT (Just In Time) compiler enabled.\n\nDisabling the JavaScript JIT will mean that Microsoft Edge may render web content more slowly, and may also disable parts of JavaScript including WebAssembly. Disabling the JavaScript JIT may allow Microsoft Edge to render web content in a more secure configuration.\n\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.\n\nJavaScript JIT policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.contoso.com will not correctly apply to contoso.com or subdomain.contoso.com since they both resolve to the same eTLD+1 (contoso.com) for which there is no policy. In this case, policy must be set on contoso.com to apply correctly for both contoso.com and subdomain.contoso.com.\n\nThis policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if contoso.com is listed in the JavaScriptJitBlockedForSites policy but contoso.com loads a frame containing fabrikam.com then contoso.com will have JavaScript JIT disabled, but fabrikam.com will use the policy from \"DefaultJavaScriptJitSetting\", if set, or default to JavaScript JIT enabled.\n\nIf you don't configure this policy for a site then the policy from \"DefaultJavaScriptJitSetting\" applies to the site, if set, otherwise JavaScript JIT is enabled for the site.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.javascriptoptimizerallowedforsites","displayName":"Allow JavaScript optimization on these sites","description":"Allows you to set a list of site URL patterns that specify sites for which advanced JavaScript optimizations are enabled.\n\nFor detailed information on valid site url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.\n\nJavaScript optimization policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.contoso.com doesn't correctly apply to contoso.com or subdomain.contoso.com since they both resolve to the same eTLD+1 (contoso.com) for which there's no policy. In this case, policy must be set on contoso.com to apply correctly for both contoso.com and subdomain.contoso.com.\n\nThis policy applies on a frame-by-frame basis and not based on top-level origin URL alone; so, for example, if contoso.com is listed in the \"JavaScriptOptimizerAllowedForSites\" policy but contoso.com loads a frame containing fabrikam.com, then contoso.com has JavaScript optimizations enabled, but fabrikam.com uses the policy from \"DefaultJavaScriptOptimizerSetting\", if set, or default to JavaScript optimizations enabled. Blocklist entries have higher priority than allowlist entries, which in turn have higher priority than the configured default value.\n\nIf you don't configure this policy for a site, then the policy from \"DefaultJavaScriptOptimizerSetting\" applies to the site, if set, otherwise Javascript optimization is enabled for the site.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.javascriptoptimizerblockedforsites","displayName":"Block JavaScript optimizations on these sites","description":"Allows you to set a list of site url patterns that specify sites for which advanced JavaScript optimizations are disabled.\n\nDisabling JavaScript optimizations means that Microsoft Edge may render web content more slowly.\n\nFor detailed information on valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.\n\nJavaScript optimization policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.contoso.com won't correctly apply to contoso.com or subdomain.contoso.com since they both resolve to the same eTLD+1 (contoso.com) for which there's no policy. In this case, policy must be set on contoso.com to apply correctly for both contoso.com and subdomain.contoso.com.\n\nThis policy applies on a frame-by-frame basis and isn't based on top-level origin url alone; so, for example, if contoso.com is listed in the \"JavaScriptOptimizerBlockedForSites\" policy but contoso.com loads a frame containing fabrikam.com, then contoso.com has JavaScript optimizations disabled, but fabrikam.com will use the policy from \"DefaultJavaScriptOptimizerSetting\", if set, or default to JavaScript optimizations enabled. Blocklist entries have higher priority than allowlist entries, which in turn have higher priority than the configured default value.\n\nIf you don't configure this policy for a site, then the policy from \"DefaultJavaScriptOptimizerSetting\" applies to the site, if set; otherwise, JavaScript optimization is enabled for the site.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.keyboardfocusablescrollersenabled","displayName":"Enable keyboard focusable scrollers (Obsolete)","description":"This policy provides a temporary opt-out for the new keyboard focusable scrollers behavior.\n\nWhen this policy is Enabled or unset, scrollers without focusable children are keyboard focusable by default.\n\nWhen this policy is Disabled, scrollers aren't keyboard focusable by default.\n\nThis policy is a temporary workaround. Starting in Microsoft Edge version 139, this policy is obsolete.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.keyboardfocusablescrollersenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.keyboardfocusablescrollersenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.legacysamesitecookiebehaviorenabled","displayName":"Enable default legacy SameSite cookie behavior setting (Obsolete)","description":"This policy doesn't work because it was only intended to serve only as a short-term mechanism to give enterprises more time to update their environments if they were found to be incompatible with the SameSite behavior change.\n\nIf you still require legacy cookie behavior, please use \"LegacySameSiteCookieBehaviorEnabledForDomainList\" to configure behavior on a per-domain basis.\n\nLets you revert all cookies to legacy SameSite behavior. Reverting to legacy behavior causes cookies that don't specify a SameSite attribute to be treated as if they were \"SameSite=None\", removes the requirement for \"SameSite=None\" cookies to carry the \"Secure\" attribute, and skips the scheme comparison when evaluating if two sites are same-site.\n\nIf you don't set this policy, the default SameSite behavior for cookies will depend on other configuration sources for the SameSite-by-default feature, the Cookies-without-SameSite-must-be-secure feature, and the Schemeful Same-Site feature. These features can also be configured by a field trial or the same-site-by-default-cookies flag, the cookies-without-same-site-must-be-secure flag, or the schemeful-same-site flag in edge://flags.\n\nPolicy options mapping:\n\n* DefaultToLegacySameSiteCookieBehavior (1) = Revert to legacy SameSite behavior for cookies on all sites\n\n* DefaultToSameSiteByDefaultCookieBehavior (2) = Use SameSite-by-default behavior for cookies on all sites\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.legacysamesitecookiebehaviorenabled_defaulttolegacysamesitecookiebehavior","displayName":"Revert to legacy SameSite behavior for cookies on all sites","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.legacysamesitecookiebehaviorenabled_defaulttosamesitebydefaultcookiebehavior","displayName":"Use SameSite-by-default behavior for cookies on all sites","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.legacysamesitecookiebehaviorenabledfordomainlist","displayName":"Revert to legacy SameSite behavior for cookies on specified sites (Obsolete)","description":"Cookies set for domains match specified patterns will revert to legacy SameSite behavior.\n\nReverting to legacy behavior causes cookies that don't specify a SameSite attribute to be treated as if they were \"SameSite=None\", removes the requirement for \"SameSite=None\" cookies to carry the \"Secure\" attribute, and skips the scheme comparison when evaluating if two sites are same-site.\n\nIf you don't set this policy, the global default value will be used. The global default will also be used for cookies on domains not covered by the patterns you specify.\n\nThe global default value can be configured using the \"LegacySameSiteCookieBehaviorEnabled\" policy. If \"LegacySameSiteCookieBehaviorEnabled\" is unset, the global default value falls back to other configuration sources.\n\nFor detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.\n\nNote that patterns you list in this policy are treated as domains, not URLs, so you should not specify a scheme or port.\n\nThe policy has been discontinued starting from Edge 132.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.linkedaccountenabled","displayName":"Enable the linked account feature (Obsolete)","description":"This policy is obsolete because Microsoft Edge no longer supports the linked account feature.\n\nMicrosoft Edge guides a user to the account management page where they can link a Microsoft Account (MSA) to an Azure Active Directory (Azure AD) account.\n\nIf you enable or don't configure this policy, linked account information is shown on a flyout. When the Azure AD profile doesn't have a linked account, it shows \"Add account\".\n\nIf you disable this policy, linked accounts are turned off and no extra information is shown.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.linkedaccountenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.linkedaccountenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.livecaptionsallowed","displayName":"Live captions allowed","description":"Allow users to turn the Live captions feature on or off.\n\nLive captions is an accessibility feature that converts speech from the audio that plays in Microsoft Edge in to text and shows this text in a separate window. The entire process happens on the device and no audio or caption text ever leaves the device.\n\nNote: This feature is not generally available. Clients that have the \"ExperimentationAndConfigurationServiceControl\" policy set to 'FullMode' may receive the feature before broad availability. Broad availability will be announced via Microsoft Edge release notes.\n\nIf you enable or don't configure this policy, users can turn this feature on or off at edge://settings/accessibility.\n\nIf you disable this policy, users will not be able to turn this accessibility feature on. If speech recognition files have been downloaded previously, they will be deleted from the device in 30 days. We recommend avoiding this option unless it's needed in your environment.\n\nIf users choose to turn on Live captions, speech recognition files (approximately 100 megabytes) will be downloaded to the device on first run and then periodically to improve performance and accuracy. These files will be deleted after 30 days.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.livecaptionsallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.livecaptionsallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.livevideotranslationenabled","displayName":"Allows users to translate videos to different languages.","description":"This policy configures the on-device real-time video translation feature in Microsoft Edge.\nWith this feature, users can watch videos translated into their selected language in real time.\n\nWhen a user selects the Translate icon and chooses a source (video language) and target language (translated language),\ntranslation components are downloaded on first use (approximately 200 MB per language pair).\n\nThese components may be updated periodically to improve performance and translation quality.\nTranslation is performed locally on the user’s device and no data is sent outside of the device.\nThe feature is available only for non-DRM videos, on supported high-end devices, with select language pairs, and in select regions.\nFor more details, see https://www.microsoft.com/en-us/edge/features/real-time-video-translation.\n\nIf you enable or don’t configure this policy, the on-device real-time video translation feature is enabled and\nusers will see the Translate button when hovering over videos.\n\nIf you disable this policy, the on-device real-time video translation feature is disabled and the Translate button won’t be shown.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.livevideotranslationenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.livevideotranslationenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.localbrowserdatashareenabled","displayName":"Enable Windows to search local Microsoft Edge browsing data","description":"Enables Windows to index Microsoft Edge browsing data stored locally on the user's device and allows users to find and launch previously stored browsing data directly from Windows features such as the search box on the taskbar in Windows.\n\nIf you enable this policy or don't configure it, Microsoft Edge publishes local browsing data to the Windows Indexer.\n\nIf you disable this policy, Microsoft Edge won't share data to the Windows Indexer.\n\nNote that if you disable this policy, Microsoft Edge removes the data shared with Windows on the device and stops sharing any new browsing data.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.localbrowserdatashareenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.localbrowserdatashareenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.localbrowserdatashareenabled_recommended","displayName":"Enable Windows to search local Microsoft Edge browsing data (users can override)","description":"Enables Windows to index Microsoft Edge browsing data stored locally on the user's device and allows users to find and launch previously stored browsing data directly from Windows features such as the search box on the taskbar in Windows.\n\nIf you enable this policy or don't configure it, Microsoft Edge publishes local browsing data to the Windows Indexer.\n\nIf you disable this policy, Microsoft Edge won't share data to the Windows Indexer.\n\nNote that if you disable this policy, Microsoft Edge removes the data shared with Windows on the device and stops sharing any new browsing data.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.localbrowserdatashareenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.localbrowserdatashareenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.localnetworkaccessallowedforurls","displayName":"Allow sites to make requests to local network endpoints.","description":"Specifies a list of URL patterns for which requests initiated from matching origins are exempt from Local Network Access restrictions.\n\nIf an origin is specified by both this policy and the \"LocalNetworkAccessBlockedForUrls\" policy, the blocked list takes precedence.\n\nFor origins not covered by this policy, the user's personal settings and local network access restrictions will apply.\n\nFor guidance on valid URL pattern syntax, see:\nhttps://learn.microsoft.com/deployedge/edge-learnmore-ent-policy-url-patterns\n\nNote: This policy enables controlled exceptions to local network access restrictions. It allows specific public websites to access private IP addresses when necessary for trusted local communication scenarios. For more information about Local Network Access, see https://wicg.github.io/local-network-access/.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.localnetworkaccessblockedforurls","displayName":"Block sites from making requests to local network endpoints.","description":"List of URL patterns. Requests initiated from websites served by matching origins are blocked from issuing Local Network Access requests.\n\nIf an origin is covered by both this policy and by \"LocalNetworkAccessAllowedForUrls\", this policy takes precedence.\n\nDepending on the stage of the rollout of Local Network Access, LocalNetworkAccessRestrictionsEnabled may also need to be enabled for this policy to block Local Network Access requests.\n\nFor origins not covered by the patterns specified here, the user's personal configuration will apply.\n\nFor detailed information on valid URL patterns, please see https://learn.microsoft.com/deployedge/edge-learnmore-ent-policy-url-patterns.\n\nNote: This policy improves local network security by blocking specified public websites from accessing private IP addresses. It helps prevent unauthorized external sites from reaching internal resources unless explicitly permitted. For more information about Local Network Access, see https://wicg.github.io/local-network-access/.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.localnetworkaccessrestrictionsenabled","displayName":"Specifies whether to block requests from public websites to devices on a user's local network. (Obsolete)","description":"Local Network Access restrictions prevent public websites from making\nrequests to devices on a user's local network without explicit user permission.\n\nIf you enable this policy, Microsoft Edge blocks\nany request that would otherwise trigger a DevTools warning\ndue to Local Network Access checks.\nThese requests are denied without prompting the user.\n\nIf you disable or don't configure this policy, Microsoft Edge handles\nthese requests using the default behavior, which may include showing warnings in DevTools\nand allowing the request to proceed depending on the context.\n\nNote: This feature improves local network security by deprecating direct access to private IP addresses from public websites\nunless explicitly granted by the user. For more information about Local Network Access, see https://wicg.github.io/local-network-access/.\n\nStarting in version 140, Microsoft Edge introduces support for policies that manage Local Network Access behavior on a per-URL basis.\n\nYou can configure exceptions to allow specific URLs to bypass Local Network Access restrictions.\n\nYou can also block specific URLs from making Local Network Access requests.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.localnetworkaccessrestrictionsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.localnetworkaccessrestrictionsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.localnetworkaccessrestrictionstemporaryoptout","displayName":"Specifies whether to opt out of Local Network Access restrictions","description":"This policy allows for opting out of restrictions on requests to local network endpoints.\n\nIf you enable this policy, Local Network Access requests will only display warnings in Edge DevTools when Local Network Access checks fail.\n\nIf you disable or don't configure this policy, Local Network Access requests will follow the default handling behavior.\n\nFor more information about Local Network Access restrictions, see Local Network Access .\n\nTo allow specific URL patterns that should automatically be granted Local Network Access permission, use the LocalNetworkAccessAllowedForUrls policy.\n\nNote: This opt-out policy is temporary and will be removed after Microsoft Edge version 152.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.localnetworkaccessrestrictionstemporaryoptout_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.localnetworkaccessrestrictionstemporaryoptout_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.localprovidersenabled","displayName":"Allow suggestions from local providers","description":"Allow suggestions from suggestion providers on the device (local providers), for example, Favorites and Browsing History, in Microsoft Edge's Address Bar and Auto-Suggest List.\n\nIf you enable this policy, suggestions from local providers are used.\n\nIf you disable this policy, suggestions from local providers are never used. Local history and local favorites suggestions will not appear.\n\nIf you do not configure this policy, suggestions from local providers are allowed but the user can change that using the settings toggle.\n\nNote that some features may not be available if a policy to disable this feature has been applied. For example, Browsing History suggestions will not be available if you enable the \"SavingBrowserHistoryDisabled\" policy.\n\nThis policy requires a browser restart to finish applying.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.localprovidersenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.localprovidersenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.localprovidersenabled_recommended","displayName":"Allow suggestions from local providers (users can override)","description":"Allow suggestions from suggestion providers on the device (local providers), for example, Favorites and Browsing History, in Microsoft Edge's Address Bar and Auto-Suggest List.\n\nIf you enable this policy, suggestions from local providers are used.\n\nIf you disable this policy, suggestions from local providers are never used. Local history and local favorites suggestions will not appear.\n\nIf you do not configure this policy, suggestions from local providers are allowed but the user can change that using the settings toggle.\n\nNote that some features may not be available if a policy to disable this feature has been applied. For example, Browsing History suggestions will not be available if you enable the \"SavingBrowserHistoryDisabled\" policy.\n\nThis policy requires a browser restart to finish applying.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.localprovidersenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.localprovidersenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.managedconfigurationperorigin","displayName":"Sets managed configuration values for websites to specific origins","description":"Setting this policy defines the return value of Managed Configuration API for given origin.\n\nManaged Configuration API is a key-value configuration that can be accessed via navigator.device.getManagedConfiguration() javascript call. This API is only available to origins which correspond to force-installed web applications via \"WebAppInstallForceList\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.managedfavorites","displayName":"Configure favorites","description":"Configures a list of managed favorites.\n\nThe policy creates a list of favorites. Each favorite contains the keys \"name\" and \"url,\" which hold the favorite's name and its target. You can configure a subfolder by defining a favorites without an \"url\" key but with an additional \"children\" key that contains a list of favorites as defined above (some of which may be folders again). Microsoft Edge amends incomplete URLs as if they were submitted via the Address Bar, for example \"microsoft.com\" becomes \"https://microsoft.com/\".\n\nThese favorites are placed in a folder that can't be modified by the user (but the user can choose to hide it from the favorites bar). By default the folder name is \"Managed favorites\" but you can change it by adding to the list of favorites a dictionary containing the key \"toplevel_name\" with the desired folder name as the value.\n\nManaged favorites are not synced to the user account and can't be modified by extensions.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.managedsearchengines","displayName":"Manage Search Engines","description":"Lets you configure a list of up to 10 search engines, one of which must be marked as the default search engine. Starting in Microsoft Edge version 100, you can configure up to 100 engines.\n\nYou do not need to specify the encoding. Starting in Microsoft Edge 80, the suggest_url and image_search_url parameters are optional. The optional parameter, image_search_post_params (consists of comma-separated name/value pairs), is available starting in Microsoft Edge 80.\n\nStarting in Microsoft Edge 83, you can enable search engine discovery with the optional allow_search_engine_discovery parameter. This parameter must be the first item in the list. If allow_search_engine_discovery isn't specified, search engine discovery will be disabled by default. Starting in Microsoft Edge 84, you can set this policy as a recommended policy to allow search provider discovery. You don't need to add the optional allow_search_engine_discovery parameter. Starting in Microsoft Edge 100, setting this policy as a recommended policy will also allow users to manually add new search engines from their Microsoft Edge settings.\n\nIf you enable this policy, users can't add, remove, or change any search engine in the list. Users can set their default search engine to any search engine in the list.\n\nIf you disable or don't configure this policy, users can modify the search engines list as desired.\n\nIf the \"DefaultSearchProviderSearchURL\" policy is set, this policy (ManagedSearchEngines) is ignored. The user must restart their browser to finish applying this policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.managedsearchengines_recommended","displayName":"Manage Search Engines (users can override)","description":"Lets you configure a list of up to 10 search engines, one of which must be marked as the default search engine. Starting in Microsoft Edge version 100, you can configure up to 100 engines.\n\nYou do not need to specify the encoding. Starting in Microsoft Edge 80, the suggest_url and image_search_url parameters are optional. The optional parameter, image_search_post_params (consists of comma-separated name/value pairs), is available starting in Microsoft Edge 80.\n\nStarting in Microsoft Edge 83, you can enable search engine discovery with the optional allow_search_engine_discovery parameter. This parameter must be the first item in the list. If allow_search_engine_discovery isn't specified, search engine discovery will be disabled by default. Starting in Microsoft Edge 84, you can set this policy as a recommended policy to allow search provider discovery. You don't need to add the optional allow_search_engine_discovery parameter. Starting in Microsoft Edge 100, setting this policy as a recommended policy will also allow users to manually add new search engines from their Microsoft Edge settings.\n\nIf you enable this policy, users can't add, remove, or change any search engine in the list. Users can set their default search engine to any search engine in the list.\n\nIf you disable or don't configure this policy, users can modify the search engines list as desired.\n\nIf the \"DefaultSearchProviderSearchURL\" policy is set, this policy (ManagedSearchEngines) is ignored. The user must restart their browser to finish applying this policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.mandatoryextensionsforinprivatenavigation","displayName":"Specify extensions users must allow in order to navigate using InPrivate mode","description":"This policy lets you specify a list of extension IDs that must be explicitly allowed by the user to run in InPrivate mode in order to enable InPrivate browsing.\n\nIf users don't allow all listed extensions to run in InPrivate mode, they'll be unable to navigate using InPrivate.\n\nIf any extension in the list isn't installed, InPrivate navigation is blocked.\n\nThis policy only applies when InPrivate mode is enabled. If InPrivate mode is disabled using the InPrivateModeAvailability policy, this policy has no effect.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.microsoft365copilotchaticonenabled","displayName":"Control whether Microsoft 365 Copilot Chat shows in the Microsoft Edge for Business toolbar","description":"For users in an Entra ID Microsoft Edge profile, this policy controls whether the Microsoft 365 Copilot Chat icon will be shown in the Microsoft Edge for Business toolbar for Microsoft 365 Copilot licensed and unlicensed users.\n\nThis policy only applies when users are accessing Copilot in the sidepane.\n\nIf the policy is enabled: Copilot will appear in the toolbar.\n\nIf the policy is disabled: Copilot won't appear in the toolbar.\n\nIf the policy isn't configured: Otherwise, Copilot shows in the toolbar and users may enable or disable Copilot from showing by using the Show Copilot toggle in settings.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.microsoft365copilotchaticonenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.microsoft365copilotchaticonenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.microsoft365copilotchaticonenabled_recommended","displayName":"Control whether Microsoft 365 Copilot Chat shows in the Microsoft Edge for Business toolbar (users can override)","description":"For users in an Entra ID Microsoft Edge profile, this policy controls whether the Microsoft 365 Copilot Chat icon will be shown in the Microsoft Edge for Business toolbar for Microsoft 365 Copilot licensed and unlicensed users.\n\nThis policy only applies when users are accessing Copilot in the sidepane.\n\nIf the policy is enabled: Copilot will appear in the toolbar.\n\nIf the policy is disabled: Copilot won't appear in the toolbar.\n\nIf the policy isn't configured: Otherwise, Copilot shows in the toolbar and users may enable or disable Copilot from showing by using the Show Copilot toggle in settings.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.microsoft365copilotchaticonenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.microsoft365copilotchaticonenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.microsoftedgeinsiderpromotionenabled","displayName":"Microsoft Edge Insider Promotion Enabled","description":"Shows content promoting the Microsoft Edge Insider channels on the About Microsoft Edge settings page.\n\nIf you enable or don't configure this policy, the Microsoft Edge Insider promotion content is shown on the About Microsoft Edge page.\n\nIf you disable this policy, the Microsoft Edge Insider promotion content isn't shown on the About Microsoft Edge page.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.microsoftedgeinsiderpromotionenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.microsoftedgeinsiderpromotionenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.microsofteditorproofingenabled","displayName":"Spell checking provided by Microsoft Editor","description":"The Microsoft Editor service provides enhanced spell and grammar checking for editable text fields on web pages.\n\nIf you enable or don't configure this policy, Microsoft Editor spell check can be used for eligible text fields.\n\nIf you disable this policy, spell check can only be provided by local engines that use platform or Hunspell services. The results from these engines might be less informative than the results Microsoft Editor can provide.\n\nIf the \"SpellcheckEnabled\" policy is set to disabled, or the user disables spell checking in the settings page, this policy will have no effect.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.microsofteditorproofingenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.microsofteditorproofingenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.microsofteditorsynonymsenabled","displayName":"Synonyms are provided when using Microsoft Editor spell checker","description":"The Microsoft Editor service provides enhanced spell and grammar checking for editable text fields on web pages, and synonyms can be suggested as an integrated feature.\n\nIf you enable this policy, Microsoft Editor spell checker provides synonyms for suggestions for misspelled words.\n\nIf you disable or don't configure this policy, Microsoft Editor spell checker won't provide synonyms for suggestions for misspelled words.\n\nIf the \"SpellcheckEnabled\" policy or the \"MicrosoftEditorProofingEnabled\" policy are set to disabled, or the user disables spell checking or chooses not to use Microsoft Editor spell checker in the settings page, this policy will have no effect.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.microsofteditorsynonymsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.microsofteditorsynonymsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.microsoftofficemenuenabled","displayName":"Allow users to access the Microsoft Office menu (Deprecated)","description":"This policy is deprecated because it's been replaced by the Microsoft Edge sidebar. Microsoft Office applications are now available in the sidebar, which can be managed by HubsSidebarEnabled policy.\n\nWhen users can access the Microsoft Office menu, they can get access to Office applications such as Microsoft Word and Microsoft Excel.\n\nIf you enable or don't configure this policy, users can open the Microsoft Office menu.\n\nIf you disable this policy, users won't be able to access the Microsoft Office menu.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.microsoftofficemenuenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.microsoftofficemenuenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.mousegestureenabled","displayName":"Mouse Gesture Enabled","description":"This policy lets you configure the Mouse Gesture feature in Microsoft Edge.\n\nThis feature provides an easy way for users to complete tasks like scroll forward or backward, open new tab, refresh page, etc. They can finish a task by pressing and holding the mouse right button to draw certain patterns on a webpage, instead of clicking the buttons or using keyboard shortcuts.\n\nIf you enable or don't configure this policy, you can use the Mouse Gesture feature on Microsoft Edge to start using this feature.\n\nIf you disable this policy, you can't use the Mouse Gesture feature in Microsoft Edge.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.mousegestureenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.mousegestureenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.mutationeventsenabled","displayName":"Enable deprecated/removed Mutation Events (Obsolete)","description":"This policy provides a temporary opt-in back to a deprecated and removed set of platform events named Mutation Events.\n\nIf you enable this policy, mutation events will continue to be fired, even if they've been disabled by default for normal web users.\n\nIf you disable or don't configure this policy, these events will not be fired.\n\nNote:\nThis policy is a temporary workaround and will be obsolete starting with Microsoft Edge version 137.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.mutationeventsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.mutationeventsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.nativehostsexecutableslaunchdirectly","displayName":"Force Windows executable Native Messaging hosts to launch directly","description":"This policy controls whether native host executables launch directly on Windows.\n\nIf you enable this policy, Microsoft Edge is forced to launch native messaging hosts implemented as executables directly.\n\nIf you disable this policy, Microsoft Edge will launch hosts using cmd.exe as an intermediary process.\n\nIf you don't configure this policy, Microsoft Edge will decide which approach to use based on a progressive rollout from the legacy behavior to the Launch Directly behavior, guided by ecosystem compatibility.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.nativehostsexecutableslaunchdirectly_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.nativehostsexecutableslaunchdirectly_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.nativemessagingallowlist","displayName":"Control which native messaging hosts users can use","description":"Setting the policy specifies which native messaging hosts aren't subject to the deny list. A deny list value of * means all native messaging hosts are denied unless they're explicitly allowed.\n\nAll native messaging hosts are allowed by default. However, if a native messaging host is denied by policy, the admin can use the allow list to change that policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.nativemessagingblocklist","displayName":"Configure native messaging block list","description":"Setting this policy specifies which native messaging hosts shouldn't be loaded. A deny list value of * means all native messaging hosts are denied unless they're explicitly allowed.\n\nIf you leave this policy unset , Microsoft Edge loads all installed native messaging hosts.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.nativemessaginguserlevelhosts","displayName":"Allow user-level native messaging hosts (installed without admin permissions)","description":"If you set this policy to Enabled or leave it unset, Microsoft Edge can use native messaging hosts installed at the user level.\n\nIf you set this policy to Disabled, Microsoft Edge can only use these hosts if they're installed at the system level.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.nativemessaginguserlevelhosts_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.nativemessaginguserlevelhosts_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.navigationdelayforinitialsitelistdownloadtimeout","displayName":"Set a timeout for delay of tab navigation for the Enterprise Mode Site List","description":"Allows you to set a timeout, in seconds, for Microsoft Edge tabs waiting to navigate until the browser has downloaded the initial Enterprise Mode Site List.\n\nThis setting works in conjunction with: \"InternetExplorerIntegrationLevel\" is set to 'IEMode' and \"InternetExplorerIntegrationSiteList\" policy where the list has at least one entry and \"DelayNavigationsForInitialSiteListDownload\" is set to \"All eligible navigations\" (1).\n\nTabs will not wait longer than this timeout for the Enterprise Mode Site List to download. If the browser has not finished downloading the Enterprise Mode Site List when the timeout expires, Microsoft Edge tabs will continue navigating anyway. The value of the timeout should be no greater than 20 seconds and no fewer than 1 second.\n\nIf you set the timeout in this policy to a value greater than 2 seconds, an information bar is shown to the user after 2 seconds. The information bar contains a button that allows the user to quit waiting for the Enterprise Mode Site List download to complete.\n\nIf you don't configure this policy, the default timeout of 4 seconds is used. This default is subject to change in the future.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.networkpredictionoptions","displayName":"Enable network prediction","description":"Enables network prediction and prevents users from changing this setting.\n\nThis controls DNS prefetching, TCP and SSL preconnection, and prerendering of web pages.\n\nIf you don't configure this policy, network prediction is enabled but the user can change it.\n\nPolicy options mapping:\n\n* NetworkPredictionAlways (0) = Predict network actions on any network connection\n\n* NetworkPredictionWifiOnly (1) = Not supported, if this value is used it will be treated as if 'Predict network actions on any network connection' (0) was set\n\n* NetworkPredictionNever (2) = Don't predict network actions on any network connection\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.networkpredictionoptions_networkpredictionalways","displayName":"Predict network actions on any network connection","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.networkpredictionoptions_networkpredictionwifionly","displayName":"Not supported, if this value is used it will be treated as if 'Predict network actions on any network connection' (0) was set","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.networkpredictionoptions_networkpredictionnever","displayName":"Don't predict network actions on any network connection","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.networkpredictionoptions_recommended","displayName":"Enable network prediction (users can override)","description":"Enables network prediction and prevents users from changing this setting.\n\nThis controls DNS prefetching, TCP and SSL preconnection, and prerendering of web pages.\n\nIf you don't configure this policy, network prediction is enabled but the user can change it.\n\nPolicy options mapping:\n\n* NetworkPredictionAlways (0) = Predict network actions on any network connection\n\n* NetworkPredictionWifiOnly (1) = Not supported, if this value is used it will be treated as if 'Predict network actions on any network connection' (0) was set\n\n* NetworkPredictionNever (2) = Don't predict network actions on any network connection\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.networkpredictionoptions_recommended_networkpredictionalways","displayName":"Predict network actions on any network connection","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.networkpredictionoptions_recommended_networkpredictionwifionly","displayName":"Not supported, if this value is used it will be treated as if 'Predict network actions on any network connection' (0) was set","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.networkpredictionoptions_recommended_networkpredictionnever","displayName":"Don't predict network actions on any network connection","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newpdfreaderenabled","displayName":"Microsoft Edge built-in PDF reader powered by Adobe Acrobat enabled","description":"The policy lets Microsoft Edge launch the new version of the built-in PDF reader that's powered by Adobe Acrobat's PDF rendering engine. The new PDF reader ensures that there's no loss of functionality and delivers an enhanced PDF experience. This experience includes richer rendering, improved performance, strong security for PDF handling, and greater accessibility.\n\nIf you enable this policy, Microsoft Edge will use the new Adobe Acrobat powered built-in PDF reader to open all PDF files.\n\nIf you disable or don't configure this policy, Microsoft Edge will use the existing PDF reader to open all PDF files.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.newpdfreaderenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newpdfreaderenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newpdfreaderenabled_recommended","displayName":"Microsoft Edge built-in PDF reader powered by Adobe Acrobat enabled (users can override)","description":"The policy lets Microsoft Edge launch the new version of the built-in PDF reader that's powered by Adobe Acrobat's PDF rendering engine. The new PDF reader ensures that there's no loss of functionality and delivers an enhanced PDF experience. This experience includes richer rendering, improved performance, strong security for PDF handling, and greater accessibility.\n\nIf you enable this policy, Microsoft Edge will use the new Adobe Acrobat powered built-in PDF reader to open all PDF files.\n\nIf you disable or don't configure this policy, Microsoft Edge will use the existing PDF reader to open all PDF files.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.newpdfreaderenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newpdfreaderenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpageallowedbackgroundtypes","displayName":"Configure the background types allowed for the new tab page layout","description":"You can configure which types of background image that are allowed on the new tab page layout in Microsoft Edge.\n\nIf you don't configure this policy, all background image types on the new tab page are enabled.\n\nPolicy options mapping:\n\n* DisableImageOfTheDay (1) = Disable daily background image type\n\n* DisableCustomImage (2) = Disable custom background image type\n\n* DisableAll (3) = Disable all background image types\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpageallowedbackgroundtypes_disableimageoftheday","displayName":"Disable daily background image type","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpageallowedbackgroundtypes_disablecustomimage","displayName":"Disable custom background image type","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpageallowedbackgroundtypes_disableall","displayName":"Disable all background image types","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpageapplauncherenabled","displayName":"Hide App Launcher on Microsoft Edge new tab page","description":"By default, the App Launcher is shown every time a user opens a new tab page.\n\nIf you enable or don't configure this policy, there is no change on the Microsoft Edge new tab page and App Launcher is there for users.\n\nIf you disable this policy, App Launcher doesn't appear and users won't be able to launch M365 apps from Microsoft Edge new tab page via the App Launcher.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpageapplauncherenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpageapplauncherenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagebingchatenabled","displayName":"Disable Bing chat entry-points on Microsoft Edge Enterprise new tab page","description":"By default, the Microsoft Edge new tab page includes three Bing Chat entry points: one inside the search box, one in the Bing autosuggest dropdown when users click or begin typing in the box, and one as a suggested prompt below the box.\n\nIf you enable or don't configure this policy, these Bing Chat entry points continue to appear on the new tab page.\n\nIf you disable this policy, all Bing Chat entry points are removed from the new tab page.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagebingchatenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagebingchatenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagecompanylogo","displayName":"Set new tab page company logo (Obsolete)","description":"This policy didn't work as expected due to changes in operational requirements. Therefore, it's obsolete and shouldn't be used.\n\nSpecifies the company logo that's to be used on the new tab page in Microsoft Edge.\n\nThe policy should be configured as a string that expresses the logo(s) in JSON format. For example: { \"default_logo\": { \"url\": \"https://www.contoso.com/logo.png\", \"hash\": \"cd0aa9856147b6c5b4ff2b7dfee5da20aa38253099ef1b4a64aced233c9afe29\" }, \"light_logo\": { \"url\": \"https://www.contoso.com/light_logo.png\", \"hash\": \"517d286edb416bb2625ccfcba9de78296e90da8e32330d4c9c8275c4c1c33737\" } }\n\nYou configure this policy by specifying the URL from which Microsoft Edge can download the logo and its cryptographic hash (SHA-256), which is used to verify the integrity of the download. The logo must be in PNG or SVG format, and its file size must not exceed 16 MB. The logo is downloaded and cached, and it will be redownloaded whenever the URL or the hash changes. The URL must be accessible without any authentication.\n\nThe 'default_logo' is required and used when there's no background image. If 'light_logo' is provided, it's used when the user's new tab page has a background image. We recommend a horizontal logo with a transparent background that's left-aligned and vertically centered. The logo should have a minimum height of 32 pixels and an aspect ratio from 1:1 to 4:1. The 'default_logo' should have proper contrast against a white/black background, while the 'light_logo' should have proper contrast against a background image.\n\nIf you enable this policy, Microsoft Edge downloads and shows the specified logo(s) on the new tab page. Users can't override or hide the logo(s).\n\nIf you disable or don't configure this policy, Microsoft Edge shows no company logo or a Microsoft logo on the new tab page.\n\nFor help with determining the SHA-256 hash, see [Get-FileHash](/powershell/module/microsoft.powershell.utility/get-filehash).","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagecompanylogobackplatecolor","displayName":"Set the company logo backplate color on the new tab page.","description":"By default, the new tab page sets the company logo backplate color to the neutralStrokeActive (#cecece) constant.\n\nYou can configure this policy with a color hex code to change the company logo backplate color on the new tab page.\n\nIf this policy is not configured, the default neutralStrokeActive (#cecece) color will be used as the backplate color.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagecompanylogoenabled","displayName":"Hide the company logo on the Microsoft Edge new tab page","description":"By default, the company logo is shown on the new tab page if the company logo is configured in Admin Portal.\n\nIf you enable or don't configure this policy, there is no change on the Microsoft Edge new tab page and the company logo is there for users.\n\nIf you disable this policy, the company logo doesn't appear on Microsoft Edge new tab page.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagecompanylogoenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagecompanylogoenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagecontentenabled","displayName":"Allow Microsoft content on the new tab page","description":"This policy applies for Microsoft Edge to all profile types, namely unsigned local user profiles, profiles signed in using a Microsoft Account, profiles signed in using Active Directory, and profiles signed in using Microsoft Entra ID. The Enterprise new tab page for profiles signed in using Microsoft Entra ID can be configured in the Microsoft 365 admin portal, but this policy setting takes precedence; therefore, any Microsoft 365 admin portal configurations are ignored.\n\nIf you enable or don't configure this policy, Microsoft Edge displays Microsoft content on the new tab page. The user can choose different display options for the content. These options include, but aren't limited to: \"Content off\", \"Content visible on scroll\", \"Headings only\", and \"Content visible\". Enabling this policy doesn't force content to be visible - the users can keep setting their own preferred content position.\n\nIf you disable this policy, Microsoft Edge doesn't display Microsoft content on the new tab page. The Content control in the NTP settings flyout is disabled and set to \"Content off\", and the Layout control in the NTP settings flyout is disabled and set to \"Custom\".\n\nRelated policies: \"NewTabPageAllowedBackgroundTypes\", \"NewTabPageQuickLinksEnabled\"","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagecontentenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagecontentenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagehidedefaulttopsites","displayName":"Hide the default top sites from the new tab page","description":"Hides the default top sites from the new tab page in Microsoft Edge.\n\nIf you set this policy to true, the default top site tiles are hidden.\n\nIf you set this policy to false or don't configure it, the default top site tiles remain visible.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagehidedefaulttopsites_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagehidedefaulttopsites_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagelocation","displayName":"Configure the new tab page URL","description":"Configures the default URL for the new tab page.\n\nThe recommended version of this policy doesn't currently work and functions exactly like the mandatory version.\n\nThis policy determines the page that's opened when new tabs are created (including when new windows are opened). It also affects the startup page if that's set to open to the new tab page.\n\nThis policy doesn't determine which page opens on startup; that's controlled by the \"RestoreOnStartup\" policy. It also doesn't affect the home page if that's set to open to the new tab page.\n\nIf you don't configure this policy, the default new tab page is used.\n\nIf you configure this policy *and* the \"NewTabPageSetFeedType\" policy, this policy has precedence.\n\nIf a blank tab is preferred, \"about:blank\" is the correct URL to use, not \"about://blank\".\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is available only on instances that are managed via MDM or joined to a domain via MCX.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagelocation_recommended","displayName":"Configure the new tab page URL (users can override)","description":"Configures the default URL for the new tab page.\n\nThe recommended version of this policy doesn't currently work and functions exactly like the mandatory version.\n\nThis policy determines the page that's opened when new tabs are created (including when new windows are opened). It also affects the startup page if that's set to open to the new tab page.\n\nThis policy doesn't determine which page opens on startup; that's controlled by the \"RestoreOnStartup\" policy. It also doesn't affect the home page if that's set to open to the new tab page.\n\nIf you don't configure this policy, the default new tab page is used.\n\nIf you configure this policy *and* the \"NewTabPageSetFeedType\" policy, this policy has precedence.\n\nIf a blank tab is preferred, \"about:blank\" is the correct URL to use, not \"about://blank\".\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is available only on instances that are managed via MDM or joined to a domain via MCX.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagemanagedquicklinks","displayName":"Set new tab page quick links","description":"By default, Microsoft Edge displays quick links on the new tab page from user-added shortcuts and top sites based on browsing history. With this policy, you can configure up to three quick link tiles on the new tab page, expressed as a JSON object:\n\n[ { \"url\": \"https://www.contoso.com\", \"title\": \"Contoso Portal\", \"pinned\": true/false }, ... ]\n\nThe 'url' field is required; 'title' and 'pinned' are optional. If 'title' is not provided, the URL is used as the default title. If 'pinned' is not provided, the default value is false.\n\nMicrosoft Edge presents these in the order listed, from left to right, with all pinned tiles displayed ahead of non-pinned tiles.\n\nIf the policy is set as mandatory, the 'pinned' field will be ignored and all tiles will be pinned. The tiles can't be deleted by the user and will always appear at the front of the quick links list.\n\nIf the policy is set as recommended, pinned tiles will remain in the list but the user has the ability to edit and delete them. Quick link tiles that aren't pinned behave like default top sites and are pushed off the list if other websites are visited more frequently. When applying non-pinned links via this policy to an existing browser profile, the links may not appear at all, depending on how they rank compared to the user's browsing history.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagemanagedquicklinks_recommended","displayName":"Set new tab page quick links (users can override)","description":"By default, Microsoft Edge displays quick links on the new tab page from user-added shortcuts and top sites based on browsing history. With this policy, you can configure up to three quick link tiles on the new tab page, expressed as a JSON object:\n\n[ { \"url\": \"https://www.contoso.com\", \"title\": \"Contoso Portal\", \"pinned\": true/false }, ... ]\n\nThe 'url' field is required; 'title' and 'pinned' are optional. If 'title' is not provided, the URL is used as the default title. If 'pinned' is not provided, the default value is false.\n\nMicrosoft Edge presents these in the order listed, from left to right, with all pinned tiles displayed ahead of non-pinned tiles.\n\nIf the policy is set as mandatory, the 'pinned' field will be ignored and all tiles will be pinned. The tiles can't be deleted by the user and will always appear at the front of the quick links list.\n\nIf the policy is set as recommended, pinned tiles will remain in the list but the user has the ability to edit and delete them. Quick link tiles that aren't pinned behave like default top sites and are pushed off the list if other websites are visited more frequently. When applying non-pinned links via this policy to an existing browser profile, the links may not appear at all, depending on how they rank compared to the user's browsing history.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpageprerenderenabled","displayName":"Enable preload of the new tab page for faster rendering","description":"If you configure this policy, preloading the New tab page is enabled, and users can't change this setting. If you don't configure this policy, preloading is enabled and a user can change this setting.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpageprerenderenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpageprerenderenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpageprerenderenabled_recommended","displayName":"Enable preload of the new tab page for faster rendering (users can override)","description":"If you configure this policy, preloading the New tab page is enabled, and users can't change this setting. If you don't configure this policy, preloading is enabled and a user can change this setting.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpageprerenderenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpageprerenderenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagequicklinksenabled","displayName":"Allow quick links on the new tab page","description":"If you enable or don't configure this policy, Microsoft Edge displays quick links on the new tab page, and the user can interact with the control, turning quick links on and off. Enabling this policy does not force quick links to be visible - the user can continue to turn quick links on and off.\n\nIf you disable this policy, Microsoft Edge hides quick links on the new tab page and disables the quick links control in the NTP settings flyout.\n\nThis policy only applies for Microsoft Edge local user profiles, profiles signed in using a Microsoft Account, and profiles signed in using Active Directory. To configure the Enterprise new tab page for profiles signed in using Azure Active Directory, use the M365 admin portal.\n\nRelated policies: \"NewTabPageAllowedBackgroundTypes\", \"NewTabPageContentEnabled\"","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagequicklinksenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagequicklinksenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagesearchbox","displayName":"Configure the new tab page search box experience","description":"You can configure the new tab page search box to use \"Search box (Recommended)\" or \"Address bar\" to search on new tabs. This policy only works if you set the search engine to a value other than Bing by setting the following two policies: \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\".\n\n If you disable or don't configure this policy and:\n\n- If the address bar default search engine is Bing, the new tab page uses the search box to search on new tabs.\n- If the address bar default search engine isn't Bing, users are offered an additional choice (use \"Address bar\") when searching on new tabs.\n\n\nIf you enable this policy and set it to:\n\n- \"Search box (Recommended)\" ('bing'), the new tab page uses the search box to search on new tabs.\n- \"Address bar\" ('redirect'), the new tab page search box uses the address bar to search on new tabs.\n\nPolicy options mapping:\n\n* bing (bing) = Search box (Recommended)\n\n* redirect (redirect) = Address bar\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagesearchbox_bing","displayName":"Search box (Recommended)","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagesearchbox_redirect","displayName":"Address bar","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagesearchbox_recommended","displayName":"Configure the new tab page search box experience (users can override)","description":"You can configure the new tab page search box to use \"Search box (Recommended)\" or \"Address bar\" to search on new tabs. This policy only works if you set the search engine to a value other than Bing by setting the following two policies: \"DefaultSearchProviderEnabled\" and \"DefaultSearchProviderSearchURL\".\n\n If you disable or don't configure this policy and:\n\n- If the address bar default search engine is Bing, the new tab page uses the search box to search on new tabs.\n- If the address bar default search engine isn't Bing, users are offered an additional choice (use \"Address bar\") when searching on new tabs.\n\n\nIf you enable this policy and set it to:\n\n- \"Search box (Recommended)\" ('bing'), the new tab page uses the search box to search on new tabs.\n- \"Address bar\" ('redirect'), the new tab page search box uses the address bar to search on new tabs.\n\nPolicy options mapping:\n\n* bing (bing) = Search box (Recommended)\n\n* redirect (redirect) = Address bar\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagesearchbox_recommended_bing","displayName":"Search box (Recommended)","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagesearchbox_recommended_redirect","displayName":"Address bar","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagesetfeedtype","displayName":"Configure the Microsoft Edge new tab page experience (Obsolete)","description":"This policy is obsolete because the new version of the enterprise new tab page no longer requires choosing between different content types. Instead, the content that is presented to the user can be controlled via the Microsoft 365 admin center. To get to the Microsoft 365 admin center, sign in at https://admin.microsoft.com with your admin account.\n\nLets you choose either the Microsoft News or Office 365 feed experience for the new tab page.\n\nWhen you set this policy to 'News', users will see the Microsoft News feed experience on the new tab page.\n\nWhen you set this policy to 'Office', users with an Azure Active Directory browser sign-in will see the Office 365 feed experience on the new tab page.\n\nIf you disable or don't configure this policy:\n\n- Users with an Azure Active Directory browser sign-in are offered the Office 365 new tab page feed experience, as well as the standard new tab page feed experience.\n\n- Users without an Azure Active Directory browser sign-in will see the standard new tab page experience.\n\nIf you configure this policy *and* the \"NewTabPageLocation\" policy, \"NewTabPageLocation\" has precedence.\n\nDefault setting: Disabled or not configured.\n\nPolicy options mapping:\n\n* News (0) = Microsoft News feed experience\n\n* Office (1) = Office 365 feed experience\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagesetfeedtype_news","displayName":"Microsoft News feed experience","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagesetfeedtype_office","displayName":"Office 365 feed experience","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagesetfeedtype_recommended","displayName":"Configure the Microsoft Edge new tab page experience (Obsolete) (users can override)","description":"This policy is obsolete because the new version of the enterprise new tab page no longer requires choosing between different content types. Instead, the content that is presented to the user can be controlled via the Microsoft 365 admin center. To get to the Microsoft 365 admin center, sign in at https://admin.microsoft.com with your admin account.\n\nLets you choose either the Microsoft News or Office 365 feed experience for the new tab page.\n\nWhen you set this policy to 'News', users will see the Microsoft News feed experience on the new tab page.\n\nWhen you set this policy to 'Office', users with an Azure Active Directory browser sign-in will see the Office 365 feed experience on the new tab page.\n\nIf you disable or don't configure this policy:\n\n- Users with an Azure Active Directory browser sign-in are offered the Office 365 new tab page feed experience, as well as the standard new tab page feed experience.\n\n- Users without an Azure Active Directory browser sign-in will see the standard new tab page experience.\n\nIf you configure this policy *and* the \"NewTabPageLocation\" policy, \"NewTabPageLocation\" has precedence.\n\nDefault setting: Disabled or not configured.\n\nPolicy options mapping:\n\n* News (0) = Microsoft News feed experience\n\n* Office (1) = Office 365 feed experience\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagesetfeedtype_recommended_news","displayName":"Microsoft News feed experience","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.newtabpagesetfeedtype_recommended_office","displayName":"Office 365 feed experience","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.notificationsallowedforurls","displayName":"Allow notifications on specific sites","description":"Allows you to create a list of url patterns to specify sites that are allowed to display notifications.\n\nIf you don't set this policy, the global default value will be used for all sites. This default value will be from the \"DefaultNotificationsSetting\" policy if it's set, or from the user's personal configuration. For detailed information on valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.notificationsblockedforurls","displayName":"Block notifications on specific sites","description":"Allows you to create a list of url patterns to specify sites that aren't allowed to display notifications.\n\nIf you don't set this policy, the global default value is used for all sites. This default value is from the \"DefaultNotificationsSetting\" policy if it's set, or from the user's personal configuration. For detailed information on valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.onbulkdataentryenterpriseconnector","displayName":"Configuration policy for bulk data entry for Microsoft Edge for Business Data Loss Prevention Connectors","description":"List of Microsoft Edge for Business Data Loss Prevention Connectors services settings to be applied when data is entered in Microsoft Edge from the clipboard or by drag and dropping web content.\n\nConnector Fields\n\n1. url_list,\ntags,\nenable,\ndisable\nThese fields determine whether the connector sends data for analysis when content is entered on a specific page, and which tags to include in the analysis request.\nA tag associated with an enable pattern is included in the request if the page URL matches the pattern—unless a corresponding disable pattern also matches.\nAnalysis is triggered if at least one tag is included in the request.\n\n2. service_provider\nIdentifies the analysis service provider the configuration applies to.\n\n3. block_until_verdict\nIf set to 1, Microsoft Edge waits for a response from the analysis service before giving the page access to the data.\nAny other integer value allows the page to access the data immediately.\n\n4. default_action\nIf set to block, Microsoft Edge denies page access to the data if an error occurs while contacting the analysis service.\nAny other value permits the page to access the data.\n\n5. minimum_data_size\nSpecifies the minimum size (in bytes) that the entered data must meet or exceed to be scanned.\nDefault: 100 bytes if the field is not set.\n\nThis policy requires additional setup to take effect. For configuration guidance, see https://go.microsoft.com/fwlink/?linkid=2320413.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.onfileattachedenterpriseconnector","displayName":"Configuration policy for files attached for Microsoft Edge for Business Data Loss Prevention Connectors","description":"List of Microsoft Edge for Business Data Loss Prevention Connectors services settings to be applied when a file is attached to Microsoft Edge.\n\nConnector Fields\n\n1. url_list,\ntags,\nenable,\ndisable\nThese fields determine whether the connector sends data for analysis when content is entered on a specific page, and which tags to include in the analysis request.\nA tag associated with an enable pattern is included in the request if the page URL matches the pattern—unless a corresponding disable pattern also matches.\nAnalysis is triggered if at least one tag is included in the request.\n\n2. service_provider\nIdentifies the analysis service provider the configuration applies to.\n\n3. block_until_verdict\nIf set to 1, Microsoft Edge waits for a response from the analysis service before giving the page access to the data.\nAny other integer value allows the page to access the data immediately.\n\n4. default_action\nIf set to block, Microsoft Edge denies page access to the data if an error occurs while contacting the analysis service.\nAny other value permits the page to access the data.\n\nThis policy requires additional setup to take effect. For configuration guidance, see https://go.microsoft.com/fwlink/?linkid=2320413.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.onprintenterpriseconnector","displayName":"Configuration policy for print for Microsoft Edge for Business Data Loss Prevention Connectors","description":"List of Microsoft Edge for Business Data Loss Prevention Connectors services settings to be applied when a page or file is printed from Microsoft Edge.\n\nConnector Fields\n\n1. url_list,\ntags,\nenable,\ndisable\nThese fields determine whether the connector sends data for analysis when content is entered on a specific page, and which tags to include in the analysis request.\nA tag associated with an enable pattern is included in the request if the page URL matches the pattern—unless a corresponding disable pattern also matches.\nAnalysis is triggered if at least one tag is included in the request.\n\n2. service_provider\nIdentifies the analysis service provider the configuration applies to.\n\n3. block_until_verdict\nIf set to 1, Microsoft Edge waits for a response from the analysis service before giving the page access to the data.\nAny other integer value allows the page to access the data immediately.\n\n4. default_action\nIf set to block, Microsoft Edge denies page access to the data if an error occurs while contacting the analysis service.\nAny other value permits the page to access the data.\n\nThis policy requires additional setup to take effect. For configuration guidance, see https://go.microsoft.com/fwlink/?linkid=2320413.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.onsecurityevententerpriseconnector","displayName":"Configuration policy for Microsoft Edge for Business Reporting Connectors","description":"Defines the Microsoft Edge for Business Reporting Connectors service settings that apply when a security event occurs in Microsoft Edge. These events include negative verdicts from Data Loss Prevention Connectors, password reuse, navigation to unsafe pages, and other security-sensitive actions.\n\nThe service_provider field specifies the reporting service provider. The enabled_event_names field lists the security events enabled for that provider.\n\nThis policy requires additional setup to take effect. For configuration guidance, see https://go.microsoft.com/fwlink/?linkid=2325446.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.organizationalbrandingonworkprofileuienabled_recommended","displayName":"Allow the use of your organization's branding assets from Microsoft Entra on the profile-related UI of a work or school profile (users can override)","description":"Allow the use of your organization's branding assets from Entra, if any, on the profile-related UI of a profile that's signed in with an Entra ID (formerly known as Azure Active Directory) account. This requires a browser restart to take effect.\n\nIf you enable this policy, your organization's branding assets from Entra are used.\n\nIf you disable or don't configure this policy, your organization's branding assets from Entra aren't used.\n\nFor more information about configuring your organization's branding assets on Entra, visit https://go.microsoft.com/fwlink/?linkid=2254514.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.organizationalbrandingonworkprofileuienabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.organizationalbrandingonworkprofileuienabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.organizationlogooverlayonappiconenabled_recommended","displayName":"Allow your organization's logo from Microsoft Entra to be overlaid on the Microsoft Edge app icon of a work or school profile (users can override)","description":"Allows your organization's logo from Entra, if any, to be overlaid on the Microsoft Edge app icon of a profile that's signed in with an Entra ID (formerly known as Azure Active Directory) account. This requires a browser restart to take effect.\n\nIf you enable this policy, your organization's logo from Entra is used.\n\nIf you disable or don't configure this policy, your organization's logo from Entra won't be used.\n\nFor more information about configuring your organization's logo on Entra, visit https://go.microsoft.com/fwlink/?linkid=2254514.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.organizationlogooverlayonappiconenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.organizationlogooverlayonappiconenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.originagentclusterdefaultenabled","displayName":"Origin-keyed agent clustering enabled by default","description":"The Origin-Agent-Cluster: HTTP header controls whether a document is isolated in an origin-keyed agent cluster or in a site-keyed agent cluster. This functionality has security implications because an origin-keyed agent cluster allows isolating documents by origin. The consequence of this for developers is that the document.domain accessor can no longer be set when origin-keyed agent clustering is enabled.\n\nIf you enable or don't configure this policy, documents without the Origin-Agent-Cluster: header are assigned to origin-keyed agent clustering by default. On these documents, the document.domain accessor isn't settable.\n\nIf you disable this policy, documents without the Origin-Agent-Cluster: header are assigned to site-keyed agent clusters by default. On these documents, the document.domain accessor is settable.\n\nFor more information, see https://go.microsoft.com/fwlink/?linkid=2191896.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.originagentclusterdefaultenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.originagentclusterdefaultenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.outlookhubmenuenabled","displayName":"Allow users to access the Outlook menu (Obsolete)","description":"This policy doesn't work because the Outlook menu is now contained within the Edge Sidebar and can be managed using the \"HubsSidebarEnabled\" policy.\n\nThis policy is used to manage access to the Outlook menu from Microsoft Edge.\n\nIf you enable or don't configure this policy, users can access the Outlook menu.\nIf you disable this policy, users can't access the Outlook menu.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.outlookhubmenuenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.outlookhubmenuenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.outlookhubmenuenabled_recommended","displayName":"Allow users to access the Outlook menu (Obsolete) (users can override)","description":"This policy doesn't work because the Outlook menu is now contained within the Edge Sidebar and can be managed using the \"HubsSidebarEnabled\" policy.\n\nThis policy is used to manage access to the Outlook menu from Microsoft Edge.\n\nIf you enable or don't configure this policy, users can access the Outlook menu.\nIf you disable this policy, users can't access the Outlook menu.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.outlookhubmenuenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.outlookhubmenuenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.partitionedbloburlusage","displayName":"Manage Blob URL Partitioning During Fetching and Navigation","description":"The \"PartitionedBlobUrlUsage\" policy controls whether Blob URLs are partitioned during fetching and navigation.\nIf this policy is set to Enabled or not set, Blob URLs are partitioned.\nIf this policy is set to Disabled, Blob URLs won't be partitioned. This represents the Blob URL behavior before Microsoft Edge version 135.\n\nIf storage partitioning is disabled for a given top-level origin either by \"ThirdPartyStoragePartitioningBlockedForOrigins\" or \"DefaultThirdPartyStoragePartitioningSetting\", then Blob URLs aren't partitioned.\n\nThe policy is scheduled to be available through Microsoft Edge version 146. After this version, the policy will be removed, and Microsoft Edge will no longer support unpartitioned blob storage.\n\nFor detailed information on third-party storage partitioning, see https://github.com/privacycg/storage-partitioning.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.partitionedbloburlusage_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.partitionedbloburlusage_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passworddeleteonbrowsercloseenabled","displayName":"Prevent passwords from being deleted if any Edge settings is enabled to delete browsing data when Microsoft Edge closes","description":"When this policy is enabled, the passwords saved with Edge Password Manager are exempted from deletion when the browser closes. This policy is only effective when the \"ClearBrowsingDataOnExit\" policy is enabled.\n\nIf you enable this policy, passwords aren't cleared when the browser closes.\nIf you disable or don't configure this policy, the user's personal configuration is used.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.passworddeleteonbrowsercloseenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passworddeleteonbrowsercloseenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passworddeleteonbrowsercloseenabled_recommended","displayName":"Prevent passwords from being deleted if any Edge settings is enabled to delete browsing data when Microsoft Edge closes (users can override)","description":"When this policy is enabled, the passwords saved with Edge Password Manager are exempted from deletion when the browser closes. This policy is only effective when the \"ClearBrowsingDataOnExit\" policy is enabled.\n\nIf you enable this policy, passwords aren't cleared when the browser closes.\nIf you disable or don't configure this policy, the user's personal configuration is used.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.passworddeleteonbrowsercloseenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passworddeleteonbrowsercloseenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordexportenabled","displayName":"Enable exporting saved passwords from Password Manager","description":"This policy controls whether the Export Password button in edge://wallet/passwords is enabled.\n\nIf enabled or not configured, users can export saved passwords.\nIf disabled, the Export Password button is unavailable, preventing password exports.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordexportenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordexportenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordgeneratorenabled","displayName":"Allow users to get a strong password suggestion whenever they are creating an account online","description":"Configures the Password Generator Settings toggle that enables/disables the feature for users.\n\nIf you enable or don't configure this policy, then Password Generator will offer users a strong and unique password suggestion (via a dropdown) on Signup and Change Password pages.\n\nIf you disable this policy, users will no longer see strong password suggestions on Signup or Change Password pages.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordgeneratorenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordgeneratorenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmanagerblocklist","displayName":"Configure the list of domains for which the password manager UI (Save and Fill) will be disabled","description":"Configure the list of domains where Microsoft Edge should disable the password manager. This means that Save and Fill workflows will be disabled, ensuring that passwords for those websites can't be saved or auto filled into web forms.\n\nIf you enable this policy, the password manager will be disabled for the specified set of domains.\n\nIf you disable or don't configure this policy, password manager will work as usual for all domains.\n\nIf you configure this policy, that is, add domains for which password manager is blocked, users can't change or override the behavior in Microsoft Edge. In addition, users can't use password manager for those URLs.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmanagerenabled","displayName":"Enable saving passwords to the password manager","description":"Enable Microsoft Edge to save user passwords. The next time a user visits a site with a saved password, Microsoft Edge will enter the password automatically.\n\nIf you enable or don't configure this policy, users can save and add their passwords in Microsoft Edge.\n\nIf you disable this policy, users can't save and add new passwords, but they can still use previously saved passwords.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmanagerenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmanagerenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmanagerenabled_recommended","displayName":"Enable saving passwords to the password manager (users can override)","description":"Enable Microsoft Edge to save user passwords. The next time a user visits a site with a saved password, Microsoft Edge will enter the password automatically.\n\nIf you enable or don't configure this policy, users can save and add their passwords in Microsoft Edge.\n\nIf you disable this policy, users can't save and add new passwords, but they can still use previously saved passwords.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmanagerenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmanagerenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmanagerpasskeysenabled","displayName":"Enable saving passkeys to the password manager","description":"This policy controls whether users can save passkeys in the built-in password manager. It does not limit access to, or change the contents of, passkeys already saved in the password manager.\n\nIf the PasswordManagerEnabled policy is Disabled, saving to the built-in password manager is disabled in general, including passkeys. In this case, this policy has no effect.\n\nIf this policy is enabled or not configured, users can save passkeys in the built-in password manager when signed in to Microsoft Edge.\n\nIf this policy is disabled, users cannot save new passkeys to the built-in password manager. Previously saved passkeys continue to work.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmanagerpasskeysenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmanagerpasskeysenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmanagerrestrictlengthenabled","displayName":"Restrict the length of passwords that can be saved in the Password Manager","description":"Make Microsoft Edge restrict the length of usernames and/or passwords that can be saved in the Password Manager.\n\nIf you enable this policy, Microsoft Edge will not let the user save credentials with usernames and/or passwords longer than 256 characters.\n\nIf you disable or don't configure this policy, Microsoft Edge will let the user save credentials with arbitrarily long usernames and/or passwords.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmanagerrestrictlengthenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmanagerrestrictlengthenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmonitorallowed","displayName":"Allow users to be alerted if their passwords are found to be unsafe","description":"Allow Microsoft Edge to monitor user passwords.\n\nIf you enable this policy, the user gets alerted if any of their passwords stored in Microsoft Edge are found to be unsafe. Microsoft Edge will show an alert and this information will also be available in Settings > Passwords > Password Monitor.\n\nIf you disable this policy, users aren't asked for permission to enable this feature. Their passwords aren't scanned, and they aren't alerted either.\n\nIf you don't configure the policy, users can turn this feature on or off.\n\nTo learn more about how Microsoft Edge finds unsafe passwords see https://go.microsoft.com/fwlink/?linkid=2133833\n\nAdditional guidance:\n\nThis policy can be set as both Recommended and Mandatory, however with an important callout.\n\nMandatory enabled: If the policy is set to Mandatory enabled, the UI in Settings will be disabled but remain in 'On' state, and a briefcase icon will be made visible next to it with this description displayed on hover - \"This setting is managed by your organization.\"\n\nRecommended enabled: If the policy is set to Recommended enabled, the UI in Settings will remain in 'Off' state, but a briefcase icon will be made visible next to it with this description displayed on hover - \"Your organization recommends a specific value for this setting and you have chosen a different value\"\n\nMandatory and Recommended disabled: Both these states will work the normal way, with the usual captions being shown to users.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmonitorallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmonitorallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmonitorallowed_recommended","displayName":"Allow users to be alerted if their passwords are found to be unsafe (users can override)","description":"Allow Microsoft Edge to monitor user passwords.\n\nIf you enable this policy, the user gets alerted if any of their passwords stored in Microsoft Edge are found to be unsafe. Microsoft Edge will show an alert and this information will also be available in Settings > Passwords > Password Monitor.\n\nIf you disable this policy, users aren't asked for permission to enable this feature. Their passwords aren't scanned, and they aren't alerted either.\n\nIf you don't configure the policy, users can turn this feature on or off.\n\nTo learn more about how Microsoft Edge finds unsafe passwords see https://go.microsoft.com/fwlink/?linkid=2133833\n\nAdditional guidance:\n\nThis policy can be set as both Recommended and Mandatory, however with an important callout.\n\nMandatory enabled: If the policy is set to Mandatory enabled, the UI in Settings will be disabled but remain in 'On' state, and a briefcase icon will be made visible next to it with this description displayed on hover - \"This setting is managed by your organization.\"\n\nRecommended enabled: If the policy is set to Recommended enabled, the UI in Settings will remain in 'Off' state, but a briefcase icon will be made visible next to it with this description displayed on hover - \"Your organization recommends a specific value for this setting and you have chosen a different value\"\n\nMandatory and Recommended disabled: Both these states will work the normal way, with the usual captions being shown to users.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmonitorallowed_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordmonitorallowed_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordprotectionchangepasswordurl","displayName":"Configure the change password URL","description":"Configures the change password URL (HTTP and HTTPS schemes only).\n\nPassword protection service will send users to this URL to change their password after seeing a warning in the browser.\n\nIf you enable this policy, then password protection service sends users to this URL to change their password.\n\nIf you disable this policy or don't configure it, then password protection service will not redirect users to a change password URL.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is available only on instances that are managed via MDM or joined to a domain via MCX.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordprotectionloginurls","displayName":"Configure the list of enterprise login URLs where the password protection service should capture salted hashes of a password","description":"Configure the list of enterprise login URLs (HTTP and HTTPS schemes only) where Microsoft Edge should capture the salted hashes of passwords and use it for password reuse detection.\n\nIf you enable this policy, the password protection service captures fingerprints of passwords on the defined URLs.\n\nIf you disable this policy or don't configure it, no password fingerprints are captured.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is available only on instances that are managed via MDM or joined to a domain via MCX.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordprotectionwarningtrigger","displayName":"Configure password protection warning trigger","description":"Allows you to control when to trigger password protection warning. Password protection alerts users when they reuse their protected password on potentially suspicious sites.\n\nYou can use the \"PasswordProtectionLoginURLs\" and \"PasswordProtectionChangePasswordURL\" policies to configure which passwords to protect.\n\nExemptions: Passwords for the sites listed in \"PasswordProtectionLoginURLs\" and \"PasswordProtectionChangePasswordURL\", as well as for the sites listed in \"SmartScreenAllowListDomains\", will not trigger a password-protection warning.\n\nSet to 'PasswordProtectionWarningOff' to not show password protection warningss.\n\nSet to 'PasswordProtectionWarningOnPasswordReuse' to show password protection warnings when the user reuses their protected password on a non-allowlisted site.\n\nIf you disable or don't configure this policy, then the warning trigger is not shown.\n\nPolicy options mapping:\n\n* PasswordProtectionWarningOff (0) = Password protection warning is off\n\n* PasswordProtectionWarningOnPasswordReuse (1) = Password protection warning is triggered by password reuse\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordprotectionwarningtrigger_passwordprotectionwarningoff","displayName":"Password protection warning is off","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordprotectionwarningtrigger_passwordprotectionwarningonpasswordreuse","displayName":"Password protection warning is triggered by password reuse","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordrevealenabled","displayName":"Enable Password reveal button","description":"Lets you configure the default display of the browser password reveal button for password input fields on websites.\n\nIf you enable or don't configure this policy, the browser user setting defaults to displaying the password reveal button.\n\nIf you disable this policy, the browser user setting won't display the password reveal button.\n\nFor accessibility, users can change the browser setting from the default policy.\n\nThis policy only affects the browser password reveal button, it doesn't affect websites' custom reveal buttons.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordrevealenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordrevealenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordrevealenabled_recommended","displayName":"Enable Password reveal button (users can override)","description":"Lets you configure the default display of the browser password reveal button for password input fields on websites.\n\nIf you enable or don't configure this policy, the browser user setting defaults to displaying the password reveal button.\n\nIf you disable this policy, the browser user setting won't display the password reveal button.\n\nFor accessibility, users can change the browser setting from the default policy.\n\nThis policy only affects the browser password reveal button, it doesn't affect websites' custom reveal buttons.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordrevealenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.passwordrevealenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.paymentmethodqueryenabled","displayName":"Allow websites to query for available payment methods","description":"Allows you to set whether websites can check if the user has payment methods saved.\n\nIf you disable this policy, websites that use PaymentRequest.canMakePayment or PaymentRequest.hasEnrolledInstrument API will be informed that no payment methods are available.\n\nIf you enable this policy or don't set this policy, websites can check if the user has payment methods saved.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.paymentmethodqueryenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.paymentmethodqueryenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.pdfsecuremode","displayName":"Secure mode and Certificate-based Digital Signature validation in native PDF reader","description":"The policy enables Digital Signature validation for PDF files in a secure environment, which shows the correct validation status of the signatures.\n\nIf you enable this policy, PDF files with Certificate-based digital signatures are opened with an option to view and verify the validity of the signatures with high security.\n\nIf you disable or don't configure this policy, the capability to view and verify the signature will not be available.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.pdfsecuremode_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.pdfsecuremode_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.pdfvieweroutofprocessiframeenabled","displayName":"Use out-of-process iframe PDF Viewer","description":"Determines whether the PDF viewer in Microsoft Edge uses an out-of-process iframe (OOPIF).\nThis will be the new PDF viewer architecture going forward, as it is simpler in design and makes adding new features easier. The current GuestView PDF viewer, which relies on an outdated and overly complex architecture, is being deprecated.\n\nWhen this policy is set to Enabled or not set, Microsoft Edge will use the OOPIF PDF viewer architecture. Once Enabled or not set, the default behavior will be decided by Microsoft Edge.\n\nWhen this policy is set to Disabled, Microsoft Edge will strictly use the existing GuestView PDF viewer. This approach embeds a web page with its own separate frame tree into another web page.\n\nThis policy will be removed in the future, after the OOPIF PDF viewer feature has fully rolled out.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.pdfvieweroutofprocessiframeenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.pdfvieweroutofprocessiframeenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.pdfxfaenabled","displayName":"XFA support in native PDF reader enabled","description":"Lets the Microsoft Edge browser enable XFA (XML Forms Architecture) support in the native PDF reader and allows users to open XFA PDF files in the browser.\n\nIf you enable this policy, XFA support in the native PDF reader is enabled.\n\nIf you disable or don't configure this policy, Microsoft Edge won't enable XFA support in the native PDF reader.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.pdfxfaenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.pdfxfaenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.performancedetectorenabled","displayName":"Performance Detector Enabled","description":"The performance detector detects tab performance issues and recommends actions to fix the performance issues.\n\nIf you enable or don't configure this policy, performance detector is turned on.\n\nIf you disable this policy, performance detector is turned off.\n\nThe user can configure its behavior in edge://settings/system.\n\nLearn more about performance detector: https://aka.ms/EdgePerformanceDetector","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.performancedetectorenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.performancedetectorenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.performancedetectorenabled_recommended","displayName":"Performance Detector Enabled (users can override)","description":"The performance detector detects tab performance issues and recommends actions to fix the performance issues.\n\nIf you enable or don't configure this policy, performance detector is turned on.\n\nIf you disable this policy, performance detector is turned off.\n\nThe user can configure its behavior in edge://settings/system.\n\nLearn more about performance detector: https://aka.ms/EdgePerformanceDetector","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.performancedetectorenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.performancedetectorenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.personalizationreportingenabled","displayName":"Allow personalization of ads, Microsoft Edge, search, news and other Microsoft services by sending browsing history, favorites and collections, usage and other browsing data to Microsoft","description":"This policy prevents Microsoft from collecting a user's Microsoft Edge browsing history, favorites and collections, usage, and other browsing data to be used for personalizing advertising, search, news, Microsoft Edge and other Microsoft services.\n\nThis setting is not available for child accounts or enterprise accounts.\n\nIf you disable this policy, users can't change or override the setting. If this policy is enabled or not configured, Microsoft Edge will default to the user's preference.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.personalizationreportingenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.personalizationreportingenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.personalizetopsitesincustomizesidebarenabled","displayName":"Personalize my top sites in Customize Sidebar enabled by default","description":"This policy controls whether Microsoft Edge browser be allowed to use the browsing history to personalize the top sites in the customize sidebar page.\n\nIf you enable this policy, Microsoft Edge will use the browsing history to personalize the top sites in the customize sidebar page.\n\nIf you disable this policy, Microsoft Edge will not use the browsing history to personalize the top sites in the customize sidebar page.\n\nIf you don't configure this policy, the default behavior is to use the browsing history to personalize the top sites in the customize sidebar page.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.personalizetopsitesincustomizesidebarenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.personalizetopsitesincustomizesidebarenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.pictureinpictureoverlayenabled","displayName":"Enable Picture in Picture overlay feature on supported webpages in Microsoft Edge","description":"This policy lets you configure the Picture in Picture floating overlay button in Microsoft Edge.\n\nThe Picture in Picture floating overlay button lets user to watch videos in a floating window on top of other windows.\n\nIf you enable or don't configure this policy, you can use the Picture in Picture floating overlay button in Microsoft Edge.\n\nIf you disable this policy, you can't use the Picture in Picture floating overlay button in Microsoft Edge.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.pictureinpictureoverlayenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.pictureinpictureoverlayenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.pinbrowseressentialstoolbarbutton","displayName":"Pin browser essentials toolbar button","description":"This policy lets you configure whether to pin the Browser essentials button on the toolbar.\n\nWhen the button is pinned, it will always appear on the toolbar.\n\nWhen the button isn't pinned, it will only appear when there's an alert. An example of this kind of alert is the performance detector alert that indicates the browser is using high CPU or memory.\n\nIf you enable or don't configure this policy, the Browser essentials button will be pinned on the toolbar.\n\nIf you disable this policy, the Browser essentials button won't be pinned on the toolbar.\n\nLearn more about browser essentials: https://go.microsoft.com/fwlink/?linkid=2240439","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.pinbrowseressentialstoolbarbutton_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.pinbrowseressentialstoolbarbutton_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.pinbrowseressentialstoolbarbutton_recommended","displayName":"Pin browser essentials toolbar button (users can override)","description":"This policy lets you configure whether to pin the Browser essentials button on the toolbar.\n\nWhen the button is pinned, it will always appear on the toolbar.\n\nWhen the button isn't pinned, it will only appear when there's an alert. An example of this kind of alert is the performance detector alert that indicates the browser is using high CPU or memory.\n\nIf you enable or don't configure this policy, the Browser essentials button will be pinned on the toolbar.\n\nIf you disable this policy, the Browser essentials button won't be pinned on the toolbar.\n\nLearn more about browser essentials: https://go.microsoft.com/fwlink/?linkid=2240439","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.pinbrowseressentialstoolbarbutton_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.pinbrowseressentialstoolbarbutton_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.pluginsallowedforurls","displayName":"Allow the Adobe Flash plug-in on specific sites (Obsolete)","description":"This policy doesn't work because Flash is no longer supported by Microsoft Edge.\n\nDefine a list of sites, based on URL patterns, that can run the Adobe Flash plug-in.\n\nIf you don't configure this policy, the global default value from the \"DefaultPluginsSetting\" policy (if set) or the user's personal configuration is used for all sites.\n\nFor detailed information on valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. However, starting in M85, patterns with '*' and '[*.]' wildcards in the host are no longer supported for this policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.pluginsblockedforurls","displayName":"Block the Adobe Flash plug-in on specific sites (Obsolete)","description":"This policy doesn't work because Flash is no longer supported by Microsoft Edge.\n\nDefine a list of sites, based on URL patterns, that are blocked from running Adobe Flash.\n\nIf you don't configure this policy, the global default value from the \"DefaultPluginsSetting\" policy (if set) or the user's personal configuration is used for all sites.\n\nFor detailed information on valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. However, starting in M85, patterns with '*' and '[*.]' wildcards in the host are no longer supported for this policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.popupsallowedforurls","displayName":"Allow pop-up windows on specific sites","description":"Define a list of sites, based on URL patterns, that can open pop-up windows. Wildcards (*) are allowed.\n\nIf you don't configure this policy, the global default value from the \"DefaultPopupsSetting\" policy (if set) or the user's personal configuration is used for all sites.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.popupsblockedforurls","displayName":"Block pop-up windows on specific sites","description":"Define a list of sites, based on URL patterns, that are blocked from opening pop-up windows. Wildcards (*) are allowed.\n\nIf you don't configure this policy, the global default value from the \"DefaultPopupsSetting\" policy (if set) or the user's personal configuration is used for all sites.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.precisegeolocationallowedforurls","displayName":"Allow precise geolocation on these sites","description":"This policy lets you specify a list of URL patterns for sites that are allowed to access the user's high-accuracy geolocation without prompting for permission.\n\nIf you leave this policy unset, DefaultGeolocationSetting applies to all sites (if configured). Otherwise, the user's personal setting is used.\n\nFor information about valid url patterns, see https://learn.microsoft.com/deployedge/edge-learnmmore-url-list-filter%20format. Wildcards (*) are supported.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.prefetchwithserviceworkerenabled","displayName":"Allow SpeculationRules prefetch for ServiceWorker-controlled URLs","description":"Controls whether SpeculationRules prefetch requests are allowed for\nServiceWorker-controlled URLs.\n\nStarting with Microsoft Edge version 138,\nprefetch requests to ServiceWorker-controlled URLs are allowed by default when\nthe PrefetchServiceWorker feature is enabled.\n\nIf this policy is enabled or not configured, that default behavior is used.\n\nTo restore the legacy behavior from versions prior to 138, where prefetch requests\nto ServiceWorker-controlled URLs were blocked, set this policy to disabled.\n\nThis policy is intended to be temporary and will be removed in the future.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.prefetchwithserviceworkerenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.prefetchwithserviceworkerenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.preventsmartscreenpromptoverride","displayName":"Prevent bypassing Microsoft Defender SmartScreen prompts for sites","description":"This policy setting lets you decide whether users can override the Microsoft Defender SmartScreen warnings about potentially malicious websites.\n\nIf you enable this setting, users can't ignore Microsoft Defender SmartScreen warnings and they are blocked from continuing to the site.\n\nIf you disable or don't configure this setting, users can ignore Microsoft Defender SmartScreen warnings and continue to the site.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.preventsmartscreenpromptoverride_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.preventsmartscreenpromptoverride_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.preventsmartscreenpromptoverrideforfiles","displayName":"Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads","description":"This policy lets you determine whether users can override Microsoft Defender SmartScreen warnings about unverified downloads.\n\nIf you enable this policy, users in your organization can't ignore Microsoft Defender SmartScreen warnings, and they're prevented from completing the unverified downloads.\n\nIf you disable or don't configure this policy, users can ignore Microsoft Defender SmartScreen warnings and complete unverified downloads.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.preventsmartscreenpromptoverrideforfiles_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.preventsmartscreenpromptoverrideforfiles_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.preventtyposquattingpromptoverride","displayName":"Prevent bypassing Edge Website Typo Protection prompts for sites","description":"This policy setting lets you decide whether users can override the Edge Website Typo Protection warnings about potential typosquatting websites.\n\nIf you enable this setting, users can't ignore Edge Website Typo Protection warnings, and they're blocked from continuing to the site.\n\nIf you disable or don't configure this setting, users can ignore Edge Website Typo Protection warnings and continue to the site.\n\nThis only takes effect when TyposquattingCheckerEnabled policy isn't set or is set to enabled.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are managed via MDM or joined to a domain via MCX.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.preventtyposquattingpromptoverride_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.preventtyposquattingpromptoverride_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.primarypasswordsetting","displayName":"Configures a setting that asks users to enter their device password while using password autofill","description":"The feature helps users add an additional layer of privacy to their online accounts by requiring device authentication (as a way of confirming the user's identity) before the saved password is auto-filled into a web form. This ensures that non-authorized persons can't use saved passwords for autofill. Note that this feature does not protect against locally-running malware.\n\nThis group policy configures the radio button selector that enables this feature for users. It also has a frequency control where users can specify how often they would like to be prompted for authentication.\n\nIf you set this policy to 'Automatically', disable this policy, or don't configure this policy, autofill will not have any authentication flow.\n\nIf you set this policy to 'WithDevicePassword', users will have to enter their device password (or preferred mode of authentication under Windows) to prove their identity before their password is auto filled. Authentication modes include Windows Hello, PIN, face recognition, or fingerprint. The frequency for authentication prompt will be set to 'Ask permission once per browsing session' by default. However, users can change it to the other option, which is 'Always ask permission'.\n\nIf you set this policy to 'WithCustomPrimaryPassword', users will be asked to create their custom password and then to be redirected to Settings. After the custom password is set, users can authenticate themselves using the custom password and their passwords will get auto-filled after successful authentication. The frequency for authentication prompt will be set to 'Ask permission once per browsing session' by default. However, users can change it to the other option, which is 'Always ask permission'.\n\nIf you set this policy to 'AutofillOff', saved passwords will no longer be suggested for autofill.\n\nPolicy options mapping:\n\n* Automatically (0) = Automatically\n\n* WithDevicePassword (1) = With device password\n\n* WithCustomPrimaryPassword (2) = With custom primary password\n\n* AutofillOff (3) = Autofill off\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.primarypasswordsetting_automatically","displayName":"Automatically","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.primarypasswordsetting_withdevicepassword","displayName":"With device password","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.primarypasswordsetting_withcustomprimarypassword","displayName":"With custom primary password","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.primarypasswordsetting_autofilloff","displayName":"Autofill off","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printertypedenylist","displayName":"Disable printer types on the deny list","description":"The printer types on the deny list aren't discovered or have their capabilities fetched.\n\nPlacing all printer types on the deny list effectively disables printing because there's no print destination for documents.\n\nIf you don't configure this policy, or the printer list is empty, all printer types are discoverable.\n\nPrinter destinations include extension printers and local printers. Extension printers are also known as print provider destinations, and include any destination that belongs to a Microsoft Edge extension.\nLocal printers are also known as native printing destinations, and include destinations available to the local machine and shared network printers.\n\nIn Microsoft version 93 or later, if you set this policy to 'pdf' it also disables the 'save as Pdf' option from the right click context menu.\n\nIn Microsoft version 103 or later, if you set this policy to 'onedrive' it also disables the 'save as Pdf (OneDrive)' option from print preview.\n\nPolicy options mapping:\n\n* privet (privet) = Zeroconf-based (mDNS + DNS-SD) protocol destinations\n\n* extension (extension) = Extension-based destinations\n\n* pdf (pdf) = The 'Save as PDF' destination. (93 or later, also disables from context menu)\n\n* local (local) = Local printer destinations\n\n* onedrive (onedrive) = Save as PDF (OneDrive) printer destinations. (103 or later)\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.printertypedenylist_privet","displayName":"Zeroconf-based (mDNS + DNS-SD) protocol destinations","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printertypedenylist_extension","displayName":"Extension-based destinations","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printertypedenylist_pdf","displayName":"The 'Save as PDF' destination. (93 or later, also disables from context menu)","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printertypedenylist_local","displayName":"Local printer destinations","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printertypedenylist_onedrive","displayName":"Save as PDF (OneDrive) printer destinations. (103 or later)","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printingallowedbackgroundgraphicsmodes","displayName":"Restrict background graphics printing mode","description":"Restricts background graphics printing mode. If this policy isn't set there's no restriction on printing background graphics.\n\nPolicy options mapping:\n\n* any (any) = Allow printing with and without background graphics\n\n* enabled (enabled) = Allow printing only with background graphics\n\n* disabled (disabled) = Allow printing only without background graphics\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.printingallowedbackgroundgraphicsmodes_any","displayName":"Allow printing with and without background graphics","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printingallowedbackgroundgraphicsmodes_enabled","displayName":"Allow printing only with background graphics","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printingallowedbackgroundgraphicsmodes_disabled","displayName":"Allow printing only without background graphics","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printingbackgroundgraphicsdefault","displayName":"Default background graphics printing mode","description":"Overrides the last used setting for printing background graphics.\nIf you enable this setting, background graphics printing is enabled.\nIf you disable this setting, background graphics printing is disabled.\n\nPolicy options mapping:\n\n* enabled (enabled) = Enable background graphics printing mode by default\n\n* disabled (disabled) = Disable background graphics printing mode by default\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.printingbackgroundgraphicsdefault_enabled","displayName":"Enable background graphics printing mode by default","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printingbackgroundgraphicsdefault_disabled","displayName":"Disable background graphics printing mode by default","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printingenabled","displayName":"Enable printing","description":"Enables printing in Microsoft Edge and prevents users from changing this setting.\n\nIf you enable this policy or don't configure it, users can print.\n\nIf you disable this policy, users can't print from Microsoft Edge. Printing is disabled in the wrench menu, extensions, JavaScript applications, and so on. Users can still print from plug-ins that bypass Microsoft Edge while printing. For example, certain Adobe Flash applications have the print option in their context menu, which isn't covered by this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.printingenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printingenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printingpapersizedefault","displayName":"Default printing page size","description":"Overrides default printing page size.\n\nname should contain one of the listed formats or 'custom' if required paper size is not in the list. If 'custom' value is provided custom_size property should be specified. It describes the desired height and width in micrometers. Otherwise custom_size property shouldn't be specified. Policy that violates these rules is ignored.\n\nIf the page size is unavailable on the printer chosen by the user this policy is ignored.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printingwebpagelayout","displayName":"Sets layout for printing","description":"Configuring this policy sets the layout for printing webpages.\n\nIf you disable or don't configure this policy, users can decide whether to print webpages in Portrait or Landscape layout.\n\nIf you enable this policy, the selected option is set as the layout option.\n\nPolicy options mapping:\n\n* portrait (0) = Sets layout option as portrait\n\n* landscape (1) = Sets layout option as landscape\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.printingwebpagelayout_portrait","displayName":"Sets layout option as portrait","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printingwebpagelayout_landscape","displayName":"Sets layout option as landscape","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printingwebpagelayout_recommended","displayName":"Sets layout for printing (users can override)","description":"Configuring this policy sets the layout for printing webpages.\n\nIf you disable or don't configure this policy, users can decide whether to print webpages in Portrait or Landscape layout.\n\nIf you enable this policy, the selected option is set as the layout option.\n\nPolicy options mapping:\n\n* portrait (0) = Sets layout option as portrait\n\n* landscape (1) = Sets layout option as landscape\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.printingwebpagelayout_recommended_portrait","displayName":"Sets layout option as portrait","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printingwebpagelayout_recommended_landscape","displayName":"Sets layout option as landscape","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printpdfasimagedefault","displayName":"Print PDF as Image Default","description":"Controls if Microsoft Edge makes the Print as image option the default when printing PDFs.\n\nIf you enable this policy, Microsoft Edge defaults to setting the Print as image option in the Print Preview when printing a PDF.\n\nIf you disable or don't configure this policy, Microsoft Edge won't default to setting the Print as image option in the Print Preview when printing a PDF.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.printpdfasimagedefault_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printpdfasimagedefault_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printpostscriptmode","displayName":"Print PostScript Mode","description":"Controls how Microsoft Edge prints on Microsoft Windows.\n\nPrinting to a PostScript printer on Microsoft Windows different PostScript generation methods can affect printing performance.\n\nIf you set this policy to Default, Microsoft Edge will use a set of default options when generating PostScript. For text in particular, text will always be rendered using Type 3 fonts.\n\nIf you set this policy to Type42, Microsoft Edge will render text using Type 42 fonts if possible. This should increase printing speed for some PostScript printers.\n\nIf you don't configure this policy, Microsoft Edge will be in Default mode.\n\nPolicy options mapping:\n\n* Default (0) = Default\n\n* Type42 (1) = Type42\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.printpostscriptmode_default","displayName":"Default","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printpostscriptmode_type42","displayName":"Type42","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printpreviewstickysettings","displayName":"Configure the sticky print preview settings","description":"Configuring this policy sets the print preview settings as the most recent choice in Print Preview instead of the default print preview settings.\n\nEach item of this policy expects a boolean:\n\nLayout specifies if the webpage layout should be kept sticky or not in print preview settings. If we set this to True the webpage layout uses the recent choice otherwise it will set to default value.\n\nSize specifies if the page size should be kept sticky or not in print preview settings. If we set this to True the page size uses the recent choice otherwise it will set to default value.\n\nScale Type specifies if the scaling percentage and scale type should be kept sticky or not in print preview settings. If we set this to True the scale percentage and scale type both uses the recent choice oherwise it will set to default value.\n\nMargins specifies if the page margin should be kept sticky or not in print preview settings. If we set this to True the page margins uses the recent choice otherwise it will set to default value.\n\nIf you enable this policy, the selected values will use the most recent choice in Print Preview.\n\nIf you disable or don't configure this policy, print preview settings will not be impacted.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printpreviewstickysettings_recommended","displayName":"Configure the sticky print preview settings (users can override)","description":"Configuring this policy sets the print preview settings as the most recent choice in Print Preview instead of the default print preview settings.\n\nEach item of this policy expects a boolean:\n\nLayout specifies if the webpage layout should be kept sticky or not in print preview settings. If we set this to True the webpage layout uses the recent choice otherwise it will set to default value.\n\nSize specifies if the page size should be kept sticky or not in print preview settings. If we set this to True the page size uses the recent choice otherwise it will set to default value.\n\nScale Type specifies if the scaling percentage and scale type should be kept sticky or not in print preview settings. If we set this to True the scale percentage and scale type both uses the recent choice oherwise it will set to default value.\n\nMargins specifies if the page margin should be kept sticky or not in print preview settings. If we set this to True the page margins uses the recent choice otherwise it will set to default value.\n\nIf you enable this policy, the selected values will use the most recent choice in Print Preview.\n\nIf you disable or don't configure this policy, print preview settings will not be impacted.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printpreviewusesystemdefaultprinter","displayName":"Set the system default printer as the default printer","description":"Tells Microsoft Edge to use the system default printer as the default choice in Print Preview instead of the most recently used printer.\n\nIf you disable this policy or don't configure it, Print Preview uses the most recently used printer as the default destination choice.\n\nIf you enable this policy, Print Preview uses the OS system default printer as the default destination choice.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.printpreviewusesystemdefaultprinter_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printpreviewusesystemdefaultprinter_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printpreviewusesystemdefaultprinter_recommended","displayName":"Set the system default printer as the default printer (users can override)","description":"Tells Microsoft Edge to use the system default printer as the default choice in Print Preview instead of the most recently used printer.\n\nIf you disable this policy or don't configure it, Print Preview uses the most recently used printer as the default destination choice.\n\nIf you enable this policy, Print Preview uses the OS system default printer as the default destination choice.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.printpreviewusesystemdefaultprinter_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printpreviewusesystemdefaultprinter_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printrasterizationmode","displayName":"Print Rasterization Mode","description":"Controls how Microsoft Edge prints on Windows.\n\nWhen printing to a non-PostScript printer on Windows, sometimes print jobs need to be rasterized to print correctly.\n\nIf you set this policy to 'Full' or don't configure it, Microsoft Edge will do full page rasterization if necessary.\n\nIf you set this policy to 'Fast', Microsoft Edge will reduce the amount of rasterization which can help reduce print job sizes and increase printing speed.\n\nPolicy options mapping:\n\n* Full (0) = Full page rasterization\n\n* Fast (1) = Avoid rasterization if possible\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.printrasterizationmode_full","displayName":"Full page rasterization","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printrasterizationmode_fast","displayName":"Avoid rasterization if possible","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printrasterizepdfdpi","displayName":"Print Rasterize PDF DPI","description":"Controls print image resolution when Microsoft Edge prints PDFs with rasterization.\n\nWhen printing a PDF using the Print to image option, it can be beneficial to specify a print resolution other than a device's printer setting or the PDF default. A high resolution will significantly increase the processing and printing time while a low resolution can lead to poor imaging quality.\n\nIf you set this policy, it allows a particular resolution to be specified for use when rasterizing PDFs for printing.\n\nIf you set this policy to zero or don't configure it, the system default resolution will be used during rasterization of page images.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printstickysettings","displayName":"Print preview sticky settings","description":"Specifies whether print preview should apply last used settings for Microsoft Edge PDF and webpages.\n\nIf you set this policy to 'EnableAll' or don't configure it, Microsoft Edge applies the last used print preview settings for both PDF and webpages.\n\nIf you set this policy to 'DisableAll', Microsoft Edge doesn't apply the last used print preview settings for both PDF and webpages.\n\nIf you set this policy to 'DisablePdf', Microsoft Edge doesn't apply the last used print preview settings for PDF printing and retains it for webpages.\n\nIf you set this policy to 'DisableWebpage', Microsoft Edge doesn't apply the last used print preview settings for webpage printing and retain it for PDF.\n\nThis policy is only available if you enable or don't configure the \"PrintingEnabled\" policy.\n\nPolicy options mapping:\n\n* EnableAll (0) = Enable sticky settings for PDF and Webpages\n\n* DisableAll (1) = Disable sticky settings for PDF and Webpages\n\n* DisablePdf (2) = Disable sticky settings for PDF\n\n* DisableWebpage (3) = Disable sticky settings for Webpages\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.printstickysettings_enableall","displayName":"Enable sticky settings for PDF and Webpages","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printstickysettings_disableall","displayName":"Disable sticky settings for PDF and Webpages","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printstickysettings_disablepdf","displayName":"Disable sticky settings for PDF","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.printstickysettings_disablewebpage","displayName":"Disable sticky settings for Webpages","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.proactiveauthenabled","displayName":"Enable Proactive Authentication (Obsolete)","description":"This policy is obsolete because it does not work independently of browser sign in. It does not work in Microsoft Edge after version 90. If you want to configure browser sign in, use the \"BrowserSignin\" policy.\n\nLets you configure whether to turn on Proactive Authentication in Microsoft Edge.\n\nIf you enable this policy, Microsoft Edge tries to seamlessly authenticate to websites and services using the account which is signed-in to the browser.\n\nIf you disable this policy, Microsoft Edge does not try to authenticate with websites or services using single sign-on (SSO). Authenticated experiences like the Enterprise New Tab Page will not work (e.g. recent and recommended Office documents will not be available).\n\nIf you don't configure this policy, Proactive Authentication is turned on.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.proactiveauthenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.proactiveauthenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.proactiveauthworkflowenabled","displayName":"Enable proactive authentication","description":"This policy controls the proactive authentication in Microsoft Edge, that connects the signed-in user identity with Microsoft Bing, MSN and Copilot services for a smooth and consistent sign-in experience.\n\nIf you enable or don't configure this policy, Microsoft Edge authentication requests are automatically sent to the services using the account that is signed-in to the browser.\n\nIf you disable this policy, Microsoft Edge does not send authentications requests to these services and users will need to manually sign-in.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.proactiveauthworkflowenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.proactiveauthworkflowenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.promptfordownloadlocation","displayName":"Ask where to save downloaded files","description":"Set whether to ask where to save a file before downloading it.\n\nIf you enable this policy, the user is asked where to save each file before downloading; if you don't configure it, files are saved automatically to the default location, without asking the user.\n\nIf you don't configure this policy, the user will be able to change this setting.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.promptfordownloadlocation_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.promptfordownloadlocation_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.promptonmultiplematchingcertificates","displayName":"Prompt the user to select a certificate when multiple certificates match","description":"This policy controls whether the user is prompted to select a client certificate when more than one certificate matches \"AutoSelectCertificateForUrls\".\nIf this policy is set to True, the user is prompted to select a client certificate whenever the auto-selection policy matches multiple certificates.\nIf this policy is set to False or not set, the user may only be prompted when no certificate matches the auto-selection.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.promptonmultiplematchingcertificates_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.promptonmultiplematchingcertificates_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.proxybypasslist","displayName":"Configure proxy bypass rules (Deprecated)","description":"This policy is deprecated, use \"ProxySettings\" instead. It won't work in Microsoft Edge version 91.\n\nDefines a list of hosts for which Microsoft Edge bypasses any proxy.\n\nThis policy is applied only if the \"ProxySettings\" policy isn't specified and you have selected either fixed_servers or pac_script in the \"ProxyMode\" policy. If you selected any other mode for configuring proxy policies, don't enable or configure this policy.\n\nIf you enable this policy, you can create a list of hosts for which Microsoft Edge doesn't use a proxy.\n\nIf you don't configure this policy, no list of hosts is created for which Microsoft Edge bypasses a proxy. Leave this policy unconfigured if you've specified any other method for setting proxy policies.\n\nFor more detailed examples go to https://go.microsoft.com/fwlink/?linkid=2094936.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.proxymode","displayName":"Configure proxy server settings (Deprecated)","description":"This policy is deprecated, use \"ProxySettings\" instead. It won't work in Microsoft Edge version 91.\n\nIf you set this policy to Enabled you can specify the proxy server Microsoft Edge uses and prevents users from changing proxy settings. Microsoft Edge ignores all proxy-related options specified from the command line. The policy is only applied if the \"ProxySettings\" policy isn't specified.\n\nOther options are ignored if you choose one of the following options:\n * direct = Never use a proxy server and always connect directly\n * system = Use system proxy settings\n * auto_detect = Auto detect the proxy server\n\nIf you choose to use:\n * fixed_servers = Fixed proxy servers. You can specify further options with \"ProxyServer\" and \"ProxyBypassList\".\n * pac_script = A .pac proxy script. Use \"ProxyPacUrl\" to set the URL to a proxy .pac file.\n\nFor detailed examples, go to https://go.microsoft.com/fwlink/?linkid=2094936.\n\nIf you don't configure this policy, users can choose their own proxy settings.\n\nPolicy options mapping:\n\n* ProxyDisabled (direct) = Never use a proxy\n\n* ProxyAutoDetect (auto_detect) = Auto detect proxy settings\n\n* ProxyPacScript (pac_script) = Use a .pac proxy script\n\n* ProxyFixedServers (fixed_servers) = Use fixed proxy servers\n\n* ProxyUseSystem (system) = Use system proxy settings\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.proxymode_proxydisabled","displayName":"Never use a proxy","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.proxymode_proxyautodetect","displayName":"Auto detect proxy settings","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.proxymode_proxypacscript","displayName":"Use a .pac proxy script","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.proxymode_proxyfixedservers","displayName":"Use fixed proxy servers","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.proxymode_proxyusesystem","displayName":"Use system proxy settings","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.proxyoverriderules","displayName":"Proxy override rules","description":"This policy enables rule-based proxy selection that determines which proxy Microsoft Edge uses based on the destination URL and any additional conditions you define.\n\nWhen this policy is configured, it takes precedence over proxy settings configured by the ProxySettings policy, the Edge.proxy extension API, and any manual user settings.\n\nIf this policy is disabled or not configured, existing proxy policies and user-defined settings continue to apply.\n\nWhen Edge selects a proxy, it evaluates entries in the ProxyOverrideRules policy in order. A rule is considered a match when all the following conditions are met:\n* At least one URL pattern in DestinationMatchers is matched.\n* No URL pattern in ExcludeDestinationMatchers is matched.\n* If Conditions is specified and non-empty, all conditions are satisfied.\n\nFor a matching rule, the value specified in ProxyList is used as the proxy. If no rule matches, proxy selection falls back to the settings defined by the ProxySettings policy.\n\nThe URL patterns supported by DestinationMatchers and ExcludeDestinationMatchers are documented at https://review.learn.microsoft.com/en-us/DeployEdge/configure-microsoft-edge-proxy-support?branch=pr-en-us-6681#proxy-config-url-patterns .\nEntries in ProxyList correspond to PAC-style proxy strings, such as:\n* DIRECT\n* PROXY host:port\n* HTTPS host:port\n* SOCKS4 host:port\n* SOCKS5 host:port\n\nAlternatively, URL-form proxy specifiers can be used, for example:\n* http://host :port\n* https://host :port\n* socks4://host:port\n* socks5://host:port\n\nThe first reachable proxy in the list is used. Invalid entries are ignored.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.proxypacurl","displayName":"Set the proxy .pac file URL (Deprecated)","description":"This policy is deprecated, use \"ProxySettings\" instead. It won't work in Microsoft Edge version 91.\n\nSpecifies the URL for a proxy auto-config (PAC) file.\n\nThis policy is applied only if the \"ProxySettings\" policy isn't specified and you have selected pac_script in the \"ProxyMode\" policy. If you selected any other mode for configuring proxy policies, don't enable or configure this policy.\n\nIf you enable this policy, you can specify the URL for a PAC file, which defines how the browser automatically chooses the appropriate proxy server for fetching a particular website.\n\nIf you disable or don't configure this policy, no PAC file is specified. Leave this policy unconfigured if you've specified any other method for setting proxy policies.\n\nFor detailed examples, see https://go.microsoft.com/fwlink/?linkid=2094936.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.proxyserver","displayName":"Configure address or URL of proxy server (Deprecated)","description":"This policy is deprecated, use \"ProxySettings\" instead. It won't work in Microsoft Edge version 91.\n\nSpecifies the URL of the proxy server.\n\nThis policy is applied only if the \"ProxySettings\" policy isn't specified and you have selected fixed_servers in the \"ProxyMode\" policy. If you selected any other mode for configuring proxy policies, don't enable or configure this policy.\n\nIf you enable this policy, the proxy server configured by this policy will be used for all URLs.\n\nIf you disable or don't configure this policy, users can choose their own proxy settings while in this proxy mode. Leave this policy unconfigured if you've specified any other method for setting proxy policies.\n\nFor more options and detailed examples, see https://go.microsoft.com/fwlink/?linkid=2094936.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.proxysettings","displayName":"Proxy settings","description":"Configures the proxy settings for Microsoft Edge.\n\nIf you enable this policy, Microsoft Edge ignores all proxy-related options specified from the command line.\n\nIf you don't configure this policy, users can choose their own proxy settings.\n\nThis policy overrides the following individual policies:\n\n\"ProxyMode\"\n\n\"ProxyPacUrl\"\n\n\"ProxyServer\"\n\n\"ProxyBypassList\"\n\nSetting the \"ProxySettings\" policy accepts the following fields:\n\n* ProxyMode, which lets you specify the proxy server used by Microsoft Edge and prevents users from changing proxy settings\n\n* ProxyPacUrl, a URL to a proxy .pac file or a PAC script encoded as a data URL with MIME type application/x-ns-proxy-autoconfig\n\n* ProxyPacMandatory, a boolean flag that prevents the network stack from falling back to direct connections with invalid or unavailable PAC script\n\n* ProxyServer, a URL for the proxy server\n\n* ProxyBypassList, a list of proxy hosts that Microsoft Edge bypasses\n\nFor ProxyMode, the following values when chosen lead to the following results:\n\n* direct, a proxy is never used and all other fields are ignored.\n\n* system, the systems's proxy is used and all other fields are ignored.\n\n* auto_detect, all other fields are ignored.\n\n* fixed_servers, the ProxyServer and ProxyBypassList fields are used.\n\n* pac_script, the ProxyPacUrl, ProxyPacMandatory and ProxyBypassList fields are used.\n\nFor more detailed examples, see https://go.microsoft.com/fwlink/?linkid=2094936.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.quicksearchshowminimenu","displayName":"Enables Microsoft Edge mini menu","description":"Enables the Microsoft Edge mini menu on websites and PDFs. The mini menu appears when users select text and provides basic actions like Copy and smart actions such as Definitions.\n\nIf you enable or don't configure this policy, selecting text on websites or PDFs shows the mini menu.\n\nIf you disable this policy, the mini menu doesn't appear when users select text on websites or PDFs.\n\nNote: Starting in Microsoft Edge for Mac version 143, this policy is obsolete because the mini menu feature has been removed on Mac.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.quicksearchshowminimenu_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.quicksearchshowminimenu_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.quicksearchshowminimenu_recommended","displayName":"Enables Microsoft Edge mini menu (users can override)","description":"Enables the Microsoft Edge mini menu on websites and PDFs. The mini menu appears when users select text and provides basic actions like Copy and smart actions such as Definitions.\n\nIf you enable or don't configure this policy, selecting text on websites or PDFs shows the mini menu.\n\nIf you disable this policy, the mini menu doesn't appear when users select text on websites or PDFs.\n\nNote: Starting in Microsoft Edge for Mac version 143, this policy is obsolete because the mini menu feature has been removed on Mac.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.quicksearchshowminimenu_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.quicksearchshowminimenu_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.quickviewofficefilesenabled","displayName":"Manage QuickView Office files capability in Microsoft Edge","description":"Allows you to set whether users can view publicly accessible Office files on the web that aren't on OneDrive or SharePoint. (For example: Word documents, PowerPoint presentations, and Excel spreadsheets)\n\nIf you enable or don't configure this policy, these files can be viewed in Microsoft Edge using Office Viewer instead of downloading the files.\n\nIf you disable this policy, these files will be downloaded to be viewed.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.quickviewofficefilesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.quickviewofficefilesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.readaloudenabled","displayName":"Enable Read Aloud feature in Microsoft Edge","description":"Enables the Read Aloud feature within Microsoft Edge.\nUsing this feature, users can listen to the content on the web page. This enables users to multi-task or improve their reading comprehension by hearing content at their own pace.\n\nIf you enable this policy or don't configure it, the Read Aloud option shows up in the address bar, right click context menu, more menu, on the PDF toolbar, and within Immersive Reader.\nIf you disable this policy, users can't access the Read Aloud feature from the address bar, right click context menu, more menu, on the PDF toolbar, and within Immersive Reader.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.readaloudenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.readaloudenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.registeredprotocolhandlers","displayName":"Register protocol handlers","description":"Set this policy (recommended only) to register a list of protocol handlers. This list is merged with ones registered by the user and both are available to use.\n\nTo register a protocol handler:\n\n- Set the protocol property to the scheme (for example, \"mailto\")\n- Set the URL property to the URL property of the application that handlers the scheme specified in the \"protocol\" field. The pattern can include a \"%s\" placeholder, which the handled URL replaces.\n\nUsers can't remove a protocol handler registered by this policy. However, they can install a new default protocol handler to override the existing protocol handlers.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.registeredprotocolhandlers_recommended","displayName":"Register protocol handlers (users can override)","description":"Set this policy (recommended only) to register a list of protocol handlers. This list is merged with ones registered by the user and both are available to use.\n\nTo register a protocol handler:\n\n- Set the protocol property to the scheme (for example, \"mailto\")\n- Set the URL property to the URL property of the application that handlers the scheme specified in the \"protocol\" field. The pattern can include a \"%s\" placeholder, which the handled URL replaces.\n\nUsers can't remove a protocol handler registered by this policy. However, they can install a new default protocol handler to override the existing protocol handlers.\n\nIn the examples in this section, the URL points to the Outlook on the Web (OWA) endpoint used in Exchange Online. If you're targeting Exchange Server (on-premises), use the following URL and replace mail.contoso.com with your organization's OWA endpoint:\n\nhttps://mail.contoso.com/?path=/mail/action/compose&mailtouri=%s","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.relatedmatchescloudserviceenabled","displayName":"Configure Related Matches in Find on Page (Obsolete)","description":"Specifies how the user receives related matches in Find on Page, which provides spellcheck, synonyms, and Q&A results in Microsoft Edge.\n\nIf you enable or do not configure this policy, users can receive related matches in Find on Page on all sites. The results are processed through a cloud service.\n\nIf you disable this policy, users can receive related matches in Find on Page on a limited set of sites. In this case, results are processed locally on the user's device.\n\nNote: This policy is obsolete. The associated cloud service has been discontinued, so the feature and policy are not supported on any versions of Microsoft Edge.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.relatedmatchescloudserviceenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.relatedmatchescloudserviceenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.relatedwebsitesetsenabled","displayName":"Enable Related Website Sets (Deprecated)","description":"This policy lets you control the enablement of the Related Website Sets feature. Related Website Sets (RWS) is a way for an organisation to declare relationships among sites, so that Microsoft Edge allows limited third-party cookie access for specific purposes across those sites.\n\nIf this policy set to True or unset, the Related Website Sets feature is enabled.\n\nIf this policy is set to False, the Related Website Sets feature is disabled.\n\nThis policy is deprecated as of Microsoft Edge version 144 with the deprecation of Related Website Sets.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.relatedwebsitesetsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.relatedwebsitesetsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.relatedwebsitesetsoverrides","displayName":"Override Related Website Sets. (Deprecated)","description":"This policy provides a way to override the list of sets Microsoft Edge uses for Related Website Sets\n\nEach set in the browser's list of Related Website Sets must meet the requirements of a Related Website Set. A Related Website Set must contain a primary site and one or more member sites.\nA set can also contain a list of service sites that it owns, and a map from a site to all its ccTLD variants. See https://github.com/WICG/first-party-sets for more information on how Microsoft Edge uses Related Website Sets.\n\n\nAll sites in a Related Website Set must be a registrable domain served over HTTPS. Each site in a Related Website Set must also be unique, which means a site can't be listed more than once in a Related Website Set.\n\nWhen this policy is given an empty dictionary, Microsoft Edge uses the public list of Related Website Sets.\n\nFor all sites in a Related Website Set from the replacements list, if a site is also present on a Related Website Set in the browser's list, then that site will be removed from the browser's Related Website Set. After this, the policy's Related Website Set will be added to the Microsoft Edge's list of Related Website Sets.\n\nFor all sites in a Related Website Set from the additions list, if a site is also present on a Related Website Set in Microsoft Edge's list, then the browser's Related Website Set will be updated so that the new Related Website Set can be added to the browser's list. After the browser's list has been updated, the policy's Related Website Set will be added to the browser's list of Related Website Sets.\n\nThe browser's list of Related Website Sets requires that for all sites in its list, no site is in\nmore than one set. This is also required for both the replacements list\nand the additions list. Similarly, a site can't be in both the\nreplacements list and the additions list.\n\nWildcards (*) aren't supported as a policy value, or as a value within any Related Website Set in these lists.\n\nThis policy is deprecated as of Microsoft Edge version 144 with the deprecation of Related Website Sets.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.resolvenavigationerrorsusewebservice","displayName":"Enable resolution of navigation errors using a web service","description":"Allow Microsoft Edge to issue a dataless connection to a web service to probe networks for connectivity in cases like hotel and airport Wi-Fi.\n\nIf you enable this policy, a web service is used for network connectivity tests.\n\nIf you disable this policy, Microsoft Edge uses native APIs to try to resolve network connectivity and navigation issues.\n\n**Note**: Except on Windows 8 and later versions of Windows, Microsoft Edge *always* uses native APIs to resolve connectivity issues.\n\nIf you don't configure this policy, Microsoft Edge respects the user preference that's set under Services at edge://settings/privacy.\nSpecifically, there's a **Use a web service to help resolve navigation errors** toggle, which the user can switch on or off. Be aware that if you have enabled this policy (ResolveNavigationErrorsUseWebService), the **Use a web service to help resolve navigation errors** setting is turned on, but the user can't change the setting by using the toggle. If you have disabled this policy, the **Use a web service to help resolve navigation errors** setting is turned off, and the user can't change the setting by using the toggle.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.resolvenavigationerrorsusewebservice_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.resolvenavigationerrorsusewebservice_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.resolvenavigationerrorsusewebservice_recommended","displayName":"Enable resolution of navigation errors using a web service (users can override)","description":"Allow Microsoft Edge to issue a dataless connection to a web service to probe networks for connectivity in cases like hotel and airport Wi-Fi.\n\nIf you enable this policy, a web service is used for network connectivity tests.\n\nIf you disable this policy, Microsoft Edge uses native APIs to try to resolve network connectivity and navigation issues.\n\n**Note**: Except on Windows 8 and later versions of Windows, Microsoft Edge *always* uses native APIs to resolve connectivity issues.\n\nIf you don't configure this policy, Microsoft Edge respects the user preference that's set under Services at edge://settings/privacy.\nSpecifically, there's a **Use a web service to help resolve navigation errors** toggle, which the user can switch on or off. Be aware that if you have enabled this policy (ResolveNavigationErrorsUseWebService), the **Use a web service to help resolve navigation errors** setting is turned on, but the user can't change the setting by using the toggle. If you have disabled this policy, the **Use a web service to help resolve navigation errors** setting is turned off, and the user can't change the setting by using the toggle.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.resolvenavigationerrorsusewebservice_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.resolvenavigationerrorsusewebservice_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.restoreonstartup","displayName":"Action to take on Microsoft Edge startup","description":"Specify how Microsoft Edge behaves when it starts.\n\nIf you want a new tab to always open on startup, choose 'RestoreOnStartupIsNewTabPage'.\n\nIf you want to reopen URLs that were open the last time Microsoft Edge closed, choose 'RestoreOnStartupIsLastSession'. The browsing session will be restored as it was. Note that this option disables some settings that rely on sessions or that perform actions on exit (such as Clear browsing data on exit or session-only cookies).\n\nIf you want to open a specific set of URLs, choose 'RestoreOnStartupIsURLs'.\n\nStarting in Microsoft Edge version 125, if you want to reopen URLs that were open the last time Microsoft Edge closed and open a specific set of URLs, choose 'RestoreOnStartupIsLastSessionAndURLs'.\n\nDisabling this setting is the same as leaving it not configured. Users will be able to change it in Microsoft Edge.\n\nThis policy is only available on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is only available on instances that are managed via MDM or joined to a domain via MCX.\n\nPolicy options mapping:\n\n* RestoreOnStartupIsNewTabPage (5) = Open a new tab\n\n* RestoreOnStartupIsLastSession (1) = Restore the last session\n\n* RestoreOnStartupIsURLs (4) = Open a list of URLs\n\n* RestoreOnStartupIsLastSessionAndURLs (6) = Open a list of URLs and restore the last session\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.restoreonstartup_restoreonstartupisnewtabpage","displayName":"Open a new tab","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.restoreonstartup_restoreonstartupislastsession","displayName":"Restore the last session","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.restoreonstartup_restoreonstartupisurls","displayName":"Open a list of URLs","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.restoreonstartup_restoreonstartupislastsessionandurls","displayName":"Open a list of URLs and restore the last session","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.restoreonstartup_recommended","displayName":"Action to take on Microsoft Edge startup (users can override)","description":"Specify how Microsoft Edge behaves when it starts.\n\nIf you want a new tab to always open on startup, choose 'RestoreOnStartupIsNewTabPage'.\n\nIf you want to reopen URLs that were open the last time Microsoft Edge closed, choose 'RestoreOnStartupIsLastSession'. The browsing session will be restored as it was. Note that this option disables some settings that rely on sessions or that perform actions on exit (such as Clear browsing data on exit or session-only cookies).\n\nIf you want to open a specific set of URLs, choose 'RestoreOnStartupIsURLs'.\n\nStarting in Microsoft Edge version 125, if you want to reopen URLs that were open the last time Microsoft Edge closed and open a specific set of URLs, choose 'RestoreOnStartupIsLastSessionAndURLs'.\n\nDisabling this setting is the same as leaving it not configured. Users will be able to change it in Microsoft Edge.\n\nThis policy is only available on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is only available on instances that are managed via MDM or joined to a domain via MCX.\n\nPolicy options mapping:\n\n* RestoreOnStartupIsNewTabPage (5) = Open a new tab\n\n* RestoreOnStartupIsLastSession (1) = Restore the last session\n\n* RestoreOnStartupIsURLs (4) = Open a list of URLs\n\n* RestoreOnStartupIsLastSessionAndURLs (6) = Open a list of URLs and restore the last session\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.restoreonstartup_recommended_restoreonstartupisnewtabpage","displayName":"Open a new tab","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.restoreonstartup_recommended_restoreonstartupislastsession","displayName":"Restore the last session","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.restoreonstartup_recommended_restoreonstartupisurls","displayName":"Open a list of URLs","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.restoreonstartup_recommended_restoreonstartupislastsessionandurls","displayName":"Open a list of URLs and restore the last session","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.restoreonstartupurls","displayName":"Sites to open when the browser starts","description":"Specify a list of websites to open automatically when the browser starts. If you don't configure this policy, no site is opened on startup.\n\nThis policy only works if you also set the \"RestoreOnStartup\" policy to 'Open a list of URLs' (4).\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory` or instances that enrolled for device management.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.restoreonstartupurls_recommended","displayName":"Sites to open when the browser starts (users can override)","description":"Specify a list of websites to open automatically when the browser starts. If you don't configure this policy, no site is opened on startup.\n\nThis policy only works if you also set the \"RestoreOnStartup\" policy to 'Open a list of URLs' (4).\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory` or instances that enrolled for device management.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.restoreonstartupuserurlsenabled","displayName":"Allow users to add and remove their own sites during startup when the RestoreOnStartupURLs policy is configured","description":"This policy only works if you set the \"RestoreOnStartup\" policy to 'Open a list of URLs' (4) and the \"RestoreOnStartupURLs\" policy as mandatory.\nIf you enable this policy, users are allowed to add and remove their own URLs to open when starting Edge while maintaining the admin specified mandatory list of sites specified by setting \"RestoreOnStartup\" policy to open a list of URLS and providing the list of sites in the \"RestoreOnStartupURLs\" policy.\n\nIf you disable or don't configure this policy, there is no change to how the \"RestoreOnStartup\" and \"RestoreOnStartupURLs\" policies work.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.restoreonstartupuserurlsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.restoreonstartupuserurlsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.restorepdfview","displayName":"Restore PDF view","description":"Enables PDF View Recovery in Microsoft Edge.\n\nIf you enable or don't configure this policy Microsoft Edge will recover the last state of PDF view and land users to the section where they ended reading in the last session.\n\nIf you disable this policy Microsoft Edge will recover the last state of PDF view and land users at the start of the PDF file.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.restorepdfview_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.restorepdfview_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.runallflashinallowmode","displayName":"Extend Adobe Flash content setting to all content (Obsolete)","description":"This policy doesn't work because Flash is no longer supported by Microsoft Edge.\n\nIf you enable this policy, all Adobe Flash content embedded in websites that are set to allow Adobe Flash in the content settings, either by the user or by enterprise policy, run. This includes content from other origins and/or small content.\n\nTo control which websites are allowed to run Adobe Flash, see the specifications in the \"DefaultPluginsSetting\", \"PluginsAllowedForUrls\", and \"PluginsBlockedForUrls\" policies.\n\nIf you disable this policy or don't configure it, Adobe Flash content from other origins (sites that aren't specified in the preceding three policies) or small content might be blocked.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.runallflashinallowmode_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.runallflashinallowmode_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sameorigintabcaptureallowedbyorigins","displayName":"Allow Same Origin Tab capture by these origins","description":"Setting the policy lets you set a list of URL patterns that can capture tabs with their same Origin.\n\nLeaving the policy unset means that sites will not be considered for an override at this scope of capture.\n\nIf a site matches a URL pattern in this policy, the following policies will not be considered: \"TabCaptureAllowedByOrigins\", \"WindowCaptureAllowedByOrigins\", \"ScreenCaptureAllowedByOrigins\", \"ScreenCaptureAllowed\".\n\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. This policy only matches based on origin, so any path in the URL pattern is ignored.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sandboxexternalprotocolblocked","displayName":"Allow Microsoft Edge to block navigations to external protocols in a sandboxed iframe","description":"Microsoft Edge will block navigations to external protocols inside a\nsandboxed iframe.\n\nIf you enable or don't configure this policy, Microsoft Edge will block those navigations.\n\nIf you disable this policy, Microsoft Edge will not block those navigations.\n\nThis can be used by administrators who need more time to update their internal website affected by this new restriction. This Enterprise policy is temporary; it's intended to be removed after Microsoft Edge version 117.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.sandboxexternalprotocolblocked_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sandboxexternalprotocolblocked_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.savecookiesonexit","displayName":"Save cookies when Microsoft Edge closes","description":"When this policy is enabled, the specified set of cookies is exempt from deletion when the browser closes. This policy is only effective when:\n- The 'Cookies and other site data' toggle is configured in Settings/Privacy and services/Clear browsing data on close or\n- The policy \"ClearBrowsingDataOnExit\" is enabled or\n- The policy \"DefaultCookiesSetting\" is set to 'Keep cookies for the duration of the session'.\n\nYou can define a list of sites, based on URL patterns, that will have their cookies preserved across sessions.\n\nNote: Users can still edit the cookie site list to add or remove URLs. However, they can't remove URLs that have been added by an Admin.\n\nIf you enable this policy, the list of cookies won't be cleared when the browser closes.\n\nIf you disable or don't configure this policy, the user's personal configuration is used.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.savingbrowserhistorydisabled","displayName":"Disable saving browser history","description":"Disables saving browser history and prevents users from changing this setting.\n\nIf you enable this policy, browsing history isn't saved. This also disables tab syncing.\n\nIf you disable this policy or don't configure it, browsing history is saved.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.savingbrowserhistorydisabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.savingbrowserhistorydisabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.scarewareblockerallowlistdomains","displayName":"Configure the list of domains where Microsoft Edge Scareware blockers don't run","description":"This policy configures the list of trusted domains for Microsoft Edge Scareware blocker. When a website's source URL matches any domain in this list, Microsoft Edge Scareware blocker doesn't analyze that site.\n\nThis policy takes effect only if the ScarewareBlockerProtectionEnabled policy is enabled.\n\nIf you enable this policy, Microsoft Edge Scareware blocker trusts the specified domains.\n\nIf you disable or don't configure this policy, Microsoft Edge Scareware blocker analyzes all sites.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.screencaptureallowed","displayName":"Allow or deny screen capture","description":"If you enable this policy, or don't configure this policy, a web page can use screen-share APIs (for example, getDisplayMedia() or the Desktop Capture extension API) for a screen capture.\nIf you disable this policy, calls to screen-share APIs will fail. For example, if you're using a web-based online meeting, video or screen sharing will not work. However, this policy is not considered\n(and a site will be allowed to use screen-share APIs) if the site matches an origin pattern in any of the following policies:\n\"ScreenCaptureAllowedByOrigins\",\n\"WindowCaptureAllowedByOrigins\",\n\"TabCaptureAllowedByOrigins\",\n\"SameOriginTabCaptureAllowedByOrigins\".","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.screencaptureallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.screencaptureallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.screencaptureallowedbyorigins","displayName":"Allow Desktop, Window, and Tab capture by these origins","description":"Setting the policy lets you set a list of URL patterns that can use Desktop, Window, and Tab Capture.\n\nLeaving the policy unset means that sites will not be considered for an override at this scope of Capture.\n\nThis policy is not considered if a site matches a URL pattern in any of the following policies: \"WindowCaptureAllowedByOrigins\", \"TabCaptureAllowedByOrigins\", \"SameOriginTabCaptureAllowedByOrigins\".\n\nIf a site matches a URL pattern in this policy, the \"ScreenCaptureAllowed\" will not be considered.\n\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. This policy only matches based on origin, so any path in the URL pattern is ignored.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.screencapturewithoutgestureallowedfororigins","displayName":"Allow screen capture without prior user gesture","description":"For security reasons, the\ngetDisplayMedia() web API requires\na prior user gesture (\"transient activation\") to be called or the API will\nfail.\n\nWhen this policy is configured, admins can specify origins on which this API\ncan be called without prior user gesture.\n\nFor detailed information on valid url patterns, see\nhttps://go.microsoft.com/fwlink/?linkid=2095322. Note: * is not an accepted\nvalue for this policy.\n\nIf this policy is not configured, all origins require a prior user gesture to\ncall this API.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.scrolltotextfragmentenabled","displayName":"Enable scrolling to text specified in URL fragments","description":"This feature lets hyperlink and address bar URL navigations target specific text on a web page, which will be scrolled to after the web page finishes loading.\n\nIf you enable or don't configure this policy, web page scrolling to specific text fragments via a URL will be enabled.\n\nIf you disable this policy, web page scrolling to specific text fragments via a URL will be disabled.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.scrolltotextfragmentenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.scrolltotextfragmentenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchfiltersenabled","displayName":"Search Filters Enabled","description":"Lets you filter your autosuggestions by selecting a filter from the search filters ribbon. For example, if you select the \"Favorites\" filter, only favorites suggestions will be shown.\n\nIf you enable or don't configure this policy, the autosuggestion dropdown defaults to displaying the ribbon of available filters.\n\nIf you disable this policy, the autosuggestion dropdown won't display the ribbon of available filters.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchfiltersenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchfiltersenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchfiltersenabled_recommended","displayName":"Search Filters Enabled (users can override)","description":"Lets you filter your autosuggestions by selecting a filter from the search filters ribbon. For example, if you select the \"Favorites\" filter, only favorites suggestions will be shown.\n\nIf you enable or don't configure this policy, the autosuggestion dropdown defaults to displaying the ribbon of available filters.\n\nIf you disable this policy, the autosuggestion dropdown won't display the ribbon of available filters.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchfiltersenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchfiltersenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchforimageenabled","displayName":"Search for image enabled","description":"This policy lets you configure the Image Search feature in the right-click context menu.\n\nIf you enable or don't configure this policy, then the \"Search the web for image\" option is visible in the context menu.\n\nIf you disable this policy, then the \"Search the web for image\" won't be visible in the context menu.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchforimageenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchforimageenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchinsidebarenabled","displayName":"Search in Sidebar enabled","description":"Search in Sidebar allows users to open search result in sidebar (including sidebar search for Progressive Web Apps).\n\nIf you configure this policy to 'EnableSearchInSidebar' or don't configure it, Search in sidebar is enabled.\n\nIf you configure this policy to 'DisableSearchInSidebarForKidsMode', Search in sidebar is disabled when in Kids mode. Some methods that would normally invoke sidebar search will invoke a traditional search instead.\n\nIf you configure this policy to 'DisableSearchInSidebar', Search in sidebar is disabled. Some methods that would invoke sidebar search invoke a traditional search instead.\n\nPolicy options mapping:\n\n* EnableSearchInSidebar (0) = Enable search in sidebar\n\n* DisableSearchInSidebarForKidsMode (1) = Disable search in sidebar for Kids Mode\n\n* DisableSearchInSidebar (2) = Disable search in sidebar\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchinsidebarenabled_enablesearchinsidebar","displayName":"Enable search in sidebar","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchinsidebarenabled_disablesearchinsidebarforkidsmode","displayName":"Disable search in sidebar for Kids Mode","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchinsidebarenabled_disablesearchinsidebar","displayName":"Disable search in sidebar","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchsuggestenabled","displayName":"Enable search suggestions","description":"Enables web search suggestions in Microsoft Edge's Address Bar and Auto-Suggest List and prevents users from changing this policy.\n\nIf you enable this policy, web search suggestions are used.\n\nIf you disable this policy, web search suggestions are never used, however local history and local favorites suggestions still appear. If you disable this policy, neither the typed characters, nor the URLs visited will be included in telemetry to Microsoft.\n\nIf this policy is left not set, search suggestions are enabled but the user can change that.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchsuggestenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchsuggestenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchsuggestenabled_recommended","displayName":"Enable search suggestions (users can override)","description":"Enables web search suggestions in Microsoft Edge's Address Bar and Auto-Suggest List and prevents users from changing this policy.\n\nIf you enable this policy, web search suggestions are used.\n\nIf you disable this policy, web search suggestions are never used, however local history and local favorites suggestions still appear. If you disable this policy, neither the typed characters, nor the URLs visited will be included in telemetry to Microsoft.\n\nIf this policy is left not set, search suggestions are enabled but the user can change that.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchsuggestenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.searchsuggestenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.securitykeypermitattestation","displayName":"Websites or domains that don't need permission to use direct Security Key attestation","description":"Specifies the WebAuthn RP IDs that don't need explicit user permission when attestation certificates from security keys are requested. Additionally, a signal is sent to the security key indicating that it can use enterprise attestation. Without this policy, users are prompted each time a site requests attestation of security keys.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.selectparserrelaxationenabled","displayName":"Controls whether the new HTML parser behavior for the element. This policy supports the old HTML parser behavior through Microsoft Edge version 138.\n\nIf this policy is enabled or unset, the HTML parser allows additional tags inside the element.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.selectparserrelaxationenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.selectparserrelaxationenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sendintranettointernetexplorer","displayName":"Send all intranet sites to Internet Explorer","description":"For guidance about configuring the optimal experience for Internet Explorer mode see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.sendintranettointernetexplorer_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sendintranettointernetexplorer_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sendmouseeventsdisabledformcontrolsenabled","displayName":"Control the new behavior for event dispatching on disabled form controls (Obsolete)","description":"Event dispatching on disabled form controls is being changed in Microsoft Edge to improve compatibility with other browsers and to improve the developer experience.\n\nWith this change, MouseEvents get dispatched on disabled form control elements. Exceptions for this behavior are click, mouseup, and mousedown. Some examples of the new events are mousemove, mouseenter, and mouseleave.\n\nThis change also truncates the event path of click, mouseup, and mousedown when they’re dispatched on children of disabled form controls. These events aren’t dispatched on the disabled form control or on any of its ancestors.\n\nNote: This new behavior might break some websites.\n\nIf you enable or don't configure this policy, the new behavior is used.\n\nIf you disable this policy, the old behavior is used.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.sendmouseeventsdisabledformcontrolsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sendmouseeventsdisabledformcontrolsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sensorsallowedforurls","displayName":"Allow access to sensors on specific sites","description":"Define a list of sites, based on URL patterns, that can access and use sensors such as motion and light sensors.\n\nIf you don't configure this policy, the global default value from the \"DefaultSensorsSetting\" policy (if set) or the user's personal configuration is used for all sites.\n\nFor URL patterns that don't match this policy, the following order of precedence is used: The \"SensorsBlockedForUrls\" policy (if there is a match), the \"DefaultSensorsSetting\" policy (if set), or the user's personal settings.\n\nThe URL patterns defined in this policy can't conflict with those configured in the \"SensorsBlockedForUrls\" policy. You can't allow and block a URL.\n\nFor detailed information about valid URL patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sensorsblockedforurls","displayName":"Block access to sensors on specific sites","description":"Define a list of sites, based on URL patterns, that can't access sensors such as motion and light sensors.\n\nIf you don't configure this policy, the global default value from the \"DefaultSensorsSetting\" policy (if set) or the user's personal configuration is used for all sites.\n\nFor URL patterns that don't match this policy, the following order of precedence is used: The \"SensorsAllowedForUrls\" policy (if there is a match), the \"DefaultSensorsSetting\" policy (if set), or the user's personal settings.\n\nThe URL patterns defined in this policy can't conflict with those configured in the \"SensorsAllowedForUrls\" policy. You can't allow and block a URL.\n\nFor detailed information about valid URL patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.serialaskforurls","displayName":"Allow the Serial API on specific sites","description":"Specifies URL patterns for sites that are allowed to request access to a serial port.\n\nIf not configured, Microsoft Edge uses the value from the DefaultSerialGuardSetting policy (if set), or the user's settings.\n\nFor unmatched sites, the following order applies:\n\n1. \"SerialBlockedForUrls\" (if matched).\n\n2. DefaultSerialGuardSetting (if set).\n\n3. User's settings.\n\nIf URL patterns in this policy conflict with those in \"SerialBlockedForUrls\", they're ignored.\n\nFor detailed information about valid URL patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.serialblockedforurls","displayName":"Block the Serial API on specific sites","description":"Specifies URL patterns for sites that aren't allowed to request access to a serial port.\n\nIf not configured, Microsoft Edge uses the value from the DefaultSerialGuardSetting policy (if set), or the user's settings.\n\nFor unmatched sites, the following order applies:\n\n1. SerialAskForUrls (if matched).\n\n2. DefaultSerialGuardSetting (if set).\n\n3. User's settings.\n\nURL patterns in this policy must not conflict with those in SerialAskForUrls. This policy takes precedence.\n\nFor detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.serviceworkerautopreloadenabled","displayName":"Allow ServiceWorker to dispatch navigation requests without waiting for its startup","description":"This policy controls whether Microsoft Edge enables the ServiceWorkerAutoPreload feature.\n\nWhen enabled or not configured, Microsoft Edge may initiate the main resource network request concurrently with the Service Worker bootstrap process. This can improve performance in scenarios where the Service Worker isn't already running.\n\nIf you disable this policy, Microsoft Edge will wait to dispatch the navigation request until after the Service Worker has started.\n\nThis is a temporary policy and will be removed in version 144 of Microsoft Edge.\n\nFor more information on the feature, see https://github.com/WICG/service-worker-auto-preload.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.serviceworkerautopreloadenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.serviceworkerautopreloadenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.serviceworkertocontrolsrcdociframeenabled","displayName":"Allow ServiceWorker to control srcdoc iframes","description":"https://github.com/w3c/ServiceWorker/issues/765 asks srcdoc iframe with the \"allow-same-origin\" sandbox attribute to be under ServiceWorker control.\n\nBy default (if left unset) or when set to Enabled, Microsoft Edge makes srcdoc iframes with \"allow-same-origin\" sandbox attributes to be under ServiceWorker control.\n\nSetting the policy to Disabled prevents ServiceWorker control over srcdoc iframes.\n\nThis policy is temporary and planned for deprecation in 2026.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.serviceworkertocontrolsrcdociframeenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.serviceworkertocontrolsrcdociframeenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.settimeoutwithout1msclampenabled","displayName":"Control Javascript setTimeout() function minimum timeout (Obsolete)","description":"This policy is obsolete and doesn't work in Microsoft Edge after version 109.\nThis policy was only provided temporarily to allow Enterprises to adapt to the new clamping behavior.\n\n When the policy is set to Enabled, the Javascript setTimeout() with a timeout of 0ms will no longer be fixed to 1ms to schedule timer-based callbacks.\n When the policy is set to Disabled, the Javascript setTimeout() with a timeout of 0ms will be fixed to 1ms to schedule timer-based callbacks.\n When the policy is unset, use the browser's default behavior for setTimeout() function.\n\n This is a web standards compliancy feature, but it may change task ordering on a web page, leading to unexpected behavior on sites that are dependent on a certain ordering.\n It also may affect sites with a lot of setTimeout()s with a timeout of 0ms usage. For example, increasing CPU load.\n\n For users where this policy is unset, Microsoft Edge Stable will roll out the change gradually on the stable channel.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.settimeoutwithout1msclampenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.settimeoutwithout1msclampenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sharebrowsinghistorywithcopilotsearchallowed","displayName":"Allow sharing tenant-approved browsing history with Microsoft 365 Copilot Search","description":"This policy controls whether browsing history in Microsoft Edge is shared with Microsoft 365 Copilot Search to provide more relevant search results. Only tenant-approved, work-related sites are shared.\n\nThis feature is available only to users who are signed in to Microsoft Edge with an Entra ID account and have an eligible Microsoft 365 Copilot license.\n\nIf you enable or don't configure this policy, browsing history will be shared with Microsoft 365 Copilot Search by default, and users can turn off sharing using the toggle in Microsoft Edge settings.\n\nIf you disable this policy, browsing history won't be shared with Microsoft 365 Copilot Search.\n\nLearn more about how Copilot uses data and consent at https://go.microsoft.com/fwlink/?linkid=2333202","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.sharebrowsinghistorywithcopilotsearchallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sharebrowsinghistorywithcopilotsearchallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sharedarraybufferunrestrictedaccessallowed","displayName":"Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context","description":"Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context. A SharedArrayBuffer is a binary data buffer that can be used to create views on shared memory. SharedArrayBuffers have a memory access vulnerability in several popular CPUs.\n\nIf you enable this policy, sites are allowed to use SharedArrayBuffers with no restrictions.\n\nIf you disable or don't configure this policy, sites are allowed to use SharedArrayBuffers only when cross-origin isolated.\n\nMicrosoft Edge will require cross-origin isolation when using SharedArrayBuffers from Microsoft Edge 91 onward for Web Compatibility reasons.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.sharedarraybufferunrestrictedaccessallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sharedarraybufferunrestrictedaccessallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sharedworkerbloburlfixenabled","displayName":"Make SharedWorker blob URL behavior aligned with the specification","description":"According to Service Worker specification\nhttps://w3c.github.io/ServiceWorker/#control-and-use-worker-client, workers\nshould inherit controllers for blob URLs. Currently, only DedicatedWorkers\ninherit the controller, while SharedWorkers do not.\n\nEnabled/Unset: Microsoft Edge inherits\nthe controller for SharedWorker blob URLs, aligning with the specification.\n\nDisabled: Behavior remains unchanged, not aligning with the specification.\n\nThis policy is temporary and will be removed in a future update.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.sharedworkerbloburlfixenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sharedworkerbloburlfixenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showacrobatsubscriptionbutton","displayName":"Shows button on native PDF viewer in Microsoft Edge that allows users to sign up for Adobe Acrobat subscription","description":"This policy lets the native PDF viewer in Microsoft Edge show a button that lets a user looking for advanced digital document features to discover and subscribe to premium offerings. This is done via the Acrobat extension.\n\nIf you enable or don't configure this policy, the button will show up on the native PDF viewer in Microsoft Edge. A user will be able to buy Adobe subscription to access their premium offerings.\n\nIf you disable this policy, the button won't be visible on the native PDF viewer in Microsoft Edge. A user won't be able to discover Adobe's advanced PDF tools or buy their subscriptions.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.showacrobatsubscriptionbutton_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showacrobatsubscriptionbutton_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showcasticonintoolbar","displayName":"Show the cast icon in the toolbar","description":"Set this policy to true to show the Cast toolbar icon on the toolbar or the overflow menu. Users won't be able to remove it.\n\nIf you don't configure this policy or if you disable it, users can pin or remove the icon by using its contextual menu.\n\nIf you've also set the \"EnableMediaRouter\" policy to false, then this policy is ignored, and the toolbar icon isn't shown.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.showcasticonintoolbar_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showcasticonintoolbar_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showdownloadsinsecurewarningsenabled","displayName":"Enable insecure download warnings","description":"Enables warnings when potentially dangerous content is downloaded over HTTP.\n\nIf you enable or don't configure this policy, when a user tries to download potentially dangerous content from an HTTP site, the user will receive a UI warning, such as \"Insecure download blocked.\" The user will still have an option to proceed and download the item.\n\nIf you disable this policy, the warnings for insecure downloads will be suppressed.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.showdownloadsinsecurewarningsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showdownloadsinsecurewarningsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showdownloadsinsecurewarningsenabled_recommended","displayName":"Enable insecure download warnings (users can override)","description":"Enables warnings when potentially dangerous content is downloaded over HTTP.\n\nIf you enable or don't configure this policy, when a user tries to download potentially dangerous content from an HTTP site, the user will receive a UI warning, such as \"Insecure download blocked.\" The user will still have an option to proceed and download the item.\n\nIf you disable this policy, the warnings for insecure downloads will be suppressed.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.showdownloadsinsecurewarningsenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showdownloadsinsecurewarningsenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showdownloadstoolbarbutton","displayName":"Show Downloads button on the toolbar","description":"Set this policy to always show the Downloads button on the toolbar.\n\nIf you enable this policy, the Downloads button is pinned to the toolbar.\n\nIf you disable or don't configure the policy, the Downloads button isn't shown on the toolbar by default. Users can toggle the Downloads button in edge://settings/appearance.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.showdownloadstoolbarbutton_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showdownloadstoolbarbutton_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showhistorythumbnails","displayName":"Show thumbnail images for browsing history","description":"This policy lets you configure whether the history thumbnail feature collects and saves images for the sites you visit. When enabled, this feature makes it easier to identify sites when you hover over your history results.\nIf you don't configure this policy, the thumbnail feature is turned on after a user visits the history hub twice in the past 7 days.\nIf you enable this policy, the history thumbnail collects and saves images for visited sites.\nIf you disable this policy, the history thumbnail doesn't collect and save images for visited sites.\nWhen the feature is disabled, existing images are deleted on a per user basis, and the feature no longer collects or saves images when a site is visited.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.showhistorythumbnails_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showhistorythumbnails_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showhomebutton","displayName":"Show Home button on toolbar","description":"Shows the Home button on Microsoft Edge's toolbar.\n\nEnable this policy to always show the Home button. Disable it to never show the button.\n\nIf you don't configure the policy, users can choose whether to show the home button.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.showhomebutton_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showhomebutton_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showhomebutton_recommended","displayName":"Show Home button on toolbar (users can override)","description":"Shows the Home button on Microsoft Edge's toolbar.\n\nEnable this policy to always show the Home button. Disable it to never show the button.\n\nIf you don't configure the policy, users can choose whether to show the home button.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.showhomebutton_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showhomebutton_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showmicrosoftrewards","displayName":"Show Microsoft Rewards experiences","description":"Show Microsoft Rewards experience and notifications.\nIf you enable this policy:\n - Microsoft account users (excludes Azure AD accounts) in search, new tab page, and earn markets see the Microsoft Rewards experience in their Microsoft Edge user profile.\n - The setting to enable Microsoft Rewards in Microsoft Edge settings is enabled and toggled on.\n\nIf you disable this policy:\n - Microsoft account users (excludes Azure AD accounts) in search, new tab page, and earn markets won't see the Microsoft Rewards experience in their Microsoft Edge user profile.\n - The setting to enable Microsoft Rewards in Microsoft Edge settings is disabled and toggled off.\n\nIf you don't configure this policy:\n - Microsoft account users (excludes Azure AD accounts) in search, new tab page, and earn markets see the Microsoft Rewards experience in their Microsoft Edge user profile.\n - The setting to enable Microsoft Rewards in Microsoft Edge settings is enabled and toggled on.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.showmicrosoftrewards_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showmicrosoftrewards_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showmicrosoftrewards_recommended","displayName":"Show Microsoft Rewards experiences (users can override)","description":"Show Microsoft Rewards experience and notifications.\nIf you enable this policy:\n - Microsoft account users (excludes Azure AD accounts) in search, new tab page, and earn markets see the Microsoft Rewards experience in their Microsoft Edge user profile.\n - The setting to enable Microsoft Rewards in Microsoft Edge settings is enabled and toggled on.\n\nIf you disable this policy:\n - Microsoft account users (excludes Azure AD accounts) in search, new tab page, and earn markets won't see the Microsoft Rewards experience in their Microsoft Edge user profile.\n - The setting to enable Microsoft Rewards in Microsoft Edge settings is disabled and toggled off.\n\nIf you don't configure this policy:\n - Microsoft account users (excludes Azure AD accounts) in search, new tab page, and earn markets see the Microsoft Rewards experience in their Microsoft Edge user profile.\n - The setting to enable Microsoft Rewards in Microsoft Edge settings is enabled and toggled on.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.showmicrosoftrewards_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showmicrosoftrewards_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showofficeshortcutinfavoritesbar","displayName":"Show Microsoft Office shortcut in favorites bar (Deprecated)","description":"This policy didn't work as expected due to changes in operational requirements. Therefore it's deprecated and should not be used.\n\nSpecifies whether to include a shortcut to Office.com in the favorites bar. For users signed into Microsoft Edge the shortcut takes users to their Microsoft Office apps and docs.\n If you enable or don't configure this policy, users can choose whether to see the shortcut by changing the toggle in the favorites bar context menu.\n If you disable this policy, the shortcut isn't shown.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.showofficeshortcutinfavoritesbar_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showofficeshortcutinfavoritesbar_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showpdfdefaultrecommendationsenabled","displayName":"Allow notifications to set Microsoft Edge as default PDF reader","description":"This policy setting lets you decide whether employees should receive recommendations to set Microsoft Edge as PDF handler.\n\nIf you enable or don't configure this setting, employees receive recommendations from Microsoft Edge to set itself as the default PDF handler.\n\nIf you disable this setting, employees will not receive any notifications from Microsoft Edge to set itself as the default PDF handler.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.showpdfdefaultrecommendationsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showpdfdefaultrecommendationsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showrecommendationsenabled","displayName":"Allow feature recommendations and browser assistance notifications from Microsoft Edge","description":"This setting controls the in-browser assistance notifications which are intended to help users get the most out of Microsoft Edge. This is done by recommending features and by helping them use browser features. These notifications take the form of dialog boxes, flyouts, coach marks and banners in the browser. An example of an assistance notification would be when a user has many tabs opened in the browser. In this instance Microsoft Edge may prompt the user to try out the vertical tabs feature which is designed to give better browser tab management.\n\nDisabling this policy will stop this message from appearing again even if the user has too many tabs open.\n Any features that have been disabled by a management policy are not suggested to users.\nIf you enable or don't configure this setting, users will receive recommendations or notifications from Microsoft Edge.\n If you disable this setting, users will not receive any recommendations or notifications from Microsoft Edge","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.showrecommendationsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showrecommendationsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showtabpreviewenabled","displayName":"Enable tab preview on hover","description":"This policy controls whether Microsoft Edge displays a preview of the tab content when the user hovers over a tab.\n\nIf you enable or don't configure this policy, Microsoft Edge shows a tab preview when the user hovers over a tab.\n\nIf you disable this policy, tab previews will not be shown on hover.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.showtabpreviewenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showtabpreviewenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showtabpreviewenabled_recommended","displayName":"Enable tab preview on hover (users can override)","description":"This policy controls whether Microsoft Edge displays a preview of the tab content when the user hovers over a tab.\n\nIf you enable or don't configure this policy, Microsoft Edge shows a tab preview when the user hovers over a tab.\n\nIf you disable this policy, tab previews will not be shown on hover.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.showtabpreviewenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.showtabpreviewenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.signedhttpexchangeenabled","displayName":"Enable Signed HTTP Exchange (SXG) support","description":"Enable support for Signed HTTP Exchange (SXG).\n\nIf this policy isn't set or enabled, Microsoft Edge will accept web contents served as Signed HTTP Exchanges.\n\nIf this policy is set to disabled, Signed HTTP Exchanges can't be loaded.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.signedhttpexchangeenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.signedhttpexchangeenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabsblockedforurls","displayName":"Block sleeping tabs on specific sites","description":"Define a list of sites, based on URL patterns, that are not allowed to be put to sleep by sleeping tabs. Sites in this list are also excluded from other performance optimizations like efficiency mode and tab discard.\n\nIf the policy \"SleepingTabsEnabled\" is disabled, this list is not used and no sites will be put to sleep automatically.\n\nIf you don't configure this policy, all sites will be eligible to be put to sleep unless the user's personal configuration blocks them.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabsblockedforurls_recommended","displayName":"Block sleeping tabs on specific sites (users can override)","description":"Define a list of sites, based on URL patterns, that are not allowed to be put to sleep by sleeping tabs. Sites in this list are also excluded from other performance optimizations like efficiency mode and tab discard.\n\nIf the policy \"SleepingTabsEnabled\" is disabled, this list is not used and no sites will be put to sleep automatically.\n\nIf you don't configure this policy, all sites will be eligible to be put to sleep unless the user's personal configuration blocks them.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabsenabled","displayName":"Configure sleeping tabs","description":"This policy setting lets you configure whether to turn on sleeping tabs. Sleeping tabs reduces CPU, battery, and memory usage by putting idle background tabs to sleep. Microsoft Edge uses heuristics to avoid putting tabs to sleep that do useful work in the background, such as display notifications, play sound, and stream video. By default, sleeping tabs is turned on.\n\nIndividual sites may be blocked from being put to sleep by configuring the policy \"SleepingTabsBlockedForUrls\".\n\nIf you enable this setting, sleeping tabs is turned on.\n\nIf you disable this setting, sleeping tabs is turned off.\n\nIf you don't configure this setting, users can choose whether to use sleeping tabs.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabsenabled_recommended","displayName":"Configure sleeping tabs (users can override)","description":"This policy setting lets you configure whether to turn on sleeping tabs. Sleeping tabs reduces CPU, battery, and memory usage by putting idle background tabs to sleep. Microsoft Edge uses heuristics to avoid putting tabs to sleep that do useful work in the background, such as display notifications, play sound, and stream video. By default, sleeping tabs is turned on.\n\nIndividual sites may be blocked from being put to sleep by configuring the policy \"SleepingTabsBlockedForUrls\".\n\nIf you enable this setting, sleeping tabs is turned on.\n\nIf you disable this setting, sleeping tabs is turned off.\n\nIf you don't configure this setting, users can choose whether to use sleeping tabs.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabsenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabsenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout","displayName":"Set the background tab inactivity timeout for sleeping tabs","description":"This policy setting lets you configure the timeout, in seconds, after which inactive background tabs will be automatically put to sleep if sleeping tabs is enabled. By default, this timeout is 7,200 seconds (2 hours).\n\nTabs are only put to sleep automatically when the policy \"SleepingTabsEnabled\" is enabled or is not configured and the user has enabled the sleeping tabs setting.\n\nIf you don't configure this policy, users can choose the timeout value.\n\nPolicy options mapping:\n\n* 30Seconds (30) = 30 seconds of inactivity\n\n* 5Minutes (300) = 5 minutes of inactivity\n\n* 15Minutes (900) = 15 minutes of inactivity\n\n* 30Minutes (1800) = 30 minutes of inactivity\n\n* 1Hour (3600) = 1 hour of inactivity\n\n* 2Hours (7200) = 2 hours of inactivity\n\n* 3Hours (10800) = 3 hours of inactivity\n\n* 6Hours (21600) = 6 hours of inactivity\n\n* 12Hours (43200) = 12 hours of inactivity\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_30seconds","displayName":"30 seconds of inactivity","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_5minutes","displayName":"5 minutes of inactivity","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_15minutes","displayName":"15 minutes of inactivity","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_30minutes","displayName":"30 minutes of inactivity","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_1hour","displayName":"1 hour of inactivity","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_2hours","displayName":"2 hours of inactivity","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_3hours","displayName":"3 hours of inactivity","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_6hours","displayName":"6 hours of inactivity","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_12hours","displayName":"12 hours of inactivity","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_recommended","displayName":"Set the background tab inactivity timeout for sleeping tabs (users can override)","description":"This policy setting lets you configure the timeout, in seconds, after which inactive background tabs will be automatically put to sleep if sleeping tabs is enabled. By default, this timeout is 7,200 seconds (2 hours).\n\nTabs are only put to sleep automatically when the policy \"SleepingTabsEnabled\" is enabled or is not configured and the user has enabled the sleeping tabs setting.\n\nIf you don't configure this policy, users can choose the timeout value.\n\nPolicy options mapping:\n\n* 30Seconds (30) = 30 seconds of inactivity\n\n* 5Minutes (300) = 5 minutes of inactivity\n\n* 15Minutes (900) = 15 minutes of inactivity\n\n* 30Minutes (1800) = 30 minutes of inactivity\n\n* 1Hour (3600) = 1 hour of inactivity\n\n* 2Hours (7200) = 2 hours of inactivity\n\n* 3Hours (10800) = 3 hours of inactivity\n\n* 6Hours (21600) = 6 hours of inactivity\n\n* 12Hours (43200) = 12 hours of inactivity\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_recommended_30seconds","displayName":"30 seconds of inactivity","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_recommended_5minutes","displayName":"5 minutes of inactivity","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_recommended_15minutes","displayName":"15 minutes of inactivity","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_recommended_30minutes","displayName":"30 minutes of inactivity","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_recommended_1hour","displayName":"1 hour of inactivity","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_recommended_2hours","displayName":"2 hours of inactivity","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_recommended_3hours","displayName":"3 hours of inactivity","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_recommended_6hours","displayName":"6 hours of inactivity","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sleepingtabstimeout_recommended_12hours","displayName":"12 hours of inactivity","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.smartactionsblocklist","displayName":"Block smart actions for a list of services","description":"List specific services, such as PDFs, and websites that don't show smart actions. (Smart actions are actions like \"define\" which are available in full and mini context menus in Microsoft Edge.)\n\nIf you enable the policy:\n - The smart action in the mini and full context menu is disabled for all profiles for services that match the given list.\n - Users won't see the smart action in the mini and full context menu on text selection for services that match the given list.\n - In Microsoft Edge settings, the smart action in the mini and full context menu is disabled for services that match the given list.\n\nIf you disable or don't configure this policy:\n - The smart action in the mini and full context menu is enabled for all profiles.\n - Users will see the smart action in the mini and full context menu on text selection.\n - In Microsoft Edge settings, the smart action in the mini and full context menu is enabled.\n\nPolicy options mapping:\n\n* smart_actions (smart_actions) = Smart actions in pdfs and on websites\n\n* smart_actions_website (smart_actions_website) = Smart actions on websites\n\n* smart_actions_pdf (smart_actions_pdf) = Smart actions in PDF\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.smartactionsblocklist_smart_actions","displayName":"Smart actions in pdfs and on websites","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.smartactionsblocklist_smart_actions_website","displayName":"Smart actions on websites","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.smartactionsblocklist_smart_actions_pdf","displayName":"Smart actions in PDF","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.smartactionsblocklist_recommended","displayName":"Block smart actions for a list of services (users can override)","description":"List specific services, such as PDFs, and websites that don't show smart actions. (Smart actions are actions like \"define\" which are available in full and mini context menus in Microsoft Edge.)\n\nIf you enable the policy:\n - The smart action in the mini and full context menu is disabled for all profiles for services that match the given list.\n - Users won't see the smart action in the mini and full context menu on text selection for services that match the given list.\n - In Microsoft Edge settings, the smart action in the mini and full context menu is disabled for services that match the given list.\n\nIf you disable or don't configure this policy:\n - The smart action in the mini and full context menu is enabled for all profiles.\n - Users will see the smart action in the mini and full context menu on text selection.\n - In Microsoft Edge settings, the smart action in the mini and full context menu is enabled.\n\nPolicy options mapping:\n\n* smart_actions (smart_actions) = Smart actions in pdfs and on websites\n\n* smart_actions_website (smart_actions_website) = Smart actions on websites\n\n* smart_actions_pdf (smart_actions_pdf) = Smart actions in PDF\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.smartactionsblocklist_recommended_smart_actions","displayName":"Smart actions in pdfs and on websites","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.smartactionsblocklist_recommended_smart_actions_website","displayName":"Smart actions on websites","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.smartactionsblocklist_recommended_smart_actions_pdf","displayName":"Smart actions in PDF","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.smartscreenallowlistdomains","displayName":"Configure the list of domains for which Microsoft Defender SmartScreen won't trigger warnings","description":"Configure the list of Microsoft Defender SmartScreen trusted domains. This means:\nMicrosoft Defender SmartScreen won't check for potentially malicious resources like phishing software and other malware if the source URLs match these domains.\nThe Microsoft Defender SmartScreen download protection service won't check downloads hosted on these domains.\n\nIf you enable this policy, Microsoft Defender SmartScreen trusts these domains.\nIf you disable or don't set this policy, default Microsoft Defender SmartScreen protection is applied to all resources.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10/11 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.\nNote: If your organization has enabled Microsoft Defender for Endpoint, this policy and any allow list created with it will be ignored. You must configure your allow and block lists in Microsoft 365 Defender portal using Indicators (Settings > Endpoints > Indicators).","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.smartscreenfortrusteddownloadsenabled","displayName":"Force Microsoft Defender SmartScreen checks on downloads from trusted sources","description":"This policy setting lets you configure whether Microsoft Defender SmartScreen checks download reputation from a trusted source.\n\nIn Windows, the policy determines a trusted source by checking its Internet zone. If the source comes from the local system, intranet, or trusted sites zone, then the download is considered trusted and safe.\n\nIf you enable or don't configure this setting, Microsoft Defender SmartScreen checks the download's reputation regardless of source.\n\nIf you disable this setting, Microsoft Defender SmartScreen doesn't check the download's reputation when downloading from a trusted source.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.smartscreenfortrusteddownloadsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.smartscreenfortrusteddownloadsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.smartscreenfortrusteddownloadsenabled_recommended","displayName":"Force Microsoft Defender SmartScreen checks on downloads from trusted sources (users can override)","description":"This policy setting lets you configure whether Microsoft Defender SmartScreen checks download reputation from a trusted source.\n\nIn Windows, the policy determines a trusted source by checking its Internet zone. If the source comes from the local system, intranet, or trusted sites zone, then the download is considered trusted and safe.\n\nIf you enable or don't configure this setting, Microsoft Defender SmartScreen checks the download's reputation regardless of source.\n\nIf you disable this setting, Microsoft Defender SmartScreen doesn't check the download's reputation when downloading from a trusted source.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.smartscreenfortrusteddownloadsenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.smartscreenfortrusteddownloadsenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.speechrecognitionenabled","displayName":"Configure Speech Recognition","description":"Set whether websites can use the W3C Web Speech API to recognize speech from the user. The Microsoft Edge implementation of the Web Speech API uses Azure Cognitive Services, so voice data will leave the machine.\n\nIf you enable or don't configure this policy, web-based applications that use the Web Speech API can use Speech Recognition.\n\nIf you disable this policy, Speech Recognition is not available through the Web Speech API.\n\nRead more about this feature here:\nSpeechRecognition API: https://go.microsoft.com/fwlink/?linkid=2143388\nCognitive Services: https://go.microsoft.com/fwlink/?linkid=2143680","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.speechrecognitionenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.speechrecognitionenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.spellcheckenabled","displayName":"Enable spellcheck","description":"If you enable or don't configure this policy, the user can use spellcheck.\n\nIf you disable this policy, the user can't use spellcheck and the \"SpellcheckLanguage\" and \"SpellcheckLanguageBlocklist\" policies are also disabled.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.spellcheckenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.spellcheckenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.spellchecklanguage","displayName":"Enable specific spellcheck languages","description":"Enables different languages for spellcheck. Any language that you specify that isn't recognized is ignored.\n\nIf you enable this policy, spellcheck is enabled for the languages specified, as well as any languages the user has enabled.\n\nIf you don't configure or disable this policy, there's no change to the user's spellcheck preferences.\n\nIf the \"SpellcheckEnabled\" policy is disabled, this policy will have no effect.\n\nIf a language is included in both the 'SpellcheckLanguage' and the \"SpellcheckLanguageBlocklist\" policy, the spellcheck language is enabled.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.spellchecklanguageblocklist","displayName":"Force disable spellcheck languages","description":"Force-disables spellcheck languages. Unrecognized languages in that list will be ignored.\n\nIf you enable this policy, spellcheck will be disabled for the languages specified. The user can still enable or disable spellcheck for languages not in the list.\n\nIf you do not set this policy, or disable it, there will be no change to the user's spellcheck preferences.\n\nIf the \"SpellcheckEnabled\" policy is set to disabled, this policy will have no effect.\n\nIf a language is included in both the \"SpellcheckLanguage\" and the 'SpellcheckLanguageBlocklist' policy, the spellcheck language is enabled.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sslerroroverrideallowed","displayName":"Allow users to proceed from the HTTPS warning page","description":"Microsoft Edge shows a warning page when users visit sites that have SSL errors.\n\nIf you enable or don't configure (default) this policy, users can click through these warning pages.\n\nIf you disable this policy, users are blocked from clicking through any warning page.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.sslerroroverrideallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sslerroroverrideallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.sslerroroverrideallowedfororigins","displayName":"Allow users to proceed from the HTTPS warning page for specific origins","description":"Microsoft Edge shows a warning page when users visit sites that have SSL errors.\n\nIf you enable or don't configure the \"SSLErrorOverrideAllowed\" policy, this policy does nothing.\n\nIf you disable the \"SSLErrorOverrideAllowed\" policy, configuring this policy lets you configure a list of origin patterns for sites where users can continue to click through SSL error pages. Users can't click through SSL error pages on origins that are not on this list.\n\nIf you don't configure this policy, the \"SSLErrorOverrideAllowed\" policy applies for all sites.\n\nFor detailed information about valid origin patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy. This policy only matches based on origin, so any path or query in the URL pattern is ignored.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.staticstoragequotaenabled","displayName":"Control whether storage quota APIs will return static values","description":"Controls how the Storage Quota APIs report the available quota to websites.\n\nWhen enabled, the Storage Quota APIs return a static quota value equal to the current usage plus the smaller of 10 GiB or the device's total storage rounded up to the nearest 1 GiB.\n\nWhen disabled, the Storage Quota APIs return a dynamic quota value that reflects the actual available device storage.\n\nWhen unset, the browser uses the default platform behavior.\n\nThis policy does not affect sites with unlimited storage permissions or enforced quota settings.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.staticstoragequotaenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.staticstoragequotaenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.strictermixedcontenttreatmentenabled","displayName":"Enable stricter treatment for mixed content (Obsolete)","description":"This policy doesn't work because it was only intended to be a short-term mechanism to give enterprises more time to update their web content if it was found to be incompatible with stricter mixed content treatment.\n\nThis policy controls the treatment for mixed content (HTTP content in HTTPS sites) in the browser.\n\nIf you set this policy to true or not set, audio and video mixed content is automatically upgraded to HTTPS (that is, the URL will be rewritten as HTTPS, without a fallback if the resource isn't available over HTTPS), and a 'Not Secure' warning is shown in the URL bar for image mixed content.\n\nIf you set the policy to false, auto upgrades are disabled for audio and video, and no warning is shown for images.\n\nThis policy doesn't affect other types of mixed content other than audio, video, and images.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.strictermixedcontenttreatmentenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.strictermixedcontenttreatmentenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.superdragdropenabled","displayName":"Super Drag Drop Enabled","description":"This policy lets you configure the Super Drag Drop feature in Microsoft Edge.\n\nWith this feature, users can drag a link or text from a webpage and drop it onto the same page. They can then either open the URL in a new tab or search the text using the default search engine.\n\nIf you enable or don't configure this policy, you can use the Super Drag Drop feature on Microsoft Edge.\n\nIf you disable this policy, you can't use the Super Drag Drop feature in Microsoft Edge.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.superdragdropenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.superdragdropenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.syncdisabled","displayName":"Disable synchronization of data using Microsoft sync services","description":"Disables data synchronization in Microsoft Edge. This policy also prevents the sync consent prompt from appearing.\n\nThis policy disables cloud synchronization only and has no impact on the \"RoamingProfileSupportEnabled\" policy.\n\nIf you don't set this policy or apply it as recommended, users can turn on or turn off sync. If you apply this policy as mandatory, users won't be able to turn on sync.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.syncdisabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.syncdisabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.syncdisabled_recommended","displayName":"Disable synchronization of data using Microsoft sync services (users can override)","description":"Disables data synchronization in Microsoft Edge. This policy also prevents the sync consent prompt from appearing.\n\nThis policy disables cloud synchronization only and has no impact on the \"RoamingProfileSupportEnabled\" policy.\n\nIf you don't set this policy or apply it as recommended, users can turn on or turn off sync. If you apply this policy as mandatory, users won't be able to turn on sync.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.syncdisabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.syncdisabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.synctypeslistdisabled","displayName":"Configure the list of types that are excluded from synchronization","description":"If you enable this policy all the specified data types will be excluded from synchronization. This policy can be used to limit the type of data uploaded to the Microsoft Edge synchronization service.\n\nYou can provide one of the following data types for this policy: \"favorites\", \"settings\", \"passwords\", \"addressesAndMore\", \"extensions\", \"history\", \"openTabs\", \"edgeWallet\", \"collections\", \"apps\", and \"edgeFeatureUsage\". The \"edgeFeatureUsage\" data type will be supported starting in Microsoft Edge version 134. Note that these data type names are case sensitive.\n\nUsers will not be able to override the disabled data types.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.tabcaptureallowedbyorigins","displayName":"Allow Tab capture by these origins","description":"Setting the policy lets you set a list of URL patterns that can use Tab Capture.\n\nLeaving the policy unset means that sites will not be considered for an override at this scope of capture.\n\nThis policy is not considered if a site matches a URL pattern in the \"SameOriginTabCaptureAllowedByOrigins\" policy.\n\nIf a site matches a URL pattern in this policy, the following policies will not be considered: \"WindowCaptureAllowedByOrigins\", \"ScreenCaptureAllowedByOrigins\", \"ScreenCaptureAllowed\".\n\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. This policy only matches based on origin, so any path in the URL pattern is ignored.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.tabservicesenabled","displayName":"Enable tab organization suggestions","description":"This policy controls whether Microsoft Edge can use its tab organization service to help name or suggest tab groups to increase productivity.\n\nIf you enable or don't configure this policy, when a user creates a tab group or activates certain \"Group Similar Tabs\" features Microsoft Edge sends tab data to its tab organization service. This data includes URLs, page titles, and existing group information. The service uses this data to return suggestions for better groupings and group names.\n\nIf you disable this policy, no data will be sent to the tab organization service. Microsoft Edge won't suggest group names when a group is created and certain \"Group Similar Tabs\" features that rely on the service won't be available.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.tabservicesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.tabservicesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.textpredictionenabled","displayName":"Text prediction enabled by default","description":"The Microsoft Turing service uses natural language processing to generate predictions for long-form editable text fields on web pages.\n\nIf you enable or don't configure this policy, text predictions are provided for eligible text fields.\n\nIf you disable this policy, text predictions aren't provided in eligible text fields. Sites may still provide their own text predictions.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.textpredictionenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.textpredictionenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.thirdpartystoragepartitioningblockedfororigins","displayName":"Disable third-party storage partitioning for specific top-level origins (Deprecated)","description":"This policy lets you set a list of URL patterns that specify top-level origins for which third-party storage partitioning (partitioning of cross-origin iframe storage) should be disabled.\n\nIf this policy isn't set or a top-level origin doesn't match one of the URL patterns, then the value from \"DefaultThirdPartyStoragePartitioningSetting\" will be used.\n\nNote that the patterns you list are treated as origins, not URLs, so you shouldn't specify a path. For detailed information about valid origin patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.\n\nThis feature will be removed starting in Microsoft Edge version 145. To ensure compatibility, use the requestStorageAccess method instead. For more information, see https://developer.mozilla.org/en-US/docs/Web/API/Document/requestStorageAccess.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.tls13hardeningforlocalanchorsenabled","displayName":"Enable a TLS 1.3 security feature for local trust anchors (Obsolete)","description":"This policy doesn't work because it was only intended to be a short-term mechanism to give enterprises more time to upgrade affected proxies.\n\nThis policy controls a security feature in TLS 1.3 that protects connections against downgrade attacks. It is backwards-compatible and will not affect connections to compliant TLS 1.2 servers or proxies. However, older versions of some TLS-intercepting proxies have an implementation flaw which causes them to be incompatible.\n\nIf you enable this policy or don't set it, Microsoft Edge will enable these security protections for all connections.\n\nIf you disable this policy, Microsoft Edge will disable these security protections for connections authenticated with locally-installed CA certificates. These protections are always enabled for connections authenticated with publicly-trusted CA certificates.\n\nThis policy can be used to test for any affected proxies and upgrade them. Affected proxies are expected to fail connections with an error code of ERR_TLS13_DOWNGRADE_DETECTED.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.tls13hardeningforlocalanchorsenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.tls13hardeningforlocalanchorsenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.trackingprevention","displayName":"Block tracking of users' web-browsing activity","description":"Lets you decide whether to block websites from tracking users' web-browsing activity.\n\nIf you disable this policy or don't configure it, users can set their own level of tracking prevention.\n\nPolicy options mapping:\n\n* TrackingPreventionOff (0) = Off (no tracking prevention)\n\n* TrackingPreventionBasic (1) = Basic (blocks harmful trackers, content and ads will be personalized)\n\n* TrackingPreventionBalanced (2) = Balanced (blocks harmful trackers and trackers from sites user has not visited; content and ads will be less personalized)\n\n* TrackingPreventionStrict (3) = Strict (blocks harmful trackers and majority of trackers from all sites; content and ads will have minimal personalization. Some parts of sites might not work)\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.trackingprevention_trackingpreventionoff","displayName":"Off (no tracking prevention)","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.trackingprevention_trackingpreventionbasic","displayName":"Basic (blocks harmful trackers, content and ads will be personalized)","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.trackingprevention_trackingpreventionbalanced","displayName":"Balanced (blocks harmful trackers and trackers from sites user has not visited; content and ads will be less personalized)","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.trackingprevention_trackingpreventionstrict","displayName":"Strict (blocks harmful trackers and majority of trackers from all sites; content and ads will have minimal personalization. Some parts of sites might not work)","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.translateenabled","displayName":"Enable Translate","description":"Enables the integrated Microsoft translation service on Microsoft Edge.\n\nIf you enable this policy, Microsoft Edge offers to translate a webpage by showing an integrated translate flyout when the language detected on a webpage isn't listed under preferred languages. A translate option is available on the right-click context menu.\n\nUsers can also translate selected text on a webpage via the right-click context menu, or on a PDF via the PDF toolbar and the right-click context menu.\n\nIf you don't configure this policy, the policy is enabled by default. Users can choose whether to use the translation functionality or not.\n\nYou can disable this policy to disable all built-in translate features.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.translateenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.translateenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.translateenabled_recommended","displayName":"Enable Translate (users can override)","description":"Enables the integrated Microsoft translation service on Microsoft Edge.\n\nIf you enable this policy, Microsoft Edge offers to translate a webpage by showing an integrated translate flyout when the language detected on a webpage isn't listed under preferred languages. A translate option is available on the right-click context menu.\n\nUsers can also translate selected text on a webpage via the right-click context menu, or on a PDF via the PDF toolbar and the right-click context menu.\n\nIf you don't configure this policy, the policy is enabled by default. Users can choose whether to use the translation functionality or not.\n\nYou can disable this policy to disable all built-in translate features.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.translateenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.translateenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.travelassistanceenabled","displayName":"Enable travel assistance (Obsolete)","description":"This policy is obsolete as the feature is now contained within the Edge Sidebar and can be managed using the \"HubsSidebarEnabled\" policy. It doesn't work in Microsoft Edge after version 105.\nConfigure this policy to allow/disallow travel assistance.\n\nThe travel assistance feature gives helpful and relevant information to a user who performs a travel-related task within the browser. This feature provides trusted and validated suggestions/information to the users from across sources gathered by Microsoft.\n\nIf you enable or don't configure this setting, travel assistance is enabled for the users when they are performing travel-related tasks.\n\nIf you disable this setting, travel assistance will be disabled, and users won't be able to see any travel-related recommendations.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.travelassistanceenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.travelassistanceenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.travelassistanceenabled_recommended","displayName":"Enable travel assistance (Obsolete) (users can override)","description":"This policy is obsolete as the feature is now contained within the Edge Sidebar and can be managed using the \"HubsSidebarEnabled\" policy. It doesn't work in Microsoft Edge after version 105.\nConfigure this policy to allow/disallow travel assistance.\n\nThe travel assistance feature gives helpful and relevant information to a user who performs a travel-related task within the browser. This feature provides trusted and validated suggestions/information to the users from across sources gathered by Microsoft.\n\nIf you enable or don't configure this setting, travel assistance is enabled for the users when they are performing travel-related tasks.\n\nIf you disable this setting, travel assistance will be disabled, and users won't be able to see any travel-related recommendations.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.travelassistanceenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.travelassistanceenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.typosquattingallowlistdomains","displayName":"Configure the list of domains for which Edge Website Typo Protection won't trigger warnings","description":"Configure the list of Edge Website Typo Protection trusted domains. This means:\nEdge Website Typo Protection won't check for potentially malicious typosquatting websites.\n\nIf you enable this policy, Edge Website Typo Protection trusts these domains.\nIf you disable or don't set this policy, default Edge Website Typo Protection protection is applied to all resources.\n\nThis will only take effect when TyposquattingCheckerEnabled policy is not set or set to enabled.\n\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10/11 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.\nAlso note that this policy does not apply if your organization has enabled Microsoft Defender for Endpoint. You must configure your allow and block lists in Microsoft 365 Defender portal using Indicators (Settings > Endpoints > Indicators).","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.u2fsecuritykeyapienabled","displayName":"Allow using the deprecated U2F Security Key API (Obsolete)","description":"This policy is obsolete because it was intended to be a short-term mechanism to give enterprises more time to update their web content when it's found to be incompatible with the change to remove the U2F Security Key API. It doesn't work in Microsoft Edge after version 103.\n\nIf you enable this policy, the deprecated U2F Security Key API can be used and the deprecation reminder prompt shown for U2F API requests is suppressed.\n\nIf you disable this policy or don't configure it, the U2F Security Key API is disabled by default and can only be used by sites that register for and use the U2FSecurityKeyAPI origin trial which ended after Microsoft Edge version 103.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.u2fsecuritykeyapienabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.u2fsecuritykeyapienabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.unthrottlednestedtimeoutenabled","displayName":"JavaScript setTimeout will not be clamped until a higher nesting threshold is set (Deprecated)","description":"This policy is deprecated because it is a temporary policy for web standards compliance. It won't work in Microsoft Edge as soon as version 107.\nIf you enable this policy, the JavaScript setTimeout and setInterval, with an interval smaller than 4ms, will not be clamped. This improves short horizon performance, but websites abusing the API will still eventually have their setTimeout usages clamped.\nIf you disable or don't configure policy, the JavaScript setTimeout and setInterval, with an interval smaller than 4ms, will be clamped.\n\nThis is a web standards compliancy feature that may change task ordering on a web page, leading to unexpected behavior on sites that are dependent on a certain ordering.\nIt also may affect sites with a lot of usage of a timeout of 0ms for setTimeout. For example, increasing CPU load.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.unthrottlednestedtimeoutenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.unthrottlednestedtimeoutenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.uploadfromphoneenabled","displayName":"Enable upload files from mobile in Microsoft Edge desktop","description":"This policy lets you configure the \"Upload from mobile\" feature in Microsoft Edge.\n\nUpload from mobile lets users select file from mobile devices to desktop when user upload file in a webpage in Microsoft Edge.\n\nIf you enable or don't configure this policy, you can use the Upload from mobile feature in Microsoft Edge.\n\nIf you disable this policy, you can't use the Upload from mobile feature in Microsoft Edge.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.uploadfromphoneenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.uploadfromphoneenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.urlallowlist","displayName":"Define a list of allowed URLs","description":"Setting the policy provides access to the listed URLs, as exceptions to \"URLBlocklist\".\n\nFormat the URL pattern according to https://go.microsoft.com/fwlink/?linkid=2095322.\n\nYou can use this policy to open exceptions to restrictive block lists. For example, you can include '*' in the block list to block all requests, and then use this policy to allow access to a limited list of URLs. You can use this policy to open exceptions to certain schemes, subdomains of other domains, ports, or specific paths.\n\nThe most specific filter determines if a URL is blocked or allowed. The allowed list takes precedence over the block list.\n\nThis policy is limited to 1000 entries; subsequent entries are ignored.\n\nThis policy also allows the browser to automatically invoke external applications registered as protocol handlers for protocols like \"tel:\" or \"ssh:\".\n\nIf you don't configure this policy, there are no exceptions to the block list in the \"URLBlocklist\" policy.\n\nThis policy does not work as expected with file://* wildcards.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.urlblocklist","displayName":"Block access to a list of URLs","description":"Define a list of sites, based on URL patterns, that are blocked (your users can't load them).\n\nFormat the URL pattern according to https://go.microsoft.com/fwlink/?linkid=2095322.\n\nYou can define exceptions in the \"URLAllowlist\" policy. These policies are limited to 1000 entries; subsequent entries are ignored.\n\nNote that blocking internal 'edge://*' URLs isn't recommended - this may lead to unexpected errors.\n\nThis policy doesn't prevent the page from updating dynamically through JavaScript. For example, if you block 'contoso.com/abc', users might still be able to visit 'contoso.com' and click on a link to visit 'contoso.com/abc', as long as the page doesn't refresh.\n\nIf you don't configure this policy, no URLs are blocked.\n\nThis policy does not work as expected with file://* wildcards.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.useragentreduction","displayName":"Enable or disable the User-Agent Reduction (Obsolete)","description":"The User-Agent HTTP request header has been reduced by default since Microsoft Edge version 119. To continue receiving detailed platform information, migrate to User-Agent Client Hints, which replace the deprecated detailed User-Agent header. For more information, visit: https://web.dev/articles/migrate-to-ua-ch\n\nIf you don't configure this policy or set it to Default, the User-Agent header will be reduced and controlled by experimentation.\n\nSet this policy to 'ForceEnabled' to force the reduced version of the User-Agent request header for all origins.\n\nSet this policy to 'ForceDisabled' to always use the full (legacy) User-Agent header.\n\nTo learn more about the User-Agent string, read here:\n\nhttps://go.microsoft.com/fwlink/?linkid=2186267\n\nPolicy options mapping:\n\n* Default (0) = Reduced User Agent, or controlled by experimentation.\n\n* ForceDisabled (1) = Full (legacy) User Agent.\n\n* ForceEnabled (2) = Reduced User Agent.\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.useragentreduction_default","displayName":"Reduced User Agent, or controlled by experimentation.","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.useragentreduction_forcedisabled","displayName":"Full (legacy) User Agent.","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.useragentreduction_forceenabled","displayName":"Reduced User Agent.","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.usesystemprintdialog","displayName":"Print using system print dialog","description":"Shows the system print dialog instead of print preview.\n\nIf you enable this policy, Microsoft Edge opens the system print dialog instead of the built-in print preview when a user prints a page.\n\nIf you don't configure or disable this policy, print commands trigger the Microsoft Edge print preview screen.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.usesystemprintdialog_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.usesystemprintdialog_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.verticaltabsallowed","displayName":"Configures availability of a vertical layout for tabs on the side of the browser","description":"Configures whether a user can access an alternative layout where tabs are vertically aligned on the side of the browser instead of at the top.\nWhen there are several tabs open, this layout provides better tab viewing and management. There's better visibility of the site titles,\nit's easier to scan aligned icons, and there's more space to manage and close tabs.\n\nIf you disable this policy, then the vertical tab layout will not be available as an option for users.\n\nIf you enable or don't configure this policy, the tab layout will still be at the top, but a user has the option to turn on vertical tabs on the side.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.verticaltabsallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.verticaltabsallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.videocaptureallowed","displayName":"Allow or block video capture","description":"Control whether sites can capture video.\n\nIf enabled or not configured (default), the user will be asked about video capture access for all sites except those with URLs configured in the \"VideoCaptureAllowedUrls\" policy list, which will be granted access without prompting.\n\nIf you disable this policy, the user isn't prompted, and video capture is only available to URLs configured in \"VideoCaptureAllowedUrls\" policy.\n\nThis policy affects all types of video inputs, not only the built-in camera.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.videocaptureallowed_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.videocaptureallowed_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.videocaptureallowedurls","displayName":"Sites that can access video capture devices without requesting permission","description":"Specify websites, based on URL patterns, that can use video capture devices without asking the user for permission. Patterns in this list are matched against the security origin of the requesting URL. If they match, the site is automatically granted access to video capture devices. However, the pattern \"*\", which matches any URL, isn't supported by this policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.viewxfapdfiniemodeallowedfilehash","displayName":"View XFA-based PDF files using IE Mode for allowed file hash.","description":"XFA is a legacy technology that's deprecated by its original creators. It's not an ISO standard and as such, it doesn't align with the modern web architecture. Continued use poses potential risks and vulnerabilities. For more information, see \"ViewXFAPDFInIEModeAllowedOrigins\".\n\nIf you enable this policy, you can configure the list of base64 encoded SHA256 file hashes for which XFA PDF files automatically open in Microsoft Edge using IE Mode.\n\nIf you disable or don't configure this policy, XFA PDFs won't be considered for opening via IE mode except the files from file origin mentioned in Policy \"ViewXFAPDFInIEModeAllowedOrigins\"\n\nFor more information, see - [Get-FileHash](https://go.microsoft.com/fwlink/?linkid=2294823), [Dot Net Convert API](https://go.microsoft.com/fwlink/?linkid=2294913).","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.viewxfapdfiniemodeallowedorigins","displayName":"View XFA-based PDF files using IE Mode for allowed file origin.","description":"Internet Explorer (IE) mode uses the Adobe Acrobat Active-X PDF Plugin to open XFA-based PDF files. This policy works only if the Active-X plugin is already on the user's device, it's not installed as part of this policy.\n\nIt's important to note that XFA is a legacy technology that's deprecated by its original creators. It's not an ISO standard and as such doesn't align with the modern web architecture. Continued use poses potential risks and vulnerabilities.\n\nGiven the deprecated status of XFA technology and the lack of any investment by its creators, we strongly recommend that you start planning your transition to more advanced HTML\\PDF form-based solutions.\n\nIn the interim, this policy provides a workaround for users to view XFA PDF in Microsoft Edge.\n\nIf you enable this policy, you can configure the list of origins from which XFA PDF files will be automatically opened in Microsoft Edge using IE Mode.\n\nIf you disable or don't configure the policy, XFA PDFs won't be considered for opening via Internet Explorer mode.\n\nFor detailed information on valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322\n\nAlternatively, \"ViewXFAPDFInIEModeAllowedFileHash\" can also be used to configure list of file hashes instead of URL origins, which enables those files to be automatically opened in Microsoft Edge using IE Mode.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.visualsearchenabled","displayName":"Visual search enabled","description":"Visual search lets you quickly explore more related content about entities in an image.\n\nIf you enable or don't configure this policy, visual search will be enabled via image hover, context menu, and search in sidebar.\n\nIf you disable this policy, visual search will be disabled and you won't be able to get more info about images via hover, context menu, and search in sidebar.\n\nNote: Visual Search in Web Capture is still managed by \"WebCaptureEnabled\" policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.visualsearchenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.visualsearchenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.visualsearchenabled_recommended","displayName":"Visual search enabled (users can override)","description":"Visual search lets you quickly explore more related content about entities in an image.\n\nIf you enable or don't configure this policy, visual search will be enabled via image hover, context menu, and search in sidebar.\n\nIf you disable this policy, visual search will be disabled and you won't be able to get more info about images via hover, context menu, and search in sidebar.\n\nNote: Visual Search in Web Capture is still managed by \"WebCaptureEnabled\" policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.visualsearchenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.visualsearchenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.walletdonationenabled","displayName":"Wallet Donation Enabled","description":"The Wallet Donation feature in Microsoft Edge allows users to view their donation summary, explore Nonprofit organizations (NPOs), donate to an NPO, manage their monthly donations, and view their donation history.\n\nIf you enable or don't configure this policy, users can use the Wallet Donation feature.\n\nIf you disable this policy, users can't use the Wallet Donation feature.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.walletdonationenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.walletdonationenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.walletdonationenabled_recommended","displayName":"Wallet Donation Enabled (users can override)","description":"The Wallet Donation feature in Microsoft Edge allows users to view their donation summary, explore Nonprofit organizations (NPOs), donate to an NPO, manage their monthly donations, and view their donation history.\n\nIf you enable or don't configure this policy, users can use the Wallet Donation feature.\n\nIf you disable this policy, users can't use the Wallet Donation feature.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.walletdonationenabled_recommended_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.walletdonationenabled_recommended_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webappinstallbyuserenabled","displayName":"Enable User Web App Install From Browser","description":"This policy controls whether users can install web apps through Microsoft Edge.\nIf you enable or don’t configure this policy, users can install web apps through the browser.\nIf you disable this policy, users can’t install web apps through the browser, and the \"apps\" data type is excluded from synchronization.\nThis policy doesn't support dynamic refresh. Changes to this policy, whether enabled, disabled, or not configured, take effect only after the browser is restarted.\nThis policy doesn't affect the 'WebAppInstallForceList' policy. Web apps specified by that policy are installed regardless of this policy setting.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.webappinstallbyuserenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webappinstallbyuserenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webappinstallforcelist","displayName":"Configure list of force-installed Web Apps","description":"Setting the policy specifies a list of web apps that install silently, without user interaction. Users can't turn off the policy or uninstall these web apps.\n\nEach list item of the policy is an object with a mandatory member:\nurl (the URL of the web app to install)\n\nand 6 optional members:\n- default_launch_container\n(for how the web app opens—a new tab is the default)\n\n- create_desktop_shortcut\n(True if you want to create Linux and\nMicrosoft Windows desktop shortcuts).\n\n- fallback_app_name\n(Starting with Microsoft Edge version 90,\nlets you permanently override the app name if it is not a Progressive Web App (PWA)\nor temporarily override the app name if authentication is required before\ninstallation can be completed. If both\ncustom_name and\nfallback_app_name are provided,\nthe latter will be ignored.)\n\n- custom_name\n(Starting with Microsoft Edge version 112\non all desktop platforms, lets you permanently override the app name for all\nweb apps and PWAs.)\n\n- custom_icon\n(Starting with Microsoft Edge version 112\non all desktop platforms, lets you to override the app icon of installed apps.\nThe icons have to be square, maximal 1 MB in size, and in one of the following formats:\njpeg, png, gif, webp, ico. The hash value has to be the SHA256 hash of the icon file.\nThe url should be accessible without authentication to\nensure the icon can be used upon app installation.)\n\n- install_as_shortcut\n(Starting with Microsoft Edge\nversion 107). If enabled, the given url will be installed as a shortcut,\nas if done via the \"Create Shortcut...\" option in the desktop browser GUI.\nNote that when installed as a shortcut it won't be updated if the manifest in url changes.\nIf disabled or unset, the web app at the given url will be installed normally.\n(This is not currently supported in Microsoft Edge.)\n\nThe 'WebAppInstallByUserEnabled' policy doesn't affect this policy. Web apps specified by this policy are installed regardless of the 'WebAppInstallByUserEnabled' policy setting.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webappsettings","displayName":"Web App management settings","description":"This policy allows an admin to specify settings for installed web apps. This policy maps a Web App ID to its specific setting. A default configuration can be set using the special ID *, which applies to all web apps without a custom configuration in this policy.\n\n- The manifest_id field is the Manifest ID for the Web App.\nSee https://developer.chrome.com/blog/pwa-manifest-id/\nfor instructions on how to determine the Manifest ID for an installed web app.\n- The run_on_os_login field specifies if a web app can be run during OS login.\nIf this field is set to blocked, the web app will not run during OS login and the user will not be able to enable this later.\nIf this field is set to run_windowed, the web app will run during OS login and the user won't be able to disable this later.\nIf this field is set to allowed, the user will be able to configure the web app to run at OS login.\nThe default policy configuration only allows the allowed and blocked values.\n- (Starting with Microsoft Edge version 120) The prevent_close_after_run_on_os_login field specifies if a web app can be prevented from closing in any way.\nFor example, by the user, by task manager, or by web APIs. This behavior can only be enabled if run_on_os_login is set to run_windowed.\nIf the app is already running, this setting will only take effect after the app is restarted.\nIf this field isn't defined, users can close the app.\n(This is currently not supported in Microsoft Edge.)\n- (Since version 118) The force_unregister_os_integration field specifies if all OS integration for a web app, that is, shortcuts, file handlers, protocol handlers and so on will be removed or not.\nIf an app is already running, this property will come into effect after the app restarts.\nThis should be used with caution, since it can override any OS integration that is set automatically during the startup of the web applications system. This currently only works on Windows, Mac and Linux platforms.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webaudiooutputbufferingenabled","displayName":"Enable adaptive buffering for Web Audio","description":"This policy determines whether the browser enables adaptive buffering\nfor Web Audio. Adaptive buffering can reduce audio glitches but may\nincrease latency to varying degrees.\n\nEnabled: The browser will always use adaptive buffering.\nDisabled or Not Set: The browser will automatically decide during the\n feature launch process whether to use adaptive buffering.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.webaudiooutputbufferingenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webaudiooutputbufferingenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webauthenticationremotedesktopallowedorigins","displayName":"Allowed Origins for Proxied WebAuthn Requests from Remote Desktop Applications.","description":"This policy defines a list of allowed HTTPS origins for remote desktop client applications that initiate WebAuthn API requests from a browsing session on a remote host.\n\nOrigins specified in this policy can request WebAuthn authentication for Relying Party IDs (RP IDs) they would not typically be authorized to claim.\n\nOnly HTTPS origins are supported. Wildcards are not permitted. Entries that do not\nmeet these requirements will be ignored.\n\nFor more information about the WebAuthn Remote Desktop Support feature, please see https://github.com/w3c/webauthn/wiki/Explainer:-Remote-Desktop-Support/a4e158c569f456c759d0ddd294a9015bd4d4eb9a.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webcomponentsv0enabled","displayName":"Re-enable Web Components v0 API until M84 (Obsolete)","description":"This policy doesn't work because this policy allowed these features to be selectively re-enabled until Microsoft Edge version 85. The Web Components v0 APIs (Shadow DOM v0, Custom Elements v0, and HTML Imports) were deprecated in 2018, and have been disabled by default starting in Microsoft Edge version 80.\n\nIf you set this policy is set to True, the Web Components v0 features will be enabled for all sites.\n\nIf you set this policy to False or don't set this policy, the Web Components v0 features will be disabled by default, starting in Microsoft Edge version 80.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.webcomponentsv0enabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webcomponentsv0enabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webhidaskforurls","displayName":"Allow the WebHID API on these sites","description":"Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them access to a HID device.\n\nLeaving the policy unset means \"DefaultWebHidGuardSetting\" applies for all sites, if it's set. If not, users' personal settings apply.\n\nFor URL patterns that don't match the policy, the following values are applied in order of precedence:\n\n * \"WebHidBlockedForUrls\" (if there is a match),\n\n * \"DefaultWebHidGuardSetting\" (if set), or\n\n * Users' personal settings.\n\nURL patterns must not conflict with \"WebHidBlockedForUrls\". Neither policy takes precedence if a URL matches both patterns.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webhidblockedforurls","displayName":"Block the WebHID API on these sites","description":"Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them access to a HID device.\n\nLeaving the policy unset means \"DefaultWebHidGuardSetting\" applies for all sites, if it's set. If not, users' personal settings apply.\n\nFor URL patterns that don't match the policy, the following values are applied in order of precedence:\n\n * \"WebHidAskForUrls\" (if there is a match),\n\n * \"DefaultWebHidGuardSetting\" (if set), or\n\n * Users' personal settings.\n\nURL patterns can't conflict with \"WebHidAskForUrls\". Neither policy takes precedence if a URL matches both patterns.\n\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webrtciphandlingurl","displayName":"WebRTC IP Handling Policy for URL Patterns","description":"Controls which IP addresses and network interfaces WebRTC can use\nwhen establishing connections for specific URL patterns.\n\nHow It Works:\nAccepts a list of URL patterns, each paired with a handling type.\nWebRTC evaluates patterns sequentially; the first match determines the handling type.\nIf no match is found, WebRTC defaults to the WebRtcLocalhostIpHandling WebRtcLocalhostIpHandling. policy.\nThis policy applies only to origins—URL path components are ignored.\nWildcards (*) are supported in URL patterns.\n\nSupported Handling Values:\ndefault – Uses all available network interfaces.\ndefault_public_and_private_interfaces – WebRTC uses all public and private interfaces.\ndefault_public_interface_only – WebRTC uses only public interfaces.\ndisable_non_proxied_udp – WebRTC uses UDP SOCKS proxying or falls back to TCP proxying.\n\nMore Information:\nValid input patterns: https://go.microsoft.com/fwlink/?linkid=2095322\nHandling types: https://tools.ietf.org/html/rfc8828.html#section-5.2","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webrtclocalhostiphandling","displayName":"Restrict exposure of local IP address by WebRTC","description":"Allows you to set whether or not WebRTC exposes the user's local IP address.\n\nIf you set this policy to \"AllowAllInterfaces\" or \"AllowPublicAndPrivateInterfaces\", WebRTC exposes the local IP address.\n\nIf you set this policy to \"AllowPublicInterfaceOnly\" or \"DisableNonProxiedUdp\", WebRTC doesn't expose the local IP address.\n\nIf you don't set this policy, or if you disable it, WebRTC exposes the local IP address.\n\nNote: This policy does not provide an option to exclude specific domains.\n\nPolicy options mapping:\n\n* AllowAllInterfaces (default) = Allow all interfaces. This exposes the local IP address\n\n* AllowPublicAndPrivateInterfaces (default_public_and_private_interfaces) = Allow public and private interfaces over http default route. This exposes the local IP address\n\n* AllowPublicInterfaceOnly (default_public_interface_only) = Allow public interface over http default route. This doesn't expose the local IP address\n\n* DisableNonProxiedUdp (disable_non_proxied_udp) = Use TCP unless proxy server supports UDP. This doesn't expose the local IP address\n\nUse the preceding information when configuring this policy.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.webrtclocalhostiphandling_allowallinterfaces","displayName":"Allow all interfaces. This exposes the local IP address","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webrtclocalhostiphandling_allowpublicandprivateinterfaces","displayName":"Allow public and private interfaces over http default route. This exposes the local IP address","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webrtclocalhostiphandling_allowpublicinterfaceonly","displayName":"Allow public interface over http default route. This doesn't expose the local IP address","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webrtclocalhostiphandling_disablenonproxiedudp","displayName":"Use TCP unless proxy server supports UDP. This doesn't expose the local IP address","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webrtclocalipsallowedurls","displayName":"Manage exposure of local IP addressess by WebRTC","description":"Specifies a list of origins (URLs) or hostname patterns (like \"*contoso.com*\") for which local IP address should be exposed by WebRTC.\n\nIf you enable this policy and set a list of origins (URLs) or hostname patterns, when edge://flags/#enable-webrtc-hide-local-ips-with-mdns is Enabled, WebRTC will expose the local IP address for cases that match patterns in the list.\n\nIf you disable or don't configure this policy, and edge://flags/#enable-webrtc-hide-local-ips-with-mdns is Enabled, WebRTC will not expose local IP addresses. The local IP address is concealed with an mDNS hostname.\n\nIf you enable, disable, or don't configure this policy, and edge://flags/#enable-webrtc-hide-local-ips-with-mdns is Disabled, WebRTC will expose local IP addresses.\n\nPlease note that this policy weakens the protection of local IP addresses that might be needed by administrators.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webrtcpostquantumkeyagreement","displayName":"Enable post-quantum key agreement for WebRTC","description":"This policy controls the use of post-quantum key agreement for WebRTC in Microsoft Edge.\n\nIf you enable this policy, Microsoft Edge will offer post-quantum key agreement for WebRTC.\n\nIf you disable this policy, post-quantum key agreement won't be offered for WebRTC.\n\nIf you don't configure this policy, post-quantum key agreement won't be offered for WebRTC. A future version of Microsoft Edge may enable this feature by default.\n\nOffering a post-quantum key agreement is backwards compatible. Existing datagram transport layer security (DTLS) peers and networking middleware are expected to ignore the new option and continue using previous options.\n\nHowever, devices that don't correctly implement DTLS may malfunction when offered the new option. For example, they may disconnect in response to unrecognized options or larger message sizes. Such devices aren’t post-quantum-ready and may interfere with an organization's post-quantum transition. If this issue occurs, administrators should contact the device vendor for a fix.\n\nThis policy is temporary and will be removed in a future release.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.webrtcpostquantumkeyagreement_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webrtcpostquantumkeyagreement_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webrtcudpportrange","displayName":"Restrict the range of local UDP ports used by WebRTC","description":"Restricts the UDP port range used by WebRTC to a specified port interval (endpoints included).\n\nBy configuring this policy, you specify the range of local UDP ports that WebRTC can use.\n\nIf you don't configure this policy, or if you set it to an empty string or invalid port range, WebRTC can use any available local UDP port.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webselectenabled","displayName":"Web Select Enabled (Obsolete)","description":"This policy is obsoleted because Web Select is part of Web Capture and can be controlled by \"WebCaptureEnabled\". This policy doesn't work in Microsoft Edge version 117. If Web Capture is disabled by \"WebCaptureEnabled\", Web select won't be available in Web Capture.\n\nWeb select lets users select and copy web content while preserving its formatting when pasted in most cases. It also allows more targeted selection on some web elements, such as copying a single column in a table.\n\nIf you enable or don't configure this policy, Web select is available in Web Capture and can be accessed directly using the CTRL+SHIFT+X keyboard shortcut.\n\nIf you disable this policy, Web select won't be available in Web Capture and the CTRL+SHIFT+X keyboard shortcut will also not work.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.webselectenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webselectenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.websqlaccess","displayName":"Force WebSQL to be enabled (Obsolete)","description":"This policy was removed in Microsoft Edge 124 and is ignored if set.\n\nWebSQL is on by default as of Microsoft Edge version 101, but can be disabled via a Microsoft Edge flag.\nIf you enable this policy, WebSQL cannot be disabled.\nIf you disable or don't configure this policy, WebSQL can be disabled.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.websqlaccess_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.websqlaccess_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.websqlnonsecurecontextenabled","displayName":"Force WebSQL in non-secure contexts to be enabled (Obsolete)","description":"This policy doesn't work because WebSQL in nonsecure contexts is on by default as of Microsoft Edge 105.\nIf you enable this policy, WebSQL in nonsecure contexts is enabled.\nIf you disable or don't configure this policy, WebSQL in nonsecure contexts follows the default settings of the browser.\n\nThis policy was removed in Microsoft Edge 113, and it's ignored if configured.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.websqlnonsecurecontextenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.websqlnonsecurecontextenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webusballowdevicesforurls","displayName":"Grant access to specific sites to connect to specific USB devices","description":"Allows you to set a list of URLs that specify which sites will automatically be granted permission to access a USB device with the given vendor and product IDs. Each item in the list must contain both devices and URLs for the policy to be valid. Each item in devices can contain a vendor ID and product ID field. Any ID that is omitted is treated as a wildcard with one exception, and that exception is that a product ID can't be specified without a vendor ID also being specified. Otherwise, the policy isn't be valid and is ignored.\n\nThe USB permission model uses the URL of the requesting site (\"requesting URL\") and the URL of the top-level frame site (\"embedding URL\") to grant permission to the requesting URL to access the USB device. The requesting URL may be different than the embedding URL when the requesting site is loaded in an iframe. Therefore, the \"urls\" field can contain up to two URL strings delimited by a comma to specify the requesting and embedding URL respectively. If only one URL is specified, then access to the corresponding USB devices is granted when the requesting site's URL matches this URL regardless of embedding status. The URLs in \"urls\" must be valid URLs; otherwise, the policy is ignored.\n\nThis is deprecated and only supported for backwards compatibility in the following manner. If both a requesting and embedding URL are specified, then the embedding URL is granted the permission as top-level origin, and the requesting URL is ignored entirely.\n\nIf you don't configure this policy, the global default value is used for all sites either from the \"DefaultWebUsbGuardSetting\" policy if it is set, or the user's personal configuration otherwise.\n\nURL patterns in this policy shouldn't clash with the ones configured via \"WebUsbBlockedForUrls\". If there's a clash, this policy takes precedence over \"WebUsbBlockedForUrls\" and \"WebUsbAskForUrls\".","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webusbaskforurls","displayName":"Allow WebUSB on specific sites","description":"Define a list of sites, based on URL patterns, that can ask the user for access to a USB device.\n\nIf you don't configure this policy, the global default value from the \"DefaultWebUsbGuardSetting\" policy (if set) or the user's personal configuration is used for all sites.\n\nThe URL patterns defined in this policy can't conflict with those configured in the \"WebUsbBlockedForUrls\" policy - you can't both allow and block a URL. For detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.webusbblockedforurls","displayName":"Block WebUSB on specific sites","description":"Define a list of sites, based on URL patterns, that can't ask the user to grant them access to a USB device.\n\nIf you don't configure this policy, the global default value from the \"DefaultWebUsbGuardSetting\" policy (if set) or the user's personal configuration is used for all sites.\n\nURL patterns in this policy can't conflict with those configured in the \"WebUsbAskForUrls\" policy. You can't both allow and block a URL. For detailed information on valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.whatsnewpageforentraprofilesenabled","displayName":"Control whether an informational webpage for Edge for Business is shown in the new tab after major browser updates","description":"Starting in Microsoft Edge version 145, users with Microsoft Entra ID profiles will see an informational page about new Edge for Business features after major browser updates. This page highlights recent enhancements designed to promote secure and productive browsing.\n\nThis policy controls whether users with Microsoft Entra ID profiles see this informational page. This policy applies only to Microsoft Entra ID profiles and does not apply to Microsoft account (MSA) profiles.\n\nThis policy is available starting in Microsoft Edge version 144 to allow configuration ahead of the changes introduced in version 145.\n\nIf you enable this policy or do not configure it, Microsoft Edge shows the informational page by default.\nIf you disable this policy, Microsoft Edge does not show the informational page to users.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.edge.mamedgeappconfigsettings.whatsnewpageforentraprofilesenabled_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.whatsnewpageforentraprofilesenabled_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"com.microsoft.edge.mamedgeappconfigsettings.windowcaptureallowedbyorigins","displayName":"Allow Window and Tab capture by these origins","description":"Setting the policy lets you set a list of URL patterns that can use Window and Tab Capture.\n\nLeaving the policy unset means that sites will not be considered for an override at this scope of Capture.\n\nThis policy is not considered if a site matches a URL pattern in any of the following policies: \"TabCaptureAllowedByOrigins\", \"SameOriginTabCaptureAllowedByOrigins\".\n\nIf a site matches a URL pattern in this policy, the following policies will not be considered: \"ScreenCaptureAllowedByOrigins\", \"ScreenCaptureAllowed\".\n\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. This policy only matches based on origin, so any path in the URL pattern is ignored.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.windowmanagementallowedforurls","displayName":"Allow Window Management permission on specified sites","description":"Lets you configure a list of site url patterns that specify sites which will automatically grant the window management permission. This extends the ability of sites to see information about the device's screens. This information can be used to open and place windows or request fullscreen on specific screens.\n\nFor detailed information on valid site url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed. This policy only matches based on site origin, so any path in the URL pattern is ignored.\n\nIf this policy isn't configured for a site, then the policy from \"DefaultWindowManagementSetting\" applies to the site, if configured. Otherwise the permission will follow the browser's defaults and let users choose this permission per site.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.windowmanagementblockedforurls","displayName":"Block Window Management permission on specified sites","description":"Lets you configure a list of site url patterns that specify sites which will automatically deny the window management permission. This limits the ability of sites to see information about the device's screens. This information can be used to open and place windows or request fullscreen on specific screens.\n\nFor detailed information on valid site url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed. This policy only matches based on site origin, so any path in the URL pattern is ignored.\n\nIf this policy isn't configured for a site, then the policy from \"DefaultWindowManagementSetting\" applies to the site, if configured. Otherwise the permission will follow the browser's defaults and let users choose this permission per site.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.edge.mamedgeappconfigsettings.workspacesnavigationsettings","displayName":"Configure navigation settings per groups of URLs in Microsoft Edge Workspaces","description":"This setting lets you to define groups of URLs, and apply specific Microsoft Edge Workspaces navigation settings to each group.\n\nIf this policy is configured, Microsoft Edge Workspaces will use the configured settings when deciding whether and how to share navigations among collaborators in a Microsoft Edge Workspace.\n\nIf this policy is not configured, Microsoft Edge Workspaces will use only default and internally configured navigation settings.\n\nFor more information about configuration options, see https://go.microsoft.com/fwlink/?linkid=2218655\n\nNote, format url_patterns according to https://go.microsoft.com/fwlink/?linkid=2095322. You can configure the url_regex_patterns in this policy to match multiple URLs using a Perl style regular expression for the pattern. Note that pattern matches are case sensitive. For more information about the regular expression rules that are used, refer to https://go.microsoft.com/fwlink/p/?linkid=2133903.","helpText":null,"infoUrls":[],"options":null},{"id":"com.microsoft.intune.mam.managedbrowser.appproxyredirection","displayName":"Application proxy redirection","description":"Enable App proxy redirection to give users access to corporate links and on-premise web apps.","helpText":null,"infoUrls":[],"options":[{"id":"com.microsoft.intune.mam.managedbrowser.appproxyredirection_false","displayName":"Disabled","description":null,"helpText":null},{"id":"com.microsoft.intune.mam.managedbrowser.appproxyredirection_true","displayName":"Enabled","description":null,"helpText":null}]},{"id":"command_remotedesktop","displayName":"Remote Desktop","description":"","helpText":null,"infoUrls":[],"options":null},{"id":"command_remotedesktop_remotedesktop","displayName":"Remote Desktop","description":"Enable/Disable Remote Desktop on the device","helpText":null,"infoUrls":[],"options":[{"id":"command_remotedesktop_remotedesktop_true","displayName":"Enable","description":null,"helpText":null},{"id":"command_remotedesktop_remotedesktop_false","displayName":"Disable","description":null,"helpText":null}]},{"id":"ddm-latestsoftwareupdate_ddm-latestsoftwareupdate","displayName":"Top Level Setting Group Collection","description":"Synthetic Top Level Setting Group Collection","helpText":null,"infoUrls":[],"options":null},{"id":"ddm-latestsoftwareupdate_delayindays","displayName":"Delay In Days","description":"Specify the number of days that should pass before a deadline is enforced after a new update is released by Apple.","helpText":null,"infoUrls":[],"options":null},{"id":"ddm-latestsoftwareupdate_enforcelatestsoftwareupdateversion","displayName":"Enforce Latest Software Update Version","description":"If true, devices will upgrade to the latest OS version that is available for that device model. This uses the Software Update Enforcement configuration and will force devices to restart and install the update after the deadline passes.","helpText":null,"infoUrls":[],"options":{"id":"ddm-latestsoftwareupdate_enforcelatestsoftwareupdateversion_0","displayName":"True","description":null,"helpText":null}},{"id":"ddm-latestsoftwareupdate_installtime","displayName":"Install Time","description":"Specify the local device time for when updates are enforced. This setting uses the 24-hour clock format where midnight is 00:00 and 11:59pm is 23:59. Ensure that you include the leading 0 on single digit hours. For example, 01:00, 02:00, 03:00.","helpText":null,"infoUrls":[],"options":null},{"id":"defender_disableprivacymode","displayName":"Allow users to view the full History results","description":"Disable the privacy mode","helpText":null,"infoUrls":[],"options":[{"id":"defender_disableprivacymode_0","displayName":"No","description":null,"helpText":null},{"id":"defender_disableprivacymode_1","displayName":"Yes","description":null,"helpText":null}]},{"id":"defender_disablerestorepoint","displayName":"Create a system restore point before computers are cleaned","description":"Disables restore point","helpText":null,"infoUrls":[],"options":[{"id":"defender_disablerestorepoint_0","displayName":"No","description":null,"helpText":null},{"id":"defender_disablerestorepoint_1","displayName":"Yes","description":null,"helpText":null}]},{"id":"defender_randomizescheduletasktimes","displayName":"Randomize scheduled scan and security intelligence update start times","description":"This setting allows you to enable or disable randomization of the scheduled scan start time and the scheduled definition update start time. This setting is used to distribute the resource impact of scanning. For example, it could be used in guest virtual machines sharing a host, to prevent multiple guest virtual machines from undertaking a disk-intensive operation at the same time.","helpText":null,"infoUrls":[],"options":[{"id":"defender_randomizescheduletasktimes_0","displayName":"No","description":null,"helpText":null},{"id":"defender_randomizescheduletasktimes_1","displayName":"Yes","description":null,"helpText":null}]},{"id":"device_vendor_msft_accountmanagement_userprofilemanagement_deletionpolicy","displayName":"Deletion Policy","description":"Configures when profiles will be deleted. Allowed values: 0 (delete immediately upon device returning to a state with no currently active users); 1 (delete at storage capacity threshold); 2 (delete at both storage capacity threshold and profile inactivity threshold).","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/AccountManagement-csp/"],"options":[{"id":"device_vendor_msft_accountmanagement_userprofilemanagement_deletionpolicy_0","displayName":"Delete immediately upon device returning to a state with no currently active users)","description":"Delete immediately upon device returning to a state with no currently active users)","helpText":null},{"id":"device_vendor_msft_accountmanagement_userprofilemanagement_deletionpolicy_1","displayName":"Delete at storage capacity threshold","description":"Delete at storage capacity threshold","helpText":null},{"id":"device_vendor_msft_accountmanagement_userprofilemanagement_deletionpolicy_2","displayName":"Delete at both storage capacity threshold and profile inactivity threshold","description":"Delete at both storage capacity threshold and profile inactivity threshold","helpText":null}]},{"id":"device_vendor_msft_accountmanagement_userprofilemanagement_enableprofilemanager","displayName":"Enable Profile Manager","description":"Enable profile lifetime mangement for shared or communal device scenarios.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/AccountManagement-csp/"],"options":[{"id":"device_vendor_msft_accountmanagement_userprofilemanagement_enableprofilemanager_false","displayName":"False","description":"False","helpText":null},{"id":"device_vendor_msft_accountmanagement_userprofilemanagement_enableprofilemanager_true","displayName":"True","description":"True","helpText":null}]},{"id":"device_vendor_msft_accountmanagement_userprofilemanagement_profileinactivitythreshold","displayName":"Profile Inactivity Threshold","description":"Start deleting profiles when they have not been logged on during the specified period, given as number of days.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/AccountManagement-csp/"],"options":null},{"id":"device_vendor_msft_accountmanagement_userprofilemanagement_storagecapacitystartdeletion","displayName":"Storage Capacity Start Deletion","description":"Start deleting profiles when available storage capacity falls below this threshold, given as percent of total storage available for profiles. Profiles that have been inactive the longest will be deleted first.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/AccountManagement-csp/"],"options":null},{"id":"device_vendor_msft_accountmanagement_userprofilemanagement_storagecapacitystopdeletion","displayName":"Storage Capacity Stop Deletion","description":"Stop deleting profiles when available storage capacity is brought up to this threshold, given as percent of total storage available for profiles.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/AccountManagement-csp/"],"options":null},{"id":"device_vendor_msft_bitlocker_allowstandarduserencryption","displayName":"Allow Standard User Encryption","description":"Allows Admin to enforce \"RequireDeviceEncryption\" policy for scenarios where policy is pushed while current logged on user is non-admin/standard user.\n \"AllowStandardUserEncryption\" policy is tied to \"AllowWarningForOtherDiskEncryption\" policy being set to \"0\", i.e, Silent encryption is enforced.\n If \"AllowWarningForOtherDiskEncryption\" is not set, or is set to \"1\", \"RequireDeviceEncryption\" policy will not try to encrypt drive(s) if a standard user\n is the current logged on user in the system.\n\n The expected values for this policy are: \n\n 1 = \"RequireDeviceEncryption\" policy will try to enable encryption on all fixed drives even if a current logged in user is standard user.\n 0 = This is the default, when the policy is not set. If current logged on user is a standard user, \"RequireDeviceEncryption\" policy\n will not try to enable encryption on any drive.\n\n If you want to disable this policy use the following SyncML:\n 111./Device/Vendor/MSFT/BitLocker/AllowStandardUserEncryptionint0","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_allowstandarduserencryption_0","displayName":"Disabled","description":"This is the default, when the policy is not set. If current logged on user is a standard user, \"RequireDeviceEncryption\" policy will not try to enable encryption on any drive.","helpText":null},{"id":"device_vendor_msft_bitlocker_allowstandarduserencryption_1","displayName":"Enabled","description":"\"RequireDeviceEncryption\" policy will try to enable encryption on all fixed drives even if a current logged in user is standard user.","helpText":null}]},{"id":"device_vendor_msft_bitlocker_allowwarningforotherdiskencryption","displayName":"Allow Warning For Other Disk Encryption","description":"Allows Admin to disable all UI (notification for encryption and warning prompt for other disk encryption)\n and turn on encryption on the user machines silently.\n Warning: When you enable BitLocker on a device with third party encryption, it may render the device unusable and will\n require reinstallation of Windows.\n Note: This policy takes effect only if \"RequireDeviceEncryption\" policy is set to 1.\n The format is integer.\n The expected values for this policy are: \n\n 1 = This is the default, when the policy is not set. Warning prompt and encryption notification is allowed.\n 0 = Disables the warning prompt and encryption notification. Starting in Windows 10, next major update, \n the value 0 only takes affect on Entra ID joined devices. \n Windows will attempt to silently enable BitLocker for value 0.\n\n If you want to disable this policy use the following SyncML:\n 110./Device/Vendor/MSFT/BitLocker/AllowWarningForOtherDiskEncryptionint0","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp#allowwarningforotherdiskencryption"],"options":[{"id":"device_vendor_msft_bitlocker_allowwarningforotherdiskencryption_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_allowwarningforotherdiskencryption_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_configurerecoverypasswordrotation","displayName":"Configure Recovery Password Rotation","description":" Allows Admin to configure Numeric Recovery Password Rotation upon use for OS and fixed drives on Entra ID and Hybrid domain joined devices.\n When not configured, Rotation is turned on by default for Entra ID only and off on Hybrid. The Policy will be effective only when \n Active Directory back up for recovery password is configured to required.\n For OS drive: Turn on \"Do not enable Bitlocker until recovery information is stored to AD DS for operating system drives\"\n For Fixed drives: Turn on \"Do not enable Bitlocker until recovery information is stored to AD DS for fixed data drives\"\n \n Supported Values: 0 - Numeric Recovery Passwords rotation OFF.\n 1 - Numeric Recovery Passwords Rotation upon use ON for Entra ID joined devices. Default value\n 2 - Numeric Recovery Passwords Rotation upon use ON for both Entra ID and Hybrid devices\n \n If you want to disable this policy use the following SyncML:\n \n 112./Device/Vendor/MSFT/BitLocker/ConfigureRecoveryPasswordRotationint0","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/BitLocker-csp/"],"options":[{"id":"device_vendor_msft_bitlocker_configurerecoverypasswordrotation_0","displayName":"Refresh off (default)","description":"Refresh off (default)","helpText":null},{"id":"device_vendor_msft_bitlocker_configurerecoverypasswordrotation_1","displayName":"Refresh on for Entra ID-joined devices","description":"Refresh on for Entra ID-joined devices","helpText":null},{"id":"device_vendor_msft_bitlocker_configurerecoverypasswordrotation_2","displayName":"Refresh on for both Entra ID-joined and hybrid-joined devices","description":"Refresh on for both Entra ID-joined and hybrid-joined devices","helpText":null}]},{"id":"device_vendor_msft_bitlocker_encryptionmethodbydrivetype","displayName":"Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)","description":"This policy setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption method has no effect if the drive is already encrypted, or if encryption is in progress.\r\n\r\nIf you enable this policy setting you will be able to configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually. For fixed and operating system drives, we recommend that you use the XTS-AES algorithm. For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that are not running Windows 10 (Version 1511).\r\n\r\nIf you disable or do not configure this policy setting, BitLocker will use AES with the same bit strength (128-bit or 256-bit) as the \"Choose drive encryption method and cipher strength (Windows Vista, Windows Server 2008, Windows 7)\" and \"Choose drive encryption method and cipher strength\" policy settings (in that order), if they are set. If none of the policies are set, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method specified by the setup script.”\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp#encryptionmethodbydrivetype"],"options":[{"id":"device_vendor_msft_bitlocker_encryptionmethodbydrivetype_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_encryptionmethodbydrivetype_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_encryptionmethodbydrivetype_encryptionmethodwithxtsfdvdropdown_name","displayName":"Select the encryption method for fixed data drives:","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp#encryptionmethodbydrivetype"],"options":[{"id":"device_vendor_msft_bitlocker_encryptionmethodbydrivetype_encryptionmethodwithxtsfdvdropdown_name_3","displayName":"AES-CBC 128-bit","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_encryptionmethodbydrivetype_encryptionmethodwithxtsfdvdropdown_name_4","displayName":"AES-CBC 256-bit","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_encryptionmethodbydrivetype_encryptionmethodwithxtsfdvdropdown_name_6","displayName":"XTS-AES 128-bit (default)","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_encryptionmethodbydrivetype_encryptionmethodwithxtsfdvdropdown_name_7","displayName":"XTS-AES 256-bit","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_encryptionmethodbydrivetype_encryptionmethodwithxtsosdropdown_name","displayName":"Select the encryption method for operating system drives:","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp#encryptionmethodbydrivetype"],"options":[{"id":"device_vendor_msft_bitlocker_encryptionmethodbydrivetype_encryptionmethodwithxtsosdropdown_name_3","displayName":"AES-CBC 128-bit","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_encryptionmethodbydrivetype_encryptionmethodwithxtsosdropdown_name_4","displayName":"AES-CBC 256-bit","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_encryptionmethodbydrivetype_encryptionmethodwithxtsosdropdown_name_6","displayName":"XTS-AES 128-bit (default)","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_encryptionmethodbydrivetype_encryptionmethodwithxtsosdropdown_name_7","displayName":"XTS-AES 256-bit","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_encryptionmethodbydrivetype_encryptionmethodwithxtsrdvdropdown_name","displayName":"Select the encryption method for removable data drives:","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp#encryptionmethodbydrivetype"],"options":[{"id":"device_vendor_msft_bitlocker_encryptionmethodbydrivetype_encryptionmethodwithxtsrdvdropdown_name_3","displayName":"AES-CBC 128-bit (default)","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_encryptionmethodbydrivetype_encryptionmethodwithxtsrdvdropdown_name_4","displayName":"AES-CBC 256-bit","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_encryptionmethodbydrivetype_encryptionmethodwithxtsrdvdropdown_name_6","displayName":"XTS-AES 128-bit","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_encryptionmethodbydrivetype_encryptionmethodwithxtsrdvdropdown_name_7","displayName":"XTS-AES 256-bit","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_fixeddrivesencryptiontype","displayName":"Enforce drive encryption type on fixed data drives","description":"This policy setting allows you to configure the encryption type used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose used space only encryption to require that only the portion of the drive used to store data is encrypted when BitLocker is turned on.\r\n\r\nIf you enable this policy setting the encryption type that BitLocker will use to encrypt drives is defined by this policy and the encryption type option will not be presented in the BitLocker setup wizard.\r\n\r\nIf you disable or do not configure this policy setting, the BitLocker setup wizard will ask the user to select the encryption type before turning on BitLocker.\r\n\r\n \n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/BitLocker-csp/"],"options":[{"id":"device_vendor_msft_bitlocker_fixeddrivesencryptiontype_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_fixeddrivesencryptiontype_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_fixeddrivesencryptiontype_fdvencryptiontypedropdown_name","displayName":"Select the encryption type: (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_bitlocker_fixeddrivesencryptiontype_fdvencryptiontypedropdown_name_0","displayName":"Allow user to choose (default)","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_fixeddrivesencryptiontype_fdvencryptiontypedropdown_name_1","displayName":"Full encryption","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_fixeddrivesencryptiontype_fdvencryptiontypedropdown_name_2","displayName":"Used Space Only encryption","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions","displayName":"Choose how BitLocker-protected fixed drives can be recovered","description":"This policy setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker.\r\n\r\nThe \"Allow data recovery agent\" check box is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents.\r\n\r\nIn \"Configure user storage of BitLocker recovery information\" select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key.\r\n\r\nSelect \"Omit recovery options from the BitLocker setup wizard\" to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting.\r\n\r\nIn \"Save BitLocker recovery information to Active Directory Domain Services\" choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select \"Backup recovery password and key package\", both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select \"Backup recovery password only,\" only the recovery password is stored in AD DS.\r\n\r\nSelect the \"Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives\" check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds.\r\n\r\nNote: If the \"Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives\" check box is selected, a recovery password is automatically generated.\r\n\r\nIf you enable this policy setting, you can control the methods available to users to recover data from BitLocker-protected fixed data drives.\r\n\r\nIf this policy setting is not configured or disabled, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS\r\n\r\n","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvactivedirectorybackup_name","displayName":"Save BitLocker recovery information to AD DS for fixed data drives","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvactivedirectorybackup_name_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvactivedirectorybackup_name_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvactivedirectorybackupdropdown_name","displayName":"Configure storage of BitLocker recovery information to AD DS:","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvactivedirectorybackupdropdown_name_1","displayName":"Backup recovery passwords and key packages","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvactivedirectorybackupdropdown_name_2","displayName":"Backup recovery passwords only","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvallowdra_name","displayName":"Allow data recovery agent","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvallowdra_name_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvallowdra_name_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvhiderecoverypage_name","displayName":"Omit recovery options from the BitLocker setup wizard","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvhiderecoverypage_name_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvhiderecoverypage_name_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvrecoverykeyusagedropdown_name","displayName":"","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvrecoverykeyusagedropdown_name_2","displayName":"Allow 256-bit recovery key","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvrecoverykeyusagedropdown_name_1","displayName":"Require 256-bit recovery key","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvrecoverykeyusagedropdown_name_0","displayName":"Do not allow 256-bit recovery key","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvrecoverypasswordusagedropdown_name","displayName":"\r\nConfigure user storage of BitLocker recovery information:\r\n","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvrecoverypasswordusagedropdown_name_2","displayName":"Allow 48-digit recovery password","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvrecoverypasswordusagedropdown_name_1","displayName":"Require 48-digit recovery password","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvrecoverypasswordusagedropdown_name_0","displayName":"Do not allow 48-digit recovery password","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvrequireactivedirectorybackup_name","displayName":"Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvrequireactivedirectorybackup_name_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions_fdvrequireactivedirectorybackup_name_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_fixeddrivesrequireencryption","displayName":"Deny write access to fixed drives not protected by BitLocker","description":"This policy setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer.\r\n\r\nIf you enable this policy setting, all fixed data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access.\r\n\r\nIf you disable or do not configure this policy setting, all fixed data drives on the computer will be mounted with read and write access.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_fixeddrivesrequireencryption_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_fixeddrivesrequireencryption_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_identificationfield","displayName":"Provide the unique identifiers for your organization","description":"This policy setting allows you to associate unique organizational identifiers to a new drive that is enabled with BitLocker. These identifiers are stored as the identification field and allowed identification field. The identification field allows you to associate a unique organizational identifier to BitLocker-protected drives. This identifier is automatically added to new BitLocker-protected drives and can be updated on existing BitLocker-protected drives using the manage-bde command-line tool. An identification field is required for management of certificate-based data recovery agents on BitLocker-protected drives and for potential updates to the BitLocker To Go Reader. BitLocker will only manage and update data recovery agents when the identification field on the drive matches the value configured in the identification field. In a similar manner, BitLocker will only update the BitLocker To Go Reader when the identification field on the drive matches the value configured for the identification field.\r\n\r\nThe allowed identification field is used in combination with the \"Deny write access to removable drives not protected by BitLocker\" policy setting to help control the use of removable drives in your organization. It is a comma separated list of identification fields from your organization or other external organizations.\r\n\r\nYou can configure the identification fields on existing drives by using manage-bde.exe.\r\n\r\nIf you enable this policy setting, you can configure the identification field on the BitLocker-protected drive and any allowed identification field used by your organization.\r\n\r\nWhen a BitLocker-protected drive is mounted on another BitLocker-enabled computer the identification field and allowed identification field will be used to determine whether the drive is from an outside organization.\r\n\r\nIf you disable or do not configure this policy setting, the identification field is not required.\r\n\r\nNote: Identification fields are required for management of certificate-based data recovery agents on BitLocker-protected drives. BitLocker will only manage and update certificate-based data recovery agents when the identification field is present on a drive and is identical to the value configured on the computer. The identification field can be any value of 260 characters or fewer.\r\n\r\n \n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/BitLocker-csp/"],"options":[{"id":"device_vendor_msft_bitlocker_identificationfield_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_identificationfield_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_identificationfield_identificationfield","displayName":"BitLocker identification field: (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_bitlocker_identificationfield_secidentificationfield","displayName":"Allowed BitLocker identification field: (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_bitlocker_removabledrivesconfigurebde","displayName":"Control use of BitLocker on removable drives","description":"This policy setting controls the use of BitLocker on removable data drives. This policy setting is applied when you turn on BitLocker.\r\n\r\nWhen this policy setting is enabled you can select property settings that control how users can configure BitLocker. Choose \"Allow users to apply BitLocker protection on removable data drives\" to permit the user to run the BitLocker setup wizard on a removable data drive. Choose \"Allow users to suspend and decrypt BitLocker on removable data drives\" to permit the user to remove BitLocker Drive encryption from the drive or suspend the encryption while maintenance is performed. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information on suspending BitLocker protection.\r\n\r\nIf you do not configure this policy setting, users can use BitLocker on removable disk drives.\r\n\r\nIf you disable this policy setting, users cannot use BitLocker on removable disk drives.\r\n\r\n \n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/BitLocker-csp/"],"options":[{"id":"device_vendor_msft_bitlocker_removabledrivesconfigurebde_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_removabledrivesconfigurebde_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_removabledrivesconfigurebde_rdvallowbde_name","displayName":"Allow users to apply BitLocker protection on removable data drives (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_bitlocker_removabledrivesconfigurebde_rdvallowbde_name_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_removabledrivesconfigurebde_rdvallowbde_name_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_removabledrivesconfigurebde_rdvdisablebde_name","displayName":"Allow users to suspend and decrypt BitLocker protection on removable data drives (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_bitlocker_removabledrivesconfigurebde_rdvdisablebde_name_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_removabledrivesconfigurebde_rdvdisablebde_name_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_removabledrivesencryptiontype","displayName":"Enforce drive encryption type on removable data drives","description":"This policy setting allows you to configure the encryption type used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose used space only encryption to require that only the portion of the drive used to store data is encrypted when BitLocker is turned on.\r\n\r\nIf you enable this policy setting the encryption type that BitLocker will use to encrypt drives is defined by this policy and the encryption type option will not be presented in the BitLocker setup wizard.\r\n\r\nIf you disable or do not configure this policy setting, the BitLocker setup wizard will ask the user to select the encryption type before turning on BitLocker.\r\n\r\n \n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/BitLocker-csp/"],"options":[{"id":"device_vendor_msft_bitlocker_removabledrivesencryptiontype_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_removabledrivesencryptiontype_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_removabledrivesencryptiontype_rdvencryptiontypedropdown_name","displayName":"Select the encryption type: (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_bitlocker_removabledrivesencryptiontype_rdvencryptiontypedropdown_name_0","displayName":"Allow user to choose (default)","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_removabledrivesencryptiontype_rdvencryptiontypedropdown_name_1","displayName":"Full encryption","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_removabledrivesencryptiontype_rdvencryptiontypedropdown_name_2","displayName":"Used Space Only encryption","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_removabledrivesexcludedfromencryption","displayName":"Removable Drives Excluded From Encryption","description":"When enabled, allows you to exclude removable drives and devices connected over USB interface from BitLocker Device Encryption. Excluded devices cannot be encrypted, even manually. Additionally, if \"Deny write access to removable drives not protected by BitLocker\" is configured, user will not be prompted for encryption and drive will be mounted in read/write mode. Provide a comma separated list of excluded removable drives\\devices, using the Hardware ID of the disk device. Example USBSTOR\\SEAGATE_ST39102LW_______0004.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/BitLocker-csp/"],"options":null},{"id":"device_vendor_msft_bitlocker_removabledrivesrequireencryption","displayName":"Deny write access to removable drives not protected by BitLocker","description":"This policy setting configures whether BitLocker protection is required for a computer to be able to write data to a removable data drive.\r\n\r\nIf you enable this policy setting, all removable data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access.\r\n\r\nIf the \"Deny write access to devices configured in another organization\" option is selected, only drives with identification fields matching the computer's identification fields will be given write access. When a removable data drive is accessed it will be checked for valid identification field and allowed identification fields. These fields are defined by the \"Provide the unique identifiers for your organization\" policy setting.\r\n\r\nIf you disable or do not configure this policy setting, all removable data drives on the computer will be mounted with read and write access.\r\n\r\nNote: This policy setting can be overridden by the policy settings under User Configuration\\Administrative Templates\\System\\Removable Storage Access. If the \"Removable Disks: Deny write access\" policy setting is enabled this policy setting will be ignored.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_removabledrivesrequireencryption_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_removabledrivesrequireencryption_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_removabledrivesrequireencryption_rdvcrossorg","displayName":"Do not allow write access to devices configured in another organization","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_removabledrivesrequireencryption_rdvcrossorg_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_removabledrivesrequireencryption_rdvcrossorg_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_requiredeviceencryption","displayName":"Require Device Encryption","description":"Allows the Admin to require encryption to be turned on using BitLocker\\Device Encryption.\n The format is integer.\n Sample value for this node to enable this policy:\n 1\n\n Disabling the policy will not turn off the encryption on the system drive. But will stop prompting the user to turn it on.\n If you want to disable this policy use the following SyncML:\n 101./Device/Vendor/MSFT/BitLocker/RequireDeviceEncryptionint0","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_requiredeviceencryption_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_requiredeviceencryption_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesdisallowstandarduserscanchangepin","displayName":"Disallow standard users from changing the PIN or password","description":"This policy setting allows you to configure whether or not standard users are allowed to change BitLocker volume PINs, provided they are able to provide the existing PIN first.\r\n\r\nThis policy setting is applied when you turn on BitLocker.\r\n\r\nIf you enable this policy setting, standard users will not be allowed to change BitLocker PINs or passwords.\r\n\r\nIf you disable or do not configure this policy setting, standard users will be permitted to change BitLocker PINs and passwords.\r\n\r\n \n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/BitLocker-csp/"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesdisallowstandarduserscanchangepin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesdisallowstandarduserscanchangepin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesenableprebootinputprotectorsonslates","displayName":"Enable use of BitLocker authentication requiring preboot keyboard input on slates","description":"This policy setting allows users to turn on authentication options that require user input from the pre-boot environment, even if the platform lacks pre-boot input capability.\r\n\r\nThe Windows touch keyboard (such as that used by tablets) isn't available in the pre-boot environment where BitLocker requires additional information such as a PIN or Password.\r\n\r\nIf you enable this policy setting, devices must have an alternative means of pre-boot input (such as an attached USB keyboard).\r\n\r\nIf this policy is not enabled, the Windows Recovery Environment must be enabled on tablets to support the entry of the BitLocker recovery password. When the Windows Recovery Environment is not enabled and this policy is not enabled, you cannot turn on BitLocker on a device that uses the Windows touch keyboard.\r\n\r\nNote that if you do not enable this policy setting, options in the \"Require additional authentication at startup\" policy might not be available on such devices. These options include:\r\n- Configure TPM startup PIN: Required/Allowed\r\n- Configure TPM startup key and PIN: Required/Allowed\r\n- Configure use of passwords for operating system drives.\r\n \n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/BitLocker-csp/"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesenableprebootinputprotectorsonslates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesenableprebootinputprotectorsonslates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesenableprebootpinexceptionondecapabledevice","displayName":"Allow devices compliant with InstantGo or HSTI to opt out of pre-boot PIN.","description":"This policy setting allows users on devices that are compliant with InstantGo or Microsoft Hardware Security Test Interface (HSTI) to not have a PIN for pre-boot authentication. This overrides the \"Require startup PIN with TPM\" and \"Require startup key and PIN with TPM\" options of the \"Require additional authentication at startup\" policy on compliant hardware.\r\n\r\nIf you enable this policy setting, users on InstantGo and HSTI compliant devices will have the choice to turn on BitLocker without pre-boot authentication.\r\n\r\nIf this policy is not enabled, the options of \"Require additional authentication at startup\" policy apply.\r\n \n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/BitLocker-csp/"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesenableprebootpinexceptionondecapabledevice_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesenableprebootpinexceptionondecapabledevice_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesencryptiontype","displayName":"Enforce drive encryption type on operating system drives","description":"This policy setting allows you to configure the encryption type used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose used space only encryption to require that only the portion of the drive used to store data is encrypted when BitLocker is turned on.\r\n\r\nIf you enable this policy setting the encryption type that BitLocker will use to encrypt drives is defined by this policy and the encryption type option will not be presented in the BitLocker setup wizard.\r\n\r\nIf you disable or do not configure this policy setting, the BitLocker setup wizard will ask the user to select the encryption type before turning on BitLocker.\r\n\r\n \n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/BitLocker-csp/"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesencryptiontype_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesencryptiontype_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesencryptiontype_osencryptiontypedropdown_name","displayName":"Select the encryption type: (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesencryptiontype_osencryptiontypedropdown_name_0","displayName":"Allow user to choose (default)","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesencryptiontype_osencryptiontypedropdown_name_1","displayName":"Full encryption","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesencryptiontype_osencryptiontypedropdown_name_2","displayName":"Used Space Only encryption","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesenhancedpin","displayName":"Allow enhanced PINs for startup","description":"This policy setting allows you to configure whether or not enhanced startup PINs are used with BitLocker.\r\n\r\nEnhanced startup PINs permit the use of characters including uppercase and lowercase letters, symbols, numbers, and spaces. This policy setting is applied when you turn on BitLocker.\r\n\r\nIf you enable this policy setting, all new BitLocker startup PINs set will be enhanced PINs.\r\n\r\nNote: Not all computers may support enhanced PINs in the pre-boot environment. It is strongly recommended that users perform a system check during BitLocker setup.\r\n\r\nIf you disable or do not configure this policy setting, enhanced PINs will not be used.\r\n\r\n \n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/BitLocker-csp/"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesenhancedpin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesenhancedpin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesminimumpinlength","displayName":"Configure minimum PIN length for startup","description":"\r\n This policy setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits.\r\n\r\n If you enable this policy setting, you can require a minimum number of digits to be used when setting the startup PIN.\r\n\r\n If you disable or do not configure this policy setting, users can configure a startup PIN of any length between 6 and 20 digits.\r\n\r\n NOTE: If minimum PIN length is set below 6 digits, Windows will attempt to update the TPM 2.0 lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesminimumpinlength_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesminimumpinlength_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesminimumpinlength_minpinlength","displayName":"Minimum characters:","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoverymessage","displayName":"Configure pre-boot recovery message and URL","description":"This policy setting lets you configure the entire recovery message or replace the existing URL that are displayed on the pre-boot key recovery screen when the OS drive is locked.\r\n\r\nIf you select the \"Use default recovery message and URL\" option, the default BitLocker recovery message and URL will be displayed in the pre-boot key recovery screen. If you have previously configured a custom recovery message or URL and want to revert to the default message, you must keep the policy enabled and select the \"Use default recovery message and URL\" option.\r\n\r\nIf you select the \"Use custom recovery message\" option, the message you type in the \"Custom recovery message option\" text box will be displayed in the pre-boot key recovery screen. If a recovery URL is available, include it in the message.\r\n\r\nIf you select the \"Use custom recovery URL\" option, the URL you type in the \"Custom recovery URL option\" text box will replace the default URL in the default recovery message, which will be displayed in the pre-boot key recovery screen.\r\n\r\nNote: Not all characters and languages are supported in pre-boot. It is strongly recommended that you test that the characters you use for the custom message or URL appear correctly on the pre-boot recovery screen.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesrecoverymessage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoverymessage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoverymessage_prebootrecoveryinfodropdown_name","displayName":"Select an option for the pre-boot recovery message:","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesrecoverymessage_prebootrecoveryinfodropdown_name_0","displayName":"","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoverymessage_prebootrecoveryinfodropdown_name_1","displayName":"Use default recovery message and URL","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoverymessage_prebootrecoveryinfodropdown_name_2","displayName":"Use custom recovery message","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoverymessage_prebootrecoveryinfodropdown_name_3","displayName":"Use custom recovery URL","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoverymessage_recoverymessage_input","displayName":"Custom recovery message option:","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoverymessage_recoveryurl_input","displayName":"Custom recovery URL option:","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions","displayName":"Choose how BitLocker-protected operating system drives can be recovered","description":"This policy setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This policy setting is applied when you turn on BitLocker.\r\n\r\nThe \"Allow certificate-based data recovery agent\" check box is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents.\r\n\r\nIn \"Configure user storage of BitLocker recovery information\" select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key.\r\n\r\nSelect \"Omit recovery options from the BitLocker setup wizard\" to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting.\r\n\r\nIn \"Save BitLocker recovery information to Active Directory Domain Services\", choose which BitLocker recovery information to store in AD DS for operating system drives. If you select \"Backup recovery password and key package\", both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select \"Backup recovery password only,\" only the recovery password is stored in AD DS.\r\n\r\nSelect the \"Do not enable BitLocker until recovery information is stored in AD DS for operating system drives\" check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds.\r\n\r\nNote: If the \"Do not enable BitLocker until recovery information is stored in AD DS for operating system drives\" check box is selected, a recovery password is automatically generated.\r\n\r\nIf you enable this policy setting, you can control the methods available to users to recover data from BitLocker-protected operating system drives.\r\n\r\nIf this policy setting is disabled or not configured, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS.\r\n\r\n","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osactivedirectorybackup_name","displayName":"Save BitLocker recovery information to AD DS for operating system drives","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osactivedirectorybackup_name_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osactivedirectorybackup_name_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osactivedirectorybackupdropdown_name","displayName":"Configure storage of BitLocker recovery information to AD DS:","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osactivedirectorybackupdropdown_name_1","displayName":"Store recovery passwords and key packages","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osactivedirectorybackupdropdown_name_2","displayName":"Store recovery passwords only","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osallowdra_name","displayName":"Allow data recovery agent","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osallowdra_name_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osallowdra_name_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_oshiderecoverypage_name","displayName":"Omit recovery options from the BitLocker setup wizard","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_oshiderecoverypage_name_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_oshiderecoverypage_name_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osrecoverykeyusagedropdown_name","displayName":"","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osrecoverykeyusagedropdown_name_2","displayName":"Allow 256-bit recovery key","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osrecoverykeyusagedropdown_name_1","displayName":"Require 256-bit recovery key","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osrecoverykeyusagedropdown_name_0","displayName":"Do not allow 256-bit recovery key","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osrecoverypasswordusagedropdown_name","displayName":"\r\nConfigure user storage of BitLocker recovery information:\r\n","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osrecoverypasswordusagedropdown_name_2","displayName":"Allow 48-digit recovery password","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osrecoverypasswordusagedropdown_name_1","displayName":"Require 48-digit recovery password","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osrecoverypasswordusagedropdown_name_0","displayName":"Do not allow 48-digit recovery password","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osrequireactivedirectorybackup_name","displayName":"Do not enable BitLocker until recovery information is stored to AD DS for operating system drives","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osrequireactivedirectorybackup_name_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions_osrequireactivedirectorybackup_name_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication","displayName":"Require additional authentication at startup","description":"This policy setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a Trusted Platform Module (TPM). This policy setting is applied when you turn on BitLocker.\r\n\r\nNote: Only one of the additional authentication options can be required at startup, otherwise a policy error occurs.\r\n\r\nIf you want to use BitLocker on a computer without a TPM, select the \"Allow BitLocker without a compatible TPM\" check box. In this mode either a password or a USB drive is required for start-up. When using a startup key, the key information used to encrypt the drive is stored on the USB drive, creating a USB key. When the USB key is inserted the access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable or if you have forgotten the password then you will need to use one of the BitLocker recovery options to access the drive.\r\n\r\nOn a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 6-digit to 20-digit personal identification number (PIN), or both.\r\n\r\nIf you enable this policy setting, users can configure advanced startup options in the BitLocker setup wizard.\r\n\r\nIf you disable or do not configure this policy setting, users can configure only basic options on computers with a TPM.\r\n\r\nNote: If you want to require the use of a startup PIN and a USB flash drive, you must configure BitLocker settings using the command-line tool manage-bde instead of the BitLocker Drive Encryption setup wizard.\r\n\r\n","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configurenontpmstartupkeyusage_name","displayName":"Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive)","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configurenontpmstartupkeyusage_name_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configurenontpmstartupkeyusage_name_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configurepinusagedropdown_name","displayName":"Configure TPM startup PIN:","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configurepinusagedropdown_name_2","displayName":"Allow startup PIN with TPM","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configurepinusagedropdown_name_1","displayName":"Require startup PIN with TPM","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configurepinusagedropdown_name_0","displayName":"Do not allow startup PIN with TPM","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configuretpmpinkeyusagedropdown_name","displayName":"Configure TPM startup key and PIN:","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configuretpmpinkeyusagedropdown_name_2","displayName":"Allow startup key and PIN with TPM","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configuretpmpinkeyusagedropdown_name_1","displayName":"Require startup key and PIN with TPM","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configuretpmpinkeyusagedropdown_name_0","displayName":"Do not allow startup key and PIN with TPM","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configuretpmstartupkeyusagedropdown_name","displayName":"Configure TPM startup key:","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configuretpmstartupkeyusagedropdown_name_2","displayName":"Allow startup key with TPM","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configuretpmstartupkeyusagedropdown_name_1","displayName":"Require startup key with TPM","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configuretpmstartupkeyusagedropdown_name_0","displayName":"Do not allow startup key with TPM","description":null,"helpText":null}]},{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configuretpmusagedropdown_name","displayName":"Configure TPM startup:","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp"],"options":[{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configuretpmusagedropdown_name_2","displayName":"Allow TPM","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configuretpmusagedropdown_name_1","displayName":"Require TPM","description":null,"helpText":null},{"id":"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication_configuretpmusagedropdown_name_0","displayName":"Do not allow TPM","description":null,"helpText":null}]},{"id":"device_vendor_msft_clouddesktop_boottocloudpcenhanced","displayName":"Boot To Cloud PC Enhanced","description":"This node allows to configure different kinds of Boot to Cloud mode. Boot to cloud mode enables users to seamlessly sign-in to a Cloud PC. For using this feature, Cloud Provider application must be installed on the PC and the user must have a Cloud PC provisioned. This node supports the below options: 0. Not Configured. 1. Enable Boot to Cloud Shared PC Mode: Boot to Cloud Shared PC mode allows multiple users to sign-in on the device and use for shared purpose. 2. Enable Boot to Cloud Dedicated Mode (Cloud only): Dedicated mode allows user to sign-in on the device using various authentication mechanism configured by their organization (For ex. PIN, Biometrics etc). This mode preserves user personalization, including their profile picture and username in local machine, and facilitates fast account switching.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/CloudDesktop-csp/"],"options":[{"id":"device_vendor_msft_clouddesktop_boottocloudpcenhanced_0","displayName":"Not Configured","description":"Not Configured","helpText":null},{"id":"device_vendor_msft_clouddesktop_boottocloudpcenhanced_1","displayName":"Enable Boot to Cloud Shared PC Mode","description":"Enable Boot to Cloud Shared PC Mode","helpText":null},{"id":"device_vendor_msft_clouddesktop_boottocloudpcenhanced_2","displayName":"Enable Boot to Cloud Dedicated Mode (Cloud only)","description":"Enable Boot to Cloud Dedicated Mode (Cloud only)","helpText":null}]},{"id":"device_vendor_msft_clouddesktop_enableboottocloudsharedpcmode","displayName":"[Deprecated] Enable Boot To Cloud Shared PC Mode","description":"Setting this node to \"true\" configures boot to cloud for Shared PC mode. Boot to cloud mode enables users to seamlessly sign-in to a Cloud PC. Shared PC mode allows multiple users to sign-in on the device and use for shared purpose. For enabling boot to cloud shared pc feature, Cloud Provider application must be installed on the PC and the user must have a Cloud PC provisioned.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/CloudDesktop-csp/"],"options":[{"id":"device_vendor_msft_clouddesktop_enableboottocloudsharedpcmode_false","displayName":"Not configured","description":"Not configured","helpText":null},{"id":"device_vendor_msft_clouddesktop_enableboottocloudsharedpcmode_true","displayName":"Boot to cloud shared pc mode enabled","description":"Boot to cloud shared pc mode enabled","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_allowdatagramprocessingonwinserver","displayName":"Allow Datagram Processing On Win Server","description":"This settings controls whether Network Protection is allowed to enable datagram processing on Windows Server. If false, the value of DisableDatagramProcessing will be ignored and default to disabling Datagram inspection.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_allowdatagramprocessingonwinserver_1","displayName":"Datagram processing on Windows Server is enabled.","description":"Datagram processing on Windows Server is enabled.","helpText":null},{"id":"device_vendor_msft_defender_configuration_allowdatagramprocessingonwinserver_0","displayName":"Datagram processing on Windows Server is disabled.","description":"Datagram processing on Windows Server is disabled.","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_allownetworkprotectiondownlevel","displayName":"Allow Network Protection Down Level","description":"This settings controls whether Network Protection is allowed to be configured into block or audit mode on windows downlevel of RS3. If false, the value of EnableNetworkProtection will be ignored.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_allownetworkprotectiondownlevel_1","displayName":"Network protection will be enabled downlevel.","description":"Network protection will be enabled downlevel.","helpText":null},{"id":"device_vendor_msft_defender_configuration_allownetworkprotectiondownlevel_0","displayName":"Network protection will be disabled downlevel.","description":"Network protection will be disabled downlevel.","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_allownetworkprotectiononwinserver","displayName":"Allow Network Protection On Win Server","description":"This settings controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server. If false, the value of EnableNetworkProtection will be ignored.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_allownetworkprotectiononwinserver_1","displayName":"Allow","description":"Allow","helpText":null},{"id":"device_vendor_msft_defender_configuration_allownetworkprotectiononwinserver_0","displayName":"Disallow","description":"Disallow","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_allowswitchtoasyncinspection","displayName":"Allow Switch To Async Inspection","description":"Control whether network protection can improve performance by switching from real-time inspection to asynchronous inspection","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_allowswitchtoasyncinspection_1","displayName":"Allow switching to asynchronous inspection","description":"Allow switching to asynchronous inspection","helpText":null},{"id":"device_vendor_msft_defender_configuration_allowswitchtoasyncinspection_0","displayName":"Don’t allow asynchronous inspection","description":"Don’t allow asynchronous inspection","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_archivemaxdepth","displayName":"Archive Max Depth","description":"Specify the maximum folder depth to extract from archive files for scanning. If this configuration is off or not set, the default value (0) is applied, and all archives are extracted up to the deepest folder for scanning.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":null},{"id":"device_vendor_msft_defender_configuration_archivemaxsize","displayName":"Archive Max Size","description":"Specify the maximum size, in KB, of archive files to be extracted and scanned. If this configuration is off or not set, the default value (0) is applied, and all archives are extracted and scanned regardless of size.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":null},{"id":"device_vendor_msft_defender_configuration_asronlyperruleexclusions","displayName":"ASR Only Per Rule Exclusions","description":"Apply ASR only per rule exclusions.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":null},{"id":"device_vendor_msft_defender_configuration_behavioralnetworkblocks_remoteencryptionprotection_remoteencryptionprotectionaggressiveness","displayName":"Remote Encryption Protection Aggressiveness","description":"Set the criteria for when Remote Encryption Protection blocks IP addresses.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_behavioralnetworkblocks_remoteencryptionprotection_remoteencryptionprotectionaggressiveness_0","displayName":"Low: Block only when confidence level is 100% (Default)","description":"Low: Block only when confidence level is 100% (Default)","helpText":null},{"id":"device_vendor_msft_defender_configuration_behavioralnetworkblocks_remoteencryptionprotection_remoteencryptionprotectionaggressiveness_1","displayName":"Medium: Use cloud aggregation and block when confidence level is above 99%","description":"Medium: Use cloud aggregation and block when confidence level is above 99%","helpText":null},{"id":"device_vendor_msft_defender_configuration_behavioralnetworkblocks_remoteencryptionprotection_remoteencryptionprotectionaggressiveness_2","displayName":"High: Use cloud intel and context, and block when confidence level is above 90%","description":"High: Use cloud intel and context, and block when confidence level is above 90%","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_behavioralnetworkblocks_remoteencryptionprotection_remoteencryptionprotectionconfiguredstate","displayName":"Remote Encryption Protection Configured State","description":"Remote Encryption Protection in Microsoft Defender Antivirus detects and blocks attempts to replace local files with encrypted versions from another device.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_behavioralnetworkblocks_remoteencryptionprotection_remoteencryptionprotectionconfiguredstate_0","displayName":"Not configured: Apply defaults set for the antivirus engine and platform","description":"Not configured: Apply defaults set for the antivirus engine and platform","helpText":null},{"id":"device_vendor_msft_defender_configuration_behavioralnetworkblocks_remoteencryptionprotection_remoteencryptionprotectionconfiguredstate_1","displayName":"Block: Prevent suspicious and malicious behaviors","description":"Block: Prevent suspicious and malicious behaviors","helpText":null},{"id":"device_vendor_msft_defender_configuration_behavioralnetworkblocks_remoteencryptionprotection_remoteencryptionprotectionconfiguredstate_2","displayName":"Audit: Generate EDR detections without blocking","description":"Audit: Generate EDR detections without blocking","helpText":null},{"id":"device_vendor_msft_defender_configuration_behavioralnetworkblocks_remoteencryptionprotection_remoteencryptionprotectionconfiguredstate_4","displayName":"Off: Feature is off with no performance impact","description":"Off: Feature is off with no performance impact","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_behavioralnetworkblocks_remoteencryptionprotection_remoteencryptionprotectionexclusions","displayName":"Remote Encryption Protection Exclusions","description":"Specify IP addresses, subnets, or workstation names to exclude from being blocked by Remote Encryption Protection. Note that attackers can spoof excluded addresses and names to bypass protection.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":null},{"id":"device_vendor_msft_defender_configuration_behavioralnetworkblocks_remoteencryptionprotection_remoteencryptionprotectionmaxblocktime","displayName":"Remote Encryption Protection Max Block Time","description":"Set the maximum time an IP address is blocked by Remote Encryption Protection. After this time, blocked IP addresses will be able to reinitiate connections. If set to 0, internal feature logic will determine blocking time.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":null},{"id":"device_vendor_msft_defender_configuration_dataduplicationdirectory","displayName":"Data Duplication Directory","description":"Define data duplication directory for device control.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":null},{"id":"device_vendor_msft_defender_configuration_dataduplicationlocalretentionperiod","displayName":"Data Duplication Local Retention Period","description":"Define the retention period in days of how much time the evidence data will be kept on the client machine should any transfer to the remote locations would occur.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":null},{"id":"device_vendor_msft_defender_configuration_dataduplicationmaximumquota","displayName":"Data Duplication Maximum Quota","description":"Defines the maximum data duplication quota in MB that can be collected. When the quota is reached the filter will stop duplicating any data until the service manages to dispatch the existing collected data, thus decreasing the quota again below the maximum. The valid interval is [5-5000] MB. By default, the maximum quota will be 500 MB.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":null},{"id":"device_vendor_msft_defender_configuration_dataduplicationremotelocation","displayName":"Data Duplication Remote Location","description":"Define data duplication remote location for Device Control. When configuring this setting, ensure that Device Control is Enabled and that the provided path is a remote path the user can access.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":null},{"id":"device_vendor_msft_defender_configuration_daysuntilaggressivecatchupquickscan","displayName":"Days Until Aggressive Catchup Quick Scan","description":"Configure how many days can pass before an aggressive catchup quick scan is triggered. Valid values are 0 and [7-60]. Configuring this setting to 0 will disable aggressive catchup quick scans. By default, these scans will run every 30 days when enabled. These scans are only enabled if catchup scans (quick and full) are disabled, and Microsoft Defender Antivirus is not in Passive mode.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":null},{"id":"device_vendor_msft_defender_configuration_defaultenforcement","displayName":"Default Enforcement","description":"Control Device Control default enforcement. This is the enforcement applied if there are no policy rules present or at the end of the policy rules evaluation none were matched.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_defaultenforcement_1","displayName":"Default Allow Enforcement","description":"Default Allow Enforcement","helpText":null},{"id":"device_vendor_msft_defender_configuration_defaultenforcement_2","displayName":"Default Deny Enforcement","description":"Default Deny Enforcement","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}","displayName":"ID","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control"],"options":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata","displayName":"Policy rule","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control"],"options":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry","displayName":"Access","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control"],"options":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_accesmask","displayName":"Access mask","description":"Defines the access.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control"],"options":[{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_accesmask_1","displayName":"Read","description":"","helpText":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_accesmask_2","displayName":"Write","description":"","helpText":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_accesmask_4","displayName":"Execute","description":"","helpText":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_accesmask_8","displayName":"File read","description":"","helpText":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_accesmask_16","displayName":"File write","description":"","helpText":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_accesmask_32","displayName":"File execute","description":"","helpText":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_accesmask_64","displayName":"Print","description":"","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_computersid","displayName":"Computer Sid","description":"Local computer Sid or computer Sid group or the Sid of the AD object, defines whether to apply this policy over a specific machine or machine group; one entry can have a maximum of one ComputerSid and an entry without any ComputerSid means applying the policy over the machine. If you want to apply an Entry to a specific user and specific machine, add both Sid and ComputerSid into the same Entry.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control"],"options":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_id","displayName":"ID","description":"One PolicyRule can have multiple entries; each entry with a unique GUID tells Device Control one restriction.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control"],"options":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_options","displayName":"Options","description":"Defines whether to display notification or not.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control"],"options":[{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_options_0","displayName":"None","description":"","helpText":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_options_1","displayName":"Show notification","description":"","helpText":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_options_2","displayName":"Send event","description":"","helpText":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_options_3","displayName":"Send notification and event","description":"","helpText":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_options_4","displayName":"Disable","description":"","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_sid","displayName":"Sid","description":"Local user Sid or user Sid group or the Sid of the AD object, defines whether to apply this policy over a specific user or user group; one entry can have a maximum of one Sid and an entry without any Sid means applying the policy over the machine.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control"],"options":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_type","displayName":"Type","description":"Defines the action for the removable storage groups in IncludedIDList\nEnforcement: Allow or Deny\nAudit: AuditAllowed or AuditDenied","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control"],"options":[{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_type_allow","displayName":"Allow","description":null,"helpText":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_type_deny","displayName":"Deny","description":null,"helpText":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_type_auditallowed","displayName":"Audit Allowed","description":null,"helpText":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_entry_type_auditdenied","displayName":"Audit Denied","description":null,"helpText":null}]},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_excludedidlist","displayName":"Excluded Devices","description":"The group(s) that the policy will not be applied to.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control"],"options":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_excludedidlist_groupid","displayName":"Excluded Devices","description":"The group(s) that the policy will not be applied to.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control"],"options":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_id","displayName":"ID","description":"GUID, a unique ID, represents the policy and will be used in the reporting and troubleshooting.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control"],"options":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_includedidlist","displayName":"Included Devices","description":"The group(s) that the policy will be applied to. If multiple groups are added, the policy will be applied to any media in all those groups.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control"],"options":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_includedidlist_groupid","displayName":"Included Devices","description":"The group(s) that the policy will be applied to. If multiple groups are added, the policy will be applied to any media in all those groups.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control"],"options":null},{"id":"device_vendor_msft_defender_configuration_devicecontrol_policyrules_{ruleid}_ruledata_name","displayName":"Name","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control"],"options":null},{"id":"device_vendor_msft_defender_configuration_devicecontrolenabled","displayName":"Device Control Enabled","description":"Control Device Control feature.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_devicecontrolenabled_1","displayName":"Device Control is enabled","description":"Device Control is enabled","helpText":null},{"id":"device_vendor_msft_defender_configuration_devicecontrolenabled_0","displayName":"Device Control is disabled","description":"Device Control is disabled","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_disablecachemaintenance","displayName":"Disable Cache Maintenance","description":"Defines whether the cache maintenance idle task will perform the cache maintenance or not.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_disablecachemaintenance_1","displayName":"Cache maintenance is disabled","description":"Cache maintenance is disabled","helpText":null},{"id":"device_vendor_msft_defender_configuration_disablecachemaintenance_0","displayName":"Cache maintenance is enabled (default)","description":"Cache maintenance is enabled (default)","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_disablecoreserviceecsintegration","displayName":"Disable Core Service ECS Integration","description":"Turn off ECS integration for Defender core service","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_disablecoreserviceecsintegration_0","displayName":"The Defender core service will use the Experimentation and Configuration Service (ECS) to rapidly deliver critical, org-specific fixes.","description":"The Defender core service will use the Experimentation and Configuration Service (ECS) to rapidly deliver critical, org-specific fixes.","helpText":null},{"id":"device_vendor_msft_defender_configuration_disablecoreserviceecsintegration_1","displayName":"The Defender core service stops using the Experimentation and Configuration Service (ECS). Fixes will continue to be delivered through security intelligence updates.","description":"The Defender core service stops using the Experimentation and Configuration Service (ECS). Fixes will continue to be delivered through security intelligence updates.","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_disablecoreservicetelemetry","displayName":"Disable Core Service Telemetry","description":"Turn off OneDsCollector telemetry for Defender core service","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_disablecoreservicetelemetry_0","displayName":"The Defender core service will use the OneDsCollector framework to rapidly collect telemetry.","description":"The Defender core service will use the OneDsCollector framework to rapidly collect telemetry.","helpText":null},{"id":"device_vendor_msft_defender_configuration_disablecoreservicetelemetry_1","displayName":"The Defender core service stops using the OneDsCollector framework to rapidly collect telemetry, impacting Microsoft's ability to quickly recognize and address poor performance, false positives, and other problems.","description":"The Defender core service stops using the OneDsCollector framework to rapidly collect telemetry, impacting Microsoft's ability to quickly recognize and address poor performance, false positives, and other problems.","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_disablecputhrottleonidlescans","displayName":"Disable Cpu Throttle On Idle Scans","description":"Indicates whether the CPU will be throttled for scheduled scans while the device is idle. This feature is enabled by default and will not throttle the CPU for scheduled scans performed when the device is otherwise idle, regardless of what ScanAvgCPULoadFactor is set to. For all other scheduled scans this flag will have no impact and normal throttling will occur.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_disablecputhrottleonidlescans_1","displayName":"Disable CPU Throttle on idle scans","description":"Disable CPU Throttle on idle scans","helpText":null},{"id":"device_vendor_msft_defender_configuration_disablecputhrottleonidlescans_0","displayName":"Enable CPU Throttle on idle scans","description":"Enable CPU Throttle on idle scans","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_disabledatagramprocessing","displayName":"Disable Datagram Processing","description":"Control whether network protection inspects User Datagram Protocol (UDP) traffic","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_disabledatagramprocessing_1","displayName":"UDP inspection is off","description":"UDP inspection is off","helpText":null},{"id":"device_vendor_msft_defender_configuration_disabledatagramprocessing_0","displayName":"UDP inspection is on","description":"UDP inspection is on","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_disablednsovertcpparsing","displayName":"Disable Dns Over Tcp Parsing","description":"This setting disables DNS over TCP Parsing for Network Protection.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_disablednsovertcpparsing_1","displayName":"DNS over TCP parsing is disabled","description":"DNS over TCP parsing is disabled","helpText":null},{"id":"device_vendor_msft_defender_configuration_disablednsovertcpparsing_0","displayName":"DNS over TCP parsing is enabled","description":"DNS over TCP parsing is enabled","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_disablednsparsing","displayName":"Disable Dns Parsing","description":"This setting disables DNS Parsing for Network Protection.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_disablednsparsing_1","displayName":"DNS parsing is disabled","description":"DNS parsing is disabled","helpText":null},{"id":"device_vendor_msft_defender_configuration_disablednsparsing_0","displayName":"DNS parsing is enabled","description":"DNS parsing is enabled","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_disableftpparsing","displayName":"Disable Ftp Parsing","description":"This setting disables FTP Parsing for Network Protection.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_disableftpparsing_1","displayName":"FTP parsing is disabled","description":"FTP parsing is disabled","helpText":null},{"id":"device_vendor_msft_defender_configuration_disableftpparsing_0","displayName":"FTP parsing is enabled","description":"FTP parsing is enabled","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_disablegradualrelease","displayName":"Disable Gradual Release","description":"Enable this policy to disable gradual rollout of Defender updates.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_disablegradualrelease_1","displayName":"Gradual release is disabled","description":"Gradual release is disabled","helpText":null},{"id":"device_vendor_msft_defender_configuration_disablegradualrelease_0","displayName":"Gradual release is enabled","description":"Gradual release is enabled","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_disablehttpparsing","displayName":"Disable Http Parsing","description":"This setting disables HTTP Parsing for Network Protection.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_disablehttpparsing_1","displayName":"HTTP parsing is disabled","description":"HTTP parsing is disabled","helpText":null},{"id":"device_vendor_msft_defender_configuration_disablehttpparsing_0","displayName":"HTTP parsing is enabled","description":"HTTP parsing is enabled","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_disableinboundconnectionfiltering","displayName":"Disable Inbound Connection Filtering","description":"This setting disables Inbound connection filtering for Network Protection.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_disableinboundconnectionfiltering_1","displayName":"Inbound connection filtering is disabled","description":"Inbound connection filtering is disabled","helpText":null},{"id":"device_vendor_msft_defender_configuration_disableinboundconnectionfiltering_0","displayName":"Inbound connection filtering is enabled","description":"Inbound connection filtering is enabled","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_disablelocaladminmerge","displayName":"Disable Local Admin Merge","description":"When this value is set to false, it allows a local admin the ability to specify some settings for complex list type that will then merge /override the Preference settings with the Policy settings","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_disablelocaladminmerge_0","displayName":"Enable Local Admin Merge","description":"Enable Local Admin Merge","helpText":null},{"id":"device_vendor_msft_defender_configuration_disablelocaladminmerge_1","displayName":"Disable Local Admin Merge","description":"Disable Local Admin Merge","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_disablenetworkprotectionperftelemetry","displayName":"Disable Network Protection Perf Telemetry","description":"This setting disables the gathering and send of performance telemetry from Network Protection.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_disablenetworkprotectionperftelemetry_1","displayName":"Network protection telemetry is disabled","description":"Network protection telemetry is disabled","helpText":null},{"id":"device_vendor_msft_defender_configuration_disablenetworkprotectionperftelemetry_0","displayName":"Network protection telemetry is enabled","description":"Network protection telemetry is enabled","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_disablequicparsing","displayName":"Disable Quic Parsing","description":"This setting disables QUIC Parsing for Network Protection.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_disablequicparsing_1","displayName":"QUIC parsing is disabled","description":"QUIC parsing is disabled","helpText":null},{"id":"device_vendor_msft_defender_configuration_disablequicparsing_0","displayName":"QUIC parsing is enabled","description":"QUIC parsing is enabled","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_disablerdpparsing","displayName":"Disable Rdp Parsing","description":"This setting disables RDP Parsing for Network Protection.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_disablerdpparsing_1","displayName":"RDP Parsing is disabled","description":"RDP Parsing is disabled","helpText":null},{"id":"device_vendor_msft_defender_configuration_disablerdpparsing_0","displayName":"RDP Parsing is enabled","description":"RDP Parsing is enabled","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_disablesmtpparsing","displayName":"Disable Smtp Parsing","description":"This setting disables SMTP Parsing for Network Protection.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_disablesmtpparsing_1","displayName":"SMTP parsing is disabled","description":"SMTP parsing is disabled","helpText":null},{"id":"device_vendor_msft_defender_configuration_disablesmtpparsing_0","displayName":"SMTP parsing is enabled","description":"SMTP parsing is enabled","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_disablesshparsing","displayName":"Disable Ssh Parsing","description":"This setting disables SSH Parsing for Network Protection.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_disablesshparsing_1","displayName":"SSH parsing is disabled","description":"SSH parsing is disabled","helpText":null},{"id":"device_vendor_msft_defender_configuration_disablesshparsing_0","displayName":"SSH parsing is enabled","description":"SSH parsing is enabled","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_disabletlsparsing","displayName":"Disable Tls Parsing","description":"This setting disables TLS Parsing for Network Protection.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_disabletlsparsing_1","displayName":"TLS parsing is disabled","description":"TLS parsing is disabled","helpText":null},{"id":"device_vendor_msft_defender_configuration_disabletlsparsing_0","displayName":"TLS parsing is enabled","description":"TLS parsing is enabled","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_enableconvertwarntoblock","displayName":"Enable Convert Warn To Block","description":"This setting controls whether network protection blocks network traffic instead of displaying a warning","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_enableconvertwarntoblock_1","displayName":"Warn verdicts are converted to block","description":"Warn verdicts are converted to block","helpText":null},{"id":"device_vendor_msft_defender_configuration_enableconvertwarntoblock_0","displayName":"Warn verdicts are not converted to block","description":"Warn verdicts are not converted to block","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_enablednssinkhole","displayName":"[Deprecated] Enable Dns Sinkhole","description":"This setting is deprecated and no longer has impact on devices. This setting enables the DNS Sinkhole feature for Network Protection, respecting the value of EnableNetworkProtection for block vs audit, does nothing in inspect mode.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_enablednssinkhole_0","displayName":"DNS Sinkhole is disabled","description":"DNS Sinkhole is disabled","helpText":null},{"id":"device_vendor_msft_defender_configuration_enablednssinkhole_1","displayName":"DNS Sinkhole is enabled","description":"DNS Sinkhole is enabled","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_enablefilehashcomputation","displayName":"Enable File Hash Computation","description":"Enables or disables file hash computation feature. When this feature is enabled Windows defender will compute hashes for files it scans.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_enablefilehashcomputation_0","displayName":"Disable","description":"Disable","helpText":null},{"id":"device_vendor_msft_defender_configuration_enablefilehashcomputation_1","displayName":"Enable","description":"Enable","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_enableudpreceiveoffload","displayName":"Enable Udp Receive Offload","description":"This setting enables Udp Receive Offload Network Protection.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_enableudpreceiveoffload_0","displayName":"Udp Receive Offload is disabled","description":"Udp Receive Offload is disabled","helpText":null},{"id":"device_vendor_msft_defender_configuration_enableudpreceiveoffload_1","displayName":"Udp Receive Offload is enabled","description":"Udp Receive Offload is enabled","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_enableudpsegmentationoffload","displayName":"Enable Udp Segmentation Offload","description":"This setting enables Udp Segmentation Offload Network Protection.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_enableudpsegmentationoffload_0","displayName":"Udp Segmentation Offload is disabled","description":"Udp Segmentation Offload is disabled","helpText":null},{"id":"device_vendor_msft_defender_configuration_enableudpsegmentationoffload_1","displayName":"Udp Segmentation Offload is enabled","description":"Udp Segmentation Offload is enabled","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_engineupdateschannel","displayName":"Engine Updates Channel","description":"Enable this policy to specify when devices receive Microsoft Defender engine updates during the monthly gradual rollout.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_engineupdateschannel_0","displayName":"Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices.","description":"Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices.","helpText":null},{"id":"device_vendor_msft_defender_configuration_engineupdateschannel_2","displayName":"Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices.","description":"Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices.","helpText":null},{"id":"device_vendor_msft_defender_configuration_engineupdateschannel_3","displayName":"Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments.","description":"Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments.","helpText":null},{"id":"device_vendor_msft_defender_configuration_engineupdateschannel_4","displayName":"Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%).","description":"Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%).","helpText":null},{"id":"device_vendor_msft_defender_configuration_engineupdateschannel_5","displayName":"Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%).","description":"Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%).","helpText":null},{"id":"device_vendor_msft_defender_configuration_engineupdateschannel_6","displayName":"Critical - Time delay: Devices will be offered updates with a 48-hour delay. Suggested for critical environments only.","description":"Critical - Time delay: Devices will be offered updates with a 48-hour delay. Suggested for critical environments only.","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_excludedipaddresses","displayName":"Excluded Ip Addresses","description":"Allows an administrator to explicitly disable network packet inspection made by wdnisdrv on a particular set of IP addresses.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":null},{"id":"device_vendor_msft_defender_configuration_hideexclusionsfromlocaladmins","displayName":"Hide Exclusions From Local Admins","description":"This policy setting controls whether or not exclusions are visible to local admins. To control local users exlcusions visibility use HideExclusionsFromLocalUsers. If HideExclusionsFromLocalAdmins is set then HideExclusionsFromLocalUsers will be implicitly set.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_hideexclusionsfromlocaladmins_1","displayName":"If you enable this setting, local admins will no longer be able to see the exclusion list in Windows Security App or via PowerShell.","description":"If you enable this setting, local admins will no longer be able to see the exclusion list in Windows Security App or via PowerShell.","helpText":null},{"id":"device_vendor_msft_defender_configuration_hideexclusionsfromlocaladmins_0","displayName":"If you disable or do not configure this setting, local admins will be able to see exclusions in the Windows Security App and via PowerShell.","description":"If you disable or do not configure this setting, local admins will be able to see exclusions in the Windows Security App and via PowerShell.","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_hideexclusionsfromlocalusers","displayName":"Hide Exclusions From Local Users","description":"This policy setting controls whether or not exclusions are visible to local users. If HideExclusionsFromLocalAdmins is set then this policy will be implicitly set.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_hideexclusionsfromlocalusers_1","displayName":"If you enable this setting, local users will no longer be able to see the exclusion list in Windows Security App or via PowerShell.","description":"If you enable this setting, local users will no longer be able to see the exclusion list in Windows Security App or via PowerShell.","helpText":null},{"id":"device_vendor_msft_defender_configuration_hideexclusionsfromlocalusers_0","displayName":"If you disable or do not configure this setting, local users will be able to see exclusions in the Windows Security App and via PowerShell.","description":"If you disable or do not configure this setting, local users will be able to see exclusions in the Windows Security App and via PowerShell.","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_inteltdtenabled","displayName":"Intel TDT Enabled","description":"This policy setting configures the Intel TDT integration level for Intel TDT-capable devices.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_inteltdtenabled_0","displayName":"If you do not configure this setting, the default value will be applied. The default value is controlled by Microsoft security intelligence updates. Microsoft will enable Intel TDT if there is a known threat.","description":"If you do not configure this setting, the default value will be applied. The default value is controlled by Microsoft security intelligence updates. Microsoft will enable Intel TDT if there is a known threat.","helpText":null},{"id":"device_vendor_msft_defender_configuration_inteltdtenabled_1","displayName":"If you configure this setting to enabled, Intel TDT integration will turn on.","description":"If you configure this setting to enabled, Intel TDT integration will turn on.","helpText":null},{"id":"device_vendor_msft_defender_configuration_inteltdtenabled_2","displayName":"If you configure this setting to disabled, Intel TDT integration will turn off.","description":"If you configure this setting to disabled, Intel TDT integration will turn off.","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_meteredconnectionupdates","displayName":"Metered Connection Updates","description":"Allow managed devices to update through metered connections. Default is 0 - not allowed, 1 - allowed","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_meteredconnectionupdates_1","displayName":"Allowed","description":"Allowed","helpText":null},{"id":"device_vendor_msft_defender_configuration_meteredconnectionupdates_0","displayName":"Not Allowed","description":"Not Allowed","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_networkprotectionreputationmode","displayName":"Network Protection Reputation Mode","description":"This sets the reputation mode engine for Network Protection.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_networkprotectionreputationmode_0","displayName":"Use standard reputation engine","description":"Use standard reputation engine","helpText":null},{"id":"device_vendor_msft_defender_configuration_networkprotectionreputationmode_1","displayName":"Use ESP reputation engine","description":"Use ESP reputation engine","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_oobeenablertpandsigupdate","displayName":"Oobe Enable Rtp And Sig Update","description":"This setting allows you to configure whether real-time protection and Security Intelligence Updates are enabled during OOBE (Out of Box experience).","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_oobeenablertpandsigupdate_1","displayName":"If you enable this setting, real-time protection and Security Intelligence Updates are enabled during OOBE.","description":"If you enable this setting, real-time protection and Security Intelligence Updates are enabled during OOBE.","helpText":null},{"id":"device_vendor_msft_defender_configuration_oobeenablertpandsigupdate_0","displayName":"If you either disable or do not configure this setting, real-time protection and Security Intelligence Updates during OOBE is not enabled.","description":"If you either disable or do not configure this setting, real-time protection and Security Intelligence Updates during OOBE is not enabled.","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_passiveremediation","displayName":"Passive Remediation","description":"Setting to control automatic remediation for Sense scans.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_passiveremediation_0","displayName":"Passive Remediation is turned off (default)","description":"Passive Remediation is turned off (default)","helpText":null},{"id":"device_vendor_msft_defender_configuration_passiveremediation_1","displayName":"PASSIVEREMEDIATIONFLAGSENSEAUTOREMEDIATION: Passive Remediation Sense AutoRemediation","description":"PASSIVE_REMEDIATION_FLAG_SENSE_AUTO_REMEDIATION: Passive Remediation Sense AutoRemediation","helpText":null},{"id":"device_vendor_msft_defender_configuration_passiveremediation_2","displayName":"PASSIVEREMEDIATIONFLAGRTPAUDIT: Passive Remediation Realtime Protection Audit","description":"PASSIVE_REMEDIATION_FLAG_RTP_AUDIT: Passive Remediation Realtime Protection Audit","helpText":null},{"id":"device_vendor_msft_defender_configuration_passiveremediation_4","displayName":"PASSIVEREMEDIATIONFLAGRTPREMEDIATION: Passive Remediation Realtime Protection Remediation","description":"PASSIVE_REMEDIATION_FLAG_RTP_REMEDIATION: Passive Remediation Realtime Protection Remediation","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_performancemodestatus","displayName":"Performance Mode Status","description":"This setting allows IT admins to configure performance mode in either enabled or disabled mode for managed devices.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_performancemodestatus_0","displayName":"Performance mode is enabled (default). A service restart is required after changing this value.","description":"Performance mode is enabled (default). A service restart is required after changing this value.","helpText":null},{"id":"device_vendor_msft_defender_configuration_performancemodestatus_1","displayName":"Performance mode is disabled. A service restart is required after changing this value.","description":"Performance mode is disabled. A service restart is required after changing this value.","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_platformupdateschannel","displayName":"Platform Updates Channel","description":"Enable this policy to specify when devices receive Microsoft Defender platform updates during the monthly gradual rollout.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_platformupdateschannel_0","displayName":"Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices.","description":"Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices.","helpText":null},{"id":"device_vendor_msft_defender_configuration_platformupdateschannel_2","displayName":"Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices.","description":"Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices.","helpText":null},{"id":"device_vendor_msft_defender_configuration_platformupdateschannel_3","displayName":"Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments.","description":"Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments.","helpText":null},{"id":"device_vendor_msft_defender_configuration_platformupdateschannel_4","displayName":"Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%).","description":"Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%).","helpText":null},{"id":"device_vendor_msft_defender_configuration_platformupdateschannel_5","displayName":"Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%).","description":"Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%).","helpText":null},{"id":"device_vendor_msft_defender_configuration_platformupdateschannel_6","displayName":"Critical - Time delay: Devices will be offered updates with a 48-hour delay. Suggested for critical environments only.","description":"Critical - Time delay: Devices will be offered updates with a 48-hour delay. Suggested for critical environments only.","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_quickscanincludeexclusions","displayName":"Quick Scan Include Exclusions","description":"This setting allows you to scan excluded files and directories during quick scans.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_quickscanincludeexclusions_0","displayName":"If you set this setting to 0 or do not configure it, exclusions are not scanned during quick scans.","description":"If you set this setting to 0 or do not configure it, exclusions are not scanned during quick scans.","helpText":null},{"id":"device_vendor_msft_defender_configuration_quickscanincludeexclusions_1","displayName":"If you set this setting to 1, all files and directories that are excluded from real-time protection using contextual exclusions are scanned during a quick scan.","description":"If you set this setting to 1, all files and directories that are excluded from real-time protection using contextual exclusions are scanned during a quick scan.","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_randomizescheduletasktimes","displayName":"Randomize Schedule Task Times","description":"In Microsoft Defender Antivirus, randomize the start time of the scan to any interval from 0 to 23 hours. This can be useful in virtual machines or VDI deployments.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_randomizescheduletasktimes_1","displayName":"Widen or narrow the randomization period for scheduled scans. Specify a randomization window of between 1 and 23 hours by using the setting SchedulerRandomizationTime.","description":"Widen or narrow the randomization period for scheduled scans. Specify a randomization window of between 1 and 23 hours by using the setting SchedulerRandomizationTime.","helpText":null},{"id":"device_vendor_msft_defender_configuration_randomizescheduletasktimes_0","displayName":"Scheduled tasks will not be randomized.","description":"Scheduled tasks will not be randomized.","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_reporting_enabledynamicsignaturedroppedeventreporting","displayName":"Enable Dynamic Signature Dropped Event Reporting","description":"This setting controls whether to report a Dynamic Security Intelligence Update dropped event. By default, such events are not reported.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_reporting_enabledynamicsignaturedroppedeventreporting_0","displayName":"Dynamic Security intelligence update dropped events will not be reported.","description":"Dynamic Security intelligence update dropped events will not be reported.","helpText":null},{"id":"device_vendor_msft_defender_configuration_reporting_enabledynamicsignaturedroppedeventreporting_1","displayName":"Dynamic Security intelligence update events will be reported.","description":"Dynamic Security intelligence update events will be reported.","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_scanonlyifidleenabled","displayName":"Scan Only If Idle Enabled","description":"In Microsoft Defender Antivirus, this setting will run scheduled scans only if the system is idle.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_scanonlyifidleenabled_1","displayName":"Runs scheduled scans only if the system is idle.","description":"Runs scheduled scans only if the system is idle.","helpText":null},{"id":"device_vendor_msft_defender_configuration_scanonlyifidleenabled_0","displayName":"Runs scheduled scans regardless of whether the system is idle.","description":"Runs scheduled scans regardless of whether the system is idle.","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_schedulerrandomizationtime","displayName":"Scheduler Randomization Time","description":"This setting allows you to configure the scheduler randomization in hours. The randomization interval is [1 - 23] hours. For more information on the randomization effect please check the RandomizeScheduleTaskTimes setting.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":null},{"id":"device_vendor_msft_defender_configuration_schedulesecurityintelligenceupdateday","displayName":"Schedule Security Intelligence Update Day","description":"This setting allows you to specify the day of the week on which to check for security intelligence updates. By default, this setting is configured to never check for security intelligence updates.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_schedulesecurityintelligenceupdateday_0","displayName":"Daily","description":"Daily","helpText":null},{"id":"device_vendor_msft_defender_configuration_schedulesecurityintelligenceupdateday_1","displayName":"Sunday","description":"Sunday","helpText":null},{"id":"device_vendor_msft_defender_configuration_schedulesecurityintelligenceupdateday_2","displayName":"Monday","description":"Monday","helpText":null},{"id":"device_vendor_msft_defender_configuration_schedulesecurityintelligenceupdateday_3","displayName":"Tuesday","description":"Tuesday","helpText":null},{"id":"device_vendor_msft_defender_configuration_schedulesecurityintelligenceupdateday_4","displayName":"Wednesday","description":"Wednesday","helpText":null},{"id":"device_vendor_msft_defender_configuration_schedulesecurityintelligenceupdateday_5","displayName":"Thursday","description":"Thursday","helpText":null},{"id":"device_vendor_msft_defender_configuration_schedulesecurityintelligenceupdateday_6","displayName":"Friday","description":"Friday","helpText":null},{"id":"device_vendor_msft_defender_configuration_schedulesecurityintelligenceupdateday_7","displayName":"Saturday","description":"Saturday","helpText":null},{"id":"device_vendor_msft_defender_configuration_schedulesecurityintelligenceupdateday_8","displayName":"Never","description":"Never","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_schedulesecurityintelligenceupdatetime","displayName":"Schedule Security Intelligence Update Time","description":"This setting allows you to specify the time of day at which to check for security intelligence updates. The time value is represented as the number of minutes past midnight (00:00). For example, 120 is equivalent to 02:00 AM. By default, this setting is configured to check for security intelligence updates 15 minutes before the scheduled scan time. The schedule is based on local time on the computer where the check is occurring.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":null},{"id":"device_vendor_msft_defender_configuration_secureddevicesconfiguration","displayName":"Secured Devices Configuration","description":"Defines which device's primary ids should be secured by Defender Device Control. The primary id values should be pipe (|) separated. Example: RemovableMediaDevices|CdRomDevices. If this configuration is not set the default value will be applied, meaning all supported devices will be secured. Currently supported primary ids are: RemovableMediaDevices, CdRomDevices, WpdDevices, PrinterDevices.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_secureddevicesconfiguration_removablemediadevices","displayName":"Removable Media Devices","description":"RemovableMediaDevices","helpText":null},{"id":"device_vendor_msft_defender_configuration_secureddevicesconfiguration_cdromdevices","displayName":"Cd Rom Devices","description":"CdRomDevices","helpText":null},{"id":"device_vendor_msft_defender_configuration_secureddevicesconfiguration_wpddevices","displayName":"Wpd Devices","description":"WpdDevices","helpText":null},{"id":"device_vendor_msft_defender_configuration_secureddevicesconfiguration_printerdevices","displayName":"Printer Devices","description":"PrinterDevices","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_securityintelligencelocationupdateatscheduledtimeonly","displayName":"Security Intelligence Location Update At Scheduled Time Only","description":"This setting allows you to configure security intelligence updates according to the scheduler for VDI-configured computers. It is used together with the shared security intelligence location (SecurityIntelligenceLocation).","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_securityintelligencelocationupdateatscheduledtimeonly_1","displayName":"If you enable this setting and configure SecurityIntelligenceLocation, updates from the configured location occur only at the previously configured scheduled update time.","description":"If you enable this setting and configure SecurityIntelligenceLocation, updates from the configured location occur only at the previously configured scheduled update time.","helpText":null},{"id":"device_vendor_msft_defender_configuration_securityintelligencelocationupdateatscheduledtimeonly_0","displayName":"If you either disable or do not configure this setting, updates occur whenever a new security intelligence update is detected at the location that is specified by SecurityIntelligenceLocation.","description":"If you either disable or do not configure this setting, updates occur whenever a new security intelligence update is detected at the location that is specified by SecurityIntelligenceLocation.","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_securityintelligenceupdateschannel","displayName":"Security Intelligence Updates Channel","description":"Enable this policy to specify when devices receive Microsoft Defender security intelligence updates during the daily gradual rollout.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_securityintelligenceupdateschannel_0","displayName":"Not configured (Default). Microsoft will either assign the device to Current Channel (Broad) or a beta channel early in the gradual release cycle. The channel selected by Microsoft might be one that receives updates early during the gradual release cycle, which may not be suitable for devices in a production or critical environment","description":"Not configured (Default). Microsoft will either assign the device to Current Channel (Broad) or a beta channel early in the gradual release cycle. The channel selected by Microsoft might be one that receives updates early during the gradual release cycle, which may not be suitable for devices in a production or critical environment","helpText":null},{"id":"device_vendor_msft_defender_configuration_securityintelligenceupdateschannel_4","displayName":"Current Channel (Staged): Same as Current Channel (Broad).","description":"Current Channel (Staged): Same as Current Channel (Broad).","helpText":null},{"id":"device_vendor_msft_defender_configuration_securityintelligenceupdateschannel_5","displayName":"Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in all populations, including production.","description":"Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in all populations, including production.","helpText":null}]},{"id":"device_vendor_msft_defender_configuration_supportloglocation","displayName":"Support Log Location","description":"The support log location setting allows the administrator to specify where the Microsoft Defender Antivirus diagnostic data collection tool (MpCmdRun.exe) will save the resulting log files. This setting is configured with an MDM solution, such as Intune, and is available for Windows 10 Enterprise.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":null},{"id":"device_vendor_msft_defender_configuration_throttleforscheduledscanonly","displayName":"Throttle For Scheduled Scan Only","description":"A CPU usage limit can be applied to scheduled scans only, or to scheduled and custom scans. The default value applies a CPU usage limit to scheduled scans only.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Defender-csp/"],"options":[{"id":"device_vendor_msft_defender_configuration_throttleforscheduledscanonly_1","displayName":"If you enable this setting, CPU throttling will apply only to scheduled scans.","description":"If you enable this setting, CPU throttling will apply only to scheduled scans.","helpText":null},{"id":"device_vendor_msft_defender_configuration_throttleforscheduledscanonly_0","displayName":"If you disable this setting, CPU throttling will apply to scheduled and custom scans.","description":"If you disable this setting, CPU throttling will apply to scheduled and custom scans.","helpText":null}]},{"id":"device_vendor_msft_dmclient_provider_{providerid}","displayName":" Provider ID","description":"This node contains the URI-encoded value of the bootstrapped device management account’s Provider ID. Scope is dynamic. This value is set and controlled by the MDM server. As a best practice, use text that doesn’t require XML/URI escaping.","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_dmclient_provider_{providerid}_configrefresh_cadence","displayName":"Refresh cadence","description":"This node determines the number of minutes between refreshes.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/DMClient-csp/"],"options":null},{"id":"device_vendor_msft_dmclient_provider_{providerid}_configrefresh_enabled","displayName":"Config refresh","description":"This node determines whether or not a periodic settings refresh for MDM policies will occur.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/DMClient-csp/"],"options":[{"id":"device_vendor_msft_dmclient_provider_{providerid}_configrefresh_enabled_false","displayName":"Disabled.","description":"Disabled.","helpText":null},{"id":"device_vendor_msft_dmclient_provider_{providerid}_configrefresh_enabled_true","displayName":"Enabled.","description":"Enabled.","helpText":null}]},{"id":"device_vendor_msft_email_accountname","displayName":"Account Name","description":"Exchange ActiveSync account name, displayed to user as name of EAS profile.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/email2-csp"],"options":null},{"id":"device_vendor_msft_email_emailaddressattributeaad","displayName":"Email address attribute from AAD","description":"The attribute Intune gets from Azure AD to dynamically generate the email address that will be used by this profile e.g. MyName@contoso.com (UPN).","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/email2-csp"],"options":null},{"id":"device_vendor_msft_email_emailserver","displayName":"Email Server","description":"The Exchange location (URL) of the email server to which the app you specified connects to get email.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/email2-csp"],"options":null},{"id":"device_vendor_msft_email_usernameattributeaad","displayName":"Username attribute from AAD","description":"The attribute Intune gets from Azure AD to dynamically generate the username that will be used by this profile e.g. MyName@contoso.com (UPN) or MyName (username).","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/email2-csp"],"options":null},{"id":"device_vendor_msft_euiccs_{euicc}","displayName":"eSIM","description":"Represents information associated with an eUICC. There is one subtree for each known eUICC, created by the Local Profile Assistant (LPA) when the eUICC is first seen. The node name is the eUICC ID (EID). The node name \"Default\" represents the currently active eUICC.","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_euiccs_{euicc}_downloadservers_{servername}","displayName":"Download Servers","description":"Node representing the discovery operation for a server name. The node name is the fully qualified domain name of the SM-DP+ server that will be used for profile discovery. Creation of this subtree triggers a discovery request.","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_euiccs_{euicc}_downloadservers_{servername}_autoenable","displayName":"Auto Enable","description":"Indicates whether the discovered profile must be enabled automatically after install. This must be set by the MDM when the ServerName subtree is created.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/eUICCs-csp/"],"options":[{"id":"device_vendor_msft_euiccs_{euicc}_downloadservers_{servername}_autoenable_false","displayName":"Disable","description":"Disable","helpText":null},{"id":"device_vendor_msft_euiccs_{euicc}_downloadservers_{servername}_autoenable_true","displayName":"Enable","description":"Enable","helpText":null}]},{"id":"device_vendor_msft_euiccs_{euicc}_downloadservers_{servername}_isdiscoveryserver","displayName":"Is Discovery Server","description":"Indicates whether the server is a discovery server or if it is used for bulk download. A discovery server is used every time a user requests a profile discovery operation. Optional, default value is false.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/eUICCs-csp/"],"options":[{"id":"device_vendor_msft_euiccs_{euicc}_downloadservers_{servername}_isdiscoveryserver_false","displayName":"Is Not Discovery Server","description":"Is Not Discovery Server","helpText":null},{"id":"device_vendor_msft_euiccs_{euicc}_downloadservers_{servername}_isdiscoveryserver_true","displayName":"Is Discovery Server","description":"Is Discovery Server","helpText":null}]},{"id":"device_vendor_msft_euiccs_{euicc}_downloadservers_{servername}_maximumattempts","displayName":"Maximum Attempts (Windows Insiders only)","description":"How many times profile download should be attempted before giving up. A value of 0 indicates unlimited retry attempts. When a value is not specified, it defaults to 50, which is equivalent to about a month of retry attempts.\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/eUICCs-csp/"],"options":null},{"id":"device_vendor_msft_euiccs_{euicc}_downloadservers_{servername}_servername","displayName":"Server Name","description":null,"helpText":null,"infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/eUICCs-csp/"],"options":null},{"id":"device_vendor_msft_euiccs_{euicc}_policies_localuienabled","displayName":"Display Local UI","description":"Determines whether the local user interface of the LUI is available (true if available, false otherwise). Initially populated by the LPA when the eUICC tree is created, can be queried and changed by the MDM server.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/eUICCs-csp/"],"options":[{"id":"device_vendor_msft_euiccs_{euicc}_policies_localuienabled_false","displayName":"Disabled","description":"Disabled","helpText":null},{"id":"device_vendor_msft_euiccs_{euicc}_policies_localuienabled_true","displayName":"Enabled","description":"Enabled","helpText":null}]},{"id":"device_vendor_msft_euiccs_{euicc}_profiles_{iccid}","displayName":"ICCID","description":"Node representing an enterprise-owned eUICC profile. The node name is the ICCID of the profile (which is a unique identifier). Creation of this subtree triggers an AddProfile request by the LPA (which installs the profile on the eUICC). Removal of this subtree triggers the LPA to delete the profile (if resident on the eUICC).","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_euiccs_{euicc}_profiles_{iccid}_isenabled","displayName":"Is Enabled","description":"Indicates whether this eSIM profile is enabled. Can be set by both the MDM and the CSP.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/eUICCs-csp/"],"options":[{"id":"device_vendor_msft_euiccs_{euicc}_profiles_{iccid}_isenabled_false","displayName":"Disabled","description":"Disabled","helpText":null},{"id":"device_vendor_msft_euiccs_{euicc}_profiles_{iccid}_isenabled_true","displayName":"Enabled","description":"Enabled","helpText":null}]},{"id":"device_vendor_msft_euiccs_{euicc}_profiles_{iccid}_matchingid","displayName":"Matching ID","description":"Matching ID (activation code token) for profile download. Must be set by the MDM when the ICCID subtree is created.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/eUICCs-csp/"],"options":null},{"id":"device_vendor_msft_euiccs_{euicc}_profiles_{iccid}_servername","displayName":"Server Name","description":"Fully qualified domain name of the SM-DP+ that can download this profile. Must be set by the MDM when the ICCID subtree is created.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/eUICCs-csp/"],"options":null},{"id":"device_vendor_msft_laps_policies_adencryptedpasswordhistorysize","displayName":"AD Encrypted Password History Size ","description":"Use this setting to configure how many previous encrypted passwords will be remembered in Active Directory.\n\nIf not specified, this setting will default to 0 passwords (disabled).\n\nThis setting has a minimum allowed value of 0 passwords.\n\nThis setting has a maximum allowed value of 12 passwords.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/"],"options":null},{"id":"device_vendor_msft_laps_policies_administratoraccountname","displayName":"Administrator Account Name ","description":"Use this setting to configure the name of the managed local administrator account.\n\nIf not specified, the default built-in local administrator account will be located by well-known SID (even if renamed).\n\nIf specified, the specified account's password will be managed.\n\nNote: if a custom managed local administrator account name is specified in this setting, that account must be created via other means. Specifying a name in this setting will not cause the account to be created.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/"],"options":null},{"id":"device_vendor_msft_laps_policies_adpasswordencryptionenabled","displayName":"AD Password Encryption Enabled ","description":"Use this setting to configure whether the password is encrypted before being stored in Active Directory.\n\nThis setting is ignored if the password is currently being stored in Azure.\n\nThis setting is only honored when the Active Directory domain is at Windows Server 2016 Domain Functional Level or higher.\n\nIf this setting is enabled, and the Active Directory domain meets the DFL prerequisite, the password will be encrypted before before being stored in Active Directory.\n\nIf this setting is disabled, or the Active Directory domain does not meet the DFL prerequisite, the password will be stored as clear-text in Active Directory.\n\nIf not specified, this setting defaults to True.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/"],"options":[{"id":"device_vendor_msft_laps_policies_adpasswordencryptionenabled_false","displayName":"Store the password in clear-text form in Active Directory","description":"Store the password in clear-text form in Active Directory","helpText":null},{"id":"device_vendor_msft_laps_policies_adpasswordencryptionenabled_true","displayName":"Store the password in encrypted form in Active Directory","description":"Store the password in encrypted form in Active Directory","helpText":null}]},{"id":"device_vendor_msft_laps_policies_adpasswordencryptionprincipal","displayName":"AD Password Encryption Principal ","description":"Use this setting to configure the name or SID of a user or group that can decrypt the password stored in Active Directory.\n\nThis setting is ignored if the password is currently being stored in Azure.\n\nIf not specified, the password will be decryptable by the Domain Admins group in the device's domain.\n\nIf specified, the specified user or group will be able to decrypt the password stored in Active Directory.\n\nIf the specified user or group account is invalid the device will fallback to using the Domain Admins group in the device's domain.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/"],"options":null},{"id":"device_vendor_msft_laps_policies_automaticaccountmanagementenableaccount","displayName":"Automatic Account Management Enable Account","description":"Use this setting to configure whether the automatically managed account is enabled or disabled.\n\nIf this setting is enabled, the target account will be enabled.\n\nIf this setting is disabled, the target account will be disabled.\n\nIf not specified, this setting defaults to False.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/"],"options":[{"id":"device_vendor_msft_laps_policies_automaticaccountmanagementenableaccount_false","displayName":"The target account will be disabled","description":"The target account will be disabled","helpText":null},{"id":"device_vendor_msft_laps_policies_automaticaccountmanagementenableaccount_true","displayName":"The target account will be enabled","description":"The target account will be enabled","helpText":null}]},{"id":"device_vendor_msft_laps_policies_automaticaccountmanagementenabled","displayName":"Automatic Account Management Enabled","description":"Use this setting to specify whether automatic account management is enabled.\n\nIf this setting is enabled, the target account will be automatically managed.\n\nIf this setting is disabled, the target account will not be automatically managed.\n\nIf not specified, this setting defaults to False.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/"],"options":[{"id":"device_vendor_msft_laps_policies_automaticaccountmanagementenabled_false","displayName":"The target account will not be automatically managed","description":"The target account will not be automatically managed","helpText":null},{"id":"device_vendor_msft_laps_policies_automaticaccountmanagementenabled_true","displayName":"The target account will be automatically managed","description":"The target account will be automatically managed","helpText":null}]},{"id":"device_vendor_msft_laps_policies_automaticaccountmanagementnameorprefix","displayName":"Automatic Account Management Name Or Prefix","description":"Use this setting to configure the name or prefix of the managed local administrator account.\n\nIf specified, the value will be used as the name or name prefix of the managed account.\n\nIf not specified, this setting will default to \"WLapsAdmin\".","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/"],"options":null},{"id":"device_vendor_msft_laps_policies_automaticaccountmanagementrandomizename","displayName":"Automatic Account Management Randomize Name","description":"Use this setting to configure whether the name of the automatically managed account uses a random numeric suffix each time the password is rotated.\n\nIf this setting is enabled, the name of the target account will use a random numeric suffix.\n\nIf this setting is disbled, the name of the target account will not use a random numeric suffix..\n\nIf not specified, this setting defaults to False.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/"],"options":[{"id":"device_vendor_msft_laps_policies_automaticaccountmanagementrandomizename_false","displayName":"The name of the target account will not use a random numeric suffix.","description":"The name of the target account will not use a random numeric suffix.","helpText":null},{"id":"device_vendor_msft_laps_policies_automaticaccountmanagementrandomizename_true","displayName":"The name of the target account will use a random numeric suffix.","description":"The name of the target account will use a random numeric suffix.","helpText":null}]},{"id":"device_vendor_msft_laps_policies_automaticaccountmanagementtarget","displayName":"Automatic Account Management Target","description":"Use this setting to configure which account is automatically managed.\n\nThe allowable settings are:\n\n0=The builtin administrator account will be managed.\n1=A new account created by Windows LAPS will be managed.\n\nIf not specified, this setting will default to 1.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/"],"options":[{"id":"device_vendor_msft_laps_policies_automaticaccountmanagementtarget_0","displayName":"Manage the built-in administrator account","description":"Manage the built-in administrator account","helpText":null},{"id":"device_vendor_msft_laps_policies_automaticaccountmanagementtarget_1","displayName":"Manage a new custom administrator account","description":"Manage a new custom administrator account","helpText":null}]},{"id":"device_vendor_msft_laps_policies_backupdirectory","displayName":"Backup Directory ","description":"Use this setting to configure which directory the local admin account password is backed up to.\n\nThe allowable settings are:\n\n0=Disabled (password will not be backed up)\n1=Backup the password to Microsoft Entra ID only\n2=Backup the password to Active Directory only\n\nIf not specified, this setting will default to 0.\r\n","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/"],"options":[{"id":"device_vendor_msft_laps_policies_backupdirectory_0","displayName":"Disabled (password will not be backed up)","description":"Disabled (password will not be backed up)","helpText":null},{"id":"device_vendor_msft_laps_policies_backupdirectory_1","displayName":"Backup the password to Microsoft Entra ID only","description":"Backup the password to Microsoft Entra ID only","helpText":null},{"id":"device_vendor_msft_laps_policies_backupdirectory_2","displayName":"Backup the password to Active Directory only","description":"Backup the password to Active Directory only","helpText":null}]},{"id":"device_vendor_msft_laps_policies_passphraselength","displayName":"Passphrase Length","description":"Use this setting to configure the number of passphrase words.\n\nIf not specified, this setting will default to 6 words\n\nThis setting has a minimum allowed value of 3 words.\n\nThis setting has a maximum allowed value of 10 words.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/"],"options":null},{"id":"device_vendor_msft_laps_policies_passwordagedays","displayName":"Password Age Days ","description":"Use this policy to configure the maximum password age of the managed local administrator account.\n\nIf not specified, this setting will default to 30 days\n\nThis setting has a minimum allowed value of 1 day when backing the password to onpremises Active Directory, and 7 days when backing the password to Microsoft Entra ID..\n\nThis setting has a maximum allowed value of 365 days.\r\n","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/"],"options":null},{"id":"device_vendor_msft_laps_policies_passwordagedays_aad","displayName":"Password Age Days","description":"Use this policy to configure the maximum password age of the managed local administrator account.\n\nIf not specified, this setting will default to 30 days\n\nThis setting has a minimum allowed value of 1 day when backing the password to onpremises Active Directory, and 7 days when backing the password to Azure AD.\n\nThis setting has a maximum allowed value of 365 days.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/"],"options":null},{"id":"device_vendor_msft_laps_policies_passwordcomplexity","displayName":"Password Complexity ","description":"Use this setting to configure password complexity of the managed local administrator account.\n\nThe allowable settings are:\n\n1=Large letters\n2=Large letters + small letters\n3=Large letters + small letters + numbers\n4=Large letters + small letters + numbers + special characters\n\nIf not specified, this setting will default to 4.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/"],"options":[{"id":"device_vendor_msft_laps_policies_passwordcomplexity_1","displayName":"Large letters","description":"Large letters","helpText":null},{"id":"device_vendor_msft_laps_policies_passwordcomplexity_2","displayName":"Large letters + small letters","description":"Large letters + small letters","helpText":null},{"id":"device_vendor_msft_laps_policies_passwordcomplexity_3","displayName":"Large letters + small letters + numbers","description":"Large letters + small letters + numbers","helpText":null},{"id":"device_vendor_msft_laps_policies_passwordcomplexity_4","displayName":"Large letters + small letters + numbers + special characters","description":"Large letters + small letters + numbers + special characters","helpText":null},{"id":"device_vendor_msft_laps_policies_passwordcomplexity_5","displayName":"Large letters + small letters + numbers + special characters (improved readability)","description":"Large letters + small letters + numbers + special characters (improved readability)","helpText":null},{"id":"device_vendor_msft_laps_policies_passwordcomplexity_6","displayName":"Passphrase (long words)","description":"Passphrase (long words)","helpText":null},{"id":"device_vendor_msft_laps_policies_passwordcomplexity_7","displayName":"Passphrase (short words)","description":"Passphrase (short words)","helpText":null},{"id":"device_vendor_msft_laps_policies_passwordcomplexity_8","displayName":"Passphrase (short words with unique prefixes)","description":"Passphrase (short words with unique prefixes)","helpText":null}]},{"id":"device_vendor_msft_laps_policies_passwordexpirationprotectionenabled","displayName":"Password Expiration Protection Enabled ","description":"Use this setting to configure additional enforcement of maximum password age for the managed local administrator account.\n\nWhen this setting is enabled, planned password expiration that would result in a password age greater than that dictated by \"PasswordAgeDays\" policy is NOT allowed. When such expiration is detected, the password is changed immediately and the new password expiration date is set according to policy.\n\nIf not specified, this setting defaults to True.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/"],"options":[{"id":"device_vendor_msft_laps_policies_passwordexpirationprotectionenabled_false","displayName":"Allow configured password expiriration timestamp to exceed maximum password age","description":"Allow configured password expiriration timestamp to exceed maximum password age","helpText":null},{"id":"device_vendor_msft_laps_policies_passwordexpirationprotectionenabled_true","displayName":"Do not allow configured password expiriration timestamp to exceed maximum password age","description":"Do not allow configured password expiriration timestamp to exceed maximum password age","helpText":null}]},{"id":"device_vendor_msft_laps_policies_passwordlength","displayName":"Password Length ","description":"Use this setting to configure the length of the password of the managed local administrator account.\n\nIf not specified, this setting will default to 14 characters.\n\nThis setting has a minimum allowed value of 8 characters.\n\nThis setting has a maximum allowed value of 64 characters.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/"],"options":null},{"id":"device_vendor_msft_laps_policies_postauthenticationactions","displayName":"Post Authentication Actions ","description":"Use this setting to specify the actions to take upon expiration of the configured grace period.\n\nIf not specified, this setting will default to 3 (Reset the password and logoff the managed account).\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/"],"options":[{"id":"device_vendor_msft_laps_policies_postauthenticationactions_1","displayName":"Reset password: upon expiry of the grace period, the managed account password will be reset.","description":"Reset password: upon expiry of the grace period, the managed account password will be reset.","helpText":null},{"id":"device_vendor_msft_laps_policies_postauthenticationactions_3","displayName":"Reset the password and logoff the managed account: upon expiry of the grace period, the managed account password will be reset and any interactive logon sessions using the managed account will terminated.","description":"Reset the password and logoff the managed account: upon expiry of the grace period, the managed account password will be reset and any interactive logon sessions using the managed account will terminated.","helpText":null},{"id":"device_vendor_msft_laps_policies_postauthenticationactions_5","displayName":"Reset the password and reboot: upon expiry of the grace period, the managed account password will be reset and the managed device will be immediately rebooted.","description":"Reset the password and reboot: upon expiry of the grace period, the managed account password will be reset and the managed device will be immediately rebooted.","helpText":null},{"id":"device_vendor_msft_laps_policies_postauthenticationactions_11","displayName":"Reset the password, logoff the managed account, and terminate any remaining processes: upon expiration of the grace period, the managed account password is reset, any interactive logon sessions using the managed account are logged off, and any remaining processes are terminated.","description":"Reset the password, logoff the managed account, and terminate any remaining processes: upon expiration of the grace period, the managed account password is reset, any interactive logon sessions using the managed account are logged off, and any remaining processes are terminated.","helpText":null}]},{"id":"device_vendor_msft_laps_policies_postauthenticationresetdelay","displayName":"Post Authentication Reset Delay ","description":"Use this setting to specify the amount of time (in hours) to wait after an authentication before executing the specified post-authentication actions.\n\n If not specified, this setting will default to 24 hours.\n\n This setting has a minimum allowed value of 0 hours (this disables all post-authentication actions).\n\n This setting has a maximum allowed value of 24 hours.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/"],"options":null},{"id":"device_vendor_msft_multisim_{modemid}","displayName":"Modem ID","description":"Node representing a Mobile Broadband Modem. The node name is the Modem ID. Modem ID is a GUID without curly braces, with exception of \"Embedded\" which represents the embedded Modem.","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_multisim_{modemid}_policies_slotselectionenabled","displayName":"Slot Selection Enabled","description":"Determines whether the user is allowed to change slots in the Cellular settings UI. Default is true.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/MultiSIM-csp/"],"options":[{"id":"device_vendor_msft_multisim_{modemid}_policies_slotselectionenabled_false","displayName":"Disabled","description":"Disabled","helpText":null},{"id":"device_vendor_msft_multisim_{modemid}_policies_slotselectionenabled_true","displayName":"Enabled","description":"Enabled","helpText":null}]},{"id":"device_vendor_msft_multisim_{modemid}_slots_{slotid}","displayName":" Slot ID","description":"Node representing a SIM Slot. The node name is the Slot ID. SIM Slot ID format is \"0\", \"1\", etc., with exception of \"Embedded\" which represents the embedded Slot.","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_multisim_{modemid}_slots_{slotid}_identifier","displayName":"Slot ID","description":"Node representing a SIM Slot. The node name is the Slot ID. SIM Slot ID format is \"0\", \"1\", etc., with exception of \"Embedded\" which represents the embedded Slot.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/MultiSIM-csp/"],"options":[{"id":"device_vendor_msft_multisim_{modemid}_slots_{slotid}_identifier_embedded","displayName":"Embedded","description":"Embedded","helpText":null},{"id":"device_vendor_msft_multisim_{modemid}_slots_{slotid}_identifier_0","displayName":"SIM Slot Id 0","description":"0","helpText":null},{"id":"device_vendor_msft_multisim_{modemid}_slots_{slotid}_identifier_1","displayName":"SIM Slot Id 1","description":"1","helpText":null}]},{"id":"device_vendor_msft_multisim_{modemid}_slots_{slotid}_isselected","displayName":"Is Selected","description":"Indicates whether this Slot is selected or not.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/MultiSIM-csp/"],"options":[{"id":"device_vendor_msft_multisim_{modemid}_slots_{slotid}_isselected_false","displayName":"Not selected","description":"Not selected","helpText":null},{"id":"device_vendor_msft_multisim_{modemid}_slots_{slotid}_isselected_true","displayName":"Selected","description":"Selected","helpText":null}]},{"id":"device_vendor_msft_passportforwork_{tenantid}","displayName":"Device-scoped settings","description":"This policy specifies the Tenant ID in the format of a Globally Unique Identifier (GUID) without curly braces ( { , } ), which will be used as part of Windows Hello for Business provisioning and management.","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_enablepinrecovery","displayName":"Enable Pin Recovery","description":"If the user forgets their PIN, it can be changed to a new PIN using the Windows Hello for Business PIN recovery service. This cloud service encrypts a recovery secret which is stored locally on the client, but which can only be decrypted by the cloud service.\n\nIf you enable this policy setting, the PIN recovery secret will be stored on the device and the user will be able to change to a new PIN in case their PIN is forgotten.\n\nIf you disable or do not configure this policy setting, the PIN recovery secret will not be created or stored. If the user's PIN is forgotten, the only way to get a new PIN is by deleting the existing PIN and creating a new one, which will require the user to re-register with any services the old PIN provided access to.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":[{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_enablepinrecovery_false","displayName":"false","description":"Disabled","helpText":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_enablepinrecovery_true","displayName":"true","description":"Enabled","helpText":null}]},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_excludesecuritydevices_tpm12","displayName":"Restrict use of TPM 1.2","description":"Some Trusted Platform Modules (TPMs) are only compliant with the older 1.2 revision of the TPM specification defined by the Trusted Computing Group (TCG).\n\nIf you enable this policy setting, TPM revision 1.2 modules will be disallowed from being used with Windows Hello for Business.\n\nIf you disable or do not configure this policy setting, TPM revision 1.2 modules will be allowed to be used with Windows Hello for Business.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":[{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_excludesecuritydevices_tpm12_false","displayName":"Disabled","description":"Disabled","helpText":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_excludesecuritydevices_tpm12_true","displayName":"Enabled","description":"Enabled","helpText":null}]},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_digits","displayName":"Digits","description":"Use this policy setting to configure the use of digits in the Windows Hello for Business PIN.\n\nA value of 1 corresponds to “Required.” If you configure this policy setting to 1, Windows Hello for Business requires users to include at least one digit in their PIN.\n\nA value of 2 corresponds to “Disallow.” If you configure this policy setting to 2, Windows Hello for Business prevents users from using digits in their PIN.\n\nIf you do not configure this policy setting, Windows Hello for Business requires users to use digits in their PIN.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":[{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_digits_0","displayName":"Allows the use of digits in PIN.","description":"Allows the use of digits in PIN.","helpText":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_digits_1","displayName":"Requires the use of at least one digits in PIN.","description":"Requires the use of at least one digits in PIN.","helpText":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_digits_2","displayName":"Does not allow the use of digits in PIN.","description":"Does not allow the use of digits in PIN.","helpText":null}]},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_expiration","displayName":"Expiration","description":"This policy specifies when the PIN expires (in days). Valid values are 0 to 730 inclusive. If this policy is set to 0, then PINs do not expire.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_history","displayName":"PIN History","description":"This policy specifies the number of past PINs that can be stored in the history that can’t be used. Valid values are 0 to 50 inclusive. If this policy is set to 0, then storage of previous PINs is not required. PIN history is not preserved through PIN reset.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_lowercaseletters","displayName":"Lowercase Letters","description":"Use this policy setting to configure the use of lowercase letters in the Windows Hello for Business PIN.\n\nA value of 1 corresponds to “Required.” If you configure this policy setting to 1, Windows Hello for Business requires users to include at least one lowercase letter in their PIN.\n\nA value of 2 corresponds to “Disallow.” If you configure this policy setting to 2, Windows Hello for Business prevents users from using lowercase letters in their PIN.\n\nIf you do not configure this policy setting, Windows Hello for Business does not allow users to use lowercase letters in their PIN.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":[{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_lowercaseletters_0","displayName":"Allowed","description":"Allows the use of lowercase letters in PIN.","helpText":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_lowercaseletters_1","displayName":"Required","description":"Requires the use of at least one lowercase letters in PIN.","helpText":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_lowercaseletters_2","displayName":"Blocked","description":"Does not allow the use of lowercase letters in PIN.","helpText":null}]},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_maximumpinlength","displayName":"Maximum PIN Length","description":"Maximum PIN length configures the maximum number of characters allowed for the PIN. The largest number you can configure for this policy setting is 127. The lowest number you can configure must be larger than the number configured in the Minimum PIN length policy setting or the number 4, whichever is greater.\n\nIf you configure this policy setting, the PIN length must be less than or equal to this number.\n\nIf you do not configure this policy setting, the PIN length must be less than or equal to 127.\n\nNOTE: If the above specified conditions for the maximum PIN length are not met, default values will be used for both the maximum and minimum PIN lengths.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_minimumpinlength","displayName":"Minimum PIN Length","description":"Minimum PIN length configures the minimum number of characters required for the PIN. The lowest number you can configure for this policy setting is 4. The largest number you can configure must be less than the number configured in the Maximum PIN length policy setting or the number 127, whichever is the lowest.\n\nIf you configure this policy setting, the PIN length must be greater than or equal to this number.\n\nIf you do not configure this policy setting, the PIN length must be greater than or equal to 4.\n\nNOTE: If the above specified conditions for the minimum PIN length are not met, default values will be used for both the maximum and minimum PIN lengths.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_specialcharacters","displayName":"Special Characters","description":"Use this policy setting to configure the use of special characters in the Windows Hello for Business PIN gesture. Valid special characters for Windows Hello for Business PIN gestures include: ! \" # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \\ ] ^ _ ` { | } ~ .\n\nA value of 1 corresponds to “Required.” If you configure this policy setting to 1, Windows Hello for Business requires users to include at least one special character in their PIN.\n\nA value of 2 corresponds to “Disallow.” If you configure this policy setting to 2, Windows Hello for Business prevents users from using special characters in their PIN.\n\nIf you do not configure this policy setting, Windows Hello for Business does not allow users to use special characters in their PIN.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":[{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_specialcharacters_0","displayName":"Allows the use of special characters in PIN.","description":"Allows the use of special characters in PIN.","helpText":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_specialcharacters_1","displayName":"Requires the use of at least one special characters in PIN.","description":"Requires the use of at least one special characters in PIN.","helpText":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_specialcharacters_2","displayName":"Does not allow the use of special characters in PIN.","description":"Does not allow the use of special characters in PIN.","helpText":null}]},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_uppercaseletters","displayName":"Uppercase Letters","description":"Use this policy setting to configure the use of uppercase letters in the Windows Hello for Business PIN.\n\nA value of 1 corresponds to “Required.” If you configure this policy setting to 1, Windows Hello for Business requires users to include at least one uppercase letter in their PIN.\n\nA value of 2 corresponds to “Disallow.” If you configure this policy setting to 2, Windows Hello for Business prevents users from using uppercase letters in their PIN.\n\nIf you do not configure this policy setting, Windows Hello for Business does not allow users to use uppercase letters in their PIN.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":[{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_uppercaseletters_0","displayName":"Allowed","description":"Allows the use of uppercase letters in PIN.","helpText":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_uppercaseletters_1","displayName":"Required","description":"Requires the use of at least one uppercase letters in PIN.","helpText":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_pincomplexity_uppercaseletters_2","displayName":"Blocked","description":"Does not allow the use of uppercase letters in PIN.","helpText":null}]},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_remote_useremotepassport","displayName":"Use Remote Passport","description":"Boolean that specifies if phone sign-in can be used with a device. Phone sign-in provides the ability for a portable, registered device to be usable as a companion device for desktop authentication.\n\nDefault value is false. If you enable this setting, a desktop device will allow a registered, companion device to be used as an authentication factor. If you disable this setting, a companion device cannot be used in desktop authentication scenarios.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":[{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_remote_useremotepassport_false","displayName":"Disabled","description":"Disabled","helpText":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_remote_useremotepassport_true","displayName":"Enabled","description":"Enabled","helpText":null}]},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_requiresecuritydevice","displayName":"Require Security Device","description":"A Trusted Platform Module (TPM) provides additional security benefits over software because data stored within it cannot be used on other devices.\n\nIf you enable this policy setting, only devices with a usable TPM provision Windows Hello for Business.\n\nIf you disable or do not configure this policy setting, the TPM is still preferred, but all devices provision Windows Hello for Business using software if the TPM is non-functional or unavailable.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":[{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_requiresecuritydevice_false","displayName":"false","description":"Disabled","helpText":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_requiresecuritydevice_true","displayName":"true","description":"Enabled","helpText":null}]},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_usecertificateforonpremauth","displayName":"Use Certificate For On Prem Auth","description":"Windows Hello for Business can use certificates to authenticate to on-premise resources. \n\nIf you enable this policy setting, Windows Hello for Business will wait until the device has received a certificate payload from the mobile device management server before provisioning a PIN.\n\nIf you disable or do not configure this policy setting, the PIN will be provisioned when the user logs in, without waiting for a certificate payload.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":[{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_usecertificateforonpremauth_false","displayName":"Disabled","description":"Disabled","helpText":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_usecertificateforonpremauth_true","displayName":"Enabled","description":"Enabled","helpText":null}]},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_usecloudtrustforonpremauth","displayName":"Use Cloud Trust For On Prem Auth","description":"Windows Hello for Business to use Azure AD Kerberos to authenticate to on-premises resources. \n\nIf you enable this policy setting, Windows Hello for Business will use an Azure AD Kerberos ticket to authenticate to on-premises resources.\n\nIf you disable or do not configure this policy setting, Windows Hello for Business will use a key or certificate to authenticate to on-premises resources.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":[{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_usecloudtrustforonpremauth_false","displayName":"Disabled","description":"Disabled","helpText":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_usecloudtrustforonpremauth_true","displayName":"Enabled","description":"Enabled","helpText":null}]},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_usehellocertificatesassmartcardcertificates","displayName":"Use Hello Certificates As Smart Card Certificates","description":"If you enable this policy setting, applications use Windows Hello for Business certificates as smart card certificates. Biometric factors are unavailable when a user is asked to authorize the use of the certificate's private key. This policy setting is designed to allow compatibility with applications that rely exclusively on smart card certificates.\n\nIf you disable or do not configure this policy setting, applications do not use Windows Hello for Business certificates as smart card certificates, and biometric factors are available when a user is asked to authorize the use of the certificate's private key.\n\nWindows requires a user to lock and unlock their session after changing this setting if the user is currently signed in.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":[{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_usehellocertificatesassmartcardcertificates_false","displayName":"Disabled","description":"Disabled","helpText":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_usehellocertificatesassmartcardcertificates_true","displayName":"Enabled","description":"Enabled","helpText":null}]},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_usepassportforwork","displayName":"Use Windows Hello For Business (Device)","description":"Windows Hello for Business is an alternative method for signing into Windows using your Active Directory or Azure Active Directory account that can replace passwords, Smart Cards, and Virtual Smart Cards.\n\nIf you enable or do not configure this policy setting, the device provisions Windows Hello for Business for all users.\n\nIf you disable this policy setting, the device does not provision Windows Hello for Business for any user.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":[{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_usepassportforwork_false","displayName":"false","description":"Disabled","helpText":null},{"id":"device_vendor_msft_passportforwork_{tenantid}_policies_usepassportforwork_true","displayName":"true","description":"Enabled","helpText":null}]},{"id":"device_vendor_msft_passportforwork_biometrics_enableesswithsupportedperipherals","displayName":"Enable ESS with Supported Peripherals","description":"Enhanced Sign-in Security (ESS) isolates both biometric template data and matching operations to trusted hardware or specified memory regions, meaning the rest of the operating system cannot access or tamper with them. Because the channel of communication between the sensors and the algorithm is also secured, it is impossible for malware to inject or replay data in order to simulate a user signing in or to lock a user out of their machine.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":[{"id":"device_vendor_msft_passportforwork_biometrics_enableesswithsupportedperipherals_0","displayName":"Enhanced sign-in security will be disabled on all systems. If a user already has a secure Windows Hello enrollment, they will lose their enrollment and must reset PIN, and they will have the option to re-enroll in normal face and fingerprint. Peripheral usage will be enabled by disabling Enhanced sign-in security. OS will not attempt to start secure components, even if the secure hardware and software components are present. (not recommended)","description":"Enhanced sign-in security will be disabled on all systems. If a user already has a secure Windows Hello enrollment, they will lose their enrollment and must reset PIN, and they will have the option to re-enroll in normal face and fingerprint. Peripheral usage will be enabled by disabling Enhanced sign-in security. OS will not attempt to start secure components, even if the secure hardware and software components are present. (not recommended)","helpText":null},{"id":"device_vendor_msft_passportforwork_biometrics_enableesswithsupportedperipherals_1","displayName":"Enhanced sign-in security will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. For systems with one secure modality (face or fingerprint) and one insecure modality (fingerprint or face), only the secure sensor can be used for sign-in and the insecure sensor(s) will be blocked. This includes peripheral devices, which are unsupported and will be unusable. (default and recommended for highest security)","description":"Enhanced sign-in security will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. For systems with one secure modality (face or fingerprint) and one insecure modality (fingerprint or face), only the secure sensor can be used for sign-in and the insecure sensor(s) will be blocked. This includes peripheral devices, which are unsupported and will be unusable. (default and recommended for highest security)","helpText":null}]},{"id":"device_vendor_msft_passportforwork_biometrics_facialfeaturesuseenhancedantispoofing","displayName":"Facial Features Use Enhanced Anti Spoofing","description":"This setting determines whether enhanced anti-spoofing is required for Windows Hello face authentication.\n\nIf you enable this setting, Windows requires all users on managed devices to use enhanced anti-spoofing for Windows Hello face authentication. This disables Windows Hello face authentication on devices that do not support enhanced anti-spoofing.\n\nIf you disable or do not configure this setting, Windows doesn't require enhanced anti-spoofing for Windows Hello face authentication.\n\nNote that enhanced anti-spoofing for Windows Hello face authentication is not required on unmanaged devices.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":[{"id":"device_vendor_msft_passportforwork_biometrics_facialfeaturesuseenhancedantispoofing_false","displayName":"false","description":"Disabled","helpText":null},{"id":"device_vendor_msft_passportforwork_biometrics_facialfeaturesuseenhancedantispoofing_true","displayName":"true","description":"Enabled","helpText":null}]},{"id":"device_vendor_msft_passportforwork_biometrics_usebiometrics","displayName":"Allow Use of Biometrics","description":"Windows Hello for Business enables users to use biometric gestures, such as face and fingerprints, as an alternative to the PIN gesture. However, users must still configure a PIN to use in case of failures.\n\nIf you enable or do not configure this policy setting, Windows Hello for Business allows the use of biometric gestures.\n\nIf you disable this policy setting, Windows Hello for Business prevents the use of biometric gestures.\n\nNOTE: Disabling this policy prevents the use of biometric gestures on the device for all account types.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":[{"id":"device_vendor_msft_passportforwork_biometrics_usebiometrics_false","displayName":"False","description":"Disabled","helpText":null},{"id":"device_vendor_msft_passportforwork_biometrics_usebiometrics_true","displayName":"True","description":"Enabled","helpText":null}]},{"id":"device_vendor_msft_passportforwork_deviceunlock_groupa","displayName":"Group A","description":"Contains a list of providers by GUID that are to be considered for the first step of authentication","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":null},{"id":"device_vendor_msft_passportforwork_deviceunlock_groupb","displayName":"Group B","description":"Contains a list of providers by GUID that are to be considered for the second step of authentication","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":null},{"id":"device_vendor_msft_passportforwork_deviceunlock_plugins","displayName":"Device Unlock Plugins","description":"List of plugins that the passive provider monitors to detect user presence","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":null},{"id":"device_vendor_msft_passportforwork_dynamiclock_dynamiclock","displayName":"Dynamic Lock","description":"Enables/Disables Dyanamic Lock","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":[{"id":"device_vendor_msft_passportforwork_dynamiclock_dynamiclock_false","displayName":"Disabled","description":"Disabled","helpText":null},{"id":"device_vendor_msft_passportforwork_dynamiclock_dynamiclock_true","displayName":"Enabled","description":"Enabled","helpText":null}]},{"id":"device_vendor_msft_passportforwork_dynamiclock_plugins","displayName":"Dynamic Lock Plugins","description":"List of plugins that the passive provider monitors to detect user absence","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":null},{"id":"device_vendor_msft_passportforwork_securitykey_usesecuritykeyforsignin","displayName":"Use Security Key For Signin","description":"Use security key for signin. 0 is disabled. 1 is enable. If you do not configure this policy setting, the default is disabled.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PassportForWork-csp/"],"options":[{"id":"device_vendor_msft_passportforwork_securitykey_usesecuritykeyforsignin_0","displayName":"Disabled","description":"disabled","helpText":null},{"id":"device_vendor_msft_passportforwork_securitykey_usesecuritykeyforsignin_1","displayName":"Enabled","description":"enabled","helpText":null}]},{"id":"device_vendor_msft_pkcscertificate_certificatevalidityperiod","displayName":"Certificate validity period","description":"The amount of time remaining before the certificate expires. Enter a value that is equal to or lower than the validity period shown in the certificate template. Default is set at one year.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/mem/intune/protect/certificates-pfx-configure"],"options":null},{"id":"device_vendor_msft_pkcscertificate_certificationauthority","displayName":"Certification Authority","description":"The fully qualified domain name of the server that hosts the Certification Authority role and issues certificates.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/mem/intune/protect/certificates-pfx-configure"],"options":null},{"id":"device_vendor_msft_pkcscertificate_keystorageprovider","displayName":"Key storage provider (KSP)","description":"Select where you want to store the certificate’s key.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/mem/intune/protect/certificates-pfx-configure"],"options":null},{"id":"device_vendor_msft_pkcscertificate_renewalthreshold","displayName":"Renewal threshold (%)","description":"Enter the percentage (between 1 and 99 percent) of remaining certificate lifetime that is allowed before a device can request renewal of the certificate. The recommended amount in Intune is 20%. (1-99)","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/mem/intune/protect/certificates-pfx-configure"],"options":null},{"id":"device_vendor_msft_pkcscertificate_subjectnameformat","displayName":"Subject name format","description":"CN={{UserName}},E={{EmailAddress}},OU=EnterpriseUsers,O=Contoso Corporation,L=Redmond,ST=WA,C=US\\nor\\nCN={{AAD_Device_ID}},E={{EmailAddress}},OU=EnterpriseUsers,O=Contoso Corporation,L=Redmond,ST=WA,C=US","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/mem/intune/protect/certificates-pfx-configure"],"options":null},{"id":"device_vendor_msft_pkcsimportedcertificate_intendedpurpose","displayName":"Intended Purpose","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_pkcsimportedcertificate_keystorageprovider","displayName":"Key storage provider (KSP)","description":"Select where you want to store the certificate’s key.","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_abovelock_allowcortanaabovelock","displayName":"Allow Cortana Above Lock","description":"Added in Windows 10, version 1607. Specifies whether or not the user can interact with Cortana using speech while the system is locked. If you allow or don’t configure this setting, the user can interact with Cortana using speech while the system is locked. If you block this setting, the system will need to be unlocked for the user to interact with Cortana using speech.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-abovelock#allowcortanaabovelock"],"options":[{"id":"device_vendor_msft_policy_config_abovelock_allowcortanaabovelock_0","displayName":"Block","description":"Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_abovelock_allowcortanaabovelock_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_abovelock_allowtoasts","displayName":"Allow Toasts","description":"Specifies whether to allow toast notifications above the device lock screen. Most restrictive value is \"Block\".","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-abovelock#allowtoasts"],"options":[{"id":"device_vendor_msft_policy_config_abovelock_allowtoasts_0","displayName":"Block","description":"Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_abovelock_allowtoasts_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_accounts_allowaddingnonmicrosoftaccountsmanually","displayName":"Allow Adding Non Microsoft Accounts Manually","description":"Specifies whether user is allowed to add non-MSA email accounts. Most restricted value is 0. Note This policy will only block UI/UX-based methods for adding non-Microsoft accounts. Even if this policy is enforced, you can still provision non-MSA accounts using the EMAIL2 CSP.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Accounts#AllowAddingNonMicrosoftAccountsManually"],"options":[{"id":"device_vendor_msft_policy_config_accounts_allowaddingnonmicrosoftaccountsmanually_0","displayName":"Block","description":"Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_accounts_allowaddingnonmicrosoftaccountsmanually_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_accounts_allowmicrosoftaccountconnection","displayName":"Allow Microsoft Account Connection","description":"Specifies whether the user is allowed to use an MSA account for non-email related connection authentication and services. Most restricted value is 0.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Accounts#AllowMicrosoftAccountConnection"],"options":[{"id":"device_vendor_msft_policy_config_accounts_allowmicrosoftaccountconnection_0","displayName":"Block","description":"Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_accounts_allowmicrosoftaccountconnection_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_accounts_allowmicrosoftaccountsigninassistant","displayName":"Allow Microsoft Account Sign In Assistant","description":"Allows IT Admins the ability to disable the Microsoft Account Sign-In Assistant (wlidsvc) NT service. Note If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See Feature updates are not being offered while other updates are. Note: If the MSA service is disabled, the Subscription Activation feature will not work properly and your users will not be able to “step-up” from Windows 10 Pro to Windows 10 Enterprise, because the MSA ticket for license authentication cannot be generated. The machine will remain on Windows 10 Pro and no error will be displayed in the Activation Settings app.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Accounts#AllowMicrosoftAccountSignInAssistant"],"options":[{"id":"device_vendor_msft_policy_config_accounts_allowmicrosoftaccountsigninassistant_0","displayName":"Disabled","description":"Disabled","helpText":null},{"id":"device_vendor_msft_policy_config_accounts_allowmicrosoftaccountsigninassistant_1","displayName":"Manual start","description":"Manual start","helpText":null}]},{"id":"device_vendor_msft_policy_config_accounts_domainnamesforemailsync","displayName":"Domain Names For Email Sync","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Accounts#domainnamesforemailsync"],"options":null},{"id":"device_vendor_msft_policy_config_activexcontrols_approvedinstallationsites","displayName":"Approved Installation Sites for ActiveX Controls","description":"This policy setting determines which ActiveX installation sites standard users in your organization can use to install ActiveX controls on their computers. When this setting is enabled, the administrator can create a list of approved Activex Install sites specified by host URL. \r\n\r\nIf you enable this setting, the administrator can create a list of approved ActiveX Install sites specified by host URL. \r\n \r\nIf you disable or do not configure this policy setting, ActiveX controls prompt the user for administrative credentials before installation. \r\n\r\nNote: Wild card characters cannot be used when specifying the host URLs.\r\n","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-activexcontrols#activexcontrols-approvedinstallationsites"],"options":[{"id":"device_vendor_msft_policy_config_activexcontrols_approvedinstallationsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_activexcontrols_approvedinstallationsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_activexcontrols_approvedinstallationsites_approvedactivexinstallsiteslist","displayName":"Host URLs (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_activexcontrols_approvedinstallationsites_approvedactivexinstallsiteslist_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_activexcontrols_approvedinstallationsites_approvedactivexinstallsiteslist_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies","displayName":"Establish ActiveX installation policy for sites in Trusted zones","description":"This policy setting controls the installation of ActiveX controls for sites in Trusted zone. \r\n\r\nIf you enable this policy setting, ActiveX controls are installed according to the settings defined by this policy setting. \r\n \r\nIf you disable or do not configure this policy setting, ActiveX controls prompt the user before installation. \r\n\r\nIf the trusted site uses the HTTPS protocol, this policy setting can also control how ActiveX Installer Service responds to certificate errors. By default all HTTPS connections must supply a server certificate that passes all validation criteria. If you are aware that a trusted site has a certificate error but you want to trust it anyway you can select the certificate errors that you want to ignore. \r\n \r\nNote: This policy setting applies to all sites in Trusted zones.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-activexinstallservice#admx-activexinstallservice-axisurlzonepolicies"],"options":[{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_ignoreinvalidcertdate","displayName":"Expired certificate validation date (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_ignoreinvalidcertdate_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_ignoreinvalidcertdate_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_ignoreinvalidcn","displayName":"Invalid certificate name (CN) (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_ignoreinvalidcn_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_ignoreinvalidcn_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_ignoreunknownca","displayName":"Unknown certifcation authority (CA) (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_ignoreunknownca_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_ignoreunknownca_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_ignorewrongcertusage","displayName":"Wrong certificate usage (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_ignorewrongcertusage_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_ignorewrongcertusage_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_installsignedocx","displayName":"Installation Policy for signed ActiveX control (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_installsignedocx_0","displayName":"Don't install","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_installsignedocx_1","displayName":"Prompt the user","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_installsignedocx_2","displayName":"Silently install","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_installtrustedocx","displayName":"Installation Policy for ActiveX control signed by trusted publisher (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_installtrustedocx_0","displayName":"Don't install","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_installtrustedocx_1","displayName":"Prompt the user","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_installtrustedocx_2","displayName":"Silently install","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_installunsignedocx","displayName":"Installation Policy for unsigned ActiveX control (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_installunsignedocx_0","displayName":"Don't install","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_activexinstallservice_axisurlzonepolicies_installunsignedocx_1","displayName":"Prompt the user","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd","displayName":"Password Settings","description":"\r\nConfigures password parameters\r\n\r\nPassword complexity: which characters are used when generating a new password\r\n Default: Large letters + small letters + numbers + special characters\r\n\r\nPassword length\r\n Minimum: 8 characters\r\n Maximum: 64 characters\r\n Default: 14 characters\r\n\r\nPassword age in days\r\n Minimum: 1 day\r\n Maximum: 365 days\r\n Default: 30 days\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-admpwd#admx-admpwd-pol-admpwd"],"options":[{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_adminname","displayName":"Name of administrator account to manage","description":"\r\nAdministrator account name: name of the local account you want to manage password for.\r\n DO NOT configure when you use built-in admin account. Built-in admin account is auto-detected by well-known SID, even when renamed\r\n\r\n DO configure when you use custom local admin account\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-admpwd#admx-admpwd-pol-admpwd-adminname"],"options":[{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_adminname_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_adminname_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_adminname_txt_adminaccountname","displayName":"Administrator account name (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_dontallowpwdexpirationbehindpolicy","displayName":"Do not allow password expiration time longer than required by policy","description":"\r\nWhen you enable this setting, planned password expiration longer than password age dictated by \"Password Settings\" policy is NOT allowed. When such expiration is detected, password is changed immediately and password expiration is set according to policy.\r\n\r\nWhen you disable or not configure this setting, password expiration time may be longer than required by \"Password Settings\" policy.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-admpwd#admx-admpwd-pol-admpwd-dontallowpwdexpirationbehindpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_dontallowpwdexpirationbehindpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_dontallowpwdexpirationbehindpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_elm_admpwd_passwordagedays","displayName":"Password Age (Days) (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_elm_admpwd_passwordcomplexity","displayName":"Password Complexity (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_elm_admpwd_passwordcomplexity_1","displayName":"Large letters","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_elm_admpwd_passwordcomplexity_2","displayName":"Large letters + small letters","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_elm_admpwd_passwordcomplexity_3","displayName":"Large letters + small letters + numbers","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_elm_admpwd_passwordcomplexity_4","displayName":"Large letters + small letters + numbers + specials","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_elm_admpwd_passwordlength","displayName":"Password Length (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_enabled","displayName":"Enable local admin password management","description":"\r\nEnables management of password for local administrator account\r\n\r\nIf you enable this setting, local administrator password is managed\r\n\r\nIf you disable or not configure this setting, local administrator password is NOT managed\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-admpwd#admx-admpwd-pol-admpwd-enabled"],"options":[{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_enabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_admpwd_pol_admpwd_enabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatprevent16bitmach","displayName":"Prevent access to 16-bit applications","description":"Specifies whether to prevent the MS-DOS subsystem (ntvdm.exe) from running on this computer. This setting affects the launching of 16-bit applications in the operating system.\r\n\r\nYou can use this setting to turn off the MS-DOS subsystem, which will reduce resource usage and prevent users from running 16-bit applications. To run any 16-bit application or any application with 16-bit components, ntvdm.exe must be allowed to run. The MS-DOS subsystem starts when the first 16-bit application is launched. While the MS-DOS subsystem is running, any subsequent 16-bit applications launch faster, but overall resource usage on the system is increased.\r\n\r\nIf the status is set to Enabled, the MS-DOS subsystem is prevented from running, which then prevents any 16-bit applications from running. In addition, any 32-bit applications with 16-bit installers or other 16-bit components cannot run.\r\n\r\nIf the status is set to Disabled, the MS-DOS subsystem runs for all users on this computer.\r\n\r\nIf the status is set to Not Configured, the OS falls back on a local policy set by the registry DWORD value HKLM\\System\\CurrentControlSet\\Control\\WOW\\DisallowedPolicyDefault. If that value is non-0, this prevents all 16-bit applications from running. If that value is 0, 16-bit applications are allowed to run. If that value is also not present, on Windows 10 and above the OS will launch the 16-bit application support control panel to allow an elevated administrator to make the decision; on windows 7 and downlevel, the OS will allow 16-bit applications to run.\r\n\r\nNote: This setting appears in only Computer Configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-appcompat#admx-appcompat-appcompatprevent16bitmach"],"options":[{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatprevent16bitmach_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatprevent16bitmach_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatremoveprogramcompatproppage","displayName":"Remove Program Compatibility Property Page","description":"This policy controls the visibility of the Program Compatibility property page shell extension. This shell extension is visible on the property context-menu of any program shortcut or executable file.\r\n\r\nThe compatibility property page displays a list of options that can be selected and applied to the application to resolve the most common issues affecting legacy applications. Enabling this policy setting removes the property page from the context-menus, but does not affect previous compatibility settings applied to application using this interface.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-appcompat#admx-appcompat-appcompatremoveprogramcompatproppage"],"options":[{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatremoveprogramcompatproppage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatremoveprogramcompatproppage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatturnoffapplicationimpacttelemetry","displayName":"Turn off Application Telemetry","description":"The policy controls the state of the Application Telemetry engine in the system.\r\n\r\nApplication Telemetry is a mechanism that tracks anonymous usage of specific Windows system components by applications.\r\n\r\nTurning Application Telemetry off by selecting \"enable\" will stop the collection of usage data.\r\n\r\nIf the customer Experience Improvement program is turned off, Application Telemetry will be turned off regardless of how this policy is set.\r\n\r\nDisabling telemetry will take effect on any newly launched applications. To ensure that telemetry collection has stopped for all applications, please reboot your machine.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-appcompat#admx-appcompat-appcompatturnoffapplicationimpacttelemetry"],"options":[{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatturnoffapplicationimpacttelemetry_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatturnoffapplicationimpacttelemetry_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatturnoffengine","displayName":"Turn off Application Compatibility Engine","description":" This policy controls the state of the application compatibility engine in the system.\r\n\r\nThe engine is part of the loader and looks through a compatibility database every time an application is started on the system. If a match for the application is found it provides either run-time solutions or compatibility fixes, or displays an Application Help message if the application has a know problem.\r\n\r\nTurning off the application compatibility engine will boost system performance. However, this will degrade the compatibility of many popular legacy applications, and will not block known incompatible applications from installing. (For Instance: This may result in a blue screen if an old anti-virus application is installed.)\r\n\r\nThe Windows Resource Protection and User Account Control features of Windows use the application compatibility engine to provide mitigations for application problems. If the engine is turned off, these mitigations will not be applied to applications and their installers and these applications may fail to install or run properly.\r\n\r\nThis option is useful to server administrators who require faster performance and are aware of the compatibility of the applications they are using. It is particularly useful for a web server where applications may be launched several hundred times a second, and the performance of the loader is essential.\r\n\r\nNOTE: Many system processes cache the value of this setting for performance reasons. If you make changes to this setting, please reboot to ensure that your system accurately reflects those changes.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-appcompat#admx-appcompat-appcompatturnoffengine"],"options":[{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatturnoffengine_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatturnoffengine_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatturnoffprogramcompatibilityassistant_2","displayName":"Turn off Program Compatibility Assistant","description":"This policy setting controls the state of the Program Compatibility Assistant (PCA).\r\n \r\nThe PCA monitors applications run by the user. When a potential compatibility issue with an application is detected, the PCA will prompt the user with recommended solutions. To configure the diagnostic settings for the PCA, go to System->Troubleshooting and Diagnostics->Application Compatibility Diagnostics. \r\n\r\nIf you enable this policy setting, the PCA will be turned off. The user will not be presented with solutions to known compatibility issues when running applications. Turning off the PCA can be useful for system administrators who require better performance and are already aware of application compatibility issues. \r\n\r\nIf you disable or do not configure this policy setting, the PCA will be turned on. To configure the diagnostic settings for the PCA, go to System->Troubleshooting and Diagnostics->Application Compatibility Diagnostics.\r\n\r\nNote: The Diagnostic Policy Service (DPS) and Program Compatibility Assistant Service must be running for the PCA to run. These services can be configured by using the Services snap-in to the Microsoft Management Console.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-appcompat#admx-appcompat-appcompatturnoffprogramcompatibilityassistant-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatturnoffprogramcompatibilityassistant_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatturnoffprogramcompatibilityassistant_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatturnoffprograminventory","displayName":"Turn off Inventory Collector","description":"This policy setting controls the state of the Inventory Collector. \r\n\r\nThe Inventory Collector inventories applications, files, devices, and drivers on the system and sends the information to Microsoft. This information is used to help diagnose compatibility problems.\r\n\r\nIf you enable this policy setting, the Inventory Collector will be turned off and data will not be sent to Microsoft. Collection of installation data through the Program Compatibility Assistant is also disabled.\r\n\r\nIf you disable or do not configure this policy setting, the Inventory Collector will be turned on.\r\n\r\nNote: This policy setting has no effect if the Customer Experience Improvement Program is turned off. The Inventory Collector will be off.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-appcompat#admx-appcompat-appcompatturnoffprograminventory"],"options":[{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatturnoffprograminventory_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatturnoffprograminventory_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatturnoffswitchback","displayName":"Turn off SwitchBack Compatibility Engine","description":"The policy controls the state of the Switchback compatibility engine in the system. \r\n\r\nSwitchback is a mechanism that provides generic compatibility mitigations to older applications by providing older behavior to old applications and new behavior to new applications. \r\n\r\nSwitchback is on by default.\r\n\r\nIf you enable this policy setting, Switchback will be turned off. Turning Switchback off may degrade the compatibility of older applications. This option is useful for server administrators who require performance and are aware of compatibility of the applications they are using. \r\n\r\nIf you disable or do not configure this policy setting, the Switchback will be turned on.\r\n\r\nPlease reboot the system after changing the setting to ensure that your system accurately reflects those changes.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-appcompat#admx-appcompat-appcompatturnoffswitchback"],"options":[{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatturnoffswitchback_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatturnoffswitchback_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatturnoffuseractionrecord","displayName":"Turn off Steps Recorder","description":"This policy setting controls the state of Steps Recorder.\r\n\r\nSteps Recorder keeps a record of steps taken by the user. The data generated by Steps Recorder can be used in feedback systems such as Windows Error Reporting to help developers understand and fix problems. The data includes user actions such as keyboard input and mouse input, user interface data, and screen shots. Steps Recorder includes an option to turn on and off data collection.\r\n\r\nIf you enable this policy setting, Steps Recorder will be disabled.\r\n\r\nIf you disable or do not configure this policy setting, Steps Recorder will be enabled.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-appcompat#admx-appcompat-appcompatturnoffuseractionrecord"],"options":[{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatturnoffuseractionrecord_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_appcompat_appcompatturnoffuseractionrecord_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_appxpackagemanager_allowdeploymentinspecialprofiles","displayName":"Allow deployment operations in special profiles","description":"This policy setting allows you to manage the deployment of Windows Store apps when the user is signed in using a special profile. Special profiles are the following user profiles, where changes are discarded after the user signs off:\r\n\r\nRoaming user profiles to which the \"Delete cached copies of roaming profiles\" Group Policy setting applies\r\n\r\nMandatory user profiles and super-mandatory profiles, which are created by an administrator\r\n\r\nTemporary user profiles, which are created when an error prevents the correct profile from loading\r\n\r\nUser profiles for the Guest account and members of the Guests group\r\n\r\n\r\nIf you enable this policy setting, Group Policy allows deployment operations (adding, registering, staging, updating, or removing an app package) of Windows Store apps when using a special profile.\r\n\r\nIf you disable or do not configure this policy setting, Group Policy blocks deployment operations of Windows Store apps when using a special profile.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-appxpackagemanager#admx-appxpackagemanager-allowdeploymentinspecialprofiles"],"options":[{"id":"device_vendor_msft_policy_config_admx_appxpackagemanager_allowdeploymentinspecialprofiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_appxpackagemanager_allowdeploymentinspecialprofiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_appxruntime_appxruntimeapplicationcontenturirules","displayName":"Turn on dynamic Content URI Rules for packaged Microsoft Store apps","description":"This policy setting lets you turn on Content URI Rules to supplement the static Content URI Rules that were defined as part of the app manifest and apply to all Windows Store apps that use the enterpriseAuthentication capability on a computer.\r\n\r\nIf you enable this policy setting, you can define additional Content URI Rules that all Windows Store apps that use the enterpriseAuthentication capability on a computer can use.\r\n\r\nIf you disable or don't set this policy setting, Windows Store apps will only use the static Content URI Rules.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-appxruntime#admx-appxruntime-appxruntimeapplicationcontenturirules"],"options":[{"id":"device_vendor_msft_policy_config_admx_appxruntime_appxruntimeapplicationcontenturirules_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_appxruntime_appxruntimeapplicationcontenturirules_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_appxruntime_appxruntimeapplicationcontenturirules_listbox_contenturirules","displayName":"Content URI Rules: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_appxruntime_appxruntimeblockfileelevation","displayName":"Block launching desktop apps associated with a file.","description":"This policy setting lets you control whether Windows Store apps can open files using the default desktop app for a file type. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a Windows Store app might compromise the system by opening a file in the default desktop app for a file type.\r\n\r\nIf you enable this policy setting, Windows Store apps cannot open files in the default desktop app for a file type; they can open files only in other Windows Store apps.\r\n\r\nIf you disable or do not configure this policy setting, Windows Store apps can open files in the default desktop app for a file type.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-appxruntime#admx-appxruntime-appxruntimeblockfileelevation"],"options":[{"id":"device_vendor_msft_policy_config_admx_appxruntime_appxruntimeblockfileelevation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_appxruntime_appxruntimeblockfileelevation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_appxruntime_appxruntimeblockhostedappaccesswinrt","displayName":"Block launching Universal Windows apps with Windows Runtime API access from hosted content.","description":"\r\n This policy setting controls whether Universal Windows apps with Windows Runtime API access directly from web content can be launched.\r\n\r\n If you enable this policy setting, Universal Windows apps which declare Windows Runtime API access in ApplicationContentUriRules section of the manifest cannot be launched; Universal Windows apps which have not declared Windows Runtime API access in the manifest are not affected.\r\n\r\n If you disable or do not configure this policy setting, all Universal Windows apps can be launched.\r\n\r\n This policy should not be enabled unless recommended by Microsoft as a security response because it can cause severe app compatibility issues.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-appxruntime#admx-appxruntime-appxruntimeblockhostedappaccesswinrt"],"options":[{"id":"device_vendor_msft_policy_config_admx_appxruntime_appxruntimeblockhostedappaccesswinrt_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_appxruntime_appxruntimeblockhostedappaccesswinrt_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_appxruntime_appxruntimeblockprotocolelevation","displayName":"Block launching desktop apps associated with a URI scheme","description":"This policy setting lets you control whether Windows Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a URI scheme launched by a Windows Store app might compromise the system by launching a desktop app.\r\n\r\nIf you enable this policy setting, Windows Store apps cannot open URIs in the default desktop app for a URI scheme; they can open URIs only in other Windows Store apps.\r\n\r\nIf you disable or do not configure this policy setting, Windows Store apps can open URIs in the default desktop app for a URI scheme.\r\n\r\nNote: Enabling this policy setting does not block Windows Store apps from opening the default desktop app for the http, https, and mailto URI schemes. The handlers for these URI schemes are hardened against URI-based vulnerabilities from untrusted sources, reducing the associated risk.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-appxruntime#admx-appxruntime-appxruntimeblockprotocolelevation"],"options":[{"id":"device_vendor_msft_policy_config_admx_appxruntime_appxruntimeblockprotocolelevation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_appxruntime_appxruntimeblockprotocolelevation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_auditsettings_includecmdline","displayName":"Include command line in process creation events","description":"This policy setting determines what information is logged in security audit events when a new process has been created.\r\n\r\nThis setting only applies when the Audit Process Creation policy is enabled. If you enable this policy setting the command line information for every process will be logged in plain text in the security event log as part of the Audit Process Creation event 4688, \"a new process has been created,\" on the workstations and servers on which this policy setting is applied.\r\n\r\nIf you disable or do not configure this policy setting, the process's command line information will not be included in Audit Process Creation events.\r\n\r\nDefault: Not configured\r\n\r\nNote: When this policy setting is enabled, any user with access to read the security events will be able to read the command line arguments for any successfully created process. Command line arguments can contain sensitive or private information such as passwords or user data.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-auditsettings#admx-auditsettings-includecmdline"],"options":[{"id":"device_vendor_msft_policy_config_admx_auditsettings_includecmdline_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_auditsettings_includecmdline_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_disablebranchcache","displayName":"Do not allow the BITS client to use Windows Branch Cache","description":"This setting affects whether the BITS client is allowed to use Windows Branch Cache. If the Windows Branch Cache component is installed and enabled on a computer, BITS jobs on that computer can use Windows Branch Cache by default.\r\n\r\n If you enable this policy setting, the BITS client does not use Windows Branch Cache.\r\n\r\n If you disable or do not configure this policy setting, the BITS client uses Windows Branch Cache.\r\n\r\n Note: This policy setting does not affect the use of Windows Branch Cache by applications other than BITS. This policy setting does not apply to BITS transfers over SMB. This setting has no effect if the computer's administrative settings for Windows Branch Cache disable its use entirely.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-bits#admx-bits-bits-disablebranchcache"],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_disablebranchcache_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_disablebranchcache_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_disablepeercachingclient","displayName":"Do not allow the computer to act as a BITS Peercaching client","description":"This policy setting specifies whether the computer will act as a BITS peer caching client. By default, when BITS peer caching is enabled, the computer acts as both a peer caching server (offering files to its peers) and a peer caching client (downloading files from its peers).\r\n\r\n If you enable this policy setting, the computer will no longer use the BITS peer caching feature to download files; files will be downloaded only from the origin server. However, the computer will still make files available to its peers.\r\n\r\n If you disable or do not configure this policy setting, the computer attempts to download peer-enabled BITS jobs from peer computers before reverting to the origin server.\r\n\r\n Note: This policy setting has no effect if the \"Allow BITS peer caching\" policy setting is disabled or not configured.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-bits#admx-bits-bits-disablepeercachingclient"],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_disablepeercachingclient_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_disablepeercachingclient_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_disablepeercachingserver","displayName":"Do not allow the computer to act as a BITS Peercaching server","description":"This policy setting specifies whether the computer will act as a BITS peer caching server. By default, when BITS peer caching is enabled, the computer acts as both a peer caching server (offering files to its peers) and a peer caching client (downloading files from its peers).\r\n\r\n If you enable this policy setting, the computer will no longer cache downloaded files and offer them to its peers. However, the computer will still download files from peers.\r\n\r\n If you disable or do not configure this policy setting, the computer will offer downloaded and cached files to its peers.\r\n\r\n Note: This setting has no effect if the \"Allow BITS peer caching\" setting is disabled or not configured.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-bits#admx-bits-bits-disablepeercachingserver"],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_disablepeercachingserver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_disablepeercachingserver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_enablepeercaching","displayName":"Allow BITS Peercaching","description":"This policy setting determines if the Background Intelligent Transfer Service (BITS) peer caching feature is enabled on a specific computer. By default, the files in a BITS job are downloaded only from the origin server specified by the job's owner.\r\n\r\n If BITS peer caching is enabled, BITS caches downloaded files and makes them available to other BITS peers. When transferring a download job, BITS first requests the files for the job from its peers in the same IP subnet. If none of the peers in the subnet have the requested files, BITS downloads them from the origin server.\r\n\r\n If you enable this policy setting, BITS downloads files from peers, caches the files, and responds to content requests from peers. Using the \"Do not allow the computer to act as a BITS peer caching server\" and \"Do not allow the computer to act as a BITS peer caching client\" policy settings, it is possible to control BITS peer caching functionality at a more detailed level. However, it should be noted that the \"Allow BITS peer caching\" policy setting must be enabled for the other two policy settings to have any effect.\r\n\r\n If you disable or do not configure this policy setting, the BITS peer caching feature will be disabled, and BITS will download files directly from the origin server.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-bits#admx-bits-bits-enablepeercaching"],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_enablepeercaching_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_enablepeercaching_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthservedforpeers","displayName":"Limit the maximum network bandwidth used for Peercaching","description":"This policy setting limits the network bandwidth that BITS uses for peer cache transfers (this setting does not affect transfers from the origin server).\r\n To prevent any negative impact to a computer caused by serving other peers, by default BITS will use up to 30 percent of the bandwidth of the slowest active network interface. For example, if a computer has both a 100 Mbps network card and a 56 Kbps modem, and both are active, BITS will use a maximum of 30 percent of 56 Kbps. \r\n You can change the default behavior of BITS, and specify a fixed maximum bandwidth that BITS will use for peer caching.\r\n\r\n If you enable this policy setting, you can enter a value in bits per second (bps) between 1048576 and 4294967200 to use as the maximum network bandwidth used for peer caching.\r\n\r\n If you disable this policy setting or do not configure it, the default value of 30 percent of the slowest active network interface will be used.\r\n\r\n Note: This setting has no effect if the \"Allow BITS peer caching\" policy setting is disabled or not configured.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-bits#admx-bits-bits-maxbandwidthservedforpeers"],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthservedforpeers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthservedforpeers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthservedforpeers_bits_maxbandwidthservedforpeerslist","displayName":"Maximum network bandwidth used for Peercaching (bps): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance","displayName":"Set up a maintenance schedule to limit the maximum network bandwidth used for BITS background transfers","description":"This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers during the maintenance days and hours. Maintenance schedules further limit the network bandwidth that is used for background transfers.\r\n\r\n If you enable this policy setting, you can define a separate set of network bandwidth limits and set up a schedule for the maintenance period.\r\n\r\n You can specify a limit to use for background jobs during a maintenance schedule. For example, if normal priority jobs are currently limited to 256 Kbps on a work schedule, you can further limit the network bandwidth of normal priority jobs to 0 Kbps from 8:00 A.M. to 10:00 A.M. on a maintenance schedule.\r\n\r\n If you disable or do not configure this policy setting, the limits defined for work or nonwork schedules will be used.\r\n\r\n Note: The bandwidth limits that are set for the maintenance period supersede any limits defined for work and other schedules.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-bits#admx-bits-bits-maxbandwidthv2-maintenance"],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancedaysfrom","displayName":"From (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancedaysfrom_0","displayName":"Sunday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancedaysfrom_1","displayName":"Monday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancedaysfrom_2","displayName":"Tuesday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancedaysfrom_3","displayName":"Wednesday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancedaysfrom_4","displayName":"Thursday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancedaysfrom_5","displayName":"Friday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancedaysfrom_6","displayName":"Saturday","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancedaysto","displayName":"To (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancedaysto_0","displayName":"Sunday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancedaysto_1","displayName":"Monday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancedaysto_2","displayName":"Tuesday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancedaysto_3","displayName":"Wednesday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancedaysto_4","displayName":"Thursday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancedaysto_5","displayName":"Friday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancedaysto_6","displayName":"Saturday","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehighprioritylimit","displayName":"High Priority Limit: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehighpriorityunit","displayName":"High Priority Unit: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehighpriorityunit_1","displayName":"Kbps","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehighpriorityunit_2","displayName":"Mbps","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehighpriorityunit_3","displayName":"Unlimited","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom","displayName":"From (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_0","displayName":"12 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_1","displayName":"1 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_2","displayName":"2 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_3","displayName":"3 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_4","displayName":"4 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_5","displayName":"5 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_6","displayName":"6 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_7","displayName":"7 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_8","displayName":"8 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_9","displayName":"9 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_10","displayName":"10 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_11","displayName":"11 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_12","displayName":"12 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_13","displayName":"1 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_14","displayName":"2 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_15","displayName":"3 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_16","displayName":"4 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_17","displayName":"5 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_18","displayName":"6 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_19","displayName":"7 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_20","displayName":"8 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_21","displayName":"9 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_22","displayName":"10 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursfrom_23","displayName":"11 PM","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto","displayName":"To (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_0","displayName":"12 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_1","displayName":"1 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_2","displayName":"2 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_3","displayName":"3 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_4","displayName":"4 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_5","displayName":"5 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_6","displayName":"6 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_7","displayName":"7 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_8","displayName":"8 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_9","displayName":"9 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_10","displayName":"10 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_11","displayName":"11 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_12","displayName":"12 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_13","displayName":"1 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_14","displayName":"2 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_15","displayName":"3 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_16","displayName":"4 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_17","displayName":"5 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_18","displayName":"6 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_19","displayName":"7 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_20","displayName":"8 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_21","displayName":"9 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_22","displayName":"10 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancehoursto_23","displayName":"11 PM","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancelowprioritylimit","displayName":"Low Priority Limit: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancelowpriorityunit","displayName":"Low Priority Unit: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancelowpriorityunit_1","displayName":"Kbps","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancelowpriorityunit_2","displayName":"Mbps","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancelowpriorityunit_3","displayName":"Unlimited","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancenormalprioritylimit","displayName":"Normal Priority Limit: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancenormalpriorityunit","displayName":"Normal Priority Unit: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancenormalpriorityunit_1","displayName":"Kbps","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancenormalpriorityunit_2","displayName":"Mbps","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_maintenance_bits_maintenancenormalpriorityunit_3","displayName":"Unlimited","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work","displayName":"Set up a work schedule to limit the maximum network bandwidth used for BITS background transfers","description":"This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers during the work and nonwork days and hours. The work schedule is defined using a weekly calendar, which consists of days of the week and hours of the day. All hours and days that are not defined in a work schedule are considered non-work hours.\r\n\r\n If you enable this policy setting, you can set up a schedule for limiting network bandwidth during both work and nonwork hours. After the work schedule is defined, you can set the bandwidth usage limits for each of the three BITS background priority levels: high, normal, and low.\r\n\r\n You can specify a limit to use for background jobs during a work schedule. For example, you can limit the network bandwidth of low priority jobs to 128 Kbps from 8:00 A.M. to 5:00 P.M. on Monday through Friday, and then set the limit to 512 Kbps for nonwork hours.\r\n\r\n If you disable or do not configure this policy setting, BITS uses all available unused bandwidth for background job transfers.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-bits#admx-bits-bits-maxbandwidthv2-work"],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_ignorelimitsonlan","displayName":"Ignore bandwidth limits if the source and the destination are on the same subnet. (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_ignorelimitsonlan_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_ignorelimitsonlan_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_nonworkhighprioritylimit","displayName":"High Priority Limit: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_nonworkhighpriorityunit","displayName":"High Priority Unit: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_nonworkhighpriorityunit_1","displayName":"Kbps","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_nonworkhighpriorityunit_2","displayName":"Mbps","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_nonworkhighpriorityunit_3","displayName":"Unlimited","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_nonworklowprioritylimit","displayName":"Low Priority Limit: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_nonworklowpriorityunit","displayName":"Low Priority Unit: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_nonworklowpriorityunit_1","displayName":"Kbps","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_nonworklowpriorityunit_2","displayName":"Mbps","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_nonworklowpriorityunit_3","displayName":"Unlimited","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_nonworknormalprioritylimit","displayName":"Normal Priority Limit: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_nonworknormalpriorityunit","displayName":"Normal Priority Unit: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_nonworknormalpriorityunit_1","displayName":"Kbps","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_nonworknormalpriorityunit_2","displayName":"Mbps","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_nonworknormalpriorityunit_3","displayName":"Unlimited","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workdaysfrom","displayName":"From (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workdaysfrom_0","displayName":"Sunday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workdaysfrom_1","displayName":"Monday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workdaysfrom_2","displayName":"Tuesday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workdaysfrom_3","displayName":"Wednesday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workdaysfrom_4","displayName":"Thursday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workdaysfrom_5","displayName":"Friday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workdaysfrom_6","displayName":"Saturday","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workdaysto","displayName":"To (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workdaysto_0","displayName":"Sunday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workdaysto_1","displayName":"Monday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workdaysto_2","displayName":"Tuesday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workdaysto_3","displayName":"Wednesday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workdaysto_4","displayName":"Thursday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workdaysto_5","displayName":"Friday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workdaysto_6","displayName":"Saturday","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhighprioritylimit","displayName":"High Priority Limit: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhighpriorityunit","displayName":"High Priority Unit: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhighpriorityunit_1","displayName":"Kbps","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhighpriorityunit_2","displayName":"Mbps","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhighpriorityunit_3","displayName":"Unlimited","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom","displayName":"From (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_0","displayName":"12 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_1","displayName":"1 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_2","displayName":"2 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_3","displayName":"3 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_4","displayName":"4 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_5","displayName":"5 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_6","displayName":"6 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_7","displayName":"7 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_8","displayName":"8 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_9","displayName":"9 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_10","displayName":"10 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_11","displayName":"11 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_12","displayName":"12 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_13","displayName":"1 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_14","displayName":"2 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_15","displayName":"3 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_16","displayName":"4 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_17","displayName":"5 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_18","displayName":"6 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_19","displayName":"7 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_20","displayName":"8 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_21","displayName":"9 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_22","displayName":"10 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursfrom_23","displayName":"11 PM","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto","displayName":"To (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_0","displayName":"12 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_1","displayName":"1 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_2","displayName":"2 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_3","displayName":"3 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_4","displayName":"4 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_5","displayName":"5 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_6","displayName":"6 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_7","displayName":"7 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_8","displayName":"8 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_9","displayName":"9 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_10","displayName":"10 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_11","displayName":"11 AM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_12","displayName":"12 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_13","displayName":"1 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_14","displayName":"2 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_15","displayName":"3 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_16","displayName":"4 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_17","displayName":"5 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_18","displayName":"6 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_19","displayName":"7 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_20","displayName":"8 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_21","displayName":"9 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_22","displayName":"10 PM","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_workhoursto_23","displayName":"11 PM","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_worklowprioritylimit","displayName":"Low Priority Limit: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_worklowpriorityunit","displayName":"Low Priority Unit: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_worklowpriorityunit_1","displayName":"Kbps","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_worklowpriorityunit_2","displayName":"Mbps","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_worklowpriorityunit_3","displayName":"Unlimited","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_worknormalprioritylimit","displayName":"Normal Priority Limit: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_worknormalpriorityunit","displayName":"Normal Priority Unit: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_worknormalpriorityunit_1","displayName":"Kbps","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_worknormalpriorityunit_2","displayName":"Mbps","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxbandwidthv2_work_bits_worknormalpriorityunit_3","displayName":"Unlimited","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxcachesize","displayName":"Limit the BITS Peercache size","description":"This policy setting limits the maximum amount of disk space that can be used for the BITS peer cache, as a percentage of the total system disk size. BITS will add files to the peer cache and make those files available to peers until the cache content reaches the specified cache size. By default, BITS will use 1 percent of the total system disk for the peercache.\r\n\r\n If you enable this policy setting, you can enter the percentage of disk space to be used for the BITS peer cache. You can enter a value between 1 percent and 80 percent.\r\n\r\n If you disable or do not configure this policy setting, the default size of the BITS peer cache is 1 percent of the total system disk size.\r\n\r\n Note: This policy setting has no effect if the \"Allow BITS peer caching\" setting is disabled or not configured.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-bits#admx-bits-bits-maxcachesize"],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxcachesize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxcachesize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxcachesize_bits_maxsize","displayName":"Percentage of disk space to be used for the BITS peercache: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxcontentage","displayName":"Limit the age of files in the BITS Peercache","description":"This policy setting limits the maximum age of files in the Background Intelligent Transfer Service (BITS) peer cache. In order to make the most efficient use of disk space, by default BITS removes any files in the peer cache that have not been accessed in the past 90 days.\r\n\r\n If you enable this policy setting, you can specify in days the maximum age of files in the cache. You can enter a value between 1 and 120 days.\r\n\r\n If you disable or do not configure this policy setting, files that have not been accessed for the past 90 days will be removed from the peer cache.\r\n\r\n Note: This policy setting has no effect if the \"Allow BITS Peercaching\" policy setting is disabled or not configured.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-bits#admx-bits-bits-maxcontentage"],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxcontentage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxcontentage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxcontentage_bits_maxcontentagelist","displayName":"Number of days: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxdownloadtime","displayName":"Limit the maximum BITS job download time","description":"This policy setting limits the amount of time that Background Intelligent Transfer Service (BITS) will take to download the files in a BITS job.\r\n\r\n The time limit applies only to the time that BITS is actively downloading files. When the cumulative download time exceeds this limit, the job is placed in the error state.\r\n\r\n By default BITS uses a maximum download time of 90 days (7,776,000 seconds).\r\n\r\n If you enable this policy setting, you can set the maximum job download time to a specified number of seconds.\r\n\r\n If you disable or do not configure this policy setting, the default value of 90 days (7,776,000 seconds) will be used.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-bits#admx-bits-bits-maxdownloadtime"],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxdownloadtime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxdownloadtime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxdownloadtime_bits_maxdownloadseconds","displayName":"Active Job Timeout in seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxfilesperjob","displayName":"Limit the maximum number of files allowed in a BITS job","description":"This policy setting limits the number of files that a BITS job can contain. By default, a BITS job is limited to 200 files. You can use this setting to raise or lower the maximum number of files a BITS jobs can contain.\r\n\r\n If you enable this policy setting, BITS will limit the maximum number of files a job can contain to the specified number.\r\n\r\n If you disable or do not configure this policy setting, BITS will use the default value of 200 for the maximum number of files a job can contain.\r\n\r\n Note: BITS Jobs created by services and the local administrator account do not count toward this limit.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-bits#admx-bits-bits-maxfilesperjob"],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxfilesperjob_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxfilesperjob_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxfilesperjob_bits_maxfilesperjoblist","displayName":"Maximum number of files allowed in a BITS job: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxjobspermachine","displayName":"Limit the maximum number of BITS jobs for this computer","description":"This policy setting limits the number of BITS jobs that can be created for all users of the computer. By default, BITS limits the total number of jobs that can be created on the computer to 300 jobs. You can use this policy setting to raise or lower the maximum number of user BITS jobs.\r\n\r\n If you enable this policy setting, BITS will limit the maximum number of BITS jobs to the specified number.\r\n\r\n If you disable or do not configure this policy setting, BITS will use the default BITS job limit of 300 jobs.\r\n\r\n Note: BITS jobs created by services and the local administrator account do not count toward this limit.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-bits#admx-bits-bits-maxjobspermachine"],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxjobspermachine_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxjobspermachine_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxjobspermachine_bits_maxjobspermachinelist","displayName":"Maximum number of BITS jobs for this computer: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxjobsperuser","displayName":"Limit the maximum number of BITS jobs for each user","description":"This policy setting limits the number of BITS jobs that can be created by a user. By default, BITS limits the total number of jobs that can be created by a user to 60 jobs. You can use this setting to raise or lower the maximum number of BITS jobs a user can create.\r\n\r\n If you enable this policy setting, BITS will limit the maximum number of BITS jobs a user can create to the specified number.\r\n\r\n If you disable or do not configure this policy setting, BITS will use the default user BITS job limit of 300 jobs.\r\n\r\n Note: This limit must be lower than the setting specified in the \"Maximum number of BITS jobs for this computer\" policy setting, or 300 if the \"Maximum number of BITS jobs for this computer\" policy setting is not configured. BITS jobs created by services and the local administrator account do not count toward this limit.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-bits#admx-bits-bits-maxjobsperuser"],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxjobsperuser_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxjobsperuser_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxjobsperuser_bits_maxjobsperuserlist","displayName":"Maximum number of BITS jobs for each user: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxrangesperfile","displayName":"Limit the maximum number of ranges that can be added to the file in a BITS job","description":"This policy setting limits the number of ranges that can be added to a file in a BITS job. By default, files in a BITS job are limited to 500 ranges per file. You can use this setting to raise or lower the maximum number ranges per file.\r\n\r\n If you enable this policy setting, BITS will limit the maximum number of ranges that can be added to a file to the specified number.\r\n\r\n If you disable or do not configure this policy setting, BITS will limit ranges to 500 ranges per file.\r\n\r\n Note: BITS Jobs created by services and the local administrator account do not count toward this limit.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-bits#admx-bits-bits-maxrangesperfile"],"options":[{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxrangesperfile_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxrangesperfile_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_bits_bits_maxrangesperfile_bits_maxrangesperfilelist","displayName":"Maximum number of ranges that can be added to the file in a BITS job: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_ciphersuiteorder_sslciphersuiteorder","displayName":"SSL Cipher Suite Order","description":"This policy setting determines the cipher suites used by the Secure Socket Layer (SSL).\r\n\r\nIf you enable this policy setting, SSL cipher suites are prioritized in the order specified.\r\n\r\nIf you disable or do not configure this policy setting, default cipher suite order is used.\r\n\r\nLink for all the cipherSuites: http://go.microsoft.com/fwlink/?LinkId=517265\r\n\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder#admx-ciphersuiteorder-sslciphersuiteorder"],"options":[{"id":"device_vendor_msft_policy_config_admx_ciphersuiteorder_sslciphersuiteorder_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_ciphersuiteorder_sslciphersuiteorder_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_ciphersuiteorder_sslciphersuiteorder_pol_sslciphersuiteorder","displayName":"SSL Cipher Suites (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_ciphersuiteorder_sslcurveorder","displayName":"ECC Curve Order","description":"This policy setting determines the priority order of ECC curves used with ECDHE cipher suites.\r\n\r\nIf you enable this policy setting, ECC curves are prioritized in the order specified.(Enter one Curve name per line)\r\n\r\nIf you disable or do not configure this policy setting, the default ECC curve order is used.\r\n\r\nDefault Curve Order\r\n============\r\ncurve25519\r\nNistP256\r\nNistP384\r\n\r\nTo See all the curves supported on the system, Use the following command:\r\n\r\nCertUtil.exe -DisplayEccCurve\r\n\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder#admx-ciphersuiteorder-sslcurveorder"],"options":[{"id":"device_vendor_msft_policy_config_admx_ciphersuiteorder_sslcurveorder_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_ciphersuiteorder_sslcurveorder_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_ciphersuiteorder_sslcurveorder_sslcurveorderlist","displayName":"ECC Curve Order: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_com_appmgmt_com_searchforclsid_2","displayName":"Download missing COM components","description":"This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires.\r\n\r\nMany Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs cannot perform all their functions unless Windows has internally registered the required components.\r\n\r\nIf you enable this policy setting and a component registration is missing, the system searches for it in Active Directory and, if it is found, downloads it. The resulting searches might make some programs start or run slowly.\r\n\r\nIf you disable or do not configure this policy setting, the program continues without the registration. As a result, the program might not perform all its functions, or it might stop.\r\n\r\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-com#admx-com-appmgmt-com-searchforclsid-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_com_appmgmt_com_searchforclsid_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_com_appmgmt_com_searchforclsid_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_forcedefaultlockscreen","displayName":"Force a specific default lock screen and logon image","description":"This setting allows you to force a specific default lock screen and logon image by entering the path (location) of the image file. The same image will be used for both the lock and logon screens.\r\n\r\nThis setting lets you specify the default lock screen and logon image shown when no user is signed in, and also sets the specified image as the default for all users (it replaces the inbox default image).\r\n\r\nTo use this setting, type the fully qualified path and name of the file that stores the default lock screen and logon image. You can type a local path, such as C:\\Windows\\Web\\Screen\\img104.jpg or a UNC path, such as \\\\Server\\Share\\Corp.jpg.\r\n\r\nThis can be used in conjunction with the \"Prevent changing lock screen and logon image\" setting to always force the specified lock screen and logon image to be shown.\r\n\r\nNote: This setting only applies to Enterprise, Education, and Server SKUs.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay#admx-controlpaneldisplay-cpl-personalization-forcedefaultlockscreen"],"options":[{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_forcedefaultlockscreen_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_forcedefaultlockscreen_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_forcedefaultlockscreen_lockscreenimage","displayName":"Path to lock screen image: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_forcedefaultlockscreen_lockscreenoverlaysdisabled","displayName":"Turn off fun facts, tips, tricks, and more on lock screen (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_forcedefaultlockscreen_lockscreenoverlaysdisabled_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_forcedefaultlockscreen_lockscreenoverlaysdisabled_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_nochanginglockscreen","displayName":"Prevent changing lock screen and logon image","description":"Prevents users from changing the background image shown when the machine is locked or when on the logon screen.\r\n\r\nBy default, users can change the background image shown when the machine is locked or displaying the logon screen.\r\n\r\nIf you enable this setting, the user will not be able to change their lock screen and logon image, and they will instead see the default image.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay#admx-controlpaneldisplay-cpl-personalization-nochanginglockscreen"],"options":[{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_nochanginglockscreen_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_nochanginglockscreen_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_nochangingstartmenubackground","displayName":"Prevent changing start menu background","description":"Prevents users from changing the look of their start menu background, such as its color or accent.\r\n\r\nBy default, users can change the look of their start menu background, such as its color or accent.\r\n\r\nIf you enable this setting, the user will be assigned the default start menu background and colors and will not be allowed to change them.\r\n\r\nIf the \"Force a specific background and accent color\" policy is also set on a supported version of Windows, then those colors take precedence over this policy.\r\n\r\nIf the \"Force a specific Start background\" policy is also set on a supported version of Windows, then that background takes precedence over this policy.\r\n\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay#admx-controlpaneldisplay-cpl-personalization-nochangingstartmenubackground"],"options":[{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_nochangingstartmenubackground_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_nochangingstartmenubackground_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_nolockscreen","displayName":"Do not display the lock screen","description":"This policy setting controls whether the lock screen appears for users.\r\n\r\nIf you enable this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see their selected tile after locking their PC.\r\n\r\nIf you disable or do not configure this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see a lock screen after locking their PC. They must dismiss the lock screen using touch, the keyboard, or by dragging it with the mouse.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay#admx-controlpaneldisplay-cpl-personalization-nolockscreen"],"options":[{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_nolockscreen_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_nolockscreen_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_personalcolors","displayName":"Force a specific background and accent color","description":"Forces Windows to use the specified colors for the background and accent. The color values are specified in hex as #RGB.\r\n\r\nBy default, users can change the background and accent colors.\r\n\r\nIf this setting is enabled, the background and accent colors of Windows will be set to the specified colors and users cannot change those colors. This setting will not be applied if the specified colors do not meet a contrast ratio of 2:1 with white text.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay#admx-controlpaneldisplay-cpl-personalization-personalcolors"],"options":[{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_personalcolors_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_personalcolors_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_personalcolors_personalcolors_accent","displayName":"Accent color: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_personalcolors_personalcolors_background","displayName":"Start background color: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_settheme","displayName":"Load a specific theme","description":"Specifies which theme file is applied to the computer the first time a user logs on.\r\n\r\nIf you enable this setting, the theme that you specify will be applied when a new user logs on for the first time. This policy does not prevent the user from changing the theme or any of the theme elements such as the desktop background, color, sounds, or screen saver after the first logon.\r\n\r\nIf you disable or do not configure this setting, the default theme will be applied at the first logon.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay#admx-controlpaneldisplay-cpl-personalization-settheme"],"options":[{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_settheme_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_settheme_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_settheme_themefilename","displayName":"Path to theme file: (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_startbackground","displayName":"Force a specific Start background","description":"Forces the Start screen to use one of the available backgrounds, 1 through 20, and prevents the user from changing it.\r\n\r\nIf this setting is set to zero or not configured, then Start uses the default background, and users can change it.\r\n\r\nIf this setting is set to a nonzero value, then Start uses the specified background, and users cannot change it. If the specified background is not supported, the default background is used.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay#admx-controlpaneldisplay-cpl-personalization-startbackground"],"options":[{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_startbackground_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_startbackground_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_controlpaneldisplay_cpl_personalization_startbackground_startbackgroundspin","displayName":"Background ID: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_cpls_usedefaulttile","displayName":"Apply the default account picture to all users","description":"This policy setting allows an administrator to standardize the account pictures for all users on a system to the default account picture. One application for this policy setting is to standardize the account pictures to a company logo.\r\n\r\nNote: The default account picture is stored at %PROGRAMDATA%\\Microsoft\\User Account Pictures\\user.jpg. The default guest picture is stored at %PROGRAMDATA%\\Microsoft\\User Account Pictures\\guest.jpg. If the default pictures do not exist, an empty frame is displayed.\r\n\r\nIf you enable this policy setting, the default user account picture will display for all users on the system with no customization allowed.\r\n\r\nIf you disable or do not configure this policy setting, users will be able to customize their account pictures.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-cpls#admx-cpls-usedefaulttile"],"options":[{"id":"device_vendor_msft_policy_config_admx_cpls_usedefaulttile_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_cpls_usedefaulttile_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credentialproviders_allowdomaindelaylock","displayName":"Allow users to select when a password is required when resuming from connected standby","description":"This policy setting allows you to control whether a user can change the time before a password is required when a Connected Standby device screen turns off.\r\n\r\nIf you enable this policy setting, a user on a Connected Standby device can change the amount of time after the device's screen turns off before a password is required when waking the device. The time is limited by any EAS settings or Group Policies that affect the maximum idle time before a device locks. Additionally, if a password is required when a screensaver turns on, the screensaver timeout will limit the options the user may choose.\r\n\r\nIf you disable this policy setting, a user cannot change the amount of time after the device's screen turns off before a password is required when waking the device. Instead, a password is required immediately after the screen turns off.\r\n\r\nIf you don't configure this policy setting on a domain-joined device, a user cannot change the amount of time after the device's screen turns off before a password is required when waking the device. Instead, a password is required immediately after the screen turns off.\r\n\r\nIf you don't configure this policy setting on a workgroup device, a user on a Connected Standby device can change the amount of time after the device's screen turns off before a password is required when waking the device. The time is limited by any EAS settings or Group Policies that affect the maximum idle time before a device locks. Additionally, if a password is required when a screensaver turns on, the screensaver timeout will limit the options the user may choose.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-credentialproviders#admx-credentialproviders-allowdomaindelaylock"],"options":[{"id":"device_vendor_msft_policy_config_admx_credentialproviders_allowdomaindelaylock_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credentialproviders_allowdomaindelaylock_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credentialproviders_defaultcredentialprovider","displayName":"Assign a default credential provider","description":"This policy setting allows the administrator to assign a specified credential provider as the default credential provider.\r\n\r\nIf you enable this policy setting, the specified credential provider is selected on other user tile.\r\n\r\nIf you disable or do not configure this policy setting, the system picks the default credential provider on other user tile.\r\n\r\nNote: A list of registered credential providers and their GUIDs can be found in the registry at HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-credentialproviders#admx-credentialproviders-defaultcredentialprovider"],"options":[{"id":"device_vendor_msft_policy_config_admx_credentialproviders_defaultcredentialprovider_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credentialproviders_defaultcredentialprovider_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credentialproviders_defaultcredentialprovider_defaultcredentialprovider_message","displayName":"Assign the following credential provider as the default credential provider: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_credentialproviders_excludedcredentialproviders","displayName":"Exclude credential providers","description":"This policy setting allows the administrator to exclude the specified\r\ncredential providers from use during authentication.\r\n\r\nNote: credential providers are used to process and validate user\r\ncredentials during logon or when authentication is required.\r\nWindows Vista provides two default credential providers:\r\nPassword and Smart Card. An administrator can install additional\r\ncredential providers for different sets of credentials\r\n(for example, to support biometric authentication).\r\n\r\nIf you enable this policy, an administrator can specify the CLSIDs\r\nof the credential providers to exclude from the set of installed\r\ncredential providers available for authentication purposes.\r\n\r\nIf you disable or do not configure this policy, all installed and otherwise enabled credential providers are available for authentication purposes.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-credentialproviders#admx-credentialproviders-excludedcredentialproviders"],"options":[{"id":"device_vendor_msft_policy_config_admx_credentialproviders_excludedcredentialproviders_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credentialproviders_excludedcredentialproviders_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credentialproviders_excludedcredentialproviders_excludedcredentialproviders_message","displayName":"Exclude the following credential providers: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowdefaultcredentials","displayName":"Allow delegating default credentials","description":"This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).\r\n\r\nThis policy setting applies when server authentication was achieved by using a trusted X509 certificate or Kerberos.\r\n\r\nIf you enable this policy setting, you can specify the servers to which the user's default credentials can be delegated (default credentials are those that you use when first logging on to Windows).\r\n\r\nThe policy becomes effective the next time the user signs on to a computer running Windows.\r\n\r\nIf you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any computer. Applications depending upon this delegation behavior might fail authentication. For more information, see KB.\r\n\r\nFWlink for KB:\r\nhttp://go.microsoft.com/fwlink/?LinkId=301508\r\n\r\nNote: The \"Allow delegating default credentials\" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN.\r\n\r\nFor Example:\r\nTERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine\r\nTERMSRV/* Remote Desktop Session Host running on all machines.\r\nTERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-credssp#admx-credssp-allowdefaultcredentials"],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_allowdefaultcredentials_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowdefaultcredentials_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_allowdefaultcredentials_allowdefaultcredentials_name","displayName":"Add servers to the list: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowdefaultcredentials_concatenatedefaults_adc","displayName":"Concatenate OS defaults with input above (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_allowdefaultcredentials_concatenatedefaults_adc_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowdefaultcredentials_concatenatedefaults_adc_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_allowdefcredentialswhenntlmonly","displayName":"Allow delegating default credentials with NTLM-only server authentication","description":"This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).\r\n\r\nThis policy setting applies when server authentication was achieved via NTLM.\r\n\r\nIf you enable this policy setting, you can specify the servers to which the user's default credentials can be delegated (default credentials are those that you use when first logging on to Windows).\r\n\r\nIf you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any machine.\r\n\r\nNote: The \"Allow delegating default credentials with NTLM-only server authentication\" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN.\r\n\r\nFor Example:\r\nTERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine\r\nTERMSRV/* Remote Desktop Session Host running on all machines.\r\nTERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-credssp#admx-credssp-allowdefcredentialswhenntlmonly"],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_allowdefcredentialswhenntlmonly_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowdefcredentialswhenntlmonly_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_allowdefcredentialswhenntlmonly_allowdefcredentialswhenntlmonly_name","displayName":"Add servers to the list: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowdefcredentialswhenntlmonly_concatenatedefaults_adcn","displayName":"Concatenate OS defaults with input above (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_allowdefcredentialswhenntlmonly_concatenatedefaults_adcn_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowdefcredentialswhenntlmonly_concatenatedefaults_adcn_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_allowencryptionoracle","displayName":"Encryption Oracle Remediation","description":"Encryption Oracle Remediation\r\n\r\nThis policy setting applies to applications using the CredSSP component (for example: Remote Desktop Connection).\r\n\r\nSome versions of the CredSSP protocol are vulnerable to an encryption oracle attack against the client. This policy controls compatibility with vulnerable clients and servers. This policy allows you to set the level of protection desired for the encryption oracle vulnerability.\r\n\r\nIf you enable this policy setting, CredSSP version support will be selected based on the following options:\r\n\r\nForce Updated Clients: Client applications which use CredSSP will not be able to fall back to the insecure versions and services using CredSSP will not accept unpatched clients. Note: this setting should not be deployed until all remote hosts support the newest version.\r\n\r\nMitigated: Client applications which use CredSSP will not be able to fall back to the insecure version but services using CredSSP will accept unpatched clients. See the link below for important information about the risk posed by remaining unpatched clients.\r\n\r\nVulnerable: Client applications which use CredSSP will expose the remote servers to attacks by supporting fall back to the insecure versions and services using CredSSP will accept unpatched clients.\r\n\r\nFor more information about the vulnerability and servicing requirements for protection, see https://go.microsoft.com/fwlink/?linkid=866660\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-credssp#admx-credssp-allowencryptionoracle"],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_allowencryptionoracle_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowencryptionoracle_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_allowencryptionoracle_allowencryptionoracledrop","displayName":"Protection Level: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_allowencryptionoracle_allowencryptionoracledrop_0","displayName":"Force Updated Clients","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowencryptionoracle_allowencryptionoracledrop_1","displayName":"Mitigated","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowencryptionoracle_allowencryptionoracledrop_2","displayName":"Vulnerable","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_allowfreshcredentials","displayName":"Allow delegating fresh credentials","description":"This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).\r\n\r\nThis policy setting applies when server authentication was achieved via a trusted X509 certificate or Kerberos.\r\n\r\nIf you enable this policy setting, you can specify the servers to which the user's fresh credentials can be delegated (fresh credentials are those that you are prompted for when executing the application).\r\n\r\nIf you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*).\r\n\r\nIf you disable this policy setting, delegation of fresh credentials is not permitted to any machine.\r\n\r\nNote: The \"Allow delegating fresh credentials\" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard is permitted when specifying the SPN.\r\n\r\nFor Example:\r\nTERMSRV/host.humanresources.fabrikam.com\r\nRemote Desktop Session Host running on host.humanresources.fabrikam.com machine\r\nTERMSRV/* Remote Desktop Session Host running on all machines.\r\nTERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-credssp#admx-credssp-allowfreshcredentials"],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_allowfreshcredentials_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowfreshcredentials_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_allowfreshcredentials_allowfreshcredentials_name","displayName":"Add servers to the list: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowfreshcredentials_concatenatedefaults_afc","displayName":"Concatenate OS defaults with input above (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_allowfreshcredentials_concatenatedefaults_afc_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowfreshcredentials_concatenatedefaults_afc_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_allowfreshcredentialswhenntlmonly","displayName":"Allow delegating fresh credentials with NTLM-only server authentication","description":"This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).\r\n\r\nThis policy setting applies when server authentication was achieved via NTLM.\r\n\r\nIf you enable this policy setting, you can specify the servers to which the user's fresh credentials can be delegated (fresh credentials are those that you are prompted for when executing the application).\r\n\r\nIf you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*).\r\n\r\nIf you disable this policy setting, delegation of fresh credentials is not permitted to any machine.\r\n\r\nNote: The \"Allow delegating fresh credentials with NTLM-only server authentication\" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN.\r\n\r\nFor Example:\r\nTERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine\r\nTERMSRV/* Remote Desktop Session Host running on all machines.\r\nTERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-credssp#admx-credssp-allowfreshcredentialswhenntlmonly"],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_allowfreshcredentialswhenntlmonly_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowfreshcredentialswhenntlmonly_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_allowfreshcredentialswhenntlmonly_allowfreshcredentialswhenntlmonly_name","displayName":"Add servers to the list: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowfreshcredentialswhenntlmonly_concatenatedefaults_afcn","displayName":"Concatenate OS defaults with input above (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_allowfreshcredentialswhenntlmonly_concatenatedefaults_afcn_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowfreshcredentialswhenntlmonly_concatenatedefaults_afcn_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_allowsavedcredentials","displayName":"Allow delegating saved credentials","description":"This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).\r\n\r\nThis policy setting applies when server authentication was achieved via a trusted X509 certificate or Kerberos.\r\n\r\nIf you enable this policy setting, you can specify the servers to which the user's saved credentials can be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager).\r\n\r\nIf you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*).\r\n\r\nIf you disable this policy setting, delegation of saved credentials is not permitted to any machine.\r\n\r\nNote: The \"Allow delegating saved credentials\" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN.\r\n\r\nFor Example:\r\nTERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine\r\nTERMSRV/* Remote Desktop Session Host running on all machines.\r\nTERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-credssp#admx-credssp-allowsavedcredentials"],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_allowsavedcredentials_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowsavedcredentials_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_allowsavedcredentials_allowsavedcredentials_name","displayName":"Add servers to the list: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowsavedcredentials_concatenatedefaults_asc","displayName":"Concatenate OS defaults with input above (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_allowsavedcredentials_concatenatedefaults_asc_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowsavedcredentials_concatenatedefaults_asc_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_allowsavedcredentialswhenntlmonly","displayName":"Allow delegating saved credentials with NTLM-only server authentication","description":"This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).\r\n\r\nThis policy setting applies when server authentication was achieved via NTLM.\r\n\r\nIf you enable this policy setting, you can specify the servers to which the user's saved credentials can be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager).\r\n\r\nIf you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*) if the client machine is not a member of any domain. If the client is domain-joined, by default the delegation of saved credentials is not permitted to any machine.\r\n\r\nIf you disable this policy setting, delegation of saved credentials is not permitted to any machine.\r\n\r\nNote: The \"Allow delegating saved credentials with NTLM-only server authentication\" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN.\r\n\r\nFor Example:\r\nTERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine\r\nTERMSRV/* Remote Desktop Session Host running on all machines.\r\nTERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-credssp#admx-credssp-allowsavedcredentialswhenntlmonly"],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_allowsavedcredentialswhenntlmonly_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowsavedcredentialswhenntlmonly_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_allowsavedcredentialswhenntlmonly_allowsavedcredentialswhenntlmonly_name","displayName":"Add servers to the list: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowsavedcredentialswhenntlmonly_concatenatedefaults_ascn","displayName":"Concatenate OS defaults with input above (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_allowsavedcredentialswhenntlmonly_concatenatedefaults_ascn_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_allowsavedcredentialswhenntlmonly_concatenatedefaults_ascn_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_denydefaultcredentials","displayName":"Deny delegating default credentials","description":"This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).\r\n\r\nIf you enable this policy setting, you can specify the servers to which the user's default credentials cannot be delegated (default credentials are those that you use when first logging on to Windows).\r\n\r\nIf you disable or do not configure (by default) this policy setting, this policy setting does not specify any server.\r\n\r\nNote: The \"Deny delegating default credentials\" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN.\r\n\r\nFor Example:\r\nTERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine\r\nTERMSRV/* Remote Desktop Session Host running on all machines.\r\nTERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com\r\n\r\nThis policy setting can be used in combination with the \"Allow delegating default credentials\" policy setting to define exceptions for specific servers that are otherwise permitted when using wildcard characters in the \"Allow delegating default credentials\" server list.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-credssp#admx-credssp-denydefaultcredentials"],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_denydefaultcredentials_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_denydefaultcredentials_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_denydefaultcredentials_concatenatedefaults_ddc","displayName":"Concatenate OS defaults with input above (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_denydefaultcredentials_concatenatedefaults_ddc_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_denydefaultcredentials_concatenatedefaults_ddc_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_denydefaultcredentials_denydefaultcredentials_name","displayName":"Add servers to the list: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_credssp_denyfreshcredentials","displayName":"Deny delegating fresh credentials","description":"This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).\r\n\r\nIf you enable this policy setting, you can specify the servers to which the user's fresh credentials cannot be delegated (fresh credentials are those that you are prompted for when executing the application).\r\n\r\nIf you disable or do not configure (by default) this policy setting, this policy setting does not specify any server.\r\n\r\nNote: The \"Deny delegating fresh credentials\" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN.\r\n\r\nFor Example:\r\nTERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine\r\nTERMSRV/* Remote Desktop Session Host running on all machines.\r\nTERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com\r\n\r\nThis policy setting can be used in combination with the \"Allow delegating fresh credentials\" policy setting to define exceptions for specific servers that are otherwise permitted when using wildcard characters in the \"Allow delegating fresh credentials\" server list.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-credssp#admx-credssp-denyfreshcredentials"],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_denyfreshcredentials_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_denyfreshcredentials_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_denyfreshcredentials_concatenatedefaults_dfc","displayName":"Concatenate OS defaults with input above (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_denyfreshcredentials_concatenatedefaults_dfc_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_denyfreshcredentials_concatenatedefaults_dfc_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_denyfreshcredentials_denyfreshcredentials_name","displayName":"Add servers to the list: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_credssp_denysavedcredentials","displayName":"Deny delegating saved credentials","description":"This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).\r\n\r\nIf you enable this policy setting, you can specify the servers to which the user's saved credentials cannot be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager).\r\n\r\nIf you disable or do not configure (by default) this policy setting, this policy setting does not specify any server.\r\n\r\nNote: The \"Deny delegating saved credentials\" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN.\r\n\r\nFor Example:\r\nTERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine\r\nTERMSRV/* Remote Desktop Session Host running on all machines.\r\nTERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com\r\n\r\nThis policy setting can be used in combination with the \"Allow delegating saved credentials\" policy setting to define exceptions for specific servers that are otherwise permitted when using wildcard characters in the \"Allow delegating saved credentials\" server list.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-credssp#admx-credssp-denysavedcredentials"],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_denysavedcredentials_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_denysavedcredentials_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_denysavedcredentials_concatenatedefaults_dsc","displayName":"Concatenate OS defaults with input above (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_denysavedcredentials_concatenatedefaults_dsc_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_denysavedcredentials_concatenatedefaults_dsc_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_denysavedcredentials_denysavedcredentials_name","displayName":"Add servers to the list: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_credssp_restrictedremoteadministration","displayName":"Restrict delegation of credentials to remote servers","description":"When running in Restricted Admin or Remote Credential Guard mode, participating apps do not expose signed in or supplied credentials to a remote host. Restricted Admin limits access to resources located on other servers or networks from the remote host because credentials are not delegated. Remote Credential Guard does not limit access to resources because it redirects all requests back to the client device.\r\n\r\nParticipating apps:\r\nRemote Desktop Client\r\n\r\nIf you enable this policy setting, the following options are supported:\r\n \r\nRestrict credential delegation: Participating applications must use Restricted Admin or Remote Credential Guard to connect to remote hosts.\r\n \r\nRequire Remote Credential Guard: Participating applications must use Remote Credential Guard to connect to remote hosts.\r\n \r\nRequire Restricted Admin: Participating applications must use Restricted Admin to connect to remote hosts.\r\n\r\nIf you disable or do not configure this policy setting, Restricted Admin and Remote Credential Guard mode are not enforced and participating apps can delegate credentials to remote devices.\r\n\r\nNote: To disable most credential delegation, it may be sufficient to deny delegation in Credential Security Support Provider (CredSSP) by modifying Administrative template settings (located at Computer Configuration\\Administrative Templates\\System\\Credentials Delegation).\r\n\r\nNote: On Windows 8.1 and Windows Server 2012 R2, enabling this policy will enforce Restricted Administration mode, regardless of the mode chosen. These versions do not support Remote Credential Guard.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-credssp#admx-credssp-restrictedremoteadministration"],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_restrictedremoteadministration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_restrictedremoteadministration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credssp_restrictedremoteadministration_restrictedremoteadministrationdrop","displayName":"Use the following restricted mode: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_credssp_restrictedremoteadministration_restrictedremoteadministrationdrop_3","displayName":"Restrict Credential Delegation","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_restrictedremoteadministration_restrictedremoteadministrationdrop_2","displayName":"Require Remote Credential Guard","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credssp_restrictedremoteadministration_restrictedremoteadministrationdrop_1","displayName":"Require Restricted Admin","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credui_enablesecurecredentialprompting","displayName":"Require trusted path for credential entry","description":"This policy setting requires the user to enter Microsoft Windows credentials using a trusted path, to prevent a Trojan horse or other types of malicious code from stealing the user’s Windows credentials.\r\n\r\nNote: This policy affects nonlogon authentication tasks only. As a security best practice, this policy should be enabled.\r\n\r\nIf you enable this policy setting, users will be required to enter Windows credentials on the Secure Desktop by means of the trusted path mechanism.\r\n\r\nIf you disable or do not configure this policy setting, users will enter Windows credentials within the user’s desktop session, potentially allowing malicious code access to the user’s Windows credentials.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-credui#admx-credui-enablesecurecredentialprompting"],"options":[{"id":"device_vendor_msft_policy_config_admx_credui_enablesecurecredentialprompting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credui_enablesecurecredentialprompting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_credui_nolocalpasswordresetquestions","displayName":"Prevent the use of security questions for local accounts","description":"If you turn this policy setting on, local users won’t be able to set up and use security questions to reset their passwords.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-credui#admx-credui-nolocalpasswordresetquestions"],"options":[{"id":"device_vendor_msft_policy_config_admx_credui_nolocalpasswordresetquestions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_credui_nolocalpasswordresetquestions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_datacollection_commercialidpolicy","displayName":"Configure the Commercial ID","description":"This policy setting defines the identifier used to uniquely associate this device’s telemetry data as belonging to a given organization. If your organization is participating in a program that requires this device to be identified as belonging to your organization then use this setting to provide that identification. The value for this setting will be provided by Microsoft as part of the onboarding process for the program. \r\n\r\nIf you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its telemetry data with your organization.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-datacollection#admx-datacollection-commercialidpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_datacollection_commercialidpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_datacollection_commercialidpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_datacollection_commercialidpolicy_commercialidvalue","displayName":"Commercial Id: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_dcom_dcomactivationsecuritycheckallowlocallist","displayName":"Allow local activation security check exemptions","description":"Allows you to specify that local computer administrators can supplement the \"Define Activation Security Check exemptions\" list.\r\n\r\nIf you enable this policy setting, and DCOM does not find an explicit entry for a DCOM server application id (appid) in the \"Define Activation Security Check exemptions\" policy (if enabled), DCOM will look for an entry in the locally configured list.\r\n\r\nIf you disable this policy setting, DCOM will not look in the locally configured DCOM activation security check exemption list.\r\n\r\nIf you do not configure this policy setting, DCOM will only look in the locally configured exemption list if the \"Define Activation Security Check exemptions\" policy is not configured.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dcom#admx-dcom-dcomactivationsecuritycheckallowlocallist"],"options":[{"id":"device_vendor_msft_policy_config_admx_dcom_dcomactivationsecuritycheckallowlocallist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dcom_dcomactivationsecuritycheckallowlocallist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dcom_dcomactivationsecuritycheckexemptionlist","displayName":"Define Activation Security Check exemptions","description":"Allows you to view and change a list of DCOM server application ids (appids) which are exempted from the DCOM Activation security check. DCOM uses two such lists, one configured via Group Policy through this policy setting, and the other via the actions of local computer administrators. DCOM ignores the second list when this policy setting is configured, unless the \"Allow local activation security check exemptions\" policy is enabled.\r\n\r\nDCOM server appids added to this policy must be listed in curly-brace format. For example: {b5dcb061-cefb-42e0-a1be-e6a6438133fe}. If you enter a non-existent or improperly formatted appid DCOM will add it to the list without checking for errors.\r\n\r\nIf you enable this policy setting, you can view and change the list of DCOM activation security check exemptions defined by Group Policy settings. If you add an appid to this list and set its value to 1, DCOM will not enforce the Activation security check for that DCOM server. If you add an appid to this list and set its value to 0 DCOM will always enforce the Activation security check for that DCOM server regardless of local settings.\r\n\r\nIf you disable this policy setting, the appid exemption list defined by Group Policy is deleted, and the one defined by local computer administrators is used.\r\n\r\nIf you do not configure this policy setting, the appid exemption list defined by local computer administrators is used.\r\n\r\nNotes:\r\n\r\nThe DCOM Activation security check is done after a DCOM server process is started, but before an object activation request is dispatched to the server process. This access check is done against the DCOM server's custom launch permission security descriptor if it exists, or otherwise against the configured defaults.\r\n\r\nIf the DCOM server's custom launch permission contains explicit DENY entries this may mean that object activations that would have previously succeeded for such specified users, once the DCOM server process was up and running, might now fail instead. The proper action in this situation is to re-configure the DCOM server's custom launch permission settings for correct security settings, but this policy setting may be used in the short-term as an application compatibility deployment aid.\r\n\r\nDCOM servers added to this exemption list are only exempted if their custom launch permissions do not contain specific LocalLaunch, RemoteLaunch, LocalActivate, or RemoteActivate grant or deny entries for any users or groups. Also note, exemptions for DCOM Server Appids added to this list will apply to both 32-bit and 64-bit versions of the server if present.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dcom#admx-dcom-dcomactivationsecuritycheckexemptionlist"],"options":[{"id":"device_vendor_msft_policy_config_admx_dcom_dcomactivationsecuritycheckexemptionlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dcom_dcomactivationsecuritycheckexemptionlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dcom_dcomactivationsecuritycheckexemptionlist_dcom_lbl_actseccheckexemptionlist","displayName":"Add\\remove DCOM servers to the exemption list: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_dcom_dcomactivationsecuritycheckexemptionlist_dcom_lbl_actseccheckexemptionlist_key","displayName":"Name","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_dcom_dcomactivationsecuritycheckexemptionlist_dcom_lbl_actseccheckexemptionlist_value","displayName":"Value","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_desktop_nodesktop","displayName":"Hide and disable all items on the desktop","description":"Removes icons, shortcuts, and other default and user-defined items from the desktop, including Briefcase, Recycle Bin, Computer, and Network Locations.\r\n\r\nRemoving icons and shortcuts does not prevent the user from using another method to start the programs or opening the items they represent.\r\n\r\nAlso, see \"Items displayed in Places Bar\" in User Configuration\\Administrative Templates\\Windows Components\\Common Open File Dialog to remove the Desktop icon from the Places Bar. This will help prevent users from saving data to the Desktop.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-desktop#admx-desktop-nodesktop"],"options":[{"id":"device_vendor_msft_policy_config_admx_desktop_nodesktop_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_desktop_nodesktop_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_devicecompat_deviceflags","displayName":"Device compatibility settings","description":"Changes behavior of Microsoft bus drivers to work with specific devices.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-devicecompat#admx-devicecompat-deviceflags"],"options":[{"id":"device_vendor_msft_policy_config_admx_devicecompat_deviceflags_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_devicecompat_deviceflags_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_devicecompat_drivershims","displayName":"Driver compatibility settings","description":"Changes behavior of 3rd-party drivers to work around incompatibilities introduced between OS versions.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-devicecompat#admx-devicecompat-drivershims"],"options":[{"id":"device_vendor_msft_policy_config_admx_devicecompat_drivershims_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_devicecompat_drivershims_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_deviceguard_configcipolicy","displayName":"Deploy App Control for Business","description":"Deploy Windows Defender Application Control\r\n\r\nThis policy setting lets you deploy a Code Integrity Policy to a machine to control what is allowed to run on that machine.\r\n\r\nIf you deploy a Code Integrity Policy, Windows will restrict what can run in both kernel mode and on the Windows Desktop based on the policy. To enable this policy the machine must be rebooted. \r\n\r\nThe file path must be either a UNC path (for example, \\\\ServerName\\ShareName\\SIPolicy.p7b), or a locally valid path (for example, C:\\FolderName\\SIPolicy.p7b). The local machine account (LOCAL SYSTEM) must have access permission to the policy file.\r\n \r\nIf using a signed and protected policy then disabling this policy setting doesn't remove the feature from the computer. Instead, you must either:\r\n\r\n 1) first update the policy to a non-protected policy and then disable the setting, or\r\n 2) disable the setting and then remove the policy from each computer, with a physically present user.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-deviceguard#admx-deviceguard-configcipolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_deviceguard_configcipolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_deviceguard_configcipolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_deviceguard_configcipolicy_configcipolicyfilepathtext","displayName":"Code Integrity Policy file path: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_allowadmininstall","displayName":"Allow administrators to override Device Installation Restriction policies","description":"This policy setting allows you to determine whether members of the Administrators group can install and update the drivers for any device, regardless of other policy settings.\r\n\r\nIf you enable this policy setting, members of the Administrators group can use the Add Hardware wizard or the Update Driver wizard to install and update the drivers for any device. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.\r\n\r\nIf you disable or do not configure this policy setting, members of the Administrators group are subject to all policy settings that restrict device installation.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-deviceinstallation#admx-deviceinstallation-deviceinstall-allowadmininstall"],"options":[{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_allowadmininstall_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_allowadmininstall_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_deniedpolicy_detailtext","displayName":"Display a custom message when installation is prevented by a policy setting","description":"This policy setting allows you to display a custom message to users in a notification when a device installation is attempted and a policy setting prevents the installation.\r\n\r\nIf you enable this policy setting, Windows displays the text you type in the Detail Text box when a policy setting prevents device installation.\r\n\r\nIf you disable or do not configure this policy setting, Windows displays a default message when a policy setting prevents device installation.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-deviceinstallation#admx-deviceinstallation-deviceinstall-deniedpolicy-detailtext"],"options":[{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_deniedpolicy_detailtext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_deniedpolicy_detailtext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_deniedpolicy_detailtext_deviceinstall_deniedpolicy_detailtext_text","displayName":"Detail Text (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_deniedpolicy_simpletext","displayName":"Display a custom message title when device installation is prevented by a policy setting","description":"This policy setting allows you to display a custom message title in a notification when a device installation is attempted and a policy setting prevents the installation.\r\n\r\nIf you enable this policy setting, Windows displays the text you type in the Main Text box as the title text of a notification when a policy setting prevents device installation.\r\n\r\nIf you disable or do not configure this policy setting, Windows displays a default title in a notification when a policy setting prevents device installation.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-deviceinstallation#admx-deviceinstallation-deviceinstall-deniedpolicy-simpletext"],"options":[{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_deniedpolicy_simpletext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_deniedpolicy_simpletext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_deniedpolicy_simpletext_deviceinstall_deniedpolicy_simpletext_text","displayName":"Main Text (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_installtimeout","displayName":"Configure device installation time-out","description":"This policy setting allows you to configure the number of seconds Windows waits for a device installation task to complete. \r\n\r\nIf you enable this policy setting, Windows waits for the number of seconds you specify before terminating the installation.\r\n\r\nIf you disable or do not configure this policy setting, Windows waits 240 seconds for a device installation task to complete before terminating the installation.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-deviceinstallation#admx-deviceinstallation-deviceinstall-installtimeout"],"options":[{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_installtimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_installtimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_installtimeout_deviceinstall_installtimeout_time","displayName":"Device Installation Timeout (in seconds) (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_policy_reboottime","displayName":"Time (in seconds) to force reboot when required for policy changes to take effect","description":"This policy setting establishes the amount of time (in seconds) that the system will wait to reboot in order to enforce a change in device installation restriction policies.\r\n\r\nIf you enable this policy setting, set the amount of seconds you want the system to wait until a reboot.\r\n\r\nIf you disable or do not configure this policy setting, the system does not force a reboot.\r\n\r\nNote: If no reboot is forced, the device installation restriction right will not take effect until the system is restarted.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-deviceinstallation#admx-deviceinstallation-deviceinstall-policy-reboottime"],"options":[{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_policy_reboottime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_policy_reboottime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_policy_reboottime_deviceinstall_policy_reboottime_time","displayName":"Reboot Timeout (in seconds) (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_removable_deny","displayName":"Prevent installation of removable devices","description":"This policy setting allows you to prevent Windows from installing removable devices. A device is considered removable when the driver for the device to which it is connected indicates that the device is removable. For example, a Universal Serial Bus (USB) device is reported to be removable by the drivers for the USB hub to which the device is connected. This policy setting takes precedence over any other policy setting that allows Windows to install a device.\r\n\r\nIf you enable this policy setting, Windows is prevented from installing removable devices and existing removable devices cannot have their drivers updated. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of removable devices from a remote desktop client to the remote desktop server.\r\n\r\nIf you disable or do not configure this policy setting, Windows can install and update device drivers for removable devices as allowed or prevented by other policy settings.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-deviceinstallation#admx-deviceinstallation-deviceinstall-removable-deny"],"options":[{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_removable_deny_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_removable_deny_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_systemrestore","displayName":"Prevent creation of a system restore point during device activity that would normally prompt creation of a restore point","description":"This policy setting allows you to prevent Windows from creating a system restore point during device activity that would normally prompt Windows to create a system restore point. Windows normally creates restore points for certain driver activity, such as the installation of an unsigned driver. A system restore point enables you to more easily restore your system to its state before the activity. \r\n\r\nIf you enable this policy setting, Windows does not create a system restore point when one would normally be created.\r\n\r\nIf you disable or do not configure this policy setting, Windows creates a system restore point as it normally would.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-deviceinstallation#admx-deviceinstallation-deviceinstall-systemrestore"],"options":[{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_systemrestore_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_deviceinstall_systemrestore_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_driverinstall_classes_allowuser","displayName":"Allow non-administrators to install drivers for these device setup classes","description":"This policy setting specifies a list of device setup class GUIDs describing driver packages that non-administrator members of the built-in Users group may install on the system.\r\n\r\nIf you enable this policy setting, members of the Users group may install new drivers for the specified device setup classes. The drivers must be signed according to Windows Driver Signing Policy, or be signed by publishers already in the TrustedPublisher store.\r\n\r\nIf you disable or do not configure this policy setting, only members of the Administrators group are allowed to install new driver packages on the system.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-deviceinstallation#admx-deviceinstallation-driverinstall-classes-allowuser"],"options":[{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_driverinstall_classes_allowuser_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_driverinstall_classes_allowuser_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_deviceinstallation_driverinstall_classes_allowuser_driverinstall_classes_allowuser_list","displayName":"Allow Users to install driver packages for these classes: (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_devicesetup_deviceinstall_balloontips","displayName":"Turn off \"Found New Hardware\" balloons during device installation","description":"This policy setting allows you to turn off \"Found New Hardware\" balloons during device installation.\r\n\r\nIf you enable this policy setting, \"Found New Hardware\" balloons do not appear while a device is being installed.\r\n\r\nIf you disable or do not configure this policy setting, \"Found New Hardware\" balloons appear while a device is being installed, unless the driver for the device suppresses the balloons.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-devicesetup#admx-devicesetup-deviceinstall-balloontips"],"options":[{"id":"device_vendor_msft_policy_config_admx_devicesetup_deviceinstall_balloontips_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_devicesetup_deviceinstall_balloontips_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_devicesetup_driversearchplaces_searchorderconfiguration","displayName":"Specify search order for device driver source locations","description":"This policy setting allows you to specify the order in which Windows searches source locations for device drivers. \r\n\r\nIf you enable this policy setting, you can select whether Windows searches for drivers on Windows Update unconditionally, only if necessary, or not at all.\r\n\r\nNote that searching always implies that Windows will attempt to search Windows Update exactly one time. With this setting, Windows will not continually search for updates. This setting is used to ensure that the best software will be found for the device, even if the network is temporarily available.\r\n\r\nIf the setting for searching only if needed is specified, then Windows will search for a driver only if a driver is not locally available on the system.\r\n\r\nIf you disable or do not configure this policy setting, members of the Administrators group can determine the priority order in which Windows searches source locations for device drivers.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-devicesetup#admx-devicesetup-driversearchplaces-searchorderconfiguration"],"options":[{"id":"device_vendor_msft_policy_config_admx_devicesetup_driversearchplaces_searchorderconfiguration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_devicesetup_driversearchplaces_searchorderconfiguration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_devicesetup_driversearchplaces_searchorderconfiguration_driversearchplaces_searchorderconfiguration_dropdown","displayName":"Select search order: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_devicesetup_driversearchplaces_searchorderconfiguration_driversearchplaces_searchorderconfiguration_dropdown_1","displayName":"Always search Windows Update","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_devicesetup_driversearchplaces_searchorderconfiguration_driversearchplaces_searchorderconfiguration_dropdown_2","displayName":"Search Windows Update only if needed","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_devicesetup_driversearchplaces_searchorderconfiguration_driversearchplaces_searchorderconfiguration_dropdown_0","displayName":"Do not search Windows Update","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dfs_dfsdiscoverdc","displayName":"Configure how often a DFS client discovers domain controllers","description":"This policy setting allows you to configure how often a Distributed File System (DFS) client attempts to discover domain controllers on a network. By default, a DFS client attempts to discover domain controllers every 15 minutes.\r\n\r\nIf you enable this policy setting, you can configure how often a DFS client attempts to discover domain controllers. This value is specified in minutes.\r\n\r\nIf you disable or do not configure this policy setting, the default value of 15 minutes applies.\r\n\r\nNote: The minimum value you can select is 15 minutes. If you try to set this setting to a value less than 15 minutes, the default value of 15 minutes is applied.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dfs#admx-dfs-dfsdiscoverdc"],"options":[{"id":"device_vendor_msft_policy_config_admx_dfs_dfsdiscoverdc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dfs_dfsdiscoverdc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dfs_dfsdiscoverdc_dfsdiscoverdialog","displayName":"Time in minutes: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_digitallocker_digitalx_diableapplication_titletext_2","displayName":"Do not allow Digital Locker to run","description":"Specifies whether Digital Locker can run.\r\n\r\nDigital Locker is a dedicated download manager associated with Windows Marketplace and a feature of Windows that can be used to manage and download products acquired and stored in the user's Windows Marketplace Digital Locker.\r\n\r\nIf you enable this setting, Digital Locker will not run.\r\n\r\nIf you disable or do not configure this setting, Digital Locker can be run.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-digitallocker#admx-digitallocker-digitalx-diableapplication-titletext-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_digitallocker_digitalx_diableapplication_titletext_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_digitallocker_digitalx_diableapplication_titletext_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_diskdiagnostic_dfdalertpolicy","displayName":"Disk Diagnostic: Configure custom alert text","description":"This policy setting substitutes custom alert text in the disk diagnostic message shown to users when a disk reports a S.M.A.R.T. fault. \r\n\r\nIf you enable this policy setting, Windows displays custom alert text in the disk diagnostic message. The custom text may not exceed 512 characters. \r\n\r\nIf you disable or do not configure this policy setting, Windows displays the default alert text in the disk diagnostic message. \r\n\r\nNo reboots or service restarts are required for this policy setting to take effect: changes take effect immediately. \r\n\r\nThis policy setting only takes effect if the Disk Diagnostic scenario policy setting is enabled or not configured and the Diagnostic Policy Service (DPS) is in the running state. When the service is stopped or disabled, diagnostic scenarios are not executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console. \r\n\r\nNote: For Windows Server systems, this policy setting applies only if the Desktop Experience optional component is installed and the Remote Desktop Services role is not installed. \r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-diskdiagnostic#admx-diskdiagnostic-dfdalertpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_diskdiagnostic_dfdalertpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_diskdiagnostic_dfdalertpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_diskdiagnostic_dfdalertpolicy_dfdalertpolicytitle","displayName":"Custom alert text (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_diskdiagnostic_wdiscenarioexecutionpolicy","displayName":"Disk Diagnostic: Configure execution level","description":"This policy setting determines the execution level for S.M.A.R.T.-based disk diagnostics. \r\n\r\nSelf-Monitoring And Reporting Technology (S.M.A.R.T.) is a standard mechanism for storage devices to report faults to Windows. A disk that reports a S.M.A.R.T. fault may need to be repaired or replaced. The Diagnostic Policy Service (DPS) detects and logs S.M.A.R.T. faults to the event log when they occur. \r\n\r\nIf you enable this policy setting, the DPS also warns users of S.M.A.R.T. faults and guides them through backup and recovery to minimize potential data loss. \r\n\r\nIf you disable this policy, S.M.A.R.T. faults are still detected and logged, but no corrective action is taken. \r\n\r\nIf you do not configure this policy setting, the DPS enables S.M.A.R.T. fault resolution by default. \r\n\r\nThis policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured. \r\n\r\nNo reboots or service restarts are required for this policy setting to take effect: changes take effect immediately. \r\n\r\nThis policy setting takes effect only when the DPS is in the running state. When the service is stopped or disabled, diagnostic scenarios are not executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console. \r\n\r\nNote: For Windows Server systems, this policy setting applies only if the Desktop Experience optional component is installed and the Remote Desktop Services role is not installed. \r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-diskdiagnostic#admx-diskdiagnostic-wdiscenarioexecutionpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_diskdiagnostic_wdiscenarioexecutionpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_diskdiagnostic_wdiscenarioexecutionpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_disknvcache_bootresumepolicy","displayName":"Turn off boot and resume optimizations","description":"This policy setting turns off the boot and resume optimizations for the hybrid hard disks in the system.\r\n\r\nIf you enable this policy setting, the system does not use the non-volatile (NV) cache to optimize boot and resume.\r\n\r\nIf you disable this policy setting, the system uses the NV cache to achieve faster boot and resume. The system determines the data that will be stored in the NV cache to optimize boot and resume. The required data is stored in the NV cache during shutdown and hibernate, respectively. This might cause a slight increase in the time taken for shutdown and hibernate.\r\n\r\nIf you do not configure this policy setting, the default behavior is observed and the NV cache is used for boot and resume optimizations.\r\n\r\nNote: This policy setting is applicable only if the NV cache feature is on.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-disknvcache#admx-disknvcache-bootresumepolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_disknvcache_bootresumepolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_disknvcache_bootresumepolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_disknvcache_cachepowermodepolicy","displayName":"Turn off cache power mode","description":"This policy setting turns off power save mode on the hybrid hard disks in the system.\r\n\r\nIf you enable this policy setting, the hard disks are not put into NV cache power save mode and no power savings are achieved.\r\n\r\nIf you disable this policy setting, the hard disks are put into an NV cache power saving mode. In this mode, the system tries to save power by aggressively spinning down the disk.\r\n\r\nIf you do not configure this policy setting, the default behavior is to allow the hybrid hard disks to be in power save mode.\r\n\r\nNote: This policy setting is applicable only if the NV cache feature is on.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-disknvcache#admx-disknvcache-cachepowermodepolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_disknvcache_cachepowermodepolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_disknvcache_cachepowermodepolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_disknvcache_featureoffpolicy","displayName":"Turn off non-volatile cache feature","description":"This policy setting turns off all support for the non-volatile (NV) cache on all hybrid hard disks in the system. To check if you have hybrid hard disks in the system, from Device Manager, right-click the disk drive and select Properties. The NV cache can be used to optimize boot and resume by reading data from the cache while the disks are spinning up. The NV cache can also be used to reduce the power consumption of the system by keeping the disks spun down while satisfying reads and writes from the cache.\r\n\r\nIf you enable this policy setting, the system will not manage the NV cache and will not enable NV cache power saving mode.\r\n\r\nIf you disable this policy setting, the system will manage the NV cache on the disks if the other policy settings for the NV cache are appropriately configured.\r\n\r\nNote: This policy setting will take effect on next boot.\r\n\r\nIf you do not configure this policy setting, the default behavior is to turn on support for the NV cache.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-disknvcache#admx-disknvcache-featureoffpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_disknvcache_featureoffpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_disknvcache_featureoffpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_disknvcache_solidstatepolicy","displayName":"Turn off solid state mode","description":"This policy setting turns off the solid state mode for the hybrid hard disks. \r\n\r\nIf you enable this policy setting, frequently written files such as the file system metadata and registry may not be stored in the NV cache.\r\n\r\nIf you disable this policy setting, the system will store frequently written data into the non-volatile (NV) cache. This allows the system to exclusively run out of the NV cache and power down the disk for longer periods to save power. Note that this can cause increased wear of the NV cache.\r\n\r\nIf you do not configure this policy setting, the default behavior of the system is observed and frequently written files will be stored in the NV cache.\r\n\r\nNote: This policy setting is applicable only if the NV cache feature is on.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-disknvcache#admx-disknvcache-solidstatepolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_disknvcache_solidstatepolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_disknvcache_solidstatepolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_enable","displayName":"Enable disk quotas","description":"This policy setting turns on and turns off disk quota management on all NTFS volumes of the computer, and prevents users from changing the setting.\r\n\r\nIf you enable this policy setting, disk quota management is turned on, and users cannot turn it off.\r\n\r\nIf you disable the policy setting, disk quota management is turned off, and users cannot turn it on.\r\n\r\nIf this policy setting is not configured, disk quota management is turned off by default, but administrators can turn it on.\r\n\r\nTo prevent users from changing the setting while a setting is in effect, the system disables the \"Enable quota management\" option on the Quota tab of NTFS volumes.\r\n\r\nNote: This policy setting turns on disk quota management but does not establish or enforce a particular disk quota limit. To specify a disk quota limit, use the \"Default quota limit and warning level\" policy setting. Otherwise, the system uses the physical space on the volume as the quota limit.\r\n\r\nNote: To turn on or turn off disk quota management without specifying a setting, in My Computer, right-click the name of an NTFS volume, click Properties, click the Quota tab, and then click \"Enable quota management.\"\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-diskquota#admx-diskquota-dq-enable"],"options":[{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_enable_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_enable_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_enforce","displayName":"Enforce disk quota limit","description":"This policy setting determines whether disk quota limits are enforced and prevents users from changing the setting.\r\n\r\nIf you enable this policy setting, disk quota limits are enforced. If you disable this policy setting, disk quota limits are not enforced. When you enable or disable this policy setting, the system disables the \"Deny disk space to users exceeding quota limit\" option on the Quota tab so administrators cannot make changes while the setting is in effect.\r\n\r\nIf you do not configure this policy setting, the disk quota limit is not enforced by default, but administrators can change the setting.\r\n\r\nEnforcement is optional. When users reach an enforced disk quota limit, the system responds as though the physical space on the volume were exhausted. When users reach an unenforced limit, their status in the Quota Entries window changes, but they can continue to write to the volume as long as physical space is available.\r\n\r\nNote: This policy setting overrides user settings that enable or disable quota enforcement on their volumes.\r\n\r\nNote: To specify a disk quota limit, use the \"Default quota limit and warning level\" policy setting. Otherwise, the system uses the physical space on the volume as the quota limit.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-diskquota#admx-diskquota-dq-enforce"],"options":[{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_enforce_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_enforce_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit","displayName":"Specify default quota limit and warning level","description":"This policy setting specifies the default disk quota limit and warning level for new users of the volume.\r\n\r\nThis policy setting determines how much disk space can be used by each user on each of the NTFS file system volumes on a computer. It also specifies the warning level, the point at which the user's status in the Quota Entries window changes to indicate that the user is approaching the disk quota limit.\r\n\r\nThis setting overrides new users’ settings for the disk quota limit and warning level on their volumes, and it disables the corresponding options in the \"Select the default quota limit for new users of this volume\" section on the Quota tab.\r\n\r\nThis policy setting applies to all new users as soon as they write to the volume. It does not affect disk quota limits for current users, or affect customized limits and warning levels set for particular users (on the Quota tab in Volume Properties).\r\n\r\nIf you disable or do not configure this policy setting, the disk space available to users is not limited. The disk quota management feature uses the physical space on each volume as its quota limit and warning level.\r\n\r\nWhen you select a limit, remember that the same limit applies to all users on all volumes, regardless of actual volume size. Be sure to set the limit and warning level so that it is reasonable for the range of volumes in the group.\r\n\r\nThis policy setting is effective only when disk quota management is enabled on the volume. Also, if disk quotas are not enforced, users can exceed the quota limit you set. When users reach the quota limit, their status in the Quota Entries window changes, but users can continue to write to the volume.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-diskquota#admx-diskquota-dq-limit"],"options":[{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit_dq_limitunits","displayName":"Units (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit_dq_limitunits_1","displayName":"KB","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit_dq_limitunits_2","displayName":"MB","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit_dq_limitunits_3","displayName":"GB","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit_dq_limitunits_4","displayName":"TB","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit_dq_limitunits_5","displayName":"PB","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit_dq_limitunits_6","displayName":"EB","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit_dq_limitvalue","displayName":"Value (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit_dq_thresholdunits","displayName":"Units (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit_dq_thresholdunits_1","displayName":"KB","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit_dq_thresholdunits_2","displayName":"MB","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit_dq_thresholdunits_3","displayName":"GB","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit_dq_thresholdunits_4","displayName":"TB","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit_dq_thresholdunits_5","displayName":"PB","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit_dq_thresholdunits_6","displayName":"EB","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_limit_dq_thresholdvalue","displayName":"Value (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_logeventoverlimit","displayName":"Log event when quota limit is exceeded","description":"This policy setting determines whether the system records an event in the local Application log when users reach their disk quota limit on a volume, and prevents users from changing the logging setting.\r\n\r\nIf you enable this policy setting, the system records an event when the user reaches their limit. If you disable this policy setting, no event is recorded. Also, when you enable or disable this policy setting, the system disables the \"Log event when a user exceeds their quota limit\" option on the Quota tab, so administrators cannot change the setting while a setting is in effect.\r\n\r\nIf you do not configure this policy setting, no events are recorded, but administrators can use the Quota tab option to change the setting.\r\n\r\nThis policy setting is independent of the enforcement policy settings for disk quotas. As a result, you can direct the system to log an event, regardless of whether or not you choose to enforce the disk quota limit.\r\n\r\nAlso, this policy setting does not affect the Quota Entries window on the Quota tab. Even without the logged event, users can detect that they have reached their limit, because their status in the Quota Entries window changes.\r\n\r\nNote: To find the logging option, in My Computer, right-click the name of an NTFS file system volume, click Properties, and then click the Quota tab.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-diskquota#admx-diskquota-dq-logeventoverlimit"],"options":[{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_logeventoverlimit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_logeventoverlimit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_logeventoverthreshold","displayName":"Log event when quota warning level is exceeded","description":"This policy setting determines whether the system records an event in the Application log when users reach their disk quota warning level on a volume.\r\n\r\nIf you enable this policy setting, the system records an event. If you disable this policy setting, no event is recorded. When you enable or disable this policy setting, the system disables the corresponding \"Log event when a user exceeds their warning level\" option on the Quota tab so that administrators cannot change logging while a policy setting is in effect.\r\n\r\nIf you do not configure this policy setting, no event is recorded, but administrators can use the Quota tab option to change the logging setting.\r\n\r\nThis policy setting does not affect the Quota Entries window on the Quota tab. Even without the logged event, users can detect that they have reached their warning level because their status in the Quota Entries window changes.\r\n\r\nNote: To find the logging option, in My Computer, right-click the name of an NTFS file system volume, click Properties, and then click the Quota tab.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-diskquota#admx-diskquota-dq-logeventoverthreshold"],"options":[{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_logeventoverthreshold_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_logeventoverthreshold_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_removablemedia","displayName":"Apply policy to removable media","description":"This policy setting extends the disk quota policies in this folder to NTFS file system volumes on removable media.\r\n\r\nIf you disable or do not configure this policy setting, the disk quota policies established in this folder apply to fixed-media NTFS volumes only. Note: When this policy setting is applied, the computer will apply the disk quota to both fixed and removable media.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-diskquota#admx-diskquota-dq-removablemedia"],"options":[{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_removablemedia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_diskquota_dq_removablemedia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_distributedlinktracking_dlt_allowdomainmode","displayName":"Allow Distributed Link Tracking clients to use domain resources","description":"Specifies that Distributed Link Tracking clients in this domain may use the Distributed Link Tracking (DLT) server, which runs on domain controllers. The DLT client enables programs to track linked files that are moved within an NTFS volume, to another NTFS volume on the same computer, or to an NTFS volume on another computer. The DLT client can more reliably track links when allowed to use the DLT server. This policy should not be set unless the DLT server is running on all domain controllers in the domain.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-distributedlinktracking#admx-distributedlinktracking-dlt-allowdomainmode"],"options":[{"id":"device_vendor_msft_policy_config_admx_distributedlinktracking_dlt_allowdomainmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_distributedlinktracking_dlt_allowdomainmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_allowfqdnnetbiosqueries","displayName":"Allow NetBT queries for fully qualified domain names","description":"Specifies that NetBIOS over TCP/IP (NetBT) queries are issued for fully qualified domain names. \r\n\r\nIf you enable this policy setting, NetBT queries will be issued for multi-label and fully qualified domain names such as \"www.example.com\" in addition to single-label names. \r\n\r\nIf you disable this policy setting, or if you do not configure this policy setting, NetBT queries will only be issued for single-label names such as \"example\" and not for multi-label and fully qualified domain names.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-allowfqdnnetbiosqueries"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_allowfqdnnetbiosqueries_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_allowfqdnnetbiosqueries_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_appendtomultilabelname","displayName":"Allow DNS suffix appending to unqualified multi-label name queries","description":"Specifies that computers may attach suffixes to an unqualified multi-label name before sending subsequent DNS queries if the original name query fails.\r\n\r\nA name containing dots, but not dot-terminated, is called an unqualified multi-label name, for example \"server.corp\" is an unqualified multi-label name. The name \"server.corp.contoso.com.\" is an example of a fully qualified name because it contains a terminating dot.\r\n\r\nFor example, if attaching suffixes is allowed, an unqualified multi-label name query for \"server.corp\" will be queried by the DNS client first. If the query succeeds, the response is returned to the client. If the query fails, the unqualified multi-label name is appended with DNS suffixes. These suffixes can be derived from a combination of the local DNS client's primary domain suffix, a connection-specific domain suffix, and a DNS suffix search list.\r\n\r\nIf attaching suffixes is allowed, and a DNS client with a primary domain suffix of \"contoso.com\" performs a query for \"server.corp\" the DNS client will send a query for \"server.corp\" first, and then a query for \"server.corp.contoso.com.\" second if the first query fails.\r\n\r\nIf you enable this policy setting, suffixes are allowed to be appended to an unqualified multi-label name if the original name query fails.\r\n\r\nIf you disable this policy setting, no suffixes are appended to unqualified multi-label name queries if the original name query fails.\r\n\r\nIf you do not configure this policy setting, computers will use their local DNS client settings to determine the query behavior for unqualified multi-label names.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-appendtomultilabelname"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_appendtomultilabelname_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_appendtomultilabelname_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_domain","displayName":"Connection-specific DNS suffix","description":"Specifies a connection-specific DNS suffix. This policy setting supersedes local connection-specific DNS suffixes, and those configured using DHCP.\r\n\r\nTo use this policy setting, click Enabled, and then enter a string value representing the DNS suffix.\r\n\r\nIf you enable this policy setting, the DNS suffix that you enter will be applied to all network connections used by computers that receive this policy setting.\r\n\r\nIf you disable this policy setting, or if you do not configure this policy setting, computers will use the local or DHCP supplied connection specific DNS suffix, if configured.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-domain"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_domain_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_domain_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_domain_dns_domainlabel","displayName":"DNS suffix: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_domainnamedevolutionlevel","displayName":"Primary DNS suffix devolution level","description":"Specifies if the devolution level that DNS clients will use if they perform primary DNS suffix devolution during the name resolution process.\r\n\r\nWith devolution, a DNS client creates queries by appending a single-label, unqualified domain name with the parent suffix of the primary DNS suffix name, and the parent of that suffix, and so on, stopping if the name is successfully resolved or at a level determined by devolution settings. Devolution can be used when a user or application submits a query for a single-label domain name.\r\n\r\nThe DNS client appends DNS suffixes to the single-label, unqualified domain name based on the state of the Append primary and connection specific DNS suffixes radio button and Append parent suffixes of the primary DNS suffix check box on the DNS tab in Advanced TCP/IP Settings for the Internet Protocol (TCP/IP) Properties dialog box.\r\n\r\nDevolution is not enabled if a global suffix search list is configured using Group Policy.\r\n\r\nIf a global suffix search list is not configured, and the Append primary and connection specific DNS suffixes radio button is selected, the DNS client appends the following names to a single-label name when it sends DNS queries:\r\n\r\nThe primary DNS suffix, as specified on the Computer Name tab of the System control panel.\r\n\r\nEach connection-specific DNS suffix, assigned either through DHCP or specified in the DNS suffix for this connection box on the DNS tab in the Advanced TCP/IP Settings dialog box for each connection.\r\n\r\nFor example, when a user submits a query for a single-label name such as \"example,\" the DNS client attaches a suffix such as \"microsoft.com\" resulting in the query \"example.microsoft.com,\" before sending the query to a DNS server.\r\n\r\nIf a DNS suffix search list is not specified, the DNS client attaches the primary DNS suffix to a single-label name. If this query fails, the connection-specific DNS suffix is attached for a new query. If none of these queries are resolved, the client devolves the primary DNS suffix of the computer (drops the leftmost label of the primary DNS suffix), attaches this devolved primary DNS suffix to the single-label name, and submits this new query to a DNS server.\r\n\r\nFor example, if the primary DNS suffix ooo.aaa.microsoft.com is attached to the non-dot-terminated single-label name \"example,\" and the DNS query for example.ooo.aaa.microsoft.com fails, the DNS client devolves the primary DNS suffix (drops the leftmost label) till the specified devolution level, and submits a query for example.aaa.microsoft.com. If this query fails, the primary DNS suffix is devolved further if it is under specified devolution level and the query example.microsoft.com is submitted. If this query fails, devolution continues if it is under specified devolution level and the query example.microsoft.com is submitted, corresponding to a devolution level of two. The primary DNS suffix cannot be devolved beyond a devolution level of two. The devolution level can be configured using this policy setting. The default devolution level is two.\r\n\r\nIf you enable this policy setting and DNS devolution is also enabled, DNS clients use the DNS devolution level that you specify.\r\n\r\nIf this policy setting is disabled, or if this policy setting is not configured, DNS clients use the default devolution level of two provided that DNS devolution is enabled.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-domainnamedevolutionlevel"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_domainnamedevolutionlevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_domainnamedevolutionlevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_domainnamedevolutionlevel_dns_domainnamedevolutionlevellabel","displayName":"Set the primary DNS suffix devolution level (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_idnencoding","displayName":"Turn off IDN encoding","description":"Specifies whether the DNS client should convert internationalized domain names (IDNs) to Punycode when the computer is on non-domain networks with no WINS servers configured.\r\n\r\nIf this policy setting is enabled, IDNs are not converted to Punycode.\r\n\r\nIf this policy setting is disabled, or if this policy setting is not configured, IDNs are converted to Punycode when the computer is on non-domain networks with no WINS servers configured.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-idnencoding"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_idnencoding_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_idnencoding_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_idnmapping","displayName":"IDN mapping","description":"Specifies whether the DNS client should convert internationalized domain names (IDNs) to the Nameprep form, a canonical Unicode representation of the string.\r\n\r\nIf this policy setting is enabled, IDNs are converted to the Nameprep form.\r\n\r\nIf this policy setting is disabled, or if this policy setting is not configured, IDNs are not converted to the Nameprep form.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-idnmapping"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_idnmapping_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_idnmapping_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_nameserver","displayName":"DNS servers","description":"Defines the DNS servers to which a computer sends queries when it attempts to resolve names. This policy setting supersedes the list of DNS servers configured locally and those configured using DHCP. \r\n\r\nTo use this policy setting, click Enabled, and then enter a space-delimited list of IP addresses in the available field. To use this policy setting, you must enter at least one IP address.\r\n\r\nIf you enable this policy setting, the list of DNS servers is applied to all network connections used by computers that receive this policy setting. \r\n\r\nIf you disable this policy setting, or if you do not configure this policy setting, computers will use the local or DHCP supplied list of DNS servers, if configured.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-nameserver"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_nameserver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_nameserver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_nameserver_dns_nameserverlabel","displayName":"IP addresses: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_preferlocalresponsesoverlowerorderdns","displayName":"Prefer link local responses over DNS when received over a network with higher precedence","description":"Specifies that responses from link local name resolution protocols received over a network interface that is higher in the binding order are preferred over DNS responses from network interfaces lower in the binding order. Examples of link local name resolution protocols include link local multicast name resolution (LLMNR) and NetBIOS over TCP/IP (NetBT).\r\n\r\nIf you enable this policy setting, responses from link local protocols will be preferred over DNS responses if the local responses are from a network with a higher binding order.\r\n\r\nIf you disable this policy setting, or if you do not configure this policy setting, then DNS responses from networks lower in the binding order will be preferred over responses from link local protocols received from networks higher in the binding order.\r\n\r\nNote: This policy setting is applicable only if the turn off smart multi-homed name resolution policy setting is disabled or not configured.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-preferlocalresponsesoverlowerorderdns"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_preferlocalresponsesoverlowerorderdns_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_preferlocalresponsesoverlowerorderdns_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_primarydnssuffix","displayName":"Primary DNS suffix","description":"Specifies the primary DNS suffix used by computers in DNS name registration and DNS name resolution.\r\n\r\nTo use this policy setting, click Enabled and enter the entire primary DNS suffix you want to assign. For example: microsoft.com.\r\n\r\nImportant: In order for changes to this policy setting to be applied on computers that receive it, you must restart Windows.\r\n\r\nIf you enable this policy setting, it supersedes the primary DNS suffix configured in the DNS Suffix and NetBIOS Computer Name dialog box using the System control panel.\r\n\r\nYou can use this policy setting to prevent users, including local administrators, from changing the primary DNS suffix.\r\n\r\nIf you disable this policy setting, or if you do not configure this policy setting, each computer uses its local primary DNS suffix, which is usually the DNS name of Active Directory domain to which it is joined.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-primarydnssuffix"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_primarydnssuffix_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_primarydnssuffix_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_primarydnssuffix_dns_primarydnssuffixbox","displayName":"Enter a primary DNS suffix: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registeradaptername","displayName":"Register DNS records with connection-specific DNS suffix","description":"Specifies if a computer performing dynamic DNS registration will register A and PTR resource records with a concatenation of its computer name and a connection-specific DNS suffix, in addition to registering these records with a concatenation of its computer name and the primary DNS suffix.\r\n\r\nBy default, a DNS client performing dynamic DNS registration registers A and PTR resource records with a concatenation of its computer name and the primary DNS suffix. For example, a computer name of mycomputer and a primary DNS suffix of microsoft.com will be registered as: mycomputer.microsoft.com.\r\n\r\nIf you enable this policy setting, a computer will register A and PTR resource records with its connection-specific DNS suffix, in addition to the primary DNS suffix. This applies to all network connections used by computers that receive this policy setting.\r\n\r\nFor example, with a computer name of mycomputer, a primary DNS suffix of microsoft.com, and a connection specific DNS suffix of VPNconnection, a computer will register A and PTR resource records for mycomputer.VPNconnection and mycomputer.microsoft.com when this policy setting is enabled.\r\n\r\nImportant: This policy setting is ignored on a DNS client computer if dynamic DNS registration is disabled.\r\n\r\nIf you disable this policy setting, or if you do not configure this policy setting, a DNS client computer will not register any A and PTR resource records using a connection-specific DNS suffix.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-registeradaptername"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registeradaptername_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registeradaptername_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registerreverselookup","displayName":"Register PTR records","description":"Specifies if DNS client computers will register PTR resource records.\r\n\r\nBy default, DNS clients configured to perform dynamic DNS registration will attempt to register PTR resource record only if they successfully registered the corresponding A resource record.\r\n\r\nIf you enable this policy setting, registration of PTR records will be determined by the option that you choose under Register PTR records.\r\n\r\nTo use this policy setting, click Enabled, and then select one of the following options from the drop-down list:\r\n\r\nDo not register: Computers will not attempt to register PTR resource records.\r\n\r\nRegister: Computers will attempt to register PTR resource records even if registration of the corresponding A records was not successful.\r\n\r\nRegister only if A record registration succeeds: Computers will attempt to register PTR resource records only if registration of the corresponding A records was successful.\r\n\r\nIf you disable this policy setting, or if you do not configure this policy setting, computers will use locally configured settings.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-registerreverselookup"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registerreverselookup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registerreverselookup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registerreverselookup_dns_registerreverselookup_box","displayName":"Register PTR records: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registerreverselookup_dns_registerreverselookup_box_2","displayName":"Register only if A record registration succeeds","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registerreverselookup_dns_registerreverselookup_box_1","displayName":"Register","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registerreverselookup_dns_registerreverselookup_box_0","displayName":"Do not register","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registrationenabled","displayName":"Dynamic update","description":"Specifies if DNS dynamic update is enabled. Computers configured for DNS dynamic update automatically register and update their DNS resource records with a DNS server.\r\n\r\nIf you enable this policy setting, or you do not configure this policy setting, computers will attempt to use dynamic DNS registration on all network connections that have connection-specific dynamic DNS registration enabled. For a dynamic DNS registration to be enabled on a network connection, the connection-specific configuration must allow dynamic DNS registration, and this policy setting must not be disabled.\r\n\r\nIf you disable this policy setting, computers may not use dynamic DNS registration for any of their network connections, regardless of the configuration for individual network connections.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-registrationenabled"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registrationenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registrationenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registrationoverwritesinconflict","displayName":"Replace addresses in conflicts","description":"Specifies whether dynamic updates should overwrite existing resource records that contain conflicting IP addresses.\r\n\r\nThis policy setting is designed for computers that register address (A) resource records in DNS zones that do not use Secure Dynamic Updates. Secure Dynamic Update preserves ownership of resource records and does not allow a DNS client to overwrite records that are registered by other computers.\r\n\r\nDuring dynamic update of resource records in a zone that does not use Secure Dynamic Updates, an A resource record might exist that associates the client's host name with an IP address different than the one currently in use by the client. By default, the DNS client attempts to replace the existing A resource record with an A resource record that has the client's current IP address.\r\n\r\nIf you enable this policy setting or if you do not configure this policy setting, DNS clients maintain their default behavior and will attempt to replace conflicting A resource records during dynamic update.\r\n\r\nIf you disable this policy setting, existing A resource records that contain conflicting IP addresses will not be replaced during a dynamic update, and an error will be recorded in Event Viewer.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-registrationoverwritesinconflict"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registrationoverwritesinconflict_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registrationoverwritesinconflict_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registrationrefreshinterval","displayName":"Registration refresh interval","description":"Specifies the interval used by DNS clients to refresh registration of A and PTR resource. This policy setting only applies to computers performing dynamic DNS updates.\r\n\r\nComputers configured to perform dynamic DNS registration of A and PTR resource records periodically reregister their records with DNS servers, even if the record has not changed. This reregistration is required to indicate to DNS servers that records are current and should not be automatically removed (scavenged) when a DNS server is configured to delete stale records.\r\n\r\nWarning: If record scavenging is enabled on the zone, the value of this policy setting should never be longer than the value of the DNS zone refresh interval. Configuring the registration refresh interval to be longer than the refresh interval of the DNS zone might result in the undesired deletion of A and PTR resource records.\r\n\r\nTo specify the registration refresh interval, click Enabled and then enter a value of 1800 or greater. The value that you specify is the number of seconds to use for the registration refresh interval. For example, 1800 seconds is 30 minutes.\r\n\r\nIf you enable this policy setting, registration refresh interval that you specify will be applied to all network connections used by computers that receive this policy setting.\r\n\r\nIf you disable this policy setting, or if you do not configure this policy setting, computers will use the local or DHCP supplied setting. By default, client computers configured with a static IP address attempt to update their DNS resource records once every 24 hours and DHCP clients will attempt to update their DNS resource records when a DHCP lease is granted or renewed.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-registrationrefreshinterval"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registrationrefreshinterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registrationrefreshinterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registrationrefreshinterval_dns_registrationrefreshintervallabel","displayName":"Seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registrationttl","displayName":"TTL value for A and PTR records","description":"\r\nSpecifies the value of the time to live (TTL) field in A and PTR resource records that are registered by computers to which this policy setting is applied.\r\n\r\nTo specify the TTL, click Enabled and then enter a value in seconds (for example, 900 is 15 minutes).\r\n\r\nIf you enable this policy setting, the TTL value that you specify will be applied to DNS resource records registered for all network connections used by computers that receive this policy setting.\r\n\r\nIf you disable this policy setting, or if you do not configure this policy setting, computers will use the TTL settings specified in DNS. By default, the TTL is 1200 seconds (20 minutes).\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-registrationttl"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registrationttl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registrationttl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_registrationttl_dns_registrationttllabel","displayName":"Seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_searchlist","displayName":"DNS suffix search list","description":"Specifies the DNS suffixes to attach to an unqualified single-label name before submission of a DNS query for that name.\r\n\r\nAn unqualified single-label name contains no dots. The name \"example\" is a single-label name. This is different from a fully qualified domain name such as \"example.microsoft.com.\"\r\n\r\nClient computers that receive this policy setting will attach one or more suffixes to DNS queries for a single-label name. For example, a DNS query for the single-label name \"example\" will be modified to \"example.microsoft.com\" before sending the query to a DNS server if this policy setting is enabled with a suffix of \"microsoft.com.\"\r\n\r\nTo use this policy setting, click Enabled, and then enter a string value representing the DNS suffixes that should be appended to single-label names. You must specify at least one suffix. Use a comma-delimited string, such as \"microsoft.com,serverua.microsoft.com,office.microsoft.com\" to specify multiple suffixes.\r\n\r\nIf you enable this policy setting, one DNS suffix is attached at a time for each query. If a query is unsuccessful, a new DNS suffix is added in place of the failed suffix, and this new query is submitted. The values are used in the order they appear in the string, starting with the leftmost value and proceeding to the right until a query is successful or all suffixes are tried.\r\n\r\nIf you disable this policy setting, or if you do not configure this policy setting, the primary DNS suffix and network connection-specific DNS suffixes are appended to the unqualified queries.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-searchlist"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_searchlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_searchlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_searchlist_dns_searchlistlabel","displayName":"DNS Suffixes: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_smartmultihomednameresolution","displayName":"Turn off smart multi-homed name resolution","description":"Specifies that a multi-homed DNS client should optimize name resolution across networks. The setting improves performance by issuing parallel DNS, link local multicast name resolution (LLMNR) and NetBIOS over TCP/IP (NetBT) queries across all networks. In the event that multiple positive responses are received, the network binding order is used to determine which response to accept.\r\n\r\nIf you enable this policy setting, the DNS client will not perform any optimizations. DNS queries will be issued across all networks first. LLMNR queries will be issued if the DNS queries fail, followed by NetBT queries if LLMNR queries fail.\r\n\r\nIf you disable this policy setting, or if you do not configure this policy setting, name resolution will be optimized when issuing DNS, LLMNR and NetBT queries.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-smartmultihomednameresolution"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_smartmultihomednameresolution_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_smartmultihomednameresolution_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_smartprotocolreorder","displayName":"Turn off smart protocol reordering","description":"Specifies that the DNS client should prefer responses from link local name resolution protocols on non-domain networks over DNS responses when issuing queries for flat names. Examples of link local name resolution protocols include link local multicast name resolution (LLMNR) and NetBIOS over TCP/IP (NetBT).\r\n\r\nIf you enable this policy setting, the DNS client will prefer DNS responses, followed by LLMNR, followed by NetBT for all networks. \r\n\r\nIf you disable this policy setting, or if you do not configure this policy setting, the DNS client will prefer link local responses for flat name queries on non-domain networks. \r\n\r\nNote: This policy setting is applicable only if the turn off smart multi-homed name resolution policy setting is disabled or not configured.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-smartprotocolreorder"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_smartprotocolreorder_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_smartprotocolreorder_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_updatesecuritylevel","displayName":"Update security level","description":"Specifies the security level for dynamic DNS updates.\r\n\r\nTo use this policy setting, click Enabled and then select one of the following values:\r\n\r\nUnsecure followed by secure - computers send secure dynamic updates only when nonsecure dynamic updates are refused.\r\n\r\nOnly unsecure - computers send only nonsecure dynamic updates.\r\n\r\nOnly secure - computers send only secure dynamic updates.\r\n\r\nIf you enable this policy setting, computers that attempt to send dynamic DNS updates will use the security level that you specify in this policy setting.\r\n\r\nIf you disable this policy setting, or if you do not configure this policy setting, computers will use local settings. By default, DNS clients attempt to use unsecured dynamic update first. If an unsecured update is refused, clients try to use secure update.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-updatesecuritylevel"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_updatesecuritylevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_updatesecuritylevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_updatesecuritylevel_dns_updatesecuritylevel_box","displayName":"Update security level: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_updatesecuritylevel_dns_updatesecuritylevel_box_256","displayName":"Only secure","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_updatesecuritylevel_dns_updatesecuritylevel_box_16","displayName":"Only unsecure","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_updatesecuritylevel_dns_updatesecuritylevel_box_0","displayName":"Unsecure followed by secure","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_updatetopleveldomainzones","displayName":"Update top level domain zones","description":"Specifies if computers may send dynamic updates to zones with a single label name. These zones are also known as top-level domain zones, for example: \"com.\"\r\n\r\nBy default, a DNS client that is configured to perform dynamic DNS update will update the DNS zone that is authoritative for its DNS resource records unless the authoritative zone is a top-level domain or root zone.\r\n\r\nIf you enable this policy setting, computers send dynamic updates to any zone that is authoritative for the resource records that the computer needs to update, except the root zone.\r\n\r\nIf you disable this policy setting, or if you do not configure this policy setting, computers do not send dynamic updates to the root zone or top-level domain zones that are authoritative for the resource records that the computer needs to update.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-updatetopleveldomainzones"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_updatetopleveldomainzones_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_updatetopleveldomainzones_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_usedomainnamedevolution","displayName":"Primary DNS suffix devolution","description":"Specifies if the DNS client performs primary DNS suffix devolution during the name resolution process.\r\n\r\nWith devolution, a DNS client creates queries by appending a single-label, unqualified domain name with the parent suffix of the primary DNS suffix name, and the parent of that suffix, and so on, stopping if the name is successfully resolved or at a level determined by devolution settings. Devolution can be used when a user or application submits a query for a single-label domain name.\r\n\r\nThe DNS client appends DNS suffixes to the single-label, unqualified domain name based on the state of the Append primary and connection specific DNS suffixes radio button and Append parent suffixes of the primary DNS suffix check box on the DNS tab in Advanced TCP/IP Settings for the Internet Protocol (TCP/IP) Properties dialog box.\r\n\r\nDevolution is not enabled if a global suffix search list is configured using Group Policy.\r\n\r\nIf a global suffix search list is not configured, and the Append primary and connection specific DNS suffixes radio button is selected, the DNS client appends the following names to a single-label name when it sends DNS queries:\r\n\r\nThe primary DNS suffix, as specified on the Computer Name tab of the System control panel.\r\n\r\nEach connection-specific DNS suffix, assigned either through DHCP or specified in the DNS suffix for this connection box on the DNS tab in the Advanced TCP/IP Settings dialog box for each connection.\r\n\r\nFor example, when a user submits a query for a single-label name such as \"example,\" the DNS client attaches a suffix such as \"microsoft.com\" resulting in the query \"example.microsoft.com,\" before sending the query to a DNS server.\r\n\r\nIf a DNS suffix search list is not specified, the DNS client attaches the primary DNS suffix to a single-label name. If this query fails, the connection-specific DNS suffix is attached for a new query. If none of these queries are resolved, the client devolves the primary DNS suffix of the computer (drops the leftmost label of the primary DNS suffix), attaches this devolved primary DNS suffix to the single-label name, and submits this new query to a DNS server.\r\n\r\nFor example, if the primary DNS suffix ooo.aaa.microsoft.com is attached to the non-dot-terminated single-label name \"example,\" and the DNS query for example.ooo.aaa.microsoft.com fails, the DNS client devolves the primary DNS suffix (drops the leftmost label) till the specified devolution level, and submits a query for example.aaa.microsoft.com. If this query fails, the primary DNS suffix is devolved further if it is under specified devolution level and the query example.microsoft.com is submitted. If this query fails, devolution continues if it is under specified devolution level and the query example.microsoft.com is submitted, corresponding to a devolution level of two. The primary DNS suffix cannot be devolved beyond a devolution level of two. The devolution level can be configured using the primary DNS suffix devolution level policy setting. The default devolution level is two.\r\n\r\nIf you enable this policy setting, or if you do not configure this policy setting, DNS clients attempt to resolve single-label names using concatenations of the single-label name to be resolved and the devolved primary DNS suffix.\r\n\r\nIf you disable this policy setting, DNS clients do not attempt to resolve names that are concatenations of the single-label name to be resolved and the devolved primary DNS suffix.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-dns-usedomainnamedevolution"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_usedomainnamedevolution_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_dns_usedomainnamedevolution_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dnsclient_turn_off_multicast","displayName":"Turn off multicast name resolution","description":"Specifies that link local multicast name resolution (LLMNR) is disabled on client computers.\r\n\r\nLLMNR is a secondary name resolution protocol. With LLMNR, queries are sent using multicast over a local network link on a single subnet from a client computer to another client computer on the same subnet that also has LLMNR enabled. LLMNR does not require a DNS server or DNS client configuration, and provides name resolution in scenarios in which conventional DNS name resolution is not possible.\r\n\r\nIf you enable this policy setting, LLMNR will be disabled on all available network adapters on the client computer.\r\n\r\nIf you disable this policy setting, or you do not configure this policy setting, LLMNR will be enabled on all available network adapters.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dnsclient#admx-dnsclient-turn-off-multicast"],"options":[{"id":"device_vendor_msft_policy_config_admx_dnsclient_turn_off_multicast_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dnsclient_turn_off_multicast_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dwm_dwmdefaultcolorizationcolor_2","displayName":"Specify a default color","description":"This policy setting controls the default color for window frames when the user does not specify a color. \r\n\r\nIf you enable this policy setting and specify a default color, this color is used in glass window frames, if the user does not specify a color. \r\n\r\nIf you disable or do not configure this policy setting, the default internal color is used, if the user does not specify a color. \r\n\r\nNote: This policy setting can be used in conjunction with the \"Prevent color changes of window frames\" setting, to enforce a specific color for window frames that cannot be changed by users.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dwm#admx-dwm-dwmdefaultcolorizationcolor-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_dwm_dwmdefaultcolorizationcolor_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dwm_dwmdefaultcolorizationcolor_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dwm_dwmdefaultcolorizationcolor_2_dwmdefaultcolorizationcoloralpha","displayName":"Alpha (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_dwm_dwmdefaultcolorizationcolor_2_dwmdefaultcolorizationcolorblue","displayName":"Blue (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_dwm_dwmdefaultcolorizationcolor_2_dwmdefaultcolorizationcolorgreen","displayName":"Green (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_dwm_dwmdefaultcolorizationcolor_2_dwmdefaultcolorizationcolorred","displayName":"Red (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_dwm_dwmdisallowanimations_2","displayName":"Do not allow window animations","description":"This policy setting controls the appearance of window animations such as those found when restoring, minimizing, and maximizing windows. \r\n\r\nIf you enable this policy setting, window animations are turned off. \r\n\r\nIf you disable or do not configure this policy setting, window animations are turned on. \r\n\r\nChanging this policy setting requires a logoff for it to be applied.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dwm#admx-dwm-dwmdisallowanimations-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_dwm_dwmdisallowanimations_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dwm_dwmdisallowanimations_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_dwm_dwmdisallowcolorizationcolorchanges_2","displayName":"Do not allow color changes","description":"This policy setting controls the ability to change the color of window frames. \r\n\r\nIf you enable this policy setting, you prevent users from changing the default window frame color. \r\n\r\nIf you disable or do not configure this policy setting, you allow users to change the default window frame color. \r\n\r\nNote: This policy setting can be used in conjunction with the \"Specify a default color for window frames\" policy setting, to enforce a specific color for window frames that cannot be changed by users.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-dwm#admx-dwm-dwmdisallowcolorizationcolorchanges-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_dwm_dwmdisallowcolorizationcolorchanges_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_dwm_dwmdisallowcolorizationcolorchanges_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_encryptfilesonmove_noencryptonmove","displayName":"Do not automatically encrypt files moved to encrypted folders","description":"This policy setting prevents File Explorer from encrypting files that are moved to an encrypted folder.\r\n\r\nIf you enable this policy setting, File Explorer will not automatically encrypt files that are moved to an encrypted folder.\r\n\r\nIf you disable or do not configure this policy setting, File Explorer automatically encrypts files that are moved to an encrypted folder.\r\n\r\nThis setting applies only to files moved within a volume. When files are moved to other volumes, or if you create a new file in an encrypted folder, File Explorer encrypts those files automatically.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove#admx-encryptfilesonmove-noencryptonmove"],"options":[{"id":"device_vendor_msft_policy_config_admx_encryptfilesonmove_noencryptonmove_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_encryptfilesonmove_noencryptonmove_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_approvedenstordevices","displayName":"Configure list of Enhanced Storage devices usable on your computer","description":"This policy setting allows you to configure a list of Enhanced Storage devices by manufacturer and product ID that are usable on your computer.\r\n\r\nIf you enable this policy setting, only Enhanced Storage devices that contain a manufacturer and product ID specified in this policy are usable on your computer.\r\n\r\nIf you disable or do not configure this policy setting, all Enhanced Storage devices are usable on your computer.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-enhancedstorage#admx-enhancedstorage-approvedenstordevices"],"options":[{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_approvedenstordevices_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_approvedenstordevices_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_approvedenstordevices_approvedenstordevices_list","displayName":"Usable Enhanced Storage Devices: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_approvedsilos","displayName":"Configure list of IEEE 1667 silos usable on your computer","description":"This policy setting allows you to create a list of IEEE 1667 silos, compliant with the Institute of Electrical and Electronics Engineers, Inc. (IEEE) 1667 specification, that are usable on your computer.\r\n\r\nIf you enable this policy setting, only IEEE 1667 silos that match a silo type identifier specified in this policy are usable on your computer.\r\n\r\nIf you disable or do not configure this policy setting, all IEEE 1667 silos on Enhanced Storage devices are usable on your computer.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-enhancedstorage#admx-enhancedstorage-approvedsilos"],"options":[{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_approvedsilos_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_approvedsilos_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_approvedsilos_approvedsilos_list","displayName":"Usable IEEE 1667 Silo Type Identifiers: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_disablepasswordauthentication","displayName":"Do not allow password authentication of Enhanced Storage devices","description":"This policy setting configures whether or not a password can be used to unlock an Enhanced Storage device.\r\n\r\nIf you enable this policy setting, a password cannot be used to unlock an Enhanced Storage device.\r\n\r\nIf you disable or do not configure this policy setting, a password can be used to unlock an Enhanced Storage device.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-enhancedstorage#admx-enhancedstorage-disablepasswordauthentication"],"options":[{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_disablepasswordauthentication_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_disablepasswordauthentication_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_disallowlegacydiskdevices","displayName":"Do not allow non-Enhanced Storage removable devices","description":"This policy setting configures whether or not non-Enhanced Storage removable devices are allowed on your computer.\r\n\r\nIf you enable this policy setting, non-Enhanced Storage removable devices are not allowed on your computer.\r\n\r\nIf you disable or do not configure this policy setting, non-Enhanced Storage removable devices are allowed on your computer.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-enhancedstorage#admx-enhancedstorage-disallowlegacydiskdevices"],"options":[{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_disallowlegacydiskdevices_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_disallowlegacydiskdevices_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_lockdeviceonmachinelock","displayName":"Lock Enhanced Storage when the computer is locked","description":"This policy setting locks Enhanced Storage devices when the computer is locked.\r\n\r\nThis policy setting is supported in Windows Server SKUs only.\r\n\r\nIf you enable this policy setting, the Enhanced Storage device remains locked when the computer is locked.\r\n\r\nIf you disable or do not configure this policy setting, the Enhanced Storage device state is not changed when the computer is locked.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-enhancedstorage#admx-enhancedstorage-lockdeviceonmachinelock"],"options":[{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_lockdeviceonmachinelock_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_lockdeviceonmachinelock_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_roothubconnectedenstordevices","displayName":"Allow only USB root hub connected Enhanced Storage devices","description":"This policy setting configures whether or not only USB root hub connected Enhanced Storage devices are allowed. Allowing only root hub connected Enhanced Storage devices minimizes the risk of an unauthorized USB device reading data on an Enhanced Storage device.\r\n\r\nIf you enable this policy setting, only USB root hub connected Enhanced Storage devices are allowed.\r\n\r\nIf you disable or do not configure this policy setting, USB Enhanced Storage devices connected to both USB root hubs and non-root hubs will be allowed.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-enhancedstorage#admx-enhancedstorage-roothubconnectedenstordevices"],"options":[{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_roothubconnectedenstordevices_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_enhancedstorage_roothubconnectedenstordevices_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornonedef","displayName":"Default application reporting settings","description":"This policy setting controls whether errors in general applications are included in reports when Windows Error Reporting is enabled.\r\n\r\nIf you enable this policy setting, you can instruct Windows Error Reporting in the Default pull-down menu to report either all application errors (the default setting), or no application errors.\r\n\r\nIf the Report all errors in Microsoft applications check box is filled, all errors in Microsoft applications are reported, regardless of the setting in the Default pull-down menu. When the Report all errors in Windows check box is filled, all errors in Windows applications are reported, regardless of the setting in the Default dropdown list. The Windows applications category is a subset of Microsoft applications.\r\n\r\nIf you disable or do not configure this policy setting, users can enable or disable Windows Error Reporting in Control Panel. The default setting in Control Panel is Upload all applications.\r\n\r\nThis policy setting is ignored if the Configure Error Reporting policy setting is disabled or not configured.\r\n\r\nFor related information, see the Configure Error Reporting and Report Operating System Errors policy settings.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-errorreporting#admx-errorreporting-pch-allornonedef"],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornonedef_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornonedef_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornonedef_pch_allornonedef_list","displayName":"Default: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornonedef_pch_allornonedef_list_1","displayName":"Report all application errors","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornonedef_pch_allornonedef_list_0","displayName":"Do not report any application errors","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornonedef_pch_allornoneincms_chk","displayName":"Report all errors in Microsoft applications. (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornonedef_pch_allornoneincms_chk_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornonedef_pch_allornoneincms_chk_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornonedef_pch_allornonewincomp_chk","displayName":"Report all errors in Windows components. (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornonedef_pch_allornonewincomp_chk_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornonedef_pch_allornonewincomp_chk_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornoneex","displayName":"List of applications to never report errors for","description":"This policy setting controls Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on.\r\n\r\nIf you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show under the Exclude errors for applications on this list setting, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. Errors that are generated by applications in this list are not reported, even if the Default Application Reporting Settings policy setting is configured to report all application errors.\r\n\r\nIf this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence. If an application is listed both in the List of applications to always report errors for policy setting, and in the exclusion list in this policy setting, the application is excluded from error reporting. You can also use the exclusion list in this policy setting to exclude specific Microsoft applications or parts of Windows if the check boxes for these categories are filled in the Default application reporting settings policy setting.\r\n\r\nIf you disable or do not configure this policy setting, the Default application reporting settings policy setting takes precedence.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-errorreporting#admx-errorreporting-pch-allornoneex"],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornoneex_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornoneex_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornoneex_pch_allornoneex_list","displayName":"Exclude errors for applications on this list: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornoneinc","displayName":"List of applications to always report errors for","description":"This policy setting specifies applications for which Windows Error Reporting should always report errors.\r\n\r\nTo create a list of applications for which Windows Error Reporting never reports errors, click Show under the Exclude errors for applications on this list setting, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). Errors that are generated by applications in this list are not reported, even if the Default Application Reporting Settings policy setting is configured to report all application errors.\r\n\r\nIf you enable this policy setting, you can create a list of applications that are always included in error reporting. To add applications to the list, click Show under the Report errors for applications on this list setting, and edit the list of application file names in the Show Contents dialog box. The file names must include the .exe file name extension (for example, notepad.exe). Errors that are generated by applications on this list are always reported, even if the Default dropdown in the Default application reporting policy setting is set to report no application errors.\r\n\r\nIf the Report all errors in Microsoft applications or Report all errors in Windows components check boxes in the Default Application Reporting policy setting are filled, Windows Error Reporting reports errors as if all applications in these categories were added to the list in this policy setting. (Note: The Microsoft applications category includes the Windows components category.)\r\n\r\nIf you disable this policy setting or do not configure it, the Default application reporting settings policy setting takes precedence.\r\n\r\nAlso see the \"Default Application Reporting\" and \"Application Exclusion List\" policies.\r\n\r\nThis setting will be ignored if the 'Configure Error Reporting' setting is disabled or not configured.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-errorreporting#admx-errorreporting-pch-allornoneinc"],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornoneinc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornoneinc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_allornoneinc_pch_allornoneinc_list","displayName":"Report errors for applications on this list: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_configurereport","displayName":"Configure Error Reporting","description":"This policy setting configures how errors are reported to Microsoft, and what information is sent when Windows Error Reporting is enabled.\r\n\r\nThis policy setting does not enable or disable Windows Error Reporting. To turn Windows Error Reporting on or off, see the Turn off Windows Error Reporting policy setting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings.\r\n\r\nImportant: If the Turn off Windows Error Reporting policy setting is not configured, then Control Panel settings for Windows Error Reporting override this policy setting.\r\n\r\nIf you enable this policy setting, the setting overrides any user changes made to Windows Error Reporting settings in Control Panel, and default values are applied for any Windows Error Reporting policy settings that are not configured (even if users have changed settings by using Control Panel). If you enable this policy setting, you can configure the following settings in the policy setting:\r\n\r\n- \"Do not display links to any Microsoft ‘More information’ websites\": Select this option if you do not want error dialog boxes to display links to Microsoft websites.\r\n\r\n- \"Do not collect additional files\": Select this option if you do not want additional files to be collected and included in error reports.\r\n\r\n- \"Do not collect additional computer data\": Select this if you do not want additional information about the computer to be collected and included in error reports.\r\n\r\n- \"Force queue mode for application errors\": Select this option if you do not want users to report errors. When this option is selected, errors are stored in a queue directory, and the next administrator to log on to the computer can send the error reports to Microsoft.\r\n\r\n- \"Corporate file path\": Type a UNC path to enable Corporate Error Reporting. All errors are stored at the specified location instead of being sent directly to Microsoft, and the next administrator to log onto the computer can send the error reports to Microsoft.\r\n\r\n- \"Replace instances of the word ‘Microsoft’ with\": You can specify text with which to customize your error report dialog boxes. The word \"Microsoft\" is replaced with the specified text.\r\n\r\nIf you do not configure this policy setting, users can change Windows Error Reporting settings in Control Panel. By default, these settings are Enable Reporting on computers that are running Windows XP, and Report to Queue on computers that are running Windows Server 2003.\r\n\r\nIf you disable this policy setting, configuration settings in the policy setting are left blank.\r\n\r\nSee related policy settings Display Error Notification (same folder as this policy setting), and Turn off Windows Error Reporting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-errorreporting#admx-errorreporting-pch-configurereport"],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_configurereport_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_configurereport_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_configurereport_pch_companytext_edit","displayName":"Replace instances of the word 'Microsoft' with: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_configurereport_pch_dumppath_edit","displayName":"Corporate upload file path: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_configurereport_pch_forceq_chk","displayName":"Force queue mode for application errors (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_configurereport_pch_forceq_chk_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_configurereport_pch_forceq_chk_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_configurereport_pch_noexternalurl_chk","displayName":"Do not display links to any Microsoft provided 'more information' web sites. (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_configurereport_pch_noexternalurl_chk_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_configurereport_pch_noexternalurl_chk_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_configurereport_pch_nofilecollect_chk","displayName":"Do not collect additional files (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_configurereport_pch_nofilecollect_chk_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_configurereport_pch_nofilecollect_chk_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_configurereport_pch_noleveltwo_chk","displayName":"Do not collect additional machine data (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_configurereport_pch_noleveltwo_chk_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_configurereport_pch_noleveltwo_chk_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_reportoperatingsystemfaults","displayName":"Report operating system errors","description":"This policy setting controls whether errors in the operating system are included Windows Error Reporting is enabled.\r\n\r\nIf you enable this policy setting, Windows Error Reporting includes operating system errors.\r\n\r\nIf you disable this policy setting, operating system errors are not included in error reports.\r\n\r\nIf you do not configure this policy setting, users can change this setting in Control Panel. By default, Windows Error Reporting settings in Control Panel are set to upload operating system errors.\r\n\r\nSee also the Configure Error Reporting policy setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-errorreporting#admx-errorreporting-pch-reportoperatingsystemfaults"],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_reportoperatingsystemfaults_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_pch_reportoperatingsystemfaults_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werarchive_2","displayName":"Configure Report Archive","description":"This policy setting controls the behavior of the Windows Error Reporting archive.\r\n\r\nIf you enable this policy setting, you can configure Windows Error Reporting archiving behavior. If Archive behavior is set to Store all, all data collected for each error report is stored in the appropriate location. If Archive behavior is set to Store parameters only, only the minimum information required to check for an existing solution is stored. The Maximum number of reports to store setting determines how many reports are stored before older reports are automatically deleted.\r\n\r\nIf you disable or do not configure this policy setting, no Windows Error Reporting information is stored.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-errorreporting#admx-errorreporting-werarchive-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_werarchive_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werarchive_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werarchive_2_werarchivebehavior","displayName":"Archive behavior: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_werarchive_2_werarchivebehavior_2","displayName":"Store all","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werarchive_2_werarchivebehavior_1","displayName":"Store parameters only","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werarchive_2_wermaxarchivecount","displayName":"Maximum number of reports to store: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werautoapproveosdumps_2","displayName":"Automatically send memory dumps for OS-generated error reports","description":"This policy setting controls whether memory dumps in support of OS-generated error reports can be sent to Microsoft automatically. This policy does not apply to error reports generated by 3rd-party products, or additional data other than memory dumps.\r\n\r\nIf you enable or do not configure this policy setting, any memory dumps generated for error reports by Microsoft Windows are automatically uploaded, without notification to the user.\r\n\r\nIf you disable this policy setting, then all memory dumps are uploaded according to the default consent and notification settings.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-errorreporting#admx-errorreporting-werautoapproveosdumps-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_werautoapproveosdumps_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werautoapproveosdumps_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werbypassdatathrottling_2","displayName":"Do not throttle additional data","description":"This policy setting determines whether Windows Error Reporting (WER) sends additional, second-level report data even if a CAB file containing data about the same event types has already been uploaded to the server.\r\n\r\nIf you enable this policy setting, WER does not throttle data; that is, WER uploads additional CAB files that can contain data about the same event types as an earlier uploaded report.\r\n\r\nIf you disable or do not configure this policy setting, WER throttles data by default; that is, WER does not upload more than one CAB file for a report that contains data about the same event types.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-errorreporting#admx-errorreporting-werbypassdatathrottling-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_werbypassdatathrottling_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werbypassdatathrottling_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werbypassnetworkcostthrottling_2","displayName":"Send data when on connected to a restricted/costed network","description":"This policy setting determines whether Windows Error Reporting (WER) checks for a network cost policy that restricts the amount of data that is sent over the network.\r\n\r\nIf you enable this policy setting, WER does not check for network cost policy restrictions, and transmits data even if network cost is restricted.\r\n\r\nIf you disable or do not configure this policy setting, WER does not send data, but will check the network cost policy again if the network profile is changed.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-errorreporting#admx-errorreporting-werbypassnetworkcostthrottling-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_werbypassnetworkcostthrottling_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werbypassnetworkcostthrottling_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werbypasspowerthrottling_2","displayName":"Send additional data when on battery power","description":"This policy setting determines whether Windows Error Reporting (WER) checks if the computer is running on battery power. By default, when a computer is running on battery power, WER only checks for solutions, but does not upload additional report data until the computer is connected to a more permanent power source.\r\n\r\nIf you enable this policy setting, WER does not determine whether the computer is running on battery power, but checks for solutions and uploads report data normally.\r\n\r\nIf you disable or do not configure this policy setting, WER checks for solutions while a computer is running on battery power, but does not upload report data until the computer is connected to a more permanent power source.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-errorreporting#admx-errorreporting-werbypasspowerthrottling-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_werbypasspowerthrottling_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werbypasspowerthrottling_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_wercer","displayName":"Configure Corporate Windows Error Reporting","description":"This policy setting specifies a corporate server to which Windows Error Reporting sends reports (if you do not want to send error reports to Microsoft).\r\n\r\nIf you enable this policy setting, you can specify the name or IP address of an error report destination server on your organization’s network. You can also select Connect using SSL to transmit error reports over a Secure Sockets Layer (SSL) connection, and specify a port number on the destination server for transmission.\r\n\r\nIf you disable or do not configure this policy setting, Windows Error Reporting sends error reports to Microsoft.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-errorreporting#admx-errorreporting-wercer"],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_wercer_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_wercer_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_wercer_wercercorporateportnumber","displayName":"Server port: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_wercer_wercerserver","displayName":"Corporate server name: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_wercer_werceruploadonfreenetworksonly","displayName":"Only upload on free networks (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_wercer_werceruploadonfreenetworksonly_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_wercer_werceruploadonfreenetworksonly_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_wercer_wercerusessl","displayName":"Connect using SSL (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_wercer_wercerusessl_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_wercer_wercerusessl_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werconsentoverride_2","displayName":"Ignore custom consent settings","description":"This policy setting determines the behavior of the Configure Default Consent setting in relation to custom consent settings.\r\n\r\nIf you enable this policy setting, the default consent levels of Windows Error Reporting always override any other consent policy setting.\r\n\r\nIf you disable or do not configure this policy setting, custom consent policy settings for error reporting determine the consent level for specified event types, and the default consent setting determines only the consent level of any other error reports.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-errorreporting#admx-errorreporting-werconsentoverride-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_werconsentoverride_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werconsentoverride_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werdefaultconsent_2","displayName":"Configure Default consent","description":"This policy setting determines the default consent behavior of Windows Error Reporting.\r\n\r\nIf you enable this policy setting, you can set the default consent handling for error reports. The following list describes the Consent level settings that are available in the pull-down menu in this policy setting:\r\n\r\n- Always ask before sending data: Windows prompts users for consent to send reports.\r\n\r\n- Send parameters: Only the minimum data that is required to check for an existing solution is sent automatically, and Windows prompts users for consent to send any additional data that is requested by Microsoft.\r\n\r\n- Send parameters and safe additional data: the minimum data that is required to check for an existing solution, along with data which Windows has determined (within a high probability) does not contain personally-identifiable information is sent automatically, and Windows prompts the user for consent to send any additional data that is requested by Microsoft.\r\n\r\n- Send all data: any error reporting data requested by Microsoft is sent automatically.\r\n\r\nIf this policy setting is disabled or not configured, then the consent level defaults to the highest-privacy setting: Always ask before sending data.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-errorreporting#admx-errorreporting-werdefaultconsent-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_werdefaultconsent_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werdefaultconsent_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werdefaultconsent_2_werconsent","displayName":"Consent level (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_werdefaultconsent_2_werconsent_1","displayName":"Always ask before sending data","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werdefaultconsent_2_werconsent_2","displayName":"Send parameters","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werdefaultconsent_2_werconsent_3","displayName":"Send parameters and safe additional data","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werdefaultconsent_2_werconsent_4","displayName":"Send all data","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werexlusion_2","displayName":"List of applications to be excluded","description":"This policy setting limits Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on.\r\n\r\nIf you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. To remove an application from the list, click the name, and then press DELETE. If this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence.\r\n\r\nIf you disable or do not configure this policy setting, errors are reported on all Microsoft and Windows applications by default.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-errorreporting#admx-errorreporting-werexlusion-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_werexlusion_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werexlusion_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werexlusion_2_werexlusionlist","displayName":"List of applications to be excluded (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_wernologging_2","displayName":"Disable logging","description":"This policy setting controls whether Windows Error Reporting saves its own events and error messages to the system event log.\r\n\r\nIf you enable this policy setting, Windows Error Reporting events are not recorded in the system event log.\r\n\r\nIf you disable or do not configure this policy setting, Windows Error Reporting events and errors are logged to the system event log, as with other Windows-based programs.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-errorreporting#admx-errorreporting-wernologging-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_wernologging_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_wernologging_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werqueue_2","displayName":"Configure Report Queue","description":"This policy setting determines the behavior of the Windows Error Reporting report queue.\r\n\r\nIf you enable this policy setting, you can configure report queue behavior by using the controls in the policy setting. When the Queuing behavior pull-down list is set to Default, Windows determines, when a problem occurs, whether the report should be placed in the reporting queue, or the user should be prompted to send it immediately. When Queuing behavior is set to Always queue, all reports are added to the queue until the user is prompted to send the reports, or until the user sends problem reports by using the Solutions to Problems page in Control Panel. If Queuing behavior is set to Always queue for administrator, reports are queued until an administrator is prompted to send them, or until the administrator sends them by using the Solutions to Problems page in Control Panel.\r\n\r\nThe Maximum number of reports to queue setting determines how many reports can be queued before older reports are automatically deleted. The setting for Number of days between solution check reminders determines the interval time between the display of system notifications that remind the user to check for solutions to problems. A value of 0 disables the reminder.\r\n\r\nIf you disable or do not configure this policy setting, Windows Error Reporting reports are not queued, and users can only send reports at the time that a problem occurs.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-errorreporting#admx-errorreporting-werqueue-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_werqueue_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werqueue_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werqueue_2_wermaxqueuecount","displayName":"Maximum number of reports to queue: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werqueue_2_wermaxqueuesize","displayName":"Maximum size of the queue (MB): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werqueue_2_werminfreediskspace","displayName":"Minimum free disk space (MB): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werqueue_2_werqueuebehavior","displayName":"Queuing behavior: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_errorreporting_werqueue_2_werqueuebehavior_0","displayName":"Default","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werqueue_2_werqueuebehavior_1","displayName":"Always queue","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werqueue_2_werqueuebehavior_2","displayName":"Always queue for administrator","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_errorreporting_werqueue_2_werupdatecheck","displayName":"Number of days between solution check reminders: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventforwarding_forwarderresourceusage","displayName":"Configure forwarder resource usage","description":"This policy setting controls resource usage for the forwarder (source computer) by controlling the events/per second sent to the Event Collector.\r\n\r\nIf you enable this policy setting, you can control the volume of events sent to the Event Collector by the source computer. This may be required in high volume environments.\r\n\r\nIf you disable or do not configure this policy setting, forwarder resource usage is not specified.\r\n\r\nThis setting applies across all subscriptions for the forwarder (source computer).\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventforwarding#admx-eventforwarding-forwarderresourceusage"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventforwarding_forwarderresourceusage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventforwarding_forwarderresourceusage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventforwarding_forwarderresourceusage_maxforwardingrate","displayName":"The maximum forwarding rate ( events/sec ) allowed for the forwarder: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventforwarding_subscriptionmanager","displayName":"Configure target Subscription Manager","description":"This policy setting allows you to configure the server address, refresh interval, and issuer certificate authority (CA) of a target Subscription Manager.\r\n\r\nIf you enable this policy setting, you can configure the Source Computer to contact a specific FQDN (Fully Qualified Domain Name) or IP Address and request subscription specifics.\r\n\r\nUse the following syntax when using the HTTPS protocol:\r\nServer=https://:5986/wsman/SubscriptionManager/WEC,Refresh=,IssuerCA=. When using the HTTP protocol, use port 5985.\r\n\r\nIf you disable or do not configure this policy setting, the Event Collector computer will not be specified.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventforwarding#admx-eventforwarding-subscriptionmanager"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventforwarding_subscriptionmanager_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventforwarding_subscriptionmanager_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventforwarding_subscriptionmanager_subscriptionmanager_listbox","displayName":"SubscriptionManagers (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_autobackup_1","displayName":"Back up log automatically when full","description":"This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the \"Retain old events\" policy setting is enabled.\r\n\r\nIf you enable this policy setting and the \"Retain old events\" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started.\r\n\r\nIf you disable this policy setting and the \"Retain old events\" policy setting is enabled, new events are discarded and old events are retained.\r\n\r\nIf you do not configure this policy setting and the \"Retain old events\" policy setting is enabled, new events are discarded and the old events are retained.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-log-autobackup-1"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_autobackup_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_autobackup_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_autobackup_2","displayName":"Back up log automatically when full","description":"This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the \"Retain old events\" policy setting is enabled.\r\n\r\nIf you enable this policy setting and the \"Retain old events\" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started.\r\n\r\nIf you disable this policy setting and the \"Retain old events\" policy setting is enabled, new events are discarded and old events are retained.\r\n\r\nIf you do not configure this policy setting and the \"Retain old events\" policy setting is enabled, new events are discarded and the old events are retained.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-log-autobackup-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_autobackup_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_autobackup_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_autobackup_3","displayName":"Back up log automatically when full","description":"This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the \"Retain old events\" policy setting is enabled.\r\n\r\nIf you enable this policy setting and the \"Retain old events\" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started.\r\n\r\nIf you disable this policy setting and the \"Retain old events\" policy setting is enabled, new events are discarded and old events are retained.\r\n\r\nIf you do not configure this policy setting and the \"Retain old events\" policy setting is enabled, new events are discarded and the old events are retained.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-log-autobackup-3"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_autobackup_3_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_autobackup_3_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_autobackup_4","displayName":"Back up log automatically when full","description":"This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the \"Retain old events\" policy setting is enabled.\r\n\r\nIf you enable this policy setting and the \"Retain old events\" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started.\r\n\r\nIf you disable this policy setting and the \"Retain old events\" policy setting is enabled, new events are discarded and old events are retained.\r\n\r\nIf you do not configure this policy setting and the \"Retain old events\" policy setting is enabled, new events are discarded and the old events are retained.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-log-autobackup-4"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_autobackup_4_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_autobackup_4_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_1","displayName":"Configure log access","description":"This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string.\r\n\r\nIf you enable this policy setting, only those users matching the security descriptor can access the log.\r\n\r\nIf you disable or do not configure this policy setting, all authenticated users and system services can write, read, or clear this log.\r\n\r\nNote: If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the \"Configure log access (legacy)\" policy setting to enforce this change across all tools and APIs.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-log-filelogaccess-1"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_1_channel_log_filelogaccess","displayName":"Log Access (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_2","displayName":"Configure log access","description":"This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You cannot configure write permissions for this log. You must set both \"configure log access\" policy settings for this log in order to affect the both modern and legacy tools.\r\n\r\nIf you enable this policy setting, only those users whose security descriptor matches the configured specified value can access the log.\r\n\r\nIf you disable or do not configure this policy setting, only system software and administrators can read or clear this log.\r\n\r\nNote: If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the \"Configure log access (legacy)\" policy setting to enforce this change across all tools and APIs.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-log-filelogaccess-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_2_channel_log_filelogaccess","displayName":"Log Access (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_3","displayName":"Configure log access","description":"This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string.\r\n\r\nIf you enable this policy setting, only those users matching the security descriptor can access the log.\r\n\r\nIf you disable or do not configure this policy setting, all authenticated users and system services can write, read, or clear this log.\r\n\r\nNote: If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the \"Configure log access (legacy)\" policy setting to enforce this change across all tools and APIs.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-log-filelogaccess-3"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_3_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_3_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_3_channel_log_filelogaccess","displayName":"Log Access (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_4","displayName":"Configure log access","description":"This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You must set both \"configure log access\" policy settings for this log in order to affect the both modern and legacy tools.\r\n\r\nIf you enable this policy setting, only users whose security descriptor matches the configured value can access the log.\r\n\r\nIf you disable or do not configure this policy setting, only system software and administrators can write or clear this log, and any authenticated user can read events from it.\r\n\r\nNote: If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the \"Configure log access (legacy)\" policy setting to enforce this change across all tools and APIs.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-log-filelogaccess-4"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_4_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_4_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_4_channel_log_filelogaccess","displayName":"Log Access (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_5","displayName":"Configure log access (legacy)","description":"This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You must set both \"configure log access\" policy settings for this log in order to affect the both modern and legacy tools.\r\n\r\nIf you enable this policy setting, only those users matching the security descriptor can access the log.\r\n\r\nIf you disable this policy setting, all authenticated users and system services can write, read, or clear this log.\r\n\r\nIf you do not configure this policy setting, the previous policy setting configuration remains in effect.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-log-filelogaccess-5"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_5_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_5_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_5_channel_log_filelogaccess","displayName":"Log Access (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_6","displayName":"Configure log access (legacy)","description":"This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You cannot configure write permissions for this log.\r\n\r\nIf you enable this policy setting, only those users whose security descriptor matches the configured specified value can access the log.\r\n\r\nIf you disable this policy setting, only system software and administrators can read or clear this log.\r\n\r\nIf you do not configure this policy setting, the previous policy setting configuration remains in effect.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-log-filelogaccess-6"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_6_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_6_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_6_channel_log_filelogaccess","displayName":"Log Access (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_7","displayName":"Configure log access (legacy)","description":"This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You must set both \"configure log access\" policy settings for this log in order to affect the both modern and legacy tools.\r\n\r\nIf you enable this policy setting, only those users matching the security descriptor can access the log.\r\n\r\nIf you disable this policy setting, all authenticated users and system services can write, read, or clear this log.\r\n\r\nIf you do not configure this policy setting, the previous policy setting configuration remains in effect.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-log-filelogaccess-7"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_7_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_7_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_7_channel_log_filelogaccess","displayName":"Log Access (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_8","displayName":"Configure log access (legacy)","description":"This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string.\r\n\r\nIf you enable this policy setting, only users whose security descriptor matches the configured value can access the log.\r\n\r\nIf you disable this policy setting, only system software and administrators can write or clear this log, and any authenticated user can read events from it.\r\n\r\nIf you do not configure this policy setting, the previous policy setting configuration remains in effect.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-log-filelogaccess-8"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_8_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_8_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_filelogaccess_8_channel_log_filelogaccess","displayName":"Log Access (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_retention_2","displayName":"Control Event Log behavior when the log file reaches its maximum size","description":"This policy setting controls Event Log behavior when the log file reaches its maximum size.\r\n\r\nIf you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost.\r\n\r\nIf you disable or do not configure this policy setting and a log file reaches its maximum size, new events overwrite old events.\r\n\r\nNote: Old events may or may not be retained according to the \"Backup log automatically when full\" policy setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-log-retention-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_retention_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_retention_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_retention_3","displayName":"Control Event Log behavior when the log file reaches its maximum size","description":"This policy setting controls Event Log behavior when the log file reaches its maximum size.\r\n\r\nIf you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost.\r\n\r\nIf you disable or do not configure this policy setting and a log file reaches its maximum size, new events overwrite old events.\r\n\r\nNote: Old events may or may not be retained according to the \"Backup log automatically when full\" policy setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-log-retention-3"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_retention_3_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_retention_3_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_retention_4","displayName":"Control Event Log behavior when the log file reaches its maximum size","description":"This policy setting controls Event Log behavior when the log file reaches its maximum size.\r\n\r\nIf you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost.\r\n\r\nIf you disable or do not configure this policy setting and a log file reaches its maximum size, new events overwrite old events.\r\n\r\nNote: Old events may or may not be retained according to the \"Backup log automatically when full\" policy setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-log-retention-4"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_retention_4_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_log_retention_4_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logenabled","displayName":"Turn on logging","description":"This policy setting turns on logging.\r\n\r\nIf you enable or do not configure this policy setting, then events can be written to this log.\r\n\r\nIf the policy setting is disabled, then no new events can be logged. Events can always be read from the log, regardless of this policy setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-logenabled"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logfilepath_1","displayName":"Control the location of the log file","description":"This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators.\r\n\r\nIf you enable this policy setting, the Event Log uses the path specified in this policy setting.\r\n\r\nIf you disable or do not configure this policy setting, the Event Log uses the folder %SYSTEMROOT%\\System32\\winevt\\Logs.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-logfilepath-1"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logfilepath_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logfilepath_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logfilepath_1_channel_logfilepath","displayName":"Log File Path (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logfilepath_2","displayName":"Control the location of the log file","description":"This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators.\r\n\r\nIf you enable this policy setting, the Event Log uses the path specified in this policy setting.\r\n\r\nIf you disable or do not configure this policy setting, the Event Log uses the folder %SYSTEMROOT%\\System32\\winevt\\Logs.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-logfilepath-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logfilepath_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logfilepath_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logfilepath_2_channel_logfilepath","displayName":"Log File Path (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logfilepath_3","displayName":"Control the location of the log file","description":"This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators.\r\n\r\nIf you enable this policy setting, the Event Log uses the path specified in this policy setting.\r\n\r\nIf you disable or do not configure this policy setting, the Event Log uses the folder %SYSTEMROOT%\\System32\\winevt\\Logs.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-logfilepath-3"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logfilepath_3_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logfilepath_3_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logfilepath_3_channel_logfilepath","displayName":"Log File Path (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logfilepath_4","displayName":"Control the location of the log file","description":"This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators.\r\n\r\nIf you enable this policy setting, the Event Log uses the path specified in this policy setting.\r\n\r\nIf you disable or do not configure this policy setting, the Event Log uses the folder %SYSTEMROOT%\\System32\\winevt\\Logs.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-logfilepath-4"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logfilepath_4_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logfilepath_4_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logfilepath_4_channel_logfilepath","displayName":"Log File Path (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logmaxsize_3","displayName":"Specify the maximum log file size (KB)","description":"This policy setting specifies the maximum size of the log file in kilobytes.\r\n\r\nIf you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes), in kilobyte increments.\r\n\r\nIf you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog, and it defaults to 1 megabyte.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlog#admx-eventlog-channel-logmaxsize-3"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logmaxsize_3_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logmaxsize_3_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlog_channel_logmaxsize_3_channel_logmaxsize","displayName":"Maximum Log Size (KB) (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventlogging_enableprotectedeventlogging","displayName":"Enable Protected Event Logging","description":"\r\nThis policy setting lets you configure Protected Event Logging.\r\n\r\nIf you enable this policy setting, components that support it will use the certificate you supply to encrypt potentially sensitive event log data before writing it to the event log. Data will be encrypted using the Cryptographic Message Syntax (CMS) standard and the public key you provide. You can use the Unprotect-CmsMessage PowerShell cmdlet to decrypt these encrypted messages, provided that you have access to the private key corresponding to the public key that they were encrypted with.\r\n\r\nIf you disable or do not configure this policy setting, components will not encrypt event log messages before writing them to the event log.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventlogging#admx-eventlogging-enableprotectedeventlogging"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventlogging_enableprotectedeventlogging_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventlogging_enableprotectedeventlogging_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventlogging_enableprotectedeventlogging_encryptioncertificate","displayName":"\r\nProvide an encryption certificate to be used by Protected Event Logging. You may provide either:\r\n\r\n - The content of a base-64 encoded X.509 certificate\r\n - The thumbprint of a certificate that can be found in the Local Machine certificate store (usually deployed by PKI infrastructure)\r\n - The full path to a certificate (can be local, or a remote share)\r\n - The path to a directory containing a certificate or certificates (can be local, or a remote share)\r\n - The subject name of a certificate that can be found in the Local Machine certificate store (usually deployed by PKI infrastructure)\r\n\r\nThe resulting certificate must have 'Document Encryption' as an enhanced key usage (1.3.6.1.4.1.311.80.1), as well as either Data Encipherment or Key Encipherment key usages enabled.\r\n","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventviewer_eventviewer_redirectionprogram","displayName":"Events.asp program","description":"This is the program that will be invoked when the user clicks the events.asp link.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventviewer#admx-eventviewer-eventviewer-redirectionprogram"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventviewer_eventviewer_redirectionprogram_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventviewer_eventviewer_redirectionprogram_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventviewer_eventviewer_redirectionprogram_eventviewer_redirectionprogram","displayName":"Events.asp program (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventviewer_eventviewer_redirectionprogramcommandlineparameters","displayName":"Events.asp program command line parameters","description":"This specifies the command line parameters that will be passed to the events.asp program\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventviewer#admx-eventviewer-eventviewer-redirectionprogramcommandlineparameters"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventviewer_eventviewer_redirectionprogramcommandlineparameters_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventviewer_eventviewer_redirectionprogramcommandlineparameters_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventviewer_eventviewer_redirectionprogramcommandlineparameters_eventviewer_redirectionprogramcommandlineparameters","displayName":"Events.asp program command line parameters (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_eventviewer_eventviewer_redirectionurl","displayName":"Events.asp URL","description":"This is the URL that will be passed to the Description area in the Event Properties dialog box. Change this value if you want to use a different Web server to handle event information requests.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-eventviewer#admx-eventviewer-eventviewer-redirectionurl"],"options":[{"id":"device_vendor_msft_policy_config_admx_eventviewer_eventviewer_redirectionurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_eventviewer_eventviewer_redirectionurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_eventviewer_eventviewer_redirectionurl_eventviewer_redirectionurl","displayName":"Events.asp URL (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_explorer_admininfourl","displayName":"Set a support web page link","description":"Sets the target of the More Information link that will be displayed when the user attempts to run a program that is blocked by policy.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-explorer#admx-explorer-admininfourl"],"options":[{"id":"device_vendor_msft_policy_config_admx_explorer_admininfourl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_explorer_admininfourl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_explorer_admininfourl_admininfourl_textbox","displayName":"Support Web page URL (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_explorer_disableroamedprofileinit","displayName":"Do not reinitialize a pre-existing roamed user profile when it is loaded on a machine for the first time","description":"This policy setting allows administrators who have configured roaming profile in conjunction with Delete Cached Roaming Profile Group Policy setting to ensure that Explorer will not reinitialize default program associations and other settings to default values. \r\n\r\nIf you enable this policy setting on a machine that does not contain all programs installed in the same manner as it was on the machine on which the user had last logged on, unexpected behavior could occur. \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-explorer#admx-explorer-disableroamedprofileinit"],"options":[{"id":"device_vendor_msft_policy_config_admx_explorer_disableroamedprofileinit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_explorer_disableroamedprofileinit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_externalboot_portableoperatingsystem_hibernate","displayName":"Allow hibernate (S4) when starting from a Windows To Go workspace","description":"\r\n\r\nSpecifies whether the PC can use the hibernation sleep state (S4) when started from a Windows To Go workspace.\r\n\r\nIf you enable this setting, Windows, when started from a Windows To Go workspace, can hibernate the PC.\r\n\r\nIf you disable or don't configure this setting, Windows, when started from a Windows To Go workspace, can't hibernate the PC.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-externalboot#admx-externalboot-portableoperatingsystem-hibernate"],"options":[{"id":"device_vendor_msft_policy_config_admx_externalboot_portableoperatingsystem_hibernate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_externalboot_portableoperatingsystem_hibernate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_externalboot_portableoperatingsystem_launcher","displayName":"Windows To Go Default Startup Options","description":"\r\n\r\nThis policy setting controls whether the PC will boot to Windows To Go if a USB device containing a Windows To Go workspace is connected, and controls whether users can make changes using the Windows To Go Startup Options Control Panel item.\r\n\r\nIf you enable this setting, booting to Windows To Go when a USB device is connected will be enabled, and users will not be able to make changes using the Windows To Go Startup Options Control Panel item.\r\n\r\nIf you disable this setting, booting to Windows To Go when a USB device is connected will not be enabled unless a user configures the option manually in the BIOS or other boot order configuration.\r\n\r\nIf you do not configure this setting, users who are members of the Administrators group can make changes using the Windows To Go Startup Options Control Panel item.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-externalboot#admx-externalboot-portableoperatingsystem-launcher"],"options":[{"id":"device_vendor_msft_policy_config_admx_externalboot_portableoperatingsystem_launcher_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_externalboot_portableoperatingsystem_launcher_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_externalboot_portableoperatingsystem_sleep","displayName":"Disallow standby sleep states (S1-S3) when starting from a Windows to Go workspace","description":"\r\n\r\nSpecifies whether the PC can use standby sleep states (S1-S3) when starting from a Windows To Go workspace.\r\n\r\nIf you enable this setting, Windows, when started from a Windows To Go workspace, can't use standby states to make the PC sleep.\r\n\r\nIf you disable or don't configure this setting, Windows, when started from a Windows To Go workspace, can use standby states to make the PC sleep.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-externalboot#admx-externalboot-portableoperatingsystem-sleep"],"options":[{"id":"device_vendor_msft_policy_config_admx_externalboot_portableoperatingsystem_sleep_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_externalboot_portableoperatingsystem_sleep_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_filerecovery_wdiscenarioexecutionpolicy","displayName":"Configure Corrupted File Recovery behavior","description":"This policy setting allows you to configure the recovery behavior for corrupted files to one of three states:\r\n\r\nRegular: Detection, troubleshooting, and recovery of corrupted files will automatically start with a minimal UI display. Windows will attempt to present you with a dialog box when a system restart is required. This is the default recovery behavior for corrupted files.\r\n\r\nSilent: Detection, troubleshooting, and recovery of corrupted files will automatically start with no UI. Windows will log an administrator event when a system restart is required. This behavior is recommended for headless operation.\r\n\r\nTroubleshooting Only: Detection and troubleshooting of corrupted files will automatically start with no UI. Recovery is not attempted automatically. Windows will log an administrator event with instructions if manual recovery is possible.\r\n\r\nIf you enable this setting, the recovery behavior for corrupted files will be set to either the regular (default), silent, or troubleshooting only state.\r\n\r\nIf you disable this setting, the recovery behavior for corrupted files will be disabled. No troubleshooting or resolution will be attempted.\r\n\r\nIf you do not configure this setting, the recovery behavior for corrupted files will be set to the regular recovery behavior.\r\n\r\nNo system or service restarts are required for changes to this policy to take immediate effect after a Group Policy refresh.\r\n\r\nNote: This policy setting will take effect only when the Diagnostic Policy Service (DPS) is in the running state. When the service is stopped or disabled, system file recovery will not be attempted. The DPS can be configured with the Services snap-in to the Microsoft Management Console.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-filerecovery#admx-filerecovery-wdiscenarioexecutionpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_filerecovery_wdiscenarioexecutionpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_filerecovery_wdiscenarioexecutionpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_filerecovery_wdiscenarioexecutionpolicy_wdiscenarioexecutionpolicylevel","displayName":"Scenario Execution Level (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_filerecovery_wdiscenarioexecutionpolicy_wdiscenarioexecutionpolicylevel_1","displayName":"Troubleshooting Only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_filerecovery_wdiscenarioexecutionpolicy_wdiscenarioexecutionpolicylevel_2","displayName":"Regular","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_filerecovery_wdiscenarioexecutionpolicy_wdiscenarioexecutionpolicylevel_3","displayName":"Silent","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_fileservervssprovider_pol_encryptprotocol","displayName":"Allow or Disallow use of encryption to protect the RPC protocol messages between File Share Shadow Copy Provider running on application server and File Share Shadow Copy Agent running on the file servers.","description":"Determines whether the RPC protocol messagese used by VSS for SMB2 File Shares feature is enabled.\r\n\r\nVSS for SMB2 File Shares feature enables VSS aware backup applications to perform application consistent backup and restore of VSS aware applications storing data on SMB2 File Shares.\r\n\r\nBy default, the RPC protocol message between File Server VSS provider and File Server VSS Agent is signed but not encrypted. \r\n\r\nNote: To make changes to this setting effective, you must restart Volume Shadow Copy (VSS) Service .\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-fileservervssprovider#admx-fileservervssprovider-pol-encryptprotocol"],"options":[{"id":"device_vendor_msft_policy_config_admx_fileservervssprovider_pol_encryptprotocol_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_fileservervssprovider_pol_encryptprotocol_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_filesys_disablecompression","displayName":"Do not allow compression on all NTFS volumes","description":"Compression can add to the processing overhead of filesystem operations. Enabling this setting will prevent access to and creation of compressed files. \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-filesys#admx-filesys-disablecompression"],"options":[{"id":"device_vendor_msft_policy_config_admx_filesys_disablecompression_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_filesys_disablecompression_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_filesys_disabledeletenotification","displayName":"Disable delete notifications on all volumes","description":"Delete notification is a feature that notifies the underlying storage device of clusters that are freed due to a file delete operation.\r\n\r\nA value of 0, the default, will enable delete notifications for all volumes. \r\nA value of 1 will disable delete notifications for all volumes.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-filesys#admx-filesys-disabledeletenotification"],"options":[{"id":"device_vendor_msft_policy_config_admx_filesys_disabledeletenotification_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_filesys_disabledeletenotification_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_filesys_disableencryption","displayName":"Do not allow encryption on all NTFS volumes","description":"Encryption can add to the processing overhead of filesystem operations. Enabling this setting will prevent access to and creation of encrypted files\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-filesys#admx-filesys-disableencryption"],"options":[{"id":"device_vendor_msft_policy_config_admx_filesys_disableencryption_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_filesys_disableencryption_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_filesys_enablepagefileencryption","displayName":"Enable NTFS pagefile encryption","description":"Encrypting the page file prevents malicious users from reading data that has been paged to disk, but also adds processing overhead for filesystem operations. Enabling this setting will cause the page files to be encrypted.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-filesys#admx-filesys-enablepagefileencryption"],"options":[{"id":"device_vendor_msft_policy_config_admx_filesys_enablepagefileencryption_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_filesys_enablepagefileencryption_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_filesys_longpathsenabled","displayName":"Enable Win32 long paths","description":"Enabling Win32 long paths will allow manifested win32 applications and Windows Store applications to access paths beyond the normal 260 character limit per node on file systems that support it. Enabling this setting will cause the long paths to be accessible within the process.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-filesys#admx-filesys-longpathsenabled"],"options":[{"id":"device_vendor_msft_policy_config_admx_filesys_longpathsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_filesys_longpathsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_filesys_shortnamecreationsettings","displayName":"Short name creation options","description":"These settings provide control over whether or not short names are generated during file creation. Some applications require short names for compatibility, but short names have a negative performance impact on the system.\r\n\r\nIf you enable short names on all volumes then short names will always be generated. If you disable them on all volumes then they will never be generated. If you set short name creation to be configurable on a per volume basis then an on-disk flag will determine whether or not short names are created on a given volume. If you disable short name creation on all data volumes then short names will only be generated for files created on the system volume.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-filesys#admx-filesys-shortnamecreationsettings"],"options":[{"id":"device_vendor_msft_policy_config_admx_filesys_shortnamecreationsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_filesys_shortnamecreationsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_filesys_shortnamecreationsettings_shortnamecreationsetting_levels","displayName":"Short name creation options (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_filesys_shortnamecreationsettings_shortnamecreationsetting_levels_0","displayName":"Enable on all volumes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_filesys_shortnamecreationsettings_shortnamecreationsetting_levels_1","displayName":"Disable on all volumes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_filesys_shortnamecreationsettings_shortnamecreationsetting_levels_2","displayName":"Enable / disable on a per volume basis","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_filesys_shortnamecreationsettings_shortnamecreationsetting_levels_3","displayName":"Disable on all data volumes","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_filesys_symlinkevaluation","displayName":"Selectively allow the evaluation of a symbolic link","description":"Symbolic links can introduce vulnerabilities in certain applications. To mitigate this issue, you can selectively enable or disable the evaluation of these types of symbolic links:\r\n\r\nLocal Link to a Local Target\r\nLocal Link to a Remote Target\r\nRemote Link to Remote Target\r\nRemote Link to Local Target\r\n\r\nFor further information please refer to the Windows Help section\r\n\r\nNOTE: If this policy is Disabled or Not Configured, local administrators may select the types of symbolic links to be evaluated.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-filesys#admx-filesys-symlinkevaluation"],"options":[{"id":"device_vendor_msft_policy_config_admx_filesys_symlinkevaluation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_filesys_symlinkevaluation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_filesys_symlinkevaluation_symlinkclassl2l","displayName":"Local Link to Local Target (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_filesys_symlinkevaluation_symlinkclassl2l_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_filesys_symlinkevaluation_symlinkclassl2l_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_filesys_symlinkevaluation_symlinkclassl2r","displayName":"Local Link to a Remote Target (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_filesys_symlinkevaluation_symlinkclassl2r_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_filesys_symlinkevaluation_symlinkclassl2r_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_filesys_symlinkevaluation_symlinkclassr2l","displayName":"Remote Link to Local Target (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_filesys_symlinkevaluation_symlinkclassr2l_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_filesys_symlinkevaluation_symlinkclassr2l_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_filesys_symlinkevaluation_symlinkclassr2r","displayName":"Remote Link to Remote Target (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_filesys_symlinkevaluation_symlinkclassr2r_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_filesys_symlinkevaluation_symlinkclassr2r_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_filesys_txfdeprecatedfunctionality","displayName":"Enable / disable TXF deprecated features","description":"TXF deprecated features included savepoints, secondary RM, miniversion and roll forward. Please enable it if you want to use the APIs.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-filesys#admx-filesys-txfdeprecatedfunctionality"],"options":[{"id":"device_vendor_msft_policy_config_admx_filesys_txfdeprecatedfunctionality_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_filesys_txfdeprecatedfunctionality_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_folderredirection_localizexprelativepaths_2","displayName":"Use localized subfolder names when redirecting Start Menu and My Documents","description":"This policy setting allows the administrator to define whether Folder Redirection should use localized names for the All Programs, Startup, My Music, My Pictures, and My Videos subfolders when redirecting the parent Start Menu and legacy My Documents folder respectively.\r\n\r\nIf you enable this policy setting, Windows Vista, Windows 7, Windows 8, and Windows Server 2012 will use localized folder names for these subfolders when redirecting the Start Menu or legacy My Documents folder.\r\n\r\nIf you disable or not configure this policy setting, Windows Vista, Windows 7, Windows 8, and Windows Server 2012 will use the standard English names for these subfolders when redirecting the Start Menu or legacy My Documents folder.\r\n\r\nNote: This policy is valid only on Windows Vista, Windows 7, Windows 8, and Windows Server 2012 when it processes a legacy redirection policy already deployed for these folders in your existing localized environment.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-folderredirection#admx-folderredirection-localizexprelativepaths-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_folderredirection_localizexprelativepaths_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_folderredirection_localizexprelativepaths_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_folderredirection_primarycomputer_fr_2","displayName":"Redirect folders on primary computers only","description":"This policy setting controls whether folders are redirected on a user's primary computers only. This policy setting is useful to improve logon performance and to increase security for user data on computers where the user might not want to download private data, such as on a meeting room computer or on a computer in a remote office.\r\n\r\nTo designate a user's primary computers, an administrator must use management software or a script to add primary computer attributes to the user's account in Active Directory Domain Services (AD DS). This policy setting also requires the Windows Server 2012 version of the Active Directory schema to function.\r\n\r\nIf you enable this policy setting and the user has redirected folders, such as the Documents and Pictures folders, the folders are redirected on the user's primary computer only.\r\n\r\nIf you disable or do not configure this policy setting and the user has redirected folders, the folders are redirected on every computer that the user logs on to.\r\n\r\nNote: If you enable this policy setting in Computer Configuration and User Configuration, the Computer Configuration policy setting takes precedence.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-folderredirection#admx-folderredirection-primarycomputer-fr-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_folderredirection_primarycomputer_fr_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_folderredirection_primarycomputer_fr_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_fthsvc_wdiscenarioexecutionpolicy","displayName":"Configure Scenario Execution Level","description":"This policy setting permits or prohibits the Diagnostic Policy Service (DPS) from automatically resolving any heap corruption problems.\r\n\r\nIf you enable this policy setting, the DPS detects, troubleshoots, and attempts to resolve automatically any heap corruption problems.\r\n\r\nIf you disable this policy setting, Windows cannot detect, troubleshoot, and attempt to resolve automatically any heap corruption problems that are handled by the DPS.\r\n\r\nIf you do not configure this policy setting, the DPS enables Fault Tolerant Heap for resolution by default.\r\n\r\nThis policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.\r\n\r\nThis policy setting takes effect only when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios are not executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console.\r\n\r\nNo system restart or service restart is required for this policy setting to take effect: changes take effect immediately.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-fthsvc#admx-fthsvc-wdiscenarioexecutionpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_fthsvc_wdiscenarioexecutionpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_fthsvc_wdiscenarioexecutionpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_globalization_blockuserinputmethodsforsignin","displayName":"Disallow copying of user input methods to the system account for sign-in","description":"\r\n This policy prevents automatic copying of user input methods to the system account for use on the sign-in screen. The user is restricted to the set of input methods that are enabled in the system account.\r\n\r\n Note this does not affect the availability of user input methods on the lock screen or with the UAC prompt.\r\n\r\n If the policy is Enabled, then the user will get input methods enabled for the system account on the sign-in page.\r\n\r\n If the policy is Disabled or Not Configured, then the user will be able to use input methods enabled for their user account on the sign-in page.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-globalization#admx-globalization-blockuserinputmethodsforsignin"],"options":[{"id":"device_vendor_msft_policy_config_admx_globalization_blockuserinputmethodsforsignin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_blockuserinputmethodsforsignin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_globalization_customlocalesnoselect_2","displayName":"Disallow selection of Custom Locales","description":"This policy setting prevents a user from selecting a supplemental custom locale as their user locale. The user is restricted to the set of locales that are installed with the operating system.\r\n\r\nThis does not affect the selection of replacement locales. To prevent the selection of replacement locales, adjust the permissions of the %windir%\\Globalization directory to prevent the installation of locales by unauthorized users.\r\n\r\nThe policy setting \"Restrict user locales\" can also be enabled to disallow selection of a custom locale, even if this policy setting is not configured.\r\n\r\nIf you enable this policy setting, the user cannot select a custom locale as their user locale, but they can still select a replacement locale if one is installed.\r\n\r\nIf you disable or do not configure this policy setting, the user can select a custom locale as their user locale.\r\n\r\nIf this policy setting is enabled at the machine level, it cannot be disabled by a per-user policy setting. If this policy setting is disabled at the machine level, the per-user policy setting will be ignored. If this policy setting is not configured at the machine level, restrictions will be based on per-user policy settings.\r\n\r\nTo set this policy setting on a per-user basis, make sure that you do not configure the per-machine policy setting.\r\n\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-globalization#admx-globalization-customlocalesnoselect-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_globalization_customlocalesnoselect_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_customlocalesnoselect_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_globalization_implicitdatacollectionoff_2","displayName":"Turn off automatic learning","description":"\r\n This policy setting turns off the automatic learning component of handwriting recognition personalization. \r\n\r\n\t\tAutomatic learning enables the collection and storage of text and ink written by the user in order to help adapt handwriting recognition to the vocabulary and handwriting style of the user. \r\n\r\n\t\tText that is collected includes all outgoing messages in Windows Mail, and MAPI enabled email clients, as well as URLs from the Internet Explorer browser history. The information that is stored includes word frequency and new words not already known to the handwriting recognition engines (for example, proper names and acronyms). Deleting email content or the browser history does not delete the stored personalization data. Ink entered through Input Panel is collected and stored. \r\n\r\n\t\tNote: Automatic learning of both text and ink might not be available for all languages, even when handwriting personalization is available. See Tablet PC Help for more information.\r\n\r\n\t\tIf you enable this policy setting, automatic learning stops and any stored data is deleted. Users cannot configure this setting in Control Panel.\r\n\r\n\t\tIf you disable this policy setting, automatic learning is turned on. Users cannot configure this policy setting in Control Panel. Collected data is only used for handwriting recognition, if handwriting personalization is turned on.\r\n\r\n\t\tIf you do not configure this policy, users can choose to enable or disable automatic learning either from the Handwriting tab in the Tablet Settings in Control Panel or from the opt-in dialog.\r\n\r\n\t\tThis policy setting is related to the \"Turn off handwriting personalization\" policy setting.\r\n\r\n\t\tNote: The amount of stored ink is limited to 50 MB and the amount of text information to approximately 5 MB. When these limits are reached and new data is collected, old data is deleted to make room for more recent data.\r\n\r\n\t\tNote: Handwriting personalization works only for Microsoft handwriting recognizers, and not with third-party recognizers.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-globalization#admx-globalization-implicitdatacollectionoff-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_globalization_implicitdatacollectionoff_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_implicitdatacollectionoff_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_globalization_localesystemrestrict","displayName":"Restrict system locales","description":"This policy setting restricts the permitted system locales to the specified list. If the list is empty, it locks the system locale to its current value. This policy setting does not change the existing system locale; however, the next time that an administrator attempts to change the computer's system locale, they will be restricted to the specified list.\r\n\r\nThe locale list is specified using language names, separated by a semicolon (;). For example, en-US is English (United States). Specifying \"en-US;en-CA\" would restrict the system locale to English (United States) and English (Canada).\r\n\r\nIf you enable this policy setting, administrators can select a system locale only from the specified system locale list.\r\n\r\nIf you disable or do not configure this policy setting, administrators can select any system locale shipped with the operating system.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-globalization#admx-globalization-localesystemrestrict"],"options":[{"id":"device_vendor_msft_policy_config_admx_globalization_localesystemrestrict_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_localesystemrestrict_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_globalization_localesystemrestrict_allowablesystemlocaletaglist","displayName":"System Locales (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_globalization_localeuserrestrict_2","displayName":"Restrict user locales","description":"This policy setting restricts users on a computer to the specified list of user locales. If the list is empty, it locks all user locales to their current values. This policy setting does not change existing user locale settings; however, the next time a user attempts to change their user locale, their choices will be restricted to locales in this list.\r\n\r\nTo set this policy setting on a per-user basis, make sure that you do not configure the per-computer policy setting.\r\n\r\nThe locale list is specified using language tags, separated by a semicolon (;). For example, en-US is English (United States). Specifying \"en-CA;fr-CA\" would restrict the user locale to English (Canada) and French (Canada).\r\n\r\nIf you enable this policy setting, only locales in the specified locale list can be selected by users.\r\n\r\nIf you disable or do not configure this policy setting, users can select any locale installed on the computer, unless restricted by the \"Disallow selection of Custom Locales\" policy setting.\r\n\r\nIf this policy setting is enabled at the computer level, it cannot be disabled by a per-user policy. If this policy setting is disabled at the computer level, the per-user policy is ignored. If this policy setting is not configured at the computer level, restrictions are based on per-user policies.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-globalization#admx-globalization-localeuserrestrict-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_globalization_localeuserrestrict_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_localeuserrestrict_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_globalization_localeuserrestrict_2_allowableuserlocaletaglist","displayName":"User Locales (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage","displayName":"Restricts the UI language Windows uses for all logged users","description":"This policy setting restricts the Windows UI language for all users.\r\n\r\nThis is a policy setting for computers with more than one UI language installed.\r\n\r\nIf you enable this policy setting, the UI language of Windows menus and dialogs for systems with more than one language will follow the language specified by the administrator as the system UI languages. The UI language selected by the user will be ignored if it is different than any of the system UI languages.\r\n\r\nIf you disable or do not configure this policy setting, the user can specify which UI language is used.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-globalization#admx-globalization-lockmachineuilanguage"],"options":[{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect","displayName":"Restrict users to the following language: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_en-us","displayName":"English","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_ja-jp","displayName":"Japanese","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_ko-kr","displayName":"Korean","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_de-de","displayName":"German","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_zh-cn","displayName":"Simplified Chinese","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_zh-tw","displayName":"Traditional Chinese (Taiwan)","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_fr-fr","displayName":"French","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_es-es","displayName":"Spanish","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_it-it","displayName":"Italian","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_sv-se","displayName":"Swedish","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_nl-nl","displayName":"Dutch","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_pt-br","displayName":"Portuguese (Brazil)","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_fi-fi","displayName":"Finnish","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_nb-no","displayName":"Norwegian","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_da-dk","displayName":"Danish","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_hu-hu","displayName":"Hungarian","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_pl-pl","displayName":"Polish","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_ru-ru","displayName":"Russian","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_cs-cz","displayName":"Czech","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_el-gr","displayName":"Greek","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_pt-pt","displayName":"Portuguese (Portugal)","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_tr-tr","displayName":"Turkish","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_ar-sa","displayName":"Arabic","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_he-il","displayName":"Hebrew","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_sk-sk","displayName":"Slovak","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_sl-si","displayName":"Slovenian","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_ro-ro","displayName":"Romanian","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_hr-hr","displayName":"Croatian","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_bg-bg","displayName":"Bulgarian","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_et-ee","displayName":"Estonian","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_lt-lt","displayName":"Lithuanian","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_lv-lv","displayName":"Latvian","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_th-th","displayName":"Thai","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_zh-hk","displayName":"Traditional Chinese (Hong Kong)","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_sr-latn-cs","displayName":"Serbian (Latin)","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_lockmachineuilanguage_uilangselect_uk-ua","displayName":"Ukrainian","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_globalization_preventgeoidchange_2","displayName":"Disallow changing of geographic location","description":"This policy setting prevents users from changing their user geographical location (GeoID).\r\n\r\nIf you enable this policy setting, users cannot change their GeoID.\r\n\r\nIf you disable or do not configure this policy setting, users may select any GeoID.\r\n\r\nIf you enable this policy setting at the computer level, it cannot be disabled by a per-user policy setting. If you disable this policy setting at the computer level, the per-user policy is ignored. If you do not configure this policy setting at the computer level, restrictions are based on per-user policy settings.\r\n\r\nTo set this policy setting on a per-user basis, make sure that the per-computer policy setting is not configured.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-globalization#admx-globalization-preventgeoidchange-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_globalization_preventgeoidchange_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_preventgeoidchange_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_globalization_preventuseroverrides_2","displayName":"Disallow user override of locale settings","description":"This policy setting prevents the user from customizing their locale by changing their user overrides.\r\n\r\nAny existing overrides in place when this policy is enabled will be frozen. To remove existing user overrides, first reset the user(s) values to the defaults and then apply this policy.\r\n\r\nWhen this policy setting is enabled, users can still choose alternate locales installed on the system unless prevented by other policies, however, they will be unable to customize those choices. The user cannot customize their user locale with user overrides.\r\n\r\nIf this policy setting is disabled or not configured, then the user can customize their user locale overrides.\r\n\r\nIf this policy is set to Enabled at the computer level, then it cannot be disabled by a per-User policy. If this policy is set to Disabled at the computer level, then the per-User policy will be ignored. If this policy is set to Not Configured at the computer level, then restrictions will be based on per-User policies.\r\n\r\nTo set this policy on a per-user basis, make sure that the per-computer policy is set to Not Configured.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-globalization#admx-globalization-preventuseroverrides-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_globalization_preventuseroverrides_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_globalization_preventuseroverrides_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_allowx-forestpolicy-and-rup","displayName":"Allow cross-forest user policy and roaming user profiles","description":"This policy setting allows user-based policy processing, roaming user profiles, and user object logon scripts for interactive logons across forests.\r\n\r\nThis policy setting affects all user accounts that interactively log on to a computer in a different forest when a trust across forests or a two-way forest trust exists.\r\n\r\nIf you do not configure this policy setting:\r\n- No user-based policy settings are applied from the user's forest.\r\n- Users do not receive their roaming profiles; they receive a local profile on the computer from the local forest. A warning message appears to the user, and an event log message (1529) is posted.\r\n- Loopback Group Policy processing is applied, using the Group Policy Objects (GPOs) that are scoped to the computer.\r\n- An event log message (1109) is posted, stating that loopback was invoked in Replace mode.\r\n\r\nIf you enable this policy setting, the behavior is exactly the same as in Windows 2000: user policy is applied, and a roaming user profile is allowed from the trusted forest.\r\n\r\nIf you disable this policy setting, the behavior is the same as if it is not configured.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-allowx-forestpolicy-and-rup"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_allowx-forestpolicy-and-rup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_allowx-forestpolicy-and-rup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_corpconnsyncwaittime","displayName":"Specify workplace connectivity wait time for policy processing","description":"This policy setting specifies how long Group Policy should wait for workplace connectivity notifications during startup policy processing. If the startup policy processing is synchronous, the computer is blocked until workplace connectivity is available or the wait time is reached. If the startup policy processing is asynchronous, the computer is not blocked and policy processing will occur in the background. In either case, configuring this policy setting overrides any system-computed wait times.\r\n\r\nIf you enable this policy setting, Group Policy uses this administratively configured maximum wait time for workplace connectivity, and overrides any default or system-computed wait time.\r\n\r\nIf you disable or do not configure this policy setting, Group Policy will use the default wait time of 60 seconds on computers running Windows operating systems greater than Windows 7 configured for workplace connectivity.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-corpconnsyncwaittime"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_corpconnsyncwaittime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_corpconnsyncwaittime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_corpconnsyncwaittime_corpconnsyncwaittime_seconds","displayName":"Amount of time to wait (in seconds): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_appmgmt","displayName":"Configure software Installation policy processing","description":"This policy setting determines when software installation policies are updated.\r\n\r\nThis policy setting affects all policy settings that use the software installation component of Group Policy, such as policy settings in Software Settings\\Software Installation. You can set software installation policy only for Group Policy Objects stored in Active Directory, not for Group Policy Objects on the local computer.\r\n\r\nThis policy setting overrides customized settings that the program implementing the software installation policy set when it was installed.\r\n\r\nIf you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system.\r\n\r\nThe \"Allow processing across a slow network connection\" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.\r\n\r\nThe \"Process even if the Group Policy objects have not changed\" option updates and reapplies the policies even if the policies have not changed. Many policy setting implementations specify that they are updated only when changed. However, you might want to update unchanged policy settings, such as reapplying a desired policies in case a user has changed it.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-cse-appmgmt"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_appmgmt_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_appmgmt_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_appmgmt_cse_nochanges1","displayName":"Process even if the Group Policy objects have not changed (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_appmgmt_cse_nochanges1_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_appmgmt_cse_nochanges1_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_appmgmt_cse_slowlink1","displayName":"Allow processing across a slow network connection (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_appmgmt_cse_slowlink1_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_appmgmt_cse_slowlink1_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_diskquota","displayName":"Configure disk quota policy processing","description":"This policy setting determines when disk quota policies are updated.\r\n\r\nThis policy setting affects all policies that use the disk quota component of Group Policy, such as those in Computer Configuration\\Administrative Templates\\System\\Disk Quotas.\r\n\r\nThis policy setting overrides customized settings that the program implementing the disk quota policy set when it was installed.\r\n\r\nIf you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system.\r\n\r\nThe \"Allow processing across a slow network connection\" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.\r\n\r\nThe \"Do not apply during periodic background processing\" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.\r\n\r\nThe \"Process even if the Group Policy objects have not changed\" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-cse-diskquota"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_diskquota_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_diskquota_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_diskquota_cse_nobackground2","displayName":"Do not apply during periodic background processing (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_diskquota_cse_nobackground2_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_diskquota_cse_nobackground2_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_diskquota_cse_nochanges2","displayName":"Process even if the Group Policy objects have not changed (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_diskquota_cse_nochanges2_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_diskquota_cse_nochanges2_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_diskquota_cse_slowlink2","displayName":"Allow processing across a slow network connection (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_diskquota_cse_slowlink2_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_diskquota_cse_slowlink2_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_efsrecovery","displayName":"Configure EFS recovery policy processing","description":"This policy setting determines when encryption policies are updated.\r\n\r\nThis policy setting affects all policies that use the encryption component of Group Policy, such as policies related to encryption in Windows Settings\\Security Settings.\r\n\r\nIt overrides customized settings that the program implementing the encryption policy set when it was installed.\r\n\r\nIf you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system.\r\n\r\nThe \"Allow processing across a slow network connection\" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.\r\n\r\nThe \"Do not apply during periodic background processing\" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.\r\n\r\nThe \"Process even if the Group Policy objects have not changed\" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-cse-efsrecovery"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_efsrecovery_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_efsrecovery_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_efsrecovery_cse_nobackground3","displayName":"Do not apply during periodic background processing (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_efsrecovery_cse_nobackground3_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_efsrecovery_cse_nobackground3_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_efsrecovery_cse_nochanges3","displayName":"Process even if the Group Policy objects have not changed (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_efsrecovery_cse_nochanges3_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_efsrecovery_cse_nochanges3_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_efsrecovery_cse_slowlink3","displayName":"Allow processing across a slow network connection (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_efsrecovery_cse_slowlink3_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_efsrecovery_cse_slowlink3_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_folderredirection","displayName":"Configure folder redirection policy processing","description":"This policy setting determines when folder redirection policies are updated.\r\n\r\nThis policy setting affects all policies that use the folder redirection component of Group Policy, such as those in WindowsSettings\\Folder Redirection. You can only set folder redirection policy for Group Policy objects, stored in Active Directory, not for Group Policy objects on the local computer.\r\n\r\nThis policy setting overrides customized settings that the program implementing the folder redirection policy setting set when it was installed.\r\n\r\nIf you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system.\r\n\r\nThe \"Allow processing across a slow network connection\" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.\r\n\r\nThe \"Process even if the Group Policy objects have not changed\" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-cse-folderredirection"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_folderredirection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_folderredirection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_folderredirection_cse_nochanges4","displayName":"Process even if the Group Policy objects have not changed (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_folderredirection_cse_nochanges4_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_folderredirection_cse_nochanges4_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_folderredirection_cse_slowlink4","displayName":"Allow processing across a slow network connection (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_folderredirection_cse_slowlink4_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_folderredirection_cse_slowlink4_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_iem","displayName":"Configure Internet Explorer Maintenance policy processing","description":"This policy setting determines when Internet Explorer Maintenance policies are updated.\r\n\r\nThis policy setting affects all policies that use the Internet Explorer Maintenance component of Group Policy, such as those in Windows Settings\\Internet Explorer Maintenance.\r\n\r\nThis policy setting overrides customized settings that the program implementing the Internet Explorer Maintenance policy set when it was installed.\r\n\r\nIf you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system.\r\n\r\nThe \"Allow processing across a slow network connection\" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.\r\n\r\nThe \"Do not apply during periodic background processing\" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.\r\n\r\nThe \"Process even if the Group Policy objects have not changed\" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-cse-iem"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_iem_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_iem_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_iem_cse_nobackground5","displayName":"Do not apply during periodic background processing (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_iem_cse_nobackground5_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_iem_cse_nobackground5_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_iem_cse_nochanges5","displayName":"Process even if the Group Policy objects have not changed (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_iem_cse_nochanges5_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_iem_cse_nochanges5_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_iem_cse_slowlink5","displayName":"Allow processing across a slow network connection (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_iem_cse_slowlink5_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_iem_cse_slowlink5_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_ipsecurity","displayName":"Configure IP security policy processing","description":"This policy setting determines when IP security policies are updated.\r\n\r\nThis policy setting affects all policies that use the IP security component of Group Policy, such as policies in Computer Configuration\\Windows Settings\\Security Settings\\IP Security Policies on Local Machine.\r\n\r\nThis policy setting overrides customized settings that the program implementing the IP security policy set when it was installed.\r\n\r\nIf you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system.\r\n\r\nThe \"Allow processing across a slow network connection\" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.\r\n\r\nThe \"Do not apply during periodic background processing\" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.\r\n\r\nThe \"Process even if the Group Policy objects have not changed\" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-cse-ipsecurity"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_ipsecurity_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_ipsecurity_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_ipsecurity_cse_nobackground6","displayName":"Do not apply during periodic background processing (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_ipsecurity_cse_nobackground6_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_ipsecurity_cse_nobackground6_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_ipsecurity_cse_nochanges6","displayName":"Process even if the Group Policy objects have not changed (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_ipsecurity_cse_nochanges6_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_ipsecurity_cse_nochanges6_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_ipsecurity_cse_slowlink6","displayName":"Allow processing across a slow network connection (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_ipsecurity_cse_slowlink6_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_ipsecurity_cse_slowlink6_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_registry","displayName":"Configure registry policy processing","description":"This policy setting determines when registry policies are updated.\r\n\r\nThis policy setting affects all policies in the Administrative Templates folder and any other policies that store values in the registry. It overrides customized settings that the program implementing a registry policy set when it was installed.\r\n\r\nIf you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system.\r\n\r\nThe \"Do not apply during periodic background processing\" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.\r\n\r\nThe \"Process even if the Group Policy objects have not changed\" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-cse-registry"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_registry_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_registry_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_registry_cse_nobackground10","displayName":"Do not apply during periodic background processing (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_registry_cse_nobackground10_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_registry_cse_nobackground10_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_registry_cse_nochanges10","displayName":"Process even if the Group Policy objects have not changed (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_registry_cse_nochanges10_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_registry_cse_nochanges10_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_scripts","displayName":"Configure scripts policy processing","description":"This policy setting determines when policies that assign shared scripts are updated.\r\n\r\nThis policy setting affects all policies that use the scripts component of Group Policy, such as those in WindowsSettings\\Scripts. It overrides customized settings that the program implementing the scripts policy set when it was installed.\r\n\r\nIf you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this setting, it has no effect on the system.\r\n\r\nThe \"Allow processing across a slow network connection\" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.\r\n\r\nThe \"Do not apply during periodic background processing\" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.\r\n\r\nThe \"Process even if the Group Policy objects have not changed\" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-cse-scripts"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_scripts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_scripts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_scripts_cse_nobackground7","displayName":"Do not apply during periodic background processing (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_scripts_cse_nobackground7_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_scripts_cse_nobackground7_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_scripts_cse_nochanges7","displayName":"Process even if the Group Policy objects have not changed (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_scripts_cse_nochanges7_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_scripts_cse_nochanges7_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_scripts_cse_slowlink7","displayName":"Allow processing across a slow network connection (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_scripts_cse_slowlink7_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_scripts_cse_slowlink7_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_security","displayName":"Configure security policy processing","description":"This policy setting determines when security policies are updated.\r\n\r\nThis policy setting affects all policies that use the security component of Group Policy, such as those in Windows Settings\\Security Settings.\r\n\r\nThis policy setting overrides customized settings that the program implementing the security policy set when it was installed.\r\n\r\nIf you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system.\r\n\r\nThe \"Do not apply during periodic background processing\" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.\r\n\r\nThe \"Process even if the Group Policy objects have not changed\" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they be updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-cse-security"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_security_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_security_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_security_cse_nobackground11","displayName":"Do not apply during periodic background processing (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_security_cse_nobackground11_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_security_cse_nobackground11_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_security_cse_nochanges11","displayName":"Process even if the Group Policy objects have not changed (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_security_cse_nochanges11_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_security_cse_nochanges11_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wired","displayName":"Configure wired policy processing","description":"This policy setting determines when policies that assign wired network settings are updated.\r\n\r\nThis policy setting affects all policies that use the wired network component of Group Policy, such as those in Windows Settings\\Wired Network Policies.\r\n\r\nIt overrides customized settings that the program implementing the wired network set when it was installed.\r\n\r\nIf you enable this policy, you can use the check boxes provided to change the options.\r\n\r\nIf you disable this setting or do not configure it, it has no effect on the system.\r\n\r\nThe \"Allow processing across a slow network connection\" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.\r\n\r\nThe \"Do not apply during periodic background processing\" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.\r\n\r\nThe \"Process even if the Group Policy objects have not changed\" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-cse-wired"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wired_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wired_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wired_cse_nobackground8","displayName":"Do not apply during periodic background processing (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wired_cse_nobackground8_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wired_cse_nobackground8_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wired_cse_nochanges8","displayName":"Process even if the Group Policy objects have not changed (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wired_cse_nochanges8_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wired_cse_nochanges8_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wired_cse_slowlink8","displayName":"Allow processing across a slow network connection (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wired_cse_slowlink8_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wired_cse_slowlink8_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wireless","displayName":"Configure wireless policy processing","description":"This policy setting determines when policies that assign wireless network settings are updated.\r\n\r\nThis policy setting affects all policies that use the wireless network component of Group Policy, such as those in WindowsSettings\\Wireless Network Policies.\r\n\r\nIt overrides customized settings that the program implementing the wireless network set when it was installed.\r\n\r\nIf you enable this policy, you can use the check boxes provided to change the options.\r\n\r\nIf you disable this setting or do not configure it, it has no effect on the system.\r\n\r\nThe \"Allow processing across a slow network connection\" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.\r\n\r\nThe \"Do not apply during periodic background processing\" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.\r\n\r\nThe \"Process even if the Group Policy objects have not changed\" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-cse-wireless"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wireless_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wireless_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wireless_cse_nobackground9","displayName":"Do not apply during periodic background processing (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wireless_cse_nobackground9_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wireless_cse_nobackground9_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wireless_cse_nochanges9","displayName":"Process even if the Group Policy objects have not changed (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wireless_cse_nochanges9_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wireless_cse_nochanges9_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wireless_cse_slowlink9","displayName":"Allow processing across a slow network connection (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wireless_cse_slowlink9_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_cse_wireless_cse_slowlink9_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_denyrsoptointeractiveuser_2","displayName":"Determine if interactive users can generate Resultant Set of Policy data","description":"This policy setting controls the ability of users to view their Resultant Set of Policy (RSoP) data.\r\n\r\nBy default, interactively logged on users can view their own Resultant Set of Policy (RSoP) data.\r\n\r\nIf you enable this policy setting, interactive users cannot generate RSoP data.\r\n\r\nIf you disable or do not configure this policy setting, interactive users can generate RSoP.\r\n\r\nNote: This policy setting does not affect administrators. If you enable or disable this policy setting, by default administrators can view RSoP data.\r\n\r\nNote: To view RSoP data on a client computer, use the RSoP snap-in for the Microsoft Management Console. You can launch the RSoP snap-in from the command line by typing RSOP.msc\r\n\r\nNote: This policy setting exists as both a User Configuration and Computer Configuration setting.\r\n\r\nAlso, see the \"Turn off Resultant set of Policy logging\" policy setting in Computer Configuration\\Administrative Templates\\System\\GroupPolicy.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-denyrsoptointeractiveuser-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_denyrsoptointeractiveuser_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_denyrsoptointeractiveuser_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_disableaoacprocessing","displayName":"Turn off Group Policy Client Service AOAC optimization","description":"This policy setting prevents the Group Policy Client Service from stopping when idle.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-disableaoacprocessing"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_disableaoacprocessing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_disableaoacprocessing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_disablebackgroundpolicy","displayName":"Turn off background refresh of Group Policy","description":"This policy setting prevents Group Policy from being updated while the computer is in use. This policy setting applies to Group Policy for computers, users, and domain controllers.\r\n\r\nIf you enable this policy setting, the system waits until the current user logs off the system before updating the computer and user settings.\r\n\r\nIf you disable or do not configure this policy setting, updates can be applied while users are working. The frequency of updates is determined by the \"Set Group Policy refresh interval for computers\" and \"Set Group Policy refresh interval for users\" policy settings.\r\n\r\nNote: If you make changes to this policy setting, you must restart your computer for it to take effect.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-disablebackgroundpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_disablebackgroundpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_disablebackgroundpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_disablelgpoprocessing","displayName":"Turn off Local Group Policy Objects processing","description":"This policy setting prevents Local Group Policy Objects (Local GPOs) from being applied.\r\n\r\nBy default, the policy settings in Local GPOs are applied before any domain-based GPO policy settings. These policy settings can apply to both users and the local computer. You can disable the processing and application of all Local GPOs to ensure that only domain-based GPOs are applied.\r\n\r\nIf you enable this policy setting, the system does not process and apply any Local GPOs.\r\n\r\nIf you disable or do not configure this policy setting, Local GPOs continue to be applied.\r\n\r\nNote: For computers joined to a domain, it is strongly recommended that you only configure this policy setting in domain-based GPOs. This policy setting will be ignored on computers that are joined to a workgroup.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-disablelgpoprocessing"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_disablelgpoprocessing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_disablelgpoprocessing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_disableusersfrommachgp","displayName":"Remove users' ability to invoke machine policy refresh","description":"This policy setting allows you to control a user's ability to invoke a computer policy refresh.\r\n\r\nIf you enable this policy setting, users are not able to invoke a refresh of computer policy. Computer policy will still be applied at startup or when an official policy refresh occurs.\r\n\r\nIf you disable or do not configure this policy setting, the default behavior applies. By default, computer policy is applied when the computer starts up. It also applies at a specified refresh interval or when manually invoked by the user.\r\n\r\nNote: This policy setting applies only to non-administrators. Administrators can still invoke a refresh of computer policy at any time, no matter how this policy setting is configured.\r\n\r\nAlso, see the \"Set Group Policy refresh interval for computers\" policy setting to change the policy refresh interval.\r\n\r\nNote: If you make changes to this policy setting, you must restart your computer for it to take effect.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-disableusersfrommachgp"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_disableusersfrommachgp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_disableusersfrommachgp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_enablecdp","displayName":"Continue experiences on this device","description":"\r\nThis policy setting determines whether the Windows device is allowed to participate in cross-device experiences (continue experiences).\r\n\r\nIf you enable this policy setting, the Windows device is discoverable by other Windows devices that belong to the same user, and can participate in cross-device experiences.\r\n\r\nIf you disable this policy setting, the Windows device is not discoverable by other devices, and cannot participate in cross-device experiences.\r\n\r\nIf you do not configure this policy setting, the default behavior depends on the Windows edition. Changes to this policy take effect on reboot.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-enablecdp"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_enablecdp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_enablecdp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_enablelogonoptimization","displayName":"Configure Group Policy Caching","description":"\r\n This policy setting allows you to configure Group Policy caching behavior.\r\n\r\n If you enable or do not configure this policy setting, Group Policy caches policy information after every background processing session. This cache saves applicable GPOs and the settings contained within them. When Group Policy runs in synchronous foreground mode, it refers to this cache, which enables it to run faster. When the cache is read, Group Policy attempts to contact a logon domain controller to determine the link speed. When Group Policy runs in background mode or asynchronous foreground mode, it continues to download the latest version of the policy information, and it uses a bandwidth estimate to determine slow link thresholds. (See the “Configure Group Policy Slow Link Detection” policy setting to configure asynchronous foreground behavior.)\r\n\r\n The slow link value that is defined in this policy setting determines how long Group Policy will wait for a response from the domain controller before reporting the link speed as slow. The default is 500 milliseconds.\r\n\r\n The timeout value that is defined in this policy setting determines how long Group Policy will wait for a response from the domain controller before determining that there is no network connectivity. This stops the current Group Policy processing. Group Policy will run in the background the next time a connection to a domain controller is established. Setting this value too high might result in longer waits for the user at boot or logon. The default is 5000 milliseconds.\r\n\r\n If you disable this policy setting, the Group Policy client will not cache applicable GPOs or settings that are contained within the GPOs. When Group Policy runs synchronously, it downloads the latest version of the policy from the network and uses bandwidth estimates to determine slow link thresholds. (See the “Configure Group Policy Slow Link Detection” policy setting to configure asynchronous foreground behavior.)\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-enablelogonoptimization"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_enablelogonoptimization_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_enablelogonoptimization_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_enablelogonoptimization_syncmodenodcthreshold1","displayName":"Timeout value: [number field] milliseconds (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_enablelogonoptimization_syncmodeslowlinkthreshold1","displayName":"Slow link value:[number field] milliseconds (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_enablelogonoptimizationonserversku","displayName":"Enable Group Policy Caching for Servers","description":"\r\n This policy setting allows you to configure Group Policy caching behavior on Windows Server machines.\r\n If you enable this policy setting, Group Policy caches policy information after every background processing session. This cache saves applicable GPOs and the settings contained within them. When Group Policy runs in synchronous foreground mode, it refers to this cache, which enables it to run faster. When the cache is read, Group Policy attempts to contact a logon domain controller to determine the link speed. When Group Policy runs in background mode or asynchronous foreground mode, it continues to download the latest version of the policy information, and it uses a bandwidth estimate to determine slow link thresholds. (See the “Configure Group Policy Slow Link Detection” policy setting to configure asynchronous foreground behavior.)\r\n The slow link value that is defined in this policy setting determines how long Group Policy will wait for a response from the domain controller before reporting the link speed as slow. The default is 500 milliseconds.\r\n The timeout value that is defined in this policy setting determines how long Group Policy will wait for a response from the domain controller before determining that there is no network connectivity. This stops the current Group Policy processing. Group Policy will run in the background the next time a connection to a domain controller is established. Setting this value too high might result in longer waits for the user at boot or logon. The default is 5000 milliseconds.\r\n If you disable or do not configure this policy setting, the Group Policy client will not cache applicable GPOs or settings that are contained within the GPOs. When Group Policy runs synchronously, it downloads the latest version of the policy from the network and uses bandwidth estimates to determine slow link thresholds. (See the “Configure Group Policy Slow Link Detection” policy setting to configure asynchronous foreground behavior.)\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-enablelogonoptimizationonserversku"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_enablelogonoptimizationonserversku_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_enablelogonoptimizationonserversku_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_enablelogonoptimizationonserversku_syncmodenodcthreshold1","displayName":"Timeout value: [number field] milliseconds (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_enablelogonoptimizationonserversku_syncmodeslowlinkthreshold1","displayName":"Slow link value:[number field] milliseconds (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_enablemmx","displayName":"Phone-PC linking on this device","description":"\r\nThis policy allows IT admins to turn off the ability to Link a Phone with a PC to continue reading, emailing and other tasks that requires linking between Phone and PC.\r\n\r\nIf you enable this policy setting, the Windows device will be able to enroll in Phone-PC linking functionality and participate in Continue on PC experiences.\r\n\r\nIf you disable this policy setting, the Windows device is not allowed to be linked to Phones, will remove itself from the device list of any linked Phones, and cannot participate in Continue on PC experiences.\r\n\r\nIf you do not configure this policy setting, the default behavior depends on the Windows edition. Changes to this policy take effect on reboot.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-enablemmx"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_enablemmx_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_enablemmx_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_fontmitigation","displayName":"Untrusted Font Blocking","description":"This security feature provides a global setting to prevent programs from loading untrusted fonts. Untrusted fonts are any font installed outside of the %windir%\\Fonts directory. This feature can be configured to be in 3 modes: On, Off, and Audit. By default, it is Off and no fonts are blocked. If you aren't quite ready to deploy this feature into your organization, you can run it in Audit mode to see if blocking untrusted fonts causes any usability or compatibility issues.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-fontmitigation"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_fontmitigation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_fontmitigation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_fontmitigation_fontmitigation_dl","displayName":"Mitigation Options (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_fontmitigation_fontmitigation_dl_1000000000000","displayName":"Block untrusted fonts and log events","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_fontmitigation_fontmitigation_dl_2000000000000","displayName":"Do not block untrusted fonts","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_fontmitigation_fontmitigation_dl_3000000000000","displayName":"Log events without blocking untrusted fonts","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_gptransferrate_2","displayName":"Configure Group Policy slow link detection","description":"This policy setting defines a slow connection for purposes of applying and updating Group Policy.\r\n\r\nIf the rate at which data is transferred from the domain controller providing a policy update to the computers in this group is slower than the rate specified by this setting, the system considers the connection to be slow.\r\n\r\nThe system's response to a slow policy connection varies among policies. The program implementing the policy can specify the response to a slow link. Also, the policy processing settings in this folder lets you override the programs' specified responses to slow links.\r\n\r\nIf you enable this setting, you can, in the \"Connection speed\" box, type a decimal number between 0 and 4,294,967,200, indicating a transfer rate in kilobits per second. Any connection slower than this rate is considered to be slow. If you type 0, all connections are considered to be fast.\r\n\r\nIf you disable this setting or do not configure it, the system uses the default value of 500 kilobits per second.\r\n\r\nThis setting appears in the Computer Configuration and User Configuration folders. The setting in Computer Configuration defines a slow link for policies in the Computer Configuration folder. The setting in User Configuration defines a slow link for settings in the User Configuration folder.\r\n\r\nAlso, see the \"Do not detect slow network connections\" and related policies in Computer Configuration\\Administrative Templates\\System\\User Profile. Note: If the profile server has IP connectivity, the connection speed setting is used. If the profile server does not have IP connectivity, the SMB timing is used.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-gptransferrate-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_gptransferrate_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_gptransferrate_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_gptransferrate_2_cse_3g_default_to_slowlink_computer","displayName":"Always treat WWAN connections as a slow link (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_gptransferrate_2_cse_3g_default_to_slowlink_computer_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_gptransferrate_2_cse_3g_default_to_slowlink_computer_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_gptransferrate_2_transferrateop2","displayName":"Connection speed (Kbps): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_grouppolicyrefreshrate","displayName":"Set Group Policy refresh interval for computers","description":"This policy setting specifies how often Group Policy for computers is updated while the computer is in use (in the background). This setting specifies a background update rate only for Group Policies in the Computer Configuration folder.\r\n\r\nIn addition to background updates, Group Policy for the computer is always updated when the system starts.\r\n\r\nBy default, computer Group Policy is updated in the background every 90 minutes, with a random offset of 0 to 30 minutes.\r\n\r\nIf you enable this setting, you can specify an update rate from 0 to 64,800 minutes (45 days). If you select 0 minutes, the computer tries to update Group Policy every 7 seconds. However, because updates might interfere with users' work and increase network traffic, very short update intervals are not appropriate for most installations.\r\n\r\nIf you disable this setting, Group Policy is updated every 90 minutes (the default). To specify that Group Policy should never be updated while the computer is in use, select the \"Turn off background refresh of Group Policy\" policy.\r\n\r\nThe Set Group Policy refresh interval for computers policy also lets you specify how much the actual update interval varies. To prevent clients with the same update interval from requesting updates simultaneously, the system varies the update interval for each client by a random number of minutes. The number you type in the random time box sets the upper limit for the range of variance. For example, if you type 30 minutes, the system selects a variance of 0 to 30 minutes. Typing a large number establishes a broad range and makes it less likely that client requests overlap. However, updates might be delayed significantly.\r\n\r\nThis setting establishes the update rate for computer Group Policy. To set an update rate for user policies, use the \"Set Group Policy refresh interval for users\" setting (located in User Configuration\\Administrative Templates\\System\\Group Policy).\r\n\r\nThis setting is only used when the \"Turn off background refresh of Group Policy\" setting is not enabled.\r\n\r\nNote: Consider notifying users that their policy is updated periodically so that they recognize the signs of a policy update. When Group Policy is updated, the Windows desktop is refreshed; it flickers briefly and closes open menus. Also, restrictions imposed by Group Policies, such as those that limit the programs users can run, might interfere with tasks in progress.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-grouppolicyrefreshrate"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_grouppolicyrefreshrate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_grouppolicyrefreshrate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_grouppolicyrefreshrate_gprefreshrate1","displayName":"Minutes: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_grouppolicyrefreshrate_gprefreshrateoffset1","displayName":"Minutes: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_grouppolicyrefreshratedc","displayName":"Set Group Policy refresh interval for domain controllers","description":"This policy setting specifies how often Group Policy is updated on domain controllers while they are running (in the background). The updates specified by this setting occur in addition to updates performed when the system starts.\r\n\r\nBy default, Group Policy on the domain controllers is updated every five minutes.\r\n\r\nIf you enable this setting, you can specify an update rate from 0 to 64,800 minutes (45 days). If you select 0 minutes, the domain controller tries to update Group Policy every 7 seconds. However, because updates might interfere with users' work and increase network traffic, very short update intervals are not appropriate for most installations.\r\n\r\nIf you disable or do not configure this setting, the domain controller updates Group Policy every 5 minutes (the default). To specify that Group Policies for users should never be updated while the computer is in use, select the \"Turn off background refresh of Group Policy\" setting.\r\n\r\nThis setting also lets you specify how much the actual update interval varies. To prevent domain controllers with the same update interval from requesting updates simultaneously, the system varies the update interval for each controller by a random number of minutes. The number you type in the random time box sets the upper limit for the range of variance. For example, if you type 30 minutes, the system selects a variance of 0 to 30 minutes. Typing a large number establishes a broad range and makes it less likely that update requests overlap. However, updates might be delayed significantly.\r\n\r\nNote: This setting is used only when you are establishing policy for a domain, site, organizational unit (OU), or customized group. If you are establishing policy for a local computer only, the system ignores this setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-grouppolicyrefreshratedc"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_grouppolicyrefreshratedc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_grouppolicyrefreshratedc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_grouppolicyrefreshratedc_gprefreshrate2","displayName":"Minutes: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_grouppolicyrefreshratedc_gprefreshrateoffset2","displayName":"Minutes: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_logonscriptdelay","displayName":"Configure Logon Script Delay","description":"\r\n Enter “0” to disable Logon Script Delay.\r\n\r\n This policy setting allows you to configure how long the Group Policy client waits after logon before running scripts.\r\n\r\n By default, the Group Policy client waits five minutes before running logon scripts. This helps create a responsive desktop environment by preventing disk contention.\r\n\r\n If you enable this policy setting, Group Policy will wait for the specified amount of time before running logon scripts.\r\n\r\n If you disable this policy setting, Group Policy will run scripts immediately after logon.\r\n\r\n If you do not configure this policy setting, Group Policy will wait five minutes before running logon scripts.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-logonscriptdelay"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_logonscriptdelay_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_logonscriptdelay_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_logonscriptdelay_asyncscriptdelay1","displayName":"minute: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_onlyuselocaladminfiles","displayName":"Always use local ADM files for Group Policy Object Editor","description":"This policy setting lets you always use local ADM files for the Group Policy snap-in.\r\n\r\nBy default, when you edit a Group Policy Object (GPO) using the Group Policy Object Editor snap-in, the ADM files are loaded from that GPO into the Group Policy Object Editor snap-in. This allows you to use the same version of the ADM files that were used to create the GPO while editing this GPO.\r\n\r\nThis leads to the following behavior:\r\n\r\n- If you originally created the GPO with, for example, an English system, the GPO contains English ADM files.\r\n\r\n- If you later edit the GPO from a different-language system, you get the English ADM files as they were in the GPO.\r\n\r\nYou can change this behavior by using this setting.\r\n\r\nIf you enable this setting, the Group Policy Object Editor snap-in always uses local ADM files in your %windir%\\inf directory when editing GPOs.\r\n\r\nThis leads to the following behavior:\r\n\r\n- If you had originally created the GPO with an English system, and then you edit the GPO with a Japanese system, the Group Policy Object Editor snap-in uses the local Japanese ADM files, and you see the text in Japanese under Administrative Templates.\r\n\r\nIf you disable or do not configure this setting, the Group Policy Object Editor snap-in always loads all ADM files from the actual GPO.\r\n\r\nNote: If the ADMs that you require are not all available locally in your %windir%\\inf directory, you might not be able to see all the settings that have been configured in the GPO that you are editing.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-onlyuselocaladminfiles"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_onlyuselocaladminfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_onlyuselocaladminfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_processmitigationoptions","displayName":"Process Mitigation Options","description":"\r\n This security feature provides a means to override individual process MitigationOptions settings. This can be used to enforce a number of security policies specific to applications. The application name is specified as the Value name, including extension. The Value is specified as a bit field with a series of flags in particular positions. Bits can be set to either 0 (setting is forced off), 1 (setting is forced on), or ? (setting retains its existing value prior to GPO evaluation). The recognized bit locations are:\r\n\r\n PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE (0x00000001)\r\n Enables data execution prevention (DEP) for the child process\r\n\r\n PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE (0x00000002)\r\n Enables DEP-ATL thunk emulation for the child process. DEP-ATL thunk emulation causes the system to intercept NX faults that originate from the Active Template Library (ATL) thunk layer.\r\n\r\n PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE (0x00000004)\r\n Enables structured exception handler overwrite protection (SEHOP) for the child process. SEHOP blocks exploits that use the structured exception handler (SEH) overwrite technique.\r\n\r\n PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON (0x00000100)\r\n The force Address Space Layout Randomization (ASLR) policy forcibly rebases images that are not dynamic base compatible by acting as though an image base collision happened at load time. If relocations are required, images that do not have a base relocation section will not be loaded.\r\n\r\n PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_ON (0x00010000)\r\n PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_OFF (0x00020000)\r\n The bottom-up randomization policy, which includes stack randomization options, causes a random location to be used as the lowest user address.\r\n\r\n For instance, to enable PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE and PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON, disable PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_OFF, and to leave all other options at their default values, specify a value of:\r\n ???????????????0???????1???????1\r\n\r\n Setting flags not specified here to any value other than ? results in undefined behavior.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-processmitigationoptions"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_processmitigationoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_processmitigationoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_processmitigationoptions_processmitigationoptionslist","displayName":"Process Mitigation Options (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_processmitigationoptions_processmitigationoptionslist_key","displayName":"Name","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_processmitigationoptions_processmitigationoptionslist_value","displayName":"Value","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_resetdfsclientinfoduringrefreshpolicy","displayName":"Enable AD/DFS domain controller synchronization during policy refresh","description":"Enabling this setting will cause the Group Policy Client to connect to the same domain controller for DFS shares as is being used for Active Directory.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-resetdfsclientinfoduringrefreshpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_resetdfsclientinfoduringrefreshpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_resetdfsclientinfoduringrefreshpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_rsoplogging","displayName":"Turn off Resultant Set of Policy logging","description":"This setting allows you to enable or disable Resultant Set of Policy (RSoP) logging on a client computer.\r\n\r\nRSoP logs information on Group Policy settings that have been applied to the client. This information includes details such as which Group Policy Objects (GPO) were applied, where they came from, and the client-side extension settings that were included.\r\n\r\nIf you enable this setting, RSoP logging is turned off.\r\n\r\nIf you disable or do not configure this setting, RSoP logging is turned on. By default, RSoP logging is always on.\r\n\r\nNote: To view the RSoP information logged on a client computer, you can use the RSoP snap-in in the Microsoft Management Console (MMC).\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-rsoplogging"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_rsoplogging_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_rsoplogging_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_slowlinkdefaultfordirectaccess","displayName":"Configure Direct Access connections as a fast network connection","description":"This policy setting allows an administrator to define the Direct Access connection to be considered a fast network connection for the purposes of applying and updating Group Policy.\r\n\r\nWhen Group Policy detects the bandwidth speed of a Direct Access connection, the detection can sometimes fail to provide any bandwidth speed information. If Group Policy detects a bandwidth speed, Group Policy will follow the normal rules for evaluating if the Direct Access connection is a fast or slow network connection. If no bandwidth speed is detected, Group Policy will default to a slow network connection. This policy setting allows the administrator the option to override the default to slow network connection and instead default to using a fast network connection in the case that no network bandwidth speed is determined.\r\n\r\nNote: When Group Policy detects a slow network connection, Group Policy will only process those client side extensions configured for processing across a slow link (slow network connection).\r\n\r\nIf you enable this policy, when Group Policy cannot determine the bandwidth speed across Direct Access, Group Policy will evaluate the network connection as a fast link and process all client side extensions.\r\n\r\nIf you disable this setting or do not configure it, Group Policy will evaluate the network connection as a slow link and process only those client side extensions configured to process over a slow link.\r\n\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-slowlinkdefaultfordirectaccess"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_slowlinkdefaultfordirectaccess_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_slowlinkdefaultfordirectaccess_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_slowlinkdefaulttoasync","displayName":"Change Group Policy processing to run asynchronously when a slow network connection is detected.","description":"This policy directs Group Policy processing to skip processing any client side extension that requires synchronous processing (that is, whether computers wait for the network to be fully initialized during computer startup and user logon) when a slow network connection is detected.\r\n\r\nIf you enable this policy setting, when a slow network connection is detected, Group Policy processing will always run in an asynchronous manner.\r\nClient computers will not wait for the network to be fully initialized at startup and logon. Existing users will be logged on using cached credentials,\r\nwhich will result in shorter logon times. Group Policy will be applied in the background after the network becomes available.\r\nNote that because this is a background refresh, extensions requiring synchronous processing such as Software Installation, Folder Redirection\r\nand Drive Maps preference extension will not be applied.\r\n\r\nNote: There are two conditions that will cause Group Policy to be processed synchronously even if this policy setting is enabled:\r\n1 - At the first computer startup after the client computer has joined the domain.\r\n2 - If the policy setting \"Always wait for the network at computer startup and logon\" is enabled.\r\n\r\nIf you disable or do not configure this policy setting, detecting a slow network connection will not affect whether Group Policy processing will be synchronous or asynchronous.\r\n\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-slowlinkdefaulttoasync"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_slowlinkdefaulttoasync_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_slowlinkdefaulttoasync_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_syncwaittime","displayName":"Specify startup policy processing wait time","description":"This policy setting specifies how long Group Policy should wait for network availability notifications during startup policy processing. If the startup policy processing is synchronous, the computer is blocked until the network is available or the default wait time is reached. If the startup policy processing is asynchronous, the computer is not blocked and policy processing will occur in the background. In either case, configuring this policy setting overrides any system-computed wait times.\r\n\r\nIf you enable this policy setting, Group Policy will use this administratively configured maximum wait time and override any default or system-computed wait time.\r\n\r\nIf you disable or do not configure this policy setting, Group Policy will use the default wait time of 30 seconds on computers running Windows Vista operating system.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-syncwaittime"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_syncwaittime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_syncwaittime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_syncwaittime_syncwaittime_minutes","displayName":"Amount of time to wait (in seconds): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_userpolicymode","displayName":"Configure user Group Policy loopback processing mode","description":"This policy setting directs the system to apply the set of Group Policy objects for the computer to any user who logs on to a computer affected by this setting. It is intended for special-use computers, such as those in public places, laboratories, and classrooms, where you must modify the user setting based on the computer that is being used.\r\n\r\nBy default, the user's Group Policy Objects determine which user settings apply. If this setting is enabled, then, when a user logs on to this computer, the computer's Group Policy Objects determine which set of Group Policy Objects applies.\r\n\r\nIf you enable this setting, you can select one of the following modes from the Mode box:\r\n\r\n\"Replace\" indicates that the user settings defined in the computer's Group Policy Objects replace the user settings normally applied to the user.\r\n\r\n\"Merge\" indicates that the user settings defined in the computer's Group Policy Objects and the user settings normally applied to the user are combined. If the settings conflict, the user settings in the computer's Group Policy Objects take precedence over the user's normal settings.\r\n\r\nIf you disable this setting or do not configure it, the user's Group Policy Objects determines which user settings apply.\r\n\r\nNote: This setting is effective only when both the computer account and the user account are in at least Windows 2000 domains.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-grouppolicy#admx-grouppolicy-userpolicymode"],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_userpolicymode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_userpolicymode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_userpolicymode_userpolicymodeop","displayName":"Mode: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_grouppolicy_userpolicymode_userpolicymodeop_1","displayName":"Merge","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_grouppolicy_userpolicymode_userpolicymodeop_2","displayName":"Replace","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_help_disablehhdep","displayName":"Turn off Data Execution Prevention for HTML Help Executible","description":"This policy setting allows you to exclude HTML Help Executable from being monitored by software-enforced Data Execution Prevention.\r\n\r\n Data Execution Prevention (DEP) is designed to block malicious code that takes advantage of exception-handling mechanisms in Windows by monitoring your programs to make sure that they use system memory safely.\r\n\r\n If you enable this policy setting, DEP for HTML Help Executable is turned off. This will allow certain legacy ActiveX controls to function without DEP shutting down HTML Help Executable.\r\n\r\n If you disable or do not configure this policy setting, DEP is turned on for HTML Help Executable. This provides an additional security benefit, but HTLM Help stops if DEP detects system memory abnormalities.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-help#admx-help-disablehhdep"],"options":[{"id":"device_vendor_msft_policy_config_admx_help_disablehhdep_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_help_disablehhdep_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_help_helpqualifiedrootdir_comp","displayName":"Restrict potentially unsafe HTML Help functions to specified folders","description":"This policy setting allows you to restrict certain HTML Help commands to function only in HTML Help (.chm) files within specified folders and their subfolders. Alternatively, you can disable these commands on the entire system. It is strongly recommended that only folders requiring administrative privileges be added to this policy setting.\r\n\r\n If you enable this policy setting, the commands function only for .chm files in the specified folders and their subfolders.\r\n\r\n To restrict the commands to one or more folders, enable the policy setting and enter the desired folders in the text box on the Settings tab of the Policy Properties dialog box. Use a semicolon to separate folders. For example, to restrict the commands to only .chm files in the %windir%\\help folder and D:\\somefolder, add the following string to the edit box: \"%windir%\\help;D:\\somefolder\".\r\n\r\n Note: An environment variable may be used, (for example, %windir%), as long as it is defined on the system. For example, %programfiles% is not defined on some early versions of Windows.\r\n\r\n The \"Shortcut\" command is used to add a link to a Help topic, and runs executables that are external to the Help file. The \"WinHelp\" command is used to add a link to a Help topic, and runs a WinHLP32.exe Help (.hlp) file.\r\n\r\n To disallow the \"Shortcut\" and \"WinHelp\" commands on the entire local system, enable the policy setting and leave the text box on the Settings tab of the Policy Properties dialog box blank.\r\n\r\n If you disable or do not configure this policy setting, these commands are fully functional for all Help files.\r\n\r\n Note: Only folders on the local computer can be specified in this policy setting. You cannot use this policy setting to enable the \"Shortcut\" and \"WinHelp\" commands for .chm files that are stored on mapped drives or accessed using UNC paths.\r\n\r\n For additional options, see the \"Restrict these programs from being launched from Help\" policy.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-help#admx-help-helpqualifiedrootdir-comp"],"options":[{"id":"device_vendor_msft_policy_config_admx_help_helpqualifiedrootdir_comp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_help_helpqualifiedrootdir_comp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_help_helpqualifiedrootdir_comp_helpqualifiedrootdir_edit","displayName":"Enter folder names separated by semi-colons: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_help_restrictrunfromhelp_comp","displayName":"Restrict these programs from being launched from Help","description":"\r\n This policy setting allows you to restrict programs from being run from online Help.\r\n \r\n If you enable this policy setting, you can prevent specified programs from being run from Help. When you enable this policy setting, enter the file names names of the programs you want to restrict, separated by commas.\r\n \r\n If you disable or do not configure this policy setting, users can run all applications from online Help.\r\n \r\n Note: You can also restrict users from running applications by using the Software Restriction Policy settings available in Computer Configuration\\Security Settings.\r\n \r\n Note: This policy setting is available under Computer Configuration and User Configuration. If both are settings are used, any programs listed in either of these locations cannot launched from Help\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-help#admx-help-restrictrunfromhelp-comp"],"options":[{"id":"device_vendor_msft_policy_config_admx_help_restrictrunfromhelp_comp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_help_restrictrunfromhelp_comp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_help_restrictrunfromhelp_comp_restrictrunfromhelp_edit","displayName":"Enter executables separated by commas: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_helpandsupport_activehelp","displayName":"Turn off Active Help","description":"This policy setting specifies whether active content links in trusted assistance content are rendered. By default, the Help viewer renders trusted assistance content with active elements such as ShellExecute links and Guided Help links.\r\n\r\nIf you enable this policy setting, active content links are not rendered. The text is displayed, but there are no clickable links for these elements.\r\n\r\nIf you disable or do not configure this policy setting, the default behavior applies (Help viewer renders trusted assistance content with active elements).\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-helpandsupport#admx-helpandsupport-activehelp"],"options":[{"id":"device_vendor_msft_policy_config_admx_helpandsupport_activehelp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_helpandsupport_activehelp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_hotspotauth_hotspotauth_enable","displayName":"Enable Hotspot Authentication","description":"This policy setting defines whether WLAN hotspots are probed for Wireless Internet Service Provider roaming (WISPr) protocol support.\r\n\r\nIf a WLAN hotspot supports the WISPr protocol, users can submit credentials when manually connecting to the network. If authentication is successful, users will be connected automatically on subsequent attempts. Credentials can also be configured by network operators.\r\n\r\nIf you enable this policy setting, or if you do not configure this policy setting, WLAN hotspots are automatically probed for WISPR protocol support.\r\n\r\nIf you disable this policy setting, WLAN hotspots are not probed for WISPr protocol support, and users can only authenticate with WLAN hotspots using a web browser.\r\n\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-hotspotauth#admx-hotspotauth-hotspotauth-enable"],"options":[{"id":"device_vendor_msft_policy_config_admx_hotspotauth_hotspotauth_enable_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_hotspotauth_hotspotauth_enable_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_icm_ceipenable","displayName":"Turn off Windows Customer Experience Improvement Program","description":"This policy setting turns off the Windows Customer Experience Improvement Program. The Windows Customer Experience Improvement Program collects information about your hardware configuration and how you use our software and services to identify trends and usage patterns. Microsoft will not collect your name, address, or any other personally identifiable information. There are no surveys to complete, no salesperson will call, and you can continue working without interruption. It is simple and user-friendly.\r\n\r\nIf you enable this policy setting, all users are opted out of the Windows Customer Experience Improvement Program.\r\n\r\nIf you disable this policy setting, all users are opted into the Windows Customer Experience Improvement Program.\r\n\r\nIf you do not configure this policy setting, the administrator can use the Problem Reports and Solutions component in Control Panel to enable Windows Customer Experience Improvement Program for all users.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-icm#admx-icm-ceipenable"],"options":[{"id":"device_vendor_msft_policy_config_admx_icm_ceipenable_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_icm_ceipenable_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_icm_certmgr_disableautorootupdates","displayName":"Turn off Automatic Root Certificates Update","description":"This policy setting specifies whether to automatically update root certificates using the Windows Update website. \r\n\r\nTypically, a certificate is used when you use a secure website or when you send and receive secure email. Anyone can issue certificates, but to have transactions that are as secure as possible, certificates must be issued by a trusted certificate authority (CA). Microsoft has included a list in Windows XP and other products of companies and organizations that it considers trusted authorities.\r\n\r\nIf you enable this policy setting, when you are presented with a certificate issued by an untrusted root authority, your computer will not contact the Windows Update website to see if Microsoft has added the CA to its list of trusted authorities.\r\n\r\nIf you disable or do not configure this policy setting, your computer will contact the Windows Update website.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-icm#admx-icm-certmgr-disableautorootupdates"],"options":[{"id":"device_vendor_msft_policy_config_admx_icm_certmgr_disableautorootupdates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_icm_certmgr_disableautorootupdates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_icm_driversearchplaces_dontsearchwindowsupdate","displayName":"Turn off Windows Update device driver searching","description":"This policy setting specifies whether Windows searches Windows Update for device drivers when no local drivers for a device are present.\r\n\r\nIf you enable this policy setting, Windows Update is not searched when a new device is installed.\r\n\r\nIf you disable this policy setting, Windows Update is always searched for drivers when no local drivers are present.\r\n\r\nIf you do not configure this policy setting, searching Windows Update is optional when installing a device.\r\n\r\nAlso see \"Turn off Windows Update device driver search prompt\" in \"Administrative Templates/System,\" which governs whether an administrator is prompted before searching Windows Update for device drivers if a driver is not found locally.\r\n\r\nNote: This policy setting is replaced by \"Specify Driver Source Search Order\" in \"Administrative Templates/System/Device Installation\" on newer versions of Windows.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-icm#admx-icm-driversearchplaces-dontsearchwindowsupdate"],"options":[{"id":"device_vendor_msft_policy_config_admx_icm_driversearchplaces_dontsearchwindowsupdate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_icm_driversearchplaces_dontsearchwindowsupdate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_icm_eventviewer_disablelinks","displayName":"Turn off Event Viewer \"Events.asp\" links","description":"This policy setting specifies whether \"Events.asp\" hyperlinks are available for events within the Event Viewer application.\r\n\r\nThe Event Viewer normally makes all HTTP(S) URLs into hyperlinks that activate the Internet browser when clicked. In addition, \"More Information\" is placed at the end of the description text if the event is created by a Microsoft component. This text contains a link (URL) that, if clicked, sends information about the event to Microsoft, and allows users to learn more about why that event occurred.\r\n\r\nIf you enable this policy setting, event description hyperlinks are not activated and the text \"More Information\" is not displayed at the end of the description.\r\n\r\nIf you disable or do not configure this policy setting, the user can click the hyperlink, which prompts the user and then sends information about the event over the Internet to Microsoft. Also, see \"Events.asp URL\", \"Events.asp program\", and \"Events.asp Program Command Line Parameters\" settings in \"Administrative Templates/Windows Components/Event Viewer\".\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-icm#admx-icm-eventviewer-disablelinks"],"options":[{"id":"device_vendor_msft_policy_config_admx_icm_eventviewer_disablelinks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_icm_eventviewer_disablelinks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_icm_hss_headlinespolicy","displayName":"Turn off Help and Support Center \"Did you know?\" content","description":"This policy setting specifies whether to show the \"Did you know?\" section of Help and Support Center.\r\n\r\nThis content is dynamically updated when users who are connected to the Internet open Help and Support Center, and provides up-to-date information about Windows and the computer.\r\n\r\nIf you enable this policy setting, the Help and Support Center no longer retrieves nor displays \"Did you know?\" content.\r\n\r\nIf you disable or do not configure this policy setting, the Help and Support Center retrieves and displays \"Did you know?\" content.\r\n\r\nYou might want to enable this policy setting for users who do not have Internet access, because the content in the \"Did you know?\" section will remain static indefinitely without an Internet connection.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-icm#admx-icm-hss-headlinespolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_icm_hss_headlinespolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_icm_hss_headlinespolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_icm_hss_kbsearchpolicy","displayName":"Turn off Help and Support Center Microsoft Knowledge Base search","description":"This policy setting specifies whether users can perform a Microsoft Knowledge Base search from the Help and Support Center.\r\n\r\nThe Knowledge Base is an online source of technical support information and self-help tools for Microsoft products, and is searched as part of all Help and Support Center searches with the default search options.\r\n\r\nIf you enable this policy setting, it removes the Knowledge Base section from the Help and Support Center \"Set search options\" page, and only Help content on the local computer is searched. \r\n\r\nIf you disable or do not configure this policy setting, the Knowledge Base is searched if the user has a connection to the Internet and has not disabled the Knowledge Base search from the Search Options page.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-icm#admx-icm-hss-kbsearchpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_icm_hss_kbsearchpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_icm_hss_kbsearchpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_icm_internetmanagement_restrictcommunication_2","displayName":"Restrict Internet communication","description":"This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources.\r\n\r\nIf you enable this setting, all of the the policy settings listed in the \"Internet Communication settings\" section are set such that their respective features cannot access the Internet.\r\n\r\nIf you disable this policy setting, all of the the policy settings listed in the \"Internet Communication settings\" section are set such that their respective features can access the Internet.\r\n\r\nIf you do not configure this policy setting, all of the the policy settings in the \"Internet Communication settings\" section are set to not configured.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-icm#admx-icm-internetmanagement-restrictcommunication-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_icm_internetmanagement_restrictcommunication_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_icm_internetmanagement_restrictcommunication_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_icm_nc_exitonisp","displayName":"Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com","description":"This policy setting specifies whether the Internet Connection Wizard can connect to Microsoft to download a list of Internet Service Providers (ISPs).\r\n\r\nIf you enable this policy setting, the \"Choose a list of Internet Service Providers\" path in the Internet Connection Wizard causes the wizard to exit. This prevents users from retrieving the list of ISPs, which resides on Microsoft servers.\r\n\r\nIf you disable or do not configure this policy setting, users can connect to Microsoft to download a list of ISPs for their area.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-icm#admx-icm-nc-exitonisp"],"options":[{"id":"device_vendor_msft_policy_config_admx_icm_nc_exitonisp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_icm_nc_exitonisp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_icm_nc_noregistration","displayName":"Turn off Registration if URL connection is referring to Microsoft.com","description":"This policy setting specifies whether the Windows Registration Wizard connects to Microsoft.com for online registration.\r\n\r\nIf you enable this policy setting, it blocks users from connecting to Microsoft.com for online registration and users cannot register their copy of Windows online.\r\n\r\nIf you disable or do not configure this policy setting, users can connect to Microsoft.com to complete the online Windows Registration.\r\n\r\nNote that registration is optional and involves submitting some personal information to Microsoft. However, Windows Product Activation is required but does not involve submitting any personal information (except the country/region you live in).\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-icm#admx-icm-nc-noregistration"],"options":[{"id":"device_vendor_msft_policy_config_admx_icm_nc_noregistration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_icm_nc_noregistration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_icm_pch_donotreport","displayName":"Turn off Windows Error Reporting","description":"This policy setting controls whether or not errors are reported to Microsoft.\r\n\r\nError Reporting is used to report information about a system or application that has failed or has stopped responding and is used to improve the quality of the product.\r\n\r\nIf you enable this policy setting, users are not given the option to report errors.\r\n\r\nIf you disable or do not configure this policy setting, the errors may be reported to Microsoft via the Internet or to a corporate file share.\r\n\r\nThis policy setting overrides any user setting made from the Control Panel for error reporting.\r\n\r\nAlso see the \"Configure Error Reporting\", \"Display Error Notification\" and \"Disable Windows Error Reporting\" policy settings under Computer Configuration/Administrative Templates/Windows Components/Windows Error Reporting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-icm#admx-icm-pch-donotreport"],"options":[{"id":"device_vendor_msft_policy_config_admx_icm_pch_donotreport_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_icm_pch_donotreport_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_icm_removewindowsupdate_icm","displayName":"Turn off access to all Windows Update features","description":"This policy setting allows you to remove access to Windows Update.\r\n\r\nIf you enable this policy setting, all Windows Update features are removed. This includes blocking access to the Windows Update website at http://windowsupdate.microsoft.com, from the Windows Update hyperlink on the Start menu, and also on the Tools menu in Internet Explorer. Windows automatic updating is also disabled; you will neither be notified about nor will you receive critical updates from Windows Update. This policy setting also prevents Device Manager from automatically installing driver updates from the Windows Update website.\r\n\r\nIf you disable or do not configure this policy setting, users can access the Windows Update website and enable automatic updating to receive notifications and critical updates from Windows Update.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-icm#admx-icm-removewindowsupdate-icm"],"options":[{"id":"device_vendor_msft_policy_config_admx_icm_removewindowsupdate_icm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_icm_removewindowsupdate_icm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_icm_searchcompanion_disablefileupdates","displayName":"Turn off Search Companion content file updates","description":"This policy setting specifies whether Search Companion should automatically download content updates during local and Internet searches.\r\n\r\nWhen users search the local computer or the Internet, Search Companion occasionally connects to Microsoft to download an updated privacy policy and additional content files used to format and display results.\r\n\r\nIf you enable this policy setting, Search Companion does not download content updates during searches.\r\n\r\nIf you disable or do not configure this policy setting, Search Companion downloads content updates unless the user is using Classic Search.\r\n\r\nNote: Internet searches still send the search text and information about the search to Microsoft and the chosen search provider. Choosing Classic Search turns off the Search Companion feature completely.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-icm#admx-icm-searchcompanion-disablefileupdates"],"options":[{"id":"device_vendor_msft_policy_config_admx_icm_searchcompanion_disablefileupdates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_icm_searchcompanion_disablefileupdates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_icm_shellnouseinternetopenwith_2","displayName":"Turn off Internet File Association service","description":"This policy setting specifies whether to use the Microsoft Web service for finding an application to open a file with an unhandled file association.\r\n\r\nWhen a user opens a file that has an extension that is not associated with any applications on the computer, the user is given the choice to select a local application or use the Web service to find an application.\r\n\r\nIf you enable this policy setting, the link and the dialog for using the Web service to open an unhandled file association are removed.\r\n\r\nIf you disable or do not configure this policy setting, the user is allowed to use the Web service.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-icm#admx-icm-shellnouseinternetopenwith-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_icm_shellnouseinternetopenwith_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_icm_shellnouseinternetopenwith_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_icm_shellnousestoreopenwith_2","displayName":"Turn off access to the Store","description":"This policy setting specifies whether to use the Store service for finding an application to open a file with an unhandled file type or protocol association.\r\n\r\nWhen a user opens a file type or protocol that is not associated with any applications on the computer, the user is given the choice to select a local application or use the Store service to find an application.\r\n\r\nIf you enable this policy setting, the \"Look for an app in the Store\" item in the Open With dialog is removed.\r\n\r\nIf you disable or do not configure this policy setting, the user is allowed to use the Store service and the Store item is available in the Open With dialog.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-icm#admx-icm-shellnousestoreopenwith-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_icm_shellnousestoreopenwith_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_icm_shellnousestoreopenwith_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_icm_shellremoveorderprints_2","displayName":"Turn off the \"Order Prints\" picture task","description":"This policy setting specifies whether the \"Order Prints Online\" task is available from Picture Tasks in Windows folders.\r\n\r\nThe Order Prints Online Wizard is used to download a list of providers and allow users to order prints online.\r\n\r\nIf you enable this policy setting, the task \"Order Prints Online\" is removed from Picture Tasks in File Explorer folders.\r\n\r\nIf you disable or do not configure this policy setting, the task is displayed.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-icm#admx-icm-shellremoveorderprints-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_icm_shellremoveorderprints_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_icm_shellremoveorderprints_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_icm_shellremovepublishtoweb_2","displayName":"Turn off the \"Publish to Web\" task for files and folders","description":"This policy setting specifies whether the tasks \"Publish this file to the Web,\" \"Publish this folder to the Web,\" and \"Publish the selected items to the Web\" are available from File and Folder Tasks in Windows folders.\r\n\r\nThe Web Publishing Wizard is used to download a list of providers and allow users to publish content to the web.\r\n\r\nIf you enable this policy setting, these tasks are removed from the File and Folder tasks in Windows folders.\r\n\r\nIf you disable or do not configure this policy setting, the tasks are shown.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-icm#admx-icm-shellremovepublishtoweb-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_icm_shellremovepublishtoweb_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_icm_shellremovepublishtoweb_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_icm_winmsg_noinstrumentation_2","displayName":"Turn off the Windows Messenger Customer Experience Improvement Program","description":"This policy setting specifies whether Windows Messenger collects anonymous information about how Windows Messenger software and service is used.\r\n\r\nWith the Customer Experience Improvement program, users can allow Microsoft to collect anonymous information about how the product is used. This information is used to improve the product in future releases.\r\n\r\nIf you enable this policy setting, Windows Messenger does not collect usage information, and the user settings to enable the collection of usage information are not shown.\r\n\r\nIf you disable this policy setting, Windows Messenger collects anonymous usage information, and the setting is not shown.\r\n\r\nIf you do not configure this policy setting, users have the choice to opt in and allow information to be collected.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-icm#admx-icm-winmsg-noinstrumentation-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_icm_winmsg_noinstrumentation_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_icm_winmsg_noinstrumentation_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_iis_preventiisinstall","displayName":"Prevent IIS installation","description":"\"This policy setting prevents installation of Internet Information Services (IIS) on this computer. If you enable this policy setting, Internet Information Services (IIS) cannot be installed, and you will not be able to install Windows components or applications that require IIS. Users installing Windows components or applications that require IIS might not receive a warning that IIS cannot be installed because of this Group Policy setting. Enabling this setting will not have any effect on IIS if IIS is already installed on the computer. If you disable or do not configure this policy setting, IIS can be installed, as well as all the programs and applications that require IIS to run.\"\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-iis#admx-iis-preventiisinstall"],"options":[{"id":"device_vendor_msft_policy_config_admx_iis_preventiisinstall_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_iis_preventiisinstall_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsidiscovery_configureisnsservers","displayName":"Do not allow manual configuration of iSNS servers","description":"If enabled then new iSNS servers may not be added and thus new targets discovered via those iSNS servers; existing iSNS servers may not be removed. If disabled then new iSNS servers may be added and thus new targets discovered via those iSNS servers; existing iSNS servers may be removed.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-iscsi#admx-iscsi-iscsidiscovery-configureisnsservers"],"options":[{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsidiscovery_configureisnsservers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsidiscovery_configureisnsservers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsidiscovery_configuretargetportals","displayName":"Do not allow manual configuration of target portals","description":"If enabled then new target portals may not be added and thus new targets discovered on those portals; existing target portals may not be removed. If disabled then new target portals may be added and thus new targets discovered on those portals; existing target portals may be removed.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-iscsi#admx-iscsi-iscsidiscovery-configuretargetportals"],"options":[{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsidiscovery_configuretargetportals_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsidiscovery_configuretargetportals_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsidiscovery_configuretargets","displayName":"Do not allow manual configuration of discovered targets","description":"If enabled then discovered targets may not be manually configured. If disabled then discovered targets may be manually configured. Note: if enabled there may be cases where this will break VDS.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-iscsi#admx-iscsi-iscsidiscovery-configuretargets"],"options":[{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsidiscovery_configuretargets_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsidiscovery_configuretargets_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsidiscovery_newstatictargets","displayName":"Do not allow adding new targets via manual configuration","description":"If enabled then new targets may not be manually configured by entering the target name and target portal; already discovered targets may be manually configured. If disabled then new and already discovered targets may be manually configured. Note: if enabled there may be cases where this will break VDS.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-iscsi#admx-iscsi-iscsidiscovery-newstatictargets"],"options":[{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsidiscovery_newstatictargets_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsidiscovery_newstatictargets_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsigeneral_changeiqnname","displayName":"Do not allow changes to initiator iqn name","description":" If enabled then do not allow the initiator iqn name to be changed. If disabled then the initiator iqn name may be changed.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-iscsi#admx-iscsi-iscsigeneral-changeiqnname"],"options":[{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsigeneral_changeiqnname_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsigeneral_changeiqnname_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsigeneral_restrictadditionallogins","displayName":"Do not allow additional session logins","description":"If enabled then only those sessions that are established via a persistent login will be established and no new persistent logins may be created. If disabled then additional persistent and non persistent logins may be established.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-iscsi#admx-iscsi-iscsigeneral-restrictadditionallogins"],"options":[{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsigeneral_restrictadditionallogins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsigeneral_restrictadditionallogins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsisecurity_changechapsecret","displayName":"Do not allow changes to initiator CHAP secret","description":" If enabled then do not allow the initiator CHAP secret to be changed. If disabled then the initiator CHAP secret may be changed.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-iscsi#admx-iscsi-iscsisecurity-changechapsecret"],"options":[{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsisecurity_changechapsecret_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsisecurity_changechapsecret_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsisecurity_requireipsec","displayName":"Do not allow connections without IPSec","description":"If enabled then only those connections that are configured for IPSec may be established. If disabled then connections that are configured for IPSec or connections not configured for IPSec may be established.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-iscsi#admx-iscsi-iscsisecurity-requireipsec"],"options":[{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsisecurity_requireipsec_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsisecurity_requireipsec_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsisecurity_requiremutualchap","displayName":"Do not allow sessions without mutual CHAP","description":"If enabled then only those sessions that are configured for mutual CHAP may be established. If disabled then sessions that are configured for mutual CHAP or sessions not configured for mutual CHAP may be established.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-iscsi#admx-iscsi-iscsisecurity-requiremutualchap"],"options":[{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsisecurity_requiremutualchap_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsisecurity_requiremutualchap_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsisecurity_requireonewaychap","displayName":"Do not allow sessions without one way CHAP","description":"If enabled then only those sessions that are configured for one-way CHAP may be established. If disabled then sessions that are configured for one-way CHAP or sessions not configured for one-way CHAP may be established. Note that if the \"Do not allow sessions without mutual CHAP\" setting is enabled then that setting overrides this one.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-iscsi#admx-iscsi-iscsisecurity-requireonewaychap"],"options":[{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsisecurity_requireonewaychap_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_iscsi_iscsisecurity_requireonewaychap_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_kdc_cbacandarmor","displayName":"KDC support for claims, compound authentication and Kerberos armoring","description":"This policy setting allows you to configure a domain controller to support claims and compound authentication for Dynamic Access Control and Kerberos armoring using Kerberos authentication.\r\n\r\nIf you enable this policy setting, client computers that support claims and compound authentication for Dynamic Access Control and are Kerberos armor-aware will use this feature for Kerberos authentication messages. This policy should be applied to all domain controllers to ensure consistent application of this policy in the domain. \r\n\r\nIf you disable or do not configure this policy setting, the domain controller does not support claims, compound authentication or armoring.\r\n\r\nIf you configure the \"Not supported\" option, the domain controller does not support claims, compound authentication or armoring which is the default behavior for domain controllers running Windows Server 2008 R2 or earlier operating systems.\r\n\r\nNote: For the following options of this KDC policy to be effective, the Kerberos Group Policy \"Kerberos client support for claims, compound authentication and Kerberos armoring\" must be enabled on supported systems. If the Kerberos policy setting is not enabled, Kerberos authentication messages will not use these features. \r\n\r\nIf you configure \"Supported\", the domain controller supports claims, compound authentication and Kerberos armoring. The domain controller advertises to Kerberos client computers that the domain is capable of claims and compound authentication for Dynamic Access Control and Kerberos armoring. \r\n\r\nDomain functional level requirements\r\nFor the options \"Always provide claims\" and \"Fail unarmored authentication requests\", when the domain functional level is set to Windows Server 2008 R2 or earlier then domain controllers behave as if the \"Supported\" option is selected. \r\n\r\nWhen the domain functional level is set to Windows Server 2012 then the domain controller advertises to Kerberos client computers that the domain is capable of claims and compound authentication for Dynamic Access Control and Kerberos armoring, and:\r\n - If you set the \"Always provide claims\" option, always returns claims for accounts and supports the RFC behavior for advertising the flexible authentication secure tunneling (FAST).\r\n - If you set the \"Fail unarmored authentication requests\" option, rejects unarmored Kerberos messages.\r\n\r\nWarning: When \"Fail unarmored authentication requests\" is set, then client computers which do not support Kerberos armoring will fail to authenticate to the domain controller.\r\n\r\nTo ensure this feature is effective, deploy enough domain controllers that support claims and compound authentication for Dynamic Access Control and are Kerberos armor-aware to handle the authentication requests. Insufficient number of domain controllers that support this policy result in authentication failures whenever Dynamic Access Control or Kerberos armoring is required (that is, the \"Supported\" option is enabled).\r\n\r\nImpact on domain controller performance when this policy setting is enabled:\r\n - Secure Kerberos domain capability discovery is required resulting in additional message exchanges.\r\n - Claims and compound authentication for Dynamic Access Control increases the size and complexity of the data in the message which results in more processing time and greater Kerberos service ticket size.\r\n - Kerberos armoring fully encrypts Kerberos messages and signs Kerberos errors which results in increased processing time, but does not change the service ticket size.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-kdc#admx-kdc-cbacandarmor"],"options":[{"id":"device_vendor_msft_policy_config_admx_kdc_cbacandarmor_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kdc_cbacandarmor_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_kdc_cbacandarmor_cbacandarmor_levels","displayName":"Claims, compound authentication for Dynamic Access Control and Kerberos armoring options: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_kdc_cbacandarmor_cbacandarmor_levels_0","displayName":"Not supported","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kdc_cbacandarmor_cbacandarmor_levels_1","displayName":"Supported","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kdc_cbacandarmor_cbacandarmor_levels_2","displayName":"Always provide claims","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kdc_cbacandarmor_cbacandarmor_levels_3","displayName":"Fail unarmored authentication requests","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_kdc_emitlili","displayName":"Provide information about previous logons to client computers","description":"This policy setting controls whether the domain controller provides information about previous logons to client computers.\r\n\r\nIf you enable this policy setting, the domain controller provides the information message about previous logons.\r\n\r\nFor Windows Logon to leverage this feature, the \"Display information about previous logons during user logon\" policy setting located in the Windows Logon Options node under Windows Components also needs to be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the domain controller does not provide information about previous logons unless the \"Display information about previous logons during user logon\" policy setting is enabled.\r\n\r\nNote: Information about previous logons is provided only if the domain functional level is Windows Server 2008. In domains with a domain functional level of Windows Server 2003, Windows 2000 native, or Windows 2000 mixed, domain controllers cannot provide information about previous logons, and enabling this policy setting does not affect anything.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-kdc#admx-kdc-emitlili"],"options":[{"id":"device_vendor_msft_policy_config_admx_kdc_emitlili_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kdc_emitlili_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_kdc_forestsearch","displayName":"Use forest search order","description":"This policy setting defines the list of trusting forests that the Key Distribution Center (KDC) searches when attempting to resolve two-part service principal names (SPNs).\r\n\r\nIf you enable this policy setting, the KDC will search the forests in this list if it is unable to resolve a two-part SPN in the local forest. The forest search is performed by using a global catalog or name suffix hints. If a match is found, the KDC will return a referral ticket to the client for the appropriate domain.\r\n\r\nIf you disable or do not configure this policy setting, the KDC will not search the listed forests to resolve the SPN. If the KDC is unable to resolve the SPN because the name is not found, NTLM authentication might be used.\r\n\r\nTo ensure consistent behavior, this policy setting must be supported and set identically on all domain controllers in the domain.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-kdc#admx-kdc-forestsearch"],"options":[{"id":"device_vendor_msft_policy_config_admx_kdc_forestsearch_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kdc_forestsearch_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_kdc_forestsearch_forestsearchlist","displayName":"Forests to Search (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_kdc_pkinitfreshness","displayName":"KDC support for PKInit Freshness Extension","description":"Support for PKInit Freshness Extension requires Windows Server 2016 domain functional level (DFL). If the domain controller’s domain is not at Windows Server 2016 DFL or higher this policy will not be applied.\r\n\r\nThis policy setting allows you to configure a domain controller (DC) to support the PKInit Freshness Extension.\r\n\r\nIf you enable this policy setting, the following options are supported:\r\n\r\nSupported: PKInit Freshness Extension is supported on request. Kerberos clients successfully authenticating with the PKInit Freshness Extension will get the fresh public key identity SID.\r\n\r\nRequired: PKInit Freshness Extension is required for successful authentication. Kerberos clients which do not support the PKInit Freshness Extension will always fail when using public key credentials.\r\n\r\nIf you disable or not configure this policy setting, then the DC will never offer the PKInit Freshness Extension and accept valid authentication requests without checking for freshness. Users will never receive the fresh public key identity SID.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-kdc#admx-kdc-pkinitfreshness"],"options":[{"id":"device_vendor_msft_policy_config_admx_kdc_pkinitfreshness_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kdc_pkinitfreshness_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_kdc_pkinitfreshness_pkinitfreshness_levels","displayName":"PKInit Freshness Extension options: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_kdc_pkinitfreshness_pkinitfreshness_levels_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kdc_pkinitfreshness_pkinitfreshness_levels_1","displayName":"Supported","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kdc_pkinitfreshness_pkinitfreshness_levels_2","displayName":"Required","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_kdc_requestcompoundid","displayName":"Request compound authentication","description":"This policy setting allows you to configure a domain controller to request compound authentication.\r\n\r\nNote: For a domain controller to request compound authentication, the policy \"KDC support for claims, compound authentication, and Kerberos armoring\" must be configured and enabled. \r\n\r\nIf you enable this policy setting, domain controllers will request compound authentication. The returned service ticket will contain compound authentication only when the account is explicitly configured. This policy should be applied to all domain controllers to ensure consistent application of this policy in the domain. \r\n\r\nIf you disable or do not configure this policy setting, domain controllers will return service tickets that contain compound authentication any time the client sends a compound authentication request regardless of the account configuration.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-kdc#admx-kdc-requestcompoundid"],"options":[{"id":"device_vendor_msft_policy_config_admx_kdc_requestcompoundid_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kdc_requestcompoundid_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_kdc_ticketsizethreshold","displayName":"Warning for large Kerberos tickets","description":"This policy setting allows you to configure at what size Kerberos tickets will trigger the warning event issued during Kerberos authentication. The ticket size warnings are logged in the System log.\r\n\r\nIf you enable this policy setting, you can set the threshold limit for Kerberos ticket which trigger the warning events. If set too high, then authentication failures might be occurring even though warning events are not being logged. If set too low, then there will be too many ticket warnings in the log to be useful for analysis. This value should be set to the same value as the Kerberos policy \"Set maximum Kerberos SSPI context token buffer size\" or the smallest MaxTokenSize used in your environment if you are not configuring using Group Policy.\r\n \r\nIf you disable or do not configure this policy setting, the threshold value defaults to 12,000 bytes, which is the default Kerberos MaxTokenSize for Windows 7, Windows Server 2008 R2 and prior versions.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-kdc#admx-kdc-ticketsizethreshold"],"options":[{"id":"device_vendor_msft_policy_config_admx_kdc_ticketsizethreshold_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kdc_ticketsizethreshold_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_kdc_ticketsizethreshold_ticketsizethreshold","displayName":"Ticket Size Threshold (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_alwayssendcompoundid","displayName":"Always send compound authentication first","description":"This policy setting controls whether a device always sends a compound authentication request when the resource domain requests compound identity.\r\n\r\nNote: For a domain controller to request compound authentication, the policies \"KDC support for claims, compound authentication, and Kerberos armoring\" and \"Request compound authentication\" must be configured and enabled in the resource account domain. \r\n\r\nIf you enable this policy setting and the resource domain requests compound authentication, devices that support compound authentication always send a compound authentication request. \r\n\r\nIf you disable or do not configure this policy setting and the resource domain requests compound authentication, devices will send a non-compounded authentication request first then a compound authentication request when the service requests compound authentication.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-kerberos#admx-kerberos-alwayssendcompoundid"],"options":[{"id":"device_vendor_msft_policy_config_admx_kerberos_alwayssendcompoundid_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_alwayssendcompoundid_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_kerberos_devicepkinitenabled","displayName":"Support device authentication using certificate","description":"Support for device authentication using certificate will require connectivity to a DC in the device account domain which supports certificate authentication for computer accounts. \r\n\r\nThis policy setting allows you to set support for Kerberos to attempt authentication using the certificate for the device to the domain.\r\n\r\nIf you enable this policy setting, the device’s credentials will be selected based on the following options:\r\n\r\nAutomatic: Device will attempt to authenticate using its certificate. If the DC does not support computer account authentication using certificates then authentication with password will be attempted.\r\n\r\nForce: Device will always authenticate using its certificate. If a DC cannot be found which support computer account authentication using certificates then authentication will fail.\r\n\r\nIf you disable this policy setting, certificates will never be used.\r\nIf you do not configure this policy setting, Automatic will be used.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-kerberos#admx-kerberos-devicepkinitenabled"],"options":[{"id":"device_vendor_msft_policy_config_admx_kerberos_devicepkinitenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_devicepkinitenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_kerberos_devicepkinitenabled_devicepkinitbehavior","displayName":"Device authentication behavior using certificate: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_kerberos_devicepkinitenabled_devicepkinitbehavior_0","displayName":"Automatic","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_devicepkinitenabled_devicepkinitbehavior_1","displayName":"Force","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_kerberos_hosttorealm","displayName":"Define host name-to-Kerberos realm mappings","description":"This policy setting allows you to specify which DNS host names and which DNS suffixes are mapped to a Kerberos realm.\r\n\r\nIf you enable this policy setting, you can view and change the list of DNS host names and DNS suffixes mapped to a Kerberos realm as defined by Group Policy. To view the list of mappings, enable the policy setting and then click the Show button. To add a mapping, enable the policy setting, note the syntax, and then click Show. In the Show Contents dialog box in the Value Name column, type a realm name. In the Value column, type the list of DNS host names and DNS suffixes using the appropriate syntax format. To remove a mapping from the list, click the mapping entry to be removed, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters.\r\n\r\nIf you disable this policy setting, the host name-to-Kerberos realm mappings list defined by Group Policy is deleted.\r\n\r\nIf you do not configure this policy setting, the system uses the host name-to-Kerberos realm mappings that are defined in the local registry, if they exist.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-kerberos#admx-kerberos-hosttorealm"],"options":[{"id":"device_vendor_msft_policy_config_admx_kerberos_hosttorealm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_hosttorealm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_kerberos_hosttorealm_hosttorealm","displayName":"Define host name-to-realm mappings: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_hosttorealm_hosttorealm_key","displayName":"Name","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_hosttorealm_hosttorealm_value","displayName":"Value","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_kdcproxydisableserverrevocationcheck","displayName":"Disable revocation checking for the SSL certificate of KDC proxy servers","description":"This policy setting allows you to disable revocation check for the SSL certificate of the targeted KDC proxy server.\r\n\r\nIf you enable this policy setting, revocation check for the SSL certificate of the KDC proxy server is ignored by the Kerberos client. This policy setting should only be used in troubleshooting KDC proxy connections. \r\nWarning: When revocation check is ignored, the server represented by the certificate is not guaranteed valid. \r\n\r\nIf you disable or do not configure this policy setting, the Kerberos client enforces the revocation check for the SSL certificate. The connection to the KDC proxy server is not established if the revocation check fails.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-kerberos#admx-kerberos-kdcproxydisableserverrevocationcheck"],"options":[{"id":"device_vendor_msft_policy_config_admx_kerberos_kdcproxydisableserverrevocationcheck_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_kdcproxydisableserverrevocationcheck_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_kerberos_kdcproxyserver","displayName":"Specify KDC proxy servers for Kerberos clients","description":"This policy setting configures the Kerberos client's mapping to KDC proxy servers for domains based on their DNS suffix names.\r\n\r\nIf you enable this policy setting, the Kerberos client will use the KDC proxy server for a domain when a domain controller cannot be located based on the configured mappings. To map a KDC proxy server to a domain, enable the policy setting, click Show, and then map the KDC proxy server name(s) to the DNS name for the domain using the syntax described in the options pane. In the Show Contents dialog box in the Value Name column, type a DNS suffix name. In the Value column, type the list of proxy servers using the appropriate syntax format. To view the list of mappings, enable the policy setting and then click the Show button. To remove a mapping from the list, click the mapping entry to be removed, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters.\r\n\r\nIf you disable or do not configure this policy setting, the Kerberos client does not have KDC proxy servers settings defined by Group Policy.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-kerberos#admx-kerberos-kdcproxyserver"],"options":[{"id":"device_vendor_msft_policy_config_admx_kerberos_kdcproxyserver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_kdcproxyserver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_kerberos_kdcproxyserver_kdcproxyserver","displayName":"Define KDC proxy servers settings: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_kdcproxyserver_kdcproxyserver_key","displayName":"Name","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_kdcproxyserver_kdcproxyserver_value","displayName":"Value","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_mitrealms","displayName":"Define interoperable Kerberos V5 realm settings","description":"This policy setting configures the Kerberos client so that it can authenticate with interoperable Kerberos V5 realms, as defined by this policy setting.\r\n \r\nIf you enable this policy setting, you can view and change the list of interoperable Kerberos V5 realms and their settings. To view the list of interoperable Kerberos V5 realms, enable the policy setting and then click the Show button. To add an interoperable Kerberos V5 realm, enable the policy setting, note the syntax, and then click Show. In the Show Contents dialog box in the Value Name column, type the interoperable Kerberos V5 realm name. In the Value column, type the realm flags and host names of the host KDCs using the appropriate syntax format. To remove an interoperable Kerberos V5 realm Value Name or Value entry from the list, click the entry, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters.\r\n\r\nIf you disable this policy setting, the interoperable Kerberos V5 realm settings defined by Group Policy are deleted.\r\n\r\nIf you do not configure this policy setting, the system uses the interoperable Kerberos V5 realm settings that are defined in the local registry, if they exist.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-kerberos#admx-kerberos-mitrealms"],"options":[{"id":"device_vendor_msft_policy_config_admx_kerberos_mitrealms_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_mitrealms_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_kerberos_mitrealms_mitrealms","displayName":"Define interoperable Kerberos V5 realm settings: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_mitrealms_mitrealms_key","displayName":"Name","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_mitrealms_mitrealms_value","displayName":"Value","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_serveracceptscompound","displayName":"Support compound authentication","description":"This policy setting controls configuring the device's Active Directory account for compound authentication.\r\n\r\nSupport for providing compound authentication which is used for access control will require enough domain controllers in the resource account domains to support the requests. The Domain Administrator must configure the policy \"Support Dynamic Access Control and Kerberos armoring\" on all the domain controllers to support this policy.\r\n\r\nIf you enable this policy setting, the device's Active Directory account will be configured for compound authentication by the following options:\r\n\r\nNever: Compound authentication is never provided for this computer account.\r\n\r\nAutomatic: Compound authentication is provided for this computer account when one or more applications are configured for Dynamic Access Control.\r\n\r\nAlways: Compound authentication is always provided for this computer account.\r\n\r\nIf you disable this policy setting, Never will be used.\r\nIf you do not configure this policy setting, Automatic will be used.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-kerberos#admx-kerberos-serveracceptscompound"],"options":[{"id":"device_vendor_msft_policy_config_admx_kerberos_serveracceptscompound_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_serveracceptscompound_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_kerberos_serveracceptscompound_compoundidenabled","displayName":"Support authorization with client device information: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_kerberos_serveracceptscompound_compoundidenabled_0","displayName":"Never","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_serveracceptscompound_compoundidenabled_1","displayName":"Automatic","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_serveracceptscompound_compoundidenabled_2","displayName":"Always","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_kerberos_stricttarget","displayName":"Require strict target SPN match on remote procedure calls","description":" This policy setting allows you to configure this server so that Kerberos can decrypt a ticket that contains this system-generated SPN. When an application attempts to make a remote procedure call (RPC) to this server with a NULL value for the service principal name (SPN), computers running Windows 7 or later attempt to use Kerberos by generating an SPN.\r\n \r\nIf you enable this policy setting, only services running as LocalSystem or NetworkService are allowed to accept these connections. Services running as identities different from LocalSystem or NetworkService might fail to authenticate.\r\n\r\nIf you disable or do not configure this policy setting, any service is allowed to accept incoming connections by using this system-generated SPN.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-kerberos#admx-kerberos-stricttarget"],"options":[{"id":"device_vendor_msft_policy_config_admx_kerberos_stricttarget_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_kerberos_stricttarget_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_ciphersuiteorder","displayName":"Cipher suite order","description":"This policy setting determines the cipher suites used by the SMB server.\r\n\r\nIf you enable this policy setting, cipher suites are prioritized in the order specified.\r\n\r\nIf you enable this policy setting and do not specify at least one supported cipher suite, or if you disable or do not configure this policy setting, the default cipher suite order is used.\r\n\r\nSMB 3.11 cipher suites:\r\n\r\nAES_128_GCM\r\nAES_128_CCM\r\n\r\nSMB 3.0 and 3.02 cipher suites:\r\n\r\nAES_128_CCM\r\n\r\nHow to modify this setting:\r\n\r\nArrange the desired cipher suites in the edit box, one cipher suite per line, in order from most to least preferred, with the most preferred cipher suite at the top. Remove any cipher suites you don't want to use.\r\n\r\nNote: When configuring this security setting, changes will not take effect until you restart Windows.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-lanmanserver#admx-lanmanserver-pol-ciphersuiteorder"],"options":[{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_ciphersuiteorder_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_ciphersuiteorder_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_ciphersuiteorder_multitext_ciphersuiteorder","displayName":"\r\nCipher suites:\r\n","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_hashpublication","displayName":"Hash Publication for BranchCache","description":"This policy setting specifies whether a hash generation service generates hashes, also called content information, for data that is stored in shared folders. This policy setting must be applied to server computers that have the File Services role and both the File Server and the BranchCache for Network Files role services installed.\r\n\r\nPolicy configuration\r\n\r\nSelect one of the following:\r\n\r\n- Not Configured. With this selection, hash publication settings are not applied to file servers. In the circumstance where file servers are domain members but you do not want to enable BranchCache on all file servers, you can specify Not Configured for this domain Group Policy setting, and then configure local machine policy to enable BranchCache on individual file servers. Because the domain Group Policy setting is not configured, it will not over-write the enabled setting that you use on individual servers where you want to enable BranchCache.\r\n\r\n- Enabled. With this selection, hash publication is turned on for all file servers where Group Policy is applied. For example, if Hash Publication for BranchCache is enabled in domain Group Policy, hash publication is turned on for all domain member file servers to which the policy is applied. The file servers are then able to create content information for all content that is stored in BranchCache-enabled file shares.\r\n\r\n- Disabled. With this selection, hash publication is turned off for all file servers where Group Policy is applied.\r\n\r\nIn circumstances where this policy setting is enabled, you can also select the following configuration options:\r\n\r\n- Allow hash publication for all shared folders. With this option, BranchCache generates content information for all content in all shares on the file server. \r\n\r\n- Allow hash publication only for shared folders on which BranchCache is enabled. With this option, content information is generated only for shared folders on which BranchCache is enabled. If you use this setting, you must enable BranchCache for individual shares in Share and Storage Management on the file server.\r\n\r\n- Disallow hash publication on all shared folders. With this option, BranchCache does not generate content information for any shares on the computer and does not send content information to client computers that request content.\r\n \n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-lanmanserver#admx-lanmanserver-pol-hashpublication"],"options":[{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_hashpublication_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_hashpublication_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_hashpublication_lbl_hashpublicationactioncombo","displayName":"Hash publication actions: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_hashpublication_lbl_hashpublicationactioncombo_0","displayName":"Allow hash publication only for shared folders on which BranchCache is enabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_hashpublication_lbl_hashpublicationactioncombo_1","displayName":"Disallow hash publication on all shared folders","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_hashpublication_lbl_hashpublicationactioncombo_2","displayName":"Allow hash publication for all shared folders","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_hashsupportversion","displayName":"Hash Version support for BranchCache","description":"This policy setting specifies whether the BranchCache hash generation service supports version 1 (V1) hashes, version 2 (V2) hashes, or both V1 and V2 hashes. Hashes, also called content information, are created based on the data in shared folders where BranchCache is enabled. \r\n\r\nIf you specify only one version that is supported, content information for that version is the only type that is generated by BranchCache, and it is the only type of content information that can be retrieved by client computers. For example, if you enable support for V1 hashes, BranchCache generates only V1 hashes and client computers can retrieve only V1 hashes.\r\n\r\nPolicy configuration\r\n\r\nSelect one of the following:\r\n\r\n- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy setting. In this circumstance, which is the default, both V1 and V2 hash generation and retrieval are supported.\r\n\r\n- Enabled. With this selection, the policy setting is applied and the hash version(s) that are specified in \"Hash version supported\" are generated and retrieved.\r\n\r\n- Disabled. With this selection, both V1 and V2 hash generation and retrieval are supported.\r\n\r\nIn circumstances where this setting is enabled, you can also select and configure the following option:\r\n\r\nHash version supported:\r\n\r\n- To support V1 content information only, configure \"Hash version supported\" with the value of 1.\r\n\r\n- To support V2 content information only, configure \"Hash version supported\" with the value of 2.\r\n\r\n- To support both V1 and V2 content information, configure \"Hash version supported\" with the value of 3.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-lanmanserver#admx-lanmanserver-pol-hashsupportversion"],"options":[{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_hashsupportversion_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_hashsupportversion_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_hashsupportversion_lbl_hashversionsupportactioncombo","displayName":"Hash version supported: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_hashsupportversion_lbl_hashversionsupportactioncombo_1","displayName":"Supports V1 hash version only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_hashsupportversion_lbl_hashversionsupportactioncombo_2","displayName":"Supports V2 hash version only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_hashsupportversion_lbl_hashversionsupportactioncombo_3","displayName":"Supports V1 as well as V2 versions","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_honorciphersuiteorder","displayName":"Honor cipher suite order","description":"This policy setting determines how the SMB server selects a cipher suite when negotiating a new connection with an SMB client.\r\n\r\nIf you enable this policy setting, the SMB server will select the cipher suite it most prefers from the list of client-supported cipher suites, ignoring the client's preferences.\r\n\r\nIf you disable or do not configure this policy setting, the SMB server will select the cipher suite the client most prefers from the list of server-supported cipher suites.\r\n\r\nNote: When configuring this security setting, changes will not take effect until you restart Windows.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-lanmanserver#admx-lanmanserver-pol-honorciphersuiteorder"],"options":[{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_honorciphersuiteorder_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_lanmanserver_pol_honorciphersuiteorder_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_lanmanworkstation_pol_ciphersuiteorder","displayName":"Cipher suite order","description":"This policy setting determines the cipher suites used by the SMB client.\r\n\r\nIf you enable this policy setting, cipher suites are prioritized in the order specified.\r\n\r\nIf you enable this policy setting and do not specify at least one supported cipher suite, or if you disable or do not configure this policy setting, the default cipher suite order is used.\r\n\r\nSMB 3.11 cipher suites:\r\n\r\nAES_128_GCM\r\nAES_128_CCM\r\n\r\nSMB 3.0 and 3.02 cipher suites:\r\n\r\nAES_128_CCM\r\n\r\nHow to modify this setting:\r\n\r\nArrange the desired cipher suites in the edit box, one cipher suite per line, in order from most to least preferred, with the most preferred cipher suite at the top. Remove any cipher suites you don't want to use.\r\n\r\nNote: When configuring this security setting, changes will not take effect until you restart Windows.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-lanmanworkstation#admx-lanmanworkstation-pol-ciphersuiteorder"],"options":[{"id":"device_vendor_msft_policy_config_admx_lanmanworkstation_pol_ciphersuiteorder_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_lanmanworkstation_pol_ciphersuiteorder_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_lanmanworkstation_pol_ciphersuiteorder_multitext_ciphersuiteorder","displayName":"\r\nCipher suites:\r\n","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_lanmanworkstation_pol_enablehandlecachingforcafiles","displayName":"Handle Caching on Continuous Availability Shares","description":"\r\n This policy setting determines the behavior of SMB handle caching for clients connecting to an SMB share where the Continuous Availability (CA) flag is enabled.\r\n\r\n If you enable this policy setting, the SMB client will allow cached handles to files on CA shares. This may lead to better performance when repeatedly accessing a large number of unstructured data files on CA shares running in Microsoft Azure Files.\r\n\r\n If you disable or do not configure this policy setting, Windows will prevent use of cached handles to files opened through CA shares.\r\n\r\n Note: This policy has no effect when connecting Scale-out File Server shares provided by a Windows Server. Microsoft does not recommend enabling this policy for clients that routinely connect to files hosted on a Windows Failover Cluster with the File Server for General Use role, as it can lead to adverse failover times and increased memory and CPU usage.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-lanmanworkstation#admx-lanmanworkstation-pol-enablehandlecachingforcafiles"],"options":[{"id":"device_vendor_msft_policy_config_admx_lanmanworkstation_pol_enablehandlecachingforcafiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_lanmanworkstation_pol_enablehandlecachingforcafiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_lanmanworkstation_pol_enableofflinefilesforcashares","displayName":"Offline Files Availability on Continuous Availability Shares","description":"\r\n This policy setting determines the behavior of Offline Files on clients connecting to an SMB share where the Continuous Availability (CA) flag is enabled.\r\n\r\n If you enable this policy setting, the \"Always Available offline\" option will appear in the File Explorer menu on a Windows computer when connecting to a CA-enabled share. Pinning of files on CA-enabled shares using client-side caching will also be possible.\r\n\r\n If you disable or do not configure this policy setting, Windows will prevent use of Offline Files with CA-enabled shares.\r\n\r\n Note: Microsoft does not recommend enabling this group policy. Use of CA with Offline Files will lead to very long transition times between the online and offline states.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-lanmanworkstation#admx-lanmanworkstation-pol-enableofflinefilesforcashares"],"options":[{"id":"device_vendor_msft_policy_config_admx_lanmanworkstation_pol_enableofflinefilesforcashares_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_lanmanworkstation_pol_enableofflinefilesforcashares_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_leakdiagnostic_wdiscenarioexecutionpolicy","displayName":"Configure Scenario Execution Level","description":"This policy setting determines whether Diagnostic Policy Service (DPS) diagnoses memory leak problems.\r\n\r\nIf you enable or do not configure this policy setting, the DPS enables Windows Memory Leak Diagnosis by default.\r\n\r\nIf you disable this policy setting, the DPS is not able to diagnose memory leak problems.\r\n\r\nThis policy setting takes effect only under the following conditions: \r\n-- If the diagnostics-wide scenario execution policy is not configured. \r\n-- When the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios are not executed.\r\n\r\nNote: The DPS can be configured with the Services snap-in to the Microsoft Management Console.\r\n\r\nNo operating system restart or service restart is required for this policy to take effect. Changes take effect immediately.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-leakdiagnostic#admx-leakdiagnostic-wdiscenarioexecutionpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_leakdiagnostic_wdiscenarioexecutionpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_leakdiagnostic_wdiscenarioexecutionpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablelltdio","displayName":"Turn on Mapper I/O (LLTDIO) driver","description":"This policy setting changes the operational behavior of the Mapper I/O network protocol driver.\r\n\r\nLLTDIO allows a computer to discover the topology of a network it's connected to. It also allows a computer to initiate Quality-of-Service requests such as bandwidth estimation and network health analysis.\r\n\r\nIf you enable this policy setting, additional options are available to fine-tune your selection. You may choose the \"Allow operation while in domain\" option to allow LLTDIO to operate on a network interface that's connected to a managed network. On the other hand, if a network interface is connected to an unmanaged network, you may choose the \"Allow operation while in public network\" and \"Prohibit operation while in private network\" options instead.\r\n\r\nIf you disable or do not configure this policy setting, the default behavior of LLTDIO will apply.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery#admx-linklayertopologydiscovery-lltd-enablelltdio"],"options":[{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablelltdio_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablelltdio_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablelltdio_lltd_enablelltdio_allowondomain","displayName":"Allow operation while in domain (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablelltdio_lltd_enablelltdio_allowondomain_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablelltdio_lltd_enablelltdio_allowondomain_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablelltdio_lltd_enablelltdio_allowonpublicnet","displayName":"Allow operation while in public network (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablelltdio_lltd_enablelltdio_allowonpublicnet_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablelltdio_lltd_enablelltdio_allowonpublicnet_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablelltdio_lltd_enablelltdio_prohibitonprivatenet","displayName":"Prohibit operation while in private network (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablelltdio_lltd_enablelltdio_prohibitonprivatenet_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablelltdio_lltd_enablelltdio_prohibitonprivatenet_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablerspndr","displayName":"Turn on Responder (RSPNDR) driver","description":"This policy setting changes the operational behavior of the Responder network protocol driver.\r\n\r\nThe Responder allows a computer to participate in Link Layer Topology Discovery requests so that it can be discovered and located on the network. It also allows a computer to participate in Quality-of-Service activities such as bandwidth estimation and network health analysis.\r\n\r\nIf you enable this policy setting, additional options are available to fine-tune your selection. You may choose the \"Allow operation while in domain\" option to allow the Responder to operate on a network interface that's connected to a managed network. On the other hand, if a network interface is connected to an unmanaged network, you may choose the \"Allow operation while in public network\" and \"Prohibit operation while in private network\" options instead.\r\n\r\nIf you disable or do not configure this policy setting, the default behavior for the Responder will apply.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery#admx-linklayertopologydiscovery-lltd-enablerspndr"],"options":[{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablerspndr_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablerspndr_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablerspndr_lltd_enablerspndr_allowondomain","displayName":"Allow operation while in domain (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablerspndr_lltd_enablerspndr_allowondomain_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablerspndr_lltd_enablerspndr_allowondomain_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablerspndr_lltd_enablerspndr_allowonpublicnet","displayName":"Allow operation while in public network (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablerspndr_lltd_enablerspndr_allowonpublicnet_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablerspndr_lltd_enablerspndr_allowonpublicnet_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablerspndr_lltd_enablerspndr_prohibitonprivatenet","displayName":"Prohibit operation while in private network (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablerspndr_lltd_enablerspndr_prohibitonprivatenet_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_linklayertopologydiscovery_lltd_enablerspndr_lltd_enablerspndr_prohibitonprivatenet_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_locationprovideradm_disablewindowslocationprovider_1","displayName":"Turn off Windows Location Provider","description":"\r\n This policy setting turns off the Windows Location Provider feature for this computer.\r\n\r\n If you enable this policy setting, the Windows Location Provider feature will be turned off, and all programs on this computer will not be able to use the Windows Location Provider feature.\r\n\r\n If you disable or do not configure this policy setting, all programs on this computer can use the Windows Location Provider feature.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-locationprovideradm#admx-locationprovideradm-disablewindowslocationprovider-1"],"options":[{"id":"device_vendor_msft_policy_config_admx_locationprovideradm_disablewindowslocationprovider_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_locationprovideradm_disablewindowslocationprovider_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_logon_blockuserfromshowingaccountdetailsonsignin","displayName":"Block user from showing account details on sign-in","description":"This policy prevents the user from showing account details (email address or user name) on the sign-in screen.\r\n\r\nIf you enable this policy setting, the user cannot choose to show account details on the sign-in screen.\r\n\r\nIf you disable or do not configure this policy setting, the user may choose to show account details on the sign-in screen.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-logon#admx-logon-blockuserfromshowingaccountdetailsonsignin"],"options":[{"id":"device_vendor_msft_policy_config_admx_logon_blockuserfromshowingaccountdetailsonsignin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_logon_blockuserfromshowingaccountdetailsonsignin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_logon_disableacrylicbackgroundonlogon","displayName":"Show clear logon background","description":"This policy setting disables the acrylic blur effect on logon background image.\r\n\r\n If you enable this policy, the logon background image shows without blur.\r\n If you disable or do not configure this policy, the logon background image adopts the acrylic blur effect.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-logon#admx-logon-disableacrylicbackgroundonlogon"],"options":[{"id":"device_vendor_msft_policy_config_admx_logon_disableacrylicbackgroundonlogon_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_logon_disableacrylicbackgroundonlogon_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_logon_disableexplorerrunlegacy_2","displayName":"Do not process the legacy run list","description":"This policy setting ignores the customized run list.\r\n\r\nYou can create a customized list of additional programs and documents that the system starts automatically when it runs on Windows Vista, Windows XP Professional, and Windows 2000 Professional. These programs are added to the standard run list of programs and services that the system starts.\r\n\r\nIf you enable this policy setting, the system ignores the run list for Windows Vista, Windows XP Professional, and Windows 2000 Professional.\r\n\r\nIf you disable or do not configure this policy setting, Windows Vista adds any customized run list configured to its run list.\r\n\r\nThis policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration.\r\n\r\nNote: To create a customized run list by using a policy setting, use the \"Run these applications at startup\" policy setting.\r\n\r\nAlso, see the \"Do not process the run once list\" policy setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-logon#admx-logon-disableexplorerrunlegacy-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_logon_disableexplorerrunlegacy_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_logon_disableexplorerrunlegacy_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_logon_disableexplorerrunoncelegacy_2","displayName":"Do not process the run once list","description":"This policy setting ignores customized run-once lists.\r\n\r\nYou can create a customized list of additional programs and documents that are started automatically the next time the system starts (but not thereafter). These programs are added to the standard list of programs and services that the system starts.\r\n\r\nIf you enable this policy setting, the system ignores the run-once list.\r\n\r\nIf you disable or do not configure this policy setting, the system runs the programs in the run-once list.\r\n\r\nThis policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration.\r\n\r\nNote: Customized run-once lists are stored in the registry in HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce.\r\n\r\nAlso, see the \"Do not process the legacy run list\" policy setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-logon#admx-logon-disableexplorerrunoncelegacy-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_logon_disableexplorerrunoncelegacy_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_logon_disableexplorerrunoncelegacy_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_logon_disablestatusmessages","displayName":"Remove Boot / Shutdown / Logon / Logoff status messages","description":"This policy setting suppresses system status messages.\r\n\r\nIf you enable this setting, the system does not display a message reminding users to wait while their system starts or shuts down, or while users log on or off.\r\n\r\nIf you disable or do not configure this policy setting, the system displays the message reminding users to wait while their system starts or shuts down, or while users log on or off.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-logon#admx-logon-disablestatusmessages"],"options":[{"id":"device_vendor_msft_policy_config_admx_logon_disablestatusmessages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_logon_disablestatusmessages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_logon_dontenumerateconnectedusers","displayName":"Do not enumerate connected users on domain-joined computers","description":"This policy setting prevents connected users from being enumerated on domain-joined computers. \r\n\r\nIf you enable this policy setting, the Logon UI will not enumerate any connected users on domain-joined computers.\r\n\r\nIf you disable or do not configure this policy setting, connected users will be enumerated on domain-joined computers.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-logon#admx-logon-dontenumerateconnectedusers"],"options":[{"id":"device_vendor_msft_policy_config_admx_logon_dontenumerateconnectedusers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_logon_dontenumerateconnectedusers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_logon_nowelcometips_2","displayName":"Do not display the Getting Started welcome screen at logon","description":"This policy setting hides the welcome screen that is displayed on Windows 2000 Professional each time the user logs on.\r\n\r\nIf you enable this policy setting, the welcome screen is hidden from the user logging on to a computer where this policy is applied.\r\n\r\nUsers can still display the welcome screen by selecting it on the Start menu or by typing \"Welcome\" in the Run dialog box.\r\n\r\nIf you disable or do not configure this policy, the welcome screen is displayed each time a user logs on to the computer.\r\n\r\nThis setting applies only to Windows 2000 Professional. It does not affect the \"Configure Your Server on a Windows 2000 Server\" screen on Windows 2000 Server.\r\n\r\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\r\n\r\nTip: To display the welcome screen, click Start, point to Programs, point to Accessories, point to System Tools, and then click \"Getting Started.\" To suppress the welcome screen without specifying a setting, clear the \"Show this screen at startup\" check box on the welcome screen.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-logon#admx-logon-nowelcometips-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_logon_nowelcometips_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_logon_nowelcometips_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_logon_run_2","displayName":"Run these programs at user logon","description":"This policy setting specifies additional programs or documents that Windows starts automatically when a user logs on to the system.\r\n\r\nIf you enable this policy setting, you can specify which programs can run at the time the user logs on to this computer that has this policy applied.\r\n\r\nTo specify values for this policy setting, click Show. In the Show Contents dialog box in the Value column, type the name of the executable program (.exe) file or document file. To specify another name, press ENTER, and type the name. Unless the file is located in the %Systemroot% directory, you must specify the fully qualified path to the file.\r\n\r\nIf you disable or do not configure this policy setting, the user will have to start the appropriate programs after logon.\r\n\r\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the system starts the programs specified in the Computer Configuration setting just before it starts the programs specified in the User Configuration setting.\r\n\r\nAlso, see the \"Do not process the legacy run list\" and the \"Do not process the run once list\" settings.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-logon#admx-logon-run-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_logon_run_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_logon_run_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_logon_run_2_runlistbox2","displayName":"Items to run at logon (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_logon_syncforegroundpolicy","displayName":"Always wait for the network at computer startup and logon","description":"This policy setting determines whether Group Policy processing is synchronous (that is, whether computers wait for the network to be fully initialized during computer startup and user logon). By default, on client computers, Group Policy processing is not synchronous; client computers typically do not wait for the network to be fully initialized at startup and logon. Existing users are logged on using cached credentials, which results in shorter logon times. Group Policy is applied in the background after the network becomes available. \r\n\r\nNote that because this is a background refresh, extensions such as Software Installation and Folder Redirection take two logons to apply changes. To be able to operate safely, these extensions require that no users be logged on. Therefore, they must be processed in the foreground before users are actively using the computer. In addition, changes that are made to the user object, such as adding a roaming profile path, home directory, or user object logon script, may take up to two logons to be detected.\r\n\r\nIf a user with a roaming profile, home directory, or user object logon script logs on to a computer, computers always wait for the network to be initialized before logging the user on. If a user has never logged on to this computer before, computers always wait for the network to be initialized.\r\n\r\nIf you enable this policy setting, computers wait for the network to be fully initialized before users are logged on. Group Policy is applied in the foreground, synchronously. \r\n\r\nOn servers running Windows Server 2008 or later, this policy setting is ignored during Group Policy processing at computer startup and Group Policy processing will be synchronous (these servers wait for the network to be initialized during computer startup). \r\n\r\nIf the server is configured as follows, this policy setting takes effect during Group Policy processing at user logon:\r\n• The server is configured as a terminal server (that is, the Terminal Server role service is installed and configured on the server); and\r\n• The “Allow asynchronous user Group Policy processing when logging on through Terminal Services” policy setting is enabled. This policy setting is located under Computer Configuration\\Policies\\Administrative templates\\System\\Group Policy\\.\r\n\r\nIf this configuration is not implemented on the server, this policy setting is ignored. In this case, Group Policy processing at user logon is synchronous (these servers wait for the network to be initialized during user logon).\r\n\r\nIf you disable or do not configure this policy setting and users log on to a client computer or a server running Windows Server 2008 or later and that is configured as described earlier, the computer typically does not wait for the network to be fully initialized. In this case, users are logged on with cached credentials. Group Policy is applied asynchronously in the background.\r\n\r\nNotes: \r\n-If you want to guarantee the application of Folder Redirection, Software Installation, or roaming user profile settings in just one logon, enable this policy setting to ensure that Windows waits for the network to be available before applying policy. \r\n-If Folder Redirection policy will apply during the next logon, security policies will be applied asynchronously during the next update cycle, if network connectivity is available.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-logon#admx-logon-syncforegroundpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_logon_syncforegroundpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_logon_syncforegroundpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_logon_useoembackground","displayName":"Always use custom logon background","description":"This policy setting ignores Windows Logon Background.\r\n\r\nThis policy setting may be used to make Windows give preference to a custom logon background. \r\n\r\nIf you enable this policy setting, the logon screen always attempts to load a custom background instead of the Windows-branded logon background. \r\n\r\nIf you disable or do not configure this policy setting, Windows uses the default Windows logon background or custom background.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-logon#admx-logon-useoembackground"],"options":[{"id":"device_vendor_msft_policy_config_admx_logon_useoembackground_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_logon_useoembackground_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_logon_verbosestatus","displayName":"Display highly detailed status messages","description":"This policy setting directs the system to display highly detailed status messages.\r\n\r\nThis policy setting is designed for advanced users who require this information.\r\n\r\nIf you enable this policy setting, the system displays status messages that reflect each step in the process of starting, shutting down, logging on, or logging off the system.\r\n\r\nIf you disable or do not configure this policy setting, only the default status messages are displayed to the user during these processes.\r\n\r\nNote: This policy setting is ignored if the \"Remove Boot/Shutdown/Logon/Logoff status messages\" policy setting is enabled.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-logon#admx-logon-verbosestatus"],"options":[{"id":"device_vendor_msft_policy_config_admx_logon_verbosestatus_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_logon_verbosestatus_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_allowfastservicestartup","displayName":"Allow antimalware service to startup with normal priority","description":"This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance.\r\n\r\n If you enable or do not configure this setting, the antimalware service will load as a normal priority task.\r\n\r\n If you disable this setting, the antimalware service will load as a low priority task.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-allowfastservicestartup"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_allowfastservicestartup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_allowfastservicestartup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_disableantispywaredefender","displayName":"Turn off Microsoft Defender Antivirus","description":"This policy setting turns off Microsoft Defender Antivirus.\r\n \r\n If you enable this policy setting, Microsoft Defender Antivirus does not run, and will not scan computers for malware or other potentially unwanted software.\r\n\r\n If you disable this policy setting, Microsoft Defender Antivirus will run regardless of any other installed antivirus product.\r\n\r\n If you do not configure this policy setting, Windows will internally manage Microsoft Defender Antivirus. If you install another antivirus program, Windows automatically disables Microsoft Defender Antivirus. Otherwise, Microsoft Defender Antivirus will scan your computers for malware and other potentially unwanted software.\r\n\r\n Enabling or disabling this policy may lead to unexpected or unsupported behavior. It is recommended that you leave this policy setting unconfigured.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-disableantispywaredefender"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_disableantispywaredefender_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_disableantispywaredefender_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_disableautoexclusions","displayName":"Turn off Auto Exclusions","description":"\r\n Allows an administrator to specify if Automatic Exclusions feature for Server SKUs should be turned off.\r\n\r\n Disabled (Default):\r\n Microsoft Defender will exclude pre-defined list of paths from the scan to improve performance.\r\n\r\n Enabled:\r\n Microsoft Defender will not exclude pre-defined list of paths from scans. This can impact machine performance in some scenarios.\r\n\r\n Not configured:\r\n Same as Disabled.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-disableautoexclusions"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_disableautoexclusions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_disableautoexclusions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_disableblockatfirstseen","displayName":"Configure the 'Block at First Sight' feature","description":"This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device.\r\n Enabled – The Block at First Sight setting is turned on.\r\n Disabled – The Block at First Sight setting is turned off.\r\n \r\n This feature requires these Group Policy settings to be set as follows:\r\n MAPS -> The “Join Microsoft MAPS” must be enabled or the “Block at First Sight” feature will not function.\r\n MAPS -> The “Send file samples when further analysis is required” should be set to 1 (Send safe samples) or 3 (Send all samples). Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the “Block at First Sight” feature will not function.\r\n Real-time Protection -> The “Scan all downloaded files and attachments” policy must be enabled or the “Block at First Sight” feature will not function.\r\n Real-time Protection -> Do not enable the “Turn off real-time protection” policy or the “Block at First Sight” feature will not function.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-disableblockatfirstseen"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_disableblockatfirstseen_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_disableblockatfirstseen_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_disablelocaladminmerge","displayName":"Configure local administrator merge behavior for lists","description":"This policy setting controls whether or not complex list settings configured by a local administrator are merged with Group Policy settings. This setting applies to lists such as threats and Exclusions.\r\n\r\n If you disable or do not configure this setting, unique items defined in Group Policy and in preference settings configured by the local administrator will be merged into the resulting effective policy. In the case of conflicts, Group policy Settings will override preference settings.\r\n\r\n If you enable this setting, only items defined by Group Policy will be used in the resulting effective policy. Group Policy settings will override preference settings configured by the local administrator.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-disablelocaladminmerge"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_disablelocaladminmerge_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_disablelocaladminmerge_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_disablerealtimemonitoring","displayName":"Turn off real-time protection","description":"This policy setting turns off real-time protection prompts for known malware detection.\r\n\r\n Microsoft Defender Antivirus alerts you when malware or potentially unwanted software attempts to install itself or to run on your computer.\r\n\r\n If you enable this policy setting, Microsoft Defender Antivirus will not prompt users to take actions on malware detections.\r\n\r\n If you disable or do not configure this policy setting, Microsoft Defender Antivirus will prompt users to take actions on malware detections.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-disablerealtimemonitoring"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_disablerealtimemonitoring_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_disablerealtimemonitoring_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_disableroutinelytakingaction","displayName":"Turn off routine remediation","description":"\r\n This policy setting allows you to configure whether Microsoft Defender Antivirus automatically takes action on all detected threats. The action to be taken on a particular threat is determined by the combination of the policy-defined action, user-defined action, and the signature-defined action.\r\n\r\n If you enable this policy setting, Microsoft Defender Antivirus does not automatically take action on the detected threats, but prompts users to choose from the actions available for each threat.\r\n\r\n If you disable or do not configure this policy setting, Microsoft Defender Antivirus automatically takes action on all detected threats after a nonconfigurable delay of approximately five seconds.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-disableroutinelytakingaction"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_disableroutinelytakingaction_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_disableroutinelytakingaction_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exclusions_extensions","displayName":"Extension Exclusions","description":"This policy setting allows you specify a list of file types that should be excluded from scheduled, custom, and real-time scanning. File types should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the file type extension (such as \"obj\" or \"lib\"). The value is not used and it is recommended that this be set to 0.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-exclusions-extensions"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exclusions_extensions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exclusions_extensions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exclusions_extensions_exclusions_extensionslist","displayName":"Extension Exclusions (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exclusions_extensions_exclusions_extensionslist_key","displayName":"Name","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exclusions_extensions_exclusions_extensionslist_value","displayName":"Value","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exclusions_paths","displayName":"Path Exclusions","description":"This policy setting allows you to disable scheduled and real-time scanning for files under the paths specified or for the fully qualified resources specified. Paths should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a path or a fully qualified resource name. As an example, a path might be defined as: \"c:\\Windows\" to exclude all files in this directory. A fully qualified resource name might be defined as: \"C:\\Windows\\App.exe\". The value is not used and it is recommended that this be set to 0.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-exclusions-paths"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exclusions_paths_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exclusions_paths_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exclusions_paths_exclusions_pathslist","displayName":"Path Exclusions (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exclusions_paths_exclusions_pathslist_key","displayName":"Name","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exclusions_paths_exclusions_pathslist_value","displayName":"Value","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exclusions_processes","displayName":"Process Exclusions","description":"This policy setting allows you to disable real-time scanning for any file opened by any of the specified processes. This policy does not apply to scheduled scans. The process itself will not be excluded. To exclude the process, use the Path exclusion. Processes should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the path to the process image. Note that only executables can be excluded. For example, a process might be defined as: \"c:\\windows\\app.exe\". The value is not used and it is recommended that this be set to 0.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-exclusions-processes"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exclusions_processes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exclusions_processes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exclusions_processes_exclusions_processeslist","displayName":"Process Exclusions (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exclusions_processes_exclusions_processeslist_key","displayName":"Name","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exclusions_processes_exclusions_processeslist_value","displayName":"Value","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_asr_asronlyexclusions","displayName":"Exclude files and paths from Attack Surface Reduction Rules","description":"\r\n Exclude files and paths from Attack Surface Reduction (ASR) rules.\r\n\r\n Enabled:\r\n Specify the folders or files and resources that should be excluded from ASR rules in the Options section.\r\n Enter each rule on a new line as a name-value pair:\r\n - Name column: Enter a folder path or a fully qualified resource name. For example, \"C:\\Windows\" will exclude all files in that directory. \"C:\\Windows\\App.exe\" will exclude only that specific file in that specific folder\r\n - Value column: Enter \"0\" for each item\r\n\r\n Disabled:\r\n No exclusions will be applied to the ASR rules.\r\n\r\n Not configured:\r\n Same as Disabled.\r\n\r\n You can configure ASR rules in the Configure Attack Surface Reduction rules GP setting.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-exploitguard-asr-asronlyexclusions"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_asr_asronlyexclusions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_asr_asronlyexclusions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_asr_asronlyexclusions_exploitguard_asr_asronlyexclusions","displayName":"Exclusions from ASR rules: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_asr_asronlyexclusions_exploitguard_asr_asronlyexclusions_key","displayName":"Name","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_asr_asronlyexclusions_exploitguard_asr_asronlyexclusions_value","displayName":"Value","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_asr_rules","displayName":"Configure Attack Surface Reduction rules","description":"\r\n Set the state for each Attack Surface Reduction (ASR) rule.\r\n\r\n After enabling this setting, you can set each rule to the following in the Options section:\r\n - Block: the rule will be applied\r\n - Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied)\r\n - Off: the rule will not be applied\r\n - Not Configured: the rule is enabled with default values\r\n - Warn: the rule will be applied and the end-user will have the option to bypass the block\r\n\r\n Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules will the value of not configured.\r\n\r\n Enabled:\r\n Specify the state for each ASR rule under the Options section for this setting.\r\n Enter each rule on a new line as a name-value pair:\r\n - Name column: Enter a valid ASR rule ID\r\n - Value column: Enter the status ID that relates to state you want to specify for the associated rule\r\n\r\n The following status IDs are permitted under the value column:\r\n - 1 (Block)\r\n - 0 (Off)\r\n - 2 (Audit)\r\n - 5 (Not Configured)\r\n - 6 (Warn)\r\n\r\n \r\n Example:\r\n xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 0\r\n xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 1\r\n xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 2\r\n\r\n Disabled:\r\n No ASR rules will be configured.\r\n\r\n Not configured:\r\n Same as Disabled.\r\n\r\n You can exclude folders or files in the \"Exclude files and paths from Attack Surface Reduction Rules\" GP setting.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-exploitguard-asr-rules"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_asr_rules_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_asr_rules_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_asr_rules_exploitguard_asr_rules","displayName":"Set the state for each ASR rule: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_asr_rules_exploitguard_asr_rules_key","displayName":"Name","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_asr_rules_exploitguard_asr_rules_value","displayName":"Value","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_controlledfolderaccess_allowedapplications","displayName":"Configure allowed applications","description":"\r\n Add additional applications that should be considered \"trusted\" by controlled folder access.\r\n\r\n These applications are allowed to modify or delete files in controlled folder access folders.\r\n\r\n Microsoft Defender Antivirus automatically determines which applications should be trusted. You can configure this setting to add additional applications.\r\n\r\n Enabled: \r\n Specify additional allowed applications in the Options section..\r\n\r\n Disabled:\r\n No additional applications will be added to the trusted list.\r\n\r\n Not configured:\r\n Same as Disabled.\r\n\r\n You can enable controlled folder access in the Configure controlled folder access GP setting.\r\n\r\n Default system folders are automatically guarded, but you can add folders in the configure protected folders GP setting.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-exploitguard-controlledfolderaccess-allowedapplications"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_controlledfolderaccess_allowedapplications_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_controlledfolderaccess_allowedapplications_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_controlledfolderaccess_allowedapplications_exploitguard_controlledfolderaccess_allowedapplications","displayName":"Enter the applications that should be trusted: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_controlledfolderaccess_allowedapplications_exploitguard_controlledfolderaccess_allowedapplications_key","displayName":"Name","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_controlledfolderaccess_allowedapplications_exploitguard_controlledfolderaccess_allowedapplications_value","displayName":"Value","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_controlledfolderaccess_protectedfolders","displayName":"Configure protected folders","description":"\r\n Specify additional folders that should be guarded by the Controlled folder access feature.\r\n\r\n Files in these folders cannot be modified or deleted by untrusted applications.\r\n\r\n Default system folders are automatically protected. You can configure this setting to add additional folders. \r\n The list of default system folders that are protected is shown in Windows Security.\r\n\r\n Enabled:\r\n Specify additional folders that should be protected in the Options section.\r\n\r\n Disabled:\r\n No additional folders will be protected.\r\n\r\n Not configured:\r\n Same as Disabled.\r\n\r\n You can enable controlled folder access in the Configure controlled folder access GP setting.\r\n\r\n Microsoft Defender Antivirus automatically determines which applications can be trusted. You can add additional trusted applications in the Configure allowed applications GP setting.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-exploitguard-controlledfolderaccess-protectedfolders"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_controlledfolderaccess_protectedfolders_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_controlledfolderaccess_protectedfolders_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_controlledfolderaccess_protectedfolders_exploitguard_controlledfolderaccess_protectedfolders","displayName":"Enter the folders that should be guarded: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_controlledfolderaccess_protectedfolders_exploitguard_controlledfolderaccess_protectedfolders_key","displayName":"Name","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_exploitguard_controlledfolderaccess_protectedfolders_exploitguard_controlledfolderaccess_protectedfolders_value","displayName":"Value","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_mpengine_enablefilehashcomputation","displayName":"Enable file hash computation feature","description":"\r\n Enable or disable file hash computation feature.\r\n\r\n Enabled:\r\n When this feature is enabled Microsoft Defender will compute hash value for files it scans.\r\n\r\n Disabled:\r\n File hash value is not computed\r\n \r\n Not configured:\r\n Same as Disabled.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-mpengine-enablefilehashcomputation"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_mpengine_enablefilehashcomputation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_mpengine_enablefilehashcomputation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_nis_consumers_ips_disablesignatureretirement","displayName":"Turn on definition retirement","description":"This policy setting allows you to configure definition retirement for network protection against exploits of known vulnerabilities. Definition retirement checks to see if a computer has the required security updates necessary to protect it against a particular vulnerability. If the system is not vulnerable to the exploit detected by a definition, then that definition is \"retired\". If all security intelligence for a given protocal are retired then that protocol is no longer parsed. Enabling this feature helps to improve performance. On a computer that is up-to-date with all the latest security updates, network protection will have no impact on network performance.\r\n\r\n If you enable or do not configure this setting, definition retirement will be enabled.\r\n\r\n If you disable this setting, definition retirement will be disabled.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-nis-consumers-ips-disablesignatureretirement"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_nis_consumers_ips_disablesignatureretirement_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_nis_consumers_ips_disablesignatureretirement_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_nis_consumers_ips_sku_differentiation_signature_set_guid","displayName":"Specify additional definition sets for network traffic inspection","description":"This policy setting defines additional definition sets to enable for network traffic inspection. Definition set GUIDs should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a definition set GUID. As an example, the definition set GUID to enable test security intelligence is defined as: “{b54b6ac9-a737-498e-9120-6616ad3bf590}”. The value is not used and it is recommended that this be set to 0.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-nis-consumers-ips-sku-differentiation-signature-set-guid"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_nis_consumers_ips_sku_differentiation_signature_set_guid_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_nis_consumers_ips_sku_differentiation_signature_set_guid_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_nis_consumers_ips_sku_differentiation_signature_set_guid_nis_consumers_ips_sku_differentiation_signature_set_guidlist","displayName":"Specify additional definition sets for network traffic inspection (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_nis_consumers_ips_sku_differentiation_signature_set_guid_nis_consumers_ips_sku_differentiation_signature_set_guidlist_key","displayName":"Name","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_nis_consumers_ips_sku_differentiation_signature_set_guid_nis_consumers_ips_sku_differentiation_signature_set_guidlist_value","displayName":"Value","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_nis_disableprotocolrecognition","displayName":"Turn on protocol recognition","description":"This policy setting allows you to configure protocol recognition for network protection against exploits of known vulnerabilities.\r\n\r\n If you enable or do not configure this setting, protocol recognition will be enabled.\r\n\r\n If you disable this setting, protocol recognition will be disabled.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-nis-disableprotocolrecognition"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_nis_disableprotocolrecognition_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_nis_disableprotocolrecognition_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_proxybypass","displayName":"Define addresses to bypass proxy server","description":"This policy, if defined, will prevent antimalware from using the configured proxy server when communicating with the specified IP addresses. The address value should be entered as a valid URL.\r\n\r\n If you enable this setting, the proxy server will be bypassed for the specified addresses.\r\n\r\n If you disable or do not configure this setting, the proxy server will not be bypassed for the specified addresses.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-proxybypass"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_proxybypass_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_proxybypass_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_proxybypass_proxybypass","displayName":"Define addresses to bypass proxy server (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_proxypacurl","displayName":"Define proxy auto-config (.pac) for connecting to the network","description":"This policy setting defines the URL of a proxy .pac file that should be used when the client attempts to connect the network for security intelligence updates and MAPS reporting. If the proxy auto-config fails or if there is no proxy auto-config specified, the client will fall back to the alternative options (in order):\r\n 1. Proxy server (if specified)\r\n 2. Proxy .pac URL (if specified)\r\n 3. None\r\n 4. Internet Explorer proxy settings\r\n 5. Autodetect\r\n\r\n If you enable this setting, the proxy setting will be set to use the specified proxy .pac according to the order specified above.\r\n\r\n If you disable or do not configure this setting, the proxy will skip over this fallback step according to the order specified above.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-proxypacurl"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_proxypacurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_proxypacurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_proxypacurl_proxypacurl","displayName":"Define proxy auto-config (.pac) for connecting to the network (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_proxyserver","displayName":"Define proxy server for connecting to the network","description":"This policy setting allows you to configure the named proxy that should be used when the client attempts to connect to the network for security intelligence updates and MAPS reporting. If the named proxy fails or if there is no proxy specified, the client will fall back to the alternative options (in order):\r\n 1. Proxy server (if specified)\r\n 2. Proxy .pac URL (if specified)\r\n 3. None\r\n 4. Internet Explorer proxy settings\r\n 5. Autodetect\r\n\r\n If you enable this setting, the proxy will be set to the specified URL according to the order specified above. The URL should be proceeded with either http:// or https://.\r\n\r\n If you disable or do not configure this setting, the proxy will skip over this fallback step according to the order specified above.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-proxyserver"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_proxyserver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_proxyserver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_proxyserver_proxyserver","displayName":"Define proxy server for connecting to the network (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_quarantine_localsettingoverridepurgeitemsafterdelay","displayName":"Configure local setting override for the removal of items from Quarantine folder","description":"This policy setting configures a local override for the configuration of the number of days items should be kept in the Quarantine folder before being removed. This setting can only be set by Group Policy.\r\n\r\n If you enable this setting, the local preference setting will take priority over Group Policy.\r\n\r\n If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-quarantine-localsettingoverridepurgeitemsafterdelay"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_quarantine_localsettingoverridepurgeitemsafterdelay_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_quarantine_localsettingoverridepurgeitemsafterdelay_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_quarantine_purgeitemsafterdelay","displayName":"Configure removal of items from Quarantine folder","description":"This policy setting defines the number of days items should be kept in the Quarantine folder before being removed.\r\n\r\n If you enable this setting, items will be removed from the Quarantine folder after the number of days specified.\r\n\r\n If you disable or do not configure this setting, items will be kept in the quarantine folder indefinitely and will not be automatically removed.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-quarantine-purgeitemsafterdelay"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_quarantine_purgeitemsafterdelay_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_quarantine_purgeitemsafterdelay_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_quarantine_purgeitemsafterdelay_quarantine_purgeitemsafterdelay","displayName":"Configure removal of items from Quarantine folder (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_randomizescheduletasktimes","displayName":"Randomize scheduled task times","description":"This policy setting allows you to enable or disable randomization of the scheduled scan start time and the scheduled security intelligence update start time. This setting is used to distribute the resource impact of scanning. For example, it could be used in guest virtual machines sharing a host, to prevent multiple guest virtual machines from undertaking a disk-intensive operation at the same time.\r\n\r\n If you enable or do not configure this setting, scheduled tasks will begin at a random time within an interval of 4 hours after the specified start time.\r\n\r\n If you disable this setting, scheduled tasks will begin at the specified start time.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-randomizescheduletasktimes"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_randomizescheduletasktimes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_randomizescheduletasktimes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_disablebehaviormonitoring","displayName":"Turn on behavior monitoring","description":"This policy setting allows you to configure behavior monitoring.\r\n\r\n If you enable or do not configure this setting, behavior monitoring will be enabled.\r\n\r\n If you disable this setting, behavior monitoring will be disabled.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-realtimeprotection-disablebehaviormonitoring"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_disablebehaviormonitoring_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_disablebehaviormonitoring_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_disableioavprotection","displayName":"Scan all downloaded files and attachments","description":"This policy setting allows you to configure scanning for all downloaded files and attachments.\r\n\r\n If you enable or do not configure this setting, scanning for all downloaded files and attachments will be enabled.\r\n\r\n If you disable this setting, scanning for all downloaded files and attachments will be disabled.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-realtimeprotection-disableioavprotection"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_disableioavprotection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_disableioavprotection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_disableonaccessprotection","displayName":"Monitor file and program activity on your computer","description":"This policy setting allows you to configure monitoring for file and program activity.\r\n\r\n If you enable or do not configure this setting, monitoring for file and program activity will be enabled.\r\n\r\n If you disable this setting, monitoring for file and program activity will be disabled.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-realtimeprotection-disableonaccessprotection"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_disableonaccessprotection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_disableonaccessprotection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_disablerawwritenotification","displayName":"Turn on raw volume write notifications","description":"This policy setting controls whether raw volume write notifications are sent to behavior monitoring.\r\n\r\n If you enable or do not configure this setting, raw write notifications will be enabled.\r\n\r\n If you disable this setting, raw write notifications be disabled.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-realtimeprotection-disablerawwritenotification"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_disablerawwritenotification_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_disablerawwritenotification_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_disablescanonrealtimeenable","displayName":"Turn on process scanning whenever real-time protection is enabled","description":"This policy setting allows you to configure process scanning when real-time protection is turned on. This helps to catch malware which could start when real-time protection is turned off.\r\n\r\n If you enable or do not configure this setting, a process scan will be initiated when real-time protection is turned on.\r\n\r\n If you disable this setting, a process scan will not be initiated when real-time protection is turned on.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-realtimeprotection-disablescanonrealtimeenable"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_disablescanonrealtimeenable_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_disablescanonrealtimeenable_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_ioavmaxsize","displayName":"Define the maximum size of downloaded files and attachments to be scanned","description":"This policy setting defines the maximum size (in kilobytes) of downloaded files and attachments that will be scanned.\r\n\r\n If you enable this setting, downloaded files and attachments smaller than the size specified will be scanned.\r\n\r\n If you disable or do not configure this setting, a default size will be applied.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-realtimeprotection-ioavmaxsize"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_ioavmaxsize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_ioavmaxsize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_ioavmaxsize_realtimeprotection_ioavmaxsize","displayName":"Define the maximum size of downloaded files and attachments to be scanned (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_localsettingoverridedisablebehaviormonitoring","displayName":"Configure local setting override for turn on behavior monitoring","description":"This policy setting configures a local override for the configuration of behavior monitoring. This setting can only be set by Group Policy.\r\n\r\n If you enable this setting, the local preference setting will take priority over Group Policy.\r\n\r\n If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisablebehaviormonitoring"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_localsettingoverridedisablebehaviormonitoring_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_localsettingoverridedisablebehaviormonitoring_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_localsettingoverridedisableioavprotection","displayName":"Configure local setting override for scanning all downloaded files and attachments","description":"This policy setting configures a local override for the configuration of scanning for all downloaded files and attachments. This setting can only be set by Group Policy.\r\n\r\n If you enable this setting, the local preference setting will take priority over Group Policy.\r\n\r\n If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisableioavprotection"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_localsettingoverridedisableioavprotection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_localsettingoverridedisableioavprotection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_localsettingoverridedisableonaccessprotection","displayName":"Configure local setting override for monitoring file and program activity on your computer","description":"This policy setting configures a local override for the configuration of monitoring for file and program activity on your computer. This setting can only be set by Group Policy.\r\n\r\n If you enable this setting, the local preference setting will take priority over Group Policy.\r\n\r\n If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisableonaccessprotection"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_localsettingoverridedisableonaccessprotection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_localsettingoverridedisableonaccessprotection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_localsettingoverridedisablerealtimemonitoring","displayName":"Configure local setting override to turn on real-time protection","description":"This policy setting configures a local override for the configuration to turn on real-time protection. This setting can only be set by Group Policy.\r\n\r\n If you enable this setting, the local preference setting will take priority over Group Policy.\r\n\r\n If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisablerealtimemonitoring"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_localsettingoverridedisablerealtimemonitoring_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_localsettingoverridedisablerealtimemonitoring_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_localsettingoverriderealtimescandirection","displayName":"Configure local setting override for monitoring for incoming and outgoing file activity","description":"This policy setting configures a local override for the configuration of monitoring for incoming and outgoing file activity. This setting can only be set by Group Policy.\r\n\r\n If you enable this setting, the local preference setting will take priority over Group Policy.\r\n\r\n If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverriderealtimescandirection"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_localsettingoverriderealtimescandirection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_realtimeprotection_localsettingoverriderealtimescandirection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_localsettingoverridescan_scheduletime","displayName":"Configure local setting override for the time of day to run a scheduled full scan to complete remediation","description":"This policy setting configures a local override for the configuration of the time to run a scheduled full scan to complete remediation. This setting can only be set by Group Policy.\r\n\r\n If you enable this setting, the local preference setting will take priority over Group Policy.\r\n\r\n If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-remediation-localsettingoverridescan-scheduletime"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_localsettingoverridescan_scheduletime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_localsettingoverridescan_scheduletime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_scan_scheduleday","displayName":"Specify the day of the week to run a scheduled full scan to complete remediation","description":"This policy setting allows you to specify the day of the week on which to perform a scheduled full scan in order to complete remediation. The scan can also be configured to run every day or to never run at all.\r\n\r\n This setting can be configured with the following ordinal number values:\r\n (0x0) Every Day\r\n (0x1) Sunday \r\n (0x2) Monday\r\n (0x3) Tuesday\r\n (0x4) Wednesday\r\n (0x5) Thursday\r\n (0x6) Friday\r\n (0x7) Saturday\r\n (0x8) Never (default)\r\n\r\n If you enable this setting, a scheduled full scan to complete remediation will run at the frequency specified.\r\n\r\n If you disable or do not configure this setting, a scheduled full scan to complete remediation will run at a default frequency.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-remediation-scan-scheduleday"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_scan_scheduleday_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_scan_scheduleday_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_scan_scheduleday_remediation_scan_scheduleday","displayName":"Specify the day of the week to run a scheduled full scan to complete remediation (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_scan_scheduleday_remediation_scan_scheduleday_8","displayName":"Never","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_scan_scheduleday_remediation_scan_scheduleday_0","displayName":"Every Day","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_scan_scheduleday_remediation_scan_scheduleday_1","displayName":"Sunday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_scan_scheduleday_remediation_scan_scheduleday_2","displayName":"Monday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_scan_scheduleday_remediation_scan_scheduleday_3","displayName":"Tuesday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_scan_scheduleday_remediation_scan_scheduleday_4","displayName":"Wednesday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_scan_scheduleday_remediation_scan_scheduleday_5","displayName":"Thursday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_scan_scheduleday_remediation_scan_scheduleday_6","displayName":"Friday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_scan_scheduleday_remediation_scan_scheduleday_7","displayName":"Saturday","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_scan_scheduletime","displayName":"Specify the time of day to run a scheduled full scan to complete remediation","description":"This policy setting allows you to specify the time of day at which to perform a scheduled full scan in order to complete remediation. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. The schedule is based on local time on the computer where the scan is executing.\r\n\r\n If you enable this setting, a scheduled full scan to complete remediation will run at the time of day specified.\r\n\r\n If you disable or do not configure this setting, a scheduled full scan to complete remediation will run at a default time.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-remediation-scan-scheduletime"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_scan_scheduletime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_scan_scheduletime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_remediation_scan_scheduletime_remediation_scan_scheduletime","displayName":"Specify the time of day to run a scheduled full scan to complete remediation (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_additionalactiontimeout","displayName":"Configure time out for detections requiring additional action","description":"This policy setting configures the time in minutes before a detection in the \"additional action\" state moves to the \"cleared\" state.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-reporting-additionalactiontimeout"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_additionalactiontimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_additionalactiontimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_additionalactiontimeout_reporting_additionalactiontimeout","displayName":"Configure time out for detections requiring additional action (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_criticalfailuretimeout","displayName":"Configure time out for detections in critically failed state","description":"This policy setting configures the time in minutes before a detection in the “critically failed” state to moves to either the “additional action” state or the “cleared” state.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-reporting-criticalfailuretimeout"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_criticalfailuretimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_criticalfailuretimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_criticalfailuretimeout_reporting_criticalfailuretimeout","displayName":"Configure time out for detections in critically failed state (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_disableenhancednotifications","displayName":"Turn off enhanced notifications","description":"\r\n Use this policy setting to specify if you want Microsoft Defender Antivirus enhanced notifications to display on clients.\r\n \r\n If you disable or do not configure this setting, Microsoft Defender Antivirus enhanced notifications will display on clients.\r\n \r\n If you enable this setting, Microsoft Defender Antivirus enhanced notifications will not display on clients.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-reporting-disableenhancednotifications"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_disableenhancednotifications_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_disableenhancednotifications_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_disablegenericreports","displayName":"Configure Watson events","description":"This policy setting allows you to configure whether or not Watson events are sent.\r\n\r\n If you enable or do not configure this setting, Watson events will be sent.\r\n\r\n If you disable this setting, Watson events will not be sent.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-reporting-disablegenericreports"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_disablegenericreports_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_disablegenericreports_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_noncriticaltimeout","displayName":"Configure time out for detections in non-critical failed state","description":"This policy setting configures the time in minutes before a detection in the \"non-critically failed\" state moves to the \"cleared\" state.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-reporting-noncriticaltimeout"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_noncriticaltimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_noncriticaltimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_noncriticaltimeout_reporting_noncriticaltimeout","displayName":"Configure time out for detections in non-critical failed state (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_recentlycleanedtimeout","displayName":"Configure time out for detections in recently remediated state","description":"This policy setting configures the time in minutes before a detection in the \"completed\" state moves to the \"cleared\" state.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-reporting-recentlycleanedtimeout"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_recentlycleanedtimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_recentlycleanedtimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_recentlycleanedtimeout_reporting_recentlycleanedtimeout","displayName":"Configure time out for detections in recently remediated state (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_wpptracingcomponents","displayName":"Configure Windows software trace preprocessor components","description":"This policy configures Windows software trace preprocessor (WPP Software Tracing) components.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-reporting-wpptracingcomponents"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_wpptracingcomponents_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_wpptracingcomponents_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_wpptracingcomponents_reporting_wpptracingcomponents","displayName":"Configure Windows software trace preprocessor components (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_wpptracinglevel","displayName":"Configure WPP tracing level","description":"This policy allows you to configure tracing levels for Windows software trace preprocessor (WPP Software Tracing). \r\n Tracing levels are defined as:\r\n 1 - Error\r\n 2 - Warning\r\n 3 - Info\r\n 4 - Debug\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-reporting-wpptracinglevel"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_wpptracinglevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_wpptracinglevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_reporting_wpptracinglevel_reporting_wpptracinglevel","displayName":"Configure WPP tracing level (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_allowpause","displayName":"Allow users to pause scan","description":"This policy setting allows you to manage whether or not end users can pause a scan in progress.\r\n\r\n If you enable or do not configure this setting, a new context menu will be added to the task tray icon to allow the user to pause a scan.\r\n\r\n If you disable this setting, users will not be able to pause scans.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-allowpause"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_allowpause_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_allowpause_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_archivemaxdepth","displayName":"Specify the maximum depth to scan archive files","description":"This policy setting allows you to configure the maximum directory depth level into which archive files such as .ZIP or .CAB are unpacked during scanning. The default directory depth level is 0.\r\n\r\n If you enable this setting, archive files will be scanned to the directory depth level specified.\r\n\r\n If you disable or do not configure this setting, archive files will be scanned to the default directory depth level.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-archivemaxdepth"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_archivemaxdepth_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_archivemaxdepth_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_archivemaxdepth_scan_archivemaxdepth","displayName":"Specify the maximum depth to scan archive files (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_archivemaxsize","displayName":"Specify the maximum size of archive files to be scanned","description":"This policy setting allows you to configure the maximum size of archive files such as .ZIP or .CAB that will be scanned. The value represents file size in kilobytes (KB). The default value is 0 and represents no limit to archive size for scanning.\r\n\r\n If you enable this setting, archive files less than or equal to the size specified will be scanned.\r\n\r\n If you disable or do not configure this setting, archive files will be scanned according to the default value.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-archivemaxsize"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_archivemaxsize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_archivemaxsize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_archivemaxsize_scan_archivemaxsize","displayName":"Specify the maximum size of archive files to be scanned (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disablearchivescanning","displayName":"Scan archive files","description":"This policy setting allows you to configure scans for malicious software and unwanted software in archive files such as .ZIP or .CAB files.\r\n\r\n If you enable or do not configure this setting, archive files will be scanned.\r\n\r\n If you disable this setting, archive files will not be scanned.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-disablearchivescanning"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disablearchivescanning_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disablearchivescanning_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disableemailscanning","displayName":"Turn on e-mail scanning","description":"This policy setting allows you to configure e-mail scanning. When e-mail scanning is enabled, the engine will parse the mailbox and mail files, according to their specific format, in order to analyze the mail bodies and attachments. Several e-mail formats are currently supported, for example: pst (Outlook), dbx, mbx, mime (Outlook Express), binhex (Mac).\r\n\r\n If you enable this setting, e-mail scanning will be enabled.\r\n\r\n If you disable or do not configure this setting, e-mail scanning will be disabled.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-disableemailscanning"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disableemailscanning_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disableemailscanning_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disableheuristics","displayName":"Turn on heuristics","description":"This policy setting allows you to configure heuristics. Suspicious detections will be suppressed right before reporting to the engine client. Turning off heuristics will reduce the capability to flag new threats. It is recommended that you do not turn off heuristics.\r\n\r\n If you enable or do not configure this setting, heuristics will be enabled.\r\n\r\n If you disable this setting, heuristics will be disabled.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-disableheuristics"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disableheuristics_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disableheuristics_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disablepackedexescanning","displayName":"Scan packed executables","description":"This policy setting allows you to configure scanning for packed executables. It is recommended that this type of scanning remain enabled.\r\n\r\n If you enable or do not configure this setting, packed executables will be scanned.\r\n\r\n If you disable this setting, packed executables will not be scanned.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-disablepackedexescanning"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disablepackedexescanning_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disablepackedexescanning_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disableremovabledrivescanning","displayName":"Scan removable drives","description":"This policy setting allows you to manage whether or not to scan for malicious software and unwanted software in the contents of removable drives, such as USB flash drives, when running a full scan.\r\n\r\n If you enable this setting, removable drives will be scanned during any type of scan.\r\n\r\n If you disable or do not configure this setting, removable drives will not be scanned during a full scan. Removable drives may still be scanned during quick scan and custom scan.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-disableremovabledrivescanning"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disableremovabledrivescanning_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disableremovabledrivescanning_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disablereparsepointscanning","displayName":"Turn on reparse point scanning","description":"This policy setting allows you to configure reparse point scanning. If you allow reparse points to be scanned, there is a possible risk of recursion. However, the engine supports following reparse points to a maximum depth so at worst scanning could be slowed. Reparse point scanning is disabled by default and this is the recommended state for this functionality. \r\n\r\n If you enable this setting, reparse point scanning will be enabled.\r\n\r\n If you disable or do not configure this setting, reparse point scanning will be disabled.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-disablereparsepointscanning"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disablereparsepointscanning_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disablereparsepointscanning_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disablerestorepoint","displayName":"Create a system restore point","description":"This policy setting allows you to create a system restore point on the computer on a daily basis prior to cleaning. \r\n\r\n If you enable this setting, a system restore point will be created.\r\n\r\n If you disable or do not configure this setting, a system restore point will not be created.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-disablerestorepoint"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disablerestorepoint_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disablerestorepoint_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disablescanningmappednetworkdrivesforfullscan","displayName":"Run full scan on mapped network drives","description":"This policy setting allows you to configure scanning mapped network drives.\r\n\r\n If you enable this setting, mapped network drives will be scanned.\r\n\r\n If you disable or do not configure this setting, mapped network drives will not be scanned.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-disablescanningmappednetworkdrivesforfullscan"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disablescanningmappednetworkdrivesforfullscan_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disablescanningmappednetworkdrivesforfullscan_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disablescanningnetworkfiles","displayName":"Configure scanning of network files","description":"This policy setting allows you to configure scanning for network files. It is recommended that you do not enable this setting.\r\n\r\n If you enable this setting, network files will be scanned.\r\n\r\n If you disable or do not configure this setting, network files will not be scanned.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-disablescanningnetworkfiles"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disablescanningnetworkfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_disablescanningnetworkfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_localsettingoverrideavgcpuloadfactor","displayName":"Configure local setting override for maximum percentage of CPU utilization","description":"This policy setting configures a local override for the configuration of maximum percentage of CPU utilization during scan. This setting can only be set by Group Policy.\r\n\r\n If you enable this setting, the local preference setting will take priority over Group Policy.\r\n\r\n If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-localsettingoverrideavgcpuloadfactor"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_localsettingoverrideavgcpuloadfactor_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_localsettingoverrideavgcpuloadfactor_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_localsettingoverridescanparameters","displayName":"Configure local setting override for the scan type to use for a scheduled scan","description":"This policy setting configures a local override for the configuration of the scan type to use during a scheduled scan. This setting can only be set by Group Policy.\r\n\r\n If you enable this setting, the local preference setting will take priority over Group Policy.\r\n\r\n If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-localsettingoverridescanparameters"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_localsettingoverridescanparameters_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_localsettingoverridescanparameters_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_localsettingoverridescheduleday","displayName":"Configure local setting override for schedule scan day","description":"This policy setting configures a local override for the configuration of scheduled scan day. This setting can only be set by Group Policy.\r\n\r\n If you enable this setting, the local preference setting will take priority over Group Policy.\r\n\r\n If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-localsettingoverridescheduleday"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_localsettingoverridescheduleday_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_localsettingoverridescheduleday_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_localsettingoverrideschedulequickscantime","displayName":"Configure local setting override for scheduled quick scan time","description":"This policy setting configures a local override for the configuration of scheduled quick scan time. This setting can only be set by Group Policy.\r\n\r\n If you enable this setting, the local preference setting will take priority over Group Policy.\r\n\r\n If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-localsettingoverrideschedulequickscantime"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_localsettingoverrideschedulequickscantime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_localsettingoverrideschedulequickscantime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_localsettingoverridescheduletime","displayName":"Configure local setting override for scheduled scan time","description":"This policy setting configures a local override for the configuration of scheduled scan time. This setting can only be set by Group Policy.\r\n\r\n If you enable this setting, the local preference setting will take priority over Group Policy.\r\n\r\n If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-localsettingoverridescheduletime"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_localsettingoverridescheduletime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_localsettingoverridescheduletime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_lowcpupriority","displayName":"Configure low CPU priority for scheduled scans","description":"\r\n This policy setting allows you to enable or disable low CPU priority for scheduled scans.\r\n\r\n If you enable this setting, low CPU priority will be used during scheduled scans.\r\n\r\n If you disable or do not configure this setting, not changes will be made to CPU priority for scheduled scans.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-lowcpupriority"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_lowcpupriority_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_lowcpupriority_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_missedscheduledscancountbeforecatchup","displayName":"Define the number of days after which a catch-up scan is forced","description":"\r\n This policy setting allows you to define the number of consecutive scheduled scans that can be missed after which a catch-up scan will be forced. By default, the value of this setting is 2 consecutive scheduled scans.\r\n\r\n If you enable this setting, a catch-up scan will occur after the specified number consecutive missed scheduled scans.\r\n\r\n If you disable or do not configure this setting, a catch-up scan will occur after the 2 consecutive missed scheduled scans.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-missedscheduledscancountbeforecatchup"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_missedscheduledscancountbeforecatchup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_missedscheduledscancountbeforecatchup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_missedscheduledscancountbeforecatchup_scan_missedscheduledscancountbeforecatchup","displayName":"Define the number of scheduled scans that can be missed after which a catch-up scan is forced (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_purgeitemsafterdelay","displayName":"Turn on removal of items from scan history folder","description":"This policy setting defines the number of days items should be kept in the scan history folder before being permanently removed. The value represents the number of days to keep items in the folder. If set to zero, items will be kept forever and will not be automatically removed. By default, the value is set to 30 days.\r\n\r\n If you enable this setting, items will be removed from the scan history folder after the number of days specified.\r\n\r\n If you disable or do not configure this setting, items will be kept in the scan history folder for the default number of days.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-purgeitemsafterdelay"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_purgeitemsafterdelay_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_purgeitemsafterdelay_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_purgeitemsafterdelay_scan_purgeitemsafterdelay","displayName":"Turn on removal of items from scan history folder (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_quickscaninterval","displayName":"Specify the interval to run quick scans per day","description":"This policy setting allows you to specify an interval at which to perform a quick scan. The time value is represented as the number of hours between quick scans. Valid values range from 1 (every hour) to 24 (once per day). If set to zero, interval quick scans will not occur. By default, this setting is set to 0.\r\n\r\n If you enable this setting, a quick scan will run at the interval specified.\r\n\r\n If you disable or do not configure this setting, a quick scan will run at a default time.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-quickscaninterval"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_quickscaninterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_quickscaninterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_quickscaninterval_scan_quickscaninterval","displayName":"Specify the interval to run quick scans per day (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scanonlyifidle","displayName":"Start the scheduled scan only when computer is on but not in use","description":"This policy setting allows you to configure scheduled scans to start only when your computer is on but not in use.\r\n\r\n If you enable or do not configure this setting, scheduled scans will only run when the computer is on but not in use.\r\n\r\n If you disable this setting, scheduled scans will run at the scheduled time.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-scanonlyifidle"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scanonlyifidle_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scanonlyifidle_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scheduleday","displayName":"Specify the day of the week to run a scheduled scan","description":"This policy setting allows you to specify the day of the week on which to perform a scheduled scan. The scan can also be configured to run every day or to never run at all.\r\n\r\n This setting can be configured with the following ordinal number values:\r\n (0x0) Every Day\r\n (0x1) Sunday \r\n (0x2) Monday\r\n (0x3) Tuesday\r\n (0x4) Wednesday\r\n (0x5) Thursday\r\n (0x6) Friday\r\n (0x7) Saturday\r\n (0x8) Never (default)\r\n\r\n If you enable this setting, a scheduled scan will run at the frequency specified.\r\n\r\n If you disable or do not configure this setting, a scheduled scan will run at a default frequency.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-scheduleday"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scheduleday_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scheduleday_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scheduleday_scan_scheduleday","displayName":"Specify the day of the week to run a scheduled scan (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scheduleday_scan_scheduleday_8","displayName":"Never","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scheduleday_scan_scheduleday_0","displayName":"Every Day","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scheduleday_scan_scheduleday_1","displayName":"Sunday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scheduleday_scan_scheduleday_2","displayName":"Monday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scheduleday_scan_scheduleday_3","displayName":"Tuesday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scheduleday_scan_scheduleday_4","displayName":"Wednesday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scheduleday_scan_scheduleday_5","displayName":"Thursday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scheduleday_scan_scheduleday_6","displayName":"Friday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scheduleday_scan_scheduleday_7","displayName":"Saturday","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scheduletime","displayName":"Specify the time of day to run a scheduled scan","description":"This policy setting allows you to specify the time of day at which to perform a scheduled scan. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. By default, this setting is set to a time value of 2:00 AM. The schedule is based on local time on the computer where the scan is executing.\r\n\r\n If you enable this setting, a scheduled scan will run at the time of day specified.\r\n\r\n If you disable or do not configure this setting, a scheduled scan will run at a default time.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-scan-scheduletime"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scheduletime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scheduletime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_scan_scheduletime_scan_scheduletime","displayName":"Specify the time of day to run a scheduled scan (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_servicekeepalive","displayName":"Allow antimalware service to remain running always","description":"This policy setting allows you to configure whether or not the antimalware service remains running when antivirus and antispyware security intelligence is disabled. It is recommended that this setting remain disabled.\r\n\r\n If you enable this setting, the antimalware service will always remain running even if both antivirus and antispyware security intelligence is disabled.\r\n\r\n If you disable or do not configure this setting, the antimalware service will be stopped when both antivirus and antispyware security intelligence is disabled. If the computer is restarted, the service will be started if it is set to Automatic startup. After the service has started, there will be a check to see if antivirus and antispyware security intelligence is enabled. If at least one is enabled, the service will remain running. If both are disabled, the service will be stopped.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-servicekeepalive"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_servicekeepalive_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_servicekeepalive_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_assignaturedue","displayName":"Define the number of days before spyware security intelligence is considered out of date","description":"This policy setting allows you to define the number of days that must pass before spyware security intelligence is considered out of date. If security intelligence is determined to be out of date, this state may trigger several additional actions, including falling back to an alternative update source or displaying a warning icon in the user interface. By default, this value is set to 7 days.\r\n\r\n If you enable this setting, spyware security intelligence will be considered out of date after the number of days specified have passed without an update.\r\n\r\n If you disable or do not configure this setting, spyware security intelligence will be considered out of date after the default number of days have passed without an update.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-signatureupdate-assignaturedue"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_assignaturedue_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_assignaturedue_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_assignaturedue_signatureupdate_assignaturedue","displayName":"Define the number of days before spyware security intelligence is considered out of date (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_avsignaturedue","displayName":"Define the number of days before virus security intelligence is considered out of date","description":"This policy setting allows you to define the number of days that must pass before virus security intelligence is considered out of date. If security intelligence is determined to be out of date, this state may trigger several additional actions, including falling back to an alternative update source or displaying a warning icon in the user interface. By default, this value is set to 7 days.\r\n\r\n If you enable this setting, virus security intelligence will be considered out of date after the number of days specified have passed without an update.\r\n\r\n If you disable or do not configure this setting, virus security intelligence will be considered out of date after the default number of days have passed without an update.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-signatureupdate-avsignaturedue"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_avsignaturedue_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_avsignaturedue_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_avsignaturedue_signatureupdate_avsignaturedue","displayName":"Define the number of days before virus security intelligence is considered out of date (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_definitionupdatefilesharessources","displayName":"Define file shares for downloading security intelligence updates","description":"This policy setting allows you to configure UNC file share sources for downloading security intelligence updates. Sources will be contacted in the order specified. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources. For example: \"{\\\\unc1 | \\\\unc2 }\". The list is empty by default.\r\n\r\n If you enable this setting, the specified sources will be contacted for security intelligence updates. Once security intelligence updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted.\r\n\r\n If you disable or do not configure this setting, the list will remain empty by default and no sources will be contacted.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-signatureupdate-definitionupdatefilesharessources"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_definitionupdatefilesharessources_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_definitionupdatefilesharessources_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_definitionupdatefilesharessources_signatureupdate_definitionupdatefilesharessources","displayName":"Define file shares for downloading security intelligence updates (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_disablescanonupdate","displayName":"Turn on scan after security intelligence update","description":"This policy setting allows you to configure the automatic scan which starts after a security intelligence update has occurred.\r\n\r\n If you enable or do not configure this setting, a scan will start following a security intelligence update.\r\n\r\n If you disable this setting, a scan will not start following a security intelligence update.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-signatureupdate-disablescanonupdate"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_disablescanonupdate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_disablescanonupdate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_disablescheduledsignatureupdateonbattery","displayName":"Allow security intelligence updates when running on battery power","description":"This policy setting allows you to configure security intelligence updates when the computer is running on battery power.\r\n\r\n If you enable or do not configure this setting, security intelligence updates will occur as usual regardless of power state.\r\n\r\n If you disable this setting, security intelligence updates will be turned off while the computer is running on battery power.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-signatureupdate-disablescheduledsignatureupdateonbattery"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_disablescheduledsignatureupdateonbattery_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_disablescheduledsignatureupdateonbattery_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_disableupdateonstartupwithoutengine","displayName":"Initiate security intelligence update on startup","description":"This policy setting allows you to configure security intelligence updates on startup when there is no antimalware engine present.\r\n\r\n If you enable or do not configure this setting, security intelligence updates will be initiated on startup when there is no antimalware engine present.\r\n\r\n If you disable this setting, security intelligence updates will not be initiated on startup when there is no antimalware engine present.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-signatureupdate-disableupdateonstartupwithoutengine"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_disableupdateonstartupwithoutengine_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_disableupdateonstartupwithoutengine_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_fallbackorder","displayName":"Define the order of sources for downloading security intelligence updates","description":"This policy setting allows you to define the order in which different security intelligence update sources should be contacted. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources in order. Possible values are: “InternalDefinitionUpdateServer”, “MicrosoftUpdateServer”, “MMPC”, and “FileShares”\r\n\r\n For example: { InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC }\r\n\r\n If you enable this setting, security intelligence update sources will be contacted in the order specified. Once security intelligence updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted.\r\n\r\n If you disable or do not configure this setting, security intelligence update sources will be contacted in a default order.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-signatureupdate-fallbackorder"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_fallbackorder_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_fallbackorder_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_fallbackorder_signatureupdate_fallbackorder","displayName":"Define the order of sources for downloading security intelligence updates (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_forceupdatefrommu","displayName":"Allow security intelligence updates from Microsoft Update","description":"This policy setting allows you to enable download of security intelligence updates from Microsoft Update even if the Automatic Updates default server is configured to another download source such as Windows Update.\r\n\r\n If you enable this setting, security intelligence updates will be downloaded from Microsoft Update.\r\n\r\n If you disable or do not configure this setting, security intelligence updates will be downloaded from the configured download source.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-signatureupdate-forceupdatefrommu"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_forceupdatefrommu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_forceupdatefrommu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_realtimesignaturedelivery","displayName":"Allow real-time security intelligence updates based on reports to Microsoft MAPS","description":"This policy setting allows you to enable real-time security intelligence updates in response to reports sent to Microsoft MAPS. If the service reports a file as an unknown and Microsoft MAPS finds that the latest security intelligence update has security intelligence for a threat involving that file, the service will receive all of the latest security intelligence for that threat immediately. You must have configured your computer to join Microsoft MAPS for this functionality to work.\r\n\r\n If you enable or do not configure this setting, real-time security intelligence updates will be enabled.\r\n\r\n If you disable this setting, real-time security intelligence updates will disabled.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-signatureupdate-realtimesignaturedelivery"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_realtimesignaturedelivery_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_realtimesignaturedelivery_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_scheduleday","displayName":"Specify the day of the week to check for security intelligence updates","description":"This policy setting allows you to specify the day of the week on which to check for security intelligence updates. The check can also be configured to run every day or to never run at all.\r\n\r\n This setting can be configured with the following ordinal number values:\r\n (0x0) Every Day (default)\r\n (0x1) Sunday \r\n (0x2) Monday\r\n (0x3) Tuesday\r\n (0x4) Wednesday\r\n (0x5) Thursday\r\n (0x6) Friday\r\n (0x7) Saturday\r\n (0x8) Never\r\n\r\n If you enable this setting, the check for security intelligence updates will occur at the frequency specified.\r\n\r\n If you disable or do not configure this setting, the check for security intelligence updates will occur at a default frequency.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-signatureupdate-scheduleday"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_scheduleday_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_scheduleday_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_scheduleday_signatureupdate_scheduleday","displayName":"Specify the day of the week to check for security intelligence updates (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_scheduleday_signatureupdate_scheduleday_8","displayName":"Never","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_scheduleday_signatureupdate_scheduleday_0","displayName":"Every Day","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_scheduleday_signatureupdate_scheduleday_1","displayName":"Sunday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_scheduleday_signatureupdate_scheduleday_2","displayName":"Monday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_scheduleday_signatureupdate_scheduleday_3","displayName":"Tuesday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_scheduleday_signatureupdate_scheduleday_4","displayName":"Wednesday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_scheduleday_signatureupdate_scheduleday_5","displayName":"Thursday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_scheduleday_signatureupdate_scheduleday_6","displayName":"Friday","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_scheduleday_signatureupdate_scheduleday_7","displayName":"Saturday","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_scheduletime","displayName":"Specify the time to check for security intelligence updates","description":"This policy setting allows you to specify the time of day at which to check for security intelligence updates. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. By default this setting is configured to check for security intelligence updates 15 minutes before the scheduled scan time. The schedule is based on local time on the computer where the check is occurring.\r\n\r\n If you enable this setting, the check for security intelligence updates will occur at the time of day specified.\r\n\r\n If you disable or do not configure this setting, the check for security intelligence updates will occur at the default time.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-signatureupdate-scheduletime"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_scheduletime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_scheduletime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_scheduletime_signatureupdate_scheduletime","displayName":"Specify the time to check for security intelligence updates (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_sharedsignatureslocation","displayName":"Define security intelligence location for VDI clients.","description":"This policy setting allows you to define the security intelligence location for VDI-configured computers. \r\n\r\n If you disable or do not configure this setting, security intelligence will be referred from the default local source.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-signatureupdate-sharedsignatureslocation"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_sharedsignatureslocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_sharedsignatureslocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_sharedsignatureslocation_signatureupdate_sharedsignatureslocation","displayName":"Define file share for downloading security intelligence updates in virtual environments (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_signaturedisablenotification","displayName":"Allow notifications to disable security intelligence based reports to Microsoft MAPS","description":"This policy setting allows you to configure the antimalware service to receive notifications to disable individual security intelligence in response to reports it sends to Microsoft MAPS. Microsoft MAPS uses these notifications to disable security intelligence that are causing false positive reports. You must have configured your computer to join Microsoft MAPS for this functionality to work.\r\n\r\n If you enable this setting or do not configure, the antimalware service will receive notifications to disable security intelligence.\r\n\r\n If you disable this setting, the antimalware service will not receive notifications to disable security intelligence.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-signatureupdate-signaturedisablenotification"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_signaturedisablenotification_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_signaturedisablenotification_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_signatureupdatecatchupinterval","displayName":"Define the number of days after which a catch-up security intelligence update is required","description":"This policy setting allows you to define the number of days after which a catch-up security intelligence update will be required. By default, the value of this setting is 1 day.\r\n\r\n If you enable this setting, a catch-up security intelligence update will occur after the specified number of days.\r\n\r\n If you disable or do not configure this setting, a catch-up security intelligence update will be required after the default number of days.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-signatureupdate-signatureupdatecatchupinterval"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_signatureupdatecatchupinterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_signatureupdatecatchupinterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_signatureupdatecatchupinterval_signatureupdate_signatureupdatecatchupinterval","displayName":"Define the number of days after which a catch-up security intelligence update is required (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_updateonstartup","displayName":"Check for the latest virus and spyware security intelligence on startup","description":"This policy setting allows you to manage whether a check for new virus and spyware security intelligence will occur immediately after service startup.\r\n\r\n If you enable this setting, a check for new security intelligence will occur after service startup.\r\n\r\n If you disable this setting or do not configure this setting, a check for new security intelligence will not occur after service startup.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-signatureupdate-updateonstartup"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_updateonstartup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_signatureupdate_updateonstartup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_spynet_localsettingoverridespynetreporting","displayName":"Configure local setting override for reporting to Microsoft MAPS","description":"This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by Group Policy.\r\n\r\n If you enable this setting, the local preference setting will take priority over Group Policy.\r\n\r\n If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-spynet-localsettingoverridespynetreporting"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_spynet_localsettingoverridespynetreporting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_spynet_localsettingoverridespynetreporting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_spynetreporting","displayName":"Join Microsoft MAPS","description":"This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections.\r\n\r\n You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new security intelligence and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances, personal information might unintentionally be sent to Microsoft. However, Microsoft will not use this information to identify you or contact you.\r\n\r\n Possible options are:\r\n (0x0) Disabled (default)\r\n (0x1) Basic membership\r\n (0x2) Advanced membership\r\n\r\n Basic membership will send basic information to Microsoft about software that has been detected, including where the software came from, the actions that you apply or that are applied automatically, and whether the actions were successful.\r\n\r\n Advanced membership, in addition to basic information, will send more information to Microsoft about malicious software, spyware, and potentially unwanted software, including the location of the software, file names, how the software operates, and how it has impacted your computer.\r\n\r\n If you enable this setting, you will join Microsoft MAPS with the membership specified.\r\n\r\n If you disable or do not configure this setting, you will not join Microsoft MAPS.\r\n \r\n In Windows 10, Basic membership is no longer available, so setting the value to 1 or 2 enrolls the device into Advanced membership.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-spynetreporting"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_spynetreporting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_spynetreporting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_spynetreporting_spynetreporting","displayName":"Join Microsoft MAPS (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_spynetreporting_spynetreporting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_spynetreporting_spynetreporting_1","displayName":"Basic MAPS","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_spynetreporting_spynetreporting_2","displayName":"Advanced MAPS","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_threats_threatiddefaultaction","displayName":"Specify threats upon which default action should not be taken when detected","description":"This policy setting customize which remediation action will be taken for each listed Threat ID when it is detected during a scan. Threats should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a valid Threat ID, while the value contains the action ID for the remediation action that should be taken.\r\n\r\n Valid remediation action values are:\r\n 2 = Quarantine\r\n 3 = Remove\r\n 6 = Ignore\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-threats-threatiddefaultaction"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_threats_threatiddefaultaction_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_threats_threatiddefaultaction_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_threats_threatiddefaultaction_threats_threatiddefaultactionlist","displayName":"Specify threats upon which default action should not be taken when detected (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_threats_threatiddefaultaction_threats_threatiddefaultactionlist_key","displayName":"Name","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_threats_threatiddefaultaction_threats_threatiddefaultactionlist_value","displayName":"Value","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_ux_configuration_customdefaultactiontoaststring","displayName":"Display additional text to clients when they need to perform an action","description":"This policy setting allows you to configure whether or not to display additional text to clients when they need to perform an action. The text displayed is a custom administrator-defined string. For example, the phone number to call the company help desk. The client interface will only display a maximum of 1024 characters. Longer strings will be truncated before display.\r\n\r\n If you enable this setting, the additional text specified will be displayed.\r\n\r\n If you disable or do not configure this setting, there will be no additional text displayed.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-ux-configuration-customdefaultactiontoaststring"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_ux_configuration_customdefaultactiontoaststring_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_ux_configuration_customdefaultactiontoaststring_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_ux_configuration_customdefaultactiontoaststring_ux_configuration_customdefaultactiontoaststring","displayName":"Display additional text to clients when they need to perform an action (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_ux_configuration_notification_suppress","displayName":"Suppress all notifications","description":"Use this policy setting to specify if you want Microsoft Defender Antivirus notifications to display on clients.\r\n If you disable or do not configure this setting, Microsoft Defender Antivirus notifications will display on clients.\r\n\r\n If you enable this setting, Microsoft Defender Antivirus notifications will not display on clients.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-ux-configuration-notification-suppress"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_ux_configuration_notification_suppress_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_ux_configuration_notification_suppress_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_ux_configuration_suppressrebootnotification","displayName":"Suppresses reboot notifications","description":"\r\n This policy setting allows user to supress reboot notifications in UI only mode (for cases where UI can't be in lockdown mode).\r\n\r\n If you enable this setting AM UI won't show reboot notifications.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-ux-configuration-suppressrebootnotification"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_ux_configuration_suppressrebootnotification_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_ux_configuration_suppressrebootnotification_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_ux_configuration_uilockdown","displayName":"Enable headless UI mode","description":"\r\n This policy setting allows you to configure whether or not to display AM UI to the users.\r\n If you enable this setting AM UI won't be available to users.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus#admx-microsoftdefenderantivirus-ux-configuration-uilockdown"],"options":[{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_ux_configuration_uilockdown_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_microsoftdefenderantivirus_ux_configuration_uilockdown_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mobilepcmobilitycenter_mobilitycenterenable_2","displayName":"Turn off Windows Mobility Center","description":"This policy setting turns off Windows Mobility Center.\r\n\r\nIf you enable this policy setting, the user is unable to invoke Windows Mobility Center. The Windows Mobility Center UI is removed from all shell entry points and the .exe file does not launch it.\r\n\r\nIf you disable this policy setting, the user is able to invoke Windows Mobility Center and the .exe file launches it.\r\n\r\nIf you do not configure this policy setting, Windows Mobility Center is on by default.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mobilepcmobilitycenter#admx-mobilepcmobilitycenter-mobilitycenterenable-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_mobilepcmobilitycenter_mobilitycenterenable_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mobilepcmobilitycenter_mobilitycenterenable_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mobilepcpresentationsettings_presentationsettingsenable_2","displayName":"Turn off Windows presentation settings","description":"This policy setting turns off Windows presentation settings.\r\n\r\nIf you enable this policy setting, Windows presentation settings cannot be invoked.\r\n\r\nIf you disable this policy setting, Windows presentation settings can be invoked. The presentation settings icon will be displayed in the notification area. This will give users a quick and easy way to configure their system settings before a presentation to block system notifications and screen blanking, adjust speaker volume, and apply a custom background image.\r\n\r\nNote: Users will be able to customize their system settings for presentations in Windows Mobility Center.\r\n\r\nIf you do not configure this policy setting, Windows presentation settings can be invoked.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mobilepcpresentationsettings#admx-mobilepcpresentationsettings-presentationsettingsenable-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_mobilepcpresentationsettings_presentationsettingsenable_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mobilepcpresentationsettings_presentationsettingsenable_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msapolicy_microsoftaccount_disableuserauth","displayName":"Block all consumer Microsoft account user authentication","description":"This setting controls whether users can provide Microsoft accounts for authentication for applications or services. If this setting is enabled, all applications and services on the device are prevented from using Microsoft accounts for authentication. \r\nThis applies both to existing users of a device and new users who may be added. However, any application or service that has already authenticated a user will not be affected by enabling this setting until the authentication cache expires. \r\nIt is recommended to enable this setting before any user signs in to a device to prevent cached tokens from being present. If this setting is disabled or not configured, applications and services can use Microsoft accounts for authentication. \r\nBy default, this setting is Disabled. This setting does not affect whether users can sign in to devices by using Microsoft accounts, or the ability for users to provide Microsoft accounts via the browser for authentication with web-based applications. \r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msapolicy#admx-msapolicy-microsoftaccount-disableuserauth"],"options":[{"id":"device_vendor_msft_policy_config_admx_msapolicy_microsoftaccount_disableuserauth_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msapolicy_microsoftaccount_disableuserauth_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msched_activationboundarypolicy","displayName":"Automatic Maintenance Activation Boundary","description":"\r\n This policy setting allows you to configure Automatic Maintenance activation boundary.\r\n\r\n The maintenance activation boundary is the daily schduled time at which Automatic Maintenance starts\r\n\r\n If you enable this policy setting, this will override the default daily scheduled time as specified in Security and Maintenance/Automatic Maintenance Control Panel.\r\n\r\n If you disable or do not configure this policy setting, the daily scheduled time as specified in Security and Maintenance/Automatic Maintenance Control Panel will apply.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msched#admx-msched-activationboundarypolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_msched_activationboundarypolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msched_activationboundarypolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msched_activationboundarypolicy_activationboundary","displayName":"Regular maintenance activation boundary (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_msched_randomdelaypolicy","displayName":"Automatic Maintenance Random Delay","description":"\r\n This policy setting allows you to configure Automatic Maintenance activation random delay.\r\n\r\n The maintenance random delay is the amount of time up to which Automatic Maintenance will delay starting from its Activation Boundary.\r\n\r\n If you enable this policy setting, Automatic Maintenance will delay starting from its Activation Boundary, by upto this time.\r\n\r\n If you do not configure this policy setting, 4 hour random delay will be applied to Automatic Maintenance.\r\n\r\n If you disable this policy setting, no random delay will be applied to Automatic Maintenance.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msched#admx-msched-randomdelaypolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_msched_randomdelaypolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msched_randomdelaypolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msched_randomdelaypolicy_randomdelay","displayName":"Regular maintenance random delay (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_msdt_msdtsupportprovider","displayName":"Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider","description":"This policy setting configures Microsoft Support Diagnostic Tool (MSDT) interactive communication with the support provider. MSDT gathers diagnostic data for analysis by support professionals.\r\n\r\nIf you enable this policy setting, users can use MSDT to collect and send diagnostic data to a support professional to resolve a problem.\r\n\r\nBy default, the support provider is set to Microsoft Corporation.\r\n\r\nIf you disable this policy setting, MSDT cannot run in support mode, and no data can be collected or sent to the support provider.\r\n\r\nIf you do not configure this policy setting, MSDT support mode is enabled by default.\r\n\r\nNo reboots or service restarts are required for this policy setting to take effect. Changes take effect immediately.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msdt#admx-msdt-msdtsupportprovider"],"options":[{"id":"device_vendor_msft_policy_config_admx_msdt_msdtsupportprovider_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msdt_msdtsupportprovider_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msdt_msdttooldownloadpolicy","displayName":"Microsoft Support Diagnostic Tool: Restrict tool download","description":"This policy setting restricts the tool download policy for Microsoft Support Diagnostic Tool.\r\n\r\nMicrosoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by support professionals. For some problems, MSDT may prompt the user to download additional tools for troubleshooting.\r\n\r\nThese tools are required to completely troubleshoot the problem. If tool download is restricted, it may not be possible to find the root cause of the problem.\r\n\r\nIf you enable this policy setting for remote troubleshooting, MSDT prompts the user to download additional tools to diagnose problems on remote computers only. If you enable this policy setting for local and remote troubleshooting, MSDT always prompts for additional tool downloading.\r\n\r\nIf you disable this policy setting, MSDT never downloads tools, and is unable to diagnose problems on remote computers.\r\n\r\nIf you do not configure this policy setting, MSDT prompts the user before downloading any additional tools.\r\n\r\nNo reboots or service restarts are required for this policy setting to take effect. Changes take effect immediately.\r\n\r\nThis policy setting will take effect only when MSDT is enabled.\r\n\r\nThis policy setting will only take effect when the Diagnostic Policy Service (DPS) is in the running state. When the service is stopped or disabled, diagnostic scenarios are not executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msdt#admx-msdt-msdttooldownloadpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_msdt_msdttooldownloadpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msdt_msdttooldownloadpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msdt_msdttooldownloadpolicy_msdttooldownloadpolicylevel","displayName":"Tool downloads allowed (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_msdt_msdttooldownloadpolicy_msdttooldownloadpolicylevel_1","displayName":"Remote troubleshooting only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msdt_msdttooldownloadpolicy_msdttooldownloadpolicylevel_2","displayName":"Local and remote troubleshooting","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msdt_wdiscenarioexecutionpolicy","displayName":"Microsoft Support Diagnostic Tool: Configure execution level","description":"This policy setting determines the execution level for Microsoft Support Diagnostic Tool.\r\n\r\nMicrosoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by support professionals.\r\n\r\nIf you enable this policy setting, administrators can use MSDT to collect and send diagnostic data to a support professional to resolve a problem.\r\n\r\nIf you disable this policy setting, MSDT cannot gather diagnostic data.\r\n\r\nIf you do not configure this policy setting, MSDT is turned on by default.\r\n\r\nThis policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.\r\n\r\nNo reboots or service restarts are required for this policy setting to take effect. Changes take effect immediately.\r\n\r\nThis policy setting will only take effect when the Diagnostic Policy Service (DPS) is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msdt#admx-msdt-wdiscenarioexecutionpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_msdt_wdiscenarioexecutionpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msdt_wdiscenarioexecutionpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_allowlockdownbrowse","displayName":"Allow users to browse for source while elevated","description":"This policy setting allows users to search for installation files during privileged installations.\r\n\r\nIf you enable this policy setting, the Browse button in the \"Use feature from\" dialog box is enabled. As a result, users can search for installation files even when the installation program is running with elevated system privileges.\r\n\r\nBecause the installation is running with elevated system privileges, users can browse through directories that their own permissions would not allow.\r\n\r\nThis policy setting does not affect installations that run in the user's security context. Also, see the \"Remove browse dialog box for new source\" policy setting.\r\n\r\nIf you disable or do not configure this policy setting, by default, only system administrators can browse during installations with elevated privileges, such as installations offered on the desktop or displayed in Add or Remove Programs.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-allowlockdownbrowse"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_allowlockdownbrowse_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_allowlockdownbrowse_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_allowlockdownmedia","displayName":"Allow users to use media source while elevated","description":"This policy setting allows users to install programs from removable media during privileged installations.\r\n\r\nIf you enable this policy setting, all users are permitted to install programs from removable media, such as floppy disks and CD-ROMs, even when the installation program is running with elevated system privileges.\r\n\r\nThis policy setting does not affect installations that run in the user's security context. By default, users can install from removable media when the installation runs in their own security context.\r\n\r\nIf you disable or do not configure this policy setting, by default, users can install programs from removable media only when the installation runs in the user's security context. During privileged installations, such as those offered on the desktop or displayed in Add or Remove Programs, only system administrators can install from removable media.\r\n\r\nAlso, see the \"Prevent removable media source for any install\" policy setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-allowlockdownmedia"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_allowlockdownmedia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_allowlockdownmedia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_allowlockdownpatch","displayName":"Allow users to patch elevated products","description":"This policy setting allows users to patch elevated products.\r\n\r\nIf you enable this policy setting, all users are permitted to install patches, even when the installation program is running with elevated system privileges. Patches are updates or upgrades that replace only those program files that have changed. Because patches can easily be vehicles for malicious programs, some installations prohibit their use.\r\n\r\nIf you disable or do not configure this policy setting, by default, only system administrators can apply patches during installations with elevated privileges, such as installations offered on the desktop or displayed in Add or Remove Programs.\r\n\r\nThis policy setting does not affect installations that run in the user's security context. By default, users can install patches to programs that run in their own security context. Also, see the \"Prohibit patching\" policy setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-allowlockdownpatch"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_allowlockdownpatch_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_allowlockdownpatch_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_disableautomaticapplicationshutdown","displayName":"Prohibit use of Restart Manager","description":"This policy setting controls Windows Installer's interaction with the Restart Manager. The Restart Manager API can eliminate or reduce the number of system restarts that are required to complete an installation or update.\r\n\r\nIf you enable this policy setting, you can use the options in the Prohibit Use of Restart Manager box to control file in use detection behavior.\r\n\r\n-- The \"Restart Manager On\" option instructs Windows Installer to use Restart Manager to detect files in use and mitigate a system restart, when possible.\r\n\r\n-- The \"Restart Manager Off\" option turns off Restart Manager for file in use detection and the legacy file in use behavior is used.\r\n\r\n-- The \"Restart Manager Off for Legacy App Setup\" option applies to packages that were created for Windows Installer versions lesser than 4.0. This option lets those packages display the legacy files in use UI while still using Restart Manager for detection.\r\n\r\nIf you disable or do not configure this policy setting, Windows Installer will use Restart Manager to detect files in use and mitigate a system restart, when possible.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-disableautomaticapplicationshutdown"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_disableautomaticapplicationshutdown_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_disableautomaticapplicationshutdown_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_disableautomaticapplicationshutdown_disableautomaticapplicationshutdown","displayName":"Prohibit Usage of Restart Manager (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_disableautomaticapplicationshutdown_disableautomaticapplicationshutdown_0","displayName":"Restart Manager On","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_disableautomaticapplicationshutdown_disableautomaticapplicationshutdown_1","displayName":"Restart Manager Off","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_disableautomaticapplicationshutdown_disableautomaticapplicationshutdown_2","displayName":"Restart Manager Off for Legacy App Setup","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_disablebrowse","displayName":"Remove browse dialog box for new source","description":"\r\n This policy setting prevents users from searching for installation files when they add features or components to an installed program.\r\n\r\n If you enable this policy setting, the Browse button beside the \"Use feature from\" list in the Windows Installer dialog box is disabled. As a result, users must select an installation file source from the \"Use features from\" list that the system administrator configures.\r\n\r\n This policy setting applies even when the installation is running in the user's security context.\r\n\r\n If you disable or do not configure this policy setting, the Browse button is enabled when an installation is running in the user's security context. But only system administrators can browse when an installation is running with elevated system privileges, such as installations offered on the desktop or in Add or Remove Programs.\r\n\r\n This policy setting affects Windows Installer only. It does not prevent users from selecting other browsers, such as File Explorer or Network Locations, to search for installation files.\r\n\r\n Also, see the \"Enable user to browse for source while elevated\" policy setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-disablebrowse"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_disablebrowse_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_disablebrowse_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_disableflyweightpatching","displayName":"Prohibit flyweight patching","description":"This policy setting controls the ability to turn off all patch optimizations.\r\n\r\nIf you enable this policy setting, all Patch Optimization options are turned off during the installation.\r\n\r\nIf you disable or do not configure this policy setting, it enables faster application of patches by removing execution of unnecessary actions. The flyweight patching mode is primarily designed for patches that just update a few files or registry values. The Installer will analyze the patch for specific changes to determine if optimization is possible. If so, the patch will be applied using a minimal set of processing.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-disableflyweightpatching"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_disableflyweightpatching_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_disableflyweightpatching_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_disableflyweightpatching_disableflyweightpatching","displayName":"Prohibit Flyweight Patching (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_disableflyweightpatching_disableflyweightpatching_1","displayName":"Patch Optimization Off","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_disableflyweightpatching_disableflyweightpatching_0","displayName":"Patch Optimization On","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_disableloggingfrompackage","displayName":"Turn off logging via package settings","description":"This policy setting controls Windows Installer's processing of the MsiLogging property. The MsiLogging property in an installation package can be used to enable automatic logging of all install operations for the package.\r\n\r\nIf you enable this policy setting, you can use the options in the Disable logging via package settings box to control automatic logging via package settings behavior.\r\n\r\n-- The \"Logging via package settings on\" option instructs Windows Installer to automatically generate log files for packages that include the MsiLogging property.\r\n\r\n-- The \"Logging via package settings off\" option turns off the automatic logging behavior when specified via the MsiLogging policy. Log files can still be generated using the logging command line switch or the Logging policy.\r\n\r\nIf you disable or do not configure this policy setting, Windows Installer will automatically generate log files for those packages that include the MsiLogging property.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-disableloggingfrompackage"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_disableloggingfrompackage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_disableloggingfrompackage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_disableloggingfrompackage_disableloggingfrompackage","displayName":"Disable logging via package settings (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_disableloggingfrompackage_disableloggingfrompackage_1","displayName":"Disable logging via package settings off","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_disableloggingfrompackage_disableloggingfrompackage_0","displayName":"Disable logging via package settings on","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_disablemsi","displayName":"Turn off Windows Installer","description":"This policy setting restricts the use of Windows Installer.\r\n\r\nIf you enable this policy setting, you can prevent users from installing software on their systems or permit users to install only those programs offered by a system administrator. You can use the options in the Disable Windows Installer box to establish an installation setting.\r\n\r\n-- The \"Never\" option indicates Windows Installer is fully enabled. Users can install and upgrade software. This is the default behavior for Windows Installer on Windows 2000 Professional, Windows XP Professional and Windows Vista when the policy is not configured.\r\n\r\n-- The \"For non-managed applications only\" option permits users to install only those programs that a system administrator assigns (offers on the desktop) or publishes (adds them to Add or Remove Programs). This is the default behavior of Windows Installer on Windows Server 2003 family when the policy is not configured.\r\n\r\n-- The \"Always\" option indicates that Windows Installer is disabled.\r\n\r\nThis policy setting affects Windows Installer only. It does not prevent users from using other methods to install and upgrade programs.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-disablemsi"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_disablemsi_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_disablemsi_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_disablemsi_disablemsi","displayName":"Disable Windows Installer (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_disablemsi_disablemsi_2","displayName":"Always","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_disablemsi_disablemsi_1","displayName":"For non-managed applications only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_disablemsi_disablemsi_0","displayName":"Never","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_disablepatch","displayName":"Prevent users from using Windows Installer to install updates and upgrades","description":"This policy setting prevents users from using Windows Installer to install patches.\r\n\r\nIf you enable this policy setting, users are prevented from using Windows Installer to install patches. Patches are updates or upgrades that replace only those program files that have changed. Because patches can be easy vehicles for malicious programs, some installations prohibit their use.\r\n\r\nNote: This policy setting applies only to installations that run in the user's security context.\r\n\r\nIf you disable or do not configure this policy setting, by default, users who are not system administrators cannot apply patches to installations that run with elevated system privileges, such as those offered on the desktop or in Add or Remove Programs.\r\n\r\nAlso, see the \"Enable user to patch elevated products\" policy setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-disablepatch"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_disablepatch_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_disablepatch_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_disablerollback_2","displayName":"Prohibit rollback","description":"This policy setting prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation.\r\n\r\nIf you enable this policy setting, Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete.\r\n\r\nThis policy setting is designed to reduce the amount of temporary disk space required to install programs. Also, it prevents malicious users from interrupting an installation to gather data about the internal state of the computer or to search secure system files. However, because an incomplete installation can render the system or a program inoperable, do not use this policy setting unless it is essential.\r\n\r\nThis policy setting appears in the Computer Configuration and User Configuration folders. If the policy setting is enabled in either folder, it is considered be enabled, even if it is explicitly disabled in the other folder.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-disablerollback-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_disablerollback_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_disablerollback_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_disablesharedcomponent","displayName":"Turn off shared components","description":"This policy setting controls the ability to turn off shared components.\r\n\r\nIf you enable this policy setting, no packages on the system get the shared component functionality enabled by the msidbComponentAttributesShared attribute in the Component Table.\r\n\r\nIf you disable or do not configure this policy setting, by default, the shared component functionality is allowed.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-disablesharedcomponent"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_disablesharedcomponent_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_disablesharedcomponent_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_msi_disableluapatching","displayName":"Prohibit non-administrators from applying vendor signed updates","description":"This policy setting controls the ability of non-administrators to install updates that have been digitally signed by the application vendor.\r\n\r\nNon-administrator updates provide a mechanism for the author of an application to create digitally signed updates that can be applied by non-privileged users.\r\n\r\nIf you enable this policy setting, only administrators or users with administrative privileges can apply updates to Windows Installer based applications.\r\n\r\nIf you disable or do not configure this policy setting, users without administrative privileges can install non-administrator updates.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-msi-disableluapatching"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_msi_disableluapatching_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_msi_disableluapatching_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_msi_disablepatchuninstall","displayName":"Prohibit removal of updates","description":"This policy setting controls the ability for users or administrators to remove Windows Installer based updates.\r\n\r\nThis policy setting should be used if you need to maintain a tight control over updates. One example is a lockdown environment where you want to ensure that updates once installed cannot be removed by users or administrators.\r\n\r\nIf you enable this policy setting, updates cannot be removed from the computer by a user or an administrator. The Windows Installer can still remove an update that is no longer applicable to the product.\r\n\r\nIf you disable or do not configure this policy setting, a user can remove an update from the computer only if the user has been granted privileges to remove the update. This can depend on whether the user is an administrator, whether \"Disable Windows Installer\" and \"Always install with elevated privileges\" policy settings are set, and whether the update was installed in a per-user managed, per-user unmanaged, or per-machine context.\"\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-msi-disablepatchuninstall"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_msi_disablepatchuninstall_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_msi_disablepatchuninstall_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_msi_disablesrcheckpoints","displayName":"Turn off creation of System Restore checkpoints","description":"This policy setting prevents Windows Installer from creating a System Restore checkpoint each time an application is installed. System Restore enables users, in the event of a problem, to restore their computers to a previous state without losing personal data files.\r\n\r\nIf you enable this policy setting, the Windows Installer does not generate System Restore checkpoints when installing applications.\r\n\r\nIf you disable or do not configure this policy setting, by default, the Windows Installer automatically creates a System Restore checkpoint each time an application is installed, so that users can restore their computer to the state it was in before installing the application.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-msi-disablesrcheckpoints"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_msi_disablesrcheckpoints_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_msi_disablesrcheckpoints_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_msi_disableuserinstalls","displayName":"Prohibit User Installs","description":"This policy setting allows you to configure user installs. To configure this policy setting, set it to enabled and use the drop-down list to select the behavior you want.\r\n\r\nIf you do not configure this policy setting, or if the policy setting is enabled and \"Allow User Installs\" is selected, the installer allows and makes use of products that are installed per user, and products that are installed per computer. If the installer finds a per-user install of an application, this hides a per-computer installation of that same product.\r\n\r\nIf you enable this policy setting and \"Hide User Installs\" is selected, the installer ignores per-user applications. This causes a per-computer installed application to be visible to users, even if those users have a per-user install of the product registered in their user profile.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-msi-disableuserinstalls"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_msi_disableuserinstalls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_msi_disableuserinstalls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_msi_disableuserinstalls_msi_disableuserinstallsbox","displayName":"User Install Behavior: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_msi_disableuserinstalls_msi_disableuserinstallsbox_0","displayName":"Allow User Installs","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_msi_disableuserinstalls_msi_disableuserinstallsbox_1","displayName":"Hide User Installs","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_msi_enforceupgradecomponentrules","displayName":"Enforce upgrade component rules","description":"This policy setting causes the Windows Installer to enforce strict rules for component upgrades.\r\n\r\nIf you enable this policy setting, strict upgrade rules will be enforced by the Windows Installer which may cause some upgrades to fail. Upgrades can fail if they attempt to do one of the following:\r\n\r\n(1) Remove a component from a feature.\r\nThis can also occur if you change the GUID of a component. The component identified by the original GUID appears to be removed and the component as identified by the new GUID appears as a new component.\r\n\r\n(2) Add a new feature to the top or middle of an existing feature tree.\r\nThe new feature must be added as a new leaf feature to an existing feature tree.\r\n\r\nIf you disable or do not configure this policy setting, the Windows Installer will use less restrictive rules for component upgrades.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-msi-enforceupgradecomponentrules"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_msi_enforceupgradecomponentrules_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_msi_enforceupgradecomponentrules_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_msi_maxpatchcachesize","displayName":"Control maximum size of baseline file cache","description":"\r\n This policy controls the percentage of disk space available to the Windows Installer baseline file cache.\r\n\r\n The Windows Installer uses the baseline file cache to save baseline files modified by binary delta difference updates. The cache is used to retrieve the baseline file for future updates. The cache eliminates user prompts for source media when new updates are applied.\r\n\r\n If you enable this policy setting you can modify the maximum size of the Windows Installer baseline file cache.\r\n\r\n If you set the baseline cache size to 0, the Windows Installer will stop populating the baseline cache for new updates. The existing cached files will remain on disk and will be deleted when the product is removed.\r\n\r\n If you set the baseline cache to 100, the Windows Installer will use available free space for the baseline file cache.\r\n\r\n If you disable or do not configure this policy setting, the Windows Installer will uses a default value of 10 percent for the baseline file cache maximum size.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-msi-maxpatchcachesize"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_msi_maxpatchcachesize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_msi_maxpatchcachesize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_msi_maxpatchcachesize_msi_maxpatchcachesize","displayName":"Baseline file cache maximum size (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_msi_msidisableembeddedui","displayName":"Prevent embedded UI","description":"This policy setting controls the ability to prevent embedded UI.\r\n\r\nIf you enable this policy setting, no packages on the system can run embedded UI.\r\n\r\nIf you disable or do not configure this policy setting, embedded UI is allowed to run.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-msidisableembeddedui"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_msidisableembeddedui_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_msidisableembeddedui_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_msilogging","displayName":"Specify the types of events Windows Installer records in its transaction log","description":"\r\n Specifies the types of events that Windows Installer records in its transaction log for each installation. The log, Msi.log, appears in the Temp directory of the system volume.\r\n\r\n When you enable this policy setting, you can specify the types of events you want Windows Installer to record. To indicate that an event type is recorded, type the letter representing the event type. You can type the letters in any order and list as many or as few event types as you want.\r\n\r\n To disable logging, delete all of the letters from the box.\r\n\r\n If you disable or do not configure this policy setting, Windows Installer logs the default event types, represented by the letters \"iweap.\"\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-msilogging"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_msilogging_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_msilogging_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_msilogging_msilogging","displayName":"Logging (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_msi_safeforscripting","displayName":"Prevent Internet Explorer security prompt for Windows Installer scripts","description":"This policy setting allows Web-based programs to install software on the computer without notifying the user.\r\n\r\nIf you disable or do not configure this policy setting, by default, when a script hosted by an Internet browser tries to install a program on the system, the system warns users and allows them to select or refuse the installation.\r\n\r\nIf you enable this policy setting, the warning is suppressed and allows the installation to proceed.\r\n\r\nThis policy setting is designed for enterprises that use Web-based tools to distribute programs to their employees. However, because this policy setting can pose a security risk, it should be applied cautiously.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-safeforscripting"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_safeforscripting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_safeforscripting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msi_transformssecure","displayName":"Save copies of transform files in a secure location on workstation","description":"This policy setting saves copies of transform files in a secure location on the local computer.\r\n\r\nTransform files consist of instructions to modify or customize a program during installation.\r\n\r\nIf you enable this policy setting, the transform file is saved in a secure location on the user's computer.\r\n\r\nIf you do not configure this policy setting on Windows Server 2003, Windows Installer requires the transform file in order to repeat an installation in which the transform file was used, therefore, the user must be using the same computer or be connected to the original or identical media to reinstall, remove, or repair the installation.\r\n\r\nThis policy setting is designed for enterprises to prevent unauthorized or malicious editing of transform files.\r\n\r\nIf you disable this policy setting, Windows Installer stores transform files in the Application Data directory in the user's profile.\r\n\r\nIf you do not configure this policy setting on Windows 2000 Professional, Windows XP Professional and Windows Vista, when a user reinstalls, removes, or repairs an installation, the transform file is available, even if the user is on a different computer or is not connected to the network.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msi#admx-msi-transformssecure"],"options":[{"id":"device_vendor_msft_policy_config_admx_msi_transformssecure_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msi_transformssecure_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msifilerecovery_wdiscenarioexecutionpolicy","displayName":"Configure MSI Corrupted File Recovery behavior","description":"This policy setting allows you to configure the recovery behavior for corrupted MSI files to one of three states:\r\n\r\nPrompt for Resolution: Detection, troubleshooting, and recovery of corrupted MSI applications will be turned on. Windows will prompt the user with a dialog box when application reinstallation is required. This is the default recovery behavior on Windows client.\r\n\r\nSilent: Detection, troubleshooting, and notification of MSI application to reinstall will occur with no UI. Windows will log an event when corruption is determined and will suggest the application that should be re-installed. This behavior is recommended for headless operation and is the default recovery behavior on Windows server.\r\n\r\nTroubleshooting Only: Detection and verification of file corruption will be performed without UI. Recovery is not attempted.\r\n\r\nIf you enable this policy setting, the recovery behavior for corrupted files is set to either the Prompt For Resolution (default on Windows client), Silent (default on Windows server), or Troubleshooting Only. \r\n\r\nIf you disable this policy setting, the troubleshooting and recovery behavior for corrupted files will be disabled. No troubleshooting or resolution will be attempted.\r\n\r\nIf you do not configure this policy setting, the recovery behavior for corrupted files will be set to the default recovery behavior.\r\n\r\nNo system or service restarts are required for changes to this policy setting to take immediate effect after a Group Policy refresh.\r\n\r\nNote: This policy setting will take effect only when the Diagnostic Policy Service (DPS) is in the running state. When the service is stopped or disabled, system file recovery will not be attempted. The DPS can be configured with the Services snap-in to the Microsoft Management Console.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-msifilerecovery#admx-msifilerecovery-wdiscenarioexecutionpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_msifilerecovery_wdiscenarioexecutionpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msifilerecovery_wdiscenarioexecutionpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_msifilerecovery_wdiscenarioexecutionpolicy_wdiscenarioexecutionpolicylevel","displayName":"Scenario Execution Level (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_msifilerecovery_wdiscenarioexecutionpolicy_wdiscenarioexecutionpolicylevel_1","displayName":"Troubleshooting Only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msifilerecovery_wdiscenarioexecutionpolicy_wdiscenarioexecutionpolicylevel_2","displayName":"Prompt for Resolution","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_msifilerecovery_wdiscenarioexecutionpolicy_wdiscenarioexecutionpolicylevel_3","displayName":"Silent","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_autoadminlogon","displayName":"MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)","description":"MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mss-legacy#admx-mss-legacy-pol-mss-autoadminlogon"],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_autoadminlogon_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_autoadminlogon_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_autoreboot","displayName":"MSS: (AutoReboot) Allow Windows to automatically restart after a system crash (recommended except for highly secure environments)","description":"MSS: (AutoReboot) Allow Windows to automatically restart after a system crash (recommended except for highly secure environments)\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mss-legacy#admx-mss-legacy-pol-mss-autoreboot"],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_autoreboot_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_autoreboot_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_autoshareserver","displayName":"MSS: (AutoShareServer) Enable Administrative Shares (recommended except for highly secure environments)","description":"MSS: (AutoShareServer) Enable Administrative Shares (recommended except for highly secure environments)\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mss-legacy#admx-mss-legacy-pol-mss-autoshareserver"],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_autoshareserver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_autoshareserver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_autosharewks","displayName":"MSS: (AutoShareWks) Enable Administrative Shares (recommended except for highly secure environments)","description":"MSS: (AutoShareWks) Enable Administrative Shares (recommended except for highly secure environments)\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mss-legacy#admx-mss-legacy-pol-mss-autosharewks"],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_autosharewks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_autosharewks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_disablesavepassword","displayName":"MSS: (DisableSavePassword) Prevent the dial-up passsword from being saved (recommended)","description":"MSS: (DisableSavePassword) Prevent the dial-up passsword from being saved (recommended)\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mss-legacy#admx-mss-legacy-pol-mss-disablesavepassword"],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_disablesavepassword_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_disablesavepassword_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_enabledeadgwdetect","displayName":"MSS: (EnableDeadGWDetect) Allow automatic detection of dead network gateways (could lead to DoS)","description":"MSS: (EnableDeadGWDetect) Allow automatic detection of dead network gateways (could lead to DoS)\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mss-legacy#admx-mss-legacy-pol-mss-enabledeadgwdetect"],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_enabledeadgwdetect_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_enabledeadgwdetect_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_hidefrombrowselist","displayName":"MSS: (Hidden) Hide Computer From the Browse List (not recommended except for highly secure environments)","description":"MSS: (Hidden) Hide Computer From the Browse List (not recommended except for highly secure environments)\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mss-legacy#admx-mss-legacy-pol-mss-hidefrombrowselist"],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_hidefrombrowselist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_hidefrombrowselist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_keepalivetime","displayName":"MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds","description":"MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mss-legacy#admx-mss-legacy-pol-mss-keepalivetime"],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_keepalivetime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_keepalivetime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_keepalivetime_keepalivetime","displayName":"KeepAliveTime (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_keepalivetime_keepalivetime_150000","displayName":"150000 or 2.5 minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_keepalivetime_keepalivetime_300000","displayName":"300000 or 5 minutes (recommended) ","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_keepalivetime_keepalivetime_600000","displayName":"600000 or 10 minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_keepalivetime_keepalivetime_1200000","displayName":"1200000 or 20 minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_keepalivetime_keepalivetime_2400000","displayName":"2400000 or 40 minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_keepalivetime_keepalivetime_3600000","displayName":"3600000 or 1 hour","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_keepalivetime_keepalivetime_7200000","displayName":"7200000 or 2 hours (default value)","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_nodefaultexempt","displayName":"MSS: (NoDefaultExempt) Configure IPSec exemptions for various types of network traffic.","description":"MSS: (NoDefaultExempt) Configure IPSec exemptions for various types of network traffic. \n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mss-legacy#admx-mss-legacy-pol-mss-nodefaultexempt"],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_nodefaultexempt_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_nodefaultexempt_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_nodefaultexempt_nodefaultexempt","displayName":"NoDefaultExempt (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_nodefaultexempt_nodefaultexempt_0","displayName":"Allow all exemptions.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_nodefaultexempt_nodefaultexempt_1","displayName":"Multicast, broadcast, & ISAKMP exempt.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_nodefaultexempt_nodefaultexempt_2","displayName":"RSVP, Kerberos, and ISAKMP are exempt.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_nodefaultexempt_nodefaultexempt_3","displayName":"Only ISAKMP is exempt.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_ntfsdisable8dot3namecreation","displayName":"MSS: (NtfsDisable8dot3NameCreation) Enable the computer to stop generating 8.3 style filenames","description":"MSS: (NtfsDisable8dot3NameCreation) Enable the computer to stop generating 8.3 style filenames\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mss-legacy#admx-mss-legacy-pol-mss-ntfsdisable8dot3namecreation"],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_ntfsdisable8dot3namecreation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_ntfsdisable8dot3namecreation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_ntfsdisable8dot3namecreation_ntfsdisable8dot3namecreation","displayName":"NtfsDisable8dot3NameCreation (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_ntfsdisable8dot3namecreation_ntfsdisable8dot3namecreation_0","displayName":"Enable 8Dot3 Creation on all Volumes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_ntfsdisable8dot3namecreation_ntfsdisable8dot3namecreation_1","displayName":"Disable 8Dot3 Creation on all Volumes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_ntfsdisable8dot3namecreation_ntfsdisable8dot3namecreation_2","displayName":"Set 8dot3 name creation per volume using FSUTIL","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_ntfsdisable8dot3namecreation_ntfsdisable8dot3namecreation_3","displayName":"Disable 8Dot3 name creation on all volumes except system volume","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_performrouterdiscovery","displayName":"MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)","description":"MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mss-legacy#admx-mss-legacy-pol-mss-performrouterdiscovery"],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_performrouterdiscovery_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_performrouterdiscovery_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_safedllsearchmode","displayName":"MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)","description":"MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mss-legacy#admx-mss-legacy-pol-mss-safedllsearchmode"],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_safedllsearchmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_safedllsearchmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_screensavergraceperiod","displayName":"MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)","description":"MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mss-legacy#admx-mss-legacy-pol-mss-screensavergraceperiod"],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_screensavergraceperiod_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_screensavergraceperiod_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_screensavergraceperiod_screensavergraceperiod","displayName":"ScreenSaverGracePeriod (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_synattackprotect","displayName":"MSS: (SynAttackProtect) Syn attack protection level (protects against DoS)","description":"MSS: (SynAttackProtect) Syn attack protection level (protects against DoS)\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mss-legacy#admx-mss-legacy-pol-mss-synattackprotect"],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_synattackprotect_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_synattackprotect_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_synattackprotect_synattackprotect","displayName":"SynAttackProtect (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_synattackprotect_synattackprotect_0","displayName":"No additional protection, use default settings","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_synattackprotect_synattackprotect_1","displayName":"Connections time out sooner if a SYN attack is detected","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_tcpmaxconnectresponseretransmissions","displayName":"MSS: (TcpMaxConnectResponseRetransmissions) SYN-ACK retransmissions when a connection request is not acknowledged","description":"MSS: (TcpMaxConnectResponseRetransmissions) SYN-ACK retransmissions when a connection request is not acknowledged\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mss-legacy#admx-mss-legacy-pol-mss-tcpmaxconnectresponseretransmissions"],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_tcpmaxconnectresponseretransmissions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_tcpmaxconnectresponseretransmissions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_tcpmaxconnectresponseretransmissions_tcpmaxconnectresponseretransmissions","displayName":"TcpMaxConnectResponseRetransmissions (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_tcpmaxconnectresponseretransmissions_tcpmaxconnectresponseretransmissions_0","displayName":"No retransmission, half-open connections dropped after 3 seconds","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_tcpmaxconnectresponseretransmissions_tcpmaxconnectresponseretransmissions_1","displayName":"3 seconds, half-open connections dropped after 9 seconds","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_tcpmaxconnectresponseretransmissions_tcpmaxconnectresponseretransmissions_2","displayName":"3 & 6 seconds, half-open connections dropped after 21 seconds","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_tcpmaxconnectresponseretransmissions_tcpmaxconnectresponseretransmissions_3","displayName":"3, 6, & 9 seconds, half-open connections dropped after 45 seconds","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_tcpmaxdataretransmissions","displayName":"MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)","description":"MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mss-legacy#admx-mss-legacy-pol-mss-tcpmaxdataretransmissions"],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_tcpmaxdataretransmissions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_tcpmaxdataretransmissions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_tcpmaxdataretransmissions_tcpmaxdataretransmissions","displayName":"TcpMaxDataRetransmissions (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_tcpmaxdataretransmissionsipv6","displayName":"MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)","description":"MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mss-legacy#admx-mss-legacy-pol-mss-tcpmaxdataretransmissionsipv6"],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_tcpmaxdataretransmissionsipv6_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_tcpmaxdataretransmissionsipv6_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_tcpmaxdataretransmissionsipv6_tcpmaxdataretransmissions","displayName":"TcpMaxDataRetransmissions (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_warninglevel","displayName":"MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning","description":"MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-mss-legacy#admx-mss-legacy-pol-mss-warninglevel"],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_warninglevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_warninglevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_warninglevel_warninglevel","displayName":"WarningLevel (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_warninglevel_warninglevel_50","displayName":"50%","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_warninglevel_warninglevel_60","displayName":"60%","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_warninglevel_warninglevel_70","displayName":"70%","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_warninglevel_warninglevel_80","displayName":"80%","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_mss-legacy_pol_mss_warninglevel_warninglevel_90","displayName":"90%","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_nca_corporateresources","displayName":"Corporate Resources","description":"Specifies resources on your intranet that are normally accessible to DirectAccess clients. Each entry is a string that identifies the type of resource and the location of the resource. \r\n\r\nEach string can be one of the following types:\r\n\t \r\n- A DNS name or IPv6 address that NCA pings. The syntax is “PING:” followed by a fully qualified domain name (FQDN) that resolves to an IPv6 address, or an IPv6 address. Examples: PING:myserver.corp.contoso.com or PING:2002:836b:1::1. \r\n \r\nNote \r\n\r\nWe recommend that you use FQDNs instead of IPv6 addresses wherever possible.\r\n\r\nImportant \r\n\r\nAt least one of the entries must be a PING: resource.\r\n\r\n-\tA Uniform Resource Locator (URL) that NCA queries with a Hypertext Transfer Protocol (HTTP) request. The contents of the web page do not matter. The syntax is “HTTP:” followed by a URL. The host portion of the URL must resolve to an IPv6 address of a Web server or contain an IPv6 address. Examples: HTTP:http://myserver.corp.contoso.com/ or HTTP:http://2002:836b:1::1/.\r\n\r\n-\tA Universal Naming Convention (UNC) path to a file that NCA checks for existence. The contents of the file do not matter. The syntax is “FILE:” followed by a UNC path. The ComputerName portion of the UNC path must resolve to an IPv6 address or contain an IPv6 address. Examples: FILE:\\\\myserver\\myshare\\test.txt or FILE:\\\\2002:836b:1::1\\myshare\\test.txt.\r\n\r\nYou must configure this setting to have complete NCA functionality.\r\n\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-nca#admx-nca-corporateresources"],"options":[{"id":"device_vendor_msft_policy_config_admx_nca_corporateresources_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_nca_corporateresources_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_nca_corporateresources_corporateresources_control","displayName":"Corporate Resources (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_nca_customcommands","displayName":"Custom Commands","description":"Specifies commands configured by the administrator for custom logging. These commands will run in addition to default log commands.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-nca#admx-nca-customcommands"],"options":[{"id":"device_vendor_msft_policy_config_admx_nca_customcommands_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_nca_customcommands_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_nca_customcommands_customcommands_control","displayName":"CustomCommands (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_nca_dtes","displayName":"IPsec Tunnel Endpoints","description":"Specifies the IPv6 addresses of the endpoints of the Internet Protocol security (IPsec) tunnels that enable DirectAccess. NCA attempts to access the resources that are specified in the Corporate Resources setting through these configured tunnel endpoints. \r\n\r\nBy default, NCA uses the same DirectAccess server that the DirectAccess client computer connection is using. In default configurations of DirectAccess, there are typically two IPsec tunnel endpoints: one for the infrastructure tunnel and one for the intranet tunnel. You should configure one endpoint for each tunnel. \r\n\t \r\nEach entry consists of the text PING: followed by the IPv6 address of an IPsec tunnel endpoint. Example: PING:2002:836b:1::836b:1.\r\n\r\nYou must configure this setting to have complete NCA functionality.\r\n\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-nca#admx-nca-dtes"],"options":[{"id":"device_vendor_msft_policy_config_admx_nca_dtes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_nca_dtes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_nca_dtes_dtes_control","displayName":"DTEs (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_nca_friendlyname","displayName":"Friendly Name","description":"Specifies the string that appears for DirectAccess connectivity when the user clicks the Networking notification area icon. For example, you can specify “Contoso Intranet Access” for the DirectAccess clients of the Contoso Corporation.\r\n\r\nIf this setting is not configured, the string that appears for DirectAccess connectivity is “Corporate Connection”.\r\n\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-nca#admx-nca-friendlyname"],"options":[{"id":"device_vendor_msft_policy_config_admx_nca_friendlyname_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_nca_friendlyname_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_nca_friendlyname_friendlyname_control","displayName":"Friendly Name (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_nca_localnameson","displayName":"Prefer Local Names Allowed","description":"Specifies whether the user has Connect and Disconnect options for the DirectAccess entry when the user clicks the Networking notification area icon.\r\n\r\nIf the user clicks the Disconnect option, NCA removes the DirectAccess rules from the Name Resolution Policy Table (NRPT) and the DirectAccess client computer uses whatever normal name resolution is available to the client computer in its current network configuration, including sending all DNS queries to the local intranet or Internet DNS servers. Note that NCA does not remove the existing IPsec tunnels and users can still access intranet resources across the DirectAccess server by specifying IPv6 addresses rather than names.\r\n\r\nThe ability to disconnect allows users to specify single-label, unqualified names (such as “PRINTSVR”) for local resources when connected to a different intranet and for temporary access to intranet resources when network location detection has not correctly determined that the DirectAccess client computer is connected to its own intranet.\r\n\r\nTo restore the DirectAccess rules to the NRPT and resume normal DirectAccess functionality, the user clicks Connect.\r\n\r\nNote \r\nIf the DirectAccess client computer is on the intranet and has correctly determined its network location, the Disconnect option has no effect because the rules for DirectAccess are already removed from the NRPT.\r\n\r\nIf this setting is not configured, users do not have Connect or Disconnect options.\r\n\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-nca#admx-nca-localnameson"],"options":[{"id":"device_vendor_msft_policy_config_admx_nca_localnameson_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_nca_localnameson_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_nca_passivemode","displayName":"DirectAccess Passive Mode","description":"Specifies whether NCA service runs in Passive Mode or not.\r\n\r\nSet this to Disabled to keep NCA probing actively all the time. If this setting is not configured, NCA probing is in active mode by default.\r\n\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-nca#admx-nca-passivemode"],"options":[{"id":"device_vendor_msft_policy_config_admx_nca_passivemode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_nca_passivemode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_nca_showui","displayName":"User Interface","description":"Specifies whether an entry for DirectAccess connectivity appears when the user clicks the Networking notification area icon.\r\n\r\nSet this to Disabled to prevent user confusion when you are just using DirectAccess to remotely manage DirectAccess client computers from your intranet and not providing seamless intranet access. \r\n\r\nIf this setting is not configured, the entry for DirectAccess connectivity appears.\r\n\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-nca#admx-nca-showui"],"options":[{"id":"device_vendor_msft_policy_config_admx_nca_showui_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_nca_showui_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_nca_supportemail","displayName":"Support Email Address","description":"Specifies the e-mail address to be used when sending the log files that are generated by NCA to the network administrator. \r\n\r\nWhen the user sends the log files to the Administrator, NCA uses the default e-mail client to open a new message with the support email address in the To: field of the message, then attaches the generated log files as a .html file. The user can review the message and add additional information before sending the message.\r\n\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-nca#admx-nca-supportemail"],"options":[{"id":"device_vendor_msft_policy_config_admx_nca_supportemail_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_nca_supportemail_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_nca_supportemail_supportemail_control","displayName":"Support Email (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_corpdnsprobecontent","displayName":"Specify corporate DNS probe host address","description":"This policy setting enables you to specify the expected address of the host name used for the DNS probe. Successful resolution of the host name to this address indicates corporate connectivity.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-ncsi#admx-ncsi-ncsi-corpdnsprobecontent"],"options":[{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_corpdnsprobecontent_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_corpdnsprobecontent_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_corpdnsprobecontent_ncsi_corpdnsprobecontentbox","displayName":"Corporate DNS Probe Address: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_corpdnsprobehost","displayName":"Specify corporate DNS probe host name","description":"This policy setting enables you to specify the host name of a computer known to be on the corporate network. Successful resolution of this host name to the expected address indicates corporate connectivity.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-ncsi#admx-ncsi-ncsi-corpdnsprobehost"],"options":[{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_corpdnsprobehost_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_corpdnsprobehost_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_corpdnsprobehost_ncsi_corpdnsprobehostbox","displayName":"Corporate DNS Probe Hostname: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_corpsiteprefixes","displayName":"Specify corporate site prefix list","description":"This policy setting enables you to specify the list of IPv6 corporate site prefixes to monitor for corporate connectivity. Reachability of addresses with any of these prefixes indicates corporate connectivity.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-ncsi#admx-ncsi-ncsi-corpsiteprefixes"],"options":[{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_corpsiteprefixes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_corpsiteprefixes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_corpsiteprefixes_ncsi_corpsiteprefixesbox","displayName":"Corporate Site Prefix List: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_corpwebprobeurl","displayName":"Specify corporate Website probe URL","description":"This policy setting enables you to specify the URL of the corporate website, against which an active probe is performed.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-ncsi#admx-ncsi-ncsi-corpwebprobeurl"],"options":[{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_corpwebprobeurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_corpwebprobeurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_corpwebprobeurl_ncsi_corpwebprobeurlbox","displayName":"Corporate Website Probe URL: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_domainlocationdeterminationurl","displayName":"Specify domain location determination URL","description":"This policy setting enables you to specify the HTTPS URL of the corporate website that clients use to determine the current domain location (i.e. whether the computer is inside or outside the corporate network). Reachability of the URL destination indicates that the client location is inside corporate network; otherwise it is outside the network.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-ncsi#admx-ncsi-ncsi-domainlocationdeterminationurl"],"options":[{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_domainlocationdeterminationurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_domainlocationdeterminationurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_domainlocationdeterminationurl_ncsi_domainlocationdeterminationurlbox","displayName":"Corporate Domain Location Determination URL: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_globaldns","displayName":"Specify global DNS","description":"This policy setting enables you to specify DNS binding behavior. NCSI by default will restrict DNS lookups to the interface it is currently probing on. If you enable this setting, NCSI will allow the DNS lookups to happen on any interface.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-ncsi#admx-ncsi-ncsi-globaldns"],"options":[{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_globaldns_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_globaldns_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_globaldns_ncsi_useglobaldns_checkbox","displayName":"Use global DNS (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_globaldns_ncsi_useglobaldns_checkbox_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_globaldns_ncsi_useglobaldns_checkbox_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_passivepolling","displayName":"Specify passive polling","description":"This Policy setting enables you to specify passive polling behavior. NCSI polls various measurements throughout the network stack on a frequent interval to determine if network connectivity has been lost. Use the options to control the passive polling behavior.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-ncsi#admx-ncsi-ncsi-passivepolling"],"options":[{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_passivepolling_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_passivepolling_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_passivepolling_ncsi_disablepassivepolling_checkbox","displayName":"Disable passive polling (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_passivepolling_ncsi_disablepassivepolling_checkbox_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_ncsi_ncsi_passivepolling_ncsi_disablepassivepolling_checkbox_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_addresslookuponpingbehavior","displayName":"Specify address lookup behavior for DC locator ping","description":"This policy setting configures how a domain controller (DC) behaves when responding to a client whose IP address does not map to any configured site.\r\n\r\nDomain controllers use the client IP address during a DC locator ping request to compute which Active Directory site the client belongs to. If no site mapping can be computed, the DC may do an address lookup on the client network name to discover other IP addresses which may then be used to compute a matching site for the client. \r\n\r\nThe allowable values for this setting result in the following behaviors:\r\n\r\n0 - DCs will never perform address lookups.\r\n1 - DCs will perform an exhaustive address lookup to discover additional client IP addresses.\r\n2 - DCs will perform a fast, DNS-only address lookup to discover additional client IP addresses.\r\n\r\nTo specify this behavior in the DC Locator DNS SRV records, click Enabled, and then enter a value. The range of values is from 0 to 2.\r\n\r\nIf you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-addresslookuponpingbehavior"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_addresslookuponpingbehavior_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_addresslookuponpingbehavior_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_addresslookuponpingbehavior_netlogon_addresslookuponpingbehaviorlabel","displayName":"Address lookup behavior: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_addresstypereturned","displayName":"Return domain controller address type","description":"This policy setting detremines the type of IP address that is returned for a domain controller. The DC Locator APIs return the IP address of the DC with the other parts of information. Before the support of IPv6, the returned DC IP address was IPv4. But with the support of IPv6, the DC Locator APIs can return IPv6 DC address. The returned IPv6 DC address may not be correctly handled by some of the existing applications. So this policy is provided to support such scenarios.\r\n\r\nBy default, DC Locator APIs can return IPv4/IPv6 DC address. But if some applications are broken due to the returned IPv6 DC address, this policy can be used to disable the default behavior and enforce to return only IPv4 DC address. Once applications are fixed, this policy can be used to enable the default behavior.\r\n\r\nIf you enable this policy setting, DC Locator APIs can return IPv4/IPv6 DC address. This is the default behavior of the DC Locator.\r\n\r\nIf you disable this policy setting, DC Locator APIs will ONLY return IPv4 DC address if any. So if the domain controller supports both IPv4 and IPv6 addresses, DC Locator APIs will return IPv4 address. But if the domain controller supports only IPv6 address, then DC Locator APIs will fail.\r\n\r\nIf you do not configure this policy setting, DC Locator APIs can return IPv4/IPv6 DC address. This is the default behavior of the DC Locator.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-addresstypereturned"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_addresstypereturned_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_addresstypereturned_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_allowdnssuffixsearch","displayName":"Use DNS name resolution when a single-label domain name is used, by appending different registered DNS suffixes, if the AllowSingleLabelDnsDomain setting is not enabled.","description":"This policy setting specifies whether the computers to which this setting is applied attemps DNS name resolution of single-lablel domain names, by appending different registered DNS suffixes, and uses NetBIOS name resolution only if DNS name resolution fails. This policy, including the specified default behavior, is not used if the AllowSingleLabelDnsDomain policy setting is enabled.\r\n\r\nBy default, when no setting is specified for this policy, the behavior is the same as explicitly enabling this policy, unless the AllowSingleLabelDnsDomain policy setting is enabled.\r\n\r\nIf you enable this policy setting, when the AllowSingleLabelDnsDomain policy is not enabled, computers to which this policy is applied, will locate a domain controller hosting an Active Directory domain specified with a single-label name, by appending different registered DNS suffixes to perform DNS name resolution. The single-label name is not used without appending DNS suffixes unless the computer is joined to a domain that has a single-label DNS name in the Active Directory forest. NetBIOS name resolution is performed on the single-label name only, in the event that DNS resolution fails.\r\n\r\nIf you disable this policy setting, when the AllowSingleLabelDnsDomain policy is not enabled, computers to which this policy is applied, will only use NetBIOS name resolution to attempt to locate a domain controller hosting an Active Directory domain specified with a single-label name. The computers will not attempt DNS name resolution in this case, unless the computer is searching for a domain with a single label DNS name to which this computer is joined, in the Active Directory forest.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-allowdnssuffixsearch"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_allowdnssuffixsearch_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_allowdnssuffixsearch_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_allownt4crypto","displayName":"Allow cryptography algorithms compatible with Windows NT 4.0","description":"This policy setting controls whether the Net Logon service will allow the use of older cryptography algorithms that are used in Windows NT 4.0. The cryptography algorithms used in Windows NT 4.0 and earlier are not as secure as newer algorithms used in Windows 2000 or later, including this version of Windows.\r\n\r\nBy default, Net Logon will not allow the older cryptography algorithms to be used and will not include them in the negotiation of cryptography algorithms. Therefore, computers running Windows NT 4.0 will not be able to establish a connection to this domain controller.\r\n \r\nIf you enable this policy setting, Net Logon will allow the negotiation and use of older cryptography algorithms compatible with Windows NT 4.0. However, using the older algorithms represents a potential security risk.\r\n\r\nIf you disable this policy setting, Net Logon will not allow the negotiation and use of older cryptography algorithms. \r\n\r\nIf you do not configure this policy setting, Net Logon will not allow the negotiation and use of older cryptography algorithms.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-allownt4crypto"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_allownt4crypto_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_allownt4crypto_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_allowsinglelabeldnsdomain","displayName":"Use DNS name resolution with a single-label domain name instead of NetBIOS name resolution to locate the DC","description":"This policy setting specifies whether the computers to which this setting is applied attempt DNS name resolution of a single-label domain names.\r\n\r\nBy default, the behavior specified in the AllowDnsSuffixSearch is used. If the AllowDnsSuffixSearch policy is disabled, then NetBIOS name resolution is used exclusively, to locate a domain controller hosting an Active Directory domain specified with a single-label name.\r\n\r\nIf you enable this policy setting, computers to which this policy is applied will attempt to locate a domain controller hosting an Active Directory domain specified with a single-label name using DNS name resolution.\r\n\r\nIf you disable this policy setting, computers to which this setting is applied will use the AllowDnsSuffixSearch policy, if it is not disabled or perform NetBIOS name resolution otherwise, to attempt to locate a domain controller that hosts an Active Directory domain specified with a single-label name. the computers will not the DNS name resolution in this case, unless the computer is searching for a domain with a single label DNS name that exists in the Active Directory forest to which this computer is joined.\r\n\r\nIf you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-allowsinglelabeldnsdomain"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_allowsinglelabeldnsdomain_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_allowsinglelabeldnsdomain_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_autositecoverage","displayName":"Use automated site coverage by the DC Locator DNS SRV Records","description":"This policy setting determines whether domain controllers (DC) will dynamically register DC Locator site-specific SRV records for the closest sites where no DC for the same domain exists (or no Global Catalog for the same forest exists). These DNS records are dynamically registered by the Net Logon service, and they are used to locate the DC.\r\n\r\nIf you enable this policy setting, the DCs to which this setting is applied dynamically register DC Locator site-specific DNS SRV records for the closest sites where no DC for the same domain, or no Global Catalog for the same forest, exists.\r\n\r\nIf you disable this policy setting, the DCs will not register site-specific DC Locator DNS SRV records for any other sites but their own.\r\n\r\nIf you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-autositecoverage"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_autositecoverage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_autositecoverage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_avoidfallbacknetbiosdiscovery","displayName":"Do not use NetBIOS-based discovery for domain controller location when DNS-based discovery fails","description":"This policy setting allows you to control the domain controller (DC) location algorithm. By default, the DC location algorithm prefers DNS-based discovery if the DNS domain name is known. If DNS-based discovery fails and the NetBIOS domain name is known, the algorithm then uses NetBIOS-based discovery as a fallback mechanism.\r\n\r\nNetBIOS-based discovery uses a WINS server and mailslot messages but does not use site information. Hence it does not ensure that clients will discover the closest DC. It also allows a hub-site client to discover a branch-site DC even if the branch-site DC only registers site-specific DNS records (as recommended). For these reasons, NetBIOS-based discovery is not recommended.\r\n\r\nNote that this policy setting does not affect NetBIOS-based discovery for DC location if only the NetBIOS domain name is known.\r\n\r\nIf you enable or do not configure this policy setting, the DC location algorithm does not use NetBIOS-based discovery as a fallback mechanism when DNS-based discovery fails. This is the default behavior.\r\n\r\nIf you disable this policy setting, the DC location algorithm can use NetBIOS-based discovery as a fallback mechanism when DNS based discovery fails.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-avoidfallbacknetbiosdiscovery"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_avoidfallbacknetbiosdiscovery_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_avoidfallbacknetbiosdiscovery_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_avoidpdconwan","displayName":"Contact PDC on logon failure","description":"This policy setting defines whether a domain controller (DC) should attempt to verify the password provided by a client with the PDC emulator if the DC failed to validate the password.\r\n\r\nContacting the PDC emulator is useful in case the client’s password was recently changed and did not propagate to the DC yet. Users may want to disable this feature if the PDC emulator is located over a slow WAN connection.\r\n\r\nIf you enable this policy setting, the DCs to which this policy setting applies will attempt to verify a password with the PDC emulator if the DC fails to validate the password.\r\n\r\nIf you disable this policy setting, the DCs will not attempt to verify any passwords with the PDC emulator. \r\n\r\nIf you do not configure this policy setting, it is not applied to any DCs.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-avoidpdconwan"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_avoidpdconwan_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_avoidpdconwan_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_backgroundretryinitialperiod","displayName":"Use initial DC discovery retry setting for background callers","description":"This policy setting determines the amount of time (in seconds) to wait before the first retry for applications that perform periodic searches for domain controllers (DC) that are unable to find a DC.\r\n\r\nThe default value for this setting is 10 minutes (10*60). The maximum value for this setting is 49 days (0x49*24*60*60=4233600). The minimum value for this setting is 0.\r\n\r\nThis setting is relevant only to those callers of DsGetDcName that have specified the DS_BACKGROUND_ONLY flag.\r\n\r\nIf the value of this setting is less than the value specified in the NegativeCachePeriod subkey, the value in the NegativeCachePeriod subkey is used.\r\n\r\nWarning: If the value for this setting is too large, a client will not attempt to find any DCs that were initially unavailable. If the value set in this setting is very small and the DC is not available, the traffic caused by periodic DC discoveries may be excessive.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-backgroundretryinitialperiod"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_backgroundretryinitialperiod_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_backgroundretryinitialperiod_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_backgroundretryinitialperiod_netlogon_backgroundretryinitialperiodlabel","displayName":"Seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_backgroundretrymaximumperiod","displayName":"Use maximum DC discovery retry interval setting for background callers","description":"This policy setting determines the maximum retry interval allowed when applications performing periodic searches for Domain Controllers (DCs) are unable to find a DC.\r\n\r\nFor example, the retry intervals may be set at 10 minutes, then 20 minutes and then 40 minutes, but when the interval reaches the value set in this setting, that value becomes the retry interval for all subsequent retries until the value set in Final DC Discovery Retry Setting is reached.\r\n\r\nThe default value for this setting is 60 minutes (60*60). The maximum value for this setting is 49 days (0x49*24*60*60=4233600). The minimum value for this setting is 0.\r\n\r\nIf the value for this setting is smaller than the value specified for the Initial DC Discovery Retry Setting, the Initial DC Discovery Retry Setting is used.\r\n\r\nWarning: If the value for this setting is too large, a client may take very long periods to try to find a DC.\r\n\r\nIf the value for this setting is too small and the DC is not available, the frequent retries may produce excessive network traffic.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-backgroundretrymaximumperiod"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_backgroundretrymaximumperiod_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_backgroundretrymaximumperiod_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_backgroundretrymaximumperiod_netlogon_backgroundretrymaximumperiodlabel","displayName":"Seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_backgroundretryquittime","displayName":"Use final DC discovery retry setting for background callers","description":"This policy setting determines when retries are no longer allowed for applications that perform periodic searches for domain controllers (DC) are unable to find a DC. For example, retires may be set to occur according to the Use maximum DC discovery retry interval policy setting, but when the value set in this policy setting is reached, no more retries occur. If a value for this policy setting is smaller than the value in the Use maximum DC discovery retry interval policy setting, the value for Use maximum DC discovery retry interval policy setting is used.\r\n\r\nThe default value for this setting is to not quit retrying (0). The maximum value for this setting is 49 days (0x49*24*60*60=4233600). The minimum value for this setting is 0.\r\n\r\nWarning: If the value for this setting is too small, a client will stop trying to find a DC too soon.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-backgroundretryquittime"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_backgroundretryquittime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_backgroundretryquittime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_backgroundretryquittime_netlogon_backgroundretryquittimelabel","displayName":"Seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_backgroundsuccessfulrefreshperiod","displayName":"Use positive periodic DC cache refresh for background callers","description":"This policy setting determines when a successful DC cache entry is refreshed. This policy setting is applied to caller programs that periodically attempt to locate DCs, and it is applied before returning the DC information to the caller program. The default value for this setting is infinite (4294967200). The maximum value for this setting is (4294967200), while the maximum that is not treated as infinity is 49 days (49*24*60*60=4233600). Any larger value is treated as infinity. The minimum value for this setting is to always refresh (0).\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-backgroundsuccessfulrefreshperiod"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_backgroundsuccessfulrefreshperiod_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_backgroundsuccessfulrefreshperiod_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_backgroundsuccessfulrefreshperiod_netlogon_backgroundsuccessfulrefreshperiodlabel","displayName":"Seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_debugflag","displayName":"Specify log file debug output level","description":"This policy setting specifies the level of debug output for the Net Logon service.\r\n\r\nThe Net Logon service outputs debug information to the log file netlogon.log in the directory %windir%\\debug. By default, no debug information is logged.\r\n\r\nIf you enable this policy setting and specify a non-zero value, debug information will be logged to the file. Higher values result in more verbose logging; the value of 536936447 is commonly used as an optimal setting.\r\n\r\nIf you specify zero for this policy setting, the default behavior occurs as described above.\r\n\r\nIf you disable this policy setting or do not configure it, the default behavior occurs as described above.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-debugflag"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_debugflag_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_debugflag_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_debugflag_netlogon_debugflaglabel","displayName":"Level: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_dnsavoidregisterrecords","displayName":"Specify DC Locator DNS records not registered by the DCs","description":"This policy setting determines which DC Locator DNS records are not registered by the Net Logon service.\r\n\r\nIf you enable this policy setting, select Enabled and specify a list of space-delimited mnemonics (instructions) for the DC Locator DNS records that will not be registered by the DCs to which this setting is applied.\r\n\r\nSelect the mnemonics from the following list:\r\n\r\nMnemonic Type DNS Record\r\n\r\nLdapIpAddress A \r\nLdap SRV _ldap._tcp.\r\nLdapAtSite SRV _ldap._tcp.._sites.\r\nPdc SRV _ldap._tcp.pdc._msdcs.\r\nGc SRV _ldap._tcp.gc._msdcs.\r\nGcAtSite SRV _ldap._tcp.._sites.gc._msdcs.\r\nDcByGuid SRV _ldap._tcp..domains._msdcs.\r\nGcIpAddress A gc._msdcs.\r\nDsaCname CNAME ._msdcs.\r\nKdc SRV _kerberos._tcp.dc._msdcs.\r\nKdcAtSite SRV _kerberos._tcp.._sites.dc._msdcs.\r\nDc SRV _ldap._tcp.dc._msdcs.\r\nDcAtSite SRV _ldap._tcp.._sites.dc._msdcs.\r\nRfc1510Kdc SRV _kerberos._tcp.\r\nRfc1510KdcAtSite SRV _kerberos._tcp.._sites.\r\nGenericGc SRV _gc._tcp.\r\nGenericGcAtSite SRV _gc._tcp.._sites.\r\nRfc1510UdpKdc SRV _kerberos._udp.\r\nRfc1510Kpwd SRV _kpasswd._tcp.\r\nRfc1510UdpKpwd SRV _kpasswd._udp.\r\n\r\nIf you disable this policy setting, DCs configured to perform dynamic registration of DC Locator DNS records register all DC Locator DNS resource records.\r\n\r\nIf you do not configure this policy setting, DCs use their local configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-dnsavoidregisterrecords"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_dnsavoidregisterrecords_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_dnsavoidregisterrecords_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_dnsavoidregisterrecords_netlogon_dnsavoidregisterrecordslabel","displayName":"Mnemonics: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_dnsrefreshinterval","displayName":"Specify Refresh Interval of the DC Locator DNS records","description":"This policy setting specifies the Refresh Interval of the DC Locator DNS resource records for DCs to which this setting is applied. These DNS records are dynamically registered by the Net Logon service and are used by the DC Locator algorithm to locate the DC. This setting may be applied only to DCs using dynamic update.\r\n\r\nDCs configured to perform dynamic registration of the DC Locator DNS resource records periodically reregister their records with DNS servers, even if their records’ data has not changed. If authoritative DNS servers are configured to perform scavenging of the stale records, this reregistration is required to instruct the DNS servers configured to automatically remove (scavenge) stale records that these records are current and should be preserved in the database.\r\n\r\nWarning: If the DNS resource records are registered in zones with scavenging enabled, the value of this setting should never be longer than the Refresh Interval configured for these zones. Setting the Refresh Interval of the DC Locator DNS records to longer than the Refresh Interval of the DNS zones may result in the undesired deletion of DNS resource records.\r\n\r\nTo specify the Refresh Interval of the DC records, click Enabled, and then enter a value larger than 1800. This value specifies the Refresh Interval of the DC records in seconds (for example, the value 3600 is 60 minutes).\r\n\r\nIf you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-dnsrefreshinterval"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_dnsrefreshinterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_dnsrefreshinterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_dnsrefreshinterval_netlogon_dnsrefreshintervallabel","displayName":"Seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_dnssrvrecorduselowercasehostnames","displayName":"Use lowercase DNS host names when registering domain controller SRV records","description":"This policy setting configures whether the domain controllers to which this setting is applied will lowercase their DNS host name when registering SRV records.\r\n\r\nIf enabled, domain controllers will lowercase their DNS host name when registering domain controller SRV records. A best-effort attempt will be made to delete any previously registered SRV records that contain mixed-case DNS host names. For more information and potential manual cleanup procedures, see the link below.\r\n\r\nIf disabled, domain controllers will use their configured DNS host name as-is when registering domain controller SRV records.\r\n\r\nIf not configured, domain controllers will default to using their local configuration.\r\n\r\nThe default local configuration is enabled.\r\n\r\nA reboot is not required for changes to this setting to take effect.\r\n\r\nMore information is available at https://aka.ms/lowercasehostnamesrvrecord\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-dnssrvrecorduselowercasehostnames"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_dnssrvrecorduselowercasehostnames_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_dnssrvrecorduselowercasehostnames_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_dnsttl","displayName":"Set TTL in the DC Locator DNS Records","description":"This policy setting specifies the value for the Time-To-Live (TTL) field in SRV resource records that are registered by the Net Logon service. These DNS records are dynamically registered, and they are used to locate the domain controller (DC).\r\n\r\nTo specify the TTL for DC Locator DNS records, click Enabled, and then enter a value in seconds (for example, the value \"900\" is 15 minutes).\r\n\r\nIf you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-dnsttl"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_dnsttl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_dnsttl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_dnsttl_netlogon_dnsttllabel","displayName":"Seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_expecteddialupdelay","displayName":"Specify expected dial-up delay on logon","description":"This policy setting specifies the additional time for the computer to wait for the domain controller’s (DC) response when logging on to the network.\r\n\r\nTo specify the expected dial-up delay at logon, click Enabled, and then enter the desired value in seconds (for example, the value \"60\" is 1 minute).\r\n\r\nIf you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-expecteddialupdelay"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_expecteddialupdelay_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_expecteddialupdelay_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_expecteddialupdelay_netlogon_expecteddialupdelaylabel","displayName":"Seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_forcerediscoveryinterval","displayName":"Force Rediscovery Interval","description":"This policy setting determines the interval for when a Force Rediscovery is carried out by DC Locator.\r\n\r\nThe Domain Controller Locator (DC Locator) service is used by clients to find domain controllers for their Active Directory domain. When DC Locator finds a domain controller, it caches domain controllers to improve the efficiency of the location algorithm. As long as the cached domain controller meets the requirements and is running, DC Locator will continue to return it. If a new domain controller is introduced, existing clients will only discover it when a Force Rediscovery is carried out by DC Locator. To adapt to changes in network conditions DC Locator will by default carry out a Force Rediscovery according to a specific time interval and maintain efficient load-balancing of clients across all available domain controllers in all domains or forests. The default time interval for Force Rediscovery by DC Locator is 12 hours. Force Rediscovery can also be triggered if a call to DC Locator uses the DS_FORCE_REDISCOVERY flag. Rediscovery resets the timer on the cached domain controller entries.\r\n\r\nIf you enable this policy setting, DC Locator on the machine will carry out Force Rediscovery periodically according to the configured time interval. The minimum time interval is 3600 seconds (1 hour) to avoid excessive network traffic from rediscovery. The maximum allowed time interval is 4294967200 seconds, while any value greater than 4294967 seconds (~49 days) will be treated as infinity.\r\n\r\nIf you disable this policy setting, Force Rediscovery will be used by default for the machine at every 12 hour interval.\r\n\r\nIf you do not configure this policy setting, Force Rediscovery will be used by default for the machine at every 12 hour interval, unless the local machine setting in the registry is a different value.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-forcerediscoveryinterval"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_forcerediscoveryinterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_forcerediscoveryinterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_forcerediscoveryinterval_netlogon_forcerediscoveryintervallabel","displayName":"Seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_gcsitecoverage","displayName":"Specify sites covered by the GC Locator DNS SRV Records","description":"This policy setting specifies the sites for which the global catalogs (GC) should register site-specific GC locator DNS SRV resource records. These records are registered in addition to the site-specific SRV records registered for the site where the GC resides, and records registered by a GC configured to register GC Locator DNS SRV records for those sites without a GC that are closest to it. \r\n\r\nThe GC Locator DNS records and the site-specific SRV records are dynamically registered by the Net Logon service, and they are used to locate the GC. An Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication. A GC is a domain controller that contains a partial replica of every domain in Active Directory.\r\n\r\nTo specify the sites covered by the GC Locator DNS SRV records, click Enabled, and enter the sites' names in a space-delimited format.\r\n\r\nIf you do not configure this policy setting, it is not applied to any GCs, and GCs use their local configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-gcsitecoverage"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_gcsitecoverage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_gcsitecoverage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_gcsitecoverage_netlogon_gcsitecoveragelabel","displayName":"Sites: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_ignoreincomingmailslotmessages","displayName":"Do not process incoming mailslot messages used for domain controller location based on NetBIOS domain names","description":"This policy setting allows you to control the processing of incoming mailslot messages by a local domain controller (DC).\r\n\r\nNote: To locate a remote DC based on its NetBIOS (single-label) domain name, DC Locator first gets the list of DCs from a WINS server that is configured in its local client settings. DC Locator then sends a mailslot message to each remote DC to get more information. DC location succeeds only if a remote DC responds to the mailslot message.\r\n\r\nThis policy setting is recommended to reduce the attack surface on a DC, and can be used in an environment without WINS, in an IPv6-only environment, and whenever DC location based on a NetBIOS domain name is not required. This policy setting does not affect DC location based on DNS names.\r\n\r\nIf you enable this policy setting, this DC does not process incoming mailslot messages that are used for NetBIOS domain name based DC location.\r\n\r\nIf you disable or do not configure this policy setting, this DC processes incoming mailslot messages. This is the default behavior of DC Locator.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-ignoreincomingmailslotmessages"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_ignoreincomingmailslotmessages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_ignoreincomingmailslotmessages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_ldapsrvpriority","displayName":"Set Priority in the DC Locator DNS SRV records","description":"This policy setting specifies the Priority field in the SRV resource records registered by domain controllers (DC) to which this setting is applied. These DNS records are dynamically registered by the Net Logon service and are used to locate the DC.\r\n\r\nThe Priority field in the SRV record sets the preference for target hosts (specified in the SRV record’s Target field). DNS clients that query for SRV resource records attempt to contact the first reachable host with the lowest priority number listed.\r\n\r\nTo specify the Priority in the DC Locator DNS SRV resource records, click Enabled, and then enter a value. The range of values is from 0 to 65535.\r\n\r\nIf you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-ldapsrvpriority"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_ldapsrvpriority_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_ldapsrvpriority_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_ldapsrvpriority_netlogon_ldapsrvprioritylabel","displayName":"Priority: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_ldapsrvweight","displayName":"Set Weight in the DC Locator DNS SRV records","description":"This policy setting specifies the Weight field in the SRV resource records registered by the domain controllers (DC) to which this setting is applied. These DNS records are dynamically registered by the Net Logon service, and they are used to locate the DC.\r\n\r\nThe Weight field in the SRV record can be used in addition to the Priority value to provide a load-balancing mechanism where multiple servers are specified in the SRV records Target field and are all set to the same priority. The probability with which the DNS client randomly selects the target host to be contacted is proportional to the Weight field value in the SRV record.\r\n\r\nTo specify the Weight in the DC Locator DNS SRV records, click Enabled, and then enter a value. The range of values is from 0 to 65535.\r\n\r\nIf you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-ldapsrvweight"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_ldapsrvweight_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_ldapsrvweight_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_ldapsrvweight_netlogon_ldapsrvweightlabel","displayName":"Weight: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_maximumlogfilesize","displayName":"Specify maximum log file size","description":"This policy setting specifies the maximum size in bytes of the log file netlogon.log in the directory %windir%\\debug when logging is enabled.\r\n\r\nBy default, the maximum size of the log file is 20MB. If you enable this policy setting, the maximum size of the log file is set to the specified size. Once this size is reached the log file is saved to netlogon.bak and netlogon.log is truncated. A reasonable value based on available storage should be specified.\r\n\r\nIf you disable or do not configure this policy setting, the default behavior occurs as indicated above.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-maximumlogfilesize"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_maximumlogfilesize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_maximumlogfilesize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_maximumlogfilesize_netlogon_maximumlogfilesizelabel","displayName":"Bytes: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_ndncsitecoverage","displayName":"Specify sites covered by the application directory partition DC Locator DNS SRV records","description":"This policy setting specifies the sites for which the domain controllers (DC) that host the application directory partition should register the site-specific, application directory partition-specific DC Locator DNS SRV resource records. These records are registered in addition to the site-specific SRV records registered for the site where the DC resides, and records registered by a DC configured to register DC Locator DNS SRV records for those sites without a DC that are closest to it. \r\n\r\nThe application directory partition DC Locator DNS records and the site-specific SRV records are dynamically registered by the Net Logon service, and they are used to locate the application directory partition-specific DC. An Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication.\r\n\r\nTo specify the sites covered by the DC Locator application directory partition-specific DNS SRV records, click Enabled, and then enter the site names in a space-delimited format.\r\n\r\nIf you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-ndncsitecoverage"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_ndncsitecoverage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_ndncsitecoverage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_ndncsitecoverage_netlogon_ndncsitecoveragelabel","displayName":"Sites: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_negativecacheperiod","displayName":"Specify negative DC Discovery cache setting","description":"This policy setting specifies the amount of time (in seconds) the DC locator remembers that a domain controller (DC) could not be found in a domain. When a subsequent attempt to locate the DC occurs within the time set in this setting, DC Discovery immediately fails, without attempting to find the DC.\r\n\r\nThe default value for this setting is 45 seconds. The maximum value for this setting is 7 days (7*24*60*60). The minimum value for this setting is 0.\r\n\r\nWarning: If the value for this setting is too large, a client will not attempt to find any DCs that were initially unavailable. If the value for this setting is too small, clients will attempt to find DCs even when none are available.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-negativecacheperiod"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_negativecacheperiod_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_negativecacheperiod_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_negativecacheperiod_netlogon_negativecacheperiodlabel","displayName":"Seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_netlogonsharecompatibilitymode","displayName":"Set Netlogon share compatibility","description":"This policy setting controls whether or not the Netlogon share created by the Net Logon service on a domain controller (DC) should support compatibility in file sharing semantics with earlier applications.\r\n\r\nIf you enable this policy setting, the Netlogon share will honor file sharing semantics that grant requests for exclusive read access to files on the share even when the caller has only read permission.\r\n\r\nIf you disable or do not configure this policy setting, the Netlogon share will grant shared read access to files on the share when exclusive access is requested and the caller has only read permission.\r\n\r\nBy default, the Netlogon share will grant shared read access to files on the share when exclusive access is requested.\r\n\r\nNote: The Netlogon share is a share created by the Net Logon service for use by client machines in the domain. The default behavior of the Netlogon share ensures that no application with only read permission to files on the Netlogon share can lock the files by requesting exclusive read access, which might prevent Group Policy settings from being updated on clients in the domain. When this setting is enabled, an application that relies on the ability to lock files on the Netlogon share with only read permission will be able to deny Group Policy clients from reading the files, and in general the availability of the Netlogon share on the domain will be decreased.\r\n\r\nIf you enable this policy setting, domain administrators should ensure that the only applications using the exclusive read capability in the domain are those approved by the administrator.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-netlogonsharecompatibilitymode"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_netlogonsharecompatibilitymode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_netlogonsharecompatibilitymode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_nonbackgroundsuccessfulrefreshperiod","displayName":"Specify positive periodic DC Cache refresh for non-background callers","description":"This policy setting determines when a successful DC cache entry is refreshed. This policy setting is applied to caller programs that do not periodically attempt to locate DCs, and it is applied before the returning the DC information to the caller program. This policy setting is relevant to only those callers of DsGetDcName that have not specified the DS_BACKGROUND_ONLY flag.\r\n\r\nThe default value for this setting is 30 minutes (1800). The maximum value for this setting is (4294967200), while the maximum that is not treated as infinity is 49 days (49*24*60*60=4233600). Any larger value will be treated as infinity. The minimum value for this setting is to always refresh (0).\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-nonbackgroundsuccessfulrefreshperiod"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_nonbackgroundsuccessfulrefreshperiod_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_nonbackgroundsuccessfulrefreshperiod_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_nonbackgroundsuccessfulrefreshperiod_netlogon_nonbackgroundsuccessfulrefreshperiodlabel","displayName":"Seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_pingurgencymode","displayName":"Use urgent mode when pinging domain controllers","description":"This policy setting configures whether the computers to which this setting is applied are more aggressive when trying to locate a domain controller (DC).\r\n\r\nWhen an environment has a large number of DCs running both old and new operating systems, the default DC locator discovery behavior may be insufficient to find DCs running a newer operating system. This policy setting can be enabled to configure DC locator to be more aggressive about trying to locate a DC in such an environment, by pinging DCs at a higher frequency. Enabling this setting may result in additional network traffic and increased load on DCs. You should disable this setting once all DCs are running the same OS version.\r\n\r\nThe allowable values for this setting result in the following behaviors:\r\n\r\n1 - Computers will ping DCs at the normal frequency.\r\n2 - Computers will ping DCs at the higher frequency.\r\n\r\nTo specify this behavior, click Enabled and then enter a value. The range of values is from 1 to 2.\r\n\r\nIf you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-pingurgencymode"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_pingurgencymode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_pingurgencymode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_pingurgencymode_netlogon_pingurgencymodelabel","displayName":"Ping urgency mode: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_scavengeinterval","displayName":"Set scavenge interval","description":"This policy setting determines the interval at which Netlogon performs the following scavenging operations:\r\n\r\n- Checks if a password on a secure channel needs to be modified, and modifies it if necessary.\r\n\r\n- On the domain controllers (DC), discovers a DC that has not been discovered.\r\n\r\n- On the PDC, attempts to add the [1B] NetBIOS name if it hasn’t already been successfully added.\r\n\r\nNone of these operations are critical. 15 minutes is optimal in all but extreme cases. For instance, if a DC is separated from a trusted domain by an expensive (e.g., ISDN) line, this parameter might be adjusted upward to avoid frequent automatic discovery of DCs in a trusted domain.\r\n\r\nTo enable the setting, click Enabled, and then specify the interval in seconds.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-scavengeinterval"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_scavengeinterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_scavengeinterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_scavengeinterval_netlogon_scavengeintervallabel","displayName":"Seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_sitecoverage","displayName":"Specify sites covered by the DC Locator DNS SRV records","description":"This policy setting specifies the sites for which the domain controllers (DC) register the site-specific DC Locator DNS SRV resource records. These records are registered in addition to the site-specific SRV records registered for the site where the DC resides, and records registered by a DC configured to register DC Locator DNS SRV records for those sites without a DC that are closest to it. \r\n\r\nThe DC Locator DNS records are dynamically registered by the Net Logon service, and they are used to locate the DC. An Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication.\r\n\r\nTo specify the sites covered by the DC Locator DNS SRV records, click Enabled, and then enter the sites names in a space-delimited format.\r\n\r\nIf you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-sitecoverage"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_sitecoverage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_sitecoverage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_sitecoverage_netlogon_sitecoveragelabel","displayName":"Sites: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_sitename","displayName":"Specify site name","description":"This policy setting specifies the Active Directory site to which computers belong.\r\n\r\nAn Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication.\r\n\r\nTo specify the site name for this setting, click Enabled, and then enter the site name. When the site to which a computer belongs is not specified, the computer automatically discovers its site from Active Directory.\r\n\r\nIf you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-sitename"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_sitename_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_sitename_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_sitename_netlogon_sitenamelabel","displayName":"Site: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_sysvolsharecompatibilitymode","displayName":"Set SYSVOL share compatibility","description":"This policy setting controls whether or not the SYSVOL share created by the Net Logon service on a domain controller (DC) should support compatibility in file sharing semantics with earlier applications.\r\n\r\nWhen this setting is enabled, the SYSVOL share will honor file sharing semantics that grant requests for exclusive read access to files on the share even when the caller has only read permission.\r\n\r\nWhen this setting is disabled or not configured, the SYSVOL share will grant shared read access to files on the share when exclusive access is requested and the caller has only read permission.\r\n\r\nBy default, the SYSVOL share will grant shared read access to files on the share when exclusive access is requested.\r\n\r\nNote: The SYSVOL share is a share created by the Net Logon service for use by Group Policy clients in the domain. The default behavior of the SYSVOL share ensures that no application with only read permission to files on the sysvol share can lock the files by requesting exclusive read access, which might prevent Group Policy settings from being updated on clients in the domain. When this setting is enabled, an application that relies on the ability to lock files on the SYSVOL share with only read permission will be able to deny Group Policy clients from reading the files, and in general the availability of the SYSVOL share on the domain will be decreased.\r\n\r\nIf you enable this policy setting, domain administrators should ensure that the only applications using the exclusive read capability in the domain are those approved by the administrator.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-sysvolsharecompatibilitymode"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_sysvolsharecompatibilitymode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_sysvolsharecompatibilitymode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_trynextclosestsite","displayName":"Try Next Closest Site","description":"This policy setting enables DC Locator to attempt to locate a DC in the nearest site based on the site link cost if a DC in same the site is not found. In scenarios with multiple sites, failing over to the try next closest site during DC Location streamlines network traffic more effectively.\r\n\r\nThe DC Locator service is used by clients to find domain controllers for their Active Directory domain. The default behavior for DC Locator is to find a DC in the same site. If none are found in the same site, a DC in another site, which might be several site-hops away, could be returned by DC Locator. Site proximity between two sites is determined by the total site-link cost between them. A site is closer if it has a lower site link cost than another site with a higher site link cost. \r\n\r\nIf you enable this policy setting, Try Next Closest Site DC Location will be turned on for the computer.\r\n\r\nIf you disable this policy setting, Try Next Closest Site DC Location will not be used by default for the computer. However, if a DC Locator call is made using the DS_TRY_NEXTCLOSEST_SITE flag explicitly, the Try Next Closest Site behavior is honored.\r\n\r\nIf you do not configure this policy setting, Try Next Closest Site DC Location will not be used by default for the machine. If the DS_TRY_NEXTCLOSEST_SITE flag is used explicitly, the Next Closest Site behavior will be used.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-trynextclosestsite"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_trynextclosestsite_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_trynextclosestsite_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_usedynamicdns","displayName":"Specify dynamic registration of the DC Locator DNS Records","description":"This policy setting determines if dynamic registration of the domain controller (DC) locator DNS resource records is enabled. These DNS records are dynamically registered by the Net Logon service and are used by the Locator algorithm to locate the DC.\r\n\r\nIf you enable this policy setting, DCs to which this setting is applied dynamically register DC Locator DNS resource records through dynamic DNS update-enabled network connections.\r\n\r\nIf you disable this policy setting, DCs will not register DC Locator DNS resource records.\r\n\r\nIf you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-netlogon#admx-netlogon-netlogon-usedynamicdns"],"options":[{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_usedynamicdns_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_netlogon_netlogon_usedynamicdns_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_networkconnections_nc_donotshowlocalonlyicon","displayName":"Do not show the \"local access only\" network icon","description":"Specifies whether or not the \"local access only\" network icon will be shown.\r\n\r\nWhen enabled, the icon for Internet access will be shown in the system tray even when a user is connected to a network with local access only.\r\n\r\nIf you disable this setting or do not configure it, the \"local access only\" icon will be used when a user is connected to a network with local access only.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-networkconnections#admx-networkconnections-nc-donotshowlocalonlyicon"],"options":[{"id":"device_vendor_msft_policy_config_admx_networkconnections_nc_donotshowlocalonlyicon_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_networkconnections_nc_donotshowlocalonlyicon_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_networkconnections_nc_forcetunneling","displayName":"Route all traffic through the internal network","description":"This policy setting determines whether a remote client computer routes Internet traffic through the internal network or whether the client accesses the Internet directly.\r\n\r\nWhen a remote client computer connects to an internal network using DirectAccess, it can access the Internet in two ways: through the secure tunnel that DirectAccess establishes between the computer and the internal network, or directly through the local default gateway.\r\n\r\nIf you enable this policy setting, all traffic between a remote client computer running DirectAccess and the Internet is routed through the internal network.\r\n\r\nIf you disable this policy setting, traffic between remote client computers running DirectAccess and the Internet is not routed through the internal network.\r\n\r\nIf you do not configure this policy setting, traffic between remote client computers running DirectAccess and the Internet is not routed through the internal network.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-networkconnections#admx-networkconnections-nc-forcetunneling"],"options":[{"id":"device_vendor_msft_policy_config_admx_networkconnections_nc_forcetunneling_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_networkconnections_nc_forcetunneling_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_networkconnections_nc_forcetunneling_stateselect","displayName":"Select from the following states: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_networkconnections_nc_forcetunneling_stateselect_enabled","displayName":"Enabled State","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_networkconnections_nc_forcetunneling_stateselect_disabled","displayName":"Disabled State","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_networkconnections_nc_personalfirewallconfig","displayName":"Prohibit use of Internet Connection Firewall on your DNS domain network","description":"Prohibits use of Internet Connection Firewall on your DNS domain network.\r\n\r\nDetermines whether users can enable the Internet Connection Firewall feature on a connection, and if the Internet Connection Firewall service can run on a computer.\r\n\r\nImportant: This setting is location aware. It only applies when a computer is connected to the same DNS domain network it was connected to when the setting was refreshed on that computer. If a computer is connected to a DNS domain network other than the one it was connected to when the setting was refreshed, this setting does not apply.\r\n\r\nThe Internet Connection Firewall is a stateful packet filter for home and small office users to protect them from Internet network security threats.\r\n\r\nIf you enable this setting, Internet Connection Firewall cannot be enabled or configured by users (including administrators), and the Internet Connection Firewall service cannot run on the computer. The option to enable the Internet Connection Firewall through the Advanced tab is removed. In addition, the Internet Connection Firewall is not enabled for remote access connections created through the Make New Connection Wizard. The Network Setup Wizard is disabled.\r\n\r\nNote: If you enable the \"Windows Firewall: Protect all network connections\" policy setting, the \"Prohibit use of Internet Connection Firewall on your DNS domain network\" policy setting has no effect on computers that are running Windows Firewall, which replaces Internet Connection Firewall when you install Windows XP Service Pack 2.\r\n\r\nIf you disable this setting or do not configure it, the Internet Connection Firewall is disabled when a LAN Connection or VPN connection is created, but users can use the Advanced tab in the connection properties to enable it. The Internet Connection Firewall is enabled by default on the connection for which Internet Connection Sharing is enabled. In addition, remote access connections created through the Make New Connection Wizard have the Internet Connection Firewall enabled.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-networkconnections#admx-networkconnections-nc-personalfirewallconfig"],"options":[{"id":"device_vendor_msft_policy_config_admx_networkconnections_nc_personalfirewallconfig_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_networkconnections_nc_personalfirewallconfig_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_networkconnections_nc_showsharedaccessui","displayName":"Prohibit use of Internet Connection Sharing on your DNS domain network","description":"Determines whether administrators can enable and configure the Internet Connection Sharing (ICS) feature of an Internet connection and if the ICS service can run on the computer.\r\n\r\nICS lets administrators configure their system as an Internet gateway for a small network and provides network services, such as name resolution and addressing through DHCP, to the local private network.\r\n\r\nIf you enable this setting, ICS cannot be enabled or configured by administrators, and the ICS service cannot run on the computer. The Advanced tab in the Properties dialog box for a LAN or remote access connection is removed. The Internet Connection Sharing page is removed from the New Connection Wizard. The Network Setup Wizard is disabled.\r\n\r\nIf you disable this setting or do not configure it and have two or more connections, administrators can enable ICS. The Advanced tab in the properties dialog box for a LAN or remote access connection is available. In addition, the user is presented with the option to enable Internet Connection Sharing in the Network Setup Wizard and Make New Connection Wizard. (The Network Setup Wizard is available only in Windows XP Professional.)\r\n\r\nBy default, ICS is disabled when you create a remote access connection, but administrators can use the Advanced tab to enable it. When running the New Connection Wizard or Network Setup Wizard, administrators can choose to enable ICS.\r\n\r\nNote: Internet Connection Sharing is only available when two or more network connections are present.\r\n\r\nNote: When the \"Prohibit access to properties of a LAN connection,\" \"Ability to change properties of an all user remote access connection,\" or \"Prohibit changing properties of a private remote access connection\" settings are set to deny access to the Connection Properties dialog box, the Advanced tab for the connection is blocked.\r\n\r\nNote: Nonadministrators are already prohibited from configuring Internet Connection Sharing, regardless of this setting.\r\n\r\nNote: Disabling this setting does not prevent Wireless Hosted Networking from using the ICS service for DHCP services. To prevent the ICS service from running, on the Network Permissions tab in the network's policy properties, select the \"Don't use hosted networks\" check box.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-networkconnections#admx-networkconnections-nc-showsharedaccessui"],"options":[{"id":"device_vendor_msft_policy_config_admx_networkconnections_nc_showsharedaccessui_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_networkconnections_nc_showsharedaccessui_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_networkconnections_nc_stddomainusersetlocation","displayName":"Require domain users to elevate when setting a network's location","description":"This policy setting determines whether to require domain users to elevate when setting a network's location.\r\n\r\nIf you enable this policy setting, domain users must elevate when setting a network's location.\r\n\r\nIf you disable or do not configure this policy setting, domain users can set a network's location without elevating.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-networkconnections#admx-networkconnections-nc-stddomainusersetlocation"],"options":[{"id":"device_vendor_msft_policy_config_admx_networkconnections_nc_stddomainusersetlocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_networkconnections_nc_stddomainusersetlocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_alwayspinsubfolders","displayName":"Subfolders always available offline","description":"Makes subfolders available offline whenever their parent folder is made available offline.\r\n\r\nThis setting automatically extends the \"make available offline\" setting to all new and existing subfolders of a folder. Users do not have the option of excluding subfolders.\r\n\r\nIf you enable this setting, when you make a folder available offline, all folders within that folder are also made available offline. Also, new folders that you create within a folder that is available offline are made available offline when the parent folder is synchronized.\r\n\r\nIf you disable this setting or do not configure it, the system asks users whether they want subfolders to be made available offline when they make a parent folder available offline.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-alwayspinsubfolders"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_alwayspinsubfolders_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_alwayspinsubfolders_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_assignedofflinefiles_2","displayName":"Specify administratively assigned Offline Files","description":"This policy setting lists network files and folders that are always available for offline use. This ensures that the specified files and folders are available offline to users of the computer.\r\n\r\nIf you enable this policy setting, the files you enter are always available offline to users of the computer. To specify a file or folder, click Show. In the Show Contents dialog box in the Value Name column, type the fully qualified UNC path to the file or folder. Leave the Value column field blank.\r\n\r\nIf you disable this policy setting, the list of files or folders made always available offline (including those inherited from lower precedence GPOs) is deleted and no files or folders are made available for offline use by Group Policy (though users can still specify their own files and folders for offline use).\r\n\r\nIf you do not configure this policy setting, no files or folders are made available for offline use by Group Policy.\r\n\r\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy settings will be combined and all specified files will be available for offline use.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-assignedofflinefiles-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_assignedofflinefiles_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_assignedofflinefiles_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_assignedofflinefiles_2_lbl_assignedofflinefileslist","displayName":"Files and Folders: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_assignedofflinefiles_2_lbl_assignedofflinefileslist_key","displayName":"Name","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_assignedofflinefiles_2_lbl_assignedofflinefileslist_value","displayName":"Value","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_backgroundsyncsettings","displayName":"Configure Background Sync","description":"This policy setting controls when background synchronization occurs while operating in slow-link mode, and applies to any user who logs onto the specified machine while this policy is in effect. To control slow-link mode, use the \"Configure slow-link mode\" policy setting.\r\n\r\nIf you enable this policy setting, you can control when Windows synchronizes in the background while operating in slow-link mode. Use the 'Sync Interval' and 'Sync Variance' values to override the default sync interval and variance settings. Use 'Blockout Start Time' and 'Blockout Duration' to set a period of time where background sync is disabled. Use the 'Maximum Allowed Time Without A Sync' value to ensure that all network folders on the machine are synchronized with the server on a regular basis.\r\n\r\nYou can also configure Background Sync for network shares that are in user selected Work Offline mode. This mode is in effect when a user selects the Work Offline button for a specific share. When selected, all configured settings will apply to shares in user selected Work Offline mode as well.\r\n\r\nIf you disable or do not configure this policy setting, Windows performs a background sync of offline folders in the slow-link mode at a default interval with the start of the sync varying between 0 and 60 additional minutes. In Windows 7 and Windows Server 2008 R2, the default sync interval is 360 minutes. In Windows 8 and Windows Server 2012, the default sync interval is 120 minutes.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-backgroundsyncsettings"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_backgroundsyncsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_backgroundsyncsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_backgroundsyncsettings_lbl_backgroundsyncblockoutperiodduration","displayName":"Blockout Duration (minutes) (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_backgroundsyncsettings_lbl_backgroundsyncblockoutperiodstarttime","displayName":"Blockout Start Time (HHMM) (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_backgroundsyncsettings_lbl_backgroundsyncdefaultsynctime","displayName":"Sync Interval (minutes) (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_backgroundsyncsettings_lbl_backgroundsyncignoreblockouttime","displayName":"Maximum Allowed Time Without A Sync (minutes) (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_backgroundsyncsettings_lbl_backgroundsyncinforcedoffline","displayName":"Enable Background Sync for shares in user selected \"Work Offline\" mode (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_backgroundsyncsettings_lbl_backgroundsyncinforcedoffline_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_backgroundsyncsettings_lbl_backgroundsyncinforcedoffline_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_backgroundsyncsettings_lbl_backgroundsyncvariance","displayName":"Sync Variance (minutes) (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_cachesize","displayName":"Limit disk space used by Offline Files","description":"This policy setting limits the amount of disk space that can be used to store offline files. This includes the space used by automatically cached files and files that are specifically made available offline. Files can be automatically cached if the user accesses a file on an automatic caching network share.\r\n\r\nThis setting also disables the ability to adjust, through the Offline Files control panel applet, the disk space limits on the Offline Files cache. This prevents users from trying to change the option while a policy setting controls it.\r\n\r\nIf you enable this policy setting, you can specify the disk space limit (in megabytes) for offline files and also specify how much of that disk space can be used by automatically cached files.\r\n\r\nIf you disable this policy setting, the system limits the space that offline files occupy to 25 percent of the total space on the drive where the Offline Files cache is located. The limit for automatically cached files is 100 percent of the total disk space limit.\r\n\r\nIf you do not configure this policy setting, the system limits the space that offline files occupy to 25 percent of the total space on the drive where the Offline Files cache is located. The limit for automatically cached files is 100 percent of the total disk space limit. However, the users can change these values using the Offline Files control applet.\r\n\r\nIf you enable this setting and specify a total size limit greater than the size of the drive hosting the Offline Files cache, and that drive is the system drive, the total size limit is automatically adjusted downward to 75 percent of the size of the drive. If the cache is located on a drive other than the system drive, the limit is automatically adjusted downward to 100 percent of the size of the drive.\r\n\r\nIf you enable this setting and specify a total size limit less than the amount of space currently used by the Offline Files cache, the total size limit is automatically adjusted upward to the amount of space currently used by offline files. The cache is then considered full.\r\n\r\nIf you enable this setting and specify an auto-cached space limit greater than the total size limit, the auto-cached limit is automatically adjusted downward to equal the total size limit.\r\n\r\nThis setting replaces the Default Cache Size setting used by pre-Windows Vista systems.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-cachesize"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_cachesize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_cachesize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_cachesize_lbl_autocachesizespin","displayName":"Size of auto-cached files: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_cachesize_lbl_totalcachesizespin","displayName":"Total size of offline files: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_customgoofflineactions_2","displayName":"Non-default server disconnect actions","description":"Determines how computers respond when they are disconnected from particular offline file servers. This setting overrides the default response, a user-specified response, and the response specified in the \"Action on server disconnect\" setting.\r\n\r\nTo use this setting, click Show. In the Show Contents dialog box in the Value Name column box, type the server's computer name. Then, in the Value column box, type \"0\" if users can work offline when they are disconnected from this server, or type \"1\" if they cannot.\r\n\r\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured for a particular server, the setting in Computer Configuration takes precedence over the setting in User Configuration. Both Computer and User configuration take precedence over a user's setting. This setting does not prevent users from setting custom actions through the Offline Files tab. However, users are unable to change any custom actions established via this setting.\r\n\r\nTip: To configure this setting without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then click Advanced. This setting corresponds to the settings in the \"Exception list\" section.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-customgoofflineactions-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_customgoofflineactions_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_customgoofflineactions_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_customgoofflineactions_2_lbl_customgoofflineactionslist","displayName":"Customize actions: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_customgoofflineactions_2_lbl_customgoofflineactionslist_key","displayName":"Name","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_customgoofflineactions_2_lbl_customgoofflineactionslist_value","displayName":"Value","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_defcachesize","displayName":"Default cache size","description":"Limits the percentage of the computer's disk space that can be used to store automatically cached offline files.\r\n\r\nThis setting also disables the \"Amount of disk space to use for temporary offline files\" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it.\r\n\r\nAutomatic caching can be set on any network share. When a user opens a file on the share, the system automatically stores a copy of the file on the user's computer.\r\n\r\nThis setting does not limit the disk space available for files that user's make available offline manually.\r\n\r\nIf you enable this setting, you can specify an automatic-cache disk space limit.\r\n\r\nIf you disable this setting, the system limits the space that automatically cached files occupy to 10 percent of the space on the system drive.\r\n\r\nIf you do not configure this setting, disk space for automatically cached files is limited to 10 percent of the system drive by default, but users can change it.\r\n\r\nTip: To change the amount of disk space used for automatic caching without specifying a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then use the slider bar associated with the \"Amount of disk space to use for temporary offline files\" option.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-defcachesize"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_defcachesize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_defcachesize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_defcachesize_lbl_defcachesizespin","displayName":"Default cache size: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_enabled","displayName":"Allow or Disallow use of the Offline Files feature","description":"This policy setting determines whether the Offline Files feature is enabled. Offline Files saves a copy of network files on the user's computer for use when the computer is not connected to the network.\r\n\r\nIf you enable this policy setting, Offline Files is enabled and users cannot disable it.\r\n\r\nIf you disable this policy setting, Offline Files is disabled and users cannot enable it.\r\n\r\nIf you do not configure this policy setting, Offline Files is enabled on Windows client computers, and disabled on computers running Windows Server, unless changed by the user.\r\n\r\nNote: Changes to this policy setting do not take effect until the affected computer is restarted.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-enabled"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_enabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_enabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_encryptofflinefiles","displayName":"Encrypt the Offline Files cache","description":"This policy setting determines whether offline files are encrypted.\r\n\r\nOffline files are locally cached copies of files from a network share. Encrypting this cache reduces the likelihood that a user could access files from the Offline Files cache without proper permissions.\r\n\r\nIf you enable this policy setting, all files in the Offline Files cache are encrypted. This includes existing files as well as files added later. The cached copy on the local computer is affected, but the associated network copy is not. The user cannot unencrypt Offline Files through the user interface.\r\n\r\nIf you disable this policy setting, all files in the Offline Files cache are unencrypted. This includes existing files as well as files added later, even if the files were stored using NTFS encryption or BitLocker Drive Encryption while on the server. The cached copy on the local computer is affected, but the associated network copy is not. The user cannot encrypt Offline Files through the user interface.\r\n\r\nIf you do not configure this policy setting, encryption of the Offline Files cache is controlled by the user through the user interface. The current cache state is retained, and if the cache is only partially encrypted, the operation completes so that it is fully encrypted. The cache does not return to the unencrypted state. The user must be an administrator on the local computer to encrypt or decrypt the Offline Files cache.\r\n\r\nNote: By default, this cache is protected on NTFS partitions by ACLs.\r\n\r\nThis setting is applied at user logon. If this setting is changed after user logon then user logoff and logon is required for this setting to take effect.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-encryptofflinefiles"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_encryptofflinefiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_encryptofflinefiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_eventlogginglevel_2","displayName":"Event logging level","description":"Determines which events the Offline Files feature records in the event log.\r\n\r\nOffline Files records events in the Application log in Event Viewer when it detects errors. By default, Offline Files records an event only when the offline files storage cache is corrupted. However, you can use this setting to specify additional events you want Offline Files to record.\r\n\r\nTo use this setting, in the \"Enter\" box, select the number corresponding to the events you want the system to log. The levels are cumulative; that is, each level includes the events in all preceding levels.\r\n\r\n\"0\" records an error when the offline storage cache is corrupted.\r\n\r\n\"1\" also records an event when the server hosting the offline file is disconnected from the network.\r\n\r\n\"2\" also records events when the local computer is connected and disconnected from the network.\r\n\r\n\"3\" also records an event when the server hosting the offline file is reconnected to the network.\r\n\r\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-eventlogginglevel-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_eventlogginglevel_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_eventlogginglevel_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_eventlogginglevel_2_lbl_eventlogginglevelspin","displayName":"Enter [0-3]: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_exclusionlistsettings","displayName":"Enable file screens","description":"This policy setting enables administrators to block certain file types from being created in the folders that have been made available offline.\r\n\r\nIf you enable this policy setting, a user will be unable to create files with the specified file extensions in any of the folders that have been made available offline.\r\n\r\nIf you disable or do not configure this policy setting, a user can create a file of any type in the folders that have been made available offline.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-exclusionlistsettings"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_exclusionlistsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_exclusionlistsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_exclusionlistsettings_lbl_exclusionlistsettingslist","displayName":"Extensions: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_extexclusionlist","displayName":"Files not cached","description":"Lists types of files that cannot be used offline.\r\n\r\nThis setting lets you exclude certain types of files from automatic and manual caching for offline use. The system does not cache files of the type specified in this setting even when they reside on a network share configured for automatic caching. Also, if users try to make a file of this type available offline, the operation will fail and the following message will be displayed in the Synchronization Manager progress dialog box: \"Files of this type cannot be made available offline.\"\r\n\r\nThis setting is designed to protect files that cannot be separated, such as database components.\r\n\r\nTo use this setting, type the file name extension in the \"Extensions\" box. To type more than one extension, separate the extensions with a semicolon (;).\r\n\r\nNote: To make changes to this setting effective, you must log off and log on again.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-extexclusionlist"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_extexclusionlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_extexclusionlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_extexclusionlist_lbl_extexclusionlistedit","displayName":"Extensions: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_goofflineaction_2","displayName":"Action on server disconnect","description":"Determines whether network files remain available if the computer is suddenly disconnected from the server hosting the files.\r\n\r\nThis setting also disables the \"When a network connection is lost\" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it.\r\n\r\nIf you enable this setting, you can use the \"Action\" box to specify how computers in the group respond.\r\n\r\n-- \"Work offline\" indicates that the computer can use local copies of network files while the server is inaccessible.\r\n\r\n-- \"Never go offline\" indicates that network files are not available while the server is inaccessible.\r\n\r\nIf you disable this setting or select the \"Work offline\" option, users can work offline if disconnected.\r\n\r\nIf you do not configure this setting, users can work offline by default, but they can change this option.\r\n\r\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\r\n\r\nTip: To configure this setting without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, click Advanced, and then select an option in the \"When a network connection is lost\" section.\r\n\r\nAlso, see the \"Non-default server disconnect actions\" setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-goofflineaction-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_goofflineaction_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_goofflineaction_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_goofflineaction_2_lbl_goofflineactioncombo","displayName":"Action: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_goofflineaction_2_lbl_goofflineactioncombo_0","displayName":"Work offline","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_goofflineaction_2_lbl_goofflineactioncombo_1","displayName":"Never go offline","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_nocacheviewer_2","displayName":"Prevent use of Offline Files folder","description":"Disables the Offline Files folder.\r\n\r\nThis setting disables the \"View Files\" button on the Offline Files tab. As a result, users cannot use the Offline Files folder to view or open copies of network files stored on their computer. Also, they cannot use the folder to view characteristics of offline files, such as their server status, type, or location.\r\n\r\nThis setting does not prevent users from working offline or from saving local copies of files available offline. Also, it does not prevent them from using other programs, such as Windows Explorer, to view their offline files.\r\n\r\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\r\n\r\nTip: To view the Offline Files Folder, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then click \"View Files.\"\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-nocacheviewer-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_nocacheviewer_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_nocacheviewer_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_noconfigcache_2","displayName":"Prohibit user configuration of Offline Files","description":"Prevents users from enabling, disabling, or changing the configuration of Offline Files.\r\n\r\nThis setting removes the Offline Files tab from the Folder Options dialog box. It also removes the Settings item from the Offline Files context menu and disables the Settings button on the Offline Files Status dialog box. As a result, users cannot view or change the options on the Offline Files tab or Offline Files dialog box.\r\n\r\nThis is a comprehensive setting that locks down the configuration you establish by using other settings in this folder.\r\n\r\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\r\n\r\nTip: This setting provides a quick method for locking down the default settings for Offline Files. To accept the defaults, just enable this setting. You do not have to disable any other settings in this folder.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-noconfigcache-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_noconfigcache_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_noconfigcache_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_nomakeavailableoffline_2","displayName":"Remove \"Make Available Offline\" command","description":"This policy setting prevents users from making network files and folders available offline.\r\n\r\nIf you enable this policy setting, users cannot designate files to be saved on their computer for offline use. However, Windows will still cache local copies of files that reside on network shares designated for automatic caching.\r\n\r\nIf you disable or do not configure this policy setting, users can manually specify files and folders that they want to make available offline.\r\n\r\nNotes:\r\n\r\nThis policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy setting in Computer Configuration takes precedence.\r\n\r\nThe \"Make Available Offline\" command is called \"Always available offline\" on computers running Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, or Windows Vista.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-nomakeavailableoffline-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_nomakeavailableoffline_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_nomakeavailableoffline_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_nopinfiles_2","displayName":"Remove \"Make Available Offline\" for these files and folders","description":"This policy setting allows you to manage a list of files and folders for which you want to block the \"Make Available Offline\" command.\r\n\r\nIf you enable this policy setting, the \"Make Available Offline\" command is not available for the files and folders that you list. To specify these files and folders, click Show. In the Show Contents dialog box, in the Value Name column box, type the fully qualified UNC path to the file or folder. Leave the Value column field blank.\r\n\r\nIf you disable this policy setting, the list of files and folders is deleted, including any lists inherited from lower precedence GPOs, and the \"Make Available Offline\" command is displayed for all files and folders.\r\n\r\nIf you do not configure this policy setting, the \"Make Available Offline\" command is available for all files and folders.\r\n\r\nNotes:\r\n\r\nThis policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy settings are combined, and the \"Make Available Offline\" command is unavailable for all specified files and folders.\r\n\r\nThe \"Make Available Offline\" command is called \"Always available offline\" on computers running Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, or Windows Vista.\r\n\r\nThis policy setting does not prevent files from being automatically cached if the network share is configured for \"Automatic Caching.\" It only affects the display of the \"Make Available Offline\" command in File Explorer.\r\n\r\nIf the \"Remove 'Make Available Offline' command\" policy setting is enabled, this setting has no effect.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-nopinfiles-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_nopinfiles_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_nopinfiles_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_nopinfiles_2_lbl_nopinfileslist","displayName":"Files and Folders: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_nopinfiles_2_lbl_nopinfileslist_key","displayName":"Name","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_nopinfiles_2_lbl_nopinfileslist_value","displayName":"Value","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_noreminders_2","displayName":"Turn off reminder balloons","description":"Hides or displays reminder balloons, and prevents users from changing the setting.\r\n\r\nReminder balloons appear above the Offline Files icon in the notification area to notify users when they have lost the connection to a networked file and are working on a local copy of the file. Users can then decide how to proceed.\r\n\r\nIf you enable this setting, the system hides the reminder balloons, and prevents users from displaying them.\r\n\r\nIf you disable the setting, the system displays the reminder balloons and prevents users from hiding them.\r\n\r\nIf this setting is not configured, reminder balloons are displayed by default when you enable offline files, but users can change the setting.\r\n\r\nTo prevent users from changing the setting while a setting is in effect, the system disables the \"Enable reminders\" option on the Offline Files tab\r\n\r\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\r\n\r\nTip: To display or hide reminder balloons without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, and then click the Offline Files tab. This setting corresponds to the \"Enable reminders\" check box.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-noreminders-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_noreminders_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_noreminders_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_onlinecachingsettings","displayName":"Enable Transparent Caching","description":"This policy setting controls whether files read from file shares over a slow network are transparently cached in the Offline Files cache for future reads. When a user tries to access a file that has been transparently cached, Windows reads from the cached copy after verifying its integrity. This improves end-user response times and decreases bandwidth consumption over WAN links.\r\n\r\nThe cached files are temporary and are not available to the user when offline. The cached files are not kept in sync with the version on the server, and the most current version from the server is always available for subsequent reads.\r\n\r\nThis policy setting is triggered by the configured round trip network latency value. We recommend using this policy setting when the network connection to the server is slow. For example, you can configure a value of 60 ms as the round trip latency of the network above which files should be transparently cached in the Offline Files cache. If the round trip latency of the network is less than 60ms, reads to remote files will not be cached.\r\n\r\nIf you enable this policy setting, transparent caching is enabled and configurable.\r\n\r\nIf you disable or do not configure this policy setting, remote files will be not be transparently cached on client computers.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-onlinecachingsettings"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_onlinecachingsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_onlinecachingsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_onlinecachingsettings_lbl_onlinecachingsettingslist","displayName":"Enter network latency value in milliseconds (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_purgeatlogoff","displayName":"At logoff, delete local copy of user’s offline files","description":"Deletes local copies of the user's offline files when the user logs off.\r\n\r\nThis setting specifies that automatically and manually cached offline files are retained only while the user is logged on to the computer. When the user logs off, the system deletes all local copies of offline files.\r\n\r\nIf you disable this setting or do not configure it, automatically and manually cached copies are retained on the user's computer for later offline use.\r\n\r\nCaution: Files are not synchronized before they are deleted. Any changes to local files since the last synchronization are lost.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-purgeatlogoff"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_purgeatlogoff_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_purgeatlogoff_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_purgeatlogoff_lbl_purgeonlyautocachedfiles","displayName":"Delete only the temporary offline files. (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_purgeatlogoff_lbl_purgeonlyautocachedfiles_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_purgeatlogoff_lbl_purgeonlyautocachedfiles_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_quickadimpin","displayName":"Turn on economical application of administratively assigned Offline Files","description":"This policy setting allows you to turn on economical application of administratively assigned Offline Files.\r\n\r\nIf you enable or do not configure this policy setting, only new files and folders in administratively assigned folders are synchronized at logon. Files and folders that are already available offline are skipped and are synchronized later.\r\n\r\nIf you disable this policy setting, all administratively assigned folders are synchronized at logon.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-quickadimpin"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_quickadimpin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_quickadimpin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_reminderfreq_2","displayName":"Reminder balloon frequency","description":"Determines how often reminder balloon updates appear.\r\n\r\nIf you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting.\r\n\r\nReminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the update interval.\r\n\r\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\r\n\r\nTip: To set reminder balloon frequency without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, and then click the Offline Files tab. This setting corresponds to the \"Display reminder balloons every ... minutes\" option.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-reminderfreq-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_reminderfreq_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_reminderfreq_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_reminderfreq_2_lbl_reminderfreqspin","displayName":"Minutes: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_reminderinittimeout_2","displayName":"Initial reminder balloon lifetime","description":"Determines how long the first reminder balloon for a network status change is displayed.\r\n\r\nReminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the duration of the first reminder.\r\n\r\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-reminderinittimeout-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_reminderinittimeout_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_reminderinittimeout_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_reminderinittimeout_2_lbl_reminderinittimeoutspin","displayName":"Seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_remindertimeout_2","displayName":"Reminder balloon lifetime","description":"Determines how long updated reminder balloons are displayed.\r\n\r\nReminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the duration of the update reminder.\r\n\r\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-remindertimeout-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_remindertimeout_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_remindertimeout_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_remindertimeout_2_lbl_remindertimeoutspin","displayName":"Seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_slowlinksettings","displayName":"Configure slow-link mode","description":"This policy setting controls the network latency and throughput thresholds that will cause a client computers to transition files and folders that are already available offline to the slow-link mode so that the user's access to this data is not degraded due to network slowness. When Offline Files is operating in the slow-link mode, all network file requests are satisfied from the Offline Files cache. This is similar to a user working offline.\r\n\r\nIf you enable this policy setting, Offline Files uses the slow-link mode if the network throughput between the client and the server is below (slower than) the Throughput threshold parameter, or if the round-trip network latency is above (slower than) the Latency threshold parameter.\r\n\r\nYou can configure the slow-link mode by specifying threshold values for Throughput (in bits per second) and/or Latency (in milliseconds) for specific UNC paths. We recommend that you always specify a value for Latency, since the round-trip network latency detection is faster. You can use wildcard characters (*) for specifying UNC paths. If you do not specify a Latency or Throughput value, computers running Windows Vista or Windows Server 2008 will not use the slow-link mode.\r\n\r\nIf you do not configure this policy setting, computers running Windows Vista or Windows Server 2008 will not transition a shared folder to the slow-link mode. Computers running Windows 7 or Windows Server 2008 R2 will use the default latency value of 80 milliseconds when transitioning a folder to the slow-link mode. Computers running Windows 8 or Windows Server 2012 will use the default latency value of 35 milliseconds when transitioning a folder to the slow-link mode. To avoid extra charges on cell phone or broadband plans, it may be necessary to configure the latency threshold to be lower than the round-trip network latency.\r\n\r\nIn Windows Vista or Windows Server 2008, once transitioned to slow-link mode, users will continue to operate in slow-link mode until the user clicks the Work Online button on the toolbar in Windows Explorer. Data will only be synchronized to the server if the user manually initiates synchronization by using Sync Center.\r\n\r\nIn Windows 7, Windows Server 2008 R2, Windows 8 or Windows Server 2012, when operating in slow-link mode Offline Files synchronizes the user's files in the background at regular intervals, or as configured by the \"Configure Background Sync\" policy. While in slow-link mode, Windows periodically checks the connection to the folder and brings the folder back online if network speeds improve.\r\n\r\nIn Windows 8 or Windows Server 2012, set the Latency threshold to 1ms to keep users always working offline in slow-link mode.\r\n\r\nIf you disable this policy setting, computers will not use the slow-link mode.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-slowlinksettings"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_slowlinksettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_slowlinksettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_slowlinksettings_lbl_slowlinksettingslist","displayName":"UNC Paths: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_slowlinksettings_lbl_slowlinksettingslist_key","displayName":"Name","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_slowlinksettings_lbl_slowlinksettingslist_value","displayName":"Value","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_slowlinkspeed","displayName":"Configure Slow link speed","description":"Configures the threshold value at which Offline Files considers a network connection to be \"slow\". Any network speed below this value is considered to be slow.\r\n\r\nWhen a connection is considered slow, Offline Files automatically adjust its behavior to avoid excessive synchronization traffic and will not automatically reconnect to a server when the presence of a server is detected.\r\n\r\nIf you enable this setting, you can configure the threshold value that will be used to determine a slow network connection.\r\n\r\nIf this setting is disabled or not configured, the default threshold value of 64,000 bps is used to determine if a network connection is considered to be slow.\r\n\r\nNote: Use the following formula when entering the slow link value: [ bps / 100]. For example, if you want to set a threshold value of 128,000 bps, enter a value of 1280.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-slowlinkspeed"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_slowlinkspeed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_slowlinkspeed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_slowlinkspeed_lbl_slowlinkspeedspin","displayName":"Value: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_syncatlogoff_2","displayName":"Synchronize all offline files before logging off","description":"Determines whether offline files are fully synchronized when users log off.\r\n\r\nThis setting also disables the \"Synchronize all offline files before logging off\" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it.\r\n\r\nIf you enable this setting, offline files are fully synchronized. Full synchronization ensures that offline files are complete and current.\r\n\r\nIf you disable this setting, the system only performs a quick synchronization. Quick synchronization ensures that files are complete, but does not ensure that they are current.\r\n\r\nIf you do not configure this setting, the system performs a quick synchronization by default, but users can change this option.\r\n\r\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\r\n\r\nTip: To change the synchronization method without changing a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then select the \"Synchronize all offline files before logging off\" option.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-syncatlogoff-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_syncatlogoff_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_syncatlogoff_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_syncatlogon_2","displayName":"Synchronize all offline files when logging on","description":"Determines whether offline files are fully synchronized when users log on.\r\n\r\nThis setting also disables the \"Synchronize all offline files before logging on\" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it.\r\n\r\nIf you enable this setting, offline files are fully synchronized at logon. Full synchronization ensures that offline files are complete and current. Enabling this setting automatically enables logon synchronization in Synchronization Manager.\r\n\r\nIf this setting is disabled and Synchronization Manager is configured for logon synchronization, the system performs only a quick synchronization. Quick synchronization ensures that files are complete but does not ensure that they are current.\r\n\r\nIf you do not configure this setting and Synchronization Manager is configured for logon synchronization, the system performs a quick synchronization by default, but users can change this option.\r\n\r\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\r\n\r\nTip: To change the synchronization method without setting a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then select the \"Synchronize all offline files before logging on\" option.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-syncatlogon-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_syncatlogon_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_syncatlogon_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_syncatsuspend_2","displayName":"Synchronize offline files before suspend","description":"Determines whether offline files are synchonized before a computer is suspended.\r\n\r\nIf you enable this setting, offline files are synchronized whenever the computer is suspended. Setting the synchronization action to \"Quick\" ensures only that all files in the cache are complete. Setting the synchronization action to \"Full\" ensures that all cached files and folders are up-to-date with the most current version.\r\n\r\nIf you disable or do not configuring this setting, files are not synchronized when the computer is suspended.\r\n\r\nNote: If the computer is suspended by closing the display on a portable computer, files are not synchronized. If multiple users are logged on to the computer at the time the computer is suspended, a synchronization is not performed.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-syncatsuspend-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_syncatsuspend_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_syncatsuspend_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_syncatsuspend_2_lbl_syncatsuspendcombo","displayName":"Action: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_syncatsuspend_2_lbl_syncatsuspendcombo_0","displayName":"Quick","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_syncatsuspend_2_lbl_syncatsuspendcombo_1","displayName":"Full","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_synconcostednetwork","displayName":"Enable file synchronization on costed networks","description":"This policy setting determines whether offline files are synchronized in the background when it could result in extra charges on cell phone or broadband plans.\r\n\r\nIf you enable this setting, synchronization can occur in the background when the user's network is roaming, near, or over the plan's data limit. This may result in extra charges on cell phone or broadband plans.\r\n\r\nIf this setting is disabled or not configured, synchronization will not run in the background on network folders when the user's network is roaming, near, or over the plan's data limit. The network folder must also be in \"slow-link\" mode, as specified by the \"Configure slow-link mode\" policy to avoid network usage.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-synconcostednetwork"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_synconcostednetwork_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_synconcostednetwork_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_workofflinedisabled_2","displayName":"Remove \"Work offline\" command","description":"This policy setting removes the \"Work offline\" command from Explorer, preventing users from manually changing whether Offline Files is in online mode or offline mode.\r\n\r\nIf you enable this policy setting, the \"Work offline\" command is not displayed in File Explorer.\r\n\r\nIf you disable or do not configure this policy setting, the \"Work offline\" command is displayed in File Explorer.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-offlinefiles#admx-offlinefiles-pol-workofflinedisabled-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_workofflinedisabled_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_offlinefiles_pol_workofflinedisabled_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_pca_detectblockeddriverspolicy","displayName":"Notify blocked drivers","description":"This setting exists only for backward compatibility, and is not valid for this version of Windows. To configure the Program Compatibility Assistant, use the 'Turn off Program Compatibility Assistant' setting under Computer Configuration\\Administrative Templates\\Windows Components\\Application Compatibility.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-pca#admx-pca-detectblockeddriverspolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_pca_detectblockeddriverspolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_pca_detectblockeddriverspolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_pca_detectdeprecatedcomcomponentfailurespolicy","displayName":"Detect application failures caused by deprecated COM objects","description":"This setting exists only for backward compatibility, and is not valid for this version of Windows. To configure the Program Compatibility Assistant, use the 'Turn off Program Compatibility Assistant' setting under Computer Configuration\\Administrative Templates\\Windows Components\\Application Compatibility.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-pca#admx-pca-detectdeprecatedcomcomponentfailurespolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_pca_detectdeprecatedcomcomponentfailurespolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_pca_detectdeprecatedcomcomponentfailurespolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_pca_detectdeprecatedcomcomponentfailurespolicy_detectdeprecatedcomcomponentfailureslevel","displayName":"Scenario Execution Level (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_pca_detectdeprecatedcomcomponentfailurespolicy_detectdeprecatedcomcomponentfailureslevel_1","displayName":"Detection and Troubleshooting Only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_pca_detectdeprecatedcomcomponentfailurespolicy_detectdeprecatedcomcomponentfailureslevel_2","displayName":"Detection, Troubleshooting and Resolution","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_pca_detectdeprecatedcomponentfailurespolicy","displayName":"Detect application failures caused by deprecated Windows DLLs","description":"This setting exists only for backward compatibility, and is not valid for this version of Windows. To configure the Program Compatibility Assistant, use the 'Turn off Program Compatibility Assistant' setting under Computer Configuration\\Administrative Templates\\Windows Components\\Application Compatibility.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-pca#admx-pca-detectdeprecatedcomponentfailurespolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_pca_detectdeprecatedcomponentfailurespolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_pca_detectdeprecatedcomponentfailurespolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_pca_detectdeprecatedcomponentfailurespolicy_detectdeprecatedcomponentfailureslevel","displayName":"Scenario Execution Level (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_pca_detectdeprecatedcomponentfailurespolicy_detectdeprecatedcomponentfailureslevel_1","displayName":"Detection and Troubleshooting Only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_pca_detectdeprecatedcomponentfailurespolicy_detectdeprecatedcomponentfailureslevel_2","displayName":"Detection, Troubleshooting and Resolution","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_pca_detectinstallfailurespolicy","displayName":"Detect application install failures","description":"This setting exists only for backward compatibility, and is not valid for this version of Windows. To configure the Program Compatibility Assistant, use the 'Turn off Program Compatibility Assistant' setting under Computer Configuration\\Administrative Templates\\Windows Components\\Application Compatibility.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-pca#admx-pca-detectinstallfailurespolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_pca_detectinstallfailurespolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_pca_detectinstallfailurespolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_pca_detectundetectedinstallerspolicy","displayName":"Detect application installers that need to be run as administrator","description":"This setting exists only for backward compatibility, and is not valid for this version of Windows. To configure the Program Compatibility Assistant, use the 'Turn off Program Compatibility Assistant' setting under Computer Configuration\\Administrative Templates\\Windows Components\\Application Compatibility.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-pca#admx-pca-detectundetectedinstallerspolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_pca_detectundetectedinstallerspolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_pca_detectundetectedinstallerspolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_pca_detectundetectedinstallerspolicy_detectundetectedinstallerslevel","displayName":"Scenario Execution Level (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_pca_detectundetectedinstallerspolicy_detectundetectedinstallerslevel_1","displayName":"Detection and Troubleshooting Only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_pca_detectundetectedinstallerspolicy_detectundetectedinstallerslevel_2","displayName":"Detection, Troubleshooting and Resolution","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_pca_detectupdatefailurespolicy","displayName":"Detect applications unable to launch installers under UAC","description":"This setting exists only for backward compatibility, and is not valid for this version of Windows. To configure the Program Compatibility Assistant, use the 'Turn off Program Compatibility Assistant' setting under Computer Configuration\\Administrative Templates\\Windows Components\\Application Compatibility.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-pca#admx-pca-detectupdatefailurespolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_pca_detectupdatefailurespolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_pca_detectupdatefailurespolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_pca_detectupdatefailurespolicy_detectupdatefailureslevel","displayName":"Scenario Execution Level (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_pca_detectupdatefailurespolicy_detectupdatefailureslevel_1","displayName":"Detection and Troubleshooting Only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_pca_detectupdatefailurespolicy_detectupdatefailureslevel_2","displayName":"Detection, Troubleshooting and Resolution","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_pca_disablepcauipolicy","displayName":"Detect compatibility issues for applications and drivers","description":"This policy setting configures the Program Compatibility Assistant (PCA) to diagnose failures with application and driver compatibility. \r\n\r\nIf you enable this policy setting, the PCA is configured to detect failures during application installation, failures during application runtime, and drivers blocked due to compatibility issues. When failures are detected, the PCA will provide options to run the application in a compatibility mode or get help online through a Microsoft website.\r\n\r\nIf you disable this policy setting, the PCA does not detect compatibility issues for applications and drivers.\r\n\r\nIf you do not configure this policy setting, the PCA is configured to detect failures during application installation, failures during application runtime, and drivers blocked due to compatibility issues.\r\n\r\nNote: This policy setting has no effect if the \"Turn off Program Compatibility Assistant\" policy setting is enabled. The Diagnostic Policy Service (DPS) and Program Compatibility Assistant Service must be running for the PCA to run. These services can be configured by using the Services snap-in to the Microsoft Management Console.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-pca#admx-pca-disablepcauipolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_pca_disablepcauipolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_pca_disablepcauipolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache","displayName":"Turn on BranchCache","description":"This policy setting specifies whether BranchCache is enabled on client computers to which this policy is applied. In addition to this policy setting, you must specify whether the client computers are hosted cache mode or distributed cache mode clients. To do so, configure one of the following the policy settings: \r\n\r\n- Set BranchCache Distributed Cache mode\r\n\r\n- Set BranchCache Hosted Cache mode\r\n\r\n- Configure Hosted Cache Servers\r\n\r\nPolicy configuration\r\n\r\nSelect one of the following:\r\n\r\n- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy. In the circumstance where client computers are domain members but you do not want to enable BranchCache on all client computers, you can specify Not Configured for this domain Group Policy setting, and then configure local computer policy to enable BranchCache on individual client computers. Because the domain Group Policy setting is not configured, it will not over-write the enabled setting that you use on individual client computers where you want to enable BranchCache.\r\n\r\n- Enabled. With this selection, BranchCache is turned on for all client computers where the policy is applied. For example, if this policy is enabled in domain Group Policy, BranchCache is turned on for all domain member client computers to which the policy is applied.\r\n\r\n- Disabled. With this selection, BranchCache is turned off for all client computers where the policy is applied.\r\n\r\n* This policy setting is supported on computers that are running Windows Vista Business, Enterprise, and Ultimate editions with Background Intelligent Transfer Service (BITS) 4.0 installed.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-peertopeercaching#admx-peertopeercaching-enablewindowsbranchcache"],"options":[{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_distributed","displayName":"Set BranchCache Distributed Cache mode","description":"This policy setting specifies whether BranchCache distributed cache mode is enabled on client computers to which this policy is applied. In addition to this policy, you must use the policy \"Turn on BranchCache\" to enable BranchCache on client computers.\r\n\r\nIn distributed cache mode, client computers download content from BranchCache-enabled main office content servers, cache the content locally, and serve the content to other BranchCache distributed cache mode clients in the branch office.\r\n\r\nPolicy configuration\r\n\r\nSelect one of the following:\r\n\r\n- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy. In the circumstance where client computers are domain members but you do not want to enable BranchCache on all client computers, you can specify Not Configured for this domain Group Policy setting, and then configure local computer policy to enable BranchCache on individual client computers. Because the domain Group Policy setting is not configured, it will not over-write the enabled setting that you use on individual client computers where you want to enable BranchCache.\r\n\r\n- Enabled. With this selection, BranchCache distributed cache mode is enabled for all client computers where the policy is applied. For example, if this policy is enabled in domain Group Policy, BranchCache distributed cache mode is turned on for all domain member client computers to which the policy is applied.\r\n\r\n- Disabled. With this selection, BranchCache distributed cache mode is turned off for all client computers where the policy is applied.\r\n\r\n* This policy setting is supported on computers that are running Windows Vista Business, Enterprise, and Ultimate editions with Background Intelligent Transfer Service (BITS) 4.0 installed.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-peertopeercaching#admx-peertopeercaching-enablewindowsbranchcache-distributed"],"options":[{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_distributed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_distributed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_hosted","displayName":"Set BranchCache Hosted Cache mode","description":"This policy setting specifies whether BranchCache hosted cache mode is enabled on client computers to which this policy is applied. In addition to this policy, you must use the policy \"Turn on BranchCache\" to enable BranchCache on client computers.\r\n\r\nWhen a client computer is configured as a hosted cache mode client, it is able to download cached content from a hosted cache server that is located at the branch office. In addition, when the hosted cache client obtains content from a content server, the client can upload the content to the hosted cache server for access by other hosted cache clients at the branch office.\r\n\r\nPolicy configuration\r\n\r\nSelect one of the following:\r\n\r\n- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy. In the circumstance where client computers are domain members but you do not want to enable BranchCache on all client computers, you can specify Not Configured for this domain Group Policy setting, and then configure local computer policy to enable BranchCache on individual client computers. Because the domain Group Policy setting is not configured, it will not over-write the enabled setting that you use on individual client computers where you want to enable BranchCache.\r\n\r\n- Enabled. With this selection, BranchCache hosted cache mode is enabled for all client computers where the policy is applied. For example, if this policy is enabled in domain Group Policy, BranchCache hosted cache mode is turned on for all domain member client computers to which the policy is applied.\r\n\r\n- Disabled. With this selection, BranchCache hosted cache mode is turned off for all client computers where the policy is applied.\r\n\r\nIn circumstances where this setting is enabled, you can also select and configure the following option:\r\n\r\n- Type the name of the hosted cache server. Specifies the computer name of the hosted cache server. Because the hosted cache server name is also specified in the certificate enrolled to the hosted cache server, the name that you enter here must match the name of the hosted cache server that is specified in the server certificate. \r\n\r\nHosted cache clients must trust the server certificate that is issued to the hosted cache server. Ensure that the issuing CA certificate is installed in the Trusted Root Certification Authorities certificate store on all hosted cache client computers.\r\n\r\n* This policy setting is supported on computers that are running Windows Vista Business, Enterprise, and Ultimate editions with Background Intelligent Transfer Service (BITS) 4.0 installed.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-peertopeercaching#admx-peertopeercaching-enablewindowsbranchcache-hosted"],"options":[{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_hosted_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_hosted_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_hosted_wbc_cache_textbox","displayName":"Type the name of the hosted cache server (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_hostedcachediscovery","displayName":"Enable Automatic Hosted Cache Discovery by Service Connection Point","description":"This policy setting specifies whether client computers should attempt the automatic configuration of hosted cache mode by searching for hosted cache servers publishing service connection points that are associated with the client's current Active Directory site. If you enable this policy setting, client computers to which the policy setting is applied search for hosted cache servers using Active Directory, and will prefer both these servers and hosted cache mode rather than manual BranchCache configuration or BranchCache configuration by other group policies.\r\n\r\nIf you enable this policy setting in addition to the \"Turn on BranchCache\" policy setting, BranchCache clients attempt to discover hosted cache servers in the local branch office. If client computers detect hosted cache servers, hosted cache mode is turned on. If they do not detect hosted cache servers, hosted cache mode is not turned on, and the client uses any other configuration that is specified manually or by Group Policy.\r\n\r\nWhen this policy setting is applied, the client computer performs or does not perform automatic hosted cache server discovery under the following circumstances:\r\n\r\nIf no other BranchCache mode-based policy settings are applied, the client computer performs automatic hosted cache server discovery. If one or more hosted cache servers is found, the client computer self-configures for hosted cache mode.\r\n\r\nIf the policy setting \"Set BranchCache Distributed Cache Mode\" is applied in addition to this policy, the client computer performs automatic hosted cache server discovery. If one or more hosted cache servers are found, the client computer self-configures for hosted cache mode only.\r\n\r\nIf the policy setting \"Set BranchCache Hosted Cache Mode\" is applied, the client computer does not perform automatic hosted cache discovery. This is also true in cases where the policy setting \"Configure Hosted Cache Servers\" is applied.\r\n\r\nThis policy setting can only be applied to client computers that are running at least Windows 8. This policy has no effect on computers that are running Windows 7 or Windows Vista. \r\n\r\nIf you disable, or do not configure this setting, a client will not attempt to discover hosted cache servers by service connection point.\r\n\r\nPolicy configuration\r\n\r\nSelect one of the following:\r\n\r\n- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy setting, and client computers do not perform hosted cache server discovery.\r\n\r\n- Enabled. With this selection, the policy setting is applied to client computers, which perform automatic hosted cache server discovery and which are configured as hosted cache mode clients.\r\n\r\n- Disabled. With this selection, this policy is not applied to client computers.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-peertopeercaching#admx-peertopeercaching-enablewindowsbranchcache-hostedcachediscovery"],"options":[{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_hostedcachediscovery_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_hostedcachediscovery_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_hostedmultipleservers","displayName":"Configure Hosted Cache Servers","description":"This policy setting specifies whether client computers are configured to use hosted cache mode and provides the computer name of the hosted cache servers that are available to the client computers. Hosted cache mode enables client computers in branch offices to retrieve content from one or more hosted cache servers that are installed in the same office location. You can use this setting to automatically configure client computers that are configured for hosted cache mode with the computer names of the hosted cache servers in the branch office.\r\n\r\nIf you enable this policy setting and specify valid computer names of hosted cache servers, hosted cache mode is enabled for all client computers to which the policy setting is applied. For this policy setting to take effect, you must also enable the \"Turn on BranchCache\" policy setting.\r\n\r\nThis policy setting can only be applied to client computers that are running at least Windows 8. This policy has no effect on computers that are running Windows 7 or Windows Vista. Client computers to which this policy setting is applied, in addition to the \"Set BranchCache Hosted Cache mode\" policy setting, use the hosted cache servers that are specified in this policy setting and do not use the hosted cache server that is configured in the policy setting \"Set BranchCache Hosted Cache Mode.\"\r\n\r\nIf you do not configure this policy setting, or if you disable this policy setting, client computers that are configured with hosted cache mode still function correctly.\r\n\r\nPolicy configuration\r\n\r\nSelect one of the following:\r\n\r\n- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy setting.\r\n\r\n- Enabled. With this selection, the policy setting is applied to client computers, which are configured as hosted cache mode clients that use the hosted cache servers that you specify in \"Hosted cache servers.\"\r\n\r\n- Disabled. With this selection, this policy is not applied to client computers.\r\n\r\nIn circumstances where this setting is enabled, you can also select and configure the following option:\r\n\r\n- Hosted cache servers. To add hosted cache server computer names to this policy setting, click Enabled, and then click Show. The Show Contents dialog box opens. Click Value, and then type the computer names of the hosted cache servers.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-peertopeercaching#admx-peertopeercaching-enablewindowsbranchcache-hostedmultipleservers"],"options":[{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_hostedmultipleservers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_hostedmultipleservers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_hostedmultipleservers_wbc_multipleservers_listbox","displayName":"\r\nHosted cache servers\r\n","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_smb","displayName":"Configure BranchCache for network files","description":"This policy setting is used only when you have deployed one or more BranchCache-enabled file servers at your main office. This policy setting specifies when client computers in branch offices start caching content from file servers based on the network latency - or delay - that occurs when the clients download content from the main office over a Wide Area Network (WAN) link. When you configure a value for this setting, which is the maximum round trip network latency allowed before caching begins, clients do not cache content until the network latency reaches the specified value; when network latency is greater than the value, clients begin caching content after they receive it from the file servers.\r\n\r\nPolicy configuration\r\n\r\nSelect one of the following:\r\n\r\n- Not Configured. With this selection, BranchCache latency settings are not applied to client computers by this policy. In the circumstance where client computers are domain members but you do not want to configure a BranchCache latency setting on all client computers, you can specify Not Configured for this domain Group Policy setting, and then configure local computer policy to enable BranchCache latency settings on individual client computers. Because the domain Group Policy setting is not configured, it will not over-write the latency setting that you use on individual client computers.\r\n\r\n- Enabled. With this selection, the BranchCache maximum round trip latency setting is enabled for all client computers where the policy is applied. For example, if Configure BranchCache for network files is enabled in domain Group Policy, the BranchCache latency setting that you specify in the policy is turned on for all domain member client computers to which the policy is applied.\r\n\r\n- Disabled. With this selection, BranchCache client computers use the default latency setting of 80 milliseconds.\r\n\r\nIn circumstances where this policy setting is enabled, you can also select and configure the following option:\r\n\r\n- Type the maximum round trip network latency (milliseconds) after which caching begins. Specifies the amount of time, in milliseconds, after which BranchCache client computers begin to cache content locally.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-peertopeercaching#admx-peertopeercaching-enablewindowsbranchcache-smb"],"options":[{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_smb_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_smb_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_enablewindowsbranchcache_smb_wbc_smblatency_decimaltextbox","displayName":"\r\nType the maximum round trip network latency (milliseconds) after which caching begins\r\n","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_setcachepercent","displayName":"Set percentage of disk space used for client computer cache","description":"This policy setting specifies the default percentage of total disk space that is allocated for the BranchCache disk cache on client computers.\r\n\r\nIf you enable this policy setting, you can configure the percentage of total disk space to allocate for the cache.\r\n\r\nIf you disable or do not configure this policy setting, the cache is set to 5 percent of the total disk space on the client computer.\r\n\r\nPolicy configuration\r\n\r\nSelect one of the following:\r\n\r\n- Not Configured. With this selection, BranchCache client computer cache settings are not applied to client computers by this policy. In the circumstance where client computers are domain members but you do not want to configure a BranchCache client computer cache setting on all client computers, you can specify Not Configured for this domain Group Policy setting, and then configure local computer policy to enable BranchCache client computer cache settings on individual client computers. Because the domain Group Policy setting is not configured, it will not over-write the client computer cache setting that you use on individual client computers.\r\n\r\n- Enabled. With this selection, the BranchCache client computer cache setting is enabled for all client computers where the policy is applied. For example, if Set percentage of disk space used for client computer cache is enabled in domain Group Policy, the BranchCache client computer cache setting that you specify in the policy is turned on for all domain member client computers to which the policy is applied.\r\n\r\n- Disabled. With this selection, BranchCache client computers use the default client computer cache setting of five percent of the total disk space on the client computer.\r\n\r\nIn circumstances where this setting is enabled, you can also select and configure the following option:\r\n\r\n- Specify the percentage of total disk space allocated for the cache. Specifies an integer that is the percentage of total client computer disk space to use for the BranchCache client computer cache.\r\n\r\n* This policy setting is supported on computers that are running Windows Vista Business, Enterprise, and Ultimate editions with Background Intelligent Transfer Service (BITS) 4.0 installed.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-peertopeercaching#admx-peertopeercaching-setcachepercent"],"options":[{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_setcachepercent_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_setcachepercent_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_setcachepercent_wbc_cache_size_percent_dctxtbox","displayName":"\r\nSpecify the percentage of total disk space allocated for the cache\r\n","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_setdatacacheentrymaxage","displayName":"Set age for segments in the data cache","description":"This policy setting specifies the default age in days for which segments are valid in the BranchCache data cache on client computers.\r\n\r\nIf you enable this policy setting, you can configure the age for segments in the data cache.\r\n\r\nIf you disable or do not configure this policy setting, the age is set to 28 days.\r\n\r\nPolicy configuration\r\n\r\nSelect one of the following:\r\n\r\n- Not Configured. With this selection, BranchCache client computer cache age settings are not applied to client computers by this policy. In the circumstance where client computers are domain members but you do not want to configure a BranchCache client computer cache age setting on all client computers, you can specify Not Configured for this domain Group Policy setting, and then configure local computer policy to enable BranchCache client computer cache age settings on individual client computers. Because the domain Group Policy setting is not configured, it will not over-write the client computer cache age setting that you use on individual client computers.\r\n\r\n- Enabled. With this selection, the BranchCache client computer cache age setting is enabled for all client computers where the policy is applied. For example, if this policy setting is enabled in domain Group Policy, the BranchCache client computer cache age that you specify in the policy is turned on for all domain member client computers to which the policy is applied.\r\n\r\n- Disabled. With this selection, BranchCache client computers use the default client computer cache age setting of 28 days on the client computer.\r\n\r\nIn circumstances where this setting is enabled, you can also select and configure the following option:\r\n\r\n- Specify the age in days for which segments in the data cache are valid.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-peertopeercaching#admx-peertopeercaching-setdatacacheentrymaxage"],"options":[{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_setdatacacheentrymaxage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_setdatacacheentrymaxage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_setdatacacheentrymaxage_wbc_cache_maxage_dctxtbox","displayName":"\r\nSpecify the age in days for which segments in the data cache are valid\r\n","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_setdowngrading","displayName":"Configure Client BranchCache Version Support","description":"This policy setting specifies whether BranchCache-capable client computers operate in a downgraded mode in order to maintain compatibility with previous versions of BranchCache. If client computers do not use the same BranchCache version, cache efficiency might be reduced because client computers that are using different versions of BranchCache might store cache data in incompatible formats.\r\n\r\nIf you enable this policy setting, all clients use the version of BranchCache that you specify in \"Select from the following versions.\"\r\n\r\nIf you do not configure this setting, all clients will use the version of BranchCache that matches their operating system.\r\n\r\nPolicy configuration\r\n\r\nSelect one of the following:\r\n\r\n- Not Configured. With this selection, this policy setting is not applied to client computers, and the clients run the version of BranchCache that is included with their operating system.\r\n\r\n- Enabled. With this selection, this policy setting is applied to client computers based on the value of the option setting \"Select from the following versions\" that you specify.\r\n\r\n- Disabled. With this selection, this policy setting is not applied to client computers, and the clients run the version of BranchCache that is included with their operating system.\r\n\r\nIn circumstances where this setting is enabled, you can also select and configure the following option:\r\n\r\nSelect from the following versions\r\n\r\n- Windows Vista with BITS 4.0 installed, Windows 7, or Windows Server 2008 R2. If you select this version, later versions of Windows run the version of BranchCache that is included in these operating systems rather than later versions of BranchCache.\r\n\r\n- Windows 8. If you select this version, Windows 8 will run the version of BranchCache that is included in the operating system.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-peertopeercaching#admx-peertopeercaching-setdowngrading"],"options":[{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_setdowngrading_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_setdowngrading_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_setdowngrading_downgrading_version","displayName":"Select from the following versions: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_setdowngrading_downgrading_version_1","displayName":"Windows Vista with BITS 4.0 installed, Windows 7, or Windows Server 2008 R2","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_peertopeercaching_setdowngrading_downgrading_version_2","displayName":"Windows 8","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_pentraining_pentrainingoff_2","displayName":"Turn off Tablet PC Pen Training","description":"Turns off Tablet PC Pen Training.\r\n\r\nIf you enable this policy setting, users cannot open Tablet PC Pen Training.\r\n\r\nIf you disable or do not configure this policy setting, users can open Tablet PC Pen Training.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-pentraining#admx-pentraining-pentrainingoff-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_pentraining_pentrainingoff_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_pentraining_pentrainingoff_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_1","displayName":"Configure Scenario Execution Level","description":"Determines the execution level for Windows Boot Performance Diagnostics.\r\n\r\nIf you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Boot Performance problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will detect Windows Boot Performance problems and indicate to the user that assisted resolution is available.\r\n\r\nIf you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any Windows Boot Performance problems that are handled by the DPS.\r\n\r\nIf you do not configure this policy setting, the DPS will enable Windows Boot Performance for resolution by default.\r\n\r\nThis policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.\r\n\r\nNo system restart or service restart is required for this policy to take effect: changes take effect immediately.\r\n\r\nThis policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-performancediagnostics#admx-performancediagnostics-wdiscenarioexecutionpolicy-1"],"options":[{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_1_wdiscenarioexecutionpolicylevel","displayName":"Scenario Execution Level (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_1_wdiscenarioexecutionpolicylevel_1","displayName":"Detection and Troubleshooting Only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_1_wdiscenarioexecutionpolicylevel_2","displayName":"Detection, Troubleshooting and Resolution","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_2","displayName":"Configure Scenario Execution Level","description":"Determines the execution level for Windows System Responsiveness Diagnostics.\r\n\r\nIf you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows System Responsiveness problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will detect Windows System Responsiveness problems and indicate to the user that assisted resolution is available.\r\n\r\nIf you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any Windows System Responsiveness problems that are handled by the DPS.\r\n\r\nIf you do not configure this policy setting, the DPS will enable Windows System Responsiveness for resolution by default.\r\n\r\nThis policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.\r\n\r\nNo system restart or service restart is required for this policy to take effect: changes take effect immediately.\r\n\r\nThis policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-performancediagnostics#admx-performancediagnostics-wdiscenarioexecutionpolicy-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_2_wdiscenarioexecutionpolicylevel","displayName":"Scenario Execution Level (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_2_wdiscenarioexecutionpolicylevel_1","displayName":"Detection and Troubleshooting Only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_2_wdiscenarioexecutionpolicylevel_2","displayName":"Detection, Troubleshooting and Resolution","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_3","displayName":"Configure Scenario Execution Level","description":"Determines the execution level for Windows Shutdown Performance Diagnostics.\r\n\r\nIf you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Shutdown Performance problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will detect Windows Shutdown Performance problems and indicate to the user that assisted resolution is available.\r\n\r\nIf you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any Windows Shutdown Performance problems that are handled by the DPS.\r\n\r\nIf you do not configure this policy setting, the DPS will enable Windows Shutdown Performance for resolution by default.\r\n\r\nThis policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.\r\n\r\nNo system restart or service restart is required for this policy to take effect: changes take effect immediately.\r\n\r\nThis policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-performancediagnostics#admx-performancediagnostics-wdiscenarioexecutionpolicy-3"],"options":[{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_3_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_3_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_3_wdiscenarioexecutionpolicylevel","displayName":"Scenario Execution Level (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_3_wdiscenarioexecutionpolicylevel_1","displayName":"Detection and Troubleshooting Only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_3_wdiscenarioexecutionpolicylevel_2","displayName":"Detection, Troubleshooting and Resolution","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_4","displayName":"Configure Scenario Execution Level","description":"Determines the execution level for Windows Standby/Resume Performance Diagnostics.\r\n\r\nIf you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Standby/Resume Performance problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will detect Windows Standby/Resume Performance problems and indicate to the user that assisted resolution is available.\r\n\r\nIf you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any Windows Standby/Resume Performance problems that are handled by the DPS.\r\n\r\nIf you do not configure this policy setting, the DPS will enable Windows Standby/Resume Performance for resolution by default.\r\n\r\nThis policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.\r\n\r\nNo system restart or service restart is required for this policy to take effect: changes take effect immediately.\r\n\r\nThis policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-performancediagnostics#admx-performancediagnostics-wdiscenarioexecutionpolicy-4"],"options":[{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_4_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_4_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_4_wdiscenarioexecutionpolicylevel","displayName":"Scenario Execution Level (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_4_wdiscenarioexecutionpolicylevel_1","displayName":"Detection and Troubleshooting Only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_performancediagnostics_wdiscenarioexecutionpolicy_4_wdiscenarioexecutionpolicylevel_2","displayName":"Detection, Troubleshooting and Resolution","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_acconnectivityinstandby_2","displayName":"Allow network connectivity during connected-standby (plugged in)","description":"This policy setting allows you to control the network connectivity state in standby on modern standby-capable systems.\r\n\r\nIf you enable this policy setting, network connectivity will be maintained in standby.\r\n\r\nIf you disable this policy setting, network connectivity in standby is not guaranteed. This connectivity restriction currently applies to WLAN networks only, and is subject to change.\r\n\r\nIf you do not configure this policy setting, users control this setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-acconnectivityinstandby-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_acconnectivityinstandby_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_acconnectivityinstandby_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_accriticalsleeptransitionsdisable_2","displayName":"Turn on the ability for applications to prevent sleep transitions (plugged in)","description":"This policy setting allows you to turn on the ability for applications and services to prevent the system from sleeping.\r\n\r\nIf you enable this policy setting, an application or service may prevent the system from sleeping (Hybrid Sleep, Stand By, or Hibernate).\r\n\r\nIf you disable or do not configure this policy setting, users control this setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-accriticalsleeptransitionsdisable-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_accriticalsleeptransitionsdisable_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_accriticalsleeptransitionsdisable_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_acstartmenubuttonaction_2","displayName":"Select the Start menu Power button action (plugged in)","description":"This policy setting specifies the action that Windows takes when a user presses the Start menu Power button.\r\n\r\nIf you enable this policy setting, select one of the following actions:\r\n-Sleep\r\n-Hibernate\r\n-Shut down\r\n\r\nIf you disable this policy or do not configure this policy setting, users control this setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-acstartmenubuttonaction-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_acstartmenubuttonaction_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_acstartmenubuttonaction_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_acstartmenubuttonaction_2_selectacstartmenubuttonaction","displayName":"User Interface Sleep Button Action (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_power_acstartmenubuttonaction_2_selectacstartmenubuttonaction_0","displayName":"Sleep","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_acstartmenubuttonaction_2_selectacstartmenubuttonaction_1","displayName":"Hibernate","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_acstartmenubuttonaction_2_selectacstartmenubuttonaction_2","displayName":"Shut down","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_allowsystempowerrequestac","displayName":"Allow applications to prevent automatic sleep (plugged in)","description":"This policy setting allows applications and services to prevent automatic sleep.\r\n\r\nIf you enable this policy setting, any application, service, or device driver prevents Windows from automatically transitioning to sleep after a period of user inactivity.\r\n\r\nIf you disable or do not configure this policy setting, applications, services, or drivers do not prevent Windows from automatically transitioning to sleep. Only user input is used to determine if Windows should automatically sleep.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-allowsystempowerrequestac"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_allowsystempowerrequestac_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_allowsystempowerrequestac_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_allowsystempowerrequestdc","displayName":"Allow applications to prevent automatic sleep (on battery)","description":"This policy setting allows applications and services to prevent automatic sleep.\r\n\r\nIf you enable this policy setting, any application, service, or device driver prevents Windows from automatically transitioning to sleep after a period of user inactivity.\r\n\r\nIf you disable or do not configure this policy setting, applications, services, or drivers do not prevent Windows from automatically transitioning to sleep. Only user input is used to determine if Windows should automatically sleep.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-allowsystempowerrequestdc"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_allowsystempowerrequestdc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_allowsystempowerrequestdc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_allowsystemsleepwithremotefilesopenac","displayName":"Allow automatic sleep with Open Network Files (plugged in)","description":"This policy setting allows you to manage automatic sleep with open network files.\r\n\r\nIf you enable this policy setting, the computer automatically sleeps when network files are open.\r\n\r\nIf you disable or do not configure this policy setting, the computer does not automatically sleep when network files are open.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-allowsystemsleepwithremotefilesopenac"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_allowsystemsleepwithremotefilesopenac_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_allowsystemsleepwithremotefilesopenac_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_allowsystemsleepwithremotefilesopendc","displayName":"Allow automatic sleep with Open Network Files (on battery)","description":"This policy setting allows you to manage automatic sleep with open network files.\r\n\r\nIf you enable this policy setting, the computer automatically sleeps when network files are open.\r\n\r\nIf you disable or do not configure this policy setting, the computer does not automatically sleep when network files are open.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-allowsystemsleepwithremotefilesopendc"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_allowsystemsleepwithremotefilesopendc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_allowsystemsleepwithremotefilesopendc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_customactiveschemeoverride_2","displayName":"Specify a custom active power plan","description":"This policy setting specifies the active power plan from a specified power plan’s GUID. The GUID for a custom power plan GUID can be retrieved by using powercfg, the power configuration command line tool. \r\n\r\nIf you enable this policy setting, you must specify a power plan, specified as a GUID using the following format: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX (For example, 103eea6e-9fcd-4544-a713-c282d8e50083), indicating the power plan to be active.\r\n\r\nIf you disable or do not configure this policy setting, users can see and change this setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-customactiveschemeoverride-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_customactiveschemeoverride_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_customactiveschemeoverride_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_customactiveschemeoverride_2_customactiveschemeoverrideenter","displayName":"Custom Active Power Plan (GUID): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargeaction0_2","displayName":"Critical battery notification action","description":"This policy setting specifies the action that Windows takes when battery capacity reaches the critical battery notification level.\r\n\r\nIf you enable this policy setting, select one of the following actions:\r\n-Take no action\r\n-Sleep\r\n-Hibernate\r\n-Shut down\r\n\r\nIf you disable or do not configure this policy setting, users control this setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-dcbatterydischargeaction0-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargeaction0_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargeaction0_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargeaction0_2_selectdcbatterydischargeaction0","displayName":"Critical Battery Notification Action (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargeaction0_2_selectdcbatterydischargeaction0_0","displayName":"Take no action","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargeaction0_2_selectdcbatterydischargeaction0_1","displayName":"Sleep","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargeaction0_2_selectdcbatterydischargeaction0_2","displayName":"Hibernate","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargeaction0_2_selectdcbatterydischargeaction0_3","displayName":"Shut down","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargeaction1_2","displayName":"Low battery notification action","description":"This policy setting specifies the action that Windows takes when battery capacity reaches the low battery notification level.\r\n\r\nIf you enable this policy setting, select one of the following actions:\r\n-Take no action\r\n-Sleep\r\n-Hibernate\r\n-Shut down\r\n\r\nIf you disable or do not configure this policy setting, users control this setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-dcbatterydischargeaction1-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargeaction1_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargeaction1_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargeaction1_2_selectdcbatterydischargeaction1","displayName":"Low Battery Notification Action (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargeaction1_2_selectdcbatterydischargeaction1_0","displayName":"Take no action","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargeaction1_2_selectdcbatterydischargeaction1_1","displayName":"Sleep","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargeaction1_2_selectdcbatterydischargeaction1_2","displayName":"Hibernate","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargeaction1_2_selectdcbatterydischargeaction1_3","displayName":"Shut down","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargelevel0_2","displayName":"Critical battery notification level","description":"This policy setting specifies the percentage of battery capacity remaining that triggers the critical battery notification action.\r\n\r\nIf you enable this policy setting, you must enter a numeric value (percentage) to set the battery level that triggers the critical notification.\r\n\r\nTo set the action that is triggered, see the \"Critical Battery Notification Action\" policy setting.\r\n\r\nIf you disable this policy setting or do not configure it, users control this setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-dcbatterydischargelevel0-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargelevel0_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargelevel0_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargelevel0_2_enterdcbatterydischargelevel0","displayName":"Critical Battery Notification Level (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargelevel1_2","displayName":"Low battery notification level","description":"This policy setting specifies the percentage of battery capacity remaining that triggers the low battery notification action.\r\n\r\nIf you enable this policy setting, you must enter a numeric value (percentage) to set the battery level that triggers the low notification.\r\n\r\nTo set the action that is triggered, see the \"Low Battery Notification Action\" policy setting.\r\n\r\nIf you disable this policy setting or do not configure it, users control this setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-dcbatterydischargelevel1-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargelevel1_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargelevel1_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargelevel1_2_enterdcbatterydischargelevel1","displayName":"Low Battery Notification Level (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargelevel1uinotification_2","displayName":"Turn off low battery user notification","description":"This policy setting turns off the user notification when the battery capacity remaining equals the low battery notification level.\r\n\r\nIf you enable this policy setting, Windows shows a notification when the battery capacity remaining equals the low battery notification level. To configure the low battery notification level, see the \"Low Battery Notification Level\" policy setting.\r\n\r\nThe notification will only be shown if the \"Low Battery Notification Action\" policy setting is configured to \"No Action\".\r\n\r\nIf you disable or do not configure this policy setting, users can control this setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-dcbatterydischargelevel1uinotification-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargelevel1uinotification_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_dcbatterydischargelevel1uinotification_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_dcconnectivityinstandby_2","displayName":"Allow network connectivity during connected-standby (on battery)","description":"This policy setting allows you to control the network connectivity state in standby on modern standby-capable systems.\r\n\r\nIf you enable this policy setting, network connectivity will be maintained in standby.\r\n\r\nIf you disable this policy setting, network connectivity in standby is not guaranteed. This connectivity restriction currently applies to WLAN networks only, and is subject to change.\r\n\r\nIf you do not configure this policy setting, users control this setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-dcconnectivityinstandby-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_dcconnectivityinstandby_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_dcconnectivityinstandby_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_dccriticalsleeptransitionsdisable_2","displayName":"Turn on the ability for applications to prevent sleep transitions (on battery)","description":"This policy setting allows you to turn on the ability for applications and services to prevent the system from sleeping.\r\n\r\nIf you enable this policy setting, an application or service may prevent the system from sleeping (Hybrid Sleep, Stand By, or Hibernate).\r\n\r\nIf you disable or do not configure this policy setting, users control this setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-dccriticalsleeptransitionsdisable-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_dccriticalsleeptransitionsdisable_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_dccriticalsleeptransitionsdisable_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_dcstartmenubuttonaction_2","displayName":"Select the Start menu Power button action (on battery)","description":"This policy setting specifies the action that Windows takes when a user presses the Start menu Power button.\r\n\r\nIf you enable this policy setting, select one of the following actions:\r\n-Sleep\r\n-Hibernate\r\n-Shut down\r\n\r\nIf you disable this policy or do not configure this policy setting, users control this setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-dcstartmenubuttonaction-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_dcstartmenubuttonaction_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_dcstartmenubuttonaction_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_dcstartmenubuttonaction_2_selectdcstartmenubuttonaction","displayName":"User Interface Sleep Button Action (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_power_dcstartmenubuttonaction_2_selectdcstartmenubuttonaction_0","displayName":"Sleep","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_dcstartmenubuttonaction_2_selectdcstartmenubuttonaction_1","displayName":"Hibernate","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_dcstartmenubuttonaction_2_selectdcstartmenubuttonaction_2","displayName":"Shut down","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_diskacpowerdowntimeout_2","displayName":"Turn Off the hard disk (plugged in)","description":"This policy setting specifies the period of inactivity before Windows turns off the hard disk.\r\n\r\nIf you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the hard disk.\r\n\r\nIf you disable or do not configure this policy setting, users can see and change this setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-diskacpowerdowntimeout-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_diskacpowerdowntimeout_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_diskacpowerdowntimeout_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_diskacpowerdowntimeout_2_enterdiskacpowerdowntimeout","displayName":"Turn Off the Hard Disk (seconds): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_power_diskdcpowerdowntimeout_2","displayName":"Turn Off the hard disk (on battery)","description":"This policy setting specifies the period of inactivity before Windows turns off the hard disk.\r\n\r\nIf you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the hard disk.\r\n\r\nIf you disable or do not configure this policy setting, users can see and change this setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-diskdcpowerdowntimeout-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_diskdcpowerdowntimeout_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_diskdcpowerdowntimeout_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_diskdcpowerdowntimeout_2_enterdiskdcpowerdowntimeout","displayName":"Turn Off the Hard Disk (seconds): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_power_dont_poweroff_aftershutdown","displayName":"Do not turn off system power after a Windows system shutdown has occurred.","description":"This policy setting allows you to configure whether power is automatically turned off when Windows shutdown completes. This setting does not affect Windows shutdown behavior when shutdown is manually selected using the Start menu or Task Manager user interfaces. Applications such as UPS software may rely on Windows shutdown behavior.\r\n\r\nThis setting is only applicable when Windows shutdown is initiated by software programs invoking the Windows programming interfaces ExitWindowsEx() or InitiateSystemShutdown().\r\n\r\nIf you enable this policy setting, the computer system safely shuts down and remains in a powered state, ready for power to be safely removed.\r\n\r\nIf you disable or do not configure this policy setting, the computer system safely shuts down to a fully powered-off state.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-dont-poweroff-aftershutdown"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_dont_poweroff_aftershutdown_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_dont_poweroff_aftershutdown_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_enabledesktopslideshowac","displayName":"Turn on desktop background slideshow (plugged in)","description":"This policy setting allows you to specify if Windows should enable the desktop background slideshow.\r\n\r\nIf you enable this policy setting, desktop background slideshow is enabled.\r\n\r\nIf you disable this policy setting, the desktop background slideshow is disabled.\r\n\r\nIf you disable or do not configure this policy setting, users control this setting.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-enabledesktopslideshowac"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_enabledesktopslideshowac_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_enabledesktopslideshowac_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_enabledesktopslideshowdc","displayName":"Turn on desktop background slideshow (on battery)","description":"This policy setting allows you to specify if Windows should enable the desktop background slideshow.\r\n\r\nIf you enable this policy setting, desktop background slideshow is enabled.\r\n\r\nIf you disable this policy setting, the desktop background slideshow is disabled.\r\n\r\nIf you disable or do not configure this policy setting, users control this setting.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-enabledesktopslideshowdc"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_enabledesktopslideshowdc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_enabledesktopslideshowdc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_inboxactiveschemeoverride_2","displayName":"Select an active power plan","description":"This policy setting specifies the active power plan from a list of default Windows power plans. To specify a custom power plan, use the Custom Active Power Plan setting.\r\n\r\nIf you enable this policy setting, specify a power plan from the Active Power Plan list.\r\n\r\nIf you disable or do not configure this policy setting, users control this setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-inboxactiveschemeoverride-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_inboxactiveschemeoverride_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_inboxactiveschemeoverride_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_inboxactiveschemeoverride_2_inboxactiveschemeoverrideenter","displayName":"Active Power Plan: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_power_inboxactiveschemeoverride_2_inboxactiveschemeoverrideenter_381b4222-f694-41f0-9685-ff5bb260df2e","displayName":"Automatic (recommended)","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_inboxactiveschemeoverride_2_inboxactiveschemeoverrideenter_a1841308-3541-4fab-bc81-f71556f20b4a","displayName":"Power Saver","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_inboxactiveschemeoverride_2_inboxactiveschemeoverrideenter_8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c","displayName":"High Performance","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_powerthrottlingturnoff","displayName":"Turn off Power Throttling","description":"This policy setting allows you to turn off Power Throttling.\r\n\r\nIf you enable this policy setting, Power Throttling will be turned off.\r\n\r\nIf you disable or do not configure this policy setting, users control this setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-powerthrottlingturnoff"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_powerthrottlingturnoff_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_powerthrottlingturnoff_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_reservebatterynotificationlevel","displayName":"Reserve battery notification level","description":"This policy setting specifies the percentage of battery capacity remaining that triggers the reserve power mode.\r\n\r\nIf you enable this policy setting, you must enter a numeric value (percentage) to set the battery level that triggers the reserve power notification.\r\n\r\nIf you disable or do not configure this policy setting, users can see and change this setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-power#admx-power-reservebatterynotificationlevel"],"options":[{"id":"device_vendor_msft_policy_config_admx_power_reservebatterynotificationlevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_power_reservebatterynotificationlevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_power_reservebatterynotificationlevel_enterreservebatterynotificationlevel","displayName":"Reserve Battery Notification Level (percent): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enablemodulelogging","displayName":"Turn on Module Logging","description":"\r\n This policy setting allows you to turn on logging for Windows PowerShell modules.\r\n\r\n If you enable this policy setting, pipeline execution events for members of the specified modules are recorded in the Windows PowerShell log in Event Viewer. Enabling this policy setting for a module is equivalent to setting the LogPipelineExecutionDetails property of the module to True.\r\n\r\n If you disable this policy setting, logging of execution events is disabled for all Windows PowerShell modules. Disabling this policy setting for a module is equivalent to setting the LogPipelineExecutionDetails property of the module to False.\r\n\r\n If this policy setting is not configured, the LogPipelineExecutionDetails property of a module or snap-in determines whether the execution events of a module or snap-in are logged. By default, the LogPipelineExecutionDetails property of all modules and snap-ins is set to False.\r\n\r\n To add modules and snap-ins to the policy setting list, click Show, and then type the module names in the list. The modules and snap-ins in the list must be installed on the computer.\r\n\r\n Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy#admx-powershellexecutionpolicy-enablemodulelogging"],"options":[{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enablemodulelogging_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enablemodulelogging_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enablemodulelogging_listbox_modulenames","displayName":"Module Names (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enablescripts","displayName":"Turn on Script Execution","description":"This policy setting lets you configure the script execution policy, controlling which scripts are allowed to run.\r\n\r\nIf you enable this policy setting, the scripts selected in the drop-down list are allowed to run.\r\n\r\nThe \"Allow only signed scripts\" policy setting allows scripts to execute only if they are signed by a trusted publisher.\r\n\r\nThe \"Allow local scripts and remote signed scripts\" policy setting allows any local scrips to run; scripts that originate from the Internet must be signed by a trusted publisher.\r\n\r\nThe \"Allow all scripts\" policy setting allows all scripts to run.\r\n\r\nIf you disable this policy setting, no scripts are allowed to run.\r\n\r\nNote: This policy setting exists under both \"Computer Configuration\" and \"User Configuration\" in the Local Group Policy Editor. The \"Computer Configuration\" has precedence over \"User Configuration.\"\r\n\r\nIf you disable or do not configure this policy setting, it reverts to a per-machine preference setting; the default if that is not configured is \"No scripts allowed.\"\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy#admx-powershellexecutionpolicy-enablescripts"],"options":[{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enablescripts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enablescripts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enablescripts_executionpolicy","displayName":"Execution Policy (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enablescripts_executionpolicy_allsigned","displayName":"Allow only signed scripts","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enablescripts_executionpolicy_remotesigned","displayName":"Allow local scripts and remote signed scripts","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enablescripts_executionpolicy_unrestricted","displayName":"Allow all scripts","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enabletranscripting","displayName":"Turn on PowerShell Transcription","description":"\r\n This policy setting lets you capture the input and output of Windows PowerShell commands into text-based transcripts.\r\n\r\n If you enable this policy setting, Windows PowerShell will enable transcripting for Windows PowerShell, the Windows PowerShell ISE, and any other\r\n applications that leverage the Windows PowerShell engine. By default, Windows PowerShell will record transcript output to each users' My Documents\r\n directory, with a file name that includes 'PowerShell_transcript', along with the computer name and time started. Enabling this policy is equivalent\r\n to calling the Start-Transcript cmdlet on each Windows PowerShell session.\r\n\r\n If you disable this policy setting, transcripting of PowerShell-based applications is disabled by default, although transcripting can still be enabled\r\n through the Start-Transcript cmdlet.\r\n \r\n If you use the OutputDirectory setting to enable transcript logging to a shared location, be sure to limit access to that directory to prevent users\r\n from viewing the transcripts of other users or computers.\r\n\r\n Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy#admx-powershellexecutionpolicy-enabletranscripting"],"options":[{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enabletranscripting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enabletranscripting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enabletranscripting_enableinvocationheader","displayName":"Include invocation headers: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enabletranscripting_enableinvocationheader_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enabletranscripting_enableinvocationheader_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enabletranscripting_outputdirectory","displayName":"Transcript output directory (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enableupdatehelpdefaultsourcepath","displayName":"Set the default source path for Update-Help","description":"This policy setting allows you to set the default value of the SourcePath parameter on the Update-Help cmdlet.\r\n\r\nIf you enable this policy setting, the Update-Help cmdlet will use the specified value as the default value for the SourcePath parameter. This default value can be overridden by specifying a different value with the SourcePath parameter on the Update-Help cmdlet.\r\n\r\nIf this policy setting is disabled or not configured, this policy setting does not set a default value for the SourcePath parameter of the Update-Help cmdlet.\r\n\r\nNote: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy#admx-powershellexecutionpolicy-enableupdatehelpdefaultsourcepath"],"options":[{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enableupdatehelpdefaultsourcepath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enableupdatehelpdefaultsourcepath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_powershellexecutionpolicy_enableupdatehelpdefaultsourcepath_sourcepathforupdatehelp","displayName":"Default Source Path (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_previousversions_disablebackuprestore_2","displayName":"Prevent restoring previous versions from backups","description":"This policy setting lets you suppress the Restore button in the previous versions property page when the user has selected a previous version of a local file, in which the previous version is stored on a backup.\r\n\r\nIf you enable this policy setting, the Restore button is disabled when the user selects a previous version corresponding to a backup.\r\n\r\nIf you disable this policy setting, the Restore button remains active for a previous version corresponding to a backup. If the Restore button is clicked, Windows attempts to restore the file from the backup media.\r\n\r\nIf you do not configure this policy setting, it is disabled by default. The Restore button is active when the previous version is of a local file and stored on the backup.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-previousversions#admx-previousversions-disablebackuprestore-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_previousversions_disablebackuprestore_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_previousversions_disablebackuprestore_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_previousversions_disablelocalpage_2","displayName":"Hide previous versions list for local files","description":"This policy setting lets you hide the list of previous versions of files that are on local disks. The previous versions could come from the on-disk restore points or from backup media.\r\n\r\nIf you enable this policy setting, users cannot list or restore previous versions of files on local disks.\r\n\r\nIf you disable this policy setting, users cannot list and restore previous versions of files on local disks.\r\n\r\nIf you do not configure this policy setting, it defaults to disabled.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-previousversions#admx-previousversions-disablelocalpage-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_previousversions_disablelocalpage_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_previousversions_disablelocalpage_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_previousversions_disablelocalrestore_2","displayName":"Prevent restoring local previous versions","description":"This policy setting lets you suppress the Restore button in the previous versions property page when the user has selected a previous version of a local file.\r\n\r\nIf you enable this policy setting, the Restore button is disabled when the user selects a previous version corresponding to a local file.\r\n\r\nIf you disable this policy setting, the Restore button remains active for a previous version corresponding to a local file. If the user clicks the Restore button, Windows attempts to restore the file from the local disk.\r\n\r\nIf you do not configure this policy setting, it is disabled by default. The Restore button is active when the previous version is of a local file.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-previousversions#admx-previousversions-disablelocalrestore-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_previousversions_disablelocalrestore_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_previousversions_disablelocalrestore_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_previousversions_disableremotepage_2","displayName":"Hide previous versions list for remote files","description":"This policy setting lets you hide the list of previous versions of files that are on file shares. The previous versions come from the on-disk restore points on the file share.\r\n\r\nIf you enable this policy setting, users cannot list or restore previous versions of files on file shares.\r\n\r\nIf you disable this policy setting, users can list and restore previous versions of files on file shares.\r\n\r\nIf you do not configure this policy setting, it is disabled by default.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-previousversions#admx-previousversions-disableremotepage-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_previousversions_disableremotepage_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_previousversions_disableremotepage_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_previousversions_disableremoterestore_2","displayName":"Prevent restoring remote previous versions","description":"This setting lets you suppress the Restore button in the previous versions property page when the user has selected a previous version of a file on a file share.\r\n\r\nIf you enable this policy setting, the Restore button is disabled when the user selects a previous version corresponding to a file on a file share.\r\n\r\nIf you disable this policy setting, the Restore button remains active for a previous version corresponding to a file on a file share. If the user clicks the Restore button, Windows attempts to restore the file from the file share.\r\n\r\nIf you do not configure this policy setting, it is disabled by default. The Restore button is active when the previous version is of a file on a file share.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-previousversions#admx-previousversions-disableremoterestore-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_previousversions_disableremoterestore_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_previousversions_disableremoterestore_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_previousversions_hidebackupentries_2","displayName":"Hide previous versions of files on backup location","description":"This policy setting lets you hide entries in the list of previous versions of a file in which the previous version is located on backup media. Previous versions can come from the on-disk restore points or the backup media.\r\n\r\nIf you enable this policy setting, users cannot see any previous versions corresponding to backup copies, and can see only previous versions corresponding to on-disk restore points.\r\n\r\nIf you disable this policy setting, users can see previous versions corresponding to backup copies as well as previous versions corresponding to on-disk restore points.\r\n\r\nIf you do not configure this policy setting, it is disabled by default.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-previousversions#admx-previousversions-hidebackupentries-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_previousversions_hidebackupentries_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_previousversions_hidebackupentries_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_allowwebprinting","displayName":"Activate Internet printing","description":"Internet printing lets you display printers on Web pages so that printers can be viewed, managed, and used across the Internet or an intranet.\r\n\r\n If you enable this policy setting, Internet printing is activated on this server.\r\n\r\n If you disable this policy setting or do not configure it, Internet printing is not activated.\r\n\r\n Internet printing is an extension of Internet Information Services (IIS). To use Internet printing, IIS must be installed, and printing support and this setting must be enabled.\r\n\r\n Note: This setting affects the server side of Internet printing only. It does not prevent the print client on the computer from printing across the Internet.\r\n\r\n Also, see the \"Custom support URL in the Printers folder's left pane\" setting in this folder and the \"Browse a common Web site to find printers\" setting in User Configuration\\Administrative Templates\\Control Panel\\Printers.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-allowwebprinting"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_allowwebprinting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_allowwebprinting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_applicationdriverisolation","displayName":"Isolate print drivers from applications","description":"Determines if print driver components are isolated from applications instead of normally loading them into applications. Isolating print drivers greatly reduces the risk of a print driver failure causing an application crash.\r\n\r\nNot all applications support driver isolation. By default, Microsoft Excel 2007, Excel 2010, Word 2007, Word 2010 and certain other applications are configured to support it. Other applications may also be capable of isolating print drivers, depending on whether they are configured for it.\r\n\r\nIf you enable or do not configure this policy setting, then applications that are configured to support driver isolation will be isolated.\r\n\r\nIf you disable this policy setting, then print drivers will be loaded within all associated application processes.\r\n\r\nNotes:\r\n-This policy setting applies only to applications opted into isolation.\r\n-This policy setting applies only to print drivers loaded by applications. Print drivers loaded by the print spooler are not affected.\r\n-This policy setting is only checked once during the lifetime of a process. After changing the policy, a running application must be relaunched before settings take effect.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-applicationdriverisolation"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_applicationdriverisolation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_applicationdriverisolation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_customizedsupporturl","displayName":"Custom support URL in the Printers folder's left pane","description":"By default, the Printers folder includes a link to the Microsoft Support Web page called \"Get help with printing\". It can also include a link to a Web page supplied by the vendor of the currently selected printer.\r\n\r\n If you enable this policy setting, you replace the \"Get help with printing\" default link with a link to a Web page customized for your enterprise.\r\n\r\n If you disable this setting or do not configure it, or if you do not enter an alternate Internet address, the default link will appear in the Printers folder.\r\n\r\n Note: Web pages links only appear in the Printers folder when Web view is enabled. If Web view is disabled, the setting has no effect. (To enable Web view, open the Printers folder, and, on the Tools menu, click Folder Options, click the General tab, and then click \"Enable Web content in folders.\")\r\n\r\n Also, see the \"Activate Internet printing\" setting in this setting folder and the \"Browse a common web site to find printers\" setting in User Configuration\\Administrative Templates\\Control Panel\\Printers.\r\n\r\n Web view is affected by the \"Turn on Classic Shell\" and \"Do not allow Folder Options to be opened from the Options button on the View tab of the ribbon\" settings in User Configuration\\Administrative Templates\\Windows Components\\Windows Explorer, and by the \"Enable Active Desktop\" setting in User Configuration\\Administrative Templates\\Desktop\\Active Desktop.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-customizedsupporturl"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_customizedsupporturl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_customizedsupporturl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_customizedsupporturl_customizedsupporturl_link","displayName":"URL (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_printing_domainprinters","displayName":"Add Printer wizard - Network scan page (Managed network)","description":"If you enable this policy setting, it sets the maximum number of printers (of each type) that the Add Printer wizard will display on a computer on a managed network (when the computer is able to reach a domain controller, e.g. a domain-joined laptop on a corporate network.)\r\n\r\n If this policy setting is disabled, the network scan page will not be displayed.\r\n\r\n If this policy setting is not configured, the Add Printer wizard will display the default number of printers of each type:\r\n Directory printers: 20\r\n TCP/IP printers: 0\r\n Web Services printers: 0\r\n Bluetooth printers: 10\r\n Shared printers: 0\r\n\r\n In order to view available Web Services printers on your network, ensure that network discovery is turned on. To turn on network discovery, click \"Start\", click \"Control Panel\", and then click \"Network and Internet\". On the \"Network and Internet\" page, click \"Network and Sharing Center\". On the Network and Sharing Center page, click \"Change advanced sharing settings\". On the Advanced sharing settings page, click the arrow next to \"Domain\" arrow, click \"turn on network discovery\", and then click \"Save changes\".\r\n\r\n If you would like to not display printers of a certain type, enable this policy and set the number of printers to display to 0.\r\n\r\n In Windows 10 and later, only TCP/IP printers can be shown in the wizard. If you enable this policy setting, only TCP/IP printer limits are applicable. On Windows 10 only, if you disable or do not configure this policy setting, the default limit is applied.\r\n \r\n In Windows 8 and later, Bluetooth printers are not shown so its limit does not apply to those versions of Windows.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-domainprinters"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_domainprinters_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_domainprinters_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_domainprinters_adprinters","displayName":"Number of directory printers (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_printing_domainprinters_bluetoothprinters","displayName":"Number of Bluetooth printers (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_printing_domainprinters_ipprinters","displayName":"Number of TCP/IP printers (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_printing_domainprinters_shareprinters","displayName":"Number of shared printers (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_printing_domainprinters_wsdprinters","displayName":"Number of Web Services Printers (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_printing_donotinstallcompatibledriverfromwindowsupdate","displayName":"Extend Point and Print connection to search Windows Update","description":"This policy setting allows you to manage where client computers search for Point and Printer drivers.\r\n\r\nIf you enable this policy setting, the client computer will continue to search for compatible Point and Print drivers from Windows Update after it fails to find the compatible driver from the local driver store and the server driver cache.\r\n\r\nIf you disable this policy setting, the client computer will only search the local driver store and server driver cache for compatible Point and Print drivers. If it is unable to find a compatible driver, then the Point and Print connection will fail.\r\n\r\nThis policy setting is not configured by default, and the behavior depends on the version of Windows that you are using.\r\nBy default, Windows Ultimate, Professional and Home SKUs will continue to search for compatible Point and Print drivers from Windows Update, if needed. However, you must explicitly enable this policy setting for other versions of Windows (for example Windows Enterprise, and all versions of Windows Server 2008 R2 and later) to have the same behavior.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-donotinstallcompatibledriverfromwindowsupdate"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_donotinstallcompatibledriverfromwindowsupdate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_donotinstallcompatibledriverfromwindowsupdate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_emfdespooling","displayName":"Always render print jobs on the server","description":"When printing through a print server, determines whether the print spooler on the client will process print jobs itself, or pass them on to the server to do the work.\r\n\r\nThis policy setting only effects printing to a Windows print server.\r\n\r\nIf you enable this policy setting on a client machine, the client spooler will not process print jobs before sending them to the print server. This decreases the workload on the client at the expense of increasing the load on the server.\r\n\r\nIf you disable this policy setting on a client machine, the client itself will process print jobs into printer device commands. These commands will then be sent to the print server, and the server will simply pass the commands to the printer. This increases the workload of the client while decreasing the load on the server.\r\n\r\nIf you do not enable this policy setting, the behavior is the same as disabling it.\r\n\r\nNote: This policy does not determine whether offline printing will be available to the client. The client print spooler can always queue print jobs when not connected to the print server. Upon reconnecting to the server, the client will submit any pending print jobs.\r\n\r\nNote: Some printer drivers require a custom print processor. In some cases the custom print processor may not be installed on the client machine, such as when the print server does not support transferring print processors during point-and-print. In the case of a print processor mismatch, the client spooler will always send jobs to the print server for rendering. Disabling the above policy setting does not override this behavior.\r\n\r\nNote: In cases where the client print driver does not match the server print driver (mismatched connection), the client will always process the print job, regardless of the setting of this policy.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-emfdespooling"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_emfdespooling_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_emfdespooling_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_forcesoftwarerasterization","displayName":"Always rasterize content to be printed using a software rasterizer","description":"Determines whether the XPS Rasterization Service or the XPS-to-GDI conversion (XGC) is forced to use a software rasterizer instead of a Graphics Processing Unit (GPU) to rasterize pages.\r\n\r\nThis setting may improve the performance of the XPS Rasterization Service or the XPS-to-GDI conversion (XGC) on machines that have a relatively powerful CPU as compared to the machine’s GPU.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-forcesoftwarerasterization"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_forcesoftwarerasterization_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_forcesoftwarerasterization_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_kmprintersareblocked","displayName":"Disallow installation of printers using kernel-mode drivers","description":"Determines whether printers using kernel-mode drivers may be installed on the local computer. Kernel-mode drivers have access to system-wide memory, and therefore poorly-written kernel-mode drivers can cause stop errors.\r\n\r\nIf you disable this setting, or do not configure it, then printers using a kernel-mode drivers may be installed on the local computer running Windows XP Home Edition and Windows XP Professional.\r\n\r\nIf you do not configure this setting on Windows Server 2003 family products, the installation of kernel-mode printer drivers will be blocked.\r\n\r\nIf you enable this setting, installation of a printer using a kernel-mode driver will not be allowed.\r\n\r\nNote: By applying this policy, existing kernel-mode drivers will be disabled upon installation of service packs or reinstallation of the Windows XP operating system. This policy does not apply to 64-bit kernel-mode printer drivers as they cannot be installed and associated with a print queue.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-kmprintersareblocked"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_kmprintersareblocked_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_kmprintersareblocked_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_mxdwuselegacyoutputformatmsxps","displayName":"Change Microsoft XPS Document Writer (MXDW) default output format to the legacy Microsoft XPS format (*.xps)","description":"Microsoft XPS Document Writer (MXDW) generates OpenXPS (*.oxps) files by default in %WINDOWS_CLIENT_CURRENT_VERSION%, %WINDOWS_ARM_CURRENT_VERSION% and %WINDOWS_SERVER_CURRENT_VERSION%.\r\n\r\n If you enable this group policy setting, the default MXDW output format is the legacy Microsoft XPS (*.xps).\r\n\r\n If you disable or do not configure this policy setting, the default MXDW output format is OpenXPS (*.oxps).\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-mxdwuselegacyoutputformatmsxps"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_mxdwuselegacyoutputformatmsxps_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_mxdwuselegacyoutputformatmsxps_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_nondomainprinters","displayName":"Add Printer wizard - Network scan page (Unmanaged network)","description":"This policy sets the maximum number of printers (of each type) that the Add Printer wizard will display on a computer on an unmanaged network (when the computer is not able to reach a domain controller, e.g. a domain-joined laptop on a home network.)\r\n\r\nIf this setting is disabled, the network scan page will not be displayed.\r\n\r\nIf this setting is not configured, the Add Printer wizard will display the default number of printers of each type:\r\nTCP/IP printers: 50\r\nWeb Services printers: 50\r\nBluetooth printers: 10\r\nShared printers: 50\r\n\r\nIf you would like to not display printers of a certain type, enable this policy and set the number of printers to display to 0.\r\n\r\nIn Windows 10 and later, only TCP/IP printers can be shown in the wizard. If you enable this policy setting, only TCP/IP printer limits are applicable. On Windows 10 only, if you disable or do not configure this policy setting, the default limit is applied.\r\n \r\nIn Windows 8 and later, Bluetooth printers are not shown so its limit does not apply to those versions of Windows.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-nondomainprinters"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_nondomainprinters_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_nondomainprinters_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_nondomainprinters_bluetoothprinters","displayName":"Number of Bluetooth printers (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_printing_nondomainprinters_ipprinters","displayName":"Number of TCP/IP printers (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_printing_nondomainprinters_shareprinters","displayName":"Number of shared printers (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_printing_nondomainprinters_wsdprinters","displayName":"Number of Web Services Printers (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_printing_packagepointandprintonly_win7","displayName":"Only use Package Point and print","description":"This policy restricts clients computers to use package point and print only.\r\n\r\nIf this setting is enabled, users will only be able to point and print to printers that use package-aware drivers. When using package point and print, client computers will check the driver signature of all drivers that are downloaded from print servers.\r\n\r\nIf this setting is disabled, or not configured, users will not be restricted to package-aware point and print only.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-packagepointandprintonly-win7"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_packagepointandprintonly_win7_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_packagepointandprintonly_win7_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_packagepointandprintserverlist_win7","displayName":"Package Point and print - Approved servers","description":"Restricts package point and print to approved servers.\r\n\r\nThis policy setting restricts package point and print connections to approved servers. This setting only applies to Package Point and Print connections, and is completely independent from the \"Point and Print Restrictions\" policy that governs the behavior of non-package point and print connections.\r\n\r\nWindows Vista and later clients will attempt to make a non-package point and print connection anytime a package point and print connection fails, including attempts that are blocked by this policy. Administrators may need to set both policies to block all print connections to a specific print server.\r\n\r\nIf this setting is enabled, users will only be able to package point and print to print servers approved by the network administrator. When using package point and print, client computers will check the driver signature of all drivers that are downloaded from print servers.\r\n\r\nIf this setting is disabled, or not configured, package point and print will not be restricted to specific print servers.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-packagepointandprintserverlist-win7"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_packagepointandprintserverlist_win7_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_packagepointandprintserverlist_win7_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_packagepointandprintserverlist_win7_packagepointandprintserverlist_edit","displayName":"Enter fully qualified server names (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_printing_physicallocation","displayName":"Computer location","description":"If this policy setting is enabled, it specifies the default location criteria used when searching for printers.\r\n\r\n This setting is a component of the Location Tracking feature of Windows printers. To use this setting, enable Location Tracking by enabling the \"Pre-populate printer search location text\" setting.\r\n\r\n When Location Tracking is enabled, the system uses the specified location as a criterion when users search for printers. The value you type here overrides the actual location of the computer conducting the search.\r\n\r\n Type the location of the user's computer. When users search for printers, the system uses the specified location (and other search criteria) to find a printer nearby. You can also use this setting to direct users to a particular printer or group of printers that you want them to use.\r\n\r\n If you disable this setting or do not configure it, and the user does not type a location as a search criterion, the system searches for a nearby printer based on the IP address and subnet mask of the user's computer.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-physicallocation"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_physicallocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_physicallocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_physicallocation_physicallocation_name","displayName":"Location (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_printing_physicallocationsupport","displayName":"Pre-populate printer search location text","description":"Enables the physical Location Tracking setting for Windows printers.\r\n\r\nUse Location Tracking to design a location scheme for your enterprise and assign computers and printers to locations in the scheme. Location Tracking overrides the standard method used to locate and associate computers and printers. The standard method uses a printer's IP address and subnet mask to estimate its physical location and proximity to computers.\r\n\r\nIf you enable this setting, users can browse for printers by location without knowing the printer's location or location naming scheme. Enabling Location Tracking adds a Browse button in the Add Printer wizard's Printer Name and Sharing Location screen and to the General tab in the Printer Properties dialog box. If you enable the Group Policy Computer location setting, the default location you entered appears in the Location field by default.\r\n\r\nIf you disable this setting or do not configure it, Location Tracking is disabled. Printer proximity is estimated using the standard method (that is, based on IP address and subnet mask).\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-physicallocationsupport"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_physicallocationsupport_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_physicallocationsupport_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_printdriverisolationexecutionpolicy","displayName":"Execute print drivers in isolated processes","description":"This policy setting determines whether the print spooler will execute print drivers in an isolated or separate process. When print drivers are loaded in an isolated process (or isolated processes), a print driver failure will not cause the print spooler service to fail.\r\n\r\nIf you enable or do not configure this policy setting, the print spooler will execute print drivers in an isolated process by default.\r\n\r\nIf you disable this policy setting, the print spooler will execute print drivers in the print spooler process.\r\n\r\n\r\nNotes:\r\n-Other system or driver policy settings may alter the process in which a print driver is executed.\r\n-This policy setting applies only to print drivers loaded by the print spooler. Print drivers loaded by applications are not affected.\r\n-This policy setting takes effect without restarting the print spooler service.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-printdriverisolationexecutionpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_printdriverisolationexecutionpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_printdriverisolationexecutionpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_printdriverisolationoverridecompat","displayName":"Override print driver execution compatibility setting reported by print driver","description":"This policy setting determines whether the print spooler will override the Driver Isolation compatibility reported by the print driver. This enables executing print drivers in an isolated process, even if the driver does not report compatibility.\r\n\r\nIf you enable this policy setting, the print spooler isolates all print drivers that do not explicitly opt out of Driver Isolation.\r\n\r\nIf you disable or do not configure this policy setting, the print spooler uses the Driver Isolation compatibility flag value reported by the print driver.\r\n\r\nNotes:\r\n-Other system or driver policy settings may alter the process in which a print driver is executed.\r\n-This policy setting applies only to print drivers loaded by the print spooler. Print drivers loaded by applications are not affected.\r\n-This policy setting takes effect without restarting the print spooler service.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-printdriverisolationoverridecompat"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_printdriverisolationoverridecompat_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_printdriverisolationoverridecompat_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_printerserverthread","displayName":"Printer browsing","description":"Announces the presence of shared printers to print browse master servers for the domain.\r\n\r\nOn domains with Active Directory, shared printer resources are available in Active Directory and are not announced.\r\n\r\nIf you enable this setting, the print spooler announces shared printers to the print browse master servers.\r\n\r\nIf you disable this setting, shared printers are not announced to print browse master servers, even if Active Directory is not available.\r\n\r\nIf you do not configure this setting, shared printers are announced to browse master servers only when Active Directory is not available.\r\n\r\nNote: A client license is used each time a client computer announces a printer to a print browse master on the domain.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-printerserverthread"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_printerserverthread_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_printerserverthread_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_showjobtitleineventlogs","displayName":"Allow job name in event logs","description":"\r\n This policy controls whether the print job name will be included in print event logs.\r\n\r\n If you disable or do not configure this policy setting, the print job name will not be included.\r\n\r\n If you enable this policy setting, the print job name will be included in new log entries.\r\n\r\n Note: This setting does not apply to Branch Office Direct Printing jobs.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-showjobtitleineventlogs"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_showjobtitleineventlogs_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_showjobtitleineventlogs_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing_v4driverdisallowprinterextension","displayName":"Do not allow v4 printer drivers to show printer extensions","description":"This policy determines if v4 printer drivers are allowed to run printer extensions.\r\n\r\n V4 printer drivers may include an optional, customized user interface known as a printer extension. These extensions may provide access to more device features, but this may not be appropriate for all enterprises.\r\n\r\n If you enable this policy setting, then all printer extensions will not be allowed to run.\r\n\r\n If you disable this policy setting or do not configure it, then all printer extensions that have been installed will be allowed to run.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing#admx-printing-v4driverdisallowprinterextension"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing_v4driverdisallowprinterextension_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing_v4driverdisallowprinterextension_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing2_autopublishing","displayName":"Automatically publish new printers in Active Directory","description":"Determines whether the Add Printer Wizard automatically publishes the computer's shared printers in Active Directory.\r\n\r\n If you enable this setting or do not configure it, the Add Printer Wizard automatically publishes all shared printers.\r\n\r\n If you disable this setting, the Add Printer Wizard does not automatically publish printers. However, you can publish shared printers manually.\r\n\r\n The default behavior is to automatically publish shared printers in Active Directory.\r\n\r\n Note: This setting is ignored if the \"Allow printers to be published\" setting is disabled.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing2#admx-printing2-autopublishing"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing2_autopublishing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_autopublishing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing2_immortalprintqueue","displayName":"Allow pruning of published printers","description":"Determines whether the domain controller can prune (delete from Active Directory) the printers published by this computer.\r\n\r\n By default, the pruning service on the domain controller prunes printer objects from Active Directory if the computer that published them does not respond to contact requests. When the computer that published the printers restarts, it republishes any deleted printer objects.\r\n\r\n If you enable this setting or do not configure it, the domain controller prunes this computer's printers when the computer does not respond.\r\n\r\n If you disable this setting, the domain controller does not prune this computer's printers. This setting is designed to prevent printers from being pruned when the computer is temporarily disconnected from the network.\r\n\r\n Note: You can use the \"Directory Pruning Interval\" and \"Directory Pruning Retry\" settings to adjust the contact interval and number of contact attempts.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing2#admx-printing2-immortalprintqueue"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing2_immortalprintqueue_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_immortalprintqueue_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing2_prunedownlevel","displayName":"Prune printers that are not automatically republished","description":"Determines whether the pruning service on a domain controller prunes printer objects that are not automatically republished whenever the host computer does not respond,just as it does with Windows 2000 printers. This setting applies to printers running operating systems other than Windows 2000 and to Windows 2000 printers published outside their forest.\r\n\r\n The Windows pruning service prunes printer objects from Active Directory when the computer that published them does not respond to contact requests. Computers running Windows 2000 Professional detect and republish deleted printer objects when they rejoin the network. However, because non-Windows 2000 computers and computers in other domains cannot republish printers in Active Directory automatically, by default, the system never prunes their printer objects.\r\n\r\n You can enable this setting to change the default behavior. To use this setting, select one of the following options from the \"Prune non-republishing printers\" box:\r\n\r\n -- \"Never\" specifies that printer objects that are not automatically republished are never pruned. \"Never\" is the default.\r\n\r\n -- \"Only if Print Server is found\" prunes printer objects that are not automatically republished only when the print server responds, but the printer is unavailable.\r\n\r\n -- \"Whenever printer is not found\" prunes printer objects that are not automatically republished whenever the host computer does not respond, just as it does with Windows 2000 printers.\r\n\r\n Note: This setting applies to printers published by using Active Directory Users and Computers or Pubprn.vbs. It does not apply to printers published by using Printers in Control Panel.\r\n\r\n Tip: If you disable automatic pruning, remember to delete printer objects manually whenever you remove a printer or print server.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing2#admx-printing2-prunedownlevel"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing2_prunedownlevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_prunedownlevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing2_prunedownlevel_prunedownleveltitle","displayName":"Prune non-republishing printers: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_printing2_prunedownlevel_prunedownleveltitle_0","displayName":"Never","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_prunedownlevel_prunedownleveltitle_1","displayName":"Only if Print Server is found","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_prunedownlevel_prunedownleveltitle_2","displayName":"Whenever printer is not found","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval","displayName":"Directory pruning interval","description":"Specifies how often the pruning service on a domain controller contacts computers to verify that their printers are operational.\r\n\r\n The pruning service periodically contacts computers that have published printers. If a computer does not respond to the contact message (optionally, after repeated attempts), the pruning service \"prunes\" (deletes from Active Directory) printer objects the computer has published.\r\n\r\n By default, the pruning service contacts computers every eight hours and allows two repeated contact attempts before deleting printers from Active Directory.\r\n\r\n If you enable this setting, you can change the interval between contact attempts.\r\n\r\n If you do not configure or disable this setting the default values will be used.\r\n\r\n Note: This setting is used only on domain controllers.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing2#admx-printing2-pruninginterval"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle","displayName":"Interval: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_0","displayName":"Continuous","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_10","displayName":"10 Minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_30","displayName":"30 Minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_60","displayName":"1 Hour","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_240","displayName":"4 Hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_480","displayName":"8 Hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_720","displayName":"12 Hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_1440","displayName":"1 Day","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_2880","displayName":"2 Days","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_4320","displayName":"3 Days","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_5760","displayName":"4 Days","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_7200","displayName":"5 Days","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_8640","displayName":"6 Days","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_10080","displayName":"1 Week","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_20160","displayName":"2 Weeks","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_30240","displayName":"3 Weeks","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_40320","displayName":"4 Weeks","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_50400","displayName":"5 Weeks","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_60480","displayName":"6 Weeks","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_70560","displayName":"7 Weeks","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruninginterval_pruningintervaltitle_4294967295","displayName":"Infinite","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing2_pruningpriority","displayName":"Directory pruning priority","description":"Sets the priority of the pruning thread.\r\n\r\n The pruning thread, which runs only on domain controllers, deletes printer objects from Active Directory if the printer that published the object does not respond to contact attempts. This process keeps printer information in Active Directory current.\r\n\r\n The thread priority influences the order in which the thread receives processor time and determines how likely it is to be preempted by higher priority threads.\r\n\r\n By default, the pruning thread runs at normal priority. However, you can adjust the priority to improve the performance of this service.\r\n\r\n Note: This setting is used only on domain controllers.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing2#admx-printing2-pruningpriority"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing2_pruningpriority_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruningpriority_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing2_pruningpriority_prioritylevel","displayName":"Priority level: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_printing2_pruningpriority_prioritylevel_4294967294","displayName":"Lowest","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruningpriority_prioritylevel_4294967295","displayName":"Below Normal","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruningpriority_prioritylevel_0","displayName":"Normal","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruningpriority_prioritylevel_1","displayName":"Above Normal","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruningpriority_prioritylevel_2","displayName":"Highest","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing2_pruningretries","displayName":"Directory pruning retry","description":"Specifies how many times the pruning service on a domain controller repeats its attempt to contact a computer before pruning the computer's printers.\r\n\r\n The pruning service periodically contacts computers that have published printers to verify that the printers are still available for use. If a computer does not respond to the contact message, the message is repeated for the specified number of times. If the computer still fails to respond, then the pruning service \"prunes\" (deletes from Active Directory) printer objects the computer has published.\r\n\r\n By default, the pruning service contacts computers every eight hours and allows two retries before deleting printers from Active Directory. You can use this setting to change the number of retries.\r\n\r\n If you enable this setting, you can change the interval between attempts.\r\n\r\n If you do not configure or disable this setting, the default values are used.\r\n\r\n Note: This setting is used only on domain controllers.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing2#admx-printing2-pruningretries"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing2_pruningretries_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruningretries_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing2_pruningretries_pruningretriestitle","displayName":"Retries: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_printing2_pruningretries_pruningretriestitle_0","displayName":"No Retry","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruningretries_pruningretriestitle_1","displayName":"1 Retry","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruningretries_pruningretriestitle_2","displayName":"2 Retries","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruningretries_pruningretriestitle_3","displayName":"3 Retries","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruningretries_pruningretriestitle_4","displayName":"4 Retries","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruningretries_pruningretriestitle_5","displayName":"5 Retries","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruningretries_pruningretriestitle_6","displayName":"6 Retries","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing2_pruningretrylog","displayName":"Log directory pruning retry events","description":"Specifies whether or not to log events when the pruning service on a domain controller attempts to contact a computer before pruning the computer's printers.\r\n\r\n The pruning service periodically contacts computers that have published printers to verify that the printers are still available for use. If a computer does not respond to the contact attempt, the attempt is retried a specified number of times, at a specified interval. The \"Directory pruning retry\" setting determines the number of times the attempt is retried; the default value is two retries. The \"Directory Pruning Interval\" setting determines the time interval between retries; the default value is every eight hours. If the computer has not responded by the last contact attempt, its printers are pruned from the directory.\r\n\r\n If you enable this policy setting, the contact events are recorded in the event log.\r\n\r\n If you disable or do not configure this policy setting, the contact events are not recorded in the event log.\r\n\r\n Note: This setting does not affect the logging of pruning events; the actual pruning of a printer is always logged.\r\n\r\n Note: This setting is used only on domain controllers.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing2#admx-printing2-pruningretrylog"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing2_pruningretrylog_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_pruningretrylog_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing2_registerspoolerremoterpcendpoint","displayName":"Allow Print Spooler to accept client connections","description":"This policy controls whether the print spooler will accept client connections.\r\n\r\nWhen the policy is unconfigured or enabled, the spooler will always accept client connections.\r\n\r\nWhen the policy is disabled, the spooler will not accept client connections nor allow users to share printers. All printers currently shared will continue to be shared.\r\n\r\nThe spooler must be restarted for changes to this policy to take effect.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing2#admx-printing2-registerspoolerremoterpcendpoint"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing2_registerspoolerremoterpcendpoint_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_registerspoolerremoterpcendpoint_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing2_verifypublishedstate","displayName":"Check published state","description":"Directs the system to periodically verify that the printers published by this computer still appear in Active Directory. This setting also specifies how often the system repeats the verification.\r\n\r\n By default, the system only verifies published printers at startup. This setting allows for periodic verification while the computer is operating.\r\n\r\n To enable this additional verification, enable this setting, and then select a verification interval.\r\n\r\n To disable verification, disable this setting, or enable this setting and select \"Never\" for the verification interval.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-printing2#admx-printing2-verifypublishedstate"],"options":[{"id":"device_vendor_msft_policy_config_admx_printing2_verifypublishedstate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_verifypublishedstate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_printing2_verifypublishedstate_verifypublishedstatetitle","displayName":"Published State Check Interval: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_printing2_verifypublishedstate_verifypublishedstatetitle_30","displayName":"30 Minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_verifypublishedstate_verifypublishedstatetitle_60","displayName":"1 Hour","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_verifypublishedstate_verifypublishedstatetitle_240","displayName":"4 Hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_verifypublishedstate_verifypublishedstatetitle_480","displayName":"8 Hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_verifypublishedstate_verifypublishedstatetitle_720","displayName":"12 Hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_verifypublishedstate_verifypublishedstatetitle_1440","displayName":"1 Day","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_printing2_verifypublishedstate_verifypublishedstatetitle_4294967295","displayName":"Never","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_pushtoinstall_disablepushtoinstall","displayName":"Turn off Push To Install service","description":"If you enable this setting, users will not be able to push Apps to this device from the Microsoft Store running on other devices or the web.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-pushtoinstall#admx-pushtoinstall-disablepushtoinstall"],"options":[{"id":"device_vendor_msft_policy_config_admx_pushtoinstall_disablepushtoinstall_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_pushtoinstall_disablepushtoinstall_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosmaxoutstandingsends","displayName":"Limit outstanding packets","description":"Specifies the maximum number of outstanding packets permitted on the system. When the number of outstanding packets reaches this limit, the Packet Scheduler postpones all submissions to network adapters until the number falls below this limit.\r\n\r\n\"Outstanding packets\" are packets that the Packet Scheduler has submitted to a network adapter for transmission, but which have not yet been sent.\r\n\r\nIf you enable this setting, you can limit the number of outstanding packets.\r\n\r\nIf you disable this setting or do not configure it, then the setting has no effect on the system.\r\n\r\nImportant: If the maximum number of outstanding packets is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qosmaxoutstandingsends"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qosmaxoutstandingsends_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosmaxoutstandingsends_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosmaxoutstandingsends_qosmaxoutstandingsends_box","displayName":"Number of packets: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosnonbesteffortlimit","displayName":"Limit reservable bandwidth","description":"Determines the percentage of connection bandwidth that the system can reserve. This value limits the combined bandwidth reservations of all programs running on the system.\r\n\r\nBy default, the Packet Scheduler limits the system to 80 percent of the bandwidth of a connection, but you can use this setting to override the default.\r\n\r\nIf you enable this setting, you can use the \"Bandwidth limit\" box to adjust the amount of bandwidth the system can reserve.\r\n\r\nIf you disable this setting or do not configure it, the system uses the default value of 80 percent of the connection.\r\n\r\nImportant: If a bandwidth limit is set for a particular network adapter in the registry, this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qosnonbesteffortlimit"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qosnonbesteffortlimit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosnonbesteffortlimit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosnonbesteffortlimit_qosnonbesteffortlimit_box","displayName":"Bandwidth limit (%): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypebesteffort_c","displayName":"Best effort service type","description":"Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Best Effort service type (ServiceTypeBestEffort). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets.\r\n\r\nThis setting applies only to packets that conform to the flow specification.\r\n\r\nIf you enable this setting, you can change the default DSCP value associated with the Best Effort service type.\r\n\r\nIf you disable this setting, the system uses the default DSCP value of 0.\r\n\r\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qosservicetypebesteffort-c"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypebesteffort_c_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypebesteffort_c_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypebesteffort_c_qosdscpvalue","displayName":"DSCP value: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypebesteffort_nc","displayName":"Best effort service type","description":"Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Best Effort service type (ServiceTypeBestEffort). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets.\r\n\r\nThis setting applies only to packets that do not conform to the flow specification.\r\n\r\nIf you enable this setting, you can change the default DSCP value associated with the Best Effort service type.\r\n\r\nIf you disable this setting, the system uses the default DSCP value of 0.\r\n\r\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qosservicetypebesteffort-nc"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypebesteffort_nc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypebesteffort_nc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypebesteffort_nc_qosdscpvalue","displayName":"DSCP value: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypebesteffort_pv","displayName":"Best effort service type","description":"Specifies an alternate link layer (Layer-2) priority value for packets with the Best Effort service type (ServiceTypeBestEffort). The Packet Scheduler inserts the corresponding priority value in the Layer-2 header of the packets.\r\n\r\nIf you enable this setting, you can change the default priority value associated with the Best Effort service type.\r\n\r\nIf you disable this setting, the system uses the default priority value of 0.\r\n\r\nImportant: If the Layer-2 priority value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qosservicetypebesteffort-pv"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypebesteffort_pv_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypebesteffort_pv_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypebesteffort_pv_qospriorityvalue","displayName":"Priority value (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypecontrolledload_c","displayName":"Controlled load service type","description":"Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Controlled Load service type (ServiceTypeControlledLoad). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets.\r\n\r\nThis setting applies only to packets that conform to the flow specification.\r\n\r\nIf you enable this setting, you can change the default DSCP value associated with the Controlled Load service type.\r\n\r\nIf you disable this setting, the system uses the default DSCP value of 24 (0x18).\r\n\r\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qosservicetypecontrolledload-c"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypecontrolledload_c_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypecontrolledload_c_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypecontrolledload_c_qosdscpvalue","displayName":"DSCP value: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypecontrolledload_nc","displayName":"Controlled load service type","description":"Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Controlled Load service type (ServiceTypeControlledLoad). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets.\r\n\r\nThis setting applies only to packets that do not conform to the flow specification.\r\n\r\nIf you enable this setting, you can change the default DSCP value associated with the Controlled Load service type.\r\n\r\nIf you disable this setting, the system uses the default DSCP value of 0.\r\n\r\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qosservicetypecontrolledload-nc"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypecontrolledload_nc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypecontrolledload_nc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypecontrolledload_nc_qosdscpvalue","displayName":"DSCP value: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypecontrolledload_pv","displayName":"Controlled load service type","description":"Specifies an alternate link layer (Layer-2) priority value for packets with the Controlled Load service type (ServiceTypeControlledLoad). The Packet Scheduler inserts the corresponding priority value in the Layer-2 header of the packets.\r\n\r\nIf you enable this setting, you can change the default priority value associated with the Controlled Load service type.\r\n\r\nIf you disable this setting, the system uses the default priority value of 0.\r\n\r\nImportant: If the Layer-2 priority value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qosservicetypecontrolledload-pv"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypecontrolledload_pv_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypecontrolledload_pv_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypecontrolledload_pv_qospriorityvalue","displayName":"Priority value (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypeguaranteed_c","displayName":"Guaranteed service type","description":"Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Guaranteed service type (ServiceTypeGuaranteed). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets.\r\n\r\nThis setting applies only to packets that conform to the flow specification.\r\n\r\nIf you enable this setting, you can change the default DSCP value associated with the Guaranteed service type.\r\n\r\nIf you disable this setting, the system uses the default DSCP value of 40 (0x28).\r\n\r\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qosservicetypeguaranteed-c"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypeguaranteed_c_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypeguaranteed_c_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypeguaranteed_c_qosdscpvalue","displayName":"DSCP value: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypeguaranteed_nc","displayName":"Guaranteed service type","description":"Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Guaranteed service type (ServiceTypeGuaranteed). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets.\r\n\r\nThis setting applies only to packets that do not conform to the flow specification.\r\n\r\nIf you enable this setting, you can change the default DSCP value associated with the Guaranteed service type.\r\n\r\nIf you disable this setting, the system uses the default DSCP value of 0.\r\n\r\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qosservicetypeguaranteed-nc"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypeguaranteed_nc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypeguaranteed_nc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypeguaranteed_nc_qosdscpvalue","displayName":"DSCP value: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypeguaranteed_pv","displayName":"Guaranteed service type","description":"Specifies an alternate link layer (Layer-2) priority value for packets with the Guaranteed service type (ServiceTypeGuaranteed). The Packet Scheduler inserts the corresponding priority value in the Layer-2 header of the packets.\r\n\r\nIf you enable this setting, you can change the default priority value associated with the Guaranteed service type.\r\n\r\nIf you disable this setting, the system uses the default priority value of 0.\r\n\r\nImportant: If the Layer-2 priority value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qosservicetypeguaranteed-pv"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypeguaranteed_pv_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypeguaranteed_pv_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypeguaranteed_pv_qospriorityvalue","displayName":"Priority value (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypenetworkcontrol_c","displayName":"Network control service type","description":"Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Network Control service type (ServiceTypeNetworkControl). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets.\r\n\r\nThis setting applies only to packets that conform to the flow specification.\r\n\r\nIf you enable this setting, you can change the default DSCP value associated with the Network Control service type.\r\n\r\nIf you disable this setting, the system uses the default DSCP value of 48 (0x30).\r\n\r\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qosservicetypenetworkcontrol-c"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypenetworkcontrol_c_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypenetworkcontrol_c_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypenetworkcontrol_c_qosdscpvalue","displayName":"DSCP value: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypenetworkcontrol_nc","displayName":"Network control service type","description":"Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Network Control service type (ServiceTypeNetworkControl). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets.\r\n\r\nThis setting applies only to packets that do not conform to the flow specification.\r\n\r\nIf you enable this setting, you can change the default DSCP value associated with the Network Control service type.\r\n\r\nIf you disable this setting, the system uses the default DSCP value of 0.\r\n\r\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qosservicetypenetworkcontrol-nc"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypenetworkcontrol_nc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypenetworkcontrol_nc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypenetworkcontrol_nc_qosdscpvalue","displayName":"DSCP value: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypenetworkcontrol_pv","displayName":"Network control service type","description":"Specifies an alternate link layer (Layer-2) priority value for packets with the Network Control service type (ServiceTypeNetworkControl). The Packet Scheduler inserts the corresponding priority value in the Layer-2 header of the packets.\r\n\r\nIf you enable this setting, you can change the default priority value associated with the Network Control service type.\r\n\r\nIf you disable this setting, the system uses the default priority value of 0.\r\n\r\nImportant: If the Layer-2 priority value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qosservicetypenetworkcontrol-pv"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypenetworkcontrol_pv_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypenetworkcontrol_pv_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypenetworkcontrol_pv_qospriorityvalue","displayName":"Priority value (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypenonconforming","displayName":"Non-conforming packets","description":"Specifies an alternate link layer (Layer-2) priority value for packets that do not conform to the flow specification. The Packet Scheduler inserts the corresponding priority value in the Layer-2 header of the packets.\r\n\r\nIf you enable this setting, you can change the default priority value associated with nonconforming packets.\r\n\r\nIf you disable this setting, the system uses the default priority value of 0.\r\n\r\nImportant: If the Layer-2 priority value for nonconforming packets is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qosservicetypenonconforming"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypenonconforming_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypenonconforming_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypenonconforming_qospriorityvalue","displayName":"Priority value (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypequalitative_c","displayName":"Qualitative service type","description":"Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Qualitative service type (ServiceTypeQualitative). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets.\r\n\r\nThis setting applies only to packets that conform to the flow specification.\r\n\r\nIf you enable this setting, you can change the default DSCP value associated with the Qualitative service type.\r\n\r\nIf you disable this setting, the system uses the default DSCP value of 0.\r\n\r\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qosservicetypequalitative-c"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypequalitative_c_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypequalitative_c_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypequalitative_c_qosdscpvalue","displayName":"DSCP value: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypequalitative_nc","displayName":"Qualitative service type","description":"Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Qualitative service type (ServiceTypeQualitative). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets.\r\n\r\nThis setting applies only to packets that do not conform to the flow specification.\r\n\r\nIf you enable this setting, you can change the default DSCP value associated with the Qualitative service type.\r\n\r\nIf you disable this setting, the system uses the default DSCP value of 0.\r\n\r\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qosservicetypequalitative-nc"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypequalitative_nc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypequalitative_nc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypequalitative_nc_qosdscpvalue","displayName":"DSCP value: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypequalitative_pv","displayName":"Qualitative service type","description":"Specifies an alternate link layer (Layer-2) priority value for packets with the Qualitative service type (ServiceTypeQualitative). The Packet Scheduler inserts the corresponding priority value in the Layer-2 header of the packets.\r\n\r\nIf you enable this setting, you can change the default priority value associated with the Qualitative service type.\r\n\r\nIf you disable this setting, the system uses the default priority value of 0.\r\n\r\nImportant: If the Layer-2 priority value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qosservicetypequalitative-pv"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypequalitative_pv_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypequalitative_pv_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qosservicetypequalitative_pv_qospriorityvalue","displayName":"Priority value (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_qos_qostimerresolution","displayName":"Set timer resolution","description":"Determines the smallest unit of time that the Packet Scheduler uses when scheduling packets for transmission. The Packet Scheduler cannot schedule packets for transmission more frequently than permitted by the value of this entry.\r\n\r\nIf you enable this setting, you can override the default timer resolution established for the system, usually units of 10 microseconds.\r\n\r\nIf you disable this setting or do not configure it, the setting has no effect on the system.\r\n\r\nImportant: If a timer resolution is specified in the registry for a particular network adapter, then this setting is ignored when configuring that network adapter.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-qos#admx-qos-qostimerresolution"],"options":[{"id":"device_vendor_msft_policy_config_admx_qos_qostimerresolution_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_qos_qostimerresolution_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_qos_qostimerresolution_qostimerresolution_box","displayName":"Timer units (in microseconds): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_radar_wdiscenarioexecutionpolicy","displayName":"Configure Scenario Execution Level","description":"Determines the execution level for Windows Resource Exhaustion Detection and Resolution.\r\n\r\nIf you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Resource Exhaustion problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will detect Windows Resource Exhaustion problems and indicate to the user that assisted resolution is available.\r\n\r\nIf you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any Windows Resource Exhaustion problems that are handled by the DPS.\r\n\r\nIf you do not configure this policy setting, the DPS will enable Windows Resource Exhaustion for resolution by default.\r\n\r\nThis policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.\r\n\r\nNo system restart or service restart is required for this policy to take effect: changes take effect immediately.\r\n\r\nThis policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-radar#admx-radar-wdiscenarioexecutionpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_radar_wdiscenarioexecutionpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_radar_wdiscenarioexecutionpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_radar_wdiscenarioexecutionpolicy_wdiscenarioexecutionpolicylevel","displayName":"Scenario Execution Level (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_radar_wdiscenarioexecutionpolicy_wdiscenarioexecutionpolicylevel_1","displayName":"Detection and Troubleshooting Only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_radar_wdiscenarioexecutionpolicy_wdiscenarioexecutionpolicylevel_2","displayName":"Detection, Troubleshooting and Resolution","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_reliability_ee_enablepersistenttimestamp","displayName":"Enable Persistent Time Stamp","description":"This policy setting allows the system to detect the time of unexpected shutdowns by writing the current time to disk on a schedule controlled by the Timestamp Interval.\r\n\r\nIf you enable this policy setting, you are able to specify how often the Persistent System Timestamp is refreshed and subsequently written to the disk. You can specify the Timestamp Interval in seconds.\r\n\r\nIf you disable this policy setting, the Persistent System Timestamp is turned off and the timing of unexpected shutdowns is not recorded.\r\n\r\nIf you do not configure this policy setting, the Persistent System Timestamp is refreshed according the default, which is every 60 seconds beginning with Windows Server 2003.\r\n\r\nNote: This feature might interfere with power configuration settings that turn off hard disks after a period of inactivity. These power settings may be accessed in the Power Options Control Panel.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-reliability#admx-reliability-ee-enablepersistenttimestamp"],"options":[{"id":"device_vendor_msft_policy_config_admx_reliability_ee_enablepersistenttimestamp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_reliability_ee_enablepersistenttimestamp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_reliability_ee_enablepersistenttimestamp_ee_enablepersistenttimestamp_desc4","displayName":"Seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_reliability_pch_reportshutdownevents","displayName":"Report unplanned shutdown events","description":"This policy setting controls whether or not unplanned shutdown events can be reported when error reporting is enabled.\r\n\r\nIf you enable this policy setting, error reporting includes unplanned shutdown events.\r\n\r\nIf you disable this policy setting, unplanned shutdown events are not included in error reporting.\r\n\r\nIf you do not configure this policy setting, users can adjust this setting using the control panel, which is set to \"Upload unplanned shutdown events\" by default.\r\n\r\nAlso see the \"Configure Error Reporting\" policy setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-reliability#admx-reliability-pch-reportshutdownevents"],"options":[{"id":"device_vendor_msft_policy_config_admx_reliability_pch_reportshutdownevents_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_reliability_pch_reportshutdownevents_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_reliability_shutdowneventtrackerstatefile","displayName":"Activate Shutdown Event Tracker System State Data feature","description":"This policy setting defines when the Shutdown Event Tracker System State Data feature is activated.\r\n\r\nThe system state data file contains information about the basic system state as well as the state of all running processes.\r\n\r\nIf you enable this policy setting, the System State Data feature is activated when the user indicates that the shutdown or restart is unplanned.\r\n\r\nIf you disable this policy setting, the System State Data feature is never activated.\r\n\r\nIf you do not configure this policy setting, the default behavior for the System State Data feature occurs.\r\n\r\nNote: By default, the System State Data feature is always enabled on Windows Server 2003. See \"Supported on\" for all supported versions.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-reliability#admx-reliability-shutdowneventtrackerstatefile"],"options":[{"id":"device_vendor_msft_policy_config_admx_reliability_shutdowneventtrackerstatefile_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_reliability_shutdowneventtrackerstatefile_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_reliability_shutdownreason","displayName":"Display Shutdown Event Tracker","description":"The Shutdown Event Tracker can be displayed when you shut down a workstation or server. This is an extra set of questions that is displayed when you invoke a shutdown to collect information related to why you are shutting down the computer.\r\n\r\nIf you enable this setting and choose \"Always\" from the drop-down menu list, the Shutdown Event Tracker is displayed when the computer shuts down.\r\n\r\nIf you enable this policy setting and choose \"Server Only\" from the drop-down menu list, the Shutdown Event Tracker is displayed when you shut down a computer running Windows Server. (See \"Supported on\" for supported versions.)\r\n\r\nIf you enable this policy setting and choose \"Workstation Only\" from the drop-down menu list, the Shutdown Event Tracker is displayed when you shut down a computer running a client version of Windows. (See \"Supported on\" for supported versions.)\r\n\r\nIf you disable this policy setting, the Shutdown Event Tracker is not displayed when you shut down the computer.\r\n\r\nIf you do not configure this policy setting, the default behavior for the Shutdown Event Tracker occurs.\r\n\r\nNote: By default, the Shutdown Event Tracker is only displayed on computers running Windows Server.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-reliability#admx-reliability-shutdownreason"],"options":[{"id":"device_vendor_msft_policy_config_admx_reliability_shutdownreason_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_reliability_shutdownreason_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_reliability_shutdownreason_shutdownreason_box","displayName":"Shutdown Event Tracker should be displayed: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_reliability_shutdownreason_shutdownreason_box_1","displayName":"Always","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_reliability_shutdownreason_shutdownreason_box_2","displayName":"Workstation Only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_reliability_shutdownreason_shutdownreason_box_3","displayName":"Server Only","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_remoteassistance_ra_encryptedticketonly","displayName":"Allow only Windows Vista or later connections","description":"This policy setting enables Remote Assistance invitations to be generated with improved encryption so that only computers running this version (or later versions) of the operating system can connect. This policy setting does not affect Remote Assistance connections that are initiated by instant messaging contacts or the unsolicited Offer Remote Assistance.\r\n\r\nIf you enable this policy setting, only computers running this version (or later versions) of the operating system can connect to this computer.\r\n\r\nIf you disable this policy setting, computers running this version and a previous version of the operating system can connect to this computer.\r\n\r\nIf you do not configure this policy setting, users can configure the setting in System Properties in the Control Panel.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-remoteassistance#admx-remoteassistance-ra-encryptedticketonly"],"options":[{"id":"device_vendor_msft_policy_config_admx_remoteassistance_ra_encryptedticketonly_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_remoteassistance_ra_encryptedticketonly_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_remoteassistance_ra_optimize_bandwidth","displayName":"Turn on bandwidth optimization","description":"This policy setting allows you to improve performance in low bandwidth scenarios.\r\n\r\nThis setting is incrementally scaled from \"No optimization\" to \"Full optimization\". Each incremental setting includes the previous optimization setting.\r\n\r\nFor example:\r\n\r\n\"Turn off background\" will include the following optimizations:\r\n-No full window drag\r\n-Turn off background\r\n\r\n\"Full optimization\" will include the following optimizations:\r\n-Use 16-bit color (8-bit color in Windows Vista)\r\n-Turn off font smoothing (not supported in Windows Vista)\r\n-No full window drag\r\n-Turn off background\r\n\r\nIf you enable this policy setting, bandwidth optimization occurs at the level specified.\r\n\r\nIf you disable this policy setting, application-based settings are used.\r\n\r\nIf you do not configure this policy setting, application-based settings are used.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-remoteassistance#admx-remoteassistance-ra-optimize-bandwidth"],"options":[{"id":"device_vendor_msft_policy_config_admx_remoteassistance_ra_optimize_bandwidth_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_remoteassistance_ra_optimize_bandwidth_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_remoteassistance_ra_optimize_bandwidth_ra_optimize_bandwidth_list","displayName":"Optimize settings for reduced bandwidth: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_remoteassistance_ra_optimize_bandwidth_ra_optimize_bandwidth_list_14","displayName":"No optimization","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_remoteassistance_ra_optimize_bandwidth_ra_optimize_bandwidth_list_12","displayName":"No full window drag","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_remoteassistance_ra_optimize_bandwidth_ra_optimize_bandwidth_list_8","displayName":"Turn off background","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_remoteassistance_ra_optimize_bandwidth_ra_optimize_bandwidth_list_0","displayName":"Full optimization","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_removablestorage_accessrights_reboottime_2","displayName":"Set time (in seconds) to force reboot","description":"This policy setting configures the amount of time (in seconds) that the operating system waits to reboot in order to enforce a change in access rights to removable storage devices.\r\n\r\nIf you enable this policy setting, you can set the number of seconds you want the system to wait until a reboot.\r\n\r\nIf you disable or do not configure this setting, the operating system does not force a reboot.\r\n\r\nNote: If no reboot is forced, the access right does not take effect until the operating system is restarted.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-removablestorage#admx-removablestorage-accessrights-reboottime-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_removablestorage_accessrights_reboottime_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_accessrights_reboottime_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_removablestorage_accessrights_reboottime_2_accessrights_reboottime_seconds","displayName":"Time (in seconds): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_cdanddvd_denyexecute_access_2","displayName":"CD and DVD: Deny execute access","description":"This policy setting denies execute access to the CD and DVD removable storage class.\r\n\r\nIf you enable this policy setting, execute access is denied to this removable storage class.\r\n\r\nIf you disable or do not configure this policy setting, execute access is allowed to this removable storage class.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-removablestorage#admx-removablestorage-cdanddvd-denyexecute-access-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_removablestorage_cdanddvd_denyexecute_access_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_cdanddvd_denyexecute_access_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_removablestorage_cdanddvd_denyread_access_2","displayName":"CD and DVD: Deny read access","description":"This policy setting denies read access to the CD and DVD removable storage class.\r\n\r\nIf you enable this policy setting, read access is denied to this removable storage class.\r\n\r\nIf you disable or do not configure this policy setting, read access is allowed to this removable storage class.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-removablestorage#admx-removablestorage-cdanddvd-denyread-access-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_removablestorage_cdanddvd_denyread_access_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_cdanddvd_denyread_access_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_removablestorage_cdanddvd_denywrite_access_2","displayName":"CD and DVD: Deny write access","description":"This policy setting denies write access to the CD and DVD removable storage class.\r\n\r\nIf you enable this policy setting, write access is denied to this removable storage class.\r\n\r\nIf you disable or do not configure this policy setting, write access is allowed to this removable storage class.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-removablestorage#admx-removablestorage-cdanddvd-denywrite-access-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_removablestorage_cdanddvd_denywrite_access_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_cdanddvd_denywrite_access_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_removablestorage_customclasses_denyread_access_2","displayName":"Custom Classes: Deny read access","description":"This policy setting denies read access to custom removable storage classes.\r\n\r\nIf you enable this policy setting, read access is denied to these removable storage classes.\r\n\r\nIf you disable or do not configure this policy setting, read access is allowed to these removable storage classes.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-removablestorage#admx-removablestorage-customclasses-denyread-access-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_removablestorage_customclasses_denyread_access_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_customclasses_denyread_access_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_removablestorage_customclasses_denyread_access_2_customclasses_list","displayName":"GUID for custom removable storage class: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_customclasses_denywrite_access_2","displayName":"Custom Classes: Deny write access","description":"This policy setting denies write access to custom removable storage classes.\r\n\r\nIf you enable this policy setting, write access is denied to these removable storage classes.\r\n\r\nIf you disable or do not configure this policy setting, write access is allowed to these removable storage classes.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-removablestorage#admx-removablestorage-customclasses-denywrite-access-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_removablestorage_customclasses_denywrite_access_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_customclasses_denywrite_access_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_removablestorage_customclasses_denywrite_access_2_customclasses_list","displayName":"GUID for custom removable storage class: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_floppydrives_denyexecute_access_2","displayName":"Floppy Drives: Deny execute access","description":"This policy setting denies execute access to the Floppy Drives removable storage class, including USB Floppy Drives.\r\n\r\nIf you enable this policy setting, execute access is denied to this removable storage class.\r\n\r\nIf you disable or do not configure this policy setting, execute access is allowed to this removable storage class.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-removablestorage#admx-removablestorage-floppydrives-denyexecute-access-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_removablestorage_floppydrives_denyexecute_access_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_floppydrives_denyexecute_access_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_removablestorage_floppydrives_denyread_access_2","displayName":"Floppy Drives: Deny read access","description":"This policy setting denies read access to the Floppy Drives removable storage class, including USB Floppy Drives.\r\n\r\nIf you enable this policy setting, read access is denied to this removable storage class.\r\n\r\nIf you disable or do not configure this policy setting, read access is allowed to this removable storage class.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-removablestorage#admx-removablestorage-floppydrives-denyread-access-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_removablestorage_floppydrives_denyread_access_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_floppydrives_denyread_access_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_removablestorage_floppydrives_denywrite_access_2","displayName":"Floppy Drives: Deny write access","description":"This policy setting denies write access to the Floppy Drives removable storage class, including USB Floppy Drives.\r\n\r\nIf you enable this policy setting, write access is denied to this removable storage class.\r\n\r\nIf you disable or do not configure this policy setting, write access is allowed to this removable storage class.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-removablestorage#admx-removablestorage-floppydrives-denywrite-access-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_removablestorage_floppydrives_denywrite_access_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_floppydrives_denywrite_access_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_removablestorage_removable_remote_allow_access","displayName":"All Removable Storage: Allow direct access in remote sessions","description":"This policy setting grants normal users direct access to removable storage devices in remote sessions.\r\n\r\nIf you enable this policy setting, remote users can open direct handles to removable storage devices in remote sessions.\r\n\r\nIf you disable or do not configure this policy setting, remote users cannot open direct handles to removable storage devices in remote sessions.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-removablestorage#admx-removablestorage-removable-remote-allow-access"],"options":[{"id":"device_vendor_msft_policy_config_admx_removablestorage_removable_remote_allow_access_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_removable_remote_allow_access_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_removablestorage_removabledisks_denyexecute_access_2","displayName":"Removable Disks: Deny execute access","description":"This policy setting denies execute access to removable disks.\r\n\r\nIf you enable this policy setting, execute access is denied to this removable storage class.\r\n\r\nIf you disable or do not configure this policy setting, execute access is allowed to this removable storage class.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-removablestorage#admx-removablestorage-removabledisks-denyexecute-access-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_removablestorage_removabledisks_denyexecute_access_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_removabledisks_denyexecute_access_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_removablestorage_removabledisks_denyread_access_2","displayName":"Removable Disks: Deny read access","description":"This policy setting denies read access to removable disks.\r\n\r\nIf you enable this policy setting, read access is denied to this removable storage class.\r\n\r\nIf you disable or do not configure this policy setting, read access is allowed to this removable storage class.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-removablestorage#admx-removablestorage-removabledisks-denyread-access-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_removablestorage_removabledisks_denyread_access_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_removabledisks_denyread_access_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_removablestorage_removablestorageclasses_denyall_access_2","displayName":"All Removable Storage classes: Deny all access","description":"Configure access to all removable storage classes.\r\n\r\nThis policy setting takes precedence over any individual removable storage policy settings. To manage individual classes, use the policy settings available for each class.\r\n\r\nIf you enable this policy setting, no access is allowed to any removable storage class.\r\n\r\nIf you disable or do not configure this policy setting, write and read accesses are allowed to all removable storage classes.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-removablestorage#admx-removablestorage-removablestorageclasses-denyall-access-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_removablestorage_removablestorageclasses_denyall_access_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_removablestorageclasses_denyall_access_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_removablestorage_tapedrives_denyexecute_access_2","displayName":"Tape Drives: Deny execute access","description":"This policy setting denies execute access to the Tape Drive removable storage class.\r\n\r\nIf you enable this policy setting, execute access is denied to this removable storage class.\r\n\r\nIf you disable or do not configure this policy setting, execute access is allowed to this removable storage class.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-removablestorage#admx-removablestorage-tapedrives-denyexecute-access-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_removablestorage_tapedrives_denyexecute_access_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_tapedrives_denyexecute_access_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_removablestorage_tapedrives_denyread_access_2","displayName":"Tape Drives: Deny read access","description":"This policy setting denies read access to the Tape Drive removable storage class.\r\n\r\nIf you enable this policy setting, read access is denied to this removable storage class.\r\n\r\nIf you disable or do not configure this policy setting, read access is allowed to this removable storage class.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-removablestorage#admx-removablestorage-tapedrives-denyread-access-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_removablestorage_tapedrives_denyread_access_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_tapedrives_denyread_access_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_removablestorage_tapedrives_denywrite_access_2","displayName":"Tape Drives: Deny write access","description":"This policy setting denies write access to the Tape Drive removable storage class.\r\n\r\nIf you enable this policy setting, write access is denied to this removable storage class.\r\n\r\nIf you disable or do not configure this policy setting, write access is allowed to this removable storage class.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-removablestorage#admx-removablestorage-tapedrives-denywrite-access-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_removablestorage_tapedrives_denywrite_access_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_tapedrives_denywrite_access_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_removablestorage_wpddevices_denyread_access_2","displayName":"WPD Devices: Deny read access","description":"This policy setting denies read access to removable disks, which may include media players, cellular phones, auxiliary displays, and CE devices.\r\n\r\nIf you enable this policy setting, read access is denied to this removable storage class.\r\n\r\nIf you disable or do not configure this policy setting, read access is allowed to this removable storage class.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-removablestorage#admx-removablestorage-wpddevices-denyread-access-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_removablestorage_wpddevices_denyread_access_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_wpddevices_denyread_access_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_removablestorage_wpddevices_denywrite_access_2","displayName":"WPD Devices: Deny write access","description":"This policy setting denies write access to removable disks, which may include media players, cellular phones, auxiliary displays, and CE devices.\r\n\r\nIf you enable this policy setting, write access is denied to this removable storage class.\r\n\r\nIf you disable or do not configure this policy setting, write access is allowed to this removable storage class.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-removablestorage#admx-removablestorage-wpddevices-denywrite-access-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_removablestorage_wpddevices_denywrite_access_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_removablestorage_wpddevices_denywrite_access_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcextendederrorinformation","displayName":"Propagate extended error information","description":"This policy setting controls whether the RPC runtime generates extended error information when an error occurs.\r\n\r\nExtended error information includes the local time that the error occurred, the RPC version, and the name of the computer on which the error occurred, or from which it was propagated. Programs can retrieve the extended error information by using standard Windows application programming interfaces (APIs).\r\n\r\nIf you disable this policy setting, the RPC Runtime only generates a status code to indicate an error condition.\r\n\r\nIf you do not configure this policy setting, it remains disabled. It will only generate a status code to indicate an error condition.\r\n\r\nIf you enable this policy setting, the RPC runtime will generate extended error information. You must select an error response type in the drop-down box.\r\n\r\n-- \"Off\" disables all extended error information for all processes. RPC only generates an error code.\r\n\r\n-- \"On with Exceptions\" enables extended error information, but lets you disable it for selected processes. To disable extended error information for a process while this policy setting is in effect, the command that starts the process must begin with one of the strings in the Extended Error Information Exception field.\r\n\r\n-- \"Off with Exceptions\" disables extended error information, but lets you enable it for selected processes. To enable extended error information for a process while this policy setting is in effect, the command that starts the process must begin with one of the strings in the Extended Error Information Exception field.\r\n\r\n-- \"On\" enables extended error information for all processes.\r\n\r\nNote: For information about the Extended Error Information Exception field, see the Windows Software Development Kit (SDK).\r\n\r\nNote: Extended error information is formatted to be compatible with other operating systems and older Microsoft operating systems, but only newer Microsoft operating systems can read and respond to the information.\r\n\r\nNote: The default policy setting, \"Off,\" is designed for systems where extended error information is considered to be sensitive, and it should not be made available remotely.\r\n\r\nNote: This policy setting will not be applied until the system is rebooted.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-rpc#admx-rpc-rpcextendederrorinformation"],"options":[{"id":"device_vendor_msft_policy_config_admx_rpc_rpcextendederrorinformation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcextendederrorinformation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcextendederrorinformation_rpcextendederrorinformationlist","displayName":"Propagation of extended error information: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_rpc_rpcextendederrorinformation_rpcextendederrorinformationlist_0","displayName":"Off","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcextendederrorinformation_rpcextendederrorinformationlist_1","displayName":"On with Exceptions","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcextendederrorinformation_rpcextendederrorinformationlist_2","displayName":"Off with Exceptions","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcextendederrorinformation_rpcextendederrorinformationlist_3","displayName":"On","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcextendederrorinformation_rpcexterrorexceptions","displayName":"Extended Error Information Exceptions: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcignoredelegationfailure","displayName":"Ignore Delegation Failure","description":"This policy setting controls whether the RPC Runtime ignores delegation failures when delegation is requested.\r\n\r\nThe constrained delegation model, introduced in Windows Server 2003, does not report that delegation was enabled on a security context when a client connects to a server. Callers of RPC and COM are encouraged to use the RPC_C_QOS_CAPABILITIES_IGNORE_DELEGATE_FAILURE flag, but some applications written for the traditional delegation model prior to Windows Server 2003 may not use this flag and will encounter RPC_S_SEC_PKG_ERROR when connecting to a server that uses constrained delegation.\r\n\r\nIf you disable this policy setting, the RPC Runtime will generate RPC_S_SEC_PKG_ERROR errors to applications that ask for delegation and connect to servers using constrained delegation. \r\n\r\nIf you do not configure this policy setting, it remains disabled and will generate RPC_S_SEC_PKG_ERROR errors to applications that ask for delegation and connect to servers using constrained delegation. \r\n\r\nIf you enable this policy setting, then:\r\n\r\n-- \"Off\" directs the RPC Runtime to generate RPC_S_SEC_PKG_ERROR if the client asks for delegation, but the created security context does not support delegation.\r\n\r\n-- \"On\" directs the RPC Runtime to accept security contexts that do not support delegation even if delegation was asked for.\r\n\r\nNote: This policy setting will not be applied until the system is rebooted.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-rpc#admx-rpc-rpcignoredelegationfailure"],"options":[{"id":"device_vendor_msft_policy_config_admx_rpc_rpcignoredelegationfailure_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcignoredelegationfailure_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcignoredelegationfailure_rpcignoredelegationfailurelist","displayName":"Ignoring Delegation Failure: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_rpc_rpcignoredelegationfailure_rpcignoredelegationfailurelist_0","displayName":"Off","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcignoredelegationfailure_rpcignoredelegationfailurelist_1","displayName":"On","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcminimumhttpconnectiontimeout","displayName":"Set Minimum Idle Connection Timeout for RPC/HTTP connections","description":"This policy setting controls the idle connection timeout for RPC/HTTP connections. \r\n\r\nThis policy setting is useful in cases where a network agent like an HTTP proxy or a router uses a lower idle connection timeout than the IIS server running the RPC/HTTP proxy. In such cases, RPC/HTTP clients may encounter errors because connections will be timed out faster than expected. Using this policy setting you can force the RPC Runtime and the RPC/HTTP Proxy to use a lower connection timeout.\r\n\r\nThis policy setting is only applicable when the RPC Client, the RPC Server and the RPC HTTP Proxy are all running Windows Server 2003 family/Windows XP SP1 or higher versions. If either the RPC Client or the RPC Server or the RPC HTTP Proxy run on an older version of Windows, this policy setting will be ignored.\r\n\r\nThe minimum allowed value for this policy setting is 90 seconds. The maximum is 7200 seconds (2 hours).\r\n\r\nIf you disable this policy setting, the idle connection timeout on the IIS server running the RPC HTTP proxy will be used.\r\n\r\nIf you do not configure this policy setting, it will remain disabled. The idle connection timeout on the IIS server running the RPC HTTP proxy will be used.\r\n\r\nIf you enable this policy setting, and the IIS server running the RPC HTTP proxy is configured with a lower idle connection timeout, the timeout on the IIS server is used. Otherwise, the provided timeout value is used. The timeout is given in seconds.\r\n\r\nNote: This policy setting will not be applied until the system is rebooted.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-rpc#admx-rpc-rpcminimumhttpconnectiontimeout"],"options":[{"id":"device_vendor_msft_policy_config_admx_rpc_rpcminimumhttpconnectiontimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcminimumhttpconnectiontimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcminimumhttpconnectiontimeout_rpcminimumhttpconnectiontimeoutvalue","displayName":"Minimum Idle Connection Timeout (in seconds): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcstateinformation","displayName":"Maintain RPC Troubleshooting State Information","description":"This policy setting determines whether the RPC Runtime maintains RPC state information for the system, and how much information it maintains. Basic state information, which consists only of the most commonly needed state data, is required for troubleshooting RPC problems.\r\n\r\nIf you disable this policy setting, the RPC runtime defaults to \"Auto2\" level.\r\n\r\nIf you do not configure this policy setting, the RPC defaults to \"Auto2\" level. \r\n\r\nIf you enable this policy setting, you can use the drop-down box to determine which systems maintain RPC state information.\r\n\r\n-- \"None\" indicates that the system does not maintain any RPC state information. Note: Because the basic state information required for troubleshooting has a negligible effect on performance and uses only about 4K of memory, this setting is not recommended for most installations.\r\n\r\n-- \"Auto1\" directs RPC to maintain basic state information only if the computer has at least 64 MB of memory.\r\n\r\n-- \"Auto2\" directs RPC to maintain basic state information only if the computer has at least 128 MB of memory and is running Windows 2000 Server, Windows 2000 Advanced Server, or Windows 2000 Datacenter Server. \r\n\r\n-- \"Server\" directs RPC to maintain basic state information on the computer, regardless of its capacity.\r\n\r\n-- \"Full\" directs RPC to maintain complete RPC state information on the system, regardless of its capacity. Because this level can degrade performance, it is recommended for use only while you are investigating an RPC problem.\r\n\r\nNote: To retrieve the RPC state information from a system that maintains it, you must use a debugging tool.\r\n\r\nNote: This policy setting will not be applied until the system is rebooted.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-rpc#admx-rpc-rpcstateinformation"],"options":[{"id":"device_vendor_msft_policy_config_admx_rpc_rpcstateinformation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcstateinformation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcstateinformation_rpcstateinformationlist","displayName":"RPC Runtime state information to maintain: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_rpc_rpcstateinformation_rpcstateinformationlist_0","displayName":"None","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcstateinformation_rpcstateinformationlist_1","displayName":"Auto1","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcstateinformation_rpcstateinformationlist_2","displayName":"Auto2","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcstateinformation_rpcstateinformationlist_3","displayName":"Server","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_rpc_rpcstateinformation_rpcstateinformationlist_4","displayName":"Full","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_sam_samngckeyrocavalidation","displayName":"Configure validation of ROCA-vulnerable WHfB keys during authentication","description":"This policy setting allows you to configure how domain controllers handle Windows Hello for Business (WHfB) keys that are vulnerable to the \"Return of Coppersmith's attack\" (ROCA) vulnerability.\r\n\r\nFor more information on the ROCA vulnerability, please see:\r\n\r\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15361\r\n\r\nhttps://en.wikipedia.org/wiki/ROCA_vulnerability\r\n\r\nIf you enable this policy setting the following options are supported:\r\n\r\nIgnore: during authentication the domain controller will not probe any WHfB keys for the ROCA vulnerability.\r\n\r\nAudit: during authentication the domain controller will emit audit events for WHfB keys that are subject to the ROCA vulnerability (authentications will still succeed).\r\n\r\nBlock: during authentication the domain controller will block the use of WHfB keys that are subject to the ROCA vulnerability (authentications will fail).\r\n\r\nThis setting only takes effect on domain controllers.\r\n\r\nIf not configured, domain controllers will default to using their local configuration. The default local configuration is Audit.\r\n\r\nA reboot is not required for changes to this setting to take effect.\r\n\r\nNote: to avoid unexpected disruptions this setting should not be set to Block until appropriate mitigations have been performed, for example patching of vulnerable TPMs.\r\n\r\nMore information is available at https://go.microsoft.com/fwlink/?linkid=2116430.\r\n","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-sam#admx-sam-samngckeyrocavalidation"],"options":[{"id":"device_vendor_msft_policy_config_admx_sam_samngckeyrocavalidation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_sam_samngckeyrocavalidation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_sam_samngckeyrocavalidation_samngckeyrocavalidation_settings","displayName":"Options for handling ROCA-vulnerable WHfB keys: (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_sam_samngckeyrocavalidation_samngckeyrocavalidation_settings_0","displayName":"Ignore ROCA-vulnerable WHfB keys","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_sam_samngckeyrocavalidation_samngckeyrocavalidation_settings_1","displayName":"Audit ROCA-vulnerable WHfB keys on use","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_sam_samngckeyrocavalidation_samngckeyrocavalidation_settings_2","displayName":"Block ROCA-vulnerable WHfB keys on use","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_scripts_allow_logon_script_netbiosdisabled","displayName":"Allow logon scripts when NetBIOS or WINS is disabled","description":"This policy setting allows user logon scripts to run when the logon cross-forest, DNS suffixes are not configured, and NetBIOS or WINS is disabled. This policy setting affects all user accounts interactively logging on to the computer.\r\n\r\nIf you enable this policy setting, user logon scripts run if NetBIOS or WINS is disabled during cross-forest logons without the DNS suffixes being configured.\r\n\r\nIf you disable or do not configure this policy setting, user account cross-forest, interactive logging cannot run logon scripts if NetBIOS or WINS is disabled, and the DNS suffixes are not configured.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-scripts#admx-scripts-allow-logon-script-netbiosdisabled"],"options":[{"id":"device_vendor_msft_policy_config_admx_scripts_allow_logon_script_netbiosdisabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_scripts_allow_logon_script_netbiosdisabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_scripts_maxgposcriptwaitpolicy","displayName":"Specify maximum wait time for Group Policy scripts","description":"This policy setting determines how long the system waits for scripts applied by Group Policy to run. \r\n\r\nThis setting limits the total time allowed for all logon, logoff, startup, and shutdown scripts applied by Group Policy to finish running. If the scripts have not finished running when the specified time expires, the system stops script processing and records an error event.\r\n\r\nIf you enable this setting, then, in the Seconds box, you can type a number from 1 to 32,000 for the number of seconds you want the system to wait for the set of scripts to finish. To direct the system to wait until the scripts have finished, no matter how long they take, type 0. \r\n\r\nThis interval is particularly important when other system tasks must wait while the scripts complete. By default, each startup script must complete before the next one runs. Also, you can use the \"Run logon scripts synchronously\" setting to direct the system to wait for the logon scripts to complete before loading the desktop. \r\n\r\nAn excessively long interval can delay the system and inconvenience users. However, if the interval is too short, prerequisite tasks might not be done, and the system can appear to be ready prematurely.\r\n\r\nIf you disable or do not configure this setting the system lets the combined set of scripts run for up to 600 seconds (10 minutes). This is the default.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-scripts#admx-scripts-maxgposcriptwaitpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_scripts_maxgposcriptwaitpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_scripts_maxgposcriptwaitpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_scripts_maxgposcriptwaitpolicy_maxgposcriptwait","displayName":"Seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_scripts_run_computer_ps_scripts_first","displayName":"Run Windows PowerShell scripts first at computer startup, shutdown","description":"This policy setting determines whether Windows PowerShell scripts are run before non-Windows PowerShell scripts during computer startup and shutdown. By default, Windows PowerShell scripts run after non-Windows PowerShell scripts. \r\n \r\nIf you enable this policy setting, within each applicable Group Policy Object (GPO), Windows PowerShell scripts are run before non-Windows PowerShell scripts during computer startup and shutdown. \r\n\r\nFor example, assume the following scenario: \r\n\r\nThere are three GPOs (GPO A, GPO B, and GPO C). This policy setting is enabled in GPO A. \r\n\r\nGPO B and GPO C include the following computer startup scripts:\r\n\r\nGPO B: B.cmd, B.ps1\r\nGPO C: C.cmd, C.ps1\r\n\r\nAssume also that there are two computers, DesktopIT and DesktopSales. \r\nFor DesktopIT, GPOs A, B, and C are applied. Therefore, the scripts for GPOs B and C run in the following order for DesktopIT:\r\n\r\nWithin GPO B: B.ps1, B.cmd\r\nWithin GPO C: C.ps1, C.cmd\r\n \r\nFor DesktopSales, GPOs B and C are applied, but not GPO A. Therefore, the scripts for GPOs B and C run in the following order for DesktopSales:\r\n\r\nWithin GPO B: B.cmd, B.ps1\r\nWithin GPO C: C.cmd, C.ps1\r\n\r\nNote: This policy setting determines the order in which computer startup and shutdown scripts are run within all applicable GPOs. You can override this policy setting for specific script types within a specific GPO by configuring the following policy settings for the GPO:\r\n \r\nComputer Configuration\\Policies\\Windows Settings\\Scripts (Startup/Shutdown)\\Startup\r\nComputer Configuration\\Policies\\Windows Settings\\Scripts (Startup/Shutdown)\\Shutdown\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-scripts#admx-scripts-run-computer-ps-scripts-first"],"options":[{"id":"device_vendor_msft_policy_config_admx_scripts_run_computer_ps_scripts_first_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_scripts_run_computer_ps_scripts_first_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_scripts_run_logon_script_sync_2","displayName":"Run logon scripts synchronously","description":"This policy setting directs the system to wait for logon scripts to finish running before it starts the File Explorer interface program and creates the desktop.\r\n\r\nIf you enable this policy setting, File Explorer does not start until the logon scripts have finished running. This policy setting ensures that logon script processing is complete before the user starts working, but it can delay the appearance of the desktop.\r\n\r\nIf you disable or do not configure this policy setting, the logon scripts and File Explorer are not synchronized and can run simultaneously.\r\n\r\nThis policy setting appears in the Computer Configuration and User Configuration folders. The policy setting set in Computer Configuration takes precedence over the policy setting set in User Configuration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-scripts#admx-scripts-run-logon-script-sync-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_scripts_run_logon_script_sync_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_scripts_run_logon_script_sync_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_scripts_run_shutdown_script_visible","displayName":"Display instructions in shutdown scripts as they run","description":"This policy setting displays the instructions in shutdown scripts as they run.\r\n\r\nShutdown scripts are batch files of instructions that run when the user restarts the system or shuts it down. By default, the system does not display the instructions in the shutdown script.\r\n\r\nIf you enable this policy setting, the system displays each instruction in the shutdown script as it runs. The instructions appear in a command window.\r\n\r\nIf you disable or do not configure this policy setting, the instructions are suppressed.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-scripts#admx-scripts-run-shutdown-script-visible"],"options":[{"id":"device_vendor_msft_policy_config_admx_scripts_run_shutdown_script_visible_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_scripts_run_shutdown_script_visible_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_scripts_run_startup_script_sync","displayName":"Run startup scripts asynchronously","description":"This policy setting lets the system run startup scripts simultaneously.\r\n\r\nStartup scripts are batch files that run before the user is invited to log on. By default, the system waits for each startup script to complete before it runs the next startup script.\r\n\r\nIf you enable this policy setting, the system does not coordinate the running of startup scripts. As a result, startup scripts can run simultaneously.\r\n\r\nIf you disable or do not configure this policy setting, a startup cannot run until the previous script is complete.\r\n\r\nNote: Starting with Windows Vista operating system, scripts that are configured to run asynchronously are no longer visible on startup, whether the \"Run startup scripts visible\" policy setting is enabled or not.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-scripts#admx-scripts-run-startup-script-sync"],"options":[{"id":"device_vendor_msft_policy_config_admx_scripts_run_startup_script_sync_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_scripts_run_startup_script_sync_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_scripts_run_startup_script_visible","displayName":"Display instructions in startup scripts as they run","description":"This policy setting displays the instructions in startup scripts as they run.\r\n\r\nStartup scripts are batch files of instructions that run before the user is invited to log on. By default, the system does not display the instructions in the startup script.\r\n\r\nIf you enable this policy setting, the system displays each instruction in the startup script as it runs. Instructions appear in a command window. This policy setting is designed for advanced users.\r\n\r\nIf you disable or do not configure this policy setting, the instructions are suppressed.\r\n\r\nNote: Starting with Windows Vista operating system, scripts that are configured to run asynchronously are no longer visible on startup, whether this policy setting is enabled or not.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-scripts#admx-scripts-run-startup-script-visible"],"options":[{"id":"device_vendor_msft_policy_config_admx_scripts_run_startup_script_visible_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_scripts_run_startup_script_visible_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_scripts_run_user_ps_scripts_first","displayName":"Run Windows PowerShell scripts first at user logon, logoff","description":"This policy setting determines whether Windows PowerShell scripts are run before non-Windows PowerShell scripts during user logon and logoff. By default, Windows PowerShell scripts run after non-Windows PowerShell scripts. \r\n \r\nIf you enable this policy setting, within each applicable Group Policy Object (GPO), PowerShell scripts are run before non-PowerShell scripts during user logon and logoff. \r\n\r\nFor example, assume the following scenario: \r\n\r\nThere are three GPOs (GPO A, GPO B, and GPO C). This policy setting is enabled in GPO A. \r\n\r\nGPO B and GPO C include the following user logon scripts:\r\n\r\nGPO B: B.cmd, B.ps1\r\nGPO C: C.cmd, C.ps1\r\n\r\nAssume also that there are two users, Qin Hong and Tamara Johnston. \r\nFor Qin, GPOs A, B, and C are applied. Therefore, the scripts for GPOs B and C run in the following order for Qin:\r\n\r\nWithin GPO B: B.ps1, B.cmd\r\nWithin GPO C: C.ps1, C.cmd\r\n \r\nFor Tamara, GPOs B and C are applied, but not GPO A. Therefore, the scripts for GPOs B and C run in the following order for Tamara:\r\n\r\nWithin GPO B: B.cmd, B.ps1\r\nWithin GPO C: C.cmd, C.ps1\r\n\r\nNote: This policy setting determines the order in which user logon and logoff scripts are run within all applicable GPOs. You can override this policy setting for specific script types within a specific GPO by configuring the following policy settings for the GPO:\r\n \r\nUser Configuration\\Policies\\Windows Settings\\Scripts (Logon/Logoff)\\Logon\r\nUser Configuration\\Policies\\Windows Settings\\Scripts (Logon/Logoff)\\Logoff\r\n\r\nThis policy setting appears in the Computer Configuration and User Configuration folders. The policy setting set in Computer Configuration takes precedence over the setting set in User Configuration.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-scripts#admx-scripts-run-user-ps-scripts-first"],"options":[{"id":"device_vendor_msft_policy_config_admx_scripts_run_user_ps_scripts_first_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_scripts_run_user_ps_scripts_first_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_sdiageng_betterwhenconnected","displayName":"Troubleshooting: Allow users to access online troubleshooting content on Microsoft servers from the Troubleshooting Control Panel (via the Windows Online Troubleshooting Service - WOTS)","description":"This policy setting allows users who are connected to the Internet to access and search troubleshooting content that is hosted on Microsoft content servers. Users can access online troubleshooting content from within the Troubleshooting Control Panel UI by clicking \"Yes\" when they are prompted by a message that states, \"Do you want the most up-to-date troubleshooting content?\"\r\n\r\nIf you enable or do not configure this policy setting, users who are connected to the Internet can access and search troubleshooting content that is hosted on Microsoft content servers from within the Troubleshooting Control Panel user interface.\r\n\r\nIf you disable this policy setting, users can only access and search troubleshooting content that is available locally on their computers, even if they are connected to the Internet. They are prevented from connecting to the Microsoft servers that host the Windows Online Troubleshooting Service.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-sdiageng#admx-sdiageng-betterwhenconnected"],"options":[{"id":"device_vendor_msft_policy_config_admx_sdiageng_betterwhenconnected_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_sdiageng_betterwhenconnected_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_sdiageng_scripteddiagnosticsexecutionpolicy","displayName":"Troubleshooting: Allow users to access and run Troubleshooting Wizards","description":"This policy setting allows users to access and run the troubleshooting tools that are available in the Troubleshooting Control Panel and to run the troubleshooting wizard to troubleshoot problems on their computers.\r\n\r\nIf you enable or do not configure this policy setting, users can access and run the troubleshooting tools from the Troubleshooting Control Panel.\r\n\r\nIf you disable this policy setting, users cannot access or run the troubleshooting tools from the Control Panel.\r\n\r\nNote that this setting also controls a user's ability to launch standalone troubleshooting packs such as those found in .diagcab files.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-sdiageng#admx-sdiageng-scripteddiagnosticsexecutionpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_sdiageng_scripteddiagnosticsexecutionpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_sdiageng_scripteddiagnosticsexecutionpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_sdiageng_scripteddiagnosticssecuritypolicy","displayName":"Configure Security Policy for Scripted Diagnostics","description":"This policy setting determines whether scripted diagnostics will execute diagnostic packages that are signed by untrusted publishers.\r\n\r\nIf you enable this policy setting, the scripted diagnostics execution engine validates the signer of any diagnostic package and runs only those signed by trusted publishers.\r\n\r\nIf you disable or do not configure this policy setting, the scripted diagnostics execution engine runs all digitally signed packages.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-sdiageng#admx-sdiageng-scripteddiagnosticssecuritypolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_sdiageng_scripteddiagnosticssecuritypolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_sdiageng_scripteddiagnosticssecuritypolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_sdiagschd_scheduleddiagnosticsexecutionpolicy","displayName":"Configure Scheduled Maintenance Behavior","description":"Determines whether scheduled diagnostics will run to proactively detect and resolve system problems.\r\n\r\nIf you enable this policy setting, you must choose an execution level. If you choose detection and troubleshooting only, Windows will periodically detect and troubleshoot problems. The user will be notified of the problem for interactive resolution. \r\n\r\nIf you choose detection, troubleshooting and resolution, Windows will resolve some of these problems silently without requiring user input.\r\n\r\nIf you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve problems on a scheduled basis.\r\n\r\nIf you do not configure this policy setting, local troubleshooting preferences will take precedence, as configured in the control panel. If no local troubleshooting preference is configured, scheduled diagnostics are enabled for detection, troubleshooting and resolution by default.\r\n\r\nNo reboots or service restarts are required for this policy to take effect: changes take effect immediately.\r\n\r\nThis policy setting will only take effect when the Task Scheduler service is in the running state. When the service is stopped or disabled, scheduled diagnostics will not be executed. The Task Scheduler service can be configured with the Services snap-in to the Microsoft Management Console.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-sdiagschd#admx-sdiagschd-scheduleddiagnosticsexecutionpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_sdiagschd_scheduleddiagnosticsexecutionpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_sdiagschd_scheduleddiagnosticsexecutionpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_sdiagschd_scheduleddiagnosticsexecutionpolicy_scheduleddiagnosticsexecutionpolicylevel","displayName":"Execution Level (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_sdiagschd_scheduleddiagnosticsexecutionpolicy_scheduleddiagnosticsexecutionpolicylevel_1","displayName":"Troubleshooting Only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_sdiagschd_scheduleddiagnosticsexecutionpolicy_scheduleddiagnosticsexecutionpolicylevel_2","displayName":"Regular","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_securitycenter_securitycenter_securitycenterindomain","displayName":"Turn on Security Center (Domain PCs only)","description":"This policy setting specifies whether Security Center is turned on or off for computers that are joined to an Active Directory domain. When Security Center is turned on, it monitors essential security settings and notifies the user when the computer might be at risk. The Security Center Control Panel category view also contains a status section, where the user can get recommendations to help increase the computer's security. When Security Center is not enabled on the domain, neither the notifications nor the Security Center status section are displayed. \r\n\r\nNote that Security Center can only be turned off for computers that are joined to a Windows domain. When a computer is not joined to a Windows domain, the policy setting will have no effect.\r\n\r\nIf you do not congifure this policy setting, the Security Center is turned off for domain members. \r\n\r\nIf you enable this policy setting, Security Center is turned on for all users. \r\n\r\nIf you disable this policy setting, Security Center is turned off for domain members.\r\n\r\nWindows XP SP2\r\n----------------------\r\nIn Windows XP SP2, the essential security settings that are monitored by Security Center include firewall, antivirus, and Automatic Updates. Note that Security Center might not be available following a change to this policy setting until after the computer is restarted for Windows XP SP2 computers. \r\n\r\nWindows Vista\r\n---------------------\r\nIn Windows Vista, this policy setting monitors essential security settings to include firewall, antivirus, antispyware, Internet security settings, User Account Control, and Automatic Updates. Windows Vista computers do not require a reboot for this policy setting to take effect.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-securitycenter#admx-securitycenter-securitycenter-securitycenterindomain"],"options":[{"id":"device_vendor_msft_policy_config_admx_securitycenter_securitycenter_securitycenterindomain_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_securitycenter_securitycenter_securitycenterindomain_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_sensors_disablelocationscripting_2","displayName":"Turn off location scripting","description":"\r\n This policy setting turns off scripting for the location feature.\r\n\r\n If you enable this policy setting, scripts for the location feature will not run.\r\n\r\n If you disable or do not configure this policy setting, all location scripts will run.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-sensors#admx-sensors-disablelocationscripting-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_sensors_disablelocationscripting_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_sensors_disablelocationscripting_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_sensors_disablesensors_2","displayName":"Turn off sensors","description":"\r\n This policy setting turns off the sensor feature for this computer.\r\n\r\n If you enable this policy setting, the sensor feature is turned off, and all programs on this computer cannot use the sensor feature.\r\n\r\n If you disable or do not configure this policy setting, all programs on this computer can use the sensor feature.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-sensors#admx-sensors-disablesensors-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_sensors_disablesensors_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_sensors_disablesensors_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_servermanager_do_not_display_manage_your_server_page","displayName":"Do not display Manage Your Server page at logon","description":"This policy setting allows you to turn off the automatic display of the Manage Your Server page. \r\n\r\nIf you enable this policy setting, the Manage Your Server page is not displayed each time an administrator logs on to the server. \r\n\r\nIf you disable or do not configure this policy setting, the Manage Your Server page is displayed each time an administrator logs on to the server. However, if the administrator has selected the \"Don’t display this page at logon\" option at the bottom of the Manage Your Server page, the page is not displayed.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-servermanager#admx-servermanager-do-not-display-manage-your-server-page"],"options":[{"id":"device_vendor_msft_policy_config_admx_servermanager_do_not_display_manage_your_server_page_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_servermanager_do_not_display_manage_your_server_page_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_servermanager_donotlaunchinitialconfigurationtasks","displayName":"Do not display Initial Configuration Tasks window automatically at logon","description":"This policy setting allows you to turn off the automatic display of the Initial Configuration Tasks window at logon on Windows Server 2008 and Windows Server 2008 R2. \r\n\r\nIf you enable this policy setting, the Initial Configuration Tasks window is not displayed when an administrator logs on to the server. \r\n\r\nIf you disable this policy setting, the Initial Configuration Tasks window is displayed when an administrator logs on to the server.\r\n\r\nIf you do not configure this policy setting, the Initial Configuration Tasks window is displayed when an administrator logs on to the server. However, if an administrator selects the \"Do not show this window at logon\" option, the window is not displayed on subsequent logons.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-servermanager#admx-servermanager-donotlaunchinitialconfigurationtasks"],"options":[{"id":"device_vendor_msft_policy_config_admx_servermanager_donotlaunchinitialconfigurationtasks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_servermanager_donotlaunchinitialconfigurationtasks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_servermanager_donotlaunchservermanager","displayName":"Do not display Server Manager automatically at logon","description":"This policy setting allows you to turn off the automatic display of Server Manager at logon.\r\n\r\nIf you enable this policy setting, Server Manager is not displayed automatically when a user logs on to the server.\r\n\r\nIf you disable this policy setting, Server Manager is displayed automatically when a user logs on to the server.\r\n\r\nIf you do not configure this policy setting, Server Manager is displayed when a user logs on to the server. However, if the \"Do not show me this console at logon\" (Windows Server 2008 and Windows Server 2008 R2) or “Do not start Server Manager automatically at logon” (Windows Server 2012) option is selected, the console is not displayed automatically at logon.\r\n\r\nNote: Regardless of the status of this policy setting, Server Manager is available from the Start menu or the Windows taskbar.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-servermanager#admx-servermanager-donotlaunchservermanager"],"options":[{"id":"device_vendor_msft_policy_config_admx_servermanager_donotlaunchservermanager_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_servermanager_donotlaunchservermanager_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_servermanager_servermanagerautorefreshrate","displayName":"Configure the refresh interval for Server Manager","description":"This policy setting allows you to set the refresh interval for Server Manager. Each refresh provides Server Manager with updated information about which roles and features are installed on servers that you are managing by using Server Manager. Server Manager also monitors the status of roles and features installed on managed servers.\r\n\r\nIf you enable this policy setting, Server Manager uses the refresh interval specified in the policy setting instead of the “Configure Refresh Interval” setting (in Windows Server 2008 and Windows Server 2008 R2), or the “Refresh the data shown in Server Manager every [x] [minutes/hours/days]” setting (in Windows Server 2012) that is configured in the Server Manager console.\r\n\r\nIf you disable this policy setting, Server Manager does not refresh automatically. If you do not configure this policy setting, Server Manager uses the refresh interval settings that are specified in the Server Manager console.\r\n\r\nNote: The default refresh interval for Server Manager is two minutes in Windows Server 2008 and Windows Server 2008 R2, or 10 minutes in Windows Server 2012.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-servermanager#admx-servermanager-servermanagerautorefreshrate"],"options":[{"id":"device_vendor_msft_policy_config_admx_servermanager_servermanagerautorefreshrate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_servermanager_servermanagerautorefreshrate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_servermanager_servermanagerautorefreshrate_refreshrate","displayName":"Minutes: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_servicing_servicing","displayName":"Specify settings for optional component installation and component repair","description":"\r\nThis policy setting specifies the network locations that will be used for the repair of operating system corruption and for enabling optional features that have had their payload files removed.\r\n\r\nIf you enable this policy setting and specify the new location, the files in that location will be used to repair operating system corruption and for enabling optional features that have had their payload files removed. You must enter the fully qualified path to the new location in the \"Alternate source file path\" text box. Multiple locations can be specified when each path is separated by a semicolon. \r\n\r\nThe network location can be either a folder, or a WIM file. If it is a WIM file, the location should be specified by prefixing the path with “wim:” and include the index of the image to use in the WIM file. For example “wim:\\\\server\\share\\install.wim:3”.\r\n\r\nIf you disable or do not configure this policy setting, or if the required files cannot be found at the locations specified in this policy setting, the files will be downloaded from Windows Update, if that is allowed by the policy settings for the computer.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-servicing#admx-servicing-servicing"],"options":[{"id":"device_vendor_msft_policy_config_admx_servicing_servicing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_servicing_servicing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_servicing_servicing_checkbox_neverusewu","displayName":"Never attempt to download payload from Windows Update (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_servicing_servicing_checkbox_neverusewu_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_servicing_servicing_checkbox_neverusewu_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_servicing_servicing_checkbox_sidestepwsus","displayName":"Download repair content and optional features directly from Windows Update instead of Windows Server Update Services (WSUS) (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_servicing_servicing_checkbox_sidestepwsus_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_servicing_servicing_checkbox_sidestepwsus_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_servicing_servicing_localsourcepath_textbox","displayName":"Alternate source file path (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_settingsync_disableapplicationsettingsync","displayName":"Do not sync app settings","description":"Prevent the \"app settings\" group from syncing to and from this PC. This turns off and disables the \"app settings\" group on the \"sync your settings\" page in PC settings.\r\n\r\nIf you enable this policy setting, the \"app settings\" group will not be synced.\r\n\r\nUse the option \"Allow users to turn app settings syncing on\" so that syncing it turned off by default but not disabled.\r\n\r\nIf you do not set or disable this setting, syncing of the \"app settings\" group is on by default and configurable by the user.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-settingsync#admx-settingsync-disableapplicationsettingsync"],"options":[{"id":"device_vendor_msft_policy_config_admx_settingsync_disableapplicationsettingsync_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_settingsync_disableapplicationsettingsync_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_settingsync_disableapplicationsettingsync_checkbox_useroverride","displayName":"Allow users to turn \"app settings\" syncing on. (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_settingsync_disableapplicationsettingsync_checkbox_useroverride_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_settingsync_disableapplicationsettingsync_checkbox_useroverride_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_settingsync_disableappsyncsettingsync","displayName":"Do not sync Apps","description":"\r\n Prevent the \"AppSync\" group from syncing to and from this PC. This turns off and disables the \"AppSync\" group on the \"sync your settings\" page in PC settings.\r\n\r\nIf you enable this policy setting, the \"AppSync\" group will not be synced.\r\n\r\nUse the option \"Allow users to turn app syncing on\" so that syncing it turned off by default but not disabled.\r\n\r\nIf you do not set or disable this setting, syncing of the \"AppSync\" group is on by default and configurable by the user.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-settingsync#admx-settingsync-disableappsyncsettingsync"],"options":[{"id":"device_vendor_msft_policy_config_admx_settingsync_disableappsyncsettingsync_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_settingsync_disableappsyncsettingsync_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_settingsync_disableappsyncsettingsync_checkbox_useroverride","displayName":"Allow users to turn \"AppSync\" syncing on. (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_settingsync_disableappsyncsettingsync_checkbox_useroverride_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_settingsync_disableappsyncsettingsync_checkbox_useroverride_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablecredentialssettingsync","displayName":"Do not sync passwords","description":"Prevent the \"passwords\" group from syncing to and from this PC. This turns off and disables the \"passwords\" group on the \"sync your settings\" page in PC settings.\r\n\r\nIf you enable this policy setting, the \"passwords\" group will not be synced.\r\n\r\nUse the option \"Allow users to turn passwords syncing on\" so that syncing it turned off by default but not disabled.\r\n\r\nIf you do not set or disable this setting, syncing of the \"passwords\" group is on by default and configurable by the user.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-settingsync#admx-settingsync-disablecredentialssettingsync"],"options":[{"id":"device_vendor_msft_policy_config_admx_settingsync_disablecredentialssettingsync_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablecredentialssettingsync_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablecredentialssettingsync_checkbox_useroverride","displayName":"Allow users to turn \"passwords\" syncing on. (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_settingsync_disablecredentialssettingsync_checkbox_useroverride_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablecredentialssettingsync_checkbox_useroverride_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_settingsync_disabledesktopthemesettingsync","displayName":"Do not sync desktop personalization","description":"Prevent the \"desktop personalization\" group from syncing to and from this PC. This turns off and disables the \"desktop personalization\" group on the \"sync your settings\" page in PC settings.\r\n\r\nIf you enable this policy setting, the \"desktop personalization\" group will not be synced.\r\n\r\nUse the option \"Allow users to turn desktop personalization syncing on\" so that syncing it turned off by default but not disabled.\r\n\r\nIf you do not set or disable this setting, syncing of the \"desktop personalization\" group is on by default and configurable by the user.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-settingsync#admx-settingsync-disabledesktopthemesettingsync"],"options":[{"id":"device_vendor_msft_policy_config_admx_settingsync_disabledesktopthemesettingsync_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_settingsync_disabledesktopthemesettingsync_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_settingsync_disabledesktopthemesettingsync_checkbox_useroverride","displayName":"Allow users to turn \"desktop personalization\" syncing on. (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_settingsync_disabledesktopthemesettingsync_checkbox_useroverride_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_settingsync_disabledesktopthemesettingsync_checkbox_useroverride_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablepersonalizationsettingsync","displayName":"Do not sync personalize","description":"Prevent the \"personalize\" group from syncing to and from this PC. This turns off and disables the \"personalize\" group on the \"sync your settings\" page in PC settings.\r\n\r\nIf you enable this policy setting, the \"personalize\" group will not be synced.\r\n\r\nUse the option \"Allow users to turn personalize syncing on\" so that syncing it turned off by default but not disabled.\r\n\r\nIf you do not set or disable this setting, syncing of the \"personalize\" group is on by default and configurable by the user.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-settingsync#admx-settingsync-disablepersonalizationsettingsync"],"options":[{"id":"device_vendor_msft_policy_config_admx_settingsync_disablepersonalizationsettingsync_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablepersonalizationsettingsync_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablepersonalizationsettingsync_checkbox_useroverride","displayName":"Allow users to turn \"personalize\" syncing on. (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_settingsync_disablepersonalizationsettingsync_checkbox_useroverride_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablepersonalizationsettingsync_checkbox_useroverride_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablesettingsync","displayName":"Do not sync","description":"Prevent syncing to and from this PC. This turns off and disables the \"sync your settings\" switch on the \"sync your settings\" page in PC Settings.\r\n\r\nIf you enable this policy setting, \"sync your settings\" will be turned off, and none of the \"sync your setting\" groups will be synced on this PC.\r\n\r\nUse the option \"Allow users to turn syncing on\" so that syncing it turned off by default but not disabled.\r\n\r\nIf you do not set or disable this setting, \"sync your settings\" is on by default and configurable by the user.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-settingsync#admx-settingsync-disablesettingsync"],"options":[{"id":"device_vendor_msft_policy_config_admx_settingsync_disablesettingsync_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablesettingsync_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablesettingsync_checkbox_useroverride","displayName":"Allow users to turn syncing on. (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_settingsync_disablesettingsync_checkbox_useroverride_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablesettingsync_checkbox_useroverride_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablestartlayoutsettingsync","displayName":"Do not sync start settings","description":"\r\n Prevent the \"Start layout\" group from syncing to and from this PC. This turns off and disables the \"Start layout\" group on the \"sync your settings\" page in PC settings.\r\n\r\n If you enable this policy setting, the \"Start layout\" group will not be synced.\r\n\r\n Use the option \"Allow users to turn start syncing on\" so that syncing is turned off by default but not disabled.\r\n\r\n If you do not set or disable this setting, syncing of the \"Start layout\" group is on by default and configurable by the user.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-settingsync#admx-settingsync-disablestartlayoutsettingsync"],"options":[{"id":"device_vendor_msft_policy_config_admx_settingsync_disablestartlayoutsettingsync_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablestartlayoutsettingsync_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablestartlayoutsettingsync_checkbox_useroverride","displayName":"Allow users to turn \"start layout\" syncing on. (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_settingsync_disablestartlayoutsettingsync_checkbox_useroverride_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablestartlayoutsettingsync_checkbox_useroverride_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablesynconpaidnetwork","displayName":"Do not sync on metered connections","description":"Prevent syncing to and from this PC when on metered Internet connections. This turns off and disables \"sync your settings on metered connections\" switch on the \"sync your settings\" page in PC Settings.\r\n\r\nIf you enable this policy setting, syncing on metered connections will be turned off, and no syncing will take place when this PC is on a metered connection.\r\n\r\nIf you do not set or disable this setting, syncing on metered connections is configurable by the user.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-settingsync#admx-settingsync-disablesynconpaidnetwork"],"options":[{"id":"device_vendor_msft_policy_config_admx_settingsync_disablesynconpaidnetwork_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablesynconpaidnetwork_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablewindowssettingsync","displayName":"Do not sync other Windows settings","description":"Prevent the \"Other Windows settings\" group from syncing to and from this PC. This turns off and disables the \"Other Windows settings\" group on the \"sync your settings\" page in PC settings.\r\n\r\nIf you enable this policy setting, the \"Other Windows settings\" group will not be synced.\r\n\r\nUse the option \"Allow users to turn other Windows settings syncing on\" so that syncing it turned off by default but not disabled.\r\n\r\nIf you do not set or disable this setting, syncing of the \"Other Windows settings\" group is on by default and configurable by the user.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-settingsync#admx-settingsync-disablewindowssettingsync"],"options":[{"id":"device_vendor_msft_policy_config_admx_settingsync_disablewindowssettingsync_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablewindowssettingsync_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablewindowssettingsync_checkbox_useroverride","displayName":"Allow users to turn \"other Windows settings\" syncing on. (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_settingsync_disablewindowssettingsync_checkbox_useroverride_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_settingsync_disablewindowssettingsync_checkbox_useroverride_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_sharing_disablehomegroup","displayName":"Prevent the computer from joining a homegroup","description":"This policy setting specifies whether users can add computers to a homegroup. By default, users can add their computer to a homegroup on a private network.\r\n\r\nIf you enable this policy setting, users cannot add computers to a homegroup. This policy setting does not affect other network sharing features.\r\n\r\nIf you disable or do not configure this policy setting, users can add computers to a homegroup. However, data on a domain-joined computer is not shared with the homegroup.\r\n\r\nThis policy setting is not configured by default.\r\n\r\nYou must restart the computer for this policy setting to take effect.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-sharing#admx-sharing-disablehomegroup"],"options":[{"id":"device_vendor_msft_policy_config_admx_sharing_disablehomegroup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_sharing_disablehomegroup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_smartcard_allowcertificateswithnoeku","displayName":"Allow certificates with no extended key usage certificate attribute","description":"This policy setting lets you allow certificates without an Extended Key Usage (EKU) set to be used for logon.\r\n\r\nIn versions of Windows prior to Windows Vista, smart card certificates that are used for logon require an enhanced key usage (EKU) extension with a smart card logon object identifier. This policy setting can be used to modify that restriction.\r\n\r\nIf you enable this policy setting, certificates with the following attributes can also be used to log on with a smart card:\r\n- Certificates with no EKU\r\n- Certificates with an All Purpose EKU\r\n- Certificates with a Client Authentication EKU\r\n\r\nIf you disable or do not configure this policy setting, only certificates that contain the smart card logon object identifier can be used to log on with a smart card.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-smartcard#admx-smartcard-allowcertificateswithnoeku"],"options":[{"id":"device_vendor_msft_policy_config_admx_smartcard_allowcertificateswithnoeku_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_allowcertificateswithnoeku_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_smartcard_allowintegratedunblock","displayName":"Allow Integrated Unblock screen to be displayed at the time of logon","description":"This policy setting lets you determine whether the integrated unblock feature will be available in the logon User Interface (UI).\r\n\r\nIn order to use the integrated unblock feature your smart card must support this feature. Please check with your hardware manufacturer to see if your smart card supports this feature.\r\n\r\nIf you enable this policy setting, the integrated unblock feature will be available.\r\n\r\nIf you disable or do not configure this policy setting then the integrated unblock feature will not be available.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-smartcard#admx-smartcard-allowintegratedunblock"],"options":[{"id":"device_vendor_msft_policy_config_admx_smartcard_allowintegratedunblock_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_allowintegratedunblock_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_smartcard_allowsignatureonlykeys","displayName":"Allow signature keys valid for Logon","description":"This policy setting lets you allow signature key-based certificates to be enumerated and available for logon.\r\n\r\nIf you enable this policy setting then any certificates available on the smart card with a signature only key will be listed on the logon screen.\r\n\r\nIf you disable or do not configure this policy setting, any available smart card signature key-based certificates will not be listed on the logon screen.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-smartcard#admx-smartcard-allowsignatureonlykeys"],"options":[{"id":"device_vendor_msft_policy_config_admx_smartcard_allowsignatureonlykeys_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_allowsignatureonlykeys_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_smartcard_allowtimeinvalidcertificates","displayName":"Allow time invalid certificates","description":"This policy setting permits those certificates to be displayed for logon that are either expired or not yet valid.\r\n\r\nUnder previous versions of Microsoft Windows, certificates were required to contain a valid time and not be expired. The certificate must still be accepted by the domain controller in order to be used. This setting only controls the displaying of the certificate on the client machine. \r\n\r\nIf you enable this policy setting certificates will be listed on the logon screen regardless of whether they have an invalid time or their time validity has expired.\r\n\r\nIf you disable or do not configure this policy setting, certificates which are expired or not yet valid will not be listed on the logon screen.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-smartcard#admx-smartcard-allowtimeinvalidcertificates"],"options":[{"id":"device_vendor_msft_policy_config_admx_smartcard_allowtimeinvalidcertificates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_allowtimeinvalidcertificates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_smartcard_certpropenabledstring","displayName":"Turn on certificate propagation from smart card","description":"This policy setting allows you to manage the certificate propagation that occurs when a smart card is inserted.\r\n\r\nIf you enable or do not configure this policy setting then certificate propagation will occur when you insert your smart card.\r\n\r\nIf you disable this policy setting, certificate propagation will not occur and the certificates will not be made available to applications such as Outlook.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-smartcard#admx-smartcard-certpropenabledstring"],"options":[{"id":"device_vendor_msft_policy_config_admx_smartcard_certpropenabledstring_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_certpropenabledstring_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_smartcard_certproprootcleanupstring","displayName":"Configure root certificate clean up","description":"This policy setting allows you to manage the clean up behavior of root certificates. If you enable this policy setting then root certificate cleanup will occur according to the option selected. If you disable or do not configure this setting then root certificate clean up will occur on log off.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-smartcard#admx-smartcard-certproprootcleanupstring"],"options":[{"id":"device_vendor_msft_policy_config_admx_smartcard_certproprootcleanupstring_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_certproprootcleanupstring_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_smartcard_certproprootcleanupstring_rootcertcleanupoption_levels","displayName":"Root certificate clean up options (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_smartcard_certproprootcleanupstring_rootcertcleanupoption_levels_0","displayName":"No cleanup","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_certproprootcleanupstring_rootcertcleanupoption_levels_1","displayName":"Clean up certificates on smart card removal","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_certproprootcleanupstring_rootcertcleanupoption_levels_2","displayName":"Clean up certificates on log off","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_smartcard_certproprootenabledstring","displayName":"Turn on root certificate propagation from smart card","description":"This policy setting allows you to manage the root certificate propagation that occurs when a smart card is inserted.\r\n\r\nIf you enable or do not configure this policy setting then root certificate propagation will occur when you insert your smart card. Note: For this policy setting to work the following policy setting must also be enabled: Turn on certificate propagation from smart card.\r\n\r\nIf you disable this policy setting then root certificates will not be propagated from the smart card.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-smartcard#admx-smartcard-certproprootenabledstring"],"options":[{"id":"device_vendor_msft_policy_config_admx_smartcard_certproprootenabledstring_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_certproprootenabledstring_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_smartcard_disallowplaintextpin","displayName":"Prevent plaintext PINs from being returned by Credential Manager","description":"This policy setting prevents plaintext PINs from being returned by Credential Manager. \r\n\r\nIf you enable this policy setting, Credential Manager does not return a plaintext PIN. \r\n\r\nIf you disable or do not configure this policy setting, plaintext PINs can be returned by Credential Manager.\r\n\r\nNote: Enabling this policy setting could prevent certain smart cards from working on Windows. Please consult your smart card manufacturer to find out whether you will be affected by this policy setting.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-smartcard#admx-smartcard-disallowplaintextpin"],"options":[{"id":"device_vendor_msft_policy_config_admx_smartcard_disallowplaintextpin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_disallowplaintextpin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_smartcard_enumerateecccerts","displayName":"Allow ECC certificates to be used for logon and authentication","description":"This policy setting allows you to control whether elliptic curve cryptography (ECC) certificates on a smart card can be used to log on to a domain.\r\n\r\nIf you enable this policy setting, ECC certificates on a smart card can be used to log on to a domain.\r\n\r\nIf you disable or do not configure this policy setting, ECC certificates on a smart card cannot be used to log on to a domain. \r\n\r\nNote: This policy setting only affects a user's ability to log on to a domain. ECC certificates on a smart card that are used for other applications, such as document signing, are not affected by this policy setting. \r\nNote: If you use an ECDSA key to log on, you must also have an associated ECDH key to permit logons when you are not connected to the network.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-smartcard#admx-smartcard-enumerateecccerts"],"options":[{"id":"device_vendor_msft_policy_config_admx_smartcard_enumerateecccerts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_enumerateecccerts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_smartcard_filterduplicatecerts","displayName":"Filter duplicate logon certificates","description":"This policy settings lets you configure if all your valid logon certificates are displayed.\r\n\r\nDuring the certificate renewal period, a user can have multiple valid logon certificates issued from the same certificate template. This can cause confusion as to which certificate to select for logon. The common case for this behavior is when a certificate is renewed and the old one has not yet expired. Two certificates are determined to be the same if they are issued from the same template with the same major version and they are for the same user (determined by their UPN). \r\n \r\nIf there are two or more of the \"same\" certificate on a smart card and this policy is enabled then the certificate that is used for logon on Windows 2000, Windows XP, and Windows 2003 Server will be shown, otherwise the the certificate with the expiration time furthest in the future will be shown. Note: This setting will be applied after the following policy: \"Allow time invalid certificates\"\r\n\r\nIf you enable or do not configure this policy setting, filtering will take place.\r\n\r\nIf you disable this policy setting, no filtering will take place.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-smartcard#admx-smartcard-filterduplicatecerts"],"options":[{"id":"device_vendor_msft_policy_config_admx_smartcard_filterduplicatecerts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_filterduplicatecerts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_smartcard_forcereadingallcertificates","displayName":"Force the reading of all certificates from the smart card","description":"This policy setting allows you to manage the reading of all certificates from the smart card for logon.\r\n\r\nDuring logon Windows will by default only read the default certificate from the smart card unless it supports retrieval of all certificates in a single call. This setting forces Windows to read all the certificates from the card. This can introduce a significant performance decrease in certain situations. Please contact your smart card vendor to determine if your smart card and associated CSP supports the required behavior.\r\n\r\nIf you enable this setting, then Windows will attempt to read all certificates from the smart card regardless of the feature set of the CSP.\r\n\r\nIf you disable or do not configure this setting, Windows will only attempt to read the default certificate from those cards that do not support retrieval of all certificates in a single call. Certificates other than the default will not be available for logon.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-smartcard#admx-smartcard-forcereadingallcertificates"],"options":[{"id":"device_vendor_msft_policy_config_admx_smartcard_forcereadingallcertificates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_forcereadingallcertificates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_smartcard_integratedunblockpromptstring","displayName":"Display string when smart card is blocked","description":"This policy setting allows you to manage the displayed message when a smart card is blocked.\r\n\r\nIf you enable this policy setting, the specified message will be displayed to the user when the smart card is blocked. Note: The following policy setting must be enabled - Allow Integrated Unblock screen to be displayed at the time of logon.\r\n\r\nIf you disable or do not configure this policy setting, the default message will be displayed to the user when the smart card is blocked, if the integrated unblock feature is enabled.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-smartcard#admx-smartcard-integratedunblockpromptstring"],"options":[{"id":"device_vendor_msft_policy_config_admx_smartcard_integratedunblockpromptstring_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_integratedunblockpromptstring_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_smartcard_integratedunblockpromptstring_integratedunblockpromptstring","displayName":"Display string when smart card is blocked (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_reversesubject","displayName":"Reverse the subject name stored in a certificate when displaying","description":"This policy setting lets you reverse the subject name from how it is stored in the certificate when displaying it during logon. \r\n \r\nBy default the user principal name (UPN) is displayed in addition to the common name to help users distinguish one certificate from another. For example, if the certificate subject was CN=User1, OU=Users, DN=example, DN=com and had an UPN of user1@example.com then \"User1\" will be displayed along with \"user1@example.com.\" If the UPN is not present then the entire subject name will be displayed. This setting controls the appearance of that subject name and might need to be adjusted per organization.\r\n\r\nIf you enable this policy setting or do not configure this setting, then the subject name will be reversed. \r\n\r\nIf you disable , the subject name will be displayed as it appears in the certificate.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-smartcard#admx-smartcard-reversesubject"],"options":[{"id":"device_vendor_msft_policy_config_admx_smartcard_reversesubject_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_reversesubject_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_smartcard_scpnpenabled","displayName":"Turn on Smart Card Plug and Play service","description":"This policy setting allows you to control whether Smart Card Plug and Play is enabled.\r\n\r\nIf you enable or do not configure this policy setting, Smart Card Plug and Play will be enabled and the system will attempt to install a Smart Card device driver when a card is inserted in a Smart Card Reader for the first time.\r\n\r\nIf you disable this policy setting, Smart Card Plug and Play will be disabled and a device driver will not be installed when a card is inserted in a Smart Card Reader.\r\n\r\nNote: This policy setting is applied only for smart cards that have passed the Windows Hardware Quality Labs (WHQL) testing process.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-smartcard#admx-smartcard-scpnpenabled"],"options":[{"id":"device_vendor_msft_policy_config_admx_smartcard_scpnpenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_scpnpenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_smartcard_scpnpnotification","displayName":"Notify user of successful smart card driver installation","description":"This policy setting allows you to control whether a confirmation message is displayed when a smart card device driver is installed.\r\n\r\nIf you enable or do not configure this policy setting, a confirmation message will be displayed when a smart card device driver is installed.\r\n\r\nIf you disable this policy setting, a confirmation message will not be displayed when a smart card device driver is installed.\r\n\r\nNote: This policy setting is applied only for smart cards that have passed the Windows Hardware Quality Labs (WHQL) testing process.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-smartcard#admx-smartcard-scpnpnotification"],"options":[{"id":"device_vendor_msft_policy_config_admx_smartcard_scpnpnotification_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_scpnpnotification_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_smartcard_x509hintsneeded","displayName":"Allow user name hint","description":"This policy setting lets you determine whether an optional field will be displayed during logon and elevation that allows a user to enter his or her user name or user name and domain, thereby associating a certificate with that user.\r\n\r\nIf you enable this policy setting then an optional field that allows a user to enter their user name or user name and domain will be displayed.\r\n\r\nIf you disable or do not configure this policy setting, an optional field that allows users to enter their user name or user name and domain will not be displayed.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-smartcard#admx-smartcard-x509hintsneeded"],"options":[{"id":"device_vendor_msft_policy_config_admx_smartcard_x509hintsneeded_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_smartcard_x509hintsneeded_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_snmp_snmp_communities","displayName":"Specify communities","description":"This policy setting configures a list of the communities defined to the Simple Network Management Protocol (SNMP) service.\r\n\r\nSNMP is a protocol designed to give a user the capability to remotely manage a computer network, by polling and setting terminal values and monitoring network events.\r\n\r\nA valid community is a community recognized by the SNMP service, while a community is a group of hosts (servers, workstations, hubs, and routers) that are administered together by SNMP. The SNMP service is a managed network node that receives SNMP packets from the network.\r\n\r\nIf you enable this policy setting, the SNMP agent only accepts requests from management systems within the communities it recognizes, and only SNMP Read operation is allowed for the community.\r\n\r\nIf you disable or do not configure this policy setting, the SNMP service takes the Valid Communities configured on the local computer instead.\r\n\r\nBest practice: For security purposes, it is recommended to restrict the HKLM\\SOFTWARE\\Policies\\SNMP\\Parameters\\ValidCommunities key to allow only the local admin group full control.\r\n\r\nNote: It is good practice to use a cryptic community name.\r\n\r\nNote: This policy setting has no effect if the SNMP agent is not installed on the client computer.\r\n\r\nAlso, see the other two SNMP settings: \"Specify permitted managers\" and \"Specify trap configuration\".\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-snmp#admx-snmp-snmp-communities"],"options":[{"id":"device_vendor_msft_policy_config_admx_snmp_snmp_communities_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_snmp_snmp_communities_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_snmp_snmp_communities_snmp_communitieslistbox","displayName":"Communities (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_snmp_snmp_permittedmanagers","displayName":"Specify permitted managers","description":"This policy setting determines the permitted list of hosts that can submit a query to the Simple Network Management (SNMP) agent running on the client computer.\r\n\r\nSimple Network Management Protocol is a protocol designed to give a user the capability to remotely manage a computer network by polling and setting terminal values and monitoring network events.\r\n\r\nThe manager is located on the host computer on the network. The manager's role is to poll the agents for certain requested information.\r\n\r\nIf you enable this policy setting, the SNMP agent only accepts requests from the list of permitted managers that you configure using this setting.\r\n\r\nIf you disable or do not configure this policy setting, SNMP service takes the permitted managers configured on the local computer instead.\r\n\r\nBest practice: For security purposes, it is recommended to restrict the HKLM\\SOFTWARE\\Policies\\SNMP\\Parameters\\PermittedManagers key to allow only the local admin group full control.\r\n\r\nNote: This policy setting has no effect if the SNMP agent is not installed on the client computer.\r\n\r\nAlso, see the other two SNMP policy settings: \"Specify trap configuration\" and \"Specify Community Name\".\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-snmp#admx-snmp-snmp-permittedmanagers"],"options":[{"id":"device_vendor_msft_policy_config_admx_snmp_snmp_permittedmanagers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_snmp_snmp_permittedmanagers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_snmp_snmp_permittedmanagers_snmp_permittedmanagerslistbox","displayName":"Permitted managers (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_snmp_snmp_traps_public","displayName":"Specify traps for public community","description":"This policy setting allows trap configuration for the Simple Network Management Protocol (SNMP) agent.\r\n\r\nSimple Network Management Protocol is a protocol designed to give a user the capability to remotely manage a computer network by polling and setting terminal values and monitoring network events.\r\n\r\nThis policy setting allows you to configure the name of the hosts that receive trap messages for the community sent by the SNMP service. A trap message is an alert or significant event that allows the SNMP agent to notify management systems asynchronously.\r\n\r\nIf you enable this policy setting, the SNMP service sends trap messages to the hosts within the \"public\" community.\r\n\r\nIf you disable or do not configure this policy setting, the SNMP service takes the trap configuration configured on the local computer instead.\r\n\r\nNote: This setting has no effect if the SNMP agent is not installed on the client computer.\r\n\r\nAlso, see the other two SNMP settings: \"Specify permitted managers\" and \"Specify Community Name\".\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-snmp#admx-snmp-snmp-traps-public"],"options":[{"id":"device_vendor_msft_policy_config_admx_snmp_snmp_traps_public_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_snmp_snmp_traps_public_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_snmp_snmp_traps_public_snmp_traps_publiclistbox","displayName":"Trap configuration (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_soundrec_soundrec_diableapplication_titletext_2","displayName":"Do not allow Sound Recorder to run","description":"Specifies whether Sound Recorder can run.\r\n\r\nSound Recorder is a feature of Microsoft Windows Vista that can be used to record sound from an audio input device where the recorded sound is encoded and saved as an audio file.\r\n\r\nIf you enable this policy setting, Sound Recorder will not run.\r\n\r\nIf you disable or do not configure this policy setting, Sound Recorder can be run.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-soundrec#admx-soundrec-soundrec-diableapplication-titletext-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_soundrec_soundrec_diableapplication_titletext_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_soundrec_soundrec_diableapplication_titletext_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration","displayName":"Customize message for Access Denied errors","description":"This policy setting specifies the message that users see when they are denied access to a file or folder. You can customize the Access Denied message to include additional text and links. You can also provide users with the ability to send an email to request access to the file or folder to which they were denied access.\r\n\r\nIf you enable this policy setting, users receive a customized Access Denied message from the file servers on which this policy setting is applied. \r\n\r\nIf you disable this policy setting, users see a standard Access Denied message that doesn't provide any of the functionality controlled by this policy setting, regardless of the file server configuration.\r\n\r\nIf you do not configure this policy setting, users see a standard Access Denied message unless the file server is configured to display the customized Access Denied message. By default, users see the standard Access Denied message.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-srmfci#admx-srmfci-accessdeniedconfiguration"],"options":[{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_additonalemailtotext","displayName":"Additional recipients: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_allowemailrequestscheck","displayName":"Enable users to request assistance (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_allowemailrequestscheck_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_allowemailrequestscheck_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_emailmessagetext","displayName":"\r\nAdd the following text to the end of the email:\r\n","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_errormessagetext","displayName":"\r\nDisplay the following message to users who are denied access:\r\n","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_generatelogcheck","displayName":"Log emails in Application and Services event log (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_generatelogcheck_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_generatelogcheck_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_includedeviceclaimscheck","displayName":"Include device claims (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_includedeviceclaimscheck_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_includedeviceclaimscheck_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_includeuserclaimscheck","displayName":"Include user claims (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_includeuserclaimscheck_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_includeuserclaimscheck_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_putadminontocheck","displayName":"File server administrator (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_putadminontocheck_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_putadminontocheck_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_putdataownerontocheck","displayName":"Folder owner (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_putdataownerontocheck_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_srmfci_accessdeniedconfiguration_putdataownerontocheck_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_srmfci_centralclassificationlist","displayName":"File Classification Infrastructure: Specify classification properties list","description":"This policy setting controls which set of properties is available for classifying files on affected computers.\r\n\r\nAdministrators can define the properties for the organization by using Active Directory Domain Services (AD DS), and then group these properties into lists. Administrators can supplement these properties on individual file servers by using File Classification Infrastructure, which is part of the File Server Resource Manager role service.\r\n\r\nIf you enable this policy setting, you can select which list of properties is available for classification on the affected computers. \r\n\r\nIf you disable or do not configure this policy setting, the Global Resource Property List in AD DS provides the default set of properties.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-srmfci#admx-srmfci-centralclassificationlist"],"options":[{"id":"device_vendor_msft_policy_config_admx_srmfci_centralclassificationlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_srmfci_centralclassificationlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_srmfci_centralclassificationlist_centralclassificationlisttextelement","displayName":"Classification properties list: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_srmfci_enablemanualux","displayName":"File Classification Infrastructure: Display Classification tab in File Explorer","description":"This policy setting controls whether the Classification tab is displayed in the Properties dialog box in File Explorer.\r\n\r\nThe Classification tab enables users to manually classify files by selecting properties from a list. Administrators can define the properties for the organization by using Group Policy, and supplement these with properties defined on individual file servers by using File Classification Infrastructure, which is part of the File Server Resource Manager role service.\r\n\r\nIf you enable this policy setting, the Classification tab is displayed.\r\n\r\nIf you disable or do not configure this policy setting, the Classification tab is hidden.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-srmfci#admx-srmfci-enablemanualux"],"options":[{"id":"device_vendor_msft_policy_config_admx_srmfci_enablemanualux_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_srmfci_enablemanualux_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_srmfci_enableshellaccesscheck","displayName":"Enable access-denied assistance on client for all file types","description":"This Group Policy Setting should be set on Windows clients to enable access-denied assistance for all file types\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-srmfci#admx-srmfci-enableshellaccesscheck"],"options":[{"id":"device_vendor_msft_policy_config_admx_srmfci_enableshellaccesscheck_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_srmfci_enableshellaccesscheck_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_startmenu_hidepoweroptions","displayName":"Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands","description":"This policy setting prevents users from performing the following commands from the Windows security screen, the logon screen, and the Start menu: Shut Down, Restart, Sleep, and Hibernate. This policy setting does not prevent users from running Windows-based programs that perform these functions.\r\n\r\nIf you enable this policy setting, the shutdown, restart, sleep, and hibernate commands are removed from the Start menu. The Power button is also removed from the Windows Security screen, which appears when you press CTRL+ALT+DELETE, and from the logon screen.\r\n\r\nIf you disable or do not configure this policy setting, the Power button and the Shut Down, Restart, Sleep, and Hibernate commands are available on the Start menu. The Power button on the Windows Security and logon screens is also available.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-startmenu#admx-startmenu-hidepoweroptions"],"options":[{"id":"device_vendor_msft_policy_config_admx_startmenu_hidepoweroptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_startmenu_hidepoweroptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_startmenu_nochangestartmenu","displayName":"Prevent users from customizing their Start Screen","description":"This policy setting allows you to prevent users from changing their Start screen layout.\r\n\r\nIf you enable this setting, you will prevent a user from selecting an app, resizing a tile, pinning/unpinning a tile or a secondary tile, entering the customize mode and rearranging tiles within Start and Apps.\r\n\r\nIf you disable or do not configure this setting, you will allow a user to select an app, resize a tile, pin/unpin a tile or a secondary tile, enter the customize mode and rearrange tiles within Start and Apps.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-startmenu#admx-startmenu-nochangestartmenu"],"options":[{"id":"device_vendor_msft_policy_config_admx_startmenu_nochangestartmenu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_startmenu_nochangestartmenu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_startmenu_nomoreprogramslist","displayName":"Remove All Programs list from the Start menu","description":"If you enable this setting, the Start Menu will either collapse or remove the all apps list from the Start menu.\r\n\r\nSelecting \"Collapse\" will not display the app list next to the pinned tiles in Start. An \"All apps\" button will be displayed on Start to open the all apps list. This is equivalent to setting the \"Show app list in Start\" in Settings to Off.\r\n\r\nSelecting \"Collapse and disable setting\" will do the same as the collapse option and disable the \"Show app list in Start menu\" in Settings, so users cannot turn it to On.\r\n\r\nSelecting \"Remove and disable setting\" will remove the all apps list from Start and disable the \"Show app list in Start menu\" in Settings, so users cannot turn it to On. Select this option for compatibility with earlier versions of Windows.\r\n\r\nIf you disable or do not configure this setting, the all apps list will be visible by default, and the user can change \"Show app list in Start\" in Settings.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-startmenu#admx-startmenu-nomoreprogramslist"],"options":[{"id":"device_vendor_msft_policy_config_admx_startmenu_nomoreprogramslist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_startmenu_nomoreprogramslist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_startmenu_nomoreprogramslist_nomoreprogramslistdropdown","displayName":"Choose one of the following actions (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_startmenu_nomoreprogramslist_nomoreprogramslistdropdown_0","displayName":"None","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_startmenu_nomoreprogramslist_nomoreprogramslistdropdown_3","displayName":"Collapse","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_startmenu_nomoreprogramslist_nomoreprogramslistdropdown_2","displayName":"Collapse and disable setting","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_startmenu_nomoreprogramslist_nomoreprogramslistdropdown_1","displayName":"Remove and disable setting","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_startmenu_norun","displayName":"Remove Run menu from Start Menu","description":"Allows you to remove the Run command from the Start menu, Internet Explorer, and Task Manager.\r\n\r\nIf you enable this setting, the following changes occur:\r\n\r\n(1) The Run command is removed from the Start menu.\r\n\r\n(2) The New Task (Run) command is removed from Task Manager.\r\n\r\n(3) The user will be blocked from entering the following into the Internet Explorer Address Bar:\r\n\r\n--- A UNC path: \\\\\\\r\n\r\n---Accessing local drives: e.g., C:\r\n\r\n--- Accessing local folders: e.g., \\temp>\r\n\r\nAlso, users with extended keyboards will no longer be able to display the Run dialog box by pressing the Application key (the key with the Windows logo) + R.\r\n\r\nIf you disable or do not configure this setting, users will be able to access the Run command in the Start menu and in Task Manager and use the Internet Explorer Address Bar.\r\n\r\n\r\n\r\nNote:This setting affects the specified interface only. It does not prevent users from using other methods to run programs.\r\n\r\nNote: It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-startmenu#admx-startmenu-norun"],"options":[{"id":"device_vendor_msft_policy_config_admx_startmenu_norun_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_startmenu_norun_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_startmenu_nosettaskbar","displayName":"Prevent changes to Taskbar and Start Menu Settings","description":"This policy setting allows you to prevent changes to Taskbar and Start Menu Settings.\r\n\r\nIf you enable this policy setting, The user will be prevented from opening the Taskbar Properties dialog box.\r\n\r\nIf the user right-clicks the taskbar and then clicks Properties, a message appears explaining that a setting prevents the action.\r\n\r\nIf you disable or do not configure this policy setting, the Taskbar and Start Menu items are available from Settings on the Start menu.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-startmenu#admx-startmenu-nosettaskbar"],"options":[{"id":"device_vendor_msft_policy_config_admx_startmenu_nosettaskbar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_startmenu_nosettaskbar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_startmenu_notraycontextmenu","displayName":"Remove access to the context menus for the taskbar","description":"This policy setting allows you to remove access to the context menus for the taskbar.\r\n\r\nIf you enable this policy setting, the menus that appear when you right-click the taskbar and items on the taskbar are hidden, such as the Start button, the clock, and the taskbar buttons.\r\n\r\nIf you disable or do not configure this policy setting, the context menus for the taskbar are available.\r\n\r\nThis policy setting does not prevent users from using other methods to issue the commands that appear on these menus.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-startmenu#admx-startmenu-notraycontextmenu"],"options":[{"id":"device_vendor_msft_policy_config_admx_startmenu_notraycontextmenu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_startmenu_notraycontextmenu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_startmenu_nouninstallfromstart","displayName":"Prevent users from uninstalling applications from Start","description":"If you enable this setting, users cannot uninstall apps from Start.\r\n\r\nIf you disable this setting or do not configure it, users can access the uninstall command from Start","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-startmenu#admx-startmenu-nouninstallfromstart"],"options":[{"id":"device_vendor_msft_policy_config_admx_startmenu_nouninstallfromstart_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_startmenu_nouninstallfromstart_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_startmenu_startpinappswheninstalled","displayName":"Pin Apps to Start when installed","description":"This policy setting allows pinning apps to Start by default, when they are included by AppID on the list.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-startmenu#admx-startmenu-startpinappswheninstalled"],"options":[{"id":"device_vendor_msft_policy_config_admx_startmenu_startpinappswheninstalled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_startmenu_startpinappswheninstalled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_startmenu_startpinappswheninstalled_startpinappswheninstalled_name","displayName":"Add AppIDs to the list: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_systemrestore_sr_disableconfig","displayName":"Turn off Configuration","description":"Allows you to disable System Restore configuration through System Protection.\r\n\r\nThis policy setting allows you to turn off System Restore configuration through System Protection.\r\n\r\nSystem Restore enables users, in the event of a problem, to restore their computers to a previous state without losing personal data files. The behavior of this policy setting depends on the \"Turn off System Restore\" policy setting.\r\n\r\nIf you enable this policy setting, the option to configure System Restore through System Protection is disabled.\r\n\r\nIf you disable or do not configure this policy setting, users can change the System Restore settings through System Protection. \r\n\r\nAlso, see the \"Turn off System Restore\" policy setting. If the \"Turn off System Restore\" policy setting is enabled, the \"Turn off System Restore configuration\" policy setting is overwritten.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-systemrestore#admx-systemrestore-sr-disableconfig"],"options":[{"id":"device_vendor_msft_policy_config_admx_systemrestore_sr_disableconfig_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_systemrestore_sr_disableconfig_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_autocomplete_2","displayName":"Turn off AutoComplete integration with Input Panel","description":"Turns off the integration of application auto complete lists with Tablet PC Input Panel in applications where this behavior is available.\r\n\r\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\r\n\r\nIf you enable this policy, application auto complete lists will never appear next to Input Panel. Users will not be able to configure this setting in the Input Panel Options dialog box.\r\n\r\nIf you disable this policy, application auto complete lists will appear next to Input Panel in applications where the functionality is available. Users will not be able to configure this setting in the Input Panel Options dialog box.\r\n\r\nIf you do not configure this policy, application auto complete lists will appear next to Input Panel in applications where the functionality is available. Users will be able to configure this setting on the Text completion tab in Input Panel Options.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel#admx-tabletpcinputpanel-autocomplete-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_autocomplete_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_autocomplete_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_edgetarget_2","displayName":"Prevent Input Panel tab from appearing","description":"Prevents Input Panel tab from appearing on the edge of the Tablet PC screen.\r\n\r\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\r\n\r\nIf you enable this policy, Input Panel tab will not appear on the edge of the Tablet PC screen. Users will not be able to configure this setting in the Input Panel Options dialog box.\r\n\r\nIf you disable this policy, Input Panel tab will appear on the edge of the Tablet PC screen. Users will not be able to configure this setting in the Input Panel Options dialog box.\r\n\r\nIf you do not configure this policy, Input Panel tab will appear on the edge of the Tablet PC screen. Users will be able to configure this setting on the Opening tab in Input Panel Options.\r\n\r\nCaution: If you enable both the “Prevent Input Panel from appearing next to text entry areas” policy and the “Prevent Input Panel tab from appearing” policy, and disable the “Show Input Panel taskbar icon” policy, the user will then have no way to access Input Panel.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel#admx-tabletpcinputpanel-edgetarget-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_edgetarget_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_edgetarget_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_iptiptarget_2","displayName":"For tablet pen input, don’t show the Input Panel icon","description":"Prevents the Tablet PC Input Panel icon from appearing next to any text entry area in applications where this behavior is available. This policy applies only when using a tablet pen as an input device.\r\n\r\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\r\n\r\nIf you enable this policy, Input Panel will never appear next to text entry areas when using a tablet pen as an input device. Users will not be able to configure this setting in the Input Panel Options dialog box.\r\n\r\nIf you disable this policy, Input Panel will appear next to any text entry area in applications where this behavior is available. Users will not be able to configure this setting in the Input Panel Options dialog box.\r\n\r\nIf you do not configure this policy, Input Panel will appear next to text entry areas in applications where this behavior is available. Users will be able to configure this setting on the Opening tab in Input Panel Options.\r\n\r\nCaution: If you enable both the “Prevent Input Panel from appearing next to text entry areas” policy and the “Prevent Input Panel tab from appearing” policy, and disable the “Show Input Panel taskbar icon” policy, the user will then have no way to access Input Panel.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel#admx-tabletpcinputpanel-iptiptarget-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_iptiptarget_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_iptiptarget_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_iptiptouchtarget_2","displayName":"For touch input, don’t show the Input Panel icon","description":"Prevents the Tablet PC Input Panel icon from appearing next to any text entry area in applications where this behavior is available. This policy applies only when a user is using touch input.\r\n\r\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\r\n\r\nIf you enable this policy, Input Panel will never appear next to any text entry area when a user is using touch input. Users will not be able to configure this setting in the Input Panel Options dialog box.\r\n\r\nIf you disable this policy, Input Panel will appear next to text entry areas in applications where this behavior is available. Users will not be able to configure this setting in the Input Panel Options dialog box.\r\n\r\nIf you do not configure this policy, Input Panel will appear next to text entry areas in applications where this behavior is available. Users will be able to configure this setting on the Opening tab in Input Panel Options.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel#admx-tabletpcinputpanel-iptiptouchtarget-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_iptiptouchtarget_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_iptiptouchtarget_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_passwordsecurity_2","displayName":"Turn off password security in Input Panel","description":"Adjusts password security settings in Touch Keyboard and Handwriting panel (a.k.a. Tablet PC Input Panel in Windows 7 and Windows Vista). These settings include using the on-screen keyboard by default, preventing users from switching to another Input Panel skin (the writing pad or character pad), and not showing what keys are tapped when entering a password.\r\n\r\nTouch Keyboard and Handwriting panel enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\r\n\r\nIf you enable this policy and choose “Low” from the drop-down box, password security is set to “Low.” At this setting, all password security settings are turned off. Users will not be able to configure this setting in the Input Panel Options dialog box. \r\n\r\nIf you enable this policy and choose “Medium-Low” from the drop-down box, password security is set to “Medium-Low.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel displays the cursor and which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. \r\n\r\nIf you enable this policy and choose “Medium” from the drop-down box, password security is set to “Medium.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is not allowed, and Input Panel displays the cursor and which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. \r\n\r\nIf you enable this policy and choose to “Medium-High” from the drop-down box, password security is set to “Medium-High.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel does not display the cursor or which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box.\r\n\r\nIf you enable this policy and choose “High” from the drop-down box, password security is set to “High.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is not allowed, and Input Panel does not display the cursor or which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. \r\n\r\nIf you disable this policy, password security is set to “Medium-High.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel does not display the cursor or which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box.\r\n \r\nIf you do not configure this policy, password security is set to “Medium-High” by default. At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel does not display the cursor or which keys are tapped. Users will be able to configure this setting on the Advanced tab in Input Panel Options in Windows 7 and Windows Vista.\r\n\r\nCaution: If you lower password security settings, people who can see the user’s screen might be able to see their passwords.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel#admx-tabletpcinputpanel-passwordsecurity-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_passwordsecurity_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_passwordsecurity_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_passwordsecurity_2_passwordsecurity","displayName":"Turn off password security in Input Panel (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_passwordsecurity_2_passwordsecurity_1","displayName":"Low","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_passwordsecurity_2_passwordsecurity_2","displayName":"Medium Low","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_passwordsecurity_2_passwordsecurity_3","displayName":"Medium","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_passwordsecurity_2_passwordsecurity_4","displayName":"Medium High","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_passwordsecurity_2_passwordsecurity_5","displayName":"High","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_prediction_2","displayName":"Disable text prediction","description":"Prevents the Touch Keyboard and Handwriting panel (a.k.a. Tablet PC Input Panel in Windows 7 and Windows Vista) from providing text prediction suggestions. This policy applies for both the on-screen keyboard and the handwriting tab when the feature is available for the current input area and input language.\r\n\r\nTouch Keyboard and Handwriting panel enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\r\n\r\nIf you enable this policy, Input Panel will not provide text prediction suggestions. Users will not be able to configure this setting in the Input Panel Options dialog box.\r\n\r\nIf you disable this policy, Input Panel will provide text prediction suggestions. Users will not be able to configure this setting in the Input Panel Options dialog box.\r\n\r\nIf you do not configure this policy, Input Panel will provide text prediction suggestions. Users will be able to configure this setting on the Text Completion tab in Input Panel Options in Windows 7 and Windows Vista.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel#admx-tabletpcinputpanel-prediction-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_prediction_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_prediction_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_rarechar_2","displayName":"Include rarely used Chinese, Kanji, or Hanja characters","description":"Includes rarely used Chinese, Kanji, and Hanja characters when handwriting is converted to typed text. This policy applies only to the use of the Microsoft recognizers for Chinese (Simplified), Chinese (Traditional), Japanese, and Korean. This setting appears in Input Panel Options (in Windows 7 and Windows Vista only) only when these input languages or keyboards are installed. \r\n\r\nTouch Keyboard and Handwriting panel (a.k.a. Tablet PC Input Panel in Windows 7 and Windows Vista) enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\r\n\r\nIf you enable this policy, rarely used Chinese, Kanji, and Hanja characters will be included in recognition results when handwriting is converted to typed text. Users will not be able to configure this setting in the Input Panel Options dialog box.\r\n\r\nIf you disable this policy, rarely used Chinese, Kanji, and Hanja characters will not be included in recognition results when handwriting is converted to typed text. Users will not be able to configure this setting in the Input Panel Options dialog box.\r\n\r\nIf you do not configure this policy, rarely used Chinese, Kanji, and Hanja characters will not be included in recognition results when handwriting is converted to typed text. Users will be able to configure this setting on the Ink to text conversion tab in Input Panel Options (in Windows 7 and Windows Vista).\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel#admx-tabletpcinputpanel-rarechar-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_rarechar_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_rarechar_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_scratchout_2","displayName":"Turn off tolerant and Z-shaped scratch-out gestures","description":"\r\n Turns off both the more tolerant scratch-out gestures that were added in Windows Vista and the Z-shaped scratch-out gesture that was available in Microsoft Windows XP Tablet PC Edition.\r\n\r\n The tolerant gestures let users scratch out ink in Input Panel by using strikethrough and other scratch-out gesture shapes.\r\n\r\n Tablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\r\n\r\n If you enable this policy and choose “All” from the drop-down menu, no scratch-out gestures will be available in Input Panel. Users will not be able to configure this setting in the Input Panel Options dialog box.\r\n\r\n If you enable this policy and choose “Tolerant,\" users will be able to use the Z-shaped scratch-out gesture that was available in Microsoft Windows XP Tablet PC Edition. Users will not be able to configure this setting in the Input Panel Options dialog box.\r\n\r\n If you enable this policy and choose “None,” users will be able to use both the tolerant scratch-out gestures and the Z-shaped scratch-out gesture. Users will not be able to configure this setting in the Input Panel Options dialog box.\r\n\r\n If you disable this policy, users will be able to use both the tolerant scratch-out gestures and the Z-shaped scratch-out gesture. Users will not be able to configure this setting in the Input Panel Options dialog box.\r\n\r\n If you do not configure this policy, users will be able to use both the tolerant scratch-out gestures and the Z-shaped scratch-out gesture. Users will be able to configure this setting on the Gestures tab in Input Panel Options.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel#admx-tabletpcinputpanel-scratchout-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_scratchout_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_scratchout_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_scratchout_2_scratchout","displayName":"Turn off tolerant and Z-shaped scratch-out gestures (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_scratchout_2_scratchout_1","displayName":"All","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_scratchout_2_scratchout_2","displayName":"Tolerant","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletpcinputpanel_scratchout_2_scratchout_3","displayName":"None","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletshell_disableinkball_2","displayName":"Do not allow Inkball to run","description":"Prevents start of InkBall game.\r\n\r\nIf you enable this policy, the InkBall game will not run.\r\n\r\nIf you disable this policy, the InkBall game will run.\r\n\r\nIf you do not configure this policy, the InkBall game will run.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletshell#admx-tabletshell-disableinkball-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletshell_disableinkball_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletshell_disableinkball_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletshell_disablejournal_2","displayName":"Do not allow Windows Journal to be run","description":"Prevents start of Windows Journal.\r\n\r\nIf you enable this policy, the Windows Journal accessory will not run.\r\n\r\nIf you disable this policy, the Windows Journal accessory will run.\r\n\r\nIf you do not configure this policy, the Windows Journal accessory will run.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletshell#admx-tabletshell-disablejournal-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletshell_disablejournal_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletshell_disablejournal_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletshell_disablenotewriterprinting_2","displayName":"Do not allow printing to Journal Note Writer","description":"Prevents printing to Journal Note Writer.\r\n\r\nIf you enable this policy, the Journal Note Writer printer driver will not allow printing to it. It will remain displayed in the list of available printers, but attempts to print to it will fail.\r\n\r\nIf you disable this policy, you will be able to use this feature to print to a Journal Note.\r\n\r\nIf you do not configure this policy, users will be able to use this feature to print to a Journal Note.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletshell#admx-tabletshell-disablenotewriterprinting-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletshell_disablenotewriterprinting_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletshell_disablenotewriterprinting_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletshell_disablesnippingtool_2","displayName":"Do not allow Snipping Tool to run","description":"Prevents the snipping tool from running.\r\n\r\nIf you enable this policy setting, the Snipping Tool will not run.\r\n\r\nIf you disable this policy setting, the Snipping Tool will run.\r\n\r\nIf you do not configure this policy setting, the Snipping Tool will run.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletshell#admx-tabletshell-disablesnippingtool-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletshell_disablesnippingtool_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletshell_disablesnippingtool_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletshell_preventbackescmapping_2","displayName":"Prevent Back-ESC mapping","description":"Removes the Back->ESC mapping that normally occurs when menus are visible, and for applications that subscribe to this behavior.\r\n\r\nIf you enable this policy, a button assigned to Back will not map to ESC.\r\n\r\nIf you disable this policy, Back->ESC mapping will occur.\r\n\r\nIf you do not configure this policy, Back->ESC mapping will occur.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletshell#admx-tabletshell-preventbackescmapping-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletshell_preventbackescmapping_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletshell_preventbackescmapping_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletshell_preventflicks_2","displayName":"Prevent flicks","description":"Makes pen flicks and all related features unavailable.\r\n\r\nIf you enable this policy, pen flicks and all related features are unavailable. This includes: pen flicks themselves, pen flicks training, pen flicks training triggers in Internet Explorer, the pen flicks notification and the pen flicks tray icon.\r\n\r\nIf you disable or do not configure this policy, pen flicks and related features are available.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletshell#admx-tabletshell-preventflicks-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletshell_preventflicks_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletshell_preventflicks_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletshell_preventflickslearningmode_2","displayName":"Prevent Flicks Learning Mode","description":"Makes pen flicks learning mode unavailable.\r\n\r\nIf you enable this policy, pen flicks are still available but learning mode is not. Pen flicks are off by default and can be turned on system-wide, but cannot be restricted to learning mode applications. This means that the pen flicks training triggers in Internet Explorer are disabled and that the pen flicks notification will never be displayed. However, pen flicks, the pen flicks tray icon and pen flicks training (that can be accessed through CPL) are still available. Conceptually this policy is a subset of the Disable pen flicks policy.\r\n\r\nIf you disable or do not configure this policy, all the features described above will be available.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletshell#admx-tabletshell-preventflickslearningmode-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletshell_preventflickslearningmode_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletshell_preventflickslearningmode_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletshell_preventlaunchapp_2","displayName":"Prevent launch an application","description":"Prevents the user from launching an application from a Tablet PC hardware button.\r\n\r\nIf you enable this policy, applications cannot be launched from a hardware button, and \"Launch an application\" is removed from the drop down menu for configuring button actions (in the Tablet PC Control Panel buttons tab).\r\n\r\nIf you disable this policy, applications can be launched from a hardware button.\r\n\r\nIf you do not configure this policy, applications can be launched from a hardware button.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletshell#admx-tabletshell-preventlaunchapp-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletshell_preventlaunchapp_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletshell_preventlaunchapp_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletshell_preventpressandhold_2","displayName":"Prevent press and hold","description":"Prevents press and hold actions on hardware buttons, so that only one action is available per button.\r\n\r\nIf you enable this policy, press and hold actions are unavailable, and the button configuration dialog will display the following text: \"Some settings are controlled by Group Policy. If a setting is unavailable, contact your system administrator.\"\r\n\r\nIf you disable this policy, press and hold actions for buttons will be available.\r\n\r\nIf you do not configure this policy, press and hold actions will be available.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletshell#admx-tabletshell-preventpressandhold-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletshell_preventpressandhold_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletshell_preventpressandhold_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletshell_turnoffbuttons_2","displayName":"Turn off hardware buttons","description":"Turns off Tablet PC hardware buttons.\r\n\r\nIf you enable this policy, no actions will occur when the buttons are pressed, and the buttons tab in Tablet PC Control Panel will be removed.\r\n\r\nIf you disable this policy, user and OEM defined button actions will occur when the buttons are pressed.\r\n\r\nIf you do not configure this policy, user and OEM defined button actions will occur when the buttons are pressed.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletshell#admx-tabletshell-turnoffbuttons-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletshell_turnoffbuttons_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletshell_turnoffbuttons_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tabletshell_turnofffeedback_2","displayName":"Turn off pen feedback","description":"Disables visual pen action feedback, except for press and hold feedback.\r\n\r\nIf you enable this policy, all visual pen action feedback is disabled except for press and hold feedback. Additionally, the mouse cursors are shown instead of the pen cursors.\r\n\r\nIf you disable or do not configure this policy, visual feedback and pen cursors will be shown unless the user disables them in Control Panel.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tabletshell#admx-tabletshell-turnofffeedback-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_tabletshell_turnofffeedback_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tabletshell_turnofffeedback_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_taskbar_disablenotificationcenter","displayName":"Remove Notifications and Action Center","description":"This policy setting removes Notifications and Action Center from the notification area on the taskbar.\r\n\r\nThe notification area is located at the far right end of the taskbar and includes icons for current notifications and the system clock.\r\n\r\nIf this setting is enabled, Notifications and Action Center is not displayed in the notification area. The user will be able to read notifications when they appear, but they won’t be able to review any notifications they miss.\r\n\r\nIf you disable or do not configure this policy setting, Notification and Security and Maintenance will be displayed on the taskbar.\r\n\r\nA reboot is required for this policy setting to take effect.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-taskbar#admx-taskbar-disablenotificationcenter"],"options":[{"id":"device_vendor_msft_policy_config_admx_taskbar_disablenotificationcenter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_taskbar_disablenotificationcenter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_taskbar_taskbarnopinnedlist","displayName":"Remove pinned programs from the Taskbar","description":"This policy setting allows you to remove pinned programs from the taskbar.\r\n\r\nIf you enable this policy setting, pinned programs are prevented from being shown on the Taskbar. Users cannot pin programs to the Taskbar.\r\n\r\nIf you disable or do not configure this policy setting, users can pin programs so that the program shortcuts stay on the Taskbar.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-taskbar#admx-taskbar-taskbarnopinnedlist"],"options":[{"id":"device_vendor_msft_policy_config_admx_taskbar_taskbarnopinnedlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_taskbar_taskbarnopinnedlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tcpip_6to4_router_name","displayName":"Set 6to4 Relay Name","description":"This policy setting allows you to specify a 6to4 relay name for a 6to4 host. A 6to4 relay is used as a default gateway for IPv6 network traffic sent by the 6to4 host. The 6to4 relay name setting has no effect if 6to4 connectivity is not available on the host.\r\n\r\nIf you enable this policy setting, you can specify a relay name for a 6to4 host.\r\n\r\nIf you disable or do not configure this policy setting, the local host setting is used, and you cannot specify a relay name for a 6to4 host.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tcpip#admx-tcpip-6to4-router-name"],"options":[{"id":"device_vendor_msft_policy_config_admx_tcpip_6to4_router_name_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_6to4_router_name_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tcpip_6to4_router_name_resolution_interval","displayName":"Set 6to4 Relay Name Resolution Interval","description":"This policy setting allows you to specify the interval at which the relay name is resolved. The 6to4 relay name resolution interval setting has no effect if 6to4 connectivity is not available on the host.\r\n\r\nIf you enable this policy setting, you can specify the value for the duration at which the relay name is resolved periodically.\r\n\r\nIf you disable or do not configure this policy setting, the local host setting is used.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tcpip#admx-tcpip-6to4-router-name-resolution-interval"],"options":[{"id":"device_vendor_msft_policy_config_admx_tcpip_6to4_router_name_resolution_interval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_6to4_router_name_resolution_interval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tcpip_6to4_router_name_resolution_interval_routernameresolutionintervalbox","displayName":"Minutes: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_6to4_router_name_routernamebox","displayName":"Enter a router or relay name: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_6to4_state","displayName":"Set 6to4 State","description":"This policy setting allows you to configure 6to4, an address assignment and router-to-router automatic tunneling technology that is used to provide unicast IPv6 connectivity between IPv6 sites and hosts across the IPv4 Internet. 6to4 uses the global address prefix: 2002:WWXX:YYZZ::/48 in which the letters are a hexadecimal representation of the global IPv4 address (w.x.y.z) assigned to a site.\r\n\r\nIf you disable or do not configure this policy setting, the local host setting is used.\r\n\r\nIf you enable this policy setting, you can configure 6to4 with one of the following settings:\r\n\r\nPolicy Default State: 6to4 is enabled if the host has only link-local IPv6 connectivity and a public IPv4 address. If no global IPv6 address is present and no global IPv4 address is present, the host will not have a 6to4 interface. If no global IPv6 address is present and a global IPv4 address is present, the host will have a 6to4 interface.\r\n\r\nPolicy Enabled State: If a global IPv4 address is present, the host will have a 6to4 interface. If no global IPv4 address is present, the host will not have a 6to4 interface.\r\n\r\nPolicy Disabled State: 6to4 is turned off and connectivity with 6to4 will not be available.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tcpip#admx-tcpip-6to4-state"],"options":[{"id":"device_vendor_msft_policy_config_admx_tcpip_6to4_state_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_6to4_state_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tcpip_6to4_state_stateselect","displayName":"Select from the following states: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_tcpip_6to4_state_stateselect_default","displayName":"Default State","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_6to4_state_stateselect_enabled","displayName":"Enabled State","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_6to4_state_stateselect_disabled","displayName":"Disabled State","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tcpip_ip_stateless_autoconfiguration_limits_state","displayName":"Set IP Stateless Autoconfiguration Limits State","description":"This policy setting allows you to configure IP Stateless Autoconfiguration Limits.\r\n\r\nIf you enable or do not configure this policy setting, IP Stateless Autoconfiguration Limits will be enabled and system will limit the number of autoconfigured addresses and routes.\r\n\r\nIf you disable this policy setting, IP Stateless Autoconfiguration Limits will be disabled and system will not limit the number of autoconfigured addresses and routes.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tcpip#admx-tcpip-ip-stateless-autoconfiguration-limits-state"],"options":[{"id":"device_vendor_msft_policy_config_admx_tcpip_ip_stateless_autoconfiguration_limits_state_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_ip_stateless_autoconfiguration_limits_state_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tcpip_iphttps_clientstate","displayName":"Set IP-HTTPS State","description":"This policy setting allows you to configure IP-HTTPS, a tunneling technology that uses the HTTPS protocol to provide IP connectivity to a remote network.\r\n\r\nIf you disable or do not configure this policy setting, the local host settings are used.\r\n\r\nIf you enable this policy setting, you can specify an IP-HTTPS server URL. You will be able to configure IP-HTTPS with one of the following settings:\r\n\r\nPolicy Default State: The IP-HTTPS interface is used when there are no other connectivity options.\r\n\r\nPolicy Enabled State: The IP-HTTPS interface is always present, even if the host has other connectivity options.\r\n\r\nPolicy Disabled State: No IP-HTTPS interfaces are present on the host.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tcpip#admx-tcpip-iphttps-clientstate"],"options":[{"id":"device_vendor_msft_policy_config_admx_tcpip_iphttps_clientstate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_iphttps_clientstate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tcpip_iphttps_clientstate_iphttpsclienturlbox","displayName":"Enter the IPHTTPS Url: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_iphttps_clientstate_stateselect","displayName":"Select Interface state from the following options: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_tcpip_iphttps_clientstate_stateselect_0","displayName":"Default State","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_iphttps_clientstate_stateselect_2","displayName":"Enabled State","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_iphttps_clientstate_stateselect_3","displayName":"Disabled State","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tcpip_isatap_router_name","displayName":"Set ISATAP Router Name","description":"This policy setting allows you to specify a router name or Internet Protocol version 4 (IPv4) address for an ISATAP router.\r\n\r\nIf you enable this policy setting, you can specify a router name or IPv4 address for an ISATAP router. If you enter an IPv4 address of the ISATAP router in the text box, DNS services are not required.\r\n\r\nIf you disable or do not configure this policy setting, the local host setting is used.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tcpip#admx-tcpip-isatap-router-name"],"options":[{"id":"device_vendor_msft_policy_config_admx_tcpip_isatap_router_name_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_isatap_router_name_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tcpip_isatap_router_name_routernamebox","displayName":"Enter a router or relay name: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_isatap_state","displayName":"Set ISATAP State","description":"This policy setting allows you to configure Intra-Site Automatic Tunnel Addressing Protocol (ISATAP), an address-to-router and host-to-host, host-to-router and router-to-host automatic tunneling technology that is used to provide unicast IPv6 connectivity between IPv6 hosts across an IPv4 intranet.\r\n\r\nIf you disable or do not configure this policy setting, the local host setting is used.\r\n\r\nIf you enable this policy setting, you can configure ISATAP with one of the following settings:\r\n\r\nPolicy Default State: If the ISATAP router name is resolved successfully, the host will have ISATAP configured with a link-local address and an address for each prefix received from the ISATAP router through stateless address auto-configuration. If the ISATAP router name is not resolved successfully, ISATAP connectivity is not available on the host using the corresponding IPv4 address.\r\n\r\nPolicy Enabled State: If the ISATAP name is resolved successfully, the host will have ISATAP configured with a link-local address and an address for each prefix received from the ISATAP router through stateless address auto-configuration. If the ISATAP name is not resolved successfully, the host will have an ISATAP interface configured with a link-local address.\r\n\r\nPolicy Disabled State: No ISATAP interfaces are present on the host.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tcpip#admx-tcpip-isatap-state"],"options":[{"id":"device_vendor_msft_policy_config_admx_tcpip_isatap_state_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_isatap_state_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tcpip_isatap_state_stateselect","displayName":"Select from the following states: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_tcpip_isatap_state_stateselect_default","displayName":"Default State","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_isatap_state_stateselect_enabled","displayName":"Enabled State","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_isatap_state_stateselect_disabled","displayName":"Disabled State","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_client_port","displayName":"Set Teredo Client Port","description":"This policy setting allows you to select the UDP port the Teredo client will use to send packets. If you leave the default of 0, the operating system will select a port (recommended). If you select a UDP port that is already in use by a system, the Teredo client will fail to initialize.\r\n\r\nIf you enable this policy setting, you can customize a UDP port for the Teredo client.\r\n\r\nIf you disable or do not configure this policy setting, the local host setting is used.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tcpip#admx-tcpip-teredo-client-port"],"options":[{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_client_port_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_client_port_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_client_port_teredoclientportbox","displayName":"\r\nThe setting allows you to customize the Teredo client port\r\nThe range is 0 to 65535. Default (recommended) is 0 which is to let the local system pick the port.\r\n","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_default_qualified","displayName":"Set Teredo Default Qualified","description":"This policy setting allows you to set Teredo to be ready to communicate, a process referred to as qualification. By default, Teredo enters a dormant state when not in use. The qualification process brings it out of a dormant state.\r\n\r\nIf you disable or do not configure this policy setting, the local host setting is used.\r\n\r\nThis policy setting contains only one state:\r\n\r\nPolicy Enabled State: If Default Qualified is enabled, Teredo will attempt qualification immediately and remain qualified if the qualification process succeeds.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tcpip#admx-tcpip-teredo-default-qualified"],"options":[{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_default_qualified_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_default_qualified_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_default_qualified_stateselect","displayName":"Select from the following states: (Device)","description":null,"helpText":"","infoUrls":[],"options":{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_default_qualified_stateselect_enabled","displayName":"Enabled State","description":null,"helpText":null}},{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_refresh_rate","displayName":"Set Teredo Refresh Rate","description":"This policy setting allows you to configure the Teredo refresh rate.\r\n\r\nNote: On a periodic basis (by default, every 30 seconds), Teredo clients send a single Router Solicitation packet to the Teredo server. The Teredo server sends a Router Advertisement Packet in response. This periodic packet refreshes the IP address and UDP port mapping in the translation table of the Teredo client's NAT device.\r\n\r\nIf you enable this policy setting, you can specify the refresh rate. If you choose a refresh rate longer than the port mapping in the Teredo client's NAT device, Teredo might stop working or connectivity might be intermittent.\r\n\r\nIf you disable or do not configure this policy setting, the refresh rate is configured using the local settings on the computer. The default refresh rate is 30 seconds.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tcpip#admx-tcpip-teredo-refresh-rate"],"options":[{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_refresh_rate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_refresh_rate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_refresh_rate_teredorefreshratebox","displayName":"Seconds: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_server_name","displayName":"Set Teredo Server Name","description":"This policy setting allows you to specify the name of the Teredo server. This server name will be used on the Teredo client computer where this policy setting is applied.\r\n\r\nIf you enable this policy setting, you can specify a Teredo server name that applies to a Teredo client.\r\n\r\nIf you disable or do not configure this policy setting, the local settings on the computer are used to determine the Teredo server name.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tcpip#admx-tcpip-teredo-server-name"],"options":[{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_server_name_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_server_name_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_server_name_teredoservernamebox","displayName":"Enter a Teredo server name: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_state","displayName":"Set Teredo State","description":"This policy setting allows you to configure Teredo, an address assignment and automatic tunneling technology that provides unicast IPv6 connectivity across the IPv4 Internet.\r\n\r\nIf you disable or do not configure this policy setting, the local host settings are used.\r\n\r\nIf you enable this policy setting, you can configure Teredo with one of the following settings:\r\n\r\nDefault: The default state is \"Client.\"\r\n\r\nDisabled: No Teredo interfaces are present on the host.\r\n\r\nClient: The Teredo interface is present only when the host is not on a network that includes a domain controller.\r\n\r\nEnterprise Client: The Teredo interface is always present, even if the host is on a network that includes a domain controller.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tcpip#admx-tcpip-teredo-state"],"options":[{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_state_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_state_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_state_stateselect","displayName":"Select from the following states: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_state_stateselect_default","displayName":"Default State","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_state_stateselect_disabled","displayName":"Disabled State","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_state_stateselect_client","displayName":"Client","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_teredo_state_stateselect_enterprise client","displayName":"Enterprise Client","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tcpip_windows_scaling_heuristics_state","displayName":"Set Window Scaling Heuristics State","description":"This policy setting allows you to configure Window Scaling Heuristics. Window Scaling Heuristics is an algorithm to identify connectivity and throughput problems caused by many Firewalls and other middle boxes that don't interpret Window Scaling option correctly.\r\n\r\nIf you do not configure this policy setting, the local host settings are used.\r\n\r\nIf you enable this policy setting, Window Scaling Heuristics will be enabled and system will try to identify connectivity and throughput problems and take appropriate measures.\r\n\r\nIf you disable this policy setting, Window Scaling Heuristics will be disabled and system will not try to identify connectivity and throughput problems casued by Firewalls or other middle boxes.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tcpip#admx-tcpip-windows-scaling-heuristics-state"],"options":[{"id":"device_vendor_msft_policy_config_admx_tcpip_windows_scaling_heuristics_state_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tcpip_windows_scaling_heuristics_state_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_auto_reconnect","displayName":"Automatic reconnection","description":"Specifies whether to allow Remote Desktop Connection clients to automatically reconnect to sessions on an RD Session Host server if their network link is temporarily lost. By default, a maximum of twenty reconnection attempts are made at five second intervals.\r\n\r\nIf the status is set to Enabled, automatic reconnection is attempted for all clients running Remote Desktop Connection whenever their network connection is lost.\r\n\r\nIf the status is set to Disabled, automatic reconnection of clients is prohibited.\r\n\r\nIf the status is set to Not Configured, automatic reconnection is not specified at the Group Policy level. However, users can configure automatic reconnection using the \"Reconnect if connection is dropped\" checkbox on the Experience tab in Remote Desktop Connection.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-auto-reconnect"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_auto_reconnect_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_auto_reconnect_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_camera_redirection","displayName":"Do not allow video capture redirection","description":"This policy setting lets you control the redirection of video capture devices to the remote computer in a Remote Desktop Services session. \r\n\r\nBy default, Remote Desktop Services allows redirection of video capture devices.\r\n\r\nIf you enable this policy setting, users cannot redirect their video capture devices to the remote computer. \r\n\r\nIf you disable or do not configure this policy setting, users can redirect their video capture devices to the remote computer. Users can use the More option on the Local Resources tab of Remote Desktop Connection to choose the video capture devices to redirect to the remote computer.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-camera-redirection"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_camera_redirection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_camera_redirection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_certificate_template_policy","displayName":"Server authentication certificate template","description":"This policy setting allows you to specify the name of the certificate template that determines which certificate is automatically selected to authenticate an RD Session Host server.\r\n\r\nA certificate is needed to authenticate an RD Session Host server when TLS 1.0, 1.1 or 1.2 is used to secure communication between a client and an RD Session Host server during RDP connections.\r\n\r\nIf you enable this policy setting, you need to specify a certificate template name. Only certificates created by using the specified certificate template will be considered when a certificate to authenticate the RD Session Host server is automatically selected. Automatic certificate selection only occurs when a specific certificate has not been selected.\r\n\r\nIf no certificate can be found that was created with the specified certificate template, the RD Session Host server will issue a certificate enrollment request and will use the current certificate until the request is completed. If more than one certificate is found that was created with the specified certificate template, the certificate that will expire latest and that matches the current name of the RD Session Host server will be selected.\r\n\r\nIf you disable or do not configure this policy, the certificate template name is not specified at the Group Policy level. By default, a self-signed certificate is used to authenticate the RD Session Host server. \r\n\r\nNote: If you select a specific certificate to be used to authenticate the RD Session Host server, that certificate will take precedence over this policy setting.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-certificate-template-policy"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_certificate_template_policy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_certificate_template_policy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_certificate_template_policy_ts_certificate_template_name","displayName":"Certificate Template Name (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_allow_signed_files_2","displayName":"Allow .rdp files from valid publishers and user's default .rdp settings","description":"This policy setting allows you to specify whether users can run Remote Desktop Protocol (.rdp) files from a publisher that signed the file with a valid certificate. A valid certificate is one that is issued by an authority recognized by the client, such as the issuers in the client's Third-Party Root Certification Authorities certificate store. This policy setting also controls whether the user can start an RDP session by using default .rdp settings (for example, when a user directly opens the Remote Desktop Connection [RDC] client without specifying an .rdp file).\r\n\r\nIf you enable or do not configure this policy setting, users can run .rdp files that are signed with a valid certificate. Users can also start an RDP session with default .rdp settings by directly opening the RDC client. When a user starts an RDP session, the user is asked to confirm whether they want to connect.\r\n\r\nIf you disable this policy setting, users cannot run .rdp files that are signed with a valid certificate. Additionally, users cannot start an RDP session by directly opening the RDC client and specifying the remote computer name. When a user tries to start an RDP session, the user receives a message that the publisher has been blocked.\r\n\r\nNote: You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, all users on the computer are affected.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-client-allow-signed-files-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_allow_signed_files_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_allow_signed_files_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_allow_unsigned_files_2","displayName":"Allow .rdp files from unknown publishers","description":"This policy setting allows you to specify whether users can run unsigned Remote Desktop Protocol (.rdp) files and .rdp files from unknown publishers on the client computer.\r\n\r\nIf you enable or do not configure this policy setting, users can run unsigned .rdp files and .rdp files from unknown publishers on the client computer. Before a user starts an RDP session, the user receives a warning message and is asked to confirm whether they want to connect.\r\n\r\nIf you disable this policy setting, users cannot run unsigned .rdp files and .rdp files from unknown publishers on the client computer. If the user tries to start an RDP session, the user receives a message that the publisher has been blocked.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-client-allow-unsigned-files-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_allow_unsigned_files_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_allow_unsigned_files_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_audio","displayName":"Allow audio and video playback redirection","description":"This policy setting allows you to specify whether users can redirect the remote computer's audio and video output in a Remote Desktop Services session.\r\nUsers can specify where to play the remote computer's audio output by configuring the remote audio settings on the Local Resources tab in Remote Desktop Connection (RDC). Users can choose to play the remote audio on the remote computer or on the local computer. Users can also choose to not play the audio. Video playback can be configured by using the videoplayback setting in a Remote Desktop Protocol (.rdp) file. By default, video playback is enabled.\r\n\r\nBy default, audio and video playback redirection is not allowed when connecting to a computer running Windows Server 2008 R2, Windows Server 2008, or Windows Server 2003. Audio and video playback redirection is allowed by default when connecting to a computer running Windows 8, Windows Server 2012, Windows 7, Windows Vista, or Windows XP Professional.\r\n\r\nIf you enable this policy setting, audio and video playback redirection is allowed.\r\n\r\nIf you disable this policy setting, audio and video playback redirection is not allowed, even if audio playback redirection is specified in RDC, or video playback is specified in the .rdp file.\r\n\r\nIf you do not configure this policy setting audio and video playback redirection is not specified at the Group Policy level. \r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-client-audio"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_audio_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_audio_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_audio_capture","displayName":"Allow audio recording redirection","description":"This policy setting allows you to specify whether users can record audio to the remote computer in a Remote Desktop Services session.\r\nUsers can specify whether to record audio to the remote computer by configuring the remote audio settings on the Local Resources tab in Remote Desktop Connection (RDC). Users can record audio by using an audio input device on the local computer, such as a built-in microphone.\r\n\r\nBy default, audio recording redirection is not allowed when connecting to a computer running Windows Server 2008 R2. Audio recording redirection is allowed by default when connecting to a computer running at least Windows 7, or Windows Server 2008 R2. \r\n\r\nIf you enable this policy setting, audio recording redirection is allowed.\r\n\r\nIf you disable this policy setting, audio recording redirection is not allowed, even if audio recording redirection is specified in RDC.\r\n\r\nIf you do not configure this policy setting, Audio recording redirection is not specified at the Group Policy level.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-client-audio-capture"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_audio_capture_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_audio_capture_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_audio_quality","displayName":"Limit audio playback quality","description":"This policy setting allows you to limit the audio playback quality for a Remote Desktop Services session. Limiting the quality of audio playback can improve connection performance, particularly over slow links.\r\n\r\nIf you enable this policy setting, you must select one of the following: High, Medium, or Dynamic. If you select High, the audio will be sent without any compression and with minimum latency. This requires a large amount of bandwidth. If you select Medium, the audio will be sent with some compression and with minimum latency as determined by the codec that is being used. If you select Dynamic, the audio will be sent with a level of compression that is determined by the bandwidth of the remote connection.\r\n\r\nThe audio playback quality that you specify on the remote computer by using this policy setting is the maximum quality that can be used for a Remote Desktop Services session, regardless of the audio playback quality configured on the client computer. For example, if the audio playback quality configured on the client computer is higher than the audio playback quality configured on the remote computer, the lower level of audio playback quality will be used.\r\n\r\nAudio playback quality can be configured on the client computer by using the audioqualitymode setting in a Remote Desktop Protocol (.rdp) file. By default, audio playback quality is set to Dynamic.\r\n\r\nIf you disable or do not configure this policy setting, audio playback quality will be set to Dynamic.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-client-audio-quality"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_audio_quality_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_audio_quality_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_audio_quality_ts_audio_quality_level","displayName":"Audio Quality (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_audio_quality_ts_audio_quality_level_1","displayName":"Dynamic","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_audio_quality_ts_audio_quality_level_3","displayName":"Medium","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_audio_quality_ts_audio_quality_level_7","displayName":"High","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_clipboard","displayName":"Do not allow Clipboard redirection","description":"This policy setting specifies whether to prevent the sharing of Clipboard contents (Clipboard redirection) between a remote computer and a client computer during a Remote Desktop Services session.\r\n\r\nYou can use this setting to prevent users from redirecting Clipboard data to and from the remote computer and the local computer. By default, Remote Desktop Services allows Clipboard redirection.\r\n\r\nIf you enable this policy setting, users cannot redirect Clipboard data.\r\n\r\nIf you disable this policy setting, Remote Desktop Services always allows Clipboard redirection.\r\n\r\nIf you do not configure this policy setting, Clipboard redirection is not specified at the Group Policy level. \r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-client-clipboard"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_clipboard_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_clipboard_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_com","displayName":"Do not allow COM port redirection","description":"This policy setting specifies whether to prevent the redirection of data to client COM ports from the remote computer in a Remote Desktop Services session.\r\n\r\nYou can use this setting to prevent users from redirecting data to COM port peripherals or mapping local COM ports while they are logged on to a Remote Desktop Services session. By default, Remote Desktop Services allows this COM port redirection.\r\n\r\nIf you enable this policy setting, users cannot redirect server data to the local COM port.\r\n\r\nIf you disable this policy setting, Remote Desktop Services always allows COM port redirection.\r\n\r\nIf you do not configure this policy setting, COM port redirection is not specified at the Group Policy level. \r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-client-com"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_com_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_com_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_default_m","displayName":"Do not set default client printer to be default printer in a session","description":"This policy setting allows you to specify whether the client default printer is automatically set as the default printer in a session on an RD Session Host server.\r\n\r\nBy default, Remote Desktop Services automatically designates the client default printer as the default printer in a session on an RD Session Host server. You can use this policy setting to override this behavior.\r\n\r\nIf you enable this policy setting, the default printer is the printer specified on the remote computer.\r\n\r\nIf you disable this policy setting, the RD Session Host server automatically maps the client default printer and sets it as the default printer upon connection.\r\n\r\nIf you do not configure this policy setting, the default printer is not specified at the Group Policy level.\r\n\r\n This setting is only available to Windows Insiders.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-client-default-m"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_default_m_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_default_m_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_disable_hardware_mode","displayName":"Do not allow hardware accelerated decoding","description":"This policy setting specifies whether the Remote Desktop Connection can use hardware acceleration if supported hardware is available. If you use this setting, the Remote Desktop Client will use only software decoding. For example, if you have a problem that you suspect may be related to hardware acceleration, use this setting to disable the acceleration; then, if the problem still occurs, you will know that there are additional issues to investigate. If you disable this setting or leave it not configured, the Remote Desktop client will use hardware accelerated decoding if supported hardware is available.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-client-disable-hardware-mode"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_disable_hardware_mode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_disable_hardware_mode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_lpt","displayName":"Do not allow LPT port redirection","description":"This policy setting specifies whether to prevent the redirection of data to client LPT ports during a Remote Desktop Services session.\r\n\r\nYou can use this setting to prevent users from mapping local LPT ports and redirecting data from the remote computer to local LPT port peripherals. By default, Remote Desktop Services allows LPT port redirection.\r\n\r\nIf you enable this policy setting, users in a Remote Desktop Services session cannot redirect server data to the local LPT port.\r\n\r\nIf you disable this policy setting, LPT port redirection is always allowed.\r\n\r\nIf you do not configure this policy setting, LPT port redirection is not specified at the Group Policy level. \r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-client-lpt"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_lpt_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_lpt_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_pnp","displayName":"Do not allow supported Plug and Play device redirection","description":"This policy setting lets you control the redirection of supported Plug and Play and RemoteFX USB devices, such as Windows Portable Devices, to the remote computer in a Remote Desktop Services session. \r\n\r\nBy default, Remote Desktop Services does not allow redirection of supported Plug and Play and RemoteFX USB devices.\r\n\r\nIf you disable this policy setting, users can redirect their supported Plug and Play devices to the remote computer. Users can use the More option on the Local Resources tab of Remote Desktop Connection to choose the supported Plug and Play devices to redirect to the remote computer.\r\n\r\nIf you enable this policy setting, users cannot redirect their supported Plug and Play devices to the remote computer.If you do not configure this policy setting, users can redirect their supported Plug and Play devices to the remote computer only if it is running Windows Server 2012 R2 and earlier versions.\r\n\r\nNote: You can disable redirection of specific types of supported Plug and Play devices by using Computer Configuration\\Administrative Templates\\System\\Device Installation\\Device Installation Restrictions policy settings.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-client-pnp"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_pnp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_pnp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_printer","displayName":"Do not allow client printer redirection","description":"This policy setting allows you to specify whether to prevent the mapping of client printers in Remote Desktop Services sessions.\r\n\r\nYou can use this policy setting to prevent users from redirecting print jobs from the remote computer to a printer attached to their local (client) computer. By default, Remote Desktop Services allows this client printer mapping.\r\n\r\nIf you enable this policy setting, users cannot redirect print jobs from the remote computer to a local client printer in Remote Desktop Services sessions.\r\n\r\nIf you disable this policy setting, users can redirect print jobs with client printer mapping.\r\n\r\nIf you do not configure this policy setting, client printer mapping is not specified at the Group Policy level.\r\n\r\n This setting is only available to Windows Insiders.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-client-printer"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_printer_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_printer_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_trusted_certificate_thumbprints_1","displayName":"Specify SHA1 thumbprints of certificates representing trusted .rdp publishers","description":"This policy setting allows you to specify a list of Secure Hash Algorithm 1 (SHA1) certificate thumbprints that represent trusted Remote Desktop Protocol (.rdp) file publishers.\r\n\r\nIf you enable this policy setting, any certificate with an SHA1 thumbprint that matches a thumbprint on the list is trusted. If a user tries to start an .rdp file that is signed by a trusted certificate, the user does not receive any warning messages when they start the file. To obtain the thumbprint, view the certificate details, and then click the Thumbprint field.\r\n\r\nIf you disable or do not configure this policy setting, no publisher is treated as a trusted .rdp publisher.\r\n\r\nNotes:\r\n\r\nYou can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user.\r\n\r\nThis policy setting overrides the behavior of the \"Allow .rdp files from valid publishers and user's default .rdp settings\" policy setting.\r\n\r\nIf the list contains a string that is not a certificate thumbprint, it is ignored.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-client-trusted-certificate-thumbprints-1"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_trusted_certificate_thumbprints_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_trusted_certificate_thumbprints_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_trusted_certificate_thumbprints_1_trusted_certificate_thumbprints","displayName":"Comma-separated list of SHA1 trusted certificate thumbprints: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_turn_off_udp","displayName":"Turn Off UDP On Client","description":"This policy setting specifies whether the UDP protocol will be used to access servers via Remote Desktop Protocol. \r\n\r\nIf you enable this policy setting, Remote Desktop Protocol traffic will only use the TCP protocol.\r\n\r\nIf you disable or do not configure this policy setting, Remote Desktop Protocol traffic will attempt to use both TCP and UDP protocols.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-client-turn-off-udp"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_turn_off_udp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_client_turn_off_udp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_colordepth","displayName":"Limit maximum color depth","description":"This policy setting allows you to specify the maximum color resolution (color depth) for Remote Desktop Services connections.\r\n\r\nYou can use this policy setting to set a limit on the color depth of any connection that uses RDP. Limiting the color depth can improve connection performance, particularly over slow links, and reduce server load.\r\n\r\nIf you enable this policy setting, the color depth that you specify is the maximum color depth allowed for a user's RDP connection. The actual color depth for the connection is determined by the color support available on the client computer. If you select Client Compatible, the highest color depth supported by the client will be used.\r\n\r\nIf you disable or do not configure this policy setting, the color depth for connections is not specified at the Group Policy level.\r\n\r\nNote:\r\n1.\tSetting the color depth to 24 bits is only supported on Windows Server 2003 and Windows XP Professional.\r\n2.\tThe value specified in this policy setting is not applied to connections from client computers that are using at least Remote Desktop Protocol 8.0 (computers running at least Windows 8 or Windows Server 2012). The 32-bit color depth format is always used for these connections.\r\n3.\tFor connections from client computers that are using Remote Desktop Protocol 7.1 or earlier versions that are connecting to computers running at least Windows 8 or Windows Server 2012, the minimum of the following values is used as the color depth format:\r\na.\tValue specified by this policy setting\r\nb.\tMaximum color depth supported by the client\r\nc.\tValue requested by the client\r\n\r\nIf the client does not support at least 16 bits, the connection is terminated.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-colordepth"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_colordepth_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_colordepth_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_colordepth_ts_color_depth","displayName":"Color Depth (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_colordepth_ts_color_depth_999","displayName":"Client Compatible","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_colordepth_ts_color_depth_2","displayName":"15 bit","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_colordepth_ts_color_depth_3","displayName":"16 bit","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_colordepth_ts_color_depth_4","displayName":"24 bit","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_colordepth_ts_color_depth_5","displayName":"32 bit","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_delete_roaming_user_profiles","displayName":"Limit the size of the entire roaming user profile cache","description":"This policy setting allows you to limit the size of the entire roaming user profile cache on the local drive. This policy setting only applies to a computer on which the Remote Desktop Session Host role service is installed.\r\n\r\nNote: If you want to limit the size of an individual user profile, use the \"Limit profile size\" policy setting located in User Configuration\\Policies\\Administrative Templates\\System\\User Profiles.\r\n\r\nIf you enable this policy setting, you must specify a monitoring interval (in minutes) and a maximum size (in gigabytes) for the entire roaming user profile cache. The monitoring interval determines how often the size of the entire roaming user profile cache is checked. When the size of the entire roaming user profile cache exceeds the maximum size that you have specified, the oldest (least recently used) roaming user profiles will be deleted until the size of the entire roaming user profile cache is less than the maximum size specified.\r\n\r\nIf you disable or do not configure this policy setting, no restriction is placed on the size of the entire roaming user profile cache on the local drive.\r\n\r\nNote: This policy setting is ignored if the \"Prevent Roaming Profile changes from propagating to the server\" policy setting located in Computer Configuration\\Policies\\Administrative Templates\\System\\User Profiles is enabled.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-delete-roaming-user-profiles"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_delete_roaming_user_profiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_delete_roaming_user_profiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_delete_roaming_user_profiles_ts_profile_directory_monitoring_interval","displayName":"Monitoring interval (minutes): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_delete_roaming_user_profiles_ts_profile_directory_quota","displayName":"Maximum cache size (GBs): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_disable_remote_desktop_wallpaper","displayName":"Enforce Removal of Remote Desktop Wallpaper","description":"Specifies whether desktop wallpaper is displayed to remote clients connecting via Remote Desktop Services.\r\n\r\nYou can use this setting to enforce the removal of wallpaper during a Remote Desktop Services session. By default, Windows XP Professional displays wallpaper to remote clients connecting through Remote Desktop, depending on the client configuration (see the Experience tab in the Remote Desktop Connection options for more information). Servers running Windows Server 2003 do not display wallpaper by default to Remote Desktop Services sessions.\r\n\r\nIf the status is set to Enabled, wallpaper never appears in a Remote Desktop Services session.\r\n\r\nIf the status is set to Disabled, wallpaper might appear in a Remote Desktop Services session, depending on the client configuration.\r\n\r\nIf the status is set to Not Configured, the default behavior applies.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-disable-remote-desktop-wallpaper"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_disable_remote_desktop_wallpaper_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_disable_remote_desktop_wallpaper_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_dx_use_full_hwgpu","displayName":"Use hardware graphics adapters for all Remote Desktop Services sessions","description":"This policy setting enables system administrators to change the graphics rendering for all Remote Desktop Services sessions.\r\n\r\nIf you enable this policy setting, all Remote Desktop Services sessions use the hardware graphics renderer instead of the Microsoft Basic Render Driver as the default adapter.\r\n\r\nIf you disable this policy setting, all Remote Desktop Services sessions use the Microsoft Basic Render Driver as the default adapter.\r\n\r\nIf you do not configure this policy setting, Remote Desktop Services sessions on the RD Session Host server use the Microsoft Basic Render Driver as the default adapter. In all other cases, Remote Desktop Services sessions use the hardware graphics renderer by default.\r\n\r\nNOTE: The policy setting enables load-balancing of graphics processing units (GPU) on a computer with more than one GPU installed. The GPU configuration of the local session is not affected by this policy setting.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-dx-use-full-hwgpu"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_dx_use_full_hwgpu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_dx_use_full_hwgpu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_easy_print","displayName":"Use Remote Desktop Easy Print printer driver first","description":"This policy setting allows you to specify whether the Remote Desktop Easy Print printer driver is used first to install all client printers. \r\n\r\nIf you enable or do not configure this policy setting, the RD Session Host server first tries to use the Remote Desktop Easy Print printer driver to install all client printers. If for any reason the Remote Desktop Easy Print printer driver cannot be used, a printer driver on the RD Session Host server that matches the client printer is used. If the RD Session Host server does not have a printer driver that matches the client printer, the client printer is not available for the Remote Desktop session.\r\n\r\nIf you disable this policy setting, the RD Session Host server tries to find a suitable printer driver to install the client printer. If the RD Session Host server does not have a printer driver that matches the client printer, the server tries to use the Remote Desktop Easy Print driver to install the client printer. If for any reason the Remote Desktop Easy Print printer driver cannot be used, the client printer is not available for the Remote Desktop Services session.\r\n\r\nNote: If the \"Do not allow client printer redirection\" policy setting is enabled, the \"Use Remote Desktop Easy Print printer driver first\" policy setting is ignored.\r\n This setting is only available to Windows Insiders.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-easy-print"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_easy_print_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_easy_print_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_enablevirtualgraphics","displayName":"Configure RemoteFX","description":"This policy setting allows you to control the availability of RemoteFX on both a Remote Desktop Virtualization Host (RD Virtualization Host) server and a Remote Desktop Session Host (RD Session Host) server.\r\n\r\nWhen deployed on an RD Virtualization Host server, RemoteFX delivers a rich user experience by rendering content on the server by using graphics processing units (GPUs). By default, RemoteFX for RD Virtualization Host uses server-side GPUs to deliver a rich user experience over LAN connections and RDP 7.1.\r\n\r\nWhen deployed on an RD Session Host server, RemoteFX delivers a rich user experience by using a hardware-accelerated compression scheme.\r\n\r\nIf you enable this policy setting, RemoteFX will be used to deliver a rich user experience over LAN connections and RDP 7.1.\r\n\r\nIf you disable this policy setting, RemoteFX will be disabled.\r\n\r\nIf you do not configure this policy setting, the default behavior will be used. By default, RemoteFX for RD Virtualization Host is enabled and RemoteFX for RD Session Host is disabled.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-enablevirtualgraphics"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_enablevirtualgraphics_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_enablevirtualgraphics_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_fallbackprintdrivertype","displayName":"Specify RD Session Host server fallback printer driver behavior","description":"This policy setting allows you to specify the RD Session Host server fallback printer driver behavior.\r\n\r\nBy default, the RD Session Host server fallback printer driver is disabled. If the RD Session Host server does not have a printer driver that matches the client's printer, no printer will be available for the Remote Desktop Services session.\r\n\r\nIf you enable this policy setting, the fallback printer driver is enabled, and the default behavior is for the RD Session Host server to find a suitable printer driver. If one is not found, the client's printer is not available. You can choose to change this default behavior. The available options are:\r\n\r\n\"Do nothing if one is not found\" - If there is a printer driver mismatch, the server will attempt to find a suitable driver. If one is not found, the client's printer is not available. This is the default behavior.\r\n\r\n\"Default to PCL if one is not found\" - If no suitable printer driver can be found, default to the Printer Control Language (PCL) fallback printer driver.\r\n\r\n\"Default to PS if one is not found\" - If no suitable printer driver can be found, default to the PostScript (PS) fallback printer driver.\r\n\r\n\"Show both PCL and PS if one is not found\" - If no suitable driver can be found, show both PS and PCL-based fallback printer drivers.\r\n\r\nIf you disable this policy setting, the RD Session Host server fallback driver is disabled and the RD Session Host server will not attempt to use the fallback printer driver.\r\n\r\nIf you do not configure this policy setting, the fallback printer driver behavior is off by default.\r\n\r\nNote: If the \"Do not allow client printer redirection\" setting is enabled, this policy setting is ignored and the fallback printer driver is disabled.\r\n This setting is only available to Windows Insiders.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-fallbackprintdrivertype"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_fallbackprintdrivertype_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_fallbackprintdrivertype_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_fallbackprintdrivertype_ts_fallback_options","displayName":"When attempting to find a suitable driver: (Device)","description":"\r\n This setting is only available to Windows Insiders.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_fallbackprintdrivertype_ts_fallback_options_1","displayName":"Do nothing if one is not found.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_fallbackprintdrivertype_ts_fallback_options_2","displayName":"Default to PCL if one is not found.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_fallbackprintdrivertype_ts_fallback_options_3","displayName":"Default to PS if one is not found.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_fallbackprintdrivertype_ts_fallback_options_4","displayName":"Show both PCL and PS if one is not found.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_forcible_logoff","displayName":"Deny logoff of an administrator logged in to the console session","description":"This policy setting determines whether an administrator attempting to connect remotely to the console of a server can log off an administrator currently logged on to the console.\r\n\r\nThis policy is useful when the currently connected administrator does not want to be logged off by another administrator. If the connected administrator is logged off, any data not previously saved is lost.\r\n\r\nIf you enable this policy setting, logging off the connected administrator is not allowed.\r\n\r\nIf you disable or do not configure this policy setting, logging off the connected administrator is allowed.\r\n\r\nNote: The console session is also known as Session 0. Console access can be obtained by using the /console switch from Remote Desktop Connection in the computer field name or from the command line.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-forcible-logoff"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_forcible_logoff_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_forcible_logoff_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_join_session_directory","displayName":"Join RD Connection Broker","description":"This policy setting allows you to specify whether the RD Session Host server should join a farm in RD Connection Broker. RD Connection Broker tracks user sessions and allows a user to reconnect to their existing session in a load-balanced RD Session Host server farm. To participate in RD Connection Broker, the Remote Desktop Session Host role service must be installed on the server.\r\n\r\nIf the policy setting is enabled, the RD Session Host server joins the farm that is specified in the RD Connection Broker farm name policy setting. The farm exists on the RD Connection Broker server that is specified in the Configure RD Connection Broker server name policy setting.\r\n\r\nIf you disable this policy setting, the server does not join a farm in RD Connection Broker, and user session tracking is not performed. If the policy setting is disabled, you cannot use either the Remote Desktop Session Host Configuration tool or the Remote Desktop Services WMI Provider to join the server to RD Connection Broker.\r\n\r\nIf the policy setting is not configured, the policy setting is not specified at the Group Policy level. \r\n\r\nNotes:\r\n\r\n 1. If you enable this policy setting, you must also enable the Configure RD Connection Broker farm name and Configure RD Connection Broker server name policy settings.\r\n\r\n 2. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-join-session-directory"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_join_session_directory_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_join_session_directory_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_keep_alive","displayName":"Configure keep-alive connection interval","description":"This policy setting allows you to enter a keep-alive interval to ensure that the session state on the RD Session Host server is consistent with the client state.\r\n\r\nAfter an RD Session Host server client loses the connection to an RD Session Host server, the session on the RD Session Host server might remain active instead of changing to a disconnected state, even if the client is physically disconnected from the RD Session Host server. If the client logs on to the same RD Session Host server again, a new session might be established (if the RD Session Host server is configured to allow multiple sessions), and the original session might still be active.\r\n\r\nIf you enable this policy setting, you must enter a keep-alive interval. The keep-alive interval determines how often, in minutes, the server checks the session state. The range of values you can enter is 1 to 999,999.\r\n\r\nIf you disable or do not configure this policy setting, a keep-alive interval is not set and the server will not check the session state.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-keep-alive"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_keep_alive_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_keep_alive_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_keep_alive_ts_keep_alive_interval","displayName":"Keep-Alive interval: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_license_secgroup","displayName":"License server security group","description":"This policy setting allows you to specify the RD Session Host servers to which a Remote Desktop license server will offer Remote Desktop Services client access licenses (RDS CALs).\r\n\r\nYou can use this policy setting to control which RD Session Host servers are issued RDS CALs by the Remote Desktop license server. By default, a license server issues an RDS CAL to any RD Session Host server that requests one.\r\n\r\nIf you enable this policy setting and this policy setting is applied to a Remote Desktop license server, the license server will only respond to RDS CAL requests from RD Session Host servers whose computer accounts are a member of the RDS Endpoint Servers group on the license server.\r\n\r\nBy default, the RDS Endpoint Servers group is empty.\r\n\r\nIf you disable or do not configure this policy setting, the Remote Desktop license server issues an RDS CAL to any RD Session Host server that requests one. The RDS Endpoint Servers group is not deleted or changed in any way by disabling or not configuring this policy setting.\r\n\r\nNote: You should only enable this policy setting when the license server is a member of a domain. You can only add computer accounts for RD Session Host servers to the RDS Endpoint Servers group when the license server is a member of a domain.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-license-secgroup"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_license_secgroup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_license_secgroup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_license_servers","displayName":"Use the specified Remote Desktop license servers","description":"This policy setting allows you to specify the order in which an RD Session Host server attempts to locate Remote Desktop license servers.\r\n\r\nIf you enable this policy setting, an RD Session Host server first attempts to locate the specified license servers. If the specified license servers cannot be located, the RD Session Host server will attempt automatic license server discovery. In the automatic license server discovery process, an RD Session Host server in a Windows Server-based domain attempts to contact a license server in the following order:\r\n\r\n 1. Remote Desktop license servers that are published in Active Directory Domain Services.\r\n\r\n 2. Remote Desktop license servers that are installed on domain controllers in the same domain as the RD Session Host server.\r\n\r\nIf you disable or do not configure this policy setting, the RD Session Host server does not specify a license server at the Group Policy level.\r\n\r\n This setting is only available to Windows Insiders.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-license-servers"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_license_servers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_license_servers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_license_servers_ts_license_edit","displayName":"License servers to use: (Device)","description":"\r\n This setting is only available to Windows Insiders.\r\n ","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_license_tooltip","displayName":"Hide notifications about RD Licensing problems that affect the RD Session Host server","description":"This policy setting determines whether notifications are displayed on an RD Session Host server when there are problems with RD Licensing that affect the RD Session Host server.\r\n\r\nBy default, notifications are displayed on an RD Session Host server after you log on as a local administrator, if there are problems with RD Licensing that affect the RD Session Host server. If applicable, a notification will also be displayed that notes the number of days until the licensing grace period for the RD Session Host server will expire.\r\n\r\nIf you enable this policy setting, these notifications will not be displayed on the RD Session Host server.\r\n\r\nIf you disable or do not configure this policy setting, these notifications will be displayed on the RD Session Host server after you log on as a local administrator.\r\n This setting is only available to Windows Insiders.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-license-tooltip"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_license_tooltip_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_license_tooltip_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_licensing_mode","displayName":"Set the Remote Desktop licensing mode","description":"\r\n This policy setting allows you to specify the type of Remote Desktop Services client access license (RDS CAL) that is required to connect to this RD Session Host server.\r\n\r\n You can use this policy setting to select one of three licensing modes: Per User , Per Device and AAD Per User .\r\n\r\n Per User licensing mode requires that each user account connecting to this RD Session Host server have an RDS Per User CAL issued from an RD Licensing server.\r\n\r\n Per Device licensing mode requires that each device connecting to this RD Session Host server have an RDS Per Device CAL issued from an RD Licensing server.\r\n\r\n AAD Per User licensing mode requires that each user account connecting to this RD Session Host server have a service plan that supports RDS licenses assigned in AAD.\r\n \r\n If you enable this policy setting, the Remote Desktop licensing mode that you specify is honored by the Remote Desktop license server and RD Session Host.\r\n\r\n If you disable or do not configure this policy setting, the licensing mode is not specified at the Group Policy level.\r\n \r\n This setting is only available to Windows Insiders.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-licensing-mode"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_licensing_mode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_licensing_mode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_licensing_mode_ts_licensing_name","displayName":"Specify the licensing mode for the RD Session Host server. (Device)","description":"\r\n This setting is only available to Windows Insiders.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_licensing_mode_ts_licensing_name_2","displayName":"Per Device","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_licensing_mode_ts_licensing_name_4","displayName":"Per User","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_licensing_mode_ts_licensing_name_6","displayName":"AAD Per User","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_max_con_policy","displayName":"Limit number of connections","description":"Specifies whether Remote Desktop Services limits the number of simultaneous connections to the server.\r\n\r\nYou can use this setting to restrict the number of Remote Desktop Services sessions that can be active on a server. If this number is exceeded, addtional users who try to connect receive an error message telling them that the server is busy and to try again later. Restricting the number of sessions improves performance because fewer sessions are demanding system resources. By default, RD Session Host servers allow an unlimited number of Remote Desktop Services sessions, and Remote Desktop for Administration allows two Remote Desktop Services sessions.\r\n\r\nTo use this setting, enter the number of connections you want to specify as the maximum for the server. To specify an unlimited number of connections, type 999999.\r\n\r\nIf the status is set to Enabled, the maximum number of connections is limited to the specified number consistent with the version of Windows and the mode of Remote Desktop Services running on the server.\r\n\r\nIf the status is set to Disabled or Not Configured, limits to the number of connections are not enforced at the Group Policy level.\r\n\r\nNote: This setting is designed to be used on RD Session Host servers (that is, on servers running Windows with Remote Desktop Session Host role service installed).\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-max-con-policy"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_max_con_policy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_max_con_policy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_max_con_policy_ts_maximum_connections_allowed","displayName":"RD Maximum Connections allowed (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_maxdisplayres","displayName":"Limit maximum display resolution","description":"This policy setting allows you to specify the maximum display resolution that can be used by each monitor used to display a Remote Desktop Services session. Limiting the resolution used to display a remote session can improve connection performance, particularly over slow links, and reduce server load.\r\n\r\nIf you enable this policy setting, you must specify a resolution width and height. The resolution specified will be the maximum resolution that can be used by each monitor used to display a Remote Desktop Services session.\r\n\r\nIf you disable or do not configure this policy setting, the maximum resolution that can be used by each monitor to display a Remote Desktop Services session will be determined by the values specified on the Display Settings tab in the Remote Desktop Session Host Configuration tool.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-maxdisplayres"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_maxdisplayres_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_maxdisplayres_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_maxdisplayres_ts_displayres_height","displayName":"Height (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_maxdisplayres_ts_displayres_width","displayName":"Width (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_maxmonitor","displayName":"Limit number of monitors","description":"This policy setting allows you to limit the number of monitors that a user can use to display a Remote Desktop Services session. Limiting the number of monitors to display a Remote Desktop Services session can improve connection performance, particularly over slow links, and reduce server load.\r\n\r\nIf you enable this policy setting, you can specify the number of monitors that can be used to display a Remote Desktop Services session. You can specify a number from 1 to 16.\r\n\r\nIf you disable or do not configure this policy setting, the number of monitors that can be used to display a Remote Desktop Services session is not specified at the Group Policy level.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-maxmonitor"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_maxmonitor_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_maxmonitor_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_maxmonitor_ts_max_monitor","displayName":"Maximum Monitors (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_nodisconnectmenu","displayName":"Remove \"Disconnect\" option from Shut Down dialog","description":"This policy setting allows you to remove the \"Disconnect\" option from the Shut Down Windows dialog box in Remote Desktop Services sessions.\r\n\r\nYou can use this policy setting to prevent users from using this familiar method to disconnect their client from an RD Session Host server.\r\n\r\nIf you enable this policy setting, \"Disconnect\" does not appear as an option in the drop-down list in the Shut Down Windows dialog box.\r\n\r\nIf you disable or do not configure this policy setting, \"Disconnect\" is not removed from the list in the Shut Down Windows dialog box.\r\n\r\nNote: This policy setting affects only the Shut Down Windows dialog box. It does not prevent users from using other methods to disconnect from a Remote Desktop Services session. This policy setting also does not prevent disconnected sessions at the server. You can control how long a disconnected session remains active on the server by configuring the \"Computer Configuration\\Administrative Templates\\Windows Components\\Remote Desktop Services\\RD Session Host\\Session Time Limits\\Set time limit for disconnected sessions\" policy setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-nodisconnectmenu"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_nodisconnectmenu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_nodisconnectmenu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_nosecuritymenu","displayName":"Remove Windows Security item from Start menu","description":"Specifies whether to remove the Windows Security item from the Settings menu on Remote Desktop clients. You can use this setting to prevent inexperienced users from logging off from Remote Desktop Services inadvertently.\r\n\r\nIf the status is set to Enabled, Windows Security does not appear in Settings on the Start menu. As a result, users must type a security attention sequence, such as CTRL+ALT+END, to open the Windows Security dialog box on the client computer.\r\n\r\nIf the status is set to Disabled or Not Configured, Windows Security remains in the Settings menu.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-nosecuritymenu"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_nosecuritymenu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_nosecuritymenu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_preventlicenseupgrade","displayName":"Prevent license upgrade","description":"This policy setting allows you to specify which version of Remote Desktop Services client access license (RDS CAL) a Remote Desktop Services license server will issue to clients connecting to RD Session Host servers running other Windows-based operating systems.\r\n\r\nA license server attempts to provide the most appropriate RDS or TS CAL for a connection. For example, a Windows Server 2008 license server will try to issue a Windows Server 2008 TS CAL for clients connecting to a terminal server running Windows Server 2008, and will try to issue a Windows Server 2003 TS CAL for clients connecting to a terminal server running Windows Server 2003.\r\n\r\nBy default, if the most appropriate RDS CAL is not available for a connection, a Windows Server 2008 license server will issue a Windows Server 2008 TS CAL, if available, to the following:\r\n\r\n* A client connecting to a Windows Server 2003 terminal server\r\n* A client connecting to a Windows 2000 terminal server\r\n\r\nIf you enable this policy setting, the license server will only issue a temporary RDS CAL to the client if an appropriate RDS CAL for the RD Session Host server is not available. If the client has already been issued a temporary RDS CAL and the temporary RDS CAL has expired, the client will not be able to connect to the RD Session Host server unless the RD Licensing grace period for the RD Session Host server has not expired.\r\n\r\nIf you disable or do not configure this policy setting, the license server will exhibit the default behavior noted earlier.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-preventlicenseupgrade"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_preventlicenseupgrade_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_preventlicenseupgrade_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_promt_creds_client_comp","displayName":"Prompt for credentials on the client computer","description":"This policy setting determines whether a user will be prompted on the client computer to provide credentials for a remote connection to an RD Session Host server.\r\n\r\nIf you enable this policy setting, a user will be prompted on the client computer instead of on the RD Session Host server to provide credentials for a remote connection to an RD Session Host server. If saved credentials for the user are available on the client computer, the user will not be prompted to provide credentials.\r\n\r\nNote: If you enable this policy setting in releases of Windows Server 2008 R2 with SP1 or Windows Server 2008 R2, and a user is prompted on both the client computer and on the RD Session Host server to provide credentials, clear the Always prompt for password check box on the Log on Settings tab in Remote Desktop Session Host Configuration.\r\n\r\nIf you disable or do not configure this policy setting, the version of the operating system on the RD Session Host server will determine when a user is prompted to provide credentials for a remote connection to an RD Session Host server. For Windows Server 2003 and Windows 2000 Server a user will be prompted on the terminal server to provide credentials for a remote connection. For Windows Server 2008 and Windows Server 2008 R2, a user will be prompted on the client computer to provide credentials for a remote connection.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-promt-creds-client-comp"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_promt_creds_client_comp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_promt_creds_client_comp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_rdsappx_waitforregistration","displayName":"Suspend user sign-in to complete app registration","description":"This policy setting allows you to specify whether the app registration is completed before showing the Start screen to the user. \r\n\r\nBy default, when a new user signs in to a computer, the Start screen is shown and apps are registered in the background. However, some apps may not work until app registration is complete.\r\n\r\nIf you enable this policy setting, user sign-in is blocked for up to 6 minutes to complete the app registration. You can use this policy setting when customizing the Start screen on Remote Desktop Session Host servers. \r\n\r\nIf you disable or do not configure this policy setting, the Start screen is shown and apps are registered in the background.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-rdsappx-waitforregistration"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_rdsappx_waitforregistration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_rdsappx_waitforregistration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotecontrol_2","displayName":"Set rules for remote control of Remote Desktop Services user sessions","description":"If you enable this policy setting, administrators can interact with a user's Remote Desktop Services session based on the option selected. Select the desired level of control and permission from the options list:\r\n\r\n1. No remote control allowed: Disallows an administrator to use remote control or view a remote user session.\r\n2. Full Control with user's permission: Allows the administrator to interact with the session, with the user's consent.\r\n3. Full Control without user's permission: Allows the administrator to interact with the session, without the user's consent.\r\n4. View Session with user's permission: Allows the administrator to watch the session of a remote user with the user's consent. \r\n5. View Session without user's permission: Allows the administrator to watch the session of a remote user without the user's consent.\r\n\r\nIf you disable this policy setting, administrators can interact with a user's Remote Desktop Services session, with the user's consent.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-remotecontrol-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotecontrol_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotecontrol_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotecontrol_2_ts_remotecontrol_levels","displayName":"Options: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotecontrol_2_ts_remotecontrol_levels_0","displayName":"No remote control allowed","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotecontrol_2_ts_remotecontrol_levels_1","displayName":"Full Control with user's permission","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotecontrol_2_ts_remotecontrol_levels_2","displayName":"Full Control without user's permission","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotecontrol_2_ts_remotecontrol_levels_3","displayName":"View Session with user's permission","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotecontrol_2_ts_remotecontrol_levels_4","displayName":"View Session without user's permission","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotedesktopvirtualgraphics","displayName":"Optimize visual experience when using RemoteFX","description":"This policy setting allows you to specify the visual experience that remote users will have in Remote Desktop Connection (RDC) connections that use RemoteFX. You can use this policy to balance the network bandwidth usage with the type of graphics experience that is delivered.\r\n\r\nDepending on the requirements of your users, you can reduce network bandwidth usage by reducing the screen capture rate. You can also reduce network bandwidth usage by reducing the image quality (increasing the amount of image compression that is performed).\r\n\r\nIf you have a higher than average bandwidth network, you can maximize the utilization of bandwidth by selecting the highest setting for screen capture rate and the highest setting for image quality.\r\n\r\nBy default, Remote Desktop Connection sessions that use RemoteFX are optimized for a balanced experience over LAN conditions. If you disable or do not configure this policy setting, Remote Desktop Connection sessions that use RemoteFX will be the same as if the medium screen capture rate and the medium image compression settings were selected (the default behavior). \r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-remotedesktopvirtualgraphics"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotedesktopvirtualgraphics_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotedesktopvirtualgraphics_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotedesktopvirtualgraphics_ts_remotedesktopvirtualgraphics_screencapturerate","displayName":"Screen capture rate (frames per second): (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotedesktopvirtualgraphics_ts_remotedesktopvirtualgraphics_screencapturerate_1","displayName":"Highest (best quality)","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotedesktopvirtualgraphics_ts_remotedesktopvirtualgraphics_screencapturerate_2","displayName":"Medium (default)","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotedesktopvirtualgraphics_ts_remotedesktopvirtualgraphics_screencapturerate_3","displayName":"Lowest","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotedesktopvirtualgraphics_ts_remotedesktopvirtualgraphics_screenimagequality","displayName":"Screen Image Quality: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotedesktopvirtualgraphics_ts_remotedesktopvirtualgraphics_screenimagequality_1","displayName":"Highest (best quality)","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotedesktopvirtualgraphics_ts_remotedesktopvirtualgraphics_screenimagequality_2","displayName":"Medium (default)","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_remotedesktopvirtualgraphics_ts_remotedesktopvirtualgraphics_screenimagequality_3","displayName":"Lowest","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sd_clustname","displayName":"Configure RD Connection Broker farm name","description":"This policy setting allows you to specify the name of a farm to join in RD Connection Broker. RD Connection Broker uses the farm name to determine which RD Session Host servers are in the same RD Session Host server farm. Therefore, you must use the same farm name for all RD Session Host servers in the same load-balanced farm. The farm name does not have to correspond to a name in Active Directory Domain Services.\r\n\r\nIf you specify a new farm name, a new farm is created in RD Connection Broker. If you specify an existing farm name, the server joins that farm in RD Connection Broker.\r\n\r\nIf you enable this policy setting, you must specify the name of a farm in RD Connection Broker.\r\n\r\nIf you disable or do not configure this policy setting, the farm name is not specified at the Group Policy level. \r\n\r\nNotes:\r\n\r\n 1. This policy setting is not effective unless both the Join RD Connection Broker and the Configure RD Connection Broker server name policy settings are enabled and configured by using Group Policy.\r\n\r\n 2. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-sd-clustname"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sd_clustname_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sd_clustname_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sd_clustname_ts_sd_clustname","displayName":"Configure RD Connection Broker farm name: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sd_expose_address","displayName":"Use IP Address Redirection","description":"This policy setting allows you to specify the redirection method to use when a client device reconnects to an existing Remote Desktop Services session in a load-balanced RD Session Host server farm. This setting applies to an RD Session Host server that is configured to use RD Connection Broker and not to the RD Connection Broker server.\r\n\r\nIf you enable this policy setting, a Remote Desktop Services client queries the RD Connection Broker server and is redirected to their existing session by using the IP address of the RD Session Host server where their session exists. To use this redirection method, client computers must be able to connect directly by IP address to RD Session Host servers in the farm.\r\n\r\nIf you disable this policy setting, the IP address of the RD Session Host server is not sent to the client. Instead, the IP address is embedded in a token. When a client reconnects to the load balancer, the routing token is used to redirect the client to their existing session on the correct RD Session Host server in the farm. Only disable this setting when your network load-balancing solution supports the use of RD Connection Broker routing tokens and you do not want clients to directly connect by IP address to RD Session Host servers in the load-balanced farm.\r\n\r\nIf you do not configure this policy setting, the Use IP address redirection policy setting is not enforced at the group Group policy Policy level and the default will be used. This setting is enabled by default.\r\n\r\nNotes:\r\n\r\n 1. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-sd-expose-address"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sd_expose_address_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sd_expose_address_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sd_loc","displayName":"Configure RD Connection Broker server name","description":"This policy setting allows you to specify the RD Connection Broker server that the RD Session Host server uses to track and redirect user sessions for a load-balanced RD Session Host server farm. The specified server must be running the Remote Desktop Connection Broker service. All RD Session Host servers in a load-balanced farm should use the same RD Connection Broker server.\r\n\r\nIf you enable this policy setting, you must specify the RD Connection Broker server by using its fully qualified domain name (FQDN). In Windows Server 2012, for a high availability setup with multiple RD Connection Broker servers, you must provide a semi-colon separated list of the FQDNs of all the RD Connection Broker servers.\r\n\r\nIf you disable or do not configure this policy setting, the policy setting is not specified at the Group Policy level.\r\n\r\nNotes:\r\n\r\n 1. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard.\r\n\r\n 2. This policy setting is not effective unless the Join RD Connection Broker policy setting is enabled.\r\n\r\n 3. To be an active member of an RD Session Host server farm, the computer account for each RD Session Host server in the farm must be a member of one of the following local groups on the RD Connection Broker server: Session Directory Computers, Session Broker Computers, or RDS Endpoint Servers.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-sd-loc"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sd_loc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sd_loc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sd_loc_ts_sd_loc","displayName":"Configure RD Connection Broker server name: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_security_layer_policy","displayName":"Require use of specific security layer for remote (RDP) connections","description":"This policy setting specifies whether to require the use of a specific security layer to secure communications between clients and RD Session Host servers during Remote Desktop Protocol (RDP) connections.\r\n\r\nIf you enable this policy setting, all communications between clients and RD Session Host servers during remote connections must use the security method specified in this setting. The following security methods are available:\r\n\r\n* Negotiate: The Negotiate method enforces the most secure method that is supported by the client. If Transport Layer Security (TLS) version 1.0 is supported, it is used to authenticate the RD Session Host server. If TLS is not supported, native Remote Desktop Protocol (RDP) encryption is used to secure communications, but the RD Session Host server is not authenticated. Native RDP encryption (as opposed to SSL encryption) is not recommended.\r\n\r\n* RDP: The RDP method uses native RDP encryption to secure communications between the client and RD Session Host server. If you select this setting, the RD Session Host server is not authenticated. Native RDP encryption (as opposed to SSL encryption) is not recommended.\r\n\r\n* SSL (TLS 1.0): The SSL method requires the use of TLS 1.0 to authenticate the RD Session Host server. If TLS is not supported, the connection fails. This is the recommended setting for this policy.\r\n\r\nIf you disable or do not configure this policy setting, the security method to be used for remote connections to RD Session Host servers is not specified at the Group Policy level.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-security-layer-policy"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_security_layer_policy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_security_layer_policy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_security_layer_policy_ts_security_layer","displayName":"Security Layer (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_security_layer_policy_ts_security_layer_0","displayName":"RDP","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_security_layer_policy_ts_security_layer_1","displayName":"Negotiate","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_security_layer_policy_ts_security_layer_2","displayName":"SSL","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_select_network_detect","displayName":"Select network detection on the server","description":"This policy setting allows you to specify how the Remote Desktop Protocol will try to detect the network quality (bandwidth and latency).\r\n\r\nYou can choose to disable Connect Time Detect, Continuous Network Detect, or both Connect Time Detect and Continuous Network Detect. \r\n\r\nIf you disable Connect Time Detect, Remote Desktop Protocol will not determine the network quality at the connect time, and it will assume that all traffic to this server originates from a low-speed connection.\r\n\r\nIf you disable Continuous Network Detect, Remote Desktop Protocol will not try to adapt the remote user experience to varying network quality. \r\n\r\nIf you disable Connect Time Detect and Continuous Network Detect, Remote Desktop Protocol will not try to determine the network quality at the connect time; instead it will assume that all traffic to this server originates from a low-speed connection, and it will not try to adapt the user experience to varying network quality.\r\n\r\nIf you disable or do not configure this policy setting, Remote Desktop Protocol will spend up to a few seconds trying to determine the network quality prior to the connection, and it will continuously try to adapt the user experience to varying network quality.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-select-network-detect"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_select_network_detect_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_select_network_detect_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_select_network_detect_ts_select_network_detect_level","displayName":"Select Network Detect Level (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_select_network_detect_ts_select_network_detect_level_0","displayName":"Use both Connect Time Detect and Continuous Network Detect","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_select_network_detect_ts_select_network_detect_level_1","displayName":"Turn off Connect Time Detect","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_select_network_detect_ts_select_network_detect_level_2","displayName":"Turn off Continuous Network Detect","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_select_network_detect_ts_select_network_detect_level_3","displayName":"Turn off Connect Time Detect and Continuous Network Detect","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_select_transport","displayName":"Select RDP transport protocols","description":"This policy setting allows you to specify which protocols can be used for Remote Desktop Protocol (RDP) access to this server.\r\n\r\nIf you enable this policy setting, you must specify if you would like RDP to use UDP.\r\n\r\nYou can select one of the following options: \"Use both UDP and TCP\", \"Use only TCP\" or \"Use either UDP or TCP (default)\" \r\n\r\nIf you select \"Use either UDP or TCP\" and the UDP connection is successful, most of the RDP traffic will use UDP.\r\n\r\nIf the UDP connection is not successful or if you select \"Use only TCP,\" all of the RDP traffic will use TCP.\r\n\r\nIf you disable or do not configure this policy setting, RDP will choose the optimal protocols for delivering the best user experience.\r\n\t \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-select-transport"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_select_transport_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_select_transport_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_select_transport_ts_select_transport_type","displayName":"Select Transport Type (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_select_transport_ts_select_transport_type_0","displayName":"Use both UDP and TCP","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_select_transport_ts_select_transport_type_1","displayName":"Use only TCP","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_select_transport_ts_select_transport_type_2","displayName":"Use either UDP or TCP","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_advanced_remotefx_remoteapp","displayName":"Use advanced RemoteFX graphics for RemoteApp","description":"This policy setting allows you to enable RemoteApp programs to use advanced graphics, including support for transparency, live thumbnails, and seamless application moves. This policy setting applies only to RemoteApp programs and does not apply to remote desktop sessions.\r\n\r\nIf you enable or do not configure this policy setting, RemoteApp programs published from this RD Session Host server will use these advanced graphics.\r\n\r\nIf you disable this policy setting, RemoteApp programs published from this RD Session Host server will not use these advanced graphics. You may want to choose this option if you discover that applications published as RemoteApp programs do not support these advanced graphics. \r\n\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-server-advanced-remotefx-remoteapp"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_advanced_remotefx_remoteapp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_advanced_remotefx_remoteapp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_auth","displayName":"Configure server authentication for client","description":"This policy setting allows you to specify whether the client will establish a connection to the RD Session Host server when the client cannot authenticate the RD Session Host server.\r\n\r\nIf you enable this policy setting, you must specify one of the following settings:\r\n\r\nAlways connect, even if authentication fails: The client connects to the RD Session Host server even if the client cannot authenticate the RD Session Host server.\r\n\r\nWarn me if authentication fails: The client attempts to authenticate the RD Session Host server. If the RD Session Host server can be authenticated, the client establishes a connection to the RD Session Host server. If the RD Session Host server cannot be authenticated, the user is prompted to choose whether to connect to the RD Session Host server without authenticating the RD Session Host server.\r\n\r\nDo not connect if authentication fails: The client establishes a connection to the RD Session Host server only if the RD Session Host server can be authenticated.\r\n\r\nIf you disable or do not configure this policy setting, the authentication setting that is specified in Remote Desktop Connection or in the .rdp file determines whether the client establishes a connection to the RD Session Host server when the client cannot authenticate the RD Session Host server.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-server-auth"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_auth_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_auth_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_auth_ts_server_auth_level","displayName":"Authentication setting: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_auth_ts_server_auth_level_0","displayName":"Always connect, even if authentication fails","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_auth_ts_server_auth_level_2","displayName":"Warn me if authentication fails","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_auth_ts_server_auth_level_1","displayName":"Do not connect if authentication fails","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_avc_hw_encode_preferred","displayName":"Configure H.264/AVC hardware encoding for Remote Desktop Connections","description":"This policy setting lets you enable H.264/AVC hardware encoding support for Remote Desktop Connections. When you enable hardware encoding, if an error occurs, we will attempt to use software encoding. If you disable or do not configure this policy, we will always use software encoding.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-server-avc-hw-encode-preferred"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_avc_hw_encode_preferred_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_avc_hw_encode_preferred_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_avc444_mode_preferred","displayName":"Prioritize H.264/AVC 444 graphics mode for Remote Desktop Connections","description":"This policy setting prioritizes the H.264/AVC 444 graphics mode for non-RemoteFX vGPU scenarios. When you use this setting on the RDP server, the server will use H.264/AVC 444 as the codec in an RDP 10 connection where both the client and server can use H.264/AVC 444.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-server-avc444-mode-preferred"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_avc444_mode_preferred_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_avc444_mode_preferred_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_compressor","displayName":"Configure compression for RemoteFX data","description":"This policy setting allows you to specify which Remote Desktop Protocol (RDP) compression algorithm to use.\r\n\r\nBy default, servers use an RDP compression algorithm that is based on the server's hardware configuration.\r\n\r\nIf you enable this policy setting, you can specify which RDP compression algorithm to use. If you select the algorithm that is optimized to use less memory, this option is less memory-intensive, but uses more network bandwidth. If you select the algorithm that is optimized to use less network bandwidth, this option uses less network bandwidth, but is more memory-intensive. Additionally, a third option is available that balances memory usage and network bandwidth. In Windows 8 only the compression algorithm that balances memory usage and bandwidth is used.\r\n\r\nYou can also choose not to use an RDP compression algorithm. Choosing not to use an RDP compression algorithm will use more network bandwidth and is only recommended if you are using a hardware device that is designed to optimize network traffic. Even if you choose not to use an RDP compression algorithm, some graphics data will still be compressed.\r\n\r\nIf you disable or do not configure this policy setting, the default RDP compression algorithm will be used.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-server-compressor"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_compressor_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_compressor_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_compressor_ts_compressor_levels","displayName":"RDP compression algorithm: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_compressor_ts_compressor_levels_1","displayName":"Optimized to use less memory","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_compressor_ts_compressor_levels_3","displayName":"Optimized to use less network bandwidth","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_compressor_ts_compressor_levels_2","displayName":"Balances memory and network bandwidth","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_compressor_ts_compressor_levels_0","displayName":"Do not use an RDP compression algorithm","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_image_quality","displayName":"Configure image quality for RemoteFX Adaptive Graphics","description":"This policy setting allows you to specify the visual quality for remote users when connecting to this computer by using Remote Desktop Connection. You can use this policy setting to balance the network bandwidth usage with the visual quality that is delivered.\r\n If you enable this policy setting and set quality to Low, RemoteFX Adaptive Graphics uses an encoding mechanism that results in low quality images. This mode consumes the lowest amount of network bandwidth of the quality modes.\r\n If you enable this policy setting and set quality to Medium, RemoteFX Adaptive Graphics uses an encoding mechanism that results in medium quality images. This mode provides better graphics quality than low quality and uses less bandwidth than high quality.\r\n If you enable this policy setting and set quality to High, RemoteFX Adaptive Graphics uses an encoding mechanism that results in high quality images and consumes moderate network bandwidth.\r\n If you enable this policy setting and set quality to Lossless, RemoteFX Adaptive Graphics uses lossless encoding. In this mode, the color integrity of the graphics data is not impacted. However, this setting results in a significant increase in network bandwidth consumption. We recommend that you set this for very specific cases only.\r\n If you disable or do not configure this policy setting, RemoteFX Adaptive Graphics uses an encoding mechanism that results in medium quality images.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-server-image-quality"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_image_quality_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_image_quality_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_image_quality_ts_server_image_quality_levels","displayName":"Image quality: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_image_quality_ts_server_image_quality_levels_1","displayName":"Lossless","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_image_quality_ts_server_image_quality_levels_2","displayName":"High","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_image_quality_ts_server_image_quality_levels_3","displayName":"Medium","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_image_quality_ts_server_image_quality_levels_4","displayName":"Low","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_legacy_rfx","displayName":"Enable RemoteFX encoding for RemoteFX clients designed for Windows Server 2008 R2 SP1","description":"This policy setting allows you to configure graphics encoding to use the RemoteFX Codec on the Remote Desktop Session Host server so that the sessions are compatible with non-Windows thin client devices designed for Windows Server 2008 R2 SP1. These clients only support the Windows Server 2008 R2 SP1 RemoteFX Codec.If you enable this policy setting, users' sessions on this server will only use the Windows Server 2008 R2 SP1 RemoteFX Codec for encoding. This mode is compatible with thin client devices that only support the Windows Server 2008 R2 SP1 RemoteFX Codec.If you disable or do not configure this policy setting, non-Windows thin clients that only support the Windows Server 2008 R2 SP1 RemoteFX Codec will not be able to connect to this server. This policy setting applies only to clients that are using Remote Desktop Protocol (RDP) 7.1, and does not affect clients that are using other RDP versions.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-server-legacy-rfx"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_legacy_rfx_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_legacy_rfx_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_profile","displayName":"Configure RemoteFX Adaptive Graphics","description":"This policy setting allows the administrator to configure the RemoteFX experience for Remote Desktop Session Host or Remote Desktop Virtualization Host servers. By default, the system will choose the best experience based on available nework bandwidth.\r\n\r\nIf you enable this policy setting, the RemoteFX experience could be set to one of the following options:\r\n1. Let the system choose the experience for the network condition\r\n2. Optimize for server scalability\r\n3. Optimize for minimum bandwidth usage\r\n\r\nIf you disable or do not configure this policy setting, the RemoteFX experience will change dynamically based on the network condition.\"\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-server-profile"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_profile_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_profile_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_profile_ts_server_profile_levels","displayName":"RDP experience: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_profile_ts_server_profile_levels_2","displayName":"Let the system choose experience for network condition","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_profile_ts_server_profile_levels_1","displayName":"Optimize for server scalability","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_profile_ts_server_profile_levels_3","displayName":"Optimize for minimum bandwidth usage","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_visexp","displayName":"Optimize visual experience for Remote Desktop Service Sessions","description":"This policy setting allows you to specify the visual experience that remote users receive in Remote Desktop Services sessions. Remote sessions on the remote computer are then optimized to support this visual experience.\r\n\r\nBy default, Remote Desktop Services sessions are optimized for rich multimedia, such as applications that use Silverlight or Windows Presentation Foundation.\r\n\r\nIf you enable this policy setting, you must select the visual experience for which you want to optimize Remote Desktop Services sessions. You can select either Rich multimedia or Text.\r\n\r\nIf you disable or do not configure this policy setting, Remote Desktop Services sessions are optimized for rich multimedia.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-server-visexp"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_visexp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_visexp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_visexp_ts_visexp_settings","displayName":"Visual experience: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_visexp_ts_visexp_settings_1","displayName":"Rich multimedia","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_visexp_ts_visexp_settings_2","displayName":"Text","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_wddm_graphics_driver","displayName":"Use WDDM graphics display driver for Remote Desktop Connections","description":"This policy setting lets you enable WDDM graphics display driver for Remote Desktop Connections.\r\n\r\nIf you enable or do not configure this policy setting, Remote Desktop Connections will use WDDM graphics display driver.\r\n\r\nIf you disable this policy setting, Remote Desktop Connections will NOT use WDDM graphics display driver. In this case, the Remote Desktop Connections will use XDDM graphics display driver.\r\n\r\nFor this change to take effect, you must restart Windows.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-server-wddm-graphics-driver"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_wddm_graphics_driver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_server_wddm_graphics_driver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_session_end_on_limit_2","displayName":"End session when time limits are reached","description":"This policy setting specifies whether to end a Remote Desktop Services session that has timed out instead of disconnecting it.\r\n\r\nYou can use this setting to direct Remote Desktop Services to end a session (that is, the user is logged off and the session is deleted from the server) after time limits for active or idle sessions are reached. By default, Remote Desktop Services disconnects sessions that reach their time limits.\r\n\r\nTime limits are set locally by the server administrator or by using Group Policy. See the policy settings Set time limit for active Remote Desktop Services sessions and Set time limit for active but idle Remote Desktop Services sessions policy settings.\r\n\r\nIf you enable this policy setting, Remote Desktop Services ends any session that reaches its time-out limit.\r\n\r\nIf you disable this policy setting, Remote Desktop Services always disconnects a timed-out session, even if specified otherwise by the server administrator.\r\n\r\nIf you do not configure this policy setting, Remote Desktop Services disconnects a timed-out session, unless specified otherwise in local settings.\r\n\r\nNote: This policy setting only applies to time-out limits that are explicitly set by the administrator. This policy setting does not apply to time-out events that occur due to connectivity or network conditions. This setting appears in both Computer Configuration and User Configuration. If both settings are configured, the Computer Configuration setting takes precedence.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-session-end-on-limit-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_session_end_on_limit_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_session_end_on_limit_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2","displayName":"Set time limit for disconnected sessions","description":"This policy setting allows you to configure a time limit for disconnected Remote Desktop Services sessions.\r\n\r\nYou can use this policy setting to specify the maximum amount of time that a disconnected session remains active on the server. By default, Remote Desktop Services allows users to disconnect from a Remote Desktop Services session without logging off and ending the session.\r\n\r\nWhen a session is in a disconnected state, running programs are kept active even though the user is no longer actively connected. By default, these disconnected sessions are maintained for an unlimited time on the server.\r\n\r\nIf you enable this policy setting, disconnected sessions are deleted from the server after the specified amount of time. To enforce the default behavior that disconnected sessions are maintained for an unlimited time, select Never. If you have a console session, disconnected session time limits do not apply.\r\n\r\n\r\nIf you disable or do not configure this policy setting, this policy setting is not specified at the Group Policy level. Be y default, Remote Desktop Services disconnected sessions are maintained for an unlimited amount of time. \r\n\r\nNote: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-sessions-disconnected-timeout-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected","displayName":"End a disconnected session (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_0","displayName":"Never","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_60000","displayName":"1 minute","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_300000","displayName":"5 minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_600000","displayName":"10 minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_900000","displayName":"15 minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_1800000","displayName":"30 minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_3600000","displayName":"1 hour","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_7200000","displayName":"2 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_10800000","displayName":"3 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_21600000","displayName":"6 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_28800000","displayName":"8 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_43200000","displayName":"12 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_57600000","displayName":"16 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_64800000","displayName":"18 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_86400000","displayName":"1 day","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_172800000","displayName":"2 days","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_259200000","displayName":"3 days","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_345600000","displayName":"4 days","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_disconnected_timeout_2_ts_sessions_enddisconnected_432000000","displayName":"5 days","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2","displayName":"Set time limit for active but idle Remote Desktop Services sessions","description":"This policy setting allows you to specify the maximum amount of time that an active Remote Desktop Services session can be idle (without user input) before it is automatically disconnected.\r\n\r\nIf you enable this policy setting, you must select the desired time limit in the Idle session limit list. Remote Desktop Services will automatically disconnect active but idle sessions after the specified amount of time. The user receives a warning two minutes before the session disconnects, which allows the user to press a key or move the mouse to keep the session active. If you have a console session, idle session time limits do not apply.\r\n\r\nIf you disable or do not configure this policy setting, the time limit is not specified at the Group Policy level. By default, Remote Desktop Services allows sessions to remain active but idle for an unlimited amount of time. \r\n\r\nIf you want Remote Desktop Services to end instead of disconnect a session when the time limit is reached, you can configure the policy setting Computer Configuration\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Session Time Limits\\End session when time limits are reached.\r\n\r\nNote: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-sessions-idle-limit-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext","displayName":"Idle session limit: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_0","displayName":"Never","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_60000","displayName":"1 minute","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_300000","displayName":"5 minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_600000","displayName":"10 minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_900000","displayName":"15 minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_1800000","displayName":"30 minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_3600000","displayName":"1 hour","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_7200000","displayName":"2 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_10800000","displayName":"3 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_21600000","displayName":"6 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_28800000","displayName":"8 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_43200000","displayName":"12 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_57600000","displayName":"16 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_64800000","displayName":"18 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_86400000","displayName":"1 day","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_172800000","displayName":"2 days","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_259200000","displayName":"3 days","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_345600000","displayName":"4 days","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_idle_limit_2_ts_sessions_idlelimittext_432000000","displayName":"5 days","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2","displayName":"Set time limit for active Remote Desktop Services sessions","description":"This policy setting allows you to specify the maximum amount of time that a Remote Desktop Services session can be active before it is automatically disconnected.\r\n\r\nIf you enable this policy setting, you must select the desired time limit in the Active session limit list. Remote Desktop Services will automatically disconnect active sessions after the specified amount of time. The user receives a warning two minutes before the Remote Desktop Services session disconnects, which allows the user to save open files and close programs. If you have a console session, active session time limits do not apply.\r\n\r\nIf you disable or do not configure this policy setting, this policy setting is not specified at the Group Policy level. By default, Remote Desktop Services allows sessions to remain active for an unlimited amount of time. \r\n\r\nIf you want Remote Desktop Services to end instead of disconnect a session when the time limit is reached, you can configure the policy setting Computer Configuration\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Session Time Limits\\End session when time limits are reached.\r\n\r\nNote: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-sessions-limits-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit","displayName":"Active session limit : (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_0","displayName":"Never","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_60000","displayName":"1 minute","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_300000","displayName":"5 minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_600000","displayName":"10 minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_900000","displayName":"15 minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_1800000","displayName":"30 minutes","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_3600000","displayName":"1 hour","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_7200000","displayName":"2 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_10800000","displayName":"3 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_21600000","displayName":"6 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_28800000","displayName":"8 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_43200000","displayName":"12 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_57600000","displayName":"16 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_64800000","displayName":"18 hours","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_86400000","displayName":"1 day","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_172800000","displayName":"2 days","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_259200000","displayName":"3 days","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_345600000","displayName":"4 days","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_sessions_limits_2_ts_sessions_activelimit_432000000","displayName":"5 days","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_single_session","displayName":"Restrict Remote Desktop Services users to a single Remote Desktop Services session","description":"This policy setting allows you to restrict users to a single Remote Desktop Services session.\r\n\r\nIf you enable this policy setting, users who log on remotely by using Remote Desktop Services will be restricted to a single session (either active or disconnected) on that server. If the user leaves the session in a disconnected state, the user automatically reconnects to that session at the next logon.\r\n\r\nIf you disable this policy setting, users are allowed to make unlimited simultaneous remote connections by using Remote Desktop Services.\r\n\r\nIf you do not configure this policy setting, this policy setting is not specified at the Group Policy level.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-single-session"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_single_session_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_single_session_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_smart_card","displayName":"Do not allow smart card device redirection","description":"This policy setting allows you to control the redirection of smart card devices in a Remote Desktop Services session.\r\n\r\nIf you enable this policy setting, Remote Desktop Services users cannot use a smart card to log on to a Remote Desktop Services session.\r\n\r\nIf you disable or do not configure this policy setting, smart card device redirection is allowed. By default, Remote Desktop Services automatically redirects smart card devices on connection.\r\n\r\nNote: The client computer must be running at least Microsoft Windows 2000 Server or at least Microsoft Windows XP Professional and the target server must be joined to a domain.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-smart-card"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_smart_card_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_smart_card_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_start_program_2","displayName":"Start a program on connection","description":"Configures Remote Desktop Services to run a specified program automatically upon connection.\r\n\r\nYou can use this setting to specify a program to run automatically when a user logs on to a remote computer.\r\n\r\nBy default, Remote Desktop Services sessions provide access to the full Windows desktop, unless otherwise specified with this setting, by the server administrator, or by the user in configuring the client connection. Enabling this setting overrides the \"Start Program\" settings set by the server administrator or user. The Start menu and Windows Desktop are not displayed, and when the user exits the program the session is automatically logged off.\r\n\r\nTo use this setting, in Program path and file name, type the fully qualified path and file name of the executable file to be run when the user logs on. If necessary, in Working Directory, type the fully qualified path to the starting directory for the program. If you leave Working Directory blank, the program runs with its default working directory. If the specified program path, file name, or working directory is not the name of a valid directory, the RD Session Host server connection fails with an error message.\r\n\r\nIf the status is set to Enabled, Remote Desktop Services sessions automatically run the specified program and use the specified Working Directory (or the program default directory, if Working Directory is not specified) as the working directory for the program.\r\n\r\nIf the status is set to Disabled or Not Configured, Remote Desktop Services sessions start with the full desktop, unless the server administrator or user specify otherwise. (See \"Computer Configuration\\Administrative Templates\\System\\Logon\\Run these programs at user logon\" setting.)\r\n\r\nNote: This setting appears in both Computer Configuration and User Configuration. If both settings are configured, the Computer Configuration setting overrides.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-start-program-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_start_program_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_start_program_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_start_program_2_ts_program_name","displayName":"Program path and file name (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_start_program_2_ts_workdir","displayName":"Working Directory (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_temp_delete","displayName":"Do not delete temp folders upon exit","description":"This policy setting specifies whether Remote Desktop Services retains a user's per-session temporary folders at logoff.\r\n\r\nYou can use this setting to maintain a user's session-specific temporary folders on a remote computer, even if the user logs off from a session. By default, Remote Desktop Services deletes a user's temporary folders when the user logs off.\r\n\r\nIf you enable this policy setting, a user's per-session temporary folders are retained when the user logs off from a session.\r\n\r\nIf you disable this policy setting, temporary folders are deleted when a user logs off, even if the server administrator specifies otherwise.\r\n\r\nIf you do not configure this policy setting, Remote Desktop Services deletes the temporary folders from the remote computer at logoff, unless specified otherwise by the server administrator.\r\n\r\nNote: This setting only takes effect if per-session temporary folders are in use on the server. If you enable the Do not use temporary folders per session policy setting, this policy setting has no effect.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-temp-delete"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_temp_delete_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_temp_delete_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_temp_per_session","displayName":"Do not use temporary folders per session","description":"This policy setting allows you to prevent Remote Desktop Services from creating session-specific temporary folders.\r\n\r\nYou can use this policy setting to disable the creation of separate temporary folders on a remote computer for each session. By default, Remote Desktop Services creates a separate temporary folder for each active session that a user maintains on a remote computer. These temporary folders are created on the remote computer in a Temp folder under the user's profile folder and are named with the sessionid.\r\n\r\nIf you enable this policy setting, per-session temporary folders are not created. Instead, a user's temporary files for all sessions on the remote computer are stored in a common Temp folder under the user's profile folder on the remote computer.\r\n\r\nIf you disable this policy setting, per-session temporary folders are always created, even if the server administrator specifies otherwise.\r\n\r\nIf you do not configure this policy setting, per-session temporary folders are created unless the server administrator specifies otherwise.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-temp-per-session"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_temp_per_session_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_temp_per_session_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_time_zone","displayName":"Allow time zone redirection","description":"This policy setting determines whether the client computer redirects its time zone settings to the Remote Desktop Services session.\r\n\r\nIf you enable this policy setting, clients that are capable of time zone redirection send their time zone information to the server. The server base time is then used to calculate the current session time (current session time = server base time + client time zone).\r\n\r\nIf you disable or do not configure this policy setting, the client computer does not redirect its time zone information and the session time zone is the same as the server time zone.\r\n\r\nNote: Time zone redirection is possible only when connecting to at least a Microsoft Windows Server 2003 terminal server with a client using RDP 5.1 and later.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-time-zone"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_time_zone_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_time_zone_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_tscc_permissions_policy","displayName":"Do not allow local administrators to customize permissions","description":"This policy setting specifies whether to disable the administrator rights to customize security permissions for the Remote Desktop Session Host server. \r\n\r\nYou can use this setting to prevent administrators from making changes to the user groups allowed to connect remotely to the RD Session Host server. By default, administrators are able to make such changes.\r\n\r\nIf you enable this policy setting the default security descriptors for existing groups on the RD Session Host server cannot be changed. All the security descriptors are read-only.\r\n\r\nIf you disable or do not configure this policy setting, server administrators have full read/write permissions to the user security descriptors by using the Remote Desktop Session WMI Provider.\r\n\r\nNote: The preferred method of managing user access is by adding a user to the Remote Desktop Users group.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-tscc-permissions-policy"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_tscc_permissions_policy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_tscc_permissions_policy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_turnoff_singleapp","displayName":"Always show desktop on connection","description":"This policy setting determines whether the desktop is always displayed after a client connects to a remote computer or an initial program can run. It can be used to require that the desktop be displayed after a client connects to a remote computer, even if an initial program is already specified in the default user profile, Remote Desktop Connection, Remote Desktop Services client, or through Group Policy.\r\n\r\nIf you enable this policy setting, the desktop is always displayed when a client connects to a remote computer. This policy setting overrides any initial program policy settings.\r\n\r\nIf you disable or do not configure this policy setting, an initial program can be specified that runs on the remote computer after the client connects to the remote computer. If an initial program is not specified, the desktop is always displayed on the remote computer after the client connects to the remote computer.\r\n\r\nNote: If this policy setting is enabled, then the \"Start a program on connection\" policy setting is ignored.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-turnoff-singleapp"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_turnoff_singleapp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_turnoff_singleapp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_usb_redirection_disable","displayName":"Allow RDP redirection of other supported RemoteFX USB devices from this computer","description":"This policy setting allows you to permit RDP redirection of other supported RemoteFX USB devices from this computer. Redirected RemoteFX USB devices will not be available for local usage on this computer.\r\n\r\nIf you enable this policy setting, you can choose to give the ability to redirect other supported RemoteFX USB devices over RDP to all users or only to users who are in the Administrators group on the computer.\r\n\r\nIf you disable or do not configure this policy setting, other supported RemoteFX USB devices are not available for RDP redirection by using any user account.\r\n\r\nFor this change to take effect, you must restart Windows.\r\n\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-usb-redirection-disable"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_usb_redirection_disable_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_usb_redirection_disable_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_usb_redirection_disable_usbaccessright","displayName":"RemoteFX USB Redirection Access Rights (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_usb_redirection_disable_usbaccessright_1","displayName":"Adminstrators Only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_usb_redirection_disable_usbaccessright_2","displayName":"Adminstrators and Users","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_authentication_policy","displayName":"Require user authentication for remote connections by using Network Level Authentication","description":"This policy setting allows you to specify whether to require user authentication for remote connections to the RD Session Host server by using Network Level Authentication. This policy setting enhances security by requiring that user authentication occur earlier in the remote connection process.\r\n\r\nIf you enable this policy setting, only client computers that support Network Level Authentication can connect to the RD Session Host server.\r\n\r\nTo determine whether a client computer supports Network Level Authentication, start Remote Desktop Connection on the client computer, click the icon in the upper-left corner of the Remote Desktop Connection dialog box, and then click About. In the About Remote Desktop Connection dialog box, look for the phrase Network Level Authentication supported.\r\n\r\nIf you disable this policy setting, Network Level Authentication is not required for user authentication before allowing remote connections to the RD Session Host server.\r\n\r\nIf you do not configure this policy setting, the local setting on the target computer will be enforced. On Windows Server 2012 and Windows 8, Network Level Authentication is enforced by default.\r\n\r\nImportant: Disabling this policy setting provides less security because user authentication will occur later in the remote connection process.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-user-authentication-policy"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_authentication_policy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_authentication_policy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home","displayName":"Set Remote Desktop Services User Home Directory","description":"Specifies whether Remote Desktop Services uses the specified network share or local directory path as the root of the user's home directory for a Remote Desktop Services session.\r\n\r\nTo use this setting, select the location for the home directory (network or local) from the Location drop-down list. If you choose to place the directory on a network share, type the Home Dir Root Path in the form \\\\Computername\\Sharename, and then select the drive letter to which you want the network share to be mapped.\r\n\r\nIf you choose to keep the home directory on the local computer, type the Home Dir Root Path in the form \"Drive:\\Path\" (without quotes), without environment variables or ellipses. Do not specify a placeholder for user alias, because Remote Desktop Services automatically appends this at logon.\r\n\r\nNote: The Drive Letter field is ignored if you choose to specify a local path. If you choose to specify a local path but then type the name of a network share in Home Dir Root Path, Remote Desktop Services places user home directories in the network location.\r\n\r\nIf the status is set to Enabled, Remote Desktop Services creates the user's home directory in the specified location on the local computer or the network. The home directory path for each user is the specified Home Dir Root Path and the user's alias.\r\n\r\nIf the status is set to Disabled or Not Configured, the user's home directory is as specified at the server.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-user-home"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter","displayName":"Drive Letter (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_g:","displayName":"G:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_h:","displayName":"H:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_i:","displayName":"I:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_j:","displayName":"J:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_k:","displayName":"K:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_l:","displayName":"L:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_m:","displayName":"M:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_n:","displayName":"N:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_o:","displayName":"O:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_p:","displayName":"P:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_q:","displayName":"Q:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_r:","displayName":"R:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_s:","displayName":"S:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_t:","displayName":"T:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_u:","displayName":"U:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_v:","displayName":"V:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_w:","displayName":"W:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_x:","displayName":"X:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_y:","displayName":"Y:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_drive_letter_z:","displayName":"Z:","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_home_dir","displayName":"Home Dir Root Path: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_user_home_location","displayName":"Location: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_user_home_location_1","displayName":"On the Network","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_home_ts_user_home_location_0","displayName":"On the Local machine","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_mandatory_profiles","displayName":"Use mandatory profiles on the RD Session Host server","description":"This policy setting allows you to specify whether Remote Desktop Services uses a mandatory profile for all users connecting remotely to the RD Session Host server.\r\n\r\nIf you enable this policy setting, Remote Desktop Services uses the path specified in the \"Set path for Remote Desktop Services Roaming User Profile\" policy setting as the root folder for the mandatory user profile. All users connecting remotely to the RD Session Host server use the same user profile.\r\n\r\nIf you disable or do not configure this policy setting, mandatory user profiles are not used by users connecting remotely to the RD Session Host server.\r\n\r\nNote:\r\n\r\nFor this policy setting to take effect, you must also enable and configure the \"Set path for Remote Desktop Services Roaming User Profile\" policy setting.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-user-mandatory-profiles"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_mandatory_profiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_mandatory_profiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_profiles","displayName":"Set path for Remote Desktop Services Roaming User Profile","description":"This policy setting allows you to specify the network path that Remote Desktop Services uses for roaming user profiles.\r\n\r\nBy default, Remote Desktop Services stores all user profiles locally on the RD Session Host server. You can use this policy setting to specify a network share where user profiles can be centrally stored, allowing a user to access the same profile for sessions on all RD Session Host servers that are configured to use the network share for user profiles.\r\n\r\nIf you enable this policy setting, Remote Desktop Services uses the specified path as the root directory for all user profiles. The profiles are contained in subfolders named for the account name of each user.\r\n\r\nTo configure this policy setting, type the path to the network share in the form of \\\\Computername\\Sharename. Do not specify a placeholder for the user account name, because Remote Desktop Services automatically adds this when the user logs on and the profile is created. If the specified network share does not exist, Remote Desktop Services displays an error message on the RD Session Host server and will store the user profiles locally on the RD Session Host server.\r\n\r\nIf you disable or do not configure this policy setting, user profiles are stored locally on the RD Session Host server. You can configure a user's profile path on the Remote Desktop Services Profile tab on the user's account Properties dialog box.\r\n\r\nNotes:\r\n1. The roaming user profiles enabled by the policy setting apply only to Remote Desktop Services connections. A user might also have a Windows roaming user profile configured. The Remote Desktop Services roaming user profile always takes precedence in a Remote Desktop Services session.\r\n2. To configure a mandatory Remote Desktop Services roaming user profile for all users connecting remotely to the RD Session Host server, use this policy setting together with the \"Use mandatory profiles on the RD Session Host server\" policy setting located in Computer Configuration\\Administrative Templates\\Windows Components\\Remote Desktop Services\\RD Session Host\\Profiles. The path set in the \"Set path for Remote Desktop Services Roaming User Profile\" policy setting should contain the mandatory profile.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver#admx-terminalserver-ts-user-profiles"],"options":[{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_profiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_profiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_terminalserver_ts_user_profiles_ts_profile_path","displayName":"Profile path (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_touchinput_panningeverywhereoff_2","displayName":"Turn off Touch Panning","description":"Turn off Panning \r\nTurns off touch panning, which allows users pan inside windows by touch. On a compatible PC with a touch digitizer, by default users are able to scroll or pan inside a scrolling area by dragging up or down directly on the scrolling content.\r\n\r\nIf you enable this setting, the user will not be able to pan windows by touch. \r\n\r\nIf you disable this setting, the user can pan windows by touch.\r\n\r\nIf you do not configure this setting, Touch Panning is on by default.\r\n\r\nNote: Changes to this setting will not take effect until the user logs off.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-touchinput#admx-touchinput-panningeverywhereoff-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_touchinput_panningeverywhereoff_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_touchinput_panningeverywhereoff_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_touchinput_touchinputoff_2","displayName":"Turn off Tablet PC touch input","description":"Turn off Tablet PC touch input\r\n\r\nTurns off touch input, which allows the user to interact with their computer using their finger.\r\n\r\nIf you enable this setting, the user will not be able to produce input with touch. They will not be able to use touch input or touch gestures such as tap and double tap, the touch pointer, and other touch-specific features.\r\n\r\nIf you disable this setting, the user can produce input with touch, by using gestures, the touch pointer, and other-touch specific features.\r\n\r\nIf you do not configure this setting, touch input is on by default.\r\n\r\nNote: Changes to this setting will not take effect until the user logs off.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-touchinput#admx-touchinput-touchinputoff-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_touchinput_touchinputoff_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_touchinput_touchinputoff_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tpm_blockedcommandslist_name","displayName":"Configure the list of blocked TPM commands","description":"This policy setting allows you to manage the Group Policy list of Trusted Platform Module (TPM) commands blocked by Windows.\r\n\r\nIf you enable this policy setting, Windows will block the specified commands from being sent to the TPM on the computer. TPM commands are referenced by a command number. For example, command number 129 is TPM_OwnerReadInternalPub, and command number 170 is TPM_FieldUpgrade. To find the command number associated with each TPM command with TPM 1.2, run \"tpm.msc\" and navigate to the \"Command Management\" section.\r\n\r\nIf you disable or do not configure this policy setting, only those TPM commands specified through the default or local lists may be blocked by Windows. The default list of blocked TPM commands is pre-configured by Windows. You can view the default list by running \"tpm.msc\", navigating to the \"Command Management\" section, and making visible the \"On Default Block List\" column. The local list of blocked TPM commands is configured outside of Group Policy by running \"tpm.msc\" or through scripting against the Win32_Tpm interface. See related policy settings to enforce or ignore the default and local lists of blocked TPM commands.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tpm#admx-tpm-blockedcommandslist-name"],"options":[{"id":"device_vendor_msft_policy_config_admx_tpm_blockedcommandslist_name_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tpm_blockedcommandslist_name_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tpm_blockedcommandslist_name_blockedcommandslist_ordinals2","displayName":"The list of blocked TPM commands: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_tpm_cleartpmifnotready_name","displayName":"Configure the system to clear the TPM if it is not in a ready state.","description":"This policy setting configures the system to prompt the user to clear the TPM if the TPM is detected to be in any state other than Ready. This policy will take effect only if the system’s TPM is in a state other than Ready, including if the TPM is “Ready, with reduced functionality”. The prompt to clear the TPM will start occurring after the next reboot, upon user login only if the logged in user is part of the Administrators group for the system. The prompt can be dismissed, but will reappear after every reboot and login until the policy is disabled or until the TPM is in a Ready state.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tpm#admx-tpm-cleartpmifnotready-name"],"options":[{"id":"device_vendor_msft_policy_config_admx_tpm_cleartpmifnotready_name_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tpm_cleartpmifnotready_name_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tpm_ignoredefaultlist_name","displayName":"Ignore the default list of blocked TPM commands","description":"This policy setting allows you to enforce or ignore the computer's default list of blocked Trusted Platform Module (TPM) commands.\r\n\r\nIf you enable this policy setting, Windows will ignore the computer's default list of blocked TPM commands and will only block those TPM commands specified by Group Policy or the local list.\r\n\r\nThe default list of blocked TPM commands is pre-configured by Windows. You can view the default list by running \"tpm.msc\", navigating to the \"Command Management\" section, and making visible the \"On Default Block List\" column. The local list of blocked TPM commands is configured outside of Group Policy by running \"tpm.msc\" or through scripting against the Win32_Tpm interface. See the related policy setting to configure the Group Policy list of blocked TPM commands.\r\n\r\nIf you disable or do not configure this policy setting, Windows will block the TPM commands in the default list, in addition to commands in the Group Policy and local lists of blocked TPM commands. \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tpm#admx-tpm-ignoredefaultlist-name"],"options":[{"id":"device_vendor_msft_policy_config_admx_tpm_ignoredefaultlist_name_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tpm_ignoredefaultlist_name_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tpm_ignorelocallist_name","displayName":"Ignore the local list of blocked TPM commands","description":"This policy setting allows you to enforce or ignore the computer's local list of blocked Trusted Platform Module (TPM) commands.\r\n\r\nIf you enable this policy setting, Windows will ignore the computer's local list of blocked TPM commands and will only block those TPM commands specified by Group Policy or the default list.\r\n\r\nThe local list of blocked TPM commands is configured outside of Group Policy by running \"tpm.msc\" or through scripting against the Win32_Tpm interface. The default list of blocked TPM commands is pre-configured by Windows. See the related policy setting to configure the Group Policy list of blocked TPM commands.\r\n\r\nIf you disable or do not configure this policy setting, Windows will block the TPM commands found in the local list, in addition to commands in the Group Policy and default lists of blocked TPM commands.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tpm#admx-tpm-ignorelocallist-name"],"options":[{"id":"device_vendor_msft_policy_config_admx_tpm_ignorelocallist_name_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tpm_ignorelocallist_name_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tpm_optintodsha_name","displayName":"Enable Device Health Attestation Monitoring and Reporting","description":"This group policy enables Device Health Attestation reporting (DHA-report) on supported devices. It enables supported devices to send Device Health Attestation related information (device boot logs, PCR values, TPM certificate, etc.) to Device Health Attestation Service (DHA-Service) every time a device starts. Device Health Attestation Service validates the security state and health of the devices, and makes the findings accessible to enterprise administrators via a cloud based reporting portal. This policy is independent of DHA reports that are initiated by device manageability solutions (like MDM or SCCM), and will not interfere with their workflows.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tpm#admx-tpm-optintodsha-name"],"options":[{"id":"device_vendor_msft_policy_config_admx_tpm_optintodsha_name_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tpm_optintodsha_name_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tpm_osmanagedauth_name","displayName":"Configure the level of TPM owner authorization information available to the operating system","description":"This policy setting configures how much of the TPM owner authorization information is stored in the registry of the local computer. Depending on the amount of TPM owner authorization information stored locally, the operating system and TPM-based applications can perform certain TPM actions which require TPM owner authorization without requiring the user to enter the TPM owner password.\r\n\r\nYou can choose to have the operating system store either the full TPM owner authorization value, the TPM administrative delegation blob plus the TPM user delegation blob, or none.\r\n\r\nIf you enable this policy setting, Windows will store the TPM owner authorization in the registry of the local computer according to the operating system managed TPM authentication setting you choose.\r\n\r\nChoose the operating system managed TPM authentication setting of \"Full\" to store the full TPM owner authorization, the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting allows use of the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios which do not depend on preventing reset of the TPM anti-hammering logic or changing the TPM owner authorization value. Some TPM-based applications may require this setting be changed before features which depend on the TPM anti-hammering logic can be used.\r\n\r\nChoose the operating system managed TPM authentication setting of \"Delegated\" to store only the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is appropriate for use with TPM-based applications that depend on the TPM anti-hammering logic.\r\n\r\nChoose the operating system managed TPM authentication setting of \"None\" for compatibility with previous operating systems and applications or for use with scenarios that require TPM owner authorization not be stored locally. Using this setting might cause issues with some TPM-based applications.\r\n\r\nNote: If the operating system managed TPM authentication setting is changed from \"Full\" to \"Delegated\", the full TPM owner authorization value will be regenerated and any copies of the original TPM owner authorization value will be invalid.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tpm#admx-tpm-osmanagedauth-name"],"options":[{"id":"device_vendor_msft_policy_config_admx_tpm_osmanagedauth_name_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tpm_osmanagedauth_name_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tpm_osmanagedauth_name_selectosmanagedauthlevel","displayName":"Operating system managed TPM authentication level: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_tpm_osmanagedauth_name_selectosmanagedauthlevel_4","displayName":"Full","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tpm_osmanagedauth_name_selectosmanagedauthlevel_2","displayName":"Delegated","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tpm_osmanagedauth_name_selectosmanagedauthlevel_0","displayName":"None","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tpm_standarduserauthorizationfailureduration_name","displayName":"Standard User Lockout Duration","description":"This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for Trusted Platform Module (TPM) commands requiring authorization. If the number of TPM commands with an authorization failure within the duration equals a threshold, a standard user is prevented from sending commands requiring authorization to the TPM.\r\n\r\nThis setting helps administrators prevent the TPM hardware from entering a lockout mode because it slows the speed standard users can send commands requiring authorization to the TPM.\r\n\r\nAn authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than this duration are ignored.\r\n\r\nFor each standard user two thresholds apply. Exceeding either threshold will prevent the standard user from sending a command to the TPM that requires authorization.\r\n\r\nThe Standard User Lockout Threshold Individual value is the maximum number of authorization failures each standard user may have before the user is not allowed to send commands requiring authorization to the TPM.\r\n\r\nThe Standard User Lockout Total Threshold value is the maximum total number of authorization failures all standard users may have before all standard users are not allowed to send commands requiring authorization to the TPM.\r\n\r\nThe TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode it is global for all users including administrators and Windows features like BitLocker Drive Encryption. The number of authorization failures a TPM allows and how long it stays locked out vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time with fewer authorization failures depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require the system to be on so enough clock cycles elapse before the TPM exits the lockout mode.\r\n\r\nAn administrator with the TPM owner password may fully reset the TPM's hardware lockout logic using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic all prior standard user TPM authorization failures are ignored; allowing standard users to use the TPM normally again immediately.\r\n\r\nIf this value is not configured, a default value of 480 minutes (8 hours) is used.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tpm#admx-tpm-standarduserauthorizationfailureduration-name"],"options":[{"id":"device_vendor_msft_policy_config_admx_tpm_standarduserauthorizationfailureduration_name_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tpm_standarduserauthorizationfailureduration_name_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tpm_standarduserauthorizationfailureduration_name_dxt_standarduserauthorizationfailureduration_name","displayName":"Duration for counting TPM authorization failures (minutes): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_tpm_standarduserauthorizationfailureindividualthreshold_name","displayName":"Standard User Individual Lockout Threshold","description":"This policy setting allows you to manage the maximum number of authorization failures for each standard user for the Trusted Platform Module (TPM). If the number of authorization failures for the user within the duration for Standard User Lockout Duration equals this value, the standard user is prevented from sending commands to the Trusted Platform Module (TPM) that require authorization.\r\n\r\nThis setting helps administrators prevent the TPM hardware from entering a lockout mode because it slows the speed standard users can send commands requiring authorization to the TPM.\r\n\r\nAn authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than the duration are ignored.\r\n\r\nFor each standard user two thresholds apply. Exceeding either threshold will prevent the standard user from sending a command to the TPM that requires authorization.\r\n\r\nThis value is the maximum number of authorization failures each standard user may have before the user is not allowed to send commands requiring authorization to the TPM.\r\n\r\nThe Standard User Lockout Total Threshold value is the maximum total number of authorization failures all standard users may have before all standard users are not allowed to send commands requiring authorization to the TPM.\r\n\r\nThe TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode it is global for all users including administrators and Windows features like BitLocker Drive Encryption. The number of authorization failures a TPM allows and how long it stays locked out vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time with fewer authorization failures depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require the system to be on so enough clock cycles elapse before the TPM exits the lockout mode.\r\n\r\nAn administrator with the TPM owner password may fully reset the TPM's hardware lockout logic using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic all prior standard user TPM authorization failures are ignored; allowing standard users to use the TPM normally again immediately.\r\n\r\nIf this value is not configured, a default value of 4 is used.\r\n\r\nA value of zero means the OS will not allow standard users to send commands to the TPM which may cause an authorization failure.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tpm#admx-tpm-standarduserauthorizationfailureindividualthreshold-name"],"options":[{"id":"device_vendor_msft_policy_config_admx_tpm_standarduserauthorizationfailureindividualthreshold_name_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tpm_standarduserauthorizationfailureindividualthreshold_name_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tpm_standarduserauthorizationfailureindividualthreshold_name_dxt_standarduserauthorizationfailureindividualthreshold_name","displayName":"Maximum number of authorization failures per duration: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_tpm_standarduserauthorizationfailuretotalthreshold_name","displayName":"Standard User Total Lockout Threshold","description":"This policy setting allows you to manage the maximum number of authorization failures for all standard users for the Trusted Platform Module (TPM). If the total number of authorization failures for all standard users within the duration for Standard User Lockout Duration equals this value, all standard users are prevented from sending commands to the Trusted Platform Module (TPM) that require authorization.\r\n\r\nThis setting helps administrators prevent the TPM hardware from entering a lockout mode because it slows the speed standard users can send commands requiring authorization to the TPM.\r\n\r\nAn authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than the duration are ignored.\r\n\r\nFor each standard user two thresholds apply. Exceeding either threshold will prevent the standard user from sending a command to the TPM that requires authorization.\r\n\r\nThe Standard User Individual Lockout value is the maximum number of authorization failures each standard user may have before the user is not allowed to send commands requiring authorization to the TPM.\r\n\r\nThis value is the maximum total number of authorization failures all standard users may have before all standard users are not allowed to send commands requiring authorization to the TPM.\r\n\r\nThe TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode it is global for all users including administrators and Windows features like BitLocker Drive Encryption. The number of authorization failures a TPM allows and how long it stays locked out vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time with fewer authorization failures depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require the system to be on so enough clock cycles elapse before the TPM exits the lockout mode.\r\n\r\nAn administrator with the TPM owner password may fully reset the TPM's hardware lockout logic using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic all prior standard user TPM authorization failures are ignored; allowing standard users to use the TPM normally again immediately.\r\n\r\nIf this value is not configured, a default value of 9 is used.\r\n\r\nA value of zero means the OS will not allow standard users to send commands to the TPM which may cause an authorization failure.\r\n\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tpm#admx-tpm-standarduserauthorizationfailuretotalthreshold-name"],"options":[{"id":"device_vendor_msft_policy_config_admx_tpm_standarduserauthorizationfailuretotalthreshold_name_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tpm_standarduserauthorizationfailuretotalthreshold_name_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_tpm_standarduserauthorizationfailuretotalthreshold_name_dxt_standarduserauthorizationfailuretotalthreshold_name","displayName":"Maximum number of authorization failures per duration: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_tpm_uselegacydap_name","displayName":"Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0.","description":"This policy setting configures the TPM to use the Dictionary Attack Prevention Parameters (lockout threshold and recovery time) to the values that were used for Windows 10 Version 1607 and below. Setting this policy will take effect only if a) the TPM was originally prepared using a version of Windows after Windows 10 Version 1607 and b) the System has a TPM 2.0. Note that enabling this policy will only take effect after the TPM maintenance task runs (which typically happens after a system restart). Once this policy has been enabled on a system and has taken effect (after a system restart), disabling it will have no impact and the system's TPM will remain configured using the legacy Dictionary Attack Prevention parameters, regardless of the value of this group policy. The only way for the disabled setting of this policy to take effect on a system where it was once enabled is to a) disable it from group policy and b)clear the TPM on the system.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-tpm#admx-tpm-uselegacydap-name"],"options":[{"id":"device_vendor_msft_policy_config_admx_tpm_uselegacydap_name_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_tpm_uselegacydap_name_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_calculator","displayName":"Calculator","description":"This policy setting configures the synchronization of user settings of Calculator.\r\nBy default, the user settings of Calculator synchronize between computers. Use the policy setting to prevent the user settings of Calculator from synchronization between computers. \r\nIf you enable this policy setting, the Calculator user settings continue to synchronize. \r\nIf you disable this policy setting, Calculator user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-calculator"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_calculator_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_calculator_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_configuresyncmethod","displayName":"Configure Sync Method","description":"This policy setting configures the sync provider used by User Experience Virtualization (UE-V) to sync settings between users’ computers. With Sync Method set to ”SyncProvider,” the UE-V Agent uses a built-in sync provider to keep user settings synchronized between the computer and the settings storage location. This is the default value. You can disable the sync provider on computers that never go offline and are always connected to the settings storage location.\r\nWhen SyncMethod is set to “None,” the UE-V Agent uses no sync provider. Settings are written directly to the settings storage location rather than being cached to sync later. \r\nSet SyncMethod to “External” when an external synchronization engine is being deployed for settings sync. This could use OneDrive, Work Folders, SharePoint or any other engine that uses a local folder to synchronize data between users’ computers. In this mode, UE-V writes settings data to the local folder specified in the settings storage path. These settings are then synchronized to other computers by an external synchronization engine. UE-V has no control over this synchronization. It only reads and writes the settings data when the normal UE-V triggers take place.\r\nWith notifications enabled, UE-V users receive a message when the settings sync is delayed. The notification delay policy setting defines the delay before a notification appears.\r\nIf you disable this policy setting, the sync provider is used to synchronize settings between computers and the settings storage location.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-configuresyncmethod"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_configuresyncmethod_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_configuresyncmethod_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_configuresyncmethod_settingsimportnotification_delay","displayName":"Notification delay (in seconds): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_configuresyncmethod_settingsimportnotification_enable","displayName":"Enable notification (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_configuresyncmethod_settingsimportnotification_enable_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_configuresyncmethod_settingsimportnotification_enable_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_configuresyncmethod_syncmethodconfiguration_list","displayName":"Sync Method: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_configuresyncmethod_syncmethodconfiguration_list_syncprovider","displayName":"SyncProvider","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_configuresyncmethod_syncmethodconfiguration_list_none","displayName":"None","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_configuresyncmethod_syncmethodconfiguration_list_external","displayName":"External","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_configurevdi","displayName":"VDI Configuration","description":"This policy setting configures the synchronization of User Experience Virtualization (UE-V) rollback information for computers running in a non-persistent, pooled VDI environment. UE-V settings rollback data and checkpoints are normally stored only on the local computer. With this policy setting enabled, the rollback information is copied to the settings storage location when the user logs off or shuts down their VDI session. Enable this setting to register a VDI-specific settings location template and restore data on computers in pooled VDI environments that reset to a clean state on logout. With this policy enabled you can roll settings back to the state when UE-V was installed or to “last-known-good” configurations. Only enable this policy setting on computers running in a non-persistent VDI environment. The VDI Collection Name defines the name of the virtual desktop collection containing the virtual computers. \r\nIf you enable this policy setting, the UE-V rollback state is copied to the settings storage location on logout and restored on login.\r\nIf you disable this policy setting, no UE-V rollback state is copied to the settings storage location.\r\nIf you do not configure this policy, no UE-V rollback state is copied to the settings storage location.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-configurevdi"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_configurevdi_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_configurevdi_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_configurevdi_vdicollectionname","displayName":"VDI Collection Name: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_contactitdescription","displayName":"Contact IT Link Text","description":"This policy setting specifies the text of the Contact IT URL hyperlink in the Company Settings Center.\r\nIf you enable this policy setting, the Company Settings Center displays the specified text in the link to the Contact IT URL.\r\nIf you disable this policy setting, the Company Settings Center does not display an IT Contact link.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-contactitdescription"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_contactitdescription_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_contactitdescription_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_contactitdescription_contactitdescription","displayName":"Contact IT Link Text (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_contactiturl","displayName":"Contact IT URL","description":"This policy setting specifies the URL for the Contact IT link in the Company Settings Center.\r\nIf you enable this policy setting, the Company Settings Center Contact IT text links to the specified URL. The link can be of any standard protocol such as http or mailto. \r\nIf you disable this policy setting, the Company Settings Center does not display an IT Contact link.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-contactiturl"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_contactiturl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_contactiturl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_contactiturl_contactiturl","displayName":"Contact IT URL (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewin8sync","displayName":"Do not synchronize Windows Apps","description":"This policy setting defines whether the User Experience Virtualization (UE-V) Agent synchronizes settings for Windows apps.\r\nBy default, the UE-V Agent synchronizes settings for Windows apps between the computer and the settings storage location. \r\nIf you enable this policy setting, the UE-V Agent will not synchronize settings for Windows apps.\r\nIf you disable this policy setting, the UE-V Agent will synchronize settings for Windows apps. \r\nIf you do not configure this policy setting, any defined values are deleted.\r\nNote: If the user connects their Microsoft account for their computer then the UE-V Agent will not synchronize Windows apps. The Windows apps will default to whatever settings are configured in the Sync your settings configuration in Windows.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-disablewin8sync"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewin8sync_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewin8sync_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewindowsossettings","displayName":"Synchronize Windows settings","description":"\r\nThis policy setting configures the synchronization of Windows settings between computers.\r\nCertain Windows settings will synchronize between computers by default. These settings include Windows themes, Windows desktop settings, Ease of Access settings, and network printers. Use this policy setting to specify which Windows settings synchronize between computers. You can also use these settings to enable synchronization of users' sign-in information for certain apps, networks, and certificates.\r\nIf you enable this policy setting, only the selected Windows settings synchronize. Unselected Windows settings are excluded from settings synchronization.\r\nIf you disable this policy setting, all Windows Settings are excluded from the settings synchronization.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-disablewindowsossettings"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewindowsossettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewindowsossettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewindowsossettings_desktopsettings","displayName":"Desktop settings (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewindowsossettings_desktopsettings_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewindowsossettings_desktopsettings_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewindowsossettings_easeofaccesssettings","displayName":"Ease of access (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewindowsossettings_easeofaccesssettings_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewindowsossettings_easeofaccesssettings_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewindowsossettings_networkprinters","displayName":"Network Printers (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewindowsossettings_networkprinters_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewindowsossettings_networkprinters_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewindowsossettings_roamingcredentialsettings","displayName":"Roaming Credentials (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewindowsossettings_roamingcredentialsettings_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewindowsossettings_roamingcredentialsettings_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewindowsossettings_themesettings","displayName":"Themes (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewindowsossettings_themesettings_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_disablewindowsossettings_themesettings_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_enableuev","displayName":"Enable UEV","description":"This policy setting allows you to enable or disable User Experience Virtualization (UE-V) feature. Reboot is needed for enable to take effect. With Auto-register inbox templates enabled, the UE-V inbox templates such as Office 2016 will be automatically registered when the UE-V Service is enabled. If this option is changed, it will only take effect when UE-V service is re-enabled.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-enableuev"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_enableuev_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_enableuev_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_enableuev_registerinboxtemplates","displayName":"Auto-register inbox templates (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_enableuev_registerinboxtemplates_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_enableuev_registerinboxtemplates_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_finance","displayName":"Finance","description":"This policy setting configures the synchronization of user settings for the Finance app.\r\nBy default, the user settings of Finance sync between computers. Use the policy setting to prevent the user settings of Finance from synchronizing between computers.\r\nIf you enable this policy setting, Finance user settings continue to sync.\r\nIf you disable this policy setting, Finance user settings are excluded from synchronization.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-finance"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_finance_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_finance_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_firstusenotificationenabled","displayName":"First Use Notification","description":"This policy setting enables a notification in the system tray that appears when the User Experience Virtualization (UE-V) Agent runs for the first time.\r\nBy default, a notification informs users that Company Settings Center, the user-facing name for the UE-V Agent, now helps to synchronize settings between their work computers.\r\nWith this setting enabled, the notification appears the first time that the UE-V Agent runs.\r\nWith this setting disabled, no notification appears.\r\nIf you do not configure this policy setting, any defined values are deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-firstusenotificationenabled"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_firstusenotificationenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_firstusenotificationenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_games","displayName":"Games","description":"This policy setting configures the synchronization of user settings for the Games app.\r\nBy default, the user settings of Games sync between computers. Use the policy setting to prevent the user settings of Games from synchronizing between computers.\r\nIf you enable this policy setting, Games user settings continue to sync.\r\nIf you disable this policy setting, Games user settings are excluded from synchronization.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-games"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_games_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_games_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_internetexplorer10","displayName":"Internet Explorer 10","description":"This policy setting configures the synchronization of user settings of Internet Explorer 10.\r\nBy default, the user settings of Internet Explorer 10 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 10 from synchronization between computers. \r\nIf you enable this policy setting, the Internet Explorer 10 user settings continue to synchronize. \r\nIf you disable this policy setting, Internet Explorer 10 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-internetexplorer10"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_internetexplorer10_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_internetexplorer10_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_internetexplorer11","displayName":"Internet Explorer 11","description":"This policy setting configures the synchronization of user settings of Internet Explorer 11.\r\nBy default, the user settings of Internet Explorer 11 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 11 from synchronization between computers.\r\nIf you enable this policy setting, the Internet Explorer 11 user settings continue to synchronize.\r\nIf you disable this policy setting, Internet Explorer 11 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-internetexplorer11"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_internetexplorer11_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_internetexplorer11_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_internetexplorer8","displayName":"Internet Explorer 8","description":"This policy setting configures the synchronization of user settings for Internet Explorer 8.\r\nBy default, the user settings of Internet Explorer 8 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 8 from synchronization between computers. \r\nIf you enable this policy setting, the Internet Explorer 8 user settings continue to synchronize. \r\nIf you disable this policy setting, Internet Explorer 8 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-internetexplorer8"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_internetexplorer8_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_internetexplorer8_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_internetexplorer9","displayName":"Internet Explorer 9","description":"This policy setting configures the synchronization of user settings for Internet Explorer 9.\r\nBy default, the user settings of Internet Explorer 9 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 9 from synchronization between computers. \r\nIf you enable this policy setting, the Internet Explorer 9 user settings continue to synchronize. \r\nIf you disable this policy setting, Internet Explorer 9 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-internetexplorer9"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_internetexplorer9_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_internetexplorer9_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_internetexplorercommon","displayName":"Internet Explorer Common Settings","description":"This policy setting configures the synchronization of user settings which are common between the versions of Internet Explorer.\r\nBy default, the user settings which are common between the versions of Internet Explorer synchronize between computers. Use the policy setting to prevent the user settings of Internet Explorer from synchronization between computers. \r\nIf you enable this policy setting, the user settings which are common between the versions of Internet Explorer continue to synchronize.\r\nIf you disable this policy setting, the user settings which are common between the versions of Internet Explorer are excluded from settings synchronization. If any version of the Internet Explorer settings are enabled this policy setting should not be disabled.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-internetexplorercommon"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_internetexplorercommon_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_internetexplorercommon_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_maps","displayName":"Maps","description":"This policy setting configures the synchronization of user settings for the Maps app.\r\nBy default, the user settings of Maps sync between computers. Use the policy setting to prevent the user settings of Maps from synchronizing between computers.\r\nIf you enable this policy setting, Maps user settings continue to sync.\r\nIf you disable this policy setting, Maps user settings are excluded from synchronization.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-maps"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_maps_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_maps_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_maxpackagesizeinbytes","displayName":"Settings package size warning threshold","description":"This policy setting allows you to configure the UE-V Agent to write a warning event to the event log when a settings package file size reaches a defined threshold. By default the UE-V Agent does not report information about package file size. \r\nIf you enable this policy setting, specify the threshold file size in bytes. When the settings package file exceeds this threshold the UE-V Agent will write a warning event to the event log.\r\nIf you disable or do not configure this policy setting, no event is written to the event log to report settings package size.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-maxpackagesizeinbytes"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_maxpackagesizeinbytes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_maxpackagesizeinbytes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_maxpackagesizeinbytes_maxpackagesizeinbytes","displayName":"Package size threshold (in bytes): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010access","displayName":"Microsoft Access 2010","description":"This policy setting configures the synchronization of user settings for Microsoft Access 2010.\r\nBy default, the user settings of Microsoft Access 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Access 2010 from synchronization between computers. \r\nIf you enable this policy setting, Microsoft Access 2010 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Access 2010 user settings are excluded from the synchronization settings. \r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2010access"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010access_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010access_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010common","displayName":"Microsoft Office 2010 Common Settings","description":"This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2010 applications.\r\nBy default, the user settings which are common between the Microsoft Office Suite 2010 applications synchronize between computers. Use the policy setting to prevent the user settings which are common between the Microsoft Office Suite 2010 applications from synchronization between computers. \r\nIf you enable this policy setting, the user settings which are common between the Microsoft Office Suite 2010 applications continue to synchronize.\r\nIf you disable this policy setting, the user settings which are common between the Microsoft Office Suite 2010 applications are excluded from the synchronization settings. If any of the Microsoft Office Suite 2010 applications are enabled, this policy setting should not be disabled \r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2010common"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010common_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010common_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010excel","displayName":"Microsoft Excel 2010","description":"This policy setting configures the synchronization of user settings for Microsoft Excel 2010.\r\nBy default, the user settings of Microsoft Excel 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Excel 2010 from synchronization between computers. \r\nIf you enable this policy setting, Microsoft Excel 2010 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Excel 2010 user settings are excluded from the synchronization settings. \r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2010excel"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010excel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010excel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010infopath","displayName":"Microsoft InfoPath 2010","description":"This policy setting configures the synchronization of user settings for Microsoft InfoPath 2010.\r\nBy default, the user settings of Microsoft InfoPath 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft InfoPath 2010 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft InfoPath 2010 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft InfoPath 2010 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2010infopath"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010infopath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010infopath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010lync","displayName":"Microsoft Lync 2010","description":"This policy setting configures the synchronization of user settings for Microsoft Lync 2010.\r\nBy default, the user settings of Microsoft Lync 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Lync 2010 from synchronization between computers. \r\nIf you enable this policy setting, Microsoft Lync 2010 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Lync 2010 user settings are excluded from the synchronization settings. \r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2010lync"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010lync_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010lync_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010onenote","displayName":"Microsoft OneNote 2010","description":"This policy setting configures the synchronization of user settings for Microsoft OneNote 2010.\r\nBy default, the user settings of Microsoft OneNote 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft OneNote 2010 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft OneNote 2010 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft OneNote 2010 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2010onenote"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010onenote_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010onenote_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010outlook","displayName":"Microsoft Outlook 2010","description":"This policy setting configures the synchronization of user settings for Microsoft Outlook 2010.\r\nBy default, the user settings of Microsoft Outlook 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Outlook 2010 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Outlook 2010 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Outlook 2010 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2010outlook"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010outlook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010outlook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010powerpoint","displayName":"Microsoft PowerPoint 2010","description":"This policy setting configures the synchronization of user settings for Microsoft PowerPoint 2010.\r\nBy default, the user settings of Microsoft PowerPoint 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft PowerPoint 2010 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft PowerPoint 2010 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft PowerPoint 2010 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2010powerpoint"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010powerpoint_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010powerpoint_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010project","displayName":"Microsoft Project 2010","description":"This policy setting configures the synchronization of user settings for Microsoft Project 2010.\r\nBy default, the user settings of Microsoft Project 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Project 2010 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Project 2010 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Project 2010 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2010project"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010project_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010project_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010publisher","displayName":"Microsoft Publisher 2010","description":"This policy setting configures the synchronization of user settings for Microsoft Publisher 2010.\r\nBy default, the user settings of Microsoft Publisher 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Publisher 2010 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Publisher 2010 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Publisher 2010 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2010publisher"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010publisher_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010publisher_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010sharepointdesigner","displayName":"Microsoft SharePoint Designer 2010","description":"This policy setting configures the synchronization of user settings for Microsoft SharePoint Designer 2010.\r\nBy default, the user settings of Microsoft SharePoint Designer 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft SharePoint Designer 2010 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft SharePoint Designer 2010 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft SharePoint Designer 2010 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2010sharepointdesigner"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010sharepointdesigner_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010sharepointdesigner_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010sharepointworkspace","displayName":"Microsoft SharePoint Workspace 2010","description":"This policy setting configures the synchronization of user settings for Microsoft SharePoint Workspace 2010.\r\nBy default, the user settings of Microsoft SharePoint Workspace 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft SharePoint Workspace 2010 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft SharePoint Workspace 2010 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft SharePoint Workspace 2010 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2010sharepointworkspace"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010sharepointworkspace_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010sharepointworkspace_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010visio","displayName":"Microsoft Visio 2010","description":"This policy setting configures the synchronization of user settings for Microsoft Visio 2010.\r\nBy default, the user settings of Microsoft Visio 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Visio 2010 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Visio 2010 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Visio 2010 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2010visio"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010visio_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010visio_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010word","displayName":"Microsoft Word 2010","description":"This policy setting configures the synchronization of user settings for Microsoft Word 2010.\r\nBy default, the user settings of Microsoft Word 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Word 2010 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Word 2010 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Word 2010 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2010word"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010word_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2010word_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013access","displayName":"Microsoft Access 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Access 2013.\r\nBy default, the user settings of Microsoft Access 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Access 2013 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Access 2013 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Access 2013 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013access"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013access_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013access_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013accessbackup","displayName":"Access 2013 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft Access 2013.\r\nMicrosoft Access 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Access 2013 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft Access 2013 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft Access 2013 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013accessbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013accessbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013accessbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013common","displayName":"Microsoft Office 2013 Common Settings","description":"\r\nThis policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2013 applications.\r\nBy default, the user settings which are common between the Microsoft Office Suite 2013 applications synchronize between computers. Use the policy setting to prevent the user settings which are common between the Microsoft Office Suite 2013 applications from synchronization between computers.\r\nIf you enable this policy setting, the user settings which are common between the Microsoft Office Suite 2013 applications continue to synchronize.\r\nIf you disable this policy setting, the user settings which are common between the Microsoft Office Suite 2013 applications are excluded from the synchronization settings. If any of the Microsoft Office Suite 2013 applications are enabled, this policy setting should not be disabled.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013common"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013common_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013common_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013commonbackup","displayName":"Common 2013 backup only","description":"\r\nThis policy setting configures the backup of certain user settings which are common between the Microsoft Office Suite 2013 applications.\r\nMicrosoft Office Suite 2013 has user settings which are common between applications and are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific common Microsoft Office Suite 2013 applications.\r\nIf you enable this policy setting, certain user settings which are common between the Microsoft Office Suite 2013 applications will continue to be backed up.\r\nIf you disable this policy setting, certain user settings which are common between the Microsoft Office Suite 2013 applications will not be backed up. \r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013commonbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013commonbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013commonbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013excel","displayName":"Microsoft Excel 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Excel 2013.\r\nBy default, the user settings of Microsoft Excel 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Excel 2013 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Excel 2013 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Excel 2013 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013excel"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013excel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013excel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013excelbackup","displayName":"Excel 2013 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft Excel 2013.\r\nMicrosoft Excel 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Excel 2013 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft Excel 2013 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft Excel 2013 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013excelbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013excelbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013excelbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013infopath","displayName":"Microsoft InfoPath 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft InfoPath 2013.\r\nBy default, the user settings of Microsoft InfoPath 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft InfoPath 2013 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft InfoPath 2013 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft InfoPath 2013 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013infopath"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013infopath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013infopath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013infopathbackup","displayName":"InfoPath 2013 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft InfoPath 2013.\r\nMicrosoft InfoPath 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft InfoPath 2013 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft InfoPath 2013 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft InfoPath 2013 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013infopathbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013infopathbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013infopathbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013lync","displayName":"Microsoft Lync 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Lync 2013.\r\nBy default, the user settings of Microsoft Lync 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Lync 2013 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Lync 2013 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Lync 2013 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013lync"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013lync_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013lync_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013lyncbackup","displayName":"Lync 2013 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft Lync 2013.\r\nMicrosoft Lync 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Lync 2013 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft Lync 2013 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft Lync 2013 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013lyncbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013lyncbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013lyncbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013onedriveforbusiness","displayName":"Microsoft OneDrive for Business 2013","description":"\r\nThis policy setting configures the synchronization of user settings for OneDrive for Business 2013.\r\nBy default, the user settings of OneDrive for Business 2013 synchronize between computers. Use the policy setting to prevent the user settings of OneDrive for Business 2013 from synchronization between computers.\r\nIf you enable this policy setting, OneDrive for Business 2013 user settings continue to synchronize.\r\nIf you disable this policy setting, OneDrive for Business 2013 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013onedriveforbusiness"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013onedriveforbusiness_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013onedriveforbusiness_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013onenote","displayName":"Microsoft OneNote 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft OneNote 2013.\r\nBy default, the user settings of Microsoft OneNote 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft OneNote 2013 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft OneNote 2013 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft OneNote 2013 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013onenote"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013onenote_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013onenote_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013onenotebackup","displayName":"OneNote 2013 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft OneNote 2013.\r\nMicrosoft OneNote 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft OneNote 2013 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft OneNote 2013 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft OneNote 2013 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013onenotebackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013onenotebackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013onenotebackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013outlook","displayName":"Microsoft Outlook 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Outlook 2013.\r\nBy default, the user settings of Microsoft Outlook 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Outlook 2013 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Outlook 2013 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Outlook 2013 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013outlook"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013outlook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013outlook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013outlookbackup","displayName":"Outlook 2013 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft Outlook 2013.\r\nMicrosoft Outlook 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Outlook 2013 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft Outlook 2013 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft Outlook 2013 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013outlookbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013outlookbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013outlookbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013powerpoint","displayName":"Microsoft PowerPoint 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft PowerPoint 2013.\r\nBy default, the user settings of Microsoft PowerPoint 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft PowerPoint 2013 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft PowerPoint 2013 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft PowerPoint 2013 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013powerpoint"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013powerpoint_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013powerpoint_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013powerpointbackup","displayName":"PowerPoint 2013 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft PowerPoint 2013.\r\nMicrosoft PowerPoint 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft PowerPoint 2013 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft PowerPoint 2013 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft PowerPoint 2013 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013powerpointbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013powerpointbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013powerpointbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013project","displayName":"Microsoft Project 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Project 2013.\r\nBy default, the user settings of Microsoft Project 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Project 2013 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Project 2013 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Project 2013 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013project"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013project_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013project_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013projectbackup","displayName":"Project 2013 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft Project 2013.\r\nMicrosoft Project 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Project 2013 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft Project 2013 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft Project 2013 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013projectbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013projectbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013projectbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013publisher","displayName":"Microsoft Publisher 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Publisher 2013.\r\nBy default, the user settings of Microsoft Publisher 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Publisher 2013 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Publisher 2013 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Publisher 2013 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013publisher"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013publisher_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013publisher_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013publisherbackup","displayName":"Publisher 2013 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft Publisher 2013.\r\nMicrosoft Publisher 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Publisher 2013 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft Publisher 2013 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft Publisher 2013 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013publisherbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013publisherbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013publisherbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013sharepointdesigner","displayName":"Microsoft SharePoint Designer 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft SharePoint Designer 2013.\r\nBy default, the user settings of Microsoft SharePoint Designer 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft SharePoint Designer 2013 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft SharePoint Designer 2013 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft SharePoint Designer 2013 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013sharepointdesigner"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013sharepointdesigner_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013sharepointdesigner_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013sharepointdesignerbackup","displayName":"SharePoint Designer 2013 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft SharePoint Designer 2013.\r\nMicrosoft SharePoint Designer 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft SharePoint Designer 2013 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft SharePoint Designer 2013 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft SharePoint Designer 2013 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013sharepointdesignerbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013sharepointdesignerbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013sharepointdesignerbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013uploadcenter","displayName":"Microsoft Office 2013 Upload Center","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 2013 Upload Center.\r\nBy default, the user settings of Microsoft Office 2013 Upload Center synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Office 2013 Upload Center from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Office 2013 Upload Center user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Office 2013 Upload Center user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013uploadcenter"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013uploadcenter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013uploadcenter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013visio","displayName":"Microsoft Visio 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Visio 2013.\r\nBy default, the user settings of Microsoft Visio 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Visio 2013 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Visio 2013 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Visio 2013 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013visio"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013visio_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013visio_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013visiobackup","displayName":"Visio 2013 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft Visio 2013.\r\nMicrosoft Visio 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Visio 2013 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft Visio 2013 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft Visio 2013 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013visiobackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013visiobackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013visiobackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013word","displayName":"Microsoft Word 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Word 2013.\r\nBy default, the user settings of Microsoft Word 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Word 2013 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Word 2013 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Word 2013 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013word"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013word_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013word_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013wordbackup","displayName":"Word 2013 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft Word 2013.\r\nMicrosoft Word 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Word 2013 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft Word 2013 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft Word 2013 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2013wordbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013wordbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2013wordbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016access","displayName":"Microsoft Access 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Access 2016.\r\nBy default, the user settings of Microsoft Access 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Access 2016 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Access 2016 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Access 2016 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016access"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016access_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016access_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016accessbackup","displayName":"Access 2016 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft Access 2016.\r\nMicrosoft Access 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Access 2016 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft Access 2016 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft Access 2016 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016accessbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016accessbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016accessbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016common","displayName":"Microsoft Office 2016 Common Settings","description":"\r\nThis policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2016 applications.\r\nBy default, the user settings which are common between the Microsoft Office Suite 2016 applications synchronize between computers. Use the policy setting to prevent the user settings which are common between the Microsoft Office Suite 2016 applications from synchronization between computers.\r\nIf you enable this policy setting, the user settings which are common between the Microsoft Office Suite 2016 applications continue to synchronize.\r\nIf you disable this policy setting, the user settings which are common between the Microsoft Office Suite 2016 applications are excluded from the synchronization settings. If any of the Microsoft Office Suite 2016 applications are enabled, this policy setting should not be disabled.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016common"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016common_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016common_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016commonbackup","displayName":"Common 2016 backup only","description":"\r\nThis policy setting configures the backup of certain user settings which are common between the Microsoft Office Suite 2016 applications.\r\nMicrosoft Office Suite 2016 has user settings which are common between applications and are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific common Microsoft Office Suite 2016 applications.\r\nIf you enable this policy setting, certain user settings which are common between the Microsoft Office Suite 2016 applications will continue to be backed up.\r\nIf you disable this policy setting, certain user settings which are common between the Microsoft Office Suite 2016 applications will not be backed up. \r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016commonbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016commonbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016commonbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016excel","displayName":"Microsoft Excel 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Excel 2016.\r\nBy default, the user settings of Microsoft Excel 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Excel 2016 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Excel 2016 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Excel 2016 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016excel"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016excel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016excel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016excelbackup","displayName":"Excel 2016 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft Excel 2016.\r\nMicrosoft Excel 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Excel 2016 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft Excel 2016 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft Excel 2016 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016excelbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016excelbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016excelbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016lync","displayName":"Microsoft Lync 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Lync 2016.\r\nBy default, the user settings of Microsoft Lync 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Lync 2016 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Lync 2016 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Lync 2016 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016lync"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016lync_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016lync_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016lyncbackup","displayName":"Lync 2016 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft Lync 2016.\r\nMicrosoft Lync 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Lync 2016 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft Lync 2016 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft Lync 2016 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016lyncbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016lyncbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016lyncbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016onedriveforbusiness","displayName":"Microsoft OneDrive for Business 2016","description":"\r\nThis policy setting configures the synchronization of user settings for OneDrive for Business 2016.\r\nBy default, the user settings of OneDrive for Business 2016 synchronize between computers. Use the policy setting to prevent the user settings of OneDrive for Business 2016 from synchronization between computers.\r\nIf you enable this policy setting, OneDrive for Business 2016 user settings continue to synchronize.\r\nIf you disable this policy setting, OneDrive for Business 2016 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016onedriveforbusiness"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016onedriveforbusiness_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016onedriveforbusiness_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016onenote","displayName":"Microsoft OneNote 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft OneNote 2016.\r\nBy default, the user settings of Microsoft OneNote 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft OneNote 2016 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft OneNote 2016 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft OneNote 2016 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016onenote"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016onenote_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016onenote_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016onenotebackup","displayName":"OneNote 2016 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft OneNote 2016.\r\nMicrosoft OneNote 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft OneNote 2016 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft OneNote 2016 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft OneNote 2016 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016onenotebackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016onenotebackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016onenotebackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016outlook","displayName":"Microsoft Outlook 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Outlook 2016.\r\nBy default, the user settings of Microsoft Outlook 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Outlook 2016 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Outlook 2016 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Outlook 2016 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016outlook"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016outlook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016outlook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016outlookbackup","displayName":"Outlook 2016 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft Outlook 2016.\r\nMicrosoft Outlook 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Outlook 2016 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft Outlook 2016 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft Outlook 2016 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016outlookbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016outlookbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016outlookbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016powerpoint","displayName":"Microsoft PowerPoint 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft PowerPoint 2016.\r\nBy default, the user settings of Microsoft PowerPoint 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft PowerPoint 2016 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft PowerPoint 2016 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft PowerPoint 2016 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016powerpoint"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016powerpoint_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016powerpoint_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016powerpointbackup","displayName":"PowerPoint 2016 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft PowerPoint 2016.\r\nMicrosoft PowerPoint 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft PowerPoint 2016 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft PowerPoint 2016 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft PowerPoint 2016 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016powerpointbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016powerpointbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016powerpointbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016project","displayName":"Microsoft Project 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Project 2016.\r\nBy default, the user settings of Microsoft Project 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Project 2016 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Project 2016 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Project 2016 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016project"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016project_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016project_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016projectbackup","displayName":"Project 2016 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft Project 2016.\r\nMicrosoft Project 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Project 2016 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft Project 2016 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft Project 2016 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016projectbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016projectbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016projectbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016publisher","displayName":"Microsoft Publisher 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Publisher 2016.\r\nBy default, the user settings of Microsoft Publisher 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Publisher 2016 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Publisher 2016 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Publisher 2016 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016publisher"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016publisher_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016publisher_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016publisherbackup","displayName":"Publisher 2016 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft Publisher 2016.\r\nMicrosoft Publisher 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Publisher 2016 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft Publisher 2016 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft Publisher 2016 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016publisherbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016publisherbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016publisherbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016uploadcenter","displayName":"Microsoft Office 2016 Upload Center","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 2016 Upload Center.\r\nBy default, the user settings of Microsoft Office 2016 Upload Center synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Office 2016 Upload Center from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Office 2016 Upload Center user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Office 2016 Upload Center user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016uploadcenter"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016uploadcenter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016uploadcenter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016visio","displayName":"Microsoft Visio 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Visio 2016.\r\nBy default, the user settings of Microsoft Visio 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Visio 2016 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Visio 2016 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Visio 2016 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016visio"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016visio_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016visio_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016visiobackup","displayName":"Visio 2016 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft Visio 2016.\r\nMicrosoft Visio 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Visio 2016 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft Visio 2016 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft Visio 2016 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016visiobackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016visiobackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016visiobackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016word","displayName":"Microsoft Word 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Word 2016.\r\nBy default, the user settings of Microsoft Word 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Word 2016 from synchronization between computers.\r\nIf you enable this policy setting, Microsoft Word 2016 user settings continue to synchronize.\r\nIf you disable this policy setting, Microsoft Word 2016 user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016word"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016word_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016word_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016wordbackup","displayName":"Word 2016 backup only","description":"\r\nThis policy setting configures the backup of certain user settings for Microsoft Word 2016.\r\nMicrosoft Word 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Word 2016 settings.\r\nIf you enable this policy setting, certain user settings of Microsoft Word 2016 will continue to be backed up.\r\nIf you disable this policy setting, certain user settings of Microsoft Word 2016 will not be backed up.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice2016wordbackup"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016wordbackup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice2016wordbackup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365access2013","displayName":"Microsoft Office 365 Access 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 Access 2013.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Access 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Access 2013 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 Access 2013 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 Access 2013 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365access2013"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365access2013_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365access2013_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365access2016","displayName":"Microsoft Office 365 Access 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 Access 2016.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Access 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Access 2016 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 Access 2016 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 Access 2016 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365access2016"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365access2016_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365access2016_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365common2013","displayName":"Microsoft Office 365 Common 2013","description":"\r\nThis policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2013 applications.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings which are common between the Microsoft Office Suite 2013 applications will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings which are common between the Microsoft Office Suite 2013 applications from synchronization between computers with UE-V.\r\nIf you enable this policy setting, user settings which are common between the Microsoft Office Suite 2013 applications continue to synchronize with UE-V.\r\nIf you disable this policy setting, user settings which are common between the Microsoft Office Suite 2013 applications are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365common2013"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365common2013_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365common2013_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365common2016","displayName":"Microsoft Office 365 Common 2016","description":"\r\nThis policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2016 applications.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings which are common between the Microsoft Office Suite 2016 applications will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings which are common between the Microsoft Office Suite 2016 applications from synchronization between computers with UE-V.\r\nIf you enable this policy setting, user settings which are common between the Microsoft Office Suite 2016 applications continue to synchronize with UE-V.\r\nIf you disable this policy setting, user settings which are common between the Microsoft Office Suite 2016 applications are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365common2016"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365common2016_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365common2016_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365excel2013","displayName":"Microsoft Office 365 Excel 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 Excel 2013.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Excel 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Excel 2013 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 Excel 2013 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 Excel 2013 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365excel2013"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365excel2013_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365excel2013_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365excel2016","displayName":"Microsoft Office 365 Excel 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 Excel 2016.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Excel 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Excel 2016 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 Excel 2016 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 Excel 2016 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365excel2016"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365excel2016_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365excel2016_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365infopath2013","displayName":"Microsoft Office 365 InfoPath 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 InfoPath 2013.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 InfoPath 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 InfoPath 2013 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 InfoPath 2013 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 InfoPath 2013 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365infopath2013"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365infopath2013_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365infopath2013_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365lync2013","displayName":"Microsoft Office 365 Lync 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 Lync 2013.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Lync 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Lync 2013 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 Lync 2013 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 Lync 2013 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365lync2013"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365lync2013_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365lync2013_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365lync2016","displayName":"Microsoft Office 365 Lync 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 Lync 2016.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Lync 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Lync 2016 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 Lync 2016 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 Lync 2016 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365lync2016"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365lync2016_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365lync2016_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365onenote2013","displayName":"Microsoft Office 365 OneNote 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 OneNote 2013.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 OneNote 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 OneNote 2013 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 OneNote 2013 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 OneNote 2013 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365onenote2013"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365onenote2013_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365onenote2013_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365onenote2016","displayName":"Microsoft Office 365 OneNote 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 OneNote 2016.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 OneNote 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 OneNote 2016 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 OneNote 2016 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 OneNote 2016 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365onenote2016"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365onenote2016_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365onenote2016_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365outlook2013","displayName":"Microsoft Office 365 Outlook 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 Outlook 2013.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Outlook 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Outlook 2013 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 Outlook 2013 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 Outlook 2013 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365outlook2013"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365outlook2013_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365outlook2013_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365outlook2016","displayName":"Microsoft Office 365 Outlook 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 Outlook 2016.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Outlook 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Outlook 2016 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 Outlook 2016 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 Outlook 2016 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365outlook2016"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365outlook2016_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365outlook2016_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365powerpoint2013","displayName":"Microsoft Office 365 PowerPoint 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 PowerPoint 2013.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 PowerPoint 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 PowerPoint 2013 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 PowerPoint 2013 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 PowerPoint 2013 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365powerpoint2013"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365powerpoint2013_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365powerpoint2013_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365powerpoint2016","displayName":"Microsoft Office 365 PowerPoint 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 PowerPoint 2016.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 PowerPoint 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 PowerPoint 2016 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 PowerPoint 2016 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 PowerPoint 2016 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365powerpoint2016"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365powerpoint2016_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365powerpoint2016_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365project2013","displayName":"Microsoft Office 365 Project 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 Project 2013.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Project 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Project 2013 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 Project 2013 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 Project 2013 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365project2013"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365project2013_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365project2013_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365project2016","displayName":"Microsoft Office 365 Project 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 Project 2016.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Project 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Project 2016 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 Project 2016 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 Project 2016 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365project2016"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365project2016_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365project2016_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365publisher2013","displayName":"Microsoft Office 365 Publisher 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 Publisher 2013.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Publisher 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Publisher 2013 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 Publisher 2013 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 Publisher 2013 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365publisher2013"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365publisher2013_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365publisher2013_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365publisher2016","displayName":"Microsoft Office 365 Publisher 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 Publisher 2016.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Publisher 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Publisher 2016 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 Publisher 2016 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 Publisher 2016 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365publisher2016"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365publisher2016_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365publisher2016_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365sharepointdesigner2013","displayName":"Microsoft Office 365 SharePoint Designer 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 SharePoint Designer 2013.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 SharePoint Designer 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 SharePoint Designer 2013 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 SharePoint Designer 2013 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 SharePoint Designer 2013 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365sharepointdesigner2013"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365sharepointdesigner2013_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365sharepointdesigner2013_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365visio2013","displayName":"Microsoft Office 365 Visio 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 Visio 2013.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Visio 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Visio 2013 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 Visio 2013 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 Visio 2013 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365visio2013"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365visio2013_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365visio2013_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365visio2016","displayName":"Microsoft Office 365 Visio 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 Visio 2016.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Visio 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Visio 2016 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 Visio 2016 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 Visio 2016 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365visio2016"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365visio2016_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365visio2016_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365word2013","displayName":"Microsoft Office 365 Word 2013","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 Word 2013.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Word 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Word 2013 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 Word 2013 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 Word 2013 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365word2013"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365word2013_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365word2013_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365word2016","displayName":"Microsoft Office 365 Word 2016","description":"\r\nThis policy setting configures the synchronization of user settings for Microsoft Office 365 Word 2016.\r\nMicrosoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Word 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Word 2016 from synchronization between computers with UE-V.\r\nIf you enable this policy setting, Microsoft Office 365 Word 2016 user settings continue to sync with UE-V.\r\nIf you disable this policy setting, Microsoft Office 365 Word 2016 user settings are excluded from synchronization with UE-V.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-microsoftoffice365word2016"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365word2016_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_microsoftoffice365word2016_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_music","displayName":"Music","description":"This policy setting configures the synchronization of user settings for the Music app.\r\nBy default, the user settings of Music sync between computers. Use the policy setting to prevent the user settings of Music from synchronizing between computers.\r\nIf you enable this policy setting, Music user settings continue to sync.\r\nIf you disable this policy setting, Music user settings are excluded from the synchronizing settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-music"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_music_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_music_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_news","displayName":"News","description":"This policy setting configures the synchronization of user settings for the News app.\r\nBy default, the user settings of News sync between computers. Use the policy setting to prevent the user settings of News from synchronizing between computers.\r\nIf you enable this policy setting, News user settings continue to sync.\r\nIf you disable this policy setting, News user settings are excluded from synchronization.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-news"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_news_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_news_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_notepad","displayName":"Notepad","description":"This policy setting configures the synchronization of user settings of Notepad.\r\nBy default, the user settings of Notepad synchronize between computers. Use the policy setting to prevent the user settings of Notepad from synchronization between computers. \r\nIf you enable this policy setting, the Notepad user settings continue to synchronize. \r\nIf you disable this policy setting, Notepad user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-notepad"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_notepad_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_notepad_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_reader","displayName":"Reader","description":"This policy setting configures the synchronization of user settings for the Reader app.\r\nBy default, the user settings of Reader sync between computers. Use the policy setting to prevent the user settings of Reader from synchronizing between computers.\r\nIf you enable this policy setting, Reader user settings continue to sync.\r\nIf you disable this policy setting, Reader user settings are excluded from the synchronization.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-reader"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_reader_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_reader_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_repositorytimeout","displayName":"Synchronization timeout","description":"This policy setting configures the number of milliseconds that the computer waits when retrieving user settings from the settings storage location. \r\nYou can use this setting to override the default value of 2000 milliseconds. \r\nIf you enable this policy setting, set the number of milliseconds that the system waits to retrieve settings. \r\nIf you disable or do not configure this policy setting, the default value of 2000 milliseconds is used.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-repositorytimeout"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_repositorytimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_repositorytimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_repositorytimeout_repositorytimeout","displayName":"Synchronization timeout (in milliseconds): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_settingsstoragepath","displayName":"Settings storage path","description":"This policy setting configures where the settings package files that contain user settings are stored. \r\nIf you enable this policy setting, the user settings are stored in the specified location. \r\nIf you disable or do not configure this policy setting, the user settings are stored in the user’s home directory if configured for your environment. \r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-settingsstoragepath"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_settingsstoragepath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_settingsstoragepath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_settingsstoragepath_settingsstoragepath","displayName":"Settings storage path (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_settingstemplatecatalogpath","displayName":"Settings template catalog path","description":"This policy setting configures where custom settings location templates are stored and if the catalog will be used to replace the default Microsoft templates installed with the UE-V Agent.\r\nIf you enable this policy setting, the UE-V Agent checks the specified location once each day and updates its synchronization behavior based on the templates in this location. Settings location templates added or updated since the last check are registered by the UE-V Agent. The UE-V Agent deregisters templates that were removed from this location.\r\nIf you specify a UNC path and leave the option to replace the default Microsoft templates unchecked, the UE-V Agent will use the default Microsoft templates installed by the UE-V Agent and custom templates in the settings template catalog. If there are custom templates in the settings template catalog which use the same ID as the default Microsoft templates, they will be ignored.\r\nIf you specify a UNC path and check the option to replace the default Microsoft templates, all of the default Microsoft templates installed by the UE-V Agent will be deleted from the computer and only the templates located in the settings template catalog will be used.\r\nIf you disable this policy setting, the UE-V Agent will not use the custom settings location templates. If you disable this policy setting after it has been enabled, the UE-V Agent will not restore the default Microsoft templates. \r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-settingstemplatecatalogpath"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_settingstemplatecatalogpath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_settingstemplatecatalogpath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_settingstemplatecatalogpath_overridemstemplates","displayName":"Replace the default Microsoft templates (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_settingstemplatecatalogpath_overridemstemplates_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_settingstemplatecatalogpath_overridemstemplates_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_settingstemplatecatalogpath_settingstemplatecatalogpath","displayName":"Settings template catalog path (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_sports","displayName":"Sports","description":"This policy setting configures the synchronization of user settings for the Sports app.\r\nBy default, the user settings of Sports sync between computers. Use the policy setting to prevent the user settings of Sports from synchronizing between computers.\r\nIf you enable this policy setting, Sports user settings continue to sync.\r\nIf you disable this policy setting, Sports user settings are excluded from synchronization.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-sports"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_sports_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_sports_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_syncenabled","displayName":"Use User Experience Virtualization (UE-V)","description":"This policy setting allows you to enable or disable User Experience Virtualization (UE-V). Only applies to Windows 10 or earlier.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-syncenabled"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_syncenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_syncenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_syncovermeterednetwork","displayName":"Sync settings over metered connections","description":"This policy setting defines whether the User Experience Virtualization (UE-V) Agent synchronizes settings over metered connections.\r\nBy default, the UE-V Agent does not synchronize settings over a metered connection.\r\nWith this setting enabled, the UE-V Agent synchronizes settings over a metered connection.\r\nWith this setting disabled, the UE-V Agent does not synchronize settings over a metered connection.\r\nIf you do not configure this policy setting, any defined values are deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-syncovermeterednetwork"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_syncovermeterednetwork_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_syncovermeterednetwork_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_syncovermeterednetworkwhenroaming","displayName":"Sync settings over metered connections even when roaming","description":"This policy setting defines whether the User Experience Virtualization (UE-V) Agent synchronizes settings over metered connections outside of the home provider network, for example when connected via a roaming connection.\r\nBy default, the UE-V Agent does not synchronize settings over a metered connection that is roaming.\r\nWith this setting enabled, the UE-V Agent synchronizes settings over a metered connection that is roaming.\r\nWith this setting disabled, the UE-V Agent will not synchronize settings over a metered connection that is roaming.\r\nIf you do not configure this policy setting, any defined values are deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-syncovermeterednetworkwhenroaming"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_syncovermeterednetworkwhenroaming_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_syncovermeterednetworkwhenroaming_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_syncproviderpingenabled","displayName":"Ping the settings storage location before sync","description":"This policy setting allows you to configure the User Experience Virtualization (UE-V) sync provider to ping the settings storage path before attempting to sync settings. If the ping is successful then the sync provider attempts to synchronize the settings packages. If the ping is unsuccessful then the sync provider doesn’t attempt the synchronization. \r\nIf you enable this policy setting, the sync provider pings the settings storage location before synchronizing settings packages.\r\nIf you disable this policy setting, the sync provider doesn’t ping the settings storage location before synchronizing settings packages. \r\nIf you do not configure this policy, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-syncproviderpingenabled"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_syncproviderpingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_syncproviderpingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_syncunlistedwindows8apps","displayName":"Sync Unlisted Windows Apps","description":"This policy setting defines the default settings sync behavior of the User Experience Virtualization (UE-V) Agent for Windows apps that are not explicitly listed in Windows App List.\r\nBy default, the UE-V Agent only synchronizes settings of those Windows apps included in the Windows App List.\r\nWith this setting enabled, the settings of all Windows apps not expressly disable in the Windows App List are synchronized.\r\nWith this setting disabled, only the settings of the Windows apps set to synchronize in the Windows App List are synchronized.\r\nIf you do not configure this policy setting, any defined values are deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-syncunlistedwindows8apps"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_syncunlistedwindows8apps_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_syncunlistedwindows8apps_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_travel","displayName":"Travel","description":"This policy setting configures the synchronization of user settings for the Travel app.\r\nBy default, the user settings of Travel sync between computers. Use the policy setting to prevent the user settings of Travel from synchronizing between computers.\r\nIf you enable this policy setting, Travel user settings continue to sync.\r\nIf you disable this policy setting, Travel user settings are excluded from synchronization.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-travel"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_travel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_travel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_trayiconenabled","displayName":"Tray Icon","description":"This policy setting enables the User Experience Virtualization (UE-V) tray icon. By default, an icon appears in the system tray that displays notifications for UE-V. This icon also provides a link to the UE-V Agent application, Company Settings Center. Users can open the Company Settings Center by right-clicking the icon and selecting Open or by double-clicking the icon. When this group policy setting is enabled, the UE-V tray icon is visible, the UE-V notifications display, and the Company Settings Center is accessible from the tray icon.\r\nWith this setting disabled, the tray icon does not appear in the system tray, UE-V never displays notifications, and the user cannot access Company Settings Center from the system tray. The Company Settings Center remains accessible through the Control Panel and the Start menu or Start screen.\r\nIf you do not configure this policy setting, any defined values are deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-trayiconenabled"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_trayiconenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_trayiconenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_video","displayName":"Video","description":"This policy setting configures the synchronization of user settings for the Video app.\r\nBy default, the user settings of Video sync between computers. Use the policy setting to prevent the user settings of Video from synchronizing between computers.\r\nIf you enable this policy setting, Video user settings continue to sync.\r\nIf you disable this policy setting, Video user settings are excluded from synchronization.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-video"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_video_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_video_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_weather","displayName":"Weather","description":"This policy setting configures the synchronization of user settings for the Weather app.\r\nBy default, the user settings of Weather sync between computers. Use the policy setting to prevent the user settings of Weather from synchronizing between computers.\r\nIf you enable this policy setting, Weather user settings continue to sync.\r\nIf you disable this policy setting, Weather user settings are excluded from synchronization.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-weather"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_weather_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_weather_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_wordpad","displayName":"WordPad","description":"This policy setting configures the synchronization of user settings of WordPad.\r\nBy default, the user settings of WordPad synchronize between computers. Use the policy setting to prevent the user settings of WordPad from synchronization between computers. \r\nIf you enable this policy setting, the WordPad user settings continue to synchronize. \r\nIf you disable this policy setting, WordPad user settings are excluded from the synchronization settings.\r\nIf you do not configure this policy setting, any defined values will be deleted.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization#admx-userexperiencevirtualization-wordpad"],"options":[{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_wordpad_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userexperiencevirtualization_wordpad_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userprofiles_cleanupprofiles","displayName":"Delete user profiles older than a specified number of days on system restart","description":"This policy setting allows an administrator to automatically delete user profiles on system restart that have not been used within a specified number of days. Note: One day is interpreted as 24 hours after a specific user profile was accessed.\r\n\r\nIf you enable this policy setting, the User Profile Service will automatically delete on the next system restart all user profiles on the computer that have not been used within the specified number of days. \r\n\r\nIf you disable or do not configure this policy setting, User Profile Service will not automatically delete any profiles on the next system restart.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userprofiles#admx-userprofiles-cleanupprofiles"],"options":[{"id":"device_vendor_msft_policy_config_admx_userprofiles_cleanupprofiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_cleanupprofiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userprofiles_cleanupprofiles_cleanupprofiles_days","displayName":"Delete user profiles older than (days) (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_dontforceunloadhive","displayName":"Do not forcefully unload the users registry at user logoff","description":"This policy setting controls whether Windows forcefully unloads the user's registry at logoff, even if there are open handles to the per-user registry keys. \r\n\r\nNote: This policy setting should only be used for cases where you may be running into application compatibility issues due to this specific Windows behavior. It is not recommended to enable this policy by default as it may prevent users from getting an updated version of their roaming user profile.\r\n\r\nIf you enable this policy setting, Windows will not forcefully unload the users registry at logoff, but will unload the registry when all open handles to the per-user registry keys are closed.\r\n\r\nIf you disable or do not configure this policy setting, Windows will always unload the users registry at logoff, even if there are any open handles to the per-user registry keys at user logoff.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userprofiles#admx-userprofiles-dontforceunloadhive"],"options":[{"id":"device_vendor_msft_policy_config_admx_userprofiles_dontforceunloadhive_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_dontforceunloadhive_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userprofiles_leaveappmgmtdata","displayName":"Leave Windows Installer and Group Policy Software Installation Data","description":"This policy setting determines whether the system retains a roaming user's Windows Installer and Group Policy based software installation data on their profile deletion.\r\n\r\nBy default Windows deletes all information related to a roaming user (which includes the user's settings, data, Windows Installer related data, and the like) when their profile is deleted. As a result, the next time a roaming user whose profile was previously deleted on that client logs on, they will need to reinstall all apps published via policy at logon increasing logon time. You can use this policy setting to change this behavior.\r\n\r\nIf you enable this policy setting, Windows will not delete Windows Installer or Group Policy software installation data for roaming users when profiles are deleted from the machine. This will improve the performance of Group Policy based Software Installation during user logon when a user profile is deleted and that user subsequently logs on to the machine.\r\n\r\nIf you disable or do not configure this policy setting, Windows will delete the entire profile for roaming users, including the Windows Installer and Group Policy software installation data when those profiles are deleted.\r\n\r\nNote: If this policy setting is enabled for a machine, local administrator action is required to remove the Windows Installer or Group Policy software installation data stored in the registry and file system of roaming users' profiles on the machine.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userprofiles#admx-userprofiles-leaveappmgmtdata"],"options":[{"id":"device_vendor_msft_policy_config_admx_userprofiles_leaveappmgmtdata_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_leaveappmgmtdata_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userprofiles_profileerroraction","displayName":"Do not log users on with temporary profiles","description":"This policy setting will automatically log off a user when Windows cannot load their profile. \r\n\r\nIf Windows cannot access the user profile folder or the profile contains errors that prevent it from loading, Windows logs on the user with a temporary profile. This policy setting allows the administrator to disable this behavior, preventing Windows from loggin on the user with a temporary profile.\r\n\r\nIf you enable this policy setting, Windows will not log on a user with a temporary profile. Windows logs the user off if their profile cannot be loaded.\r\n\r\nIf you disable this policy setting or do not configure it, Windows logs on the user with a temporary profile when Windows cannot load their user profile.\r\n\r\nAlso, see the \"Delete cached copies of roaming profiles\" policy setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userprofiles#admx-userprofiles-profileerroraction"],"options":[{"id":"device_vendor_msft_policy_config_admx_userprofiles_profileerroraction_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_profileerroraction_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userprofiles_slowlinktimeout","displayName":"Control slow network connection timeout for user profiles","description":"This policy setting defines a slow connection for roaming user profiles and establishes thresholds for two tests of network speed. \r\n\r\nTo determine the network performance characteristics, a connection is made to the file share storing the user's profile and 64 kilobytes of data is transfered. From that connection and data transfer, the network's latency and connection speed are determined.\r\n\r\nThis policy setting and related policy settings in this folder together define the system's response when roaming user profiles are slow to load.\r\n\r\nIf you enable this policy setting, you can change how long Windows waits for a response from the server before considering the connection to be slow.\r\n\r\nIf you disable or do not configure this policy setting, Windows considers the network connection to be slow if the server returns less than 500 kilobits of data per second or take 120 milliseconds to respond.Consider increasing this value for clients using DHCP Service-assigned addresses or for computers accessing profiles across dial-up connections.Important: If the \"Do not detect slow network connections\" policy setting is enabled, this policy setting is ignored. Also, if the \"Delete cached copies of roaming profiles\" policy setting is enabled, there is no local copy of the roaming profile to load when the system detects a slow connection.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userprofiles#admx-userprofiles-slowlinktimeout"],"options":[{"id":"device_vendor_msft_policy_config_admx_userprofiles_slowlinktimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_slowlinktimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userprofiles_slowlinktimeout_slowlinkwaitinterval","displayName":"Time (milliseconds) (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_slowlinktimeout_transferrateop","displayName":"Connection speed (Kbps): (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home","displayName":"Set user home folder","description":"This policy setting allows you to specify the location and root (file share or local path) of a user's home folder for a logon session.\r\n\r\nIf you enable this policy setting, the user's home folder is configured to the specified local or network location, creating a new folder for each user name.\r\n\r\nTo use this policy setting, in the Location list, choose the location for the home folder. If you choose “On the network,” enter the path to a file share in the Path box (for example, \\\\ComputerName\\ShareName), and then choose the drive letter to assign to the file share. If you choose “On the local computer,” enter a local path (for example, C:\\HomeFolder) in the Path box.\r\n\r\nDo not specify environment variables or ellipses in the path. Also, do not specify a placeholder for the user name because the user name will be appended at logon.\r\n\r\nNote: The Drive letter box is ignored if you choose “On the local computer” from the Location list. If you choose “On the local computer” and enter a file share, the user's home folder will be placed in the network location without mapping the file share to a drive letter.\r\n\r\nIf you disable or do not configure this policy setting, the user's home folder is configured as specified in the user's Active Directory Domain Services account.\r\n\r\nIf the \"Set Remote Desktop Services User Home Directory\" policy setting is enabled, the “Set user home folder” policy setting has no effect.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userprofiles#admx-userprofiles-user-home"],"options":[{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter","displayName":"Drive letter (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_g:","displayName":"G:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_h:","displayName":"H:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_i:","displayName":"I:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_j:","displayName":"J:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_k:","displayName":"K:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_l:","displayName":"L:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_m:","displayName":"M:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_n:","displayName":"N:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_o:","displayName":"O:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_p:","displayName":"P:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_q:","displayName":"Q:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_r:","displayName":"R:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_s:","displayName":"S:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_t:","displayName":"T:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_u:","displayName":"U:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_v:","displayName":"V:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_w:","displayName":"W:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_x:","displayName":"X:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_y:","displayName":"Y:","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_drive_letter_z:","displayName":"Z:","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_home_path","displayName":"Path: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_user_home_location","displayName":"Location: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_user_home_location_1","displayName":"On the network","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_user_home_user_home_location_0","displayName":"On the local computer","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userprofiles_userinfoaccessaction","displayName":"User management of sharing user name, account picture, and domain information with apps (not desktop apps)","description":"This setting prevents users from managing the ability to allow apps to access the user name, account picture, and domain information.\r\n\r\nIf you enable this policy setting, sharing of user name, picture and domain information may be controlled by setting one of the following options:\r\n\r\n\"Always on\" - users will not be able to change this setting and the user's name and account picture will be shared with apps (not desktop apps). In addition apps (not desktop apps) that have the enterprise authentication capability will also be able to retrieve the user's UPN, SIP/URI, and DNS.\r\n\r\n\"Always off\" - users will not be able to change this setting and the user's name and account picture will not be shared with apps (not desktop apps). In addition apps (not desktop apps) that have the enterprise authentication capability will not be able to retrieve the user's UPN, SIP/URI, and DNS. Selecting this option may have a negative impact on certain enterprise software and/or line of business apps that depend on the domain information protected by this setting to connect with network resources.\r\n\r\nIf you do not configure or disable this policy the user will have full control over this setting and can turn it off and on. Selecting this option may have a negative impact on certain enterprise software and/or line of business apps that depend on the domain information protected by this setting to connect with network resources if users choose to turn the setting off.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-userprofiles#admx-userprofiles-userinfoaccessaction"],"options":[{"id":"device_vendor_msft_policy_config_admx_userprofiles_userinfoaccessaction_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_userinfoaccessaction_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_userprofiles_userinfoaccessaction_allowuserinfoaccess","displayName":"Action: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_userprofiles_userinfoaccessaction_allowuserinfoaccess_1","displayName":"Always on","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_userprofiles_userinfoaccessaction_allowuserinfoaccess_2","displayName":"Always off","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config","displayName":"Global Configuration Settings","description":"This policy setting allows you to specify Clock discipline and General values for the Windows Time service (W32time) for domain controllers including RODCs.\r\n\r\nIf this policy setting is enabled, W32time Service on target machines use the settings provided here. Otherwise, the service on target machines use locally configured settings values.\r\n\r\nFor more details on individual parameters, combinations of parameter values as well as definitions of flags, see https://go.microsoft.com/fwlink/?linkid=847809.\r\n\r\n FrequencyCorrectRate\r\nThis parameter controls the rate at which the W32time corrects the local clock's frequency. Lower values cause slower corrections; larger values cause more frequent corrections. Default: 4 (scalar).\r\n\r\n HoldPeriod\r\nThis parameter indicates how many consistent time samples the client computer must receive in a series before subsequent time samples are evaluated as potential spikes. Default: 5\r\n\r\n LargePhaseOffset\r\nIf a time sample differs from the client computer's local clock by more than LargePhaseOffset, the local clock is deemed to have drifted considerably, or in other words, spiked. Default: 50,000,000 100-nanosecond units (ns) or 5 seconds.\r\n\r\n MaxAllowedPhaseOffset\r\nIf a response is received that has a time variation that is larger than this parameter value, W32time sets the client computer's local clock immediately to the time that is accepted as accurate from the Network Time Protocol (NTP) server. If the time variation is less than this value, the client computer's local clock is corrected gradually. Default: 300 seconds.\r\n\r\n MaxNegPhaseCorrection\r\nIf a time sample is received that indicates a time in the past (as compared to the client computer's local clock) that has a time difference that is greater than the MaxNegPhaseCorrection value, the time sample is discarded. Default: 172,800 seconds.\r\n\r\n MaxPosPhaseCorrection\r\nIf a time sample is received that indicates a time in the future (as compared to the client computer's local clock) that has a time difference greater than the MaxPosPhaseCorrection value, the time sample is discarded. Default: 172,800 seconds.\r\n\r\n PhaseCorrectRate\r\nThis parameter controls how quickly W32time corrects the client computer's local clock difference to match time samples that are accepted as accurate from the NTP server. Lower values cause the clock to correct more slowly; larger values cause the clock to correct more quickly. Default: 7 (scalar).\r\n\r\n PollAdjustFactor\r\nThis parameter controls how quickly W32time changes polling intervals. When responses are considered to be accurate, the polling interval lengthens automatically. When responses are considered to be inaccurate, the polling interval shortens automatically. Default: 5 (scalar).\r\n\r\n SpikeWatchPeriod\r\nThis parameter specifies the amount of time that samples with time offset larger than LargePhaseOffset are received before these samples are accepted as accurate. SpikeWatchPeriod is used in conjunction with HoldPeriod to help eliminate sporadic, inaccurate time samples that are returned from a peer. Default: 900 seconds.\r\n\r\n UpdateInterval\r\nThis parameter specifies the amount of time that W32time waits between corrections when the clock is being corrected gradually. When it makes a gradual correction, the service adjusts the clock slightly, waits this amount of time, and then checks to see if another adjustment is needed, until the correction is finished. Default: 100 1/100th second units, or 1 second.\r\n\r\n General parameters:\r\n\r\n AnnounceFlags\r\nThis parameter is a bitmask value that controls how time service availability is advertised through NetLogon. Default: 0x0a hexadecimal\r\n\r\n EventLogFlags\r\nThis parameter controls special events that may be logged to the Event Viewer System log. Default: 0x02 hexadecimal bitmask.\r\n\r\n LocalClockDispersion\r\nThis parameter indicates the maximum error in seconds that is reported by the NTP server to clients that are requesting a time sample. (Applies only when the NTP server is using the time of the local CMOS clock.) Default: 10 seconds.\r\n\r\n MaxPollInterval\r\nThis parameter controls the maximum polling interval, which defines the maximum amount of time between polls of a peer. Default: 10 in log base-2, or 1024 seconds. (Should not be set higher than 15.)\r\n\r\n MinPollInterval\r\nThis parameter controls the minimum polling interval that defines the minimum amount of time between polls of a peer. Default: 6 in log base-2, or 64 seconds.\r\n\r\n ClockHoldoverPeriod\r\nThis parameter indicates the maximum number of seconds a system clock can nominally hold its accuracy without synchronizing with a time source. If this period of time passes without W32time obtaining new samples from any of its input providers, W32time initiates a rediscovery of time sources. Default: 7800 seconds.\r\n\r\n RequireSecureTimeSyncRequests\r\nThis parameter controls whether or not the DC will respond to time sync requests that use older authentication protocols. If enabled (set to 1), the DC will not respond to requests using such protocols. Default: 0 Boolean.\r\n\r\n UtilizeSslTimeData\r\nThis parameter controls whether W32time will use time data computed from SSL traffic on the machine as an additional input for correcting the local clock. Default: 1 (enabled) Boolean\r\n\r\n ClockAdjustmentAuditLimit\r\nThis parameter specifies the smallest local clock adjustments that may be logged to the W32time service event log on the target machine. Default: 800 Parts per million (PPM).\r\n\r\n RODC parameters:\r\n\r\n ChainEntryTimeout\r\nThis parameter specifies the maximum amount of time that an entry can remain in the chaining table before the entry is considered to be expired. Expired entries may be removed when the next request or response is processed. Default: 16 seconds.\r\n\r\n ChainMaxEntries\r\nThis parameter controls the maximum number of entries that are allowed in the chaining table. If the chaining table is full and no expired entries can be removed, any incoming requests are discarded. Default: 128 entries.\r\n\r\n ChainMaxHostEntries\r\nThis parameter controls the maximum number of entries that are allowed in the chaining table for a particular host. Default: 4 entries.\r\n\r\n ChainDisable\r\nThis parameter controls whether or not the chaining mechanism is disabled. If chaining is disabled (set to 0), the RODC can synchronize with any domain controller, but hosts that do not have their passwords cached on the RODC will not be able to synchronize with the RODC. Default: 0 Boolean.\r\n\r\n ChainLoggingRate\r\nThis parameter controls the frequency at which an event that indicates the number of successful and unsuccessful chaining attempts is logged to the System log in Event Viewer. Default: 30 minutes.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-w32time#admx-w32time-w32time-policy-config"],"options":[{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_announceflags","displayName":"AnnounceFlags (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_chaindisable","displayName":"ChainDisable (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_chainentrytimeout","displayName":"ChainEntryTimeout (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_chainloggingrate","displayName":"ChainLoggingRate (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_chainmaxentries","displayName":"ChainMaxEntries (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_chainmaxhostentries","displayName":"ChainMaxHostEntries (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_clockadjustmentauditlimit","displayName":"ClockAdjustmentAuditLimit (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_clockholdoverperiod","displayName":"ClockHoldoverPeriod (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_eventlogflags","displayName":"EventLogFlags (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_frequencycorrectrate","displayName":"FrequencyCorrectRate (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_holdperiod","displayName":"HoldPeriod (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_largephaseoffset","displayName":"LargePhaseOffset (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_localclockdispersion","displayName":"LocalClockDispersion (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_maxallowedphaseoffset","displayName":"MaxAllowedPhaseOffset (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_maxnegphasecorrection","displayName":"MaxNegPhaseCorrection (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_maxpollinterval","displayName":"MaxPollInterval (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_maxposphasecorrection","displayName":"MaxPosPhaseCorrection (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_minpollinterval","displayName":"MinPollInterval (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_phasecorrectrate","displayName":"PhaseCorrectRate (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_polladjustfactor","displayName":"PollAdjustFactor (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_requiresecuretimesyncrequests","displayName":"RequireSecureTimeSyncRequests (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_spikewatchperiod","displayName":"SpikeWatchPeriod (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_updateinterval","displayName":"UpdateInterval (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_config_w32time_utilizessltimedata","displayName":"UtilizeSslTimeData (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_configure_ntpclient","displayName":"Configure Windows NTP Client","description":"This policy setting specifies a set of parameters for controlling the Windows NTP Client.\r\n\r\nIf you enable this policy setting, you can specify the following parameters for the Windows NTP Client.\r\n\r\nIf you disable or do not configure this policy setting, the WIndows NTP Client uses the defaults of each of the following parameters.\r\n\r\nNtpServer\r\nThe Domain Name System (DNS) name or IP address of an NTP time source. This value is in the form of \"dnsName,flags\" where \"flags\" is a hexadecimal bitmask of the flags for that host. For more information, see the NTP Client Group Policy Settings Associated with Windows Time section of the Windows Time Service Group Policy Settings. The default value is \"time.windows.com,0x09\". \r\n\r\nType\r\nThis value controls the authentication that W32time uses. The default value is NT5DS.\r\n\r\nCrossSiteSyncFlags\r\nThis value, expressed as a bitmask, controls how W32time chooses time sources outside its own site. The possible values are 0, 1, and 2. Setting this value to 0 (None) indicates that the time client should not attempt to synchronize time outside its site. Setting this value to 1 (PdcOnly) indicates that only the computers that function as primary domain controller (PDC) emulator operations masters in other domains can be used as synchronization partners when the client has to synchronize time with a partner outside its own site. Setting a value of 2 (All) indicates that any synchronization partner can be used. This value is ignored if the NT5DS value is not set. The default value is 2 decimal (0x02 hexadecimal).\r\n\r\nResolvePeerBackoffMinutes\r\nThis value, expressed in minutes, controls how long W32time waits before it attempts to resolve a DNS name when a previous attempt failed. The default value is 15 minutes.\r\n\r\nResolvePeerBackoffMaxTimes\r\nThis value controls how many times W32time attempts to resolve a DNS name before the discovery process is restarted. Each time DNS name resolution fails, the amount of time to wait before the next attempt will be twice the previous amount. The default value is seven attempts.\r\n\r\nSpecialPollInterval\r\nThis NTP client value, expressed in seconds, controls how often a manually configured time source is polled when the time source is configured to use a special polling interval. If the SpecialInterval flag is enabled on the NTPServer setting, the client uses the value that is set as the SpecialPollInterval, instead of a variable interval between MinPollInterval and MaxPollInterval values, to determine how frequently to poll the time source. SpecialPollInterval must be in the range of [MinPollInterval, MaxPollInterval], else the nearest value of the range is picked. Default: 1024 seconds.\r\n\r\nEventLogFlags\r\nThis value is a bitmask that controls events that may be logged to the System log in Event Viewer. Setting this value to 0x1 indicates that W32time will create an event whenever a time jump is detected. Setting this value to 0x2 indicates that W32time will create an event whenever a time source change is made. Because it is a bitmask value, setting 0x3 (the addition of 0x1 and 0x2) indicates that both time jumps and time source changes will be logged.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-w32time#admx-w32time-w32time-policy-configure-ntpclient"],"options":[{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_configure_ntpclient_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_configure_ntpclient_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_configure_ntpclient_w32time_crosssitesyncflags","displayName":"CrossSiteSyncFlags (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_configure_ntpclient_w32time_ntpclienteventlogflags","displayName":"EventLogFlags (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_configure_ntpclient_w32time_ntpserver","displayName":"NtpServer (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_configure_ntpclient_w32time_resolvepeerbackoffmaxtimes","displayName":"ResolvePeerBackoffMaxTimes (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_configure_ntpclient_w32time_resolvepeerbackoffminutes","displayName":"ResolvePeerBackoffMinutes (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_configure_ntpclient_w32time_specialpollinterval","displayName":"SpecialPollInterval (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_configure_ntpclient_w32time_type","displayName":"Type (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_configure_ntpclient_w32time_type_nosync","displayName":"NoSync","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_configure_ntpclient_w32time_type_ntp","displayName":"NTP","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_configure_ntpclient_w32time_type_nt5ds","displayName":"NT5DS","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_configure_ntpclient_w32time_type_allsync","displayName":"AllSync","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_enable_ntpclient","displayName":"Enable Windows NTP Client","description":"This policy setting specifies whether the Windows NTP Client is enabled.\r\n\r\nEnabling the Windows NTP Client allows your computer to synchronize its computer clock with other NTP servers. You might want to disable this service if you decide to use a third-party time provider.\r\n\r\nIf you enable this policy setting, you can set the local computer clock to synchronize time with NTP servers.\r\n\r\nIf you disable or do not configure this policy setting, the local computer clock does not synchronize time with NTP servers.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-w32time#admx-w32time-w32time-policy-enable-ntpclient"],"options":[{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_enable_ntpclient_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_enable_ntpclient_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_enable_ntpserver","displayName":"Enable Windows NTP Server","description":"This policy setting allows you to specify whether the Windows NTP Server is enabled.\r\n\r\nIf you enable this policy setting for the Windows NTP Server, your computer can service NTP requests from other computers.\r\n\r\n\r\nIf you disable or do not configure this policy setting, your computer cannot service NTP requests from other computers.\r\n\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-w32time#admx-w32time-w32time-policy-enable-ntpserver"],"options":[{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_enable_ntpserver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_w32time_w32time_policy_enable_ntpserver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_wcm_wcm_disablepowermanagement","displayName":"Disable power management in connected standby mode","description":"This policy setting specifies that power management is disabled when the machine enters connected standby mode. \r\n\r\nIf this policy setting is enabled, Windows Connection Manager does not manage adapter radios to reduce power consumption when the machine enters connected standby mode.\r\n\r\nIf this policy setting is not configured or is disabled, power management is enabled when the machine enters connected standby mode.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-wcm#admx-wcm-wcm-disablepowermanagement"],"options":[{"id":"device_vendor_msft_policy_config_admx_wcm_wcm_disablepowermanagement_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wcm_wcm_disablepowermanagement_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_wcm_wcm_enablesoftdisconnect","displayName":"Enable Windows to soft-disconnect a computer from a network","description":"This policy setting determines whether Windows will soft-disconnect a computer from a network.\r\n\r\nIf this policy setting is enabled or not configured, Windows will soft-disconnect a computer from a network when it determines that the computer should no longer be connected to a network.\r\n\r\nIf this policy setting is disabled, Windows will disconnect a computer from a network immediately when it determines that the computer should no longer be connected to a network.\r\n\r\nWhen soft disconnect is enabled:\r\n- When Windows decides that the computer should no longer be connected to a network, it waits for traffic to settle on that network. The existing TCP session will continue uninterrupted.\r\n- Windows then checks the traffic level on the network periodically. If the traffic level is above a certain threshold, no further action is taken. The computer stays connected to the network and continues to use it. For example, if the network connection is currently being used to download files from the Internet, the files will continue to be downloaded using that network connection.\r\n- When the network traffic drops below this threshold, the computer will be disconnected from the network. Apps that keep a network connection active even when they’re not actively using it (for example, email apps) might lose their connection. If this happens, these apps should re-establish their connection over a different network. \r\n\r\nThis policy setting depends on other group policy settings. For example, if 'Minimize the number of simultaneous connections to the Internet or a Windows Domain' is disabled, Windows will not disconnect from any networks.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-wcm#admx-wcm-wcm-enablesoftdisconnect"],"options":[{"id":"device_vendor_msft_policy_config_admx_wcm_wcm_enablesoftdisconnect_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wcm_wcm_enablesoftdisconnect_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_wcm_wcm_minimizeconnections","displayName":"Minimize the number of simultaneous connections to the Internet or a Windows Domain","description":"\r\n This policy setting determines if a computer can have multiple connections to the internet or to a Windows domain. If multiple connections are allowed, it then determines how network traffic will be routed.\r\n\r\n If this policy setting is set to 0, a computer can have simultaneous connections to the internet, to a Windows domain, or to both. Internet traffic can be routed over any connection - including a cellular connection and any metered network. This was previously the Disabled state for this policy setting. This option was first available in Windows 8.\r\n\r\n If this policy setting is set to 1, any new automatic internet connection is blocked when the computer has at least one active internet connection to a preferred type of network. Here's the order of preference (from most preferred to least preferred): Ethernet, WLAN, then cellular. Ethernet is always preferred when connected. Users can still manually connect to any network. This was previously the Enabled state for this policy setting. This option was first available in Windows 8.\r\n\r\n If this policy setting is set to 2, the behavior is similar to 1. However, if a cellular data connection is available, it will always stay connected for services that require a cellular connection. When the user is connected to a WLAN or Ethernet connection, no internet traffic will be routed over the cellular connection. This option was first available in Windows 10 (Version 1703).\r\n\r\n If this policy setting is set to 3, the behavior is similar to 2. However, if there's an Ethernet connection, Windows won't allow users to connect to a WLAN manually. A WLAN can only be connected (automatically or manually) when there's no Ethernet connection.\r\n\r\n This policy setting is related to the \"Enable Windows to soft-disconnect a computer from a network\" policy setting.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-wcm#admx-wcm-wcm-minimizeconnections"],"options":[{"id":"device_vendor_msft_policy_config_admx_wcm_wcm_minimizeconnections_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wcm_wcm_minimizeconnections_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_wcm_wcm_minimizeconnections_wcm_minimizeconnections_options","displayName":"Minimize Policy Options (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_wcm_wcm_minimizeconnections_wcm_minimizeconnections_options_0","displayName":"0 = Allow simultaneous connections","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wcm_wcm_minimizeconnections_wcm_minimizeconnections_options_1","displayName":"1 = Minimize simultaneous connections","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wcm_wcm_minimizeconnections_wcm_minimizeconnections_options_2","displayName":"2 = Stay connected to cellular","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wcm_wcm_minimizeconnections_wcm_minimizeconnections_options_3","displayName":"3 = Prevent Wi-Fi when on Ethernet","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_wdi_wdidpsscenariodatasizelimitpolicy","displayName":"Diagnostics: Configure scenario retention","description":"This policy setting determines the data retention limit for Diagnostic Policy Service (DPS) scenario data.\r\n\r\nIf you enable this policy setting, you must enter the maximum size of scenario data that should be retained in megabytes. Detailed troubleshooting data related to scenarios will be retained until this limit is reached.\r\n\r\nIf you disable or do not configure this policy setting, the DPS deletes scenario data once it exceeds 128 megabytes in size.\r\n\r\nNo reboots or service restarts are required for this policy setting to take effect: changes take effect immediately.\r\n\r\nThis policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenario data will not be deleted. The DPS can be configured with the Services snap-in to the Microsoft Management Console.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-wdi#admx-wdi-wdidpsscenariodatasizelimitpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_wdi_wdidpsscenariodatasizelimitpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wdi_wdidpsscenariodatasizelimitpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_wdi_wdidpsscenariodatasizelimitpolicy_wdidpsscenariodatasizelimitpolicyvalue","displayName":"Scenario data size limit (in MB) (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_wdi_wdidpsscenarioexecutionpolicy","displayName":"Diagnostics: Configure scenario execution level","description":"This policy setting determines the execution level for Diagnostic Policy Service (DPS) scenarios.\r\n\r\nIf you enable this policy setting, you must select an execution level from the drop-down menu. If you select problem detection and troubleshooting only, the DPS will detect problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will attempt to automatically fix problems it detects or indicate to the user that assisted resolution is available.\r\n\r\nIf you disable this policy setting, Windows cannot detect, troubleshoot, or resolve any problems that are handled by the DPS.\r\n\r\nIf you do not configure this policy setting, the DPS enables all scenarios for resolution by default, unless you configure separate scenario-specific policy settings.\r\n\r\nThis policy setting takes precedence over any scenario-specific policy settings when it is enabled or disabled. Scenario-specific policy settings only take effect if this policy setting is not configured.\r\n\r\nNo reboots or service restarts are required for this policy setting to take effect: changes take effect immediately.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-wdi#admx-wdi-wdidpsscenarioexecutionpolicy"],"options":[{"id":"device_vendor_msft_policy_config_admx_wdi_wdidpsscenarioexecutionpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wdi_wdidpsscenarioexecutionpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_wdi_wdidpsscenarioexecutionpolicy_wdidpsscenarioexecutionpolicylevel","displayName":"Scenario Execution Level (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_wdi_wdidpsscenarioexecutionpolicy_wdidpsscenarioexecutionpolicylevel_1","displayName":"Detection and Troubleshooting Only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wdi_wdidpsscenarioexecutionpolicy_wdidpsscenarioexecutionpolicylevel_2","displayName":"Detection, Troubleshooting and Resolution","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_wincal_turnoffwincal_2","displayName":"Turn off Windows Calendar","description":"Windows Calendar is a feature that allows users to manage appointments and tasks by creating personal calendars, publishing them, and subscribing to other users calendars.\r\n\r\nIf you enable this setting, Windows Calendar will be turned off.\r\n\r\nIf you disable or do not configure this setting, Windows Calendar will be turned on.\r\n\r\nThe default is for Windows Calendar to be turned on.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-wincal#admx-wincal-turnoffwincal-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_wincal_turnoffwincal_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wincal_turnoffwincal_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowscolorsystem_prohibitchanginginstalledprofilelist_2","displayName":"Prohibit installing or uninstalling color profiles","description":"This policy setting affects the ability of users to install or uninstall color profiles.\r\n\r\nIf you enable this policy setting, users cannot install new color profiles or uninstall previously installed color profiles.\r\n\r\nIf you disable or do not configure this policy setting, all users can install new color profiles. Standard users can uninstall color profiles that they previously installed. Administrators will be able to uninstall all color profiles.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowscolorsystem#admx-windowscolorsystem-prohibitchanginginstalledprofilelist-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowscolorsystem_prohibitchanginginstalledprofilelist_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowscolorsystem_prohibitchanginginstalledprofilelist_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_disablewcnui_2","displayName":"Prohibit access of the Windows Connect Now wizards","description":"This policy setting prohibits access to Windows Connect Now (WCN) wizards. \r\n\r\nIf you enable this policy setting, the wizards are turned off and users have no access to any of the wizard tasks. All the configuration related tasks, including \"Set up a wireless router or access point\" and \"Add a wireless device\" are disabled. \r\n\r\nIf you disable or do not configure this policy setting, users can access the wizard tasks, including \"Set up a wireless router or access point\" and \"Add a wireless device.\" The default for this policy setting allows users to access all WCN wizards.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsconnectnow#admx-windowsconnectnow-wcn-disablewcnui-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_disablewcnui_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_disablewcnui_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar","displayName":"Configuration of wireless settings using Windows Connect Now","description":"This policy setting allows the configuration of wireless settings using Windows Connect Now (WCN). The WCN Registrar enables the discovery and configuration of devices over Ethernet (UPnP), over In-band 802.11 WLAN, through the Windows Portable Device API (WPD), and via USB Flash drives.\r\n\r\nAdditional options are available to allow discovery and configuration over a specific medium. \r\n\r\nIf you enable this policy setting, additional choices are available to turn off the operations over a specific medium. \r\n\r\nIf you disable this policy setting, operations are disabled over all media. \r\n\r\nIf you do not configure this policy setting, operations are enabled over all media. \r\n\r\nThe default for this policy setting allows operations over all media.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsconnectnow#admx-windowsconnectnow-wcn-enableregistrar"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar_wcn_enableregistrar_disableflashconfig","displayName":"Turn off ability to configure using a USB Flash Drive (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar_wcn_enableregistrar_disableflashconfig_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar_wcn_enableregistrar_disableflashconfig_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar_wcn_enableregistrar_disableinband802dot11","displayName":"Turn off ability to configure using WCN over In-band 802.11 WLAN (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar_wcn_enableregistrar_disableinband802dot11_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar_wcn_enableregistrar_disableinband802dot11_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar_wcn_enableregistrar_disableupnp","displayName":"Turn off ability to configure using WCN over Ethernet (UPnP) (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar_wcn_enableregistrar_disableupnp_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar_wcn_enableregistrar_disableupnp_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar_wcn_enableregistrar_disablewpd","displayName":"Turn off ability to configure Windows Portable Device (WPD) (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar_wcn_enableregistrar_disablewpd_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar_wcn_enableregistrar_disablewpd_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar_wcn_enableregistrar_maxwcndevicenumber","displayName":"Maximum number of WCN devices allowed: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar_wcn_higher_precedence_registrar","displayName":"Higher precedence medium for devices discovered by multiple media: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar_wcn_higher_precedence_registrar_1","displayName":"WCN over Ethernet (UPnP)","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsconnectnow_wcn_enableregistrar_wcn_higher_precedence_registrar_2","displayName":"WCN over In-band 802.11 WLAN","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_checksamesourceandtargetforfranddfs","displayName":"Verify old and new Folder Redirection targets point to the same share before redirecting","description":"This policy setting allows you to prevent data loss when you change the target location for Folder Redirection, and the new and old targets point to the same network share, but have different network paths.\r\n\r\nIf you enable this policy setting, Folder Redirection creates a temporary file in the old location in order to verify that new and old locations point to the same network share. If both new and old locations point to the same share, the target path is updated and files are not copied or deleted. The temporary file is deleted.\r\n\r\nIf you disable or do not configure this policy setting, Folder Redirection does not create a temporary file and functions as if both new and old locations point to different shares when their network paths are different.\r\n\r\nNote: If the paths point to different network shares, this policy setting is not required. If the paths point to the same network share, any data contained in the redirected folders is deleted if this policy setting is not enabled.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-checksamesourceandtargetforfranddfs"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_checksamesourceandtargetforfranddfs_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_checksamesourceandtargetforfranddfs_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_defaultlibrarieslocation","displayName":"Location where all default Library definition files for users/machines reside.","description":"\r\nThis policy setting allows you to specify a location where all default Library definition files for users/machines reside.\r\n\r\nIf you enable this policy setting, administrators can specify a path where all default Library definition files for users reside. The user will not be allowed to make changes to these Libraries from the UI. On every logon, the policy settings are verified and Libraries for the user are updated or changed according to the path defined.\r\n\r\nIf you disable or do not configure this policy setting, no changes are made to the location of the default Library definition files.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-defaultlibrarieslocation"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_defaultlibrarieslocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_defaultlibrarieslocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_defaultlibrarieslocation_defaultlibrarieslocation","displayName":"Default Libraries definition location (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_disablebinddirectlytopropertysetstorage","displayName":"Disable binding directly to IPropertySetStorage without intermediate layers.","description":"\r\nChanges the behavior of IShellFolder::BindToObject for IID_IPropertySetStorage to not bind directly to the IPropertySetStorage implementation, and to include the intermediate layers provided by the Property System. This behavior is consistent with Windows Vista's behavior in this scenario.\r\n\r\nThis disables access to user-defined properties, and properties stored in NTFS secondary streams.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-disablebinddirectlytopropertysetstorage"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_disablebinddirectlytopropertysetstorage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_disablebinddirectlytopropertysetstorage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_disablemotwoninsecurepathcopy","displayName":"Do not apply the Mark of the Web tag to files copied from insecure sources","description":"This policy setting determines the application of the Mark of the Web tag to files sourced from insecure locations.\r\n\r\nIf you enable this policy setting, files copied from unsecure sources will not be tagged with the Mark of the Web.\r\n\r\nIf you disable or do not configure this policy setting, files copied from unsecure sources will be tagged with the appropriate Mark of the Web.\r\n\r\nNote: Failure to tag files from unsecure sources with the Mark of the Web can expose users’ computers to security risks.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-disablemotwoninsecurepathcopy"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_disablemotwoninsecurepathcopy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_disablemotwoninsecurepathcopy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_enableshellshortcuticonremotepath","displayName":"Allow the use of remote paths in file shortcut icons","description":"This policy setting determines whether remote paths can be used for file shortcut (.lnk file) icons.\r\n\r\nIf you enable this policy setting, file shortcut icons are allowed to be obtained from remote paths.\r\n\r\nIf you disable or do not configure this policy setting, file shortcut icons that use remote paths are prevented from being displayed.\r\n\r\nNote: Allowing the use of remote paths in file shortcut icons can expose users’ computers to security risks.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-enableshellshortcuticonremotepath"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_enableshellshortcuticonremotepath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_enableshellshortcuticonremotepath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_enablesmartscreen","displayName":"Configure Windows Defender SmartScreen","description":"This policy allows you to turn Windows Defender SmartScreen on or off. SmartScreen helps protect PCs by warning users before running potentially malicious programs downloaded from the Internet. This warning is presented as an interstitial dialog shown before running an app that has been downloaded from the Internet and is unrecognized or known to be malicious. No dialog is shown for apps that do not appear to be suspicious.\r\n\r\nSome information is sent to Microsoft about files and programs run on PCs with this feature enabled.\r\n\r\nIf you enable this policy, SmartScreen will be turned on for all users. Its behavior can be controlled by the following options:\r\n\r\n• Warn and prevent bypass\r\n• Warn\r\n\r\nIf you enable this policy with the \"Warn and prevent bypass\" option, SmartScreen's dialogs will not present the user with the option to disregard the warning and run the app. SmartScreen will continue to show the warning on subsequent attempts to run the app.\r\n\r\nIf you enable this policy with the \"Warn\" option, SmartScreen's dialogs will warn the user that the app appears suspicious, but will permit the user to disregard the warning and run the app anyway. SmartScreen will not warn the user again for that app if the user tells SmartScreen to run the app.\r\n\r\nIf you disable this policy, SmartScreen will be turned off for all users. Users will not be warned if they try to run suspicious apps from the Internet.\r\n\r\nIf you do not configure this policy, SmartScreen will be enabled by default, but users may change their settings.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-enablesmartscreen"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_enablesmartscreen_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_enablesmartscreen_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_enablesmartscreen_enablesmartscreendropdown","displayName":"Pick one of the following settings: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_enablesmartscreen_enablesmartscreendropdown_block","displayName":"Warn and prevent bypass","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_enablesmartscreen_enablesmartscreendropdown_warn","displayName":"Warn","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_explorerribbonstartsminimized","displayName":"Start File Explorer with ribbon minimized","description":"This policy setting allows you to specify whether the ribbon appears minimized or in full when new File Explorer windows are opened. If you enable this policy setting, you can set how the ribbon appears the first time users open File Explorer and whenever they open new windows. If you disable or do not configure this policy setting, users can choose how the ribbon appears when they open new windows.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-explorerribbonstartsminimized"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_explorerribbonstartsminimized_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_explorerribbonstartsminimized_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_explorerribbonstartsminimized_explorerribbonstartsminimizeddropdown","displayName":"Pick one of the following settings (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_explorerribbonstartsminimized_explorerribbonstartsminimizeddropdown_1","displayName":"Always open new File Explorer windows with the ribbon minimized.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_explorerribbonstartsminimized_explorerribbonstartsminimizeddropdown_2","displayName":"Never open new File Explorer windows with the ribbon minimized.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_explorerribbonstartsminimized_explorerribbonstartsminimizeddropdown_3","displayName":"Minimize the ribbon when File Explorer is opened the first time.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_explorerribbonstartsminimized_explorerribbonstartsminimizeddropdown_4","displayName":"Display the full ribbon when File Explorer is opened the first time.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_internet","displayName":"Allow previewing and custom thumbnails of OpenSearch query results in File Explorer","description":"\r\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\r\n\r\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nChanges to this setting may not be applied until the user logs off from Windows.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchpreview-internet"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_internet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_internet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_internetlockdown","displayName":"Allow previewing and custom thumbnails of OpenSearch query results in File Explorer","description":"\r\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\r\n\r\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nChanges to this setting may not be applied until the user logs off from Windows.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchpreview-internetlockdown"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_internetlockdown_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_internetlockdown_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_intranet","displayName":"Allow previewing and custom thumbnails of OpenSearch query results in File Explorer","description":"\r\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\r\n\r\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nChanges to this setting may not be applied until the user logs off from Windows.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchpreview-intranet"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_intranet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_intranet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_intranetlockdown","displayName":"Allow previewing and custom thumbnails of OpenSearch query results in File Explorer","description":"\r\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\r\n\r\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nChanges to this setting may not be applied until the user logs off from Windows.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchpreview-intranetlockdown"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_intranetlockdown_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_intranetlockdown_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_localmachine","displayName":"Allow previewing and custom thumbnails of OpenSearch query results in File Explorer","description":"\r\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\r\n\r\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nChanges to this setting may not be applied until the user logs off from Windows.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchpreview-localmachine"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_localmachine_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_localmachine_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_localmachinelockdown","displayName":"Allow previewing and custom thumbnails of OpenSearch query results in File Explorer","description":"\r\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\r\n\r\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nChanges to this setting may not be applied until the user logs off from Windows.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchpreview-localmachinelockdown"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_localmachinelockdown_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_localmachinelockdown_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_restricted","displayName":"Allow previewing and custom thumbnails of OpenSearch query results in File Explorer","description":"\r\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\r\n\r\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you do not configure this policy setting, users cannot preview items or get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nChanges to this setting may not be applied until the user logs off from Windows.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchpreview-restricted"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_restricted_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_restricted_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_restrictedlockdown","displayName":"Allow previewing and custom thumbnails of OpenSearch query results in File Explorer","description":"\r\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\r\n\r\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you do not configure this policy setting, users cannot preview items or get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nChanges to this setting may not be applied until the user logs off from Windows.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchpreview-restrictedlockdown"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_restrictedlockdown_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_restrictedlockdown_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_trusted","displayName":"Allow previewing and custom thumbnails of OpenSearch query results in File Explorer","description":"\r\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\r\n\r\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nChanges to this setting may not be applied until the user logs off from Windows.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchpreview-trusted"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_trusted_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_trusted_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_trustedlockdown","displayName":"Allow previewing and custom thumbnails of OpenSearch query results in File Explorer","description":"\r\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\r\n\r\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer.\r\n\r\nChanges to this setting may not be applied until the user logs off from Windows.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchpreview-trustedlockdown"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_trustedlockdown_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchpreview_trustedlockdown_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_internet","displayName":"Allow OpenSearch queries in File Explorer","description":"\r\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files.\r\n\r\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchquery-internet"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_internet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_internet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_internetlockdown","displayName":"Allow OpenSearch queries in File Explorer","description":"\r\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files.\r\n\r\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchquery-internetlockdown"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_internetlockdown_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_internetlockdown_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_intranet","displayName":"Allow OpenSearch queries in File Explorer","description":"\r\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files.\r\n\r\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchquery-intranet"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_intranet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_intranet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_intranetlockdown","displayName":"Allow OpenSearch queries in File Explorer","description":"\r\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files.\r\n\r\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchquery-intranetlockdown"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_intranetlockdown_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_intranetlockdown_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_localmachine","displayName":"Allow OpenSearch queries in File Explorer","description":"\r\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files.\r\n\r\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchquery-localmachine"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_localmachine_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_localmachine_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_localmachinelockdown","displayName":"Allow OpenSearch queries in File Explorer","description":"\r\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files.\r\n\r\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchquery-localmachinelockdown"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_localmachinelockdown_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_localmachinelockdown_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_restricted","displayName":"Allow OpenSearch queries in File Explorer","description":"\r\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files.\r\n\r\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you do not configure this policy setting, users cannot perform OpenSearch queries in this zone using Search Connectors.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchquery-restricted"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_restricted_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_restricted_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_restrictedlockdown","displayName":"Allow OpenSearch queries in File Explorer","description":"\r\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files.\r\n\r\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you do not configure this policy setting, users cannot perform OpenSearch queries in this zone using Search Connectors.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchquery-restrictedlockdown"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_restrictedlockdown_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_restrictedlockdown_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_trusted","displayName":"Allow OpenSearch queries in File Explorer","description":"\r\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files.\r\n\r\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchquery-trusted"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_trusted_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_trusted_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_trustedlockdown","displayName":"Allow OpenSearch queries in File Explorer","description":"\r\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files.\r\n\r\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\r\n\r\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-iz-policy-opensearchquery-trustedlockdown"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_trustedlockdown_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_iz_policy_opensearchquery_trustedlockdown_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_nonewappalert","displayName":"Do not show the 'new application installed' notification","description":"This policy removes the end-user notification for new application associations. These associations are based on file types (e.g. *.txt) or protocols (e.g. http:)\r\n\r\nIf this group policy is enabled, no notifications will be shown. If the group policy is not configured or disabled, notifications will be shown to the end user if a new application has been installed that can handle the file type or protocol association that was invoked.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-nonewappalert"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_nonewappalert_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_nonewappalert_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_nostrcmplogical","displayName":"Turn off numerical sorting in File Explorer","description":"\r\nThis policy setting allows you to have file names sorted literally (as in Windows 2000 and earlier) rather than in numerical order.\r\nIf you enable this policy setting, File Explorer will sort file names by each digit in a file name (for example, 111 < 22 < 3).\r\nIf you disable or do not configure this policy setting, File Explorer will sort file names by increasing number value (for example, 3 < 22 < 111).\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-nostrcmplogical"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_nostrcmplogical_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_nostrcmplogical_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_shellprotocolprotectedmodetitle_2","displayName":"Turn off shell protocol protected mode","description":"This policy setting allows you to configure the amount of functionality that the shell protocol can have. When using the full functionality of this protocol, applications can open folders and launch files. The protected mode reduces the functionality of this protocol allowing applications to only open a limited set of folders. Applications are not able to open files with this protocol when it is in the protected mode. It is recommended to leave this protocol in the protected mode to increase the security of Windows.\r\n\r\nIf you enable this policy setting the protocol is fully enabled, allowing the opening of folders and files.\r\n\r\nIf you disable this policy setting the protocol is in the protected mode, allowing applications to only open a limited set of folders.\r\n\r\nIf you do not configure this policy setting the protocol is in the protected mode, allowing applications to only open a limited set of folders.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-shellprotocolprotectedmodetitle-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_shellprotocolprotectedmodetitle_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_shellprotocolprotectedmodetitle_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_showhibernateoption","displayName":"Show hibernate in the power options menu","description":"Shows or hides hibernate from the power options menu.\r\n\r\nIf you enable this policy setting, the hibernate option will be shown in the Power Options menu (as long as it is supported by the machine's hardware).\r\n\r\nIf you disable this policy setting, the hibernate option will never be shown in the Power Options menu.\r\n\r\nIf you do not configure this policy setting, users will be able to choose whether they want hibernate to show through the Power Options Control Panel.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-showhibernateoption"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_showhibernateoption_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_showhibernateoption_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_showsleepoption","displayName":"Show sleep in the power options menu","description":"Shows or hides sleep from the power options menu.\r\n\r\nIf you enable this policy setting, the sleep option will be shown in the Power Options menu (as long as it is supported by the machine's hardware).\r\n\r\nIf you disable this policy setting, the sleep option will never be shown in the Power Options menu.\r\n\r\nIf you do not configure this policy setting, users will be able to choose whether they want sleep to show through the Power Options Control Panel.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsexplorer#admx-windowsexplorer-showsleepoption"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_showsleepoption_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsexplorer_showsleepoption_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsfileprotection_wfpdllcachedir","displayName":"Specify Windows File Protection cache location (Windows Insiders only)","description":"This policy setting specifies an alternate location for the Windows File Protection cache.\r\n\r\nIf you enable this policy setting, enter the fully qualified local path to the new location in the \"Cache file path\" box.\r\n\r\nIf you disable this setting or do not configure it, the Windows File Protection cache is located in the %Systemroot%\\System32\\Dllcache directory.\r\n\r\nNote: Do not put the cache on a network shared directory.\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsfileprotection#admx-windowsfileprotection-wfpdllcachedir"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsfileprotection_wfpdllcachedir_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsfileprotection_wfpdllcachedir_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsfileprotection_wfpdllcachedir_wfpdllcachedirbox","displayName":"Cache file path: (Device)","description":"\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_windowsfileprotection_wfpquota","displayName":"Limit Windows File Protection cache size (Windows Insiders only)","description":"This policy setting specifies the maximum amount of disk space that can be used for the Windows File Protection file cache.\r\n\r\nWindows File Protection adds protected files to the cache until the cache content reaches the quota. If the quota is greater than 50 MB, Windows File Protection adds other important Windows XP files to the cache until the cache size reaches the quota.\r\n\r\nIf you enable this policy setting, enter the maximum amount of disk space to be used (in MB). To indicate that the cache size is unlimited, select \"4294967295\" as the maximum amount of disk space.\r\n\r\nIf you disable this policy setting or do not configure it, the default value is set to 50 MB on Windows XP Professional and is unlimited (4294967295 MB) on Windows Server 2003.\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsfileprotection#admx-windowsfileprotection-wfpquota"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsfileprotection_wfpquota_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsfileprotection_wfpquota_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsfileprotection_wfpquota_wfpquota_size","displayName":"Cache size (in MB) (Device)","description":"\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_windowsfileprotection_wfpscan","displayName":"Set Windows File Protection scanning (Windows Insiders only)","description":"This policy setting allows you to set when Windows File Protection scans protected files. This policy setting directs Windows File Protection to enumerate and scan all system files for changes.\r\n\r\nIf you enable this policy setting, select a rate from the \"Scanning Frequency\" box. You can use this setting to direct Windows File Protection to scan files more often.\r\n\r\n-- \"Do not scan during startup,\" the default, scans files only during setup.\r\n\r\n-- \"Scan during startup\" also scans files each time you start Windows XP. This setting delays each startup.\r\n\r\nIf you disable or do not configure this policy setting, by default, files are scanned only during setup.\r\n\r\nNote: This policy setting affects file scanning only. It does not affect the standard background file change detection that Windows File Protection provides.\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsfileprotection#admx-windowsfileprotection-wfpscan"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsfileprotection_wfpscan_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsfileprotection_wfpscan_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsfileprotection_wfpscan_wfpscanlist","displayName":"Scanning frequency: (Device)","description":"\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsfileprotection_wfpscan_wfpscanlist_0","displayName":"Do not scan during startup","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsfileprotection_wfpscan_wfpscanlist_1","displayName":"Scan during startup","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsfileprotection_wfpshowprogress","displayName":"Hide the file scan progress window (Windows Insiders only)","description":"This policy setting hides the file scan progress window. This window provides status information to sophisticated users, but it might confuse novices.\r\n\r\nIf you enable this policy setting, the file scan window does not appear during file scanning.\r\n\r\nIf you disable or do not configure this policy setting, the file scan progress window appears.\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsfileprotection#admx-windowsfileprotection-wfpshowprogress"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsfileprotection_wfpshowprogress_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsfileprotection_wfpshowprogress_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsmediadrm_disableonline","displayName":"Prevent Windows Media DRM Internet Access","description":"Prevents Windows Media Digital Rights Management (DRM) from accessing the Internet (or intranet).\r\n\r\nWhen enabled, Windows Media DRM is prevented from accessing the Internet (or intranet) for license acquisition and security upgrades.\r\n\r\nWhen this policy is enabled, programs are not able to acquire licenses for secure content, upgrade Windows Media DRM security components, or restore backed up content licenses. Secure content that is already licensed to the local computer will continue to play. Users are also able to protect music that they copy from a CD and play this protected content on their computer, since the license is generated locally in this scenario.\r\n\r\nWhen this policy is either disabled or not configured, Windows Media DRM functions normally and will connect to the Internet (or intranet) to acquire licenses, download security upgrades, and perform license restoration.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsmediadrm#admx-windowsmediadrm-disableonline"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsmediadrm_disableonline_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsmediadrm_disableonline_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsmediaplayer_disableautoupdate","displayName":"Prevent Automatic Updates","description":"This policy setting allows you to turn off do not show first use dialog boxes.\r\n\r\nIf you enable this policy setting, the Privacy Options and Installation Options dialog boxes are prevented from being displayed the first time a user starts Windows Media Player.\r\n\r\nThis policy setting prevents the dialog boxes which allow users to select privacy, file types, and other desktop options from being displayed when the Player is first started. Some of the options can be configured by using other Windows Media Player group policies.\r\n\r\nIf you disable or do not configure this policy setting, the dialog boxes are displayed when the user starts the Player for the first time.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer#admx-windowsmediaplayer-disableautoupdate"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsmediaplayer_disableautoupdate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsmediaplayer_disableautoupdate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsmediaplayer_disablesetupfirstuseconfiguration","displayName":"Do Not Show First Use Dialog Boxes","description":"This policy setting allows you to prevent the anchor window from being displayed when Windows Media Player is in skin mode.\r\n\r\nIf you enable this policy setting, the anchor window is hidden when the Player is in skin mode. In addition, the option on the Player tab in the Player that enables users to choose whether the anchor window displays is not available.\r\n\r\nIf you disable or do not configure this policy setting, users can show or hide the anchor window when the Player is in skin mode by using the Player tab in the Player.\r\n\r\nIf you do not configure this policy setting, and the \"Set and lock skin\" policy setting is enabled, some options in the anchor window are not available.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer#admx-windowsmediaplayer-disablesetupfirstuseconfiguration"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsmediaplayer_disablesetupfirstuseconfiguration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsmediaplayer_disablesetupfirstuseconfiguration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsmediaplayer_dontuseframeinterpolation","displayName":"Prevent Video Smoothing","description":"This policy setting allows you to prevent video smoothing from occurring.\r\n\r\nIf you enable this policy setting, video smoothing is prevented, which can improve video playback on computers with limited resources. In addition, the Use Video Smoothing check box in the Video Acceleration Settings dialog box in the Player is cleared and is not available.\r\n\r\nIf you disable this policy setting, video smoothing occurs if necessary, and the Use Video Smoothing check box is selected and is not available.\r\n\r\nIf you do not configure this policy setting, video smoothing occurs if necessary. Users can change the setting for the Use Video Smoothing check box.\r\n\r\nVideo smoothing is available only on the Windows XP Home Edition and Windows XP Professional operating systems.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer#admx-windowsmediaplayer-dontuseframeinterpolation"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsmediaplayer_dontuseframeinterpolation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsmediaplayer_dontuseframeinterpolation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsmediaplayer_preventlibrarysharing","displayName":"Prevent Media Sharing","description":"This policy setting allows you to prevent media sharing from Windows Media Player.\r\n\r\nIf you enable this policy setting, any user on this computer is prevented from sharing digital media content from Windows Media Player with other computers and devices that are on the same network. Media sharing is disabled from Windows Media Player or from programs that depend on the Player's media sharing feature.\r\n\r\nIf you disable or do not configure this policy setting, anyone using Windows Media Player can turn media sharing on or off.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer#admx-windowsmediaplayer-preventlibrarysharing"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsmediaplayer_preventlibrarysharing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsmediaplayer_preventlibrarysharing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsmediaplayer_preventquicklaunchshortcut","displayName":"Prevent Quick Launch Toolbar Shortcut Creation","description":"This policy setting allows you to prevent a shortcut for the Player from being added to the Quick Launch bar.\r\n\r\nIf you enable this policy setting, the user cannot add the shortcut for the Player to the Quick Launch bar.\r\n\r\nIf you disable or do not configure this policy setting, the user can choose whether to add the shortcut for the Player to the Quick Launch bar.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer#admx-windowsmediaplayer-preventquicklaunchshortcut"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsmediaplayer_preventquicklaunchshortcut_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsmediaplayer_preventquicklaunchshortcut_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsmediaplayer_preventwmpdesktopshortcut","displayName":"Prevent Desktop Shortcut Creation","description":"This policy setting allows you to prevent a shortcut icon for the Player from being added to the user's desktop.\r\n\r\nIf you enable this policy setting, users cannot add the Player shortcut icon to their desktops.\r\n\r\nIf you disable or do not configure this policy setting, users can choose whether to add the Player shortcut icon to their desktops.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer#admx-windowsmediaplayer-preventwmpdesktopshortcut"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsmediaplayer_preventwmpdesktopshortcut_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsmediaplayer_preventwmpdesktopshortcut_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsremotemanagement_disallowkerberos_1","displayName":"Disallow Kerberos authentication","description":"This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts Kerberos credentials over the network.\r\n\r\n If you enable this policy setting, the WinRM service does not accept Kerberos credentials over the network.\r\n\r\n If you disable or do not configure this policy setting, the WinRM service accepts Kerberos authentication from a remote client.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement#admx-windowsremotemanagement-disallowkerberos-1"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsremotemanagement_disallowkerberos_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsremotemanagement_disallowkerberos_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsremotemanagement_disallowkerberos_2","displayName":"Disallow Kerberos authentication","description":"This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Kerberos authentication directly.\r\n\r\nIf you enable this policy setting, the Windows Remote Management (WinRM) client does not use Kerberos authentication directly. Kerberos can still be used if the WinRM client is using the Negotiate authentication and Kerberos is selected.\r\n\r\nIf you disable or do not configure this policy setting, the WinRM client uses the Kerberos authentication directly.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement#admx-windowsremotemanagement-disallowkerberos-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsremotemanagement_disallowkerberos_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsremotemanagement_disallowkerberos_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsstore_disableautodownloadwin8","displayName":"Turn off Automatic Download of updates on Win8 machines","description":"Enables or disables the automatic download of app updates on PCs running Windows 8.\r\n\r\nIf you enable this setting, the automatic download of app updates is turned off.\r\n\r\nIf you disable this setting, the automatic download of app updates is turned on.\r\n\r\nIf you don't configure this setting, the automatic download of app updates is determined by a registry setting that the user can change using Settings in the Microsoft Store.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsstore#admx-windowsstore-disableautodownloadwin8"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsstore_disableautodownloadwin8_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsstore_disableautodownloadwin8_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsstore_disableosupgrade_2","displayName":"Turn off the offer to update to the latest version of Windows","description":"Enables or disables the Store offer to update to the latest version of Windows.\r\n\r\nIf you enable this setting, the Store application will not offer updates to the latest version of Windows.\r\n\r\nIf you disable or do not configure this setting the Store application will offer updates to the latest version of Windows.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsstore#admx-windowsstore-disableosupgrade-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsstore_disableosupgrade_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsstore_disableosupgrade_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_windowsstore_removewindowsstore_2","displayName":"Turn off the Store application","description":"Denies or allows access to the Store application.\r\n\r\nIf you enable this setting, access to the Store application is denied. Access to the Store is required for installing app updates.\r\n\r\nIf you disable or don't configure this setting, access to the Store application is allowed.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-windowsstore#admx-windowsstore-removewindowsstore-2"],"options":[{"id":"device_vendor_msft_policy_config_admx_windowsstore_removewindowsstore_2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_windowsstore_removewindowsstore_2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_wininit_disablenamedpipeshutdownpolicydescription","displayName":"Turn off legacy remote shutdown interface","description":"This policy setting controls the legacy remote shutdown interface (named pipe). The named pipe remote shutdown interface is needed in order to shutdown this system from a remote Windows XP or Windows Server 2003 system.\r\n\r\nIf you enable this policy setting, the system does not create the named pipe remote shutdown interface.\r\n\r\nIf you disable or do not configure this policy setting, the system creates the named pipe remote shutdown interface.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-wininit#admx-wininit-disablenamedpipeshutdownpolicydescription"],"options":[{"id":"device_vendor_msft_policy_config_admx_wininit_disablenamedpipeshutdownpolicydescription_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wininit_disablenamedpipeshutdownpolicydescription_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_wininit_hiberboot","displayName":"Require use of fast startup","description":"This policy setting controls the use of fast startup. \r\n\r\nIf you enable this policy setting, the system requires hibernate to be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the local setting is used.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-wininit#admx-wininit-hiberboot"],"options":[{"id":"device_vendor_msft_policy_config_admx_wininit_hiberboot_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wininit_hiberboot_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_wininit_shutdowntimeouthungsessionsdescription","displayName":"Timeout for hung logon sessions during shutdown","description":"This policy setting configures the number of minutes the system waits for the hung logon sessions before proceeding with the system shutdown.\r\n\r\nIf you enable this policy setting, the system waits for the hung logon sessions for the number of minutes specified.\r\n\r\nIf you disable or do not configure this policy setting, the default timeout value is 3 minutes for workstations and 15 minutes for servers.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-wininit#admx-wininit-shutdowntimeouthungsessionsdescription"],"options":[{"id":"device_vendor_msft_policy_config_admx_wininit_shutdowntimeouthungsessionsdescription_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wininit_shutdowntimeouthungsessionsdescription_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_wininit_shutdowntimeouthungsessionsdescription_shutdownsessiontimeout_time","displayName":"Hung session timeout in Minutes: (Device)","description":null,"helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_admx_winlogon_displaylastlogoninfodescription","displayName":"Display information about previous logons during user logon","description":"This policy setting controls whether or not the system displays information about previous logons and logon failures to the user.\r\n\r\nFor local user accounts and domain user accounts in domains of at least a Windows Server 2008 functional level, if you enable this setting, a message appears after the user logs on that displays the date and time of the last successful logon by that user, the date and time of the last unsuccessful logon attempted with that user name, and the number of unsuccessful logons since the last successful logon by that user. This message must be acknowledged by the user before the user is presented with the Microsoft Windows desktop.\r\n\r\nFor domain user accounts in Windows Server 2003, Windows 2000 native, or Windows 2000 mixed functional level domains, if you enable this setting, a warning message will appear that Windows could not retrieve the information and the user will not be able to log on. Therefore, you should not enable this policy setting if the domain is not at the Windows Server 2008 domain functional level.\r\n\r\nIf you disable or do not configure this setting, messages about the previous logon or logon failures are not displayed.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-winlogon#admx-winlogon-displaylastlogoninfodescription"],"options":[{"id":"device_vendor_msft_policy_config_admx_winlogon_displaylastlogoninfodescription_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_winlogon_displaylastlogoninfodescription_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_winlogon_reportcachedlogonpolicydescription","displayName":"Report when logon server was not available during user logon","description":"This policy controls whether the logged on user should be notified if the logon server could not be contacted during logon and he has been logged on using previously stored account information.\r\n\r\nIf enabled, a notification popup will be displayed to the user when the user logs on with cached credentials.\r\n\r\nIf disabled or not configured, no popup will be displayed to the user.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-winlogon#admx-winlogon-reportcachedlogonpolicydescription"],"options":[{"id":"device_vendor_msft_policy_config_admx_winlogon_reportcachedlogonpolicydescription_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_winlogon_reportcachedlogonpolicydescription_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_winlogon_softwaresasgeneration","displayName":"Disable or enable software Secure Attention Sequence","description":"This policy setting controls whether or not software can simulate the Secure Attention Sequence (SAS).\r\n\r\nIf you enable this policy setting, you have one of four options:\r\n\r\nIf you set this policy setting to \"None,\" user mode software cannot simulate the SAS.\r\nIf you set this policy setting to \"Services,\" services can simulate the SAS.\r\nIf you set this policy setting to \"Ease of Access applications,\" Ease of Access applications can simulate the SAS.\r\nIf you set this policy setting to \"Services and Ease of Access applications,\" both services and Ease of Access applications can simulate the SAS.\r\n\r\nIf you disable or do not configure this setting, only Ease of Access applications running on the secure desktop can simulate the SAS.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-winlogon#admx-winlogon-softwaresasgeneration"],"options":[{"id":"device_vendor_msft_policy_config_admx_winlogon_softwaresasgeneration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_winlogon_softwaresasgeneration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_winlogon_softwaresasgeneration_softwaresasgenerationdescription","displayName":"Set which software is allowed to generate the Secure Attention Sequence (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_winlogon_softwaresasgeneration_softwaresasgenerationdescription_0","displayName":"None","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_winlogon_softwaresasgeneration_softwaresasgenerationdescription_1","displayName":"Services","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_winlogon_softwaresasgeneration_softwaresasgenerationdescription_2","displayName":"Ease of Access applications","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_winlogon_softwaresasgeneration_softwaresasgenerationdescription_3","displayName":"Services and Ease of Access applications","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_winsrv_allowblockingappsatshutdown","displayName":"Turn off automatic termination of applications that block or cancel shutdown","description":"This policy setting specifies whether Windows will allow console applications and GUI applications without visible top-level windows to block or cancel shutdown. By default, such applications are automatically terminated if they attempt to cancel shutdown or block it indefinitely.\r\n\r\nIf you enable this setting, console applications or GUI applications without visible top-level windows that block or cancel shutdown will not be automatically terminated during shutdown.\r\n\r\nIf you disable or do not configure this setting, these applications will be automatically terminated during shutdown, helping to ensure that Windows can shut down faster and more smoothly.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-winsrv#admx-winsrv-allowblockingappsatshutdown"],"options":[{"id":"device_vendor_msft_policy_config_admx_winsrv_allowblockingappsatshutdown_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_winsrv_allowblockingappsatshutdown_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_wlansvc_setcost","displayName":"Set Cost","description":"This policy setting configures the cost of Wireless LAN (WLAN) connections on the local machine.\r\n\r\nIf this policy setting is enabled, a drop-down list box presenting possible cost values will be active. Selecting one of the following values from the list will set the cost of all WLAN connections on the local machine:\r\n\r\n- Unrestricted: Use of this connection is unlimited and not restricted by usage charges and capacity constraints. \r\n\r\n- Fixed: Use of this connection is not restricted by usage charges and capacity constraints up to a certain data limit. \r\n\r\n- Variable: This connection is costed on a per byte basis.\r\n\r\nIf this policy setting is disabled or is not configured, the cost of Wireless LAN connections is Unrestricted by default.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-wlansvc#admx-wlansvc-setcost"],"options":[{"id":"device_vendor_msft_policy_config_admx_wlansvc_setcost_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wlansvc_setcost_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_wlansvc_setcost_cost_dropdownlist","displayName":"Please select a wlan connection cost value to set: (Device)","description":null,"helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_admx_wlansvc_setcost_cost_dropdownlist_1","displayName":"Unrestricted","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wlansvc_setcost_cost_dropdownlist_2","displayName":"Fixed","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wlansvc_setcost_cost_dropdownlist_3","displayName":"Variable","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_wlansvc_setpinenforced","displayName":"Require PIN pairing","description":"This policy applies to Wireless Display connections. This policy means that the use of a PIN for pairing to Wireless Display devices is required rather than optional.\r\n\r\nConversely it means that Push Button is NOT allowed.\r\n\r\nIf this policy setting is disabled or is not configured, by default Push Button pairing is allowed (but not necessarily preferred).\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-wlansvc#admx-wlansvc-setpinenforced"],"options":[{"id":"device_vendor_msft_policy_config_admx_wlansvc_setpinenforced_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wlansvc_setpinenforced_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_wlansvc_setpinpreferred","displayName":"Prefer PIN pairing","description":"This policy applies to Wireless Display connections. This policy changes the preference order of the pairing methods.\r\n\r\nWhen enabled, it makes the connections to prefer a PIN for pairing to Wireless Display devices over the Push Button pairing method.\r\n\r\nIf this policy setting is disabled or is not configured, by default Push Button pairing is preferred (if allowed by other policies).\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-wlansvc#admx-wlansvc-setpinpreferred"],"options":[{"id":"device_vendor_msft_policy_config_admx_wlansvc_setpinpreferred_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wlansvc_setpinpreferred_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_workfoldersclient_pol_machineenableworkfolders","displayName":"Force automatic setup for all users","description":"This policy setting specifies whether Work Folders should be set up automatically for all users of the affected computer.\r\n \r\nIf you enable this policy setting, Work Folders will be set up automatically for all users of the affected computer. This prevents users from choosing not to use Work Folders on the computer; it also prevents them from manually specifying the local folder in which Work Folders stores files. Work Folders will use the settings specified in the \"Specify Work Folders settings\" policy setting in User Configuration\\Administrative Templates\\Windows Components\\WorkFolders. If the \"Specify Work Folders settings\" policy setting does not apply to a user, Work Folders is not automatically set up.\r\n \r\nIf you disable or do not configure this policy setting, Work Folders uses the \"Force automatic setup\" option of the \"Specify Work Folders settings\" policy setting to determine whether to automatically set up Work Folders for a given user.\r\n \r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-workfoldersclient#admx-workfoldersclient-pol-machineenableworkfolders"],"options":[{"id":"device_vendor_msft_policy_config_admx_workfoldersclient_pol_machineenableworkfolders_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_workfoldersclient_pol_machineenableworkfolders_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_admx_wpn_notoastnotification","displayName":"Turn off toast notifications","description":"\r\n This policy setting turns off toast notifications for applications.\r\n\r\n If you enable this policy setting, applications will not be able to raise toast notifications.\r\n\r\n Note that this policy does not affect taskbar notification balloons.\r\n\r\n Note that Windows system features are not affected by this policy. You must enable/disable system features individually to stop their ability to raise toast notifications.\r\n\r\n If you disable or do not configure this policy setting, toast notifications are enabled and can be turned off by the administrator or user.\r\n\r\n No reboots or service restarts are required for this policy setting to take effect.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-admx-wpn#admx-wpn-notoastnotification"],"options":[{"id":"device_vendor_msft_policy_config_admx_wpn_notoastnotification_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_admx_wpn_notoastnotification_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationcontrol_built_in_controls","displayName":"App Control for Business Built In Controls","description":"App Control for Business Built In Controls","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":null},{"id":"device_vendor_msft_policy_config_applicationcontrol_built_in_controls_enable_app_control","displayName":"Enable App Control for Business policy to trust Windows components and Store apps","description":"Select Audit only to log all events in local client logs but not block any apps from running or select Enforce to actively block apps from running in a deployed App Control for Business base policy. App Control for Business policies created in either Audit only or Enforce mode will be deployed as rebootless base policies to all devices targeted./nBy default, any devices targeted with this App Control for Business policy will have the setting to Trust Windows components and Store apps enabled, in either audit or enforce mode based on your selection.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":[{"id":"device_vendor_msft_policy_config_applicationcontrol_built_in_controls_enable_app_control_0","displayName":"Enforce","description":"Enforce","helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrol_built_in_controls_enable_app_control_1","displayName":"Audit only","description":"Audit only","helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationcontrol_built_in_controls_trust_apps","displayName":"Select additional rules for trusting apps","description":"By default, any devices targeted with this App Control for Business policy will have the setting to Trust Windows components and Store apps enabled, in either audit or enforce mode based on your selection./nFurther, you can optionally add some additional rules to your policy, such as selecting Trust apps with good reputation to allow reputable apps as defined by the Microsoft Intelligent Security Graph to run./nSelect Trust apps from managed installers to allow apps deployed via authorized sources of application deployment (managed installers). The Intune management extension will be considered a managed installer if it has been set as such within your organization. Any apps not marked as coming from a managed installer will not be allowed to run./nAll other apps and files not specified by the rules in this App Control for Business policy will be audited only in local client logs (if Audit only is selected), or blocked (if Enforce is selected) from running on devices.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create"],"options":[{"id":"device_vendor_msft_policy_config_applicationcontrol_built_in_controls_trust_apps_0","displayName":"Trust apps with good reputation","description":"Trust app with good reputation","helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrol_built_in_controls_trust_apps_1","displayName":"Trust apps from managed installers","description":"Trust apps from managed installers","helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationcontrol_policies_{policyguid}_policiesoptions","displayName":"Configuration settings format","description":"Select Enter XML data to type or paste an XML property list that contains your App Control for Business policy. Select Use built-in controls to choose from toggles exposed in this App Control for Business policy. Setting this to Not Configured will result in default behaviour on the device with no added options from the ApplicationControl CSP on the device.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":[{"id":"device_vendor_msft_policy_config_applicationcontrol_configure_xml_selected","displayName":"Enter xml data","description":"Enter xml data","helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrol_built_in_controls_selected","displayName":"Use built-in controls","description":"Use built-in controls","helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationcontrol_policies_{policyguid}_xml","displayName":"App Control for Business policy","description":"The format of the XML property list varies depending on the settings you are configuring for the ApplicationControl CSP. Microsoft Endpoint Manager will validate the XML format; but not validate the settings behaviour, the settings applicability nor sign the policy binary. ApplicationControl CSP supports base and supplemental policies for devices running the Windows 1903 build and later. Supplemental policies are required to loosen a base policy; and are always less restrictive. A supplemental policy needs to support a specific base policy that has been deployed to the same client. If not, there is no effect on assigned Windows devices.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide"],"options":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_auditmode","displayName":"Audit mode","description":"Turning audit mode on will not enforce the policy. We recommend first running the poliy with audit mode turned on prior to enforcement to determine the impacts of the policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":[{"id":"device_vendor_msft_policy_config_applicationcontrolv2_auditmode_disabled","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_auditmode_enabled","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_buildoptions","displayName":"Policy creation type","description":"Select Enter XML data to type or paste an XML property list that contains your Application Control policy. Select Use built-in controls to choose from toggles exposed in this Application Control policy. Setting this to Not Configured will result in default behaviour on the device with no added options from the ApplicationControl CSP on the device.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":[{"id":"device_vendor_msft_policy_config_applicationcontrolv2_buildoptions_upload_xml_selected","displayName":"XML upload","description":"XML upload","helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_buildoptions_built_in_controls_selected","displayName":"Built-in controls","description":"Built-in controls","helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions","displayName":"Configuration settings format","description":"Select Enter XML data to type or paste an XML property list that contains your Application Control policy. Select Use built-in controls to choose from toggles exposed in this Application Control policy. Setting this to Not Configured will result in default behaviour on the device with no added options from the ApplicationControl CSP on the device.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":[{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_uploadxml","displayName":"Enter xml data","description":"Enter xml data","helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_builtincontrols","displayName":"Use built-in controls","description":"Use built-in controls","helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}","displayName":"Policy rules","description":"","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/defender-csp"],"options":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_action","displayName":"Action","description":"Sets a rule to allow or deny the configured settings.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_action_allow","displayName":"Allow","description":null,"helpText":null}},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_id","displayName":"Rule Id","description":"The Id of the rule, leave this field blank, it will be filled in automatically.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_name","displayName":"Rule Name","description":"The name of the rule","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type","displayName":"Rule Type","description":"Rule Type","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":[{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_publisher","displayName":"Publisher","description":"Creates a rule for a file that is signed by the software publisher. Upload the output generated by the binary file information extractor for your selected reference file.","helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_filehash","displayName":"File Hash","description":"Creates a rule for a file based on its corresponding hash values. Upload a CSV file containing a list of hash values you want to include in this rule or directly type your hash values in the text area below.","helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_filepath","displayName":"File Path","description":"Creates a rule for a specific file path or folder. Selecting folder will affect all files in a folder.","helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_fileattributes","displayName":"File Attributes","description":"Creates a rule for a file based on one of its attributes. Select a file to use as reference for your rule.","helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_fileattributes_filedescriptiondetails","displayName":"File description","description":"The description of the selected file as stated in the file attributes.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_fileattributes_filenamedetails","displayName":"Original file name","description":"The original name of the applications executable as stated in the file attributes.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_fileattributes_internalnamedetails","displayName":"Internal name","description":"The Internal name of the selected file as stated in the file attributes.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_fileattributes_productnamedetails","displayName":"Product name","description":"The product name of the selected file as stated in the file attributes.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_fileattributesdetails","displayName":"File Attributes","description":"Creates a rule for attributes of a selected file.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":[{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_fileattributes_filename","displayName":"Original file name","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_fileattributes_filedescription","displayName":"File description","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_fileattributes_productname","displayName":"Minimum version","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_fileattributes_internalname","displayName":"Internal name","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_filehashdetails","displayName":"File hash","description":"A set of coma separated hashes for use of the application of this rule.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_filepathdetails","displayName":"File Path","description":"The path of the directory or file for application of this rule.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_publisherdetails","displayName":"Publisher","description":"Creates a rule for a file that is signed by the software publisher. Upload the output generated by the binary file information extractor for your selected reference file.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":[{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_publisherdetails_issuingca","displayName":"Issuing certificate authority","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_publisherdetails_publishername","displayName":"Publisher","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_publisherdetails_minimumversion","displayName":"Minimum version","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_publisherfilename","displayName":"File name","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_publisherdetails_issuingcadetails","displayName":"Issuing certificate authority","description":"The name of the issuing certificate authority","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_publisherdetails_minimumversiondetails","displayName":"Minimum Version","description":"The application's minimum version","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_publisherdetails_publishernamedetails","displayName":"Publisher","description":"The name of the application publisher","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_{ruleid}_type_publisherfilenamedetails","displayName":"File name","description":"The name of the applications executable file name.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_basepolicyid","displayName":"Base policy id","description":"The id of the base policy for which this supplemental policy applies.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide"],"options":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_disableruntimefilepathrules","displayName":"Disable runtime file path rules","description":"Turning this off will disable FilePath rule protection of enforcing user-writeability and onlu allowing admin-writable locations.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":[{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_disableruntimefilepathrules_disabled","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_disableruntimefilepathrules_enabled","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_hypervisorprotectedcodeintegrity","displayName":"Hypervisor protected Code Integrity","description":"When enabled, code integrity runs in a hypervisor-protected container.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":[{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_hypervisorprotectedcodeintegrity_disabled","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_hypervisorprotectedcodeintegrity_enabled","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_trustappsfrommanagedinstaller","displayName":"Trust apps from managed installer","description":"Turning Trust apps from managed installer on will not enforce the policy. We recommend first running the poliy with Trust apps from managed installer turned on prior to enforcement to determine the impacts of the policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":[{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_trustappsfrommanagedinstaller_disabled","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_trustappsfrommanagedinstaller_enabled","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_trustappswithgoodreputation","displayName":"Trust apps with good reputation","description":"When enabled, applications with known good reputation as defined by the Microsoft's Intelligent Security Graph (ISG) are white listed.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":[{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_trustappswithgoodreputation_disabled","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_trustappswithgoodreputation_enabled","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_supplementalpolicy_buildoptions_uploadxmldetails","displayName":"XML Upload","description":"The format of the XML property list varies depending on the settings you are configuring for the ApplicationControl CSP. Microsoft Endpoint Manager will validate the XML format; but not validate the settings behaviour, the settings applicability nor sign the policy binary. ApplicationControl CSP supports base and supplemental policies for devices running the Windows 1903 build and later. Supplemental policies are required to loosen a base policy; and are always less restrictive. A supplemental policy needs to support a specific base policy that has been deployed to the same client. If not, there is no effect on assigned Windows devices.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide"],"options":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_trustappsfrommanagedinstaller","displayName":"Trust apps from managed installer","description":"Turning Trust apps from managed installer on will not enforce the policy. We recommend first running the poliy with Trust apps from managed installer turned on prior to enforcement to determine the impacts of the policy.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":[{"id":"device_vendor_msft_policy_config_applicationcontrolv2_trustappsfrommanagedinstaller_disabled","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_trustappsfrommanagedinstaller_enabled","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_trustappswithgoodreputation","displayName":"Trust apps with good reputation","description":"When enabled, applications with known good reputation as defined by the Microsoft's Intelligent Security Graph (ISG) are white listed.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/applicationcontrol-csp"],"options":[{"id":"device_vendor_msft_policy_config_applicationcontrolv2_trustappswithgoodreputation_disabled","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_trustappswithgoodreputation_enabled","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationcontrolv2_xmlupload","displayName":"XML upload","description":"The format of the XML property list varies depending on the settings you are configuring for the ApplicationControl CSP. Microsoft Endpoint Manager will validate the XML format; but not validate the settings behaviour, the settings applicability nor sign the policy binary. ApplicationControl CSP supports base and supplemental policies for devices running the Windows 1903 build and later. Supplemental policies are required to loosen a base policy; and are always less restrictive. A supplemental policy needs to support a specific base policy that has been deployed to the same client. If not, there is no effect on assigned Windows devices.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide"],"options":null},{"id":"device_vendor_msft_policy_config_applicationdefaults_defaultassociationsconfiguration","displayName":"Default Associations Configuration","description":"This policy allows an administrator to set default file type and protocol associations. When set, default associations will be applied on sign-in to the PC. The association file can be created using the DISM tool (dism /online /export-defaultappassociations:appassoc. xml), and then needs to be base64 encoded before being added to SyncML. If policy is enabled and the client machine is Azure Active Directory joined, the associations assigned in SyncML will be processed and default associations will be applied.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-ApplicationDefaults#defaultassociationsconfiguration"],"options":null},{"id":"device_vendor_msft_policy_config_applicationdefaults_enableappurihandlers","displayName":"Enable App Uri Handlers","description":"Enables web-to-app linking, which allows apps to be launched with a http(s) URI","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-ApplicationDefaults#enableappurihandlers"],"options":[{"id":"device_vendor_msft_policy_config_applicationdefaults_enableappurihandlers_0","displayName":"Disabled","description":"Disabled.","helpText":null},{"id":"device_vendor_msft_policy_config_applicationdefaults_enableappurihandlers_1","displayName":"Enabled","description":"Enabled.","helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_allowalltrustedapps","displayName":"Allow All Trusted Apps","description":"Specifies whether non Microsoft Store apps are allowed.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-ApplicationManagement#allowalltrustedapps"],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_allowalltrustedapps_0","displayName":"Explicit deny.","description":"Explicit deny.","helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_allowalltrustedapps_1","displayName":"Explicit allow unlock.","description":"Explicit allow unlock.","helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_allowalltrustedapps_65535","displayName":"Not configured.","description":"Not configured.","helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_allowappstoreautoupdate","displayName":"Allow apps from the Microsoft app store to auto update","description":"Specifies whether automatic update of apps from Microsoft Store are allowed. Most restricted value is 0.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-ApplicationManagement#allowappstoreautoupdate"],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_allowappstoreautoupdate_0","displayName":"Not allowed.","description":"Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_allowappstoreautoupdate_1","displayName":"Allowed.","description":"Allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_allowappstoreautoupdate_2","displayName":"Not configured.","description":"Not configured.","helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_allowdeveloperunlock","displayName":"Allow Developer Unlock","description":"Specifies whether developer unlock is allowed. Most restricted value is 0.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-ApplicationManagement#allowdeveloperunlock"],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_allowdeveloperunlock_0","displayName":"Explicit deny.","description":"Explicit deny.","helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_allowdeveloperunlock_1","displayName":"Explicit allow unlock.","description":"Explicit allow unlock.","helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_allowdeveloperunlock_65535","displayName":"Not configured.","description":"Not configured.","helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_allowgamedvr","displayName":"Allow Game DVR","description":"Note The policy is only enforced in Windows 10 for desktop. Specifies whether DVR and broadcasting is allowed. Most restricted value is 0.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-ApplicationManagement#allowgamedvr"],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_allowgamedvr_0","displayName":"Block","description":"Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_allowgamedvr_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_allowshareduserappdata","displayName":"Allow Shared User App Data","description":"With this policy, you can configure Windows 10 to share application data among multiple users on the system and with other instances of that app. Data shared through the SharedLocal folder is available through the Windows. Storage API. If you previously enabled this policy and now want to disable it, any shared app data remains in the SharedLocal folder.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-ApplicationManagement#allowshareduserappdata"],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_allowshareduserappdata_0","displayName":"Block","description":"Prevented/not allowed, but Microsoft Edge downloads book files to a per-user folder for each user.","helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_allowshareduserappdata_1","displayName":"Allow","description":"Allowed. Microsoft Edge downloads book files into a shared folder. For this policy to work correctly, you must also enable the Allow a Windows app to share application data between users group policy. Also, the users must be signed in with a school or work account.","helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_blocknonadminuserinstall","displayName":"Block Non Admin User Install","description":"Manages non-administrator users' ability to install Windows app packages. If you enable this policy, non-administrators will be unable to initiate installation of Windows app packages. Administrators who wish to install an app will need to do so from an Administrator context (for example, an Administrator PowerShell window). All users will still be able to install Windows app packages via the Microsoft Store, if permitted by other policies. If you disable or do not configure this policy, all users will be able to initiate installation of Windows app packages.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-ApplicationManagement#blocknonadminuserinstall"],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_blocknonadminuserinstall_0","displayName":"Block","description":"Disabled. All users will be able to initiate installation of Windows app packages.","helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_blocknonadminuserinstall_1","displayName":"Allow","description":"Enabled. Non-administrator users will not be able to initiate installation of Windows app packages.","helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_disablestoreoriginatedapps","displayName":"Disable Store Originated Apps","description":"Boolean value that disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-ApplicationManagement#disablestoreoriginatedapps"],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_disablestoreoriginatedapps_0","displayName":"Disabled","description":"Enable launch of apps.","helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_disablestoreoriginatedapps_1","displayName":"Enabled","description":"Disable launch of apps.","helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_launchappafterlogon","displayName":"Launch App After Log On","description":"List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are to be launched after logon.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-ApplicationManagement#launchappafterlogon"],"options":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_msiallowusercontroloverinstall","displayName":"MSI Allow User Control Over Install","description":"This policy setting permits users to change installation options that typically are available only to system administrators. If you enable this policy setting, some of the security features of Windows Installer are bypassed. It permits installations to complete that otherwise would be halted due to a security violation. If you disable or do not configure this policy setting, the security features of Windows Installer prevent users from changing installation options typically reserved for system administrators, such as specifying the directory to which files are installed. If Windows Installer detects that an installation package has permitted the user to change a protected option, it stops the installation and displays a message. These security features operate only when the installation program is running in a privileged security context in which it has access to directories denied to the user. This policy setting is designed for less restrictive environments. It can be used to circumvent errors in an installation program that prevents software from being installed.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-ApplicationManagement#msiallowusercontroloverinstall"],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_msiallowusercontroloverinstall_0","displayName":"Disabled","description":"Disabled","helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_msiallowusercontroloverinstall_1","displayName":"Enabled","description":"Enabled","helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_msialwaysinstallwithelevatedprivileges","displayName":"MSI Always Install With Elevated Privileges","description":"This policy setting directs Windows Installer to use elevated permissions when it installs any program on the system. If you enable this policy setting, privileges are extended to all programs. These privileges are usually reserved for programs that have been assigned to the user (offered on the desktop), assigned to the computer (installed automatically), or made available in Add or Remove Programs in Control Panel. This profile setting lets users install programs that require access to directories that the user might not have permission to view or change, including directories on highly restricted computers. If you disable or do not configure this policy setting, the system applies the current user's permissions when it installs programs that a system administrator does not distribute or offer. Note: This policy setting appears both in the Computer Configuration and User Configuration folders. To make this policy setting effective, you must enable it in both folders. Caution: Skilled users can take advantage of the permissions this policy setting grants to change their privileges and gain permanent access to restricted files and folders. Note that the User Configuration version of this policy setting is not guaranteed to be secure.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-ApplicationManagement#msialwaysinstallwithelevatedprivileges"],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_msialwaysinstallwithelevatedprivileges_0","displayName":"Disabled","description":"Disabled","helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_msialwaysinstallwithelevatedprivileges_1","displayName":"Enabled","description":"Enabled","helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages","displayName":"Remove Default Microsoft Store packages from the system.","description":"Removes Default Microsoft Store packages from the system.\r\n\r\nIf you enable this policy, the selected Microsoft Store apps in the provided list will be uninstalled from the system. You can make adjustments to the default settings.\r\n\r\nUnselected apps in the list will not be removed.\r\n\r\nDefault is 'disabled' (key not present).\r\n\r\nIf the policy is disabled or not configured, no Default Microsoft Store packages will be removed from the system.\r\n\r\n* This is a headless app (no UI)\r\n\r\n** This app is the default handler for a common file type or protocol. Removing this app might result in a degraded user experience. We do not recommend removing this app.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-removedefaultmicrosoftstorepackages"],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_bingnews","displayName":"Microsoft News (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_bingnews_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_bingnews_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_bingweather","displayName":"MSN Weather (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_bingweather_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_bingweather_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_clipchamp","displayName":"Microsoft Clipchamp (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_clipchamp_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_clipchamp_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_copilot","displayName":"Microsoft Copilot (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_copilot_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_copilot_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_gamingapp","displayName":"Xbox Gaming App (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_gamingapp_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_gamingapp_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_mediaplayer","displayName":"Windows Media Player ** (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_mediaplayer_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_mediaplayer_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_microsoftofficehub","displayName":"Microsoft 365 Copilot (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_microsoftofficehub_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_microsoftofficehub_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_microsoftsolitairecollection","displayName":"Microsoft Solitaire Collection (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_microsoftsolitairecollection_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_microsoftsolitairecollection_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_microsoftstickynotes","displayName":"Microsoft Sticky Notes (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_microsoftstickynotes_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_microsoftstickynotes_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_msteams","displayName":"Microsoft Teams (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_msteams_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_msteams_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_outlookforwindows","displayName":"Outlook for Windows (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_outlookforwindows_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_outlookforwindows_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_paint","displayName":"Paint (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_paint_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_paint_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_photos","displayName":"Microsoft Photos ** (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_photos_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_photos_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_quickassist","displayName":"Quick Assist (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_quickassist_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_quickassist_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_screensketch","displayName":"Snipping Tool (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_screensketch_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_screensketch_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_todo","displayName":"Microsoft To Do (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_todo_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_todo_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_windowscalculator","displayName":"Windows Calculator (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_windowscalculator_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_windowscalculator_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_windowscamera","displayName":"Windows Camera ** (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_windowscamera_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_windowscamera_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_windowsfeedbackhub","displayName":"Feedback Hub (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_windowsfeedbackhub_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_windowsfeedbackhub_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_windowsnotepad","displayName":"Windows Notepad ** (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_windowsnotepad_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_windowsnotepad_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_windowssoundrecorder","displayName":"Windows Sound Recorder (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_windowssoundrecorder_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_windowssoundrecorder_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_windowsterminal","displayName":"Windows Terminal (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_windowsterminal_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_windowsterminal_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_xboxidentityprovider","displayName":"Xbox Identity Provider * (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_xboxidentityprovider_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_xboxidentityprovider_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_xboxspeechtotextoverlay","displayName":"Xbox Speech To Text Overlay * (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_xboxspeechtotextoverlay_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_xboxspeechtotextoverlay_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_xboxtcui","displayName":"Xbox TCUI * (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_xboxtcui_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_removedefaultmicrosoftstorepackages_xboxtcui_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_requireprivatestoreonly","displayName":"Require Private Store Only","description":"Allows disabling of the retail catalog and only enables the Private store. Most restricted value is 1.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-ApplicationManagement#requireprivatestoreonly"],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_requireprivatestoreonly_0","displayName":"Allow both public and Private store.","description":"Allow both public and Private store.","helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_requireprivatestoreonly_1","displayName":"Only Private store is enabled.","description":"Only Private store is enabled.","helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_restrictappdatatosystemvolume","displayName":"Restrict App Data To System Volume","description":"Specifies whether application data is restricted to the system drive. Most restricted value is 1.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-ApplicationManagement#restrictappdatatosystemvolume"],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_restrictappdatatosystemvolume_0","displayName":"Disabled","description":"Not restricted.","helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_restrictappdatatosystemvolume_1","displayName":"Enabled","description":"Restricted.","helpText":null}]},{"id":"device_vendor_msft_policy_config_applicationmanagement_restrictapptosystemvolume","displayName":"Restrict App To System Volume","description":"Specifies whether the installation of applications is restricted to the system drive. Most restricted value is 1.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-ApplicationManagement#restrictapptosystemvolume"],"options":[{"id":"device_vendor_msft_policy_config_applicationmanagement_restrictapptosystemvolume_0","displayName":"Disabled","description":"Not restricted.","helpText":null},{"id":"device_vendor_msft_policy_config_applicationmanagement_restrictapptosystemvolume_1","displayName":"Enabled","description":"Restricted.","helpText":null}]},{"id":"device_vendor_msft_policy_config_appruntime_allowmicrosoftaccountstobeoptional","displayName":"Allow Microsoft accounts to be optional","description":"This policy setting lets you control whether Microsoft accounts are optional for packaged Microsoft Store apps that require an account to sign in. This policy only affects packaged Microsoft Store apps that support it.\r\n\r\nIf you enable this policy setting, packaged Microsoft Store apps that typically require a Microsoft account to sign in will allow users to sign in with an enterprise account instead.\r\n\r\nIf you disable or do not configure this policy setting, users will need to sign in with a Microsoft account.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-appruntime#appruntime-allowmicrosoftaccountstobeoptional"],"options":[{"id":"device_vendor_msft_policy_config_appruntime_allowmicrosoftaccountstobeoptional_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appruntime_allowmicrosoftaccountstobeoptional_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_allowappvclient","displayName":"Enable App-V Client","description":"This policy setting allows you to enable or disable Microsoft Application Virtualization (App-V) feature. Reboot is needed for disable to take effect.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-allowappvclient"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_allowappvclient_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowappvclient_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_allowdynamicvirtualization","displayName":"Enable Dynamic Virtualization","description":"Enables Dynamic Virtualization of supported shell extensions, browser helper objects, and ActiveX controls.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-allowdynamicvirtualization"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_allowdynamicvirtualization_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowdynamicvirtualization_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_allowpackagecleanup","displayName":"Enable automatic cleanup of unused appv packages","description":"Enables automatic cleanup of appv packages that were added after Windows10 anniversary release.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-allowpackagecleanup"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_allowpackagecleanup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowpackagecleanup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_allowpackagescripts","displayName":"Enable Package Scripts","description":"Enables scripts defined in the package manifest of configuration files that should run.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-allowpackagescripts"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_allowpackagescripts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowpackagescripts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_allowpublishingrefreshux","displayName":"Enable Publishing Refresh UX","description":"Enables a UX to display to the user when a publishing refresh is performed on the client.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-allowpublishingrefreshux"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_allowpublishingrefreshux_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowpublishingrefreshux_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_allowreportingserver","displayName":"Reporting Server","description":"Reporting Server URL: Displays the URL of reporting server.\r\n\r\n Reporting Time: When the client data should be reported to the server. Acceptable range is 0~23, corresponding to the 24 hours in a day. A good practice is, don't set this time to a busy hour, e.g. 9AM.\r\n \r\n Delay reporting for the random minutes: The maximum minutes of random delay on top of the reporting time. For a busy system, the random delay will help reduce the server load.\r\n \r\n Repeat reporting for every (days): The periodical interval in days for sending the reporting data.\r\n \r\n Data Cache Limit: This value specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The default value is 20 MB. The size applies to the cache in memory. When the limit is reached, the log file will roll over. When a new record is to be added (bottom of the list), one or more of the oldest records (top of the list) will be deleted to make room. A warning will be logged to the Client log and the event log the first time this occurs, and will not be logged again until after the cache has been successfully cleared on transmission and the log has filled up again.\r\n\r\n Data Block Size: This value specifies the maximum size in bytes to transmit to the server at once on a reporting upload, to avoid permanent transmission failures when the log has reached a significant size. The default value is 65536. When transmitting report data to the server, one block at a time of application records that is less than or equal to the block size in bytes of XML data will be removed from the cache and sent to the server. Each block will have the general Client data and global package list data prepended, and these will not factor into the block size calculations; the potential exists for an extremely large package list to result in transmission failures over low bandwidth or unreliable connections.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-allowreportingserver"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_allowreportingserver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowreportingserver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_allowreportingserver_data_block_size","displayName":"Data Block Size","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowreportingserver_data_cache_limit","displayName":"Data Cache Limit","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowreportingserver_interval","displayName":"Repeat reporting for every (days)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowreportingserver_random_delay","displayName":"Delay reporting for the random minutes","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowreportingserver_reporting_server_url_prompt","displayName":"Reporting Server URL","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowreportingserver_start_time","displayName":"Reporting Time","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowroamingfileexclusions","displayName":"Roaming File Exclusions","description":"Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /FILEEXCLUSIONLIST='desktop;my pictures'.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-allowroamingfileexclusions"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_allowroamingfileexclusions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowroamingfileexclusions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_allowroamingfileexclusions_integration_roaming_file_exclusions_prompt","displayName":"Roaming Registry Exclusions","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowroamingregistryexclusions","displayName":"Roaming Registry Exclusions","description":"Specifies the registry paths that do not roam with a user profile. Example usage: /REGISTRYEXCLUSIONLIST=software\\classes;software\\clients.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-allowroamingregistryexclusions"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_allowroamingregistryexclusions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowroamingregistryexclusions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_allowroamingregistryexclusions_integration_roaming_registry_exclusions_prompt","displayName":"Roaming File Exclusions","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowstreamingautoload","displayName":"Specify what to load in background (aka AutoLoad)","description":"Specifies how new packages should be loaded automatically by App-V on a specific computer.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-allowstreamingautoload"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_allowstreamingautoload_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowstreamingautoload_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_allowstreamingautoload_steaming_autoload_options","displayName":"Autoload Options","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_allowstreamingautoload_steaming_autoload_options_0","displayName":"None","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowstreamingautoload_steaming_autoload_options_1","displayName":"Previously Used","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_allowstreamingautoload_steaming_autoload_options_2","displayName":"All","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_clientcoexistenceallowmigrationmode","displayName":"Enable Migration Mode","description":"Migration mode allows the App-V client to modify shortcuts and FTA's for packages created using a previous version of App-V.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-clientcoexistenceallowmigrationmode"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_clientcoexistenceallowmigrationmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_clientcoexistenceallowmigrationmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_integrationallowrootglobal","displayName":"Integration Root User","description":"Specifies the location where symbolic links are created to the current version of a per-user published package. Shortcuts, file type associations, etc. are created pointing to this path. If empty, symbolic links are not used during publishing. Example: %localappdata%\\Microsoft\\AppV\\Client\\Integration.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-integrationallowrootglobal"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_integrationallowrootglobal_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_integrationallowrootglobal_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_integrationallowrootglobal_integration_root_user_prompt","displayName":"Integration Root User","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_integrationallowrootuser","displayName":"Integration Root Global","description":"Specifies the location where symbolic links are created to the current version of a globally published package. Shortcuts, file type associations, etc. are created pointing to this path. If empty, symbolic links are not used during publishing. Example: %allusersprofile%\\Microsoft\\AppV\\Client\\Integration.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-integrationallowrootuser"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_integrationallowrootuser_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_integrationallowrootuser_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_integrationallowrootuser_integration_root_global_prompt","displayName":"Integration Root Global","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1","displayName":"Publishing Server 1 Settings","description":" Publishing Server Display Name: Displays the name of publishing server.\r\n \r\n Publishing Server URL: Displays the URL of publishing server.\r\n \r\n Global Publishing Refresh: Enables global publishing refresh (Boolean).\r\n \r\n Global Publishing Refresh On Logon: Triggers a global publishing refresh on logon (Boolean).\r\n \r\n Global Publishing Refresh Interval: Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0.\r\n \r\n Global Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31).\r\n \r\n User Publishing Refresh: Enables user publishing refresh (Boolean).\r\n \r\n User Publishing Refresh On Logon: Triggers a user publishing refresh on logon (Boolean).\r\n \r\n User Publishing Refresh Interval: Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0.\r\n \r\n User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31).\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-publishingallowserver1"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_global_publishing_refresh_options","displayName":"Global Publishing Refresh","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_global_publishing_refresh_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_global_publishing_refresh_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_global_refresh_interval_prompt","displayName":"Global Publishing Refresh Interval","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_global_refresh_onlogon_options","displayName":"Global Publishing Refresh On Logon","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_global_refresh_onlogon_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_global_refresh_onlogon_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_global_refresh_unit_options","displayName":"Global Publishing Refresh Interval Unit","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_global_refresh_unit_options_0","displayName":"Hour","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_global_refresh_unit_options_1","displayName":"Day","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_publishing_server_url_prompt","displayName":"Publishing Server URL","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_publishing_server1_name_prompt","displayName":"Publishing Server Display Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_user_publishing_refresh_options","displayName":"User Publishing Refresh","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_user_publishing_refresh_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_user_publishing_refresh_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_user_refresh_interval_prompt","displayName":"User Publishing Refresh Interval","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_user_refresh_onlogon_options","displayName":"User Publishing Refresh On Logon","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_user_refresh_onlogon_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_user_refresh_onlogon_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_user_refresh_unit_options","displayName":"User Publishing Refresh Interval Unit","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_user_refresh_unit_options_0","displayName":"Hour","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver1_user_refresh_unit_options_1","displayName":"Day","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2","displayName":"Publishing Server 2 Settings","description":" Publishing Server Display Name: Displays the name of publishing server.\r\n \r\n Publishing Server URL: Displays the URL of publishing server.\r\n \r\n Global Publishing Refresh: Enables global publishing refresh (Boolean).\r\n \r\n Global Publishing Refresh On Logon: Triggers a global publishing refresh on logon (Boolean).\r\n \r\n Global Publishing Refresh Interval: Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0.\r\n \r\n Global Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31).\r\n \r\n User Publishing Refresh: Enables user publishing refresh (Boolean).\r\n \r\n User Publishing Refresh On Logon: Triggers a user publishing refresh on logon (Boolean).\r\n \r\n User Publishing Refresh Interval: Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0.\r\n \r\n User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31).\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-publishingallowserver2"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_global_publishing_refresh_options","displayName":"Global Publishing Refresh","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_global_publishing_refresh_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_global_publishing_refresh_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_global_refresh_interval_prompt","displayName":"Global Publishing Refresh Interval","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_global_refresh_onlogon_options","displayName":"Global Publishing Refresh On Logon","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_global_refresh_onlogon_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_global_refresh_onlogon_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_global_refresh_unit_options","displayName":"Global Publishing Refresh Interval Unit","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_global_refresh_unit_options_0","displayName":"Hour","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_global_refresh_unit_options_1","displayName":"Day","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_publishing_server_url_prompt","displayName":"Publishing Server URL","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_publishing_server2_name_prompt","displayName":"Publishing Server Display Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_user_publishing_refresh_options","displayName":"User Publishing Refresh","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_user_publishing_refresh_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_user_publishing_refresh_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_user_refresh_interval_prompt","displayName":"User Publishing Refresh Interval","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_user_refresh_onlogon_options","displayName":"User Publishing Refresh On Logon","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_user_refresh_onlogon_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_user_refresh_onlogon_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_user_refresh_unit_options","displayName":"User Publishing Refresh Interval Unit","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_user_refresh_unit_options_0","displayName":"Hour","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver2_user_refresh_unit_options_1","displayName":"Day","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3","displayName":"Publishing Server 3 Settings","description":" Publishing Server Display Name: Displays the name of publishing server.\r\n \r\n Publishing Server URL: Displays the URL of publishing server.\r\n \r\n Global Publishing Refresh: Enables global publishing refresh (Boolean).\r\n \r\n Global Publishing Refresh On Logon: Triggers a global publishing refresh on logon (Boolean).\r\n \r\n Global Publishing Refresh Interval: Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0.\r\n \r\n Global Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31).\r\n \r\n User Publishing Refresh: Enables user publishing refresh (Boolean).\r\n \r\n User Publishing Refresh On Logon: Triggers a user publishing refresh on logon (Boolean).\r\n \r\n User Publishing Refresh Interval: Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0.\r\n \r\n User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31).\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-publishingallowserver3"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_global_publishing_refresh_options","displayName":"Global Publishing Refresh","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_global_publishing_refresh_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_global_publishing_refresh_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_global_refresh_interval_prompt","displayName":"Global Publishing Refresh Interval","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_global_refresh_onlogon_options","displayName":"Global Publishing Refresh On Logon","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_global_refresh_onlogon_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_global_refresh_onlogon_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_global_refresh_unit_options","displayName":"Global Publishing Refresh Interval Unit","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_global_refresh_unit_options_0","displayName":"Hour","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_global_refresh_unit_options_1","displayName":"Day","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_publishing_server_url_prompt","displayName":"Publishing Server URL","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_publishing_server3_name_prompt","displayName":"Publishing Server Display Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_user_publishing_refresh_options","displayName":"User Publishing Refresh","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_user_publishing_refresh_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_user_publishing_refresh_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_user_refresh_interval_prompt","displayName":"User Publishing Refresh Interval","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_user_refresh_onlogon_options","displayName":"User Publishing Refresh On Logon","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_user_refresh_onlogon_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_user_refresh_onlogon_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_user_refresh_unit_options","displayName":"User Publishing Refresh Interval Unit","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_user_refresh_unit_options_0","displayName":"Hour","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver3_user_refresh_unit_options_1","displayName":"Day","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4","displayName":"Publishing Server 4 Settings","description":" Publishing Server Display Name: Displays the name of publishing server.\r\n \r\n Publishing Server URL: Displays the URL of publishing server.\r\n \r\n Global Publishing Refresh: Enables global publishing refresh (Boolean).\r\n \r\n Global Publishing Refresh On Logon: Triggers a global publishing refresh on logon (Boolean).\r\n \r\n Global Publishing Refresh Interval: Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0.\r\n \r\n Global Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31).\r\n \r\n User Publishing Refresh: Enables user publishing refresh (Boolean).\r\n \r\n User Publishing Refresh On Logon: Triggers a user publishing refresh on logon (Boolean).\r\n \r\n User Publishing Refresh Interval: Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0.\r\n \r\n User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31).\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-publishingallowserver4"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_global_publishing_refresh_options","displayName":"Global Publishing Refresh","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_global_publishing_refresh_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_global_publishing_refresh_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_global_refresh_interval_prompt","displayName":"Global Publishing Refresh Interval","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_global_refresh_onlogon_options","displayName":"Global Publishing Refresh On Logon","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_global_refresh_onlogon_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_global_refresh_onlogon_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_global_refresh_unit_options","displayName":"Global Publishing Refresh Interval Unit","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_global_refresh_unit_options_0","displayName":"Hour","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_global_refresh_unit_options_1","displayName":"Day","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_publishing_server_url_prompt","displayName":"Publishing Server URL","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_publishing_server4_name_prompt","displayName":"Publishing Server Display Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_user_publishing_refresh_options","displayName":"User Publishing Refresh","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_user_publishing_refresh_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_user_publishing_refresh_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_user_refresh_interval_prompt","displayName":"User Publishing Refresh Interval","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_user_refresh_onlogon_options","displayName":"User Publishing Refresh On Logon","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_user_refresh_onlogon_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_user_refresh_onlogon_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_user_refresh_unit_options","displayName":"User Publishing Refresh Interval Unit","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_user_refresh_unit_options_0","displayName":"Hour","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver4_user_refresh_unit_options_1","displayName":"Day","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5","displayName":"Publishing Server 5 Settings","description":" Publishing Server Display Name: Displays the name of publishing server.\r\n \r\n Publishing Server URL: Displays the URL of publishing server.\r\n \r\n Global Publishing Refresh: Enables global publishing refresh (Boolean).\r\n \r\n Global Publishing Refresh On Logon: Triggers a global publishing refresh on logon (Boolean).\r\n \r\n Global Publishing Refresh Interval: Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0.\r\n \r\n Global Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31).\r\n \r\n User Publishing Refresh: Enables user publishing refresh (Boolean).\r\n \r\n User Publishing Refresh On Logon: Triggers a user publishing refresh on logon (Boolean).\r\n \r\n User Publishing Refresh Interval: Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0.\r\n \r\n User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31).\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-publishingallowserver5"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_global_publishing_refresh_options","displayName":"Global Publishing Refresh","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_global_publishing_refresh_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_global_publishing_refresh_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_global_refresh_interval_prompt","displayName":"Global Publishing Refresh Interval","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_global_refresh_onlogon_options","displayName":"Global Publishing Refresh On Logon","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_global_refresh_onlogon_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_global_refresh_onlogon_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_global_refresh_unit_options","displayName":"Global Publishing Refresh Interval Unit","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_global_refresh_unit_options_0","displayName":"Hour","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_global_refresh_unit_options_1","displayName":"Day","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_publishing_server_url_prompt","displayName":"Publishing Server URL","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_publishing_server5_name_prompt","displayName":"Publishing Server Display Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_user_publishing_refresh_options","displayName":"User Publishing Refresh","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_user_publishing_refresh_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_user_publishing_refresh_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_user_refresh_interval_prompt","displayName":"User Publishing Refresh Interval","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_user_refresh_onlogon_options","displayName":"User Publishing Refresh On Logon","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_user_refresh_onlogon_options_0","displayName":"False","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_user_refresh_onlogon_options_1","displayName":"True","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_user_refresh_unit_options","displayName":"User Publishing Refresh Interval Unit","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_user_refresh_unit_options_0","displayName":"Hour","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_publishingallowserver5_user_refresh_unit_options_1","displayName":"Day","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowcertificatefilterforclient_ssl","displayName":"Certificate Filter For Client SSL","description":"Specifies the path to a valid certificate in the certificate store.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-streamingallowcertificatefilterforclient-ssl"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowcertificatefilterforclient_ssl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowcertificatefilterforclient_ssl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowcertificatefilterforclient_ssl_streaming_certificate_filter_for_client_ssl_prompt","displayName":"Certificate Filter For Client SSL","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowhighcostlaunch","displayName":"Allow First Time Application Launches if on a High Cost Windows 8 Metered Connection","description":"This setting controls whether virtualized applications are launched on Windows 8 machines connected via a metered network connection (e.g. 4G).","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-streamingallowhighcostlaunch"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowhighcostlaunch_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowhighcostlaunch_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowlocationprovider","displayName":"Location Provider","description":"Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-streamingallowlocationprovider"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowlocationprovider_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowlocationprovider_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowlocationprovider_streaming_location_provider_prompt","displayName":"Location Provider","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowpackageinstallationroot","displayName":"Package Installation Root","description":"Specifies directory where all new applications and updates will be installed.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-streamingallowpackageinstallationroot"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowpackageinstallationroot_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowpackageinstallationroot_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowpackageinstallationroot_streaming_package_installation_root_prompt","displayName":"Package Installation Root","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowpackagesourceroot","displayName":"Package Source Root","description":"Overrides source location for downloading package content.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-streamingallowpackagesourceroot"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowpackagesourceroot_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowpackagesourceroot_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowpackagesourceroot_package_source_root_prompt","displayName":"Package Source Root","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowreestablishmentinterval","displayName":"Reestablishment Interval","description":"Specifies the number of seconds between attempts to reestablish a dropped session.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-streamingallowreestablishmentinterval"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowreestablishmentinterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowreestablishmentinterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowreestablishmentinterval_streaming_reestablishment_interval_prompt","displayName":"Reestablishment Interval:","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowreestablishmentretries","displayName":"Reestablishment Retries","description":"Specifies the number of times to retry a dropped session.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-streamingallowreestablishmentretries"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowreestablishmentretries_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowreestablishmentretries_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingallowreestablishmentretries_streaming_reestablishment_retries_prompt","displayName":"Reestablishment Retries:","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingsharedcontentstoremode","displayName":"Shared Content Store (SCS) mode","description":"Specifies that streamed package contents will be not be saved to the local hard disk.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-streamingsharedcontentstoremode"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_streamingsharedcontentstoremode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingsharedcontentstoremode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingsupportbranchcache","displayName":"Enable Support for BranchCache","description":"If enabled, the App-V client will support BrancheCache compatible HTTP streaming. If BranchCache support is not desired, this should be disabled. The client can then apply HTTP optimizations which are incompatible with BranchCache","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-streamingsupportbranchcache"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_streamingsupportbranchcache_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingsupportbranchcache_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingverifycertificaterevocationlist","displayName":"Verify certificate revocation list","description":"Verifies Server certificate revocation status before streaming using HTTPS.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-streamingverifycertificaterevocationlist"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_streamingverifycertificaterevocationlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_streamingverifycertificaterevocationlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_virtualcomponentsallowlist","displayName":"Virtual Component Process Allow List","description":"Specifies a list of process paths (may contain wildcards) which are candidates for using virtual components (shell extensions, browser helper objects, etc). Only processes whose full path matches one of these items can use virtual components.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-appvirtualization#appvirtualization-virtualcomponentsallowlist"],"options":[{"id":"device_vendor_msft_policy_config_appvirtualization_virtualcomponentsallowlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_appvirtualization_virtualcomponentsallowlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_appvirtualization_virtualcomponentsallowlist_virtualization_jitvallowlist_prompt","displayName":"Virtual Component Process Allow List","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditcredentialvalidation","displayName":"Account Logon Audit Credential Validation","description":"This policy setting allows you to audit events generated by validation tests on user account logon credentials. Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountlogon_auditcredentialvalidation"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditcredentialvalidation_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditcredentialvalidation_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditcredentialvalidation_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditcredentialvalidation_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditkerberosauthenticationservice","displayName":"Account Logon Audit Kerberos Authentication Service","description":"This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountlogon_auditkerberosauthenticationservice"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditkerberosauthenticationservice_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditkerberosauthenticationservice_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditkerberosauthenticationservice_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditkerberosauthenticationservice_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditkerberosserviceticketoperations","displayName":"Account Logon Audit Kerberos Service Ticket Operations","description":"This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountlogon_auditkerberosserviceticketoperations"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditkerberosserviceticketoperations_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditkerberosserviceticketoperations_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditkerberosserviceticketoperations_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditkerberosserviceticketoperations_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditotheraccountlogonevents","displayName":"Account Logon Audit Other Account Logon Events","description":"This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. Currently, there are no events in this subcategory.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountlogon_auditotheraccountlogonevents"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditotheraccountlogonevents_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditotheraccountlogonevents_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditotheraccountlogonevents_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogon_auditotheraccountlogonevents_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditaccountlockout","displayName":"Account Logon Logoff Audit Account Lockout","description":"This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. Logon events are essential for understanding user activity and to detect potential attacks.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountlogonlogoff_auditaccountlockout"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditaccountlockout_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditaccountlockout_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditaccountlockout_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditaccountlockout_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditgroupmembership","displayName":"Account Logon Logoff Audit Group Membership","description":"This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\\System Audit Policies\\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountlogonlogoff_auditgroupmembership"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditgroupmembership_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditgroupmembership_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditgroupmembership_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditgroupmembership_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditipsecextendedmode","displayName":"Account Logon Logoff Audit I Psec Extended Mode","description":"This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountlogonlogoff_auditipsecextendedmode"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditipsecextendedmode_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditipsecextendedmode_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditipsecextendedmode_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditipsecextendedmode_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditipsecmainmode","displayName":"Account Logon Logoff Audit I Psec Main Mode","description":"This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountlogonlogoff_auditipsecmainmode"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditipsecmainmode_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditipsecmainmode_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditipsecmainmode_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditipsecmainmode_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditipsecquickmode","displayName":"Account Logon Logoff Audit I Psec Quick Mode","description":"This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountlogonlogoff_auditipsecquickmode"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditipsecquickmode_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditipsecquickmode_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditipsecquickmode_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditipsecquickmode_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditlogoff","displayName":"Account Logon Logoff Audit Logoff","description":"This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. If you do not configure this policy setting, no audit event is generated when a logon session is closed.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountlogonlogoff_auditlogoff"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditlogoff_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditlogoff_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditlogoff_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditlogoff_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditlogon","displayName":"Account Logon Logoff Audit Logon","description":"This policy setting allows you to audit events generated by user account logon attempts on the computer. Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: Successful logon attempts. Failed logon attempts. Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. Security identifiers (SIDs) were filtered and not allowed to log on.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountlogonlogoff_auditlogon"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditlogon_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditlogon_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditlogon_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditlogon_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditnetworkpolicyserver","displayName":"Account Logon Logoff Audit Network Policy Server","description":"This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. If you do not configure this policy settings, IAS and NAP user access requests are not audited.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountlogonlogoff_auditnetworkpolicyserver"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditnetworkpolicyserver_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditnetworkpolicyserver_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditnetworkpolicyserver_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditnetworkpolicyserver_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditotherlogonlogoffevents","displayName":"Audit Other Logon Logoff Events","description":"This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting such as the following: Terminal Services session disconnections. New Terminal Services sessions. Locking and unlocking a workstation. Invoking a screen saver. Dismissal of a screen saver. Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. Access to a wireless network granted to a user or computer account. Access to a wired 802.1x network granted to a user or computer account.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountlogonlogoff_auditotherlogonlogoffevents"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditotherlogonlogoffevents_0","displayName":"Off/None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditotherlogonlogoffevents_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditotherlogonlogoffevents_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditotherlogonlogoffevents_3","displayName":"Success+Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditspeciallogon","displayName":"Audit Special Logon","description":"This policy setting allows you to audit events generated by special logons such as the following : The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see article 947223 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121697).","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountlogonlogoff_auditspeciallogon"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditspeciallogon_0","displayName":"Off/None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditspeciallogon_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditspeciallogon_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_auditspeciallogon_3","displayName":"Success+Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_audituserdeviceclaims","displayName":"Account Logon Logoff Audit User Device Claims","description":"This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\\System Audit Policies\\Logon/Logoff. Multiple events are generated if the user and device claims information cannot fit in a single security audit event.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountlogonlogoff_audituserdeviceclaims"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_audituserdeviceclaims_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_audituserdeviceclaims_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_audituserdeviceclaims_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountlogonlogoff_audituserdeviceclaims_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditapplicationgroupmanagement","displayName":"Account Management Audit Application Group Management","description":"This policy setting allows you to audit events generated by changes to application groups such as the following: Application group is created, changed, or deleted. Member is added or removed from an application group. If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an application group changes.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountmanagement_auditapplicationgroupmanagement"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditapplicationgroupmanagement_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditapplicationgroupmanagement_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditapplicationgroupmanagement_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditapplicationgroupmanagement_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditcomputeraccountmanagement","displayName":"Account Management Audit Computer Account Management","description":"This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a computer account changes.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountmanagement_auditcomputeraccountmanagement"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditcomputeraccountmanagement_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditcomputeraccountmanagement_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditcomputeraccountmanagement_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditcomputeraccountmanagement_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditdistributiongroupmanagement","displayName":"Account Management Audit Distribution Group Management","description":"This policy setting allows you to audit events generated by changes to distribution groups such as the following: Distribution group is created, changed, or deleted. Member is added or removed from a distribution group. Distribution group type is changed. If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a distribution group changes. Note: Events in this subcategory are logged only on domain controllers.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountmanagement_auditdistributiongroupmanagement"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditdistributiongroupmanagement_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditdistributiongroupmanagement_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditdistributiongroupmanagement_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditdistributiongroupmanagement_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditotheraccountmanagementevents","displayName":"Account Management Audit Other Account Management Events","description":"This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. Changes to the Default Domain Group Policy under the following Group Policy paths: Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Account Lockout Policy","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountmanagement_auditotheraccountmanagementevents"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditotheraccountmanagementevents_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditotheraccountmanagementevents_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditotheraccountmanagementevents_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditotheraccountmanagementevents_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditsecuritygroupmanagement","displayName":"Audit Security Group Management","description":"This policy setting allows you to audit events generated by changes to security groups such as the following: Security group is created, changed, or deleted. Member is added or removed from a security group. Group type is changed. If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a security group changes.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountmanagement_auditsecuritygroupmanagement"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditsecuritygroupmanagement_0","displayName":"Off/None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditsecuritygroupmanagement_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditsecuritygroupmanagement_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_auditsecuritygroupmanagement_3","displayName":"Success+Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_audituseraccountmanagement","displayName":"Audit User Account Management","description":"This policy setting allows you to audit changes to user accounts. Events include the following: A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. A user account’s password is set or changed. A security identifier (SID) is added to the SID History of a user account. The Directory Services Restore Mode password is configured. Permissions on administrative user accounts are changed. Credential Manager credentials are backed up or restored. If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a user account changes.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#accountmanagement_audituseraccountmanagement"],"options":[{"id":"device_vendor_msft_policy_config_audit_accountmanagement_audituseraccountmanagement_0","displayName":"Off/None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_audituseraccountmanagement_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_audituseraccountmanagement_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_accountmanagement_audituseraccountmanagement_3","displayName":"Success+Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditdpapiactivity","displayName":"Detailed Tracking Audit DPAPI Activity","description":"This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#detailedtracking_auditdpapiactivity"],"options":[{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditdpapiactivity_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditdpapiactivity_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditdpapiactivity_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditdpapiactivity_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditpnpactivity","displayName":"Detailed Tracking Audit PNP Activity","description":"This policy setting allows you to audit when plug and play detects an external device. If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#detailedtracking_auditpnpactivity"],"options":[{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditpnpactivity_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditpnpactivity_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditpnpactivity_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditpnpactivity_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditprocesscreation","displayName":"Detailed Tracking Audit Process Creation","description":"This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a process is created.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#detailedtracking_auditprocesscreation"],"options":[{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditprocesscreation_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditprocesscreation_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditprocesscreation_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditprocesscreation_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditprocesstermination","displayName":"Detailed Tracking Audit Process Termination","description":"This policy setting allows you to audit events generated when a process ends. If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a process ends.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#detailedtracking_auditprocesstermination"],"options":[{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditprocesstermination_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditprocesstermination_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditprocesstermination_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditprocesstermination_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditrpcevents","displayName":"Detailed Tracking Audit RPC Events","description":"This policy setting allows you to audit inbound remote procedure call (RPC) connections. If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#detailedtracking_auditrpcevents"],"options":[{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditrpcevents_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditrpcevents_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditrpcevents_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_auditrpcevents_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_audittokenrightadjusted","displayName":"Detailed Tracking Audit Token Right Adjusted","description":"This policy setting allows you to audit events generated by adjusting the privileges of a token.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#detailedtracking_audittokenrightadjusted"],"options":[{"id":"device_vendor_msft_policy_config_audit_detailedtracking_audittokenrightadjusted_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_audittokenrightadjusted_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_audittokenrightadjusted_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_detailedtracking_audittokenrightadjusted_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdetaileddirectoryservicereplication","displayName":"DS Access Audit Detailed Directory Service Replication","description":"This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#dsaccess_auditdetaileddirectoryservicereplication"],"options":[{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdetaileddirectoryservicereplication_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdetaileddirectoryservicereplication_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdetaileddirectoryservicereplication_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdetaileddirectoryservicereplication_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryserviceaccess","displayName":"DS Access Audit Directory Service Access","description":"This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. Only AD DS objects with a matching system access control list (SACL) are logged. Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#dsaccess_auditdirectoryserviceaccess"],"options":[{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryserviceaccess_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryserviceaccess_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryserviceaccess_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryserviceaccess_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryservicechanges","displayName":"Audit Directory Service Changes","description":"This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. When possible, events logged in this subcategory indicate the old and new values of the object’s properties. Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. Note: Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#dsaccess_auditdirectoryservicechanges"],"options":[{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryservicechanges_0","displayName":"Off/None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryservicechanges_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryservicechanges_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryservicechanges_3","displayName":"Success+Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryservicereplication","displayName":"DS Access Audit Directory Service Replication","description":"This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. If you do not configure this policy setting, no audit event is generated during AD DS replication.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#dsaccess_auditdirectoryservicereplication"],"options":[{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryservicereplication_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryservicereplication_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryservicereplication_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_dsaccess_auditdirectoryservicereplication_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditapplicationgenerated","displayName":"Object Access Audit Application Generated","description":"This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. Events in this subcategory include: Creation of an application client context. Deletion of an application client context. Initialization of an application client context. Other application operations using the Windows Auditing APIs.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#objectaccess_auditapplicationgenerated"],"options":[{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditapplicationgenerated_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditapplicationgenerated_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditapplicationgenerated_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditapplicationgenerated_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditcentralaccesspolicystaging","displayName":"Object Access Audit Central Access Policy Staging","description":"This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: 1) Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. 2) Failure audits when configured records access attempts when: a) The current central access policy does not grant access but the proposed policy grants access. b) A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#objectaccess_auditcentralaccesspolicystaging"],"options":[{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditcentralaccesspolicystaging_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditcentralaccesspolicystaging_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditcentralaccesspolicystaging_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditcentralaccesspolicystaging_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditcertificationservices","displayName":"Object Access Audit Certification Services","description":"This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. AD CS operations include the following: AD CS startup/shutdown/backup/restore. Changes to the certificate revocation list (CRL). New certificate requests. Issuing of a certificate. Revocation of a certificate. Changes to the Certificate Manager settings for AD CS. Changes in the configuration of AD CS. Changes to a Certificate Services template. Importing of a certificate. Publishing of a certification authority certificate is to Active Directory Domain Services. Changes to the security permissions for AD CS. Archival of a key. Importing of a key. Retrieval of a key. Starting of Online Certificate Status Protocol (OCSP) Responder Service. Stopping of Online Certificate Status Protocol (OCSP) Responder Service.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#objectaccess_auditcertificationservices"],"options":[{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditcertificationservices_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditcertificationservices_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditcertificationservices_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditcertificationservices_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditdetailedfileshare","displayName":"Object Access Audit Detailed File Share","description":"This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#objectaccess_auditdetailedfileshare"],"options":[{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditdetailedfileshare_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditdetailedfileshare_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditdetailedfileshare_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditdetailedfileshare_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfileshare","displayName":"Audit File Share Access","description":"This policy setting allows you to audit attempts to access a shared folder. If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#objectaccess_auditfileshare"],"options":[{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfileshare_0","displayName":"Off/None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfileshare_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfileshare_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfileshare_3","displayName":"Success+Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfilesystem","displayName":"Object Access Audit File System","description":"This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see https://go.microsoft.com/fwlink/?LinkId=122083. If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. Note: You can set a SACL on a file system object using the Security tab in that object's Properties dialog box.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#objectaccess_auditfilesystem"],"options":[{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfilesystem_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfilesystem_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfilesystem_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfilesystem_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfilteringplatformconnection","displayName":"Object Access Audit Filtering Platform Connection","description":"This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: The Windows Firewall Service blocks an application from accepting incoming connections on the network. The WFP allows a connection. The WFP blocks a connection. The WFP permits a bind to a local port. The WFP blocks a bind to a local port. The WFP allows a connection. The WFP blocks a connection. The WFP permits an application or service to listen on a port for incoming connections. The WFP blocks an application or service to listen on a port for incoming connections. If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#objectaccess_auditfilteringplatformconnection"],"options":[{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfilteringplatformconnection_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfilteringplatformconnection_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfilteringplatformconnection_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfilteringplatformconnection_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfilteringplatformpacketdrop","displayName":"Object Access Audit Filtering Platform Packet Drop","description":"This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP).","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#objectaccess_auditfilteringplatformpacketdrop"],"options":[{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfilteringplatformpacketdrop_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfilteringplatformpacketdrop_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfilteringplatformpacketdrop_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditfilteringplatformpacketdrop_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_objectaccess_audithandlemanipulation","displayName":"Object Access Audit Handle Manipulation","description":"This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a handle is manipulated. Note: Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#objectaccess_audithandlemanipulation"],"options":[{"id":"device_vendor_msft_policy_config_audit_objectaccess_audithandlemanipulation_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_audithandlemanipulation_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_audithandlemanipulation_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_audithandlemanipulation_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditkernelobject","displayName":"Object Access Audit Kernel Object","description":"This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. Only kernel objects with a matching system access control list (SACL) generate security audit events. Note: The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#objectaccess_auditkernelobject"],"options":[{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditkernelobject_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditkernelobject_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditkernelobject_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditkernelobject_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditotherobjectaccessevents","displayName":"Object Access Audit Other Object Access Events","description":"This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. For scheduler jobs, the following are audited: Job created. Job deleted. Job enabled. Job disabled. Job updated. For COM+ objects, the following are audited: Catalog object added. Catalog object updated. Catalog object deleted.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#objectaccess_auditotherobjectaccessevents"],"options":[{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditotherobjectaccessevents_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditotherobjectaccessevents_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditotherobjectaccessevents_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditotherobjectaccessevents_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditregistry","displayName":"Object Access Audit Registry","description":"This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. Note: You can set a SACL on a registry object using the Permissions dialog box.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#objectaccess_auditregistry"],"options":[{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditregistry_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditregistry_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditregistry_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditregistry_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditremovablestorage","displayName":"Object Access Audit Removable Storage","description":"This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#objectaccess_auditremovablestorage"],"options":[{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditremovablestorage_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditremovablestorage_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditremovablestorage_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditremovablestorage_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditsam","displayName":"Object Access Audit SAM","description":"This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. SAM objects include the following: SAM_ALIAS -- A local group. SAM_GROUP -- A group that is not a local group. SAM_USER – A user account. SAM_DOMAIN – A domain. SAM_SERVER – A computer account. If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. Note: Only the System Access Control List (SACL) for SAM_SERVER can be modified. Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see article 841001 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121698).","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#objectaccess_auditsam"],"options":[{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditsam_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditsam_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditsam_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_objectaccess_auditsam_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_policychange_auditauthenticationpolicychange","displayName":"Audit Authentication Policy Change","description":"This policy setting allows you to audit events generated by changes to the authentication policy such as the following: Creation of forest and domain trusts. Modification of forest and domain trusts. Removal of forest and domain trusts. Changes to Kerberos policy under Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy. Granting of any of the following user rights to a user or group: Access This Computer From the Network. Allow Logon Locally. Allow Logon Through Terminal Services. Logon as a Batch Job. Logon a Service. Namespace collision. For example, when a new trust has the same name as an existing namespace name. If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. Note: The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#policychange_auditauthenticationpolicychange"],"options":[{"id":"device_vendor_msft_policy_config_audit_policychange_auditauthenticationpolicychange_0","displayName":"Off/None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_policychange_auditauthenticationpolicychange_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_policychange_auditauthenticationpolicychange_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_policychange_auditauthenticationpolicychange_3","displayName":"Success+Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_policychange_auditauthorizationpolicychange","displayName":"Audit Authorization Policy Change","description":"This policy setting allows you to audit events generated by changes to the authorization policy such as the following: Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. Changes in the Encrypted File System (EFS) policy. Changes to the Resource attributes of an object. Changes to the Central Access Policy (CAP) applied to an object. If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when the authorization policy changes.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#policychange_auditauthorizationpolicychange"],"options":[{"id":"device_vendor_msft_policy_config_audit_policychange_auditauthorizationpolicychange_0","displayName":"Off/None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_policychange_auditauthorizationpolicychange_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_policychange_auditauthorizationpolicychange_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_policychange_auditauthorizationpolicychange_3","displayName":"Success+Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_policychange_auditfilteringplatformpolicychange","displayName":"Policy Change Audit Filtering Platform Policy Change","description":"This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: IPsec services status. Changes to IPsec policy settings. Changes to Windows Firewall policy settings. Changes to WFP providers and engine. If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#policychange_auditfilteringplatformpolicychange"],"options":[{"id":"device_vendor_msft_policy_config_audit_policychange_auditfilteringplatformpolicychange_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_policychange_auditfilteringplatformpolicychange_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_policychange_auditfilteringplatformpolicychange_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_policychange_auditfilteringplatformpolicychange_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_policychange_auditmpssvcrulelevelpolicychange","displayName":"Policy Change Audit MPSSVC Rule Level Policy Change","description":"This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: Reporting of active policies when Windows Firewall service starts. Changes to Windows Firewall rules. Changes to Windows Firewall exception list. Changes to Windows Firewall settings. Rules ignored or not applied by Windows Firewall Service. Changes to Windows Firewall Group Policy settings. If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#policychange_auditmpssvcrulelevelpolicychange"],"options":[{"id":"device_vendor_msft_policy_config_audit_policychange_auditmpssvcrulelevelpolicychange_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_policychange_auditmpssvcrulelevelpolicychange_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_policychange_auditmpssvcrulelevelpolicychange_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_policychange_auditmpssvcrulelevelpolicychange_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_policychange_auditotherpolicychangeevents","displayName":"Policy Change Audit Other Policy Change Events","description":"This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: Trusted Platform Module (TPM) configuration changes. Kernel-mode cryptographic self tests. Cryptographic provider operations. Cryptographic context operations or modifications. Applied Central Access Policies (CAPs) changes. Boot Configuration Data (BCD) modifications.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#policychange_auditotherpolicychangeevents"],"options":[{"id":"device_vendor_msft_policy_config_audit_policychange_auditotherpolicychangeevents_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_policychange_auditotherpolicychangeevents_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_policychange_auditotherpolicychangeevents_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_policychange_auditotherpolicychangeevents_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_policychange_auditpolicychange","displayName":"Audit Changes to Audit Policy","description":"This policy setting allows you to audit changes in the security audit policy settings such as the following: Settings permissions and audit settings on the Audit Policy object. Changes to the system audit policy. Registration of security event sources. De-registration of security event sources. Changes to the per-user audit settings. Changes to the value of CrashOnAuditFail. Changes to the system access control list on a file system or registry object. Changes to the Special Groups list. Note: System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#policychange_auditpolicychange"],"options":[{"id":"device_vendor_msft_policy_config_audit_policychange_auditpolicychange_0","displayName":"Off/None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_policychange_auditpolicychange_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_policychange_auditpolicychange_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_policychange_auditpolicychange_3","displayName":"Success+Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_privilegeuse_auditnonsensitiveprivilegeuse","displayName":"Privilege Use Audit Non Sensitive Privilege Use","description":"This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). The following privileges are non-sensitive: Access Credential Manager as a trusted caller. Access this computer from the network. Add workstations to domain. Adjust memory quotas for a process. Allow log on locally. Allow log on through Terminal Services. Bypass traverse checking. Change the system time. Create a pagefile. Create global objects. Create permanent shared objects. Create symbolic links. Deny access this computer from the network. Deny log on as a batch job. Deny log on as a service. Deny log on locally. Deny log on through Terminal Services. Force shutdown from a remote system. Increase a process working set. Increase scheduling priority. Lock pages in memory. Log on as a batch job. Log on as a service. Modify an object label. Perform volume maintenance tasks. Profile single process. Profile system performance. Remove computer from docking station. Shut down the system. Synchronize directory service data. If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#privilegeuse_auditnonsensitiveprivilegeuse"],"options":[{"id":"device_vendor_msft_policy_config_audit_privilegeuse_auditnonsensitiveprivilegeuse_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_privilegeuse_auditnonsensitiveprivilegeuse_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_privilegeuse_auditnonsensitiveprivilegeuse_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_privilegeuse_auditnonsensitiveprivilegeuse_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_privilegeuse_auditotherprivilegeuseevents","displayName":"Privilege Use Audit Other Privilege Use Events","description":"Not used.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#privilegeuse_auditotherprivilegeuseevents"],"options":[{"id":"device_vendor_msft_policy_config_audit_privilegeuse_auditotherprivilegeuseevents_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_privilegeuse_auditotherprivilegeuseevents_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_privilegeuse_auditotherprivilegeuseevents_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_privilegeuse_auditotherprivilegeuseevents_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_privilegeuse_auditsensitiveprivilegeuse","displayName":"Privilege Use Audit Sensitive Privilege Use","description":"This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: A privileged service is called. One of the following privileges are called: Act as part of the operating system. Back up files and directories. Create a token object. Debug programs. Enable computer and user accounts to be trusted for delegation. Generate security audits. Impersonate a client after authentication. Load and unload device drivers. Manage auditing and security log. Modify firmware environment values. Replace a process-level token. Restore files and directories. Take ownership of files or other objects. If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#privilegeuse_auditsensitiveprivilegeuse"],"options":[{"id":"device_vendor_msft_policy_config_audit_privilegeuse_auditsensitiveprivilegeuse_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_privilegeuse_auditsensitiveprivilegeuse_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_privilegeuse_auditsensitiveprivilegeuse_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_privilegeuse_auditsensitiveprivilegeuse_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_system_auditipsecdriver","displayName":"System Audit I Psec Driver","description":"This policy setting allows you to audit events generated by the IPsec filter driver such as the following: Startup and shutdown of the IPsec services. Network packets dropped due to integrity check failure. Network packets dropped due to replay check failure. Network packets dropped due to being in plaintext. Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. Inability to process IPsec filters. If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#system_auditipsecdriver"],"options":[{"id":"device_vendor_msft_policy_config_audit_system_auditipsecdriver_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_system_auditipsecdriver_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_system_auditipsecdriver_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_system_auditipsecdriver_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_system_auditothersystemevents","displayName":"System Audit Other System Events","description":"This policy setting allows you to audit any of the following events: Startup and shutdown of the Windows Firewall service and driver. Security policy processing by the Windows Firewall Service. Cryptography key file and migration operations.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#system_auditothersystemevents"],"options":[{"id":"device_vendor_msft_policy_config_audit_system_auditothersystemevents_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_system_auditothersystemevents_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_system_auditothersystemevents_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_system_auditothersystemevents_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_system_auditsecuritystatechange","displayName":"System Audit Security State Change","description":"This policy setting allows you to audit events generated by changes in the security state of the computer such as the following events: Startup and shutdown of the computer. Change of system time. Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#system_auditsecuritystatechange"],"options":[{"id":"device_vendor_msft_policy_config_audit_system_auditsecuritystatechange_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_system_auditsecuritystatechange_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_system_auditsecuritystatechange_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_system_auditsecuritystatechange_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_system_auditsecuritysystemextension","displayName":"Audit Security System Extension","description":"This policy setting allows you to audit events related to security system extensions or services such as the following: A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#system_auditsecuritysystemextension"],"options":[{"id":"device_vendor_msft_policy_config_audit_system_auditsecuritysystemextension_0","displayName":"Off/None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_system_auditsecuritysystemextension_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_system_auditsecuritysystemextension_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_system_auditsecuritysystemextension_3","displayName":"Success+Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_audit_system_auditsystemintegrity","displayName":"System Audit System Integrity","description":"This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: Events that could not be written to the event log because of a problem with the auditing system. A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. The detection of a Remote Procedure Call (RPC) that compromises system integrity. The detection of a hash value of an executable file that is not valid as determined by Code Integrity. Cryptographic operations that compromise system integrity.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Audit#system_auditsystemintegrity"],"options":[{"id":"device_vendor_msft_policy_config_audit_system_auditsystemintegrity_0","displayName":"Off/ None","description":"Off/None","helpText":null},{"id":"device_vendor_msft_policy_config_audit_system_auditsystemintegrity_1","displayName":"Success","description":"Success","helpText":null},{"id":"device_vendor_msft_policy_config_audit_system_auditsystemintegrity_2","displayName":"Failure","description":"Failure","helpText":null},{"id":"device_vendor_msft_policy_config_audit_system_auditsystemintegrity_3","displayName":"Success+ Failure","description":"Success+Failure","helpText":null}]},{"id":"device_vendor_msft_policy_config_authentication_allowaadpasswordreset","displayName":"Allow Aad Password Reset","description":"Specifies whether password reset is enabled for AAD accounts.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Authentication#allowaadpasswordreset"],"options":[{"id":"device_vendor_msft_policy_config_authentication_allowaadpasswordreset_0","displayName":"Block","description":"Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_authentication_allowaadpasswordreset_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_authentication_allowfastreconnect","displayName":"Allow Fast Reconnect","description":"Allows EAP Fast Reconnect from being attempted for EAP Method TLS. Most restricted value is 0.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Authentication#allowfastreconnect"],"options":[{"id":"device_vendor_msft_policy_config_authentication_allowfastreconnect_0","displayName":"Block","description":"Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_authentication_allowfastreconnect_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_authentication_allowsecondaryauthenticationdevice","displayName":"Allow Secondary Authentication Device","description":"Allows secondary authentication devices to work with Windows. The default for this policy must be on for consumer devices (defined as local or Microsoft account connected device) and off for enterprise devices (such as cloud domain-joined, cloud domain-joined in an on-premises only environment, cloud domain-joined in a hybrid environment, and BYOD). In the next major release of Windows 10, the default for this policy for consumer devices will be changed to off. This will only affect users that have not already set up a secondary authentication device.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Authentication#allowsecondaryauthenticationdevice"],"options":[{"id":"device_vendor_msft_policy_config_authentication_allowsecondaryauthenticationdevice_0","displayName":"Block","description":"Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_authentication_allowsecondaryauthenticationdevice_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_authentication_configurewebcamaccessdomainnames","displayName":"Configure Webcam Access Domain Names","description":"Specifies a list of domains that are allowed to access the webcam in Web Sign-in based authentication scenarios.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Authentication#configurewebcamaccessdomainnames"],"options":null},{"id":"device_vendor_msft_policy_config_authentication_configurewebsigninallowedurls","displayName":"Configure Web Sign In Allowed Urls","description":"Specifies a list of URLs that are navigable in Web Sign-in based authentication scenarios.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Authentication#configurewebsigninallowedurls"],"options":null},{"id":"device_vendor_msft_policy_config_authentication_enablefastfirstsignin","displayName":"Enable Fast First Sign In","description":"Specifies whether new non-admin AAD accounts should auto-connect to pre-created candidate local accounts","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Authentication#enablefastfirstsignin"],"options":[{"id":"device_vendor_msft_policy_config_authentication_enablefastfirstsignin_0","displayName":"The feature defaults to the existing SKU and device capabilities.","description":"The feature defaults to the existing SKU and device capabilities.","helpText":null},{"id":"device_vendor_msft_policy_config_authentication_enablefastfirstsignin_1","displayName":"Enabled. Auto-connect new non-admin Azure AD accounts to pre-configured candidate local accounts","description":"Enabled. Auto-connect new non-admin Azure AD accounts to pre-configured candidate local accounts","helpText":null},{"id":"device_vendor_msft_policy_config_authentication_enablefastfirstsignin_2","displayName":"Disabled. Do not auto-connect new non-admin Azure AD accounts to pre-configured local accounts","description":"Disabled. Do not auto-connect new non-admin Azure AD accounts to pre-configured local accounts","helpText":null}]},{"id":"device_vendor_msft_policy_config_authentication_enablepasswordlessexperience","displayName":"Enable Passwordless Experience","description":"Specifies whether connected users on AADJ devices receive a Passwordless experience on Windows\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Authentication#enablepasswordlessexperience"],"options":[{"id":"device_vendor_msft_policy_config_authentication_enablepasswordlessexperience_0","displayName":"The feature defaults to the existing edition and device capabilities.","description":"The feature defaults to the existing edition and device capabilities.","helpText":null},{"id":"device_vendor_msft_policy_config_authentication_enablepasswordlessexperience_1","displayName":"Enabled. The Passwordless experience will be enabled on Windows","description":"Enabled. The Passwordless experience will be enabled on Windows","helpText":null},{"id":"device_vendor_msft_policy_config_authentication_enablepasswordlessexperience_2","displayName":"Disabled. The Passwordless experience will not be enabled on Windows","description":"Disabled. The Passwordless experience will not be enabled on Windows","helpText":null}]},{"id":"device_vendor_msft_policy_config_authentication_enablewebsignin","displayName":"Enable Web Sign In","description":"Specifies whether web-based sign-in is allowed for signing in to Windows","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Authentication#enablewebsignin"],"options":[{"id":"device_vendor_msft_policy_config_authentication_enablewebsignin_0","displayName":"The feature defaults to the existing SKU and device capabilities.","description":"The feature defaults to the existing SKU and device capabilities.","helpText":null},{"id":"device_vendor_msft_policy_config_authentication_enablewebsignin_1","displayName":"Enabled. Web Sign-in will be enabled for signing in to Windows","description":"Enabled. Web Sign-in will be enabled for signing in to Windows","helpText":null},{"id":"device_vendor_msft_policy_config_authentication_enablewebsignin_2","displayName":"Disabled. Web Sign-in will not be enabled for signing in to Windows","description":"Disabled. Web Sign-in will not be enabled for signing in to Windows","helpText":null}]},{"id":"device_vendor_msft_policy_config_authentication_preferredaadtenantdomainname","displayName":"Preferred Aad Tenant Domain Name","description":"Specifies the preferred domain among available domains in the AAD tenant.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Authentication#preferredaadtenantdomainname"],"options":null},{"id":"device_vendor_msft_policy_config_autoplay_disallowautoplayfornonvolumedevices","displayName":"Disallow Autoplay for non-volume devices","description":"This policy setting disallows AutoPlay for MTP devices like cameras or phones.\r\n\r\n If you enable this policy setting, AutoPlay is not allowed for MTP devices like cameras or phones.\r\n\r\n If you disable or do not configure this policy setting, AutoPlay is enabled for non-volume devices.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-autoplay#autoplay-disallowautoplayfornonvolumedevices"],"options":[{"id":"device_vendor_msft_policy_config_autoplay_disallowautoplayfornonvolumedevices_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_autoplay_disallowautoplayfornonvolumedevices_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_autoplay_setdefaultautorunbehavior","displayName":"Set the default behavior for AutoRun","description":"This policy setting sets the default behavior for Autorun commands.\r\n\r\n Autorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines.\r\n\r\n Prior to Windows Vista, when media containing an autorun command is inserted, the system will automatically execute the program without user intervention.\r\n\r\n This creates a major security concern as code may be executed without user's knowledge. The default behavior starting with Windows Vista is to prompt the user whether autorun command is to be run. The autorun command is represented as a handler in the Autoplay dialog.\r\n\r\n If you enable this policy setting, an Administrator can change the default Windows Vista or later behavior for autorun to:\r\n\r\n a) Completely disable autorun commands, or\r\n b) Revert back to pre-Windows Vista behavior of automatically executing the autorun command.\r\n\r\n If you disable or not configure this policy setting, Windows Vista or later will prompt the user whether autorun command is to be run.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-autoplay#autoplay-setdefaultautorunbehavior"],"options":[{"id":"device_vendor_msft_policy_config_autoplay_setdefaultautorunbehavior_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_autoplay_setdefaultautorunbehavior_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_autoplay_setdefaultautorunbehavior_noautorun_dropdown","displayName":"Default AutoRun Behavior","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_autoplay_setdefaultautorunbehavior_noautorun_dropdown_1","displayName":"Do not execute any autorun commands","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_autoplay_setdefaultautorunbehavior_noautorun_dropdown_2","displayName":"Automatically execute autorun commands","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_autoplay_turnoffautoplay","displayName":"Turn off Autoplay","description":"This policy setting allows you to turn off the Autoplay feature.\r\n\r\n Autoplay begins reading from a drive as soon as you insert media in the drive. As a result, the setup file of programs and the music on audio media start immediately.\r\n\r\n Prior to Windows XP SP2, Autoplay is disabled by default on removable drives, such as the floppy disk drive (but not the CD-ROM drive), and on network drives.\r\n\r\n Starting with Windows XP SP2, Autoplay is enabled for removable drives as well, including Zip drives and some USB mass storage devices.\r\n\r\n If you enable this policy setting, Autoplay is disabled on CD-ROM and removable media drives, or disabled on all drives.\r\n\r\n This policy setting disables Autoplay on additional types of drives. You cannot use this setting to enable Autoplay on drives on which it is disabled by default.\r\n\r\n If you disable or do not configure this policy setting, AutoPlay is enabled.\r\n\r\n Note: This policy setting appears in both the Computer Configuration and User Configuration folders. If the policy settings conflict, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-autoplay#autoplay-turnoffautoplay"],"options":[{"id":"device_vendor_msft_policy_config_autoplay_turnoffautoplay_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_autoplay_turnoffautoplay_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_autoplay_turnoffautoplay_autorun_box","displayName":"Turn off Autoplay on:","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_autoplay_turnoffautoplay_autorun_box_181","displayName":"CD-ROM and removable media drives","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_autoplay_turnoffautoplay_autorun_box_255","displayName":"All drives","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_bits_bandwidththrottlingendtime","displayName":"Bandwidth Throttling End Time","description":"This policy specifies the bandwidth throttling end time that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting does not affect foreground transfers. This policy is based on the 24-hour clock. Value type is integer. Default value is 17 (5 PM). Supported value range: 0 - 23You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A. M. to 5:00 P. M. , and use all available unused bandwidth the rest of the day's hours. Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrottlingEndTime, BandwidthThrottlingTransferRate), BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the Limit the maximum network bandwidth used for Peercaching policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs).","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-BITS#bandwidththrottlingendtime"],"options":null},{"id":"device_vendor_msft_policy_config_bits_bandwidththrottlingstarttime","displayName":"Bandwidth Throttling Start Time","description":"This policy specifies the bandwidth throttling start time that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting does not affect foreground transfers. This policy is based on the 24-hour clock. Value type is integer. Default value is 8 (8 am). Supported value range: 0 - 23You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A. M. to 5:00 P. M. , and use all available unused bandwidth the rest of the day's hours. Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrottlingEndTime, BandwidthThrottlingTransferRate), BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the Limit the maximum network bandwidth used for Peercaching policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs).","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-BITS#bandwidththrottlingstarttime"],"options":null},{"id":"device_vendor_msft_policy_config_bits_bandwidththrottlingtransferrate","displayName":"Bandwidth Throttling Transfer Rate","description":"This policy specifies the bandwidth throttling transfer rate in kilobits per second (Kbps) that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting does not affect foreground transfers. Value type is integer. Default value is 1000. Supported value range: 0 - 4294967200. You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A. M. to 5:00 P. M. , and use all available unused bandwidth the rest of the day's hours. Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrottlingEndTime, BandwidthThrottlingTransferRate), BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the Limit the maximum network bandwidth used for Peercaching policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs).","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-BITS#bandwidththrottlingtransferrate"],"options":null},{"id":"device_vendor_msft_policy_config_bits_costednetworkbehaviorbackgroundpriority","displayName":"Costed Network Behavior Background Priority","description":"This policy setting defines the default behavior that the Background Intelligent Transfer Service (BITS) uses for background transfers when the system is connected to a costed network (3G, etc. ). Download behavior policies further limit the network usage of background transfers. If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting does not override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority. For example, you can specify that background jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are:1 - Always transfer2 - Transfer unless roaming3 - Transfer unless surcharge applies (when not roaming or overcap)4 - Transfer unless nearing limit (when not roaming or nearing cap)5 - Transfer only if unconstrained","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-BITS#costednetworkbehaviorbackgroundpriority"],"options":[{"id":"device_vendor_msft_policy_config_bits_costednetworkbehaviorbackgroundpriority_1","displayName":"Always transfer","description":"Always transfer","helpText":null},{"id":"device_vendor_msft_policy_config_bits_costednetworkbehaviorbackgroundpriority_2","displayName":"Transfer unless roaming","description":"Transfer unless roaming","helpText":null},{"id":"device_vendor_msft_policy_config_bits_costednetworkbehaviorbackgroundpriority_3","displayName":"Transfer unless surcharge applies (when not roaming or over cap)","description":"Transfer unless surcharge applies (when not roaming or over cap)","helpText":null},{"id":"device_vendor_msft_policy_config_bits_costednetworkbehaviorbackgroundpriority_4","displayName":"Transfer unless nearing limit (when not roaming or nearing cap)","description":"Transfer unless nearing limit (when not roaming or nearing cap)","helpText":null},{"id":"device_vendor_msft_policy_config_bits_costednetworkbehaviorbackgroundpriority_5","displayName":"Transfer only if unconstrained","description":"Transfer only if unconstrained","helpText":null}]},{"id":"device_vendor_msft_policy_config_bits_costednetworkbehaviorforegroundpriority","displayName":"Costed Network Behavior Foreground Priority","description":"This policy setting defines the default behavior that the foreground Intelligent Transfer Service (BITS) uses for foreground transfers when the system is connected to a costed network (3G, etc. ). Download behavior policies further limit the network usage of foreground transfers. If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting does not override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority. For example, you can specify that foreground jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are:1 - Always transfer2 - Transfer unless roaming3 - Transfer unless surcharge applies (when not roaming or overcap)4 - Transfer unless nearing limit (when not roaming or nearing cap)5 - Transfer only if unconstrained","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-BITS#costednetworkbehaviorforegroundpriority"],"options":[{"id":"device_vendor_msft_policy_config_bits_costednetworkbehaviorforegroundpriority_1","displayName":"Always transfer","description":"Always transfer","helpText":null},{"id":"device_vendor_msft_policy_config_bits_costednetworkbehaviorforegroundpriority_2","displayName":"Transfer unless roaming","description":"Transfer unless roaming","helpText":null},{"id":"device_vendor_msft_policy_config_bits_costednetworkbehaviorforegroundpriority_3","displayName":"Transfer unless surcharge applies (when not roaming or over cap)","description":"Transfer unless surcharge applies (when not roaming or over cap)","helpText":null},{"id":"device_vendor_msft_policy_config_bits_costednetworkbehaviorforegroundpriority_4","displayName":"Transfer unless nearing limit (when not roaming or nearing cap)","description":"Transfer unless nearing limit (when not roaming or nearing cap)","helpText":null},{"id":"device_vendor_msft_policy_config_bits_costednetworkbehaviorforegroundpriority_5","displayName":"Transfer only if unconstrained","description":"Transfer only if unconstrained","helpText":null}]},{"id":"device_vendor_msft_policy_config_bits_jobinactivitytimeout","displayName":"Job Inactivity Timeout","description":"This policy setting specifies the number of days a pending BITS job can remain inactive before the job is considered abandoned. By default BITS will wait 90 days before considering an inactive job abandoned. After a job is determined to be abandoned, the job is deleted from BITS and any downloaded files for the job are deleted from the disk. NoteAny property changes to the job or any successful download action will reset this timeout. Value type is integer. Default is 90 days. Supported values range: 0 - 999Consider increasing the timeout value if computers tend to stay offline for a long period of time and still have pending jobs. Consider decreasing this value if you are concerned about orphaned jobs occupying disk space. If you disable or do not configure this policy setting, the default value of 90 (days) will be used for the inactive job timeout.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-BITS#jobinactivitytimeout"],"options":null},{"id":"device_vendor_msft_policy_config_bluetooth_allowadvertising","displayName":"Allow Advertising","description":"Specifies whether the device can send out Bluetooth advertisements. If this is not set or it is deleted, the default value of 1 (Allow) is used. Most restricted value is 0.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Bluetooth#allowadvertising"],"options":[{"id":"device_vendor_msft_policy_config_bluetooth_allowadvertising_0","displayName":"Block","description":"Not allowed. When set to 0, the device will not send out advertisements. To verify, use any Bluetooth LE app and enable it to do advertising. Then, verify that the advertisement is not received by the peripheral.","helpText":null},{"id":"device_vendor_msft_policy_config_bluetooth_allowadvertising_1","displayName":"Allow","description":"Allowed. When set to 1, the device will send out advertisements. To verify, use any Bluetooth LE app and enable it to do advertising. Then, verify that the advertisement is received by the peripheral.","helpText":null}]},{"id":"device_vendor_msft_policy_config_bluetooth_allowdiscoverablemode","displayName":"Allow Discoverable Mode","description":"Specifies whether other Bluetooth-enabled devices can discover the device. If this is not set or it is deleted, the default value of 1 (Allow) is used. Most restricted value is 0.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Bluetooth#allowdiscoverablemode"],"options":[{"id":"device_vendor_msft_policy_config_bluetooth_allowdiscoverablemode_0","displayName":"Block","description":"Not allowed. When set to 0, other devices will not be able to detect the device. To verify, open the Bluetooth control panel on the device. Then, go to another Bluetooth-enabled device, open the Bluetooth control panel, and verify that you cannot see the name of the device.","helpText":null},{"id":"device_vendor_msft_policy_config_bluetooth_allowdiscoverablemode_1","displayName":"Allow","description":"Allowed. When set to 1, other devices will be able to detect the device. To verify, open the Bluetooth control panel on the device. Then, go to another Bluetooth-enabled device, open the Bluetooth control panel and verify that you can discover it.","helpText":null}]},{"id":"device_vendor_msft_policy_config_bluetooth_allowprepairing","displayName":"Allow Prepairing","description":"Specifies whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Bluetooth#allowprepairing"],"options":[{"id":"device_vendor_msft_policy_config_bluetooth_allowprepairing_0","displayName":"Block","description":"Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_bluetooth_allowprepairing_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_bluetooth_allowpromptedproximalconnections","displayName":"Allow Prompted Proximal Connections","description":"This policy allows the IT admin to block users on these managed devices from using Swift Pair and other proximity based scenarios.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Bluetooth#allowpromptedproximalconnections"],"options":[{"id":"device_vendor_msft_policy_config_bluetooth_allowpromptedproximalconnections_0","displayName":"Block","description":"Disallow. Block users on these managed devices from using Swift Pair and other proximity based scenarios","helpText":null},{"id":"device_vendor_msft_policy_config_bluetooth_allowpromptedproximalconnections_1","displayName":"Allow","description":"Allow. Allow users on these managed devices to use Swift Pair and other proximity based scenarios","helpText":null}]},{"id":"device_vendor_msft_policy_config_bluetooth_localdevicename","displayName":"Local Device Name","description":"Sets the local Bluetooth device name. If this is set, the value that it is set to will be used as the Bluetooth device name. To verify the policy is set, open the Bluetooth control panel on the device. Then, go to another Bluetooth-enabled device, open the Bluetooth control panel, and verify that the value that was specified. If this policy is not set or it is deleted, the default local radio name is used.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Bluetooth#localdevicename"],"options":null},{"id":"device_vendor_msft_policy_config_bluetooth_servicesallowedlist","displayName":"Services Allowed List","description":"Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7CAA-436C-8BF0-78CD0FFBD4AF}. The default value is an empty string. For more information, see ServicesAllowedList usage guide","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Bluetooth#servicesallowedlist"],"options":null},{"id":"device_vendor_msft_policy_config_bluetooth_setminimumencryptionkeysize","displayName":"Set Minimum Encryption Key Size","description":"There are multiple levels of encryption strength when pairing Bluetooth devices. This policy helps prevent weaker devices cryptographically being used in high security environments.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Bluetooth#setminimumencryptionkeysize"],"options":null},{"id":"device_vendor_msft_policy_config_browser_allowaddressbardropdown","displayName":"Allow Address Bar Dropdown","description":"This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowaddressbardropdown"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowaddressbardropdown_0","displayName":"Block","description":"Prevented/not allowed. Hide the Address bar drop-down functionality and disable the Show search and site suggestions as I type toggle in Settings.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowaddressbardropdown_1","displayName":"Allow","description":"Allowed. Show the Address bar drop-down list and make it available.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowautofill","displayName":"Allow Autofill","description":"This setting lets you decide whether employees can use Autofill to automatically fill in form fields while using Microsoft Edge.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowautofill"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowautofill_0","displayName":"Block","description":"Prevented/Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowautofill_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowconfigurationupdateforbookslibrary","displayName":"Allow Configuration Update For Books Library","description":"This policy setting lets you decide whether Microsoft Edge can automatically update the configuration data for the Books Library.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowconfigurationupdateforbookslibrary"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowconfigurationupdateforbookslibrary_0","displayName":"Block","description":"Prevented/Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowconfigurationupdateforbookslibrary_1","displayName":"Allow","description":"Allowed. Microsoft Edge updates the configuration data for the Books Library automatically.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowcookies","displayName":"Allow Cookies","description":"This setting lets you configure how your company deals with cookies.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowcookies"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowcookies_0","displayName":"Block all cookies from all sites","description":"Block all cookies from all sites","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowcookies_1","displayName":"Block only cookies from third party websites","description":"Block only cookies from third party websites","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowcookies_2","displayName":"Allow all cookies from all sites","description":"Allow all cookies from all sites","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowdevelopertools","displayName":"Allow Developer Tools","description":"This setting lets you decide whether employees can use F12 Developer Tools on Microsoft Edge.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowdevelopertools"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowdevelopertools_0","displayName":"Block","description":"Prevented/Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowdevelopertools_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowdonottrack","displayName":"Allow Do Not Track","description":"This setting lets you decide whether employees can send Do Not Track headers to websites that request tracking info.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowdonottrack"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowdonottrack_0","displayName":"Block","description":"Never send tracking information.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowdonottrack_1","displayName":"Allow","description":"Send tracking information.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowextensions","displayName":"Allow Extensions","description":"This setting lets you decide whether employees can load extensions in Microsoft Edge.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowextensions"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowextensions_0","displayName":"Block","description":"Prevented/Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowextensions_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowflash","displayName":"Allow Flash","description":"This setting lets you decide whether employees can run Adobe Flash in Microsoft Edge.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowflash"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowflash_0","displayName":"Block","description":"Prevented/Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowflash_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowflashclicktorun","displayName":"Allow Flash Click To Run","description":"Configure the Adobe Flash Click-to-Run setting.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowflashclicktorun"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowflashclicktorun_0","displayName":"Block","description":"Load and run Adobe Flash content automatically.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowflashclicktorun_1","displayName":"Allow","description":"Does not load or run Adobe Flash content automatically. Requires action from the user.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowfullscreenmode","displayName":"Allow Full Screen Mode","description":"With this policy, you can specify whether to allow full-screen mode, which shows only the web content and hides the Microsoft Edge UI. If enabled or not configured, full-screen mode is available for use in Microsoft Edge. Your users and extensions must have the proper permissions. If disabled, full-screen mode is unavailable for use in Microsoft Edge.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowfullscreenmode"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowfullscreenmode_0","displayName":"Block","description":"Prevented/Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowfullscreenmode_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowinprivate","displayName":"Allow InPrivate","description":"This setting lets you decide whether employees can browse using InPrivate website browsing.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowinprivate"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowinprivate_0","displayName":"Block","description":"Prevented/Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowinprivate_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowmicrosoftcompatibilitylist","displayName":"Allow Microsoft Compatibility List","description":"This policy setting lets you decide whether the Microsoft Compatibility List is enabled or disabled in Microsoft Edge. This feature uses a Microsoft-provided list to ensure that any sites with known compatibility issues are displayed correctly when a user navigates to them. By default, the Microsoft Compatibility List is enabled and can be viewed by navigating to about:compat. If you enable or don’t configure this setting, Microsoft Edge will periodically download the latest version of the list from Microsoft and will apply the configurations specified there during browser navigation. If a user visits a site on the Microsoft Compatibility List, he or she will be prompted to open the site in Internet Explorer 11. Once in Internet Explorer, the site will automatically be rendered as if the user is viewing it in the previous version of Internet Explorer it requires to display correctly. If you disable this setting, the Microsoft Compatibility List will not be used during browser navigation.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowmicrosoftcompatibilitylist"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowmicrosoftcompatibilitylist_0","displayName":"Block","description":"Prevented/Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowmicrosoftcompatibilitylist_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowpasswordmanager","displayName":"Allow Password Manager","description":"This setting lets you decide whether employees can save their passwords locally, using Password Manager.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowpasswordmanager"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowpasswordmanager_0","displayName":"Block","description":"Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowpasswordmanager_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowpopups","displayName":"Allow Popups","description":"This setting lets you decide whether to turn on Pop-up Blocker and whether to allow pop-ups to appear in secondary windows.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowpopups"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowpopups_0","displayName":"Block","description":"Turn off Pop-up Blocker letting pop-up windows open.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowpopups_1","displayName":"Allow","description":"Turn on Pop-up Blocker stopping pop-up windows from opening.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowprelaunch","displayName":"Allow Prelaunch","description":"Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowprelaunch"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowprelaunch_0","displayName":"Block","description":"Prevented/Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowprelaunch_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowprinting","displayName":"Allow Printing","description":"With this policy, you can restrict whether printing web content in Microsoft Edge is allowed. If enabled, printing is allowed. If disabled, printing is not allowed.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowprinting"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowprinting_0","displayName":"Block","description":"Prevented/Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowprinting_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowsavinghistory","displayName":"Allow Saving History","description":"Microsoft Edge saves your user's browsing history, which is made up of info about the websites they visit, on their devices. If enabled or not configured, the browsing history is saved and visible in the History pane. If disabled, the browsing history stops saving and is not visible in the History pane. If browsing history exists before this policy was disabled, the previous browsing history remains visible in the History pane. This policy, when disabled, does not stop roaming of existing history or history coming from other roamed devices.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowsavinghistory"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowsavinghistory_0","displayName":"Block","description":"Prevented/Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowsavinghistory_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowsearchenginecustomization","displayName":"Allow Search Engine Customization","description":"Allow search engine customization for MDM enrolled devices. Users can change their default search engine. If this setting is turned on or not configured, users can add new search engines and change the default used in the address bar from within Microsoft Edge Settings. If this setting is disabled, users will be unable to add search engines or change the default used in the address bar. This policy will only apply on domain joined machines or when the device is MDM enrolled. For more information, see Microsoft browser extension policy (aka.ms/browserpolicy).","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowsearchenginecustomization"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowsearchenginecustomization_0","displayName":"Block","description":"Prevented/Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowsearchenginecustomization_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowsearchsuggestionsinaddressbar","displayName":"Allow Search Suggestionsin Address Bar","description":"This setting lets you decide whether search suggestions should appear in the Address bar of Microsoft Edge.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowsearchsuggestionsinaddressbar"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowsearchsuggestionsinaddressbar_0","displayName":"Block","description":"Prevented/Not allowed. Hide the search suggestions.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowsearchsuggestionsinaddressbar_1","displayName":"Allow","description":"Allowed. Show the search suggestions.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowsideloadingofextensions","displayName":"Allow Sideloading Of Extensions","description":"This setting lets you decide whether employees can sideload extensions in Microsoft Edge.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowsideloadingofextensions"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowsideloadingofextensions_0","displayName":"Block","description":"Prevented/Not allowed. Disabling does not prevent sideloading of extensions using Add-AppxPackage via Powershell. To prevent this, set the ApplicationManagement/AllowDeveloperUnlock policy to 1 (enabled).","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowsideloadingofextensions_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowsmartscreen","displayName":"Allow Smart Screen","description":"This setting lets you decide whether to turn on Windows Defender SmartScreen.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowsmartscreen"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowsmartscreen_0","displayName":"Block","description":"Turned off. Do not protect users from potential threats and prevent users from turning it on.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowsmartscreen_1","displayName":"Allow","description":"Turned on. Protect users from potential threats and prevent users from turning it off.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowtabpreloading","displayName":"Allow Tab Preloading","description":"Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowtabpreloading"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowtabpreloading_0","displayName":"Block","description":"Prevented/Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowtabpreloading_1","displayName":"Allow","description":"Allowed. Preload Start and New tab pages.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_allowwebcontentonnewtabpage","displayName":"Allow Web Content On New Tab Page","description":"This policy setting lets you configure what appears when Microsoft Edge opens a new tab. By default, Microsoft Edge opens the New Tab page. If you enable this setting, Microsoft Edge opens a new tab with the New Tab page. If you disable this setting, Microsoft Edge opens a new tab with a blank page. If you use this setting, employees can't change it. If you don't configure this setting, employees can choose how new tabs appears.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#allowwebcontentonnewtabpage"],"options":[{"id":"device_vendor_msft_policy_config_browser_allowwebcontentonnewtabpage_0","displayName":"Block","description":"Load a blank page instead of the default New tab page and prevent users from changing it.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_allowwebcontentonnewtabpage_1","displayName":"Allow","description":"Load the default New tab page.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_alwaysenablebookslibrary","displayName":"Always Enable Books Library","description":"Specifies whether the Books Library in Microsoft Edge will always be visible regardless of the country or region setting for the device.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#alwaysenablebookslibrary"],"options":[{"id":"device_vendor_msft_policy_config_browser_alwaysenablebookslibrary_0","displayName":"Disabled","description":"Show the Books Library only in countries or regions where supported.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_alwaysenablebookslibrary_1","displayName":"Enabled","description":"Show the Books Library, regardless of the device's country or region.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_clearbrowsingdataonexit","displayName":"Clear Browsing Data On Exit","description":"Specifies whether to always clear browsing history on exiting Microsoft Edge.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#clearbrowsingdataonexit"],"options":[{"id":"device_vendor_msft_policy_config_browser_clearbrowsingdataonexit_0","displayName":"Disabled","description":"Prevented/not allowed. Users can configure the 'Clear browsing data' option in Settings.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_clearbrowsingdataonexit_1","displayName":"Enabled","description":"Allowed. Clear the browsing data upon exit automatically.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_configureadditionalsearchengines","displayName":"Configure Additional Search Engines","description":"Allows you to add up to 5 additional search engines for MDM-enrolled devices. If this setting is turned on, you can add up to 5 additional search engines for your employee. For each additional search engine you wish to add, you must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. This policy does not affect the default search engine. Employees will not be able to remove these search engines, but they can set any one of these as the default. If this setting is not configured, the search engines are the ones specified in the App settings. If this setting is disabled, the search engines you had added will be deleted from your employee's machine. Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#configureadditionalsearchengines"],"options":null},{"id":"device_vendor_msft_policy_config_browser_configurefavoritesbar","displayName":"Configure Favorites Bar","description":"The favorites bar shows your user's links to sites they have added to it. With this policy, you can specify whether to set the favorites bar to always be visible or hidden on any page. If enabled, favorites bar is always visible on any page, and the favorites bar toggle in Settings sets to On, but disabled preventing your users from making changes. An error message also shows at the top of the Settings pane indicating that your organization manages some settings. The show bar/hide bar option is hidden from the context menu. If disabled, the favorites bar is hidden, and the favorites bar toggle resets to Off, but disabled preventing your users from making changes. An error message also shows at the top of the Settings pane indicating that your organization manages some settings. If not configured, the favorites bar is hidden but is visible on the Start and New Tab pages, and the favorites bar toggle in Settings sets to Off but is enabled allowing the user to make changes.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#configurefavoritesbar"],"options":[{"id":"device_vendor_msft_policy_config_browser_configurefavoritesbar_0","displayName":"Disabled","description":"Hide the favorites bar on all pages. Also, the favorites bar toggle, in Settings, is set to Off and disabled preventing users from making changes. Microsoft Edge also hides the “show bar/hide bar” option in the context menu.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_configurefavoritesbar_1","displayName":"Enabled","description":"Show the favorites bar on all pages. Also, the favorites bar toggle, in Settings, is set to On and disabled preventing users from making changes. Microsoft Edge also hides the “show bar/hide bar” option in the context menu.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_configurehomebutton","displayName":"Configure Home Button","description":"The Home button loads either the default Start page, the New tab page, or a URL defined in the Set Home Button URL policy. By default, this policy is disabled or not configured and clicking the home button loads the default Start page. When enabled, the home button is locked down preventing your users from making changes in Microsoft Edge's UI settings. To let your users change the Microsoft Edge UI settings, enable the Unlock Home Button policy. If Enabled AND: - Show home button & set to Start page is selected, clicking the home button loads the Start page. - Show home button & set to New tab page is selected, clicking the home button loads a New tab page. - Show home button & set a specific page is selected, clicking the home button loads the URL specified in the Set Home Button URL policy. - Hide home button is selected, the home button is hidden in Microsoft Edge. Default setting: Disabled or not configured Related policies: - Set Home Button URL - Unlock Home Button","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#configurehomebutton"],"options":[{"id":"device_vendor_msft_policy_config_browser_configurehomebutton_0","displayName":"Show home button and load the Start page","description":"Show home button and load the Start page","helpText":null},{"id":"device_vendor_msft_policy_config_browser_configurehomebutton_1","displayName":"Show home button and load the New tab page","description":"Show home button and load the New tab page","helpText":null},{"id":"device_vendor_msft_policy_config_browser_configurehomebutton_2","displayName":"Show home button and load the custom URL defined in the Set Home Button URL policy","description":"Show home button and load the custom URL defined in the Set Home Button URL policy","helpText":null},{"id":"device_vendor_msft_policy_config_browser_configurehomebutton_3","displayName":"Hide home button","description":"Hide home button","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_configurekioskmode","displayName":"Configure Kiosk Mode","description":"Configure how Microsoft Edge behaves when it’s running in kiosk mode with assigned access, either as a single app or as one of multiple apps running on the kiosk device. You can control whether Microsoft Edge runs InPrivate full screen, InPrivate multi-tab with limited functionality, or normal Microsoft Edge. You need to configure Microsoft Edge in assigned access for this policy to take effect; otherwise, these settings are ignored. To learn more about assigned access and kiosk configuration, see “Configure kiosk and shared devices running Windows desktop editions” (https://aka.ms/E489vw). If enabled and set to 0 (Default or not configured): - If it’s a single app, it runs InPrivate full screen for digital signage or interactive displays. - If it’s one of many apps, Microsoft Edge runs as normal. If enabled and set to 1: - If it’s a single app, it runs a limited multi-tab version of InPrivate and is the only app available for public browsing. Users can’t minimize, close, or open windows or customize Microsoft Edge, but can clear browsing data and downloads and restart by clicking “End session.” You can configure Microsoft Edge to restart after a period of inactivity by using the “Configure kiosk reset after idle timeout” policy. - If it’s one of many apps, it runs in a limited multi-tab version of InPrivate for public browsing with other apps. Users can minimize, close, and open multiple InPrivate windows, but they can’t customize Microsoft Edge.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#configurekioskmode"],"options":[{"id":"device_vendor_msft_policy_config_browser_configurekioskmode_1","displayName":"Enable","description":"Enable","helpText":null},{"id":"device_vendor_msft_policy_config_browser_configurekioskmode_0","displayName":"Disable","description":"Disable","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_configurekioskresetafteridletimeout","displayName":"Configure Kiosk Reset After Idle Timeout","description":"You can configure Microsoft Edge to reset to the configured start experience after a specified amount of idle time. The reset timer begins after the last user interaction. Resetting to the configured start experience deletes the current user’s browsing data. If enabled, you can set the idle time in minutes (0-1440). You must set the Configure kiosk mode policy to 1 and configure Microsoft Edge in assigned access as a single app for this policy to work. Once the idle time meets the time specified, a confirmation message prompts the user to continue, and if no user action, Microsoft Edge resets after 30 seconds. If you set this policy to 0, Microsoft Edge does not use an idle timer. If disabled or not configured, the default value is 5 minutes. If you do not configure Microsoft Edge in assigned access, then this policy does not take effect.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#configurekioskresetafteridletimeout"],"options":null},{"id":"device_vendor_msft_policy_config_browser_configureopenmicrosoftedgewith","displayName":"Configure Open Microsoft Edge With","description":"You can configure Microsoft Edge to lock down the Start page, preventing users from changing or customizing it. If enabled, you can choose one of the following options: - Start page: the Start page loads ignoring the Configure Start Pages policy. - New tab page: the New tab page loads ignoring the Configure Start Pages policy. - Previous pages: all tabs the user had open when Microsoft Edge last closed loads ignoring the Configure Start Pages policy. - A specific page or pages: the URL(s) specified with Configure Start Pages policy load(s). If selected, you must specify at least one URL in Configure Start Pages; otherwise, this policy is ignored. When enabled, and you want to make changes, you must first set the Disable Lockdown of Start Pages to not configured, make the changes to the Configure Open Edge With policy, and then enable the Disable Lockdown of Start Pages policy. If disabled or not configured, and you enable the Disable Lockdown of Start Pages policy, your users can change or customize the Start page. Default setting: A specific page or pages (default) Related policies: -Disable Lockdown of Start Pages -Configure Start Pages","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#configureopenmicrosoftedgewith"],"options":[{"id":"device_vendor_msft_policy_config_browser_configureopenmicrosoftedgewith_0","displayName":"Load the Start page","description":"Load the Start page","helpText":null},{"id":"device_vendor_msft_policy_config_browser_configureopenmicrosoftedgewith_1","displayName":"Load the New tab page","description":"Load the New tab page","helpText":null},{"id":"device_vendor_msft_policy_config_browser_configureopenmicrosoftedgewith_2","displayName":"Load the previous pages","description":"Load the previous pages","helpText":null},{"id":"device_vendor_msft_policy_config_browser_configureopenmicrosoftedgewith_3","displayName":"Load a specific page or pages","description":"Load a specific page or pages","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_configuretelemetryformicrosoft365analytics","displayName":"Configure Telemetry For Microsoft 365 Analytics","description":"Configures what browsing data will be sent to Microsoft 365 Analytics for devices belonging to an organization.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#configuretelemetryformicrosoft365analytics"],"options":[{"id":"device_vendor_msft_policy_config_browser_configuretelemetryformicrosoft365analytics_0","displayName":"No data collected or sent","description":"No data collected or sent","helpText":null},{"id":"device_vendor_msft_policy_config_browser_configuretelemetryformicrosoft365analytics_1","displayName":"Send intranet history only","description":"Send intranet history only","helpText":null},{"id":"device_vendor_msft_policy_config_browser_configuretelemetryformicrosoft365analytics_2","displayName":"Send Internet history only","description":"Send Internet history only","helpText":null},{"id":"device_vendor_msft_policy_config_browser_configuretelemetryformicrosoft365analytics_3","displayName":"Send both intranet and Internet history","description":"Send both intranet and Internet history","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_disablelockdownofstartpages","displayName":"Disable Lockdown Of Start Pages","description":"You can configure Microsoft Edge to disable the lockdown of Start pages allowing users to change or customize their start pages. To do this, you must also enable the Configure Start Pages or Configure Open Microsoft With policy. When enabled, all configured start pages are editable. Any Start page configured using the Configure Start pages policy is not locked down allowing users to edit their Start pages. If disabled or not configured, the Start pages configured in the Configure Start Pages policy cannot be changed and remain locked down. Supported devices: Domain-joined or MDM-enrolled Related policy: - Configure Start Pages - Configure Open Microsoft Edge With","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#disablelockdownofstartpages"],"options":[{"id":"device_vendor_msft_policy_config_browser_disablelockdownofstartpages_0","displayName":"Disabled","description":"Lock down Start pages configured in either the ConfigureOpenEdgeWith policy and HomePages policy.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_disablelockdownofstartpages_1","displayName":"Enabled","description":"Unlocked. Users can make changes to all configured start pages.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_enableextendedbookstelemetry","displayName":"Enable Extended Books Telemetry","description":"This setting allows organizations to send extended telemetry on book usage from the Books Library.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#enableextendedbookstelemetry"],"options":[{"id":"device_vendor_msft_policy_config_browser_enableextendedbookstelemetry_0","displayName":"Disabled","description":"Gather and send only basic diagnostic data, depending on the device configuration.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_enableextendedbookstelemetry_1","displayName":"Enabled","description":"Gather all diagnostic data.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_enterprisemodesitelist","displayName":"Enterprise Mode Site List","description":"This setting lets you configure whether your company uses Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy websites.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#enterprisemodesitelist"],"options":null},{"id":"device_vendor_msft_policy_config_browser_enterprisesitelistserviceurl","displayName":"Enterprise Site List Service Url","description":"Important. Discontinued in Windows 10, version 1511. Use the Browser/EnterpriseModeSiteList policy instead.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#enterprisesitelistserviceurl"],"options":null},{"id":"device_vendor_msft_policy_config_browser_homepages","displayName":"Home Pages","description":"When you enable the Configure Open Microsoft Edge With policy, you can configure one or more Start pages. When you enable this policy, users are not allowed to make changes to their Start pages. If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format: If disabled or not configured, the webpages specified in App settings loads as the default Start pages. Version 1703 or later: If you do not want to send traffic to Microsoft, enable this policy and use the value, which honors domain- and non-domain-joined devices, when it is the only configured URL. Version 1809: If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy. Supported devices: Domain-joined or MDM-enrolled Related policy: - Configure Open Microsoft Edge With - Disable Lockdown of Start Pages","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#homepages"],"options":null},{"id":"device_vendor_msft_policy_config_browser_lockdownfavorites","displayName":"Lockdown Favorites","description":"This policy setting lets you decide whether employees can add, import, sort, or edit the Favorites list on Microsoft Edge. If you enable this setting, employees won't be able to add, import, or change anything in the Favorites list. Also as part of this, Save a Favorite, Import settings, and the context menu items (such as, Create a new folder) are all turned off. Important Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. If you disable or don't configure this setting (default), employees can add, import and make changes to the Favorites list.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#lockdownfavorites"],"options":[{"id":"device_vendor_msft_policy_config_browser_lockdownfavorites_0","displayName":"Disabled","description":"Allowed/not locked down. Users can add, import, and make changes to the favorites.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_lockdownfavorites_1","displayName":"Enabled","description":"Prevented/locked down.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_preventaccesstoaboutflagsinmicrosoftedge","displayName":"Prevent Access To About Flags In Microsoft Edge","description":"Prevent access to the about:flags page in Microsoft Edge.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#preventaccesstoaboutflagsinmicrosoftedge"],"options":[{"id":"device_vendor_msft_policy_config_browser_preventaccesstoaboutflagsinmicrosoftedge_0","displayName":"Disabled","description":"Allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_preventaccesstoaboutflagsinmicrosoftedge_1","displayName":"Enabled","description":"Prevents users from accessing the about:flags page.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_preventcerterroroverrides","displayName":"Prevent Cert Error Overrides","description":"Web security certificates are used to ensure a site your users go to is legitimate, and in some circumstances encrypts the data. With this policy, you can specify whether to prevent users from bypassing the security warning to sites that have SSL errors. If enabled, overriding certificate errors are not allowed. If disabled or not configured, overriding certificate errors are allowed.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#preventcerterroroverrides"],"options":[{"id":"device_vendor_msft_policy_config_browser_preventcerterroroverrides_0","displayName":"Disabled","description":"Allowed/turned on. Override the security warning to sites that have SSL errors.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_preventcerterroroverrides_1","displayName":"Enabled","description":"Prevented/turned on.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_preventlivetiledatacollection","displayName":"Prevent Live Tile Data Collection","description":"This policy lets you decide whether Microsoft Edge can gather Live Tile metadata from the ieonline.microsoft.com service to provide a better experience while pinning a Live Tile to the Start menu. Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#preventlivetiledatacollection"],"options":[{"id":"device_vendor_msft_policy_config_browser_preventlivetiledatacollection_0","displayName":"Disabled","description":"Collect and send Live Tile metadata.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_preventlivetiledatacollection_1","displayName":"Enabled","description":"No data collected.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_preventsmartscreenpromptoverride","displayName":"Prevent Smart Screen Prompt Override","description":"Don't allow Windows Defender SmartScreen warning overrides","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#preventsmartscreenpromptoverride"],"options":[{"id":"device_vendor_msft_policy_config_browser_preventsmartscreenpromptoverride_0","displayName":"Disabled","description":"Allowed/turned off. Users can ignore the warning and continue to the site.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_preventsmartscreenpromptoverride_1","displayName":"Enabled","description":"Prevented/turned on.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_preventsmartscreenpromptoverrideforfiles","displayName":"Prevent Smart Screen Prompt Override For Files","description":"Don't allow Windows Defender SmartScreen warning overrides for unverified files.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#preventsmartscreenpromptoverrideforfiles"],"options":[{"id":"device_vendor_msft_policy_config_browser_preventsmartscreenpromptoverrideforfiles_0","displayName":"Disabled","description":"Allowed/turned off. Users can ignore the warning and continue to download the unverified file(s).","helpText":null},{"id":"device_vendor_msft_policy_config_browser_preventsmartscreenpromptoverrideforfiles_1","displayName":"Enabled","description":"Prevented/turned on.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_preventturningoffrequiredextensions","displayName":"Prevent Turning Off Required Extensions","description":"You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. If you enable the Allow Developer Tools policy, then this policy does not prevent users from debugging and altering the logic on an extension. If disabled or not configured, extensions defined as part of this policy get ignored. Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: - Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) - How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) - How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) - Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) - How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows)","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#preventturningoffrequiredextensions"],"options":null},{"id":"device_vendor_msft_policy_config_browser_preventusinglocalhostipaddressforwebrtc","displayName":"Prevent Using Local Host IP Address For Web RTC","description":"Prevent using localhost IP address for WebRTC","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#preventusinglocalhostipaddressforwebrtc"],"options":[{"id":"device_vendor_msft_policy_config_browser_preventusinglocalhostipaddressforwebrtc_0","displayName":"Disabled","description":"Allowed. Show localhost IP addresses.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_preventusinglocalhostipaddressforwebrtc_1","displayName":"Enabled","description":"Prevented/Not allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_provisionfavorites","displayName":"Provision Favorites","description":"This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites. If you enable this setting, you can set favorite URL's and favorite folders to appear on top of users' favorites list (either in the Hub or Favorites Bar). The user favorites will appear after these provisioned favorites. Important Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. If you disable or don't configure this setting, employees will see the favorites they set in the Hub and Favorites Bar.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#provisionfavorites"],"options":null},{"id":"device_vendor_msft_policy_config_browser_sendintranettraffictointernetexplorer","displayName":"Send Intranet Trafficto Internet Explorer","description":"Sends all intranet traffic over to Internet Explorer.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#sendintranettraffictointernetexplorer"],"options":[{"id":"device_vendor_msft_policy_config_browser_sendintranettraffictointernetexplorer_0","displayName":"Disabled","description":"All sites, including intranet sites, open in Microsoft Edge automatically.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_sendintranettraffictointernetexplorer_1","displayName":"Enabled","description":"Only intranet sites open in Internet Explorer 11 automatically.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_setdefaultsearchengine","displayName":"Set Default Search Engine","description":"Sets the default search engine for MDM-enrolled devices. Users can still change their default search engine. If this setting is turned on, you are setting the default search engine that you would like your employees to use. Employees can still change the default search engine, unless you apply the AllowSearchEngineCustomization policy which will disable the ability to change it. You must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. If you would like for your employees to use the Edge factory settings for the default search engine for their market, set the string EDGEDEFAULT; if you would like for your employees to use Bing as the default search engine, set the string EDGEBING. If this setting is not configured, the default search engine is set to the one specified in App settings and can be changed by your employees. If this setting is disabled, the policy-set search engine will be removed, and, if it is the current default, the default will be set back to the factory Microsoft Edge search engine for the market. Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#setdefaultsearchengine"],"options":null},{"id":"device_vendor_msft_policy_config_browser_sethomebuttonurl","displayName":"Set Home Button URL","description":"The home button can be configured to load a custom URL when your user clicks the home button. If enabled, or configured, and the Configure Home Button policy is enabled, and the Show home button & set a specific page is selected, a custom URL loads when your user clicks the home button. Default setting: Blank or not configured Related policy: Configure Home Button","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#sethomebuttonurl"],"options":null},{"id":"device_vendor_msft_policy_config_browser_setnewtabpageurl","displayName":"Set New Tab Page URL","description":"You can set the default New Tab page URL in Microsoft Edge. Enabling this policy prevents your users from changing the New tab page setting. When enabled and the Allow web content on New Tab page policy is disabled, Microsoft Edge ignores the URL specified in this policy and opens about:blank. If enabled, you can set the default New Tab page URL. If disabled or not configured, the default Microsoft Edge new tab page is used. Default setting: Disabled or not configured Related policy: Allow web content on New Tab page","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#setnewtabpageurl"],"options":null},{"id":"device_vendor_msft_policy_config_browser_showmessagewhenopeningsitesininternetexplorer","displayName":"Show Message When Opening Sites In Internet Explorer","description":"You can configure Microsoft Edge to open a site automatically in Internet Explorer 11 and choose to display a notification before the site opens. If you want to display a notification, you must enable Configure the Enterprise Mode Site List or Send all intranets sites to Internet Explorer 11 or both. If enabled, the notification appears on a new page. If you want users to continue in Microsoft Edge, select the Show Keep going in Microsoft Edge option from the drop-down list under Options. If disabled or not configured, the default app behavior occurs and no additional page displays. Default setting: Disabled or not configured Related policies: -Configure the Enterprise Mode Site List -Send all intranet sites to Internet Explorer 11","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#showmessagewhenopeningsitesininternetexplorer"],"options":[{"id":"device_vendor_msft_policy_config_browser_showmessagewhenopeningsitesininternetexplorer_0","displayName":"No additional message displays.","description":"No additional message displays.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_showmessagewhenopeningsitesininternetexplorer_1","displayName":"Show an additional message stating that a site has opened in IE11.","description":"Show an additional message stating that a site has opened in IE11.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_showmessagewhenopeningsitesininternetexplorer_2","displayName":"Show an additional message with a \"Keep going in Microsoft Edge\" link.","description":"Show an additional message with a \"Keep going in Microsoft Edge\" link.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_syncfavoritesbetweenieandmicrosoftedge","displayName":"Sync Favorites Between IE And Microsoft Edge","description":"Specifies whether favorites are kept in sync between Internet Explorer and Microsoft Edge. Changes to favorites in one browser are reflected in the other, including: additions, deletions, modifications, and ordering.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#syncfavoritesbetweenieandmicrosoftedge"],"options":[{"id":"device_vendor_msft_policy_config_browser_syncfavoritesbetweenieandmicrosoftedge_0","displayName":"Disabled","description":"Turned off/not syncing.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_syncfavoritesbetweenieandmicrosoftedge_1","displayName":"Enabled","description":"Turned on/syncing.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_unlockhomebutton","displayName":"Unlock Home Button","description":"By default, when enabling Configure Home Button or Set Home Button URL, the home button is locked down to prevent your users from changing what page loads when clicking the home button. Use this policy to let users change the home button even when Configure Home Button or Set Home Button URL are enabled. If enabled, the UI settings for the home button are enabled allowing your users to make changes, including hiding and showing the home button as well as configuring a custom URL. If disabled or not configured, the UI settings for the home button are disabled preventing your users from making changes. Default setting: Disabled or not configured Related policy: -Configure Home Button -Set Home Button URL","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#unlockhomebutton"],"options":[{"id":"device_vendor_msft_policy_config_browser_unlockhomebutton_0","displayName":"Disabled","description":"Lock down and prevent users from making changes to the settings.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_unlockhomebutton_1","displayName":"Enabled","description":"Let users make changes.","helpText":null}]},{"id":"device_vendor_msft_policy_config_browser_usesharedfolderforbooks","displayName":"Use Shared Folder For Books","description":"This setting specifies whether organizations should use a folder shared across users to store books from the Books Library.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Browser#usesharedfolderforbooks"],"options":[{"id":"device_vendor_msft_policy_config_browser_usesharedfolderforbooks_0","displayName":"Disabled","description":"Prevented/not allowed, but Microsoft Edge downloads book files to a per-user folder for each user.","helpText":null},{"id":"device_vendor_msft_policy_config_browser_usesharedfolderforbooks_1","displayName":"Enabled","description":"Allowed. Microsoft Edge downloads book files to a shared folder. For this policy to work correctly, you must also enable the Allow a Windows app to share application data between users group policy. Also, the users must be signed in with a school or work account.","helpText":null}]},{"id":"device_vendor_msft_policy_config_camera_allowcamera","displayName":"Allow Camera","description":"Disables or enables the camera. Most restrictive value is Block","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-camera#allowcamera"],"options":[{"id":"device_vendor_msft_policy_config_camera_allowcamera_0","displayName":"Not allowed.","description":"Not allowed.","helpText":null},{"id":"device_vendor_msft_policy_config_camera_allowcamera_1","displayName":"Allowed.","description":"Allowed.","helpText":null}]},{"id":"device_vendor_msft_policy_config_cellular_letappsaccesscellulardata","displayName":"Let Apps Access Cellular Data","description":"This policy setting specifies whether Windows apps can access cellular data.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Cellular#letappsaccesscellulardata"],"options":[{"id":"device_vendor_msft_policy_config_cellular_letappsaccesscellulardata_0","displayName":"User is in control","description":"User is in control","helpText":null},{"id":"device_vendor_msft_policy_config_cellular_letappsaccesscellulardata_1","displayName":"Force Allow","description":"Force Allow","helpText":null},{"id":"device_vendor_msft_policy_config_cellular_letappsaccesscellulardata_2","displayName":"Force Deny","description":"Force Deny","helpText":null}]},{"id":"device_vendor_msft_policy_config_cellular_letappsaccesscellulardata_forceallowtheseapps","displayName":"Let Apps Access Cellular Data Force Allow These Apps","description":"List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Cellular#letappsaccesscellulardata_forceallowtheseapps"],"options":null},{"id":"device_vendor_msft_policy_config_cellular_letappsaccesscellulardata_forcedenytheseapps","displayName":"Let Apps Access Cellular Data Force Deny These Apps","description":"List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Cellular#letappsaccesscellulardata_forcedenytheseapps"],"options":null},{"id":"device_vendor_msft_policy_config_cellular_letappsaccesscellulardata_userincontroloftheseapps","displayName":"Let Apps Access Cellular Data User In Control Of These Apps","description":"List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Cellular#letappsaccesscellulardata_userincontroloftheseapps"],"options":null},{"id":"device_vendor_msft_policy_config_cellular_showappcellularaccessui","displayName":"Set Per-App Cellular Access UI Visibility","description":"This policy setting configures the visibility of the link to the per-application cellular access control page in the cellular setting UX.\r\n\r\nIf this policy setting is enabled, a drop-down list box presenting possible values will be active. Select \"Hide\" or \"Show\" to hide or show the link to the per-application cellular access control page.\r\nIf this policy setting is disabled or is not configured, the link to the per-application cellular access control page is showed by default.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-cellular#cellular-showappcellularaccessui"],"options":[{"id":"device_vendor_msft_policy_config_cellular_showappcellularaccessui_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_cellular_showappcellularaccessui_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_cellular_showappcellularaccessui_showappcellularaccessui_option","displayName":"Please select one option to set: (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_cellular_showappcellularaccessui_showappcellularaccessui_option_0","displayName":"Hide","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_cellular_showappcellularaccessui_showappcellularaccessui_option_1","displayName":"Show","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_abusiveexperienceinterventionenforce","displayName":"Abusive Experience Intervention Enforce","description":"If SafeBrowsingEnabled is not Disabled, then setting AbusiveExperienceInterventionEnforce to Enabled or leaving it unset prevents sites with abusive experiences from opening new windows or tabs.\r\n\r\nSetting SafeBrowsingEnabled to Disabled or AbusiveExperienceInterventionEnforce to Disabled lets sites with abusive experiences open new windows or tabs.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_abusiveexperienceinterventionenforce_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_abusiveexperienceinterventionenforce_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_accessibilityimagelabelsenabled","displayName":"Enable Get Image Descriptions from Google.","description":"The Get Image Descriptions from Google\r\naccessibility feature enables visually-impaired screen reader users to\r\nget descriptions of unlabeled images on the web. Users who choose to enable it\r\nwill have the option of using an anonymous Google service to provide\r\nautomatic descriptions for unlabeled images they encounter on the web.\r\n\r\nIf this feature is enabled, the content of images will be sent to Google\r\nservers in order to generate a description. No cookies or other user\r\ndata is sent, and Google does not save or log any image content.\r\n\r\nIf this policy is set to Enabled, the\r\nGet Image Descriptions from Google\r\nfeature will be enabled, though it will only affect users who are using a\r\nscreen reader or other similar assistive technology.\r\n\r\nIf this policy is set to Disabled, users will not have the option of enabling\r\nthe feature.\r\n\r\nIf this policy is not set, user can choose to use this feature or not.\r\n","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_accessibilityimagelabelsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_accessibilityimagelabelsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_additionaldnsquerytypesenabled","displayName":"Allow DNS queries for additional DNS record types","description":"This policy controls whether Google Chrome may query additional DNS record types when making insecure DNS requests. This policy has no effect on DNS queries made via Secure DNS, which may always query additional DNS types.\r\n\r\nIf this policy is unset or set to Enabled, additional types such as HTTPS (DNS type 65) may be queried in addition to A (DNS type 1) and AAAA (DNS type 28).\r\n\r\nIf this policy is set to Disabled, DNS will only be queried for A (DNS type 1) and/or AAAA (DNS type 28).\r\n\r\nThis policy is a temporary measure and will be removed in future versions of Google Chrome. After removal of the policy, Google Chrome will always be able to query additional DNS types.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_additionaldnsquerytypesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_additionaldnsquerytypesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_adssettingforintrusiveadssites","displayName":"Ads setting for sites with intrusive ads","description":"Unless SafeBrowsingEnabled is set to False, then setting AdsSettingForIntrusiveAdsSites to 1 or leaving it unset allows ads on all sites.\r\n\r\nSetting the policy to 2 blocks ads on sites with intrusive ads.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_adssettingforintrusiveadssites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_adssettingforintrusiveadssites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_adssettingforintrusiveadssites_adssettingforintrusiveadssites","displayName":"Ads setting for sites with intrusive ads (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_adssettingforintrusiveadssites_adssettingforintrusiveadssites_1","displayName":"Allow ads on all sites","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_adssettingforintrusiveadssites_adssettingforintrusiveadssites_2","displayName":"Do not allow ads on sites with intrusive ads","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_advancedprotectionallowed","displayName":"Enable additional protections for users enrolled in the Advanced Protection program","description":"This policy controls whether users enrolled in the Advanced Protection program receive extra protections. Some of these features may involve the sharing of data with Google (for example, Advanced Protection users will be able to send their downloads to Google for malware scanning). If set to True or not set, enrolled users will receive extra protections. If set to False, Advanced Protection users will receive only the standard consumer features.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_advancedprotectionallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_advancedprotectionallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_allowdeletingbrowserhistory","displayName":"Enable deleting browser and download history","description":"Setting the policy to Enabled or leaving it unset means browser history and download history can be deleted in Chrome, and users can't change this setting.\r\n\r\nSetting the policy to Disabled means browser history and download history can't be deleted. Even with this policy off, the browsing and download history are not guaranteed to be retained. Users may be able to edit or delete the history database files directly, and the browser itself may expire or archive any or all history items at any time.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_allowdeletingbrowserhistory_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_allowdeletingbrowserhistory_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_allowdinosaureasteregg","displayName":"Allow Dinosaur Easter Egg Game","description":"Setting the policy to True allows users to play the dinosaur game. Setting the policy to False means users can't play the dinosaur easter egg game when device is offline.\r\n\r\nLeaving the policy unset means users can't play the game on enrolled Google Chrome OS, but can under other circumstances.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_allowdinosaureasteregg_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_allowdinosaureasteregg_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_alloweddomainsforapps","displayName":"Define domains allowed to access Google Workspace","description":"Setting the policy turns on Chrome's restricted sign-in feature in Google Workspace and prevents users from changing this setting. Users can only access Google tools using accounts from the specified domains (to allow gmail or googlemail accounts, add consumer_accounts to the list of domains). This setting prevents users from signing in and adding a Secondary Account on a managed device that requires Google authentication, if that account doesn't belong to one of the explicitly allowed domains.\r\n\r\nLeaving this setting empty or unset means users can access Google Workspace with any account.\r\n\r\nUsers cannot change or override this setting.\r\n\r\nNote: This policy causes the X-GoogApps-Allowed-Domains header to be appended to all HTTP and HTTPS requests to all google.com domains, as described in https://support.google.com/a/answer/1668854.\r\n\r\nExample value: managedchrome.com,example.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_alloweddomainsforapps_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_alloweddomainsforapps_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_alloweddomainsforapps_alloweddomainsforapps","displayName":"Define domains allowed to access Google Workspace (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_allowfileselectiondialogs","displayName":"Allow invocation of file selection dialogs","description":"Setting the policy to Enabled or leaving it unset means Chrome can display, and users can open, file selection dialogs.\r\n\r\nSetting the policy to Disabled means that whenever users perform actions provoking a file selection dialog, such as importing bookmarks, uploading files, and saving links, a message appears instead. The user is assumed to have clicked Cancel on the file selection dialog.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_allowfileselectiondialogs_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_allowfileselectiondialogs_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_allowsyncxhrinpagedismissal","displayName":"Allows a page to perform synchronous XHR requests during page dismissal.","description":"This policy allows an admin to specify that a page may send synchronous XHR requests during page dismissal.\r\n\r\nWhen the policy is set to enabled, pages are allowed to send synchronous XHR requests during page dismissal.\r\n\r\nWhen the policy is set to disabled or not set, pages are not allowed to send synchronous XHR requests during page dismissal.\r\n\r\nThis policy will be removed in Chrome 93.\r\n\r\nSee https://www.chromestatus.com/feature/4664843055398912 .","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_allowsyncxhrinpagedismissal_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_allowsyncxhrinpagedismissal_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_alternateerrorpagesenabled","displayName":"Enable alternate error pages","description":"Setting the policy to True means Google Chrome uses alternate error pages built into (such as \"page not found\"). Setting the policy to False means Google Chrome never uses alternate error pages.\r\n\r\nIf you set the policy, users can't change it. If not set, the policy is on, but users can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_alternateerrorpagesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_alternateerrorpagesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_alwaysopenpdfexternally","displayName":"Always Open PDF files externally","description":"Setting the policy to Enabled turns the internal PDF viewer off in Google Chrome, treats PDF files as a download, and lets users open PDFs with the default application.\r\n\r\nSetting the policy to Disabled means that unless users turns off the PDF plugin, it will open PDF files.\r\n\r\nIf you set the policy, users can't change it in Google Chrome. If not set, users can choose whether to open PDF externally or not.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_alwaysopenpdfexternally_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_alwaysopenpdfexternally_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_ambientauthenticationinprivatemodesenabled","displayName":"Enable Ambient Authentication for profile types.","description":"Configuring this policy will allow/disallow ambient authentication for Incognito and Guest profiles in Google Chrome.\r\n\r\nAmbient Authentication is http authentication with default credentials if explicit credentials are not provided via NTLM/Kerberos/Negotiate challenge/response schemes.\r\n\r\nSetting the RegularOnly (value 0), allows ambient authentication for Regular sessions only. Incognito and Guest sessions wouldn't be allowed to ambiently authenticate.\r\n\r\nSetting the IncognitoAndRegular (value 1), allows ambient authentication for Incognito and Regular sessions. Guest sessions wouldn't be allowed to ambiently authenticate.\r\n\r\nSetting the GuestAndRegular (value 2), allows ambient authentication for Guest and Regular sessions. Incognito sessions wouldn't be allowed to ambiently authenticate.\r\n\r\nSetting the All (value 3), allows ambient authentication for all sessions.\r\n\r\nNote that, ambient authentication is always allowed on regular profiles.\r\n\r\nIn Google Chrome version 81 and later, if the policy is left not set, ambient authentication will be enabled in regular sessions only.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_ambientauthenticationinprivatemodesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_ambientauthenticationinprivatemodesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_ambientauthenticationinprivatemodesenabled_ambientauthenticationinprivatemodesenabled","displayName":"Enable Ambient Authentication for profile types. (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_ambientauthenticationinprivatemodesenabled_ambientauthenticationinprivatemodesenabled_0","displayName":"Enable ambient authentication in regular sessions only.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_ambientauthenticationinprivatemodesenabled_ambientauthenticationinprivatemodesenabled_1","displayName":"Enable ambient authentication in incognito and regular sessions.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_ambientauthenticationinprivatemodesenabled_ambientauthenticationinprivatemodesenabled_2","displayName":"Enable ambient authentication in guest and regular sessions.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_ambientauthenticationinprivatemodesenabled_ambientauthenticationinprivatemodesenabled_3","displayName":"Enable ambient authentication in regular, incognito and guest sessions.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_applicationlocalevalue","displayName":"Application locale","description":"Setting the policy specifies the locale Google Chrome uses.\r\n\r\nTurning it off or leaving it unset means the locale will be the first valid locale from:\r\n1) The user specified locale (if configured).\r\n2) The system locale.\r\n3) The fallback locale (en-US).\r\n\r\nExample value: en","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_applicationlocalevalue_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_applicationlocalevalue_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_applicationlocalevalue_applicationlocalevalue","displayName":"Application locale (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_audiocaptureallowed","displayName":"Allow or deny audio capture","description":"Setting the policy to Enabled or leaving it unset means that, with the exception of URLs set in the AudioCaptureAllowedUrls list, users get prompted for audio capture access.\r\n\r\nSetting the policy to Disabled turns off prompts, and audio capture is only available to URLs set in the AudioCaptureAllowedUrls list.\r\n\r\nNote: The policy affects all audio input (not just the built-in microphone).","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_audiocaptureallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_audiocaptureallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_audiocaptureallowedurls","displayName":"URLs that will be granted access to audio capture devices without prompt","description":"Setting the policy means you specify the URL list whose patterns get matched to the security origin of the requesting URL. A match grants access to audio capture devices without prompt\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com/\r\nhttps://[*.]example.edu/","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_audiocaptureallowedurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_audiocaptureallowedurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_audiocaptureallowedurls_audiocaptureallowedurlsdesc","displayName":"URLs that will be granted access to audio capture devices without prompt (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_audioprocesshighpriorityenabled","displayName":"Allow the audio process to run with priority above normal on Windows","description":"This policy controls the priority of the audio process on Windows.\r\nIf this policy is enabled, the audio process will run with above normal priority.\r\nIf this policy is disabled, the audio process will run with normal priority.\r\nIf this policy is not set, the default configuration for the audio process will be used.\r\nThis policy is intended as a temporary measure to give enterprises the ability to\r\nrun audio with higher priority to address certain performance issues with audio capture.\r\nThis policy will be removed in the future.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_audioprocesshighpriorityenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_audioprocesshighpriorityenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_audiosandboxenabled","displayName":"Allow the audio sandbox to run","description":"This policy controls the audio process sandbox.\r\nIf this policy is enabled, the audio process will run sandboxed.\r\nIf this policy is disabled, the audio process will run unsandboxed and the WebRTC audio-processing module will run in the renderer process.\r\nThis leaves users open to security risks related to running the audio subsystem unsandboxed.\r\nIf this policy is not set, the default configuration for the audio sandbox will be used, which may differ per platform.\r\nThis policy is intended to give enterprises flexibility to disable the audio sandbox if they use security software setups that interfere with the sandbox.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_audiosandboxenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_audiosandboxenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autofilladdressenabled","displayName":"Enable AutoFill for addresses","description":"Setting the policy to True or leaving it unset gives users control of Autofill for addresses in the UI.\r\n\r\nSetting the policy to False means Autofill never suggests or fills address information, nor does it save additional address information that users submit while browsing the web.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autofilladdressenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autofilladdressenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autofillcreditcardenabled","displayName":"Enable AutoFill for credit cards","description":"Setting the policy to True or leaving it unset means users can control autofill suggestions for credit cards in the UI.\r\n\r\nSetting the policy to False means autofill never suggests or fills credit card information, nor will it save additional credit card information that users might submit while browsing the web.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autofillcreditcardenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autofillcreditcardenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autolaunchprotocolsfromorigins","displayName":"Define a list of protocols that can launch an external application from listed origins without prompting the user","description":"Allows you to set a list of protocols, and for each protocol an associated list of allowed origin patterns, that can launch an external application without prompting the user. The trailing separator should not be included when listing the protocol, so list \"skype\" instead of \"skype:\" or \"skype://\".\r\n\r\nIf this policy is set, a protocol will only be permitted to launch an external application without prompting by policy if the protocol is listed, and the origin of the site trying to launch the protocol matches one of the origin patterns in that protocol's allowed_origins list. If either condition is false the external protocol launch prompt will not be omitted by policy.\r\n\r\nIf this policy is not set, no protocols can launch without a prompt by default. Users may opt out of prompts on a per-protocol/per-site basis unless the ExternalProtocolDialogShowAlwaysOpenCheckbox policy is set to Disabled. This policy has no impact on per-protocol/per-site prompt exemptions set by users.\r\n\r\nThe origin matching patterns use a similar format to those for the 'URLBlocklist' policy, which are documented at http://www.chromium.org/administrators/url-blocklist-filter-format.\r\n\r\nHowever, origin matching patterns for this policy cannot contain \"/path\" or \"@query\" elements. Any pattern that does contain a \"/path\" or \"@query\" element will be ignored.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=AutoLaunchProtocolsFromOrigins for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"protocol\": \"spotify\",\r\n \"allowed_origins\": [\r\n \"example.com\",\r\n \"http://www.example.com:8080\"\r\n ]\r\n },\r\n {\r\n \"protocol\": \"teams\",\r\n \"allowed_origins\": [\r\n \"https://example.com\",\r\n \"https://.mail.example.com\"\r\n ]\r\n },\r\n {\r\n \"protocol\": \"outlook\",\r\n \"allowed_origins\": [\r\n \"*\"\r\n ]\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autolaunchprotocolsfromorigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autolaunchprotocolsfromorigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autolaunchprotocolsfromorigins_autolaunchprotocolsfromorigins","displayName":"Define a list of protocols that can launch an external application from listed origins without prompting the user (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autoopenallowedforurls","displayName":"URLs where AutoOpenFileTypes can apply","description":"List of URLs specifying which urls AutoOpenFileTypes will apply to. This policy has no impact on automatically open values set by users.\r\n\r\nIf this policy is set, files will only automatically open by policy if the url is part of this set and the file type is listed in AutoOpenFileTypes. If either condition is false the download won't automatically open by policy.\r\n\r\nIf this policy isn't set, all downloads where the file type is in AutoOpenFileTypes will automatically open.\r\n\r\nA URL pattern has to be formatted according to https://www.chromium.org/administrators/url-blocklist-filter-format.\r\n\r\nExample value:\r\n\r\nexample.com\r\nhttps://ssl.server.com\r\nhosting.com/good_path\r\nhttps://server:8080/path\r\n.exact.hostname.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autoopenallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autoopenallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autoopenallowedforurls_autoopenallowedforurlsdesc","displayName":"URLs where AutoOpenFileTypes can apply (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autoopenfiletypes","displayName":"List of file types that should be automatically opened on download","description":"List of file types that should be automatically opened on download. The leading separator should not be included when listing the file type, so list \"txt\" instead of \".txt\".\r\n\r\nFiles with types that should be automatically opened will still be subject to the enabled safe browsing checks and won't be opened if they fail those checks.\r\n\r\nIf this policy isn't set, only file types that a user has already specified to automatically be opened will do so when downloaded.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.\r\n\r\nExample value:\r\n\r\nexe\r\ntxt","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autoopenfiletypes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autoopenfiletypes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autoopenfiletypes_autoopenfiletypesdesc","displayName":"List of file types that should be automatically opened on download (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autoplayallowed","displayName":"Allow media autoplay","description":"Setting the policy to True lets Google Chrome autoplay media. Setting the policy to False stops Google Chrome from autoplaying media.\r\n\r\n By default, Google Chrome doesn't autoplay media. But, for certain URL patterns, you can use the AutoplayAllowlist policy to change this setting.\r\n\r\nIf this policy changes while Google Chrome is running, it only applies to newly opened tabs.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autoplayallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autoplayallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autoplayallowlist","displayName":"Allow media autoplay on a allowlist of URL patterns","description":"Setting the policy lets videos play automatically (without user consent) with audio content in Google Chrome. If AutoplayAllowed policy is set to True, then this policy has no effect. If AutoplayAllowed is set to False, then any URL patterns set in this policy can still play. If this policy changes while Google Chrome is running, it only applies to newly opened tabs.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autoplayallowlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autoplayallowlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_autoplayallowlist_autoplayallowlistdesc","displayName":"Allow media autoplay on a allowlist of URL patterns (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_backgroundmodeenabled","displayName":"Continue running background apps when Google Chrome is closed","description":"Setting the policy to Enabled turns background mode on. In background mode, a Google Chrome process is started on OS sign-in and keeps running when the last browser window is closed, allowing background apps and the browsing session to remain active. The background process displays an icon in the system tray and can always be closed from there.\r\n\r\nSetting the policy to Disabled turns background mode off.\r\n\r\nIf you set the policy, users can't change it in the browser settings. If unset, background mode is off at first, but users can change it.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_backgroundmodeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_backgroundmodeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_blockthirdpartycookies","displayName":"Block third party cookies","description":"Setting the policy to Enabled prevents webpage elements that aren't from the domain that's in the browser's address bar from setting cookies. Setting the policy to Disabled lets those elements set cookies and prevents users from changing this setting.\r\n\r\nLeaving it unset turns third-party cookies on, but users can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_blockthirdpartycookies_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_blockthirdpartycookies_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_bookmarkbarenabled","displayName":"Enable Bookmark Bar","description":"Setting the policy to True displays a bookmark bar in Google Chrome. Setting the policy to False means users never see the bookmark bar.\r\n\r\nIf you set the policy, users can't change it. If not set, users decide whether to use this function.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_bookmarkbarenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_bookmarkbarenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browseraddpersonenabled","displayName":"Enable add person in user manager","description":"If this policy is set to true or not configured, Google Chrome will allow Add Person from the user manager.\r\n\r\nIf this policy is set to false, Google Chrome will not allow creation of new profiles from the user manager.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browseraddpersonenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browseraddpersonenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browserguestmodeenabled","displayName":"Enable guest mode in browser","description":"If this policy is set to true or not configured, Google Chrome will enable guest logins. Guest logins are Google Chrome profiles where all windows are in incognito mode.\r\n\r\nIf this policy is set to false, Google Chrome will not allow guest profiles to be started.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browserguestmodeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browserguestmodeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browserguestmodeenforced","displayName":"Enforce browser guest mode","description":"Setting the policy to Enabled means Google Chrome enforces guest sessions and prevents profile sign-ins. Guest sign-ins are Google Chrome profiles where windows are in Incognito mode.\r\n\r\nSetting the policy to Disabled, leaving it unset, or disabling browser Guest mode (through BrowserGuestModeEnabled) allows the use of new and existing profiles.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browserguestmodeenforced_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browserguestmodeenforced_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browserlabsenabled","displayName":"Browser experiments icon in toolbar","description":"Setting the policy to Enabled or leaving the policy unset means that users can access browser experimental features through an icon in the toolbar\r\n\r\nSetting the policy to Disabled removes the browser experimental features icon from the toolbar.\r\n\r\nchrome://flags and any other means of turning off and on browser features will still behave as expected regardless of whether this policy is Enabled or Disabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browserlabsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browserlabsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browserlegacyextensionpointsblocked","displayName":"Block Browser Legacy Extension Points","description":"Setting the policy to Enabled or leaving it unset will enable ProcessExtensionPointDisablePolicy to block legacy extension points in the Browser process.\r\n\r\nSetting the policy to Disabled has a detrimental effect on Google Chrome's security and stability as unknown and potentially hostile code can load inside Google Chrome's browser process. Only turn off the policy if there are compatibility issues with third-party software that must run inside Google Chrome's browser process.\r\n\r\nNote: Read more about Process mitigation policies ( https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md#Process-mitigation-policies ).","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browserlegacyextensionpointsblocked_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browserlegacyextensionpointsblocked_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browsernetworktimequeriesenabled","displayName":"Allow queries to a Google time service","description":"Setting the policy to Enabled or leaving it unset means Google Chrome send occasional queries to a Google server to retrieve an accurate timestamp.\r\n\r\nSetting the policy to Disabled stops Google Chrome from sending these queries.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browsernetworktimequeriesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browsernetworktimequeriesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browsersignin","displayName":"Browser sign in settings","description":"This policy controls the sign-in behavior of the browser. It allows you to specify if the user can sign in to Google Chrome with their account and use account related services like Google Chrome Sync.\r\n\r\nIf the policy is set to \"Disable browser sign-in\" then the user cannot sign in to the browser and use account-based services. In this case browser-level features like Google Chrome Sync cannot be used and will be unavailable. On iOS, if the user was signed in and the policy is set to \"Disabled\" they will be signed out immediately. On other platforms, they will be signed out the next time they run Google Chrome. On all platforms, their local profile data like bookmarks, passwords etc. will be preserved and still usable. The user will still be able to sign into and use Google web services like Gmail.\r\n\r\nIf the policy is set to \"Enable browser sign-in,\" then the user is allowed to sign in to the browser. On all platforms except iOS, the user is automatically signed in to the browser when signed in to Google web services like Gmail. Being signed in to the browser means the user's account information will be kept by the browser. However, it does not mean that Google Chrome Sync will be turned on by default; the user must separately opt-in to use this feature. Enabling this policy will prevent the user from turning off the setting that allows browser sign-in. To control the availability of Google Chrome Sync, use the SyncDisabled policy.\r\n\r\nIf the policy is set to \"Force browser sign-in\" the user is presented with an account selection dialog and has to choose and sign in to an account to use the browser. This ensures that for managed accounts the policies associated with the account are applied and enforced. The default value of BrowserGuestModeEnabled will be set to disabled. Note that existing unsigned profiles will be locked and inaccessible after enabling this policy. For more information, see help center article: https://support.google.com/chrome/a/answer/7572556 . This option is not supported on Linux, Android or iOS. It will fall back to \"Enable browser sign-in\" if used.\r\n\r\nIf this policy is not set then the user can decide if they want to enable browser sign-in in the Google Chrome settings and use it as they see fit.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browsersignin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browsersignin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browsersignin_browsersignin","displayName":"Browser sign in settings (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browsersignin_browsersignin_0","displayName":"Disable browser sign-in","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browsersignin_browsersignin_1","displayName":"Enable browser sign-in","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browsersignin_browsersignin_2","displayName":"Force users to sign-in to use the browser","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browserthemecolor","displayName":"Configure the color of the browser's theme","description":"This policy allows admins to configure the color of Google Chrome's theme. The input string should be a valid hex color string matching the format \"#RRGGBB\".\r\n\r\nSetting the policy to a valid hex color causes a theme based on that color to be automatically generated and applied to the browser. Users won't be able to change the theme set by the policy.\r\n\r\nLeaving the policy unset lets users change their browser's theme as preferred.\r\n\r\nExample value: #FFFFFF","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browserthemecolor_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browserthemecolor_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browserthemecolor_browserthemecolor","displayName":"Configure the color of the browser's theme (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browsingdatalifetime","displayName":"Browsing Data Lifetime Settings","description":"Configures browsing data lifetime settings for Google Chrome. This policy allows admins to configure (per data-type) when data is deleted by the browser. This is useful for customers that work with sensitive customer data. The policy will only take effect if SyncDisabled is set to true.\r\n\r\nThe available data types are 'browsing_history', 'download_history', 'cookies_and_other_site_data', 'cached_images_and_files', 'password_signin', 'autofill', 'site_settings' and 'hosted_app_data'.\r\n\r\nThe browser will automatically remove data of selected types that is older than 'time_to_live_in_hours'. The minimum value that can be set is 1 hour.\r\n\r\nThe deletion of expired data will happen 15 seconds after the browser starts then every hour while the browser is running.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=BrowsingDataLifetime for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"time_to_live_in_hours\": 24,\r\n \"data_types\": [\r\n \"browsing_history\"\r\n ]\r\n },\r\n {\r\n \"time_to_live_in_hours\": 12,\r\n \"data_types\": [\r\n \"password_signin\",\r\n \"autofill\"\r\n ]\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browsingdatalifetime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browsingdatalifetime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_browsingdatalifetime_browsingdatalifetime","displayName":"Browsing Data Lifetime Settings (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_builtindnsclientenabled","displayName":"Use built-in DNS client","description":"This policy controls which software stack is used to communicate with the DNS server: the Operating System DNS client, or Google Chrome's built-in DNS client. This policy does not affect which DNS servers are used: if, for example, the operating system is configured to use an enterprise DNS server, that same server would be used by the built-in DNS client. It also does not control if DNS-over-HTTPS is used; Google Chrome will always use the built-in resolver for DNS-over-HTTPS requests. Please see the DnsOverHttpsMode policy for information on controlling DNS-over-HTTPS.\r\n\r\nIf this policy is set to Enabled, the built-in DNS client will be used, if available.\r\n\r\nIf this policy is set to Disabled, the built-in DNS client will only be used when DNS-over-HTTPS is in use.\r\n\r\nIf this policy is left unset, the built-in DNS client will be enabled by default on macOS, Android (when neither Private DNS nor VPN are enabled) and Google Chrome OS.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_builtindnsclientenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_builtindnsclientenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_cecpq2enabled","displayName":"CECPQ2 post-quantum key-agreement enabled for TLS","description":"If this policy is not configured, or is set to enabled, then Google Chrome will follow the default rollout process for CECPQ2, a post-quantum key-agreement algorithm in TLS.\r\n\r\nCECPQ2 results in larger TLS messages which, in very rare cases, can trigger bugs in some networking hardware. This policy can be set to False to disable CECPQ2 while networking issues are resolved.\r\n\r\nThis policy is a temporary measure and will be removed in future versions of Google Chrome.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_cecpq2enabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_cecpq2enabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_certificatetransparencyenforcementdisabledforcas","displayName":"Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes","description":"Setting the policy turns off enforcement of Certificate Transparency disclosure requirements for a list of subjectPublicKeyInfo hashes. Enterprise hosts can keep using certificates that otherwise wouldn't be trusted (because they weren't properly publicly disclosed). To turn off enforcement, the hash must meet one of these conditions:\r\n\r\n* It's of the server certificate's subjectPublicKeyInfo.\r\n\r\n* It's of a subjectPublicKeyInfo that appears in a Certificate Authority (CA) certificate in the certificate chain. That CA certificate is constrained through the X.509v3 nameConstraints extension, one or more directoryName nameConstraints are present in the permittedSubtrees, and the directoryName has an organizationName attribute.\r\n\r\n* It's of a subjectPublicKeyInfo that appears in a CA certificate in the certificate chain, the CA certificate has one or more organizationName attributes in the certificate Subject, and the server's certificate has the same number of organizationName attributes, in the same order, and with byte-for-byte identical values.\r\n\r\nSpecify a subjectPublicKeyInfo hash by linking the hash algorithm name, a slash, and the Base64 encoding of that hash algorithm applied to the DER-encoded subjectPublicKeyInfo of the specified certificate. Base64 encoding format matches that of an SPKI Fingerprint. The only recognized hash algorithm is sha256; others are ignored.\r\n\r\nLeaving the policy unset means that if certificates requiring disclosure through Certificate Transparency aren't disclosed, then Google Chrome doesn't trust those certificates.\r\n\r\nExample value:\r\n\r\nsha256/AAAAAAAAAAAAAAAAAAAAAA==\r\nsha256//////////////////////w==","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_certificatetransparencyenforcementdisabledforcas_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_certificatetransparencyenforcementdisabledforcas_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_certificatetransparencyenforcementdisabledforcas_certificatetransparencyenforcementdisabledforcasdesc","displayName":"Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_certificatetransparencyenforcementdisabledforlegacycas","displayName":"Disable Certificate Transparency enforcement for a list of Legacy Certificate Authorities","description":"Setting the policy turns off enforcement of Certificate Transparency disclosure requirements for a list of Legacy Certificate Authorities (CA) for certificate chains with a specified subjectPublicKeyInfo hash. Enterprise hosts can keep using certificates that otherwise wouldn't be trusted (because they weren't properly publicly disclosed). To turn off enforcement, the subjectPublicKeyInfo hash must appear in a CA certificate recognized as a Legacy CA. A Legacy CA is publicly trusted by one or more operating systems supported by Google Chrome, but not Android Open Source Project or Google Chrome OS.\r\n\r\nSpecify a subjectPublicKeyInfo hash by linking the hash algorithm name, a slash and the Base64 encoding of that hash algorithm applied to the DER-encoded subjectPublicKeyInfo of the specified certificate. Base64 encoding format matches that of an SPKI Fingerprint. The only recognized hash algorithm is sha256; others are ignored.\r\n\r\nLeaving the policy unset means that if certificates requiring disclosure through Certificate Transparency aren't disclosed, then Google Chrome doesn't trust those certificates.\r\n\r\nExample value:\r\n\r\nsha256/AAAAAAAAAAAAAAAAAAAAAA==\r\nsha256//////////////////////w==","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_certificatetransparencyenforcementdisabledforlegacycas_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_certificatetransparencyenforcementdisabledforlegacycas_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_certificatetransparencyenforcementdisabledforlegacycas_certificatetransparencyenforcementdisabledforlegacycasdesc","displayName":"Disable Certificate Transparency enforcement for a list of Legacy Certificate Authorities (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_certificatetransparencyenforcementdisabledforurls","displayName":"Disable Certificate Transparency enforcement for a list of URLs","description":"Setting the policy turns off Certificate Transparency disclosure requirements for the hostnames in the specified URLs. While making it harder to detect misissued certificates, hosts can keep using certificates that otherwise wouldn't be trusted (because they weren't properly publicly disclosed).\r\n\r\nLeaving the policy unset means that if certificates requiring disclosure through Certificate Transparency aren't disclosed, then Google Chrome doesn't trust those certificates.\r\n\r\nA URL pattern follows this format ( https://www.chromium.org/administrators/url-blocklist-filter-format ). However, because the validity of certificates for a given hostname is independent of the scheme, port, or path, Google Chrome only considers the hostname portion of the URL. Wildcard hosts aren't supported.\r\n\r\nExample value:\r\n\r\nexample.com\r\n.example.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_certificatetransparencyenforcementdisabledforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_certificatetransparencyenforcementdisabledforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_certificatetransparencyenforcementdisabledforurls_certificatetransparencyenforcementdisabledforurlsdesc","displayName":"Disable Certificate Transparency enforcement for a list of URLs (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_chromecleanupenabled","displayName":"Enable Chrome Cleanup on Windows","description":"Setting the policy to Enabled or leaving it unset means Chrome Cleanup periodically scans the system for unwanted software and should any be found, will ask the user if they wish to remove it. Manually triggering Chrome Cleanup from chrome://settings is allowed.\r\n\r\nSetting the policy to Disabled means Chrome Cleanup won't periodically scan and manual triggering is disabled.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_chromecleanupenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_chromecleanupenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_chromecleanupreportingenabled","displayName":"Control how Chrome Cleanup reports data to Google","description":"Setting the policy to Enabled means if Chrome Cleanup detects unwanted software, it may, in line with policy set by SafeBrowsingExtendedReportingEnabled, report about the scan to Google. Chrome Cleanup asks users if they want the cleanup. It sends results to Google.\r\n\r\nSetting the policy to Disabled means if Chrome Cleanup detects unwanted software, it won't report about the scan to Google, regardless of the value of SafeBrowsingExtendedReportingEnabled. Chrome Cleanup asks users if they want the cleanup. The results aren't reported to Google.\r\n\r\nLeaving the policy unset means Chrome Cleanup may, in line with policy set by SafeBrowsingExtendedReportingEnabled, report about scans for detecting unwanted software to Google. Chrome Cleanup asks users if they want the cleanup and to share the results with Google to help with future unwanted software detection. These results have file metadata, automatically installed extensions, and registry keys, as described by the Chrome Privacy Whitepaper.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_chromecleanupreportingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_chromecleanupreportingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_chromevariations","displayName":"Determine the availability of variations","description":"Configuring this policy allows to specify which variations are allowed to be applied in Google Chrome.\r\n\r\nVariations provide a means for offering modifications to Google Chrome without shipping a new version of the browser by selectively enabling or disabling already existing features. See https://support.google.com/chrome/a?p=Manage_the_Chrome_variations_framework for more information.\r\n\r\nSetting the VariationsEnabled (value 0), or leaving the policy not set allows all variations to be applied to the browser.\r\n\r\nSetting the CriticalFixesOnly (value 1), allows only variations considered critical security or stability fixes to be applied to Google Chrome.\r\n\r\nSetting the VariationsDisabled (value 2), prevent all variations from being applied to the browser. Please note that this mode can potentially prevent the Google Chrome developers from providing critical security fixes in a timely manner and is thus not recommended.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_chromevariations_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_chromevariations_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_chromevariations_chromevariations","displayName":"Determine the availability of variations (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_chromevariations_chromevariations_0","displayName":"Enable all variations","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_chromevariations_chromevariations_1","displayName":"Enable variations concerning critical fixes only","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_chromevariations_chromevariations_2","displayName":"Disable all variations","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_clearbrowsingdataonexitlist","displayName":"Clear Browsing Data on Exit","description":"Configures a list of browsing data types that should be deleted when the user closes all browser windows. The available data types are browsing history (browsing_history), download history (download_history), cookies (cookies_and_other_site_data), cache(cached_images_and_files), autofill (autofill), passwords (password_signin), site settings (site_settings) and hosted apps data (hosted_app_data). This policy does not take precedence over AllowDeletingBrowserHistory.\r\n\r\nThis policy requires the SyncDisabled policy to be set to true, otherwise it will be ignored. If this policy is set at platform level, Sync should be disabled at platform level. If this policy is set at user level, Sync should be disabled for that user in order for this policy to take effect.\r\n\r\nIf Google Chrome does not exit cleanly (for example, if the browser or the OS crashes), the browsing data will be cleared the next time the profile is loaded.\r\n\r\nExample value:\r\n\r\nbrowsing_history\r\ndownload_history\r\ncookies_and_other_site_data\r\ncached_images_and_files\r\npassword_signin\r\nautofill\r\nsite_settings\r\nhosted_app_data","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_clearbrowsingdataonexitlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_clearbrowsingdataonexitlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_clearbrowsingdataonexitlist_clearbrowsingdataonexitlistdesc","displayName":"Clear Browsing Data on Exit (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_clicktocallenabled","displayName":"Enable the Click to Call Feature","description":"Enable the Click to Call feature which allows users to send phone numbers from Chrome Desktops to an Android device when the user is Signed-in. For more information, see help center article: https://support.google.com/chrome/answer/9430554?hl=en.\r\n\r\nIf this policy is set to enabled, the capability of sending phone numbers to Android devices will be enabled for the Chrome user.\r\n\r\nIf this policy is set to disabled, the capability of sending phone numbers to Android devices will be disabled for the Chrome user.\r\n\r\nIf you set this policy, users cannot change or override it.\r\n\r\nIf this policy is left unset, the Click to Call feature is enabled by default.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_clicktocallenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_clicktocallenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_cloudmanagementenrollmentmandatory","displayName":"Enable mandatory cloud management enrollment","description":"Setting the policy to Enabled mandates Chrome Browser Cloud Management enrollment and blocks Google Chrome launch process if failed.\r\n\r\nSetting the policy to Disabled or leaving it unset renders Chrome Browser Cloud Management optional and doesn't block Google Chrome launch process if failed.\r\n\r\nMachine scope cloud policy enrollment on desktop uses this policy. See https://support.google.com/chrome/a/answer/9301891?ref_topic=9301744 for details.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_cloudmanagementenrollmentmandatory_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_cloudmanagementenrollmentmandatory_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_cloudmanagementenrollmenttoken","displayName":"The enrollment token of cloud policy on desktop","description":"Setting the policy means Google Chrome tries to register itself with Chrome Browser Cloud Management. The value of this policy is an enrollment token you can retrieve from the Google Admin console.\r\n\r\nSee https://support.google.com/chrome/a/answer/9301891?ref_topic=9301744 for details.\r\n\r\nExample value: 37185d02-e055-11e7-80c1-9a214cf093ae","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_cloudmanagementenrollmenttoken_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_cloudmanagementenrollmenttoken_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_cloudmanagementenrollmenttoken_cloudmanagementenrollmenttoken","displayName":"The enrollment token of cloud policy on desktop (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_cloudpolicyoverridesplatformpolicy","displayName":"Google Chrome cloud policy overrides Platform policy.","description":"Setting the policy to Enabled means cloud policy takes precedence if it conflicts with platform policy.\r\n\r\nSetting the policy to Disabled or leaving it unset means platform policy takes precedence if it conflicts with cloud policy.\r\n\r\nThis mandatory policy affects machine scope cloud policies.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_cloudpolicyoverridesplatformpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_cloudpolicyoverridesplatformpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_clouduserpolicymerge","displayName":"Enables merging of user cloud policies into machine-level policies","description":"Setting the policy to Enabled allows policies associated with a Google Workspace account to be merged into machine-level policies.\r\n\r\nOnly policies originating from secure users can be merged. A secure user is affiliated with the organization that manages their browser using Chrome Browser Cloud Management. All other user-level policies will always be ignored.\r\n\r\nPolicies that need to be merged also need to be set in either PolicyListMultipleSourceMergeList or PolicyDictionaryMultipleSourceMergeList. This policy will be ignored if neither of the two aforementioned policies is configured.\r\n\r\nLeaving the policy unset or setting it to Disabled prevents user-level cloud policies from being merged with policies from any other sources.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_clouduserpolicymerge_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_clouduserpolicymerge_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_clouduserpolicyoverridescloudmachinepolicy","displayName":"Allow user cloud policies to override Chrome Browser Cloud Management policies.","description":"Setting the policy to Enabled allows policies associated with a Google Workspace account to take precedence if they conflict with Chrome Browser Cloud Management policies.\r\n\r\nOnly policies originating from secure users can be merged. A secure user is affiliated with the organization that manages their browser using Chrome Browser Cloud Management. All other user-level policies will have default precedence.\r\n\r\nThe policy can be combined with CloudPolicyOverridesPlatformPolicy. If both policies are enabled, user cloud policies will also take precedence over conflicting platform policies.\r\n\r\nLeaving the policy unset or setting it to disabled causes user-level cloud policies to have default priority.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_clouduserpolicyoverridescloudmachinepolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_clouduserpolicyoverridescloudmachinepolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_commandlineflagsecuritywarningsenabled","displayName":"Enable security warnings for command-line flags","description":"Setting the policy to Enabled or leaving it unset means security warnings appear when potentially dangerous command-line flags are used to launch Chrome.\r\n\r\nSetting the policy to Disabled prevents security warnings from appearing when Chrome is launched with potentially dangerous command-line flags.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_commandlineflagsecuritywarningsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_commandlineflagsecuritywarningsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_componentupdatesenabled","displayName":"Enable component updates in Google Chrome","description":"Enables component updates for all components in Google Chrome when not set or set to enabled.\r\n\r\nIf set to disabled, updates to components are disabled. However, some components are exempt from this policy: updates to any component that does not contain executable code, or does not significantly alter the behavior of the browser, or is critical for its security will not be disabled.\r\nExamples of such components include the certificate revocation lists and Safe Browsing data.\r\nSee https://developers.google.com/safe-browsing for more info on Safe Browsing.\r\nPlease note that setting this policy to disabled can potentially prevent the Google Chrome developers from providing critical security fixes in a timely manner and is thus not recommended.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_componentupdatesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_componentupdatesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_corsnonwildcardrequestheaderssupport","displayName":"CORS non-wildcard request headers support","description":"Configures support of CORS non-wildcard request headers.\r\n\r\nGoogle Chrome version 97 introduces support for CORS non-wildcard request headers. When scripts make a cross-origin network request via fetch() and XMLHttpRequest with a script-added Authorization header, the header must be explicitly allowed by the Access-Control-Allow-Headers header in the CORS preflight response. \"Explicitly\" here means that the wild card symbol \"*\" doesn't cover the Authorization header. See https://www.chromest atus.com/feature/5768642492891136 for more detail.\r\n\r\nIf this policy is not set, or set to True, Google Chrome will support the CORS non-wildcard request headers and behave as described above.\r\n\r\nWhen this policy is set to False, chrome will allow the wildcard symbol (\"*\") in the Access-Control-Allow-Headers header in the CORS preflight response to cover the Authorization header.\r\n\r\nThis Enterprise policy is temporary; it's intended to be removed after Google Chrome version 103.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_corsnonwildcardrequestheaderssupport_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_corsnonwildcardrequestheaderssupport_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_crossoriginwebassemblymodulesharingenabled","displayName":"Specifies whether WebAssembly modules can be sent cross-origin","description":"\r\nSpecifies whether WebAssembly modules can be sent to another window or worker cross-origin. Cross-origin WebAssembly module sharing will be deprecated as part of the efforts to deprecate document.domain, see https://github.com/mikewest/deprecating-document-domain. This policy allows to re-enable cross-origin WebAssembly module sharing to offer a longer transition period in the deprecation process.\r\n\r\nWhen set to True, sites can send WebAssembly modules also cross-origin without restrictions.\r\n\r\nWhen set to False or not set, sites can only send WebAssembly modules to windows and workers in the same origin.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_crossoriginwebassemblymodulesharingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_crossoriginwebassemblymodulesharingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_defaultbrowsersettingenabled","displayName":"Set Google Chrome as Default Browser","description":"Setting the policy to True has Google Chrome always check whether it's the default browser on startup and, if possible, automatically register itself. Setting the policy to False stops Google Chrome from ever checking if it's the default and turns user controls off for this option.\r\n\r\nLeaving the policy unset means Google Chrome lets users control whether it's the default and, if not, whether user notifications should appear.\r\n\r\nNote: For Microsoft®Windows® administrators, turning this setting on only works for machines running Windows 7. For later versions, you must deploy a \"default application associations\" file that makes Google Chrome the handler for the https and http protocols (and, optionally, the ftp protocol and other file formats). See Chrome Help ( https://support.google.com/chrome?p=make_chrome_default_win ).","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_defaultbrowsersettingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_defaultbrowsersettingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_defaultsearchprovidercontextmenuaccessallowed","displayName":"Allow default search provider context menu search access","description":"Enables the use of a default search provider on the context menu.\r\n\r\nIf you set this policy to disabled the search context menu item that relies on your default search provider will not be available.\r\n\r\nIf this policy is set to enabled or not set, the context menu item for your default search provider will be available.\r\n\r\nThe policy value is only appled when the DefaultSearchProviderEnabled policy is enabled, and is not applicable otherwise.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_defaultsearchprovidercontextmenuaccessallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_defaultsearchprovidercontextmenuaccessallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_desktopsharinghubenabled","displayName":"Enable desktop sharing in the omnibox and 3-dot menu","description":"Setting the policy to True or leaving it unset lets users share or save the current webpage using actions provided by the desktop sharing hub. The sharing hub is accessed through either an omnibox icon or the 3-dot menu.\r\n\r\nSetting the policy to False removes the sharing icon from the omnibox and the entry from the 3-dot menu.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_desktopsharinghubenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_desktopsharinghubenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_developertoolsavailability","displayName":"Control where Developer Tools can be used","description":"Setting the policy to 0 (the default) means you can access the developer tools and the JavaScript console, but not in the context of extensions installed by enterprise policy. Setting the policy to 1 means you can access the developer tools and the JavaScript console in all contexts, including that of extensions installed by enterprise policy. Setting the policy to 2 means you can't acess developer tools, and you can't inspect website elements.\r\n\r\nThis setting also turns off keyboard shortcuts and menu or context menu entries to open developer tools or the JavaScript console.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_developertoolsavailability_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_developertoolsavailability_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_developertoolsavailability_developertoolsavailability","displayName":"Control where Developer Tools can be used (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_developertoolsavailability_developertoolsavailability_0","displayName":"Disallow usage of the Developer Tools on extensions installed by enterprise policy, allow usage of the Developer Tools in other contexts","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_developertoolsavailability_developertoolsavailability_1","displayName":"Allow usage of the Developer Tools","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_developertoolsavailability_developertoolsavailability_2","displayName":"Disallow usage of the Developer Tools","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_disable3dapis","displayName":"Disable support for 3D graphics APIs","description":"Setting the policy to True (or setting HardwareAccelerationModeEnabled to False) prevents webpages from accessing the WebGL API, and plugins can't use the Pepper 3D API.\r\n\r\nSetting the policy to False or leaving it unset lets webpages use the WebGL API and plugins use the Pepper 3D API, but the browser's default settings might still require command line arguments to use these APIs.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_disable3dapis_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_disable3dapis_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_disablesafebrowsingproceedanyway","displayName":"Disable proceeding from the Safe Browsing warning page","description":"Setting the policy to Enabled prevents users from proceeding past the warning page the Safe Browsing service shows to the malicious site. This policy only prevents users from proceeding on Safe Browsing warnings such as malware and phishing, not for SSL certificate-related issues such as invalid or expired certificates.\r\n\r\nSetting the policy to Disabled or leaving it unset means users can choose to proceed to the flagged site after the warning appears.\r\n\r\nSee more about Safe Browsing ( https://developers.google.com/safe-browsing ).","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_disablesafebrowsingproceedanyway_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_disablesafebrowsingproceedanyway_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_disablescreenshots","displayName":"Disable taking screenshots","description":"Setting the policy to True disallows screenshots taken with keyboard shortcuts or extension APIs. Setting the policy to False allows screenshots.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_disablescreenshots_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_disablescreenshots_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_diskcachedir","displayName":"Set disk cache directory","description":"Setting the policy has Google Chrome use the directory you provide for storing cached files on the disk—whether or not users specify the --disk-cache-dir flag.\r\n\r\nIf not set, Google Chrome uses the default cache directory, but users can change that setting with the --disk-cache-dir command line flag.\r\n\r\nGoogle Chrome manages the contents of a volume's root directory. So to avoid data loss or other errors, do not set this policy to the root directory or any directory used for other purposes. See the variables you can use ( https://www.chromium.org/administrators/policy-list-3/user-data-directory-variables ).\r\n\r\nExample value: ${user_home}/Chrome_cache","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_diskcachedir_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_diskcachedir_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_diskcachedir_diskcachedir","displayName":"Set disk cache directory (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_diskcachesize","displayName":"Set disk cache size in bytes","description":"Setting the policy to None has Google Chrome use the default cache size for storing cached files on the disk. Users can't change it.\r\n\r\nIf you set the policy, Google Chrome uses the cache size you provide—whether or not users specify the --disk-cache-size flag. (Values below a few megabytes are rounded up.)\r\n\r\nIf not set, Google Chrome uses the default size. Users can change that setting using the --disk-cache-size flag.\r\n\r\nNote: The value specified in this policy is used as a hint to various cache subsystems in the browser. Therefore the actual total disk consumption of all caches will be higher but within the same order of magnitude as the value specified.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_diskcachesize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_diskcachesize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_diskcachesize_diskcachesize","displayName":"Set disk cache size: (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_displaycapturepermissionspolicyenabled","displayName":"Specifies whether the display-capture permissions-policy is checked or skipped.","description":"\r\nThe display-capture permissions-policy gates access to getDisplayMedia(), as per this spec: https://www.w3.org/TR/screen-capture/#feature-policy-integration. However, if this policy is Disabled, this requirement is not enforced, and getDisplayMedia() is allowed from contexts that would otherwise be forbidden. This Enterprise policy is temporary; it's intended to be removed after Google Chrome version 100. It is intended to unblock Enterprise users whose application is non-spec compliant, but needs time to be fixed.\r\n\r\nWhen enabled or not set, sites can only call getDisplayMedia() from contexts which are allowlisted by the display-capture permissions-policy.\r\n\r\nWhen disabled, sites can call getDisplayMedia() even from contexts which are not allowlisted by the display-capture permissions policy. Note that other restrictions may still apply.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_displaycapturepermissionspolicyenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_displaycapturepermissionspolicyenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_dnsinterceptionchecksenabled","displayName":"DNS interception checks enabled","description":"This policy configures a local switch that can be used to disable DNS interception checks. The checks attempt to discover whether the browser is behind a proxy that redirects unknown host names.\r\n\r\nThis detection may not be necessary in an enterprise environment where the network configuration is known, since it causes some amount of DNS and HTTP traffic on start-up and each DNS configuration change.\r\n\r\nWhen this policy is not set, or is enabled, the DNS interception checks are performed. When explicitly disabled, they're not.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_dnsinterceptionchecksenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_dnsinterceptionchecksenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_dnsoverhttpsmode","displayName":"Controls the mode of DNS-over-HTTPS","description":"Controls the mode of the DNS-over-HTTPS resolver. Please note that this policy will only set the default mode for each query. The mode may be overridden for special types of queries such as requests to resolve a DNS-over-HTTPS server hostname.\r\n\r\nThe \"off\" mode will disable DNS-over-HTTPS.\r\n\r\nThe \"automatic\" mode will send DNS-over-HTTPS queries first if a DNS-over-HTTPS server is available and may fallback to sending insecure queries on error.\r\n\r\nThe \"secure\" mode will only send DNS-over-HTTPS queries and will fail to resolve on error.\r\n\r\nOn Android Pie and above, if DNS-over-TLS is active, Google Chrome will not send insecure DNS requests.\r\n\r\nIf this policy is unset the browser may send DNS-over-HTTPS requests to a resolver associated with the user's configured system resolver.\r\n\r\nExample value: off","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_dnsoverhttpsmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_dnsoverhttpsmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_dnsoverhttpsmode_dnsoverhttpsmode","displayName":"Controls the mode of DNS-over-HTTPS (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_dnsoverhttpsmode_dnsoverhttpsmode_off","displayName":"Disable DNS-over-HTTPS","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_dnsoverhttpsmode_dnsoverhttpsmode_automatic","displayName":"Enable DNS-over-HTTPS with insecure fallback","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_dnsoverhttpsmode_dnsoverhttpsmode_secure","displayName":"Enable DNS-over-HTTPS without insecure fallback","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_dnsoverhttpstemplates","displayName":"Specify URI template of desired DNS-over-HTTPS resolver","description":"The URI template of the desired DNS-over-HTTPS resolver. To specify multiple DNS-over-HTTPS resolvers, separate the corresponding URI templates with spaces.\r\n\r\nIf the DnsOverHttpsMode is set to \"secure\" then this policy must be set and not empty.\r\n\r\nIf the DnsOverHttpsMode is set to \"automatic\" and this policy is set then the URI templates specified will be used; if this policy is unset then hardcoded mappings will be used to attempt to upgrade the user's current DNS resolver to a DoH resolver operated by the same provider.\r\n\r\nIf the URI template contains a dns variable, requests to the resolver will use GET; otherwise requests will use POST.\r\n\r\nIncorrectly formatted templates will be ignored.\r\n\r\nExample value: https://dns.example.net/dns-query{?dns}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_dnsoverhttpstemplates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_dnsoverhttpstemplates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_dnsoverhttpstemplates_dnsoverhttpstemplates","displayName":"Specify URI template of desired DNS-over-HTTPS resolver (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_downloaddirectory","displayName":"Set download directory","description":"Setting the policy sets up the directory Chrome uses for downloading files. It uses the provided directory, whether or not users specify one or turned on the flag to be prompted for download location every time.\r\n\r\nLeaving the policy unset means Chrome uses the default download directory, and users can change it.\r\n\r\nNote: See a list of variables you can use ( https://www.chromium.org/administrators/policy-list-3/user-data-directory-variables ).\r\n\r\nExample value: /home/${user_name}/Downloads","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_downloaddirectory_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_downloaddirectory_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_downloaddirectory_downloaddirectory","displayName":"Set download directory (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_downloadrestrictions","displayName":"Allow download restrictions","description":"Setting the policy means users can't bypass download security decisions.\r\n\r\nThere are many types of download warnings within Chrome, which roughly break down into these categories (learn more about Safe Browsing verdicts https://support.google.com/chrome/?p=ib_download_blocked):\r\n\r\n* Malicious, as flagged by the Safe Browsing server\r\n* Uncommon or unwanted, as flagged by the Safe Browsing server\r\n* A dangerous file type (e.g. all SWF downloads and many EXE downloads)\r\n\r\nSetting the policy blocks different subsets of these, depending on it's value:\r\n\r\n0: No special restrictions. Default.\r\n\r\n1: Blocks malicious files flagged by the Safe Browsing server AND Blocks all dangerous file types. Only recommended for OUs/browsers/users that have a high tolerance for False Positives.\r\n\r\n2: Blocks malicious files flagged by the Safe Browsing server AND Blocks uncommon or unwanted files flagged by the Safe Browsing server AND Blocks all dangerous file types. Only recommended for OUs/browsers/users that have a high tolerance for False Positives.\r\n\r\n3: Blocks all downloads. Not recommended, except for special use cases.\r\n\r\n4: Blocks malicious files flagged by the Safe Browsing server, does not block dangerous file types. Recommended.\r\n\r\nNote: These restrictions apply to downloads triggered from webpage content, as well as the Download link... menu option. They don't apply to the download of the currently displayed page or to saving as PDF from the printing options. Read more about Safe Browsing ( https://developers.google.com/safe-browsing ).","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_downloadrestrictions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_downloadrestrictions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_downloadrestrictions_downloadrestrictions","displayName":"Download restrictions (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_downloadrestrictions_downloadrestrictions_0","displayName":"No special restrictions. Default.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_downloadrestrictions_downloadrestrictions_1","displayName":"Block malicious downloads and dangerous file types.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_downloadrestrictions_downloadrestrictions_2","displayName":"Block malicious downloads, uncommon or unwanted downloads and dangerous file types.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_downloadrestrictions_downloadrestrictions_3","displayName":"Block all downloads.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_downloadrestrictions_downloadrestrictions_4","displayName":"Block malicious downloads. Recommended.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_editbookmarksenabled","displayName":"Enable or disable bookmark editing","description":"Setting the policy to True or leaving it unset lets users add, remove, or modify bookmarks.\r\n\r\nSetting the policy to False means users can't add, remove, or modify bookmarks. They can still use existing bookmarks.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_editbookmarksenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_editbookmarksenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_enableexperimentalpolicies","displayName":"Enables experimental policies","description":"Allows Google Chrome to load experimental policies.\r\n\r\nWARNING: Experimental policies are unsupported and subject to change or be removed without notice in future version of the browser!\r\n\r\nAn experimental policy may not be finished or still have known or unknown defects. It may be changed or even removed without any notification. By enabling experimental policies, you could lose browser data or compromise your security or privacy.\r\n\r\nIf a policy is not in the list and it's not officially released, its value will be ignored on Beta and Stable channel.\r\n\r\nIf a policy is in the list and it's not officially released, its value will be applied.\r\n\r\nThis policy has no effect on already released policies.\r\n\r\nExample value:\r\n\r\nExtensionInstallAllowlist\r\nExtensionInstallBlocklist","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_enableexperimentalpolicies_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_enableexperimentalpolicies_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_enableexperimentalpolicies_enableexperimentalpoliciesdesc","displayName":"Enables experimental policies (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_enableonlinerevocationchecks","displayName":"Enable online OCSP/CRL checks","description":"Setting the policy to True means online OCSP/CRL checks are performed.\r\n\r\nSetting the policy to False or leaving it unset means Google Chrome won't perform online revocation checks in Google Chrome 19 and later.\r\n\r\nNote: OCSP/CRL checks provide no effective security benefit.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_enableonlinerevocationchecks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_enableonlinerevocationchecks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_enterprisehardwareplatformapienabled","displayName":"Enables managed extensions to use the Enterprise Hardware Platform API","description":"Setting the policy to True lets extensions installed by enterprise policy use the Enterprise Hardware Platform API.\r\n\r\nSetting the policy to False or leaving it unset prevents extensions from using this API.\r\n\r\nNote: This policy also applies to component extensions, such as the Hangout Services extension.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_enterprisehardwareplatformapienabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_enterprisehardwareplatformapienabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_explicitlyallowednetworkports","displayName":"Explicitly allowed network ports","description":"There is a list of restricted ports built into Google Chrome. Connections to these ports will fail. This setting permits bypassing that list. The value is a comma-separated list of zero or more ports that outgoing connections will be permitted on.\r\n\r\nPorts are restricted to prevent Google Chrome being used as a vector to exploit various network vulnerabilities. Setting this policy may expose your network to attacks. This policy is intended as a temporary workaround for errors with code \"ERR_UNSAFE_PORT\" while migrating a service running on a blocked port to a standard port (ie. port 80 or 443).\r\n\r\nMalicious websites can easily detect that this policy is set, and for what ports, and use that information to target attacks.\r\n\r\nEach port here is labelled with a date that it can be unblocked until. After that date the port will be restricted regardless of this setting.\r\n\r\nLeaving the value empty or unset means that all restricted ports will be blocked. If there is a mixture of valid and invalid values, the valid ones will be applied.\r\n\r\nThis policy overrides the \"--explicitly-allowed-ports\" command-line option.\r\n\r\nExample value:\r\n\r\n10080","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_explicitlyallowednetworkports_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_explicitlyallowednetworkports_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_explicitlyallowednetworkports_explicitlyallowednetworkportsdesc","displayName":"Explicitly allowed network ports (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_externalprotocoldialogshowalwaysopencheckbox","displayName":"Show an \"Always open\" checkbox in external protocol dialog.","description":"This policy controls whether or not the \"Always open\" checkbox is shown on external protocol launch confirmation prompts.\r\n\r\n If this policy is set to True or not set, when an external protocol confirmation is shown, the user can select \"Always allow\" to skip all future confirmation prompts for the protocol on this site.\r\n\r\n If this policy is set to False, the \"Always allow\" checkbox is not displayed and the user will be prompted each time an external protocol is invoked.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_externalprotocoldialogshowalwaysopencheckbox_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_externalprotocoldialogshowalwaysopencheckbox_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_fetchkeepalivedurationsecondsonshutdown","displayName":"Fetch keepalive duration on Shutdown","description":"Controls the duration (in seconds) allowed for keepalive requests on browser shutdown.\r\n\r\nWhen specified, browser shutdown can be blocked up to the specified seconds,\r\nto process keepalive (https://fetch.spec.whatwg.org/#request-keepalive-flag) requests.\r\n\r\nThe default value (0) means this feature is disabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_fetchkeepalivedurationsecondsonshutdown_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_fetchkeepalivedurationsecondsonshutdown_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_fetchkeepalivedurationsecondsonshutdown_fetchkeepalivedurationsecondsonshutdown","displayName":"Fetch keepalive duration on Shutdown: (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_forcedlanguages","displayName":"Configure the content and order of preferred languages","description":"This policy allows admins to configure the order of the preferred languages in Google Chrome's settings.\r\n\r\nThe order of the list will appear in the same order under the \"Order languages based on your preference\" section in chrome://settings/languages. Users won't be able to remove or reorder languages set by the policy, but will be able to add languages underneath those set by the policy. Users will also have full control over the browser's UI language and translation/spell check settings, unless enforced by other policies.\r\n\r\nLeaving the policy unset lets users manipulate the entire list of preferred languages.\r\n\r\nExample value:\r\n\r\nen-US","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_forcedlanguages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_forcedlanguages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_forcedlanguages_forcedlanguagesdesc","displayName":"Configure the content and order of preferred languages (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_forceephemeralprofiles","displayName":"Ephemeral profile","description":"If set to enabled this policy forces the profile to be switched to ephemeral mode. If this policy is specified as an OS policy (e.g. GPO on Windows) it will apply to every profile on the system; if the policy is set as a Cloud policy it will apply only to a profile signed in with a managed account.\r\n\r\nIn this mode the profile data is persisted on disk only for the length of the user session. Features like browser history, extensions and their data, web data like cookies and web databases are not preserved after the browser is closed. However this does not prevent the user from downloading any data to disk manually, save pages or print them.\r\n\r\nIf the user has enabled sync all this data is preserved in their sync profile just like with regular profiles. Incognito mode is also available if not explicitly disabled by policy.\r\n\r\nIf the policy is set to disabled or left not set signing in leads to regular profiles.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_forceephemeralprofiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_forceephemeralprofiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_forcegooglesafesearch","displayName":"Force Google SafeSearch","description":"Setting the policy to Enabled means SafeSearch in Google Search is always active, and users can't change this setting.\r\n\r\nSetting the policy to Disabled or leaving it unset means SafeSearch in Google Search is not enforced.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_forcegooglesafesearch_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_forcegooglesafesearch_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_forceyoutuberestrict","displayName":"Force minimum YouTube Restricted Mode","description":"Setting the policy enforces a minimum Restricted mode on YouTube and prevents users from picking a less restricted mode. If you set it to:\r\n\r\n* Strict, Strict Restricted mode on YouTube is always active.\r\n\r\n* Moderate, the user may only pick Moderate Restricted mode and Strict Restricted mode on YouTube, but can't turn off Restricted mode.\r\n\r\n* Off or if no value is set, Restricted mode on YouTube isn't enforced by Chrome. External policies such as YouTube policies might still enforce Restricted mode.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_forceyoutuberestrict_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_forceyoutuberestrict_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_forceyoutuberestrict_forceyoutuberestrict","displayName":"Force minimum YouTube Restricted Mode (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_forceyoutuberestrict_forceyoutuberestrict_0","displayName":"Do not enforce Restricted Mode on YouTube","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_forceyoutuberestrict_forceyoutuberestrict_1","displayName":"Enforce at least Moderate Restricted Mode on YouTube","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_forceyoutuberestrict_forceyoutuberestrict_2","displayName":"Enforce Strict Restricted Mode for YouTube","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_fullscreenallowed","displayName":"Allow fullscreen mode","description":"Setting the policy to True or leaving it unset means that, with appropriate permissions, users, apps, and extensions can enter Fullscreen mode (in which only web content appears).\r\n\r\nSetting the policy to False means users, apps, and extensions can't enter Fullscreen mode.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_fullscreenallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_fullscreenallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_globallyscopehttpauthcacheenabled","displayName":"Enable globally scoped HTTP auth cache","description":"This policy configures a single global per profile cache with HTTP server authentication credentials.\r\n\r\nIf this policy is unset or disabled, the browser will use the default behavior of cross-site auth, which as of version 80, will be to scope HTTP server authentication credentials by top-level site, so if two sites use resources from the same authenticating domain, credentials will need to be provided independently in the context of both sites. Cached proxy credentials will be reused across sites.\r\n\r\nIf the policy is enabled, HTTP auth credentials entered in the context of one site will automatically be used in the context of another.\r\n\r\nEnabling this policy leaves sites open to some types of cross-site attacks, and allows users to be tracked across sites even without cookies by adding entries to the HTTP auth cache using credentials embedded in URLs.\r\n\r\nThis policy is intended to give enterprises depending on the legacy behavior a chance to update their login procedures, and will be removed in the future.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_globallyscopehttpauthcacheenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_globallyscopehttpauthcacheenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_hardwareaccelerationmodeenabled","displayName":"Use hardware acceleration when available","description":"Setting the policy to Enabled or leaving it unset turns on hardware acceleration, if available.\r\n\r\nSetting the policy to Disabled turns off hardware acceleration.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_hardwareaccelerationmodeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_hardwareaccelerationmodeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_headlessmode","displayName":"Control use of the Headless Mode","description":"Setting this policy to Enabled or leaving the policy unset allows use of the headless mode. Setting this policy to Disabled denies use of the headless mode.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_headlessmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_headlessmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_headlessmode_headlessmode","displayName":"Control use of the Headless Mode (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_headlessmode_headlessmode_1","displayName":"Allow use of the Headless Mode","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_headlessmode_headlessmode_2","displayName":"Do not allow use of the Headless Mode","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_hidewebstoreicon","displayName":"Hide the web store from the New Tab Page and app launcher","description":"Hide the Chrome Web Store app and footer link from the New Tab Page and Google Chrome OS app launcher.\r\n\r\nWhen this policy is set to true, the icons are hidden.\r\n\r\nWhen this policy is set to false or is not configured, the icons are visible.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_hidewebstoreicon_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_hidewebstoreicon_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_historyclustersvisible","displayName":"Show history clusters on the Chrome history page","description":"This policy controls the visibility of history clusters on the Chrome history page.\r\n\r\nIf the policy is set to Enabled, history clusters will be visible at chrome://history/journeys.\r\n\r\nIf the policy is set to Disabled, history clusters will not be visible at chrome://history/journeys.\r\n\r\nIf the policy is left unset, history clusters will be visible at chrome://history/journeys by default and users can change the visibility of history clusters.\r\n","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_historyclustersvisible_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_historyclustersvisible_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_hstspolicybypasslist","displayName":"List of names that will bypass the HSTS policy check","description":"Setting the policy specifies a list of hostnames that bypass preloaded HSTS upgrades from http to https.\r\n\r\nOnly single-label hostnames are allowed in this policy, and this policy only applies to \"static\" HSTS-preloaded entries (for instance, \"app\", \"new\", \"search\", \"play\"). This policy does not prevent HSTS upgrades for servers that have \"dynamically\" requested HSTS upgrades using a Strict-Transport-Security response header.\r\n\r\nSupplied hostnames must be canonicalized: Any IDNs must be converted to their A-label format, and all ASCII letters must be lowercase. This policy only applies to the specific single-label hostnames specified, not to subdomains of those names.\r\n\r\nExample value:\r\n\r\nmeet","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_hstspolicybypasslist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_hstspolicybypasslist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_hstspolicybypasslist_hstspolicybypasslistdesc","displayName":"List of names that will bypass the HSTS policy check (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_httpsonlymode","displayName":"Allow HTTPS-Only Mode to be enabled","description":"This policy controls whether users can enable HTTPS-Only Mode in Settings. HTTPS-Only Mode upgrades all navigations to HTTPS.\r\nIf this setting is not set or set to allowed, users will be allowed to enable HTTPS-Only Mode.\r\nIf this setting is set to disallowed, users will not be allowed to enable HTTPS-Only Mode.\r\nForce enabling HTTPS-Only Mode is not currently supported.\r\n\r\nExample value: disallowed","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_httpsonlymode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_httpsonlymode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_httpsonlymode_httpsonlymode","displayName":"Allow HTTPS-Only Mode to be enabled (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_httpsonlymode_httpsonlymode_allowed","displayName":"Allow users to enable HTTPS-Only Mode","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_httpsonlymode_httpsonlymode_disallowed","displayName":"Do not allow users to enable HTTPS-Only Mode","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_httpsonlymode_httpsonlymode_force_enabled","displayName":"Force enable HTTPS-Only Mode (not supported yet)","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_importautofillformdata","displayName":"Import autofill form data from default browser on first run","description":"Setting the policy to Enabled imports autofill form data from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means no autofill form data is imported on first run.\r\n\r\nUsers can trigger an import dialog and the autofill form data checkbox will be checked or unchecked to match this policy's value.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_importautofillformdata_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_importautofillformdata_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_importbookmarks","displayName":"Import bookmarks from default browser on first run","description":"Setting the policy to Enabled imports bookmarks from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means no bookmarks are imported on first run.\r\n\r\nUsers can trigger an import dialog and the bookmarks checkbox will be checked or unchecked to match this policy's value.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_importbookmarks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_importbookmarks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_importhistory","displayName":"Import browsing history from default browser on first run","description":"Setting the policy to Enabled imports browsing history from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means no browsing history is imported on first run.\r\n\r\nUsers can trigger an import dialog and the browsing history checkbox will be checked or unchecked to match this policy's value.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_importhistory_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_importhistory_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_importhomepage","displayName":"Import of homepage from default browser on first run","description":"Setting the policy to Enabled imports the homepage from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means the homepage isn't imported on first run.\r\n\r\nUsers can trigger an import dialog and the homepage checkbox will be checked or unchecked to match this policy's value.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_importhomepage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_importhomepage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_importsavedpasswords","displayName":"Import saved passwords from default browser on first run","description":"Setting the policy to Enabled imports saved passwords from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means no saved passwords are imported on first run.\r\n\r\nUsers can trigger an import dialog and the saved passwords checkbox will be checked or unchecked to match this policy's value.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_importsavedpasswords_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_importsavedpasswords_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_importsearchengine","displayName":"Import search engines from default browser on first run","description":"Setting the policy to Enabled imports the default search engine from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means the default search engine isn't imported on first run.\r\n\r\nUsers can trigger an import dialog and the default search engine checkbox will be checked or unchecked to match this policy's value.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_importsearchengine_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_importsearchengine_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_incognitomodeavailability","displayName":"Incognito mode availability","description":"Specifies whether the user may open pages in Incognito mode in Google Chrome.\r\n\r\nIf 'Enabled' is selected or the policy is left unset, pages may be opened in Incognito mode.\r\n\r\nIf 'Disabled' is selected, pages may not be opened in Incognito mode.\r\n\r\nIf 'Forced' is selected, pages may be opened ONLY in Incognito mode. Note that 'Forced' does not work for Android-on-Chrome\r\n\r\nNote: On iOS, if the policy is changed during a session, it will only take effect on relaunch.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_incognitomodeavailability_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_incognitomodeavailability_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_incognitomodeavailability_incognitomodeavailability","displayName":"Incognito mode availability (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_incognitomodeavailability_incognitomodeavailability_0","displayName":"Incognito mode available","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_incognitomodeavailability_incognitomodeavailability_1","displayName":"Incognito mode disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_incognitomodeavailability_incognitomodeavailability_2","displayName":"Incognito mode forced","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_insecureformswarningsenabled","displayName":"Enable warnings for insecure forms","description":"This policy controls the treatment for insecure forms (forms that submit over HTTP) embedded in secure (HTTPS) sites in the browser.\r\nIf the policy is enabled or unset, a full page warning will be shown when an insecure form is submitted. Additionally, a warning bubble will be shown next to the form fields when they are focused, and autofill will be disabled for those forms.\r\nIf the policy is disabled, warnings will not be shown for insecure forms, and autofill will work normally.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_insecureformswarningsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_insecureformswarningsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_insecureprivatenetworkrequestsallowed","displayName":"Specifies whether to allow insecure websites to make requests to more-private network endpoints","description":"Controls whether insecure websites are allowed to make requests to more-private network endpoints.\r\n\r\nThis policy relates to the Private Network Access specification. See https://wicg.github.io/private-network-access/ for more details.\r\n\r\nA network endpoint is more private than another if:\r\n1) Its IP address is localhost and the other is not.\r\n2) Its IP address is private and the other is public.\r\nIn the future, depending on spec evolution, this policy might apply to all cross-origin requests directed at private IPs or localhost.\r\n\r\nA website is deemed secure if it meets the definition of a secure context in https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts. Otherwise, it will be treated as an insecure context.\r\n\r\nWhen this policy is either not set or set to false, the default behavior for requests from insecure contexts to more-private network endpoints will depend on the user's personal configuration for the BlockInsecurePrivateNetworkRequests feature, which may be set by a field trial or on the command line.\r\n\r\nWhen this policy is set to true, insecure websites are allowed to make requests to any network endpoint, subject to other cross-origin checks.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_insecureprivatenetworkrequestsallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_insecureprivatenetworkrequestsallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_insecureprivatenetworkrequestsallowedforurls","displayName":"Allow the listed sites to make requests to more-private network endpoints from insecure contexts.","description":"List of URL patterns. Private network requests initiated from insecure websites served by matching origins are allowed.\r\n\r\nIf unset, this policy behaves as if set to the empty list.\r\n\r\nFor origins not covered by the patterns specified here, the global default value will be used either from the InsecurePrivateNetworkRequestsAllowed policy, if it is set, or the user's personal configuration otherwise.\r\n\r\nNote that this policy only affects insecure origins, so secure origins (e.g. https://example.com) included in this list will be ignored.\r\n\r\nFor detailed information on valid URL patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.\r\n\r\nExample value:\r\n\r\nhttp://www.example.com:8080\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_insecureprivatenetworkrequestsallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_insecureprivatenetworkrequestsallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_insecureprivatenetworkrequestsallowedforurls_insecureprivatenetworkrequestsallowedforurlsdesc","displayName":"Allow the listed sites to make requests to more-private network endpoints from insecure contexts. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_intensivewakeupthrottlingenabled","displayName":"Control the IntensiveWakeUpThrottling feature.","description":"When enabled the IntensiveWakeUpThrottling feature causes Javascript timers in background tabs to be aggressively throttled and coalesced, running no more than once per minute after a page has been backgrounded for 5 minutes or more.\r\n\r\nThis is a web standards compliant feature, but it may break functionality\r\non some websites by causing certain actions to be delayed by up to a\r\nminute. However, it results in significant CPU and battery savings when\r\nenabled. See https://bit.ly/30b1XR4 for more details.\r\n\r\nIf this policy is set to enabled then the feature will be force enabled, and\r\nusers will not be able to override this.\r\n\r\nIf this policy is set to disabled then the feature will be force disabled, and\r\nusers will not be able to override this.\r\n\r\nIf this policy is left unset then the feature will be controlled by its\r\nown internal logic, which can be manually configured by users.\r\n\r\nNote that the policy is applied per renderer process, with the most recent\r\nvalue of the policy setting in force when a renderer process starts. A full\r\nrestart is required to ensure that all loaded tabs receive a consistent\r\npolicy setting. It is harmless for processes to be running with different\r\nvalues of this policy.\r\n","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_intensivewakeupthrottlingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_intensivewakeupthrottlingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_intranetredirectbehavior","displayName":"Intranet Redirection Behavior","description":"This policy configures behavior for intranet redirection via DNS interception checks. The checks attempt to discover whether the browser is behind a proxy that redirects unknown host names.\r\n\r\nIf this policy is not set, the browser will use the default behavior of DNS interception checks and intranet redirect suggestions. In M88, they are enabled by default but will be disabled by default in the future release.\r\n\r\nDNSInterceptionChecksEnabled is a related policy that may also disable DNS interception checks; this policy is a more flexible version which may separately control intranet redirection infobars and may be expanded in the future.\r\nIf either DNSInterceptionChecksEnabled or this policy requests to disable interception checks, the checks will be disabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_intranetredirectbehavior_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_intranetredirectbehavior_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_intranetredirectbehavior_intranetredirectbehavior","displayName":"Intranet Redirection Behavior (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_intranetredirectbehavior_intranetredirectbehavior_0","displayName":"Use default browser behavior.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_intranetredirectbehavior_intranetredirectbehavior_1","displayName":"Disable DNS interception checks and did-you-mean \"http://intranetsite/\" infobars.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_intranetredirectbehavior_intranetredirectbehavior_2","displayName":"Disable DNS interception checks; allow did-you-mean \"http://intranetsite/\" infobars.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_intranetredirectbehavior_intranetredirectbehavior_3","displayName":"Allow DNS interception checks and did-you-mean \"http://intranetsite/\" infobars.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_isolateorigins","displayName":"Enable Site Isolation for specified origins","description":"Setting the policy means each of the named origins in a comma-separated list runs in a dedicated process. Each named origin's process will only be allowed to contain documents from that origin and its subdomains. For example, specifying https://a1.example.com/ allows https://a2.a1.example.com/ in the same process, but not https://example.com or https://b.example.com.\r\n\r\nSince Google Chrome 77, you can also specify a range of origins to isolate using a wildcard. For example, specifying https://[*.]corp.example.com will give every origin underneath https://corp.example.com its own dedicated process, including https://corp.example.com itself, https://a1.corp.example.com, and https://a2.a1.corp.example.com.\r\n\r\nNote that all sites (i.e., scheme plus eTLD+1, such as https://example.com) are already isolated by default on Desktop platforms, as noted in the SitePerProcess policy. This IsolateOrigins policy is useful to isolate specific origins at a finer granularity (e.g., https://a.example.com).\r\n\r\nAlso note that origins isolated by this policy will be unable to script other origins in the same site, which is otherwise possible if two same-site documents modify their document.domain values to match. Administrators should confirm this uncommon behavior is not used on an origin before isolating it.\r\n\r\nSetting the policy to off or leaving it unset lets users change this setting.\r\n\r\nNote: For Android, use the IsolateOriginsAndroid policy instead.\r\n\r\nExample value: https://a.example.com/,https://othersite.org/,https://[*.]corp.example.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_isolateorigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_isolateorigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_isolateorigins_isolateorigins","displayName":"Enable Site Isolation for specified origins (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_lensregionsearchenabled","displayName":"Allow Google Lens region search menu item to be shown in context menu if supported.","description":"Leaving the policy unset or setting it to Enabled allows users to view and use the Google Lens region search menu item in the context menu. Setting the policy to Disabled means users will not see the Google Lens region search menu item in the context menu when Google Lens region search is supported.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_lensregionsearchenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_lensregionsearchenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_lockiconinaddressbarenabled","displayName":"Enable lock icon in the omnibox for secure connections","description":"This policy controls the treatment for lock icon in the omnibox.\r\nFrom Chrome M93, there is a new omnibox icon for secure connections.\r\nIf the policy is Enabled, Chrome will use the existing lock icon for secure connections.\r\nIf the policy is Disabled or not set, Chrome will use the default icon for secure connections.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_lockiconinaddressbarenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_lockiconinaddressbarenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_lookalikewarningallowlistdomains","displayName":"Suppress lookalike domain warnings on domains","description":"This policy prevents the display of lookalike URL warnings on the sites listed. These warnings are typically shown on sites that Google Chrome believes might be trying to spoof another site the user is familiar with.\r\n\r\nIf the policy is enabled and set to one or more domains, no lookalike warnings pages will be shown when the user visits pages on that domain.\r\n\r\nIf the policy is not set, or set to an empty list, warnings may appear on any site the user visits.\r\n\r\nA hostname can be allowed with a complete host match, or any domain match. For example, a URL like \"https://foo.example.com/bar\" may have warnings suppressed if this list includes either \"foo.example.com\" or \"example.com\".\r\n\r\nExample value:\r\n\r\nfoo.example.com\r\nexample.org","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_lookalikewarningallowlistdomains_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_lookalikewarningallowlistdomains_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_lookalikewarningallowlistdomains_lookalikewarningallowlistdomainsdesc","displayName":"Suppress lookalike domain warnings on domains (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_managedaccountssigninrestriction","displayName":"Add restrictions on managed accounts","description":"\r\n This policy requires SigninInterceptionEnabled to be set to True to take effect.\r\n\r\n If this policy is set to 'primary_account' at the machine level, all managed accounts will be forced to be primary.\r\n If this policy is set to 'primary_account' on an account, that account will always be a primary account, but may have secondary accounts in its profile.\r\n\r\n If this policy is set to 'primary_account_strict' at the machine level, all managed accounts will be forced to be primary.\r\n If this policy is set to 'primary_account_strict' on an account, that account will always be a primary account and will not have any secondary accounts in its profile.\r\n\r\n If this policy is set to 'none' or not set, managed accounts have no restrictions. This may result in a managed account being a secondary account, which disables its ability to receive policies set on the account by the admin.\r\n\r\n\r\nExample value: primary_account","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_managedaccountssigninrestriction_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_managedaccountssigninrestriction_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_managedaccountssigninrestriction_managedaccountssigninrestriction","displayName":"Add restrictions on managed accounts (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_managedaccountssigninrestriction_managedaccountssigninrestriction_primary_account","displayName":"A Managed account must be a primary account","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_managedaccountssigninrestriction_managedaccountssigninrestriction_primary_account_strict","displayName":"A Managed account must be a primary account and have no secondary accounts","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_managedaccountssigninrestriction_managedaccountssigninrestriction_none","displayName":"No restrictions on managed accounts","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_managedbookmarks","displayName":"Managed Bookmarks","description":"Setting the policy sets up a list of bookmarks where each one is a dictionary with the keys \"name\" and \"url\". These keys hold the bookmark's name and target. Admins can set up a subfolder by defining a bookmark without a \"url\" key, but with an additional \"children\" key. This key also has a list of bookmarks, some of which can also be folders. Chrome amends incomplete URLs as if they were submitted through the address bar. For example, \"google.com\" becomes \"https://google.com/\".\r\n\r\nUsers can't change the folders the bookmarks are placed in (though they can hide it from the bookmark bar). The default folder name for managed bookmarks is \"Managed bookmarks\" but it can be changed by adding a new sub-dictionary to the policy with a single key named \"toplevel_name\" with the desired folder name as its value. Managed bookmarks are not synced to the user account and extensions can't modify them.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ManagedBookmarks for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"toplevel_name\": \"My managed bookmarks folder\"\r\n },\r\n {\r\n \"name\": \"Google\",\r\n \"url\": \"google.com\"\r\n },\r\n {\r\n \"name\": \"Youtube\",\r\n \"url\": \"youtube.com\"\r\n },\r\n {\r\n \"name\": \"Chrome links\",\r\n \"children\": [\r\n {\r\n \"name\": \"Chromium\",\r\n \"url\": \"chromium.org\"\r\n },\r\n {\r\n \"name\": \"Chromium Developers\",\r\n \"url\": \"dev.chromium.org\"\r\n }\r\n ]\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_managedbookmarks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_managedbookmarks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_managedbookmarks_managedbookmarks","displayName":"Managed Bookmarks (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_managedconfigurationperorigin","displayName":"Sets managed configuration values to websites to specific origins","description":"Setting the policy defines the return value of Managed Configuration API for given origin.\r\n\r\n Managed configuration API is a key-value configuration that can be accessed via navigator.managed.getManagedConfiguration() javascript call. This API is only available to origins which correspond to force-installed web applications via WebAppInstallForceList.\r\n\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ManagedConfigurationPerOrigin for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"origin\": \"https://www.google.com\",\r\n \"managed_configuration_url\": \"https://gstatic.google.com/configuration.json\",\r\n \"managed_configuration_hash\": \"asd891jedasd12ue9h\"\r\n },\r\n {\r\n \"origin\": \"https://www.example.com\",\r\n \"managed_configuration_url\": \"https://gstatic.google.com/configuration2.json\",\r\n \"managed_configuration_hash\": \"djio12easd89u12aws\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_managedconfigurationperorigin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_managedconfigurationperorigin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_managedconfigurationperorigin_managedconfigurationperorigin","displayName":"Sets managed configuration values to websites to specific origins (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_maxconnectionsperproxy","displayName":"Maximal number of concurrent connections to the proxy server","description":"Setting the policy specifies the maximal number of simultaneous connections to the proxy server. Some proxy servers can't handle a high number of concurrent connections per client, which is solved by setting this policy to a lower value. The value should be lower than 100 and higher than 6. Some web apps are known to consume many connections with hanging GETs, so setting a value below 32 may lead to browser networking hangs if there are too many web apps with hanging connections open. Lower below the default at your own risk.\r\n\r\nLeaving the policy unset means a default of 32 is used.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_maxconnectionsperproxy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_maxconnectionsperproxy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_maxconnectionsperproxy_maxconnectionsperproxy","displayName":"Maximal number of concurrent connections to the proxy server: (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_maxinvalidationfetchdelay","displayName":"Maximum fetch delay after a policy invalidation","description":"Setting the policy specifies the maximum delay in milliseconds between receiving a policy invalidation and fetching the new policy from the device management service. Valid values range from 1,000 (1 second) to 300,000 (5 minutes). Values outside this range will be clamped to the respective boundary.\r\n\r\nLeaving the policy unset means Google Chrome uses the default value of 10 seconds.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_maxinvalidationfetchdelay_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_maxinvalidationfetchdelay_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_maxinvalidationfetchdelay_maxinvalidationfetchdelay","displayName":"Maximum fetch delay after a policy invalidation: (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_mediarecommendationsenabled","displayName":"Enable Media Recommendations","description":"By default the browser will show media recommendations that are personalized to the user. Setting this policy to Disabled will result in these recommendations being hidden from the user. Setting this policy to Enabled or leaving it unset will result in the media recommendations being shown to the user.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_mediarecommendationsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_mediarecommendationsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_mediaroutercastallowallips","displayName":"Allow Google Cast to connect to Cast devices on all IP addresses.","description":"Unless EnableMediaRouter is set to Disabled, setting MediaRouterCastAllowAllIPs to Enabled connects Google Cast to Cast devices on all IP addresses, not just RFC1918/RFC4193 private addresses.\r\n\r\nSetting the policy to Disabled connects Google Cast to Cast devices only on RFC1918/RFC4193.\r\n\r\nLeaving the policy unset connects Google Cast to Cast devices only on RFC1918/RFC4193, unless the CastAllowAllIPs feature is turned on.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_mediaroutercastallowallips_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_mediaroutercastallowallips_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_metricsreportingenabled","displayName":"Enable reporting of usage and crash-related data","description":"When this policy is enabled, anonymous reporting of usage and crash-related data about Chrome to Google is enabled by default. Users will still be able to change this setting in the Chrome settings.\r\n\r\nWhen this policy is disabled, anonymous reporting is disabled and no usage or crash data is sent to Google. Users won't be able to change this setting.\r\n\r\nWhen this policy isn't set, users can choose the anonymous reporting behavior at installation or first run, and can later change the setting in the Chrome settings.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft® Active Directory® domain or Windows 10 Pro or Enterprise instances that are enrolled for device management, and macOS instances that are managed via MDM or joined to a domain via MCX.\r\n\r\n(For Chrome OS, see DeviceMetricsReportingEnabled.)","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_metricsreportingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_metricsreportingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_networkpredictionoptions","displayName":"Enable network prediction","description":"This policy controls network prediction in Google Chrome. It controls DNS prefetching, TCP, and SSL preconnection and prerendering of webpages.\r\n\r\nIf you set the policy, users can't change it. Leaving it unset turns on network prediction, but the user can change it.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_networkpredictionoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_networkpredictionoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_networkpredictionoptions_networkpredictionoptions","displayName":"Enable network prediction (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_networkpredictionoptions_networkpredictionoptions_0","displayName":"Predict network actions on any network connection","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_networkpredictionoptions_networkpredictionoptions_1","displayName":"Predict network actions on any network that is not cellular.\r\n(Deprecated in 50, removed in 52. After 52, if value 1 is set, it will be treated as 0 - predict network actions on any network connection.)","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_networkpredictionoptions_networkpredictionoptions_2","displayName":"Do not predict network actions on any network connection","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_networkservicesandboxenabled","displayName":"Enable the network service sandbox","description":"This policy controls whether or not the network service process runs sandboxed.\r\nIf this policy is enabled, the network service process will run sandboxed.\r\nIf this policy is disabled, the network service process will run unsandboxed. This leaves users open to additional security risks related to running the network service unsandboxed.\r\nIf this policy is not set, the default configuration for the network sandbox will be used. This may vary depending on Google Chrome release, currently running field trials, and platform.\r\nThis policy is intended to give enterprises flexibility to disable the network sandbox if they use third party software that interferes with the network service sandbox.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_networkservicesandboxenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_networkservicesandboxenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_ntpcardsvisible","displayName":"Show cards on the New Tab Page","description":"This policy controls the visibility of cards on the New Tab Page. Cards surface entry points to launch common user journeys based on the user's browsing behavior.\r\n\r\nIf the policy is set to Enabled, the New Tab Page will show cards if content is available.\r\n\r\nIf the policy is set to Disabled, the New Tab Page won't show cards.\r\n\r\nIf the policy is not set, the user can control the card visibility. The default is visible.\r\n","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_ntpcardsvisible_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_ntpcardsvisible_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_ntpcustombackgroundenabled","displayName":"Allow users to customize the background on the New Tab page","description":"If the policy is set to false, the New Tab page won't allow users to customize the background. Any existing custom background will be permanently removed even if the policy is set to true later.\r\n\r\nIf the policy is set to true or unset, users can customize the background on the New Tab page.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_ntpcustombackgroundenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_ntpcustombackgroundenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_overridesecurityrestrictionsoninsecureorigin","displayName":"Origins or hostname patterns for which restrictions on\r\ninsecure origins should not apply","description":"Setting the policy specifies a list of origins (URLs) or hostname patterns (such as *.example.com) for which security restrictions on insecure origins won't apply. Organizations can specify origins for legacy applications that can't deploy TLS or set up a staging server for internal web development, so developers can test out features requiring secure contexts without having to deploy TLS on the staging server. This policy also prevents the origin from being labeled \"Not Secure\" in the address bar.\r\n\r\nSetting a list of URLs in this policy amounts to setting the command-line flag --unsafely-treat-insecure-origin-as-secure to a comma-separated list of the same URLs. The policy overrides the command-line flag and UnsafelyTreatInsecureOriginAsSecure, if present.\r\n\r\nFor more information on secure contexts, see Secure Contexts ( https://www.w3.org/TR/secure-contexts ).\r\n\r\nExample value:\r\n\r\nhttp://testserver.example.com/\r\n*.example.org","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_overridesecurityrestrictionsoninsecureorigin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_overridesecurityrestrictionsoninsecureorigin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_overridesecurityrestrictionsoninsecureorigin_overridesecurityrestrictionsoninsecureorigindesc","displayName":"Origins or hostname patterns for which restrictions on\r\ninsecure origins should not apply (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_paymentmethodqueryenabled","displayName":"Allow websites to query for available payment methods.","description":"Allows you to set whether websites are allowed to check if the user has payment methods saved.\r\n\r\nIf this policy is set to disabled, websites that use PaymentRequest.canMakePayment or PaymentRequest.hasEnrolledInstrument API will be informed that no payment methods are available.\r\n\r\nIf the setting is enabled or not set then websites are allowed to check if the user has payment methods saved.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_paymentmethodqueryenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_paymentmethodqueryenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_policyatomicgroupsenabled","displayName":"Enables the concept of policy atomic groups","description":"Setting the policy to Enabled means policies coming from an atomic group that don't share the source with the highest priority from that group get ignored.\r\n\r\nSetting the policy to Disabled means no policy is ignored because of its source. Policies are ignored only if there's a conflict, and the policy doesn't have the highest priority.\r\n\r\nIf this policy is set from a cloud source, it can't target a specific user.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_policyatomicgroupsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_policyatomicgroupsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_policydictionarymultiplesourcemergelist","displayName":"Allow merging dictionary policies from different sources","description":"Setting the policy allows merging of selected policies when they come from different sources, with the same scopes and level. This merging is in the first level keys of the dictionary from each source. The key coming from the highest priority source takes precedence.\r\n\r\nIf a policy is in the list and there's conflict between sources with:\r\n\r\n* The same scopes and level: The values merge into a new policy dictionary.\r\n\r\n* Different scopes or level: The policy with the highest priority applies.\r\n\r\nIf a policy isn't in the list and there's conflict between sources, scopes, or level, the policy with the highest priority applies.\r\n\r\nExample value:\r\n\r\nExtensionSettings","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_policydictionarymultiplesourcemergelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_policydictionarymultiplesourcemergelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_policydictionarymultiplesourcemergelist_policydictionarymultiplesourcemergelistdesc","displayName":"Allow merging dictionary policies from different sources (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_policylistmultiplesourcemergelist","displayName":"Allow merging list policies from different sources","description":"Setting the policy allows merging of selected policies when they come from different sources, with the same scopes and level.\r\n\r\nIf a policy is in the list and there's conflict between sources with:\r\n\r\n* The same scopes and level: The values merge into a new policy list.\r\n\r\n* Different scopes or level: The policy with the highest priority applies.\r\n\r\nIf a policy isn't in the list and there's conflict between sources, scopes, or level, the policy with the highest priority applies.\r\n\r\nExample value:\r\n\r\nExtensionInstallAllowlist\r\nExtensionInstallBlocklist","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_policylistmultiplesourcemergelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_policylistmultiplesourcemergelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_policylistmultiplesourcemergelist_policylistmultiplesourcemergelistdesc","displayName":"Allow merging list policies from different sources (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_policyrefreshrate","displayName":"Refresh rate for user policy","description":"Setting the policy specifies the period in milliseconds at which the device management service is queried for user policy information. Valid values range from 1,800,000 (30 minutes) to 86,400,000 (1 day). Values outside this range will be clamped to the respective boundary.\r\n\r\nLeaving the policy unset uses the default value of 3 hours.\r\n\r\nNote: Policy notifications force a refresh when the policy changes, making frequent refreshes unnecessary. So, if the platform supports these notifications, the refresh delay is 24 hours (ignoring defaults and the value of this policy).","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_policyrefreshrate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_policyrefreshrate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_policyrefreshrate_policyrefreshrate","displayName":"Refresh rate for user policy: (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_profilepickeronstartupavailability","displayName":"Profile picker availability on startup","description":"Specifies whether the profile picker is enabled, disabled or forced at the browser startup.\r\n\r\nBy default the profile picker is not shown if the browser starts in guest or incognito mode, a profile directory and/or urls are specified by command line, an app is explicitly requested to open, the browser was launched by a native notification, there is only one profile available or the policy ForceBrowserSignin is set to true.\r\n\r\nIf 'Enabled' (0) is selected or the policy is left unset, the profile picker will be shown at startup by default, but users will be able to enable/disable it.\r\n\r\nIf 'Disabled' (1) is selected, the profile picker will never be shown, and users will not be able to change the setting.\r\n\r\nIf 'Forced' (2) is selected, the profile picker cannot be suppressed by the user. The profile picker will be shown even if there is only one profile available.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_profilepickeronstartupavailability_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_profilepickeronstartupavailability_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_profilepickeronstartupavailability_profilepickeronstartupavailability","displayName":"Profile picker availability on startup (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_profilepickeronstartupavailability_profilepickeronstartupavailability_0","displayName":"Profile picker available at startup","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_profilepickeronstartupavailability_profilepickeronstartupavailability_1","displayName":"Profile picker disabled at startup","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_profilepickeronstartupavailability_profilepickeronstartupavailability_2","displayName":"Profile picker forced at startup","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_promotionaltabsenabled","displayName":"Enable showing full-tab promotional content","description":"Setting the policy to True or leaving it unset lets Google Chrome show users product information as full-tab content.\r\n\r\nSetting the policy to False prevents Google Chrome from showing product information as full-tab content.\r\n\r\nSetting the policy controls the presentation of the welcome pages that help users sign in to Google Chrome, set Google Chrome as users' default browser, or otherwise inform them of product features.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_promotionaltabsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_promotionaltabsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_promptfordownloadlocation","displayName":"Ask where to save each file before downloading","description":"Setting the policy to Enabled means users are asked where to save each file before downloading. Setting the policy to Disabled has downloads start immediately, and users aren't asked where to save the file.\r\n\r\nLeaving the policy unset lets users change this setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_promptfordownloadlocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_promptfordownloadlocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_proxysettings","displayName":"Proxy settings","description":"Setting the policy configures the proxy settings for Chrome and ARC-apps, which ignore all proxy-related options specified from the command line.\r\n\r\n Leaving the policy unset lets users choose their proxy settings.\r\n\r\n Setting the ProxySettings policy accepts the following fields:\r\n * ProxyMode, which lets you specify the proxy server Chrome uses and prevents users from changing proxy settings\r\n * ProxyPacUrl, a URL to a proxy .pac file\r\n * ProxyPacMandatory, which prevents the network stack from falling back to direct connections with invalid or unavailable PAC script\r\n * ProxyServer, a URL of the proxy server\r\n * ProxyBypassList, a list of hosts for which the proxy will be bypassed\r\n\r\n The ProxyServerMode field is deprecated in favor of the ProxyMode field.\r\n\r\n For ProxyMode, if you choose the value:\r\n * direct, a proxy is never used and all other fields are ignored.\r\n * system, the systems's proxy is used and all other fields are ignored.\r\n * auto_detect, all other fields are ignored.\r\n * fixed_servers, the ProxyServer and ProxyBypassList fields are used.\r\n * pac_script, the ProxyPacUrl, ProxyPacMandatory and ProxyBypassList fields are used.\r\n\r\nNote: For more detailed examples, visit The Chromium Projects ( https://www.chromium.org/developers/design-documents/network-settings#TOC-Command-line-options-for-proxy-sett ).\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ProxySettings for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n{\r\n \"ProxyMode\": \"fixed_servers\",\r\n \"ProxyServer\": \"123.123.123.123:8080\",\r\n \"ProxyBypassList\": \"https://www.example1.com,https://www.example2.com,https://internalsite/\"\r\n}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_proxysettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_proxysettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_proxysettings_proxysettings","displayName":"Proxy settings (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_quicallowed","displayName":"Allow QUIC protocol","description":"Setting the policy to Enabled or leaving it unset allows the use of QUIC protocol in Google Chrome.\r\n\r\nSetting the policy to Disabled disallows the use of QUIC protocol.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_quicallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_quicallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_alternateerrorpagesenabled_recommended","displayName":"Enable alternate error pages","description":"Setting the policy to True means Google Chrome uses alternate error pages built into (such as \"page not found\"). Setting the policy to False means Google Chrome never uses alternate error pages.\r\n\r\nIf you set the policy, users can't change it. If not set, the policy is on, but users can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_alternateerrorpagesenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_alternateerrorpagesenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_alwaysopenpdfexternally_recommended","displayName":"Always Open PDF files externally","description":"Setting the policy to Enabled turns the internal PDF viewer off in Google Chrome, treats PDF files as a download, and lets users open PDFs with the default application.\r\n\r\nSetting the policy to Disabled means that unless users turns off the PDF plugin, it will open PDF files.\r\n\r\nIf you set the policy, users can't change it in Google Chrome. If not set, users can choose whether to open PDF externally or not.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_alwaysopenpdfexternally_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_alwaysopenpdfexternally_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_applicationlocalevalue_recommended","displayName":"Application locale","description":"Setting the policy specifies the locale Google Chrome uses.\r\n\r\nTurning it off or leaving it unset means the locale will be the first valid locale from:\r\n1) The user specified locale (if configured).\r\n2) The system locale.\r\n3) The fallback locale (en-US).\r\n\r\nExample value: en","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_applicationlocalevalue_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_applicationlocalevalue_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_applicationlocalevalue_recommended_applicationlocalevalue","displayName":"Application locale (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_autofilladdressenabled_recommended","displayName":"Enable AutoFill for addresses","description":"Setting the policy to True or leaving it unset gives users control of Autofill for addresses in the UI.\r\n\r\nSetting the policy to False means Autofill never suggests or fills address information, nor does it save additional address information that users submit while browsing the web.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_autofilladdressenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_autofilladdressenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_autofillcreditcardenabled_recommended","displayName":"Enable AutoFill for credit cards","description":"Setting the policy to True or leaving it unset means users can control autofill suggestions for credit cards in the UI.\r\n\r\nSetting the policy to False means autofill never suggests or fills credit card information, nor will it save additional credit card information that users might submit while browsing the web.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_autofillcreditcardenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_autofillcreditcardenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_backgroundmodeenabled_recommended","displayName":"Continue running background apps when Google Chrome is closed","description":"Setting the policy to Enabled turns background mode on. In background mode, a Google Chrome process is started on OS sign-in and keeps running when the last browser window is closed, allowing background apps and the browsing session to remain active. The background process displays an icon in the system tray and can always be closed from there.\r\n\r\nSetting the policy to Disabled turns background mode off.\r\n\r\nIf you set the policy, users can't change it in the browser settings. If unset, background mode is off at first, but users can change it.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_backgroundmodeenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_backgroundmodeenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_blockthirdpartycookies_recommended","displayName":"Block third party cookies","description":"Setting the policy to Enabled prevents webpage elements that aren't from the domain that's in the browser's address bar from setting cookies. Setting the policy to Disabled lets those elements set cookies and prevents users from changing this setting.\r\n\r\nLeaving it unset turns third-party cookies on, but users can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_blockthirdpartycookies_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_blockthirdpartycookies_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_bookmarkbarenabled_recommended","displayName":"Enable Bookmark Bar","description":"Setting the policy to True displays a bookmark bar in Google Chrome. Setting the policy to False means users never see the bookmark bar.\r\n\r\nIf you set the policy, users can't change it. If not set, users decide whether to use this function.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_bookmarkbarenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_bookmarkbarenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_defaultdownloaddirectory_recommended","displayName":"Set default download directory","description":"Setting the policy changes the default directory that Chrome downloads files to, but users can change the directory.\r\n\r\nLeaving the policy unset means Chrome uses its platform-specific default directory.\r\n\r\nNote: See a list of variables you can use ( https://www.chromium.org/administrators/policy-list-3/user-data-directory-variables ).\r\n\r\nExample value: /home/${user_name}/Downloads","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_defaultdownloaddirectory_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_defaultdownloaddirectory_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_defaultdownloaddirectory_recommended_defaultdownloaddirectory","displayName":"Set default download directory (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_defaultsearchprovidercontextmenuaccessallowed_recommended","displayName":"Allow default search provider context menu search access","description":"Enables the use of a default search provider on the context menu.\r\n\r\nIf you set this policy to disabled the search context menu item that relies on your default search provider will not be available.\r\n\r\nIf this policy is set to enabled or not set, the context menu item for your default search provider will be available.\r\n\r\nThe policy value is only appled when the DefaultSearchProviderEnabled policy is enabled, and is not applicable otherwise.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_defaultsearchprovidercontextmenuaccessallowed_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_defaultsearchprovidercontextmenuaccessallowed_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_downloaddirectory_recommended","displayName":"Set download directory","description":"Setting the policy sets up the directory Chrome uses for downloading files. It uses the provided directory, whether or not users specify one or turned on the flag to be prompted for download location every time.\r\n\r\nLeaving the policy unset means Chrome uses the default download directory, and users can change it.\r\n\r\nNote: See a list of variables you can use ( https://www.chromium.org/administrators/policy-list-3/user-data-directory-variables ).\r\n\r\nExample value: /home/${user_name}/Downloads","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_downloaddirectory_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_downloaddirectory_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_downloaddirectory_recommended_downloaddirectory","displayName":"Set download directory (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_downloadrestrictions_recommended","displayName":"Allow download restrictions","description":"Setting the policy means users can't bypass download security decisions.\r\n\r\nThere are many types of download warnings within Chrome, which roughly break down into these categories (learn more about Safe Browsing verdicts https://support.google.com/chrome/?p=ib_download_blocked):\r\n\r\n* Malicious, as flagged by the Safe Browsing server\r\n* Uncommon or unwanted, as flagged by the Safe Browsing server\r\n* A dangerous file type (e.g. all SWF downloads and many EXE downloads)\r\n\r\nSetting the policy blocks different subsets of these, depending on it's value:\r\n\r\n0: No special restrictions. Default.\r\n\r\n1: Blocks malicious files flagged by the Safe Browsing server AND Blocks all dangerous file types. Only recommended for OUs/browsers/users that have a high tolerance for False Positives.\r\n\r\n2: Blocks malicious files flagged by the Safe Browsing server AND Blocks uncommon or unwanted files flagged by the Safe Browsing server AND Blocks all dangerous file types. Only recommended for OUs/browsers/users that have a high tolerance for False Positives.\r\n\r\n3: Blocks all downloads. Not recommended, except for special use cases.\r\n\r\n4: Blocks malicious files flagged by the Safe Browsing server, does not block dangerous file types. Recommended.\r\n\r\nNote: These restrictions apply to downloads triggered from webpage content, as well as the Download link... menu option. They don't apply to the download of the currently displayed page or to saving as PDF from the printing options. Read more about Safe Browsing ( https://developers.google.com/safe-browsing ).","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_downloadrestrictions_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_downloadrestrictions_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_downloadrestrictions_recommended_downloadrestrictions","displayName":"Download restrictions (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_downloadrestrictions_recommended_downloadrestrictions_0","displayName":"No special restrictions. Default.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_downloadrestrictions_recommended_downloadrestrictions_1","displayName":"Block malicious downloads and dangerous file types.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_downloadrestrictions_recommended_downloadrestrictions_2","displayName":"Block malicious downloads, uncommon or unwanted downloads and dangerous file types.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_downloadrestrictions_recommended_downloadrestrictions_3","displayName":"Block all downloads.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_downloadrestrictions_recommended_downloadrestrictions_4","displayName":"Block malicious downloads. Recommended.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_importautofillformdata_recommended","displayName":"Import autofill form data from default browser on first run","description":"Setting the policy to Enabled imports autofill form data from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means no autofill form data is imported on first run.\r\n\r\nUsers can trigger an import dialog and the autofill form data checkbox will be checked or unchecked to match this policy's value.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_importautofillformdata_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_importautofillformdata_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_importbookmarks_recommended","displayName":"Import bookmarks from default browser on first run","description":"Setting the policy to Enabled imports bookmarks from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means no bookmarks are imported on first run.\r\n\r\nUsers can trigger an import dialog and the bookmarks checkbox will be checked or unchecked to match this policy's value.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_importbookmarks_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_importbookmarks_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_importhistory_recommended","displayName":"Import browsing history from default browser on first run","description":"Setting the policy to Enabled imports browsing history from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means no browsing history is imported on first run.\r\n\r\nUsers can trigger an import dialog and the browsing history checkbox will be checked or unchecked to match this policy's value.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_importhistory_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_importhistory_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_importsavedpasswords_recommended","displayName":"Import saved passwords from default browser on first run","description":"Setting the policy to Enabled imports saved passwords from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means no saved passwords are imported on first run.\r\n\r\nUsers can trigger an import dialog and the saved passwords checkbox will be checked or unchecked to match this policy's value.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_importsavedpasswords_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_importsavedpasswords_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_importsearchengine_recommended","displayName":"Import search engines from default browser on first run","description":"Setting the policy to Enabled imports the default search engine from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means the default search engine isn't imported on first run.\r\n\r\nUsers can trigger an import dialog and the default search engine checkbox will be checked or unchecked to match this policy's value.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_importsearchengine_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_importsearchengine_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_metricsreportingenabled_recommended","displayName":"Enable reporting of usage and crash-related data","description":"When this policy is enabled, anonymous reporting of usage and crash-related data about Chrome to Google is enabled by default. Users will still be able to change this setting in the Chrome settings.\r\n\r\nWhen this policy is disabled, anonymous reporting is disabled and no usage or crash data is sent to Google. Users won't be able to change this setting.\r\n\r\nWhen this policy isn't set, users can choose the anonymous reporting behavior at installation or first run, and can later change the setting in the Chrome settings.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft® Active Directory® domain or Windows 10 Pro or Enterprise instances that are enrolled for device management, and macOS instances that are managed via MDM or joined to a domain via MCX.\r\n\r\n(For Chrome OS, see DeviceMetricsReportingEnabled.)","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_metricsreportingenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_metricsreportingenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_networkpredictionoptions_recommended","displayName":"Enable network prediction","description":"This policy controls network prediction in Google Chrome. It controls DNS prefetching, TCP, and SSL preconnection and prerendering of webpages.\r\n\r\nIf you set the policy, users can't change it. Leaving it unset turns on network prediction, but the user can change it.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_networkpredictionoptions_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_networkpredictionoptions_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_networkpredictionoptions_recommended_networkpredictionoptions","displayName":"Enable network prediction (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_networkpredictionoptions_recommended_networkpredictionoptions_0","displayName":"Predict network actions on any network connection","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_networkpredictionoptions_recommended_networkpredictionoptions_1","displayName":"Predict network actions on any network that is not cellular.\r\n(Deprecated in 50, removed in 52. After 52, if value 1 is set, it will be treated as 0 - predict network actions on any network connection.)","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_networkpredictionoptions_recommended_networkpredictionoptions_2","displayName":"Do not predict network actions on any network connection","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_safebrowsingfortrustedsourcesenabled_recommended","displayName":"Enable Safe Browsing for trusted sources","description":"Setting the policy to Enabled or leaving it unset means downloaded files are sent to be analyzed by Safe Browsing, even when it's from a trusted source.\r\n\r\nSetting the policy to Disabled means downloaded files won't be sent to be analyzed by Safe Browsing when it's from a trusted source.\r\n\r\nThese restrictions apply to downloads triggered from webpage content, as well as the Download link menu option. These restrictions don't apply to the save or download of the currently displayed page or to saving as PDF from the printing options.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_safebrowsingfortrustedsourcesenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_safebrowsingfortrustedsourcesenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_searchsuggestenabled_recommended","displayName":"Enable search suggestions","description":"Setting the policy to True turns on search suggestions in Google Chrome's address bar. Setting the policy to False turns off these search suggestions.\r\n\r\nIf you set the policy, users can't change it. If not set, search suggestions are on at first, but users can turn them off any time.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_searchsuggestenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_searchsuggestenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_showfullurlsinaddressbar_recommended","displayName":"Show Full URLs","description":"This feature enables display of the full URL in the address bar.\r\nIf this policy is set to True, then the full URL will be shown in the address bar, including schemes and subdomains.\r\nIf this policy is set to False, then the default URL display will apply.\r\nIf this policy is left unset, then the default URL display will apply and the user will be able to toggle between default and full URL display with a context menu option.\r\n","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_showfullurlsinaddressbar_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_showfullurlsinaddressbar_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_spellcheckserviceenabled_recommended","displayName":"Enable or disable spell checking web service","description":"Setting the policy to Enabled puts a Google web service in use to help resolve spelling errors. This policy only controls the use of the online service. Setting the policy to Disabled means this service is never used.\r\n\r\nLeaving the policy unset lets users choose whether to use the spellcheck service.\r\n\r\nThe spell check can always use a downloaded dictionary locally unless the feature is disabled by SpellcheckEnabled in which case this policy will have no effect.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_spellcheckserviceenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_spellcheckserviceenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_translateenabled_recommended","displayName":"Enable Translate","description":"Setting the policy to True provides translation functionality when it's appropriate for users by showing an integrated translate toolbar in Google Chrome and a translate option on the right-click context menu. Setting the policy to False shuts off all built-in translate features.\r\n\r\nIf you set the policy, users can't change this function. Leaving it unset lets them change the setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_translateenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended_translateenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~contentsettings_recommended_registeredprotocolhandlers_recommended","displayName":"Register protocol handlers","description":"Setting the policy (as recommended only) lets you register a list of protocol handlers, which merge with the ones that the user registers, putting both sets in use. Set the property \"protocol\" to the scheme, such as \"mailto\", and set the property \"URL\" to the URL pattern of the application that handles the scheme specified in the \"protocol\" field. The pattern can include a \"%s\" placeholder, which the handled URL replaces.\r\n\r\nUsers can't remove a protocol handler registered by policy. However, by installing a new default handler, they can change the protocol handlers installed by policy.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=RegisteredProtocolHandlers for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"protocol\": \"mailto\",\r\n \"url\": \"https://mail.google.com/mail/?extsrc=mailto&url=%s\",\r\n \"default\": true\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~contentsettings_recommended_registeredprotocolhandlers_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~contentsettings_recommended_registeredprotocolhandlers_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~contentsettings_recommended_registeredprotocolhandlers_recommended_registeredprotocolhandlers","displayName":"Register protocol handlers (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovideralternateurls_recommended","displayName":"List of alternate URLs for the default search provider","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderAlternateURLs specifies a list of alternate URLs for extracting search terms from the search engine. The URLs should include the string '{searchTerms}'.\r\n\r\nLeaving DefaultSearchProviderAlternateURLs unset means no alternate URLs are used to extract search terms.\r\n\r\nExample value:\r\n\r\nhttps://search.my.company/suggest#q={searchTerms}\r\nhttps://search.my.company/suggest/search#q={searchTerms}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovideralternateurls_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovideralternateurls_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovideralternateurls_recommended_defaultsearchprovideralternateurlsdesc","displayName":"List of alternate URLs for the default search provider (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderenabled_recommended","displayName":"Enable the default search provider","description":"Setting the policy to Enabled means a default search is performed when a user enters non-URL text in the address bar. To specify the default search provider, set the rest of the default search policies. If you leave those policies empty, the user can choose the default provider. Setting the policy to Disabled means there's no search when the user enters non-URL text in the address bar.\r\n\r\nIf you set the policy, users can't change it in Google Chrome. If not set, the default search provider is on, and users can set the search provider list.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderencodings_recommended","displayName":"Default search provider encodings","description":"If DefaultSearchProviderEnabled is on, setting DefaultSearchProviderEncodings specifies the character encodings supported by the search provider. Encodings are code page names such as UTF-8, GB2312, and ISO-8859-1. They're tried in the order provided.\r\n\r\nLeaving DefaultSearchProviderEncodings unset puts UTF-8 in use.\r\n\r\nExample value:\r\n\r\nUTF-8\r\nUTF-16\r\nGB2312\r\nISO-8859-1","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderencodings_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderencodings_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderencodings_recommended_defaultsearchproviderencodingsdesc","displayName":"Default search provider encodings (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidericonurl_recommended","displayName":"Default search provider icon","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderIconURL specifies the default search provider's favorite icon URL.\r\n\r\nLeaving DefaultSearchProviderIconURL unset means there's no icon for the search provider.\r\n\r\nExample value: https://search.my.company/favicon.ico","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidericonurl_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidericonurl_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidericonurl_recommended_defaultsearchprovidericonurl","displayName":"Default search provider icon (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderimageurl_recommended","displayName":"Parameter providing search-by-image feature for the default search provider","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderImageURL specifies the URL of the search engine used for image search. (If DefaultSearchProviderImageURLPostParams is set, then image search requests use the POST method instead.)\r\n\r\nLeaving DefaultSearchProviderImageURL unset means no image search is used.\r\n\r\nExample value: https://search.my.company/searchbyimage/upload","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderimageurl_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderimageurl_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderimageurl_recommended_defaultsearchproviderimageurl","displayName":"Parameter providing search-by-image feature for the default search provider (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderimageurlpostparams_recommended","displayName":"Parameters for image URL which uses POST","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderImageURLPostParams specifies the parameters during image search with POST. It consists of comma-separated, name-value pairs. If a value is a template parameter, such as {imageThumbnail}, real image thumbnail data replaces it.\r\n\r\nLeaving DefaultSearchProviderImageURLPostParams unset means image search request is sent using the GET method.\r\n\r\nExample value: content={imageThumbnail},url={imageURL},sbisrc={SearchSource}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderimageurlpostparams_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderimageurlpostparams_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderimageurlpostparams_recommended_defaultsearchproviderimageurlpostparams","displayName":"Parameters for image URL which uses POST (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderkeyword_recommended","displayName":"Default search provider keyword","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderKeyword specifies the keyword or shortcut used in the address bar to trigger the search for this provider.\r\n\r\nLeaving DefaultSearchProviderKeyword unset means no keyword activates the search provider.\r\n\r\nExample value: mis","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderkeyword_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderkeyword_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchproviderkeyword_recommended_defaultsearchproviderkeyword","displayName":"Default search provider keyword (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidername_recommended","displayName":"Default search provider name","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderName specifies the default search provider's name.\r\n\r\nLeaving DefaultSearchProviderName unset means the hostname specified by the search URL is used.\r\n\r\nExample value: My Intranet Search","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidername_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidername_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidername_recommended_defaultsearchprovidername","displayName":"Default search provider name (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidernewtaburl_recommended","displayName":"Default search provider new tab page URL","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderNewTabURL specifies the URL of the search engine used to provide a New Tab page.\r\n\r\nLeaving DefaultSearchProviderNewTabURL unset means no new tab page is provided.\r\n\r\nExample value: https://search.my.company/newtab","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidernewtaburl_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidernewtaburl_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidernewtaburl_recommended_defaultsearchprovidernewtaburl","displayName":"Default search provider new tab page URL (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidersearchurl_recommended","displayName":"Default search provider search URL","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSearchURL specifies the URL of the search engine used during a default search. The URL should include the string '{searchTerms}', replaced in the query by the user's search terms.\r\n\r\nYou can specify Google's search URL as: '{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}ie={inputEncoding}'.\r\n\r\nExample value: https://search.my.company/search?q={searchTerms}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidersearchurl_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidersearchurl_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidersearchurl_recommended_defaultsearchprovidersearchurl","displayName":"Default search provider search URL (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidersearchurlpostparams_recommended","displayName":"Parameters for search URL which uses POST","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSearchURLPostParams specifies the parameters when searching a URL with POST. It consists of comma-separated, name-value pairs. If a value is a template parameter, such as '{searchTerms}', real search terms data replaces it.\r\n\r\nLeaving DefaultSearchProviderSearchURLPostParams unset means search requests are sent using the GET method.\r\n\r\nExample value: q={searchTerms},ie=utf-8,oe=utf-8","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidersearchurlpostparams_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidersearchurlpostparams_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidersearchurlpostparams_recommended_defaultsearchprovidersearchurlpostparams","displayName":"Parameters for search URL which uses POST (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidersuggesturl_recommended","displayName":"Default search provider suggest URL","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSuggestURL specifies the URL of the search engine to provide search suggestions. The URL should include the string '{searchTerms}', replaced in the query by the user's search terms.\r\n\r\nYou can specify Google's search URL as: '{google:baseURL}complete/search?output=chrome&q={searchTerms}'.\r\n\r\nExample value: https://search.my.company/suggest?q={searchTerms}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidersuggesturl_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidersuggesturl_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidersuggesturl_recommended_defaultsearchprovidersuggesturl","displayName":"Default search provider suggest URL (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidersuggesturlpostparams_recommended","displayName":"Parameters for suggest URL which uses POST","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSuggestURLPostParams specifies the parameters during suggestion search with POST. It consists of comma-separated, name-value pairs. If a value is a template parameter, such as '{searchTerms}', real search terms data replaces it.\r\n\r\nLeaving DefaultSearchProviderSuggestURLPostParams unset unset means suggest search requests are sent using the GET method.\r\n\r\nExample value: q={searchTerms},ie=utf-8,oe=utf-8","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidersuggesturlpostparams_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidersuggesturlpostparams_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~defaultsearchprovider_recommended_defaultsearchprovidersuggesturlpostparams_recommended_defaultsearchprovidersuggesturlpostparams","displayName":"Parameters for suggest URL which uses POST (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~deprecatedpolicies_recommended_autofillenabled_recommended","displayName":"Enable AutoFill","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~deprecatedpolicies_recommended_autofillenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~deprecatedpolicies_recommended_autofillenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~deprecatedpolicies_recommended_safebrowsingenabled_recommended","displayName":"Enable Safe Browsing","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~deprecatedpolicies_recommended_safebrowsingenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~deprecatedpolicies_recommended_safebrowsingenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~passwordmanager_recommended_passwordleakdetectionenabled_recommended","displayName":"Enable leak detection for entered credentials","description":"Setting the policy to Enabled lets users have Google Chrome check whether usernames and passwords entered were part of a leak.\r\n\r\nIf the policy is set, users can't change it in Google Chrome. If not set, credential leak checking is allowed, but the user can turn it off.\r\n\r\nThis behavior will not trigger if Safe Browsing is disabled (either by policy or by the user). In order to force Safe Browsing on, use the SafeBrowsingEnabled policy or the SafeBrowsingProtectionLevel policy.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~passwordmanager_recommended_passwordleakdetectionenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~passwordmanager_recommended_passwordleakdetectionenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~passwordmanager_recommended_passwordmanagerenabled_recommended","displayName":"Enable saving passwords to the password manager","description":"Setting the policy to Enabled means users have Google Chrome remember passwords and provide them the next time they sign in to a site.\r\n\r\nSetting the policy to Disabled means users can't save new passwords, but previously saved passwords will still work.\r\n\r\nIf the policy is set, users can't change it in Google Chrome. If not set, the user can turn off password saving.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~passwordmanager_recommended_passwordmanagerenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~passwordmanager_recommended_passwordmanagerenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~printing_recommended_printheaderfooter_recommended","displayName":"Print Headers and Footers","description":"Setting the policy to Enabled turns headers and footers on in print preview. Setting the policy to Disabled turns them off in print preview.\r\n\r\nIf you set the policy, users can't change it. If unset, users decides whether headers and footers appear.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~printing_recommended_printheaderfooter_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~printing_recommended_printheaderfooter_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~printing_recommended_printpdfasimagedefault_recommended","displayName":"Print PDF as Image Default","description":"Controls if Google Chrome makes the Print as image option default to set when printing PDFs.\r\n\r\nWhen this policy is set to Enabled, Google Chrome will default to setting the Print as image option in the Print Preview when printing a PDF.\r\n\r\nWhen this policy is set to Disabled or not set Google Chrome then the user selection for Print as image option will be initially unset. The user will be allowed to select it for each individual PDFs print job, if the option is available.\r\n\r\nFor Microsoft® Windows® or macOS this policy only has an effect if PrintPdfAsImageAvailability is also enabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~printing_recommended_printpdfasimagedefault_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~printing_recommended_printpdfasimagedefault_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~printing_recommended_printpreviewusesystemdefaultprinter_recommended","displayName":"Use System Default Printer as Default","description":"Setting the policy to Enabled means Google Chrome uses the OS default printer as the default destination for print preview.\r\n\r\nSetting the policy to Disabled or leaving it unset means Google Chrome uses the most recently used printer as the default destination for print preview.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~printing_recommended_printpreviewusesystemdefaultprinter_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~printing_recommended_printpreviewusesystemdefaultprinter_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_clearsitedataonexit_recommended","displayName":"Clear site data on browser shutdown (deprecated)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_clearsitedataonexit_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_clearsitedataonexit_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_defaultsearchproviderinstanturl_recommended","displayName":"Default search provider instant URL","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_defaultsearchproviderinstanturl_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_defaultsearchproviderinstanturl_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_defaultsearchproviderinstanturl_recommended_defaultsearchproviderinstanturl","displayName":"Default search provider instant URL (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_defaultsearchproviderinstanturlpostparams_recommended","displayName":"Parameters for instant URL which uses POST","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_defaultsearchproviderinstanturlpostparams_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_defaultsearchproviderinstanturlpostparams_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_defaultsearchproviderinstanturlpostparams_recommended_defaultsearchproviderinstanturlpostparams","displayName":"Parameters for instant URL which uses POST (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_defaultsearchprovidersearchtermsreplacementkey_recommended","displayName":"Parameter controlling search term placement for the default search provider","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_defaultsearchprovidersearchtermsreplacementkey_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_defaultsearchprovidersearchtermsreplacementkey_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_defaultsearchprovidersearchtermsreplacementkey_recommended_defaultsearchprovidersearchtermsreplacementkey","displayName":"Parameter controlling search term placement for the default search provider (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_dnsprefetchingenabled_recommended","displayName":"Enable network prediction","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_dnsprefetchingenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_dnsprefetchingenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_instantenabled_recommended","displayName":"Enable Instant","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_instantenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~removedpolicies_recommended_instantenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~safebrowsing_recommended_safebrowsingprotectionlevel_recommended","displayName":"Safe Browsing Protection Level","description":"Allows you to control whether Google Chrome's Safe Browsing feature is enabled and the mode it operates in.\r\n\r\nIf this policy is set to 'NoProtection' (value 0), Safe Browsing is never active.\r\n\r\nIf this policy is set to 'StandardProtection' (value 1, which is the default), Safe Browsing is always active in the standard mode.\r\n\r\nIf this policy is set to 'EnhancedProtection' (value 2), Safe Browsing is always active in the enhanced mode, which provides better security, but requires sharing more browsing information with Google.\r\n\r\nIf you set this policy as mandatory, users cannot change or override the Safe Browsing setting in Google Chrome.\r\n\r\nIf this policy is left not set, Safe Browsing will operate in Standard Protection mode but users can change this setting.\r\n\r\nSee https://developers.google.com/safe-browsing for more info on Safe Browsing.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~safebrowsing_recommended_safebrowsingprotectionlevel_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~safebrowsing_recommended_safebrowsingprotectionlevel_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~safebrowsing_recommended_safebrowsingprotectionlevel_recommended_safebrowsingprotectionlevel","displayName":"Safe Browsing Protection Level (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~safebrowsing_recommended_safebrowsingprotectionlevel_recommended_safebrowsingprotectionlevel_0","displayName":"Safe Browsing is never active.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~safebrowsing_recommended_safebrowsingprotectionlevel_recommended_safebrowsingprotectionlevel_1","displayName":"Safe Browsing is active in the standard mode.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~safebrowsing_recommended_safebrowsingprotectionlevel_recommended_safebrowsingprotectionlevel_2","displayName":"Safe Browsing is active in the enhanced mode. This mode provides better security, but requires sharing more browsing information with Google.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_homepageisnewtabpage_recommended","displayName":"Use New Tab Page as homepage","description":"Setting the policy to Enabled makes the New Tab page the user's homepage, ignoring any homepage URL location. Setting the policy to Disabled means that their homepage is never the New Tab page, unless the user's homepage URL is set to chrome://newtab.\r\n\r\nIf you set the policy, users can't change their homepage type in Google Chrome. If not set, the user decides whether or not the New Tab page is their homepage.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_homepageisnewtabpage_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_homepageisnewtabpage_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_homepagelocation_recommended","displayName":"Configure the home page URL","description":"Setting the policy sets the default homepage URL in Google Chrome. You open the homepage using the Home button. On desktop, the RestoreOnStartup policies control the pages that open on startup.\r\n\r\nIf the homepage is set to the New Tab Page, by the user or HomepageIsNewTabPage, this policy has no effect.\r\n\r\n The URL needs a standard scheme, such as http://example.com or https://example.com. When this policy is set, users can't change their homepage URL in Google Chrome.\r\n\r\nLeaving both HomepageLocation and HomepageIsNewTabPage unset lets users choose their homepage.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.\r\n\r\nExample value: https://www.chromium.org","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_homepagelocation_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_homepagelocation_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_homepagelocation_recommended_homepagelocation","displayName":"Home page URL (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_restoreonstartup_recommended","displayName":"Action on startup","description":"Setting the policy lets you specify system behavior on startup. Turning this setting off amounts to leaving it unset as Google Chrome must have specified start up behavior.\r\n\r\nIf you set the policy, users can't change it in Google Chrome. If not set, users can change it.\r\n\r\nSetting this policy to RestoreOnStartupIsLastSession turns off some settings that rely on sessions or that perform actions on exit, such as clearing browsing data on exit or session-only cookies.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_restoreonstartup_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_restoreonstartup_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_restoreonstartup_recommended_restoreonstartup","displayName":"Action on startup (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_restoreonstartup_recommended_restoreonstartup_5","displayName":"Open New Tab Page","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_restoreonstartup_recommended_restoreonstartup_1","displayName":"Restore the last session","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_restoreonstartup_recommended_restoreonstartup_4","displayName":"Open a list of URLs","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_restoreonstartupurls_recommended","displayName":"URLs to open on startup","description":"If RestoreOnStartup is set to RestoreOnStartupIsURLs, then setting RestoreOnStartupURLs to a list of URLs specify which URLs open.\r\n\r\nIf not set, the New Tab page opens on start up.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.\r\n\r\nExample value:\r\n\r\nhttps://example.com\r\nhttps://www.chromium.org","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_restoreonstartupurls_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_restoreonstartupurls_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_restoreonstartupurls_recommended_restoreonstartupurlsdesc","displayName":"URLs to open on startup (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_showhomebutton_recommended","displayName":"Show Home button on toolbar","description":"Setting the policy to Enabled shows the Home button on Google Chrome's toolbar. Setting the policy to Disabled keeps the Home button from appearing.\r\n\r\nIf you set the policy, users can't change it in Google Chrome. If not set, users chooses whether to show the Home button.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_showhomebutton_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_recommended~startup_recommended_showhomebutton_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_relaunchnotification","displayName":"Notify a user that a browser relaunch or device restart is recommended or required","description":"Notify users that Google Chrome must be relaunched or Google Chrome OS must be restarted to apply a pending update.\r\n\r\nThis policy setting enables notifications to inform the user that a browser relaunch or device restart is recommended or required. If not set, Google Chrome indicates to the user that a relaunch is needed via subtle changes to its menu, while Google Chrome OS indicates such via a notification in the system tray. If set to 'Recommended', a recurring warning will be shown to the user that a relaunch is recommended. The user can dismiss this warning to defer the relaunch. If set to 'Required', a recurring warning will be shown to the user indicating that a browser relaunch will be forced once the notification period passes. The default period is seven days for Google Chrome and four days for Google Chrome OS, and may be configured via the RelaunchNotificationPeriod policy setting.\r\n\r\nThe user's session is restored following the relaunch/restart.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_relaunchnotification_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_relaunchnotification_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_relaunchnotification_relaunchnotification","displayName":"Notify a user that a browser relaunch or device restart is recommended or required (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_relaunchnotification_relaunchnotification_1","displayName":"Show a recurring prompt to the user indicating that a relaunch is recommended","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_relaunchnotification_relaunchnotification_2","displayName":"Show a recurring prompt to the user indicating that a relaunch is required","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_relaunchnotificationperiod","displayName":"Set the time period for update notifications","description":"Allows you to set the time period, in milliseconds, over which users are notified that Google Chrome must be relaunched or that a Google Chrome OS device must be restarted to apply a pending update.\r\n\r\nOver this time period, the user will be repeatedly informed of the need for an update. For Google Chrome OS devices, a restart notification appears in the system tray according to the RelaunchHeadsUpPeriod policy. For Google Chrome browsers, the app menu changes to indicate that a relaunch is needed once one third of the notification period passes. This notification changes color once two thirds of the notification period passes, and again once the full notification period has passed. The additional notifications enabled by the RelaunchNotification policy follow this same schedule.\r\n\r\nIf not set, the default period of 604800000 milliseconds (one week) is used.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_relaunchnotificationperiod_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_relaunchnotificationperiod_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_relaunchnotificationperiod_relaunchnotificationperiod","displayName":"Time period (milliseconds): (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_relaunchwindow","displayName":"Set the time interval for relaunch","description":"Specify a target time window for the end of the relaunch notification period.\r\n\r\nUsers are notified of the need for a browser relaunch or device restart based on the RelaunchNotification and RelaunchNotificationPeriod policy settings. Browsers and devices are forcibly restarted at the end of the notification period when the RelaunchNotification policy is set to 'Required'. This RelaunchWindow policy can be used to defer the end of the notification period so that it falls within a specific time window.\r\n\r\nIf this policy is not set, the default target time window for Google Chrome OS is between 2 AM and 4 AM. The default target time window for Google Chrome is the whole day (i.e., the end of the notification period is never deferred).\r\n\r\nNote: Though the policy can accept multiple items in entries, all but the first item are ignored.\r\nWarning: Setting this policy may delay application of software updates.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=RelaunchWindow for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"start\": {\r\n \"hour\": 2,\r\n \"minute\": 15\r\n },\r\n \"duration_mins\": 240\r\n }\r\n ]\r\n}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_relaunchwindow_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_relaunchwindow_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_relaunchwindow_relaunchwindow","displayName":"Relaunch time window (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_remotedebuggingallowed","displayName":"Allow remote debugging","description":"Controls whether users may use remote debugging.\r\n\r\nIf this policy is set to Enabled or not set, users may use remote debugging by specifying --remote-debugging-port and --remote-debugging-pipe command line switches.\r\n\r\nIf this policy is set to Disabled, users are not allowed to use remote debugging.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_remotedebuggingallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_remotedebuggingallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_renderercodeintegrityenabled","displayName":"Enable Renderer Code Integrity","description":"Setting the policy to Enabled or leaving it unset turns Renderer Code Integrity on.\r\n\r\nSetting the policy to Disabled has a detrimental effect on Google Chrome's security and stability as unknown and potentially hostile code can load inside Google Chrome's renderer processes. Only turn off the policy if there are compatibility issues with third-party software that must run inside Google Chrome's renderer processes.\r\n\r\nNote: Read more about Process mitigation policies ( https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md#Process-mitigation-policies ).","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_renderercodeintegrityenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_renderercodeintegrityenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_requireonlinerevocationchecksforlocalanchors","displayName":"Require online OCSP/CRL checks for local trust anchors","description":"Setting the policy to True means Google Chrome always performs revocation checking for successfully validated server certificates signed by locally installed CA certificates. If Google Chrome can't get revocation status information, Google Chrome treats these certificates as revoked (hard-fail).\r\n\r\nSetting the policy to False or leaving it unset means Google Chrome uses existing online revocation-checking settings.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_requireonlinerevocationchecksforlocalanchors_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_requireonlinerevocationchecksforlocalanchors_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_restrictsignintopattern","displayName":"Restrict which Google accounts are allowed to be set as browser primary accounts in Google Chrome","description":"Contains a regular expression which is used to determine which Google accounts can be set as browser primary accounts in Google Chrome (i.e. the account that is chosen during the Sync opt-in flow).\r\n\r\nAn appropriate error is displayed if a user tries to set a browser primary account with a username that does not match this pattern.\r\n\r\nIf this policy is left not set or blank, then the user can set any Google account as a browser primary account in Google Chrome.\r\n\r\nExample value: .*@example\\.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_restrictsignintopattern_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_restrictsignintopattern_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_restrictsignintopattern_restrictsignintopattern","displayName":"Restrict which Google accounts are allowed to be set as browser primary accounts in Google Chrome (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_roamingprofilelocation","displayName":"Set the roaming profile directory","description":"Configures the directory that Google Chrome will use for storing the roaming copy of the profiles.\r\n\r\nIf you set this policy, Google Chrome will use the provided directory to store the roaming copy of the profiles if the RoamingProfileSupportEnabled policy has been enabled. If the RoamingProfileSupportEnabled policy is disabled or left unset the value stored in this policy is not used.\r\n\r\nSee https://www.chromium.org/administrators/policy-list-3/user-data-directory-variables for a list of variables that can be used.\r\n\r\nOn non-Windows platforms, this policy must be set for roaming profiles to work.\r\n\r\nOn Windows, if this policy is left unset, the default roaming profile path will be used.\r\n\r\nExample value: ${roaming_app_data}\\chrome-profile","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_roamingprofilelocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_roamingprofilelocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_roamingprofilelocation_roamingprofilelocation","displayName":"Set the roaming profile directory (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_roamingprofilesupportenabled","displayName":"Enable the creation of roaming copies for Google Chrome profile data","description":"If you enable this setting, the settings stored in Google Chrome profiles like bookmarks, autofill data, passwords, etc. will also be written to a file stored in the Roaming user profile folder or a location specified by the Administrator through the RoamingProfileLocation policy. Enabling this policy disables cloud sync.\r\n\r\nIf this policy is disabled or left not set only the regular local profiles will be used.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_roamingprofilesupportenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_roamingprofilesupportenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_safebrowsingfortrustedsourcesenabled","displayName":"Enable Safe Browsing for trusted sources","description":"Setting the policy to Enabled or leaving it unset means downloaded files are sent to be analyzed by Safe Browsing, even when it's from a trusted source.\r\n\r\nSetting the policy to Disabled means downloaded files won't be sent to be analyzed by Safe Browsing when it's from a trusted source.\r\n\r\nThese restrictions apply to downloads triggered from webpage content, as well as the Download link menu option. These restrictions don't apply to the save or download of the currently displayed page or to saving as PDF from the printing options.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_safebrowsingfortrustedsourcesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_safebrowsingfortrustedsourcesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_safesitesfilterbehavior","displayName":"Control SafeSites adult content filtering.","description":"Setting the policy controls the SafeSites URL filter, which uses the Google Safe Search API to classify URLs as pornographic or not.\r\n\r\nWhen this policy is set to:\r\n\r\n* Do not filter sites for adult content, or not set, sites aren't filtered\r\n\r\n* Filter top level sites for adult content, pornographic sites are filtered","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_safesitesfilterbehavior_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_safesitesfilterbehavior_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_safesitesfilterbehavior_safesitesfilterbehavior","displayName":"Control SafeSites adult content filtering. (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_safesitesfilterbehavior_safesitesfilterbehavior_0","displayName":"Do not filter sites for adult content","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_safesitesfilterbehavior_safesitesfilterbehavior_1","displayName":"Filter top level sites (but not embedded iframes) for adult content","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sandboxexternalprotocolblocked","displayName":"Allow Chrome to block navigations toward external protocols in sandboxed iframes","description":"Chrome will block navigations toward external protocols inside\r\nsandboxed iframe. See https://chromestatus.com/features/5680742077038592.\r\n\r\nWhen True, this lets Chrome blocks those navigations.\r\n\r\nWhen False, this prevents Chrome from blocking those navigations.\r\n\r\nThis defaults to True: security feature enabled.\r\n\r\nThis can be used by administrators who need more time to update their internal website affected by this new restriction. This Enterprise policy is temporary; it's intended to be removed after Google Chrome version 104.\r\n","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sandboxexternalprotocolblocked_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sandboxexternalprotocolblocked_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_savingbrowserhistorydisabled","displayName":"Disable saving browser history","description":"Setting the policy to Enabled means browsing history is not saved, tab syncing is off and users can't change this setting.\r\n\r\nSetting the policy to Disabled or leaving it unset saves browsing history.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_savingbrowserhistorydisabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_savingbrowserhistorydisabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_scrolltotextfragmentenabled","displayName":"Enable scrolling to text specified in URL fragments","description":"This feature allows for hyperlinks and address bar URL navigations to target specific text within a web page, which will be scrolled to once the loading of the web page is complete.\r\n\r\nIf you enable or don't configure this policy, web page scrolling to specific text fragments via URL will be enabled.\r\n\r\nIf you disable this policy, web page scrolling to specific text fragments via URL will be disabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_scrolltotextfragmentenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_scrolltotextfragmentenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_searchsuggestenabled","displayName":"Enable search suggestions","description":"Setting the policy to True turns on search suggestions in Google Chrome's address bar. Setting the policy to False turns off these search suggestions.\r\n\r\nIf you set the policy, users can't change it. If not set, search suggestions are on at first, but users can turn them off any time.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_searchsuggestenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_searchsuggestenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_securitykeypermitattestation","displayName":"URLs/domains automatically permitted direct Security Key attestation","description":"Setting the policy specifies URLs and domains for which no prompt appears when attestation certificates from Security Keys are requested. A signal is also sent to the Security Key indicating that individual attestation may be used. Without this, when sites request attestation of Security Keys, users are prompted in Google Chrome version 65 and later.\r\n\r\nURLs will only match as U2F appIDs. Domains only match as webauthn RP IDs. So to cover both U2F and webauthn APIs, list the appID URL and domain for a given site.\r\n\r\nExample value:\r\n\r\nhttps://example.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_securitykeypermitattestation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_securitykeypermitattestation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_securitykeypermitattestation_securitykeypermitattestationdesc","displayName":"URLs/domains automatically permitted direct Security Key attestation (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sharedarraybufferunrestrictedaccessallowed","displayName":"Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context","description":"\r\nSpecifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context. Google Chrome will require cross-origin isolation when using SharedArrayBuffers from Google Chrome 91 onward (2021-05-25) for Web Compatibility reasons. Additional details can be found on: https://developer.chrome.com/blog/enabling-shared-array-buffer/.\r\n\r\nWhen set to Enabled, sites can use SharedArrayBuffer with no restrictions.\r\n\r\nWhen set to Disabled or not set, sites can only use SharedArrayBuffers when cross-origin isolated.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sharedarraybufferunrestrictedaccessallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sharedarraybufferunrestrictedaccessallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sharedclipboardenabled","displayName":"Enable the Shared Clipboard Feature","description":"Enable the Shared Clipboard feature which allows users to send text between Chrome Desktops and an Android device when Sync is enabled and the user is Signed-in.\r\n\r\nIf this policy is set to true, the capability of sending text, cross device, for chrome user is enabled.\r\n\r\nIf this policy is set to false, the capability of sending text, cross device, for chrome user is disabled.\r\n\r\nIf you set this policy, users cannot change or override it.\r\n\r\nIf this policy is left unset, the shared clipboard feature is enabled by default.\r\n\r\nIt is up to the admins to set policies in all platforms they care about. It's recommended to set this policy to one value in all platforms.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sharedclipboardenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sharedclipboardenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_showappsshortcutinbookmarkbar","displayName":"Show the apps shortcut in the bookmark bar","description":"Setting the policy to True displays the apps shortcut. Setting the policy to False means this shortcut never appears.\r\n\r\nIf you set the policy, users can't change it. If not set, users decide to show or hide the apps shortcut from the bookmark bar context menu.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_showappsshortcutinbookmarkbar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_showappsshortcutinbookmarkbar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_showfullurlsinaddressbar","displayName":"Show Full URLs","description":"This feature enables display of the full URL in the address bar.\r\nIf this policy is set to True, then the full URL will be shown in the address bar, including schemes and subdomains.\r\nIf this policy is set to False, then the default URL display will apply.\r\nIf this policy is left unset, then the default URL display will apply and the user will be able to toggle between default and full URL display with a context menu option.\r\n","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_showfullurlsinaddressbar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_showfullurlsinaddressbar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_signedhttpexchangeenabled","displayName":"Enable Signed HTTP Exchange (SXG) support","description":"Setting the policy to True or leaving it unset means Google Chrome will accept web contents served as Signed HTTP Exchanges.\r\n\r\nSetting the policy to False prevents Signed HTTP Exchanges from loading.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_signedhttpexchangeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_signedhttpexchangeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_signininterceptionenabled","displayName":"Enable signin interception","description":"This settings enables or disables signin interception.\r\n\r\nWhen this policy not set or is set to True, the signin interception dialog triggers when a Google account is added on the web, and the user may benefit from moving this account to another (new or existing) profile.\r\n\r\nWhen this is set to False, the signin interception dialog does not trigger.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_signininterceptionenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_signininterceptionenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_siteperprocess","displayName":"Require Site Isolation for every site","description":"Since Google Chrome 67, site isolation has been enabled by default on all Desktop platforms, causing every site to run in its own process. A site is a scheme plus eTLD+1 (e.g., https://example.com). Setting this policy to Enabled does not change that behavior; it only prevents users from opting out (for example, using Disable site isolation in chrome://flags). Since Google Chrome 76, setting the policy to Disabled or leaving it unset doesn't turn off site isolation, but instead allows users to opt out.\r\n\r\nIsolateOrigins might also be useful for isolating specific origins at a finer granularity than site (e.g., https://a.example.com).\r\n\r\nOn Google Chrome OS version 76 and earlier, set the DeviceLoginScreenSitePerProcess device policy to the same value. (If the values don't match, a delay can occur when entering a user session.)\r\n\r\nNote: For Android, use the SitePerProcessAndroid policy instead.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_siteperprocess_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_siteperprocess_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_spellcheckenabled","displayName":"Enable spellcheck","description":"Setting the policy to Enabled turns spellcheck on, and users can't turn it off. On Microsoft® Windows®, Google Chrome OS and Linux®, spellcheck languages can be switched on or off individually, so users can still turn spellcheck off by switching off every spellcheck language. To avoid that, use the SpellcheckLanguage to force-enable specific spellcheck languages.\r\n\r\nSetting the policy to Disabled turns off spellcheck from all sources, and users can't turn it on. The SpellCheckServiceEnabled, SpellcheckLanguage and SpellcheckLanguageBlocklist policies have no effect when this policy is set to False.\r\n\r\nLeaving the policy unset lets users turn spellcheck on or off in the language settings.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_spellcheckenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_spellcheckenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_spellchecklanguage","displayName":"Force enable spellcheck languages","description":"Force-enables spellcheck languages. Unrecognized languages in the list will be ignored.\r\n\r\nIf you enable this policy, spellcheck will be enabled for the languages specified, in addition to the languages for which the user has enabled spellcheck.\r\n\r\nIf you do not set this policy, or disable it, there will be no change to the user's spellcheck preferences.\r\n\r\nIf the SpellcheckEnabled policy is set to false, this policy will have no effect.\r\n\r\nIf a language is included in both this policy and the SpellcheckLanguageBlocklist policy, this policy is prioritized and the spellcheck language is enabled.\r\n\r\nThe currently supported languages are: af, bg, ca, cs, da, de, el, en-AU, en-CA, en-GB, en-US, es, es-419, es-AR, es-ES, es-MX, es-US, et, fa, fo, fr, he, hi, hr, hu, id, it, ko, lt, lv, nb, nl, pl, pt-BR, pt-PT, ro, ru, sh, sk, sl, sq, sr, sv, ta, tg, tr, uk, vi.\r\n\r\nExample value:\r\n\r\nfr\r\nes","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_spellchecklanguage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_spellchecklanguage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_spellchecklanguage_spellchecklanguagedesc","displayName":"Force enable spellcheck languages (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_spellchecklanguageblocklist","displayName":"Force disable spellcheck languages","description":"Force-disables spellcheck languages. Unrecognized languages in that list will be ignored.\r\n\r\nIf you enable this policy, spellcheck will be disabled for the languages specified. The user can still enable or disable spellcheck for languages not in the list.\r\n\r\nIf you do not set this policy, or disable it, there will be no change to the user's spellcheck preferences.\r\n\r\nIf the SpellcheckEnabled policy is set to false, this policy will have no effect.\r\n\r\nIf a language is included in both this policy and the SpellcheckLanguage policy, the latter is prioritized and the spellcheck language will be enabled.\r\n\r\nThe currently supported languages are: af, bg, ca, cs, da, de, el, en-AU, en-CA, en-GB, en-US, es, es-419, es-AR, es-ES, es-MX, es-US, et, fa, fo, fr, he, hi, hr, hu, id, it, ko, lt, lv, nb, nl, pl, pt-BR, pt-PT, ro, ru, sh, sk, sl, sq, sr, sv, ta, tg, tr, uk, vi.\r\n\r\nExample value:\r\n\r\nfr\r\nes","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_spellchecklanguageblocklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_spellchecklanguageblocklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_spellchecklanguageblocklist_spellchecklanguageblocklistdesc","displayName":"Force disable spellcheck languages (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_spellcheckserviceenabled","displayName":"Enable or disable spell checking web service","description":"Setting the policy to Enabled puts a Google web service in use to help resolve spelling errors. This policy only controls the use of the online service. Setting the policy to Disabled means this service is never used.\r\n\r\nLeaving the policy unset lets users choose whether to use the spellcheck service.\r\n\r\nThe spell check can always use a downloaded dictionary locally unless the feature is disabled by SpellcheckEnabled in which case this policy will have no effect.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_spellcheckserviceenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_spellcheckserviceenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sslerroroverrideallowed","displayName":"Allow proceeding from the SSL warning page","description":"Setting the policy to Enabled or leaving it unset lets users click through warning pages Google Chrome shows when users navigate to sites that have SSL errors.\r\n\r\nSetting the policy to Disabled prevent users from clicking through any warning pages.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sslerroroverrideallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sslerroroverrideallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sslerroroverrideallowedfororigins","displayName":"Allow proceeding from the SSL warning page on specific origins","description":"If SSLErrorOverrideAllowed is Disabled, setting the policy lets you set a list of origin patterns that specify the sites where a user can click through warning pages Google Chrome shows when users navigate to sites that have SSL errors. Users will not be able to click through SSL warning pages on origins that are not on this list.\r\n\r\nIf SSLErrorOverrideAllowed is Enabled or unset, this policy does nothing.\r\n\r\nLeaving the policy unset means SSLErrorOverrideAllowed applies for all sites.\r\n\r\nFor detailed information on valid input patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy. This policy only matches based on origin, so any path in the URL pattern is ignored.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sslerroroverrideallowedfororigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sslerroroverrideallowedfororigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sslerroroverrideallowedfororigins_sslerroroverrideallowedfororiginsdesc","displayName":"Allow proceeding from the SSL warning page on specific origins (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sslversionmin","displayName":"Minimum SSL version enabled","description":"Setting the policy to a valid value means Google Chrome won't use SSL/TLS versions less than the specified version. Unrecognized values are ignored.\r\n\r\nIf this policy is not set, then Google Chrome will show an error for TLS 1.0 and TLS 1.1, but the user will be able to bypass it.\r\n\r\nIf this policy is set to \"tls1.2\", the user will not be able to bypass this error.\r\n\r\nSupport for setting this policy to \"tls1\" or \"tls1.1\" was removed in version 91. Suppressing the TLS 1.0/1.1 warning is no longer supported.\r\n\r\nExample value: tls1.2","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sslversionmin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sslversionmin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sslversionmin_sslversionmin","displayName":"Minimum SSL version enabled (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sslversionmin_sslversionmin_tls1","displayName":"TLS 1.0","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sslversionmin_sslversionmin_tls1.1","displayName":"TLS 1.1","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_sslversionmin_sslversionmin_tls1.2","displayName":"TLS 1.2","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_suppressdifferentoriginsubframedialogs","displayName":"Suppress JavaScript Dialogs triggered from different origin subframes","description":"As described in https://www.chromestatus.com/feature/5148698084376576 , JavaScript modal dialogs, triggered by window.alert, window.confirm, and window.prompt, will be blocked in Google Chrome if triggered from a subframe whose origin is different from the main frame origin.\r\nThis policy allows overriding that change.\r\nIf the policy is set to enabled or unset, JavaScript dialogs triggered from a different origin subframe will be blocked.\r\nIf the policy is set to disabled, JavaScript dialogs triggered from a different origin subframe will not be blocked.\r\n\r\nThis policy will be removed in Google Chrome version 95.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_suppressdifferentoriginsubframedialogs_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_suppressdifferentoriginsubframedialogs_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_suppressunsupportedoswarning","displayName":"Suppress the unsupported OS warning","description":"Setting the policy to Enabled suppresses the warning that appears when Google Chrome is running on an unsupported computer or operating system.\r\n\r\nSetting the policy to Disabled or leaving it unset means the warnings appear on unsupported systems.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_suppressunsupportedoswarning_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_suppressunsupportedoswarning_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_syncdisabled","displayName":"Disable synchronization of data with Google","description":"Setting the policy to Enabled turns off data synchronization in Google Chrome using Google-hosted synchronization services.\r\nTo fully turn off Chrome Sync services, we recommend that you turn off the service in the Google Admin console.\r\n\r\nIf the policy is set to Disabled or not set, users are allowed to choose whether to use Chrome Sync.\r\n\r\nNote: Do not turn on this policy when RoamingProfileSupportEnabled is Enabled, because that feature shares the same client-side functionality. The Google-hosted synchronization is off completely in this case.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_syncdisabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_syncdisabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_synctypeslistdisabled","displayName":"List of types that should be excluded from synchronization","description":"If this policy is set all specified data types will be excluded from synchronization both for Chrome Sync as well as for roaming profile synchronization. This can be beneficial to reduce the size of the roaming profile or limit the type of data uploaded to the Chrome Sync Servers.\r\n\r\nThe current data types for this policy are: \"bookmarks\", \"readingList\", \"preferences\", \"passwords\", \"autofill\", \"themes\", \"typedUrls\", \"extensions\", \"apps\", \"tabs\", \"wifiConfigurations\". Those names are case sensitive!\r\n\r\nExample value:\r\n\r\nbookmarks","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_synctypeslistdisabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_synctypeslistdisabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_synctypeslistdisabled_synctypeslistdisableddesc","displayName":"List of types that should be excluded from synchronization (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_targetblankimpliesnoopener","displayName":"Do not set window.opener for links targeting _blank","description":"Setting the policy to Disabled allows popups targeting _blank to access (via JavaScript) the page that requested to open the popup.\r\n\r\nSetting the policy to Enabled or leaving it unset causes the window.opener property to be set to null unless the anchor specifies rel=\"opener\".\r\n\r\nThis policy will be removed in Google Chrome version 95.\r\n\r\nSee https://chromestatus.com/feature/6140064063029248.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_targetblankimpliesnoopener_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_targetblankimpliesnoopener_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_taskmanagerendprocessenabled","displayName":"Enable ending processes in Task Manager","description":"Setting the policy to Disabled prevents users from ending processes in the Task Manager.\r\n\r\nSetting the policy to Enabled or leaving it unset lets users end processes in the Task Manager.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_taskmanagerendprocessenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_taskmanagerendprocessenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_thirdpartyblockingenabled","displayName":"Enable third party software injection blocking","description":"Setting the policy to Enabled or leaving it unset prevents third-party software from injecting executable code into Google Chrome's processes.\r\n\r\nSetting the policy to Disabled allows this software to inject such code into Google Chrome's processes.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_thirdpartyblockingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_thirdpartyblockingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_totalmemorylimitmb","displayName":"Set limit on megabytes of memory a single Chrome instance can use.","description":"Configures the amount of memory that a single Google Chrome instance can use before tabs start being discarded (I.E. the memory used by the tab will be freed and the tab will have to be reloaded when switched to) to save memory.\r\n\r\nIf the policy is set, browser will begin to discard tabs to save memory once the limitation is exceeded. However, there is no guarantee that the browser is always running under the limit. Any value under 1024 will be rounded up to 1024.\r\n\r\nIf this policy is not set, the browser will only begin attempts to save memory once it has detected that the amount of physical memory on its machine is low.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_totalmemorylimitmb_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_totalmemorylimitmb_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_totalmemorylimitmb_totalmemorylimitmb","displayName":"Set memory limit for Chrome instances: (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_translateenabled","displayName":"Enable Translate","description":"Setting the policy to True provides translation functionality when it's appropriate for users by showing an integrated translate toolbar in Google Chrome and a translate option on the right-click context menu. Setting the policy to False shuts off all built-in translate features.\r\n\r\nIf you set the policy, users can't change this function. Leaving it unset lets them change the setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_translateenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_translateenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_u2fsecuritykeyapienabled","displayName":"Allow using the deprecated U2F Security Key API","description":"If set to Enabled, the deprecated U2F Security Key API can be used and the deprecation reminder prompt shown for U2F API requests is suppressed.\r\n\r\nIf the policy is set to Disabled or left unset, the default behavior will apply.\r\n\r\nThe U2F Security Key API is deprecated and it will be disabled by default in Chrome 98.\r\n\r\nThis is a temporary opt-out mechanism. The U2F API will be removed from Chrome in Chrome 104, at which point this policy will cease to be supported.\r\n\r\nFor more information about the deprecation of the U2F Security Key API, please refer to https://groups.google.com/a/chromium.org/g/blink-dev/c/xHC3AtU_65A.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_u2fsecuritykeyapienabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_u2fsecuritykeyapienabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_urlallowlist","displayName":"Allow access to a list of URLs","description":"Setting the policy provides access to the listed URLs, as exceptions to URLBlocklist. See that policy's description for the format of entries of this list. For example, setting URLBlocklist to * will block all requests, and you can use this policy to allow access to a limited list of URLs. Use it to open exceptions to certain schemes, subdomains of other domains, ports, or specific paths, using the format specified at ( https://www.chromium.org/administrators/url-blocklist-filter-format ). The most specific filter determines if a URL is blocked or allowed. The URLAllowlist policy takes precedence over URLBlocklist. This policy is limited to 1,000 entries.\r\n\r\nThis policy also allows enabling the automatic invocation by the browser of external application registered as protocol handlers for the listed protocols like \"tel:\" or \"ssh:\".\r\n\r\nLeaving the policy unset allows no exceptions to URLBlocklist.\r\n\r\nFrom Google Chrome version 92, this policy is also supported in the headless mode.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.\r\n\r\nExample value:\r\n\r\nexample.com\r\nhttps://ssl.server.com\r\nhosting.com/good_path\r\nhttps://server:8080/path\r\n.exact.hostname.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_urlallowlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_urlallowlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_urlallowlist_urlallowlistdesc","displayName":"Allow access to a list of URLs (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_urlblocklist","displayName":"Block access to a list of URLs","description":"Setting the policy prevents webpages with prohibited URLs from loading. It provides a list of URL patterns that specify forbidden URLs. Leaving the policy unset means no URLs are prohibited in the browser. Format the URL pattern according to this format ( https://www.chromium.org/administrators/url-blocklist-filter-format ). Up to 1,000 exceptions can be defined in URLAllowlist.\r\n\r\nFrom Google Chrome version 73, you can block javascript://* URLs. However, it affects only JavaScript entered in the address bar (or, for example, bookmarklets). In-page JavaScript URLs with dynamically loaded data aren't subject to this policy. For example, if you block example.com/abc, then example.com can still load example.com/abc using XMLHTTPRequest.\r\n\r\nFrom Google Chrome version 92, this policy is also supported in the headless mode.\r\n\r\nNote: Blocking internal chrome://* URLs can lead to unexpected errors.\r\n\r\nExample value:\r\n\r\nexample.com\r\nhttps://ssl.server.com\r\nhosting.com/bad_path\r\nhttps://server:8080/path\r\n.exact.hostname.com\r\nfile://*\r\ncustom_scheme:*\r\n*","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_urlblocklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_urlblocklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_urlblocklist_urlblocklistdesc","displayName":"Block access to a list of URLs (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_urlkeyedanonymizeddatacollectionenabled","displayName":"Enable URL-keyed anonymized data collection","description":"Setting the policy to Enabled means URL-keyed anonymized data collection, which sends URLs of pages the user visits to Google to make searches and browsing better, is always active.\r\n\r\nSetting the policy to Disabled results in no URL-keyed anonymized data collection.\r\n\r\nIf you set the policy, users can't change. If not set, then URL-keyed anonymized data collection at first, but users can change it.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_urlkeyedanonymizeddatacollectionenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_urlkeyedanonymizeddatacollectionenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_userdatadir","displayName":"Set user data directory","description":"Configures the directory that Google Chrome will use for storing user data.\r\n\r\nIf you set this policy, Google Chrome will use the provided directory regardless whether the user has specified the '--user-data-dir' flag or not. To avoid data loss or other unexpected errors this policy should not be set to a directory used for other purposes, because Google Chrome manages its contents.\r\n\r\nSee https://support.google.com/chrome/a?p=Supported_directory_variables for a list of variables that can be used.\r\n\r\nIf this policy is left not set the default profile path will be used and the user will be able to override it with the '--user-data-dir' command line flag.\r\n\r\nExample value: ${users}/${user_name}/Chrome","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_userdatadir_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_userdatadir_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_userdatadir_userdatadir","displayName":"Set user data directory (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_userdatasnapshotretentionlimit","displayName":"Limits the number of user data snapshots retained for use in case of emergency rollback.","description":"Following each major version update, Chrome will create a snapshot of certain portions of the user's browsing data for use in case of a later emergency version rollback. If an emergency rollback is performed to a version for which a user has a corresponding snapshot, the data in the snapshot is restored. This allows users to retain such settings as bookmarks and autofill data.\r\n\r\nIf this policy is not set, the default value of 3 is used\r\n\r\nIf the policy is set, old snapshots are deleted as needed to respect the limit. If the policy is set to 0, no snapshots will be taken","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_userdatasnapshotretentionlimit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_userdatasnapshotretentionlimit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_userdatasnapshotretentionlimit_userdatasnapshotretentionlimit","displayName":"Limits the number of user data snapshots retained for use in case of emergency rollback.: (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_userfeedbackallowed","displayName":"Allow user feedback","description":"Setting the policy to Enabled or leaving it unset lets users send feedback to Google through Menu > Help > Report an Issue or key combination.\r\n\r\nSetting the policy to Disabled means users can't send feedback to Google.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_userfeedbackallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_userfeedbackallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_videocaptureallowed","displayName":"Allow or deny video capture","description":"Setting the policy to Enabled or leaving it unset means that, with the exception of URLs set in the VideoCaptureAllowedUrls list, users get prompted for video capture access.\r\n\r\nSetting the policy to Disabled turns off prompts, and video capture is only available to URLs set in the VideoCaptureAllowedUrls list.\r\n\r\nNote: The policy affects all video input (not just the built-in camera).","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_videocaptureallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_videocaptureallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_videocaptureallowedurls","displayName":"URLs that will be granted access to video capture devices without prompt","description":"Setting the policy means you specify the URL list whose patterns get matched to the security origin of the requesting URL. A match grants access to video capture devices without prompt\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com/\r\nhttps://[*.]example.edu/","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_videocaptureallowedurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_videocaptureallowedurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_videocaptureallowedurls_videocaptureallowedurlsdesc","displayName":"URLs that will be granted access to video capture devices without prompt (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webappinstallforcelist","displayName":"Configure list of force-installed Web Apps","description":"Setting the policy specifies a list of web apps that install silently, without user interaction, and which users can't uninstall or turn off.\r\n\r\nEach list item of the policy is an object with a mandatory member:\r\nurl (the URL of the web app to install)\r\n\r\nand 5 optional members:\r\n- default_launch_container\r\n(for how the web app opens—a new tab is the default)\r\n\r\n- create_desktop_shortcut\r\n(True if you want to create Linux and\r\nMicrosoft® Windows® desktop shortcuts).\r\n\r\n- fallback_app_name\r\n(Starting with Google Chrome version 90,\r\nallows you to override the app name if it is not a\r\nProgressive Web App (PWA), or the app name that is temporarily\r\ninstalled if it is a PWA but authentication is required before the\r\ninstallation can be completed. If both\r\ncustom_name and\r\nfallback_app_name are provided,\r\nthe latter will be ignored.)\r\n\r\n- custom_name\r\n(Starting with Google Chrome\r\nversion 96, allows you to permanently override the app name for all web\r\napps and PWAs. Currently only supported on\r\nGoogle Chrome OS.)\r\n\r\n- custom_icon\r\n(Starting with Google Chrome\r\nversion 96, allows you to override the app icon of installed apps. The\r\nicons have to be square, maximal 1 MB in size, and in one of the following\r\nformats: jpeg, png, gif, webp, ico. The hash value has to be the SHA256\r\nhash of the icon file. Currently only supported on\r\nGoogle Chrome OS.)\r\n\r\nSee PinnedLauncherApps for pinning apps to the Google Chrome OS shelf.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=WebAppInstallForceList for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"url\": \"https://www.google.com/maps\",\r\n \"default_launch_container\": \"window\",\r\n \"create_desktop_shortcut\": true\r\n },\r\n {\r\n \"url\": \"https://docs.google.com\",\r\n \"default_launch_container\": \"tab\"\r\n },\r\n {\r\n \"url\": \"https://docs.google.com/editor\",\r\n \"default_launch_container\": \"window\",\r\n \"fallback_app_name\": \"Editor\"\r\n },\r\n {\r\n \"url\": \"https://docs.google.com/sheets\",\r\n \"default_launch_container\": \"window\",\r\n \"custom_name\": \"Spreadsheets\"\r\n },\r\n {\r\n \"url\": \"https://weather.example.com\",\r\n \"custom_icon\": {\r\n \"url\": \"https://mydomain.example.com/sunny_icon.png\",\r\n \"hash\": \"c28f469c450e9ab2b86ea47038d2b324c6ad3b1e9a4bd8960da13214afd0ca38\"\r\n }\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webappinstallforcelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webappinstallforcelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webappinstallforcelist_webappinstallforcelist","displayName":"URLs for Web Apps to be silently installed. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtcallowlegacytlsprotocols","displayName":"Allow legacy TLS/DTLS downgrade in WebRTC","description":"If enabled, WebRTC peer connections can downgrade to obsolete\r\nversions of the TLS/DTLS (DTLS 1.0, TLS 1.0 and TLS 1.1) protocols.\r\nWhen this policy is disabled or not set, these TLS/DTLS versions are\r\ndisabled.\r\n\r\nThis policy is temporary and will be removed in a future version\r\nof Google Chrome.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtcallowlegacytlsprotocols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtcallowlegacytlsprotocols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtceventlogcollectionallowed","displayName":"Allow collection of WebRTC event logs from Google services","description":"Setting the policy to Enabled means Google Chrome can collect WebRTC event logs from Google services such as Hangouts Meet and upload them to Google. These logs have diagnostic information for debugging issues with audio or video meetings in Google Chrome, such as the time and size of RTP packets, feedback about congestion on the network, and metadata about time and quality of audio and video frames. These logs have no audio or video content from the meeting. To make debugging easier, Google might associate these logs, by means of a session ID, with other logs collected by the Google service itself.\r\n\r\nSetting the policy to Disabled results in no collection or uploading of such logs.\r\n\r\nLeaving the policy unset on versions up to and including M76 means Google Chrome defaults to not being able to collect and upload these logs. Starting at M77, Google Chrome defaults to being able to collect and upload these logs from most profiles affected by cloud-based, user-level enterprise policies. From M77 up to and including M80, Google Chrome can also collect and upload these logs by default from profiles affected by Google Chrome on-premise management.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtceventlogcollectionallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtceventlogcollectionallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtciphandling","displayName":"The IP handling policy of WebRTC","description":"This policy allows restricting which IP addresses and interfaces WebRTC uses when attempting to find the best available connection. See RFC 8828 section 5.2 (https://tools.ietf.org/html/rfc8828.html#section-5.2). When unset, defaults to using all available interfaces.\r\n\r\nExample value: default","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtciphandling_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtciphandling_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtciphandling_webrtciphandling","displayName":"The IP handling policy of WebRTC (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtciphandling_webrtciphandling_default","displayName":"WebRTC will use all available interfaces when searching for the best path.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtciphandling_webrtciphandling_default_public_and_private_interfaces","displayName":"WebRTC will only use the interface connecting to the public Internet, but may connect using private IP addresses.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtciphandling_webrtciphandling_default_public_interface_only","displayName":"WebRTC will only use the interface connecting to the public Internet, and will not connect using private IP addresses.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtciphandling_webrtciphandling_disable_non_proxied_udp","displayName":"WebRTC will use TCP on the public-facing interface, and will only use UDP if supported by a configured proxy.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtclocalipsallowedurls","displayName":"URLs for which local IPs are exposed in WebRTC ICE candidates","description":"Patterns in this list will be matched against the security origin of the requesting URL.\r\nIf a match is found or chrome://flags/#enable-webrtc-hide-local-ips-with-mdns is Disabled, the local IP addresses are shown in WebRTC ICE candidates.\r\nOtherwise, local IP addresses are concealed with mDNS hostnames.\r\nPlease note that this policy weakens the protection of local IPs if needed by administrators.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n*example.com*","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtclocalipsallowedurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtclocalipsallowedurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtclocalipsallowedurls_webrtclocalipsallowedurlsdesc","displayName":"URLs for which local IPs are exposed in WebRTC ICE candidates (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtcudpportrange","displayName":"Restrict the range of local UDP ports used by WebRTC","description":"If the policy is set, the UDP port range used by WebRTC is restricted to the specified port interval (endpoints included).\r\n\r\nIf the policy is not set, or if it is set to the empty string or an invalid port range, WebRTC is allowed to use any available local UDP port.\r\n\r\nExample value: 10000-11999","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtcudpportrange_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtcudpportrange_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_webrtcudpportrange_webrtcudpportrange","displayName":"Restrict the range of local UDP ports used by WebRTC (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_websqlinthirdpartycontextenabled","displayName":"Force WebSQL in third-party contexts to be re-enabled.","description":"WebSQL in third-party contexts (e.g., cross-site iframes) is off by default as of M97 and will be fully removed in M101.\r\nIf this policy is set to false or unset, WebSQL in third party contexts will remain off.\r\nIf this policy is set to true, WebSQL in third-party contexts will be re-enabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_websqlinthirdpartycontextenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_websqlinthirdpartycontextenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_windowocclusionenabled","displayName":"Enable Window Occlusion","description":"Enables window occlusion in Google Chrome.\r\n\r\nIf you enable this setting, to reduce CPU and power consumption Google Chrome will detect when a window is covered by other windows, and will suspend work painting pixels.\r\n\r\nIf you disable this setting Google Chrome will not detect when a window is covered by other windows.\r\n\r\nIf this policy is left not set, occlusion detection will be enabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_windowocclusionenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_windowocclusionenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_wpadquickcheckenabled","displayName":"Enable WPAD optimization","description":"Setting the policy to Enabled or leaving it unset turns on WPAD (Web Proxy Auto-Discovery) optimization in Google Chrome.\r\n\r\nSetting the policy to Disabled turns off WPAD optimization, causing Google Chrome to wait longer for DNS-based WPAD servers.\r\n\r\nWhether or not this policy is set, users can't change the WPAD optimization setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_wpadquickcheckenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome_wpadquickcheckenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_alternativebrowserparameters","displayName":"Command-line parameters for the alternative browser.","description":"Setting the policy to a list of strings means each string is passed to the alternative browser as separate command-line parameters. On Microsoft® Windows®, the parameters are joined with spaces. On macOS and Linux®, a parameter can have spaces and still be treated as a single parameter.\r\n\r\nIf an parameter contains ${url}, ${url} is replaced with the URL of the page to open. If no parameter contains ${url}, the URL is appended at the end of the command line.\r\n\r\nEnvironment variables are expanded. On Microsoft® Windows®, %ABC% is replaced with the value of the ABC environment variable. On macOS and Linux®, ${ABC} is replaced with the value of the ABC environment variable.\r\n\r\nLeaving the policy unset means only the URL is passed as a command-line parameter.\r\n\r\nExample value:\r\n\r\n-foreground\r\n-new-window\r\n${url}\r\n-profile\r\n%HOME%\\browser_profile","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_alternativebrowserparameters_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_alternativebrowserparameters_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_alternativebrowserparameters_alternativebrowserparametersdesc","displayName":"Command-line parameters for the alternative browser. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_alternativebrowserpath","displayName":"Alternative browser to launch for configured websites.","description":"Setting the policy controls which command to use to open URLs in an alternative browser. The policy can be set to one of ${ie}, ${firefox}, ${safari}, ${opera}, ${edge} or a file path. When this policy is set to a file path, that file is used as an executable file. ${ie} is only available on Microsoft® Windows®. ${safari} and ${edge} are only available on Microsoft® Windows® and macOS.\r\n\r\nLeaving the policy unset puts a platform-specific default in use: Internet Explorer® for Microsoft® Windows®, or Safari® for macOS. On Linux®, launching an alternative browser will fail.\r\n\r\nExample value: ${ie}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_alternativebrowserpath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_alternativebrowserpath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_alternativebrowserpath_alternativebrowserpath","displayName":"Alternative browser to launch for configured websites. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherchromeparameters","displayName":"Command-line parameters for switching from the alternative browser.","description":"Setting the policy to a list of strings means the strings are joined with spaces and passed from Internet Explorer® to Google Chrome as command-line parameters. If an parameter contains ${url}, ${url} is replaced with the URL of the page to open. If no parameter contains ${url}, the URL is appended at the end of the command line.\r\n\r\nEnvironment variables are expanded. On Microsoft® Windows®, %ABC% is replaced with the value of the ABC environment variable.\r\n\r\nLeaving the policy unset means Internet Explorer® only passes the URL to Google Chrome as a command-line parameter.\r\n\r\nNote: If the Legacy Browser Support add-in for Internet Explorer® isn't installed, this policy has no effect.\r\n\r\nExample value:\r\n\r\n--force-dark-mode","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherchromeparameters_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherchromeparameters_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherchromeparameters_browserswitcherchromeparametersdesc","displayName":"Command-line parameters for switching from the alternative browser. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherchromepath","displayName":"Path to Chrome for switching from the alternative browser.","description":"This policy controls the command to use to open URLs in Google Chrome when switching from Internet Explorer®. This policy can be set to an executable file path or ${chrome} to autodetect the location of Google Chrome.\r\n\r\nLeaving the policy unset means Internet Explorer® autodetects Google Chrome's own executable path when launching Google Chrome from Internet Explorer.\r\n\r\nNote: If the Legacy Browser Support add-in for Internet Explorer® isn't installed, this policy has no effect.\r\n\r\nExample value: ${chrome}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherchromepath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherchromepath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherchromepath_browserswitcherchromepath","displayName":"Path to Chrome for switching from the alternative browser. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherdelay","displayName":"Delay before launching alternative browser (milliseconds)","description":"Setting the policy to a number has Google Chrome show a message for that number of milliseconds, then it opens an alternative browser.\r\n\r\nLeaving the policy unset or set to 0 means navigating to a designated URL immediately opens it in an alternative browser.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherdelay_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherdelay_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherdelay_browserswitcherdelay","displayName":"Delay before launching alternative browser (milliseconds): (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherenabled","displayName":"Enable the Legacy Browser Support feature.","description":"Setting the policy to Enabled means Google Chrome will try to launch some URLs in an alternate browser, such as Internet Explorer®. This feature is set using the policies in the Legacy Browser support group.\r\n\r\nSetting the policy to Disabled or leaving it unset means Google Chrome won't try to launch designated URLs in an alternate browser.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherexternalgreylisturl","displayName":"URL of an XML file that contains URLs that should never trigger a browser switch.","description":"Setting the policy to a valid URL has Google Chrome download the site list from that URL and apply the rules as if they were set up with the BrowserSwitcherUrlGreylist policy. These policies prevent Google Chrome and the alternative browser from opening one another.\r\n\r\nLeaving it unset (or set to a invalid URL) means Google Chrome doesn't use the policy as a source of rules for not switching browsers.\r\n\r\nNote: This policy points to an XML file in the same format as Internet Explorer®'s SiteList policy. This loads rules from an XML file, without sharing those rules with Internet Explorer®. Read more on Internet Explorer®'s SiteList policy ( https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode )\r\n\r\nExample value: http://example.com/greylist.xml","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherexternalgreylisturl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherexternalgreylisturl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherexternalgreylisturl_browserswitcherexternalgreylisturl","displayName":"URL of an XML file that contains URLs that should never trigger a browser switch. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherexternalsitelisturl","displayName":"URL of an XML file that contains URLs to load in an alternative browser.","description":"Setting the policy to a valid URL has Google Chrome download the site list from that URL and apply the rules as if they were set up with the BrowserSwitcherUrlList policy.\r\n\r\nLeaving it unset (or set to a invalid URL) means Google Chrome doesn't use the policy as a source of rules for switching browsers.\r\n\r\nNote: This policy points to an XML file in the same format as Internet Explorer®'s SiteList policy. This loads rules from an XML file, without sharing those rules with Internet Explorer®. Read more on Internet Explorer®'s SiteList policy ( https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode)\r\n\r\nExample value: http://example.com/sitelist.xml","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherexternalsitelisturl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherexternalsitelisturl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherexternalsitelisturl_browserswitcherexternalsitelisturl","displayName":"URL of an XML file that contains URLs to load in an alternative browser. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherkeeplastchrometab","displayName":"Keep last tab open in Chrome.","description":"Setting the policy to Enabled or leaving it unset has Google Chrome keep at least one tab open, after switching to an alternate browser.\r\n\r\nSetting the policy to Disabled has Google Chrome close the tab after switching to an alternate browser, even if it was the last tab. This causes Google Chrome to exit completely.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherkeeplastchrometab_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherkeeplastchrometab_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherparsingmode","displayName":"Sitelist parsing mode","description":"This policy controls how Google Chrome interprets sitelist/greylist policies for the Legacy Browser Support feature. It affects the following policies: BrowserSwitcherUrlList, BrowserSwitcherUrlGreylist, BrowserSwitcherUseIeSitelist, BrowserSwitcherExternalSitelistUrl, and BrowserSwitcherExternalGreylistUrl.\r\n\r\nIf 'Default' (0) or unset, URL matching is less strict. Rules that do not contain \"/\" look for a substring anywhere in the URL's hostname. Matching the path component of a URL is case-sensitive.\r\n\r\nIf 'IESiteListMode' (1), URL matching is more strict. Rules that do not contain \"/\" only match at the end of the hostname. They must also be at a domain name boundary. Matching the path component of a URL is case-insensitive. This is more compatible with Microsoft® Internet Explorer® and Microsoft® Edge®.\r\n\r\nFor example, with the rules \"example.com\" and \"acme.com/abc\":\r\n\r\n\"http://example.com/\", \"http://subdomain.example.com/\" and \"http://acme.com/abc\" match regardless of parsing mode.\r\n\r\n\"http://notexample.com/\", \"http://example.com.invalid.com/\", \"http://example.comabc/\" only match in 'Default' mode.\r\n\r\n\"http://acme.com/ABC\" only matches in 'IESiteListMode'.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherparsingmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherparsingmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherparsingmode_browserswitcherparsingmode","displayName":"Sitelist parsing mode (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherparsingmode_browserswitcherparsingmode_0","displayName":"Default behavior for LBS.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherparsingmode_browserswitcherparsingmode_1","displayName":"More compatible with Microsoft IE/Edge enterprise mode sitelists.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherurlgreylist","displayName":"Websites that should never trigger a browser switch.","description":"Setting the policy controls the list of websites that will never cause a browser switch. Each item is treated as a rule. Those rules that match won't open an alternative browser. Unlike the BrowserSwitcherUrlList policy, rules apply to both directions. When the Internet Explorer® add-in is on, it also controls whether Internet Explorer® should open these URLs in Google Chrome.\r\n\r\nLeaving the policy unset adds no websites to the list.\r\n\r\nNote: Elements can also be added to this list through the BrowserSwitcherExternalGreylistUrl policy.\r\n\r\nExample value:\r\n\r\nie.com\r\n!open-in-chrome.ie.com\r\nfoobar.com/ie-only/","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherurlgreylist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherurlgreylist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherurlgreylist_browserswitcherurlgreylistdesc","displayName":"Websites that should never trigger a browser switch. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherurllist","displayName":"Websites to open in alternative browser","description":"Setting the policy controls the list of websites to open in an alternative browser. Each item is treated as a rule for something to open in an alternative browser. Google Chrome uses those rules when choosing if a URL should open in an alternative browser. When the Internet Explorer® add-in is on, Internet Explorer® switches back to Google Chrome when the rules don't match. If rules contradict each other, Google Chrome uses the most specific rule.\r\n\r\nLeaving the policy unset adds no websites to the list.\r\n\r\nNote: Elements can also be added to this list through the BrowserSwitcherUseIeSitelist and BrowserSwitcherExternalSitelistUrl policies.\r\n\r\nExample value:\r\n\r\nie.com\r\n!open-in-chrome.ie.com\r\nfoobar.com/ie-only/","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherurllist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherurllist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcherurllist_browserswitcherurllistdesc","displayName":"Websites to open in alternative browser (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcheruseiesitelist","displayName":"Use Internet Explorer's SiteList policy for Legacy Browser Support.","description":"This policy controls whether to load rules from Internet Explorer®'s SiteList policy.\r\n\r\nWhen this policy is set to true, Google Chrome reads Internet Explorer®'s SiteList to obtain the site list's URL. Google Chrome then downloads the site list from that URL, and applies the rules as if they had been configured with the BrowserSwitcherUrlList policy.\r\n\r\nWhen this policy is false or unset, Google Chrome does not use Internet Explorer®'s SiteList policy as a source of rules for switching browsers.\r\n\r\nFor more information on Internet Explorer's SiteList policy: https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcheruseiesitelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~browserswitcher_browserswitcheruseiesitelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_autoselectcertificateforurls","displayName":"Automatically select client certificates for these sites","description":"Setting the policy lets you make a list of URL patterns that specify sites for which Chrome can automatically select a client certificate. The value is an array of stringified JSON dictionaries, each with the form { \"pattern\": \"$URL_PATTERN\", \"filter\" : $FILTER }, where $URL_PATTERN is a content setting pattern. $FILTER restricts the client certificates the browser automatically selects from. Independent of the filter, only certificates that match the server's certificate request are selected.\r\n\r\nExamples for the usage of the $FILTER section:\r\n\r\n* When $FILTER is set to { \"ISSUER\": { \"CN\": \"$ISSUER_CN\" } }, only client certificates issued by a certificate with the CommonName $ISSUER_CN are selected.\r\n\r\n* When $FILTER contains both the \"ISSUER\" and the \"SUBJECT\" sections, only client certificates that satisfy both conditions are selected.\r\n\r\n* When $FILTER contains a \"SUBJECT\" section with the \"O\" value, a certificate needs at least one organization matching the specified value to be selected.\r\n\r\n* When $FILTER contains a \"SUBJECT\" section with a \"OU\" value, a certificate needs at least one organizational unit matching the specified value to be selected.\r\n\r\n* When $FILTER is set to {}, the selection of client certificates is not additionally restricted. Note that filters provided by the web server still apply.\r\n\r\nLeaving the policy unset means there's no autoselection for any site.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=AutoSelectCertificateForUrls for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n{\"pattern\":\"https://www.example.com\",\"filter\":{\"ISSUER\":{\"CN\":\"certificate issuer name\", \"L\": \"certificate issuer location\", \"O\": \"certificate issuer org\", \"OU\": \"certificate issuer org unit\"}, \"SUBJECT\":{\"CN\":\"certificate subject name\", \"L\": \"certificate subject location\", \"O\": \"certificate subject org\", \"OU\": \"certificate subject org unit\"}}}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_autoselectcertificateforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_autoselectcertificateforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_autoselectcertificateforurls_autoselectcertificateforurlsdesc","displayName":"Automatically select client certificates for these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_cookiesallowedforurls","displayName":"Allow cookies on these sites","description":"Allows you to set a list of url patterns that specify sites which are allowed to set cookies.\r\n\r\nIf this policy is left not set the global default value will be used for all sites either from the DefaultCookiesSetting policy if it is set, or the user's personal configuration otherwise.\r\n\r\nSee also policies CookiesBlockedForUrls and CookiesSessionOnlyForUrls. Note that there must be no conflicting URL patterns between these three policies - it is unspecified which policy takes precedence.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_cookiesallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_cookiesallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_cookiesallowedforurls_cookiesallowedforurlsdesc","displayName":"Allow cookies on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_cookiesblockedforurls","displayName":"Block cookies on these sites","description":"Setting the policy lets you make a list of URL patterns that specify sites that can't set cookies.\r\n\r\nLeaving the policy unset results in the use of DefaultCookiesSetting for all sites, if it's set. If not, the user's personal setting applies.\r\n\r\nWhile no specific policy takes precedence, see CookiesAllowedForUrls and CookiesSessionOnlyForUrls. URL patterns among these 3 policies must not conflict.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_cookiesblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_cookiesblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_cookiesblockedforurls_cookiesblockedforurlsdesc","displayName":"Block cookies on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_cookiessessiononlyforurls","displayName":"Limit cookies from matching URLs to the current session","description":"Unless the RestoreOnStartup policy is set to permanently restore URLs from previous sessions, then setting CookiesSessionOnlyForUrls lets you make a list of URL patterns that specify sites that can and can't set cookies for one session.\r\n\r\nLeaving the policy unset results in the use of DefaultCookiesSetting for all sites, if it's set. If not, the user's personal setting applies. URLs not covered by the patterns specified also result in the use of defaults.\r\n\r\nWhile no specific policy takes precedence, see CookiesBlockedForUrls and CookiesAllowedForUrls. URL patterns among these 3 policies must not conflict.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_cookiessessiononlyforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_cookiessessiononlyforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_cookiessessiononlyforurls_cookiessessiononlyforurlsdesc","displayName":"Limit cookies from matching URLs to the current session (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultcookiessetting","displayName":"Default cookies setting","description":"Unless the RestoreOnStartup policy is set to permanently restore URLs from previous sessions, then setting CookiesSessionOnlyForUrls lets you make a list of URL patterns that specify sites that can and can't set cookies for one session.\r\n\r\nLeaving the policy unset results in the use of DefaultCookiesSetting for all sites, if it's set. If not, the user's personal setting applies. URLs not covered by the patterns specified also result in the use of defaults.\r\n\r\nWhile no specific policy takes precedence, see CookiesBlockedForUrls and CookiesAllowedForUrls. URL patterns among these 3 policies must not conflict.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultcookiessetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultcookiessetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultcookiessetting_defaultcookiessetting","displayName":"Default cookies setting (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultcookiessetting_defaultcookiessetting_1","displayName":"Allow all sites to set local data","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultcookiessetting_defaultcookiessetting_2","displayName":"Do not allow any site to set local data","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultcookiessetting_defaultcookiessetting_4","displayName":"Keep cookies for the duration of the session","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultfilesystemreadguardsetting","displayName":"Control use of the File System API for reading","description":"Setting the policy to 3 lets websites ask for read access to files and directories in the host operating system's file system via the File System API. Setting the policy to 2 denies access.\r\n\r\nLeaving it unset lets websites ask for access, but users can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultfilesystemreadguardsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultfilesystemreadguardsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultfilesystemreadguardsetting_defaultfilesystemreadguardsetting","displayName":"Control use of the File System API for reading (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultfilesystemreadguardsetting_defaultfilesystemreadguardsetting_2","displayName":"Do not allow any site to request read access to files and directories via the File System API","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultfilesystemreadguardsetting_defaultfilesystemreadguardsetting_3","displayName":"Allow sites to ask the user to grant read access to files and directories via the File System API","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultfilesystemwriteguardsetting","displayName":"Control use of the File System API for writing","description":"Setting the policy to 3 lets websites ask for write access to files and directories in the host operating system's file system. Setting the policy to 2 denies access.\r\n\r\nLeaving it unset lets websites ask for access, but users can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultfilesystemwriteguardsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultfilesystemwriteguardsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultfilesystemwriteguardsetting_defaultfilesystemwriteguardsetting","displayName":"Control use of the File System API for writing (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultfilesystemwriteguardsetting_defaultfilesystemwriteguardsetting_2","displayName":"Do not allow any site to request write access to files and directories","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultfilesystemwriteguardsetting_defaultfilesystemwriteguardsetting_3","displayName":"Allow sites to ask the user to grant write access to files and directories","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultgeolocationsetting","displayName":"Default geolocation setting","description":"Setting the policy to 1 lets sites track the users' physical location as the default state. Setting the policy to 2 denies this tracking by default. You can set the policy to ask whenever a site wants to track the users' physical location.\r\n\r\nLeaving the policy unset means the AskGeolocation policy applies, but users can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultgeolocationsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultgeolocationsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultgeolocationsetting_defaultgeolocationsetting","displayName":"Default geolocation setting (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultgeolocationsetting_defaultgeolocationsetting_1","displayName":"Allow sites to track the users' physical location","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultgeolocationsetting_defaultgeolocationsetting_2","displayName":"Do not allow any site to track the users' physical location","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultgeolocationsetting_defaultgeolocationsetting_3","displayName":"Ask whenever a site wants to track the users' physical location","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultimagessetting","displayName":"Default images setting","description":"Setting the policy to 1 lets all websites display images. Setting the policy to 2 denies image display.\r\n\r\nLeaving it unset allows images, but users can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultimagessetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultimagessetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultimagessetting_defaultimagessetting","displayName":"Default images setting (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultimagessetting_defaultimagessetting_1","displayName":"Allow all sites to show all images","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultimagessetting_defaultimagessetting_2","displayName":"Do not allow any site to show images","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultinsecurecontentsetting","displayName":"Control use of insecure content exceptions","description":"Allows you to set whether users can add exceptions to allow mixed content for specific sites.\r\n\r\nThis policy can be overridden for specific URL patterns using the 'InsecureContentAllowedForUrls' and 'InsecureContentBlockedForUrls' policies.\r\n\r\nIf this policy is left not set, users will be allowed to add exceptions to allow blockable mixed content and disable autoupgrades for optionally blockable mixed content.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultinsecurecontentsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultinsecurecontentsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultinsecurecontentsetting_defaultinsecurecontentsetting","displayName":"Control use of insecure content exceptions (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultinsecurecontentsetting_defaultinsecurecontentsetting_2","displayName":"Do not allow any site to load mixed content","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultinsecurecontentsetting_defaultinsecurecontentsetting_3","displayName":"Allow users to add exceptions to allow mixed content","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultjavascriptjitsetting","displayName":"Control use of JavaScript JIT","description":"Allows you to set whether Google Chrome will run the v8 JavaScript engine with JIT (Just In Time) compiler enabled or not.\r\n\r\nDisabling the JavaScript JIT will mean that Google Chrome may render web content more slowly, and may also disable parts of JavaScript including WebAssembly. Disabling the JavaScript JIT may allow Google Chrome to render web content in a more secure configuration.\r\n\r\nThis policy can be overridden for specific URL patterns using the JavaScriptJitAllowedForSites and JavaScriptJitBlockedForSites policies.\r\n\r\nIf this policy is left not set, JavaScript JIT is enabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultjavascriptjitsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultjavascriptjitsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultjavascriptjitsetting_defaultjavascriptjitsetting","displayName":"Control use of JavaScript JIT (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultjavascriptjitsetting_defaultjavascriptjitsetting_1","displayName":"Allow any site to run JavaScript JIT","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultjavascriptjitsetting_defaultjavascriptjitsetting_2","displayName":"Do not allow any site to run JavaScript JIT","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultjavascriptsetting","displayName":"Default JavaScript setting","description":"Setting the policy to 1 lets websites run JavaScript. Setting the policy to 2 denies JavaScript.\r\n\r\nLeaving it unset allows JavaScript, but users can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultjavascriptsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultjavascriptsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultjavascriptsetting_defaultjavascriptsetting","displayName":"Default JavaScript setting (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultjavascriptsetting_defaultjavascriptsetting_1","displayName":"Allow all sites to run JavaScript","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultjavascriptsetting_defaultjavascriptsetting_2","displayName":"Do not allow any site to run JavaScript","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultnotificationssetting","displayName":"Default notification setting","description":"Setting the policy to 1 lets websites display desktop notifications. Setting the policy to 2 denies desktop notifications.\r\n\r\nLeaving it unset means AskNotifications applies, but users can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultnotificationssetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultnotificationssetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultnotificationssetting_defaultnotificationssetting","displayName":"Default notification setting (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultnotificationssetting_defaultnotificationssetting_1","displayName":"Allow sites to show desktop notifications","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultnotificationssetting_defaultnotificationssetting_2","displayName":"Do not allow any site to show desktop notifications","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultnotificationssetting_defaultnotificationssetting_3","displayName":"Ask every time a site wants to show desktop notifications","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultpopupssetting","displayName":"Default popups setting","description":"Setting the policy to 1 lets websites display pop-ups. Setting the policy to 2 denies pop-ups.\r\n\r\nLeaving it unset means BlockPopups applies, but users can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultpopupssetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultpopupssetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultpopupssetting_defaultpopupssetting","displayName":"Default popups setting (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultpopupssetting_defaultpopupssetting_1","displayName":"Allow all sites to show pop-ups","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultpopupssetting_defaultpopupssetting_2","displayName":"Do not allow any site to show popups","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultsensorssetting","displayName":"Default sensors setting","description":"Setting the policy to 1 lets websites access and use sensors such as motion and light. Setting the policy to 2 denies acess to sensors.\r\n\r\nLeaving it unset means AllowSensors applies, but users can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultsensorssetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultsensorssetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultsensorssetting_defaultsensorssetting","displayName":"Default sensors setting (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultsensorssetting_defaultsensorssetting_1","displayName":"Allow sites to access sensors","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultsensorssetting_defaultsensorssetting_2","displayName":"Do not allow any site to access sensors","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultserialguardsetting","displayName":"Control use of the Serial API","description":"Setting the policy to 3 lets websites ask for access to serial ports. Setting the policy to 2 denies access to serial ports.\r\n\r\nLeaving it unset lets websites ask for access, but users can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultserialguardsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultserialguardsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultserialguardsetting_defaultserialguardsetting","displayName":"Control use of the Serial API (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultserialguardsetting_defaultserialguardsetting_2","displayName":"Do not allow any site to request access to serial ports via the Serial API","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultserialguardsetting_defaultserialguardsetting_3","displayName":"Allow sites to ask the user to grant access to a serial port","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultwebbluetoothguardsetting","displayName":"Control use of the Web Bluetooth API","description":"Setting the policy to 3 lets websites ask for access to nearby Bluetooth devices. Setting the policy to 2 denies access to nearby Bluetooth devices.\r\n\r\nLeaving the policy unset lets sites ask for access, but users can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultwebbluetoothguardsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultwebbluetoothguardsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultwebbluetoothguardsetting_defaultwebbluetoothguardsetting","displayName":"Control use of the Web Bluetooth API (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultwebbluetoothguardsetting_defaultwebbluetoothguardsetting_2","displayName":"Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultwebbluetoothguardsetting_defaultwebbluetoothguardsetting_3","displayName":"Allow sites to ask the user to grant access to a nearby Bluetooth device","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultwebusbguardsetting","displayName":"Control use of the WebUSB API","description":"Setting the policy to 3 lets websites ask for access to connected USB devices. Setting the policy to 2 denies access to connected USB devices.\r\n\r\nLeaving it unset lets websites ask for access, but users can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultwebusbguardsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultwebusbguardsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultwebusbguardsetting_defaultwebusbguardsetting","displayName":"Control use of the WebUSB API (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultwebusbguardsetting_defaultwebusbguardsetting_2","displayName":"Do not allow any site to request access to USB devices via the WebUSB API","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_defaultwebusbguardsetting_defaultwebusbguardsetting_3","displayName":"Allow sites to ask the user to grant access to a connected USB device","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_filesystemreadaskforurls","displayName":"Allow read access via the File System API on these sites","description":"Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them read access to files or directories in the host operating system's file system via the File System API.\r\n\r\nLeaving the policy unset means DefaultFileSystemReadGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.\r\n\r\nURL patterns must not conflict with FileSystemReadBlockedForUrls. Neither policy takes precedence if a URL matches with both.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_filesystemreadaskforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_filesystemreadaskforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_filesystemreadaskforurls_filesystemreadaskforurlsdesc","displayName":"Allow read access via the File System API on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_filesystemreadblockedforurls","displayName":"Block read access via the File System API on these sites","description":"Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them read access to files or directories in the host operating system's file system via the File System API.\r\n\r\nLeaving the policy unset means DefaultFileSystemReadGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.\r\n\r\nURL patterns can't conflict with FileSystemReadAskForUrls. Neither policy takes precedence if a URL matches with both.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_filesystemreadblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_filesystemreadblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_filesystemreadblockedforurls_filesystemreadblockedforurlsdesc","displayName":"Block read access via the File System API on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_filesystemwriteaskforurls","displayName":"Allow write access to files and directories on these sites","description":"Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them write access to files or directories in the host operating system's file system.\r\n\r\nLeaving the policy unset means DefaultFileSystemWriteGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.\r\n\r\nURL patterns must not conflict with FileSystemWriteBlockedForUrls. Neither policy takes precedence if a URL matches with both.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_filesystemwriteaskforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_filesystemwriteaskforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_filesystemwriteaskforurls_filesystemwriteaskforurlsdesc","displayName":"Allow write access to files and directories on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_filesystemwriteblockedforurls","displayName":"Block write access to files and directories on these sites","description":"Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them write access to files or directories in the host operating system's file system.\r\n\r\nLeaving the policy unset means DefaultFileSystemWriteGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.\r\n\r\nURL patterns can't conflict with FileSystemWriteAskForUrls. Neither policy takes precedence if a URL matches with both.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_filesystemwriteblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_filesystemwriteblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_filesystemwriteblockedforurls_filesystemwriteblockedforurlsdesc","displayName":"Block write access to files and directories on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_imagesallowedforurls","displayName":"Allow images on these sites","description":"Setting the policy lets you set a list of URL patterns that specify sites that may display images.\r\n\r\nLeaving the policy unset means DefaultImagesSetting applies for all sites, if it's set. If not, the user's personal setting applies.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nNote that previously this policy was erroneously enabled on Android, but this functionality has never been fully supported on Android.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_imagesallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_imagesallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_imagesallowedforurls_imagesallowedforurlsdesc","displayName":"Allow images on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_imagesblockedforurls","displayName":"Block images on these sites","description":"Setting the policy lets you set a list of URL patterns that specify sites that can't display images.\r\n\r\nLeaving the policy unset means DefaultImagesSetting applies for all sites, if it's set. If not, the user's personal setting applies.\r\n\r\n For detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\n Note that previously this policy was erroneously enabled on Android, but this functionality has never been fully supported on Android.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_imagesblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_imagesblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_imagesblockedforurls_imagesblockedforurlsdesc","displayName":"Block images on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_insecurecontentallowedforurls","displayName":"Allow insecure content on these sites","description":"Allows you to set a list of url patterns that specify sites which are allowed to display blockable (i.e. active) mixed content (i.e. HTTP content on HTTPS sites) and for which optionally blockable mixed content upgrades will be disabled.\r\n\r\nIf this policy is left not set blockable mixed content will be blocked and optionally blockable mixed content will be upgraded, and users will be allowed to set exceptions to allow it for specific sites.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_insecurecontentallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_insecurecontentallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_insecurecontentallowedforurls_insecurecontentallowedforurlsdesc","displayName":"Allow insecure content on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_insecurecontentblockedforurls","displayName":"Block insecure content on these sites","description":"Allows you to set a list of url patterns that specify sites which are not allowed to display blockable (i.e. active) mixed content (i.e. HTTP content on HTTPS sites), and for which optionally blockable (i.e. passive) mixed content will be upgraded.\r\n\r\nIf this policy is left not set blockable mixed content will be blocked and optionally blockable mixed content will be upgraded, but users will be allowed to set exceptions to allow it for specific sites.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_insecurecontentblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_insecurecontentblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_insecurecontentblockedforurls_insecurecontentblockedforurlsdesc","displayName":"Block insecure content on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_javascriptallowedforurls","displayName":"Allow JavaScript on these sites","description":"Setting the policy lets you set a list of URL patterns that specify the sites that can run JavaScript.\r\n\r\nLeaving the policy unset means DefaultJavaScriptSetting applies for all sites, if it's set. If not, the user's personal setting applies.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_javascriptallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_javascriptallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_javascriptallowedforurls_javascriptallowedforurlsdesc","displayName":"Allow JavaScript on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_javascriptblockedforurls","displayName":"Block JavaScript on these sites","description":"Setting the policy lets you set a list of URL patterns that specify the sites that can't run JavaScript.\r\n\r\nLeaving the policy unset means DefaultJavaScriptSetting applies for all sites, if it's set. If not, the user's personal setting applies.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_javascriptblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_javascriptblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_javascriptblockedforurls_javascriptblockedforurlsdesc","displayName":"Block JavaScript on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_javascriptjitallowedforsites","displayName":"Allow JavaScript to use JIT on these sites","description":"Allows you to set a list of site url patterns that specify sites which are allowed to run JavaScript with JIT (Just In Time) compiler enabled.\r\n\r\nFor detailed information on valid site url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nJavaScript JIT policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.site.com will not correctly apply to site.com or subdomain.site.com since they both resolve to the same eTLD+1 (site.com) for which there is no policy. In this case, policy must be set on site.com to apply correctly for both site.com and subdomain.site.com.\r\n\r\nThis policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if site-one.com is listed in the JavaScriptJitAllowedForSites policy but site-one.com loads a frame containing site-two.com then site-one.com will have JavaScript JIT enabled, but site-two.com will use the policy from DefaultJavaScriptJitSetting, if set, or default to JavaScript JIT enabled.\r\n\r\nIf this policy is not set for a site then the policy from DefaultJavaScriptJitSetting applies to the site, if set, otherwise Javascript JIT is enabled for the site.\r\n\r\nExample value:\r\n\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_javascriptjitallowedforsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_javascriptjitallowedforsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_javascriptjitallowedforsites_javascriptjitallowedforsitesdesc","displayName":"Allow JavaScript to use JIT on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_javascriptjitblockedforsites","displayName":"Block JavaScript from using JIT on these sites","description":"Allows you to set a list of site url patterns that specify sites which are not allowed to run JavaScript JIT (Just In Time) compiler enabled.\r\n\r\nDisabling the JavaScript JIT will mean that Google Chrome may render web content more slowly, and may also disable parts of JavaScript including WebAssembly. Disabling the JavaScript JIT may allow Google Chrome to render web content in a more secure configuration.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nJavaScript JIT policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.site.com will not correctly apply to site.com or subdomain.site.com since they both resolve to the same eTLD+1 (site.com) for which there is no policy. In this case, policy must be set on site.com to apply correctly for both site.com and subdomain.site.com.\r\n\r\nThis policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if site-one.com is listed in the JavaScriptJitBlockedForSites policy but site-one.com loads a frame containing site-two.com then site-one.com will have JavaScript JIT disabled, but site-two.com will use the policy from DefaultJavaScriptJitSetting, if set, or default to JavaScript JIT enabled.\r\n\r\nIf this policy is not set for a site then the policy from DefaultJavaScriptJitSetting applies to the site, if set, otherwise JavaScript JIT is enabled for the site.\r\n\r\nExample value:\r\n\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_javascriptjitblockedforsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_javascriptjitblockedforsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_javascriptjitblockedforsites_javascriptjitblockedforsitesdesc","displayName":"Block JavaScript from using JIT on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_legacysamesitecookiebehaviorenabledfordomainlist","displayName":"Revert to legacy SameSite behavior for cookies on these sites","description":"Cookies set for domains matching these patterns will revert to legacy SameSite behavior. Reverting to legacy behavior causes cookies that don't specify a SameSite attribute to be treated as if they were \"SameSite=None\", removes the requirement for \"SameSite=None\" cookies to carry the \"Secure\" attribute, and skips the scheme comparison when evaluating if two sites are same-site. See https://www.chromium.org/administrators/policy-list-3/cookie-legacy-samesite-policies for full description.\r\n\r\nFor cookies on domains not covered by the patterns specified here, or for all cookies if this policy is not set, the global default value will be the user's personal configuration.\r\n\r\nFor detailed information on valid patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.\r\n\r\nNote that patterns you list here are treated as domains, not URLs, so you should not specify a scheme or port.\r\n\r\nExample value:\r\n\r\nwww.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_legacysamesitecookiebehaviorenabledfordomainlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_legacysamesitecookiebehaviorenabledfordomainlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_legacysamesitecookiebehaviorenabledfordomainlist_legacysamesitecookiebehaviorenabledfordomainlistdesc","displayName":"Revert to legacy SameSite behavior for cookies on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_notificationsallowedforurls","displayName":"Allow notifications on these sites","description":"Setting the policy lets you set a list of URL patterns that specify the sites that can display notifications.\r\n\r\nLeaving the policy unset means DefaultNotificationsSetting applies for all sites, if it's set. If not, the user's personal setting applies.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_notificationsallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_notificationsallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_notificationsallowedforurls_notificationsallowedforurlsdesc","displayName":"Allow notifications on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_notificationsblockedforurls","displayName":"Block notifications on these sites","description":"Setting the policy lets you set a list of URL patterns that specify the sites that can't display notifications.\r\n\r\nLeaving the policy unset means DefaultNotificationsSetting applies for all sites, if it's set. If not, the user's personal setting applies.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_notificationsblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_notificationsblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_notificationsblockedforurls_notificationsblockedforurlsdesc","displayName":"Block notifications on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_popupsallowedforurls","displayName":"Allow popups on these sites","description":"Setting the policy lets you set a list of URL patterns that specify the sites that can open pop-ups.\r\n\r\nLeaving the policy unset means DefaultPopupsSetting applies for all sites, if it's set. If not, the user's personal setting applies.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_popupsallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_popupsallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_popupsallowedforurls_popupsallowedforurlsdesc","displayName":"Allow popups on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_popupsblockedforurls","displayName":"Block popups on these sites","description":"Setting the policy lets you set a list of URL patterns that specify the sites that can't open pop-ups.\r\n\r\nLeaving the policy unset means DefaultPopupsSetting applies for all sites, if it's set. If not, the user's personal setting applies.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_popupsblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_popupsblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_popupsblockedforurls_popupsblockedforurlsdesc","displayName":"Block popups on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_sensorsallowedforurls","displayName":"Allow access to sensors on these sites","description":"Setting the policy lets you set a list of URL patterns that specify the sites that can access sensors like motion and light sensors.\r\n\r\nLeaving the policy unset means DefaultSensorsSetting applies for all sites, if it's set. If not, the user's personal setting applies.\r\n\r\nIf the same URL pattern exists in both this policy and the SensorsBlockedForUrls policy, the latter is prioritized and access to motion or light sensors will be blocked.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_sensorsallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_sensorsallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_sensorsallowedforurls_sensorsallowedforurlsdesc","displayName":"Allow access to sensors on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_sensorsblockedforurls","displayName":"Block access to sensors on these sites","description":"Setting the policy lets you set a list of URL patterns that specify the sites that can't access sensors like motion and light sensors.\r\n\r\nLeaving the policy unset means DefaultSensorsSetting applies for all sites, if it's set. If not, the user's personal setting applies.\r\n\r\nIf the same URL pattern exists in both this policy and the SensorsAllowedForUrls policy, this policy is prioritized and access to motion or light sensors will be blocked.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_sensorsblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_sensorsblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_sensorsblockedforurls_sensorsblockedforurlsdesc","displayName":"Block access to sensors on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_serialallowallportsforurls","displayName":"Automatically grant permission to sites to connect all serial ports.","description":"Setting the policy allows you to list sites which are automatically granted permission to access all available serial ports.\r\n\r\nThe URLs must be valid, otherwise the policy is ignored. Only the origin (scheme, host and port) of the URL is considered.\r\n\r\nOn Chrome OS, this policy only applies to affiliated users.\r\n\r\nThis policy overrides DefaultSerialGuardSetting, SerialAskForUrls, SerialBlockedForUrls and the user's preferences.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_serialallowallportsforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_serialallowallportsforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_serialallowallportsforurls_serialallowallportsforurlsdesc","displayName":"Automatically grant permission to sites to connect all serial ports. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_serialallowusbdevicesforurls","displayName":"Automatically grant permission to sites to connect to USB serial devices.","description":"Setting the policy allows you to list sites which are automatically granted permission to access USB serial devices with vendor and product IDs matching the vendor_id and product_id fields. Omitting the product_id field allows the given sites permission to access devices with a vendor ID matching the vendor_id field and any product ID.\r\n\r\nThe URLs must be valid, otherwise the policy is ignored. Only the origin (scheme, host and port) of the URL is considered.\r\n\r\nOn Chrome OS, this policy only applies to affiliated users.\r\n\r\nThis policy overrides DefaultSerialGuardSetting, SerialAskForUrls, SerialBlockedForUrls and the user's preferences.\r\n\r\nThis policy only affects access to USB devices through the Web Serial API. To grant access to USB devices through the WebUSB API see the WebUsbAllowDevicesForUrls policy.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=SerialAllowUsbDevicesForUrls for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"devices\": [\r\n {\r\n \"vendor_id\": 1234,\r\n \"product_id\": 5678\r\n }\r\n ],\r\n \"urls\": [\r\n \"https://specific-device.example.com\"\r\n ]\r\n },\r\n {\r\n \"devices\": [\r\n {\r\n \"vendor_id\": 1234\r\n }\r\n ],\r\n \"urls\": [\r\n \"https://all-vendor-devices.example.com\"\r\n ]\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_serialallowusbdevicesforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_serialallowusbdevicesforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_serialallowusbdevicesforurls_serialallowusbdevicesforurls","displayName":"Automatically grant permission to sites to connect to USB serial devices. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_serialaskforurls","displayName":"Allow the Serial API on these sites","description":"Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them access to a serial port.\r\n\r\nLeaving the policy unset means DefaultSerialGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.\r\n\r\nFor URL patterns which do not match the policy SerialBlockedForUrls (if there is a match), DefaultSerialGuardSetting (if set), or the users' personal settings take precedence, in that order.\r\n\r\nURL patterns must not conflict with SerialBlockedForUrls. Neither policy takes precedence if a URL matches with both.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_serialaskforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_serialaskforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_serialaskforurls_serialaskforurlsdesc","displayName":"Allow the Serial API on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_serialblockedforurls","displayName":"Block the Serial API on these sites","description":"Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them access to a serial port.\r\n\r\nLeaving the policy unset means DefaultSerialGuardSetting applies for all sites, if it's set. If not, the user's personal setting applies.\r\n\r\nFor URL patterns which do not match the policy SerialAskForUrls (if there is a match), DefaultSerialGuardSetting (if set), or the users' personal settings take precedence, in that order.\r\n\r\nURL patterns can't conflict with SerialAskForUrls. Neither policy takes precedence if a URL matches with both.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_serialblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_serialblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_serialblockedforurls_serialblockedforurlsdesc","displayName":"Block the Serial API on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_webusballowdevicesforurls","displayName":"Automatically grant permission to these sites to connect to USB devices with the given vendor and product IDs.","description":"Setting the policy lets you list the URL patterns that specify which sites are automatically granted permission to access a USB device with the given vendor and product IDs. Each item in the list requires both devices and urls fields for the policy to be valid. Each item in the devices field can have a vendor_id and product_id field. Omitting the vendor_id field will create a policy matching any device. Omitting the product_id field will create a policy matching any device with the given vendor ID. A policy which has a product_id field without a vendor_id field is invalid.\r\n\r\nThe USB permission model will grant the specified URL permission to access the USB device as a top-level origin. If embedded frames need to access USB devices, the 'usb' feature-policy header should be used to grant access. The URL must be valid, otherwise the policy is ignored.\r\n\r\nDeprecated: The USB permission model used to support specifying both the requesting and embedding URLs. This is deprecated and only supported for backwards compatiblity in this manner: if both a requesting and embedding URL is specified, then the embedding URL will be granted the permission as top-level origin and the requsting URL will be ignored entirely.\r\n\r\nThis policy overrides DefaultWebUsbGuardSetting, WebUsbAskForUrls, WebUsbBlockedForUrls and the user's preferences.\r\n\r\nThis policy only affects access to USB devices through the WebUSB API. To grant access to USB devices through the Web Serial API see the SerialAllowUsbDevicesForUrls policy.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=WebUsbAllowDevicesForUrls for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"devices\": [\r\n {\r\n \"vendor_id\": 1234,\r\n \"product_id\": 5678\r\n }\r\n ],\r\n \"urls\": [\r\n \"https://google.com\"\r\n ]\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_webusballowdevicesforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_webusballowdevicesforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_webusballowdevicesforurls_webusballowdevicesforurls","displayName":"Automatically grant permission to these sites to connect to USB devices with the given vendor and product IDs. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_webusbaskforurls","displayName":"Allow WebUSB on these sites","description":"Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them access to a USB device.\r\n\r\nLeaving the policy unset means DefaultWebUsbGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.\r\n\r\nURL patterns must not conflict with WebUsbAskForUrls. Neither policy takes precedence if a URL matches with both.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_webusbaskforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_webusbaskforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_webusbaskforurls_webusbaskforurlsdesc","displayName":"Allow WebUSB on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_webusbblockedforurls","displayName":"Block WebUSB on these sites","description":"Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them access to a USB device.\r\n\r\nLeaving the policy unset means DefaultWebUsbGuardSetting applies for all sites, if it's set. If not, the user's personal setting applies.\r\n\r\nURL patterns can't conflict with WebUsbAskForUrls. Neither policy takes precedence if a URL matches with both.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_webusbblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_webusbblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~contentsettings_webusbblockedforurls_webusbblockedforurlsdesc","displayName":"Block WebUSB on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovideralternateurls","displayName":"List of alternate URLs for the default search provider","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderAlternateURLs specifies a list of alternate URLs for extracting search terms from the search engine. The URLs should include the string '{searchTerms}'.\r\n\r\nLeaving DefaultSearchProviderAlternateURLs unset means no alternate URLs are used to extract search terms.\r\n\r\nExample value:\r\n\r\nhttps://search.my.company/suggest#q={searchTerms}\r\nhttps://search.my.company/suggest/search#q={searchTerms}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovideralternateurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovideralternateurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovideralternateurls_defaultsearchprovideralternateurlsdesc","displayName":"List of alternate URLs for the default search provider (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderenabled","displayName":"Enable the default search provider","description":"Setting the policy to Enabled means a default search is performed when a user enters non-URL text in the address bar. To specify the default search provider, set the rest of the default search policies. If you leave those policies empty, the user can choose the default provider. Setting the policy to Disabled means there's no search when the user enters non-URL text in the address bar.\r\n\r\nIf you set the policy, users can't change it in Google Chrome. If not set, the default search provider is on, and users can set the search provider list.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderencodings","displayName":"Default search provider encodings","description":"If DefaultSearchProviderEnabled is on, setting DefaultSearchProviderEncodings specifies the character encodings supported by the search provider. Encodings are code page names such as UTF-8, GB2312, and ISO-8859-1. They're tried in the order provided.\r\n\r\nLeaving DefaultSearchProviderEncodings unset puts UTF-8 in use.\r\n\r\nExample value:\r\n\r\nUTF-8\r\nUTF-16\r\nGB2312\r\nISO-8859-1","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderencodings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderencodings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderencodings_defaultsearchproviderencodingsdesc","displayName":"Default search provider encodings (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidericonurl","displayName":"Default search provider icon","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderIconURL specifies the default search provider's favorite icon URL.\r\n\r\nLeaving DefaultSearchProviderIconURL unset means there's no icon for the search provider.\r\n\r\nExample value: https://search.my.company/favicon.ico","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidericonurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidericonurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidericonurl_defaultsearchprovidericonurl","displayName":"Default search provider icon (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderimageurl","displayName":"Parameter providing search-by-image feature for the default search provider","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderImageURL specifies the URL of the search engine used for image search. (If DefaultSearchProviderImageURLPostParams is set, then image search requests use the POST method instead.)\r\n\r\nLeaving DefaultSearchProviderImageURL unset means no image search is used.\r\n\r\nExample value: https://search.my.company/searchbyimage/upload","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderimageurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderimageurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderimageurl_defaultsearchproviderimageurl","displayName":"Parameter providing search-by-image feature for the default search provider (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderimageurlpostparams","displayName":"Parameters for image URL which uses POST","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderImageURLPostParams specifies the parameters during image search with POST. It consists of comma-separated, name-value pairs. If a value is a template parameter, such as {imageThumbnail}, real image thumbnail data replaces it.\r\n\r\nLeaving DefaultSearchProviderImageURLPostParams unset means image search request is sent using the GET method.\r\n\r\nExample value: content={imageThumbnail},url={imageURL},sbisrc={SearchSource}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderimageurlpostparams_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderimageurlpostparams_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderimageurlpostparams_defaultsearchproviderimageurlpostparams","displayName":"Parameters for image URL which uses POST (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderkeyword","displayName":"Default search provider keyword","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderKeyword specifies the keyword or shortcut used in the address bar to trigger the search for this provider.\r\n\r\nLeaving DefaultSearchProviderKeyword unset means no keyword activates the search provider.\r\n\r\nExample value: mis","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderkeyword_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderkeyword_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchproviderkeyword_defaultsearchproviderkeyword","displayName":"Default search provider keyword (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidername","displayName":"Default search provider name","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderName specifies the default search provider's name.\r\n\r\nLeaving DefaultSearchProviderName unset means the hostname specified by the search URL is used.\r\n\r\nExample value: My Intranet Search","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidername_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidername_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidername_defaultsearchprovidername","displayName":"Default search provider name (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidernewtaburl","displayName":"Default search provider new tab page URL","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderNewTabURL specifies the URL of the search engine used to provide a New Tab page.\r\n\r\nLeaving DefaultSearchProviderNewTabURL unset means no new tab page is provided.\r\n\r\nExample value: https://search.my.company/newtab","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidernewtaburl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidernewtaburl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidernewtaburl_defaultsearchprovidernewtaburl","displayName":"Default search provider new tab page URL (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidersearchurl","displayName":"Default search provider search URL","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSearchURL specifies the URL of the search engine used during a default search. The URL should include the string '{searchTerms}', replaced in the query by the user's search terms.\r\n\r\nYou can specify Google's search URL as: '{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}ie={inputEncoding}'.\r\n\r\nExample value: https://search.my.company/search?q={searchTerms}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidersearchurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidersearchurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidersearchurl_defaultsearchprovidersearchurl","displayName":"Default search provider search URL (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidersearchurlpostparams","displayName":"Parameters for search URL which uses POST","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSearchURLPostParams specifies the parameters when searching a URL with POST. It consists of comma-separated, name-value pairs. If a value is a template parameter, such as '{searchTerms}', real search terms data replaces it.\r\n\r\nLeaving DefaultSearchProviderSearchURLPostParams unset means search requests are sent using the GET method.\r\n\r\nExample value: q={searchTerms},ie=utf-8,oe=utf-8","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidersearchurlpostparams_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidersearchurlpostparams_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidersearchurlpostparams_defaultsearchprovidersearchurlpostparams","displayName":"Parameters for search URL which uses POST (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidersuggesturl","displayName":"Default search provider suggest URL","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSuggestURL specifies the URL of the search engine to provide search suggestions. The URL should include the string '{searchTerms}', replaced in the query by the user's search terms.\r\n\r\nYou can specify Google's search URL as: '{google:baseURL}complete/search?output=chrome&q={searchTerms}'.\r\n\r\nExample value: https://search.my.company/suggest?q={searchTerms}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidersuggesturl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidersuggesturl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidersuggesturl_defaultsearchprovidersuggesturl","displayName":"Default search provider suggest URL (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidersuggesturlpostparams","displayName":"Parameters for suggest URL which uses POST","description":"If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSuggestURLPostParams specifies the parameters during suggestion search with POST. It consists of comma-separated, name-value pairs. If a value is a template parameter, such as '{searchTerms}', real search terms data replaces it.\r\n\r\nLeaving DefaultSearchProviderSuggestURLPostParams unset unset means suggest search requests are sent using the GET method.\r\n\r\nExample value: q={searchTerms},ie=utf-8,oe=utf-8","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidersuggesturlpostparams_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidersuggesturlpostparams_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~defaultsearchprovider_defaultsearchprovidersuggesturlpostparams_defaultsearchprovidersuggesturlpostparams","displayName":"Parameters for suggest URL which uses POST (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_authnegotiatedelegatewhitelist","displayName":"Kerberos delegation server whitelist","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value: foobar.example.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_authnegotiatedelegatewhitelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_authnegotiatedelegatewhitelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_authnegotiatedelegatewhitelist_authnegotiatedelegatewhitelist","displayName":"Kerberos delegation server whitelist (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_authserverwhitelist","displayName":"Authentication server whitelist","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value: *.example.com,example.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_authserverwhitelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_authserverwhitelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_authserverwhitelist_authserverwhitelist","displayName":"Authentication server whitelist (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_autofillenabled","displayName":"Enable AutoFill","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_autofillenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_autofillenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_autoplaywhitelist","displayName":"Allow media autoplay on a whitelist of URL patterns","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_autoplaywhitelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_autoplaywhitelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_autoplaywhitelist_autoplaywhitelistdesc","displayName":"Allow media autoplay on a whitelist of URL patterns (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_defaultmediastreamsetting","displayName":"Default mediastream setting","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_defaultmediastreamsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_defaultmediastreamsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_defaultmediastreamsetting_defaultmediastreamsetting","displayName":"Default mediastream setting (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_defaultmediastreamsetting_defaultmediastreamsetting_2","displayName":"Do not allow any site to access the camera and microphone","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_defaultmediastreamsetting_defaultmediastreamsetting_3","displayName":"Ask every time a site wants to access the camera and/or microphone","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_developertoolsdisabled","displayName":"Disable Developer Tools","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_developertoolsdisabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_developertoolsdisabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_disabledschemes","displayName":"Disable URL protocol schemes","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value:\r\n\r\nfile\r\nhttps","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_disabledschemes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_disabledschemes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_disabledschemes_disabledschemesdesc","displayName":"List of disabled protocol schemes (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_extensioninstallblacklist","displayName":"Configure extension installation blacklist","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value:\r\n\r\nextension_id1\r\nextension_id2","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_extensioninstallblacklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_extensioninstallblacklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_extensioninstallblacklist_extensioninstallblacklistdesc","displayName":"Extension IDs the user should be prevented from installing (or * for all) (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_extensioninstallwhitelist","displayName":"Configure extension installation whitelist","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value:\r\n\r\nextension_id1\r\nextension_id2","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_extensioninstallwhitelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_extensioninstallwhitelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_extensioninstallwhitelist_extensioninstallwhitelistdesc","displayName":"Extension IDs to exempt from the blacklist (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_forcebrowsersignin","displayName":"Enable force sign in for Google Chrome","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_forcebrowsersignin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_forcebrowsersignin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_forcesafesearch","displayName":"Force SafeSearch","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_forcesafesearch_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_forcesafesearch_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_forceyoutubesafetymode","displayName":"Force YouTube Safety Mode","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_forceyoutubesafetymode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_forceyoutubesafetymode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_incognitoenabled","displayName":"Enable Incognito mode","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_incognitoenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_incognitoenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_javascriptenabled","displayName":"Enable JavaScript","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_javascriptenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_javascriptenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_nativemessagingblacklist","displayName":"Configure native messaging blocklist","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value:\r\n\r\ncom.native.messaging.host.name1\r\ncom.native.messaging.host.name2","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_nativemessagingblacklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_nativemessagingblacklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_nativemessagingblacklist_nativemessagingblacklistdesc","displayName":"Names of the forbidden native messaging hosts (or * for all) (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_nativemessagingwhitelist","displayName":"Configure native messaging whitelist","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value:\r\n\r\ncom.native.messaging.host.name1\r\ncom.native.messaging.host.name2","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_nativemessagingwhitelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_nativemessagingwhitelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_nativemessagingwhitelist_nativemessagingwhitelistdesc","displayName":"Names of the native messaging hosts to exempt from the blocklist (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_nativewindowocclusionenabled","displayName":"Enable Native Window Occlusion","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_nativewindowocclusionenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_nativewindowocclusionenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxybypasslist","displayName":"Proxy bypass rules","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value: https://www.example1.com,https://www.example2.com,https://internalsite/","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxybypasslist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxybypasslist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxybypasslist_proxybypasslist","displayName":"Comma-separated list of proxy bypass rules (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxymode","displayName":"Choose how to specify proxy server settings","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value: direct","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxymode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxymode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxymode_proxymode","displayName":"Choose how to specify proxy server settings (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxymode_proxymode_direct","displayName":"Never use a proxy","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxymode_proxymode_auto_detect","displayName":"Auto detect proxy settings","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxymode_proxymode_pac_script","displayName":"Use a .pac proxy script","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxymode_proxymode_fixed_servers","displayName":"Use fixed proxy servers","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxymode_proxymode_system","displayName":"Use system proxy settings","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxypacurl","displayName":"URL to a proxy .pac file","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value: https://internal.site/example.pac","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxypacurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxypacurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxypacurl_proxypacurl","displayName":"URL to a proxy .pac file (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxyserver","displayName":"Address or URL of proxy server","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value: 123.123.123.123:8080","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxyserver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxyserver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxyserver_proxyserver","displayName":"Address or URL of proxy server (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxyservermode","displayName":"Choose how to specify proxy server settings","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxyservermode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxyservermode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxyservermode_proxyservermode","displayName":"Choose how to specify proxy server settings (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxyservermode_proxyservermode_0","displayName":"Never use a proxy","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxyservermode_proxyservermode_1","displayName":"Auto detect proxy settings","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxyservermode_proxyservermode_2","displayName":"Manually specify proxy settings","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_proxyservermode_proxyservermode_3","displayName":"Use system proxy settings","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_remoteaccesshostclientdomain","displayName":"Configure the required domain name for remote access clients","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value: my-awesome-domain.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_remoteaccesshostclientdomain_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_remoteaccesshostclientdomain_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_remoteaccesshostclientdomain_remoteaccesshostclientdomain","displayName":"Configure the required domain name for remote access clients (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_remoteaccesshostdomain","displayName":"Configure the required domain name for remote access hosts","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value: my-awesome-domain.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_remoteaccesshostdomain_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_remoteaccesshostdomain_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_remoteaccesshostdomain_remoteaccesshostdomain","displayName":"Configure the required domain name for remote access hosts (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_safebrowsingenabled","displayName":"Enable Safe Browsing","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_safebrowsingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_safebrowsingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_safebrowsingwhitelistdomains","displayName":"Configure the list of domains on which Safe Browsing will not trigger warnings.","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value:\r\n\r\nmydomain.com\r\nmyuniversity.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_safebrowsingwhitelistdomains_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_safebrowsingwhitelistdomains_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_safebrowsingwhitelistdomains_safebrowsingwhitelistdomainsdesc","displayName":"Configure the list of domains on which Safe Browsing will not trigger warnings. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_signinallowed","displayName":"Allow sign in to Google Chrome","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_signinallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_signinallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_spellchecklanguageblacklist","displayName":"Force disable spellcheck languages","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value:\r\n\r\nfr\r\nes","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_spellchecklanguageblacklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_spellchecklanguageblacklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_spellchecklanguageblacklist_spellchecklanguageblacklistdesc","displayName":"Force disable spellcheck languages (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_strictermixedcontenttreatmentenabled","displayName":"Enable stricter treatment for mixed content","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_strictermixedcontenttreatmentenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_strictermixedcontenttreatmentenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_unsafelytreatinsecureoriginassecure","displayName":"Origins or hostname patterns for which restrictions on\r\ninsecure origins should not apply","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value:\r\n\r\nhttp://testserver.example.com/\r\n*.example.org","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_unsafelytreatinsecureoriginassecure_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_unsafelytreatinsecureoriginassecure_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_unsafelytreatinsecureoriginassecure_unsafelytreatinsecureoriginassecuredesc","displayName":"Origins or hostname patterns for which restrictions on\r\ninsecure origins should not apply (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_urlblacklist","displayName":"Block access to a list of URLs","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value:\r\n\r\nexample.com\r\nhttps://ssl.server.com\r\nhosting.com/bad_path\r\nhttps://server:8080/path\r\n.exact.hostname.com\r\nfile://*\r\ncustom_scheme:*\r\n*","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_urlblacklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_urlblacklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_urlblacklist_urlblacklistdesc","displayName":"Block access to a list of URLs (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_urlwhitelist","displayName":"Allow access to a list of URLs","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value:\r\n\r\nexample.com\r\nhttps://ssl.server.com\r\nhosting.com/good_path\r\nhttps://server:8080/path\r\n.exact.hostname.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_urlwhitelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_urlwhitelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~deprecatedpolicies_urlwhitelist_urlwhitelistdesc","displayName":"Allow access to a list of URLs (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_blockexternalextensions","displayName":"Blocks external extensions from being installed","description":"Controls external extensions installation.\r\n\r\nEnabling this setting blocks external extensions from being installed.\r\n\r\nDisabling this setting or leaving it unset allows external extensions to be installed.\r\n\r\nExternal extensions and their installation are documented at https://developer.chrome.com/apps/external_extensions.\r\n","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_blockexternalextensions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_blockexternalextensions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensionallowedtypes","displayName":"Configure allowed app/extension types","description":"Setting the policy controls which apps and extensions may be installed in Google Chrome, which hosts they can interact with, and limits runtime access.\r\n\r\nLeaving the policy unset results in no restrictions on the acceptable extension and app types.\r\n\r\nExtensions and apps which have a type that's not on the list won't be installed. Each value should be one of these strings:\r\n\r\n* \"extension\"\r\n\r\n* \"theme\"\r\n\r\n* \"user_script\"\r\n\r\n* \"hosted_app\"\r\n\r\n* \"legacy_packaged_app\"\r\n\r\n* \"platform_app\"\r\n\r\nSee the Google Chrome extensions documentation for more information on these types.\r\n\r\nVersions earlier than 75 that use multiple comma separated extension IDs aren't supported and are skipped. The rest of the policy applies.\r\n\r\nNote: This policy also affects extensions and apps to be force-installed using ExtensionInstallForcelist.\r\n\r\nExample value:\r\n\r\nhosted_app","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensionallowedtypes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensionallowedtypes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensionallowedtypes_extensionallowedtypesdesc","displayName":"Types of extensions/apps that are allowed to be installed (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensioninstallallowlist","displayName":"Configure extension installation allow list","description":"Setting the policy specifies which extensions are not subject to the blocklist.\r\n\r\nA blocklist value of * means all extensions are blocked and users can only install extensions listed in the allow list.\r\n\r\nBy default, all extensions are allowed. But, if you prohibited extensions by policy, use the list of allowed extensions to change that policy.\r\n\r\nExample value:\r\n\r\nextension_id1\r\nextension_id2","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensioninstallallowlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensioninstallallowlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensioninstallallowlist_extensioninstallallowlistdesc","displayName":"Extension IDs to exempt from the blocklist (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensioninstallblocklist","displayName":"Configure extension installation blocklist","description":"Allows you to specify which extensions the users can NOT install. Extensions already installed will be disabled if blocked, without a way for the user to enable them. Once an extension disabled due to the blocklist is removed from it, it will automatically get re-enabled.\r\n\r\nA blocklist value of '*' means all extensions are blocked unless they are explicitly listed in the allowlist.\r\n\r\nIf this policy is left not set the user can install any extension in Google Chrome.\r\n\r\nExample value:\r\n\r\nextension_id1\r\nextension_id2","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensioninstallblocklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensioninstallblocklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensioninstallblocklist_extensioninstallblocklistdesc","displayName":"Extension IDs the user should be prevented from installing (or * for all) (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensioninstallforcelist","displayName":"Configure the list of force-installed apps and extensions","description":"Setting the policy specifies a list of apps and extensions that install silently, without user interaction, and which users can't uninstall or turn off. Permissions are granted implicitly, including for the enterprise.deviceAttributes and enterprise.platformKeys extension APIs. (These 2 APIs aren't available to apps and extensions that aren't force-installed.)\r\n\r\nLeaving the policy unset means no apps or extensions are autoinstalled, and users can uninstall any app or extension in Google Chrome.\r\n\r\nThis policy superseeds ExtensionInstallBlocklist policy. If a previously force-installed app or extension is removed from this list, Google Chrome automatically uninstalls it.\r\n\r\nOn Microsoft® Windows® instances, apps and extensions from outside the Chrome Web Store can only be forced installed if the instance is joined to a Microsoft® Active Directory® domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management.\r\n\r\nOn macOS instances, apps and extensions from outside the Chrome Web Store can only be force installed if the instance is managed via MDM, or joined to a domain via MCX.\r\n\r\nThe source code of any extension may be altered by users through developer tools, potentially rendering the extension dysfunctional. If this is a concern, set the DeveloperToolsDisabled policy.\r\n\r\nEach list item of the policy is a string that contains an extension ID and, optionally, an \"update\" URL separated by a semicolon (;). The extension ID is the 32-letter string found, for example, on chrome://extensions when in Developer mode. If specified, the \"update\" URL should point to an Update Manifest XML document ( https://developer.chrome.com/extensions/autoupdate ). By default, the Chrome Web Store's update URL is used. The \"update\" URL set in this policy is only used for the initial installation; subsequent updates of the extension use the update URL in the extension's manifest.\r\n\r\n Note: This policy doesn't apply to Incognito mode. Read about hosting extensions ( https://developer.chrome.com/extensions/hosting ).\r\n\r\nExample value:\r\n\r\naaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;https://clients2.google.com/service/update2/crx\r\nabcdefghijklmnopabcdefghijklmnop","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensioninstallforcelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensioninstallforcelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensioninstallforcelist_extensioninstallforcelistdesc","displayName":"Extension/App IDs and update URLs to be silently installed (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensioninstallsources","displayName":"Configure extension, app, and user script install sources","description":"Setting the policy specifies which URLs may install extensions, apps, and themes. Before Google Chrome 21, users could click on a link to a *.crx file, and Google Chrome would offer to install the file after a few warnings. Afterwards, such files must be downloaded and dragged to the Google Chrome settings page. This setting allows specific URLs to have the old, easier installation flow.\r\n\r\nEach item in this list is an extension-style match pattern (see https://developer.chrome.com/extensions/match_patterns). Users can easily install items from any URL that matches an item in this list. Both the location of the *.crx file and the page where the download is started from (the referrer) must be allowed by these patterns.\r\n\r\nExtensionInstallBlocklist takes precedence over this policy. That is, an extension on the blocklist won't be installed, even if it happens from a site on this list.\r\n\r\nExample value:\r\n\r\nhttps://corp.mycompany.com/*","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensioninstallsources_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensioninstallsources_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensioninstallsources_extensioninstallsourcesdesc","displayName":"URL patterns to allow extension, app, and user script installs from (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensionsettings","displayName":"Extension management settings","description":"Setting the policy controls extension management settings for Google Chrome, including any controlled by existing extension-related policies. The policy supersedes any legacy policies that might be set.\r\n\r\nThis policy maps an extension ID or an update URL to its specific setting only. A default configuration can be set for the special ID \"*\", which applies to all extensions without a custom configuration in this policy. With an update URL, configuration applies to extensions with the exact update URL stated in the extension manifest ( http://support.google.com/chrome/a?p=Configure_ExtensionSettings_policy ). If the 'override_update_url' flag is set to true, the extension is installed and updated using the \"update\" URL specified in the ExtensionInstallForcelist policy or in 'update_url' field in this policy. The flag 'override_update_url' is ignored if the 'update_url' is a Chrome Web Store url.\r\n\r\nNote: For Windows® instances not joined to a Microsoft® Active Directory® domain, forced installation is limited to apps and extensions listed in the Chrome Web Store.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ExtensionSettings for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n{\r\n \"abcdefghijklmnopabcdefghijklmnop\": {\r\n \"installation_mode\": \"allowed\",\r\n \"blocked_permissions\": [\r\n \"history\"\r\n ],\r\n \"minimum_version_required\": \"1.0.1\",\r\n \"toolbar_pin\": \"force_pinned\"\r\n },\r\n \"bcdefghijklmnopabcdefghijklmnopa\": {\r\n \"installation_mode\": \"force_installed\",\r\n \"update_url\": \"https://example.com/update_url\",\r\n \"allowed_permissions\": [\r\n \"downloads\"\r\n ],\r\n \"runtime_blocked_hosts\": [\r\n \"*://*.example.com\"\r\n ],\r\n \"runtime_allowed_hosts\": [\r\n \"*://good.example.com\"\r\n ]\r\n },\r\n \"cdefghijklmnopabcdefghijklmnopab\": {\r\n \"installation_mode\": \"blocked\",\r\n \"blocked_install_message\": \"Custom error message.\"\r\n },\r\n \"defghijklmnopabcdefghijklmnopabc,efghijklmnopabcdefghijklmnopabcd\": {\r\n \"installation_mode\": \"blocked\",\r\n \"blocked_install_message\": \"Custom error message.\"\r\n },\r\n \"update_url:https://www.example.com/update.xml\": {\r\n \"blocked_permissions\": [\r\n \"wallpaper\"\r\n ],\r\n \"allowed_permissions\": [\r\n \"downloads\"\r\n ],\r\n \"installation_mode\": \"allowed\"\r\n },\r\n \"fghijklmnopabcdefghijklmnopabcde\": {\r\n \"installation_mode\": \"removed\",\r\n \"blocked_install_message\": \"Custom removal message.\"\r\n },\r\n \"ghijklmnopabcdefghijklmnopabcdef\": {\r\n \"installation_mode\": \"force_installed\",\r\n \"update_url\": \"https://example.com/update_url\",\r\n \"override_update_url\": true\r\n },\r\n \"*\": {\r\n \"installation_mode\": \"blocked\",\r\n \"blocked_permissions\": [\r\n \"downloads\",\r\n \"bookmarks\"\r\n ],\r\n \"install_sources\": [\r\n \"https://company-intranet/chromeapps\"\r\n ],\r\n \"allowed_types\": [\r\n \"hosted_app\"\r\n ],\r\n \"runtime_blocked_hosts\": [\r\n \"*://*.example.com\"\r\n ],\r\n \"runtime_allowed_hosts\": [\r\n \"*://good.example.com\"\r\n ],\r\n \"blocked_install_message\": \"Custom error message.\"\r\n }\r\n}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensionsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensionsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~extensions_extensionsettings_extensionsettings","displayName":"Extension management settings (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~googlecast_enablemediarouter","displayName":"Enable Google Cast","description":"Setting the policy to Enabled or leaving it unset turns on Google Cast, which users can launch from the app menu, page context menus, media controls on Cast-enabled websites, and (if shown) the Cast toolbar icon.\r\n\r\nSetting the policy to Disabled turns off Google Cast.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~googlecast_enablemediarouter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~googlecast_enablemediarouter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~googlecast_showcasticonintoolbar","displayName":"Show the Google Cast toolbar icon","description":"Setting the policy to Enabled displays the Cast toolbar icon on the toolbar or the overflow menu, and users can't remove it.\r\n\r\nSetting the policy to Disabled or leaving it unset lets users pin or remove the icon through its contextual menu.\r\n\r\nIf the policy EnableMediaRouter is set to Disabled, then this policy's value has no effect, and the toolbar icon doesn't appear.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~googlecast_showcasticonintoolbar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~googlecast_showcasticonintoolbar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_allowcrossoriginauthprompt","displayName":"Cross-origin HTTP Authentication prompts","description":"Setting the policy to Enabled allows third-party images on a page to show an authentication prompt.\r\n\r\n Setting the policy to Disabled or leaving it unset renders third-party images unable to show an authentication prompt.\r\n\r\nTypically, this policy is Disabled as a phishing defense.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_allowcrossoriginauthprompt_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_allowcrossoriginauthprompt_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_authnegotiatedelegateallowlist","displayName":"Kerberos delegation server allowlist","description":"Setting the policy assigns servers that Google Chrome may delegate to. Separate multiple server names with commas. Wildcards, *, are allowed.\r\n\r\nLeaving the policy unset means Google Chrome won't delegate user credentials, even if a server is detected as intranet.\r\n\r\nExample value: foobar.example.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_authnegotiatedelegateallowlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_authnegotiatedelegateallowlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_authnegotiatedelegateallowlist_authnegotiatedelegateallowlist","displayName":"Kerberos delegation server allowlist (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_authschemes","displayName":"Supported authentication schemes","description":"Setting the policy specifies which HTTP authentication schemes Google Chrome supports.\r\n\r\nLeaving the policy unset employs all 4 schemes.\r\n\r\nValid values:\r\n\r\n* basic\r\n\r\n* digest\r\n\r\n* ntlm\r\n\r\n* negotiate\r\n\r\nNote: Separate multiple values with commas.\r\n\r\nExample value: basic,digest,ntlm,negotiate","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_authschemes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_authschemes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_authschemes_authschemes","displayName":"Supported authentication schemes (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_authserverallowlist","displayName":"Authentication server allowlist","description":"Setting the policy specifies which servers should be allowed for integrated authentication. Integrated authentication is only on when Google Chrome gets an authentication challenge from a proxy or from a server in this permitted list.\r\n\r\nLeaving the policy unset means Google Chrome tries to detect if a server is on the intranet. Only then will it respond to IWA requests. If a server is detected as internet, then Google Chrome ignores IWA requests from it.\r\n\r\nNote: Separate multiple server names with commas. Wildcards, *, are allowed.\r\n\r\nExample value: *.example.com,example.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_authserverallowlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_authserverallowlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_authserverallowlist_authserverallowlist","displayName":"Authentication server allowlist (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_basicauthoverhttpenabled","displayName":"Allow Basic authentication for HTTP","description":"Setting the policy to Enabled or leaving it unset will allow Basic authentication challenges received over non-secure HTTP.\r\n\r\nSetting the policy to Disabled forbids non-secure HTTP requests from using the Basic authentication scheme; only secure HTTPS is allowed.\r\n\r\nThis policy setting is ignored (and Basic is always forbidden) if the AuthSchemes policy is set and does not include Basic.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_basicauthoverhttpenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_basicauthoverhttpenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_disableauthnegotiatecnamelookup","displayName":"Disable CNAME lookup when negotiating Kerberos authentication","description":"Setting the policy to Enabled skips CNAME lookup. The server name is used as entered when generating the Kerberos SPN.\r\n\r\nSetting the policy to Disabled or leaving it unset means CNAME lookup determines the canonical name of the server when generating the Kerberos SPN.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_disableauthnegotiatecnamelookup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_disableauthnegotiatecnamelookup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_enableauthnegotiateport","displayName":"Include non-standard port in Kerberos SPN","description":"Setting the policy to Enabled and entering a nonstandard port (in other words, a port other than 80 or 443) includes it in the generated Kerberos SPN.\r\n\r\nSetting the policy to Disabled or leaving it unset means the generated Kerberos SPN won't include a port.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_enableauthnegotiateport_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~httpauthentication_enableauthnegotiateport_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~nativemessaging_nativemessagingallowlist","displayName":"Configure native messaging allowlist","description":"Setting the policy specifies which native messaging hosts aren't subject to the deny list. A deny list value of * means all native messaging hosts are denied, unless they're explicitly allowed.\r\n\r\nAll native messaging hosts are allowed by default. But, if all native messaging hosts are denied by policy, the admin can use the allow list to change that policy.\r\n\r\nExample value:\r\n\r\ncom.native.messaging.host.name1\r\ncom.native.messaging.host.name2","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~nativemessaging_nativemessagingallowlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~nativemessaging_nativemessagingallowlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~nativemessaging_nativemessagingallowlist_nativemessagingallowlistdesc","displayName":"Names of the native messaging hosts to exempt from the blocklist (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~nativemessaging_nativemessagingblocklist","displayName":"Configure native messaging blocklist","description":"Setting the policy specifies which native messaging hosts shouldn't be loaded. A deny list value of * means all native messaging hosts are denied, unless they're explicitly allowed.\r\n\r\nLeaving the policy unset means Google Chrome loads all installed native messaging hosts.\r\n\r\nExample value:\r\n\r\ncom.native.messaging.host.name1\r\ncom.native.messaging.host.name2","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~nativemessaging_nativemessagingblocklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~nativemessaging_nativemessagingblocklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~nativemessaging_nativemessagingblocklist_nativemessagingblocklistdesc","displayName":"Names of the forbidden native messaging hosts (or * for all) (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~nativemessaging_nativemessaginguserlevelhosts","displayName":"Allow user-level Native Messaging hosts (installed without admin permissions)","description":"Setting the policy to Enabled or leaving it unset means Google Chrome can use native messaging hosts installed at the user level.\r\n\r\nSetting the policy to Disabled means Google Chrome can only use these hosts if installed at the system level.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~nativemessaging_nativemessaginguserlevelhosts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~nativemessaging_nativemessaginguserlevelhosts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~other_promptonmultiplematchingcertificates","displayName":"Prompt for the client certificate when multiple certificates match.","description":"This policy controls whether the user is prompted to select a client certificate when more than one certificate matches AutoSelectCertificateForUrls.\r\nIf this policy is set to Enabled, the user is prompted to select a client certificate whenever the auto-selection policy matches multiple certificates.\r\nIf this policy is set to Disabled or not set, the user may only be prompted when no certificate matches the auto-selection.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~other_promptonmultiplematchingcertificates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~other_promptonmultiplematchingcertificates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~passwordmanager_passwordleakdetectionenabled","displayName":"Enable leak detection for entered credentials","description":"Setting the policy to Enabled lets users have Google Chrome check whether usernames and passwords entered were part of a leak.\r\n\r\nIf the policy is set, users can't change it in Google Chrome. If not set, credential leak checking is allowed, but the user can turn it off.\r\n\r\nThis behavior will not trigger if Safe Browsing is disabled (either by policy or by the user). In order to force Safe Browsing on, use the SafeBrowsingEnabled policy or the SafeBrowsingProtectionLevel policy.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~passwordmanager_passwordleakdetectionenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~passwordmanager_passwordleakdetectionenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~passwordmanager_passwordmanagerenabled","displayName":"Enable saving passwords to the password manager","description":"Setting the policy to Enabled means users have Google Chrome remember passwords and provide them the next time they sign in to a site.\r\n\r\nSetting the policy to Disabled means users can't save new passwords, but previously saved passwords will still work.\r\n\r\nIf the policy is set, users can't change it in Google Chrome. If not set, the user can turn off password saving.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~passwordmanager_passwordmanagerenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~passwordmanager_passwordmanagerenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_cloudprintproxyenabled","displayName":"Enable Google Cloud Print proxy","description":"Setting the policy to Enabled or leaving it unset lets Google Chrome act as a proxy between Google Cloud Print and legacy printers connected to the machine. Using their Google Account, users may turn on the cloud print proxy by authentication.\r\n\r\nSetting the policy to Disabled means users can't turn on the proxy, and the machine can't share its printers with Google Cloud Print.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_cloudprintproxyenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_cloudprintproxyenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_cloudprintsubmitenabled","displayName":"Enable submission of documents to Google Cloud Print","description":"Setting the policy to Enabled or leaving it unset lets users print to Google Cloud Print from the Google Chrome print dialog. Google Chrome can submit documents to Google Cloud Print for printing. This doesn't prevent users from submitting print jobs on websites.\r\n\r\nSetting the policy to Disabled means users can't print to Google Cloud Print from the Google Chrome print dialog.\r\n\r\nIn order to keep Google Cloud Print destinations discoverable, this policy must be set to Enabled and cloud must not be included in the PrinterTypeDenyList policy.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_cloudprintsubmitenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_cloudprintsubmitenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_defaultprinterselection","displayName":"Default printer selection rules","description":"Setting the policy sets the rules for selecting the default printer in Google Chrome, overriding the default rules. Printer selection occurs the first time users try to print, when Google Chrome seeks a printer matching the specified attributes. In case of a less than perfect match, Google Chrome can be set to select any matching printer, depending on the order printers are discovered.\r\n\r\nLeaving the policy unset or set to attributes for which there's no match means the built-in PDF printer is the default. If there's no PDF printer, Google Chrome defaults to none.\r\n\r\nPrinters connected to Google Cloud Print are considered \"cloud\", the rest of the printers are classified as \"local\".\r\n\r\nNote: Omitting a field means all values match. For example, not specifying connectivity causes Print Preview to start discovery of all kinds of printers, \"local\" and \"cloud\". Regular expression patterns must follow the JavaScript RegExp syntax, and matches are case sensistive.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=DefaultPrinterSelection for more information about schema and formatting.\r\n\r\n\r\nExample value: { \"kind\": \"cloud\", \"idPattern\": \".*public\", \"namePattern\": \".*Color\" }","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_defaultprinterselection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_defaultprinterselection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_defaultprinterselection_defaultprinterselection","displayName":"Default printer selection rules (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_disableprintpreview","displayName":"Disable Print Preview","description":"Setting the policy to Enabled has Google Chrome open the system print dialog instead of the built-in print preview when users request a printout.\r\n\r\nSetting the policy to Disabled or leaving it unset has print commands trigger the print preview screen.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_disableprintpreview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_disableprintpreview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printertypedenylist","displayName":"Disable printer types on the deny list","description":"The printers of types placed on the deny list will be disabled from being discovered or having their capabilities fetched.\r\n\r\nPlacing all printer types on the deny list effectively disables printing, as there would be no available destinations to send a document for printing.\r\n\r\nIncluding cloud on the deny list has the same effect as setting the CloudPrintSubmitEnabled policy to false. In order to keep Google Cloud Print destinations discoverable, the CloudPrintSubmitEnabled policy must be set to true and cloud must not be on the deny list.\r\n\r\nIf the policy is not set, or is set to an empty list, all printer types will be available for discovery.\r\n\r\nExtension printers are also known as print provider destinations, and include any destination that belongs to a Google Chrome extension.\r\n\r\nLocal printers are also known as native printing destinations, and include destinations available to the local machine and shared network printers.\r\n\r\nExample value:\r\n\r\ncloud\r\nprivet","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printertypedenylist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printertypedenylist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printertypedenylist_printertypedenylistdesc","displayName":"Disable printer types on the deny list (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printheaderfooter","displayName":"Print Headers and Footers","description":"Setting the policy to Enabled turns headers and footers on in print preview. Setting the policy to Disabled turns them off in print preview.\r\n\r\nIf you set the policy, users can't change it. If unset, users decides whether headers and footers appear.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printheaderfooter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printheaderfooter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingallowedbackgroundgraphicsmodes","displayName":"Restrict background graphics printing mode","description":"Restricts background graphics printing mode. Unset policy is treated as no restriction.\r\n\r\nExample value: enabled","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingallowedbackgroundgraphicsmodes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingallowedbackgroundgraphicsmodes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingallowedbackgroundgraphicsmodes_printingallowedbackgroundgraphicsmodes","displayName":"Restrict background graphics printing mode (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingallowedbackgroundgraphicsmodes_printingallowedbackgroundgraphicsmodes_any","displayName":"Allow printing both with and without background graphics","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingallowedbackgroundgraphicsmodes_printingallowedbackgroundgraphicsmodes_enabled","displayName":"Allow printing only with background graphics","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingallowedbackgroundgraphicsmodes_printingallowedbackgroundgraphicsmodes_disabled","displayName":"Allow printing only without background graphics","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingbackgroundgraphicsdefault","displayName":"Default background graphics printing mode","description":"Overrides default background graphics printing mode.\r\n\r\nExample value: enabled","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingbackgroundgraphicsdefault_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingbackgroundgraphicsdefault_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingbackgroundgraphicsdefault_printingbackgroundgraphicsdefault","displayName":"Default background graphics printing mode (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingbackgroundgraphicsdefault_printingbackgroundgraphicsdefault_enabled","displayName":"Enable background graphics printing mode by default","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingbackgroundgraphicsdefault_printingbackgroundgraphicsdefault_disabled","displayName":"Disable background graphics printing mode by default","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingenabled","displayName":"Enable printing","description":"Setting the policy to Enabled or leaving it unset lets users print in Google Chrome, and users can't change this setting.\r\n\r\nSetting the policy to Disabled means users can't print from Google Chrome. Printing is off in the three dots menu, extensions, and JavaScript applications.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingpapersizedefault","displayName":"Default printing page size","description":"Overrides default printing page size.\r\n\r\nname should contain one of the listed formats or 'custom' if required paper size is not in the list. If 'custom' value is provided custom_size property should be specified. It describes the desired height and width in micrometers. Otherwise custom_size property shouldn't be specified. Policy that violates these rules is ignored.\r\n\r\nIf the page size is unavailable on the printer chosen by the user this policy is ignored.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=PrintingPaperSizeDefault for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n{\r\n \"name\": \"custom\",\r\n \"custom_size\": {\r\n \"width\": 210000,\r\n \"height\": 297000\r\n }\r\n}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingpapersizedefault_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingpapersizedefault_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printingpapersizedefault_printingpapersizedefault","displayName":"Default printing page size (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printpdfasimageavailability","displayName":"Print PDF as Image Available","description":"Controls how Google Chrome makes the Print as image option available on Microsoft® Windows® and macOS when printing PDFs.\r\n\r\nWhen printing a PDF on Microsoft® Windows® or macOS, sometimes print jobs need to be rasterized to an image for certain printers to get correct looking output.\r\n\r\nWhen this policy is set to Enabled, Google Chrome will make the Print as image option available in the Print Preview when printing a PDF.\r\n\r\nWhen this policy is set to Disabled or not set Google Chrome the Print as image option will not be available to users in Print Preview and PDFs will be printed as usual without being rasterized to an image before being sent to the destination.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printpdfasimageavailability_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printpdfasimageavailability_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printpostscriptmode","displayName":"Print PostScript Mode","description":"Controls how Google Chrome prints on Microsoft® Windows®.\r\n\r\nWhen printing to a PostScript printer on Microsoft® Windows® different PostScript generation methods can affect printing performance.\r\n\r\nWhen this policy is set to Default, Google Chrome will use a set of default options when generating PostScript. For text in particular, text will always be rendered using Type 3 fonts.\r\n\r\nWhen this policy is set to Type42, Google Chrome will render text using Type 42 fonts if possible. This should increase printing speed for some PostScript printers.\r\n\r\nWhen this policy is not set, Google Chrome will be in Default mode.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printpostscriptmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printpostscriptmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printpostscriptmode_printpostscriptmode","displayName":"Print PostScript Mode (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printpostscriptmode_printpostscriptmode_0","displayName":"Default","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printpostscriptmode_printpostscriptmode_1","displayName":"Type42","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printpreviewusesystemdefaultprinter","displayName":"Use System Default Printer as Default","description":"Setting the policy to Enabled means Google Chrome uses the OS default printer as the default destination for print preview.\r\n\r\nSetting the policy to Disabled or leaving it unset means Google Chrome uses the most recently used printer as the default destination for print preview.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printpreviewusesystemdefaultprinter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printpreviewusesystemdefaultprinter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printrasterizationmode","displayName":"Print Rasterization Mode","description":"Controls how Google Chrome prints on Microsoft® Windows®.\r\n\r\nWhen printing to a non-PostScript printer on Microsoft® Windows®, sometimes print jobs need to be rasterized to print correctly.\r\n\r\nWhen this policy is set to Full, Google Chrome will do full page rasterization if necessary.\r\n\r\nWhen this policy is set to Fast, Google Chrome will avoid rasterization if possible, reducing the amount of rasterization can help reduce print job sizes and increase printing speed.\r\n\r\nWhen this policy is not set, Google Chrome will be in Full mode.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printrasterizationmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printrasterizationmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printrasterizationmode_printrasterizationmode","displayName":"Print Rasterization Mode (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printrasterizationmode_printrasterizationmode_0","displayName":"Full","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printrasterizationmode_printrasterizationmode_1","displayName":"Fast","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printrasterizepdfdpi","displayName":"Print Rasterize PDF DPI","description":"Controls print image resolution when Google Chrome prints PDFs with rasterization.\r\n\r\nWhen printing a PDF using the Print to image option, it can be beneficial to specify a print resolution other than a device's printer setting or the PDF default. A high resolution will significantly increase the processing and printing time while a low resolution can lead to poor imaging quality.\r\n\r\nThis policy allows a particular resolution to be specified for use when rasterizing PDFs for printing.\r\n\r\nIf this policy is set to zero or not set at all then the system default resolution will be used during rasterization of page images.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printrasterizepdfdpi_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printrasterizepdfdpi_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~printing_printrasterizepdfdpi_printrasterizepdfdpi","displayName":"Print Rasterize PDF DPI: (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostallowclientpairing","displayName":"Enable or disable PIN-less authentication for remote access hosts","description":"Setting the policy to Enabled or leaving it unset lets users pair clients and hosts at connection time, eliminating the need to enter a PIN every time.\r\n\r\nSetting the policy to Disabled makes this feature unavailable.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostallowclientpairing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostallowclientpairing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostallowfiletransfer","displayName":"Allow remote access users to transfer files to/from the host","description":"Setting the policy to Enabled or leaving it unset allows users connected to a remote access host to transfer files between the client and the host. This doesn't apply to remote assistance connections, which don't support file transfer.\r\n\r\nSetting the policy to Disabled disallows file transfer.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostallowfiletransfer_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostallowfiletransfer_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostallowrelayedconnection","displayName":"Enable the use of relay servers by the remote access host","description":"If RemoteAccessHostFirewallTraversal is set to Enabled, setting RemoteAccessHostAllowRelayedConnection to Enabled or leaving it unset allows the use of remote clients to use relay servers to connect to this machine when a direct connection is not available, for example, because of firewall restrictions.\r\n\r\nSetting the policy to Disabled doesn't turn remote access off, but only allows connections from the same network (not NAT traversal or relay).","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostallowrelayedconnection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostallowrelayedconnection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostallowremoteaccessconnections","displayName":"Allow remote access connections to this machine","description":"If this policy is Disabled, the remote access host service cannot be started or configured to accept incoming connections. This policy does not affect remote support scenarios.\r\n\r\nThis policy has no effect if it is set to Enabled, left empty, or is not set.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostallowremoteaccessconnections_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostallowremoteaccessconnections_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostallowremotesupportconnections","displayName":"Allow remote support connections to this machine","description":"If this policy is disabled, the remote support host cannot be started or configured to accept incoming connections.\r\n\r\nThis policy does not affect remote access scenarios.\r\n\r\nThis policy does not prevent enterprise admins from connecting to managed Chrome OS devices.\r\n\r\nThis policy has no effect if enabled, left empty, or is not set.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostallowremotesupportconnections_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostallowremotesupportconnections_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostallowuiaccessforremoteassistance","displayName":"Allow remote users to interact with elevated windows in remote assistance sessions","description":"Setting the policy to Enabled means the remote assistance host runs in a process with uiAccess permissions. This lets remote users interact with elevated windows on the local user's desktop.\r\n\r\nSetting the policy to Disabled or leaving it unset means the remote assistance host runs in the user's context, and remote users can't interact with elevated windows on the desktop.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostallowuiaccessforremoteassistance_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostallowuiaccessforremoteassistance_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostclientdomainlist","displayName":"Configure the required domain names for remote access clients","description":"Setting the policy specifies the client domain names that are imposed on remote access clients, and users can't change them. Only clients from one of the specified domains can connect to the host.\r\n\r\nSetting the policy to an empty list or leaving it unset applies the default policy for the connection type. For remote assistance, this allows clients from any domain to connect to the host. For anytime remote access, only the host owner can connect.\r\n\r\nSee also RemoteAccessHostDomainList.\r\n\r\nNote: This setting overrides RemoteAccessHostClientDomain, if present.\r\n\r\nExample value:\r\n\r\nmy-awesome-domain.com\r\nmy-auxiliary-domain.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostclientdomainlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostclientdomainlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostclientdomainlist_remoteaccesshostclientdomainlistdesc","displayName":"Configure the required domain names for remote access clients (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostclipboardsizebytes","displayName":"The maximum size, in bytes, that can be transferred between client and host via clipboard synchronization","description":"If this policy is set, clipboard data sent to and from the host will be truncated to the limit set by this policy.\r\n\r\nIf a value of 0 is set, then clipboard sync is disabled.\r\n\r\nThis policy affects both remote access and remote support scenarios.\r\n\r\nThis policy has no effect if it is not set.\r\n\r\nSetting the policy to a value that is not within the min/max range may prevent the host from starting.\r\n\r\nPlease note that the actual upper bound for the clipboard size is based on the maximum WebRTC data channel message size which this policy does not control.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostclipboardsizebytes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostclipboardsizebytes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostclipboardsizebytes_remoteaccesshostclipboardsizebytes","displayName":"The maximum size, in bytes, that can be transferred between client and host via clipboard synchronization: (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostdomainlist","displayName":"Configure the required domain names for remote access hosts","description":"Setting the policy specifies the host domain names that are imposed on remote access hosts, and users can't change them. Hosts can be shared only using accounts registered on one of the specified domain names.\r\n\r\nSetting the policy to an empty list or leaving it unset means hosts can be shared using any account.\r\n\r\nSee also RemoteAccessHostClientDomainList.\r\n\r\nNote: This setting will override RemoteAccessHostDomain, if present.\r\n\r\nExample value:\r\n\r\nmy-awesome-domain.com\r\nmy-auxiliary-domain.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostdomainlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostdomainlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostdomainlist_remoteaccesshostdomainlistdesc","displayName":"Configure the required domain names for remote access hosts (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostfirewalltraversal","displayName":"Enable firewall traversal from remote access host","description":"Setting the policy to Enabled or leaving it unset allows the usage of STUN servers, letting remote clients discover and connect to this machine, even if separated by a firewall.\r\n\r\nSetting the policy to Disabled when outgoing UDP connections are filtered by the firewall means the machine only allows connections from client machines within the local network.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostfirewalltraversal_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostfirewalltraversal_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostmaximumsessiondurationminutes","displayName":"Maximum session duration allowed for remote access connections","description":"If this policy is set, remote access connections will automatically disconnect after the number of minutes defined in the policy have elapsed. This does not prevent the client from reconnecting after the maximum session duration has been reached. Setting the policy to a value that is not within the min/max range may prevent the host from starting. This policy does not affect remote support scenarios.\r\n\r\nThis policy has no effect if it is not set. In this case, remote access connections will have no maximum duration on this machine.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostmaximumsessiondurationminutes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostmaximumsessiondurationminutes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostmaximumsessiondurationminutes_remoteaccesshostmaximumsessiondurationminutes","displayName":"Maximum session duration allowed for remote access connections: (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostrequirecurtain","displayName":"Enable curtaining of remote access hosts","description":"Setting the policy to Enabled turns off remote access hosts' physical input and output devices during a remote connection.\r\n\r\nSetting the policy to Disabled or leaving it unset lets both local and remote users interact with the host while it's shared.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostrequirecurtain_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostrequirecurtain_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostudpportrange","displayName":"Restrict the UDP port range used by the remote access host","description":"Setting the policy restricts the UDP port range used by the remote access host in this machine.\r\n\r\nLeaving the policy unset or set to an empty string means the remote access host can use any available port.\r\n\r\nNote: If RemoteAccessHostFirewallTraversal is Disabled, the remote access host will use UDP ports in the 12400-12409 range.\r\n\r\nExample value: 12400-12409","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostudpportrange_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostudpportrange_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~remoteaccess_remoteaccesshostudpportrange_remoteaccesshostudpportrange","displayName":"Restrict the UDP port range used by the remote access host (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_additionallaunchparameters","displayName":"Additional command line parameters for Google Chrome","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_additionallaunchparameters_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_additionallaunchparameters_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_additionallaunchparameters_additionallaunchparameters","displayName":"Additional command line parameters for Google Chrome (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_advancedprotectiondeepscanningenabled","displayName":"Enable sending downloads to Google for deep scanning for users enrolled in the Advanced Protection program","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_advancedprotectiondeepscanningenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_advancedprotectiondeepscanningenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_allowoutdatedplugins","displayName":"Allow running plugins that are outdated","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_allowoutdatedplugins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_allowoutdatedplugins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_allowpopupsduringpageunload","displayName":"Allows a page to show popups during its unloading","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_allowpopupsduringpageunload_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_allowpopupsduringpageunload_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_alwaysauthorizeplugins","displayName":"Always runs plugins that require authorization (deprecated)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_alwaysauthorizeplugins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_alwaysauthorizeplugins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_appcacheforceenabled","displayName":"Allows the AppCache feature to be re-enabled even if it is off by default.","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_appcacheforceenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_appcacheforceenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_chromeframecontenttypes","displayName":"Allow Google Chrome Frame to handle the listed content types","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_chromeframecontenttypes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_chromeframecontenttypes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_chromeframecontenttypes_chromeframecontenttypesdesc","displayName":"Allow Google Chrome Frame to handle the listed content types (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_chromeframerenderersettings","displayName":"Default HTML renderer for Google Chrome Frame","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_chromeframerenderersettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_chromeframerenderersettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_chromeframerenderersettings_chromeframerenderersettings","displayName":"Default HTML renderer for Google Chrome Frame (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_chromeframerenderersettings_chromeframerenderersettings_0","displayName":"Use the host browser by default","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_chromeframerenderersettings_chromeframerenderersettings_1","displayName":"Use Google Chrome Frame by default","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_clearsitedataonexit","displayName":"Clear site data on browser shutdown (deprecated)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_clearsitedataonexit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_clearsitedataonexit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_cloudprintwarningssuppressed","displayName":"Suppress Google Cloud Print deprecation messages","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_cloudprintwarningssuppressed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_cloudprintwarningssuppressed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_corslegacymodeenabled","displayName":"Use the legacy CORS implementation rather than new CORS","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_corslegacymodeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_corslegacymodeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_corsmitigationlist","displayName":"Enable CORS check mitigations in the new CORS implementation","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_corsmitigationlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_corsmitigationlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_corsmitigationlist_corsmitigationlistdesc","displayName":"Enable CORS check mitigations in the new CORS implementation (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultfilehandlingguardsetting","displayName":"Control use of the File Handling API","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultfilehandlingguardsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultfilehandlingguardsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultfilehandlingguardsetting_defaultfilehandlingguardsetting","displayName":"Control use of the File Handling API (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultfilehandlingguardsetting_defaultfilehandlingguardsetting_2","displayName":"Do not allow any web app to access file types via the File Handling API","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultfilehandlingguardsetting_defaultfilehandlingguardsetting_3","displayName":"Allow web apps to ask the user to grant access to file types via the File Handling API","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultkeygensetting","displayName":"Default key generation setting","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultkeygensetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultkeygensetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultkeygensetting_defaultkeygensetting","displayName":"Default key generation setting (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultkeygensetting_defaultkeygensetting_1","displayName":"Allow all sites to use key generation","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultkeygensetting_defaultkeygensetting_2","displayName":"Do not allow any site to use key generation","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultpluginssetting","displayName":"Default Flash setting","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultpluginssetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultpluginssetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultpluginssetting_defaultpluginssetting","displayName":"Default Flash setting (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultpluginssetting_defaultpluginssetting_1","displayName":"Allow all sites to automatically run the Flash plugin","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultpluginssetting_defaultpluginssetting_2","displayName":"Block the Flash plugin","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultpluginssetting_defaultpluginssetting_3","displayName":"Click to play","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultsearchproviderinstanturl","displayName":"Default search provider instant URL","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultsearchproviderinstanturl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultsearchproviderinstanturl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultsearchproviderinstanturl_defaultsearchproviderinstanturl","displayName":"Default search provider instant URL (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultsearchproviderinstanturlpostparams","displayName":"Parameters for instant URL which uses POST","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultsearchproviderinstanturlpostparams_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultsearchproviderinstanturlpostparams_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultsearchproviderinstanturlpostparams_defaultsearchproviderinstanturlpostparams","displayName":"Parameters for instant URL which uses POST (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultsearchprovidersearchtermsreplacementkey","displayName":"Parameter controlling search term placement for the default search provider","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultsearchprovidersearchtermsreplacementkey_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultsearchprovidersearchtermsreplacementkey_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_defaultsearchprovidersearchtermsreplacementkey_defaultsearchprovidersearchtermsreplacementkey","displayName":"Parameter controlling search term placement for the default search provider (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_dheenabled","displayName":"Enable DHE cipher suites in TLS","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_dheenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_dheenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_disabledplugins","displayName":"Specify a list of disabled plugins","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_disabledplugins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_disabledplugins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_disabledplugins_disabledpluginsdesc","displayName":"List of disabled plugins (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_disabledpluginsexceptions","displayName":"Specify a list of plugins that the user can enable or disable","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_disabledpluginsexceptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_disabledpluginsexceptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_disabledpluginsexceptions_disabledpluginsexceptionsdesc","displayName":"List of exceptions to the list of disabled plugins (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_disablepluginfinder","displayName":"Specify whether the plugin finder should be disabled (deprecated)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_disablepluginfinder_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_disablepluginfinder_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_disablespdy","displayName":"Disable SPDY protocol","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_disablespdy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_disablespdy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_disablesslrecordsplitting","displayName":"Disable TLS False Start","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_disablesslrecordsplitting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_disablesslrecordsplitting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_dnsprefetchingenabled","displayName":"Enable network prediction","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_dnsprefetchingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_dnsprefetchingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enablecommonnamefallbackforlocalanchors","displayName":"Allow certificates issued by local trust anchors without subjectAlternativeName extension","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enablecommonnamefallbackforlocalanchors_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enablecommonnamefallbackforlocalanchors_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enabledeprecatedprivetprinting","displayName":"Enable deprecated privet printing","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enabledeprecatedprivetprinting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enabledeprecatedprivetprinting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enabledeprecatedwebbasedsignin","displayName":"Enable the old web-based signin flow","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enabledeprecatedwebbasedsignin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enabledeprecatedwebbasedsignin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enabledeprecatedwebplatformfeatures","displayName":"Enable deprecated web platform features for a limited time","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enabledeprecatedwebplatformfeatures_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enabledeprecatedwebplatformfeatures_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enabledeprecatedwebplatformfeatures_enabledeprecatedwebplatformfeaturesdesc","displayName":"Enable deprecated web platform features for a limited time (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enabledplugins","displayName":"Specify a list of enabled plugins","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enabledplugins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enabledplugins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enabledplugins_enabledpluginsdesc","displayName":"List of enabled plugins (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enablesha1forlocalanchors","displayName":"Allow SHA-1 signed certificates issued by local trust anchors","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enablesha1forlocalanchors_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enablesha1forlocalanchors_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enablesymanteclegacyinfrastructure","displayName":"Enable trust in Symantec Corporation's Legacy PKI Infrastructure","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enablesymanteclegacyinfrastructure_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enablesymanteclegacyinfrastructure_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enterprisewebstorename","displayName":"Enterprise web store name (deprecated)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enterprisewebstorename_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enterprisewebstorename_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enterprisewebstorename_enterprisewebstorename","displayName":"Enterprise web store name (deprecated) (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enterprisewebstoreurl","displayName":"Enterprise web store URL (deprecated)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enterprisewebstoreurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enterprisewebstoreurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_enterprisewebstoreurl_enterprisewebstoreurl","displayName":"Enterprise web store URL (deprecated) (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_extensionallowinsecureupdates","displayName":"Allow insecure algorithms in integrity checks on extension updates and installs","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_extensionallowinsecureupdates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_extensionallowinsecureupdates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_filehandlingallowedforurls","displayName":"Allow the File Handling API on these web apps","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_filehandlingallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_filehandlingallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_filehandlingallowedforurls_filehandlingallowedforurlsdesc","displayName":"Allow the File Handling API on these web apps (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_filehandlingblockedforurls","displayName":"Block the File Handling API on these web apps","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_filehandlingblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_filehandlingblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_filehandlingblockedforurls_filehandlingblockedforurlsdesc","displayName":"Block the File Handling API on these web apps (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_forcelegacydefaultreferrerpolicy","displayName":"Use a default referrer policy of no-referrer-when-downgrade.","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_forcelegacydefaultreferrerpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_forcelegacydefaultreferrerpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_forcenetworkinprocess","displayName":"Force networking code to run in the browser process","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_forcenetworkinprocess_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_forcenetworkinprocess_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_gcfuserdatadir","displayName":"Set Google Chrome Frame user data directory","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_gcfuserdatadir_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_gcfuserdatadir_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_gcfuserdatadir_gcfuserdatadir","displayName":"Set user data directory (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_hidewebstorepromo","displayName":"Prevent app promotions from appearing on the new tab page","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_hidewebstorepromo_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_hidewebstorepromo_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_http09onnondefaultportsenabled","displayName":"Enable HTTP/0.9 support on non-default ports","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_http09onnondefaultportsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_http09onnondefaultportsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_instantenabled","displayName":"Enable Instant","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_instantenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_instantenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_keygenallowedforurls","displayName":"Allow key generation on these sites","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_keygenallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_keygenallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_keygenallowedforurls_keygenallowedforurlsdesc","displayName":"Allow key generation on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_keygenblockedforurls","displayName":"Block key generation on these sites","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_keygenblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_keygenblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_keygenblockedforurls_keygenblockedforurlsdesc","displayName":"Block key generation on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_legacysamesitecookiebehaviorenabled","displayName":"Default legacy SameSite cookie behavior setting","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_legacysamesitecookiebehaviorenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_legacysamesitecookiebehaviorenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_legacysamesitecookiebehaviorenabled_legacysamesitecookiebehaviorenabled","displayName":"Default legacy SameSite cookie behavior setting (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_legacysamesitecookiebehaviorenabled_legacysamesitecookiebehaviorenabled_1","displayName":"Revert to legacy SameSite behavior for cookies on all sites","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_legacysamesitecookiebehaviorenabled_legacysamesitecookiebehaviorenabled_2","displayName":"Use SameSite-by-default behavior for cookies on all sites","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_localdiscoveryenabled","displayName":"Enable chrome://devices","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_localdiscoveryenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_localdiscoveryenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_machinelevelusercloudpolicyenrollmenttoken","displayName":"The enrollment token of cloud policy on desktop","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_machinelevelusercloudpolicyenrollmenttoken_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_machinelevelusercloudpolicyenrollmenttoken_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_machinelevelusercloudpolicyenrollmenttoken_machinelevelusercloudpolicyenrollmenttoken","displayName":"The enrollment token of cloud policy on desktop (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_mediacachesize","displayName":"Set media disk cache size in bytes","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_mediacachesize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_mediacachesize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_mediacachesize_mediacachesize","displayName":"Set media disk cache size: (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_pachttpsurlstrippingenabled","displayName":"Enable PAC URL stripping (for https://)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_pachttpsurlstrippingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_pachttpsurlstrippingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_passwordmanagerallowshowpasswords","displayName":"Allow users to show passwords in Password Manager (deprecated)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_passwordmanagerallowshowpasswords_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_passwordmanagerallowshowpasswords_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_pluginsallowedforurls","displayName":"Allow the Flash plugin on these sites","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_pluginsallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_pluginsallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_pluginsallowedforurls_pluginsallowedforurlsdesc","displayName":"Allow the Flash plugin on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_pluginsblockedforurls","displayName":"Block the Flash plugin on these sites","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_pluginsblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_pluginsblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_pluginsblockedforurls_pluginsblockedforurlsdesc","displayName":"Block the Flash plugin on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_rc4enabled","displayName":"Enable RC4 cipher suites in TLS","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_rc4enabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_rc4enabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_remoteaccessclientfirewalltraversal","displayName":"Enable firewall traversal from remote access client","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_remoteaccessclientfirewalltraversal_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_remoteaccessclientfirewalltraversal_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_remoteaccesshostdebugoverridepolicies","displayName":"Policy overrides for Debug builds of the remote access host","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_remoteaccesshostdebugoverridepolicies_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_remoteaccesshostdebugoverridepolicies_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_remoteaccesshostdebugoverridepolicies_remoteaccesshostdebugoverridepolicies","displayName":"Policy overrides for Debug builds of the remote access host (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_remoteaccesshostrequiretwofactor","displayName":"Enable two-factor authentication for remote access hosts","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_remoteaccesshostrequiretwofactor_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_remoteaccesshostrequiretwofactor_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_remoteaccesshosttalkgadgetprefix","displayName":"Configure the TalkGadget prefix for remote access hosts","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_remoteaccesshosttalkgadgetprefix_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_remoteaccesshosttalkgadgetprefix_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_remoteaccesshosttalkgadgetprefix_remoteaccesshosttalkgadgetprefix","displayName":"Configure the TalkGadget prefix for remote access hosts (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_renderinchromeframelist","displayName":"Always render the following URL patterns in Google Chrome Frame","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_renderinchromeframelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_renderinchromeframelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_renderinchromeframelist_renderinchromeframelistdesc","displayName":"Always render the following URL patterns in Google Chrome Frame (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_renderinhostlist","displayName":"Always render the following URL patterns in the host browser","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_renderinhostlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_renderinhostlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_renderinhostlist_renderinhostlistdesc","displayName":"Always render the following URL patterns in the host browser (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_runallflashinallowmode","displayName":"Extend Flash content setting to all content (deprecated)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_runallflashinallowmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_runallflashinallowmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_safebrowsingextendedreportingoptinallowed","displayName":"Allow users to opt in to Safe Browsing extended reporting","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_safebrowsingextendedreportingoptinallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_safebrowsingextendedreportingoptinallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_skipmetadatacheck","displayName":"Skip the meta tag check in Google Chrome Frame","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_skipmetadatacheck_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_skipmetadatacheck_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_sslversionfallbackmin","displayName":"Minimum TLS version to fallback to","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_sslversionfallbackmin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_sslversionfallbackmin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_sslversionfallbackmin_sslversionfallbackmin","displayName":"Minimum TLS version to fallback to (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_sslversionfallbackmin_sslversionfallbackmin_tls1.1","displayName":"TLS 1.1","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_sslversionfallbackmin_sslversionfallbackmin_tls1.2","displayName":"TLS 1.2","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_sslversionmax","displayName":"Maximum SSL version enabled","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_sslversionmax_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_sslversionmax_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_sslversionmax_sslversionmax","displayName":"Maximum SSL version enabled (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_sslversionmax_sslversionmax_tls1.2","displayName":"TLS 1.2","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_sslversionmax_sslversionmax_tls1.3","displayName":"TLS 1.3","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_supervisedusercreationenabled","displayName":"Enable creation of supervised users","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_supervisedusercreationenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_supervisedusercreationenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_suppresschromeframeturndownprompt","displayName":"Suppress the Google Chrome Frame turndown prompt","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_suppresschromeframeturndownprompt_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_suppresschromeframeturndownprompt_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_tabfreezingenabled","displayName":"Allow background tabs freeze","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_tabfreezingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_tabfreezingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_tabunderallowed","displayName":"Allow sites to simultaneously navigate and open pop-ups","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_tabunderallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_tabunderallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_tls13hardeningforlocalanchorsenabled","displayName":"Enable a TLS 1.3 security feature for local trust anchors.","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_tls13hardeningforlocalanchorsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_tls13hardeningforlocalanchorsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_tripledesenabled","displayName":"Enable 3DES cipher suites in TLS","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_tripledesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_tripledesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_uselegacyformcontrols","displayName":"Use Legacy Form Controls until M84.","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_uselegacyformcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_uselegacyformcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_useragentclienthintsenabled","displayName":"Control the User-Agent Client Hints feature.","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_useragentclienthintsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_useragentclienthintsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_webcomponentsv0enabled","displayName":"Re-enable Web Components v0 API until M84.","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_webcomponentsv0enabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_webcomponentsv0enabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_webdriveroverridesincompatiblepolicies","displayName":"Allow WebDriver to Override Incompatible Policies","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_webdriveroverridesincompatiblepolicies_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_webdriveroverridesincompatiblepolicies_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_welcomepageonosupgradeenabled","displayName":"Enable showing the welcome page on the first browser launch following OS upgrade","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_welcomepageonosupgradeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~removedpolicies_welcomepageonosupgradeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_passwordprotectionchangepasswordurl","displayName":"Configure the change password URL.","description":"Setting the policy sets the URL for users to change their password after seeing a warning in the browser. The password protection service sends users to the URL (HTTP and HTTPS protocols only) you designate through this policy. For Google Chrome to correctly capture the salted hash of the new password on this change password page, make sure your change password page follows these guidelines ( https://www.chromium.org/developers/design-documents/create-amazing-password-forms ).\r\n\r\nTurning the policy off or leaving it unset means the service sends users to https://myaccount.google.com to change their password.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.\r\n\r\nExample value: https://mydomain.com/change_password.html","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_passwordprotectionchangepasswordurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_passwordprotectionchangepasswordurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_passwordprotectionchangepasswordurl_passwordprotectionchangepasswordurl","displayName":"Configure the change password URL. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_passwordprotectionloginurls","displayName":"Configure the list of enterprise login URLs where password protection service should capture salted hashes of passwords.","description":"Setting the policy sets the list of enterprise login URLs (HTTP and HTTPS protocols only). Password protection service will capture salted hashes of passwords on these URLs and use them for password reuse detection. For Google Chrome to correctly capture password salted hashes, ensure your sign-in pages follow these guidelines ( https://www.chromium.org/developers/design-documents/create-amazing-password-forms ).\r\n\r\nTurning this setting off or leaving it unset means the password protection service only captures the password salted hashes on https://accounts.google.com.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.\r\n\r\nExample value:\r\n\r\nhttps://mydomain.com/login.html\r\nhttps://login.mydomain.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_passwordprotectionloginurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_passwordprotectionloginurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_passwordprotectionloginurls_passwordprotectionloginurlsdesc","displayName":"Configure the list of enterprise login URLs where password protection service should capture salted hashes of passwords. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_passwordprotectionwarningtrigger","displayName":"Password protection warning trigger","description":"Setting the policy lets you control the triggering of password protection warning. Password protection alerts users when they reuse their protected password on potentially suspicious sites.\r\n\r\nUse PasswordProtectionLoginURLs and PasswordProtectionChangePasswordURL to set which password to protect.\r\n\r\nIf this policy is set to:\r\n\r\n* PasswordProtectionWarningOff, no password protection warning will be shown.\r\n\r\n* PasswordProtectionWarningOnPasswordReuse, password protection warning will be shown when the user reuses their protected password on a non-allowed site.\r\n\r\n* PasswordProtectionWarningOnPhishingReuse, password protection warning will be shown when the user reuses their protected password on a phishing site.\r\n\r\nLeaving the policy unset has the password protection service only protect Google passwords, but users can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_passwordprotectionwarningtrigger_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_passwordprotectionwarningtrigger_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_passwordprotectionwarningtrigger_passwordprotectionwarningtrigger","displayName":"Password protection warning trigger (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_passwordprotectionwarningtrigger_passwordprotectionwarningtrigger_0","displayName":"Password protection warning is off","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_passwordprotectionwarningtrigger_passwordprotectionwarningtrigger_1","displayName":"Password protection warning is triggered by password reuse","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_passwordprotectionwarningtrigger_passwordprotectionwarningtrigger_2","displayName":"Password protection warning is triggered by password reuse on phishing page","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_safebrowsingallowlistdomains","displayName":"Configure the list of domains on which Safe Browsing will not trigger warnings.","description":"Setting the policy to Enabled means Safe Browsing will trust the domains you designate. It won't check them for dangerous resources such as phishing, malware, or unwanted software. Safe Browsing's download protection service won't check downloads hosted on these domains. Its password protection service won't check for password reuse.\r\n\r\nLeaving the policy unset means default Safe Browsing protection applies to all resources.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.\r\n\r\nExample value:\r\n\r\nmydomain.com\r\nmyuniversity.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_safebrowsingallowlistdomains_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_safebrowsingallowlistdomains_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_safebrowsingallowlistdomains_safebrowsingallowlistdomainsdesc","displayName":"Configure the list of domains on which Safe Browsing will not trigger warnings. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_safebrowsingextendedreportingenabled","displayName":"Enable Safe Browsing Extended Reporting","description":"Setting the policy to Enabled turns on Google Chrome's Safe Browsing Extended Reporting, which sends some system information and page content to Google servers to help detect dangerous apps and sites.\r\n\r\nSetting the policy to Disabled means reports are never sent.\r\n\r\nIf you set this policy, users can't change it. If not set, users can decide whether to send reports or not.\r\n\r\nSee more about Safe Browsing ( https://developers.google.com/safe-browsing ).","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_safebrowsingextendedreportingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_safebrowsingextendedreportingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_safebrowsingprotectionlevel","displayName":"Safe Browsing Protection Level","description":"Allows you to control whether Google Chrome's Safe Browsing feature is enabled and the mode it operates in.\r\n\r\nIf this policy is set to 'NoProtection' (value 0), Safe Browsing is never active.\r\n\r\nIf this policy is set to 'StandardProtection' (value 1, which is the default), Safe Browsing is always active in the standard mode.\r\n\r\nIf this policy is set to 'EnhancedProtection' (value 2), Safe Browsing is always active in the enhanced mode, which provides better security, but requires sharing more browsing information with Google.\r\n\r\nIf you set this policy as mandatory, users cannot change or override the Safe Browsing setting in Google Chrome.\r\n\r\nIf this policy is left not set, Safe Browsing will operate in Standard Protection mode but users can change this setting.\r\n\r\nSee https://developers.google.com/safe-browsing for more info on Safe Browsing.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_safebrowsingprotectionlevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_safebrowsingprotectionlevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_safebrowsingprotectionlevel_safebrowsingprotectionlevel","displayName":"Safe Browsing Protection Level (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_safebrowsingprotectionlevel_safebrowsingprotectionlevel_0","displayName":"Safe Browsing is never active.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_safebrowsingprotectionlevel_safebrowsingprotectionlevel_1","displayName":"Safe Browsing is active in the standard mode.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~safebrowsing_safebrowsingprotectionlevel_safebrowsingprotectionlevel_2","displayName":"Safe Browsing is active in the enhanced mode. This mode provides better security, but requires sharing more browsing information with Google.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_sameorigintabcaptureallowedbyorigins","displayName":"Allow Same Origin Tab capture by these origins","description":"Setting the policy lets you set a list of URL patterns that can capture tabs with their same Origin.\r\n\r\nLeaving the policy unset means that sites will not be considered for an override at this level of capture.\r\n\r\nNote that windowed Chrome Apps with the same origin as this site will still be allowed to be captured.\r\n\r\nIf a site matches a URL pattern in this policy, the following policies will not be considered: TabCaptureAllowedByOrigins, WindowCaptureAllowedByOrigins, ScreenCaptureAllowedByOrigins, ScreenCaptureAllowed.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. This policy only matches based on origin, so any path in the URL pattern is ignored.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_sameorigintabcaptureallowedbyorigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_sameorigintabcaptureallowedbyorigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_sameorigintabcaptureallowedbyorigins_sameorigintabcaptureallowedbyoriginsdesc","displayName":"Allow Same Origin Tab capture by these origins (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_screencaptureallowed","displayName":"Allow or deny screen capture","description":"If enabled or not configured (default), a Web page can use\r\nscreen-share APIs (e.g., getDisplayMedia() or the Desktop Capture extension API)\r\nto prompt the user to select a tab, window or desktop to capture.\r\n\r\nWhen this policy is disabled, any calls to screen-share APIs will fail\r\nwith an error; however this policy is not considered (and a site will be\r\nallowed to use screen-share APIs) if the site matches an origin pattern in\r\nany of the following policies:\r\nScreenCaptureAllowedByOrigins,\r\nWindowCaptureAllowedByOrigins,\r\nTabCaptureAllowedByOrigins,\r\nSameOriginTabCaptureAllowedByOrigins.\r\n","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_screencaptureallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_screencaptureallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_screencaptureallowedbyorigins","displayName":"Allow Desktop, Window, and Tab capture by these origins","description":"Setting the policy lets you set a list of URL patterns that can use Desktop, Window, and Tab Capture.\r\n\r\nLeaving the policy unset means that sites will not be considered for an override at this level of Capture.\r\n\r\nThis policy is not considered if a site matches a URL pattern in any of the following policies: WindowCaptureAllowedByOrigins, TabCaptureAllowedByOrigins, SameOriginTabCaptureAllowedByOrigins.\r\n\r\nIf a site matches a URL pattern in this policy, the ScreenCaptureAllowed will not be considered.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. This policy only matches based on origin, so any path in the URL pattern is ignored.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_screencaptureallowedbyorigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_screencaptureallowedbyorigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_screencaptureallowedbyorigins_screencaptureallowedbyoriginsdesc","displayName":"Allow Desktop, Window, and Tab capture by these origins (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_tabcaptureallowedbyorigins","displayName":"Allow Tab capture by these origins","description":"Setting the policy lets you set a list of URL patterns that can use Tab Capture.\r\n\r\nLeaving the policy unset means that sites will not be considered for an override at this level of capture.\r\n\r\nNote that windowed Chrome Apps will still be allowed to be captured.\r\n\r\nThis policy is not considered if a site matches a URL pattern in the SameOriginTabCaptureAllowedByOrigins policy.\r\n\r\nIf a site matches a URL pattern in this policy, the following policies will not be considered: WindowCaptureAllowedByOrigins, ScreenCaptureAllowedByOrigins, ScreenCaptureAllowed.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. This policy only matches based on origin, so any path in the URL pattern is ignored.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_tabcaptureallowedbyorigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_tabcaptureallowedbyorigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_tabcaptureallowedbyorigins_tabcaptureallowedbyoriginsdesc","displayName":"Allow Tab capture by these origins (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_windowcaptureallowedbyorigins","displayName":"Allow Window and Tab capture by these origins","description":"Setting the policy lets you set a list of URL patterns that can use Window and Tab Capture.\r\n\r\nLeaving the policy unset means that sites will not be considered for an override at this level of Capture.\r\n\r\nThis policy is not considered if a site matches a URL pattern in any of the following policies: TabCaptureAllowedByOrigins, SameOriginTabCaptureAllowedByOrigins.\r\n\r\nIf a site matches a URL pattern in this policy, the following policies will not be considered: ScreenCaptureAllowedByOrigins, ScreenCaptureAllowed.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. This policy only matches based on origin, so any path in the URL pattern is ignored.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_windowcaptureallowedbyorigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_windowcaptureallowedbyorigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~screencapture_windowcaptureallowedbyorigins_windowcaptureallowedbyoriginsdesc","displayName":"Allow Window and Tab capture by these origins (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_homepageisnewtabpage","displayName":"Use New Tab Page as homepage","description":"Setting the policy to Enabled makes the New Tab page the user's homepage, ignoring any homepage URL location. Setting the policy to Disabled means that their homepage is never the New Tab page, unless the user's homepage URL is set to chrome://newtab.\r\n\r\nIf you set the policy, users can't change their homepage type in Google Chrome. If not set, the user decides whether or not the New Tab page is their homepage.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_homepageisnewtabpage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_homepageisnewtabpage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_homepagelocation","displayName":"Configure the home page URL","description":"Setting the policy sets the default homepage URL in Google Chrome. You open the homepage using the Home button. On desktop, the RestoreOnStartup policies control the pages that open on startup.\r\n\r\nIf the homepage is set to the New Tab Page, by the user or HomepageIsNewTabPage, this policy has no effect.\r\n\r\n The URL needs a standard scheme, such as http://example.com or https://example.com. When this policy is set, users can't change their homepage URL in Google Chrome.\r\n\r\nLeaving both HomepageLocation and HomepageIsNewTabPage unset lets users choose their homepage.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.\r\n\r\nExample value: https://www.chromium.org","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_homepagelocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_homepagelocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_homepagelocation_homepagelocation","displayName":"Home page URL (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_newtabpagelocation","displayName":"Configure the New Tab page URL","description":"Setting the policy configures the default New Tab page URL and prevents users from changing it.\r\n\r\nThe New Tab page opens with new tabs and windows.\r\n\r\nThis policy doesn't decide which pages open on start up. Those are controlled by the RestoreOnStartup policies. This policy does affect the homepage, if that's set to open the New Tab page, as well as the startup page if it's set to open the New Tab page.\r\n\r\nIt is a best practice to provide fully canonicalized URL, if the URL is not fully canonicalized Google Chrome will default to https://.\r\n\r\nLeaving the policy unset or empty puts the default New Tab page in use.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.\r\n\r\nExample value: https://www.chromium.org","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_newtabpagelocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_newtabpagelocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_newtabpagelocation_newtabpagelocation","displayName":"New Tab page URL (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_restoreonstartup","displayName":"Action on startup","description":"Setting the policy lets you specify system behavior on startup. Turning this setting off amounts to leaving it unset as Google Chrome must have specified start up behavior.\r\n\r\nIf you set the policy, users can't change it in Google Chrome. If not set, users can change it.\r\n\r\nSetting this policy to RestoreOnStartupIsLastSession turns off some settings that rely on sessions or that perform actions on exit, such as clearing browsing data on exit or session-only cookies.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_restoreonstartup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_restoreonstartup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_restoreonstartup_restoreonstartup","displayName":"Action on startup (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_restoreonstartup_restoreonstartup_5","displayName":"Open New Tab Page","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_restoreonstartup_restoreonstartup_1","displayName":"Restore the last session","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_restoreonstartup_restoreonstartup_4","displayName":"Open a list of URLs","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_restoreonstartupurls","displayName":"URLs to open on startup","description":"If RestoreOnStartup is set to RestoreOnStartupIsURLs, then setting RestoreOnStartupURLs to a list of URLs specify which URLs open.\r\n\r\nIf not set, the New Tab page opens on start up.\r\n\r\nOn Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.\r\n\r\nExample value:\r\n\r\nhttps://example.com\r\nhttps://www.chromium.org","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_restoreonstartupurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_restoreonstartupurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_restoreonstartupurls_restoreonstartupurlsdesc","displayName":"URLs to open on startup (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_showhomebutton","displayName":"Show Home button on toolbar","description":"Setting the policy to Enabled shows the Home button on Google Chrome's toolbar. Setting the policy to Disabled keeps the Home button from appearing.\r\n\r\nIf you set the policy, users can't change it in Google Chrome. If not set, users chooses whether to show the Home button.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_showhomebutton_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev1~policy~googlechrome~startup_showhomebutton_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_allowbackforwardcacheforcachecontrolnostorepageenabled","displayName":"Allow pages with Cache-Control: no-store header to enter back/forward cache","description":"This policy controls if a page with Cache-Control: no-store header can be stored in back/forward cache. The website setting this header may not expect the page to be restored from back/forward cache since some sensitive information could still be displayed after the restoration even if it is no longer accessible.\r\n\r\nIf the policy is enabled or unset, the page with Cache-Control: no-store header might be restored from back/forward cache unless the cache eviction is triggered (e.g. when there is HTTP-only cookie change to the site).\r\n\r\nIf the policy is disabled, the page with Cache-Control: no-store header will not be stored in back/forward cache.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_allowbackforwardcacheforcachecontrolnostorepageenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_allowbackforwardcacheforcachecontrolnostorepageenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_allowwebauthnwithbrokentlscerts","displayName":"Allow Web Authentication requests on sites with broken TLS certificates.","description":"If set to Enabled, Google Chrome will\r\nallow Web Authentication requests on websites that have TLS certificates with\r\nerrors (i.e. websites considered not secure).\r\n\r\nIf the policy is set to Disabled or left unset, the default behavior of\r\nblocking such requests will apply.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_allowwebauthnwithbrokentlscerts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_allowwebauthnwithbrokentlscerts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_applicationboundencryptionenabled","displayName":"Enable Application Bound Encryption","description":"Setting the policy to Enabled or leaving it unset binds encryption keys used for local data storage to Google Chrome whenever that is possible.\r\n\r\nSetting the policy to Disabled has a detrimental effect on Google Chrome's security as unknown and potentially hostile apps can retrieve encryption keys used to secure data.\r\n\r\nOnly turn off the policy if there are compatibility issues, such as other applications that need legitimate access to Google Chrome's data, encrypted user data is expected to be fully portable between different computers or the integrity and location of Google Chrome's executable files is not consistent.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_applicationboundencryptionenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_applicationboundencryptionenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_batterysavermodeavailability","displayName":"Enable Battery Saver Mode","description":"This policy enables or disables the Battery Saver Mode setting.\r\nOn Chrome, this setting makes it so that frame rate is throttled to lower power consumption. If this policy is unset, the end user can control this setting in chrome://settings/performance.\r\nOn ChromeOS, this setting makes it so that frame rate and CPU frequency are throttled, backlights are dimmed, and Android is put in Battery Saver Mode. On devices with multiple CPUs, some CPUs will be turned off.\r\nThe different levels are:\r\nDisabled (0): Battery Saver Mode will be disabled.\r\nEnabledBelowThreshold (1): Battery Saver Mode will be enabled when the device is on battery power and battery level is low.\r\nEnabledOnBattery (2): This value is deprecated as of M121. From M121 onwards, values will be treated as EnabledBelowThreshold.\r\n","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_batterysavermodeavailability_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_batterysavermodeavailability_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_batterysavermodeavailability_batterysavermodeavailability","displayName":"Enable Battery Saver Mode (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_batterysavermodeavailability_batterysavermodeavailability_0","displayName":"Battery Saver Mode will be disabled.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_batterysavermodeavailability_batterysavermodeavailability_1","displayName":"Battery Saver Mode will be enabled when the device is on battery power and battery level is low.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_batterysavermodeavailability_batterysavermodeavailability_2","displayName":"This value is deprecated as of M121. In M121 and after, values will be treated as EnabledBelowThreshold.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_builtinaiapisenabled","displayName":"Allow pages to use the built-in AI APIs.","description":"This policy controls if a page can use the built-in AI APIs (such as LanguageModel API, Summarization API, Writer API, and Rewriter API).\r\n\r\nIf the policy is enabled or unset, the APIs are enabled to be used.\r\n\r\nIf the policy is disabled, attempting using the APIs will result in an error.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_builtinaiapisenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_builtinaiapisenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_chromefortestingallowed","displayName":"Allow Chrome for Testing","description":"Controls whether users may use Chrome for Testing.\r\n\r\nIf this policy is set to Enabled or not set, users may install and run Chrome for Testing.\r\n\r\nIf this policy is set to Disabled, users are not allowed to run Chrome for Testing. Users will still be able to install Chrome for Testing, however it will not run with the profiles where this policy is set to Disabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_chromefortestingallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_chromefortestingallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_domainreliabilityallowed","displayName":"Allow reporting of domain reliability related data","description":"If this policy is set false, domain reliability diagnostic data reporting is disabled and no data is sent to Google.\r\nIf this policy is set true or not set, domain reliability diagnostic data reporting will follow the behavior of MetricsReportingEnabled for Google Chrome or DeviceMetricsReportingEnabled for Google ChromeOS.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_domainreliabilityallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_domainreliabilityallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_dynamiccodesettings","displayName":"Dynamic Code Settings","description":"This policy controls the dynamic code settings for Google Chrome.\r\n\r\nDisabling dynamic code improves the security of Google Chrome by preventing potentially hostile dynamic code and third-party code from making changes to Google Chrome's behavior, but might cause compatibility issues with third-party software (e.g. certain printer drivers) that must run inside the browser process.\r\n\r\nIf the policy is set to 0 - Default or left unset then Google Chrome will use the default settings.\r\n\r\nIf the policy is set to 1 - DisabledForBrowser then the Google Chrome browser process will be prevented from creating dynamic code.\r\n\r\nNote: Read more about process mitigation policies ( https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md#Process-mitigation-policies ).","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_dynamiccodesettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_dynamiccodesettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_dynamiccodesettings_dynamiccodesettings","displayName":"Dynamic Code Settings (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_dynamiccodesettings_dynamiccodesettings_0","displayName":"Default dynamic code settings","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_dynamiccodesettings_dynamiccodesettings_1","displayName":"Prevent the browser process from creating dynamic code","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enableunsafeswiftshader","displayName":"Allow software WebGL fallback using SwiftShader","description":"A policy that controls if SwiftShader will be used as a WebGL fallback when hardware GPU acceleration is not available.\r\n\r\nSwiftShader has been used to support WebGL on systems without GPU acceleration such as headless systems or virtual machines but has been deprecated due to security issues. Starting in M139, WebGL context creation will fail when it would have otherwise used SwiftShader. This policy allows the browser or administrator to temporarily defer the deprecation.\r\n\r\nSetting the policy to Enabled, SwiftShader will be used as a software WebGL fallback.\r\n\r\nSetting the policy to Disabled or not set, WebGL context creation may fail if hardware GPU acceleration is not available. Web pages may misbehave if they do not gracefully handle WebGL context creation failure.\r\n\r\nThis is a temporary policy which will be removed in the future.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enableunsafeswiftshader_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enableunsafeswiftshader_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_encryptedclienthelloenabled","displayName":"Enable TLS Encrypted ClientHello","description":"Encrypted ClientHello (ECH) is an extension to TLS to encrypt sensitive fields of the ClientHello and improve privacy.\r\n\r\nIf this policy is not configured, or is set to enabled, Google Chrome will follow the default rollout process for ECH. If it is disabled, Google Chrome will not enable ECH.\r\n\r\nWhen the feature is enabled, Google Chrome may or may not use ECH depending on server support, availability of the HTTPS DNS record, or rollout status.\r\n\r\nECH is an evolving protocol, so Google Chrome's implementation is subject to change. As such, this policy is a temporary measure to control the initial experimental implementation. It will be replaced with final controls as the protocol finalizes.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_encryptedclienthelloenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_encryptedclienthelloenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterprisecustomlabel","displayName":"Set a custom enterprise label for a managed profile","description":"This policy controls a custom label used to identify managed profiles. For managed profiles, this label will be shown next to the avatar in the toolbar. The custom label will not be translated.\r\n\r\nWhen this policy is applied, any strings that surpass 16 characters will be truncated with a “...” Please refrain from using extended names.\r\n\r\nThis policy can only be set as a user policy.\r\n\r\nNote that this policy has no effect if the EnterpriseProfileBadgeToolbarSettings policy is set to hide_expanded_enterprise_toolbar_badge (value 1).\r\n\r\nExample value: Chromium","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterprisecustomlabel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterprisecustomlabel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterprisecustomlabel_enterprisecustomlabel","displayName":"Set a custom enterprise label for a managed profile (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterprisecustomlabelforbrowser","displayName":"Set a custom enterprise label for a managed browser","description":"This policy controls a custom label used to indicate a managed browser. For managed browsers, this label will be shown in a management disclaimer on a footer on the New Tab page. The custom label will not be translated.\r\n\r\nNote that this policy is only applied for managed browsers, so it will have no effect for managed users on unmanaged browsers.\r\n\r\nOn Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core.\r\n\r\nOn macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.\r\n\r\nExample value: Chromium","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterprisecustomlabelforbrowser_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterprisecustomlabelforbrowser_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterprisecustomlabelforbrowser_enterprisecustomlabelforbrowser","displayName":"Set a custom enterprise label for a managed browser (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterpriselogourl","displayName":"Enterprise Logo URL for a managed profile","description":"A URL to an image that will be used as an enterprise badge for a managed profile. The URL must point to an image.\r\n\r\nThis policy can only be set as a user policy.\r\n\r\nIt is recommended to use the favicon (example https://www.google.com/favicon.ico) or an icon no smaller than 48 x 48 px.\r\n\r\nExample value: https://example.com/image.png","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterpriselogourl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterpriselogourl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterpriselogourl_enterpriselogourl","displayName":"Enterprise Logo URL for a managed profile (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterpriselogourlforbrowser","displayName":"Enterprise Logo URL for a managed browser","description":"A URL to an image that will be used as an enterprise badge for a managed browser. The URL must point to an image.\r\n\r\nIt is recommended to use the favicon (example https://www.google.com/favicon.ico) or an icon no smaller than 48 x 48 px.\r\n\r\nNote that this policy is only applied for managed browsers, so it will have no effect for managed users on unmanaged browsers.\r\n\r\nOn Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core.\r\n\r\nOn macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.\r\n\r\nExample value: https://example.com/image.png","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterpriselogourlforbrowser_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterpriselogourlforbrowser_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterpriselogourlforbrowser_enterpriselogourlforbrowser","displayName":"Enterprise Logo URL for a managed browser (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterpriseprofilebadgetoolbarsettings","displayName":"Controls visibility of enterprise profile badge in the toolbar","description":"For work and school profiles, the toolbar will show a \"Work\" or \"School\" label by default next to the toolbar avatar. The label will only be shown if the signed in account is managed.\r\n\r\nSetting this policy to hide_expanded_enterprise_toolbar_badge (value 1) will hide the enterprise badge for a managed profile in the toolbar.\r\n\r\nLeaving this policy unset or setting it to show_expanded_enterprise_toolbar_badge (value 0) will show the enterprise badge.\r\n\r\nThe label is customizable via the EnterpriseCustomLabel policy.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterpriseprofilebadgetoolbarsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterpriseprofilebadgetoolbarsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterpriseprofilebadgetoolbarsettings_enterpriseprofilebadgetoolbarsettings","displayName":"Controls visibility of enterprise profile badge in the toolbar (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterpriseprofilebadgetoolbarsettings_enterpriseprofilebadgetoolbarsettings_0","displayName":"Show expanded enterprise toolbar badge","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterpriseprofilebadgetoolbarsettings_enterpriseprofilebadgetoolbarsettings_1","displayName":"Hide expanded enterprise toolbar badge","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterpriseprofilecreationkeepbrowsingdata","displayName":"Keep browsing data when creating enterprise profile by default","description":"If this policy is Enabled, the option to keep any existing browsing data when creating an enterprise profile will be checked by default.\r\n\r\nIf this policy is unset or Disabled, the option to keep any existing browsing data when creating an enterprise profile will not be checked by default.\r\n\r\nRegardless of the value, the user will be able to decide whether or not to keep any existing browsing data when creating an enterprise profile.\r\n\r\nThis policy has no effect if the option to keep existing browsing data is not available; this happens if enterprise profile separation is strictly enforced, or if the data would be from an already managed profile.\r\n","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterpriseprofilecreationkeepbrowsingdata_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterpriseprofilecreationkeepbrowsingdata_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterprisesearchaggregatorsettings","displayName":"Enterprise search aggregator settings","description":"This policy allows administrators to set a designated enterprise search aggregator that will provide search recommendations and results within the omnibox (address bar) and the search box on the New Tab page.\r\n\r\nBy default, enterprise search suggestions will be blended and shown alongside regular Google Chrome recommendations. Users can explicitly scope their search to just the enterprise search aggregator by typing the keyword specified in the shortcut field with or without the @ prefix (e.g. @work) followed by Space or Tab in the omnibox. Scoped enterprise searches (triggered by a keyword) are currently only supported in the omnibox and not in the search box on the New Tab page.\r\n\r\nThe following fields are required: name, shortcut, search_url, suggest_url.\r\n\r\nThe name field corresponds to the search engine name shown to the user in the address bar.\r\n\r\nThe shortcut field corresponds to the keyword that the user enters to trigger the search. The shortcut can include plain words and characters, but cannot include spaces or start with the @ symbol. Shortcuts must be unique.\r\n\r\nThe search_url field specifies the URL on which to search. Enter the web address for the search engine's results page, and use '{searchTerms}' in place of the query.\r\n\r\nThe suggest_url field specifies the URL that provides search suggestions. A POST request will be made and the user's query will be passed in the POST params under key 'query'.\r\n\r\nThe icon_url field specifies the URL to an image that will be used on the search suggestions. A default icon will be used when this field is not set. It's recommended to use a favicon (example https://www.google.com/favicon.ico). Supported image file formats: JPEG, PNG, and ICO.\r\n\r\nThe require_shortcut field specifies whether the address bar shortcut is required to see search recommendations. If required, suggestions will not be shown in the search box on the New Tab page, but will continue to be shown in the omnibox (address bar) in scoped search mode. If this field is not set, the address bar shortcut is not required.\r\n\r\nOn Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core.\r\n\r\nOn macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=EnterpriseSearchAggregatorSettings for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n{\r\n \"name\": \"My Search Aggregator\",\r\n \"shortcut\": \"work\",\r\n \"search_url\": \"https://www.aggregator.com/search?q={searchTerms}\",\r\n \"suggest_url\": \"https://www.aggregator.com/suggest\",\r\n \"icon_url\": \"https://www.google.com/favicon.ico\",\r\n \"require_shortcut\": true\r\n}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterprisesearchaggregatorsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterprisesearchaggregatorsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_enterprisesearchaggregatorsettings_enterprisesearchaggregatorsettings","displayName":"Enterprise search aggregator settings (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_exemptdomainfiletypepairsfromfiletypedownloadwarnings","displayName":"Disable download file type extension-based warnings for specified file types on domains","description":"You can enable this policy to create a dictionary of file type extensions with a corresponding list of domains that will be exempted from file type extension-based download warnings. This lets enterprise administrators block file type extension-based download warnings for files that are associated with a listed domain. For example, if the \"jnlp\" extension is associated with \"website1.com\", users would not see a warning when downloading \"jnlp\" files from \"website1.com\", but see a download warning when downloading \"jnlp\" files from \"website2.com\".\r\n\r\nFiles with file type extensions specified for domains identified by this policy will still be subject to non-file type extension-based security warnings such as mixed-content download warnings and Safe Browsing warnings.\r\n\r\nIf you disable this policy or don't configure it, file types that trigger extension-based download warnings will show warnings to the user.\r\n\r\nIf you enable this policy:\r\n\r\n* The URL pattern should be formatted according to https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.\r\n\r\n* The file type extension entered must be in lower-cased ASCII. The leading separator should not be included when listing the file type extension, so list \"jnlp\" should be used instead of \".jnlp\".\r\n\r\nExample:\r\n\r\nThe following example value would prevent file type extension-based download warnings on \"exe\" and \"jnlp\" extensions for *.example.com domains, and on \"swf\" extensions for all domains. It will show the user a file type extension-based download warning on any other domain for exe and jnlp files, but not for swf files.\r\n\r\n[\r\n{ \"file_extension\": \"jnlp\", \"domains\": [\"example.com\"] },\r\n{ \"file_extension\": \"exe\", \"domains\": [\"example.com\"] },\r\n{ \"file_extension\": \"swf\", \"domains\": [\"*\"] }\r\n]\r\n\r\nNote that while the preceding example shows the suppression of file type extension-based download warnings for \"swf\" files for all domains, applying suppression of such warnings for all domains for any dangerous file type extension is not recommended due to security concerns. It is shown in the example merely to demonstrate the ability to do so.\r\n\r\nIf this policy is enabled alongside DownloadRestrictions, then the exemptions to file type extension-based warnings specified by this policy take precedence over a DownloadRestrictions setting that would block dangerous file types. The exemptions specified by this policy only apply to the \"block dangerous file types\" behavior specified by values 1 and 2 of DownloadRestrictions.\r\n\r\nFor example, if this policy specifies an exemption for \"exe\" downloads from \"website1.com\", and DownloadRestrictions is set to block malicious downloads and dangerous file types (value 1), then \"exe\" downloads from \"website1.com\" will be exempt from file type extension-based blocking but will still be blocked if they are malicious.\r\n\r\nMore information about DownloadRestrictions can be found at https://chromeenterprise.google/policies/?policy=DownloadRestrictions.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ExemptDomainFileTypePairsFromFileTypeDownloadWarnings for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"domains\": [\r\n \"https://example.com\",\r\n \"example2.com\"\r\n ],\r\n \"file_extension\": \"jnlp\"\r\n },\r\n {\r\n \"domains\": [\r\n \"*\"\r\n ],\r\n \"file_extension\": \"swf\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_exemptdomainfiletypepairsfromfiletypedownloadwarnings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_exemptdomainfiletypepairsfromfiletypedownloadwarnings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_exemptdomainfiletypepairsfromfiletypedownloadwarnings_exemptdomainfiletypepairsfromfiletypedownloadwarnings","displayName":"Disable download file type extension-based warnings for specified file types on domains (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_feedbacksurveysenabled","displayName":"Specifies whether in-product Google Chrome surveys are shown to users.","description":"Google Chrome in-product surveys collect user feedback for the browser. Survey responses are not associated with user accounts.\r\nWhen this policy is Enabled or not set, in-product surveys may be shown to users.\r\nWhen this policy is Disabled, in-product surveys are not shown to users.\r\n\r\nThis policy has no effect if MetricsReportingEnabled is set to Disabled, which disables in-product surveys as well.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_feedbacksurveysenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_feedbacksurveysenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_fileordirectorypickerwithoutgestureallowedfororigins","displayName":"Allow file or directory picker APIs to be called without prior user gesture","description":"For security reasons, the\r\nshowOpenFilePicker(),\r\nshowSaveFilePicker() and\r\nshowDirectoryPicker() web APIs\r\nrequire a prior user gesture (\"transient activation\") to be called or will\r\notherwise fail.\r\n\r\nWith this policy set, admins can specify origins on which these APIs can be\r\ncalled without prior user gesture.\r\n\r\nFor detailed information on valid url patterns, please see\r\nhttps://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is\r\nnot an accepted value for this policy.\r\n\r\nIf this policy is unset, all origins will require a prior user gesture to call\r\nthese APIs.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_fileordirectorypickerwithoutgestureallowedfororigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_fileordirectorypickerwithoutgestureallowedfororigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_fileordirectorypickerwithoutgestureallowedfororigins_fileordirectorypickerwithoutgestureallowedfororiginsdesc","displayName":"Allow file or directory picker APIs to be called without prior user gesture (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_forcepermissionpolicyunloaddefaultenabled","displayName":"Controls whether unload event handlers can be disabled.","description":"unload event handlers are being deprecated. Whether they fire depends on the unload Permissions-Policy. Currently, they are allowed by policy by default. In the future they will gradually move to being disallowed by default and sites must explicitly enable them using Permissions-Policy headers. This enterprise policy can be used to opt out of this gradual deprecation by forcing the default to remain as enabled.\r\n\r\nPages may depend on unload event handlers to save data or signal the end of a user session to the server. This is not recommended as it is unreliable and impacts performance by blocking use of BackForwardCache. Recommended alternatives exist, however the unload event has been used for a long time. Some applications may still rely on them.\r\n\r\nIf this policy is set to false or not set, then unload events handlers will be gradually deprecated in-line with the deprecation rollout and sites which do not set Permissions-Policy header will stop firing `unload` events.\r\n\r\nIf this policy is set to true then unload event handlers will continue to work by default.\r\n\r\nNOTE: This policy had an incorrectly documented default of `true` in M117. The unload event did and will not change in M117, so this policy has no effect in that version.\r\n","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_forcepermissionpolicyunloaddefaultenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_forcepermissionpolicyunloaddefaultenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_googlesearchsidepanelenabled","displayName":"Enable Google Search Side Panel","description":"If set to Enabled or not set, Google Search Side Panel is allowed on all web pages.\r\n\r\nIf set to Disabled, Google Search Side Panel is not available on any webpage.\r\n\r\nGenAI capabilities that are part of this feature are not available for Educational or Enterprise accounts.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_googlesearchsidepanelenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_googlesearchsidepanelenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_highefficiencymodeenabled","displayName":"Enable High Efficiency Mode","description":"This policy enables or disables the High Efficiency Mode setting. This setting makes it so that tabs are discarded after some period of time in the background to reclaim memory.\r\nIf this policy is unset, the end user can control this setting in chrome://settings/performance.\r\n","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_highefficiencymodeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_highefficiencymodeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_httpallowlist","displayName":"HTTP Allowlist","description":"Setting the policy specifies a list of hostnames or hostname patterns (such as\r\n'[*.]example.com') that will not be upgraded to HTTPS and will not show an\r\nerror interstitial if HTTPS-First Mode is enabled. Organizations can use this\r\npolicy to maintain access to servers that do not support HTTPS, without\r\nneeding to disable HTTPS Upgrades and/or HTTPS-First Mode.\r\n\r\nSupplied hostnames must be canonicalized: Any IDNs must be converted to their\r\nA-label format, and all ASCII letters must be lowercase.\r\n\r\nBlanket host wildcards (i.e., \"*\" or \"[*]\") are not allowed. Instead,\r\nHTTPS-First Mode and HTTPS Upgrades should be explicitly disabled via their\r\nspecific policies.\r\n\r\nNote: This policy does not apply to HSTS upgrades.\r\n\r\nExample value:\r\n\r\ntestserver.example.com\r\n[*.]example.org","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_httpallowlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_httpallowlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_httpallowlist_httpallowlistdesc","displayName":"HTTP Allowlist (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_httpsupgradesenabled","displayName":"Enable automatic HTTPS upgrades","description":"Google Chrome attempts to upgrade some\r\nnavigations from HTTP to HTTPS, when possible. This policy can be used to\r\ndisable this behavior. If set to \"true\" or left unset, this feature will be\r\nenabled by default.\r\n\r\nThe separate HttpAllowlist policy\r\ncan be used to exempt specific hostnames or hostname patterns from being\r\nupgraded to HTTPS by this feature.\r\n\r\nSee also the HttpsOnlyMode policy.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_httpsupgradesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_httpsupgradesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_lensdesktopntpsearchenabled","displayName":"Allow Google Lens button to be shown in the search box on the New Tab page if supported.","description":"Leaving the policy unset or setting it to Enabled allows users to view and use the Google Lens button in the search box on the New Tab page. Setting the policy to Disabled means users will not see the Google Lens button in the search box on the New Tab page.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_lensdesktopntpsearchenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_lensdesktopntpsearchenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_lensoverlaysettings","displayName":"Settings for the Lens Overlay feature","description":"Lens Overlay lets users perform contextual Google searches either via a screenshot or by asking a question about the current page's contents. This feature requires the end user to opt-in.\r\n\r\nThis feature is available to all users with Google as their default search engine, unless it is disabled by this policy.\r\n\r\nWhen policy is set to 0 - Allow or not set, the feature will be available to users.\r\n\r\nWhen policy is set to 1 - Do not allow, the feature will not be available.\r\n\r\nStarting in Google Chrome 140, if the policy is unset, its behavior is determined by the GenAiDefaultSettings policy.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_lensoverlaysettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_lensoverlaysettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_lensoverlaysettings_lensoverlaysettings","displayName":"Settings for the Lens Overlay feature (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_lensoverlaysettings_lensoverlaysettings_0","displayName":"Allow","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_lensoverlaysettings_lensoverlaysettings_1","displayName":"Do not allow","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_memorysavermodesavings","displayName":"Change Memory Saver Mode Savings","description":"This policy changes the savings level of Memory Saver.\r\n\r\nThis only takes effect when Memory Saver is enabled through settings or through the HighEfficiencyModeEnabled policy, and will affect how heuristics are used to determine when to discard tabs. For example, reducing the lifetime of an inactive tab before discarding it can save memory, but it also means that tabs will be reloaded more frequently which can lead to bad user experience and cost more network traffic.\r\n\r\nSetting the policy to 0 - Memory Saver will get moderate memory savings. Tabs become inactive after a longer period of time\r\n\r\nSetting the policy to 1 - Memory Saver will get balanced memory savings. Tabs become inactive after an optimal period of time.\r\n\r\nSetting the policy to 2 - Memory Saver will get maximum memory savings. Tabs become inactive after a shorter period of time.\r\n\r\nIf this policy is unset, the end user can control this setting in chrome://settings/performance.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_memorysavermodesavings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_memorysavermodesavings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_memorysavermodesavings_memorysavermodesavings","displayName":"Change Memory Saver Mode Savings (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_memorysavermodesavings_memorysavermodesavings_0","displayName":"Moderate memory savings.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_memorysavermodesavings_memorysavermodesavings_1","displayName":"Balanced memory savings.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_memorysavermodesavings_memorysavermodesavings_2","displayName":"Maximum memory savings.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_nativehostsexecutableslaunchdirectly","displayName":"Force Windows executable Native Messaging hosts to launch directly","description":"This policy controls whether native host executables launch directly on Windows.\r\n\r\nSetting the policy to Enabled forces Google Chrome to launch native messaging hosts implemented as executables directly.\r\n\r\nSetting the policy to Disabled will result in Google Chrome launching hosts using cmd.exe as an intermediary process.\r\n\r\nLeaving the policy unset allows Google Chrome to decide which approach to use.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_nativehostsexecutableslaunchdirectly_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_nativehostsexecutableslaunchdirectly_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpfooterextensionattributionenabled","displayName":"Control the visibility of the extension attribution on the New Tab page","description":"This policy determines whether an attribution to the extension modifying the New Tab Page (NTP) is displayed in the NTP's footer.\r\n\r\nBy default, if an extension has overridden the standard NTP, a message attributing this change to the specific extension will appear in the footer. This attribution typically includes a link to the relevant extension in the Chrome Web Store.\r\n\r\nIf this policy is left unset or set to true, the extension attribution will be visible on the NTP footer when an extension is controlling the NTP.\r\n\r\nIf this policy is set to false, the attribution to the extension in the NTP footer will be suppressed.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpfooterextensionattributionenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpfooterextensionattributionenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpfootermanagementnoticeenabled","displayName":"Control the visibility of the management notice on the New Tab Page for managed browsers","description":"This policy controls the visibility of the management notice within the footer of the New Tab Page (NTP). By default, the NTP footer displays information when the browser is managed by an organization (indicated by a building icon and \"Managed by [domain name]\"). This can be customized using the EnterpriseCustomLabelForBrowser and EnterpriseLogoUrlForBrowser policies.\r\n\r\nIf this policy is left unset or set to true, managed browsers will display a “Managed by…” notice with an icon.\r\n\r\nIf this policy is set to false, the management notice will be hidden.\r\n\r\nNote that this policy is only applied for managed browsers, so it will have no effect for managed users on unmanaged browsers.\r\n\r\nOn Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core.\r\n\r\nOn macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpfootermanagementnoticeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpfootermanagementnoticeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpmiddleslotannouncementvisible","displayName":"Show the middle slot announcement on the New Tab Page","description":"This policy controls the visibility of the middle slot announcement on the New Tab Page.\r\n\r\nIf the policy is set to Enabled, the New Tab Page will show the middle slot announcement if it is available.\r\n\r\nIf the policy is set to Disabled, the New Tab Page will not show the middle slot announcement even if it is available.\r\n","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpmiddleslotannouncementvisible_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpmiddleslotannouncementvisible_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpoutlookcardvisible","displayName":"Show Outlook Calendar card on the New Tab Page","description":"This policy controls the visibility of the Outlook Card on the New Tab Page. The card will only be displayed on the New Tab Page if the policy is enabled and your organization authorized the usage of the Outlook Calendar data in the browser.\r\n\r\nOutlook data will not be stored by the browser.\r\n\r\nThe Outlook card shows the next calendar event, along with a glanceable look at the rest of the day's meetings. It aims to address the issue of context switching and enhance productivity by giving users a shortcut to their next meeting.\r\n\r\nThe Microsoft Outlook card will require additional admin configuration. For detailed information on connecting the Chrome New Tab Page Card to Outlook, please see https://support.google.com/chrome/a?p=chrome_ntp_microsoft_cards.\r\n\r\nIf the NTPCardsVisible is disabled, the Outlook Card will not be shown. If NTPCardsVisible is enabled, the Outlook card will be shown if this policy is also enabled and there is data to be shown. If NTPCardsVisible is unset, the Outlook card will be shown if this policy is also enabled, the user has the card enabled in Customize Chrome, and there is data to be shown.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpoutlookcardvisible_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpoutlookcardvisible_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpsharepointcardvisible","displayName":"Show SharePoint and OneDrive File Card on the New Tab Page","description":"This policy controls the visibility of the SharePoint and OneDrive File Card on the New Tab Page. The card will only be displayed on the New Tab Page if the policy is enabled and your organization authorized the usage of the SharePoint and OneDrive File data in the browser.\r\n\r\nSharePoint and OneDrive data will not be stored by the browser.\r\n\r\nThe SharePoint and OneDrive Files recommendation card shows a list of recommended files. It aims to address the issue of context switching and enhance productivity by giving users a shortcut to their most important documents.\r\n\r\nThe Microsoft SharePoint and OneDrive card will require additional admin configuration. For detailed information on connecting the Chrome New Tab Page Card to Sharepoint, please see https://support.google.com/chrome/a?p=chrome_ntp_microsoft_cards.\r\n\r\nIf the NTPCardsVisible is disabled, the SharePoint and OneDrive Card will not be shown. If NTPCardsVisible is enabled, the SharePoint and OneDrive card will be shown if this policy is also enabled and there is data to be shown. If NTPCardsVisible is unset, the SharePoint and OneDrive card will be shown if this policy is also enabled, the user has the card enabled in Customize Chrome, and there is data to be shown.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpsharepointcardvisible_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpsharepointcardvisible_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpshortcuts","displayName":"Setting shortcuts on the New Tab Page (Beta)","description":"In development: for early preview only.\r\n\r\nSetting the policy pre-configures up to 10 custom shortcuts on the Google Chrome New Tab page.\r\n\r\nIf set, users will see these shortcuts by default and users can toggle between “My shortcuts,\" \"Most visited sites\" or \"My organization's shortcuts\" on the \"Customize Chrome\" panel. If empty or unset, the user will only be able to toggle between “My shortcuts\" or \"Most visited sites\" on the \"Customize Chrome\" panel.\r\n\r\nShortcut URLs must be unique.\r\n\r\nIf allow_user_edit is set to true, users can change the name of the shortcut. If set to false or unset, users cannot edit the name.\r\n\r\nIf allow_user_delete is set to true, users can remove the shortcut. If set to false or unset, users cannot remove the shortcut.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=NTPShortcuts for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"name\": \"Google\",\r\n \"url\": \"https://www.google.com\"\r\n },\r\n {\r\n \"name\": \"YouTube\",\r\n \"url\": \"https://www.youtube.com\"\r\n },\r\n {\r\n \"name\": \"Google Drive\",\r\n \"url\": \"https://www.drive.google.com\",\r\n \"allow_user_edit\": true,\r\n \"allow_user_delete\": true\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpshortcuts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpshortcuts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_ntpshortcuts_ntpshortcuts","displayName":"Setting shortcuts on the New Tab Page (Beta) (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_originagentclusterdefaultenabled","displayName":"Allows origin-keyed agent clustering by default.","description":"This policy allows origin-keyed agent clustering by default.\r\n\r\nThe Origin-Agent-Cluster HTTP header controls whether a document is\r\nisolated in an origin-keyed agent cluster, or in a site-keyed agent\r\ncluster. This has security implications since an origin-keyed agent\r\ncluster allows isolating documents by origin. The developer-visible\r\nconsequence of this is that the document.domain accessor can no longer\r\nbe set.\r\n\r\nThe default behaviour - when no Origin-Agent-Cluster header has been set -\r\nchanges in M111 from site-keyed to origin-keyed.\r\n\r\nIf this policy is enabled or not set, the browser will follow this\r\nnew default from that version on.\r\n\r\nIf this policy is disabled this change is reversed and\r\ndocuments without Origin-Agent-Cluster headers will be assigned to\r\nsite-keyed agent clusters. As a consequence, the document.domain accessor\r\nremains settable by default. This matches the legacy behaviour.\r\n\r\nSee https://developer.chrome.com/blog/immutable-document-domain/ for\r\nadditional details.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_originagentclusterdefaultenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_originagentclusterdefaultenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_pdfannotationsenabled","displayName":"Enable PDF Annotations","description":"Controls if the PDF viewer in Google Chrome can annotate PDFs.\r\n\r\nWhen this policy is not set, or is set to true, then the PDF viewer will be able to annotate PDFs.\r\n\r\nWhen this policy is set to false, then the PDF viewer will not be able to annotate PDFs.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_pdfannotationsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_pdfannotationsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_pdfuseskiarendererenabled","displayName":"Use Skia renderer for PDF rendering","description":"Controls whether the PDF viewer in Google Chrome uses Skia renderer.\r\n\r\nWhen this policy is enabled, the PDF viewer uses Skia renderer.\r\n\r\nWhen this policy is disabled, the PDF viewer uses its current AGG renderer.\r\n\r\nWhen this policy is not set, the PDF renderer will be chosen by the browser.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_pdfuseskiarendererenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_pdfuseskiarendererenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_pdfvieweroutofprocessiframeenabled","displayName":"Use out-of-process iframe PDF Viewer","description":"Controls whether the PDF viewer in Google Chrome uses an out-of-process iframe (OOPIF). This will be the new PDF viewer architecture in the future, as it is simpler and makes adding new features easier. The existing GuestView PDF viewer is an outdated, complex architecture that is being deprecated.\r\n\r\nWhen this policy is set to Enabled or not set, Google Chrome will be able to use the OOPIF PDF viewer architecture. Once Enabled or not set, the default behavior will be decided by Google Chrome.\r\n\r\nWhen this policy is set to Disabled, Google Chrome will strictly use the existing GuestView PDF viewer. It embeds a web page with a separate frame tree into another web page.\r\n\r\nThis policy will be removed in the future, after the OOPIF PDF viewer feature has fully rolled out.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_pdfvieweroutofprocessiframeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_pdfvieweroutofprocessiframeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_postquantumkeyagreementenabled","displayName":"Enable post-quantum key agreement for TLS","description":"This policy configures whether Google Chrome will offer a post-quantum key agreement algorithm in TLS, using the ML-KEM NIST standard. Prior to Google Chrome 131, the algorithm was Kyber, an earlier draft iteration of the standard. This allows supporting servers to protect user traffic from being later decrypted by quantum computers.\r\n\r\nIf this policy is Enabled or not set, Google Chrome will offer a post-quantum key agreement in TLS connections. User traffic will then be protected from quantum computers when communicating with compatible servers.\r\n\r\nIf this policy is Disabled, Google Chrome will not offer a post-quantum key agreement in TLS connections. User traffic will then be unprotected from quantum computers.\r\n\r\nOffering a post-quantum key agreement is backwards-compatible. Existing TLS servers and networking middleware are expected to ignore the new option and continue selecting previous options.\r\n\r\nHowever, devices that do not correctly implement TLS may malfunction when offered the new option. For example, they may disconnect in response to unrecognized options or the resulting larger messages. Such devices are not post-quantum-ready and will interfere with an enterprise's post-quantum transition. If encountered, administrators should contact the vendor for a fix.\r\n\r\nThis policy is a temporary measure and will be removed sometime after Google Chrome version 145. It may be Enabled to allow you to test for issues, and may be Disabled while issues are being resolved.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_postquantumkeyagreementenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_postquantumkeyagreementenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_prefetchwithserviceworkerenabled","displayName":"Allow SpeculationRules prefetch to ServiceWorker-controlled URLs","description":"SpeculationRules prefetch can be issued to URLs that are controlled by\r\nServiceWorker. However, legacy code did not allow it and canceled the prefetch\r\nrequests. This policy enables to control the behavior.\r\n\r\nSetting this policy to Enabled or not set allows SpeculationRules prefetch to\r\nServiceWorker-controlled URLs (if the PrefetchServiceWorker feature flag is\r\nenabled). This is the current default behavior and is aligned with the\r\nspecifications.\r\n\r\nSetting this policy to Disabled disallows SpeculationRules prefetch to\r\nServiceWorker-controlled URLs. This is the legacy behavior.\r\n\r\nThis policy is intended to be temporary and will be removed in the future.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_prefetchwithserviceworkerenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_prefetchwithserviceworkerenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_profilereauthprompt","displayName":"Prompt users to re-authenticate to the profile","description":"When set to DoNotPrompt or left unset, Google Chrome does not automatically prompt the user to re-authenticate to the browser.\r\n\r\nWhen set to PromptInTab, when the user's authentication expires, immediately open a new tab with the Google login page. This only happens if using Chrome Sync.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_profilereauthprompt_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_profilereauthprompt_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_profilereauthprompt_profilereauthprompt","displayName":"Prompt users to re-authenticate to the profile (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_profilereauthprompt_profilereauthprompt_0","displayName":"Do not prompt for reauth","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_profilereauthprompt_profilereauthprompt_1","displayName":"Prompt for reauth in a tab","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_promotionsenabled","displayName":"Enable showing promotional content","description":"Setting the policy to True or leaving it unset lets Google Chrome show users product promotional content.\r\n\r\nSetting the policy to False prevents Google Chrome from showing product promotional content.\r\n\r\nSetting the policy controls the presentation of promotional content, including the welcome pages that help users sign in to Google Chrome, set Google Chrome as users' default browser, or otherwise inform them of product features.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_promotionsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_promotionsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_qrcodegeneratorenabled","displayName":"Enable QR Code Generator","description":"This policy enables the QR Code generator feature in Google Chrome.\r\n\r\nIf you enable this policy or don't configure it, the QR Code Generator feature is enabled.\r\n\r\nIf you disable this policy, the QR Code Generator feature is disabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_qrcodegeneratorenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_qrcodegeneratorenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended_batterysavermodeavailability_recommended","displayName":"Enable Battery Saver Mode","description":"This policy enables or disables the Battery Saver Mode setting.\r\nOn Chrome, this setting makes it so that frame rate is throttled to lower power consumption. If this policy is unset, the end user can control this setting in chrome://settings/performance.\r\nOn ChromeOS, this setting makes it so that frame rate and CPU frequency are throttled, backlights are dimmed, and Android is put in Battery Saver Mode. On devices with multiple CPUs, some CPUs will be turned off.\r\nThe different levels are:\r\nDisabled (0): Battery Saver Mode will be disabled.\r\nEnabledBelowThreshold (1): Battery Saver Mode will be enabled when the device is on battery power and battery level is low.\r\nEnabledOnBattery (2): This value is deprecated as of M121. From M121 onwards, values will be treated as EnabledBelowThreshold.\r\n","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended_batterysavermodeavailability_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended_batterysavermodeavailability_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended_batterysavermodeavailability_recommended_batterysavermodeavailability","displayName":"Enable Battery Saver Mode (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended_batterysavermodeavailability_recommended_batterysavermodeavailability_0","displayName":"Battery Saver Mode will be disabled.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended_batterysavermodeavailability_recommended_batterysavermodeavailability_1","displayName":"Battery Saver Mode will be enabled when the device is on battery power and battery level is low.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended_batterysavermodeavailability_recommended_batterysavermodeavailability_2","displayName":"This value is deprecated as of M121. In M121 and after, values will be treated as EnabledBelowThreshold.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended_domainreliabilityallowed_recommended","displayName":"Allow reporting of domain reliability related data","description":"If this policy is set false, domain reliability diagnostic data reporting is disabled and no data is sent to Google.\r\nIf this policy is set true or not set, domain reliability diagnostic data reporting will follow the behavior of MetricsReportingEnabled for Google Chrome or DeviceMetricsReportingEnabled for Google ChromeOS.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended_domainreliabilityallowed_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended_domainreliabilityallowed_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended_enterpriseprofilecreationkeepbrowsingdata_recommended","displayName":"Keep browsing data when creating enterprise profile by default","description":"If this policy is Enabled, the option to keep any existing browsing data when creating an enterprise profile will be checked by default.\r\n\r\nIf this policy is unset or Disabled, the option to keep any existing browsing data when creating an enterprise profile will not be checked by default.\r\n\r\nRegardless of the value, the user will be able to decide whether or not to keep any existing browsing data when creating an enterprise profile.\r\n\r\nThis policy has no effect if the option to keep existing browsing data is not available; this happens if enterprise profile separation is strictly enforced, or if the data would be from an already managed profile.\r\n","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended_enterpriseprofilecreationkeepbrowsingdata_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended_enterpriseprofilecreationkeepbrowsingdata_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended_originkeyedprocessesenabled_recommended","displayName":"Enable origin-keyed process isolation by default.","description":"Enables origin-keyed process isolation for most pages (i.e., those assigned to an origin-keyed agent cluster by default). This improves security but also increases the number of processes created. Users are allowed to override the set policy value via the command-line flags or chrome://flags (both to turn this feature on or off).\r\n\r\nSetting the policy to Enabled results in most origins being isolated, even from other origins in the same site. See also the IsolateOrigins and SitePerProcess policies.\r\n\r\nSetting the policy to Disabled results in no origins being isolated from the rest of their site unless an origin explicitly asks to.\r\n\r\nNot setting the policy results in the browser determining which origins to isolate and when to isolate them.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended_originkeyedprocessesenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended_originkeyedprocessesenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended~accessibility_recommended_livecaptionenabled_recommended","displayName":"Enable Live Caption","description":"Enable the Live Caption feature.\r\n\r\nIf this policy is set to Enabled, Live Caption will always be turned on.\r\n\r\nIf this policy is set to Disabled, Live Caption will always be turned off.\r\n\r\nIf you set this policy as mandatory, users cannot change or override it.\r\n\r\nIf this policy is left unset, Live Caption is disabled initially but can be enabled by the user anytime.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended~accessibility_recommended_livecaptionenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended~accessibility_recommended_livecaptionenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended~accessibility_recommended_livetranslateenabled_recommended","displayName":"Enable Live Translate","description":"Enable translation of live captions. Captions will be sent to Google for translation.\r\n\r\nIf this policy is set to Enabled, Live Translate will always be turned on.\r\n\r\nIf this policy is set to Disabled, Live Translate will always be turned off.\r\n\r\nIf you set this policy as mandatory, users cannot change or override it.\r\n\r\nIf this policy is left unset, Live Translate is disabled initially but can be enabled by the user anytime.\r\n\r\nIn LiveCaptionEnabled is set to Disabled, Live Translate will be disabled regardless of this policy setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended~accessibility_recommended_livetranslateenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_recommended~accessibility_recommended_livetranslateenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_reduceacceptlanguageenabled","displayName":"Control Accept-Language Reduction","description":"The Accept-Language HTTP request header and the JavaScript navigator.languages getter are planned for reduction for privacy reasons.\r\nTo facilitate testing and ensure compatibility, this policy allows you to enable or disable the Accept-Language Reduction feature.\r\n\r\nIf this policy is set to enabled or left unset, Accept-Language Reduction will be applied through field trials.\r\nIf this policy is set to disabled, field trials will not be able to activate Accept-Language Reduction.\r\n\r\nFor more information about this feature, please visit: https://github.com/explainers-by-googlers/reduce-accept-language.\r\n\r\nNOTE: Only newly-started renderer processes will reflect changes to this policy while the browser is running.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_reduceacceptlanguageenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_reduceacceptlanguageenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_relaunchfastifoutdated","displayName":"Relaunch fast if outdated","description":"Specifies the minimum release age beyond which relaunch notifications are more aggressive. The age is calculated from the time the currently-running version was last served to clients.\r\n\r\nIf a browser relaunch or device restart is needed to finalize a pending update and the current version has been outdated for more than the number of days specified by this setting, the RelaunchNotificationPeriod policy is overridden to 2 hours. If the RelaunchNotification policy is set to 1 ('Required'), users will be forced to relaunch or restart at the end of the period.\r\n\r\nIf not set, or if the release age cannot be determined, the RelaunchNotificationPeriod policy will be used for all updates.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_relaunchfastifoutdated_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_relaunchfastifoutdated_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_relaunchfastifoutdated_relaunchfastifoutdated","displayName":"Time period (days): (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_rendererappcontainerenabled","displayName":"Enable Renderer App Container","description":"Setting the policy to Enabled or leaving it unset means Renderer App Container configuration will be enabled on supported platforms.\r\n\r\nSetting the policy to Disabled has a detrimental effect on the security and stability of Google Chrome as it will weaken the sandbox that renderer processes use. Only turn off the policy if there are compatibility issues with third-party software that must run inside renderer processes.\r\n\r\nNote: Read more about Process mitigation policies ( https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md#Process-mitigation-policies ).","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_rendererappcontainerenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_rendererappcontainerenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_restrictcoresharingonrenderer","displayName":"Restrict CPU core sharing for renderer process","description":"This policy mitigates side-channel cross process memory attacks by isolating the renderer process on the CPU core and preventing other processes from sharing the same core. The mitigation is supported on Microsoft® Windows® 11 24H2 and above. If the OS does not have the required scheduling support, this policy will have no effect. This policy may slow down performance in some demanding scenarios similar to disabling hyperthreading. For more information refer https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-process_mitigation_side_channel_isolation_policy\r\nIf this policy is enabled, all other processes will not be scheduled on the same CPU core when the renderer process is running.\r\nIf this policy is disabled, all other processes can be scheduled on the same CPU core if a renderer process is running on it.\r\nIf this policy is not set, all other processes can be scheduled on the same CPU core if a renderer process is running on the core. This may vary depending on Google Chrome release, currently running field trials, and platform.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_restrictcoresharingonrenderer_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_restrictcoresharingonrenderer_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_screencapturewithoutgestureallowedfororigins","displayName":"Allow screen capture without prior user gesture","description":"For security reasons, the\r\ngetDisplayMedia() web API requires\r\na prior user gesture (\"transient activation\") to be called or will otherwise\r\nfail.\r\n\r\nWith this policy set, admins can specify origins on which this API can be\r\ncalled without prior user gesture.\r\n\r\nFor detailed information on valid url patterns, please see\r\nhttps://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is\r\nnot an accepted value for this policy.\r\n\r\nIf this policy is unset, all origins will require a prior user gesture to call\r\nthis API.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_screencapturewithoutgestureallowedfororigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_screencapturewithoutgestureallowedfororigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_screencapturewithoutgestureallowedfororigins_screencapturewithoutgestureallowedfororiginsdesc","displayName":"Allow screen capture without prior user gesture (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_serviceworkerautopreloadenabled","displayName":"Allow ServiceWorker to dispatch navigation requests without waiting for its startup","description":"https://github.com/WICG/service-worker-auto-preload\r\nThe ServiceWorkerAutoPreload feature dispatches a network request for a main resource at the same time it begins the ServiceWorker bootstrap process.\r\n\r\nSetting the policy to Enabled or leaving it unset means\r\nGoogle Chrome enables ServiceWorkerAutoPreload. The navigation request is automatically dispatched while starting the ServiceWorker in some scenarios, e.g. ServiceWorker is not running,\r\n\r\nIf it is disabled, Google Chrome will not enable ServiceWorkerAutoPreload. The navigation request is dispatched always after starting the ServiceWorker.\r\n\r\nThis policy is a temporary measure to control the feature and will be removed in M144.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_serviceworkerautopreloadenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_serviceworkerautopreloadenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_serviceworkertocontrolsrcdociframeenabled","displayName":"Allow ServiceWorker to control srcdoc iframes","description":"https://github.com/w3c/ServiceWorker/issues/765 asks srcdoc iframe with\r\nthe \"allow-same-origin\" sandbox attribute to be under ServiceWorker control.\r\n\r\nSetting the policy to Enabled or leaving it unset means\r\nGoogle Chrome makes srcdoc iframes\r\nwith \"allow-same-origin\" sandbox attributes to be under ServiceWorker control.\r\n\r\nSetting the policy to Disabled leaves the srcdoc iframe not controlled by\r\nServiceWorker.\r\n\r\nThis policy is intended to be temporary and will be removed in 2026.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_serviceworkertocontrolsrcdociframeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_serviceworkertocontrolsrcdociframeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_sharedworkerbloburlfixenabled","displayName":"Make SharedWorker blob URL behavior aligned with the specification","description":"Upon https://w3c.github.io/ServiceWorker/#control-and-use-worker-client,\r\nworkers should inherit controllers for the blob URL. However, existing code\r\nallows only DedicatedWorkers to inherit the controller, and SharedWorkers do\r\nnot inherit the controller.\r\n\r\nSetting the policy to Enabled or leaving it unset means\r\nGoogle Chrome inherit the controller\r\nif a blob URL is used as a SharedWorker URL.\r\n\r\nSetting the policy to Disabled leaves the behavior not aligned with the\r\nspecification as-is.\r\n\r\nThis policy is intended to be temporary and will be removed in the future.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_sharedworkerbloburlfixenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_sharedworkerbloburlfixenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_shoppinglistenabled","displayName":"Allow the shopping list feature to be enabled","description":"This policy controls the availability of the shopping list feature.\r\nIf enabled, users will be presented with UI to track the price of the product displayed on the current page. The tracked product will be shown in the bookmarks side panel.\r\nIf this policy is set to Enabled or not set, the shopping list feature will be available to users.\r\nIf this policy is set to Disabled, the shopping list feature will be unavailable.\r\n","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_shoppinglistenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_shoppinglistenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_sidesearchenabled","displayName":"Allow showing the most recent default search engine results page in a Browser side panel","description":"Setting the policy to Enabled or leaving the policy unset means that users can bring up their most recent default search engine results page in a side panel via toggling an icon in the toolbar.\r\n\r\nSetting the policy to Disabled removes the icon from the toolbar that opens the side panel with the default search engine results page.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_sidesearchenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_sidesearchenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_sitesearchsettings","displayName":"Site search settings","description":"This policy provides a list of sites that users can quickly search using shortcuts in the address bar. Users can initiate a search by typing the shortcut or @shortcut (e.g. @work), followed by Space or Tab, in the address bar.\r\n\r\nThe following fields are required for each site: name, shortcut, url.\r\n\r\nThe name field corresponds to the site or search engine name to be shown to the user in the address bar.\r\n\r\nThe shortcut can include plain words and characters, but cannot include spaces or start with the @ symbol. Shortcuts must also be unique.\r\n\r\nFor each entry, the url field specifies the URL of the search engine used during a search with the corresponding keyword. The URL must include the string '{searchTerms}', replaced in the query by the user's search terms. Invalid entries and entries with duplicate shortcuts are ignored.\r\n\r\nSite search entries configured as featured are displayed in the address bar when the user types \"@\". Up to three entries can be selected as featured.\r\n\r\nFor a site search entry where allow_user_override is true, users have the ability to edit or disable that entry. However, featured engines (beginning with \"@\") can only be disabled. If a user modifies an entry that was initially created by this policy, it will no longer be managed by policy and will be treated like a user-created shortcut. When allow_user_override is false or unspecified for a site search entry, users cannot edit or disable that entry. The setting to allow user override is only supported on M139 and later; earlier versions will default to disabling user override.\r\n\r\nUsers cannot create new site search entries with a shortcut previously created via this policy unless allow_user_override is set to true for the site search entry.\r\n\r\nIn case of a conflict with a shortcut previously created by the user, the user setting takes precedence. However, users can still trigger the option created by the policy by typing \"@\" in the search bar. For example, if the user already defined \"work\" as a shortcut to URL1 and the policy defines \"work\" as a shortcut to URL2, then typing \"work\" in the search bar will trigger a search to URL1, but typing \"@work\" in the search bar will trigger a search to URL2.\r\n\r\nOn Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core.\r\n\r\nOn macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=SiteSearchSettings for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"featured\": true,\r\n \"name\": \"Google Wikipedia\",\r\n \"shortcut\": \"wikipedia\",\r\n \"url\": \"https://www.google.com/search?q=site%3Awikipedia.com+%s\"\r\n },\r\n {\r\n \"name\": \"YouTube\",\r\n \"shortcut\": \"youtube\",\r\n \"url\": \"https://www.youtube.com/results?search_query=%s\"\r\n },\r\n {\r\n \"name\": \"Google Drive\",\r\n \"shortcut\": \"drive\",\r\n \"url\": \"https://drive.google.com/?q=%s\",\r\n \"allow_user_override\": true\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_sitesearchsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_sitesearchsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_sitesearchsettings_sitesearchsettings","displayName":"Site search settings (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_standardizedbrowserzoomenabled","displayName":"Enable Standardized Browser Zoom Behavior","description":"This policy enables conformance to the newly-adopted specification of CSS zoom.\r\n\r\nWhen this policy is Enabled or unset, the CSS \"zoom\" property will adhere to the specification:\r\n\r\nhttps://drafts.csswg.org/css-viewport/#zoom-property\r\n\r\nWhen Disabled, the CSS \"zoom\" property will fall back to its legacy pre-standardized behavior.\r\n\r\nThis policy is a temporary reprieve to allow time to migrate web content to the new behavior. There is also an origin trial (\"DisableStandardizedBrowserZoom\") that corresponds to the behavior when this policy is Disabled. This policy will be removed and the \"Enabled\" behavior made permanent in milestone 134.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_standardizedbrowserzoomenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_standardizedbrowserzoomenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_strictmimetypecheckforworkerscriptsenabled","displayName":"Enable strict MIME type checking for worker scripts","description":"This policy enables strict MIME type checking for worker scripts.\r\n\r\nWhen enabled or unset, then worker scripts will use strict MIME type checking for JavaScript, which is the new default behaviour. Worker scripts with legacy MIME types will be rejected.\r\n\r\nWhen disabled, then worker scripts will use lax MIME type checking, so that worker scripts with legacy MIME types, e.g. text/ascii, will continue to be loaded and executed.\r\n\r\nBrowsers traditionally used lax MIME type checking, so that resources with a number of legacy MIME types were supported. E.g. for JavaScript resources, text/ascii is a legacy supported MIME type. This may cause security issues, by allowing to load resources as scripts that were never intended to be used as such. Chrome will transition to use strict MIME type checking in the near future. The enabled policy will track the default behaviour. Disabling this policy allows administrators to retain the legacy behaviour, if desired.\r\n\r\nSee https://html.spec.whatwg.org/multipage/scripting.html#scriptingLanguage for details about JavaScript / ECMAScript media types.\r\n","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_strictmimetypecheckforworkerscriptsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_strictmimetypecheckforworkerscriptsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_tabdiscardingexceptions","displayName":"URL pattern Exceptions to tab discarding","description":"This policy makes it so that any URL matching one or more of the patterns it specifies (using the URLBlocklist filter format) will never be discarded by the browser.\r\nThis applies to memory pressure and high efficiency mode discarding.\r\nA discarded page is unloaded and its resources fully reclaimed. The tab its associated with remains in the tabstrip, but making it visible will trigger a full reload.\r\n\r\n\r\nExample value:\r\n\r\nexample.com\r\nhttps://*\r\n*","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_tabdiscardingexceptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_tabdiscardingexceptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_tabdiscardingexceptions_tabdiscardingexceptionsdesc","displayName":"URL pattern Exceptions to tab discarding (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_tls13earlydataenabled","displayName":"Enable TLS 1.3 Early Data","description":"TLS 1.3 Early Data is an extension to TLS 1.3 to send an HTTP request simultaneously with the TLS handshake.\r\n\r\nIf this policy is not configured, Google Chrome will follow the default rollout process for TLS 1.3 Early Data.\r\n\r\nIf it is enabled, Google Chrome will enable TLS 1.3 Early Data.\r\n\r\nIf it is disabled, Google Chrome will not enable TLS 1.3 Early Data.\r\n\r\nWhen the feature is enabled, Google Chrome may or may not use TLS 1.3 Early Data depending on server support.\r\n\r\nTLS 1.3 Early Data is an established protocol. Existing TLS servers, middleboxes, and security software are expected to either handle or reject TLS 1.3 Early Data without dropping the connection.\r\n\r\nHowever, devices that do not correctly implement TLS may malfunction and disconnect when TLS 1.3 Early Data is in use. If this occurs, administrators should contact the vendor for a fix.\r\n\r\nThis policy is a temporary measure to control the feature and will be removed afterwards. The policy may be enabled to allow you to test for issues and disabled while issues are being resolved.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_tls13earlydataenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_tls13earlydataenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_translatorapiallowed","displayName":"Allow Translator API","description":"Setting the policy to Enabled or leaving it unset allows the use of Translator API in Google Chrome.\r\n\r\nSetting the policy to Disabled disallows the use of Translator API.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_translatorapiallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_translatorapiallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_webappsettings","displayName":"Web App management settings","description":"This policy allows an admin to specify settings for installed web apps. This policy maps a Web App ID to its specific setting. A default configuration can be set using the special ID *, which applies to all web apps without a custom configuration in this policy.\r\n\r\nThe manifest_id field is the Manifest ID for the Web App. See https://developer.chrome.com/blog/pwa-manifest-id/ for instructions on how to determine the Manifest ID for an installed web app.\r\nThe run_on_os_login field specifies if a web app can be run during OS login. If this field is set to blocked, the web app will not run during OS login and the user will not be able to enable this later. If this field is set to run_windowed, the web app will run during OS login and the user will not be able to disable this later. If this field is set to allowed, the user will be able to configure the web app to run at OS login. The default configuration only allows the allowed and blocked values.\r\n(Since version 117) The prevent_close_after_run_on_os_login field specifies if a web app shall be prevented from closing in any way (e.g. by the user, task manager, web APIs). This behavior can only be enabled if run_on_os_login is set to run_windowed. If the app were already running, this property will only come into effect after the app is restarted. If this field is not defined, apps will be closable by users.\r\n(Since version 118) The force_unregister_os_integration field specifies if all OS integration for a web app, i.e. shortcuts, file handlers, protocol handlers etc will be removed or not. If an app is already running, this property will come into effect after the app has restarted. This should be used with caution, since this can override any OS integration that is set automatically during the startup of the web applications system. Currently only works on Windows, Mac and Linux platforms.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=WebAppSettings for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"manifest_id\": \"https://foo.example/index.html\",\r\n \"run_on_os_login\": \"allowed\"\r\n },\r\n {\r\n \"manifest_id\": \"https://bar.example/index.html\",\r\n \"run_on_os_login\": \"allowed\"\r\n },\r\n {\r\n \"manifest_id\": \"https://foobar.example/index.html\",\r\n \"run_on_os_login\": \"run_windowed\",\r\n \"prevent_close_after_run_on_os_login\": true\r\n },\r\n {\r\n \"manifest_id\": \"*\",\r\n \"run_on_os_login\": \"blocked\"\r\n },\r\n {\r\n \"manifest_id\": \"https://foo.example/index.html\",\r\n \"force_unregister_os_integration\": true\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_webappsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_webappsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_webappsettings_webappsettings","displayName":"Web App management settings (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_webaudiooutputbufferingenabled","displayName":"Enable adaptive buffering for Web Audio","description":"This policy controls whether the browser uses adaptive buffering for\r\nWeb Audio, which may decrease audio glitches but may increase\r\nlatency by a variable amount.\r\n\r\nSetting the policy to Enabled will always use adaptive buffering.\r\n\r\nSetting the policy to Disabled or not set will allow the browser\r\nfeature launch process to decide if adaptive buffering is used.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_webaudiooutputbufferingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_webaudiooutputbufferingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_webauthenticationremotedesktopallowedorigins","displayName":"Allowed Origins for Proxied WebAuthn Requests from Remote Desktop Applications.","description":"A list of origins of remote desktop client apps that may execute WebAuthn API\r\nrequests that originate from a browsing session on a remote host.\r\n\r\nAny origin configured in this policy can make WebAuthn requests for Relying\r\nParty IDs (RP IDs) that it would normally not allowed to be able to claim.\r\n\r\nOnly valid HTTPS origins are allowed. Wildcards are not supported.\r\nAny invalid entries are ignored.\r\n\r\nExample value:\r\n\r\nhttps://remotedesktop.google.com\r\nhttps://vdi.corp.example\r\nhttps://server:8080/","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_webauthenticationremotedesktopallowedorigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_webauthenticationremotedesktopallowedorigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_webauthenticationremotedesktopallowedorigins_webauthenticationremotedesktopallowedoriginsdesc","displayName":"Allowed Origins for Proxied WebAuthn Requests from Remote Desktop Applications. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_webrtctextlogcollectionallowed","displayName":"Allow WebRTC text logs collection from Google Services","description":"Setting the policy to enabled means Google Chrome can collect WebRTC text logs from Google services such as Google Meet and upload them to Google. These logs have diagnostic information for debugging issues with audio or video meetings in Google Chrome, such as textual metadata describing incoming and outgoing WebRTC streams, WebRTC specific log entries and additional system information. These logs have no audio or video content from the meeting.\r\nSetting the policy to disabled results in no uploading of such logs to Google. Logs would still accumulate locally on the user's device.\r\nLeaving the policy unset means Google Chrome defaults to being able to collect and upload these logs.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_webrtctextlogcollectionallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome_webrtctextlogcollectionallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~accessibility_livecaptionenabled","displayName":"Enable Live Caption","description":"Enable the Live Caption feature.\r\n\r\nIf this policy is set to Enabled, Live Caption will always be turned on.\r\n\r\nIf this policy is set to Disabled, Live Caption will always be turned off.\r\n\r\nIf you set this policy as mandatory, users cannot change or override it.\r\n\r\nIf this policy is left unset, Live Caption is disabled initially but can be enabled by the user anytime.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~accessibility_livecaptionenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~accessibility_livecaptionenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~accessibility_livetranslateenabled","displayName":"Enable Live Translate","description":"Enable translation of live captions. Captions will be sent to Google for translation.\r\n\r\nIf this policy is set to Enabled, Live Translate will always be turned on.\r\n\r\nIf this policy is set to Disabled, Live Translate will always be turned off.\r\n\r\nIf you set this policy as mandatory, users cannot change or override it.\r\n\r\nIf this policy is left unset, Live Translate is disabled initially but can be enabled by the user anytime.\r\n\r\nIn LiveCaptionEnabled is set to Disabled, Live Translate will be disabled regardless of this policy setting.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~accessibility_livetranslateenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~accessibility_livetranslateenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~accessibility_uiautomationproviderenabled","displayName":"Enable the browser's UI Automation accessibility framework provider on Windows","description":"Enables the UI Automation accessibility framework\r\nprovider in Google Chrome for use by\r\naccessibility tools.\r\n\r\nThis policy is supported in\r\nGoogle Chrome for a one-year\r\ntransition period to allow enterprise administrators to control the deployment\r\nof the browser's UI Automation accessibility\r\nframework provider. Accessibility and other tools that use the\r\nUI Automation accessibility framework to interoperate\r\nwith the browser may require updates to function properly with the browser's\r\nUI Automation provider. Administrators can use this\r\npolicy to temporarily disable the browser's\r\nUI Automation provider (thereby reverting to the old\r\nbehavior) while they work with vendors to provide updates to impacted tools.\r\n\r\nWhen set to false, Google Chrome only\r\nenables its Microsoft Active Accessibility\r\nprovider. Accessibility and other tools that use the newer\r\nUI Automation accessibility framework to interoperate\r\nwith the browser will communicate with it by way of a compatibility shim in\r\nMicrosoft® Windows®.\r\n\r\nWhen set to true, Google Chrome\r\nenables its UI Automation provider in addition to its\r\nMicrosoft Active Accessibility provider.\r\nAccessibility and other tools that use the newer\r\nUI Automation accessibility framework to interoperate\r\nwith the browser will communicate directly with it.\r\n\r\nWhen left unset, the variations framework in Google Chrome is used to enable or disable\r\nthe provider.\r\n\r\nSupport for this policy setting will end in Google Chrome 146.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~accessibility_uiautomationproviderenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~accessibility_uiautomationproviderenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~activedirectorymanagement_cloudapauthenabled","displayName":"Allow automatic sign-in to Microsoft® cloud identity providers","description":"Configures automatic user sign-in for accounts backed by a Microsoft® cloud identity provider.\r\n\r\nBy setting this policy to 1 (Enabled), users who sign into their computer with an account backed by a Microsoft® cloud identity provider (i.e., Microsoft® Azure® Active Directory® or the consumer Microsoft® account identity provider) or who have added a work or school account to Microsoft® Windows® can be signed into web properties using that identity automatically. Information pertaining to the user's device and account is transmitted to the user's cloud identity provider for each authentication event.\r\n\r\nBy setting this policy to 0 (Disabled) or leaving it unset, automatic sign-in as described above is disabled.\r\n\r\nThis feature is available starting in Microsoft® Windows® 10.\r\n\r\nNote: This policy doesn't apply to Incognito or Guest modes.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~activedirectorymanagement_cloudapauthenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~activedirectorymanagement_cloudapauthenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~activedirectorymanagement_cloudapauthenabled_cloudapauthenabled","displayName":"Allow automatic sign-in to Microsoft® cloud identity providers (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~activedirectorymanagement_cloudapauthenabled_cloudapauthenabled_0","displayName":"Disable Microsoft® cloud authentication","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~activedirectorymanagement_cloudapauthenabled_cloudapauthenabled_1","displayName":"Enable Microsoft® cloud authentication","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~browseridle_idletimeout","displayName":"Delay before running idle actions","description":"Triggers an action when the computer is idle.\r\n\r\nIf this policy is set, it specifies the length of time without user input (in minutes) before the browser runs actions configured via the IdleTimeoutActions policy.\r\n\r\nIf this policy is not set, no action will be ran.\r\n\r\nThe minimum threshold is 1 minute.\r\n\r\n\"User input\" is defined by Operating System APIs, and includes things like moving the mouse or typing on the keyboard.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~browseridle_idletimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~browseridle_idletimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~browseridle_idletimeout_idletimeout","displayName":"Delay before running idle actions: (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~browseridle_idletimeoutactions","displayName":"Actions to run when the computer is idle","description":"List of actions to run when the timeout from the IdleTimeout policy is reached.\r\n\r\nWarning: Setting this policy can impact and permanently remove local personal data. It is recommended to test your settings before deploying to prevent accidental deletion of personal data.\r\n\r\nIf the IdleTimeout policy is unset, this policy has no effect.\r\n\r\nWhen the timeout from the IdleTimeout policy is reached, the browser runs the actions configured in this policy.\r\n\r\nIf this policy is empty or left unset, the IdleTimeout policy has no effect.\r\n\r\nSupported actions are:\r\n\r\n'close_browsers': close all browser windows and PWAs for this profile. Not supported on Android and iOS.\r\n\r\n'close_tabs': close all open tabs in open windows. Only supported on iOS.\r\n\r\n'show_profile_picker': show the Profile Picker window. Not supported on Android and iOS.\r\n\r\n'sign_out': Signs out the current signed in user. Only supported on iOS.\r\n\r\n'clear_browsing_history', 'clear_download_history', 'clear_cookies_and_other_site_data', 'clear_cached_images_and_files', 'clear_password_signing', 'clear_autofill', 'clear_site_settings', 'clear_hosted_app_data': clear the corresponding browsing data. See the ClearBrowsingDataOnExitList policy for more details. The types supported on iOS are 'clear_browsing_history', 'clear_cookies_and_other_site_data', 'clear_cached_images_and_files', 'clear_password_signing', and 'clear_autofill'\r\n\r\n'reload_pages': reload all webpages. For some pages, the user may be prompted for confirmation first. Not supported on iOS.\r\n\r\nThe user will stay signed into their Google account when deleting cookies using 'clear_cookies_and_other_site_data'.\r\n\r\nSetting 'clear_browsing_history', 'clear_password_signing', 'clear_autofill', and 'clear_site_settings' will disable sync for the respective data types if neither `Chrome Sync` is disabled by setting the SyncDisabled policy nor BrowserSignin is disabled.\r\n\r\nExample value:\r\n\r\nclose_browsers\r\nshow_profile_picker","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~browseridle_idletimeoutactions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~browseridle_idletimeoutactions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~browseridle_idletimeoutactions_idletimeoutactionsdesc","displayName":"Actions to run when the computer is idle (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cacertificatemanagementallowed","displayName":"Allow users to manage installed CA certificates.","description":"Setting the policy to All (0) or leaving it unset lets users edit trust settings for all CA certificates, remove user-imported certificates, and import certificates using Certificate Manager. Setting the policy to UserOnly (1) lets users manage only user-imported certificates, but not change trust settings of built-in certificates. Setting it to None (2) lets users view (not manage) CA certificates.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cacertificatemanagementallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cacertificatemanagementallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cacertificatemanagementallowed_cacertificatemanagementallowed","displayName":"Allow users to manage installed CA certificates. (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cacertificatemanagementallowed_cacertificatemanagementallowed_0","displayName":"Allow users to manage all certificates","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cacertificatemanagementallowed_cacertificatemanagementallowed_1","displayName":"Allow users to manage user certificates","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cacertificatemanagementallowed_cacertificatemanagementallowed_2","displayName":"Disallow users from managing certificates","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cacertificates","displayName":"TLS certificates that should be trusted by Google Chrome for server authentication","description":"A list of TLS certificates that should be trusted by Google Chrome for server authentication.\r\nCertificates should be base64-encoded.\r\n\r\nExample value:\r\n\r\nMIICCTCCAY6gAwIBAgINAgPluILrIPglJ209ZjAKBggqhkjOPQQDAzBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQfTzOHMymKoYTey8chWEGJ6ladK0uFxh1MJ7x/JlFyb+Kf1qPKzEUURout736GjOyxfi//qXGdGIRFBEFVbivqJn+7kAHjSxm65FSWRQmx1WyRRK2EE46ajA2ADDL24CejQjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTB8Sa6oC2uhYHP0/EqEr24Cmf9vDAKBggqhkjOPQQDAwNpADBmAjEA9uEglRR7VKOQFhG/hMjqb2sXnh5GmCCbn9MN2azTL818+FsuVbu/3ZL3pAzcMeGiAjEA/JdmZuVDFhOD3cffL74UOO0BzrEXGhF16b0DjyZ+hOXJYKaV11RZt+cRLInUue4X","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cacertificates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cacertificates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cacertificates_cacertificatesdesc","displayName":"TLS certificates that should be trusted by Google Chrome for server authentication (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cacertificateswithconstraints","displayName":"TLS certificates that should be trusted by Google Chrome for server authentication with constraints","description":"A list of TLS certificates that should be trusted by Google Chrome for server authentication, with constraints added outside the certificate. If no constraint of a certain type is present, then any name of that type is allowed.\r\nCertificates should be base64-encoded. At least one constraint must be specified for each certificate.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=CACertificatesWithConstraints for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"certificate\": \"MIICCTCCAY6gAwIBAgINAgPluILrIPglJ209ZjAKBggqhkjOPQQDAzBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQfTzOHMymKoYTey8chWEGJ6ladK0uFxh1MJ7x/JlFyb+Kf1qPKzEUURout736GjOyxfi//qXGdGIRFBEFVbivqJn+7kAHjSxm65FSWRQmx1WyRRK2EE46ajA2ADDL24CejQjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTB8Sa6oC2uhYHP0/EqEr24Cmf9vDAKBggqhkjOPQQDAwNpADBmAjEA9uEglRR7VKOQFhG/hMjqb2sXnh5GmCCbn9MN2azTL818+FsuVbu/3ZL3pAzcMeGiAjEA/JdmZuVDFhOD3cffL74UOO0BzrEXGhF16b0DjyZ+hOXJYKaV11RZt+cRLInUue4X\",\r\n \"constraints\": {\r\n \"permitted_dns_names\": [\r\n \"example.org\"\r\n ],\r\n \"permitted_cidrs\": [\r\n \"10.1.1.0/24\"\r\n ]\r\n }\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cacertificateswithconstraints_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cacertificateswithconstraints_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cacertificateswithconstraints_cacertificateswithconstraints","displayName":"TLS certificates that should be trusted by Google Chrome for server authentication with constraints (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cadistrustedcertificates","displayName":"TLS certificates that should be distrusted by Google Chrome for server authentication","description":"A list of certificate public keys that should be distrusted by Google Chrome for TLS server\r\nauthentication.\r\n\r\nThe policy value is a list of base64-encoded X.509 certificates. Any\r\ncertificate with a matching SPKI (SubjectPublicKeyInfo) will be distrusted.\r\n\r\nExample value:\r\n\r\nMIIB/TCCAaOgAwIBAgIUQthnWVsd1jWpUCNBf/uILjXC+t4wCgYIKoZIzj0EAwIwVDELMAkGA1UEBhMCVVMxETAPBgNVBAgMCFZpcmdpbmlhMQ8wDQYDVQQHDAZSZXN0b24xITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMzEyMDcxNjE5NTVaFw0yMzEyMjExNjE5NTVaMFQxCzAJBgNVBAYTAlVTMREwDwYDVQQIDAhWaXJnaW5pYTEPMA0GA1UEBwwGUmVzdG9uMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQ9Akav/KB0aVA9FM1QK4J1CEHn5rFOyY/nxcr5HG3+Fom0Kwu5zTR/kz9eOYgtG/1NmCzbiEKaULDfzA8V9aJ7o1MwUTAdBgNVHQ4EFgQUq37bLKiuw8Y/G+rurMf46hw7EekwHwYDVR0jBBgwFoAUq37bLKiuw8Y/G+rurMf46hw7EekwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNIADBFAiEA/JhtLSgtVOcXkgFJ9V5Vb6lhGdiKQFfzO9wTxPeCxCECIFePYPucys2n/r9MOBMHiX/8068ssv+uceqokzUg0mAb","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cadistrustedcertificates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cadistrustedcertificates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cadistrustedcertificates_cadistrustedcertificatesdesc","displayName":"TLS certificates that should be distrusted by Google Chrome for server authentication (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cahintcertificates","displayName":"TLS certificates that are not trusted or distrusted but can be used in path-building for server authentication","description":"A list of certificates that are not trusted or distrusted in Google Chrome\r\nbut can be used as hints for path-building. Certificates should be base64-encoded.\r\n\r\nExample value:\r\n\r\nMIIFljCCA36gAwIBAgINAgO8U1lrNMcY9QFQZjANBgkqhkiG9w0BAQsFADBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjEwHhcNMjAwODEzMDAwMDQyWhcNMjcwOTMwMDAwMDQyWjBGMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzETMBEGA1UEAxMKR1RTIENBIDFDMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPWI3+dijB43+DdCkH9sh9D7ZYIl/ejLa6T/belaI+KZ9hzpkgOZE3wJCor6QtZeViSqejOEH9Hpabu5dOxXTGZok3c3VVP+ORBNtzS7XyV3NzsXlOo85Z3VvMO0Q+sup0fvsEQRY9i0QYXdQTBIkxu/t/bgRQIh4JZCF8/ZK2VWNAcmBA2o/X3KLu/qSHw3TT8An4Pf73WELnlXXPxXbhqW//yMmqaZviXZf5YsBvcRKgKAgOtjGDxQSYflispfGStZloEAoPtR28p3CwvJlk/vcEnHXG0g/Zm0tOLKLnf9LdwLtmsTDIwZKxeWmLnwi/agJ7u2441Rj72ux5uxiZ0CAwEAAaOCAYAwggF8MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUinR/r4XN7pXNPZzQ4kYU83E1HScwHwYDVR0jBBgwFoAU5K8rJnEaK0gnhS9SZizv8IkTcT4waAYIKwYBBQUHAQEEXDBaMCYGCCsGAQUFBzABhhpodHRwOi8vb2NzcC5wa2kuZ29vZy9ndHNyMTAwBggrBgEFBQcwAoYkaHR0cDovL3BraS5nb29nL3JlcG8vY2VydHMvZ3RzcjEuZGVyMDQGA1UdHwQtMCswKaAnoCWGI2h0dHA6Ly9jcmwucGtpLmdvb2cvZ3RzcjEvZ3RzcjEuY3JsMFcGA1UdIARQME4wOAYKKwYBBAHWeQIFAzAqMCgGCCsGAQUFBwIBFhxodHRwczovL3BraS5nb29nL3JlcG9zaXRvcnkvMAgGBmeBDAECATAIBgZngQwBAgIwDQYJKoZIhvcNAQELBQADggIBAIl9rCBcDDy+mqhXlRu0rvqrpXJxtDaV/d9AEQNMwkYUuxQkq/BQcSLbrcRuf8/xam/IgxvYzolfh2yHuKkMo5uhYpSTld9brmYZCwKWnvy15xBpPnrLRklfRuFBsdeYTWU0AIAaP0+fbH9JAIFTQaSSIYKCGvGjRFsqUBITTcFTNvNCCK9U+o53UxtkOCcXCb1YyRt8OS1b887U7ZfbFAO/CVMkH8IMBHmYJvJh8VNS/UKMG2YrPxWhu//2m+OBmgEGcYk1KCTd4b3rGS3hSMs9WYNRtHTGnXzGsYZbr8w0xNPM1IERlQCh9BIiAfq0g3GvjLeMcySsN1PCAJA/Ef5c7TaUEDu9Ka7ixzpiO2xj2YC/WXGsYye5TBeg2vZzFb8q3o/zpWwygTMD0IZRcZk0upONXbVRWPeyk+gB9lm+cZv9TSjOz23HFtz30dZGm6fKa+l3D/2gthsjgx0QGtkJAITgRNOidSOzNIb2ILCkXhAd4FJGAJ2xDx8hcFH1mt0G/FX0Kw4zd8NLQsLxdxP8c4CU6x+7Nz/OAipmsHMdMqUybDKwjuDEI/9bfU1lcKwrmz3O2+BtjjKAvpafkmO8l7tdufThcV4q5O8DIrGKZTqPwJNl1IXNDw9bg1kWRxYtnCQ6yICmJhSFm/Y3m6xv+cXDBlHz4n/FsRC6UfTd","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cahintcertificates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cahintcertificates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_cahintcertificates_cahintcertificatesdesc","displayName":"TLS certificates that are not trusted or distrusted but can be used in path-building for server authentication (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_caplatformintegrationenabled","displayName":"Use user-added TLS certificates from platform trust stores for server authentication","description":"If enabled(or not set), user-added TLS certificates from platform trust stores will be used in path-building for TLS server authentication.\r\n\r\nIf disabled, user-added TLS certificates from platform trust stores will not be used in path-building for TLS server authentication.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_caplatformintegrationenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~certificatemanagement_caplatformintegrationenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_automaticfullscreenallowedforurls","displayName":"Allow automatic fullscreen on these sites","description":"For security reasons, the\r\nrequestFullscreen() web API\r\nrequires a prior user gesture (\"transient activation\") to be called or will\r\notherwise fail. Users' personal settings may allow certain origins to call\r\nthis API without a prior user gesture, as described in\r\nhttps://chromestatus.com/feature/6218822004768768.\r\n\r\nThis policy supersedes users' personal settings and allows matching origins to\r\ncall the API without a prior user gesture.\r\n\r\nFor detailed information on valid url patterns, please see\r\nhttps://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.\r\nWildcards, *, are allowed.\r\n\r\nOrigins matching both blocked and allowed policy patterns will be blocked.\r\nOrigins not specified by policy nor user settings will require a prior user\r\ngesture to call this API.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_automaticfullscreenallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_automaticfullscreenallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_automaticfullscreenallowedforurls_automaticfullscreenallowedforurlsdesc","displayName":"Allow automatic fullscreen on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_automaticfullscreenblockedforurls","displayName":"Block automatic fullscreen on these sites","description":"For security reasons, the\r\nrequestFullscreen() web API\r\nrequires a prior user gesture (\"transient activation\") to be called or will\r\notherwise fail. Users' personal settings may allow certain origins to call\r\nthis API without a prior user gesture, as described in\r\nhttps://chromestatus.com/feature/6218822004768768.\r\n\r\nThis policy supersedes users' personal settings and blocks matching origins\r\nfrom calling the API without a prior user gesture.\r\n\r\nFor detailed information on valid url patterns, please see\r\nhttps://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.\r\nWildcards, *, are allowed.\r\n\r\nOrigins matching both blocked and allowed policy patterns will be blocked.\r\nOrigins not specified by policy nor user settings will require a prior user\r\ngesture to call this API.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_automaticfullscreenblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_automaticfullscreenblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_automaticfullscreenblockedforurls_automaticfullscreenblockedforurlsdesc","displayName":"Block automatic fullscreen on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_clipboardallowedforurls","displayName":"Allow clipboard on these sites","description":"Setting the policy lets you set a list of URL patterns that specify sites that can use the clipboard site permission. This does not include all clipboard operations on origins matching the patterns. For instance, users will still be able to paste using keyboard shortcuts as this isn't gated by the clipboard site permission.\r\n\r\n\r\nLeaving the policy unset means DefaultClipboardSetting applies for all sites, if it's set. If not, the user's personal setting applies.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. Wildcards, *, are allowed.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_clipboardallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_clipboardallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_clipboardallowedforurls_clipboardallowedforurlsdesc","displayName":"Allow clipboard on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_clipboardblockedforurls","displayName":"Block clipboard on these sites","description":"Setting the policy lets you set a list of URL patterns that specify sites that can't use the clipboard site permission. This does not include all clipboard operations on origins matching the patterns. For instance, users will still be able to paste using keyboard shortcuts as this isn't gated by the clipboard site permission.\r\n\r\nLeaving the policy unset means DefaultClipboardSetting applies for all sites, if it's set. If not, the user's personal setting applies.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. Wildcards, *, are allowed.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_clipboardblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_clipboardblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_clipboardblockedforurls_clipboardblockedforurlsdesc","displayName":"Block clipboard on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_dataurlinsvguseenabled","displayName":"Data URL support for SVGUseElement.","description":"This policy enables Data URL support for SVGUseElement, which will be disabled\r\nby default starting in M119.\r\nIf this policy is set to Enabled, Data URLs will continue to work in SVGUseElement.\r\nIf this policy is set to Disabled or not set, Data URLs won't work in SVGUseElement.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_dataurlinsvguseenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_dataurlinsvguseenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultclipboardsetting","displayName":"Default clipboard setting","description":"Setting the policy to 2 blocks sites from using the clipboard site permission. Setting the policy to 3 or leaving it unset lets the user change the setting and decide if the clipboard APIs are available when a site wants to use one.\r\n\r\nThis policy can be overridden for specific URL patterns using the ClipboardAllowedForUrls and ClipboardBlockedForUrls policies.\r\n\r\nThis policy only affects clipboard operations controlled by the clipboard site permission, and does not affect sanitized clipboard writes or trusted copy and paste operations.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultclipboardsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultclipboardsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultclipboardsetting_defaultclipboardsetting","displayName":"Default clipboard setting (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultclipboardsetting_defaultclipboardsetting_2","displayName":"Do not allow any site to use the clipboard site permission","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultclipboardsetting_defaultclipboardsetting_3","displayName":"Allow sites to ask the user to grant the clipboard site permission","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultjavascriptoptimizersetting","displayName":"Control use of JavaScript optimizers","description":"Allows you to set whether Google Chrome\r\nwill run the v8 JavaScript engine with more advanced JavaScript optimizations enabled.\r\n\r\nDisabling JavaScript optimizations (by setting this policy's value to 2) will\r\nmean that Google Chrome may render web\r\ncontent more slowly.\r\n\r\nThis policy can be overridden for specific URL patterns using the JavaScriptOptimizerAllowedForSites and JavaScriptOptimizerBlockedForSites policies.\r\n\r\nIf this policy is left not set, JavaScript optimizations are enabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultjavascriptoptimizersetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultjavascriptoptimizersetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultjavascriptoptimizersetting_defaultjavascriptoptimizersetting","displayName":"Control use of JavaScript optimizers (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultjavascriptoptimizersetting_defaultjavascriptoptimizersetting_1","displayName":"Enable advanced JavaScript optimizations on all sites","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultjavascriptoptimizersetting_defaultjavascriptoptimizersetting_2","displayName":"Disable advanced JavaScript optimizations on all sites","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultlocalfontssetting","displayName":"Default Local Fonts permission setting","description":"Setting the policy to BlockLocalFonts (value 2) automatically denies the local fonts permission to sites by default. This will limit the ability of sites to see information about local fonts.\r\n\r\nSetting the policy to AskLocalFonts (value 3) will prompt the user when the local fonts permission is requested by default. If users allow the permission, it will extend the ability of sites to see information about local fonts.\r\n\r\nLeaving the policy unset means the default behavior applies which is to prompt the user, but users can change this setting","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultlocalfontssetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultlocalfontssetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultlocalfontssetting_defaultlocalfontssetting","displayName":"Default Local Fonts permission setting (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultlocalfontssetting_defaultlocalfontssetting_2","displayName":"Denies the Local Fonts permission on all sites by default","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultlocalfontssetting_defaultlocalfontssetting_3","displayName":"Ask every time a site wants obtain the Local Fonts permission","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultwebhidguardsetting","displayName":"Control use of the WebHID API","description":"Setting the policy to 3 lets websites ask for access to HID devices. Setting the policy to 2 denies access to HID devices.\r\n\r\nLeaving it unset lets websites ask for access, but users can change this setting.\r\n\r\nThis policy can be overridden for specific url patterns using the WebHidAskForUrls and WebHidBlockedForUrls policies.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultwebhidguardsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultwebhidguardsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultwebhidguardsetting_defaultwebhidguardsetting","displayName":"Control use of the WebHID API (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultwebhidguardsetting_defaultwebhidguardsetting_2","displayName":"Do not allow any site to request access to HID devices via the WebHID API","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultwebhidguardsetting_defaultwebhidguardsetting_3","displayName":"Allow sites to ask the user to grant access to a HID device","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultwindowmanagementsetting","displayName":"Default Window Management permission setting","description":"Setting the policy to BlockWindowManagement (value 2) automatically denies the window management permission to sites by default. This will limit the ability of sites to see information about the device's screens and use that information to open and place windows or request fullscreen on specific screens.\r\n\r\nSetting the policy to AskWindowManagement (value 3) will prompt the user when the window management permission is requested by default. If users allow the permission, it will extend the ability of sites to see information about the device's screens and use that information to open and place windows or request fullscreen on specific screens.\r\n\r\nLeaving the policy unset means the AskWindowManagement policy applies, but users can change this setting.\r\n\r\nThis replaces the deprecated DefaultWindowPlacementSetting policy.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultwindowmanagementsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultwindowmanagementsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultwindowmanagementsetting_defaultwindowmanagementsetting","displayName":"Default Window Management permission setting (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultwindowmanagementsetting_defaultwindowmanagementsetting_2","displayName":"Denies the Window Management permission on all sites by default","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_defaultwindowmanagementsetting_defaultwindowmanagementsetting_3","displayName":"Ask every time a site wants obtain the Window Management permission","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_javascriptoptimizerallowedforsites","displayName":"Allow JavaScript optimization on these sites","description":"Allows you to set a list of site url patterns that specify sites for which\r\nadvanced JavaScript optimizations are enabled.\r\n\r\nFor detailed information on valid site url patterns, please see\r\nhttps://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.\r\nWildcards, *, are allowed.\r\n\r\nJavaScript optimization policy exceptions will only be enforced at a site\r\ngranularity (eTLD+1). A policy set for only subdomain.site.com will not\r\ncorrectly apply to site.com or subdomain.site.com since they both resolve to\r\nthe same eTLD+1 (site.com) for which there is no policy. In this case, policy\r\nmust be set on site.com to apply correctly for both site.com and\r\nsubdomain.site.com.\r\n\r\nThis policy applies on a frame-by-frame basis and not based on top level\r\norigin url alone, so e.g. if site-one.com is listed in the JavaScriptOptimizerAllowedForSites policy but site-one.com loads a frame containing site-two.com then site-one.com will have JavaScript optimizations\r\nenabled, but site-two.com will use the policy from DefaultJavaScriptOptimizerSetting, if set, or default to JavaScript\r\noptimizations enabled. Blocklist entries have higher priority than allowlist\r\nentries, which in turn have higher priority than the configured default value.\r\n\r\nIf this policy is not set for a site then the policy from DefaultJavaScriptOptimizerSetting applies to the site, if set, otherwise\r\nJavascript optimization is enabled for the site.\r\n\r\nExample value:\r\n\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_javascriptoptimizerallowedforsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_javascriptoptimizerallowedforsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_javascriptoptimizerallowedforsites_javascriptoptimizerallowedforsitesdesc","displayName":"Allow JavaScript optimization on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_javascriptoptimizerblockedforsites","displayName":"Block JavaScript optimizations on these sites","description":"Allows you to set a list of site url patterns that specify sites for which\r\nadvanced JavaScript optimizations are disabled.\r\n\r\nDisabling JavaScript optimizations will mean that Google Chrome may render web content more slowly.\r\n\r\nFor detailed information on valid url patterns, please see\r\nhttps://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.\r\nWildcards, *, are allowed.\r\n\r\nJavaScript optimization policy exceptions will only be enforced at a site\r\ngranularity (eTLD+1). A policy set for only subdomain.site.com will not\r\ncorrectly apply to site.com or subdomain.site.com since they both resolve to\r\nthe same eTLD+1 (site.com) for which there is no policy. In this case, policy\r\nmust be set on site.com to apply correctly for both site.com and\r\nsubdomain.site.com.\r\n\r\nThis policy applies on a frame-by-frame basis and not based on top level\r\norigin url alone, so e.g. if site-one.com is listed in the JavaScriptOptimizerBlockedForSites policy but site-one.com loads a frame\r\ncontaining site-two.com then site-one.com will have JavaScript optimizations\r\ndisabled, but site-two.com will use the policy from DefaultJavaScriptOptimizerSetting, if set, or default to JavaScript\r\noptimizations enabled. Blocklist entries have higher priority than allowlist\r\nentries, which in turn have higher priority than the configured default value.\r\n\r\nIf this policy is not set for a site then the policy from DefaultJavaScriptOptimizerSetting applies to the site, if set, otherwise\r\nJavaScript optimization is enabled for the site.\r\n\r\nExample value:\r\n\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_javascriptoptimizerblockedforsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_javascriptoptimizerblockedforsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_javascriptoptimizerblockedforsites_javascriptoptimizerblockedforsitesdesc","displayName":"Block JavaScript optimizations on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_localfontsallowedforurls","displayName":"Allow Local Fonts permission on these sites","description":"Sets a list of site url patterns that specify sites which will automatically grant the local fonts permission. This will extend the ability of sites to see information about local fonts.\r\n\r\nFor detailed information on valid site url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored.\r\n\r\nIf this policy is not set for a site then the policy from DefaultLocalFontsSetting applies to the site, if set, otherwise the permission will follow the browser's defaults and allow users to choose this permission per site.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_localfontsallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_localfontsallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_localfontsallowedforurls_localfontsallowedforurlsdesc","displayName":"Allow Local Fonts permission on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_localfontsblockedforurls","displayName":"Block Local Fonts permission on these sites","description":"Sets a list of site url patterns that specify sites which will automatically deny the local fonts permission. This will limit the ability of sites to see information about local fonts.\r\n\r\nFor detailed information on valid site url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored.\r\n\r\nIf this policy is not set for a site then the policy from DefaultLocalFontsSetting applies to the site, if set, otherwise the permission will follow the browser's defaults and allow users to choose this permission per site.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_localfontsblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_localfontsblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_localfontsblockedforurls_localfontsblockedforurlsdesc","displayName":"Block Local Fonts permission on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_partitionedbloburlusage","displayName":"Choose whether Blob URLs are partitioned during fetching and navigations","description":"This policy controls whether Blob URLs are partitioned during fetching and navigation.\r\nIf this policy is set to Enabled or not set, Blob URLs will be partitioned.\r\nIf this policy is set to Disabled, Blob URLs won't be partitioned.\r\n\r\nIf storage partitioning is disabled for a given top-level origin by either\r\nThirdPartyStoragePartitioningBlockedForOrigins\r\nor DefaultThirdPartyStoragePartitioningSetting,\r\nthen Blob URLs will also not be partitioned.\r\n\r\nIf you must use the policy, please file a bug at\r\nGoogle Chrome\r\nexplaining your use case. The policy is scheduled to be offered through\r\nGoogle Chrome version 143, after which\r\nthe old implementation will be removed.\r\n\r\nNOTE: Only newly-started renderer processes will reflect changes to this\r\npolicy while the browser is running.\r\n\r\nFor detailed information on third-party storage partitioning, please see\r\nhttps://developers.google.com/privacy-sandbox/cookies/storage-partitioning.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_partitionedbloburlusage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_partitionedbloburlusage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_pdflocalfileaccessallowedfordomains","displayName":"Allow local file access to file:// URLs on these sites in the PDF Viewer","description":"Setting this policy allows the domains listed to access file:// URLs in the PDF Viewer.\r\nAdding to the policy allows the domain to access file:// URLs in the PDF Viewer.\r\nRemoving from the policy disallows the domain from accessing file:// URLs in the PDF Viewer.\r\nLeaving the policy unset disallows all domains from accessing file:// URLs in the PDF Viewer.\r\n\r\nExample value:\r\n\r\nexample.com\r\ngoogle.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_pdflocalfileaccessallowedfordomains_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_pdflocalfileaccessallowedfordomains_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_pdflocalfileaccessallowedfordomains_pdflocalfileaccessallowedfordomainsdesc","displayName":"Allow local file access to file:// URLs on these sites in the PDF Viewer (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidallowalldevicesforurls","displayName":"Automatically grant permission to sites to connect to any HID device.","description":"Setting the policy allows you to list sites which are automatically granted permission to access all available devices.\r\n\r\nThe URLs must be valid, otherwise the policy is ignored. Only the origin (scheme, host and port) of the URL is considered.\r\n\r\nOn ChromeOS, this policy only applies to affiliated users.\r\n\r\nThis policy overrides DefaultWebHidGuardSetting, WebHidAskForUrls, WebHidBlockedForUrls and the user's preferences.\r\n\r\nExample value:\r\n\r\nhttps://google.com\r\nhttps://chromium.org","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidallowalldevicesforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidallowalldevicesforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidallowalldevicesforurls_webhidallowalldevicesforurlsdesc","displayName":"Automatically grant permission to sites to connect to any HID device. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidallowdevicesforurls","displayName":"Automatically grant permission to these sites to connect to HID devices with the given vendor and product IDs.","description":"Setting the policy lets you list the URLs that specify which sites are automatically granted permission to access a HID device with the given vendor and product IDs. Each item in the list requires both devices and urls fields for the item to be valid, otherwise the item is ignored. Each item in the devices field must have a vendor_id and may have a product_id field. Omitting the product_id field will create a policy matching any device with the specified vendor ID. An item which has a product_id field without a vendor_id field is invalid and is ignored.\r\n\r\nLeaving the policy unset means DefaultWebHidGuardSetting applies, if it's set. If not, the user's personal setting applies.\r\n\r\nURLs in this policy shouldn't conflict with those configured through WebHidBlockedForUrls. If they do, this policy takes precedence over WebHidBlockedForUrls.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=WebHidAllowDevicesForUrls for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"devices\": [\r\n {\r\n \"product_id\": 5678,\r\n \"vendor_id\": 1234\r\n }\r\n ],\r\n \"urls\": [\r\n \"https://google.com\",\r\n \"https://chromium.org\"\r\n ]\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidallowdevicesforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidallowdevicesforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidallowdevicesforurls_webhidallowdevicesforurls","displayName":"Automatically grant permission to these sites to connect to HID devices with the given vendor and product IDs. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidallowdeviceswithhidusagesforurls","displayName":"Automatically grant permission to these sites to connect to HID devices containing top-level collections with the given HID usage.","description":"Setting the policy lets you list the URLs that specify which sites are automatically granted permission to access a HID device containing a top-level collection with the given HID usage. Each item in the list requires both usages and urls fields for the policy to be valid. Each item in the usages field must have a usage_page and may have a usage field. Omitting the usage field will create a policy matching any device containing a top-level collection with a usage from the specified usage page. An item which has a usage field without a usage_page field is invalid and is ignored.\r\n\r\nLeaving the policy unset means DefaultWebHidGuardSetting applies, if it's set. If not, the user's personal setting applies.\r\n\r\nURLs in this policy shouldn't conflict with those configured through WebHidBlockedForUrls. If they do, this policy takes precedence over WebHidBlockedForUrls.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=WebHidAllowDevicesWithHidUsagesForUrls for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"urls\": [\r\n \"https://google.com\",\r\n \"https://chromium.org\"\r\n ],\r\n \"usages\": [\r\n {\r\n \"usage\": 5678,\r\n \"usage_page\": 1234\r\n }\r\n ]\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidallowdeviceswithhidusagesforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidallowdeviceswithhidusagesforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidallowdeviceswithhidusagesforurls_webhidallowdeviceswithhidusagesforurls","displayName":"Automatically grant permission to these sites to connect to HID devices containing top-level collections with the given HID usage. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidaskforurls","displayName":"Allow the WebHID API on these sites","description":"Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them access to a HID device.\r\n\r\nLeaving the policy unset means DefaultWebHidGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.\r\n\r\nFor URL patterns which do not match the policy, the following take precedence, in this order:\r\n\r\n * WebHidBlockedForUrls (if there is a match),\r\n\r\n * DefaultWebHidGuardSetting (if set), or\r\n\r\n * Users' personal settings.\r\n\r\nURL patterns must not conflict with WebHidBlockedForUrls. Neither policy takes precedence if a URL matches with both.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://google.com\r\nhttps://chromium.org","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidaskforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidaskforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidaskforurls_webhidaskforurlsdesc","displayName":"Allow the WebHID API on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidblockedforurls","displayName":"Block the WebHID API on these sites","description":"Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them access to a HID device.\r\n\r\nLeaving the policy unset means DefaultWebHidGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.\r\n\r\nFor URL patterns which do not match the policy, the following take precedence, in this order:\r\n\r\n * WebHidAskForUrls (if there is a match),\r\n\r\n * DefaultWebHidGuardSetting (if set), or\r\n\r\n * Users' personal settings.\r\n\r\nURL patterns can't conflict with WebHidAskForUrls. Neither policy takes precedence if a URL matches with both.\r\n\r\nFor detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://google.com\r\nhttps://chromium.org","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_webhidblockedforurls_webhidblockedforurlsdesc","displayName":"Block the WebHID API on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_windowmanagementallowedforurls","displayName":"Allow Window Management permission on these sites","description":"Allows you to set a list of site url patterns that specify sites which will automatically grant the window management permission. This will extend the ability of sites to see information about the device's screens and use that information to open and place windows or request fullscreen on specific screens.\r\n\r\nFor detailed information on valid site url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored.\r\n\r\nIf this policy is not set for a site then the policy from DefaultWindowManagementSetting applies to the site, if set, otherwise the permission will follow the browser's defaults and allow users to choose this permission per site.\r\n\r\nThis replaces the deprecated WindowPlacementAllowedForUrls policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_windowmanagementallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_windowmanagementallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_windowmanagementallowedforurls_windowmanagementallowedforurlsdesc","displayName":"Allow Window Management permission on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_windowmanagementblockedforurls","displayName":"Block Window Management permission on these sites","description":"Allows you to set a list of site url patterns that specify sites which will automatically deny the window management permission. This will limit the ability of sites to see information about the device's screens and use that information to open and place windows or request fullscreen on specific screens.\r\n\r\nFor detailed information on valid site url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored.\r\n\r\nIf this policy is not set for a site then the policy from DefaultWindowManagementSetting applies to the site, if set, otherwise the permission will follow the browser's defaults and allow users to choose this permission per site.\r\n\r\nThis replaces the deprecated WindowPlacementBlockedForUrls policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_windowmanagementblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_windowmanagementblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~contentsettings_windowmanagementblockedforurls_windowmanagementblockedforurlsdesc","displayName":"Block Window Management permission on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_defaultthirdpartystoragepartitioningsetting","displayName":"Default third-party storage partitioning setting","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_defaultthirdpartystoragepartitioningsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_defaultthirdpartystoragepartitioningsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_defaultthirdpartystoragepartitioningsetting_defaultthirdpartystoragepartitioningsetting","displayName":"Default third-party storage partitioning setting (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_defaultthirdpartystoragepartitioningsetting_defaultthirdpartystoragepartitioningsetting_1","displayName":"Allow third-party storage partitioning by default.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_defaultthirdpartystoragepartitioningsetting_defaultthirdpartystoragepartitioningsetting_2","displayName":"Disable third-party storage partitioning.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_defaultwindowplacementsetting","displayName":"Default Window Placement permission setting","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_defaultwindowplacementsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_defaultwindowplacementsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_defaultwindowplacementsetting_defaultwindowplacementsetting","displayName":"Default Window Placement permission setting (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_defaultwindowplacementsetting_defaultwindowplacementsetting_2","displayName":"Denies the Window Placement permission on all sites by default","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_defaultwindowplacementsetting_defaultwindowplacementsetting_3","displayName":"Ask every time a site wants obtain the Window Placement permission","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_thirdpartystoragepartitioningblockedfororigins","displayName":"Disable third-party storage partitioning for specific top-level origins","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value:\r\n\r\nwww.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_thirdpartystoragepartitioningblockedfororigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_thirdpartystoragepartitioningblockedfororigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_thirdpartystoragepartitioningblockedfororigins_thirdpartystoragepartitioningblockedfororiginsdesc","displayName":"Disable third-party storage partitioning for specific top-level origins (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_useragentreduction","displayName":"Enable or disable the User-Agent Reduction.","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_useragentreduction_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_useragentreduction_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_useragentreduction_useragentreduction","displayName":"Enable or disable the User-Agent Reduction. (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_useragentreduction_useragentreduction_0","displayName":"Reduced User Agent.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_useragentreduction_useragentreduction_1","displayName":"Full (legacy) User Agent.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_useragentreduction_useragentreduction_2","displayName":"Reduced User Agent.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_windowplacementallowedforurls","displayName":"Allow Window Placement permission on these sites","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_windowplacementallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_windowplacementallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_windowplacementallowedforurls_windowplacementallowedforurlsdesc","displayName":"Allow Window Placement permission on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_windowplacementblockedforurls","displayName":"Block Window Placement permission on these sites","description":"This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_windowplacementblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_windowplacementblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~deprecatedpolicies_windowplacementblockedforurls_windowplacementblockedforurlsdesc","displayName":"Block Window Placement permission on these sites (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensiondevelopermodesettings","displayName":"Control the availability of developer mode on extensions page","description":"Control if users can turn on Developer Mode on chrome://extensions.\r\n\r\nIf the policy is not set, users can turn on developer mode on extension page unless DeveloperToolsAvailability policy is set to DeveloperToolsDisallowed (2).\r\nIf the policy is set to Allow (0), users can turn on developer mode on extensions page.\r\nIf the policy is set to Disallow (1), users can not turn on developer mode on extensions page.\r\n\r\nIf this policy is set, DeveloperToolsAvailability can no longer control extensions developer mode.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensiondevelopermodesettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensiondevelopermodesettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensiondevelopermodesettings_extensiondevelopermodesettings","displayName":"Control the availability of developer mode on extensions page (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensiondevelopermodesettings_extensiondevelopermodesettings_0","displayName":"Allow the usage of developer mode on extensions page","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensiondevelopermodesettings_extensiondevelopermodesettings_1","displayName":"Do not allow the usage of developer mode on extensions page","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensionextendedbackgroundlifetimeforportconnectionstourls","displayName":"Configure a list of origins that grant extended background lifetime to the connecting extensions.","description":"Extensions that connect to one of these origins will be be kept running as long as the port is connected.\r\n\r\nIf unset, the policy's default values will be used. These are app origins that offer SDKs that are known to not offer the possibility to restart a closed connection to a previous state:\r\n- Smart Card Connector\r\n- Citrix Receiver (stable, beta, back-up)\r\n- VMware Horizon (stable, beta)\r\n\r\nIf set, the default value list is extended with the newly configured values. Both defaults and the policy-provided entries will grant the exception to the connecting extensions, as long as the port is connected.\r\n\r\nExample value:\r\n\r\nchrome-extension://abcdefghijklmnopabcdefghijklmnop/\r\nchrome-extension://bcdefghijklmnopabcdefghijklmnopa/","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensionextendedbackgroundlifetimeforportconnectionstourls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensionextendedbackgroundlifetimeforportconnectionstourls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensionextendedbackgroundlifetimeforportconnectionstourls_extensionextendedbackgroundlifetimeforportconnectionstourlsdesc","displayName":"Configure a list of origins that grant extended background lifetime to the connecting extensions. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensioninstalltypeblocklist","displayName":"Blocklist for install types of extensions","description":"The blocklist controls which extensions install types are disallowed.\r\n\r\nSetting \"command_line\" will block extension from being loaded from\r\ncommand line.\r\n\r\nExample value:\r\n\r\ncommand_line","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensioninstalltypeblocklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensioninstalltypeblocklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensioninstalltypeblocklist_extensioninstalltypeblocklistdesc","displayName":"Blocklist for install types of extensions (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensionunpublishedavailability","displayName":"Control availability of extensions unpublished on the Chrome Web Store.","description":"If this policy is enabled, extensions that are unpublished on the Chrome Web\r\nStore will be disabled in Google Chrome.\r\nThis policy only applies to extensions that are installed and updated from the\r\nChrome Web Store.\r\n\r\nOff-store extensions such as unpacked extensions installed using developer\r\nmode and extensions installed using the command-line switch are ignored.\r\nForce-installed extensions that are self-hosted are ignored. All\r\nversion-pinned extensions are also ignored.\r\n\r\nIf the policy is set to AllowUnpublished (0) or not set, extensions that are unpublished on the Chrome Web Store are allowed.\r\nIf the policy is set to DisableUnpublished (1), extensions that are unpublished on the Chrome Web Store are disabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensionunpublishedavailability_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensionunpublishedavailability_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensionunpublishedavailability_extensionunpublishedavailability","displayName":"Control availability of extensions unpublished on the Chrome Web Store. (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensionunpublishedavailability_extensionunpublishedavailability_0","displayName":"Allow unpublished extensions","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~extensions_extensionunpublishedavailability_extensionunpublishedavailability_1","displayName":"Disable unpublished extensions","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~firstpartysets_firstpartysetsenabled","displayName":"Enable First-Party Sets.","description":"This policy is provided as a way to opt-out of the First-Party Sets feature.\r\n\r\nWhen this policy is unset or set to Enabled, the First-Party Sets feature is enabled.\r\n\r\nWhen this policy is set to Disabled, the First-Party Sets feature is disabled.\r\n\r\nIt controls whether Chrome supports First-Party Sets related integrations.\r\n\r\nThis is the equivalent of the RelatedWebsiteSetsEnabled policy.\r\nEither policy may be used, but this one will be deprecated soon so the RelatedWebsiteSetsEnabled policy is preferred.\r\nThey both have the same effect on the browser's behavior.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~firstpartysets_firstpartysetsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~firstpartysets_firstpartysetsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~firstpartysets_firstpartysetsoverrides","displayName":"Override First-Party Sets.","description":"This policy provides a way to override the list of sets the browser uses for First-Party Sets features.\r\n\r\nEach set in the browser's list of First-Party Sets must meet the requirements of a First-Party Set.\r\nA First-Party Set must contain a primary site and one or more member sites.\r\nA set can also contain a list of service sites that it owns, as well as a map from a site to all of its ccTLD variants.\r\nSee https://github.com/WICG/first-party-sets for more information on First-Party Sets are used by Google Chrome.\r\n\r\nAll sites in a First-Party Set must be a registrable domain served over HTTPS. Each site in a First-Party Set must also be unique,\r\nmeaning a site cannot be listed more than once in a First-Party Set.\r\n\r\nWhen this policy is given an empty dictionary, the browser uses the public list of First-Party Sets.\r\n\r\nFor all sites in a First-Party Set from the replacements list, if a site is also present\r\non a First-Party Set in the browser's list, then that site will be removed from the browser's First-Party Set.\r\nAfter this, the policy's First-Party Set will be added to the browser's list of First-Party Sets.\r\n\r\nFor all sites in a First-Party Set from the additions list, if a site is also present\r\non a First-Party Set in the browser's list, then the browser's First-Party Set will be updated so that the\r\nnew First-Party Set can be added to the browser's list. After the browser's list has been updated,\r\nthe policy's First-Party Set will be added to the browser's list of First-Party Sets.\r\n\r\nThe browser's list of First-Party Sets requires that for all sites in its list, no site is in\r\nmore than one set. This is also required for both the replacements list\r\nand the additions list. Similarly, a site cannot be in both the\r\nreplacements list and the additions list.\r\n\r\nWildcards (*) are not supported as a policy value, nor within any First-Party Set in these lists.\r\n\r\nAll sets provided by the policy must be valid First-Party Sets, if they aren't then an\r\nappropriate error will be outputted.\r\n\r\nOn Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core.\r\n\r\nOn macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.\r\n\r\nThis is the equivalent of the RelatedWebsiteSetsOverrides policy.\r\nEither policy may be used, but this one will be deprecated soon so the RelatedWebsiteSetsOverrides policy is preferred.\r\nThey both have the same effect on the browser's behavior.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=FirstPartySetsOverrides for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n{\r\n \"additions\": [\r\n {\r\n \"associatedSites\": [\r\n \"https://associate2.test\"\r\n ],\r\n \"ccTLDs\": {\r\n \"https://associate2.test\": [\r\n \"https://associate2.com\"\r\n ]\r\n },\r\n \"primary\": \"https://primary2.test\",\r\n \"serviceSites\": [\r\n \"https://associate2-content.test\"\r\n ]\r\n }\r\n ],\r\n \"replacements\": [\r\n {\r\n \"associatedSites\": [\r\n \"https://associate1.test\"\r\n ],\r\n \"ccTLDs\": {\r\n \"https://associate1.test\": [\r\n \"https://associate1.co.uk\"\r\n ]\r\n },\r\n \"primary\": \"https://primary1.test\",\r\n \"serviceSites\": [\r\n \"https://associate1-content.test\"\r\n ]\r\n }\r\n ]\r\n}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~firstpartysets_firstpartysetsoverrides_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~firstpartysets_firstpartysetsoverrides_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~firstpartysets_firstpartysetsoverrides_firstpartysetsoverrides","displayName":"Override First-Party Sets. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_aimodesettings","displayName":"Settings for Google's AI Mode integrations in the address bar and New Tab page search box.","description":"This policy controls Google's AI Mode integrations in the address bar and the New Tab page search box.\r\n\r\nTo access this feature, Google must be set as the user's default search engine.\r\n\r\n0/unset = The feature will be available to users.\r\n\r\n1 = The feature will not be available to users.\r\n\r\nIf the policy is unset, its behavior is determined by the GenAiDefaultSettings policy.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_aimodesettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_aimodesettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_aimodesettings_aimodesettings","displayName":"Settings for Google's AI Mode integrations in the address bar and New Tab page search box. (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_aimodesettings_aimodesettings_0","displayName":"Allow AI Mode integrations.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_aimodesettings_aimodesettings_1","displayName":"Do not allow AI Mode integrations.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_autofillpredictionsettings","displayName":"Settings for enhanced autofill","description":"Specifies whether users can let Google Chrome use Generative AI to better understand forms and help them fill more fields.\r\n\r\n0 = Allow the feature to be used, while allowing Google to use relevant data to improve its AI models. Relevant data may include prompts, inputs, outputs, source materials, and written feedback, depending on the feature. 0 is the default value, except when noted below.\r\n\r\n1 = Allow the feature to be used, but does not allow Google to improve models using users' content (including prompts, inputs, outputs, source materials, and written feedback). 1 is the default value for Enterprise users managed by Google Admin console and for Education accounts managed by Google Workspace.\r\n\r\n2 = Do not allow the feature.\r\n\r\nIf the policy is unset, its behavior is determined by the GenAiDefaultSettings policy.\r\n\r\nFor more information on data handling for generative AI features, please see https://support.google.com/chrome/a?p=generative_ai_settings.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_autofillpredictionsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_autofillpredictionsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_autofillpredictionsettings_autofillpredictionsettings","displayName":"Settings for enhanced autofill (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_autofillpredictionsettings_autofillpredictionsettings_0","displayName":"Allow enhanced autofill and improve AI models.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_autofillpredictionsettings_autofillpredictionsettings_1","displayName":"Allow enhanced autofill without improving AI models.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_autofillpredictionsettings_autofillpredictionsettings_2","displayName":"Do not allow enhanced autofill.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_createthemessettings","displayName":"Settings for Create Themes with AI","description":"Create Themes with AI lets users create custom themes/wallpapers by preselecting from a list of options.\r\n\r\n0 = Allow the feature to be used, while allowing Google to use relevant data to improve its AI models. Relevant data may include prompts, inputs, outputs, source materials, and written feedback, depending on the feature. It may also be reviewed by humans to improve AI models. 0 is the default value, except when noted below.\r\n\r\n1 = Allow the feature to be used, but does not allow Google to improve models using users' content (including prompts, inputs, outputs, source materials, and written feedback). 1 is the default value for Enterprise users managed by Google Admin console and for Education accounts managed by Google Workspace.\r\n\r\n2 = Do not allow the feature.\r\n\r\nIf the policy is unset, its behavior is determined by the GenAiDefaultSettings policy.\r\n\r\nFor more information on data handling for generative AI features, please see https://support.google.com/chrome/a?p=generative_ai_settings.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_createthemessettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_createthemessettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_createthemessettings_createthemessettings","displayName":"Settings for Create Themes with AI (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_createthemessettings_createthemessettings_0","displayName":"Allow Create Themes and improve AI models.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_createthemessettings_createthemessettings_1","displayName":"Allow Create Themes without improving AI models.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_createthemessettings_createthemessettings_2","displayName":"Do not allow Create Themes.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_devtoolsgenaisettings","displayName":"Settings for DevTools Generative AI Features","description":"These features in Google Chrome's DevTools employ generative AI models to provide additional debugging information. To use these features, Google Chrome has to collect data such as error messages, stack traces, code snippets, and network requests and send them to a server owned by Google, which runs a generative AI model. Response body or authentication and cookie headers in network requests are not included in the data sent to the server.\r\n\r\n0 = Allow the feature to be used, while allowing Google to use relevant data to improve its AI models. Relevant data may include prompts, inputs, outputs, source materials, and written feedback, depending on the feature. It may also be reviewed by humans to improve AI models. 0 is the default value, except when noted below.\r\n\r\n1 = Allow the feature to be used, but does not allow Google to improve models using users' content (including prompts, inputs, outputs, source materials, and written feedback). 1 is the default value for Enterprise users managed by Google Admin console and for Education accounts managed by Google Workspace.\r\n\r\n2 = Do not allow the feature.\r\n\r\nIf the policy is unset, its behavior is determined by the GenAiDefaultSettings policy.\r\n\r\nDevTools Generative AI features include:\r\n\r\n- Console Insights: explains console messages and offers suggestions on how to fix console errors.\r\n\r\n- AI assistance: get help with understanding CSS styles (since version 131), network requests, performance, and files (all since version 132).\r\n\r\nFor more information on data handling for generative AI features, please see https://support.google.com/chrome/a?p=generative_ai_settings.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_devtoolsgenaisettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_devtoolsgenaisettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_devtoolsgenaisettings_devtoolsgenaisettings","displayName":"Settings for DevTools Generative AI Features (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_devtoolsgenaisettings_devtoolsgenaisettings_0","displayName":"Allow DevTools Generative AI Features and improve AI models.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_devtoolsgenaisettings_devtoolsgenaisettings_1","displayName":"Allow DevTools Generative AI Features without improving AI models.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_devtoolsgenaisettings_devtoolsgenaisettings_2","displayName":"Do not allow DevTools Generative AI Features.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_geminisettings","displayName":"Settings for Gemini integration","description":"This setting allows Gemini app integrations.\r\n\r\n0/unset = Gemini integration will be available for users.\r\n\r\n1 = Gemini integration will not be available for users.\r\n\r\nIf the policy is unset, its behavior is determined by the GenAiDefaultSettings policy.\r\n\r\nFor more information, please check the Help Center article https://support.google.com/chrome/a?p=gemini_in_chrome.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_geminisettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_geminisettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_geminisettings_geminisettings","displayName":"Settings for Gemini integration (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_geminisettings_geminisettings_0","displayName":"Allow Gemini integrations.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_geminisettings_geminisettings_1","displayName":"Do not allow Gemini integrations.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_genailocalfoundationalmodelsettings","displayName":"Settings for GenAI local foundational model","description":"Configure how Google Chrome downloads the foundational GenAI model and uses for inference locally.\r\n\r\nWhen the policy is set to Allowed (0) or not set, the model is downloaded automatically, and used for inference.\r\n\r\nWhen the policy is set to Disabled (1), the model will not be downloaded.\r\n\r\nModel downloading can also be disabled by ComponentUpdatesEnabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_genailocalfoundationalmodelsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_genailocalfoundationalmodelsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_genailocalfoundationalmodelsettings_genailocalfoundationalmodelsettings","displayName":"Settings for GenAI local foundational model (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_genailocalfoundationalmodelsettings_genailocalfoundationalmodelsettings_0","displayName":"Downloads model automatically","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_genailocalfoundationalmodelsettings_genailocalfoundationalmodelsettings_1","displayName":"Do not download model","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_helpmewritesettings","displayName":"Settings for Help Me Write","description":"Help Me Write is an AI-based writing assistant for short-form content on the web. Suggested content is based on prompts entered by the user and the content of the web page.\r\n\r\n0 = Allow the feature to be used, while allowing Google to use relevant data to improve its AI models. Relevant data may include prompts, inputs, outputs, source materials, and written feedback, depending on the feature. It may also be reviewed by humans to improve AI models. 0 is the default value, except when noted below.\r\n\r\n1 = Allow the feature to be used, but does not allow Google to improve models using users' content (including prompts, inputs, outputs, source materials, and written feedback). 1 is the default value for Enterprise users managed by Google Admin console and for Education accounts managed by Google Workspace.\r\n\r\n2 = Do not allow the feature.\r\n\r\nIf the policy is unset, its behavior is determined by the GenAiDefaultSettings policy.\r\n\r\nFor more information on data handling for generative AI features, please see https://support.google.com/chrome/a?p=generative_ai_settings.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_helpmewritesettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_helpmewritesettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_helpmewritesettings_helpmewritesettings","displayName":"Settings for Help Me Write (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_helpmewritesettings_helpmewritesettings_0","displayName":"Allow Help Me Write and improve AI models.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_helpmewritesettings_helpmewritesettings_1","displayName":"Allow Help Me Write without improving AI models.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_helpmewritesettings_helpmewritesettings_2","displayName":"Do not allow Help Me Write.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_historysearchsettings","displayName":"Settings for AI-powered History Search","description":"AI History Search is a feature that allows users to search their browsing history and receive generated answers based on page contents and not just the page title and URL.\r\n\r\n0 = Allow the feature to be used, while allowing Google to use relevant data to improve its AI models. Relevant data may include prompts, inputs, outputs, source materials, and written feedback, depending on the feature. It may also be reviewed by humans to improve AI models. 0 is the default value, except when noted below.\r\n\r\n1 = Allow the feature to be used, but does not allow Google to improve models using users' content (including prompts, inputs, outputs, source materials, and written feedback). 1 is the default value for Enterprise users managed by Google Admin console and for Education accounts managed by Google Workspace.\r\n\r\n2 = Do not allow the feature.\r\n\r\nIf the policy is unset, its behavior is determined by the GenAiDefaultSettings policy.\r\n\r\nFor more information on data handling for generative AI features, please see https://support.google.com/chrome/a?p=generative_ai_settings.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_historysearchsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_historysearchsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_historysearchsettings_historysearchsettings","displayName":"Settings for AI-powered History Search (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_historysearchsettings_historysearchsettings_0","displayName":"Allow AI History Search and improve AI models.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_historysearchsettings_historysearchsettings_1","displayName":"Allow AI History Search without improving AI models.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_historysearchsettings_historysearchsettings_2","displayName":"Do not allow AI History Search.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_tabcomparesettings","displayName":"Tab Compare settings","description":"Tab Compare is an AI-powered tool for comparing information across a user's tabs. As an example, the feature can be offered to the user when multiple tabs with products in a similar category are open.\r\n\r\n0 = Allow the feature to be used, while allowing Google to use relevant data to improve its AI models. Relevant data may include prompts, inputs, outputs, source materials, and written feedback, depending on the feature. It may also be reviewed by humans to improve AI models. 0 is the default value, except when noted below.\r\n\r\n1 = Allow the feature to be used, but does not allow Google to improve models using users' content (including prompts, inputs, outputs, source materials, and written feedback). 1 is the default value for Enterprise users managed by Google Admin console and for Education accounts managed by Google Workspace.\r\n\r\n2 = Do not allow the feature.\r\n\r\nIf the policy is unset, its behavior is determined by the GenAiDefaultSettings policy.\r\n\r\nFor more information on data handling for generative AI features, please see https://support.google.com/chrome/a?p=generative_ai_settings.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_tabcomparesettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_tabcomparesettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_tabcomparesettings_tabcomparesettings","displayName":"Tab Compare settings (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_tabcomparesettings_tabcomparesettings_0","displayName":"Allow Tab Compare and improve AI models.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_tabcomparesettings_tabcomparesettings_1","displayName":"Allow Tab Compare without improving AI models.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~generativeai_tabcomparesettings_tabcomparesettings_2","displayName":"Do not allow Tab Compare.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~googlecast_accesscodecastdeviceduration","displayName":"Specifies how long (in seconds) a cast device selected with an access code or QR code stays in the Google Cast menu's list of cast devices.","description":"This policy specifies how long (in seconds) a cast device that was previously selected via an access code or QR code can be seen within the Google Cast menu of cast devices.\r\nThe lifetime of an entry starts at the time the access code was first entered or the QR code was first scanned.\r\nDuring this period the cast device will appear in the Google Cast menu's list of cast devices.\r\nAfter this period, in order to use the cast device again the access code must be reentered or the QR code must be rescanned.\r\nBy default, the period is zero seconds, so cast devices will not stay in the Google Cast menu, and so the access code must be reentered, or the QR code rescanned, in order to initiate a new casting session.\r\nNote that this policy only affects how long a cast devices appears in the Google Cast menu, and has no effect on any ongoing cast session which will continue even if the period expires.\r\nThis policy has no effect unless the AccessCodeCastEnabled policy is Enabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~googlecast_accesscodecastdeviceduration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~googlecast_accesscodecastdeviceduration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~googlecast_accesscodecastdeviceduration_accesscodecastdeviceduration","displayName":"Specifies how long (in seconds) a cast device selected with an access code or QR code stays in the Google Cast menu's list of cast devices.: (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~googlecast_accesscodecastenabled","displayName":"Allow users to select cast devices with an access code or QR code from within the Google Cast menu.","description":"This policy controls whether a user will be presented with an option, within the Google Cast menu which allows them to cast to cast devices that do not appear in the Google Cast menu, using either the access code or QR code displayed on the cast devices's screen.\r\nBy default, a user must reenter the access code or rescan the QR code in order to initiate a subsequent casting session, but if the AccessCodeCastDeviceDuration policy has been set to a non-zero value (the default is zero), then the cast device will remain in the list of available cast devices until the specified period of time has expired.\r\nWhen this policy is set to Enabled, users will be presented with the option to select cast devices by using an access code or by scanning a QR code.\r\nWhen this policy is set to Disabled or not set, users will not be given the option to select cast devices by using an access code or by scanning a QR code.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~googlecast_accesscodecastenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~googlecast_accesscodecastenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~googlecast_showcastsessionsstartedbyotherdevices","displayName":"Show media controls for Google Cast sessions started by other devices on the local network","description":"When this policy is enabled, media playback controls UI is available for Google Cast sessions started by other devices on the local network.\r\n\r\nWhen this policy is unset for enterprise users or is disabled, media playback controls UI is unavailable for Google Cast sessions started by other devices on the local network.\r\n\r\nIf the policy EnableMediaRouter is disabled, then this policy's value has no effect, as the entire Google Cast functionality is disabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~googlecast_showcastsessionsstartedbyotherdevices_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~googlecast_showcastsessionsstartedbyotherdevices_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~httpauthentication_allhttpauthschemesallowedfororigins","displayName":"List of origins allowing all HTTP authentication","description":"Setting the policy specifies for which origins to allow all the HTTP authentication schemes Google Chrome supports regardless of the AuthSchemes policy.\r\n\r\nFormat the origin pattern according to this format (https://support.google.com/chrome/a?p=url_blocklist_filter_format). Up to 1,000 exceptions can be defined in AllHttpAuthSchemesAllowedForOrigins.\r\nWildcards are allowed for the whole origin or parts of the origin, either the scheme, host, port.\r\n\r\nExample value:\r\n\r\n*.example.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~httpauthentication_allhttpauthschemesallowedfororigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~httpauthentication_allhttpauthschemesallowedfororigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~httpauthentication_allhttpauthschemesallowedfororigins_allhttpauthschemesallowedfororiginsdesc","displayName":"List of origins allowing all HTTP authentication (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~localnetworkaccesssettings_localnetworkaccessallowedforurls","displayName":"Allow sites to make requests to local network endpoints.","description":"List of URL patterns. Requests initiated from websites served by matching origins are not subject to Local Network Access checks.\r\n\r\nIf an origin is covered by both this policy and by LocalNetworkAccessBlockedForUrls, LocalNetworkAccessBlockedForUrls takes precedence.\r\n\r\nFor origins not covered by the patterns specified here, the user's personal configuration will apply.\r\n\r\nFor detailed information on valid URL patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.\r\n\r\nSee https://wicg.github.io/local-network-access/ for Local Network Access restrictions.\r\n\r\nExample value:\r\n\r\nhttp://www.example.com:8080\r\n[*.]example.edu\r\n*","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~localnetworkaccesssettings_localnetworkaccessallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~localnetworkaccesssettings_localnetworkaccessallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~localnetworkaccesssettings_localnetworkaccessallowedforurls_localnetworkaccessallowedforurlsdesc","displayName":"Allow sites to make requests to local network endpoints. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~localnetworkaccesssettings_localnetworkaccessblockedforurls","displayName":"Block sites from making requests to local network endpoints.","description":"List of URL patterns. Requests initiated from websites served by matching origins are blocked from issuing Local Network Access requests.\r\n\r\nIf an origin is covered by both this policy and by LocalNetworkAccessAllowedForUrls, this policy takes precedence.\r\n\r\nDepending on the stage of the rollout of Local Network Access, LocalNetworkAccessRestrictionsEnabled may also need to be enabled for this policy to block Local Network Access requests.\r\n\r\nFor origins not covered by the patterns specified here, the user's personal configuration will apply.\r\n\r\nFor detailed information on valid URL patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.\r\n\r\nSee https://wicg.github.io/local-network-access/ for Local Network Access restrictions.\r\n\r\nExample value:\r\n\r\nhttp://www.example.com:8080\r\n[*.]example.edu\r\n*","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~localnetworkaccesssettings_localnetworkaccessblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~localnetworkaccesssettings_localnetworkaccessblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~localnetworkaccesssettings_localnetworkaccessblockedforurls_localnetworkaccessblockedforurlsdesc","displayName":"Block sites from making requests to local network endpoints. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~localnetworkaccesssettings_localnetworkaccessrestrictionsenabled","displayName":"Specifies whether to apply restrictions to requests to local network endpoints","description":"When this policy is set to Enabled, any time when a warning is supposed to be\r\ndisplayed in the DevTools due to Local Network Access checks failing, the\r\nmain request will be blocked instead.\r\n\r\nWhen this policy is set to Disabled or unset, Local Network Access requests will use the\r\ndefault handling of these requests.\r\n\r\nSee https://wicg.github.io/local-network-access/ for Local Network Access restrictions.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~localnetworkaccesssettings_localnetworkaccessrestrictionsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~localnetworkaccesssettings_localnetworkaccessrestrictionsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~network_accesscontrolallowmethodsincorspreflightspecconformant","displayName":"Make Access-Control-Allow-Methods matching in CORS preflight spec conformant","description":"This policy controls whether request methods are uppercased when matching with Access-Control-Allow-Methods response headers in CORS preflight.\r\n\r\nIf the policy is Disabled, request methods are uppercased.\r\nThis is the behavior on or before Google Chrome 108.\r\n\r\nIf the policy is Enabled or not set, request methods are not uppercased, unless matching case-insensitively with DELETE, GET, HEAD, OPTIONS, POST, or PUT.\r\nThis would reject fetch(url, {method: 'Foo'}) + \"Access-Control-Allow-Methods: FOO\" response header,\r\nand would accept fetch(url, {method: 'Foo'}) + \"Access-Control-Allow-Methods: Foo\" response header.\r\n\r\nNote: request methods \"post\" and \"put\" are not affected, while \"patch\" is affected.\r\n\r\nThis policy is intended to be temporary and will be removed in the future.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~network_accesscontrolallowmethodsincorspreflightspecconformant_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~network_accesscontrolallowmethodsincorspreflightspecconformant_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~network_compressiondictionarytransportenabled","displayName":"Enable compression dictionary transport support","description":"This feature enables the use of dictionary-specific content encodings in the Accept-Encoding request header (\"sbr\" and \"zst-d\") when dictionaries are available for use.\r\n\r\nSetting the policy to Enabled or leaving it unset means Google Chrome will accept web contents using the compression dictionary transport feature.\r\nSetting the policy to Disabled turns off the compression dictionary transport feature.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~network_compressiondictionarytransportenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~network_compressiondictionarytransportenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~network_dataurlwhitespacepreservationenabled","displayName":"DataURL Whitespace Preservation for all media types","description":"This policy provides a temporary opt-out for changes to how Chrome handles whitepsace in data URLS.\r\nPreviously, whitespace would be kept only if the top level media type was text or contained the media type string xml.\r\nNow, whitespace will be preserved in all data URLs, regardless of media type.\r\n\r\nIf this policy is left unset or is set to True, the new behavior is enabled.\r\n\r\nWhen this policy is set to False, the old behavior is enabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~network_dataurlwhitespacepreservationenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~network_dataurlwhitespacepreservationenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~network_happyeyeballsv3enabled","displayName":"Use the Happy Eyeballs V3 algorithm","description":"This feature enables the Happy Eyeballs V3 algorithm to make connection attempts. See https://datatracker.ietf.org/doc/draft-pauly-happy-happyeyeballs-v3 for details.\r\n\r\nSetting the policy to Enabled means Google Chrome will use the Happy Eyeballs V3 algorithm for connection attempts.\r\n\r\nSetting the policy to Disabled turns off the Happy Eyeballs V3 algorithm.\r\n\r\nNot setting the policy, Google Chrome will turn on or off the Happy Eyeballs V3 algorithm based on chrome://flags/#happy-eyeballs-v3.\r\n\r\nThis policy supports dynamic refresh.\r\n\r\nThis policy is a temporary measure and will be removed in future versions of Google Chrome.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~network_happyeyeballsv3enabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~network_happyeyeballsv3enabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~network_ipv6reachabilityoverrideenabled","displayName":"Enable IPv6 reachability check override","description":"Setting the policy to true overrides the IPv6 reachability check. This means that the\r\nsystem will always query AAAA records when resolving host names. It applies to\r\nall users and interfaces on the device.\r\n\r\nSetting the policy to false or leaving it unset does not overrides the IPv6 reachability check.\r\nThe system only queries AAAA records when it is reachable to a global IPv6 host.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~network_ipv6reachabilityoverrideenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~network_ipv6reachabilityoverrideenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_automatedpasswordchangesettings","displayName":"Enable automated password change","description":"This policy controls the availability of Google Chrome's automated password change feature.\r\n\r\nIf enabled, a user can trigger a process where the browser attempts to change their password on a website automatically. This process is managed by Generative AI. The new password is saved in the browser's password manager.\r\n\r\n0 = Allow the feature to be used, while allowing Google to use relevant data to improve its AI models. Relevant data may include prompts, inputs, outputs, source materials, and written feedback, depending on the feature. It may also be reviewed by humans to improve AI models. 0 is the default value, except when noted below.\r\n\r\n1 = Allow the feature to be used, but does not allow Google to improve models using users' content (including prompts, inputs, outputs, source materials, and written feedback). 1 is the default value for Enterprise users managed by Google Admin console and for Education accounts managed by Google Workspace.\r\n\r\n2 = Do not allow the feature.\r\n\r\nIf the policy is unset, its behavior is determined by the GenAiDefaultSettings policy.\r\n\r\nFor more information on data handling for generative AI features, please see https://support.google.com/chrome/a?p=generative_ai_settings.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_automatedpasswordchangesettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_automatedpasswordchangesettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_automatedpasswordchangesettings_automatedpasswordchangesettings","displayName":"Enable automated password change (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_automatedpasswordchangesettings_automatedpasswordchangesettings_0","displayName":"Allow feature use and improving AI models","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_automatedpasswordchangesettings_automatedpasswordchangesettings_1","displayName":"Allow feature use without improving AI models","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_automatedpasswordchangesettings_automatedpasswordchangesettings_2","displayName":"Do not allow feature","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_deletingundecryptablepasswordsenabled","displayName":"Enable deleting undecryptable passwords","description":"This policy controls whether the built-in password manager can delete undecryptable passwords from its database. This is required to restore the full functionality of the built-in password manager, but it may include a permanent data loss. Undecryptable password values will not become decryptable on their own and, if fixing them is possible, it usually requires complex user actions.\r\n\r\nSetting the policy to Enabled or leaving it unset means that users with undecryptable passwords saved to the built-in password manager will lose them. Passwords that are still in a working state will remain untouched.\r\n\r\nSetting the policy to Disabled means users will leave their password manager data untouched, but will experience a broken password manager functionality.\r\n\r\nIf the policy is set, users can't change it in Google Chrome.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_deletingundecryptablepasswordsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_deletingundecryptablepasswordsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_passworddismisscompromisedalertenabled","displayName":"Enable dismissing compromised password alerts for entered credentials","description":"Setting the policy to Enabled or leaving it unset gives the user the option to dismiss/restore compromised password alerts.\r\n\r\nIf you disable this setting, users will not be able to dismiss alerts about compromised passwords. If enabled, users will be able to dismiss alerts about compromised passwords.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_passworddismisscompromisedalertenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_passworddismisscompromisedalertenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_passwordmanagerblocklist","displayName":"Configure the list of domains for which the Password Manager (Save and Fill) will be disabled","description":"Configure the list of domains where Google Chrome should disable the Password Manager. This means that Save and Fill workflows will be disabled, ensuring that passwords for those websites can't be saved or auto filled into web forms.\r\n\r\nIf a domain is present in the list, the Password Manager will be disabled for it.\r\n\r\nIf a domain is not present in the list, the Password Manager will be available for it.\r\n\r\nIf the policy is unset, the Password Manager will be available for all domains.\r\n\r\nExample value:\r\n\r\nexample.com\r\nlogin.example.com","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_passwordmanagerblocklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_passwordmanagerblocklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_passwordmanagerblocklist_passwordmanagerblocklistdesc","displayName":"Configure the list of domains for which the Password Manager (Save and Fill) will be disabled (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_passwordmanagerpasskeysenabled","displayName":"Enable saving passkeys to the password manager","description":"This policy controls the browser's ability to save passkeys in the built-in password manager. It does not limit access to, or change the contents of, passkeys already saved in the password manager. If the PasswordManagerEnabled policy is set to Disabled then saving in the built-in password manager is disabled in general, including passkeys and passwords, and thus this policy is not applicable.\r\n\r\nSetting the policy to Enabled or leaving unset means that users can save passkeys in the built-in password manager if signed into Google Chrome.\r\n\r\nSetting the policy to Disabled means users can't save passkeys to the built-in password manager, but previously saved passkeys will still work.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_passwordmanagerpasskeysenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_passwordmanagerpasskeysenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_passwordsharingenabled","displayName":"Enable sharing user credentials with other users","description":"Setting the policy to Enabled lets users send to and receive from family members (according to Family Service) their passwords.\r\nWhen the policy is Enabled or not set, there is a button in the Password Manager allowing to send a password.\r\nThe received passwords are stored into user's account and are available in the Password Manager.\r\n\r\nSetting the policy to Disabled means users can't send passwords from Password Manager to other users, and can't receive passwords from other users.\r\n\r\nThe feature is not available if synchronization of Passwords is turned off (either via user settings or SyncDisabled policy is Enabled).\r\n\r\nManaged accounts aren't eligible to join or create a family group and therefore cannot share passwords.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_passwordsharingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~passwordmanager_passwordsharingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~printing_oopprintdriversallowed","displayName":"Out-of-process print drivers allowed","description":"Controls if Google Chrome interacts with printer drivers from a separate service process. Platform printing calls to query available printers, get print driver settings, and submit documents for printing to local printers are made from a service process. Moving such calls out of the browser process helps improve stability and reduce frozen UI behavior in Print Preview.\r\n\r\nWhen this policy is set to Enabled or not set, Google Chrome will use a separate service process for platform printing tasks.\r\n\r\nWhen this policy is set to Disabled, Google Chrome will use the browser process for platform printing tasks.\r\n\r\nThis policy will be removed in the future, after the out-of-process print drivers feature has fully rolled out.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~printing_oopprintdriversallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~printing_oopprintdriversallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~printing_printinglpacsandboxenabled","displayName":"Enable Printing LPAC Sandbox","description":"Setting the policy to Enabled or leaving it unset enables the LPAC Sandbox for printing services whenever the system configuration supports it.\r\n\r\nSetting the policy to Disabled has a detrimental effect on Google Chrome's security as services used for printing might run in a weaker sandbox configuration.\r\n\r\nOnly turn off the policy if there are compatibility issues with third party software that prevent printing services from operating correctly inside the LPAC Sandbox.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~printing_printinglpacsandboxenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~printing_printinglpacsandboxenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~printing_printpdfasimagedefault","displayName":"Print PDF as Image Default","description":"Controls if Google Chrome makes the Print as image option default to set when printing PDFs.\r\n\r\nWhen this policy is set to Enabled, Google Chrome will default to setting the Print as image option in the Print Preview when printing a PDF.\r\n\r\nWhen this policy is set to Disabled or not set Google Chrome then the user selection for Print as image option will be initially unset. The user will be allowed to select it for each individual PDFs print job, if the option is available.\r\n\r\nFor Microsoft® Windows® or macOS this policy only has an effect if PrintPdfAsImageAvailability is also enabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~printing_printpdfasimagedefault_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~printing_printpdfasimagedefault_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~privacysandbox_privacysandboxadmeasurementenabled","displayName":"Choose whether the Privacy Sandbox ad measurement setting can be disabled","description":"A policy to control whether the Privacy Sandbox Ad measurement setting can be disabled for your users.\r\n\r\nIf you set this policy to Disabled, then the Ad measurement setting will be turned off for your users.\r\nIf you set this policy to Enabled or keep it unset, your users will be able to turn on or off the Privacy Sandbox Ad measurement setting on their device.\r\n\r\nSetting this policy requires setting the PrivacySandboxPromptEnabled policy to Disabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~privacysandbox_privacysandboxadmeasurementenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~privacysandbox_privacysandboxadmeasurementenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~privacysandbox_privacysandboxadtopicsenabled","displayName":"Choose whether the Privacy Sandbox Ad topics setting can be disabled","description":"A policy to control whether the Privacy Sandbox Ad topics setting can be disabled for your users.\r\n\r\nIf you set this policy to Disabled, then the Ad topics setting will be turned off for your users.\r\nIf you set this policy to Enabled or keep it unset, your users will be able to turn on or off the Privacy Sandbox Ad topics setting on their device.\r\n\r\nSetting this policy requires setting the PrivacySandboxPromptEnabled policy to Disabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~privacysandbox_privacysandboxadtopicsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~privacysandbox_privacysandboxadtopicsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~privacysandbox_privacysandboxfingerprintingprotectionenabled","displayName":"Choose whether the Privacy Sandbox Fingerprinting Protection feature is to be enabled in Incognito mode.","description":"A policy to control whether the Privacy Sandbox Fingerprinting Protection setting is to be enabled in Incognito mode or disabled for your users.\r\n\r\nIf you set this policy to Disabled, then the Fingerprinting Protection feature setting will be turned off for your users.\r\nIf you set this policy to Enabled, your users will have the Fingerprinting Protection feature setting turned on in Incognito mode.\r\nIf the policy is not set, users will be able to turn on or off the Fingerprinting Protection feature for Incognito mode in their UI settings. The default state will be false or disabled, meaning the Fingerprinting Protection feature will be turned off.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~privacysandbox_privacysandboxfingerprintingprotectionenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~privacysandbox_privacysandboxfingerprintingprotectionenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~privacysandbox_privacysandboxipprotectionenabled","displayName":"Choose whether the Privacy Sandbox IP Protection feature should be enabled.","description":"A policy to control whether the Privacy Sandbox IP Protection feature should be enabled.\r\n\r\nIP Protection is a feature that limits availability of a user's original IP address for certain third-party network requests made while browsing in Incognito mode, enhancing protections against cross-site tracking during Incognito browsing sessions.\r\n\r\nIf the policy is set to Disabled, then IP Protection will be disabled and users won't be able to enable the feature via UI settings.\r\nIf the policy is set to Enabled, then IP Protection will be enabled and users won't be able to disable the feature via UI settings.\r\nIf the policy is not set, IP Protection will be enabled by default and users will be able to control the feature on their device via UI settings.\r\n\r\nSome considerations regarding whether enterprises should disable IP Protection include:\r\n\r\n- DNS lookups won't be performed for requests that are proxied, which may impact DNS-based monitoring or filtering.\r\n\r\n- Enterprise applications may experience breakage when used in Incognito mode if they rely on requests to domains (or subdomains of those domains) on the Masked Domain List (Google Chrome) and require those requests to come from specific IP address ranges.\r\n\r\n- Traffic might not be proxied in Incognito mode under certain conditions, for example when users launch Incognito mode from a Chrome profile they aren't signed in to. In general the feature requires the user to have been signed in to Chrome with a personal Google account when launching Incognito mode.\r\n\r\n- The list of domains on the Masked Domain List may change over time, with new versions being pushed to users automatically. For more information on the Masked Domain List, see: Google Chrome.\r\n\r\nFor more information on IP Protection, see: Google Chrome.\r\n\r\nIP Protection will be launched no sooner than M139.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~privacysandbox_privacysandboxipprotectionenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~privacysandbox_privacysandboxipprotectionenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~privacysandbox_privacysandboxpromptenabled","displayName":"Choose whether the Privacy Sandbox prompt can be shown to your users","description":"A policy to control whether your users see the Privacy Sandbox prompt.\r\nThe prompt is a user-blocking flow which informs your users of the Privacy Sandbox settings. See https://privacysandbox.com for details about Chrome’s effort to deprecate third-party cookies.\r\n\r\nIf you set this policy to Disabled, then Google Chrome won’t show the Privacy Sandbox prompt.\r\nIf you set this policy to Enabled or keep it unset, then Google Chrome determines whether the Privacy Sandbox prompt can be shown or not and then show it if possible.\r\n\r\nIf any of the following policies are set, it’s required to set this policy to Disabled:\r\nPrivacySandboxAdTopicsEnabled\r\nPrivacySandboxSiteEnabledAdsEnabled\r\nPrivacySandboxAdMeasurementEnabled","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~privacysandbox_privacysandboxpromptenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~privacysandbox_privacysandboxpromptenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~privacysandbox_privacysandboxsiteenabledadsenabled","displayName":"Choose whether the Privacy Sandbox Site-suggested ads setting can be disabled","description":"A policy to control whether the Privacy Sandbox Site-suggested ads setting can be disabled for your users.\r\n\r\nIf you set this policy to Disabled, then the Site-suggested ads setting will be turned off for your users.\r\nIf you set this policy to Enabled or keep it unset, your users will be able to turn on or off the Privacy Sandbox Site-suggested ads setting on their device.\r\n\r\nSetting this policy requires setting the PrivacySandboxPromptEnabled policy to Disabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~privacysandbox_privacysandboxsiteenabledadsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~privacysandbox_privacysandboxsiteenabledadsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~protectedcontent_protectedcontentidentifiersallowed","displayName":"Allows web pages to use identifiers for the purpose of protected content playback","description":"If the policy is set to true or unset, the use of protected content identifiers is allowed, which can help enable higher quality of protected content playback.\r\n\r\nIf the policy is set to false, protected content identifiers are not allowed to be used.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~protectedcontent_protectedcontentidentifiersallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~protectedcontent_protectedcontentidentifiersallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~relatedwebsitesets_relatedwebsitesetsenabled","displayName":"Enable Related Website Sets","description":"This policy allows to control the Related Website Sets feature enablement.\r\n\r\nThis policy overrides the FirstPartySetsEnabled policy.\r\n\r\nWhen this policy is unset or set to True, the Related Website Sets feature is enabled.\r\n\r\nWhen this policy is set to False, the Related Website Sets feature is disabled.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~relatedwebsitesets_relatedwebsitesetsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~relatedwebsitesets_relatedwebsitesetsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~relatedwebsitesets_relatedwebsitesetsoverrides","displayName":"Override Related Website Sets.","description":"This policy provides a way to override the list of sets the browser uses for Related Website Sets features.\r\n\r\nThis policy overrides the FirstPartySetsOverrides policy.\r\n\r\nEach set in the browser's list of Related Website Sets must meet the requirements of a Related Website Set.\r\nA Related Website Set must contain a primary site and one or more member sites.\r\nA set can also contain a list of service sites that it owns, as well as a map from a site to all of its ccTLD variants.\r\nSee https://github.com/WICG/first-party-sets for more information on how Google Chrome uses Related Website Sets.\r\n\r\n\r\nAll sites in a Related Website Set must be a registrable domain served over HTTPS. Each site in a Related Website Set must also be unique,\r\nmeaning a site cannot be listed more than once in a Related Website Set.\r\n\r\nWhen this policy is given an empty dictionary, the browser uses the public list of Related Website Sets.\r\n\r\nFor all sites in a Related Website Set from the replacements list, if a site is also present\r\non a Related Website Set in the browser's list, then that site will be removed from the browser's Related Website Set.\r\nAfter this, the policy's Related Website Set will be added to the browser's list of Related Website Sets.\r\n\r\nFor all sites in a Related Website Set from the additions list, if a site is also present\r\non a Related Website Set in the browser's list, then the browser's Related Website Set will be updated so that the\r\nnew Related Website Set can be added to the browser's list. After the browser's list has been updated,\r\nthe policy's Related Website Set will be added to the browser's list of Related Website Sets.\r\n\r\nThe browser's list of Related Website Sets requires that for all sites in its list, no site is in\r\nmore than one set. This is also required for both the replacements list\r\nand the additions list. Similarly, a site cannot be in both the\r\nreplacements list and the additions list.\r\n\r\nWildcards (*) are not supported as a policy value, nor within any Related Website Set in these lists.\r\n\r\nAll sets provided by the policy must be valid Related Website Sets, if they aren't then an\r\nappropriate error will be outputted.\r\n\r\nOn Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core.\r\n\r\nOn macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=RelatedWebsiteSetsOverrides for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n{\r\n \"additions\": [\r\n {\r\n \"associatedSites\": [\r\n \"https://associate2.test\"\r\n ],\r\n \"ccTLDs\": {\r\n \"https://associate2.test\": [\r\n \"https://associate2.com\"\r\n ]\r\n },\r\n \"primary\": \"https://primary2.test\",\r\n \"serviceSites\": [\r\n \"https://associate2-content.test\"\r\n ]\r\n }\r\n ],\r\n \"replacements\": [\r\n {\r\n \"associatedSites\": [\r\n \"https://associate1.test\"\r\n ],\r\n \"ccTLDs\": {\r\n \"https://associate1.test\": [\r\n \"https://associate1.co.uk\"\r\n ]\r\n },\r\n \"primary\": \"https://primary1.test\",\r\n \"serviceSites\": [\r\n \"https://associate1-content.test\"\r\n ]\r\n }\r\n ]\r\n}","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~relatedwebsitesets_relatedwebsitesetsoverrides_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~relatedwebsitesets_relatedwebsitesetsoverrides_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~relatedwebsitesets_relatedwebsitesetsoverrides_relatedwebsitesetsoverrides","displayName":"Override Related Website Sets. (Device)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~remoteaccess_remoteaccesshostallowpinauthentication","displayName":"Allow PIN and pairing authentication methods for remote access hosts","description":"Setting the policy to Enabled allows the remote access host to use PIN and pairing authentications when accepting client connections.\r\n\r\nSetting the policy to Disabled disallows PIN or pairing authentications.\r\n\r\nLeaving it unset lets the host decide whether PIN and/or pairing authentications can be used.\r\n\r\nNote: If the setting results in no mutually supported authentication methods by both the host and the client, then the connection will be rejected.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~remoteaccess_remoteaccesshostallowpinauthentication_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~remoteaccess_remoteaccesshostallowpinauthentication_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~remoteaccess_remoteaccesshostallowurlforwarding","displayName":"Allow remote access users to open host-side URLs in their local client browser","description":"Setting the policy to Enabled or leaving it unset may allow users connected to a remote access host to open host-side URLs in their local client browser.\r\n\r\nSetting the policy to Disabled will prevent the remote access host from sending URLs to the client.\r\n\r\nThis setting doesn't apply to remote assistance connections as the feature is not supported for that connection mode.\r\n\r\nNote: This feature is not yet generally available so enabling it does not mean that the feature will be visible in the client UI.","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~remoteaccess_remoteaccesshostallowurlforwarding_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~remoteaccess_remoteaccesshostallowurlforwarding_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_assistantwebenabled","displayName":"Allow using Google Assistant on the web, e.g. to enable changing passwords automatically","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_assistantwebenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_assistantwebenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_beforeunloadeventcancelbypreventdefaultenabled","displayName":"Control new behavior for the cancel dialog produced by the beforeunload event","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_beforeunloadeventcancelbypreventdefaultenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_beforeunloadeventcancelbypreventdefaultenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_blocktruncatedcookies","displayName":"Block truncated cookies","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_blocktruncatedcookies_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_blocktruncatedcookies_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_chromeappsenabled","displayName":"Extend support for Chrome Apps on Microsoft® Windows®, macOS, and Linux.","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_chromeappsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_chromeappsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_chromeappswebviewpermissivebehaviorallowed","displayName":"Restore permissive Chrome Apps behavior","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_chromeappswebviewpermissivebehaviorallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_chromeappswebviewpermissivebehaviorallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_chromerootstoreenabled","displayName":"Determines whether the Chrome Root Store and built-in certificate verifier will be used to verify server certificates","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_chromerootstoreenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_chromerootstoreenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_csscustomstatedeprecatedsyntaxenabled","displayName":"Controls whether the deprecated :--foo syntax for CSS custom state is enabled","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_csscustomstatedeprecatedsyntaxenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_csscustomstatedeprecatedsyntaxenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_downloadbubbleenabled","displayName":"Enable download bubble UI","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_downloadbubbleenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_downloadbubbleenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_enforcelocalanchorconstraintsenabled","displayName":"Determines whether the built-in certificate verifier will enforce constraints encoded into trust anchors loaded from the platform trust store.","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_enforcelocalanchorconstraintsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_enforcelocalanchorconstraintsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_eventpathenabled","displayName":"Re-enable the Event.path API until M115.","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_eventpathenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_eventpathenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_extensionmanifestv2availability","displayName":"Control Manifest v2 extension availability","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_extensionmanifestv2availability_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_extensionmanifestv2availability_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_extensionmanifestv2availability_extensionmanifestv2availability","displayName":"Control Manifest v2 extension availability (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_extensionmanifestv2availability_extensionmanifestv2availability_0","displayName":"Default browser behavior","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_extensionmanifestv2availability_extensionmanifestv2availability_1","displayName":"Manifest v2 is disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_extensionmanifestv2availability_extensionmanifestv2availability_2","displayName":"Manifest v2 is enabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_extensionmanifestv2availability_extensionmanifestv2availability_3","displayName":"Manifest v2 is enabled for forced extensions only","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_filesystemsyncaccesshandleasyncinterfaceenabled","displayName":"Re-enable the deprecated async interface for FileSystemSyncAccessHandle in File System Access API","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_filesystemsyncaccesshandleasyncinterfaceenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_filesystemsyncaccesshandleasyncinterfaceenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_forceenablepeppervideodecoderdevapi","displayName":"Enable support for the PPB_VideoDecoder(Dev) API.","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_forceenablepeppervideodecoderdevapi_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_forceenablepeppervideodecoderdevapi_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_forcemajorversiontominorpositioninuseragent","displayName":"Freeze User-Agent string major version at 99","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_forcemajorversiontominorpositioninuseragent_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_forcemajorversiontominorpositioninuseragent_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_forcemajorversiontominorpositioninuseragent_forcemajorversiontominorpositioninuseragent","displayName":"Freeze User-Agent string major version at 99 (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_forcemajorversiontominorpositioninuseragent_forcemajorversiontominorpositioninuseragent_0","displayName":"Default to browser settings for User-Agent string version.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_forcemajorversiontominorpositioninuseragent_forcemajorversiontominorpositioninuseragent_1","displayName":"The User-Agent string will not freeze the major version.","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_forcemajorversiontominorpositioninuseragent_forcemajorversiontominorpositioninuseragent_2","displayName":"The User-Agent string will freeze the major version as 99 and include the browser's major version in the minor position.","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_insecurehashesintlshandshakesenabled","displayName":"Insecure Hashes in TLS Handshakes Enabled","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_insecurehashesintlshandshakesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_insecurehashesintlshandshakesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_keyboardfocusablescrollersenabled","displayName":"Enable keyboard focusable scrollers","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_keyboardfocusablescrollersenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_keyboardfocusablescrollersenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_loadcryptotokenextension","displayName":"Load the CryptoToken component extension at startup","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_loadcryptotokenextension_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_loadcryptotokenextension_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_mutationeventsenabled","displayName":"Re-enable deprecated/removed Mutation Events","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_mutationeventsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_mutationeventsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_nativeclientforceallowed","displayName":"Forces Native Client (NaCl) to be allowed to run.","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_nativeclientforceallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_nativeclientforceallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_newbaseurlinheritancebehaviorallowed","displayName":"Allows enabling the feature NewBaseUrlInheritanceBehavior","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_newbaseurlinheritancebehaviorallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_newbaseurlinheritancebehaviorallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_offsetparentnewspecbehaviorenabled","displayName":"Control the new behavior of HTMLElement.offsetParent","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_offsetparentnewspecbehaviorenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_offsetparentnewspecbehaviorenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_optimizationguidefetchingenabled","displayName":"Enable Optimization Guide Fetching","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_optimizationguidefetchingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_optimizationguidefetchingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_persistentquotaenabled","displayName":"Force persistent quota to be enabled","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_persistentquotaenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_persistentquotaenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_ppapisharedimagesswapchainallowed","displayName":"Allow modern buffer allocation for Graphics3D APIs PPAPI plugin.","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_ppapisharedimagesswapchainallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_ppapisharedimagesswapchainallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_prefixedstorageinfoenabled","displayName":"Re-enable the deprecated window.webkitStorageInfo API","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_prefixedstorageinfoenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_prefixedstorageinfoenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_prefixedvideofullscreenapiavailability","displayName":"Manage the deprecated prefixed video fullscreen API's availability","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_prefixedvideofullscreenapiavailability_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_prefixedvideofullscreenapiavailability_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_prefixedvideofullscreenapiavailability_prefixedvideofullscreenapiavailability","displayName":"Manage the deprecated prefixed video fullscreen API's availability (Device)","description":"","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_prefixedvideofullscreenapiavailability_prefixedvideofullscreenapiavailability_runtime-enabled","displayName":"Follows regular deprecation timelines for the PrefixedVideoFullscreen API","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_prefixedvideofullscreenapiavailability_prefixedvideofullscreenapiavailability_disabled","displayName":"Disables prefixed video fullscreen APIs","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_prefixedvideofullscreenapiavailability_prefixedvideofullscreenapiavailability_enabled","displayName":"Enables prefixed video fullscreen APIs","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_privatenetworkaccessrestrictionsenabled","displayName":"Specifies whether to apply restrictions to requests to more-private network endpoints","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_privatenetworkaccessrestrictionsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_privatenetworkaccessrestrictionsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_rsakeyusageforlocalanchorsenabled","displayName":"Check RSA key usage for server certificates issued by local trust anchors","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_rsakeyusageforlocalanchorsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_rsakeyusageforlocalanchorsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"device_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_selectparserrelaxationenabled","displayName":"Controls whether the new HTML parser behavior for the element is enabled","description":"The HTML parser is being changed to allow additional HTML tags inside the element.\r\n\r\nIf this policy is disabled, then the HTML parser will restrict which tags can be put in the element is enabled (User)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_selectparserrelaxationenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_selectparserrelaxationenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_sendmouseeventsdisabledformcontrolsenabled","displayName":"Control the new behavior for event dispatching on disabled form controls (User)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_sendmouseeventsdisabledformcontrolsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_sendmouseeventsdisabledformcontrolsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_settimeoutwithout1msclampenabled","displayName":"Control Javascript setTimeout() function minimum timeout. (User)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_settimeoutwithout1msclampenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_settimeoutwithout1msclampenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_taborganizersettings","displayName":"Settings for Tab Organizer (User)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_taborganizersettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_taborganizersettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_taborganizersettings_taborganizersettings","displayName":"Settings for Tab Organizer (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_taborganizersettings_taborganizersettings_0","displayName":"Allow Tab Organizer and improve AI models.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_taborganizersettings_taborganizersettings_1","displayName":"Allow Tab Organizer without improving AI models.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_taborganizersettings_taborganizersettings_2","displayName":"Do not allow Tab Organizer.","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_throttlenonvisiblecrossoriginiframesallowed","displayName":"Allows enabling throttling of non-visible, cross-origin iframes (User)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_throttlenonvisiblecrossoriginiframesallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_throttlenonvisiblecrossoriginiframesallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_toolbaravatarlabelsettings","displayName":"Managed toolbar avatar label setting (User)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_toolbaravatarlabelsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_toolbaravatarlabelsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_toolbaravatarlabelsettings_toolbaravatarlabelsettings","displayName":"Managed toolbar avatar label setting (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_toolbaravatarlabelsettings_toolbaravatarlabelsettings_0","displayName":"Always display management label","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_toolbaravatarlabelsettings_toolbaravatarlabelsettings_1","displayName":"Display management labels for 30s","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_unthrottlednestedtimeoutenabled","displayName":"Control the nesting threshold before which Javascript setTimeout() function start being clamped (User)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_unthrottlednestedtimeoutenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_unthrottlednestedtimeoutenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_urlparamfilterenabled","displayName":"Control the URL parameter filter feature (User)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_urlparamfilterenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_urlparamfilterenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_usemojovideodecoderforpepperallowed","displayName":"Allow Pepper to use a new decoder for hardware accelerated video decoding. (User)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_usemojovideodecoderforpepperallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_usemojovideodecoderforpepperallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_useragentclienthintsgreaseupdateenabled","displayName":"Control the User-Agent Client Hints GREASE Update feature. (User)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_useragentclienthintsgreaseupdateenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_useragentclienthintsgreaseupdateenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_websqlaccess","displayName":"Force WebSQL to be enabled. (User)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_websqlaccess_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_websqlaccess_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_websqlnonsecurecontextenabled","displayName":"Force WebSQL in non-secure contexts to be enabled. (User)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_websqlnonsecurecontextenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_websqlnonsecurecontextenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_zstdcontentencodingenabled","displayName":"Enable zstd content-encoding support (User)","description":"This policy is removed. It is not compatible with this version of Google Chrome. Read more at https://support.google.com/chrome/a/answer/7643500","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_zstdcontentencodingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~removedpolicies_zstdcontentencodingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~safebrowsing_safebrowsingdeepscanningenabled","displayName":"Allow download deep scanning for Safe Browsing-enabled users (User)","description":"When this policy is enabled or left unset, Google Chrome can send suspicious downloads from Safe Browsing-enabled users to Google to scan for malware, or prompt users to provide a password for encrypted archives.\r\nWhen this policy is disabled, this scanning will not be performed.\r\nThis policy does not impact download content analysis configured by Chrome Enterprise Connectors.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~safebrowsing_safebrowsingdeepscanningenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~safebrowsing_safebrowsingdeepscanningenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~safebrowsing_safebrowsingproxiedrealtimechecksallowed","displayName":"Allow Safe Browsing Proxied Real Time Checks (User)","description":"This controls whether Safe Browsing's standard protection mode is allowed to\r\nsend partial hashes of URLs to Google through a proxy via Oblivious HTTP\r\nin order to determine whether they are safe to visit.\r\n\r\nThe proxy allows browsers to upload partial hashes of URLs to Google\r\nwithout them being linked to the user's IP address. The policy also allows\r\nbrowsers to upload the partial hashes of URLs with higher frequency for\r\nbetter Safe Browsing protection quality.\r\n\r\nThis policy will be ignored if Safe Browsing is disabled or set to enhanced\r\nprotection mode.\r\n\r\nSetting the policy to Enabled or leaving it unset allows the\r\nhigher-protection proxied lookups.\r\n\r\nSetting the policy to Disabled disallows the higher-protection proxied\r\nlookups. Partial hashes of URLs will be uploaded to Google directly with much\r\nlower frequency, which will degrade protection.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~safebrowsing_safebrowsingproxiedrealtimechecksallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~safebrowsing_safebrowsingproxiedrealtimechecksallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~safebrowsing_safebrowsingsurveysenabled","displayName":"Allow Safe Browsing Surveys (User)","description":"When this policy is enabled or left unset, the user may receive surveys related to Safe Browsing.\r\nWhen this policy is disabled, the user will not receive surveys related to Safe Browsing.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~safebrowsing_safebrowsingsurveysenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~safebrowsing_safebrowsingsurveysenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~signin_boundsessioncredentialsenabled","displayName":"Bind Google credentials to a device (User)","description":"Controls the state of the Device Bound Session Credentials feature.\r\n\r\nDevice Bound Session Credentials protects Google authentication cookies against cookie theft by regularly providing a cryptographic proof of device possession to Google servers.\r\n\r\nIf this policy is set to false, Device Bound Session Credentials feature will be disabled.\r\n\r\nIf this policy is set to true, Device Bound Session Credentials feature will be enabled.\r\n\r\nIf this policy is unset, Google Chrome will follow the default rollout process for the Device Bound Session Credentials feature, which means that the feature will be gradually rolled out to an increasing number of users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~signin_boundsessioncredentialsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~signin_boundsessioncredentialsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~signin_profileseparationdomainexceptionlist","displayName":"Enterprise profile separation secondary domain allowlist (User)","description":"If this policy is unset, account logins will not be required to create a new separate profile.\r\n\r\nIf this policy is set, account logins from the listed domains will not be required to create a new separate profile.\r\n\r\nThis policy can be set to an empty string so that all account logins are required to create a new separate profile.\r\n\r\nExample value:\r\n\r\ndomain.com\r\notherdomain.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~signin_profileseparationdomainexceptionlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~signin_profileseparationdomainexceptionlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~signin_profileseparationdomainexceptionlist_profileseparationdomainexceptionlistdesc","displayName":"Enterprise profile separation secondary domain allowlist (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~webrtc_webrtciphandlingurl","displayName":"WebRTC per URL IP Handling (User)","description":"This policy allows restricting which IP addresses and interfaces WebRTC uses when attempting to find the best available connection for each specific URL pattern.\r\n\r\nIt accepts a list of URL patterns and handling type pairs. The URL patterns are checked in order and the first match will configure which handling is used by WebRTC for the domain. When the URL of the current document is not matched against any entry, it uses the configuration set by the policy WebRtcIPHandling.\r\n\r\nFor detailed information on valid input patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns. Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored.\r\n\r\nValid handling values:\r\n\r\n* default - WebRTC uses all network interfaces.\r\n\r\n* default_public_and_private_interfaces - WebRTC uses all public and private interfaces.\r\n\r\n* default_public_interface_only - WebRTC uses all public interfaces, but not private ones.\r\n\r\n* disable_non_proxied_udp - WebRTC uses either UDP SOCKS proxying or will fallback to TCP proxying.\r\n\r\nSee RFC 8828 section 5.2 (https://tools.ietf.org/html/rfc8828.html#section-5.2) for a detailed description of all the handling values.\r\nSee https://cloud.google.com/docs/chrome-enterprise/policies/?policy=WebRtcIPHandlingUrl for more information about schema and formatting.\r\n\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"url\": \"https://www.example.com\",\r\n \"handling\": \"default_public_and_private_interfaces\"\r\n },\r\n {\r\n \"url\": \"https://[*.]example.edu\",\r\n \"handling\": \"default_public_interface_only\"\r\n },\r\n {\r\n \"url\": \"*\",\r\n \"handling\": \"disable_non_proxied_udp\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~webrtc_webrtciphandlingurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~webrtc_webrtciphandlingurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~webrtc_webrtciphandlingurl_webrtciphandlingurl","displayName":"WebRTC per URL IP Handling (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~webrtc_webrtcpostquantumkeyagreement","displayName":"Enable post-quantum key agreement for WebRTC (User)","description":"This policy allows controlling post-quantum key agreement for WebRTC.\r\n\r\nIf this policy is set to Enabled, post-quantum key agreement would be offered for\r\nWebRTC.\r\n\r\nIf this policy is set to Disabled, post-quantum key agreement would not be offered\r\nfor WebRTC.\r\n\r\nIf this policy is not set, the value would be set by the default rollout process\r\nfor post-quantum key agreement offered for WebRTC.\r\n\r\nOffering a post-quantum key agreement is backwards-compatible. Existing DTLS\r\npeers and networking middleware are expected to ignore the new option and\r\ncontinue selecting previous options.\r\n\r\nHowever, devices that do not correctly implement DTLS may malfunction when\r\noffered the new option. For example, they may disconnect in response to\r\nunrecognized options or the resulting larger messages. Such devices are not\r\npost-quantum-ready and will interfere with an enterprise's post-quantum\r\ntransition. If encountered, administrators should contact the vendor for a fix.\r\n\r\nThis policy is a temporary measure and will be removed after some milestones.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~webrtc_webrtcpostquantumkeyagreement_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_chromeintunev141~policy~googlechrome~webrtc_webrtcpostquantumkeyagreement_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_connectivity_disablecrossdeviceresume","displayName":"Disable Cross Device Resume (User) (Windows Insiders only)","description":"This policy allows IT admins to turn off CrossDeviceResume feature to continue tasks, such as browsing file, continue using 1P/ 3P apps that require linking between Phone and PC. If you enable this policy setting, the Windows device will not receive any CrossDeviceResume notification. If you disable this policy setting, the Windows device will receive notification to resume activity from linked phone. If you do not configure this policy setting, the default behavior is that the CrossDeviceResume feature is turned 'ON'. Changes to this policy take effect on reboot.\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Connectivity#disablecrossdeviceresume"],"options":[{"id":"user_vendor_msft_policy_config_connectivity_disablecrossdeviceresume_0","displayName":"CrossDeviceResume is Enabled.","description":"CrossDeviceResume is Enabled.","helpText":null},{"id":"user_vendor_msft_policy_config_connectivity_disablecrossdeviceresume_1","displayName":"CrossDeviceResume is Disabled.","description":"CrossDeviceResume is Disabled.","helpText":null}]},{"id":"user_vendor_msft_policy_config_credentialsui_disablepasswordreveal","displayName":"Do not display the password reveal button (User)","description":"This policy setting allows you to configure the display of the password reveal button in password entry user experiences.\r\n\r\nIf you enable this policy setting, the password reveal button will not be displayed after a user types a password in the password entry text box.\r\n\r\nIf you disable or do not configure this policy setting, the password reveal button will be displayed after a user types a password in the password entry text box.\r\n\r\nBy default, the password reveal button is displayed after a user types a password in the password entry text box. To display the password, click the password reveal button.\r\n\r\nThe policy applies to all Windows components and applications that use the Windows system controls, including Internet Explorer.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-credentialsui#credentialsui-disablepasswordreveal"],"options":[{"id":"user_vendor_msft_policy_config_credentialsui_disablepasswordreveal_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_credentialsui_disablepasswordreveal_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_desktop_preventuserredirectionofprofilefolders","displayName":"Prohibit User from manually redirecting Profile Folders (User)","description":"Prevents users from changing the path to their profile folders.\r\n\r\nBy default, a user can change the location of their individual profile folders like Documents, Music etc. by typing a new path in the Locations tab of the folder's Properties dialog box.\r\n\r\nIf you enable this setting, users are unable to type a new location in the Target box.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-desktop#desktop-preventuserredirectionofprofilefolders"],"options":[{"id":"user_vendor_msft_policy_config_desktop_preventuserredirectionofprofilefolders_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_desktop_preventuserredirectionofprofilefolders_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_display_configuremultipledisplaymode","displayName":"Configure Multiple Display Mode (User)","description":"Set the default display arrangement as clone, extend, internalOnly, externalOnly or default Windows Settings.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Display#configuremultipledisplaymode"],"options":[{"id":"user_vendor_msft_policy_config_display_configuremultipledisplaymode_0","displayName":"Default.","description":"Default.","helpText":null},{"id":"user_vendor_msft_policy_config_display_configuremultipledisplaymode_1","displayName":"Internal Only.","description":"Internal Only.","helpText":null},{"id":"user_vendor_msft_policy_config_display_configuremultipledisplaymode_2","displayName":"External Only.","description":"External Only.","helpText":null},{"id":"user_vendor_msft_policy_config_display_configuremultipledisplaymode_3","displayName":"Clone.","description":"Clone.","helpText":null},{"id":"user_vendor_msft_policy_config_display_configuremultipledisplaymode_4","displayName":"Extend.","description":"Extend.","helpText":null}]},{"id":"user_vendor_msft_policy_config_display_enableperprocessdpi","displayName":"Enable Per Process Dpi (User)","description":"Enable or disable Per-Process System DPI for all applications.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Display#enableperprocessdpi"],"options":[{"id":"user_vendor_msft_policy_config_display_enableperprocessdpi_0","displayName":"Disabled","description":"Disable.","helpText":null},{"id":"user_vendor_msft_policy_config_display_enableperprocessdpi_1","displayName":"Enabled","description":"Enable.","helpText":null}]},{"id":"user_vendor_msft_policy_config_display_setclonepreferredresolutionsource","displayName":"Set Clone Preferred Resolution Source (User)","description":"Set the cloned monitor preferred resolution source as internal or external monitor or set to default.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Display#setclonepreferredresolutionsource"],"options":[{"id":"user_vendor_msft_policy_config_display_setclonepreferredresolutionsource_0","displayName":"Default.","description":"Default.","helpText":null},{"id":"user_vendor_msft_policy_config_display_setclonepreferredresolutionsource_1","displayName":"Internal.","description":"Internal.","helpText":null},{"id":"user_vendor_msft_policy_config_display_setclonepreferredresolutionsource_2","displayName":"External.","description":"External.","helpText":null}]},{"id":"user_vendor_msft_policy_config_education_allowgraphingcalculator","displayName":"Allow Graphing Calculator (User)","description":"This policy setting allows you to control whether graphing functionality is available in the Windows Calculator app. If you disable this policy setting, graphing functionality will not be accessible in the Windows Calculator app. If you enable or don't configure this policy setting, users will be able to access graphing functionality.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Education#allowgraphingcalculator"],"options":[{"id":"user_vendor_msft_policy_config_education_allowgraphingcalculator_0","displayName":"Block","description":"Disabled.","helpText":null},{"id":"user_vendor_msft_policy_config_education_allowgraphingcalculator_1","displayName":"Allow","description":"Enabled.","helpText":null}]},{"id":"user_vendor_msft_policy_config_education_defaultprintername","displayName":"Default Printer Name (User)","description":"This policy sets user's default printer","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Education#defaultprintername"],"options":null},{"id":"user_vendor_msft_policy_config_education_preventaddingnewprinters","displayName":"Prevent Adding New Printers (User)","description":"Boolean that specifies whether or not to prevent user to install new printers","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Education#preventaddingnewprinters"],"options":[{"id":"user_vendor_msft_policy_config_education_preventaddingnewprinters_0","displayName":"Disabled","description":"Allow user installation.","helpText":null},{"id":"user_vendor_msft_policy_config_education_preventaddingnewprinters_1","displayName":"Enabled","description":"Prevent user installation.","helpText":null}]},{"id":"user_vendor_msft_policy_config_education_printernames","displayName":"Printer Names (User)","description":"This policy provisions per-user network printers","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Education#printernames"],"options":null},{"id":"user_vendor_msft_policy_config_enterprisecloudprint_cloudprinterdiscoveryendpoint","displayName":"Cloud Printer Discovery End Point (User)","description":"This policy provisions per-user discovery end point to discover cloud printers","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-EnterpriseCloudPrint#cloudprinterdiscoveryendpoint"],"options":null},{"id":"user_vendor_msft_policy_config_enterprisecloudprint_cloudprintoauthauthority","displayName":"Cloud Print OAuth Authority (User)","description":"Authentication endpoint for acquiring OAuth tokens","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-EnterpriseCloudPrint#cloudprintoauthauthority"],"options":null},{"id":"user_vendor_msft_policy_config_enterprisecloudprint_cloudprintoauthclientid","displayName":"Cloud Print OAuth Client Id (User)","description":"A GUID identifying the client application authorized to retrieve OAuth tokens from the OAuthAuthority","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-EnterpriseCloudPrint#cloudprintoauthclientid"],"options":null},{"id":"user_vendor_msft_policy_config_enterprisecloudprint_cloudprintresourceid","displayName":"Cloud Print Resource Id (User)","description":"Resource URI for which access is being requested by the Enterprise Cloud Print client during OAuth authentication","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-EnterpriseCloudPrint#cloudprintresourceid"],"options":null},{"id":"user_vendor_msft_policy_config_enterprisecloudprint_mopriadiscoveryresourceid","displayName":"Mopria Discovery Resource Id (User)","description":"Resource URI for which access is being requested by the Mopria discovery client during OAuth authentication","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-EnterpriseCloudPrint#mopriadiscoveryresourceid"],"options":null},{"id":"user_vendor_msft_policy_config_excel16v10~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_excelforcesupportforunicodesurrogates","displayName":"Force support for Unicode surrogates in Excel 2021 and Excel 2024 (User)","description":"Warning: this setting alters how your app calculates LEN, MID, SEARCH, FIND and REPLACE and forces files to Compatibility Version 2. When these workbooks are shared, users may see different calculation results. This setting only applies to non-subscription Excel 2021 and Excel 2024.\r\n \r\nIf you enable this policy setting, when any workbook is opened in non-subscription Excel 2021 or Excel 2024, it will automatically be set to Compatibility Version 2. This will cause LEN, MID, SEARCH, FIND and REPLACE functions to calculate differently in those workbooks.\r\n \r\nIf you disable or do not configure this policy setting, the Compatibility Version will not be automatically set when a file is opened in any version of non-subscription Excel 2021 and Excel 2024 (this setting never affects other versions).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v10~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_excelforcesupportforunicodesurrogates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v10~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_excelforcesupportforunicodesurrogates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_customizableerrormessages_l_listoferrormessagestocustomize","displayName":"List of error messages to customize (User)","description":"Enter error ID for Value Name and custom button text for Value","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_customizableerrormessages_l_listoferrormessagestocustomize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_customizableerrormessages_l_listoferrormessagestocustomize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_customizableerrormessages_l_listoferrormessagestocustomize_l_listoferrormessagestocustomize87","displayName":"List of error messages to customize (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_customizableerrormessages_l_listoferrormessagestocustomize_l_listoferrormessagestocustomize87_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_customizableerrormessages_l_listoferrormessagestocustomize_l_listoferrormessagestocustomize87_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_datarecovery_l_donotshowdataextractionoptionswhenopeningcorruptworkbooks","displayName":"Do not show data extraction options when opening corrupt workbooks (User)","description":"This policy setting controls whether Excel presents users with a list of data extraction options before beginning an Open and Repair operation when users choose to open a corrupt workbook in repair or extract mode.\r\n \r\nIf you enable this policy setting, Excel opens the file using the Safe Load process and does not prompt users to choose between repairing or extracting data.\r\n \r\nIf you disable or do not configure this policy setting, Excel prompts the user to select either to repair or to extract data, and to select either to convert to values or to recover formulas.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_datarecovery_l_donotshowdataextractionoptionswhenopeningcorruptworkbooks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_datarecovery_l_donotshowdataextractionoptionswhenopeningcorruptworkbooks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems165","displayName":"Disable commands (User)","description":"This policy setting allows you to disable any command bar button and menu item with a command bar ID, including command bar buttons and menu items that are not in the predefined lists.\r\n\r\nIf you enable this policy setting, you can enter an ID number to disable a specific command bar button or menu item. The ID number needs to be in decimal (not hexadecimal). Multiple values should be separated by commas.\r\n\r\nIf you disable or do not configure this policy setting, all default command bar buttons or menu items are available to users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems165_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems165_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems165_l_enteracommandbaridtodisable","displayName":"Enter a command bar ID to disable (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys166","displayName":"Disable shortcut keys (User)","description":"This policy setting allows you to disable any shortcut key by using its virtual key code ID, including shortcut keys that are not in the predefined lists.\r\n\r\nIf you enable this policy setting, you can enter a virtual key code ID number to disable a specific shortcut key.\r\n\r\nIf you disable or do not configure this policy setting, all default shortcut keys are enabled for users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys166_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys166_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys166_l_enterakeyandmodifiertodisable","displayName":"Enter a key and modifier to disable (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems","displayName":"Disable commands (User)","description":"This policy setting allows you to disable specific command bar buttons and menu items in the specified applications.\r\n \r\n If you enable this policy setting you can disable specific command bar buttons and menu items in the user interface for the selected application. The predefined list of command bar buttons and menu items you can disable becomes available to you when you enable this policy setting.\r\n \r\n If you disable or do not configure this policy setting, the predefined list of command bar buttons and menu items are enabled for the application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_developercodemacros","displayName":"Developer tab | Code | Macros (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_developercodemacros_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_developercodemacros_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_developercodemacrosecurity","displayName":"Developer tab | Code | Macro Security (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_developercodemacrosecurity_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_developercodemacrosecurity_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_developercoderecordmacro","displayName":"Developer tab | Code | Record Macro (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_developercoderecordmacro_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_developercoderecordmacro_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_developercodevisualbasic","displayName":"Developer tab | Code | Visual Basic (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_developercodevisualbasic_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_developercodevisualbasic_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_insertlinkshyperlink","displayName":"Insert tab | Links | Hyperlink (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_insertlinkshyperlink_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_insertlinkshyperlink_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_officebuttonexceloptionscustomizationmailrecipient","displayName":"File tab | Share | Email (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_officebuttonexceloptionscustomizationmailrecipient_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_officebuttonexceloptionscustomizationmailrecipient_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_officebuttonexceloptionscustomizedocumentlocation","displayName":"File tab | Options | Customize Ribbon | All Commands | Document Location (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_officebuttonexceloptionscustomizedocumentlocation_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_officebuttonexceloptionscustomizedocumentlocation_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_officebuttonxceloptionscustomizationcombinedpreviewwebpagepreview","displayName":"File tab | Options | Customize Ribbon | All Commands | Web Page Preview (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_officebuttonxceloptionscustomizationcombinedpreviewwebpagepreview_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_officebuttonxceloptionscustomizationcombinedpreviewwebpagepreview_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_reviewchangesprotectsharing","displayName":"Review tab | Changes | Protect and Share Workbook (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_reviewchangesprotectsharing_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_reviewchangesprotectsharing_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_reviewchangesprotectsheet","displayName":"Review tab | Changes | Protect Sheet (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_reviewchangesprotectsheet_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_reviewchangesprotectsheet_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_reviewchangesprotectworkbook","displayName":"Review tab | Changes | Protect Workbook (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_reviewchangesprotectworkbook_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_reviewchangesprotectworkbook_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_viewmacrosmacros","displayName":"View tab | Macros | Macros (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_viewmacrosmacros_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_viewmacrosmacros_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys","displayName":"Disable shortcut keys (User)","description":"This policy setting allows you to disable specific shortcut key combinations in the specified applications.\r\n \r\n If you enable this policy setting you can disable specific shortcut keys for the selected application. The predefined list of shortcut keys you can disable becomes available to you when you enable this policy setting.\r\n \r\n If you disable or do not configure this policy setting, the predefined list of shortcut keys are enabled for the application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_altf8toolsmacromacros","displayName":"Alt+F8 (Developer | Code | Macros) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_altf8toolsmacromacros_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_altf8toolsmacromacros_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_altlvdevelopercodevisualbasic","displayName":"Alt+F11 (Developer | Code | Visual Basic) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_altlvdevelopercodevisualbasic_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_altlvdevelopercodevisualbasic_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlfhomeeditingfind","displayName":"Ctrl+F (Home | Editing | Find & Select | Find) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlfhomeeditingfind_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlfhomeeditingfind_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlkinsertlinkshyperlinks","displayName":"Ctrl+K (Insert | Links | Hyperlink) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlkinsertlinkshyperlinks_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlkinsertlinkshyperlinks_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_alertbeforeoverwritingcells","displayName":"Alert before overwriting cells (User)","description":"This policy setting sets the \"Alert before overwriting cells\" option found under File tab | Options | Advanced | Editing Options.\r\n\r\nIf you enable or do not configure this policy setting, Excel will give a warning if cells are about to be overwritten. This is the default behavior.\r\n\r\nIf you disable this policy setting, Excel will suppress the warning that cells are about to be overwritten.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_alertbeforeoverwritingcells_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_alertbeforeoverwritingcells_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_alternatestartupfilelocation","displayName":"Alternate startup file location (User)","description":"This policy setting allows you to specify the folder where files will be opened by Excel at startup.\r\n\r\nIf you enable this policy setting, you may specify the folder where files will be opened by Excel at startup. Files will be opened from this folder in addition to the XLSTART folder in the Microsoft Office installation directory (default C:\\Program Files\\Microsoft Office\\Office14\\XLSTART).\r\n\r\nIf you disable or do not configure this policy setting, files will only be opened from the XLSTART folder.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_alternatestartupfilelocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_alternatestartupfilelocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_alternatestartupfilelocation_l_alternatestartupfilelocation86","displayName":"Alternate startup file location (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_asktoupdateautomaticlinks","displayName":"Ask to update automatic links (User)","description":"This policy setting controls whether Excel prompts users to update automatic links, or whether the updates occur in the background with no prompt.\r\n \r\nIf you enable or do not configure this policy setting, Excel will prompt users to update automatic links. In addition, the \"Ask to update automatic links\" user interface option under File tab | Advanced | General is selected.\r\n \r\nIf you disable this policy setting, Excel updates automatic links without prompting or informing users, which could compromise the integrity of some of the information in the workbook.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_asktoupdateautomaticlinks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_asktoupdateautomaticlinks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_automaticallyflashfill","displayName":"Automatically Flash Fill (User)","description":"This policy setting controls the \"Automatically Flash Fill\" option found under File tab | Options | Advanced | Editing Options.\r\n\r\nIf you enable or do not configure this policy setting, Excel will enable automatic Flash Fill. This is the default behavior.\r\n\r\nIf you disable this policy setting, Excel will turn off the Automatic Flash Fill feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_automaticallyflashfill_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_automaticallyflashfill_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_automaticallyinsertadecimalpoint","displayName":"Automatically insert a decimal point (User)","description":"This policy setting allows you to configure the \"Automatically insert a decimal point\" option.\r\n\r\nIf you enable this policy setting, the \"Automatically insert a decimal point\" option will be checked and the Places option is set to 2.\r\n\r\nIf you disable or do not configure this policy setting, the \"Automatically insert a decimal point\" option will not be checked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_automaticallyinsertadecimalpoint_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_automaticallyinsertadecimalpoint_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_chartreftrackingenabled","displayName":"Allow formatting and labels to track data points (User)","description":"This policy setting governs how custom formatting and data labels react to data changes in a chart.\r\n\r\nIf you enable or do not configure this policy setting, when the user creates a new workbook, custom formatting and data labels follow data points as they move or change in any chart in the workbook.\r\n\r\nIf you disable this policy setting, custom formatting and data labels do not follow data points, but instead follow data point indices.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_chartreftrackingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_chartreftrackingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_comments","displayName":"Comments (User)","description":"Determines how comments are displayed on the worksheet.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_comments_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_comments_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_comments_l_comments85","displayName":"Comments (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_comments_l_comments85_0","displayName":"None","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_comments_l_comments85_1","displayName":"Comment indicator only","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_comments_l_comments85_2","displayName":"Comment & indicator","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_cursormovement","displayName":"Cursor movement (User)","description":"Determines how the insertion point moves through bi-directional text. Possible values are Logical or Visual and the default is Logical.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_cursormovement_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_cursormovement_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_cursormovement_l_cursormovement82","displayName":"Cursor movement (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_cursormovement_l_cursormovement82_0","displayName":"Logical","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_cursormovement_l_cursormovement82_1","displayName":"Visual","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_cutandcopyobjectswithcells","displayName":"Cut and copy objects with cells (User)","description":"This policy setting sets the \"Cut, copy, and sort inserted objects with their parent cells\" option found under File tab | Options | Advanced | Cut, copy, and paste Options.\r\n\r\nIf you enable or do not configure this policy setting, Excel will cut, copy, and sort inserted objects with their parent cells.\r\n\r\nIf you disable this policy setting, Excel will not cut and copy inserted objects with their parent cells.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_cutandcopyobjectswithcells_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_cutandcopyobjectswithcells_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_defaultdirection","displayName":"Default sheet direction (User)","description":"This setting controls the default sheet direction, which is either \"Left to Right\" or \"Right to Left\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_defaultdirection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_defaultdirection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_defaultdirection_l_defaultdirection81","displayName":"Default sheet direction (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_defaultdirection_l_defaultdirection81_1","displayName":"Right-to-Left","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_defaultdirection_l_defaultdirection81_0","displayName":"Left-to-Right","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_editdirectlyincell","displayName":"Edit directly in cell (User)","description":"This policy setting sets the \"Edit directly in cell\" option found under File tab | Options | Advanced | Editing Options.\r\n\r\nIf you enable or do not configure this policy setting, Excel will allow editing directly in the cell This is the default behavior.\r\n\r\nIf you disable this policy setting, Excel will not allow editing to be done directly in the cell.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_editdirectlyincell_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_editdirectlyincell_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_enableautocompleteforcellvalues","displayName":"Enable AutoComplete for cell values (User)","description":"This policy setting sets the \"Enable AutoComplete for cell values\" option found under File tab | Options | Advanced | Editing Options.\r\n\r\nIf you enable or do not configure this policy setting, Excel will allow AutoComplete for cell values. This is the default behavior.\r\n\r\nIf you disable this policy setting, Excel will turn off the AutoComplete feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_enableautocompleteforcellvalues_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_enableautocompleteforcellvalues_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_enableautomaticpercententry","displayName":"Enable automatic percent entry (User)","description":"Enabling this policy selects the Advanced (Editing options) user option to \"Enable automatic percent entry\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_enableautomaticpercententry_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_enableautomaticpercententry_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_enablefillhandleandcelldraganddrop","displayName":"Enable fill handle and cell drag-and-drop (User)","description":"This policy setting sets the \"Enable fill handle and cell drag-and-drop\" option found under File tab | Options | Advanced | Editing Options.\r\n\r\nIf you enable or do not configure this policy setting, Excel will enable the fill handle and allow drag-and-drop. This is the default behavior.\r\n\r\nIf you disable this policy setting, Excel will disable the fill handle and drag-and-drop will not be allowed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_enablefillhandleandcelldraganddrop_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_enablefillhandleandcelldraganddrop_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_extenddatarangeformatsandformulas","displayName":"Extend data range formats and formulas (User)","description":"This policy setting sets the \"Extend data range formats and formulas\" option found under File tab | Options | Advanced | Editing Options.\r\n\r\nIf you enable or do not configure this policy setting, Excel will allow the user to automatically format new items added to the end of a list to match the format of the rest of the list. This is the default behavior.\r\n\r\nIf you disable this policy setting, Excel will not automatically format new items added to the end of a list.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_extenddatarangeformatsandformulas_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_extenddatarangeformatsandformulas_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_functiontooltips","displayName":"Function tooltips (User)","description":"Enabling this setting selects the Advanced (Display) user option to \"Show function ScreenTips\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_functiontooltips_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_functiontooltips_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_ignoreotherapplications","displayName":"Ignore other applications (User)","description":"This policy setting controls whether Excel can exchange data with other applications that use Dynamic Data Exchange (DDE).\r\n \r\n If you enable this policy setting, Excel does not allow the exchange of data with other applications that use DDE. In addition, the \"Ignore other applications that use Dynamic Data Exchange (DDE)\" user interface option under Excel Options | General is selected and users cannot change it. Enabling this policy setting can cause disruptions for users who rely on the DDE functionality in Excel to update information in workbooks. These users will have to use some other method to update information provided by other applications.\r\n \r\n If you disable or do not configure this policy setting, Excel can use the Dynamic Data Exchange (DDE) protocol to exchange messages and data with other applications. For example, a cell in an Excel workbook can be dynamically linked to a value provided by another application, such as weather or stock price information. When the value provided by the other application changes, Excel can automatically update the value in the workbook. Note: users can change this behavior by selecting the \"Ignore other applications that use Dynamic Data Exchange (DDE)\" user interface option under Excel Options | General.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_ignoreotherapplications_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_ignoreotherapplications_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_microsoftexcelmenuorhelpkey","displayName":"Microsoft Excel menu or Help key (User)","description":"This policy setting allows you to set the ASCII value for the key of choice (e.g. '/'=47).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_microsoftexcelmenuorhelpkey_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_microsoftexcelmenuorhelpkey_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_microsoftexcelmenuorhelpkey_l_helpkey","displayName":"Enter ASCII value (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_moveselectionafterenter","displayName":"Move selection after Enter (User)","description":"Enabling this policy selects the Advanced (Editing Options) user option to \"After pressing Enter, move selection\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_moveselectionafterenter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_moveselectionafterenter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_moveselectionafterenterdirection","displayName":"Move selection after Enter direction (User)","description":"Specifies the direction that the selection is moved after the Enter key is pressed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_moveselectionafterenterdirection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_moveselectionafterenterdirection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_moveselectionafterenterdirection_l_moveselectionafterenterdirection84","displayName":"Move selection after Enter direction (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_moveselectionafterenterdirection_l_moveselectionafterenterdirection84_0","displayName":"Down","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_moveselectionafterenterdirection_l_moveselectionafterenterdirection84_1","displayName":"Right","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_moveselectionafterenterdirection_l_moveselectionafterenterdirection84_2","displayName":"Up","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_moveselectionafterenterdirection_l_moveselectionafterenterdirection84_3","displayName":"Left","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_recentlyusedfilelist","displayName":"Number of workbooks in the Recent Workbooks list (User)","description":"This policy setting specifies the number of entries displayed in the Recent Workbooks list that appears when users click Open on the File tab in Backstage view.\r\n\r\nIf you enable this policy setting, you can specify the number of entries to be between 0 and 50. If you set the number to 0, all pinned and unpinned entries are hidden.\r\n\r\nIf you disable or do not configure this policy setting, a maximum of 25 items will be displayed in the Recent Workbooks list.\r\n\r\nNote: If you want to prevent items from being added to the Recent Workbooks list entirely, you can enable the \"Do not keep history of recently opened documents\" Windows policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_recentlyusedfilelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_recentlyusedfilelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_recentlyusedfilelist_l_entriesonrecentlyusedfilelist","displayName":"Entries on recently used file list (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_setnumberofplacesintherecentplaceslist","displayName":"Number of folders in the Recent Folders list (User)","description":"This policy setting specifies the number of unpinned entries displayed in the Recent Folders list that appears when users click Open or Save As on the File tab in Backstage view.\r\n\r\nIf you enable this policy setting, you can specify the number of unpinned entries to be between 0 and 20. If you set the number to 0, all pinned and unpinned entries are hidden.\r\n\r\nIf you disable or do not configure this policy setting, a maximum of 5 unpinned items are displayed in the Recent Folders list.\r\n\r\nNote: If you want to prevent items from being added to the Recent Folders list entirely, you can enable the \"Do not keep history of recently opened documents\" Windows policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_setnumberofplacesintherecentplaceslist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_setnumberofplacesintherecentplaceslist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_setnumberofplacesintherecentplaceslist_l_setnumberofplacesintherecentplaceslistspinid","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showalertifnotdefault","displayName":"Show Alert if Excel is not the default for its associated file types (User)","description":"This policy setting controls the \"Tell me if Microsoft Excel isn't the default progam for viewing and editing spreadsheets\" option found under File tab | Options.\r\n\r\nIf you enable or do not configure this policy setting, Excel will show an alert if it isn't the default progam for viewing and editing spreadsheets. This is the default behavior.\r\n\r\nIf you disable this policy setting, Excel will turn off the alert.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showalertifnotdefault_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showalertifnotdefault_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showcontrolcharacters","displayName":"Show control characters (User)","description":"Enabling this policy selects the user option to \"Show control characters\". This option appears in the Advanced category when certain languages have been enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showcontrolcharacters_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showcontrolcharacters_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showformulabarinfullview","displayName":"Show Formula bar in Full View (User)","description":"Checked: Displays the Formula bar when the Full Screen command in the View menu is set. | Unchecked: Does not dispaly the Formula bar when the Full Screen command in the View menu is set.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showformulabarinfullview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showformulabarinfullview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showformulabarinnormalview","displayName":"Show Formula bar in Normal View (User)","description":"Enabling this setting selects the Advanced (Display) user option to \"Show formula bar\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showformulabarinnormalview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showformulabarinnormalview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showinsertoptionsbuttons","displayName":"Show Insert Options buttons (User)","description":"This policy setting sets the \"Show Insert Options buttons\" option found under File tab | Options | Advanced | Cut, copy, and paste options.\r\n\r\nIf you enable or do not configure this policy setting, Excel will show the Insert Options button after inserting cells, rows, or columns that contain formatting. This is the default behavior.\r\n\r\nIf you disable this policy setting, Excel will not display the Insert Options buttons on insert.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showinsertoptionsbuttons_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showinsertoptionsbuttons_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_shownames","displayName":"Show names (User)","description":"Enabling this setting selects the Advanced (Display) user option to \"Show chart element names on hover\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_shownames_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_shownames_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showpasteoptionsbuttonwhencontentispasted","displayName":"Show Paste Options button when content is pasted (User)","description":"This policy setting sets the \"Show Paste Options button when content is pasted\" option found under File tab | Options | Advanced | Cut, copy, and paste options.\r\n\r\nIf you enable or do not configure this policy setting, Excel will show the Paste Options button after inserting cells, rows, or columns that contain formatting. This is the default behavior.\r\n\r\nIf you disable this policy setting, Excel will not display the Paste Options buttons on paste.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showpasteoptionsbuttonwhencontentispasted_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showpasteoptionsbuttonwhencontentispasted_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showvalues","displayName":"Show values (User)","description":"Enabling this setting selects the Advanced (Display) user option to \"Show data point values on hover\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showvalues_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_showvalues_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_transitionnavigationkeys","displayName":"Transition navigation keys (User)","description":"Enabling this policy checks the Advanced (Lotus compatibility) user option named \"Transition navigation keys\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_transitionnavigationkeys_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_transitionnavigationkeys_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_zoomonrollwithintellimouse","displayName":"Zoom on roll with IntelliMouse (User)","description":"This policy setting sets the \"Zoom on roll with IntelliMouse'\" option found under File tab | Options | Advanced | Editing options\r\n\r\nIf you enable this policy setting, rolling the mouse wheel will change the zoom level of the worksheet.\r\n\r\nIf you disable or do not configure this policy setting, rolling the mouse wheel will scroll the worksheet. This is the default behavior.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_zoomonrollwithintellimouse_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced_l_zoomonrollwithintellimouse_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced~l_weboptions~l_general_l_loadpicturesfromwebpagesnotcreatedinexcel","displayName":"Load pictures from Web pages not created in Excel (User)","description":"This policy setting controls whether Excel loads graphics when opening Web pages that were not created in Excel. It configures the \"Load pictures from Web pages not created in Excel\" option under the File tab | Options | Advanced | General | Web Options... | General tab.\r\n \r\nIf you enable or do not configure this policy setting, Excel loads any graphics that are included in the pages, regardless of whether they were originally created in Excel.\r\n \r\nIf you disable this policy setting, Excel will not load any pictures from Web pages that were not created in Excel.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced~l_weboptions~l_general_l_loadpicturesfromwebpagesnotcreatedinexcel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_advanced~l_weboptions~l_general_l_loadpicturesfromwebpagesnotcreatedinexcel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_formulas_l_r1c1referencestyle","displayName":"R1C1 reference style (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_formulas_l_r1c1referencestyle_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_formulas_l_r1c1referencestyle_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionscustomizeribbon_l_displaydevelopertab","displayName":"Display Developer tab in the Ribbon (User)","description":"This policy setting controls whether the Developer tab will be displayed in the Ribbon.\r\n\r\nIf you enable this policy setting, the Developer tab will be displayed in the Ribbon.\r\n\r\nIf you disable this policy setting, the Developer tab will not be displayed in the Ribbon.\r\n\r\nIf you do not configure this policy setting, the Developer tab will not be displayed in the Ribbon, but its visibility can be changed via a setting in the application Options dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionscustomizeribbon_l_displaydevelopertab_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionscustomizeribbon_l_displaydevelopertab_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_allowquickanalysis","displayName":"Show Quick Analysis options on selection (User)","description":"This policy setting controls the \"Show Quick Analysis options on selection\" option found under File tab | Options | General | User Interface Options.\r\n\r\nIf you enable or do not configure this policy setting, Excel will show Quick Analysis options when data is selected. This is the default behavior.\r\n\r\nIf you disable this policy setting, Excel will not show these options on selection.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_allowquickanalysis_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_allowquickanalysis_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_allowselectionfloaties","displayName":"Show Mini Toolbar on selection (User)","description":"Disabling this policy setting will result in Mini Toolbar not being displayed on text selection. By default, Mini Toolbar on selection is enabled and its visibility can be changed via a setting in the Excel Options dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_allowselectionfloaties_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_allowselectionfloaties_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_defaultsheets","displayName":"Default Sheets (User)","description":"Specifies the initial number of worksheets to create in a new workbook.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_defaultsheets_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_defaultsheets_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_defaultsheets_l_sheetsinnewworkbook","displayName":"Sheets in new workbook (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_disablelivepreview","displayName":"Enable Live Preview (User)","description":"Shows or hides the Live Previews that appear when using Galleries that support previews. Live Preview shows how a command would be applied without actually applying it to the document.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_disablelivepreview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_disablelivepreview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_font","displayName":"Font (User)","description":"Specifies the \"Standard font\" font name and size.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_font_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_font_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_font_l_namesize","displayName":"Name, Size (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_windowsintaskbar","displayName":"Show all windows in the Taskbar (User)","description":"When multiple workbooks are open simultaneously, this determines whether the user will see a single entry for Excel in the taskbar or a separate entry in the taskbar for each open workbook.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_windowsintaskbar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_optionsgeneral_l_windowsintaskbar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_proofing~l_autocorrectoptions_l_includenewrowsandcolumnsinlist","displayName":"Include new rows and columns in table (User)","description":"When working in cells adjacent to a table (known as a \"list\" in previous versions of Excel), enabling this setting causes the adjacent row or column to become part of the table.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_proofing~l_autocorrectoptions_l_includenewrowsandcolumnsinlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_proofing~l_autocorrectoptions_l_includenewrowsandcolumnsinlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_proofing~l_autocorrectoptions_l_internetandnetworkpathsashyperlinks","displayName":"Internet and network paths as hyperlinks (User)","description":"This policy setting determines whether Excel automatically creates hyperlinks when users enter URL or UNC path information.\r\n \r\nIf you enable this policy setting, when users type a string of characters that Excel recognizes as a Uniform Resource Locator (URL) or Uniform Naming Convention (UNC) path to a resource on the Internet or a local network, Excel will automatically transform it into a hyperlink. Clicking the hyperlink opens it in the configured default Web browser or the appropriate application.\r\n \r\nIf you disable this policy setting, Excel will not transform URLs and UNC paths to hyperlinks.\r\n \r\nIf you do not configure this policy setting, Excel will automatically transform URLs and UNC paths to hyperlinks and users can change the behavior by selecting or deselecting the \"Internet and network paths as hyperlinks\" check box under File tab | Help | Options | Proofing | AutoCorrect Options... | AutoFormat as You Type tab | Replace as you type.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_proofing~l_autocorrectoptions_l_internetandnetworkpathsashyperlinks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_proofing~l_autocorrectoptions_l_internetandnetworkpathsashyperlinks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_autorecoverdelay","displayName":"AutoRecover delay (User)","description":"This policy specifies how long (in seconds) the user must be idle before AutoRecover information will be saved.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_autorecoverdelay_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_autorecoverdelay_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_autorecoverdelay_l_secondsofidletimebeforeautorecoverstarts","displayName":"Seconds of idle time before AutoRecover starts (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_autorecoversavelocation","displayName":"AutoRecover save location (User)","description":"This policy setting allows you to specify the location where AutoRecover information is to be saved. Directing the location to a network drive may allow you to back up these files along with other network files.\r\n\r\nIf you enable this policy setting, you may specify the location where AutoRecover information is to be saved.\r\n\r\nIf you disable or you do not configure this policy setting, the default location is %userprofile%\\Application Data\\Microsoft\\Excel.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_autorecoversavelocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_autorecoversavelocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_autorecoversavelocation_l_autorecoversavelocation2","displayName":"AutoRecover save location (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_autorecovertime","displayName":"AutoRecover time (User)","description":"This policy determines the interval (in minutes) at which AutoRecover information will be saved.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_autorecovertime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_autorecovertime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_autorecovertime_l_saveautorecoverinfoevery","displayName":"Save AutoRecover info every (minutes): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_defaultfilelocation","displayName":"Default file location (User)","description":"This policy setting allows you to specify the folder that Excel uses when opening or saving a file. This setting can be found under File tab | Options | Save | Save workbook Options.\r\n\r\nIf you enable this policy setting, you may specify this folder.\r\n\r\nIf you disable or do not configure this policy setting, the default folder will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_defaultfilelocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_defaultfilelocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_defaultfilelocation_l_defaultfilelocation0","displayName":"Default file location (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_disableautorepublish","displayName":"Disable AutoRepublish (User)","description":"This policy setting allows administrators to disable the AutoRepublish feature in Excel. If users choose to publish Excel data to a static Web page and enable the AutoRepublish feature, Excel saves a copy of the data to the Web page every time the user saves the workbook. By default, a message dialog displays every time the user saves a published workbook when AutoRepublish is enabled. From this dialog, the user can disable AutoRepublish temporarily or permanently, or select \"Do not show this message again\" to prevent the dialog from appearing after every save. If the user selects \"Do not show this message again\", Excel will continue to automatically republish the data after every save without informing the user.\r\n \r\n If you enable this policy setting, the AutoRepublish feature is turned off and Excel users will need to publish data to the Web manually.\r\n \r\n If you disable or do not configure this policy setting, users can enable the AutoRepublish feature to automatically republish workbooks saved as type Web Page.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_disableautorepublish_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_disableautorepublish_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_donotshowautorepublishwarningalert","displayName":"Do not show AutoRepublish warning alert (User)","description":"This policy setting controls whether Excel displays an alert before republishing a workbook to the World Wide Web.\r\n\r\nIf you enable this policy setting, no warning appears when the user saves a published workbook when AutoRepublish is enabled.\r\n \r\nIf you disable or do not configure this policy setting, a message dialog appears every time the user saves a published workbook when AutoRepublish is enabled. From this dialog, the user can disable AutoRepublish temporarily or permanently, or select \"Do not show this message again\" to prevent the dialog from appearing after every save. If the user selects \"Do not show this message again\", Excel will continue to automatically republish the data after every save without informing the user.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_donotshowautorepublishwarningalert_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_donotshowautorepublishwarningalert_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_keeplastautosavedversions","displayName":"Keep the last AutoSaved versions of files for the next session (User)","description":"This policy setting determines whether Excel keeps the last AutoSaved version of a file if a user closes a file without saving it. (Note: AutoSave applies only when AutoRecover is enabled.)\r\n\r\nIf you enable or do not configure this policy setting, Excel keeps the last AutoSaved version of the file and makes it available to the user the next time the file is opened if the user closes a file without saving it.\r\n\r\nIf you disable this policy setting, Excel does not keep the last AutoSaved version of the file if the user closes a file without saving it.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_keeplastautosavedversions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_keeplastautosavedversions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_promptforworkbookproperties","displayName":"Prompt for workbook properties (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_promptforworkbookproperties_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_promptforworkbookproperties_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_saveautorecoverinfo","displayName":"Save AutoRecover info (User)","description":"Enabling this policy selects the user option to \"Save AutoRecover information every N minutes\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_saveautorecoverinfo_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_saveautorecoverinfo_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_saveexcelfilesas","displayName":"Default file format (User)","description":"This policy setting controls the default file format for saving workbooks in Excel.\r\n\r\nIf you enable this policy setting, you can set the default file format for Excel from among the following options:\r\n\r\n- Excel Workbook (.xlsx).This option is the default configuration in Excel 2016.\r\n- Excel Macro-Enabled Workbook (.xlsm)\r\n- Excel Binary Workbook (.xlsb)\r\n- Web Page (.htm; .html)\r\n- Excel 97-2003 Workbook (.xls)\r\n- Excel 5.0/95 Workbook (.xls)\r\n- OpenDocument Spreadsheet (*.ods)\r\n\r\nUsers can choose to save workbooks in a different file format than the default.\r\n\r\nIf you disable or you do not configure this policy setting, Excel saves new workbooks in the Office Open XML format with an .xlsx extension.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_saveexcelfilesas_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_saveexcelfilesas_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_saveexcelfilesas_l_saveexcelfilesas1","displayName":"Save Excel files as (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_saveexcelfilesas_l_saveexcelfilesas1_51","displayName":"Excel Workbook (*.xlsx)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_saveexcelfilesas_l_saveexcelfilesas1_52","displayName":"Excel Macro-Enabled Workbook (*.xlsm)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_saveexcelfilesas_l_saveexcelfilesas1_50","displayName":"Excel Binary Workbook (*.xlsb)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_saveexcelfilesas_l_saveexcelfilesas1_44","displayName":"Web Page (*.htm; *.html)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_saveexcelfilesas_l_saveexcelfilesas1_56","displayName":"Excel 97-2003 Workbook (*.xls)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_saveexcelfilesas_l_saveexcelfilesas1_39","displayName":"Excel 5.0/95 Workbook (*.xls)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_saveexcelfilesas_l_saveexcelfilesas1_60","displayName":"OpenDocument Spreadsheet (*.ods)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_turnofffileformatcompatiblitydialogforods","displayName":"Suppress file format compatibility dialog box for OpenDocument Spreadsheet format (User)","description":"This policy setting allows you to configure the file format compatibility dialog box when saving a file as an OpenDocument Spreadsheet file in Microsoft Excel.\r\n\r\nIf you enable this policy setting, the file format compatibility dialog is not displayed whenever you save as an OpenDocument Spreadsheet file in Excel.\r\n\r\nIf you disable or do not configure this policy setting, the file format compatibility dialog is displayed when you save as an OpenDocument Spreadsheet file in Excel.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_turnofffileformatcompatiblitydialogforods_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_save_l_turnofffileformatcompatiblitydialogforods_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_determinewhethertoforceencryptedexcel","displayName":"Scan encrypted macros in Excel Open XML workbooks (User)","description":"This policy setting controls whether encrypted macros in Open XML workbooks be are required to be scanned with anti-virus software before being opened.\r\n\r\nIf you enable this policy setting, you may choose one of these options:\r\n\r\n- Scan encrypted macros: encrypted macros are disabled unless anti-virus software is installed. Encrypted macros are scanned by your anti-virus software when you attempt to open an encrypted workbook that contains macros.\r\n- Scan if anti-virus software available: if anti-virus software is installed, scan the encrypted macros first before allowing them to load. If anti-virus software is not available, allow encrypted macros to load.\r\n- Load macros without scanning: do not check for anti-virus software and allow macros to be loaded in an encrypted file.\r\n\r\nIf you disable or do not configure this policy setting, the behavior will be similar to the \"Scan encrypted macros\" option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_determinewhethertoforceencryptedexcel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_determinewhethertoforceencryptedexcel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_determinewhethertoforceencryptedexcel_l_determinewhethertoforceencryptedexceldropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_determinewhethertoforceencryptedexcel_l_determinewhethertoforceencryptedexceldropid_0","displayName":"Scan encrypted macros (default)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_determinewhethertoforceencryptedexcel_l_determinewhethertoforceencryptedexceldropid_1","displayName":"Scan if anti-virus software available","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_determinewhethertoforceencryptedexcel_l_determinewhethertoforceencryptedexceldropid_2","displayName":"Load macros without scanning","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_forcefileextenstionstomatch","displayName":"Force file extension to match file type (User)","description":"This policy setting controls how Excel loads file types that do not match their extension. Excel can load files with extensions that do not match the files' type. For example, if a comma-separated values (CSV) file named example.csv is renamed example.xls (or any other file extension supported by Excel 2003 and earlier only), Excel can properly load it as a CSV file.\r\n\r\nIf you enable this policy setting, you can choose from three options for working with files that have non-matching extensions:\r\n\r\n- Allow different - Excel opens the files properly without warning users that the files have non-matching extensions. If users subsequently edit and save the files, Excel preserves both the true, underlying file format and the incorrect file extension.\r\n\r\n- Allow different, but warn - Excel opens the files properly, but warns users about the file type mismatch. This option is the default configuration in Excel.\r\n\r\n- Always match file type - Excel does not open any files that have non-matching extensions.\r\n\r\nIf you disable or do not configure this policy setting, if users attempt to open files with the wrong extension, Excel opens the file and displays a warning that the file type is not what Excel expected.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_forcefileextenstionstomatch_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_forcefileextenstionstomatch_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_forcefileextenstionstomatch_l_empty","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_forcefileextenstionstomatch_l_empty_0","displayName":"Allow different","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_forcefileextenstionstomatch_l_empty_1","displayName":"Allow different, but warn","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_forcefileextenstionstomatch_l_empty_2","displayName":"Always match file type","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_performfilevalidationonpivotcaches","displayName":"Perform file validation on pivot caches (User)","description":"This policy key configures whether or not pivot caches should go through file validation and get scanned for security problems when documents in Excel 97-2003 format are opened.\r\n\r\nIf you enable this policy setting, you may select one of these options:\r\n\r\n- No file validation: Never perform file validation on pivot caches for all Excel files (not recommended).\r\n- Web and email sources: Perform file validation on pivot caches for documents that come from the web and email, in addition to all documents that trigger pivot caches on load (default).\r\n- Always perform validation: Always perform file validation on pivot caches for all Excel files.\r\n\r\nThis setting can be overridden by the Object Model property Application.FileValidationPivot.\r\n\r\nIf you disable or do not configure this policy setting, the \"Web and email source\" setting will apply.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_performfilevalidationonpivotcaches_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_performfilevalidationonpivotcaches_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_performfilevalidationonpivotcaches_l_performfilevalidationonpivotcachesdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_performfilevalidationonpivotcaches_l_performfilevalidationonpivotcachesdropid_0","displayName":"No file validation","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_performfilevalidationonpivotcaches_l_performfilevalidationonpivotcachesdropid_1","displayName":"Web and email sources","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_performfilevalidationonpivotcaches_l_performfilevalidationonpivotcachesdropid_2","displayName":"Always perform validation","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_turnofffilevalidation","displayName":"Turn off file validation (User)","description":"This policy setting allows you turn off the file validation feature.\r\n\r\nIf you enable this policy setting, file validation will be turned off.\r\n\r\nIf you disable or do not configure this policy setting, file validation will be turned on. Office Binary Documents (97-2003) are checked to see if they conform against the file format schema before they are opened.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_turnofffilevalidation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_turnofffilevalidation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_webcontentwarninglevel","displayName":"WEBSERVICE Function Notification Settings (User)","description":"This policy setting controls how Excel will warn users when WEBSERVICE functions are present.\r\n\r\nIf you enable this policy setting, you can choose from three options for determining how the specified applications will warn the user about WEBSERVICE functions:\r\n\r\n- Disable all with notification: The application displays the Trust Bar for all WEBSERVICE functions. This option enforces the default configuration in Office.\r\n- Disable all without notification: The application disables all WEBSERVICE functions and does not notify users.\r\n- Enable all WEBSERVICE functions (not recommended): The application enables all WEBSERVICE functions and does not notify users. This option can significantly reduce security by allowing information disclosure to third party web services.\r\n\r\nIf you disable this policy setting, the “Disable all with notification” will be the default setting.\r\nIf you do not configure this policy setting, when users open workbooks that contain WEBSERVICE functions, Excel will open the files with the WEBSERVICE functions disabled and display the Trust Bar with a warning that WEBSERVICE functions are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking \"Enable Content\" on the Trust Bar. If the user clicks \"Enable Content,\" then the document is added as a trusted document.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_webcontentwarninglevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_webcontentwarninglevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_webcontentwarninglevel_l_webcontentwarninglevelvalue","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_webcontentwarninglevel_l_webcontentwarninglevelvalue_0","displayName":"Enable all WEBSERVICE functions (not recommended)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_webcontentwarninglevel_l_webcontentwarninglevelvalue_1","displayName":"Disable all with notification","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security_l_webcontentwarninglevel_l_webcontentwarninglevelvalue_2","displayName":"Disable all without notification","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_configurecngcipherchainingmode","displayName":"Configure CNG cipher chaining mode (User)","description":"This policy setting allows you to configure the cipher chaining mode used.\r\n\r\nIf you enable this policy setting, the cipher chaining mode specified will be applied.\r\n\r\nIf you disable or do not configure this policy setting, Cipher Block Chaining (CBC) will be the default CNG cipher chaining mode used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_configurecngcipherchainingmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_configurecngcipherchainingmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_configurecngcipherchainingmode_l_configurecngcipherchainingmodedropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_configurecngcipherchainingmode_l_configurecngcipherchainingmodedropid_chainingmodecbc","displayName":"Cipher Block Chaining (CBC)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_configurecngcipherchainingmode_l_configurecngcipherchainingmodedropid_chainingmodecfb","displayName":"Cipher Feedback (CFB)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_setcngcipheralgorithm","displayName":"Set CNG cipher algorithm (User)","description":"This policy setting allows you to configure the CNG cipher algorithm that is used.\r\n\r\nIf you enable this policy setting, then the cipher provided will be used if it is a supported algorithm.\r\n\r\nIf you disable or do not configure this policy setting, AES will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_setcngcipheralgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_setcngcipheralgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_setcngcipheralgorithm_l_setcngcipheralgorithmid","displayName":"CNG cipher algorithm: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_setcngcipherkeylength","displayName":"Set CNG cipher key length (User)","description":"This policy setting allows you to configure the number of bits to use when creating the cipher key. This number will be rounded down to a multiple of 8.\r\n\r\nIf you enable this policy setting, the key bits specified will be used.\r\n\r\nIf you disable or do not configure this policy setting, the default value will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_setcngcipherkeylength_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_setcngcipherkeylength_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_setcngcipherkeylength_l_setcngcipherkeylengthspinid","displayName":"Cipher key length (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_setcngpasswordspincount","displayName":"Set CNG password spin count (User)","description":"This policy setting allows you to specify the number of times to spin (rehash) the password verifier.\r\n\r\nIf you enable this policy setting, the number specified will be the number of times the password will be rehashed.\r\n\r\nIf you disable or do not configure this policy setting, the default (100000) will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_setcngpasswordspincount_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_setcngpasswordspincount_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_setcngpasswordspincount_l_setcngpasswordspincountspinid","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_setparametersforcngcontext","displayName":"Set parameters for CNG context (User)","description":"This policy setting allows you to specify the encryption parameters that should be used for the CNG context. \r\n\r\nIf you enable this policy setting, the parameters specified will be passed to the CNG context.\r\n\r\nIf you disable or do not configure this policy setting, the default CNG values will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_setparametersforcngcontext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_setparametersforcngcontext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_setparametersforcngcontext_l_setparametersforcngcontextid","displayName":"Parameters (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifycnghashalgorithm","displayName":"Specify CNG hash algorithm (User)","description":"This policy setting allows you to specify the hash algorithm used.\r\n\r\nIf you enable this policy setting, the hashing algorithm selected will be used by CNG.\r\n\r\nIf you disable or do not configure this policy setting, the default CNG hash algorithm will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifycnghashalgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifycnghashalgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha1","displayName":"SHA1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha256","displayName":"SHA256","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha384","displayName":"SHA384","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha512","displayName":"SHA512","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm","displayName":"Specify CNG random number generator algorithm (User)","description":"This policy setting allows you to configure the CNG random number generator to use.\r\n\r\nIf you enable this policy setting, the random number generator specified will be used.\r\n\r\nIf you disable or do not configure this policy setting, the default random number generator will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm_l_specifycngrandomnumbergeneratoralgorithmid","displayName":"Random number generator: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifycngsaltlength","displayName":"Specify CNG salt length (User)","description":"This policy setting allows you to specific the number of bytes of salt that should be used.\r\n\r\nIf you enable this policy setting, the bytes specified will be used.\r\n\r\nIf you disable or do not configure this policy setting, the default length or 16 will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifycngsaltlength_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifycngsaltlength_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifycngsaltlength_l_specifycngsaltlengthspinid","displayName":"Number of bytes (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifyencryptioncompatibility","displayName":"Specify encryption compatibility (User)","description":"This policy setting allows you to specify the encrypted database compatibility.\r\n\r\nIf you enable this policy setting, the compatibility format specified will be applied during encryption for new files\r\n- Use legacy format\r\n- Use next generation format\r\n- All files save with next generation format\r\n\r\nIf you disable or do not configure this policy setting, the default setting, \"Use next generation format,\" will be applied.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifyencryptioncompatibility_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifyencryptioncompatibility_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifyencryptioncompatibility_l_specifyencryptioncompatibilitydropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifyencryptioncompatibility_l_specifyencryptioncompatibilitydropid_0","displayName":"Use legacy format","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifyencryptioncompatibility_l_specifyencryptioncompatibilitydropid_1","displayName":"Use next generation format","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_specifyencryptioncompatibility_l_specifyencryptioncompatibilitydropid_2","displayName":"All files save with next generation format","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_usenewkeyonpasswordchange","displayName":"Use new key on password change (User)","description":"This policy setting allows you to specify if a new encryption key is used when the password is changed.\r\n\r\nIf you enable or do not configure this policy setting, a new intermediate key is generated when the password is changed. This causes any extra key encryptors to be removed when the file is saved.\r\n\r\nIf you disable this policy setting, a new intermediate key is not generated when the password is changed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_usenewkeyonpasswordchange_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_cryptography_l_usenewkeyonpasswordchange_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_blockmacroexecutionfrominternet","displayName":"Block macros from running in Office files from the Internet (User)","description":"\r\n This policy setting allows you to block macros from running in Office files that come from the Internet.\r\n\r\n If you enable this policy setting, macros are blocked from running, even if “Enable all macros” is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to “Enable Content,” users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run.\r\n\r\n If you disable or don’t configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_blockmacroexecutionfrominternet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_blockmacroexecutionfrominternet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_disableallapplicationextensions","displayName":"Disable all application add-ins (User)","description":"This policy setting disables all add-ins for the specified Office 2016 applications.\r\n \r\nIf you enable this policy setting, all add-ins for the specified Office 2016 applications are disabled.\r\n\r\nIf you disable or do not configure this policy setting, all add-ins for the specified Office 2016 applications are allowed to run without notifying the users, except if application add-ins are required to be signed by Trusted Publishers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_disableallapplicationextensions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_disableallapplicationextensions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned","displayName":"Disable Trust Bar Notification for unsigned application add-ins and block them (User) (Deprecated)","description":"This policy setting controls whether the specified Office 2016 applications notify users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the ''Require that application add-ins are signed by Trusted Publisher'' policy setting, which prevents users from changing this policy setting. \r\nIf you enable this policy setting, applications automatically disable unsigned add-ins without informing users.\r\n \r\nIf you disable this policy setting, if an application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.\r\n\r\nIf you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the ''Add-ins'' category of the Trust Center for the application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_v2","displayName":"Disable Trust Bar Notification for unsigned application add-ins and block them (User)","description":"This policy setting controls whether the specified Office 2016 applications notify users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the ''Require that application add-ins are signed by Trusted Publisher'' policy setting, which prevents users from changing this policy setting. \r\nIf you enable this policy setting, applications automatically disable unsigned add-ins without informing users.\r\n \r\nIf you disable this policy setting, if an application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.\r\n\r\nIf you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the ''Add-ins'' category of the Trust Center for the application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_requirethatapplicationextensionsaresigned","displayName":"Require that application add-ins are signed by Trusted Publisher (User)","description":"This policy setting controls whether add-ins for the specified Office 2016 applications must be digitally signed by a trusted publisher.\r\n \r\nIf you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2016 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Office 2016 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2016, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.\r\n\r\nIf you disable or do not configure this policy setting, Office 2016 applications do not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_requirethatapplicationextensionsaresigned_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_requirethatapplicationextensionsaresigned_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_setmaximumnumberoftrusteddocuments","displayName":"Set maximum number of trusted documents (User)","description":"This policy setting allows you to specify the maximum number of trust records for trusted documents that can be stored in the registry before the purge task runs. The purge task reduces the number of trusted documents stored in the registry to the value set by the \"Set maximum number of trust records to preserve\" policy setting.\r\n\r\nIf you enable this policy setting, you can specify the maximum number of trusted documents to be stored in the registry before the purge task runs, with an upper limit of 20,000 documents. For performance reasons, we do not recommend setting this policy setting to the upper limit.\r\n\r\nIf you disable or do not configure this policy setting, the default value of 500 is used for the maximum number of trusted documents that can be stored in the registry before the purge task runs.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_setmaximumnumberoftrusteddocuments_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_setmaximumnumberoftrusteddocuments_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_setmaximumnumberoftrusteddocuments_l_setmaximumnumberoftrusteddocumentsspinid","displayName":"Maximum number: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_setmaximumnumberoftrustrecordstopreserve","displayName":"Set maximum number of trust records to preserve (User)","description":"This policy setting allows you to specify the maximum number of trust records to preserve when the purge task detects that this application has trusted more than the number of trusted documents set by the \"Set maximum number of trusted documents\" policy setting.\r\n\r\nIf you enable this policy setting, you may specify the maximum number of trust records to preserve, with an upper limit of 20000. Due to performance reasons, it is not recommended to set it to the upper limit.\r\n\r\nIf you disable or you do not configure this policy setting, the default value for of 400 is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_setmaximumnumberoftrustrecordstopreserve_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_setmaximumnumberoftrustrecordstopreserve_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_setmaximumnumberoftrustrecordstopreserve_l_setmaximumnumberoftrustrecordstopreservespinid","displayName":"Maximum to preserve: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_storemacroinpersonalmacroworkbookbydefault","displayName":"Store macro in Personal Macro Workbook by default (User)","description":"This policy setting controls the default location for storing macros in Excel.\r\n \r\n If this policy setting is enabled, Excel stores macros in users' personal macro workbook.\r\n \r\n If you disable or do not configure this policy setting, Excel stores macros in the active workbook from which they are created.\r\n \r\n Note: In the user interface (UI), the \"Store macro in\" drop down list box in the Record Macro dialog box (Macros | Record Macro) allows users to choose whether to store the new macro in the current workbook, a new workbook, or their personal macro workbook (Personal.xlsb), a hidden workbook that opens every time Excel starts.\r\n \r\n By default, Excel displays the \"Store macro in\" box with \"This Workbook\" already selected in the drop-down list. If a user saves a macro in the active workbook and then distributes the workbook to others, the macro is distributed along with the workbook. If you enable this policy setting, Excel displays the \"Store macro in\" box with \"Personal Macro Workbook\" already selected. Users can still select one of the other two options in the drop-down menu.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_storemacroinpersonalmacroworkbookbydefault_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_storemacroinpersonalmacroworkbookbydefault_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_trustaccesstovisualbasicproject","displayName":"Trust access to Visual Basic Project (User)","description":"This policy setting controls whether automation clients such as Microsoft Visual Studio 2005 Tools for Microsoft Office (VSTO) can access the Visual Basic for Applications project system in the specified applications. VSTO projects require access to the Visual Basic for Applications project system in Excel, PowerPoint, and Word, even though the projects do not use Visual Basic for Applications. Design-time support of controls in both Visual Basic and C# projects depends on the Visual Basic for Applications project system in Word and Excel.\r\n\r\nIf you enable this policy setting, VSTO and other automation clients can access the Visual Basic for Applications project system in the specified applications. Users will not be able to change this behavior through the \"Trust access to the VBA project object model\" user interface option under the Macro Settings section of the Trust Center.\r\n\r\nIf you disable this policy setting, VSTO does not have programmatic access to VBA projects. In addition, the \"Trust access to the VBA project object model\" check box is cleared and users cannot change it. Note: Disabling this policy setting prevents VSTO projects from interacting properly with the VBA project system in the selected application.\r\n\r\nIf you do not configure this policy setting, automation clients do not have programmatic access to VBA projects. Users can enable this by selecting the \"Trust access to the VBA project object model\" in the \"Macro Settings\" section of the Trust Center. However, doing so allows macros in any documents the user opens to access the core Visual Basic objects, methods, and properties, which represents a potential security hazard.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_trustaccesstovisualbasicproject_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_trustaccesstovisualbasicproject_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_turnofftrusteddocuments","displayName":"Turn off trusted documents (User)","description":"This policy setting allows you to turn off the trusted documents feature. The trusted documents feature allows users to always enable active content in documents such as macros, ActiveX controls, data connections, etc. so that they are not prompted the next time they open the documents. Trusted documents are exempt from security notifications.\r\n\r\nIf you enable this policy setting, you will turn off the trusted documents feature. Users will receive a security prompt every time a document containing active content is opened.\r\n\r\nIf you disable or do not configure this policy setting, documents will be trusted when users enable content for a document, and users will not receive a security prompt.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_turnofftrusteddocuments_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_turnofftrusteddocuments_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_turnofftrusteddocumentsonthenetwork","displayName":"Turn off Trusted Documents on the network (User)","description":"This policy setting allows you to turn off the trusted documents feature for documents opened from the network.\r\n\r\nIf you enable this policy setting, users will always see security notifications for active content such as macros, ActiveX controls, data connections, etc. for documents opened from the network.\r\n\r\nIf you disable or do not configure this policy setting, the trusted documents feature allows users to always allow active content in documents such as macros, ActiveX controls, data connections, etc. so that users are not prompted the next time they open the documents. Trusted documents are exempt from security notifications.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_turnofftrusteddocumentsonthenetwork_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_turnofftrusteddocumentsonthenetwork_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_vbawarningspolicy","displayName":"VBA Macro Notification Settings (User)","description":"This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.\r\n\r\nIf you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:\r\n \r\n- Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.\r\n \r\n- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.\r\n \r\n- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.\r\n \r\n- Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.\r\n \r\nIf you disable this policy setting, \"Disable all with notification\" will be the default setting.\r\n \r\nIf you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking \"Enable Content\" on the Trust Bar. If the user clicks \"Enable Content\", then the document is added as a trusted document.\r\n \r\nImportant: If \"Disable all except digitally signed macros\" is selected, users will not be able to open unsigned Access databases.\r\n \r\nAlso, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.\r\n \r\nTherefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_vbawarningspolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_vbawarningspolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty4","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty4_2","displayName":"Disable all with notification","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty4_3","displayName":"Disable all except digitally signed macros","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty4_4","displayName":"Disable all without notification","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty4_1","displayName":"Enable all macros (not recommended)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_dbaseiiiandivfiles","displayName":"dBase III / IV files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_dbaseiiiandivfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_dbaseiiiandivfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_dbaseiiiandivfiles_l_dbaseiiiandivfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_dbaseiiiandivfiles_l_dbaseiiiandivfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_dbaseiiiandivfiles_l_dbaseiiiandivfilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_difandsylkfiles","displayName":"Dif and Sylk files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_difandsylkfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_difandsylkfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_difandsylkfiles_l_difandsylkfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_difandsylkfiles_l_difandsylkfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_difandsylkfiles_l_difandsylkfilesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_difandsylkfiles_l_difandsylkfilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlateraddinfiles","displayName":"Excel 2007 and later add-in files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlateraddinfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlateraddinfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlateraddinfiles_l_excel2007andlateraddinfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlateraddinfiles_l_excel2007andlateraddinfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlateraddinfiles_l_excel2007andlateraddinfilesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlateraddinfiles_l_excel2007andlateraddinfilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterbinaryworkbooks","displayName":"Excel 2007 and later binary workbooks (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterbinaryworkbooks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterbinaryworkbooks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterbinaryworkbooks_l_excel2007andlaterbinaryworkbooksdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterbinaryworkbooks_l_excel2007andlaterbinaryworkbooksdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterbinaryworkbooks_l_excel2007andlaterbinaryworkbooksdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterbinaryworkbooks_l_excel2007andlaterbinaryworkbooksdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterbinaryworkbooks_l_excel2007andlaterbinaryworkbooksdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterbinaryworkbooks_l_excel2007andlaterbinaryworkbooksdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterbinaryworkbooks_l_excel2007andlaterbinaryworkbooksdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlatermacroenabledworkbooksandtemplates","displayName":"Excel 2007 and later macro-enabled workbooks and templates (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlatermacroenabledworkbooksandtemplates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlatermacroenabledworkbooksandtemplates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlatermacroenabledworkbooksandtemplates_l_excel2007andlatermacroenabledworkbooksandtemplatesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlatermacroenabledworkbooksandtemplates_l_excel2007andlatermacroenabledworkbooksandtemplatesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlatermacroenabledworkbooksandtemplates_l_excel2007andlatermacroenabledworkbooksandtemplatesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlatermacroenabledworkbooksandtemplates_l_excel2007andlatermacroenabledworkbooksandtemplatesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlatermacroenabledworkbooksandtemplates_l_excel2007andlatermacroenabledworkbooksandtemplatesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlatermacroenabledworkbooksandtemplates_l_excel2007andlatermacroenabledworkbooksandtemplatesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlatermacroenabledworkbooksandtemplates_l_excel2007andlatermacroenabledworkbooksandtemplatesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterworkbooksandtemplates","displayName":"Excel 2007 and later workbooks and templates (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterworkbooksandtemplates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterworkbooksandtemplates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterworkbooksandtemplates_l_excel2007andlaterworkbooksandtemplatesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterworkbooksandtemplates_l_excel2007andlaterworkbooksandtemplatesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterworkbooksandtemplates_l_excel2007andlaterworkbooksandtemplatesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterworkbooksandtemplates_l_excel2007andlaterworkbooksandtemplatesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterworkbooksandtemplates_l_excel2007andlaterworkbooksandtemplatesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterworkbooksandtemplates_l_excel2007andlaterworkbooksandtemplatesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2007andlaterworkbooksandtemplates_l_excel2007andlaterworkbooksandtemplatesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2macrosheetsandaddinfiles","displayName":"Excel 2 macrosheets and add-in files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2macrosheetsandaddinfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2macrosheetsandaddinfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2macrosheetsandaddinfiles_l_excel2macrosheetsandaddinfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2macrosheetsandaddinfiles_l_excel2macrosheetsandaddinfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2macrosheetsandaddinfiles_l_excel2macrosheetsandaddinfilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2macrosheetsandaddinfiles_l_excel2macrosheetsandaddinfilesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2macrosheetsandaddinfiles_l_excel2macrosheetsandaddinfilesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2macrosheetsandaddinfiles_l_excel2macrosheetsandaddinfilesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2worksheets","displayName":"Excel 2 worksheets (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2worksheets_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2worksheets_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2worksheets_l_excel2worksheetsdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2worksheets_l_excel2worksheetsdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2worksheets_l_excel2worksheetsdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2worksheets_l_excel2worksheetsdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2worksheets_l_excel2worksheetsdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel2worksheets_l_excel2worksheetsdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel3macrosheetsandaddinfiles","displayName":"Excel 3 macrosheets and add-in files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel3macrosheetsandaddinfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel3macrosheetsandaddinfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel3macrosheetsandaddinfiles_l_excel3macrosheetsandaddinfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel3macrosheetsandaddinfiles_l_excel3macrosheetsandaddinfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel3macrosheetsandaddinfiles_l_excel3macrosheetsandaddinfilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel3macrosheetsandaddinfiles_l_excel3macrosheetsandaddinfilesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel3macrosheetsandaddinfiles_l_excel3macrosheetsandaddinfilesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel3macrosheetsandaddinfiles_l_excel3macrosheetsandaddinfilesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel3worksheets","displayName":"Excel 3 worksheets (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel3worksheets_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel3worksheets_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel3worksheets_l_excel3worksheetsdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel3worksheets_l_excel3worksheetsdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel3worksheets_l_excel3worksheetsdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel3worksheets_l_excel3worksheetsdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel3worksheets_l_excel3worksheetsdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel3worksheets_l_excel3worksheetsdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4macrosheetsandaddinfiles","displayName":"Excel 4 macrosheets and add-in files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4macrosheetsandaddinfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4macrosheetsandaddinfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4macrosheetsandaddinfiles_l_excel4macrosheetsandaddinfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4macrosheetsandaddinfiles_l_excel4macrosheetsandaddinfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4macrosheetsandaddinfiles_l_excel4macrosheetsandaddinfilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4macrosheetsandaddinfiles_l_excel4macrosheetsandaddinfilesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4macrosheetsandaddinfiles_l_excel4macrosheetsandaddinfilesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4macrosheetsandaddinfiles_l_excel4macrosheetsandaddinfilesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4workbooks","displayName":"Excel 4 workbooks (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4workbooks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4workbooks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4workbooks_l_excel4workbooksdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4workbooks_l_excel4workbooksdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4workbooks_l_excel4workbooksdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4workbooks_l_excel4workbooksdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4workbooks_l_excel4workbooksdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4workbooks_l_excel4workbooksdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4worksheets","displayName":"Excel 4 worksheets (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4worksheets_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4worksheets_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4worksheets_l_excel4worksheetsdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4worksheets_l_excel4worksheetsdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4worksheets_l_excel4worksheetsdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4worksheets_l_excel4worksheetsdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4worksheets_l_excel4worksheetsdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel4worksheets_l_excel4worksheetsdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel9597workbooksandtemplates","displayName":"Excel 95-97 workbooks and templates (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel9597workbooksandtemplates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel9597workbooksandtemplates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel9597workbooksandtemplates_l_excel9597workbooksandtemplatesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel9597workbooksandtemplates_l_excel9597workbooksandtemplatesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel9597workbooksandtemplates_l_excel9597workbooksandtemplatesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel9597workbooksandtemplates_l_excel9597workbooksandtemplatesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel9597workbooksandtemplates_l_excel9597workbooksandtemplatesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel9597workbooksandtemplates_l_excel9597workbooksandtemplatesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel95workbooks","displayName":"Excel 95 workbooks (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel95workbooks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel95workbooks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel95workbooks_l_excel95workbooksdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel95workbooks_l_excel95workbooksdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel95workbooks_l_excel95workbooksdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel95workbooks_l_excel95workbooksdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel95workbooks_l_excel95workbooksdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel95workbooks_l_excel95workbooksdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel95workbooks_l_excel95workbooksdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel972003addinfiles","displayName":"Excel 97-2003 add-in files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel972003addinfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel972003addinfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel972003addinfiles_l_excel972003addinfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel972003addinfiles_l_excel972003addinfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel972003addinfiles_l_excel972003addinfilesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel972003addinfiles_l_excel972003addinfilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel972003workbooksandtemplates","displayName":"Excel 97-2003 workbooks and templates (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel972003workbooksandtemplates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel972003workbooksandtemplates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel972003workbooksandtemplates_l_excel972003workbooksandtemplatesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel972003workbooksandtemplates_l_excel972003workbooksandtemplatesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel972003workbooksandtemplates_l_excel972003workbooksandtemplatesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel972003workbooksandtemplates_l_excel972003workbooksandtemplatesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel972003workbooksandtemplates_l_excel972003workbooksandtemplatesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel972003workbooksandtemplates_l_excel972003workbooksandtemplatesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excel972003workbooksandtemplates_l_excel972003workbooksandtemplatesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_exceladdinfiles","displayName":"Excel add-in files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_exceladdinfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_exceladdinfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_exceladdinfiles_l_exceladdinfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_exceladdinfiles_l_exceladdinfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_exceladdinfiles_l_exceladdinfilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforexcel","displayName":"Legacy converters for Excel (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforexcel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforexcel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforexcel_l_legacyconvertersforexceldropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforexcel_l_legacyconvertersforexceldropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforexcel_l_legacyconvertersforexceldropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforexcel_l_legacyconvertersforexceldropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforexcel_l_legacyconvertersforexceldropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforexcel_l_legacyconvertersforexceldropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforexcel","displayName":"Microsoft Office Open XML converters for Excel (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforexcel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforexcel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforexcel_l_microsoftofficeopenxmlconvertersforexceldropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforexcel_l_microsoftofficeopenxmlconvertersforexceldropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforexcel_l_microsoftofficeopenxmlconvertersforexceldropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforexcel_l_microsoftofficeopenxmlconvertersforexceldropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforexcel_l_microsoftofficeopenxmlconvertersforexceldropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforexcel_l_microsoftofficeopenxmlconvertersforexceldropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforexcel_l_microsoftofficeopenxmlconvertersforexceldropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficequeryfiles","displayName":"Microsoft Office query files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficequeryfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficequeryfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficequeryfiles_l_microsoftofficequeryfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficequeryfiles_l_microsoftofficequeryfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficequeryfiles_l_microsoftofficequeryfilesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficequeryfiles_l_microsoftofficequeryfilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficequeryfiles_l_microsoftofficequeryfilesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficequeryfiles_l_microsoftofficequeryfilesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficequeryfiles_l_microsoftofficequeryfilesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_officedataconnectionfiles","displayName":"Microsoft Office data connection files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_officedataconnectionfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_officedataconnectionfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_officedataconnectionfiles_l_officedataconnectionfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_officedataconnectionfiles_l_officedataconnectionfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_officedataconnectionfiles_l_officedataconnectionfilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_offlinecubefiles","displayName":"Offline cube files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_offlinecubefiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_offlinecubefiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_offlinecubefiles_l_offlinecubefilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_offlinecubefiles_l_offlinecubefilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_offlinecubefiles_l_offlinecubefilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentspreadsheetfiles","displayName":"OpenDocument Spreadsheet files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentspreadsheetfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentspreadsheetfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentspreadsheetfiles_l_opendocumentspreadsheetfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentspreadsheetfiles_l_opendocumentspreadsheetfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentspreadsheetfiles_l_opendocumentspreadsheetfilesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentspreadsheetfiles_l_opendocumentspreadsheetfilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentspreadsheetfiles_l_opendocumentspreadsheetfilesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentspreadsheetfiles_l_opendocumentspreadsheetfilesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentspreadsheetfiles_l_opendocumentspreadsheetfilesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_otherdatasourcefiles","displayName":"Other data source files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_otherdatasourcefiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_otherdatasourcefiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_otherdatasourcefiles_l_otherdatasourcefilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_otherdatasourcefiles_l_otherdatasourcefilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_otherdatasourcefiles_l_otherdatasourcefilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior","displayName":"Set default file block behavior (User)","description":"This policy setting allows you to determine if users can open, view, or edit Excel files.\r\n\r\nIf you enable this policy setting, you can set one of these options:\r\n- Blocked files are not opened\r\n- Blocked files open in Protected View and can not be edited\r\n- Blocked files open in Protected View and can be edited\r\n\r\nIf you disable or do not configure this policy setting, the behavior is the same as the \"Blocked files are not opened\" setting. Users will not be able to open blocked files.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior_l_setdefaultfileblockbehaviordropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior_l_setdefaultfileblockbehaviordropid_0","displayName":"Blocked files are not opened","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior_l_setdefaultfileblockbehaviordropid_1","displayName":"Blocked files open in Protected View and can not be edited","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior_l_setdefaultfileblockbehaviordropid_2","displayName":"Blocked files open in Protected View and can be edited","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_textfiles","displayName":"Text files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_textfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_textfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_textfiles_l_textfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_textfiles_l_textfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_textfiles_l_textfilesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_textfiles_l_textfilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_webpagesandexcel2003xmlspreadsheets","displayName":"Web pages and Excel 2003 XML spreadsheets (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_webpagesandexcel2003xmlspreadsheets_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_webpagesandexcel2003xmlspreadsheets_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_webpagesandexcel2003xmlspreadsheets_l_webpagesandexcel2003xmlspreadsheetsdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_webpagesandexcel2003xmlspreadsheets_l_webpagesandexcel2003xmlspreadsheetsdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_webpagesandexcel2003xmlspreadsheets_l_webpagesandexcel2003xmlspreadsheetsdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_webpagesandexcel2003xmlspreadsheets_l_webpagesandexcel2003xmlspreadsheetsdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_webpagesandexcel2003xmlspreadsheets_l_webpagesandexcel2003xmlspreadsheetsdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_webpagesandexcel2003xmlspreadsheets_l_webpagesandexcel2003xmlspreadsheetsdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_webpagesandexcel2003xmlspreadsheets_l_webpagesandexcel2003xmlspreadsheetsdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_xmlfiles","displayName":"XML files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_xmlfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_xmlfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_xmlfiles_l_xmlfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_xmlfiles_l_xmlfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_xmlfiles_l_xmlfilesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_xmlfiles_l_xmlfilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_donotopenfilesfromtheinternetzoneinprotectedview","displayName":"Do not open files from the Internet zone in Protected View (User)","description":"This policy setting allows you to determine if files downloaded from the Internet zone open in Protected View.\r\n\r\nIf you enable this policy setting, files downloaded from the Internet zone do not open in Protected View.\r\n\r\nIf you disable or do not configure this policy setting, files downloaded from the Internet zone open in Protected View.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_donotopenfilesfromtheinternetzoneinprotectedview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_donotopenfilesfromtheinternetzoneinprotectedview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_donotopenfilesinunsafelocationsinprotectedview","displayName":"Do not open files in unsafe locations in Protected View (User)","description":"This policy setting lets you determine if files located in unsafe locations will open in Protected View. If you have not specified unsafe locations, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders are considered unsafe locations.\r\n\r\nIf you enable this policy setting, files located in unsafe locations do not open in Protected View.\r\n\r\nIf you disable or do not configure this policy setting, files located in unsafe locations open in Protected View.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_donotopenfilesinunsafelocationsinprotectedview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_donotopenfilesinunsafelocationsinprotectedview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_openfilesonlocalintranetuncinprotectedview","displayName":"Open files on local Intranet UNC in Protected View (User)","description":"This policy setting lets you determine if files on local Intranet UNC file shares open in Protected View.\r\n\r\nIf you enable this policy setting, files on local Intranet UNC file shares open in Protected View if their UNC paths appear to be within the Internet zone.\r\n\r\nIf you disable or do not configure this policy setting, files on Intranet UNC file shares do not open in Protected View if their UNC paths appear to be within the Internet zone.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_openfilesonlocalintranetuncinprotectedview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_openfilesonlocalintranetuncinprotectedview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails","displayName":"Set document behavior if file validation fails (User)","description":"This policy setting controls how Office handles documents when they fail file validation. \r\n\r\nIf you enable this policy setting, you can configure the following options for files that fail file validation:\r\n\r\n- Block files completely. Users cannot open the files.\r\n- Open files in Protected View and disallow edit. Users cannot edit the files. This is also how Office handles the files if you disable this policy setting.\r\n- Open files in Protected View and allow edit. Users can edit the files. This is also how Office handles the files if you do not configure this policy setting.\r\n\r\nIf you disable this policy setting, Office follows the \"Open files in Protected View and disallow edit\" behavior.\r\n\r\nIf you do not configure this policy setting, Office follows the \"Open files in Protected View and allow edit\" behavior.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_l_setdocumentbehavioriffilevalidationfailsdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_l_setdocumentbehavioriffilevalidationfailsdropid_0","displayName":"Block files","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_l_setdocumentbehavioriffilevalidationfailsdropid_1","displayName":"Open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_l_setdocumentbehavioriffilevalidationfailsstr3","displayName":"Checked: Allow edit. Unchecked: Do not allow edit. (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_l_setdocumentbehavioriffilevalidationfailsstr3_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_l_setdocumentbehavioriffilevalidationfailsstr3_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_turnoffprotectedviewforattachmentsopenedfromoutlook","displayName":"Turn off Protected View for attachments opened from Outlook (User)","description":"This policy setting allows you to determine if Excel files in Outlook attachments open in Protected View.\r\n\r\nIf you enable this policy setting, Outlook attachments do not open in Protected View.\r\n\r\nIf you disable or do not configure this policy setting, Outlook attachments open in Protected View.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_turnoffprotectedviewforattachmentsopenedfromoutlook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_turnoffprotectedviewforattachmentsopenedfromoutlook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_allowtrustedlocationsonthenetwork","displayName":"Allow Trusted Locations on the network (User)","description":"This policy setting controls whether trusted locations on the network can be used.\r\n\r\nIf you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the \"Add new location\" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.\r\n\r\nIf you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. \r\n\r\nIf you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.\r\n\r\nDisabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center. We recommended that you do not enable this policy setting (as the \"Allow Trusted Locations on my network (not recommended)\" check box also states). Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.\r\n\r\nIf you do not enable this policy setting, users can select the \"Allow Trusted Locations on my network (not recommended)\" check box if desired and then specify trusted locations by clicking the \"Add new location\" button.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_allowtrustedlocationsonthenetwork_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_allowtrustedlocationsonthenetwork_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_disabletrustedloc","displayName":"Disable all trusted locations (User)","description":"This policy setting allows administrators to disable all trusted locations in the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data.\r\n \r\nIf you enable this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are ignored, including any trusted locations established by Office 2016 during setup, deployed to users using Group Policy, or added by users themselves. Users will be prompted again when opening files from trusted locations.\r\n\r\nIf you disable or do not configure this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are assumed to be safe.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_disabletrustedloc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_disabletrustedloc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01","displayName":"Trusted Location #1 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_l_allowsubfolders","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_l_allowsubfolders_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_l_allowsubfolders_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_l_datecolon","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_l_descriptioncolon","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_l_pathcolon","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02","displayName":"Trusted Location #2 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_l_allowsubfolders8","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_l_allowsubfolders8_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_l_allowsubfolders8_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_l_datecolon6","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_l_descriptioncolon7","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_l_pathcolon5","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03","displayName":"Trusted Location #3 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_l_allowsubfolders12","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_l_allowsubfolders12_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_l_allowsubfolders12_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_l_datecolon10","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_l_descriptioncolon11","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_l_pathcolon9","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04","displayName":"Trusted Location #4 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_l_allowsubfolders16","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_l_allowsubfolders16_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_l_allowsubfolders16_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_l_datecolon14","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_l_descriptioncolon15","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_l_pathcolon13","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05","displayName":"Trusted Location #5 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_l_allowsubfolders20","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_l_allowsubfolders20_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_l_allowsubfolders20_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_l_datecolon18","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_l_descriptioncolon19","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_l_pathcolon17","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06","displayName":"Trusted Location #6 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_l_allowsubfolders24","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_l_allowsubfolders24_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_l_allowsubfolders24_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_l_datecolon22","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_l_descriptioncolon23","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_l_pathcolon21","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07","displayName":"Trusted Location #7 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_l_allowsubfolders28","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_l_allowsubfolders28_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_l_allowsubfolders28_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_l_datecolon26","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_l_descriptioncolon27","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_l_pathcolon25","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08","displayName":"Trusted Location #8 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_l_allowsubfolders32","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_l_allowsubfolders32_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_l_allowsubfolders32_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_l_datecolon30","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_l_descriptioncolon31","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_l_pathcolon29","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09","displayName":"Trusted Location #9 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_l_allowsubfolders36","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_l_allowsubfolders36_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_l_allowsubfolders36_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_l_datecolon34","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_l_descriptioncolon35","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_l_pathcolon33","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10","displayName":"Trusted Location #10 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_l_allowsubfolders40","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_l_allowsubfolders40_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_l_allowsubfolders40_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_l_datecolon38","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_l_descriptioncolon39","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_l_pathcolon37","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11","displayName":"Trusted Location #11 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_l_allowsubfolders44","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_l_allowsubfolders44_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_l_allowsubfolders44_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_l_datecolon42","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_l_descriptioncolon43","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_l_pathcolon41","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12","displayName":"Trusted Location #12 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_l_allowsubfolders48","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_l_allowsubfolders48_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_l_allowsubfolders48_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_l_datecolon46","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_l_descriptioncolon47","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_l_pathcolon45","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13","displayName":"Trusted Location #13 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_l_allowsubfolders52","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_l_allowsubfolders52_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_l_allowsubfolders52_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_l_datecolon50","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_l_descriptioncolon51","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_l_pathcolon49","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14","displayName":"Trusted Location #14 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_l_allowsubfolders56","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_l_allowsubfolders56_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_l_allowsubfolders56_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_l_datecolon54","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_l_descriptioncolon55","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_l_pathcolon53","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15","displayName":"Trusted Location #15 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_l_allowsubfolders60","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_l_allowsubfolders60_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_l_allowsubfolders60_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_l_datecolon58","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_l_descriptioncolon59","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_l_pathcolon57","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16","displayName":"Trusted Location #16 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_l_allowsubfolders64","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_l_allowsubfolders64_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_l_allowsubfolders64_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_l_datecolon62","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_l_descriptioncolon63","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_l_pathcolon61","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17","displayName":"Trusted Location #17 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_l_allowsubfolders68","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_l_allowsubfolders68_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_l_allowsubfolders68_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_l_datecolon66","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_l_descriptioncolon67","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_l_pathcolon65","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18","displayName":"Trusted Location #18 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_l_allowsubfolders72","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_l_allowsubfolders72_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_l_allowsubfolders72_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_l_datecolon70","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_l_descriptioncolon71","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_l_pathcolon69","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19","displayName":"Trusted Location #19 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_l_allowsubfolders76","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_l_allowsubfolders76_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_l_allowsubfolders76_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_l_datecolon74","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_l_descriptioncolon75","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_l_pathcolon73","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20","displayName":"Trusted Location #20 (User)","description":"This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_l_allowsubfolders80","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_l_allowsubfolders80_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_l_allowsubfolders80_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_l_datecolon78","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_l_descriptioncolon79","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_l_pathcolon77","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_backgroundaccessibilitycheckerinformation","displayName":"Check for accessibility issues while editing (User)","description":"This policy setting controls whether accessibility issues are checked for automatically while the user is editing a workbook. By default, accessibility issues aren’t checked for automatically.\r\n\r\nIf you enable this policy setting, accessibility issues are checked for automatically and users won’t be able to turn it off. The status bar will indicate if accessibility recommendations are available to make the workbook more usable by people with disabilities.\r\n\r\nIf you disable or don’t configure this policy setting, accessibility issues won’t be checked for automatically while editing a workbook. Users can turn on automatic checking by going to File > Options > Ease of Access.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_backgroundaccessibilitycheckerinformation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_backgroundaccessibilitycheckerinformation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingalttextaccessibilityinformation","displayName":"Stop checking for alt text accessibility information (User)","description":"This policy setting prevents the Accessibility Checker from verifying that objects such as images and shapes contain alternative text.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that objects such as images and shapes contain alternative text.\r\n\r\nIf you disable or do not configure this policy setting, objects will be checked for alternative text and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingalttextaccessibilityinformation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingalttextaccessibilityinformation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingforblanktablerowsusedasformatting","displayName":"Stop checking for blank table rows used as formatting (User)","description":"This policy setting allows you to configure Accessibility Checker and whether it checks for blank table rows used as formatting.\r\n\r\nIf you enable this policy setting, no check for blank table rows used as formatting will be done.\r\n\r\nIf you disable or do not configure this policy setting, tables will be checked for blank rows and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingforblanktablerowsusedasformatting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingforblanktablerowsusedasformatting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingformergedcells","displayName":"Stop checking for merged cells (User)","description":"This policy setting allows you to configure whether Accessibility Checker will verify that tables do not have merged cells.\r\n\r\nIf you enable this policy setting, no check will be made.\r\n\r\nIf you disable or do not configure this policy setting, worksheets will be checked for merged cells and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingformergedcells_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingformergedcells_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingtableheaderaccessibilityinformation","displayName":"Stop checking for table header accessibility information (User)","description":"This policy setting prevents the Accessibility Checker from verifying that tables have a header row specified.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that tables have a header row specified.\r\n\r\nIf you disable or do not configure this policy setting, tables will be checked for header rows and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingtableheaderaccessibilityinformation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingtableheaderaccessibilityinformation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingtoensurehyperlinktextismeaningful","displayName":"Stop checking to ensure hyperlink text is meaningful (User)","description":"This policy setting prevents the Accessibility Checker from verifying that hyperlinks have meaningful text.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that hyperlinks have meaningful text.\r\n\r\nIf you disable or do not configure this policy setting, hyperlink text will be checked and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingtoensurehyperlinktextismeaningful_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingtoensurehyperlinktextismeaningful_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingtoensurenondefaultsheetnames","displayName":"Stop checking to ensure non-default sheet names (User)","description":"This policy setting prevents the Accessibility Checker from verifying that worksheets with content have non-default names.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that worksheets with content have non-default names.\r\n\r\nIf you disable or do not configure this policy setting, worksheet names will be checked and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingtoensurenondefaultsheetnames_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingtoensurenondefaultsheetnames_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingtoensureworkbooksallowprogrammaticaccess","displayName":"Stop checking to ensure workbooks allow programmatic access (User)","description":"This policy setting allows you to configure Accessibility Checker and whether it checks to ensure that workbooks have not blocked programmatic access through DRM.\r\n\r\nIf you enable this policy setting, no check will be made.\r\n\r\nIf you disable or do not configure this policy setting, workbooks will be checked for programmatic access and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingtoensureworkbooksallowprogrammaticaccess_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingtoensureworkbooksallowprogrammaticaccess_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_intelligentservices_l_insights","displayName":"Remove Ideas button from the Ribbon (User)","description":"\r\nThis policy setting allows you to prevent users from accessing Ideas in Excel, an intelligent service providing suggestions and analyses based on your data. By default, a button for Ideas appears in the “Ideas” group on the “Home” tab on the ribbon.\r\n\r\nIf you enable this policy setting, the button for Ideas is removed from the ribbon and users can’t add the button to the ribbon manually. Users won’t be able to access Ideas.\r\n\r\nIf you disable or don’t configure this policy setting, the button for Ideas appears on the ribbon and users can access Ideas.\r\n\t\t","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_intelligentservices_l_insights_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_intelligentservices_l_insights_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_blockallunmanagedaddins","displayName":"Block all unmanaged add-ins (User)","description":"This policy setting blocks all add-ins that are not managed by the \"List of managed add-ins\" policy setting.\r\n\r\nIf you enable this policy setting, and the \"List of managed add-ins\" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the \"List of managed add-ins\" policy setting.\r\n\r\nIf you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the \"List of managed add-ins\" policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_blockallunmanagedaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_blockallunmanagedaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_defaultcustomtab","displayName":"Show custom templates tab by default in Excel on the Office Start screen and in File | New (User)","description":"This policy setting controls whether custom templates (when they exist) show as the default tab in Excel on the Office Start screen and in File | New. \r\n\r\nIf you enable this policy setting, users will the see custom templates tab as the default tab in Excel on the Office Start screen and in File | New when templates exist (this can include Custom XML programmed templates, templates in the Workgroup templates path, templates in the Personal templates path, or SharePoint templates).\r\n\r\nIf you disable or do not configure this policy setting, users will see the Featured templates tab as the default tab in Excel on the Office Start screen and in File | New, unless all Office-provided templates have been disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_defaultcustomtab_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_defaultcustomtab_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_disableofficestartexcel","displayName":"Disable the Office Start screen for Excel (User)","description":"This policy setting controls whether the Office Start screen appears on boot for Excel.\r\n\r\nIf you enable this policy setting, users will not see the Office Start screen when they boot Excel.\r\n\r\nIf you disable or do not configure this policy setting, users will see the Office Start screen when they boot Excel.\r\n\r\nNote: This policy setting is overridden by the policy setting \"Microsoft Office 2016 > Miscellaneous > Disable the Office Start screen for all Office applications\" if that policy setting is set.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_disableofficestartexcel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_disableofficestartexcel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_donotcachenetworkfileslocally","displayName":"Do not cache network files locally (User)","description":"This policy setting allows you to configure whether network files are locally cached when editing spreadsheets stored on network shares.\r\n\r\nIf you enable this policy setting, a file located on a network share may not be saved if the network connection was lost at any time while editing the file and the file contains a pivot table, VBE code or an embedded OLE object. \r\n\r\nIf you disable or do not configure this policy setting, network files are locally cached when editing spreadsheets stored on network shares. This may help prevent data loss during network failures.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_donotcachenetworkfileslocally_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_donotcachenetworkfileslocally_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_enablefourdigityeardisplay","displayName":"Enable four-digit year display (User)","description":"When this setting is not enabled, Excel follows the Short date style setting under Regional Settings in Control Panel. When this setting is enabled, Excel always displays four digits when you type a date that includes a four-digit year, which may override the Short date style setting under Regional Settings in Control Panel.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_enablefourdigityeardisplay_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_enablefourdigityeardisplay_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_graphgallerypath","displayName":"Graph gallery path (User)","description":"Sets the path where user defined graph templates are stored.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_graphgallerypath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_graphgallerypath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_graphgallerypath_l_graphgallerypath169","displayName":"Graph gallery path (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_listofmanagedaddins","displayName":"List of managed add-ins (User)","description":"This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the \"Block all unmanaged add-ins\" policy setting.\r\n\r\nTo enable this policy setting, provide the following information for each add-in:\r\n\r\nIn \"Value name,\" specify the programmatic identifier (ProgID) for COM add-ins, Excel Automation add-ins, and RTD add-ins, or specify the file name of Excel XLL add-ins and Excel add-ins.\r\n\r\nTo obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Office\\Excel\\Addins or HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Office\\Excel\\Addins.\r\n\r\nTo obtain the file name of an add-in, click the File menu in the application where the add-in is installed. Click Options, click Add-ins, and then use the Location column to determine the file name of the add-in.\r\n\r\nYou can also obtain the ProgID or the file name of an add-in by using Office Telemetry Dashboard.\r\n\r\nIn \"Value,\" specify the value as follows:\r\n\r\nTo specify that an add-in is always disabled (blocked), type 0.\r\n\r\nTo specify that an add-in is always enabled, type 1.\r\n\r\nTo specify that an add-in is configurable by the user and not blocked by the \"Block all unmanaged add-ins\" policy setting when enabled, type 2.\r\n\r\nIf you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the \"Block all unmanaged add-ins\" policy setting is enabled, then all add-ins are blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_listofmanagedaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_listofmanagedaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_listofmanagedaddins_l_listofmanagedaddins2","displayName":"List of managed add-ins (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_listofmanagedaddins_l_listofmanagedaddins2_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_listofmanagedaddins_l_listofmanagedaddins2_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_olappivottableuserdefinedfunctionudfsecuritysetting","displayName":"OLAP PivotTable User Defined Function (UDF) security setting (User)","description":"PivotTable reports can contain OLAP queries with references to User Defined Functions (UDFs). UDFs can be compiled executables, therefore posing a potential security threat. With this setting you can either (1) allow all UDFs in OLAP queries to execute with no IObjectSafety check, (2) allow only UDFs where the developer has used IObjectSafety to mark the UDF as a safe executable, or (3) disable all UDFs from executing in OLAP queries. The effect of setting this key is for Excel to pass the selected value to the OLAP provider.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_olappivottableuserdefinedfunctionudfsecuritysetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_olappivottableuserdefinedfunctionudfsecuritysetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_olappivottableuserdefinedfunctionudfsecuritysetting_l_olappivottableuserdefinedfunctionudfsecuritysetting171","displayName":"OLAP PivotTable User Defined Function (UDF) security setting (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_olappivottableuserdefinedfunctionudfsecuritysetting_l_olappivottableuserdefinedfunctionudfsecuritysetting171_1","displayName":"Allow ALL UDFs","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_olappivottableuserdefinedfunctionudfsecuritysetting_l_olappivottableuserdefinedfunctionudfsecuritysetting171_2","displayName":"Allow safe UDFs only","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_olappivottableuserdefinedfunctionudfsecuritysetting_l_olappivottableuserdefinedfunctionudfsecuritysetting171_3","displayName":"Allow NO UDFs","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_personaltemplatespath","displayName":"Personal templates path for Excel (User)","description":"This policy setting specifies the location of a user's personal templates. \r\n\r\nIf you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. \r\n\r\nIf you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_personaltemplatespath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_personaltemplatespath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168_l_personaltemplatespath_l_personaltemplatespath","displayName":"Personal templates path (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168~l_serversettings_l_turnofffilesynchronizationviasoapoverhttp","displayName":"Turn off file synchronization via SOAP over HTTP (User)","description":"This policy setting controls file synchronization via SOAP over HTTP for Excel.\r\n\r\nIf you enable this policy setting, file synchronization via SOAP over HTTP is turned off for Excel.\r\n\r\nIf you disable or do not configure this policy setting this policy setting, file synchronization via SOAP over HTTP is turned on for Excel.\r\n\r\nNote: Turning off file synchronization via SOAP over HTTP will adversely affect the behavior of SharePoint Workspaces.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168~l_serversettings_l_turnofffilesynchronizationviasoapoverhttp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v2~policy~l_microsoftofficeexcel~l_miscellaneous168~l_serversettings_l_turnofffilesynchronizationviasoapoverhttp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v3~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_externalcontent_l_disableddeserverlaunch","displayName":"Don’t allow Dynamic Data Exchange (DDE) server launch in Excel (User)","description":"This policy setting allows you to control whether Dynamic Data Exchange (DDE) server launch is allowed.\r\n\r\nBy default, DDE server launch is turned off, but users can turn on DDE server launch by going to File > Options > Trust Center > Trust Center Settings > External Content.\r\n\r\nFor security reasons, turning on DDE server launch is not recommended.\r\n\r\nNote: For DDE server launch to work, Dynamic Data Exchange (DDE) server lookup must be turned on. Be sure that the “Don’t allow Dynamic Data Exchange (DDE) server lookup” policy setting isn’t enabled, because enabling that policy setting turns off DDE server lookup.\r\n\r\nIf you enable this policy setting, DDE server launch isn’t allowed, and users can’t turn on DDE server launch in the Trust Center.\r\n\r\nIf you disable this policy setting, DDE server launch is allowed, and users cannot turn off DDE server launch in the Trust Center. For security reasons, this is not recommended.\r\n\r\nIf you don’t configure this policy setting, DDE server launch is turned off, but users can turn on DDE server launch in the Trust Center.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v3~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_externalcontent_l_disableddeserverlaunch_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v3~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_externalcontent_l_disableddeserverlaunch_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v3~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_externalcontent_l_disableddeserverlookup","displayName":"Don’t allow Dynamic Data Exchange (DDE) server lookup in Excel (User)","description":"This policy setting allows you to control whether Dynamic Data Exchange (DDE) server lookup is allowed.\r\n\r\nBy default, DDE server lookup is turned on, but users can turn off DDE server lookup by going to File > Options > Trust Center > Trust Center Settings > External Content.\r\n\r\nIf you enable this policy setting, DDE server lookup isn’t allowed, and users can’t turn on DDE server lookup in the Trust Center.\r\n\r\nNote: If you’re using Dynamic Data Exchange (DDE) server launch, which isn’t recommended, don’t enable this policy setting, because DDE server launch requires DDE server lookup to be on.\r\n\r\nIf you disable or don’t configure this policy setting, DDE server lookup is turned on, but users can turn off DDE server lookup in the Trust Center.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v3~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_externalcontent_l_disableddeserverlookup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v3~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_externalcontent_l_disableddeserverlookup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v3~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_externalcontent_l_enableblockunsecurequeryfiles","displayName":"Always prevent untrusted Microsoft Query files from opening (User)","description":"This policy setting controls whether Microsoft Query files (.iqy, oqy, .dqy, and .rqy) in an untrusted location are prevented from opening.\r\n\r\nIf you enable this policy setting, Microsoft Query files in an untrusted location are prevented from opening. Users will not be able to change this setting under File > Options > Trust Center > Trust Center Settings > External Content.\r\n\r\nIf you disable or don’t configure this policy setting, Microsoft Query files in an untrusted location are not prevented from opening, unless users have changed this setting in the Trust Center.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v3~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_externalcontent_l_enableblockunsecurequeryfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v3~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_externalcontent_l_enableblockunsecurequeryfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v3~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_enabledatabasefileprotectedview","displayName":"Always open untrusted database files in Protected View (User)","description":"This policy setting controls whether database files (.dbf) opened from an untrusted location are always opened in Protected View.\r\n\r\nIf you enable this policy setting, database files opened from an untrusted location are always opened in Protected View. Users will not be able to change this setting under File > Options > Trust Center > Trust Center Settings > Protected View.\r\n\r\nIf you disable or don’t configure this policy setting, database files opened from an untrusted location are not opened in Protected View, unless users have changed this setting in the Trust Center.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v3~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_enabledatabasefileprotectedview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v3~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_enabledatabasefileprotectedview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v3~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_enableforeigntextfileprotectedview","displayName":"Always open untrusted text-based files in Protected View (User)","description":"This policy setting controls whether text-based files (.csv, .dif, and .sylk) opened from an untrusted location are always opened in Protected View.\r\n\r\nIf you enable this policy setting, text-based files opened from an untrusted location are always opened in Protected View. Users will not be able to change this setting under File > Options > Trust Center > Trust Center Settings > Protected View.\r\n\r\nIf you disable or don’t configure this policy setting, text-based files opened from an untrusted location are not opened in Protected View, unless users have changed this setting in the Trust Center.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v3~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_enableforeigntextfileprotectedview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v3~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_protectedview_l_enableforeigntextfileprotectedview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v4~policy~l_microsoftofficeexcel~l_powerbi_l_disablefrompowerbidatasetorganizationname","displayName":"Disable displaying organization name in the buttons to create PivotTables from Power BI datasets (User)","description":"\r\n This policy setting allows you to prevent the organization name from being displayed in the buttons in the Excel ribbon used to create PivotTables from Power BI datasets. By default, the organization name will be shown in the ribbon if it is available from Graph.\r\n\r\n If you enable this policy setting, the organization name will not be shown.\r\n\r\n If you disable or don’t configure this policy setting, the organization name will be shown.\r\n\r\n Note: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v4~policy~l_microsoftofficeexcel~l_powerbi_l_disablefrompowerbidatasetorganizationname_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v4~policy~l_microsoftofficeexcel~l_powerbi_l_disablefrompowerbidatasetorganizationname_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v5~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingtablealttextaccessibilityinformation","displayName":"Stop checking for table alt text accessibility information (User)","description":"This policy setting prevents the Accessibility Checker from verifying that tables contain alternative text.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that tables contain alternative text.\r\n\r\nIf you disable or do not configure this policy setting, tables will be checked for alternative text and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v5~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingtablealttextaccessibilityinformation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v5~policy~l_microsoftofficeexcel~l_filetab~l_checkaccessibility_l_stopcheckingtablealttextaccessibilityinformation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v6~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_xl4killswitchpolicy","displayName":"Prevent Excel from running XLM macros (User)","description":"This policy setting will prevent Excel from running Excel 4.0 (XLM) macros.\r\n\r\nIf you enable this policy setting, XLM macros cannot be run in Excel.\r\n\r\nIf you disable or don’t configure this policy setting, XLM macros can be run in Excel.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v6~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_xl4killswitchpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v6~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_xl4killswitchpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v7~policy~l_microsoftofficeexcel~l_miscellaneous168_l_exceldisableofficescripts","displayName":"Disable Office Scripts in Excel for Windows Desktop (User)","description":"This policy setting controls whether Office Scripts (including the relevant commands on the Automate tab) are available for use.\r\n\r\nIf you enable this policy setting, Office Scripts will not be available for use on the installed Excel app on a desktop.\r\n\r\nIf you disable or don't configure this policy setting, Office Scripts will be available for use provided all other prerequisites are met, including the applicable Microsoft 365 subscription license.\r\n\r\nNote: This policy setting is independent of Office Scripts settings available to administrators in the Microsoft 365 Admin Center. Admin Center settings are always honored by the Excel app regardless of the state of this policy; however, turning on this policy will also hide Office Scripts-related entry points.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v7~policy~l_microsoftofficeexcel~l_miscellaneous168_l_exceldisableofficescripts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v7~policy~l_microsoftofficeexcel~l_miscellaneous168_l_exceldisableofficescripts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v8~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_blockxllfrominternet","displayName":"Block Excel XLL Add-ins that come from an untrusted source (User)","description":"\r\n This policy setting allows you to block Excel XLL Add-ins that come from an untrusted source.\r\n\r\n If you enable this policy setting, you can set one of these options:\r\n - Block: XLL add-ins from untrusted sources are blocked. Users will receive a notification that the add-in was blocked.\r\n - Show Additional Warning: Show an additional warning prompt after the user chooses to enable an XLL add-in from an untrusted source.\r\n - Allow: XLL add-ins from an untrusted source are allowed.\r\n\r\n The exceptions when Excel XLL Add-ins will be allowed to run are:\r\n - The XLL is stored in a Trusted Location.\r\n - The XLL is digitally signed and the matching Trusted Publisher certificate is installed on the device.\r\n\r\n If you disable this policy setting, the settings configured in the Macro and Add-in Settings sections of the Trust Center determine whether Excel XLL Add-ins that come from an untrusted source will be allowed.\r\n\r\n If you disable or do not configure this policy setting, users will be able to override default behavior by modifying the registry.\r\n\r\n For more information, see https://support.microsoft.com/topic/1e3752e2-1177-4444-a807-7b700266a6fb.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v8~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_blockxllfrominternet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v8~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_blockxllfrominternet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v8~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_blockxllfrominternet_l_blockxllfrominternetenum","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v8~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_blockxllfrominternet_l_blockxllfrominternetenum_1","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v8~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_blockxllfrominternet_l_blockxllfrominternetenum_0","displayName":"Show Additional Warning","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v8~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter_l_blockxllfrominternet_l_blockxllfrominternetenum_2","displayName":"Allow","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_excel16v9~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excelfileblockexternallinks","displayName":"File Block includes external link files (User)","description":"This setting determines whether Trust Center settings for blocking load of potentially unsecure workbooks applies to those accessed by external links.\r\n\r\nIf you enable this policy setting, external links to workbooks that are blocked by File Block settings in Trust Center will not refresh. Attempts to create new links or refresh data from blocked workbooks may result in errors.\r\n\r\nIf you disable this policy setting, attempts to access external links data will not be subject to File Block settings in Trust Center.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_excel16v9~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excelfileblockexternallinks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_excel16v9~policy~l_microsoftofficeexcel~l_exceloptions~l_security~l_trustcenter~l_fileblocksettings_l_excelfileblockexternallinks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_experience_allowspotlightcollection","displayName":"Allow Spotlight Collection (User)","description":"Specifies whether Spotlight collection is allowed as a Personalization->Background Setting. If you enable this policy setting, Spotlight collection will show as an option in the user's Personalization Settings, and the user will be able to get daily images from Microsoft displayed on their desktop. If you disable this policy setting, Spotlight collection will not show as an option in Personliazation Settings, and the user will not have the choice of getting Microsoft daily images shown on their desktop.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Experience#allowspotlightcollection"],"options":null},{"id":"user_vendor_msft_policy_config_experience_allowtailoredexperienceswithdiagnosticdata","displayName":"Allow Tailored Experiences With Diagnostic Data (User)","description":"This policy allows you to prevent Windows from using diagnostic data to provide customized experiences to the user. If you enable this policy setting, Windows will not use diagnostic data from this device to customize content shown on the lock screen, Windows tips, Microsoft consumer features, or other related features. If these features are enabled, users will still see recommendations, tips and offers, but they may be less relevant. If you disable or do not configure this policy setting, Microsoft will use diagnostic data to provide personalized recommendations, tips, and offers to tailor Windows for the user's needs and make it work better for them. Diagnostic data can include browser, app and feature usage, depending on the Diagnostic and usage data setting value. Note This setting does not control Cortana cutomized experiences because there are separate policies to configure it. Most restricted value is 0.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Experience#allowtailoredexperienceswithdiagnosticdata"],"options":[{"id":"user_vendor_msft_policy_config_experience_allowtailoredexperienceswithdiagnosticdata_0","displayName":"Block","description":"Not allowed.","helpText":null},{"id":"user_vendor_msft_policy_config_experience_allowtailoredexperienceswithdiagnosticdata_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"user_vendor_msft_policy_config_experience_allowthirdpartysuggestionsinwindowsspotlight","displayName":"Allow Third Party Suggestions In Windows Spotlight (User)","description":"Specifies whether to allow app and content suggestions from third-party software publishers in Windows spotlight features like lock screen spotlight, suggested apps in the Start menu, and Windows tips. Users may still see suggestions for Microsoft features, apps, and services.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Experience#allowthirdpartysuggestionsinwindowsspotlight"],"options":[{"id":"user_vendor_msft_policy_config_experience_allowthirdpartysuggestionsinwindowsspotlight_0","displayName":"Block","description":"Third-party suggestions not allowed.","helpText":null},{"id":"user_vendor_msft_policy_config_experience_allowthirdpartysuggestionsinwindowsspotlight_1","displayName":"Allow","description":"Third-party suggestions allowed.","helpText":null}]},{"id":"user_vendor_msft_policy_config_experience_allowwindowsspotlight","displayName":"Allow Windows Spotlight (User)","description":"Specifies whether to turn off all Windows spotlight features at once. If you enable this policy setting, Windows spotlight on lock screen, Windows Tips, Microsoft consumer features and other related features will be turned off. You should enable this policy setting if your goal is to minimize network traffic from target devices. If you disable or do not configure this policy setting, Windows spotlight features are allowed and may be controlled individually using their corresponding policy settings. Most restricted value is 0.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Experience#allowwindowsspotlight"],"options":[{"id":"user_vendor_msft_policy_config_experience_allowwindowsspotlight_0","displayName":"Block","description":"Not allowed.","helpText":null},{"id":"user_vendor_msft_policy_config_experience_allowwindowsspotlight_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"user_vendor_msft_policy_config_experience_allowwindowsspotlightonactioncenter","displayName":"Allow Windows Spotlight On Action Center (User)","description":"This policy allows administrators to prevent Windows spotlight notifications from being displayed in the Action Center. If you enable this policy, Windows spotlight notifications will no longer be displayed in the Action Center. If you disable or do not configure this policy, Microsoft may display notifications in the Action Center that will suggest apps or features to help users be more productive on Windows. Most restricted value is 0.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Experience#allowwindowsspotlightonactioncenter"],"options":[{"id":"user_vendor_msft_policy_config_experience_allowwindowsspotlightonactioncenter_0","displayName":"Block","description":"Not allowed.","helpText":null},{"id":"user_vendor_msft_policy_config_experience_allowwindowsspotlightonactioncenter_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"user_vendor_msft_policy_config_experience_allowwindowsspotlightonsettings","displayName":"Allow Windows Spotlight On Settings (User)","description":"This policy allows IT admins to turn off Suggestions in Settings app. These suggestions from Microsoft may show after each OS clean install, upgrade or an on-going basis to help users discover apps/features on Windows or across devices, to make their experience productive. User setting is under Settings -> Privacy -> General -> Show me suggested content in Settings app. User Setting is changeable on a per user basis. If the Group policy is set to off, no suggestions will be shown to the user in Settings app.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Experience#allowwindowsspotlightonsettings"],"options":[{"id":"user_vendor_msft_policy_config_experience_allowwindowsspotlightonsettings_0","displayName":"Block","description":"Not allowed.","helpText":null},{"id":"user_vendor_msft_policy_config_experience_allowwindowsspotlightonsettings_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"user_vendor_msft_policy_config_experience_allowwindowsspotlightwindowswelcomeexperience","displayName":"Allow Windows Spotlight Windows Welcome Experience (User)","description":"This policy setting lets you turn off the Windows spotlight Windows welcome experience feature. The Windows welcome experience feature introduces onboard users to Windows; for example, launching Microsoft Edge with a webpage that highlights new features. If you enable this policy, the Windows welcome experience will no longer be displayed when there are updates and changes to Windows and its apps. If you disable or do not configure this policy, the Windows welcome experience will be launched to inform onboard users about what's new, changed, and suggested. Most restricted value is 0.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Experience#allowwindowsspotlightwindowswelcomeexperience"],"options":[{"id":"user_vendor_msft_policy_config_experience_allowwindowsspotlightwindowswelcomeexperience_0","displayName":"Block","description":"Not allowed.","helpText":null},{"id":"user_vendor_msft_policy_config_experience_allowwindowsspotlightwindowswelcomeexperience_1","displayName":"Allow","description":"Allowed.","helpText":null}]},{"id":"user_vendor_msft_policy_config_experience_configurewindowsspotlightonlockscreen","displayName":"Configure Windows Spotlight On Lock Screen (User)","description":"Allows IT admins to specify whether spotlight should be used on the user's lock screen. If your organization does not have an Enterprise spotlight content service, then this policy will behave the same as a setting of 1.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Experience#configurewindowsspotlightonlockscreen"],"options":[{"id":"user_vendor_msft_policy_config_experience_configurewindowsspotlightonlockscreen_0","displayName":"Windows spotlight disabled.","description":"Windows spotlight disabled.","helpText":null},{"id":"user_vendor_msft_policy_config_experience_configurewindowsspotlightonlockscreen_1","displayName":"Windows spotlight enabled.","description":"Windows spotlight enabled.","helpText":null},{"id":"user_vendor_msft_policy_config_experience_configurewindowsspotlightonlockscreen_2","displayName":"Windows spotlight is always enabled, the user cannot disable it","description":"Windows spotlight is always enabled, the user cannot disable it","helpText":null},{"id":"user_vendor_msft_policy_config_experience_configurewindowsspotlightonlockscreen_3","displayName":"Windows spotlight is always enabled, the user cannot disable it. For special configurations only","description":"Windows spotlight is always enabled, the user cannot disable it. For special configurations only","helpText":null}]},{"id":"user_vendor_msft_policy_config_experience_enableorganizationalmessages","displayName":"Enable delivery of organizational messages (User)","description":"Organizational messages allow Administrators to deliver messages to their end users on selected Windows 11 experiences. Organizational messages are available to Administrators via services like Microsoft Endpoint Manager. By default, this policy is disabled. If you enable this policy, these experiences will show content booked by Administrators. Enabling this policy will have no impact on existing MDM policy settings governing delivery of content from Microsoft on Windows experiences.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Experience#enableorganizationalmessages"],"options":[{"id":"user_vendor_msft_policy_config_experience_enableorganizationalmessages_0","displayName":"Disabled","description":"Disabled","helpText":null},{"id":"user_vendor_msft_policy_config_experience_enableorganizationalmessages_1","displayName":"Enabled","description":"Enabled","helpText":null}]},{"id":"user_vendor_msft_policy_config_fileexplorer_allowoptiontoshownetwork","displayName":"Allow Option To Show Network (User)","description":"When the Network folder is restricted, give the user the option to enumerate and navigate into it.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-FileExplorer#allowoptiontoshownetwork"],"options":[{"id":"user_vendor_msft_policy_config_fileexplorer_allowoptiontoshownetwork_0","displayName":"Not Allowed.","description":"Not Allowed.","helpText":null},{"id":"user_vendor_msft_policy_config_fileexplorer_allowoptiontoshownetwork_1","displayName":"Allowed.","description":"Allowed.","helpText":null}]},{"id":"user_vendor_msft_policy_config_fileexplorer_allowoptiontoshowthispc","displayName":"Allow Option To Show This PC (User)","description":"When This PC location is restricted, give the user the option to enumerate and navigate into it.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-FileExplorer#allowoptiontoshowthispc"],"options":[{"id":"user_vendor_msft_policy_config_fileexplorer_allowoptiontoshowthispc_0","displayName":"Not Allowed.","description":"Not Allowed.","helpText":null},{"id":"user_vendor_msft_policy_config_fileexplorer_allowoptiontoshowthispc_1","displayName":"Allowed.","description":"Allowed.","helpText":null}]},{"id":"user_vendor_msft_policy_config_fileexplorer_setallowedfolderlocations","displayName":"Set Allowed Folder Locations (User)","description":"A value that can represent one or more folder locations in File Explorer. If not specified, the default is access to all folder locations.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-FileExplorer#setallowedfolderlocations"],"options":[{"id":"user_vendor_msft_policy_config_fileexplorer_setallowedfolderlocations_0","displayName":"Access to all folder locations.","description":"Access to all folder locations.","helpText":null},{"id":"user_vendor_msft_policy_config_fileexplorer_setallowedfolderlocations_13","displayName":"Documents, Pictures, Downloads","description":"Documents, Pictures, Downloads","helpText":null},{"id":"user_vendor_msft_policy_config_fileexplorer_setallowedfolderlocations_15","displayName":"Desktop, Documents, Pictures, Downloads","description":"Desktop, Documents, Pictures, Downloads","helpText":null},{"id":"user_vendor_msft_policy_config_fileexplorer_setallowedfolderlocations_31","displayName":"Desktop, Documents, Pictures, Downloads, Network","description":"Desktop, Documents, Pictures, Downloads, Network","helpText":null},{"id":"user_vendor_msft_policy_config_fileexplorer_setallowedfolderlocations_47","displayName":"This PC, Desktop, Documents, Pictures, Downloads","description":"This PC, Desktop, Documents, Pictures, Downloads","helpText":null},{"id":"user_vendor_msft_policy_config_fileexplorer_setallowedfolderlocations_63","displayName":"This PC, Desktop, Documents, Pictures, Downloads, Network","description":"This PC, Desktop, Documents, Pictures, Downloads, Network","helpText":null}]},{"id":"user_vendor_msft_policy_config_fileexplorer_setallowedstoragelocations","displayName":"Set Allowed Storage Locations (User)","description":"A value that can represent one or more storage locations in File Explorer. If not specified, the default is access to all storage locations.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-FileExplorer#setallowedstoragelocations"],"options":[{"id":"user_vendor_msft_policy_config_fileexplorer_setallowedstoragelocations_0","displayName":"Access to all storage locations.","description":"Access to all storage locations.","helpText":null},{"id":"user_vendor_msft_policy_config_fileexplorer_setallowedstoragelocations_1","displayName":"Removable Drives","description":"Removable Drives","helpText":null},{"id":"user_vendor_msft_policy_config_fileexplorer_setallowedstoragelocations_2","displayName":"Sync roots","description":"Sync roots","helpText":null},{"id":"user_vendor_msft_policy_config_fileexplorer_setallowedstoragelocations_3","displayName":"Removable Drives, Sync roots","description":"Removable Drives, Sync roots","helpText":null},{"id":"user_vendor_msft_policy_config_fileexplorer_setallowedstoragelocations_4","displayName":"Local Drives","description":"Local Drives","helpText":null},{"id":"user_vendor_msft_policy_config_fileexplorer_setallowedstoragelocations_5","displayName":"Removable Drives, Local Drives","description":"Removable Drives, Local Drives","helpText":null},{"id":"user_vendor_msft_policy_config_fileexplorer_setallowedstoragelocations_6","displayName":"Sync Roots, Local Drives","description":"Sync Roots, Local Drives","helpText":null},{"id":"user_vendor_msft_policy_config_fileexplorer_setallowedstoragelocations_7","displayName":"Removable Drives, Sync Roots, Local Drives","description":"Removable Drives, Sync Roots, Local Drives","helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_addsearchprovider","displayName":"Add a specific list of search providers to the user's list of search providers (User)","description":"This policy setting allows you to add a specific list of search providers to the user's default list of search providers. Normally, search providers can be added from third-party toolbars or in Setup. The user can also add a search provider from the provider's website.\r\n\r\nIf you enable this policy setting, the user can add and remove search providers, but only from the set of search providers specified in the list of policy keys for search providers (found under [HKCU or HKLM\\Software\\policies\\Microsoft\\Internet Explorer\\SearchScopes]). Note: This list can be created from a custom administrative template file. For information about creating this custom administrative template file, see the Internet Explorer documentation on search providers.\r\n\r\nIf you disable or do not configure this policy setting, the user can configure their list of search providers unless another policy setting restricts such configuration.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-addsearchprovider"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_addsearchprovider_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_addsearchprovider_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowactivexfiltering","displayName":"Turn on ActiveX Filtering (User)","description":"This policy setting controls the ActiveX Filtering feature for websites that are running ActiveX controls. The user can choose to turn off ActiveX Filtering for specific websites so that ActiveX controls can run properly.\r\n\r\nIf you enable this policy setting, ActiveX Filtering is enabled by default for the user. The user cannot turn off ActiveX Filtering, although they may add per-site exceptions.\r\n\r\nIf you disable or do not configure this policy setting, ActiveX Filtering is not enabled by default for the user. The user can turn ActiveX Filtering on or off.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowactivexfiltering"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowactivexfiltering_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowactivexfiltering_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowaddonlist","displayName":"Add-on List (User)","description":"This policy setting allows you to manage a list of add-ons to be allowed or denied by Internet Explorer. Add-ons in this case are controls like ActiveX Controls, Toolbars, and Browser Helper Objects (BHOs) which are specifically written to extend or enhance the functionality of the browser or web pages.\r\n\r\nThis list can be used with the 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting, which defines whether add-ons not listed here are assumed to be denied.\r\n\r\nIf you enable this policy setting, you can enter a list of add-ons to be allowed or denied by Internet Explorer. For each entry that you add to the list, enter the following information:\r\n\r\nName of the Value - the CLSID (class identifier) for the add-on you wish to add to the list. The CLSID should be in brackets for example, ‘{000000000-0000-0000-0000-0000000000000}'. The CLSID for an add-on can be obtained by reading the OBJECT tag from a Web page on which the add-on is referenced.\r\n\r\nValue - A number indicating whether Internet Explorer should deny or allow the add-on to be loaded. To specify that an add-on should be denied enter a 0 (zero) into this field. To specify that an add-on should be allowed, enter a 1 (one) into this field. To specify that an add-on should be allowed and also permit the user to manage the add-on through Add-on Manager, enter a 2 (two) into this field.\r\n\r\nIf you disable this policy setting, the list is deleted. The 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting will still determine whether add-ons not in this list are assumed to be denied.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowaddonlist"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowaddonlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowaddonlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowaddonlist_addonlist","displayName":"Add-on List (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowaddonlist_addonlist_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowaddonlist_addonlist_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowautocomplete","displayName":"Turn on the auto-complete feature for user names and passwords on forms (User)","description":"This AutoComplete feature can remember and suggest User names and passwords on Forms.\r\n\r\nIf you enable this setting, the user cannot change \"User name and passwords on forms\" or \"prompt me to save passwords\". The Auto Complete feature for User names and passwords on Forms will be turned on. You have to decide whether to select \"prompt me to save passwords\".\r\n\r\nIf you disable this setting the user cannot change \"User name and passwords on forms\" or \"prompt me to save passwords\". The Auto Complete feature for User names and passwords on Forms is turned off. The user also cannot opt to be prompted to save passwords.\r\n\r\nIf you do not configure this setting, the user has the freedom of turning on Auto complete for User name and passwords on forms and the option of prompting to save passwords. To display this option, the users open the Internet Options dialog box, click the Contents Tab and click the Settings button.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowautocomplete"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowautocomplete_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowautocomplete_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowautocomplete_chkbox_passwordask","displayName":"Prompt me to save passwords (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowautocomplete_chkbox_passwordask_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowautocomplete_chkbox_passwordask_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowcertificateaddressmismatchwarning","displayName":"Turn on certificate address mismatch warning (User)","description":"This policy setting allows you to turn on the certificate address mismatch security warning. When this policy setting is turned on, the user is warned when visiting Secure HTTP (HTTPS) websites that present certificates issued for a different website address. This warning helps prevent spoofing attacks.\r\n\r\nIf you enable this policy setting, the certificate address mismatch warning always appears.\r\n\r\nIf you disable or do not configure this policy setting, the user can choose whether the certificate address mismatch warning appears (by using the Advanced page in the Internet Control panel).","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowcertificateaddressmismatchwarning"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowcertificateaddressmismatchwarning_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowcertificateaddressmismatchwarning_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowdeletingbrowsinghistoryonexit","displayName":"Allow deleting browsing history on exit (User)","description":"This policy setting allows the automatic deletion of specified items when the last browser window closes. The preferences selected in the Delete Browsing History dialog box (such as deleting temporary Internet files, cookies, history, form data, and passwords) are applied, and those items are deleted.\r\n\r\nIf you enable this policy setting, deleting browsing history on exit is turned on.\r\n\r\nIf you disable this policy setting, deleting browsing history on exit is turned off.\r\n\r\nIf you do not configure this policy setting, it can be configured on the General tab in Internet Options.\r\n\r\nIf the \"Prevent access to Delete Browsing History\" policy setting is enabled, this policy setting has no effect.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowdeletingbrowsinghistoryonexit"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowdeletingbrowsinghistoryonexit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowdeletingbrowsinghistoryonexit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowenhancedprotectedmode","displayName":"Turn on Enhanced Protected Mode (User)","description":"Enhanced Protected Mode provides additional protection against malicious websites by using 64-bit processes on 64-bit versions of Windows. For computers running at least Windows 8, Enhanced Protected Mode also limits the locations Internet Explorer can read from in the registry and the file system.\r\n\r\nIf you enable this policy setting, Enhanced Protected Mode will be turned on. Any zone that has Protected Mode enabled will use Enhanced Protected Mode. Users will not be able to disable Enhanced Protected Mode.\r\n\r\nIf you disable this policy setting, Enhanced Protected Mode will be turned off. Any zone that has Protected Mode enabled will use the version of Protected Mode introduced in Internet Explorer 7 for Windows Vista.\r\n\r\nIf you do not configure this policy, users will be able to turn on or turn off Enhanced Protected Mode on the Advanced tab of the Internet Options dialog.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowenhancedprotectedmode"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowenhancedprotectedmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowenhancedprotectedmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowenhancedsuggestionsinaddressbar","displayName":"Allow Microsoft services to provide enhanced suggestions as the user types in the Address bar (User)","description":"This policy setting allows Internet Explorer to provide enhanced suggestions as the user types in the Address bar. To provide enhanced suggestions, the user's keystrokes are sent to Microsoft through Microsoft services.\r\n\r\nIf you enable this policy setting, users receive enhanced suggestions while typing in the Address bar. In addition, users won't be able to change the Suggestions setting on the Settings charm.\r\n\r\nIf you disable this policy setting, users won't receive enhanced suggestions while typing in the Address bar. In addition, users won't be able to change the Suggestions setting on the Settings charm.\r\n\r\nIf you don't configure this policy setting, users can change the Suggestions setting on the Settings charm.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowenhancedsuggestionsinaddressbar"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowenhancedsuggestionsinaddressbar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowenhancedsuggestionsinaddressbar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowenterprisemodefromtoolsmenu","displayName":"Let users turn on and use Enterprise Mode from the Tools menu (User)","description":"This policy setting lets you decide whether users can turn on Enterprise Mode for websites with compatibility issues. Optionally, this policy also lets you specify where to get reports (through post messages) about the websites for which users turn on Enterprise Mode using the Tools menu.\r\n\r\nIf you turn this setting on, users can see and use the Enterprise Mode option from the Tools menu. If you turn this setting on, but don't specify a report location, Enterprise Mode will still be available to your users, but you won't get any reports.\r\n\r\nIf you disable or don't configure this policy setting, the menu option won't appear and users won't be able to run websites in Enterprise Mode.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowenterprisemodefromtoolsmenu"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowenterprisemodefromtoolsmenu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowenterprisemodefromtoolsmenu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowenterprisemodefromtoolsmenu_enterreportbackprompt","displayName":"Type the location (URL) of where to receive reports about the websites for which users turn on and use Enterprise Mode (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowenterprisemodesitelist","displayName":"Use the Enterprise Mode IE website list (User)","description":"This policy setting lets you specify where to find the list of websites you want opened using Enterprise Mode IE, instead of Standard mode, because of compatibility issues. Users can't edit this list.\r\n\r\nIf you enable this policy setting, Internet Explorer downloads the website list from your location (HKCU or HKLM\\Software\\policies\\Microsoft\\Internet Explorer\\Main\\EnterpriseMode), opening all listed websites using Enterprise Mode IE.\r\n\r\nIf you disable or don't configure this policy setting, Internet Explorer opens all websites using Standards mode.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowenterprisemodesitelist"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowenterprisemodesitelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowenterprisemodesitelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowenterprisemodesitelist_entersitelistprompt","displayName":"Type the location (URL) of your Enterprise Mode IE website list (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowinternetexplorer7policylist","displayName":"Use Policy List of Internet Explorer 7 sites (User)","description":"This policy setting allows you to add specific sites that must be viewed in Internet Explorer 7 Compatibility View.\r\n\r\nIf you enable this policy setting, the user can add and remove sites from the list, but the user cannot remove the entries that you specify.\r\n\r\nIf you disable or do not configure this policy setting, the user can add and remove sites from the list.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowinternetexplorer7policylist"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowinternetexplorer7policylist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowinternetexplorer7policylist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowinternetexplorer7policylist_compatview_sitelist","displayName":"List of sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowinternetexplorerstandardsmode","displayName":"Turn on Internet Explorer Standards Mode for local intranet (User)","description":"This policy setting controls how Internet Explorer displays local intranet content. Intranet content is defined as any webpage that belongs to the local intranet security zone.\r\n\r\nIf you enable this policy setting, Internet Explorer uses the current user agent string for local intranet content. Additionally, all local intranet Standards Mode pages appear in the Standards Mode available with the latest version of Internet Explorer. The user cannot change this behavior through the Compatibility View Settings dialog box.\r\n\r\nIf you disable this policy setting, Internet Explorer uses an Internet Explorer 7 user agent string (with an additional string appended) for local intranet content. Additionally, all local intranet Standards Mode pages appear in Internet Explorer 7 Standards Mode. The user cannot change this behavior through the Compatibility View Settings dialog box.\r\n\r\nIf you do not configure this policy setting, Internet Explorer uses an Internet Explorer 7 user agent string (with an additional string appended) for local intranet content. Additionally, all local intranet Standards Mode pages appear in Internet Explorer 7 Standards Mode. This option results in the greatest compatibility with existing webpages, but newer content written to common Internet standards may be displayed incorrectly. This option matches the default behavior of Internet Explorer.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowinternetexplorerstandardsmode"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowinternetexplorerstandardsmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowinternetexplorerstandardsmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowinternetzonetemplate","displayName":"Internet Zone Template (User)","description":"This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\r\n\r\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.\r\n\r\nIf you disable this template policy setting, no security level is configured.\r\n\r\nIf you do not configure this template policy setting, no security level is configured.\r\n\r\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\r\n\r\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowinternetzonetemplate"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowinternetzonetemplate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowinternetzonetemplate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowinternetzonetemplate_iz_partnameinternetzonetemplate","displayName":"Internet (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowinternetzonetemplate_iz_partnameinternetzonetemplate_1","displayName":"Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowinternetzonetemplate_iz_partnameinternetzonetemplate_2","displayName":"Medium Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowinternetzonetemplate_iz_partnameinternetzonetemplate_3","displayName":"Medium","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowinternetzonetemplate_iz_partnameinternetzonetemplate_5","displayName":"Medium High","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowinternetzonetemplate_iz_partnameinternetzonetemplate_4","displayName":"High","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowintranetzonetemplate","displayName":"Intranet Zone Template (User)","description":"This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\r\n\r\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.\r\n\r\nIf you disable this template policy setting, no security level is configured.\r\n\r\nIf you do not configure this template policy setting, no security level is configured.\r\n\r\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\r\n\r\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowintranetzonetemplate"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowintranetzonetemplate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowintranetzonetemplate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowintranetzonetemplate_iz_partnameintranetzonetemplate","displayName":"Intranet (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowintranetzonetemplate_iz_partnameintranetzonetemplate_1","displayName":"Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowintranetzonetemplate_iz_partnameintranetzonetemplate_2","displayName":"Medium Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowintranetzonetemplate_iz_partnameintranetzonetemplate_3","displayName":"Medium","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowintranetzonetemplate_iz_partnameintranetzonetemplate_5","displayName":"Medium High","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowintranetzonetemplate_iz_partnameintranetzonetemplate_4","displayName":"High","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlocalmachinezonetemplate","displayName":"Local Machine Zone Template (User)","description":"This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\r\n\r\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.\r\n\r\nIf you disable this template policy setting, no security level is configured.\r\n\r\nIf you do not configure this template policy setting, no security level is configured.\r\n\r\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\r\n\r\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowlocalmachinezonetemplate"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowlocalmachinezonetemplate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlocalmachinezonetemplate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlocalmachinezonetemplate_iz_partnamelocalmachinezonetemplate","displayName":"Local Machine Zone (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowlocalmachinezonetemplate_iz_partnamelocalmachinezonetemplate_1","displayName":"Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlocalmachinezonetemplate_iz_partnamelocalmachinezonetemplate_2","displayName":"Medium Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlocalmachinezonetemplate_iz_partnamelocalmachinezonetemplate_3","displayName":"Medium","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlocalmachinezonetemplate_iz_partnamelocalmachinezonetemplate_5","displayName":"Medium High","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlocalmachinezonetemplate_iz_partnamelocalmachinezonetemplate_4","displayName":"High","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddowninternetzonetemplate","displayName":"Locked-Down Internet Zone Template (User)","description":"This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\r\n\r\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.\r\n\r\nIf you disable this template policy setting, no security level is configured.\r\n\r\nIf you do not configure this template policy setting, no security level is configured.\r\n\r\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\r\n\r\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowlockeddowninternetzonetemplate"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddowninternetzonetemplate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddowninternetzonetemplate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddowninternetzonetemplate_iz_partnameinternetzonelockdowntemplate","displayName":"Locked-Down Internet (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddowninternetzonetemplate_iz_partnameinternetzonelockdowntemplate_1","displayName":"Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddowninternetzonetemplate_iz_partnameinternetzonelockdowntemplate_2","displayName":"Medium Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddowninternetzonetemplate_iz_partnameinternetzonelockdowntemplate_3","displayName":"Medium","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddowninternetzonetemplate_iz_partnameinternetzonelockdowntemplate_5","displayName":"Medium High","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddowninternetzonetemplate_iz_partnameinternetzonelockdowntemplate_4","displayName":"High","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownintranetzonetemplate","displayName":"Locked-Down Intranet Zone Template (User)","description":"This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\r\n\r\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.\r\n\r\nIf you disable this template policy setting, no security level is configured.\r\n\r\nIf you do not configure this template policy setting, no security level is configured.\r\n\r\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\r\n\r\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowlockeddownintranetzonetemplate"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownintranetzonetemplate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownintranetzonetemplate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownintranetzonetemplate_iz_partnameintranetzonelockdowntemplate","displayName":"Locked-Down Intranet (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownintranetzonetemplate_iz_partnameintranetzonelockdowntemplate_1","displayName":"Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownintranetzonetemplate_iz_partnameintranetzonelockdowntemplate_2","displayName":"Medium Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownintranetzonetemplate_iz_partnameintranetzonelockdowntemplate_3","displayName":"Medium","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownintranetzonetemplate_iz_partnameintranetzonelockdowntemplate_5","displayName":"Medium High","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownintranetzonetemplate_iz_partnameintranetzonelockdowntemplate_4","displayName":"High","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownlocalmachinezonetemplate","displayName":"Locked-Down Local Machine Zone Template (User)","description":"This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\r\n\r\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.\r\n\r\nIf you disable this template policy setting, no security level is configured.\r\n\r\nIf you do not configure this template policy setting, no security level is configured.\r\n\r\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\r\n\r\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowlockeddownlocalmachinezonetemplate"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownlocalmachinezonetemplate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownlocalmachinezonetemplate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownlocalmachinezonetemplate_iz_partnamelocalmachinezonelockdowntemplate","displayName":"Locked-Down Local Machine Zone (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownlocalmachinezonetemplate_iz_partnamelocalmachinezonelockdowntemplate_1","displayName":"Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownlocalmachinezonetemplate_iz_partnamelocalmachinezonelockdowntemplate_2","displayName":"Medium Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownlocalmachinezonetemplate_iz_partnamelocalmachinezonelockdowntemplate_3","displayName":"Medium","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownlocalmachinezonetemplate_iz_partnamelocalmachinezonelockdowntemplate_5","displayName":"Medium High","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownlocalmachinezonetemplate_iz_partnamelocalmachinezonelockdowntemplate_4","displayName":"High","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownrestrictedsiteszonetemplate","displayName":"Locked-Down Restricted Sites Zone Template (User)","description":"This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\r\n\r\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.\r\n\r\nIf you disable this template policy setting, no security level is configured.\r\n\r\nIf you do not configure this template policy setting, no security level is configured.\r\n\r\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\r\n\r\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowlockeddownrestrictedsiteszonetemplate"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownrestrictedsiteszonetemplate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownrestrictedsiteszonetemplate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownrestrictedsiteszonetemplate_iz_partnamerestrictedsiteszonelockdowntemplate","displayName":"Locked-Down Restricted Sites (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownrestrictedsiteszonetemplate_iz_partnamerestrictedsiteszonelockdowntemplate_1","displayName":"Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownrestrictedsiteszonetemplate_iz_partnamerestrictedsiteszonelockdowntemplate_2","displayName":"Medium Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownrestrictedsiteszonetemplate_iz_partnamerestrictedsiteszonelockdowntemplate_3","displayName":"Medium","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownrestrictedsiteszonetemplate_iz_partnamerestrictedsiteszonelockdowntemplate_5","displayName":"Medium High","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowlockeddownrestrictedsiteszonetemplate_iz_partnamerestrictedsiteszonelockdowntemplate_4","displayName":"High","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowonewordentry","displayName":"Go to an intranet site for a one-word entry in the Address bar (User)","description":"This policy allows the user to go directly to an intranet site for a one-word entry in the Address bar.\r\n\r\nIf you enable this policy setting, Internet Explorer goes directly to an intranet site for a one-word entry in the Address bar, if it is available.\r\n\r\nIf you disable or do not configure this policy setting, Internet Explorer does not go directly to an intranet site for a one-word entry in the Address bar.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowonewordentry"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowonewordentry_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowonewordentry_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowsavetargetasiniemode","displayName":"Allow \"Save Target As\" in Internet Explorer mode (User)","description":"This policy setting allows admins to enable \"Save Target As\" context menu in Internet Explorer mode.\r\n\r\nIf you enable this policy, \"Save Target As\" will show up in the Internet Explorer mode context menu and work the same as Internet Explorer.\r\n\r\nIf you disable or do not configure this policy setting, \"Save Target As\" will not show up in the Internet Explorer mode context menu.\r\n\r\nFor more information, see https://go.microsoft.com/fwlink/?linkid=2102115","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowsavetargetasiniemode"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowsavetargetasiniemode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowsavetargetasiniemode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowsitetozoneassignmentlist","displayName":"Site to Zone Assignment List (User)","description":"This policy setting allows you to manage a list of sites that you want to associate with a particular security zone. These zone numbers have associated security settings that apply to all of the sites in the zone.\r\n\r\nInternet Explorer has 4 security zones, numbered 1-4, and these are used by this policy setting to associate sites to zones. They are: (1) Intranet zone, (2) Trusted Sites zone, (3) Internet zone, and (4) Restricted Sites zone. Security settings can be set for each of these zones through other policy settings, and their default settings are: Trusted Sites zone (Low template), Intranet zone (Medium-Low template), Internet zone (Medium template), and Restricted Sites zone (High template). (The Local Machine zone and its locked down equivalent have special security settings that protect your local computer.)\r\n\r\nIf you enable this policy setting, you can enter a list of sites and their related zone numbers. The association of a site with a zone will ensure that the security settings for the specified zone are applied to the site.  For each entry that you add to the list, enter the following information:\r\n\r\nValuename – A host for an intranet site, or a fully qualified domain name for other sites. The valuename may also include a specific protocol. For example, if you enter http://www.contoso.com as the valuename, other protocols are not affected. If you enter just www.contoso.com, then all protocols are affected for that site, including http, https, ftp, and so on. The site may also be expressed as an IP address (e.g., 127.0.0.1) or range (e.g., 127.0.0.1-10). To avoid creating conflicting policies, do not include additional characters after the domain such as trailing slashes or URL path. For example, policy settings for www.contoso.com and www.contoso.com/mail would be treated as the same policy setting by Internet Explorer, and would therefore be in conflict.\r\n\r\nValue - A number indicating the zone with which this site should be associated for security settings. The Internet Explorer zones described above are 1-4.\r\n\r\nIf you disable or do not configure this policy, users may choose their own site-to-zone assignments.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowsitetozoneassignmentlist"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowsitetozoneassignmentlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowsitetozoneassignmentlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowsitetozoneassignmentlist_iz_zonemapprompt","displayName":"Enter the zone assignments here. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowsitetozoneassignmentlist_iz_zonemapprompt_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowsitetozoneassignmentlist_iz_zonemapprompt_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowslockeddowntrustedsiteszonetemplate","displayName":"Locked-Down Trusted Sites Zone Template (User)","description":"This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\r\n\r\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.\r\n\r\nIf you disable this template policy setting, no security level is configured.\r\n\r\nIf you do not configure this template policy setting, no security level is configured.\r\n\r\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\r\n\r\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowslockeddowntrustedsiteszonetemplate"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowslockeddowntrustedsiteszonetemplate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowslockeddowntrustedsiteszonetemplate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowslockeddowntrustedsiteszonetemplate_iz_partnametrustedsiteszonelockdowntemplate","displayName":"Locked-Down Trusted Sites (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowslockeddowntrustedsiteszonetemplate_iz_partnametrustedsiteszonelockdowntemplate_1","displayName":"Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowslockeddowntrustedsiteszonetemplate_iz_partnametrustedsiteszonelockdowntemplate_2","displayName":"Medium Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowslockeddowntrustedsiteszonetemplate_iz_partnametrustedsiteszonelockdowntemplate_3","displayName":"Medium","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowslockeddowntrustedsiteszonetemplate_iz_partnametrustedsiteszonelockdowntemplate_5","displayName":"Medium High","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowslockeddowntrustedsiteszonetemplate_iz_partnametrustedsiteszonelockdowntemplate_4","displayName":"High","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowsoftwarewhensignatureisinvalid","displayName":"Allow software to run or install even if the signature is invalid (User)","description":"This policy setting allows you to manage whether software, such as ActiveX controls and file downloads, can be installed or run by the user even though the signature is invalid. An invalid signature might indicate that someone has tampered with the file.\r\n\r\nIf you enable this policy setting, users will be prompted to install or run files with an invalid signature.\r\n\r\nIf you disable this policy setting, users cannot run or install files with an invalid signature.\r\n\r\nIf you do not configure this policy, users can choose to run or install files with an invalid signature.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowsoftwarewhensignatureisinvalid"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowsoftwarewhensignatureisinvalid_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowsoftwarewhensignatureisinvalid_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowsrestrictedsiteszonetemplate","displayName":"Restricted Sites Zone Template (User)","description":"This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\r\n\r\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.\r\n\r\nIf you disable this template policy setting, no security level is configured.\r\n\r\nIf you do not configure this template policy setting, no security level is configured.\r\n\r\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\r\n\r\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowsrestrictedsiteszonetemplate"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowsrestrictedsiteszonetemplate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowsrestrictedsiteszonetemplate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowsrestrictedsiteszonetemplate_iz_partnamerestrictedsiteszonetemplate","displayName":"Restricted Sites (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowsrestrictedsiteszonetemplate_iz_partnamerestrictedsiteszonetemplate_1","displayName":"Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowsrestrictedsiteszonetemplate_iz_partnamerestrictedsiteszonetemplate_2","displayName":"Medium Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowsrestrictedsiteszonetemplate_iz_partnamerestrictedsiteszonetemplate_3","displayName":"Medium","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowsrestrictedsiteszonetemplate_iz_partnamerestrictedsiteszonetemplate_5","displayName":"Medium High","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowsrestrictedsiteszonetemplate_iz_partnamerestrictedsiteszonetemplate_4","displayName":"High","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowsuggestedsites","displayName":"Turn on Suggested Sites (User)","description":"This policy setting controls the Suggested Sites feature, which recommends websites based on the user’s browsing activity. Suggested Sites reports a user’s browsing history to Microsoft to suggest sites that the user might want to visit.\r\n\r\nIf you enable this policy setting, the user is not prompted to enable Suggested Sites. The user’s browsing history is sent to Microsoft to produce suggestions.\r\n\r\nIf you disable this policy setting, the entry points and functionality associated with this feature are turned off.\r\n\r\nIf you do not configure this policy setting, the user can turn on and turn off the Suggested Sites feature.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowsuggestedsites"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowsuggestedsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowsuggestedsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowtrustedsiteszonetemplate","displayName":"Trusted Sites Zone Template (User)","description":"This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\r\n\r\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.\r\n\r\nIf you disable this template policy setting, no security level is configured.\r\n\r\nIf you do not configure this template policy setting, no security level is configured.\r\n\r\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\r\n\r\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowtrustedsiteszonetemplate"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowtrustedsiteszonetemplate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowtrustedsiteszonetemplate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_allowtrustedsiteszonetemplate_iz_partnametrustedsiteszonetemplate","displayName":"Trusted Sites (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_allowtrustedsiteszonetemplate_iz_partnametrustedsiteszonetemplate_1","displayName":"Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowtrustedsiteszonetemplate_iz_partnametrustedsiteszonetemplate_2","displayName":"Medium Low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowtrustedsiteszonetemplate_iz_partnametrustedsiteszonetemplate_3","displayName":"Medium","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowtrustedsiteszonetemplate_iz_partnametrustedsiteszonetemplate_5","displayName":"Medium High","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_allowtrustedsiteszonetemplate_iz_partnametrustedsiteszonetemplate_4","displayName":"High","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_autodetectintranet","displayName":"Turn on automatic detection of intranet (User)","description":"This policy setting enables intranet mapping rules to be applied automatically if the computer belongs to a domain.\r\n\r\nIf you enable this policy setting, automatic detection of the intranet is turned on, and intranet mapping rules are applied automatically if the computer belongs to a domain.\r\n\r\nIf you disable this policy setting, automatic detection of the intranet is turned off, and intranet mapping rules are applied however they are configured.\r\n\r\nIf this policy setting is not configured, the user can choose whether or not to automatically detect the intranet through the intranet settings dialog in Control Panel.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-autodetectintranet"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_autodetectintranet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_autodetectintranet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_checkservercertificaterevocation","displayName":"Check for server certificate revocation (User)","description":"This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confidential data to a site that may be fraudulent or not secure.\r\n\r\nIf you enable this policy setting, Internet Explorer will check to see if server certificates have been revoked.\r\n\r\nIf you disable this policy setting, Internet Explorer will not check server certificates to see if they have been revoked.\r\n\r\nIf you do not configure this policy setting, Internet Explorer will not check server certificates to see if they have been revoked.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-checkservercertificaterevocation"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_checkservercertificaterevocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_checkservercertificaterevocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_checksignaturesondownloadedprograms","displayName":"Check for signatures on downloaded programs (User)","description":"This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it hasn't been modified or tampered with) on user computers before downloading executable programs.\r\n\r\nIf you enable this policy setting, Internet Explorer will check the digital signatures of executable programs and display their identities before downloading them to user computers.\r\n\r\nIf you disable this policy setting, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers.\r\n\r\nIf you do not configure this policy, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-checksignaturesondownloadedprograms"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_checksignaturesondownloadedprograms_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_checksignaturesondownloadedprograms_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel","displayName":"Configure which channel of Microsoft Edge to use for opening redirected sites (User)","description":"Enables you to configure up to three versions of Microsoft Edge to open a redirected site (in order of preference). Use this policy if your environment is configured to redirect sites from Internet Explorer 11 to Microsoft Edge. If any of the chosen versions are not installed on the device, that preference will be bypassed.\r\n\r\nIf both the Windows Update for the next version of Microsoft Edge* and Microsoft Edge Stable channel are installed, the following behaviors occur:\r\n- If you disable or don't configure this policy, Microsoft Edge Stable channel is used. This is the default behavior.\r\n- If you enable this policy, you can configure redirected sites to open in up to three of the following channels where:\r\n 1 = Microsoft Edge Stable\r\n 2 = Microsoft Edge Beta version 77 or later\r\n 3 = Microsoft Edge Dev version 77 or later\r\n 4 = Microsoft Edge Canary version 77 or later\r\n\r\nIf the Windows Update for the next version of Microsoft Edge* or Microsoft Edge Stable channel are not installed, the following behaviors occur:\r\n- If you disable or don't configure this policy, Microsoft Edge version 45 or earlier is automatically used. This is the default behavior.\r\n- If you enable this policy, you can configure redirected sites to open in up to three of the following channels where:\r\n 0 = Microsoft Edge version 45 or earlier\r\n 1 = Microsoft Edge Stable\r\n 2 = Microsoft Edge Beta version 77 or later\r\n 3 = Microsoft Edge Dev version 77 or later\r\n 4 = Microsoft Edge Canary version 77 or later\r\n\r\n*For more information about the Windows update for the next version of Microsoft Edge including how to disable it, see https://go.microsoft.com/fwlink/?linkid=2102115. This update applies only to Windows 10 version 1709 and higher.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-configureedgeredirectchannel"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser","displayName":"First choice (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser_","displayName":"","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser_1","displayName":"Microsoft Edge Stable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser_2","displayName":"Microsoft Edge Beta version 77 or later","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser_3","displayName":"Microsoft Edge Dev version 77 or later","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser_4","displayName":"Microsoft Edge Canary version 77 or later","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser_0","displayName":"Microsoft Edge version 45 or earlier","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser2","displayName":"Second choice (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser2_","displayName":"","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser2_1","displayName":"Microsoft Edge Stable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser2_2","displayName":"Microsoft Edge Beta version 77 or later","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser2_3","displayName":"Microsoft Edge Dev version 77 or later","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser2_4","displayName":"Microsoft Edge Canary version 77 or later","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser2_0","displayName":"Microsoft Edge version 45 or earlier","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser3","displayName":"Third choice (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser3_","displayName":"","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser3_1","displayName":"Microsoft Edge Stable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser3_2","displayName":"Microsoft Edge Beta version 77 or later","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser3_3","displayName":"Microsoft Edge Dev version 77 or later","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser3_4","displayName":"Microsoft Edge Canary version 77 or later","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_configureedgeredirectchannel_neededgebrowser3_0","displayName":"Microsoft Edge version 45 or earlier","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_consistentmimehandlinginternetexplorerprocesses","displayName":"Internet Explorer Processes (User)","description":"Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server.\r\n\r\nThis policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME sniff indicates that the file is really an executable file, Internet Explorer renames the file by saving it in the Internet Explorer cache and changing its extension.\r\n\r\nIf you enable this policy setting, Internet Explorer requires consistent MIME data for all received files.\r\n\r\nIf you disable this policy setting, Internet Explorer will not require consistent MIME data for all received files.\r\n\r\nIf you do not configure this policy setting, Internet Explorer requires consistent MIME data for all received files.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-consistentmimehandlinginternetexplorerprocesses"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_consistentmimehandlinginternetexplorerprocesses_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_consistentmimehandlinginternetexplorerprocesses_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disableactivexversionlistautodownload","displayName":"Turn off automatic download of the ActiveX VersionList (User)","description":"This setting determines whether IE automatically downloads updated versions of Microsoft’s VersionList.XML. IE uses this file to determine whether an ActiveX control should be stopped from loading.\r\n\r\nIf you enable this setting, IE stops downloading updated versions of VersionList.XML. Turning off this automatic download breaks the out-of-date ActiveX control blocking feature by not letting the version list update with newly outdated controls, potentially compromising the security of your computer.\r\n\r\nIf you disable or don't configure this setting, IE continues to download updated versions of VersionList.XML.\r\n\r\nFor more information, see \"Out-of-date ActiveX control blocking\" in the Internet Explorer TechNet library.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disableactivexversionlistautodownload"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disableactivexversionlistautodownload_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableactivexversionlistautodownload_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disableadobeflash","displayName":"Turn off Adobe Flash in Internet Explorer and prevent applications from using Internet Explorer technology to instantiate Flash objects (User)","description":"This policy setting turns off Adobe Flash in Internet Explorer and prevents applications from using Internet Explorer technology to instantiate Flash objects.\r\n\r\nIf you enable this policy setting, Flash is turned off for Internet Explorer, and applications cannot use Internet Explorer technology to instantiate Flash objects. In the Manage Add-ons dialog box, the Flash status will be 'Disabled', and users cannot enable Flash. If you enable this policy setting, Internet Explorer will ignore settings made for Adobe Flash through the \"Add-on List\" and \"Deny all add-ons unless specifically allowed in the Add-on List\" policy settings.\r\n\r\nIf you disable, or do not configure this policy setting, Flash is turned on for Internet Explorer, and applications can use Internet Explorer technology to instantiate Flash objects. Users can enable or disable Flash in the Manage Add-ons dialog box.\r\n\r\nNote that Adobe Flash can still be disabled through the \"Add-on List\" and \"Deny all add-ons unless specifically allowed in the Add-on List\" policy settings, even if this policy setting is disabled, or not configured. However, if Adobe Flash is disabled through the \"Add-on List\" and \"Deny all add-ons unless specifically allowed in the Add-on List\" policy settings and not through this policy setting, all applications that use Internet Explorer technology to instantiate Flash object can still do so. For more information, see \"Group Policy Settings in Internet Explorer 10\" in the Internet Explorer TechNet library.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-InternetExplorer#internetexplorer-disableadobeflash"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disableadobeflash_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableadobeflash_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disablebypassofsmartscreenwarnings","displayName":"Prevent bypassing SmartScreen Filter warnings (User)","description":"This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter prevents the user from browsing to or downloading from sites that are known to host malicious content. SmartScreen Filter also prevents the execution of files that are known to be malicious.\r\n\r\nIf you enable this policy setting, SmartScreen Filter warnings block the user.\r\n\r\nIf you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disablebypassofsmartscreenwarnings"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disablebypassofsmartscreenwarnings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disablebypassofsmartscreenwarnings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disablebypassofsmartscreenwarningsaboutuncommonfiles","displayName":"Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet (User)","description":"This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter warns the user about executable files that Internet Explorer users do not commonly download from the Internet.\r\n\r\nIf you enable this policy setting, SmartScreen Filter warnings block the user.\r\n\r\nIf you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disablebypassofsmartscreenwarningsaboutuncommonfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disablebypassofsmartscreenwarningsaboutuncommonfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disablecompatview","displayName":"Turn off Compatibility View (User)","description":"This policy setting controls the Compatibility View feature, which allows the user to fix website display problems that he or she may encounter while browsing.\r\n\r\nIf you enable this policy setting, the user cannot use the Compatibility View button or manage the Compatibility View sites list.\r\n\r\nIf you disable or do not configure this policy setting, the user can use the Compatibility View button and manage the Compatibility View sites list.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disablecompatview"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disablecompatview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disablecompatview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disableconfiguringhistory","displayName":"Disable \"Configuring History\" (User)","description":"This setting specifies the number of days that Internet Explorer tracks views of pages in the History List. To access the Temporary Internet Files and History Settings dialog box, from the Menu bar, on the Tools menu, click Internet Options, click the General tab, and then click Settings under Browsing history.\r\n\r\nIf you enable this policy setting, a user cannot set the number of days that Internet Explorer tracks views of the pages in the History List. You must specify the number of days that Internet Explorer tracks views of pages in the History List. Users can not delete browsing history.\r\n\r\nIf you disable or do not configure this policy setting, a user can set the number of days that Internet Explorer tracks views of pages in the History list. Users can delete browsing history.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disableconfiguringhistory"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disableconfiguringhistory_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableconfiguringhistory_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disableconfiguringhistory_daystokeep_prompt","displayName":"Days to keep pages in History (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disablecrashdetection","displayName":"Turn off Crash Detection (User)","description":"This policy setting allows you to manage the crash detection feature of add-on Management.\r\n\r\nIf you enable this policy setting, a crash in Internet Explorer will exhibit behavior found in Windows XP Professional Service Pack 1 and earlier, namely to invoke Windows Error Reporting. All policy settings for Windows Error Reporting continue to apply.\r\n\r\nIf you disable or do not configure this policy setting, the crash detection feature for add-on management will be functional.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disablecrashdetection"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disablecrashdetection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disablecrashdetection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disablecustomerexperienceimprovementprogramparticipation","displayName":"Prevent participation in the Customer Experience Improvement Program (User)","description":"This policy setting prevents the user from participating in the Customer Experience Improvement Program (CEIP).\r\n\r\nIf you enable this policy setting, the user cannot participate in the CEIP, and the Customer Feedback Options command does not appear on the Help menu.\r\n\r\nIf you disable this policy setting, the user must participate in the CEIP, and the Customer Feedback Options command does not appear on the Help menu.\r\n\r\nIf you do not configure this policy setting, the user can choose to participate in the CEIP.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disablecustomerexperienceimprovementprogramparticipation"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disablecustomerexperienceimprovementprogramparticipation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disablecustomerexperienceimprovementprogramparticipation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disabledeletinguservisitedwebsites","displayName":"Prevent deleting websites that the user has visited (User)","description":"This policy setting prevents the user from deleting the history of websites that he or she has visited. This feature is available in the Delete Browsing History dialog box.\r\n\r\nIf you enable this policy setting, websites that the user has visited are preserved when he or she clicks Delete.\r\n\r\nIf you disable this policy setting, websites that the user has visited are deleted when he or she clicks Delete.\r\n\r\nIf you do not configure this policy setting, the user can choose whether to delete or preserve visited websites when he or she clicks Delete.\r\n\r\nIf the \"Prevent access to Delete Browsing History\" policy setting is enabled, this policy setting is enabled by default.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disabledeletinguservisitedwebsites"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disabledeletinguservisitedwebsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disabledeletinguservisitedwebsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disableenclosuredownloading","displayName":"Prevent downloading of enclosures (User)","description":"This policy setting prevents the user from having enclosures (file attachments) downloaded from a feed to the user's computer.\r\n\r\nIf you enable this policy setting, the user cannot set the Feed Sync Engine to download an enclosure through the Feed property page. A developer cannot change the download setting through the Feed APIs.\r\n\r\nIf you disable or do not configure this policy setting, the user can set the Feed Sync Engine to download an enclosure through the Feed property page. A developer can change the download setting through the Feed APIs.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disableenclosuredownloading"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disableenclosuredownloading_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableenclosuredownloading_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport","displayName":"Turn off encryption support (User)","description":"This policy setting allows you to turn off support for Transport Layer Security (TLS) 1.0, TLS 1.1, TLS 1.2, Secure Sockets Layer (SSL) 2.0, or SSL 3.0 in the browser. TLS and SSL are protocols that help protect communication between the browser and the target server. When the browser attempts to set up a protected communication with the target server, the browser and server negotiate which protocol and version to use. The browser and server attempt to match each other’s list of supported protocols and versions, and they select the most preferred match.\r\n\r\nIf you enable this policy setting, the browser negotiates or does not negotiate an encryption tunnel by using the encryption methods that you select from the drop-down list.\r\n\r\nIf you disable or do not configure this policy setting, the user can select which encryption method the browser supports.\r\n\r\nNote: SSL 2.0 is off by default and is no longer supported starting with Windows 10 Version 1607. SSL 2.0 is an outdated security protocol, and enabling SSL 2.0 impairs the performance and functionality of TLS 1.0.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disableencryptionsupport"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions","displayName":"Secure Protocol combinations (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_0","displayName":"Use no secure protocols","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_8","displayName":"[Obsolete] Only use SSL 2.0","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_32","displayName":"Only use SSL 3.0","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_40","displayName":"[Obsolete] Use SSL 2.0 and SSL 3.0","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_128","displayName":"Only use TLS 1.0","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_136","displayName":"[Obsolete] Use SSL 2.0 and TLS 1.0","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_160","displayName":"Use SSL 3.0 and TLS 1.0","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_168","displayName":"[Obsolete] Use SSL 2.0, SSL 3.0, and TLS 1.0","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_512","displayName":"Only use TLS 1.1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_520","displayName":"[Obsolete] Use SSL 2.0 and TLS 1.1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_544","displayName":"Use SSL 3.0 and TLS 1.1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_552","displayName":"[Obsolete] Use SSL 2.0, SSL 3.0, and TLS 1.1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_640","displayName":"Use TLS 1.0 and TLS 1.1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_648","displayName":"[Obsolete] Use SSL 2.0, TLS 1.0, and TLS 1.1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_672","displayName":"Use SSL 3.0, TLS 1.0, and TLS 1.1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_680","displayName":"[Obsolete] Use SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_2048","displayName":"Only use TLS 1.2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_2056","displayName":"[Obsolete] Use SSL 2.0 and TLS 1.2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_2080","displayName":"Use SSL 3.0 and TLS 1.2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_2088","displayName":"[Obsolete] Use SSL 2.0, SSL 3.0, and TLS 1.2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_2176","displayName":"Use TLS 1.0 and TLS 1.2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_2184","displayName":"[Obsolete] Use SSL 2.0, TLS 1.0, and TLS 1.2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_2208","displayName":"Use SSL 3.0, TLS 1.0, and TLS 1.2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_2216","displayName":"[Obsolete] Use SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_2560","displayName":"Use TLS 1.1 and TLS 1.2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_2568","displayName":"[Obsolete] Use SSL 2.0, TLS 1.1, and TLS 1.2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_2592","displayName":"Use SSL 3.0, TLS 1.1, and TLS 1.2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_2600","displayName":"[Obsolete] Use SSL 2.0, SSL 3.0, TLS 1.1, and TLS 1.2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_2688","displayName":"Use TLS 1.0, TLS 1.1, and TLS 1.2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_2696","displayName":"[Obsolete] Use SSL 2.0, TLS 1.0, TLS 1.1, and TLS 1.2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_2720","displayName":"Use SSL 3.0, TLS 1.0, TLS 1.1, and TLS 1.2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_2728","displayName":"[Obsolete] Use SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1, and TLS 1.2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_8192","displayName":"Only use TLS 1.3","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_10240","displayName":"Use TLS 1.2 and TLS 1.3","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_10752","displayName":"Use TLS 1.1, TLS 1.2, and TLS 1.3","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_10880","displayName":"Use TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableencryptionsupport_advanced_wininetprotocoloptions_10912","displayName":"Use SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disablefeedsbackgroundsync","displayName":"Turn off background synchronization for feeds and Web Slices (User)","description":"This policy setting controls whether to have background synchronization for feeds and Web Slices.\r\n\r\nIf you enable this policy setting, the ability to synchronize feeds and Web Slices in the background is turned off.\r\n\r\nIf you disable or do not configure this policy setting, the user can synchronize feeds and Web Slices in the background.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disablefeedsbackgroundsync"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disablefeedsbackgroundsync_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disablefeedsbackgroundsync_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disablefirstrunwizard","displayName":"Prevent running First Run wizard (User)","description":"This policy setting prevents Internet Explorer from running the First Run wizard the first time a user starts the browser after installing Internet Explorer or Windows.\r\n\r\nIf you enable this policy setting, you must make one of the following choices:\r\n • Skip the First Run wizard, and go directly to the user's home page.\r\n • Skip the First Run wizard, and go directly to the \"Welcome to Internet Explorer\" webpage.\r\n\r\nStarting with Windows 8, the \"Welcome to Internet Explorer\" webpage is not available. The user's home page will display regardless of which option is chosen.\r\n\r\nIf you disable or do not configure this policy setting, Internet Explorer may run the First Run wizard the first time the browser is started after installation.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disablefirstrunwizard"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disablefirstrunwizard_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disablefirstrunwizard_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disablefirstrunwizard_firstrunoptions","displayName":"Select your choice (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disablefirstrunwizard_firstrunoptions_1","displayName":"Go directly to home page","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disablefirstrunwizard_firstrunoptions_2","displayName":"Go directly to \"Welcome To IE\" page","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disableflipaheadfeature","displayName":"Turn off the flip ahead with page prediction feature (User)","description":"This policy setting determines whether a user can swipe across a screen or click Forward to go to the next pre-loaded page of a website.\r\n\r\nMicrosoft collects your browsing history to improve how flip ahead with page prediction works. This feature isn't available for Internet Explorer for the desktop.\r\n\r\nIf you enable this policy setting, flip ahead with page prediction is turned off and the next webpage isn't loaded into the background.\r\n\r\nIf you disable this policy setting, flip ahead with page prediction is turned on and the next webpage is loaded into the background.\r\n\r\nIf you don't configure this setting, users can turn this behavior on or off, using the Settings charm.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disableflipaheadfeature"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disableflipaheadfeature_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableflipaheadfeature_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disablegeolocation","displayName":"Turn off browser geolocation (User)","description":"This policy setting allows you to disable browser geolocation support. This will prevent websites from requesting location data about the user.\r\n\r\nIf you enable this policy setting, browser geolocation support is turned off.\r\n\r\nIf you disable this policy setting, browser geolocation support is turned on.\r\n\r\nIf you do not configure this policy setting, browser geolocation support can be turned on or off in Internet Options on the Privacy tab.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disablegeolocation"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disablegeolocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disablegeolocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disablehomepagechange","displayName":"Disable changing home page settings (User)","description":"The Home page specified on the General tab of the Internet Options dialog box is the default Web page that Internet Explorer loads whenever it is run.\r\n\r\nIf you enable this policy setting, a user cannot set a custom default home page. You must specify which default home page should load on the user machine. For machines with at least Internet Explorer 7, the home page can be set within this policy to override other home page policies.\r\n\r\nIf you disable or do not configure this policy setting, the Home page box is enabled and users can choose their own home page.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disablehomepagechange"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disablehomepagechange_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disablehomepagechange_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disablehomepagechange_enterhomepageprompt","displayName":"Home Page (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disablehtmlapplication","displayName":"Disable HTML Application (User)","description":"This policy setting specifies if running the HTML Application (HTA file) is blocked or allowed.\r\n\r\nIf you enable this policy setting, running the HTML Application (HTA file) will be blocked.\r\n\r\nIf you disable or do not configure this policy setting, running the HTML Application (HTA file) is allowed.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disablehtmlapplication"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disablehtmlapplication_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disablehtmlapplication_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disableignoringcertificateerrors","displayName":"Prevent ignoring certificate errors (User)","description":"This policy setting prevents the user from ignoring Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt browsing (such as \"expired\", \"revoked\", or \"name mismatch\" errors) in Internet Explorer.\r\n\r\nIf you enable this policy setting, the user cannot continue browsing.\r\n\r\nIf you disable or do not configure this policy setting, the user can choose to ignore certificate errors and continue browsing.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disableignoringcertificateerrors"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disableignoringcertificateerrors_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableignoringcertificateerrors_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disableinprivatebrowsing","displayName":"Turn off InPrivate Browsing (User)","description":"This policy setting allows you to turn off the InPrivate Browsing feature.\r\n\r\nInPrivate Browsing prevents Internet Explorer from storing data about a user's browsing session. This includes cookies, temporary Internet files, history, and other data.\r\n\r\nIf you enable this policy setting, InPrivate Browsing is turned off.\r\n\r\nIf you disable this policy setting, InPrivate Browsing is available for use.\r\n\r\nIf you do not configure this policy setting, InPrivate Browsing can be turned on or off through the registry.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disableinprivatebrowsing"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disableinprivatebrowsing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableinprivatebrowsing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disableinternetexplorerapp","displayName":"[Deprecated] Disable Internet Explorer 11 as a standalone browser (User)","description":"This policy lets you restrict launching of Internet Explorer as a standalone browser.\r\n\r\nIf you enable this policy, it:\r\n- Prevents Internet Explorer 11 from launching as a standalone browser.\r\n- Restricts Internet Explorer's usage to Microsoft Edge's native 'Internet Explorer mode'.\r\n- Redirects all attempts at launching Internet Explorer 11 to Microsoft Edge Stable Channel browser.\r\n- Overrides any other policies that redirect to Internet Explorer 11.\r\n\r\nIf you disable, or don’t configure this policy, all sites are opened using the current active browser settings. Note: Microsoft Edge Stable Channel must be installed for this policy to take effect.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disableinternetexplorerapp"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disableinternetexplorerapp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableinternetexplorerapp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disableinternetexplorerapp_v2","displayName":"Disable Internet Explorer 11 as a standalone browser (User)","description":"This policy lets you restrict launching of Internet Explorer as a standalone browser.\r\n\r\nIf you enable this policy, it:\r\n- Prevents Internet Explorer 11 from launching as a standalone browser.\r\n- Restricts Internet Explorer's usage to Microsoft Edge's native 'Internet Explorer mode'.\r\n- Redirects attempts at launching Internet Explorer 11 to Microsoft Edge Stable Channel browser.\r\n- Overrides any other policies that redirect to Internet Explorer 11.\r\n\r\nEven with this policy enabled launching Internet Explorer 11 using COM automation will still be allowed. To disable COM automation launches of Internet Explorer 11 use the \"Disable Internet Explorer 11 COM Automation\" group policy.\r\n\r\nIf you disable, or don’t configure this policy, all sites are opened using the current active browser settings. Note: Microsoft Edge Stable Channel must be installed for this policy to take effect.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disableinternetexplorerapp"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disableinternetexplorerapp_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableinternetexplorerapp_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disableinternetexplorerapp_v2_notifydisableieoptions","displayName":"Notify that Internet Explorer 11 browser is disabled (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disableinternetexplorerapp_v2_notifydisableieoptions_0","displayName":"Never","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableinternetexplorerapp_v2_notifydisableieoptions_1","displayName":"Always","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableinternetexplorerapp_v2_notifydisableieoptions_2","displayName":"Once per user","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disableinternetexplorerlaunchviacom","displayName":"Disable Internet Explorer 11 Launch Via COM Automation (User)","description":"This policy lets you restrict launching of Internet Explorer using COM automation.\r\n\r\nIf you enable this policy, it prevents Internet Explorer 11 from being launched using COM automation.\r\n\r\nIf you disable, or don’t configure this policy, Internet Explorer 11 COM automation launches are allowed.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disableinternetexplorerlaunchviacom"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disableinternetexplorerlaunchviacom_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableinternetexplorerlaunchviacom_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disableprocessesinenhancedprotectedmode","displayName":"Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows (User)","description":"This policy setting determines whether Internet Explorer 11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on 64-bit versions of Windows.\r\n\r\nImportant: Some ActiveX controls and toolbars may not be available when 64-bit processes are used.\r\n\r\nIf you enable this policy setting, Internet Explorer 11 will use 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.\r\n\r\nIf you disable this policy setting, Internet Explorer 11 will use 32-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.\r\n\r\nIf you don't configure this policy setting, users can turn this feature on or off using Internet Explorer settings. This feature is turned off by default.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disableprocessesinenhancedprotectedmode"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disableprocessesinenhancedprotectedmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableprocessesinenhancedprotectedmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disableproxychange","displayName":"Prevent changing proxy settings (User)","description":"This policy setting specifies if a user can change proxy settings.\r\n\r\nIf you enable this policy setting, the user will not be able to configure proxy settings.\r\n\r\nIf you disable or do not configure this policy setting, the user can configure proxy settings.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disableproxychange"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disableproxychange_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disableproxychange_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disablesearchproviderchange","displayName":"Prevent changing the default search provider (User)","description":"This policy setting prevents the user from changing the default search provider for the Address bar and the toolbar Search box.\r\n\r\nIf you enable this policy setting, the user cannot change the default search provider.\r\n\r\nIf you disable or do not configure this policy setting, the user can change the default search provider.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disablesearchproviderchange"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disablesearchproviderchange_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disablesearchproviderchange_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disablesecondaryhomepagechange","displayName":"Disable changing secondary home page settings (User)","description":"Secondary home pages are the default Web pages that Internet Explorer loads in separate tabs from the home page whenever the browser is run. This policy setting allows you to set default secondary home pages.\r\n\r\nIf you enable this policy setting, you can specify which default home pages should load as secondary home pages. The user cannot set custom default secondary home pages.\r\n\r\nIf you disable or do not configure this policy setting, the user can add secondary home pages.\r\n\r\nNote: If the “Disable Changing Home Page Settings” policy is enabled, the user cannot add secondary home pages.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disablesecondaryhomepagechange"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disablesecondaryhomepagechange_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disablesecondaryhomepagechange_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disablesecondaryhomepagechange_secondaryhomepageslist","displayName":"Secondary home pages (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disablesecuritysettingscheck","displayName":"Turn off the Security Settings Check feature (User)","description":"This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk.\r\n\r\nIf you enable this policy setting, the feature is turned off.\r\n\r\nIf you disable or do not configure this policy setting, the feature is turned on.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disablesecuritysettingscheck"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disablesecuritysettingscheck_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disablesecuritysettingscheck_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_disablewebaddressautocomplete","displayName":"Turn off the auto-complete feature for web addresses (User)","description":"This AutoComplete feature suggests possible matches when users are entering Web addresses in the browser address bar.\r\n\r\nIf you enable this policy setting, user will not be suggested matches when entering Web addresses. The user cannot change the auto-complete for web-address setting.\r\n\r\nIf you disable this policy setting, user will be suggested matches when entering Web addresses. The user cannot change the auto-complete for web-address setting.\r\n\r\nIf you do not configure this policy setting, a user will have the freedom to choose to turn the auto-complete setting for web-addresses on or off.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disablewebaddressautocomplete"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_disablewebaddressautocomplete_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_disablewebaddressautocomplete_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_donotallowactivexcontrolsinprotectedmode","displayName":"Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled (User)","description":"This policy setting prevents ActiveX controls from running in Protected Mode when Enhanced Protected Mode is enabled. When a user has an ActiveX control installed that is not compatible with Enhanced Protected Mode and a website attempts to load the control, Internet Explorer notifies the user and gives the option to run the website in regular Protected Mode. This policy setting disables this notification and forces all websites to run in Enhanced Protected Mode.\r\n\r\nEnhanced Protected Mode provides additional protection against malicious websites by using 64-bit processes on 64-bit versions of Windows. For computers running at least Windows 8, Enhanced Protected Mode also limits the locations Internet Explorer can read from in the registry and the file system.\r\n\r\nWhen Enhanced Protected Mode is enabled, and a user encounters a website that attempts to load an ActiveX control that is not compatible with Enhanced Protected Mode, Internet Explorer notifies the user and gives the option to disable Enhanced Protected Mode for that particular website.\r\n\r\nIf you enable this policy setting, Internet Explorer will not give the user the option to disable Enhanced Protected Mode. All Protected Mode websites will run in Enhanced Protected Mode.\r\n\r\nIf you disable or do not configure this policy setting, Internet Explorer notifies users and provides an option to run websites with incompatible ActiveX controls in regular Protected Mode. This is the default behavior.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-donotallowactivexcontrolsinprotectedmode"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_donotallowactivexcontrolsinprotectedmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_donotallowactivexcontrolsinprotectedmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_donotblockoutdatedactivexcontrols","displayName":"Turn off blocking of outdated ActiveX controls for Internet Explorer (User)","description":"This policy setting determines whether Internet Explorer blocks specific outdated ActiveX controls. Outdated ActiveX controls are never blocked in the Intranet Zone.\r\n\r\nIf you enable this policy setting, Internet Explorer stops blocking outdated ActiveX controls.\r\n\r\nIf you disable or don't configure this policy setting, Internet Explorer continues to block specific outdated ActiveX controls.\r\n\r\nFor more information, see \"Outdated ActiveX Controls\" in the Internet Explorer TechNet library.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-donotblockoutdatedactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_donotblockoutdatedactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_donotblockoutdatedactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_donotblockoutdatedactivexcontrolsonspecificdomains","displayName":"Turn off blocking of outdated ActiveX controls for Internet Explorer on specific domains (User)","description":"This policy setting allows you to manage a list of domains on which Internet Explorer will stop blocking outdated ActiveX controls. Outdated ActiveX controls are never blocked in the Intranet Zone.\r\n\r\nIf you enable this policy setting, you can enter a custom list of domains for which outdated ActiveX controls won't be blocked in Internet Explorer. Each domain entry must be formatted like one of the following:\r\n\r\n1. \"domain.name.TLD\". For example, if you want to include *.contoso.com/*, use \"contoso.com\"\r\n2. \"hostname\". For example, if you want to include http://example, use \"example\"\r\n3. \"file:///path/filename.htm\". For example, use \"file:///C:/Users/contoso/Desktop/index.htm\"\r\n\r\nIf you disable or don't configure this policy setting, the list is deleted and Internet Explorer continues to block specific outdated ActiveX controls on all domains in the Internet Zone.\r\n\r\nFor more information, see \"Outdated ActiveX Controls\" in the Internet Explorer TechNet library.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_donotblockoutdatedactivexcontrolsonspecificdomains_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_donotblockoutdatedactivexcontrolsonspecificdomains_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_donotblockoutdatedactivexcontrolsonspecificdomains_domainlist","displayName":"Domain allow list (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_internetexplorer_enableextendediemodehotkeys","displayName":"Enable extended hot keys in Internet Explorer mode (User)","description":"This policy setting lets admins enable extended Microsoft Edge Internet Explorer mode hotkeys, such as \"Ctrl+S\" to have \"Save as\" functionality.\r\n\r\nIf you enable this policy, extended hotkey functionality is enabled in Internet Explorer mode and work the same as Internet Explorer.\r\n\r\nIf you disable, or don't configure this policy, extended hotkeys will not work in Internet Explorer mode.\r\n\r\nFor more information, see https://go.microsoft.com/fwlink/?linkid=2102115","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-enableextendediemodehotkeys"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_enableextendediemodehotkeys_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_enableextendediemodehotkeys_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_enableglobalwindowlistiniemode","displayName":"Enable global window list in Internet Explorer mode (User)","description":"This setting allows Internet Explorer mode to use the global window list that enables sharing state with other applications.\r\nThe setting will take effect only when Internet Explorer 11 is disabled as a standalone browser.\r\n\r\nIf you enable this policy, Internet Explorer mode will use the global window list.\r\n\r\nIf you disable or don’t configure this policy, Internet Explorer mode will continue to maintain a separate window list.\r\n\r\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2102921\r\nTo learn more about disabling Internet Explorer 11 as a standalone browser, see https://go.microsoft.com/fwlink/?linkid=2168340","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-enableglobalwindowlistiniemode"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_enableglobalwindowlistiniemode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_enableglobalwindowlistiniemode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_includealllocalsites","displayName":"Intranet Sites: Include all local (intranet) sites not listed in other zones (User)","description":"This policy setting controls whether local sites which are not explicitly mapped into any Security Zone are forced into the local Intranet security zone.\r\n\r\nIf you enable this policy setting, local sites which are not explicitly mapped into a zone are considered to be in the Intranet Zone.\r\n\r\nIf you disable this policy setting, local sites which are not explicitly mapped into a zone will not be considered to be in the Intranet Zone (so would typically be in the Internet Zone).\r\n\r\nIf you do not configure this policy setting, users choose whether to force local sites into the Intranet Zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-includealllocalsites"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_includealllocalsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_includealllocalsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_includeallnetworkpaths","displayName":"Intranet Sites: Include all network paths (UNCs) (User)","description":"This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone.\r\n\r\nIf you enable this policy setting, all network paths are mapped into the Intranet Zone.\r\n\r\nIf you disable this policy setting, network paths are not necessarily mapped into the Intranet Zone (other rules might map one there).\r\n\r\nIf you do not configure this policy setting, users choose whether network paths are mapped into the Intranet Zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-includeallnetworkpaths"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_includeallnetworkpaths_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_includeallnetworkpaths_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_includeallproxybypasssites","displayName":"Intranet Sites: Include all sites that bypass the proxy server (User)","description":"This policy setting controls whether sites which bypass the proxy server are mapped into the local Intranet security zone.\r\n\r\nIf you enable this policy setting, sites which bypass the proxy server are mapped into the Intranet Zone.\r\n\r\nIf you disable this policy setting, sites which bypass the proxy server aren't necessarily mapped into the Intranet Zone (other rules might map one there).\r\n\r\nIf you do not configure this policy setting, users choose whether sites which bypass the proxy server are mapped into the Intranet Zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-includeallproxybypasssites"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_includeallproxybypasssites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_includeallproxybypasssites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowaccesstodatasources","displayName":"Access data sources across domains (User)","description":"This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\r\n\r\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneallowaccesstodatasources"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowaccesstodatasources_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowaccesstodatasources_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowaccesstodatasources_iz_partname1406","displayName":"Access data sources across domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowaccesstodatasources_iz_partname1406_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowaccesstodatasources_iz_partname1406_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowaccesstodatasources_iz_partname1406_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowautomaticpromptingforactivexcontrols","displayName":"Automatic prompting for ActiveX controls (User)","description":"This policy setting manages whether users will be automatically prompted for ActiveX control installations.\r\n\r\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\r\n\r\nIf you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.\r\n\r\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowautomaticpromptingforactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowautomaticpromptingforactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowautomaticpromptingforactivexcontrols_iz_partname2201","displayName":"Automatic prompting for ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowautomaticpromptingforactivexcontrols_iz_partname2201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowautomaticpromptingforactivexcontrols_iz_partname2201_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowautomaticpromptingforfiledownloads","displayName":"Automatic prompting for file downloads (User)","description":"This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\r\n\r\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\r\n\r\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowautomaticpromptingforfiledownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowautomaticpromptingforfiledownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowautomaticpromptingforfiledownloads_iz_partname2200","displayName":"Automatic prompting for file downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowautomaticpromptingforfiledownloads_iz_partname2200_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowautomaticpromptingforfiledownloads_iz_partname2200_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowcopypasteviascript","displayName":"Allow cut, copy or paste operations from the clipboard via script (User)","description":"This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\r\n\r\nIf you enable this policy setting, a script can perform a clipboard operation.\r\n\r\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\r\n\r\nIf you disable this policy setting, a script cannot perform a clipboard operation.\r\n\r\nIf you do not configure this policy setting, a script can perform a clipboard operation.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneallowcopypasteviascript"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowcopypasteviascript_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowcopypasteviascript_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowcopypasteviascript_iz_partname1407","displayName":"Allow paste operations via script (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowcopypasteviascript_iz_partname1407_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowcopypasteviascript_iz_partname1407_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowcopypasteviascript_iz_partname1407_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowdraganddropcopyandpastefiles","displayName":"Allow drag and drop or copy and paste files (User)","description":"This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\r\n\r\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\r\n\r\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\r\n\r\nIf you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneallowdraganddropcopyandpastefiles"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowdraganddropcopyandpastefiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowdraganddropcopyandpastefiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowdraganddropcopyandpastefiles_iz_partname1802","displayName":"Allow drag and drop or copy and paste files (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowdraganddropcopyandpastefiles_iz_partname1802_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowdraganddropcopyandpastefiles_iz_partname1802_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowdraganddropcopyandpastefiles_iz_partname1802_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowfontdownloads","displayName":"Allow font downloads (User)","description":"This policy setting allows you to manage whether pages of the zone may download HTML fonts.\r\n\r\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\r\n\r\nIf you disable this policy setting, HTML fonts are prevented from downloading.\r\n\r\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneallowfontdownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowfontdownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowfontdownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowfontdownloads_iz_partname1604","displayName":"Allow font downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowfontdownloads_iz_partname1604_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowfontdownloads_iz_partname1604_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowfontdownloads_iz_partname1604_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowlessprivilegedsites","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.\r\n\r\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\r\n\r\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\r\n\r\nIf you do not configure this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneallowlessprivilegedsites"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowlessprivilegedsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowlessprivilegedsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowlessprivilegedsites_iz_partname2101","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowlessprivilegedsites_iz_partname2101_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowlessprivilegedsites_iz_partname2101_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowlessprivilegedsites_iz_partname2101_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowloadingofxamlfiles","displayName":"Allow loading of XAML files (User)","description":"This policy setting allows you to manage the loading of Extensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that take advantage of the Windows Presentation Foundation.\r\n\r\nIf you enable this policy setting and set the drop-down box to Enable, XAML files are automatically loaded inside Internet Explorer. The user cannot change this behavior. If you set the drop-down box to Prompt, the user is prompted for loading XAML files.\r\n\r\nIf you disable this policy setting, XAML files are not loaded inside Internet Explorer. The user cannot change this behavior.\r\n\r\nIf you do not configure this policy setting, the user can decide whether to load XAML files inside Internet Explorer.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneallowloadingofxamlfiles"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowloadingofxamlfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowloadingofxamlfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowloadingofxamlfiles_iz_partname2402","displayName":"XAML Files (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowloadingofxamlfiles_iz_partname2402_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowloadingofxamlfiles_iz_partname2402_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowloadingofxamlfiles_iz_partname2402_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallownetframeworkreliantcomponents","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\r\n\r\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\r\n\r\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\r\n\r\nIf you do not configure this policy setting, Internet Explorer will execute unsigned managed components.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneallownetframeworkreliantcomponents"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallownetframeworkreliantcomponents_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallownetframeworkreliantcomponents_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallownetframeworkreliantcomponents_iz_partname2004","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallownetframeworkreliantcomponents_iz_partname2004_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallownetframeworkreliantcomponents_iz_partname2004_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallownetframeworkreliantcomponents_iz_partname2004_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowonlyapproveddomainstouseactivexcontrols","displayName":"Allow only approved domains to use ActiveX controls without prompt (User)","description":"This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control.\r\n\r\nIf you enable this policy setting, the user is prompted before ActiveX controls can run from websites in this zone. The user can choose to allow the control to run from the current site or from all sites.\r\n\r\nIf you disable this policy setting, the user does not see the per-site ActiveX prompt, and ActiveX controls can run from all sites in this zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowonlyapproveddomainstouseactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowonlyapproveddomainstouseactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowonlyapproveddomainstouseactivexcontrols_iz_partname120b","displayName":"Only allow approved domains to use ActiveX controls without prompt (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowonlyapproveddomainstouseactivexcontrols_iz_partname120b_3","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowonlyapproveddomainstouseactivexcontrols_iz_partname120b_0","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowonlyapproveddomainstousetdcactivexcontrol","displayName":"Allow only approved domains to use the TDC ActiveX control (User)","description":"This policy setting controls whether or not the user is allowed to run the TDC ActiveX control on websites.\r\n\r\nIf you enable this policy setting, the TDC ActiveX control will not run from websites in this zone.\r\n\r\nIf you disable this policy setting, the TDC Active X control will run from all sites in this zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowonlyapproveddomainstousetdcactivexcontrol_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowonlyapproveddomainstousetdcactivexcontrol_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowonlyapproveddomainstousetdcactivexcontrol_iz_partname120c","displayName":"Only allow approved domains to use the TDC ActiveX control (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowonlyapproveddomainstousetdcactivexcontrol_iz_partname120c_3","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowonlyapproveddomainstousetdcactivexcontrol_iz_partname120c_0","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowscriptingofinternetexplorerwebbrowsercontrols","displayName":"Allow scripting of Internet Explorer WebBrowser controls (User)","description":"This policy setting determines whether a page can control embedded WebBrowser controls via script.\r\n\r\nIf you enable this policy setting, script access to the WebBrowser control is allowed.\r\n\r\nIf you disable this policy setting, script access to the WebBrowser control is not allowed.\r\n\r\nIf you do not configure this policy setting, the user can enable or disable script access to the WebBrowser control. By default, script access to the WebBrowser control is allowed only in the Local Machine and Intranet zones.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowscriptingofinternetexplorerwebbrowsercontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowscriptingofinternetexplorerwebbrowsercontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowscriptingofinternetexplorerwebbrowsercontrols_iz_partname1206","displayName":"Internet Explorer web browser control (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowscriptingofinternetexplorerwebbrowsercontrols_iz_partname1206_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowscriptingofinternetexplorerwebbrowsercontrols_iz_partname1206_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowscriptinitiatedwindows","displayName":"Allow script-initiated windows without size or position constraints (User)","description":"This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\r\n\r\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\r\n\r\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\r\n\r\nIf you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneallowscriptinitiatedwindows"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowscriptinitiatedwindows_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowscriptinitiatedwindows_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowscriptinitiatedwindows_iz_partname2102","displayName":"Allow script-initiated windows without size or position constraints (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowscriptinitiatedwindows_iz_partname2102_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowscriptinitiatedwindows_iz_partname2102_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowscriptlets","displayName":"Allow scriptlets (User)","description":"This policy setting allows you to manage whether the user can run scriptlets.\r\n\r\nIf you enable this policy setting, the user can run scriptlets.\r\n\r\nIf you disable this policy setting, the user cannot run scriptlets.\r\n\r\nIf you do not configure this policy setting, the user can enable or disable scriptlets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneallowscriptlets"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowscriptlets_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowscriptlets_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowscriptlets_iz_partname1209","displayName":"Scriptlets (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowscriptlets_iz_partname1209_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowscriptlets_iz_partname1209_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowsmartscreenie","displayName":"Turn on SmartScreen Filter scan (User)","description":"This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.\r\n\r\nIf you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nNote: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneallowsmartscreenie"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowsmartscreenie_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowsmartscreenie_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowsmartscreenie_iz_partname2301","displayName":"Use SmartScreen Filter (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowsmartscreenie_iz_partname2301_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowsmartscreenie_iz_partname2301_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowupdatestostatusbarviascript","displayName":"Allow updates to status bar via script (User)","description":"This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\r\n\r\nIf you enable this policy setting, script is allowed to update the status bar.\r\n\r\nIf you disable or do not configure this policy setting, script is not allowed to update the status bar.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneallowupdatestostatusbarviascript"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowupdatestostatusbarviascript_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowupdatestostatusbarviascript_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowupdatestostatusbarviascript_iz_partname2103","displayName":"Status bar updates via script (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowupdatestostatusbarviascript_iz_partname2103_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowupdatestostatusbarviascript_iz_partname2103_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowuserdatapersistence","displayName":"Userdata persistence (User)","description":"This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\r\n\r\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneallowuserdatapersistence"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowuserdatapersistence_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowuserdatapersistence_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowuserdatapersistence_iz_partname1606","displayName":"Userdata persistence (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowuserdatapersistence_iz_partname1606_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowuserdatapersistence_iz_partname1606_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowvbscripttorunininternetexplorer","displayName":"Allow VBScript to run in Internet Explorer (User)","description":"This policy setting allows you to manage whether VBScript can be run on pages from the specified zone in Internet Explorer.\r\n\r\nIf you selected Enable in the drop-down box, VBScript can run without user intervention.\r\n\r\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow VBScript to run.\r\n\r\nIf you selected Disable in the drop-down box, VBScript is prevented from running.\r\n\r\nIf you do not configure or disable this policy setting, VBScript is prevented from running.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneallowvbscripttorunininternetexplorer"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowvbscripttorunininternetexplorer_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowvbscripttorunininternetexplorer_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowvbscripttorunininternetexplorer_iz_partname140c","displayName":"Allow VBScript to run in Internet Explorer (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowvbscripttorunininternetexplorer_iz_partname140c_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowvbscripttorunininternetexplorer_iz_partname140c_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneallowvbscripttorunininternetexplorer_iz_partname140c_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedonotrunantimalwareagainstactivexcontrols","displayName":"Don't run antimalware programs against ActiveX controls (User)","description":"This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.\r\n\r\nIf you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.\r\n\r\nIf you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.\r\n\r\nIf you don't configure this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedonotrunantimalwareagainstactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedonotrunantimalwareagainstactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedonotrunantimalwareagainstactivexcontrols_iz_partname270c","displayName":"Don't run antimalware programs against ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedonotrunantimalwareagainstactivexcontrols_iz_partname270c_3","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedonotrunantimalwareagainstactivexcontrols_iz_partname270c_0","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedownloadsignedactivexcontrols","displayName":"Download signed ActiveX controls (User)","description":"This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\r\n\r\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\r\n\r\nIf you disable the policy setting, signed controls cannot be downloaded.\r\n\r\nIf you do not configure this policy setting, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzonedownloadsignedactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedownloadsignedactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedownloadsignedactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedownloadsignedactivexcontrols_iz_partname1001","displayName":"Download signed ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedownloadsignedactivexcontrols_iz_partname1001_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedownloadsignedactivexcontrols_iz_partname1001_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedownloadsignedactivexcontrols_iz_partname1001_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedownloadunsignedactivexcontrols","displayName":"Download unsigned ActiveX controls (User)","description":"This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\r\n\r\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\r\n\r\nIf you disable this policy setting, users cannot run unsigned controls.\r\n\r\nIf you do not configure this policy setting, users cannot run unsigned controls.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzonedownloadunsignedactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedownloadunsignedactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedownloadunsignedactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedownloadunsignedactivexcontrols_iz_partname1004","displayName":"Download unsigned ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedownloadunsignedactivexcontrols_iz_partname1004_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedownloadunsignedactivexcontrols_iz_partname1004_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonedownloadunsignedactivexcontrols_iz_partname1004_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenablecrosssitescriptingfilter","displayName":"Turn on Cross-Site Scripting Filter (User)","description":"This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injections into websites in this zone.\r\n\r\nIf you enable this policy setting, the XSS Filter is turned on for sites in this zone, and the XSS Filter attempts to block cross-site script injections.\r\n\r\nIf you disable this policy setting, the XSS Filter is turned off for sites in this zone, and Internet Explorer permits cross-site script injections.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneenablecrosssitescriptingfilter"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenablecrosssitescriptingfilter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenablecrosssitescriptingfilter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenablecrosssitescriptingfilter_iz_partname1409","displayName":"Turn on Cross-Site Scripting (XSS) Filter (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenablecrosssitescriptingfilter_iz_partname1409_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenablecrosssitescriptingfilter_iz_partname1409_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows","displayName":"Enable dragging of content from different domains across windows (User)","description":"This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows.\r\n\r\nIf you enable this policy setting and click Enable, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting.\r\n\r\nIf you enable this policy setting and click Disable, users cannot drag content from one domain to a different domain when both the source and destination are in different windows. Users cannot change this setting.\r\n\r\nIn Internet Explorer 10, if you disable this policy setting or do not configure it, users cannot drag content from one domain to a different domain when the source and destination are in different windows. Users can change this setting in the Internet Options dialog.\r\n\r\nIn Internet Explorer 9 and earlier versions, if you disable this policy or do not configure it, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows_iz_partname2709","displayName":"Enable dragging of content from different domains across windows (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows_iz_partname2709_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows_iz_partname2709_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows","displayName":"Enable dragging of content from different domains within a window (User)","description":"This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window.\r\n\r\nIf you enable this policy setting and click Enable, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting.\r\n\r\nIf you enable this policy setting and click Disable, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog.\r\n\r\nIn Internet Explorer 10, if you disable this policy setting or do not configure it, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users can change this setting in the Internet Options dialog.\r\n\r\nIn Internet Explorer 9 and earlier versions, if you disable this policy setting or do not configure it, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows_iz_partname2708","displayName":"Enable dragging of content from different domains within a window (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows_iz_partname2708_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows_iz_partname2708_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenablemimesniffing","displayName":"Enable MIME Sniffing (User)","description":"This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\r\n\r\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\r\n\r\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\r\n\r\nIf you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneenablemimesniffing"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenablemimesniffing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenablemimesniffing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenablemimesniffing_iz_partname2100","displayName":"Enable MIME Sniffing (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenablemimesniffing_iz_partname2100_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenablemimesniffing_iz_partname2100_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenableprotectedmode","displayName":"Turn on Protected Mode (User)","description":"This policy setting allows you to turn on Protected Mode. Protected Mode helps protect Internet Explorer from exploited vulnerabilities by reducing the locations that Internet Explorer can write to in the registry and the file system.\r\n\r\nIf you enable this policy setting, Protected Mode is turned on. The user cannot turn off Protected Mode.\r\n\r\nIf you disable this policy setting, Protected Mode is turned off. The user cannot turn on Protected Mode.\r\n\r\nIf you do not configure this policy setting, the user can turn on or turn off Protected Mode.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneenableprotectedmode"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenableprotectedmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenableprotectedmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenableprotectedmode_iz_partname2500","displayName":"Protected Mode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenableprotectedmode_iz_partname2500_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneenableprotectedmode_iz_partname2500_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneincludelocalpathwhenuploadingfilestoserver","displayName":"Include local path when user is uploading files to a server (User)","description":"This policy setting controls whether or not local path information is sent when the user is uploading a file via an HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. For instance, files sent from the user's desktop may contain the user name as a part of the path.\r\n\r\nIf you enable this policy setting, path information is sent when the user is uploading a file via an HTML form.\r\n\r\nIf you disable this policy setting, path information is removed when the user is uploading a file via an HTML form.\r\n\r\nIf you do not configure this policy setting, the user can choose whether path information is sent when he or she is uploading a file via an HTML form. By default, path information is sent.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneincludelocalpathwhenuploadingfilestoserver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneincludelocalpathwhenuploadingfilestoserver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneincludelocalpathwhenuploadingfilestoserver_iz_partname160a","displayName":"Include local directory path when uploading files to a server (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneincludelocalpathwhenuploadingfilestoserver_iz_partname160a_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneincludelocalpathwhenuploadingfilestoserver_iz_partname160a_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneinitializeandscriptactivexcontrols","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"This policy setting allows you to manage ActiveX controls not marked as safe.\r\n\r\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\r\n\r\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\r\n\r\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\r\n\r\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneinitializeandscriptactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneinitializeandscriptactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneinitializeandscriptactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneinitializeandscriptactivexcontrols_iz_partname1201","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneinitializeandscriptactivexcontrols_iz_partname1201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneinitializeandscriptactivexcontrols_iz_partname1201_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneinitializeandscriptactivexcontrols_iz_partname1201_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonejavapermissions","displayName":"Java permissions (User)","description":"This policy setting allows you to manage permissions for Java applets.\r\n\r\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\r\n\r\nLow Safety enables applets to perform all operations.\r\n\r\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.\r\n\r\nHigh Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.\r\n\r\nIf you disable this policy setting, Java applets cannot run.\r\n\r\nIf you do not configure this policy setting, the permission is set to High Safety.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzonejavapermissions"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonejavapermissions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonejavapermissions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonejavapermissions_iz_partname1c00","displayName":"Java permissions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonejavapermissions_iz_partname1c00_65536","displayName":"High safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonejavapermissions_iz_partname1c00_131072","displayName":"Medium safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonejavapermissions_iz_partname1c00_196608","displayName":"Low safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonejavapermissions_iz_partname1c00_8388608","displayName":"Custom","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonejavapermissions_iz_partname1c00_0","displayName":"Disable Java","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonelaunchingapplicationsandfilesiniframe","displayName":"Launching applications and files in an IFRAME (User)","description":"This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone.\r\n\r\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\r\n\r\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\r\n\r\nIf you do not configure this policy setting, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonelaunchingapplicationsandfilesiniframe_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonelaunchingapplicationsandfilesiniframe_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonelaunchingapplicationsandfilesiniframe_iz_partname1804","displayName":"Launching applications and files in an IFRAME (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonelaunchingapplicationsandfilesiniframe_iz_partname1804_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonelaunchingapplicationsandfilesiniframe_iz_partname1804_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonelaunchingapplicationsandfilesiniframe_iz_partname1804_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonelogonoptions","displayName":"Logon options (User)","description":"This policy setting allows you to manage settings for logon options.\r\n\r\nIf you enable this policy setting, you can choose from the following logon options.\r\n\r\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\r\n\r\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\r\n\r\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\r\n\r\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\r\n\r\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\r\n\r\nIf you do not configure this policy setting, logon is set to Automatic logon only in Intranet zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzonelogonoptions"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonelogonoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonelogonoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonelogonoptions_iz_partname1a00","displayName":"Logon options (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonelogonoptions_iz_partname1a00_196608","displayName":"Anonymous logon","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonelogonoptions_iz_partname1a00_131072","displayName":"Automatic logon only in Intranet zone","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonelogonoptions_iz_partname1a00_0","displayName":"Automatic logon with current username and password","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonelogonoptions_iz_partname1a00_65536","displayName":"Prompt for user name and password","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonenavigatewindowsandframes","displayName":"Navigate windows and frames across different domains (User)","description":"This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\r\n\r\nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\r\n\r\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\r\n\r\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzonenavigatewindowsandframes"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonenavigatewindowsandframes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonenavigatewindowsandframes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonenavigatewindowsandframes_iz_partname1607","displayName":"Navigate windows and frames across different domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonenavigatewindowsandframes_iz_partname1607_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonenavigatewindowsandframes_iz_partname1607_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonenavigatewindowsandframes_iz_partname1607_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonerunnetframeworkreliantcomponentssignedwithauthenticode","displayName":"Run .NET Framework-reliant components signed with Authenticode (User)","description":"This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\r\n\r\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\r\n\r\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\r\n\r\nIf you do not configure this policy setting, Internet Explorer will execute signed managed components.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonerunnetframeworkreliantcomponentssignedwithauthenticode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonerunnetframeworkreliantcomponentssignedwithauthenticode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonerunnetframeworkreliantcomponentssignedwithauthenticode_iz_partname2001","displayName":"Run .NET Framework-reliant components signed with Authenticode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonerunnetframeworkreliantcomponentssignedwithauthenticode_iz_partname2001_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonerunnetframeworkreliantcomponentssignedwithauthenticode_iz_partname2001_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzonerunnetframeworkreliantcomponentssignedwithauthenticode_iz_partname2001_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneshowsecuritywarningforpotentiallyunsafefiles","displayName":"Show security warning for potentially unsafe files (User)","description":"This policy setting controls whether or not the \"Open File - Security Warning\" message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file share by using File Explorer, for example).\r\n\r\nIf you enable this policy setting and set the drop-down box to Enable, these files open without a security warning. If you set the drop-down box to Prompt, a security warning appears before the files open.\r\n\r\nIf you disable this policy setting, these files do not open.\r\n\r\nIf you do not configure this policy setting, the user can configure how the computer handles these files. By default, these files are blocked in the Restricted zone, enabled in the Intranet and Local Computer zones, and set to prompt in the Internet and Trusted zones.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneshowsecuritywarningforpotentiallyunsafefiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneshowsecuritywarningforpotentiallyunsafefiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneshowsecuritywarningforpotentiallyunsafefiles_iz_partname1806","displayName":"Launching programs and unsafe files (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneshowsecuritywarningforpotentiallyunsafefiles_iz_partname1806_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneshowsecuritywarningforpotentiallyunsafefiles_iz_partname1806_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneshowsecuritywarningforpotentiallyunsafefiles_iz_partname1806_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneusepopupblocker","displayName":"Use Pop-up Blocker (User)","description":"This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\r\n\r\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\r\n\r\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\r\n\r\nIf you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-internetzoneusepopupblocker"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneusepopupblocker_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneusepopupblocker_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneusepopupblocker_iz_partname1809","displayName":"Use Pop-up Blocker (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneusepopupblocker_iz_partname1809_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_internetzoneusepopupblocker_iz_partname1809_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowaccesstodatasources","displayName":"Access data sources across domains (User)","description":"This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\r\n\r\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you do not configure this policy setting, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-intranetzoneallowaccesstodatasources"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowaccesstodatasources_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowaccesstodatasources_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowaccesstodatasources_iz_partname1406","displayName":"Access data sources across domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowaccesstodatasources_iz_partname1406_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowaccesstodatasources_iz_partname1406_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowaccesstodatasources_iz_partname1406_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowautomaticpromptingforactivexcontrols","displayName":"Automatic prompting for ActiveX controls (User)","description":"This policy setting manages whether users will be automatically prompted for ActiveX control installations.\r\n\r\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\r\n\r\nIf you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.\r\n\r\nIf you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowautomaticpromptingforactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowautomaticpromptingforactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowautomaticpromptingforactivexcontrols_iz_partname2201","displayName":"Automatic prompting for ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowautomaticpromptingforactivexcontrols_iz_partname2201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowautomaticpromptingforactivexcontrols_iz_partname2201_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowautomaticpromptingforfiledownloads","displayName":"Automatic prompting for file downloads (User)","description":"This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\r\n\r\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\r\n\r\nIf you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowautomaticpromptingforfiledownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowautomaticpromptingforfiledownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowautomaticpromptingforfiledownloads_iz_partname2200","displayName":"Automatic prompting for file downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowautomaticpromptingforfiledownloads_iz_partname2200_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowautomaticpromptingforfiledownloads_iz_partname2200_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowfontdownloads","displayName":"Allow font downloads (User)","description":"This policy setting allows you to manage whether pages of the zone may download HTML fonts.\r\n\r\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\r\n\r\nIf you disable this policy setting, HTML fonts are prevented from downloading.\r\n\r\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-intranetzoneallowfontdownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowfontdownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowfontdownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowfontdownloads_iz_partname1604","displayName":"Allow font downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowfontdownloads_iz_partname1604_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowfontdownloads_iz_partname1604_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowfontdownloads_iz_partname1604_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowlessprivilegedsites","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.\r\n\r\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\r\n\r\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\r\n\r\nIf you do not configure this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-intranetzoneallowlessprivilegedsites"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowlessprivilegedsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowlessprivilegedsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowlessprivilegedsites_iz_partname2101","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowlessprivilegedsites_iz_partname2101_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowlessprivilegedsites_iz_partname2101_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowlessprivilegedsites_iz_partname2101_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallownetframeworkreliantcomponents","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\r\n\r\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\r\n\r\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\r\n\r\nIf you do not configure this policy setting, Internet Explorer will execute unsigned managed components.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-intranetzoneallownetframeworkreliantcomponents"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallownetframeworkreliantcomponents_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallownetframeworkreliantcomponents_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallownetframeworkreliantcomponents_iz_partname2004","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallownetframeworkreliantcomponents_iz_partname2004_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallownetframeworkreliantcomponents_iz_partname2004_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallownetframeworkreliantcomponents_iz_partname2004_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowscriptlets","displayName":"Allow scriptlets (User)","description":"This policy setting allows you to manage whether the user can run scriptlets.\r\n\r\nIf you enable this policy setting, the user can run scriptlets.\r\n\r\nIf you disable this policy setting, the user cannot run scriptlets.\r\n\r\nIf you do not configure this policy setting, the user can enable or disable scriptlets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-intranetzoneallowscriptlets"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowscriptlets_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowscriptlets_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowscriptlets_iz_partname1209","displayName":"Scriptlets (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowscriptlets_iz_partname1209_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowscriptlets_iz_partname1209_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowsmartscreenie","displayName":"Turn on SmartScreen Filter scan (User)","description":"This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.\r\n\r\nIf you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nNote: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-intranetzoneallowsmartscreenie"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowsmartscreenie_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowsmartscreenie_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowsmartscreenie_iz_partname2301","displayName":"Use SmartScreen Filter (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowsmartscreenie_iz_partname2301_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowsmartscreenie_iz_partname2301_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowuserdatapersistence","displayName":"Userdata persistence (User)","description":"This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\r\n\r\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-intranetzoneallowuserdatapersistence"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowuserdatapersistence_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowuserdatapersistence_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowuserdatapersistence_iz_partname1606","displayName":"Userdata persistence (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowuserdatapersistence_iz_partname1606_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneallowuserdatapersistence_iz_partname1606_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonedonotrunantimalwareagainstactivexcontrols","displayName":"Don't run antimalware programs against ActiveX controls (User)","description":"This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.\r\n\r\nIf you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.\r\n\r\nIf you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.\r\n\r\nIf you don't configure this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonedonotrunantimalwareagainstactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonedonotrunantimalwareagainstactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonedonotrunantimalwareagainstactivexcontrols_iz_partname270c","displayName":"Don't run antimalware programs against ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonedonotrunantimalwareagainstactivexcontrols_iz_partname270c_3","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonedonotrunantimalwareagainstactivexcontrols_iz_partname270c_0","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneinitializeandscriptactivexcontrols","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"This policy setting allows you to manage ActiveX controls not marked as safe.\r\n\r\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\r\n\r\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\r\n\r\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\r\n\r\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-intranetzoneinitializeandscriptactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneinitializeandscriptactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneinitializeandscriptactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneinitializeandscriptactivexcontrols_iz_partname1201","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneinitializeandscriptactivexcontrols_iz_partname1201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneinitializeandscriptactivexcontrols_iz_partname1201_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzoneinitializeandscriptactivexcontrols_iz_partname1201_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonejavapermissions","displayName":"Java permissions (User)","description":"This policy setting allows you to manage permissions for Java applets.\r\n\r\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\r\n\r\nLow Safety enables applets to perform all operations.\r\n\r\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.\r\n\r\nHigh Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.\r\n\r\nIf you disable this policy setting, Java applets cannot run.\r\n\r\nIf you do not configure this policy setting, the permission is set to Medium Safety.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-intranetzonejavapermissions"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonejavapermissions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonejavapermissions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonejavapermissions_iz_partname1c00","displayName":"Java permissions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonejavapermissions_iz_partname1c00_65536","displayName":"High safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonejavapermissions_iz_partname1c00_131072","displayName":"Medium safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonejavapermissions_iz_partname1c00_196608","displayName":"Low safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonejavapermissions_iz_partname1c00_8388608","displayName":"Custom","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonejavapermissions_iz_partname1c00_0","displayName":"Disable Java","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonelogonoptions","displayName":"Logon options (User)","description":"This policy setting allows you to manage settings for logon options.\r\n\r\nIf you enable this policy setting, you can choose from the following logon options.\r\n\r\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\r\n\r\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\r\n\r\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\r\n\r\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\r\n\r\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\r\n\r\nIf you do not configure this policy setting, logon is set to Automatic logon only in Intranet zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-intranetzonelogonoptions"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonelogonoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonelogonoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonelogonoptions_iz_partname1a00","displayName":"Logon options (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonelogonoptions_iz_partname1a00_196608","displayName":"Anonymous logon","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonelogonoptions_iz_partname1a00_131072","displayName":"Automatic logon only in Intranet zone","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonelogonoptions_iz_partname1a00_0","displayName":"Automatic logon with current username and password","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonelogonoptions_iz_partname1a00_65536","displayName":"Prompt for user name and password","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonenavigatewindowsandframes","displayName":"Navigate windows and frames across different domains (User)","description":"This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\r\n\r\nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\r\n\r\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\r\n\r\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-intranetzonenavigatewindowsandframes"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonenavigatewindowsandframes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonenavigatewindowsandframes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonenavigatewindowsandframes_iz_partname1607","displayName":"Navigate windows and frames across different domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonenavigatewindowsandframes_iz_partname1607_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonenavigatewindowsandframes_iz_partname1607_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_intranetzonenavigatewindowsandframes_iz_partname1607_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_jscriptreplacement","displayName":"Replace JScript by loading JScript9Legacy in place of JScript. (User)","description":"This policy setting specifies whether JScript or JScript9Legacy is loaded.\r\n \r\nIf you enable this policy setting or not configured, JScript9Legacy will be loaded in situations where JScript is instantiated.\r\n\r\nIf you disable this policy, then JScript will be utilized.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-jscriptreplacement"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_jscriptreplacement_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_jscriptreplacement_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_keepintranetsitesininternetexplorer","displayName":"Keep all intranet sites in Internet Explorer (User)","description":"Prevents intranet sites from being opened in any browser except Internet Explorer. But note that If the ‘Send all sites not included in the Enterprise Mode Site List to Microsoft Edge’ (‘RestrictIE’) policy isn’t enabled, this policy has no effect.\r\n\r\nIf you enable this policy, all intranet sites are opened in Internet Explorer 11. The only exceptions are sites listed in your Enterprise Mode Site List.\r\n\r\nIf you disable or don’t configure this policy, all intranet sites are automatically opened in Microsoft Edge.\r\n\r\nWe strongly recommend keeping this policy in sync with the ‘Send all intranet sites to Internet Explorer’ (‘SendIntranetToInternetExplorer’) policy. Additionally, it’s best to enable this policy only if your intranet sites have known compatibility problems with Microsoft Edge.\r\n\r\nRelated policies:\r\n- Send all intranet sites to Internet Explorer (‘SendIntranetToInternetExplorer’)\r\n- Send all sites not included in the Enterprise Mode Site List to Microsoft Edge (‘RestrictIE’)\r\n\r\nFor more info about how to use this policy together with other related policies to create the optimal configuration for your organization, see https://go.microsoft.com/fwlink/?linkid=2094210.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-keepintranetsitesininternetexplorer"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_keepintranetsitesininternetexplorer_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_keepintranetsitesininternetexplorer_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowaccesstodatasources","displayName":"Access data sources across domains (User)","description":"This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\r\n\r\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-localmachinezoneallowaccesstodatasources"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowaccesstodatasources_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowaccesstodatasources_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowaccesstodatasources_iz_partname1406","displayName":"Access data sources across domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowaccesstodatasources_iz_partname1406_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowaccesstodatasources_iz_partname1406_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowaccesstodatasources_iz_partname1406_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowautomaticpromptingforactivexcontrols","displayName":"Automatic prompting for ActiveX controls (User)","description":"This policy setting manages whether users will be automatically prompted for ActiveX control installations.\r\n\r\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\r\n\r\nIf you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.\r\n\r\nIf you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowautomaticpromptingforactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowautomaticpromptingforactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowautomaticpromptingforactivexcontrols_iz_partname2201","displayName":"Automatic prompting for ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowautomaticpromptingforactivexcontrols_iz_partname2201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowautomaticpromptingforactivexcontrols_iz_partname2201_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowautomaticpromptingforfiledownloads","displayName":"Automatic prompting for file downloads (User)","description":"This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\r\n\r\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\r\n\r\nIf you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowautomaticpromptingforfiledownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowautomaticpromptingforfiledownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowautomaticpromptingforfiledownloads_iz_partname2200","displayName":"Automatic prompting for file downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowautomaticpromptingforfiledownloads_iz_partname2200_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowautomaticpromptingforfiledownloads_iz_partname2200_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowfontdownloads","displayName":"Allow font downloads (User)","description":"This policy setting allows you to manage whether pages of the zone may download HTML fonts.\r\n\r\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\r\n\r\nIf you disable this policy setting, HTML fonts are prevented from downloading.\r\n\r\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-localmachinezoneallowfontdownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowfontdownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowfontdownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowfontdownloads_iz_partname1604","displayName":"Allow font downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowfontdownloads_iz_partname1604_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowfontdownloads_iz_partname1604_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowfontdownloads_iz_partname1604_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowlessprivilegedsites","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\r\n\r\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\r\n\r\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\r\n\r\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-localmachinezoneallowlessprivilegedsites"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowlessprivilegedsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowlessprivilegedsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowlessprivilegedsites_iz_partname2101","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowlessprivilegedsites_iz_partname2101_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowlessprivilegedsites_iz_partname2101_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowlessprivilegedsites_iz_partname2101_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallownetframeworkreliantcomponents","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\r\n\r\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\r\n\r\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\r\n\r\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-localmachinezoneallownetframeworkreliantcomponents"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallownetframeworkreliantcomponents_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallownetframeworkreliantcomponents_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallownetframeworkreliantcomponents_iz_partname2004","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallownetframeworkreliantcomponents_iz_partname2004_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallownetframeworkreliantcomponents_iz_partname2004_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallownetframeworkreliantcomponents_iz_partname2004_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowscriptlets","displayName":"Allow scriptlets (User)","description":"This policy setting allows you to manage whether the user can run scriptlets.\r\n\r\nIf you enable this policy setting, the user can run scriptlets.\r\n\r\nIf you disable this policy setting, the user cannot run scriptlets.\r\n\r\nIf you do not configure this policy setting, the user can enable or disable scriptlets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-localmachinezoneallowscriptlets"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowscriptlets_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowscriptlets_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowscriptlets_iz_partname1209","displayName":"Scriptlets (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowscriptlets_iz_partname1209_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowscriptlets_iz_partname1209_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowsmartscreenie","displayName":"Turn on SmartScreen Filter scan (User)","description":"This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.\r\n\r\nIf you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nNote: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-localmachinezoneallowsmartscreenie"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowsmartscreenie_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowsmartscreenie_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowsmartscreenie_iz_partname2301","displayName":"Use SmartScreen Filter (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowsmartscreenie_iz_partname2301_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowsmartscreenie_iz_partname2301_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowuserdatapersistence","displayName":"Userdata persistence (User)","description":"This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\r\n\r\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-localmachinezoneallowuserdatapersistence"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowuserdatapersistence_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowuserdatapersistence_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowuserdatapersistence_iz_partname1606","displayName":"Userdata persistence (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowuserdatapersistence_iz_partname1606_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneallowuserdatapersistence_iz_partname1606_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonedonotrunantimalwareagainstactivexcontrols","displayName":"Don't run antimalware programs against ActiveX controls (User)","description":"This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.\r\n\r\nIf you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.\r\n\r\nIf you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.\r\n\r\nIf you don't configure this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonedonotrunantimalwareagainstactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonedonotrunantimalwareagainstactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonedonotrunantimalwareagainstactivexcontrols_iz_partname270c","displayName":"Don't run antimalware programs against ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonedonotrunantimalwareagainstactivexcontrols_iz_partname270c_3","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonedonotrunantimalwareagainstactivexcontrols_iz_partname270c_0","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneinitializeandscriptactivexcontrols","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"This policy setting allows you to manage ActiveX controls not marked as safe.\r\n\r\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\r\n\r\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\r\n\r\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\r\n\r\nIf you do not configure this policy setting, users are queried whether to allow the control to be loaded with parameters or scripted.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneinitializeandscriptactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneinitializeandscriptactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneinitializeandscriptactivexcontrols_iz_partname1201","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneinitializeandscriptactivexcontrols_iz_partname1201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneinitializeandscriptactivexcontrols_iz_partname1201_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezoneinitializeandscriptactivexcontrols_iz_partname1201_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonejavapermissions","displayName":"Java permissions (User)","description":"This policy setting allows you to manage permissions for Java applets.\r\n\r\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\r\n\r\nLow Safety enables applets to perform all operations.\r\n\r\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.\r\n\r\nHigh Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.\r\n\r\nIf you disable this policy setting, Java applets cannot run.\r\n\r\nIf you do not configure this policy setting, the permission is set to Medium Safety.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-localmachinezonejavapermissions"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonejavapermissions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonejavapermissions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonejavapermissions_iz_partname1c00","displayName":"Java permissions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonejavapermissions_iz_partname1c00_65536","displayName":"High safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonejavapermissions_iz_partname1c00_131072","displayName":"Medium safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonejavapermissions_iz_partname1c00_196608","displayName":"Low safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonejavapermissions_iz_partname1c00_8388608","displayName":"Custom","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonejavapermissions_iz_partname1c00_0","displayName":"Disable Java","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonelogonoptions","displayName":"Logon options (User)","description":"This policy setting allows you to manage settings for logon options.\r\n\r\nIf you enable this policy setting, you can choose from the following logon options.\r\n\r\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\r\n\r\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\r\n\r\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\r\n\r\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\r\n\r\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\r\n\r\nIf you do not configure this policy setting, logon is set to Automatic logon with current username and password.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-localmachinezonelogonoptions"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonelogonoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonelogonoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonelogonoptions_iz_partname1a00","displayName":"Logon options (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonelogonoptions_iz_partname1a00_196608","displayName":"Anonymous logon","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonelogonoptions_iz_partname1a00_131072","displayName":"Automatic logon only in Intranet zone","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonelogonoptions_iz_partname1a00_0","displayName":"Automatic logon with current username and password","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonelogonoptions_iz_partname1a00_65536","displayName":"Prompt for user name and password","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonenavigatewindowsandframes","displayName":"Navigate windows and frames across different domains (User)","description":"This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\r\n\r\nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\r\n\r\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\r\n\r\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-localmachinezonenavigatewindowsandframes"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonenavigatewindowsandframes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonenavigatewindowsandframes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonenavigatewindowsandframes_iz_partname1607","displayName":"Navigate windows and frames across different domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonenavigatewindowsandframes_iz_partname1607_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonenavigatewindowsandframes_iz_partname1607_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_localmachinezonenavigatewindowsandframes_iz_partname1607_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowaccesstodatasources","displayName":"Access data sources across domains (User)","description":"This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\r\n\r\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowninternetzoneallowaccesstodatasources"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowaccesstodatasources_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowaccesstodatasources_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowaccesstodatasources_iz_partname1406","displayName":"Access data sources across domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowaccesstodatasources_iz_partname1406_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowaccesstodatasources_iz_partname1406_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowaccesstodatasources_iz_partname1406_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowautomaticpromptingforactivexcontrols","displayName":"Automatic prompting for ActiveX controls (User)","description":"This policy setting manages whether users will be automatically prompted for ActiveX control installations.\r\n\r\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\r\n\r\nIf you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.\r\n\r\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowautomaticpromptingforactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowautomaticpromptingforactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowautomaticpromptingforactivexcontrols_iz_partname2201","displayName":"Automatic prompting for ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowautomaticpromptingforactivexcontrols_iz_partname2201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowautomaticpromptingforactivexcontrols_iz_partname2201_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowautomaticpromptingforfiledownloads","displayName":"Automatic prompting for file downloads (User)","description":"This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\r\n\r\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\r\n\r\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowautomaticpromptingforfiledownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowautomaticpromptingforfiledownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowautomaticpromptingforfiledownloads_iz_partname2200","displayName":"Automatic prompting for file downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowautomaticpromptingforfiledownloads_iz_partname2200_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowautomaticpromptingforfiledownloads_iz_partname2200_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowfontdownloads","displayName":"Allow font downloads (User)","description":"This policy setting allows you to manage whether pages of the zone may download HTML fonts.\r\n\r\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\r\n\r\nIf you disable this policy setting, HTML fonts are prevented from downloading.\r\n\r\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowninternetzoneallowfontdownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowfontdownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowfontdownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowfontdownloads_iz_partname1604","displayName":"Allow font downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowfontdownloads_iz_partname1604_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowfontdownloads_iz_partname1604_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowfontdownloads_iz_partname1604_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowlessprivilegedsites","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\r\n\r\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\r\n\r\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\r\n\r\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowlessprivilegedsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowlessprivilegedsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowlessprivilegedsites_iz_partname2101","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowlessprivilegedsites_iz_partname2101_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowlessprivilegedsites_iz_partname2101_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowlessprivilegedsites_iz_partname2101_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallownetframeworkreliantcomponents","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\r\n\r\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\r\n\r\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\r\n\r\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallownetframeworkreliantcomponents_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallownetframeworkreliantcomponents_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallownetframeworkreliantcomponents_iz_partname2004","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallownetframeworkreliantcomponents_iz_partname2004_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallownetframeworkreliantcomponents_iz_partname2004_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallownetframeworkreliantcomponents_iz_partname2004_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowscriptlets","displayName":"Allow scriptlets (User)","description":"This policy setting allows you to manage whether the user can run scriptlets.\r\n\r\nIf you enable this policy setting, the user can run scriptlets.\r\n\r\nIf you disable this policy setting, the user cannot run scriptlets.\r\n\r\nIf you do not configure this policy setting, the user can enable or disable scriptlets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowninternetzoneallowscriptlets"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowscriptlets_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowscriptlets_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowscriptlets_iz_partname1209","displayName":"Scriptlets (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowscriptlets_iz_partname1209_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowscriptlets_iz_partname1209_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowsmartscreenie","displayName":"Turn on SmartScreen Filter scan (User)","description":"This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.\r\n\r\nIf you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nNote: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowninternetzoneallowsmartscreenie"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowsmartscreenie_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowsmartscreenie_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowsmartscreenie_iz_partname2301","displayName":"Use SmartScreen Filter (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowsmartscreenie_iz_partname2301_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowsmartscreenie_iz_partname2301_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowuserdatapersistence","displayName":"Userdata persistence (User)","description":"This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\r\n\r\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowninternetzoneallowuserdatapersistence"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowuserdatapersistence_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowuserdatapersistence_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowuserdatapersistence_iz_partname1606","displayName":"Userdata persistence (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowuserdatapersistence_iz_partname1606_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneallowuserdatapersistence_iz_partname1606_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneinitializeandscriptactivexcontrols","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"This policy setting allows you to manage ActiveX controls not marked as safe.\r\n\r\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\r\n\r\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\r\n\r\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\r\n\r\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneinitializeandscriptactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneinitializeandscriptactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneinitializeandscriptactivexcontrols_iz_partname1201","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneinitializeandscriptactivexcontrols_iz_partname1201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneinitializeandscriptactivexcontrols_iz_partname1201_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzoneinitializeandscriptactivexcontrols_iz_partname1201_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzonejavapermissions","displayName":"Java permissions (User)","description":"This policy setting allows you to manage permissions for Java applets.\r\n\r\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\r\n\r\nLow Safety enables applets to perform all operations.\r\n\r\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.\r\n\r\nHigh Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.\r\n\r\nIf you disable this policy setting, Java applets cannot run.\r\n\r\nIf you do not configure this policy setting, Java applets are disabled.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowninternetzonejavapermissions"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzonejavapermissions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzonejavapermissions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzonejavapermissions_iz_partname1c00","displayName":"Java permissions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzonejavapermissions_iz_partname1c00_65536","displayName":"High safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzonejavapermissions_iz_partname1c00_131072","displayName":"Medium safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzonejavapermissions_iz_partname1c00_196608","displayName":"Low safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzonejavapermissions_iz_partname1c00_8388608","displayName":"Custom","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzonejavapermissions_iz_partname1c00_0","displayName":"Disable Java","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzonenavigatewindowsandframes","displayName":"Navigate windows and frames across different domains (User)","description":"This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\r\n\r\nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\r\n\r\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\r\n\r\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowninternetzonenavigatewindowsandframes"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzonenavigatewindowsandframes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzonenavigatewindowsandframes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzonenavigatewindowsandframes_iz_partname1607","displayName":"Navigate windows and frames across different domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzonenavigatewindowsandframes_iz_partname1607_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzonenavigatewindowsandframes_iz_partname1607_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowninternetzonenavigatewindowsandframes_iz_partname1607_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetjavapermissions","displayName":"Java permissions (User)","description":"This policy setting allows you to manage permissions for Java applets.\r\n\r\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\r\n\r\nLow Safety enables applets to perform all operations.\r\n\r\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.\r\n\r\nHigh Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.\r\n\r\nIf you disable this policy setting, Java applets cannot run.\r\n\r\nIf you do not configure this policy setting, Java applets are disabled.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownintranetjavapermissions"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetjavapermissions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetjavapermissions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetjavapermissions_iz_partname1c00","displayName":"Java permissions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetjavapermissions_iz_partname1c00_65536","displayName":"High safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetjavapermissions_iz_partname1c00_131072","displayName":"Medium safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetjavapermissions_iz_partname1c00_196608","displayName":"Low safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetjavapermissions_iz_partname1c00_8388608","displayName":"Custom","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetjavapermissions_iz_partname1c00_0","displayName":"Disable Java","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowaccesstodatasources","displayName":"Access data sources across domains (User)","description":"This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\r\n\r\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you do not configure this policy setting, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownintranetzoneallowaccesstodatasources"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowaccesstodatasources_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowaccesstodatasources_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowaccesstodatasources_iz_partname1406","displayName":"Access data sources across domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowaccesstodatasources_iz_partname1406_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowaccesstodatasources_iz_partname1406_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowaccesstodatasources_iz_partname1406_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowautomaticpromptingforactivexcontrols","displayName":"Automatic prompting for ActiveX controls (User)","description":"This policy setting manages whether users will be automatically prompted for ActiveX control installations.\r\n\r\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\r\n\r\nIf you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.\r\n\r\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowautomaticpromptingforactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowautomaticpromptingforactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowautomaticpromptingforactivexcontrols_iz_partname2201","displayName":"Automatic prompting for ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowautomaticpromptingforactivexcontrols_iz_partname2201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowautomaticpromptingforactivexcontrols_iz_partname2201_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowautomaticpromptingforfiledownloads","displayName":"Automatic prompting for file downloads (User)","description":"This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\r\n\r\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\r\n\r\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowautomaticpromptingforfiledownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowautomaticpromptingforfiledownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowautomaticpromptingforfiledownloads_iz_partname2200","displayName":"Automatic prompting for file downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowautomaticpromptingforfiledownloads_iz_partname2200_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowautomaticpromptingforfiledownloads_iz_partname2200_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowfontdownloads","displayName":"Allow font downloads (User)","description":"This policy setting allows you to manage whether pages of the zone may download HTML fonts.\r\n\r\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\r\n\r\nIf you disable this policy setting, HTML fonts are prevented from downloading.\r\n\r\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownintranetzoneallowfontdownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowfontdownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowfontdownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowfontdownloads_iz_partname1604","displayName":"Allow font downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowfontdownloads_iz_partname1604_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowfontdownloads_iz_partname1604_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowfontdownloads_iz_partname1604_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowlessprivilegedsites","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\r\n\r\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\r\n\r\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\r\n\r\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowlessprivilegedsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowlessprivilegedsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowlessprivilegedsites_iz_partname2101","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowlessprivilegedsites_iz_partname2101_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowlessprivilegedsites_iz_partname2101_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowlessprivilegedsites_iz_partname2101_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallownetframeworkreliantcomponents","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\r\n\r\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\r\n\r\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\r\n\r\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallownetframeworkreliantcomponents_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallownetframeworkreliantcomponents_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallownetframeworkreliantcomponents_iz_partname2004","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallownetframeworkreliantcomponents_iz_partname2004_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallownetframeworkreliantcomponents_iz_partname2004_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallownetframeworkreliantcomponents_iz_partname2004_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowscriptlets","displayName":"Allow scriptlets (User)","description":"This policy setting allows you to manage whether the user can run scriptlets.\r\n\r\nIf you enable this policy setting, the user can run scriptlets.\r\n\r\nIf you disable this policy setting, the user cannot run scriptlets.\r\n\r\nIf you do not configure this policy setting, the user can enable or disable scriptlets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownintranetzoneallowscriptlets"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowscriptlets_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowscriptlets_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowscriptlets_iz_partname1209","displayName":"Scriptlets (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowscriptlets_iz_partname1209_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowscriptlets_iz_partname1209_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowsmartscreenie","displayName":"Turn on SmartScreen Filter scan (User)","description":"This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.\r\n\r\nIf you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nNote: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownintranetzoneallowsmartscreenie"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowsmartscreenie_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowsmartscreenie_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowsmartscreenie_iz_partname2301","displayName":"Use SmartScreen Filter (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowsmartscreenie_iz_partname2301_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowsmartscreenie_iz_partname2301_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowuserdatapersistence","displayName":"Userdata persistence (User)","description":"This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\r\n\r\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownintranetzoneallowuserdatapersistence"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowuserdatapersistence_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowuserdatapersistence_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowuserdatapersistence_iz_partname1606","displayName":"Userdata persistence (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowuserdatapersistence_iz_partname1606_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneallowuserdatapersistence_iz_partname1606_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneinitializeandscriptactivexcontrols","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"This policy setting allows you to manage ActiveX controls not marked as safe.\r\n\r\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\r\n\r\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\r\n\r\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\r\n\r\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneinitializeandscriptactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneinitializeandscriptactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneinitializeandscriptactivexcontrols_iz_partname1201","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneinitializeandscriptactivexcontrols_iz_partname1201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneinitializeandscriptactivexcontrols_iz_partname1201_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzoneinitializeandscriptactivexcontrols_iz_partname1201_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzonenavigatewindowsandframes","displayName":"Navigate windows and frames across different domains (User)","description":"This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\r\n\r\nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\r\n\r\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\r\n\r\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownintranetzonenavigatewindowsandframes"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzonenavigatewindowsandframes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzonenavigatewindowsandframes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzonenavigatewindowsandframes_iz_partname1607","displayName":"Navigate windows and frames across different domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzonenavigatewindowsandframes_iz_partname1607_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzonenavigatewindowsandframes_iz_partname1607_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownintranetzonenavigatewindowsandframes_iz_partname1607_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowaccesstodatasources","displayName":"Access data sources across domains (User)","description":"This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\r\n\r\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowaccesstodatasources_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowaccesstodatasources_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowaccesstodatasources_iz_partname1406","displayName":"Access data sources across domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowaccesstodatasources_iz_partname1406_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowaccesstodatasources_iz_partname1406_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowaccesstodatasources_iz_partname1406_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols","displayName":"Automatic prompting for ActiveX controls (User)","description":"This policy setting manages whether users will be automatically prompted for ActiveX control installations.\r\n\r\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\r\n\r\nIf you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.\r\n\r\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols_iz_partname2201","displayName":"Automatic prompting for ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols_iz_partname2201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols_iz_partname2201_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads","displayName":"Automatic prompting for file downloads (User)","description":"This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\r\n\r\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\r\n\r\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads_iz_partname2200","displayName":"Automatic prompting for file downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads_iz_partname2200_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads_iz_partname2200_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowfontdownloads","displayName":"Allow font downloads (User)","description":"This policy setting allows you to manage whether pages of the zone may download HTML fonts.\r\n\r\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\r\n\r\nIf you disable this policy setting, HTML fonts are prevented from downloading.\r\n\r\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowfontdownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowfontdownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowfontdownloads_iz_partname1604","displayName":"Allow font downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowfontdownloads_iz_partname1604_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowfontdownloads_iz_partname1604_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowfontdownloads_iz_partname1604_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowlessprivilegedsites","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\r\n\r\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\r\n\r\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\r\n\r\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowlessprivilegedsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowlessprivilegedsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowlessprivilegedsites_iz_partname2101","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowlessprivilegedsites_iz_partname2101_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowlessprivilegedsites_iz_partname2101_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowlessprivilegedsites_iz_partname2101_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallownetframeworkreliantcomponents","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\r\n\r\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\r\n\r\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\r\n\r\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallownetframeworkreliantcomponents_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallownetframeworkreliantcomponents_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallownetframeworkreliantcomponents_iz_partname2004","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallownetframeworkreliantcomponents_iz_partname2004_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallownetframeworkreliantcomponents_iz_partname2004_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallownetframeworkreliantcomponents_iz_partname2004_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowscriptlets","displayName":"Allow scriptlets (User)","description":"This policy setting allows you to manage whether the user can run scriptlets.\r\n\r\nIf you enable this policy setting, the user can run scriptlets.\r\n\r\nIf you disable this policy setting, the user cannot run scriptlets.\r\n\r\nIf you do not configure this policy setting, the user can enable or disable scriptlets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownlocalmachinezoneallowscriptlets"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowscriptlets_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowscriptlets_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowscriptlets_iz_partname1209","displayName":"Scriptlets (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowscriptlets_iz_partname1209_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowscriptlets_iz_partname1209_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowsmartscreenie","displayName":"Turn on SmartScreen Filter scan (User)","description":"This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.\r\n\r\nIf you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nNote: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowsmartscreenie_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowsmartscreenie_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowsmartscreenie_iz_partname2301","displayName":"Use SmartScreen Filter (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowsmartscreenie_iz_partname2301_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowsmartscreenie_iz_partname2301_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowuserdatapersistence","displayName":"Userdata persistence (User)","description":"This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\r\n\r\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowuserdatapersistence_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowuserdatapersistence_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowuserdatapersistence_iz_partname1606","displayName":"Userdata persistence (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowuserdatapersistence_iz_partname1606_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneallowuserdatapersistence_iz_partname1606_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneinitializeandscriptactivexcontrols","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"This policy setting allows you to manage ActiveX controls not marked as safe.\r\n\r\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\r\n\r\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\r\n\r\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\r\n\r\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneinitializeandscriptactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneinitializeandscriptactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneinitializeandscriptactivexcontrols_iz_partname1201","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneinitializeandscriptactivexcontrols_iz_partname1201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneinitializeandscriptactivexcontrols_iz_partname1201_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezoneinitializeandscriptactivexcontrols_iz_partname1201_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezonejavapermissions","displayName":"Java permissions (User)","description":"This policy setting allows you to manage permissions for Java applets.\r\n\r\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\r\n\r\nLow Safety enables applets to perform all operations.\r\n\r\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.\r\n\r\nHigh Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.\r\n\r\nIf you disable this policy setting, Java applets cannot run.\r\n\r\nIf you do not configure this policy setting, Java applets are disabled.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownlocalmachinezonejavapermissions"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezonejavapermissions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezonejavapermissions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezonejavapermissions_iz_partname1c00","displayName":"Java permissions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezonejavapermissions_iz_partname1c00_65536","displayName":"High safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezonejavapermissions_iz_partname1c00_131072","displayName":"Medium safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezonejavapermissions_iz_partname1c00_196608","displayName":"Low safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezonejavapermissions_iz_partname1c00_8388608","displayName":"Custom","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezonejavapermissions_iz_partname1c00_0","displayName":"Disable Java","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezonenavigatewindowsandframes","displayName":"Navigate windows and frames across different domains (User)","description":"This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\r\n\r\nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\r\n\r\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\r\n\r\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezonenavigatewindowsandframes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezonenavigatewindowsandframes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezonenavigatewindowsandframes_iz_partname1607","displayName":"Navigate windows and frames across different domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezonenavigatewindowsandframes_iz_partname1607_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezonenavigatewindowsandframes_iz_partname1607_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownlocalmachinezonenavigatewindowsandframes_iz_partname1607_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowaccesstodatasources","displayName":"Access data sources across domains (User)","description":"This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\r\n\r\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowaccesstodatasources_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowaccesstodatasources_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowaccesstodatasources_iz_partname1406","displayName":"Access data sources across domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowaccesstodatasources_iz_partname1406_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowaccesstodatasources_iz_partname1406_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowaccesstodatasources_iz_partname1406_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols","displayName":"Automatic prompting for ActiveX controls (User)","description":"This policy setting manages whether users will be automatically prompted for ActiveX control installations.\r\n\r\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\r\n\r\nIf you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.\r\n\r\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols_iz_partname2201","displayName":"Automatic prompting for ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols_iz_partname2201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols_iz_partname2201_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads","displayName":"Automatic prompting for file downloads (User)","description":"This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\r\n\r\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\r\n\r\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads_iz_partname2200","displayName":"Automatic prompting for file downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads_iz_partname2200_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads_iz_partname2200_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowfontdownloads","displayName":"Allow font downloads (User)","description":"This policy setting allows you to manage whether pages of the zone may download HTML fonts.\r\n\r\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\r\n\r\nIf you disable this policy setting, HTML fonts are prevented from downloading.\r\n\r\nIf you do not configure this policy setting, users are queried whether to allow HTML fonts to download.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowfontdownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowfontdownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowfontdownloads_iz_partname1604","displayName":"Allow font downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowfontdownloads_iz_partname1604_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowfontdownloads_iz_partname1604_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowfontdownloads_iz_partname1604_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowlessprivilegedsites","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\r\n\r\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\r\n\r\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\r\n\r\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowlessprivilegedsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowlessprivilegedsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowlessprivilegedsites_iz_partname2101","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowlessprivilegedsites_iz_partname2101_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowlessprivilegedsites_iz_partname2101_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowlessprivilegedsites_iz_partname2101_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\r\n\r\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\r\n\r\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\r\n\r\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents_iz_partname2004","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents_iz_partname2004_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents_iz_partname2004_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents_iz_partname2004_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowscriptlets","displayName":"Allow scriptlets (User)","description":"This policy setting allows you to manage whether the user can run scriptlets.\r\n\r\nIf you enable this policy setting, the user can run scriptlets.\r\n\r\nIf you disable this policy setting, the user cannot run scriptlets.\r\n\r\nIf you do not configure this policy setting, the user can enable or disable scriptlets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowscriptlets_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowscriptlets_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowscriptlets_iz_partname1209","displayName":"Scriptlets (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowscriptlets_iz_partname1209_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowscriptlets_iz_partname1209_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowsmartscreenie","displayName":"Turn on SmartScreen Filter scan (User)","description":"This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.\r\n\r\nIf you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nNote: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowsmartscreenie_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowsmartscreenie_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowsmartscreenie_iz_partname2301","displayName":"Use SmartScreen Filter (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowsmartscreenie_iz_partname2301_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowsmartscreenie_iz_partname2301_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowuserdatapersistence","displayName":"Userdata persistence (User)","description":"This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\r\n\r\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you do not configure this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowuserdatapersistence_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowuserdatapersistence_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowuserdatapersistence_iz_partname1606","displayName":"Userdata persistence (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowuserdatapersistence_iz_partname1606_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneallowuserdatapersistence_iz_partname1606_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"This policy setting allows you to manage ActiveX controls not marked as safe.\r\n\r\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\r\n\r\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\r\n\r\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\r\n\r\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols_iz_partname1201","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols_iz_partname1201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols_iz_partname1201_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols_iz_partname1201_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszonejavapermissions","displayName":"Java permissions (User)","description":"This policy setting allows you to manage permissions for Java applets.\r\n\r\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\r\n\r\nLow Safety enables applets to perform all operations.\r\n\r\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.\r\n\r\nHigh Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.\r\n\r\nIf you disable this policy setting, Java applets cannot run.\r\n\r\nIf you do not configure this policy setting, Java applets are disabled.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownrestrictedsiteszonejavapermissions"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszonejavapermissions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszonejavapermissions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszonejavapermissions_iz_partname1c00","displayName":"Java permissions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszonejavapermissions_iz_partname1c00_65536","displayName":"High safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszonejavapermissions_iz_partname1c00_131072","displayName":"Medium safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszonejavapermissions_iz_partname1c00_196608","displayName":"Low safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszonejavapermissions_iz_partname1c00_8388608","displayName":"Custom","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszonejavapermissions_iz_partname1c00_0","displayName":"Disable Java","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszonenavigatewindowsandframes","displayName":"Navigate windows and frames across different domains (User)","description":"This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\r\n\r\nIf you enable this policy setting, users can open additional windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow additional windows and frames to access applications from other domains.\r\n\r\nIf you disable this policy setting, users cannot open other windows and frames from other domains or access applications from different domains.\r\n\r\nIf you do not configure this policy setting, users cannot open other windows and frames from different domains or access applications from different domains.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszonenavigatewindowsandframes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszonenavigatewindowsandframes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszonenavigatewindowsandframes_iz_partname1607","displayName":"Navigate windows and frames across different domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszonenavigatewindowsandframes_iz_partname1607_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszonenavigatewindowsandframes_iz_partname1607_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddownrestrictedsiteszonenavigatewindowsandframes_iz_partname1607_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowaccesstodatasources","displayName":"Access data sources across domains (User)","description":"This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\r\n\r\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowaccesstodatasources_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowaccesstodatasources_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowaccesstodatasources_iz_partname1406","displayName":"Access data sources across domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowaccesstodatasources_iz_partname1406_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowaccesstodatasources_iz_partname1406_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowaccesstodatasources_iz_partname1406_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols","displayName":"Automatic prompting for ActiveX controls (User)","description":"This policy setting manages whether users will be automatically prompted for ActiveX control installations.\r\n\r\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\r\n\r\nIf you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.\r\n\r\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols_iz_partname2201","displayName":"Automatic prompting for ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols_iz_partname2201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols_iz_partname2201_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads","displayName":"Automatic prompting for file downloads (User)","description":"This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\r\n\r\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\r\n\r\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads_iz_partname2200","displayName":"Automatic prompting for file downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads_iz_partname2200_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads_iz_partname2200_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowfontdownloads","displayName":"Allow font downloads (User)","description":"This policy setting allows you to manage whether pages of the zone may download HTML fonts.\r\n\r\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\r\n\r\nIf you disable this policy setting, HTML fonts are prevented from downloading.\r\n\r\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowfontdownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowfontdownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowfontdownloads_iz_partname1604","displayName":"Allow font downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowfontdownloads_iz_partname1604_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowfontdownloads_iz_partname1604_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowfontdownloads_iz_partname1604_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowlessprivilegedsites","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\r\n\r\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\r\n\r\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\r\n\r\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowlessprivilegedsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowlessprivilegedsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowlessprivilegedsites_iz_partname2101","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowlessprivilegedsites_iz_partname2101_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowlessprivilegedsites_iz_partname2101_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowlessprivilegedsites_iz_partname2101_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallownetframeworkreliantcomponents","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\r\n\r\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\r\n\r\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\r\n\r\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallownetframeworkreliantcomponents_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallownetframeworkreliantcomponents_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallownetframeworkreliantcomponents_iz_partname2004","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallownetframeworkreliantcomponents_iz_partname2004_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallownetframeworkreliantcomponents_iz_partname2004_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallownetframeworkreliantcomponents_iz_partname2004_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowscriptlets","displayName":"Allow scriptlets (User)","description":"This policy setting allows you to manage whether the user can run scriptlets.\r\n\r\nIf you enable this policy setting, the user can run scriptlets.\r\n\r\nIf you disable this policy setting, the user cannot run scriptlets.\r\n\r\nIf you do not configure this policy setting, the user can enable or disable scriptlets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowscriptlets_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowscriptlets_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowscriptlets_iz_partname1209","displayName":"Scriptlets (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowscriptlets_iz_partname1209_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowscriptlets_iz_partname1209_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowsmartscreenie","displayName":"Turn on SmartScreen Filter scan (User)","description":"This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.\r\n\r\nIf you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nNote: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowsmartscreenie_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowsmartscreenie_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowsmartscreenie_iz_partname2301","displayName":"Use SmartScreen Filter (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowsmartscreenie_iz_partname2301_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowsmartscreenie_iz_partname2301_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowuserdatapersistence","displayName":"Userdata persistence (User)","description":"This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\r\n\r\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowuserdatapersistence_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowuserdatapersistence_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowuserdatapersistence_iz_partname1606","displayName":"Userdata persistence (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowuserdatapersistence_iz_partname1606_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneallowuserdatapersistence_iz_partname1606_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"This policy setting allows you to manage ActiveX controls not marked as safe.\r\n\r\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\r\n\r\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\r\n\r\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\r\n\r\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols_iz_partname1201","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols_iz_partname1201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols_iz_partname1201_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols_iz_partname1201_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszonejavapermissions","displayName":"Java permissions (User)","description":"This policy setting allows you to manage permissions for Java applets.\r\n\r\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\r\n\r\nLow Safety enables applets to perform all operations.\r\n\r\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.\r\n\r\nHigh Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.\r\n\r\nIf you disable this policy setting, Java applets cannot run.\r\n\r\nIf you do not configure this policy setting, Java applets are disabled.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowntrustedsiteszonejavapermissions"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszonejavapermissions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszonejavapermissions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszonejavapermissions_iz_partname1c00","displayName":"Java permissions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszonejavapermissions_iz_partname1c00_65536","displayName":"High safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszonejavapermissions_iz_partname1c00_131072","displayName":"Medium safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszonejavapermissions_iz_partname1c00_196608","displayName":"Low safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszonejavapermissions_iz_partname1c00_8388608","displayName":"Custom","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszonejavapermissions_iz_partname1c00_0","displayName":"Disable Java","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszonenavigatewindowsandframes","displayName":"Navigate windows and frames across different domains (User)","description":"This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\r\n\r\nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\r\n\r\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\r\n\r\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszonenavigatewindowsandframes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszonenavigatewindowsandframes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszonenavigatewindowsandframes_iz_partname1607","displayName":"Navigate windows and frames across different domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszonenavigatewindowsandframes_iz_partname1607_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszonenavigatewindowsandframes_iz_partname1607_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_lockeddowntrustedsiteszonenavigatewindowsandframes_iz_partname1607_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_mimesniffingsafetyfeatureinternetexplorerprocesses","displayName":"Internet Explorer Processes (User)","description":"This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type.\r\n\r\nIf you enable this policy setting, MIME sniffing will never promote a file of one type to a more dangerous file type.\r\n\r\nIf you disable this policy setting, Internet Explorer processes will allow a MIME sniff promoting a file of one type to a more dangerous file type.\r\n\r\nIf you do not configure this policy setting, MIME sniffing will never promote a file of one type to a more dangerous file type.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_mimesniffingsafetyfeatureinternetexplorerprocesses_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_mimesniffingsafetyfeatureinternetexplorerprocesses_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_mkprotocolsecurityrestrictioninternetexplorerprocesses","displayName":"Internet Explorer Processes (User)","description":"The MK Protocol Security Restriction policy setting reduces attack surface area by preventing the MK protocol. Resources hosted on the MK protocol will fail.\r\n\r\nIf you enable this policy setting, the MK Protocol is prevented for File Explorer and Internet Explorer, and resources hosted on the MK protocol will fail.\r\n\r\nIf you disable this policy setting, applications can use the MK protocol API. Resources hosted on the MK protocol will work for the File Explorer and Internet Explorer processes.\r\n\r\nIf you do not configure this policy setting, the MK Protocol is prevented for File Explorer and Internet Explorer, and resources hosted on the MK protocol will fail.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_mkprotocolsecurityrestrictioninternetexplorerprocesses_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_mkprotocolsecurityrestrictioninternetexplorerprocesses_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_newtabdefaultpage","displayName":"Specify default behavior for a new tab (User)","description":"This policy setting allows you to specify what is displayed when the user opens a new tab.\r\n\r\nIf you enable this policy setting, you can choose which page to display when the user opens a new tab: blank page (about:blank), the first home page, the new tab page or the new tab page with my news feed.\r\n\r\nIf you disable or do not configure this policy setting, the user can select his or her preference for this behavior.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-newtabdefaultpage"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_newtabdefaultpage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_newtabdefaultpage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_newtabdefaultpage_newtabactionoptions","displayName":"New tab behavior (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_newtabdefaultpage_newtabactionoptions_3","displayName":"New tab page with my news feed","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_newtabdefaultpage_newtabactionoptions_0","displayName":"about:blank","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_newtabdefaultpage_newtabactionoptions_2","displayName":"New tab page","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_newtabdefaultpage_newtabactionoptions_1","displayName":"Home page","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_notificationbarinternetexplorerprocesses","displayName":"Internet Explorer Processes (User)","description":"This policy setting allows you to manage whether the Notification bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification bar is displayed for Internet Explorer processes.\r\n\r\nIf you enable this policy setting, the Notification bar will be displayed for Internet Explorer Processes.\r\n\r\nIf you disable this policy setting, the Notification bar will not be displayed for Internet Explorer processes.\r\n\r\nIf you do not configure this policy setting, the Notification bar will be displayed for Internet Explorer Processes.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-notificationbarinternetexplorerprocesses"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_notificationbarinternetexplorerprocesses_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_notificationbarinternetexplorerprocesses_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_preventmanagingsmartscreenfilter","displayName":"Prevent managing SmartScreen Filter (User)","description":"This policy setting prevents the user from managing SmartScreen Filter, which warns the user if the website being visited is known for fraudulent attempts to gather personal information through \"phishing,\" or is known to host malware.\r\n\r\nIf you enable this policy setting, the user is not prompted to turn on SmartScreen Filter. All website addresses that are not on the filter's allow list are sent automatically to Microsoft without prompting the user.\r\n\r\nIf you disable or do not configure this policy setting, the user is prompted to decide whether to turn on SmartScreen Filter during the first-run experience.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-preventmanagingsmartscreenfilter"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_preventmanagingsmartscreenfilter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_preventmanagingsmartscreenfilter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_preventmanagingsmartscreenfilter_ie9safetyfilteroptions","displayName":"Select SmartScreen Filter mode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_preventmanagingsmartscreenfilter_ie9safetyfilteroptions_0","displayName":"Off","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_preventmanagingsmartscreenfilter_ie9safetyfilteroptions_1","displayName":"On","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_preventperuserinstallationofactivexcontrols","displayName":"Prevent per-user installation of ActiveX controls (User)","description":"This policy setting allows you to prevent the installation of ActiveX controls on a per-user basis.\r\n\r\nIf you enable this policy setting, ActiveX controls cannot be installed on a per-user basis.\r\n\r\nIf you disable or do not configure this policy setting, ActiveX controls can be installed on a per-user basis.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-preventperuserinstallationofactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_preventperuserinstallationofactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_preventperuserinstallationofactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_protectionfromzoneelevationinternetexplorerprocesses","displayName":"Internet Explorer Processes (User)","description":"Internet Explorer places restrictions on each Web page it opens. The restrictions are dependent upon the location of the Web page (Internet, Intranet, Local Machine zone, etc.). Web pages on the local computer have the fewest security restrictions and reside in the Local Machine zone, making the Local Machine security zone a prime target for malicious users. Zone Elevation also disables JavaScript navigation if there is no security context.\r\n\r\nIf you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes.\r\n\r\nIf you disable this policy setting, no zone receives such protection for Internet Explorer processes.\r\n\r\nIf you do not configure this policy setting, any zone can be protected from zone elevation by Internet Explorer processes.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_protectionfromzoneelevationinternetexplorerprocesses_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_protectionfromzoneelevationinternetexplorerprocesses_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_removerunthistimebuttonforoutdatedactivexcontrols","displayName":"Remove \"Run this time\" button for outdated ActiveX controls in Internet Explorer (User)","description":"This policy setting allows you to stop users from seeing the \"Run this time\" button and from running specific outdated ActiveX controls in Internet Explorer.\r\n\r\nIf you enable this policy setting, users won't see the \"Run this time\" button on the warning message that appears when Internet Explorer blocks an outdated ActiveX control.\r\n\r\nIf you disable or don't configure this policy setting, users will see the \"Run this time\" button on the warning message that appears when Internet Explorer blocks an outdated ActiveX control. Clicking this button lets the user run the outdated ActiveX control once.\r\n\r\nFor more information, see \"Outdated ActiveX Controls\" in the Internet Explorer TechNet library.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_removerunthistimebuttonforoutdatedactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_removerunthistimebuttonforoutdatedactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_resetzoomfordialoginiemode","displayName":"Reset zoom to default for HTML dialogs in Internet Explorer mode (User)","description":"This policy setting lets admins reset zoom to default for HTML dialogs in Internet Explorer mode.\r\n\r\nIf you enable this policy, the zoom of an HTML dialog in Internet Explorer mode will not get propagated from its parent page.\r\n\r\nIf you disable, or don't configure this policy, the zoom of an HTML dialog in Internet Explorer mode will be set based on the zoom of it's parent page.\r\n\r\nFor more information, see https://go.microsoft.com/fwlink/?linkid=2220107","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-resetzoomfordialoginiemode"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_resetzoomfordialoginiemode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_resetzoomfordialoginiemode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictactivexinstallinternetexplorerprocesses","displayName":"Internet Explorer Processes (User)","description":"This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes.\r\n\r\nIf you enable this policy setting, prompting for ActiveX control installations will be blocked for Internet Explorer processes.\r\n\r\nIf you disable this policy setting, prompting for ActiveX control installations will not be blocked for Internet Explorer processes.\r\n\r\nIf you do not configure this policy setting, the user's preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictactivexinstallinternetexplorerprocesses"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictactivexinstallinternetexplorerprocesses_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictactivexinstallinternetexplorerprocesses_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowaccesstodatasources","displayName":"Access data sources across domains (User)","description":"This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\r\n\r\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowaccesstodatasources"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowaccesstodatasources_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowaccesstodatasources_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowaccesstodatasources_iz_partname1406","displayName":"Access data sources across domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowaccesstodatasources_iz_partname1406_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowaccesstodatasources_iz_partname1406_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowaccesstodatasources_iz_partname1406_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowactivescripting","displayName":"Allow active scripting (User)","description":"This policy setting allows you to manage whether script code on pages in the zone is run.\r\n\r\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\r\n\r\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\r\n\r\nIf you do not configure this policy setting, script code on pages in the zone is prevented from running.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowactivescripting"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowactivescripting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowactivescripting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowactivescripting_iz_partname1400","displayName":"Allow active scripting (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowactivescripting_iz_partname1400_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowactivescripting_iz_partname1400_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowactivescripting_iz_partname1400_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowautomaticpromptingforactivexcontrols","displayName":"Automatic prompting for ActiveX controls (User)","description":"This policy setting manages whether users will be automatically prompted for ActiveX control installations.\r\n\r\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\r\n\r\nIf you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.\r\n\r\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowautomaticpromptingforactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowautomaticpromptingforactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowautomaticpromptingforactivexcontrols_iz_partname2201","displayName":"Automatic prompting for ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowautomaticpromptingforactivexcontrols_iz_partname2201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowautomaticpromptingforactivexcontrols_iz_partname2201_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowautomaticpromptingforfiledownloads","displayName":"Automatic prompting for file downloads (User)","description":"This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\r\n\r\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\r\n\r\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowautomaticpromptingforfiledownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowautomaticpromptingforfiledownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowautomaticpromptingforfiledownloads_iz_partname2200","displayName":"Automatic prompting for file downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowautomaticpromptingforfiledownloads_iz_partname2200_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowautomaticpromptingforfiledownloads_iz_partname2200_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowbinaryandscriptbehaviors","displayName":"Allow binary and script behaviors (User)","description":"This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\r\n\r\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the Admin-approved Behaviors under Binary Behaviors Security Restriction policy are available.\r\n\r\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\r\n\r\nIf you do not configure this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowbinaryandscriptbehaviors_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowbinaryandscriptbehaviors_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowbinaryandscriptbehaviors_iz_partname2000","displayName":"Allow Binary and Script Behaviors (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowbinaryandscriptbehaviors_iz_partname2000_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowbinaryandscriptbehaviors_iz_partname2000_65536","displayName":"Administrator approved","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowbinaryandscriptbehaviors_iz_partname2000_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowcopypasteviascript","displayName":"Allow cut, copy or paste operations from the clipboard via script (User)","description":"This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\r\n\r\nIf you enable this policy setting, a script can perform a clipboard operation.\r\n\r\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\r\n\r\nIf you disable this policy setting, a script cannot perform a clipboard operation.\r\n\r\nIf you do not configure this policy setting, a script cannot perform a clipboard operation.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowcopypasteviascript"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowcopypasteviascript_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowcopypasteviascript_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowcopypasteviascript_iz_partname1407","displayName":"Allow paste operations via script (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowcopypasteviascript_iz_partname1407_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowcopypasteviascript_iz_partname1407_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowcopypasteviascript_iz_partname1407_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowdraganddropcopyandpastefiles","displayName":"Allow drag and drop or copy and paste files (User)","description":"This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\r\n\r\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\r\n\r\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\r\n\r\nIf you do not configure this policy setting, users are queried to choose whether to drag or copy files from this zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowdraganddropcopyandpastefiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowdraganddropcopyandpastefiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowdraganddropcopyandpastefiles_iz_partname1802","displayName":"Allow drag and drop or copy and paste files (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowdraganddropcopyandpastefiles_iz_partname1802_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowdraganddropcopyandpastefiles_iz_partname1802_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowdraganddropcopyandpastefiles_iz_partname1802_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowfiledownloads","displayName":"Allow file downloads (User)","description":"This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\r\n\r\nIf you enable this policy setting, files can be downloaded from the zone.\r\n\r\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\r\n\r\n If you do not configure this policy setting, files are prevented from being downloaded from the zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowfiledownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowfiledownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowfiledownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowfiledownloads_iz_partname1803","displayName":"Allow file downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowfiledownloads_iz_partname1803_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowfiledownloads_iz_partname1803_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowfontdownloads","displayName":"Allow font downloads (User)","description":"This policy setting allows you to manage whether pages of the zone may download HTML fonts.\r\n\r\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\r\n\r\nIf you disable this policy setting, HTML fonts are prevented from downloading.\r\n\r\nIf you do not configure this policy setting, users are queried whether to allow HTML fonts to download.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowfontdownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowfontdownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowfontdownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowfontdownloads_iz_partname1604","displayName":"Allow font downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowfontdownloads_iz_partname1604_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowfontdownloads_iz_partname1604_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowfontdownloads_iz_partname1604_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowlessprivilegedsites","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\r\n\r\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\r\n\r\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\r\n\r\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowlessprivilegedsites"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowlessprivilegedsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowlessprivilegedsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowlessprivilegedsites_iz_partname2101","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowlessprivilegedsites_iz_partname2101_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowlessprivilegedsites_iz_partname2101_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowlessprivilegedsites_iz_partname2101_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowloadingofxamlfiles","displayName":"Allow loading of XAML files (User)","description":"This policy setting allows you to manage the loading of Extensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that take advantage of the Windows Presentation Foundation.\r\n\r\nIf you enable this policy setting and set the drop-down box to Enable, XAML files are automatically loaded inside Internet Explorer. The user cannot change this behavior. If you set the drop-down box to Prompt, the user is prompted for loading XAML files.\r\n\r\nIf you disable this policy setting, XAML files are not loaded inside Internet Explorer. The user cannot change this behavior.\r\n\r\nIf you do not configure this policy setting, the user can decide whether to load XAML files inside Internet Explorer.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowloadingofxamlfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowloadingofxamlfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowloadingofxamlfiles_iz_partname2402","displayName":"XAML Files (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowloadingofxamlfiles_iz_partname2402_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowloadingofxamlfiles_iz_partname2402_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowloadingofxamlfiles_iz_partname2402_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowmetarefresh","displayName":"Allow META REFRESH (User)","description":"This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page.\r\n\r\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\r\n\r\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\r\n\r\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowmetarefresh"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowmetarefresh_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowmetarefresh_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowmetarefresh_iz_partname1608","displayName":"Allow META REFRESH (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowmetarefresh_iz_partname1608_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowmetarefresh_iz_partname1608_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallownetframeworkreliantcomponents","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\r\n\r\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\r\n\r\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\r\n\r\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallownetframeworkreliantcomponents_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallownetframeworkreliantcomponents_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallownetframeworkreliantcomponents_iz_partname2004","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallownetframeworkreliantcomponents_iz_partname2004_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallownetframeworkreliantcomponents_iz_partname2004_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallownetframeworkreliantcomponents_iz_partname2004_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols","displayName":"Allow only approved domains to use ActiveX controls without prompt (User)","description":"This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control.\r\n\r\nIf you enable this policy setting, the user is prompted before ActiveX controls can run from websites in this zone. The user can choose to allow the control to run from the current site or from all sites.\r\n\r\nIf you disable this policy setting, the user does not see the per-site ActiveX prompt, and ActiveX controls can run from all sites in this zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols_iz_partname120b","displayName":"Only allow approved domains to use ActiveX controls without prompt (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols_iz_partname120b_3","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols_iz_partname120b_0","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol","displayName":"Allow only approved domains to use the TDC ActiveX control (User)","description":"This policy setting controls whether or not the user is allowed to run the TDC ActiveX control on websites.\r\n\r\nIf you enable this policy setting, the TDC ActiveX control will not run from websites in this zone.\r\n\r\nIf you disable this policy setting, the TDC Active X control will run from all sites in this zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol_iz_partname120c","displayName":"Only allow approved domains to use the TDC ActiveX control (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol_iz_partname120c_3","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol_iz_partname120c_0","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols","displayName":"Allow scripting of Internet Explorer WebBrowser controls (User)","description":"This policy setting determines whether a page can control embedded WebBrowser controls via script.\r\n\r\nIf you enable this policy setting, script access to the WebBrowser control is allowed.\r\n\r\nIf you disable this policy setting, script access to the WebBrowser control is not allowed.\r\n\r\nIf you do not configure this policy setting, the user can enable or disable script access to the WebBrowser control. By default, script access to the WebBrowser control is allowed only in the Local Machine and Intranet zones.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols_iz_partname1206","displayName":"Internet Explorer web browser control (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols_iz_partname1206_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols_iz_partname1206_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowscriptinitiatedwindows","displayName":"Allow script-initiated windows without size or position constraints (User)","description":"This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\r\n\r\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\r\n\r\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\r\n\r\nIf you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowscriptinitiatedwindows_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowscriptinitiatedwindows_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowscriptinitiatedwindows_iz_partname2102","displayName":"Allow script-initiated windows without size or position constraints (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowscriptinitiatedwindows_iz_partname2102_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowscriptinitiatedwindows_iz_partname2102_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowscriptlets","displayName":"Allow scriptlets (User)","description":"This policy setting allows you to manage whether the user can run scriptlets.\r\n\r\nIf you enable this policy setting, the user can run scriptlets.\r\n\r\nIf you disable this policy setting, the user cannot run scriptlets.\r\n\r\nIf you do not configure this policy setting, the user can enable or disable scriptlets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowscriptlets"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowscriptlets_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowscriptlets_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowscriptlets_iz_partname1209","displayName":"Scriptlets (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowscriptlets_iz_partname1209_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowscriptlets_iz_partname1209_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowsmartscreenie","displayName":"Turn on SmartScreen Filter scan (User)","description":"This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.\r\n\r\nIf you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nNote: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowsmartscreenie"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowsmartscreenie_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowsmartscreenie_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowsmartscreenie_iz_partname2301","displayName":"Use SmartScreen Filter (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowsmartscreenie_iz_partname2301_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowsmartscreenie_iz_partname2301_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowupdatestostatusbarviascript","displayName":"Allow updates to status bar via script (User)","description":"This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\r\n\r\nIf you enable this policy setting, script is allowed to update the status bar.\r\n\r\nIf you disable or do not configure this policy setting, script is not allowed to update the status bar.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowupdatestostatusbarviascript_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowupdatestostatusbarviascript_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowupdatestostatusbarviascript_iz_partname2103","displayName":"Status bar updates via script (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowupdatestostatusbarviascript_iz_partname2103_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowupdatestostatusbarviascript_iz_partname2103_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowuserdatapersistence","displayName":"Userdata persistence (User)","description":"This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\r\n\r\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you do not configure this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowuserdatapersistence"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowuserdatapersistence_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowuserdatapersistence_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowuserdatapersistence_iz_partname1606","displayName":"Userdata persistence (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowuserdatapersistence_iz_partname1606_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowuserdatapersistence_iz_partname1606_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowvbscripttorunininternetexplorer","displayName":"Allow VBScript to run in Internet Explorer (User)","description":"This policy setting allows you to manage whether VBScript can be run on pages from the specified zone in Internet Explorer.\r\n\r\nIf you selected Enable in the drop-down box, VBScript can run without user intervention.\r\n\r\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow VBScript to run.\r\n\r\nIf you selected Disable in the drop-down box, VBScript is prevented from running.\r\n\r\nIf you do not configure or disable this policy setting, VBScript is prevented from running.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowvbscripttorunininternetexplorer_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowvbscripttorunininternetexplorer_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowvbscripttorunininternetexplorer_iz_partname140c","displayName":"Allow VBScript to run in Internet Explorer (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowvbscripttorunininternetexplorer_iz_partname140c_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowvbscripttorunininternetexplorer_iz_partname140c_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneallowvbscripttorunininternetexplorer_iz_partname140c_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedonotrunantimalwareagainstactivexcontrols","displayName":"Don't run antimalware programs against ActiveX controls (User)","description":"This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.\r\n\r\nIf you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.\r\n\r\nIf you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.\r\n\r\nIf you don't configure this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedonotrunantimalwareagainstactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedonotrunantimalwareagainstactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedonotrunantimalwareagainstactivexcontrols_iz_partname270c","displayName":"Don't run antimalware programs against ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedonotrunantimalwareagainstactivexcontrols_iz_partname270c_3","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedonotrunantimalwareagainstactivexcontrols_iz_partname270c_0","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedownloadsignedactivexcontrols","displayName":"Download signed ActiveX controls (User)","description":"This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\r\n\r\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\r\n\r\nIf you disable the policy setting, signed controls cannot be downloaded.\r\n\r\nIf you do not configure this policy setting, signed controls cannot be downloaded.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedownloadsignedactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedownloadsignedactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedownloadsignedactivexcontrols_iz_partname1001","displayName":"Download signed ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedownloadsignedactivexcontrols_iz_partname1001_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedownloadsignedactivexcontrols_iz_partname1001_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedownloadsignedactivexcontrols_iz_partname1001_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedownloadunsignedactivexcontrols","displayName":"Download unsigned ActiveX controls (User)","description":"This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\r\n\r\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\r\n\r\nIf you disable this policy setting, users cannot run unsigned controls.\r\n\r\nIf you do not configure this policy setting, users cannot run unsigned controls.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedownloadunsignedactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedownloadunsignedactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedownloadunsignedactivexcontrols_iz_partname1004","displayName":"Download unsigned ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedownloadunsignedactivexcontrols_iz_partname1004_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedownloadunsignedactivexcontrols_iz_partname1004_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonedownloadunsignedactivexcontrols_iz_partname1004_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenablecrosssitescriptingfilter","displayName":"Turn on Cross-Site Scripting Filter (User)","description":"This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injections into websites in this zone.\r\n\r\nIf you enable this policy setting, the XSS Filter is turned on for sites in this zone, and the XSS Filter attempts to block cross-site script injections.\r\n\r\nIf you disable this policy setting, the XSS Filter is turned off for sites in this zone, and Internet Explorer permits cross-site script injections.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenablecrosssitescriptingfilter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenablecrosssitescriptingfilter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenablecrosssitescriptingfilter_iz_partname1409","displayName":"Turn on Cross-Site Scripting (XSS) Filter (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenablecrosssitescriptingfilter_iz_partname1409_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenablecrosssitescriptingfilter_iz_partname1409_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows","displayName":"Enable dragging of content from different domains across windows (User)","description":"This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows.\r\n\r\nIf you enable this policy setting and click Enable, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting.\r\n\r\nIf you enable this policy setting and click Disable, users cannot drag content from one domain to a different domain when both the source and destination are in different windows. Users cannot change this setting.\r\n\r\nIn Internet Explorer 10, if you disable this policy setting or do not configure it, users cannot drag content from one domain to a different domain when the source and destination are in different windows. Users can change this setting in the Internet Options dialog.\r\n\r\nIn Internet Explorer 9 and earlier versions, if you disable this policy or do not configure it, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows_iz_partname2709","displayName":"Enable dragging of content from different domains across windows (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows_iz_partname2709_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows_iz_partname2709_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows","displayName":"Enable dragging of content from different domains within a window (User)","description":"This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window.\r\n\r\nIf you enable this policy setting and click Enable, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting.\r\n\r\nIf you enable this policy setting and click Disable, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog.\r\n\r\nIn Internet Explorer 10, if you disable this policy setting or do not configure it, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users can change this setting in the Internet Options dialog.\r\n\r\nIn Internet Explorer 9 and earlier versions, if you disable this policy setting or do not configure it, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows_iz_partname2708","displayName":"Enable dragging of content from different domains within a window (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows_iz_partname2708_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows_iz_partname2708_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenablemimesniffing","displayName":"Enable MIME Sniffing (User)","description":"This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\r\n\r\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\r\n\r\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\r\n\r\nIf you do not configure this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneenablemimesniffing"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenablemimesniffing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenablemimesniffing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenablemimesniffing_iz_partname2100","displayName":"Enable MIME Sniffing (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenablemimesniffing_iz_partname2100_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneenablemimesniffing_iz_partname2100_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver","displayName":"Include local path when user is uploading files to a server (User)","description":"This policy setting controls whether or not local path information is sent when the user is uploading a file via an HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. For instance, files sent from the user's desktop may contain the user name as a part of the path.\r\n\r\nIf you enable this policy setting, path information is sent when the user is uploading a file via an HTML form.\r\n\r\nIf you disable this policy setting, path information is removed when the user is uploading a file via an HTML form.\r\n\r\nIf you do not configure this policy setting, the user can choose whether path information is sent when he or she is uploading a file via an HTML form. By default, path information is sent.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver_iz_partname160a","displayName":"Include local directory path when uploading files to a server (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver_iz_partname160a_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver_iz_partname160a_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneinitializeandscriptactivexcontrols","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"This policy setting allows you to manage ActiveX controls not marked as safe.\r\n\r\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\r\n\r\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\r\n\r\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\r\n\r\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneinitializeandscriptactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneinitializeandscriptactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneinitializeandscriptactivexcontrols_iz_partname1201","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneinitializeandscriptactivexcontrols_iz_partname1201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneinitializeandscriptactivexcontrols_iz_partname1201_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneinitializeandscriptactivexcontrols_iz_partname1201_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonejavapermissions","displayName":"Java permissions (User)","description":"This policy setting allows you to manage permissions for Java applets.\r\n\r\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\r\n\r\nLow Safety enables applets to perform all operations.\r\n\r\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.\r\n\r\nHigh Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.\r\n\r\nIf you disable this policy setting, Java applets cannot run.\r\n\r\nIf you do not configure this policy setting, Java applets are disabled.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszonejavapermissions"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonejavapermissions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonejavapermissions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonejavapermissions_iz_partname1c00","displayName":"Java permissions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonejavapermissions_iz_partname1c00_65536","displayName":"High safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonejavapermissions_iz_partname1c00_131072","displayName":"Medium safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonejavapermissions_iz_partname1c00_196608","displayName":"Low safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonejavapermissions_iz_partname1c00_8388608","displayName":"Custom","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonejavapermissions_iz_partname1c00_0","displayName":"Disable Java","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonelaunchingapplicationsandfilesiniframe","displayName":"Launching applications and files in an IFRAME (User)","description":"This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone.\r\n\r\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\r\n\r\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\r\n\r\nIf you do not configure this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonelaunchingapplicationsandfilesiniframe_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonelaunchingapplicationsandfilesiniframe_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonelaunchingapplicationsandfilesiniframe_iz_partname1804","displayName":"Launching applications and files in an IFRAME (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonelaunchingapplicationsandfilesiniframe_iz_partname1804_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonelaunchingapplicationsandfilesiniframe_iz_partname1804_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonelaunchingapplicationsandfilesiniframe_iz_partname1804_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonelogonoptions","displayName":"Logon options (User)","description":"This policy setting allows you to manage settings for logon options.\r\n\r\nIf you enable this policy setting, you can choose from the following logon options.\r\n\r\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\r\n\r\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\r\n\r\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\r\n\r\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\r\n\r\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\r\n\r\nIf you do not configure this policy setting, logon is set to Prompt for username and password.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszonelogonoptions"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonelogonoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonelogonoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonelogonoptions_iz_partname1a00","displayName":"Logon options (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonelogonoptions_iz_partname1a00_196608","displayName":"Anonymous logon","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonelogonoptions_iz_partname1a00_131072","displayName":"Automatic logon only in Intranet zone","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonelogonoptions_iz_partname1a00_0","displayName":"Automatic logon with current username and password","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonelogonoptions_iz_partname1a00_65536","displayName":"Prompt for user name and password","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonenavigatewindowsandframes","displayName":"Navigate windows and frames across different domains (User)","description":"This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\r\n\r\nIf you enable this policy setting, users can open additional windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow additional windows and frames to access applications from other domains.\r\n\r\nIf you disable this policy setting, users cannot open other windows and frames from other domains or access applications from different domains.\r\n\r\nIf you do not configure this policy setting, users cannot open other windows and frames from different domains or access applications from different domains.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszonenavigatewindowsandframes"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonenavigatewindowsandframes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonenavigatewindowsandframes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonenavigatewindowsandframes_iz_partname1607","displayName":"Navigate windows and frames across different domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonenavigatewindowsandframes_iz_partname1607_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonenavigatewindowsandframes_iz_partname1607_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonenavigatewindowsandframes_iz_partname1607_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonerunactivexcontrolsandplugins","displayName":"Run ActiveX controls and plugins (User)","description":"This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\r\n\r\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\r\n\r\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\r\n\r\nIf you disable this policy setting, controls and plug-ins are prevented from running.\r\n\r\nIf you do not configure this policy setting, controls and plug-ins are prevented from running.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonerunactivexcontrolsandplugins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonerunactivexcontrolsandplugins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonerunactivexcontrolsandplugins_iz_partname1200","displayName":"Run ActiveX controls and plugins (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonerunactivexcontrolsandplugins_iz_partname1200_65536","displayName":"Administrator approved","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonerunactivexcontrolsandplugins_iz_partname1200_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonerunactivexcontrolsandplugins_iz_partname1200_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonerunactivexcontrolsandplugins_iz_partname1200_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode","displayName":"Run .NET Framework-reliant components signed with Authenticode (User)","description":"This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\r\n\r\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\r\n\r\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\r\n\r\nIf you do not configure this policy setting, Internet Explorer will not execute signed managed components.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode_iz_partname2001","displayName":"Run .NET Framework-reliant components signed with Authenticode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode_iz_partname2001_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode_iz_partname2001_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode_iz_partname2001_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting","displayName":"Script ActiveX controls marked safe for scripting (User)","description":"This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\r\n\r\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\r\n\r\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\r\n\r\nIf you disable this policy setting, script interaction is prevented from occurring.\r\n\r\nIf you do not configure this policy setting, script interaction is prevented from occurring.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting_iz_partname1405","displayName":"Script ActiveX controls marked safe for scripting (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting_iz_partname1405_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting_iz_partname1405_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting_iz_partname1405_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonescriptingofjavaapplets","displayName":"Scripting of Java applets (User)","description":"This policy setting allows you to manage whether applets are exposed to scripts within the zone.\r\n\r\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\r\n\r\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\r\n\r\nIf you disable this policy setting, scripts are prevented from accessing applets.\r\n\r\nIf you do not configure this policy setting, scripts are prevented from accessing applets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszonescriptingofjavaapplets"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonescriptingofjavaapplets_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonescriptingofjavaapplets_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonescriptingofjavaapplets_iz_partname1402","displayName":"Scripting of Java applets (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonescriptingofjavaapplets_iz_partname1402_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonescriptingofjavaapplets_iz_partname1402_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszonescriptingofjavaapplets_iz_partname1402_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles","displayName":"Show security warning for potentially unsafe files (User)","description":"This policy setting controls whether or not the \"Open File - Security Warning\" message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file share by using File Explorer, for example).\r\n\r\nIf you enable this policy setting and set the drop-down box to Enable, these files open without a security warning. If you set the drop-down box to Prompt, a security warning appears before the files open.\r\n\r\nIf you disable this policy setting, these files do not open.\r\n\r\nIf you do not configure this policy setting, the user can configure how the computer handles these files. By default, these files are blocked in the Restricted zone, enabled in the Intranet and Local Computer zones, and set to prompt in the Internet and Trusted zones.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles_iz_partname1806","displayName":"Launching programs and unsafe files (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles_iz_partname1806_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles_iz_partname1806_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles_iz_partname1806_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneturnonprotectedmode","displayName":"Turn on Protected Mode (User)","description":"This policy setting allows you to turn on Protected Mode. Protected Mode helps protect Internet Explorer from exploited vulnerabilities by reducing the locations that Internet Explorer can write to in the registry and the file system.\r\n\r\nIf you enable this policy setting, Protected Mode is turned on. The user cannot turn off Protected Mode.\r\n\r\nIf you disable this policy setting, Protected Mode is turned off. The user cannot turn on Protected Mode.\r\n\r\nIf you do not configure this policy setting, the user can turn on or turn off Protected Mode.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneturnonprotectedmode"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneturnonprotectedmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneturnonprotectedmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneturnonprotectedmode_iz_partname2500","displayName":"Protected Mode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneturnonprotectedmode_iz_partname2500_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneturnonprotectedmode_iz_partname2500_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneusepopupblocker","displayName":"Use Pop-up Blocker (User)","description":"This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\r\n\r\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\r\n\r\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\r\n\r\nIf you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictedsiteszoneusepopupblocker"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneusepopupblocker_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneusepopupblocker_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneusepopupblocker_iz_partname1809","displayName":"Use Pop-up Blocker (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneusepopupblocker_iz_partname1809_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictedsiteszoneusepopupblocker_iz_partname1809_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictfiledownloadinternetexplorerprocesses","displayName":"Internet Explorer Processes (User)","description":"This policy setting enables blocking of file download prompts that are not user initiated.\r\n\r\nIf you enable this policy setting, file download prompts that are not user initiated will be blocked for Internet Explorer processes.\r\n\r\nIf you disable this policy setting, prompting will occur for file downloads that are not user initiated for Internet Explorer processes.\r\n\r\nIf you do not configure this policy setting, the user's preference determines whether to prompt for file downloads that are not user initiated for Internet Explorer processes.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-restrictfiledownloadinternetexplorerprocesses"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_restrictfiledownloadinternetexplorerprocesses_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_restrictfiledownloadinternetexplorerprocesses_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_scriptedwindowsecurityrestrictionsinternetexplorerprocesses","displayName":"Internet Explorer Processes (User)","description":"Internet Explorer allows scripts to programmatically open, resize, and reposition windows of various types. The Window Restrictions security feature restricts popup windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or obfuscate other Windows' title and status bars.\r\n\r\nIf you enable this policy setting, popup windows and other restrictions apply for File Explorer and Internet Explorer processes.\r\n\r\nIf you disable this policy setting, scripts can continue to create popup windows and windows that obfuscate other windows.\r\n\r\nIf you do not configure this policy setting, popup windows and other restrictions apply for File Explorer and Internet Explorer processes.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_scriptedwindowsecurityrestrictionsinternetexplorerprocesses_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_scriptedwindowsecurityrestrictionsinternetexplorerprocesses_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_searchproviderlist","displayName":"Restrict search providers to a specific list (User)","description":"This policy setting allows you to restrict the search providers that appear in the Search box in Internet Explorer to those defined in the list of policy keys for search providers (found under [HKCU or HKLM\\Software\\policies\\Microsoft\\Internet Explorer\\SearchScopes]). Normally, search providers can be added from third-party toolbars or in Setup, but the user can also add them from a search provider's website.\r\n\r\nIf you enable this policy setting, the user cannot configure the list of search providers on his or her computer, and any default providers installed do not appear (including providers installed from other applications). The only providers that appear are those in the list of policy keys for search providers. Note: This list can be created through a custom administrative template file. For information about creating this custom administrative template file, see the Internet Explorer documentation on search providers.\r\n\r\nIf you disable or do not configure this policy setting, the user can configure his or her list of search providers.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-searchproviderlist"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_searchproviderlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_searchproviderlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_sendsitesnotinenterprisesitelisttoedge","displayName":"Send all sites not included in the Enterprise Mode Site List to Microsoft Edge. (User)","description":"This setting lets you decide whether to open all sites not included in the Enterprise Mode Site List in Microsoft Edge. If you use this setting, you must also turn on the Administrative Templates\\Windows Components\\Internet Explorer\\Use the Enterprise Mode IE website list policy setting and you must include at least one site in the Enterprise Mode Site List.\r\n\r\nEnabling this setting automatically opens all sites not included in the Enterprise Mode Site List in Microsoft Edge.\r\n\r\nDisabling, or not configuring this setting, opens all sites based on the currently active browser.\r\n\r\nNote: If you've also enabled the Administrative Templates\\Windows Components\\Microsoft Edge\\Send all intranet sites to Internet Explorer 11 policy setting, then all intranet sites will continue to open in Internet Explorer 11.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-sendsitesnotinenterprisesitelisttoedge"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_sendsitesnotinenterprisesitelisttoedge_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_sendsitesnotinenterprisesitelisttoedge_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_specifyuseofactivexinstallerservice","displayName":"Specify use of ActiveX Installer Service for installation of ActiveX controls (User)","description":"This policy setting allows you to specify how ActiveX controls are installed.\r\n\r\nIf you enable this policy setting, ActiveX controls are installed only if the ActiveX Installer Service is present and has been configured to allow the installation of ActiveX controls.\r\n\r\nIf you disable or do not configure this policy setting, ActiveX controls, including per-user controls, are installed through the standard installation process.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-specifyuseofactivexinstallerservice"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_specifyuseofactivexinstallerservice_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_specifyuseofactivexinstallerservice_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowaccesstodatasources","displayName":"Access data sources across domains (User)","description":"This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\r\n\r\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\r\n\r\nIf you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-trustedsiteszoneallowaccesstodatasources"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowaccesstodatasources_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowaccesstodatasources_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowaccesstodatasources_iz_partname1406","displayName":"Access data sources across domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowaccesstodatasources_iz_partname1406_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowaccesstodatasources_iz_partname1406_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowaccesstodatasources_iz_partname1406_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowautomaticpromptingforactivexcontrols","displayName":"Automatic prompting for ActiveX controls (User)","description":"This policy setting manages whether users will be automatically prompted for ActiveX control installations.\r\n\r\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\r\n\r\nIf you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.\r\n\r\nIf you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowautomaticpromptingforactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowautomaticpromptingforactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowautomaticpromptingforactivexcontrols_iz_partname2201","displayName":"Automatic prompting for ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowautomaticpromptingforactivexcontrols_iz_partname2201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowautomaticpromptingforactivexcontrols_iz_partname2201_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowautomaticpromptingforfiledownloads","displayName":"Automatic prompting for file downloads (User)","description":"This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\r\n\r\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\r\n\r\nIf you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowautomaticpromptingforfiledownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowautomaticpromptingforfiledownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowautomaticpromptingforfiledownloads_iz_partname2200","displayName":"Automatic prompting for file downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowautomaticpromptingforfiledownloads_iz_partname2200_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowautomaticpromptingforfiledownloads_iz_partname2200_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowfontdownloads","displayName":"Allow font downloads (User)","description":"This policy setting allows you to manage whether pages of the zone may download HTML fonts.\r\n\r\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\r\n\r\nIf you disable this policy setting, HTML fonts are prevented from downloading.\r\n\r\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-trustedsiteszoneallowfontdownloads"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowfontdownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowfontdownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowfontdownloads_iz_partname1604","displayName":"Allow font downloads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowfontdownloads_iz_partname1604_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowfontdownloads_iz_partname1604_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowfontdownloads_iz_partname1604_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowlessprivilegedsites","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.\r\n\r\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\r\n\r\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\r\n\r\nIf you do not configure this policy setting, a warning is issued to the user that potentially risky navigation is about to occur.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-trustedsiteszoneallowlessprivilegedsites"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowlessprivilegedsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowlessprivilegedsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowlessprivilegedsites_iz_partname2101","displayName":"Web sites in less privileged Web content zones can navigate into this zone (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowlessprivilegedsites_iz_partname2101_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowlessprivilegedsites_iz_partname2101_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowlessprivilegedsites_iz_partname2101_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallownetframeworkreliantcomponents","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\r\n\r\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\r\n\r\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\r\n\r\nIf you do not configure this policy setting, Internet Explorer will execute unsigned managed components.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallownetframeworkreliantcomponents_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallownetframeworkreliantcomponents_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallownetframeworkreliantcomponents_iz_partname2004","displayName":"Run .NET Framework-reliant components not signed with Authenticode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallownetframeworkreliantcomponents_iz_partname2004_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallownetframeworkreliantcomponents_iz_partname2004_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallownetframeworkreliantcomponents_iz_partname2004_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowscriptlets","displayName":"Allow scriptlets (User)","description":"This policy setting allows you to manage whether the user can run scriptlets.\r\n\r\nIf you enable this policy setting, the user can run scriptlets.\r\n\r\nIf you disable this policy setting, the user cannot run scriptlets.\r\n\r\nIf you do not configure this policy setting, the user can enable or disable scriptlets.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-trustedsiteszoneallowscriptlets"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowscriptlets_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowscriptlets_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowscriptlets_iz_partname1209","displayName":"Scriptlets (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowscriptlets_iz_partname1209_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowscriptlets_iz_partname1209_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowsmartscreenie","displayName":"Turn on SmartScreen Filter scan (User)","description":"This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nIf you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.\r\n\r\nIf you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.\r\n\r\nNote: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-trustedsiteszoneallowsmartscreenie"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowsmartscreenie_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowsmartscreenie_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowsmartscreenie_iz_partname2301","displayName":"Use SmartScreen Filter (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowsmartscreenie_iz_partname2301_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowsmartscreenie_iz_partname2301_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowuserdatapersistence","displayName":"Userdata persistence (User)","description":"This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\r\n\r\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\r\n\r\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-trustedsiteszoneallowuserdatapersistence"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowuserdatapersistence_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowuserdatapersistence_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowuserdatapersistence_iz_partname1606","displayName":"Userdata persistence (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowuserdatapersistence_iz_partname1606_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneallowuserdatapersistence_iz_partname1606_3","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonedonotrunantimalwareagainstactivexcontrols","displayName":"Don't run antimalware programs against ActiveX controls (User)","description":"This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.\r\n\r\nIf you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.\r\n\r\nIf you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.\r\n\r\nIf you don't configure this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonedonotrunantimalwareagainstactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonedonotrunantimalwareagainstactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonedonotrunantimalwareagainstactivexcontrols_iz_partname270c","displayName":"Don't run antimalware programs against ActiveX controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonedonotrunantimalwareagainstactivexcontrols_iz_partname270c_3","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonedonotrunantimalwareagainstactivexcontrols_iz_partname270c_0","displayName":"Disable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneinitializeandscriptactivexcontrols","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"This policy setting allows you to manage ActiveX controls not marked as safe.\r\n\r\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\r\n\r\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\r\n\r\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\r\n\r\nIf you do not configure this policy setting, users are queried whether to allow the control to be loaded with parameters or scripted.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneinitializeandscriptactivexcontrols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneinitializeandscriptactivexcontrols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneinitializeandscriptactivexcontrols_iz_partname1201","displayName":"Initialize and script ActiveX controls not marked as safe (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneinitializeandscriptactivexcontrols_iz_partname1201_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneinitializeandscriptactivexcontrols_iz_partname1201_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszoneinitializeandscriptactivexcontrols_iz_partname1201_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonejavapermissions","displayName":"Java permissions (User)","description":"This policy setting allows you to manage permissions for Java applets.\r\n\r\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\r\n\r\nLow Safety enables applets to perform all operations.\r\n\r\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.\r\n\r\nHigh Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.\r\n\r\nIf you disable this policy setting, Java applets cannot run.\r\n\r\nIf you do not configure this policy setting, the permission is set to Low Safety.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-trustedsiteszonejavapermissions"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonejavapermissions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonejavapermissions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonejavapermissions_iz_partname1c00","displayName":"Java permissions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonejavapermissions_iz_partname1c00_65536","displayName":"High safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonejavapermissions_iz_partname1c00_131072","displayName":"Medium safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonejavapermissions_iz_partname1c00_196608","displayName":"Low safety","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonejavapermissions_iz_partname1c00_8388608","displayName":"Custom","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonejavapermissions_iz_partname1c00_0","displayName":"Disable Java","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonelogonoptions","displayName":"Logon options (User)","description":"This policy setting allows you to manage settings for logon options.\r\n\r\nIf you enable this policy setting, you can choose from the following logon options.\r\n\r\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\r\n\r\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\r\n\r\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\r\n\r\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\r\n\r\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\r\n\r\nIf you do not configure this policy setting, logon is set to Automatic logon with current username and password.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-trustedsiteszonelogonoptions"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonelogonoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonelogonoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonelogonoptions_iz_partname1a00","displayName":"Logon options (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonelogonoptions_iz_partname1a00_196608","displayName":"Anonymous logon","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonelogonoptions_iz_partname1a00_131072","displayName":"Automatic logon only in Intranet zone","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonelogonoptions_iz_partname1a00_0","displayName":"Automatic logon with current username and password","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonelogonoptions_iz_partname1a00_65536","displayName":"Prompt for user name and password","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonenavigatewindowsandframes","displayName":"Navigate windows and frames across different domains (User)","description":"This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\r\n\r\nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\r\n\r\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\r\n\r\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-trustedsiteszonenavigatewindowsandframes"],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonenavigatewindowsandframes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonenavigatewindowsandframes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonenavigatewindowsandframes_iz_partname1607","displayName":"Navigate windows and frames across different domains (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonenavigatewindowsandframes_iz_partname1607_0","displayName":"Enable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonenavigatewindowsandframes_iz_partname1607_3","displayName":"Disable","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_internetexplorer_trustedsiteszonenavigatewindowsandframes_iz_partname1607_1","displayName":"Prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_kioskbrowser_blockedurlexceptions","displayName":"Blocked Url Exceptions (User)","description":"List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-KioskBrowser#blockedurlexceptions"],"options":null},{"id":"user_vendor_msft_policy_config_kioskbrowser_blockedurls","displayName":"Blocked Urls (User)","description":"List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers can not navigate to.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-KioskBrowser#blockedurls"],"options":null},{"id":"user_vendor_msft_policy_config_kioskbrowser_defaulturl","displayName":"Default URL (User)","description":"Configures the default URL kiosk browsers to navigate on launch and restart.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-KioskBrowser#defaulturl"],"options":null},{"id":"user_vendor_msft_policy_config_kioskbrowser_enableendsessionbutton","displayName":"Enable End Session Button (User)","description":"Enable/disable kiosk browser's end session button.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-KioskBrowser#enableendsessionbutton"],"options":[{"id":"user_vendor_msft_policy_config_kioskbrowser_enableendsessionbutton_1","displayName":"Enable","description":"Enable","helpText":null},{"id":"user_vendor_msft_policy_config_kioskbrowser_enableendsessionbutton_0","displayName":"Disable","description":"Disable","helpText":null}]},{"id":"user_vendor_msft_policy_config_kioskbrowser_enablehomebutton","displayName":"Enable Home Button (User)","description":"Enable/disable kiosk browser's home button.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-KioskBrowser#enablehomebutton"],"options":[{"id":"user_vendor_msft_policy_config_kioskbrowser_enablehomebutton_1","displayName":"Enable","description":"Enable","helpText":null},{"id":"user_vendor_msft_policy_config_kioskbrowser_enablehomebutton_0","displayName":"Disable","description":"Disable","helpText":null}]},{"id":"user_vendor_msft_policy_config_kioskbrowser_enablenavigationbuttons","displayName":"Enable Navigation Buttons (User)","description":"Enable/disable kiosk browser's navigation buttons (forward/back).","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-KioskBrowser#enablenavigationbuttons"],"options":[{"id":"user_vendor_msft_policy_config_kioskbrowser_enablenavigationbuttons_1","displayName":"Enable","description":"Enable","helpText":null},{"id":"user_vendor_msft_policy_config_kioskbrowser_enablenavigationbuttons_0","displayName":"Disable","description":"Disable","helpText":null}]},{"id":"user_vendor_msft_policy_config_kioskbrowser_restartonidletime","displayName":"Restart On Idle Time (User)","description":"Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-KioskBrowser#restartonidletime"],"options":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policyconfigurationmode_1","displayName":"Specify server (User)","description":"\r\nSpecifies how Microsoft Lync identifies the server.\r\n\r\nIf you enable this policy setting, you must specify the server name that Microsoft Lync uses.\r\n\r\nIf you disable this policy setting, Microsoft Lync uses a DNS lookup to identify the server.\r\n\r\nIf you do not configure this policy setting, the user can choose automatic configuration, or the user can specify the name of the server in Microsoft Lync user preferences. To set the user preferences, from the Microsoft Lync Tools menu, click Options, click the Personal tab, within the SIP Communications My Account area click Advanced, select Configure Settings, type the server name in the Server name field.\r\n\r\nNote: You can configure this policy setting under both Computer Configuration and User Configuration, but the policy setting under Computer Configuration takes precedence.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policyconfigurationmode_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policyconfigurationmode_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policyconfigurationmode_1_l_serveraddressexternal_value","displayName":"DNS name of the external server (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policyconfigurationmode_1_l_serveraddressinternal_value","displayName":"DNS name of the internal server (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policyconfiguredservercheckvalues_1","displayName":"Additional server versions supported (User)","description":"\r\nSpecify a semicolon separated list of server version names, e.g. RTC/2.9;RTC/3.0;RTC/4.0, to which Microsoft Lync allows logon in addition to the server versions that are supported by default. Space character is treated as part of the version string.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policyconfiguredservercheckvalues_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policyconfiguredservercheckvalues_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policyconfiguredservercheckvalues_1_l_configuredservercheckvalues_value","displayName":"Server version names (semicolon separated list): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policydisableautomaticsendtracing_1","displayName":"Disable automatic upload of sign-in failure logs (User)","description":"\r\nUploads the sign-in failure logs to the Microsoft Lync Server automatically for analysis. No logs will be automatically uploaded if sign-in is successful.\r\n\r\nIf this policy is not configured, then the following happens: \r\nFor Lync Online Users: Sign-in failure logs are automatically uploaded.\r\nFor Lync On-Premise Users: A confirmation seeking consent from the user is shown before upload.\r\n\r\nWhen this is disabled, sign-in logs would be uploaded to the Microsoft Lync Server for both Lync On-Premise and Online users automatically.\r\n\r\nWhen this is enabled, sign-in logs will never be uploaded automatically.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policydisableautomaticsendtracing_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policydisableautomaticsendtracing_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policydisablehttpconnect_1","displayName":"Disable HTTP fallback for SIP connection (User)","description":"Prevents from HTTP being used for SIP connection in case TLS or TCP fail.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policydisablehttpconnect_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policydisablehttpconnect_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policydisablentcredentials_1","displayName":"Require logon credentials (User)","description":"\r\nRequires the user to provide logon credentials for Microsoft Lync rather than automatically using the Windows credentials when Microsoft Lync authenticates the user using NTLM or Kerberos.\r\n\r\nIf you enable this policy setting, Microsoft Lync requires the user to provide logon credentials.\r\n\r\nIf you disable or do not configure this policy setting, Microsoft Lync authenticates the user based on the logon credentials for Windows.\r\n\r\nNote: You can configure this policy setting under both Computer Configuration and User Configuration, but the policy setting under Computer Configuration takes precedence.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policydisablentcredentials_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policydisablentcredentials_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policydisableservercheck_1","displayName":"Disable server version check (User)","description":"Prevents Microsoft Lync from checking the server version before signing in.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policydisableservercheck_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policydisableservercheck_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policyenablebitsforgaldownload_1","displayName":"Enable using BITS to download Address Book Service files (User)","description":"This policy allows Microsoft Lync to use BITS (Background Intelligent Transfer Service) to download the Address Book Services files.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policyenablebitsforgaldownload_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policyenablebitsforgaldownload_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policyenablesiphighsecuritymode_1","displayName":"Configure SIP security mode (User)","description":"\r\nWhen Lync connects to the server, it supports various authentication mechanisms. This policy allows the user to specify whether Digest and Basic authentication are supported.\r\n\r\nDisabled (default): NTLM/Kerberos/TLS-DSK/Digest/Basic\r\nEnabled:\r\n Authentication mechanisms: NTLM/Kerberos/TLS-DSK\r\n Gal Download: Requires HTTPS if user is not logged in as an internal user.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policyenablesiphighsecuritymode_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policyenablesiphighsecuritymode_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policygaldownloadinitialdelay_1","displayName":"Global Address Book Download Initial Delay (User)","description":"\r\nWhen set, this will delay the initial download of the Global Address Book by a random number between 0 and the number of minutes specified after sign-in. When the value is 0, the download will begin immediately after sign-in. By default, the value is 60. This means that there will be a random delay between 0 and 60 minutes after sign-in before Lync begins to download the address book.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policygaldownloadinitialdelay_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policygaldownloadinitialdelay_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policygaldownloadinitialdelay_1_l_galdownloadinitialdelay_value","displayName":"Maximum possible number of minutes to delay download: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policypreventrun_1","displayName":"Prevent users from running Microsoft Lync (User)","description":"\r\nPrevents users from running Microsoft Lync.\r\n\r\nIf you enable this policy setting, users cannot run Microsoft Lync.\r\n\r\nIf you disable or do not configure this policy setting, users can run Microsoft Lync.\r\n\r\nNote: You can configure this policy setting under both Computer Configuration and User Configuration, but the policy setting under Computer Configuration takes precedence.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policypreventrun_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policypreventrun_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policysavepassword_1","displayName":"Allow storage of user passwords (User)","description":"\r\nAllows Microsoft Lync to store user passwords.\r\n\r\nIf you enable this policy setting, Microsoft Lync can store a password on request from the user.\r\n\r\nIf you disable this policy setting, Microsoft Lync cannot store a password.\r\n\r\nIf you do not configure this policy setting and the user logs on to a domain, Microsoft Lync does not store the password. If you do not configure this policy setting and the user does not log on to a domain (for example, if the user logs on to a workgroup), Microsoft Lync can store the password.\r\n\r\nNote: You can configure this policy setting under both Computer Configuration and User Configuration, but the policy setting under Computer Configuration takes precedence.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policysavepassword_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policysavepassword_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policysipcompression_1","displayName":"Configure SIP compression mode (User)","description":"\r\nDefines when to turn on SIP compression. Default: Based on adaptor speed.\r\n\r\nSetting this policy may cause an increase in sign-in time.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policysipcompression_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policysipcompression_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policysipcompression_1_l_policysipcompression","displayName":"Configure SIP compression mode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policysipcompression_1_l_policysipcompression_0","displayName":"Always disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policysipcompression_1_l_policysipcompression_1","displayName":"Always enabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policysipcompression_1_l_policysipcompression_2","displayName":"Based on adaptor speed (default)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policysipcompression_1_l_policysipcompression_3","displayName":"Based on ping round-trip time","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policytrustmodeldata_1","displayName":"Trusted Domain List (User)","description":"\r\nWhen Lync connects to an unknown domain, it needs explicit user consent. A dialog is shown asking the user for confirmation on whether it should continue.\r\n\r\nThis policy gives administrators the ability to provide trusted domain names. If a domain name is added to this list, Lync will trust that domain and will not show the dialog requesting permission. Multiple domain addresses as comma separated values can be provided.\r\n\r\nBy setting this policy, Lync will not explicitly trust the default domains specified below. It will exclusively trust the domain specified by the policy.\r\n\r\nSupported values:\r\n Not Configured (Default)/Disabled: By default the following domains will be trusted: \"lync.com, outlook.com, lync.glbdns.microsoft.com, and microsoftonline.com.\"\r\n Enabled: The list of domains to be trusted. For example: \"contoso.com, contoso.co.in\"\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policytrustmodeldata_1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policytrustmodeldata_1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_lync16v2~policy~l_lync~l_lyncconfiguration_l_policytrustmodeldata_1_l_trustmodeldata_value","displayName":"Trusted Domains (comma separated list): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v1~policy~microsoft_edge_webview2~webview2loaderoverridesettings_browserexecutablefolder","displayName":"Configure the location of the browser executable folder (User)","description":"This policy configures WebView2 applications to use the WebView2 Runtime in the specified path. The folder should contain the following files: msedgewebview2.exe, msedge.dll, and so on.\r\n\r\nTo set the value for the folder path, provide a Value name and Value pair. Set value name to the Application User Model ID or the executable file name. You can use the \"*\" wildcard as value name to apply to all applications.\r\n\r\nExample value:\r\n\r\nName: *, Value: C:\\Program Files\\Microsoft Edge WebView2 Runtime Redistributable 85.0.541.0 x64","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v1~policy~microsoft_edge_webview2~webview2loaderoverridesettings_browserexecutablefolder_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v1~policy~microsoft_edge_webview2~webview2loaderoverridesettings_browserexecutablefolder_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v1~policy~microsoft_edge_webview2~webview2loaderoverridesettings_browserexecutablefolder_browserexecutablefolderdesc","displayName":"Set value name to the Application User Model ID or the executable file name. You can use the \"*\" wildcard as value name to apply to all applications. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v1~policy~microsoft_edge_webview2~webview2loaderoverridesettings_browserexecutablefolder_browserexecutablefolderdesc_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v1~policy~microsoft_edge_webview2~webview2loaderoverridesettings_browserexecutablefolder_browserexecutablefolderdesc_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v1~policy~microsoft_edge_webview2~webview2loaderoverridesettings_releasechannelpreference","displayName":"Set the release channel search order preference (User)","description":"The default channel search order is WebView2 Runtime, Beta, Dev, and Canary.\r\n\r\nTo reverse the default search order, set this policy to 1.\r\n\r\nTo set the value for the release channel preference, provide a Value name and Value pair. Set value name to the Application User Model ID or the executable file name. You can use the \"*\" wildcard as value name to apply to all applications.\r\n\r\nExample value:\r\n\r\nName: *, Value: 1","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v1~policy~microsoft_edge_webview2~webview2loaderoverridesettings_releasechannelpreference_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v1~policy~microsoft_edge_webview2~webview2loaderoverridesettings_releasechannelpreference_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v1~policy~microsoft_edge_webview2~webview2loaderoverridesettings_releasechannelpreference_releasechannelpreferencedesc","displayName":"Set value name to the Application User Model ID or the executable file name. You can use the \"*\" wildcard as value name to apply to all applications. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v1~policy~microsoft_edge_webview2~webview2loaderoverridesettings_releasechannelpreference_releasechannelpreferencedesc_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v1~policy~microsoft_edge_webview2~webview2loaderoverridesettings_releasechannelpreference_releasechannelpreferencedesc_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_experimentationandconfigurationservicecontrol","displayName":"Control communication with the Experimentation and Configuration Service (User)","description":"The Experimentation and Configuration Service is used to deploy Experimentation and Configuration payloads to the client.\r\n\r\nExperimentation payload consists of a list of early in development features that Microsoft is enabling for testing and feedback.\r\n\r\nConfiguration payload consists of a list of recommended settings that Microsoft wants to deploy to optimize the user experience.\r\n\r\nConfiguration payload may also contain a list of actions to take on certain domains for compatibility reasons. For example, the browser may override the User Agent string on a website if that website is broken. Each of these actions is intended to be temporary while Microsoft tries to resolve the issue with the site owner.\r\n\r\nIf you set this policy to 'FullMode', the full payload is downloaded from the Experimentation and Configuration Service. This includes both the experimentation and configuration payloads.\r\n\r\nIf you set this policy to 'ConfigurationsOnlyMode', only the configuration payload is downloaded.\r\n\r\nIf you set this policy to 'RestrictedMode', the communication with the Experimentation and Configuration Service is stopped completely. Microsoft does not recommend this setting.\r\n\r\nIf you don't configure this policy on a managed device, the behavior on Beta and Stable channels is the same as the 'ConfigurationsOnlyMode'. On Canary and Dev channels the behavior is the same as 'FullMode'.\r\n\r\nIf you don't configure this policy on an unmanaged device, the behavior is the same as the 'FullMode'.\r\n\r\nPolicy options mapping:\r\n\r\n* FullMode (2) = Retrieve configurations and experiments\r\n\r\n* ConfigurationsOnlyMode (1) = Retrieve configurations only\r\n\r\n* RestrictedMode (0) = Disable communication with the Experimentation and Configuration Service\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_experimentationandconfigurationservicecontrol_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_experimentationandconfigurationservicecontrol_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_experimentationandconfigurationservicecontrol_experimentationandconfigurationservicecontrol","displayName":"Control communication with the Experimentation and Configuration Service (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_experimentationandconfigurationservicecontrol_experimentationandconfigurationservicecontrol_2","displayName":"Retrieve configurations and experiments","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_experimentationandconfigurationservicecontrol_experimentationandconfigurationservicecontrol_1","displayName":"Retrieve configurations only","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_experimentationandconfigurationservicecontrol_experimentationandconfigurationservicecontrol_0","displayName":"Disable communication with the Experimentation and Configuration Service","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_forcepermissionpolicyunloaddefaultenabled","displayName":"Controls whether unload event handlers can be disabled. (User)","description":"unload event handlers are being deprecated. Whether they fire depends on the unload Permissions-Policy.\r\nCurrently, they are allowed by policy by default. In the future they will gradually move to being disallowed by default and sites must explicitly enable them using Permissions-Policy headers.\r\nThis enterprise policy can be used to opt out of this gradual deprecation by forcing the default to stay enabled.\r\n\r\nPages might depend on unload event handlers to save data or signal the end of a user session to the server.\r\nThis is not recommended because it's unreliable and impacts performance by blocking use of BackForwardCache.\r\nRecommended alternatives exist, but the unload event has been used for a long time. Some applications might still rely on them.\r\n\r\nIf you disable this policy or don't configure it, unload event handlers will gradually be deprecated in-line with the deprecation rollout and sites which don't set Permissions-Policy header will stop firing `unload` events.\r\n\r\nIf you enable this policy then unload event handlers will continue to work by default.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_forcepermissionpolicyunloaddefaultenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_forcepermissionpolicyunloaddefaultenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_httpallowlist","displayName":"HTTP Allowlist (User)","description":"Setting the policy specifies a list of hostnames or hostname patterns (such as '[*.]example.com') that will not be upgraded to HTTPS and will not show an error interstitial if HTTPS-First Mode is enabled. Organizations can use this policy to maintain access to servers that do not support HTTPS, without needing to disable \"AutomaticHttpsDefault\".\r\n\r\nSupplied hostnames must be canonicalized: Any IDNs must be converted to their A-label format, and all ASCII letters must be lowercase.\r\n\r\nBlanket host wildcards (i.e., \"*\" or \"[*]\") are not allowed. Instead, HTTPS-First Mode and HTTPS Upgrades should be explicitly disabled via their specific policies.\r\n\r\nNote: This policy does not apply to HSTS upgrades.\r\n\r\nExample value:\r\n\r\ntestserver.example.com\r\n[*.]example.org","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_httpallowlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_httpallowlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_httpallowlist_httpallowlistdesc","displayName":"HTTP Allowlist (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_httpallowlist_httpallowlistdesc_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_httpallowlist_httpallowlistdesc_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_newbaseurlinheritancebehaviorallowed","displayName":"Allows enabling the feature NewBaseUrlInheritanceBehavior (User)","description":"NewBaseUrlInheritanceBehavior is a Microsoft Edge feature that causes about:blank and about:srcdoc frames to consistently inherit their base url values via snapshots of their initiator's base url.\r\n\r\nIf you disable this policy, it prevents users or Microsoft Edge variations from enabling NewBaseUrlInheritanceBehavior, in case compatibility issues are discovered.\r\n\r\nIf you enable or don't configure this policy, it allows enabling NewBaseUrlInheritanceBehavior.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_newbaseurlinheritancebehaviorallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_newbaseurlinheritancebehaviorallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_newpdfreaderwebview2list","displayName":"Enable built-in PDF reader powered by Adobe Acrobat for WebView2 (User)","description":"This policy configures WebView2 applications to launch the new version of the PDF reader that's powered by Adobe Acrobat's PDF reader. The new PDF reader ensures that there's no loss of functionality and delivers an enhanced PDF experience. This experience includes richer rendering, improved performance, strong security for PDF file handling, and greater accessibility.\r\n\r\nIf this policy is specified for an application, it is possible that it may impact other related applications as well. The policy is applied to all WebView2s sharing the same WebView2 user data folder. These WebView2s could potentially belong to multiple applications if those applications, which are likely from the same product family, are designed to share the same user data folder.\r\n\r\nUse a name-value pair to enable the new PDF reader for the application. Set the name to the Application User Model ID or the executable file name. You can use the \"*\" wildcard as value name to apply to all applications. Set the Value to true to enable the new reader or set it to false to use the existing one.\r\n\r\nIf you enable this policy for the specified WebView2 applications, they will use the new Adobe Acrobat powered PDF reader to open all PDF files.\r\n\r\nIf you disable the policy for the specified WebView2 applications or don't configure it, they will use the existing PDF reader to open all PDF files.\r\n\r\nExample value:\r\n\r\n{\"name\": \"app1.exe\", \"value\": true}\r\n{\"name\": \"app_id_for_app2\", \"value\": true}\r\n{\"name\": \"*\", \"value\": false}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_newpdfreaderwebview2list_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_newpdfreaderwebview2list_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_newpdfreaderwebview2list_newpdfreaderwebview2listdesc","displayName":"Set value name to the Application User Model ID or the executable file name. You can use the \"*\" wildcard as value name to apply to all applications. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_newpdfreaderwebview2list_newpdfreaderwebview2listdesc_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_newpdfreaderwebview2list_newpdfreaderwebview2listdesc_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_rsakeyusageforlocalanchorsenabled","displayName":"Check RSA key usage for server certificates issued by local trust anchors (User)","description":"The X.509 key usage extension declares how the key in a certificate can be\r\nused. These instructions ensure certificates aren't used in an unintended\r\ncontext, which protects against a class of cross-protocol attacks on HTTPS and\r\nother protocols. HTTPS clients must verify that server certificates match the\r\nconnection's TLS parameters.\r\n\r\nIf this policy is enabled,\r\nMicrosoft Edge will perform this key\r\ncheck. This helps prevent attacks where an attacker manipulates the browser into\r\ninterpreting a key in ways that the certificate owner did not intend.\r\n\r\nIf this policy is set to disabled or not configured,\r\nMicrosoft Edge will skip this key check in\r\nHTTPS connections that negotiate TLS 1.2 and use an RSA certificate that\r\nchains to a local trust anchor. Examples of local trust anchors include\r\npolicy-provided or user-installed root certificates. In all other cases, the\r\ncheck is performed independent of this policy's setting.\r\n\r\nThis policy is available for administrators to preview the behavior of a\r\nfuture release, which will enable this check by default. At that point, this\r\npolicy will remain temporarily available for administrators that need more\r\ntime to update their certificates to meet the new RSA key usage requirements.\r\n\r\nConnections that fail this check will fail with the error\r\nERR_SSL_KEY_USAGE_INCOMPATIBLE. Sites that fail with this error likely have a\r\nmisconfigured certificate. Modern ECDHE_RSA cipher suites use the\r\n\"digitalSignature\" key usage option, while legacy RSA decryption cipher suites\r\nuse the \"keyEncipherment\" key usage option. If uncertain, administrators should\r\ninclude both in RSA certificates meant for HTTPS.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_rsakeyusageforlocalanchorsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge_webview2v2~policy~microsoft_edge_webview2_rsakeyusageforlocalanchorsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_allowdeletingbrowserhistory","displayName":"Enable deleting browser and download history (User)","description":"Enables deleting browser history and download history and prevents users from changing this setting.\r\n\r\nNote that even with this policy is disabled, the browsing and download history aren't guaranteed to be retained: users can edit or delete the history database files directly, and the browser itself may remove (based on expiration period) or archive any or all history items at any time.\r\n\r\nIf you enable this policy or don't configure it, users can delete the browsing and download history.\r\n\r\nIf you disable this policy, users can't delete browsing and download history.\r\n\r\nIf you enable this policy, don't enable the 'ClearBrowsingDataOnExit' (Clear browsing data when Microsoft Edge closes) policy, because they both deal with deleting data. If you enable both, the 'ClearBrowsingDataOnExit' policy takes precedence and deletes all data when Microsoft Edge closes, regardless of how this policy is configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_allowdeletingbrowserhistory_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_allowdeletingbrowserhistory_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_allowfileselectiondialogs","displayName":"Allow file selection dialogs (User)","description":"Allow access to local files by letting Microsoft Edge display file selection dialogs.\r\n\r\nIf you enable or don't configure this policy, users can open file selection dialogs as normal.\r\n\r\nIf you disable this policy, whenever the user performs an action that triggers a file selection dialog (like importing favorites, uploading files, or saving links), a message is displayed instead, and the user is assumed to have clicked Cancel on the file selection dialog.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_allowfileselectiondialogs_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_allowfileselectiondialogs_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_alwaysopenpdfexternally","displayName":"Always open PDF files externally (User)","description":"Disables the internal PDF viewer in Microsoft Edge.\r\n\r\nIf you enable this policy Microsoft Edge treats PDF files as downloads and lets users open them with the default application.\r\n\r\nIf you don't configure this policy or disable it, Microsoft Edge will open PDF files (unless the user disables it).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_alwaysopenpdfexternally_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_alwaysopenpdfexternally_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_applicationlocalevalue","displayName":"Set application locale (User)","description":"Configures the application locale in Microsoft Edge and prevents users from changing the locale.\r\n\r\nIf you enable this policy, Microsoft Edge uses the specified locale. If the configured locale isn't supported, 'en-US' is used instead.\r\n\r\nIf you disable or don't configure this setting, Microsoft Edge uses either the user-specified preferred locale (if configured) or the fallback locale 'en-US'.\r\n\r\nExample value: en","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_applicationlocalevalue_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_applicationlocalevalue_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_applicationlocalevalue_applicationlocalevalue","displayName":"Application locale (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_audiocaptureallowed","displayName":"Allow or block audio capture (User)","description":"Allows you to set whether a user is prompted to grant a website access to their audio capture device. This policy applies to all URLs except for those configured in the 'AudioCaptureAllowedUrls' (Sites that can access audio capture devices without requesting permission) list.\r\n\r\nIf you enable this policy or don't configure it (the default setting), the user is prompted for audio capture access except from the URLs in the 'AudioCaptureAllowedUrls' list. These listed URLs are granted access without prompting.\r\n\r\nIf you disable this policy, the user is not prompted, and audio capture is accessible only to the URLs configured in 'AudioCaptureAllowedUrls'.\r\n\r\nThis policy affects all types of audio inputs, not only the built-in microphone.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_audiocaptureallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_audiocaptureallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_audiocaptureallowedurls","displayName":"Sites that can access audio capture devices without requesting permission (User)","description":"Specify websites, based on URL patterns, that can use audio capture devices without asking the user for permission. Patterns in this list are matched against the security origin of the requesting URL. If they match, the site is automatically granted access to audio capture devices. Note, however, that the pattern \"*\", which matches any URL, is not supported by this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com/\r\nhttps://[*.]contoso.edu/","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_audiocaptureallowedurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_audiocaptureallowedurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_audiocaptureallowedurls_audiocaptureallowedurlsdesc","displayName":"Sites that can access audio capture devices without requesting permission (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_autofilladdressenabled","displayName":"Enable AutoFill for addresses (User)","description":"Enables the AutoFill feature and allows users to auto-complete address information in web forms using previously stored information.\r\n\r\nIf you disable this policy, AutoFill never suggests or fills in address information, nor does it save additional address information that the user might submit while browsing the web.\r\n\r\nIf you enable this policy or don't configure it, users can control AutoFill for addresses in the user interface.\r\n\r\nNote that if you disable this policy you also stop all activity for all web forms, except payment and password forms. No further entries are saved, and Microsoft Edge won't suggest or AutoFill any previous entries.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_autofilladdressenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_autofilladdressenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_autofillcreditcardenabled","displayName":"Enable AutoFill for payment instruments (User)","description":"Enables Microsoft Edge's AutoFill feature and lets users auto complete payment instruments like credit or debit cards in web forms using previously stored information. This includes suggesting new payment instruments like Buy Now Pay Later (BNPL) in web forms and Express Checkout.\r\n\r\nIf you enable this policy or don't configure it, users can control AutoFill for payment instruments.\r\n\r\nIf you disable this policy, AutoFill never suggests, fills, or recommends new payment Instruments. Additionally, it won't save any payment instrument information that users submit while browsing the web.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_autofillcreditcardenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_autofillcreditcardenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_autoimportatfirstrun","displayName":"Automatically import another browser's data and settings at first run (User)","description":"If you enable this policy, all supported datatypes and settings from the specified browser will be silently and automatically imported at first run. During the First Run Experience, the import section will also be skipped.\r\n\r\nThe browser data from Microsoft Edge Legacy will always be silently migrated at the first run, irrespective of the value of this policy. You can use the following values for this policy:\r\n\r\n* 0 = Automatically imports all supported datatypes and settings from the default browser\r\n\r\n* 1 = Automatically imports all supported datatypes and settings from Internet Explorer\r\n\r\n* 2 = Automatically imports all supported datatypes and settings from Google Chrome\r\n\r\n* 3 = Automatically imports all supported datatypes and settings from Safari\r\n\r\n* 4 = Disables automatic import, and the import section of the first-run experience is skipped\r\n\r\n* 5 = Automatically imports all supported datatypes and settings from Mozilla Firefox\r\n\r\nIf this policy is set to the default value (0), then the datatypes corresponding to the default browser on the managed device will be imported.\r\n\r\nIf the browser specified as the value of this policy is not present in the managed device, Microsoft Edge will simply skip the import without any notification to the user.\r\n\r\nIf you set this policy to 'DisabledAutoImport' (4), the import section of the first-run experience is skipped entirely and Microsoft Edge doesn't import browser data and settings automatically.\r\n\r\nIf this policy is set to the value of Internet Explorer (1), the following datatypes will be imported from Internet Explorer:\r\n1. Favorites or bookmarks\r\n2. Saved passwords\r\n3. Search engines\r\n4. Browsing history\r\n5. Home page\r\n\r\nIf this policy is set to the value of Google Chrome (2), the following datatypes will be imported from Google Chrome:\r\n1. Favorites\r\n2. Saved passwords\r\n3. Addresses and more\r\n4. Payment info\r\n5. Browsing history\r\n6. Settings\r\n7. Pinned and Open tabs\r\n8. Extensions\r\n9. Cookies\r\n\r\nNote: For more details on what is imported from Google Chrome, please see https://go.microsoft.com/fwlink/?linkid=2120835\r\n\r\nIf this policy is set to the value of Safari (3), the following datatypes will be imported from Safari:\r\n1. Favorites or bookmarks\r\n2. Browsing history\r\n\r\nStarting with Microsoft Edge version 83, if this policy is set to the value of Mozilla Firefox (5), the following datatypes will be imported from Mozilla Firefox:\r\n1. Favorites or bookmarks\r\n2. Saved passwords\r\n3. Addresses and more\r\n4. Browsing History\r\n\r\nIf you want to restrict specific datatypes from getting imported on the managed devices, you can use this policy with other policies such as 'ImportAutofillFormData' (Allow importing of autofill form data), 'ImportBrowserSettings' (Allow importing of browser settings), 'ImportFavorites' (Allow importing of favorites), and etc.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_autoimportatfirstrun_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_autoimportatfirstrun_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_autoimportatfirstrun_autoimportatfirstrun","displayName":"Automatically import another browser's data and settings at first run (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_autoimportatfirstrun_autoimportatfirstrun_0","displayName":"Automatically imports all supported datatypes and settings from the default browser","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_autoimportatfirstrun_autoimportatfirstrun_1","displayName":"Automatically imports all supported datatypes and settings from Internet Explorer","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_autoimportatfirstrun_autoimportatfirstrun_2","displayName":"Automatically imports all supported datatypes and settings from Google Chrome","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_autoimportatfirstrun_autoimportatfirstrun_3","displayName":"Automatically imports all supported datatypes and settings from Safari","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_autoimportatfirstrun_autoimportatfirstrun_4","displayName":"Disables automatic import, and the import section of the first-run experience is skipped","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_backgroundmodeenabled","displayName":"Continue running background apps after Microsoft Edge closes (User)","description":"Allows Microsoft Edge processes to start at OS sign-in and keep running after the last browser window is closed. In this scenario, background apps and the current browsing session remain active, including any session cookies. An open background process displays an icon in the system tray and can always be closed from there.\r\n\r\nIf you enable this policy, background mode is turned on.\r\n\r\nIf you disable this policy, background mode is turned off.\r\n\r\nIf you don't configure this policy, background mode is initially turned off, and the user can configure its behavior in edge://settings/system.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_backgroundmodeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_backgroundmodeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_blockthirdpartycookies","displayName":"Block third party cookies (User)","description":"Block web page elements that aren't from the domain that's in the address bar from setting cookies.\r\n\r\nIf you enable this policy, web page elements that are not from the domain that is in the address bar can't set cookies\r\n\r\nIf you disable this policy, web page elements from domains other than in the address bar can set cookies.\r\n\r\nIf you don't configure this policy, third-party cookies are enabled but users can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_blockthirdpartycookies_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_blockthirdpartycookies_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_browseraddprofileenabled","displayName":"Enable profile creation from the Identity flyout menu or the Settings page (User)","description":"Allows users to create new profiles, using the **Add profile** option.\r\nIf you enable this policy or don't configure it, Microsoft Edge allows users to use **Add profile** on the Identity flyout menu or the Settings page to create new profiles.\r\n\r\nIf you disable this policy, users cannot add new profiles from the Identity flyout menu or the Settings page.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_browseraddprofileenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_browseraddprofileenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_browserguestmodeenabled","displayName":"Enable guest mode (User)","description":"Enable the option to allow the use of guest profiles in Microsoft Edge. In a guest profile, the browser doesn't import browsing data from existing profiles, and it deletes browsing data when all guest profiles are closed.\r\n\r\nIf you enable this policy or don't configure it, Microsoft Edge lets users browse in guest profiles.\r\n\r\nIf you disable this policy, Microsoft Edge doesn't let users browse in guest profiles.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_browserguestmodeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_browserguestmodeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_browsernetworktimequeriesenabled","displayName":"Allow queries to a Browser Network Time service (User)","description":"Prevents Microsoft Edge from occasionally sending queries to a browser network time service to retrieve an accurate timestamp.\r\n\r\nIf you disable this policy, Microsoft Edge will stop sending queries to a browser network time service.\r\n\r\nIf you enable this policy or don't configure it, Microsoft Edge will occasionally send queries to a browser network time service.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_browsernetworktimequeriesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_browsernetworktimequeriesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_browsersignin","displayName":"Browser sign-in settings (User)","description":"Specify whether a user can sign into Microsoft Edge with their account and use account-related services like sync and single sign on. To control the availability of sync, use the 'SyncDisabled' (Disable synchronization of data using Microsoft sync services) policy instead.\r\n\r\nIf you set this policy to 'Disable browser sign-in', make sure that you also set the 'NonRemovableProfileEnabled' (Configure whether a user always has a default profile automatically signed in with their work or school account) policy to disabled because 'NonRemovableProfileEnabled' disables the creation of an automatically signed in browser profile. If both policies are set, Microsoft Edge will use the 'Disable browser sign-in' policy and behave as if 'NonRemovableProfileEnabled' is set to disabled.\r\n\r\nIf you set this policy to 'Enable browser sign-in' (1), users can sign into the browser. Signing into the browser doesn't mean that sync is turned on by default; the user must separately opt-in to use this feature.\r\n\r\nIf you set this policy to 'Force browser sign-in' (2) users must sign into a profile to use the browser. By default, this will allow the user to choose whether they want to sync to their account, unless sync is disabled by the domain admin or with the 'SyncDisabled' policy. The default value of 'BrowserGuestModeEnabled' (Enable guest mode) policy is set to false.\r\n\r\nIf you don't configure this policy users can decide if they want to enable the browser sign-in option and use it as they see fit.\r\n\r\n* 0 = Disable browser sign-in\r\n\r\n* 1 = Enable browser sign-in\r\n\r\n* 2 = Force users to sign-in to use the browser","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_browsersignin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_browsersignin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_browsersignin_browsersignin","displayName":"Browser sign-in settings (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_browsersignin_browsersignin_0","displayName":"Disable browser sign-in","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_browsersignin_browsersignin_1","displayName":"Enable browser sign-in","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_browsersignin_browsersignin_2","displayName":"Force users to sign-in to use the browser","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_builtindnsclientenabled","displayName":"Use built-in DNS client (User)","description":"Controls whether to use the built-in DNS client.\r\n\r\nThis does not affect which DNS servers are used; just the software stack which is used to communicate with them. For example if the operating system is configured to use an enterprise DNS server, that same server would be used by the built-in DNS client. It is however possible that the built-in DNS client will address servers in different ways by using more modern DNS-related protocols such as DNS-over-TLS.\r\n\r\nIf you enable this policy, the built-in DNS client is used, if it's available.\r\n\r\nIf you disable this policy, the client is never used.\r\n\r\nIf you don't configure this policy, the built-in DNS client is enabled by default on MacOS, and users can change whether to use the built-in DNS client by editing edge://flags or by specifying a command-line flag.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_builtindnsclientenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_builtindnsclientenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_certificatetransparencyenforcementdisabledforcas","displayName":"Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes (User)","description":"Disables enforcement of Certificate Transparency requirements for a list of subjectPublicKeyInfo hashes.\r\n\r\nThis policy lets you disable Certificate Transparency disclosure requirements for certificate chains that contain certificates with one of the specified subjectPublicKeyInfo hashes. This allows certificates that would otherwise be untrusted because they were not properly publicly disclosed to still be used for Enterprise hosts.\r\n\r\nTo disable Certificate Transparency enforcement when this policy is set, one of the following sets of conditions must be met:\r\n1. The hash is of the server certificate's subjectPublicKeyInfo.\r\n2. The hash is of a subjectPublicKeyInfo that appears in a CA certificate in the certificate chain, that CA certificate is constrained via the X.509v3 nameConstraints extension, one or more directoryName nameConstraints are present in the permittedSubtrees, and the directoryName contains an organizationName attribute.\r\n3. The hash is of a subjectPublicKeyInfo that appears in a CA certificate in the certificate chain, the CA certificate has one or more organizationName attributes in the certificate Subject, and the server's certificate contains the same number of organizationName attributes, in the same order, and with byte-for-byte identical values.\r\n\r\nA subjectPublicKeyInfo hash is specified by concatenating the hash algorithm name, the \"/\" character, and the Base64 encoding of that hash algorithm applied to the DER-encoded subjectPublicKeyInfo of the specified certificate. This Base64 encoding is the same format as an SPKI Fingerprint, as defined in RFC 7469, Section 2.4. Unrecognized hash algorithms are ignored. The only supported hash algorithm at this time is \"sha256\".\r\n\r\nIf you disable this policy or don't configure it, any certificate that's required to be disclosed via Certificate Transparency will be treated as untrusted if it's not disclosed according to the Certificate Transparency policy.\r\n\r\nExample value:\r\n\r\nsha256/AAAAAAAAAAAAAAAAAAAAAA==\r\nsha256//////////////////////w==","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_certificatetransparencyenforcementdisabledforcas_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_certificatetransparencyenforcementdisabledforcas_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_certificatetransparencyenforcementdisabledforcas_certificatetransparencyenforcementdisabledforcasdesc","displayName":"Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_certificatetransparencyenforcementdisabledforlegacycas","displayName":"Disable Certificate Transparency enforcement for a list of legacy certificate authorities (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 131.\r\n\r\nDisables enforcing Certificate Transparency requirements for a list of legacy certificate authorities (Cas).\r\n\r\nThis policy lets you disable Certificate Transparency disclosure requirements for certificate chains that contain certificates with one of the specified subjectPublicKeyInfo hashes. This allows certificates that would otherwise be untrusted because they were not properly publicly disclosed, continue to be used for enterprise hosts.\r\n\r\nIn order for Certificate Transparency enforcement to be disabled, you must set the hash to a subjectPublicKeyInfo appearing in a CA certificate that is recognized as a legacy certificate authority (CA). A legacy CA is a CA that has been publicly trusted by default by one or more operating systems supported by Microsoft Edge.\r\n\r\nYou specify a subjectPublicKeyInfo hash by concatenating the hash algorithm name, the \"/\" character, and the Base64 encoding of that hash algorithm applied to the DER-encoded subjectPublicKeyInfo of the specified certificate. This Base64 encoding is the same format as an SPKI Fingerprint, as defined in RFC 7469, Section 2.4. Unrecognized hash algorithms are ignored. The only supported hash algorithm at this time is \"sha256\".\r\n\r\nIf you don't configure this policy, any certificate that's required to be disclosed via Certificate Transparency will be treated as untrusted if it isn't disclosed according to the Certificate Transparency policy.\r\n\r\nThis policy is obsolete because the feature to disable Certificate Transparency enforcement for legacy certificates has been removed.\r\n\r\nExample value:\r\n\r\nsha256/AAAAAAAAAAAAAAAAAAAAAA==\r\nsha256//////////////////////w==","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_certificatetransparencyenforcementdisabledforlegacycas_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_certificatetransparencyenforcementdisabledforlegacycas_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_certificatetransparencyenforcementdisabledforlegacycas_certificatetransparencyenforcementdisabledforlegacycasdesc","displayName":"Disable Certificate Transparency enforcement for a list of legacy certificate authorities (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_certificatetransparencyenforcementdisabledforurls","displayName":"Disable Certificate Transparency enforcement for specific URLs (User)","description":"Disables enforcing Certificate Transparency requirements for the listed URLs.\r\n\r\nThis policy lets you not disclose certificates for the hostnames in the specified URLs via Certificate Transparency. This lets you use certificates that would otherwise be untrusted, because they weren't properly publicly disclosed, but it makes it harder to detect mis-issued certificates for those hosts.\r\n\r\nForm your URL pattern according to https://go.microsoft.com/fwlink/?linkid=2095322. Because certificates are valid for a given hostname, independent of the scheme, port, or path, only the hostname part of the URL is considered. Wildcard hosts are not supported.\r\n\r\nIf you don't configure this policy, any certificate that should be disclosed via Certificate Transparency is treated as untrusted if it's not disclosed.\r\n\r\nExample value:\r\n\r\ncontoso.com\r\n.contoso.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_certificatetransparencyenforcementdisabledforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_certificatetransparencyenforcementdisabledforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_certificatetransparencyenforcementdisabledforurls_certificatetransparencyenforcementdisabledforurlsdesc","displayName":"Disable Certificate Transparency enforcement for specific URLs (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_componentupdatesenabled","displayName":"Enable component updates in Microsoft Edge (User)","description":"If you enable or don't configure this policy, component updates are enabled in Microsoft Edge.\r\n\r\nIf you disable this policy or set it to false, component updates are disabled for all components in Microsoft Edge.\r\n\r\nHowever, some components are exempt from this policy. This includes any component that doesn't contain executable code, that doesn't significantly alter the behavior of the browser, or that's critical for security. That is, updates that are deemed \"critical for security\" are still applied even if you disable this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_componentupdatesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_componentupdatesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_configuredonottrack","displayName":"Configure Do Not Track (User)","description":"Specify whether to send Do Not Track requests to websites that ask for tracking info. Do Not Track requests let the websites you visit know that you don't want your browsing activity to be tracked. By default, Microsoft Edge doesn't send Do Not Track requests, but users can turn on this feature to send them.\r\n\r\nIf you enable this policy, Do Not Track requests are always sent to websites asking for tracking info.\r\n\r\nIf you disable this policy, requests are never sent.\r\n\r\nIf you don't configure this policy, users can choose whether to send these requests.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_configuredonottrack_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_configuredonottrack_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_configureonlinetexttospeech","displayName":"Configure Online Text To Speech (User)","description":"Set whether the browser can leverage Online Text to Speech voice fonts, part of Azure Cognitive Services. These voice fonts are higher quality than the pre-installed system voice fonts.\r\n\r\nIf you enable or don't configure this policy, web-based applications that use the SpeechSynthesis API can use Online Text to Speech voice fonts.\r\n\r\nIf you disable this policy, the voice fonts aren't available.\r\n\r\nRead more about this feature here:\r\nSpeechSynthesis API: https://go.microsoft.com/fwlink/?linkid=2110038\r\nCognitive Services: https://go.microsoft.com/fwlink/?linkid=2110141","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_configureonlinetexttospeech_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_configureonlinetexttospeech_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_developertoolsavailability","displayName":"Control where developer tools can be used (User)","description":"Control where developer tools can be used.\r\n\r\nIf you set this policy to 'DeveloperToolsDisallowedForForceInstalledExtensions' (0, the default), users can access the developer tools and the JavaScript console in general, but not in the context of extensions installed by enterprise policy.\r\n\r\nIf you set this policy to 'DeveloperToolsAllowed' (1), users can access the developer tools and the JavaScript console in all contexts, including extensions installed by enterprise policy.\r\n\r\nIf you set this policy to 'DeveloperToolsDisallowed' (2), users can't access the developer tools or inspect website elements. Keyboard shortcuts and menu or context menu entries that open the developer tools or the JavaScript Console are disabled.\r\n\r\n* 0 = Block the developer tools on extensions installed by enterprise policy, allow in other contexts\r\n\r\n* 1 = Allow using the developer tools\r\n\r\n* 2 = Don't allow using the developer tools","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_developertoolsavailability_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_developertoolsavailability_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_developertoolsavailability_developertoolsavailability","displayName":"Control where developer tools can be used (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_developertoolsavailability_developertoolsavailability_0","displayName":"Block the developer tools on extensions installed by enterprise policy, allow in other contexts","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_developertoolsavailability_developertoolsavailability_1","displayName":"Allow using the developer tools","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_developertoolsavailability_developertoolsavailability_2","displayName":"Don't allow using the developer tools","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_disable3dapis","displayName":"Disable support for 3D graphics APIs (User)","description":"Prevent web pages from accessing the graphics processing unit (GPU). Specifically, web pages can't access the WebGL API and plug-ins can't use the Pepper 3D API.\r\n\r\nIf you don't configure or disable this policy, it potentially allows web pages to use the WebGL API and plug-ins to use the Pepper 3D API. Microsoft Edge might, by default, still require command line arguments to be passed in order to use these APIs.\r\n\r\nIf 'HardwareAccelerationModeEnabled' (Use hardware acceleration when available) policy is set to false, the setting for 'Disable3DAPIs' policy is ignored - it's the equivalent of setting 'Disable3DAPIs' policy to true.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_disable3dapis_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_disable3dapis_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_disablescreenshots","displayName":"Disable taking screenshots (User)","description":"Controls if users can take screenshots of the browser page.\r\n\r\nIf enabled, user can't take screenshots by using keyboard shortcuts or extension APIs.\r\n\r\nIf disabled or don't configure this policy, users can take screenshots.\r\n\r\nPlease note this policy controls screenshots taken from within the browser itself. Even if you enable this policy, users might still be able to take screenshots using some method outside of the browser (like using an operating system feature or another application).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_disablescreenshots_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_disablescreenshots_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_diskcachedir","displayName":"Set disk cache directory (User)","description":"Configures the directory to use to store cached files.\r\n\r\nIf you enable this policy, Microsoft Edge uses the provided directory regardless of whether the user has specified the '--disk-cache-dir' flag. To avoid data loss or other unexpected errors, don't configure this policy to a volume's root directory or to a directory used for other purposes, because Microsoft Edge manages its contents.\r\n\r\nSee https://go.microsoft.com/fwlink/?linkid=2095041 for a list of variables you can use when specifying directories and paths.\r\n\r\nIf you don't configure this policy, the default cache directory is used, and users can override that default with the '--disk-cache-dir' command line flag.\r\n\r\nExample value: ${user_home}/Edge_cache","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_diskcachedir_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_diskcachedir_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_diskcachedir_diskcachedir","displayName":"Set disk cache directory (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_diskcachesize","displayName":"Set disk cache size, in bytes (User)","description":"Configures the size of the cache, in bytes, used to store files on the disk.\r\n\r\nIf you enable this policy, Microsoft Edge uses the provided cache size regardless of whether the user has specified the '--disk-cache-size' flag. The value specified in this policy isn't a hard boundary but rather a suggestion to the caching system; any value below a few megabytes is too small and will be rounded up to a reasonable minimum.\r\n\r\nIf you set the value of this policy to 0, the default cache size is used, and users can't change it.\r\n\r\nIf you don't configure this policy, the default size is used, but users can override it with the '--disk-cache-size' flag.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_diskcachesize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_diskcachesize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_diskcachesize_diskcachesize","displayName":"Set disk cache size: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_downloaddirectory","displayName":"Set download directory (User)","description":"Configures the directory to use when downloading files.\r\n\r\nIf you enable this policy, Microsoft Edge uses the provided directory regardless of whether the user has specified one or chosen to be prompted for download location every time. See https://go.microsoft.com/fwlink/?linkid=2095041 for a list of variables that can be used.\r\n\r\nIf you disable or don't configure this policy, the default download directory is used, and the user can change it.\r\n\r\nIf you set an invalid path, Microsoft Edge will default to the user's default download directory.\r\n\r\nIf the folder specified by the path doesn't exist, the download will trigger a prompt that asks the user where they want to save their download.\r\n\r\nExample value: \r\n Linux-based OSes (including Mac): /home/${user_name}/Downloads\r\n Windows: C:\\Users\\${user_name}\\Downloads","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_downloaddirectory_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_downloaddirectory_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_downloaddirectory_downloaddirectory","displayName":"Set download directory (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_downloadrestrictions","displayName":"Allow download restrictions (User)","description":"Configures the type of downloads that Microsoft Edge completely blocks, without letting users override the security decision.\r\n\r\nSet 'Block dangerous downloads' (1) to allow all downloads except for those that carry Microsoft Defender SmartScreen warnings.\r\n\r\nSet 'Block potentially dangerous downloads' (2) to allow all downloads except for those that carry Microsoft Defender SmartScreen warnings of potentially dangerous downloads.\r\n\r\nSet 'Block all downloads' (3) to block all downloads.\r\n\r\nIf you don't configure this policy or set the 'No special restrictions' (0) option, the downloads go through the usual security restrictions based on Microsoft Defender SmartScreen analysis results.\r\n\r\nNote that these restrictions apply to downloads from web page content, as well as the 'download link...' context menu option. These restrictions don't apply to saving or downloading the currently displayed page, nor do they apply to the Save as PDF option from the printing options.\r\n\r\nSee https://go.microsoft.com/fwlink/?linkid=2094934 for more info on Microsoft Defender SmartScreen.\r\n\r\n* 0 = No special restrictions\r\n\r\n* 1 = Block dangerous downloads\r\n\r\n* 2 = Block potentially dangerous downloads\r\n\r\n* 3 = Block all downloads","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_downloadrestrictions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_downloadrestrictions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_downloadrestrictions_downloadrestrictions","displayName":"Download restrictions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_downloadrestrictions_downloadrestrictions_0","displayName":"No special restrictions","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_downloadrestrictions_downloadrestrictions_1","displayName":"Block dangerous downloads","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_downloadrestrictions_downloadrestrictions_2","displayName":"Block potentially dangerous downloads","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_downloadrestrictions_downloadrestrictions_3","displayName":"Block all downloads","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_editfavoritesenabled","displayName":"Allows users to edit favorites (User)","description":"Enable this policy to let users add, remove, and modify favorites. This is the default behavior if you don't configure the policy.\r\n\r\nDisable this policy to stop users from adding, removing, or modifying favorites. They can still use existing favorites.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_editfavoritesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_editfavoritesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_enabledeprecatedwebplatformfeatures","displayName":"Re-enable deprecated web platform features for a limited time (User)","description":"Specify a list of deprecated web platform features to temporarily re-enable.\r\n\r\nThis policy lets you re-enable deprecated web platform features for a limited time. Features are identified by a string tag.\r\n\r\nIf you don't configure this policy, if the list is empty, or if a feature doesn't match one of the supported string tags, all deprecated web platform features remain disabled.\r\n\r\nWhile the policy itself is supported on the above platforms, the feature it's enabling might not be available on all of those platforms. Not all deprecated Web Platform features can be re-enabled. Only those explicitly listed below can be re-enabled, and only for a limited period of time, which differs per feature. You can review the intent behind the Web Platform feature changes at https://bit.ly/blinkintents.\r\n\r\nThe general format of the string tag is [DeprecatedFeatureName]_EffectiveUntil[yyyymmdd].\r\n\r\n* \"ExampleDeprecatedFeature_EffectiveUntil20080902\" = Enable ExampleDeprecatedFeature API through 2008/09/02\r\n\r\nExample value:\r\n\r\nExampleDeprecatedFeature_EffectiveUntil20080902","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_enabledeprecatedwebplatformfeatures_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_enabledeprecatedwebplatformfeatures_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_enabledeprecatedwebplatformfeatures_enabledeprecatedwebplatformfeaturesdesc","displayName":"Re-enable deprecated web platform features for a limited time (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_enabledomainactionsdownload","displayName":"Enable Domain Actions Download from Microsoft (deprecated) (User)","description":"DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.\r\n\r\nAlthough this policy is used to enable/disable download of the domain actions list, it doesn't always achieve the desired state. The Experimentation and Configuration Service, which handles the download, has its own group policy to configure what is downloaded from the service. To avoid conflicting states, this policy is being deprecated and will be obsolete in milestone 85 onward. Please use the 'ExperimentationAndConfigurationServiceControl' (Control communication with the Experimentation and Configuration Service) policy instead.\r\n\r\nIn Microsoft Edge, Domain Actions represent a series of compatibility features that help the browser work correctly on the web.\r\n\r\nMicrosoft keeps a list of actions to take on certain domains for compatibility reasons. For example, the browser may override the User Agent string on a website if that website is broken due to the new User Agent string on Microsoft Edge. Each of these actions is intended to be temporary while Microsoft tries to resolve the issue with the site owner.\r\n\r\nWhen the browser starts up and then periodically afterwards, the browser will contact the Experimentation and Configuration Service that contains the most up to date list of compatibility actions to perform. This list is saved locally after it is first retrieved so that subsequent requests will only update the list if the server's copy has changed.\r\n\r\nIf you enable this policy, the list of Domain Actions will continue to be downloaded from the Experimentation and Configuration Service.\r\n\r\nIf you disable this policy, the list of Domain Actions will no longer be downloaded from the Experimentation and Configuration Service.\r\n\r\nIf you don't configure this policy, the list of Domain Actions will continue to be downloaded from the Experimentation and Configuration Service.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_enabledomainactionsdownload_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_enabledomainactionsdownload_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_enableonlinerevocationchecks","displayName":"Enable online OCSP/CRL checks (User)","description":"Online revocation checks don't provide a significant security benefit and are disabled by default.\r\n\r\nIf you enable this policy, Microsoft Edge will perform soft-fail, online OCSP/CRL checks. \"Soft fail\" means that if the revocation server can't be reached, the certificate will be considered valid.\r\n\r\nIf you disable the policy or don't configure it, Microsoft Edge won't perform online revocation checks.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_enableonlinerevocationchecks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_enableonlinerevocationchecks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_experimentationandconfigurationservicecontrol","displayName":"Control communication with the Experimentation and Configuration Service (User)","description":"In Microsoft Edge, the Experimentation and Configuration Service is used to deploy Experimentation and Configuration payload.\r\n\r\nExperimentation payload consists of a list of early in development features that Microsoft is enabling for testing and feedback.\r\n\r\nConfiguration payload consists of a list of settings that Microsoft wants to deploy to Microsoft Edge to optimize user experience. For example, configuration payload may specify how often Microsoft Edge sends requests to the Experimentation and Configuration Service to retrieve the newest payload.\r\n\r\nAdditionaly, configuration payload may also contain a list of actions to take on certain domains for compatibility reasons. For example, the browser may override the User Agent string on a website if that website is broken due to the new User Agent string on Microsoft Edge. Each of these actions is intended to be temporary while Microsoft tries to resolve the issue with the site owner.\r\n\r\nIf you set this policy to \"Retrieve configurations and experiments\" mode, the full payload is downloaded from the Experimentation and Configuration Service. This includes both the experimentation and configuration payloads.\r\n\r\nIf you set this policy to \"Retrieve configurations only\" mode, only the configuration payload is delivered.\r\n\r\nIf you set this policy to \"Disable communication with the Experimentation and Configuration Service\" mode, the communication with the Experimentation and Configuration Service is stopped completely.\r\n\r\nIf you don't configure this policy, on a managed device on Stable and Beta channels the behavior is the same as the \"Retrieve configurations only\" mode.\r\n\r\nIf you don't configure this policy, on an unmanaged device the behavior is the same as the \"Retrieve configurations and experiments\" mode.\r\n\r\n* 0 = Disable communication with the Experimentation and Configuration Service\r\n\r\n* 1 = Retrieve configurations only\r\n\r\n* 2 = Retrieve configurations and experiments","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_experimentationandconfigurationservicecontrol_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_experimentationandconfigurationservicecontrol_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_experimentationandconfigurationservicecontrol_experimentationandconfigurationservicecontrol","displayName":"Control communication with the Experimentation and Configuration Service (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_experimentationandconfigurationservicecontrol_experimentationandconfigurationservicecontrol_2","displayName":"Retrieve configurations and experiments","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_experimentationandconfigurationservicecontrol_experimentationandconfigurationservicecontrol_1","displayName":"Retrieve configurations only","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_experimentationandconfigurationservicecontrol_experimentationandconfigurationservicecontrol_0","displayName":"Disable communication with the Experimentation and Configuration Service","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_favoritesbarenabled","displayName":"Enable favorites bar (User)","description":"Enables or disables the favorites bar.\r\n\r\nIf you enable this policy, users will see the favorites bar.\r\n\r\nIf you disable this policy, users won't see the favorites bar.\r\n\r\nIf this policy is not configured, then the user can decide to use the favorites bar or not.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_favoritesbarenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_favoritesbarenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forcebingsafesearch","displayName":"Enforce Bing SafeSearch (User)","description":"Ensure that queries in Bing web search are done with SafeSearch set to the value specified. Users can't change this setting.\r\n\r\nIf you configure this policy to \"Off\", SafeSearch in Bing search falls back to the bing.com value.\r\n\r\nIf you configure this policy to \"Moderate\", the moderate setting is used in SafeSearch. The moderate setting filters adult videos and images but not text from search results.\r\n\r\nIf you configure this policy to \"Strict\", the strict setting in SafeSearch is used. The strict setting filters adult text, images, and videos.\r\n\r\nIf you disable this policy or don't configure it, SafeSearch in Bing search isn't enforced, and users can set the value they want on bing.com.\r\n\r\n* 0 = Don't configure search restrictions in Bing\r\n\r\n* 1 = Configure moderate search restrictions in Bing\r\n\r\n* 2 = Configure strict search restrictions in Bing","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forcebingsafesearch_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forcebingsafesearch_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forcebingsafesearch_forcebingsafesearch","displayName":"Enforce Bing SafeSearch (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forcebingsafesearch_forcebingsafesearch_0","displayName":"Don't configure search restrictions in Bing","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forcebingsafesearch_forcebingsafesearch_1","displayName":"Configure moderate search restrictions in Bing","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forcebingsafesearch_forcebingsafesearch_2","displayName":"Configure strict search restrictions in Bing","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forceephemeralprofiles","displayName":"Enable use of ephemeral profiles (User)","description":"Controls whether user profiles are switched to ephemeral mode. An ephemeral profile is created when a session begins, is deleted when the session ends, and is associated with the user's original profile.\r\n\r\nIf you enable this policy, profiles run in ephemeral mode. This lets users work from their own devices without saving browsing data to those devices. If you enable this policy as an OS policy (by using GPO on Windows, for example), it applies to every profile on the system.\r\n\r\nIf you disable this policy or don't configure it, users get their regular profiles when they sign in to the browser.\r\n\r\nIn ephemeral mode, profile data is saved on disk only for the length of the user session. Features like browser history, extensions and their data, web data like cookies, and web databases aren't saved after the browser is closed. This doesn't prevent a user from manually downloading any data to disk, or from saving pages or printing them. If the user has enabled sync, all data is preserved in their sync accounts just like with regular profiles. Users can also use InPrivate browsing in ephemeral mode unless you explicitly disable this.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forceephemeralprofiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forceephemeralprofiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forcegooglesafesearch","displayName":"Enforce Google SafeSearch (User)","description":"Forces queries in Google Web Search to be performed with SafeSearch set to active, and prevents users from changing this setting.\r\n\r\nIf you enable this policy, SafeSearch in Google Search is always active.\r\n\r\nIf you disable this policy or don't configure it, SafeSearch in Google Search isn't enforced.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forcegooglesafesearch_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forcegooglesafesearch_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forceyoutuberestrict","displayName":"Force minimum YouTube Restricted Mode (User)","description":"Enforces a minimum Restricted Mode on YouTube and prevents users from picking a less restricted mode.\r\n\r\nSet to Strict (2) to enforce Strict Restricted Mode on YouTube.\r\n\r\nSet to Moderate (1) to enforce the user to only use Moderate Restricted Mode and Strict Restricted Mode on YouTube. They can't disable Restricted Mode.\r\n\r\nSet to Off (0) or don't configure this policy to not enforce Restricted Mode on YouTube. External policies such as YouTube policies might still enforce Restricted Mode.\r\n\r\n* 0 = Do not enforce Restricted Mode on YouTube\r\n\r\n* 1 = Enforce at least Moderate Restricted Mode on YouTube\r\n\r\n* 2 = Enforce Strict Restricted Mode for YouTube","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forceyoutuberestrict_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forceyoutuberestrict_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forceyoutuberestrict_forceyoutuberestrict","displayName":"Force minimum YouTube Restricted Mode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forceyoutuberestrict_forceyoutuberestrict_0","displayName":"Do not enforce Restricted Mode on YouTube","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forceyoutuberestrict_forceyoutuberestrict_1","displayName":"Enforce at least Moderate Restricted Mode on YouTube","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_forceyoutuberestrict_forceyoutuberestrict_2","displayName":"Enforce Strict Restricted Mode for YouTube","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_fullscreenallowed","displayName":"Allow full screen mode (User)","description":"Set the availability of full screen mode - all Microsoft Edge UI is hidden and only web content is visible.\r\n\r\nIf you enable this policy or don't configure it, the user, apps, and extensions with appropriate permissions can enter full screen mode.\r\n\r\nIf you disable this policy, users, apps, and extensions can't enter full screen mode.\r\n\r\nOpening Microsoft Edge in kiosk mode using the command line is unavailable when full screen mode is disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_fullscreenallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_fullscreenallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_hardwareaccelerationmodeenabled","displayName":"Use hardware acceleration when available (User)","description":"Specify to use hardware acceleration, if it's available. If you enable this policy or don't configure it, hardware acceleration is enabled unless a GPU feature is explicitly blocked.\r\n\r\nIf you disable this policy, hardware acceleration is disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_hardwareaccelerationmodeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_hardwareaccelerationmodeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importautofillformdata","displayName":"Allow importing of autofill form data (User)","description":"Allows users to import autofill form data from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the option to manually import autofill data is automatically selected.\r\n\r\nIf you disable this policy, autofill form data isn't imported at first run, and users can't import it manually.\r\n\r\nIf you don't configure this policy, autofill data is imported at first run, and users can choose whether to import this data manually during later browsing sessions.\r\n\r\nYou can set this policy as a recommendation. This means that Microsoft Edge will import autofill data on first run, but users can select or clear **autofill data** option during manual import.\r\n\r\n**Note**: This policy currently manages importing from Google Chrome (on Windows 7, 8, and 10 and on macOS) and Mozilla Firefox (on Windows 7, 8, and 10 and on macOS) browsers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importautofillformdata_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importautofillformdata_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importfavorites","displayName":"Allow importing of favorites (User)","description":"Allows users to import favorites from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the **Favorites** check box is automatically selected in the **Import browser data** dialog box.\r\n\r\nIf you disable this policy, favorites aren't imported at first run, and users can’t import them manually.\r\n\r\nIf you don’t configure this policy, favorites are imported at first run, and users can choose whether to import them manually during later browsing sessions.\r\n\r\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports favorites on first run, but users can select or clear the **favorites** option during manual import.\r\n\r\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10), Google Chrome (on Windows 7, 8, and 10 and on macOS), Mozilla Firefox (on Windows 7, 8, and 10 and on macOS), and Apple Safari (on macOS) browsers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importfavorites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importfavorites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importhistory","displayName":"Allow importing of browsing history (User)","description":"Allows users to import their browsing history from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the **Browsing history** check box is automatically selected in the **Import browser data** dialog box.\r\n\r\nIf you disable this policy, browsing history data isn't imported at first run, and users can’t import this data manually.\r\n\r\nIf you don’t configure this policy, browsing history data is imported at first run, and users can choose whether to import it manually during later browsing sessions.\r\n\r\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports browsing history on first run, but users can select or clear the **history** option during manual import.\r\n\r\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10), Google Chrome (on Windows 7, 8, and 10 and on macOS), Mozilla Firefox (on Windows 7, 8, and 10 and on macOS), and Apple Safari (macOS) browsers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importhistory_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importhistory_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importhomepage","displayName":"Allow importing of home page settings (User)","description":"Allows users to import their home page setting from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the option to manually import the home page setting is automatically selected.\r\n\r\nIf you disable this policy, the home page setting isn’t imported at first run, and users can’t import it manually.\r\n\r\nIf you don’t configure this policy, the home page setting is imported at first run, and users can choose whether to import this data manually during later browsing sessions.\r\n\r\nYou can set this policy as a recommendation. This means that Microsoft Edge imports the home page setting on first run, but users can select or clear the **home page** option during manual import.\r\n\r\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importhomepage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importhomepage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importpaymentinfo","displayName":"Allow importing of payment info (User)","description":"Allows users to import payment info from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the **payment info** check box is automatically selected in the **Import browser data** dialog box.\r\n\r\nIf you disable this policy, payment info isn’t imported at first run, and users can’t import it manually.\r\n\r\nIf you don’t configure this policy, payment info is imported at first run, and users can choose whether to import it manually during later browsing sessions.\r\n\r\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports payment info on first run, but users can select or clear the **payment info** option during manual import.\r\n\r\n**Note:** This policy currently manages importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importpaymentinfo_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importpaymentinfo_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importsavedpasswords","displayName":"Allow importing of saved passwords (User)","description":"Allows users to import saved passwords from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the option to manually import saved passwords is automatically selected.\r\n\r\nIf you disable this policy, saved passwords aren't imported on first run, and users can't import them manually.\r\n\r\nIf you don't configure this policy, passwords are imported at first run, and users can choose whether to import them manually during later browsing sessions.\r\n\r\nYou can set this policy as a recommendation. This means that Microsoft Edge imports passwords on first run, but users can select or clear the **passwords** option during manual import.\r\n\r\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10), Google Chrome (on Windows 7, 8, and 10 and on macOS), and Mozilla Firefox (on Windows 7, 8, and 10 and on macOS) browsers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importsavedpasswords_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importsavedpasswords_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importsearchengine","displayName":"Allow importing of search engine settings (User)","description":"Allows users to import search engine settings from another browser into Microsoft Edge.\r\n\r\nIf you enable, this policy, the option to import search engine settings is automatically selected.\r\n\r\nIf you disable this policy, search engine settings aren't imported at first run, and users can’t import them manually.\r\n\r\nIf you don’t configure this policy, search engine settings are imported at first run, and users can choose whether to import this data manually during later browsing sessions.\r\n\r\nYou can set this policy as a recommendation. This means that Microsoft Edge imports search engine settings on first run, but users can select or clear the **search engine** option during manual import.\r\n\r\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importsearchengine_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_importsearchengine_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_inprivatemodeavailability","displayName":"Configure InPrivate mode availability (User)","description":"Specifies whether the user can open pages in InPrivate mode in Microsoft Edge.\r\n\r\nIf you don't configure this policy or set it to 'Enabled' (0), users can open pages in InPrivate mode.\r\n\r\nSet this policy to 'Disable' (1) to stop users from using InPrivate mode.\r\n\r\nSet this policy to 'Forced' (2) to always use InPrivate mode.\r\n\r\n* 0 = InPrivate mode available\r\n\r\n* 1 = InPrivate mode disabled\r\n\r\n* 2 = InPrivate mode forced","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_inprivatemodeavailability_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_inprivatemodeavailability_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_inprivatemodeavailability_inprivatemodeavailability","displayName":"Configure InPrivate mode availability (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_inprivatemodeavailability_inprivatemodeavailability_0","displayName":"InPrivate mode available","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_inprivatemodeavailability_inprivatemodeavailability_1","displayName":"InPrivate mode disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_inprivatemodeavailability_inprivatemodeavailability_2","displayName":"InPrivate mode forced","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_internetexplorerintegrationlevel","displayName":"Configure Internet Explorer integration (User)","description":"For guidance about configuring the optimal experience for Internet Explorer mode see https://go.microsoft.com/fwlink/?linkid=2094210\r\n\r\n* 0 = None\r\n\r\n* 1 = Internet Explorer mode\r\n\r\n* 2 = Internet Explorer 11","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_internetexplorerintegrationlevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_internetexplorerintegrationlevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_internetexplorerintegrationlevel_internetexplorerintegrationlevel","displayName":"Configure Internet Explorer integration (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_internetexplorerintegrationlevel_internetexplorerintegrationlevel_1","displayName":"Internet Explorer mode","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_internetexplorerintegrationlevel_internetexplorerintegrationlevel_2","displayName":"Internet Explorer 11","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_isolateorigins","displayName":"Enable site isolation for specific origins (User)","description":"Specify origins to run in isolation, in their own process.\r\nThis policy also isolates origins named by subdomains - for example, specifying https://contoso.com/ will cause https://foo.contoso.com/ to be isolated as part of the https://contoso.com/ site.\r\nIf the policy is enabled, each of the named origins in a comma-separated list will run in its own process.\r\nIf you disable this policy, then both the 'IsolateOrigins' and 'SitePerProcess' features are disabled. Users can still enable 'IsolateOrigins' policy manually, via command line flags.\r\nIf you don't configure the policy, the user can change this setting.\r\n\r\nExample value: https://contoso.com/,https://fabrikam.com/","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_isolateorigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_isolateorigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_isolateorigins_isolateorigins","displayName":"Enable site isolation for specific origins (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_managedfavorites","displayName":"Configure favorites (User)","description":"Configures a list of managed favorites.\r\n\r\nThe policy creates a list of favorites. Each favorite contains the keys \"name\" and \"url,\" which hold the favorite's name and its target. You can configure a subfolder by defining a favorites without an \"url\" key but with an additional \"children\" key that contains a list of favorites as defined above (some of which may be folders again). Microsoft Edge amends incomplete URLs as if they were submitted via the Address Bar, for example \"microsoft.com\" becomes \"https://microsoft.com/\".\r\n\r\nThese favorites are placed in a folder that can't be modified by the user (but the user can choose to hide it from the favorites bar). By default the folder name is \"Managed favorites\" but you can change it by adding to the list of favorites a dictionary containing the key \"toplevel_name\" with the desired folder name as the value.\r\n\r\nManaged favorites are not synced to the user account and can't be modified by extensions.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"toplevel_name\": \"My managed favorites folder\"\r\n }, \r\n {\r\n \"url\": \"microsoft.com\", \r\n \"name\": \"Microsoft\"\r\n }, \r\n {\r\n \"url\": \"bing.com\", \r\n \"name\": \"Bing\"\r\n }, \r\n {\r\n \"name\": \"Microsoft Edge links\", \r\n \"children\": [\r\n {\r\n \"url\": \"www.microsoftedgeinsider.com\", \r\n \"name\": \"Microsoft Edge Insiders\"\r\n }, \r\n {\r\n \"url\": \"www.microsoft.com/windows/microsoft-edge\", \r\n \"name\": \"Microsoft Edge\"\r\n }\r\n ]\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_managedfavorites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_managedfavorites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_managedfavorites_managedfavorites","displayName":"Configure favorites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_managedsearchengines","displayName":"Manage Search Engines (User)","description":"Lets you configure a list of up to 10 search engines, one of which must be marked as the default search engine.\r\nYou do not need to specify the encoding. Starting in Microsoft Edge 80, the suggest_url and image_search_url parameters are optional. The optional parameter, image_search_post_params (consists of comma-separated name/value pairs), is available starting in Microsoft Edge 80.\r\n\r\nStarting in Microsoft Edge 83, you can enable search engine discovery with the allow_search_engine_discovery optional parameter. This parameter must be the first item in the list. If allow_search_engine_discovery is not specified, search engine discovery will be disabled by default.\r\n\r\nIf you enable this policy, users can't add, remove, or change any search engine in the list. Users can set their default search engine to any search engine in the list.\r\n\r\nIf you disable or don't configure this policy, users can modify the search engines list as desired.\r\n\r\nIf the 'DefaultSearchProviderSearchURL' (Default search provider search URL) policy is set, this policy (ManagedSearchEngines) is ignored. The user must restart their browser to finish applying this policy.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"allow_search_engine_discovery\": true\r\n }, \r\n {\r\n \"is_default\": true, \r\n \"suggest_url\": \"https://www.example1.com/qbox?query={searchTerms}\", \r\n \"search_url\": \"https://www.example1.com/search?q={searchTerms}\", \r\n \"name\": \"Example1\", \r\n \"keyword\": \"example1.com\"\r\n }, \r\n {\r\n \"suggest_url\": \"https://www.example2.com/qbox?query={searchTerms}\", \r\n \"image_search_url\": \"https://www.example2.com/images/detail/search?iss=sbiupload\", \r\n \"name\": \"Example2\", \r\n \"keyword\": \"example2.com\", \r\n \"image_search_post_params\": \"content={imageThumbnail},url={imageURL},sbisrc={SearchSource}\", \r\n \"search_url\": \"https://www.example2.com/search?q={searchTerms}\"\r\n }, \r\n {\r\n \"suggest_url\": \"https://www.example3.com/qbox?query={searchTerms}\", \r\n \"image_search_url\": \"https://www.example3.com/images/detail/search?iss=sbiupload\", \r\n \"name\": \"Example3\", \r\n \"keyword\": \"example3.com\", \r\n \"encoding\": \"UTF-8\", \r\n \"search_url\": \"https://www.example3.com/search?q={searchTerms}\"\r\n }, \r\n {\r\n \"search_url\": \"https://www.example4.com/search?q={searchTerms}\", \r\n \"name\": \"Example4\", \r\n \"keyword\": \"example4.com\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_managedsearchengines_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_managedsearchengines_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_managedsearchengines_managedsearchengines","displayName":"Manage Search Engines (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_maxconnectionsperproxy","displayName":"Maximum number of concurrent connections to the proxy server (User)","description":"Specifies the maximum number of simultaneous connections to the proxy server.\r\n\r\nSome proxy servers can't handle a high number of concurrent connections per client - you can solve this by setting this policy to a lower value.\r\n\r\nThe value of this policy should be lower than 100 and higher than 6. The default value is 32.\r\n\r\nSome web apps are known to consume many connections with hanging GETs - lowering the maximum connections below 32 may lead to browser networking hangs if too many of these kind of web apps are open.\r\n\r\nIf you don't configure this policy, the default value (32) is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_maxconnectionsperproxy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_maxconnectionsperproxy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_maxconnectionsperproxy_maxconnectionsperproxy","displayName":"Maximum number of concurrent connections to the proxy server: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_mediaroutercastallowallips","displayName":"Allow Google Cast to connect to Cast devices on all IP addresses (User)","description":"Enable this policy to let Google Cast connect to Cast devices on all IP addresses, not just RFC1918/RFC4193 private addresses.\r\n\r\nDisable this policy to restrict Google Cast to Cast devices on RFC1918/RFC4193 private addresses.\r\n\r\nIf you don't configure this policy, Google Cast connects to Cast devices on RFC1918/RFC4193 private addresses only, unless you enable the CastAllowAllIPs feature.\r\n\r\nIf the 'EnableMediaRouter' (Enable Google Cast) policy is disabled, then this policy has no effect.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_mediaroutercastallowallips_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_mediaroutercastallowallips_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_metricsreportingenabled","displayName":"Enable usage and crash-related data reporting (User)","description":"This policy enables reporting of usage and crash-related data about Microsoft Edge to Microsoft.\r\n\r\nEnable this policy to send reporting of usage and crash-related data to Microsoft. Disable this policy to not send the data to Microsoft. In both cases, users can't change or override the setting.\r\n\r\nOn Windows 10, Beta and Stable channels, if you don’t configure this policy, Microsoft Edge will default to the Windows diagnostic data setting. If you enable this policy, Microsoft Edge will only send usage data if the Windows Diagnostic data setting is set to Enhanced or Full. If you disable this policy, Microsoft Edge will not send usage data. Crash-related data is sent based on the Windows Diagnostic data setting. Learn more about Windows Diagnostic data settings at https://go.microsoft.com/fwlink/?linkid=2099569\r\n\r\nOn Windows 10, Canary and Dev channels, this policy controls sending usage data. If this policy is not configured, Microsoft Edge will default to the user's preference. Crash-related data is sent based on the Windows Diagnostic data setting. Learn more about Windows Diagnostic data settings: https://go.microsoft.com/fwlink/?linkid=2099569\r\n\r\nOn Windows 7, 8, and macOS, this policy controls sending usage and crash-related data. If you don’t configure this policy, Microsoft Edge will default to the user's preference.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_metricsreportingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_metricsreportingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_networkpredictionoptions","displayName":"Enable network prediction (User)","description":"Enables network prediction and prevents users from changing this setting.\r\n\r\nThis controls DNS prefetching, TCP and SSL preconnection, and prerendering of web pages.\r\n\r\nIf you don't configure this policy, network prediction is enabled but the user can change it.\r\n\r\n* 0 = Predict network actions on any network connection\r\n\r\n* 2 = Don't predict network actions on any network connection","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_networkpredictionoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_networkpredictionoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_networkpredictionoptions_networkpredictionoptions","displayName":"Enable network prediction (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_networkpredictionoptions_networkpredictionoptions_0","displayName":"Predict network actions on any network connection","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_networkpredictionoptions_networkpredictionoptions_1","displayName":"Predict network actions on any network that is not cellular.\r\n(Deprecated in 50, removed in 52. After 52, if value 1 is set, it will be treated as 0 - predict network actions on any network connection.)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_networkpredictionoptions_networkpredictionoptions_2","displayName":"Don't predict network actions on any network connection","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_overridesecurityrestrictionsoninsecureorigin","displayName":"Control where security restrictions on insecure origins apply (User)","description":"Specifies a list of origins (URLs) or hostname patterns (like \"*.contoso.com\") for which security restrictions on insecure origins don't apply.\r\n\r\nThis policy lets you specify allowed origins for legacy applications that can't deploy TLS or set up a staging server for internal web development so that developers can test out features requiring secure contexts without having to deploy TLS on the staging server. This policy also prevents the origin from being labeled \"Not Secure\" in the omnibox.\r\n\r\nSetting a list of URLs in this policy has the same effect as setting the command-line flag '--unsafely-treat-insecure-origin-as-secure' to a comma-separated list of the same URLs. If you enable this policy, it overrides the command-line flag.\r\n\r\nFor more information on secure contexts, see https://www.w3.org/TR/secure-contexts/.\r\n\r\nExample value:\r\n\r\nhttp://testserver.contoso.com/\r\n*.contoso.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_overridesecurityrestrictionsoninsecureorigin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_overridesecurityrestrictionsoninsecureorigin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_overridesecurityrestrictionsoninsecureorigin_overridesecurityrestrictionsoninsecureorigindesc","displayName":"Control where security restrictions on insecure origins apply (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_proactiveauthenabled","displayName":"Enable Proactive Authentication (User)","description":"Lets you configure whether to turn on Proactive Authentication.\r\n\r\nIf you enable this policy, Microsoft Edge tries to proactively authenticate the signed-in user with Microsoft services. At regular intervals, Microsoft Edge checks with an online service for an updated manifest that contains the configuration that governs how to do this.\r\n\r\nIf you disable this policy, Microsoft Edge doesn't try to proactively authenticate the signed-in user with Microsoft services. Microsoft Edge no longer checks with an online service for an updated manifest that contains the configuration for doing this.\r\n\r\nIf you don't configure this policy, Proactive Authentication is turned on.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_proactiveauthenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_proactiveauthenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_promotionaltabsenabled","displayName":"Enable full-tab promotional content (deprecated) (User)","description":"DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.\r\n\r\nControl the presentation of full-tab promotional or educational content. This setting controls the presentation of welcome pages that help users sign into Microsoft Edge, choose their default browser, or learn about product features.\r\n\r\nIf you enable this policy (set it true) or don't configure it, Microsoft Edge can show full-tab content to users to provide product information.\r\n\r\nIf you disable (set to false) this policy, Microsoft Edge can't show full-tab content to users.\r\n\r\nThis is deprecated - use ShowRecommendationsEnabled instead.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_promotionaltabsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_promotionaltabsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_promptfordownloadlocation","displayName":"Ask where to save downloaded files (User)","description":"Set whether to ask where to save a file before downloading it.\r\n\r\nIf you enable this policy, the user is asked where to save each file before downloading; if you don't configure it, files are saved automatically to the default location, without asking the user.\r\n\r\nIf you don't configure this policy, the user will be able to change this setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_promptfordownloadlocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_promptfordownloadlocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_quicallowed","displayName":"Allow QUIC protocol (User)","description":"Allows use of the QUIC protocol in Microsoft Edge.\r\n\r\nIf you enable this policy or don't configure it, the QUIC protocol is allowed.\r\n\r\nIf you disable this policy, the QUIC protocol is blocked.\r\n\r\nQUIC is a transport layer network protocol that can improve performance of web applications that currently use TCP.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_quicallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_quicallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_applicationlocalevalue_recommended","displayName":"Set application locale (User)","description":"Configures the application locale in Microsoft Edge and prevents users from changing the locale.\r\n\r\nIf you enable this policy, Microsoft Edge uses the specified locale. If the configured locale isn't supported, 'en-US' is used instead.\r\n\r\nIf you disable or don't configure this setting, Microsoft Edge uses either the user-specified preferred locale (if configured) or the fallback locale 'en-US'.\r\n\r\nExample value: en","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_applicationlocalevalue_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_applicationlocalevalue_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_applicationlocalevalue_recommended_applicationlocalevalue","displayName":"Application locale (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_autofilladdressenabled_recommended","displayName":"Enable AutoFill for addresses (User)","description":"Enables the AutoFill feature and allows users to auto-complete address information in web forms using previously stored information.\r\n\r\nIf you disable this policy, AutoFill never suggests or fills in address information, nor does it save additional address information that the user might submit while browsing the web.\r\n\r\nIf you enable this policy or don't configure it, users can control AutoFill for addresses in the user interface.\r\n\r\nNote that if you disable this policy you also stop all activity for all web forms, except payment and password forms. No further entries are saved, and Microsoft Edge won't suggest or AutoFill any previous entries.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_autofilladdressenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_autofilladdressenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_autofillcreditcardenabled_recommended","displayName":"Enable AutoFill for credit cards (User)","description":"Enables Microsoft Edge's AutoFill feature and lets users auto complete credit card information in web forms using previously stored information.\r\n\r\nIf you disable this policy, AutoFill never suggests or fills credit card information, nor will it save additional credit card information that users might submit while browsing the web.\r\n\r\nIf you enable this policy or don't configure it, users can control AutoFill for credit cards.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_autofillcreditcardenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_autofillcreditcardenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_backgroundmodeenabled_recommended","displayName":"Continue running background apps after Microsoft Edge closes (User)","description":"Allows Microsoft Edge processes to start at OS sign-in and keep running after the last browser window is closed. In this scenario, background apps and the current browsing session remain active, including any session cookies. An open background process displays an icon in the system tray and can always be closed from there.\r\n\r\nIf you enable this policy, background mode is turned on.\r\n\r\nIf you disable this policy, background mode is turned off.\r\n\r\nIf you don't configure this policy, background mode is initially turned off, and the user can configure its behavior in edge://settings/system.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_backgroundmodeenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_backgroundmodeenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_blockthirdpartycookies_recommended","displayName":"Block third party cookies (User)","description":"Block web page elements that aren't from the domain that's in the address bar from setting cookies.\r\n\r\nIf you enable this policy, web page elements that are not from the domain that is in the address bar can't set cookies\r\n\r\nIf you disable this policy, web page elements from domains other than in the address bar can set cookies.\r\n\r\nIf you don't configure this policy, third-party cookies are enabled but users can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_blockthirdpartycookies_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_blockthirdpartycookies_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_downloaddirectory_recommended","displayName":"Set download directory (User)","description":"Configures the directory to use when downloading files.\r\n\r\nIf you enable this policy, Microsoft Edge uses the provided directory regardless of whether the user has specified one or chosen to be prompted for download location every time. See https://go.microsoft.com/fwlink/?linkid=2095041 for a list of variables that can be used.\r\n\r\nIf you disable or don't configure this policy, the default download directory is used, and the user can change it.\r\n\r\nIf you set an invalid path, Microsoft Edge will default to the user's default download directory.\r\n\r\nIf the folder specified by the path doesn't exist, the download will trigger a prompt that asks the user where they want to save their download.\r\n\r\nExample value: \r\n Linux-based OSes (including Mac): /home/${user_name}/Downloads\r\n Windows: C:\\Users\\${user_name}\\Downloads","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_downloaddirectory_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_downloaddirectory_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_downloaddirectory_recommended_downloaddirectory","displayName":"Set download directory (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_downloadrestrictions_recommended","displayName":"Allow download restrictions (User)","description":"Configures the type of downloads that Microsoft Edge completely blocks, without letting users override the security decision.\r\n\r\nSet 'Block dangerous downloads' (1) to allow all downloads except for those that carry Microsoft Defender SmartScreen warnings.\r\n\r\nSet 'Block potentially dangerous downloads' (2) to allow all downloads except for those that carry Microsoft Defender SmartScreen warnings of potentially dangerous downloads.\r\n\r\nSet 'Block all downloads' (3) to block all downloads.\r\n\r\nIf you don't configure this policy or set the 'No special restrictions' (0) option, the downloads go through the usual security restrictions based on Microsoft Defender SmartScreen analysis results.\r\n\r\nNote that these restrictions apply to downloads from web page content, as well as the 'download link...' context menu option. These restrictions don't apply to saving or downloading the currently displayed page, nor do they apply to the Save as PDF option from the printing options.\r\n\r\nSee https://go.microsoft.com/fwlink/?linkid=2094934 for more info on Microsoft Defender SmartScreen.\r\n\r\n* 0 = No special restrictions\r\n\r\n* 1 = Block dangerous downloads\r\n\r\n* 2 = Block potentially dangerous downloads\r\n\r\n* 3 = Block all downloads","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_downloadrestrictions_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_downloadrestrictions_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_downloadrestrictions_recommended_downloadrestrictions","displayName":"Download restrictions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_downloadrestrictions_recommended_downloadrestrictions_0","displayName":"No special restrictions","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_downloadrestrictions_recommended_downloadrestrictions_1","displayName":"Block dangerous downloads","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_downloadrestrictions_recommended_downloadrestrictions_2","displayName":"Block potentially dangerous downloads","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_downloadrestrictions_recommended_downloadrestrictions_3","displayName":"Block all downloads","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_favoritesbarenabled_recommended","displayName":"Enable favorites bar (User)","description":"Enables or disables the favorites bar.\r\n\r\nIf you enable this policy, users will see the favorites bar.\r\n\r\nIf you disable this policy, users won't see the favorites bar.\r\n\r\nIf this policy is not configured, then the user can decide to use the favorites bar or not.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_favoritesbarenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_favoritesbarenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_importautofillformdata_recommended","displayName":"Allow importing of autofill form data (User)","description":"Allows users to import autofill form data from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the option to manually import autofill data is automatically selected.\r\n\r\nIf you disable this policy, autofill form data isn't imported at first run, and users can't import it manually.\r\n\r\nIf you don't configure this policy, autofill data is imported at first run, and users can choose whether to import this data manually during later browsing sessions.\r\n\r\nYou can set this policy as a recommendation. This means that Microsoft Edge will import autofill data on first run, but users can select or clear **autofill data** option during manual import.\r\n\r\n**Note**: This policy currently manages importing from Google Chrome (on Windows 7, 8, and 10 and on macOS) and Mozilla Firefox (on Windows 7, 8, and 10 and on macOS) browsers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_importautofillformdata_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_importautofillformdata_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_importfavorites_recommended","displayName":"Allow importing of favorites (User)","description":"Allows users to import favorites from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the **Favorites** check box is automatically selected in the **Import browser data** dialog box.\r\n\r\nIf you disable this policy, favorites aren't imported at first run, and users can’t import them manually.\r\n\r\nIf you don’t configure this policy, favorites are imported at first run, and users can choose whether to import them manually during later browsing sessions.\r\n\r\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports favorites on first run, but users can select or clear the **favorites** option during manual import.\r\n\r\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10), Google Chrome (on Windows 7, 8, and 10 and on macOS), Mozilla Firefox (on Windows 7, 8, and 10 and on macOS), and Apple Safari (on macOS) browsers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_importfavorites_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_importfavorites_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_importhistory_recommended","displayName":"Allow importing of browsing history (User)","description":"Allows users to import their browsing history from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the **Browsing history** check box is automatically selected in the **Import browser data** dialog box.\r\n\r\nIf you disable this policy, browsing history data isn't imported at first run, and users can’t import this data manually.\r\n\r\nIf you don’t configure this policy, browsing history data is imported at first run, and users can choose whether to import it manually during later browsing sessions.\r\n\r\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports browsing history on first run, but users can select or clear the **history** option during manual import.\r\n\r\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10), Google Chrome (on Windows 7, 8, and 10 and on macOS), Mozilla Firefox (on Windows 7, 8, and 10 and on macOS), and Apple Safari (macOS) browsers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_importhistory_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_importhistory_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_importpaymentinfo_recommended","displayName":"Allow importing of payment info (User)","description":"Allows users to import payment info from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the **payment info** check box is automatically selected in the **Import browser data** dialog box.\r\n\r\nIf you disable this policy, payment info isn’t imported at first run, and users can’t import it manually.\r\n\r\nIf you don’t configure this policy, payment info is imported at first run, and users can choose whether to import it manually during later browsing sessions.\r\n\r\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports payment info on first run, but users can select or clear the **payment info** option during manual import.\r\n\r\n**Note:** This policy currently manages importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_importpaymentinfo_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_importpaymentinfo_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_importsavedpasswords_recommended","displayName":"Allow importing of saved passwords (User)","description":"Allows users to import saved passwords from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the option to manually import saved passwords is automatically selected.\r\n\r\nIf you disable this policy, saved passwords aren't imported on first run, and users can't import them manually.\r\n\r\nIf you don't configure this policy, passwords are imported at first run, and users can choose whether to import them manually during later browsing sessions.\r\n\r\nYou can set this policy as a recommendation. This means that Microsoft Edge imports passwords on first run, but users can select or clear the **passwords** option during manual import.\r\n\r\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10), Google Chrome (on Windows 7, 8, and 10 and on macOS), and Mozilla Firefox (on Windows 7, 8, and 10 and on macOS) browsers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_importsavedpasswords_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_importsavedpasswords_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_importsearchengine_recommended","displayName":"Allow importing of search engine settings (User)","description":"Allows users to import search engine settings from another browser into Microsoft Edge.\r\n\r\nIf you enable, this policy, the option to import search engine settings is automatically selected.\r\n\r\nIf you disable this policy, search engine settings aren't imported at first run, and users can’t import them manually.\r\n\r\nIf you don’t configure this policy, search engine settings are imported at first run, and users can choose whether to import this data manually during later browsing sessions.\r\n\r\nYou can set this policy as a recommendation. This means that Microsoft Edge imports search engine settings on first run, but users can select or clear the **search engine** option during manual import.\r\n\r\n**Note**: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_importsearchengine_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_importsearchengine_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_networkpredictionoptions_recommended","displayName":"Enable network prediction (User)","description":"Enables network prediction and prevents users from changing this setting.\r\n\r\nThis controls DNS prefetching, TCP and SSL preconnection, and prerendering of web pages.\r\n\r\nIf you don't configure this policy, network prediction is enabled but the user can change it.\r\n\r\n* 0 = Predict network actions on any network connection\r\n\r\n* 2 = Don't predict network actions on any network connection","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_networkpredictionoptions_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_networkpredictionoptions_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_networkpredictionoptions_recommended_networkpredictionoptions","displayName":"Enable network prediction (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_networkpredictionoptions_recommended_networkpredictionoptions_0","displayName":"Predict network actions on any network connection","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_networkpredictionoptions_recommended_networkpredictionoptions_1","displayName":"Predict network actions on any network that is not cellular.\r\n(Deprecated in 50, removed in 52. After 52, if value 1 is set, it will be treated as 0 - predict network actions on any network connection.)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_networkpredictionoptions_recommended_networkpredictionoptions_2","displayName":"Don't predict network actions on any network connection","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_resolvenavigationerrorsusewebservice_recommended","displayName":"Enable resolution of navigation errors using a web service (User)","description":"Allow Microsoft Edge to issue a dataless connection to a web service to probe networks for connectivity in cases like hotel and airport Wi-Fi.\r\n\r\nIf you enable this policy, a web service is used for network connectivity tests.\r\n\r\nIf you disable this policy, Microsoft Edge uses native APIs to try to resolve network connectivity and navigation issues.\r\n\r\n**Note**: Except on Windows 8 and later versions of Windows, Microsoft Edge *always* uses native APIs to resolve connectivity issues.\r\n\r\nIf you don't configure this policy, Microsoft Edge respects the user preference that's set under Services at edge://settings/privacy.\r\nSpecifically, there's a **Use a web service to help resolve navigation errors** toggle, which the user can switch on or off. Be aware that if you have enabled this policy (ResolveNavigationErrorsUseWebService), the **Use a web service to help resolve navigation errors** setting is turned on, but the user can't change the setting by using the toggle. If you have disabled this policy, the **Use a web service to help resolve navigation errors** setting is turned off, and the user can't change the setting by using the toggle.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_resolvenavigationerrorsusewebservice_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_resolvenavigationerrorsusewebservice_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_searchsuggestenabled_recommended","displayName":"Enable search suggestions (User)","description":"Enables web search suggestions in Microsoft Edge's Address Bar and Auto-Suggest List and prevents users from changing this policy.\r\n\r\nIf you enable this policy, web search suggestions are used.\r\n\r\nIf you disable this policy, web search suggestions are never used, however local history and local favorites suggestions still appear. If you disable this policy, neither the typed characters, nor the URLs visited will be included in telemetry to Microsoft.\r\n\r\nIf this policy is left not set, search suggestions are enabled but the user can change that.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_searchsuggestenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_searchsuggestenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_syncdisabled_recommended","displayName":"Disable synchronization of data using Microsoft sync services (User)","description":"Disables data synchronization in Microsoft Edge. This policy also prevents the sync consent prompt from appearing.\r\n\r\nIf you don't set this policy or apply it as recommended, users will be able to turn sync on or off. If you apply this policy as mandatory, users will not be able to turn sync on.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_syncdisabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_syncdisabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_translateenabled_recommended","displayName":"Enable Translate (User)","description":"Enables the integrated Microsoft translation service on Microsoft Edge.\r\n\r\nIf you enable this policy, Microsoft Edge offers translation functionality to the user by showing an integrated translate flyout when appropriate, and a translate option on the right-click context menu.\r\n\r\nDisable this policy to disable all built-in translate features.\r\n\r\nIf you don't configure the policy, users can choose whether to use the translation functionality or not.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_translateenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended_translateenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~contentsettings_recommended_registeredprotocolhandlers_recommended","displayName":"Register protocol handlers (User)","description":"Register a list of protocol handlers. Set the protocol property to the scheme (like 'mailto') and the url property to the URL pattern of the application that handles the scheme. The pattern can include a '%s', which will be replaced by the handled URL.\r\n\r\nYou can recommend a specific value for this policy, but you can't require that your users use it.\r\n\r\nThe protocol handlers registered by policy are merged with any handlers registered by the user, and both are available for use. The user can override the protocol handlers installed by policy by installing a new default handler, but they can't remove a protocol handler registered by policy.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"url\": \"https://mail.contoso.com/mail/?extsrc=mailto&url=%s\", \r\n \"default\": true, \r\n \"protocol\": \"mailto\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~contentsettings_recommended_registeredprotocolhandlers_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~contentsettings_recommended_registeredprotocolhandlers_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~contentsettings_recommended_registeredprotocolhandlers_recommended_registeredprotocolhandlers","displayName":"Register protocol handlers (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~passwordmanager_recommended_passwordmanagerenabled_recommended","displayName":"Enable saving passwords to the password manager (User)","description":"Enable Microsoft Edge to save user passwords.\r\n\r\nIf you enable this policy, users can save their passwords in Microsoft Edge. The next time they visit the site, Microsoft Edge will enter the password automatically.\r\n\r\nIf you disable this policy, users can't save new passwords, but they can still use previously saved passwords.\r\n\r\nIf you enable or disable this policy, users can't change or override it in Microsoft Edge. If you don't configure it, users can save passwords, as well as turn this feature off.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~passwordmanager_recommended_passwordmanagerenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~passwordmanager_recommended_passwordmanagerenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~printing_recommended_printheaderfooter_recommended","displayName":"Print headers and footers (User)","description":"Force 'headers and footers' to be on or off in the printing dialog.\r\n\r\nIf you don't configure this policy, users can decide whether to print headers and footers.\r\n\r\nIf you disable this policy, users can't print headers and footers.\r\n\r\nIf you enable this policy, users always print headers and footers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~printing_recommended_printheaderfooter_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~printing_recommended_printheaderfooter_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~printing_recommended_printpreviewusesystemdefaultprinter_recommended","displayName":"Set the system default printer as the default printer (User)","description":"Tells Microsoft Edge to use the system default printer as the default choice in Print Preview instead of the most recently used printer.\r\n\r\nIf you disable this policy or don't configure it, Print Preview uses the most recently used printer as the default destination choice.\r\n\r\nIf you enable this policy, Print Preview uses the OS system default printer as the default destination choice.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~printing_recommended_printpreviewusesystemdefaultprinter_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~printing_recommended_printpreviewusesystemdefaultprinter_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~smartscreen_recommended_smartscreenenabled_recommended","displayName":"Configure Microsoft Defender SmartScreen (User)","description":"This policy setting lets you configure whether to turn on Microsoft Defender SmartScreen. Microsoft Defender SmartScreen provides warning messages to help protect your users from potential phishing scams and malicious software. By default, Microsoft Defender SmartScreen is turned on.\r\n\r\nIf you enable this setting, Microsoft Defender SmartScreen is turned on.\r\n\r\nIf you disable this setting, Microsoft Defender SmartScreen is turned off.\r\n\r\nIf you don't configure this setting, users can choose whether to use Microsoft Defender SmartScreen.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~smartscreen_recommended_smartscreenenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~smartscreen_recommended_smartscreenenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_homepageisnewtabpage_recommended","displayName":"Set the new tab page as the home page (User)","description":"Configures the default home page in Microsoft Edge. You can set the home page to a URL you specify or to the new tab page.\r\n\r\nIf you enable this policy, the new tab page is always used for the home page, and the home page URL location is ignored.\r\n\r\nIf you disable this policy, the user's home page can't be the new tab page, unless the URL is set to 'edge://newtab'.\r\n\r\nIf not configured users can choose whether the new tab page is their home page.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances enrolled for device management.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_homepageisnewtabpage_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_homepageisnewtabpage_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_homepagelocation_recommended","displayName":"Configure the home page URL (User)","description":"Configures the default home page URL in Microsoft Edge.\r\n\r\nThe home page is the page opened by the Home button. The pages that open on startup are controlled by the 'RestoreOnStartup' (Action to take on startup) policies.\r\n\r\nYou can either set a URL here or set the home page to open the new tab page. If you select to open the new tab page, then this policy doesn't take effect.\r\n\r\nIf you enable this policy, users can't change their home page URL, but they can choose to use the new tab page as their home page.\r\n\r\nIf you disable or don't configure this policy, users can choose their own home page, as long as the 'HomepageIsNewTabPage' (Set the new tab page as the home page) policy isn't enabled.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances enrolled for device management.\r\n\r\nExample value: https://www.contoso.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_homepagelocation_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_homepagelocation_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_homepagelocation_recommended_homepagelocation","displayName":"Home page URL (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_newtabpagelocation_recommended","displayName":"Configure the new tab page URL (User)","description":"Configures the default URL for the new tab page.\r\n\r\nThis policy determines the page that's opened when new tabs are created (including when new windows are opened). It also affects the startup page if that's set to open to the new tab page.\r\n\r\nThis policy doesn't determine which page opens on startup; that's controlled by the 'RestoreOnStartup' (Action to take on startup) policy. It also doesn’t affect the home page if that’s set to open to the new tab page.\r\n\r\nIf you don't configure this policy, the default new tab page is used.\r\n\r\nIf you configure this policy *and* the 'NewTabPageSetFeedType' (Configure the Microsoft Edge new tab page experience) policy, this policy has precedence.\r\n\r\nIf an invalid URL is provided, new tabs will open about://blank.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances that are enrolled for device management.\r\n\r\nExample value: https://www.fabrikam.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_newtabpagelocation_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_newtabpagelocation_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_newtabpagelocation_recommended_newtabpagelocation","displayName":"New tab page URL (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_restoreonstartup_recommended","displayName":"Action to take on Microsoft Edge startup (User)","description":"Specify how Microsoft Edge behaves when it starts.\r\n\r\nIf you want a new tab to always open on startup, choose 'Open new tab' (5).\r\n\r\nIf you want to reopen URLs that were open the last time Microsoft Edge closed, choose 'Restore the last session' (1). The browsing session will be restored as it was. Note that this option disables some settings that rely on sessions or that perform actions on exit (such as Clear browsing data on exit or session-only cookies).\r\n\r\nIf you want to open a specific set of URLs, choose 'Open a list of URLs' (4).\r\n\r\nDisabling this setting is equivalent to leaving it not configured. Users will be able to change it in Microsoft Edge.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances enrolled for device management.\r\n\r\n* 1 = Restore the last session\r\n\r\n* 4 = Open a list of URLs\r\n\r\n* 5 = Open a new tab","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_restoreonstartup_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_restoreonstartup_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_restoreonstartup_recommended_restoreonstartup","displayName":"Action to take on startup (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_restoreonstartup_recommended_restoreonstartup_5","displayName":"Open a new tab","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_restoreonstartup_recommended_restoreonstartup_1","displayName":"Restore the last session","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_restoreonstartup_recommended_restoreonstartup_4","displayName":"Open a list of URLs","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_restoreonstartupurls_recommended","displayName":"Sites to open when the browser starts (User)","description":"Specify a list of websites to open automatically when the browser starts. If you don't configure this policy, no site is opened on startup.\r\n\r\nThis policy only works if you also set the 'RestoreOnStartup' (Action to take on startup) policy to 'Open a list of URLs' (4).\r\n\r\nThis policy is only available on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances that are enrolled for device management.\r\n\r\nExample value:\r\n\r\nhttps://contoso.com\r\nhttps://www.fabrikam.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_restoreonstartupurls_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_restoreonstartupurls_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_restoreonstartupurls_recommended_restoreonstartupurlsdesc","displayName":"Sites to open when the browser starts (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_showhomebutton_recommended","displayName":"Show Home button on toolbar (User)","description":"Shows the Home button on Microsoft Edge's toolbar.\r\n\r\nEnable this policy to always show the Home button. Disable it to never show the button.\r\n\r\nIf you don't configure the policy, users can choose whether to show the home button.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_showhomebutton_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_recommended~startup_recommended_showhomebutton_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_relaunchnotification","displayName":"Notify a user that a browser restart is recommended or required for pending updates (User)","description":"Notify users that they need to restart Microsoft Edge to apply a pending update.\r\n\r\nIf you don't configure this policy, Microsoft Edge adds a recycle icon at the far right of the top menu bar to prompt users to restart the browser to apply the update.\r\n\r\nIf you enable this policy and set it to 'Recommended' (1), a recurring warning prompts users that a restart is recommended. Users can dismiss this warning and defer the restart.\r\n\r\nIf you set the policy to 'Required' (2), a recurring warning prompts users that the browser will be restarted automatically as soon as a notification period passes. The default period is seven days. You can configure this period with the 'RelaunchNotificationPeriod' (Set the time period for update notifications) policy.\r\n\r\nThe user's session is restored when the browser restarts.\r\n\r\n* 1 = Recommended - Show a recurring prompt to the user indicating that a restart is recommended\r\n\r\n* 2 = Required - Show a recurring prompt to the user indicating that a restart is required","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_relaunchnotification_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_relaunchnotification_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_relaunchnotification_relaunchnotification","displayName":"Notify a user that a browser restart is recommended or required for pending updates (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_relaunchnotification_relaunchnotification_1","displayName":"Recommended - Show a recurring prompt to the user indicating that a restart is recommended","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_relaunchnotification_relaunchnotification_2","displayName":"Required - Show a recurring prompt to the user indicating that a restart is required","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_relaunchnotificationperiod","displayName":"Set the time period for update notifications (User)","description":"Allows you to set the time period, in milliseconds, over which users are notified that Microsoft Edge must be relaunched or that a Microsoft Edge OS device must be restarted to apply a pending update.\r\n\r\nOver this time period, the user will be repeatedly informed of the need for an update. For Microsoft Edge OS devices, a restart notification appears in the system tray according to the RelaunchHeadsUpPeriod policy. For Microsoft Edge browsers, the app menu changes to indicate that a relaunch is needed once one third of the notification period passes. This notification changes color once two thirds of the notification period passes, and again once the full notification period has passed. The additional notifications enabled by the 'RelaunchNotification' (Notify a user that a browser restart is recommended or required for pending updates) policy follow this same schedule.\r\n\r\nIf not set, the default period of 604800000 milliseconds (one week) is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_relaunchnotificationperiod_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_relaunchnotificationperiod_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_relaunchnotificationperiod_relaunchnotificationperiod","displayName":"Set the time period for update notifications: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_requireonlinerevocationchecksforlocalanchors","displayName":"Specify if online OCSP/CRL checks are required for local trust anchors (User)","description":"Control whether online revocation checks (OCSP/CRL checks) are required. If Microsoft Edge can't get revocation status information, these certificates are treated as revoked (\"hard-fail\").\r\n\r\nIf you enable this policy, Microsoft Edge always performs revocation checking for server certificates that successfully validate and are signed by locally-installed CA certificates.\r\n\r\nIf you don't configure or disable this policy, then Microsoft Edge uses the existing online revocation checking settings.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_requireonlinerevocationchecksforlocalanchors_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_requireonlinerevocationchecksforlocalanchors_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_resolvenavigationerrorsusewebservice","displayName":"Enable resolution of navigation errors using a web service (User)","description":"Allow Microsoft Edge to issue a dataless connection to a web service to probe networks for connectivity in cases like hotel and airport Wi-Fi.\r\n\r\nIf you enable this policy, a web service is used for network connectivity tests.\r\n\r\nIf you disable this policy, Microsoft Edge uses native APIs to try to resolve network connectivity and navigation issues.\r\n\r\n**Note**: Except on Windows 8 and later versions of Windows, Microsoft Edge *always* uses native APIs to resolve connectivity issues.\r\n\r\nIf you don't configure this policy, Microsoft Edge respects the user preference that's set under Services at edge://settings/privacy.\r\nSpecifically, there's a **Use a web service to help resolve navigation errors** toggle, which the user can switch on or off. Be aware that if you have enabled this policy (ResolveNavigationErrorsUseWebService), the **Use a web service to help resolve navigation errors** setting is turned on, but the user can't change the setting by using the toggle. If you have disabled this policy, the **Use a web service to help resolve navigation errors** setting is turned off, and the user can't change the setting by using the toggle.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_resolvenavigationerrorsusewebservice_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_resolvenavigationerrorsusewebservice_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_restrictsignintopattern","displayName":"Restrict which accounts can be used to sign in to Microsoft Edge (User)","description":"Determines which accounts can be used to sign in to the Microsoft Edge account that's chosen during the Sync opt-in flow.\r\n\r\nYou can configure this policy to match multiple accounts using a Perl style regular expression for the pattern. If a user tries to sign in to the browser with an account whose username doesn't match this pattern, they are blocked and will get the appropriate error message. Note that pattern matches are case sensitive. For more information about the regular expression rules that are used, refer to https://go.microsoft.com/fwlink/p/?linkid=2133903.\r\n\r\nIf you don't configure this policy or leave it blank, users can use any account to sign in to Microsoft Edge.\r\n\r\nNote that signed-in profiles with a username that doesn't match this pattern will be signed out after this policy is enabled.\r\n\r\nExample value: .*@contoso.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_restrictsignintopattern_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_restrictsignintopattern_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_restrictsignintopattern_restrictsignintopattern","displayName":"Restrict which accounts can be used as Microsoft Edge primary accounts (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_runallflashinallowmode","displayName":"Extend Adobe Flash content setting to all content (User)","description":"If you enable this policy, all Adobe Flash content embedded in websites that are set to allow Adobe Flash in the content settings -- either by the user or by enterprise policy -- will run. This includes content from other origins and/or small content.\r\n\r\nTo control which websites are allowed to run Adobe Flash, see the specifications in the 'DefaultPluginsSetting' (Default Adobe Flash setting), 'PluginsAllowedForUrls' (Allow the Adobe Flash plug-in on specific sites), and 'PluginsBlockedForUrls' (Block the Adobe Flash plug-in on specific sites) policies.\r\n\r\nIf you disable this policy or don't configure it, Adobe Flash content from other origins (from sites that aren't specified in the three policies mentioned immediately above) or small content might be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_runallflashinallowmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_runallflashinallowmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_savingbrowserhistorydisabled","displayName":"Disable saving browser history (User)","description":"Disables saving browser history and prevents users from changing this setting.\r\n\r\nIf you enable this policy, browsing history isn't saved. This also disables tab syncing.\r\n\r\nIf you disable this policy or don't configure it, browsing history is saved.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_savingbrowserhistorydisabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_savingbrowserhistorydisabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_searchsuggestenabled","displayName":"Enable search suggestions (User)","description":"Enables web search suggestions in Microsoft Edge's Address Bar and Auto-Suggest List and prevents users from changing this policy.\r\n\r\nIf you enable this policy, web search suggestions are used.\r\n\r\nIf you disable this policy, web search suggestions are never used, however local history and local favorites suggestions still appear. If you disable this policy, neither the typed characters, nor the URLs visited will be included in telemetry to Microsoft.\r\n\r\nIf this policy is left not set, search suggestions are enabled but the user can change that.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_searchsuggestenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_searchsuggestenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_securitykeypermitattestation","displayName":"Websites or domains that don't need permission to use direct Security Key attestation (User)","description":"Specifies websites and domains that don't need explicit user permission when attestation certificates from security keys are requested. Additionally, a signal is sent to the security key indicating that it can use individual attestation. Without this, users are prompted each time a site requests attestation of security keys.\r\n\r\nSites (like https://contoso.com/some/path) only match as U2F appIDs. Domains (like contoso.com) only match as webauthn RP IDs. To cover both U2F and webauthn APIs for a given site, you need to list both the appID URL and domain.\r\n\r\nExample value:\r\n\r\nhttps://contoso.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_securitykeypermitattestation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_securitykeypermitattestation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_securitykeypermitattestation_securitykeypermitattestationdesc","displayName":"Websites or domains that don't need permission to use direct Security Key attestation (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_sendintranettointernetexplorer","displayName":"Send all intranet sites to Internet Explorer (User)","description":"For guidance about configuring the optimal experience for Internet Explorer mode see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_sendintranettointernetexplorer_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_sendintranettointernetexplorer_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_sendsiteinfotoimproveservices","displayName":"Send site information to improve Microsoft services (User)","description":"This policy enables sending info about websites visited in Microsoft Edge to Microsoft to improve services like search.\r\n\r\nEnable this policy to send info about websites visited in Microsoft Edge to Microsoft. Disable this policy to not send info about websites visited in Microsoft Edge to Microsoft. In both cases, users can't change or override the setting.\r\n\r\nOn Windows 10, Beta and Stable if this policy is not configured, Microsoft Edge will default to the Windows diagnostic data setting. If this policy is enabled Microsoft Edge will only send info about websites visited in Microsoft Edge if the Windows Diagnostic data setting is set to Full. If this policy is disabled Microsoft Edge will not send info about websites visited. Learn more about Windows Diagnostic data settings: https://go.microsoft.com/fwlink/?linkid=2099569\r\n\r\nOn Windows 10, Canary and Dev channels, this policy controls sending info about websites visited. If this policy is not configured, Microsoft Edge will default to the user’s preference.\r\n\r\nOn Windows 7, 8, and Mac this policy controls sending info about websites visited. If this policy is not configured, Microsoft Edge will default to the user’s preference.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_sendsiteinfotoimproveservices_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_sendsiteinfotoimproveservices_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_showofficeshortcutinfavoritesbar","displayName":"Show Microsoft Office shortcut in favorites bar (User)","description":"Specifies whether to include a shortcut to Office.com in the favorites bar. For users signed into Microsoft Edge the shortcut takes users to their Microsoft Office apps and docs.\r\n\r\nIf this policy is enabled or not configure, users can choose whether to see the shortcut by changing the toggle in the favorites bar context menu.\r\n\r\nIf the policy is disabled, the shortcut won't be shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_showofficeshortcutinfavoritesbar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_showofficeshortcutinfavoritesbar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_siteperprocess","displayName":"Enable site isolation for every site (User)","description":"\r\nThe 'SitePerProcess' policy can be used to prevent users from opting out of the default behavior of isolating all sites. Note that you can also use the 'IsolateOrigins' (Enable site isolation for specific origins) policy to isolate additional, finer-grained origins.\r\nIf you enable this policy, users can't opt out of the default behavior where each site runs in its own process.\r\nIf you disable or don’t configure this policy, a user can opt out of site isolation. (For example, by using \"Disable site isolation\" entry in edge://flags.) Disabling the policy or not configuring the policy doesn't turn off Site Isolation.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_siteperprocess_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_siteperprocess_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_spellcheckenabled","displayName":"Enable spellcheck (User)","description":"If you enable or don't configure this policy, the user can use spellcheck.\r\n\r\nIf you disable this policy, the user can't use spellcheck and the 'SpellcheckLanguage' (Enable specific spellcheck languages) and 'SpellcheckLanguageBlocklist' (Force disable spellcheck languages) policies are also disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_spellcheckenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_spellcheckenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_spellchecklanguage","displayName":"Enable specific spellcheck languages (User)","description":"Enables different languages for spellcheck. Any language that you specify that isn't recognized is ignored.\r\n\r\nIf you enable this policy, spellcheck is enabled for the languages specified, as well as any languages the user has enabled.\r\n\r\nIf you don't configure or disable this policy, there's no change to the user's spellcheck preferences.\r\n\r\nIf the 'SpellcheckEnabled' (Enable spellcheck) policy is disabled, this policy will have no effect.\r\n\r\nIf a language is included in both the 'SpellcheckLanguage' and the 'SpellcheckLanguageBlocklist' (Force disable spellcheck languages) policy, the spellcheck language is enabled.\r\n\r\nThe supported languages are: af, bg, ca, cs, cy, da, de, el, en-AU, en-CA, en-GB, en-US, es, es-419, es-AR, es-ES, es-MX, es-US, et, fa, fo, fr, he, hi, hr, hu, id, it, ko, lt, lv, nb, nl, pl, pt-BR, pt-PT, ro, ru, sh, sk, sl, sq, sr, sv, ta, tg, tr, uk, vi.\r\n\r\nExample value:\r\n\r\nfr\r\nes","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_spellchecklanguage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_spellchecklanguage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_spellchecklanguage_spellchecklanguagedesc","displayName":"Enable specific spellcheck languages (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_sslerroroverrideallowed","displayName":"Allow users to proceed from the HTTPS warning page (User)","description":"Microsoft Edge shows a warning page when users visit sites that have SSL errors.\r\n\r\nIf you enable or don't configure (default) this policy, users can click through these warning pages.\r\n\r\nIf you disable this policy, users are blocked from clicking through any warning page.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_sslerroroverrideallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_sslerroroverrideallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_sslversionmin","displayName":"Minimum TLS version enabled (User)","description":"Sets the minimum supported version of SSL. If you don't configure this policy, Microsoft Edge uses a default minimum version, TLS 1.0.\r\n\r\nIf you enable this policy, you can set the minimum version to one of the following values: \"tls1\", \"tls1.1\" or \"tls1.2\". When set, Microsoft Edge won't use any version of SSL/TLS lower than the specified version. Any unrecognized value is ignored.\r\n\r\n* \"tls1\" = TLS 1.0\r\n\r\n* \"tls1.1\" = TLS 1.1\r\n\r\n* \"tls1.2\" = TLS 1.2\r\n\r\nExample value: tls1","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_sslversionmin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_sslversionmin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_sslversionmin_sslversionmin","displayName":"Minimum SSL version enabled (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_sslversionmin_sslversionmin_tls1","displayName":"TLS 1.0","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_sslversionmin_sslversionmin_tls1.1","displayName":"TLS 1.1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_sslversionmin_sslversionmin_tls1.2","displayName":"TLS 1.2","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_suppressunsupportedoswarning","displayName":"Suppress the unsupported OS warning (User)","description":"Suppresses the warning that appears when Microsoft Edge is running on a computer or operating system that is no longer supported.\r\n\r\nIf this policy is false or unset, the warnings will appear on such unsupported computers or operating systems.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_suppressunsupportedoswarning_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_suppressunsupportedoswarning_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_syncdisabled","displayName":"Disable synchronization of data using Microsoft sync services (User)","description":"Disables data synchronization in Microsoft Edge. This policy also prevents the sync consent prompt from appearing.\r\n\r\nIf you don't set this policy or apply it as recommended, users will be able to turn sync on or off. If you apply this policy as mandatory, users will not be able to turn sync on.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_syncdisabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_syncdisabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_tablifecyclesenabled","displayName":"Configure tab lifecycles (User)","description":"The tab lifecycles feature reclaims CPU and memory associated with running tabs that haven't been used in a long time, by first throttling, then freezing, and finally discarding them.\r\n\r\nIf you disable this policy, the tab lifecycles feature is disabled, and all tabs are left running normally.\r\n\r\nIf you enable or don't configure this policy, the tab lifecycles feature is enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_tablifecyclesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_tablifecyclesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_taskmanagerendprocessenabled","displayName":"Enable ending processes in the Browser task manager (User)","description":"If you enable or don't configure this policy, users can end processes in the Browser task manager. If you disable it, users can't end processes, and the End process button is disabled in the Browser task manager.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_taskmanagerendprocessenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_taskmanagerendprocessenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_translateenabled","displayName":"Enable Translate (User)","description":"Enables the integrated Microsoft translation service on Microsoft Edge.\r\n\r\nIf you enable this policy, Microsoft Edge offers translation functionality to the user by showing an integrated translate flyout when appropriate, and a translate option on the right-click context menu.\r\n\r\nDisable this policy to disable all built-in translate features.\r\n\r\nIf you don't configure the policy, users can choose whether to use the translation functionality or not.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_translateenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_translateenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_urlallowlist","displayName":"Define a list of allowed URLs (User)","description":"Allow access to the listed URLs, as exceptions to the URL block list.\r\n\r\nFormat the URL pattern according to https://go.microsoft.com/fwlink/?linkid=2095322.\r\n\r\nYou can use this policy to open exceptions to restrictive block lists. For example, you can include '*' in the block list to block all requests, and then use this policy to allow access to a limited list of URLs. You can use this policy to open exceptions to certain schemes, subdomains of other domains, ports, or specific paths.\r\n\r\nThe most specific filter determines if a URL is blocked or allowed. The allowed list takes precedence over the block list.\r\n\r\nThis policy is limited to 1000 entries; subsequent entries are ignored.\r\n\r\nIf you don't configure this policy, there are no exceptions to the block list in the 'URLBlocklist' (Block access to a list of URLs) policy.\r\n\r\nExample value:\r\n\r\ncontoso.com\r\nhttps://ssl.server.com\r\nhosting.com/good_path\r\nhttps://server:8080/path\r\n.exact.hostname.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_urlallowlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_urlallowlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_urlallowlist_urlallowlistdesc","displayName":"Define a list of allowed URLs (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_urlblocklist","displayName":"Block access to a list of URLs (User)","description":"Define a list of sites, based on URL patterns, that are blocked (your users can't load them).\r\n\r\nFormat the URL pattern according to https://go.microsoft.com/fwlink/?linkid=2095322.\r\n\r\nYou can define exceptions in the 'URLAllowlist' (Define a list of allowed URLs) policy. These policies are limited to 1000 entries; subsequent entries are ignored.\r\n\r\nNote that blocking internal 'edge://*' URLs isn't recommended - this may lead to unexpected errors.\r\n\r\nThis policy doesn't prevent the page from updating dynamically through JavaScript. For example, if you block 'contoso.com/abc', users might still be able to visit 'contoso.com' and click on a link to visit 'contoso.com/abc', as long as the page doesn't refresh.\r\n\r\nIf you don't configure this policy, no URLs are blocked.\r\n\r\nExample value:\r\n\r\ncontoso.com\r\nhttps://ssl.server.com\r\nhosting.com/bad_path\r\nhttps://server:8080/path\r\n.exact.hostname.com\r\nfile://*\r\ncustom_scheme:*\r\n*","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_urlblocklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_urlblocklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_urlblocklist_urlblocklistdesc","displayName":"Block access to a list of URLs (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_userdatadir","displayName":"Set the user data directory (User)","description":"Set the directory to use for storing user data.\r\n\r\nIf you enable this policy, Microsoft Edge uses the specified directory regardless of whether the user has set the '--user-data-dir' command-line flag.\r\n\r\nIf you don't enable this policy, the default profile path is used, but the user can override it by using the '--user-data-dir' flag. Users can find the directory for the profile at edge://version/ under profile path.\r\n\r\nTo avoid data loss or other errors, don't configure this policy to a volume's root directory or to a directory that's used for other purposes, because Microsoft Edge manages its contents.\r\n\r\nSee https://go.microsoft.com/fwlink/?linkid=2095041 for a list of variables that can be used.\r\n\r\nExample value: ${users}/${user_name}/Edge","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_userdatadir_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_userdatadir_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_userdatadir_userdatadir","displayName":"Set the user data directory (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_userfeedbackallowed","displayName":"Allow user feedback (User)","description":"Microsoft Edge uses the Edge Feedback feature (enabled by default) to allow users to send feedback, suggestions or customer surveys and to report any issues with the browser. Also, by default, users can't disable (turn off) the Edge Feedback feature.\r\n\r\nIf you enable this policy or don't configure it, users can invoke Edge Feedback.\r\n\r\nIf you disable this policy, users can't invoke Edge Feedback.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_userfeedbackallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_userfeedbackallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_videocaptureallowed","displayName":"Allow or block video capture (User)","description":"Control whether sites can capture video.\r\n\r\nIf enabled or not configured (default), the user will be asked about video capture access for all sites except those with URLs configured in the 'VideoCaptureAllowedUrls' (Sites that can access video capture devices without requesting permission) policy list, which will be granted access without prompting.\r\n\r\nIf you disable this policy, the user isn't prompted, and video capture is only available to URLs configured in 'VideoCaptureAllowedUrls' policy.\r\n\r\nThis policy affects all types of video inputs, not only the built-in camera.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_videocaptureallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_videocaptureallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_videocaptureallowedurls","displayName":"Sites that can access video capture devices without requesting permission (User)","description":"Specify websites, based on URL patterns, that can use video capture devices without asking the user for permission. Patterns in this list are matched against the security origin of the requesting URL. If they match, the site is automatically granted access to video capture devices. Note, however, that the pattern \"*\", which matches any URL, is not supported by this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com/\r\nhttps://[*.]contoso.edu/","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_videocaptureallowedurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_videocaptureallowedurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_videocaptureallowedurls_videocaptureallowedurlsdesc","displayName":"Sites that can access video capture devices without requesting permission (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_webdriveroverridesincompatiblepolicies","displayName":"Allow WebDriver to Override Incompatible Policies (deprecated) (User)","description":"DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.\r\n\r\n\r\nThis policy was removed in M83, because it is not necessary anymore as\r\nWebDriver is now compatible with all existing policies.\r\n\r\nThis policy allows users of the WebDriver feature to override\r\npolicies which can interfere with its operation.\r\n\r\nCurrently this policy disables 'SitePerProcess' (Enable site isolation for every site) and 'IsolateOrigins' (Enable site isolation for specific origins) policies.\r\n\r\nIf the policy is enabled, WebDriver will be able to override incomaptible\r\npolicies.\r\nIf the policy is disabled or not configured, WebDriver will not be allowed\r\nto override incompatible policies.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_webdriveroverridesincompatiblepolicies_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_webdriveroverridesincompatiblepolicies_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_webrtclocalhostiphandling","displayName":"Restrict exposure of local IP address by WebRTC (User)","description":"Allows you to set whether or not WebRTC exposes the user's local IP address.\r\n\r\nIf you set this policy to \"AllowAllInterfaces\" ('default') or \"AllowPublicAndPrivateInterfaces\" ('default_public_and_private_interfaces'), WebRTC exposes the local IP address.\r\n\r\nIf you set this policy to \"AllowPublicInterfaceOnly\" ('default_public_interface_only') or \"DisableNonProxiedUdp\" ('disable_non_proxied_udp'), WebRTC doesn't expose the local IP address.\r\n\r\nIf you don't set this policy, or if you disable it, WebRTC exposes the local IP address.\r\n\r\n * 'default' = Allow all interfaces. This exposes the local IP address.\r\n * 'default_public_and_private_interfaces' = Allow public and private interfaces over http default route. This exposes the local IP address.\r\n * 'default_public_interface_only' = Allow public interface over http default route. This doesn't expose the local IP address.\r\n * 'disable_non_proxied_udp' = Use TCP unless proxy server supports UDP. This doesn't expose the local IP address.\r\n\r\nExample value: default","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_webrtclocalhostiphandling_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_webrtclocalhostiphandling_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_webrtclocalhostiphandling_webrtclocalhostiphandling","displayName":"Restrict exposure of localhost IP address by WebRTC (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_webrtclocalhostiphandling_webrtclocalhostiphandling_default","displayName":"Allow all interfaces. This exposes the local IP address","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_webrtclocalhostiphandling_webrtclocalhostiphandling_default_public_and_private_interfaces","displayName":"Allow public and private interfaces over http default route. This exposes the local IP address","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_webrtclocalhostiphandling_webrtclocalhostiphandling_default_public_interface_only","displayName":"Allow public interface over http default route. This doesn't expose the local IP address","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_webrtclocalhostiphandling_webrtclocalhostiphandling_disable_non_proxied_udp","displayName":"Use TCP unless proxy server supports UDP. This doesn't expose the local IP address","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_webrtcudpportrange","displayName":"Restrict the range of local UDP ports used by WebRTC (User)","description":"Restricts the UDP port range used by WebRTC to a specified port interval (endpoints included).\r\n\r\nBy configuring this policy, you specify the range of local UDP ports that WebRTC can use.\r\n\r\nIf you don't configure this policy, or if you set it to an empty string or invalid port range, WebRTC can use any available local UDP port.\r\n\r\nExample value: 10000-11999","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_webrtcudpportrange_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_webrtcudpportrange_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_webrtcudpportrange_webrtcudpportrange","displayName":"Restrict the range of local UDP ports used by WebRTC (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_wpadquickcheckenabled","displayName":"Set WPAD optimization (User)","description":"Allows you to turn off WPAD (Web Proxy Auto-Discovery) optimization in Microsoft Edge.\r\n\r\nIf you disable this policy, WPAD optimization is disabled, which makes the browser wait longer for DNS-based WPAD servers.\r\n\r\nIf you enable or don't configure the policy, WPAD optimization is enabled.\r\n\r\nIndependent of whether or how this policy is enabled, the WPAD optimization setting cannot be changed by users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_wpadquickcheckenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge_wpadquickcheckenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_autoselectcertificateforurls","displayName":"Automatically select client certificates for these sites (User)","description":"Specify a list of sites, based on URL patterns, for which Microsoft Edge should automatically select a client certificate, if the site requests one.\r\n\r\nThe value must be an array of stringified JSON dictionaries. Each dictionary must have the form { \"pattern\": \"$URL_PATTERN\", \"filter\" : $FILTER }, where $URL_PATTERN is a content setting pattern. $FILTER restricts from which client certificates the browser will automatically select. Independent of the filter, only certificates will be selected that match the server's certificate request. For example, if $FILTER has the form { \"ISSUER\": { \"CN\": \"$ISSUER_CN\" } }, additionally only client certificates are selected that are issued by a certificate with the CommonName $ISSUER_CN. If $FILTER contains an \"ISSUER\" and a \"SUBJECT\" section, a client certificate must satisfy both conditions to be selected. If $FILTER specifies an organization (\"O\"), a certificate must have at least one organization which matches the specified value to be selected. If $FILTER specifies an organization unit (\"OU\"), a certificate must have at least one organization unit which matches the specified value to be selected. If $FILTER is the empty dictionary {}, the selection of client certificates is not additionally restricted.\r\n\r\nIf you don't configure this policy, auto-selection isn't done for any site.\r\n\r\nExample value:\r\n\r\n{\"pattern\":\"https://www.contoso.com\",\"filter\":{\"ISSUER\":{\"CN\":\"certificate issuer name\", \"L\": \"certificate issuer location\", \"O\": \"certificate issuer org\", \"OU\": \"certificate issuer org unit\"}, \"SUBJECT\":{\"CN\":\"certificate subject name\", \"L\": \"certificate subject location\", \"O\": \"certificate subject org\", \"OU\": \"certificate subject org unit\"}}}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_autoselectcertificateforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_autoselectcertificateforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_autoselectcertificateforurls_autoselectcertificateforurlsdesc","displayName":"Automatically select client certificates for these sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_cookiesallowedforurls","displayName":"Allow cookies on specific sites (User)","description":"Define a list of sites, based on URL patterns, that are allowed to set cookies.\r\n\r\nIf you don't configure this policy, the global default value from the 'DefaultCookiesSetting' (Configure cookies) policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nSee the 'CookiesBlockedForUrls' (Block cookies on specific sites) and 'CookiesSessionOnlyForUrls' (Limit cookies from specific websites to the current session) policies for more information.\r\n\r\nNote there cannot be conflicting URL patterns set between these three policies:\r\n\r\n- 'CookiesBlockedForUrls'\r\n\r\n- CookiesAllowedForUrls\r\n\r\n- 'CookiesSessionOnlyForUrls'\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_cookiesallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_cookiesallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_cookiesallowedforurls_cookiesallowedforurlsdesc","displayName":"Allow cookies on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_cookiesblockedforurls","displayName":"Block cookies on specific sites (User)","description":"Define a list of sites, based on URL patterns, that can't set cookies.\r\n\r\nIf you don't configure this policy, the global default value from the 'DefaultCookiesSetting' (Configure cookies) policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nSee the 'CookiesAllowedForUrls' (Allow cookies on specific sites) and 'CookiesSessionOnlyForUrls' (Limit cookies from specific websites to the current session) policies for more information.\r\n\r\nNote there cannot be conflicting URL patterns set between these three policies:\r\n\r\n- CookiesBlockedForUrls\r\n\r\n- 'CookiesAllowedForUrls'\r\n\r\n- 'CookiesSessionOnlyForUrls'\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_cookiesblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_cookiesblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_cookiesblockedforurls_cookiesblockedforurlsdesc","displayName":"Block cookies on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_cookiessessiononlyforurls","displayName":"Limit cookies from specific websites to the current session (User)","description":"Cookies created by websites that match a URL pattern you define are deleted when the session ends (when the window closes).\r\n\r\nCookies created by websites that don't match the pattern are controlled by the 'DefaultCookiesSetting' (Configure cookies) policy (if set) or by the user's personal configuration. This is also the default behavior if you don't configure this policy.\r\n\r\nIf Microsoft Edge is running in background mode, the session might not close when the last window is closed, meaning the cookies won't be cleared when the window closes. See the 'BackgroundModeEnabled' (Continue running background apps after Microsoft Edge closes) policy for information about configuring what happens when Microsoft Edge runs in background mode.\r\n\r\nYou can also use the 'CookiesAllowedForUrls' (Allow cookies on specific sites) and 'CookiesBlockedForUrls' (Block cookies on specific sites) policies to control which websites can create cookies.\r\n\r\nNote there cannot be conflicting URL patterns set between these three policies:\r\n\r\n- 'CookiesBlockedForUrls'\r\n\r\n- 'CookiesAllowedForUrls'\r\n\r\n- CookiesSessionOnlyForUrls\r\n\r\nIf you set the 'RestoreOnStartup' (Action to take on startup) policy to restore URLs from previous sessions, this policy is ignored, and cookies are stored permanently for those sites.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_cookiessessiononlyforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_cookiessessiononlyforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_cookiessessiononlyforurls_cookiessessiononlyforurlsdesc","displayName":"Limit cookies from specific websites to the current session (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultcookiessetting","displayName":"Configure cookies (User)","description":"Control whether websites can create cookies on the user's device. This policy is all or nothing - you can let all websites create cookies, or no websites create cookies. You can't use this policy to enable cookies from specific websites.\r\n\r\nSet the policy to 'SessionOnly' (4) to clear cookies when the session closes. If Microsoft Edge is running in background mode, the session might not close when the last window is closed, meaning the cookies won't be cleared when the window closes. See 'BackgroundModeEnabled' (Continue running background apps after Microsoft Edge closes) policy for information about configuring what happens when Microsoft Edge runs in background mode.\r\n\r\nIf you don't configure this policy, the default 'AllowCookies' (1) is used, and users can change this setting in Microsoft Edge Settings. (If you don't want users to be able to change this setting, set the policy.)\r\n\r\n* 1 = Let all sites create cookies\r\n\r\n* 2 = Don't let any site create cookies\r\n\r\n* 4 = Keep cookies for the duration of the session","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultcookiessetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultcookiessetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultcookiessetting_defaultcookiessetting","displayName":"Configure cookies (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultcookiessetting_defaultcookiessetting_1","displayName":"Let all sites create cookies","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultcookiessetting_defaultcookiessetting_2","displayName":"Don't let any site create cookies","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultcookiessetting_defaultcookiessetting_4","displayName":"Keep cookies for the duration of the session","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultgeolocationsetting","displayName":"Default geolocation setting (User)","description":"Set whether websites can track users' physical locations. You can allow tracking by default (1), deny it by default (2), or ask the user each time a website requests their location (3).\r\n\r\nIf you don't configure this policy, 'AskGeolocation' policy is used and the user can change it.\r\n\r\n* 1 = Allow sites to track users' physical location\r\n\r\n* 2 = Don't allow any site to track users' physical location\r\n\r\n* 3 = Ask whenever a site wants to track users' physical location","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultgeolocationsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultgeolocationsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultgeolocationsetting_defaultgeolocationsetting","displayName":"Default geolocation setting (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultgeolocationsetting_defaultgeolocationsetting_1","displayName":"Allow sites to track users' physical location","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultgeolocationsetting_defaultgeolocationsetting_2","displayName":"Don't allow any site to track users' physical location","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultgeolocationsetting_defaultgeolocationsetting_3","displayName":"Ask whenever a site wants to track users' physical location","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultimagessetting","displayName":"Default images setting (User)","description":"Set whether websites can display images. You can allow images on all sites (1) or block them on all sites (2).\r\n\r\nIf you don't configure this policy, images are allowed by default, and the user can change this setting.\r\n\r\n* 1 = Allow all sites to show all images\r\n\r\n* 2 = Don't allow any site to show images","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultimagessetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultimagessetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultimagessetting_defaultimagessetting","displayName":"Default images setting (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultimagessetting_defaultimagessetting_1","displayName":"Allow all sites to show all images","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultimagessetting_defaultimagessetting_2","displayName":"Don't allow any site to show images","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultjavascriptsetting","displayName":"Default JavaScript setting (User)","description":"Set whether websites can run JavaScript. You can allow it for all sites (1) or block it for all sites (2).\r\n\r\nIf you don't configure this policy, all sites can run JavaScript by default, and the user can change this setting.\r\n\r\n* 1 = Allow all sites to run JavaScript\r\n\r\n* 2 = Don't allow any site to run JavaScript","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultjavascriptsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultjavascriptsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultjavascriptsetting_defaultjavascriptsetting","displayName":"Default JavaScript setting (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultjavascriptsetting_defaultjavascriptsetting_1","displayName":"Allow all sites to run JavaScript","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultjavascriptsetting_defaultjavascriptsetting_2","displayName":"Don't allow any site to run JavaScript","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultnotificationssetting","displayName":"Default notification setting (User)","description":"Set whether websites can display desktop notifications. You can allow them by default (1), deny them by default (2), or have the user be asked each time a website wants to show a notification (3).\r\n\r\nIf you don't configure this policy, notifications are allowed by default, and the user can change this setting.\r\n\r\n* 1 = Allow sites to show desktop notifications\r\n\r\n* 2 = Don't allow any site to show desktop notifications\r\n\r\n* 3 = Ask every time a site wants to show desktop notifications","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultnotificationssetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultnotificationssetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultnotificationssetting_defaultnotificationssetting","displayName":"Default notification setting (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultnotificationssetting_defaultnotificationssetting_1","displayName":"Allow sites to show desktop notifications","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultnotificationssetting_defaultnotificationssetting_2","displayName":"Don't allow any site to show desktop notifications","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultnotificationssetting_defaultnotificationssetting_3","displayName":"Ask every time a site wants to show desktop notifications","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultpluginssetting","displayName":"Default Adobe Flash setting (User)","description":"Determines whether websites that aren't covered by 'PluginsAllowedForUrls' (Allow the Adobe Flash plug-in on specific sites) or 'PluginsBlockedForUrls' (Block the Adobe Flash plug-in on specific sites) can automatically run the Adobe Flash plug-in. You can select 'BlockPlugins' (2) to block Adobe Flash on all sites, or you can select 'ClickToPlay' (3) to let Adobe Flash run but require the user to click the placeholder to start it. In any case, the 'PluginsAllowedForUrls' and 'PluginsBlockedForUrls' policies take precedence over 'DefaultPluginsSetting'.\r\n\r\nAutomatic playback is only allowed for domains explicitly listed in the 'PluginsAllowedForUrls' policy. If you want to enable automatic playback for all sites, consider adding http://* and https://* to this list.\r\n\r\nIf you don't configure this policy, the user can change this setting manually.\r\n\r\n* 2 = Block the Adobe Flash plug-in\r\n\r\n* 3 = Click to play\r\n\r\nThe former '1' option set allow-all, but this functionality is now only handled by the 'PluginsAllowedForUrls' policy. Existing policies using '1' will operate in Click-to-play mode.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultpluginssetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultpluginssetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultpluginssetting_defaultpluginssetting","displayName":"Default Adobe Flash setting (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultpluginssetting_defaultpluginssetting_2","displayName":"Block the Adobe Flash plugin","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultpluginssetting_defaultpluginssetting_3","displayName":"Click to play","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultpopupssetting","displayName":"Default pop-up window setting (User)","description":"Set whether websites can show pop-up windows. You can allow them on all websites (1) or block them on all sites (2).\r\n\r\nIf you don't configure this policy, pop-up windows are blocked by default, and users can change this setting.\r\n\r\n* 1 = Allow all sites to show pop-ups\r\n\r\n* 2 = Don't allow any site to show pop-up windows","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultpopupssetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultpopupssetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultpopupssetting_defaultpopupssetting","displayName":"Default pop-up window setting (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultpopupssetting_defaultpopupssetting_1","displayName":"Allow all sites to show pop-ups","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultpopupssetting_defaultpopupssetting_2","displayName":"Do not allow any site to show popups","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultwebbluetoothguardsetting","displayName":"Control use of the Web Bluetooth API (User)","description":"Control whether websites can access nearby Bluetooth devices. You can completely block access or require the site to ask the user each time it wants to access a Bluetooth device.\r\n\r\nIf you don't configure this policy, the default value (3, meaning users are asked each time) is used and users can change it.\r\n\r\n* 2 = Don't allow any site to request access to Bluetooth devices by using the Web Bluetooth API\r\n\r\n* 3 = Allow sites to ask the user to grant access to a nearby Bluetooth device","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultwebbluetoothguardsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultwebbluetoothguardsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultwebbluetoothguardsetting_defaultwebbluetoothguardsetting","displayName":"Control use of the Web Bluetooth API (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultwebbluetoothguardsetting_defaultwebbluetoothguardsetting_2","displayName":"Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultwebbluetoothguardsetting_defaultwebbluetoothguardsetting_3","displayName":"Allow sites to ask the user to grant access to a nearby Bluetooth device","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultwebusbguardsetting","displayName":"Control use of the WebUSB API (User)","description":"Set whether websites can access connected USB devices. You can completely block access or ask the user each time a website wants to get access to connected USB devices.\r\n\r\nYou can override this policy for specific URL patterns by using the 'WebUsbAskForUrls' (Allow WebUSB on specific sites) and 'WebUsbBlockedForUrls' (Block WebUSB on specific sites) policies.\r\n\r\nIf you don't configure this policy, sites can ask users whether they can access the connected USB devices (3) by default, and users can change this setting.\r\n\r\n* 2 = Don't allow any site to request access to USB devices via the WebUSB API\r\n\r\n* 3 = Allow sites to ask the user to grant access to a connected USB device","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultwebusbguardsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultwebusbguardsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultwebusbguardsetting_defaultwebusbguardsetting","displayName":"Control use of the WebUSB API (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultwebusbguardsetting_defaultwebusbguardsetting_2","displayName":"Do not allow any site to request access to USB devices via the WebUSB API","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_defaultwebusbguardsetting_defaultwebusbguardsetting_3","displayName":"Allow sites to ask the user to grant access to a connected USB device","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_imagesallowedforurls","displayName":"Allow images on these sites (User)","description":"Define a list of sites, based on URL patterns, that can display images.\r\n\r\nIf you don't configure this policy, the global default value is used for all sites either from the 'DefaultImagesSetting' (Default images setting) policy (if set) or the user's personal configuration.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_imagesallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_imagesallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_imagesallowedforurls_imagesallowedforurlsdesc","displayName":"Allow images on these sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_imagesblockedforurls","displayName":"Block images on specific sites (User)","description":"Define a list of sites, based on URL patterns, that aren't allowed to display images.\r\n\r\nIf you don't configure this policy, the global default value from the 'DefaultImagesSetting' (Default images setting) policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_imagesblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_imagesblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_imagesblockedforurls_imagesblockedforurlsdesc","displayName":"Block images on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_javascriptallowedforurls","displayName":"Allow JavaScript on specific sites (User)","description":"Define a list of sites, based on URL patterns, that are allowed to run JavaScript.\r\n\r\nIf you don't configure this policy, the global default value from the 'DefaultJavaScriptSetting' (Default JavaScript setting) policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_javascriptallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_javascriptallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_javascriptallowedforurls_javascriptallowedforurlsdesc","displayName":"Allow JavaScript on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_javascriptblockedforurls","displayName":"Block JavaScript on specific sites (User)","description":"Define a list of sites, based on URL patterns, that aren't allowed to run JavaScript.\r\n\r\nIf you don't configure this policy, the global default value from the 'DefaultJavaScriptSetting' (Default JavaScript setting) policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_javascriptblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_javascriptblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_javascriptblockedforurls_javascriptblockedforurlsdesc","displayName":"Block JavaScript on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_notificationsallowedforurls","displayName":"Allow notifications on specific sites (User)","description":"Define a list of sites, based on URL patterns, that can display notifications.\r\n\r\nIf you don't configure this policy, the global default value from the 'DefaultNotificationsSetting' (Default notification setting) policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_notificationsallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_notificationsallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_notificationsallowedforurls_notificationsallowedforurlsdesc","displayName":"Allow notifications on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_notificationsblockedforurls","displayName":"Block notifications on specific sites (User)","description":"Define a list of sites, based on URL patterns, that are blocked from displaying notifications.\r\n\r\nIf you don't configure this policy, the global default value from the 'DefaultNotificationsSetting' (Default notification setting) policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_notificationsblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_notificationsblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_notificationsblockedforurls_notificationsblockedforurlsdesc","displayName":"Block notifications on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_pluginsallowedforurls","displayName":"Allow the Adobe Flash plug-in on specific sites (User)","description":"Define a list of sites, based on URL patterns, that can run the Adobe Flash plug-in.\r\n\r\nIf you don't configure this policy, the global default value from the 'DefaultPluginsSetting' (Default Adobe Flash setting) policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_pluginsallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_pluginsallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_pluginsallowedforurls_pluginsallowedforurlsdesc","displayName":"Allow the Adobe Flash plug-in on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_pluginsblockedforurls","displayName":"Block the Adobe Flash plug-in on specific sites (User)","description":"Define a list of sites, based on URL patterns, that are blocked from running Adobe Flash.\r\n\r\nIf you don't configure this policy, the global default value from the 'DefaultPluginsSetting' (Default Adobe Flash setting) policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_pluginsblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_pluginsblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_pluginsblockedforurls_pluginsblockedforurlsdesc","displayName":"Block the Adobe Flash plug-in on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_popupsallowedforurls","displayName":"Allow pop-up windows on specific sites (User)","description":"Define a list of sites, based on URL patterns, that can open pop-up windows.\r\n\r\nIf you don't configure this policy, the global default value from the 'DefaultPopupsSetting' (Default pop-up window setting) policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_popupsallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_popupsallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_popupsallowedforurls_popupsallowedforurlsdesc","displayName":"Allow pop-up windows on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_popupsblockedforurls","displayName":"Block pop-up windows on specific sites (User)","description":"Define a list of sites, based on URL patterns, that are blocked from opening pop-up windows.\r\n\r\nIf you don't configure this policy, the global default value from the 'DefaultPopupsSetting' (Default pop-up window setting) policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_popupsblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_popupsblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_popupsblockedforurls_popupsblockedforurlsdesc","displayName":"Block pop-up windows on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_webusballowdevicesforurls","displayName":"Grant access to specific sites to connect to specific USB devices (User)","description":"Allows you to set a list of urls that specify which sites will automatically be granted permission to access a USB device with the given vendor and product IDs. Each item in the list must contain both devices and urls in order for the policy to be valid. Each item in devices can contain a vendor ID and product ID field. Any ID that is omitted is treated as a wildcard with one exception, and that exception is that a product ID cannot be specified without a vendor ID also being specified. Otherwise, the policy will not be valid and will be ignored.\r\n\r\nThe USB permission model uses the URL of the requesting site (\"requesting URL\") and the URL of the top-level frame site (\"embedding URL\") to grant permission to the requesting URL to access the USB device. The requesting URL may be different than the embedding URL when the requesting site is loaded in an iframe. Therefore, the \"urls\" field can contain up to two URL strings delimited by a comma to specify the requesting and embedding URL respectively. If only one URL is specified, then access to the corresponding USB devices will be granted when the requesting site's URL matches this URL regardless of embedding status. The URLs in \"urls\" must be valid URLs, otherwise the policy will be ignored.\r\n\r\nIf this policy is left not set, the global default value will be used for all sites either from the 'DefaultWebUsbGuardSetting' (Control use of the WebUSB API) policy if it is set, or the user's personal configuration otherwise.\r\n\r\nURL patterns in this policy should not clash with the ones configured via 'WebUsbBlockedForUrls' (Block WebUSB on specific sites). If there is a clash, this policy will take precedence over 'WebUsbBlockedForUrls' and 'WebUsbAskForUrls' (Allow WebUSB on specific sites).\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"urls\": [\r\n \"https://contoso.com\", \r\n \"https://fabrikam.com\"\r\n ], \r\n \"devices\": [\r\n {\r\n \"vendor_id\": 1234, \r\n \"product_id\": 5678\r\n }\r\n ]\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_webusballowdevicesforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_webusballowdevicesforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_webusballowdevicesforurls_webusballowdevicesforurls","displayName":"Grant access to specific sites to connect to specific USB devices (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_webusbaskforurls","displayName":"Allow WebUSB on specific sites (User)","description":"Define a list of sites, based on URL patterns, that can ask the user for access to a USB device.\r\n\r\nIf you don't configure this policy, the global default value from the 'DefaultWebUsbGuardSetting' (Control use of the WebUSB API) policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nThe URL patterns defined in this policy can't conflict with those configured in the 'WebUsbBlockedForUrls' (Block WebUSB on specific sites) policy - you can't both allow and block a URL.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_webusbaskforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_webusbaskforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_webusbaskforurls_webusbaskforurlsdesc","displayName":"Allow WebUSB on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_webusbblockedforurls","displayName":"Block WebUSB on specific sites (User)","description":"Define a list of sites, based on URL patterns, that can't ask the user to grant them access to a USB device.\r\n\r\nIf you don't configure this policy, the global default value from the 'DefaultWebUsbGuardSetting' (Control use of the WebUSB API) policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nURL patterns in this policy can't conflict with those configured in the 'WebUsbAskForUrls' (Allow WebUSB on specific sites) policy. You can't both allow and block a URL.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_webusbblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_webusbblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~contentsettings_webusbblockedforurls_webusbblockedforurlsdesc","displayName":"Block WebUSB on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderenabled","displayName":"Enable the default search provider (User)","description":"Enables the ability to use a default search provider.\r\n\r\nIf you enable this policy, a user can search for a term by typing in the address bar (as long as what they type isn't a URL).\r\n\r\nYou can specify the default search provider to use by enabling the rest of the default search policies. If these are left empty (not configured) or configured incorrectly, the user can choose the default provider.\r\n\r\nIf you disable this policy, the user can't search from the address bar.\r\n\r\nIf you enable or disable this policy, users can't change or override it.\r\n\r\nIf you don't configure this policy, the default search provider is enabled, and the user can choose the default search provider and set the search provider list.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances that are enrolled for device management.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderencodings","displayName":"Default search provider encodings (User)","description":"Specify the character encodings supported by the search provider. Encodings are code page names like UTF-8, GB2312, and ISO-8859-1. They are tried in the order provided.\r\n\r\nThis policy is optional. If not configured, the default, UTF-8, is used.\r\n\r\nThis policy is applied only if you enable the 'DefaultSearchProviderEnabled' (Enable the default search provider) and 'DefaultSearchProviderSearchURL' (Default search provider search URL) policies.\r\n\r\nExample value:\r\n\r\nUTF-8\r\nUTF-16\r\nGB2312\r\nISO-8859-1","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderencodings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderencodings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderencodings_defaultsearchproviderencodingsdesc","displayName":"Default search provider encodings (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderimageurl","displayName":"Specifies the search-by-image feature for the default search provider (User)","description":"Specifies the URL to the search engine used for image search. Search requests are sent using the GET method.\r\n\r\nThis policy is optional. If you don't configure it, image search isn't available.\r\n\r\nSpecify Bing's Image Search URL as:\r\n'{bing:baseURL}images/detail/search?iss=sbiupload&FORM=ANCMS1#enterInsights'.\r\n\r\nSpecify Google's Image Search URL as: '{google:baseURL}searchbyimage/upload'.\r\n\r\nSee 'DefaultSearchProviderImageURLPostParams' (Parameters for an image URL that uses POST) policy to finish configuring image search.\r\n\r\nThis policy is applied only if you enable the 'DefaultSearchProviderEnabled' (Enable the default search provider) and 'DefaultSearchProviderSearchURL' (Default search provider search URL) policies.\r\n\r\nExample value: https://search.contoso.com/searchbyimage/upload","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderimageurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderimageurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderimageurl_defaultsearchproviderimageurl","displayName":"Specifies the search-by-image feature for the default search provider (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderimageurlpostparams","displayName":"Parameters for an image URL that uses POST (User)","description":"If you enable this policy, it specifies the parameters used when an image search that uses POST is performed. The policy consists of comma-separated name/value pairs. If a value is a template parameter, like {imageThumbnail} in the preceding example, it’s replaced with real image thumbnail data. This policy is applied only if you enable the 'DefaultSearchProviderEnabled' (Enable the default search provider) and 'DefaultSearchProviderSearchURL' (Default search provider search URL) policies.\r\n\r\nSpecify Bing's Image Search URL Post Params as:\r\n'imageBin={google:imageThumbnailBase64}'.\r\n\r\nSpecify Google's Image Search URL Post Params as:\r\n'encoded_image={google:imageThumbnail},image_url={google:imageURL},sbisrc={google:imageSearchSource},original_width={google:imageOriginalWidth},original_height={google:imageOriginalHeight}'.\r\n\r\nIf you don’t set this policy, image search requests are sent using the GET method.\r\n\r\nExample value: content={imageThumbnail},url={imageURL},sbisrc={SearchSource}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderimageurlpostparams_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderimageurlpostparams_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderimageurlpostparams_defaultsearchproviderimageurlpostparams","displayName":"Parameters for an image URL that uses POST (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderkeyword","displayName":"Default search provider keyword (User)","description":"Specifies the keyword, which is the shortcut used in the Address Bar to trigger the search for this provider.\r\n\r\nThis policy is optional. If you don't configure it, no keyword activates the search provider.\r\n\r\nThis policy is applied only if you enable the 'DefaultSearchProviderEnabled' (Enable the default search provider) and 'DefaultSearchProviderSearchURL' (Default search provider search URL) policies.\r\n\r\nExample value: mis","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderkeyword_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderkeyword_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchproviderkeyword_defaultsearchproviderkeyword","displayName":"Default search provider keyword (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchprovidername","displayName":"Default search provider name (User)","description":"Specifies the name of the default search provider.\r\n\r\nIf you enable this policy, you set the name of the default search provider.\r\n\r\nIf you don't enable this policy or if you leave it empty, the host name specified by the search URL is used.\r\n\r\n'DefaultSearchProviderName' should be set to an organization-approved encrypted search provider that corresponds to the encrypted search provider set in DTBC-0008. This policy is applied only if you enable the 'DefaultSearchProviderEnabled' (Enable the default search provider) and 'DefaultSearchProviderSearchURL' (Default search provider search URL) policies.\r\n\r\nExample value: My Intranet Search","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchprovidername_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchprovidername_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchprovidername_defaultsearchprovidername","displayName":"Default search provider name (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchprovidersearchurl","displayName":"Default search provider search URL (User)","description":"Specifies the URL of the search engine used for a default search. The URL contains the string '{searchTerms}', which is replaced at query time by the terms the user is searching for.\r\n\r\nSpecify Bing's search URL as:\r\n\r\n'{bing:baseURL}search?q={searchTerms}'.\r\n\r\nSpecify Google's search URL as: '{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}ie={inputEncoding}'.\r\n\r\nThis policy is required when you enable the 'DefaultSearchProviderEnabled' (Enable the default search provider) policy; if you don't enable the latter policy, this policy is ignored.\r\n\r\nExample value: https://search.contoso.com/search?q={searchTerms}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchprovidersearchurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchprovidersearchurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchprovidersearchurl_defaultsearchprovidersearchurl","displayName":"Default search provider search URL (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchprovidersuggesturl","displayName":"Default search provider URL for suggestions (User)","description":"Specifies the URL for the search engine used to provide search suggestions. The URL contains the string '{searchTerms}', which is replaced at query time by the text the user has entered so far.\r\n\r\nThis policy is optional. If you don't configure it, users won't see search suggestions; they will see suggestions from their browsing history and favorites.\r\n\r\nBing's suggest URL can be specified as:\r\n\r\n'{bing:baseURL}qbox?query={searchTerms}'.\r\n\r\nGoogle's suggest URL can be specified as: '{google:baseURL}complete/search?output=chrome&q={searchTerms}'.\r\n\r\nThis policy is applied only if you enable the 'DefaultSearchProviderEnabled' (Enable the default search provider) and 'DefaultSearchProviderSearchURL' (Default search provider search URL) policies.\r\n\r\nExample value: https://search.contoso.com/suggest?q={searchTerms}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchprovidersuggesturl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchprovidersuggesturl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~defaultsearchprovider_defaultsearchprovidersuggesturl_defaultsearchprovidersuggesturl","displayName":"Default search provider URL for suggestions (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensionallowedtypes","displayName":"Configure allowed extension types (User)","description":"Controls which extension types can be installed and limits runtime access.\r\n\r\nThis setting defines the allowed types of extensions and which hosts they can interact with. The value is a list of strings, each of which should be one of the following: \"extension\", \"theme\", \"user_script\", and \"hosted_app\". See the Microsoft Edge extensions documentation for more information on these types.\r\n\r\nNote that this policy also affects extensions to be force-installed by using 'ExtensionInstallForcelist' (Control which extensions are installed silently) policy.\r\n\r\nIf you enable this policy, only extensions that match a type in the list are installed.\r\n\r\nIf you don't configure this policy, no restrictions on the acceptable extension types are enforced.\r\n\r\nExample value:\r\n\r\nhosted_app","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensionallowedtypes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensionallowedtypes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensionallowedtypes_extensionallowedtypesdesc","displayName":"Types of extensions/apps that are allowed to be installed (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensioninstallallowlist","displayName":"Allow specific extensions to be installed (User)","description":"By default, all extensions are allowed. However, if you block all extensions by setting the 'ExtensionInstallBlockList' policy to \"*,\" users can only install extensions defined in this policy.\r\n\r\nExample value:\r\n\r\nextension_id1\r\nextension_id2","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensioninstallallowlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensioninstallallowlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensioninstallallowlist_extensioninstallallowlistdesc","displayName":"Extension IDs to exempt from the block list (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensioninstallblocklist","displayName":"Control which extensions cannot be installed (User)","description":"List specific extensions that users can NOT install in Microsoft Edge. When you deploy this policy, any extensions on this list that were previously installed will be disabled, and the user won't be able to enable them. If you remove an item from the list of blocked extensions, that extension is automatically re-enabled anywhere it was previously installed.\r\n\r\nUse \"*\" to block all extensions that aren't explicitly listed in the allow list.\r\n\r\nIf you don't configure this policy, users can install any extension in Microsoft Edge.\r\n\r\nExample value:\r\n\r\nextension_id1\r\nextension_id2","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensioninstallblocklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensioninstallblocklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensioninstallblocklist_extensioninstallblocklistdesc","displayName":"Extension IDs the user should be prevented from installing (or * for all) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensioninstallforcelist","displayName":"Control which extensions are installed silently (User)","description":"Specifies extensions that are installed silently, without user interaction, and that the users can't uninstall or disable (\"force-installed\"). All permissions requested by the extensions are granted implicitly, without user interaction, including any additional permissions requested by future versions of the extension. Furthermore, permissions are granted for the enterprise.deviceAttributes and enterprise.platformKeys extension APIs. (These two APIs are only available to extensions that are force-installed.)\r\n\r\nThis policy takes precedence over a potentially conflicting 'ExtensionInstallBlocklist' (Control which extensions cannot be installed) policy. When you take an extension off of the force-installed list it's automatically uninstalled by Microsoft Edge.\r\n\r\nFor Windows devices that aren't joined to a Microsoft Active Directory domain, forced installation is limited to extensions available in the Microsoft Store.\r\n\r\nNote that users can modify the source code of any extension by using Developer Tools, potentially rendering the extension dysfunctional. If this is a concern, set the 'DeveloperToolsAvailability' (Control where developer tools can be used) policy.\r\n\r\nUse the following format to add an extension to the list:\r\n\r\n[extensionID];[updateURL]\r\n\r\n- extensionID - the 32-letter string found on edge://extensions when in developer mode.\r\n\r\n- updateURL (optional) is the address of the Update Manifest XML document for the app or extension, as described at https://go.microsoft.com/fwlink/?linkid=2095043. If you don't set the updateURL, the Microsoft Store update URL is used (currently https://edge.microsoft.com/extensionwebstorebase/v1/crx). Note that the update URL set in this policy is only used for the initial installation; subsequent updates of the extension use the update URL indicated in the extension's manifest.\r\n\r\nFor example, gggmmkjegpiggikcnhidnjjhmicpibll;https://edge.microsoft.com/extensionwebstorebase/v1/crx installs the Microsoft Online app from the Microsoft Store \"update\" URL. For more information about hosting extensions, see: https://go.microsoft.com/fwlink/?linkid=2095044.\r\n\r\nIf you don't configure this policy, no extensions are installed automatically, and users can uninstall any extension in Microsoft Edge.\r\n\r\nNote that this policy doesn't apply to InPrivate mode.\r\n\r\nExample value:\r\n\r\ngbchcmhmhahfdphkhkmpfmihenigjmpp;https://edge.microsoft.com/extensionwebstorebase/v1/crx\r\nabcdefghijklmnopabcdefghijklmnop","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensioninstallforcelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensioninstallforcelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensioninstallforcelist_extensioninstallforcelistdesc","displayName":"Extension/App IDs and update URLs to be silently installed (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensioninstallsources","displayName":"Configure extension and user script install sources (User)","description":"Define URLs that can install extensions and themes.\r\n\r\nBy default, users have to download a *.crx file for each extension or script they want to install, and then drag it onto the Microsoft Edge settings page. This policy lets specific URLs use install the extension or script for the user.\r\n\r\nEach item in this list is an extension-style match pattern (see https://go.microsoft.com/fwlink/?linkid=2095039). Users can easily install items from any URL that matches an item in this list. Both the location of the *.crx file and the page where the download is started from (in other words, the referrer) must be allowed by these patterns.\r\n\r\nThe 'ExtensionInstallBlocklist' (Control which extensions cannot be installed) policy takes precedence over this policy. Any extensions that's on the block list won't be installed, even if it comes from a site on this list.\r\n\r\nExample value:\r\n\r\nhttps://corp.contoso.com/*","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensioninstallsources_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensioninstallsources_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensioninstallsources_extensioninstallsourcesdesc","displayName":"URL patterns to allow extension, app, and user script installs from (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensionsettings","displayName":"Configure extension management settings (User)","description":"Configures extension management settings for Microsoft Edge.\r\n\r\nThis policy controls multiple settings, including settings controlled by any existing extension-related policies. This policy overrides any legacy policies if both are set.\r\n\r\nThis policy maps an extension ID or an update URL to its configuration. With an extension ID, the configuration is applied only to the specified extension. Set a default configuration for the special ID \"*\", to apply to all extensions that aren't specifically listed in this policy. With an update URL, the configuration is applied to all extensions with the exact update URL stated in manifest of this extension, as described at https://go.microsoft.com/fwlink/?linkid=2095043.\r\n\r\nExample value:\r\n\r\n{\r\n \"abcdefghijklmnopabcdefghijklmnop\": {\r\n \"blocked_permissions\": [\r\n \"history\"\r\n ], \r\n \"installation_mode\": \"allowed\", \r\n \"minimum_version_required\": \"1.0.1\"\r\n }, \r\n \"bcdefghijklmnopabcdefghijklmnopa\": {\r\n \"runtime_blocked_hosts\": [\r\n \"*://*.contoso.com\"\r\n ], \r\n \"allowed_permissions\": [\r\n \"downloads\"\r\n ], \r\n \"update_url\": \"https://contoso.com/update_url\", \r\n \"runtime_allowed_hosts\": [\r\n \"*://good.contoso.com\"\r\n ], \r\n \"installation_mode\": \"force_installed\"\r\n }, \r\n \"cdefghijklmnopabcdefghijklmnopab\": {\r\n \"blocked_install_message\": \"Custom error message.\", \r\n \"installation_mode\": \"blocked\"\r\n }, \r\n \"*\": {\r\n \"blocked_permissions\": [\r\n \"downloads\", \r\n \"bookmarks\"\r\n ], \r\n \"installation_mode\": \"blocked\", \r\n \"runtime_blocked_hosts\": [\r\n \"*://*.contoso.com\"\r\n ], \r\n \"blocked_install_message\": \"Custom error message.\", \r\n \"allowed_types\": [\r\n \"hosted_app\"\r\n ], \r\n \"runtime_allowed_hosts\": [\r\n \"*://good.contoso.com\"\r\n ], \r\n \"install_sources\": [\r\n \"https://company-intranet/apps\"\r\n ]\r\n }, \r\n \"defghijklmnopabcdefghijklmnopabc,efghijklmnopabcdefghijklmnopabcd\": {\r\n \"blocked_install_message\": \"Custom error message.\", \r\n \"installation_mode\": \"blocked\"\r\n }, \r\n \"fghijklmnopabcdefghijklmnopabcde\": {\r\n \"blocked_install_message\": \"Custom removal message.\", \r\n \"installation_mode\": \"removed\"\r\n }, \r\n \"update_url:https://www.contoso.com/update.xml\": {\r\n \"blocked_permissions\": [\r\n \"wallpaper\"\r\n ], \r\n \"allowed_permissions\": [\r\n \"downloads\"\r\n ], \r\n \"installation_mode\": \"allowed\"\r\n }\r\n}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensionsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensionsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~extensions_extensionsettings_extensionsettings","displayName":"Configure extension management settings (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~googlecast_enablemediarouter","displayName":"Enable Google Cast (User)","description":"Enable this policy to enable Google Cast. Users will be able to launch it from the app menu, page context menus, media controls on Cast-enabled websites, and (if shown) the Cast toolbar icon.\r\n\r\nDisable this policy to disable Google Cast.\r\n\r\nBy default, Google Cast is enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~googlecast_enablemediarouter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~googlecast_enablemediarouter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~googlecast_showcasticonintoolbar","displayName":"Show the cast icon in the toolbar (User)","description":"Set this policy to true to show the Cast toolbar icon on the toolbar or the overflow menu. Users won't be able to remove it.\r\n\r\nIf you don't configure this policy or if you disable it, users can pin or remove the icon by using its contextual menu.\r\n\r\nIf you've also set the 'EnableMediaRouter' (Enable Google Cast) policy to false, then this policy is ignored, and the toolbar icon isn't shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~googlecast_showcasticonintoolbar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~googlecast_showcasticonintoolbar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_allowcrossoriginauthprompt","displayName":"Allow cross-origin HTTP Basic Auth prompts (User)","description":"Controls whether third-party sub-content on a page can open an HTTP Basic Auth dialog box.\r\n\r\nTypically, this is disabled as a phishing defense. If you don't configure this policy, it's disabled and third-party sub-content can't open a HTTP Basic Auth dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_allowcrossoriginauthprompt_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_allowcrossoriginauthprompt_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_authnegotiatedelegateallowlist","displayName":"Specifies a list of servers that Microsoft Edge can delegate user credentials to (User)","description":"Configure the list of servers that Microsoft Edge can delegate to.\r\n\r\nSeparate multiple server names with commas. Wildcards (*) are allowed.\r\n\r\nIf you don't configure this policy Microsoft Edge won't delegate user credentials even if a server is detected as Intranet.\r\n\r\nExample value: contoso.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_authnegotiatedelegateallowlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_authnegotiatedelegateallowlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_authnegotiatedelegateallowlist_authnegotiatedelegateallowlist","displayName":"Specifies a list of servers that Microsoft Edge can delegate user credentials to (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_authschemes","displayName":"Supported authentication schemes (User)","description":"Specifies which HTTP authentication schemes are supported.\r\n\r\nYou can configure the policy by using these values: 'basic', 'digest', 'ntlm', and 'negotiate'. Separate multiple values with commas.\r\n\r\nIf you don't configure this policy, all four schemes are used.\r\n\r\nExample value: basic,digest,ntlm,negotiate","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_authschemes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_authschemes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_authschemes_authschemes","displayName":"Supported authentication schemes (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_authserverallowlist","displayName":"Configure list of allowed authentication servers (User)","description":"Specifies which servers to enable for integrated authentication. Integrated authentication is only enabled when Microsoft Edge receives an authentication challenge from a proxy or from a server in this list.\r\n\r\nSeparate multiple server names with commas. Wildcards (*) are allowed.\r\n\r\nIf you don't configure this policy, Microsoft Edge tries to detect if a server is on the intranet - only then will it respond to IWA requests. If the server is on the internet, IWA requests from it are ignored by Microsoft Edge.\r\n\r\nExample value: *contoso.com,contoso.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_authserverallowlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_authserverallowlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_authserverallowlist_authserverallowlist","displayName":"Configure list of allowed authentication servers (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_disableauthnegotiatecnamelookup","displayName":"Disable CNAME lookup when negotiating Kerberos authentication (User)","description":"Determines whether the generated Kerberos SPN is based on the canonical DNS name (CNAME) or on the original name entered.\r\n\r\nIf you enable this policy, CNAME lookup is skipped and the server name (as entered) is used.\r\n\r\nIf you disable this policy or don't configure it, the canonical name of the server is used. This is determined through CNAME lookup.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_disableauthnegotiatecnamelookup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_disableauthnegotiatecnamelookup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_enableauthnegotiateport","displayName":"Include non-standard port in Kerberos SPN (User)","description":"Specifies whether the generated Kerberos SPN should include a non-standard port.\r\n\r\nIf you enable this policy, and a user includes a non-standard port (a port other than 80 or 443) in a URL, that port is included in the generated Kerberos SPN.\r\n\r\nIf you don't configure or disable this policy, the generated Kerberos SPN won't include a port in any case.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_enableauthnegotiateport_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~httpauthentication_enableauthnegotiateport_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~nativemessaging_nativemessagingallowlist","displayName":"Control which native messaging hosts users can use (User)","description":"List specific native messaging hosts that users can use in Microsoft Edge.\r\n\r\nBy default, all native messaging hosts are allowed. If you set the 'NativeMessagingBlocklist' (Configure native messaging block list) policy to *, all native messaging hosts are blocked, and only native messaging hosts listed in here are loaded.\r\n\r\nExample value:\r\n\r\ncom.native.messaging.host.name1\r\ncom.native.messaging.host.name2","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~nativemessaging_nativemessagingallowlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~nativemessaging_nativemessagingallowlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~nativemessaging_nativemessagingallowlist_nativemessagingallowlistdesc","displayName":"Names of the native messaging hosts to exempt from the block list (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~nativemessaging_nativemessagingblocklist","displayName":"Configure native messaging block list (User)","description":"Specifies which native messaging hosts that shouldn't be used.\r\n\r\nUse '*' to block all native messaging hosts unless they are explicitly listed in the allow list.\r\n\r\nIf you don't configure this policy, Microsoft Edge will load all installed native messaging hosts.\r\n\r\nExample value:\r\n\r\ncom.native.messaging.host.name1\r\ncom.native.messaging.host.name2","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~nativemessaging_nativemessagingblocklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~nativemessaging_nativemessagingblocklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~nativemessaging_nativemessagingblocklist_nativemessagingblocklistdesc","displayName":"Names of the forbidden native messaging hosts (or * for all) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~nativemessaging_nativemessaginguserlevelhosts","displayName":"Allow user-level native messaging hosts (installed without admin permissions) (User)","description":"Enables user-level installation of native messaging hosts.\r\n\r\nIf you disable this policy, Microsoft Edge will only use native messaging hosts installed on the system level.\r\n\r\nBy default, if you don't configure this policy, Microsoft Edge will allow usage of user-level native messaging hosts.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~nativemessaging_nativemessaginguserlevelhosts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~nativemessaging_nativemessaginguserlevelhosts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~passwordmanager_passwordmanagerenabled","displayName":"Enable saving passwords to the password manager (User)","description":"Enable Microsoft Edge to save user passwords.\r\n\r\nIf you enable this policy, users can save their passwords in Microsoft Edge. The next time they visit the site, Microsoft Edge will enter the password automatically.\r\n\r\nIf you disable this policy, users can't save new passwords, but they can still use previously saved passwords.\r\n\r\nIf you enable or disable this policy, users can't change or override it in Microsoft Edge. If you don't configure it, users can save passwords, as well as turn this feature off.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~passwordmanager_passwordmanagerenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~passwordmanager_passwordmanagerenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~passwordmanager_passwordprotectionchangepasswordurl","displayName":"Configure the change password URL (User)","description":"Configures the change password URL (HTTP and HTTPS schemes only).\r\n\r\nPassword protection service will send users to this URL to change their password after seeing a warning in the browser.\r\n\r\nIf you enable this policy, then password protection service sends users to this URL to change their password.\r\n\r\nIf you disable this policy or don't configure it, then password protection service will not redirect users to a change password URL.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances that are enrolled for device management.\r\n\r\nExample value: https://contoso.com/change_password.html","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~passwordmanager_passwordprotectionchangepasswordurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~passwordmanager_passwordprotectionchangepasswordurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~passwordmanager_passwordprotectionchangepasswordurl_passwordprotectionchangepasswordurl","displayName":"Configure the change password URL (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~passwordmanager_passwordprotectionloginurls","displayName":"Configure the list of enterprise login URLs where password protection service should capture fingerprint of password (User)","description":"Configure the list of enterprise login URLs (HTTP and HTTPS schemes only) where Microsoft Edge should capture the fingerprint of passwords and use it for password reuse detection.\r\n\r\nIf you enable this policy, the password protection service captures fingerprints of passwords on the defined URLs.\r\n\r\nIf you disable this policy or don't configure it, no password fingerprints are captured.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances that are enrolled for device management.\r\n\r\nExample value:\r\n\r\nhttps://contoso.com/login.html\r\nhttps://login.contoso.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~passwordmanager_passwordprotectionloginurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~passwordmanager_passwordprotectionloginurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~passwordmanager_passwordprotectionloginurls_passwordprotectionloginurlsdesc","displayName":"Configure the list of enterprise login URLs where password protection service should capture fingerprint of password (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~passwordmanager_passwordprotectionwarningtrigger","displayName":"Configure password protection warning trigger (User)","description":"Allows you to control when to trigger password protection warning. Password protection alerts users when they reuse their protected password on potentially suspicious sites.\r\n\r\nYou can use the 'PasswordProtectionLoginURLs' (Configure the list of enterprise login URLs where password protection service should capture fingerprint of password) and 'PasswordProtectionChangePasswordURL' (Configure the change password URL) policies to configure which passwords to protect.\r\n\r\nExemptions: Passwords for the sites listed in 'PasswordProtectionLoginURLs' and 'PasswordProtectionChangePasswordURL', as well as for the sites listed in 'SmartScreenAllowListDomains' (Configure the list of domains for which Microsoft Defender SmartScreen won't trigger warnings), will not trigger a password-protection warning.\r\n\r\nSet to 'PasswordProtectionWarningOff' (0) to not show password protection warningss.\r\n\r\nSet to 'PasswordProtectionWarningOnPasswordReuse' (1) to show password protection warnings when the user reuses their protected password on a non-allowlisted site.\r\n\r\nIf you disable or don't configure this policy, then the warning trigger is not shown.\r\n\r\n* 0 = Password protection warning is off.\r\n\r\n* 1 = Password protection warning is triggered by password reuse.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~passwordmanager_passwordprotectionwarningtrigger_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~passwordmanager_passwordprotectionwarningtrigger_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~passwordmanager_passwordprotectionwarningtrigger_passwordprotectionwarningtrigger","displayName":"Configure password protection warning trigger (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~passwordmanager_passwordprotectionwarningtrigger_passwordprotectionwarningtrigger_0","displayName":"Password protection warning is off","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~passwordmanager_passwordprotectionwarningtrigger_passwordprotectionwarningtrigger_1","displayName":"Password protection warning is triggered by password reuse","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~printing_defaultprinterselection","displayName":"Default printer selection rules (User)","description":"Overrides Microsoft Edge default printer selection rules. This policy determines the rules for selecting the default printer in Microsoft Edge, which happens the first time a user tries to print a page.\r\n\r\nWhen this policy is set, Microsoft Edge tries to find a printer that matches all of the specified attributes and uses it as default printer. If there are multiple printers that meet the criteria, the first printer that matches is used.\r\n\r\nIf you don't configure this policy or no matching printers are found within the timeout, the printer defaults to the built-in PDF printer or no printer, if the PDF printer isn't available.\r\n\r\nThe value is parsed as a JSON object, conforming to the following schema: { \"type\": \"object\", \"properties\": { \"idPattern\": { \"description\": \"Regular expression to match printer id.\", \"type\": \"string\" }, \"namePattern\": { \"description\": \"Regular expression to match printer display name.\", \"type\": \"string\" } } }\r\n\r\nOmitting a field means all values match; for example, if you don't specify connectivity Print Preview starts discovering all kinds of local printers. Regular expression patterns must follow the JavaScript RegExp syntax and matches are case sensitive.\r\n\r\nExample value: { \"idPattern\": \".*public\", \"namePattern\": \".*Color\" }","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~printing_defaultprinterselection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~printing_defaultprinterselection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~printing_defaultprinterselection_defaultprinterselection","displayName":"Default printer selection rules (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~printing_printheaderfooter","displayName":"Print headers and footers (User)","description":"Force 'headers and footers' to be on or off in the printing dialog.\r\n\r\nIf you don't configure this policy, users can decide whether to print headers and footers.\r\n\r\nIf you disable this policy, users can't print headers and footers.\r\n\r\nIf you enable this policy, users always print headers and footers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~printing_printheaderfooter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~printing_printheaderfooter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~printing_printingenabled","displayName":"Enable printing (User)","description":"Enables printing in Microsoft Edge and prevents users from changing this setting.\r\n\r\nIf you enable this policy or don't configure it, users can print.\r\n\r\nIf you disable this policy, users can't print from Microsoft Edge. Printing is disabled in the wrench menu, extensions, JavaScript applications, and so on. Users can still print from plug-ins that bypass Microsoft Edge while printing. For example, certain Adobe Flash applications have the print option in their context menu, which isn't covered by this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~printing_printingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~printing_printingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~printing_printpreviewusesystemdefaultprinter","displayName":"Set the system default printer as the default printer (User)","description":"Tells Microsoft Edge to use the system default printer as the default choice in Print Preview instead of the most recently used printer.\r\n\r\nIf you disable this policy or don't configure it, Print Preview uses the most recently used printer as the default destination choice.\r\n\r\nIf you enable this policy, Print Preview uses the OS system default printer as the default destination choice.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~printing_printpreviewusesystemdefaultprinter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~printing_printpreviewusesystemdefaultprinter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~printing_usesystemprintdialog","displayName":"Print using system print dialog (User)","description":"Shows the system print dialog instead of print preview.\r\n\r\nIf you enable this policy, Microsoft Edge opens the system print dialog instead of the built-in print preview when a user prints a page.\r\n\r\nIf you don't configure or disable this policy, print commands trigger the Microsoft Edge print preview screen.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~printing_usesystemprintdialog_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~printing_usesystemprintdialog_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxybypasslist","displayName":"Configure proxy bypass rules (User)","description":"Defines a list of hosts for which Microsoft Edge bypasses any proxy.\r\n\r\nThis policy is applied only if you have selected 'Use fixed proxy servers' in the 'ProxyMode' (Configure proxy server settings) policy. If you selected any other mode for configuring proxy policies, don't enable or configure this policy.\r\n\r\nIf you enable this policy, you can create a list of hosts for which Microsoft Edge doesn't use a proxy.\r\n\r\nIf you don't configure this policy, no list of hosts is created for which Microsoft Edge bypasses a proxy. Leave this policy unconfigured if you've specified any other method for setting proxy policies.\r\n\r\nFor more detailed examples go to https://go.microsoft.com/fwlink/?linkid=2094936.\r\n\r\nExample value: https://www.contoso.com, https://www.fabrikam.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxybypasslist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxybypasslist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxybypasslist_proxybypasslist","displayName":"Comma-separated list of proxy bypass rules (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxymode","displayName":"Configure proxy server settings (User)","description":"Specify the proxy server settings used by Microsoft Edge. If you enable this policy, users can't change the proxy settings.\r\n\r\nIf you choose to never use a proxy server and to always connect directly, all other options are ignored.\r\n\r\nIf you choose to use system proxy settings, all other options are ignored.\r\n\r\nIf you choose to auto detect the proxy server, all other options are ignored.\r\n\r\nIf you choose fixed server proxy mode, you can specify further options in 'ProxyServer' (Configure address or URL of proxy server) and 'Comma-separated list of proxy bypass rules'.\r\n\r\nIf you choose to use a .pac proxy script, you must specify the URL to the script in 'URL to a proxy .pac file'.\r\n\r\nFor detailed examples, go to https://go.microsoft.com/fwlink/?linkid=2094936.\r\n\r\nIf you enable this policy, Microsoft Edge will ignore all proxy-related options specified from the command line.\r\n\r\nIf you don't configure this policy users can choose their own proxy settings.\r\n\r\n* \"direct\" = Never use a proxy\r\n\r\n* \"auto_detect\" = Auto detect proxy settings\r\n\r\n* \"pac_script\" = Use a .pac proxy script\r\n\r\n* \"fixed_servers\" = Use fixed proxy servers\r\n\r\n* \"system\" = Use system proxy settings\r\n\r\nExample value: direct","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxymode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxymode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxymode_proxymode","displayName":"Configure proxy server settings (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxymode_proxymode_direct","displayName":"Never use a proxy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxymode_proxymode_auto_detect","displayName":"Auto detect proxy settings","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxymode_proxymode_pac_script","displayName":"Use a .pac proxy script","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxymode_proxymode_fixed_servers","displayName":"Use fixed proxy servers","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxymode_proxymode_system","displayName":"Use system proxy settings","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxypacurl","displayName":"Set the proxy .pac file URL (User)","description":"Specifies the URL for a proxy auto-config (PAC) file.\r\n\r\nThis policy is applied only if you selected 'Use a .pac proxy script' in the 'ProxyMode' (Configure proxy server settings) policy. If you selected any other mode for configuring proxy policies, don't enable or configure this policy.\r\n\r\nIf you enable this policy, you can specify the URL for a PAC file, which defines how the browser automatically chooses the appropriate proxy server for fetching a particular website.\r\n\r\nIf you disable or don't configure this policy, no PAC file is specified. Leave this policy unconfigured if you've specified any other method for setting proxy policies.\r\n\r\nFor detailed examples, see https://go.microsoft.com/fwlink/?linkid=2094936.\r\n\r\nExample value: https://internal.contoso.com/example.pac","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxypacurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxypacurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxypacurl_proxypacurl","displayName":"Set the proxy .pac file URL (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxyserver","displayName":"Configure address or URL of proxy server (User)","description":"Specifies the URL of the proxy server.\r\n\r\nThis policy is applied only if you have selected 'Use fixed proxy servers' in the 'ProxyMode' (Configure proxy server settings) policy. If you selected any other mode for configuring proxy policies, don't enable or configure this policy.\r\n\r\nIf you enable this policy, the proxy server configured by this policy will be used for all URLs.\r\n\r\nIf you disable or don't configure this policy, users can choose their own proxy settings while in this proxy mode. Leave this policy unconfigured if you've specified any other method for setting proxy policies.\r\n\r\nFor more options and detailed examples, see https://go.microsoft.com/fwlink/?linkid=2094936.\r\n\r\nExample value: 123.123.123.123:8080","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxyserver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxyserver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxyserver_proxyserver","displayName":"Configure address or URL of proxy server (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxysettings","displayName":"Proxy settings (User)","description":"Configures the proxy settings for Microsoft Edge.\r\n\r\nIf you enable this policy, Microsoft Edge ignores all proxy-related options specified from the command line.\r\n\r\nIf you don't configure this policy, users can choose their own proxy settings.\r\n\r\nThis policy overrides the following individual policies:\r\n\r\n'ProxyMode' (Configure proxy server settings)\r\n'ProxyPacUrl' (Set the proxy .pac file URL)\r\n'ProxyServer' (Configure address or URL of proxy server)\r\n'ProxyBypassList' (Configure proxy bypass rules)\r\n\r\nThe ProxyMode field lets you specify the proxy server used by Microsoft Edge and prevents users from changing proxy settings.\r\n\r\nThe ProxyPacUrl field is a URL to a proxy .pac file.\r\n\r\nThe ProxyServer field is a URL for the proxy server.\r\n\r\nThe ProxyBypassList field is a list of proxy hosts that Microsoft Edge bypasses.\r\n\r\nIf you choose the 'direct' value as 'ProxyMode', a proxy is never used and all other fields are ignored.\r\n\r\nIf you choose the 'system' value as 'ProxyMode', the systems's proxy is used and all other fields are ignored.\r\n\r\nIf you choose the 'auto_detect' value as 'ProxyMode', all other fields are ignored.\r\n\r\nIf you choose the 'fixed_server' value as 'ProxyMode', the 'ProxyServer' and 'ProxyBypassList' fields are used.\r\n\r\nIf you choose the 'pac_script' value as 'ProxyMode', the 'ProxyPacUrl' and 'ProxyBypassList' fields are used.\r\n\r\nExample value:\r\n\r\n{\r\n \"ProxyMode\": \"direct\", \r\n \"ProxyPacUrl\": \"https://internal.site/example.pac\", \r\n \"ProxyServer\": \"123.123.123.123:8080\", \r\n \"ProxyBypassList\": \"https://www.example1.com,https://www.example2.com,https://internalsite/\"\r\n}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxysettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxysettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~proxy_proxysettings_proxysettings","displayName":"Proxy settings (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~smartscreen_preventsmartscreenpromptoverride","displayName":"Prevent bypassing Microsoft Defender SmartScreen prompts for sites (User)","description":"This policy setting lets you decide whether users can override the Microsoft Defender SmartScreen warnings about potentially malicious websites.\r\n\r\nIf you enable this setting, users can't ignore Microsoft Defender SmartScreen warnings and they are blocked from continuing to the site.\r\n\r\nIf you disable or don't configure this setting, users can ignore Microsoft Defender SmartScreen warnings and continue to the site.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~smartscreen_preventsmartscreenpromptoverride_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~smartscreen_preventsmartscreenpromptoverride_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~smartscreen_preventsmartscreenpromptoverrideforfiles","displayName":"Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads (User)","description":"This policy lets you determine whether users can override Microsoft Defender SmartScreen warnings about unverified downloads.\r\n\r\nIf you enable this policy, users in your organization can't ignore Microsoft Defender SmartScreen warnings, and they're prevented from completing the unverified downloads.\r\n\r\nIf you disable or don't configure this policy, users can ignore Microsoft Defender SmartScreen warnings and complete unverified downloads.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~smartscreen_preventsmartscreenpromptoverrideforfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~smartscreen_preventsmartscreenpromptoverrideforfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~smartscreen_smartscreenallowlistdomains","displayName":"Configure the list of domains for which Microsoft Defender SmartScreen won't trigger warnings (User)","description":"Configure the list of Microsoft Defender SmartScreen trusted domains. This means:\r\nMicrosoft Defender SmartScreen won't check for potentially malicious resources like phishing software and other malware if the source URLs match these domains.\r\nThe Microsoft Defender SmartScreen download protection service won't check downloads hosted on these domains.\r\n\r\nIf you enable this policy, Microsoft Defender SmartScreen trusts these domains.\r\nIf you disable or don't set this policy, default Microsoft Defender SmartScreen protection is applied to all resources.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.\r\nAlso note that this policy does not apply if your organization has enabled Microsoft Defender Advanced Threat Protection. You must configure your allow and block lists in Microsoft Defender Security Center instead.\r\n\r\nExample value:\r\n\r\nmydomain.com\r\nmyuniversity.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~smartscreen_smartscreenallowlistdomains_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~smartscreen_smartscreenallowlistdomains_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~smartscreen_smartscreenallowlistdomains_smartscreenallowlistdomainsdesc","displayName":"Configure the list of domains for which SmartScreen won't trigger warnings (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~smartscreen_smartscreenenabled","displayName":"Configure Microsoft Defender SmartScreen (User)","description":"This policy setting lets you configure whether to turn on Microsoft Defender SmartScreen. Microsoft Defender SmartScreen provides warning messages to help protect your users from potential phishing scams and malicious software. By default, Microsoft Defender SmartScreen is turned on.\r\n\r\nIf you enable this setting, Microsoft Defender SmartScreen is turned on.\r\n\r\nIf you disable this setting, Microsoft Defender SmartScreen is turned off.\r\n\r\nIf you don't configure this setting, users can choose whether to use Microsoft Defender SmartScreen.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~smartscreen_smartscreenenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~smartscreen_smartscreenenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_homepageisnewtabpage","displayName":"Set the new tab page as the home page (User)","description":"Configures the default home page in Microsoft Edge. You can set the home page to a URL you specify or to the new tab page.\r\n\r\nIf you enable this policy, the new tab page is always used for the home page, and the home page URL location is ignored.\r\n\r\nIf you disable this policy, the user's home page can't be the new tab page, unless the URL is set to 'edge://newtab'.\r\n\r\nIf not configured users can choose whether the new tab page is their home page.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances enrolled for device management.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_homepageisnewtabpage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_homepageisnewtabpage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_homepagelocation","displayName":"Configure the home page URL (User)","description":"Configures the default home page URL in Microsoft Edge.\r\n\r\nThe home page is the page opened by the Home button. The pages that open on startup are controlled by the 'RestoreOnStartup' (Action to take on startup) policies.\r\n\r\nYou can either set a URL here or set the home page to open the new tab page. If you select to open the new tab page, then this policy doesn't take effect.\r\n\r\nIf you enable this policy, users can't change their home page URL, but they can choose to use the new tab page as their home page.\r\n\r\nIf you disable or don't configure this policy, users can choose their own home page, as long as the 'HomepageIsNewTabPage' (Set the new tab page as the home page) policy isn't enabled.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances enrolled for device management.\r\n\r\nExample value: https://www.contoso.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_homepagelocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_homepagelocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_homepagelocation_homepagelocation","displayName":"Home page URL (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_newtabpagehidedefaulttopsites","displayName":"Hide the default top sites from the new tab page (User)","description":"Hides the default top sites from the new tab page in Microsoft Edge.\r\n\r\nIf you set this policy to true, the default top site tiles are hidden.\r\n\r\nIf you set this policy to false or don't configure it, the default top site tiles remain visible.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_newtabpagehidedefaulttopsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_newtabpagehidedefaulttopsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_newtabpagelocation","displayName":"Configure the new tab page URL (User)","description":"Configures the default URL for the new tab page.\r\n\r\nThis policy determines the page that's opened when new tabs are created (including when new windows are opened). It also affects the startup page if that's set to open to the new tab page.\r\n\r\nThis policy doesn't determine which page opens on startup; that's controlled by the 'RestoreOnStartup' (Action to take on startup) policy. It also doesn’t affect the home page if that’s set to open to the new tab page.\r\n\r\nIf you don't configure this policy, the default new tab page is used.\r\n\r\nIf you configure this policy *and* the 'NewTabPageSetFeedType' (Configure the Microsoft Edge new tab page experience) policy, this policy has precedence.\r\n\r\nIf an invalid URL is provided, new tabs will open about://blank.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances that are enrolled for device management.\r\n\r\nExample value: https://www.fabrikam.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_newtabpagelocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_newtabpagelocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_newtabpagelocation_newtabpagelocation","displayName":"New tab page URL (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_restoreonstartup","displayName":"Action to take on Microsoft Edge startup (User)","description":"Specify how Microsoft Edge behaves when it starts.\r\n\r\nIf you want a new tab to always open on startup, choose 'Open new tab' (5).\r\n\r\nIf you want to reopen URLs that were open the last time Microsoft Edge closed, choose 'Restore the last session' (1). The browsing session will be restored as it was. Note that this option disables some settings that rely on sessions or that perform actions on exit (such as Clear browsing data on exit or session-only cookies).\r\n\r\nIf you want to open a specific set of URLs, choose 'Open a list of URLs' (4).\r\n\r\nDisabling this setting is equivalent to leaving it not configured. Users will be able to change it in Microsoft Edge.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances enrolled for device management.\r\n\r\n* 1 = Restore the last session\r\n\r\n* 4 = Open a list of URLs\r\n\r\n* 5 = Open a new tab","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_restoreonstartup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_restoreonstartup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_restoreonstartup_restoreonstartup","displayName":"Action to take on startup (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_restoreonstartup_restoreonstartup_5","displayName":"Open a new tab","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_restoreonstartup_restoreonstartup_1","displayName":"Restore the last session","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_restoreonstartup_restoreonstartup_4","displayName":"Open a list of URLs","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_restoreonstartupurls","displayName":"Sites to open when the browser starts (User)","description":"Specify a list of websites to open automatically when the browser starts. If you don't configure this policy, no site is opened on startup.\r\n\r\nThis policy only works if you also set the 'RestoreOnStartup' (Action to take on startup) policy to 'Open a list of URLs' (4).\r\n\r\nThis policy is only available on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances that are enrolled for device management.\r\n\r\nExample value:\r\n\r\nhttps://contoso.com\r\nhttps://www.fabrikam.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_restoreonstartupurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_restoreonstartupurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_restoreonstartupurls_restoreonstartupurlsdesc","displayName":"Sites to open when the browser starts (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_showhomebutton","displayName":"Show Home button on toolbar (User)","description":"Shows the Home button on Microsoft Edge's toolbar.\r\n\r\nEnable this policy to always show the Home button. Disable it to never show the button.\r\n\r\nIf you don't configure the policy, users can choose whether to show the home button.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_showhomebutton_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edge~policy~microsoft_edge~startup_showhomebutton_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgeupdates.2~policy~microsoft_edge_downloadrestrictions","displayName":"Allow download restrictions (User)","description":"Configures the type of downloads that Microsoft Edge completely blocks, without letting users override the security decision.\r\n\r\nSet 'BlockDangerousDownloads' to allow all downloads except for those that carry Microsoft Defender SmartScreen warnings of known or potentially dangerous downloads or that have dangerous file type extensions.\r\n\r\nSet 'BlockPotentiallyDangerousDownloads' to allow all downloads except for those that carry Microsoft Defender SmartScreen warnings of potentially dangerous or unwanted downloads or that have dangerous file type extensions.\r\n\r\nSet 'BlockAllDownloads' to block all downloads.\r\n\r\nSet 'BlockMaliciousDownloads' to allow all downloads except for those that carry Microsoft Defender SmartScreen warnings of known malicious downloads.\r\n\r\nIf you don't configure this policy or set the 'DefaultDownloadSecurity' option, the downloads go through the usual security restrictions based on Microsoft Defender SmartScreen analysis results.\r\n\r\nNote that these restrictions apply to downloads from web page content, as well as the 'download link...' context menu option. These restrictions don't apply to saving or downloading the currently displayed page, nor do they apply to the Save as PDF option from the printing options.\r\n\r\nSee https://go.microsoft.com/fwlink/?linkid=2094934 for more info on Microsoft Defender SmartScreen.\r\n\r\nPolicy options mapping:\r\n\r\n* DefaultDownloadSecurity (0) = No special restrictions\r\n\r\n* BlockDangerousDownloads (1) = Block malicious downloads and dangerous file types\r\n\r\n* BlockPotentiallyDangerousDownloads (2) = Block potentially dangerous or unwanted downloads and dangerous file types\r\n\r\n* BlockAllDownloads (3) = Block all downloads\r\n\r\n* BlockMaliciousDownloads (4) = Block malicious downloads\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgeupdates.2~policy~microsoft_edge_downloadrestrictions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgeupdates.2~policy~microsoft_edge_downloadrestrictions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgeupdates.2~policy~microsoft_edge_downloadrestrictions_downloadrestrictions","displayName":"Download restrictions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgeupdates.2~policy~microsoft_edge_downloadrestrictions_downloadrestrictions_0","displayName":"No special restrictions","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgeupdates.2~policy~microsoft_edge_downloadrestrictions_downloadrestrictions_1","displayName":"Block malicious downloads and dangerous file types","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgeupdates.2~policy~microsoft_edge_downloadrestrictions_downloadrestrictions_2","displayName":"Block potentially dangerous or unwanted downloads and dangerous file types","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgeupdates.2~policy~microsoft_edge_downloadrestrictions_downloadrestrictions_3","displayName":"Block all downloads","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgeupdates.2~policy~microsoft_edge_downloadrestrictions_downloadrestrictions_4","displayName":"Block malicious downloads","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgeupdates.2~policy~microsoft_edge_recommended_downloadrestrictions_recommended","displayName":"Allow download restrictions (User)","description":"Configures the type of downloads that Microsoft Edge completely blocks, without letting users override the security decision.\r\n\r\nSet 'BlockDangerousDownloads' to allow all downloads except for those that carry Microsoft Defender SmartScreen warnings of known or potentially dangerous downloads or that have dangerous file type extensions.\r\n\r\nSet 'BlockPotentiallyDangerousDownloads' to allow all downloads except for those that carry Microsoft Defender SmartScreen warnings of potentially dangerous or unwanted downloads or that have dangerous file type extensions.\r\n\r\nSet 'BlockAllDownloads' to block all downloads.\r\n\r\nSet 'BlockMaliciousDownloads' to allow all downloads except for those that carry Microsoft Defender SmartScreen warnings of known malicious downloads.\r\n\r\nIf you don't configure this policy or set the 'DefaultDownloadSecurity' option, the downloads go through the usual security restrictions based on Microsoft Defender SmartScreen analysis results.\r\n\r\nNote that these restrictions apply to downloads from web page content, as well as the 'download link...' context menu option. These restrictions don't apply to saving or downloading the currently displayed page, nor do they apply to the Save as PDF option from the printing options.\r\n\r\nSee https://go.microsoft.com/fwlink/?linkid=2094934 for more info on Microsoft Defender SmartScreen.\r\n\r\nPolicy options mapping:\r\n\r\n* DefaultDownloadSecurity (0) = No special restrictions\r\n\r\n* BlockDangerousDownloads (1) = Block malicious downloads and dangerous file types\r\n\r\n* BlockPotentiallyDangerousDownloads (2) = Block potentially dangerous or unwanted downloads and dangerous file types\r\n\r\n* BlockAllDownloads (3) = Block all downloads\r\n\r\n* BlockMaliciousDownloads (4) = Block malicious downloads\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgeupdates.2~policy~microsoft_edge_recommended_downloadrestrictions_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgeupdates.2~policy~microsoft_edge_recommended_downloadrestrictions_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgeupdates.2~policy~microsoft_edge_recommended_downloadrestrictions_recommended_downloadrestrictions","displayName":"Download restrictions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgeupdates.2~policy~microsoft_edge_recommended_downloadrestrictions_recommended_downloadrestrictions_0","displayName":"No special restrictions","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgeupdates.2~policy~microsoft_edge_recommended_downloadrestrictions_recommended_downloadrestrictions_1","displayName":"Block malicious downloads and dangerous file types","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgeupdates.2~policy~microsoft_edge_recommended_downloadrestrictions_recommended_downloadrestrictions_2","displayName":"Block potentially dangerous or unwanted downloads and dangerous file types","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgeupdates.2~policy~microsoft_edge_recommended_downloadrestrictions_recommended_downloadrestrictions_3","displayName":"Block all downloads","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgeupdates.2~policy~microsoft_edge_recommended_downloadrestrictions_recommended_downloadrestrictions_4","displayName":"Block malicious downloads","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge_adstransparencyenabled","displayName":"Configure if the ads transparency feature is enabled (User)","description":"Lets you decide whether the ads transparency feature is enabled. This behavior only applies to the \"balanced\" mode of tracking prevention, and does not impact \"basic\" or \"strict\" modes. Your users' tracking prevention level can be configured using the 'TrackingPrevention' (Block tracking of users' web-browsing activity) policy. AdsTransparencyEnabled will only have an effect if 'TrackingPrevention' is set to TrackingPreventionBalanced or is not configured.\r\n\r\nIf you enable or don't configure this policy, transparency metadata provided by ads will be available to the user when the feature is active.\r\n\r\nWhen the feature is enabled, Tracking Prevention will enable exceptions for the associated ad providers that have met Microsoft's privacy standards.\r\n\r\nIf you disable this policy, Tracking Prevention will not adjust its behavior even when transparency metadata is provided by ads.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge_adstransparencyenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge_adstransparencyenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge_hiderestoredialogenabled","displayName":"Hide restore pages dialog after browser crash (User)","description":"This policy gives an option to hide the \"Restore pages\" dialog after Microsoft Edge has crashed. The \"Restore pages\" dialog gives users the option to restore the pages that were previously open before Microsoft Edge crashed.\r\n\r\nIf you enable this policy, the \"Restore pages\" dialog will not be shown. In the event of a crash, Microsoft Edge will not restore previous tabs and will start the session with a new tab page.\r\n\r\nIf you disable or don't set this policy, the \"Restore pages\" dialog will be shown.\r\n\r\nIf you set this policy, do not set the 'ClearBrowsingDataOnExit' (Clear browsing data when Microsoft Edge closes) or 'SavingBrowserHistoryDisabled' (Disable saving browser history) policy since that prevents history from being saved which also disables the dialog.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge_hiderestoredialogenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge_hiderestoredialogenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge_pdfsecuremode","displayName":"Secure mode and Certificate-based Digital Signature validation in native PDF reader (User)","description":"The policy enables Digital Signature validation for PDF files in a secure environment, which shows the correct validation status of the signatures.\r\n\r\nIf you enable this policy, PDF files with Certificate-based digital signatures are opened with an option to view and verify the validity of the signatures with high security.\r\n\r\nIf you disable or don't configure this policy, the capability to view and verify the signature will not be available.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge_pdfsecuremode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge_pdfsecuremode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge_promptonmultiplematchingcertificates","displayName":"Prompt the user to select a certificate when multiple certificates match (User)","description":"This policy controls whether the user is prompted to select a client certificate when more than one certificate matches 'AutoSelectCertificateForUrls' (Automatically select client certificates for these sites).\r\nIf this policy is set to True, the user is prompted to select a client certificate whenever the auto-selection policy matches multiple certificates.\r\nIf this policy is set to False or not set, the user may only be prompted when no certificate matches the auto-selection.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge_promptonmultiplematchingcertificates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge_promptonmultiplematchingcertificates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge~contentsettings_defaultwebhidguardsetting","displayName":"Control use of the WebHID API (User)","description":"Setting the policy to 3 lets websites ask for access to HID devices. Setting the policy to 2 denies access to HID devices.\r\n\r\nLeaving it unset lets websites ask for access, but users can change this setting.\r\n\r\nThis policy can be overridden for specific url patterns using the 'WebHidAskForUrls' (Allow the WebHID API on these sites) and 'WebHidBlockedForUrls' (Block the WebHID API on these sites) policies.\r\n\r\nPolicy options mapping:\r\n\r\n* BlockWebHid (2) = Do not allow any site to request access to HID devices via the WebHID API\r\n\r\n* AskWebHid (3) = Allow sites to ask the user to grant access to a HID device\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge~contentsettings_defaultwebhidguardsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge~contentsettings_defaultwebhidguardsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge~contentsettings_defaultwebhidguardsetting_defaultwebhidguardsetting","displayName":"Control use of the WebHID API (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge~contentsettings_defaultwebhidguardsetting_defaultwebhidguardsetting_2","displayName":"Do not allow any site to request access to HID devices via the WebHID API","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge~contentsettings_defaultwebhidguardsetting_defaultwebhidguardsetting_3","displayName":"Allow sites to ask the user to grant access to a HID device","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge~contentsettings_webhidaskforurls","displayName":"Allow the WebHID API on these sites (User)","description":"Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them access to a HID device.\r\n\r\nLeaving the policy unset means 'DefaultWebHidGuardSetting' (Control use of the WebHID API) applies for all sites, if it's set. If not, users' personal settings apply.\r\n\r\nFor URL patterns that don't match the policy, the following values are applied in order of precedence:\r\n\r\n * 'WebHidBlockedForUrls' (Block the WebHID API on these sites) (if there is a match),\r\n\r\n * 'DefaultWebHidGuardSetting' (if set), or\r\n\r\n * Users' personal settings.\r\n\r\nURL patterns must not conflict with 'WebHidBlockedForUrls'. Neither policy takes precedence if a URL matches both patterns.\r\n\r\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://microsoft.com\r\nhttps://chromium.org","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge~contentsettings_webhidaskforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge~contentsettings_webhidaskforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge~contentsettings_webhidaskforurls_webhidaskforurlsdesc","displayName":"Allow the WebHID API on these sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge~contentsettings_webhidblockedforurls","displayName":"Block the WebHID API on these sites (User)","description":"Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them access to a HID device.\r\n\r\nLeaving the policy unset means 'DefaultWebHidGuardSetting' (Control use of the WebHID API) applies for all sites, if it's set. If not, users' personal settings apply.\r\n\r\nFor URL patterns that don't match the policy, the following values are applied in order of precedence:\r\n\r\n * 'WebHidAskForUrls' (Allow the WebHID API on these sites) (if there is a match),\r\n\r\n * 'DefaultWebHidGuardSetting' (if set), or\r\n\r\n * Users' personal settings.\r\n\r\nURL patterns can't conflict with 'WebHidAskForUrls'. Neither policy takes precedence if a URL matches both patterns.\r\n\r\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://microsoft.com\r\nhttps://chromium.org","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge~contentsettings_webhidblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge~contentsettings_webhidblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev100~policy~microsoft_edge~contentsettings_webhidblockedforurls_webhidblockedforurlsdesc","displayName":"Block the WebHID API on these sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_configurekeyboardshortcuts","displayName":"Configure the list of commands for which to disable keyboard shortcuts (User)","description":"Configure the list of Microsoft Edge commands for which to disable keyboard shortcuts.\r\n\r\nSee https://go.microsoft.com/fwlink/?linkid=2186950 for a list of possible commands to disable.\r\n\r\nIf you enable this policy, commands in the 'disabled' list will no longer be activated by keyboard shortcuts.\r\n\r\nIf you disable this policy, all keyboard shortcuts behave as usual.\r\n\r\nNote: Disabling a command will only remove its shortcut mapping. Commands in the 'disabled' list will still function if accessed via browser UI.\r\n\r\nExample value:\r\n\r\n{\r\n \"disabled\": [\r\n \"new_tab\",\r\n \"fullscreen\"\r\n ]\r\n}\r\n\r\n\r\nCompact example value:\r\n\r\n{\"disabled\": [\"new_tab\", \"fullscreen\"]}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_configurekeyboardshortcuts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_configurekeyboardshortcuts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_configurekeyboardshortcuts_configurekeyboardshortcuts","displayName":"Configure the list of commands for which to disable keyboard shortcuts (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_edgeassetdeliveryserviceenabled","displayName":"Allow features to download assets from the Asset Delivery Service (User)","description":"The Asset Delivery Service is a general pipeline used to deliver assets to the Microsoft Edge Clients.\r\nThese assets can be config files or Machine Learning models that power the features that use this service.\r\n\r\nIf you enable or don't configure this policy, features can download assets from the Asset Delivery Service.\r\n\r\nIf you disable this policy, features won't be able to download assets needed for them to run correctly.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_edgeassetdeliveryserviceenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_edgeassetdeliveryserviceenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_internetexplorermodeenablesavepageas","displayName":"Allow Save page as in Internet Explorer mode (User)","description":"This policy enables 'Save page as' functionality in Internet Explorer mode.\r\nUsers can use this option to save the current page in the browser. When a user re-opens a saved page, it will be loaded in the default browser.\r\n\r\nIf you enable this policy, the \"Save page as\" option will be clickable in \"More tools\".\r\n\r\nIf you disable or don't configure this policy, users can't select the \"Save page as\" option in \"More tools\".\r\n\r\nNote: To make the \"Ctrl+S\" shortcut work, users must enable the Internet Explorer policy, 'Enable extended hot key in Internet Explorer mode'.\r\n\r\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_internetexplorermodeenablesavepageas_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_internetexplorermodeenablesavepageas_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_recommended_edgeassetdeliveryserviceenabled_recommended","displayName":"Allow features to download assets from the Asset Delivery Service (User)","description":"The Asset Delivery Service is a general pipeline used to deliver assets to the Microsoft Edge Clients.\r\nThese assets can be config files or Machine Learning models that power the features that use this service.\r\n\r\nIf you enable or don't configure this policy, features can download assets from the Asset Delivery Service.\r\n\r\nIf you disable this policy, features won't be able to download assets needed for them to run correctly.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_recommended_edgeassetdeliveryserviceenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_recommended_edgeassetdeliveryserviceenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_recommended_sitesafetyservicesenabled_recommended","displayName":"Allow users to configure Site safety services (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 127.\r\n\r\nThis policy is obselete as the feature is being removed after Microsoft Edge version 127.\r\n\r\nThis policy disables site safety services from showing top site info in the page info dialog.\r\n\r\nIf you enable this policy or don't configure it, the top site info will be shown.\r\n\r\nIf you disable this policy, the top site info will not be shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_recommended_sitesafetyservicesenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_recommended_sitesafetyservicesenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_recommended~extensions_recommended_controldefaultstateofallowextensionfromotherstoressettingenabled_recommended","displayName":"Configure default state of Allow extensions from other stores setting (User)","description":"This policy allows you to control the default state of the Allow extensions from other stores setting.\r\nThis policy can't be used to stop installation of extensions from other stores such as Chrome Web Store.\r\nTo stop installation of extensions from other stores, use the Extension Settings policy: https://go.microsoft.com/fwlink/?linkid=2187098.\r\n\r\nWhen enabled, Allow extensions from other stores will be turned on. So, users won't have to turn on the flag manually\r\nwhile installing extensions from other supported stores such as Chrome Web Store. However a user can override this setting.\r\nIf the user has already turned on the setting and then turned it off, this setting may not work.\r\nIf the Admin first sets the policy as Enabled, but then changes it to not configured or disabled, it will have no impact on\r\nuser settings and the setting will remain as it is.\r\n\r\nWhen disabled or not configured, the user can manage the Allow extensions from other store setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_recommended~extensions_recommended_controldefaultstateofallowextensionfromotherstoressettingenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_recommended~extensions_recommended_controldefaultstateofallowextensionfromotherstoressettingenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_sitesafetyservicesenabled","displayName":"Allow users to configure Site safety services (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 127.\r\n\r\nThis policy is obselete as the feature is being removed after Microsoft Edge version 127.\r\n\r\nThis policy disables site safety services from showing top site info in the page info dialog.\r\n\r\nIf you enable this policy or don't configure it, the top site info will be shown.\r\n\r\nIf you disable this policy, the top site info will not be shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_sitesafetyservicesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge_sitesafetyservicesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge~identity_edgedefaultprofileenabled","displayName":"Default Profile Setting Enabled (User)","description":"Configuring this policy will let you set a default profile in Microsoft Edge to be used when opening the browser rather than the last profile used. This policy won't affect when \"--profile-directory\" parameter has been specified. Set the value to \"Default\" to refer to the default profile. The value is case sensitive.\r\nThe value of the policy is the name of the profile (case sensitive) and can be configured with string that is the name of a specific profile.\r\nThe value \"Edge Kids Mode\" and \"Guest Profile\" are considered not useful values because they not supposed to be a default profile.\r\nThis policy won't impact the following scenarios:\r\n 1) Settings specified in \"Profile preferences for sites\" in \"Profile preferences\"\r\n 2) Links opening from Outlook and Teams.\r\n\r\nThe following statements are under the condition of not specify the \"--profile-directory\" and configured value is not \"Edge Kids Mode\" or \"Guest Profile\":\r\nIf you enable this policy and configure it with a specific profile name and the specified profile can be found, Microsoft Edge will use the specified profile when launching and the setting of \"Default profile for external link\" is changed to the specified profile name and greyed out.\r\nIf you enable this policy and configure it with a specific profile name but it can't be found, the policy will behave like it's never been set before.\r\nIf you enable this policy, but don't configure or disable it, the policy will behave like it's never been set before.\r\n\r\nExample value: Default","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge~identity_edgedefaultprofileenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge~identity_edgedefaultprofileenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge~identity_edgedefaultprofileenabled_edgedefaultprofileenabled","displayName":"Default Profile Setting Enabled (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge~kioskmode_kioskswipegesturesenabled","displayName":"Swipe gestures in Microsoft Edge kiosk mode enabled (User)","description":"This policy only applies to Microsoft Edge kiosk mode.\r\n\r\nIf you enable this policy or don't configure it, swipe gestures will behave as expected.\r\n\r\nIf you disable this policy, the user will not be able to use swipe gestures (for example navigate forwards and backwards, refresh page).\r\n\r\nFor detailed information on configuring kiosk mode, see https://go.microsoft.com/fwlink/?linkid=2137578.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge~kioskmode_kioskswipegesturesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev101~policy~microsoft_edge~kioskmode_kioskswipegesturesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge_networkservicesandboxenabled","displayName":"Enable the network service sandbox (User)","description":"This policy controls whether or not the network service process runs sandboxed.\r\nIf this policy is enabled, the network service process will run sandboxed.\r\nIf this policy is disabled, the network service process will run unsandboxed. This leaves users open to additional security risks related to running the network service unsandboxed.\r\nIf this policy is not set, the default configuration for the network sandbox will be used. This may vary depending on Microsoft Edge release, currently running field trials, and platform.\r\nThis policy is intended to give enterprises flexibility to disable the network sandbox if they use third party software that interferes with the network service sandbox.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge_networkservicesandboxenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge_networkservicesandboxenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge_outlookhubmenuenabled","displayName":"Allow users to access the Outlook menu (User)","description":"This policy is used to manage access to the Outlook menu from Microsoft Edge.\r\n\r\nIf you enable or don't configure this policy, users can access the Outlook menu.\r\nIf you disable this policy, users can't access the Outlook menu.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge_outlookhubmenuenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge_outlookhubmenuenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge_recommended_outlookhubmenuenabled_recommended","displayName":"Allow users to access the Outlook menu (User)","description":"This policy is used to manage access to the Outlook menu from Microsoft Edge.\r\n\r\nIf you enable or don't configure this policy, users can access the Outlook menu.\r\nIf you disable this policy, users can't access the Outlook menu.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge_recommended_outlookhubmenuenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge_recommended_outlookhubmenuenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge_settimeoutwithout1msclampenabled","displayName":"Control Javascript setTimeout() function minimum timeout (deprecated) (User)","description":"DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.\r\n\r\nWhen the policy is set to Enabled, the Javascript setTimeout() with a timeout of 0ms will no longer be fixed to 1ms to schedule timer-based callbacks.\r\nWhen the policy is set to Disabled, the Javascript setTimeout() with a timeout of 0ms will be fixed to 1ms to schedule timer-based callbacks.\r\nWhen the policy is unset, use the browser's default behavior for setTimeout() function.\r\n\r\nThis is a web standards compliancy feature, but it may change task ordering on a web page, leading to unexpected behavior on sites that are dependent on a certain ordering.\r\nIt also may affect sites with a lot of setTimeout()s with a timeout of 0ms usage. For example, increasing CPU load.\r\n\r\nFor users where this policy is unset, Microsoft Edge Stable will roll out the change gradually on the stable channel.\r\n\r\nThis is a temporary policy that is planned to be removed in Microsoft Edge Stable 105.\r\nThis deadline may be extended if there is a need for enterprises.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge_settimeoutwithout1msclampenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge_settimeoutwithout1msclampenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge_useragentclienthintsgreaseupdateenabled","displayName":"Control the User-Agent Client Hints GREASE Update feature (User)","description":"The User-Agent GREASE specification recommends the inclusion of additional GREASE characters beyond the current semicolon and space, and recommends that the arbitrary version number be varied over time.\r\n\r\nWhen enabled, the User-Agent Client Hints GREASE Update feature aligns the User-Agent GREASE algorithm with the latest version from the specification. The updated specification may break some websites that restrict the characters that requests may contain. For more information, see the following specification: https://wicg.github.io/ua-client-hints/#grease\r\n\r\nIf this policy is enabled or not configured, the User-Agent GREASE algorithm from the specification will be used. If the policy is disabled, the prior User-Agent GREASE algorithm will be used.\r\n\r\nThis policy is a temporary measure and will be removed in a future release.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge_useragentclienthintsgreaseupdateenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge_useragentclienthintsgreaseupdateenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge~httpauthentication_allhttpauthschemesallowedfororigins","displayName":"List of origins that allow all HTTP authentication (User)","description":"Set this policy to specify which origins allow all the HTTP authentication schemes Microsoft Edge supports regardless of the 'AuthSchemes' (Supported authentication schemes) policy.\r\n\r\nFormat the origin pattern according to this format (https://support.google.com/chrome/a?p=url_blocklist_filter_format). Up to 1,000 exceptions can be defined in 'AllHttpAuthSchemesAllowedForOrigins' (List of origins that allow all HTTP authentication).\r\nWildcards are allowed for the whole origin or parts of the origin. Parts include the scheme, host, or port.\r\n\r\nExample value:\r\n\r\n*.example.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge~httpauthentication_allhttpauthschemesallowedfororigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge~httpauthentication_allhttpauthschemesallowedfororigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev102~policy~microsoft_edge~httpauthentication_allhttpauthschemesallowedfororigins_allhttpauthschemesallowedfororiginsdesc","displayName":"List of origins that allow all HTTP authentication (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev103~policy~microsoft_edge_internetexplorerzoomdisplay","displayName":"Display zoom in IE Mode tabs with DPI Scale included like it is in Internet Explorer (User)","description":"Lets you display zoom in IE Mode tabs similar to how it was displayed in Internet Explorer, where the DPI scale of the display is factored in.\r\n\r\nFor example, if you have a page zoomed to 200% on a 100 DPI scale display and you change the display to 150 DPI, Microsoft Edge would still display the zoom as 200%. However, Internet Explorer factors in the DPI scale and displays 300%.\r\n\r\nIf you enable this policy, zoom values will be displayed with the DPI scale included for IE Mode tabs.\r\n\r\nIf you disable or don't configure this policy, zoom values will be displayed without DPI scale included for IE Mode tabs","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev103~policy~microsoft_edge_internetexplorerzoomdisplay_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev103~policy~microsoft_edge_internetexplorerzoomdisplay_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev103~policy~microsoft_edge_livecaptionsallowed","displayName":"Live captions allowed (User)","description":"Allow users to turn the Live captions feature on or off.\r\n\r\nLive captions is an accessibility feature that converts speech from the audio that plays in Microsoft Edge in to text and shows this text in a separate window. The entire process happens on the device and no audio or caption text ever leaves the device.\r\n\r\nNote: This feature is not generally available. Clients that have the 'ExperimentationAndConfigurationServiceControl' (Control communication with the Experimentation and Configuration Service) policy set to 'FullMode' may receive the feature before broad availability. Broad availability will be announced via Microsoft Edge release notes.\r\n\r\nIf you enable or don't configure this policy, users can turn this feature on or off at edge://settings/accessibility.\r\n\r\nIf you disable this policy, users will not be able to turn this accessibility feature on. If speech recognition files have been downloaded previously, they will be deleted from the device in 30 days. We recommend avoiding this option unless it's needed in your environment.\r\n\r\nIf users choose to turn on Live captions, speech recognition files (approximately 100 megabytes) will be downloaded to the device on first run and then periodically to improve performance and accuracy. These files will be deleted after 30 days.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev103~policy~microsoft_edge_livecaptionsallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev103~policy~microsoft_edge_livecaptionsallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev103~policy~microsoft_edge_originagentclusterdefaultenabled","displayName":"Origin-keyed agent clustering enabled by default (User)","description":"The Origin-Agent-Cluster: HTTP header controls whether a document is isolated in an origin-keyed agent cluster or in a site-keyed agent cluster. This has security implications because an origin-keyed agent cluster allows isolating documents by origin. The consequence of this for developers is that the document.domain accessor can no longer be set when origin-keyed agent clustering is enabled.\r\n\r\nIf you enable or don't configure this policy, documents without the Origin-Agent-Cluster: header will be assigned to origin-keyed agent clustering by default. On these documents, the document.domain accessor will not be settable.\r\n\r\nIf you disable this policy, documents without the Origin-Agent-Cluster: header will be assigned to site-keyed agent clusters by default. On these documents, the document.domain accessor will be settable.\r\n\r\nSee https://go.microsoft.com/fwlink/?linkid=2191896 for additional details.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev103~policy~microsoft_edge_originagentclusterdefaultenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev103~policy~microsoft_edge_originagentclusterdefaultenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev103~policy~microsoft_edge~identity_guidedswitchenabled","displayName":"Guided Switch Enabled (User)","description":"Allows Microsoft Edge to prompt the user to switch to the appropriate profile when Microsoft Edge detects that a link is a personal or work link.\r\n\r\nIf you enable this policy, you'll be prompted to switch to another account if the current profile doesn't work for the requesting link.\r\n\r\nIf you disable this policy, you won't be prompted to switch to another account when there's a profile and link mismatch.\r\n\r\nIf this policy isn't configured, guided switch is turned on by default. A user can override this value in the browser settings.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev103~policy~microsoft_edge~identity_guidedswitchenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev103~policy~microsoft_edge~identity_guidedswitchenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_alloweddomainsforapps","displayName":"Define domains allowed to access Google Workspace (User)","description":"Setting the policy on Microsoft Edge turns on the restricted sign-in feature in Google Workspace and prevents users from changing this setting. Users can only access Google tools using accounts from the specified domains. To allow gmail or googlemail accounts, add consumer_accounts to the list of domains. This policy is based on the Chrome policy of the same name.\r\n\r\nIf you don't provide a domain name or leave this policy unset, users can access Google Workspace with any account.\r\n\r\nUsers cannot change or override this setting.\r\n\r\nNote: This policy causes the X-GoogApps-Allowed-Domains header to be appended to all HTTP and HTTPS requests to all google.com domains, as described in https://go.microsoft.com/fwlink/?linkid=2197973.\r\n\r\nExample value: example.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_alloweddomainsforapps_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_alloweddomainsforapps_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_alloweddomainsforapps_alloweddomainsforapps","displayName":"Define domains allowed to access Google Workspace (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_askbeforecloseenabled","displayName":"Get user confirmation before closing a browser window with multiple tabs (User)","description":"This policy lets you configure whether users see a confirmation dialog before closing a browser window with multiple tabs. This dialog asks users to confirm that the browser window can be closed.\r\n\r\nIf you enable this policy, users will be presented with a confirmation dialog when closing a browser window with multiple tabs.\r\n\r\nIf you disable or don't configure this policy, a browser window with multiple tabs will close immediately without user confirmation.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_askbeforecloseenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_askbeforecloseenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_browsercodeintegritysetting","displayName":"Configure browser process code integrity guard setting (User)","description":"This policy controls the use of code integrity guard in the browser process, which only allows Microsoft signed binaries to load.\r\n\r\nSetting this policy to Enabled will enable code integrity guard in the browser process.\r\n\r\nSetting this policy to Disabled, or if the policy is not set, will prevent the browser from enabling code integrity guard in the browser process.\r\n\r\nThe policy value Audit (1) is obsolete as of version 110. Setting this value is equivalent to the Disabled value.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, or Windows 10 Pro or Enterprise instances that enrolled for device management.\r\n\r\nThis policy will only take effect on Windows 10 RS2 and above.\r\n\r\nPolicy options mapping:\r\n\r\n* Disabled (0) = Do not enable code integrity guard in the browser process.\r\n\r\n* Audit (1) = Enable code integrity guard audit mode in the browser process.\r\n\r\n* Enabled (2) = Enable code integrity guard enforcement in the browser process.\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_browsercodeintegritysetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_browsercodeintegritysetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_browsercodeintegritysetting_browsercodeintegritysetting","displayName":"Configure browser process code integrity guard setting (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_browsercodeintegritysetting_browsercodeintegritysetting_0","displayName":"Do not enable code integrity guard in the browser process.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_browsercodeintegritysetting_browsercodeintegritysetting_1","displayName":"Enable code integrity guard audit mode in the browser process.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_browsercodeintegritysetting_browsercodeintegritysetting_2","displayName":"Enable code integrity guard enforcement in the browser process.","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_doubleclickclosetabenabled","displayName":"Double Click feature in Microsoft Edge enabled (only available in China) (User)","description":"This policy lets you configure the double click feature in Microsoft Edge.\r\n\r\nDouble Click lets users close a tab by double clicking the left mouse button.\r\n\r\nIf you enable or don't configure this policy, you can use the double click feature to close a tab on Microsoft Edge to start using this feature.\r\n\r\nIf you disable this policy, you can't use the double click feature in Microsoft Edge.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_doubleclickclosetabenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_doubleclickclosetabenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_edgeedropenabled","displayName":"Enable Drop feature in Microsoft Edge (User)","description":"This policy lets you configure the Drop feature in Microsoft Edge.\r\n\r\nDrop lets users send messages or files to themselves.\r\n\r\nIf you enable or don't configure this policy, you can use the Drop feature in Microsoft Edge.\r\n\r\nIf you disable this policy, you can't use the Drop feature in Microsoft Edge.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_edgeedropenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_edgeedropenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_importoneachlaunch","displayName":"Allow import of data from other browsers on each Microsoft Edge launch (User)","description":"If you enable this policy, users will see a prompt to import their browsing data from other browsers on each Microsoft Edge launch.\r\n\r\nIf you disable this policy, users will never see a prompt to import their browsing data from other browsers on each Microsoft Edge launch.\r\n\r\nIf the policy is left unconfigured, users can activate this feature from a Microsoft Edge prompt or from the Settings page.\r\n\r\nNote: A similar policy named 'AutoImportAtFirstRun' (Automatically import another browser's data and settings at first run) exists. This policy should be used if you want to import supported data from other browsers only once while setting up your device.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_importoneachlaunch_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_importoneachlaunch_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_pdfxfaenabled","displayName":"XFA support in native PDF reader enabled (User)","description":"Lets the Microsoft Edge browser enable XFA (XML Forms Architecture) support in the native PDF reader and allows users to open XFA PDF files in the browser.\r\n\r\nIf you enable this policy, XFA support in the native PDF reader will be enabled.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will not enable XFA support in the native PDF reader.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_pdfxfaenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_pdfxfaenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_quicksearchshowminimenu","displayName":"Enables Microsoft Edge mini menu (User)","description":"Enables Microsoft Edge mini menu on websites and PDFs. The mini menu is triggered on text selection and has basic actions like copy and smart actions like definitions.\r\n\r\nIf you enable or don't config this policy, selecting text on websites and PDFs will show the Microsoft Edge mini menu.\r\n\r\nIf you disable this policy, the Microsoft Edge mini menu will not be shown when text on websites and PDFs is selected.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_quicksearchshowminimenu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_quicksearchshowminimenu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_recommended_askbeforecloseenabled_recommended","displayName":"Get user confirmation before closing a browser window with multiple tabs (User)","description":"This policy lets you configure whether users see a confirmation dialog before closing a browser window with multiple tabs. This dialog asks users to confirm that the browser window can be closed.\r\n\r\nIf you enable this policy, users will be presented with a confirmation dialog when closing a browser window with multiple tabs.\r\n\r\nIf you disable or don't configure this policy, a browser window with multiple tabs will close immediately without user confirmation.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_recommended_askbeforecloseenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_recommended_askbeforecloseenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_recommended_quicksearchshowminimenu_recommended","displayName":"Enables Microsoft Edge mini menu (User)","description":"Enables Microsoft Edge mini menu on websites and PDFs. The mini menu is triggered on text selection and has basic actions like copy and smart actions like definitions.\r\n\r\nIf you enable or don't config this policy, selecting text on websites and PDFs will show the Microsoft Edge mini menu.\r\n\r\nIf you disable this policy, the Microsoft Edge mini menu will not be shown when text on websites and PDFs is selected.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_recommended_quicksearchshowminimenu_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_recommended_quicksearchshowminimenu_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_textpredictionenabled","displayName":"Text prediction enabled by default (User)","description":"The Microsoft Turing service uses natural language processing to generate predictions for long-form editable text fields on web pages.\r\n\r\nIf you enable or don't configure this policy, text predictions will be provided for eligible text fields.\r\n\r\nIf you disable this policy, text predictions will not be provided in eligible text fields. Sites may still provide their own text predictions.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_textpredictionenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge_textpredictionenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge~passwordmanager_passwordmanagerrestrictlengthenabled","displayName":"Restrict the length of passwords that can be saved in the Password Manager (User)","description":"Make Microsoft Edge restrict the length of usernames and/or passwords that can be saved in the Password Manager.\r\n\r\nIf you enable this policy, Microsoft Edge will not let the user save credentials with usernames and/or passwords longer than 256 characters.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will let the user save credentials with arbitrarily long usernames and/or passwords.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge~passwordmanager_passwordmanagerrestrictlengthenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev104~policy~microsoft_edge~passwordmanager_passwordmanagerrestrictlengthenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_exemptfiletypedownloadwarnings","displayName":"Disable download file type extension-based warnings for specified file types on domains (User)","description":"You can enable this policy to create a dictionary of file type extensions with a corresponding list of domains that will be exempted from file type extension-based download warnings. This lets enterprise administrators block file type extension-based download warnings for files that are associated with a listed domain. For example, if the \"jnlp\" extension is associated with \"website1.com\", users would not see a warning when downloading \"jnlp\" files from \"website1.com\", but see a download warning when downloading \"jnlp\" files from \"website2.com\".\r\n\r\nFiles with file type extensions specified for domains identified by this policy will still be subject to non-file type extension-based security warnings such as mixed-content download warnings and Microsoft Defender SmartScreen warnings.\r\n\r\nIf you disable this policy or don't configure it, file types that trigger extension-based download warnings will show warnings to the user.\r\n\r\nIf you enable this policy:\r\n\r\n* The URL pattern should be formatted according to https://go.microsoft.com/fwlink/?linkid=2095322.\r\n* The file type extension entered must be in lower-cased ASCII. The leading separator should not be included when listing the file type extension, so list \"jnlp\" should be used instead of \".jnlp\".\r\n\r\nExample:\r\n\r\nThe following example value would prevent file type extension-based download warnings on swf, exe, and jnlp extensions for *.contoso.com domains. It will show the user a file type extension-based download warning on any other domain for exe and jnlp files, but not for swf files.\r\n\r\n[\r\n { \"file_extension\": \"jnlp\", \"domains\": [\"contoso.com\"] },\r\n { \"file_extension\": \"exe\", \"domains\": [\"contoso.com\"] },\r\n { \"file_extension\": \"swf\", \"domains\": [\"*\"] }\r\n]\r\n\r\nNote that while the preceding example shows the suppression of file type extension-based download warnings for \"swf\" files for all domains, applying suppression of such warnings for all domains for any dangerous file type extension is not recommended due to security concerns. It is shown in the example merely to demonstrate the ability to do so.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"domains\": [\r\n \"https://contoso.com\",\r\n \"contoso2.com\"\r\n ],\r\n \"file_extension\": \"jnlp\"\r\n },\r\n {\r\n \"domains\": [\r\n \"*\"\r\n ],\r\n \"file_extension\": \"swf\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_exemptfiletypedownloadwarnings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_exemptfiletypedownloadwarnings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_exemptfiletypedownloadwarnings_exemptfiletypedownloadwarnings","displayName":"Disable download file type extension-based warnings for specified file types on domains (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_internetexplorerintegrationalwayswaitforunload","displayName":"Wait for Internet Explorer mode tabs to completely unload before ending the browser session (User)","description":"This policy causes Microsoft Edge to continue running until all Internet Explorer tabs have completely finished unloading. This allows Internet Explorer plugins like ActiveX controls to perform additional critical work even after the browser has been closed. However, this can cause stability and performance issues, and Microsoft Edge processes may remain active in the background with no visible windows if the webpage or plugin prevents Internet Explorer from unloading. This policy should only be used if your organization depends on a plugin that requires this behavior.\r\n\r\nIf you enable this policy, Microsoft Edge will always wait for Internet Explorer mode tabs to fully unload before ending the browser session.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will not always wait for Internet Explorer mode tabs to fully unload before ending the browser session.\r\n\r\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2174004","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_internetexplorerintegrationalwayswaitforunload_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_internetexplorerintegrationalwayswaitforunload_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_microsofteditorproofingenabled","displayName":"Spell checking provided by Microsoft Editor (User)","description":"The Microsoft Editor service provides enhanced spell and grammar checking for editable text fields on web pages.\r\n\r\nIf you enable or don't configure this policy, Microsoft Editor spell check can be used for eligible text fields.\r\n\r\nIf you disable this policy, spell check can only be provided by local engines that use platform or Hunspell services. The results from these engines might be less informative than the results Microsoft Editor can provide.\r\n\r\nIf the 'SpellcheckEnabled' (Enable spellcheck) policy is set to disabled, or the user disables spell checking in the settings page, this policy will have no effect.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_microsofteditorproofingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_microsofteditorproofingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_microsofteditorsynonymsenabled","displayName":"Synonyms are provided when using Microsoft Editor spell checker (User)","description":"The Microsoft Editor service provides enhanced spell and grammar checking for editable text fields on web pages, and synonyms can be suggested as an integrated feature.\r\n\r\nIf you enable this policy, Microsoft Editor spell checker will provide synonyms for suggestions for misspelled words.\r\n\r\nIf you disable or don't configure this policy, Microsoft Editor spell checker will not provide synonyms for suggestions for misspelled words.\r\n\r\nIf the 'SpellcheckEnabled' (Enable spellcheck) policy or the 'MicrosoftEditorProofingEnabled' (Spell checking provided by Microsoft Editor) policy are set to disabled, or the user disables spell checking or chooses not to use Microsoft Editor spell checker in the settings page, this policy will have no effect.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_microsofteditorsynonymsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_microsofteditorsynonymsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_recommended_configurefriendlyurlformat_recommended","displayName":"Configure the default paste format of URLs copied from Microsoft Edge, and determine if additional formats will be available to users (User)","description":"If FriendlyURLs are enabled, Microsoft Edge will compute additional representations of the URL and place them on the clipboard.\r\n\r\nThis policy configures what format will be pasted when the user pastes in external applications, or inside Microsoft Edge without the 'Paste as' context menu item.\r\n\r\nIf configured, this policy makes a choice on behalf of the user. The options in edge://settings/shareCopyPaste will be grayed out, and the options in the 'Paste As' context menu will not be available.\r\n\r\n* Not configured = The user will be able to choose their preferred paste format. By default, this is set to the friendly URL format. The 'Paste As' menu will be available in Microsoft Edge.\r\n\r\n* 1 = No additional formats will be stored on the clipboard. There will be no 'Paste as' context menu item in Microsoft Edge and the only format available to paste will be the plain text URL format. Effectively, the friendly URL feature will be disabled.\r\n\r\n* 3 = The user will get a friendly URL whenever they paste into surfaces that accept rich text. The plain URL will still be available for non-rich surfaces. There will be no 'Paste As' menu in Microsoft Edge.\r\n\r\n* 4 = (Not currently used)\r\n\r\nThe richer formats may not be well-supported in some paste destinations and/or websites. In these scenarios, the plain URL option is recommended when configuring this policy.\r\n\r\nThe recommended policy is available in Microsoft Edge 105 or later.\r\n\r\nPolicy options mapping:\r\n\r\n* PlainText (1) = The plain URL without any extra information, such as the page's title. This is the recommended option when this policy is configured. For more information, see the description.\r\n\r\n* TitledHyperlink (3) = Titled Hyperlink: A hyperlink that points to the copied URL, but whose visible text is the title of the destination page. This is the Friendly URL format.\r\n\r\n* WebPreview (4) = Coming soon. If set, behaves the same as 'Plain URL'.\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_recommended_configurefriendlyurlformat_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_recommended_configurefriendlyurlformat_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_recommended_configurefriendlyurlformat_recommended_configurefriendlyurlformat","displayName":"Configure the default paste format of URLs copied from Microsoft Edge, and determine if additional formats will be available to users (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_recommended_configurefriendlyurlformat_recommended_configurefriendlyurlformat_1","displayName":"The plain URL without any extra information, such as the page's title. This is the recommended option when this policy is configured. For more information, see the description.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_recommended_configurefriendlyurlformat_recommended_configurefriendlyurlformat_3","displayName":"Titled Hyperlink: A hyperlink that points to the copied URL, but whose visible text is the title of the destination page. This is the Friendly URL format.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_recommended_configurefriendlyurlformat_recommended_configurefriendlyurlformat_4","displayName":"Coming soon. If set, behaves the same as 'Plain URL'.","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_unthrottlednestedtimeoutenabled","displayName":"JavaScript setTimeout will not be clamped until a higher nesting threshold is set (deprecated) (User)","description":"DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.\r\n\r\nThis policy is deprecated because it is a temporary policy for web standards compliance. It won't work in Microsoft Edge as soon as version 107.\r\nIf you enable this policy, the JavaScript setTimeout and setInterval, with an interval smaller than 4ms, will not be clamped. This improves short horizon performance, but websites abusing the API will still eventually have their setTimeout usages clamped.\r\nIf you disable or don't configure policy, the JavaScript setTimeout and setInterval, with an interval smaller than 4ms, will be clamped.\r\n\r\nThis is a web standards compliancy feature that may change task ordering on a web page, leading to unexpected behavior on sites that are dependent on a certain ordering.\r\nIt also may affect sites with a lot of usage of a timeout of 0ms for setTimeout. For example, increasing CPU load.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_unthrottlednestedtimeoutenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev105~policy~microsoft_edge_unthrottlednestedtimeoutenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev106~policy~microsoft_edge_internetexplorerintegrationalwaysuseoscapture","displayName":"Always use the OS capture engine to avoid issues with capturing Internet Explorer mode tabs (User)","description":"Configure this policy to control whether Microsoft Edge will use the \"OS capture engine\" or the \"Browser capture engine\" when capturing browser windows in the same process using the screen-share APIs.\r\n\r\nYou should configure this policy if you want to capture the contents of Internet Explorer mode tabs. However, enabling this policy may negatively impact performance when capturing browser windows in the same process.\r\n\r\nThis policy only affects window capture, not tab capture. The contents of Internet Explorer mode tabs will not be captured when you choose to capture only a single tab, even if you configure this policy.\r\n\r\nIf you enable this policy, Microsoft Edge will always use the OS capture engine for window capture. Internet Explorer mode tabs will have their contents captured.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will use the Browser capture engine for browser windows in the same process. Internet Explorer mode tabs in these windows will not have their contents captured.\r\n\r\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2174004","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev106~policy~microsoft_edge_internetexplorerintegrationalwaysuseoscapture_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev106~policy~microsoft_edge_internetexplorerintegrationalwaysuseoscapture_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev106~policy~microsoft_edge_recommended~performance_recommended_efficiencymodeenabled_recommended","displayName":"Efficiency mode enabled (User)","description":"Enables efficiency mode which helps extend battery life by saving computer resources. By default, efficiency mode is enabled for devices with a battery and disabled otherwise.\r\n\r\nIf you enable this policy, efficiency mode will become active according to the setting chosen by the user. You can configure the efficiency mode setting using the 'EfficiencyMode' (Configure when efficiency mode should become active) policy. If the device does not have a battery, efficiency mode will always be active.\r\n\r\nIf you disable this policy, efficiency mode will never become active. The 'EfficiencyMode' and 'EfficiencyModeOnPowerEnabled' (Enable efficiency mode when the device is connected to a power source) policies will have no effect.\r\n\r\nIf you don't configure this policy, efficiency mode will be enabled for devices with a battery and disabled otherwise. Users can choose the efficiency mode option they want in edge://settings/system.\r\n\r\nLearn more about efficiency mode: https://go.microsoft.com/fwlink/?linkid=2173921","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev106~policy~microsoft_edge_recommended~performance_recommended_efficiencymodeenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev106~policy~microsoft_edge_recommended~performance_recommended_efficiencymodeenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev106~policy~microsoft_edge_recommended~performance_recommended_efficiencymodeonpowerenabled_recommended","displayName":"Enable efficiency mode when the device is connected to a power source (User)","description":"Allows efficiency mode to become active when the device is connected to a power source. On devices with no battery, this policy has no effect.\r\n\r\nIf you enable this policy, efficiency mode will become active when the device is connected to a power source.\r\n\r\nIf you disable or don't configure this policy, efficiency mode will never become active when the device is connected to a power source.\r\n\r\nThis policy has no effect if the 'EfficiencyModeEnabled' (Efficiency mode enabled) policy is disabled.\r\n\r\nLearn more about efficiency mode: https://go.microsoft.com/fwlink/?linkid=2173921","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev106~policy~microsoft_edge_recommended~performance_recommended_efficiencymodeonpowerenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev106~policy~microsoft_edge_recommended~performance_recommended_efficiencymodeonpowerenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev106~policy~microsoft_edge~performance_efficiencymodeenabled","displayName":"Efficiency mode enabled (User)","description":"Enables efficiency mode which helps extend battery life by saving computer resources. By default, efficiency mode is enabled for devices with a battery and disabled otherwise.\r\n\r\nIf you enable this policy, efficiency mode will become active according to the setting chosen by the user. You can configure the efficiency mode setting using the 'EfficiencyMode' (Configure when efficiency mode should become active) policy. If the device does not have a battery, efficiency mode will always be active.\r\n\r\nIf you disable this policy, efficiency mode will never become active. The 'EfficiencyMode' and 'EfficiencyModeOnPowerEnabled' (Enable efficiency mode when the device is connected to a power source) policies will have no effect.\r\n\r\nIf you don't configure this policy, efficiency mode will be enabled for devices with a battery and disabled otherwise. Users can choose the efficiency mode option they want in edge://settings/system.\r\n\r\nLearn more about efficiency mode: https://go.microsoft.com/fwlink/?linkid=2173921","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev106~policy~microsoft_edge~performance_efficiencymodeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev106~policy~microsoft_edge~performance_efficiencymodeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev106~policy~microsoft_edge~performance_efficiencymodeonpowerenabled","displayName":"Enable efficiency mode when the device is connected to a power source (User)","description":"Allows efficiency mode to become active when the device is connected to a power source. On devices with no battery, this policy has no effect.\r\n\r\nIf you enable this policy, efficiency mode will become active when the device is connected to a power source.\r\n\r\nIf you disable or don't configure this policy, efficiency mode will never become active when the device is connected to a power source.\r\n\r\nThis policy has no effect if the 'EfficiencyModeEnabled' (Efficiency mode enabled) policy is disabled.\r\n\r\nLearn more about efficiency mode: https://go.microsoft.com/fwlink/?linkid=2173921","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev106~policy~microsoft_edge~performance_efficiencymodeonpowerenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev106~policy~microsoft_edge~performance_efficiencymodeonpowerenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev106~policy~microsoft_edge~printing_printpdfasimagedefault","displayName":"Print PDF as Image Default (User)","description":"Controls if Microsoft Edge makes the Print as image option the default when printing PDFs.\r\n\r\nIf you enable this policy, Microsoft Edge will default to setting the Print as image option in the Print Preview when printing a PDF.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will not default to setting the Print as image option in the Print Preview when printing a PDF.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev106~policy~microsoft_edge~printing_printpdfasimagedefault_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev106~policy~microsoft_edge~printing_printpdfasimagedefault_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_enhancesecuritymodebypassintranet","displayName":"Enhanced Security Mode configuration for Intranet zone sites (User)","description":"Microsoft Edge will apply Enhanced Security Mode on Intranet zone sites by default. This may lead to Intranet zone sites acting in an unexpected manner.\r\n\r\nIf you enable this policy, Microsoft Edge won't apply Enhanced Security Mode on Intranet zone sites.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will apply Enhanced Security Mode on Intranet zone sites.\r\n\r\nFor detailed information about Enhanced Security Mode, see https://go.microsoft.com/fwlink/?linkid=2185895","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_enhancesecuritymodebypassintranet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_enhancesecuritymodebypassintranet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_eventpathenabled","displayName":"Re-enable the Event.path API until Microsoft Edge version 115 (User)","description":"Starting in Microsoft Edge version 109, the non-standard API Event.path will be removed to improve web compatibility. This policy re-enables the API until version 115.\r\n\r\nIf you enable this policy, the Event.path API will be available.\r\n\r\nIf you disable this policy, the Event.path API will be unavailable.\r\n\r\nIf this policy is not set, the Event.path API will be in the following default states: available before version 109, and unavailable in version 109 to version 114.\r\n\r\nThis policy will be made obsolete after Microsoft Edge version 115.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_eventpathenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_eventpathenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_internetexplorerintegrationlocalmhtfileallowed","displayName":"Allow local MHTML files to open automatically in Internet Explorer mode (User)","description":"This policy controls whether local mht or mhtml files launched from the command line can open automatically in Internet Explorer mode based on the file content without specifying the --ie-mode-file-url command line.\r\n\r\nThis setting works in conjunction with:\r\n'InternetExplorerIntegrationLevel' (Configure Internet Explorer integration) is set to 'IEMode'\r\nand\r\n'InternetExplorerIntegrationLocalFileAllowed' (Allow launching of local files in Internet Explorer mode) is enabled or not configured.\r\n\r\nIf you enable or don't configure this policy, local mht or mhtml files can launch in Microsoft Edge or Internet Explorer mode to best view the file.\r\n\r\nIf you disable this policy, local mht or mhtml files will launch in Microsoft Edge.\r\n\r\nNote that if you use the --ie-mode-file-url command line argument for launching local mht or mhtml files, it takes precedence over how you configured this policy.\r\n\r\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_internetexplorerintegrationlocalmhtfileallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_internetexplorerintegrationlocalmhtfileallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_recommended~performance_recommended_performancedetectorenabled_recommended","displayName":"Performance Detector Enabled (User)","description":"The performance detector detects tab performance issues and recommends actions to fix the performance issues.\r\n\r\nIf you enable or don't configure this policy, performance detector is turned on.\r\n\r\nIf you disable this policy, performance detector is turned off.\r\n\r\nThe user can configure its behavior in edge://settings/system.\r\n\r\nLearn more about performance detector: https://aka.ms/EdgePerformanceDetector","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_recommended~performance_recommended_performancedetectorenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_recommended~performance_recommended_performancedetectorenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_webselectenabled","displayName":"Web Select Enabled (User)","description":"Web select lets users select and copy web content while preserving its formatting when pasted in most cases. It also allows more targeted selection on some web elements, such as copying a single column in a table.\r\n\r\nIf you enable or don't configure this policy, Web select is available through the right click context menu and the CTRL+SHIFT+X keyboard shortcut.\r\n\r\nIf you disable this policy, Web select won't be available.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_webselectenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_webselectenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_websqlaccess","displayName":"Force WebSQL to be enabled (User)","description":"WebSQL is on by default as of Microsoft Edge version 101, but can be disabled via a Microsoft Edge flag.\r\nIf you enable this policy, WebSQL cannot be disabled.\r\nIf you disable or don't configure this policy, WebSQL can be disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_websqlaccess_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_websqlaccess_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_websqlnonsecurecontextenabled","displayName":"Force WebSQL in non-secure contexts to be enabled (deprecated) (User)","description":"DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.\r\n\r\nThis policy is deprecated because it is a temporary policy to support WebSQL in non-secure contexts. It won't work in Microsoft Edge as soon as version 110.\r\nIf you enable this policy, WebSQL in non-secure contexts will be enabled.\r\nIf you disable or don't configure this policy, WebSQL in non-secure contexts will follow the default settings of the broser.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_websqlnonsecurecontextenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge_websqlnonsecurecontextenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge~edgeworkspaces_edgeworkspacesenabled","displayName":"Enable Workspaces (User)","description":"Microsoft Edge Workspaces helps improve productivity for users in your organization.\r\n\r\nIf you enable this policy, users will be able to access the Microsoft Edge Workspaces feature.\r\nIf you disable or don't configure this policy, users will not be able to access the Microsoft Edge Workspaces feature.\r\n\r\nTo learn more about the feature, see https://go.microsoft.com/fwlink/?linkid=2209950","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge~edgeworkspaces_edgeworkspacesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge~edgeworkspaces_edgeworkspacesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge~identity_linkedaccountenabled","displayName":"Enable the linked account feature (User)","description":"Microsoft Edge guides a user to the account management page where they can link a Microsoft Account (MSA) to an Azure Active Directory (Azure AD) account.\r\n\r\nIf you enable or don't configure this policy, linked account information will be shown on a flyout. When the Azure AD profile doesn't have a linked account it will show \"Add account\".\r\n\r\nIf you disable this policy, linked accounts will be turned off and no extra information will be shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge~identity_linkedaccountenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge~identity_linkedaccountenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge~performance_performancedetectorenabled","displayName":"Performance Detector Enabled (User)","description":"The performance detector detects tab performance issues and recommends actions to fix the performance issues.\r\n\r\nIf you enable or don't configure this policy, performance detector is turned on.\r\n\r\nIf you disable this policy, performance detector is turned off.\r\n\r\nThe user can configure its behavior in edge://settings/system.\r\n\r\nLearn more about performance detector: https://aka.ms/EdgePerformanceDetector","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge~performance_performancedetectorenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge~performance_performancedetectorenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge~startup_restoreonstartupuserurlsenabled","displayName":"Allow users to add and remove their own sites during startup when the RestoreOnStartupURLs policy is configured (User)","description":"If you enable this policy, users are allowed to add and remove their own URLs to open when starting Edge while maintaining the admin specified mandatory list of sites specified by setting 'RestoreOnStartup' (Action to take on startup) policy to open a list of URLS and providing the list of sites in the 'RestoreOnStartupURLs' (Sites to open when the browser starts) policy.\r\n\r\nIf you disable or don't configure this policy, there is no change to how the 'RestoreOnStartup' and 'RestoreOnStartupURLs' policies work.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge~startup_restoreonstartupuserurlsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev107~policy~microsoft_edge~startup_restoreonstartupuserurlsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge_defaultshareadditionalosregionsetting","displayName":"Set the default \"share additional operating system region\" setting (User)","description":"This policy controls the default value for the \"share additional operating system region\" setting in Microsoft Edge.\r\n\r\nThe \"share additional operating system region\" Microsoft Edge setting controls whether the OS Regional format setting will be shared with the web through the default JavaScript locale. If shared, websites will be able to query the OS Regional format using JavaScript code, for example; \"Intl.DateTimeFormat().resolvedOptions().locale\". The default value for the setting is \"Limited\".\r\n\r\nIf you set this policy to \"Limited\", the OS Regional format will only be shared if its language part matches the Microsoft Edge display language.\r\n\r\nIf you set this policy to \"Always\", the OS Regional format will always be shared. This value could cause unexpected website behavior if the OS Regional format language is different from the Microsoft Edge display language. For example, if a website uses the JavaScript default locale to format dates, the names of the days and months can be displayed in one language while the surrounding text is displayed in another language.\r\n\r\nIf you set this policy to \"Never\", the OS Regional format will never be shared.\r\n\r\nExample 1: In this example the OS Regional format is set to \"en-GB\" and the browser display language is set to \"en-US\". Then the OS Regional format will be shared if the policy is set to \"Limited\", or \"Always\".\r\n\r\nExample 2: In this example the OS Regional format is set to \"es-MX\" and the browser display language is set to \"en-US\". Then the OS Regional format will be shared if the policy is set to \"Always\" but will not if the policy is set to \"Limited\".\r\n\r\nFor more information about this setting, see https://go.microsoft.com/fwlink/?linkid=2222282\r\n\r\nPolicy options mapping:\r\n\r\n* Limited (0) = Limited\r\n\r\n* Always (1) = Always share the OS Regional format\r\n\r\n* Never (2) = Never share the OS Regional format\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge_defaultshareadditionalosregionsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge_defaultshareadditionalosregionsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge_defaultshareadditionalosregionsetting_defaultshareadditionalosregionsetting","displayName":"'Set the default \"share additional operating system region\" setting (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge_defaultshareadditionalosregionsetting_defaultshareadditionalosregionsetting_0","displayName":"Limited","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge_defaultshareadditionalosregionsetting_defaultshareadditionalosregionsetting_1","displayName":"Always share the OS Regional format","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge_defaultshareadditionalosregionsetting_defaultshareadditionalosregionsetting_2","displayName":"Never share the OS Regional format","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge_encryptedclienthelloenabled","displayName":"TLS Encrypted ClientHello Enabled (User)","description":"Encrypted ClientHello (ECH) is an extension to TLS that encrypts the sensitive fields of ClientHello to improve privacy.\r\n\r\nIf ECH is enabled, Microsoft Edge might or might not use ECH depending on server support, the availability of the HTTPS DNS record, or the rollout status.\r\n\r\nIf you enable or do not configure this policy, Microsoft Edge will follow the default rollout process for ECH.\r\n\r\nIf this policy is disabled, Microsoft Edge will not enable ECH.\r\n\r\nBecause ECH is an evolving protocol, Microsoft Edge's implementation is subject to change.\r\n\r\nAs such, this policy is a temporary measure to control the initial experimental implementation. It will be replaced with final controls as the protocol finalizes.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge_encryptedclienthelloenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge_encryptedclienthelloenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge_recommended_defaultshareadditionalosregionsetting_recommended","displayName":"Set the default \"share additional operating system region\" setting (User)","description":"This policy controls the default value for the \"share additional operating system region\" setting in Microsoft Edge.\r\n\r\nThe \"share additional operating system region\" Microsoft Edge setting controls whether the OS Regional format setting will be shared with the web through the default JavaScript locale. If shared, websites will be able to query the OS Regional format using JavaScript code, for example; \"Intl.DateTimeFormat().resolvedOptions().locale\". The default value for the setting is \"Limited\".\r\n\r\nIf you set this policy to \"Limited\", the OS Regional format will only be shared if its language part matches the Microsoft Edge display language.\r\n\r\nIf you set this policy to \"Always\", the OS Regional format will always be shared. This value could cause unexpected website behavior if the OS Regional format language is different from the Microsoft Edge display language. For example, if a website uses the JavaScript default locale to format dates, the names of the days and months can be displayed in one language while the surrounding text is displayed in another language.\r\n\r\nIf you set this policy to \"Never\", the OS Regional format will never be shared.\r\n\r\nExample 1: In this example the OS Regional format is set to \"en-GB\" and the browser display language is set to \"en-US\". Then the OS Regional format will be shared if the policy is set to \"Limited\", or \"Always\".\r\n\r\nExample 2: In this example the OS Regional format is set to \"es-MX\" and the browser display language is set to \"en-US\". Then the OS Regional format will be shared if the policy is set to \"Always\" but will not if the policy is set to \"Limited\".\r\n\r\nFor more information about this setting, see https://go.microsoft.com/fwlink/?linkid=2222282\r\n\r\nPolicy options mapping:\r\n\r\n* Limited (0) = Limited\r\n\r\n* Always (1) = Always share the OS Regional format\r\n\r\n* Never (2) = Never share the OS Regional format\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge_recommended_defaultshareadditionalosregionsetting_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge_recommended_defaultshareadditionalosregionsetting_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge_recommended_defaultshareadditionalosregionsetting_recommended_defaultshareadditionalosregionsetting","displayName":"'Set the default \"share additional operating system region\" setting (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge_recommended_defaultshareadditionalosregionsetting_recommended_defaultshareadditionalosregionsetting_0","displayName":"Limited","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge_recommended_defaultshareadditionalosregionsetting_recommended_defaultshareadditionalosregionsetting_1","displayName":"Always share the OS Regional format","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge_recommended_defaultshareadditionalosregionsetting_recommended_defaultshareadditionalosregionsetting_2","displayName":"Never share the OS Regional format","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge~startup_newtabpageapplauncherenabled","displayName":"Hide App Launcher on Microsoft Edge new tab page (User)","description":"By default, the App Launcher is shown every time a user opens a new tab page.\r\n\r\nIf you enable or don't configure this policy, there is no change on the Microsoft Edge new tab page and App Launcher is there for users.\r\n\r\nIf you disable this policy, App Launcher doesn't appear and users won't be able to launch M365 apps from Microsoft Edge new tab page via the App Launcher.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge~startup_newtabpageapplauncherenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev108~policy~microsoft_edge~startup_newtabpageapplauncherenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge_clipboardallowedforurls","displayName":"Allow clipboard use on specific sites (User)","description":"Configure the list of URL patterns that specify which sites can use the clipboard site permission.\r\n\r\nSetting the policy lets you create a list of URL patterns that specify which sites can use the clipboard site permission. This doesn't include all clipboard operations on origins that match the patterns. For example, users will still be able to paste using keyboard shortcuts because this isn't controlled by the clipboard site permission.\r\n\r\nLeaving the policy unset means 'DefaultClipboardSetting' (Default clipboard site permission) applies for all sites if it's set. If it isn't set, the user's personal setting applies.\r\n\r\nFor more information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge_clipboardallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge_clipboardallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge_clipboardallowedforurls_clipboardallowedforurlsdesc","displayName":"Allow clipboard use on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge_clipboardblockedforurls","displayName":"Block clipboard use on specific sites (User)","description":"Configure the list of URL patterns that specify which sites can use the clipboard site permission.\r\n\r\nSetting the policy lets you create a list of URL patterns that specify sites that can't use the clipboard site permission. This doesn't include all clipboard operations on origins that match the patterns. For example, users will still be able to paste using keyboard shortcuts because this isn't controlled by the clipboard site permission.\r\n\r\nLeaving the policy unset means 'DefaultClipboardSetting' (Default clipboard site permission) applies for all sites if it's set. If it isn't set, the user's personal setting applies.\r\n\r\nFor more information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge_clipboardblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge_clipboardblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge_clipboardblockedforurls_clipboardblockedforurlsdesc","displayName":"Block clipboard use on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge_defaultclipboardsetting","displayName":"Default clipboard site permission (User)","description":"This policy controls the default value for the clipboard site permission.\r\n\r\nSetting the policy to 2 blocks sites from using the clipboard site permission.\r\n\r\nSetting the policy to 3 or leaving it unset lets the user change the setting and decide if the clipboard APIs are available when a site wants to use an API.\r\n\r\nThis policy can be overridden for specific URL patterns using the 'ClipboardAllowedForUrls' (Allow clipboard use on specific sites) and 'ClipboardBlockedForUrls' (Block clipboard use on specific sites) policies.\r\n\r\nThis policy only affects clipboard operations controlled by the clipboard site permission and doesn't affect sanitized clipboard writes or trusted copy and paste operations.\r\n\r\nPolicy options mapping:\r\n\r\n* BlockClipboard (2) = Do not allow any site to use the clipboard site permission\r\n\r\n* AskClipboard (3) = Allow sites to ask the user to grant the clipboard site permission\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge_defaultclipboardsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge_defaultclipboardsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge_defaultclipboardsetting_defaultclipboardsetting","displayName":"Default clipboard site permission (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge_defaultclipboardsetting_defaultclipboardsetting_2","displayName":"Do not allow any site to use the clipboard site permission","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge_defaultclipboardsetting_defaultclipboardsetting_3","displayName":"Allow sites to ask the user to grant the clipboard site permission","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge_microsoftrootstoreenabled","displayName":"Determines whether the Microsoft Root Store and built-in certificate verifier will be used to verify server certificates (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 114.\r\n\r\nWhen this policy is set to enabled, Microsoft Edge will perform verification of server certificates using the built-in certificate verifier with the Microsoft Root Store as the source of public trust.\r\n\r\nWhen this policy is set to disabled, Microsoft Edge will use the system certificate verifier and system root certificates.\r\n\r\nWhen this policy is not set, the Microsoft Root Store or system provided roots may be used.\r\n\r\nThis policy is planned to be removed in Microsoft Edge version\r\n121 for Android devices when support for using the platform supplied roots is planned to be removed.\r\n\r\nThis policy was removed in Microsoft Edge version 115 for\r\nMicrosoft Windows and macOS,\r\nMicrosoft Edge version 120 for\r\nLinux, and\r\nMicrosoft Edge version 121 for\r\nAndroid\r\nwhen support for using the platform supplied certificate verifier and roots was removed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge_microsoftrootstoreenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge_microsoftrootstoreenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge~contentsettings_webhidallowalldevicesforurls","displayName":"Allow listed sites to connect to any HID device (User)","description":"This setting allows you to list sites which are automatically granted permission to access all available devices.\r\n\r\nThe URLs must be valid or the policy is ignored. Only the origin (scheme, host and port) of the URL is evaluated.\r\n\r\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.\r\n\r\nThis policy overrides 'DefaultWebHidGuardSetting' (Control use of the WebHID API), 'WebHidAskForUrls' (Allow the WebHID API on these sites), 'WebHidBlockedForUrls' (Block the WebHID API on these sites) and the user's preferences.\r\n\r\nExample value:\r\n\r\nhttps://microsoft.com\r\nhttps://chromium.org","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge~contentsettings_webhidallowalldevicesforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge~contentsettings_webhidallowalldevicesforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge~contentsettings_webhidallowalldevicesforurls_webhidallowalldevicesforurlsdesc","displayName":"Allow listed sites to connect to any HID device (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge~contentsettings_webhidallowdevicesforurls","displayName":"Allow listed sites connect to specific HID devices (User)","description":"This setting lets you list the URLs that specify which sites are automatically granted permission to access a HID device with the given vendor and product IDs.\r\n\r\nSetting the policy Each item in the list requires both devices and urls fields for the item to be valid, otherwise the item is ignored.\r\n\r\n * Each item in the devices field must have a vendor_id and may have a product_id field.\r\n\r\n * Omitting the product_id field will create a policy matching any device with the specified vendor ID.\r\n\r\n * An item which has a product_id field without a vendor_id field is invalid and is ignored.\r\n\r\nIf you don't set this policy, that means 'DefaultWebHidGuardSetting' (Control use of the WebHID API) applies, if it's set. If not, the user's personal setting applies.\r\n\r\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.\r\n\r\nURLs in this policy shouldn't conflict with those configured through 'WebHidBlockedForUrls' (Block the WebHID API on these sites). If they do, this policy takes precedence over 'WebHidBlockedForUrls'.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"devices\": [\r\n {\r\n \"product_id\": 5678,\r\n \"vendor_id\": 1234\r\n }\r\n ],\r\n \"urls\": [\r\n \"https://microsoft.com\",\r\n \"https://chromium.org\"\r\n ]\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge~contentsettings_webhidallowdevicesforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge~contentsettings_webhidallowdevicesforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge~contentsettings_webhidallowdevicesforurls_webhidallowdevicesforurls","displayName":"Allow listed sites connect to specific HID devices (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge~contentsettings_webhidallowdeviceswithhidusagesforurls","displayName":"Automatically grant permission to these sites to connect to HID devices containing top-level collections with the given HID usage (User)","description":"This setting allows you to list the URLs that specify which sites are automatically granted permission to access a HID device containing a top-level collection with the given HID usage.\r\n\r\nEach item in the list requires both usages and urls fields for the policy to be valid.\r\n\r\n * Each item in the usages field must have a usage_page and may have a usage field.\r\n\r\n * Omitting the usage field will create a policy matching any device containing a top-level collection with a usage from the specified usage page.\r\n\r\n * An item which has a usage field without a usage_page field is invalid and is ignored.\r\n\r\nIf you don't set this policy, that means 'DefaultWebHidGuardSetting' (Control use of the WebHID API) applies, if it's set. If not, the user's personal setting applies.\r\n\r\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.\r\n\r\nURLs in this policy shouldn't conflict with those configured through 'WebHidBlockedForUrls' (Block the WebHID API on these sites). If they do, this policy takes precedence over 'WebHidBlockedForUrls'.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"urls\": [\r\n \"https://microsoft.com\",\r\n \"https://chromium.org\"\r\n ],\r\n \"usages\": [\r\n {\r\n \"usage\": 5678,\r\n \"usage_page\": 1234\r\n }\r\n ]\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge~contentsettings_webhidallowdeviceswithhidusagesforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge~contentsettings_webhidallowdeviceswithhidusagesforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev109~policy~microsoft_edge~contentsettings_webhidallowdeviceswithhidusagesforurls_webhidallowdeviceswithhidusagesforurls","displayName":"Automatically grant permission to these sites to connect to HID devices containing top-level collections with the given HID usage (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_autofillmembershipsenabled","displayName":"Save and fill memberships (User)","description":"This policy lets you decide whether users can have their membership info (for example, program name and membership number) automatically saved and used to fill form fields while using Microsoft Edge. By default, users can choose whether to enable it or not.\r\n\r\nIf you enable this policy, users can only have their membership info automatically saved and used to fill form fields while using Microsoft Edge.\r\n\r\nIf you don't configure this policy, users can choose whether to have their membership info automatically saved and used to fill form fields while using Microsoft Edge.\r\n\r\nIf you disable this policy, users can't have their membership info automatically saved and used to fill form fields while using Microsoft Edge.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_autofillmembershipsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_autofillmembershipsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_recommended_autofillmembershipsenabled_recommended","displayName":"Save and fill memberships (User)","description":"This policy lets you decide whether users can have their membership info (for example, program name and membership number) automatically saved and used to fill form fields while using Microsoft Edge. By default, users can choose whether to enable it or not.\r\n\r\nIf you enable this policy, users can only have their membership info automatically saved and used to fill form fields while using Microsoft Edge.\r\n\r\nIf you don't configure this policy, users can choose whether to have their membership info automatically saved and used to fill form fields while using Microsoft Edge.\r\n\r\nIf you disable this policy, users can't have their membership info automatically saved and used to fill form fields while using Microsoft Edge.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_recommended_autofillmembershipsenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_recommended_autofillmembershipsenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_recommended_searchfiltersenabled_recommended","displayName":"Search Filters Enabled (User)","description":"Lets you filter your autosuggestions by selecting a filter from the search filters ribbon. For example, if you select the \"Favorites\" filter, only favorites suggestions will be shown.\r\n\r\nIf you enable or don't configure this policy, the autosuggestion dropdown defaults to displaying the ribbon of available filters.\r\n\r\nIf you disable this policy, the autosuggestion dropdown won't display the ribbon of available filters.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_recommended_searchfiltersenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_recommended_searchfiltersenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_recommended~printing_recommended_printpreviewstickysettings_recommended","displayName":"Configure the sticky print preview settings (User)","description":"Configuring this policy sets the print preview settings as the most recent choice in Print Preview instead of the default print preview settings.\r\n\r\nEach item of this policy expects a boolean:\r\n\r\nLayout specifies if the webpage layout should be kept sticky or not in print preview settings. If we set this to True the webpage layout uses the recent choice otherwise it will set to default value.\r\n\r\nSize specifies if the page size should be kept sticky or not in print preview settings. If we set this to True the page size uses the recent choice otherwise it will set to default value.\r\n\r\nScale Type specifies if the scaling percentage and scale type should be kept sticky or not in print preview settings. If we set this to True the scale percentage and scale type both uses the recent choice oherwise it will set to default value.\r\n\r\nMargins specifies if the page margin should be kept sticky or not in print preview settings. If we set this to True the page margins uses the recent choice otherwise it will set to default value.\r\n\r\nIf you enable this policy, the selected values will use the most recent choice in Print Preview.\r\n\r\nIf you disable or don't configure this policy, print preview settings will not be impacted.\r\n\r\nExample value:\r\n\r\n{\r\n \"layout\": false,\r\n \"margins\": true,\r\n \"scaleType\": false,\r\n \"size\": true\r\n}\r\n\r\n\r\nCompact example value:\r\n\r\n{\"layout\": false, \"margins\": true, \"scaleType\": false, \"size\": true}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_recommended~printing_recommended_printpreviewstickysettings_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_recommended~printing_recommended_printpreviewstickysettings_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_recommended~printing_recommended_printpreviewstickysettings_recommended_printpreviewstickysettings","displayName":"Configure the sticky print preview settings (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_searchfiltersenabled","displayName":"Search Filters Enabled (User)","description":"Lets you filter your autosuggestions by selecting a filter from the search filters ribbon. For example, if you select the \"Favorites\" filter, only favorites suggestions will be shown.\r\n\r\nIf you enable or don't configure this policy, the autosuggestion dropdown defaults to displaying the ribbon of available filters.\r\n\r\nIf you disable this policy, the autosuggestion dropdown won't display the ribbon of available filters.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_searchfiltersenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_searchfiltersenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_searchinsidebarenabled","displayName":"Search in Sidebar enabled (User)","description":"Search in Sidebar allows users to open search result in sidebar (including sidebar search for Progressive Web Apps).\r\n\r\nIf you configure this policy to 'EnableSearchInSidebar' or don't configure it, Search in sidebar will be enabled.\r\n\r\nIf you configure this policy to 'DisableSearchInSidebarForKidsMode', Search in sidebar will be disabled when in Kids mode. Some methods that would normally invoke sidebar search will invoke a traditional search instead.\r\n\r\nIf you configure this policy to 'DisableSearchInSidebar', Search in sidebar will be disabled. Some methods that would normally invoke sidebar search will invoke a traditional search instead.\r\n\r\nPolicy options mapping:\r\n\r\n* EnableSearchInSidebar (0) = Enable search in sidebar\r\n\r\n* DisableSearchInSidebarForKidsMode (1) = Disable search in sidebar for Kids Mode\r\n\r\n* DisableSearchInSidebar (2) = Disable search in sidebar\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_searchinsidebarenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_searchinsidebarenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_searchinsidebarenabled_searchinsidebarenabled","displayName":"Search in Sidebar enabled (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_searchinsidebarenabled_searchinsidebarenabled_0","displayName":"Enable search in sidebar","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_searchinsidebarenabled_searchinsidebarenabled_1","displayName":"Disable search in sidebar for Kids Mode","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge_searchinsidebarenabled_searchinsidebarenabled_2","displayName":"Disable search in sidebar","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~contentsettings_automaticdownloadsallowedforurls","displayName":"Allow multiple automatic downloads in quick succession on specific sites (User)","description":"Define a list of sites, based on URL patterns, that are allowed to perform multiple successive automatic downloads.\r\nIf you don't configure this policy, 'DefaultAutomaticDownloadsSetting' (Default automatic downloads setting) applies for all sites, if it's set. If it isn't set, then the user's personal setting applies.\r\nFor more detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.\r\n\r\nExample value:\r\n\r\nhttps://contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~contentsettings_automaticdownloadsallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~contentsettings_automaticdownloadsallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~contentsettings_automaticdownloadsallowedforurls_automaticdownloadsallowedforurlsdesc","displayName":"Allow multiple automatic downloads in quick succession on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~contentsettings_automaticdownloadsblockedforurls","displayName":"Block multiple automatic downloads in quick succession on specific sites (User)","description":"Define a list of sites, based on URL patterns, where multiple successive automatic downloads aren't allowed.\r\nIf you don't configure this policy, 'DefaultAutomaticDownloadsSetting' (Default automatic downloads setting) applies for all sites, if it's set. If it isn't set, then the user's personal setting applies.\r\nFor more detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.\r\n\r\nExample value:\r\n\r\nhttps://contoso.com\r\n[*.]contoso.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~contentsettings_automaticdownloadsblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~contentsettings_automaticdownloadsblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~contentsettings_automaticdownloadsblockedforurls_automaticdownloadsblockedforurlsdesc","displayName":"Block multiple automatic downloads in quick succession on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~contentsettings_defaultautomaticdownloadssetting","displayName":"Default automatic downloads setting (User)","description":"Administrators can use this policy to control whether websites can perform multiple downloads successively. Individual site behavior can be managed using the AutomaticDownloadsAllowedForUrls and AutomaticDownloadsBlockedForUrls policies.\r\n\r\nDefault behavior:\r\n\r\n- A user gesture is required for each additional download.\r\n\r\n- Users can modify their browser settings to disable successive downloads.\r\n\r\nPolicy options mapping:\r\n\r\n* AllowAutomaticDownloads (1) = Allow all websites to perform multiple downloads without requiring a user gesture between each download.\r\n\r\n* BlockAutomaticDownloads (2) = Prevent all websites from performing multiple downloads, even after a user gesture.\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~contentsettings_defaultautomaticdownloadssetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~contentsettings_defaultautomaticdownloadssetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~contentsettings_defaultautomaticdownloadssetting_defaultautomaticdownloadssetting","displayName":"Default automatic downloads setting (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~contentsettings_defaultautomaticdownloadssetting_defaultautomaticdownloadssetting_1","displayName":"Allow all websites to perform automatic downloads","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~contentsettings_defaultautomaticdownloadssetting_defaultautomaticdownloadssetting_2","displayName":"Don't allow any website to perform automatic downloads","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~edgeworkspaces_workspacesnavigationsettings","displayName":"Configure navigation settings per groups of URLs in Microsoft Edge Workspaces (User)","description":"This setting lets you to define groups of URLs, and apply specific Microsoft Edge Workspaces navigation settings to each group.\r\n\r\nIf this policy is configured, Microsoft Edge Workspaces will use the configured settings when deciding whether and how to share navigations among collaborators in a Microsoft Edge Workspace.\r\n\r\nIf this policy is not configured, Microsoft Edge Workspaces will use only default and internally configured navigation settings.\r\n\r\nFor more information about configuration options, see https://go.microsoft.com/fwlink/?linkid=2218655\r\n\r\nNote, format url_patterns according to https://go.microsoft.com/fwlink/?linkid=2095322. You can configure the url_regex_patterns in this policy to match multiple URLs using a Perl style regular expression for the pattern. Note that pattern matches are case sensitive. For more information about the regular expression rules that are used, refer to https://go.microsoft.com/fwlink/p/?linkid=2133903.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"navigation_options\": {\r\n \"do_not_send_to\": true,\r\n \"remove_all_query_parameters\": true\r\n },\r\n \"url_patterns\": [\r\n \"https://contoso.com\",\r\n \"https://www.fabrikam.com\",\r\n \".exact.hostname.com\"\r\n ]\r\n },\r\n {\r\n \"navigation_options\": {\r\n \"query_parameters_to_remove\": [\r\n \"username\",\r\n \"login_hint\"\r\n ]\r\n },\r\n \"url_patterns\": [\r\n \"https://adatum.com\"\r\n ]\r\n },\r\n {\r\n \"navigation_options\": {\r\n \"do_not_send_from\": true,\r\n \"prefer_initial_url\": true\r\n },\r\n \"url_regex_patterns\": [\r\n \"\\\\Ahttps://.*?tafe\\\\..*?trs.*?\\\\.fabrikam.com/Sts\"\r\n ]\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~edgeworkspaces_workspacesnavigationsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~edgeworkspaces_workspacesnavigationsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~edgeworkspaces_workspacesnavigationsettings_workspacesnavigationsettings","displayName":"Configure navigation settings per groups of URLs in Microsoft Edge Workspaces (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~immersivereader_immersivereadergrammartoolsenabled","displayName":"Enable Grammar Tools feature within Immersive Reader in Microsoft Edge (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 125.\r\n\r\nThis policy is obsoleted because Grammar Tools is deprecated from Edge. This policy won't work in Microsoft Edge version 126. Enables the Grammar Tools feature within Immersive Reader in Microsoft Edge.\r\nThis helps improve reading comprehension by splitting words into syllables and highlighting nouns, verbs, adverbs, and adjectives.\r\n\r\nIf you enable this policy or don't configure it, the Grammar Tools option shows up within Immersive Reader.\r\nIf you disable this policy, users can't access the Grammar Tools feature within Immersive Reader.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~immersivereader_immersivereadergrammartoolsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~immersivereader_immersivereadergrammartoolsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~immersivereader_immersivereaderpicturedictionaryenabled","displayName":"Enable Picture Dictionary feature within Immersive Reader in Microsoft Edge (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 126.\r\n\r\nThis Policy is obsoleted because Picture Dictionary is deprecated from Edge as of Sept, 2023. This policy won't work in Microsoft Edge Version 127. Enables the Picture Dictionary feature within Immersive Reader in Microsoft Edge.\r\nThis feature helps in reading comprehension by letting a user to click on any single word and see an illustration related to the meaning.\r\n\r\nIf you enable this policy or don't configure it, the Picture Dictionary option shows up within Immersive Reader.\r\nIf you disable this policy, users can't access the Picture Dictionary feature within Immersive Reader.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~immersivereader_immersivereaderpicturedictionaryenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~immersivereader_immersivereaderpicturedictionaryenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~printing_printpreviewstickysettings","displayName":"Configure the sticky print preview settings (User)","description":"Configuring this policy sets the print preview settings as the most recent choice in Print Preview instead of the default print preview settings.\r\n\r\nEach item of this policy expects a boolean:\r\n\r\nLayout specifies if the webpage layout should be kept sticky or not in print preview settings. If we set this to True the webpage layout uses the recent choice otherwise it will set to default value.\r\n\r\nSize specifies if the page size should be kept sticky or not in print preview settings. If we set this to True the page size uses the recent choice otherwise it will set to default value.\r\n\r\nScale Type specifies if the scaling percentage and scale type should be kept sticky or not in print preview settings. If we set this to True the scale percentage and scale type both uses the recent choice oherwise it will set to default value.\r\n\r\nMargins specifies if the page margin should be kept sticky or not in print preview settings. If we set this to True the page margins uses the recent choice otherwise it will set to default value.\r\n\r\nIf you enable this policy, the selected values will use the most recent choice in Print Preview.\r\n\r\nIf you disable or don't configure this policy, print preview settings will not be impacted.\r\n\r\nExample value:\r\n\r\n{\r\n \"layout\": false,\r\n \"margins\": true,\r\n \"scaleType\": false,\r\n \"size\": true\r\n}\r\n\r\n\r\nCompact example value:\r\n\r\n{\"layout\": false, \"margins\": true, \"scaleType\": false, \"size\": true}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~printing_printpreviewstickysettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~printing_printpreviewstickysettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev110~policy~microsoft_edge~printing_printpreviewstickysettings_printpreviewstickysettings","displayName":"Configure the sticky print preview settings (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev111~policy~microsoft_edge_internetexplorermodecleardataonexitenabled","displayName":"Clear history for IE and IE mode every time you exit (User)","description":"This policy controls whether browsing history is deleted from Internet Explorer and Internet Explorer mode every time Microsoft Edge is closed.\r\n\r\nUsers can configure this setting in the 'Clear browsing data for Internet Explorer' option in the Privacy, search, and services menu of Settings.\r\n\r\nIf you enable this policy, on browser exit Internet Explorer browsing history will be cleared.\r\n\r\nIf you disable or do not configure this policy, Internet Explorer browsing history will not be cleared on browser exit.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev111~policy~microsoft_edge_internetexplorermodecleardataonexitenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev111~policy~microsoft_edge_internetexplorermodecleardataonexitenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev111~policy~microsoft_edge_newpdfreaderenabled","displayName":"Microsoft Edge built-in PDF reader powered by Adobe Acrobat enabled (User)","description":"The policy lets Microsoft Edge launch the new version of the built-in PDF reader that's powered by Adobe Acrobat's PDF rendering engine. The new PDF reader ensures that there's no loss of functionality and delivers an enhanced PDF experience. This experience includes richer rendering, improved performance, strong security for PDF handling, and greater accessibility.\r\n\r\nIf you enable this policy, Microsoft Edge will use the new Adobe Acrobat powered built-in PDF reader to open all PDF files.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will use the existing PDF reader to open all PDF files.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev111~policy~microsoft_edge_newpdfreaderenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev111~policy~microsoft_edge_newpdfreaderenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev111~policy~microsoft_edge_recommended_newpdfreaderenabled_recommended","displayName":"Microsoft Edge built-in PDF reader powered by Adobe Acrobat enabled (User)","description":"The policy lets Microsoft Edge launch the new version of the built-in PDF reader that's powered by Adobe Acrobat's PDF rendering engine. The new PDF reader ensures that there's no loss of functionality and delivers an enhanced PDF experience. This experience includes richer rendering, improved performance, strong security for PDF handling, and greater accessibility.\r\n\r\nIf you enable this policy, Microsoft Edge will use the new Adobe Acrobat powered built-in PDF reader to open all PDF files.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will use the existing PDF reader to open all PDF files.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev111~policy~microsoft_edge_recommended_newpdfreaderenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev111~policy~microsoft_edge_recommended_newpdfreaderenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev111~policy~microsoft_edge_sharedarraybufferunrestrictedaccessallowed","displayName":"Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context (User)","description":"Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context. A SharedArrayBuffer is a binary data buffer that can be used to create views on shared memory. SharedArrayBuffers have a memory access vulnerability in several popular CPUs.\r\n\r\nIf you enable this policy, sites are allowed to use SharedArrayBuffers with no restrictions.\r\n\r\nIf you disable or don't configure this policy, sites are allowed to use SharedArrayBuffers only when cross-origin isolated.\r\n\r\nMicrosoft Edge will require cross-origin isolation when using SharedArrayBuffers from Microsoft Edge 91 onward for Web Compatibility reasons.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev111~policy~microsoft_edge_sharedarraybufferunrestrictedaccessallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev111~policy~microsoft_edge_sharedarraybufferunrestrictedaccessallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev111~policy~microsoft_edge_showacrobatsubscriptionbutton","displayName":"Shows button on native PDF viewer in Microsoft Edge that allows users to sign up for Adobe Acrobat subscription (User)","description":"This policy lets the native PDF viewer in Microsoft Edge show a button that lets a user looking for advanced digital document features to discover and subscribe to premium offerings. This is done via the Acrobat extension.\r\n\r\nIf you enable or don't configure this policy, the button will show up on the native PDF viewer in Microsoft Edge. A user will be able to buy Adobe subscription to access their premium offerings.\r\n\r\nIf you disable this policy, the button won't be visible on the native PDF viewer in Microsoft Edge. A user won't be able to discover Adobe's advanced PDF tools or buy their subscriptions.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev111~policy~microsoft_edge_showacrobatsubscriptionbutton_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev111~policy~microsoft_edge_showacrobatsubscriptionbutton_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev112~policy~microsoft_edge_cryptowalletenabled","displayName":"Enable CryptoWallet feature (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 128.\r\n\r\nThis policy is obsoleted because this feature will no longer be supported, starting in Microsoft Edge 128. There is no replacement for this policy.\r\n Enables CryptoWallet feature in Microsoft Edge.\r\n\r\n If you enable this policy or don't configure it, users can use CryptoWallet feature which allows users to securely store, manage and transact digital assets such as Bitcoin, Ethereum and other cryptocurrencies. Therefore, Microsoft Edge may access Microsoft servers to communicate with the web3 world during the use of the CryptoWallet feature.\r\n\r\n If you disable this policy, users can't use CryptoWallet feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev112~policy~microsoft_edge_cryptowalletenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev112~policy~microsoft_edge_cryptowalletenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev112~policy~microsoft_edge_mousegestureenabled","displayName":"Mouse Gesture Enabled (User)","description":"This policy lets you configure the Mouse Gesture feature in Microsoft Edge.\r\n\r\nThis feature provides an easy way for users to complete tasks like scroll forward or backward, open new tab, refresh page, etc. They can finish a task by pressing and holding the mouse right button to draw certain patterns on a webpage, instead of clicking the buttons or using keyboard shortcuts.\r\n\r\nIf you enable or don't configure this policy, you can use the Mouse Gesture feature on Microsoft Edge to start using this feature.\r\n\r\nIf you disable this policy, you can't use the Mouse Gesture feature in Microsoft Edge.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev112~policy~microsoft_edge_mousegestureenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev112~policy~microsoft_edge_mousegestureenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev113~policy~microsoft_edge_readaloudenabled","displayName":"Enable Read Aloud feature in Microsoft Edge (User)","description":"Enables the Read Aloud feature within Microsoft Edge.\r\nUsing this feature, users can listen to the content on the web page. This enables users to multi-task or improve their reading comprehension by hearing content at their own pace.\r\n\r\nIf you enable this policy or don't configure it, the Read Aloud option shows up in the address bar, right click context menu, more menu, on the PDF toolbar, and within Immersive Reader.\r\nIf you disable this policy, users can't access the Read Aloud feature from the address bar, right click context menu, more menu, on the PDF toolbar, and within Immersive Reader.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev113~policy~microsoft_edge_readaloudenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev113~policy~microsoft_edge_readaloudenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev113~policy~microsoft_edge_restorepdfview","displayName":"Restore PDF view (User)","description":"Enables PDF View Recovery in Microsoft Edge.\r\n\r\nIf you enable or don't configure this policy Microsoft Edge will recover the last state of PDF view and land users to the section where they ended reading in the last session.\r\n\r\nIf you disable this policy Microsoft Edge will recover the last state of PDF view and land users at the start of the PDF file.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev113~policy~microsoft_edge_restorepdfview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev113~policy~microsoft_edge_restorepdfview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev113~policy~microsoft_edge_tabservicesenabled","displayName":"Enable tab organization suggestions (User)","description":"This policy controls whether Microsoft Edge can use its tab organization service to help name or suggest tab groups to increase productivity.\r\n\r\nIf you enable or don't configure this policy, when a user creates a tab group or activates certain \"Group Similar Tabs\" features Microsoft Edge sends tab data to its tab organization service. This data includes URLs, page titles, and existing group information. The service uses this data to return suggestions for better groupings and group names.\r\n\r\nIf you disable this policy, no data will be sent to the tab organization service. Microsoft Edge won't suggest group names when a group is created and certain \"Group Similar Tabs\" features that rely on the service won't be available.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev113~policy~microsoft_edge_tabservicesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev113~policy~microsoft_edge_tabservicesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev114~policy~microsoft_edge_defaultbrowsersettingscampaignenabled","displayName":"Enables default browser settings campaigns (User)","description":"This policy enables the default browser settings campaign. If a user clicks to accept the campaign, their default browser and/or default search engine will be changed to Microsoft Edge and Microsoft Bing, respectively. If the user dismisses the campaign, the user's browser settings will remain unchanged.\r\n\r\nIf you enable or don't configure this policy, users will be prompted to set Microsoft Edge as the default browser and Microsoft Bing as the default search engine, if they do not have those browser settings.\r\n\r\nIf you disable this policy, users will not be prompted to set Microsoft Edge as the default browser, or to set Microsoft Bing as the default search engine.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev114~policy~microsoft_edge_defaultbrowsersettingscampaignenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev114~policy~microsoft_edge_defaultbrowsersettingscampaignenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev114~policy~microsoft_edge_discoverpagecontextenabled","displayName":"Enable Discover access to page contents for AAD profiles (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 127.\r\n\r\nThis policy has been obsoleted as of Edge 127. Two new Edge Policies have taken its place. Those policies are CopilotPageContext (Control Copilot access to page contents for AAD profiles), and CopilotCDPPageContext (Control Copilot with Commercial Data Protection access to page contents for AAD profiles).\r\n\r\nThis policy did not allow for separate control of Copilot and Copilot with Commercial Data Protection. The new policies allow separate control of these versions of Copilot. The new policies also allow admins to force-enable Copilot access to Edge page contents by enabling the policy, whereas DiscoverPageContextEnabled only allowed force-disabling of Copilot page access.\r\n\r\nThis policy controls Discover access to page contents for AAD profiles. Discover is an extension that hosts Bing Chat. In order to summarize pages and interact with text selections, it needs to be able to access the page contents. When enabled, page contents will be sent to Bing. This policy does not affect MSA profiles.\r\n\r\nIf you enable or don't configure this policy, Discover will have access to page contents.\r\n\r\nIf you disable this policy, Discover will not be able to access page contents.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev114~policy~microsoft_edge_discoverpagecontextenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev114~policy~microsoft_edge_discoverpagecontextenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev114~policy~microsoft_edge_enforcelocalanchorconstraintsenabled","displayName":"Determines whether the built-in certificate verifier will enforce constraints encoded into trust anchors loaded from the platform trust store (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 127.\r\n\r\nX.509 certificates may encode constraints, such as Name Constraints, in extensions in the certificate. RFC 5280 specifies that enforcing such constraints on trust anchor certificates is optional.\r\n\r\nStarting in Microsoft Edge 112, such constraints in certificates loaded from the platform certificate store will now be enforced.\r\n\r\nThis policy exists as a temporary opt-out in case an enterprise encounters issues with the constraints encoded in their private roots. In that case this policy may be used to temporarily disable enforcement of the constraints while correcting the certificate issues.\r\n\r\nIf you enable this policy or don't configure it, Microsoft Edge will enforce constraints encoded into trust anchors loaded from the platform trust store.\r\n\r\nIf you disable this policy, Microsoft Edge will not enforce constraints encoded into trust anchors loaded from the platform trust store.\r\n\r\nThis policy has no effect if the 'MicrosoftRootStoreEnabled' (Determines whether the Microsoft Root Store and built-in certificate verifier will be used to verify server certificates) policy is disabled.\r\n\r\nThis policy was removed in Microsoft Edge version 128. Starting with that version, constraints in trust anchors are always enforced.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev114~policy~microsoft_edge_enforcelocalanchorconstraintsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev114~policy~microsoft_edge_enforcelocalanchorconstraintsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev114~policy~microsoft_edge_showdownloadstoolbarbutton","displayName":"Show Downloads button on the toolbar (User)","description":"Set this policy to always show the Downloads button on the toolbar.\r\n\r\nIf you enable this policy, the Downloads button is pinned to the toolbar.\r\n\r\nIf you disable or don't configure the policy, the Downloads button isn't shown on the toolbar by default. Users can toggle the Downloads button in edge://settings/appearance.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev114~policy~microsoft_edge_showdownloadstoolbarbutton_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev114~policy~microsoft_edge_showdownloadstoolbarbutton_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev114~policy~microsoft_edge_standalonehubssidebarenabled","displayName":"Standalone Sidebar Enabled (User)","description":"Standalone Sidebar is an optional mode for the Sidebar in Microsoft Edge. When this mode is activated by a user, the Sidebar appears in a fixed position on the Microsoft Windows desktop, and is hidden from the browser application frame.\r\n\r\nIf you enable or don't configure this policy, users will have the ability to activate the Standalone Sidebar.\r\nIf you disable this policy, options to activate Standalone Sidebar will be hidden or made unavailable. Note that blocking 'HubsSidebarEnabled' (Show Hubs Sidebar) will also prevent users from accessing Standalone Sidebar.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev114~policy~microsoft_edge_standalonehubssidebarenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev114~policy~microsoft_edge_standalonehubssidebarenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge_composeinlineenabled","displayName":"Compose is enabled for writing on the web (User)","description":"This policy lets you configure Compose in Microsoft Edge. Compose provides help for writing with AI-generated text, which lets the user get ideas for writing. This includes elaborating on text, re-writing, changing tone, formatting the text, and more.\r\n\r\nIf you enable or don't configure this policy, Compose can provide text generation for eligible fields, which are text editable and don't have an autocomplete attribute.\r\n\r\nIf you disable this policy, Compose will not be able to provide text generation for eligible fields. Compose will still be available for prompt-based text generation through the sidebar and must be managed with either 'EdgeDiscoverEnabled' (Discover feature In Microsoft Edge) policy or 'HubsSidebarEnabled' (Show Hubs Sidebar) policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge_composeinlineenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge_composeinlineenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge_enhancesecuritymodeindicatoruienabled","displayName":"Manage the indicator UI of the Enhanced Security Mode (ESM) feature in Microsoft Edge (User)","description":"This policy lets you manage whether the indicator User Interface (UI) for enhanced security mode is shown or not when ESM is turned on.\r\n\r\nIf you enable or don't configure this policy, the indicator UI is on.\r\n\r\nIf you disable this policy, the indicator UI is off.\r\n\r\nNote: If this policy is used, only the indicator User Interface experience is supressed - ESM is still turned on. For more information, see the 'EnhanceSecurityMode' (Enhance the security state in Microsoft Edge) policy.\r\n\r\nFor detailed information about Enhanced Security Mode, see https://go.microsoft.com/fwlink/?linkid=2185895","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge_enhancesecuritymodeindicatoruienabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge_enhancesecuritymodeindicatoruienabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge_enhancesecuritymodeoptoutuxenabled","displayName":"Manage opt-out user experience for Enhanced Security Mode (ESM) in Microsoft Edge (deprecated) (User)","description":"DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.\r\n\r\nThis policy lets you manage whether the opt-out user experience for enhanced security mode is presented when ESM is turned on for Microsoft Edge.\r\n\r\nIf you enable or don't configure this policy, the UI for the opt-out user experience is on.\r\n\r\nIf you disable this policy, the UI for the opt-out user experience is off.\r\n\r\nNote: If this policy is used, only the User Interface for the opt-out experience is supressed - ESM is still turned on. For more information, see the 'EnhanceSecurityMode' (Enhance the security state in Microsoft Edge) policy.\r\n\r\nFor detailed information about Enhanced Security Mode, see https://go.microsoft.com/fwlink/?linkid=2185895.\r\n\r\nAfter careful evaluation, we have determined that this experimental opt-out UX is not required. As a result, this policy will be deprecated and stop working after Edge version 130.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge_enhancesecuritymodeoptoutuxenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge_enhancesecuritymodeoptoutuxenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge_recommended_walletdonationenabled_recommended","displayName":"Wallet Donation Enabled (User)","description":"The Wallet Donation feature in Microsoft Edge allows users to view their donation summary, explore Nonprofit organizations (NPOs), donate to an NPO, manage their monthly donations, and view their donation history.\r\n\r\nIf you enable or don't configure this policy, users can use the Wallet Donation feature.\r\n\r\nIf you disable this policy, users can't use the Wallet Donation feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge_recommended_walletdonationenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge_recommended_walletdonationenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge_searchforimageenabled","displayName":"Search for image enabled (User)","description":"This policy lets you configure the Image Search feature in the right-click context menu.\r\n\r\nIf you enable or don't configure this policy, then the \"Search the web for image\" option will be visible in the context menu.\r\n\r\nIf you disable this policy, then the \"Search the web for image\" will not be visible in the context menu.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge_searchforimageenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge_searchforimageenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge_walletdonationenabled","displayName":"Wallet Donation Enabled (User)","description":"The Wallet Donation feature in Microsoft Edge allows users to view their donation summary, explore Nonprofit organizations (NPOs), donate to an NPO, manage their monthly donations, and view their donation history.\r\n\r\nIf you enable or don't configure this policy, users can use the Wallet Donation feature.\r\n\r\nIf you disable this policy, users can't use the Wallet Donation feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge_walletdonationenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge_walletdonationenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge~manageability_edgemanagementenabled","displayName":"Microsoft Edge management enabled (User)","description":"Microsoft Edge management service in Microsoft 365 Admin Center lets you set policy and manage users through a Microsoft Edge focused cloud-based management experience. This policy lets you control whether Microsoft Edge management is enabled.\r\n\r\nIf you enable or don't configure this policy, Microsoft Edge will attempt to connect to the Microsoft Edge management service to download and apply policy assigned to the Azure AD account of the user.\r\n\r\nIf you disable this policy, Microsoft Edge will not attempt to connect to the Microsoft Edge management service.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge~manageability_edgemanagementenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge~manageability_edgemanagementenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge~manageability_edgemanagementenrollmenttoken","displayName":"Microsoft Edge management enrollment token (User)","description":"Microsoft Edge management service in Microsoft 365 Admin Center lets you set policy and manage users through a Microsoft Edge focused cloud-based management experience. This policy lets you specify an enrollment token that's used to register with Microsoft Edge management service and deploy the associated policies. The user must be signed into Microsoft Edge with a valid work or school account otherwise Microsoft Edge will not download the policy.\r\n\r\nIf you enable this policy, Microsoft Edge will attempt to use the specified enrollment token to register with the Microsoft Edge management service and download the published policy.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will not attempt to connect to the Microsoft Edge management service.\r\n\r\nExample value: RgAAAACBbzoQDmUrRfq3WeKUoFeEBwBOqK2QPYsBT5V3lQFoKND-AAAAAAEVAAAOqK2QPYvBT5V4lQFoKMD-AAADTXvzAAAA0","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge~manageability_edgemanagementenrollmenttoken_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge~manageability_edgemanagementenrollmenttoken_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge~manageability_edgemanagementenrollmenttoken_edgemanagementenrollmenttoken","displayName":"Microsoft Edge management enrollment token (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge~manageability_edgemanagementextensionsfeedbackenabled","displayName":"Microsoft Edge management extensions feedback enabled (User)","description":"This setting controls whether Microsoft Edge sends data about blocked extensions to the Microsoft Edge management service.\r\n\r\nThe 'EdgeManagementEnabled' policy must also be enabled for this setting to take effect.\r\n\r\nIf you enable this policy, Microsoft Edge will send data to the Microsoft Edge service when a user tries to install a blocked extension.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge won't send any data to the Microsoft Edge service about blocked extensions.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge~manageability_edgemanagementextensionsfeedbackenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev115~policy~microsoft_edge~manageability_edgemanagementextensionsfeedbackenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge_recommended~performance_recommended_pinbrowseressentialstoolbarbutton_recommended","displayName":"Pin browser essentials toolbar button (User)","description":"This policy lets you configure whether to pin the Browser essentials button on the toolbar.\r\n\r\nWhen the button is pinned, it will always appear on the toolbar.\r\n\r\nWhen the button isn't pinned, it will only appear when there's an alert. An example of this kind of alert is the performance detector alert that indicates the browser is using high CPU or memory.\r\n\r\nIf you enable or don't configure this policy, the Browser essentials button will be pinned on the toolbar.\r\n\r\nIf you disable this policy, the Browser essentials button won't be pinned on the toolbar.\r\n\r\nLearn more about browser essentials: https://go.microsoft.com/fwlink/?linkid=2240439","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge_recommended~performance_recommended_pinbrowseressentialstoolbarbutton_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge_recommended~performance_recommended_pinbrowseressentialstoolbarbutton_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge_throttlenonvisiblecrossoriginiframesallowed","displayName":"Allows enabling throttling of non-visible, cross-origin iframes (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 123.\r\n\r\nThrottling of cross-origin frames that are display:none and non-visible is a feature designed to make cross-process and same-process cross-origin iframes consistent in their rendering behavior. For more details on cross-process vs. same-process throttling, refer to https://go.microsoft.com/fwlink/?linkid=2239564.\r\n\r\nThis enterprise policy exists to allow administrators to control whether their users are able to turn the additional throttling on or not.\r\n\r\nIf you enable or don't configure this policy, users can opt-in to throttling.\r\n\r\nIf you disable this policy, users can't enable throttling.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge_throttlenonvisiblecrossoriginiframesallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge_throttlenonvisiblecrossoriginiframesallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge~contentsettings_defaultthirdpartystoragepartitioningsetting","displayName":"Default setting for third-party storage partitioning (User)","description":"This policy controls whether third-party storage partitioning is allowed by default.\r\n\r\nIf this policy is set to 1 - AllowPartitioning, or unset, third-party storage partitioning will be allowed by default. This default may be overridden for specific top-level origins by other means.\r\n\r\nIf this policy is set to 2 - BlockPartitioning, third-party storage partitioning will be disabled for all contexts.\r\n\r\nUse ThirdPartyStoragePartitioningBlockedForOrigins to disable third-party storage partitioning for specific top-level origins.\r\n\r\nPolicy options mapping:\r\n\r\n* AllowPartitioning (1) = Allow third-party storage partitioning by default.\r\n\r\n* BlockPartitioning (2) = Disable third-party storage partitioning.\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge~contentsettings_defaultthirdpartystoragepartitioningsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge~contentsettings_defaultthirdpartystoragepartitioningsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge~contentsettings_defaultthirdpartystoragepartitioningsetting_defaultthirdpartystoragepartitioningsetting","displayName":"Default setting for third-party storage partitioning (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge~contentsettings_defaultthirdpartystoragepartitioningsetting_defaultthirdpartystoragepartitioningsetting_1","displayName":"Let third-party storage partitioning to be enabled.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge~contentsettings_defaultthirdpartystoragepartitioningsetting_defaultthirdpartystoragepartitioningsetting_2","displayName":"Block third-party storage partitioning from being enabled.","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge~contentsettings_thirdpartystoragepartitioningblockedfororigins","displayName":"Disable third-party storage partitioning for specific top-level origins (User)","description":"This policy lets you set a list of URL patterns that specify top-level origins for which third-party storage partitioning (partitioning of cross-origin iframe storage) should be disabled.\r\n\r\nIf this policy isn't set or a top-level origin doesn't match one of the URL patterns, then the value from 'DefaultThirdPartyStoragePartitioningSetting' (Default setting for third-party storage partitioning) will be used.\r\n\r\nNote that the patterns you list are treated as origins, not URLs, so you shouldn't specify a path. For detailed information about valid origin patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.\r\n\r\nExample value:\r\n\r\nwww.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge~contentsettings_thirdpartystoragepartitioningblockedfororigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge~contentsettings_thirdpartystoragepartitioningblockedfororigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge~contentsettings_thirdpartystoragepartitioningblockedfororigins_thirdpartystoragepartitioningblockedfororiginsdesc","displayName":"Block third-party storage partitioning for these origins (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge~performance_pinbrowseressentialstoolbarbutton","displayName":"Pin browser essentials toolbar button (User)","description":"This policy lets you configure whether to pin the Browser essentials button on the toolbar.\r\n\r\nWhen the button is pinned, it will always appear on the toolbar.\r\n\r\nWhen the button isn't pinned, it will only appear when there's an alert. An example of this kind of alert is the performance detector alert that indicates the browser is using high CPU or memory.\r\n\r\nIf you enable or don't configure this policy, the Browser essentials button will be pinned on the toolbar.\r\n\r\nIf you disable this policy, the Browser essentials button won't be pinned on the toolbar.\r\n\r\nLearn more about browser essentials: https://go.microsoft.com/fwlink/?linkid=2240439","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge~performance_pinbrowseressentialstoolbarbutton_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev116~policy~microsoft_edge~performance_pinbrowseressentialstoolbarbutton_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_allowsystemnotifications","displayName":"Allows system notifications (User)","description":"Lets you use system notifications instead of Microsoft Edge's embedded Message Center on Windows and Linux.\r\n\r\nIf set to True or not set, Microsoft Edge is allowed to use system notifications.\r\n\r\nIf set to False, Microsoft Edge will not use system notifications. Microsoft Edge's embedded Message Center will be used as a fallback.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_allowsystemnotifications_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_allowsystemnotifications_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_edgewalletetreeenabled","displayName":"Edge Wallet E-Tree Enabled (User)","description":"The Edge Wallet E-Tree feature in Microsoft Edge allows users to plant a E-Tree for their own.\r\n\r\nIf you enable or don't configure this policy, users can use the Edge Wallet E-Tree feature.\r\n\r\nIf you disable this policy, users can't use the Edge Wallet E-Tree feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_edgewalletetreeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_edgewalletetreeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_internetexplorerintegrationzoneidentifiermhtfileallowed","displayName":"Automatically open downloaded MHT or MHTML files from the web in Internet Explorer mode (User)","description":"This policy controls whether MHT or MHTML files that are downloaded from the web are automatically opened in Internet Explorer mode.\r\n\r\nIf you enable this policy, the MHT or MHTML files that are downloaded from the web can be opened in both Microsoft Edge and Internet Explorer mode to provide the best user experience.\r\n\r\nIf you disable or don't configure this policy, MHT or MHTML files that are downloaded from the web won't automatically open in Internet Explorer mode.\r\n\r\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_internetexplorerintegrationzoneidentifiermhtfileallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_internetexplorerintegrationzoneidentifiermhtfileallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_recommended_edgewalletetreeenabled_recommended","displayName":"Edge Wallet E-Tree Enabled (User)","description":"The Edge Wallet E-Tree feature in Microsoft Edge allows users to plant a E-Tree for their own.\r\n\r\nIf you enable or don't configure this policy, users can use the Edge Wallet E-Tree feature.\r\n\r\nIf you disable this policy, users can't use the Edge Wallet E-Tree feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_recommended_edgewalletetreeenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_recommended_edgewalletetreeenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_recommended~edgegames_recommended_gamermodeenabled_recommended","displayName":"Enable Gamer Mode (User)","description":"Microsoft Edge Gamer Mode allows gamers to personalize their browser with gaming themes and gives them the option of enabling Efficiency Mode for PC gaming, the Gaming feed on new tabs, sidebar apps for gamers, and more.\r\n\r\nIf you enable or don't configure this policy, users can opt into Gamer Mode.\r\nIf you disable this policy, Gamer Mode will be disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_recommended~edgegames_recommended_gamermodeenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_recommended~edgegames_recommended_gamermodeenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_searchbarallowed","displayName":"Enable the Search bar (User)","description":"Enables the search bar. When enabled, users can use the search bar to search the web from their desktop or from an application. The search bar provides a search box, powered by Edge default search engine, that shows web suggestions and opens all web searches in Microsoft Edge. The search bar can be launched from the \"More tools\" menu or jump list in Microsoft Edge.\r\n\r\nIf you enable or don't configure this policy:\r\nThe search bar will be automatically enabled for all profiles.\r\nThe option to enable the search bar at startup will be toggled on if the 'SearchbarIsEnabledOnStartup' (Allow the Search bar at Windows startup) policy is enabled.\r\nIf the 'SearchbarIsEnabledOnStartup' is disabled or not configured, the option to enable the search bar at startup will be toggled off.\r\nUsers will see the menu item to launch the search bar from the Microsoft Edge \"More tools\" menu. Users can launch the search bar from \"More tools\".\r\nUsers will see the menu item to launch the search bar from the Microsoft Edge jump list menu. Users can launch the search bar from the Microsoft Edge jump list menu.\r\nThe search bar can be turned off by the \"Quit\" option in the System tray or by closing the search bar from the 3 dot menu. The search bar will be restarted on system reboot if auto-start is enabled.\r\n\r\n\r\nIf you disable this policy:\r\nThe search bar will be disabled for all profiles.\r\nThe option to launch the search bar from Microsoft Edge \"More tools\" menu will be disabled.\r\nThe option to launch the search bar from Microsoft Edge jump list menu will be disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_searchbarallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_searchbarallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_searchbarisenabledonstartup","displayName":"Allow the Search bar at Windows startup (User)","description":"Allows the Search bar to start running at Windows startup.\r\n\r\nIf you enable:\r\n The Search bar will start running at Windows startup by default.\r\n If the Search bar is disabled via 'SearchbarAllowed' (Enable the Search bar) policy, this policy will not start the Search bar on Windows startup.\r\n\r\nIf you disable this policy:\r\n The Search bar will not start at Windows startup for all profiles.\r\n The option to start the search bar at Windows startup will be disabled and toggled off in search bar settings.\r\n\r\nIf you don't configure the policy:\r\n The Search bar will not start at Windows startup for all profiles.\r\n The option to start the search bar at Windows startup will be toggled off in search bar settings.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_searchbarisenabledonstartup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_searchbarisenabledonstartup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_showhistorythumbnails","displayName":"Show thumbnail images for browsing history (User)","description":"This policy lets you configure whether the history thumbnail feature collects and saves images for the sites you visit. When enabled, this feature makes it easier to identify sites when you hover over your history results.\r\nIf you don't configure this policy, the thumbnail feature is turned on after a user visits the history hub twice in the past 7 days.\r\nIf you enable this policy, the history thumbnail collects and saves images for visited sites.\r\nIf you disable this policy, the history thumbnail doesn't collect and save images for visited sites.\r\nWhen the feature is disabled, existing images are deleted on a per user basis, and the feature no longer collects or saves images when a site is visited.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_showhistorythumbnails_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_showhistorythumbnails_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_splitscreenenabled","displayName":"Enable split screen feature in Microsoft Edge (User)","description":"This policy lets you configure the split screen feature in Microsoft Edge. This feature lets a user open two web pages in one tab.\r\n\r\nIf you enable or don't configure this policy, users can use the split screen feature in Microsoft Edge.\r\n\r\nIf you disable this policy, users can't use the split screen feature in Microsoft Edge.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_splitscreenenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_splitscreenenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_uploadfromphoneenabled","displayName":"Enable upload files from mobile in Microsoft Edge desktop (User)","description":"This policy lets you configure the \"Upload from mobile\" feature in Microsoft Edge.\r\n\r\nUpload from mobile lets users select file from mobile devices to desktop when user upload file in a webpage in Microsoft Edge.\r\n\r\nIf you enable or don't configure this policy, you can use the Upload from mobile feature in Microsoft Edge.\r\n\r\nIf you disable this policy, you can't use the Upload from mobile feature in Microsoft Edge.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_uploadfromphoneenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge_uploadfromphoneenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge~edgegames_gamermodeenabled","displayName":"Enable Gamer Mode (User)","description":"Microsoft Edge Gamer Mode allows gamers to personalize their browser with gaming themes and gives them the option of enabling Efficiency Mode for PC gaming, the Gaming feed on new tabs, sidebar apps for gamers, and more.\r\n\r\nIf you enable or don't configure this policy, users can opt into Gamer Mode.\r\nIf you disable this policy, Gamer Mode will be disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge~edgegames_gamermodeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev117~policy~microsoft_edge~edgegames_gamermodeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge_beforeunloadeventcancelbypreventdefaultenabled","displayName":"Control the behavior for the cancel dialog produced by the beforeunload event (User)","description":"This policy provides a temporary opt-out for two related fixes to the behavior of the confirmation dialog that’s shown by the beforeunload event.\r\n\r\nWhen this policy is Enabled, the new (correct) behavior will be used.\r\nWhen this policy is Disabled, the old (legacy) behavior will be used.\r\nWhen this policy is left not set, the default behavior will be used.\r\nNote: This policy is a temporary workaround and will be removed in a future release.\r\n\r\nNew and correct behavior: In `beforeunload`, calling `event.preventDefault()` will trigger the confirmation dialog. Setting `event.returnValue` to the empty string won’t trigger the confirmation dialog.\r\n\r\nOld and legacy behavior: In `beforeunload`, calling `event.preventDefault()` won’t trigger the confirmation dialog. Setting `event.returnValue` to the empty string will trigger the confirmation dialog.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge_beforeunloadeventcancelbypreventdefaultenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge_beforeunloadeventcancelbypreventdefaultenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge_forcebuiltinpushmessagingclient","displayName":"Forces Microsoft Edge to use its built-in WNS push client to connect to the Windows Push Notification Service. (User)","description":"In some environments, the Windows OS client can't connect to the Windows Push Notification Service (WNS). For these environments, you can use the Microsoft Edge built-in WNS push client, which may be able to connect successfully.\r\n\r\nIf enabled, Microsoft Edge will use its built-in WNS push client to connect to WNS.\r\n\r\nIf disabled or not configured, Microsoft Edge will use the Windows OS client to connect to the Windows Push Notification Service. This is the default setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge_forcebuiltinpushmessagingclient_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge_forcebuiltinpushmessagingclient_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge_forcepermissionpolicyunloaddefaultenabled","displayName":"Controls whether unload event handlers can be disabled. (User)","description":"unload event handlers are being deprecated. Whether they fire depends on the unload Permissions-Policy.\r\nCurrently, they are allowed by policy by default. In the future they will gradually move to being disallowed by default and sites must explicitly enable them using Permissions-Policy headers.\r\nThis enterprise policy can be used to opt out of this gradual deprecation by forcing the default to stay enabled.\r\n\r\nPages might depend on unload event handlers to save data or signal the end of a user session to the server.\r\nThis is not recommended because it's unreliable and impacts performance by blocking use of BackForwardCache.\r\nRecommended alternatives exist, but the unload event has been used for a long time. Some applications might still rely on them.\r\n\r\nIf you disable this policy or don't configure it, unload event handlers will gradually be deprecated in-line with the deprecation rollout and sites which don't set Permissions-Policy header will stop firing `unload` events.\r\n\r\nIf you enable this policy then unload event handlers will continue to work by default.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge_forcepermissionpolicyunloaddefaultenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge_forcepermissionpolicyunloaddefaultenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge_pictureinpictureoverlayenabled","displayName":"Enable Picture in Picture overlay feature on supported webpages in Microsoft Edge (User)","description":"This policy lets you configure the Picture in Picture floating overlay button in Microsoft Edge.\r\n\r\nThe Picture in Picture floating overlay button lets user to watch videos in a floating window on top of other windows.\r\n\r\nIf you enable or don't configure this policy, you can use the Picture in Picture floating overlay button in Microsoft Edge.\r\n\r\nIf you disable this policy, you can't use the Picture in Picture floating overlay button in Microsoft Edge.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge_pictureinpictureoverlayenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge_pictureinpictureoverlayenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge_recommended~passwordmanager_recommended_passworddeleteonbrowsercloseenabled_recommended","displayName":"Prevent passwords from being deleted if any Edge settings is enabled to delete browsing data when Microsoft Edge closes (User)","description":"When this policy is enabled, the passwords saved with Edge Password Manager are exempted from deletion when the browser closes. This policy is only effective when:\r\n- The 'Passwords' toggle is configured in Settings/Privacy and services/Clear browsing data on close or\r\n- The policy ClearBrowsingDataOnExit is enabled\r\n\r\nIf you enable this policy, passwords won't be cleared when the browser closes.\r\nIf you disable or don't configure this policy, the user's personal configuration is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge_recommended~passwordmanager_recommended_passworddeleteonbrowsercloseenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge_recommended~passwordmanager_recommended_passworddeleteonbrowsercloseenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge_sendmouseeventsdisabledformcontrolsenabled","displayName":"Control the new behavior for event dispatching on disabled form controls (User)","description":"Event dispatching on disabled form controls is being changed in Edge to improve compatibility with other browsers and to improve the developer experience.\r\n\r\nWith this change, MouseEvents get dispatched on disabled form control elements. Exceptions for this behavior are click, mouseup, and mousedown. Some examples of the new events are mousemove, mouseenter, and mouseleave.\r\n\r\nThis change also truncates the event path of click, mouseup, and mousedown when they’re dispatched on children of disabled form controls. These events aren’t dispatched on the disabled form control or any of its ancestors.\r\n\r\nNote: This new behavior might break some websites.\r\n\r\nIf this policy is enabled or left not set, the new behavior will be used.\r\n\r\nIf this policy is disabled, the old behavior will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge_sendmouseeventsdisabledformcontrolsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge_sendmouseeventsdisabledformcontrolsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~contentsettings_dataurlinsvguseenabled","displayName":"Data URL support for SVGUseElement (User)","description":"This policy enables Data URL support for SVGUseElement, which will be disabled\r\nby default starting in Edge stable version 119.\r\nIf this policy is Enabled, Data URLs will keep working in SVGUseElement.\r\nIf this policy is Disabled or left not set, Data URLs won't work in SVGUseElement.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~contentsettings_dataurlinsvguseenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~contentsettings_dataurlinsvguseenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~network_compressiondictionarytransportenabled","displayName":"Enable compression dictionary transport support (User)","description":"This feature enables the use of dictionary-specific content encodings in the Accept-Encoding request header (\"sbr\" and \"zst-d\") when dictionaries are available for use.\r\n\r\nIf you enable this policy or don't configure it, Microsoft Edge will accept web contents using the compression dictionary transport feature.\r\n\r\nIf you disable this policy, Microsoft Edge will turn off the compression dictionary transport feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~network_compressiondictionarytransportenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~network_compressiondictionarytransportenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~passwordmanager_passworddeleteonbrowsercloseenabled","displayName":"Prevent passwords from being deleted if any Edge settings is enabled to delete browsing data when Microsoft Edge closes (User)","description":"When this policy is enabled, the passwords saved with Edge Password Manager are exempted from deletion when the browser closes. This policy is only effective when:\r\n- The 'Passwords' toggle is configured in Settings/Privacy and services/Clear browsing data on close or\r\n- The policy ClearBrowsingDataOnExit is enabled\r\n\r\nIf you enable this policy, passwords won't be cleared when the browser closes.\r\nIf you disable or don't configure this policy, the user's personal configuration is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~passwordmanager_passworddeleteonbrowsercloseenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~passwordmanager_passworddeleteonbrowsercloseenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~smartscreen_exemptsmartscreendownloadwarnings","displayName":"Disable SmartScreen AppRep based warnings for specified file types on specified domains (User)","description":"You can enable this policy to create a dictionary of file type extensions with a corresponding list of domains that will be exempted from SmartScreen AppRep warnings. For example, if the \"vbe\" extension is associated with \"website1.com\", users would not see a SmartScreen AppRep warning when downloading \"vbe\" files from \"website1.com\", but may see a download warning when downloading \"vbe\" files from \"website2.com\".\r\n\r\nFiles with file type extensions specified for domains identified by this policy will still be subject to file type extension-based security warnings and mixed-content download warnings.\r\n\r\nIf you disable this policy or don't configure it, files that trigger SmartScreen AppRep download warnings will show warnings to the user.\r\n\r\nIf you enable this policy:\r\n\r\n* The URL pattern should be formatted according to https://go.microsoft.com/fwlink/?linkid=2095322.\r\n* The file type extension entered must be in lower-cased ASCII. The leading separator should not be included when listing the file type extension, so \"vbe\" should be used instead of \".vbe\".\r\n\r\nExample:\r\n\r\nThe following example value would prevent SmartScreen AppRep warnings on msi, exe, and vbe extensions for *.contoso.com domains. It may show the user a SmartScreen AppRep warning on any other domain for exe and msi files, but not for vbe files.\r\n\r\n[\r\n { \"file_extension\": \"msi\", \"domains\": [\"contoso.com\"] },\r\n { \"file_extension\": \"exe\", \"domains\": [\"contoso.com\"] },\r\n { \"file_extension\": \"vbe\", \"domains\": [\"*\"] }\r\n]\r\n\r\nNote that while the preceding example shows the suppression of SmartScreen AppRep download warnings for \"vbe\" files for all domains, applying suppression of such warnings for all domains is not recommended due to security concerns. It is shown in the example merely to demonstrate the ability to do so.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"domains\": [\r\n \"https://contoso.com\",\r\n \"contoso2.com\"\r\n ],\r\n \"file_extension\": \"msi\"\r\n },\r\n {\r\n \"domains\": [\r\n \"*\"\r\n ],\r\n \"file_extension\": \"vbe\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~smartscreen_exemptsmartscreendownloadwarnings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~smartscreen_exemptsmartscreendownloadwarnings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~smartscreen_exemptsmartscreendownloadwarnings_exemptsmartscreendownloadwarnings","displayName":"Disable SmartScreen AppRep based warnings for specified file types on specified domains (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~startup_newtabpagebingchatenabled","displayName":"Disable Bing chat entry-points on Microsoft Edge Enterprise new tab page (User)","description":"By default, there are two Bing chat entry-points on new tab page. One is inside the new tab page search box, and one is in the Bing Autosuggest drawer on-click.\r\n\r\nIf you enable or don't configure this policy, there is no change on the Microsoft Edge Enterprise new tab page and the Bing chat entry-points are there for users.\r\n\r\nIf you disable this policy, Bing chat entry-points don't appear on the new tab page.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~startup_newtabpagebingchatenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~startup_newtabpagebingchatenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~startup_newtabpagecompanylogoenabled","displayName":"Hide the company logo on the Microsoft Edge new tab page (User)","description":"By default, the company logo is shown on the new tab page if the company logo is configured in Admin Portal.\r\n\r\nIf you enable or don't configure this policy, there is no change on the Microsoft Edge new tab page and the company logo is there for users.\r\n\r\nIf you disable this policy, the company logo doesn't appear on Microsoft Edge new tab page.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~startup_newtabpagecompanylogoenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev118~policy~microsoft_edge~startup_newtabpagecompanylogoenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev119~policy~microsoft_edge_recommended_organizationalbrandingonworkprofileuienabled_recommended","displayName":"Allow the use of your organization's branding assets from Microsoft Entra on the profile-related UI of a work profile (User)","description":"Allow the use of your organization's branding assets from Entra, if any, on the profile-related UI of a profile that's signed in with an Entra ID (formerly known as Azure Active Directory) account. This requires a browser restart to take effect.\r\n\r\nIf you enable this policy, your organization's branding assets from Entra will be used.\r\n\r\nIf you disable or don't configure this policy, your organization's branding assets from Entra won't be used.\r\n\r\nFor more information about configuring your organization's branding assets on Entra, please visit https://go.microsoft.com/fwlink/?linkid=2254514.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev119~policy~microsoft_edge_recommended_organizationalbrandingonworkprofileuienabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev119~policy~microsoft_edge_recommended_organizationalbrandingonworkprofileuienabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev119~policy~microsoft_edge~identity_switchintranetsitestoworkprofile","displayName":"Switch intranet sites to a work profile (User)","description":"Allows Microsoft Edge to switch to the appropriate profile when Microsoft Edge detects that a URL is the intranet.\r\n\r\nIf you enable or don't configure this policy, navigations to intranet URLs will switch to the most recently used work profile if one exists.\r\n\r\nIf you disable this policy, navigations to intranet URLs will remain in the current browser profile.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev119~policy~microsoft_edge~identity_switchintranetsitestoworkprofile_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev119~policy~microsoft_edge~identity_switchintranetsitestoworkprofile_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev119~policy~microsoft_edge~identity_switchsitesoniemodesitelisttoworkprofile","displayName":"Switch sites on the IE mode site list to a work profile (User)","description":"Allows Microsoft Edge to switch to the appropriate profile when navigating to a site that matches an entry on the IE mode site list. Only sites that specify IE mode or Edge mode will be switched to the work profile.\r\n\r\nIf you enable or don't configure this policy, navigations to URLs matching a site on the IE mode site list will switch to the most recently used work profile if one exists.\r\n\r\nIf you disable this policy, navigations to URLs matching a site on the IE mode site list will remain in the current browser profile.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev119~policy~microsoft_edge~identity_switchsitesoniemodesitelisttoworkprofile_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev119~policy~microsoft_edge~identity_switchsitesoniemodesitelisttoworkprofile_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev119~policy~microsoft_edge~manageability_edgemanagementpolicyoverridesplatformpolicy","displayName":"Microsoft Edge management service policy overrides platform policy. (User)","description":"If you enable this policy, the cloud-based Microsoft Edge management service policy takes precedence if it conflicts with platform policy.\r\n\r\nIf you disable or don't configure this policy, platform policy takes precedence if it conflicts with the cloud-based Microsoft Edge management service policy.\r\n\r\nThis mandatory policy affects machine scope cloud-based Microsoft Edge management policies.\r\n\r\nMachine policies apply to all edge browser instances regardless of the user who is logged in.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev119~policy~microsoft_edge~manageability_edgemanagementpolicyoverridesplatformpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev119~policy~microsoft_edge~manageability_edgemanagementpolicyoverridesplatformpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev119~policy~microsoft_edge~manageability_edgemanagementuserpolicyoverridescloudmachinepolicy","displayName":"Allow cloud-based Microsoft Edge management service user policies to override local user policies. (User)","description":"If you enable this policy, cloud-based Microsoft Edge management service user policies takes precedence if it conflicts with local user policy.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge management service user policies will take precedence.\r\n\r\nThe policy can be combined with 'EdgeManagementPolicyOverridesPlatformPolicy' (Microsoft Edge management service policy overrides platform policy.). If both policies are enabled, all cloud-based Microsoft Edge management service policies will take precedence over conflicting local service policies.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev119~policy~microsoft_edge~manageability_edgemanagementuserpolicyoverridescloudmachinepolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev119~policy~microsoft_edge~manageability_edgemanagementuserpolicyoverridescloudmachinepolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_edge3pserptelemetryenabled","displayName":"Edge 3P SERP Telemetry Enabled (User)","description":"Edge3P Telemetry in Microsoft Edge captures the searches user does on third party search providers without identifying the person or the device and captures only if the user has consented to this collection of data. User can turn off the collection at any time in the browser settings.\r\n\r\nIf you enable or don't configure this policy, Edge 3P SERP Telemetry feature will be enabled.\r\n\r\nIf you disable this policy, Edge 3P SERP Telemetry feature will be disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_edge3pserptelemetryenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_edge3pserptelemetryenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_recommended_edge3pserptelemetryenabled_recommended","displayName":"Edge 3P SERP Telemetry Enabled (User)","description":"Edge3P Telemetry in Microsoft Edge captures the searches user does on third party search providers without identifying the person or the device and captures only if the user has consented to this collection of data. User can turn off the collection at any time in the browser settings.\r\n\r\nIf you enable or don't configure this policy, Edge 3P SERP Telemetry feature will be enabled.\r\n\r\nIf you disable this policy, Edge 3P SERP Telemetry feature will be disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_recommended_edge3pserptelemetryenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_recommended_edge3pserptelemetryenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_recommended_organizationlogooverlayonappiconenabled_recommended","displayName":"Allow your organization's logo from Microsoft Entra to be overlaid on the Microsoft Edge app icon of a work profile (User)","description":"Allow your organization's logo from Entra, if any, to be overlaid on the Microsoft Edge app icon of a profile that's signed in with an Entra ID (formerly known as Azure Active Directory) account. This requires a browser restart to take effect.\r\n\r\nIf you enable this policy, your organization's logo from Entra will be used.\r\n\r\nIf you disable or don't configure this policy, your organization's logo from Entra won't be used.\r\n\r\nFor more information about configuring your organization's logo on Entra, please visit https://go.microsoft.com/fwlink/?linkid=2254514.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_recommended_organizationlogooverlayonappiconenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_recommended_organizationlogooverlayonappiconenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_recommended~identity_recommended_automaticprofileswitchingsitelist_recommended","displayName":"Configure the automatic profile switching site list (User)","description":"Set this policy to control which profiles Microsoft Edge will use to open sites in. Switching configurations for sites listed in this policy take precedence over other heuristics Microsoft Edge uses for switching sites but note that sites not listed on this policy are still subject to switching by those heuristics. If this policy is not configured, Microsoft Edge will continue using its heuristics to automatically switch sites.\r\n\r\nThis policy maps a URL hostname to a profile that it should be opened in.\r\n\r\nThe 'site' field should take the form of a URL hostname.\r\n\r\nThe 'profile' field can take one of the following values:\r\n- 'Work': The most recently used Microsoft Entra signed-in profile will be used to open 'site'.\r\n- 'Personal': The most recently used MSA signed-in profile will be used to open 'site'.\r\n- 'No preference': The currently used profile will be used to open 'site'.\r\n- Wildcard email address: This takes the form of '*@contoso.com'. A profile whose username ends with the contents following the '*' will be used to open 'site'.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"site\": \"work.com\",\r\n \"profile\": \"Work\"\r\n },\r\n {\r\n \"site\": \"personal.com\",\r\n \"profile\": \"Personal\"\r\n },\r\n {\r\n \"site\": \"nopreference.com\",\r\n \"profile\": \"No preference\"\r\n },\r\n {\r\n \"site\": \"contoso.com\",\r\n \"profile\": \"*@contoso.com\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_recommended~identity_recommended_automaticprofileswitchingsitelist_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_recommended~identity_recommended_automaticprofileswitchingsitelist_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_recommended~identity_recommended_automaticprofileswitchingsitelist_recommended_automaticprofileswitchingsitelist","displayName":"Configure the automatic profile switching site list (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_recommended~sleepingtabs_recommended_autodiscardsleepingtabsenabled_recommended","displayName":"Configure auto discard sleeping tabs (User)","description":"Setting this policy enables inactive (sleeping) tabs to be automatically discarded after 1.5 days of inactivity. This is done to save memory. When the user switches back to a discarded tab, the tab will need to be reloaded.\r\n\r\nIf the 'SleepingTabsEnabled' (Configure sleeping tabs) policy is enabled, then this feature will be enabled by default.\r\n\r\nIf the 'SleepingTabsEnabled' is disabled, then this feature will be disabled by default and cannot be enabled.\r\n\r\nIf enabled, idle background tabs will be discarded after 1.5 days.\r\n\r\nIf disabled, idle background tab will not be discarded after 1.5 days. Tabs can still be discarded for other reasons if this policy is disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_recommended~sleepingtabs_recommended_autodiscardsleepingtabsenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_recommended~sleepingtabs_recommended_autodiscardsleepingtabsenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_webappsettings","displayName":"Web App management settings (User)","description":"This policy allows an admin to specify settings for installed web apps. This policy maps a Web App ID to its specific setting. A default configuration can be set using the special ID *, which applies to all web apps without a custom configuration in this policy.\r\n\r\n- The manifest_id field is the Manifest ID for the Web App.\r\nSee https://developer.chrome.com/blog/pwa-manifest-id/\r\nfor instructions on how to determine the Manifest ID for an installed web app.\r\n- The run_on_os_login field specifies if a web app can be run during OS login.\r\nIf this field is set to blocked, the web app will not run during OS login and the user will not be able to enable this later.\r\nIf this field is set to run_windowed, the web app will run during OS login and the user won't be able to disable this later.\r\nIf this field is set to allowed, the user will be able to configure the web app to run at OS login.\r\nThe default policy configuration only allows the allowed and blocked values.\r\n- (Starting with Microsoft Edge version 120) The prevent_close_after_run_on_os_login field specifies if a web app can be prevented from closing in any way.\r\nFor example, by the user, by task manager, or by web APIs. This behavior can only be enabled if run_on_os_login is set to run_windowed.\r\nIf the app is already running, this setting will only take effect after the app is restarted.\r\nIf this field isn't defined, users can close the app.\r\n(This is currently not supported in Microsoft Edge.)\r\n- (Since version 118) The force_unregister_os_integration field specifies if all OS integration for a web app, that is, shortcuts, file handlers, protocol handlers and so on will be removed or not.\r\nIf an app is already running, this property will come into effect after the app restarts.\r\nThis should be used with caution, since it can override any OS integration that is set automatically during the startup of the web applications system. This currently only works on Windows, Mac and Linux platforms.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"manifest_id\": \"https://foo.example/index.html\",\r\n \"run_on_os_login\": \"allowed\"\r\n },\r\n {\r\n \"manifest_id\": \"https://bar.example/index.html\",\r\n \"run_on_os_login\": \"allowed\"\r\n },\r\n {\r\n \"manifest_id\": \"https://foobar.example/index.html\",\r\n \"run_on_os_login\": \"run_windowed\",\r\n \"prevent_close_after_run_on_os_login\": true\r\n },\r\n {\r\n \"manifest_id\": \"*\",\r\n \"run_on_os_login\": \"blocked\"\r\n },\r\n {\r\n \"manifest_id\": \"https://foo.example/index.html\",\r\n \"force_unregister_os_integration\": true\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_webappsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_webappsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge_webappsettings_webappsettings","displayName":"Web App management settings (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge~identity_automaticprofileswitchingsitelist","displayName":"Configure the automatic profile switching site list (User)","description":"Set this policy to control which profiles Microsoft Edge will use to open sites in. Switching configurations for sites listed in this policy take precedence over other heuristics Microsoft Edge uses for switching sites but note that sites not listed on this policy are still subject to switching by those heuristics. If this policy is not configured, Microsoft Edge will continue using its heuristics to automatically switch sites.\r\n\r\nThis policy maps a URL hostname to a profile that it should be opened in.\r\n\r\nThe 'site' field should take the form of a URL hostname.\r\n\r\nThe 'profile' field can take one of the following values:\r\n- 'Work': The most recently used Microsoft Entra signed-in profile will be used to open 'site'.\r\n- 'Personal': The most recently used MSA signed-in profile will be used to open 'site'.\r\n- 'No preference': The currently used profile will be used to open 'site'.\r\n- Wildcard email address: This takes the form of '*@contoso.com'. A profile whose username ends with the contents following the '*' will be used to open 'site'.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"site\": \"work.com\",\r\n \"profile\": \"Work\"\r\n },\r\n {\r\n \"site\": \"personal.com\",\r\n \"profile\": \"Personal\"\r\n },\r\n {\r\n \"site\": \"nopreference.com\",\r\n \"profile\": \"No preference\"\r\n },\r\n {\r\n \"site\": \"contoso.com\",\r\n \"profile\": \"*@contoso.com\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge~identity_automaticprofileswitchingsitelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge~identity_automaticprofileswitchingsitelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge~identity_automaticprofileswitchingsitelist_automaticprofileswitchingsitelist","displayName":"Configure the automatic profile switching site list (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge~sleepingtabs_autodiscardsleepingtabsenabled","displayName":"Configure auto discard sleeping tabs (User)","description":"Setting this policy enables inactive (sleeping) tabs to be automatically discarded after 1.5 days of inactivity. This is done to save memory. When the user switches back to a discarded tab, the tab will need to be reloaded.\r\n\r\nIf the 'SleepingTabsEnabled' (Configure sleeping tabs) policy is enabled, then this feature will be enabled by default.\r\n\r\nIf the 'SleepingTabsEnabled' is disabled, then this feature will be disabled by default and cannot be enabled.\r\n\r\nIf enabled, idle background tabs will be discarded after 1.5 days.\r\n\r\nIf disabled, idle background tab will not be discarded after 1.5 days. Tabs can still be discarded for other reasons if this policy is disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge~sleepingtabs_autodiscardsleepingtabsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev120~policy~microsoft_edge~sleepingtabs_autodiscardsleepingtabsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge_nativehostsexecutableslaunchdirectly","displayName":"Force Windows executable Native Messaging hosts to launch directly (User)","description":"This policy controls whether native host executables launch directly on Windows.\r\n\r\nIf you enable this policy, Microsoft Edge is forced to launch native messaging hosts implemented as executables directly.\r\n\r\nIf you disable this policy, Microsoft Edge will launch hosts using cmd.exe as an intermediary process.\r\n\r\nIf you don't configure this policy, Microsoft Edge will decide which approach to use based on a progressive rollout from the legacy behavior to the Launch Directly behavior, guided by ecosystem compatibility.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge_nativehostsexecutableslaunchdirectly_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge_nativehostsexecutableslaunchdirectly_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge_postquantumkeyagreementenabled","displayName":"Enable post-quantum key agreement for TLS (User)","description":"This policy configures whether Microsoft Edge will offer a post-quantum key agreement algorithm in TLS. This lets supporting servers protect user traffic from being decrypted by quantum computers.\r\n\r\nIf you enable this policy, Microsoft Edge will offer a post-quantum key agreement in TLS connections. TLS connections will be protected from quantum computers when communicating with compatible servers.\r\n\r\nIf you disable this policy, Microsoft Edge will not offer a post-quantum key agreement in TLS connections. User traffic will be unprotected from decryption by quantum computers.\r\n\r\nIf you don't configure this policy, Microsoft Edge will follow the default rollout process for offering a post-quantum key agreement.\r\n\r\nOffering a post-quantum key agreement is backwards-compatible. Existing TLS servers and networking middleware are expected to ignore the new option and continue selecting previous options.\r\n\r\nHowever, devices that don't implement TLS correctly may malfunction when offered the new option. For example, they might disconnect in response to unrecognized options or the resulting larger messages. These devices are not post-quantum-ready and will interfere with an enterprise's post-quantum transition. If this issue is encountered, administrators should contact the vendor for a fix.\r\n\r\nThis policy is a temporary measure and will be removed in future versions of Microsoft Edge. You can enable it to test for issues and you can disable it while you resolve issues.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge_postquantumkeyagreementenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge_postquantumkeyagreementenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge~googlecast_edgedisabledialprotocolforcastdiscovery","displayName":"Disable DIAL protocol for cast device discovery (User)","description":"Enable this policy to disable the DIAL (Discovery And Launch) protocol for cast device discovery. (If EnableMediaRouter is disabled, this policy will have no effect).\r\n\r\nEnable this policy to disable DIAL protocol.\r\n\r\nBy default, Cast device discovery will use DIAL protocol.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge~googlecast_edgedisabledialprotocolforcastdiscovery_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge~googlecast_edgedisabledialprotocolforcastdiscovery_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge~relatedwebsitesets_relatedwebsitesetsenabled","displayName":"Enable Related Website Sets (User)","description":"This policy lets you control the enablement of the Related Website Sets feature. Related Website Sets (RWS) is a way for an organisation to declare relationships among sites, so that Microsoft Edge allows limited third-party cookie access for specific purposes across those sites.\r\n\r\nIf this policy set to True or unset, the Related Website Sets feature is enabled.\r\n\r\nIf this policy is set to False, the Related Website Sets feature is disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge~relatedwebsitesets_relatedwebsitesetsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge~relatedwebsitesets_relatedwebsitesetsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge~relatedwebsitesets_relatedwebsitesetsoverrides","displayName":"Override Related Website Sets. (User)","description":"This policy provides a way to override the list of sets Microsoft Edge uses for Related Website Sets\r\n\r\nEach set in the browser's list of Related Website Sets must meet the requirements of a Related Website Set. A Related Website Set must contain a primary site and one or more member sites.\r\nA set can also contain a list of service sites that it owns, as well as a map from a site to all its ccTLD variants. See https://github.com/WICG/first-party-sets for more information on how Microsoft Edge uses Related Website Sets.\r\n\r\n\r\nAll sites in a Related Website Set must be a registrable domain served over HTTPS. Each site in a Related Website Set must also be unique, which means a site can't be listed more than once in a Related Website Set.\r\n\r\nWhen this policy is given an empty dictionary, Microsoft Edge uses the public list of Related Website Sets.\r\n\r\nFor all sites in a Related Website Set from the replacements list, if a site is also present on a Related Website Set in the browser's list, then that site will be removed from the browser's Related Website Set. After this, the policy's Related Website Set will be added to the Microsoft Edge's list of Related Website Sets.\r\n\r\nFor all sites in a Related Website Set from the additions list, if a site is also present on a Related Website Set in Microsoft Edge's list, then the browser's Related Website Set will be updated so that the new Related Website Set can be added to the browser's list. After the browser's list has been updated, the policy's Related Website Set will be added to the browser's list of Related Website Sets.\r\n\r\nThe browser's list of Related Website Sets requires that for all sites in its list, no site is in\r\nmore than one set. This is also required for both the replacements list\r\nand the additions list. Similarly, a site can't be in both the\r\nreplacements list and the additions list.\r\n\r\nWildcards (*) aren't supported as a policy value, or as a value within any Related Website Set in these lists.\r\n\r\nExample value:\r\n\r\n{\r\n \"additions\": [\r\n {\r\n \"associatedSites\": [\r\n \"https://associate2.test\"\r\n ],\r\n \"ccTLDs\": {\r\n \"https://associate2.test\": [\r\n \"https://associate2.com\"\r\n ]\r\n },\r\n \"primary\": \"https://primary2.test\",\r\n \"serviceSites\": [\r\n \"https://associate2-content.test\"\r\n ]\r\n }\r\n ],\r\n \"replacements\": [\r\n {\r\n \"associatedSites\": [\r\n \"https://associate1.test\"\r\n ],\r\n \"ccTLDs\": {\r\n \"https://associate1.test\": [\r\n \"https://associate1.co.uk\"\r\n ]\r\n },\r\n \"primary\": \"https://primary1.test\",\r\n \"serviceSites\": [\r\n \"https://associate1-content.test\"\r\n ]\r\n }\r\n ]\r\n}\r\n\r\n\r\nCompact example value:\r\n\r\n{\"additions\": [{\"associatedSites\": [\"https://associate2.test\"], \"ccTLDs\": {\"https://associate2.test\": [\"https://associate2.com\"]}, \"primary\": \"https://primary2.test\", \"serviceSites\": [\"https://associate2-content.test\"]}], \"replacements\": [{\"associatedSites\": [\"https://associate1.test\"], \"ccTLDs\": {\"https://associate1.test\": [\"https://associate1.co.uk\"]}, \"primary\": \"https://primary1.test\", \"serviceSites\": [\"https://associate1-content.test\"]}]}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge~relatedwebsitesets_relatedwebsitesetsoverrides_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge~relatedwebsitesets_relatedwebsitesetsoverrides_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge~relatedwebsitesets_relatedwebsitesetsoverrides_relatedwebsitesetsoverrides","displayName":"Override Related Website Sets. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge~typosquattingchecker_preventtyposquattingpromptoverride","displayName":"Prevent bypassing Edge Website Typo Protection prompts for sites (User)","description":"This policy setting lets you decide whether users can override the Edge Website Typo Protection warnings about potential typosquatting websites.\r\n\r\nIf you enable this setting, users can't ignore Edge Website Typo Protection warnings and they are blocked from continuing to the site.\r\n\r\nIf you disable or don't configure this setting, users can ignore Edge Website Typo Protection warnings and continue to the site.\r\n\r\nThis will only take effect when TyposquattingCheckerEnabled policy is not set or set to enabled.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge~typosquattingchecker_preventtyposquattingpromptoverride_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge~typosquattingchecker_preventtyposquattingpromptoverride_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge~typosquattingchecker_typosquattingallowlistdomains","displayName":"Configure the list of domains for which Edge Website Typo Protection won't trigger warnings (User)","description":"Configure the list of Edge Website Typo Protection trusted domains. This means:\r\nEdge Website Typo Protection won't check for potentially malicious typosquatting websites.\r\n\r\nIf you enable this policy, Edge Website Typo Protection trusts these domains.\r\nIf you disable or don't set this policy, default Edge Website Typo Protection protection is applied to all resources.\r\n\r\nThis will only take effect when TyposquattingCheckerEnabled policy is not set or set to enabled.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10/11 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.\r\nAlso note that this policy does not apply if your organization has enabled Microsoft Defender for Endpoint. You must configure your allow and block lists in Microsoft 365 Defender portal using Indicators (Settings > Endpoints > Indicators).\r\n\r\nExample value:\r\n\r\nmydomain.com\r\nmyuniversity.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge~typosquattingchecker_typosquattingallowlistdomains_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge~typosquattingchecker_typosquattingallowlistdomains_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev121~policy~microsoft_edge~typosquattingchecker_typosquattingallowlistdomains_typosquattingallowlistdomainsdesc","displayName":"Configure the list of domains for which Edge Website Typo Protection won't trigger warnings (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev122~policy~microsoft_edge_aigenthemesenabled","displayName":"Enables DALL-E themes generation (User)","description":"This policy lets you generate browser themes using DALL-E and apply them to Microsoft Edge.\r\n\r\nIf you enable or don't configure this policy, the AI generated themes will be enabled.\r\n\r\nIf you disable this policy, the AI generated themes will be disabled for your organization.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev122~policy~microsoft_edge_aigenthemesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev122~policy~microsoft_edge_aigenthemesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev122~policy~microsoft_edge_enhancesecuritymodeallowuserbypass","displayName":"Allow users to bypass Enhanced Security Mode (User)","description":"Microsoft Edge will let users bypass Enhanced Security Mode on a site via Settings page or PageInfo flyout. This policy lets you configure whether users can bypass Enhanced Security Mode.\r\n\r\nIf you disable this policy, Microsoft Edge won't allow users to bypass Enhanced Security Mode.\r\n\r\nIf you enable or don't configure this policy, Microsoft Edge will allow users to bypass Enhanced Security Mode.\r\n\r\nFor detailed information about Enhanced Security Mode, see https://go.microsoft.com/fwlink/?linkid=2185895","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev122~policy~microsoft_edge_enhancesecuritymodeallowuserbypass_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev122~policy~microsoft_edge_enhancesecuritymodeallowuserbypass_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev122~policy~microsoft_edge_superdragdropenabled","displayName":"Super Drag Drop Enabled (User)","description":"This policy lets you configure the Super Drag Drop feature in Microsoft Edge.\r\n\r\nWith this feature, users can drag a link or text from a webpage and drop it onto the same page. They can then either open the URL in a new tab or search the text using the default search engine.\r\n\r\nIf you enable or don't configure this policy, you can use the Super Drag Drop feature on Microsoft Edge.\r\n\r\nIf you disable this policy, you can't use the Super Drag Drop feature in Microsoft Edge.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev122~policy~microsoft_edge_superdragdropenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev122~policy~microsoft_edge_superdragdropenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev122~policy~microsoft_edge_urldiagnosticdataenabled","displayName":"URL reporting in Edge diagnostic data enabled (User)","description":"Controls sending URLs of pages visited and per-page usage in the Microsoft Edge optional diagnostics data to Microsoft to help make browsing and search better. This also includes identifiers and usage diagnostics of other browser components that can modify or provide content, such as extensions.\r\n\r\nThis policy is applicable only if the 'DiagnosticData' (Send required and optional diagnostic data about browser usage) setting is set to 'OptionalData'. See the description of 'DiagnosticData' for more information on how Microsoft Edge diagnostic data levels are set.\r\n\r\nIf you enable or don't configure this setting, URLs are provided in optional diagnostic data.\r\n\r\nIf you disable this setting, URLs are not reported in optional diagnostic data.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev122~policy~microsoft_edge_urldiagnosticdataenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev122~policy~microsoft_edge_urldiagnosticdataenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge_rsakeyusageforlocalanchorsenabled","displayName":"Check RSA key usage for server certificates issued by local trust anchors (User)","description":"The X.509 key usage extension declares how the key in a certificate can be\r\nused. These instructions ensure certificates aren't used in an unintended\r\ncontext, which protects against a class of cross-protocol attacks on HTTPS and\r\nother protocols. HTTPS clients must verify that server certificates match the\r\nconnection's TLS parameters.\r\n\r\nIf this policy is enabled,\r\nMicrosoft Edge will perform this key\r\ncheck. This helps prevent attacks where an attacker manipulates the browser into\r\ninterpreting a key in ways that the certificate owner did not intend.\r\n\r\nIf this policy is set to disabled or not configured,\r\nMicrosoft Edge will skip this key check in\r\nHTTPS connections that negotiate TLS 1.2 and use an RSA certificate that\r\nchains to a local trust anchor. Examples of local trust anchors include\r\npolicy-provided or user-installed root certificates. In all other cases, the\r\ncheck is performed independent of this policy's setting.\r\n\r\nThis policy is available for administrators to preview the behavior of a\r\nfuture release, which will enable this check by default. At that point, this\r\npolicy will remain temporarily available for administrators that need more\r\ntime to update their certificates to meet the new RSA key usage requirements.\r\n\r\nConnections that fail this check will fail with the error\r\nERR_SSL_KEY_USAGE_INCOMPATIBLE. Sites that fail with this error likely have a\r\nmisconfigured certificate. Modern ECDHE_RSA cipher suites use the\r\n\"digitalSignature\" key usage option, while legacy RSA decryption cipher suites\r\nuse the \"keyEncipherment\" key usage option. If uncertain, administrators should\r\ninclude both in RSA certificates meant for HTTPS.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge_rsakeyusageforlocalanchorsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge_rsakeyusageforlocalanchorsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge_screencapturewithoutgestureallowedfororigins","displayName":"Allow screen capture without prior user gesture (User)","description":"For security reasons, the\r\ngetDisplayMedia() web API requires\r\na prior user gesture (\"transient activation\") to be called or the API will\r\nfail.\r\n\r\nWhen this policy is configured, admins can specify origins on which this API\r\ncan be called without prior user gesture.\r\n\r\nFor detailed information on valid url patterns, see\r\nhttps://go.microsoft.com/fwlink/?linkid=2095322. Note: * is not an accepted\r\nvalue for this policy.\r\n\r\nIf this policy is not configured, all origins require a prior user gesture to\r\ncall this API.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge_screencapturewithoutgestureallowedfororigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge_screencapturewithoutgestureallowedfororigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge_screencapturewithoutgestureallowedfororigins_screencapturewithoutgestureallowedfororiginsdesc","displayName":"Allow screen capture without prior user gesture (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~contentsettings_defaultwindowmanagementsetting","displayName":"Default Window Management permission setting (User)","description":"Setting the policy to \"BlockWindowManagement\" (value 2) automatically denies the window management permission to sites by default. This limits the ability of sites to see information about the device's screens and use that information to open and place windows or request fullscreen on specific screens.\r\n\r\nSetting the policy to \"AskWindowManagement\" (value 3) by default prompts the user when the window management permission is requested. If users allow the permission, it extends the ability of sites to see information about the device's screens and use that information to open and place windows or request fullscreen on specific screens.\r\n\r\nNot configuring the policy means the \"AskWindowManagement\" policy applies, but users can change this setting.\r\n\r\nPolicy options mapping:\r\n\r\n* BlockWindowManagement (2) = Denies the Window Management permission on all sites by default\r\n\r\n* AskWindowManagement (3) = Ask every time a site wants obtain the Window Management permission\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~contentsettings_defaultwindowmanagementsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~contentsettings_defaultwindowmanagementsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~contentsettings_defaultwindowmanagementsetting_defaultwindowmanagementsetting","displayName":"Default Window Management permission setting (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~contentsettings_defaultwindowmanagementsetting_defaultwindowmanagementsetting_2","displayName":"Denies the Window Management permission on all sites by default","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~contentsettings_defaultwindowmanagementsetting_defaultwindowmanagementsetting_3","displayName":"Ask every time a site wants obtain the Window Management permission","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~contentsettings_windowmanagementallowedforurls","displayName":"Allow Window Management permission on specified sites (User)","description":"Lets you configure a list of site url patterns that specify sites which will automatically grant the window management permission. This extends the ability of sites to see information about the device's screens. This information can be used to open and place windows or request fullscreen on specific screens.\r\n\r\nFor detailed information on valid site url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed. This policy only matches based on site origin, so any path in the URL pattern is ignored.\r\n\r\nIf this policy isn't configured for a site, then the policy from 'DefaultWindowManagementSetting' (Default Window Management permission setting) applies to the site, if configured. Otherwise the permission will follow the browser's defaults and let users choose this permission per site.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~contentsettings_windowmanagementallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~contentsettings_windowmanagementallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~contentsettings_windowmanagementallowedforurls_windowmanagementallowedforurlsdesc","displayName":"Allow Window Management permission on specified sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~contentsettings_windowmanagementblockedforurls","displayName":"Block Window Management permission on specified sites (User)","description":"Lets you configure a list of site url patterns that specify sites which will automatically deny the window management permission. This limits the ability of sites to see information about the device's screens. This information can be used to open and place windows or request fullscreen on specific screens.\r\n\r\nFor detailed information on valid site url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed. This policy only matches based on site origin, so any path in the URL pattern is ignored.\r\n\r\nIf this policy isn't configured for a site, then the policy from 'DefaultWindowManagementSetting' (Default Window Management permission setting) applies to the site, if configured. Otherwise the permission will follow the browser's defaults and let users choose this permission per site.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~contentsettings_windowmanagementblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~contentsettings_windowmanagementblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~contentsettings_windowmanagementblockedforurls_windowmanagementblockedforurlsdesc","displayName":"Block Window Management permission on specified sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~extensions_extensioninstalltypeblocklist","displayName":"Blocklist for extension install types (User)","description":"The blocklist controls which extension install types are disallowed.\r\n\r\nSetting the \"command_line\" will block an extension from being loaded from command line.\r\n\r\nPolicy options mapping:\r\n\r\n* command_line (command_line) = Blocks extensions from being loaded from command line\r\n\r\nUse the preceding information when configuring this policy.\r\n\r\nExample value:\r\n\r\ncommand_line","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~extensions_extensioninstalltypeblocklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~extensions_extensioninstalltypeblocklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~extensions_extensioninstalltypeblocklist_extensioninstalltypeblocklistdesc","displayName":"Blocklist for extension install types (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~extensions_extensionmanifestv2availability","displayName":"Control Manifest v2 extension availability (User)","description":"Control if Manifest v2 extensions can be used by browser.\r\n\r\nManifest v2 extensions support will be deprecated and all extensions need to be migrated to v3 in the future. More information about, and the timeline of the migration has not been established.\r\n\r\nIf the policy is set to Default or not set, v2 extension loading is decided by browser. This will follow the preceding timeline when it's established.\r\n\r\nIf the policy is set to Disable, v2 extensions installation are blocked, and existing ones are disabled. This option is going to be treated the same as if the policy is unset after v2 support is turned off by default.\r\n\r\nIf the policy is set to Enable, v2 extensions are allowed. The option is going to be treated the same as if the policy isn't set before v2 support is turned off by default.\r\n\r\nIf the policy is set to EnableForForcedExtensions, force installed v2 extensions are allowed. This includes extensions that are listed by 'ExtensionInstallForcelist' (Control which extensions are installed silently) or 'ExtensionSettings' (Configure extension management settings) with installation_mode \"force_installed\" or \"normal_installed\". All other v2 extensions are disabled. The option is always available regardless of the manifest migration state.\r\n\r\nExtensions availabilities are still controlled by other policies.\r\n\r\nPolicy options mapping:\r\n\r\n* Default (0) = Default browser behavior\r\n\r\n* Disable (1) = Manifest v2 is disabled\r\n\r\n* Enable (2) = Manifest v2 is enabled\r\n\r\n* EnableForForcedExtensions (3) = Manifest v2 is enabled for forced extensions only\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~extensions_extensionmanifestv2availability_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~extensions_extensionmanifestv2availability_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~extensions_extensionmanifestv2availability_extensionmanifestv2availability","displayName":"Control Manifest v2 extension availability (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~extensions_extensionmanifestv2availability_extensionmanifestv2availability_0","displayName":"Default browser behavior","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~extensions_extensionmanifestv2availability_extensionmanifestv2availability_1","displayName":"Manifest v2 is disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~extensions_extensionmanifestv2availability_extensionmanifestv2availability_2","displayName":"Manifest v2 is enabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev123~policy~microsoft_edge~extensions_extensionmanifestv2availability_extensionmanifestv2availability_3","displayName":"Manifest v2 is enabled for forced extensions only","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev124~policy~microsoft_edge_copilotcdppagecontext","displayName":"Control Copilot with Commercial Data Protection access to page context for Microsoft Entra ID profiles (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 132.\r\n\r\nThis policy has been obsoleted as of Edge 133. Instead of this obsolete policy, we recommend using 'EdgeEntraCopilotPageContext' (Control Copilot access to Microsoft Edge page content for Entra account user profiles when using Copilot in the Microsoft Edge sidepane).\r\n\r\nThis policy controls access to page contents for Copilot with Commercial Data Protection in the Edge sidebar. This policy applies only to Microsoft Entra ID profiles. To summarize pages and interact with text selections, it needs to be able to access the page contents. This policy does not apply to MSA profiles. This policy doesn't control access for Copilot without Commercial Data Protection. Access for Copilot without Commercial Data Protection is controlled by the policy CopilotPageContext.\r\n\r\nIf you enable this policy, Copilot with Commercial Data Protection will have access to page context.\r\n\r\nIf you don't configure this policy, a user can enable access to page context for Copilot with Commercial Data Protection using the setting toggle in Edge.\r\n\r\nIf you disable this policy, Copilot with Commercial Data Protection will not be able to access page context.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev124~policy~microsoft_edge_copilotcdppagecontext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev124~policy~microsoft_edge_copilotcdppagecontext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev124~policy~microsoft_edge_copilotpagecontext","displayName":"Control Copilot access to page context for Microsoft Entra ID profiles (User)","description":"This policy controls access to page contents for Copilot in the Microsoft Edge sidebar when users are logged into their MSA Copilot account. This policy applies only to Microsoft Entra ID Microsoft Edge profiles. To summarize pages and interact with text selections, it needs to be able to access the page contents. This policy does not apply to MSA Microsoft Edge profiles. This policy doesn't control access for Copilot with enterprise data protection (EDP). Access for Copilot with enterprise data protection (EDP) is controlled by the 'EdgeEntraCopilotPageContext' (Control Copilot access to Microsoft Edge page content for Entra account user profiles when using Copilot in the Microsoft Edge sidepane) policy.\r\n\r\nIf you enable this policy, Copilot will have access to page content when logged in with Entra ID.\r\n\r\nIf this policy is not configured, the default behavior for non-EU countries is that access is initially enabled. For EU countries, the default behavior is that access is initially disabled. In both cases, if the policy is not configured, users can enable or disable Copilot's access to page content using the setting toggle in Microsoft Edge.\r\n\r\nIf you disable this policy, Copilot will not be able to access page context.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev124~policy~microsoft_edge_copilotpagecontext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev124~policy~microsoft_edge_copilotpagecontext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev124~policy~microsoft_edge_mutationeventsenabled","displayName":"Enable deprecated/removed Mutation Events (deprecated) (User)","description":"DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.\r\n\r\nThis policy provides a temporary opt-in back to a deprecated and removed set of platform events named Mutation Events.\r\n\r\nIf you enable this policy, mutation events will continue to be fired, even if they've been disabled by default for normal web users.\r\n\r\nIf you disable or don't configure this policy, these events will not be fired.\r\n\r\nThis policy is a temporary workaround, and enterprises should still work to remove their dependencies on these mutation events.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev124~policy~microsoft_edge_mutationeventsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev124~policy~microsoft_edge_mutationeventsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev125~policy~microsoft_edge_imageeditorserviceenabled","displayName":"Enable the Designer for Image Editor feature (User)","description":"Lets users access and use the Designer for Image Editor feature to edit an image they select.\r\n\r\nIf you enable or don't configure this policy, users can access and use the Designer for Image Editor feature in Microsoft Edge.\r\n\r\nIf you disable this policy, users can't access and use the Designer for Image Editor feature in Microsoft Edge.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev125~policy~microsoft_edge_imageeditorserviceenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev125~policy~microsoft_edge_imageeditorserviceenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev125~policy~microsoft_edge_qrcodegeneratorenabled","displayName":"Enable QR Code Generator (User)","description":"This policy enables the QR Code generator feature in Microsoft Edge.\r\n\r\nIf you enable this policy or don't configure it, the QR Code Generator feature is enabled.\r\n\r\nIf you disable this policy, the QR Code Generator feature is disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev125~policy~microsoft_edge_qrcodegeneratorenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev125~policy~microsoft_edge_qrcodegeneratorenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev125~policy~microsoft_edge~network_zstdcontentencodingenabled","displayName":"Enable zstd content encoding support (User)","description":"This feature enables advertising \"zstd\" support in the Accept-Encoding request header and support for decompressing zstd web content.\r\n\r\nIf you enable or don't configure this policy, Microsoft Edge will accept server responses compressed with zstd.\r\n\r\nIf you disable this policy, the zstd content encoding feature will not be advertised or supported when processing server responses.\r\n\r\nThis policy is temporary and will be removed in the future.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev125~policy~microsoft_edge~network_zstdcontentencodingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev125~policy~microsoft_edge~network_zstdcontentencodingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev126~policy~microsoft_edge_internetexplorersetforegroundwhenactive","displayName":"Keep the active Microsoft Edge window with an Internet Explorer mode tab always in the foreground. (User)","description":"This policy controls whether to always keep the active Microsoft Edge window with an Internet Explorer mode tab in the foreground.\r\n\r\nIf you enable this policy, the active Microsoft Edge window with an Internet Explorer mode tab will always be in the foreground.\r\n\r\nIf you disable or don't configure this policy, the active Microsoft Edge window with an Internet Explorer mode tab will not be kept in the foreground.\r\n\r\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev126~policy~microsoft_edge_internetexplorersetforegroundwhenactive_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev126~policy~microsoft_edge_internetexplorersetforegroundwhenactive_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev126~policy~microsoft_edge~identity_proactiveauthworkflowenabled","displayName":"Enable proactive authentication (User)","description":"This policy controls the proactive authentication in Microsoft Edge, that connects the signed-in user identity with Microsoft Bing, MSN and Copilot services for a smooth and consistent sign-in experience.\r\n\r\nIf you enable or don't configure this policy, Microsoft Edge authentication requests are automatically sent to the services using the account that is signed-in to the browser.\r\n\r\nIf you disable this policy, Microsoft Edge does not send authentications requests to these services and users will need to manually sign-in.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev126~policy~microsoft_edge~identity_proactiveauthworkflowenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev126~policy~microsoft_edge~identity_proactiveauthworkflowenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev127~policy~microsoft_edge_csscustomstatedeprecatedsyntaxenabled","displayName":"Controls whether the deprecated :--foo syntax for CSS custom state is enabled (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 132.\r\n\r\nThe :--foo syntax for the CSS custom state feature is being changed to :state(foo) in Microsoft Edge in order to comply with changes that have been made in Firefox and Safari. This policy lets the deprecated syntax to be used until Stable 132.\r\n\r\nThis deprecation might break some Microsoft Edge-only websites that use the deprecated :--foo syntax.\r\n\r\nIf you enable this policy, the deprecated syntax will be enabled.\r\n\r\nIf you disable this policy or don't set it, the deprecated syntax will be disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev127~policy~microsoft_edge_csscustomstatedeprecatedsyntaxenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev127~policy~microsoft_edge_csscustomstatedeprecatedsyntaxenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev127~policy~microsoft_edge_edgesidebarappurlhostblocklist","displayName":"Control which apps cannot be opened in Microsoft Edge sidebar (User)","description":"Define a list of sites, based on URL patterns, that cannot be opened in sidebar.\r\n\r\nIf you don't configure this policy, a user can open any app in sidebar.\r\n\r\nIf the 'HubsSidebarEnabled' (Show Hubs Sidebar) policy is disabled, this list isn't used and no sidebar can be opened.\r\n\r\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2281313.\r\n\r\nNote: A blocklist value of '*' means all apps are blocked unless they are explicitly listed in the 'EdgeSidebarAppUrlHostAllowList' (Allow specific apps to be opened in Microsoft Edge sidebar) policy.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev127~policy~microsoft_edge_edgesidebarappurlhostblocklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev127~policy~microsoft_edge_edgesidebarappurlhostblocklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev127~policy~microsoft_edge_edgesidebarappurlhostblocklist_edgesidebarappurlhostblocklistdesc","displayName":"Control which apps cannot be opened in Microsoft Edge sidebar (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev128.1~policy~microsoft_edge_applicationboundencryptionenabled","displayName":"Enable Application Bound Encryption (User)","description":"Enabling this policy or leaving it unset binds the encryption keys used for local data storage to Microsoft Edge whenever possible.\r\n\r\nDisabling this policy has a detrimental effect on Microsoft Edge's security because unknown and potentially hostile apps can retrieve the encryption keys used to secure data.\r\n\r\nOnly turn off this policy if there are compatibility issues, such as scenarios where other applications need legitimate access to Microsoft Edge's data. Encrypted user data is expected to be fully portable between different computers or the integrity and location of Microsoft Edge's executable files isn’t consistent.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev128.1~policy~microsoft_edge_applicationboundencryptionenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev128.1~policy~microsoft_edge_applicationboundencryptionenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge_dynamiccodesettings","displayName":"Dynamic Code Settings (User)","description":"This policy controls the dynamic code settings for Microsoft Edge.\r\n\r\nDisabling dynamic code improves the security of Microsoft Edge by preventing potentially hostile dynamic code and third-party code from making changes to Microsoft Edge's behavior. However this might cause compatibility issues with third-party software that must run in the browser process.\r\n\r\nIf you set this policy to 0 (the default) or leave unset, then Microsoft Edge will use the default settings.\r\n\r\nIf you set this policy to 1 – (EnabledForBrowser) then the Microsoft Edge browser process is prevented from creating dynamic code.\r\n\r\nPolicy options mapping:\r\n\r\n* Default (0) = Default dynamic code settings\r\n\r\n* EnabledForBrowser (1) = Prevent the browser process from creating dynamic code\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge_dynamiccodesettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge_dynamiccodesettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge_dynamiccodesettings_dynamiccodesettings","displayName":"Dynamic Code Settings (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge_dynamiccodesettings_dynamiccodesettings_0","displayName":"Default dynamic code settings","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge_dynamiccodesettings_dynamiccodesettings_1","displayName":"Prevent the browser process from creating dynamic code","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge_edgeopeninsidebarenabled","displayName":"Enable open in sidebar (User)","description":"Allow/Disallow user open a website or an app to the sidebar.\r\n\r\nIf you enable or don't configure this policy, users will be able to access the feature.\r\nIf you disable this policy, users will not be able to access the feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge_edgeopeninsidebarenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge_edgeopeninsidebarenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge_edgesidebarcustomizeenabled","displayName":"Enable sidebar customize (User)","description":"Allow/Disallow to use sidebar customize.\r\n\r\nIf you enable or don't configure this policy, users will be able to access sidebar customize.\r\nIf you disable this policy, users will not be able to access the sidebar customize.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge_edgesidebarcustomizeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge_edgesidebarcustomizeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge_keyboardfocusablescrollersenabled","displayName":"Enable keyboard focusable scrollers (User)","description":"This policy provides a temporary opt-out for the new keyboard focusable scrollers behavior.\r\n\r\nWhen this policy is Enabled or unset, scrollers without focusable children are keyboard focusable by default.\r\n\r\nWhen this policy is Disabled, scrollers are not keyboard focusable by default.\r\n\r\nThis policy is a temporary workaround and will be removed in Edge Stable 135.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge_keyboardfocusablescrollersenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge_keyboardfocusablescrollersenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge_recommended~downloads_recommended_showdownloadsinsecurewarningsenabled_recommended","displayName":"Enable insecure download warnings (User)","description":"Enables warnings when potentially dangerous content is downloaded over HTTP.\r\n\r\nIf you enable or don't configure this policy, when a user tries to download potentially dangerous content from an HTTP site, the user will receive a UI warning, such as \"Insecure download blocked.\" The user will still have an option to proceed and download the item.\r\n\r\nIf you disable this policy, the warnings for insecure downloads will be suppressed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge_recommended~downloads_recommended_showdownloadsinsecurewarningsenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge_recommended~downloads_recommended_showdownloadsinsecurewarningsenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge~downloads_showdownloadsinsecurewarningsenabled","displayName":"Enable insecure download warnings (User)","description":"Enables warnings when potentially dangerous content is downloaded over HTTP.\r\n\r\nIf you enable or don't configure this policy, when a user tries to download potentially dangerous content from an HTTP site, the user will receive a UI warning, such as \"Insecure download blocked.\" The user will still have an option to proceed and download the item.\r\n\r\nIf you disable this policy, the warnings for insecure downloads will be suppressed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge~downloads_showdownloadsinsecurewarningsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge~downloads_showdownloadsinsecurewarningsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge~extensions_extensiondevelopermodesettings","displayName":"Control the availability of developer mode on extensions page (User)","description":"Control if users can turn on Developer Mode on edge://extensions.\r\n\r\nIf the policy isn't set, users can turn on developer mode on the extension page unless DeveloperToolsAvailability policy is set to DeveloperToolsDisallowed (2).\r\nIf the policy is set to Allow (0), users can turn on developer mode on the extensions page.\r\nIf the policy is set to Disallow (1), users cannot turn on developer mode on the extensions page.\r\n\r\nIf this policy is set, DeveloperToolsAvailability can no longer control extensions developer mode.\r\n\r\nPolicy options mapping:\r\n\r\n* Allow (0) = Allow the usage of developer mode on extensions page\r\n\r\n* Disallow (1) = Do not allow the usage of developer mode on extensions page\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge~extensions_extensiondevelopermodesettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge~extensions_extensiondevelopermodesettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge~extensions_extensiondevelopermodesettings_extensiondevelopermodesettings","displayName":"Control the availability of developer mode on extensions page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge~extensions_extensiondevelopermodesettings_extensiondevelopermodesettings_0","displayName":"Allow the usage of developer mode on extensions page","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge~extensions_extensiondevelopermodesettings_extensiondevelopermodesettings_1","displayName":"Do not allow the usage of developer mode on extensions page","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge~extensions_extensionextendedbackgroundlifetimeforportconnectionstourls","displayName":"Configure a list of origins that grant an extended background lifetime to connecting extensions. (User)","description":"Extensions that connect to one of these origins will keep running as long as the port is connected.\r\nIf unset, the policy's default values are used. These are the app origins that offer SDKs that are known to not offer the possibility to restart a closed connection to a previous state:\r\n- Smart Card Connector\r\n- Citrix Receiver (stable, beta, back-up)\r\n- VMware Horizon (stable, beta)\r\n\r\nIf set, the default value list is extended with the newly configured values. The defaults and policy-provided entries will grant the exception to the connecting extensions, as long as the port is connected.\r\n\r\nExample value:\r\n\r\nchrome-extension://abcdefghijklmnopabcdefghijklmnop/\r\nchrome-extension://bcdefghijklmnopabcdefghijklmnopa/","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge~extensions_extensionextendedbackgroundlifetimeforportconnectionstourls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge~extensions_extensionextendedbackgroundlifetimeforportconnectionstourls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev128~policy~microsoft_edge~extensions_extensionextendedbackgroundlifetimeforportconnectionstourls_extensionextendedbackgroundlifetimeforportconnectionstourlsdesc","displayName":"Configure a list of origins that grant an extended background lifetime to connecting extensions. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev129~policy~microsoft_edge~printing_printinglpacsandboxenabled","displayName":"Enable Printing LPAC Sandbox (User)","description":"Setting this policy to Enabled or leaving it unset enables the LPAC Sandbox for printing services when the system configuration supports it.\r\n\r\nSetting this policy to Disabled has a detrimental effect on Microsoft Edge's security because services used for printing might run in a weaker sandbox configuration.\r\n\r\nOnly turn this policy off if there are compatibility issues with third party software that prevent printing services from operating correctly inside the LPAC Sandbox.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev129~policy~microsoft_edge~printing_printinglpacsandboxenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev129~policy~microsoft_edge~printing_printinglpacsandboxenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev130~policy~microsoft_edge_edgeentracopilotpagecontext","displayName":"Control Copilot access to Microsoft Edge page content for Entra account user profiles when using Copilot in the Microsoft Edge sidepane (User)","description":"This policy controls whether Copilot in the Microsoft Edge sidepane can access Microsoft Edge page content. This includes page summarization and similar contextual queries sent to Copilot.\r\n\r\nThis policy only applies to users who are signed in to Microsoft Edge with their Entra account and are using Copilot in the sidepane. This policy applies to all Copilot products in the Microsoft Edge sidepane - namely, Microsoft 365 Copilot Business Chat and Microsoft Copilot with enterprise data protection (EDP).\r\n\r\nIf you enable this policy, Copilot will be able to access Microsoft Edge page content when users ask a contextual query to Copilot in the Microsoft Edge sidepane.\r\n\r\nIf you disable this policy, Copilot will not be able to access Microsoft Edge page content.\r\n\r\nIf you don't configure this policy, the default behavior is as follows:\r\n\r\n- For non-EU countries, access is enabled by default.\r\n\r\n- For EU countries, access is disabled by default.\r\n\r\n- In both cases, if the policy is not configured, users can enable or disable Copilot access to Microsoft Edge page content using the toggle in Microsoft Edge settings.\r\n\r\nExceptions to the preceding behavior include when a page is protected using data loss prevention (DLP) measures. In that case, Copilot will not be able to access Microsoft Edge page content even when this policy is enabled. This behavior is to ensure the integrity of DLP.\r\n\r\nLearn more about Copilot's data usage and consent at https://go.microsoft.com/fwlink/?linkid=2288056","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev130~policy~microsoft_edge_edgeentracopilotpagecontext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev130~policy~microsoft_edge_edgeentracopilotpagecontext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev130~policy~microsoft_edge~performance_extensionsperformancedetectorenabled","displayName":"Extensions Performance Detector enabled (User)","description":"This policy controls if users can access the Extensions Performance Detector Recommended Action feature in Browser Essentials. This feature alerts extension users if their extensions are causing performance regressions in the browser and allows them to take action to resolve the issue.\r\n\r\nIf you enable or don't configure this policy, users will receive Extensions Performance Detector notifications from Browser Essentials. When there is an active alert, users will be able to view the impact of extensions on their browser's performance and make an informed decision to disable impacting extensions. The detector will exclude browser-managed extensions, such as Google Docs offline, component extensions, and organization-managed extensions (ie. extensions that cannot be disabled).\r\n\r\nIf you disable this policy, users will not receive notifications or be able to view the Extensions Performance Detector Recommended Action.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev130~policy~microsoft_edge~performance_extensionsperformancedetectorenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev130~policy~microsoft_edge~performance_extensionsperformancedetectorenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev131~policy~microsoft_edge_edgesidebarappurlhostallowlist","displayName":"Allow specific apps to be opened in Microsoft Edge sidebar (User)","description":"Define a list of sites, based on URL patterns, that are not subject to the 'EdgeSidebarAppUrlHostBlockList' (Control which apps cannot be opened in Microsoft Edge sidebar).\r\n\r\nIf you don't configure this policy, a user can open any app in sidebar except the urls listed in 'EdgeSidebarAppUrlHostBlockList'.\r\n\r\nIf you configure this policy, the apps listed in the allow list could be opened in sidebar even if they are listed in the block list.\r\n\r\nBy default, all apps are allowed. However, if you prohibited apps by policy, you can use the list of allowed apps to change that policy.\r\n\r\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2281313.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev131~policy~microsoft_edge_edgesidebarappurlhostallowlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev131~policy~microsoft_edge_edgesidebarappurlhostallowlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev131~policy~microsoft_edge_edgesidebarappurlhostallowlist_edgesidebarappurlhostallowlistdesc","displayName":"Allow specific apps to be opened in Microsoft Edge sidebar (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge_edgeautofillmlenabled","displayName":"Machine learning powered autofill suggestions (User)","description":"Allows ML technology to predict and fill in forms and text fields for better browsing. Your personal data is secure and will not be used elsewhere.\r\n\r\nIf you enable this policy or don't configure it, users can benefit from machine learning powered autofill suggestions, which improve efficiency by offering more accurate, context aware form recommendations based on historical autofill data.\r\n\r\nIf you disable this policy, machine learning powered autofill suggestions will not be shown, and autofill will no longer use cloud-based machine learning models to enhance form filling with smarter, context aware suggestions. Instead, autofill will rely on basic form data without the benefits of machine learning.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge_edgeautofillmlenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge_edgeautofillmlenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge_livetranslationallowed","displayName":"Live translation allowed (User)","description":"Allow users to turn the Realtime Video Translation feature on or off.\r\n\r\nThis feature allows videos being watched to be translated to the selected language in real time or live. Users need to click the translate icon that appears when they hover over a video to get started.\r\n\r\nThis is the on-device feature and none of the audio, data or even translated audio leave the device.\r\n\r\nIf you enable or don't configure this policy, users can turn this feature on or off in edge://settings/languages.\r\nIf you disable this policy, users will not be able to turn this feature on. If user has been using the feature already and policy gets disabled, the feature related files downloaded previously, will be deleted from the device after 30 days. We recommend not to disable the policy, unless it is needed in your environment.\r\n\r\nIf users enable this feature, the feature related files (approximately 200 megabytes) will be downloaded to the device on the first run and periodically thereafter to enhance performance and accuracy. These files will be deleted 30 days after their last use.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge_livetranslationallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge_livetranslationallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge_personalizetopsitesincustomizesidebarenabled","displayName":"Personalize my top sites in Customize Sidebar enabled by default (User)","description":"This policy controls whether Microsoft Edge browser be allowed to use the browsing history to personalize the top sites in the customize sidebar page.\r\n\r\nIf you enable this policy, Microsoft Edge will use the browsing history to personalize the top sites in the customize sidebar page.\r\n\r\nIf you disable this policy, Microsoft Edge will not use the browsing history to personalize the top sites in the customize sidebar page.\r\n\r\nIf you don't configure this policy, the default behavior is to use the browsing history to personalize the top sites in the customize sidebar page.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge_personalizetopsitesincustomizesidebarenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge_personalizetopsitesincustomizesidebarenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge_recommended_edgeautofillmlenabled_recommended","displayName":"Machine learning powered autofill suggestions (User)","description":"Allows ML technology to predict and fill in forms and text fields for better browsing. Your personal data is secure and will not be used elsewhere.\r\n\r\nIf you enable this policy or don't configure it, users can benefit from machine learning powered autofill suggestions, which improve efficiency by offering more accurate, context aware form recommendations based on historical autofill data.\r\n\r\nIf you disable this policy, machine learning powered autofill suggestions will not be shown, and autofill will no longer use cloud-based machine learning models to enhance form filling with smarter, context aware suggestions. Instead, autofill will rely on basic form data without the benefits of machine learning.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge_recommended_edgeautofillmlenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge_recommended_edgeautofillmlenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge_selectparserrelaxationenabled","displayName":"Controls whether the new HTML parser behavior for the element. This policy supports the old HTML parser behavior until M136.\r\n\r\nIf this policy is enabled or unset, the HTML parser will allow additional tags inside the element.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge_selectparserrelaxationenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge_selectparserrelaxationenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~contentsettings_automaticfullscreenallowedforurls","displayName":"Allow automatic full screen on specified sites (User)","description":"For security reasons, the\r\nrequestFullscreen() web API\r\nrequires a prior user gesture (\"transient activation\") to be called or it will\r\nfail. Users' personal settings may allow certain origins to call this API\r\nwithout a prior user gesture.\r\n\r\nThis policy supersedes users' personal settings and allows matching origins to\r\ncall the API without a prior user gesture.\r\n\r\nFor detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.\r\nWildcards (*) are allowed.\r\n\r\nOrigins matching both blocked and allowed policy patterns will be blocked.\r\nOrigins not specified by policy or user settings will require a prior user\r\ngesture to call this API.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~contentsettings_automaticfullscreenallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~contentsettings_automaticfullscreenallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~contentsettings_automaticfullscreenallowedforurls_automaticfullscreenallowedforurlsdesc","displayName":"Allow automatic full screen on specified sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~contentsettings_automaticfullscreenblockedforurls","displayName":"Block automatic full screen on specified sites (User)","description":"For security reasons, the\r\nrequestFullscreen() web API\r\nrequires a prior user gesture (\"transient activation\") to be called or it will\r\nfail. Users' personal settings may allow certain origins to call this API\r\nwithout a prior user gesture.\r\n\r\nThis policy supersedes users' personal settings and blocks matching origins\r\nfrom calling the API without a prior user gesture.\r\n\r\nFor detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.\r\nWildcards (*) are allowed.\r\n\r\nOrigins matching both blocked and allowed policy patterns will be blocked.\r\nOrigins not specified by policy or user settings will require a prior user\r\ngesture to call this API.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~contentsettings_automaticfullscreenblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~contentsettings_automaticfullscreenblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~contentsettings_automaticfullscreenblockedforurls_automaticfullscreenblockedforurlsdesc","displayName":"Block automatic full screen on specified sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~generativeai_genailocalfoundationalmodelsettings","displayName":"Settings for GenAI local foundational model (User)","description":"Configure how Microsoft Edge downloads the foundational GenAI model and uses it for inference locally.\r\n\r\nWhen the policy is set to Allowed (0) or not set, the model is downloaded automatically, and used for inference.\r\n\r\nWhen the policy is set to Disabled (1), the model will not be downloaded.\r\n\r\nModel downloading can also be disabled by ComponentUpdatesEnabled.\r\n\r\nPolicy options mapping:\r\n\r\n* Allowed (0) = Downloads model automatically\r\n\r\n* Disabled (1) = Do not download model\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~generativeai_genailocalfoundationalmodelsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~generativeai_genailocalfoundationalmodelsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~generativeai_genailocalfoundationalmodelsettings_genailocalfoundationalmodelsettings","displayName":"Settings for GenAI local foundational model (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~generativeai_genailocalfoundationalmodelsettings_genailocalfoundationalmodelsettings_0","displayName":"Downloads model automatically","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~generativeai_genailocalfoundationalmodelsettings_genailocalfoundationalmodelsettings_1","displayName":"Do not download model","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~network_ipv6reachabilityoverrideenabled","displayName":"Enable IPv6 reachability check override (User)","description":"This policy enables an override of the IPv6 reachability check. When overridden, the\r\nsystem will always query AAAA records when resolving host names. It applies to\r\nall users and interfaces on the device.\r\n\r\nIf you enable this policy, the IPv6 reachability check will be overridden.\r\n\r\nIf you disable or don't configure this policy, the IPv6 reachability check will not be overridden.\r\nThe system only queries AAAA records when it is reachable to a global IPv6 host.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~network_ipv6reachabilityoverrideenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~network_ipv6reachabilityoverrideenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~passwordmanager_deletingundecryptablepasswordsenabled","displayName":"Enable deleting undecryptable passwords (User)","description":"This policy controls whether the built-in password manager can delete undecryptable passwords from its database. This is required to restore the full functionality of the built-in password manager, but it may include a permanent data loss. Undecryptable password values will not become decryptable on their own.\r\n\r\nIf fixing them is possible, it usually requires complex user actions.\r\n\r\nEnabling this policy or leaving it unset means that users with undecryptable passwords saved to the built-in password manager will lose them. Passwords that are still in a working state will remain untouched.\r\n\r\nDisabling this policy means users will have their password manager data untouched, but will experience a broken password manager functionality.\r\n\r\nIf the policy is set, users can't override it in Microsoft Edge.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~passwordmanager_deletingundecryptablepasswordsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~passwordmanager_deletingundecryptablepasswordsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~pdf_viewxfapdfiniemodeallowedfilehash","displayName":"View XFA-based PDF files using IE Mode for allowed file hash. (User)","description":"XFA is a legacy technology that is deprecated by its original creators. It is not an ISO standard and as such, doesn't align with the modern web architecture. Continued use poses potential risks and vulnerabilities. For more information, see - 'ViewXFAPDFInIEModeAllowedOrigins' (View XFA-based PDF files using IE Mode for allowed file origin.).\r\n\r\nIf you enable this policy, you can configure the list of base64 encoded SHA256 file hashes for which XFA PDF files will automatically open in Microsoft Edge using IE Mode.\r\n\r\nIf you disable or don't configure this policy, XFA PDFs won't be considered for opening via IE mode except the files from file origin mentioned in Policy 'ViewXFAPDFInIEModeAllowedOrigins'\r\n\r\nFor more information, see - [Get-FileHash](https://go.microsoft.com/fwlink/?linkid=2294823), [Dot Net Convert API](https://go.microsoft.com/fwlink/?linkid=2294913).\r\n\r\nExample value:\r\n\r\npZGm1Av0IEBKARczz7exkNYsZb8LzaMrV7J32a2fFG4=\r\nnFeL0Q+9HX7WFI3RsmSDFTlUtrbclXH67MTdXDwWuu4=","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~pdf_viewxfapdfiniemodeallowedfilehash_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~pdf_viewxfapdfiniemodeallowedfilehash_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~pdf_viewxfapdfiniemodeallowedfilehash_viewxfapdfiniemodeallowedfilehashdesc","displayName":"View XFA-based PDF files using IE Mode for allowed file hash. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~pdf_viewxfapdfiniemodeallowedorigins","displayName":"View XFA-based PDF files using IE Mode for allowed file origin. (User)","description":"Internet Explorer (IE) mode uses the Adobe Acrobat Active-X PDF Plugin to open XFA-based PDF files. This policy will only work if the Active-X plugin is already on the user's device, it's not installed as part of this policy.\r\n\r\nIt's important to note that XFA is a legacy technology that is deprecated by its original creators. It is not an ISO standard and as such, doesn't align with the modern web architecture. Continued use poses potential risks and vulnerabilities.\r\n\r\nGiven the deprecated status of XFA technology and the lack of any investment by its creators, we strongly recommend that you start planning your transition to a more advanced HTML\\PDF form-based solutions.\r\n\r\nIn the interim, this policy provides a workaround for users to view XFA PDF in Microsoft Edge.\r\n\r\nIf you enable this policy, you can configure the list of origins from which XFA PDF files will be automatically opened in Microsoft Edge using IE Mode.\r\n\r\nIf you disable or don't configure the policy, XFA PDFs won't be considered for opening via Internet Explorer mode.\r\n\r\nFor detailed information on valid URL patterns, see - https://go.microsoft.com/fwlink/?linkid=2095322\r\n\r\nAlternatively, 'ViewXFAPDFInIEModeAllowedFileHash' (View XFA-based PDF files using IE Mode for allowed file hash.) can also be used to configure list of file hashes instead of URL origins, which will enable those files to be automatically opened in Microsoft Edge using IE Mode.\r\n\r\nExample value:\r\n\r\nhttps://contesso.sharepoint.com/accounts/\r\nhttps://contesso.sharepoint.com/transport/\r\nfile://account_forms/","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~pdf_viewxfapdfiniemodeallowedorigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~pdf_viewxfapdfiniemodeallowedorigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev132~policy~microsoft_edge~pdf_viewxfapdfiniemodeallowedorigins_viewxfapdfiniemodeallowedoriginsdesc","displayName":"View XFA-based PDF files using IE Mode for allowed file origin. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge_additionalsearchboxenabled","displayName":"Enable additional search box in browser (User)","description":"A search box is an additional text input field located next to the address bar in a web browser. It allows users to perform web searches directly from the browser interface.\r\n\r\nIf you enable or don't configure this policy, the search box will be visible and available for use.\r\nUsers can toggle the search box in Edge Settings page edge://settings/appearance#SearchBoxInToolbar.\r\n\r\nIf you disable this policy, search box will not be visible, and users will have to use the address bar or navigate to a search engine to perform web searches.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge_additionalsearchboxenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge_additionalsearchboxenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge_allowwebauthnwithbrokentlscerts","displayName":"Allow Web Authentication requests on sites with broken TLS certificates. (User)","description":"If you enable this policy, Microsoft Edge will allow Web Authentication requests on websites that have TLS certificates with errors (i.e. websites considered not secure).\r\n\r\nIf you disable or don't configure this policy, the default behavior of blocking such requests will apply.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge_allowwebauthnwithbrokentlscerts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge_allowwebauthnwithbrokentlscerts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge_edgesidebarappurlhostforcelist","displayName":"Control which apps are forced to be shown in Microsoft Edge sidebar (User)","description":"Define a list of sites, based on URL, that are forced to be shown in sidebar.\r\n\r\nIf you don't configure this policy, no app is forced to be shown in sidebar.\r\n\r\nIf the 'HubsSidebarEnabled' (Show Hubs Sidebar) policy is disabled, this list isn't used and no sidebar can be shown.\r\n\r\nFor detailed information about valid url, see https://go.microsoft.com/fwlink/?linkid=2281313.\r\n\r\nNote: URL patterns are not supported in this policy. You should provide the exact URL of the app.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge_edgesidebarappurlhostforcelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge_edgesidebarappurlhostforcelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge_edgesidebarappurlhostforcelist_edgesidebarappurlhostforcelistdesc","displayName":"Control which apps are forced to be shown in Microsoft Edge sidebar (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge_httpallowlist","displayName":"HTTP Allowlist (User)","description":"Setting the policy specifies a list of hostnames or hostname patterns (such as '[*.]example.com') that will not be upgraded to HTTPS and will not show an error interstitial if HTTPS-First Mode is enabled. Organizations can use this policy to maintain access to servers that do not support HTTPS, without needing to disable 'AutomaticHttpsDefault' (Configure Automatic HTTPS).\r\n\r\nSupplied hostnames must be canonicalized: Any IDNs must be converted to their A-label format, and all ASCII letters must be lowercase.\r\n\r\nBlanket host wildcards (i.e., \"*\" or \"[*]\") are not allowed. Instead, HTTPS-First Mode and HTTPS Upgrades should be explicitly disabled via their specific policies.\r\n\r\nNote: This policy does not apply to HSTS upgrades.\r\n\r\nExample value:\r\n\r\ntestserver.example.com\r\n[*.]example.org","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge_httpallowlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge_httpallowlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge_httpallowlist_httpallowlistdesc","displayName":"HTTP Allowlist (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge_pdfvieweroutofprocessiframeenabled","displayName":"Use out-of-process iframe PDF Viewer (User)","description":"Determines whether the PDF viewer in Microsoft Edge uses an out-of-process iframe (OOPIF).\r\nThis will be the new PDF viewer architecture going forward, as it is simpler in design and makes adding new features easier. The current GuestView PDF viewer, which relies on an outdated and overly complex architecture, is being deprecated.\r\n\r\nWhen this policy is set to Enabled or not set, Microsoft Edge will use the OOPIF PDF viewer architecture. Once Enabled or not set, the default behavior will be decided by Microsoft Edge.\r\n\r\nWhen this policy is set to Disabled, Microsoft Edge will strictly use the existing GuestView PDF viewer. This approach embeds a web page with its own separate frame tree into another web page.\r\n\r\nThis policy will be removed in the future, after the OOPIF PDF viewer feature has fully rolled out.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge_pdfvieweroutofprocessiframeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge_pdfvieweroutofprocessiframeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cacertificatemanagementallowed","displayName":"Allow users to manage installed CA certificates. (User)","description":"Setting the policy to All (0) or leaving it unset lets users edit trust settings for all CA certificates, remove user-imported certificates, and import certificates using Certificate Manager. Setting the policy to UserOnly (1) lets users manage only user-imported certificates, but not change trust settings of built-in certificates. Setting it to None (2) lets users view (not manage) CA certificates.\r\n\r\nPolicy options mapping:\r\n\r\n* All (0) = Allow users to manage all certificates\r\n\r\n* UserOnly (1) = Allow users to manage user certificates\r\n\r\n* None (2) = Disallow users from managing certificates\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cacertificatemanagementallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cacertificatemanagementallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cacertificatemanagementallowed_cacertificatemanagementallowed","displayName":"Allow users to manage installed CA certificates. (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cacertificatemanagementallowed_cacertificatemanagementallowed_0","displayName":"Allow users to manage all certificates","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cacertificatemanagementallowed_cacertificatemanagementallowed_1","displayName":"Allow users to manage user certificates","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cacertificatemanagementallowed_cacertificatemanagementallowed_2","displayName":"Disallow users from managing certificates","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cacertificates","displayName":"TLS server certificates that should be trusted by Microsoft Edge (User)","description":"This policy enables a list of TLS certificates that should be trusted by Microsoft Edge for server authentication.\r\nCertificates should be base64-encoded.\r\n\r\nExample value:\r\n\r\nMIICCTCCAY6gAwIBAgINAgPluILrIPglJ209ZjAKBggqhkjOPQQDAzBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQfTzOHMymKoYTey8chWEGJ6ladK0uFxh1MJ7x/JlFyb+Kf1qPKzEUURout736GjOyxfi//qXGdGIRFBEFVbivqJn+7kAHjSxm65FSWRQmx1WyRRK2EE46ajA2ADDL24CejQjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTB8Sa6oC2uhYHP0/EqEr24Cmf9vDAKBggqhkjOPQQDAwNpADBmAjEA9uEglRR7VKOQFhG/hMjqb2sXnh5GmCCbn9MN2azTL818+FsuVbu/3ZL3pAzcMeGiAjEA/JdmZuVDFhOD3cffL74UOO0BzrEXGhF16b0DjyZ+hOXJYKaV11RZt+cRLInUue4X","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cacertificates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cacertificates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cacertificates_cacertificatesdesc","displayName":"TLS server certificates that should be trusted by Microsoft Edge (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cacertificateswithconstraints","displayName":"TLS certificates that should be trusted by Microsoft Edge for server authentication with constraints (User)","description":"This policy enables a list of TLS certificates that should be trusted by Microsoft Edge for server authentication, with constraints added outside the certificate. If no constraint of a certain type is present, then any name of that type is allowed.\r\nCertificates should be base64-encoded. At least one constraint must be specified for each certificate.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"certificate\": \"MIICCTCCAY6gAwIBAgINAgPluILrIPglJ209ZjAKBggqhkjOPQQDAzBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQfTzOHMymKoYTey8chWEGJ6ladK0uFxh1MJ7x/JlFyb+Kf1qPKzEUURout736GjOyxfi//qXGdGIRFBEFVbivqJn+7kAHjSxm65FSWRQmx1WyRRK2EE46ajA2ADDL24CejQjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTB8Sa6oC2uhYHP0/EqEr24Cmf9vDAKBggqhkjOPQQDAwNpADBmAjEA9uEglRR7VKOQFhG/hMjqb2sXnh5GmCCbn9MN2azTL818+FsuVbu/3ZL3pAzcMeGiAjEA/JdmZuVDFhOD3cffL74UOO0BzrEXGhF16b0DjyZ+hOXJYKaV11RZt+cRLInUue4X\",\r\n \"constraints\": {\r\n \"permitted_dns_names\": [\r\n \"example.org\"\r\n ],\r\n \"permitted_cidrs\": [\r\n \"10.1.1.0/24\"\r\n ]\r\n }\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cacertificateswithconstraints_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cacertificateswithconstraints_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cacertificateswithconstraints_cacertificateswithconstraints","displayName":"TLS certificates that should be trusted by Microsoft Edge for server authentication with constraints (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cadistrustedcertificates","displayName":"TLS certificates that should be distrusted by Microsoft Edge for server authentication (User)","description":"This policy enables defining a list of certificate public keys that should be distrusted by Microsoft Edge for TLS server\r\nauthentication.\r\n\r\nThe policy value is a list of base64-encoded X.509 certificates. Any\r\ncertificate with a matching SPKI (SubjectPublicKeyInfo) will be distrusted.\r\n\r\nExample value:\r\n\r\nMIIB/TCCAaOgAwIBAgIUQthnWVsd1jWpUCNBf/uILjXC+t4wCgYIKoZIzj0EAwIwVDELMAkGA1UEBhMCVVMxETAPBgNVBAgMCFZpcmdpbmlhMQ8wDQYDVQQHDAZSZXN0b24xITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMzEyMDcxNjE5NTVaFw0yMzEyMjExNjE5NTVaMFQxCzAJBgNVBAYTAlVTMREwDwYDVQQIDAhWaXJnaW5pYTEPMA0GA1UEBwwGUmVzdG9uMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQ9Akav/KB0aVA9FM1QK4J1CEHn5rFOyY/nxcr5HG3+Fom0Kwu5zTR/kz9eOYgtG/1NmCzbiEKaULDfzA8V9aJ7o1MwUTAdBgNVHQ4EFgQUq37bLKiuw8Y/G+rurMf46hw7EekwHwYDVR0jBBgwFoAUq37bLKiuw8Y/G+rurMf46hw7EekwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNIADBFAiEA/JhtLSgtVOcXkgFJ9V5Vb6lhGdiKQFfzO9wTxPeCxCECIFePYPucys2n/r9MOBMHiX/8068ssv+uceqokzUg0mAb","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cadistrustedcertificates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cadistrustedcertificates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cadistrustedcertificates_cadistrustedcertificatesdesc","displayName":"TLS certificates that should be distrusted by Microsoft Edge for server authentication (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cahintcertificates","displayName":"TLS certificates that are not trusted or distrusted but can be used in path-building for server authentication (User)","description":"This policy enables defining a list of certificates that are not trusted or distrusted in Microsoft Edge\r\nbut can be used as hints for path-building. Certificates should be base64-encoded.\r\n\r\nExample value:\r\n\r\nMIIFljCCA36gAwIBAgINAgO8U1lrNMcY9QFQZjANBgkqhkiG9w0BAQsFADBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjEwHhcNMjAwODEzMDAwMDQyWhcNMjcwOTMwMDAwMDQyWjBGMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzETMBEGA1UEAxMKR1RTIENBIDFDMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPWI3+dijB43+DdCkH9sh9D7ZYIl/ejLa6T/belaI+KZ9hzpkgOZE3wJCor6QtZeViSqejOEH9Hpabu5dOxXTGZok3c3VVP+ORBNtzS7XyV3NzsXlOo85Z3VvMO0Q+sup0fvsEQRY9i0QYXdQTBIkxu/t/bgRQIh4JZCF8/ZK2VWNAcmBA2o/X3KLu/qSHw3TT8An4Pf73WELnlXXPxXbhqW//yMmqaZviXZf5YsBvcRKgKAgOtjGDxQSYflispfGStZloEAoPtR28p3CwvJlk/vcEnHXG0g/Zm0tOLKLnf9LdwLtmsTDIwZKxeWmLnwi/agJ7u2441Rj72ux5uxiZ0CAwEAAaOCAYAwggF8MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUinR/r4XN7pXNPZzQ4kYU83E1HScwHwYDVR0jBBgwFoAU5K8rJnEaK0gnhS9SZizv8IkTcT4waAYIKwYBBQUHAQEEXDBaMCYGCCsGAQUFBzABhhpodHRwOi8vb2NzcC5wa2kuZ29vZy9ndHNyMTAwBggrBgEFBQcwAoYkaHR0cDovL3BraS5nb29nL3JlcG8vY2VydHMvZ3RzcjEuZGVyMDQGA1UdHwQtMCswKaAnoCWGI2h0dHA6Ly9jcmwucGtpLmdvb2cvZ3RzcjEvZ3RzcjEuY3JsMFcGA1UdIARQME4wOAYKKwYBBAHWeQIFAzAqMCgGCCsGAQUFBwIBFhxodHRwczovL3BraS5nb29nL3JlcG9zaXRvcnkvMAgGBmeBDAECATAIBgZngQwBAgIwDQYJKoZIhvcNAQELBQADggIBAIl9rCBcDDy+mqhXlRu0rvqrpXJxtDaV/d9AEQNMwkYUuxQkq/BQcSLbrcRuf8/xam/IgxvYzolfh2yHuKkMo5uhYpSTld9brmYZCwKWnvy15xBpPnrLRklfRuFBsdeYTWU0AIAaP0+fbH9JAIFTQaSSIYKCGvGjRFsqUBITTcFTNvNCCK9U+o53UxtkOCcXCb1YyRt8OS1b887U7ZfbFAO/CVMkH8IMBHmYJvJh8VNS/UKMG2YrPxWhu//2m+OBmgEGcYk1KCTd4b3rGS3hSMs9WYNRtHTGnXzGsYZbr8w0xNPM1IERlQCh9BIiAfq0g3GvjLeMcySsN1PCAJA/Ef5c7TaUEDu9Ka7ixzpiO2xj2YC/WXGsYye5TBeg2vZzFb8q3o/zpWwygTMD0IZRcZk0upONXbVRWPeyk+gB9lm+cZv9TSjOz23HFtz30dZGm6fKa+l3D/2gthsjgx0QGtkJAITgRNOidSOzNIb2ILCkXhAd4FJGAJ2xDx8hcFH1mt0G/FX0Kw4zd8NLQsLxdxP8c4CU6x+7Nz/OAipmsHMdMqUybDKwjuDEI/9bfU1lcKwrmz3O2+BtjjKAvpafkmO8l7tdufThcV4q5O8DIrGKZTqPwJNl1IXNDw9bg1kWRxYtnCQ6yICmJhSFm/Y3m6xv+cXDBlHz4n/FsRC6UfTd","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cahintcertificates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cahintcertificates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_cahintcertificates_cahintcertificatesdesc","displayName":"TLS certificates that are not trusted or distrusted but can be used in path-building for server authentication (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_caplatformintegrationenabled","displayName":"Use user-added TLS certificates from platform trust stores for server authentication (User)","description":"If enabled (or unset), user-added TLS certificates from platform trust stores will be used in path-building for TLS server authentication.\r\n\r\nIf disabled, user-added TLS certificates from platform trust stores will not be used in path-building for TLS server authentication.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_caplatformintegrationenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~certificatemanagement_caplatformintegrationenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~identity_seamlesswebtobrowsersigninenabled","displayName":"Seamless Web To Browser Sign-in Enabled (User)","description":"This policy only takes effect when the 'WebToBrowserSignInEnabled' (Web To Browser Sign-in Enabled) is enabled.\r\nIf you enable this policy and set this policy to True, users cannot turn off Seamless Web to Browser Sign-in feature from \"Automatic sign in on Microsoft Edge\" setting on Microsoft Edge profile settings page and that toggle will be greyed out.\r\nIf you enable this policy and set this policy to False, users cannot turn on Seamless Web to Browser Sign-in feature from \"Automatic sign in on Microsoft Edge\" setting on Microsoft Edge profile settings page and that toggle will be greyed out.\r\nIf you enable this policy but not configured or disabled, users can turn on/off Seamless Web to Browser Sign-in feature from settings by themselves.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~identity_seamlesswebtobrowsersigninenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~identity_seamlesswebtobrowsersigninenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~identity_webtobrowsersigninenabled","displayName":"Web To Browser Sign-in Enabled (User)","description":"Allow user to sign in to the same account in Microsoft Edge when a user signs in to a Microsoft website.\r\nIf this policy is enabled or not configured, user are able to get sign in CTA or seamless sign in experience(if 'SeamlessWebToBrowserSignInEnabled' (Seamless Web To Browser Sign-in Enabled) is enabled) when user sign in on Microsoft website.\r\nIf this policy is disabled, user will not get sign in CTA or seamless sign in experience when user sign in on Microsoft website.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~identity_webtobrowsersigninenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~identity_webtobrowsersigninenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~network_dataurlwhitespacepreservationenabled","displayName":"DataURL Whitespace Preservation for all media types (User)","description":"This policy provides a temporary opt-out for changes to how Edge handles whitepsace in data URLS.\r\nPreviously, whitespace would be kept only if the top level media type was text or contained the media type string xml.\r\nNow, whitespace will be preserved in all data URLs, regardless of media type.\r\n\r\nIf this policy is left unset or is set to True, the new behavior is enabled.\r\n\r\nWhen this policy is set to False, the old behavior is enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~network_dataurlwhitespacepreservationenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev133~policy~microsoft_edge~network_dataurlwhitespacepreservationenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge_addressbarworksearchresultsenabled","displayName":"Enable Work Search suggestions in the address bar (User)","description":"Enables the display of relevant workplace suggestions in the address bar’s suggestion dropdown when users type a query in the address bar.\r\n\r\nIf this policy is enabled or not configured, users can view internal work-related suggestions, such as bookmarks, files, and people results powered by Microsoft 365, in the Microsoft Edge address bar suggestion dropdown. To access these results, users must be signed into Microsoft Edge with their Entra ID account associated with that organization.\r\n\r\nIf this policy is disabled, users will not see internal workplace results in the Microsoft Edge address bar suggestion dropdown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge_addressbarworksearchresultsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge_addressbarworksearchresultsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge_recommended~scarewareblocker_recommended_scarewareblockerprotectionenabled_recommended","displayName":"Configure Edge Scareware Blocker Protection (User)","description":"This policy setting allows administrators to control whether Microsoft Edge enables the Scareware Blocker, an AI-powered feature that provides warning messages to help protect users from potential tech scams.\r\n\r\nIf this policy is enabled, Edge Scareware Blocker will warn users of potential tech scams.\r\n\r\nIf this policy is disabled, Edge Scareware Blocker will not warn users of potential tech scams.\r\n\r\nIf this policy is not configured, Edge Scareware Blocker will not warn users of potential tech scams, but users can choose warnings in settings.\r\n\r\nBy configuring this policy, administrators determine whether users receive proactive scam warnings or must manually enable them.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge_recommended~scarewareblocker_recommended_scarewareblockerprotectionenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge_recommended~scarewareblocker_recommended_scarewareblockerprotectionenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge_serviceworkertocontrolsrcdociframeenabled","displayName":"Allow ServiceWorker to control srcdoc iframes (User)","description":"https://github.com/w3c/ServiceWorker/issues/765 asks srcdoc iframe with the \"allow-same-origin\" sandbox attribute to be under ServiceWorker control.\r\n\r\nBy default (if left unset) or when set to Enabled, Microsoft Edge makes srcdoc iframes with \"allow-same-origin\" sandbox attributes to be under ServiceWorker control.\r\n\r\nSetting the policy to Disabled prevents ServiceWorker control over srcdoc iframes.\r\n\r\nThis policy is temporary and planned for deprecation in 2026.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge_serviceworkertocontrolsrcdociframeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge_serviceworkertocontrolsrcdociframeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge_sharedworkerbloburlfixenabled","displayName":"Make SharedWorker blob URL behavior aligned with the specification (User)","description":"According to Service Worker specification\r\nhttps://w3c.github.io/ServiceWorker/#control-and-use-worker-client, workers\r\nshould inherit controllers for blob URLs. Currently, only DedicatedWorkers\r\ninherit the controller, while SharedWorkers do not.\r\n\r\nEnabled/Unset: Microsoft Edge inherits\r\nthe controller for SharedWorker blob URLs, aligning with the specification.\r\n\r\nDisabled: Behavior remains unchanged, not aligning with the specification.\r\n\r\nThis policy is temporary and will be removed in a future update.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge_sharedworkerbloburlfixenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge_sharedworkerbloburlfixenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge_webaudiooutputbufferingenabled","displayName":"Enable adaptive buffering for Web Audio (User)","description":"This policy determines whether the browser enables adaptive buffering\r\nfor Web Audio. Adaptive buffering can reduce audio glitches but may\r\nincrease latency to varying degrees.\r\n\r\nEnabled: The browser will always use adaptive buffering.\r\nDisabled or Not Set: The browser will automatically decide during the\r\n feature launch process whether to use adaptive buffering.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge_webaudiooutputbufferingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge_webaudiooutputbufferingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~browseridle_idletimeout","displayName":"Delay before running idle actions (User)","description":"Triggers an action when the computer is idle.\r\n\r\nIf you set this policy, it specifies the length of time without user input (in minutes) before the browser runs actions configured via the IdleTimeoutActions policy.\r\n\r\nIf you not set this policy, no action will be ran.\r\n\r\nThe minimum threshold is 1 minute.\r\n\r\n\"User input\" is defined by Operating System APIs, and includes things like moving the mouse or typing on the keyboard.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~browseridle_idletimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~browseridle_idletimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~browseridle_idletimeout_idletimeout","displayName":"Delay before running idle actions: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~browseridle_idletimeoutactions","displayName":"Actions to run when the computer is idle (User)","description":"List of actions to run when the timeout from the IdleTimeout policy is reached.\r\n\r\nIf the IdleTimeout policy is unset, this policy has no effect.\r\n\r\nWhen the timeout from the IdleTimeout policy is reached, the browser runs the actions configured in this policy.\r\n\r\nIf you do not set this policy or no actions are selected, the IdleTimeout policy has no effect.\r\n\r\nSupported actions are:\r\n\r\n'close_browsers': close all browser windows and PWAs for this profile.\r\n\r\n'reload_pages': reload all webpages. For some pages, the user may be prompted for confirmation first.\r\n\r\n'clear_browsing_history', 'clear_download_history', 'clear_cookies_and_other_site_data', 'clear_cached_images_and_files', 'clear_password_signing', 'clear_autofill', 'clear_site_settings': clear the corresponding browsing data.\r\n\r\nSetting 'clear_browsing_history', 'clear_password_signing', 'clear_autofill', and 'clear_site_settings' will disable sync for the respective data types if neither `Chrome Sync` is disabled by setting the SyncDisabled policy nor BrowserSignin is disabled.\r\n\r\nPolicy options mapping:\r\n\r\n* close_browsers (close_browsers) = Close Browsers\r\n\r\n* clear_browsing_history (clear_browsing_history) = Clear Browsing History\r\n\r\n* clear_download_history (clear_download_history) = Clear Download History\r\n\r\n* clear_cookies_and_other_site_data (clear_cookies_and_other_site_data) = Clear Cookies and Other Site Data\r\n\r\n* clear_cached_images_and_files (clear_cached_images_and_files) = Clear Cached Images and Files\r\n\r\n* clear_password_signin (clear_password_signin) = Clear Password Signin\r\n\r\n* clear_autofill (clear_autofill) = Clear Autofill\r\n\r\n* clear_site_settings (clear_site_settings) = Clear Site Settings\r\n\r\n* reload_pages (reload_pages) = Reload Pages\r\n\r\nUse the preceding information when configuring this policy.\r\n\r\nExample value:\r\n\r\nclose_browsers","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~browseridle_idletimeoutactions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~browseridle_idletimeoutactions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~browseridle_idletimeoutactions_idletimeoutactionsdesc","displayName":"Actions to run when the computer is idle (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~contentsettings_defaultjavascriptoptimizersetting","displayName":"Control use of JavaScript optimizers (User)","description":"Allows you to set whether Microsoft Edge will run the v8 JavaScript engine with more advanced JavaScript optimizations enabled.\r\n\r\nDisabling JavaScript optimizations (by setting this policy's value to 2) will mean that Microsoft Edge may render web content more slowly.\r\n\r\nThis policy can be overridden for specific URL patterns using the 'JavaScriptOptimizerAllowedForSites' (Allow JavaScript optimization on these sites) and 'JavaScriptOptimizerBlockedForSites' (Block JavaScript optimizations on these sites) policies.\r\n\r\nIf you don't configure this policy, JavaScript optimizations are enabled.\r\n\r\nPolicy options mapping:\r\n\r\n* AllowJavaScriptOptimizer (1) = Enable advanced JavaScript optimizations on all sites\r\n\r\n* BlockJavaScriptOptimizer (2) = Disable advanced JavaScript optimizations on all sites\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~contentsettings_defaultjavascriptoptimizersetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~contentsettings_defaultjavascriptoptimizersetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~contentsettings_defaultjavascriptoptimizersetting_defaultjavascriptoptimizersetting","displayName":"Control use of JavaScript optimizers (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~contentsettings_defaultjavascriptoptimizersetting_defaultjavascriptoptimizersetting_1","displayName":"Enable advanced JavaScript optimizations on all sites","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~contentsettings_defaultjavascriptoptimizersetting_defaultjavascriptoptimizersetting_2","displayName":"Disable advanced JavaScript optimizations on all sites","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~contentsettings_javascriptoptimizerallowedforsites","displayName":"Allow JavaScript optimization on these sites (User)","description":"Allows you to set a list of site url patterns that specify sites for which advanced JavaScript optimizations are enabled.\r\n\r\nFor detailed information on valid site url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.\r\n\r\nJavaScript optimization policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.contoso.com will not correctly apply to contoso.com or subdomain.contoso.com since they both resolve to the same eTLD+1 (contoso.com) for which there is no policy. In this case, policy must be set on contoso.com to apply correctly for both contoso.com and subdomain.contoso.com.\r\n\r\nThis policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if contoso.com is listed in the 'JavaScriptOptimizerAllowedForSites' (Allow JavaScript optimization on these sites) policy but contoso.com loads a frame containing fabrikam.com then contoso.com will have JavaScript optimizations enabled, but fabrikam.com will use the policy from 'DefaultJavaScriptOptimizerSetting' (Control use of JavaScript optimizers), if set, or default to JavaScript optimizations enabled. Blocklist entries have higher priority than allowlist entries, which in turn have higher priority than the configured default value.\r\n\r\nIf you don't configure this policy for a site then the policy from 'DefaultJavaScriptOptimizerSetting' applies to the site, if set, otherwise Javascript optimization is enabled for the site.\r\n\r\nExample value:\r\n\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~contentsettings_javascriptoptimizerallowedforsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~contentsettings_javascriptoptimizerallowedforsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~contentsettings_javascriptoptimizerallowedforsites_javascriptoptimizerallowedforsitesdesc","displayName":"Allow JavaScript optimization on these sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~contentsettings_javascriptoptimizerblockedforsites","displayName":"Block JavaScript optimizations on these sites (User)","description":"Allows you to set a list of site url patterns that specify sites for which advanced JavaScript optimizations are disabled.\r\n\r\nDisabling JavaScript optimizations will mean that Microsoft Edge may render web content more slowly.\r\n\r\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.\r\n\r\nJavaScript optimization policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.contoso.com will not correctly apply to contoso.com or subdomain.contoso.com since they both resolve to the same eTLD+1 (contoso.com) for which there is no policy. In this case, policy must be set on contoso.com to apply correctly for both contoso.com and subdomain.contoso.com.\r\n\r\nThis policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if contoso.com is listed in the 'JavaScriptOptimizerBlockedForSites' (Block JavaScript optimizations on these sites) policy but contoso.com loads a frame containing fabrikam.com then contoso.com will have JavaScript optimizations disabled, but fabrikam.com will use the policy from 'DefaultJavaScriptOptimizerSetting' (Control use of JavaScript optimizers), if set, or default to JavaScript optimizations enabled. Blocklist entries have higher priority than allowlist entries, which in turn have higher priority than the configured default value.\r\n\r\nIf you don't configure this policy for a site then the policy from 'DefaultJavaScriptOptimizerSetting' applies to the site, if set, otherwise JavaScript optimization is enabled for the site.\r\n\r\nExample value:\r\n\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~contentsettings_javascriptoptimizerblockedforsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~contentsettings_javascriptoptimizerblockedforsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~contentsettings_javascriptoptimizerblockedforsites_javascriptoptimizerblockedforsitesdesc","displayName":"Block JavaScript optimizations on these sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~printing_oopprintdriversallowed","displayName":"Out-of-process print drivers allowed (User)","description":"This policy determines whether Microsoft Edge handles interactions with printer drivers through a separate service process.\r\n\r\nUsing a service process for tasks like querying available printers, retrieving print driver settings, and submitting documents to local printers improves browser stability and prevents UI freezing during Print Preview.\r\n\r\nEnabled or Not Set: Microsoft Edge will use a separate service process for these printing tasks.\r\n\r\nDisabled: Microsoft Edge will perform these printing tasks within the browser process.\r\n\r\nNote: This policy will be deprecated in the future once the transition to out-of-process print drivers is fully implemented.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~printing_oopprintdriversallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~printing_oopprintdriversallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~scarewareblocker_scarewareblockerprotectionenabled","displayName":"Configure Edge Scareware Blocker Protection (User)","description":"This policy setting allows administrators to control whether Microsoft Edge enables the Scareware Blocker, an AI-powered feature that provides warning messages to help protect users from potential tech scams.\r\n\r\nIf this policy is enabled, Edge Scareware Blocker will warn users of potential tech scams.\r\n\r\nIf this policy is disabled, Edge Scareware Blocker will not warn users of potential tech scams.\r\n\r\nIf this policy is not configured, Edge Scareware Blocker will not warn users of potential tech scams, but users can choose warnings in settings.\r\n\r\nBy configuring this policy, administrators determine whether users receive proactive scam warnings or must manually enable them.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~scarewareblocker_scarewareblockerprotectionenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev134~policy~microsoft_edge~scarewareblocker_scarewareblockerprotectionenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev135~policy~microsoft_edge_addressbartrendingsuggestenabled","displayName":"Enable Microsoft Bing trending suggestions in the address bar (User)","description":"This policy controls whether Microsoft Bing trending suggestions appear in the address bar’s suggestion dropdown when users click the address bar while on a New Tab Page.\r\n\r\nIf this policy is enabled or not configured, Microsoft Bing trending suggestions will appear in the address bar suggestion dropdown.\r\n\r\nIf this policy is disabled, Microsoft Edge will not display Microsoft Bing trending suggestions when users click the address bar.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev135~policy~microsoft_edge_addressbartrendingsuggestenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev135~policy~microsoft_edge_addressbartrendingsuggestenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev135~policy~microsoft_edge_webcontentfilteringblockedcategories","displayName":"Configure Web Content Filtering (User)","description":"You can configure this policy to block certain categories of URLs. Blocking a category prevents users in specified device groups from accessing URLs associated with the category.\r\n\r\nThe list of possible categories, their Category String, and their description are detailed at https://go.microsoft.com/fwlink/?linkid=2249965\r\n\r\nTo block a category, add the Category String of the category to the following List of blocked categories If you leave this policy unset or disable the policy, no URLs will be blocked.\r\n\r\nIf you want to block a specific URL without blocking an entire category, add the URL to the list of blocked URLs using the 'URLBlocklist' (Block access to a list of URLs) policy.\r\n\r\nIf you want a specific URL in a blocked category to be accessible, add the URL to the list of allowed URLs using the 'URLAllowlist' (Define a list of allowed URLs) policy.\r\n\r\nThis Web Content Filtering policy only works on Microsoft Edge on Windows 10 devices or above.\r\n\r\nPolicy options mapping:\r\n\r\n* chat (chat) = Chat\r\n\r\n* child_abuse_images (child_abuse_images) = Child Abuse Images\r\n\r\n* criminal_activity (criminal_activity) = Criminal Activity\r\n\r\n* download_sites (download_sites) = Download Sites\r\n\r\n* gambling (gambling) = Gambling\r\n\r\n* games (games) = Games\r\n\r\n* hacking (hacking) = Hacking\r\n\r\n* hate_and_intolerance (hate_and_intolerance) = Hate and Intolerance\r\n\r\n* illegal_drug (illegal_drug) = Illegal Drug\r\n\r\n* illegal_software (illegal_software) = Illegal Software\r\n\r\n* image_sharing (image_sharing) = Image Sharing\r\n\r\n* instant_messaging (instant_messaging) = Instant Messaging\r\n\r\n* nudity (nudity) = Nudity\r\n\r\n* peer_to_peer (peer_to_peer) = Peer to Peer\r\n\r\n* pornography_or_sexually_explicit (pornography_or_sexually_explicit) = Pornography or Sexually Explicit\r\n\r\n* professional_networking (professional_networking) = Professional Networking\r\n\r\n* self_harm (self_harm) = Self Harm\r\n\r\n* sex_education (sex_education) = Sex Education\r\n\r\n* social_networking (social_networking) = Social Networking\r\n\r\n* streaming_and_downloads (streaming_and_downloads) = Streaming Media and Downloads\r\n\r\n* tasteless (tasteless) = Tasteless\r\n\r\n* violence (violence) = Violence\r\n\r\n* weapons (weapons) = Weapons\r\n\r\n* web_based_email (web_based_email) = Web Based Email\r\n\r\n* none (none) = None\r\n\r\nUse the preceding information when configuring this policy.\r\n\r\nExample value:\r\n\r\ngambling\r\nstreaming_and_downloads\r\ngames","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev135~policy~microsoft_edge_webcontentfilteringblockedcategories_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev135~policy~microsoft_edge_webcontentfilteringblockedcategories_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev135~policy~microsoft_edge_webcontentfilteringblockedcategories_webcontentfilteringblockedcategoriesdesc","displayName":"List of blocked categories (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev135~policy~microsoft_edge~contentsettings_partitionedbloburlusage","displayName":"Manage Blob URL Partitioning During Fetching and Navigation (User)","description":"This policy controls whether Blob URLs are partitioned during fetching and navigation.\r\nIf this policy is set to Enabled or not set, Blob URLs will be partitioned.\r\nIf this policy is set to Disabled, Blob URLs won't be partitioned. This is the Blob URL behavior prior to\r\nMicrosoft Edge version 135.\r\n\r\nIf storage partitioning is disabled for a given top-level origin by either\r\nThirdPartyStoragePartitioningBlockedForOrigins\r\nor DefaultThirdPartyStoragePartitioningSetting,\r\nthen Blob URLs will also not be partitioned.\r\n\r\nThe policy is scheduled to be available through Microsoft Edge version 140. After this\r\nversion, the policy will be removed, and Microsoft Edge will no longer support unpartitioned\r\nblob storage.\r\n\r\nFor detailed information on third-party storage partitioning, please see https://github.com/privacycg/storage-partitioning.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev135~policy~microsoft_edge~contentsettings_partitionedbloburlusage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev135~policy~microsoft_edge~contentsettings_partitionedbloburlusage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev135~policy~microsoft_edge~startup_newtabpagecompanylogobackplatecolor","displayName":"Set the company logo backplate color on the new tab page. (User)","description":"By default, the new tab page sets the company logo backplate color to the neutralStrokeActive (#cecece) constant.\r\n\r\nYou can configure this policy with a color hex code to change the company logo backplate color on the new tab page.\r\n\r\nIf this policy is not configured, the default neutralStrokeActive (#cecece) color will be used as the backplate color.\r\n\r\nExample value: #cecece","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev135~policy~microsoft_edge~startup_newtabpagecompanylogobackplatecolor_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev135~policy~microsoft_edge~startup_newtabpagecompanylogobackplatecolor_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev135~policy~microsoft_edge~startup_newtabpagecompanylogobackplatecolor_newtabpagecompanylogobackplatecolor","displayName":"Set the company logo backplate color on the new tab page. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev135~policy~microsoft_edge~webrtc_webrtciphandlingurl","displayName":"WebRTC IP Handling Policy for URL Patterns (User)","description":"Controls which IP addresses and network interfaces WebRTC can use\r\nwhen establishing connections for specific URL patterns.\r\n\r\nHow It Works:\r\nAccepts a list of URL patterns, each paired with a handling type.\r\nWebRTC evaluates patterns sequentially; the first match determines the handling type.\r\nIf no match is found, WebRTC defaults to the WebRtcLocalhostIpHandling WebRtcLocalhostIpHandling. policy.\r\nThis policy applies only to origins—URL path components are ignored.\r\nWildcards (*) are supported in URL patterns.\r\n\r\nSupported Handling Values:\r\ndefault – Uses all available network interfaces.\r\ndefault_public_and_private_interfaces – WebRTC uses all public and private interfaces.\r\ndefault_public_interface_only – WebRTC uses only public interfaces.\r\ndisable_non_proxied_udp – WebRTC uses UDP SOCKS proxying or falls back to TCP proxying.\r\n\r\nMore Information:\r\nValid input patterns: https://go.microsoft.com/fwlink/?linkid=2095322\r\nHandling types: https://tools.ietf.org/html/rfc8828.html#section-5.2\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"url\": \"https://www.example.com\",\r\n \"handling\": \"default_public_and_private_interfaces\"\r\n },\r\n {\r\n \"url\": \"https://[*.]example.edu\",\r\n \"handling\": \"default_public_interface_only\"\r\n },\r\n {\r\n \"url\": \"*\",\r\n \"handling\": \"disable_non_proxied_udp\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev135~policy~microsoft_edge~webrtc_webrtciphandlingurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev135~policy~microsoft_edge~webrtc_webrtciphandlingurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev135~policy~microsoft_edge~webrtc_webrtciphandlingurl_webrtciphandlingurl","displayName":"WebRTC IP Handling Policy for URL Patterns (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev136~policy~microsoft_edge_httpsupgradesenabled","displayName":"Enable automatic HTTPS upgrades (User)","description":"As of Microsoft Edge version 120, Microsoft Edge tries to upgrade HTTP navigations to HTTPS whenever possible to improve security. Navigations to captive portals, IP addresses, and non-unique hostnames are excluded from automatic upgrades.\r\n\r\nIf this policy is enabled or not configured, automatic HTTPS upgrades are turned on by default.\r\n\r\nIf this policy is disabled, Microsoft Edge won't attempt to upgrade HTTP connections to HTTPS.\r\n\r\nTo exempt specific hostnames or hostname patterns from being upgraded, use the HttpAllowlist policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev136~policy~microsoft_edge_httpsupgradesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev136~policy~microsoft_edge_httpsupgradesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev136~policy~microsoft_edge~passwordmanager_passwordexportenabled","displayName":"Enable exporting saved passwords from Password Manager (User)","description":"This policy controls whether the Export Password button in edge://wallet/passwords is enabled.\r\n\r\nIf enabled or not configured, users can export saved passwords.\r\nIf disabled, the Export Password button is unavailable, preventing password exports.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev136~policy~microsoft_edge~passwordmanager_passwordexportenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev136~policy~microsoft_edge~passwordmanager_passwordexportenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev136~policy~microsoft_edge~profile_profiletypeinprofilebuttonenabled","displayName":"Controls the display of the profile button label for the work or school profile (User)","description":"Controls whether the label for the work or school profile type is shown in the profile button.\r\n\r\nThis policy does not apply when the OrganizationalBrandingOnWorkProfileUIEnabled policy is enabled.\r\n\r\nIf you enable this policy, the label for the work or school profile type appears in the profile button.\r\n\r\nIf you disable this policy or leave it not configured, the label is not shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev136~policy~microsoft_edge~profile_profiletypeinprofilebuttonenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev136~policy~microsoft_edge~profile_profiletypeinprofilebuttonenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge_onbulkdataentryenterpriseconnector","displayName":"Configuration policy for bulk data entry for Microsoft Edge for Business Data Loss Prevention Connectors (User)","description":"List of Microsoft Edge for Business Data Loss Prevention Connectors services settings to be applied when data is entered in Microsoft Edge from the clipboard or by drag and dropping web content.\r\n\r\nConnector Fields\r\n\r\n1. url_list,\r\ntags,\r\nenable,\r\ndisable\r\nThese fields determine whether the connector sends data for analysis when content is entered on a specific page, and which tags to include in the analysis request.\r\nA tag associated with an enable pattern is included in the request if the page URL matches the pattern—unless a corresponding disable pattern also matches.\r\nAnalysis is triggered if at least one tag is included in the request.\r\n\r\n2. service_provider\r\nIdentifies the analysis service provider the configuration applies to.\r\n\r\n3. block_until_verdict\r\nIf set to 1, Microsoft Edge waits for a response from the analysis service before giving the page access to the data.\r\nAny other integer value allows the page to access the data immediately.\r\n\r\n4. default_action\r\nIf set to block, Microsoft Edge denies page access to the data if an error occurs while contacting the analysis service.\r\nAny other value permits the page to access the data.\r\n\r\n5. minimum_data_size\r\nSpecifies the minimum size (in bytes) that the entered data must meet or exceed to be scanned.\r\nDefault: 100 bytes if the field is not set.\r\n\r\nThis policy requires additional setup to take effect. For configuration guidance, see https://go.microsoft.com/fwlink/?linkid=2320413.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"block_until_verdict\": 0,\r\n \"default_action\": \"allow\",\r\n \"disable\": [\r\n {\r\n \"tags\": [\r\n \"malware\"\r\n ],\r\n \"url_list\": [\r\n \"*.us.com\"\r\n ]\r\n }\r\n ],\r\n \"enable\": [\r\n {\r\n \"tags\": [\r\n \"malware\"\r\n ],\r\n \"url_list\": [\r\n \"*\"\r\n ]\r\n },\r\n {\r\n \"tags\": [\r\n \"dlp\"\r\n ],\r\n \"url_list\": [\r\n \"*.them.com\",\r\n \"*.others.com\"\r\n ]\r\n }\r\n ],\r\n \"minimum_data_size\": 100,\r\n \"service_provider\": \"local_system_agent\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge_onbulkdataentryenterpriseconnector_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge_onbulkdataentryenterpriseconnector_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge_onbulkdataentryenterpriseconnector_onbulkdataentryenterpriseconnector","displayName":"Configuration policy for bulk data entry for Microsoft Edge for Business Data Loss Prevention Connectors (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge_onfileattachedenterpriseconnector","displayName":"Configuration policy for files attached for Microsoft Edge for Business Data Loss Prevention Connectors (User)","description":"List of Microsoft Edge for Business Data Loss Prevention Connectors services settings to be applied when a file is attached to Microsoft Edge.\r\n\r\nConnector Fields\r\n\r\n1. url_list,\r\ntags,\r\nenable,\r\ndisable\r\nThese fields determine whether the connector sends data for analysis when content is entered on a specific page, and which tags to include in the analysis request.\r\nA tag associated with an enable pattern is included in the request if the page URL matches the pattern—unless a corresponding disable pattern also matches.\r\nAnalysis is triggered if at least one tag is included in the request.\r\n\r\n2. service_provider\r\nIdentifies the analysis service provider the configuration applies to.\r\n\r\n3. block_until_verdict\r\nIf set to 1, Microsoft Edge waits for a response from the analysis service before giving the page access to the data.\r\nAny other integer value allows the page to access the data immediately.\r\n\r\n4. default_action\r\nIf set to block, Microsoft Edge denies page access to the data if an error occurs while contacting the analysis service.\r\nAny other value permits the page to access the data.\r\n\r\nThis policy requires additional setup to take effect. For configuration guidance, see https://go.microsoft.com/fwlink/?linkid=2320413.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"block_until_verdict\": 0,\r\n \"default_action\": \"allow\",\r\n \"disable\": [\r\n {\r\n \"tags\": [\r\n \"malware\"\r\n ],\r\n \"url_list\": [\r\n \"*.us.com\"\r\n ]\r\n }\r\n ],\r\n \"enable\": [\r\n {\r\n \"tags\": [\r\n \"malware\"\r\n ],\r\n \"url_list\": [\r\n \"*\"\r\n ]\r\n },\r\n {\r\n \"tags\": [\r\n \"dlp\"\r\n ],\r\n \"url_list\": [\r\n \"*.them.com\",\r\n \"*.others.com\"\r\n ]\r\n }\r\n ],\r\n \"service_provider\": \"local_system_agent\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge_onfileattachedenterpriseconnector_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge_onfileattachedenterpriseconnector_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge_onfileattachedenterpriseconnector_onfileattachedenterpriseconnector","displayName":"Configuration policy for files attached for Microsoft Edge for Business Data Loss Prevention Connectors (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge_onprintenterpriseconnector","displayName":"Configuration policy for print for Microsoft Edge for Business Data Loss Prevention Connectors (User)","description":"List of Microsoft Edge for Business Data Loss Prevention Connectors services settings to be applied when a page or file is printed from Microsoft Edge.\r\n\r\nConnector Fields\r\n\r\n1. url_list,\r\ntags,\r\nenable,\r\ndisable\r\nThese fields determine whether the connector sends data for analysis when content is entered on a specific page, and which tags to include in the analysis request.\r\nA tag associated with an enable pattern is included in the request if the page URL matches the pattern—unless a corresponding disable pattern also matches.\r\nAnalysis is triggered if at least one tag is included in the request.\r\n\r\n2. service_provider\r\nIdentifies the analysis service provider the configuration applies to.\r\n\r\n3. block_until_verdict\r\nIf set to 1, Microsoft Edge waits for a response from the analysis service before giving the page access to the data.\r\nAny other integer value allows the page to access the data immediately.\r\n\r\n4. default_action\r\nIf set to block, Microsoft Edge denies page access to the data if an error occurs while contacting the analysis service.\r\nAny other value permits the page to access the data.\r\n\r\nThis policy requires additional setup to take effect. For configuration guidance, see https://go.microsoft.com/fwlink/?linkid=2320413.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"block_until_verdict\": 0,\r\n \"default_action\": \"allow\",\r\n \"disable\": [\r\n {\r\n \"tags\": [\r\n \"dlp\"\r\n ],\r\n \"url_list\": [\r\n \"*.us.com\"\r\n ]\r\n }\r\n ],\r\n \"enable\": [\r\n {\r\n \"tags\": [\r\n \"dlp\"\r\n ],\r\n \"url_list\": [\r\n \"*.them.com\",\r\n \"*.others.com\"\r\n ]\r\n }\r\n ],\r\n \"service_provider\": \"local_system_agent\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge_onprintenterpriseconnector_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge_onprintenterpriseconnector_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge_onprintenterpriseconnector_onprintenterpriseconnector","displayName":"Configuration policy for print for Microsoft Edge for Business Data Loss Prevention Connectors (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge_webauthenticationremotedesktopallowedorigins","displayName":"Allowed Origins for Proxied WebAuthn Requests from Remote Desktop Applications. (User)","description":"This policy defines a list of allowed HTTPS origins for remote desktop client applications that initiate WebAuthn API requests from a browsing session on a remote host.\r\n\r\nOrigins specified in this policy can request WebAuthn authentication for Relying Party IDs (RP IDs) they would not typically be authorized to claim.\r\n\r\nOnly HTTPS origins are supported. Wildcards are not permitted. Entries that do not\r\nmeet these requirements will be ignored.\r\n\r\nFor more information about the WebAuthn Remote Desktop Support feature, please see https://github.com/w3c/webauthn/wiki/Explainer:-Remote-Desktop-Support/a4e158c569f456c759d0ddd294a9015bd4d4eb9a.\r\n\r\nExample value:\r\n\r\nhttps://server:8080/","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge_webauthenticationremotedesktopallowedorigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge_webauthenticationremotedesktopallowedorigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge_webauthenticationremotedesktopallowedorigins_webauthenticationremotedesktopallowedoriginsdesc","displayName":"Allowed Origins for Proxied WebAuthn Requests from Remote Desktop Applications. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge~network_happyeyeballsv3enabled","displayName":"Use the Happy Eyeballs V3 algorithm for connection attempts (User)","description":"Controls whether Microsoft Edge uses the Happy Eyeballs V3 algorithm to optimize connection attempts. This algorithm improves reliability and performance in dual-stack (IPv4/IPv6) networks by racing connection attempts across IP versions and HTTP protocols (e.g., HTTP/3 vs. others). For more details, see https://datatracker.ietf.org/doc/draft-pauly-happy-happyeyeballs-v3.\r\n\r\nEnabled or not configured: Uses the algorithm for connection attempts.\r\n\r\nDisabled: Disables the algorithm.\r\n\r\nNote: This policy supports dynamic refresh.\r\n\r\nImportant: This policy is temporary and will be removed in a future version.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge~network_happyeyeballsv3enabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev137~policy~microsoft_edge~network_happyeyeballsv3enabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev138~policy~microsoft_edge_builtinaiapisenabled","displayName":"Allow pages to use the built-in AI APIs. (User)","description":"Use this policy to control whether websites can access the built-in AI APIs, including the LanguageModel API, Summarization API, Writer API, and Rewriter API.\r\n\r\nEnable this policy to allow pages to use the APIs. If you don’t configure this policy, the APIs are still allowed.\r\n\r\nDisable this policy to block access to the APIs. The APIs will return an error when used.\r\n\r\nFor more information, see https://github.com/webmachinelearning/writing-assistance-apis/blob/main/README.md.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev138~policy~microsoft_edge_builtinaiapisenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev138~policy~microsoft_edge_builtinaiapisenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev138~policy~microsoft_edge_edgehistoryaisearchenabled","displayName":"Control access to AI-enhanced search in History (User)","description":"This policy controls whether users can use AI-enhanced search in their browsing history in Microsoft Edge.\r\n\r\nWhen enabled or not configured, users can search using synonyms, natural language phrases, and minor spelling errors to find previously visited pages.\r\n\r\nWhen disabled, users can only perform exact match (verbatim) searches in their history.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev138~policy~microsoft_edge_edgehistoryaisearchenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev138~policy~microsoft_edge_edgehistoryaisearchenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev138~policy~microsoft_edge_prefetchwithserviceworkerenabled","displayName":"Allow SpeculationRules prefetch for ServiceWorker-controlled URLs (User)","description":"Controls whether SpeculationRules prefetch requests are allowed for\r\nServiceWorker-controlled URLs.\r\n\r\nStarting with Microsoft Edge version 138,\r\nprefetch requests to ServiceWorker-controlled URLs are allowed by default when\r\nthe PrefetchServiceWorker feature is enabled.\r\n\r\nIf this policy is enabled or not configured, that default behavior is used.\r\n\r\nTo restore the legacy behavior from versions prior to 138, where prefetch requests\r\nto ServiceWorker-controlled URLs were blocked, set this policy to disabled.\r\n\r\nThis policy is intended to be temporary and will be removed in the future.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev138~policy~microsoft_edge_prefetchwithserviceworkerenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev138~policy~microsoft_edge_prefetchwithserviceworkerenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev138~policy~microsoft_edge_recommended~identity_recommended_edgeopenexternallinkswithprimaryworkprofileenabled_recommended","displayName":"Use Primary Work Profile as default to open external links (User)","description":"This policy controls whether Microsoft Edge uses the Primary Work Profile as the default profile when opening external links.\r\n1. On Windows, the Primary Work Profile refers to the profile signed in with the Entra ID account used to enroll the device.\r\n2. On macOS and Linux, the Primary Work Profile is the only profile signed in with an Entra ID account. If multiple profiles are signed in with Entra ID accounts, the Primary Work Profile setting does not apply.\r\n\r\nPolicy behavior:\r\n1. If enabled or not configured, Microsoft Edge will use the Primary Work Profile as the default for opening external links.\r\n2. If disabled, the last used profile becomes the default for opening external links.\r\n\r\nNote: This policy does not override the following scenarios:\r\n1. If the EdgeDefaultProfileEnabled policy is set, it takes precedence over this policy.\r\n2. External links opened from Outlook or Microsoft Teams may be configured to launch in a specific profile, which can override the Primary Work Profile setting.\r\n3. If the user sets a preference for \"Default profile for external links\" in Profile preferences, that setting will take effect.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev138~policy~microsoft_edge_recommended~identity_recommended_edgeopenexternallinkswithprimaryworkprofileenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev138~policy~microsoft_edge_recommended~identity_recommended_edgeopenexternallinkswithprimaryworkprofileenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev138~policy~microsoft_edge_tls13earlydataenabled","displayName":"Control whether TLS 1.3 Early Data is enabled in Microsoft Edge (User)","description":"This policy controls whether TLS 1.3 Early Data is enabled in Microsoft Edge.\r\n\r\nTLS 1.3 Early Data is an extension that allows an HTTP request to be sent in parallel with the TLS handshake. When enabled and supported by the server, this can improve page load performance.\r\n\r\nEnabled – Microsoft Edge enables TLS 1.3 Early Data.\r\n\r\nDisabled – Microsoft Edge disables TLS 1.3 Early Data.\r\n\r\nNot configured – Microsoft Edge follows the default rollout process for TLS 1.3 Early Data.\r\n\r\nNOTE: When this feature is enabled, whether TLS 1.3 Early Data is used depends on server support. Most modern TLS servers and middleware can handle or reject Early Data without interrupting the connection. However, improperly implemented TLS stacks may cause connection failures. If such issues occur, contact the device or software vendor for a resolution.\r\n\r\nThis policy is temporary and intended to help test for compatibility issues. It may be removed in a future release once the feature is fully rolled out.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev138~policy~microsoft_edge_tls13earlydataenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev138~policy~microsoft_edge_tls13earlydataenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev138~policy~microsoft_edge~network_localnetworkaccessrestrictionsenabled","displayName":"Specifies whether to block requests from public websites to devices on a user's local network. (deprecated) (User)","description":"DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.\r\n\r\nLocal Network Access restrictions prevent public websites from making\r\nrequests to devices on a user's local network without explicit user permission.\r\n\r\nIf you enable this policy, Microsoft Edge will\r\nblock any request that would otherwise trigger a DevTools warning\r\ndue to Local Network Access checks.\r\nThese requests will be denied without prompting the user.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will handle\r\nthese requests using the default behavior, which may include showing warnings in DevTools\r\nand allowing the request to proceed depending on the context.\r\n\r\nNote: This feature improves local network security by deprecating direct access to private IP addresses from public websites\r\nunless explicitly granted by the user.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev138~policy~microsoft_edge~network_localnetworkaccessrestrictionsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev138~policy~microsoft_edge~network_localnetworkaccessrestrictionsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge_enableunsafeswiftshader","displayName":"Allow software WebGL fallback using SwiftShader (User)","description":"Controls whether SwiftShader is used as a fallback for WebGL when hardware GPU acceleration is not available.\r\n\r\nWhen enabled, Microsoft Edge will use SwiftShader to support WebGL on systems without GPU acceleration, such as headless environments or virtual machines.\r\n\r\nStarting in Microsoft Edge version 139, SwiftShader has been deprecated due to security concerns. As a result, WebGL context creation will fail in scenarios where SwiftShader would have been used. Enabling this policy allows organizations to temporarily defer the deprecation and continue using SwiftShader.\r\n\r\nIf you disable or do not configure this policy, WebGL context creation may fail on systems without hardware acceleration. This could cause web content relying on WebGL to function incorrectly if it does not handle context creation failures.\r\n\r\nNote: This is a temporary policy and will be removed in a future release.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge_enableunsafeswiftshader_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge_enableunsafeswiftshader_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge_microsoft365copilotchaticonenabled","displayName":"Control whether Microsoft 365 Copilot Chat shows in the Microsoft Edge for Business toolbar (User)","description":"For users in an Entra ID Microsoft Edge profile, this policy controls whether the Microsoft 365 Copilot Chat icon will be shown in the Microsoft Edge for Business toolbar for Microsoft 365 Copilot licensed and unlicensed users.\r\n\r\nThis policy only applies when users are accessing Copilot in the sidepane.\r\n\r\nIf the policy is enabled: Copilot will appear in the toolbar.\r\n\r\nIf the policy is disabled: Copilot will not appear in the toolbar.\r\n\r\nIf the policy is not configured: Otherwise, Copilot will show in the toolbar and users may enable or disable Copilot from showing by using the Show Copilot toggle in settings.\r\n\r\nWhen both this policy and 'HubsSidebarEnabled' (Show Hubs Sidebar) are configured, this policy takes precedence in determining whether Copilot appears in the toolbar. If this policy is not configured and 'HubsSidebarEnabled' is disabled, Copilot will remain hidden. In a future release, this policy will be the sole control for managing Copilot's visibility in the toolbar.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge_microsoft365copilotchaticonenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge_microsoft365copilotchaticonenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge_onsecurityevententerpriseconnector","displayName":"Configuration policy for Microsoft Edge for Business Reporting Connectors (User)","description":"Defines the Microsoft Edge for Business Reporting Connectors service settings that apply when a security event occurs in Microsoft Edge. These events include negative verdicts from Data Loss Prevention Connectors, password reuse, navigation to unsafe pages, and other security-sensitive actions.\r\n\r\nThe service_provider field specifies the reporting service provider. The enabled_event_names field lists the security events enabled for that provider.\r\n\r\nThis policy requires additional setup to take effect. For configuration guidance, see https://go.microsoft.com/fwlink/?linkid=2325446.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"enabled_event_names\": [\r\n \"passwordChangedEvent\",\r\n \"sensitiveDataEvent\"\r\n ],\r\n \"enabled_opt_in_events\": [\r\n {\r\n \"name\": \"loginEvent\",\r\n \"url_patterns\": [\r\n \"*\"\r\n ]\r\n },\r\n {\r\n \"name\": \"passwordBreachEvent\",\r\n \"url_patterns\": [\r\n \"example.com\",\r\n \"other.example.com\"\r\n ]\r\n }\r\n ],\r\n \"service_provider\": \"microsoft\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge_onsecurityevententerpriseconnector_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge_onsecurityevententerpriseconnector_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge_onsecurityevententerpriseconnector_onsecurityevententerpriseconnector","displayName":"Configuration policy for Microsoft Edge for Business Reporting Connectors (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge_recommended_microsoft365copilotchaticonenabled_recommended","displayName":"Control whether Microsoft 365 Copilot Chat shows in the Microsoft Edge for Business toolbar (User)","description":"For users in an Entra ID Microsoft Edge profile, this policy controls whether the Microsoft 365 Copilot Chat icon will be shown in the Microsoft Edge for Business toolbar for Microsoft 365 Copilot licensed and unlicensed users.\r\n\r\nThis policy only applies when users are accessing Copilot in the sidepane.\r\n\r\nIf the policy is enabled: Copilot will appear in the toolbar.\r\n\r\nIf the policy is disabled: Copilot will not appear in the toolbar.\r\n\r\nIf the policy is not configured: Otherwise, Copilot will show in the toolbar and users may enable or disable Copilot from showing by using the Show Copilot toggle in settings.\r\n\r\nWhen both this policy and 'HubsSidebarEnabled' (Show Hubs Sidebar) are configured, this policy takes precedence in determining whether Copilot appears in the toolbar. If this policy is not configured and 'HubsSidebarEnabled' is disabled, Copilot will remain hidden. In a future release, this policy will be the sole control for managing Copilot's visibility in the toolbar.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge_recommended_microsoft365copilotchaticonenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge_recommended_microsoft365copilotchaticonenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge~extensions_mandatoryextensionsforinprivatenavigation","displayName":"Specify extensions users must allow in order to navigate using InPrivate mode (User)","description":"This policy lets you specify a list of extension IDs that must be explicitly allowed by the user to run in InPrivate mode in order to enable InPrivate browsing.\r\n\r\nIf users do not allow all listed extensions to run in InPrivate mode, they will be unable to navigate using InPrivate.\r\n\r\nIf any extension in the list is not installed, InPrivate navigation is blocked.\r\n\r\nThis policy only applies when InPrivate mode is enabled. If InPrivate mode is disabled using the InPrivateModeAvailability policy, this policy has no effect.\r\n\r\nExample value:\r\n\r\nabcdefghijklmnopabcdefghijklmnop","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge~extensions_mandatoryextensionsforinprivatenavigation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge~extensions_mandatoryextensionsforinprivatenavigation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge~extensions_mandatoryextensionsforinprivatenavigation_mandatoryextensionsforinprivatenavigationdesc","displayName":"Specify extensions users must allow in order to navigate using InPrivate mode (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge~identity_edgeopenexternallinkswithappspecifiedprofile","displayName":"Prioritize App specified profile to open external links (User)","description":"This policy controls whether the profile specified by an app (such as Microsoft Teams or Outlook) is given priority when opening external links, instead of the profile selected in the Default profile for external links setting.\r\n\r\nPolicy behavior:\r\n1. Enabled or not configured: The app-specified profile is prioritized for opening external links. This behavior overrides the profile selected in settings, and the behavior defined by the EdgeDefaultProfileEnabled and EdgeOpenExternalLinksWithPrimaryWorkProfileEnabled policies. If the app doesn't specify a profile, this policy has no effect.\r\n2. Disabled: The profile selected in settings—along with the EdgeDefaultProfileEnabled and EdgeOpenExternalLinksWithPrimaryWorkProfileEnabled policies—will be used to determine which profile opens external links.\r\n\r\nNOTE:\r\nThis policy doesn't override user-defined preferences set through Automatic profile switching, including the Custom site switch setting located within it. If a user has configured specific sites to open in designated profiles, those preferences take precedence.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge~identity_edgeopenexternallinkswithappspecifiedprofile_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev139~policy~microsoft_edge~identity_edgeopenexternallinkswithappspecifiedprofile_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge_additionaldnsquerytypesenabled","displayName":"Allow DNS queries for more DNS record types (User)","description":"This policy controls whether Microsoft Edge can query more DNS record types when making insecure (non-Secure DNS) requests.\r\n\r\nIf this policy is unset or set to Enabled, more record types such as HTTPS (DNS type 65) may be queried in addition to A (DNS type 1) and AAAA (DNS type 28).\r\n\r\nIf this policy is set to Disabled, Microsoft Edge will only query A and AAAA record types for insecure DNS requests.\r\n\r\nThis setting doesn't affect DNS queries made via Secure DNS, which may always use more record types.\r\n\r\nNote: This is a temporary policy and is planned for removal in a future version of Microsoft Edge. After removal, Microsoft Edge will always be able to query more DNS types during insecure requests.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge_additionaldnsquerytypesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge_additionaldnsquerytypesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge_httpsonlymode","displayName":"Allow HTTPS-Only Mode to be enabled (User)","description":"This policy controls whether users can enable HTTPS-Only Mode (Always Use Secure Connections) in Settings. HTTPS-Only Mode attempts to upgrade all navigations to HTTPS.\r\n\r\nIf this setting is not set or is set to allowed, users will be able to enable HTTPS-Only Mode.\r\nIf this setting is set to disallowed, users will not be able to enable HTTPS-Only Mode.\r\nIf this setting is set to force_enabled, HTTPS-Only Mode will be enabled in Strict mode and users will not be able to disable it.\r\nIf this setting is set to force_balanced_enabled, HTTPS-Only Mode will be enabled in Balanced mode and users will not be able to disable it.\r\n\r\nIf you set this policy to a value that is not supported by the version of Microsoft Edge that receives the policy, Microsoft Edge will default to the allowed setting.\r\n\r\nThe separate HttpAllowlist policy can be used to exempt specific hostnames or hostname patterns from being upgraded to HTTPS by this feature.\r\n\r\nPolicy options mapping:\r\n\r\n* allowed (allowed) = Do not restrict users' HTTPS-Only Mode setting\r\n\r\n* disallowed (disallowed) = Do not allow users to enable any HTTPS-Only Mode\r\n\r\n* force_enabled (force_enabled) = Force enable HTTPS-Only Mode in Strict mode\r\n\r\n* force_balanced_enabled (force_balanced_enabled) = Force enable HTTPS-Only Mode in Balanced Mode\r\n\r\nUse the preceding information when configuring this policy.\r\n\r\nExample value: disallowed","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge_httpsonlymode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge_httpsonlymode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge_httpsonlymode_httpsonlymode","displayName":"Allow HTTPS-Only Mode to be enabled (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge_httpsonlymode_httpsonlymode_allowed","displayName":"Do not restrict users' HTTPS-Only Mode setting","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge_httpsonlymode_httpsonlymode_disallowed","displayName":"Do not allow users to enable any HTTPS-Only Mode","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge_httpsonlymode_httpsonlymode_force_enabled","displayName":"Force enable HTTPS-Only Mode in Strict mode","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge_httpsonlymode_httpsonlymode_force_balanced_enabled","displayName":"Force enable HTTPS-Only Mode in Balanced Mode","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge_restrictcoresharingonrenderer","displayName":"Restrict CPU core sharing for renderer process (User)","description":"This policy helps mitigate side-channel cross-process memory attacks by isolating the renderer process to a dedicated CPU core, preventing other processes from being scheduled on the same core. This mitigation is supported on Microsoft® Windows® 11 24H2 and later. If the operating system does not support the necessary scheduling features, this policy has no effect. Enabling this policy may reduce performance in demanding workloads, similar to the impact of disabling hyperthreading. For more information refer https://learn.microsoft.com/windows/win32/api/winnt/ns-winnt-process_mitigation_side_channel_isolation_policy\r\nIf you enable this policy, other processes can not be scheduled on the same CPU core as a renderer process.\r\nIf you disable this policy, other processes can be scheduled on the same CPU core as a renderer process.\r\nIf you don't configure this policy, other processes may be scheduled on the same core as the renderer process. Behavior may vary depending on Microsoft Edge version and platform.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge_restrictcoresharingonrenderer_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge_restrictcoresharingonrenderer_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge_serviceworkerautopreloadenabled","displayName":"Allow ServiceWorker to dispatch navigation requests without waiting for its startup (User)","description":"This policy controls whether Microsoft Edge enables the ServiceWorkerAutoPreload feature.\r\n\r\nWhen enabled or not configured, Microsoft Edge may initiate the main resource network request concurrently with the Service Worker bootstrap process. This can improve performance in scenarios where the Service Worker is not already running.\r\n\r\nIf you disable this policy, Microsoft Edge will wait to dispatch the navigation request until after the Service Worker has started.\r\n\r\nThis is a temporary policy and will be removed in version 144 of Microsoft Edge.\r\n\r\nFor more details on the feature, see https://github.com/WICG/service-worker-auto-preload.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge_serviceworkerautopreloadenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge_serviceworkerautopreloadenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge~network_localnetworkaccessallowedforurls","displayName":"Allow sites to make requests to local network endpoints. (User)","description":"Specifies a list of URL patterns for which requests initiated from matching origins are exempt from Local Network Access restrictions.\r\n\r\nIf an origin is specified by both this policy and the 'LocalNetworkAccessBlockedForUrls' (Block sites from making requests to local network endpoints.) policy, the blocked list takes precedence.\r\n\r\nFor origins not covered by this policy, the user's personal settings and local network access restrictions will apply.\r\n\r\nFor guidance on valid URL pattern syntax, see:\r\nhttps://learn.microsoft.com/deployedge/edge-learnmore-ent-policy-url-patterns\r\n\r\nNote: This policy enables controlled exceptions to local network access restrictions. It allows specific public websites to access private IP addresses when necessary for trusted local communication scenarios. For more information about Local Network Access, see https://wicg.github.io/local-network-access/.\r\n\r\nExample value:\r\n\r\nhttp://www.example.com:8080\r\n[*.]example.edu\r\n*","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge~network_localnetworkaccessallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge~network_localnetworkaccessallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge~network_localnetworkaccessallowedforurls_localnetworkaccessallowedforurlsdesc","displayName":"Allow sites to make requests to local network endpoints. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge~network_localnetworkaccessblockedforurls","displayName":"Block sites from making requests to local network endpoints. (User)","description":"List of URL patterns. Requests initiated from websites served by matching origins are blocked from issuing Local Network Access requests.\r\n\r\nIf an origin is covered by both this policy and by 'LocalNetworkAccessAllowedForUrls' (Allow sites to make requests to local network endpoints.), this policy takes precedence.\r\n\r\nDepending on the stage of the rollout of Local Network Access, LocalNetworkAccessRestrictionsEnabled may also need to be enabled for this policy to block Local Network Access requests.\r\n\r\nFor origins not covered by the patterns specified here, the user's personal configuration will apply.\r\n\r\nFor detailed information on valid URL patterns, please see https://learn.microsoft.com/deployedge/edge-learnmore-ent-policy-url-patterns.\r\n\r\nNote: This policy improves local network security by blocking specified public websites from accessing private IP addresses. It helps prevent unauthorized external sites from reaching internal resources unless explicitly permitted. For more information about Local Network Access, see https://wicg.github.io/local-network-access/.\r\n\r\nExample value:\r\n\r\nhttp://www.example.com:8080\r\n[*.]example.edu\r\n*","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge~network_localnetworkaccessblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge~network_localnetworkaccessblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev140~policy~microsoft_edge~network_localnetworkaccessblockedforurls_localnetworkaccessblockedforurlsdesc","displayName":"Block sites from making requests to local network endpoints. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge_livevideotranslationenabled","displayName":"Allows users to translate videos to different languages. (User)","description":"This policy configures the on-device real-time video translation feature in Microsoft Edge.\r\nWith this feature, users can watch videos translated into their selected language in real time.\r\n\r\nWhen a user selects the Translate icon and chooses a source (video language) and target language (translated language),\r\ntranslation components are downloaded on first use (approximately 200 MB per language pair).\r\n\r\nThese components may be updated periodically to improve performance and translation quality.\r\nTranslation is performed locally on the user’s device and no data is sent outside of the device.\r\nThe feature is available only for non-DRM videos, on supported high-end devices, with select language pairs, and in select regions.\r\nFor more details, see https://www.microsoft.com/en-us/edge/features/real-time-video-translation.\r\n\r\nIf you enable or don’t configure this policy, the on-device real-time video translation feature is enabled and\r\nusers will see the Translate button when hovering over videos.\r\n\r\nIf you disable this policy, the on-device real-time video translation feature is disabled and the Translate button won’t be shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge_livevideotranslationenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge_livevideotranslationenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge_recommended_originkeyedprocessesenabled_recommended","displayName":"Enable origin-keyed process isolation for improved security (User)","description":"This policy enables origin-keyed process isolation for most pages, which improves security by separating content from different origins into distinct processes. This may increase the number of processes created. Users can override this setting by using command-line flags or edge://flags to turn the feature on or off.\r\n\r\nIf you enable this policy, most origins will be isolated, even from other origins within the same site. For related configuration, see the IsolateOrigins and SitePerProcess policies.\r\n\r\nIf you disable this policy, origins will not be isolated from the rest of their site unless the origin explicitly requests isolation.\r\n\r\nIf you don’t configure this policy, the browser will decide which origins to isolate and when. By default, this feature is disabled. The default state may change in the future.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge_recommended_originkeyedprocessesenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge_recommended_originkeyedprocessesenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge_recommended_showtabpreviewenabled_recommended","displayName":"Enable tab preview on hover (User)","description":"This policy controls whether Microsoft Edge displays a preview of the tab content when the user hovers over a tab.\r\n\r\nIf you enable or don't configure this policy, Microsoft Edge shows a tab preview when the user hovers over a tab.\r\n\r\nIf you disable this policy, tab previews will not be shown on hover.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge_recommended_showtabpreviewenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge_recommended_showtabpreviewenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge_relaunchfastifoutdated","displayName":"Relaunch browser quickly when the current version is outdated (User)","description":"This policy specifies the minimum release age after which relaunch notifications become more aggressive. The release age is calculated from the time the currently running version was last served to clients.\r\n\r\nIf a browser relaunch is needed to finalize a pending update and the current version has been outdated for more than the number of days specified by this setting, the RelaunchNotificationPeriod policy is overridden to 2 hours. If the RelaunchNotification policy is set to 1 ('Required'), a browser relaunch will be forced at the end of the period.\r\n\r\nIf not set, or if the release age cannot be determined, the RelaunchNotificationPeriod policy will be used for all updates.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge_relaunchfastifoutdated_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge_relaunchfastifoutdated_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge_relaunchfastifoutdated_relaunchfastifoutdated","displayName":"Time period (days): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge_showtabpreviewenabled","displayName":"Enable tab preview on hover (User)","description":"This policy controls whether Microsoft Edge displays a preview of the tab content when the user hovers over a tab.\r\n\r\nIf you enable or don't configure this policy, Microsoft Edge shows a tab preview when the user hovers over a tab.\r\n\r\nIf you disable this policy, tab previews will not be shown on hover.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge_showtabpreviewenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge_showtabpreviewenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge~webrtc_webrtcpostquantumkeyagreement","displayName":"Enable post-quantum key agreement for WebRTC (User)","description":"This policy controls the use of post-quantum key agreement for WebRTC in Microsoft Edge.\r\n\r\nIf you enable this policy, Microsoft Edge will offer post-quantum key agreement for WebRTC.\r\n\r\nIf you disable this policy, post-quantum key agreement will not be offered for WebRTC.\r\n\r\nIf you don't configure this policy, post-quantum key agreement will not be offered for WebRTC. A future version of Microsoft Edge may enable this feature by default.\r\n\r\nOffering a post-quantum key agreement is backwards compatible. Existing datagram transport layer security (DTLS) peers and networking middleware are expected to ignore the new option and continue using previous options.\r\n\r\nHowever, devices that don't correctly implement DTLS may malfunction when offered the new option. For example, they may disconnect in response to unrecognized options or larger message sizes. Such devices aren’t post-quantum-ready and may interfere with an organization's post-quantum transition. If this issue occurs, administrators should contact the device vendor for a fix.\r\n\r\nThis policy is temporary and will be removed in a future release.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge~webrtc_webrtcpostquantumkeyagreement_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev141~policy~microsoft_edge~webrtc_webrtcpostquantumkeyagreement_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev142~policy~microsoft_edge_recommended~scarewareblocker_recommended_scarewareblockerblocksdetectedsitesenabled_recommended","displayName":"Configure Edge scareware blocker to block sites detected as potential tech scams (User)","description":"This policy controls whether Microsoft Edge blocks sites that are detected as potential tech scams.\r\n\r\nThis policy only takes effect if ScarewareBlockerProtectionEnabled is enabled.\r\n\r\nIf you enable or don't configure this policy, Microsoft Edge will block sites detected as potential tech scams.\r\n\r\nIf you disable this policy, Microsoft Edge will not block sites detected as potential tech scams.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev142~policy~microsoft_edge_recommended~scarewareblocker_recommended_scarewareblockerblocksdetectedsitesenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev142~policy~microsoft_edge_recommended~scarewareblocker_recommended_scarewareblockerblocksdetectedsitesenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev142~policy~microsoft_edge_recommended~scarewareblocker_recommended_scarewareblockersenddetectedsitestosmartscreenenabled_recommended","displayName":"Configure Edge scareware blocker to share URLs of sites detected as potential tech scams with Microsoft Defender SmartScreen (User)","description":"This policy controls whether Microsoft Edge shares URLs of sites that are detected as potential tech scams with Microsoft Defender SmartScreen.\r\n\r\nThis policy only takes effect if ScarewareBlockerProtectionEnabled is enabled.\r\n\r\nIf you enable this policy, Microsoft Edge will share URLs of sites detected as potential tech scams with Microsoft Defender SmartScreen.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will not share URLs of sites detected as potential tech scams with Microsoft Defender SmartScreen.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev142~policy~microsoft_edge_recommended~scarewareblocker_recommended_scarewareblockersenddetectedsitestosmartscreenenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev142~policy~microsoft_edge_recommended~scarewareblocker_recommended_scarewareblockersenddetectedsitestosmartscreenenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev142~policy~microsoft_edge~scarewareblocker_scarewareblockerallowlistdomains","displayName":"Configure the list of domains where Microsoft Edge scareware blocker won't run (User)","description":"This policy configures the list of trusted domains for Microsoft Edge scareware blocker. When a website's source URL matches any domain in this list, Edge scareware blocker won’t analyze that site.\r\n\r\nThis policy takes effect only if the ScarewareBlockerProtectionEnabled policy is enabled.\r\n\r\nIf you enable this policy, Microsoft Edge scareware blocker will trust the specified domains.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge scareware blocker will analyze all sites.\r\n\r\nExample value:\r\n\r\nmydomain.com\r\nmyuniversity.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev142~policy~microsoft_edge~scarewareblocker_scarewareblockerallowlistdomains_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev142~policy~microsoft_edge~scarewareblocker_scarewareblockerallowlistdomains_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev142~policy~microsoft_edge~scarewareblocker_scarewareblockerallowlistdomains_scarewareblockerallowlistdomainsdesc","displayName":"Configure the list of domains where Microsoft Edge scareware blocker won't run (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev142~policy~microsoft_edge~scarewareblocker_scarewareblockerblocksdetectedsitesenabled","displayName":"Configure Edge scareware blocker to block sites detected as potential tech scams (User)","description":"This policy controls whether Microsoft Edge blocks sites that are detected as potential tech scams.\r\n\r\nThis policy only takes effect if ScarewareBlockerProtectionEnabled is enabled.\r\n\r\nIf you enable or don't configure this policy, Microsoft Edge will block sites detected as potential tech scams.\r\n\r\nIf you disable this policy, Microsoft Edge will not block sites detected as potential tech scams.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev142~policy~microsoft_edge~scarewareblocker_scarewareblockerblocksdetectedsitesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev142~policy~microsoft_edge~scarewareblocker_scarewareblockerblocksdetectedsitesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev142~policy~microsoft_edge~scarewareblocker_scarewareblockersenddetectedsitestosmartscreenenabled","displayName":"Configure Edge scareware blocker to share URLs of sites detected as potential tech scams with Microsoft Defender SmartScreen (User)","description":"This policy controls whether Microsoft Edge shares URLs of sites that are detected as potential tech scams with Microsoft Defender SmartScreen.\r\n\r\nThis policy only takes effect if ScarewareBlockerProtectionEnabled is enabled.\r\n\r\nIf you enable this policy, Microsoft Edge will share URLs of sites detected as potential tech scams with Microsoft Defender SmartScreen.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will not share URLs of sites detected as potential tech scams with Microsoft Defender SmartScreen.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev142~policy~microsoft_edge~scarewareblocker_scarewareblockersenddetectedsitestosmartscreenenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev142~policy~microsoft_edge~scarewareblocker_scarewareblockersenddetectedsitestosmartscreenenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev143~policy~microsoft_edge_sharebrowsinghistorywithcopilotsearchallowed","displayName":"Allow sharing tenant-approved browsing history with Microsoft 365 Copilot Search (User)","description":"This policy controls whether browsing history in Microsoft Edge is shared with Microsoft 365 Copilot Search to provide more relevant search results. Only tenant-approved, work-related sites are shared.\r\n\r\nThis feature is available only to users who are signed in to Microsoft Edge with an Entra ID account and have an eligible Microsoft 365 Copilot license.\r\n\r\nIf you enable or don't configure this policy, browsing history will be shared with Microsoft 365 Copilot Search by default, and users can turn off sharing using the toggle in Microsoft Edge settings.\r\n\r\nIf you disable this policy, browsing history won't be shared with Microsoft 365 Copilot Search.\r\n\r\nLearn more about how Copilot uses data and consent at https://go.microsoft.com/fwlink/?linkid=2333202","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev143~policy~microsoft_edge_sharebrowsinghistorywithcopilotsearchallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev143~policy~microsoft_edge_sharebrowsinghistorywithcopilotsearchallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev143~policy~microsoft_edge~network_localnetworkaccessrestrictionstemporaryoptout","displayName":"Specifies whether to opt out of Local Network Access restrictions (User)","description":"This policy allows for opting out of restrictions on requests to local network endpoints.\r\n\r\nIf you enable this policy, Local Network Access requests will only display warnings in Edge DevTools when Local Network Access checks fail.\r\n\r\nIf you disable or don't configure this policy, Local Network Access requests will follow the default handling behavior.\r\n\r\nFor more information about Local Network Access restrictions, see Local Network Access .\r\n\r\nThis enterprise policy is temporary and will be removed after Microsoft Edge version 146.\r\n\r\nTo allow specific URL patterns that should automatically be granted Local Network Access permission, use the LocalNetworkAccessAllowedForUrls policy.\r\n\r\nNote: If the LocalNetworkAccessRestrictionsEnabled policy is enabled, it takes precedence over this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev143~policy~microsoft_edge~network_localnetworkaccessrestrictionstemporaryoptout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev143~policy~microsoft_edge~network_localnetworkaccessrestrictionstemporaryoptout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev143~policy~microsoft_edge~performance_ramresourcecontrolsenabled","displayName":"Enable RAM (memory) resource controls (User)","description":"This policy controls whether users can access the RAM (memory) resource control feature. This feature lets users set an individual limit on how much RAM (memory) the browser can use.\r\n\r\nTo set a specific memory limit, use the 'TotalMemoryLimitMb' (Set limit on megabytes of memory a single Microsoft Edge instance can use) policy.\r\n\r\nIf you enable or don't configure this policy, users can enable resource control and set the amount of RAM that Microsoft Edge can use. Browser performance may be affected by low limits.\r\n\r\nIf you disable this policy, users can't use resource control.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev143~policy~microsoft_edge~performance_ramresourcecontrolsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev143~policy~microsoft_edge~performance_ramresourcecontrolsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev144~policy~microsoft_edge_silentprintingenabled","displayName":"Enable Silent Printing (User)","description":"This policy controls whether Microsoft Edge uses silent printing.\r\n\r\nIf you enable this policy, Edge automatically closes the print preview window and prints to the default printer using its default settings. If the default printer is Save as PDF, the file is saved to the user's Downloads folder.\r\n\r\nIf you disable or don't configure this policy, silent printing is disabled. The print preview window stays open and the user must choose print settings as usual.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev144~policy~microsoft_edge_silentprintingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev144~policy~microsoft_edge_silentprintingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev144~policy~microsoft_edge_whatsnewpageforentraprofilesenabled","displayName":"Control whether an informational webpage for Edge for Business is shown in the new tab after major browser updates (User)","description":"Starting in Microsoft Edge version 145, users with Microsoft Entra ID profiles will see an informational page about new Edge for Business features after major browser updates. This page highlights recent enhancements designed to promote secure and productive browsing.\r\n\r\nThis policy controls whether users with Microsoft Entra ID profiles see this informational page. This policy applies only to Microsoft Entra ID profiles and does not apply to Microsoft account (MSA) profiles.\r\n\r\nThis policy is available starting in Microsoft Edge version 144 to allow configuration ahead of the changes introduced in version 145.\r\n\r\nIf you enable this policy or do not configure it, Microsoft Edge shows the informational page by default.\r\nIf you disable this policy, Microsoft Edge does not show the informational page to users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev144~policy~microsoft_edge_whatsnewpageforentraprofilesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev144~policy~microsoft_edge_whatsnewpageforentraprofilesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev144~policy~microsoft_edge~contentsettings_geolocationblockedforurls","displayName":"Block geolocation on these sites (User)","description":"Use this policy to define a list of URL patterns for sites that are blocked from accessing the user's geolocation. These sites also can't prompt the user for location permissions.\r\n\r\nIf you enable this policy, the list you provide determines which sites are blocked from requesting or accessing geolocation.\r\n\r\nIf you disable or don't configure this policy, DefaultGeolocationSetting applies to all sites, if configured. If it's not configured, the user’s personal browser setting is used.\r\n\r\nFor detailed information on valid url patterns, see the documentation on pattern formats: https://learn.microsoft.com/deployedge/edge-learnmmore-url-list-filter%20format.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev144~policy~microsoft_edge~contentsettings_geolocationblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev144~policy~microsoft_edge~contentsettings_geolocationblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev144~policy~microsoft_edge~contentsettings_geolocationblockedforurls_geolocationblockedforurlsdesc","displayName":"Block geolocation on these sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev144~policy~microsoft_edge~contentsettings_precisegeolocationallowedforurls","displayName":"Allow precise geolocation on these sites (User)","description":"This policy lets you specify a list of URL patterns for sites that are allowed to access the user's high-accuracy geolocation without prompting for permission.\r\n\r\nIf you leave this policy unset, DefaultGeolocationSetting applies to all sites (if configured). Otherwise, the user's personal setting is used.\r\n\r\nFor information about valid url patterns, see https://learn.microsoft.com/deployedge/edge-learnmmore-url-list-filter%20format. Wildcards (*) are supported.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev144~policy~microsoft_edge~contentsettings_precisegeolocationallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev144~policy~microsoft_edge~contentsettings_precisegeolocationallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev144~policy~microsoft_edge~contentsettings_precisegeolocationallowedforurls_precisegeolocationallowedforurlsdesc","displayName":"Allow precise geolocation on these sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge_recommended_httpsonlymode_recommended","displayName":"Allow HTTPS-Only Mode to be enabled (User)","description":"This policy controls whether users can enable HTTPS-Only Mode (Always Use Secure Connections) in Settings. HTTPS-Only Mode attempts to upgrade all navigations to HTTPS.\r\n\r\nIf this setting isn't set or is set to `allowed`, users are able to enable HTTPS-Only Mode.\r\nIf this setting is set to `disallowed`, HTTPS-Only Mode will be disabled.\r\nIf this setting is set to `force_enabled`, HTTPS-Only Mode is enabled in Strict mode.\r\nIf this setting is set to `force_balanced_enabled`, HTTPS-Only Mode is enabled in Balanced mode.\r\n\r\nThe settings `force_enabled` and `force_balanced_enabled` can be recommended to users. HTTPS-Only Mode will be set to Strict or Balanced initially, but users are allowed to change it.\r\n\r\nIf you set this policy to a value that isn't supported by the version of Microsoft Edge that receives the policy, Microsoft Edge defaults to the `allowed` setting.\r\n\r\nThe separate HttpAllowlist policy can be used to exempt specific hostnames or hostname patterns from being upgraded to HTTPS by this feature.\r\n\r\nPolicy options mapping:\r\n\r\n* allowed (allowed) = Don't restrict users' HTTPS-Only Mode setting\r\n\r\n* disallowed (disallowed) = Disable HTTPS-Only Mode\r\n\r\n* force_enabled (force_enabled) = Force enable HTTPS-Only Mode in Strict mode\r\n\r\n* force_balanced_enabled (force_balanced_enabled) = Force enable HTTPS-Only Mode in Balanced Mode\r\n\r\nUse the preceding information when configuring this policy.\r\n\r\nExample value: disallowed","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge_recommended_httpsonlymode_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge_recommended_httpsonlymode_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge_recommended_httpsonlymode_recommended_httpsonlymode","displayName":"Allow HTTPS-Only Mode to be enabled (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge_recommended_httpsonlymode_recommended_httpsonlymode_allowed","displayName":"Don't restrict users' HTTPS-Only Mode setting","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge_recommended_httpsonlymode_recommended_httpsonlymode_disallowed","displayName":"Disable HTTPS-Only Mode","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge_recommended_httpsonlymode_recommended_httpsonlymode_force_enabled","displayName":"Force enable HTTPS-Only Mode in Strict mode","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge_recommended_httpsonlymode_recommended_httpsonlymode_force_balanced_enabled","displayName":"Force enable HTTPS-Only Mode in Balanced Mode","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge_staticstoragequotaenabled","displayName":"Control whether storage quota APIs will return static values (User)","description":"Controls how the Storage Quota APIs report the available quota to websites.\r\n\r\nWhen enabled, the Storage Quota APIs return a static quota value equal to the current usage plus the smaller of 10 GiB or the device's total storage rounded up to the nearest 1 GiB.\r\n\r\nWhen disabled, the Storage Quota APIs return a dynamic quota value that reflects the actual available device storage.\r\n\r\nWhen unset, the browser uses the default platform behavior.\r\n\r\nThis policy does not affect sites with unlimited storage permissions or enforced quota settings.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge_staticstoragequotaenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge_staticstoragequotaenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge_webappinstallbyuserenabled","displayName":"Enable User Web App Install From Browser (User)","description":"This policy controls whether users can install web apps through Microsoft Edge.\r\nIf you enable or don’t configure this policy, users can install web apps through the browser.\r\nIf you disable this policy, users can’t install web apps through the browser, and the \"apps\" data type is excluded from synchronization.\r\nThis policy doesn't support dynamic refresh. Changes to this policy, whether enabled, disabled, or not configured, take effect only after the browser is restarted.\r\nThis policy doesn't affect the 'WebAppInstallForceList' policy. Web apps specified by that policy are installed regardless of this policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge_webappinstallbyuserenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge_webappinstallbyuserenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~contentsettings_defaultidledetectionsetting","displayName":"Default idle detection setting (User)","description":"Setting this policy to 1 - AllowIdleDetection allows websites to use the Idle Detection API without requesting user permission.\r\n\r\nSetting this policy to 2 - BlockIdleDetection prevents websites from using the Idle Detection API.\r\n\r\nSetting this policy to 3 - AskIdleDetection requires websites to request user permission each time before using the Idle Detection API.\r\n\r\nIf you do not configure this policy, users can decide whether to allow the Idle Detection API and can change this setting themselves.\r\n\r\nPolicy options mapping:\r\n\r\n* AllowIdleDetection (1) = Allow sites to detect idle state without asking the user\r\n\r\n* BlockIdleDetection (2) = Do not allow any site to detect the user's idle state\r\n\r\n* AskIdleDetection (3) = Ask every time a site wants to detect the user's idle state\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~contentsettings_defaultidledetectionsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~contentsettings_defaultidledetectionsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~contentsettings_defaultidledetectionsetting_defaultidledetectionsetting","displayName":"Idle detection (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~contentsettings_defaultidledetectionsetting_defaultidledetectionsetting_1","displayName":"Allow sites to detect idle state without asking the user","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~contentsettings_defaultidledetectionsetting_defaultidledetectionsetting_2","displayName":"Do not allow any site to detect the user's idle state","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~contentsettings_defaultidledetectionsetting_defaultidledetectionsetting_3","displayName":"Ask every time a site wants to detect the user's idle state","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~contentsettings_idledetectionallowedforurls","displayName":"Allow idle detection on these sites (User)","description":"Allows you to specify a list of URL patterns for sites that are allowed to use the Idle Detection API.\r\n\r\nIf you do not configure this policy, the default behavior applies to all sites. The default behavior is determined by the DefaultIdleDetectionSetting policy, if configured, or by the user’s personal settings otherwise.\r\n\r\nOnly the origin of the URL is evaluated. Any path specified in a URL pattern is ignored. Wildcards, *, are supported. For detailed information about valid URL pattern formats, see https://go.microsoft.com/fwlink/?linkid=209532.\r\n\r\nURL patterns specified in the blocklist take precedence over this allowlist. This allowlist takes precedence over the DefaultIdleDetectionSetting policy.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~contentsettings_idledetectionallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~contentsettings_idledetectionallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~contentsettings_idledetectionallowedforurls_idledetectionallowedforurlsdesc","displayName":"Allowed sites for idle detection (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~contentsettings_idledetectionblockedforurls","displayName":"Block idle detection on these sites (User)","description":"Allows you to specify a list of URL patterns for sites that are not allowed to use the Idle Detection API.\r\n\r\nOnly the origin of the URL is evaluated. Any path specified in a URL pattern is ignored. Wildcards, *, are supported.\r\n\r\nFor detailed information about valid URL pattern formats, see https://go.microsoft.com/fwlink/?linkid=2095322.\r\n\r\nIf you do not configure this policy, the default behavior applies to all sites. The default behavior is determined by the DefaultIdleDetectionSetting policy, if configured, or by the user’s personal settings otherwise.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~contentsettings_idledetectionblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~contentsettings_idledetectionblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~contentsettings_idledetectionblockedforurls_idledetectionblockedforurlsdesc","displayName":"Blocked sites for idle detection (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~extensions_edgesafehostingextensionenabled","displayName":"Control Microsoft Edge Safe Hosting Extension (User)","description":"This policy controls whether the Microsoft Edge Safe Hosting component extension is installed automatically when users visit supported Microsoft services, such as Microsoft 365 Copilot app.\r\n\r\nThe Microsoft Edge Safe Hosting extension provides additional security capabilities for these services. When a user accesses a supported service, the extension installs automatically to enable those protections.\r\n\r\nIf you enable or don't configure this policy, the extension installs automatically and remains installed for 90 days after the user's last visit, then is removed if no further activity occurs.\r\n\r\nIf you disable this policy, the extension won't install automatically. If it’s already installed, it will be removed.\r\n\r\nNote: This policy controls only automatic installation. It doesn’t prevent users from manually installing other extensions from the Microsoft Edge Add-ons website.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~extensions_edgesafehostingextensionenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~extensions_edgesafehostingextensionenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~identity_editprofileenabled","displayName":"Enable editing profile in settings (User)","description":"This policy controls whether users can modify profile properties (such as profile avatar) from the profile settings page.\r\n\r\nIf you enable or don't configure this policy, users can edit profile properties. The edit button is available on the profile settings page.\r\n\r\nIf you disable this policy, users can't edit profile properties. The edit button is disabled on the profile settings page.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~identity_editprofileenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~identity_editprofileenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~passwordmanager_passwordmanagerpasskeysenabled","displayName":"Enable saving passkeys to the password manager (User)","description":"This policy controls whether users can save passkeys in the built-in password manager. It does not limit access to, or change the contents of, passkeys already saved in the password manager.\r\n\r\nIf the PasswordManagerEnabled policy is Disabled, saving to the built-in password manager is disabled in general, including passkeys. In this case, this policy has no effect.\r\n\r\nIf this policy is enabled or not configured, users can save passkeys in the built-in password manager when signed in to Microsoft Edge.\r\n\r\nIf this policy is disabled, users cannot save new passkeys to the built-in password manager. Previously saved passkeys continue to work.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~passwordmanager_passwordmanagerpasskeysenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev145~policy~microsoft_edge~passwordmanager_passwordmanagerpasskeysenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge_standardizedbrowserzoomenabled","displayName":"Enable Standardized Browser Zoom Behavior (User)","description":"Configures whether the CSS \"zoom\" property follows the current CSS specification or legacy behavior.\r\n\r\nWhen this policy is enabled or not configured, the CSS \"zoom\" property follows the current specification defined by the CSS Working Group:\r\nhttps://drafts.csswg.org/css-viewport/#zoom-property\r\n\r\nWhen this policy is disabled, the CSS \"zoom\" property uses its legacy, pre-standardized behavior.\r\n\r\nThis policy is temporary and is intended to provide time for organizations to migrate web content to the updated behavior. In a future Microsoft Edge release, this policy will be removed and the standardized behavior will be enforced by default.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge_standardizedbrowserzoomenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge_standardizedbrowserzoomenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~cryptographycompliance_preferslowciphers","displayName":"Prefer specific encryption cipher algorithms for TLS (User)","description":"This policy configures Microsoft Edge to order its preferred encryption ciphers in TLS 1.3 based on algorithms approved by a specific compliance regime.\r\n\r\nSetting this policy does not guarantee that any specific algorithms will be negotiated.\r\n\r\nThis policy allows server operators who support both compliant and non-compliant clients to differentiate between them, and use certain non-default algorithms with increased cryptographic strength only for clients explicitly configured to prefer them.\r\n\r\nSetting the policy to 'cnsa' configures Microsoft Edge to prefer ciphers required for compliance with the Commercial National Security Algorithm Suite versions 1.0 and 2.0 (CNSA 1.0 and 2.0).\r\n\r\nNot setting the policy, or setting it to 'default', configures Microsoft Edge to use its default ciphers.\r\n\r\nSetting this policy isn't required for security. The default cryptography used by Microsoft Edge is strong enough to withstand a brute-force attack using the entire power of the Sun.\r\n\r\nSetting this policy will cause Microsoft Edge to be slower when accessing websites.\r\n\r\nThis policy only affects TLS 1.3 and QUIC. It doesn't affect earlier versions of TLS.\r\n\r\nPolicy options mapping:\r\n\r\n* CNSA (cnsa) = Prefer ciphers satisfying the requirements of CNSA 1.0 and 2.0\r\n\r\n* Default (default) = Use Microsoft Edge's default cipher order\r\n\r\nUse the preceding information when configuring this policy.\r\n\r\nExample value: cnsa","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~cryptographycompliance_preferslowciphers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~cryptographycompliance_preferslowciphers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~cryptographycompliance_preferslowciphers_preferslowciphers","displayName":"Prefer specific encryption cipher algorithms for TLS (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~cryptographycompliance_preferslowciphers_preferslowciphers_cnsa","displayName":"Prefer ciphers satisfying the requirements of CNSA 1.0 and 2.0","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~cryptographycompliance_preferslowciphers_preferslowciphers_default","displayName":"Use Microsoft Edge's default cipher order","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~cryptographycompliance_preferslowkexalgorithms","displayName":"Prefer specific key exchange algorithms for TLS (User)","description":"This policy configures Microsoft Edge to prioritize certain key agreement algorithms (supported groups) in TLS 1.3 based on compliance requirements.\r\n\r\nIf you set this policy to 'cnsa2', Microsoft Edge prefers the algorithms required for the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0). If you leave this policy unset or set it to 'default', the browser uses its standard key exchange order.\r\n\r\nThis policy does not guarantee negotiation of a specific algorithm. It is designed to help server operators distinguish clients with compliance requirements and apply higher-strength, non-default algorithms only when appropriate.\r\n\r\nIf this policy would prefer a post-quantum key agreement algorithm but PostQuantumKeyAgreementEnabled is Disabled, the post-quantum setting takes precedence.\r\n\r\nThis policy applies only to TLS 1.3 and QUIC. The default cryptography used by Microsoft Edge already provides strong security, but enabling this policy may reduce performance when accessing websites.\r\n\r\nPolicy options mapping:\r\n\r\n* CNSA2.0 (cnsa2) = Prefer key exchange methods satisfying the requirements of CNSA 2.0\r\n\r\n* Default (default) = Use Microsoft Edge's default supported groups\r\n\r\nUse the preceding information when configuring this policy.\r\n\r\nExample value: cnsa2","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~cryptographycompliance_preferslowkexalgorithms_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~cryptographycompliance_preferslowkexalgorithms_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~cryptographycompliance_preferslowkexalgorithms_preferslowkexalgorithms","displayName":"Prefer specific key exchange algorithms for TLS (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~cryptographycompliance_preferslowkexalgorithms_preferslowkexalgorithms_cnsa2","displayName":"Prefer key exchange methods satisfying the requirements of CNSA 2.0","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~cryptographycompliance_preferslowkexalgorithms_preferslowkexalgorithms_default","displayName":"Use Microsoft Edge's default supported groups","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_localnetworkaccessipaddressspaceoverrides","displayName":"Override IP address space mappings (User)","description":"Specifies IP address space overrides for Local Network Access restrictions. This policy allows administrators to treat specific IP address ranges as public (exempt from Local Network Access restrictions) or as local (subject to Local Network Access restrictions).\r\n\r\nIP address space overrides can be specified using one of the following formats:\r\n\r\n• [cidr]=[public|local|loopback]\r\nwhere [cidr] is an IP address range in CIDR notation. CIDR overrides apply to all ports.\r\n\r\n• [ip-address]:[port]=[public|local|loopback]\r\n\r\nIPv6 addresses must be specified in URL-safe (bracketed) format.\r\n\r\nFor more information about Local Network Access, see https://wicg.github.io/local-network-access/.\r\n\r\nExample value:\r\n\r\n100.64.0.0/10=public\r\n[2001:db8::]/32=local\r\n192.168.0.1:8000=public\r\n[2001:DB8::8:800:200C:417A]:8080=local","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_localnetworkaccessipaddressspaceoverrides_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_localnetworkaccessipaddressspaceoverrides_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_localnetworkaccessipaddressspaceoverrides_localnetworkaccessipaddressspaceoverridesdesc","displayName":"Override IP address space mappings (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_localnetworkaccesspermissionspolicydefaultenabled","displayName":"Allow Local Network Access (LNA) requests in subframes without explicit delegation (User)","description":"Controls whether Local Network Access (LNA) permissions are inherited by cross-origin subframes.\r\n\r\nBy default, Local Network Access permissions can be requested in cross-origin subframes only if they are explicitly delegated.\r\n\r\nIf you enable this policy, subframes inherit all LNA Permissions Policy features by default and can make local network requests, which trigger the permission prompt.\r\n\r\nIf you disable or don't configure this policy, subframes must be explicitly delegated the Permissions Policy feature to make local network requests and trigger the permission prompt.\r\n\r\nThis policy applies to the Permissions Policy features \"local-network-access\", \"loopback-network\", and \"local-network\".\r\n\r\nFor more information about Local Network Access, see https://learn.microsoft.com/deployedge/ms-edge-local-network-access.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_localnetworkaccesspermissionspolicydefaultenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_localnetworkaccesspermissionspolicydefaultenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_localnetworkallowedforurls","displayName":"Allow sites to make network requests to local network endpoints. (User)","description":"Controls which website origins are exempt from Local Network Access checks when accessing local network endpoints.\r\n\r\nNetwork requests initiated from websites that match the specified URL patterns are not subject to Local Network Access checks.\r\n\r\nFor origins not covered by the patterns specified in this policy, the user's personal configuration applies.\r\n\r\nFor detailed information about valid URL patterns, see https://learn.microsoft.com/deployedge/edge-learnmore-ent-policy-url-patterns.\r\n\r\nFor more information about Local Network Access restrictions, see https://wicg.github.io/local-network-access/.\r\n\r\nMultiple policies can list origins that affect requests to local network endpoints. If an origin matches more than one of the following policies, they take precedence in the following order:\r\n- LocalNetworkBlockedForUrls\r\n- LocalNetworkAllowedForUrls\r\n- LoopbackNetworkBlockedForUrls\r\n- LoopbackNetworkAllowedForUrls\r\n- LocalNetworkAccessBlockedForUrls\r\n- LocalNetworkAccessAllowedForUrls\r\n\r\nThis policy controls access to local network endpoints (private IP addresses) and can be used to allow specific websites to access local network resources.\r\n\r\nExample value:\r\n\r\nhttp://www.example.com:8080\r\n[*.]example.edu\r\n*","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_localnetworkallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_localnetworkallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_localnetworkallowedforurls_localnetworkallowedforurlsdesc","displayName":"Allow sites to make network requests to local network endpoints. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_localnetworkblockedforurls","displayName":"Block sites from making network requests to local network endpoints. (User)","description":"Controls which website origins are blocked from making Local Network Access requests to local network endpoints.\r\n\r\nNetwork requests initiated from websites that match the specified URL patterns are blocked from issuing Local Network Access requests.\r\n\r\nFor origins not covered by the patterns specified in this policy, the user's personal configuration applies.\r\n\r\nFor detailed information about valid URL patterns, see https://learn.microsoft.com/deployedge/edge-learnmore-ent-policy-url-patterns.\r\n\r\nFor more information about Local Network Access restrictions, see https://wicg.github.io/local-network-access/.\r\n\r\nMultiple policies can list origins that affect requests to local network endpoints. If an origin matches more than one of the following policies, they take precedence in the following order:\r\n- LocalNetworkBlockedForUrls\r\n- LocalNetworkAllowedForUrls\r\n- LoopbackNetworkBlockedForUrls\r\n- LoopbackNetworkAllowedForUrls\r\n- LocalNetworkAccessBlockedForUrls\r\n- LocalNetworkAccessAllowedForUrls\r\n\r\nThis policy controls access to local network endpoints (private IP addresses) and can be used to block specific websites from accessing local network resources.\r\n\r\nExample value:\r\n\r\nhttp://www.example.com:8080\r\n[*.]example.edu\r\n*","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_localnetworkblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_localnetworkblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_localnetworkblockedforurls_localnetworkblockedforurlsdesc","displayName":"Block sites from making network requests to local network endpoints. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_loopbacknetworkallowedforurls","displayName":"Allow sites to make network requests to the local device. (User)","description":"Specifies a list of URL patterns for which requests initiated from matching origins are exempt from Local Network Access restrictions when accessing loopback addresses (127.0.0.1, ::1, localhost).\r\n\r\nIf a requesting origin matches a URL pattern specified in this policy, requests to loopback addresses are allowed and are not subject to Local Network Access restrictions.\r\n\r\nFor origins not covered by this policy, the user's personal settings and local network access restrictions apply.\r\n\r\nIf this policy is disabled or not configured, no additional exemptions are granted beyond the user's existing configuration.\r\n\r\nMultiple policies can specify origins that affect requests to the local device. If an origin matches more than one of the following policies, they are applied in the following order of precedence:\r\n- LoopbackNetworkBlockedForUrls\r\n- LoopbackNetworkAllowedForUrls\r\n- LocalNetworkAccessBlockedForUrls\r\n- LocalNetworkAccessAllowedForUrls\r\n\r\nFor guidance on valid URL pattern syntax, see https://learn.microsoft.com/deployedge/edge-learnmore-ent-policy-url-patterns .\r\n\r\nExample value:\r\n\r\nhttp://www.example.com:8080\r\n[*.]example.edu\r\n*","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_loopbacknetworkallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_loopbacknetworkallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_loopbacknetworkallowedforurls_loopbacknetworkallowedforurlsdesc","displayName":"Allow sites to make network requests to the local device. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_loopbacknetworkblockedforurls","displayName":"Block sites from making network requests to the local device. (User)","description":"Specifies a list of URL patterns for which requests initiated from matching origins to loopback addresses (127.0.0.1, ::1, localhost) are blocked from issuing Local Network Access requests.\r\n\r\nIf a requesting origin matches a URL pattern specified in this policy, requests to loopback addresses are blocked.\r\n\r\nFor origins not covered by this policy, the user's personal settings and local network access restrictions apply.\r\n\r\nMultiple policies can specify origins that affect requests to the local device. If an origin matches more than one of the following policies, they are applied in the following order of precedence:\r\n- LoopbackNetworkBlockedForUrls\r\n- LoopbackNetworkAllowedForUrls\r\n- LocalNetworkAccessBlockedForUrls\r\n- LocalNetworkAccessAllowedForUrls\r\n\r\nNote: This policy improves local network security by blocking specified public websites from accessing loopback addresses. It helps prevent unauthorized external sites from reaching local services running on the device unless explicitly permitted.\r\n\r\nFor more information about Local Network Access, see https://wicg.github.io/local-network-access/\r\n\r\nExample value:\r\n\r\nhttp://www.example.com:8080\r\n[*.]example.edu\r\n*","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_loopbacknetworkblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_loopbacknetworkblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev146~policy~microsoft_edge~network_loopbacknetworkblockedforurls_loopbacknetworkblockedforurlsdesc","displayName":"Block sites from making network requests to the local device. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev77.3~policy~microsoft_edge_recommended~startup_recommended_restoreonstartup_recommended","displayName":"Action to take on Microsoft Edge startup (User)","description":"Specify how Microsoft Edge behaves when it starts.\r\n\r\nIf you want a new tab to always open on startup, choose 'RestoreOnStartupIsNewTabPage'.\r\n\r\nIf you want to reopen URLs that were open the last time Microsoft Edge closed, choose 'RestoreOnStartupIsLastSession'. The browsing session will be restored as it was. Note that this option disables some settings that rely on sessions or that perform actions on exit (such as Clear browsing data on exit or session-only cookies).\r\n\r\nIf you want to open a specific set of URLs, choose 'RestoreOnStartupIsURLs'.\r\n\r\nStarting in Microsoft Edge version 125, if you want to reopen URLs that were open the last time Microsoft Edge closed and open a specific set of URLs, choose 'RestoreOnStartupIsLastSessionAndURLs'.\r\n\r\nDisabling this setting is the same as leaving it not configured. Users will be able to change it in Microsoft Edge.\r\n\r\nThis policy is only available on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is only available on instances that are managed via MDM or joined to a domain via MCX.\r\n\r\nPolicy options mapping:\r\n\r\n* RestoreOnStartupIsNewTabPage (5) = Open a new tab\r\n\r\n* RestoreOnStartupIsLastSession (1) = Restore the last session\r\n\r\n* RestoreOnStartupIsURLs (4) = Open a list of URLs\r\n\r\n* RestoreOnStartupIsLastSessionAndURLs (6) = Open a list of URLs and restore the last session\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev77.3~policy~microsoft_edge_recommended~startup_recommended_restoreonstartup_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev77.3~policy~microsoft_edge_recommended~startup_recommended_restoreonstartup_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev77.3~policy~microsoft_edge_recommended~startup_recommended_restoreonstartup_recommended_restoreonstartup","displayName":"Action to take on Microsoft Edge startup (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev77.3~policy~microsoft_edge_recommended~startup_recommended_restoreonstartup_recommended_restoreonstartup_5","displayName":"Open a new tab","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev77.3~policy~microsoft_edge_recommended~startup_recommended_restoreonstartup_recommended_restoreonstartup_1","displayName":"Restore the last session","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev77.3~policy~microsoft_edge_recommended~startup_recommended_restoreonstartup_recommended_restoreonstartup_4","displayName":"Open a list of URLs","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev77.3~policy~microsoft_edge_recommended~startup_recommended_restoreonstartup_recommended_restoreonstartup_6","displayName":"Open a list of URLs and restore the last session","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev77.3~policy~microsoft_edge~startup_restoreonstartup","displayName":"Action to take on Microsoft Edge startup (User)","description":"Specify how Microsoft Edge behaves when it starts.\r\n\r\nIf you want a new tab to always open on startup, choose 'RestoreOnStartupIsNewTabPage'.\r\n\r\nIf you want to reopen URLs that were open the last time Microsoft Edge closed, choose 'RestoreOnStartupIsLastSession'. The browsing session will be restored as it was. Note that this option disables some settings that rely on sessions or that perform actions on exit (such as Clear browsing data on exit or session-only cookies).\r\n\r\nIf you want to open a specific set of URLs, choose 'RestoreOnStartupIsURLs'.\r\n\r\nStarting in Microsoft Edge version 125, if you want to reopen URLs that were open the last time Microsoft Edge closed and open a specific set of URLs, choose 'RestoreOnStartupIsLastSessionAndURLs'.\r\n\r\nDisabling this setting is the same as leaving it not configured. Users will be able to change it in Microsoft Edge.\r\n\r\nThis policy is only available on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is only available on instances that are managed via MDM or joined to a domain via MCX.\r\n\r\nPolicy options mapping:\r\n\r\n* RestoreOnStartupIsNewTabPage (5) = Open a new tab\r\n\r\n* RestoreOnStartupIsLastSession (1) = Restore the last session\r\n\r\n* RestoreOnStartupIsURLs (4) = Open a list of URLs\r\n\r\n* RestoreOnStartupIsLastSessionAndURLs (6) = Open a list of URLs and restore the last session\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev77.3~policy~microsoft_edge~startup_restoreonstartup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev77.3~policy~microsoft_edge~startup_restoreonstartup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev77.3~policy~microsoft_edge~startup_restoreonstartup_restoreonstartup","displayName":"Action to take on Microsoft Edge startup (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev77.3~policy~microsoft_edge~startup_restoreonstartup_restoreonstartup_5","displayName":"Open a new tab","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev77.3~policy~microsoft_edge~startup_restoreonstartup_restoreonstartup_1","displayName":"Restore the last session","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev77.3~policy~microsoft_edge~startup_restoreonstartup_restoreonstartup_4","displayName":"Open a list of URLs","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev77.3~policy~microsoft_edge~startup_restoreonstartup_restoreonstartup_6","displayName":"Open a list of URLs and restore the last session","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_adssettingforintrusiveadssites","displayName":"Ads setting for sites with intrusive ads (User)","description":"Controls whether ads are blocked on sites with intrusive ads. You can set this policy to one of the following options:\r\n\r\n* 1 = Allow ads on all sites.\r\n\r\n* 2 = Block ads on sites with intrusive ads (Default value).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_adssettingforintrusiveadssites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_adssettingforintrusiveadssites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_adssettingforintrusiveadssites_adssettingforintrusiveadssites","displayName":"Ads setting for sites with intrusive ads (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_adssettingforintrusiveadssites_adssettingforintrusiveadssites_1","displayName":"Allow ads on all sites","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_adssettingforintrusiveadssites_adssettingforintrusiveadssites_2","displayName":"Block ads on sites with intrusive ads. (Default value)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_allowpopupsduringpageunload","displayName":"Allows a page to show popups during its unloading (User)","description":"This policy allows an admin to specify that a page can show popups during its unloading.\r\n\r\nWhen the policy is set to enabled, pages are allowed to show popups while they're being unloaded.\r\n\r\nWhen the policy is set to disabled or unset, pages aren't allowed to show popups while they're being unloaded. This is as per the spec: (https://html.spec.whatwg.org/#apis-for-creating-and-navigating-browsing-contexts-by-name).\r\n\r\nThis policy will be removed in the future.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_allowpopupsduringpageunload_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_allowpopupsduringpageunload_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_allowtrackingforurls","displayName":"Configure tracking prevention exceptions for specific sites (User)","description":"Configure the list of URL patterns that are excluded from tracking prevention.\r\n\r\nIf you configure this policy, the list of configured URL patterns is excluded from tracking prevention.\r\n\r\nIf you don't configure this policy, the global default value from the \"Block tracking of users' web-browsing activity\" policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_allowtrackingforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_allowtrackingforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_allowtrackingforurls_allowtrackingforurlsdesc","displayName":"Configure tracking prevention exceptions for specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_autoplayallowed","displayName":"Allow media autoplay for websites (User)","description":"This policy sets the media autoplay policy for websites.\r\n\r\nThe default setting, \"Not configured\" respects the current media autoplay settings and lets users configure their autoplay settings.\r\n\r\nSetting to \"Enabled\" sets media autoplay to \"Allow\". All websites are allowed to autoplay media. Users can’t override this policy.\r\n\r\nSetting to \"Disabled\" sets media autoplay to \"Block\". No websites are allowed to autoplay media. Users can’t override this policy.\r\n\r\nA tab will need to be closed and re-opened for this policy to take effect.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_autoplayallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_autoplayallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_clearbrowsingdataonexit","displayName":"Clear browsing data when Microsoft Edge closes (User)","description":"Microsoft Edge doesn't clear the browsing data by default when it closes. Browsing data includes information entered in forms, passwords, and even the websites visited.\r\n\r\nIf you enable this policy, all browsing data is deleted each time Microsoft Edge closes. Note that if you enable this policy, it takes precedence over how you configured 'DefaultCookiesSetting' (Configure cookies)\r\n\r\nIf you disable or don't configure this policy, users can configure the Clear browsing data option in Settings.\r\n\r\nIf you enable this policy, don't configure the 'AllowDeletingBrowserHistory' (Enable deleting browser and download history) or the 'ClearCachedImagesAndFilesOnExit' (Clear cached images and files when Microsoft Edge closes) policy, because they all deal with deleting browsing data. If you configure the preceding policies and this policy, all browsing data is deleted when Microsoft Edge closes, regardless of how you configured 'AllowDeletingBrowserHistory' or 'ClearCachedImagesAndFilesOnExit'.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_clearbrowsingdataonexit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_clearbrowsingdataonexit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_clickonceenabled","displayName":"Allow users to open files using the ClickOnce protocol (User)","description":"Allow users to open files using the ClickOnce protocol. The ClickOnce protocol allows websites to request that the browser open files from a specific URL using the ClickOnce file handler on the user's computer or device.\r\n\r\nIf you enable this policy, users can open files using the ClickOnce protocol. This policy overrides the user's ClickOnce setting in the edge://flags/ page.\r\n\r\nIf you disable this policy, users can't open files using the ClickOnce protocol. Instead, the file will be saved to the file system using the browser. This policy overrides the user's ClickOnce setting in the edge://flags/ page.\r\n\r\nIf you don't configure this policy, users can't open files using the ClickOnce protocol. Users have the option to enable the use of the ClickOnce protocol with the edge://flags/ page.\r\n\r\nDisabling ClickOnce may prevent ClickOnce applications (.application files) from launching properly.\r\n\r\nFor more information about ClickOnce, see https://go.microsoft.com/fwlink/?linkid=2103872 and https://go.microsoft.com/fwlink/?linkid=2099880.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_clickonceenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_clickonceenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_commandlineflagsecuritywarningsenabled","displayName":"Enable security warnings for command-line flags (User)","description":"If disabled, this policy prevents security warnings from appearing when Microsoft Edge is launched with potentially dangerous command-line flags.\r\n\r\nIf enabled or unset, security warnings are displayed when these command-line flags are used to launch Microsoft Edge.\r\n\r\nFor example, the --disable-gpu-sandbox flag generates this warning: You're using an unsupported command-line flag: --disable-gpu-sandbox. This poses stability and security risks.\r\n\r\nOn Windows, this policy is only available on instances that are joined to a Microsoft Active Directory domain, or Windows 10 Pro (or Enterprise) instances that are enrolled for device management.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_commandlineflagsecuritywarningsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_commandlineflagsecuritywarningsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_directinvokeenabled","displayName":"Allow users to open files using the DirectInvoke protocol (User)","description":"Allow users to open files using the DirectInvoke protocol. The DirectInvoke protocol allows websites to request that the browser open files from a specific URL using a specific file handler on the user's computer or device.\r\n\r\nIf you enable or don't configure this policy, users can open files using the DirectInvoke protocol.\r\n\r\nIf you disable this policy, users can't open files using the DirectInvoke protocol. Instead, the file will be saved to the file system.\r\n\r\nNote: Disabling DirectInvoke may prevent certain Microsoft SharePoint Online features from working as expected.\r\n\r\nFor more information about DirectInvoke, see https://go.microsoft.com/fwlink/?linkid=2103872 and https://go.microsoft.com/fwlink/?linkid=2099871.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_directinvokeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_directinvokeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_edgecollectionsenabled","displayName":"Enable the Collections feature (User)","description":"Lets you allow users to access the Collections feature, where they can collect, organize, share, and export content more efficiently and with Office integration.\r\n\r\nIf you enable or don't configure this policy, users can access and use the Collections feature in Microsoft Edge.\r\n\r\nIf you disable this policy, users can't access and use Collections in Microsoft Edge.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_edgecollectionsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_edgecollectionsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_enterprisehardwareplatformapienabled","displayName":"Allow managed extensions to use the Enterprise Hardware Platform API (User)","description":"When this policy is set to enabled, extensions installed by enterprise policy are allowed to use the Enterprise Hardware Platform API.\r\nWhen this policy is set to disabled or isn't set, no extensions are allowed to use the Enterprise Hardware Platform API.\r\nThis policy also applies to component extensions.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_enterprisehardwareplatformapienabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_enterprisehardwareplatformapienabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_forcenetworkinprocess","displayName":"Force networking code to run in the browser process (User)","description":"This policy forces networking code to run in the browser process.\r\n\r\nThis policy is disabled by default. If enabled, users are open to security issues when the networking process is sandboxed.\r\n\r\nThis policy is intended to give enterprises a chance to migrate to 3rd party software that doesn't depend on hooking networking APIs. Proxy servers are recommended over LSPs and Win32 API patching.\r\n\r\nIf this policy isn't set, networking code may run out of the browser process depending on field trials of the NetworkService experiment.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_forcenetworkinprocess_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_forcenetworkinprocess_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_gotointranetsiteforsinglewordentryinaddressbar","displayName":"Force direct intranet site navigation instead of searching on single word entries in the Address Bar (User)","description":"If you enable this policy, the top auto-suggest result in the address bar suggestion list will navigate to intranet sites if the text entered in the address bar is a single word without punctuation.\r\n\r\nDefault navigation when typing a single word without punctuation will conduct a navigation to an intranet site matching the entered text.\r\n\r\nIf you enable this policy, the second auto-suggest result in the address bar suggestion list will conduct a web search exactly as it was entered, provided that this text is a single word without punctuation. The default search provider will be used unless a policy to prevent web search is also enabled.\r\n\r\nTwo effects of enabling this policy are:\r\n\r\nNavigation to sites in response to single word queries that would typically resolve to a history item will no longer happen. Instead, the browser will attempt navigate to internal sites that may not exist in an organization’s intranet. This will result in a 404 error.\r\n\r\nPopular, single-word search terms will require manual selection of search suggestions to properly conduct a search.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_gotointranetsiteforsinglewordentryinaddressbar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_gotointranetsiteforsinglewordentryinaddressbar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_importbrowsersettings","displayName":"Allow importing of browser settings (User)","description":"Allows users to import browser settings from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the **Browser settings** check box is automatically selected in the **Import browser data** dialog box.\r\n\r\nIf you disable this policy, browser settings aren't imported at first run, and users can’t import them manually.\r\n\r\nIf you don’t configure this policy, browser settings are imported at first run, and users can choose whether to import them manually during later browsing sessions.\r\n\r\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports the settings on first run, but users can select or clear the **browser settings** option during manual import.\r\n\r\n**Note**: This policy currently manages importing Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_importbrowsersettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_importbrowsersettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_internetexplorerintegrationsitelist","displayName":"Configure the Enterprise Mode Site List (User)","description":"For guidance about configuring the optimal experience for Internet Explorer mode see https://go.microsoft.com/fwlink/?linkid=2094210\r\n\r\nExample value: https://internal.contoso.com/sitelist.xml","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_internetexplorerintegrationsitelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_internetexplorerintegrationsitelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_internetexplorerintegrationsitelist_internetexplorerintegrationsitelist","displayName":"Configure the Enterprise Mode Site List (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_nonremovableprofileenabled","displayName":"Configure whether a user always has a default profile automatically signed in with their work or school account (User)","description":"This policy determines if a user can remove the Microsoft Edge profile automatically signed in with a user's work or school account.\r\n\r\nIf you enable this policy, a non-removable profile will be created with the user's work or school account on Windows. This profile can't be signed out or removed.\r\n\r\nIf you disable or don't configure this policy, the profile automatically signed in with a user's work or school account on Windows can be signed out or removed by the user.\r\n\r\nIf you want to configure browser sign in, use the 'BrowserSignin' (Browser sign-in settings) policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_nonremovableprofileenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_nonremovableprofileenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_recommended_clearbrowsingdataonexit_recommended","displayName":"Clear browsing data when Microsoft Edge closes (User)","description":"Microsoft Edge doesn't clear the browsing data by default when it closes. Browsing data includes information entered in forms, passwords, and even the websites visited.\r\n\r\nIf you enable this policy, all browsing data is deleted each time Microsoft Edge closes. Note that if you enable this policy, it takes precedence over how you configured 'DefaultCookiesSetting' (Configure cookies)\r\n\r\nIf you disable or don't configure this policy, users can configure the Clear browsing data option in Settings.\r\n\r\nIf you enable this policy, don't configure the 'AllowDeletingBrowserHistory' (Enable deleting browser and download history) or the 'ClearCachedImagesAndFilesOnExit' (Clear cached images and files when Microsoft Edge closes) policy, because they all deal with deleting browsing data. If you configure the preceding policies and this policy, all browsing data is deleted when Microsoft Edge closes, regardless of how you configured 'AllowDeletingBrowserHistory' or 'ClearCachedImagesAndFilesOnExit'.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_recommended_clearbrowsingdataonexit_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_recommended_clearbrowsingdataonexit_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_recommended_importbrowsersettings_recommended","displayName":"Allow importing of browser settings (User)","description":"Allows users to import browser settings from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the **Browser settings** check box is automatically selected in the **Import browser data** dialog box.\r\n\r\nIf you disable this policy, browser settings aren't imported at first run, and users can’t import them manually.\r\n\r\nIf you don’t configure this policy, browser settings are imported at first run, and users can choose whether to import them manually during later browsing sessions.\r\n\r\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports the settings on first run, but users can select or clear the **browser settings** option during manual import.\r\n\r\n**Note**: This policy currently manages importing Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_recommended_importbrowsersettings_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_recommended_importbrowsersettings_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_recommended~smartscreen_recommended_smartscreenfortrusteddownloadsenabled_recommended","displayName":"Force Microsoft Defender SmartScreen checks on downloads from trusted sources (User)","description":"This policy setting lets you configure whether Microsoft Defender SmartScreen checks download reputation from a trusted source.\r\n\r\nIf you enable or don't configure this setting, Microsoft Defender SmartScreen checks the download’s reputation regardless of source.\r\n\r\nIf you disable this setting, Microsoft Defender SmartScreen doesn’t check the download’s reputation when downloading from a trusted source.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_recommended~smartscreen_recommended_smartscreenfortrusteddownloadsenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_recommended~smartscreen_recommended_smartscreenfortrusteddownloadsenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_renderercodeintegrityenabled","displayName":"Enable renderer code integrity (deprecated) (User)","description":"If this policy is enabled or left unset, then Renderer Code Integrity is enabled. This policy should only be disabled if compatibility issues are encountered with third party software that must run inside Microsoft Edge's renderer processes.\r\n\r\nDisabling this policy has a detrimental effect on Microsoft Edge's security and stability because unknown and potentially hostile code will be allowed to load inside Microsoft Edge's renderer processes.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_renderercodeintegrityenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_renderercodeintegrityenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_signedhttpexchangeenabled","displayName":"Enable Signed HTTP Exchange (SXG) support (User)","description":"Enable support for Signed HTTP Exchange (SXG).\r\n\r\nIf this policy isn't set or enabled, Microsoft Edge will accept web contents served as Signed HTTP Exchanges.\r\n\r\nIf this policy is set to disabled, Signed HTTP Exchanges can't be loaded.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_signedhttpexchangeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_signedhttpexchangeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_spellchecklanguageblocklist","displayName":"Force disable spellcheck languages (User)","description":"Force-disables spellcheck languages. Unrecognized languages in that list will be ignored.\r\n\r\nIf you enable this policy, spellcheck will be disabled for the languages specified. The user can still enable or disable spellcheck for languages not in the list.\r\n\r\nIf you do not set this policy, or disable it, there will be no change to the user's spellcheck preferences.\r\n\r\nIf the 'SpellcheckEnabled' (Enable spellcheck) policy is set to disabled, this policy will have no effect.\r\n\r\nIf a language is included in both the 'SpellcheckLanguage' (Enable specific spellcheck languages) and the 'SpellcheckLanguageBlocklist' policy, the spellcheck language is enabled.\r\n\r\nThe currently supported languages are: af, bg, ca, cs, da, de, el, en-AU, en-CA, en-GB, en-US, es, es-419, es-AR, es-ES, es-MX, es-US, et, fa, fo, fr, he, hi, hr, hu, id, it, ko, lt, lv, nb, nl, pl, pt-BR, pt-PT, ro, ru, sh, sk, sl, sq, sr, sv, ta, tg, tr, uk, vi.\r\n\r\nExample value:\r\n\r\nfr\r\nes","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_spellchecklanguageblocklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_spellchecklanguageblocklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_spellchecklanguageblocklist_spellchecklanguageblocklistdesc","displayName":"Force disable spellcheck languages (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_trackingprevention","displayName":"Block tracking of users' web-browsing activity (User)","description":"Lets you decide whether to block websites from tracking users' web-browsing activity.\r\n\r\nIf you enable this policy, you have the following options for setting the level of tracking prevention:\r\n\r\n* 0 = Off (no tracking prevention)\r\n\r\n* 1 = Basic (blocks harmful trackers, content and ads will be personalized)\r\n\r\n* 2 = Balanced (blocks harmful trackers and trackers from sites user has not visited; content and ads will be less personalized)\r\n\r\n* 3 = Strict (blocks harmful trackers and majority of trackers from all sites; content and ads will have minimal personalization. Some parts of sites might not work)\r\n\r\nIf you disable this policy or don't configure it, users can set their own level of tracking prevention.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_trackingprevention_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_trackingprevention_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_trackingprevention_trackingprevention","displayName":"Block tracking of users' web-browsing activity (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_trackingprevention_trackingprevention_0","displayName":"Off (no tracking prevention)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_trackingprevention_trackingprevention_1","displayName":"Basic (blocks harmful trackers, content and ads will be personalized)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_trackingprevention_trackingprevention_2","displayName":"Balanced (blocks harmful trackers and trackers from sites user has not visited; content and ads will be less personalized)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge_trackingprevention_trackingprevention_3","displayName":"Strict (blocks harmful trackers and majority of trackers from all sites; content and ads will have minimal personalization. Some parts of sites might not work)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge~smartscreen_smartscreenfortrusteddownloadsenabled","displayName":"Force Microsoft Defender SmartScreen checks on downloads from trusted sources (User)","description":"This policy setting lets you configure whether Microsoft Defender SmartScreen checks download reputation from a trusted source.\r\n\r\nIf you enable or don't configure this setting, Microsoft Defender SmartScreen checks the download’s reputation regardless of source.\r\n\r\nIf you disable this setting, Microsoft Defender SmartScreen doesn’t check the download’s reputation when downloading from a trusted source.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge~smartscreen_smartscreenfortrusteddownloadsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev78diff~policy~microsoft_edge~smartscreen_smartscreenfortrusteddownloadsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_allowsyncxhrinpagedismissal","displayName":"Allow pages to send synchronous XHR requests during page dismissal (User)","description":"This policy lets you specify that a page can send synchronous XHR requests during page dismissal.\r\n\r\nIf you enable this policy, pages can send synchronous XHR requests during page dismissal.\r\n\r\nIf you disable this policy or don't configure this policy, pages aren't allowed to send synchronous XHR requests during page dismissal.\r\n\r\nThis policy is temporary and will be removed in a future release.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_allowsyncxhrinpagedismissal_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_allowsyncxhrinpagedismissal_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_backgroundtemplatelistupdatesenabled","displayName":"Enables background updates to the list of available templates for Collections and other features that use templates (deprecated) (User)","description":"DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.\r\n\r\nThis policy is deprecated because we are moving to a new policy. It won't work in Microsoft Edge as soon as version 104. The new policy to use is 'EdgeAssetDeliveryServiceEnabled' (Allow features to download assets from the Asset Delivery Service).\r\n\r\nLets you enable or disable background updates to the list of available templates for Collections and other features that use templates. Templates are used to extract rich metadata from a webpage when the page is saved to a collection.\r\n\r\nIf you enable this setting or the setting is unconfigured, the list of available templates will be downloaded in the background from a Microsoft service every 24 hours.\r\n\r\nIf you disable this setting the list of available templates will be downloaded on demand. This type of download might result in small performance penalties for Collections and other features.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_backgroundtemplatelistupdatesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_backgroundtemplatelistupdatesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_customhelplink","displayName":"Specify custom help link (User)","description":"Specify a link for the Help menu or the F1 key.\r\n\r\nIf you enable this policy, an admin can specify a link for the Help menu or the F1 key.\r\n\r\nIf you disable or don't configure this policy, the default link for the Help menu or the F1 key is used.\r\n\r\nExample value: https://go.microsoft.com/fwlink/?linkid=2080734","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_customhelplink_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_customhelplink_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_customhelplink_customhelplink","displayName":"Specify custom help link (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_externalprotocoldialogshowalwaysopencheckbox","displayName":"Show an \"Always open\" checkbox in external protocol dialog (User)","description":"This policy controls whether the \"Always allow this site to open links of this type\" checkbox is shown on external protocol launch confirmation prompts.\r\n\r\nIf you set this policy to True, when an external protocol confirmation prompt is shown, the user can select \"Always allow\" to skip all future confirmation prompts for the protocol on this site.\r\n\r\nIf you set this policy to False, the \"Always allow\" checkbox isn't displayed. The user will be prompted for confirmation every time an external protocol is invoked.\r\n\r\nIf this policy is unset, the checkbox visibility is controlled by the \"Enable remembering protocol launch prompting preferences\" flag in edge://flags","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_externalprotocoldialogshowalwaysopencheckbox_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_externalprotocoldialogshowalwaysopencheckbox_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_hstspolicybypasslist","displayName":"Configure the list of names that will bypass the HSTS policy check (User)","description":"Hostnames specified in this list will be exempt from the HSTS policy check that could potentially upgrade requests from \"http://\" to \"https://\". Only single-label hostnames are allowed in this policy. Hostnames must be canonicalized. Any IDNs must be converted to their A-label format, and all ASCII letters must be lowercase. This policy only applies to the specific hostnames specified; it doesn't apply to subdomains of the names in the list.\r\n\r\nExample value:\r\n\r\nmeet","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_hstspolicybypasslist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_hstspolicybypasslist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_hstspolicybypasslist_hstspolicybypasslistdesc","displayName":"Configure the list of names that will bypass the HSTS policy check (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_importopentabs","displayName":"Allow importing of open tabs (User)","description":"Allows users to import open and pinned tabs from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the **Open tabs** check box is automatically selected in the **Import browser data** dialog box.\r\n\r\nIf you disable this policy, open tabs aren't imported at first run, and users can't import them manually.\r\n\r\nIf you don't configure this policy, open tabs are imported at first run, and users can choose whether to import them manually during later browsing sessions.\r\n\r\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports open tabs on first run, but users can select or clear the **Open tabs** option during manual import.\r\n\r\n**Note**: This policy currently only supports importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_importopentabs_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_importopentabs_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_recommended_importopentabs_recommended","displayName":"Allow importing of open tabs (User)","description":"Allows users to import open and pinned tabs from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the **Open tabs** check box is automatically selected in the **Import browser data** dialog box.\r\n\r\nIf you disable this policy, open tabs aren't imported at first run, and users can't import them manually.\r\n\r\nIf you don't configure this policy, open tabs are imported at first run, and users can choose whether to import them manually during later browsing sessions.\r\n\r\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports open tabs on first run, but users can select or clear the **Open tabs** option during manual import.\r\n\r\n**Note**: This policy currently only supports importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_recommended_importopentabs_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_recommended_importopentabs_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_recommended~startup_recommended_newtabpagemanagedquicklinks_recommended","displayName":"Set new tab page quick links (User)","description":"By default, Microsoft Edge displays quick links on the new tab page from user-added shortcuts and top sites based on browsing history. With this policy, you can configure up to three quick link tiles on the new tab page, expressed as a JSON object:\r\n\r\n[ { \"url\": \"https://www.contoso.com\", \"title\": \"Contoso Portal\", \"pinned\": true/false }, ... ]\r\n\r\nThe 'url' field is required; 'title' and 'pinned' are optional. If 'title' is not provided, the URL is used as the default title. If 'pinned' is not provided, the default value is false.\r\n\r\nMicrosoft Edge presents these in the order listed, from left to right, with all pinned tiles displayed ahead of non-pinned tiles.\r\n\r\nIf the policy is set as mandatory, the 'pinned' field will be ignored and all tiles will be pinned. The tiles can't be deleted by the user and will always appear at the front of the quick links list.\r\n\r\nIf the policy is set as recommended, pinned tiles will remain in the list but the user has the ability to edit and delete them. Quick link tiles that aren't pinned behave like default top sites and are pushed off the list if other websites are visited more frequently. When applying non-pinned links via this policy to an existing browser profile, the links may not appear at all, depending on how they rank compared to the user's browsing history.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"pinned\": true,\r\n \"title\": \"Contoso Portal\",\r\n \"url\": \"https://contoso.com\"\r\n },\r\n {\r\n \"title\": \"Fabrikam\",\r\n \"url\": \"https://fabrikam.com\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_recommended~startup_recommended_newtabpagemanagedquicklinks_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_recommended~startup_recommended_newtabpagemanagedquicklinks_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_recommended~startup_recommended_newtabpagemanagedquicklinks_recommended_newtabpagemanagedquicklinks","displayName":"Set new tab page quick links (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_recommended~startup_recommended_newtabpagesetfeedtype_recommended","displayName":"Configure the Microsoft Edge new tab page experience (User)","description":"Lets you choose either the Microsoft News or Office 365 feed experience for the new tab page.\r\n\r\nWhen you set this policy to Microsoft News feed experience (0), users will see the Microsoft News feed experience on the new tab page.\r\n\r\nWhen you set this policy to Office 365 feed experience (1), users with an Azure Active Directory browser sign-in will see the Office 365 feed experience on the new tab page.\r\n\r\nIf you disable or don't configure this policy:\r\n\r\n- Users with an Azure Active Directory browser sign-in are offered the Office 365 new tab page feed experience, as well as the standard new tab page feed experience.\r\n\r\n- Users without an Azure Active Directory browser sign-in will see the standard new tab page experience.\r\n\r\nIf you configure this policy *and* the 'NewTabPageLocation' (Configure the new tab page URL) policy, 'NewTabPageLocation' has precedence.\r\n\r\nDefault setting: Disabled or not configured.\r\n\r\n* 0 = Microsoft News feed experience\r\n\r\n* 1 = Office 365 feed experience","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_recommended~startup_recommended_newtabpagesetfeedtype_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_recommended~startup_recommended_newtabpagesetfeedtype_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_recommended~startup_recommended_newtabpagesetfeedtype_recommended_newtabpagesetfeedtype","displayName":"New tab page experience (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_recommended~startup_recommended_newtabpagesetfeedtype_recommended_newtabpagesetfeedtype_0","displayName":"Microsoft News feed experience","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_recommended~startup_recommended_newtabpagesetfeedtype_recommended_newtabpagesetfeedtype_1","displayName":"Office 365 feed experience","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_tabfreezingenabled","displayName":"Allow freezing of background tabs (User)","description":"Controls whether Microsoft Edge can freeze tabs that are in the background for at least 5 minutes.\r\n\r\nTab freezing reduces CPU, battery, and memory usage. Microsoft Edge uses heuristics to avoid freezing tabs that do useful work in the background, such as display notifications, play sound, and stream video.\r\n\r\nIf you enable or don't configure this policy, tabs that have been in the background for at least 5 minutes might be frozen.\r\n\r\nIf you disable this policy, no tabs will be frozen.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_tabfreezingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge_tabfreezingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge~startup_newtabpagecompanylogo","displayName":"Set new tab page company logo (deprecated) (User)","description":"DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.\r\n\r\nWe are deprecating this policy because it doesn't work as expected and recommend that it not be used.\r\n\r\nSpecifies the company logo to use on the new tab page in Microsoft Edge.\r\n\r\nThe policy should be configured as a string that expresses the logo(s) in JSON format. For example: { \"default_logo\": { \"url\": \"https://www.contoso.com/logo.png\", \"hash\": \"cd0aa9856147b6c5b4ff2b7dfee5da20aa38253099ef1b4a64aced233c9afe29\" }, \"light_logo\": { \"url\": \"https://www.contoso.com/light_logo.png\", \"hash\": \"517d286edb416bb2625ccfcba9de78296e90da8e32330d4c9c8275c4c1c33737\" } }\r\n\r\nYou configure this policy by specifying the URL from which Microsoft Edge can download the logo and its cryptographic hash (SHA-256), which is used to verify the integrity of the download. The logo must be in PNG or SVG format, and its file size must not exceed 16 MB. The logo is downloaded and cached, and it will be redownloaded whenever the URL or the hash changes. The URL must be accessible without any authentication.\r\n\r\nThe 'default_logo' is required and will be used when there's no background image. If 'light_logo' is provided, it will be used when the user's new tab page has a background image. We recommend a horizontal logo with a transparent background that is left-aligned and vertically centered. The logo should have a minimum height of 32 pixels and an aspect ratio from 1:1 to 4:1. The 'default_logo' should have proper contrast against a white/black background while the 'light_logo' should have proper contrast against a background image.\r\n\r\nIf you enable this policy, Microsoft Edge downloads and shows the specified logo(s) on the new tab page. Users can't override or hide the logo(s).\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will show no company logo or a Microsoft logo on the new tab page.\r\n\r\nFor help with determining the SHA-256 hash, see https://docs.microsoft.com/powershell/module/microsoft.powershell.utility/get-filehash.\r\n\r\nExample value:\r\n\r\n{\r\n \"light_logo\": {\r\n \"url\": \"https://www.contoso.com/light_logo.png\", \r\n \"hash\": \"517d286edb416bb2625ccfcba9de78296e90da8e32330d4c9c8275c4c1c33737\"\r\n }, \r\n \"default_logo\": {\r\n \"url\": \"https://www.contoso.com/logo.png\", \r\n \"hash\": \"cd0aa9856147b6c5b4ff2b7dfee5da20aa38253099ef1b4a64aced233c9afe29\"\r\n }\r\n}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge~startup_newtabpagecompanylogo_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge~startup_newtabpagecompanylogo_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge~startup_newtabpagecompanylogo_newtabpagecompanylogo","displayName":"New tab page company logo (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge~startup_newtabpagemanagedquicklinks","displayName":"Set new tab page quick links (User)","description":"By default, Microsoft Edge displays quick links on the new tab page from user-added shortcuts and top sites based on browsing history. With this policy, you can configure up to three quick link tiles on the new tab page, expressed as a JSON object:\r\n\r\n[ { \"url\": \"https://www.contoso.com\", \"title\": \"Contoso Portal\", \"pinned\": true/false }, ... ]\r\n\r\nThe 'url' field is required; 'title' and 'pinned' are optional. If 'title' is not provided, the URL is used as the default title. If 'pinned' is not provided, the default value is false.\r\n\r\nMicrosoft Edge presents these in the order listed, from left to right, with all pinned tiles displayed ahead of non-pinned tiles.\r\n\r\nIf the policy is set as mandatory, the 'pinned' field will be ignored and all tiles will be pinned. The tiles can't be deleted by the user and will always appear at the front of the quick links list.\r\n\r\nIf the policy is set as recommended, pinned tiles will remain in the list but the user has the ability to edit and delete them. Quick link tiles that aren't pinned behave like default top sites and are pushed off the list if other websites are visited more frequently. When applying non-pinned links via this policy to an existing browser profile, the links may not appear at all, depending on how they rank compared to the user's browsing history.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"pinned\": true,\r\n \"title\": \"Contoso Portal\",\r\n \"url\": \"https://contoso.com\"\r\n },\r\n {\r\n \"title\": \"Fabrikam\",\r\n \"url\": \"https://fabrikam.com\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge~startup_newtabpagemanagedquicklinks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge~startup_newtabpagemanagedquicklinks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge~startup_newtabpagemanagedquicklinks_newtabpagemanagedquicklinks","displayName":"Set new tab page quick links (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge~startup_newtabpagesetfeedtype","displayName":"Configure the Microsoft Edge new tab page experience (User)","description":"Lets you choose either the Microsoft News or Office 365 feed experience for the new tab page.\r\n\r\nWhen you set this policy to Microsoft News feed experience (0), users will see the Microsoft News feed experience on the new tab page.\r\n\r\nWhen you set this policy to Office 365 feed experience (1), users with an Azure Active Directory browser sign-in will see the Office 365 feed experience on the new tab page.\r\n\r\nIf you disable or don't configure this policy:\r\n\r\n- Users with an Azure Active Directory browser sign-in are offered the Office 365 new tab page feed experience, as well as the standard new tab page feed experience.\r\n\r\n- Users without an Azure Active Directory browser sign-in will see the standard new tab page experience.\r\n\r\nIf you configure this policy *and* the 'NewTabPageLocation' (Configure the new tab page URL) policy, 'NewTabPageLocation' has precedence.\r\n\r\nDefault setting: Disabled or not configured.\r\n\r\n* 0 = Microsoft News feed experience\r\n\r\n* 1 = Office 365 feed experience","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge~startup_newtabpagesetfeedtype_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge~startup_newtabpagesetfeedtype_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge~startup_newtabpagesetfeedtype_newtabpagesetfeedtype","displayName":"New tab page experience (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge~startup_newtabpagesetfeedtype_newtabpagesetfeedtype_0","displayName":"Microsoft News feed experience","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev79diff~policy~microsoft_edge~startup_newtabpagesetfeedtype_newtabpagesetfeedtype_1","displayName":"Office 365 feed experience","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_alternateerrorpagesenabled","displayName":"Suggest similar pages when a webpage can’t be found (User)","description":"Allow Microsoft Edge to issue a connection to a web service to generate URL and search suggestions for connectivity issues such as DNS errors.\r\n\r\nIf you enable this policy, a web service is used to generate url and search suggestions for network errors.\r\n\r\nIf you disable this policy, no calls to the web service are made and a standard error page is shown.\r\n\r\nIf you don't configure this policy, Microsoft Edge respects the user preference that's set under Services at edge://settings/privacy.\r\nSpecifically, there's a **Suggest similar pages when a webpage can’t be found** toggle, which the user can switch on or off. Note that if you have enable this policy (AlternateErrorPagesEnabled), the Suggest similar pages when a webpage can’t be found setting is turned on, but the user can't change the setting by using the toggle. If you disable this policy, the Suggest similar pages when a webpage can’t be found setting is turned off, and the user can't change the setting by using the toggle.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_alternateerrorpagesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_alternateerrorpagesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_dnsinterceptionchecksenabled","displayName":"DNS interception checks enabled (User)","description":"This policy configures a local switch that can be used to disable DNS interception checks. These checks attempt to discover whether the browser is behind a proxy that redirects unknown host names.\r\n\r\nThis detection might not be necessary in an enterprise environment where the network configuration is known. It can be disabled to avoid additional DNS and HTTP traffic on start-up and each DNS configuration change.\r\n\r\nIf you enable or don’t set this policy, the DNS interception checks are performed.\r\n\r\nIf you disable this policy, DNS interception checks aren’t performed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_dnsinterceptionchecksenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_dnsinterceptionchecksenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_hidefirstrunexperience","displayName":"Hide the First-run experience and splash screen (User)","description":"If you enable this policy, the First-run experience and the splash screen will not be shown to users when they run Microsoft Edge for the first time.\r\n\r\nFor the configuration options shown in the First Run Experience, the browser will default to the following:\r\n\r\n-On the New Tab Page, the feed type will be set to MSN News and the layout to Inspirational.\r\n\r\n-The user will still be automatically signed into Microsoft Edge if the Windows account is of Azure AD or MSA type.\r\n\r\n-Sync will not be enabled by default and users will be able to turn on sync from the sync settings.\r\n\r\nIf you disable or don't configure this policy, the First-run experience and the Splash screen will be shown.\r\n\r\nNote: The specific configuration options shown to the user in the First Run Experience, can also be managed by using other specific policies. You can use the HideFirstRunExperience policy in combination with these policies to configure a specific browser experience on your managed devices. Some of these other policies are:\r\n\r\n-'AutoImportAtFirstRun' (Automatically import another browser's data and settings at first run)\r\n\r\n-'NewTabPageLocation' (Configure the new tab page URL)\r\n\r\n-'NewTabPageSetFeedType' (Configure the Microsoft Edge new tab page experience)\r\n\r\n-'SyncDisabled' (Disable synchronization of data using Microsoft sync services)\r\n\r\n-'BrowserSignin' (Browser sign-in settings)\r\n\r\n-'NonRemovableProfileEnabled' (Configure whether a user always has a default profile automatically signed in with their work or school account)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_hidefirstrunexperience_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_hidefirstrunexperience_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_paymentmethodqueryenabled","displayName":"Allow websites to query for available payment methods (User)","description":"Allows you to set whether websites can check if the user has payment methods saved.\r\n\r\nIf you disable this policy, websites that use PaymentRequest.canMakePayment or PaymentRequest.hasEnrolledInstrument API will be informed that no payment methods are available.\r\n\r\nIf you enable this policy or don't set this policy, websites can check if the user has payment methods saved.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_paymentmethodqueryenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_paymentmethodqueryenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_personalizationreportingenabled","displayName":"Allow personalization of ads, search and news by sending browsing history to Microsoft (User)","description":"This policy prevents Microsoft from collecting a user's Microsoft Edge browsing history to be used for personalizing advertising, search, news and other Microsoft services.\r\n\r\nThis setting is only available for users with a Microsoft account. This setting is not available for child accounts or enterprise accounts.\r\n\r\nIf you disable this policy, users can't change or override the setting. If this policy is enabled or not configured, Microsoft Edge will default to the user’s preference.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_personalizationreportingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_personalizationreportingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_pinningwizardallowed","displayName":"Allow Pin to taskbar wizard (User)","description":"Microsoft Edge uses the Pin to taskbar wizard to help users pin suggested sites to the taskbar. The Pin to taskbar wizard feature is enabled by default and accessible to the user through the Settings and more menu.\r\n\r\nIf you enable this policy or don't configure it, users can call the Pin to taskbar wizard from the Settings and More menu. The wizard can also be called via a protocol launch.\r\n\r\nIf you disable this policy, the Pin to taskbar wizard is disabled in the menu and cannot be called via a protocol launch.\r\n\r\nUser settings to enable or disable the Pin to taskbar wizard aren't available.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_pinningwizardallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_pinningwizardallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_recommended_alternateerrorpagesenabled_recommended","displayName":"Suggest similar pages when a webpage can’t be found (User)","description":"Allow Microsoft Edge to issue a connection to a web service to generate URL and search suggestions for connectivity issues such as DNS errors.\r\n\r\nIf you enable this policy, a web service is used to generate url and search suggestions for network errors.\r\n\r\nIf you disable this policy, no calls to the web service are made and a standard error page is shown.\r\n\r\nIf you don't configure this policy, Microsoft Edge respects the user preference that's set under Services at edge://settings/privacy.\r\nSpecifically, there's a **Suggest similar pages when a webpage can’t be found** toggle, which the user can switch on or off. Note that if you have enable this policy (AlternateErrorPagesEnabled), the Suggest similar pages when a webpage can’t be found setting is turned on, but the user can't change the setting by using the toggle. If you disable this policy, the Suggest similar pages when a webpage can’t be found setting is turned off, and the user can't change the setting by using the toggle.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_recommended_alternateerrorpagesenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_recommended_alternateerrorpagesenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_recommended~smartscreen_recommended_smartscreenpuaenabled_recommended","displayName":"Configure Microsoft Defender SmartScreen to block potentially unwanted apps (User)","description":"This policy setting lets you configure whether to turn on blocking for potentially unwanted apps with Microsoft Defender SmartScreen. Potentially unwanted app blocking with Microsoft Defender SmartScreen provides warning messages to help protect users from adware, coin miners, bundleware, and other low-reputation apps that are hosted by websites. Potentially unwanted app blocking with Microsoft Defender SmartScreen is turned off by default.\r\n\r\nIf you enable this setting, potentially unwanted app blocking with Microsoft Defender SmartScreen is turned on.\r\n\r\nIf you disable this setting, potentially unwanted app blocking with Microsoft Defender SmartScreen is turned off.\r\n\r\nIf you don't configure this setting, users can choose whether to use potentially unwanted app blocking with Microsoft Defender SmartScreen.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_recommended~smartscreen_recommended_smartscreenpuaenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_recommended~smartscreen_recommended_smartscreenpuaenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_totalmemorylimitmb","displayName":"Set limit on megabytes of memory a single Microsoft Edge instance can use. (User)","description":"Configures the amount of memory that a single Microsoft Edge instance can use before tabs start getting discarded to save memory. The memory used by the tab will be freed and the tab will have to be reloaded when switched to.\r\n\r\nIf you enable this policy, the browser will start to discard tabs to save memory once the limitation is exceeded. However, there is no guarantee that the browser is always running under the limit. Any value under 1024 will be rounded up to 1024.\r\n\r\nIf you don't set this policy, the browser will only attempt to save memory when it has detected that the amount of physical memory on its machine is low.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_totalmemorylimitmb_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_totalmemorylimitmb_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_totalmemorylimitmb_totalmemorylimitmb","displayName":"Set memory limit for Microsoft Edge instances: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_webappinstallforcelist","displayName":"Configure list of force-installed Web Apps (User)","description":"Specifies a list of websites that are installed silently, without user interaction, and which can't be uninstalled or disabled by the user.\r\n\r\nEach list item of the policy is an object with the following members:\r\n - \"url\", which is mandatory. \"url\" should be the URL of the web app to install.\r\n\r\nValues for the optional members are:\r\n - \"launch_container\" should be either \"window\" or \"tab\" to indicate how the Web App will be opened after it's installed.\r\n - \"create_desktop_shortcut\" should be true if a desktop shortcut should be created on Windows.\r\n\r\nIf \"default_launch_container\" is omitted, the app will open in a tab by default. Regardless of the value of \"default_launch_container\", users can change which container the app will open in. If \"create_desktop_shortcuts\" is omitted, no desktop shortcuts will be created.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"url\": \"https://www.contoso.com/maps\", \r\n \"create_desktop_shortcut\": true, \r\n \"default_launch_container\": \"window\"\r\n }, \r\n {\r\n \"url\": \"https://app.contoso.edu\", \r\n \"default_launch_container\": \"tab\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_webappinstallforcelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_webappinstallforcelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_webappinstallforcelist_webappinstallforcelist","displayName":"URLs for Web Apps to be silently installed. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_webcomponentsv0enabled","displayName":"Re-enable Web Components v0 API until M84. (deprecated) (User)","description":"DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.\r\n\r\nThe Web Components v0 APIs (Shadow DOM v0, Custom Elements v0, and HTML Imports) were deprecated in 2018, and have been disabled by default starting in M80. This policy allows these features to be selectively re-enabled until M84.\r\n\r\n If you set this policy is set to True, the Web Components v0 features will be enabled for all sites.\r\n\r\n If you set this policy to False or don't set this policy, the Web Components v0 features will be disabled by default, starting in M80.\r\n\r\n This policy will be removed after Microsoft Edge 84.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_webcomponentsv0enabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_webcomponentsv0enabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_webrtclocalipsallowedurls","displayName":"Manage exposure of local IP addressess by WebRTC (User)","description":"Specifies a list of origins (URLs) or hostname patterns (like \"*contoso.com*\") for which local IP address should be exposed by WebRTC.\r\n\r\nIf you enable this policy and set a list of origins (URLs) or hostname patterns, when edge://flags/#enable-webrtc-hide-local-ips-with-mdns is Enabled, WebRTC will expose the local IP address for cases that match patterns in the list.\r\n\r\nIf you disable or don't configure this policy, and edge://flags/#enable-webrtc-hide-local-ips-with-mdns is Enabled, WebRTC will not expose local IP addresses. The local IP address is concealed with an mDNS hostname.\r\n\r\nIf you enable, disable, or don't configure this policy, and edge://flags/#enable-webrtc-hide-local-ips-with-mdns is Disabled, WebRTC will expose local IP addresses.\r\n\r\nPlease note that this policy weakens the protection of local IP addresses that might be needed by administrators.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n*contoso.com*","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_webrtclocalipsallowedurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_webrtclocalipsallowedurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge_webrtclocalipsallowedurls_webrtclocalipsallowedurlsdesc","displayName":"Manage exposure of local IP addressess by WebRTC (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_defaultinsecurecontentsetting","displayName":"Control use of insecure content exceptions (User)","description":"Allows you to set whether users can add exceptions to allow mixed content for specific sites.\r\n\r\nThis policy can be overridden for specific URL patterns using the 'InsecureContentAllowedForUrls' (Allow insecure content on specified sites) and 'InsecureContentBlockedForUrls' (Block insecure content on specified sites) policies.\r\n\r\nIf this policy isn't set, users will be allowed to add exceptions to allow blockable mixed content and disable autoupgrades for optionally blockable mixed content.\r\n\r\n* 2 = Do not allow any site to load blockable mixed content\r\n\r\n* 3 = Allow users to add exceptions to allow blockable mixed content","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_defaultinsecurecontentsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_defaultinsecurecontentsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_defaultinsecurecontentsetting_defaultinsecurecontentsetting","displayName":"Control use of insecure content exceptions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_defaultinsecurecontentsetting_defaultinsecurecontentsetting_2","displayName":"Do not allow any site to load blockable mixed content","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_defaultinsecurecontentsetting_defaultinsecurecontentsetting_3","displayName":"Allow users to add exceptions to allow blockable mixed content","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_insecurecontentallowedforurls","displayName":"Allow insecure content on specified sites (User)","description":"Create a list of URL patterns to specify sites that can display insecure mixed content (that is, HTTP content on HTTPS sites).\r\n\r\nIf you don't configure this policy, blockable mixed content will be blocked and optionally blockable mixed content will be upgraded. However, users will be allowed to set exceptions to allow insecure mixed content for specific sites.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_insecurecontentallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_insecurecontentallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_insecurecontentallowedforurls_insecurecontentallowedforurlsdesc","displayName":"Allow insecure content on specified sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_insecurecontentblockedforurls","displayName":"Block insecure content on specified sites (User)","description":"Create a list of URL patterns to specify sites that aren't allowed to display blockable (i.e. active) mixed content (that is, HTTP content on HTTPS sites) and for which optionally blockable mixed content upgrades will be disabled.\r\n\r\nIf you don't configure this policy, blockable mixed content will be blocked and optionally blockable mixed content will be upgraded. However, users will be allowed to set exceptions to allow insecure mixed content for specific sites.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_insecurecontentblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_insecurecontentblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_insecurecontentblockedforurls_insecurecontentblockedforurlsdesc","displayName":"Block insecure content on specified sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_legacysamesitecookiebehaviorenabled","displayName":"Enable default legacy SameSite cookie behavior setting (obsolete) (User)","description":"Lets you revert all cookies to legacy SameSite behavior. Reverting to legacy behavior causes cookies that don't specify a SameSite attribute to be treated as if they were \"SameSite=None\", and removes the requirement for \"SameSite=None\" cookies to carry the \"Secure\" attribute.\r\n\r\nYou can set the following values for this policy:\r\n\r\n* 1 = Revert to legacy SameSite behavior for cookies on all sites\r\n\r\n* 2 = Use SameSite-by-default behavior for cookies on all sites\r\n\r\nIf you don't set this policy, the default behavior for cookies that don't specify a SameSite attribute will depend on other configuration sources for the SameSite-by-default feature. This feature might be set by a field trial or by enabling the same-site-by-default-cookies flag in edge://flags.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_legacysamesitecookiebehaviorenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_legacysamesitecookiebehaviorenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_legacysamesitecookiebehaviorenabled_legacysamesitecookiebehaviorenabled","displayName":"Enable default legacy SameSite cookie behavior setting (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_legacysamesitecookiebehaviorenabled_legacysamesitecookiebehaviorenabled_1","displayName":"Revert to legacy SameSite behavior for cookies on all sites","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_legacysamesitecookiebehaviorenabled_legacysamesitecookiebehaviorenabled_2","displayName":"Use SameSite-by-default behavior for cookies on all sites","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_legacysamesitecookiebehaviorenabledfordomainlist","displayName":"Revert to legacy SameSite behavior for cookies on specified sites (obsolete) (User)","description":"Cookies set for domains match specified patterns will revert to legacy SameSite behavior.\r\n\r\nReverting to legacy behavior causes cookies that don't specify a SameSite attribute to be treated as if they were \"SameSite=None\", and removes the requirement for \"SameSite=None\" cookies to carry the \"Secure\" attribute.\r\n\r\nIf you don't set this policy, the global default value will be used. The global default will also be used for cookies on domains not covered by the patterns you specify.\r\n\r\nThe global default value can be configured using the 'LegacySameSiteCookieBehaviorEnabled' (Enable default legacy SameSite cookie behavior setting) policy. If 'LegacySameSiteCookieBehaviorEnabled' is unset, the global default value falls back to other configuration sources.\r\n\r\nNote that patterns you list in this policy are treated as domains, not URLs, so you should not specify a scheme or port.\r\n\r\nExample value:\r\n\r\nwww.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_legacysamesitecookiebehaviorenabledfordomainlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_legacysamesitecookiebehaviorenabledfordomainlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~contentsettings_legacysamesitecookiebehaviorenabledfordomainlist_legacysamesitecookiebehaviorenabledfordomainlistdesc","displayName":"Revert to legacy SameSite behavior for cookies on specified sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~smartscreen_smartscreenpuaenabled","displayName":"Configure Microsoft Defender SmartScreen to block potentially unwanted apps (User)","description":"This policy setting lets you configure whether to turn on blocking for potentially unwanted apps with Microsoft Defender SmartScreen. Potentially unwanted app blocking with Microsoft Defender SmartScreen provides warning messages to help protect users from adware, coin miners, bundleware, and other low-reputation apps that are hosted by websites. Potentially unwanted app blocking with Microsoft Defender SmartScreen is turned off by default.\r\n\r\nIf you enable this setting, potentially unwanted app blocking with Microsoft Defender SmartScreen is turned on.\r\n\r\nIf you disable this setting, potentially unwanted app blocking with Microsoft Defender SmartScreen is turned off.\r\n\r\nIf you don't configure this setting, users can choose whether to use potentially unwanted app blocking with Microsoft Defender SmartScreen.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~smartscreen_smartscreenpuaenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev80diff~policy~microsoft_edge~smartscreen_smartscreenpuaenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_addressbarmicrosoftsearchinbingproviderenabled","displayName":"Enable Microsoft Search in Bing suggestions in the address bar (User)","description":"Enables the display of relevant Microsoft Search in Bing suggestions in the address bar's suggestion list when the user types a search string in the address bar. If you enable or don't configure this policy, users can see internal results powered by Microsoft Search in Bing in the Microsoft Edge address bar suggestion list. To see the Microsoft Search in Bing results, the user must be signed into Microsoft Edge with their Azure AD account for that organization.\r\nIf you disable this policy, users can't see internal results in the Microsoft Edge address bar suggestion list.\r\nIf you have enabled the set of policies which forces a default search provider ('DefaultSearchProviderEnabled' (Enable the default search provider), 'DefaultSearchProviderName' (Default search provider name) and 'DefaultSearchProviderSearchURL' (Default search provider search URL)), and the search provider specified is not Bing, then this policy is not applicable and there will be no Microsoft Search in Bing suggestions in the address bar's suggestion list.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_addressbarmicrosoftsearchinbingproviderenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_addressbarmicrosoftsearchinbingproviderenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_ambientauthenticationinprivatemodesenabled","displayName":"Enable Ambient Authentication for InPrivate and Guest profiles (User)","description":"Configure this policy to allow/disallow ambient authentication for InPrivate and Guest profiles in Microsoft Edge.\r\n\r\nAmbient Authentication is http authentication with default credentials when explicit credentials aren't provided via NTLM/Kerberos/Negotiate challenge/response schemes.\r\n\r\nIf you set the policy to RegularOnly (value 0), it allows ambient authentication for Regular sessions only. InPrivate and Guest sessions won't be allowed to ambiently authenticate.\r\n\r\nIf you set the policy to InPrivateAndRegular (value 1), it allows ambient authentication for InPrivate and Regular sessions. Guest sessions won't be allowed to ambiently authenticate.\r\n\r\nIf you set the policy to GuestAndRegular (value 2), it allows ambient authentication for Guest and Regular sessions. InPrivate sessions won't be allowed to ambiently authenticate\r\n\r\nIf you set the policy to All (value 3), it allows ambient authentication for all sessions.\r\n\r\nNote that ambient authentication is always allowed on regular profiles.\r\n\r\nIn Microsoft Edge version 81 and later, if the policy is left not set, ambient authentication will be enabled in regular sessions only.\r\n\r\n* 0 = Enable ambient authentication in regular sessions only\r\n\r\n* 1 = Enable ambient authentication in InPrivate and regular sessions\r\n\r\n* 2 = Enable ambient authentication in guest and regular sessions\r\n\r\n* 3 = Enable ambient authentication in regular, InPrivate and guest sessions","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_ambientauthenticationinprivatemodesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_ambientauthenticationinprivatemodesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_ambientauthenticationinprivatemodesenabled_ambientauthenticationinprivatemodesenabled","displayName":"Enable Ambient Authentication for InPrivate and Guest profiles (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_ambientauthenticationinprivatemodesenabled_ambientauthenticationinprivatemodesenabled_0","displayName":"Enable ambient authentication in regular sessions only","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_ambientauthenticationinprivatemodesenabled_ambientauthenticationinprivatemodesenabled_1","displayName":"Enable ambient authentication in InPrivate and regular sessions","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_ambientauthenticationinprivatemodesenabled_ambientauthenticationinprivatemodesenabled_2","displayName":"Enable ambient authentication in guest and regular sessions","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_ambientauthenticationinprivatemodesenabled_ambientauthenticationinprivatemodesenabled_3","displayName":"Enable ambient authentication in regular, InPrivate and guest sessions","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_audiosandboxenabled","displayName":"Allow the audio sandbox to run (User)","description":"This policy controls the audio process sandbox.\r\n\r\nIf you enable this policy, the audio process will run sandboxed.\r\n\r\nIf you disable this policy, the audio process will run unsandboxed and the WebRTC audio-processing module will run in the renderer process.\r\nThis leaves users open to security risks related to running the audio subsystem unsandboxed.\r\n\r\nIf you don't configure this policy, the default configuration for the audio sandbox will be used, which might differ based on the platform.\r\n\r\nThis policy is intended to give enterprises flexibility to disable the audio sandbox if they use security software setups that interfere with the sandbox.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_audiosandboxenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_audiosandboxenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_configureonpremisesaccountautosignin","displayName":"Configure automatic sign in with an Active Directory domain account when there is no Azure AD domain account (User)","description":"Enable the use of Active Directory accounts for automatic sign in if your users' machines are Domain Joined and your environment is not hybrid joined. If you want users automatically signed in with their Azure Active Directory accounts instead, please Azure AD join (See https://go.microsoft.com/fwlink/?linkid=2118197 for more information) or hybrid join (See https://go.microsoft.com/fwlink/?linkid=2118365 for more information) your environment.\r\n\r\nIf you have configured the 'BrowserSignin' (Browser sign-in settings) policy to disabled, this policy will not take any effect.\r\n\r\nIf you enable this policy and set it to \"Sign in and make domain account non-removable\", Microsoft Edge will automatically sign in users that are on domain joined machines using their Active Directory accounts.\r\n\r\nIf you set this policy to \"Disabled\" or don't set it, Microsoft Edge will not automatically sign in users that are on domain joined machines with Active Directory accounts.\r\n\r\n* 0 = Disabled\r\n\r\n* 1 = Sign in and make domain account non-removable","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_configureonpremisesaccountautosignin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_configureonpremisesaccountautosignin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_configureonpremisesaccountautosignin_configureonpremisesaccountautosignin","displayName":"Configure automatic sign in with an Active Directory domain account when there is no Azure AD domain account (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_configureonpremisesaccountautosignin_configureonpremisesaccountautosignin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_configureonpremisesaccountautosignin_configureonpremisesaccountautosignin_1","displayName":"Sign in and make domain account non-removable","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_forcelegacydefaultreferrerpolicy","displayName":"Use a default referrer policy of no-referrer-when-downgrade. (deprecated) (User)","description":"DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.\r\n\r\nThis enterprise policy is for short-term adaptation and will be removed in M83.\r\n\r\nMicrosoft Edge’s default referrer policy is being strengthened from its current value of no-referrer-when-downgrade to the more secure strict-origin-when-cross-origin through a gradual rollout targeting M80 stable.\r\n\r\nBefore the rollout, this enterprise policy will have no effect. After the rollout, when this enterprise policy is enabled, Microsoft Edge’s default referrer policy will be set to its pre-M80 value of no-referrer-when-downgrade.\r\n\r\nThis enterprise policy is disabled by default","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_forcelegacydefaultreferrerpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_forcelegacydefaultreferrerpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_globallyscopehttpauthcacheenabled","displayName":"Enable globally scoped HTTP auth cache (User)","description":"This policy configures a single global per profile cache with HTTP server authentication credentials.\r\n\r\nIf you disable or don’t set this policy, the browser will use the default behavior of cross-site auth, which as of version 80, will be to scope HTTP server authentication credentials by top-level site. So, if two sites use resources from the same authenticating domain, credentials will need to be provided independently in the context of both sites. Cached proxy credentials will be reused across sites.\r\n\r\nIf you enable this policy HTTP auth credentials entered in the context of one site will automatically be used in the context of another site.\r\n\r\nEnabling this policy leaves sites open to some types of cross-site attacks, and allows users to be tracked across sites even without cookies by adding entries to the HTTP auth cache using credentials embedded in URLs.\r\n\r\nThis policy is intended to give enterprises depending on the legacy behavior a chance to update their login procedures and will be removed in the future.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_globallyscopehttpauthcacheenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_globallyscopehttpauthcacheenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_importcookies","displayName":"Allow importing of Cookies (User)","description":"Allows users to import Cookies from another browser into Microsoft Edge.\r\n\r\nIf you disable this policy, Cookies aren't imported on first run.\r\n\r\nIf you don’t configure this policy, Cookies are imported on first run.\r\n\r\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports Cookies on first run.\r\n\r\n**Note**: This policy currently manages importing Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_importcookies_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_importcookies_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_importextensions","displayName":"Allow importing of extensions (User)","description":"Allows users to import extensions from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the **Extensions** check box is automatically selected in the **Import browser data** dialog box.\r\n\r\nIf you disable this policy, extensions aren't imported at first run, and users can't import them manually.\r\n\r\nIf you don't configure this policy, extensions are imported at first run, and users can choose whether to import them manually during later browsing sessions.\r\n\r\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports extensions on first run, but users can select or clear the **extensions** option during manual import.\r\n\r\n**Note**: This policy currently only supports importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_importextensions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_importextensions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_importshortcuts","displayName":"Allow importing of shortcuts (User)","description":"Allows users to import Shortcuts from another browser into Microsoft Edge.\r\n\r\nIf you disable this policy, Shortcuts aren't imported on first run.\r\n\r\nIf you don’t configure this policy, Shortcuts are imported on first run.\r\n\r\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports Shortcuts on first run.\r\n\r\n**Note**: This policy currently manages importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_importshortcuts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_importshortcuts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_internetexplorerintegrationsiteredirect","displayName":"Specify how \"in-page\" navigations to unconfigured sites behave when started from Internet Explorer mode pages (User)","description":"An \"in-page\" navigation is started from a link, a script, or a form on the current page. It can also be a server-side redirect of a previous \"in-page\" navigation attempt. Conversely, a user can start a navigation that isn't \"in-page\" that's independent of the current page in several ways by using the browser controls. For example, using the address bar, the back button, or a favorite link.\r\n\r\nThis setting lets you specify whether navigations from pages loaded in Internet Explorer mode to unconfigured sites (that are not configured in the Enterprise Mode Site List) switch back to Microsoft Edge or remain in Internet Explorer mode.\r\n\r\nThis setting works in conjunction with:\r\n'InternetExplorerIntegrationLevel' (Configure Internet Explorer integration) is set to \"Internet Explorer mode\" (1)\r\nand\r\n'InternetExplorerIntegrationSiteList' (Configure the Enterprise Mode Site List) policy where the list has at least one entry.\r\n\r\nIf you disable or don’t configure this policy, only sites configured to open in Internet Explorer mode will open in that mode. Any site not configured to open in Internet Explorer mode will be redirected back to Microsoft Edge.\r\n\r\nIf you set this policy to Default (value 0), only sites configured to open in Internet Explorer mode will open in that mode. Any site not configured to open in Internet Explorer mode will be redirected back to Microsoft Edge.\r\n\r\nIf you set this policy to AutomaticNavigationsOnly (value 1), you get the default experience except that all automatic navigations (such as 302 redirects) to unconfigured sites will be kept in Internet Explorer mode.\r\n\r\nIf you set this policy to AllInPageNavigations (value 2), all navigations from pages loaded in IE mode to unconfigured sites are kept in Internet Explorer mode (Least Recommended).\r\n\r\nIf you enable this policy, you can choose one of the following navigation options:\r\n\r\n* 0 = Default\r\n\r\n* 1 = Keep only automatic navigations in Internet Explorer mode\r\n\r\n* 2 = Keep all in-page navigations in Internet Explorer mode\r\n\r\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2105106","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_internetexplorerintegrationsiteredirect_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_internetexplorerintegrationsiteredirect_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_internetexplorerintegrationsiteredirect_internetexplorerintegrationsiteredirect","displayName":"Specify how \"in-page\" navigations to unconfigured sites behave when started from Internet Explorer mode pages (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_internetexplorerintegrationsiteredirect_internetexplorerintegrationsiteredirect_0","displayName":"Default","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_internetexplorerintegrationsiteredirect_internetexplorerintegrationsiteredirect_1","displayName":"Keep only automatic navigations in Internet Explorer mode","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_internetexplorerintegrationsiteredirect_internetexplorerintegrationsiteredirect_2","displayName":"Keep all in-page navigations in Internet Explorer mode","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_recommended_importcookies_recommended","displayName":"Allow importing of Cookies (User)","description":"Allows users to import Cookies from another browser into Microsoft Edge.\r\n\r\nIf you disable this policy, Cookies aren't imported on first run.\r\n\r\nIf you don’t configure this policy, Cookies are imported on first run.\r\n\r\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports Cookies on first run.\r\n\r\n**Note**: This policy currently manages importing Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_recommended_importcookies_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_recommended_importcookies_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_recommended_importextensions_recommended","displayName":"Allow importing of extensions (User)","description":"Allows users to import extensions from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the **Extensions** check box is automatically selected in the **Import browser data** dialog box.\r\n\r\nIf you disable this policy, extensions aren't imported at first run, and users can't import them manually.\r\n\r\nIf you don't configure this policy, extensions are imported at first run, and users can choose whether to import them manually during later browsing sessions.\r\n\r\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports extensions on first run, but users can select or clear the **extensions** option during manual import.\r\n\r\n**Note**: This policy currently only supports importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_recommended_importextensions_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_recommended_importextensions_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_recommended_importshortcuts_recommended","displayName":"Allow importing of shortcuts (User)","description":"Allows users to import Shortcuts from another browser into Microsoft Edge.\r\n\r\nIf you disable this policy, Shortcuts aren't imported on first run.\r\n\r\nIf you don’t configure this policy, Shortcuts are imported on first run.\r\n\r\nYou can also set this policy as a recommendation. This means that Microsoft Edge imports Shortcuts on first run.\r\n\r\n**Note**: This policy currently manages importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_recommended_importshortcuts_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_recommended_importshortcuts_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_strictermixedcontenttreatmentenabled","displayName":"Enable stricter treatment for mixed content (User)","description":"This policy controls the treatment for mixed content (HTTP content in HTTPS sites) in the browser.\r\n\r\nIf you set this policy to true or not set, audio and video mixed content will be automatically upgraded to HTTPS (that is, the URL will be rewritten as HTTPS, without a fallback if the resource isn’t available over HTTPS) and a 'Not Secure' warning will be shown in the URL bar for image mixed content.\r\n\r\nIf you set the policy to false, auto upgrades will be disabled for audio and video, and no warning will be shown for images.\r\n\r\nThis policy does not affect other types of mixed content other than audio, video, and images.\r\n\r\nThis policy will no longer take effect starting in Microsoft Edge 84.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_strictermixedcontenttreatmentenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_strictermixedcontenttreatmentenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_tls13hardeningforlocalanchorsenabled","displayName":"Enable a TLS 1.3 security feature for local trust anchors. (User)","description":"This policy controls a security feature in TLS 1.3 that protects connections against downgrade attacks. It is backwards-compatible and will not affect connections to compliant TLS 1.2 servers or proxies. However, older versions of some TLS-intercepting proxies have an implementation flaw which causes them to be incompatible.\r\n\r\nIf you enable this policy or don't set it, Microsoft Edge will enable these security protections for all connections.\r\n\r\nIf you disable this policy, Microsoft Edge will disable these security protections for connections authenticated with locally-installed CA certificates. These protections are always enabled for connections authenticated with publicly-trusted CA certificates.\r\n\r\nThis policy may be used to test for any affected proxies and upgrade them. Affected proxies are expected to fail connections with an error code of ERR_TLS13_DOWNGRADE_DETECTED. A later version of Microsoft Edge will enable this option by default.\r\n\r\nAfter it is enabled by default, administrators who need more time to upgrade affected proxies may use this policy to temporarily disable this security feature. This policy will be removed after version 85.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_tls13hardeningforlocalanchorsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81diff~policy~microsoft_edge_tls13hardeningforlocalanchorsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev81identitydiff~policy~microsoft_edge_forcecertificatepromptsonmultiplematches","displayName":"Configure whether Microsoft Edge should automatically select a certificate when there are multiple certificate matches for a site configured with \"AutoSelectCertificateForUrls\" (User)","description":"Toggles whether users are prompted to select a certificate if there are multiple certificates available and a site is configured with 'AutoSelectCertificateForUrls' (Automatically select client certificates for these sites). If you don't configure 'AutoSelectCertificateForUrls' for a site, the user will always be prompted to select a certificate.\r\n\r\nIf you set this policy to True, Microsoft Edge will prompt a user to select a certificate for sites on the list defined in 'AutoSelectCertificateForUrls' if and only if there is more than one certificate.\r\n\r\nIf you set this policy to False or don't configure it, Microsoft Edge will automatically select a certificate even if there are multiple matches for a certificate. The user will not be prompted to select a certificate for sites on the list defined in 'AutoSelectCertificateForUrls'.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev81identitydiff~policy~microsoft_edge_forcecertificatepromptsonmultiplematches_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev81identitydiff~policy~microsoft_edge_forcecertificatepromptsonmultiplematches_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_allowsurfgame","displayName":"Allow surf game (User)","description":"If you disable this policy, users won't be able to play the surf game when the device is offline or if the user navigates to edge://surf.\r\n\r\nIf you enable or don't configure this policy, users can play the surf game.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_allowsurfgame_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_allowsurfgame_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_allowtokenbindingforurls","displayName":"Configure the list of sites for which Microsoft Edge will attempt to establish a Token Binding with. (User)","description":"Configure the list of URL patterns for sites that the browser will attempt to perform the Token Binding protocol with.\r\nFor the domains on this list, the browser will send the Token Binding ClientHello in the TLS handshake (See https://tools.ietf.org/html/rfc8472).\r\nIf the server responds with a valid ServerHello response, the browser will create and send Token Binding messages on subsequent https requests. See https://tools.ietf.org/html/rfc8471 for more info.\r\n\r\nIf this list is empty, Token Binding will be disabled.\r\n\r\nThis policy is only available on Windows 10 devices with Virtual Secure Mode capability.\r\n\r\nExample value:\r\n\r\nmydomain.com\r\n[*.]mydomain2.com\r\n[*.].mydomain2.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_allowtokenbindingforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_allowtokenbindingforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_allowtokenbindingforurls_allowtokenbindingforurlsdesc","displayName":"Configure the list of sites for which Microsoft Edge will attempt to establish a Token Binding with. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_bingadssuppression","displayName":"Block all ads on Bing search results (User)","description":"Enables an ad-free search experience on Bing.com\r\n\r\nIf you enable this policy, then a user can search on bing.com and have an ad-free search experience. At the same time, the SafeSearch setting will be set to 'Strict' and can't be changed by the user.\r\n\r\nIf you don't configure this policy, then the default experience will have ads in the search results on bing.com. SafeSearch will be set to 'Moderate' by default and can be changed by the user.\r\n\r\nThis policy is only available for K-12 SKUs that are identified as EDU tenants by Microsoft.\r\n\r\nPlease refer to https://go.microsoft.com/fwlink/?linkid=2119711 to learn more about this policy or if the following scenarios apply to you:\r\n\r\n* You have an EDU tenant, but the policy doesn't work.\r\n\r\n* You had your IP whitelisted for having an ad free search experience.\r\n\r\n* You were experiencing an ad-free search experience on Microsoft Edge Legacy and want to upgrade to the new version of Microsoft Edge.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_bingadssuppression_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_bingadssuppression_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_clearcachedimagesandfilesonexit","displayName":"Clear cached images and files when Microsoft Edge closes (User)","description":"Microsoft Edge doesn't clear cached images and files by default when it closes.\r\n\r\nIf you enable this policy, cached images and files will be deleted each time Microsoft Edge closes.\r\n\r\nIf you disable this policy, users cannot configure the cached images and files option in edge://settings/clearBrowsingDataOnClose.\r\n\r\nIf you don't configure this policy, users can choose whether cached images and files are cleared on exit.\r\n\r\nIf you disable this policy, don't enable the 'ClearBrowsingDataOnExit' (Clear browsing data when Microsoft Edge closes) policy, because they both deal with deleting data. If you configure both, the 'ClearBrowsingDataOnExit' policy takes precedence and deletes all data when Microsoft Edge closes, regardless of how you configured 'ClearCachedImagesAndFilesOnExit' (Clear cached images and files when Microsoft Edge closes).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_clearcachedimagesandfilesonexit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_clearcachedimagesandfilesonexit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_configureshare","displayName":"Configure the Share experience (User)","description":"If you set this policy to 'ShareAllowed' (0, the default), users will be able to access the Windows 10 Share experience from the Settings and More Menu in Microsoft Edge to share with other apps on the system.\r\n\r\nIf you set this policy to 'ShareDisallowed' (1), users won't be able to access the Windows 10 Share experience. If the Share button is on the toolbar, it will also be hidden.\r\n\r\n* 0 = Allow using the Share experience\r\n\r\n* 1 = Don't allow using the Share experience\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_configureshare_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_configureshare_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_configureshare_configureshare","displayName":"Configure the Share experience (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_configureshare_configureshare_0","displayName":"Allow using the Share experience","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_configureshare_configureshare_1","displayName":"Don't allow using the Share experience","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_deletedataonmigration","displayName":"Delete old browser data on migration (User)","description":"This policy determines whether user browsing data from Microsoft Edge Legacy will be deleted after migrating to the Microsoft Edge version 81 or later.\r\n\r\nIf you set this policy to \"Enabled\", all browsing data from Microsoft Edge Legacy after migrating to the Microsoft Edge version 81 or later will be deleted. This policy must be set before migrating to the Microsoft Edge version 81 or later to have any effect on existing browsing data.\r\n\r\nIf you set this policy to \"Disabled\", or the policy is not configured, user browsing data isn't deleted after migrating to the Microsoft Edge version 83 or later.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_deletedataonmigration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_deletedataonmigration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_dnsoverhttpsmode","displayName":"Control the mode of DNS-over-HTTPS (User)","description":"Control the mode of the DNS-over-HTTPS resolver. Note that this policy will only set the default mode for each query. The mode can be overridden for special types of queries such as requests to resolve a DNS-over-HTTPS server hostname.\r\n\r\nThe \"off\" mode will disable DNS-over-HTTPS.\r\n\r\nThe \"automatic\" mode will send DNS-over-HTTPS queries first if a DNS-over-HTTPS server is available and may fallback to sending insecure queries on error.\r\n\r\nThe \"secure\" mode will only send DNS-over-HTTPS queries and will fail to resolve on error.\r\n\r\nIf you don't configure this policy, the browser might send DNS-over-HTTPS requests to a resolver associated with the user's configured system resolver.\r\n\r\nExample value: off","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_dnsoverhttpsmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_dnsoverhttpsmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_dnsoverhttpsmode_dnsoverhttpsmode","displayName":"Control the mode of DNS-over-HTTPS (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_dnsoverhttpsmode_dnsoverhttpsmode_off","displayName":"Disable DNS-over-HTTPS","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_dnsoverhttpsmode_dnsoverhttpsmode_automatic","displayName":"Enable DNS-over-HTTPS with insecure fallback","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_dnsoverhttpsmode_dnsoverhttpsmode_secure","displayName":"Enable DNS-over-HTTPS without insecure fallback","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_dnsoverhttpstemplates","displayName":"Specify URI template of desired DNS-over-HTTPS resolver (User)","description":"The URI template of the desired DNS-over-HTTPS resolver. To specify multiple DNS-over-HTTPS resolvers, separate the corresponding URI templates with spaces.\r\n\r\nIf you set 'DnsOverHttpsMode' (Control the mode of DNS-over-HTTPS) to \"secure\" then this policy must be set and cannot be empty.\r\n\r\nIf you set 'DnsOverHttpsMode' to \"automatic\" and this policy is set then the URI templates specified will be used. If you don't set this policy, then hardcoded mappings will be used to attempt to upgrade the user's current DNS resolver to a DoH resolver operated by the same provider.\r\n\r\nIf the URI template contains a dns variable, requests to the resolver will use GET; otherwise requests will use POST.\r\n\r\nIncorrectly formatted templates will be ignored.\r\n\r\nExample value: https://dns.example.net/dns-query{?dns}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_dnsoverhttpstemplates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_dnsoverhttpstemplates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_dnsoverhttpstemplates_dnsoverhttpstemplates","displayName":"Specify URI template of desired DNS-over-HTTPS resolver (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_familysafetysettingsenabled","displayName":"Allow users to configure Family safety (User)","description":"This policy disables and completely hides the Family safety page in Settings. Navigation to edge://settings/familysafety will also be blocked. The Family safety page describes what features are available for family groups and how to join a family group. Learn more about family safety here: (https://go.microsoft.com/fwlink/?linkid=2098432).\r\n\r\nIf you enable this policy or don't configure it, the Family safety page will be shown.\r\n\r\nIf you disable this policy, the Family safety page will not be shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_familysafetysettingsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_familysafetysettingsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_localprovidersenabled","displayName":"Allow suggestions from local providers (User)","description":"Allow suggestions from suggestion providers on the device (local providers), for example, Favorites and Browsing History, in Microsoft Edge's Address Bar and Auto-Suggest List.\r\n\r\nIf you enable this policy, suggestions from local providers are used.\r\n\r\nIf you disable this policy, suggestions from local providers are never used. Local history and local favorites suggestions will not appear.\r\n\r\nIf you do not configure this policy, suggestions from local providers are allowed but the user can change that using the settings toggle.\r\n\r\nNote that some features may not be available if a policy to disable this feature has been applied. For example, Browsing History suggestions will not be available if you enable the 'SavingBrowserHistoryDisabled' (Disable saving browser history) policy.\r\n\r\nThis policy requires a browser restart to finish applying.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_localprovidersenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_localprovidersenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_recommended_clearcachedimagesandfilesonexit_recommended","displayName":"Clear cached images and files when Microsoft Edge closes (User)","description":"Microsoft Edge doesn't clear cached images and files by default when it closes.\r\n\r\nIf you enable this policy, cached images and files will be deleted each time Microsoft Edge closes.\r\n\r\nIf you disable this policy, users cannot configure the cached images and files option in edge://settings/clearBrowsingDataOnClose.\r\n\r\nIf you don't configure this policy, users can choose whether cached images and files are cleared on exit.\r\n\r\nIf you disable this policy, don't enable the 'ClearBrowsingDataOnExit' (Clear browsing data when Microsoft Edge closes) policy, because they both deal with deleting data. If you configure both, the 'ClearBrowsingDataOnExit' policy takes precedence and deletes all data when Microsoft Edge closes, regardless of how you configured 'ClearCachedImagesAndFilesOnExit' (Clear cached images and files when Microsoft Edge closes).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_recommended_clearcachedimagesandfilesonexit_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_recommended_clearcachedimagesandfilesonexit_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_recommended_localprovidersenabled_recommended","displayName":"Allow suggestions from local providers (User)","description":"Allow suggestions from suggestion providers on the device (local providers), for example, Favorites and Browsing History, in Microsoft Edge's Address Bar and Auto-Suggest List.\r\n\r\nIf you enable this policy, suggestions from local providers are used.\r\n\r\nIf you disable this policy, suggestions from local providers are never used. Local history and local favorites suggestions will not appear.\r\n\r\nIf you do not configure this policy, suggestions from local providers are allowed but the user can change that using the settings toggle.\r\n\r\nNote that some features may not be available if a policy to disable this feature has been applied. For example, Browsing History suggestions will not be available if you enable the 'SavingBrowserHistoryDisabled' (Disable saving browser history) policy.\r\n\r\nThis policy requires a browser restart to finish applying.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_recommended_localprovidersenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_recommended_localprovidersenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_screencaptureallowed","displayName":"Allow or deny screen capture (User)","description":"If you enable this policy, or don't configure this policy, a web page can use screen-share APIs (for example, getDisplayMedia() or the Desktop Capture extension API) for a screen capture.\r\nIf you disable this policy, calls to screen-share APIs will fail. For example, if you're using a web-based online meeting, video or screen sharing will not work. However, this policy is not considered\r\n(and a site will be allowed to use screen-share APIs) if the site matches an origin pattern in any of the following policies:\r\n'ScreenCaptureAllowedByOrigins' (Allow Desktop, Window, and Tab capture by these origins),\r\n'WindowCaptureAllowedByOrigins' (Allow Window and Tab capture by these origins),\r\n'TabCaptureAllowedByOrigins' (Allow Tab capture by these origins),\r\n'SameOriginTabCaptureAllowedByOrigins' (Allow Same Origin Tab capture by these origins).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_screencaptureallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_screencaptureallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_scrolltotextfragmentenabled","displayName":"Enable scrolling to text specified in URL fragments (User)","description":"This feature lets hyperlink and address bar URL navigations target specific text on a web page, which will be scrolled to after the web page finishes loading.\r\n​\r\nIf you enable or don't configure this policy, web page scrolling to specific text fragments via a URL will be enabled.​\r\n\r\nIf you disable this policy, web page scrolling to specific text fragments via a URL will be disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_scrolltotextfragmentenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_scrolltotextfragmentenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_synctypeslistdisabled","displayName":"Configure the list of types that are excluded from synchronization (User)","description":"If you enable this policy all the specified data types will be excluded from synchronization. This policy can be used to limit the type of data uploaded to the Microsoft Edge synchronization service.\r\n\r\nYou can provide one of the following data types for this policy: \"favorites\", \"settings\", \"passwords\", \"addressesAndMore\", \"extensions\", and “collections”. Note that these data type names are case sensitive.\r\n\r\nUsers will not be able to override the disabled data types.\r\n\r\nExample value:\r\n\r\nfavorites","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_synctypeslistdisabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_synctypeslistdisabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev83diff~policy~microsoft_edge_synctypeslistdisabled_synctypeslistdisableddesc","displayName":"Configure the list of types that are excluded from synchronization (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_appcacheforceenabled","displayName":"Allows the AppCache feature to be re-enabled, even if it's turned off by default (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 96.\r\n\r\nSupport for AppCache and this policy was removed from Microsoft Edge starting in version 97.\r\n\r\nIf you set this policy to true, the AppCache is enabled, even when AppCache in Microsoft Edge is not available by default.\r\n\r\nIf you set this policy to false, or don't set it, AppCache will follow Microsoft Edge's defaults.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_appcacheforceenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_appcacheforceenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_delaynavigationsforinitialsitelistdownload","displayName":"Require that the Enterprise Mode Site List is available before tab navigation (User)","description":"Lets you specify whether Microsoft Edge tabs wait to navigate until the browser has downloaded the initial Enterprise Mode Site List. This setting is intended for the scenario where the browser home page should load in Internet Explorer mode, and it is important that is does so on browser first run after IE mode is enabled. If this scenario does not exist, we recommend not enabling this setting because it can negatively impact the performance of loading the home page. The setting only applies when Microsoft Edge does not have a cached Enterprise Mode Site List, such as on browser first run after IE mode is enabled.\r\n\r\nThis setting works in conjunction with:\r\n'InternetExplorerIntegrationLevel' (Configure Internet Explorer integration) is set to \"Internet Explorer mode\" (1)\r\nand\r\n'InternetExplorerIntegrationSiteList' (Configure the Enterprise Mode Site List) policy where the list has at least one entry.\r\n\r\nThe timeout behavior of this policy can be configured with the 'NavigationDelayForInitialSiteListDownloadTimeout' (Set a timeout for delay of tab navigation for the Enterprise Mode Site List) policy.\r\n\r\nIf you set this policy to 1, when Microsoft Edge does not have a cached version of the Enterprise Mode Site List, tabs delay navigating until the browser has downloaded the site list. Sites configured to open in Internet Explorer mode by the site list will load in Internet Explorer mode, even during the initial navigation of the browser. Sites that cannot possibly be configured to open in Internet Explorer, such as any site with a scheme other than http:, https:, file:, or ftp: do not delay navigating and load immediately in Edge mode.\r\n\r\nIf you set this policy to 0 or don't configure it, when Microsoft Edge does not have a cached version of the Enterprise Mode Site List, tabs will navigate immediately, and not wait for the browser to download the Enterprise Mode Site List. Sites configured to open in Internet Explorer mode by the site list will open in Microsoft Edge mode until the browser has finished downloading the Enterprise Mode Site List.\r\n\r\n* 0 = None\r\n\r\n* 1 = All eligible navigations","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_delaynavigationsforinitialsitelistdownload_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_delaynavigationsforinitialsitelistdownload_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_delaynavigationsforinitialsitelistdownload_delaynavigationsforinitialsitelistdownload","displayName":"Require that the Enterprise Mode Site List is available before tab navigation (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_delaynavigationsforinitialsitelistdownload_delaynavigationsforinitialsitelistdownload_0","displayName":"None","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_delaynavigationsforinitialsitelistdownload_delaynavigationsforinitialsitelistdownload_1","displayName":"All eligible navigations","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_internetexplorerintegrationenhancedhangdetection","displayName":"Configure enhanced hang detection for Internet Explorer mode (User)","description":"Enhanced hang detection is a more granular approach to detecting hung webpages in Internet Explorer mode than what standalone Internet Explorer uses. When a hung webpage is detected, the browser will apply a mitigation to prevent the rest of the browser from hanging.\r\n\r\nThis setting allows you to configure the use of enhanced hang detection in case you run into incompatible issues with any of your websites. We recommend disabling this policy only if you see notifications such as \"(website) is not responding\" in Internet Explorer mode but not in standalone Internet Explorer.\r\n\r\nThis setting works in conjunction with:\r\n'InternetExplorerIntegrationLevel' (Configure Internet Explorer integration) is set to \"Internet Explorer mode\" (1)\r\nand\r\n'InternetExplorerIntegrationSiteList' (Configure the Enterprise Mode Site List) policy where the list has at least one entry.\r\n\r\nIf you set this policy to 'Enabled' (1) or don’t configure it, websites running in Internet Explorer mode will use enhanced hang detection.\r\n\r\nIf you set this policy to 'Disabled' (0), enhanced hang detection is disabled, and users will get the basic Internet Explorer hang detection behavior.\r\n\r\n* 0 = Enhanced hang detection disabled\r\n\r\n* 1 = Enhanced hang detection enabled\r\n\r\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_internetexplorerintegrationenhancedhangdetection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_internetexplorerintegrationenhancedhangdetection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_internetexplorerintegrationenhancedhangdetection_internetexplorerintegrationenhancedhangdetection","displayName":"Configure enhanced hang detection for Internet Explorer mode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_internetexplorerintegrationenhancedhangdetection_internetexplorerintegrationenhancedhangdetection_0","displayName":"Enhanced hang detection disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_internetexplorerintegrationenhancedhangdetection_internetexplorerintegrationenhancedhangdetection_1","displayName":"Enhanced hang detection enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_nativewindowocclusionenabled","displayName":"Enable Hiding of Native Windows (User)","description":"Enables hiding of native windows in Microsoft Edge.\r\n\r\nIf you enable this setting, to reduce CPU and power consumption Microsoft Edge will detect when a window is covered by other windows, and will suspend work painting pixels.\r\n\r\nIf you disable this setting Microsoft Edge will not detect when a window is covered by other windows.\r\n\r\nIf this policy is left not set, window hiding detection will be enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_nativewindowocclusionenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_nativewindowocclusionenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_navigationdelayforinitialsitelistdownloadtimeout","displayName":"Set a timeout for delay of tab navigation for the Enterprise Mode Site List (User)","description":"Allows you to set a timeout, in seconds, for Microsoft Edge tabs waiting to navigate until the browser has downloaded the initial Enterprise Mode Site List.\r\n\r\nThis setting works in conjunction with:\r\n'InternetExplorerIntegrationLevel' (Configure Internet Explorer integration) is set to \"Internet Explorer mode\" (1)\r\nand\r\n'InternetExplorerIntegrationSiteList' (Configure the Enterprise Mode Site List) policy where the list has at least one entry\r\nand\r\n'DelayNavigationsForInitialSiteListDownload' (Require that the Enterprise Mode Site List is available before tab navigation) is set to \"All eligible navigations\" (1).\r\n\r\nTabs will not wait longer than this timeout for the Enterprise Mode Site List to download. If the browser has not finished downloading the Enterprise Mode Site List when the timeout expires, Microsoft Edge tabs will continue navigating anyway. The value of the timeout should be no greater than 20 seconds and no fewer than 1 second.\r\n\r\nIf you set the timeout in this policy to a value greater than the default of 2 seconds, an information bar is shown to the user after 2 seconds. The information bar contains a button that allows the user to quit waiting for the Enterprise Mode Site List download to complete.\r\n\r\nIf you don't configure this policy, the default timeout of 2 seconds is used. This default is subject to change in the future.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_navigationdelayforinitialsitelistdownloadtimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_navigationdelayforinitialsitelistdownloadtimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_navigationdelayforinitialsitelistdownloadtimeout_navigationdelayforinitialsitelistdownloadtimeout","displayName":"Set a timeout for delay of tab navigation for the Enterprise Mode Site List: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended_managedsearchengines_recommended","displayName":"Manage Search Engines (User)","description":"Lets you configure a list of up to 10 search engines, one of which must be marked as the default search engine.\r\nYou do not need to specify the encoding. Starting in Microsoft Edge 80, the suggest_url and image_search_url parameters are optional. The optional parameter, image_search_post_params (consists of comma-separated name/value pairs), is available starting in Microsoft Edge 80.\r\n\r\nStarting in Microsoft Edge 83, you can enable search engine discovery with the allow_search_engine_discovery optional parameter. This parameter must be the first item in the list. If allow_search_engine_discovery is not specified, search engine discovery will be disabled by default. Starting in Microsoft Edge 84, you can set this policy as a recommended policy to allow search provider discovery. You do not need to add the allow_search_engine_discovery optional parameter.\r\n\r\nIf you enable this policy, users can't add, remove, or change any search engine in the list. Users can set their default search engine to any search engine in the list.\r\n\r\nIf you disable or don't configure this policy, users can modify the search engines list as desired.\r\n\r\nIf the 'DefaultSearchProviderSearchURL' (Default search provider search URL) policy is set, this policy (ManagedSearchEngines) is ignored. The user must restart their browser to finish applying this policy.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"allow_search_engine_discovery\": true\r\n }, \r\n {\r\n \"is_default\": true, \r\n \"suggest_url\": \"https://www.example1.com/qbox?query={searchTerms}\", \r\n \"search_url\": \"https://www.example1.com/search?q={searchTerms}\", \r\n \"name\": \"Example1\", \r\n \"keyword\": \"example1.com\"\r\n }, \r\n {\r\n \"suggest_url\": \"https://www.example2.com/qbox?query={searchTerms}\", \r\n \"image_search_url\": \"https://www.example2.com/images/detail/search?iss=sbiupload\", \r\n \"name\": \"Example2\", \r\n \"keyword\": \"example2.com\", \r\n \"image_search_post_params\": \"content={imageThumbnail},url={imageURL},sbisrc={SearchSource}\", \r\n \"search_url\": \"https://www.example2.com/search?q={searchTerms}\"\r\n }, \r\n {\r\n \"suggest_url\": \"https://www.example3.com/qbox?query={searchTerms}\", \r\n \"search_url\": \"https://www.example3.com/search?q={searchTerms}\", \r\n \"name\": \"Example3\", \r\n \"keyword\": \"example3.com\", \r\n \"encoding\": \"UTF-8\", \r\n \"image_search_url\": \"https://www.example3.com/images/detail/search?iss=sbiupload\"\r\n }, \r\n {\r\n \"search_url\": \"https://www.example4.com/search?q={searchTerms}\", \r\n \"name\": \"Example4\", \r\n \"keyword\": \"example4.com\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended_managedsearchengines_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended_managedsearchengines_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended_managedsearchengines_recommended_managedsearchengines","displayName":"Manage Search Engines (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderenabled_recommended","displayName":"Enable the default search provider (User)","description":"Enables the ability to use a default search provider.\r\n\r\nIf you enable this policy, a user can search for a term by typing in the address bar (as long as what they type isn't a URL).\r\n\r\nYou can specify the default search provider to use by enabling the rest of the default search policies. If these are left empty (not configured) or configured incorrectly, the user can choose the default provider.\r\n\r\nIf you disable this policy, the user can't search from the address bar.\r\n\r\nIf you enable or disable this policy, users can't change or override it.\r\n\r\nIf you don't configure this policy, the default search provider is enabled, and the user can choose the default search provider and set the search provider list.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is available only on instances that are managed via MDM or joined to a domain via MCX.\r\n\r\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderencodings_recommended","displayName":"Default search provider encodings (User)","description":"Specify the character encodings supported by the search provider. Encodings are code page names like UTF-8, GB2312, and ISO-8859-1. They are tried in the order provided.\r\n\r\nThis policy is optional. If not configured, the default, UTF-8, is used.\r\n\r\nThis policy is applied only if you enable the 'DefaultSearchProviderEnabled' (Enable the default search provider) and 'DefaultSearchProviderSearchURL' (Default search provider search URL) policies.\r\n\r\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the 'ManagedSearchEngines' (Manage Search Engines) policy.\r\n\r\nExample value:\r\n\r\nUTF-8\r\nUTF-16\r\nGB2312\r\nISO-8859-1","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderencodings_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderencodings_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderencodings_recommended_defaultsearchproviderencodingsdesc","displayName":"Default search provider encodings (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderimageurl_recommended","displayName":"Specifies the search-by-image feature for the default search provider (User)","description":"Specifies the URL to the search engine used for image search. Search requests are sent using the GET method.\r\n\r\nThis policy is optional. If you don't configure it, image search isn't available.\r\n\r\nSpecify Bing's Image Search URL as:\r\n'{bing:baseURL}images/detail/search?iss=sbiupload&FORM=ANCMS1#enterInsights'.\r\n\r\nSpecify Google's Image Search URL as: '{google:baseURL}searchbyimage/upload'.\r\n\r\nSee 'DefaultSearchProviderImageURLPostParams' (Parameters for an image URL that uses POST) policy to finish configuring image search.\r\n\r\nThis policy is applied only if you enable the 'DefaultSearchProviderEnabled' (Enable the default search provider) and 'DefaultSearchProviderSearchURL' (Default search provider search URL) policies.\r\n\r\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the 'ManagedSearchEngines' (Manage Search Engines) policy.\r\n\r\nExample value: https://search.contoso.com/searchbyimage/upload","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderimageurl_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderimageurl_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderimageurl_recommended_defaultsearchproviderimageurl","displayName":"Specifies the search-by-image feature for the default search provider (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderimageurlpostparams_recommended","displayName":"Parameters for an image URL that uses POST (User)","description":"If you enable this policy, it specifies the parameters used when an image search that uses POST is performed. The policy consists of comma-separated name/value pairs. If a value is a template parameter, like {imageThumbnail} in the preceding example, it's replaced with real image thumbnail data. This policy is applied only if you enable the 'DefaultSearchProviderEnabled' (Enable the default search provider) and 'DefaultSearchProviderSearchURL' (Default search provider search URL) policies.\r\n\r\nSpecify Bing's Image Search URL Post Params as:\r\n'imageBin={google:imageThumbnailBase64}'.\r\n\r\nSpecify Google's Image Search URL Post Params as:\r\n'encoded_image={google:imageThumbnail},image_url={google:imageURL},sbisrc={google:imageSearchSource},original_width={google:imageOriginalWidth},original_height={google:imageOriginalHeight}'.\r\n\r\nIf you don't set this policy, image search requests are sent using the GET method.\r\n\r\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the 'ManagedSearchEngines' (Manage Search Engines) policy.\r\n\r\nExample value: content={imageThumbnail},url={imageURL},sbisrc={SearchSource}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderimageurlpostparams_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderimageurlpostparams_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderimageurlpostparams_recommended_defaultsearchproviderimageurlpostparams","displayName":"Parameters for an image URL that uses POST (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderkeyword_recommended","displayName":"Default search provider keyword (User)","description":"Specifies the keyword, which is the shortcut used in the Address Bar to trigger the search for this provider.\r\n\r\nThis policy is optional. If you don't configure it, no keyword activates the search provider.\r\n\r\nThis policy is applied only if you enable the 'DefaultSearchProviderEnabled' (Enable the default search provider) and 'DefaultSearchProviderSearchURL' (Default search provider search URL) policies.\r\n\r\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the 'ManagedSearchEngines' (Manage Search Engines) policy.\r\n\r\nExample value: mis","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderkeyword_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderkeyword_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchproviderkeyword_recommended_defaultsearchproviderkeyword","displayName":"Default search provider keyword (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchprovidername_recommended","displayName":"Default search provider name (User)","description":"Specifies the name of the default search provider.\r\n\r\nIf you enable this policy, you set the name of the default search provider.\r\n\r\nIf you don't enable this policy or if you leave it empty, the host name specified by the search URL is used.\r\n\r\n'DefaultSearchProviderName' should be set to an organization-approved encrypted search provider that corresponds to the encrypted search provider set in DTBC-0008. This policy is applied only if you enable the 'DefaultSearchProviderEnabled' (Enable the default search provider) and 'DefaultSearchProviderSearchURL' (Default search provider search URL) policies.\r\n\r\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the 'ManagedSearchEngines' (Manage Search Engines) policy.\r\n\r\nExample value: My Intranet Search","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchprovidername_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchprovidername_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchprovidername_recommended_defaultsearchprovidername","displayName":"Default search provider name (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchprovidersearchurl_recommended","displayName":"Default search provider search URL (User)","description":"Specifies the URL of the search engine used for a default search. The URL contains the string '{searchTerms}', which is replaced at query time by the terms the user is searching for.\r\n\r\nSpecify Bing's search URL as:\r\n\r\n'{bing:baseURL}search?q={searchTerms}'.\r\n\r\nSpecify Google's search URL as: '{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}ie={inputEncoding}'.\r\n\r\nThis policy is required when you enable the 'DefaultSearchProviderEnabled' (Enable the default search provider) policy; if you don't enable the latter policy, this policy is ignored.\r\n\r\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the 'ManagedSearchEngines' (Manage Search Engines) policy.\r\n\r\nExample value: https://search.contoso.com/search?q={searchTerms}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchprovidersearchurl_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchprovidersearchurl_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchprovidersearchurl_recommended_defaultsearchprovidersearchurl","displayName":"Default search provider search URL (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchprovidersuggesturl_recommended","displayName":"Default search provider URL for suggestions (User)","description":"Specifies the URL for the search engine used to provide search suggestions. The URL contains the string '{searchTerms}', which is replaced at query time by the text the user has entered so far.\r\n\r\nThis policy is optional. If you don't configure it, users won't see search suggestions; they will see suggestions from their browsing history and favorites.\r\n\r\nBing's suggest URL can be specified as:\r\n\r\n'{bing:baseURL}qbox?query={searchTerms}'.\r\n\r\nGoogle's suggest URL can be specified as: '{google:baseURL}complete/search?output=chrome&q={searchTerms}'.\r\n\r\nThis policy is applied only if you enable the 'DefaultSearchProviderEnabled' (Enable the default search provider) and 'DefaultSearchProviderSearchURL' (Default search provider search URL) policies.\r\n\r\nStarting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the 'ManagedSearchEngines' (Manage Search Engines) policy.\r\n\r\nExample value: https://search.contoso.com/suggest?q={searchTerms}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchprovidersuggesturl_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchprovidersuggesturl_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_defaultsearchprovidersuggesturl_recommended_defaultsearchprovidersuggesturl","displayName":"Default search provider URL for suggestions (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_winhttpproxyresolverenabled","displayName":"Use Windows proxy resolver (User)","description":"DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.\r\n\r\nUse Windows to resolve proxies for all browser networking instead of the proxy resolver built into Microsoft Edge. The Windows proxy resolver enables Windows proxy features such as DirectAccess/NRPT.\r\n\r\nThis policy comes with the problems described by https://crbug.com/644030. It causes PAC files to be fetched and executed by Windows code, including PAC files set via the 'ProxyPacUrl' (Set the proxy .pac file URL) policy. Since Network Fetches for the PAC file happen via Windows instead of Microsoft Edge code, network policies such as 'DnsOverHttpsMode' (Control the mode of DNS-over-HTTPS) will not apply to network fetches for a PAC file.\r\n\r\nThis policy is deprecated. It will be superseded by a similar feature in a future release, see https://crbug.com/1032820.\r\n\r\nIf you enable this policy, the Windows proxy resolver will be used.\r\n\r\nIf you disable or don't configure this policy, the Microsoft Edge proxy resolver will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_winhttpproxyresolverenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge_winhttpproxyresolverenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge~applicationguard_applicationguardcontainerproxy","displayName":"Application Guard Container Proxy (User)","description":"Configures the proxy settings for Microsoft Edge Application Guard.\r\nIf you enable this policy, Microsoft Edge Application Guard ignores other sources of proxy configurations.\r\n\r\nIf you don't configure this policy, Microsoft Edge Application Guard uses the proxy configuration of the host.\r\n\r\nThis policy does not affect the proxy configuration of Microsoft Edge outside of Application Guard (on the host).\r\n\r\nThe ProxyMode field lets you specify the proxy server used by Microsoft Edge Application Guard.\r\n\r\nThe ProxyPacUrl field is a URL to a proxy .pac file.\r\n\r\nThe ProxyServer field is a URL for the proxy server.\r\n\r\nIf you choose the 'direct' value as 'ProxyMode', all other fields are ignored.\r\n\r\nIf you choose the 'auto_detect' value as 'ProxyMode', all other fields are ignored.\r\n\r\nIf you choose the 'fixed_servers' value as 'ProxyMode', the 'ProxyServer' field is used.\r\n\r\nIf you choose the 'pac_script' value as 'ProxyMode', the 'ProxyPacUrl' field is used.\r\n\r\nExample value:\r\n\r\n{\r\n \"ProxyMode\": \"direct\", \r\n \"ProxyPacUrl\": \"https://internal.site/example.pac\", \r\n \"ProxyServer\": \"123.123.123.123:8080\"\r\n}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge~applicationguard_applicationguardcontainerproxy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge~applicationguard_applicationguardcontainerproxy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev84diff~policy~microsoft_edge~applicationguard_applicationguardcontainerproxy_applicationguardcontainerproxy","displayName":"Application Guard Container Proxy (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_autolaunchprotocolsfromorigins","displayName":"Define a list of protocols that can launch an external application from listed origins without prompting the user (User)","description":"Allows you to set a list of protocols, and for each protocol an associated list of allowed origin patterns, that can launch an external application without prompting the user. The trailing separator should not be included when listing the protocol and the protocol should be all lower case. For example, list \"skype\" instead of \"skype:\", \"skype://\" or \"Skype\".\r\n\r\nIf you configure this policy, a protocol will only be permitted to launch an external application without prompting by policy if:\r\n\r\n- the protocol is listed\r\n\r\n- the origin of the site trying to launch the protocol matches one of the origin patterns in that protocol's allowed_origins list.\r\n\r\nIf either condition is false, the external protocol launch prompt will not be omitted by policy.\r\n\r\nIf you don't configure this policy, no protocols can launch without a prompt. Users can opt out of prompts on a per-protocol/per-site basis unless the 'ExternalProtocolDialogShowAlwaysOpenCheckbox' (Show an \"Always open\" checkbox in external protocol dialog) policy is set to Disabled. This policy has no impact on per-protocol/per-site prompt exemptions set by users.\r\n\r\nThe origin matching patterns use a similar format to those for the 'URLBlocklist' (Block access to a list of URLs) policy, which are documented at https://go.microsoft.com/fwlink/?linkid=2095322.\r\n\r\nHowever, origin matching patterns for this policy cannot contain \"/path\" or \"@query\" elements. Any pattern that does contain a \"/path\" or \"@query\" element will be ignored.\r\n\r\nThis policy does not work as expected with file://* wildcards.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"allowed_origins\": [\r\n \"example.com\",\r\n \"http://www.example.com:8080\"\r\n ],\r\n \"protocol\": \"spotify\"\r\n },\r\n {\r\n \"allowed_origins\": [\r\n \"https://example.com\",\r\n \"https://.mail.example.com\"\r\n ],\r\n \"protocol\": \"msteams\"\r\n },\r\n {\r\n \"allowed_origins\": [\r\n \"*\"\r\n ],\r\n \"protocol\": \"msoutlook\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_autolaunchprotocolsfromorigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_autolaunchprotocolsfromorigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_autolaunchprotocolsfromorigins_autolaunchprotocolsfromorigins","displayName":"Define a list of protocols that can launch an external application from listed origins without prompting the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_autoopenallowedforurls","displayName":"URLs where AutoOpenFileTypes can apply (User)","description":"A list of URLs to which 'AutoOpenFileTypes' (List of file types that should be automatically opened on download) will apply to. This policy has no impact on automatically open values set by users via the download shelf ... > \"Always open files of this type\" menu entry.\r\n\r\nIf you set URLs in this policy, files will only automatically open by policy if the URL is part of this set and the file type is listed in 'AutoOpenFileTypes'. If either condition is false, the download won't automatically open by policy.\r\n\r\nIf you don't set this policy, all downloads where the file type is in 'AutoOpenFileTypes' will automatically open.\r\n\r\nA URL pattern has to be formatted according to https://go.microsoft.com/fwlink/?linkid=2095322.\r\n\r\nThis policy does not work as expected with file://* wildcards.\r\n\r\nExample value:\r\n\r\nexample.com\r\nhttps://ssl.server.com\r\nhosting.com/good_path\r\nhttps://server:8080/path\r\n.exact.hostname.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_autoopenallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_autoopenallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_autoopenallowedforurls_autoopenallowedforurlsdesc","displayName":"URLs where AutoOpenFileTypes can apply (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_autoopenfiletypes","displayName":"List of file types that should be automatically opened on download (User)","description":"This policy sets a list of file types that should be automatically opened on download. Note: The leading separator should not be included when listing the file type, so list \"txt\" instead of \".txt\".\r\n\r\nBy default, these file types will be automatically opened on all URLs. You can use the 'AutoOpenAllowedForURLs' (URLs where AutoOpenFileTypes can apply) policy to restrict the URLs for which these file types will be automatically opened on.\r\n\r\nFiles with types that should be automatically opened will still be subject to the enabled Microsoft Defender SmartScreen checks and won't be opened if they fail those checks.\r\n\r\nFile types that a user has already specified to automatically be opened will continue to do so when downloaded. The user will continue to be able to specify other file types to be automatically opened.\r\n\r\nIf you don't set this policy, only file types that a user has already specified to automatically be opened will do so when downloaded.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory or instances that enrolled for device management.\r\n\r\nExample value:\r\n\r\nexe\r\ntxt","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_autoopenfiletypes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_autoopenfiletypes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_autoopenfiletypes_autoopenfiletypesdesc","displayName":"List of file types that should be automatically opened on download (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_defaultsearchprovidercontextmenuaccessallowed","displayName":"Allow default search provider context menu search access (User)","description":"Enables the use of a default search provider on the context menu.\r\n\r\nIf you set this policy to disabled the search context menu item that relies on your default search provider and sidebar search will not be available.\r\n\r\nIf this policy is set to enabled or not set, the context menu item for your default search provider and sidebar search will be available.\r\n\r\nThe policy value is only applied when the 'DefaultSearchProviderEnabled' (Enable the default search provider) policy is enabled, and is not applicable otherwise.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_defaultsearchprovidercontextmenuaccessallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_defaultsearchprovidercontextmenuaccessallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_enablesha1forlocalanchors","displayName":"Allow certificates signed using SHA-1 when issued by local trust anchors (deprecated) (User)","description":"DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.\r\n\r\nWhen this setting is enabled, Microsoft Edge allows connections secured by SHA-1 signed certificates so long as the the certificate chains to a locally-installed root certificate and is otherwise valid.\r\n\r\nNote that this policy depends on the operating system (OS) certificate verification stack allowing SHA-1 signatures. If an OS update changes the OS handling of SHA-1 certificates, this policy might no longer have effect. Further, this policy is intended as a temporary workaround to give enterprises more time to move away from SHA-1. This policy will be removed in Microsoft Edge 92 releasing in mid 2021.\r\n\r\nIf you don't set this policy or set it to false, or the SHA-1 certificate chains to a publicly trusted certificate root, then Microsoft Edge won't allow certificates signed by SHA-1.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_enablesha1forlocalanchors_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_enablesha1forlocalanchors_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_exemptdomainfiletypepairsfromfiletypedownloadwarnings","displayName":"Disable download file type extension-based warnings for specified file types on domains (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 109.\r\n\r\nThis policy has been obsoleted in favor of 'ExemptFileTypeDownloadWarnings' (Disable download file type extension-based warnings for specified file types on domains) because of a type mismatch that caused errors in Mac.\r\n\r\nYou can enable this policy to create a dictionary of file type extensions with a corresponding list of domains that will be exempted from file type extension-based download warnings. This lets enterprise administrators block file type extension-based download warnings for files that are associated with a listed domain. For example, if the \"jnlp\" extension is associated with \"website1.com\", users would not see a warning when downloading \"jnlp\" files from \"website1.com\", but see a download warning when downloading \"jnlp\" files from \"website2.com\".\r\n\r\nFiles with file type extensions specified for domains identified by this policy will still be subject to non-file type extension-based security warnings such as mixed-content download warnings and Microsoft Defender SmartScreen warnings.\r\n\r\nIf you disable this policy or don't configure it, file types that trigger extension-based download warnings will show warnings to the user.\r\n\r\nIf you enable this policy:\r\n\r\n* The URL pattern should be formatted according to https://go.microsoft.com/fwlink/?linkid=2095322.\r\n* The file type extension entered must be in lower-cased ASCII. The leading separator should not be included when listing the file type extension, so list \"jnlp\" should be used instead of \".jnlp\".\r\n\r\nExample:\r\n\r\nThe following example value would prevent file type extension-based download warnings on swf, exe, and jnlp extensions for *.contoso.com domains. It will show the user a file type extension-based download warning on any other domain for exe and jnlp files, but not for swf files.\r\n\r\n[\r\n { \"file_extension\": \"jnlp\", \"domains\": [\"contoso.com\"] },\r\n { \"file_extension\": \"exe\", \"domains\": [\"contoso.com\"] },\r\n { \"file_extension\": \"swf\", \"domains\": [\"*\"] }\r\n]\r\n\r\nNote that while the preceding example shows the suppression of file type extension-based download warnings for \"swf\" files for all domains, applying suppression of such warnings for all domains for any dangerous file type extension is not recommended due to security concerns. It is shown in the example merely to demonstrate the ability to do so.\r\n\r\nExample value:\r\n\r\n{\"domains\": [\"https://contoso.com\", \"contoso2.com\"], \"file_extension\": \"jnlp\"}\r\n{\"domains\": [\"*\"], \"file_extension\": \"swf\"}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_exemptdomainfiletypepairsfromfiletypedownloadwarnings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_exemptdomainfiletypepairsfromfiletypedownloadwarnings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_exemptdomainfiletypepairsfromfiletypedownloadwarnings_exemptdomainfiletypepairsfromfiletypedownloadwarningsdesc","displayName":"Disable download file type extension-based warnings for specified file types on domains (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_intensivewakeupthrottlingenabled","displayName":"Control the IntensiveWakeUpThrottling feature (User)","description":"When enabled the IntensiveWakeUpThrottling feature causes Javascript timers in background tabs to be aggressively throttled and coalesced, running no more than once per minute after a page has been backgrounded for 5 minutes or more.\r\n\r\nThis is a web standards compliant feature, but it may break functionality on some websites by causing certain actions to be delayed by up to a minute. However, it results in significant CPU and battery savings when enabled. See https://bit.ly/30b1XR4 for more details.\r\n\r\nIf you enable this policy, the feature will be force enabled, and users will not be able to override this setting.\r\nIf you disable this policy, the feature will be force disabled, and users will not be able to override this setting.\r\nIf you don't configure this policy, the feature will be controlled by its own internal logic. Users can manually configure this setting.\r\n\r\nNote that the policy is applied per renderer process, with the most recent value of the policy setting in force when a renderer process starts. A full restart is required to ensure that all the loaded tabs receive a consistent policy setting. It is harmless for processes to be running with different values of this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_intensivewakeupthrottlingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_intensivewakeupthrottlingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_newtabpagesearchbox_recommended","displayName":"Configure the new tab page search box experience (User)","description":"You can configure the new tab page search box to use \"Search box (Recommended)\" or \"Address bar\" to search on new tabs. This policy only works if you set the search engine to a value other than Bing by setting the following two policies: 'DefaultSearchProviderEnabled' (Enable the default search provider) and 'DefaultSearchProviderSearchURL' (Default search provider search URL).\r\n\r\n If you disable or don't configure this policy and:\r\n\r\n- If the address bar default search engine is Bing, the new tab page uses the search box to search on new tabs.\r\n- If the address bar default search engine is not Bing, users are offered an additional choice (use \"Address bar\") when searching on new tabs.\r\n\r\n\r\nIf you enable this policy and set it to:\r\n\r\n- \"Search box (Recommended)\" ('bing'), the new tab page uses the search box to search on new tabs.\r\n- \"Address bar\" ('redirect'), the new tab page search box uses the address bar to search on new tabs.\r\n\r\nPolicy options mapping:\r\n\r\n* bing (bing) = Search box (Recommended)\r\n\r\n* redirect (redirect) = Address bar\r\n\r\nUse the preceding information when configuring this policy.\r\n\r\nExample value: bing","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_newtabpagesearchbox_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_newtabpagesearchbox_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_newtabpagesearchbox_recommended_newtabpagesearchbox","displayName":"New tab page search box experience (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_newtabpagesearchbox_recommended_newtabpagesearchbox_bing","displayName":"Search box (Recommended)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_recommended~defaultsearchprovider_recommended_newtabpagesearchbox_recommended_newtabpagesearchbox_redirect","displayName":"Address bar","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_recommended~passwordmanager_recommended_passwordmonitorallowed_recommended","displayName":"Allow users to be alerted if their passwords are found to be unsafe (User)","description":"Allow Microsoft Edge to monitor user passwords.\r\n\r\nIf you enable this policy, the user will get alerted if any of their passwords stored in Microsoft Edge are found to be unsafe. Microsoft Edge will show an alert and this information will also be available in Settings > Passwords > Password Monitor.\r\n\r\nIf you disable this policy, users will not be asked for permission to enable this feature. Their passwords will not be scanned and they will not be alerted either.\r\n\r\nIf you don't configure the policy, users can turn this feature on or off.\r\n\r\nTo learn more about how Microsoft Edge finds unsafe passwords see https://go.microsoft.com/fwlink/?linkid=2133833\r\n\r\nAdditional guidance:\r\n\r\nThis policy can be set as both Recommended as well as Mandatory, however with an important callout.\r\n\r\nMandatory enabled: If the policy is set to Mandatory enabled, the UI in Settings will be disabled but remain in 'On' state, and a briefcase icon will be made visible next to it with this description displayed on hover - \"This setting is managed by your organization.\"\r\n\r\nRecommended enabled: If the policy is set to Recommended enabled, the UI in Settings will remain in 'Off' state, but a briefcase icon will be made visible next to it with this description displayed on hover - \"Your organization recommends a specific value for this setting and you have chosen a different value\"\r\n\r\nMandatory and Recommended disabled: Both these states will work the normal way, with the usual captions being shown to users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_recommended~passwordmanager_recommended_passwordmonitorallowed_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_recommended~passwordmanager_recommended_passwordmonitorallowed_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_recommended~startup_recommended_newtabpageprerenderenabled_recommended","displayName":"Enable preload of the new tab page for faster rendering (User)","description":"If you configure this policy, preloading the New tab page is enabled, and users can't change this setting. If you don't configure this policy, preloading is enabled and a user can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_recommended~startup_recommended_newtabpageprerenderenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_recommended~startup_recommended_newtabpageprerenderenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_roamingprofilelocation","displayName":"Set the roaming profile directory (User)","description":"Configures the directory to use to store the roaming copy of profiles.\r\n\r\nIf you enable this policy, Microsoft Edge uses the provided directory to store a roaming copy of the profiles, as long as you've also enabled the 'RoamingProfileSupportEnabled' (Enable using roaming copies for Microsoft Edge profile data) policy. If you disable the 'RoamingProfileSupportEnabled' policy or don't configure it, the value stored in this policy isn't used.\r\n\r\nSee https://go.microsoft.com/fwlink/?linkid=2095041 for a list of variables you can use.\r\n\r\nIf you don't configure this policy, the default roaming profile path is used.\r\n\r\nExample value: ${roaming_app_data}\\edge-profile","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_roamingprofilelocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_roamingprofilelocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_roamingprofilelocation_roamingprofilelocation","displayName":"Set the roaming profile directory (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_roamingprofilesupportenabled","displayName":"Enable using roaming copies for Microsoft Edge profile data (User)","description":"Enable this policy to use roaming profiles on Windows. The settings stored in Microsoft Edge profiles (favorites and preferences) are also saved to a file stored in the Roaming user profile folder (or the location specified by the administrator through the 'RoamingProfileLocation' (Set the roaming profile directory) policy).\r\n\r\nIf you disable this policy or don't configure it, only the regular local profiles are used.\r\n\r\nThe 'SyncDisabled' (Disable synchronization of data using Microsoft sync services) policy disables all data synchronization, overriding policy.\r\n\r\nSee https://docs.microsoft.com/windows-server/storage/folder-redirection/deploy-roaming-user-profiles for more information on using roaming user profiles.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_roamingprofilesupportenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_roamingprofilesupportenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_tlsciphersuitedenylist","displayName":"Specify the TLS cipher suites to disable (User)","description":"Configure the list of cipher suites that are disabled for TLS connections.\r\n\r\nIf you configure this policy, the list of configured cipher suites will not be used when establishing TLS connections.\r\n\r\nIf you don't configure this policy, the browser will choose which TLS cipher suites to use.\r\n\r\nCipher suite values to be disabled are specified as 16-bit hexadecimal values. The values are assigned by the Internet Assigned Numbers Authority (IANA) registry.\r\n\r\nThe TLS 1.3 cipher suite TLS_AES_128_GCM_SHA256 (0x1301) is required for TLS 1.3 and can't be disabled by this policy.\r\n\r\nThis policy does not affect QUIC-based connections. QUIC can be turned off via the 'QuicAllowed' (Allow QUIC protocol) policy.\r\n\r\nExample value:\r\n\r\n0x1303\r\n0xcca8\r\n0xcca9","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_tlsciphersuitedenylist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_tlsciphersuitedenylist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge_tlsciphersuitedenylist_tlsciphersuitedenylistdesc","displayName":"Specify the TLS cipher suites to disable (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge~defaultsearchprovider_newtabpagesearchbox","displayName":"Configure the new tab page search box experience (User)","description":"You can configure the new tab page search box to use \"Search box (Recommended)\" or \"Address bar\" to search on new tabs. This policy only works if you set the search engine to a value other than Bing by setting the following two policies: 'DefaultSearchProviderEnabled' (Enable the default search provider) and 'DefaultSearchProviderSearchURL' (Default search provider search URL).\r\n\r\n If you disable or don't configure this policy and:\r\n\r\n- If the address bar default search engine is Bing, the new tab page uses the search box to search on new tabs.\r\n- If the address bar default search engine is not Bing, users are offered an additional choice (use \"Address bar\") when searching on new tabs.\r\n\r\n\r\nIf you enable this policy and set it to:\r\n\r\n- \"Search box (Recommended)\" ('bing'), the new tab page uses the search box to search on new tabs.\r\n- \"Address bar\" ('redirect'), the new tab page search box uses the address bar to search on new tabs.\r\n\r\nPolicy options mapping:\r\n\r\n* bing (bing) = Search box (Recommended)\r\n\r\n* redirect (redirect) = Address bar\r\n\r\nUse the preceding information when configuring this policy.\r\n\r\nExample value: bing","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge~defaultsearchprovider_newtabpagesearchbox_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge~defaultsearchprovider_newtabpagesearchbox_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge~defaultsearchprovider_newtabpagesearchbox_newtabpagesearchbox","displayName":"New tab page search box experience (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge~defaultsearchprovider_newtabpagesearchbox_newtabpagesearchbox_bing","displayName":"Search box (Recommended)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge~defaultsearchprovider_newtabpagesearchbox_newtabpagesearchbox_redirect","displayName":"Address bar","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge~passwordmanager_passwordmonitorallowed","displayName":"Allow users to be alerted if their passwords are found to be unsafe (User)","description":"Allow Microsoft Edge to monitor user passwords.\r\n\r\nIf you enable this policy, the user will get alerted if any of their passwords stored in Microsoft Edge are found to be unsafe. Microsoft Edge will show an alert and this information will also be available in Settings > Passwords > Password Monitor.\r\n\r\nIf you disable this policy, users will not be asked for permission to enable this feature. Their passwords will not be scanned and they will not be alerted either.\r\n\r\nIf you don't configure the policy, users can turn this feature on or off.\r\n\r\nTo learn more about how Microsoft Edge finds unsafe passwords see https://go.microsoft.com/fwlink/?linkid=2133833\r\n\r\nAdditional guidance:\r\n\r\nThis policy can be set as both Recommended as well as Mandatory, however with an important callout.\r\n\r\nMandatory enabled: If the policy is set to Mandatory enabled, the UI in Settings will be disabled but remain in 'On' state, and a briefcase icon will be made visible next to it with this description displayed on hover - \"This setting is managed by your organization.\"\r\n\r\nRecommended enabled: If the policy is set to Recommended enabled, the UI in Settings will remain in 'Off' state, but a briefcase icon will be made visible next to it with this description displayed on hover - \"Your organization recommends a specific value for this setting and you have chosen a different value\"\r\n\r\nMandatory and Recommended disabled: Both these states will work the normal way, with the usual captions being shown to users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge~passwordmanager_passwordmonitorallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge~passwordmanager_passwordmonitorallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge~startup_newtabpageprerenderenabled","displayName":"Enable preload of the new tab page for faster rendering (User)","description":"If you configure this policy, preloading the New tab page is enabled, and users can't change this setting. If you don't configure this policy, preloading is enabled and a user can change this setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge~startup_newtabpageprerenderenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev85diff~policy~microsoft_edge~startup_newtabpageprerenderenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86.1~policy~microsoft_edge_diagnosticdata","displayName":"Send required and optional diagnostic data about browser usage (User)","description":"This policy controls sending required and optional diagnostic data about browser usage to Microsoft.\r\n\r\nRequired diagnostic data is collected to keep Microsoft Edge secure, up to date and performing as expected.\r\n\r\nOptional diagnostic data includes data about how you use the browser, websites you visit and crash reports to Microsoft for product and service improvement.\r\n\r\nUp to version 121, this policy is not supported on Windows 10 devices. To control this data collection on Windows 10 for 121 and previous, IT admins must use the Windows diagnostic data group policy. This policy will either be 'Allow Telemetry' or 'Allow Diagnostic Data', depending on the version of Windows. Learn more about Windows 10 diagnostic data collection: https://go.microsoft.com/fwlink/?linkid=2099569\r\n\r\nFor version 122 and later, this policy is supported on Windows 10 devices to allow controlling Microsoft Edge data collection separately from Windows 10 diagnostics data collection.\r\n\r\nUse one of the following settings to configure this policy:\r\n\r\n'Off' turns off required and optional diagnostic data collection. This option is not recommended.\r\n\r\n'RequiredData' sends required diagnostic data but turns off optional diagnostic data collection. Microsoft Edge will send required diagnostic data to keep Microsoft Edge secure, up to date and performing as expected.\r\n\r\n'OptionalData' sends optional diagnostic data includes data about browser usage, websites that are visited, crash reports sent to Microsoft for product and service improvement.\r\n\r\nOn Windows 7/macOS, this policy controls sending required and optional data to Microsoft.\r\n\r\nIf you don't configure this policy or disable it, Microsoft Edge will default to the user's preference.\r\n\r\nPolicy options mapping:\r\n\r\n* Off (0) = Off (Not recommended)\r\n\r\n* RequiredData (1) = Required data\r\n\r\n* OptionalData (2) = Optional data\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86.1~policy~microsoft_edge_diagnosticdata_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86.1~policy~microsoft_edge_diagnosticdata_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86.1~policy~microsoft_edge_diagnosticdata_diagnosticdata","displayName":"Send required and optional diagnostic data about browser usage (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86.1~policy~microsoft_edge_diagnosticdata_diagnosticdata_0","displayName":"Off (Not recommended)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86.1~policy~microsoft_edge_diagnosticdata_diagnosticdata_1","displayName":"Required data","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86.1~policy~microsoft_edge_diagnosticdata_diagnosticdata_2","displayName":"Optional data","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_collectionsservicesandexportsblocklist","displayName":"Block access to a specified list of services and export targets in Collections (User)","description":"List specific services and export targets that users can't access in the Collections feature in Microsoft Edge. This includes displaying additional data from Bing and exporting collections to Microsoft products or external partners.\r\n\r\nIf you enable this policy, services and export targets that match the given list are blocked.\r\n\r\nIf you don't configure this policy, no restrictions on the acceptable services and export targets are enforced.\r\n\r\nPolicy options mapping:\r\n\r\n* pinterest_suggestions (pinterest_suggestions) = Pinterest suggestions\r\n\r\nUse the preceding information when configuring this policy.\r\n\r\nExample value:\r\n\r\npinterest_suggestions","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_collectionsservicesandexportsblocklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_collectionsservicesandexportsblocklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_collectionsservicesandexportsblocklist_collectionsservicesandexportsblocklistdesc","displayName":"Block access to a specified list of services and export targets in Collections (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_defaultsensorssetting","displayName":"Default sensors setting (User)","description":"Set whether websites can access and use sensors such as motion and light sensors. You can completely block or allow websites to get access to sensors.\r\n\r\nSetting the policy to 1 lets websites access and use sensors. Setting the policy to 2 denies access to sensors.\r\n\r\nYou can override this policy for specific URL patterns by using the 'SensorsAllowedForUrls' (Allow access to sensors on specific sites) and 'SensorsBlockedForUrls' (Block access to sensors on specific sites) policies.\r\n\r\nIf you don't configure this policy, websites can access and use sensors, and users can change this setting. This is the global default for 'SensorsAllowedForUrls' and 'SensorsBlockedForUrls'.\r\n\r\nPolicy options mapping:\r\n\r\n* AllowSensors (1) = Allow sites to access sensors\r\n\r\n* BlockSensors (2) = Do not allow any site to access sensors\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_defaultsensorssetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_defaultsensorssetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_defaultsensorssetting_defaultsensorssetting","displayName":"Default sensors setting (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_defaultsensorssetting_defaultsensorssetting_1","displayName":"Allow sites to access sensors","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_defaultsensorssetting_defaultsensorssetting_2","displayName":"Do not allow any site to access sensors","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_defaultserialguardsetting","displayName":"Control use of the Serial API (User)","description":"\r\nSet whether websites can access serial ports. You can completely block access or ask the user each time a website wants to get access to a serial port.\r\n\r\nSetting the policy to 3 lets websites ask for access to serial ports. Setting the policy to 2 denies access to serial ports.\r\n\r\nYou can override this policy for specific URL patterns by using the 'SerialAskForUrls' (Allow the Serial API on specific sites) and 'SerialBlockedForUrls' (Block the Serial API on specific sites) policies.\r\n\r\nIf you don't configure this policy, by default, websites can ask users whether they can access a serial port, and users can change this setting.\r\n\r\nPolicy options mapping:\r\n\r\n* BlockSerial (2) = Do not allow any site to request access to serial ports via the Serial API\r\n\r\n* AskSerial (3) = Allow sites to ask for user permission to access a serial port\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_defaultserialguardsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_defaultserialguardsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_defaultserialguardsetting_defaultserialguardsetting","displayName":"Control use of the Serial API (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_defaultserialguardsetting_defaultserialguardsetting_2","displayName":"Do not allow any site to request access to serial ports via the Serial API","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_defaultserialguardsetting_defaultserialguardsetting_3","displayName":"Allow sites to ask for user permission to access a serial port","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_diagnosticdata","displayName":"Send required and optional diagnostic data about browser usage (User)","description":"This policy controls sending required and optional diagnostic data about browser usage to Microsoft.\r\n\r\nRequired diagnostic data is collected to keep Microsoft Edge secure, up to date and performing as expected.\r\n\r\nOptional diagnostic data includes data about how you use the browser, websites you visit and crash reports to Microsoft for product and service improvement.\r\n\r\nUp to version 121, this policy is not supported on Windows 10 devices. To control this data collection on Windows 10 for 121 and previous, IT admins must use the Windows diagnostic data group policy. This policy will either be 'Allow Telemetry' or 'Allow Diagnostic Data', depending on the version of Windows. Learn more about Windows 10 diagnostic data collection: https://go.microsoft.com/fwlink/?linkid=2099569\r\n\r\nFor version 122 and later, this policy is supported on Windows 10 devices to allow controlling Microsoft Edge data collection separately from Windows 10 diagnostics data collection.\r\n\r\nUse one of the following settings to configure this policy:\r\n\r\n'Off' turns off required and optional diagnostic data collection. This option is not recommended.\r\n\r\n'RequiredData' sends required diagnostic data but turns off optional diagnostic data collection. Microsoft Edge will send required diagnostic data to keep Microsoft Edge secure, up to date and performing as expected.\r\n\r\n'OptionalData' sends optional diagnostic data includes data about browser usage, websites that are visited, crash reports sent to Microsoft for product and service improvement.\r\n\r\nOn Windows 7/macOS, this policy controls sending required and optional data to Microsoft.\r\n\r\nIf you don't configure this policy or disable it, Microsoft Edge will default to the user's preference.\r\n\r\nPolicy options mapping:\r\n\r\n* Off (0) = Off (Not recommended)\r\n\r\n* RequiredData (1) = Required data\r\n\r\n* OptionalData (2) = Optional data\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_diagnosticdata_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_diagnosticdata_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_diagnosticdata_diagnosticdata","displayName":"Send required and optional diagnostic data about browser usage (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_diagnosticdata_diagnosticdata_0","displayName":"Off (Not recommended)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_diagnosticdata_diagnosticdata_1","displayName":"Required data","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_diagnosticdata_diagnosticdata_2","displayName":"Optional data","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_enterprisemodesitelistmanagerallowed","displayName":"Allow access to the Enterprise Mode Site List Manager tool (User)","description":"Allows you to set whether Enterprise Mode Site List Manager is available to users.\r\n\r\nIf you enable this policy, users can see the Enterprise Mode Site List Manager nav button on edge://compat page, navigate to the tool and use it.\r\n\r\nIf you disable or don't configure this policy, users won't see the Enterprise Mode Site List Manager nav button and won't be able to use it.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_enterprisemodesitelistmanagerallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_enterprisemodesitelistmanagerallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_forcesync","displayName":"Force synchronization of browser data and do not show the sync consent prompt (User)","description":"Forces data synchronization in Microsoft Edge. This policy also prevents the user from turning sync off.\r\n\r\nIf you don't configure this policy, users will be able to turn sync on or off. If you enable this policy, users will not be able to turn sync off.\r\n\r\nFor this policy to work as intended,\r\n'BrowserSignin' (Browser sign-in settings) policy must not be configured, or must be set to enabled. If 'ForceSync' (Force synchronization of browser data and do not show the sync consent prompt) is set to disabled, then 'BrowserSignin' will not take affect.\r\n\r\n'SyncDisabled' (Disable synchronization of data using Microsoft sync services) must not be configured or must be set to False. If this is set to True, 'ForceSync' will not take affect.\r\n\r\n0 = Do not automatically start sync and show the sync consent (default)\r\n1 = Force sync to be turned on for Azure AD/Azure AD-Degraded user profile and do not show the sync consent prompt","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_forcesync_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_forcesync_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_insecureformswarningsenabled","displayName":"Enable warnings for insecure forms (deprecated) (User)","description":"DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.\r\n\r\nThis policy controls the handling of insecure forms (forms submitted over HTTP) embedded in secure (HTTPS) sites in the browser.\r\nIf you enable this policy or don't set it, a full page warning will be shown when an insecure form is submitted. Additionally, a warning bubble will be shown next to the form fields when they are focused, and autofill will be disabled for those forms.\r\nIf you disable this policy, warnings will not be shown for insecure forms, and autofill will work normally.\r\n\r\nThis policy may be removed as soon as Edge 132. The feature is enabled by default since Edge 131.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_insecureformswarningsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_insecureformswarningsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_internetexplorerintegrationtestingallowed","displayName":"Allow Internet Explorer mode testing (User)","description":"This policy is a replacement for the ie-mode-test flag policy. It lets users open an IE mode tab from the UI menu option.\r\n\r\n This setting works in conjunction with:\r\n 'InternetExplorerIntegrationLevel' (Configure Internet Explorer integration) is set to 'IEMode'\r\n and\r\n 'InternetExplorerIntegrationSiteList' (Configure the Enterprise Mode Site List) policy where the list has at least one entry.\r\n\r\n If you enable this policy, users can open IE mode tab from the UI option and navigate current site to an IE mode site.\r\n\r\n If you disable this policy, users can't see the UI option in the menu directly.\r\n\r\n If you don't configure this policy, you can set up the ie-mode-test flag manually.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_internetexplorerintegrationtestingallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_internetexplorerintegrationtestingallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_savecookiesonexit","displayName":"Save cookies when Microsoft Edge closes (User)","description":"When this policy is enabled, the specified set of cookies is exempt from deletion when the browser closes. This policy is only effective when:\r\n- The 'Cookies and other site data' toggle is configured in Settings/Privacy and services/Clear browsing data on close or\r\n- The policy 'ClearBrowsingDataOnExit' (Clear browsing data when Microsoft Edge closes) is enabled or\r\n- The policy 'DefaultCookiesSetting' (Configure cookies) is set to 'Keep cookies for the duration of the session'.\r\n\r\nYou can define a list of sites, based on URL patterns, that will have their cookies preserved across sessions.\r\n\r\nNote: Users can still edit the cookie site list to add or remove URLs. However, they can't remove URLs that have been added by an Admin.\r\n\r\nIf you enable this policy, the list of cookies won't be cleared when the browser closes.\r\n\r\nIf you disable or don't configure this policy, the user's personal configuration is used.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_savecookiesonexit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_savecookiesonexit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_savecookiesonexit_savecookiesonexitdesc","displayName":"Save cookies when Microsoft Edge closes (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_sensorsallowedforurls","displayName":"Allow access to sensors on specific sites (User)","description":"Define a list of sites, based on URL patterns, that can access and use sensors such as motion and light sensors.\r\n\r\nIf you don't configure this policy, the global default value from the 'DefaultSensorsSetting' (Default sensors setting) policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nFor URL patterns that don't match this policy, the following order of precedence is used: The 'SensorsBlockedForUrls' (Block access to sensors on specific sites) policy (if there is a match), the 'DefaultSensorsSetting' policy (if set), or the user's personal settings.\r\n\r\nThe URL patterns defined in this policy can't conflict with those configured in the 'SensorsBlockedForUrls' policy. You can't allow and block a URL.\r\n\r\nFor detailed information about valid URL patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_sensorsallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_sensorsallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_sensorsallowedforurls_sensorsallowedforurlsdesc","displayName":"Allow access to sensors on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_sensorsblockedforurls","displayName":"Block access to sensors on specific sites (User)","description":"Define a list of sites, based on URL patterns, that can't access sensors such as motion and light sensors.\r\n\r\nIf you don't configure this policy, the global default value from the 'DefaultSensorsSetting' (Default sensors setting) policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nFor URL patterns that don't match this policy, the following order of precedence is used: The 'SensorsAllowedForUrls' (Allow access to sensors on specific sites) policy (if there is a match), the 'DefaultSensorsSetting' policy (if set), or the user's personal settings.\r\n\r\nThe URL patterns defined in this policy can't conflict with those configured in the 'SensorsAllowedForUrls' policy. You can't allow and block a URL.\r\n\r\nFor detailed information about valid URL patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_sensorsblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_sensorsblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_sensorsblockedforurls_sensorsblockedforurlsdesc","displayName":"Block access to sensors on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_serialaskforurls","displayName":"Allow the Serial API on specific sites (User)","description":"Define a list of sites, based on URL patterns, that can ask the user for access to a serial port.\r\n\r\nIf you don't configure this policy, the global default value from the 'DefaultSerialGuardSetting' (Control use of the Serial API) policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nFor URL patterns that don't match this policy, the following order of precedence is used: The 'SerialBlockedForUrls' (Block the Serial API on specific sites) policy (if there is a match), the 'DefaultSerialGuardSetting' policy (if set), or the user's personal settings.\r\n\r\nThe URL patterns defined in this policy can't conflict with those configured in the 'SerialBlockedForUrls' policy. You can't allow and block a URL.\r\n\r\nFor detailed information about valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_serialaskforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_serialaskforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_serialaskforurls_serialaskforurlsdesc","displayName":"Allow the Serial API on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_serialblockedforurls","displayName":"Block the Serial API on specific sites (User)","description":"Define a list of sites, based on URL patterns, that can't ask the user to grant them access to a serial port.\r\n\r\nIf you don't configure this policy, the global default value from the 'DefaultSerialGuardSetting' (Control use of the Serial API) policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nFor URL patterns that don't match this policy, the following order of precedence is used: The 'SerialAskForUrls' (Allow the Serial API on specific sites) policy (if there is a match), the 'DefaultSerialGuardSetting' policy (if set), or the user's personal settings.\r\n\r\nThe URL patterns in this policy can't conflict with those configured in the 'SerialAskForUrls' policy. You can't allow and block a URL.\r\n\r\nFor detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_serialblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_serialblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_serialblockedforurls_serialblockedforurlsdesc","displayName":"Block the Serial API on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_useragentclienthintsenabled","displayName":"Enable the User-Agent Client Hints feature (obsolete) (User)","description":"DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.\r\n\r\nThis policy is deprecated because it's only intended to be a short-term mechanism to give enterprises more time to update their web content if and when it's found to be incompatible with the User-Agent Client Hints feature. It won't work in Microsoft Edge version 89.\r\n\r\nWhen enabled the User-Agent Client Hints feature sends granular request headers that provide information about the user browser (for example, the browser version) and environment (for example, the system architecture).\r\n\r\nThis is an additive feature, but the new headers may break some websites that restrict the characters that requests may contain.\r\n\r\nIf you enable or don't configure this policy, the User-Agent Client Hints feature is enabled. If you disable this policy, this feature is unavailable.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_useragentclienthintsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_useragentclienthintsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_userdatasnapshotretentionlimit","displayName":"Limits the number of user data snapshots retained for use in case of emergency rollback (User)","description":"Following each major version update, Microsoft Edge will create a snapshot of parts of the user's browsing data to use in case of a later emergency that requires a temporary version rollback. If a temporary rollback is performed to a version for which a user has a corresponding snapshot, the data in the snapshot is restored. This lets users keep settings such as bookmarks and autofill data.\r\n\r\nIf you don't set this policy, the default value of 3 snapshots is used.\r\n\r\nIf you set this policy, old snapshots are deleted as needed to respect the limit you set. If you set this policy to 0, no snapshots are taken.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_userdatasnapshotretentionlimit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_userdatasnapshotretentionlimit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge_userdatasnapshotretentionlimit_userdatasnapshotretentionlimit","displayName":"Limits the number of user data snapshots retained for use in case of emergency rollback: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_defaultfilesystemreadguardsetting","displayName":"Control use of the File System API for reading (User)","description":"If you set this policy to 3, websites can ask for read access to the host operating system's filesystem using the File System API. If you set this policy to 2, access is denied.\r\n\r\nIf you don't set this policy, websites can ask for access. Users can change this setting.\r\n\r\nPolicy options mapping:\r\n\r\n* BlockFileSystemRead (2) = Don't allow any site to request read access to files and directories via the File System API\r\n\r\n* AskFileSystemRead (3) = Allow sites to ask the user to grant read access to files and directories via the File System API\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_defaultfilesystemreadguardsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_defaultfilesystemreadguardsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_defaultfilesystemreadguardsetting_defaultfilesystemreadguardsetting","displayName":"Control use of the File System API for reading (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_defaultfilesystemreadguardsetting_defaultfilesystemreadguardsetting_2","displayName":"Don't allow any site to request read access to files and directories via the File System API","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_defaultfilesystemreadguardsetting_defaultfilesystemreadguardsetting_3","displayName":"Allow sites to ask the user to grant read access to files and directories via the File System API","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_defaultfilesystemwriteguardsetting","displayName":"Control use of the File System API for writing (User)","description":"If you set this policy to 3, websites can ask for write access to the host operating system's filesystem using the File System API. If you set this policy to 2, access is denied.\r\n\r\nIf you don't set this policy, websites can ask for access. Users can change this setting.\r\n\r\nPolicy options mapping:\r\n\r\n* BlockFileSystemWrite (2) = Don't allow any site to request write access to files and directories\r\n\r\n* AskFileSystemWrite (3) = Allow sites to ask the user to grant write access to files and directories\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_defaultfilesystemwriteguardsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_defaultfilesystemwriteguardsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_defaultfilesystemwriteguardsetting_defaultfilesystemwriteguardsetting","displayName":"Control use of the File System API for writing (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_defaultfilesystemwriteguardsetting_defaultfilesystemwriteguardsetting_2","displayName":"Don't allow any site to request write access to files and directories","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_defaultfilesystemwriteguardsetting_defaultfilesystemwriteguardsetting_3","displayName":"Allow sites to ask the user to grant write access to files and directories","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_filesystemreadaskforurls","displayName":"Allow read access via the File System API on these sites (User)","description":"Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them read access to files or directories in the host operating system's file system via the File System API.\r\n\r\nLeaving the policy unset means 'DefaultFileSystemReadGuardSetting' (Control use of the File System API for reading) applies for all sites, if it's set. If not, users' personal settings apply.\r\n\r\nURL patterns can't conflict with 'FileSystemReadBlockedForUrls' (Block read access via the File System API on these sites). Neither policy takes precedence if a URL matches with both.\r\n\r\nFor detailed information about valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_filesystemreadaskforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_filesystemreadaskforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_filesystemreadaskforurls_filesystemreadaskforurlsdesc","displayName":"Allow read access via the File System API on these sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_filesystemreadblockedforurls","displayName":"Block read access via the File System API on these sites (User)","description":"If you set this policy, you can list the URL patterns that specify which sites can't ask users to grant them read access to files or directories in the host operating system's file system via the File System API.\r\n\r\nIf you don't set this policy, 'DefaultFileSystemReadGuardSetting' (Control use of the File System API for reading) applies for all sites, if it's set. If not, users' personal settings apply.\r\n\r\nURL patterns can't conflict with 'FileSystemReadAskForUrls' (Allow read access via the File System API on these sites). Neither policy takes precedence if a URL matches with both.\r\n\r\nFor detailed information about valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_filesystemreadblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_filesystemreadblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_filesystemreadblockedforurls_filesystemreadblockedforurlsdesc","displayName":"Block read access via the File System API on these sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_filesystemwriteaskforurls","displayName":"Allow write access to files and directories on these sites (User)","description":"If you set this policy, you can list the URL patterns that specify which sites can ask users to grant them write access to files or directories in the host operating system's file system.\r\n\r\nIf you don't set this policy, 'DefaultFileSystemWriteGuardSetting' (Control use of the File System API for writing) applies for all sites, if it's set. If not, users' personal settings apply.\r\n\r\nURL patterns can't conflict with 'FileSystemWriteBlockedForUrls' (Block write access to files and directories on these sites). Neither policy takes precedence if a URL matches with both.\r\n\r\nFor detailed information about valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_filesystemwriteaskforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_filesystemwriteaskforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_filesystemwriteaskforurls_filesystemwriteaskforurlsdesc","displayName":"Allow write access to files and directories on these sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_filesystemwriteblockedforurls","displayName":"Block write access to files and directories on these sites (User)","description":"If you set this policy, you can list the URL patterns that specify which sites can't ask users to grant them write access to files or directories in the host operating system's file system.\r\n\r\nIf you don't set this policy, 'DefaultFileSystemWriteGuardSetting' (Control use of the File System API for writing) applies for all sites, if it's set. If not, users' personal settings apply.\r\n\r\nURL patterns can't conflict with 'FileSystemWriteAskForUrls' (Allow write access to files and directories on these sites). Neither policy takes precedence if a URL matches with both.\r\n\r\nFor detailed information about valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_filesystemwriteblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_filesystemwriteblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_filesystemwriteblockedforurls_filesystemwriteblockedforurlsdesc","displayName":"Block write access to files and directories on these sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_spotlightexperiencesandrecommendationsenabled","displayName":"Choose whether users can receive customized background images and text, suggestions, notifications,\r\nand tips for Microsoft services (User)","description":"Choose whether users can receive customized background images and text, suggestions, notifications, and tips for Microsoft services.\r\n\r\nIf you enable or don't configure this setting, spotlight experiences and recommendations are turned on.\r\n\r\nIf you disable this setting, spotlight experiences and recommendations are turned off.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_spotlightexperiencesandrecommendationsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~contentsettings_spotlightexperiencesandrecommendationsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~startup_newtabpageallowedbackgroundtypes","displayName":"Configure the background types allowed for the new tab page layout (User)","description":"You can configure which types of background image that are allowed on the new tab page layout in Microsoft Edge.\r\n\r\nIf you don't configure this policy, all background image types on the new tab page are enabled.\r\n\r\nPolicy options mapping:\r\n\r\n* DisableImageOfTheDay (1) = Disable daily background image type\r\n\r\n* DisableCustomImage (2) = Disable custom background image type\r\n\r\n* DisableAll (3) = Disable all background image types\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~startup_newtabpageallowedbackgroundtypes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~startup_newtabpageallowedbackgroundtypes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~startup_newtabpageallowedbackgroundtypes_newtabpageallowedbackgroundtypes","displayName":"New tab page experience (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~startup_newtabpageallowedbackgroundtypes_newtabpageallowedbackgroundtypes_1","displayName":"Disable daily background image type","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~startup_newtabpageallowedbackgroundtypes_newtabpageallowedbackgroundtypes_2","displayName":"Disable custom background image type","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev86~policy~microsoft_edge~startup_newtabpageallowedbackgroundtypes_newtabpageallowedbackgroundtypes_3","displayName":"Disable all background image types","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_configurefriendlyurlformat","displayName":"Configure the default paste format of URLs copied from Microsoft Edge, and determine if additional formats will be available to users (User)","description":"If FriendlyURLs are enabled, Microsoft Edge will compute additional representations of the URL and place them on the clipboard.\r\n\r\nThis policy configures what format will be pasted when the user pastes in external applications, or inside Microsoft Edge without the 'Paste as' context menu item.\r\n\r\nIf configured, this policy makes a choice on behalf of the user. The options in edge://settings/shareCopyPaste will be grayed out, and the options in the 'Paste As' context menu will not be available.\r\n\r\n* Not configured = The user will be able to choose their preferred paste format. By default, this is set to the friendly URL format. The 'Paste As' menu will be available in Microsoft Edge.\r\n\r\n* 1 = No additional formats will be stored on the clipboard. There will be no 'Paste as' context menu item in Microsoft Edge and the only format available to paste will be the plain text URL format. Effectively, the friendly URL feature will be disabled.\r\n\r\n* 3 = The user will get a friendly URL whenever they paste into surfaces that accept rich text. The plain URL will still be available for non-rich surfaces. There will be no 'Paste As' menu in Microsoft Edge.\r\n\r\n* 4 = (Not currently used)\r\n\r\nThe richer formats may not be well-supported in some paste destinations and/or websites. In these scenarios, the plain URL option is recommended when configuring this policy.\r\n\r\nThe recommended policy is available in Microsoft Edge 105 or later.\r\n\r\nPolicy options mapping:\r\n\r\n* PlainText (1) = The plain URL without any extra information, such as the page's title. This is the recommended option when this policy is configured. For more information, see the description.\r\n\r\n* TitledHyperlink (3) = Titled Hyperlink: A hyperlink that points to the copied URL, but whose visible text is the title of the destination page. This is the Friendly URL format.\r\n\r\n* WebPreview (4) = Coming soon. If set, behaves the same as 'Plain URL'.\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_configurefriendlyurlformat_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_configurefriendlyurlformat_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_configurefriendlyurlformat_configurefriendlyurlformat","displayName":"Configure the default paste format of URLs copied from Microsoft Edge, and determine if additional formats will be available to users (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_configurefriendlyurlformat_configurefriendlyurlformat_1","displayName":"The plain URL without any extra information, such as the page's title. This is the recommended option when this policy is configured. For more information, see the description.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_configurefriendlyurlformat_configurefriendlyurlformat_3","displayName":"Titled Hyperlink: A hyperlink that points to the copied URL, but whose visible text is the title of the destination page. This is the Friendly URL format.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_configurefriendlyurlformat_configurefriendlyurlformat_4","displayName":"Coming soon. If set, behaves the same as 'Plain URL'.","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_edgeshoppingassistantenabled","displayName":"Shopping in Microsoft Edge Enabled (User)","description":"This policy lets users compare the prices of a product they are looking at, get coupons from the website they're on, or auto-apply coupons during checkout.\r\n\r\nIf you enable or don't configure this policy, shopping features such as price comparison and coupons will be automatically applied for retail domains. Coupons for the current retailer and prices from other retailers will be fetched from a server.\r\n\r\nIf you disable this policy shopping features such as price comparison and coupons will not be automatically found for retail domains.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_edgeshoppingassistantenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_edgeshoppingassistantenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_hideinternetexplorerredirectuxforincompatiblesitesenabled","displayName":"Hide the one-time redirection dialog and the banner on Microsoft Edge (User)","description":"This policy gives an option to disable one-time redirection dialog and the banner. When this policy is enabled, users will not see both the one-time dialog and the banner.\r\nUsers will continue to be redirected to Microsoft Edge when they encounter an incompatible website on Internet Explorer, but their browsing data will not be imported.\r\n\r\n- If you enable this policy the one-time redirection dialog and banner will never be shown to users. Users' browsing data will not be imported when a redirection happens.\r\n\r\n- If you disable or don't set this policy, the redirection dialog will be shown on the first redirection and the persistent redirection banner will be shown to users on sessions that begin with a redirection. Users' browsing data will be imported every time user encounters such redirection (ONLY IF user consents to it on the one-time dialog).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_hideinternetexplorerredirectuxforincompatiblesitesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_hideinternetexplorerredirectuxforincompatiblesitesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_recommended_edgeshoppingassistantenabled_recommended","displayName":"Shopping in Microsoft Edge Enabled (User)","description":"This policy lets users compare the prices of a product they are looking at, get coupons from the website they're on, or auto-apply coupons during checkout.\r\n\r\nIf you enable or don't configure this policy, shopping features such as price comparison and coupons will be automatically applied for retail domains. Coupons for the current retailer and prices from other retailers will be fetched from a server.\r\n\r\nIf you disable this policy shopping features such as price comparison and coupons will not be automatically found for retail domains.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_recommended_edgeshoppingassistantenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_recommended_edgeshoppingassistantenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_recommended_redirectsitesfrominternetexplorerredirectmode_recommended","displayName":"Redirect incompatible sites from Internet Explorer to Microsoft Edge (User)","description":"This setting lets you specify whether Internet Explorer will redirect navigations to sites that require a modern browser to Microsoft Edge.\r\n\r\nIf you don't configure this policy or set it to 'Sitelist', beginning in M87, Internet Explorer will redirect sites that require a modern browser to Microsoft Edge.\r\n\r\nMicrosoft provides a list of public sites that require such redirection, such as https://mail.yahoo.com.\r\n\r\nWhen a site is redirected from Internet Explorer to Microsoft Edge, the Internet Explorer tab that began loading that site is closed if it had no prior content. Otherwise, it is navigated to a Microsoft help page explaining why the site was redirected to Microsoft Edge.\r\n\r\nWhen Microsoft Edge is launched to load a site from IE, an information bar is shown to the user explaining that the site works best in a modern browser.\r\n\r\nIf you set this policy to 'Disable', Internet Explorer will not redirect any traffic to Microsoft Edge.\r\n\r\nFor more information about this policy see https://go.microsoft.com/fwlink/?linkid=2141715\r\n\r\nPolicy options mapping:\r\n\r\n* Disable (0) = Disable\r\n\r\n* Sitelist (1) = Redirect sites based on the incompatible sites sitelist\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_recommended_redirectsitesfrominternetexplorerredirectmode_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_recommended_redirectsitesfrominternetexplorerredirectmode_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_recommended_redirectsitesfrominternetexplorerredirectmode_recommended_redirectsitesfrominternetexplorerredirectmode","displayName":"Redirect incompatible sites from Internet Explorer to Microsoft Edge (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_recommended_redirectsitesfrominternetexplorerredirectmode_recommended_redirectsitesfrominternetexplorerredirectmode_0","displayName":"Prevent redirection","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_recommended_redirectsitesfrominternetexplorerredirectmode_recommended_redirectsitesfrominternetexplorerredirectmode_1","displayName":"Redirect sites based on the incompatible sites sitelist","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_recommended~passwordmanager_recommended_passwordrevealenabled_recommended","displayName":"Enable Password reveal button (User)","description":"Lets you configure the default display of the browser password reveal button for password input fields on websites.\r\n\r\nIf you enable or don't configure this policy, the browser user setting defaults to displaying the password reveal button.\r\n\r\nIf you disable this policy, the browser user setting won't display the password reveal button.\r\n\r\nFor accessibility, users can change the browser setting from the default policy.\r\n\r\nThis policy only affects the browser password reveal button, it doesn't affect websites' custom reveal buttons.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_recommended~passwordmanager_recommended_passwordrevealenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_recommended~passwordmanager_recommended_passwordrevealenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_redirectsitesfrominternetexplorerpreventbhoinstall","displayName":"Prevent install of the BHO to redirect incompatible sites from Internet Explorer to Microsoft Edge (User)","description":"This setting lets you specify whether to block the install of the Browser Helper Object (BHO) that enables redirecting incompatible sites from Internet Explorer to Microsoft Edge for sites that require a modern browser.\r\n\r\nIf you enable this policy, the BHO will not be installed. If it is already installed it will be uninstalled on the next Microsoft Edge update.\r\n\r\nIf this policy is not configured or is disabled, the BHO will be installed.\r\n\r\nThe BHO is required for incompatible site redirection to occur, however whether redirection occurs or not is also controlled by 'RedirectSitesFromInternetExplorerRedirectMode' (Redirect incompatible sites from Internet Explorer to Microsoft Edge).\r\n\r\nFor more information about this policy see https://go.microsoft.com/fwlink/?linkid=2141715","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_redirectsitesfrominternetexplorerpreventbhoinstall_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_redirectsitesfrominternetexplorerpreventbhoinstall_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_redirectsitesfrominternetexplorerredirectmode","displayName":"Redirect incompatible sites from Internet Explorer to Microsoft Edge (User)","description":"This setting lets you specify whether Internet Explorer will redirect navigations to sites that require a modern browser to Microsoft Edge.\r\n\r\nIf you don't configure this policy or set it to 'Sitelist', beginning in M87, Internet Explorer will redirect sites that require a modern browser to Microsoft Edge.\r\n\r\nMicrosoft provides a list of public sites that require such redirection, such as https://mail.yahoo.com.\r\n\r\nWhen a site is redirected from Internet Explorer to Microsoft Edge, the Internet Explorer tab that began loading that site is closed if it had no prior content. Otherwise, it is navigated to a Microsoft help page explaining why the site was redirected to Microsoft Edge.\r\n\r\nWhen Microsoft Edge is launched to load a site from IE, an information bar is shown to the user explaining that the site works best in a modern browser.\r\n\r\nIf you set this policy to 'Disable', Internet Explorer will not redirect any traffic to Microsoft Edge.\r\n\r\nFor more information about this policy see https://go.microsoft.com/fwlink/?linkid=2141715\r\n\r\nPolicy options mapping:\r\n\r\n* Disable (0) = Disable\r\n\r\n* Sitelist (1) = Redirect sites based on the incompatible sites sitelist\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_redirectsitesfrominternetexplorerredirectmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_redirectsitesfrominternetexplorerredirectmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_redirectsitesfrominternetexplorerredirectmode_redirectsitesfrominternetexplorerredirectmode","displayName":"Redirect incompatible sites from Internet Explorer to Microsoft Edge (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_redirectsitesfrominternetexplorerredirectmode_redirectsitesfrominternetexplorerredirectmode_0","displayName":"Prevent redirection","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_redirectsitesfrominternetexplorerredirectmode_redirectsitesfrominternetexplorerredirectmode_1","displayName":"Redirect sites based on the incompatible sites sitelist","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_speechrecognitionenabled","displayName":"Configure Speech Recognition (User)","description":"Set whether websites can use the W3C Web Speech API to recognize speech from the user. The Microsoft Edge implementation of the Web Speech API uses Azure Cognitive Services, so voice data will leave the machine.\r\n\r\nIf you enable or don't configure this policy, web-based applications that use the Web Speech API can use Speech Recognition.\r\n\r\nIf you disable this policy, Speech Recognition is not available through the Web Speech API.\r\n\r\nRead more about this feature here:\r\nSpeechRecognition API: https://go.microsoft.com/fwlink/?linkid=2143388\r\nCognitive Services: https://go.microsoft.com/fwlink/?linkid=2143680","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_speechrecognitionenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_speechrecognitionenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_webcaptureenabled","displayName":"Enable the Screenshot (previously named Web Capture) feature in Microsoft Edge (User)","description":"Note: The web capture feature is rebranded to \"Screenshot\".\r\n\r\nEnables the Screenshot feature in Microsoft Edge. This feature lets users capture web and PDF content, and annotate captures using inking tools. Users can also do a visual image search based on the captured content.\r\n\r\nIf you enable or don't configure this policy, the Screenshot option appears in the context menu, the Settings and more menu, and by using the keyboard shortcut, CTRL+SHIFT+S.\r\n\r\nIf you disable this policy, users can't access this feature in Microsoft Edge.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_webcaptureenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge_webcaptureenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge~kioskmode_kioskaddressbareditingenabled","displayName":"Configure address bar editing for kiosk mode public browsing experience (User)","description":"This policy only applies to Microsoft Edge kiosk mode while using the public browsing experience.\r\n\r\nIf you enable or don't configure this policy, users can change the URL in the address bar.\r\n\r\nIf you disable this policy, it prevents users from changing the URL in the address bar.\r\n\r\nFor detailed information on configuring kiosk Mode, see https://go.microsoft.com/fwlink/?linkid=2137578.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge~kioskmode_kioskaddressbareditingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge~kioskmode_kioskaddressbareditingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge~kioskmode_kioskdeletedownloadsonexit","displayName":"Delete files downloaded as part of kiosk session when Microsoft Edge closes (User)","description":"This policy only applies to Microsoft Edge kiosk mode.\r\n\r\nIf you enable this policy, files downloaded as part of the kiosk session are deleted each time Microsoft Edge closes.\r\n\r\nIf you disable this policy or don't configure it, files downloaded as part of the kiosk session are not deleted when Microsoft Edge closes.\r\n\r\nFor detailed information on configuring kiosk Mode, see https://go.microsoft.com/fwlink/?linkid=2137578.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge~kioskmode_kioskdeletedownloadsonexit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge~kioskmode_kioskdeletedownloadsonexit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge~printing_printingpapersizedefault","displayName":"Default printing page size (User)","description":"Overrides default printing page size.\r\n\r\nname should contain one of the listed formats or 'custom' if required paper size is not in the list. If 'custom' value is provided custom_size property should be specified. It describes the desired height and width in micrometers. Otherwise custom_size property shouldn't be specified. Policy that violates these rules is ignored.\r\n\r\nIf the page size is unavailable on the printer chosen by the user this policy is ignored.\r\n\r\nExample value:\r\n\r\n{\r\n \"custom_size\": {\r\n \"height\": 297000,\r\n \"width\": 210000\r\n },\r\n \"name\": \"custom\"\r\n}\r\n\r\n\r\nCompact example value:\r\n\r\n{\"custom_size\": {\"height\": 297000, \"width\": 210000}, \"name\": \"custom\"}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge~printing_printingpapersizedefault_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge~printing_printingpapersizedefault_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev87~policy~microsoft_edge~printing_printingpapersizedefault_printingpapersizedefault","displayName":"Default printing page size (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_recommended_sleepingtabstimeout_recommended","displayName":"Set the background tab inactivity timeout for sleeping tabs (User)","description":"This policy setting lets you configure the timeout, in seconds, after which inactive background tabs will be automatically put to sleep if sleeping tabs is enabled. By default, this timeout is 7,200 seconds (2 hours).\r\n\r\nTabs are only put to sleep automatically when the policy 'SleepingTabsEnabled' (Configure sleeping tabs) is enabled or is not configured and the user has enabled the sleeping tabs setting.\r\n\r\nIf you don't configure this policy, users can choose the timeout value.\r\n\r\nPolicy options mapping:\r\n\r\n* 30Seconds (30) = 30 seconds of inactivity\r\n\r\n* 5Minutes (300) = 5 minutes of inactivity\r\n\r\n* 15Minutes (900) = 15 minutes of inactivity\r\n\r\n* 30Minutes (1800) = 30 minutes of inactivity\r\n\r\n* 1Hour (3600) = 1 hour of inactivity\r\n\r\n* 2Hours (7200) = 2 hours of inactivity\r\n\r\n* 3Hours (10800) = 3 hours of inactivity\r\n\r\n* 6Hours (21600) = 6 hours of inactivity\r\n\r\n* 12Hours (43200) = 12 hours of inactivity\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_recommended_sleepingtabstimeout_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_recommended_sleepingtabstimeout_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout","displayName":"Set the background tab inactivity timeout for sleeping tabs (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout_30","displayName":"30 seconds of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout_300","displayName":"5 minutes of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout_900","displayName":"15 minutes of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout_1800","displayName":"30 minutes of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout_3600","displayName":"1 hour of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout_7200","displayName":"2 hours of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout_10800","displayName":"3 hours of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout_21600","displayName":"6 hours of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout_43200","displayName":"12 hours of inactivity","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_sleepingtabstimeout","displayName":"Set the background tab inactivity timeout for sleeping tabs (User)","description":"This policy setting lets you configure the timeout, in seconds, after which inactive background tabs will be automatically put to sleep if sleeping tabs is enabled. By default, this timeout is 7,200 seconds (2 hours).\r\n\r\nTabs are only put to sleep automatically when the policy 'SleepingTabsEnabled' (Configure sleeping tabs) is enabled or is not configured and the user has enabled the sleeping tabs setting.\r\n\r\nIf you don't configure this policy, users can choose the timeout value.\r\n\r\nPolicy options mapping:\r\n\r\n* 30Seconds (30) = 30 seconds of inactivity\r\n\r\n* 5Minutes (300) = 5 minutes of inactivity\r\n\r\n* 15Minutes (900) = 15 minutes of inactivity\r\n\r\n* 30Minutes (1800) = 30 minutes of inactivity\r\n\r\n* 1Hour (3600) = 1 hour of inactivity\r\n\r\n* 2Hours (7200) = 2 hours of inactivity\r\n\r\n* 3Hours (10800) = 3 hours of inactivity\r\n\r\n* 6Hours (21600) = 6 hours of inactivity\r\n\r\n* 12Hours (43200) = 12 hours of inactivity\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_sleepingtabstimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_sleepingtabstimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_sleepingtabstimeout_sleepingtabstimeout","displayName":"Set the background tab inactivity timeout for sleeping tabs (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_sleepingtabstimeout_sleepingtabstimeout_30","displayName":"30 seconds of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_sleepingtabstimeout_sleepingtabstimeout_300","displayName":"5 minutes of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_sleepingtabstimeout_sleepingtabstimeout_900","displayName":"15 minutes of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_sleepingtabstimeout_sleepingtabstimeout_1800","displayName":"30 minutes of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_sleepingtabstimeout_sleepingtabstimeout_3600","displayName":"1 hour of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_sleepingtabstimeout_sleepingtabstimeout_7200","displayName":"2 hours of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_sleepingtabstimeout_sleepingtabstimeout_10800","displayName":"3 hours of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_sleepingtabstimeout_sleepingtabstimeout_21600","displayName":"6 hours of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88.1~policy~microsoft_edge_sleepingtabstimeout_sleepingtabstimeout_43200","displayName":"12 hours of inactivity","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_internetexplorerintegrationlocalfileallowed","displayName":"Allow launching of local files in Internet Explorer mode (User)","description":"This policy controls the availability of the --ie-mode-file-url command line argument which is used to launch Microsoft Edge with a local file specified on the command line into Internet Explorer mode.\r\n\r\nThis setting works in conjunction with:\r\n'InternetExplorerIntegrationLevel' (Configure Internet Explorer integration) is set to 'IEMode'.\r\n\r\nIf you set this policy to true, or don't configure it, the user is allowed to use the --ie-mode-file-url command line argument for launching local files in Internet Explorer mode.\r\n\r\nIf you set this policy to false, the user isn't allowed to use the --ie-mode-file-url command line argument for launching local files in Internet Explorer mode.\r\n\r\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_internetexplorerintegrationlocalfileallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_internetexplorerintegrationlocalfileallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_internetexplorerintegrationlocalfileextensionallowlist","displayName":"Open local files in Internet Explorer mode file extension allow list (User)","description":"This policy limits which file:// URLs are allowed to be launched into Internet Explorer mode based on file extension.\r\n\r\nThis setting works in conjunction with:\r\n'InternetExplorerIntegrationLevel' (Configure Internet Explorer integration) is set to 'IEMode'.\r\n\r\nWhen a file:// URL is requested to launch in Internet Explorer mode, the file extension of the URL must be present in this list in order for the URL to be allowed to launch in Internet Explorer mode. A URL which is blocked from opening in Internet Explorer mode will instead open in Edge mode.\r\n\r\nIf you set this policy to the special value \"*\" or don't configure it, all file extensions are allowed.\r\n\r\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210\r\n\r\nExample value:\r\n\r\n.mht\r\n.pdf\r\n.vsdx","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_internetexplorerintegrationlocalfileextensionallowlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_internetexplorerintegrationlocalfileextensionallowlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_internetexplorerintegrationlocalfileextensionallowlist_internetexplorerintegrationlocalfileextensionallowlistdesc","displayName":"Open local files in Internet Explorer mode file extension allow list (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_internetexplorerintegrationlocalfileshowcontextmenu","displayName":"Show context menu to open a link in Internet Explorer mode (User)","description":"This policy controls the visibility of the 'Open link in new Internet Explorer mode tab' option on the context menu for file:// links.\r\n\r\nThis setting works in conjunction with:\r\n'InternetExplorerIntegrationLevel' (Configure Internet Explorer integration) is set to 'IEMode'.\r\n\r\nIf you set this policy to true, the 'Open link in new Internet Explorer mode tab' context menu item will be available for file:// links.\r\n\r\nIf you set this policy to false or don't configure it, the context menu item will not be added.\r\n\r\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_internetexplorerintegrationlocalfileshowcontextmenu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_internetexplorerintegrationlocalfileshowcontextmenu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_intranetredirectbehavior","displayName":"Intranet Redirection Behavior (User)","description":"This policy configures behavior for intranet redirection via DNS interception checks. The checks attempt to discover whether the browser is behind a proxy that redirects unknown host names.\r\n\r\nIf this policy isn't configured, the browser will use the default behavior of DNS interception checks and intranet redirect suggestions. In M88, they are enabled by default but will be disabled by default in the future release.\r\n\r\n'DNSInterceptionChecksEnabled' (DNS interception checks enabled) is a related policy that might also disable DNS interception checks. However, this policy is a more flexible version which might separately control intranet redirection infobars and might be expanded in the future.\r\nIf either 'DNSInterceptionChecksEnabled' or this policy make a request to disable interception checks, the checks will be disabled.\r\nIf DNS interception checks are disabled by this policy but 'GoToIntranetSiteForSingleWordEntryInAddressBar' (Force direct intranet site navigation instead of searching on single word entries in the Address Bar) is enabled, single word queries will still result in intranet navigations.\r\n\r\nPolicy options mapping:\r\n\r\n* Default (0) = Use default browser behavior.\r\n\r\n* DisableInterceptionChecksDisableInfobar (1) = Disable DNS interception checks and did-you-mean \"http://intranetsite/\" infobars.\r\n\r\n* DisableInterceptionChecksEnableInfobar (2) = Disable DNS interception checks; allow did-you-mean \"http://intranetsite/\" infobars.\r\n\r\n* EnableInterceptionChecksEnableInfobar (3) = Allow DNS interception checks and did-you-mean \"http://intranetsite/\" infobars.\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_intranetredirectbehavior_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_intranetredirectbehavior_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_intranetredirectbehavior_intranetredirectbehavior","displayName":"Intranet Redirection Behavior (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_intranetredirectbehavior_intranetredirectbehavior_0","displayName":"Use default browser behavior.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_intranetredirectbehavior_intranetredirectbehavior_1","displayName":"Disable DNS interception checks and did-you-mean \"http://intranetsite/\" infobars.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_intranetredirectbehavior_intranetredirectbehavior_2","displayName":"Disable DNS interception checks; allow did-you-mean \"http://intranetsite/\" infobars.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_intranetredirectbehavior_intranetredirectbehavior_3","displayName":"Allow DNS interception checks and did-you-mean \"http://intranetsite/\" infobars.","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended_showmicrosoftrewards_recommended","displayName":"Show Microsoft Rewards experiences (User)","description":"Show Microsoft Rewards experience and notifications.\r\nIf you enable this policy:\r\n - Microsoft account users (excludes Azure AD accounts) in search and earn markets will see the Microsoft Rewards experience in their Microsoft Edge user profile.\r\n - The setting to enable Microsoft Rewards in Microsoft Edge settings will be enabled and toggled on.\r\n - The setting to enable Give mode will be enabled and respect the user's setting.\r\n\r\nIf you disable this policy:\r\n - Microsoft account users (excludes Azure AD accounts) in search and earn markets will not see the Microsoft Rewards experience in their Microsoft Edge user profile.\r\n - The setting to enable Microsoft Rewards in Microsoft Edge settings will be disabled and toggled off.\r\n\r\nIf you don't configure this policy:\r\n - Microsoft account users (excludes Azure AD accounts) in search and earn markets will see the Microsoft Rewards experience in their Microsoft Edge user profile.\r\n - The setting to enable Microsoft Rewards in Microsoft Edge settings will be enabled and toggled on.\r\n - The setting to enable Give mode will be enabled and respect the user's setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended_showmicrosoftrewards_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended_showmicrosoftrewards_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~performance_recommended_startupboostenabled_recommended","displayName":"Enable startup boost (User)","description":"Allows Microsoft Edge processes to start at OS sign-in and restart in background after the last browser window is closed.\r\n\r\nIf Microsoft Edge is running in background mode, the browser might not close when the last window is closed and the browser won't be restarted in background when the window closes. See the 'BackgroundModeEnabled' (Continue running background apps after Microsoft Edge closes) policy for information about what happens after configuring Microsoft Edge background mode behavior.\r\n\r\nIf you enable this policy, startup boost is turned on.\r\n\r\nIf you disable this policy, startup boost is turned off.\r\n\r\nIf you don't configure this policy, startup boost may initially be off or on. The user can configure its behavior in edge://settings/system.\r\n\r\nLearn more about startup boost: https://go.microsoft.com/fwlink/?linkid=2147018","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~performance_recommended_startupboostenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~performance_recommended_startupboostenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabsblockedforurls_recommended","displayName":"Block Sleeping Tabs on specific sites (User)","description":"Define a list of sites, based on URL patterns, that are not allowed to be put to sleep by Sleeping Tabs.\r\n\r\nIf the policy 'SleepingTabsEnabled' (Configure Sleeping Tabs) is disabled, this list is not used and no sites will be put to sleep automatically.\r\n\r\nIf you don't configure this policy, all sites will be eligible to be put to sleep unless the user's personal configuration blocks them.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabsblockedforurls_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabsblockedforurls_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabsblockedforurls_recommended_sleepingtabsblockedforurlsdesc","displayName":"Block Sleeping Tabs on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabsenabled_recommended","displayName":"Configure Sleeping Tabs (User)","description":"This policy setting lets you configure whether to turn on Sleeping Tabs. Sleeping Tabs reduces CPU, battery, and memory usage by putting idle background tabs to sleep. Microsoft Edge uses heuristics to avoid putting tabs to sleep that do useful work in the background, such as display notifications, play sound, and stream video. By default, Sleeping Tabs is turned on.\r\n\r\nIndividual sites may be blocked from being put to sleep by configuring the policy 'SleepingTabsBlockedForUrls' (Block Sleeping Tabs on specific sites).\r\n\r\nIf you enable this setting, Sleeping Tabs is turned on.\r\n\r\nIf you disable this setting, Sleeping Tabs is turned off.\r\n\r\nIf you don't configure this setting, users can choose whether to use Sleeping Tabs.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabsenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabsenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabstimeout_recommended","displayName":"Set the background tab inactivity timeout for Sleeping Tabs (User)","description":"This policy setting lets you configure the timeout, in seconds, after which inactive background tabs will be automatically put to sleep if Sleeping Tabs is enabled. By default, this timeout is 7,200 seconds (2 hours).\r\n\r\nTabs are only put to sleep automatically when the policy 'SleepingTabsEnabled' (Configure Sleeping Tabs) is enabled or is not configured and the user has enabled the Sleeping Tabs setting.\r\n\r\nIf you don't configure this policy, users can choose the timeout value.\r\n\r\nPolicy options mapping:\r\n\r\n* 5Minutes (300) = 5 minutes of inactivity\r\n\r\n* 15Minutes (900) = 15 minutes of inactivity\r\n\r\n* 30Minutes (1800) = 30 minutes of inactivity\r\n\r\n* 1Hour (3600) = 1 hour of inactivity\r\n\r\n* 2Hours (7200) = 2 hours of inactivity\r\n\r\n* 3Hours (10800) = 3 hours of inactivity\r\n\r\n* 6Hours (21600) = 6 hours of inactivity\r\n\r\n* 12Hours (43200) = 12 hours of inactivity\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabstimeout_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabstimeout_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout","displayName":"Set the background tab inactivity timeout for Sleeping Tabs (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout_300","displayName":"5 minutes of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout_900","displayName":"15 minutes of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout_1800","displayName":"30 minutes of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout_3600","displayName":"1 hour of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout_7200","displayName":"2 hours of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout_10800","displayName":"3 hours of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout_21600","displayName":"6 hours of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_recommended~sleepingtabs_recommended_sleepingtabstimeout_recommended_sleepingtabstimeout_43200","displayName":"12 hours of inactivity","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_showmicrosoftrewards","displayName":"Show Microsoft Rewards experiences (User)","description":"Show Microsoft Rewards experience and notifications.\r\nIf you enable this policy:\r\n - Microsoft account users (excludes Azure AD accounts) in search and earn markets will see the Microsoft Rewards experience in their Microsoft Edge user profile.\r\n - The setting to enable Microsoft Rewards in Microsoft Edge settings will be enabled and toggled on.\r\n - The setting to enable Give mode will be enabled and respect the user's setting.\r\n\r\nIf you disable this policy:\r\n - Microsoft account users (excludes Azure AD accounts) in search and earn markets will not see the Microsoft Rewards experience in their Microsoft Edge user profile.\r\n - The setting to enable Microsoft Rewards in Microsoft Edge settings will be disabled and toggled off.\r\n\r\nIf you don't configure this policy:\r\n - Microsoft account users (excludes Azure AD accounts) in search and earn markets will see the Microsoft Rewards experience in their Microsoft Edge user profile.\r\n - The setting to enable Microsoft Rewards in Microsoft Edge settings will be enabled and toggled on.\r\n - The setting to enable Give mode will be enabled and respect the user's setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_showmicrosoftrewards_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_showmicrosoftrewards_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_verticaltabsallowed","displayName":"Configures availability of a vertical layout for tabs on the side of the browser (User)","description":"Configures whether a user can access an alternative layout where tabs are vertically aligned on the side of the browser instead of at the top.\r\nWhen there are several tabs open, this layout provides better tab viewing and management. There's better visibility of the site titles,\r\nit's easier to scan aligned icons, and there's more space to manage and close tabs.\r\n\r\nIf you disable this policy, then the vertical tab layout will not be available as an option for users.\r\n\r\nIf you enable or don't configure this policy, the tab layout will still be at the top, but a user has the option to turn on vertical tabs on the side.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_verticaltabsallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_verticaltabsallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_webrtcallowlegacytlsprotocols","displayName":"Allow legacy TLS/DTLS downgrade in WebRTC (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 120.\r\n\r\nIf you enable this policy, WebRTC peer connections can downgrade to obsolete\r\nversions of the TLS/DTLS (DTLS 1.0, TLS 1.0 and TLS 1.1) protocols.\r\nIf you disable or don't set this policy, these TLS/DTLS versions are\r\ndisabled.\r\n\r\nThis policy was removed in Microsoft Edge 121 and is ignored if set.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_webrtcallowlegacytlsprotocols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_webrtcallowlegacytlsprotocols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_webwidgetallowed","displayName":"Enable the Search bar (deprecated) (User)","description":"DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.\r\n\r\nEnables the search bar. When enabled, users can use the search bar to search the web from their desktop or from an application. The search bar provides a search box that shows web suggestions and opens all web searches in Microsoft Edge. The search box provides search (powered by Bing) and URL suggestions. The search bar can be launched from the \"More tools\" menu or jump list in Microsoft Edge.\r\n\r\nIf you enable or don't configure this policy:\r\nThe search bar will be automatically enabled for all profiles.\r\nThe option to enable the search bar at startup will be toggled on if the 'WebWidgetIsEnabledOnStartup' (Allow the Search bar at Windows startup) policy is enabled.\r\nIf the 'WebWidgetIsEnabledOnStartup' is disabled or not configured, the option to enable the search bar at startup will be toggled off.\r\nUsers will see the menu item to launch the search bar from the Microsoft Edge \"More tools\" menu. Users can launch the search bar from \"More tools\".\r\nUsers will see the menu item to launch the search bar from the Microsoft Edge jump list menu. Users can launch the search bar from the Microsoft Edge jump list menu.\r\nThe search bar can be turned off by the \"Quit\" option in the System tray or by closing the search bar from the 3 dot menu. The search bar will be restarted on system reboot if auto-start is enabled.\r\n\r\n\r\nIf you disable this policy:\r\nThe search bar will be disabled for all profiles.\r\nThe option to launch the search bar from Microsoft Edge \"More tools\" menu will be disabled.\r\nThe option to launch the search bar from Microsoft Edge jump list menu will be disabled.\r\n\r\nThis policy is deprecated due to the deprecation of the Web widget's vertical layout. This policy will be made obsolete in 119 release.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_webwidgetallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_webwidgetallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_webwidgetisenabledonstartup","displayName":"Allow the Search bar at Windows startup (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 119.\r\n\r\nThis policy is obsolete due to the deprecation of the Web widget, which is now known as Edge search bar. Admins should use SearchbarIsEnabledOnStartup for Edge search bar instead. Allows the Search bar to start running at Windows startup.\r\n\r\nIf you enable this policy the Search bar will start running at Windows startup by default. If the Search bar is disabled via 'WebWidgetAllowed' (Enable the Search bar) policy, this policy will not start the Search bar on Windows startup.\r\n\r\nIf you disable this policy, the Search bar will not start at Windows startup for all profiles. The option to start the Edge search bar at Windows startup will be disabled and toggled off in Microsoft Edge settings.\r\n\r\nIf you don't configure this policy, the Search bar will not start at Windows startup for all profiles. The option to start the Edge search bar at Windows startup will be toggled off in Microsoft Edge settings.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_webwidgetisenabledonstartup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge_webwidgetisenabledonstartup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~extensions_blockexternalextensions","displayName":"Blocks external extensions from being installed (User)","description":"Control the installation of external extensions.\r\n\r\nIf you enable this setting, external extensions are blocked from being installed.\r\n\r\nIf you disable this setting or leave it unset, external extensions are allowed to be installed.\r\n\r\nExternal extensions and their installation are documented at [Alternate extension distribution methods](/microsoft-edge/extensions-chromium/developer-guide/alternate-distribution-options).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~extensions_blockexternalextensions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~extensions_blockexternalextensions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~performance_startupboostenabled","displayName":"Enable startup boost (User)","description":"Allows Microsoft Edge processes to start at OS sign-in and restart in background after the last browser window is closed.\r\n\r\nIf Microsoft Edge is running in background mode, the browser might not close when the last window is closed and the browser won't be restarted in background when the window closes. See the 'BackgroundModeEnabled' (Continue running background apps after Microsoft Edge closes) policy for information about what happens after configuring Microsoft Edge background mode behavior.\r\n\r\nIf you enable this policy, startup boost is turned on.\r\n\r\nIf you disable this policy, startup boost is turned off.\r\n\r\nIf you don't configure this policy, startup boost may initially be off or on. The user can configure its behavior in edge://settings/system.\r\n\r\nLearn more about startup boost: https://go.microsoft.com/fwlink/?linkid=2147018","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~performance_startupboostenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~performance_startupboostenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~printing_printertypedenylist","displayName":"Disable printer types on the deny list (User)","description":"The printer types on the deny list won't be discovered or have their capabilities fetched.\r\n\r\nPlacing all printer types on the deny list effectively disables printing, because there's no print destination for documents.\r\n\r\nIf you don't configure this policy, or the printer list is empty, all printer types are discoverable.\r\n\r\nPrinter destinations include extension printers and local printers. Extension printers are also known as print provider destinations, and include any destination that belongs to a Microsoft Edge extension.\r\nLocal printers are also known as native printing destinations, and include destinations available to the local machine and shared network printers.\r\n\r\nIn Microsoft version 93 or later, if you set this policy to 'pdf' it also disables the 'save as Pdf' option from the right click context menu.\r\n\r\nIn Microsoft version 103 or later, if you set this policy to 'onedrive' it also disables the 'save as Pdf (OneDrive)' option from print preview.\r\n\r\nPolicy options mapping:\r\n\r\n* privet (privet) = Zeroconf-based (mDNS + DNS-SD) protocol destinations\r\n\r\n* extension (extension) = Extension-based destinations\r\n\r\n* pdf (pdf) = The 'Save as PDF' destination. (93 or later, also disables from context menu)\r\n\r\n* local (local) = Local printer destinations\r\n\r\n* onedrive (onedrive) = Save as PDF (OneDrive) printer destinations. (103 or later)\r\n\r\nUse the preceding information when configuring this policy.\r\n\r\nExample value:\r\n\r\nlocal\r\nprivet","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~printing_printertypedenylist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~printing_printertypedenylist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~printing_printertypedenylist_printertypedenylistdesc","displayName":"Disable printer types on the deny list (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabsblockedforurls","displayName":"Block Sleeping Tabs on specific sites (User)","description":"Define a list of sites, based on URL patterns, that are not allowed to be put to sleep by Sleeping Tabs.\r\n\r\nIf the policy 'SleepingTabsEnabled' (Configure Sleeping Tabs) is disabled, this list is not used and no sites will be put to sleep automatically.\r\n\r\nIf you don't configure this policy, all sites will be eligible to be put to sleep unless the user's personal configuration blocks them.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabsblockedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabsblockedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabsblockedforurls_sleepingtabsblockedforurlsdesc","displayName":"Block Sleeping Tabs on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabsenabled","displayName":"Configure Sleeping Tabs (User)","description":"This policy setting lets you configure whether to turn on Sleeping Tabs. Sleeping Tabs reduces CPU, battery, and memory usage by putting idle background tabs to sleep. Microsoft Edge uses heuristics to avoid putting tabs to sleep that do useful work in the background, such as display notifications, play sound, and stream video. By default, Sleeping Tabs is turned on.\r\n\r\nIndividual sites may be blocked from being put to sleep by configuring the policy 'SleepingTabsBlockedForUrls' (Block Sleeping Tabs on specific sites).\r\n\r\nIf you enable this setting, Sleeping Tabs is turned on.\r\n\r\nIf you disable this setting, Sleeping Tabs is turned off.\r\n\r\nIf you don't configure this setting, users can choose whether to use Sleeping Tabs.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabstimeout","displayName":"Set the background tab inactivity timeout for Sleeping Tabs (User)","description":"This policy setting lets you configure the timeout, in seconds, after which inactive background tabs will be automatically put to sleep if Sleeping Tabs is enabled. By default, this timeout is 7,200 seconds (2 hours).\r\n\r\nTabs are only put to sleep automatically when the policy 'SleepingTabsEnabled' (Configure Sleeping Tabs) is enabled or is not configured and the user has enabled the Sleeping Tabs setting.\r\n\r\nIf you don't configure this policy, users can choose the timeout value.\r\n\r\nPolicy options mapping:\r\n\r\n* 5Minutes (300) = 5 minutes of inactivity\r\n\r\n* 15Minutes (900) = 15 minutes of inactivity\r\n\r\n* 30Minutes (1800) = 30 minutes of inactivity\r\n\r\n* 1Hour (3600) = 1 hour of inactivity\r\n\r\n* 2Hours (7200) = 2 hours of inactivity\r\n\r\n* 3Hours (10800) = 3 hours of inactivity\r\n\r\n* 6Hours (21600) = 6 hours of inactivity\r\n\r\n* 12Hours (43200) = 12 hours of inactivity\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabstimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabstimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabstimeout_sleepingtabstimeout","displayName":"Set the background tab inactivity timeout for Sleeping Tabs (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabstimeout_sleepingtabstimeout_300","displayName":"5 minutes of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabstimeout_sleepingtabstimeout_900","displayName":"15 minutes of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabstimeout_sleepingtabstimeout_1800","displayName":"30 minutes of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabstimeout_sleepingtabstimeout_3600","displayName":"1 hour of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabstimeout_sleepingtabstimeout_7200","displayName":"2 hours of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabstimeout_sleepingtabstimeout_10800","displayName":"3 hours of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabstimeout_sleepingtabstimeout_21600","displayName":"6 hours of inactivity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev88~policy~microsoft_edge~sleepingtabs_sleepingtabstimeout_sleepingtabstimeout_43200","displayName":"12 hours of inactivity","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_browsingdatalifetime","displayName":"Browsing Data Lifetime Settings (User)","description":"Configures browsing data lifetime settings for Microsoft Edge.\r\nThis policy controls the lifetime of selected browsing data. This policy has no effect if Sync is enabled.\r\nThe available data types are the 'browsing_history', 'download_history', 'cookies_and_other_site_data', 'cached_images_and_files', 'password_signin', 'autofill', 'site_settings' and 'hosted_app_data'.\r\nMicrosoft Edge will regularly remove data of selected types that is older than 'time_to_live_in_hours'. Because data deletion only happens at certain intervals, some data might be kept slightly longer but never more than twice its expected 'time_to_live_in_hours'.\r\n\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"data_types\": [\r\n \"browsing_history\"\r\n ], \r\n \"time_to_live_in_hours\": 24\r\n }, \r\n {\r\n \"data_types\": [\r\n \"password_signin\", \r\n \"autofill\"\r\n ], \r\n \"time_to_live_in_hours\": 12\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_browsingdatalifetime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_browsingdatalifetime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_browsingdatalifetime_browsingdatalifetime","displayName":"Browsing Data Lifetime Settings (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_definepreferredlanguages","displayName":"Define an ordered list of preferred languages that websites should display in if the site supports the language (User)","description":"Configures the language variants that Microsoft Edge sends to websites as part of the Accept-Language request HTTP header and prevents users from adding, removing, or changing the order of preferred languages in Microsoft Edge settings. Users who want to change the languages Microsoft Edge displays in or offers to translate pages to will be limited to the languages configured in this policy.\r\n\r\nIf you enable this policy, websites will appear in the first language in the list that they support unless other site-specific logic is used to determine the display language. The language variants defined in this policy override the languages configured as part of the 'SpellcheckLanguage' (Enable specific spellcheck languages) policy.\r\n\r\nIf you don't configure or disable this policy, Microsoft Edge sends websites the user-specified preferred languages as part of the Accept-Language request HTTP header.\r\n\r\nFor detailed information on valid language variants, see https://go.microsoft.com/fwlink/?linkid=2148854.\r\n\r\nExample value: en-US,fr,es","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_definepreferredlanguages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_definepreferredlanguages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_definepreferredlanguages_definepreferredlanguages","displayName":"Define an ordered list of preferred languages that websites should display in if the site supports the language (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_recommended_smartactionsblocklist_recommended","displayName":"Block smart actions for a list of services (User)","description":"List specific services, such as PDFs, that don't show smart actions. (Smart actions are actions like \"define\" which are available in full and mini context menus in Microsoft Edge.)\r\n\r\nIf you enable the policy: :\r\n - The smart action in the mini and full context menu will be disabled for all profiles for services that match the given list.\r\n - Users will not see the smart action in the mini and full context menu on text selection for services that match the given list.\r\n - In Microsoft Edge settings, the smart action in the mini and full context menu will be disabled for services that match the given list.\r\n\r\nIf you disable or don't configure this policy:\r\n - The smart action in the mini and full context menu will be enabled for all profiles.\r\n - Users will see the smart action in the mini and full context menu on text selection.\r\n - In Microsoft Edge settings, the smart action in the mini and full context menu will be enabled.\r\n\r\nPolicy options mapping:\r\n\r\n* smart_actions_pdf (smart_actions_pdf) = Smart actions in PDF\r\n\r\nUse the preceding information when configuring this policy.\r\n\r\nExample value:\r\n\r\nsmart_actions_pdf","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_recommended_smartactionsblocklist_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_recommended_smartactionsblocklist_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_recommended_smartactionsblocklist_recommended_smartactionsblocklistdesc","displayName":"Block smart actions for a list of services (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_showrecommendationsenabled","displayName":"Allow feature recommendations and browser assistance notifications from Microsoft Edge (User)","description":"This setting controls the in-browser assistance notifications which are intended to help users get the most out of Microsoft Edge. This is done by recommending features and by helping them use browser features. These notifications take the form of dialog boxes, flyouts, coach marks and banners in the browser. An example of an assistance notification would be when a user has many tabs opened in the browser. In this instance Microsoft Edge may prompt the user to try out the vertical tabs feature which is designed to give better browser tab management.\r\n\r\nDisabling this policy will stop this message from appearing again even if the user has too many tabs open.\r\n Any features that have been disabled by a management policy are not suggested to users.\r\nIf you enable or don't configure this setting, users will receive recommendations or notifications from Microsoft Edge.\r\n If you disable this setting, users will not receive any recommendations or notifications from Microsoft Edge","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_showrecommendationsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_showrecommendationsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_smartactionsblocklist","displayName":"Block smart actions for a list of services (User)","description":"List specific services, such as PDFs, that don't show smart actions. (Smart actions are actions like \"define\" which are available in full and mini context menus in Microsoft Edge.)\r\n\r\nIf you enable the policy: :\r\n - The smart action in the mini and full context menu will be disabled for all profiles for services that match the given list.\r\n - Users will not see the smart action in the mini and full context menu on text selection for services that match the given list.\r\n - In Microsoft Edge settings, the smart action in the mini and full context menu will be disabled for services that match the given list.\r\n\r\nIf you disable or don't configure this policy:\r\n - The smart action in the mini and full context menu will be enabled for all profiles.\r\n - Users will see the smart action in the mini and full context menu on text selection.\r\n - In Microsoft Edge settings, the smart action in the mini and full context menu will be enabled.\r\n\r\nPolicy options mapping:\r\n\r\n* smart_actions_pdf (smart_actions_pdf) = Smart actions in PDF\r\n\r\nUse the preceding information when configuring this policy.\r\n\r\nExample value:\r\n\r\nsmart_actions_pdf","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_smartactionsblocklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_smartactionsblocklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge_smartactionsblocklist_smartactionsblocklistdesc","displayName":"Block smart actions for a list of services (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge~manageability_mamenabled","displayName":"Mobile App Management Enabled (User)","description":"Allows the Microsoft Edge browser to retrieve policies from the Intune application management services and apply them to users' profiles.\r\n\r\nIf you enable this policy or don't configure it, Mobile App Management (MAM) Policies can be applied.\r\n\r\nIf you disable this policy, Microsoft Edge will not communicate with Intune to request MAM Policies.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge~manageability_mamenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge~manageability_mamenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge~printing_printingallowedbackgroundgraphicsmodes","displayName":"Restrict background graphics printing mode (User)","description":"Restricts background graphics printing mode. If this policy isn't set there's no restriction on printing background graphics.\r\n\r\nPolicy options mapping:\r\n\r\n* any (any) = Allow printing with and without background graphics\r\n\r\n* enabled (enabled) = Allow printing only with background graphics\r\n\r\n* disabled (disabled) = Allow printing only without background graphics\r\n\r\nUse the preceding information when configuring this policy.\r\n\r\nExample value: enabled","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge~printing_printingallowedbackgroundgraphicsmodes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge~printing_printingallowedbackgroundgraphicsmodes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge~printing_printingallowedbackgroundgraphicsmodes_printingallowedbackgroundgraphicsmodes","displayName":"Restrict background graphics printing mode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge~printing_printingallowedbackgroundgraphicsmodes_printingallowedbackgroundgraphicsmodes_any","displayName":"Allow printing with and without background graphics","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge~printing_printingallowedbackgroundgraphicsmodes_printingallowedbackgroundgraphicsmodes_enabled","displayName":"Allow printing only with background graphics","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge~printing_printingallowedbackgroundgraphicsmodes_printingallowedbackgroundgraphicsmodes_disabled","displayName":"Allow printing only without background graphics","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge~printing_printingbackgroundgraphicsdefault","displayName":"Default background graphics printing mode (User)","description":"Overrides the last used setting for printing background graphics.\r\nIf you enable this setting, background graphics printing is enabled.\r\nIf you disable this setting, background graphics printing is disabled.\r\n\r\nPolicy options mapping:\r\n\r\n* enabled (enabled) = Enable background graphics printing mode by default\r\n\r\n* disabled (disabled) = Disable background graphics printing mode by default\r\n\r\nUse the preceding information when configuring this policy.\r\n\r\nExample value: enabled","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge~printing_printingbackgroundgraphicsdefault_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge~printing_printingbackgroundgraphicsdefault_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge~printing_printingbackgroundgraphicsdefault_printingbackgroundgraphicsdefault","displayName":"Default background graphics printing mode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge~printing_printingbackgroundgraphicsdefault_printingbackgroundgraphicsdefault_enabled","displayName":"Enable background graphics printing mode by default","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev89~policy~microsoft_edge~printing_printingbackgroundgraphicsdefault_printingbackgroundgraphicsdefault_disabled","displayName":"Disable background graphics printing mode by default","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge_fetchkeepalivedurationsecondsonshutdown","displayName":"Fetch keepalive duration on shutdown (User)","description":"Controls the duration (in seconds) that keepalive requests are allowed to prevent the browser from completing its shutdown.\r\n\r\nIf you configure this policy, the browser will block completing shutdown while it processes any outstanding keepalive requests (see https://fetch.spec.whatwg.org/#request-keepalive-flag) up to the maximum period of time specified by this policy.\r\n\r\nIf you disable or don't configure this policy, the default value of 0 seconds is used and outstanding keepalive requests will be immediately cancelled during browser shutdown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge_fetchkeepalivedurationsecondsonshutdown_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge_fetchkeepalivedurationsecondsonshutdown_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge_fetchkeepalivedurationsecondsonshutdown_fetchkeepalivedurationsecondsonshutdown","displayName":"Fetch keepalive duration on shutdown: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge_managedconfigurationperorigin","displayName":"Sets managed configuration values for websites to specific origins (User)","description":"Setting this policy defines the return value of Managed Configuration API for given origin.\r\n\r\nManaged Configuration API is a key-value configuration that can be accessed via navigator.device.getManagedConfiguration() javascript call. This API is only available to origins which correspond to force-installed web applications via 'WebAppInstallForceList' (Configure list of force-installed Web Apps).\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"managed_configuration_hash\": \"asd891jedasd12ue9h\",\r\n \"managed_configuration_url\": \"https://static.contoso.com/configuration.json\",\r\n \"origin\": \"https://www.contoso.com\"\r\n },\r\n {\r\n \"managed_configuration_hash\": \"djio12easd89u12aws\",\r\n \"managed_configuration_url\": \"https://static.contoso.com/configuration2.json\",\r\n \"origin\": \"https://www.example.com\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge_managedconfigurationperorigin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge_managedconfigurationperorigin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge_managedconfigurationperorigin_managedconfigurationperorigin","displayName":"Sets managed configuration values for websites to specific origins (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge_quickviewofficefilesenabled","displayName":"Manage QuickView Office files capability in Microsoft Edge (User)","description":"Allows you to set whether users can view publicly accessible Office files on the web that aren't on OneDrive or SharePoint. (For example: Word documents, PowerPoint presentations, and Excel spreadsheets)\r\n\r\nIf you enable or don't configure this policy, these files can be viewed in Microsoft Edge using Office Viewer instead of downloading the files.\r\n\r\nIf you disable this policy, these files will be downloaded to be viewed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge_quickviewofficefilesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge_quickviewofficefilesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge_recommended~httpauthentication_recommended_windowshelloforhttpauthenabled_recommended","displayName":"Windows Hello For HTTP Auth Enabled (User)","description":"Indicates if Windows Credential UI should be used to respond to NTLM and Negotiate authentication challenges.\r\n\r\nIf you disable this policy, a basic username and password prompt will be used to respond to NTLM and Negotiate challenges. If you enable or don't configure this policy, Windows Credential UI will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge_recommended~httpauthentication_recommended_windowshelloforhttpauthenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge_recommended~httpauthentication_recommended_windowshelloforhttpauthenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge_sslerroroverrideallowedfororigins","displayName":"Allow users to proceed from the HTTPS warning page for specific origins (User)","description":"Microsoft Edge shows a warning page when users visit sites that have SSL errors.\r\n\r\nIf you enable or don't configure the 'SSLErrorOverrideAllowed' (Allow users to proceed from the HTTPS warning page) policy, this policy does nothing.\r\n\r\nIf you disable the 'SSLErrorOverrideAllowed' policy, configuring this policy lets you configure a list of origin patterns for sites where users can continue to click through SSL error pages. Users can't click through SSL error pages on origins that are not on this list.\r\n\r\nIf you don't configure this policy, the 'SSLErrorOverrideAllowed' policy applies for all sites.\r\n\r\nFor detailed information about valid origin patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy. This policy only matches based on origin, so any path or query in the URL pattern is ignored.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge_sslerroroverrideallowedfororigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge_sslerroroverrideallowedfororigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge_sslerroroverrideallowedfororigins_sslerroroverrideallowedfororiginsdesc","displayName":"Allow users to proceed from the HTTPS warning page for specific origins (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge~applicationguard_applicationguardfavoritessyncenabled","displayName":"Application Guard Favorites Sync Enabled (User)","description":"This policy allows Microsoft Edge computers/devices that have application guard enabled to sync favorites from the host to the container so the favorites match.\r\n\r\nIf 'ManagedFavorites' (Configure favorites) are configured, those favorites will also be synced to the container.\r\n\r\nIf you enable this policy, editing favorites in the container is disabled. So, the add favorites and add favorites folder buttons will be blurred out in the UI of the container browser.\r\n\r\nIf you disable or don't configure this policy, favorites on the host will not be shared to the container.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge~applicationguard_applicationguardfavoritessyncenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge~applicationguard_applicationguardfavoritessyncenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge~httpauthentication_windowshelloforhttpauthenabled","displayName":"Windows Hello For HTTP Auth Enabled (User)","description":"Indicates if Windows Credential UI should be used to respond to NTLM and Negotiate authentication challenges.\r\n\r\nIf you disable this policy, a basic username and password prompt will be used to respond to NTLM and Negotiate challenges. If you enable or don't configure this policy, Windows Credential UI will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge~httpauthentication_windowshelloforhttpauthenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge~httpauthentication_windowshelloforhttpauthenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge~printing_printrasterizationmode","displayName":"Print Rasterization Mode (User)","description":"Controls how Microsoft Edge prints on Windows.\r\n\r\nWhen printing to a non-PostScript printer on Windows, sometimes print jobs need to be rasterized to print correctly.\r\n\r\nIf you set this policy to 'Full' or don't configure it, Microsoft Edge will do full page rasterization if necessary.\r\n\r\nIf you set this policy to 'Fast', Microsoft Edge will reduce the amount of rasterization which can help reduce print job sizes and increase printing speed.\r\n\r\nPolicy options mapping:\r\n\r\n* Full (0) = Full page rasterization\r\n\r\n* Fast (1) = Avoid rasterization if possible\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge~printing_printrasterizationmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge~printing_printrasterizationmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge~printing_printrasterizationmode_printrasterizationmode","displayName":"Print Rasterization Mode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge~printing_printrasterizationmode_printrasterizationmode_0","displayName":"Full page rasterization","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev90~policy~microsoft_edge~printing_printrasterizationmode_printrasterizationmode_1","displayName":"Avoid rasterization if possible","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge_explicitlyallowednetworkports","displayName":"Explicitly allowed network ports (User)","description":"There is a list of restricted ports built into Microsoft Edge. Connections to these ports will fail. This policy allows bypassing that list. The set of ports is defined as a comma-separated list that outgoing connections should be permitted on.\r\n\r\nPorts are restricted to prevent Microsoft Edge from being used as a vector to exploit various network vulnerabilities. Setting this policy may expose your network to attacks. This policy is intended as a temporary workaround for error code \"ERR_UNSAFE_PORT\" while migrating a service running on a blocked port to a standard port (for example port 80 or 443).\r\n\r\nMalicious websites can easily detect that this policy is set, and for which ports, then use that information to target attacks.\r\n\r\nEach port listed in this policy is labeled with a date that it can be unblocked until. After that date the port will be restricted regardless of if it's specified by the value of this policy.\r\n\r\nLeaving the value empty or unset means that all restricted ports will be blocked. Invalid port values set through this policy will be ignored while valid ones will still be applied.\r\n\r\nThis policy overrides the \"--explicitly-allowed-ports\" command-line option.\r\n\r\nPolicy options mapping:\r\n\r\n* 554 (554) = port 554 (can be unblocked until 2021/10/15)\r\n\r\n* 10080 (10080) = port 10080 (can be unblocked until 2022/04/01)\r\n\r\n* 6566 (6566) = port 6566 (can be unblocked until 2021/10/15)\r\n\r\n* 989 (989) = port 989 (can be unblocked until 2022/02/01)\r\n\r\n* 990 (990) = port 990 (can be unblocked until 2022/02/01)\r\n\r\nUse the preceding information when configuring this policy.\r\n\r\nExample value:\r\n\r\n10080","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge_explicitlyallowednetworkports_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge_explicitlyallowednetworkports_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge_explicitlyallowednetworkports_explicitlyallowednetworkportsdesc","displayName":"Explicitly allowed network ports (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge_importstartuppagesettings","displayName":"Allow importing of startup page settings (User)","description":"Allows users to import Startup settings from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the Startup settings are always imported.\r\n\r\nIf you disable this policy, startup settings are not imported at first run or at manual import.\r\n\r\nIf you don't configure this policy, startup settings are imported at first run, and users can choose whether to import this data manually by selecting browser settings option during later browsing sessions.\r\n\r\nYou can set this policy as a recommendation. This means that Microsoft Edge will import startup settings on first run, but users can select or clear **browser settings** option during manual import.\r\n\r\n**Note**: This policy currently manages importing from Microsoft Edge Legacy and Google Chrome (on Windows 7, 8, and 10) browsers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge_importstartuppagesettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge_importstartuppagesettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge_mathsolverenabled","displayName":"Let users snip a Math problem and get the solution with a step-by-step explanation in Microsoft Edge (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 125.\r\n\r\nThis policy is obsoleted because Math Solver is deprecated from Edge. This policy won't work in Microsoft Edge version 126. This policy lets you manage whether users can use the Math Solver tool in Microsoft Edge or not.\r\n\r\nIf you enable or don't configure the policy, then a user can take a snip of the Math problem and get the solution including a step-by-step explanation of the solution in a Microsoft Edge side pane.\r\n\r\nIf you disable the policy, then the Math Solver tool will be disabled and users will not be able to use it.\r\n\r\nNote: Setting the 'ComponentUpdatesEnabled' (Enable component updates in Microsoft Edge) policy to disabled will also disable the Math Solver component.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge_mathsolverenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge_mathsolverenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge_recommended_importstartuppagesettings_recommended","displayName":"Allow importing of startup page settings (User)","description":"Allows users to import Startup settings from another browser into Microsoft Edge.\r\n\r\nIf you enable this policy, the Startup settings are always imported.\r\n\r\nIf you disable this policy, startup settings are not imported at first run or at manual import.\r\n\r\nIf you don't configure this policy, startup settings are imported at first run, and users can choose whether to import this data manually by selecting browser settings option during later browsing sessions.\r\n\r\nYou can set this policy as a recommendation. This means that Microsoft Edge will import startup settings on first run, but users can select or clear **browser settings** option during manual import.\r\n\r\n**Note**: This policy currently manages importing from Microsoft Edge Legacy and Google Chrome (on Windows 7, 8, and 10) browsers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge_recommended_importstartuppagesettings_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge_recommended_importstartuppagesettings_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge~applicationguard_applicationguardtrafficidentificationenabled","displayName":"Application Guard Traffic Identification (User)","description":"If you enable or don't configure this policy, Application Guard will add an extra HTTP header (X-MS-ApplicationGuard-Initiated) to all outbound HTTP requests made from the Application Guard container.\r\n\r\nIf you disable this policy, the extra header is not added to the traffic.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge~applicationguard_applicationguardtrafficidentificationenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge~applicationguard_applicationguardtrafficidentificationenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge~startup_newtabpagecontentenabled","displayName":"Allow Microsoft content on the new tab page (User)","description":"This policy applies for Microsoft Edge to all profile types, namely unsigned local user profiles, profiles signed in using a Microsoft Account, profiles signed in using Active Directory and profiles signed in using Microsoft Entra ID. The Enterprise new tab page for profiles signed in using Microsoft Entra ID can be configured in the M365 admin portal, but this policy setting takes precedence, so any M365 admin portal configurations will be ignored.\r\n\r\nIf you enable or don't configure this policy, Microsoft Edge displays Microsoft content on the new tab page. The user can choose different display options for the content. These options include, but aren't limited to: Content off, Content visible on scroll, Headings only, and Content visible. Enabling this policy doesn't force content to be visible - the user can keep setting their own preferred content position.\r\n\r\nIf you disable this policy, Microsoft Edge doesn't display Microsoft content on the new tab page, the Content control in the NTP settings flyout is disabled and set to \"Content off\", and the Layout control in the NTP settings flyout is disabled and set to \"Custom\".\r\n\r\nRelated policies: 'NewTabPageAllowedBackgroundTypes' (Configure the background types allowed for the new tab page layout), 'NewTabPageQuickLinksEnabled' (Allow quick links on the new tab page)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge~startup_newtabpagecontentenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge~startup_newtabpagecontentenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge~startup_newtabpagequicklinksenabled","displayName":"Allow quick links on the new tab page (User)","description":"If you enable or don't configure this policy, Microsoft Edge displays quick links on the new tab page, and the user can interact with the control, turning quick links on and off. Enabling this policy does not force quick links to be visible - the user can continue to turn quick links on and off.\r\n\r\nIf you disable this policy, Microsoft Edge hides quick links on the new tab page and disables the quick links control in the NTP settings flyout.\r\n\r\nThis policy only applies for Microsoft Edge local user profiles, profiles signed in using a Microsoft Account, and profiles signed in using Active Directory. To configure the Enterprise new tab page for profiles signed in using Azure Active Directory, use the M365 admin portal.\r\n\r\nRelated policies: 'NewTabPageAllowedBackgroundTypes' (Configure the background types allowed for the new tab page layout), 'NewTabPageContentEnabled' (Allow Microsoft content on the new tab page)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge~startup_newtabpagequicklinksenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev91~policy~microsoft_edge~startup_newtabpagequicklinksenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_aadwebsitessousingthisprofileenabled","displayName":"Single sign-on for work or school sites using this profile enabled (User)","description":"'Allow single sign-on for work or school sites using this profile' option allows non-AAD profiles to be able to use single sign-on for work or school sites using work or school credentials present on the machine. This option shows up for end-users as a toggle in Settings -> Profiles -> Profile Preferences for non-AAD profiles only.\r\n\r\nIf you disable this policy, non-AAD profiles will not be able to use SSO using other credentials present on the machine. This will also ensure that 'Intelligent enablement of Single sign-on (SSO) for all Windows Azure Active Directory (Azure AD) accounts for users with a single non-Azure AD Microsoft Edge profile' is turned off.\r\n\r\nIf you enable this policy or don't configure it, non-AAD profiles will be able to use SSO using other credentials present on the machine and 'Intelligent enablement of Single sign-on (SSO) for all Windows Azure Active Directory (Azure AD) accounts for users with a single non-Azure AD Microsoft Edge profile' will continue working.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_aadwebsitessousingthisprofileenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_aadwebsitessousingthisprofileenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_automatichttpsdefault","displayName":"Configure Automatic HTTPS (User)","description":"This policy lets you manage settings for 'AutomaticHttpsDefault' (Configure Automatic HTTPS), which switches connections from HTTP to HTTPS.\r\n\r\nThis feature helps protect against man-in-the-middle attacks by enforcing more secure connections, but users might experience more connection errors.\r\n\r\nNote: The 'UpgradeCapableDomains' configuration requires a component list, and will not upgrade these connections if 'ComponentUpdatesEnabled' (Enable component updates in Microsoft Edge) is set to 'Disabled'.\r\n\r\nIf you don't configure this policy, 'AutomaticHttpsDefault' will be enabled, and will only upgrade connections on domains likely to support HTTPS.\r\n\r\nPolicy options mapping:\r\n\r\n* DisableAutomaticHttps (0) = Automatic HTTPS functionality is disabled.\r\n\r\n* UpgradeCapableDomains (1) = Navigations delivered over HTTP are switched to HTTPS, only on domains likely to support HTTPS.\r\n\r\n* AlwaysUpgrade (2) = All navigations delivered over HTTP are switched to HTTPS. Connection errors might occur more often.\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_automatichttpsdefault_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_automatichttpsdefault_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_automatichttpsdefault_automatichttpsdefault","displayName":"Configure Automatic HTTPS (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_automatichttpsdefault_automatichttpsdefault_0","displayName":"Automatic HTTPS functionality is disabled.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_automatichttpsdefault_automatichttpsdefault_1","displayName":"Navigations delivered over HTTP are switched to HTTPS, only on domains likely to support HTTPS.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_automatichttpsdefault_automatichttpsdefault_2","displayName":"All navigations delivered over HTTP are switched to HTTPS. Connection errors might occur more often.","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_headlessmodeenabled","displayName":"Control use of the Headless Mode (User)","description":"This policy setting lets you decide whether users can launch Microsoft Edge in headless mode.\r\n\r\nIf you enable or don't configure this policy, Microsoft Edge allows use of the headless mode.\r\n\r\nIf you disable this policy, Microsoft Edge denies use of the headless mode.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_headlessmodeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_headlessmodeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_internetexplorerintegrationlocalsitelistexpirationdays","displayName":"Specify the number of days that a site remains on the local IE mode site list (User)","description":"If the 'InternetExplorerIntegrationReloadInIEModeAllowed' (Allow unconfigured sites to be reloaded in Internet Explorer mode) policy is enabled or not configured, users will be able to tell Microsoft Edge to load specific pages in Internet Explorer mode for a limited number of days.\r\n\r\nYou can use this setting to determine how many days that configuration is remembered in the browser. After this period has elapsed, the individual page will no longer automatically load in IE mode.\r\n\r\nIf you disable the 'InternetExplorerIntegrationReloadInIEModeAllowed' policy, this policy has no effect.\r\n\r\nIf you disable or don't configure this policy, the default value of 30 days is used.\r\n\r\nIf you enable this policy, you must enter the number of days for which the sites are retained on the user's local site list in Microsoft Edge. The value can be from 0 to 90 days.\r\n\r\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_internetexplorerintegrationlocalsitelistexpirationdays_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_internetexplorerintegrationlocalsitelistexpirationdays_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_internetexplorerintegrationlocalsitelistexpirationdays_internetexplorerintegrationlocalsitelistexpirationdays","displayName":"Specify the number of days that a site remains on the local IE mode site list: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_internetexplorerintegrationreloadiniemodeallowed","displayName":"Allow unconfigured sites to be reloaded in Internet Explorer mode (User)","description":"This policy allows users to reload unconfigured sites (that are not configured in the Enterprise Mode Site List) in Internet Explorer mode when browsing in Microsoft Edge and a site requires Internet Explorer for compatibility.\r\n\r\nAfter a site has been reloaded in Internet Explorer mode, \"in-page\" navigations will stay in Internet Explorer mode (for example, a link, script, or form on the page, or a server-side redirect from another \"in-page\" navigation). Users can choose to exit from Internet Explorer mode, or Microsoft Edge will automatically exit from Internet Explorer mode when a navigation that isn't \"in-page\" occurs (for example, using the address bar, the back button, or a favorite link).\r\n\r\nUsers can also optionally tell Microsoft Edge to use Internet Explorer mode for the site in the future. This choice will be remembered for a length of time managed by the 'InternetExplorerIntegrationLocalSiteListExpirationDays' (Specify the number of days that a site remains on the local IE mode site list) policy.\r\n\r\nIf the 'InternetExplorerIntegrationLevel' (Configure Internet Explorer integration) policy is set to 'IEMode', then sites explicitly configured by the 'InternetExplorerIntegrationSiteList' (Configure the Enterprise Mode Site List) policy's site list to use Microsoft Edge can't be reloaded in Internet Explorer mode, and sites configured by the site list or by the 'SendIntranetToInternetExplorer' (Send all intranet sites to Internet Explorer) policy to use Internet Explorer mode can't exit from Internet Explorer mode.\r\n\r\nIf you enable this policy, users are allowed to reload unconfigured sites in Internet Explorer mode.\r\n\r\nIf you disable this policy, users aren't allowed to reload unconfigured sites in Internet Explorer mode.\r\n\r\nNote that if you enable this policy, it takes precedence over how you configured the 'InternetExplorerIntegrationTestingAllowed' (Allow Internet Explorer mode testing) policy, and that policy will be disabled.\r\n\r\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_internetexplorerintegrationreloadiniemodeallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_internetexplorerintegrationreloadiniemodeallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_recommended_aadwebsitessousingthisprofileenabled_recommended","displayName":"Single sign-on for work or school sites using this profile enabled (User)","description":"'Allow single sign-on for work or school sites using this profile' option allows non-AAD profiles to be able to use single sign-on for work or school sites using work or school credentials present on the machine. This option shows up for end-users as a toggle in Settings -> Profiles -> Profile Preferences for non-AAD profiles only.\r\n\r\nIf you disable this policy, non-AAD profiles will not be able to use SSO using other credentials present on the machine. This will also ensure that 'Intelligent enablement of Single sign-on (SSO) for all Windows Azure Active Directory (Azure AD) accounts for users with a single non-Azure AD Microsoft Edge profile' is turned off.\r\n\r\nIf you enable this policy or don't configure it, non-AAD profiles will be able to use SSO using other credentials present on the machine and 'Intelligent enablement of Single sign-on (SSO) for all Windows Azure Active Directory (Azure AD) accounts for users with a single non-Azure AD Microsoft Edge profile' will continue working.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_recommended_aadwebsitessousingthisprofileenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_recommended_aadwebsitessousingthisprofileenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_recommended_automatichttpsdefault_recommended","displayName":"Configure Automatic HTTPS (User)","description":"This policy lets you manage settings for 'AutomaticHttpsDefault' (Configure Automatic HTTPS), which switches connections from HTTP to HTTPS.\r\n\r\nThis feature helps protect against man-in-the-middle attacks by enforcing more secure connections, but users might experience more connection errors.\r\n\r\nNote: The 'UpgradeCapableDomains' configuration requires a component list, and will not upgrade these connections if 'ComponentUpdatesEnabled' (Enable component updates in Microsoft Edge) is set to 'Disabled'.\r\n\r\nIf you don't configure this policy, 'AutomaticHttpsDefault' will be enabled, and will only upgrade connections on domains likely to support HTTPS.\r\n\r\nPolicy options mapping:\r\n\r\n* DisableAutomaticHttps (0) = Automatic HTTPS functionality is disabled.\r\n\r\n* UpgradeCapableDomains (1) = Navigations delivered over HTTP are switched to HTTPS, only on domains likely to support HTTPS.\r\n\r\n* AlwaysUpgrade (2) = All navigations delivered over HTTP are switched to HTTPS. Connection errors might occur more often.\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_recommended_automatichttpsdefault_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_recommended_automatichttpsdefault_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_recommended_automatichttpsdefault_recommended_automatichttpsdefault","displayName":"Configure Automatic HTTPS (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_recommended_automatichttpsdefault_recommended_automatichttpsdefault_0","displayName":"Automatic HTTPS functionality is disabled.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_recommended_automatichttpsdefault_recommended_automatichttpsdefault_1","displayName":"Navigations delivered over HTTP are switched to HTTPS, only on domains likely to support HTTPS.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_recommended_automatichttpsdefault_recommended_automatichttpsdefault_2","displayName":"All navigations delivered over HTTP are switched to HTTPS. Connection errors might occur more often.","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_recommended_internetexplorerintegrationreloadiniemodeallowed_recommended","displayName":"Allow unconfigured sites to be reloaded in Internet Explorer mode (User)","description":"This policy allows users to reload unconfigured sites (that are not configured in the Enterprise Mode Site List) in Internet Explorer mode when browsing in Microsoft Edge and a site requires Internet Explorer for compatibility.\r\n\r\nAfter a site has been reloaded in Internet Explorer mode, \"in-page\" navigations will stay in Internet Explorer mode (for example, a link, script, or form on the page, or a server-side redirect from another \"in-page\" navigation). Users can choose to exit from Internet Explorer mode, or Microsoft Edge will automatically exit from Internet Explorer mode when a navigation that isn't \"in-page\" occurs (for example, using the address bar, the back button, or a favorite link).\r\n\r\nUsers can also optionally tell Microsoft Edge to use Internet Explorer mode for the site in the future. This choice will be remembered for a length of time managed by the 'InternetExplorerIntegrationLocalSiteListExpirationDays' (Specify the number of days that a site remains on the local IE mode site list) policy.\r\n\r\nIf the 'InternetExplorerIntegrationLevel' (Configure Internet Explorer integration) policy is set to 'IEMode', then sites explicitly configured by the 'InternetExplorerIntegrationSiteList' (Configure the Enterprise Mode Site List) policy's site list to use Microsoft Edge can't be reloaded in Internet Explorer mode, and sites configured by the site list or by the 'SendIntranetToInternetExplorer' (Send all intranet sites to Internet Explorer) policy to use Internet Explorer mode can't exit from Internet Explorer mode.\r\n\r\nIf you enable this policy, users are allowed to reload unconfigured sites in Internet Explorer mode.\r\n\r\nIf you disable this policy, users aren't allowed to reload unconfigured sites in Internet Explorer mode.\r\n\r\nNote that if you enable this policy, it takes precedence over how you configured the 'InternetExplorerIntegrationTestingAllowed' (Allow Internet Explorer mode testing) policy, and that policy will be disabled.\r\n\r\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_recommended_internetexplorerintegrationreloadiniemodeallowed_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge_recommended_internetexplorerintegrationreloadiniemodeallowed_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge~privatenetworkrequestsettings_insecureprivatenetworkrequestsallowed","displayName":"Specifies whether to allow insecure websites to make requests to more-private network endpoints (User)","description":"Controls whether insecure websites are allowed to make requests to more-private network endpoints.\r\n\r\nThis policy relates to the CORS-RFC1918 specification. See https://wicg.github.io/cors-rfc1918 for more details.\r\n\r\nA network endpoint is more private than another if:\r\n1) Its IP address is localhost and the other is not.\r\n2) Its IP address is private and the other is public.\r\nIn the future, depending on spec evolution, this policy might apply to all cross-origin requests directed at private IPs or localhost.\r\n\r\nA website is deemed secure if it meets the definition of a secure context in https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts. Otherwise, it will be treated as an insecure context.\r\n\r\nWhen this policy is either not set or set to false, the default behavior for requests from insecure contexts to more-private network endpoints will depend on the user's personal configuration for the BlockInsecurePrivateNetworkRequests feature, which may be set by a field trial or on the command line.\r\n\r\nWhen this policy is set to true, insecure websites are allowed to make requests to any network endpoint, subject to other cross-origin checks.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge~privatenetworkrequestsettings_insecureprivatenetworkrequestsallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge~privatenetworkrequestsettings_insecureprivatenetworkrequestsallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge~privatenetworkrequestsettings_insecureprivatenetworkrequestsallowedforurls","displayName":"Allow the listed sites to make requests to more-private network endpoints from insecure contexts (User)","description":"List of URL patterns. Private network requests initiated from insecure websites served by matching origins are allowed.\r\n\r\nIf this policy is not set, this policy behaves as if set to the empty list.\r\n\r\nFor origins not covered by the patterns specified here, the global default value will be used either from the 'InsecurePrivateNetworkRequestsAllowed' (Specifies whether to allow insecure websites to make requests to more-private network endpoints) policy, if it is set, or the user's personal configuration otherwise.\r\n\r\nNote that this policy only affects insecure origins, so secure origins (e.g. https://example.com) included in this list will be ignored.\r\n\r\nFor detailed information on valid URL patterns, please see https://docs.microsoft.com/en-us/DeployEdge/edge-learnmmore-url-list-filter%20format.\r\n\r\nExample value:\r\n\r\nhttp://www.example.com:8080\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge~privatenetworkrequestsettings_insecureprivatenetworkrequestsallowedforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge~privatenetworkrequestsettings_insecureprivatenetworkrequestsallowedforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev92~policy~microsoft_edge~privatenetworkrequestsettings_insecureprivatenetworkrequestsallowedforurls_insecureprivatenetworkrequestsallowedforurlsdesc","displayName":"Allow the listed sites to make requests to more-private network endpoints from insecure contexts (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93.1~policy~microsoft_edge~passwordmanager_primarypasswordsetting","displayName":"Configures a setting that asks users to enter their device password while using password autofill (User)","description":"The feature helps users add an additional layer of privacy to their online accounts by requiring device authentication (as a way of confirming the user's identity) before the saved password is auto-filled into a web form. This ensures that non-authorized persons can't use saved passwords for autofill.\r\n\r\nThis group policy configures the radio button selector that enables this feature for users. It also has a frequency control where users can specify how often they would like to be prompted for authentication.\r\n\r\nIf you set this policy to 'Automatically', disable this policy, or don't configure this policy, autofill will not have any authentication flow.\r\n\r\nIf you set this policy to 'WithDevicePassword', users will have to enter their device password (or preferred mode of authentication under Windows) to prove their identity before their password is auto filled. Authentication modes include Windows Hello, PIN, face recognition, or fingerprint. The frequency for authentication prompt will be set to 'Always' by default. However, users can change it to the other option, which is 'Once every browsing session'.\r\n\r\nIf you set this policy to 'WithCustomPrimaryPassword', users will be asked to create their custom password and then to be redirected to Settings. After the custom password is set, users can authenticate themselves using the custom password and their passwords will get auto-filled after successful authentication. The frequency for authentication prompt will be set to 'Always' by default. However, users can change it to the other option, which is 'Once every browsing session'.\r\n\r\nIf you set this policy to 'AutofillOff', saved passwords will no longer be suggested for autofill.\r\n\r\nPolicy options mapping:\r\n\r\n* Automatically (0) = Automatically\r\n\r\n* WithDevicePassword (1) = With device password\r\n\r\n* WithCustomPrimaryPassword (2) = With custom primary password\r\n\r\n* AutofillOff (3) = Autofill off\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93.1~policy~microsoft_edge~passwordmanager_primarypasswordsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93.1~policy~microsoft_edge~passwordmanager_primarypasswordsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93.1~policy~microsoft_edge~passwordmanager_primarypasswordsetting_primarypasswordsetting","displayName":"Configures a setting that asks users to enter their device password while using password autofill (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93.1~policy~microsoft_edge~passwordmanager_primarypasswordsetting_primarypasswordsetting_0","displayName":"Automatically","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93.1~policy~microsoft_edge~passwordmanager_primarypasswordsetting_primarypasswordsetting_1","displayName":"With device password","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93.1~policy~microsoft_edge~passwordmanager_primarypasswordsetting_primarypasswordsetting_2","displayName":"With custom primary password","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93.1~policy~microsoft_edge~passwordmanager_primarypasswordsetting_primarypasswordsetting_3","displayName":"Autofill off","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_autoplayallowlist","displayName":"Allow media autoplay on specific sites (User)","description":"Define a list of sites, based on URL patterns, that are allowed to autoplay media.\r\n\r\nIf you don't configure this policy, the global default value from the 'AutoplayAllowed' (Allow media autoplay for websites) policy (if set) or the user's personal configuration is used for all sites.\r\n\r\nFor detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.\r\n\r\nNote: * is not an accepted value for this policy.\r\n\r\nExample value:\r\n\r\nhttps://www.contoso.com\r\n[*.]contoso.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_autoplayallowlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_autoplayallowlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_autoplayallowlist_autoplayallowlistdesc","displayName":"Allow media autoplay on specific sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_cecpq2enabled","displayName":"CECPQ2 post-quantum key-agreement enabled for TLS (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 113.\r\n\r\nThis policy was removed in Microsoft Edge 114 and is ignored if set. It served to disable CECPQ2, but CECPQ2 has been disabled by default. A separate policy will be introduced to control the rollout of the replacement of CECPQ2. That replacement will be a combination of the standard key-agreement X25519 with NIST's chosen post-quantum KEM, called \"Kyber\".\r\n\r\nIf this policy is not configured, or is set to enabled, then Microsoft Edge will follow the default rollout process for CECPQ2, a post-quantum key-agreement algorithm in TLS.\r\n\r\nCECPQ2 results in larger TLS messages which, in very rare cases, can trigger bugs in some networking hardware. This policy can be set to False to disable CECPQ2 while networking issues are resolved.\r\n\r\nThis policy is a temporary measure and will be removed in future versions of Microsoft Edge.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_cecpq2enabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_cecpq2enabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_configureviewinfileexplorer","displayName":"Configure the View in File Explorer feature for SharePoint pages in Microsoft Edge (User)","description":"This setting allows you to configure the View in File Explorer capability for file management in SharePoint Online while using Microsoft Edge.\r\n\r\nYou will need to list the specific domains where this is allowed and list cookies needed for SharePoint authentication (rtFa and FedAuth).\r\n\r\nBehind the scenes, the policy allows URLs with the viewinfileexplorer: scheme to open WebDAV URLs in Windows File Explorer on pages matching the list of domains and uses the cookies you specified for WebDAV authentication.\r\n\r\nIf you enable this policy, you can use the \"View in File Explorer\" feature on the SharePoint document libraries you list. You will need to specify the SharePoint domain and authentication cookies. See example value below.\r\n\r\nIf you disable or don't configure this policy, you cannot use the \"View in File Explorer\" feature on SharePoint document libraries.\r\n\r\nNote that while this is an available option through Microsoft Edge, rather than use the View in File Explorer option, the recommended approach to managing files and folders outside of SharePoint is to sync your SharePoint files or move or copy files in SharePoint.\r\nSync your SharePoint files: https://go.microsoft.com/fwlink/p/?linkid=2166983\r\nMove or copy files in SharePoint: https://go.microsoft.com/fwlink/p/?linkid=2167123\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, or Windows 10 Pro or Enterprise instances enrolled for device management.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"cookies\": [\r\n \"rtFa\",\r\n \"FedAuth\"\r\n ],\r\n \"domain\": \"contoso.sharepoint.com\"\r\n },\r\n {\r\n \"cookies\": [\r\n \"rtFa\",\r\n \"FedAuth\"\r\n ],\r\n \"domain\": \"contoso2.sharepoint.com\"\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_configureviewinfileexplorer_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_configureviewinfileexplorer_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_configureviewinfileexplorer_configureviewinfileexplorer","displayName":"Configure the View in File Explorer feature for SharePoint pages in Microsoft Edge (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_internetexplorerintegrationcloudsitelist","displayName":"Configure the Enterprise Mode Cloud Site List (User)","description":"The Microsoft Edge Site Lists setting in the M365 Admin Center allows you to host your site list(s) in a compliant cloud location and manage the contents of your site list(s) through the built-in experience. This setting allows you to specify which site list within the M365 Admin Center to deploy to your users. The user must be signed into Microsoft Edge with a valid work or school account. Otherwise, Microsoft Edge will not download the site list from the cloud location.\r\n\r\nThis setting is applicable only when the 'InternetExplorerIntegrationLevel' (Configure Internet Explorer integration) setting is configured.\r\n\r\nIf you configure this policy, Microsoft Edge will use the specified site list. When enabled, you can enter the identifier of the site list that you created and published to the cloud in M365 Admin Center.\r\n\r\nThis setting takes precedence over Microsoft Edge's 'InternetExplorerIntegrationSiteList' (Configure the Enterprise Mode Site List) policy as well as Internet Explorer's site list setting (Use the Enterprise mode IE website list). If you disable or don't configure this policy, Microsoft Edge will use the 'InternetExplorerIntegrationSiteList' policy instead.\r\n\r\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2165707\r\n\r\nExample value: aba95e58-070f-4784-8dcd-e5fd46c2c6d6","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_internetexplorerintegrationcloudsitelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_internetexplorerintegrationcloudsitelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_internetexplorerintegrationcloudsitelist_internetexplorerintegrationcloudsitelist","displayName":"Configure the Enterprise Mode Cloud Site List (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_internetexplorerintegrationsitelistrefreshinterval","displayName":"Configure how frequently the Enterprise Mode Site List is refreshed (User)","description":"This setting lets you specify a custom refresh interval for the Enterprise Mode Site List. The refresh interval is specified in minutes. The minimum refresh interval is 30 minutes.\r\n\r\nThis setting is applicable only when the 'InternetExplorerIntegrationSiteList' (Configure the Enterprise Mode Site List) or 'InternetExplorerIntegrationCloudSiteList' (Configure the Enterprise Mode Cloud Site List) setting is configured.\r\n\r\nIf you configure this policy, Microsoft Edge will attempt to retrieve an updated version of the configured Enterprise Mode Site List using the specified refresh interval.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will use a default refresh interval, it is 10080 minutes (7 days) starting from version 110 or later, 120 minutes from version 93 to 110, and 30 minutes before version 93.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_internetexplorerintegrationsitelistrefreshinterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_internetexplorerintegrationsitelistrefreshinterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_internetexplorerintegrationsitelistrefreshinterval_internetexplorerintegrationsitelistrefreshinterval","displayName":"Configure how frequently the Enterprise Mode Site List is refreshed: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_localbrowserdatashareenabled","displayName":"Enable Windows to search local Microsoft Edge browsing data (User)","description":"Enables Windows to index Microsoft Edge browsing data stored locally on the user's device and allows users to find and launch previously stored browsing data directly from Windows features such as the search box on the taskbar in Windows.\r\n\r\nIf you enable this policy or don't configure it, Microsoft Edge will publish local browsing data to the Windows Indexer.\r\n\r\nIf you disable this policy, Microsoft Edge will not share data to the Windows Indexer.\r\n\r\nNote that if you disable this policy, Microsoft Edge will remove the data shared with Windows on the device and stop sharing any new browsing data.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_localbrowserdatashareenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_localbrowserdatashareenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_msawebsitessousingthisprofileallowed","displayName":"Allow single sign-on for Microsoft personal sites using this profile (User)","description":"'Allow single sign-on for Microsoft personal sites using this profile' option allows non-MSA profiles to be able to use single sign-on for Microsoft sites using MSA credentials present on the machine. This option shows up for end-users as a toggle in Settings -> Profiles -> Profile Preferences for non-MSA profiles only.\r\n\r\nIf you disable this policy, non-MSA profiles will not be able to use single sign-on for Microsoft sites using MSA credentials present on the machine.\r\n\r\nIf you enable this policy or don't configure it, users will be able to use the Settings option to ensure non-MSA profiles are able to use single sign-on for Microsoft sites using MSA credentials present on the machine provided only a single MSA account exists on the machine.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_msawebsitessousingthisprofileallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_msawebsitessousingthisprofileallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_recommended_localbrowserdatashareenabled_recommended","displayName":"Enable Windows to search local Microsoft Edge browsing data (User)","description":"Enables Windows to index Microsoft Edge browsing data stored locally on the user's device and allows users to find and launch previously stored browsing data directly from Windows features such as the search box on the taskbar in Windows.\r\n\r\nIf you enable this policy or don't configure it, Microsoft Edge will publish local browsing data to the Windows Indexer.\r\n\r\nIf you disable this policy, Microsoft Edge will not share data to the Windows Indexer.\r\n\r\nNote that if you disable this policy, Microsoft Edge will remove the data shared with Windows on the device and stop sharing any new browsing data.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_recommended_localbrowserdatashareenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_recommended_localbrowserdatashareenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_recommended_msawebsitessousingthisprofileallowed_recommended","displayName":"Allow single sign-on for Microsoft personal sites using this profile (User)","description":"'Allow single sign-on for Microsoft personal sites using this profile' option allows non-MSA profiles to be able to use single sign-on for Microsoft sites using MSA credentials present on the machine. This option shows up for end-users as a toggle in Settings -> Profiles -> Profile Preferences for non-MSA profiles only.\r\n\r\nIf you disable this policy, non-MSA profiles will not be able to use single sign-on for Microsoft sites using MSA credentials present on the machine.\r\n\r\nIf you enable this policy or don't configure it, users will be able to use the Settings option to ensure non-MSA profiles are able to use single sign-on for Microsoft sites using MSA credentials present on the machine provided only a single MSA account exists on the machine.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_recommended_msawebsitessousingthisprofileallowed_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_recommended_msawebsitessousingthisprofileallowed_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_recommended_travelassistanceenabled_recommended","displayName":"Enable travel assistance (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 105.\r\n\r\nThis policy is obsolete as the feature is now contained within the Edge Sidebar and can be managed using the 'HubsSidebarEnabled' (Show Hubs Sidebar) policy. It doesn't work in Microsoft Edge after version 105.\r\nConfigure this policy to allow/disallow travel assistance.\r\n\r\nThe travel assistance feature gives helpful and relevant information to a user who performs Travel related task within the browser. This feature provides trusted and validated suggestions / information to the users from across sources gathered by Microsoft.\r\n\r\nIf you enable or don't configure this setting, travel assistance will be enabled for the users when they are performing travel related tasks.\r\n\r\nIf you disable this setting, travel assistance will be disabled and users will not be able to see any travel related recommendations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_recommended_travelassistanceenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_recommended_travelassistanceenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_recommended~printing_recommended_printingwebpagelayout_recommended","displayName":"Sets layout for printing (User)","description":"Configuring this policy sets the layout for printing webpages.\r\n\r\nIf you disable or don't configure this policy, users can decide whether to print webpages in Portrait or Landscape layout.\r\n\r\nIf you enable this policy, the selected option is set as the layout option.\r\n\r\nPolicy options mapping:\r\n\r\n* portrait (0) = Sets layout option as portrait\r\n\r\n* landscape (1) = Sets layout option as landscape\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_recommended~printing_recommended_printingwebpagelayout_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_recommended~printing_recommended_printingwebpagelayout_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_recommended~printing_recommended_printingwebpagelayout_recommended_printingwebpagelayout","displayName":"Sets layout for printing (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_recommended~printing_recommended_printingwebpagelayout_recommended_printingwebpagelayout_0","displayName":"Sets layout option as portrait","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_recommended~printing_recommended_printingwebpagelayout_recommended_printingwebpagelayout_1","displayName":"Sets layout option as landscape","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_relaunchwindow","displayName":"Set the time interval for relaunch (User)","description":"Specifies a target time window for the end of the relaunch notification period.\r\n\r\nUsers are notified of the need for a browser relaunch or device restart based on the 'RelaunchNotification' (Notify a user that a browser restart is recommended or required for pending updates) and 'RelaunchNotificationPeriod' (Set the time period for update notifications) policy settings. Browsers and devices are forcibly restarted at the end of the notification period when the 'RelaunchNotification' policy is set to 'Required'. This RelaunchWindow policy can be used to defer the end of the notification period so that it falls within a specific time window.\r\n\r\nIf you don't configure this policy, the default target time window is the whole day (i.e., the end of the notification period is never deferred).\r\n\r\nNote: Though the policy can accept multiple items in entries, all but the first item are ignored.\r\nWarning: Setting this policy may delay application of software updates.\r\n\r\nExample value:\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"duration_mins\": 240,\r\n \"start\": {\r\n \"hour\": 2,\r\n \"minute\": 15\r\n }\r\n }\r\n ]\r\n}\r\n\r\n\r\nCompact example value:\r\n\r\n{\"entries\": [{\"duration_mins\": 240, \"start\": {\"hour\": 2, \"minute\": 15}}]}","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_relaunchwindow_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_relaunchwindow_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_relaunchwindow_relaunchwindow","displayName":"Relaunch time window (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_remotedebuggingallowed","displayName":"Allow remote debugging (User)","description":"Controls whether users may use remote debugging.\r\n\r\nIf you enable or don't configure this policy, users may use remote debugging by specifying --remote-debug-port and --remote-debugging-pipe command line switches.\r\n\r\nIf you disable this policy, users are not allowed to use remote debugging.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_remotedebuggingallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_remotedebuggingallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_travelassistanceenabled","displayName":"Enable travel assistance (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 105.\r\n\r\nThis policy is obsolete as the feature is now contained within the Edge Sidebar and can be managed using the 'HubsSidebarEnabled' (Show Hubs Sidebar) policy. It doesn't work in Microsoft Edge after version 105.\r\nConfigure this policy to allow/disallow travel assistance.\r\n\r\nThe travel assistance feature gives helpful and relevant information to a user who performs Travel related task within the browser. This feature provides trusted and validated suggestions / information to the users from across sources gathered by Microsoft.\r\n\r\nIf you enable or don't configure this setting, travel assistance will be enabled for the users when they are performing travel related tasks.\r\n\r\nIf you disable this setting, travel assistance will be disabled and users will not be able to see any travel related recommendations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_travelassistanceenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_travelassistanceenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_tripledesenabled","displayName":"Enable 3DES cipher suites in TLS (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 96.\r\n\r\n'This policy was removed in version 97 after 3DES was removed from Microsoft Edge.\r\n\r\nIf the policy is set to true, then 3DES cipher suites in TLS will be enabled. If it is set to false, they will be disabled. If the policy is unset, 3DES cipher suites are disabled by default. This policy may be used to temporarily retain compatibility with an outdated server. This is a stopgap measure and the server should be reconfigured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_tripledesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge_tripledesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~contentsettings_defaultjavascriptjitsetting","displayName":"Control use of JavaScript JIT (User)","description":"Allows you to set whether Microsoft Edge will run the v8 JavaScript engine with JIT (Just In Time) compiler enabled or not.\r\n\r\nDisabling the JavaScript JIT will mean that Microsoft Edge may render web content more slowly, and may also disable parts of JavaScript including WebAssembly. Disabling the JavaScript JIT may allow Microsoft Edge to render web content in a more secure configuration.\r\n\r\nThis policy can be overridden for specific URL patterns using the 'JavaScriptJitAllowedForSites' (Allow JavaScript to use JIT on these sites) and 'JavaScriptJitBlockedForSites' (Block JavaScript from using JIT on these sites) policies.\r\n\r\nIf you don't configure this policy, JavaScript JIT is enabled.\r\n\r\nPolicy options mapping:\r\n\r\n* AllowJavaScriptJit (1) = Allow any site to run JavaScript JIT\r\n\r\n* BlockJavaScriptJit (2) = Do not allow any site to run JavaScript JIT\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~contentsettings_defaultjavascriptjitsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~contentsettings_defaultjavascriptjitsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~contentsettings_defaultjavascriptjitsetting_defaultjavascriptjitsetting","displayName":"Control use of JavaScript JIT (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~contentsettings_defaultjavascriptjitsetting_defaultjavascriptjitsetting_1","displayName":"Allow any site to run JavaScript JIT","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~contentsettings_defaultjavascriptjitsetting_defaultjavascriptjitsetting_2","displayName":"Do not allow any site to run JavaScript JIT","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~contentsettings_javascriptjitallowedforsites","displayName":"Allow JavaScript to use JIT on these sites (User)","description":"Allows you to set a list of site url patterns that specify sites which are allowed to run JavaScript with JIT (Just In Time) compiler enabled.\r\n\r\nFor detailed information on valid site url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.\r\n\r\nJavaScript JIT policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.contoso.com will not correctly apply to contoso.com or subdomain.contoso.com since they both resolve to the same eTLD+1 (contoso.com) for which there is no policy. In this case, policy must be set on contoso.com to apply correctly for both contoso.com and subdomain.contoso.com.\r\n\r\nThis policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if contoso.com is listed in the JavaScriptJitAllowedForSites policy but contoso.com loads a frame containing fabrikam.com then contoso.com will have JavaScript JIT enabled, but fabrikam.com will use the policy from 'DefaultJavaScriptJitSetting' (Control use of JavaScript JIT), if set, or default to JavaScript JIT enabled.\r\n\r\nIf you don't configure this policy for a site then the policy from 'DefaultJavaScriptJitSetting' applies to the site, if set, otherwise Javascript JIT is enabled for the site.\r\n\r\nExample value:\r\n\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~contentsettings_javascriptjitallowedforsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~contentsettings_javascriptjitallowedforsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~contentsettings_javascriptjitallowedforsites_javascriptjitallowedforsitesdesc","displayName":"Allow JavaScript to use JIT on these sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~contentsettings_javascriptjitblockedforsites","displayName":"Block JavaScript from using JIT on these sites (User)","description":"Allows you to set a list of site url patterns that specify sites which are not allowed to run JavaScript JIT (Just In Time) compiler enabled.\r\n\r\nDisabling the JavaScript JIT will mean that Microsoft Edge may render web content more slowly, and may also disable parts of JavaScript including WebAssembly. Disabling the JavaScript JIT may allow Microsoft Edge to render web content in a more secure configuration.\r\n\r\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.\r\n\r\nJavaScript JIT policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.contoso.com will not correctly apply to contoso.com or subdomain.contoso.com since they both resolve to the same eTLD+1 (contoso.com) for which there is no policy. In this case, policy must be set on contoso.com to apply correctly for both contoso.com and subdomain.contoso.com.\r\n\r\nThis policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if contoso.com is listed in the JavaScriptJitBlockedForSites policy but contoso.com loads a frame containing fabrikam.com then contoso.com will have JavaScript JIT disabled, but fabrikam.com will use the policy from 'DefaultJavaScriptJitSetting' (Control use of JavaScript JIT), if set, or default to JavaScript JIT enabled.\r\n\r\nIf you don't configure this policy for a site then the policy from 'DefaultJavaScriptJitSetting' applies to the site, if set, otherwise JavaScript JIT is enabled for the site.\r\n\r\nExample value:\r\n\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~contentsettings_javascriptjitblockedforsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~contentsettings_javascriptjitblockedforsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~contentsettings_javascriptjitblockedforsites_javascriptjitblockedforsitesdesc","displayName":"Block JavaScript from using JIT on these sites (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~contentsettings_showpdfdefaultrecommendationsenabled","displayName":"Allow notifications to set Microsoft Edge as default PDF reader (User)","description":"This policy setting lets you decide whether employees should receive recommendations to set Microsoft Edge as PDF handler.\r\n\r\nIf you enable or don't configure this setting, employees receive recommendations from Microsoft Edge to set itself as the default PDF handler.\r\n\r\nIf you disable this setting, employees will not receive any notifications from Microsoft Edge to set itself as the default PDF handler.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~contentsettings_showpdfdefaultrecommendationsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~contentsettings_showpdfdefaultrecommendationsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~experimentation_featureflagoverridescontrol","displayName":"Configure users ability to override feature flags (User)","description":"Configures users ability to override state of feature flags.\r\nIf you set this policy to 'CommandLineOverridesEnabled', users can override state of feature flags using command line arguments but not edge://flags page.\r\n\r\nIf you set this policy to 'OverridesEnabled', users can override state of feature flags using command line arguments or edge://flags page.\r\n\r\nIf you set this policy to 'OverridesDisabled', users can't override state of feature flags using command line arguments or edge://flags page.\r\n\r\nIf you don't configure this policy, the behavior is the same as the 'OverridesEnabled'.\r\n\r\nPolicy options mapping:\r\n\r\n* CommandLineOverridesEnabled (2) = Allow users to override feature flags using command line arguments only\r\n\r\n* OverridesEnabled (1) = Allow users to override feature flags\r\n\r\n* OverridesDisabled (0) = Prevent users from overriding feature flags\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~experimentation_featureflagoverridescontrol_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~experimentation_featureflagoverridescontrol_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~experimentation_featureflagoverridescontrol_featureflagoverridescontrol","displayName":"Configure users ability to override feature flags (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~experimentation_featureflagoverridescontrol_featureflagoverridescontrol_2","displayName":"Allow users to override feature flags using command line arguments only","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~experimentation_featureflagoverridescontrol_featureflagoverridescontrol_1","displayName":"Allow users to override feature flags","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~experimentation_featureflagoverridescontrol_featureflagoverridescontrol_0","displayName":"Prevent users from overriding feature flags","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~identity_implicitsigninenabled","displayName":"Enable implicit sign-in (User)","description":"Configure this policy to allow/disallow implicit sign-in.\r\n\r\nIf you have configured the 'BrowserSignin' (Browser sign-in settings) policy to 'Disable browser sign-in', this policy will not take any effect.\r\n\r\nIf you enable or don't configure this setting, implicit sign-in will be enabled, Edge will attempt to sign the user into their profile based on what and how they sign in to their OS.\r\n\r\nIf you disable this setting, implicit sign-in will be disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~identity_implicitsigninenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~identity_implicitsigninenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~identity_oneauthauthenticationenforced","displayName":"OneAuth Authentication Flow Enforced for signin (User)","description":"This policy allows users to decide whether to use the OneAuth library for sign-in and token fetch in Microsoft Edge on Windows 10 RS3 and above.\r\n\r\nIf you disable or don't configure this policy, signin process will use Windows Account Manager. Microsoft Edge would be able to use accounts you logged in to Windows, Microsoft Office, or other Microsoft applications for login, without the needing of password. Or you can provide valid account and password to sign in, which will be stored in Windows Account Manager for future usage. You will be able to investigate all accounts stored in Windows Account Manager through Windows Settings -> Accounts -> Email and accounts page.\r\n\r\nIf you enable this policy, OneAuth authentication flow will be used for account signin. The OneAuth authentication flow has fewer dependencies and can work without Windows shell. The account you use would not be stored in the Email and accounts page.\r\n\r\nThis policy will only take effect on Windows 10 RS3 and above. On Windows 10 below RS3, OneAuth is used for authentication in Microsoft Edge by default.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~identity_oneauthauthenticationenforced_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~identity_oneauthauthenticationenforced_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~passwordmanager_passwordgeneratorenabled","displayName":"Allow users to get a strong password suggestion whenever they are creating an account online (User)","description":"Configures the Password Generator Settings toggle that enables/disables the feature for users.\r\n\r\nIf you enable or don't configure this policy, then Password Generator will offer users a strong and unique password suggestion (via a dropdown) on Signup and Change Password pages.\r\n\r\nIf you disable this policy, users will no longer see strong password suggestions on Signup or Change Password pages.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~passwordmanager_passwordgeneratorenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~passwordmanager_passwordgeneratorenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~passwordmanager_primarypasswordsetting","displayName":"Configures a setting that asks users to enter their device password while using password autofill (User)","description":"The feature helps users add an additional layer of privacy to their online accounts by requiring device authentication (as a way of confirming the user's identity) before the saved password is auto-filled into a web form. This ensures that non-authorized persons can't use saved passwords for autofill. Note that this feature does not protect against locally-running malware.\r\n\r\nThis group policy configures the radio button selector that enables this feature for users. It also has a frequency control where users can specify how often they would like to be prompted for authentication.\r\n\r\nIf you set this policy to 'Automatically', disable this policy, or don't configure this policy, autofill will not have any authentication flow.\r\n\r\nIf you set this policy to 'WithDevicePassword', users will have to enter their device password (or preferred mode of authentication under Windows) to prove their identity before their password is auto filled. Authentication modes include Windows Hello, PIN, face recognition, or fingerprint. The frequency for authentication prompt will be set to 'Ask permission once per browsing session' by default. However, users can change it to the other option, which is 'Always ask permission'.\r\n\r\nIf you set this policy to 'WithCustomPrimaryPassword', users will be asked to create their custom password and then to be redirected to Settings. After the custom password is set, users can authenticate themselves using the custom password and their passwords will get auto-filled after successful authentication. The frequency for authentication prompt will be set to 'Ask permission once per browsing session' by default. However, users can change it to the other option, which is 'Always ask permission'.\r\n\r\nIf you set this policy to 'AutofillOff', saved passwords will no longer be suggested for autofill.\r\n\r\nPolicy options mapping:\r\n\r\n* Automatically (0) = Automatically\r\n\r\n* WithDevicePassword (1) = With device password\r\n\r\n* WithCustomPrimaryPassword (2) = With custom primary password\r\n\r\n* AutofillOff (3) = Autofill off\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~passwordmanager_primarypasswordsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~passwordmanager_primarypasswordsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~passwordmanager_primarypasswordsetting_primarypasswordsetting","displayName":"Configures a setting that asks users to enter their device password while using password autofill (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~passwordmanager_primarypasswordsetting_primarypasswordsetting_0","displayName":"Automatically","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~passwordmanager_primarypasswordsetting_primarypasswordsetting_1","displayName":"With device password","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~printing_printingwebpagelayout","displayName":"Sets layout for printing (User)","description":"Configuring this policy sets the layout for printing webpages.\r\n\r\nIf you disable or don't configure this policy, users can decide whether to print webpages in Portrait or Landscape layout.\r\n\r\nIf you enable this policy, the selected option is set as the layout option.\r\n\r\nPolicy options mapping:\r\n\r\n* portrait (0) = Sets layout option as portrait\r\n\r\n* landscape (1) = Sets layout option as landscape\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~printing_printingwebpagelayout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~printing_printingwebpagelayout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~printing_printingwebpagelayout_printingwebpagelayout","displayName":"Sets layout for printing (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~printing_printingwebpagelayout_printingwebpagelayout_0","displayName":"Sets layout option as portrait","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev93~policy~microsoft_edge~printing_printingwebpagelayout_printingwebpagelayout_1","displayName":"Sets layout option as landscape","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev94~policy~microsoft_edge_webrtcrespectosroutingtableenabled","displayName":"Enable support for Windows OS routing table rules when making peer to peer connections via WebRTC (User)","description":"Controls whether WebRTC will respect the Windows OS routing table rules when making peer to peer connections, thus enabling split tunnel VPNs.\r\n\r\nIf you disable this policy or don't configure it, WebRTC will not consider the routing table and may make peer to peer connections over any available network.\r\n\r\nIf you enable this policy, WebRTC will prefer to make peer to peer connections using the indicated network interface for the remote address as indicated in the routing table.\r\n\r\nThis policy is only available on Windows.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev94~policy~microsoft_edge_webrtcrespectosroutingtableenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev94~policy~microsoft_edge_webrtcrespectosroutingtableenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev94~policy~microsoft_edge~applicationguard_applicationguardpassivemodeenabled","displayName":"Ignore Application Guard site list configuration and browse Edge normally (User)","description":"Set whether Edge should ignore the Application Guard site list configuration for trusted and untrusted sites.\r\n\r\nIf you enable this policy, all navigations from Edge, including navigations to untrusted sites, will be accessed normally within Edge without redirecting to the Application Guard container. Note: this policy ONLY impacts Edge, so navigations from other browsers might get redirected to the Application Guard Container if you have the corresponding extensions enabled.\r\n\r\nIf you disable or don't configure this policy, Edge does not ignore the Application Guard site list. If users try to navigate to an untrusted site in the host, the site will open in the container.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev94~policy~microsoft_edge~applicationguard_applicationguardpassivemodeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev94~policy~microsoft_edge~applicationguard_applicationguardpassivemodeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev94~policy~microsoft_edge~identity_onlyonpremisesimplicitsigninenabled","displayName":"Only on-premises account enabled for implicit sign-in (User)","description":"Configure this policy to decide whether only on-premises accounts are enabled for implicit sign-in.\r\n\r\nIf you enable this policy, only on-premises accounts will be enabled for implicit sign-in. Microsoft Edge won't attempt to implicitly sign in to MSA or AAD accounts. Upgrade from on-premises accounts to AAD accounts will be stopped as well.\r\n\r\nIf you disable or don't configure this policy, all accounts will be enabled for implicit sign-in.\r\n\r\nThis policy will only take effect when policy 'ConfigureOnPremisesAccountAutoSignIn' (Configure automatic sign in with an Active Directory domain account when there is no Azure AD domain account) is enabled and set to 'SignInAndMakeDomainAccountNonRemovable'.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev94~policy~microsoft_edge~identity_onlyonpremisesimplicitsigninenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev94~policy~microsoft_edge~identity_onlyonpremisesimplicitsigninenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_browserlegacyextensionpointsblockingenabled","displayName":"Enable browser legacy extension point blocking (User)","description":"Sets the ProcessExtensionPointDisablePolicy on Microsoft Edge's browser process to block code injection from legacy third party applications.\r\n\r\nIf you enable or don't configure this policy, the ProcessExtensionPointDisablePolicy is applied to block legacy extension points in the browser process.\r\n\r\nIf you disable this policy, the ProcessExtensionPointDisablePolicy is not applied to block legacy extension points in the browser process. This has a detrimental effect on Microsoft Edge's security and stability as unknown and potentially hostile code can load inside Microsoft Edge's browser process. Only turn off the policy if there are compatibility issues with third-party software that must run inside Microsoft Edge's browser process.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_browserlegacyextensionpointsblockingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_browserlegacyextensionpointsblockingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_crossoriginwebassemblymodulesharingenabled","displayName":"Specifies whether WebAssembly modules can be sent cross-origin (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 98.\r\n\r\nSpecifies whether WebAssembly modules can be sent to another window or worker cross-origin. Cross-origin WebAssembly module sharing was deprecated as part of the efforts to deprecate document.domain, see https://github.com/mikewest/deprecating-document-domain. This policy allowed re-enabling of cross-origin WebAssembly module sharing. This policy is obsolete because it was intended to offer a longer transition period in the deprecation process.\r\n\r\nIf you enable this policy, sites can send WebAssembly modules cross-origin\r\nwithout restrictions.\r\n\r\nIf you disable or don't configure this policy, sites can only send\r\nWebAssembly modules to windows and workers in the same origin.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_crossoriginwebassemblymodulesharingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_crossoriginwebassemblymodulesharingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_displaycapturepermissionspolicyenabled","displayName":"Specifies whether the display-capture permissions-policy is checked or skipped (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 109.\r\n\r\nThis policy is obsolete. The policy was a temporary workaround for non-spec-compliant enterprise applications.\r\n\r\nThis policy stopped working in Microsoft Edge 107 and was obsoleted in Microsoft Edge 110.\r\n\r\nThe display-capture permissions-policy gates access to getDisplayMedia(),\r\nas per this spec:\r\nhttps://www.w3.org/TR/screen-capture/#feature-policy-integration\r\nHowever, if this policy is Disabled, this requirement is not enforced,\r\nand getDisplayMedia() is allowed from contexts that would otherwise be\r\nforbidden.\r\n\r\nIf you enable or don't configure this policy, sites can only call getDisplayMedia() from\r\ncontexts which are allowlisted by the display-capture permissions-policy.\r\n\r\nIf you disable this policy, sites can call getDisplayMedia() even from contexts\r\nwhich are not allowlisted by the display-capture permissions policy.\r\nNote that other restrictions may still apply.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_displaycapturepermissionspolicyenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_displaycapturepermissionspolicyenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_internetexplorerintegrationwindowopenheightadjustment","displayName":"Configure the pixel adjustment between window.open heights sourced from IE mode pages vs. Edge mode pages (User)","description":"This setting lets you specify a custom adjustment to the height of popup windows generated via window.open from the Internet Explorer mode site.\r\n\r\nIf you configure this policy, Microsoft Edge will add the adjustment value to the height, in pixels. The exact difference depends on the UI configuration of both IE and Edge, but a typical difference is 5.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will treat IE mode window.open the same as Edge mode window.open in window height calculations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_internetexplorerintegrationwindowopenheightadjustment_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_internetexplorerintegrationwindowopenheightadjustment_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_internetexplorerintegrationwindowopenheightadjustment_internetexplorerintegrationwindowopenheightadjustment","displayName":"Configure the pixel adjustment between window.open heights sourced from IE mode pages vs. Edge mode pages: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_internetexplorerintegrationwindowopenwidthadjustment","displayName":"Configure the pixel adjustment between window.open widths sourced from IE mode pages vs. Edge mode pages (User)","description":"This setting lets you specify a custom adjustment to the width of popup windows generated via window.open from the Internet Explorer mode site.\r\n\r\nIf you configure this policy, Microsoft Edge will add the adjustment value to the width, in pixels. The exact difference depends on the UI configuration of both IE and Edge, but a typical difference is 4.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will treat IE mode window.open the same as Edge mode window.open in window width calculations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_internetexplorerintegrationwindowopenwidthadjustment_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_internetexplorerintegrationwindowopenwidthadjustment_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_internetexplorerintegrationwindowopenwidthadjustment_internetexplorerintegrationwindowopenwidthadjustment","displayName":"Configure the pixel adjustment between window.open widths sourced from IE mode pages vs. Edge mode pages: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_recommended_visualsearchenabled_recommended","displayName":"Visual search enabled (User)","description":"Visual search lets you quickly explore more related content about entities in an image.\r\n\r\nIf you enable or don't configure this policy, visual search will be enabled via image hover, context menu, and search in sidebar.\r\n\r\nIf you disable this policy, visual search will be disabled and you won't be able to get more info about images via hover, context menu, and search in sidebar.\r\n\r\nNote: Visual Search in Web Capture is still managed by 'WebCaptureEnabled' (Enable the Screenshot (previously named Web Capture) feature in Microsoft Edge) policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_recommended_visualsearchenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_recommended_visualsearchenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_recommended~smartscreen_recommended_newsmartscreenlibraryenabled_recommended","displayName":"Enable new SmartScreen library (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 107.\r\n\r\nThis policy doesn't work because it was only intended to be a short-term mechanism to support the update to a new SmartScreen client.\r\n\r\nAllows the Microsoft Edge browser to load the new SmartScreen library (libSmartScreenN) for any SmartScreen checks on site URLs or application downloads.\r\n\r\nIf you enable or don't configure this policy, Microsoft Edge will use the new SmartScreen library (libSmartScreenN).\r\n\r\nIf you disable this policy, Microsoft Edge will use the old SmartScreen library (libSmartScreen).\r\n\r\nBefore Microsoft Edge version 103, if you don't configure this policy, Microsoft Edge will use the old SmartScreen library (libSmartScreen).\r\n\r\nThis policy is only available on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management.\r\nThis also includes macOS instances that are that are managed via MDM or joined to a domain via MCX.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_recommended~smartscreen_recommended_newsmartscreenlibraryenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_recommended~smartscreen_recommended_newsmartscreenlibraryenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_shadowstackcrashrollbackbehavior","displayName":"Configure ShadowStack crash rollback behavior (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 109.\r\n\r\nThis policy is deprecated because it's intended to serve only as a short-term mechanism to give enterprises more time to update their environments and report issues if they are found to be incompatible with Hardware-enforced Stack Protection. It won't work in Microsoft Edge as soon as version 109.\r\n\r\nMicrosoft Edge includes a Hardware-enforced Stack Protection security feature. This feature may result in the browser crashing unexpectedly in cases that do not represent an attempt to compromise the browser's security.\r\n\r\nUsing this policy, you may control the behavior of the Hardware-enforced Stack Protection feature after a crash triggered by this feature is encountered.\r\n\r\nSet this policy to 'Disable' to disable the feature.\r\n\r\nSet this policy to 'DisableUntilUpdate' to disable the feature until Microsoft Edge updates next time.\r\n\r\nSet this policy to 'Enable' to keep the feature enabled.\r\n\r\nPolicy options mapping:\r\n\r\n* Disable (0) = Disable Hardware-enforced Stack Protection\r\n\r\n* DisableUntilUpdate (1) = Disable Hardware-enforced Stack Protection until the next Microsoft Edge update\r\n\r\n* Enable (2) = Enable Hardware-enforced Stack Protection\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_shadowstackcrashrollbackbehavior_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_shadowstackcrashrollbackbehavior_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_shadowstackcrashrollbackbehavior_shadowstackcrashrollbackbehavior","displayName":"Configure ShadowStack crash rollback behavior (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_shadowstackcrashrollbackbehavior_shadowstackcrashrollbackbehavior_0","displayName":"Disable Hardware-enforced Stack Protection","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_shadowstackcrashrollbackbehavior_shadowstackcrashrollbackbehavior_1","displayName":"Disable Hardware-enforced Stack Protection until the next Microsoft Edge update","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_shadowstackcrashrollbackbehavior_shadowstackcrashrollbackbehavior_2","displayName":"Enable Hardware-enforced Stack Protection","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_visualsearchenabled","displayName":"Visual search enabled (User)","description":"Visual search lets you quickly explore more related content about entities in an image.\r\n\r\nIf you enable or don't configure this policy, visual search will be enabled via image hover, context menu, and search in sidebar.\r\n\r\nIf you disable this policy, visual search will be disabled and you won't be able to get more info about images via hover, context menu, and search in sidebar.\r\n\r\nNote: Visual Search in Web Capture is still managed by 'WebCaptureEnabled' (Enable the Screenshot (previously named Web Capture) feature in Microsoft Edge) policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_visualsearchenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge_visualsearchenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge~contentsettings_intranetfilelinksenabled","displayName":"Allow intranet zone file URL links from Microsoft Edge to open in Windows File Explorer (User)","description":"This setting allows file URL links to intranet zone files from intranet zone HTTPS websites to open Windows File Explorer for that file or directory.\r\n\r\nIf you enable this policy, intranet zone file URL links originating from intranet zone HTTPS pages will open Windows File Explorer to the parent directory of the file and select the file. Intranet zone directory URL links originating from intranet zone HTTPS pages will open Windows File Explorer to the directory with no items in the directory selected.\r\n\r\nIf you disable or don't configure this policy, file URL links will not open.\r\n\r\nMicrosoft Edge uses the definition of intranet zone as configured for Internet Explorer. Note that https://localhost/ is specifically blocked as an exception of allowed intranet zone host, while loopback addresses (127.0.0.*, [::1]) are considered internet zone by default.\r\n\r\nUsers may opt out of prompts on a per-protocol/per-site basis unless the 'ExternalProtocolDialogShowAlwaysOpenCheckbox' (Show an \"Always open\" checkbox in external protocol dialog) policy is disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge~contentsettings_intranetfilelinksenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge~contentsettings_intranetfilelinksenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge~smartscreen_newsmartscreenlibraryenabled","displayName":"Enable new SmartScreen library (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 107.\r\n\r\nThis policy doesn't work because it was only intended to be a short-term mechanism to support the update to a new SmartScreen client.\r\n\r\nAllows the Microsoft Edge browser to load the new SmartScreen library (libSmartScreenN) for any SmartScreen checks on site URLs or application downloads.\r\n\r\nIf you enable or don't configure this policy, Microsoft Edge will use the new SmartScreen library (libSmartScreenN).\r\n\r\nIf you disable this policy, Microsoft Edge will use the old SmartScreen library (libSmartScreen).\r\n\r\nBefore Microsoft Edge version 103, if you don't configure this policy, Microsoft Edge will use the old SmartScreen library (libSmartScreen).\r\n\r\nThis policy is only available on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management.\r\nThis also includes macOS instances that are that are managed via MDM or joined to a domain via MCX.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge~smartscreen_newsmartscreenlibraryenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev95~policy~microsoft_edge~smartscreen_newsmartscreenlibraryenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge_recommended~performance_recommended_efficiencymode_recommended","displayName":"Configure when efficiency mode should become active (User)","description":"This policy setting lets you configure when efficiency mode will become active. By default, efficiency mode is set to 'BalancedSavings'. On devices with no battery, the default is for efficiency mode to never become active.\r\n\r\nIndividual sites may be blocked from participating in efficiency mode by configuring the policy 'SleepingTabsBlockedForUrls' (Block sleeping tabs on specific sites).\r\n\r\nSet this policy to 'AlwaysActive' and efficiency mode will always be active.\r\n\r\nSet this policy to 'NeverActive' and efficiency mode will never become active.\r\n\r\nSet this policy to 'ActiveWhenUnplugged' and efficiency mode will become active when the device is unplugged.\r\n\r\nSet this policy to 'ActiveWhenUnpluggedBatteryLow' and efficiency mode will become active when the device is unplugged and the battery is low.\r\n\r\nSet this policy to 'BalancedSavings' and when the device is unplugged, efficiency mode will take moderate steps to save battery. When the device is unplugged and the battery is low, efficiency mode will take additional steps to save battery.\r\n\r\nSet this policy to 'MaximumSavings' and when the device is unplugged or unplugged and the battery is low, efficiency mode takes additional steps to save battery.\r\n\r\nIf the device does not have a battery, efficiency mode will never become active in any mode other than 'AlwaysActive' unless the setting or 'EfficiencyModeEnabled' (Efficiency mode enabled) policy is enabled.\r\n\r\nThis policy has no effect if the 'EfficiencyModeEnabled' policy is disabled.\r\n\r\nLearn more about efficiency mode: https://go.microsoft.com/fwlink/?linkid=2173921\r\n\r\nPolicy options mapping:\r\n\r\n* AlwaysActive (0) = Efficiency mode is always active\r\n\r\n* NeverActive (1) = Efficiency mode is never active\r\n\r\n* ActiveWhenUnplugged (2) = Efficiency mode is active when the device is unplugged\r\n\r\n* ActiveWhenUnpluggedBatteryLow (3) = Efficiency mode is active when the device is unplugged and the battery is low\r\n\r\n* BalancedSavings (4) = When the device is unplugged, efficiency mode takes moderate steps to save battery. When the device is unplugged and the battery is low, efficiency mode takes additional steps to save battery.\r\n\r\n* MaximumSavings (5) = When the device is unplugged or unplugged and the battery is low, efficiency mode takes additional steps to save battery.\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge_recommended~performance_recommended_efficiencymode_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge_recommended~performance_recommended_efficiencymode_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge_recommended~performance_recommended_efficiencymode_recommended_efficiencymode","displayName":"Configure when efficiency mode should become active (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge_recommended~performance_recommended_efficiencymode_recommended_efficiencymode_0","displayName":"Efficiency mode is always active","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge_recommended~performance_recommended_efficiencymode_recommended_efficiencymode_1","displayName":"Efficiency mode is never active","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge_recommended~performance_recommended_efficiencymode_recommended_efficiencymode_2","displayName":"Efficiency mode is active when the device is unplugged","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge_recommended~performance_recommended_efficiencymode_recommended_efficiencymode_3","displayName":"Efficiency mode is active when the device is unplugged and the battery is low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge_recommended~performance_recommended_efficiencymode_recommended_efficiencymode_4","displayName":"When the device is unplugged, efficiency mode takes moderate steps to save battery. When the device is unplugged and the battery is low, efficiency mode takes additional steps to save battery.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge_recommended~performance_recommended_efficiencymode_recommended_efficiencymode_5","displayName":"When the device is unplugged or unplugged and the battery is low, efficiency mode takes additional steps to save battery.","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge~performance_efficiencymode","displayName":"Configure when efficiency mode should become active (User)","description":"This policy setting lets you configure when efficiency mode will become active. By default, efficiency mode is set to 'BalancedSavings'. On devices with no battery, the default is for efficiency mode to never become active.\r\n\r\nIndividual sites may be blocked from participating in efficiency mode by configuring the policy 'SleepingTabsBlockedForUrls' (Block sleeping tabs on specific sites).\r\n\r\nSet this policy to 'AlwaysActive' and efficiency mode will always be active.\r\n\r\nSet this policy to 'NeverActive' and efficiency mode will never become active.\r\n\r\nSet this policy to 'ActiveWhenUnplugged' and efficiency mode will become active when the device is unplugged.\r\n\r\nSet this policy to 'ActiveWhenUnpluggedBatteryLow' and efficiency mode will become active when the device is unplugged and the battery is low.\r\n\r\nSet this policy to 'BalancedSavings' and when the device is unplugged, efficiency mode will take moderate steps to save battery. When the device is unplugged and the battery is low, efficiency mode will take additional steps to save battery.\r\n\r\nSet this policy to 'MaximumSavings' and when the device is unplugged or unplugged and the battery is low, efficiency mode takes additional steps to save battery.\r\n\r\nIf the device does not have a battery, efficiency mode will never become active in any mode other than 'AlwaysActive' unless the setting or 'EfficiencyModeEnabled' (Efficiency mode enabled) policy is enabled.\r\n\r\nThis policy has no effect if the 'EfficiencyModeEnabled' policy is disabled.\r\n\r\nLearn more about efficiency mode: https://go.microsoft.com/fwlink/?linkid=2173921\r\n\r\nPolicy options mapping:\r\n\r\n* AlwaysActive (0) = Efficiency mode is always active\r\n\r\n* NeverActive (1) = Efficiency mode is never active\r\n\r\n* ActiveWhenUnplugged (2) = Efficiency mode is active when the device is unplugged\r\n\r\n* ActiveWhenUnpluggedBatteryLow (3) = Efficiency mode is active when the device is unplugged and the battery is low\r\n\r\n* BalancedSavings (4) = When the device is unplugged, efficiency mode takes moderate steps to save battery. When the device is unplugged and the battery is low, efficiency mode takes additional steps to save battery.\r\n\r\n* MaximumSavings (5) = When the device is unplugged or unplugged and the battery is low, efficiency mode takes additional steps to save battery.\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge~performance_efficiencymode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge~performance_efficiencymode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge~performance_efficiencymode_efficiencymode","displayName":"Configure when efficiency mode should become active (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge~performance_efficiencymode_efficiencymode_0","displayName":"Efficiency mode is always active","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge~performance_efficiencymode_efficiencymode_1","displayName":"Efficiency mode is never active","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge~performance_efficiencymode_efficiencymode_2","displayName":"Efficiency mode is active when the device is unplugged","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge~performance_efficiencymode_efficiencymode_3","displayName":"Efficiency mode is active when the device is unplugged and the battery is low","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge~performance_efficiencymode_efficiencymode_4","displayName":"When the device is unplugged, efficiency mode takes moderate steps to save battery. When the device is unplugged and the battery is low, efficiency mode takes additional steps to save battery.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96.1~policy~microsoft_edge~performance_efficiencymode_efficiencymode_5","displayName":"When the device is unplugged or unplugged and the battery is low, efficiency mode takes additional steps to save battery.","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_audioprocesshighpriorityenabled","displayName":"Allow the audio process to run with priority above normal on Windows (User)","description":"This policy controls the priority of the audio process on Windows.\r\nIf this policy is enabled, the audio process will run with above normal priority.\r\nIf this policy is disabled, the audio process will run with normal priority.\r\nIf this policy is not configured, the default configuration for the audio process will be used.\r\nThis policy is intended as a temporary measure to give enterprises the ability to\r\nrun audio with higher priority to address certain performance issues with audio capture.\r\nThis policy will be removed in the future.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_audioprocesshighpriorityenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_audioprocesshighpriorityenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_autolaunchprotocolscomponentenabled","displayName":"AutoLaunch Protocols Component Enabled (User)","description":"Specifies whether the AutoLaunch Protocols component should be enabled. This component allows Microsoft to provide a list similar to that of the 'AutoLaunchProtocolsFromOrigins' (Define a list of protocols that can launch an external application from listed origins without prompting the user) policy, allowing certain external protocols to launch without prompt or blocking certain protocols (on specified origins). By default, this component is enabled.\r\n\r\nIf you enable or don't configure this policy, the AutoLaunch Protocols component is enabled.\r\n\r\nIf you disable this policy, the AutoLaunch Protocols component is disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_autolaunchprotocolscomponentenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_autolaunchprotocolscomponentenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_forcesynctypes","displayName":"Configure the list of types that are included for synchronization (User)","description":"If you enable this policy all the specified data types will be included for synchronization for Azure AD/Azure AD-Degraded user profiles. This policy can be used to ensure the type of data uploaded to the Microsoft Edge synchronization service.\r\n\r\nYou can provide one of the following data types for this policy: \"favorites\", \"settings\", \"passwords\", \"addressesAndMore\", \"extensions\", \"history\", \"openTabs\", \"edgeWallet\", \"collections\", \"apps\", and \"edgeFeatureUsage\". The \"edgeFeatureUsage\" data type will be supported starting in Microsoft Edge version 134. Note that these data type names are case sensitive.\r\n\r\nUsers will not be able to override the enabled data types.\r\n\r\nExample value:\r\n\r\nfavorites","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_forcesynctypes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_forcesynctypes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_forcesynctypes_forcesynctypesdesc","displayName":"Configure the list of types that are included for synchronization (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_internetexplorerintegrationcomplexnavdatatypes","displayName":"Configure whether form data and HTTP headers will be sent when entering or exiting Internet Explorer mode (User)","description":"Starting with Microsoft Edge version 96, navigations that switch between Internet Explorer mode and Microsoft Edge will include form data.\r\n\r\nIf you enable this policy, you can specify which data types should be included in navigations between Microsoft Edge and Internet Explorer mode.\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will use the new behavior of including form data in navigations that change modes.\r\n\r\nTo learn more, see https://go.microsoft.com/fwlink/?linkid=2174004\r\n\r\nPolicy options mapping:\r\n\r\n* IncludeNone (0) = Do not send form data or headers\r\n\r\n* IncludeFormDataOnly (1) = Send form data only\r\n\r\n* IncludeHeadersOnly (2) = Send additional headers only\r\n\r\n* IncludeFormDataAndHeaders (3) = Send form data and additional headers\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_internetexplorerintegrationcomplexnavdatatypes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_internetexplorerintegrationcomplexnavdatatypes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_internetexplorerintegrationcomplexnavdatatypes_internetexplorerintegrationcomplexnavdatatypes","displayName":"Configure whether form data and HTTP headers will be sent when entering or exiting Internet Explorer mode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_internetexplorerintegrationcomplexnavdatatypes_internetexplorerintegrationcomplexnavdatatypes_0","displayName":"Do not send form data or headers","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_internetexplorerintegrationcomplexnavdatatypes_internetexplorerintegrationcomplexnavdatatypes_1","displayName":"Send form data only","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_internetexplorerintegrationcomplexnavdatatypes_internetexplorerintegrationcomplexnavdatatypes_2","displayName":"Send additional headers only","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_internetexplorerintegrationcomplexnavdatatypes_internetexplorerintegrationcomplexnavdatatypes_3","displayName":"Send form data and additional headers","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_internetexplorermodetoolbarbuttonenabled","displayName":"Show the Reload in Internet Explorer mode button in the toolbar (User)","description":"Set this policy to show the Reload in Internet Explorer mode button in the toolbar. Users can hide the button in the toolbar through edge://settings/appearance. The button will only be shown on the toolbar when the 'InternetExplorerIntegrationReloadInIEModeAllowed' (Allow unconfigured sites to be reloaded in Internet Explorer mode) policy is enabled or if the user has chosen to enable \"Allow sites to be reloaded in Internet Explorer mode\".\r\n\r\nIf you enable this policy, the Reload in Internet mode button is pinned to the toolbar.\r\n\r\nIf you disable or don't configure this policy, the Reload in Internet Explorer mode button isn't shown in the toolbar by default. Users can toggle the Show Internet Explorer mode button in edge://settings/appearance.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_internetexplorermodetoolbarbuttonenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_internetexplorermodetoolbarbuttonenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_recommended_internetexplorermodetoolbarbuttonenabled_recommended","displayName":"Show the Reload in Internet Explorer mode button in the toolbar (User)","description":"Set this policy to show the Reload in Internet Explorer mode button in the toolbar. Users can hide the button in the toolbar through edge://settings/appearance. The button will only be shown on the toolbar when the 'InternetExplorerIntegrationReloadInIEModeAllowed' (Allow unconfigured sites to be reloaded in Internet Explorer mode) policy is enabled or if the user has chosen to enable \"Allow sites to be reloaded in Internet Explorer mode\".\r\n\r\nIf you enable this policy, the Reload in Internet mode button is pinned to the toolbar.\r\n\r\nIf you disable or don't configure this policy, the Reload in Internet Explorer mode button isn't shown in the toolbar by default. Users can toggle the Show Internet Explorer mode button in edge://settings/appearance.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_recommended_internetexplorermodetoolbarbuttonenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_recommended_internetexplorermodetoolbarbuttonenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_recommended~performance_recommended_efficiencymode_recommended","displayName":"Configure when efficiency mode should become active (User)","description":"This policy setting lets you configure when efficiency mode will become active. By default, efficiency mode is set to 'BalancedSavings'. On devices with no battery, the default is for efficiency mode to never become active.\r\n\r\nIndividual sites may be blocked from participating in efficiency mode by configuring the policy 'SleepingTabsBlockedForUrls' (Block sleeping tabs on specific sites).\r\n\r\nSet this policy to 'AlwaysActive' and efficiency mode will always be active.\r\n\r\nSet this policy to 'NeverActive' and efficiency mode will never become active.\r\n\r\nSet this policy to 'ActiveWhenUnplugged' and efficiency mode will become active when the device is unplugged.\r\n\r\nSet this policy to 'ActiveWhenUnpluggedBatteryLow' and efficiency mode will become active when the device is unplugged and the battery is low.\r\n\r\nSet this policy to 'BalancedSavings' and when the device is unplugged, efficiency mode will take moderate steps to save battery. When the device is unplugged and the battery is low, efficiency mode will take additional steps to save battery.\r\n\r\nSet this policy to 'MaximumSavings' and when the device is unplugged or unplugged and the battery is low, efficiency mode takes additional steps to save battery.\r\n\r\nIf the device does not have a battery, efficiency mode will never become active in any mode other than 'AlwaysActive' unless the setting or 'EfficiencyModeEnabled' (Efficiency mode enabled) policy is enabled.\r\n\r\nThis policy has no effect if the 'EfficiencyModeEnabled' policy is disabled.\r\n\r\nLearn more about efficiency mode: https://go.microsoft.com/fwlink/?linkid=2173921\r\n\r\nPolicy options mapping:\r\n\r\n* AlwaysActive (0) = Efficiency mode is always active\r\n\r\n* NeverActive (1) = Efficiency mode is never active\r\n\r\n* ActiveWhenUnplugged (2) = Efficiency mode is active when the device is unplugged\r\n\r\n* ActiveWhenUnpluggedBatteryLow (3) = Efficiency mode is active when the device is unplugged and the battery is low\r\n\r\n* BalancedSavings (4) = When the device is unplugged, efficiency mode takes moderate steps to save battery. When the device is unplugged and the battery is low, efficiency mode takes additional steps to save battery.\r\n\r\n* MaximumSavings (5) = When the device is unplugged or unplugged and the battery is low, efficiency mode takes additional steps to save battery.\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_recommended~performance_recommended_efficiencymode_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_recommended~performance_recommended_efficiencymode_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_recommended~performance_recommended_efficiencymode_recommended_efficiencymode","displayName":"Configure when efficiency mode should become active (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_recommended~performance_recommended_efficiencymode_recommended_efficiencymode_0","displayName":"Efficiency mode is always active","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_recommended~performance_recommended_efficiencymode_recommended_efficiencymode_1","displayName":"Efficiency mode is never active","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_recommended~performance_recommended_efficiencymode_recommended_efficiencymode_2","displayName":"Efficiency mode is active when the device is unplugged","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_recommended~performance_recommended_efficiencymode_recommended_efficiencymode_3","displayName":"Efficiency mode is active when the device is unplugged and the battery is low","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_recommended~typosquattingchecker_recommended_typosquattingcheckerenabled_recommended","displayName":"Configure Edge Website Typo Protection (User)","description":"This policy setting lets you configure whether to turn on Edge TyposquattingChecker. Edge TyposquattingChecker provides warning messages to help protect your users from potential typosquatting sites. By default, Edge TyposquattingChecker is turned on.\r\n\r\nIf you enable this policy, Edge TyposquattingChecker is turned on.\r\n\r\nIf you disable this policy, Edge TyposquattingChecker is turned off.\r\n\r\nIf you don't configure this policy, Edge TyposquattingChecker is turned on but users can choose whether to use Edge TyposquattingChecker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_recommended~typosquattingchecker_recommended_typosquattingcheckerenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_recommended~typosquattingchecker_recommended_typosquattingcheckerenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_rendererappcontainerenabled","displayName":"Enable renderer in app container (User)","description":"Launches Renderer processes into an App Container for\r\nadditional security benefits.\r\n\r\nIf you don't configure this policy, Microsoft Edge will launch the renderer process in an app\r\ncontainer in a future update.\r\n\r\nIf you enable this policy, Microsoft Edge will launch the renderer process in an app container.\r\n\r\nIf you disable this policy, Microsoft Edge will not launch the renderer process in an app container.\r\n\r\nOnly turn off the policy if there are compatibility issues with\r\nthird-party software that must run inside Microsoft Edge's renderer processes.\r\n\r\nThis policy will only take effect on Windows 10 RS5 and above.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_rendererappcontainerenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_rendererappcontainerenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_sharedlinksenabled","displayName":"Show links shared from Microsoft 365 apps in History (User)","description":"Allows Microsoft Edge to display links recently shared by or shared with the user from Microsoft 365 apps in History.\r\n\r\nIf you enable or don't configure this policy, Microsoft Edge displays links recently shared by or shared with the user from Microsoft 365 apps in History.\r\n\r\nIf you disable this policy, Microsoft Edge does not display links recently shared by or shared with the user from Microsoft 365 apps in History. The control in Microsoft Edge settings is disabled and set to off.\r\n\r\nThis policy only applies for Microsoft Edge local user profiles and profiles signed in using Azure Active Directory.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_sharedlinksenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge_sharedlinksenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~applicationguard_applicationguarduploadblockingenabled","displayName":"Prevents files from being uploaded while in Application Guard (User)","description":"Sets whether files can be uploaded while in Application Guard.\r\n\r\nIf you enable this policy, users will not be able to upload files in Application Guard.\r\n\r\nIf you disable or don't configure this policy, users will be able to upload files while in Application Guard.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~applicationguard_applicationguarduploadblockingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~applicationguard_applicationguarduploadblockingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~performance_efficiencymode","displayName":"Configure when efficiency mode should become active (User)","description":"This policy setting lets you configure when efficiency mode will become active. By default, efficiency mode is set to 'BalancedSavings'. On devices with no battery, the default is for efficiency mode to never become active.\r\n\r\nIndividual sites may be blocked from participating in efficiency mode by configuring the policy 'SleepingTabsBlockedForUrls' (Block sleeping tabs on specific sites).\r\n\r\nSet this policy to 'AlwaysActive' and efficiency mode will always be active.\r\n\r\nSet this policy to 'NeverActive' and efficiency mode will never become active.\r\n\r\nSet this policy to 'ActiveWhenUnplugged' and efficiency mode will become active when the device is unplugged.\r\n\r\nSet this policy to 'ActiveWhenUnpluggedBatteryLow' and efficiency mode will become active when the device is unplugged and the battery is low.\r\n\r\nSet this policy to 'BalancedSavings' and when the device is unplugged, efficiency mode will take moderate steps to save battery. When the device is unplugged and the battery is low, efficiency mode will take additional steps to save battery.\r\n\r\nSet this policy to 'MaximumSavings' and when the device is unplugged or unplugged and the battery is low, efficiency mode takes additional steps to save battery.\r\n\r\nIf the device does not have a battery, efficiency mode will never become active in any mode other than 'AlwaysActive' unless the setting or 'EfficiencyModeEnabled' (Efficiency mode enabled) policy is enabled.\r\n\r\nThis policy has no effect if the 'EfficiencyModeEnabled' policy is disabled.\r\n\r\nLearn more about efficiency mode: https://go.microsoft.com/fwlink/?linkid=2173921\r\n\r\nPolicy options mapping:\r\n\r\n* AlwaysActive (0) = Efficiency mode is always active\r\n\r\n* NeverActive (1) = Efficiency mode is never active\r\n\r\n* ActiveWhenUnplugged (2) = Efficiency mode is active when the device is unplugged\r\n\r\n* ActiveWhenUnpluggedBatteryLow (3) = Efficiency mode is active when the device is unplugged and the battery is low\r\n\r\n* BalancedSavings (4) = When the device is unplugged, efficiency mode takes moderate steps to save battery. When the device is unplugged and the battery is low, efficiency mode takes additional steps to save battery.\r\n\r\n* MaximumSavings (5) = When the device is unplugged or unplugged and the battery is low, efficiency mode takes additional steps to save battery.\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~performance_efficiencymode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~performance_efficiencymode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~performance_efficiencymode_efficiencymode","displayName":"Configure when efficiency mode should become active (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~performance_efficiencymode_efficiencymode_0","displayName":"Efficiency mode is always active","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~performance_efficiencymode_efficiencymode_1","displayName":"Efficiency mode is never active","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~performance_efficiencymode_efficiencymode_2","displayName":"Efficiency mode is active when the device is unplugged","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~performance_efficiencymode_efficiencymode_3","displayName":"Efficiency mode is active when the device is unplugged and the battery is low","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~printing_printpostscriptmode","displayName":"Print PostScript Mode (User)","description":"Controls how Microsoft Edge prints on Microsoft Windows.\r\n\r\nPrinting to a PostScript printer on Microsoft Windows different PostScript generation methods can affect printing performance.\r\n\r\nIf you set this policy to Default, Microsoft Edge will use a set of default options when generating PostScript. For text in particular, text will always be rendered using Type 3 fonts.\r\n\r\nIf you set this policy to Type42, Microsoft Edge will render text using Type 42 fonts if possible. This should increase printing speed for some PostScript printers.\r\n\r\nIf you don't configure this policy, Microsoft Edge will be in Default mode.\r\n\r\nPolicy options mapping:\r\n\r\n* Default (0) = Default\r\n\r\n* Type42 (1) = Type42\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~printing_printpostscriptmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~printing_printpostscriptmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~printing_printpostscriptmode_printpostscriptmode","displayName":"Print PostScript Mode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~printing_printpostscriptmode_printpostscriptmode_0","displayName":"Default","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~printing_printpostscriptmode_printpostscriptmode_1","displayName":"Type42","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~printing_printrasterizepdfdpi","displayName":"Print Rasterize PDF DPI (User)","description":"Controls print image resolution when Microsoft Edge prints PDFs with rasterization.\r\n\r\nWhen printing a PDF using the Print to image option, it can be beneficial to specify a print resolution other than a device's printer setting or the PDF default. A high resolution will significantly increase the processing and printing time while a low resolution can lead to poor imaging quality.\r\n\r\nIf you set this policy, it allows a particular resolution to be specified for use when rasterizing PDFs for printing.\r\n\r\nIf you set this policy to zero or don't configure it, the system default resolution will be used during rasterization of page images.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~printing_printrasterizepdfdpi_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~printing_printrasterizepdfdpi_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~printing_printrasterizepdfdpi_printrasterizepdfdpi","displayName":"Print Rasterize PDF DPI: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~typosquattingchecker_typosquattingcheckerenabled","displayName":"Configure Edge Website Typo Protection (User)","description":"This policy setting lets you configure whether to turn on Edge TyposquattingChecker. Edge TyposquattingChecker provides warning messages to help protect your users from potential typosquatting sites. By default, Edge TyposquattingChecker is turned on.\r\n\r\nIf you enable this policy, Edge TyposquattingChecker is turned on.\r\n\r\nIf you disable this policy, Edge TyposquattingChecker is turned off.\r\n\r\nIf you don't configure this policy, Edge TyposquattingChecker is turned on but users can choose whether to use Edge TyposquattingChecker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~typosquattingchecker_typosquattingcheckerenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev96~policy~microsoft_edge~typosquattingchecker_typosquattingcheckerenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_accessibilityimagelabelsenabled","displayName":"Let screen reader users get image descriptions from Microsoft (User)","description":"Lets screen reader users get descriptions of unlabeled images on the web.\r\n\r\nIf you enable or don't configure this policy, users have the option of using an anonymous Microsoft service. This service provides automatic descriptions for unlabeled images users encounter on the web when they're using a screen reader.\r\n\r\nIf you disable this policy, users can't enable the Get Image Descriptions from Microsoft feature.\r\n\r\nWhen this feature is enabled, the content of images that need a generated description is sent to Microsoft servers to generate a description.\r\n\r\nNo cookies or other user data is sent to Microsoft, and Microsoft doesn't save or log any image content.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_accessibilityimagelabelsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_accessibilityimagelabelsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_corsnonwildcardrequestheaderssupport","displayName":"CORS non-wildcard request header support enabled (User)","description":"This policy lets you configure support of CORS non-wildcard request headers.\r\n\r\nMicrosoft Edge version 97 introduces support for CORS non-wildcard request headers. When a script makes a cross-origin network request via fetch() and XMLHttpRequest with a script-added Authorization header, the header must be explicitly allowed by the Access-Control-Allow-Headers header in the CORS preflight response. \"Explicitly\" here means that the wild card symbol \"*\" doesn't cover the Authorization header. See https://go.microsoft.com/fwlink/?linkid=2180022 for more detail.\r\n\r\nIf you enable or don't configure the policy, Microsoft Edge will support the CORS non-wildcard request headers and behave as previously described.\r\n\r\nIf you disable this policy, Microsoft Edge will allow the wildcard symbol (\"*\") in the Access-Control-Allow-Headers header in the CORS preflight response to cover the Authorization header.\r\n\r\nThis policy is a temporary workaround for the new CORS non-wildcard request header feature. It's intended to be removed in the future.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_corsnonwildcardrequestheaderssupport_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_corsnonwildcardrequestheaderssupport_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_edgediscoverenabled","displayName":"Discover feature In Microsoft Edge (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 105.\r\n\r\nThis policy doesn't work because Discover is now contained within the Edge Sidebar and can be managed using the 'HubsSidebarEnabled' (Show Hubs Sidebar) policy.\r\n\r\nThis policy lets you configure the Discover feature in Microsoft Edge.\r\n\r\nWorking in the background when enabled, this feature sends URLs to Microsoft Bing to search for related recommendations.\r\n\r\nIf you enable or don't configure this policy, you can use the Discover button on Microsoft Edge to start using this feature.\r\n\r\nIf you disable this policy, you can't use the Discover feature in Microsoft Edge.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_edgediscoverenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_edgediscoverenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_edgeenhanceimagesenabled","displayName":"Enhance images enabled (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 121.\r\n\r\nThe enhance images feature is deprecated and starting in 122 this policy will be removed. Set whether Microsoft Edge can automatically enhance images to show you sharper images with better color, lighting, and contrast.\r\n\r\nIf you enable this policy or don't configure the policy, Microsoft Edge will automatically enhance images on specific web applications.\r\n\r\nIf you disable this policy, Microsoft Edge will not enhance images.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_edgeenhanceimagesenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_edgeenhanceimagesenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_internetexplorermodetabinedgemodeallowed","displayName":"Allow sites configured for Internet Explorer mode to open in Microsoft Edge (User)","description":"This policy lets sites configured to open in Internet Explorer mode to be opened by Microsoft Edge for testing on a modern browser without removing them from the site list.\r\n\r\nUsers can configure this setting in the \"More tools\" menu by selecting 'Open sites in Microsoft Edge'.\r\n\r\nIf you enable this policy, the option to 'Open sites in Microsoft Edge' will be visible under \"More tools\". Users use this option to test IE mode sites on a modern browser.\r\n\r\nIf you disable or don't configure this policy, users can't see the option 'Open in Microsoft Edge' under the \"More tools\" menu. However, users can access this menu option with the --ie-mode-test flag.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_internetexplorermodetabinedgemodeallowed_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_internetexplorermodetabinedgemodeallowed_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_openmicrosoftlinksinedgeenabled","displayName":"Always open links from certain Microsoft apps in Microsoft Edge (User)","description":"Make Microsoft Edge open links from other supported Microsoft Apps, such as Microsoft Outlook and Microsoft Teams on Windows 10 and above, so that web links can be opened using the correct profile in Microsoft Edge. This does not change the browser set as the default in Windows settings.\r\n\r\nIf you do not configure this policy, the end user will see a prompt to manage this policy the first time Microsoft Edge opens a link from supported Microsoft apps. Users can manage this policy in Microsoft Edge settings at any time. The default browser setting in Windows will not be changed based on the Microsoft Edge setting.\r\n\r\nIf this policy is Enabled, Microsoft Edge will open web links from these apps, and will use the correct profile where possible, even when Microsoft Edge is not set as the default in Windows settings. This policy does not change the browser set as the default in Windows settings.\r\n\r\nIf this policy is disabled, the browser set as the default in Windows settings will be used to open web links from these apps.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_openmicrosoftlinksinedgeenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_openmicrosoftlinksinedgeenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_recommended_edgediscoverenabled_recommended","displayName":"Discover feature In Microsoft Edge (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 105.\r\n\r\nThis policy doesn't work because Discover is now contained within the Edge Sidebar and can be managed using the 'HubsSidebarEnabled' (Show Hubs Sidebar) policy.\r\n\r\nThis policy lets you configure the Discover feature in Microsoft Edge.\r\n\r\nWorking in the background when enabled, this feature sends URLs to Microsoft Bing to search for related recommendations.\r\n\r\nIf you enable or don't configure this policy, you can use the Discover button on Microsoft Edge to start using this feature.\r\n\r\nIf you disable this policy, you can't use the Discover feature in Microsoft Edge.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_recommended_edgediscoverenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_recommended_edgediscoverenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_recommended~smartscreen_recommended_smartscreendnsrequestsenabled_recommended","displayName":"Enable Microsoft Defender SmartScreen DNS requests (User)","description":"This policy lets you configure whether to enable DNS requests made by Microsoft Defender SmartScreen. Note: Disabling DNS requests will prevent Microsoft Defender SmartScreen from getting IP addresses, and potentially impact the IP-based protections provided.\r\n\r\nIf you enable or don't configure this setting, Microsoft Defender SmartScreen will make DNS requests.\r\n\r\nIf you disable this setting, Microsoft Defender SmartScreen will not make any DNS requests.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_recommended~smartscreen_recommended_smartscreendnsrequestsenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_recommended~smartscreen_recommended_smartscreendnsrequestsenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_websqlinthirdpartycontextenabled","displayName":"Force WebSQL in third-party contexts to be re-enabled (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 100.\r\n\r\nThis policy is obsolete because it was intended to be a short-term mechanism to give enterprises more time to update their web content when it's found to be incompatible with the change to disable WebSQL in third-party contexts. It doesn't work in Microsoft Edge after version 100.\r\n\r\nWebSQL in third-party contexts (for example, cross-site iframes) is off by default as of Microsoft Edge version 97 and was fully removed in version 101.\r\n\r\nIf you enable this policy, WebSQL in third-party contexts will be re-enabled.\r\n\r\nIf you disable this policy or don't configure it, WebSQL in third-party contexts will stay off.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_websqlinthirdpartycontextenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge_websqlinthirdpartycontextenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~contentsettings_serialallowallportsforurls","displayName":"Automatically grant sites permission to connect all serial ports (User)","description":"Setting the policy allows you to list sites which are automatically granted permission to access all available serial ports.\r\n\r\nThe URLs must be valid, or the policy is ignored. Only the origin (scheme, host, and port) of the URL is considered.\r\n\r\nThis policy overrides 'DefaultSerialGuardSetting' (Control use of the Serial API), 'SerialAskForUrls' (Allow the Serial API on specific sites), 'SerialBlockedForUrls' (Block the Serial API on specific sites) and the user's preferences.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~contentsettings_serialallowallportsforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~contentsettings_serialallowallportsforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~contentsettings_serialallowallportsforurls_serialallowallportsforurlsdesc","displayName":"Automatically grant sites permission to connect all serial ports (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~contentsettings_serialallowusbdevicesforurls","displayName":"Automatically grant sites permission to connect to USB serial devices (User)","description":"Setting the policy lets you list sites that are automatically granted permission to access USB serial devices with vendor and product IDs that match the vendor_id and product_id fields.\r\n\r\nOptionally you can omit the product_id field. This enables site access to all the vendor's devices. When you provide a product ID, then you give the site access to a specific device from the vendor but not all devices.\r\n\r\nThe URLs must be valid, or the policy is ignored. Only the origin (scheme, host, and port) of the URL is considered.\r\n\r\nThis policy overrides 'DefaultSerialGuardSetting' (Control use of the Serial API), 'SerialAskForUrls' (Allow the Serial API on specific sites), 'SerialBlockedForUrls' (Block the Serial API on specific sites) and the user's preferences.\r\n\r\nThis policy only affects access to USB devices through the Web Serial API. To grant access to USB devices through the WebUSB API see the 'WebUsbAllowDevicesForUrls' (Grant access to specific sites to connect to specific USB devices) policy.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"devices\": [\r\n {\r\n \"product_id\": 5678,\r\n \"vendor_id\": 1234\r\n }\r\n ],\r\n \"urls\": [\r\n \"https://specific-device.example.com\"\r\n ]\r\n },\r\n {\r\n \"devices\": [\r\n {\r\n \"vendor_id\": 1234\r\n }\r\n ],\r\n \"urls\": [\r\n \"https://all-vendor-devices.example.com\"\r\n ]\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~contentsettings_serialallowusbdevicesforurls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~contentsettings_serialallowusbdevicesforurls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~contentsettings_serialallowusbdevicesforurls_serialallowusbdevicesforurls","displayName":"Automatically grant sites permission to connect to USB serial devices (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~screencapture_sameorigintabcaptureallowedbyorigins","displayName":"Allow Same Origin Tab capture by these origins (User)","description":"Setting the policy lets you set a list of URL patterns that can capture tabs with their same Origin.\r\n\r\nLeaving the policy unset means that sites will not be considered for an override at this scope of capture.\r\n\r\nIf a site matches a URL pattern in this policy, the following policies will not be considered: 'TabCaptureAllowedByOrigins' (Allow Tab capture by these origins), 'WindowCaptureAllowedByOrigins' (Allow Window and Tab capture by these origins), 'ScreenCaptureAllowedByOrigins' (Allow Desktop, Window, and Tab capture by these origins), 'ScreenCaptureAllowed' (Allow or deny screen capture).\r\n\r\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. This policy only matches based on origin, so any path in the URL pattern is ignored.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~screencapture_sameorigintabcaptureallowedbyorigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~screencapture_sameorigintabcaptureallowedbyorigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~screencapture_sameorigintabcaptureallowedbyorigins_sameorigintabcaptureallowedbyoriginsdesc","displayName":"Allow Same Origin Tab capture by these origins (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~screencapture_screencaptureallowedbyorigins","displayName":"Allow Desktop, Window, and Tab capture by these origins (User)","description":"Setting the policy lets you set a list of URL patterns that can use Desktop, Window, and Tab Capture.\r\n\r\nLeaving the policy unset means that sites will not be considered for an override at this scope of Capture.\r\n\r\nThis policy is not considered if a site matches a URL pattern in any of the following policies: 'WindowCaptureAllowedByOrigins' (Allow Window and Tab capture by these origins), 'TabCaptureAllowedByOrigins' (Allow Tab capture by these origins), 'SameOriginTabCaptureAllowedByOrigins' (Allow Same Origin Tab capture by these origins).\r\n\r\nIf a site matches a URL pattern in this policy, the 'ScreenCaptureAllowed' (Allow or deny screen capture) will not be considered.\r\n\r\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. This policy only matches based on origin, so any path in the URL pattern is ignored.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~screencapture_screencaptureallowedbyorigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~screencapture_screencaptureallowedbyorigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~screencapture_screencaptureallowedbyorigins_screencaptureallowedbyoriginsdesc","displayName":"Allow Desktop, Window, and Tab capture by these origins (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~screencapture_tabcaptureallowedbyorigins","displayName":"Allow Tab capture by these origins (User)","description":"Setting the policy lets you set a list of URL patterns that can use Tab Capture.\r\n\r\nLeaving the policy unset means that sites will not be considered for an override at this scope of capture.\r\n\r\nThis policy is not considered if a site matches a URL pattern in the 'SameOriginTabCaptureAllowedByOrigins' (Allow Same Origin Tab capture by these origins) policy.\r\n\r\nIf a site matches a URL pattern in this policy, the following policies will not be considered: 'WindowCaptureAllowedByOrigins' (Allow Window and Tab capture by these origins), 'ScreenCaptureAllowedByOrigins' (Allow Desktop, Window, and Tab capture by these origins), 'ScreenCaptureAllowed' (Allow or deny screen capture).\r\n\r\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. This policy only matches based on origin, so any path in the URL pattern is ignored.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~screencapture_tabcaptureallowedbyorigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~screencapture_tabcaptureallowedbyorigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~screencapture_tabcaptureallowedbyorigins_tabcaptureallowedbyoriginsdesc","displayName":"Allow Tab capture by these origins (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~screencapture_windowcaptureallowedbyorigins","displayName":"Allow Window and Tab capture by these origins (User)","description":"Setting the policy lets you set a list of URL patterns that can use Window and Tab Capture.\r\n\r\nLeaving the policy unset means that sites will not be considered for an override at this scope of Capture.\r\n\r\nThis policy is not considered if a site matches a URL pattern in any of the following policies: 'TabCaptureAllowedByOrigins' (Allow Tab capture by these origins), 'SameOriginTabCaptureAllowedByOrigins' (Allow Same Origin Tab capture by these origins).\r\n\r\nIf a site matches a URL pattern in this policy, the following policies will not be considered: 'ScreenCaptureAllowedByOrigins' (Allow Desktop, Window, and Tab capture by these origins), 'ScreenCaptureAllowed' (Allow or deny screen capture).\r\n\r\nFor detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. This policy only matches based on origin, so any path in the URL pattern is ignored.\r\n\r\nExample value:\r\n\r\nhttps://www.example.com\r\n[*.]example.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~screencapture_windowcaptureallowedbyorigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~screencapture_windowcaptureallowedbyorigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~screencapture_windowcaptureallowedbyorigins_windowcaptureallowedbyoriginsdesc","displayName":"Allow Window and Tab capture by these origins (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~smartscreen_smartscreendnsrequestsenabled","displayName":"Enable Microsoft Defender SmartScreen DNS requests (User)","description":"This policy lets you configure whether to enable DNS requests made by Microsoft Defender SmartScreen. Note: Disabling DNS requests will prevent Microsoft Defender SmartScreen from getting IP addresses, and potentially impact the IP-based protections provided.\r\n\r\nIf you enable or don't configure this setting, Microsoft Defender SmartScreen will make DNS requests.\r\n\r\nIf you disable this setting, Microsoft Defender SmartScreen will not make any DNS requests.\r\n\r\nThis policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~smartscreen_smartscreendnsrequestsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev97~policy~microsoft_edge~smartscreen_smartscreendnsrequestsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev98.1~policy~microsoft_edge_enhancesecuritymode","displayName":"Enhance the security state in Microsoft Edge (User)","description":"This policy lets you enhance the security state in Microsoft Edge.\r\n\r\nIf you set this policy to 'StandardMode', the enhanced mode will be turned off and Microsoft Edge will fallback to its standard security mode.\r\n\r\nIf you set this policy to 'BalancedMode', the security state will be in balanced mode.\r\n\r\nIf you set this policy to 'StrictMode', the security state will be in strict mode.\r\n\r\nIf you set this policy to 'BasicMode', the security state will be in basic mode.\r\n\r\nNote: Sites that use WebAssembly (WASM) are not currently supported when 'EnhanceSecurityMode' (Enhance the security state in Microsoft Edge) is enabled. If you require access to a site that uses WASM, consider adding it to your exception list as described in https://go.microsoft.com/fwlink/?linkid=2183321.\r\n\r\nFor detailed information about Enhanced Security Mode, see https://go.microsoft.com/fwlink/?linkid=2195852\r\n\r\nPolicy options mapping:\r\n\r\n* StandardMode (0) = Standard mode\r\n\r\n* BalancedMode (1) = Balanced mode\r\n\r\n* StrictMode (2) = Strict mode\r\n\r\n* BasicMode (2) = Basic mode\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev98.1~policy~microsoft_edge_enhancesecuritymode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98.1~policy~microsoft_edge_enhancesecuritymode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev98.1~policy~microsoft_edge_enhancesecuritymode_enhancesecuritymode","displayName":"Enhance the security state in Microsoft Edge (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev98.1~policy~microsoft_edge_enhancesecuritymode_enhancesecuritymode_0","displayName":"Standard mode","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98.1~policy~microsoft_edge_enhancesecuritymode_enhancesecuritymode_1","displayName":"Balanced mode","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98.1~policy~microsoft_edge_enhancesecuritymode_enhancesecuritymode_2","displayName":"Strict mode","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98.1~policy~microsoft_edge_enhancesecuritymode_enhancesecuritymode_3","displayName":"Basic mode","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_edgefollowenabled","displayName":"Enable Follow service in Microsoft Edge (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 126.\r\n\r\nLets Microsoft Edge browser enable Follow service and apply it to users.\r\n\r\nUsers can use the Follow feature for an influencer, site, or topic in Microsoft Edge..\r\n\r\nIf you enable or don't configure this policy, Follow in Microsoft Edge can be applied.\r\n\r\nIf you disable this policy, Microsoft Edge will not communicate with Follow service to provide the follow feature.\r\n\r\nThis policy is obsolete after version 126.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_edgefollowenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_edgefollowenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_enhancesecuritymode","displayName":"Enhance the security state in Microsoft Edge (User)","description":"This policy lets you enhance the security state in Microsoft Edge.\r\n\r\nIf you set this policy to 'StandardMode', the enhanced mode will be turned off and Microsoft Edge will fallback to its standard security mode.\r\n\r\nIf you set this policy to 'BalancedMode', the security state will be in balanced mode.\r\n\r\nIf you set this policy to 'StrictMode', the security state will be in strict mode.\r\n\r\nIf you set this policy to 'BasicMode', the security state will be in basic mode.\r\n\r\nNote: Sites that use WebAssembly (WASM) are not supported on 32-bit systems when 'EnhanceSecurityMode' (Enhance the security state in Microsoft Edge) is enabled. If you require access to a site that uses WASM, consider adding it to your exception list as described in https://go.microsoft.com/fwlink/?linkid=2183321.\r\n\r\nStarting in Microsoft Edge 113, 'BasicMode' is deprecated and is treated the same as 'BalancedMode'. It won't work in Microsoft Edge version 116.\r\n\r\nFor detailed information about Enhanced Security Mode, see https://go.microsoft.com/fwlink/?linkid=2185895\r\n\r\nPolicy options mapping:\r\n\r\n* StandardMode (0) = Standard mode\r\n\r\n* BalancedMode (1) = Balanced mode\r\n\r\n* StrictMode (2) = Strict mode\r\n\r\n* BasicMode (3) = (Deprecated) Basic mode\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_enhancesecuritymode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_enhancesecuritymode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_enhancesecuritymode_enhancesecuritymode","displayName":"Enhance the security state in Microsoft Edge (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_enhancesecuritymode_enhancesecuritymode_0","displayName":"Standard mode","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_enhancesecuritymode_enhancesecuritymode_1","displayName":"Balanced mode","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_enhancesecuritymode_enhancesecuritymode_2","displayName":"Strict mode","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_enhancesecuritymodebypasslistdomains","displayName":"Configure the list of domains for which enhance security mode will not be enforced (User)","description":"Configure the list of enhance security trusted domains. This means that\r\nenhance security mode will not be enforced when loading the sites in trusted domains.\r\n\r\nExample value:\r\n\r\nmydomain.com\r\nmyuniversity.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_enhancesecuritymodebypasslistdomains_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_enhancesecuritymodebypasslistdomains_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_enhancesecuritymodebypasslistdomains_enhancesecuritymodebypasslistdomainsdesc","displayName":"Configure the list of domains for which enhance security mode will not be enforced (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_enhancesecuritymodeenforcelistdomains","displayName":"Configure the list of domains for which enhance security mode will always be enforced (User)","description":"Configure the list of enhance security untrusted domains. This means that\r\nenhance security mode will always be enforced when loading the sites in untrusted domains.\r\n\r\nExample value:\r\n\r\nmydomain.com\r\nmyuniversity.edu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_enhancesecuritymodeenforcelistdomains_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_enhancesecuritymodeenforcelistdomains_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_enhancesecuritymodeenforcelistdomains_enhancesecuritymodeenforcelistdomainsdesc","displayName":"Configure the list of domains for which enhance security mode will always be enforced (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_inappsupportenabled","displayName":"In-app support Enabled (User)","description":"Microsoft Edge uses the in-app support feature (enabled by default) to allow users to contact our support agents directly from the browser. Also, by default, users can't disable (turn off) the in-app support feature.\r\n\r\nIf you enable this policy or don't configure it, users can invoke in-app support.\r\n\r\nIf you disable this policy, users can't invoke in-app support.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_inappsupportenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_inappsupportenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_microsoftedgeinsiderpromotionenabled","displayName":"Microsoft Edge Insider Promotion Enabled (User)","description":"Shows content promoting the Microsoft Edge Insider channels on the About Microsoft Edge settings page.\r\n\r\nIf you enable or don't configure this policy, the Microsoft Edge Insider promotion content will be shown on the About Microsoft Edge page.\r\n\r\nIf you disable this policy, the Microsoft Edge Insider promotion content will not be shown on the About Microsoft Edge page.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_microsoftedgeinsiderpromotionenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_microsoftedgeinsiderpromotionenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_u2fsecuritykeyapienabled","displayName":"Allow using the deprecated U2F Security Key API (obsolete) (User)","description":"OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 103.\r\n\r\nThis policy is obsolete because it was intended to be a short-term mechanism to give enterprises more time to update their web content when it's found to be incompatible with the change to remove the U2F Security Key API. It doesn't work in Microsoft Edge after version 103.\r\n\r\nIf you enable this policy, the deprecated U2F Security Key API can be used and the deprecation reminder prompt shown for U2F API requests is suppressed.\r\n\r\nIf you disable this policy or don't configure it, the U2F Security Key API is disabled by default and can only be used by sites that register for and use the U2FSecurityKeyAPI origin trial which ended after Microsoft Edge version 103.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_u2fsecuritykeyapienabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge_u2fsecuritykeyapienabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge~printing_printstickysettings","displayName":"Print preview sticky settings (User)","description":"Specifies whether print preview should apply last used settings for Microsoft Edge PDF and webpages.\r\n\r\nIf you set this policy to 'EnableAll' or don't configure it, Microsoft Edge applies the last used print preview settings for both PDF and webpages.\r\n\r\nIf you set this policy to 'DisableAll', Microsoft Edge doesn't apply the last used print preview settings for both PDF and webpages.\r\n\r\nIf you set this policy to 'DisablePdf', Microsoft Edge doesn't apply the last used print preview settings for PDF printing and retains it for webpages.\r\n\r\nIf you set this policy to 'DisableWebpage', Microsoft Edge doesn't apply the last used print preview settings for webpage printing and retain it for PDF.\r\n\r\nThis policy is only available if you enable or don't configure the 'PrintingEnabled' (Enable printing) policy.\r\n\r\nPolicy options mapping:\r\n\r\n* EnableAll (0) = Enable sticky settings for PDF and Webpages\r\n\r\n* DisableAll (1) = Disable sticky settings for PDF and Webpages\r\n\r\n* DisablePdf (2) = Disable sticky settings for PDF\r\n\r\n* DisableWebpage (3) = Disable sticky settings for Webpages\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge~printing_printstickysettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge~printing_printstickysettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge~printing_printstickysettings_printstickysettings","displayName":"Print preview sticky settings (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge~printing_printstickysettings_printstickysettings_0","displayName":"Enable sticky settings for PDF and Webpages","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge~printing_printstickysettings_printstickysettings_1","displayName":"Disable sticky settings for PDF and Webpages","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge~printing_printstickysettings_printstickysettings_2","displayName":"Disable sticky settings for PDF","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev98~policy~microsoft_edge~printing_printstickysettings_printstickysettings_3","displayName":"Disable sticky settings for Webpages","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_addressbareditingenabled","displayName":"Configure address bar editing (User)","description":"If you enable or don't configure this policy, users can change the URL in the address bar.\r\n\r\nIf you disable this policy, it prevents users from changing the URL in the address bar.\r\n\r\nNote: This policy doesn't prevent the browser from navigating to any URL. Users can still navigate to any URL by using the search option in the default New Tab Page, or using any link that leads to a web search engine. To ensure that users can only go to sites you expect, consider configuring the following policies in addition to this policy:\r\n\r\n- 'NewTabPageLocation' (Configure the new tab page URL)\r\n\r\n- 'HomepageLocation' (Configure the home page URL)\r\n\r\n- 'HomepageIsNewTabPage' (Set the new tab page as the home page)\r\n\r\n- 'URLBlocklist' (Block access to a list of URLs) and 'URLAllowlist' (Define a list of allowed URLs) to scope the pages that browser can navigate to.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_addressbareditingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_addressbareditingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_allowgamesmenu","displayName":"Allow users to access the games menu (User)","description":"If you enable or don't configure this policy, users can access the games menu.\r\n\r\nIf you disable this policy, users won't be able to access the games menu.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_allowgamesmenu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_allowgamesmenu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_donotsilentlyblockprotocolsfromorigins","displayName":"Define a list of protocols that can not be silently blocked by anti-flood protection (User)","description":"Allows you to create a list of protocols, and for each protocol an associated list of allowed origin patterns. These origins won't be silently blocked from launching an external application by anti-flood protection. The trailing separator shouldn't be included when listing the protocol. For example, list \"skype\" instead of \"skype:\" or \"skype://\".\r\n\r\nIf you configure this policy, a protocol will only be permitted to bypass being silently blocked by anti-flood protection if:\r\n\r\n- the protocol is listed\r\n\r\n- the origin of the site trying to launch the protocol matches one of the origin patterns in that protocol's allowed_origins list.\r\n\r\nIf either condition is false, the external protocol launch may be blocked by anti-flood protection.\r\n\r\nIf you don't configure this policy, no protocols can bypass being silently blocked.\r\n\r\nThe origin matching patterns use a similar format to those for the 'URLBlocklist' (Block access to a list of URLs) policy, that are documented at https://go.microsoft.com/fwlink/?linkid=2095322.\r\n\r\nHowever, origin matching patterns for this policy cannot contain \"/path\" or \"@query\" elements. Any pattern that does contain a \"/path\" or \"@query\" element will be ignored.\r\n\r\nThis policy doesn't work as expected with file://* wildcards.\r\n\r\nExample value:\r\n\r\n[\r\n {\r\n \"protocol\": \"spotify\",\r\n \"allowed_origins\": [\r\n \"example.com\",\r\n \"http://www.example.com:8080\"\r\n ]\r\n },\r\n {\r\n \"protocol\": \"msteams\",\r\n \"allowed_origins\": [\r\n \"https://example.com\",\r\n \"https://.mail.example.com\"\r\n ]\r\n },\r\n {\r\n \"protocol\": \"msoutlook\",\r\n \"allowed_origins\": [\r\n \"*\"\r\n ]\r\n }\r\n]","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_donotsilentlyblockprotocolsfromorigins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_donotsilentlyblockprotocolsfromorigins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_donotsilentlyblockprotocolsfromorigins_donotsilentlyblockprotocolsfromorigins","displayName":"Define a list of protocols that can not be silently blocked by anti-flood protection (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_hubssidebarenabled","displayName":"Show Hubs Sidebar (User)","description":"Shows a launcher bar on the right side of Microsoft Edge's screen.\r\n\r\nEnable this policy to always show the Sidebar.\r\nDisable this policy to never show the Sidebar.\r\n\r\nIf you don't configure the policy, users can choose whether to show the Sidebar.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_hubssidebarenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_hubssidebarenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_internetexplorerintegrationcloudneutralsitesreporting","displayName":"Configure reporting of potentially misconfigured neutral site URLs to the M365 Admin Center Site Lists app (User)","description":"This setting lets you enable reporting of sites that might need to be configured as a neutral site on the Enterprise Mode Site List. The user must be signed into Microsoft Edge with a valid work or school account for reports to be sent, and the user's account tenant must match the tenant specified by the policy.\r\n\r\nIf you configure this policy, Microsoft Edge will send a report to the M365 Admin Center Site Lists app when a navigation appears stuck redirecting back and forth between the Microsoft Edge and Internet Explorer engines several times. This usually indicates that redirection to an authentication server is switching engines, which repeatedly fails in a loop. The report will show the URL of the site that is the redirect target, minus any query string or fragment. The user's identity isn't reported.\r\n\r\nFor this reporting to work correctly, you must have successfully visited the Microsoft Edge Site Lists app in the M365 Admin Center at least once. This activates a per-tenant storage account used to store these reports. Microsoft Edge will still attempt to send reports if this step hasn't been completed. However, the reports will not be stored in the Site Lists app.\r\n\r\nWhen enabling this policy, you must specify your O365 tenant ID. To learn more about finding your O365 tenant ID, see https://go.microsoft.com/fwlink/?linkid=2185668\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will never send reports about potentially misconfigured neutral sites to the Site Lists app.\r\n\r\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2165707\r\n\r\nExample value: aba95e58-070f-4784-8dcd-e5fd46c2c6d6","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_internetexplorerintegrationcloudneutralsitesreporting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_internetexplorerintegrationcloudneutralsitesreporting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_internetexplorerintegrationcloudneutralsitesreporting_internetexplorerintegrationcloudneutralsitesreporting","displayName":"Configure reporting of potentially misconfigured neutral site URLs to the M365 Admin Center Site Lists app (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_internetexplorerintegrationcloudusersitesreporting","displayName":"Configure reporting of IE Mode user list entries to the M365 Admin Center Site Lists app (User)","description":"This setting lets you enable reporting of sites that Microsoft Edge users add to their local IE Mode site list. The user must be signed into Microsoft Edge with a valid work or school account for reports to be sent, and the user's account tenant must match the tenant specified by the policy.\r\n\r\nIf you configure this policy, Microsoft Edge will send a report to the M365 Admin Center Site Lists app when a user adds a site to their local IE mode site list. The report will show the URL of the site the user added, minus any query string or fragment. The user's identity isn't reported.\r\n\r\nFor this reporting to work correctly, you must have successfully visited the Microsoft Edge Site Lists app in the M365 Admin Center at least once. This activates a per-tenant storage account used to store these reports. Microsoft Edge will still attempt to send reports if this step hasn't been completed. However, the reports will not be stored in the Site Lists app.\r\n\r\nWhen enabling this policy, you must specify your O365 tenant ID. To learn more about finding your O365 tenant ID, see https://go.microsoft.com/fwlink/?linkid=2185668\r\n\r\nIf you disable or don't configure this policy, Microsoft Edge will never send reports about URLs added to a user's local site list to the Site Lists app.\r\n\r\nTo learn more about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2165707\r\n\r\nExample value: aba95e58-070f-4784-8dcd-e5fd46c2c6d6","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_internetexplorerintegrationcloudusersitesreporting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_internetexplorerintegrationcloudusersitesreporting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_internetexplorerintegrationcloudusersitesreporting_internetexplorerintegrationcloudusersitesreporting","displayName":"Configure reporting of IE Mode user list entries to the M365 Admin Center Site Lists app (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_recommended_hubssidebarenabled_recommended","displayName":"Show Hubs Sidebar (User)","description":"Shows a launcher bar on the right side of Microsoft Edge's screen.\r\n\r\nEnable this policy to always show the Sidebar.\r\nDisable this policy to never show the Sidebar.\r\n\r\nIf you don't configure the policy, users can choose whether to show the Sidebar.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_recommended_hubssidebarenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_recommended_hubssidebarenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_recommended~identity_recommended_signinctaonntpenabled_recommended","displayName":"Enable sign in click to action dialog (User)","description":"Configure this policy to show sign in click to action dialog on New tab page.\r\n\r\nIf you enable or don't configure this policy, sign in click to action dialog is shown on New tab page.\r\n\r\nIf you disable this policy, sign in click to action dialog isn't shown on the New tab page.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_recommended~identity_recommended_signinctaonntpenabled_recommended_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_recommended~identity_recommended_signinctaonntpenabled_recommended_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_relatedmatchescloudserviceenabled","displayName":"Configure Related Matches in Find on Page (User)","description":"Specifies how the user receives related matches in Find on Page, which provides spellcheck, synonyms, and Q&A results in Microsoft Edge.\r\n\r\nIf you enable or don't configure this policy, users can receive related matches in Find on Page on all sites. The results are processed in a cloud service.\r\n\r\nIf you disable this policy, users can receive related matches in Find on Page on limited sites. The results are processed on the user's device.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_relatedmatchescloudserviceenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_relatedmatchescloudserviceenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_sandboxexternalprotocolblocked","displayName":"Allow Microsoft Edge to block navigations to external protocols in a sandboxed iframe (User)","description":"Microsoft Edge will block navigations to external protocols inside a\r\nsandboxed iframe.\r\n\r\nIf you enable or don't configure this policy, Microsoft Edge will block those navigations.\r\n\r\nIf you disable this policy, Microsoft Edge will not block those navigations.\r\n\r\nThis can be used by administrators who need more time to update their internal website affected by this new restriction. This Enterprise policy is temporary; it's intended to be removed after Microsoft Edge version 104.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_sandboxexternalprotocolblocked_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_sandboxexternalprotocolblocked_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_useragentreduction","displayName":"Enable or disable the User-Agent Reduction (User)","description":"The User-Agent HTTP request header is scheduled to be reduced. To facilitate testing and compatibility, this policy can enable the reduction feature for all websites, or disable the ability for origin trials, or field trials to enable the feature.\r\n\r\nIf you don't configure this policy or set it to Default, User-Agent will be controlled by experimentation.\r\n\r\nSet this policy to 'ForceEnabled' to force the reduced version of the User-Agent request header.\r\n\r\nSet this policy to 'ForceDisabled' to force the full version of the User-Agent request header.\r\n\r\nTo learn more about the User-Agent string, read here:\r\n\r\nhttps://docs.microsoft.com/en-us/microsoft-edge/web-platform/user-agent-guidance.\r\n\r\n\r\nPolicy options mapping:\r\n\r\n* Default (0) = User-Agent reduction will be controllable via Experimentation\r\n\r\n* ForceDisabled (1) = User-Agent reduction diabled, and not enabled by Experimentation\r\n\r\n* ForceEnabled (2) = User-Agent reduction will be enabled for all origins\r\n\r\nUse the preceding information when configuring this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_useragentreduction_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_useragentreduction_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_useragentreduction_useragentreduction","displayName":"Enable or disable the User-Agent Reduction (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_useragentreduction_useragentreduction_0","displayName":"User-Agent reduction will be controllable via Experimentation","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_useragentreduction_useragentreduction_1","displayName":"User-Agent reduction diabled, and not enabled by Experimentation","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge_useragentreduction_useragentreduction_2","displayName":"User-Agent reduction will be enabled for all origins","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge~passwordmanager_passwordmanagerblocklist","displayName":"Configure the list of domains for which the password manager UI (Save and Fill) will be disabled (User)","description":"Configure the list of domains where Microsoft Edge should disable the password manager. This means that Save and Fill workflows will be disabled, ensuring that passwords for those websites can't be saved or auto filled into web forms.\r\n\r\nIf you enable this policy, the password manager will be disabled for the specified set of domains.\r\n\r\nIf you disable or don't configure this policy, password manager will work as usual for all domains.\r\n\r\nIf you configure this policy, that is, add domains for which password manager is blocked, users can't change or override the behavior in Microsoft Edge. In addition, users can't use password manager for those URLs.\r\n\r\nExample value:\r\n\r\nhttps://contoso.com/\r\nhttps://login.contoso.com","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge~passwordmanager_passwordmanagerblocklist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge~passwordmanager_passwordmanagerblocklist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_microsoft_edgev99~policy~microsoft_edge~passwordmanager_passwordmanagerblocklist_passwordmanagerblocklistdesc","displayName":"Configure the list of domains for which the password manager UI (Save and Fill) will be disabled (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_notifications_disallownotificationmirroring","displayName":"Disallow Notification Mirroring (User)","description":"Boolean value that turns off notification mirroring. For each user logged into the device, if you enable this policy (set value to 1) the app and system notifications received by this user on this device will not get mirrored to other devices of the same logged in user. If you disable or do not configure this policy (set value to 0) the notifications received by this user on this device will be mirrored to other devices of the same logged in user. This feature can be turned off by apps that do not want to participate in Notification Mirroring. This feature can also be turned off by the user in the Cortana setting page. No reboot or service restart is required for this policy to take effect.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Notifications#disallownotificationmirroring"],"options":[{"id":"user_vendor_msft_policy_config_notifications_disallownotificationmirroring_0","displayName":"Block","description":"Enable notification mirroring.","helpText":null},{"id":"user_vendor_msft_policy_config_notifications_disallownotificationmirroring_1","displayName":"Allow","description":"Disable notification mirroring.","helpText":null}]},{"id":"user_vendor_msft_policy_config_notifications_disallowtilenotification","displayName":"Disallow Tile Notification (User)","description":"This policy setting turns off tile notifications. If you enable this policy setting, applications and system features will not be able to update their tiles and tile badges in the Start screen. If you disable or do not configure this policy setting, tile and badge notifications are enabled and can be turned off by the administrator or user. No reboots or service restarts are required for this policy setting to take effect.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Notifications#disallowtilenotification"],"options":[{"id":"user_vendor_msft_policy_config_notifications_disallowtilenotification_0","displayName":"Block","description":"Disabled.","helpText":null},{"id":"user_vendor_msft_policy_config_notifications_disallowtilenotification_1","displayName":"Allow","description":"Enabled.","helpText":null}]},{"id":"user_vendor_msft_policy_config_office16~policy~l_microsoftofficesystem~l_miscellaneous437_l_ageoutpolicy","displayName":"Age out documents older than n days (User)","description":"This policy controls when locally cached Office documents are aged out of the Office Document Cache","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16~policy~l_microsoftofficesystem~l_miscellaneous437_l_ageoutpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16~policy~l_microsoftofficesystem~l_miscellaneous437_l_ageoutpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16~policy~l_microsoftofficesystem~l_miscellaneous437_l_ageoutpolicy_l_ageoutpolicydecimal","displayName":"Number of days (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16~policy~l_microsoftofficesystem~l_miscellaneous437_l_evictserverversionspolicy","displayName":"Age out the locally cached copies of server document versions that are more than n days old. (User)","description":"\r\n This policy controls when locally cached Office version documents from the server are aged out of the local cache.\r\n\r\n If you enable this policy setting, Office document versions from the server that have been locally cached for more than n days, will be deleted from the local cache.\r\n\r\n If you disable or do not configure this policy setting, Office document versions from the server that have been locally cached, will be deleted from the local cache if older than the default of one day.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16~policy~l_microsoftofficesystem~l_miscellaneous437_l_evictserverversionspolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16~policy~l_microsoftofficesystem~l_miscellaneous437_l_evictserverversionspolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16~policy~l_microsoftofficesystem~l_miscellaneous437_l_evictserverversionspolicy_l_evictserverversionspolicydecimal","displayName":"Number of days (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16~policy~l_microsoftofficesystem~l_miscellaneous437_l_maximplicitcachesize","displayName":"Set the max size of the Office Document Cache (User)","description":"This policy controls how large the user's Office Document Cache can be. It does not apply to explicitly cached files on \"OneDrive for Business Client\" and \"OneDrive (consumer) Client\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16~policy~l_microsoftofficesystem~l_miscellaneous437_l_maximplicitcachesize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16~policy~l_microsoftofficesystem~l_miscellaneous437_l_maximplicitcachesize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16~policy~l_microsoftofficesystem~l_miscellaneous437_l_maximplicitcachesize_l_maximplicitcachesizedecimal","displayName":"Percent of disk space (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16~policy~l_microsoftofficesystem~l_miscellaneous437_l_opendirectlyinapp","displayName":"Open Directly in Office Client Application (User)","description":"This policy allows the admin to choose whether Office documents located on web servers open up directly in the App or go via the web browser","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16~policy~l_microsoftofficesystem~l_miscellaneous437_l_opendirectlyinapp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16~policy~l_microsoftofficesystem~l_miscellaneous437_l_opendirectlyinapp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v10~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_allownonadminuserinstalllaps","displayName":"Allow users who aren’t admins to install language accessory packs (User)","description":"This policy setting controls whether users can install language accessory packs for Office even if they don’t have local administrator permissions on their devices. By default, users must have local administrator permissions on their devices to install language accessory packs.\r\n\r\nIf you enable this policy setting, users will be able to install language accessory packs for Office even if they don’t have local administrator permissions on their devices. They can install those language accessory packs by going to File > Options > Language in the app, such as Word.\r\n\r\nIf you disable or don’t configure this policy setting, users who don’t have local administrator permissions on their devices won’t be able to install language accessory packs. Someone with local administrator permissions on the device will need to install the language accessory packs for the user.\r\n\r\nFor more information, see https://go.microsoft.com/fwlink/p/?linkid=2161939.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v10~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_allownonadminuserinstalllaps_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v10~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_allownonadminuserinstalllaps_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v11~policy~l_microsoftofficesystem~l_miscellaneous437_l_officerecommendeddocuments","displayName":"Show recommended files on the File tab or start page (User)","description":"This policy setting allows you to control whether users see a list of recommended files on the File tab or start page in Word, Excel, and PowerPoint, on devices running Windows.\r\n\r\nIf you enable this policy setting, users will see a list of recommended files on the File tab or start page.\r\n\r\nIf you disable this policy setting, users won't see a list of recommended files on the File tab or start page.\r\n\r\nIf you don't configure this policy setting, users will see a list of recommended files on the File tab or start page.\r\n\r\nFor more information, see https://go.microsoft.com/fwlink/p/?linkid=2146780.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v11~policy~l_microsoftofficesystem~l_miscellaneous437_l_officerecommendeddocuments_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v11~policy~l_microsoftofficesystem~l_miscellaneous437_l_officerecommendeddocuments_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v11~policy~l_microsoftofficesystem~l_services_l_officeenableautoalttext","displayName":"Automatically generate alternative text (alt text) for pictures (User)","description":"This policy setting controls whether alternative text (alt text) is generated automatically for pictures in Word, PowerPoint, and Outlook.\r\n\r\nThis policy setting is related to the \"Automatically generate alt text for me\" check box under File > Options > Ease of Access > Automatic Alt Text.\r\n\r\nIf you enable this policy setting, alt text will be generated automatically for pictures. The \"Automatically generate alt text for me\" check box will be selected and users won't be able to clear the check box.\r\n\r\nIf you disable this policy setting, alt text won't be generated automatically for pictures. The \"Automatically generate alt text for me\" check box won't be selected and users won't be able to select the check box.\r\n\r\nIf you don't configure this policy setting, alt text will be generated automatically for pictures. But, users will be able to clear the \"Automatically generate alt text for me\" check box.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v11~policy~l_microsoftofficesystem~l_services_l_officeenableautoalttext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v11~policy~l_microsoftofficesystem~l_services_l_officeenableautoalttext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v12~policy~l_microsoftofficesystem~l_miscellaneous437_l_ageoutpolicylocalversioning","displayName":"Number of days to keep local document versions in the local cache (User)","description":"This policy controls how long local document versions are kept in the local cache. The default setting is 30 days and applies to Word, Excel, and PowerPoint. \r\n\r\nIf you enable this policy setting, local document versions will be kept for the number of days specified, after which they’ll be deleted from the local cache. You can configure the setting with a value from 1 to 30.\r\n\r\nIf you disable or don’t configure this policy setting, local document versions will be kept for 30 days, after which they’ll be deleted from the local cache.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v12~policy~l_microsoftofficesystem~l_miscellaneous437_l_ageoutpolicylocalversioning_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v12~policy~l_microsoftofficesystem~l_miscellaneous437_l_ageoutpolicylocalversioning_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v12~policy~l_microsoftofficesystem~l_miscellaneous437_l_ageoutpolicylocalversioning_l_ageoutpolicylocalversioningdecimal","displayName":"Number of days (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v12~policy~l_microsoftofficesystem~l_miscellaneous437_l_disallowedroamingmrudomains","displayName":"Turn off roaming of file names and metadata by server domain. (User)","description":"\r\nThis policy setting controls whether file names and metadata for Office files are roamed and appear in the list of recently opened files in an Office app, such as Word, on different devices.\r\n\r\nRoaming, which relies on a web-based Microsoft service, occurs when a user signs into Office with the same work or school account on different devices.\r\n\r\nNote: This policy is applied to any Office files stored on a specified list of server domains. The set of disallowed domains is a semicolon separated list: \"*.contoso.com;service.microsoft.com\".\r\n\r\nIf you enable this policy setting, file names and metadata won't roam and won’t appear in the list of recently opened files in Office apps on other devices, unless the file has been opened on that device.\r\n\r\nIf you disable or don't configure this policy setting, file names and metadata will roam and will appear in the list of recently opened files in Office apps on other devices, even if the file hasn’t been opened on that device.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v12~policy~l_microsoftofficesystem~l_miscellaneous437_l_disallowedroamingmrudomains_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v12~policy~l_microsoftofficesystem~l_miscellaneous437_l_disallowedroamingmrudomains_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v12~policy~l_microsoftofficesystem~l_miscellaneous437_l_disallowedroamingmrudomains_l_disalloweddomainlist","displayName":"Disallowed Domains: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v12~policy~l_microsoftofficesystem~l_securitysettings_l_basicauthpromptbehavior","displayName":"Allow specified hosts to show Basic Authentication prompts to Office apps (User)","description":"This policy setting allows you to specify which hosts can show Basic Authentication sign-in prompts to Office apps.\r\n\r\nBy default, all Basic Authentication sign-in prompts are blocked, and the user is shown a message that the sign-in method isn’t allowed.\r\n\r\nIf you enable this policy setting, you need to enter the hosts by name, separating the host names with a semi-colon. For example: server1.contoso.com; server2.fabrikam.com.\r\n\r\nWarning: Allowing Basic Authentication sign-in prompts isn’t recommended because it’s a security risk.\r\n\r\nBasic Authentication sign-in prompts from all other hosts will be blocked and the user will be shown a message that the sign-in method isn’t allowed.\r\n\r\nIf you disable or don’t configure this policy setting, all Basic Authentication sign-in prompts will be blocked, and the user will be shown a message that the sign-in method isn’t allowed.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise, and to subscription versions of Project and Visio.\r\n\r\nFor more information, see https://go.microsoft.com/fwlink/p/?linkid=2199001.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v12~policy~l_microsoftofficesystem~l_securitysettings_l_basicauthpromptbehavior_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v12~policy~l_microsoftofficesystem~l_securitysettings_l_basicauthpromptbehavior_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v12~policy~l_microsoftofficesystem~l_securitysettings_l_basicauthpromptbehavior_l_authenticationbasicauthenabledhostsid","displayName":"Host names: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v12~policy~l_microsoftofficesystem~l_securitysettings_l_basicauthproxybehavior","displayName":"Allow Basic Authentication prompts from network proxies (User)","description":"This policy setting controls whether network proxies are allowed to show Basic Authentication prompts.\r\n\r\nBy default, all Basic Authentication sign-in prompts are blocked, and the user is shown a message that the sign-in method isn’t allowed.\r\n\r\nIf you enable this policy setting, then network proxies will be allowed to show Basic Authentication prompts.\r\n\r\nWarning: Allowing Basic Authentication sign-in prompts isn’t recommended because it’s a security risk.\r\n\r\nIf you disable or don’t configure this policy setting, all Basic Authentication sign-in prompts from network proxes will be blocked, and the user will be shown a message that the sign-in method isn’t allowed.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise, and to subscription versions of Project and Visio.\r\n\r\nFor more information, see https://go.microsoft.com/fwlink/p/?linkid=2199001.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v12~policy~l_microsoftofficesystem~l_securitysettings_l_basicauthproxybehavior_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v12~policy~l_microsoftofficesystem~l_securitysettings_l_basicauthproxybehavior_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v13~policy~l_microsoftofficesystem~l_pdfandxps_l_pdfprotectionfromoffice","displayName":"Use the Sensitivity feature in Office to apply sensitivity labels to PDFs (User)","description":"This policy setting controls whether sensitivity labels powered by Microsoft Purview Information Protection are applied to PDFs created in Word, Excel, and PowerPoint.​\r\n\r\nIf you enable this policy setting or don’t configure it, PDFs will inherit the sensitivity label and encryption from the source Word, Excel, and PowerPoint document.\r\n\r\nIf you disable this policy setting, PDFs created in Word, Excel, and PowerPoint do not inherit their source file’s sensitivity labels and encryption. When the source file is encrypted, users who do not have the rights to remove protection cannot export to PDF.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise. For more information about this setting, see https://go.microsoft.com/fwlink/?linkid=2220953.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v13~policy~l_microsoftofficesystem~l_pdfandxps_l_pdfprotectionfromoffice_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v13~policy~l_microsoftofficesystem~l_pdfandxps_l_pdfprotectionfromoffice_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v13~policy~l_microsoftofficesystem~l_securitysettings_l_aipexception","displayName":"Use the Azure Information Protection add-in for sensitivity labeling (User)","description":"This policy setting controls whether the Microsoft Azure Information Protection add-in can be used rather than the default of built-in labeling to view and apply sensitivity labels in Office apps. It applies only to subscription versions of Office, such as Microsoft 365 Apps for enterprise.​\r\n\r\nIf you enable this policy setting and the Microsoft Azure Information Protection unified labeling client is installed, the add-in from that client replaces the default labeling built into Office apps.\r\n\r\nIf you disable this policy setting or don’t configure it, the default labeling experience that’s built-in for Office apps is used to view and apply sensitivity labels.​\r\n\r\nFor more information about this setting, see https://go.microsoft.com/fwlink/p/?linkid=2207430.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v13~policy~l_microsoftofficesystem~l_securitysettings_l_aipexception_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v13~policy~l_microsoftofficesystem~l_securitysettings_l_aipexception_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v14~policy~l_microsoftofficesystem~l_m365linkshandling_l_m365linksbrowserchoice","displayName":"Choose which browser opens web links (User)","description":"This policy controls which browser will open web links from within supported Microsoft 365 apps. By default, web links will open in Microsoft Edge.\r\n\r\nNote: This policy doesn’t override any user settings or policies that specify that document links should open in the desktop apps instead of their web app counterparts.\r\n\r\nIf you enable this policy, you can choose either “System default browser” or a specific browser, such as “Microsoft Edge.” “System default browser” refers to the browser setting specified on the user’s Windows device.\r\n\r\nIf you disable or don’t configure this policy, web links will open in Microsoft Edge. The user can set their preferred browser from the settings for the specific Microsoft 365 app.\r\n\r\nFor more information, see https://go.microsoft.com/fwlink/p/?linkid=2224834.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v14~policy~l_microsoftofficesystem~l_m365linkshandling_l_m365linksbrowserchoice_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v14~policy~l_microsoftofficesystem~l_m365linkshandling_l_m365linksbrowserchoice_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v14~policy~l_microsoftofficesystem~l_m365linkshandling_l_m365linksbrowserchoice_l_browserchoiceenum","displayName":"Browser: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v14~policy~l_microsoftofficesystem~l_m365linkshandling_l_m365linksbrowserchoice_l_browserchoiceenum_0","displayName":"System default browser","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v14~policy~l_microsoftofficesystem~l_m365linkshandling_l_m365linksbrowserchoice_l_browserchoiceenum_1","displayName":"Microsoft Edge","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v14~policy~l_microsoftofficesystem~l_securitysettings_l_encryptiontypeforirm","displayName":"Encryption mode for Information Rights Management (IRM) (User)","description":"If you enable this policy setting, you can choose from two options for controlling the encryption mode that Excel, PowerPoint, Word, Visio, and Outlook applications use to protect content with Information Rights Management (IRM):\r\n\r\n- Electronic Codebook (ECB) – ECB mode is always used when applying IRM encryption.\r\n- Cipher Block Chaining (CBC) – CBC mode is always used when applying IRM encryption.\r\n\r\nIf you disable or don't configure this policy setting:\r\n\r\n- For Microsoft 365 Apps (Version 2304 or later): Cipher Block Chaining (CBC) mode is used.\r\n- For earlier Microsoft 365 Apps and Office LTSC 2021, 2019, and 2016: Electronic Codebook (ECB) mode is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v14~policy~l_microsoftofficesystem~l_securitysettings_l_encryptiontypeforirm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v14~policy~l_microsoftofficesystem~l_securitysettings_l_encryptiontypeforirm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v14~policy~l_microsoftofficesystem~l_securitysettings_l_encryptiontypeforirm_l_encryptiontypeforirmcolon","displayName":"IRM Encryption Mode: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v14~policy~l_microsoftofficesystem~l_securitysettings_l_encryptiontypeforirm_l_encryptiontypeforirmcolon_1","displayName":"Cipher Block Chaining (CBC)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v14~policy~l_microsoftofficesystem~l_securitysettings_l_encryptiontypeforirm_l_encryptiontypeforirmcolon_2","displayName":"Electronic Codebook (ECB)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v15~policy~l_microsoftofficesystem~l_miscellaneous437_l_disableresourceidnamemapping","displayName":"Disable caching when opening server-only files. (User)","description":"This policy setting controls disabling caching when opening server-only files.\r\n\r\nCaching files helps Office speed up server-only file opens but could cause conflicts for organizations that rename files or change file contents directly on SharePoint.\r\n\r\nThe cache is meant to improve performance so disabling it is expected to hurt performance.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v15~policy~l_microsoftofficesystem~l_miscellaneous437_l_disableresourceidnamemapping_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v15~policy~l_microsoftofficesystem~l_miscellaneous437_l_disableresourceidnamemapping_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v16~policy~l_microsoftofficesystem~l_miscellaneous437_l_disabletrainingofadaptivefloatieuser","displayName":"Disable local training of the Adaptive Floatie feature for the user. (User)","description":"\r\nThis policy setting disables local training of the Adaptive Floatie feature for the user.\r\n\r\nFor local training policy, feature-specific settings are prioritized over general settings and computer settings are prioritized over user settings.\r\n\r\nIf a higher priority policy setting is not configured, then:\r\n- If this policy setting is enabled, local training of the Adaptive Floatie feature is disabled for the user.\r\n- If this policy setting is disabled, local training of the Adaptive Floatie feature is enabled for the user.\r\n- If this policy setting is not configured, local training of the Adaptive Floatie feature is determined by lower priority policy settings.\r\n- If this policy setting is not configured and lower priority policy settings are also not configured, local training of the Adaptive Floatie feature is enabled for the user.\r\n\r\nFor this policy setting, the order of priority is:\r\n1. Disable local training of the Adaptive Floatie feature for the computer.\r\n2. Disable local training of all features for the computer.\r\n3. Disable local training of the Adaptive Floatie feature for the user.\r\n4. Disable local training of all features for the user.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v16~policy~l_microsoftofficesystem~l_miscellaneous437_l_disabletrainingofadaptivefloatieuser_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v16~policy~l_microsoftofficesystem~l_miscellaneous437_l_disabletrainingofadaptivefloatieuser_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v16~policy~l_microsoftofficesystem~l_miscellaneous437_l_disabletraininguser","displayName":"Disable local training of all features for the user. (User)","description":"\r\nThis policy setting disables local training of all features for the user.\r\n\r\nFor local training policy, feature-specific settings are prioritized over general settings and computer settings are prioritized over user settings.\r\n\r\nIf a higher priority policy setting is not configured, then:\r\n- If this policy setting is enabled, local training of all features is disabled for the user.\r\n- If this policy setting is disabled, local training of all features is enabled for the user.\r\n- If this policy setting is not configured, local training of all features is enabled for the user.\r\n\r\nFor this policy setting, the order of priority is:\r\n1. Disable local training of [a specific feature] for the computer.\r\n2. Disable local training of all features for the computer.\r\n3. Disable local training of [a specific feature] for the user.\r\n4. Disable local training of all features for the user.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v16~policy~l_microsoftofficesystem~l_miscellaneous437_l_disabletraininguser_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v16~policy~l_microsoftofficesystem~l_miscellaneous437_l_disabletraininguser_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v16~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_allowuserdefinedfilesharecatalogs","displayName":"Allow users to control the Trusted Shared Folder Catalogs (User)","description":"\r\nThis policy setting allows users to control all the Trusted Shared Folder Catalogs when other policy settings in the Trusted Catalogs folder are set by policy. \r\n\r\nNote: This setting only applies to Version 2308 or later of Office.\r\n\r\nIf you enable this policy setting, users can set their own Trusted Shared Folder Catalogs including the Default Shared Folder location. Shared Folder Catalogs defined by policy will not be used.\r\n\r\nIf you disable this policy setting, then all Trusted Shared Folders Catalogs are policy controlled.\r\n\r\nIf you do not configure this policy setting but do configure other policy settings in the Trusted Catalogs folder, the Trusted Shared Folder Catalogs are policy controlled. If you do not configure this policy setting or any other policy setting in the Trusted Catalogs folder, users can set their own Trusted Shared Folder locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v16~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_allowuserdefinedfilesharecatalogs_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v16~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_allowuserdefinedfilesharecatalogs_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v17~policy~l_microsoftofficesystem~l_diagnostics_l_configuregetdiagnostics","displayName":"Configure Get Diagnostics feature's visibility in the Help Ribbon in Office applications and control the feature's mode of operation. (User)","description":"This policy setting allows you to enable or disable Get Diagnostics in Office applications and specifies the mode in which the feature operates.\r\n\r\nIf you enable this policy setting, you must choose one of the following options:\r\nDisabled\r\nEnable upload of diagnostics logs to Microsoft\r\nEnable the collection of diagnostic logs in an archive\r\n\r\nIf you select \"Disabled\", Office applications will not display a visible Get Diagnostics button in the Help Ribbon.\r\n\r\nIf you select \"Enable upload of diagnostics logs to Microsoft\", Office applications will have a visible Get Diagnostics button in the Help Ribbon. Clicking this button will upload the application’s diagnostic logs to Microsoft for support purposes.\r\n\r\nIf you select \"Enable the collection of diagnostic logs in an archive\", Office applications will have a visible Get Diagnostics button in the Help Ribbon. Clicking this button will capture the application’s diagnostic logs in a file archive on the device where the application is currently running. These logs will not be uploaded to Microsoft.\r\n\r\nPlease note that the option “Enable the collection of diagnostic logs in an archive” may not be applicable in certain Office applications. When the application does not support local log collection, setting the policy to this option will completely disable the feature, removing the \"Get Diagnostics\" button.\r\n\r\nIf you don’t set this policy, the feature will operate in the default mode, which is “Enable upload of diagnostics logs to Microsoft.”\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v17~policy~l_microsoftofficesystem~l_diagnostics_l_configuregetdiagnostics_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v17~policy~l_microsoftofficesystem~l_diagnostics_l_configuregetdiagnostics_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v17~policy~l_microsoftofficesystem~l_diagnostics_l_configuregetdiagnostics_l_configuregetdiagnosticsenum","displayName":"Configure Get Diagnostics: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v17~policy~l_microsoftofficesystem~l_diagnostics_l_configuregetdiagnostics_l_configuregetdiagnosticsenum_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v17~policy~l_microsoftofficesystem~l_diagnostics_l_configuregetdiagnostics_l_configuregetdiagnosticsenum_1","displayName":"Upload diagnostic logs to Microsoft","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v17~policy~l_microsoftofficesystem~l_diagnostics_l_configuregetdiagnostics_l_configuregetdiagnosticsenum_2","displayName":"Capture diagnostic logs in a local archive, dont upload logs to Microsoft","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v18~policy~l_microsoftofficesystem~l_miscellaneous437_l_linksopenrightdefaultsettingisnative","displayName":"File links open preference default selection as Desktop App (User)","description":"This policy setting controls which file links open preference is set as the default for users’ who has not make their selection. For more information about file links handling and open preference in Office, see https://go.microsoft.com/fwlink/?linkid=2277074. User can manually change the default selection anytime.\r\n\r\nIf you enabled this policy setting, file open preference in Word, Excel, PowerPoint, and Outlook will be defaulted to open in Desktop App.\r\n\r\nIf you disable this policy setting, file open preference in Word, Excel, PowerPoint, and Outlook will be defaulted to open in web browser.\r\n\r\nNote: This policy setting only applies to subscription version of Office.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v18~policy~l_microsoftofficesystem~l_miscellaneous437_l_linksopenrightdefaultsettingisnative_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v18~policy~l_microsoftofficesystem~l_miscellaneous437_l_linksopenrightdefaultsettingisnative_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v19~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_acceptalleulas","displayName":"Accept all EULAs (User)","description":"By default, users are required to accept a EULA upon activating an Office license. By setting this policy, all EULAs will be automatically accepted machine-wide and no prompts will be shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v19~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_acceptalleulas_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v19~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_acceptalleulas_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2.updates.2~policy~l_microsoftofficesystem~l_miscellaneous437_l_onlinestoragefilter","displayName":"Hide Microsoft cloud-based file locations in the Backstage view (User)","description":"This policy setting allows you to hide Microsoft cloud-based file locations in the Backstage view in Office. This helps prevent users from opening, saving, or sharing cloud-based files to locations such as: OneDrive, SharePoint, or Third Party Services.\r\n\r\nThis policy setting only applies to Word, PowerPoint, and Excel.\r\n\r\nTo filter specific services, add the values for all services to be disabled:\r\n 1 - OneDrive Personal\r\n 4 - ThisPC\r\n 8 - SharePoint OnPrem\r\n 16 - Recent Places\r\n 32 - SharePoint\r\n 64 - OneDrive for Business\r\n 128 - Third Party Services\r\n\r\nSpecial Values:\r\n 0 - (Default) All services enabled.\r\n 2 - (Legacy Value) Disable SharePoint and OneDrive for Business.\r\n\t4294967295 - All optional services disabled.\r\n\r\nFor example, OneDrive Personal (1), This PC (4) and Third Party Services (128) can all be disabled with a value of 133.\r\n\r\nThis value is calculated as follows: 1 + 4 + 128 = 133\r\n\r\nCommon Setting Values:\r\n 1 - Disable OneDrive Personal\r\n 2 - Disable SharePoint Online and OneDrive for Business\r\n 3 - Disable SharePoint Online, OneDrive for Business, and OneDrive Personal\r\n\r\nIf you disable or don’t configure this policy setting, users can use any configured Microsoft cloud-based file location to open, save, and share files.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2.updates.2~policy~l_microsoftofficesystem~l_miscellaneous437_l_onlinestoragefilter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2.updates.2~policy~l_microsoftofficesystem~l_miscellaneous437_l_onlinestoragefilter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2.updates.2~policy~l_microsoftofficesystem~l_miscellaneous437_l_onlinestoragefilter_l_onlinestoragefilterid","displayName":"Online Storage Filter Value: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2.updates.2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_connectedofficeexperiences","displayName":"Allow the use of connected experiences in Office (User)","description":"This policy setting allows you to control whether connected experiences are available to your users when they're using Office.\r\n\r\nConnected experiences include experiences that analyze content, such as Editor in Word, experiences that download online content, such as PowerPoint QuickStarter, and other connected experiences, such as document co-authoring and online file storage. It also includes additional optional connected experiences, such as inserting an online video into a PowerPoint presentation or the 3D Maps feature in Excel, which uses Bing. See the Note at the end for more information about other policy settings that you can use to control these connected experiences.\r\n\r\nIf you enable this policy setting, these connected experiences will be available to your users.\r\n\r\nIf you disable this policy setting, these connected experiences won't be available to your users.\r\n\r\nNote: If you disable this policy setting, nearly all connected experiences will be turned off. However, limited Office functionality will remain available, such as synching a mailbox in Outlook. Essential services, such as the licensing service that confirms that you’re properly licensed to use Office, will also remain available.\r\n\r\nIf you don't configure this policy setting, these connected experiences will be available to your users.\r\n\r\nNote: You can use these other policy settings if you want to disable just a certain group of connected experiences: \"Allow the use of connected experiences in Office that analyze content\", \"Allow the use of connected experiences in Office that download online content\", and \"Allow the use of additional optional connected experiences in Office\".\r\n\r\nFor more information, see https://go.microsoft.com/fwlink/p/?linkid=2085689","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2.updates.2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_connectedofficeexperiences_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2.updates.2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_connectedofficeexperiences_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2.updates.3~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_officeexperiencesanlayzingcontent","displayName":"Allow the use of connected experiences in Office that analyze content (User)","description":"This policy setting allows you to control whether connected experiences that analyze content are available to your users when they're using Office.\r\n\r\nPowerPoint Designer and Editor in Word are examples of connected experiences that analyze content.\r\n\r\nIf you enable this policy setting, connected experiences that analyze content will be available to your users.\r\n\r\nIf you disable this policy setting, connected experiences that analyze content won't be available to your users.\r\n\r\nIf you don't configure this policy setting, connected experiences that analyze content will be available to your users.\r\n\r\nNote: If you disable the \"Allow the use of connected experiences in Office\" policy setting, connected experiences that analyze content won't be available to your users.\r\n\r\nFor more information, see https://go.microsoft.com/fwlink/p/?linkid=2085794\r\n\r\nNote: For information about how this policy setting affects Microsoft 365 Copilot, see https://go.microsoft.com/fwlink/p/?linkid=2248397.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2.updates.3~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_officeexperiencesanlayzingcontent_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2.updates.3~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_officeexperiencesanlayzingcontent_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2.updates.3~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_officeexperiencesdownloadingcontent","displayName":"Allow the use of connected experiences in Office that download online content (User)","description":"This policy setting allows you to control whether connected experiences that download online content are available to your users when they’re using Office.\r\n\r\nOffice templates and PowerPoint QuickStarter are examples of connected experiences that download online content.\r\n\r\nIf you enable this policy setting, connected experiences that download online content will be available to your users.\r\n\r\nIf you disable this policy setting, connected experiences that download online content won’t be available to your users.\r\n\r\nIf you don’t configure this policy setting, connected experiences that download online content will be available to your users.\r\n\r\nNote: If you disable the “Allow the use of connected experiences in Office” policy setting, connected experiences that download online content won’t be available to your users.\r\n\r\nFor more information, see https://go.microsoft.com/fwlink/p/?linkid=2085688","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2.updates.3~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_officeexperiencesdownloadingcontent_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2.updates.3~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_officeexperiencesdownloadingcontent_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2.updates.3~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_optionalconnectedexperiences","displayName":"Allow the use of additional optional connected experiences in Office (User)","description":"This policy setting allows you to control whether additional optional connected experiences are available to your users when they’re using Office.\r\n\r\nAdditional optional connected experiences are offered by Microsoft directly to your users and are governed by terms other than your organization’s commercial agreement with Microsoft.\r\n\r\nInserting an online video into a PowerPoint presentation or the 3D Maps feature in Excel, which uses Bing, are examples of additional optional connected experiences.\r\n\r\nNote: Even if you choose to make these additional optional connected experiences available to your users, your users will have the option to turn these additional optional connected experiences off as a group by going to File > Account > Account Privacy > Manage Settings.\r\n\r\nIf you enable this policy setting, additional optional connected experiences will be available to your users.\r\n\r\nIf you disable this policy setting, additional optional connected experiences won’t be available to your users.\r\n\r\nNote: Some additional optional connected experiences may be controlled by other policy settings instead of this policy setting. For more information, see the link below.\r\n\r\nIf you don’t configure this policy setting, additional optional connected experiences will be available to your users.\r\n\r\nNote: If you disable the “Allow the use of connected experiences in Office” policy setting, additional optional connected experiences won’t be available to your users.\r\n\r\nFor more information, see https://go.microsoft.com/fwlink/p/?linkid=2085690\r\n\r\nNote: For information about how this policy setting affects Microsoft 365 Copilot, see https://go.microsoft.com/fwlink/p/?linkid=2248196.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2.updates.3~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_optionalconnectedexperiences_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2.updates.3~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_optionalconnectedexperiences_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffexcel","displayName":"Turn off AutoSave by default in Excel (User)","description":"This policy setting allows you to turn off AutoSave by default in Excel. AutoSave automatically saves all changes a user makes to files that are stored in OneDrive, OneDrive for Business, or SharePoint Online.\r\n\r\nIf you enable this policy setting, AutoSave is off by default in Excel. But, the user can enable AutoSave for Excel by going to File > Options > Save. Or, the user can enable AutoSave for a specific Excel file by using the AutoSave toggle in the title bar.\r\n\r\nIf you disable or don’t configure this policy setting, AutoSave is on by default, but the user can disable AutoSave by going to File > Options > Save or by using the AutoSave toggle.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffexcel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffexcel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffexcel_l_autosavedefaultsettingenum","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffexcel_l_autosavedefaultsettingenum_0","displayName":"Use AutoSave Default Setting","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffexcel_l_autosavedefaultsettingenum_1","displayName":"AutoSave Is On By Default","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffexcel_l_autosavedefaultsettingenum_2","displayName":"AutoSave Is Off By Default","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffpowerpoint","displayName":"Turn off AutoSave by default in PowerPoint (User)","description":"This policy setting allows you to turn off AutoSave by default in PowerPoint. AutoSave automatically saves all changes a user makes to files that are stored in OneDrive, OneDrive for Business, or SharePoint Online.\r\n\r\nIf you enable this policy setting, AutoSave is off by default in PowerPoint. But, the user can enable AutoSave for PowerPoint by going to File > Options > Save. Or, the user can enable AutoSave for a specific PowerPoint file by using the AutoSave toggle in the title bar.\r\n \r\nIf you disable or don’t configure this policy setting, AutoSave is on by default, but the user can disable AutoSave by going to File > Options > Save or by using the AutoSave toggle.\r\n \r\nNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffpowerpoint_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffpowerpoint_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffpowerpoint_l_autosavedefaultsettingenum","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffpowerpoint_l_autosavedefaultsettingenum_0","displayName":"Use AutoSave Default Setting","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffpowerpoint_l_autosavedefaultsettingenum_1","displayName":"AutoSave Is On By Default","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffpowerpoint_l_autosavedefaultsettingenum_2","displayName":"AutoSave Is Off By Default","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffword","displayName":"Turn off AutoSave by default in Word (User)","description":"This policy setting allows you to turn off AutoSave by default in PowerPoint. AutoSave automatically saves all changes a user makes to files that are stored in OneDrive, OneDrive for Business, or SharePoint Online.\r\n\r\nIf you enable this policy setting, AutoSave is off by default in PowerPoint. But, the user can enable AutoSave for PowerPoint by going to File > Options > Save. Or, the user can enable AutoSave for a specific PowerPoint file by using the AutoSave toggle in the title bar.\r\n \r\nIf you disable or don’t configure this policy setting, AutoSave is on by default, but the user can disable AutoSave by going to File > Options > Save or by using the AutoSave toggle.\r\n \r\nNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffword_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffword_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffword_l_autosavedefaultsettingenum","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffword_l_autosavedefaultsettingenum_0","displayName":"Use AutoSave Default Setting","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffword_l_autosavedefaultsettingenum_1","displayName":"AutoSave Is On By Default","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_autosavedefaultoffword_l_autosavedefaultsettingenum_2","displayName":"AutoSave Is Off By Default","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_dontautosaveinformationexcel","displayName":"[Deprecated] Don’t AutoSave files in Excel (User)","description":"Important: This policy setting will be removed in a future release and will no longer be supported. Please use the \"Turn off AutoSave by default in Excel\" policy setting instead.\r\n \r\nThis policy setting controls whether files can be AutoSaved in the desktop version of Excel after Excel has been updated with new features. By default, Auto Saving files is Enabled.\r\n\r\nIf you enable this policy setting files will not be able to be AutoSaved.\r\n\r\nIf you disable or don’t configure this policy setting files will be able to be AutoSaved.\r\n\r\nNote: There are separate policy settings for Word, Excel, and PowerPoint.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_dontautosaveinformationexcel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_dontautosaveinformationexcel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_dontautosaveinformationpowerpoint","displayName":"[Deprecated] Don’t AutoSave files in PowerPoint (User)","description":"Important: This policy setting will be removed in a future release and will no longer be supported. Please use the \"Turn off AutoSave by default in PowerPoint\" policy setting instead.\r\n \r\nThis policy setting controls whether files can be AutoSaved in the desktop version of PowerPoint after PowerPoint has been updated with new features. By default, Auto Saving files is Enabled.\r\n\r\nIf you enable this policy setting files will not be able to be AutoSaved.\r\n\r\nIf you disable or don’t configure this policy setting files will be able to be AutoSaved.\r\n\r\nNote: There are separate policy settings for Word, Excel, and PowerPoint.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_dontautosaveinformationpowerpoint_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_dontautosaveinformationpowerpoint_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_dontautosaveinformationword","displayName":"[Deprecated] Don’t AutoSave files in Word (User)","description":"Important: This policy setting will be removed in a future release and will no longer be supported. Please use the \"Turn off AutoSave by default in Word\" policy setting instead.\r\n \r\nThis policy setting controls whether files can be AutoSaved in the desktop version of Word after Word has been updated with new features. By default, Auto Saving files is Enabled.\r\n\r\nIf you enable this policy setting files will not be able to be AutoSaved.\r\n\r\nIf you disable or don’t configure this policy setting files will be able to be AutoSaved.\r\n\r\nNote: There are separate policy settings for Word, Excel, and PowerPoint.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_dontautosaveinformationword_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_autosave_l_dontautosaveinformationword_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast_l_disabledefaultservice","displayName":"Remove Office Presentation Service from the list of online presentation services in PowerPoint and Word (User)","description":"This policy setting allows you to remove Office Presentation Service from the list of online presentation services in PowerPoint and Word. This list appears when a user selects Present Online from the Share tab in Backstage view and in the ribbon in PowerPoint.\r\n\r\nIf you enable this policy setting, Office Presentation Service is not shown as an option for presenting online. \r\n\r\nIf you disable or do not configure this policy setting, users can select Office Presentation Service to present their PowerPoint or Word file to other users online.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast_l_disabledefaultservice_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast_l_disabledefaultservice_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast_l_disableprogrammaticaccess","displayName":"Restrict programmatic access for creating online presentations in PowerPoint and Word (User)","description":"This policy setting allows you to restrict the ability to create an online presentation programmatically in PowerPoint and Word.\r\n\r\nIf you enable this policy setting, an online presentation cannot be created programmatically.\r\n\r\nIf you disable or do not configure this policy setting, an online presentation can be created programmatically.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast_l_disableprogrammaticaccess_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast_l_disableprogrammaticaccess_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast_l_preventaccesstouserspecifiedservices","displayName":"Prevent users from adding online presentation services in PowerPoint and Word (User)","description":"This policy setting allows you to prevent users from adding new or previously created presentation services to the list of online presentation services in PowerPoint and Word. These services appear when a user selects the More services link under Present Online on the Share tab in Backstage view.\r\n\r\nIf you enable or do not configure this policy setting, the More services link does not allow users to add a new presentation service. In addition, all services previously added by users are removed from the list.\r\n\r\nIf you disable this policy setting, the More Services link provides an option for users to add a new presentation service. In addition, the list of services previously added by users appears in the list of services.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast_l_preventaccesstouserspecifiedservices_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast_l_preventaccesstouserspecifiedservices_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice00","displayName":"Configure presentation service in PowerPoint and Word 1 (User)","description":"This policy setting allows you to add a presentation service to the list of online presentation services in PowerPoint and Word. This list appears when a user selects the More services link under Present Online on the Share tab in Backstage view in PowerPoint and Word and in the ribbon in PowerPoint.\r\n\r\nIf you enable this policy setting, you can add a presentation service to the list of online presentation services in PowerPoint and Word. For each service you add, you must specify a name and URL. Optionally, you can specify a description, the URL of a web page with more information about the service, and the URL of a web page with service terms that the user can display by selecting the Service Agreement link. \r\n\r\nIf you disable or do not configure this policy setting, the More services link displays only services that are manually added by users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice00_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice00_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice00_l_broadcastservicecreatesharednotes0","displayName":"Create Shared Notes (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice00_l_broadcastservicecreatesharednotes0_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice00_l_broadcastservicecreatesharednotes0_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice00_l_broadcastservicemajorversion0","displayName":"Server Major Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice00_l_broadcastserviceminorversion0","displayName":"Server Minor Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice00_l_broadcastservicenotesdefaulturl0","displayName":"Shared Notes Default Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice00_l_broadcastserviceservercapabilities0","displayName":"Server Capabilities flags: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice00_l_broadcastserviceserverdescription0","displayName":"Description (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice00_l_broadcastserviceserverinfo0","displayName":"Information URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice00_l_broadcastserviceservername0","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice00_l_broadcastserviceserverterms0","displayName":"Service agreement URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice00_l_broadcastserviceserverurl0","displayName":"Service URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice00_l_broadcastservicesharednotescustomurl0","displayName":"Shared Notes Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice01","displayName":"Configure presentation service in PowerPoint and Word 2 (User)","description":"This policy setting allows you to add a presentation service to the list of online presentation services in PowerPoint and Word. This list appears when a user selects the More services link under Present Online on the Share tab in Backstage view in PowerPoint and Word and in the ribbon in PowerPoint.\r\n\r\nIf you enable this policy setting, you can add a presentation service to the list of online presentation services in PowerPoint and Word. For each service you add, you must specify a name and URL. Optionally, you can specify a description, the URL of a web page with more information about the service, and the URL of a web page with service terms that the user can display by selecting the Service Agreement link. \r\n\r\nIf you disable or do not configure this policy setting, the More services link displays only services that are manually added by users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice01_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice01_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice01_l_broadcastservicecreatesharednotes1","displayName":"Create Shared Notes (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice01_l_broadcastservicecreatesharednotes1_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice01_l_broadcastservicecreatesharednotes1_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice01_l_broadcastservicemajorversion1","displayName":"Server Major Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice01_l_broadcastserviceminorversion1","displayName":"Server Minor Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice01_l_broadcastservicenotesdefaulturl1","displayName":"Shared Notes Default Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice01_l_broadcastserviceservercapabilities1","displayName":"Server Capabilities flags: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice01_l_broadcastserviceserverdescription1","displayName":"Description (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice01_l_broadcastserviceserverinfo1","displayName":"Information URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice01_l_broadcastserviceservername1","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice01_l_broadcastserviceserverterms1","displayName":"Service agreement URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice01_l_broadcastserviceserverurl1","displayName":"Service URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice01_l_broadcastservicesharednotescustomurl1","displayName":"Shared Notes Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice02","displayName":"Configure presentation service in PowerPoint and Word 3 (User)","description":"This policy setting allows you to add a presentation service to the list of online presentation services in PowerPoint and Word. This list appears when a user selects the More services link under Present Online on the Share tab in Backstage view in PowerPoint and Word and in the ribbon in PowerPoint.\r\n\r\nIf you enable this policy setting, you can add a presentation service to the list of online presentation services in PowerPoint and Word. For each service you add, you must specify a name and URL. Optionally, you can specify a description, the URL of a web page with more information about the service, and the URL of a web page with service terms that the user can display by selecting the Service Agreement link. \r\n\r\nIf you disable or do not configure this policy setting, the More services link displays only services that are manually added by users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice02_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice02_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice02_l_broadcastservicecreatesharednotes2","displayName":"Create Shared Notes (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice02_l_broadcastservicecreatesharednotes2_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice02_l_broadcastservicecreatesharednotes2_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice02_l_broadcastservicemajorversion2","displayName":"Server Major Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice02_l_broadcastserviceminorversion2","displayName":"Server Minor Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice02_l_broadcastservicenotesdefaulturl2","displayName":"Shared Notes Default Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice02_l_broadcastserviceservercapabilities2","displayName":"Server Capabilities flags: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice02_l_broadcastserviceserverdescription2","displayName":"Description (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice02_l_broadcastserviceserverinfo2","displayName":"Information URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice02_l_broadcastserviceservername2","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice02_l_broadcastserviceserverterms2","displayName":"Service agreement URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice02_l_broadcastserviceserverurl2","displayName":"Service URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice02_l_broadcastservicesharednotescustomurl2","displayName":"Shared Notes Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice03","displayName":"Configure presentation service in PowerPoint and Word 4 (User)","description":"This policy setting allows you to add a presentation service to the list of online presentation services in PowerPoint and Word. This list appears when a user selects the More services link under Present Online on the Share tab in Backstage view in PowerPoint and Word and in the ribbon in PowerPoint.\r\n\r\nIf you enable this policy setting, you can add a presentation service to the list of online presentation services in PowerPoint and Word. For each service you add, you must specify a name and URL. Optionally, you can specify a description, the URL of a web page with more information about the service, and the URL of a web page with service terms that the user can display by selecting the Service Agreement link. \r\n\r\nIf you disable or do not configure this policy setting, the More services link displays only services that are manually added by users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice03_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice03_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice03_l_broadcastservicecreatesharednotes3","displayName":"Create Shared Notes (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice03_l_broadcastservicecreatesharednotes3_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice03_l_broadcastservicecreatesharednotes3_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice03_l_broadcastservicemajorversion3","displayName":"Server Major Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice03_l_broadcastserviceminorversion3","displayName":"Server Minor Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice03_l_broadcastservicenotesdefaulturl3","displayName":"Shared Notes Default Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice03_l_broadcastserviceservercapabilities3","displayName":"Server Capabilities flags: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice03_l_broadcastserviceserverdescription3","displayName":"Description (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice03_l_broadcastserviceserverinfo3","displayName":"Information URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice03_l_broadcastserviceservername3","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice03_l_broadcastserviceserverterms3","displayName":"Service agreement URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice03_l_broadcastserviceserverurl3","displayName":"Service URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice03_l_broadcastservicesharednotescustomurl3","displayName":"Shared Notes Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice04","displayName":"Configure presentation service in PowerPoint and Word 5 (User)","description":"This policy setting allows you to add a presentation service to the list of online presentation services in PowerPoint and Word. This list appears when a user selects the More services link under Present Online on the Share tab in Backstage view in PowerPoint and Word and in the ribbon in PowerPoint.\r\n\r\nIf you enable this policy setting, you can add a presentation service to the list of online presentation services in PowerPoint and Word. For each service you add, you must specify a name and URL. Optionally, you can specify a description, the URL of a web page with more information about the service, and the URL of a web page with service terms that the user can display by selecting the Service Agreement link. \r\n\r\nIf you disable or do not configure this policy setting, the More services link displays only services that are manually added by users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice04_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice04_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice04_l_broadcastservicecreatesharednotes4","displayName":"Create Shared Notes (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice04_l_broadcastservicecreatesharednotes4_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice04_l_broadcastservicecreatesharednotes4_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice04_l_broadcastservicemajorversion4","displayName":"Server Major Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice04_l_broadcastserviceminorversion4","displayName":"Server Minor Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice04_l_broadcastservicenotesdefaulturl4","displayName":"Shared Notes Default Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice04_l_broadcastserviceservercapabilities4","displayName":"Server Capabilities flags: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice04_l_broadcastserviceserverdescription4","displayName":"Description (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice04_l_broadcastserviceserverinfo4","displayName":"Information URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice04_l_broadcastserviceservername4","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice04_l_broadcastserviceserverterms4","displayName":"Service agreement URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice04_l_broadcastserviceserverurl4","displayName":"Service URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice04_l_broadcastservicesharednotescustomurl4","displayName":"Shared Notes Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice05","displayName":"Configure presentation service in PowerPoint and Word 6 (User)","description":"This policy setting allows you to add a presentation service to the list of online presentation services in PowerPoint and Word. This list appears when a user selects the More services link under Present Online on the Share tab in Backstage view in PowerPoint and Word and in the ribbon in PowerPoint.\r\n\r\nIf you enable this policy setting, you can add a presentation service to the list of online presentation services in PowerPoint and Word. For each service you add, you must specify a name and URL. Optionally, you can specify a description, the URL of a web page with more information about the service, and the URL of a web page with service terms that the user can display by selecting the Service Agreement link. \r\n\r\nIf you disable or do not configure this policy setting, the More services link displays only services that are manually added by users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice05_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice05_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice05_l_broadcastservicecreatesharednotes5","displayName":"Create Shared Notes (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice05_l_broadcastservicecreatesharednotes5_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice05_l_broadcastservicecreatesharednotes5_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice05_l_broadcastservicemajorversion5","displayName":"Server Major Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice05_l_broadcastserviceminorversion5","displayName":"Server Minor Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice05_l_broadcastservicenotesdefaulturl5","displayName":"Shared Notes Default Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice05_l_broadcastserviceservercapabilities5","displayName":"Server Capabilities flags: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice05_l_broadcastserviceserverdescription5","displayName":"Description (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice05_l_broadcastserviceserverinfo5","displayName":"Information URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice05_l_broadcastserviceservername5","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice05_l_broadcastserviceserverterms5","displayName":"Service agreement URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice05_l_broadcastserviceserverurl5","displayName":"Service URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice05_l_broadcastservicesharednotescustomurl5","displayName":"Shared Notes Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice06","displayName":"Configure presentation service in PowerPoint and Word 7 (User)","description":"This policy setting allows you to add a presentation service to the list of online presentation services in PowerPoint and Word. This list appears when a user selects the More services link under Present Online on the Share tab in Backstage view in PowerPoint and Word and in the ribbon in PowerPoint.\r\n\r\nIf you enable this policy setting, you can add a presentation service to the list of online presentation services in PowerPoint and Word. For each service you add, you must specify a name and URL. Optionally, you can specify a description, the URL of a web page with more information about the service, and the URL of a web page with service terms that the user can display by selecting the Service Agreement link. \r\n\r\nIf you disable or do not configure this policy setting, the More services link displays only services that are manually added by users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice06_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice06_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice06_l_broadcastservicecreatesharednotes6","displayName":"Create Shared Notes (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice06_l_broadcastservicecreatesharednotes6_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice06_l_broadcastservicecreatesharednotes6_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice06_l_broadcastservicemajorversion6","displayName":"Server Major Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice06_l_broadcastserviceminorversion6","displayName":"Server Minor Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice06_l_broadcastservicenotesdefaulturl6","displayName":"Shared Notes Default Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice06_l_broadcastserviceservercapabilities6","displayName":"Server Capabilities flags: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice06_l_broadcastserviceserverdescription6","displayName":"Description (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice06_l_broadcastserviceserverinfo6","displayName":"Information URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice06_l_broadcastserviceservername6","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice06_l_broadcastserviceserverterms6","displayName":"Service agreement URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice06_l_broadcastserviceserverurl6","displayName":"Service URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice06_l_broadcastservicesharednotescustomurl6","displayName":"Shared Notes Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice07","displayName":"Configure presentation service in PowerPoint and Word 8 (User)","description":"This policy setting allows you to add a presentation service to the list of online presentation services in PowerPoint and Word. This list appears when a user selects the More services link under Present Online on the Share tab in Backstage view in PowerPoint and Word and in the ribbon in PowerPoint.\r\n\r\nIf you enable this policy setting, you can add a presentation service to the list of online presentation services in PowerPoint and Word. For each service you add, you must specify a name and URL. Optionally, you can specify a description, the URL of a web page with more information about the service, and the URL of a web page with service terms that the user can display by selecting the Service Agreement link. \r\n\r\nIf you disable or do not configure this policy setting, the More services link displays only services that are manually added by users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice07_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice07_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice07_l_broadcastservicecreatesharednotes7","displayName":"Create Shared Notes (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice07_l_broadcastservicecreatesharednotes7_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice07_l_broadcastservicecreatesharednotes7_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice07_l_broadcastservicemajorversion7","displayName":"Server Major Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice07_l_broadcastserviceminorversion7","displayName":"Server Minor Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice07_l_broadcastservicenotesdefaulturl7","displayName":"Shared Notes Default Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice07_l_broadcastserviceservercapabilities7","displayName":"Server Capabilities flags: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice07_l_broadcastserviceserverdescription7","displayName":"Description (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice07_l_broadcastserviceserverinfo7","displayName":"Information URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice07_l_broadcastserviceservername7","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice07_l_broadcastserviceserverterms7","displayName":"Service agreement URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice07_l_broadcastserviceserverurl7","displayName":"Service URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice07_l_broadcastservicesharednotescustomurl7","displayName":"Shared Notes Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice08","displayName":"Configure presentation service in PowerPoint and Word 9 (User)","description":"This policy setting allows you to add a presentation service to the list of online presentation services in PowerPoint and Word. This list appears when a user selects the More services link under Present Online on the Share tab in Backstage view in PowerPoint and Word and in the ribbon in PowerPoint.\r\n\r\nIf you enable this policy setting, you can add a presentation service to the list of online presentation services in PowerPoint and Word. For each service you add, you must specify a name and URL. Optionally, you can specify a description, the URL of a web page with more information about the service, and the URL of a web page with service terms that the user can display by selecting the Service Agreement link. \r\n\r\nIf you disable or do not configure this policy setting, the More services link displays only services that are manually added by users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice08_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice08_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice08_l_broadcastservicecreatesharednotes8","displayName":"Create Shared Notes (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice08_l_broadcastservicecreatesharednotes8_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice08_l_broadcastservicecreatesharednotes8_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice08_l_broadcastservicemajorversion8","displayName":"Server Major Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice08_l_broadcastserviceminorversion8","displayName":"Server Minor Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice08_l_broadcastservicenotesdefaulturl8","displayName":"Shared Notes Default Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice08_l_broadcastserviceservercapabilities8","displayName":"Server Capabilities flags: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice08_l_broadcastserviceserverdescription8","displayName":"Description (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice08_l_broadcastserviceserverinfo8","displayName":"Information URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice08_l_broadcastserviceservername8","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice08_l_broadcastserviceserverterms8","displayName":"Service agreement URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice08_l_broadcastserviceserverurl8","displayName":"Service URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice08_l_broadcastservicesharednotescustomurl8","displayName":"Shared Notes Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice09","displayName":"Configure presentation service in PowerPoint and Word 10 (User)","description":"This policy setting allows you to add a presentation service to the list of online presentation services in PowerPoint and Word. This list appears when a user selects the More services link under Present Online on the Share tab in Backstage view in PowerPoint and Word and in the ribbon in PowerPoint.\r\n\r\nIf you enable this policy setting, you can add a presentation service to the list of online presentation services in PowerPoint and Word. For each service you add, you must specify a name and URL. Optionally, you can specify a description, the URL of a web page with more information about the service, and the URL of a web page with service terms that the user can display by selecting the Service Agreement link. \r\n\r\nIf you disable or do not configure this policy setting, the More services link displays only services that are manually added by users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice09_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice09_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice09_l_broadcastservicecreatesharednotes9","displayName":"Create Shared Notes (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice09_l_broadcastservicecreatesharednotes9_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice09_l_broadcastservicecreatesharednotes9_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice09_l_broadcastservicemajorversion9","displayName":"Server Major Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice09_l_broadcastserviceminorversion9","displayName":"Server Minor Version: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice09_l_broadcastservicenotesdefaulturl9","displayName":"Shared Notes Default Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice09_l_broadcastserviceservercapabilities9","displayName":"Server Capabilities flags: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice09_l_broadcastserviceserverdescription9","displayName":"Description (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice09_l_broadcastserviceserverinfo9","displayName":"Information URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice09_l_broadcastserviceservername9","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice09_l_broadcastserviceserverterms9","displayName":"Service agreement URL (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice09_l_broadcastserviceserverurl9","displayName":"Service URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_broadcast~l_broadcastservices_l_configurebroadcastservice09_l_broadcastservicesharednotescustomurl9","displayName":"Shared Notes Url (optional): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_database_l_databasedefaultinstanceslimit","displayName":"Set the database default instances limit (User)","description":"This policy setting allows you to specify the default limit of how many instances per page the database shim can return. The application is allowed to specify a larger timeout programmatically. This is a default value to be used by the database shim to restrict the number of results that can be returned per page. The application can specify a larger limit via execution context.\r\n\r\nIf you enable this policy setting, you may specify the default limit of how many instances the database shim can return.\r\n\r\nIf you disable or do not configure this policy setting, a default value of 200 instances per page will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_database_l_databasedefaultinstanceslimit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_database_l_databasedefaultinstanceslimit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_database_l_databasedefaultinstanceslimit_l_databasedefaultinstanceslimitdecimal","displayName":"Default number of instances returned (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_database_l_databasedefaulttimeout","displayName":"Set the database default timeout (User)","description":"This policy setting allows you to specify the default timeout in milliseconds used by the database shim. The application can specify a larger limit via the execution context.\r\n \r\nIf you enable this policy setting, you may specify the default timeout in milliseconds used by the database shim.\r\n\r\nIf you disable or do not configure this policy setting, a default of 7000 milliseconds will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_database_l_databasedefaulttimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_database_l_databasedefaulttimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_database_l_databasedefaulttimeout_l_databasedefaulttimeoutdecimal","displayName":"Database default timeout (milliseconds) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_database_l_databasemaxinstanceslimit","displayName":"Set maximum database instances limit (User)","description":"This policy setting allows you to specify the maximum limit of how many instances per page the database shim can return. This policy setting enforces the allowed maximum for applications including those that do not respect the default.\r\n \r\nIf you enable this policy setting, you may specify the maximum limit of how many instances the database shim can return.\r\n\r\nIf you disable or do not configure this policy setting, there will be no limit of how many instances the database shim can return.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_database_l_databasemaxinstanceslimit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_database_l_databasemaxinstanceslimit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_database_l_databasemaxinstanceslimit_l_databasemaxinstanceslimitdecimal","displayName":"Maximum number of instances returned (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_database_l_databasemaxtimeout","displayName":"Set maximum database timeout limit (User)","description":"This policy setting allows you to specify the maximum timeout in milliseconds used by the database shim. This maximum value is enforced for applications including those that do not respect the default.\r\n\r\nIf you enable this policy setting, you may specify the maximum timeout in milliseconds used by the database shim.\r\n\r\nIf you disable or do not configure this policy setting, no maximum timeout value will be enforced.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_database_l_databasemaxtimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_database_l_databasemaxtimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_database_l_databasemaxtimeout_l_databasemaxtimeoutdecimal","displayName":"Database maximum timeout (milliseconds) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_cleanupinterval","displayName":"Set the cleanup interval (User)","description":"This policy setting allows you to specify the interval (in minutes) for how long successfully completed operations and other data that is no longer needed will remain in the cache before they can be deleted. The synchronization process leads to data in the cache that will no longer be needed. However, the data may be useful for troubleshooting purposes. To prevent the cache from growing too large, the cache contents should periodically be deleted.\r\n\r\nIf you enable this policy setting, you may specify the interval (in minutes) for the times the contents in the cache are deleted.\r\n\r\nIf you disable or do not configure this policy setting, a default value of 1440 minutes (1 day) will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_cleanupinterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_cleanupinterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_cleanupinterval_l_cleanupintervaldecimal","displayName":"Cleanup interval (minutes) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_errorscleanupinterval","displayName":"Set errors cleanup interval (User)","description":"This policy setting allows you to specify the interval for how long failed operations and other error data will remain in the cache before they can be deleted. Synchronization can fail for any reason. The failed operations and related instances are marked as \"in error,\" and this data will eventually need to be removed from the cache. It is recommended that this interval be larger than the regular cleanup interval to give the user opportunities to troubleshoot errors.\r\n\r\nIf you enable this policy setting, you may specify the interval (in minutes) for the times the failed operations and error data in the cache are deleted. \r\n\r\nIf you disable or do not configure this policy setting, a default value of 10080 minutes (1 week) will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_errorscleanupinterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_errorscleanupinterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_errorscleanupinterval_l_errorscleanupintervaldecimal","displayName":"Errors cleanup interval (minutes) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_maxretries","displayName":"Set maximum number of retries when synchronization fails (User)","description":"This policy setting allows you to specify the maximum number of times a failed synchronization operation can be retried.\r\n\r\nIf you enable this policy setting, you may specify the maximum number of times a failed synchronization operation can be retried.\r\n\r\nIf you disable or do not configure this policy setting, then a default value of 50 times will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_maxretries_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_maxretries_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_maxretries_l_maxretriesdecimal","displayName":"Maximum number of retries (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_queryinstanceslimit","displayName":"Set query items limit (User)","description":"This policy setting allows you to specify the maximum number of items that will be added to the client’s cache as the result of executing a query. Several bulk operations (especially queries) can return a large number of items to be added to the cache. This increases the size of the cache, potentially exceeding the 4GB limit imposed by Microsoft SQL Server CE. It also increases the amount of work required to keep the cache synchronized and increases the load on the LOB server. In order to protect the system, a limit is used – any results processed before reaching the limit are still committed, but the operation is marked as failed and will be retried later.\r\n\r\nIf you enable this policy setting, you may specify the maximum number of items that will be added to the client’s cache as the result of executing a query.\r\n\r\nIf you disable or do not configure this policy setting, a default value of 2000 items will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_queryinstanceslimit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_queryinstanceslimit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_queryinstanceslimit_l_queryinstanceslimitdecimal","displayName":"Query instances limit (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_querytimeout","displayName":"Set query processing timeout limit (User)","description":"This policy setting allows you to specify the maximum number of minutes the system will spend processing an individual query. When the interval is exceeded, the processing is aborted and the query is marked as failed. The query will then be retried later. Several bulk operations (especially queries) can take a significant amount of time before all results are retrieved and processed. During this time no other operation can be processed.\r\n\r\nIf you enable this policy setting, you may specify the maximum number of minutes the system will spend processing an individual query.\r\n\r\nIf you disable or do not configure this policy setting, a default value of 20 minutes will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_querytimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_querytimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_querytimeout_l_querytimeoutdecimal","displayName":"Time before query timeout (minutes) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_refreshfrequencylimit","displayName":"Set refresh frequency limit (User)","description":"This policy setting allows you to enforce a lower limit in minutes for the refresh interval. Refreshing subscriptions too frequently can overload the LOB systems or the network with too many requests.\r\n\r\nIf you enable this policy setting, you may specify the number of minutes for the refresh interval. This limit prevents cache subscriptions from being refreshed more frequently, reducing the number of requests issued against the line-of-business (LOB) system.\r\n\r\nIf you disable or do not configure this policy setting, a default limit of 10 minutes will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_refreshfrequencylimit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_refreshfrequencylimit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_refreshfrequencylimit_l_refreshfrequencylimitdecimal","displayName":"Refresh frequency limit (minutes) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_retryintervallimit","displayName":"Set subscription refresh retry interval (User)","description":"This policy setting allows you to specify the maximum number of minutes the system must wait before retrying the operation execution of a failed operation.\r\n\r\nIf you enable this policy setting, you may specify the maximum interval in minutes before a retrying the operation execution of a failed operation.\r\n\r\nIf you disable or do not configure this policy setting, then a default value of 360 minutes will be used.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_retryintervallimit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_retryintervallimit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_retryintervallimit_l_retryintervallimitdecimal","displayName":"Maximum retry interval (minutes) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_sleepinterval","displayName":"Set maximum sleep interval (User)","description":"This policy setting allows you to set an upper limit on the sleep interval used by the cache. The sleep is automatically interrupted when any application made changes in the cache or if there is an action scheduled to be performed.\r\n \r\nIf you enable this policy setting, you may specify how long (in minutes) the synchronization should wait before resuming when there is no pending work to do.\r\n\r\nIf you disable or do not configure this policy setting, then a default value of 20 minutes will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_sleepinterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_sleepinterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_synchronization_l_sleepinterval_l_sleepintervaldecimal","displayName":"Sleep interval upper limit (minutes) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_webservice_l_webservicedefaultsizelimit","displayName":"Set web service default return size limit (User)","description":"This policy setting allows you to specify the default limit of how much data in kilobytes (KB) the web service shim can return per call. The application is allowed to specify a larger limit programmatically.\r\n\r\nIf you enable this policy setting, you may specify the default limit of data in kilobytes the web service shim can return per call.\r\n\r\nIf you disable or do not configure this policy setting, a default limit of 3000 KB will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_webservice_l_webservicedefaultsizelimit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_webservice_l_webservicedefaultsizelimit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_webservice_l_webservicedefaultsizelimit_l_webservicedefaultsizelimitdecimal","displayName":"Web service default size limit (KB) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_webservice_l_webservicedefaulttimeout","displayName":"Set web service default timeout (User)","description":"This policy setting allows you to specify the default timeout in milliseconds for the web service shim. The application is allowed to specify a larger timeout programmatically.\r\n\r\nIf you enable this policy setting, you may specify the default timeout in milliseconds for the web service shim.\r\n\r\nIf you disable or do not configure this policy setting, a default of 7000 milliseconds will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_webservice_l_webservicedefaulttimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_webservice_l_webservicedefaulttimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_webservice_l_webservicedefaulttimeout_l_webservicedefaulttimeoutdecimal","displayName":"Web service default timeout limit (milliseconds) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_webservice_l_webservicemaxsizelimit","displayName":"Set maximum web service return size limit (User)","description":"This policy setting allows you to specify the maximum limit of how much data in kilobytes (KB) the web service shim can return per call. This maximum value is enforced for applications including those that do not respect the default. \r\n\r\nIf you enable this policy setting, you may specify the maximum limit of data in kilobytes the web service shim can return per call.\r\n\r\nIf you disable or do not configure this policy setting, no maximum limit will be enforced.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_webservice_l_webservicemaxsizelimit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_webservice_l_webservicemaxsizelimit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_webservice_l_webservicemaxsizelimit_l_webservicemaxsizelimitdecimal","displayName":"Web service maximum size limit (KB) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_webservice_l_webservicemaxtimeout","displayName":"Set maximum web service default timeout (User)","description":"This policy setting allows you to specify the maximum timeout in milliseconds for the web service shim. This maximum value is enforced for applications that do not respect the default.\r\n\r\nIf you enable this policy setting, you may specify the maximum timeout in milliseconds for the web service shim.\r\n\r\nIf you disable or do not configure this policy setting, no maximum limit will be enforced.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_webservice_l_webservicemaxtimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_webservice_l_webservicemaxtimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_businessdata~l_webservice_l_webservicemaxtimeout_l_webservicemaxtimeoutdecimal","displayName":"Web service maximum timeout limit (milliseconds) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_defaultsubjectforareviewrequest","displayName":"Default subject for a review request (User)","description":"Defines the default subject text for a review request.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_defaultsubjectforareviewrequest_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_defaultsubjectforareviewrequest_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_defaultsubjectforareviewrequest_l_defaultsubjectforareviewrequest393","displayName":"Default subject for a review request (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_donotpromptuserstoshareexcelworkbookswhensendingforreview","displayName":"Do not prompt users to share Excel workbooks when sending for review (User)","description":"Checked: Do not prompt the user to share Excel workbooks when sending them for review. | Unchecked: Prompt the user to share Excel workbooks when sending them for review.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_donotpromptuserstoshareexcelworkbookswhensendingforreview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_donotpromptuserstoshareexcelworkbookswhensendingforreview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_maxnumberofdocumentsbeingreviewedusingadhocreview","displayName":"Max number of documents being reviewed using ad hoc review (User)","description":"Sets the total number of documents that can be sent for review by a user using ad-hoc review before reusing registry entries from previous review cycles.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_maxnumberofdocumentsbeingreviewedusingadhocreview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_maxnumberofdocumentsbeingreviewedusingadhocreview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_maxnumberofdocumentsbeingreviewedusingadhocreview_l_empty388","displayName":"\r\nMax number of documents being reviewed using ad hoc review\r\n","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_maxnumberofdocumentsbeingreviewedusingsendforreview","displayName":"Max number of documents being reviewed using 'send for review' (User)","description":"Sets the total number of documents that can be sent for review by a user before reusing registry entries from previous review cycles.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_maxnumberofdocumentsbeingreviewedusingsendforreview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_maxnumberofdocumentsbeingreviewedusingsendforreview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_maxnumberofdocumentsbeingreviewedusingsendforreview_l_empty385","displayName":"\r\nMax number of documents being reviewed using 'send for review'\r\n","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_outlookadhocreviewing","displayName":"Outlook: Ad hoc reviewing (User)","description":"\"Enable ad hoc reviewing\": Enables the ad-hoc review feature. | \"Exclude author's e-mail in documents\": Enables the ad-hoc review feature, but the authors e-mail is not recorded on the sent document. | \"Disable ad hoc reviewing\": Disables the ad-hoc review feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_outlookadhocreviewing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_outlookadhocreviewing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_outlookadhocreviewing_l_empty400","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_outlookadhocreviewing_l_empty400_0","displayName":"Enable ad hoc reviewing","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_outlookadhocreviewing_l_empty400_2","displayName":"Exclude author's e-mail in documents","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_outlookadhocreviewing_l_empty400_1","displayName":"Disable ad hoc reviewing","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_outlooksendforreview","displayName":"Outlook: 'send for review' (User)","description":"\"Enable 'send for review\"': Enables the Send For Review feature. | \"Exclude author's e-mail in documents\": Enables the Send For Review feature, but the authors e-mail is not recorded on the sent document. | \"Disable 'send for review\"': Disables the Send For Review feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_outlooksendforreview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_outlooksendforreview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_outlooksendforreview_l_empty399","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_outlooksendforreview_l_empty399_0","displayName":"Enable 'send for review'","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_outlooksendforreview_l_empty399_2","displayName":"Exclude author's e-mail in documents","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_outlooksendforreview_l_empty399_1","displayName":"Disable 'send for review'","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_promptforsendingrevieweddocumenttoauthor","displayName":"Prompt for sending reviewed document to author (User)","description":"\"Never ask user\": Do not ask users if they want to send back changes to the author. | \"Prompt for 'send for review\"': Ask users if they want to send back changes to the author only if the document was sent using Send For Review and not with ad-hoc review. | \"Always prompt\": Ask users if they want to send back changes to the author for documents sent using either Send For Review or ad-hoc review.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_promptforsendingrevieweddocumenttoauthor_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_promptforsendingrevieweddocumenttoauthor_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_promptforsendingrevieweddocumenttoauthor_l_empty395","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_promptforsendingrevieweddocumenttoauthor_l_empty395_2","displayName":"Never ask user","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_promptforsendingrevieweddocumenttoauthor_l_empty395_1","displayName":"Prompt for 'send for review'","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_promptforsendingrevieweddocumenttoauthor_l_empty395_0","displayName":"Always prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_whenchoosingsendforreview","displayName":"When choosing 'Send for Review...' (User)","description":"\"Send link and attachment\": When choosing Send for Review for a document on a server, send both a link and an attachment. | \"Only send link\": When choosing Send for Review for a document on a server, send only a link. | \"Prompt user\": When choosing Send for Review for a document on a server, prompt the user for what to send.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_whenchoosingsendforreview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_whenchoosingsendforreview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_whenchoosingsendforreview_l_empty392","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_whenchoosingsendforreview_l_empty392_2","displayName":"Send link and attachment","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_whenchoosingsendforreview_l_empty392_1","displayName":"Only send link","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings_l_whenchoosingsendforreview_l_empty392_0","displayName":"Prompt user","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_coauthoring_l_setdocumentsynchronizationtimeout","displayName":"Set document synchronization timeout (User)","description":"This policy setting specifies the server timeout value in milliseconds for document synchronization. This policy setting does not apply when synchronizing documents on SharePoint servers. \r\n\r\nIf you enable this policy setting, you may specify the server timeout value in milliseconds for document synchronization.\r\n\r\nIf you disable or do not configure this policy setting, the server timeout will default to the Windows timeout value.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_coauthoring_l_setdocumentsynchronizationtimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_coauthoring_l_setdocumentsynchronizationtimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_coauthoring_l_setdocumentsynchronizationtimeout_l_setdocumentsynchronizationtimeoutspinid","displayName":"in milliseconds: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareply_l_withasimplewebdiscussionslink373","displayName":"With a simple Web discussions link (User)","description":"Defines the default message body text used in a reply to an email request for review when the reply contains a simple Web discussions link. ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareply_l_withasimplewebdiscussionslink373_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareply_l_withasimplewebdiscussionslink373_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareply_l_withasimplewebdiscussionslink373_l_withasimplewebdiscussionslink374","displayName":"With a simple Web discussions link (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareply_l_withawebdiscussionslink380","displayName":"With a Web discussions link (User)","description":"Defines the default message body text used in a reply to an email request for review when the reply contains a simple Web discussions link. ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareply_l_withawebdiscussionslink380_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareply_l_withawebdiscussionslink380_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareply_l_withawebdiscussionslink380_l_withawebdiscussionslink381","displayName":"With a Web discussions link (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareply_l_withjustanattachment","displayName":"With just an attachment (User)","description":"Defines the default message body text used in a reply to an email request for review when the reply contains a simple Web discussions link. ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareply_l_withjustanattachment_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareply_l_withjustanattachment_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareply_l_withjustanattachment_l_withjustanattachment379","displayName":"With just an attachment (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareply_l_withjustasimplewebdiscussionslink","displayName":"With just a simple Web discussions link (User)","description":"Defines the default message body text used in a reply to an email request for review when the reply contains a simple Web discussions link. ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareply_l_withjustasimplewebdiscussionslink_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareply_l_withjustasimplewebdiscussionslink_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareply_l_withjustasimplewebdiscussionslink_l_withjustasimplewebdiscussionslink377","displayName":"With just a simple Web discussions link (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_onlycontainingalink","displayName":"Only containing a link (User)","description":"Defines the default message body text used in an email request for review when the review document is included only as an attachment.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_onlycontainingalink_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_onlycontainingalink_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_onlycontainingalink_l_onlycontainingalink357","displayName":"Only containing a link (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_onlycontaininganattachment","displayName":"Only containing an attachment (User)","description":"Defines the default message body text used in an email request for review when the review document is included only as an attachment.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_onlycontaininganattachment_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_onlycontaininganattachment_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_onlycontaininganattachment_l_onlycontaininganattachment356","displayName":"Only containing an attachment (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withalinkandanattachment","displayName":"With a link and an attachment (User)","description":"Defines the default message body text used in an email request for review when the review document is included only as an attachment.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withalinkandanattachment_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withalinkandanattachment_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withalinkandanattachment_l_withalinkandanattachment359","displayName":"With a link and an attachment (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withasimplewebdiscussionslink","displayName":"With a simple Web discussions link (User)","description":"Defines the default message body text used in an email request for review when the review document is included only as an attachment.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withasimplewebdiscussionslink_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withasimplewebdiscussionslink_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withasimplewebdiscussionslink_l_withasimplewebdiscussionslink362","displayName":"With a simple Web discussions link (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withasimplewebdiscussionslinkandanattachment","displayName":"With a simple Web discussions link and an attachment (User)","description":"Defines the default message body text used in an email request for review when the review document is included only as an attachment.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withasimplewebdiscussionslinkandanattachment_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withasimplewebdiscussionslinkandanattachment_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withasimplewebdiscussionslinkandanattachment_l_withasimplewebdiscussionslinkandanattachment364","displayName":"With a simple Web discussions link and an attachment (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withawebdiscussionslink","displayName":"With a Web discussions link (User)","description":"Defines the default message body text used in an email request for review when the review document is included only as an attachment.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withawebdiscussionslink_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withawebdiscussionslink_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withawebdiscussionslink_l_withawebdiscussionslink367","displayName":"With a Web discussions link (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withawebdiscussionslinkandanattachment","displayName":"With a Web discussions link and an attachment (User)","description":"Defines the default message body text used in an email request for review when the review document is included only as an attachment.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withawebdiscussionslinkandanattachment_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withawebdiscussionslinkandanattachment_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_collaborationsettings~l_defaultmessagetextforareviewrequest_l_withawebdiscussionslinkandanattachment_l_withawebdiscussionslinkandanattachment370","displayName":"With a Web discussions link and an attachment (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_configurepresenceicons","displayName":"Configure presence icons (User)","description":"This policy setting allows you to specify whether Microsoft Office applications display presence icons in the user interface (UI).\r\n\r\nIf you enable this policy setting, you may specify when applications display presence icons:\r\n\r\n- Display all: Presence icons are displayed in the UI.\r\n- Display some: Presence icons are displayed only in the Contact Card, Quick Contacts and SharePoint.\r\n- Display none: Presence icons are not displayed in the UI.\r\n\r\nIf you disable or you do not configure this policy setting, presence icons are displayed in the UI.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_configurepresenceicons_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_configurepresenceicons_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_configurepresenceicons_l_configurepresenceiconsdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_configurepresenceicons_l_configurepresenceiconsdropid_0","displayName":"Display all","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_configurepresenceicons_l_configurepresenceiconsdropid_1","displayName":"Display some","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_configurepresenceicons_l_configurepresenceiconsdropid_2","displayName":"Display none","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_displaylegacygaldialog","displayName":"Display legacy GAL dialog (User)","description":"This policy setting allows you to specify the way contact information is displayed.\r\n\r\nIf you enable this policy setting the global address list (GAL) dialog is displayed instead of the Contact Card when users double click a contact in Outlook. \r\n\r\nIf you disable or do not configure this policy setting the Contact Card is displayed when users double click a contact in Outlook.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_displaylegacygaldialog_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_displaylegacygaldialog_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_donotdisplayhovermenu","displayName":"Do not display Hover Menu (User)","description":"This policy setting allows you to stop the Hover Menu from displaying when a user hovers over a contact’s presence icon or display name with the mouse cursor.\r\n\r\nIf you enable this policy setting, when a user hovers over a contact’s presence icon or display name with the mouse cursor, the Hover Menu will not be displayed.\r\n\r\nIf you disable or do not configure this policy setting, the Hover Menu appears when a user hovers over a contact’s presence icon or display name with the mouse cursor.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_donotdisplayhovermenu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_donotdisplayhovermenu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_donotdisplayphotograph","displayName":"Do not display photograph (User)","description":"This policy setting lets you specify if the photograph is shown on the contact card, e-mail header, reading pane, fast search results, global address list (GAL) dialog, Backstage, and quick contacts. \r\n\r\nIf you enable this policy setting, photographs are not displayed in the locations listed above.\r\n\r\nIf you disable or do not configure this policy setting, photographs appear in the locations listed above.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_donotdisplayphotograph_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_donotdisplayphotograph_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_removememberoftab","displayName":"Remove Member Of tab (User)","description":"This policy setting allows you to remove the Member Of tab from the Contact Card.\r\n\r\nIf you enable this policy setting the Member Of tab is removed from the Contact Card.\r\n\r\nIf you disable or do not configure this policy setting the Member Of tab appears on the Contact Card.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_removememberoftab_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_removememberoftab_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_removeorganizationtab","displayName":"Remove Organization tab (User)","description":"This policy setting allows you to remove the Organization tab from the Contact Card.\r\n\r\nIf you enable this policy setting, the Organization tab is removed from the Contact Card.\r\n\r\nIf you disable or do not configure this policy setting, the Organization tab appears on the Contact Card.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_removeorganizationtab_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_removeorganizationtab_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_turnoffclicktoimoption","displayName":"Turn off click to IM option (User)","description":"This policy setting allows you to remove the Instant Messaging (IM) option from the Contact Card and Outlook Ribbon.\r\n\r\nIf you enable this policy setting the Instant Messaging icon does not appear on the Contact Card and Outlook Ribbon.\r\n\r\nIf you disable or do not configure this policy setting the Instant Messaging icon appears on the Contact Card and Outlook Ribbon.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_turnoffclicktoimoption_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_turnoffclicktoimoption_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_turnoffclicktotelephone","displayName":"Turn off click to telephone (User)","description":"This policy setting allows you to remove the telephone option from the Contact Card and Outlook Ribbon.\r\n\r\nIf you enable this policy setting, the telephone option does not appear in the Contact Card. Telephone links do not appear in the Contact Card. Telephone options do not appear in the Outlook Ribbon.\r\n\r\nIf you disable or do not configure this policy setting telephone options appear in the Contact Card and Outlook Ribbon.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_turnoffclicktotelephone_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_turnoffclicktotelephone_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_turnoffpresenceintegration","displayName":"Turn off presence integration (User)","description":"This policy setting allows you to turn off instant messaging (IM) presence integration for Microsoft Office applications. \r\n\r\nIf you enable this policy, setting IM presence icons will not be displayed and presence integration will be turned off for Office applications.\r\n\r\nIf you disable or do not configure this policy setting, IM presence icons will be displayed and presence integration will be turned on for Office applications.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_turnoffpresenceintegration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard_l_turnoffpresenceintegration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoffcontacttabcalendar","displayName":"Remove Calendar Line (User)","description":"\r\nThis policy setting enables you to remove the Calendar line on the Contact Tab, which is on the Contact Card.\r\n\r\nIf you enable this policy setting, you can remove the Calendar line.\r\n\r\nIf you disable or do not configure this policy setting, the Calendar line appears on the Contact Tab.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoffcontacttabcalendar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoffcontacttabcalendar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoffcontacttablocation","displayName":"Remove Location Line (User)","description":"\r\nThis policy setting enables you to remove the Location line on the Contact Tab, which is on the Contact Card.\r\n\r\nIf you enable this policy setting, you can remove the Location line.\r\n\r\nIf you disable or do not configure this policy setting, the Location line appears on the Contact Tab.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoffcontacttablocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoffcontacttablocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacebirthday","displayName":"Replace AD - Birthday (User)","description":"This policy setting allows you to customize the 16th value of the Contact Tab.\r\n\r\nIf you enable this policy setting, you can change or remove the default value - \"birthday\" of line 16.\r\n\r\nIf you disable or do not configure this policy setting, the default value for line 16 is displayed.\r\n\r\nImportant:\r\nIt is recommended that you specify a Messaging Application Programming Interface (MAPI) property and a corresponding Active Directory attribute (AD attribute). The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in this format: ADAttribute. Any properties entered which are binary or list box, cannot be displayed and are ignored.\r\n\r\nExample:\r\nTo display the Assistant on the Contact Card, enter the AD attribute: Ms-exch-assistant-name.\r\n\r\nTo remove the value, enter: null.\r\n\r\nNote: \r\nThe Location and Calendar values for a default Contact Card are not MAPI Properties or AD Attributes. \r\n\r\nRelated policy settings: \r\nReplace MAPI property n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacebirthday_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacebirthday_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacebirthday_l_birthdayadreplace","displayName":"AD Attribute: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacecompany","displayName":"Replace AD - Company (User)","description":"This policy setting allows you to customize the 12th value of the Contact Tab.\r\n\r\nIf you enable this policy setting, you can change or remove the default value - \"company\" of line 12.\r\n\r\nIf you disable or do not configure this policy setting, the default value for line 12 is displayed.\r\n\r\nImportant:\r\nIt is recommended that you specify a Messaging Application Programming Interface (MAPI) property and a corresponding Active Directory attribute (AD attribute). The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in this format: ADAttribute. Any properties entered which are binary or list box, cannot be displayed and are ignored.\r\n\r\nExample:\r\nTo display the Assistant on the Contact Card, enter the AD attribute: Ms-exch-assistant-name.\r\n\r\nTo remove the value, enter: null.\r\n\r\nNote: \r\nThe Location and Calendar values for a default Contact Card are not MAPI Properties or AD Attributes. \r\n\r\nRelated policy settings: \r\nReplace MAPI property n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacecompany_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacecompany_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacecompany_l_companyadreplace","displayName":"AD Attribute: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceemail","displayName":"Replace AD - E-mail (User)","description":"This policy setting allows you to customize the 1st value of the Contact Tab.\r\n\r\nIf you enable this policy setting, you can change or remove the default value - \"email address\" of line 1.\r\n\r\nIf you disable or do not configure this policy setting, the default value for line 1 is displayed.\r\n\r\nImportant:\r\nIt is recommended that you specify a Messaging Application Programming Interface (MAPI) property and a corresponding Active Directory attribute (AD attribute). The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in this format: ADAttribute. Any properties entered which are binary or list box, cannot be displayed and are ignored.\r\n\r\nExample:\r\nTo display the Assistant on the Contact Card, enter the AD attribute: Ms-exch-assistant-name.\r\n\r\nTo remove the value, enter: null.\r\n\r\nNote: \r\nThe Location and Calendar values for a default Contact Card are not MAPI Properties or AD Attributes. \r\n\r\nRelated policy settings: \r\nReplace MAPI property n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceemail_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceemail_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceemail_l_emailadreplace","displayName":"AD Attribute: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacehome","displayName":"Replace AD - Home (User)","description":"This policy setting allows you to customize the 6th value of the Contact Tab.\r\n\r\nIf you enable this policy setting, you can change or remove the default value - \"home phone\" of line 6.\r\n\r\nIf you disable or do not configure this policy setting, the default value for line 6 is displayed.\r\n\r\nImportant:\r\nIt is recommended that you specify a Messaging Application Programming Interface (MAPI) property and a corresponding Active Directory attribute (AD attribute). The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in this format: ADAttribute. Any properties entered which are binary or list box, cannot be displayed and are ignored.\r\n\r\nExample:\r\nTo display the Assistant on the Contact Card, enter the AD attribute: Ms-exch-assistant-name.\r\n\r\nTo remove the value, enter: null.\r\n\r\nNote: \r\nThe Location and Calendar values for a default Contact Card are not MAPI Properties or AD Attributes. \r\n\r\nRelated policy settings: \r\nReplace MAPI property n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacehome_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacehome_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacehome_l_homeadreplace","displayName":"AD Attribute: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacehome2","displayName":"Replace AD - Home2 (User)","description":"This policy setting allows you to customize the 7th value of the Contact Tab.\r\n\r\nIf you enable this policy setting, you can change or remove the default value - \"home phone 2\" of line 7.\r\n\r\nIf you disable or do not configure this policy setting, the default value for line 7 is displayed.\r\n\r\nImportant:\r\nIt is recommended that you specify a Messaging Application Programming Interface (MAPI) property and a corresponding Active Directory attribute (AD attribute). The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in this format: ADAttribute. Any properties entered which are binary or list box, cannot be displayed and are ignored.\r\n\r\nExample:\r\nTo display the Assistant on the Contact Card, enter the AD attribute: Ms-exch-assistant-name.\r\n\r\nTo remove the value, enter: null.\r\n\r\nNote: \r\nThe Location and Calendar values for a default Contact Card are not MAPI Properties or AD Attributes. \r\n\r\nRelated policy settings: \r\nReplace MAPI property n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacehome2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacehome2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacehome2_l_home2adreplace","displayName":"AD Attribute: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacehomeadd","displayName":"Replace AD - Home Address (User)","description":"This policy setting allows you to customize the 14th value of the Contact Tab.\r\n\r\nIf you enable this policy setting, you can change or remove the default value - \"home address\" of line 14.\r\n\r\nIf you disable or do not configure this policy setting, the default value for line 14 is displayed.\r\n\r\nImportant:\r\nIt is recommended that you specify a Messaging Application Programming Interface (MAPI) property and a corresponding Active Directory attribute (AD attribute). The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in this format: ADAttribute. Any properties entered which are binary or list box, cannot be displayed and are ignored.\r\n\r\nExample:\r\nTo display the Assistant on the Contact Card, enter the AD attribute: Ms-exch-assistant-name.\r\n\r\nTo remove the value, enter: null.\r\n\r\nNote: \r\nThe Location and Calendar values for a default Contact Card are not MAPI Properties or AD Attributes. \r\n\r\nRelated policy settings: \r\nReplace MAPI property n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacehomeadd_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacehomeadd_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacehomeadd_l_homeaddadreplace","displayName":"AD Attribute: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceim","displayName":"Replace AD - IM (User)","description":"This policy setting allows you to customize the 9th value of the Contact Tab.\r\n\r\nIf you enable this policy setting, you can change or remove the default value - \"IM address\" of line 9.\r\n\r\nIf you disable or do not configure this policy setting, the default value for line 9 is displayed.\r\n\r\nImportant:\r\nIt is recommended that you specify a Messaging Application Programming Interface (MAPI) property and a corresponding Active Directory attribute (AD attribute). The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in this format: ADAttribute. Any properties entered which are binary or list box, cannot be displayed and are ignored.\r\n\r\nExample:\r\nTo display the Assistant on the Contact Card, enter the AD attribute: Ms-exch-assistant-name.\r\n\r\nTo remove the value, enter: null.\r\n\r\nNote: \r\nThe Location and Calendar values for a default Contact Card are not MAPI Properties or AD Attributes. \r\n\r\nRelated policy settings: \r\nReplace MAPI property n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceim_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceim_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceim_l_imadreplace","displayName":"AD Attribute: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacemobile","displayName":"Replace AD - Mobile (User)","description":"This policy setting allows you to customize the 5th value of the Contact Tab.\r\n\r\nIf you enable this policy setting, you can change or remove the default value - \"mobile phone\" of line 5.\r\n\r\nIf you disable or do not configure this policy setting, the default value for line 5 is displayed.\r\n\r\nImportant:\r\nIt is recommended that you specify a Messaging Application Programming Interface (MAPI) property and a corresponding Active Directory attribute (AD attribute). The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in this format: ADAttribute. Any properties entered which are binary or list box, cannot be displayed and are ignored.\r\n\r\nExample:\r\nTo display the Assistant on the Contact Card, enter the AD attribute: Ms-exch-assistant-name.\r\n\r\nTo remove the value, enter: null.\r\n\r\nNote: \r\nThe Location and Calendar values for a default Contact Card are not MAPI Properties or AD Attributes. \r\n\r\nRelated policy settings: \r\nReplace MAPI property n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacemobile_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacemobile_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacemobile_l_mobileadreplace","displayName":"AD Attribute: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceoffice","displayName":"Replace AD - Office (User)","description":"This policy setting allows you to customize the 11th value of the Contact Tab.\r\n\r\nIf you enable this policy setting, you can change or remove the default value - \"office location\" of line 11.\r\n\r\nIf you disable or do not configure this policy setting, the default value for line 11 is displayed.\r\n\r\nImportant:\r\nIt is recommended that you specify a Messaging Application Programming Interface (MAPI) property and a corresponding Active Directory attribute (AD attribute). The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in this format: ADAttribute. Any properties entered which are binary or list box, cannot be displayed and are ignored.\r\n\r\nExample:\r\nTo display the Assistant on the Contact Card, enter the AD attribute: Ms-exch-assistant-name.\r\n\r\nTo remove the value, enter: null.\r\n\r\nNote: \r\nThe Location and Calendar values for a default Contact Card are not MAPI Properties or AD Attributes. \r\n\r\nRelated policy settings: \r\nReplace MAPI property n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceoffice_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceoffice_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceoffice_l_officeadreplace","displayName":"AD Attribute: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceother","displayName":"Replace AD - Other (User)","description":"This policy setting allows you to customize the 8th value of the Contact Tab.\r\n\r\nIf you enable this policy setting, you can change or remove the default value - \"other phone\" of line 8.\r\n\r\nIf you disable or do not configure this policy setting, the default value for line 8 is displayed.\r\n\r\nImportant:\r\nIt is recommended that you specify a Messaging Application Programming Interface (MAPI) property and a corresponding Active Directory attribute (AD attribute). The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in this format: ADAttribute. Any properties entered which are binary or list box, cannot be displayed and are ignored.\r\n\r\nExample:\r\nTo display the Assistant on the Contact Card, enter the AD attribute: Ms-exch-assistant-name.\r\n\r\nTo remove the value, enter: null.\r\n\r\nNote: \r\nThe Location and Calendar values for a default Contact Card are not MAPI Properties or AD Attributes. \r\n\r\nRelated policy settings: \r\nReplace MAPI property n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceother_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceother_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceother_l_otheradreplace","displayName":"AD Attribute: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceotheradd","displayName":"Replace AD - Other Address (User)","description":"This policy setting allows you to customize the 15th value of the Contact Tab.\r\n\r\nIf you enable this policy setting, you can change or remove the default value - \"other address\" of line 15.\r\n\r\nIf you disable or do not configure this policy setting, the default value for line 15 is displayed.\r\n\r\nImportant:\r\nIt is recommended that you specify a Messaging Application Programming Interface (MAPI) property and a corresponding Active Directory attribute (AD attribute). The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in this format: ADAttribute. Any properties entered which are binary or list box, cannot be displayed and are ignored.\r\n\r\nExample:\r\nTo display the Assistant on the Contact Card, enter the AD attribute: Ms-exch-assistant-name.\r\n\r\nTo remove the value, enter: null.\r\n\r\nNote: \r\nThe Location and Calendar values for a default Contact Card are not MAPI Properties or AD Attributes. \r\n\r\nRelated policy settings: \r\nReplace MAPI property n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceotheradd_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceotheradd_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceotheradd_l_otheraddadreplace","displayName":"AD Attribute: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceprofile","displayName":"Replace AD - Profile (User)","description":"This policy setting allows you to customize the 10th value of the Contact Tab.\r\n\r\nIf you enable this policy setting, you can change or remove the default value - \"profile\" of line 10.\r\n\r\nIf you disable or do not configure this policy setting, the default value for line 10 is displayed.\r\n\r\nImportant:\r\nIt is recommended that you specify a Messaging Application Programming Interface (MAPI) property and a corresponding Active Directory attribute (AD attribute). The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in this format: ADAttribute. Any properties entered which are binary or list box, cannot be displayed and are ignored.\r\n\r\nExample:\r\nTo display the Assistant on the Contact Card, enter the AD attribute: Ms-exch-assistant-name.\r\n\r\nTo remove the value, enter: null.\r\n\r\nNote: \r\nThe Location and Calendar values for a default Contact Card are not MAPI Properties or AD Attributes. \r\n\r\nRelated policy settings: \r\nReplace MAPI property n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceprofile_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceprofile_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceprofile_l_profileadreplace","displayName":"AD Attribute: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacework","displayName":"Replace AD - Work (User)","description":"This policy setting allows you to customize the 2nd value of the Contact Tab.\r\n\r\nIf you enable this policy setting, you can change or remove the default value - \"work phone\" of line 2.\r\n\r\nIf you disable or do not configure this policy setting, the default value for line 2 is displayed.\r\n\r\nImportant:\r\nIt is recommended that you specify a Messaging Application Programming Interface (MAPI) property and a corresponding Active Directory attribute (AD attribute). The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in this format: ADAttribute. Any properties entered which are binary or list box, cannot be displayed and are ignored.\r\n\r\nExample:\r\nTo display the Assistant on the Contact Card, enter the AD attribute: Ms-exch-assistant-name.\r\n\r\nTo remove the value, enter: null.\r\n\r\nNote: \r\nThe Location and Calendar values for a default Contact Card are not MAPI Properties or AD Attributes. \r\n\r\nRelated policy settings: \r\nReplace MAPI property n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacework_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacework_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacework_l_workadreplace","displayName":"AD Attribute: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacework2","displayName":"Replace AD - Work2 (User)","description":"This policy setting allows you to customize the 3rd value of the Contact Tab.\r\n\r\nIf you enable this policy setting, you can change or remove the default value - \"work phone 2\" of line 3.\r\n\r\nIf you disable or do not configure this policy setting, the default value for line 3 is displayed.\r\n\r\nImportant:\r\nIt is recommended that you specify a Messaging Application Programming Interface (MAPI) property and a corresponding Active Directory attribute (AD attribute). The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in this format: ADAttribute. Any properties entered which are binary or list box, cannot be displayed and are ignored.\r\n\r\nExample:\r\nTo display the Assistant on the Contact Card, enter the AD attribute: Ms-exch-assistant-name.\r\n\r\nTo remove the value, enter: null.\r\n\r\nNote: \r\nThe Location and Calendar values for a default Contact Card are not MAPI Properties or AD Attributes. \r\n\r\nRelated policy settings: \r\nReplace MAPI property n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacework2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacework2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplacework2_l_work2adreplace","displayName":"AD Attribute: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceworkadd","displayName":"Replace AD - Work Address (User)","description":"This policy setting allows you to customize the 13th value of the Contact Tab.\r\n\r\nIf you enable this policy setting, you can change or remove the default value - \"work address\" of line 13.\r\n\r\nIf you disable or do not configure this policy setting, the default value for line 13 is displayed.\r\n\r\nImportant:\r\nIt is recommended that you specify a Messaging Application Programming Interface (MAPI) property and a corresponding Active Directory attribute (AD attribute). The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in this format: ADAttribute. Any properties entered which are binary or list box, cannot be displayed and are ignored.\r\n\r\nExample:\r\nTo display the Assistant on the Contact Card, enter the AD attribute: Ms-exch-assistant-name.\r\n\r\nTo remove the value, enter: null.\r\n\r\nNote: \r\nThe Location and Calendar values for a default Contact Card are not MAPI Properties or AD Attributes. \r\n\r\nRelated policy settings: \r\nReplace MAPI property n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceworkadd_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceworkadd_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceworkadd_l_workaddadreplace","displayName":"AD Attribute: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceworkfax","displayName":"Replace AD - WorkFax (User)","description":"This policy setting allows you to customize the 4th value of the Contact Tab.\r\n\r\nIf you enable this policy setting, you can change or remove the default value - \"work fax\" of line 4.\r\n\r\nIf you disable or do not configure this policy setting, the default value for line 4 is displayed.\r\n\r\nImportant:\r\nIt is recommended that you specify a Messaging Application Programming Interface (MAPI) property and a corresponding Active Directory attribute (AD attribute). The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in this format: ADAttribute. Any properties entered which are binary or list box, cannot be displayed and are ignored.\r\n\r\nExample:\r\nTo display the Assistant on the Contact Card, enter the AD attribute: Ms-exch-assistant-name.\r\n\r\nTo remove the value, enter: null.\r\n\r\nNote: \r\nThe Location and Calendar values for a default Contact Card are not MAPI Properties or AD Attributes. \r\n\r\nRelated policy settings: \r\nReplace MAPI property n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceworkfax_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceworkfax_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabadreplaceworkfax_l_workfaxadreplace","displayName":"AD Attribute: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacebirthday","displayName":"Replace Label - Birthday (User)","description":"This policy setting allows you to change or remove the 16th label on the Contact Tab, which is on the Contact Card. The default values for the Contact Tab labels are Email (email address), Work (work phone), Work2 (work phone 2), WorkFax (work fax), Mobile (mobile phone), Home (home phone), Home2 (home phone 2), Other (other phone), IM (IM address), Profile (profile), Office (office location), Company (company), WorkAdd (work address), HomeAdd (home address), OtherAdd (other address), Birthday (birthday) . \r\n\r\nIf you enable this policy setting, you can change or remove the labels on their Contact Tab by entering a new text string in the text box below. \r\n\r\nIf you disable or do not configure this policy setting, the default label is displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacebirthday_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacebirthday_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacebirthday_l_birthdaylabelreplace","displayName":"Label: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacecompany","displayName":"Replace Label - Company (User)","description":"This policy setting allows you to change or remove the 12th label on the Contact Tab, which is on the Contact Card. The default values for the Contact Tab labels are Email (email address), Work (work phone), Work2 (work phone 2), WorkFax (work fax), Mobile (mobile phone), Home (home phone), Home2 (home phone 2), Other (other phone), IM (IM address), Profile (profile), Office (office location), Company (company), WorkAdd (work address), HomeAdd (home address), OtherAdd (other address), Birthday (birthday) . \r\n\r\nIf you enable this policy setting, you can change or remove the labels on their Contact Tab by entering a new text string in the text box below. \r\n\r\nIf you disable or do not configure this policy setting, the default label is displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacecompany_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacecompany_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacecompany_l_companylabelreplace","displayName":"Label: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceemail","displayName":"Replace Label - E-mail (User)","description":"This policy setting allows you to change or remove the 1st label on the Contact Tab, which is on the Contact Card. The default values for the Contact Tab labels are Email (email address), Work (work phone), Work2 (work phone 2), WorkFax (work fax), Mobile (mobile phone), Home (home phone), Home2 (home phone 2), Other (other phone), IM (IM address), Profile (profile), Office (office location), Company (company), WorkAdd (work address), HomeAdd (home address), OtherAdd (other address), Birthday (birthday) . \r\n\r\nIf you enable this policy setting, you can change or remove the labels on their Contact Tab by entering a new text string in the text box below. \r\n\r\nIf you disable or do not configure this policy setting, the default label is displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceemail_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceemail_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceemail_l_emaillabelreplace","displayName":"Label: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacehome","displayName":"Replace Label - Home (User)","description":"This policy setting allows you to change or remove the 6th label on the Contact Tab, which is on the Contact Card. The default values for the Contact Tab labels are Email (email address), Work (work phone), Work2 (work phone 2), WorkFax (work fax), Mobile (mobile phone), Home (home phone), Home2 (home phone 2), Other (other phone), IM (IM address), Profile (profile), Office (office location), Company (company), WorkAdd (work address), HomeAdd (home address), OtherAdd (other address), Birthday (birthday) . \r\n\r\nIf you enable this policy setting, you can change or remove the labels on their Contact Tab by entering a new text string in the text box below. \r\n\r\nIf you disable or do not configure this policy setting, the default label is displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacehome_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacehome_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacehome_l_homelabelreplace","displayName":"Label: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacehome2","displayName":"Replace Label - Home2 (User)","description":"This policy setting allows you to change or remove the 7th label on the Contact Tab, which is on the Contact Card. The default values for the Contact Tab labels are Email (email address), Work (work phone), Work2 (work phone 2), WorkFax (work fax), Mobile (mobile phone), Home (home phone), Home2 (home phone 2), Other (other phone), IM (IM address), Profile (profile), Office (office location), Company (company), WorkAdd (work address), HomeAdd (home address), OtherAdd (other address), Birthday (birthday) . \r\n\r\nIf you enable this policy setting, you can change or remove the labels on their Contact Tab by entering a new text string in the text box below. \r\n\r\nIf you disable or do not configure this policy setting, the default label is displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacehome2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacehome2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacehome2_l_home2labelreplace","displayName":"Label: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacehomeadd","displayName":"Replace Label - Home Address (User)","description":"This policy setting allows you to change or remove the 14th label on the Contact Tab, which is on the Contact Card. The default values for the Contact Tab labels are Email (email address), Work (work phone), Work2 (work phone 2), WorkFax (work fax), Mobile (mobile phone), Home (home phone), Home2 (home phone 2), Other (other phone), IM (IM address), Profile (profile), Office (office location), Company (company), WorkAdd (work address), HomeAdd (home address), OtherAdd (other address), Birthday (birthday) . \r\n\r\nIf you enable this policy setting, you can change or remove the labels on their Contact Tab by entering a new text string in the text box below. \r\n\r\nIf you disable or do not configure this policy setting, the default label is displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacehomeadd_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacehomeadd_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacehomeadd_l_homeaddlabelreplace","displayName":"Label: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceim","displayName":"Replace Label - IM (User)","description":"This policy setting allows you to change or remove the 9th label on the Contact Tab, which is on the Contact Card. The default values for the Contact Tab labels are Email (email address), Work (work phone), Work2 (work phone 2), WorkFax (work fax), Mobile (mobile phone), Home (home phone), Home2 (home phone 2), Other (other phone), IM (IM address), Profile (profile), Office (office location), Company (company), WorkAdd (work address), HomeAdd (home address), OtherAdd (other address), Birthday (birthday) . \r\n\r\nIf you enable this policy setting, you can change or remove the labels on their Contact Tab by entering a new text string in the text box below. \r\n\r\nIf you disable or do not configure this policy setting, the default label is displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceim_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceim_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceim_l_imlabelreplace","displayName":"Label: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacemobile","displayName":"Replace Label - Mobile (User)","description":"This policy setting allows you to change or remove the 5th label on the Contact Tab, which is on the Contact Card. The default values for the Contact Tab labels are Email (email address), Work (work phone), Work2 (work phone 2), WorkFax (work fax), Mobile (mobile phone), Home (home phone), Home2 (home phone 2), Other (other phone), IM (IM address), Profile (profile), Office (office location), Company (company), WorkAdd (work address), HomeAdd (home address), OtherAdd (other address), Birthday (birthday) . \r\n\r\nIf you enable this policy setting, you can change or remove the labels on their Contact Tab by entering a new text string in the text box below. \r\n\r\nIf you disable or do not configure this policy setting, the default label is displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacemobile_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacemobile_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacemobile_l_mobilelabelreplace","displayName":"Label: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceoffice","displayName":"Replace Label - Office (User)","description":"This policy setting allows you to change or remove the 11th label on the Contact Tab, which is on the Contact Card. The default values for the Contact Tab labels are Email (email address), Work (work phone), Work2 (work phone 2), WorkFax (work fax), Mobile (mobile phone), Home (home phone), Home2 (home phone 2), Other (other phone), IM (IM address), Profile (profile), Office (office location), Company (company), WorkAdd (work address), HomeAdd (home address), OtherAdd (other address), Birthday (birthday) . \r\n\r\nIf you enable this policy setting, you can change or remove the labels on their Contact Tab by entering a new text string in the text box below. \r\n\r\nIf you disable or do not configure this policy setting, the default label is displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceoffice_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceoffice_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceoffice_l_officelabelreplace","displayName":"Label: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceother","displayName":"Replace Label - Other (User)","description":"This policy setting allows you to change or remove the 8th label on the Contact Tab, which is on the Contact Card. The default values for the Contact Tab labels are Email (email address), Work (work phone), Work2 (work phone 2), WorkFax (work fax), Mobile (mobile phone), Home (home phone), Home2 (home phone 2), Other (other phone), IM (IM address), Profile (profile), Office (office location), Company (company), WorkAdd (work address), HomeAdd (home address), OtherAdd (other address), Birthday (birthday) . \r\n\r\nIf you enable this policy setting, you can change or remove the labels on their Contact Tab by entering a new text string in the text box below. \r\n\r\nIf you disable or do not configure this policy setting, the default label is displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceother_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceother_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceother_l_otherlabelreplace","displayName":"Label: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceotheradd","displayName":"Replace Label - Other Address (User)","description":"This policy setting allows you to change or remove the 15th label on the Contact Tab, which is on the Contact Card. The default values for the Contact Tab labels are Email (email address), Work (work phone), Work2 (work phone 2), WorkFax (work fax), Mobile (mobile phone), Home (home phone), Home2 (home phone 2), Other (other phone), IM (IM address), Profile (profile), Office (office location), Company (company), WorkAdd (work address), HomeAdd (home address), OtherAdd (other address), Birthday (birthday) . \r\n\r\nIf you enable this policy setting, you can change or remove the labels on their Contact Tab by entering a new text string in the text box below. \r\n\r\nIf you disable or do not configure this policy setting, the default label is displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceotheradd_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceotheradd_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceotheradd_l_otheraddlabelreplace","displayName":"Label: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceprofile","displayName":"Replace Label - Profile (User)","description":"This policy setting allows you to change or remove the 10th label on the Contact Tab, which is on the Contact Card. The default values for the Contact Tab labels are Email (email address), Work (work phone), Work2 (work phone 2), WorkFax (work fax), Mobile (mobile phone), Home (home phone), Home2 (home phone 2), Other (other phone), IM (IM address), Profile (profile), Office (office location), Company (company), WorkAdd (work address), HomeAdd (home address), OtherAdd (other address), Birthday (birthday) . \r\n\r\nIf you enable this policy setting, you can change or remove the labels on their Contact Tab by entering a new text string in the text box below. \r\n\r\nIf you disable or do not configure this policy setting, the default label is displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceprofile_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceprofile_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceprofile_l_profilelabelreplace","displayName":"Label: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacework","displayName":"Replace Label - Work (User)","description":"This policy setting allows you to change or remove the 2nd label on the Contact Tab, which is on the Contact Card. The default values for the Contact Tab labels are Email (email address), Work (work phone), Work2 (work phone 2), WorkFax (work fax), Mobile (mobile phone), Home (home phone), Home2 (home phone 2), Other (other phone), IM (IM address), Profile (profile), Office (office location), Company (company), WorkAdd (work address), HomeAdd (home address), OtherAdd (other address), Birthday (birthday) . \r\n\r\nIf you enable this policy setting, you can change or remove the labels on their Contact Tab by entering a new text string in the text box below. \r\nIf you disable or do not configure this policy setting, the default label is displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacework_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacework_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacework_l_worklabelreplace","displayName":"Label: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacework2","displayName":"Replace Label - Work2 (User)","description":"This policy setting allows you to change or remove the 3rd label on the Contact Tab, which is on the Contact Card. The default values for the Contact Tab labels are Email (email address), Work (work phone), Work2 (work phone 2), WorkFax (work fax), Mobile (mobile phone), Home (home phone), Home2 (home phone 2), Other (other phone), IM (IM address), Profile (profile), Office (office location), Company (company), WorkAdd (work address), HomeAdd (home address), OtherAdd (other address), Birthday (birthday) . \r\n\r\nIf you enable this policy setting, you can change or remove the labels on their Contact Tab by entering a new text string in the text box below. \r\n\r\nIf you disable or do not configure this policy setting, the default label is displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacework2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacework2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplacework2_l_work2labelreplace","displayName":"Label: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceworkadd","displayName":"Replace Label - Work Address (User)","description":"This policy setting allows you to change or remove the 13th label on the Contact Tab, which is on the Contact Card. The default values for the Contact Tab labels are Email (email address), Work (work phone), Work2 (work phone 2), WorkFax (work fax), Mobile (mobile phone), Home (home phone), Home2 (home phone 2), Other (other phone), IM (IM address), Profile (profile), Office (office location), Company (company), WorkAdd (work address), HomeAdd (home address), OtherAdd (other address), Birthday (birthday) . \r\n\r\nIf you enable this policy setting, you can change or remove the labels on their Contact Tab by entering a new text string in the text box below. \r\n\r\nIf you disable or do not configure this policy setting, the default label is displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceworkadd_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceworkadd_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceworkadd_l_workaddlabelreplace","displayName":"Label: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceworkfax","displayName":"Replace Label - WorkFax (User)","description":"This policy setting allows you to change or remove the 4th label on the Contact Tab, which is on the Contact Card. The default values for the Contact Tab labels are Email (email address), Work (work phone), Work2 (work phone 2), WorkFax (work fax), Mobile (mobile phone), Home (home phone), Home2 (home phone 2), Other (other phone), IM (IM address), Profile (profile), Office (office location), Company (company), WorkAdd (work address), HomeAdd (home address), OtherAdd (other address), Birthday (birthday) . \r\n\r\nIf you enable this policy setting, you can change or remove the labels on their Contact Tab by entering a new text string in the text box below. \r\n\r\nIf you disable or do not configure this policy setting, the default label is displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceworkfax_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceworkfax_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttablabelreplaceworkfax_l_workfaxlabelreplace","displayName":"Label: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacebirthday","displayName":"Replace MAPI - Birthday (User)","description":"\r\n\r\nIf you enable this policy setting, you can remove or change the default value \"birthday\".\r\n\r\nIt is recommended that you specify a MAPI property and a corresponding AD attribute. The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in decimal format. \r\n\r\nIf you know the MAPIHexadecimalPropertyTag, you should convert this to a decimal value. Any properties entered which are binary or list box, cannot be displayed and thus are ignored.\r\n\r\nFor example, if you want to show the Assistant on the Contact Card, for MAPI, the PR_ASSISTANT hexadecimal property tag is 0x3A30001E. In decimal format, it is 976224286.\r\n\r\nYou would enter: \r\n976224286.\r\n\r\nTo remove the value entirely you would enter null.\r\n\r\nNote that for Location and Calendar values on the default Contact Card, the defaults are not MAPI Properties or AD Attributes.\r\n\r\nRelated policy settings: \r\nReplace AD attribute n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.\r\n\r\nIf you disable or do not configure this policy setting, the default value of \"birthday\" is shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacebirthday_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacebirthday_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacebirthday_l_birthdaymapireplace","displayName":"MAPI Property: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacecompany","displayName":"Replace MAPI - Company (User)","description":"\r\n\r\nIf you enable this policy setting, you can remove or change the default value \"company\".\r\n\r\nIt is recommended that you specify a MAPI property and a corresponding AD attribute. The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in decimal format. \r\n\r\nIf you know the MAPIHexadecimalPropertyTag, you should convert this to a decimal value. Any properties entered which are binary or list box, cannot be displayed and thus are ignored.\r\n\r\nFor example, if you want to show the Assistant on the Contact Card, for MAPI, the PR_ASSISTANT hexadecimal property tag is 0x3A30001E. In decimal format, it is 976224286.\r\n\r\nYou would enter: \r\n976224286.\r\n\r\nTo remove the value entirely you would enter null.\r\n\r\nNote that for Location and Calendar values on the default Contact Card, the defaults are not MAPI Properties or AD Attributes.\r\n\r\nRelated policy settings: \r\nReplace AD attribute n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.\r\n\r\nIf you disable or do not configure this policy setting, the default value of \"company\" is shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacecompany_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacecompany_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacecompany_l_companymapireplace","displayName":"MAPI Property: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceemail","displayName":"Replace MAPI - E-mail (User)","description":"\r\n\r\nIf you enable this policy setting, you can remove or change the default value \"email address\".\r\n\r\nIt is recommended that you specify a MAPI property and a corresponding AD attribute. The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in decimal format. \r\n\r\nIf you know the MAPIHexadecimalPropertyTag, you should convert this to a decimal value. Any properties entered which are binary or list box, cannot be displayed and thus are ignored.\r\n\r\nFor example, if you want to show the Assistant on the Contact Card, for MAPI, the PR_ASSISTANT hexadecimal property tag is 0x3A30001E. In decimal format, it is 976224286.\r\n\r\nYou would enter: \r\n976224286.\r\n\r\nTo remove the value entirely you would enter null.\r\n\r\nNote that for Location and Calendar values on the default Contact Card, the defaults are not MAPI Properties or AD Attributes.\r\n\r\nRelated policy settings: \r\nReplace AD attribute n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.\r\n\r\nIf you disable or do not configure this policy setting, the default value of \"email address\" is shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceemail_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceemail_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceemail_l_emailmapireplace","displayName":"MAPI Property: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacehome","displayName":"Replace MAPI - Home (User)","description":"\r\n\r\nIf you enable this policy setting, you can remove or change the default value \"home phone\".\r\n\r\nIt is recommended that you specify a MAPI property and a corresponding AD attribute. The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in decimal format. \r\n\r\nIf you know the MAPIHexadecimalPropertyTag, you should convert this to a decimal value. Any properties entered which are binary or list box, cannot be displayed and thus are ignored.\r\n\r\nFor example, if you want to show the Assistant on the Contact Card, for MAPI, the PR_ASSISTANT hexadecimal property tag is 0x3A30001E. In decimal format, it is 976224286.\r\n\r\nYou would enter: \r\n976224286.\r\n\r\nTo remove the value entirely you would enter null.\r\n\r\nNote that for Location and Calendar values on the default Contact Card, the defaults are not MAPI Properties or AD Attributes.\r\n\r\nRelated policy settings: \r\nReplace AD attribute n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.\r\n\r\nIf you disable or do not configure this policy setting, the default value of \"home phone\" is shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacehome_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacehome_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacehome_l_homemapireplace","displayName":"MAPI Property: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacehome2","displayName":"Replace MAPI - Home2 (User)","description":"\r\n\r\nIf you enable this policy setting, you can remove or change the default value \"home phone 2\".\r\n\r\nIt is recommended that you specify a MAPI property and a corresponding AD attribute. The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in decimal format. \r\n\r\nIf you know the MAPIHexadecimalPropertyTag, you should convert this to a decimal value. Any properties entered which are binary or list box, cannot be displayed and thus are ignored.\r\n\r\nFor example, if you want to show the Assistant on the Contact Card, for MAPI, the PR_ASSISTANT hexadecimal property tag is 0x3A30001E. In decimal format, it is 976224286.\r\n\r\nYou would enter: \r\n976224286.\r\n\r\nTo remove the value entirely you would enter null.\r\n\r\nNote that for Location and Calendar values on the default Contact Card, the defaults are not MAPI Properties or AD Attributes.\r\n\r\nRelated policy settings: \r\nReplace AD attribute n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.\r\n\r\nIf you disable or do not configure this policy setting, the default value of \"home phone 2\" is shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacehome2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacehome2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacehome2_l_home2mapireplace","displayName":"MAPI Property: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacehomeadd","displayName":"Replace MAPI - Home Address (User)","description":"\r\n\r\nIf you enable this policy setting, you can remove or change the default value \"home address\".\r\n\r\nIt is recommended that you specify a MAPI property and a corresponding AD attribute. The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in decimal format. \r\n\r\nIf you know the MAPIHexadecimalPropertyTag, you should convert this to a decimal value. Any properties entered which are binary or list box, cannot be displayed and thus are ignored.\r\n\r\nFor example, if you want to show the Assistant on the Contact Card, for MAPI, the PR_ASSISTANT hexadecimal property tag is 0x3A30001E. In decimal format, it is 976224286.\r\n\r\nYou would enter: \r\n976224286.\r\n\r\nTo remove the value entirely you would enter null.\r\n\r\nNote that for Location and Calendar values on the default Contact Card, the defaults are not MAPI Properties or AD Attributes.\r\n\r\nRelated policy settings: \r\nReplace AD attribute n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.\r\n\r\nIf you disable or do not configure this policy setting, the default value of \"home address\" is shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacehomeadd_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacehomeadd_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacehomeadd_l_homeaddmapireplace","displayName":"MAPI Property: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceim","displayName":"Replace MAPI - IM (User)","description":"\r\n\r\nIf you enable this policy setting, you can remove or change the default value \"IM address\".\r\n\r\nIt is recommended that you specify a MAPI property and a corresponding AD attribute. The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in decimal format. \r\n\r\nIf you know the MAPIHexadecimalPropertyTag, you should convert this to a decimal value. Any properties entered which are binary or list box, cannot be displayed and thus are ignored.\r\n\r\nFor example, if you want to show the Assistant on the Contact Card, for MAPI, the PR_ASSISTANT hexadecimal property tag is 0x3A30001E. In decimal format, it is 976224286.\r\n\r\nYou would enter: \r\n976224286.\r\n\r\nTo remove the value entirely you would enter null.\r\n\r\nNote that for Location and Calendar values on the default Contact Card, the defaults are not MAPI Properties or AD Attributes.\r\n\r\nRelated policy settings: \r\nReplace AD attribute n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.\r\n\r\nIf you disable or do not configure this policy setting, the default value of \"IM address\" is shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceim_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceim_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceim_l_immapireplace","displayName":"MAPI Property: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacemobile","displayName":"Replace MAPI - Mobile (User)","description":"\r\n\r\nIf you enable this policy setting, you can remove or change the default value \"mobile phone\".\r\n\r\nIt is recommended that you specify a MAPI property and a corresponding AD attribute. The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in decimal format. \r\n\r\nIf you know the MAPIHexadecimalPropertyTag, you should convert this to a decimal value. Any properties entered which are binary or list box, cannot be displayed and thus are ignored.\r\n\r\nFor example, if you want to show the Assistant on the Contact Card, for MAPI, the PR_ASSISTANT hexadecimal property tag is 0x3A30001E. In decimal format, it is 976224286.\r\n\r\nYou would enter: \r\n976224286.\r\n\r\nTo remove the value entirely you would enter null.\r\n\r\nNote that for Location and Calendar values on the default Contact Card, the defaults are not MAPI Properties or AD Attributes.\r\n\r\nRelated policy settings: \r\nReplace AD attribute n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.\r\n\r\nIf you disable or do not configure this policy setting, the default value of \"mobile phone\" is shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacemobile_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacemobile_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacemobile_l_mobilemapireplace","displayName":"MAPI Property: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceoffice","displayName":"Replace MAPI - Office (User)","description":"\r\n\r\nIf you enable this policy setting, you can remove or change the default value \"office location\".\r\n\r\nIt is recommended that you specify a MAPI property and a corresponding AD attribute. The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in decimal format. \r\n\r\nIf you know the MAPIHexadecimalPropertyTag, you should convert this to a decimal value. Any properties entered which are binary or list box, cannot be displayed and thus are ignored.\r\n\r\nFor example, if you want to show the Assistant on the Contact Card, for MAPI, the PR_ASSISTANT hexadecimal property tag is 0x3A30001E. In decimal format, it is 976224286.\r\n\r\nYou would enter: \r\n976224286.\r\n\r\nTo remove the value entirely you would enter null.\r\n\r\nNote that for Location and Calendar values on the default Contact Card, the defaults are not MAPI Properties or AD Attributes.\r\n\r\nRelated policy settings: \r\nReplace AD attribute n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.\r\n\r\nIf you disable or do not configure this policy setting, the default value of \"office location\" is shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceoffice_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceoffice_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceoffice_l_officemapireplace","displayName":"MAPI Property: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceother","displayName":"Replace MAPI - Other (User)","description":"\r\n\r\nIf you enable this policy setting, you can remove or change the default value \"other phone\".\r\n\r\nIt is recommended that you specify a MAPI property and a corresponding AD attribute. The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in decimal format. \r\n\r\nIf you know the MAPIHexadecimalPropertyTag, you should convert this to a decimal value. Any properties entered which are binary or list box, cannot be displayed and thus are ignored.\r\n\r\nFor example, if you want to show the Assistant on the Contact Card, for MAPI, the PR_ASSISTANT hexadecimal property tag is 0x3A30001E. In decimal format, it is 976224286.\r\n\r\nYou would enter: \r\n976224286.\r\n\r\nTo remove the value entirely you would enter null.\r\n\r\nNote that for Location and Calendar values on the default Contact Card, the defaults are not MAPI Properties or AD Attributes.\r\n\r\nRelated policy settings: \r\nReplace AD attribute n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.\r\n\r\nIf you disable or do not configure this policy setting, the default value of \"other phone\" is shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceother_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceother_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceother_l_othermapireplace","displayName":"MAPI Property: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceotheradd","displayName":"Replace MAPI - Other Address (User)","description":"\r\n\r\nIf you enable this policy setting, you can remove or change the default value \"other address\".\r\n\r\nIt is recommended that you specify a MAPI property and a corresponding AD attribute. The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in decimal format. \r\n\r\nIf you know the MAPIHexadecimalPropertyTag, you should convert this to a decimal value. Any properties entered which are binary or list box, cannot be displayed and thus are ignored.\r\n\r\nFor example, if you want to show the Assistant on the Contact Card, for MAPI, the PR_ASSISTANT hexadecimal property tag is 0x3A30001E. In decimal format, it is 976224286.\r\n\r\nYou would enter: \r\n976224286.\r\n\r\nTo remove the value entirely you would enter null.\r\n\r\nNote that for Location and Calendar values on the default Contact Card, the defaults are not MAPI Properties or AD Attributes.\r\n\r\nRelated policy settings: \r\nReplace AD attribute n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.\r\n\r\nIf you disable or do not configure this policy setting, the default value of \"other address\" is shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceotheradd_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceotheradd_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceotheradd_l_otheraddmapireplace","displayName":"MAPI Property: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceprofile","displayName":"Replace MAPI - Profile (User)","description":"\r\n\r\nIf you enable this policy setting, you can remove or change the default value \"profile\".\r\n\r\nIt is recommended that you specify a MAPI property and a corresponding AD attribute. The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in decimal format. \r\n\r\nIf you know the MAPIHexadecimalPropertyTag, you should convert this to a decimal value. Any properties entered which are binary or list box, cannot be displayed and thus are ignored.\r\n\r\nFor example, if you want to show the Assistant on the Contact Card, for MAPI, the PR_ASSISTANT hexadecimal property tag is 0x3A30001E. In decimal format, it is 976224286.\r\n\r\nYou would enter: \r\n976224286.\r\n\r\nTo remove the value entirely you would enter null.\r\n\r\nNote that for Location and Calendar values on the default Contact Card, the defaults are not MAPI Properties or AD Attributes.\r\n\r\nRelated policy settings: \r\nReplace AD attribute n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.\r\n\r\nIf you disable or do not configure this policy setting, the default value of \"profile\" is shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceprofile_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceprofile_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceprofile_l_profilemapireplace","displayName":"MAPI Property: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacework","displayName":"Replace MAPI - Work (User)","description":"\r\n\r\nIf you enable this policy setting, you can remove or change the default value \"work phone\".\r\n\r\nIt is recommended that you specify a MAPI property and a corresponding AD attribute. The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in decimal format. \r\n\r\nIf you know the MAPIHexadecimalPropertyTag, you should convert this to a decimal value. Any properties entered which are binary or list box, cannot be displayed and thus are ignored.\r\n\r\nFor example, if you want to show the Assistant on the Contact Card, for MAPI, the PR_ASSISTANT hexadecimal property tag is 0x3A30001E. In decimal format, it is 976224286.\r\n\r\nYou would enter: \r\n976224286.\r\n\r\nTo remove the value entirely you would enter null.\r\n\r\nNote that for Location and Calendar values on the default Contact Card, the defaults are not MAPI Properties or AD Attributes.\r\n\r\nRelated policy settings: \r\nReplace AD attribute n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.\r\n\r\nIf you disable or do not configure this policy setting, the default value of \"work phone\" is shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacework_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacework_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacework_l_workmapireplace","displayName":"MAPI Property: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacework2","displayName":"Replace MAPI - Work2 (User)","description":"\r\n\r\nIf you enable this policy setting, you can remove or change the default value \"work phone 2\".\r\n\r\nIt is recommended that you specify a MAPI property and a corresponding AD attribute. The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in decimal format. \r\n\r\nIf you know the MAPIHexadecimalPropertyTag, you should convert this to a decimal value. Any properties entered which are binary or list box, cannot be displayed and thus are ignored.\r\n\r\nFor example, if you want to show the Assistant on the Contact Card, for MAPI, the PR_ASSISTANT hexadecimal property tag is 0x3A30001E. In decimal format, it is 976224286.\r\n\r\nYou would enter: \r\n976224286.\r\n\r\nTo remove the value entirely you would enter null.\r\n\r\nNote that for Location and Calendar values on the default Contact Card, the defaults are not MAPI Properties or AD Attributes.\r\n\r\nRelated policy settings: \r\nReplace AD attribute n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.\r\n\r\nIf you disable or do not configure this policy setting, the default value of \"work phone 2\" is shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacework2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacework2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplacework2_l_work2mapireplace","displayName":"MAPI Property: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceworkadd","displayName":"Replace MAPI - Work Address (User)","description":"\r\n\r\nIf you enable this policy setting, you can remove or change the default value \"work address\".\r\n\r\nIt is recommended that you specify a MAPI property and a corresponding AD attribute. The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in decimal format. \r\n\r\nIf you know the MAPIHexadecimalPropertyTag, you should convert this to a decimal value. Any properties entered which are binary or list box, cannot be displayed and thus are ignored.\r\n\r\nFor example, if you want to show the Assistant on the Contact Card, for MAPI, the PR_ASSISTANT hexadecimal property tag is 0x3A30001E. In decimal format, it is 976224286.\r\n\r\nYou would enter: \r\n976224286.\r\n\r\nTo remove the value entirely you would enter null.\r\n\r\nNote that for Location and Calendar values on the default Contact Card, the defaults are not MAPI Properties or AD Attributes.\r\n\r\nRelated policy settings: \r\nReplace AD attribute n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.\r\n\r\nIf you disable or do not configure this policy setting, the default value of \"work address\" is shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceworkadd_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceworkadd_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceworkadd_l_workaddmapireplace","displayName":"MAPI Property: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceworkfax","displayName":"Replace MAPI - WorkFax (User)","description":"\r\n\r\nIf you enable this policy setting, you can remove or change the default value \"work fax\".\r\n\r\nIt is recommended that you specify a MAPI property and a corresponding AD attribute. The MAPI property should always be specified, unless Outlook is not installed, in which case only the AD attribute needs to be specified. It must be entered in decimal format. \r\n\r\nIf you know the MAPIHexadecimalPropertyTag, you should convert this to a decimal value. Any properties entered which are binary or list box, cannot be displayed and thus are ignored.\r\n\r\nFor example, if you want to show the Assistant on the Contact Card, for MAPI, the PR_ASSISTANT hexadecimal property tag is 0x3A30001E. In decimal format, it is 976224286.\r\n\r\nYou would enter: \r\n976224286.\r\n\r\nTo remove the value entirely you would enter null.\r\n\r\nNote that for Location and Calendar values on the default Contact Card, the defaults are not MAPI Properties or AD Attributes.\r\n\r\nRelated policy settings: \r\nReplace AD attribute n, Turn On Contact Tab Calendar Line Move, Turn On Contact Tab Location Line Move.\r\n\r\nIf you disable or do not configure this policy setting, the default value of \"work fax\" is shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceworkfax_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceworkfax_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_contactcard~l_contacttab_l_turnoncontacttabmapireplaceworkfax_l_workfaxmapireplace","displayName":"MAPI Property: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_customizableerrormessages_l_baseurl","displayName":"Base URL (User)","description":"Sets the URL for the location of customized error messages.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_customizableerrormessages_l_baseurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_customizableerrormessages_l_baseurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_customizableerrormessages_l_baseurl_l_baseurl349","displayName":"Base URL (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_customizableerrormessages_l_defaultbuttontext","displayName":"Default button text (User)","description":"Sets the custom button text that appears on the error dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_customizableerrormessages_l_defaultbuttontext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_customizableerrormessages_l_defaultbuttontext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_customizableerrormessages_l_defaultbuttontext_l_defaultbuttontext350","displayName":"Default button text (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_customizableerrormessages_l_defaultsaveprompttext","displayName":"Default save prompt text (User)","description":"Sets the text displayed when the user saves a document in any format other than the default.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_customizableerrormessages_l_defaultsaveprompttext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_customizableerrormessages_l_defaultsaveprompttext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_customizableerrormessages_l_defaultsaveprompttext_l_defaultsaveprompttext352","displayName":"Default save prompt text (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_customizableerrormessages_l_listoferrormessagestocustomize","displayName":"List of error messages to customize (User)","description":"Defines a list of custom error messages to activate.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_customizableerrormessages_l_listoferrormessagestocustomize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_customizableerrormessages_l_listoferrormessagestocustomize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_customizableerrormessages_l_listoferrormessagestocustomize_l_listoferrormessagestocustomize351","displayName":"List of error messages to customize (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_customizableerrormessages_l_listoferrormessagestocustomize_l_listoferrormessagestocustomize351_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_customizableerrormessages_l_listoferrormessagestocustomize_l_listoferrormessagestocustomize351_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_disableitemsinuserinterface_l_hidebuiltinshapepresetstyles","displayName":"Hide built-in shape style presets (User)","description":"This policy setting allows you to specify whether or not to show the the built-in shape preset styles.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_disableitemsinuserinterface_l_hidebuiltinshapepresetstyles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_disableitemsinuserinterface_l_hidebuiltinshapepresetstyles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_disableitemsinuserinterface_l_tooltipfordisabledtoolbarbuttonsandmenuitems","displayName":"Tooltip for disabled toolbar buttons and menu items (User)","description":"Defines the text to be used in tooltips for disabled toolbar buttons and menu items.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_disableitemsinuserinterface_l_tooltipfordisabledtoolbarbuttonsandmenuitems_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_disableitemsinuserinterface_l_tooltipfordisabledtoolbarbuttonsandmenuitems_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_disableitemsinuserinterface_l_tooltipfordisabledtoolbarbuttonsandmenuitems_l_tooltipfordisabledtoolbarbuttonsandmenuitems353","displayName":"Tooltip for disabled toolbar buttons and menu items (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_disableitemsinuserinterface_l_turnoffscreenclipping","displayName":"Turn off screen clipping (User)","description":"This policy setting allows you to turn off the Insert Screenshot feature.\r\n\r\nIf you enable this policy setting, you will turn off the Insert Screenshot feature found in Microsoft Excel, PowerPoint, Outlook, and Word. This setting does not affect the screen clipping feature found in Microsoft OneNote or the Print Screen key on your keyboard.\r\n\r\nIf you disable or do not configure this policy setting, the Insert Screenshot feature in Microsoft Excel, PowerPoint, Outlook, and Word will be available. This feature allows users to insert both screen clippings and the contents of an entire active window. ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_disableitemsinuserinterface_l_turnoffscreenclipping_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_disableitemsinuserinterface_l_turnoffscreenclipping_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_dlp_l_policytipsenabled","displayName":"Enable DLP on application boot (User)","description":"This policy setting determines whether DLP executes on application boot.\r\n\r\nIf you enable this policy setting, DLP runs on application boot.\r\n\r\nIf you disable or do not configure this policy setting, DLP does not run on application boot.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_dlp_l_policytipsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_dlp_l_policytipsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_disabledocumentinformationpanel","displayName":"Disable Document Information Panel (User)","description":"This policy setting controls whether Excel, PowerPoint, and Word users can view document information in the Document Information Panel.The Document Information Panel replaces the modal Properties dialog box in earlier versions of Excel, PowerPoint, and Word, and allows users to view and edit metadata that is associated with the document. Office 2016 developers can create custom Document Information Panels to record a variety of information relevant to the document or the organization. \r\n\r\nIf you enable this policy setting, forms and controls do not display in the Document Information Panel. The panel itself will display when users open it, but it will be blank. \r\n\r\nIf you disable or do not configure this policy setting, users can view the Document Information Panel.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_disabledocumentinformationpanel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_disabledocumentinformationpanel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_documentinformationpanelbeaconingui","displayName":"Document Information Panel Beaconing UI (User)","description":"This policy setting controls whether users see a security warning when they open custom Document Information Panels that contain a Web beaconing threat. InfoPath can be used to create custom Document Information Panels that can be attached to Excel workbooks, PowerPoint presentations, and Word documents. \r\n\r\nIf you enable this policy setting, you can choose from three options for controlling when users are prompted about Web beaconing threats: \r\n\r\n- Never show UI \r\n\r\n- Always show UI \r\n\r\n- Show UI if XSN is in Internet Zone \r\n\r\nIf you disable or do not configure this policy setting, the behavior is the equivalent of setting the policy to Enabled -- Never show UI.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_documentinformationpanelbeaconingui_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_documentinformationpanelbeaconingui_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_documentinformationpanelbeaconingui_l_empty423","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_documentinformationpanelbeaconingui_l_empty423_0","displayName":"Never show UI","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_documentinformationpanelbeaconingui_l_empty423_1","displayName":"Always show UI","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_documentinformationpanelbeaconingui_l_empty423_2","displayName":"Show UI if XSN is in Internet Zone","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_offlinemodefordocumentinformationpanel","displayName":"Offline Mode for Document Information Panel (User)","description":"Specify if Offline Mode is disabled/enabled for custom Document Information Panel templates and if the Document Information Panel is currently in Offline Mode.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_offlinemodefordocumentinformationpanel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_offlinemodefordocumentinformationpanel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_offlinemodefordocumentinformationpanel_l_empty422","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_offlinemodefordocumentinformationpanel_l_empty422_0","displayName":"Disable Offline Mode","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_offlinemodefordocumentinformationpanel_l_empty422_1","displayName":"Enable Offline Mode, work offline now","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_offlinemodefordocumentinformationpanel_l_empty422_2","displayName":"Enable Offline Mode","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_trustcentersolution","displayName":"Trust Local Solution (User)","description":"Suppresses prompt that asks to load a locally installed full-trust solution of a Document Information Panel in the background. This is normally shown if a full-trust solution is deployed and there are bound properties in the document (e.g. lookups) that must load the Document Information Panel in the background to retrieve the contents of the property. \r\n\r\nEnter pairs corresponding to the Document Information Panel solution path and a value of 1 to disable. If the value is set, the user will not be prompted when loading the full-trust solution in the background. The solution will load normally (and any non-related warnings that exist).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_trustcentersolution_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_trustcentersolution_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_trustcentersolution_l_empty421","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_trustcentersolution_l_empty421_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_documentinformationpanel_l_trustcentersolution_l_empty421_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_downloadingframeworkcomponents_l_hidemissingcomponentdownloadhyperlinks","displayName":"Hide missing component download hyperlinks (User)","description":"Don't allow the download of missing components but not showing the download hyperlinks for the missing components. Possible missing components are the Microsoft .NET 2.0 framework and Workflow component.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_downloadingframeworkcomponents_l_hidemissingcomponentdownloadhyperlinks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_downloadingframeworkcomponents_l_hidemissingcomponentdownloadhyperlinks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_downloadingframeworkcomponents_l_setdownloadlocationfornet20framework","displayName":"Set download location for Microsoft .NET Framework 2.0 (User)","description":"Set a custom path to where users can access the missing component.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_downloadingframeworkcomponents_l_setdownloadlocationfornet20framework_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_downloadingframeworkcomponents_l_setdownloadlocationfornet20framework_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_downloadingframeworkcomponents_l_setdownloadlocationfornet20framework_l_empty434","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_downloadingframeworkcomponents_l_setdownloadlocationfornet20frameworklp","displayName":"Set download location for Microsoft .NET Framework 2.0 Language Pack (User)","description":"Set a custom path to where users can access the missing component.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_downloadingframeworkcomponents_l_setdownloadlocationfornet20frameworklp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_downloadingframeworkcomponents_l_setdownloadlocationfornet20frameworklp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_downloadingframeworkcomponents_l_setdownloadlocationfornet20frameworklp_l_empty435","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy1","displayName":"Places Bar Location 1 (User)","description":"This setting configures the list of items displayed in the Places Bar of the Common File dialog boxes. Valid items include browseable paths and environment variables of the form %...%. Items will be displayed in the Places Bar in the order in which they are entered into the template.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy1_l_placesbarname","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy1_l_placesbarpath","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy10","displayName":"Places Bar Location 10 (User)","description":"This setting configures the list of items displayed in the Places Bar of the Common File dialog boxes. Valid items include browseable paths and environment variables of the form %...%. Items will be displayed in the Places Bar in the order in which they are entered into the template.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy10_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy10_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy10_l_placesbarname227","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy10_l_placesbarpath228","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy2","displayName":"Places Bar Location 2 (User)","description":"This setting configures the list of items displayed in the Places Bar of the Common File dialog boxes. Valid items include browseable paths and environment variables of the form %...%. Items will be displayed in the Places Bar in the order in which they are entered into the template.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy2_l_placesbarname211","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy2_l_placesbarpath212","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy3","displayName":"Places Bar Location 3 (User)","description":"This setting configures the list of items displayed in the Places Bar of the Common File dialog boxes. Valid items include browseable paths and environment variables of the form %...%. Items will be displayed in the Places Bar in the order in which they are entered into the template.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy3_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy3_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy3_l_placesbarname213","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy3_l_placesbarpath214","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy4","displayName":"Places Bar Location 4 (User)","description":"This setting configures the list of items displayed in the Places Bar of the Common File dialog boxes. Valid items include browseable paths and environment variables of the form %...%. Items will be displayed in the Places Bar in the order in which they are entered into the template.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy4_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy4_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy4_l_placesbarname215","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy4_l_placesbarpath216","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy5","displayName":"Places Bar Location 5 (User)","description":"This setting configures the list of items displayed in the Places Bar of the Common File dialog boxes. Valid items include browseable paths and environment variables of the form %...%. Items will be displayed in the Places Bar in the order in which they are entered into the template.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy5_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy5_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy5_l_placesbarname217","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy5_l_placesbarpath218","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy6","displayName":"Places Bar Location 6 (User)","description":"This setting configures the list of items displayed in the Places Bar of the Common File dialog boxes. Valid items include browseable paths and environment variables of the form %...%. Items will be displayed in the Places Bar in the order in which they are entered into the template.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy6_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy6_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy6_l_placesbarname219","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy6_l_placesbarpath220","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy7","displayName":"Places Bar Location 7 (User)","description":"This setting configures the list of items displayed in the Places Bar of the Common File dialog boxes. Valid items include browseable paths and environment variables of the form %...%. Items will be displayed in the Places Bar in the order in which they are entered into the template.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy7_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy7_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy7_l_placesbarname221","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy7_l_placesbarpath222","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy8","displayName":"Places Bar Location 8 (User)","description":"This setting configures the list of items displayed in the Places Bar of the Common File dialog boxes. Valid items include browseable paths and environment variables of the form %...%. Items will be displayed in the Places Bar in the order in which they are entered into the template.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy8_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy8_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy8_l_placesbarname223","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy8_l_placesbarpath224","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy9","displayName":"Places Bar Location 9 (User)","description":"This setting configures the list of items displayed in the Places Bar of the Common File dialog boxes. Valid items include browseable paths and environment variables of the form %...%. Items will be displayed in the Places Bar in the order in which they are entered into the template.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy9_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy9_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy9_l_placesbarname225","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_placesbarlocations_l_placesbarlocationpolicy9_l_placesbarpath226","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing","displayName":"Activate Restricted Browsing (User)","description":"When Restricted Browsing is activated the save as dialog box will be restricted such that the user will only be able to navigate to those locations and the children of those locations specified in the \"Restricted Browsing\\Approve Locations\" policy setting. If you want to enable the \"Approve Locations\" policy setting, you must first enable the \"Approve Locations\" policy setting first.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_access","displayName":"Microsoft Access (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_access_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_access_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_excel","displayName":"Microsoft Excel (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_excel_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_excel_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_infopath","displayName":"Microsoft InfoPath (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_infopath_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_infopath_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_onenote","displayName":"Microsoft OneNote (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_onenote_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_onenote_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_outlook","displayName":"Microsoft Outlook (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_outlook_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_outlook_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_powerpoint","displayName":"Microsoft PowerPoint (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_powerpoint_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_powerpoint_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_project","displayName":"Microsoft Project (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_project_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_project_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_publisher","displayName":"Microsoft Publisher (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_publisher_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_publisher_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_sharepoint","displayName":"Microsoft SharePoint Designer (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_sharepoint_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_sharepoint_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_visio","displayName":"Microsoft Visio (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_visio_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_visio_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_word","displayName":"Microsoft Word (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_word_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_activaterestrictedbrowsing_l_word_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_listofapprovedlocationspolicy","displayName":"Approve Locations (User)","description":"Adds locations, such as c:\\Windows or \\\\server\\share, to the list of approved locations for use with Restricted Browsing. When Restricted Browsing is active, the Save As dialog box is restricted such that the user can navigate only to the locations and the children of the locations specified in this list. \r\n\r\nTo allow easier access to these approved locations, consider adding them to the Places bar by using the Places Bar Locations setting for the File Open/Save dialog box. If there are no approved locations in the Places bar, the dialog box may not be able to open.\r\n\r\nTo activate Restricted Browsing, use the Restricted Browsing/Activate Restricted Browsing setting. Note: You must set this policy setting first before the \"Activate Restricted Browsing.\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_listofapprovedlocationspolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_listofapprovedlocationspolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_listofapprovedlocationspolicy_l_listofapprovedlocations","displayName":"List of Approved Locations: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_listofapprovedlocationspolicy_l_listofapprovedlocations_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_fileopensave~l_restrictedbrowsing_l_listofapprovedlocationspolicy_l_listofapprovedlocations_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_firstrun_l_disablemovie","displayName":"Disable First Run Movie (User)","description":"This policy setting determines whether a video about signing-in to Office is played when Office first runs.\r\n\r\nIf you enable this policy setting, the video does not run during Office First Run.\r\n\r\nIf you disable or do not configure this policy setting, a video about signing-in to Office plays when Office first runs.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_firstrun_l_disablemovie_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_firstrun_l_disablemovie_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_firstrun_l_disableofficefirstrun","displayName":"Disable Office First Run on application boot (User)","description":"This policy setting determines whether the Office First Run comes up on first application boot if not previously viewed.\r\n\r\nIf you enable this policy setting, the Office First Run does not run on first application boot.\r\n\r\nIf you disable or do not configure this policy setting, the Office First Run about signing-in to Office comes up on first application boot if not previously viewed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_firstrun_l_disableofficefirstrun_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_firstrun_l_disableofficefirstrun_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_allowroamingquickaccesstoolbarribboncustomizations","displayName":"Allow roaming of all user customizations (User)","description":"This policy setting allows roaming of both the Quick Access Toolbar and Ribbon customizations. \r\n\r\nIf you enable this policy setting, users' Quick Access Toolbar and Ribbon customizations will be available to them on any computer on their network when they log on. \r\n\r\nIf you disable or do not configure this policy setting, users' Quick Access Toolbar and Ribbon customizations will only be available to them on the computer on which they made the customizations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_allowroamingquickaccesstoolbarribboncustomizations_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_allowroamingquickaccesstoolbarribboncustomizations_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy","displayName":"Turn off user customizations via UI (User)","description":"This policy setting can prevent users from customizing both the Quick Access Toolbar and Ribbon through the user interface (UI).\r\n\r\nIf you enable this policy setting, the following UI entry points are turned off: the Quick Access Toolbar and Ribbon tabs in the application's Office Center dialog box, and the Quick Access Toolbar and Ribbon customization options on the right-click menu on the Ribbon.\r\n\r\nIf you disable or do not configure this policy setting, users can customize the Quick Access Toolbar and Ribbon through both the application’s Office Center dialog box, and the right-click menu on the Ribbon.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuiaccess","displayName":"Disallow in Access (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuiaccess_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuiaccess_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuiexcel","displayName":"Disallow in Excel (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuiexcel_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuiexcel_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuiinfopath","displayName":"Disallow in InfoPath (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuiinfopath_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuiinfopath_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuionenote","displayName":"Disallow in OneNote (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuionenote_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuionenote_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuioutlook","displayName":"Disallow in Outlook (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuioutlook_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuioutlook_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuipowerpoint","displayName":"Disallow in PowerPoint (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuipowerpoint_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuipowerpoint_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuiproject","displayName":"Disallow in Project (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuiproject_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuiproject_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuipublisher","displayName":"Disallow in Publisher (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuipublisher_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuipublisher_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuispd","displayName":"Disallow in SharePoint Designer (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuispd_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuispd_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuispw","displayName":"Disallow in SharePoint Workspace (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuispw_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuispw_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuivisio","displayName":"Disallow in Visio (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuivisio_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuivisio_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuiword","displayName":"Disallow in Word (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuiword_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_disabletoolbarcustomizationuipolicy_l_disabletoolbarcustomizationuiword_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_donotshowscreentipsontoolbars","displayName":"Do not show ScreenTips on toolbars (User)","description":"This policy setting allows you to configure the \"Show ScreenTips on Toolbars\" option.\r\n\r\nIf you enable this policy setting, ScreenTips will not be shown on toolbars.\r\n\r\nIf you disable or do not configure this policy setting, ScreenTips will be shown on toolbars.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_donotshowscreentipsontoolbars_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_donotshowscreentipsontoolbars_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_largeicons","displayName":"Large icons (User)","description":"Checks/Unchecks the corresponding UI option. This option only applies to CommandBars UI.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_largeicons_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_largeicons_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_listfontnamesintheirfont","displayName":"List font names in their font (User)","description":"Checks/Unchecks the corresponding UI option. This option only applies to CommandBars UI.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_listfontnamesintheirfont_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_listfontnamesintheirfont_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_menuanimations","displayName":"Menu animations (User)","description":"Checks/Unchecks the corresponding UI option. This option only applies to CommandBars UI.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_menuanimations_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_menuanimations_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_menuanimations_l_menuanimations209","displayName":"Menu animations (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_menuanimations_l_menuanimations209_0","displayName":"(System Default)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_menuanimations_l_menuanimations209_1","displayName":"Random","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_menuanimations_l_menuanimations209_2","displayName":"Unfold","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_menuanimations_l_menuanimations209_3","displayName":"Slide","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_menuanimations_l_menuanimations209_4","displayName":"Fade","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy","displayName":"Disable UI extending from documents and templates (User)","description":"This policy setting controls whether Office 2016 applications load any custom user interface (UI) code included with a document or template. Office 2016 allows developers to extend the UI with customization code that is included in a document or template. \r\n\r\nIf you enable this policy setting, Office 2016 applications cannot load any UI customization code included with documents and templates. \r\n\r\nIf you disable or do not configure this policy setting, Office 2016 applications load any UI customization code included with a document or template when opening it.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyaccess","displayName":"Disallow in Access (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyaccess_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyaccess_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyexcel","displayName":"Disallow in Excel (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyexcel_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyexcel_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyinfopath","displayName":"Disallow in InfoPath (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyinfopath_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyinfopath_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyoutlook","displayName":"Disallow in Outlook (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyoutlook_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyoutlook_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicypowerpoint","displayName":"Disallow in PowerPoint (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicypowerpoint_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicypowerpoint_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyproject","displayName":"Disallow in Project (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyproject_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyproject_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicypublisher","displayName":"Disallow in Publisher (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicypublisher_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicypublisher_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyvisio","displayName":"Disallow in Visio (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyvisio_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyvisio_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyword","displayName":"Disallow in Word (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyword_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_noextensibilitycustomizationfromdocumentpolicy_l_noextensibilitycustomizationfromdocumentpolicyword_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy","displayName":"Turn off all user customizations (User)","description":"This policy setting can prevent users from making any Quick Access Toolbar and the Ribbon customizations. This includes customizations made through user interface (UI) entry points, or loaded from documents or templates.\r\n\r\nIf you enable this policy setting, users will not be able to customize the Quick Access Toolbar and Ribbon through either the Quick Access Toolbar and Ribbon tabs in the application's Office Center dialog box, or the right-click menu on the Ribbon. In addition, Quick Access Toolbar and Ribbon customizations originating from documents or templates will not be loaded when these documents are opened.\r\n\r\nIf you disable or do not configure this policy setting, users can make Quick Access Toolbar and Ribbon customizations through the UI, as well as load them from documents and templates.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyaccess","displayName":"Disallow in Access (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyaccess_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyaccess_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyexcel","displayName":"Disallow in Excel (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyexcel_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyexcel_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyinfopath","displayName":"Disallow in InfoPath (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyinfopath_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyinfopath_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyonenote","displayName":"Disallow in OneNote (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyonenote_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyonenote_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyoutlook","displayName":"Disallow in Outlook (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyoutlook_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyoutlook_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicypowerpoint","displayName":"Disallow in PowerPoint (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicypowerpoint_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicypowerpoint_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyproject","displayName":"Disallow in Project (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyproject_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyproject_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicypublisher","displayName":"Disallow in Publisher (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicypublisher_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicypublisher_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyspd","displayName":"Disallow in SharePoint Designer (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyspd_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyspd_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyspw","displayName":"Disallow in SharePoint Workspace (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyspw_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyspw_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyvisio","displayName":"Disallow in Visio (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyvisio_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyvisio_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyword","displayName":"Disallow in Word (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyword_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_nousercustomizationpolicy_l_nousercustomizationpolicyword_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_showshortcutkeysinscreentips","displayName":"Show shortcut keys in ScreenTips (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_showshortcutkeysinscreentips_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize_l_showshortcutkeysinscreentips_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize~l_sharedworkspace_l_automaticdiscovery","displayName":"Automatic Discovery (User)","description":"Enables/Disables the Automatic Discovery feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize~l_sharedworkspace_l_automaticdiscovery_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize~l_sharedworkspace_l_automaticdiscovery_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize~l_sharedworkspace_l_automaticdiscovery_l_automaticdiscovery210","displayName":"Automatic Discovery (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize~l_sharedworkspace_l_automaticdiscovery_l_automaticdiscovery210_on","displayName":"On","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize~l_sharedworkspace_l_automaticdiscovery_l_automaticdiscovery210_off","displayName":"Off","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize~l_sharedworkspace_l_disableuserfromsettingpersonalsiteasdefaultlocation","displayName":"Disable user from setting personal site as default location (User)","description":"Checked: User is not able to define the default location to the personal site. | Unchecked: Default location is not restricted.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize~l_sharedworkspace_l_disableuserfromsettingpersonalsiteasdefaultlocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize~l_sharedworkspace_l_disableuserfromsettingpersonalsiteasdefaultlocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize~l_sharedworkspace~l_definesharedworkspaceurls_l_site1","displayName":"Site 1: (User)","description":"Specifies the name and URL of a shared workspace. The name and URL appear in the Document Management pane.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize~l_sharedworkspace~l_definesharedworkspaceurls_l_site1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize~l_sharedworkspace~l_definesharedworkspaceurls_l_site1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize~l_sharedworkspace~l_definesharedworkspaceurls_l_site1_l_name","displayName":"Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_gloabloptions~l_customize~l_sharedworkspace~l_definesharedworkspaceurls_l_site1_l_url","displayName":"URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_graphsettings_l_charttemplatesserverlocation","displayName":"Chart Templates Server Location (User)","description":"Specifies the location [URL or UNC] for server-based chart templates.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_graphsettings_l_charttemplatesserverlocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_graphsettings_l_charttemplatesserverlocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_graphsettings_l_charttemplatesserverlocation_l_location","displayName":"Location: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_graphsettings_l_enablemsgraphasdefaultchart","displayName":"Enable MS Graph as Default Chart Tool in PowerPoint and Word (User)","description":"Enables administrators to set the default chart creation tool to MS Graph instead of the default Excel Chart in PowerPoint and Word. Also blocks conversion of Graph charts to Office charts.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_graphsettings_l_enablemsgraphasdefaultchart_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_graphsettings_l_enablemsgraphasdefaultchart_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_graphsettings_l_graphgallerypath","displayName":"Graph gallery path (User)","description":"Sets the path to store user-defined custom charts.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_graphsettings_l_graphgallerypath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_graphsettings_l_graphgallerypath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_graphsettings_l_graphgallerypath_l_graphgallerypath354","displayName":"Graph gallery path (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_help_l_federatedsearchforhelp","displayName":"Federated search for help (User)","description":"\r\n This policy setting allows you to determine the sources of content that Office users in your organization can access through Office Help (F1).\r\n\r\n If you enable or do not configure this policy setting, users who utilize Office Help see content from both Office and the Internet.\r\n\r\n If you disable this setting, Office users’ search results through Help are limited to Office content.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_help_l_federatedsearchforhelp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_help_l_federatedsearchforhelp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_disablebuiltincolorvariations","displayName":"Disable built-in color variations (User)","description":"Specify whether or not to show the built-in color variations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_disablebuiltincolorvariations_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_disablebuiltincolorvariations_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_disablebuiltinigxgraphics","displayName":"Disable built-in graphics (User)","description":"Specify whether or not to show the built-in SmartArt Graphics.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_disablebuiltinigxgraphics_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_disablebuiltinigxgraphics_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_disablebuiltinquickstyles","displayName":"Disable Built-in Quick Styles (User)","description":"Specify whether or not to show the built-in Quick Styles.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_disablebuiltinquickstyles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_disablebuiltinquickstyles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_errorseveritylevel","displayName":"Error Severity Level (User)","description":"Specify the severity level of errors included in the log file created when loading layouts for SmartArt graphic layouts. Choosing Errors only will result in the smallest possible log file and choosing All will result in the largest log file.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_errorseveritylevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_errorseveritylevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_errorseveritylevel_l_errorseveritylevel419","displayName":"Error Severity Level (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_errorseveritylevel_l_errorseveritylevel419_0","displayName":"Errors only","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_errorseveritylevel_l_errorseveritylevel419_1","displayName":"Level 1 warnings and below","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_errorseveritylevel_l_errorseveritylevel419_2","displayName":"Level 2 warnings and below","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_errorseveritylevel_l_errorseveritylevel419_3","displayName":"Level 3 warnings and below","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_errorseveritylevel_l_errorseveritylevel419_4","displayName":"All","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_logfileentriesnumber","displayName":"Log File Entries Number (User)","description":"Specify the number of log entries to be removed from the log file when the maximum size limit is exceeded. (1-1000)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_logfileentriesnumber_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_logfileentriesnumber_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_logfileentriesnumber_l_empty420","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_logfilemaximumsize","displayName":"Log File Maximum Size (User)","description":"Specify the maximum size in bytes for the log file created when loading custom layouts. (Maximum = 100000)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_logfilemaximumsize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_logfilemaximumsize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_igx_l_logfilemaximumsize_l_logfilemaximumsizepart","displayName":"Bytes: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_setcommentfieldsforoutlookcontactsdictionary","displayName":"Set comment fields for Outlook Contacts Dictionary (User)","description":"This policy setting allows you to specify the fields to display in the comments in the Outlook Contacts Dictionary. This policy setting applies to Japanese Microsoft IME only.\r\n\r\nIf you enable this policy setting, you can specify the fields to display by setting strings, which are represented by the following identification letter IDs. You must also use any IDs/strings in the following sequence.\r\n\r\nID for each field is as follows:\r\na = Full Name\r\nc = Phonetic Name\r\ne = Company Name\r\nf = Department Name\r\ng = Title\r\nh = Office Location\r\nj = Email Address\r\nk = Business Telephone Number\r\nl = Business Address\r\n\r\nFor example, if you want to display Full Name, Phonetic Name and Company Name, specify 'ace'.\r\n\r\nIf you do not configure this policy setting, Full Name, Phonetic Name, Company Name, Department Name, and Job Title are displayed in the comments in this order.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_setcommentfieldsforoutlookcontactsdictionary_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_setcommentfieldsforoutlookcontactsdictionary_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_setcommentfieldsforoutlookcontactsdictionary_l_setcommentfieldsforoutlookcontactsdictionaryid","displayName":"Field identification letters: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_setcommentfieldsforoutlookglobaladdresslistdictionary","displayName":"Set comment fields for Outlook Global Address List Dictionary (User)","description":"This policy setting allows you to specify the fields to display in the comments in the Outlook Global Address List Dictionary. This policy setting applies to Japanese Microsoft IME only.\r\n\r\nIf you enable this policy setting, you can specify the fields to display by setting strings, which are represented by the following identification letter IDs. You must also use any IDs/strings in the following sequence.\r\n\r\nThe ID for each field is as follows:\r\na = Full Name\r\nc = Phonetic Name\r\ne = Company Name\r\nf = Department Name\r\ng = Title\r\nh = Office Location\r\nj = Email Address\r\nk = Business Telephone Number\r\nl = Business Address\r\n\r\nFor example, if you want to display Full Name, Phonetic Name and Company Name, specify 'ace'.\r\n\r\nIf you do not configure this policy setting, Full Name, Phonetic Name, Department Name, Job Title and Office Location are displayed in the comments, in this order.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_setcommentfieldsforoutlookglobaladdresslistdictionary_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_setcommentfieldsforoutlookglobaladdresslistdictionary_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_setcommentfieldsforoutlookglobaladdresslistdictionary_l_setcommentfieldsforoutlookglobaladdresslistdictionaryid","displayName":"Field identification letters: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_setupdateintervalforoutlookcontactsdictionary","displayName":"Set update interval for Outlook Contacts Dictionary (User)","description":"This policy setting allows you to specify the update interval for the Outlook Contacts Dictionary. This policy setting applies to Japanese Microsoft IME only.\r\n\r\nIf you enable this policy setting, you can specify the update interval. For example, if you specify \"720,\" the Outlook Contacts Dictionary is updated every 720 minutes.\r\n\r\nIf you do not configure this policy setting, the Outlook Contacts Dictionary is updated every 1440 minutes (24 hours).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_setupdateintervalforoutlookcontactsdictionary_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_setupdateintervalforoutlookcontactsdictionary_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_setupdateintervalforoutlookcontactsdictionary_l_setupdateintervalforoutlookcontactsdictionaryspinid","displayName":"(in minutes) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_setupdateintervalforoutlookglobaladdresslistdictionary","displayName":"Set update interval for Outlook Global Address List Dictionary (User)","description":"This policy setting allows you to specify the update interval for the Outlook Global Address List Dictionary. This policy setting applies to Japanese Microsoft IME only.\r\n\r\n\r\nIf you enable this policy setting, you can specify the update interval in minutes. For example, if you specify \"720,\" the Outlook Global Address List Dictionary is updated every 720 minutes.\r\n\r\nIf you do not configure this policy setting, the Outlook Global Address List Dictionary is updated every 1440 minutes (24 hours).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_setupdateintervalforoutlookglobaladdresslistdictionary_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_setupdateintervalforoutlookglobaladdresslistdictionary_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_setupdateintervalforoutlookglobaladdresslistdictionary_l_setupdateintervalforoutlookglobaladdresslistdictionaryspinid","displayName":"(in minutes) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_turnoffoutlooknamedictionaries","displayName":"Turn off Outlook name dictionaries update (User)","description":"This policy setting allows you to turn off updating for Outlook name dictionaries of Microsoft IME (Input Method Editor). This policy setting applies to Japanese Microsoft IME only.\r\n\r\nIf you enable this policy setting, all Outlook name dictionaries are not updated.\r\nOutlook name dictionaries that were added before enabling this policy setting are used for conversion.\r\n\r\nIf you disable or do not configure this policy setting, Outlook name dictionaries are generated, updated and used for conversion.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_turnoffoutlooknamedictionaries_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_turnoffoutlooknamedictionaries_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_turnoffsharepointdictionary","displayName":"Turn off SharePoint dictionary update (User)","description":"This policy setting allows you to turn off updating for SharePoint dictionary of Microsoft IME (Input Method Editor). This policy setting applies to Japanese Microsoft IME only.\r\n\r\nIf you enable this policy setting, SharePoint dictionary is not updated, and you cannot add a new SharePoint dictionary.\r\nA SharePoint dictionary that was added before enabling this policy setting is used for conversion.\r\n\r\nIf you disable or do not configure this policy setting, SharePoint dictionary can be updated and added.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_turnoffsharepointdictionary_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_imejapanese_l_turnoffsharepointdictionary_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_improvederrorreporting_l_stopreportingerrormessages","displayName":"Stop reporting error messages (User)","description":"This policy setting controls whether the application reports error messages.\r\n\r\nIf you enable this policy, error messages will not be reported.\r\n\r\nIf you disable or do not configure this policy setting, error messages will be reported.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_improvederrorreporting_l_stopreportingerrormessages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_improvederrorreporting_l_stopreportingerrormessages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_improvederrorreporting_l_stopreportingnoncriticalerrors","displayName":"Stop reporting non-critical errors (User)","description":"This policy setting controls whether the application reports non-critical errors.\r\n\r\nIf you enable this policy, non-critical errors will not be reported.\r\n\r\nIf you disable or do not configure this policy setting, non-critical errors will be reported.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_improvederrorreporting_l_stopreportingnoncriticalerrors_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_improvederrorreporting_l_stopreportingnoncriticalerrors_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings_l_disableproofingtoolsadvertisement","displayName":"Notify users if they do not have proofing tools for a language they use (User)","description":"This policy setting allows you to turn on or turn off notifications that are displayed to users when they use a language in their document but do not have proofing tools installed for that language.\r\n\r\nIf you enable this policy setting, users see a message bar when they use a language in their document but do not have proofing tools installed for that language. Users cannot disable this notification because the \"Never show again\" button is not shown, and the checkbox to disable proofing notifications is removed from the Options dialog box.\r\n\r\nIf you disable this policy setting, users do not see this message bar.\r\n\r\nIf you do not configure this policy setting, users see this message bar. They can disable the notification by clicking the \"Never show again\" button or by clearing a check box in the Options dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings_l_disableproofingtoolsadvertisement_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings_l_disableproofingtoolsadvertisement_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_changeordeletelinktolanguagepackdownloadsite","displayName":"Change or delete link to language pack download site (User)","description":"This policy setting affects the language download link under the display and help language section.\r\n\r\nIf you enable this policy setting you, you may enter the URL to another location where language packs may be downloaded.\r\n\r\nIf you disable this policy setting the URL will be removed.\r\n\r\nIf you do not configure this policy setting, the URL will remain available and point to the language pack download site on Office.com.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_changeordeletelinktolanguagepackdownloadsite_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_changeordeletelinktolanguagepackdownloadsite_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_changeordeletelinktolanguagepackdownloadsite_l_changeordeletelinktolanguagepackdownloadsiteid","displayName":"URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_changeordeletelinktoproofingtoolsdownloadsite","displayName":"Change or delete link to the proofing tools download site (User)","description":"This policy setting affects the proofing tools link under the Editing language section.\r\n\r\nIf you enable this policy setting you, you may enter the URL to another location where proofing tools may be downloaded.\r\n\r\nIf you disable this policy setting the URL will be removed.\r\n\r\nIf you do not configure this policy setting, the URL will remain available and point to the proofing tools site on Office.com.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_changeordeletelinktoproofingtoolsdownloadsite_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_changeordeletelinktoproofingtoolsdownloadsite_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_changeordeletelinktoproofingtoolsdownloadsite_l_changeordeletelinktoproofingtoolsdownloadsiteid","displayName":"URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin","displayName":"Display help in (User)","description":"Sets the default language of online Help. In addition to configuring this setting, consider enabling the same language in the 'Enabled Editing Languages' policy node.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336","displayName":"Display help in (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_0","displayName":"(same as menus and dialog boxes)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1078","displayName":"Afrikaans","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1052","displayName":"Albanian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1118","displayName":"Amharic","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1025","displayName":"Arabic","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1067","displayName":"Armenian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1101","displayName":"Assamese","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1068","displayName":"Azerbaijani (Latin)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_2117","displayName":"Bangla (Bangladesh)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1093","displayName":"Bangla (India)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1069","displayName":"Basque","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1059","displayName":"Belarusian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_5146","displayName":"Bosnian (Latin)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1026","displayName":"Bulgarian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1027","displayName":"Catalan","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1170","displayName":"Central Kurdish (Iraq)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1116","displayName":"Cherokee","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_2052","displayName":"Chinese (Simplified)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1028","displayName":"Chinese (Traditional)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1050","displayName":"Croatian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1029","displayName":"Czech","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1030","displayName":"Danish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1164","displayName":"Dari","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1043","displayName":"Dutch","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1033","displayName":"English","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1061","displayName":"Estonian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1124","displayName":"Filipino","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1035","displayName":"Finnish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1036","displayName":"French","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1110","displayName":"Galician","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1079","displayName":"Georgian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1031","displayName":"German","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1032","displayName":"Greek","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1095","displayName":"Gujarati","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1128","displayName":"Hausa (Latin)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1037","displayName":"Hebrew","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1081","displayName":"Hindi","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1038","displayName":"Hungarian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1039","displayName":"Icelandic","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1136","displayName":"Igbo","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1057","displayName":"Indonesian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_2141","displayName":"Inuktitut (Latin)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_2108","displayName":"Irish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1076","displayName":"isiXhosa","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1077","displayName":"isiZulu","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1040","displayName":"Italian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1041","displayName":"Japanese","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1099","displayName":"Kannada","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1087","displayName":"Kazakh","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1107","displayName":"Khmer","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1158","displayName":"K'iche","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1159","displayName":"Kinyarwanda","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1089","displayName":"Swahili","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1111","displayName":"Konkani","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1042","displayName":"Korean","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1088","displayName":"Kyrgyz","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1062","displayName":"Latvian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1063","displayName":"Lithuanian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1134","displayName":"Luxembourgish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1086","displayName":"Malay (Malaysia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1100","displayName":"Malayalam","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1082","displayName":"Maltese","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1153","displayName":"Maori","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1102","displayName":"Marathi","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1104","displayName":"Mongolian (Cyrillic)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1071","displayName":"Macedonian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1121","displayName":"Nepali","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1044","displayName":"Norwegian (Bokmal)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_2068","displayName":"Norwegian (Nynorsk)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1096","displayName":"Odia","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1065","displayName":"Persian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1045","displayName":"Polish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1046","displayName":"Portuguese (Brazil)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_2070","displayName":"Portuguese (Portugal)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1094","displayName":"Punjabi","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_2118","displayName":"Punjabi (Pakistan)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_3179","displayName":"Quechua (Peru)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1048","displayName":"Romanian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1049","displayName":"Russian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1169","displayName":"Scottish Gaelic (United Kingdom)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_3098","displayName":"Serbian (Cyrillic, Serbia and Montenegro (Former))","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_7194","displayName":"Serbian (Cyrillic, Bosnia and Herzegovina)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_2074","displayName":"Serbian (Latin, Serbia and Montenegro (Former))","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1132","displayName":"Sesotho sa Leboa","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1074","displayName":"Setswana","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_2137","displayName":"Sindhi (Arabic)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1115","displayName":"Sinhala","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1051","displayName":"Slovak","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1060","displayName":"Slovenian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_3082","displayName":"Spanish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1053","displayName":"Swedish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1064","displayName":"Tajik","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1097","displayName":"Tamil","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1092","displayName":"Tatar","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1098","displayName":"Telugu","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1054","displayName":"Thai","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1139","displayName":"Tigrinya (Ethiopia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1055","displayName":"Turkish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1090","displayName":"Turkmen","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1058","displayName":"Ukrainian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1056","displayName":"Urdu","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1152","displayName":"Uyghur (PRC)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1091","displayName":"Uzbek (Latin)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_2051","displayName":"Valencian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1066","displayName":"Vietnamese","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1106","displayName":"Welsh","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1160","displayName":"Wolof","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displayhelpin_l_displayhelpin336_1130","displayName":"Yoruba","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin","displayName":"Display menus and dialog boxes in (User)","description":"Sets the display language of the user interface for all Office 2016 programs. In addition to configuring this setting, consider enabling the same language in the 'Enabled Editing Languages' policy node.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334","displayName":"Display menus and dialog boxes in (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_0","displayName":"(same as the system)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1078","displayName":"Afrikaans","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1052","displayName":"Albanian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1118","displayName":"Amharic","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1025","displayName":"Arabic","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1067","displayName":"Armenian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1101","displayName":"Assamese","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1068","displayName":"Azerbaijani (Latin)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_2117","displayName":"Bangla (Bangladesh)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1093","displayName":"Bangla (India)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1069","displayName":"Basque","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1059","displayName":"Belarusian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_5146","displayName":"Bosnian (Latin)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1026","displayName":"Bulgarian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1027","displayName":"Catalan","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1170","displayName":"Central Kurdish (Iraq)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1116","displayName":"Cherokee","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_2052","displayName":"Chinese (Simplified)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1028","displayName":"Chinese (Traditional)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1050","displayName":"Croatian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1029","displayName":"Czech","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1030","displayName":"Danish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1164","displayName":"Dari","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1043","displayName":"Dutch","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1033","displayName":"English","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1061","displayName":"Estonian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1124","displayName":"Filipino","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1035","displayName":"Finnish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1036","displayName":"French","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1110","displayName":"Galician","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1079","displayName":"Georgian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1031","displayName":"German","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1032","displayName":"Greek","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1095","displayName":"Gujarati","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1128","displayName":"Hausa (Latin)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1037","displayName":"Hebrew","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1081","displayName":"Hindi","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1038","displayName":"Hungarian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1039","displayName":"Icelandic","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1136","displayName":"Igbo","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1057","displayName":"Indonesian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_2141","displayName":"Inuktitut (Latin)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_2108","displayName":"Irish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1076","displayName":"isiXhosa","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1077","displayName":"isiZulu","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1040","displayName":"Italian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1041","displayName":"Japanese","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1099","displayName":"Kannada","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1087","displayName":"Kazakh","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1107","displayName":"Khmer","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1158","displayName":"K'iche","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1159","displayName":"Kinyarwanda","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1088","displayName":"Kyrgyz","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1089","displayName":"Swahili","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1111","displayName":"Konkani","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1042","displayName":"Korean","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1062","displayName":"Latvian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1063","displayName":"Lithuanian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1134","displayName":"Luxembourgish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1086","displayName":"Malay (Malaysia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1100","displayName":"Malayalam","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1082","displayName":"Maltese","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1153","displayName":"Maori","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1102","displayName":"Marathi","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1071","displayName":"Macedonian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1104","displayName":"Mongolian (Cyrillic)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1121","displayName":"Nepali","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1044","displayName":"Norwegian (Bokmal)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_2068","displayName":"Norwegian (Nynorsk)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1096","displayName":"Odia","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1065","displayName":"Persian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1045","displayName":"Polish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1046","displayName":"Portuguese (Brazil)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_2070","displayName":"Portuguese (Portugal)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1094","displayName":"Punjabi","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_2118","displayName":"Punjabi (Pakistan)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_3179","displayName":"Quechua (Peru)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1048","displayName":"Romanian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1049","displayName":"Russian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1169","displayName":"Scottish Gaelic (United Kingdom)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_3098","displayName":"Serbian (Cyrillic, Serbia and Montenegro (Former))","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_7194","displayName":"Serbian (Cyrillic, Bosnia and Herzegovina)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_2074","displayName":"Serbian (Latin, Serbia and Montenegro (Former))","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1132","displayName":"Sesotho sa Leboa","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1074","displayName":"Setswana","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_2137","displayName":"Sindhi (Arabic)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1115","displayName":"Sinhala","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1051","displayName":"Slovak","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1060","displayName":"Slovenian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_3082","displayName":"Spanish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1053","displayName":"Swedish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1064","displayName":"Tajik","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1097","displayName":"Tamil","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1092","displayName":"Tatar","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1098","displayName":"Telugu","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1054","displayName":"Thai","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1139","displayName":"Tigrinya (Ethiopia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1055","displayName":"Turkish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1090","displayName":"Turkmen","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1058","displayName":"Ukrainian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1056","displayName":"Urdu","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1152","displayName":"Uyghur (PRC)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1091","displayName":"Uzbek (Latin)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_2051","displayName":"Valencian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1066","displayName":"Vietnamese","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1106","displayName":"Welsh","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1160","displayName":"Wolof","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_displaylanguage_l_displaymenusanddialogboxesin_l_displaymenusanddialogboxesin334_1130","displayName":"Yoruba","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage","displayName":"Primary Editing Language (User)","description":"Defines the editing options for Office 2016 programs. In addition to configuring this setting, consider enabling the same language in the 'Enabled Editing Languages' policy node. Please refer to the Office Resource Kit documentation for important information on setting the installed version of Microsoft Office.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341","displayName":"Primary Editing Language (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1078","displayName":"Afrikaans","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1052","displayName":"Albanian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1156","displayName":"Alsatian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1118","displayName":"Amharic","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_5121","displayName":"Arabic (Algeria)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_15361","displayName":"Arabic (Bahrain)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_3073","displayName":"Arabic (Egypt)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2049","displayName":"Arabic (Iraq)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_11265","displayName":"Arabic (Jordan)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_13313","displayName":"Arabic (Kuwait)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_12289","displayName":"Arabic (Lebanon)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_4097","displayName":"Arabic (Libya)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_6145","displayName":"Arabic (Morocco)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_8193","displayName":"Arabic (Oman)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_16385","displayName":"Arabic (Qatar)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1025","displayName":"Arabic (Saudi Arabia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_10241","displayName":"Arabic (Syria)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_7169","displayName":"Arabic (Tunisia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_14337","displayName":"Arabic (U.A.E.)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_9217","displayName":"Arabic (Yemen)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1067","displayName":"Armenian (Armenia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1101","displayName":"Assamese (India)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2092","displayName":"Azerbaijani (Cyrillic)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1068","displayName":"Azerbaijani (Latin)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2117","displayName":"Bangla (Bangladesh)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1093","displayName":"Bangla (India)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1133","displayName":"Bashkir","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1069","displayName":"Basque","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1059","displayName":"Belarusian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_8218","displayName":"Bosnian (Cyrillic, Bosnia and Herzegovina)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_5146","displayName":"Bosnian (Latin, Bosnia and Herzegovina)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1150","displayName":"Breton","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1026","displayName":"Bulgarian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1109","displayName":"Burmese","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1027","displayName":"Catalan","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1170","displayName":"Central Kurdish (Iraq)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1116","displayName":"Cherokee","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2052","displayName":"Chinese (PRC)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_3076","displayName":"Chinese (Hong Kong S.A.R.)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_5124","displayName":"Chinese (Macao S.A.R.)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_4100","displayName":"Chinese (Singapore)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1028","displayName":"Chinese (Taiwan)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1155","displayName":"Corsican","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_4122","displayName":"Croatian (Bosnia and Herzegovina)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1050","displayName":"Croatian (Croatia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1029","displayName":"Czech","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1030","displayName":"Danish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1164","displayName":"Dari","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1125","displayName":"Divehi","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2067","displayName":"Dutch (Belgium)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1043","displayName":"Dutch (Netherlands)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1126","displayName":"Edo","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_3081","displayName":"English (Australia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_10249","displayName":"English (Belize)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_4105","displayName":"English (Canada)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_9225","displayName":"English (Caribbean)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_15369","displayName":"English (Hong Kong S.A.R.)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_16393","displayName":"English (India)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_14345","displayName":"English (Indonesia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_6153","displayName":"English (Ireland)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_8201","displayName":"English (Jamaica)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_17417","displayName":"English (Malaysia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_5129","displayName":"English (New Zealand)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_13321","displayName":"English (Philippines)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_18441","displayName":"English (Singapore)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_7177","displayName":"English (South Africa)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_11273","displayName":"English (Trinidad and Tobago)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2057","displayName":"English (U.K.)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1033","displayName":"English (U.S.)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_12297","displayName":"English (Zimbabwe)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1061","displayName":"Estonian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1080","displayName":"Faeroese","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1124","displayName":"Filipino","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1035","displayName":"Finnish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2060","displayName":"French (Belgium)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_11276","displayName":"French (Cameroon)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_3084","displayName":"French (Canada)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_7180","displayName":"French (Caribbean)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_9228","displayName":"French (Congo (DRC))","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_12300","displayName":"French (Côte d'Ivoire)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1036","displayName":"French (France)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_15372","displayName":"French (Haiti)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_5132","displayName":"French (Luxembourg)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_13324","displayName":"French (Mali)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_6156","displayName":"French (Monaco)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_14348","displayName":"French (Morocco)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_8204","displayName":"French (Reunion)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_10252","displayName":"French (Senegal)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_4108","displayName":"French (Switzerland)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1122","displayName":"Frisian (Netherlands)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1127","displayName":"Fulfulde","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1169","displayName":"Scottish Gaelic (United Kingdom)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1110","displayName":"Galician","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1079","displayName":"Georgian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_3079","displayName":"German (Austria)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1031","displayName":"German (Germany)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_5127","displayName":"German (Liechtenstein)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_4103","displayName":"German (Luxembourg)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2055","displayName":"German (Switzerland)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1032","displayName":"Greek","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1135","displayName":"Greenlandic","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1140","displayName":"Guarani","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1095","displayName":"Gujarati","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1128","displayName":"Hausa (Latin)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1141","displayName":"Hawaiian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1037","displayName":"Hebrew (Israel)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1081","displayName":"Hindi","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1038","displayName":"Hungarian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1129","displayName":"Ibibio","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1039","displayName":"Icelandic","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1136","displayName":"Igbo","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1057","displayName":"Indonesian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2141","displayName":"Inuktitut (Latin)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1117","displayName":"Inuktitut (Syllabics)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2108","displayName":"Irish (Ireland)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1077","displayName":"isiZulu","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1076","displayName":"isiXhosa","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1040","displayName":"Italian (Italy)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2064","displayName":"Italian (Switzerland)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1041","displayName":"Japanese","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1099","displayName":"Kannada","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1137","displayName":"Kanuri","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1120","displayName":"Kashmiri (Arabic)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2144","displayName":"Kashmiri (Devanagari)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1087","displayName":"Kazakh","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1107","displayName":"Khmer","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1158","displayName":"K'iche","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1159","displayName":"Kinyarwanda","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1111","displayName":"Konkani","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1042","displayName":"Korean","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1088","displayName":"Kyrgyz","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1108","displayName":"Lao","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1142","displayName":"Latin","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1062","displayName":"Latvian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1063","displayName":"Lithuanian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1134","displayName":"Luxembourgish (Luxembourg)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1071","displayName":"Macedonian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2110","displayName":"Malay (Brunei)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1086","displayName":"Malay (Malaysia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1100","displayName":"Malayalam","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1082","displayName":"Maltese","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1112","displayName":"Manipuri","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1153","displayName":"Maori","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1146","displayName":"Mapudungun","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1102","displayName":"Marathi","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1148","displayName":"Mohawk","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1104","displayName":"Mongolian (Cyrillic)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2128","displayName":"Mongolian (Traditional Mongolian)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2145","displayName":"Nepali (India)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1121","displayName":"Nepali (Nepal)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1044","displayName":"Norwegian (Bokmål)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2068","displayName":"Norwegian (Nynorsk)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1154","displayName":"Occitan","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1138","displayName":"Oromo","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1096","displayName":"Odia","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1145","displayName":"Papiamentu","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1123","displayName":"Pashto","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1065","displayName":"Persian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1045","displayName":"Polish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1046","displayName":"Portuguese (Brazil)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2070","displayName":"Portuguese (Portugal)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1094","displayName":"Punjabi","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2118","displayName":"Punjabi (Pakistan)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1131","displayName":"Quechua (Bolivia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2155","displayName":"Quechua (Ecuador)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_3179","displayName":"Quechua (Peru)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1047","displayName":"Romansh (Switzerland)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2072","displayName":"Romanian (Moldova)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1048","displayName":"Romanian (Romania)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2073","displayName":"Russian (Moldova)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1049","displayName":"Russian (Russia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_9275","displayName":"Sami, Inari (Finland)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_4155","displayName":"Sami, Lule (Norway)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_5179","displayName":"Sami, Lule (Sweden)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_3131","displayName":"Sami, Northern (Finland)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1083","displayName":"Sami, Northern (Norway)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2107","displayName":"Sami, Northern (Sweden)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_8251","displayName":"Sami, Skolt (Finland)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_6203","displayName":"Sami, Southern (Norway)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_7227","displayName":"Sami, Southern (Sweden)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1103","displayName":"Sanskrit","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_7194","displayName":"Serbian (Cyrillic, Bosnia and Herzegovina)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_6170","displayName":"Serbian (Latin, Bosnia and Herzegovina)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_3098","displayName":"Serbian (Cyrillic, Serbia and Montenegro (Former))","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_10266","displayName":"Serbian (Cyrillic, Serbia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_12314","displayName":"Serbian (Cyrillic, Montenegro)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2074","displayName":"Serbian (Latin, Serbia and Montenegro (Former))","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_11290","displayName":"Serbian (Latin, Montenegro)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_9242","displayName":"Serbian (Latin, Serbia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1072","displayName":"Sesotho","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1132","displayName":"Sesotho sa Leboa","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1074","displayName":"Setswana","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1113","displayName":"Sindhi (Devanagari)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2137","displayName":"Sindhi (Arabic)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1115","displayName":"Sinhala","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1051","displayName":"Slovak","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1060","displayName":"Slovenian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1143","displayName":"Somali","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2094","displayName":"Lower Sorbian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1070","displayName":"Upper Sorbian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_11274","displayName":"Spanish (Argentina)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_16394","displayName":"Spanish (Bolivia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_13322","displayName":"Spanish (Chile)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_9226","displayName":"Spanish (Colombia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_5130","displayName":"Spanish (Costa Rica)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_7178","displayName":"Spanish (Dominican Republic)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_12298","displayName":"Spanish (Ecuador)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_17418","displayName":"Spanish (El Salvador)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_4106","displayName":"Spanish (Guatemala)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_18442","displayName":"Spanish (Honduras)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2058","displayName":"Spanish (Mexico)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_19466","displayName":"Spanish (Nicaragua)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_6154","displayName":"Spanish (Panama)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_15370","displayName":"Spanish (Paraguay)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_10250","displayName":"Spanish (Peru)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_20490","displayName":"Spanish (Puerto Rico)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_3082","displayName":"Spanish (Spain)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_21514","displayName":"Spanish (United States)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_14346","displayName":"Spanish (Uruguay)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_8202","displayName":"Spanish (Venezuela)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1089","displayName":"Swahili","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2077","displayName":"Swedish (Finland)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1053","displayName":"Swedish (Sweden)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1114","displayName":"Syriac","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2143","displayName":"Tamazight (Latin, Algeria)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1119","displayName":"Tamazight (Arabic, Morocco)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1097","displayName":"Tamil","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1092","displayName":"Tatar","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1098","displayName":"Telugu","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1064","displayName":"Tajik","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1054","displayName":"Thai","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1105","displayName":"Tibetan (PRC)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2163","displayName":"Tigrinya (Eritrea)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1139","displayName":"Tigrinya (Ethiopia)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1055","displayName":"Turkish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1090","displayName":"Turkmen","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1152","displayName":"Uyghur (PRC)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1058","displayName":"Ukrainian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1056","displayName":"Urdu","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2115","displayName":"Uzbek (Cyrillic)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1091","displayName":"Uzbek (Latin)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_2051","displayName":"Valencian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1075","displayName":"Venda","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1066","displayName":"Vietnamese","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1106","displayName":"Welsh","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1160","displayName":"Wolof","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1073","displayName":"Xitsonga","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1157","displayName":"Sakha","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1144","displayName":"Yi (PRC)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1085","displayName":"Yiddish","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages_l_primaryeditinglanguage_l_primaryeditinglanguage341_1130","displayName":"Yoruba","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_afrikaans","displayName":"Afrikaans (User)","description":"Enables the editing language Afrikaans","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_afrikaans_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_afrikaans_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_albanian","displayName":"Albanian (User)","description":"Enables the editing language Albanian","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_albanian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_albanian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_alsatian","displayName":"Alsatian (User)","description":"Enables the editing language Alsatian","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_alsatian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_alsatian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_amharic","displayName":"Amharic (User)","description":"Enables the editing language Amharic","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_amharic_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_amharic_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicalgeria","displayName":"Arabic (Algeria) (User)","description":"Enables the editing language Arabic (Algeria)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicalgeria_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicalgeria_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicbahrain","displayName":"Arabic (Bahrain) (User)","description":"Enables the editing language Arabic (Bahrain)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicbahrain_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicbahrain_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicegypt","displayName":"Arabic (Egypt) (User)","description":"Enables the editing language Arabic (Egypt)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicegypt_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicegypt_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabiciraq","displayName":"Arabic (Iraq) (User)","description":"Enables the editing language Arabic (Iraq)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabiciraq_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabiciraq_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicjordan","displayName":"Arabic (Jordan) (User)","description":"Enables the editing language Arabic (Jordan)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicjordan_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicjordan_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabickuwait","displayName":"Arabic (Kuwait) (User)","description":"Enables the editing language Arabic (Kuwait)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabickuwait_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabickuwait_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabiclebanon","displayName":"Arabic (Lebanon) (User)","description":"Enables the editing language Arabic (Lebanon)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabiclebanon_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabiclebanon_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabiclibya","displayName":"Arabic (Libya) (User)","description":"Enables the editing language Arabic (Libya)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabiclibya_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabiclibya_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicmorocco","displayName":"Arabic (Morocco) (User)","description":"Enables the editing language Arabic (Morocco)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicmorocco_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicmorocco_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicoman","displayName":"Arabic (Oman) (User)","description":"Enables the editing language Arabic (Oman)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicoman_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicoman_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicqatar","displayName":"Arabic (Qatar) (User)","description":"Enables the editing language Arabic (Qatar)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicqatar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicqatar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicsaudiarabia","displayName":"Arabic (Saudi Arabia) (User)","description":"Enables the editing language Arabic (Saudi Arabia)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicsaudiarabia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicsaudiarabia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicsyria","displayName":"Arabic (Syria) (User)","description":"Enables the editing language Arabic (Syria)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicsyria_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicsyria_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabictunisia","displayName":"Arabic (Tunisia) (User)","description":"Enables the editing language Arabic (Tunisia)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabictunisia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabictunisia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicuae","displayName":"Arabic (U.A.E.) (User)","description":"Enables the editing language Arabic (U.A.E.)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicuae_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicuae_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicyemen","displayName":"Arabic (Yemen) (User)","description":"Enables the editing language Arabic (Yemen)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicyemen_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_arabicyemen_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_armenianarmenia","displayName":"Armenian (Armenia) (User)","description":"Enables the editing language Armenian (Armenia)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_armenianarmenia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_armenianarmenia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_assameseindia","displayName":"Assamese (India) (User)","description":"Enables the editing language Assamese (India)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_assameseindia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_assameseindia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_azerbaijanicyrillic","displayName":"Azerbaijani (Cyrillic) (User)","description":"Enables the editing language Azerbaijani (Cyrillic)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_azerbaijanicyrillic_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_azerbaijanicyrillic_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_azerbaijanilatin","displayName":"Azerbaijani (Latin) (User)","description":"Enables the editing language Azerbaijani (Latin)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_azerbaijanilatin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_azerbaijanilatin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_banglabangladesh","displayName":"Bangla (Bangladesh) (User)","description":"Enables the editing language Bangla (Bangladesh)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_banglabangladesh_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_banglabangladesh_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_banglaindia","displayName":"Bangla (India) (User)","description":"Enables the editing language Bangla (India)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_banglaindia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_banglaindia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_bashkir","displayName":"Bashkir (User)","description":"Enables the editing language Bashkir","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_bashkir_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_bashkir_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_basque","displayName":"Basque (User)","description":"Enables the editing language Basque","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_basque_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_basque_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_belarusian","displayName":"Belarusian (User)","description":"Enables the editing language Belarusian","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_belarusian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_belarusian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_bosniancyrillicbosniaandherzegovina","displayName":"Bosnian (Cyrillic, Bosnia and Herzegovina) (User)","description":"Enables the editing language \"Bosnian (Cyrillic, Bosnia and Herzegovina)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_bosniancyrillicbosniaandherzegovina_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_bosniancyrillicbosniaandherzegovina_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_bosnianlatinbosniaandherzegovina","displayName":"Bosnian (Latin, Bosnia and Herzegovina) (User)","description":"Enables the editing language \"Bosnian (Latin, Bosnia and Herzegovina)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_bosnianlatinbosniaandherzegovina_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_bosnianlatinbosniaandherzegovina_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_breton","displayName":"Breton (User)","description":"Enables the editing language Breton","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_breton_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_breton_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_bulgarian","displayName":"Bulgarian (User)","description":"Enables the editing language Bulgarian","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_bulgarian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_bulgarian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_burmese","displayName":"Burmese (User)","description":"Enables the editing language Burmese","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_burmese_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_burmese_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_catalan","displayName":"Catalan (User)","description":"Enables the editing language Catalan","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_catalan_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_catalan_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_centralkurdishiraq","displayName":"Central Kurdish (Iraq) (User)","description":"Enables the editing language Central Kurdish (Iraq)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_centralkurdishiraq_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_centralkurdishiraq_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_cherokee","displayName":"Cherokee (User)","description":"Enables the editing language Cherokee","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_cherokee_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_cherokee_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_chinesehongkongsar","displayName":"Chinese (Hong Kong S.A.R.) (User)","description":"Enables the editing language Chinese (Hong Kong S.A.R.)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_chinesehongkongsar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_chinesehongkongsar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_chinesemacaosar","displayName":"Chinese (Macao S.A.R.) (User)","description":"Enables the editing language Chinese (Macao S.A.R.)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_chinesemacaosar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_chinesemacaosar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_chineseprc","displayName":"Chinese (PRC) (User)","description":"Enables the editing language Chinese (PRC)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_chineseprc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_chineseprc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_chinesesingapore","displayName":"Chinese (Singapore) (User)","description":"Enables the editing language Chinese (Singapore)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_chinesesingapore_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_chinesesingapore_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_chinesetaiwan","displayName":"Chinese (Taiwan) (User)","description":"Enables the editing language Chinese (Taiwan)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_chinesetaiwan_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_chinesetaiwan_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_corsican","displayName":"Corsican (User)","description":"Enables the editing language Corsican","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_corsican_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_corsican_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_croatianbosniaandherzegovina","displayName":"Croatian (Bosnia and Herzegovina) (User)","description":"Enables the editing language Croatian (Bosnia and Herzegovina)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_croatianbosniaandherzegovina_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_croatianbosniaandherzegovina_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_croatiancroatia","displayName":"Croatian (Croatia) (User)","description":"Enables the editing language Croatian (Croatia)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_croatiancroatia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_croatiancroatia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_czech","displayName":"Czech (User)","description":"Enables the editing language Czech","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_czech_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_czech_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_danish","displayName":"Danish (User)","description":"Enables the editing language Danish","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_danish_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_danish_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_dari","displayName":"Dari (User)","description":"Enables the editing language Dari","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_dari_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_dari_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_divehi","displayName":"Divehi (User)","description":"Enables the editing language Divehi","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_divehi_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_divehi_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_dutchbelgium","displayName":"Dutch (Belgium) (User)","description":"Enables the editing language Dutch (Belgium)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_dutchbelgium_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_dutchbelgium_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_dutchnetherlands","displayName":"Dutch (Netherlands) (User)","description":"Enables the editing language Dutch (Netherlands)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_dutchnetherlands_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_dutchnetherlands_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_edo","displayName":"Edo (User)","description":"Enables the editing language Edo","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_edo_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_edo_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishaustralia","displayName":"English (Australia) (User)","description":"Enables the editing language English (Australia)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishaustralia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishaustralia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishbelize","displayName":"English (Belize) (User)","description":"Enables the editing language English (Belize)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishbelize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishbelize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishcanada","displayName":"English (Canada) (User)","description":"Enables the editing language English (Canada)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishcanada_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishcanada_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishcaribbean","displayName":"English (Caribbean) (User)","description":"Enables the editing language English (Caribbean)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishcaribbean_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishcaribbean_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishhongkongsar","displayName":"English (Hong Kong S.A.R.) (User)","description":"Enables the editing language English (Hong Kong S.A.R.)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishhongkongsar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishhongkongsar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishindia","displayName":"English (India) (User)","description":"Enables the editing language English (India)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishindia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishindia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishindonesia","displayName":"English (Indonesia) (User)","description":"Enables the editing language English (Indonesia)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishindonesia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishindonesia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishireland","displayName":"English (Ireland) (User)","description":"Enables the editing language English (Ireland)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishireland_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishireland_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishjamaica","displayName":"English (Jamaica) (User)","description":"Enables the editing language English (Jamaica)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishjamaica_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishjamaica_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishmalaysia","displayName":"English (Malaysia) (User)","description":"Enables the editing language English (Malaysia)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishmalaysia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishmalaysia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishnewzealand","displayName":"English (New Zealand) (User)","description":"Enables the editing language English (New Zealand)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishnewzealand_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishnewzealand_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishphilippines","displayName":"English (Philippines) (User)","description":"Enables the editing language English (Philippines)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishphilippines_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishphilippines_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishsingapore","displayName":"English (Singapore) (User)","description":"Enables the editing language English (Singapore)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishsingapore_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishsingapore_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishsouthafrica","displayName":"English (South Africa) (User)","description":"Enables the editing language English (South Africa)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishsouthafrica_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishsouthafrica_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishtrinidadandtobago","displayName":"English (Trinidad and Tobago) (User)","description":"Enables the editing language English (Trinidad and Tobago)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishtrinidadandtobago_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishtrinidadandtobago_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishuk","displayName":"English (U.K.) (User)","description":"Enables the editing language English (U.K.)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishuk_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishuk_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishus","displayName":"English (U.S.) (User)","description":"Enables the editing language English (U.S.)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishus_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishus_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishzimbabwe","displayName":"English (Zimbabwe) (User)","description":"Enables the editing language English (Zimbabwe)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishzimbabwe_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_englishzimbabwe_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_estonian","displayName":"Estonian (User)","description":"Enables the editing language Estonian","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_estonian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_estonian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_faeroese","displayName":"Faeroese (User)","description":"Enables the editing language Faeroese","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_faeroese_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_faeroese_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_filipino","displayName":"Filipino (User)","description":"Enables the editing language Filipino","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_filipino_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_filipino_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_finnish","displayName":"Finnish (User)","description":"Enables the editing language Finnish","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_finnish_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_finnish_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchbelgium","displayName":"French (Belgium) (User)","description":"Enables the editing language French (Belgium)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchbelgium_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchbelgium_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchcameroon","displayName":"French (Cameroon) (User)","description":"Enables the editing language French (Cameroon)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchcameroon_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchcameroon_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchcanada","displayName":"French (Canada) (User)","description":"Enables the editing language French (Canada)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchcanada_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchcanada_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchcaribbean","displayName":"French (Caribbean) (User)","description":"Enables the editing language French (Caribbean)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchcaribbean_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchcaribbean_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchcongodrc","displayName":"French (Congo (DRC)) (User)","description":"Enables the editing language French (Congo (DRC))","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchcongodrc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchcongodrc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchcotedivoire","displayName":"French (Côte d'Ivoire) (User)","description":"Enables the editing language French (Côte d'Ivoire)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchcotedivoire_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchcotedivoire_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchfrance","displayName":"French (France) (User)","description":"Enables the editing language French (France)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchfrance_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchfrance_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchhaiti","displayName":"French (Haiti) (User)","description":"Enables the editing language French (Haiti)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchhaiti_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchhaiti_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchluxembourg","displayName":"French (Luxembourg) (User)","description":"Enables the editing language French (Luxembourg)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchluxembourg_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchluxembourg_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchmali","displayName":"French (Mali) (User)","description":"Enables the editing language French (Mali)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchmali_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchmali_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchmonaco","displayName":"French (Monaco) (User)","description":"Enables the editing language French (Monaco)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchmonaco_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchmonaco_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchmorocco","displayName":"French (Morocco) (User)","description":"Enables the editing language French (Morocco)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchmorocco_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchmorocco_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchreunion","displayName":"French (Reunion) (User)","description":"Enables the editing language French (Reunion)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchreunion_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchreunion_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchsenegal","displayName":"French (Senegal) (User)","description":"Enables the editing language French (Senegal)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchsenegal_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchsenegal_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchswitzerland","displayName":"French (Switzerland) (User)","description":"Enables the editing language French (Switzerland)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchswitzerland_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frenchswitzerland_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frisiannetherlands","displayName":"Frisian (Netherlands) (User)","description":"Enables the editing language Frisian (Netherlands)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frisiannetherlands_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_frisiannetherlands_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_fulfulde","displayName":"Fulfulde (User)","description":"Enables the editing language Fulfulde","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_fulfulde_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_fulfulde_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_galician","displayName":"Galician (User)","description":"Enables the editing language Galician","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_galician_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_galician_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_georgian","displayName":"Georgian (User)","description":"Enables the editing language Georgian","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_georgian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_georgian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_germanaustria","displayName":"German (Austria) (User)","description":"Enables the editing language German (Austria)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_germanaustria_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_germanaustria_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_germangermany","displayName":"German (Germany) (User)","description":"Enables the editing language German (Germany)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_germangermany_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_germangermany_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_germanliechtenstein","displayName":"German (Liechtenstein) (User)","description":"Enables the editing language German (Liechtenstein)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_germanliechtenstein_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_germanliechtenstein_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_germanluxembourg","displayName":"German (Luxembourg) (User)","description":"Enables the editing language German (Luxembourg)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_germanluxembourg_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_germanluxembourg_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_germanswitzerland","displayName":"German (Switzerland) (User)","description":"Enables the editing language German (Switzerland)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_germanswitzerland_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_germanswitzerland_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_greek","displayName":"Greek (User)","description":"Enables the editing language Greek","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_greek_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_greek_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_greenlandic","displayName":"Greenlandic (User)","description":"Enables the editing language Greenlandic","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_greenlandic_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_greenlandic_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_guarani","displayName":"Guarani (User)","description":"Enables the editing language Guarani","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_guarani_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_guarani_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_gujarati","displayName":"Gujarati (User)","description":"Enables the editing language Gujarati","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_gujarati_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_gujarati_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_hausa","displayName":"Hausa (Latin) (User)","description":"Enables the editing language Hausa (Latin)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_hausa_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_hausa_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_hawaiian","displayName":"Hawaiian (User)","description":"Enables the editing language Hawaiian","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_hawaiian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_hawaiian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_hebrewisrael","displayName":"Hebrew (Israel) (User)","description":"Enables the editing language Hebrew (Israel)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_hebrewisrael_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_hebrewisrael_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_hindi","displayName":"Hindi (User)","description":"Enables the editing language Hindi","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_hindi_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_hindi_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_hungarian","displayName":"Hungarian (User)","description":"Enables the editing language Hungarian","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_hungarian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_hungarian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_ibibio","displayName":"Ibibio (User)","description":"Enables the editing language Ibibio","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_ibibio_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_ibibio_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_icelandic","displayName":"Icelandic (User)","description":"Enables the editing language Icelandic","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_icelandic_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_icelandic_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_igbo","displayName":"Igbo (User)","description":"Enables the editing language Igbo","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_igbo_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_igbo_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_indonesian","displayName":"Indonesian (User)","description":"Enables the editing language Indonesian","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_indonesian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_indonesian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_inuktitutlatin","displayName":"Inuktitut (Latin) (User)","description":"Enables the editing language Inuktitut (Latin)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_inuktitutlatin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_inuktitutlatin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_inuktitutsyllabics","displayName":"Inuktitut (Syllabics) (User)","description":"Enables the editing language Inuktitut (Syllabics)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_inuktitutsyllabics_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_inuktitutsyllabics_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_irishireland","displayName":"Irish (Ireland) (User)","description":"Enables the editing language Irish (Ireland)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_irishireland_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_irishireland_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_isixhosa","displayName":"isiXhosa (User)","description":"Enables the editing language isiXhosa","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_isixhosa_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_isixhosa_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_isizulu","displayName":"isiZulu (User)","description":"Enables the editing language isiZulu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_isizulu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_isizulu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_italianitaly","displayName":"Italian (Italy) (User)","description":"Enables the editing language Italian (Italy)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_italianitaly_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_italianitaly_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_italianswitzerland","displayName":"Italian (Switzerland) (User)","description":"Enables the editing language Italian (Switzerland)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_italianswitzerland_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_italianswitzerland_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_japanese","displayName":"Japanese (User)","description":"Enables the editing language Japanese","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_japanese_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_japanese_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kannada","displayName":"Kannada (User)","description":"Enables the editing language Kannada","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kannada_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kannada_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kanuri","displayName":"Kanuri (User)","description":"Enables the editing language Kanuri","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kanuri_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kanuri_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kashmiriarabic","displayName":"Kashmiri (Arabic) (User)","description":"Enables the editing language Kashmiri (Arabic)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kashmiriarabic_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kashmiriarabic_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kashmiridevanagari","displayName":"Kashmiri (Devanagari) (User)","description":"Enables the editing language Kashmiri (Devanagari)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kashmiridevanagari_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kashmiridevanagari_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kazakh","displayName":"Kazakh (User)","description":"Enables the editing language Kazakh","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kazakh_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kazakh_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_khmer","displayName":"Khmer (User)","description":"Enables the editing language Khmer","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_khmer_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_khmer_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kiche","displayName":"K'iche (User)","description":"Enables the editing language K'iche","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kiche_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kiche_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kinyarwanda","displayName":"Kinyarwanda (User)","description":"Enables the editing language Kinyarwanda","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kinyarwanda_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kinyarwanda_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_konkani","displayName":"Konkani (User)","description":"Enables the editing language Konkani","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_konkani_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_konkani_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_korean","displayName":"Korean (User)","description":"Enables the editing language Korean","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_korean_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_korean_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kyrgyz","displayName":"Kyrgyz (User)","description":"Enables the editing language Kyrgyz","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kyrgyz_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_kyrgyz_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_lao","displayName":"Lao (User)","description":"Enables the editing language Lao","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_lao_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_lao_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_latin","displayName":"Latin (User)","description":"Enables the editing language Latin","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_latin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_latin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_latvian","displayName":"Latvian (User)","description":"Enables the editing language Latvian","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_latvian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_latvian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_lithuanian","displayName":"Lithuanian (User)","description":"Enables the editing language Lithuanian","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_lithuanian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_lithuanian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_lowersorbian","displayName":"Lower Sorbian (User)","description":"Enables the editing language Lower Sorbian","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_lowersorbian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_lowersorbian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_luxembourgishluxembourg","displayName":"Luxembourgish (Luxembourg) (User)","description":"Enables the editing language Luxembourgish (Luxembourg)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_luxembourgishluxembourg_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_luxembourgishluxembourg_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_macedonian","displayName":"Macedonian (User)","description":"Enables the editing language Macedonian","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_macedonian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_macedonian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_malayalam","displayName":"Malayalam (User)","description":"Enables the editing language Malayalam","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_malayalam_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_malayalam_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_malaybrunei","displayName":"Malay (Brunei) (User)","description":"Enables the editing language Malay (Brunei)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_malaybrunei_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_malaybrunei_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_malaymalaysia","displayName":"Malay (Malaysia) (User)","description":"Enables the editing language Malay (Malaysia)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_malaymalaysia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_malaymalaysia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_maltese","displayName":"Maltese (User)","description":"Enables the editing language Maltese","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_maltese_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_maltese_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_manipuri","displayName":"Manipuri (User)","description":"Enables the editing language Manipuri","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_manipuri_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_manipuri_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_maori","displayName":"Maori (User)","description":"Enables the editing language Maori","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_maori_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_maori_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_mapudungun","displayName":"Mapudungun (User)","description":"Enables the editing language Mapudungun","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_mapudungun_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_mapudungun_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_marathi","displayName":"Marathi (User)","description":"Enables the editing language Marathi","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_marathi_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_marathi_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_mohawk","displayName":"Mohawk (User)","description":"Enables the editing language Mohawk","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_mohawk_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_mohawk_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_mongoliancyrillic","displayName":"Mongolian (Cyrillic) (User)","description":"Enables the editing language Mongolian (Cyrillic)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_mongoliancyrillic_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_mongoliancyrillic_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_mongoliantraditionalmongolian","displayName":"Mongolian (Traditional Mongolian) (User)","description":"Enables the editing language Mongolian (Traditional Mongolian)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_mongoliantraditionalmongolian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_mongoliantraditionalmongolian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_nepaliindia","displayName":"Nepali (India) (User)","description":"Enables the editing language Nepali (India)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_nepaliindia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_nepaliindia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_nepalinepal","displayName":"Nepali (Nepal) (User)","description":"Enables the editing language Nepali (Nepal)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_nepalinepal_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_nepalinepal_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_norwegianbokml","displayName":"Norwegian (Bokmål) (User)","description":"Enables the editing language Norwegian (Bokm†l)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_norwegianbokml_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_norwegianbokml_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_norwegiannynorsk","displayName":"Norwegian (Nynorsk) (User)","description":"Enables the editing language Norwegian (Nynorsk)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_norwegiannynorsk_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_norwegiannynorsk_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_occitan","displayName":"Occitan (User)","description":"Enables the editing language Occitan","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_occitan_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_occitan_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_odia","displayName":"Odia (User)","description":"Enables the editing language Odia","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_odia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_odia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_oromo","displayName":"Oromo (User)","description":"Enables the editing language Oromo","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_oromo_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_oromo_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_papiamentu","displayName":"Papiamentu (User)","description":"Enables the editing language Papiamentu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_papiamentu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_papiamentu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_pashto","displayName":"Pashto (User)","description":"Enables the editing language Pashto","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_pashto_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_pashto_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_persian","displayName":"Persian (User)","description":"Enables the editing language Persian","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_persian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_persian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_polish","displayName":"Polish (User)","description":"Enables the editing language Polish","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_polish_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_polish_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_portuguesebrazil","displayName":"Portuguese (Brazil) (User)","description":"Enables the editing language Portuguese (Brazil)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_portuguesebrazil_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_portuguesebrazil_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_portugueseportugal","displayName":"Portuguese (Portugal) (User)","description":"Enables the editing language Portuguese (Portugal)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_portugueseportugal_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_portugueseportugal_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_punjabi","displayName":"Punjabi (User)","description":"Enables the editing language Punjabi","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_punjabi_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_punjabi_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_punjabipakistan","displayName":"Punjabi (Pakistan) (User)","description":"Enables the editing language Punjabi (Pakistan)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_punjabipakistan_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_punjabipakistan_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_quechuabolivia","displayName":"Quechua (Bolivia) (User)","description":"Enables the editing language Quechua (Bolivia)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_quechuabolivia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_quechuabolivia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_quechuaecuador","displayName":"Quechua (Ecuador) (User)","description":"Enables the editing language Quechua (Ecuador)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_quechuaecuador_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_quechuaecuador_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_quechuaperu","displayName":"Quechua (Peru) (User)","description":"Enables the editing language Quechua (Peru)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_quechuaperu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_quechuaperu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_romanianmoldova","displayName":"Romanian (Moldova) (User)","description":"Enables the editing language Romanian (Moldova)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_romanianmoldova_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_romanianmoldova_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_romanianromania","displayName":"Romanian (Romania) (User)","description":"Enables the editing language Romanian (Romania)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_romanianromania_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_romanianromania_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_romanshswitzerland","displayName":"Romansh (Switzerland) (User)","description":"Enables the editing language Romansh (Switzerland)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_romanshswitzerland_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_romanshswitzerland_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_russianmoldova","displayName":"Russian (Moldova) (User)","description":"Enables the editing language Russian (Moldova)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_russianmoldova_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_russianmoldova_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_russianrussia","displayName":"Russian (Russia) (User)","description":"Enables the editing language Russian (Russia)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_russianrussia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_russianrussia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sakha","displayName":"Sakha (User)","description":"Enables the editing language Sakha","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sakha_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sakha_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_samiinarifinland","displayName":"Sami, Inari (Finland) (User)","description":"Enables the editing language \"Sami, Inari (Finland)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_samiinarifinland_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_samiinarifinland_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_samilulenorway","displayName":"Sami, Lule (Norway) (User)","description":"Enables the editing language \"Sami, Lule (Norway)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_samilulenorway_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_samilulenorway_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_samilulesweden","displayName":"Sami, Lule (Sweden) (User)","description":"Enables the editing language \"Sami, Lule (Sweden)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_samilulesweden_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_samilulesweden_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_saminorthernfinland","displayName":"Sami, Northern (Finland) (User)","description":"Enables the editing language \"Sami, Northern (Finland)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_saminorthernfinland_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_saminorthernfinland_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_saminorthernnorway","displayName":"Sami, Northern (Norway) (User)","description":"Enables the editing language \"Sami, Northern (Norway)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_saminorthernnorway_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_saminorthernnorway_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_saminorthernsweden","displayName":"Sami, Northern (Sweden) (User)","description":"Enables the editing language \"Sami, Northern (Sweden)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_saminorthernsweden_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_saminorthernsweden_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_samiskoltfinland","displayName":"Sami, Skolt (Finland) (User)","description":"Enables the editing language \"Sami, Skolt (Finland)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_samiskoltfinland_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_samiskoltfinland_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_samisouthernnorway","displayName":"Sami, Southern (Norway) (User)","description":"Enables the editing language \"Sami, Southern (Norway)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_samisouthernnorway_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_samisouthernnorway_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_samisouthernsweden","displayName":"Sami, Southern (Sweden) (User)","description":"Enables the editing language \"Sami, Southern (Sweden)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_samisouthernsweden_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_samisouthernsweden_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sanskrit","displayName":"Sanskrit (User)","description":"Enables the editing language Sanskrit","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sanskrit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sanskrit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_scottishgaelicunitedkingdom","displayName":"Scottish Gaelic (United Kingdom) (User)","description":"Enables the editing language Scottish Gaelic (United Kingdom)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_scottishgaelicunitedkingdom_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_scottishgaelicunitedkingdom_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbiancyrillicbosniaandherzegovina","displayName":"Serbian (Cyrillic, Bosnia and Herzegovina) (User)","description":"Enables the editing language \"Serbian (Cyrillic, Bosnia and Herzegovina)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbiancyrillicbosniaandherzegovina_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbiancyrillicbosniaandherzegovina_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbiancyrillicmontenegro","displayName":"Serbian (Cyrillic, Montenegro) (User)","description":"Enables the editing language \"Serbian (Cyrillic, Montenegro)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbiancyrillicmontenegro_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbiancyrillicmontenegro_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbiancyrillicserbia","displayName":"Serbian (Cyrillic, Serbia) (User)","description":"Enables the editing language \"Serbian (Cyrillic, Serbia)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbiancyrillicserbia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbiancyrillicserbia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbiancyrillicserbiaandmontenegro","displayName":"Serbian (Cyrillic, Serbia and Montenegro (Former)) (User)","description":"Enables the editing language \"Serbian (Cyrillic, Serbia and Montenegro (Former))\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbiancyrillicserbiaandmontenegro_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbiancyrillicserbiaandmontenegro_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbianlatinbosniaandherzegovina","displayName":"Serbian (Latin, Bosnia and Herzegovina) (User)","description":"Enables the editing language \"Serbian (Latin, Bosnia and Herzegovina)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbianlatinbosniaandherzegovina_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbianlatinbosniaandherzegovina_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbianlatinmontenegro","displayName":"Serbian (Latin, Montenegro) (User)","description":"Enables the editing language \"Serbian (Latin, Montenegro)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbianlatinmontenegro_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbianlatinmontenegro_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbianlatinserbia","displayName":"Serbian (Latin, Serbia) (User)","description":"Enables the editing language \"Serbian (Latin, Serbia)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbianlatinserbia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbianlatinserbia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbianlatinserbiaandmontenegro","displayName":"Serbian (Latin, Serbia and Montenegro (Former)) (User)","description":"Enables the editing language \"Serbian (Latin, Serbia and Montenegro (Former))\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbianlatinserbiaandmontenegro_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_serbianlatinserbiaandmontenegro_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sesotho","displayName":"Sesotho (User)","description":"Enables the editing language Sesotho","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sesotho_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sesotho_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sesothosaleboa","displayName":"Sesotho sa Leboa (User)","description":"Enables the editing language Sesotho sa Leboa","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sesothosaleboa_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sesothosaleboa_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_setswana","displayName":"Setswana (User)","description":"Enables the editing language Setswana","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_setswana_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_setswana_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sindhiarabic","displayName":"Sindhi (Arabic) (User)","description":"Enables the editing language Sindhi (Arabic)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sindhiarabic_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sindhiarabic_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sindhidevanagari","displayName":"Sindhi (Devanagari) (User)","description":"Enables the editing language Sindhi (Devanagari)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sindhidevanagari_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sindhidevanagari_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sinhala","displayName":"Sinhala (User)","description":"Enables the editing language Sinhala","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sinhala_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_sinhala_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_slovak","displayName":"Slovak (User)","description":"Enables the editing language Slovak","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_slovak_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_slovak_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_slovenian","displayName":"Slovenian (User)","description":"Enables the editing language Slovenian","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_slovenian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_slovenian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_somali","displayName":"Somali (User)","description":"Enables the editing language Somali","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_somali_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_somali_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishargentina","displayName":"Spanish (Argentina) (User)","description":"Enables the editing language Spanish (Argentina)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishargentina_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishargentina_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishbolivia","displayName":"Spanish (Bolivia) (User)","description":"Enables the editing language Spanish (Bolivia)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishbolivia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishbolivia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishchile","displayName":"Spanish (Chile) (User)","description":"Enables the editing language Spanish (Chile)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishchile_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishchile_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishcolombia","displayName":"Spanish (Colombia) (User)","description":"Enables the editing language Spanish (Colombia)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishcolombia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishcolombia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishcostarica","displayName":"Spanish (Costa Rica) (User)","description":"Enables the editing language Spanish (Costa Rica)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishcostarica_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishcostarica_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishdominicanrepublic","displayName":"Spanish (Dominican Republic) (User)","description":"Enables the editing language Spanish (Dominican Republic)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishdominicanrepublic_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishdominicanrepublic_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishecuador","displayName":"Spanish (Ecuador) (User)","description":"Enables the editing language Spanish (Ecuador)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishecuador_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishecuador_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishelsalvador","displayName":"Spanish (El Salvador) (User)","description":"Enables the editing language Spanish (El Salvador)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishelsalvador_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishelsalvador_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishguatemala","displayName":"Spanish (Guatemala) (User)","description":"Enables the editing language Spanish (Guatemala)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishguatemala_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishguatemala_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishhonduras","displayName":"Spanish (Honduras) (User)","description":"Enables the editing language Spanish (Honduras)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishhonduras_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishhonduras_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishmexico","displayName":"Spanish (Mexico) (User)","description":"Enables the editing language Spanish (Mexico)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishmexico_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishmexico_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishnicaragua","displayName":"Spanish (Nicaragua) (User)","description":"Enables the editing language Spanish (Nicaragua)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishnicaragua_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishnicaragua_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishpanama","displayName":"Spanish (Panama) (User)","description":"Enables the editing language Spanish (Panama)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishpanama_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishpanama_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishparaguay","displayName":"Spanish (Paraguay) (User)","description":"Enables the editing language Spanish (Paraguay)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishparaguay_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishparaguay_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishperu","displayName":"Spanish (Peru) (User)","description":"Enables the editing language Spanish (Peru)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishperu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishperu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishpuertorico","displayName":"Spanish (Puerto Rico) (User)","description":"Enables the editing language Spanish (Puerto Rico)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishpuertorico_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishpuertorico_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishspain","displayName":"Spanish (Spain) (User)","description":"Enables the editing language Spanish (Spain)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishspain_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishspain_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishunitedstates","displayName":"Spanish (United States) (User)","description":"Enables the editing language Spanish (United States)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishunitedstates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishunitedstates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishuruguay","displayName":"Spanish (Uruguay) (User)","description":"Enables the editing language Spanish (Uruguay)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishuruguay_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishuruguay_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishvenezuela","displayName":"Spanish (Venezuela) (User)","description":"Enables the editing language Spanish (Venezuela)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishvenezuela_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_spanishvenezuela_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_swahili","displayName":"Swahili (User)","description":"Enables the editing language Swahili","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_swahili_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_swahili_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_swedishfinland","displayName":"Swedish (Finland) (User)","description":"Enables the editing language Swedish (Finland)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_swedishfinland_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_swedishfinland_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_swedishsweden","displayName":"Swedish (Sweden) (User)","description":"Enables the editing language Swedish (Sweden)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_swedishsweden_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_swedishsweden_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_syriac","displayName":"Syriac (User)","description":"Enables the editing language Syriac","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_syriac_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_syriac_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tajik","displayName":"Tajik (User)","description":"Enables the editing language Tajik","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tajik_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tajik_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tamazightarabicmorocco","displayName":"Tamazight (Arabic, Morocco) (User)","description":"Enables the editing language \"Tamazight (Arabic, Morocco)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tamazightarabicmorocco_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tamazightarabicmorocco_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tamazightlatinalgeria","displayName":"Tamazight (Latin, Algeria) (User)","description":"Enables the editing language \"Tamazight (Latin, Algeria)\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tamazightlatinalgeria_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tamazightlatinalgeria_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tamil","displayName":"Tamil (User)","description":"Enables the editing language Tamil","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tamil_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tamil_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tatar","displayName":"Tatar (User)","description":"Enables the editing language Tatar","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tatar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tatar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_telugu","displayName":"Telugu (User)","description":"Enables the editing language Telugu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_telugu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_telugu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_thai","displayName":"Thai (User)","description":"Enables the editing language Thai","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_thai_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_thai_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tibetanprc","displayName":"Tibetan (PRC) (User)","description":"Enables the editing language Tibetan (PRC)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tibetanprc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tibetanprc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tigrinyaeritrea","displayName":"Tigrinya (Eritrea) (User)","description":"Enables the editing language Tigrinya (Eritrea)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tigrinyaeritrea_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tigrinyaeritrea_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tigrinyaethiopia","displayName":"Tigrinya (Ethiopia) (User)","description":"Enables the editing language Tigrinya (Ethiopia)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tigrinyaethiopia_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_tigrinyaethiopia_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_turkish","displayName":"Turkish (User)","description":"Enables the editing language Turkish","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_turkish_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_turkish_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_turkmen","displayName":"Turkmen (User)","description":"Enables the editing language Turkmen","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_turkmen_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_turkmen_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_ukrainian","displayName":"Ukrainian (User)","description":"Enables the editing language Ukrainian","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_ukrainian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_ukrainian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_uppersorbian","displayName":"Upper Sorbian (User)","description":"Enables the editing language Upper Sorbian","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_uppersorbian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_uppersorbian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_urdu","displayName":"Urdu (User)","description":"Enables the editing language Urdu","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_urdu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_urdu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_uyghurprc","displayName":"Uyghur (PRC) (User)","description":"Enables the editing language Uyghur (PRC)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_uyghurprc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_uyghurprc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_uzbekcyrillic","displayName":"Uzbek (Cyrillic) (User)","description":"Enables the editing language Uzbek (Cyrillic)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_uzbekcyrillic_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_uzbekcyrillic_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_uzbeklatin","displayName":"Uzbek (Latin) (User)","description":"Enables the editing language Uzbek (Latin)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_uzbeklatin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_uzbeklatin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_valencian","displayName":"Valencian (User)","description":"Enables the editing language Valencian","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_valencian_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_valencian_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_venda","displayName":"Venda (User)","description":"Enables the editing language Venda","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_venda_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_venda_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_vietnamese","displayName":"Vietnamese (User)","description":"Enables the editing language Vietnamese","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_vietnamese_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_vietnamese_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_welsh","displayName":"Welsh (User)","description":"Enables the editing language Welsh","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_welsh_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_welsh_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_wolof","displayName":"Wolof (User)","description":"Enables the editing language Wolof","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_wolof_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_wolof_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_xitsonga","displayName":"Xitsonga (User)","description":"Enables the editing language Xitsonga","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_xitsonga_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_xitsonga_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_yiddish","displayName":"Yiddish (User)","description":"Enables the editing language Yiddish","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_yiddish_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_yiddish_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_yiprc","displayName":"Yi (PRC) (User)","description":"Enables the editing language Yi (PRC)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_yiprc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_yiprc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_yoruba","displayName":"Yoruba (User)","description":"Enables the editing language Yoruba","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_yoruba_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_editinglanguages~l_enablededitinglanguages_l_yoruba_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_other_l_disablecomingsoon","displayName":"Turn off Coming Soon (User)","description":"\r\n This policy setting controls whether Coming Soon is available to users. Coming Soon provides information in an Office app, such as Word or Excel, about upcoming feature changes to that app and lets users try out those changes ahead of time. By default, Coming Soon is available to users.\r\n\r\n If you enable this policy setting, Coming Soon is turned off and isn't available to users.\r\n\r\n If you disable or don't configure this policy setting, Coming Soon is available to users.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_other_l_disablecomingsoon_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_languagesettings~l_other_l_disablecomingsoon_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_activedirectorytimeoutforqueryingoneentryforgroupexpansion","displayName":"Active Directory timeout for querying one entry for group expansion (User)","description":"Specifies the timeout value for querying one Active Directory entry for group expansion.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_activedirectorytimeoutforqueryingoneentryforgroupexpansion_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_activedirectorytimeoutforqueryingoneentryforgroupexpansion_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_activedirectorytimeoutforqueryingoneentryforgroupexpansion_l_entertimeoutinseconds","displayName":"Enter timeout in seconds: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_additionalpermissionsrequesturl","displayName":"Additional permissions request URL (User)","description":"Specifies a location where a user can obtain more information about getting access to IRM content.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_additionalpermissionsrequesturl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_additionalpermissionsrequesturl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_additionalpermissionsrequesturl_l_checktospecifyacustomurloremailaddress","displayName":"Check to specify a custom URL or e-mail address (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_additionalpermissionsrequesturl_l_checktospecifyacustomurloremailaddress_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_additionalpermissionsrequesturl_l_checktospecifyacustomurloremailaddress_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_additionalpermissionsrequesturl_l_specifyurlemailaddress","displayName":"Specify URL/Email address: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_allowuserswithearlierversionsofofficetoreadwithbrowsers","displayName":"Allow users with earlier versions of Office to read with browsers... (User)","description":"This policy setting will allow users with earlier versions of Office to read documents with browsers supporting Information Rights Management.\r\n\r\nIf you enable this policy setting, users with earlier versions of Office can read documents with browsers supporting Information Rights Management. Note that this will make all documents with restricted permissions larger.\r\n\r\nIf you disable or do not configure this policy setting, users with earlier versions of Office cannot read documents with browsers supporting Information Rights Management.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_allowuserswithearlierversionsofofficetoreadwithbrowsers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_allowuserswithearlierversionsofofficetoreadwithbrowsers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_alwaysexpandgroupsinofficewhenrestrictingpermissionfordocume","displayName":"Always expand groups in Office when restricting permission for documents (User)","description":"This policy setting controls whether group names automatically expand to display all the members of the group when selected in the Permissions dialog box. \r\n\r\nIf you enable this policy setting, when users select a group name while applying Information Rights Management (IRM) permissions to Excel workbooks, InfoPath templates, Outlook e-mail messages, PowerPoint presentations, or Word documents in the Permissions dialog box, it will automatically expand to display all the members of the group. \r\n\r\nIf you disable or do not configure this policy setting, when users select a group name in the Permissions dialog box, the members of the group are not displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_alwaysexpandgroupsinofficewhenrestrictingpermissionfordocume_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_alwaysexpandgroupsinofficewhenrestrictingpermissionfordocume_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_alwaysrequireuserstoconnecttoverifypermission","displayName":"Always require users to connect to verify permission (User)","description":"This policy setting controls whether users are required to connect to the Internet or a local network to have their licenses confirmed every time they attempt to open Excel workbooks, InfoPath forms or templates, Outlook e-mail messages, PowerPoint presentations, or Word documents that are protected by Information Rights Management (IRM). This policy is useful if you want to log the usage of files with restricted permissions on the server.\r\n\r\nIf you enable this policy setting, users are required to connect to verify permissions. This policy setting will only affect protected files created on machines where the policy is enabled.\r\n\r\nIf you disable or do not configure this policy setting, users are not required to connect to the network to verify permissions.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_alwaysrequireuserstoconnecttoverifypermission_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_alwaysrequireuserstoconnecttoverifypermission_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_disableinformationrightsmanagementuserinterface","displayName":"Turn off Information Rights Management user interface (User)","description":"This policy setting controls Information Rights Management (IRM).\r\n\r\nIf you enable this policy setting, IRM will be turned off for users.\r\n\r\nIf you disable or do not configure this policy setting, users will be able to use IRM.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_disableinformationrightsmanagementuserinterface_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_disableinformationrightsmanagementuserinterface_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_neverallowuserstospecifygroupswhenrestrictingpermissionfordo","displayName":"Never allow users to specify groups when restricting permission for documents (User)","description":"This policy setting controls whether Office 2016 users can assign permissions to distribution lists when using Information Rights Management. \r\n\r\nIf you enable this policy setting, Office 2016 users cannot specify a distribution list as an authorized party in the Permission dialog box. \r\n\r\nIf you disable or do not configure this policy setting, Office 2016 users can specify distribution lists when using Information Rights Management (IRM) to restrict access to Excel workbooks, InfoPath templates, Outlook e-mail messages, PowerPoint presentations, or Word documents.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_neverallowuserstospecifygroupswhenrestrictingpermissionfordo_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_neverallowuserstospecifygroupswhenrestrictingpermissionfordo_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_preventusersfromchangingpermissions","displayName":"Prevent users from changing permissions on rights managed content (User)","description":"This policy setting controls whether Office 2016 users can change permissions for content that is protected with Information Rights Management (IRM). \r\n\r\nThe Information Rights Management feature of Office 2016 allows individuals and administrators to specify access permissions to Word documents, Excel workbooks, PowerPoint presentations, InfoPath templates and forms, and Outlook e-mail messages. This functionality helps prevent sensitive information from being printed, forwarded, or copied by unauthorized people. \r\n\r\nIf you enable this policy setting, users can open and edit documents for which they have the appropriate permissions, but they cannot create new rights-managed content, add IRM to existing documents, change existing IRM permissions, or remove IRM from documents. \r\n\r\nIf you disable or do not configure this policy setting, Office 2016 users can add, remove, or change IRM permissions for documents if they are authorized to do so.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_preventusersfromchangingpermissions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_preventusersfromchangingpermissions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_specifydefaultpermissionserver","displayName":"Specify Permission Policy Default Server for Quick Access Toolbar (User)","description":"This policy setting specifies the RMS server Office uses by default.\r\n\r\nIf you enable this policy setting, Office uses the server you specify as the default RMS server.\r\n\r\nIf you disable or do not configure this policy setting, Office chooses the default RMS server.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_specifydefaultpermissionserver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_specifydefaultpermissionserver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_specifydefaultpermissionserver_l_empty407","displayName":"\r\nEnter Permission Policy Default Server for Quick Access Toolbar\r\n","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_urlforlocationofdocumenttemplatespolicy","displayName":"URL for location of document templates displayed when applications do not recognize rights-managed documents (User)","description":"Provide the path to a folder with document, spreadsheet, and presentation files to be used as templates for a unencrypted wrapper for files with rights-managed content received by users with older versions of Office. Office includes plain-text wrapper documents that notify users about a rights-managed document in certain circumstances. If the user's application cannot recognize a document that includes rights-management, the user receives the wrapper document with information such as instructions for downloading a Rights Management Add-on for Windows Internet Explorer. You can provide a folder with customized templates for Office to use for these plain-text wrappers by using this setting to specify a URL to a folder.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_urlforlocationofdocumenttemplatespolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_urlforlocationofdocumenttemplatespolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_managerestrictedpermissions_l_urlforlocationofdocumenttemplatespolicy_l_enteraurl","displayName":"Enter a URL (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_microsoftofficedocumentcache_l_checkouttolocaldisk","displayName":"Check-out to local disk (User)","description":"This policy turns on the check-out to local disk feature.\r\n\r\nIf you enable this policy setting, documents that are checked-out will be stored in the Local Drafts folder on the local disk.\r\n\r\nIf you disable or do not configure this policy setting, documents that are checked out will be checked-out on SharePoint and no local copy will be created.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_microsoftofficedocumentcache_l_checkouttolocaldisk_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_microsoftofficedocumentcache_l_checkouttolocaldisk_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_microsoftofficedocumentcache_l_deletefilesfromofficedocumentcache","displayName":"Delete files from Office Document Cache (User)","description":"This policy setting determines whether or not documents opened in Office are deleted from the Office Document Cache when they are closed.\r\n\r\nIf you enable this policy setting documents are deleted from the Office Document Cache when they are closed. \r\n\r\nIf you disable or do not configure this policy setting, documents are not deleted from the Office Document Cache when they are closed.\r\n\r\nNote: This policy setting does not apply to documents in SharePoint Workspace. Documents in SharePoint Workspace will not be deleted from the Office Document cache when they are closed. Sharepoint Workspace will not work correctly if this Group Policy is enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_microsoftofficedocumentcache_l_deletefilesfromofficedocumentcache_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_microsoftofficedocumentcache_l_deletefilesfromofficedocumentcache_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_microsoftofficedocumentcache_l_enablecheckouttodrafts","displayName":"Save checked-out files to a local folder (User)","description":"This policy setting allows users to save files checked out from SharePoint, or other document management server products, to a local folder when editing the files. \r\n\r\nBy default, checked-out files are stored in the Office Document Cache. The Office Document Cache allows the same offline editing capabilities as a local folder, but automatically syncs the files when there is Internet connectivity.\r\n\r\nNote: It’s not recommended to enable this policy setting unless needed to support existing document management processes.\r\n\r\nIf you enable this policy setting, users can specify a local folder to save checked-out files to by going to File > Options > Save > Offline editing options.\r\n\r\nIf you disable or don’t configure this policy setting, checked-out files are stored in the Office Document Cache.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_microsoftofficedocumentcache_l_enablecheckouttodrafts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_microsoftofficedocumentcache_l_enablecheckouttodrafts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_microsoftofficedocumentcache_l_officedocumentcachelocation","displayName":"Office document cache location (User)","description":"This policy setting determines the location where Office maintains the Office Document Cache.\r\n\r\nIf you enable this policy setting, you can specify the location where Office maintains the Office Document Cache.\r\n\r\nIf you disable or do not configure this policy setting, the Office Document Cache will be stored in the following location: %LocalAppData%\\Microsoft\\Office\\16.0\\OfficeFileCache","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_microsoftofficedocumentcache_l_officedocumentcachelocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_microsoftofficedocumentcache_l_officedocumentcachelocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_microsoftofficedocumentcache_l_officedocumentcachelocation_l_officedocumentcachelocationid","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_microsoftofficedocumentcache_l_opendocumentsfromofficedocumentcachefirst","displayName":"Open documents from Office Document Cache first (User)","description":"This policy setting allows the client application to open a document directly from the Office Document Cache if it is aware that the server the document resides on is not reachable. It may be useful in situations where you would like to wait to contact the server every time, time out and then fallback to the cache. \r\n\r\nIf you enable or do not configure this policy setting, documents will be opened directly from the Office Document Cache when the server the document resides on is not reachable. \r\n\r\nIf you disable this policy setting, Office will always attempt to first reach the server the document resides on before opening it from the Office Document Cache.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_microsoftofficedocumentcache_l_opendocumentsfromofficedocumentcachefirst_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_microsoftofficedocumentcache_l_opendocumentsfromofficedocumentcachefirst_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_allowlinkedinfeatures","displayName":"Show LinkedIn features in Office applications (User)","description":"This policy setting will prevent LinkedIn features from appearing in the Office applications.\r\n\r\nIf you enable or do not configure this policy, users will be able to leverage LinkedIn data and resources from a variety of locations within the Office applications.\r\n\r\nIf you disable this policy setting, LinkedIn features will not be available.\r\n\r\nImportant: This policy setting only applies to Office 365 clients that are installed by using Click-to-Run, including Office 365 ProPlus, Office 365 Business, Visio Pro for Office 365 and Project Pro for Office 365. It doesn't apply to Office products that use Windows Installer (MSI).\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_allowlinkedinfeatures_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_allowlinkedinfeatures_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_alwaysshowfilesharemoreoptions","displayName":"Show additional sharing choices under the File tab (User)","description":"This policy settings controls what is displayed when the user goes to File > Share in Word, Excel, or PowerPoint.\r\n\r\nBy default, choosing File > Share takes the user to the Share dialog, which provides various choices for sharing. These choices used to appear under File > Share, but no longer appear there by default. There are some additional choices that used to appear under File > Share, but don’t appear in the Share dialog.\r\n\r\nIf you enable this policy setting, the user isn’t taken to the Share dialog and the user sees all the sharing choices under File > Share. For example, several options to share by email or an option to share by instant message.\r\n\r\nIf you disable or don’t configure this policy setting, choosing File > Share takes the user to the Share dialog, which doesn’t have all the sharing choices.\r\n\r\nNote: The user can also add buttons for these additional sharing choices to the ribbon or to the quick access toolbar, regardless of how this policy setting is configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_alwaysshowfilesharemoreoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_alwaysshowfilesharemoreoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_changedestinationurlforsharepointhyperlink","displayName":"Change destination URL for SharePoint hyperlink (User)","description":"This policy setting changes the destination URL of the Learn more about SharePoint hyperlink located on the Save to SharePoint form in the Backstage view for Word, PowerPoint, Excel, Visio, and Project.\r\n\r\nIf you enable this policy setting, the hyperlink destination you provide will be used.\r\n\r\nIf you disable or do not configure this policy setting, then the default destination URL to Learn more about SharePoint will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_changedestinationurlforsharepointhyperlink_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_changedestinationurlforsharepointhyperlink_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_changedestinationurlforsharepointhyperlink_l_changedestinationurlforsharepointhyperlinkid","displayName":"Destination URL (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_changelabelofsavetosharepoint","displayName":"SharePoint Product Name (User)","description":"This policy setting allows you to customize the label that is used for your company's SharePoint deployment. This will update the label that is used in the Open and Save As places in all Office applications.\r\n\r\nYou can use this option to make it more clear to users where they should be saving company documents.\r\n\r\nIf you enable this policy setting, the new string you provide will be used to refer to your company's SharePoint deployment. We recommend setting this to the name of your company.\r\n\r\nIf you disable or do not configure this policy setting then the default string, \"SharePoint,\" will be displayed in the Open and Save As UI in all Office applications.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_changelabelofsavetosharepoint_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_changelabelofsavetosharepoint_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_changelabelofsavetosharepoint_l_changelabelofsavetosharepointid","displayName":"Custom string to be displayed: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_controlblogging","displayName":"Control Blogging (User)","description":"This policy setting controls whether users can compose and post blog entries from Word.\r\n\r\nIf you enable this policy setting, you can choose from three options for controlling blogging: \r\n\r\n* Enabled - Users may compose and post blog entries from Word to any available blog provider. This is the default configuration in Word. \r\n\r\n* Only SharePoint blogs allowed - Users can only post blog entries to SharePoint sites. \r\n\r\n* Disabled - The blogging feature in Word is disabled entirely. \r\n\r\nIf you disable or do not configure this policy setting, the behavior is the equivalent of setting the policy to Enabled-Enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_controlblogging_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_controlblogging_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_controlblogging_l_empty503","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_controlblogging_l_empty503_0","displayName":"Enabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_controlblogging_l_empty503_1","displayName":"Only SharePoint blogs allowed","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_controlblogging_l_empty503_2","displayName":"All blogging disabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disableanimations","displayName":"Disable Office animations (User)","description":"This setting will disable all unnecessary Office animations. By default, animation effects, such as fading between views, are enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disableanimations_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disableanimations_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disablebackgrounds","displayName":"Disable Office Backgrounds (User)","description":"This policy setting turns on and off the ability of users to select an Office background.\r\n\r\nIf you enable this policy setting, users won’t see the Office Backgrounds setting in either the Account place or the Options dialog. They also won’t have an Office Background applied to the upper right of their Office applications.\r\n\r\nIf you disable or don’t configure this policy setting, users will see the Office Backgrounds setting in the Account place and in the Options dialog, and they will have an Office Background applied to the upper right of their Office applications.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disablebackgrounds_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disablebackgrounds_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disableclipboardtoolbartriggers","displayName":"Disable Clipboard Toolbar triggers (User)","description":"Checked: Prevents the Office Clipboard from automatically appearing when multiple Copy commands are performed in any of the Office programs. | Unchecked: Permits the Office Clipboard to appear automatically when multiple Copy commands are performed in Office programs.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disableclipboardtoolbartriggers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disableclipboardtoolbartriggers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disablelinksopenright","displayName":"Open Office file links in Office Online (User)","description":"\r\n This policy setting controls which version of Office opens when a hyperlink to an Office file stored on OneDrive, OneDrive for Business, or a SharePoint Online team site is selected.\r\n\r\n By default, a hyperlink to a file stored in one of these locations opens the file in the Office client version of Word, Excel, or PowerPoint. This is the version of Office that is installed on the user’s computer. If Office isn’t installed on the user’s computer, the file is opened in the Office Online version of the program in the user’s web browser.\r\n\r\n If you enable this policy setting, a hyperlink to an Office file stored in one of these locations opens the file in the Office Online version of Word, Excel, or PowerPoint. This opens the file in the user’s web browser.\r\n\r\n If you disable or don’t configure this policy setting, a hyperlink to an Office file stored in one of these locations opens the file in the Office client version of Word, Excel, or PowerPoint, if Office is installed on the user’s computer.\r\n\r\n Note: This policy setting only applies to subscription versions of the Office client, such as Office 365 ProPlus.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disablelinksopenright_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disablelinksopenright_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disableofficestartglobal","displayName":"Disable the Office Start screen for all Office applications (User)","description":"This policy setting controls whether the Office Start screen appears on boot for all Office applications.\r\n\r\nIf you enable this policy setting, users will not see the Office Start screen when they boot any Office application.\r\n\r\nIf you disable or do not configure this policy setting, users will see the Office Start screen when they boot their Office applications.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disableofficestartglobal_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disableofficestartglobal_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disablescreenshotautohyperlink","displayName":"Do not automatically hyperlink screenshots (User)","description":"This policy setting allows you to specify whether or not Word, PowerPoint, Excel or Outlook automatically binds hyperlink to a screenshot inserted through the Insert Screenshot tool, if the screenshot is of an Internet Explorer browser window.\r\n\r\nIf you enable this policy setting, Word, PowerPoint, Excel and Outlook does not automatically bind hyperlinks to screenshot of Internet Explorer browser windows.\r\n\r\nIf you disable or do not configure this policy setting, Word, PowerPoint, Excel and Outlook automatically binds a hyperlink to screenshots of Internet Explorer browser windows.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disablescreenshotautohyperlink_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disablescreenshotautohyperlink_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disablewebviewintheofficefiledialogs","displayName":"Disable web view in the Office file dialog boxes (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disablewebviewintheofficefiledialogs_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disablewebviewintheofficefiledialogs_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disalowconvertdocumentpolicy","displayName":"Disallow Convert Document (Excel, PowerPoint, Word) (User)","description":"Disallow users to convert files that are in compatibility mode via the \"Convert\" command for Excel, PowerPoint, and Word.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disalowconvertdocumentpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_disalowconvertdocumentpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_donotdisplaypathsinalerts","displayName":"Do not display paths in alerts (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_donotdisplaypathsinalerts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_donotdisplaypathsinalerts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_donotemulatetabswithspaceswhenexportinghtml","displayName":"Emulate tabs with spaces when exporting HTML (User)","description":"Enabled: Tabs are emulated by replacing them with spaces when exporting HTML. | Disabled: Tab characters are not replaced with spaces when exporting HTML format.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_donotemulatetabswithspaceswhenexportinghtml_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_donotemulatetabswithspaceswhenexportinghtml_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_donottrackdocumenteditingtime","displayName":"Do not track document editing time (User)","description":"Checked: Do not calculate the total editing time while a document is open. | Unchecked: Track the editing time while a document is open.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_donottrackdocumenteditingtime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_donottrackdocumenteditingtime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_donotuploadmediafiles","displayName":"Do not upload media files (User)","description":"Disables/Enables uploading of media files.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_donotuploadmediafiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_donotuploadmediafiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_donotusehardwareacceleration","displayName":"Do not use hardware graphics acceleration (User)","description":"This policy setting allows you to not use hardware graphics acceleration.\r\n\r\nIf you enable this policy setting, hardware graphics acceleration will not be used.\r\n\r\nIf you disable or do not configure this policy setting hardware graphics acceleration may be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_donotusehardwareacceleration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_donotusehardwareacceleration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_donotvalidateprintersbeforeusingthem","displayName":"Do not validate printers before using them (User)","description":"This policy setting allows you to determine whether Word, PowerPoint, or Excel validates its connection with a printer before attempting to use it in the Print tab in Backstage View.\r\n\r\nIf you enable this policy setting, Word, PowerPoint, and Excel do not validate printers before using them. If invalid data is returned from the printer, then Word, PowerPoint, and Excel still attempt to use the data, which can result in the application failing.\r\n\r\nIf you disable or do not configure this policy setting, Word, PowerPoint, and Excel validate printers before using them in the Print tab in Backstage View. If validation fails, the printer is disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_donotvalidateprintersbeforeusingthem_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_donotvalidateprintersbeforeusingthem_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_enableworkflowsonmysite","displayName":"Enable Workflows on My Site (User)","description":"Allows workflows on My Site to be started from within the workflow enabled Office applications.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_enableworkflowsonmysite_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_enableworkflowsonmysite_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_freezedry","displayName":"Enable Smart Resume (User)","description":"If Outlook, Word, Excel, or PowerPoint shuts down unexpectedly and is restarted automatically (for example, by Document Recovery), the user is returned to a visual state similar to the state at shutdown. By default, this setting is enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_freezedry_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_freezedry_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_graphicfilterlegacymode","displayName":"Graphic filter legacy mode (User)","description":"Controls code path used by legacy GIF/PNG/JPEG filters. The default is to use the GDI+ codecs for these image types. For a compatibility mode to previous versions of Office which will use the legacy filter code, enable this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_graphicfilterlegacymode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_graphicfilterlegacymode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_hidethelearnmoreaboutsharepointhyperlink","displayName":"Hide the Learn more about SharePoint Hyperlink (User)","description":"This policy setting allows you to remove the Learn more about SharePoint hyperlink from the Save to SharePoint form in the Backstage view for Word, PowerPoint, Excel, Visio, and Project.\r\n\r\nIf you enable this policy setting, the hyperlink will not be displayed.\r\n\r\nIf you disable or do not configure this policy setting, the hyperlink will appear for the Save to SharePoint form in the Backstage view when there are no locations listed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_hidethelearnmoreaboutsharepointhyperlink_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_hidethelearnmoreaboutsharepointhyperlink_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_homeworkflowlibrary","displayName":"Home Workflow Library (User)","description":"Allows administrators to make workflows from a specified list or library available within the workflow enabled Office applications. The value of this key should be the URL to the list or library where the workflows have been made available.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_homeworkflowlibrary_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_homeworkflowlibrary_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_homeworkflowlibrary_l_path2504","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_increasevisibilityofaccessibilitycheckerviolations","displayName":"Increase the visibility of Accessibility Checker violations (User)","description":"This policy setting controls whether a document, workbook, or spreadsheet with accessibility errors will cause a loud warning or error slab in the user interface.\r\n\r\nIf you enable this policy setting, you may specify what happens when a document, workbook, or spreadsheet has accessibility errors:\r\n\r\n- Accessibility violations do not change Prepare for Distribution loudness (default)\r\n- Accessibility errors cause the Prepare for Distribution slab to be loud\r\n- Accessibility errors or warnings cause the Prepare for Distribution slab to be loud\r\n\r\nIf you disable or do not configure this policy setting, the Accessibility Checker UI will be presented in its normal state.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_increasevisibilityofaccessibilitycheckerviolations_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_increasevisibilityofaccessibilitycheckerviolations_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_increasevisibilityofaccessibilitycheckerviolations_l_increasevisibilityofaccessibilitycheckerviolationsdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_increasevisibilityofaccessibilitycheckerviolations_l_increasevisibilityofaccessibilitycheckerviolationsdropid_0","displayName":"Accessibility violations do not change loudness (default)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_increasevisibilityofaccessibilitycheckerviolations_l_increasevisibilityofaccessibilitycheckerviolationsdropid_1","displayName":"Accessibility errors cause slab to be loud","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_increasevisibilityofaccessibilitycheckerviolations_l_increasevisibilityofaccessibilitycheckerviolationsdropid_2","displayName":"Accessibility errors or warnings cause slab to be loud","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_iscustomaddintabdefaultbackstageplace","displayName":"Take users to a custom File menu tab (User)","description":"\r\nThis policy setting controls whether users are taken to a custom menu tab when they choose the File menu in an Office app, such as Word or PowerPoint. A custom menu tab can be provided by an installed add-in.\r\n\r\nBy default, when users choose the File menu, they are taken to one of the File menu tabs provided by Office, such as Home or Info.\r\n\r\nIf you enable this policy setting, and an installed add-in provides a custom File menu tab, users will be taken to that custom tab when they choose the File menu.\r\n\r\nIf you disable or don’t configure this policy setting, when users choose the File menu, users will be taken to one of the File menu tabs provided by Office, such as Home or Info.\r\n\r\nNote: This policy setting only applies to Office clients, such as Office 365 ProPlus, that come with an Office 365 plan.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_iscustomaddintabdefaultbackstageplace_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_iscustomaddintabdefaultbackstageplace_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_iscustomtabdefaultinnewplace","displayName":"Show the Custom tab as the default tab when creating a new file (User)","description":"\r\nThis policy settings controls whether the Custom tab shows as the default tab under File > New in Word, Excel, and PowerPoint.\r\n\r\nThe Custom tab shows the custom templates that are available. If there aren’t any custom templates, the Custom tab can’t be shown.\r\n\r\nIf you enable this policy setting, users will see the Custom tab as the default tab when creating a new file by going to File > New.\r\n\r\nIf you disable or don’t configure this policy setting, users will see the Featured tab as the default tab when creating a new file by going to File > New, unless access to Office-provided templates has been disabled.\r\n\r\nNote: This policy setting only applies to Office clients, such as Office 365 ProPlus, that come with an Office 365 plan.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_iscustomtabdefaultinnewplace_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_iscustomtabdefaultinnewplace_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_microsoftofficeshareddrawingcode","displayName":"Disable Microsoft Office shared drawing code for blip caching (User)","description":"Disables blip (an image representation) caching in the shared drawing code GEL. Caching can speed up certain operations. Disabling blip caching can be used to prevent caching during file open operations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_microsoftofficeshareddrawingcode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_microsoftofficeshareddrawingcode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_microsoftofficeshareddrawingcodeformeta","displayName":"Disable Microsoft Office shared drawing code for metafile rendering (User)","description":"Disables nearly all EMF's and WMF's will no longer be converted at runtime to be anti-aliased. Examples of EMF/WMF's that would remain \"aliased\" are: clipart, OLE object placeholders, any user inserted EMF/WMF image, etc. Any EMF/WMF containing text would be an exception to this and would be still getting anti-aliased.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_microsoftofficeshareddrawingcodeformeta_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_microsoftofficeshareddrawingcodeformeta_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_mrutemplatelistlength","displayName":"Most Recently Used Template List Length (User)","description":"This setting determines the length of the recently used templates list in the New Document dialog box. The maximum value is 25 and the minimum value is 0. This setting applies to Word, Powerpoint, and Excel.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_mrutemplatelistlength_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_mrutemplatelistlength_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_mrutemplatelistlength_l_mrutemplatelistlength505","displayName":"Most Recently Used Template List Length (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_onlinestoragefilter","displayName":"Hide file locations when opening or saving files (User)","description":"\r\nThis policy setting allows you to hide specific file locations when the user opens or saves a file. This helps prevent users from using either the local PC, SharePointServer, or Microsoft Office 365 cloud-based file locations such as OneDrive or SharePoint Online, to open, save, or share files.\r\n\r\nNote: This policy setting only applies to Word, PowerPoint, and Excel.\r\n\r\nIf you enable this policy setting, you can specify which file locations are hidden when the user opens or saves a file.\r\n\r\nIf you disable or don’t configure this policy setting, users can use the local PC, SharePoint Server or any configured Microsoft cloud-based file location to open, save, and share files.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_onlinestoragefilter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_onlinestoragefilter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_onlinestoragefilter_l_onlinestoragefilterid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_onlinestoragefilter_l_onlinestoragefilterid_1","displayName":"Hide OneDrive Personal","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_onlinestoragefilter_l_onlinestoragefilterid_2","displayName":"Hide SharePoint Online and OneDrive for Business","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_onlinestoragefilter_l_onlinestoragefilterid_3","displayName":"Hide OneDrive Personal, SharePoint Online and OneDrive for Business","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_onlinestoragefilter_l_onlinestoragefilterid_4","displayName":"Hide Local PC","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_onlinestoragefilter_l_onlinestoragefilterid_8","displayName":"Hide SharePoint Server","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_printticketsafemode","displayName":"Print ticket safe mode (User)","description":"This policy setting allows you to determine whether Word, PowerPoint, or Excel turns off print ticket features the next time it attempts to use print ticket features after the application fails. Print ticket features include duplexing and stapling.\r\n\r\nIf you enable or do not configure this policy setting, print ticket features are turned off if Word, PowerPoint, and Excel fail while attempting to use a printer's print ticket functionality. When the printer is next used, its print ticket features are turned off until the user requests to use them again.\r\n\r\nIf you disable this policy setting, Word, PowerPoint, or Excel does not turn off print ticket features due to a previous application failure. This might result in repeated instances of the printer not responding.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_printticketsafemode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_printticketsafemode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_providefeedbackwithsound","displayName":"Provide feedback with sound (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_providefeedbackwithsound_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_providefeedbackwithsound_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_showpasteoptionsbuttons","displayName":"Show Paste Options button when content is pasted (User)","description":"This policy setting configures the Paste Options button.\r\n\r\nIf you enable this policy setting, the Paste Options button is displayed after content is pasted.\r\n\r\nIf you disable or do not configure this policy setting, the Paste Options button is not displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_showpasteoptionsbuttons_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_showpasteoptionsbuttons_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_showscreentips","displayName":"Show Screen Tips (User)","description":"This policy setting allows you to determine whether Office applications display screen tips when users hover on commands on the Office Ribbon, and whether the screen tips display feature names and descriptions, or just feature names. \r\n\r\nIf you enable this policy setting, you can select any of the following options:\r\n- Show feature descriptions: Both feature names and descriptions appear when users hover over commands on the Ribbon. \r\n- Don't show feature descriptions: Only feature names appear when users hover over commands on the Ribbon. \r\n- Don't show screen tips: Nothing appears when users hover over commands on the Ribbon.\r\n\r\nIf you disable this policy setting, nothing appears when users hover over commands on the Office Ribbon.\r\n\r\nIf you do not configure this policy setting, both feature names and descriptions appear when users hover over commands on the Office Ribbon.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_showscreentips_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_showscreentips_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_showscreentips_l_showscreentipsdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_showscreentips_l_showscreentipsdropid_0","displayName":"Show feature descriptions","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_showscreentips_l_showscreentipsdropid_1","displayName":"Don't show feature descriptions","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_showscreentips_l_showscreentipsdropid_2","displayName":"Don't show screentips","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_showskydrivesignin","displayName":"Show OneDrive Sign In (User)","description":"Prompt user to sign in to OneDrive while performing a file save operation.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_showskydrivesignin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_showskydrivesignin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_signinoptions","displayName":"Block signing into Office (User)","description":"This policy setting controls whether users can provide credentials to Office using either their Microsoft Account or the user ID assigned by your organization for accessing Office 365.\r\nIf you enable this policy setting, you can specify one of the following options:\r\n\r\n- If you select \"Both IDs allowed\", users can sign in and access Office content by using either ID\r\n- If you select \"Microsoft Account only\", users can sign in only by using their Microsoft Account.\r\n- If you select \"Organization only\", users can sign in only by using the user ID assigned by your organization for accessing Office 365.\r\n- If you select \"None allowed\", users cannot sign in by using either ID.\r\n\r\nIf you disable or do not configure this policy setting, users can sign in by using either ID.\r\n\r\nNote: This policy does not apply to licensing. A user can license their product using any applicable ID if they have a valid license associated with that account. Providing credentials for licensing purposes when that ID type has been disabled, however, will not affect the signed in state of Office.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_signinoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_signinoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_signinoptions_l_signinoptions5","displayName":"Block signing into Office (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_signinoptions_l_signinoptions5_0","displayName":"Both IDs allowed","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_signinoptions_l_signinoptions5_1","displayName":"Microsoft Account only","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_signinoptions_l_signinoptions5_2","displayName":"Org ID only","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_signinoptions_l_signinoptions5_3","displayName":"None allowed","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_suppressrecommendedsettingsdialog","displayName":"Suppress recommended settings dialog (User)","description":"This policy setting controls the Recommended Settings dialog on first run of Office.\r\n\r\nIf you enable this policy setting, the recommended settings dialog will not be displayed on first run of Office.\r\n\r\nIf you disable or do not configure this policy setting, the recommended settings will provide choices to the user to opt into services such as such as Microsoft Update, new software notifications, Customer Experience Improvement Program, Office Diagnostics (Automatically receive small updates to improve reliability) Online Help (Online content options) and Online Search Relevancy that will help improve their Office experience.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_suppressrecommendedsettingsdialog_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_suppressrecommendedsettingsdialog_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_uselegacytranslationfeatures","displayName":"Use legacy translation features (User)","description":"\r\nThis policy setting allows you to use legacy translation features in Office apps, such as Word, instead of the Translator feature, which uses the cloud-based Microsoft Translator service.\r\n\r\nLegacy translation features include the following:\r\n- Translation of the entire document, by using the browser-based Bilingual Viewer.\r\n- Translation of selected text, by using the Research pane.\r\n- Translation of an individual word when hovering over the word, by using the Mini Translator.\r\n\r\nYou may need to use legacy translation features in special cases that require extra configurability, such as when using customer translation providers.\r\n\r\nIf you enable this policy setting, translation commands, such as those on the ribbon or in shortcut menus, will use the legacy translation features instead of the Translator feature.\r\n\r\nIf you disable or don’t configure this policy setting, translation commands, such as those on the ribbon or in shortcut menus, will use the Translator feature instead of the legacy translation features.\r\n\r\nNote: This policy setting only applies to apps and subscription versions of Office, such as Office 365 ProPlus, that support the Translator feature.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_uselegacytranslationfeatures_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_uselegacytranslationfeatures_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_uselocaluserinfo","displayName":"Use local user name and initials values regardless of signed-in user (User)","description":"This policy setting controls whether Office uses the user name and initials of the user currently signed-in, or the user name and initials that are specified in the Options dialog box.\r\n\r\nIf you enable this policy setting, regardless of any user currently signed-in, Office uses the user name and initials specified in the Options dialog box.\r\n\r\nIf you disable or do not configure this policy setting, Office uses the user name and initials from the information provided by the user that is currently signed-in.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_uselocaluserinfo_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_uselocaluserinfo_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_usesystemfontinsteadoftahoma","displayName":"Use system font instead of the Office default UI font (User)","description":"Use the system font instead of the Office default UI font. | Unchecked: Use the Office default UI font.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_usesystemfontinsteadoftahoma_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_usesystemfontinsteadoftahoma_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_webfoldersmanagingpairsofwebpagesandfolders","displayName":"Web Folders: Managing pairs of Web pages and folders (User)","description":"Specifies how a Web page and folder pair is to be displayed and managed by Windows.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_webfoldersmanagingpairsofwebpagesandfolders_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_webfoldersmanagingpairsofwebpagesandfolders_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_webfoldersmanagingpairsofwebpagesandfolders_l_webfoldersmanagingpairsofwebpagesandfolders506","displayName":"Web Folders: Managing pairs of Web pages and folders (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_webfoldersmanagingpairsofwebpagesandfolders_l_webfoldersmanagingpairsofwebpagesandfolders506_0","displayName":"Show and manage the pair as a single file","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_webfoldersmanagingpairsofwebpagesandfolders_l_webfoldersmanagingpairsofwebpagesandfolders506_2","displayName":"Show both parts and manage them individually","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437_l_webfoldersmanagingpairsofwebpagesandfolders_l_webfoldersmanagingpairsofwebpagesandfolders506_1","displayName":"Show both parts but manage as a single file","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache1","displayName":"Workflow Cache 1 (User)","description":"The values entered will be used by the client to provide the user with a workflow to be made available to the user for all of their documents. The url should be a full path, such as 'http://localsharepointsite/Shared%20Documents'. Some workflows require that the user sign a document with an in-document signature, workflows indicated as such will only be shown the the user as an option in applications that support in-document signatures. \r\n\r\nThis workflow must also be made available on the document library (setting these values only lets the client know about the workflow).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache1_l_workflowcachename","displayName":"Name of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache1_l_workflowdescrip","displayName":"Description of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache1_l_workflowfriendly","displayName":"Name of the document library to be shown the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache1_l_workflowpath","displayName":"Full URL to the document library with which the workflow is associated (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache1_l_workflowsig","displayName":"Workflow requires the user to sign the document (Word/Excel only) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache1_l_workflowsig_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache1_l_workflowsig_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache10","displayName":"Workflow Cache 10 (User)","description":"The values entered will be used by the client to provide the user with a workflow to be made available to the user for all of their documents. The url should be a full path, such as 'http://localsharepointsite/Shared%20Documents'. Some workflows require that the user sign a document with an in-document signature, workflows indicated as such will only be shown the the user as an option in applications that support in-document signatures. \r\n\r\nThis workflow must also be made available on the document library (setting these values only lets the client know about the workflow).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache10_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache10_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache10_l_workflowcachename473","displayName":"Name of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache10_l_workflowdescrip475","displayName":"Description of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache10_l_workflowfriendly476","displayName":"Name of the document library to be shown the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache10_l_workflowpath474","displayName":"Full URL to the document library with which the workflow is associated (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache10_l_workflowsig477","displayName":"Workflow requires the user to sign the document (Word/Excel only) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache10_l_workflowsig477_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache10_l_workflowsig477_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache11","displayName":"Workflow Cache 11 (User)","description":"The values entered will be used by the client to provide the user with a workflow to be made available to the user for all of their documents. The url should be a full path, such as 'http://localsharepointsite/Shared%20Documents'. Some workflows require that the user sign a document with an in-document signature, workflows indicated as such will only be shown the the user as an option in applications that support in-document signatures. \r\n\r\nThis workflow must also be made available on the document library (setting these values only lets the client know about the workflow).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache11_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache11_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache11_l_workflowcachename478","displayName":"Name of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache11_l_workflowdescrip480","displayName":"Description of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache11_l_workflowfriendly481","displayName":"Name of the document library to be shown the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache11_l_workflowpath479","displayName":"Full URL to the document library with which the workflow is associated (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache11_l_workflowsig482","displayName":"Workflow requires the user to sign the document (Word/Excel only) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache11_l_workflowsig482_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache11_l_workflowsig482_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache12","displayName":"Workflow Cache 12 (User)","description":"The values entered will be used by the client to provide the user with a workflow to be made available to the user for all of their documents. The url should be a full path, such as 'http://localsharepointsite/Shared%20Documents'. Some workflows require that the user sign a document with an in-document signature, workflows indicated as such will only be shown the the user as an option in applications that support in-document signatures. \r\n\r\nThis workflow must also be made available on the document library (setting these values only lets the client know about the workflow).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache12_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache12_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache12_l_workflowcachename483","displayName":"Name of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache12_l_workflowdescrip485","displayName":"Description of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache12_l_workflowfriendly486","displayName":"Name of the document library to be shown the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache12_l_workflowpath484","displayName":"Full URL to the document library with which the workflow is associated (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache12_l_workflowsig487","displayName":"Workflow requires the user to sign the document (Word/Excel only) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache12_l_workflowsig487_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache12_l_workflowsig487_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache13","displayName":"Workflow Cache 13 (User)","description":"The values entered will be used by the client to provide the user with a workflow to be made available to the user for all of their documents. The url should be a full path, such as 'http://localsharepointsite/Shared%20Documents'. Some workflows require that the user sign a document with an in-document signature, workflows indicated as such will only be shown the the user as an option in applications that support in-document signatures. \r\n\r\nThis workflow must also be made available on the document library (setting these values only lets the client know about the workflow).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache13_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache13_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache13_l_workflowcachename488","displayName":"Name of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache13_l_workflowdescrip490","displayName":"Description of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache13_l_workflowfriendly491","displayName":"Name of the document library to be shown the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache13_l_workflowpath489","displayName":"Full URL to the document library with which the workflow is associated (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache13_l_workflowsig492","displayName":"Workflow requires the user to sign the document (Word/Excel only) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache13_l_workflowsig492_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache13_l_workflowsig492_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache14","displayName":"Workflow Cache 14 (User)","description":"The values entered will be used by the client to provide the user with a workflow to be made available to the user for all of their documents. The url should be a full path, such as 'http://localsharepointsite/Shared%20Documents'. Some workflows require that the user sign a document with an in-document signature, workflows indicated as such will only be shown the the user as an option in applications that support in-document signatures. \r\n\r\nThis workflow must also be made available on the document library (setting these values only lets the client know about the workflow).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache14_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache14_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache14_l_workflowcachename493","displayName":"Name of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache14_l_workflowdescrip495","displayName":"Description of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache14_l_workflowfriendly496","displayName":"Name of the document library to be shown the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache14_l_workflowpath494","displayName":"Full URL to the document library with which the workflow is associated (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache14_l_workflowsig497","displayName":"Workflow requires the user to sign the document (Word/Excel only) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache14_l_workflowsig497_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache14_l_workflowsig497_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache15","displayName":"Workflow Cache 15 (User)","description":"The values entered will be used by the client to provide the user with a workflow to be made available to the user for all of their documents. The url should be a full path, such as 'http://localsharepointsite/Shared%20Documents'. Some workflows require that the user sign a document with an in-document signature, workflows indicated as such will only be shown the the user as an option in applications that support in-document signatures. \r\n\r\nThis workflow must also be made available on the document library (setting these values only lets the client know about the workflow).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache15_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache15_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache15_l_workflowcachename498","displayName":"Name of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache15_l_workflowdescrip500","displayName":"Description of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache15_l_workflowfriendly501","displayName":"Name of the document library to be shown the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache15_l_workflowpath499","displayName":"Full URL to the document library with which the workflow is associated (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache15_l_workflowsig502","displayName":"Workflow requires the user to sign the document (Word/Excel only) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache15_l_workflowsig502_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache15_l_workflowsig502_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache2","displayName":"Workflow Cache 2 (User)","description":"The values entered will be used by the client to provide the user with a workflow to be made available to the user for all of their documents. The url should be a full path, such as 'http://localsharepointsite/Shared%20Documents'. Some workflows require that the user sign a document with an in-document signature, workflows indicated as such will only be shown the the user as an option in applications that support in-document signatures. \r\n\r\nThis workflow must also be made available on the document library (setting these values only lets the client know about the workflow).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache2_l_workflowcachename433","displayName":"Name of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache2_l_workflowdescrip435","displayName":"Description of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache2_l_workflowfriendly436","displayName":"Name of the document library to be shown the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache2_l_workflowpath434","displayName":"Full URL to the document library with which the workflow is associated (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache2_l_workflowsig437","displayName":"Workflow requires the user to sign the document (Word/Excel only) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache2_l_workflowsig437_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache2_l_workflowsig437_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache3","displayName":"Workflow Cache 3 (User)","description":"The values entered will be used by the client to provide the user with a workflow to be made available to the user for all of their documents. The url should be a full path, such as 'http://localsharepointsite/Shared%20Documents'. Some workflows require that the user sign a document with an in-document signature, workflows indicated as such will only be shown the the user as an option in applications that support in-document signatures. \r\n\r\nThis workflow must also be made available on the document library (setting these values only lets the client know about the workflow).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache3_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache3_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache3_l_workflowcachename438","displayName":"Name of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache3_l_workflowdescrip440","displayName":"Description of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache3_l_workflowfriendly441","displayName":"Name of the document library to be shown the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache3_l_workflowpath439","displayName":"Full URL to the document library with which the workflow is associated (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache3_l_workflowsig442","displayName":"Workflow requires the user to sign the document (Word/Excel only) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache3_l_workflowsig442_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache3_l_workflowsig442_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache4","displayName":"Workflow Cache 4 (User)","description":"The values entered will be used by the client to provide the user with a workflow to be made available to the user for all of their documents. The url should be a full path, such as 'http://localsharepointsite/Shared%20Documents'. Some workflows require that the user sign a document with an in-document signature, workflows indicated as such will only be shown the the user as an option in applications that support in-document signatures. \r\n\r\nThis workflow must also be made available on the document library (setting these values only lets the client know about the workflow).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache4_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache4_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache4_l_workflowcachename443","displayName":"Name of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache4_l_workflowdescrip445","displayName":"Description of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache4_l_workflowfriendly446","displayName":"Name of the document library to be shown the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache4_l_workflowpath444","displayName":"Full URL to the document library with which the workflow is associated (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache4_l_workflowsig447","displayName":"Workflow requires the user to sign the document (Word/Excel only) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache4_l_workflowsig447_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache4_l_workflowsig447_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache5","displayName":"Workflow Cache 5 (User)","description":"The values entered will be used by the client to provide the user with a workflow to be made available to the user for all of their documents. The url should be a full path, such as 'http://localsharepointsite/Shared%20Documents'. Some workflows require that the user sign a document with an in-document signature, workflows indicated as such will only be shown the the user as an option in applications that support in-document signatures. \r\n\r\nThis workflow must also be made available on the document library (setting these values only lets the client know about the workflow).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache5_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache5_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache5_l_workflowcachename448","displayName":"Name of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache5_l_workflowdescrip450","displayName":"Description of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache5_l_workflowfriendly451","displayName":"Name of the document library to be shown the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache5_l_workflowpath449","displayName":"Full URL to the document library with which the workflow is associated (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache5_l_workflowsig452","displayName":"Workflow requires the user to sign the document (Word/Excel only) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache5_l_workflowsig452_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache5_l_workflowsig452_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache6","displayName":"Workflow Cache 6 (User)","description":"The values entered will be used by the client to provide the user with a workflow to be made available to the user for all of their documents. The url should be a full path, such as 'http://localsharepointsite/Shared%20Documents'. Some workflows require that the user sign a document with an in-document signature, workflows indicated as such will only be shown the the user as an option in applications that support in-document signatures. \r\n\r\nThis workflow must also be made available on the document library (setting these values only lets the client know about the workflow).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache6_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache6_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache6_l_workflowcachename453","displayName":"Name of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache6_l_workflowdescrip455","displayName":"Description of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache6_l_workflowfriendly456","displayName":"Name of the document library to be shown the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache6_l_workflowpath454","displayName":"Full URL to the document library with which the workflow is associated (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache6_l_workflowsig457","displayName":"Workflow requires the user to sign the document (Word/Excel only) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache6_l_workflowsig457_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache6_l_workflowsig457_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache7","displayName":"Workflow Cache 7 (User)","description":"The values entered will be used by the client to provide the user with a workflow to be made available to the user for all of their documents. The url should be a full path, such as 'http://localsharepointsite/Shared%20Documents'. Some workflows require that the user sign a document with an in-document signature, workflows indicated as such will only be shown the the user as an option in applications that support in-document signatures. \r\n\r\nThis workflow must also be made available on the document library (setting these values only lets the client know about the workflow).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache7_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache7_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache7_l_workflowcachename458","displayName":"Name of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache7_l_workflowdescrip460","displayName":"Description of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache7_l_workflowfriendly461","displayName":"Name of the document library to be shown the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache7_l_workflowpath459","displayName":"Full URL to the document library with which the workflow is associated (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache7_l_workflowsig462","displayName":"Workflow requires the user to sign the document (Word/Excel only) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache7_l_workflowsig462_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache7_l_workflowsig462_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache8","displayName":"Workflow Cache 8 (User)","description":"The values entered will be used by the client to provide the user with a workflow to be made available to the user for all of their documents. The url should be a full path, such as 'http://localsharepointsite/Shared%20Documents'. Some workflows require that the user sign a document with an in-document signature, workflows indicated as such will only be shown the the user as an option in applications that support in-document signatures. \r\n\r\nThis workflow must also be made available on the document library (setting these values only lets the client know about the workflow).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache8_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache8_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache8_l_workflowcachename463","displayName":"Name of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache8_l_workflowdescrip465","displayName":"Description of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache8_l_workflowfriendly466","displayName":"Name of the document library to be shown the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache8_l_workflowpath464","displayName":"Full URL to the document library with which the workflow is associated (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache8_l_workflowsig467","displayName":"Workflow requires the user to sign the document (Word/Excel only) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache8_l_workflowsig467_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache8_l_workflowsig467_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache9","displayName":"Workflow Cache 9 (User)","description":"The values entered will be used by the client to provide the user with a workflow to be made available to the user for all of their documents. The url should be a full path, such as 'http://localsharepointsite/Shared%20Documents'. Some workflows require that the user sign a document with an in-document signature, workflows indicated as such will only be shown the the user as an option in applications that support in-document signatures. \r\n\r\nThis workflow must also be made available on the document library (setting these values only lets the client know about the workflow).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache9_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache9_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache9_l_workflowcachename468","displayName":"Name of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache9_l_workflowdescrip470","displayName":"Description of the workflow to be shown to the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache9_l_workflowfriendly471","displayName":"Name of the document library to be shown the user (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache9_l_workflowpath469","displayName":"Full URL to the document library with which the workflow is associated (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache9_l_workflowsig472","displayName":"Workflow requires the user to sign the document (Word/Excel only) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache9_l_workflowsig472_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_miscellaneous437~l_workflowcache_l_workflowcache9_l_workflowsig472_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_officeconverters_l_blockopeningofprereleaseexcel","displayName":"Block opening of pre-release versions of file formats new to Excel 2016 through the Compatibility Pack for Office 2016 and Excel 2016 Converter (User)","description":"This policy setting controls whether users with the Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2016 File Formats installed can open Office Open XML files saved with pre-release versions of Excel 2016. Excel Open XML files usually have the following extensions: .xlsx, .xlsm, .xltx, .xltm, .xlam. \r\n\r\nIf you enable this policy setting, users of the Compatibility Pack will not be able to open Office Open XML files created in pre-release versions of Excel 2016.\r\n\r\nIf you disable this policy setting, users with the Compatibility Pack installed can open files saved by some pre-release versions of Excel, but not by others, which can lead to inconsistent file opening functionality.\r\n\r\nIf you do not configure this policy setting, the behavior is the equivalent of setting the policy to Enabled. ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_officeconverters_l_blockopeningofprereleaseexcel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_officeconverters_l_blockopeningofprereleaseexcel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_officeconverters_l_blockopeningofprereleaseppt","displayName":"Block opening of pre-release versions of file formats new to PowerPoint 2016 through the Compatibility Pack for Office 2016 and PowerPoint 2016 Converter (User)","description":"This policy setting controls whether users with the Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2016 File Formats installed can open Office Open XML files saved with pre-release versions of PowerPoint 2016. PowerPoint Open XML files usually have the following extensions: .pptx, .pptm, .potx, .potm, .ppsx, .ppsm, .ppam, .thmx, .xml. \r\n\r\nIf you enable this policy setting, users of the Compatibility Pack will not be able to open Office Open XML files created in pre-release versions of PowerPoint 2016. \r\n\r\nIf you disable this policy setting, users with the Compatibility Pack installed can open files saved by some pre-release versions of PowerPoint, but not by others, which can lead to inconsistent file opening functionality.\r\n\r\nIf you do not configure this policy setting, the behavior is the equivalent of setting the policy to Enabled","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_officeconverters_l_blockopeningofprereleaseppt_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_officeconverters_l_blockopeningofprereleaseppt_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_disableinclusionofdocumentpropertiesinpdfandxpsoutput","displayName":"Disable inclusion of document properties in PDF and XPS output (User)","description":"This policy setting controls whether document metadata can be saved in PDF and XPS documents. \r\n\r\nIf you enable this policy setting, document properties metadata is not exported to PDF and XPS files. \r\n\r\nIf you disable this policy setting, document properties metadata will always be saved with PDF and XPS files, and users will not be able to override this configuration. \r\n\r\nIf you do not configure this policy setting, if the Microsoft Save as PDF or XPS Add-in for Microsoft Office Programs add-in is installed, document properties are saved as metadata when users save files using the PDF or XPS or Publish as PDF or XPS commands in Access, Excel, InfoPath, PowerPoint, and Word, unless the \"Document properties\" option is unchecked in the Options dialog.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_disableinclusionofdocumentpropertiesinpdfandxpsoutput_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_disableinclusionofdocumentpropertiesinpdfandxpsoutput_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_enforcepdfcompliancewithiso190051pdfa","displayName":"Enforce PDF compliance with ISO 19005-1 (PDF/A) (User)","description":"Allows enforcement of ISO 19005-1 compliance in PDF output. The values for his setting are as follows:\r\n \r\nDefault: Options UI defaults to not ISO compliant. User may override.\r\n\r\nEncourage: Options UI defaults to ISO compliance. User may override.\r\n\r\nPrevent: Not ISO compliant. No user override.\r\n\r\nEnforce: ISO compliant. No user override.\r\n\r\nSee Office Help for more details on the tradeoffs of choosing ISO 19005 compliance.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_enforcepdfcompliancewithiso190051pdfa_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_enforcepdfcompliancewithiso190051pdfa_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_enforcepdfcompliancewithiso190051pdfa_l_empty417","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_enforcepdfcompliancewithiso190051pdfa_l_empty417_0","displayName":"Default","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_enforcepdfcompliancewithiso190051pdfa_l_empty417_1","displayName":"Encourage","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_enforcepdfcompliancewithiso190051pdfa_l_empty417_2","displayName":"Prevent","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_enforcepdfcompliancewithiso190051pdfa_l_empty417_3","displayName":"Enforce","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_specifytypesoffixedformatoptionsavailabletotheuser","displayName":"Disable Microsoft Save As PDF and XPS add-ins (User)","description":"Allows the user or administrator to specify which of the installed Microsoft PDF and XPS add-ins are available. \r\n\r\nWhen this setting is not configured, installed Microsoft PDF and XPS add-ins are visible to users. \r\n\r\nDefault: same as not configured. \r\n\r\nDisable XPS: Hides and disables the Microsoft Save As XPS add-in. \r\n\r\nDisable PDF: Hides and disables the Microsoft Save As PDF add-in. \r\n\r\nDisable XPS and PDF: Hides and disables both the Microsoft Save As PDF and Save As XPS add-ins.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_specifytypesoffixedformatoptionsavailabletotheuser_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_specifytypesoffixedformatoptionsavailabletotheuser_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_specifytypesoffixedformatoptionsavailabletotheuser_l_empty418","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_specifytypesoffixedformatoptionsavailabletotheuser_l_empty418_0","displayName":"Default","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_specifytypesoffixedformatoptionsavailabletotheuser_l_empty418_1","displayName":"Disable XPS","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_specifytypesoffixedformatoptionsavailabletotheuser_l_empty418_2","displayName":"Disable PDF","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_pdfandxps_l_specifytypesoffixedformatoptionsavailabletotheuser_l_empty418_3","displayName":"Disable XPS and PDF","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_connectedofficeexperiences","displayName":"[Deprecated] Allow the use of connected experiences in Office (User)","description":"\r\n This policy setting allows you to control whether connected experiences are available to your users when they're using Office.\r\n\r\n Connected experiences include experiences that analyze content, such as Editor in Word, experiences that download online content, such as PowerPoint QuickStarter, and other connected experiences, such as document co-authoring and online file storage. It also includes additional optional connected experiences, such as the LinkedIn features of the Resume Assistant in Word or the 3D Maps feature in Excel, which uses Bing. See the Note at the end for more information about other policy settings that you can use to control these connected experiences.\r\n\r\n If you enable this policy setting, these connected experiences will be available to your users.\r\n\r\n If you disable this policy setting, these connected experiences won't be available to your users.\r\n\r\n Note: If you disable this policy setting, nearly all connected experiences will be turned off. However, limited Office functionality will remain available, such as synching a mailbox in Outlook. Essential services, such as the licensing service that confirms that you’re properly licensed to use Office, will also remain available.\r\n\r\n If you don't configure this policy setting, these connected experiences will be available to your users.\r\n\r\n Note: You can use these other policy settings if you want to disable just a certain group of connected experiences:\"Allow the use of connected experiences in Office that analyze content,\" \"Allow the use of connected experiences in Office that download online content,\" and \"Allow the use of additional optional connected experiences in Office.\"\r\n\r\n For more information, see https://go.microsoft.com/fwlink/p/?linkid=2085689\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_connectedofficeexperiences_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_connectedofficeexperiences_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_connectedofficeexperiences_l_connectedofficeexperiencesdropid","displayName":"[Deprecated] Connected experiences in Office (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_connectedofficeexperiences_l_connectedofficeexperiencesdropid_1","displayName":"Connected","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_connectedofficeexperiences_l_connectedofficeexperiencesdropid_2","displayName":"Disconnected","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_disableoptinwizard","displayName":"Disable Opt-in Wizard on first run (User)","description":"This policy setting controls whether users see the Opt-in Wizard the first time they run a Microsoft Office 2016 application. \r\n\r\nIf you enable this policy setting, the Opt-in Wizard does not display the first time users run an Office 2016 application. \r\n\r\nIf you disable or do not configure this policy setting, the Opt-in Wizard displays the first time users run a Microsoft Office 2016 application, which allows them to opt into Internet--based services that will help improve their Office experience, such as Microsoft Update, the Customer Experience Improvement Program, Office Diagnostics, and Online Help.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_disableoptinwizard_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_disableoptinwizard_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_enablecustomerexperienceimprovementprogram","displayName":"Enable Customer Experience Improvement Program (User)","description":"This policy setting controls whether users can participate in the Microsoft Office Customer Experience Improvement Program to help improve Microsoft Office. When users choose to participate in the Customer Experience Improvement Program (CEIP), Office 2016 applications automatically send information to Microsoft about how the applications are used. This information is combined with other CEIP data to help Microsoft solve problems and to improve the products and features customers use most often. This feature does not collect users' names, addresses, or any other identifying information except the IP address that is used to send the data. \r\n\r\nIf you enable this policy setting, users have the opportunity to opt into participation in the CEIP the first time they run an Office application. If your organization has policies that govern the use of external resources such as the CEIP, allowing users to opt in to the program might cause them to violate these policies. \r\n\r\nIf you disable this policy setting, Office 2016 users cannot participate in the Customer Experience Improvement Program. \r\n\r\nIf you do not configure this policy setting, the behavior is the equivalent of setting the policy to \"Enabled\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_enablecustomerexperienceimprovementprogram_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_enablecustomerexperienceimprovementprogram_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_officeexperiencesanlayzingcontent","displayName":"[Deprecated] Allow the use of connected experiences in Office that analyze content (User)","description":"\r\n This policy setting allows you to control whether connected experiences that analyze content are available to your users when they're using Office.\r\n\r\n PowerPoint Designer and Editor in Word are examples of connected experiences that analyze content.\r\n\r\n If you enable this policy setting, connected experiences that analyze content will be available to your users.\r\n\r\n If you disable this policy setting, connected experiences that analyze content won't be available to your users.\r\n\r\n If you don't configure this policy setting, connected experiences that analyze content will be available to your users.\r\n\r\n Note: If you disable the \"Allow the use of connected experiences in Office\" policy setting, conected experiences that analyze content won't be available to your users.\r\n\r\n For more information, see https://go.microsoft.com/fwlink/p/?linkid=2085794\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_officeexperiencesanlayzingcontent_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_officeexperiencesanlayzingcontent_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_officeexperiencesanlayzingcontent_l_officeexperiencesanlayzingcontentdropid","displayName":"[Deprecated] Connected experiences in Office that analyze content (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_officeexperiencesanlayzingcontent_l_officeexperiencesanlayzingcontentdropid_1","displayName":"Enabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_officeexperiencesanlayzingcontent_l_officeexperiencesanlayzingcontentdropid_2","displayName":"Disabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_officeexperiencesdownloadingcontent","displayName":"[Deprecated] Allow the use of connected experiences in Office that download online content (User)","description":"\r\n This policy setting allows you to control whether connected experiences that download online content are available to your users when they’re using Office.\r\n\r\n Office templates and PowerPoint QuickStarter are examples of connected experiences that download online content.\r\n\r\n If you enable this policy setting, connected experiences that download online content will be available to your users.\r\n\r\n If you disable this policy setting, connected experiences that download online content won’t be available to your users.\r\n\r\n If you don’t configure this policy setting, connected experiences that download online content will be available to your users.\r\n\r\n Note: If you disable the “Allow the use of connected experiences in Office” policy setting, connected experiences that download online content won’t be available to your users.\r\n\r\n For more information, see https://go.microsoft.com/fwlink/p/?linkid=2085688\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_officeexperiencesdownloadingcontent_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_officeexperiencesdownloadingcontent_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_officeexperiencesdownloadingcontent_l_officeexperiencesdownloadingcontentdropid","displayName":"[Deprecated] Connected experiences in Office that download online content (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_officeexperiencesdownloadingcontent_l_officeexperiencesdownloadingcontentdropid_1","displayName":"Enabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_officeexperiencesdownloadingcontent_l_officeexperiencesdownloadingcontentdropid_2","displayName":"Disabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_optionalconnectedexperiences","displayName":"[Deprecated] Allow the use of additional optional connected experiences in Office (User)","description":"\r\n This policy setting allows you to control whether additional optional connected experiences are available to your users when they’re using Office.\r\n\r\n Additional optional connected experiences are offered by Microsoft directly to your users and are governed by terms other than your organization’s commercial agreement with Microsoft.\r\n\r\n The LinkedIn features of the Resume Assistant in Word or the 3D Maps feature in Excel, which uses Bing, are examples of additional optional connected experiences.\r\n\r\n Note: Even if you choose to make these additional optional connected experiences available to your users, your users will have the option to turn these additional optional connected experiences off as a group by going to File > Account > Account Privacy > Manage Settings.\r\n\r\n If you enable this policy setting, additional optional connected experiences will be available to your users.\r\n\r\n If you disable this policy setting, additional optional connected experiences won’t be available to your users.\r\n\r\n Note: Some additional optional connected experiences may be controlled by other policy settings instead of this policy setting. For more information, see the link below.\r\n\r\n If you don’t configure this policy setting, additional optional connected experiences will be available to your users.\r\n\r\n Note: If you disable the “Allow the use of connected experiences in Office” policy setting, additional optional connected experiences won’t be available to your users.\r\n\r\n For more information, see https://go.microsoft.com/fwlink/p/?linkid=2085690\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_optionalconnectedexperiences_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_optionalconnectedexperiences_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_optionalconnectedexperiences_l_optionalconnectedexperiencesdropid","displayName":"[Deprecated] Optional connected experiences in Office (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_optionalconnectedexperiences_l_optionalconnectedexperiencesdropid_1","displayName":"Enabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_optionalconnectedexperiences_l_optionalconnectedexperiencesdropid_2","displayName":"Disabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_screenshot","displayName":"Allow including screenshot with Office Feedback (User)","description":"This policy setting manages whether the Office Feedback Tool (a.k.a. Send a Smile) allows the user to send a screenshot of their desktop with their feedback to Microsoft. The Office Feedback Tool allows users to provide Microsoft feedback regarding their positive and negative experiences when using Office.\r\n\r\nIf you enable this policy setting, the Office Feedback Tool will allow the user to send a screenshot of their desktop with their feedback to Microsoft.\r\n\r\nIf you disable this policy setting, the Office Feedback Tool will not allow the user to send a screenshot of their desktop with their feedback to Microsoft.\r\n\r\nIf you do not configure this policy setting, the behavior is the equivalent of setting the policy to \"Enabled\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_screenshot_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_screenshot_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendcustomerdata","displayName":"Send personal information (User)","description":"This policy setting controls whether users can send personal information to Office. When users choose to send information Office 2016 applications automatically send information to Office.\r\n\r\nIf you enable this policy setting, users will opt into sending personal information to Office. If your organization has policies that govern the use of external resources, opting users into the program might cause them to violate these policies.\r\n\r\nIf you disable this policy setting, Office 2016 users cannot send personal information to Office.\r\n\r\nIf you do not configure this policy setting, the behavior is the equivalent of setting the policy to \"Enabled\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendcustomerdata_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendcustomerdata_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendfeedback","displayName":"Send Office Feedback (User)","description":"This policy setting manages the Office Feedback Tool (a.k.a. Send a Smile). The Office Feedback Tool allows users to provide Microsoft feedback regarding their positive and negative experiences when using Office.\r\n\r\nIf you enable this policy setting, the Office Feedback Tool will be turned on in all Office applications in which the tool is available. They can access the tool through the Smile button located in the top right corner of the Office application.\r\n\r\nIf you disable this policy setting, the Office Feedback Tool will be turned off. Users will not see the Smile button in any of the Office applications in which the tool is available.\r\n\r\nIf you do not configure this policy setting, the behavior is the equivalent of setting the policy to \"Enabled\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendfeedback_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendfeedback_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendtelemetry","displayName":"Configure the level of client software diagnostic data sent by Office to Microsoft (User)","description":"\r\n This policy setting allows you to configure the level of client software diagnostic data that is collected and sent to Microsoft about the Office client software running on the user's device.\r\n\r\n Client software diagnostic data is used to keep Office secure and up-to-date, detect, diagnose and remediate problems, and also make product improvements. This data does not include a user's name or email address, the content of the user's files, or information about apps unrelated to Office.\r\n\r\n If you enable this policy setting, you must choose which level of diagnostic data is sent to Microsoft. Your choices are Required, Optional, or Neither.\r\n\r\n If you choose Required, the minimum data needed to keep Office secure, up-to-date, and performing as expected on the device it's installed on is sent to Microsoft.\r\n\r\n If you choose Optional, additional data that helps make product improvements and provides enhanced information to help detect, diagnose, and remediate issues is sent to Microsoft. If you choose to send optional diagnostic data, required diagnostic data is also included.\r\n\r\n If you choose Neither, no diagnostic data about Office client software running on the user's device is sent to Microsoft. This option, however, significantly limits Microsoft's ability to detect, diagnose, and remediate problems that your users may encounter when using Office.\r\n\r\n If you disable or don't configure this policy setting, optional diagnostic data is sent to Microsoft.\r\n\r\n For more information, see https://go.microsoft.com/fwlink/p/?linkid=2085687 ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendtelemetry_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendtelemetry_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendtelemetry_l_sendtelemetrydropid","displayName":"Type of diagnostic data: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendtelemetry_l_sendtelemetrydropid_3","displayName":"Neither","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendtelemetry_l_sendtelemetrydropid_2","displayName":"Optional","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendtelemetry_l_sendtelemetrydropid_1","displayName":"Required","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_updatereliabilitypolicy","displayName":"Automatically receive small updates to improve reliability (User)","description":"This policy setting controls whether Microsoft Office Diagnostics is enabled. Office Diagnostics enables Microsoft to diagnose system problems by periodically downloading a small file to the computer. \r\n\r\nIf you enable this policy setting, Office Diagnostics collects information about specific errors and the IP address of the computer. Office Diagnostics does not transmit any personally identifiable information to Microsoft other than the IP address of the computer requesting the update. \r\n\r\nIf you disable this policy setting, users will not receive updates from Office Diagnostics. \r\n\r\nIf you do not configure this policy setting, this policy setting is not enabled, but users have the opportunity to opt into receiving updates from Office Diagnostics the first time they run an Office 2016 application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_updatereliabilitypolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_updatereliabilitypolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_readinesstoolkit_l_officereadinesstoolkitcustomtags","displayName":"Specify custom labels to use with the Readiness Toolkit (User)","description":"This policy setting allows you to specify up to four custom labels to categorize and filter data in reports created by the Readiness Toolkit for Office. Labels are available in reports that are based on scans of the most recently used Office documents and installed add-ins on the user’s computer.\r\n\r\nYou can specify any string for the custom labels. For example, you can use a label to indicate the user’s department, title, or geographic location. When the Readiness Toolkit runs on the user’s computer, the custom labels are collected and are made available in the reports that are created. For example, you can filter the report to show only data from the Finance Department. Assign labels in a consistent manner, such as always using Label 1 for department.\r\n\r\nIf you enable this policy setting, the custom labels that you specify will be available in reports created by the Readiness Toolkit.\r\n\r\nIf you disable or don’t configure this policy setting, custom labels won’t be available in reports created by the Readiness Toolkit.\r\n\r\nNote: If you're using the Office Telemetry Dashboard and have already configured tags (labels), the Readiness Toolkit automatically collects those labels during its scan of the user's computer and will make them available in its reports. You don't need to enable this policy setting unless you want to specify different labels. Labels you specify for the Readiness Toolkit won't appear in the Office Telemetry Dashboard.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_readinesstoolkit_l_officereadinesstoolkitcustomtags_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_readinesstoolkit_l_officereadinesstoolkitcustomtags_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_readinesstoolkit_l_officereadinesstoolkitcustomtags_l_officereadinesstoolkitcustomtagstag1","displayName":"Label 1: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_readinesstoolkit_l_officereadinesstoolkitcustomtags_l_officereadinesstoolkitcustomtagstag2","displayName":"Label 2: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_readinesstoolkit_l_officereadinesstoolkitcustomtags_l_officereadinesstoolkitcustomtagstag3","displayName":"Label 3: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_readinesstoolkit_l_officereadinesstoolkitcustomtags_l_officereadinesstoolkitcustomtagstag4","displayName":"Label 4: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_readinesstoolkit_l_officereadinesstoolkitenableusageagent","displayName":"Allow add-in usage data to be generated and collected by the Readiness Toolkit (User)","description":"This policy setting allows you to configure whether the Readiness Toolkit for Office generates and collects add-in usage data. The data generated and collected includes when the add-in is loaded and used, and if the add-in crashes. This information is available in reports provided by the Readiness Toolkit.\r\n\r\nIf you enable this policy setting, the Readiness Toolkit generates and collects add-in usage data.\r\n\r\nIf you disable or don't configure this policy setting, the Readiness Toolkit doesn't generate or collect add-in usage data.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_readinesstoolkit_l_officereadinesstoolkitenableusageagent_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_readinesstoolkit_l_officereadinesstoolkitenableusageagent_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_activexcontrolinitialization","displayName":"ActiveX Control Initialization (User)","description":"This policy setting specifies the Microsoft ActiveX® initialization security level for all Microsoft Office applications. ActiveX controls can adversely affect a computer directly. In addition, malicious code can be used to compromise an ActiveX control and attack a computer. To indicate the safety of an ActiveX control, developers can denote them as Safe For Initialization (SFI). SFI indicates that a control is safe to open and run, and that it is not capable of causing a problem for any computer, regardless of whether it has persisted data values or not. If a control is not marked SFI, it is possible that the control could adversely affect a computer--or it could mean that the developers did not test the control in all situations and are not sure whether it might be compromised in the future. \r\n \r\n If you enable this policy setting, you can set the ActiveX security level to a number between 1 and 6. These security levels are as follows: \r\n \r\n 1 - Regardless of how the control is marked, load it and use the persisted values (if any). This setting does not prompt the user. \r\n \r\n 2 - If SFI, load the control in safe mode and use persisted values (if any). If not SFI, load in unsafe mode with persisted values (if any), or use the default (first-time initialization) settings. This level is similar to the default configuration, but does not prompt the user. \r\n \r\n 3 - If SFI, load the control in unsafe mode and use persisted values (if any). If not SFI, prompt the user and advise them that it is marked unsafe. If the user chooses No at the prompt, do not load the control. Otherwise, load it with default (first-time initialization) settings. \r\n \r\n 4 - If SFI, load the control in safe mode and use persisted values (if any). If not SFI, prompt the user and advise them that it is marked unsafe. If the user chooses No at the prompt, do not load the control. Otherwise, load it with default (first-time initialization) settings. \r\n \r\n 5 - If SFI, load the control in unsafe mode and use persisted values (if any). If not SFI, prompt the user and advise them that it is marked unsafe. If the user chooses No at the prompt, do not load the control. Otherwise, load it with persisted values. \r\n \r\n 6 - If SFI, load the control in safe mode and use persisted values (if any). If not SFI, prompt the user and advise them that it is marked unsafe. If the user chooses No at the prompt, do not load the control. Otherwise, load it with persisted values. \r\n \r\n If you disable or do not configure this policy setting, if a control is marked SFI, the application loads the control in safe mode and uses persisted values (if any). If the control is not marked SFI, the application loads the control in unsafe mode with persisted values (if any), or uses the default (first-time initialization) settings. In both situations, the Message Bar informs users that the controls have been disabled and prompts them to respond. \r\n \r\n Important - Some ActiveX controls do not respect the safe mode registry setting, and therefore might load persisted data even though you configure this setting to instruct the control to use safe mode. This setting only increases security for ActiveX controls that are accurately marked as SFI. In situations that involve malicious or poorly designed code, an ActiveX control might be inaccurately marked as SFI.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_activexcontrolinitialization_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_activexcontrolinitialization_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_activexcontrolinitialization_l_activexcontrolinitializationcolon","displayName":"ActiveX Control Initialization: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_activexcontrolinitialization_l_activexcontrolinitializationcolon_1","displayName":"1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_activexcontrolinitialization_l_activexcontrolinitializationcolon_2","displayName":"2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_activexcontrolinitialization_l_activexcontrolinitializationcolon_3","displayName":"3","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_activexcontrolinitialization_l_activexcontrolinitializationcolon_4","displayName":"4","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_activexcontrolinitialization_l_activexcontrolinitializationcolon_5","displayName":"5","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_activexcontrolinitialization_l_activexcontrolinitializationcolon_6","displayName":"6","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_allowedextensions","displayName":"Allow file extensions for OLE embedding (User)","description":"This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus or Visio Pro for Office 365.\r\n\r\nThis policy setting allows you to specify which file extensions Office won’t block when they are embedded as an OLE package in an Office file by using the Object Packager control.\r\n\r\nBy default, Office blocks certain file extensions. For a list of those file extensions, go to https://go.microsoft.com/fwlink/?linkid=847759.\r\n\r\nImportant: Malicious scripts and executables can be embedded as an OLE package and can cause harm if clicked by the user.\r\n\r\nIf you enable this policy setting, enter the file extensions to allow, separated by semicolons. For example, exe;vbs;js.\r\n\r\nIf you disable or don’t configure this policy setting, the default set of file extensions will be blocked.\r\n\r\nIf you want to block additional file extensions, enable the \"Block additional file extensions for OLE embedding\" policy setting.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_allowedextensions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_allowedextensions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_allowedextensions_l_allowedextensionsole","displayName":"File extensions: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_automationsecurity","displayName":"Automation Security (User)","description":"This policy setting controls whether macros can run in an Office 2016 application that is opened programmatically by another application. \r\n\r\nIf you enable this policy setting, you can choose from three options for controlling macro behavior in Excel, PowerPoint, and Word when the application is opened programmatically: \r\n\r\n- Disable macros by default - All macros are disabled in the programmatically opened application. \r\n\r\n- Macros enabled (default) - Macros can run in the programmatically opened application. This option enforces the default configuration in Excel, PowerPoint, and Word. \r\n\r\n- User application macro security level - Macro functionality is determined by the setting in the \"Macro Settings\" section of the Trust Center. \r\n\r\nIf you disable or do not configure this policy setting, when a separate program is used to launch Microsoft Excel, PowerPoint, or Word programmatically, any macros can run in the programmatically opened application without being blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_automationsecurity_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_automationsecurity_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_automationsecurity_l_settheautomationsecuritylevel","displayName":"Set the Automation Security level (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_automationsecurity_l_settheautomationsecuritylevel_3","displayName":"Disable macros by default","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_automationsecurity_l_settheautomationsecuritylevel_2","displayName":"Use application macro security level","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_automationsecurity_l_settheautomationsecuritylevel_1","displayName":"Macros enabled (default)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_blockedextensions","displayName":"Block additional file extensions for OLE embedding (User)","description":"This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus or Visio Pro for Office 365.\r\n\r\nThis policy setting allows you to specify additional file extensions that Office will block when they are embedded as an OLE package in an Office file by using the Object Packager control.\r\n\r\nBy default, Office blocks certain file extensions. For a list of those file extensions, go to https://go.microsoft.com/fwlink/?linkid=847759.\r\n\r\nImportant: Malicious scripts and executables can be embedded as an OLE package and can cause harm if clicked by the user.\r\n\r\nIf you enable this policy setting, enter the additional file extensions to block, separated by semicolons. For example, py;rb.\r\n\r\nIf you disable or don’t configure this policy setting, the default set of file extensions will be blocked.\r\n\r\nIf you want to allow certain file extensions, enable the \"Allow file extensions for OLE embedding\" policy setting. Extensions added to this policy setting will take precedence over extensions in \"Allow file extensions for OLE embedding\"\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_blockedextensions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_blockedextensions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_blockedextensions_l_blockedextensionsole","displayName":"File extensions: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkactivexobjects","displayName":"Check ActiveX objects (User)","description":"This policy setting determines whether Office checks that an ActiveX object is properly categorized before loading it. \r\n\r\nIf you enable this policy setting, you can select one of the following options:\r\n- Do not check: Office loads ActiveX objects without checking if they are properly categorized.\r\n- Override IE kill bit list: Office uses the category list to override IE kill bit checks. (This is also the default behavior for this policy setting). \r\n- Strict allow list: Office only loads properly categorized ActiveX objects.\r\n\r\nIf you disable or do not configure this policy setting, Office uses the category list to override IE kill bit checks.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkactivexobjects_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkactivexobjects_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkactivexobjects_l_checkactivexobjectsdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkactivexobjects_l_checkactivexobjectsdropid_0","displayName":"Do not check","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkactivexobjects_l_checkactivexobjectsdropid_1","displayName":"Override IE kill bit list","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkactivexobjects_l_checkactivexobjectsdropid_2","displayName":"Strict allow list","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkexcelrtdservers","displayName":"Check Excel RTD servers (User)","description":"This policy setting determines whether Office checks that a RealTimeData (RTD) is properly categorized before loading it. \r\n\r\nIf you enable this policy setting Office only loads properly categorized RTD servers.\r\n\r\nIf you disable or do not configure this policy setting, Office does not check that an RTD server is properly categorized before loading it.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkexcelrtdservers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkexcelrtdservers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkoleobjects","displayName":"Check OLE objects (User)","description":"This policy setting determines whether Office checks that an OLE object is properly categorized before loading it. \r\n\r\nIf you enable this policy setting, you can select one of the following options:\r\n- Do not check: Office loads OLE objects without checking if they are properly categorized.\r\n- Override IE kill bit list: Office uses the category list to override IE kill bit checks. (This is also the default behavior for this policy setting). \r\n- Strict allow list: Office only loads properly categorized OLE objects.\r\n\r\nIf you disable or do not configure this policy setting, Office uses the category list to override IE kill bit checks.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkoleobjects_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkoleobjects_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkoleobjects_l_checkoleobjectsdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkoleobjects_l_checkoleobjectsdropid_0","displayName":"Do not check","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkoleobjects_l_checkoleobjectsdropid_1","displayName":"Override IE kill bit list","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkoleobjects_l_checkoleobjectsdropid_2","displayName":"Strict allow list","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkowcdatasourceproviders","displayName":"Check OWC data source providers (User)","description":"This policy setting determines whether Office checks that an Office Web Components (OWC) data source provider is properly categorized before loading it.\r\n\r\nIf you enable this policy setting, Office only loads properly categorized data source providers.\r\n\r\nIf you disable or do not configure this policy setting, Office does not check that an OWC data source provider is properly categorized before loading it.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkowcdatasourceproviders_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_checkowcdatasourceproviders_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_disableallactivex","displayName":"Disable All ActiveX (User)","description":"This policy setting controls whether ActiveX controls are disabled. \r\n\r\nIf you enable this policy setting, Office 2016 applications do not initialize ActiveX controls from non-trusted locations, and do not notify the user that the ActiveX controls are disabled. \r\n\r\nIf you disable or do not configure this policy setting, users can set the trust level for ActiveX controls in the Trust Center in the 2016 versions of Microsoft Access, PowerPoint, Word, and Excel. The default configuration does not load untrusted ActiveX controls, but uses the Message Bar to prompt users about the control, and they can then choose whether to run the control.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_disableallactivex_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_disableallactivex_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_disablealltrustbarnotificationsfor","displayName":"Disable all Trust Bar notifications for security issues (User)","description":"This policy setting controls whether Office 2016 applications notify users when potentially unsafe features or content are detected, or whether such features or content are silently disabled without notification. \r\n\r\nThe Message Bar in Office 2016 applications is used to identify security issues, such as unsigned macros or potentially unsafe add-ins. When such issues are detected, the application disables the unsafe feature or content and displays the Message Bar at the top of the active window. The Message Bar informs the users about the nature of the security issue and, in some cases, provides the users with an option to enable the potentially unsafe feature or content, which could harm the user's computer. \r\n\r\nIf you enable this policy setting, Office 2016 applications do not display information in the Message Bar about potentially unsafe content that has been detected or has automatically been blocked. \r\n\r\nIf you disable this policy setting, Office 2016 applications display information in the Message Bar about content that has automatically been blocked. \r\n\r\nIf you do not configure this policy setting, if an Office 2016 application detects a security issue, the Message Bar is displayed. However, this configuration can be modified by users in the Trust Center.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_disablealltrustbarnotificationsfor_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_disablealltrustbarnotificationsfor_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_disablepasswordtoopenui","displayName":"Disable password to open UI (User)","description":"This policy setting controls whether Office 2016 users can add password encryption to documents. (Users would access this feature in Microsoft Office tab--click Info, click Protect Document, then click Encrypt with Password.)\r\n \r\n If you enable this policy setting, users cannot password protect their 2016 Office documents. \r\n \r\n\r\nIf you disable or do not configure this policy setting, users can encrypt their 2016 Office files with passwords.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_disablepasswordtoopenui_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_disablepasswordtoopenui_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_disablevbaforofficeapplications319","displayName":"Disable VBA for Office applications (User)","description":"This policy setting allows you to prevent Excel 2016, SharePoint Designer 2016, Outlook 2016, PowerPoint 2016, Publisher 2016, and Word 2016 from using Visual Basic for Applications (VBA), whether or not the VBA feature is installed on user computers. Changing this policy setting will not install or remove the VBA files from the user computers. For more information about configuring security settings, see the 2016 Office Resource Kit.\r\n\r\nIf you enable this policy setting, VBA is disabled on 2016 Office applications on user computers.\r\n\r\nIf you disable or do not configure this policy setting, VBA is enabled for 2016 Office applications on user computers.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_disablevbaforofficeapplications319_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_disablevbaforofficeapplications319_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_enableminimizevbaresigning","displayName":"Enable Minimizing VBA Project Digital Signature Invalidation (User)","description":"\r\nThis policy setting allows you to reduce the number of actions in Office that will result in a document's VBA digital signature becoming invalidated.\r\n\r\nThe VBA project may be modified in certain ways that change the project storage but that do not invalidate the source code digital signature. With this setting turned off, these actions will lead to the VBA digital signature being invalidated, and the signature dropped on save if the user does not have the private key available to resign.\r\n\r\nWith this setting on, we will only perform a resign of the project if the source code signature has changed, and will keep the existing signature in other cases. If the VBA project storage is changed and saved, but the old signature retained under this feature, this can lead to an invalidation of the saved compiled VBA project state. If this happens, the VBA project will be forced to recompile each time the document is loaded. This may have negative performance impacts for larger VBA projects. Once a document is in this state, the state will persist until the VBA project is resigned.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_enableminimizevbaresigning_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_enableminimizevbaresigning_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_encryptdocumentproperties","displayName":"Encrypt document properties (User)","description":"This policy setting allows you configure if the document properties are encrypted. This applies to OLE documents (Office 97-2003 compatible) if the application is configured for CAPI RC4.\r\n\r\nIf you enable this policy setting, the document properties will be encrypted.\r\n\r\nIf you disable or do not configure this policy setting, the document properties will not be encrypted.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_encryptdocumentproperties_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_encryptdocumentproperties_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_encryptiontypeforpasswordprotectedoffice972003","displayName":"Encryption type for password protected Office 97-2003 files (User)","description":"This policy setting enables you to specify an encryption type for password-protected Office 97-2003 files.\r\n \r\nIf you enable this policy setting, you can specify the type of encryption that Office applications will use to encrypt password-protected files in the older Office 97-2003 file formats. The chosen encryption type must have a corresponding cryptographic service provider (CSP) installed on the computer that encrypts the file. See the HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\ registry key for a list of CSPs installed on the local computer. Specify the encryption type to use by entering it in the provided text box in the following form:\r\n\r\n,,.\r\nFor example, Microsoft Enhanced Cryptographic Provider v1.0,RC4,128\r\n\r\nIf you do not configure this policy setting, Excel, PowerPoint, and Word use Office 97/2000 Compatible encryption, a proprietary encryption method, to encrypt password-protected Office 97-2003 files.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_encryptiontypeforpasswordprotectedoffice972003_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_encryptiontypeforpasswordprotectedoffice972003_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_encryptiontypeforpasswordprotectedoffice972003_l_encryptiontypecolon318","displayName":"Encryption type: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_encryptiontypeforpasswordprotectedofficeopen","displayName":"Encryption type for password protected Office Open XML files (User)","description":"This policy setting allows you to specify an encryption type for Office Open XML files.\r\n \r\nIf you enable this policy setting, you can specify the type of encryption that Office applications use to encrypt password-protected files in the Office Open XML file formats used by Excel, PowerPoint, and Word. The chosen encryption type must have a corresponding cryptographic service provider (CSP) installed on the computer that encrypts the file. See the HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\ registry key for a list of CSPs installed on the local computer. Specify the encryption type to use by entering it in the provided text box in the following form:\r\n\r\n,,\r\n\r\nFor example: Microsoft Enhanced Cryptographic Provider v1.0,RC4,128\r\n\r\nIf you disable or do not configure this policy setting, the default CSP is used. The default cryptographic service provider (CSP) is Microsoft Enhanced RSA and AES Cryptographic Provider, AES-128, 128-bit.\r\n\r\nNote: This policy setting does not take effect unless the registry key \r\nHKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\\\Security\\Crypto\\CompatMode is set to 0. By default the CompatMode registry key is set to 1.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_encryptiontypeforpasswordprotectedofficeopen_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_encryptiontypeforpasswordprotectedofficeopen_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_encryptiontypeforpasswordprotectedofficeopen_l_encryptiontypecolon","displayName":"Encryption type: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_loadcontrolsinforms3","displayName":"Load Controls in Forms3 (User)","description":"This policy setting allows you to control how ActiveX controls in UserForms should be initialized based upon whether they are Safe For Initialization (SFI) or Unsafefor Initialization (UFI). \r\n \r\n ActiveX controls are Component Object Model (COM) objects and have unrestricted access to users' computers. ActiveX controls can access the local file system and change the registry settings of the operating system. If a malicious user repurposes an ActiveX control to take over a user's computer, the effect could be significant. To help improve security, ActiveX developers can mark controls as Safe For Initialization (SFI), which means that the developer states that the controls are safe to open and run and not capable of causing harm to any computers. If a control is not marked SFI, the control could adversely affect a computer--or it's possible the developers did not test the control in all situations and are not sure whether their control might be compromised at some future date.SFI controls run in safe mode, which limits their access to the computer. For example, a worksheet control can both read and write files when it is in unsafe mode, but perhaps only read from files when it is in safe mode. This functionality allows the control to be used in very powerful ways when safety wasn't important, but the control would still be safe for use in a Web page. If a control is not marked as SFI, it is marked Unsafe For Initialization (UFI), which means that it is capable of affecting a user's computer. If UFI ActiveX controls are loaded, they are always loaded in unsafe mode. \r\n \r\n If you enable this policy setting, you can choose from four options for loading controls in UserForms: \r\n \r\n 1- For a UFI or SFI signed control that supports safe and unsafe mode, load the control in unsafe mode. For an SFI signed control that only supports a safe mode configuration, load the control in safe mode. This option enforces the default configuration. \r\n \r\n 2 - Users are prompted to determine how UserForm forms will load. The prompt only displays once per session within an application. When users respond to the prompt, loading continues based on whether the control is UFI or SFI: \r\n \r\n - For a UFI signed control, if users respond Yes to the prompt, load the control in unsafe mode. If users respond No, load the control using the default properties. \r\n \r\n - For an SFI signed control that supports both safe and unsafe modes, if users respond Yes to the prompt, load the control in unsafe mode. If users respond No, load the control using safe mode. If the SFI control can only support safe mode, load the control in safe mode. This option is the default configuration in the Microsoft Office 2016 release. \r\n \r\n 3 - Users are prompted to determine how UserForm forms will load. The prompt only displays once per session within an application. When users respond to the prompt, loading continues based on whether the control is UFI or SFI: \r\n \r\n - For a UFI signed control, if users respond Yes to the prompt, load the control in unsafe mode. If users respond No, load the control with its default properties. \r\n \r\n - For an SFI signed control, load in safe mode. \r\n \r\n 4 - For a UFI signed control, load with the default properties of the control. For an SFI signed control, load in safe mode (considered to be the safest mode). \r\n \r\n If you disable or do not configure this policy setting, the behavior is as if you enable this policy setting and then select option 1. ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_loadcontrolsinforms3_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_loadcontrolsinforms3_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_loadcontrolsinforms3_l_loadcontrolsinforms3colon","displayName":"Load Controls in Forms3: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_loadcontrolsinforms3_l_loadcontrolsinforms3colon_1","displayName":"1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_loadcontrolsinforms3_l_loadcontrolsinforms3colon_2","displayName":"2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_loadcontrolsinforms3_l_loadcontrolsinforms3colon_3","displayName":"3","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_loadcontrolsinforms3_l_loadcontrolsinforms3colon_4","displayName":"4","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_macroruntimescanscope","displayName":"Macro Runtime Scan Scope (User)","description":"This policy setting specifies for which documents the VBA Runtime Scan feature is enabled.\r\n\r\nIf the feature is disabled for all documents, no runtime scanning of enabled macros will be performed.\r\n\r\nIf the feature is enabled for low trust documents, the feature will be enabled for all documents for which macros are enabled except:\r\n\r\n - Documents opened while macro security settings are set to \"Enable All Macros\"\r\n\r\n - Documents opened from a Trusted Location\r\n\r\n - Documents that are Trusted Documents\r\n\r\n - Documents that contain VBA that is digitally signed by a Trusted Publisher\r\n\r\nIf the feature is enabled for all documents, then the above class of documents are not excluded from the behavior.\r\n\r\nThis protocol allows the VBA runtime to report to the Anti-Virus system certain high-risk code behaviors it is about to execute and allows the Anti-Virus to report back to the process if the sequence of observed behaviors indicates likely malicious activity so the Office application can take appropriate action.\r\n\r\nWhen this feature is enabled, affected VBA projects' runtime performance may be reduced.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_macroruntimescanscope_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_macroruntimescanscope_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_macroruntimescanscope_l_macroruntimescanscopeenum","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_macroruntimescanscope_l_macroruntimescanscopeenum_0","displayName":"Disable for all documents","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_macroruntimescanscope_l_macroruntimescanscopeenum_1","displayName":"Enable for low trust documents","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_macroruntimescanscope_l_macroruntimescanscopeenum_2","displayName":"Enable for all documents","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_preventwordandexcelfromloadingmanagedcodeextensions","displayName":"Prevent Word and Excel from loading managed code extensions (User)","description":"This policy setting allows you to prevent Word 2016 and Excel 2016 from loading managed code extensions.\r\n\r\nIf you enable this policy setting, Word 2016 and Excel 2016 will not load managed code extensions.\r\n\r\nIf you disable or do not configure this policy setting, Word 2016 and Excel 2016 will load managed code extensions automatically.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_preventwordandexcelfromloadingmanagedcodeextensions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_preventwordandexcelfromloadingmanagedcodeextensions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_protectdocumentmetadataforpasswordprotected","displayName":"Protect document metadata for password protected files (User)","description":"This policy setting determines whether metadata is encrypted when an Office Open XML file is password protected.\r\n \r\n If you enable this policy setting, Excel 2016, PowerPoint 2016, and Word 2016 encrypt metadata stored in password-protected Office Open XML files and override any configuration changes on users' computers.\r\n \r\n If you disable this policy setting, Office 2016 applications cannot encrypt metadata in password-protected Office Open XML files, which can reduce security.\r\n \r\n If you do not configure this policy setting, when an Office Open XML document is protected with a password and saved, any metadata associated with the document is encrypted along with the rest of the document's contents. If this configuration is changed, potentially sensitive information such as the document author and hyperlink references could be exposed to unauthorized people.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_protectdocumentmetadataforpasswordprotected_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_protectdocumentmetadataforpasswordprotected_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_protectdocumentmetadataforrightsmanaged","displayName":"Protect document metadata for rights managed Office Open XML Files (User)","description":"This policy setting determines whether metadata is encrypted in Office Open XML files that are protected by Information Rights Management (IRM). \r\n\r\nIf you enable this policy setting, Excel, PowerPoint, and Word encrypt metadata stored in rights-managed Office Open XML files and override any configuration changes on users' computers. \r\n\r\nIf you disable this policy setting, Office 2016 applications cannot encrypt metadata in rights-managed Office Open XML files, which can reduce security. \r\n\r\nIf you do not configure this policy setting, when Information Rights Management (IRM) is used to restrict access to an Office Open XML document, any metadata associated with the document is not encrypted.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_protectdocumentmetadataforrightsmanaged_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_protectdocumentmetadataforrightsmanaged_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setminimumpasswordlength","displayName":"Set minimum password length (User)","description":"This setting will define what the minimum length a password should be when the local policy is enforced.\r\n\r\nIf you enable this policy setting, you may specify the minimum password length. The valid range is between 0 and 255.\r\n\r\nIf you disable or do not configure this policy setting, the default minimum password length is 0 characters.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setminimumpasswordlength_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setminimumpasswordlength_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setminimumpasswordlength_l_setminimumpasswordlengthspinid","displayName":"Minimum password length (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setpasswordhashformatasisocompliant","displayName":"Set password hash format as ISO-compliant (User)","description":"This policy setting allows you create ISO-compliant modification password records.\r\n\r\nIf you enable this policy setting, then passwords created will be ISO-compliant.\r\n\r\nIf you disable or do not configure this policy setting, the default will be ECMA-style records.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setpasswordhashformatasisocompliant_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setpasswordhashformatasisocompliant_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setpasswordrulesdomaintimeout","displayName":"Set password rules domain timeout (User)","description":"This policy setting will define how long in milliseconds to wait when contacting a domain controller before timing out. This requires the \"Set password rules level\" to be enabled and set to \"Local length, local complexity, and domain policy checks.\"\r\n\r\nIf you enable this policy setting, you may set how long in milliseconds to wait when contacting a domain controller before timing out.\r\n\r\nIf you disable or do not configure this policy setting, the default value of 4000 milliseconds is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setpasswordrulesdomaintimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setpasswordrulesdomaintimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setpasswordrulesdomaintimeout_l_setpasswordrulesdomaintimeoutspinid","displayName":"in milliseconds (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setpasswordruleslevel","displayName":"Set password rules level (User)","description":"This policy setting allows you to set the password rules level.\r\n\r\nIf you enable this policy setting, you may specify a password rules level:\r\n\r\n- No password checks: There are no complexity checks\r\n- Local length check: Minimum length checks\r\n- Local length and complexity checks: Minimum length checks plus 3 of 4 character groups checks.\r\n- Local length, local complexity, and domain policy checks: All the previous checks plus Windows domain password rules enforced.\r\n\r\nIf you select \"Local length and complexity checks\" or \"Local length, local complexity, and domain policy checks,\" then the password must contain characters from at least three of four character sets: lowercase a-z, uppercase A-Z, digits 0-9, or non-alphabetic characters. When this complexity is enforced, the minimum password length needs to be at least 6, but can be more depending on the value set in the \"Set minimum password length\" policy setting.\r\n\r\nIf you select \"Local length, local complexity, and domain policy checks,\" then Microsoft Office will use the Windows domain policy as well as all the settings \"Local length and complexity checks.\" This allows a custom password filter that is installed for Windows passwords to be used. If you are offline or a domain controller cannot be contacted, then the Windows password settings are not used, and only the \"Local length and complexity checks\" settings are used. If you don’t have a custom password filter, then \"Local length and complexity checks\" saves a trip across the network and would be the best choice.\r\n\r\nIf you disable or do not configure this policy setting, the behavior is the same as if this policy setting were enabled and \"No password checks\" selected.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setpasswordruleslevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setpasswordruleslevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setpasswordruleslevel_l_setpasswordrulesleveldropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setpasswordruleslevel_l_setpasswordrulesleveldropid_0","displayName":"No password checks","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setpasswordruleslevel_l_setpasswordrulesleveldropid_1","displayName":"Local length check","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setpasswordruleslevel_l_setpasswordrulesleveldropid_2","displayName":"Local length and complexity checks","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_setpasswordruleslevel_l_setpasswordrulesleveldropid_3","displayName":"Local length, local complexity, and domain policy checks","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_suppresshyperlinkwarnings","displayName":"Suppress hyperlink warnings (User)","description":"This policy setting controls whether Office 2016 applications notify users about unsafe hyperlinks. Links that Office 2016 considers unsafe include links to executable files, TIFF files, and Microsoft Document Imaging (MDI) files. Other unsafe links are those that use protocols considered to be unsafe such as javascript. \r\n\r\nIf you enable this policy setting, unsafe hyperlink warnings are suppressed for all users. \r\n\r\nIf you disable or do not configure this policy setting, hyperlink warnings cannot be suppressed by any means. Office 2016 users will be notified that links are unsafe and must enable them manually to use them.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_suppresshyperlinkwarnings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_suppresshyperlinkwarnings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_turnofferrorreportingforfilesthatfailfilevalidation","displayName":"Turn off error reporting for files that fail file validation (User)","description":"This policy determines whether error reports and files that fail file validation should be sent using the Watson dialog.\r\n\r\nIf you enable this policy setting, users will not see the Watson dialog. Files that fail file validation will not be sent by the Watson dialog to Microsoft.\r\n\r\nIf you disable or do not configure this policy setting, the Watson dialog to send files that fail validation will show up once every two weeks.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_turnofferrorreportingforfilesthatfailfilevalidation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_turnofferrorreportingforfilesthatfailfilevalidation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_turnoffpdfencryptionsettingui","displayName":"Turn off PDF encryption setting UI (User)","description":"This policy setting allows you to turn off the PDF encryption setting UI.\r\n\r\nIf you enable this policy setting, the PDF encryption UI is hidden. If your organization has a higher requirement on encryption than what is supported, the recommendation is to enable this policy setting.\r\n\r\nIf you disable or do not configure this policy setting, the PDF encryption UI is shown, and users may choose to encrypt the PDF file or not.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_turnoffpdfencryptionsettingui_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings_l_turnoffpdfencryptionsettingui_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_checkthexadesportionsofadigitalsignature","displayName":"Check the XAdES portions of a digital signature (User)","description":"This policy setting lets you specify whether or not Office 2016 checks the XAdES portions of a digital signature, if present, when validating a digital signature for a document. \r\n\r\nIf you enable this policy setting, Office 2016 checks the XAdES portions of a digital signature when validating it.\r\n\r\nIf you disable or do not configure this policy setting, Office 2016 only validates XML-DSig and XAdES-BES portions of a digital signature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_checkthexadesportionsofadigitalsignature_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_checkthexadesportionsofadigitalsignature_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_configuretimestampinghashingalgorithm","displayName":"Configure time stamping hashing algorithm (User)","description":"This policy setting allows you to configure the time stamping hashing algorithm used by Office 2016 applications to validate a message or document.\r\n \r\nIf you enable this policy setting, you can specify any of the following standard hashing algorithm (SHA) functions:\r\n- SHA1\r\n- SHA256\r\n- SHA384\r\n- SHA512\r\n\r\nIf you disable or do not configure this policy setting, SHA1 will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_configuretimestampinghashingalgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_configuretimestampinghashingalgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_configuretimestampinghashingalgorithm_l_configuretimestampinghashingalgorithmdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_configuretimestampinghashingalgorithm_l_configuretimestampinghashingalgorithmdropid_sha1","displayName":"SHA1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_configuretimestampinghashingalgorithm_l_configuretimestampinghashingalgorithmdropid_sha256","displayName":"SHA256","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_configuretimestampinghashingalgorithm_l_configuretimestampinghashingalgorithmdropid_sha384","displayName":"SHA384","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_configuretimestampinghashingalgorithm_l_configuretimestampinghashingalgorithmdropid_sha512","displayName":"SHA512","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_donotallowexpiredcertificateswhenvalidatingsignatures","displayName":"Do not allow expired certificates when validating signatures (User)","description":"This policy setting allows you to configure Office 2016 applications to accept expired digital certificates during verification of digital signatures.\r\n\r\nIf you enable or do not configure this policy setting, Office 2016 applications display digital signatures created with expired certificates as invalid.\r\n\r\nIf you disable this policy setting, Office 2016 applications treat expired certificates as valid.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_donotallowexpiredcertificateswhenvalidatingsignatures_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_donotallowexpiredcertificateswhenvalidatingsignatures_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_requestedxadeslevelforsignaturegeneration","displayName":"Requested XAdES level for signature generation (User)","description":"This policy setting allows you to specify a requested or desired XAdES level in creating a digital signature. \r\n\r\nIf you enable this policy setting, you may specify the XAdES level in creating a digital signature. If the desired XAdES level is not reached, the last highest XAdES level reached is used if the level is higher than the minimum XAdES level (XAdeES-BES).\r\n\r\n- No XAdES: XML-DSig - No XAdES\r\n- XAdES-BES: Minimal XAdES (Default)\r\n- XAdES-T: Will fall back to XAdES-BES if minimum XAdES level < XAdes-T\r\n- XAdES-C: Will fall back to XAdES-T if minimum XAdES level < XAdes-C\r\n- XAdES-X: Will fall back to XAdES-C if minimum XAdES level < XAdes-X\r\n- XAdES-X-L: Will fall back to XAdES-X if minimum XAdES level < XAdes-X-L\r\n\r\nIf you disable or do not configure this policy setting, XAdES-BES will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_requestedxadeslevelforsignaturegeneration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_requestedxadeslevelforsignaturegeneration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_requestedxadeslevelforsignaturegeneration_l_requestedxadeslevelforsignaturegenerationdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_requestedxadeslevelforsignaturegeneration_l_requestedxadeslevelforsignaturegenerationdropid_0","displayName":"No XAdES","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_requestedxadeslevelforsignaturegeneration_l_requestedxadeslevelforsignaturegenerationdropid_1","displayName":"XAdES-BES","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_requestedxadeslevelforsignaturegeneration_l_requestedxadeslevelforsignaturegenerationdropid_2","displayName":"XAdES-T","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_requestedxadeslevelforsignaturegeneration_l_requestedxadeslevelforsignaturegenerationdropid_3","displayName":"XAdES-C","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_requestedxadeslevelforsignaturegeneration_l_requestedxadeslevelforsignaturegenerationdropid_4","displayName":"XAdES-X","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_requestedxadeslevelforsignaturegeneration_l_requestedxadeslevelforsignaturegenerationdropid_5","displayName":"XAdES-X-L","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_requireocspatsignaturegenerationtime","displayName":"Require OCSP at signature generation time (User)","description":"This policy setting lets you determine whether Office 2016 requires OCSP (Online Certificate Status Protocol) revocation data for all digital certificates in a chain when digital signatures are generated.\r\n\r\nIf you enable this policy setting, Office 2016 requires OCSP revocation data for all certificates in a chain when digital signatures are generated.\r\n\r\nIf you disable or do not configure this policy setting, Office 2016 does not set any restrictions on what type of revocation data is to be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_requireocspatsignaturegenerationtime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_requireocspatsignaturegenerationtime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturehashingalgorithm","displayName":"Select digital signature hashing algorithm (User)","description":"This policy setting allows you to configure the hashing algorithm Office 2016 applications use to confirm digital signatures.\r\n\r\nIf you enable this policy setting, you can specify any of the following SHA standard functions:\r\n- SHA1\r\n- SHA256\r\n- SHA384\r\n- SHA512\r\n\r\nIf you disable or do not configure this policy setting, the default value of SHA1 is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturehashingalgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturehashingalgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturehashingalgorithm_l_selectdigitalsignaturehashingalgorithmdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturehashingalgorithm_l_selectdigitalsignaturehashingalgorithmdropid_sha1","displayName":"SHA1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturehashingalgorithm_l_selectdigitalsignaturehashingalgorithmdropid_sha256","displayName":"SHA256","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturehashingalgorithm_l_selectdigitalsignaturehashingalgorithmdropid_sha384","displayName":"SHA384","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturehashingalgorithm_l_selectdigitalsignaturehashingalgorithmdropid_sha512","displayName":"SHA512","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvaliddsabits","displayName":"Configure invalid DSA public key size (User)","description":"This policy setting allows you to configure whether Office displays a digital signature as invalid because of the number of DSA public key bits used in the digital signature.\r\n\r\nIf you enable this policy setting, you can specify the number of bits that Office treats as invalid in a digital signature. For example: 512, 768, etc.\r\n\r\nIf you don’t configure this policy setting, Office won’t treat any digital signatures as invalid because of the number of bits in the public key.\r\n\r\nEnabling this policy causes the minimum DSA public key size to be the next largest option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvaliddsabits_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvaliddsabits_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvaliddsabits_l_selectdigitalsignaturehashingalgorithmdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvaliddsabits_l_selectdigitalsignaturehashingalgorithmdropid_0","displayName":"0","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvaliddsabits_l_selectdigitalsignaturehashingalgorithmdropid_512","displayName":"512","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvaliddsabits_l_selectdigitalsignaturehashingalgorithmdropid_768","displayName":"768","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvaliddsabits_l_selectdigitalsignaturehashingalgorithmdropid_1024","displayName":"1024","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvalidhashingalgorithm","displayName":"Configure invalid hashing algorithm (User)","description":"This policy setting allows you to configure whether Office displays a digital signature as invalid when it contains specific hash algorithms.\r\n\r\nIf you enable this policy setting, you can specify the weakest hash algorithm that Office treats as invalid. If you enable this policy setting, you can specify any of the following algorithms:\r\n- MD5\r\n- SHA1\r\n- SHA256\r\n- SHA384\r\n\r\nIf you don’t configure this policy setting, Office won’t treat digital signatures as invalid because of the hashing algorithm.\r\n\r\nFor example, if you set MD5 as the invalid hashing algorithm Office treats MD5 signatures as invalid.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvalidhashingalgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvalidhashingalgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvalidhashingalgorithm_l_selectdigitalsignaturehashingalgorithmdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvalidhashingalgorithm_l_selectdigitalsignaturehashingalgorithmdropid_md5","displayName":"MD5","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvalidhashingalgorithm_l_selectdigitalsignaturehashingalgorithmdropid_sha1","displayName":"SHA1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvalidhashingalgorithm_l_selectdigitalsignaturehashingalgorithmdropid_sha256","displayName":"SHA256","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvalidhashingalgorithm_l_selectdigitalsignaturehashingalgorithmdropid_sha384","displayName":"SHA384","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvalidrsabits","displayName":"Configure invalid RSA public key size (User)","description":"This policy setting allows you to configure whether Office displays a digital signature as invalid because of the number of RSA public key bits used in the digital signature.\r\n\r\nIf you enable this policy setting, you can specify the number of bits that Office treats as invalid in a digital signature. For example: 512, 768, etc.\r\n\r\nIf you don’t configure this policy setting, Office won’t treat any digital signatures as invalid because of the number of bits in the public key.\r\n\r\nEnabling this policy causes the minimum RSA public key size to be the next largest option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvalidrsabits_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvalidrsabits_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvalidrsabits_l_selectdigitalsignaturehashingalgorithmdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvalidrsabits_l_selectdigitalsignaturehashingalgorithmdropid_0","displayName":"0","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvalidrsabits_l_selectdigitalsignaturehashingalgorithmdropid_512","displayName":"512","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvalidrsabits_l_selectdigitalsignaturehashingalgorithmdropid_768","displayName":"768","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvalidrsabits_l_selectdigitalsignaturehashingalgorithmdropid_1024","displayName":"1024","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvalidrsabits_l_selectdigitalsignaturehashingalgorithmdropid_1536","displayName":"1536","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureinvalidrsabits_l_selectdigitalsignaturehashingalgorithmdropid_2048","displayName":"2048","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacydsabits","displayName":"Configure legacy DSA public key size (User)","description":"This policy setting allows you to configure whether Office displays a digital signature as legacy because of the number of DSA public key bits used in the digital signature.\r\n\r\nIf you enable this policy setting, you can specify the number of bits that Office treats as legacy in a digital signature. For example: 512, 768, etc.\r\n\r\nIf you don’t configure this policy setting, Office won’t treat any digital signatures as legacy because of the number of bits in the public key.\r\n\r\nEnabling this policy causes the minimum DSA public key size to be the next largest option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacydsabits_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacydsabits_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacydsabits_l_selectdigitalsignaturehashingalgorithmdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacydsabits_l_selectdigitalsignaturehashingalgorithmdropid_0","displayName":"0","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacydsabits_l_selectdigitalsignaturehashingalgorithmdropid_512","displayName":"512","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacydsabits_l_selectdigitalsignaturehashingalgorithmdropid_768","displayName":"768","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacydsabits_l_selectdigitalsignaturehashingalgorithmdropid_1024","displayName":"1024","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacyhashingalgorithm","displayName":"Configure legacy hashing algorithm (User)","description":"This policy setting allows you to configure whether Office displays a digital signature as legacy when it contains specific hash algorithms.\r\n\r\nIf you enable this policy setting, you can specify the weakest hash algorithm that Office treats as legacy. You can specify any of the following algorithms:\r\n- MD5\r\n- SHA1\r\n- SHA256\r\n- SHA384\r\n\r\nIf you don’t configure this policy setting, Office treats digital signatures containing SHA1 or better as valid.\r\n\r\nFor example, if you set SHA256 as the legacy hashing algorithm, Office treats SHA384 signatures as valid.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacyhashingalgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacyhashingalgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacyhashingalgorithm_l_selectdigitalsignaturehashingalgorithmdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacyhashingalgorithm_l_selectdigitalsignaturehashingalgorithmdropid_md5","displayName":"MD5","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacyhashingalgorithm_l_selectdigitalsignaturehashingalgorithmdropid_sha1","displayName":"SHA1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacyhashingalgorithm_l_selectdigitalsignaturehashingalgorithmdropid_sha256","displayName":"SHA256","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacyhashingalgorithm_l_selectdigitalsignaturehashingalgorithmdropid_sha384","displayName":"SHA384","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacyrsabits","displayName":"Configure legacy RSA public key size (User)","description":"This policy setting allows you to configure whether Office displays a digital signature as legacy because of the number of RSA public key bits used in the digital signature.\r\n\r\nIf you enable this policy setting, you can specify the number of bits that Office treats as legacy in a digital signature. For example: 512, 768, etc.\r\n\r\nIf you don’t configure this policy setting, Office won’t treat any digital signatures as legacy because of the number of bits in the public key.\r\n\r\nEnabling this policy causes the minimum RSA public key size to be the next largest option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacyrsabits_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacyrsabits_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacyrsabits_l_selectdigitalsignaturehashingalgorithmdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacyrsabits_l_selectdigitalsignaturehashingalgorithmdropid_0","displayName":"0","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacyrsabits_l_selectdigitalsignaturehashingalgorithmdropid_512","displayName":"512","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacyrsabits_l_selectdigitalsignaturehashingalgorithmdropid_768","displayName":"768","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacyrsabits_l_selectdigitalsignaturehashingalgorithmdropid_1024","displayName":"1024","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacyrsabits_l_selectdigitalsignaturehashingalgorithmdropid_1536","displayName":"1536","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturelegacyrsabits_l_selectdigitalsignaturehashingalgorithmdropid_2048","displayName":"2048","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturemindsabits","displayName":"Configure minimum DSA public key size (User)","description":"This policy setting allows you to configure the minimum number of DSA public key bits Office allows to create digital signatures.\r\n \r\nIf you enable this policy setting, you can specify the minimum number of bits that can be used to create a digital signature. For example: 1024, 2048, etc.\r\n \r\nIf you disable or don’t configure this policy setting, Office allows all DSA keys, unless the legacy or invalid DSA policy settings are configured.\r\n\r\n If the legacy or invalid DSA public key bits policy settings are configured, then the default for this setting will be the next larger value. For example, if the number of DSA public key bits is set to 768, then this setting would default to 1024.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturemindsabits_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturemindsabits_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturemindsabits_l_selectdigitalsignaturehashingalgorithmdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturemindsabits_l_selectdigitalsignaturehashingalgorithmdropid_0","displayName":"0","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturemindsabits_l_selectdigitalsignaturehashingalgorithmdropid_512","displayName":"512","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturemindsabits_l_selectdigitalsignaturehashingalgorithmdropid_768","displayName":"768","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignaturemindsabits_l_selectdigitalsignaturehashingalgorithmdropid_1024","displayName":"1024","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureminrsabits","displayName":"Configure minimum RSA public key size (User)","description":"This policy setting allows you to configure the minimum number of RSA public key bits Office allows to create digital signatures.\r\n \r\nIf you enable this policy setting, you can specify the minimum number of bits that can be used to create a digital signature. For example: 1024, 2048, etc.\r\n \r\nIf you disable or don’t configure this policy setting, Office allows all RSA keys, unless the legacy or invalid RSA policy settings are configured.\r\n\r\n If the legacy or invalid RSA public key bits policy settings are configured, then the default for this setting will be the next larger value. For example, if the number of RSA public key bits is set to 768, then this setting would default to 1024.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureminrsabits_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureminrsabits_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureminrsabits_l_selectdigitalsignaturehashingalgorithmdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureminrsabits_l_selectdigitalsignaturehashingalgorithmdropid_0","displayName":"0","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureminrsabits_l_selectdigitalsignaturehashingalgorithmdropid_512","displayName":"512","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureminrsabits_l_selectdigitalsignaturehashingalgorithmdropid_768","displayName":"768","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureminrsabits_l_selectdigitalsignaturehashingalgorithmdropid_1024","displayName":"1024","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureminrsabits_l_selectdigitalsignaturehashingalgorithmdropid_1536","displayName":"1536","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureminrsabits_l_selectdigitalsignaturehashingalgorithmdropid_2048","displayName":"2048","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_selectdigitalsignatureminrsabits_l_selectdigitalsignaturehashingalgorithmdropid_4096","displayName":"4096","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_setsignatureverificationlevel","displayName":"Set signature verification level (User)","description":"This policy setting allows you to set the verification level used by Office 2016 applications when validating a digital signature.\r\n\r\nNote: Enabling this policy setting is not recommended for subscription versions of Office, such as Office 365 ProPlus, because it will use the legacy registry based rules settings (described below) instead of basing the verification level on the Office version that signed the file.\r\n\r\nIf you enable this policy setting, you can set the verification level to any of the following:\r\n\r\n- No rules: Office 2016 digital signature rules are disabled.\r\n\r\n- Office 2007 rules: Office 2016 uses the Office 2007 digital signature rules.\r\n\r\n- Office 2010 rules: Office 2016 uses the Office 2010 digital signature rules.\r\n\r\n- Office 2013 rules: Office 2016 uses the Office 2013 digital signature rules.\r\n\r\nIf you disable or do not configure this policy setting, subscription versions of Office 2016 use the rules of the Office version that was used to sign the document to validate the digital signature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_setsignatureverificationlevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_setsignatureverificationlevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_setsignatureverificationlevel_l_setsignatureverificationleveldropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_setsignatureverificationlevel_l_setsignatureverificationleveldropid_0","displayName":"No rules","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_setsignatureverificationlevel_l_setsignatureverificationleveldropid_1","displayName":"Office 2007 rules","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_setsignatureverificationlevel_l_setsignatureverificationleveldropid_2","displayName":"Office 2010 rules","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_setsignatureverificationlevel_l_setsignatureverificationleveldropid_3","displayName":"Office 2013 rules","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_settimestampservertimeout","displayName":"Set timestamp server timeout (User)","description":"This policy setting allows you to configure the number of seconds Office 2016 applications wait for a response from the time stamping server before timing out. If timeout occurs, the Office 2016 application will not open the message or document.\r\n\r\nIf you enable this policy setting, the number of seconds you specify will be the length of time Office 2016 will wait for the time stamping server to return a result.\r\n\r\nIf you disable or do not configure this policy setting, the default of 5 seconds will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_settimestampservertimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_settimestampservertimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_settimestampservertimeout_l_settimestampservertimeoutspinid","displayName":"In seconds (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_specifyissuerfilter","displayName":"Specify filtering for certificate issuers (User)","description":"This policy setting allows you to configure Office to only allow certificates from a specific issuer when creating a digital signature.\r\n \r\nIf you enable this policy setting, Office only displays certificates that contain the string you set in the policy. This setting is case-sensitive.\r\n\r\nFor example, a setting of \"MyCA\" would match an issuer of \"MyCA 1\"and \"MyCA 2\", but not \"MYCA 3\".\r\n\r\nIf you disable or don’t configure this setting, then signing certificates from any issuer can be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_specifyissuerfilter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_specifyissuerfilter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_specifyissuerfilter_l_specifyissuerfilterid","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_specifyminimumxadeslevelfordigitalsignaturegeneration","displayName":"Specify minimum XAdES level for digital signature generation (User)","description":"This policy setting lets you specify a minimum XAdES level that Office 2016 applications must reach in order to create an XAdES digital signature. If unable to reach the minimum XAdESLevel, the Office application fails to create the signature. \r\n\r\nIf you enable this policy setting, you can set the following minimum XAdES levels that must be met by the Office application before creating the digital signature.\r\n\r\n- No minimum level\r\n- XAdES-BES: Must create at least XAdES-BES or fail\r\n- XAdES-T: Must create at least XAdES-T (timestamp) or fail. \r\n- XAdES-C: Must create at least XAdES-C (certificate and revocation references) or fail. \r\n- XAdES-X: Must create at least XAdES-X (timestamp -C) or fail. \r\n- XAdES-X-L: Must create at least XAdES-X-L (store certificate and revocation values) or fail.\r\n\r\nIf you disable or do not configure this policy setting, Office 2016 does not require a minimum XAdES level and creates the most advanced XAdES signature possible, up to the level specified in the policy setting","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_specifyminimumxadeslevelfordigitalsignaturegeneration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_specifyminimumxadeslevelfordigitalsignaturegeneration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_specifyminimumxadeslevelfordigitalsignaturegeneration_l_specifyminimumxadeslevelfordigitalsignaturegenerationdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_specifyminimumxadeslevelfordigitalsignaturegeneration_l_specifyminimumxadeslevelfordigitalsignaturegenerationdropid_0","displayName":"No minimum level","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_specifyminimumxadeslevelfordigitalsignaturegeneration_l_specifyminimumxadeslevelfordigitalsignaturegenerationdropid_1","displayName":"XAdES-BES","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_specifyminimumxadeslevelfordigitalsignaturegeneration_l_specifyminimumxadeslevelfordigitalsignaturegenerationdropid_2","displayName":"XAdES-T","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_specifyminimumxadeslevelfordigitalsignaturegeneration_l_specifyminimumxadeslevelfordigitalsignaturegenerationdropid_3","displayName":"XAdES-C","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_specifyminimumxadeslevelfordigitalsignaturegeneration_l_specifyminimumxadeslevelfordigitalsignaturegenerationdropid_4","displayName":"XAdES-X","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_specifyminimumxadeslevelfordigitalsignaturegeneration_l_specifyminimumxadeslevelfordigitalsignaturegenerationdropid_5","displayName":"XAdES-X-L","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_specifytimestampservername","displayName":"Specify timestamp server name (User)","description":"This policy setting allows you to set the HTTP URL for the timestamp server used by Office 2016 applications in the process of validating messages or documents.\r\n\r\nIf you enable this policy setting, you must provide a valid HTTP URL address for the timestamp server. \r\n\r\nIf you do disable or not configure this policy setting, a timestamp server will not be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_specifytimestampservername_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_specifytimestampservername_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_specifytimestampservername_l_specifytimestampservernameid","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_suppressnocertdialog","displayName":"Display alternative certificate providers (User)","description":"This policy setting allows you to configure whether Office displays a link to get a certificate from a Microsoft partner when there are no usable signing certificates.\r\n\r\nIf you enable this policy setting, the link won’t be displayed.\r\n\r\nIf you disable or don’t configure this policy setting, the link is displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_suppressnocertdialog_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_digsig_l_suppressnocertdialog_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey01","displayName":"Escrow Key #1 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey01_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey01_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey01_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey02","displayName":"Escrow Key #2 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey02_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey02_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey02_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey03","displayName":"Escrow Key #3 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey03_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey03_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey03_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey04","displayName":"Escrow Key #4 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey04_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey04_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey04_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey05","displayName":"Escrow Key #5 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey05_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey05_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey05_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey06","displayName":"Escrow Key #6 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey06_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey06_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey06_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey07","displayName":"Escrow Key #7 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey07_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey07_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey07_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey08","displayName":"Escrow Key #8 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey08_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey08_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey08_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey09","displayName":"Escrow Key #9 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey09_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey09_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey09_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey10","displayName":"Escrow Key #10 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey10_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey10_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey10_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey11","displayName":"Escrow Key #11 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey11_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey11_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey11_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey12","displayName":"Escrow Key #12 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey12_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey12_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey12_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey13","displayName":"Escrow Key #13 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey13_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey13_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey13_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey14","displayName":"Escrow Key #14 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey14_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey14_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey14_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey15","displayName":"Escrow Key #15 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey15_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey15_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey15_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey16","displayName":"Escrow Key #16 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey16_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey16_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey16_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey17","displayName":"Escrow Key #17 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey17_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey17_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey17_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey18","displayName":"Escrow Key #18 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey18_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey18_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey18_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey19","displayName":"Escrow Key #19 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey19_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey19_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey19_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey20","displayName":"Escrow Key #20 (User)","description":"This policy setting allows you to specify a certificate to use as an escrow key for password protected files.\r\n\r\nIf you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine.\r\n\r\nIf you disable or do not configure this policy setting, an escrow key is not configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey20_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey20_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_escrowkeycerts_l_escrowkey20_l_certhashcolon","displayName":"Certificate Hash: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_allowmixofpolicyanduserlocations","displayName":"Allow mix of policy and user locations (User)","description":"This policy setting controls whether trusted locations can be defined by users, the Office Customization Tool (OCT), and Group Policy, or if they must be defined by Group Policy alone.\r\n \r\nIf you enable this policy setting, users can specify any location as a trusted location, and a computer can have a combination of user-created, OCT-created, and Group Policy-created trusted locations.\r\n \r\nIf you disable this policy setting, all trusted locations that are not created by Group Policy are disabled and users cannot create new trusted locations in the Trust Center.\r\n \r\nIf you do not configure this policy setting, the behavior is the equivalent of setting the policy to Enabled.\r\n \r\nNote - InfoPath 2016 and Outlook 2016 do not recognize trusted locations, and therefore are unaffected by this policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_allowmixofpolicyanduserlocations_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_allowmixofpolicyanduserlocations_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_minsigsupportos","displayName":"Set the minimum operating system for verifying agile VBA signatures (User)","description":"This policy setting allows you to set the minimum operating system (OS) on which agile VBA signatures produced by Office can be verified. This ensures the hashing algorithm used to sign is compatible with the specified OS and later versions. \r\n\r\nIf you enable this policy setting, Office uses the OS you specify as the minimum OS to verify agile VBA signatures.\r\n\r\nIf you disable or do not configure this policy setting, Office uses Windows 7 as the minimum OS to verify agile VBA signatures.\r\n\r\nIf you specify a minimum OS version that is higher than the highest OS supported by Office, Office uses the highest supported OS to verify agile VBA signatures.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_minsigsupportos_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_minsigsupportos_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_minsigsupportos_l_minsigsupportosdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_minsigsupportos_l_minsigsupportosdropid_0","displayName":"Windows XP","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_minsigsupportos_l_minsigsupportosdropid_1","displayName":"Windows Vista","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_minsigsupportos_l_minsigsupportosdropid_2","displayName":"Windows 7","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_minsigsupportos_l_minsigsupportosdropid_3","displayName":"Windows 8","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc01","displayName":"Trusted Location #1 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc01_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc01_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc01_l_allowsubfolders","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc01_l_allowsubfolders_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc01_l_allowsubfolders_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc01_l_datecolon","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc01_l_descriptioncolon","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc01_l_pathcolon","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc02","displayName":"Trusted Location #2 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc02_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc02_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc02_l_allowsubfolders245","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc02_l_allowsubfolders245_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc02_l_allowsubfolders245_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc02_l_datecolon243","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc02_l_descriptioncolon244","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc02_l_pathcolon242","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc03","displayName":"Trusted Location #3 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc03_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc03_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc03_l_allowsubfolders249","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc03_l_allowsubfolders249_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc03_l_allowsubfolders249_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc03_l_datecolon247","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc03_l_descriptioncolon248","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc03_l_pathcolon246","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc04","displayName":"Trusted Location #4 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc04_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc04_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc04_l_allowsubfolders253","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc04_l_allowsubfolders253_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc04_l_allowsubfolders253_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc04_l_datecolon251","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc04_l_descriptioncolon252","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc04_l_pathcolon250","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc05","displayName":"Trusted Location #5 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc05_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc05_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc05_l_allowsubfolders257","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc05_l_allowsubfolders257_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc05_l_allowsubfolders257_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc05_l_datecolon255","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc05_l_descriptioncolon256","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc05_l_pathcolon254","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc06","displayName":"Trusted Location #6 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc06_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc06_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc06_l_allowsubfolders261","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc06_l_allowsubfolders261_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc06_l_allowsubfolders261_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc06_l_datecolon259","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc06_l_descriptioncolon260","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc06_l_pathcolon258","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc07","displayName":"Trusted Location #7 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc07_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc07_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc07_l_allowsubfolders265","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc07_l_allowsubfolders265_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc07_l_allowsubfolders265_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc07_l_datecolon263","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc07_l_descriptioncolon264","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc07_l_pathcolon262","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc08","displayName":"Trusted Location #8 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc08_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc08_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc08_l_allowsubfolders269","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc08_l_allowsubfolders269_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc08_l_allowsubfolders269_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc08_l_datecolon267","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc08_l_descriptioncolon268","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc08_l_pathcolon266","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc09","displayName":"Trusted Location #9 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc09_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc09_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc09_l_allowsubfolders273","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc09_l_allowsubfolders273_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc09_l_allowsubfolders273_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc09_l_datecolon271","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc09_l_descriptioncolon272","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc09_l_pathcolon270","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc10","displayName":"Trusted Location #10 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc10_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc10_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc10_l_allowsubfolders277","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc10_l_allowsubfolders277_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc10_l_allowsubfolders277_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc10_l_datecolon275","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc10_l_descriptioncolon276","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc10_l_pathcolon274","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc11","displayName":"Trusted Location #11 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc11_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc11_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc11_l_allowsubfolders281","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc11_l_allowsubfolders281_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc11_l_allowsubfolders281_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc11_l_datecolon279","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc11_l_descriptioncolon280","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc11_l_pathcolon278","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc12","displayName":"Trusted Location #12 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc12_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc12_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc12_l_allowsubfolders285","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc12_l_allowsubfolders285_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc12_l_allowsubfolders285_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc12_l_datecolon283","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc12_l_descriptioncolon284","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc12_l_pathcolon282","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc13","displayName":"Trusted Location #13 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc13_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc13_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc13_l_allowsubfolders289","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc13_l_allowsubfolders289_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc13_l_allowsubfolders289_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc13_l_datecolon287","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc13_l_descriptioncolon288","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc13_l_pathcolon286","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc14","displayName":"Trusted Location #14 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc14_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc14_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc14_l_allowsubfolders293","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc14_l_allowsubfolders293_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc14_l_allowsubfolders293_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc14_l_datecolon291","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc14_l_descriptioncolon292","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc14_l_pathcolon290","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc15","displayName":"Trusted Location #15 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc15_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc15_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc15_l_allowsubfolders297","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc15_l_allowsubfolders297_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc15_l_allowsubfolders297_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc15_l_datecolon295","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc15_l_descriptioncolon296","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc15_l_pathcolon294","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc16","displayName":"Trusted Location #16 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc16_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc16_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc16_l_allowsubfolders301","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc16_l_allowsubfolders301_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc16_l_allowsubfolders301_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc16_l_datecolon299","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc16_l_descriptioncolon300","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc16_l_pathcolon298","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc17","displayName":"Trusted Location #17 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc17_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc17_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc17_l_allowsubfolders305","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc17_l_allowsubfolders305_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc17_l_allowsubfolders305_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc17_l_datecolon303","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc17_l_descriptioncolon304","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc17_l_pathcolon302","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc18","displayName":"Trusted Location #18 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc18_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc18_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc18_l_allowsubfolders309","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc18_l_allowsubfolders309_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc18_l_allowsubfolders309_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc18_l_datecolon307","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc18_l_descriptioncolon308","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc18_l_pathcolon306","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc19","displayName":"Trusted Location #19 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc19_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc19_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc19_l_allowsubfolders313","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc19_l_allowsubfolders313_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc19_l_allowsubfolders313_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc19_l_datecolon311","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc19_l_descriptioncolon312","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc19_l_pathcolon310","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc20","displayName":"Trusted Location #20 (User)","description":"Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc20_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc20_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc20_l_allowsubfolders317","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc20_l_allowsubfolders317_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc20_l_allowsubfolders317_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc20_l_datecolon315","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc20_l_descriptioncolon316","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustedloc20_l_pathcolon314","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustlegacysignature","displayName":"Trust legacy VBA signatures (User)","description":"This policy setting allows you to control how Office loads and verifies legacy Visual Basic for Applications (VBA) signatures.\r\n\r\nIf you enable or do not configure this policy setting, Office applications can load and verify legacy VBA signatures.\r\n\r\nIf you disable this policy setting, Office applications can’t load or verify legacy VBA signatures. They can only load and verify agile VBA signatures.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustlegacysignature_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_trustlegacysignature_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc01","displayName":"Unsafe Location #1 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc01_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc01_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc01_l_allowsubfolders01","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc01_l_allowsubfolders01_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc01_l_allowsubfolders01_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc01_l_pathcolon01","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc02","displayName":"Unsafe Location #2 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc02_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc02_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc02_l_allowsubfolders02","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc02_l_allowsubfolders02_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc02_l_allowsubfolders02_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc02_l_pathcolon02","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc03","displayName":"Unsafe Location #3 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc03_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc03_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc03_l_allowsubfolders03","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc03_l_allowsubfolders03_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc03_l_allowsubfolders03_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc03_l_pathcolon03","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc04","displayName":"Unsafe Location #4 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc04_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc04_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc04_l_allowsubfolders04","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc04_l_allowsubfolders04_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc04_l_allowsubfolders04_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc04_l_pathcolon04","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc05","displayName":"Unsafe Location #5 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc05_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc05_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc05_l_allowsubfolders05","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc05_l_allowsubfolders05_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc05_l_allowsubfolders05_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc05_l_pathcolon05","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc06","displayName":"Unsafe Location #6 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc06_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc06_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc06_l_allowsubfolders06","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc06_l_allowsubfolders06_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc06_l_allowsubfolders06_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc06_l_pathcolon06","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc07","displayName":"Unsafe Location #7 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc07_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc07_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc07_l_allowsubfolders07","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc07_l_allowsubfolders07_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc07_l_allowsubfolders07_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc07_l_pathcolon07","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc08","displayName":"Unsafe Location #8 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc08_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc08_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc08_l_allowsubfolders08","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc08_l_allowsubfolders08_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc08_l_allowsubfolders08_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc08_l_pathcolon08","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc09","displayName":"Unsafe Location #9 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc09_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc09_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc09_l_allowsubfolders09","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc09_l_allowsubfolders09_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc09_l_allowsubfolders09_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc09_l_pathcolon09","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc10","displayName":"Unsafe Location #10 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc10_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc10_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc10_l_allowsubfolders10","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc10_l_allowsubfolders10_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc10_l_allowsubfolders10_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc10_l_pathcolon10","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc11","displayName":"Unsafe Location #11 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc11_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc11_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc11_l_allowsubfolders11","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc11_l_allowsubfolders11_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc11_l_allowsubfolders11_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc11_l_pathcolon11","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc12","displayName":"Unsafe Location #12 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc12_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc12_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc12_l_allowsubfolders12","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc12_l_allowsubfolders12_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc12_l_allowsubfolders12_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc12_l_pathcolon12","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc13","displayName":"Unsafe Location #13 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc13_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc13_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc13_l_allowsubfolders13","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc13_l_allowsubfolders13_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc13_l_allowsubfolders13_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc13_l_pathcolon13","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc14","displayName":"Unsafe Location #14 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc14_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc14_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc14_l_allowsubfolders14","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc14_l_allowsubfolders14_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc14_l_allowsubfolders14_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc14_l_pathcolon14","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc15","displayName":"Unsafe Location #15 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc15_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc15_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc15_l_allowsubfolders15","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc15_l_allowsubfolders15_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc15_l_allowsubfolders15_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc15_l_pathcolon15","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc16","displayName":"Unsafe Location #16 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc16_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc16_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc16_l_allowsubfolders16","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc16_l_allowsubfolders16_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc16_l_allowsubfolders16_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc16_l_pathcolon16","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc17","displayName":"Unsafe Location #17 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc17_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc17_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc17_l_allowsubfolders17","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc17_l_allowsubfolders17_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc17_l_allowsubfolders17_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc17_l_pathcolon17","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc18","displayName":"Unsafe Location #18 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc18_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc18_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc18_l_allowsubfolders18","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc18_l_allowsubfolders18_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc18_l_allowsubfolders18_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc18_l_pathcolon18","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc19","displayName":"Unsafe Location #19 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc19_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc19_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc19_l_allowsubfolders19","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc19_l_allowsubfolders19_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc19_l_allowsubfolders19_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc19_l_pathcolon19","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc20","displayName":"Unsafe Location #20 (User)","description":"This policy setting allows you to specify a location containing files that should always open in Protected View.\r\n\r\nIf you enable this policy setting, you can specify a location containing files that always open in Protected View. If you check the \"Allow sub folders\" option, sub folders will also be included.\r\n\r\nIf you disable or do not configure this policy setting, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders will be considered unsafe locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc20_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc20_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc20_l_allowsubfolders20","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc20_l_allowsubfolders20_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc20_l_allowsubfolders20_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_protectedview_l_unsafeloc20_l_pathcolon20","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_allowunsecureapps","displayName":"Allow Unsecure web add-ins and Catalogs (User)","description":"This policy setting allows users to run unsecure web add-in, which are add-ins that have web page or catalog locations that are not SSL-secured (https://), and are not in users' Internet zones.\r\n\r\nIf you enable this policy setting, users can run unsecure apps. To enable specific unsecure web add-ins, you must also configure the Trusted Web add-in Catalog policy settings to trust the catalogs that contains those Add-ins.\r\n\r\nIf you disable or do not configure this policy setting, unsecure web add-ins are not allowed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_allowunsecureapps_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_allowunsecureapps_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_defaultfilesharecatalog","displayName":"Default Shared Folder Location (User)","description":"This policy setting sets allows you to set the location of the Shared Folder that is designated as Default.\r\n\r\nIf you enable this policy setting, you can set the URL for the Shared Folder from which users can insert web add-ins into their Office documents.\r\n\r\nIf you disable this policy setting, users cannot insert web add-ins from a Shared Folder.\r\n\r\nIf you do not configure this policy setting, or any other policy settings in the Trusted Catalogs folder, users can set their own Default Shared Folder location.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_defaultfilesharecatalog_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_defaultfilesharecatalog_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_defaultfilesharecatalog_l_url","displayName":"URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_defaultspcatalog","displayName":"Default SharePoint Catalog Location (User)","description":"This policy setting allows you to set the location of the SharePoint Catalog that is designated as Default. The web add-ins contained in the Default Catalog can be inserted into Office documents by users.\r\n\r\nIf you enable this policy setting, you can set the URL for the SharePoint Catalog from which users can insert apps into their Office documents.\r\n\r\nIf you disable this policy setting, users cannot insert web add-ins from a SharePoint catalog.\r\n\r\nIf you do not configure this policy setting or set any other policy settings in the Trusted Catalogs folder, users can set their own Default SharePoint Catalog location.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_defaultspcatalog_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_defaultspcatalog_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_defaultspcatalog_l_url","displayName":"URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_disableallcatalogs","displayName":"Block Web Add-ins (User)","description":"This policy setting allows you to prevent users from using web add-ins.\r\n\r\nIf you enable this policy setting, web add-ins are blocked and all other policy settings in the Trusted Catalogs folder are ignored.\r\n\r\nIf you disable or do not configure this policy setting, apps are allowed. Other policy settings in the Trusted Catalogs folder determine which specific app sources are allowed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_disableallcatalogs_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_disableallcatalogs_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_disableofficestore","displayName":"Block the Office Store (User)","description":"This policy setting allows you to prevent users from using or inserting web add-ins that come from the Office Store.\r\n\r\nIf you enable this policy setting, apps from the Office Store are blocked.\r\n\r\nIf you disable or do not configure this policy setting, apps from the Office Store are allowed, unless the \"Block Apps for Office\" policy setting is enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_disableofficestore_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_disableofficestore_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog01","displayName":"Trusted Catalog Location #1 (User)","description":"This policy setting sets the URL location of a Trusted SharePoint Catalog or Shared Folder Catalog. All web add-ins at this location are trusted so that users can work with these add-ins in their documents. However, the user cannot insert these add-ins into an Office document.\r\n\r\nIf you enable this policy setting and set the URL, users can work with web add-ins from the SharePoint Catalog or Shared Folder Catalog at that URL.\r\n\r\nIf you disable this policy setting, users will not be able to work with any web add-ins on Internet zone catalogs, and they will be prompted before they start web add-ins from any other catalogs.\r\n\r\nIf you do not configure this policy setting or any others in the Trusted Catalogs folder, users can set their own Trusted Sharepoint Catalog and Shared Folder Catalog locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog01_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog01_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog01_l_url","displayName":"URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog02","displayName":"Trusted Catalog Location #2 (User)","description":"This policy setting sets the URL location of a Trusted SharePoint Catalog or Shared Folder Catalog. All web add-ins at this location are trusted so that users can work with these add-ins in their documents. However, the user cannot insert these add-ins into an Office document.\r\n\r\nIf you enable this policy setting and set the URL, users can work with web add-ins from the SharePoint Catalog or Shared Folder Catalog at that URL.\r\n\r\nIf you disable this policy setting, users will not be able to work with any web add-ins on Internet zone catalogs, and they will be prompted before they start web add-ins from any other catalogs.\r\n\r\nIf you do not configure this policy setting or any others in the Trusted Catalogs folder, users can set their own Trusted Sharepoint Catalog and Shared Folder Catalog locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog02_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog02_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog02_l_url","displayName":"URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog03","displayName":"Trusted Catalog Location #3 (User)","description":"This policy setting sets the URL location of a Trusted SharePoint Catalog or Shared Folder Catalog. All web add-ins at this location are trusted so that users can work with these add-ins in their documents. However, the user cannot insert these add-ins into an Office document.\r\n\r\nIf you enable this policy setting and set the URL, users can work with web add-ins from the SharePoint Catalog or Shared Folder Catalog at that URL.\r\n\r\nIf you disable this policy setting, users will not be able to work with any web add-ins on Internet zone catalogs, and they will be prompted before they start web add-ins from any other catalogs.\r\n\r\nIf you do not configure this policy setting or any others in the Trusted Catalogs folder, users can set their own Trusted Sharepoint Catalog and Shared Folder Catalog locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog03_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog03_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog03_l_url","displayName":"URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog04","displayName":"Trusted Catalog Location #4 (User)","description":"This policy setting sets the URL location of a Trusted SharePoint Catalog or Shared Folder Catalog. All web add-ins at this location are trusted so that users can work with these add-ins in their documents. However, the user cannot insert these add-ins into an Office document.\r\n\r\nIf you enable this policy setting and set the URL, users can work with web add-ins from the SharePoint Catalog or Shared Folder Catalog at that URL.\r\n\r\nIf you disable this policy setting, users will not be able to work with any web add-ins on Internet zone catalogs, and they will be prompted before they start web add-ins from any other catalogs.\r\n\r\nIf you do not configure this policy setting or any others in the Trusted Catalogs folder, users can set their own Trusted Sharepoint Catalog and Shared Folder Catalog locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog04_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog04_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog04_l_url","displayName":"URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog05","displayName":"Trusted Catalog Location #5 (User)","description":"This policy setting sets the URL location of a Trusted SharePoint Catalog or Shared Folder Catalog. All web add-ins at this location are trusted so that users can work with these add-ins in their documents. However, the user cannot insert these add-ins into an Office document.\r\n\r\nIf you enable this policy setting and set the URL, users can work with web add-ins from the SharePoint Catalog or Shared Folder Catalog at that URL.\r\n\r\nIf you disable this policy setting, users will not be able to work with any web add-ins on Internet zone catalogs, and they will be prompted before they start web add-ins from any other catalogs.\r\n\r\nIf you do not configure this policy setting or any others in the Trusted Catalogs folder, users can set their own Trusted Sharepoint Catalog and Shared Folder Catalog locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog05_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog05_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog05_l_url","displayName":"URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog06","displayName":"Trusted Catalog Location #6 (User)","description":"This policy setting sets the URL location of a Trusted SharePoint Catalog or Shared Folder Catalog. All web add-ins at this location are trusted so that users can work with these add-ins in their documents. However, the user cannot insert these add-ins into an Office document.\r\n\r\nIf you enable this policy setting and set the URL, users can work with web add-ins from the SharePoint Catalog or Shared Folder Catalog at that URL.\r\n\r\nIf you disable this policy setting, users will not be able to work with any web add-ins on Internet zone catalogs, and they will be prompted before they start web add-ins from any other catalogs.\r\n\r\nIf you do not configure this policy setting or any others in the Trusted Catalogs folder, users can set their own Trusted Sharepoint Catalog and Shared Folder Catalog locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog06_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog06_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog06_l_url","displayName":"URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog07","displayName":"Trusted Catalog Location #7 (User)","description":"This policy setting sets the URL location of a Trusted SharePoint Catalog or Shared Folder Catalog. All web add-ins at this location are trusted so that users can work with these add-ins in their documents. However, the user cannot insert these add-ins into an Office document.\r\n\r\nIf you enable this policy setting and set the URL, users can work with web add-ins from the SharePoint Catalog or Shared Folder Catalog at that URL.\r\n\r\nIf you disable this policy setting, users will not be able to work with any web add-ins on Internet zone catalogs, and they will be prompted before they start web add-ins from any other catalogs.\r\n\r\nIf you do not configure this policy setting or any others in the Trusted Catalogs folder, users can set their own Trusted Sharepoint Catalog and Shared Folder Catalog locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog07_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog07_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog07_l_url","displayName":"URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog08","displayName":"Trusted Catalog Location #8 (User)","description":"This policy setting sets the URL location of a Trusted SharePoint Catalog or Shared Folder Catalog. All web add-ins at this location are trusted so that users can work with these add-ins in their documents. However, the user cannot insert these add-ins into an Office document.\r\n\r\nIf you enable this policy setting and set the URL, users can work with web add-ins from the SharePoint Catalog or Shared Folder Catalog at that URL.\r\n\r\nIf you disable this policy setting, users will not be able to work with any web add-ins on Internet zone catalogs, and they will be prompted before they start web add-ins from any other catalogs.\r\n\r\nIf you do not configure this policy setting or any others in the Trusted Catalogs folder, users can set their own Trusted Sharepoint Catalog and Shared Folder Catalog locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog08_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog08_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog08_l_url","displayName":"URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog09","displayName":"Trusted Catalog Location #9 (User)","description":"This policy setting sets the URL location of a Trusted SharePoint Catalog or Shared Folder Catalog. All web add-ins at this location are trusted so that users can work with these add-ins in their documents. However, the user cannot insert these add-ins into an Office document.\r\n\r\nIf you enable this policy setting and set the URL, users can work with web add-ins from the SharePoint Catalog or Shared Folder Catalog at that URL.\r\n\r\nIf you disable this policy setting, users will not be able to work with any web add-ins on Internet zone catalogs, and they will be prompted before they start web add-ins from any other catalogs.\r\n\r\nIf you do not configure this policy setting or any others in the Trusted Catalogs folder, users can set their own Trusted Sharepoint Catalog and Shared Folder Catalog locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog09_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog09_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog09_l_url","displayName":"URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog10","displayName":"Trusted Catalog Location #10 (User)","description":"This policy setting sets the URL location of a Trusted SharePoint Catalog or Shared Folder Catalog. All web add-ins at this location are trusted so that users can work with these add-ins in their documents. However, the user cannot insert these add-ins into an Office document.\r\n\r\nIf you enable this policy setting and set the URL, users can work with web add-ins from the SharePoint Catalog or Shared Folder Catalog at that URL.\r\n\r\nIf you disable this policy setting, users will not be able to work with any web add-ins on Internet zone catalogs, and they will be prompted before they start web add-ins from any other catalogs.\r\n\r\nIf you do not configure this policy setting or any others in the Trusted Catalogs folder, users can set their own Trusted Sharepoint Catalog and Shared Folder Catalog locations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog10_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog10_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_trustedcatalogs_l_trustedcatalog10_l_url","displayName":"URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_adattributecontaingpersonalsiteurl","displayName":"AD attribute containing Personal Site URL (User)","description":"The Office client updates the User object in the Active Directory with the URL of the user's personal site. Please enter the attribute of the user object which Office should update. The default is \"wwwHomePage\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_adattributecontaingpersonalsiteurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_adattributecontaingpersonalsiteurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_adattributecontaingpersonalsiteurl_l_empty424","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_allowfilesynchronizationviasoaponlyondomainnetworks","displayName":"Allow file synchronization via SOAP over HTTP only on domain networks (User)","description":"This policy setting controls file synchronization via SOAP over HTTP.\r\n\r\nIf you enable this policy setting, file synchronization via SOAP over HTTP is allowed only on domain networks. \r\n\r\nIf you disable or do not configure this policy setting, file synchronization via SOAP over HTTP functions on all networks.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_allowfilesynchronizationviasoaponlyondomainnetworks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_allowfilesynchronizationviasoaponlyondomainnetworks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_catalogrefreshperiod","displayName":"Catalog Refresh Period (User)","description":"This policy setting sets the apps for Office catalog refresh period, which is the amount of time (hours) Office waits between refreshes of the app catalogs. Refreshing the catalogs detects whether entitlements to any apps have expired.\r\n\r\nIf you enable this policy setting, set the number of hours to determine the length of the refresh period. Choose a value between 0 (always refresh) and 10,000.\r\n\r\nIf you disable or do not configure this policy setting, the catalog refresh period is set to the default 72 hours.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_catalogrefreshperiod_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_catalogrefreshperiod_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_catalogrefreshperiod_l_empty601","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_disabletheofficeclientfrompolling","displayName":"Disable the Office client from polling the SharePoint Server for published links (User)","description":"This policy setting controls whether Office 2016 applications can poll Office servers to retrieve lists of published links. \r\n\r\nIf you enable this policy setting, Office 2016 applications cannot poll an Office server for published links. \r\n\r\nIf you disable or do not configure this policy setting, users of Office 2016 applications can see and use links to Microsoft SharePoint Server sites from those applications. You can configure published links to Office applications during initial deployment, and can add or change links as part of regular operations. These links appear on the My SharePoint Sites tab of the Open, Save, and Save As dialog boxes when opening and saving documents from these applications. Links can be targeted so that they only appear to users who are members of particular audiences. \r\n\r\nNote - This policy setting applies to Microsoft SharePoint Server specifically. It does not apply to Microsoft SharePoint Foundation.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_disabletheofficeclientfrompolling_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_disabletheofficeclientfrompolling_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_disabletheuserfromsettingthepersonalsiteurl","displayName":"Disable the user from setting the Personal Site URL (User)","description":"This setting will disable the Office client applications from setting the personal site URL in the Active Directory.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_disabletheuserfromsettingthepersonalsiteurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_disabletheuserfromsettingthepersonalsiteurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_foldernameforpublishedlinks","displayName":"Folder name for Published Links (User)","description":"The folder name used to store network folder shortcuts published from SharePoint Server. \"My SharePoints\" (localized) by default.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_foldernameforpublishedlinks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_foldernameforpublishedlinks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_foldernameforpublishedlinks_l_empty427","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_frequencyforpollingtheservertodownload","displayName":"Frequency for polling the server to download published links (User)","description":"Minimum time to wait (in seconds) before polling SharePoint Server to download published links.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_frequencyforpollingtheservertodownload_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_frequencyforpollingtheservertodownload_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_frequencyforpollingtheservertodownload_l_empty426","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_lengthadattributecontainingpersonalsiteurl","displayName":"Length AD Attribute containing Personal Site URL (User)","description":"The Office client updates the User object in the Active Directory with the URL of the user's personal site. Please enter the length of URL that the attribute can accept. The default is 2048.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_lengthadattributecontainingpersonalsiteurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_lengthadattributecontainingpersonalsiteurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_lengthadattributecontainingpersonalsiteurl_l_empty425","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_turnonfilesynchronizationviasoapoverhttp","displayName":"Turn on file synchronization via SOAP over HTTP (User)","description":"This policy setting controls file synchronization via SOAP over HTTP.\r\n\r\nIf you enable or do not configure this policy setting, file synchronization via SOAP over HTTP is turned on. Turning file synchronization on here will still allow application-specific file synchronization to be turned off.\r\n\r\nIf you disable this policy setting this policy setting, file synchronization via SOAP over HTTP is turned off. You will turn off file synchronization via SOAP over HTTP for other applications even if the application-specific file synchronization is turned on.\r\n\r\nImportant: If you disable this policy setting, which will turn off file synchronization via SOAP over HTTP, you will also prevent co-authoring for Word and PowerPoint, and it will adversely affect the behavior of SharePoint Workspaces.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_turnonfilesynchronizationviasoapoverhttp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings_l_turnonfilesynchronizationviasoapoverhttp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_enablecolleagueimportoutlookaddintowork","displayName":"Enable Colleague Import Outlook Add-in to work with Microsoft SharePoint Server (User)","description":"This setting will enable the Colleague Import Outlook Add-in.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_enablecolleagueimportoutlookaddintowork_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_enablecolleagueimportoutlookaddintowork_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofdaystoscanfromtodaytodetermine","displayName":"Maximum number of days to scan from today to determine the user's colleagues for recommendation (User)","description":"The maximum number of days to scan the Outlook mailbox to determine the colleagues the user has. The larger the number, the more accurate the recommendation. The smaller the number, the faster the recommendations are generated.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofdaystoscanfromtodaytodetermine_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofdaystoscanfromtodaytodetermine_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofdaystoscanfromtodaytodetermine_l_empty429","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofitemstoscanfromtoday","displayName":"Maximum number of items to scan from today to determine the user's colleagues for recommendation (User)","description":"The maximum number of items to scan in the Outlook mailbox to determine the colleagues the user has. The larger the number, the more accurate the recommendation. The smaller the number, the faster the recommendations are generated.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofitemstoscanfromtoday_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofitemstoscanfromtoday_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofitemstoscanfromtoday_l_empty428","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofreceipientsinanoutlookitem","displayName":"Maximum number of recipients in an Outlook item to scan to determine the user's colleagues for recommendation (User)","description":"The maximum number of recipients in an Outlook item to scan to determine the colleagues the user has. The larger the number, the more accurate the recommendation. The smaller the number, the faster the recommendations are generated.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofreceipientsinanoutlookitem_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofreceipientsinanoutlookitem_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofreceipientsinanoutlookitem_l_empty430","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofrows","displayName":"Maximum number of rows fetched per request while populating a lookup in the SharePoint list control (User)","description":"The maximum number of rows fetched per request while populating a lookup in the SharePoint list control. Based on a standalone server's recommended hardware configuration a good default would be about 5000. The limit helps improve the performance of the SharePoint list control and is a defense in depth measure to prevent loading the server.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofrows_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofrows_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofrows_l_empty433","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofrows_l_empty433_0","displayName":"Default","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofrows_l_empty433_1","displayName":"1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofrows_l_empty433_100","displayName":"100","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofrows_l_empty433_450","displayName":"450","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_maximumnumberofrows_l_empty433_5000","displayName":"5000","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_minimumtimebeforestartingcolleague","displayName":"Minimum time before starting Colleague recommendation scan (User)","description":"The minimum idle time (in milliseconds) to wait before the Colleague Import Outlook add-in begins to scan the mailbox.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_minimumtimebeforestartingcolleague_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_minimumtimebeforestartingcolleague_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_minimumtimebeforestartingcolleague_l_empty431","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_minimumtimetowaitbeforerescanning","displayName":"Minimum time to wait before rescanning the Outlook mailbox for new colleague recommendations (User)","description":"The minimum time (in hours) to wait before rescanning the Outlook mailbox for new colleague recommendations.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_minimumtimetowaitbeforerescanning_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_minimumtimetowaitbeforerescanning_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_serversettings~l_sharepointserver_l_minimumtimetowaitbeforerescanning_l_empty432","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_services_l_disableofficeuserroamingsettings","displayName":"Disable Roaming Office User Settings (User)","description":"Microsoft Office includes the ability to roam settings for specific Office features amongst devices by storing this data in the cloud. This data includes user activity such as the list of most recently used documents as well as user preferences such as the Office theme. This policy setting controls whether this data is allowed to be stored in the cloud. \r\n\r\nIf you enable this policy setting, roaming settings are only stored locally and not synchronized to the Microsoft Office roaming settings web service. \r\n\r\nIf you disable or do not configure this policy setting, roaming settings are synchronized with the Microsoft Office roaming settings web service and users can access their data from other devices. \r\n\r\nExisting data in the cloud is not affected by this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_services_l_disableofficeuserroamingsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_services_l_disableofficeuserroamingsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_services~l_fax_l_disablefaxoverinternetfeature","displayName":"Disable Internet Fax feature (User)","description":"This policy setting determines whether users can access the Internet Fax feature in Office 2016 applications. \r\n\r\nIf you enable this policy setting, Office 2016 users cannot send Internet faxes, and the Internet Fax menu item is removed from the Send sub-menu of the Microsoft Office menu. \r\n\r\nIf you disable or do not configure this policy setting, Office 2016 users can use the Internet Fax feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_services~l_fax_l_disablefaxoverinternetfeature_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_services~l_fax_l_disablefaxoverinternetfeature_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_services~l_fax_l_disallowcustomcoversheet","displayName":"Disallow custom cover sheet (User)","description":"Disables the custom fax cover sheet by displaying the message, \"This option has been disabled by administrative policy\" when the user clicks the Custom button in the Fax Service pane of the email message.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_services~l_fax_l_disallowcustomcoversheet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_services~l_fax_l_disallowcustomcoversheet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_enterprisetemplatespath","displayName":"Enterprise templates path (User)","description":"Specifies the location of enterprise templates.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_enterprisetemplatespath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_enterprisetemplatespath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_enterprisetemplatespath_l_enterprisetemplatespath329","displayName":"Enterprise templates path (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_setuserpathforthelabelpagesizeupdatefiles","displayName":"Set User path for the label page size update files (User)","description":"This policy setting allows you to override the User path for the label page size update files. \r\n\r\nIf you enable this policy setting, you may enter the path to the PSX update files and override the User path.\r\n\r\nIf you disable or do not configure this policy setting, the User path for the label page size update files remains valid.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_setuserpathforthelabelpagesizeupdatefiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_setuserpathforthelabelpagesizeupdatefiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_setuserpathforthelabelpagesizeupdatefiles_l_setuserpathforthelabelpagesizeupdatefilesid","displayName":"User path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_setworkgrouppathforlabelpagesizeupdatefiles","displayName":"Set Workgroup path for label page size update files (User)","description":"This policy setting allows you to specify the Workgroup path for the label page size update files. This is useful if the organization has a centralized template depot. \r\n\r\nIf you enable this policy setting, you may enter the path to the PSX update files.\r\n\r\nIf you disable or do not configure this policy setting, there is no Workgroup path for the shared label templates.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_setworkgrouppathforlabelpagesizeupdatefiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_setworkgrouppathforlabelpagesizeupdatefiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_setworkgrouppathforlabelpagesizeupdatefiles_l_setworkgrouppathforlabelpagesizeupdatefilesid","displayName":"Workgroup path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_sharedthemespath","displayName":"Shared themes path (User)","description":"Specifies the location of workgroup themes.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_sharedthemespath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_sharedthemespath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_sharedthemespath_l_sharedthemespath330","displayName":"Shared themes path (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_userqueriespath","displayName":"User queries path (User)","description":"Specifies the location of data sources for database queries.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_userqueriespath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_userqueriespath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_userqueriespath_l_userqueriespath331","displayName":"User queries path (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_usertemplatespath","displayName":"User templates path (User)","description":"Specifies the location of user templates.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_usertemplatespath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_usertemplatespath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_usertemplatespath_l_usertemplatespath328","displayName":"User templates path (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_webquerydialoghomepage","displayName":"Web Query dialog box home page (User)","description":"Specifies the default location of the home page for Web queries.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_webquerydialoghomepage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_webquerydialoghomepage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_webquerydialoghomepage_l_webquerydialoghomepage333","displayName":"Web Query dialog box home page (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_workgroupbuildingblockspath","displayName":"Workgroup building blocks path (User)","description":"Specifies the location of workgroup building block templates.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_workgroupbuildingblockspath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_workgroupbuildingblockspath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_workgroupbuildingblockspath_l_path2","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_workgrouptemplatespath","displayName":"Workgroup templates path (User)","description":"Specifies the location of workgroup templates.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_workgrouptemplatespath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_workgrouptemplatespath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_sharedpaths_l_workgrouptemplatespath_l_workgrouptemplatespath329","displayName":"Workgroup templates path (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_ekufiltering","displayName":"EKU filtering (User)","description":"This policy setting allows you to specify enhanced key usage (EKU) values to be used in filtering a list of digital certificates for signing Excel, PowerPoint, and Word documents. An enhanced key usage (EKU) extension to a digital certificate is a collection of one or more values that indicate how a certificate should be used. Examples of EKU values include Smart Card Logon and Client Authentication. EKU filtering allows you to filter the list of installed certificates that can be used for digitally signing documents. The filtered list will appear when users attempt to select a certificate for digitally signing a document. \r\n\r\nIf you enable this policy setting, you can specify a list of object identifiers (OIDs) that represent acceptable EKUs for certificates used in conjunction with signed documents. For example, for a certificate with the Encrypting File System (1.3.6.1.4.1.311.10.3.4) identifier, the OID is 1.3.6.1.4.1.311.10.3.4. This list of appropriate OIDs will vary according to the specific certificates that the organization uses. For a list of object IDs associated with Microsoft cryptography, see Microsoft Knowledge Base article 287547, \"Object IDs associated with Microsoft cryptography\" at http://officeredir.microsoft.com/r/rlidGPOIDAndCrypt2O14?clid=1033. \r\n\r\nIf you disable or do not configure this policy setting, EKU filtering is not available.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_ekufiltering_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_ekufiltering_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_ekufiltering_l_empty412","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_legacyformatsignatires","displayName":"Legacy format signatures (User)","description":"This policy setting controls whether users can apply binary format digital signatures to Office 97-2003 documents. \r\n\r\nIf you enable this policy setting, Office 2016 applications use the Office 2003 binary format to apply digital signatures to Office 97-2003 binary documents so that they will be recognized by the Office 2003 release and earlier applications. \r\n\r\nIf you disable or do not configure this policy setting, Office 2016 applications use the XML--based XMLDSIG format to attach digital signatures to documents, including Office 97-2003 binary documents. XMLDSIG signatures are not recognized by Office 2003 applications or previous versions. If an Office 2003 user opens an Excel, PowerPoint, or Word binary document with an XMLDSIG signature attached, the signature will be lost.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_legacyformatsignatires_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_legacyformatsignatires_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_setdefaultimagedirctory","displayName":"Set default image directory (User)","description":"Sets the default directory for signing images (defaults to your pictures otherwise).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_setdefaultimagedirctory_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_setdefaultimagedirctory_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_setdefaultimagedirctory_l_setdefaultimagedirctorypart","displayName":"Last-used signature image directory: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_supressexternalsigningservicesmenuitems","displayName":"Suppress external signature services menu item (User)","description":"This policy setting controls whether Outlook displays the \"Add Signature Services\" menu item. \r\n\r\nIf you enable this policy setting, Outlook does not display the \"Add Signature Services\" menu item on the Signature Line drop-down menu. \r\n\r\nIf you disable or do not configure this policy setting, users can select \"Add Signature Services\" (from the Signature Line drop-down menu on the Insert tab of the Ribbon in Excel, PowerPoint, and Word) to see a list of signature service providers on Office.com.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_supressexternalsigningservicesmenuitems_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_supressexternalsigningservicesmenuitems_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_supressofficesigningproviders","displayName":"Suppress Office Signing Providers (User)","description":"This policy setting controls whether users can apply a default Microsoft Office signature line to Word documents and Excel workbooks. Digital signatures provide assurances of authenticity, integrity, and non-repudiation to electronic documents. In Excel and Word, users can add visible representations of their signatures to a document at the same time that they add digital signatures. The ability to capture digital signatures by using signature lines in Office 2016 documents makes it possible for organizations to use paperless signing processes for documents such as contracts or other agreements. \r\n\r\nIf you enable this policy setting, you can choose from four options for enabling the default Microsoft Office 2016 signature lines: \r\n\r\n- Enable Western and East Asian - Both Microsoft Office Signature Line and Stamp Signature Line are available from the Signature Line drop-down menu on the Insert tab of the Ribbon. \r\n\r\n- Suppress default Western - Users cannot add the Microsoft Office Signature Line to documents. \r\n\r\n- Suppress default East Asian - Users cannot add the Stamp Signature Line to documents. \r\n\r\n- Suppress both Western and East Asian. Neither of the default signature lines is available. This only takes affect if there is at least one other valid third party signature provider installed. \r\n\r\nIf you disable or do not configure this policy setting, Excel and Word include support for two kinds of signature lines, called Microsoft Office Signature Line and Stamp Signature Lines. The choice(s) available to the user vary according to the editing language(s) that are configured for the application at installation. \r\n\r\n- Microsoft Office Signature Line displays the letter \"X\" followed by a horizontal line, a familiar convention for handwritten signature lines. \r\n\r\n- Stamp Signature Line is only available to users of the Simplified Chinese, Traditional Chinese, Japanese, or Korean language versions of Office 2016, or to users who have installed Office 2016 Multi-Language Pack for one of these languages. This signature line displays a square, a convention in countries where rubber identity stamps (called hanko in Japan and South Korea) are used to sign documents. \r\n\r\nBoth kinds of signature lines allow signers to specify their name, title, and e-mail address. If neither kind of signature line is appropriate, third-party signature products can be added to Office applications to serve different needs. \r\n\r\nIf the correct signature line is not available for users to choose, they might be prevented from digitally signing documents. \r\n\r\nNote - This policy setting only applies to visible signature lines in Excel workbooks and Word documents. It does not affect the ability of users to add invisible digital signatures to Excel workbooks, PowerPoint presentations, and Word documents.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_supressofficesigningproviders_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_supressofficesigningproviders_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_supressofficesigningproviders_l_empty413","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_supressofficesigningproviders_l_empty413_0","displayName":"Enable Western and East Asian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_supressofficesigningproviders_l_empty413_1","displayName":"Suppress default Western","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_supressofficesigningproviders_l_empty413_2","displayName":"Suppress default East Asian","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_signing_l_supressofficesigningproviders_l_empty413_3","displayName":"Suppress both Western and East Asian","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_smartdocumentswordexcel_l_completelydisablethesmartdocumentsfeatureinwordandexcel","displayName":"Completely disable the Smart Documents feature in Word and Excel (User)","description":"This policy setting allows you to configure the ability to run smart documents in Word or Excel. However, since XML expansion packs can include many types of solutions in addition to smart document solutions, this policy setting cannot be used to disable the ability to run XML expansion packs.\r\n\r\nIf you enable this policy setting, smart document solutions will not run. To fully manage the Smart Documents feature, this policy and the \"Disable Smart Document's use of manifests\" policy should both be configured.\r\n\r\nIf you disable or do not configure this policy setting, smart document solutions will run.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_smartdocumentswordexcel_l_completelydisablethesmartdocumentsfeatureinwordandexcel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_smartdocumentswordexcel_l_completelydisablethesmartdocumentsfeatureinwordandexcel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_smartdocumentswordexcel_l_disablesmartdocumentsuseofmanifests","displayName":"Disable Smart Document's use of manifests (User)","description":"This policy setting controls whether Office 2016 applications can load an XML expansion pack manifest file with a Smart Document. \r\n\r\nAn XML expansion pack is the group of files that constitutes a Smart Document in Excel and Word. You package one or more components that provide the logic needed for a Smart Document by using an XML expansion pack. These components can include any type of file, including XML schemas, Extensible Stylesheet Language Transforms (XSLTs), dynamic-link libraries (DLLs), and image files, as well as additional XML files, HTML files, Word files, Excel files, and text files. \r\n\r\nThe key component to building an XML expansion pack is creating an XML expansion pack manifest file. By creating this file, you specify the locations of all files that make up the XML expansion pack, as well as information that instructs Office 2016 how to set up the files for your Smart Document. The XML expansion pack can also contain information about how to set up some files, such as how to install and register a COM object required by the XML expansion pack. \r\n\r\nIf you enable this policy setting, Office 2016 applications cannot load XML expansion packs with Smart Documents. \r\n\r\nIf you disable or do not configure this policy setting, Office 2016 applications can load an XML expansion pack manifest file with a Smart Document.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_smartdocumentswordexcel_l_disablesmartdocumentsuseofmanifests_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_smartdocumentswordexcel_l_disablesmartdocumentsuseofmanifests_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_subscriptionactivation_l_autoorgidgetkey","displayName":"Automatically activate Office with federated organization credentials (User)","description":"This policy setting activates Office on users’ computers without prompting them to sign in to their Office 365 accounts.\r\n\r\nIf you enable or do not configure this policy setting, and a user is already signed in with federated organization credentials, Office automatically activates when the user first starts an Office application. If either multiple or no organization credentials are found, the user is prompted to sign in.\r\n\r\nIf you disable this policy setting, Office might prompt the user to sign in with their organization's credentials if Office is not installed directly by the user from his or her Office 365 account homepage.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_subscriptionactivation_l_autoorgidgetkey_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_subscriptionactivation_l_autoorgidgetkey_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_subscriptionactivation_l_hidemanageaccountlink","displayName":"Do not show \"Manage Account\" link for subscription licenses. (User)","description":"This policy setting controls whether a \"Manage Account\" link is exposed in Account tab of the File menu for subscription licenses.\r\n\r\nIf you enable this policy setting, Office does not expose a \"Manage Account\" link for subscription licenses.\r\n\r\nIf you disable or do not configure this policy setting, Office exposes a \"Manage Account\" link for subscription licenses.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_subscriptionactivation_l_hidemanageaccountlink_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_subscriptionactivation_l_hidemanageaccountlink_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_enablelogging","displayName":"Turn on telemetry data collection (User)","description":"This policy setting allows you to turn on the data collection features in Office that are used by Office Telemetry Dashboard and Office Telemetry Log.\r\n\r\nIf you enable this policy setting, Office Telemetry Agent and Office applications will collect telemetry data, which includes Office application usage, most recently used Office documents (including file names) and solutions usage, compatibility issues, and critical errors that occur on the local computers. You can use Office Telemetry Dashboard to view this data remotely, and users can use Office Telemetry Log to view this data on their local computers.\r\n\r\nIf you disable or do not configure this policy setting, Office Telemetry Agent and Office applications do not generate or collect telemetry data.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_enablelogging_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_enablelogging_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeinventoryagentfilemetadataobfuscation","displayName":"Turn on privacy settings in Office Telemetry Agent (User)","description":"This policy setting configures Office Telemetry Agent to disguise, or obfuscate, certain file properties that are reported in telemetry data.\r\n\r\nIf you enable this policy setting, Office Telemetry Agent obfuscates the file name, file path, and title of Office documents before uploading telemetry data to the shared folder.\r\n\r\nIf you disable or do not configure this policy setting, Office Telemetry Agent uploads telemetry data that shows the full file name, file path, and title of all Office documents.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeinventoryagentfilemetadataobfuscation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeinventoryagentfilemetadataobfuscation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeinventoryagentupload","displayName":"Turn on data uploading for Office Telemetry Agent (User)","description":"This policy setting turns on the data uploading feature in Office Telemetry Agent.\r\n\r\nIf you enable this policy setting, Office Telemetry Agent periodically uploads telemetry data to a shared folder.\r\n\r\nIf you disable or do not configure this policy setting, Office Telemetry Agent does not upload any data. However, telemetry data is still collected on the local computer and can be viewed by using Office Telemetry Log.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeinventoryagentupload_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeinventoryagentupload_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmcommonfileshare","displayName":"Specify the UNC path to store Office telemetry data (User)","description":"This policy setting allows you to specify the Uniform Naming Convention (UNC) path of a shared folder to which Office Telemetry Agent sends Office telemetry data.\r\n\r\nIf you enable this policy setting, Office Telemetry Agent uploads Office telemetry data to the UNC path that you specify. Use the format \\\\Server_Name\\Share_Name.\r\n\r\nIf you disable or do not configure this policy setting, Office Telemetry Agent does not send the data, and you cannot see any data in Office Telemetry Dashboard.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmcommonfileshare_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmcommonfileshare_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmcommonfileshare_l_officeosmcommonfilesharefileshare","displayName":"UNC path to store Office telemetry data: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmcustomtags","displayName":"Specify custom tags for Office telemetry data (User)","description":"This policy setting allows you to add custom tags to the Office telemetry data that is sent by Office Telemetry Agent.\r\n\r\nIf you enable this policy setting, the specified custom tags are shown in Office Telemetry Dashboard, where you can filter the collected data by the tag name. You can specify any string that you want to categorize and filter the collected data (for example, department name, title of user, and so forth).\r\n\r\nIf you disable or do not configure this policy setting, no custom tags are shown in Office Telemetry Dashboard, and you cannot filter the data that is sent by Office Telemetry Agent.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmcustomtags_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmcustomtags_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmcustomtags_l_officeosmcustomtagstag1","displayName":"Tag 1: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmcustomtags_l_officeosmcustomtagstag2","displayName":"Tag 2: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmcustomtags_l_officeosmcustomtagstag3","displayName":"Tag 3: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmcustomtags_l_officeosmcustomtagstag4","displayName":"Tag 4: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications","displayName":"Office applications to exclude from Office Telemetry Agent reporting (User)","description":"This policy setting allows you to prevent telemetry data for Office applications from being reported to Office Telemetry Dashboard.\r\n\r\nIf you enable this policy setting, Office Telemetry Agent does not upload telemetry data for the specified Office applications to Office Telemetry Dashboard.\r\n\r\nIf you disable or do not configure this policy setting, Office Telemetry Agent uploads telemetry data for all Office applications.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsaccess","displayName":"Access-related solutions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsaccess_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsaccess_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsexcel","displayName":"Excel-related solutions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsexcel_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsexcel_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsonenote","displayName":"OneNote-related solutions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsonenote_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsonenote_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsoutlook","displayName":"Outlook-related solutions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsoutlook_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsoutlook_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationspowerpoint","displayName":"PowerPoint-related solutions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationspowerpoint_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationspowerpoint_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsproject","displayName":"Project-related solutions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsproject_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsproject_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationspublisher","displayName":"Publisher-related solutions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationspublisher_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationspublisher_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsvisio","displayName":"Visio-related solutions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsvisio_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsvisio_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsword","displayName":"Word-related solutions (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsword_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedhostapplications_l_officeosmpreventedhostapplicationsword_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedsolutiontypes","displayName":"Office solutions to exclude from Office Telemetry Agent reporting (User)","description":"This policy setting allows you to prevent telemetry data for Office solutions from being reported to Office Telemetry Dashboard.\r\n\r\nIf you enable this policy setting, Office Telemetry Agent does not upload telemetry data for the specified Office solutions to Office Telemetry Dashboard.\r\n\r\nIf you disable or do not configure this policy setting, Office Telemetry Agent uploads telemetry data for all available solution types.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedsolutiontypes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedsolutiontypes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedsolutiontypes_l_officeosmpreventedsolutiontypesagave","displayName":"Web Add-ins (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedsolutiontypes_l_officeosmpreventedsolutiontypesagave_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedsolutiontypes_l_officeosmpreventedsolutiontypesagave_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedsolutiontypes_l_officeosmpreventedsolutiontypesappaddins","displayName":"Application-specific add-ins (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedsolutiontypes_l_officeosmpreventedsolutiontypesappaddins_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedsolutiontypes_l_officeosmpreventedsolutiontypesappaddins_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedsolutiontypes_l_officeosmpreventedsolutiontypescomaddins","displayName":"COM add-ins (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedsolutiontypes_l_officeosmpreventedsolutiontypescomaddins_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedsolutiontypes_l_officeosmpreventedsolutiontypescomaddins_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedsolutiontypes_l_officeosmpreventedsolutiontypesdocumentfiles","displayName":"Office document files (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedsolutiontypes_l_officeosmpreventedsolutiontypesdocumentfiles_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedsolutiontypes_l_officeosmpreventedsolutiontypesdocumentfiles_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedsolutiontypes_l_officeosmpreventedsolutiontypestemplatefiles","displayName":"Office template files (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedsolutiontypes_l_officeosmpreventedsolutiontypestemplatefiles_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_telemetrydashboard_l_officeosmpreventedsolutiontypes_l_officeosmpreventedsolutiontypestemplatefiles_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess_l_capitalizefirstletterofsentence","displayName":"Capitalize first letter of sentence (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess_l_capitalizefirstletterofsentence_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess_l_capitalizefirstletterofsentence_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess_l_capitalizenamesofdays","displayName":"Capitalize names of days (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess_l_capitalizenamesofdays_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess_l_capitalizenamesofdays_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess_l_correctaccidentaluseofcapslockkey","displayName":"Correct accidental use of cAPS LOCK key (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess_l_correctaccidentaluseofcapslockkey_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess_l_correctaccidentaluseofcapslockkey_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess_l_correcttwoinitialcapitals","displayName":"Correct TWo INitial CApitals (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess_l_correcttwoinitialcapitals_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess_l_correcttwoinitialcapitals_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess_l_replacetextasyoutype","displayName":"Replace text as you type (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess_l_replacetextasyoutype_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess_l_replacetextasyoutype_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess_l_showautocorrectoptionsbuttons","displayName":"Show AutoCorrect Options buttons (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess_l_showautocorrectoptionsbuttons_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess_l_showautocorrectoptionsbuttons_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess~l_additionalactions_l_checkfornewactionsurl","displayName":"Check for new actions URL (User)","description":"This policy setting allows you to configure the \"Check for New Actions\" menu option.\r\n\r\nIf you enable this policy setting, and when a URL is specified, a new \"Check for New Actions\" menu option will be added to the \"Additional Actions\" context menu.\r\n\r\nIf you disable or do not configure this policy setting, or when it is enabled and a URL is not specified, a \"Check for New Actions\" menu option will not be shown in the \"Additional Actions\" context menu.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess~l_additionalactions_l_checkfornewactionsurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess~l_additionalactions_l_checkfornewactionsurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess~l_additionalactions_l_checkfornewactionsurl_l_checkfornewactionsurl231","displayName":"Check for new actions URL (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess~l_additionalactions_l_enableadditionalactionsinexcel","displayName":"Enable additional actions in Excel (User)","description":"This policy setting controls whether Excel can provide additional actions for certain words and phrases in a workbook through the right-click menu, and whether users can configure this behavior by checking or unchecking the \"Enable additional actions in the right-click menu\" option under the File tab | Options | Proofing | AutoCorrect Options | Actions tab. If additional actions functionality is turned on, Excel can recognize dates and financial symbols and provide additional actions for them.\r\n\r\nIf you enable or do not configure this policy setting, users can configure Excel to provide additional actions. Note: Excel does not provide additional actions until users check the \"Enable additional actions in the right-click menu\" option in the UI.\r\n\r\nIf you disable this policy setting, users cannot configure Excel to provide additional actions.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess~l_additionalactions_l_enableadditionalactionsinexcel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess~l_additionalactions_l_enableadditionalactionsinexcel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess~l_additionalactions_l_moreactionsurl","displayName":"More actions URL (User)","description":"This policy setting allows you to specify what URL to send users to when the More Actions button is clicked. The More Actions button can be found under File tab | Options | Proofing | Autocorrect Options... | Actions | More Actions.\r\n\r\nIf you enable this policy setting and you specify a URL, the More Actions button will send the user to the specified URL. If you enable this policy setting and you do not specify a URL (you leave the field blank), the More Actions button is disabled.\r\n\r\nIf you disable or do not configure this policy setting, the More Actions button will send the user to the default URL.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess~l_additionalactions_l_moreactionsurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess~l_additionalactions_l_moreactionsurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsautocorrectoptionsexcelpowerpointandaccess~l_additionalactions_l_moreactionsurl_l_moreactionsurleditid","displayName":"More Actions URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_conversionservices_l_conversionservicesoptions","displayName":"Conversion Service Options (User)","description":"This policy setting controls users' access to the online features of Office 2016.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_conversionservices_l_conversionservicesoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_conversionservices_l_conversionservicesoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_conversionservices_l_conversionservicesoptions_l_conversionservicesoptions236","displayName":"Conversion service options (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_conversionservices_l_conversionservicesoptions_l_conversionservicesoptions236_0","displayName":"Do not allow to use Microsoft Conversion Service","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_conversionservices_l_conversionservicesoptions_l_conversionservicesoptions236_2","displayName":"Allow to use Microsoft Conversion Service","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_onlinecontent_l_onlinecontentoptions","displayName":"Online Content Options (User)","description":"This policy setting controls users' access to the online features of Office 2016.\r\n\r\nIf you enable this policy setting, you can choose one of two options for user access to online content and services:\r\n\r\n* Do not allow Office to connect to the Internet – Office applications do not connect to the Internet to access online services, or to download the latest online content from Office.com. Connected features of Office 2016 are disabled.\r\n\r\n* Allow Office to connect to the Internet – Office applications use online services and download the latest online content from Office.com when users’ computers are connected to the Internet. Connected features of Office 2016 are enabled. This option enforces the default configuration.\r\n\r\nIf you disable this policy setting or do not configure this policy setting, Office applications use online services and download the latest online content from Office.com when users’ computers are connected to the Internet. Users can change this behavior by deselecting the \"Allow Office to connect to the Internet\" checkbox in the Privacy Options section of the Trust Center.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_onlinecontent_l_onlinecontentoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_onlinecontent_l_onlinecontentoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_onlinecontent_l_onlinecontentoptions_l_onlinecontentoptions236","displayName":"Online content options (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_onlinecontent_l_onlinecontentoptions_l_onlinecontentoptions236_0","displayName":"Do not allow Office to connect to the Internet","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_onlinecontent_l_onlinecontentoptions_l_onlinecontentoptions236_2","displayName":"Allow Office to connect to the Internet","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_onlinecontent_l_serviceleveloptions","displayName":"Service Level Options (User)","description":"This policy setting controls the types of services that can be used by the online features of Office 2016.\r\n \r\nIf you enable this policy setting, you can choose one of three options for gating access to online services based on the owner of the service:\r\n\r\n* Office services only - Office 2016 applications on the computer communicate only with Office-owned services. All other Microsoft or third-party service integration in Office 2016 is disabled on the computer. This is the most restrictive option.\r\n\r\n* Microsoft services only - Office 2016 applications on the computer communicate only with Microsoft-owned services. All third-party service integration in Office 2016 is disabled on the computer.\r\n\r\n* All services - All service integration in Office 2016 is enabled on the computer. This is also the default configuration.\r\n\r\nIf you disable or do not configure this policy setting, Office 2016 client applications allow all service integrations. Individual users can manage the set of services they use through the new My Office place in Office Backstage view.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_onlinecontent_l_serviceleveloptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_onlinecontent_l_serviceleveloptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_onlinecontent_l_serviceleveloptions_l_serviceleveloptionsdropid","displayName":"Service Level Options (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_onlinecontent_l_serviceleveloptions_l_serviceleveloptionsdropid_0","displayName":"Office services only","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_onlinecontent_l_serviceleveloptions_l_serviceleveloptionsdropid_1","displayName":"Microsoft services only","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_onlinecontent_l_serviceleveloptions_l_serviceleveloptionsdropid_2","displayName":"All services","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_powerpointdesigner_l_powerpointdesigneroptions","displayName":"PowerPoint Designer Options (User)","description":"This policy setting allows an administrator to enable or disable PowerPoint Designer","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_powerpointdesigner_l_powerpointdesigneroptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_powerpointdesigner_l_powerpointdesigneroptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_powerpointdesigner_l_powerpointdesigneroptions_l_powerpointdesigneroptionsid","displayName":"PowerPoint Designer options (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_powerpointdesigner_l_powerpointdesigneroptions_l_powerpointdesigneroptionsid_0","displayName":"Disable PowerPoint Designer","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralserviceoptions~l_powerpointdesigner_l_powerpointdesigneroptions_l_powerpointdesigneroptionsid_73187","displayName":"Enable PowerPoint Designer","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions_l_disablehyperlinkstowebtemplatesinfilenewandtaskpanes","displayName":"Disable web templates in File | New and on the Office Start screen (User)","description":"This policy setting controls whether users can download templates from Office.com from within the Office applications.\r\n\r\nIf you enable this policy setting, users will not see featured templates from Office.com in File | New and on the Office Start screen and will not be able to download templates from within Office applications.\r\n\r\nIf you disable or do not configure this policy setting, users will see featured templates from Office.com in File | New and on the Office Start screen and will be able to download templates from within Office applications.\r\n\r\nNote - Enabling this policy setting does not prevent users from downloading templates from Office.com using their Web browsers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions_l_disablehyperlinkstowebtemplatesinfilenewandtaskpanes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions_l_disablehyperlinkstowebtemplatesinfilenewandtaskpanes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions_l_disableofficetemplates","displayName":"Hide all Office-provided templates on the Office Start screen and in File | New (User)","description":"This policy setting controls whether Office-provided templates (from Office.com and shipped with the Office clients) are hidden on the Office Start screen and in File | New.\r\n\r\nIf you enable this policy setting, users will not see any Office provided templates on the Office Start screen nor in File | New.\r\n\r\nIf you disable or do not configure this policy setting, users will see Office provided templates on the Office Start screen nor in File | New.\r\n\r\nNote - enabling this policy setting does not prevent users from downloading templates from Office.com using their Web browsers and does not prevent users from using Office-provided templates installed on their hard drive using Windows Explorer to launch those templates.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions_l_disableofficetemplates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions_l_disableofficetemplates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions_l_disabletargetedmessaging","displayName":"Hide dynamic lifecycle messages (User)","description":"This policy setting controls whether dynamic lifecycle messages are displayed in Office applications.\r\n\r\nA dynamic lifecycle message appears as a notification in an Office application. This message is similar to a default lifecycle message, but provides additional information. For example, a message that reminds users to renew their subscription that also includes information to help them renew. Office periodically connects to the Internet and contacts Microsoft to determine if there are any relevant messages to display.\r\n\r\nIf you enable this policy setting, Office won’t check for these types of messages, but, default lifecycle messages still display in Office applications.\r\n\r\nIf you disable or don’t configure this policy setting, Office checks for these types of messages and displays them.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions_l_disabletargetedmessaging_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions_l_disabletargetedmessaging_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_allowpngasanoutputformat","displayName":"Allow PNG as an output format (User)","description":"This policy setting determines whether Office 2016 applications can output graphics in Portable Network Graphics (PNG) format when documents are saved as Web pages.\r\n\r\nIf you enable this policy setting, Office 2016 applications can save graphics in PNG format and users cannot change this configuration.\r\n\r\nIf you disable this policy setting, Office 2016 applications cannot save graphics in PNG format and users cannot change this configuration.\r\n\r\nIf you do not configure this policy setting, Office 2016 applications do not save graphics in the PNG format. Users can change this functionality by opening the application's Options dialog box, clicking Advanced, clicking Web Options, and selecting the Allow PNG as a graphics format check box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_allowpngasanoutputformat_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_allowpngasanoutputformat_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_relyonvmlfordisplayinggraphicsinbrowsers","displayName":"Rely on VML for displaying graphics in browsers (User)","description":"This policy setting controls whether Office 2016 applications save standard raster file format (GIF or PNG) copies of Vector Markup Language (VML) graphics when documents are saved as Web pages.\r\n\r\nIf you enable this policy setting, Office 2016 applications will not generate alternate files for VML graphics when documents are saved as Web pages. In addition, the \"Rely on VML for displaying graphics in browsers\" check box is checked in the Web Options dialog in Excel, PowerPoint, and Word, and users cannot change it.\r\n\r\nIf you disable this policy setting, Office 2016 applications also save copies of the graphics in a standard raster file format (GIF or PNG) for use by browsers that cannot display VML. In addition, the \"Rely on VML for displaying graphics in browsers\" check box is cleared in the Web Options dialog in Excel, PowerPoint, and Word, and users cannot change it.\r\n\r\nIf you do not configure this policy setting, when saving VML graphics, Office 2016 applications also save copies of the graphics in a standard raster file format (GIF or PNG) for use by browsers that cannot display VML. If the \"Rely on VML for displaying graphics in browsers\" check box in the Web Options dialog is selected, applications will not save raster copies of VML graphics, which means those graphics will not display in non-Microsoft browsers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_relyonvmlfordisplayinggraphicsinbrowsers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_relyonvmlfordisplayinggraphicsinbrowsers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor","displayName":"Target monitor (User)","description":"Sets the value in the UI.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor_l_pixelsperinch","displayName":"Pixels per inch (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor_l_pixelsperinch_72","displayName":"72","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor_l_pixelsperinch_96","displayName":"96","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor_l_pixelsperinch_120","displayName":"120","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor_l_screensize","displayName":"Screen size (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor_l_screensize_544x376","displayName":"544 x 376","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor_l_screensize_640x480","displayName":"640 x 480","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor_l_screensize_720x512","displayName":"720 x 512","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor_l_screensize_800x600","displayName":"800 x 600","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor_l_screensize_1024x768","displayName":"1024 x 768","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor_l_screensize_1152x882","displayName":"1152 x 882","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor_l_screensize_1152x900","displayName":"1152 x 900","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor_l_screensize_1280x1024","displayName":"1280 x 1024","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor_l_screensize_1600x1200","displayName":"1600 x 1200","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor_l_screensize_1800x1440","displayName":"1800 x 1440","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_browsers_l_targetmonitor_l_screensize_1920x1200","displayName":"1920 x 1200","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding","displayName":"Default or specific encoding (User)","description":"When enabled, either default encoding or a specified encoding will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_alwayssavewebpagesinthedefaultencoding","displayName":"Always save Web pages in the default encoding. (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_alwayssavewebpagesinthedefaultencoding_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_alwayssavewebpagesinthedefaultencoding_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas","displayName":"Save this document as (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_1256","displayName":"Arabic Alphabet (Windows)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_28594","displayName":"Baltic Alphabet (ISO)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_1257","displayName":"Baltic Alphabet (Windows)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_852","displayName":"Central European (DOS)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_28592","displayName":"Central European Alphabet (ISO)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_1250","displayName":"Central European Alphabet (Windows)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_936","displayName":"Chinese Simplified (GB2312)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_52936","displayName":"Chinese Simplified (HZ)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_950","displayName":"Chinese Traditional (Big 5)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_866","displayName":"Cyrillic Alphabet (DOS)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_28595","displayName":"Cyrillic Alphabet (ISO)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_20866","displayName":"Cyrillic Alphabet (KOI8-R)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_1251","displayName":"Cyrillic Alphabet (Windows)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_28597","displayName":"Greek Alphabet (ISO)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_1253","displayName":"Greek Alphabet (Windows)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_1255","displayName":"Hebrew Alphabet (Windows)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_51932","displayName":"Japanese (EUC)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_50220","displayName":"Japanese (JIS)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_50222","displayName":"Japanese (JIS-Allow 1 byte Kana - SO/SI)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_50221","displayName":"Japanese (JIS-Allow 1 byte Kana)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_932","displayName":"Japanese (Shift-JIS)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_949","displayName":"Korean","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_28593","displayName":"Latin 3 Alphabet (ISO)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_874","displayName":"Thai (Windows)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_1254","displayName":"Turkish Alphabet","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_21866","displayName":"Ukrainian Alphabet (KOI8-RU)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_1200","displayName":"Universal Alphabet","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_1201","displayName":"Universal Alphabet (Big-Endian)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_65001","displayName":"Universal Alphabet (UTF-8)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_1258","displayName":"Vietnamese Alphabet (Windows)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_28598","displayName":"Visual Hebrew (ISO)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_encoding_l_defaultorspecificencoding_l_savethisdocumentas_1252","displayName":"Western Alphabet (Windows)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_files_l_checkifofficeisthedefaulteditorforwebpagescreatedinoffice","displayName":"Check if Office is the default editor for Web pages created in Office (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_files_l_checkifofficeisthedefaulteditorforwebpagescreatedinoffice_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_files_l_checkifofficeisthedefaulteditorforwebpagescreatedinoffice_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_files_l_openofficedocumentdirectlyinofficeapplication","displayName":"Open Office document directly in Office application (User)","description":"This policy setting allows you to choose whether Office documents located on web servers open directly in the registered application or through the web browser. \r\n\r\nIf you enable this policy setting, files will open directly in the associated Office application, bypassing the web browser.\r\n\r\nIf you disable this policy setting files will open through the web browser.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_files_l_openofficedocumentdirectlyinofficeapplication_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_files_l_openofficedocumentdirectlyinofficeapplication_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_files_l_openofficedocumentsasreadwritewhilebrowsing","displayName":"Open Office documents as read/write while browsing (User)","description":"This policy setting controls whether users can edit and save Office 2016 documents on Web servers that they have opened using Internet Explorer.\r\n \r\nIf enable this policy setting, when users browse to an Office 2016 document on a Web server using Internet Explorer the appropriate application opens the file in read/write mode.\r\n\r\nIf you disable or do not configure this policy setting, when users browse to an Office 2016 document on a Web server using Internet Explorer, the appropriate application opens the file in read-only mode.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_files_l_openofficedocumentsasreadwritewhilebrowsing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_files_l_openofficedocumentsasreadwritewhilebrowsing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_files_l_organizesupportingfilesinafolder","displayName":"Organize supporting files in a folder (User)","description":"This will be forced on if 'Use long file names' is forced off.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_files_l_organizesupportingfilesinafolder_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_files_l_organizesupportingfilesinafolder_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_files_l_updatelinksonsave","displayName":"Update links on save (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_files_l_updatelinksonsave_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_files_l_updatelinksonsave_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_files_l_uselongfilenameswheneverpossible","displayName":"Use long file names whenever possible (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_files_l_uselongfilenameswheneverpossible_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_files_l_uselongfilenameswheneverpossible_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_general_l_relyoncssforfontformatting","displayName":"Rely on CSS for font formatting (User)","description":"This policy setting allows you to rely on CSS for font formatting.\r\n\r\nIf you enable this policy setting, you may select configure these options:\r\n- Enforce CSS: If checked, enforce CSS is on. If not checked, enforce CSS is off.\r\n- CSS setting for Word: If checked, the CSS setting for Word as an email editor is used.\r\n\r\nIf you disable or do not configure this policy setting, the options will not be configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_general_l_relyoncssforfontformatting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_general_l_relyoncssforfontformatting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_general_l_relyoncssforfontformatting_l_checktoenforcecssonunchecktoenforcecssoff","displayName":"Enforce CSS (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_general_l_relyoncssforfontformatting_l_checktoenforcecssonunchecktoenforcecssoff_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_general_l_relyoncssforfontformatting_l_checktoenforcecssonunchecktoenforcecssoff_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_general_l_relyoncssforfontformatting_l_usethecsssettingforwordasanemaileditor","displayName":"CSS setting for Word (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_general_l_relyoncssforfontformatting_l_usethecsssettingforwordasanemaileditor_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsgeneralweboptions~l_general_l_relyoncssforfontformatting_l_usethecsssettingforwordasanemaileditor_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_allowaccenteduppercaseinfrench","displayName":"Allow accented uppercase in French (User)","description":"Checks/Unchecks the option \"Enforce accented uppercase in French\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_allowaccenteduppercaseinfrench_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_allowaccenteduppercaseinfrench_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_arabicmodes","displayName":"Arabic modes (User)","description":"Specifies the spelling rules to use for checking spelling of Arabic text. This option is available only if you are using a right-to-left language version of Microsoft Office or have installed Microsoft Office 2016 proofing tools or the Microsoft Office Single Language Pack 2016 for the language, and have enabled support for the language through Microsoft Office 2016 Language Preferences.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_arabicmodes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_arabicmodes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_arabicmodes_l_empty239","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_arabicmodes_l_empty239_0","displayName":"None","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_arabicmodes_l_empty239_1","displayName":"Strict initial alef hamza","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_arabicmodes_l_empty239_2","displayName":"Strict final yaa","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_arabicmodes_l_empty239_3","displayName":"Both strict","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_combineauxverbadj","displayName":"Combine aux verb/adj. (User)","description":"Checks/Unchecks the corresponding UI option. This option is available only if you are using the Korean language version of Microsoft Office or have installed Microsoft Office 2016 proofing tools or the Microsoft Office Single Language Pack 2016 for Korean, and have enabled support for Korean through Microsoft Office 2016 Language Preferences.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_combineauxverbadj_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_combineauxverbadj_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_flagrepeatedwords","displayName":"Flag Repeated Words (User)","description":"Allows users to flag or ignore repeated words.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_flagrepeatedwords_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_flagrepeatedwords_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_hebrewmode","displayName":"Hebrew mode (User)","description":"Specifies the script to use for checking spelling of Hebrew text. This option is available only if you are using a right-to-left language version of Microsoft Office or have installed Microsoft Office 2016 proofing tools or the Microsoft Office Single Language Pack 2016 for that language, and have enabled support for the language through Microsoft Office 2016 Language Preferences.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_hebrewmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_hebrewmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_hebrewmode_l_empty238","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_hebrewmode_l_empty238_0","displayName":"Full","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_hebrewmode_l_empty238_1","displayName":"Partial","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_hebrewmode_l_empty238_2","displayName":"Mixed","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_hebrewmode_l_empty238_3","displayName":"Mixed authorized","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_ignoreinternetandfileaddresses","displayName":"Ignore Internet and file addresses (User)","description":"Allow users to ignore URLs and file paths.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_ignoreinternetandfileaddresses_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_ignoreinternetandfileaddresses_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_ignorewordsinuppercase","displayName":"Ignore words in UPPERCASE (User)","description":"Allow users to ignore words written in UPPERCASE.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_ignorewordsinuppercase_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_ignorewordsinuppercase_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_ignorewordswithnumbers","displayName":"Ignore words with numbers (User)","description":"Allows users to ignore words with numbers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_ignorewordswithnumbers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_ignorewordswithnumbers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_processcompoundnouns","displayName":"Process compound nouns (User)","description":"Checks/Unchecks the corresponding UI option. This option is available only if you are using the Korean language version of Microsoft Office or have installed Microsoft Office 2016 proofing tools or the Microsoft Office Single Language Pack 2016 for Korean, and have enabled support for Korean through Microsoft Office 2016 Language Preferences.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_processcompoundnouns_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_processcompoundnouns_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_suggestfrommaindictionaryonly","displayName":"Suggest from main dictionary only (User)","description":"Allows users to select words from main lexicon only.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_suggestfrommaindictionaryonly_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_suggestfrommaindictionaryonly_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_useautochangelist","displayName":"Use auto-change list (User)","description":"Checks/Unchecks the option \"Search misused word list\". This option is available only if you are using the Korean language version of Microsoft Office or have installed Microsoft Office 2016 proofing tools or the Microsoft Office Single Language Pack 2016 for Korean, and have enabled support for Korean through Microsoft Office 2016 Language Preferences.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_useautochangelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_useautochangelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_usegermanpostreformruleswhenrunningspellcheck","displayName":"German: Use post-reform rules (User)","description":"Allows users to choose a particular spellchecking style; Pre-reform or post reform.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_usegermanpostreformruleswhenrunningspellcheck_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling_l_usegermanpostreformruleswhenrunningspellcheck_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling~l_proofingdatacollection_l_improveproofingtools","displayName":"Improve Proofing Tools (User)","description":"This policy setting controls whether the Help Improve Proofing Tools feature sends usage data to Microsoft. The Help Improve Proofing Tools feature collects data about use of the Proofing Tools, such as additions to the custom dictionary, and sends it to Microsoft. After about six months, the feature stops sending data to Microsoft and deletes the data collection file from the user's computer. \r\n\r\nIf you enable this policy setting, this feature is enabled if users choose to participate in the Customer Experience Improvement Program (CEIP). If your organization has policies that govern the use of external resources such as the CEIP, allowing the use of the Help Improve Proofing Tools feature might cause them to violate these policies. \r\n\r\nIf you disable this policy setting, the Help Improve Proofing Tools feature does not collect proofing tool usage information and transmit it to Microsoft. \r\n\r\nIf you do not configure this policy setting, the behavior is the equivalent of setting the policy to \"Enabled\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling~l_proofingdatacollection_l_improveproofingtools_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_toolsoptionsspelling~l_proofingdatacollection_l_improveproofingtools_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_allowwebarchivestobesavedinanyhtmlencoding","displayName":"Allow Web Archives to be saved in any HTML encoding (User)","description":"Enabled: Allow the user to save Web Archives in any HTML encoding.\r\n\r\nNot enabled: Always use US-ASCII for Web Archives.\r\n\r\nThis results in smaller files, but is not supported in Windows Internet Explorer 5.0 or earlier.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_allowwebarchivestobesavedinanyhtmlencoding_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_allowwebarchivestobesavedinanyhtmlencoding_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_defaultformatforpublish","displayName":"Default format for 'Publish' (User)","description":"\"Web Archive (*.mht)\": The Publish command creates a Web Archive file. | \"Web Page (*.htm)\": The Publish command creates an HTML file. | \"Default\": The Publish command uses the default Web page format for publishing.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_defaultformatforpublish_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_defaultformatforpublish_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_defaultformatforpublish_l_defaultformatforpublish405","displayName":"Default format for 'Publish' (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_defaultformatforpublish_l_defaultformatforpublish405_2","displayName":"Web Archive (*.mht)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_defaultformatforpublish_l_defaultformatforpublish405_1","displayName":"Web Page (*.htm)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_defaultformatforpublish_l_defaultformatforpublish405_0","displayName":"Default","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_powerpointsaveanadditionalversionofthepresentationforolderbr","displayName":"PowerPoint: Save an additional version of the presentation for older browsers (User)","description":"Checked: PowerPoint publishes Web Archive presentations that contain a version of the presentation that is compatible with older browsers. | Unchecked: PowerPoint publishes Web Archive presentations that contain only the version of the presentation that is compatible with later browsers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_powerpointsaveanadditionalversionofthepresentationforolderbr_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_powerpointsaveanadditionalversionofthepresentationforolderbr_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_powerpointwebpageformatcompatibility","displayName":"PowerPoint: web page format compatibility (User)","description":"\"All browsers\": Save new PowerPoint web pages in a format that is compatible with all browsers. | \"Windows Internet Explorer 4.0 or later\": Save new PowerPoint web pages in a format that requires Windows Internet Explorer 4.0 or later. | \"Based on installed browsers\": Examine the browsers installed on the user's computer and save new PowerPoint web pages in the smallest possible format that is compatible with all of the installed browsers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_powerpointwebpageformatcompatibility_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_powerpointwebpageformatcompatibility_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_powerpointwebpageformatcompatibility_l_powerpointwebpageformatcompatibility406","displayName":"PowerPoint: web page format compatibility (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_powerpointwebpageformatcompatibility_l_powerpointwebpageformatcompatibility406_2","displayName":"All browsers","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_powerpointwebpageformatcompatibility_l_powerpointwebpageformatcompatibility406_1","displayName":"Windows Internet Explorer 4.0 or later","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_powerpointwebpageformatcompatibility_l_powerpointwebpageformatcompatibility406_0","displayName":"Based on installed browsers","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_savenewwebpagesaswebarchives","displayName":"Save new Web pages as Web archives (User)","description":"Checked: Use Web Archive (*.mht) as the default format for the Save as Web Page command (File menu). | Unchecked: Use Web page (*.htm) as the default format for the Save as Web Page command (File menu).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_savenewwebpagesaswebarchives_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_savenewwebpagesaswebarchives_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_webarchiveencoding","displayName":"Web Archive encoding (User)","description":"\"Use 8 bit content-transfer-encoding\": Use a content-transfer-encoding of 8bit for all parts in a Web Archive file. | \"Use 8 bit only for encoding text parts\": Use a content-transfer-encoding of 8bit only for text parts. | \"Use RFC-approved encoding\": Always use RFC-approved encodings.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_webarchiveencoding_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_webarchiveencoding_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_webarchiveencoding_l_webarchiveencoding402","displayName":"Web Archive encoding (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_webarchiveencoding_l_webarchiveencoding402_2","displayName":"Use 8 bit content-transfer-encoding","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_webarchiveencoding_l_webarchiveencoding402_1","displayName":"Use 8 bit only for encoding text parts","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_webarchives_l_webarchiveencoding_l_webarchiveencoding402_0","displayName":"Use RFC-approved encoding","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_whatsnew_l_dontshowwhatsnewinformationexcel","displayName":"Don’t show the What’s New information for Excel (User)","description":"This policy setting controls whether the What’s New information is shown when a user opens the desktop version of Excel for the first time after Excel has been updated with new features. By default, the What’s New information is shown.\r\n\r\nIf you enable this policy setting, the What’s New information isn’t shown. Also, the What’s New button in File > Account is disabled.\r\n\r\nIf you disable or don’t configure this policy setting, the What’s New information is shown.\r\n\r\nNote: There are separate policy settings for Word, Excel, PowerPoint, Outlook, OneNote, and Visio.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_whatsnew_l_dontshowwhatsnewinformationexcel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_whatsnew_l_dontshowwhatsnewinformationexcel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_whatsnew_l_dontshowwhatsnewinformationonenote","displayName":"Don’t show the What’s New information for OneNote (User)","description":"This policy setting controls whether the What’s New information is shown when a user opens the desktop version of OneNote for the first time after OneNote has been updated with new features. By default, the What’s New information is shown.\r\n\r\nIf you enable this policy setting, the What’s New information isn’t shown. Also, the What’s New button in File > Account is disabled.\r\n\r\nIf you disable or don’t configure this policy setting, the What’s New information is shown.\r\n\r\nNote: There are separate policy settings for Word, Excel, PowerPoint, Outlook, OneNote, and Visio.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_whatsnew_l_dontshowwhatsnewinformationonenote_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_whatsnew_l_dontshowwhatsnewinformationonenote_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_whatsnew_l_dontshowwhatsnewinformationoutlook","displayName":"Don’t show the What’s New information for Outlook (User)","description":"This policy setting controls whether the What’s New information is shown when a user opens the desktop version of Outlook for the first time after Outlook has been updated with new features. By default, the What’s New information is shown.\r\n\r\nIf you enable this policy setting, the What’s New information isn’t shown. Also, the What’s New button in File > Office Account is disabled.\r\n\r\nIf you disable or don’t configure this policy setting, the What’s New information is shown.\r\n\r\nNote: There are separate policy settings for Word, Excel, PowerPoint, Outlook, OneNote, and Visio.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_whatsnew_l_dontshowwhatsnewinformationoutlook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_whatsnew_l_dontshowwhatsnewinformationoutlook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_whatsnew_l_dontshowwhatsnewinformationpowerpoint","displayName":"Don’t show the What’s New information for PowerPoint (User)","description":"This policy setting controls whether the What’s New information is shown when a user opens the desktop version of PowerPoint for the first time after PowerPoint has been updated with new features. By default, the What’s New information is shown.\r\n\r\nIf you enable this policy setting, the What’s New information isn’t shown. Also, the What’s New button in File > Account is disabled.\r\n\r\nIf you disable or don’t configure this policy setting, the What’s New information is shown.\r\n\r\nNote: There are separate policy settings for Word, Excel, PowerPoint, Outlook, OneNote, and Visio.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_whatsnew_l_dontshowwhatsnewinformationpowerpoint_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_whatsnew_l_dontshowwhatsnewinformationpowerpoint_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_whatsnew_l_dontshowwhatsnewinformationvisio","displayName":"Don’t show the What’s New information for Visio (User)","description":"This policy setting controls whether the What’s New information is shown when a user opens the desktop version of Visio for the first time after Visio has been updated with new features. By default, the What’s New information is shown.\r\n\r\nIf you enable this policy setting, the What’s New information isn’t shown. Also, the What’s New button in File > Account is disabled.\r\n\r\nIf you disable or don’t configure this policy setting, the What’s New information is shown.\r\n\r\nNote: There are separate policy settings for Word, Excel, PowerPoint, Outlook, OneNote, and Visio.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_whatsnew_l_dontshowwhatsnewinformationvisio_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_whatsnew_l_dontshowwhatsnewinformationvisio_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_whatsnew_l_dontshowwhatsnewinformationword","displayName":"Don’t show the What’s New information for Word (User)","description":"This policy setting controls whether the What’s New information is shown when a user opens the desktop version of Word for the first time after Word has been updated with new features. By default, the What’s New information is shown.\r\n\r\nIf you enable this policy setting, the What’s New information isn’t shown. Also, the What’s New button in File > Account is disabled.\r\n\r\nIf you disable or don’t configure this policy setting, the What’s New information is shown.\r\n\r\nNote: There are separate policy settings for Word, Excel, PowerPoint, Outlook, OneNote, and Visio.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_whatsnew_l_dontshowwhatsnewinformationword_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v2~policy~l_microsoftofficesystem~l_whatsnew_l_dontshowwhatsnewinformationword_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v20~policy~l_microsoftofficesystem~l_miscellaneous437_l_cloudonlysaving","displayName":"Restrict saving on non-Cloud locations (User)","description":"This policy setting controls whether Word, Excel, and PowerPoint users can use non-cloud locations (local and network) to create new files.\r\n\r\nIf you enable this policy setting, users will only have Cloud Locations available to perform SaveAs and Save new files.\r\n\r\nIf you disable or don’t configure this policy setting, users can use any location (Cloud, Local, and Network) to perform SaveAs and Save new files.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for Enterprise.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v20~policy~l_microsoftofficesystem~l_miscellaneous437_l_cloudonlysaving_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v20~policy~l_microsoftofficesystem~l_miscellaneous437_l_cloudonlysaving_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v20~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_shownfilefmtprompt","displayName":"Show the File Format dialog (User)","description":"This policy setting allows you to control whether the file format dialog has already been shown to the user. If you enable this policy setting, the dialog won't be shown again. If you disable this policy setting, the dialog prompts the user to select a default file format on each boot until one is selected. If you don't configure this policy setting, the dialog prompts the user to select a default file format on each boot until one is selected.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v20~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_shownfilefmtprompt_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v20~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_shownfilefmtprompt_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_miscellaneous437_l_ageoutpolicyincludingfilespendingupload","displayName":"Age out documents older than n days Including documents with pending uploads (User)","description":"\r\n This policy controls when locally cached Office documents are aged out of the Office Document Cache including if the file may have pending uploads. This acts as a maximum possible age (in days) for any file to remain in the Office Document Cache.\r\n\r\n If you enable this policy setting, files older than the policy \"Age out documents older than n days\" as well as this setting will get cleaned up regardless of file pending upload status.\r\n\r\n If you disable this policy setting or if you do not configure this policy setting, Office will clean out only files that do not have pending changes per the policy \"Age out documents older than n days\". Configuring this policy with a value of 0 is also considered disabling the policy.\r\n\r\n For more information https://support.microsoft.com/en-us/topic/managing-office-document-cache-size-ea64af72-b597-408e-8ecf-fd55daa02476\r\n\r\n Note: This policy setting only applies to Office builds 19328.20000 and newer\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_miscellaneous437_l_ageoutpolicyincludingfilespendingupload_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_miscellaneous437_l_ageoutpolicyincludingfilespendingupload_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_miscellaneous437_l_ageoutpolicyincludingfilespendingupload_l_ageoutpolicyincludingfilespendinguploaddecimal","displayName":"Number of days (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_miscellaneous437_l_writingassistantadminchoiceadminchoice","displayName":"Enable Writing Assistant (User)","description":"This policy setting controls whether users can use the Writing Assistant feature.\r\n \r\nIf you enable or don’t configure this policy setting, users will be allowed to use Writing Assistant and it will be enabled by default (unless the users disabled it).\r\n\r\nIf you disable this policy setting, users won't see Writing Assistant by default.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for Enterprise.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_miscellaneous437_l_writingassistantadminchoiceadminchoice_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_miscellaneous437_l_writingassistantadminchoiceadminchoice_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_allowedcomaddins","displayName":"List of allowed COM/VSTO add-ins registered in HKCU (User)","description":"This policy setting allows you to specify COM/VSTO add-ins registered in HKEY_CURRENT_USER (HKCU) that should be allowed to load, overriding the \"Block loading of COM/VSTO add-ins registered in HKCU\" policy.\r\n\r\nSome legitimate add-ins may be installed in HKCU even when deployed by administrators, due to how the independent software vendor (ISV) designed their installer. This policy provides an administrative override to allow specific add-ins to load despite being registered in HKCU.\r\n\r\nIf you enable this policy setting, you can specify a list of COM/VSTO add-ins that are allowed to load from HKCU. Enter each add-in using its ProgID as the name.\r\n\r\nIf you disable or don't configure this policy setting, the standard HKCU blocking behavior applies when that policy is enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_allowedcomaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_allowedcomaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_allowedcomaddins_l_allowedcomaddinslist","displayName":"Allowed COM/VSTO Add-ins: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_allowedcomaddins_l_allowedcomaddinslist_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_allowedcomaddins_l_allowedcomaddinslist_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_blockmotwmacrointrustedorsigned","displayName":"Block all internet macros (ignore trusted locations or publishers) (User)","description":"This policy setting removes the trusted location and trusted publisher exceptions for files downloaded from the internet with Mark of the Web (MOTW).\r\n\r\nBy default, Office blocks macros from the internet but allows exceptions for files that are either in trusted locations or signed by trusted publishers.\r\n\r\nIf you enable this policy setting, all macros in files downloaded from the internet will be blocked, including those in trusted locations or signed by trusted publishers. This provides maximum protection against internet-based macro threats.\r\n\r\nIf you disable or don't configure this policy setting, the default behavior applies where macros from the internet are blocked except when the file is in a trusted location or signed by a trusted publisher.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_blockmotwmacrointrustedorsigned_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_blockmotwmacrointrustedorsigned_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_blockvbamacrotrusteddocument","displayName":"Turn off Trusted Documents for VBA macros (User)","description":"This policy setting allows you to turn off the Trusted Documents feature for documents containing VBA macros.\r\n\r\nIf you enable this policy setting, users will always see security notifications for VBA macros in documents. When users click \"Enable Content\" for VBA macros, Office will not create a trust record for the document, ensuring that the user is prompted every time they open the document.\r\n\r\nIf you disable or don't configure this policy setting, the Trusted Documents feature allows users to always allow VBA macros in a document so that the user is not prompted the next time they open that document. Trusted documents are exempt from security notifications.\r\n\r\nNote: Enabling this policy setting does not clear existing trusted documents that were previously trusted.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_blockvbamacrotrusteddocument_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_blockvbamacrotrusteddocument_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_enablemacrotrustlevel","displayName":"Enable macro trust levels (User)","description":"This policy setting controls whether macro trust levels are enabled, which classifies VBA macros into four security levels based on file location and digital signature status.\r\n\r\nIf you enable this policy setting, VBA macros will be classified into the following trust levels with corresponding user experiences:\r\n\r\n- Lowest (Most Trusted): Files signed by a trusted publisher, saved to a trusted location, or unsaved files.\r\n - User Experience: No Message Bar displayed, macros load normally.\r\n\r\n- Lower: Files opened from a connected personal or business OneDrive account, connected SharePoint location, or local OneDrive folders.\r\n - User Experience: Yellow Message Bar with Enable Content option.\r\n\r\n- Moderate: Files opened from intranet locations, or signed with an extended validation (EV) certificate but not by a trusted publisher.\r\n - User Experience: Yellow Message Bar with a Learn More option. This encourages security awareness by requiring additional steps before enabling macros.\r\n\r\n- Highest (Least Trusted): All other files.\r\n - User Experience: Red Message Bar with macros blocked.\r\n\r\nWhen enabled, unsaved files containing macros will display a warning dialog when users attempt to save the file to local disk, informing them that saving locally may block macro execution when the file is reopened.\r\n\r\nIf you disable or don't configure this policy setting, macro trust levels are not enabled and the standard macro security behavior applies.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_enablemacrotrustlevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_enablemacrotrustlevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_requirealwaysonmacrosig","displayName":"Require trusted publisher signatures for macros that are always loaded (User)","description":"This policy setting controls signature requirements for macros that are automatically loaded when Office applications start.\r\n\r\nMacros that are always loaded include VBA add-ins and templates that load automatically: Excel add-ins (xla/xlam), PowerPoint add-ins (ppa/ppam), Access add-ins (accda/mda), and Word templates (dot/dotm).\r\n\r\nIf you enable this policy setting:\r\n- Unsigned macros that are always loaded are silently disabled and don't load.\r\n- Signed but untrusted macros that are always loaded display a red Message Bar with no option for users to enable them for the current session.\r\n- Macros signed by a trusted publisher are allowed to always load.\r\n\r\nIf you disable or don't configure this policy setting, macros that are always on can load without requiring trusted publisher signatures.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_requirealwaysonmacrosig_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_requirealwaysonmacrosig_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_restrictcucomaddin","displayName":"Block loading of COM/VSTO add-ins registered in HKCU (User)","description":"This policy setting controls whether COM/VSTO add-ins registered only in HKEY_CURRENT_USER (HKCU) are blocked from loading.\r\n\r\nStandard users can install add-ins through ClickOnce deployment or the Office Add-ins settings, which typically register add-ins in HKCU rather than HKEY_LOCAL_MACHINE (HKLM).\r\n\r\nIf you enable this policy setting, all COM/VSTO add-ins registered only in HKCU will be blocked from loading, preventing users from running add-ins they have installed without administrator privileges.\r\n\r\nIf you disable or don't configure this policy setting, COM/VSTO add-ins registered in HKCU are allowed to load normally.\r\n\r\nNote: Add-ins registered in HKLM (typically installed by administrators) are not affected by this policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_restrictcucomaddin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_restrictcucomaddin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_vbadigsigchaintrustedpublishers","displayName":"Allow root or intermediate certificates as VBA trusted publishers (User)","description":"This policy setting controls whether root and intermediate certificates can be added as trusted publishers for VBA macro validation when the VBA Macro Notification Settings policy is set to \"Disable all except digitally signed macros\".\r\n\r\nIf you enable this policy setting, administrators can add root or intermediate certificates to the trusted publishers store. VBA macros signed by any certificate that chains to these trusted root or intermediate certificates will be considered as signed by a trusted publisher and allowed to run.\r\n\r\nIf you disable or don't configure this policy setting, only end (leaf) certificates can be added as trusted publishers.\r\n\r\nNote: This policy setting only takes effect when the VBA Macro Notification Settings policy is set to \"Disable all except digitally signed macros\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_vbadigsigchaintrustedpublishers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v21~policy~l_microsoftofficesystem~l_securitysettings_l_vbadigsigchaintrustedpublishers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v3.1~policy~l_microsoftofficesystem~l_miscellaneous437_l_disableroamingmruforonpremservers","displayName":"Turn off roaming of on-premises file names and metadata (User)","description":"\r\nThis policy setting controls whether file names and metadata for Office files are roamed and appear in the list of recently opened files in an Office app, such as Word, on different devices.\r\n\r\nRoaming, which relies on a web-based Microsoft service, occurs when a user signs into Office with the same work or school account on different devices.\r\n\r\nNote: This policy setting only applies to Office files that are saved to on-premises instances of SharePoint Server or OneDrive for Business.\r\n\r\nIf you enable this policy setting, file names and metadata won't roam and won’t appear in the list of recently opened files in Office apps on other devices, unless the file has been opened on that device.\r\n\r\nIf you disable or don't configure this policy setting, file names and metadata will roam and will appear in the list of recently opened files in Office apps on other devices, even if the file hasn’t been opened on that device.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v3.1~policy~l_microsoftofficesystem~l_miscellaneous437_l_disableroamingmruforonpremservers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v3.1~policy~l_microsoftofficesystem~l_miscellaneous437_l_disableroamingmruforonpremservers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_collaborationsettings_l_documentchat","displayName":"Allow co-authors to chat within a document (User)","description":"This policy setting controls whether co-authors can use the chat functionality within an Office application to collaborate with each other when editing a document.\r\n\r\nIf you enable or don’t configure this policy setting, users can chat with each other when co-authoring a document.\r\n\r\nIf you disable this policy setting, users can’t chat with each other when co-authoring a document.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_collaborationsettings_l_documentchat_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_collaborationsettings_l_documentchat_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_globaloptions~l_customize_l_defaultuithemeuser","displayName":"Default Office theme (User)","description":"This policy setting allows you to select the user interface (UI) theme used by Office, if the user has not already selected an Office theme.\r\n\r\nNote: This setting only applies to Version 1903 or later of Office.\r\n\r\nIf you enable this policy setting, you may choose the Office theme used in cases where the user has not selected an Office theme themselves.\r\n\r\nIf you disable or do not configure this policy setting, Office will use the Colorful theme in cases where the user has not selected an Office theme themselves.\r\n\r\nRegardless of how you configure this policy setting, users can change their Office theme by going to File > Account > Office Theme (or, in Outlook, by going to File > Office Account > Office Theme).\r\n\r\nNote: The “Default Office theme” policy setting located under Computer Configuration takes precedence over this policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_globaloptions~l_customize_l_defaultuithemeuser_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_globaloptions~l_customize_l_defaultuithemeuser_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_globaloptions~l_customize_l_defaultuithemeuser_l_defaultuithemeenum","displayName":"Theme: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_globaloptions~l_customize_l_defaultuithemeuser_l_defaultuithemeenum_0","displayName":"Colorful","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_globaloptions~l_customize_l_defaultuithemeuser_l_defaultuithemeenum_3","displayName":"Dark Gray","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_globaloptions~l_customize_l_defaultuithemeuser_l_defaultuithemeenum_4","displayName":"Black","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_globaloptions~l_customize_l_defaultuithemeuser_l_defaultuithemeenum_5","displayName":"White","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_miscellaneous437_l_disableroamingmruforonpremservers","displayName":"Turn off roaming of on-premises file names and metadata (User)","description":"\r\nThis policy setting controls whether file names and metadata for Office files are roamed and appear in the list of recently opened files in an Office app, such as Word, on different devices.\r\n\r\nRoaming, which relies on a web-based Microsoft service, occurs when a user signs into Office with the same work or school account on different devices.\r\n\r\nNote: This policy setting only applies to Office files that are saved to on-premises instances of SharePoint Server or OneDrive for Business.\r\n\r\nIf you enable this policy setting, file names and metadata won't roam and won’t appear in the list of recently opened files in Office apps on other devices, unless the file has been opened on that device.\r\n\r\nIf you disable or don't configure this policy setting, file names and metadata will roam and will appear in the list of recently opened files in Office apps on other devices, even if the file hasn’t been opened on that device.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_miscellaneous437_l_disableroamingmruforonpremservers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_miscellaneous437_l_disableroamingmruforonpremservers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_miscellaneous437_l_officeinsideruserexperience","displayName":"Show the option for Office Insider (User)","description":"This policy setting controls whether the option for Office Insider is shown under File > Account in an Office app, such as Word.\r\n\r\nBy showing this option, a user can choose to join or leave the Office Insider program. For more information about the Office Insider program, see https://insider.office.com.\r\n\r\nIf you enable this policy setting, the option for Office Insider is shown under File > Account.\r\n\r\nNote: if you enable this policy setting, you shouldn’t enable and configure the “Update Channel” or the “Update Path” policy setting under Computer Configuration\\Policies\\Administrative Templates\\Microsoft Office 2016 (Machine)\\Updates. If you do, those policy settings will take precedence, even though the option for Office Insider is shown.\r\n\r\nIf you disable this policy setting, the option for Office Insider is not shown under File > Account.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus, and to subscription versions of Project and Visio.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_miscellaneous437_l_officeinsideruserexperience_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_miscellaneous437_l_officeinsideruserexperience_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_securitysettings_l_forceruntimeavscan","displayName":"Force Runtime AV Scan (User)","description":"This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus or Visio Pro for Office 365. \r\n\r\nThis policy setting controls when Office files are scanned at runtime by an installed Anti-Virus software.\r\n\r\nNote, files will only be scanned if the Anti-Virus software registers as a provider for runtime scanning.\r\n\r\nIf you enable this policy setting, Office applications will submit all files for a runtime scan by Antivirus.\r\n\r\nIf you disable or do not configure this policy setting, Office will selectively submit certain files, for example encrypted files, for a runtime scan by Antivirus.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_securitysettings_l_forceruntimeavscan_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_securitysettings_l_forceruntimeavscan_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_securitysettings_l_useofficeforlabelling","displayName":"Use the Sensitivity feature in Office to apply and view sensitivity labels (User)","description":"This policy setting controls whether sensitivity labels configured by an admin can be applied and viewed by using the Sensitivity feature in an Office app, such as Word, or by using the Microsoft Azure Information Protection add-in, if the add-in is installed and enabled.\r\n\r\nIf you enable this policy setting, the Sensitivity feature in an Office app can be used to apply and view sensitivity labels. If the Microsoft Azure Information Protection add-in is installed, the add-in is prevented from loading, even if the add-in is enabled, and the add-in can’t be used to apply sensitivity labels.\r\n\r\nIf you disable this policy setting, the Sensitivity feature won’t be available in an Office app and can’t be used to apply or view sensitivity labels. If the Microsoft Azure Information Protection add-in is installed and enabled, the add-in will be allowed to load and can be used to apply sensitivity labels.\r\n\r\nIf you don’t configure this policy setting:\r\n\r\n- If the Microsoft Azure Information Protection add-in is installed and enabled, the add-in will be allowed to load and can be used to apply sensitivity labels. The Sensitivity feature won’t be available in an Office app and can’t be used to apply or view sensitivity labels.\r\n- If the Microsoft Azure Information Protection add-in is not installed, or is installed but is disabled, then the Sensitivity feature in an Office app can be used to apply and view sensitivity labels.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_securitysettings_l_useofficeforlabelling_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v3~policy~l_microsoftofficesystem~l_securitysettings_l_useofficeforlabelling_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v5~policy~l_microsoftofficesystem~l_securitysettings_l_authenticationfbabehavior","displayName":"Control how Office handles form-based sign-in prompts (User)","description":"This policy setting controls how Office applications handle form-based sign-in prompts.​\r\n\r\nIf you enable this policy setting, you must choose one of the following options:​\r\n\r\nBlock all prompts​\r\nAsk the user what to do for each new host​\r\nShow prompts only from allowed hosts​\r\n\r\nIf you select “Block all prompts” then no form-based sign-in prompts are shown to the user and the user is shown a message that the sign-in method isn’t allowed.​\r\n\r\nIf you select “Ask the user what do for each new host” then the user is asked for each new host whether the user wants to sign-in to the host. If the user has previously signed-in to a host, a form-based sign-in prompt is shown for that host. Also, form-based sign-in prompts are shown for any hosts specified by the “Specify hosts allowed to show form-based sign-in prompts to users” setting.\r\n\r\nIf you select “Show prompts only from allowed hosts” then form-based sign-in prompts are shown only from hosts that have been specified by the additional “Specify hosts allowed to show form-based sign-in prompts to users” setting. Form-based sign-in prompts from all other hosts are blocked and the user is shown a message that the sign-in method isn’t allowed.\r\n\r\nNote: If you don’t configure the “Specify hosts allowed to show form-based sign-in prompts to users” setting or don’t specify any hosts in that setting, then the behavior of the “Show prompts only from allowed hosts” option will be the same as if you selected the “Block all prompts” option.\r\n\r\nIf you disable or don’t configure this policy setting, all form-based sign-in prompts are blocked and the user is shown a message that the sign-in method isn’t allowed. But users are able to change the behavior for form-based sign-in prompts by going to File > Options > Trust Center > Trust Center Settings > Form-based sign-in.\r\n\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus, and to subscription versions of Project and Visio.​","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v5~policy~l_microsoftofficesystem~l_securitysettings_l_authenticationfbabehavior_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v5~policy~l_microsoftofficesystem~l_securitysettings_l_authenticationfbabehavior_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v5~policy~l_microsoftofficesystem~l_securitysettings_l_authenticationfbabehavior_l_authenticationfbabehaviorenum","displayName":"Behavior: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v5~policy~l_microsoftofficesystem~l_securitysettings_l_authenticationfbabehavior_l_authenticationfbabehaviorenum_1","displayName":"Block all prompts","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v5~policy~l_microsoftofficesystem~l_securitysettings_l_authenticationfbabehavior_l_authenticationfbabehaviorenum_2","displayName":"Ask the user what to do for each new host","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v5~policy~l_microsoftofficesystem~l_securitysettings_l_authenticationfbabehavior_l_authenticationfbabehaviorenum_3","displayName":"Show prompts only from allowed hosts","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v5~policy~l_microsoftofficesystem~l_securitysettings_l_authenticationfbabehavior_l_authenticationfbaenabledhostsid","displayName":"Specify hosts allowed to show form-based sign-in prompts to users: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v6~policy~l_microsoftofficesystem~l_securitysettings_l_allowvbaintranetrefs","displayName":"Allow VBA to load typelib references by path from untrusted intranet locations (User)","description":"This policy setting permits VBA to load typelib references by explicit path read from the project data if that path points to an intranet location that is not explicitly in the system trusted sites list.\r\n\r\nBy default, VBA will attempt to load typelibs referenced in a project by searching for the library GUID in the registry. If it is not found in the registry, VBA will attempt to load the typelib or project reference using the path stored in the project for the reference as long as the reference does not point to an internet or intranet location that is not in the trusted sites list.\r\n\r\nIf you enable this policy setting, VBA will treat intranet paths like local machine paths, and therefore VBA will attempt to search for unregistered references in intranet locations that are not local machine or in the system's trusted sites list.\r\n\r\nIf you disable or don’t configure this policy setting, VBA maintains its default behavior and will refuse to load typelibs on intranet paths if it does not find the typelib registered in HKEY_CLASSES_ROOT.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v6~policy~l_microsoftofficesystem~l_securitysettings_l_allowvbaintranetrefs_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v6~policy~l_microsoftofficesystem~l_securitysettings_l_allowvbaintranetrefs_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v6~policy~l_microsoftofficesystem~l_securitysettings_l_disablestrictvbarefssecuritypolicy","displayName":"Disable additional security checks on VBA library references that may refer to unsafe locations on the local machine (User)","description":"This policy setting restricts VBA to checking project library references only against the registry and trusted zones. By default VBA performs additional checks against library paths to prevent loading references from potentially unsafe locations on the local machine as well. It is recommended that this setting remain 0 or unset to allow for the more secure default behavior. Only enable this setting if the default behavior is causing compatibility issues with critical solutions, and then, only to provide time to migrate the solutions to address the less secure behavior, at which point the setting should be turned off again.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v6~policy~l_microsoftofficesystem~l_securitysettings_l_disablestrictvbarefssecuritypolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v6~policy~l_microsoftofficesystem~l_securitysettings_l_disablestrictvbarefssecuritypolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v7.updates~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendsurvey","displayName":"Allow users to receive and respond to in-product surveys from Microsoft (User)","description":"This policy setting allows you to control whether your users can receive and respond to in-product surveys in Microsoft 365 products. Microsoft will use this feedback to improve the product experience for users. The ability to receive and respond to in-product surveys is enabled by default.\r\n\r\nIf you enable this policy setting, your users will be able to receive and respond to in-product surveys about their experience using Microsoft 365 products.\r\n\r\nIf you disable this policy setting, Microsoft will not survey your users while they are using Microsoft 365 products.\r\n\r\nIf you don't configure this policy setting, your users will be able to receive and respond to in-product surveys about their experience using Microsoft 365 products.\r\n\r\nComing soon, you will be able to view and manage feedback from your org in the Microsoft 365 admin center.\r\n\r\nNote: This data will be considered \"Feedback\" under your Microsoft 365 agreement, including information that would otherwise be considered \"Customer Data\" or \"Personal Data\".\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise, and to subscription versions of Project and Visio.\r\n\r\nFor more information, see https://go.microsoft.com/fwlink/?linkid=2142253","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v7.updates~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendsurvey_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v7.updates~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendsurvey_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_miscellaneous437_l_personalizationhomeuseprogram","displayName":"Show in-product notifications for the Microsoft Home Use Program (User)","description":"This policy setting controls whether notifications about the Microsoft Home Use Program (HUP) are displayed to end-users in Office applications.\r\n\r\nIf you enable this policy setting, Office will occasionally notify end-users if they are eligible to purchase an Office subscription for their personal use at a discount via the Microsoft Home Use Program. End-users can permanently opt-out of these notifications at any time using a button within the notification.\r\n\r\nIf you disable this policy setting, Office will not display any notifications related to the Microsoft Home Use Program.\r\n\r\nIf you don't configure this policy setting, Microsoft will control whether or not these notifications appear. Please check the Message Center in the Microsoft 365 admin center for updates on whether this feature has been enabled by Microsoft yet and the default setting for the notifications.\r\n\r\nFor more information, see https://aka.ms/huplearnmore.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise, and to subscription versions of Project and Visio.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_miscellaneous437_l_personalizationhomeuseprogram_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_miscellaneous437_l_personalizationhomeuseprogram_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_emailcollection","displayName":"Allow Microsoft to follow up on feedback submitted by users (User)","description":"This policy setting controls whether Microsoft can follow up on feedback submitted by users to help understand the feedback, troubleshoot an issue submitted through feedback, or share back how Microsoft used the feedback to improve the product.\r\n\r\nMicrosoft may send transactional emails or request follow-up conversations via email, voice, or other means related to the feedback or survey response. In some circumstances, Microsoft may ask for additional information to assist with troubleshooting.\r\n\r\nIf you enable this policy setting, Microsoft may follow up on feedback submitted. \r\n\r\nIf you disable or don’t configure this policy setting, Microsoft will not follow up on feedback submitted by your users.\r\n\r\nComing soon, you will be able to view and manage feedback from your org in the Microsoft 365 admin center.\r\n\r\nNote: This policy setting has no effect if the \"Allow users to submit feedback to Microsoft\" policy setting or the “Allow users to receive and respond to in-product surveys from Microsoft” policy setting is set to Disabled.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise, and to subscription versions of Project and Visio.\r\n\r\nFor more information, see https://go.microsoft.com/fwlink/?linkid=2142253","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_emailcollection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_emailcollection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendsurvey","displayName":"[Deprecated] Allow users to receive and respond to in-product surveys from Microsoft (User)","description":"This policy setting allows you to control whether your users can receive and respond to in-product surveys in Microsoft 365 products. Microsoft will use this feedback to improve the product experience for users. The ability to receive and respond to in-product surveys is enabled by default.\r\n\r\nIf you enable this policy setting, your users will be able to receive and respond to in-product surveys about their experience using Microsoft 365 products.\r\n\r\nIf you disable this policy setting, Microsoft will not survey your users while they are using Microsoft 365 products.\r\n\r\nIf you don't configure this policy setting, your users will be able to receive and respond to in-product surveys about their experience using Microsoft 365 products.\r\n\r\nComing soon, you will be able to view and manage feedback from your org in the Microsoft 365 admin center.\r\n\r\nNote: This data will be considered \"Feedback\" under your Microsoft 365 agreement, including information that would otherwise be considered \"Customer Data\" or \"Personal Data\".\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise, and to subscription versions of Project and Visio.\r\n\r\nFor more information, see https://go.microsoft.com/fwlink/?linkid=2142253","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendsurvey_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_sendsurvey_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings_l_model3dblockedextensions","displayName":"Disable 3D Model File Formats List (User)","description":"This policy setting allows you to specify a list of 3D model file formats that will be blocked from being loaded in Office applications.\r\n\r\nIf you enable this policy setting, you can specify a list of 3D Model file format that Office applications will block on insert or load. You should specify the list of 3D model file formats to block in a list of files extensions. For example, to block the FBX extension, enter the string “FBX”. To block the FBX and OBJ extensions, enter the string “FBX; OBJ”.\r\n\r\nIf you disable or do not configure this policy setting, Office applications do not restrict any 3D model file formats.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings_l_model3dblockedextensions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings_l_model3dblockedextensions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings_l_model3dblockedextensions_l_model3dblocklist","displayName":"List of file extensions to block: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffcameraandmicrophoneinapplicationguard","displayName":"Turn off camera and microphone access for Office apps using Application Guard. (User)","description":"The policy allows you to control whether Office apps using Application Guard can access the user's camera and microphone if they're enabled on the user's device.\r\n\r\nImportant: A compromised Application Guard container could bypass camera and microphone permissions and access the camera and microphone without the user’s knowledge. To prevent unauthorized access, we recommend that the camera and microphone be turned off on the user’s device when they aren’t needed.\r\n\r\nIf you enable this policy setting, Office apps using Application Guard won't be able to access the camera and microphone on the user’s device. \r\n\r\nIf you disable or don't configure this policy setting, Office apps using Application Guard will be able to access the camera and microphone on the user’s device.\r\n\r\nNote: This policy setting only applies to Microsoft 365 Apps for enterprise.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffcameraandmicrophoneinapplicationguard_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffcameraandmicrophoneinapplicationguard_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffclipboardaccessinapplicationguard","displayName":"Don't allow copy and paste from Office documents opened in Application Guard. (User)","description":"This policy setting allows you to control whether users can copy and paste content from Office to and from documents opened in Application Guard.\r\nNote: Application Guard only allows copying text and images and doesn’t allow copying of rich content.\r\n\r\nIf you enable this policy setting, users can't copy and paste content to and from documents opened in Application Guard to other locations outside Application Guard.\r\n\r\nIf you disable or don't configure this policy setting, users can copy and paste content to and from documents opened in Application Guard to other locations outside Application Guard.\r\n\r\nNote: This policy setting only applies to Microsoft 365 Apps for enterprise.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffclipboardaccessinapplicationguard_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffclipboardaccessinapplicationguard_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffhardwareaccelerationinapplicationguard","displayName":"Disable hardware acceleration for Office in Application Guard. (User)","description":"This policy setting controls whether Office in Application Guard uses hardware or software acceleration to render graphics.\r\n\r\nIf you enable this setting, Application Guard uses software-based (CPU) rendering and won’t load any third-party graphics drivers or interact with any connected graphics hardware.\r\n\r\nImportant: Be aware that disabling or not configuring this policy setting with potentially compromised graphics devices or drivers might pose a risk to the user's device.\r\n\r\nIf you disable or don't configure this setting, Application Guard uses Hyper-V to access supported, high-security rendering graphics hardware (GPUs). These GPUs improve rendering performance and battery life while using Application Guard, particularly for video playback and other graphics-intensive operations. If you disable or don't configure this setting without connecting any high-security rendering graphics hardware, Application Guard will automatically revert to software-based (CPU) rendering.\r\n\r\nNote: This policy setting only applies to Microsoft 365 Apps for enterprise. ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffhardwareaccelerationinapplicationguard_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffhardwareaccelerationinapplicationguard_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffofficeinapplicationguard","displayName":"Don't use Application Guard with Office. (User)","description":"This policy setting allows you to control whether Office apps use Application Guard to isolate untrusted documents.\r\n\r\nIf you enable this policy setting, Office apps won't use Application Guard to isolate untrusted documents even if the device is configured to use Application Guard. Instead, Office will use Protected View to isolate untrusted documents.\r\n\r\nNote: You should consider enabling this policy setting if you want to stop Office apps from using Application Guard without impacting the use of Application Guard with other applications.\r\n\r\nIf you disable or don't configure this policy settings, Office apps will use Application Guard to isolate untrusted documents. The device must be configured to use Application Guard and the user must be licensed to use Application Guard.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffofficeinapplicationguard_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffofficeinapplicationguard_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffprintsettingsinapplicationguard","displayName":"Restrict printing from Office of documents opened in Application Guard. (User)","description":"This policy setting allows you to control how users can print from Office documents opened in Application Guard. \r\nIf you enable this policy setting, you can choose to selectively retrict one or more of the following printing options.\r\n- Don't allow printing to XPS, prevents users from printing as XPS and saving the resulting file on the host. \r\n- Don't allow printing to PDF, prevents users from printing as PDF and saving the resulting file on the host. \r\n- Don't allow printing to local printers, prevents users from printing to locally attached printers. \r\n- Don't allow printing to existing network printers, prevents users from printing to previously connected network printers. Also, users can't search for additional printers.\r\nNote: if you select all the choices or don’t select any of the choices, then printing isn’t allowed in Application Guard.\r\n\r\nIf you disable or don’t configure this policy setting, users can print to all printers configured on their device.\r\n\r\nNote: This policy setting only applies to Microsoft 365 Apps for enterprise.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffprintsettingsinapplicationguard_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffprintsettingsinapplicationguard_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffprintsettingsinapplicationguard_l_turnofflocalprintinginapplicationguard","displayName":"Disable Local printing (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffprintsettingsinapplicationguard_l_turnofflocalprintinginapplicationguard_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffprintsettingsinapplicationguard_l_turnofflocalprintinginapplicationguard_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffprintsettingsinapplicationguard_l_turnoffnetworkprintinginapplicationguard","displayName":"Disable Network printing (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffprintsettingsinapplicationguard_l_turnoffnetworkprintinginapplicationguard_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffprintsettingsinapplicationguard_l_turnoffnetworkprintinginapplicationguard_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffprintsettingsinapplicationguard_l_turnoffpdfprintinginapplicationguard","displayName":"Disable PDF printing (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffprintsettingsinapplicationguard_l_turnoffpdfprintinginapplicationguard_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffprintsettingsinapplicationguard_l_turnoffpdfprintinginapplicationguard_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffprintsettingsinapplicationguard_l_turnoffxpsprintinginapplicationguard","displayName":"Disable XPS printing (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffprintsettingsinapplicationguard_l_turnoffxpsprintinginapplicationguard_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffprintsettingsinapplicationguard_l_turnoffxpsprintinginapplicationguard_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnofftrustpromotionfordocumentsinapplicationguard","displayName":"Prevent users from removing Application Guard protection on files. (User)","description":"This policy setting allows you to control whether users can remove Application Guard protection and open a document with full trust in Office.\r\n\r\nIf you enable this policy setting, users can continue to work with Office documents in Application Guard, however, they cannot remove protection and open a document outside Application Guard.\r\n\r\nIf you disable or do not configure this policy settings, Office will by default allow users to remove protection and open a document with full trust.\r\n\r\nNote: This policy setting only applies to Microsoft 365 Apps for enterprise.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnofftrustpromotionfordocumentsinapplicationguard_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v7~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnofftrustpromotionfordocumentsinapplicationguard_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v8~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_logcollection","displayName":"Allow users to include log files and content samples when they submit feedback to Microsoft (User)","description":"This policy setting controls whether your users see an option to include log files and content samples when they submit feedback to Microsoft.\r\n\r\nLog files and content samples help Microsoft troubleshoot product issues and Microsoft will use this information to improve product experiences for users. The option to include log files and content samples when submitting feedback to Microsoft is disabled by default.\r\n\r\nIf you enable this policy setting, your users will see an option to include log files and content samples when they submit feedback to Microsoft.\r\n\r\nIf you disable or don’t configure this policy setting, your users will not see an option to include log files and content samples when they submit feedback to Microsoft.\r\n\r\nComing soon, you will be able to view and manage feedback from your org in the Microsoft 365 admin center.\r\n\r\nNote: This policy setting has no effect if the \"Allow users to submit feedback to Microsoft\" policy setting is set to Disabled.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise, and to subscription versions of Project and Visio.\r\n\r\nFor more information, see https://go.microsoft.com/fwlink/?linkid=2142253","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v8~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_logcollection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v8~policy~l_microsoftofficesystem~l_privacy~l_trustcenter_l_logcollection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v8~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_onlytrustvbasignaturev3","displayName":"Only trust VBA macros that use V3 signatures (User)","description":"This policy setting controls whether only VBA macros that use V3 signatures can be trusted and run in the application.\r\n\r\nIf you enable this policy setting, only VBA macros that use V3 signatures can be trusted and run in the application.\r\n\r\nIf you enable this policy setting, we also recommend that you enable the “VBA Macro Notification Settings” policy setting for the application and then select the “Disable all except digitally signed macros” option.\r\n\r\nNote: Before enabling this policy setting, you should upgrade your existing VBA macros to use V3 signatures.\r\n\r\nIf you disable or don’t configure this policy setting, VBA macros signed with legacy signature schemes can be trusted and run in the application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v8~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_onlytrustvbasignaturev3_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v8~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241_l_onlytrustvbasignaturev3_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v8~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_configureprecreateinapplicationguard","displayName":"Configure Application Guard container precreation. (User)","description":"This policy setting determines if the Application Guard container, for isolating untrusted files, is pre-created for improved run time performance.\r\n\r\nIf you enable this policy setting, you can specify the number of days to continue pre-creating an Application Guard container if the user has not opened a file with Application Guard. Pre-creating a container when the user logs in will decrease the wait time when opening an untrusted file.\r\n\r\n“65535” will configure Office to always create an Application Guard container when a user logs into Windows.\r\n\"20\" will configure Office to pre-create the container each time a user logs into Windows for up to 20 days after the last time the user opened an untrusted file using Application Guard.\r\n“0” will configure Office to never pre-create the container. Instead the container will only be created when a user opens their first untrusted file after logging into Windows.\r\n\r\nNote: if you configure Office to never pre-create a container then users will experience a longer wait when opening an untrusted file after logging into Windows.\r\n\r\nIf you disable or don’t configure this setting, Office will use a built-in heuristic to pre-create the container.\r\n\r\nNote: This policy setting only applies to Microsoft 365 Apps for enterprise.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v8~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_configureprecreateinapplicationguard_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v8~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_configureprecreateinapplicationguard_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v8~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_configureprecreateinapplicationguard_l_setappguardprewarmwindowvalue","displayName":"Pre-Create Window (days): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser","displayName":"Show the option for the Office Update Channel experience (User)","description":"This policy setting controls whether the option for Update Channel experience is shown under File > Account on an Office app, such as Word.\r\n\r\nBy showing this option, a user can choose to receive Office updates from the Office update channels that the administrator chooses to expose to the users.\r\n\r\nIf you enable this policy setting, the option for Update Channel experience is shown under File > Account.\r\n\r\nNote: This policy supersedes the “Show the option for Office Insider” in cases where both policies are configured.\r\n\r\nNote: If you enable this policy setting, you shouldn’t enable and configure the “Target Version”, “Update Channel” or the “Update Path” policy setting under Computer Configuration\\Policies\\Administrative Templates\\Microsoft Office 2016 (Machine)\\Updates. If you do, those policy settings will take precedence, blocking user access to the Office Update Channel experience.\r\n\r\nIf you disable this policy setting, the option for Office Channel experience is not shown under File > Account.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_l_uc_insiderfast","displayName":"Beta Channel (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_l_uc_insiderfast_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_l_uc_insiderfast_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_l_uc_insiderslow","displayName":"Current Channel (Preview) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_l_uc_insiderslow_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_l_uc_insiderslow_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_l_uc_mec","displayName":"Monthly Enterprise Channel (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_l_uc_mec_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_l_uc_mec_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_l_uc_production","displayName":"Current Channel (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_l_uc_production_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_l_uc_production_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_l_uc_sae","displayName":"Semi-Annual Enterprise Channel (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_l_uc_sae_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_l_uc_sae_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_l_uc_saepreview","displayName":"Semi-Annual Enterprise Channel (Preview) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_l_uc_saepreview_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_miscellaneous437_l_updatechannelselectoruser_l_uc_saepreview_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffblockingofunsupportedfiletypesinapplicationguard","displayName":"Turn off protection of unsupported file types in Application Guard for Office. (User)","description":"This policy setting controls whether Application Guard for Office will block unsupported file types from being opened in Office apps or if it will enable the redirection to Protected View.\r\n\r\nIf you enable this setting, Application Guard for Office will redirect unsupported file types to Protected View in Office apps.\r\n\r\nImportant: Be aware that enabling this policy setting might pose a risk to the user's device.\r\n\r\nIf you disable or don't configure this setting, Application Guard for Office will block unsupported file types in Office apps.\r\n\r\nNote: This policy setting only applies to Microsoft 365 Apps for enterprise.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffblockingofunsupportedfiletypesinapplicationguard_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_office16v9~policy~l_microsoftofficesystem~l_securitysettings~l_trustcenter241~l_applicationguard_l_turnoffblockingofunsupportedfiletypesinapplicationguard_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_automountteamsites","displayName":"Configure team site libraries to sync automatically (User)","description":"This setting lets you specify SharePoint team site libraries to sync automatically the next time users sign in to the OneDrive sync app (OneDrive.exe). It may take up to 8 hours after a users signs in before the library begins to sync. To use the setting, you must enable OneDrive Files On-Demand, and the setting applies only for users on computers running Windows 10 (1709) Fall Creators Update or later. Do not enable this setting for the same library to more than 1,000 devices. To ensure a good sync experience, avoid enabling this feature on large libraries sets (For the most up to date guidance see https://docs.microsoft.com/en-us/onedrive/use-group-policy#AutoMountTeamSites). This feature is not enabled for on-premises SharePoint sites.\r\n \r\nIf you enable this setting, the OneDrive sync app will automatically download the contents of the libraries you specified as online-only files the next time the user signs in. The user won't be able to stop syncing the libraries.\r\n \r\nIf you disable this setting, team site libraries that you've specified won't be automatically synced for new users. Existing users can choose to stop syncing the libraries, but the libraries won't stop syncing automatically.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_automountteamsites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_automountteamsites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_automountteamsites_automountteamsiteslistbox","displayName":"Libraries: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_automountteamsites_automountteamsiteslistbox_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_automountteamsites_automountteamsiteslistbox_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_defaultrootdir","displayName":"Set the default location for the OneDrive folder (User)","description":"This setting lets you set a specific path as the default location of the OneDrive folder on users' computers. By default, the path is under %userprofile%.\r\n\r\nIf you enable this setting, the default location of the OneDrive - {organization name} folder will be the path that you specify in the OneDrive.admx file. To prevent users from changing the location you specify, enable the \"Prevent users from changing the location of their OneDrive folder\" setting.\r\n\r\nIf you disable or do not configure this setting, the default location of the OneDrive - {organization name} folder will be in %userprofile%.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_defaultrootdir_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_defaultrootdir_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_defaultrootdir_defaultrootdirlist","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_defaultrootdir_defaultrootdirlist_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_defaultrootdir_defaultrootdirlist_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_disablecustomroot","displayName":"Prevent users from changing the location of their OneDrive folder (User)","description":"This setting lets you block users from changing the location of their OneDrive - {organization name} folder during setup of the OneDrive sync app.\r\n\r\nIf you enable this setting, the \"Change location\" link is hidden in OneDrive Setup. The OneDrive folder will be created in the default location, or in the custom location you specified if you enabled the \"Set the default location for the OneDrive folder\" setting.\r\n\r\nIf you disable or do not configure this setting, users can click the \"Change location\" link to change the location of their OneDrive folder in OneDrive Setup.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_disablecustomroot_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_disablecustomroot_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_disablecustomroot_disablecustomrootlist","displayName":"Change location setting: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_disablecustomroot_disablecustomrootlist_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_disablecustomroot_disablecustomrootlist_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_disablefretutorial","displayName":"Disable the tutorial that appears at the end of OneDrive Setup (User)","description":"This setting lets you prevent the tutorial from launching in a web browser at the end of OneDrive Setup.\r\n\r\nIf you enable this setting, users will not see the tutorial after they complete OneDrive Setup.\r\n\r\nIf you disable or do not configure this setting, the tutorial will appear at the end of OneDrive Setup.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_disablefretutorial_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_disablefretutorial_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_disablepauseonbatterysaver","displayName":"Continue syncing when devices have battery saver mode turned on (User)","description":"This setting lets you turn off the auto-pause feature for devices that have battery saver mode turned on.\r\n\r\nIf you enable this setting, syncing will continue when users turn on battery saver mode. OneDrive will not automatically pause syncing.\r\n\r\nIf you disable or do not configure this setting, syncing will pause automatically when battery saver mode is detected and a notification will be displayed. Users can choose not to pause syncing by clicking \"Sync Anyway\" in the notification. When syncing is paused, users can resume syncing by clicking the OneDrive cloud icon in the notification area of the taskbar and then clicking the alert at the top of the activity center.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_disablepauseonbatterysaver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_disablepauseonbatterysaver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_disablepauseonmeterednetwork","displayName":"Continue syncing on metered networks (User)","description":"This setting lets you turn off the auto-pause feature when devices connect to metered networks.\r\n\r\nIf you enable this setting, syncing will continue when devices are on a metered network. OneDrive will not automatically pause syncing.\r\n\r\nIf you disable or do not configure this setting, syncing will pause automatically when a metered network is detected and a notification will be displayed. Users can choose not to pause syncing by clicking \"Sync Anyway\" in the notification. When syncing is paused, uers can resume syncing by clicking the OneDrive cloud icon in the notification area of the taskbar and then clicking the alert at the top of the activity center.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_disablepauseonmeterednetwork_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_disablepauseonmeterednetwork_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_disablepersonalsync","displayName":"Prevent users from syncing personal OneDrive accounts (User)","description":"This setting lets you block users from signing in with a Microsoft account to sync their personal OneDrive files.\r\n\r\nIf you enable this setting, users will be prevented from setting up a sync relationship for their personal OneDrive account. Users who are already syncing their personal OneDrive when you enable this setting won't be able to continue syncing (and will be shown a message that syncing has stopped), but any files synced to the computer will remain on the computer.\r\n\r\nIf you disable or do not configure this setting, users can sync their personal OneDrive accounts.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_disablepersonalsync_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_disablepersonalsync_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_downloadbandwidthlimit","displayName":"Limit the sync app download speed to a fixed rate (User)","description":"This setting lets you configure the maximum speed at which the OneDrive sync app (OneDrive.exe) can download files. This rate is a fixed value in kilobytes per second, and applies only to syncing, not to downloading updates. The lower the rate, the slower files will download. The minimum rate that can be set is 1 KB/s and the maximum rate is 100000 KB/s. Any input lower than 50 KB/s will set the limit to 50 KB/s, even if the UI shows the inputted rate.\r\nIf you enable this setting, computers will use the maximum download rate that you specify, and users will not be able to change it.\r\n\r\nIf you disable or do not configure this setting, users can choose to limit the download rate in OneDrive sync app settings.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_downloadbandwidthlimit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_downloadbandwidthlimit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_downloadbandwidthlimit_downloadratevalue","displayName":"Bandwidth: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_enableallocsiclients","displayName":"Coauthor and share in Office desktop apps (User)","description":"This setting lets multiple users use the Office 365 ProPlus, Office 2019, or Office 2016 desktop apps to simultaneously edit an Office file stored in OneDrive. It also lets users share files from the Office desktop apps.\r\n\r\nIf you enable this setting, coauthoring and sharing in the Office desktop apps is enabled. Users can disable these features by opening the OneDrive sync app settings, clicking the Office tab, and clearing the \"Use Office applications to sync Office files that I open\" check box.\r\n\r\nIf you disable this setting, coauthoring and sharing in the Office desktop apps is disabled, and the Office tab is hidden in sync app. The \"Office file conflicts\" setting will also be disabled and when two versions of a file conflict, both copies will be kept.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_enableallocsiclients_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_enableallocsiclients_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_enableholdthefile","displayName":"Allow users to choose how to handle Office file sync conflicts (User)","description":"This setting specifies what happens when there's a conflict between Office file versions during sync. By default, users can decide if they want to merge changes or keep both copies. Users can also change settings in the OneDrive sync app to always keep both copies. (This option is available for Office 2016 or later only. With earlier versions of Office, both copies are always kept.)\r\n\r\nIf you enable this setting or do not configure this setting, users can decide if they want to merge changes or keep both copies. Users can also select in OneDrive sync app settings to keep both copies.\r\n\r\nIf you disable this setting, both copies of the file will be kept when versions of a file conflict. Users won't be able to change the setting and merge changes.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_enableholdthefile_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_enableholdthefile_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_uploadbandwidthlimit","displayName":"Limit the sync app upload speed to a fixed rate (User)","description":"This setting lets you configure the maximum speed at which the OneDrive sync app (OneDrive.exe) can upload files. This rate is a fixed value in kilobytes per second. The lower the rate, the slower the computer will upload files. The minimum rate that can be set is 1 KB/s and the maximum rate is 100000 KB/s. Any input lower than 50 KB/s will set the limit to 50 KB/s, even if the UI shows the inputted rate.\r\n\r\nIf you enable this setting, computers will use the maximum upload rate that you specify, and users will not be able to change it in OneDrive settings.\r\n\r\nIf you disable or do not configure this setting, users can choose to limit the upload rate to a fixed value (in KB/second), or set it to \"Adjust automatically\" which will use 70% of upload throughput to respond to increases and decreases in throughput.\r\n\r\nInstead of using this setting to limit the upload rate, we recommend enabling \"Limit the sync app upload rate to a percentage of throughput\" to set a limit that adjusts to changing conditions. You should not enable both settings at the same time.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_uploadbandwidthlimit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_uploadbandwidthlimit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onedrivengscv2~policy~onedrivengsc_uploadbandwidthlimit_uploadratevalue","displayName":"Bandwidth: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onedrivengscv4~policy~onedrivengsc_kfmforcewindowsdisplaylanguage","displayName":"Always use the user's Windows display language when provisioning known folders in OneDrive (User)","description":"When you move Windows known folders to OneDrive, they will be provisioned in the user's Windows display language by default, unless the user sets a different preferred language. This setting lets you override the user's preferred language setting. It works with both Known Folder Move settings (\"Silently move Windows known folders to OneDrive\" and \"Prompt users to move Windows known folders to OneDrive\").\r\n\r\nIf you enable this setting, known folders will be provisioned using the user's Windows display language, even if the user sets a different preferred language.\r\n\r\nIf you disable or do not configure this setting, and the user set a preferred language, their known folders will be provisioned in OneDrive using that language. The known folders on their PC will appear in their preferred language.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onedrivengscv4~policy~onedrivengsc_kfmforcewindowsdisplaylanguage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onedrivengscv4~policy~onedrivengsc_kfmforcewindowsdisplaylanguage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onedrivengscv6~policy~onedrivengsc_disablefreanimation","displayName":"Disable animation that appears during OneDrive Setup (User)","description":"This setting lets you prevent the animation from showing during OneDrive Setup.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onedrivengscv6~policy~onedrivengsc_disablefreanimation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onedrivengscv6~policy~onedrivengsc_disablefreanimation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onedrivengscv7~policy~onedrivengsc_enableautostart","displayName":"Start OneDrive automatically when signing in to Windows (User)","description":"This setting overrides a user's choice, ensuring OneDrive will automatically start every time they sign in to Windows. \r\n \r\nIf you configure this setting, OneDrive will start automatically when a user signs in to Windows. The OneDrive sync app must be restarted after this setting is enabled for the setting to take effect.\r\n\r\nIf you do not configure this setting or set it to any value other than 1, the user can choose to automatically start OneDrive (default choice) or to disable OneDrive from starting in OneDrive sync app settings.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onedrivengscv7~policy~onedrivengsc_enableautostart_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onedrivengscv7~policy~onedrivengsc_enableautostart_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_addins_l_blockallunmanagedaddins","displayName":"Block all unmanaged add-ins (User)","description":"This policy setting blocks all add-ins that are not managed by the \"List of managed add-ins\" policy setting.\r\n\r\nIf you enable this policy setting, and the \"List of managed add-ins\" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the \"List of managed add-ins\" policy setting.\r\n\r\nIf you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the \"List of managed add-ins\" policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_addins_l_blockallunmanagedaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_addins_l_blockallunmanagedaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_addins_l_disableinstalledonenoteaddins","displayName":"Disable installed OneNote Add-ins (User)","description":"Turns off all of the installed OneNote Add-ins.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_addins_l_disableinstalledonenoteaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_addins_l_disableinstalledonenoteaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_addins_l_disableonenotecomapi","displayName":"Disable OneNote COM API (User)","description":"Disable OneNote COM API - this disables add-on applications that may use the COM API. Note that it also breaks other features that use this API such as sending information from Outlook to OneNote.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_addins_l_disableonenotecomapi_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_addins_l_disableonenotecomapi_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_addins_l_listofmanagedaddins","displayName":"List of managed add-ins (User)","description":"This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the \"Block all unmanaged add-ins\" policy setting.\r\n\r\nTo enable this policy setting, provide the following information for each add-in:\r\n\r\nIn \"Value name,\" specify the programmatic identifier (ProgID) for COM add-ins.\r\n\r\nTo obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Office\\OneNote\\Addins or HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Office\\OneNote\\Addins.\r\n\r\nYou can also obtain the ProgID of an add-in by using Office Telemetry Dashboard.\r\n\r\nIn \"Value,\" specify the value as follows:\r\n\r\nTo specify that an add-in is always disabled (blocked), type 0.\r\n\r\nTo specify that an add-in is always enabled, type 1.\r\n\r\nTo specify that an add-in is configurable by the user and not blocked by the \"Block all unmanaged add-ins\" policy setting when enabled, type 2.\r\n\r\nIf you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the \"Block all unmanaged add-ins\" policy setting is enabled, then all add-ins are blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_addins_l_listofmanagedaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_addins_l_listofmanagedaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_addins_l_listofmanagedaddins_l_listofmanagedaddins2","displayName":"List of managed add-ins (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_addins_l_listofmanagedaddins_l_listofmanagedaddins2_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_addins_l_listofmanagedaddins_l_listofmanagedaddins2_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_choosedefaultcodectobeusedforvideonotebook","displayName":"Choose default codec to be used for Video notebook (User)","description":"This option will set the default codec used by OneNote for video recording that are created in OneNote.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_choosedefaultcodectobeusedforvideonotebook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_choosedefaultcodectobeusedforvideonotebook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_choosedefaultcodectobeusedforvideonotebook_l_choosethewindowsmediavideo8codec","displayName":"Choose the Windows Media Video 8 codec: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_choosedefaultcodectobeusedforvideonotebook_l_choosethewindowsmediavideo8codec_windows media video 8 for color pocket pcs (150 kbps)","displayName":"Color Pocket PCs (150 Kbps)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_choosedefaultcodectobeusedforvideonotebook_l_choosethewindowsmediavideo8codec_windows media video 8 for dial-up modems or single-channel isdn (28.8 to 56 kbps)","displayName":"Dial-up Modems or Single-channel ISDN (28.8 to 56 Kbps)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_choosedefaultcodectobeusedforvideonotebook_l_choosethewindowsmediavideo8codec_windows media video 8 for lan, cable modem, or xdsl (100 to 768 kbps)","displayName":"LAN, Cable Modem, or xDSL (100 to 768 Kbps)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_choosedefaultcodectobeusedforvideonotebook_l_choosethewindowsmediavideo8codec_windows media video 8 for dial-up modems or lan (28.8 to 100 kbps)","displayName":"Dial-up Modems or LAN (28.8 to 100 Kbps)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_choosedefaultcodectobeusedforvideonotebook_l_choosethewindowsmediavideo8codec_windows media video 8 for dial-up modems (28.8 kbps)","displayName":"Dial-up Modems (28.8 Kbps)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_choosedefaultcodectobeusedforvideonotebook_l_choosethewindowsmediavideo8codec_windows media video 8 for dial-up modems (56 kbps)","displayName":"Dial-up Modems (56 Kbps)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_choosedefaultcodectobeusedforvideonotebook_l_choosethewindowsmediavideo8codec_windows media video 8 for local area network (100 kbps)","displayName":"Local Area Network (100 Kbps)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_choosedefaultcodectobeusedforvideonotebook_l_choosethewindowsmediavideo8codec_windows media video 8 for local area network (256 kbps)","displayName":"Local Area Network (256 Kbps)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_choosedefaultcodectobeusedforvideonotebook_l_choosethewindowsmediavideo8codec_windows media video 8 for local area network (384 kbps)","displayName":"Local Area Network (384 Kbps)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_choosedefaultcodectobeusedforvideonotebook_l_choosethewindowsmediavideo8codec_windows media video 8 for broadband (ntsc, 700 kbps)","displayName":"Broadband (NTSC, 700 Kbps)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_choosedefaultcodectobeusedforvideonotebook_l_choosethewindowsmediavideo8codec_windows media video 8 for broadband (ntsc, 1400 kbps)","displayName":"Broadband (NTSC, 1400 Kbps)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_choosedefaultcodectobeusedforvideonotebook_l_choosethewindowsmediavideo8codec_windows media video 8 for broadband (pal, 384 kbps)","displayName":"Broadband (PAL, 384 Kbps)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_choosedefaultcodectobeusedforvideonotebook_l_choosethewindowsmediavideo8codec_windows media video 8 for broadband (pal, 700 kbps)","displayName":"Broadband (PAL, 700 Kbps)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_disableaudosearch","displayName":"Disable audio search (User)","description":"Disables OneNote audio search feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_disableaudosearch_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_disableaudosearch_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_disablelinkedaudiofeature","displayName":"Disable Linked Audio feature (User)","description":"This policy setting allows you to configure the Record Audio and the Record Video commands on the Insert tab.\r\n\r\nIf you enable this policy setting, the commands will be not be available.\r\n\r\nIf you disable or do not configure this policy, the commands will be available.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_disablelinkedaudiofeature_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_disablelinkedaudiofeature_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_rewindfromstartofparagraphbythefollowingnumberofseconds","displayName":"Rewind from start of paragraph by the following number of seconds (User)","description":"Sets the value in the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_rewindfromstartofparagraphbythefollowingnumberofseconds_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_rewindfromstartofparagraphbythefollowingnumberofseconds_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_rewindfromstartofparagraphbythefollowingnumberofseconds_l_rewindfromstartofparagraphbysec","displayName":"Rewind from start of paragraph by: (sec) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_specifynumberofbitstosamplewhenrecording","displayName":"Specify number of bits to sample when recording (User)","description":"Specifies the default number of bits per sample (value is in kbps) used when recording audio. If the appropriate codec is found, then this is the default bit depth used in the Format setting for Linked Audio, found under File tab | Options | Audio & Video.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_specifynumberofbitstosamplewhenrecording_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_specifynumberofbitstosamplewhenrecording_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_specifynumberofbitstosamplewhenrecording_l_bits","displayName":"Bits: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_specifynumberofchannelstorecord","displayName":"Specify number of channels to record (User)","description":"Specifies whether 1 or 2 channels are used when recording audio. If the appropriate codec is found, then this is the default number of channels used in the Format setting for Linked Audio found under File tab | Options | Audio & Video.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_specifynumberofchannelstorecord_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_specifynumberofchannelstorecord_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_specifynumberofchannelstorecord_l_channels12","displayName":"Channels (1-2): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_specifyratetosampleaudiobitssecond","displayName":"Specify rate to sample audio (bits/second) (User)","description":"Specifies the default sample rate (value is in kHz) used when recording audio. If the appropriate codec is found, then this is the default sample rate used in the Format setting for Linked Audio found under File tab | Options | Audio & Video.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_specifyratetosampleaudiobitssecond_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_specifyratetosampleaudiobitssecond_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_audioandvideo_l_specifyratetosampleaudiobitssecond_l_bitssecond","displayName":"Bits/Second: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook","displayName":"Automatically back up my notebook... (User)","description":"Checks/Unchecks the option ''Automatically back up my notebook at the following time interval''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin","displayName":"Automatically back up at this interval (min): (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_1","displayName":"1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_2","displayName":"2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_3","displayName":"3","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_4","displayName":"4","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_5","displayName":"5","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_10","displayName":"10","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_15","displayName":"15","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_30","displayName":"30","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_60","displayName":"60","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_120","displayName":"120","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_180","displayName":"180","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_240","displayName":"240","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_300","displayName":"300","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_360","displayName":"360","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_480","displayName":"480","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_720","displayName":"720","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_960","displayName":"960","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_1440","displayName":"1440","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_2880","displayName":"2880","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_4320","displayName":"4320","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_5760","displayName":"5760","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_7200","displayName":"7200","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_8640","displayName":"8640","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_10080","displayName":"10080","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_20160","displayName":"20160","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_30240","displayName":"30240","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_40320","displayName":"40320","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_50400","displayName":"50400","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_automaticallybackupatthisintervalmin_60480","displayName":"60480","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_checktoenableautomaticbackup","displayName":"Check to enable automatic backup (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_checktoenableautomaticbackup_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_automaticallybackupmynotebook_l_checktoenableautomaticbackup_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_numberofbackupcopiestokeep","displayName":"Number of backup copies to keep (User)","description":"Sets the value in the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_numberofbackupcopiestokeep_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_numberofbackupcopiestokeep_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_backup_l_numberofbackupcopiestokeep_l_numberofbackupcopiestokeep2","displayName":"Number of backup copies to keep (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_display_l_navigationbarappearsontheright","displayName":"Navigation bar appears on the right (User)","description":"This option is to specify where the navigation bar appears.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_display_l_navigationbarappearsontheright_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_display_l_navigationbarappearsontheright_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_display_l_pagetabsappearontheleft","displayName":"Page tabs appear on the left (User)","description":"Right: Unchecks the option ''Page tabs appear on the left''. | Left: Checks the option ''Page tabs appear on the left''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_display_l_pagetabsappearontheleft_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_display_l_pagetabsappearontheleft_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_display_l_pagetabsappearontheleft_l_specifylocationofthepagetabcontrol","displayName":"Specify location of the page tab control: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_display_l_pagetabsappearontheleft_l_specifylocationofthepagetabcontrol_0","displayName":"Right","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_display_l_pagetabsappearontheleft_l_specifylocationofthepagetabcontrol_1","displayName":"Left","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_display_l_shownotecontainers","displayName":"Show Note Containers (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_display_l_shownotecontainers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_display_l_shownotecontainers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_display_l_verticalscrollbarappearsonleft","displayName":"Vertical scroll bar appears on left (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_display_l_verticalscrollbarappearsonleft_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_display_l_verticalscrollbarappearsonleft_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_autobulletrecognition","displayName":"Auto Bullet Recognition (User)","description":"Checks/Unchecks the option ''Apply bullets to lists automatically''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_autobulletrecognition_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_autobulletrecognition_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_autokeyboardswitching","displayName":"Auto Keyboard Switching (User)","description":"Check/Unchecks the option ''Switch keyboards automatically''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_autokeyboardswitching_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_autokeyboardswitching_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_autonumberingrecognition","displayName":"Auto Numbering Recognition (User)","description":"Checks/Unchecks the option ''Apply numbering to lists automatically''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_autonumberingrecognition_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_autonumberingrecognition_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_defaultfontname","displayName":"Default Font Name (User)","description":"Specifies the value in the option ''Font''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_defaultfontname_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_defaultfontname_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_defaultfontname_l_font","displayName":"Font: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_defaultfontsize","displayName":"Default Font Size (User)","description":"Specifies the value in the option ''Size''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_defaultfontsize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_defaultfontsize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_defaultfontsize_l_fontsize","displayName":"Font Size: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_includelinktosourcewhenpastingfromtheinternet","displayName":"Include link to source when pasting from the Internet (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_includelinktosourcewhenpastingfromtheinternet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_includelinktosourcewhenpastingfromtheinternet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_showpasteoptionsbuttons","displayName":"Show Paste Options buttons (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_showpasteoptionsbuttons_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_showpasteoptionsbuttons_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_turnoffautocalculator","displayName":"Turn off auto calculator (User)","description":"This option turns on/off the auto calculator functionality.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_turnoffautocalculator_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_turnoffautocalculator_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_turnofflinkcreationwith","displayName":"Turn off link creation with [[ ]] (User)","description":"This policy setting allows you to turn off link creation with [[ ]]. OneNote allows users to automatically create links by putting [[ ]] around a term. OneNote will then automatically create a new page in that section and create a link on that text.\r\n\r\nIf you enable this policy setting, users will not be able to use [[ ]] to create a link and a new page.\r\n\r\nIf you disable or do not configure this policy setting, OneNote will automatically create links when users use [[ ]].","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_turnofflinkcreationwith_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_turnofflinkcreationwith_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_email_l_addsignaturetoonenoteemailmessages","displayName":"Add signature to OneNote email messages (User)","description":"Checks/Unchecks the option ''Add the following signature to e-mail messages and Web pages created in OneNote''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_email_l_addsignaturetoonenoteemailmessages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_email_l_addsignaturetoonenoteemailmessages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_email_l_allowonenoteemailattachments","displayName":"Allow OneNote e-mail attachments (User)","description":"Checks/Unchecks the option ''Attach a copy of the original notes as a OneNote file''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_email_l_allowonenoteemailattachments_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_email_l_allowonenoteemailattachments_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_email_l_attachembeddedfilestotheemail","displayName":"Attach embedded files to the email message as separate files (User)","description":"This policy setting allows you to configure the \"Attach embedded files to the email message as separate file\" option found under File tab | Options | Advanced | E-mail sent from OneNote.\r\n\r\nIf you enable or do not configure this policy setting, embedded files are attached to the email message as separate files.\r\n\r\nIf you disable this policy setting, embedded files are not attached to the email message as separate files.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_email_l_attachembeddedfilestotheemail_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_email_l_attachembeddedfilestotheemail_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_email_l_usethissignatureforonenoteemail","displayName":"Use this signature for OneNote email (User)","description":"Sets the value in the option ''Add the following signature to e-mail messages and Web pages created in OneNote''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_email_l_usethissignatureforonenoteemail_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_email_l_usethissignatureforonenoteemail_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_email_l_usethissignatureforonenoteemail_l_entersignaturetouseforonenoteemail","displayName":"Enter signature to use for OneNote e-mail (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_noteflags_l_copyitemswhenmovingthem","displayName":"Copy items when moving them (User)","description":"This policy setting allows you to configure tagged notes.\r\n\r\nIf you enable or do not configure this policy setting, the option \"Leave original tagged notes unchanged\" will be checked.\r\n\r\nIf you disable this policy setting, the option \"Show original tagged notes as dimmed\" will be checked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_noteflags_l_copyitemswhenmovingthem_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_noteflags_l_copyitemswhenmovingthem_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_noteflags_l_showdimmedtaggednotesinthetagssummarytaskpane","displayName":"Show dimmed tagged notes in the Tags Summary task pane (User)","description":"Checks/unchecks the option \"Show dimmed tagged notes in the Tags Summary task pane.\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_noteflags_l_showdimmedtaggednotesinthetagssummarytaskpane_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_noteflags_l_showdimmedtaggednotesinthetagssummarytaskpane_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_addonenoteicontonotificationarea","displayName":"Add OneNote icon to notification area (User)","description":"Checks/Unchecks the option ''Place OneNote icon in the notification area of the taskbar''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_addonenoteicontonotificationarea_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_addonenoteicontonotificationarea_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_defaultunitofmeasurementusedinonenote","displayName":"Default unit of measurement used in OneNote (User)","description":"Sets the value in the option ''Measurement units''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_defaultunitofmeasurementusedinonenote_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_defaultunitofmeasurementusedinonenote_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_defaultunitofmeasurementusedinonenote_l_specifydefaultunitofmeasurement","displayName":"Specify default unit of measurement: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_defaultunitofmeasurementusedinonenote_l_specifydefaultunitofmeasurement_0","displayName":"Inch","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_defaultunitofmeasurementusedinonenote_l_specifydefaultunitofmeasurement_1","displayName":"Centimeter","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_defaultunitofmeasurementusedinonenote_l_specifydefaultunitofmeasurement_2","displayName":"Millimeter","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_defaultunitofmeasurementusedinonenote_l_specifydefaultunitofmeasurement_3","displayName":"Point","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_defaultunitofmeasurementusedinonenote_l_specifydefaultunitofmeasurement_4","displayName":"Pica","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_disableembeddedfiles","displayName":"Disable embedded files (User)","description":"To disable the ability to embed files on a OneNote page, so people cannot transmit files that might not be caught by anti-virus software, etc. Note: This policy will only limit embedded files in the OneNote UI, if a page has an embedded file OneNote will still sync and replicate the embedded files in the file system.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_disableembeddedfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_disableembeddedfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_disableocr","displayName":"Disable OCR (User)","description":"This policy turns off the OneNote image optical character recognition (OCR) feature. The OCR feature allows OneNote to automatically scan through images to find text that will appear in search results.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_disableocr_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_disableocr_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_disableonenotescreenclippingnotifications","displayName":"Disable OneNote screen clipping notifications (User)","description":"Turns off all of the OneNote screen clipping notifications.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_disableonenotescreenclippingnotifications_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_disableonenotescreenclippingnotifications_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_disableonenotescreenclippings","displayName":"Disable OneNote Screen Clippings (User)","description":"Disables the screen clipping feature in OneNote.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_disableonenotescreenclippings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_disableonenotescreenclippings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_embeddedfilesblockedextensions","displayName":"Embedded Files Blocked Extensions (User)","description":"To disable the ability of the users in your organization from being able to open a file attachment of a specific file type from a Microsoft OneNote page, add the extensions you want to disable using this format: \".ext1;.ext2;\" If you want to disable the opening of any attachment from a OneNote page, see the Disable embedded files policy. You cannot block embedded audio and video recordings (WMA & WMV) with this policy instead refer to the Disable embedded files policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_embeddedfilesblockedextensions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_embeddedfilesblockedextensions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_embeddedfilesblockedextensions_l_empty12","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_loadanotebookonfirstboot","displayName":"Load a notebook on first boot (User)","description":"Points to a folder containing a notebook that should be loaded on first boot.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_loadanotebookonfirstboot_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_loadanotebookonfirstboot_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_loadanotebookonfirstboot_l_empty13","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_notebookpresence","displayName":"Notebook Presence (User)","description":"This policy setting enables or disables the Notebook Presence feature in OneNote, which broadcasts user presence within a notebook and enables real-time synchronization for users who are editing the same page. Note: Any change to this policy does not take effect until OneNote is restarted.\r\n\r\nIf you enable or do not configure this policy setting, users are notified when they are editing the same page in a notebook as another user. OneNote also enters real-time sync when it discovers multiple users editing the same page. \r\n\r\nIf you disable this policy setting, users are not notified when they are editing the same page in a notebook as another user. OneNote does not enter real-time sync when multiple users are editing the same page.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_notebookpresence_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_notebookpresence_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_numberofdaysbeforewarningthatserveris","displayName":"Number of days before warning that server is inaccessible (User)","description":"Set the number of days until OneNote warns that the server is inaccessible and prompts for a new location for the affected files.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_numberofdaysbeforewarningthatserveris_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_numberofdaysbeforewarningthatserveris_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_numberofdaysbeforewarningthatserveris_l_empty14","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_setuncintervaltopollforchangesonfileservers","displayName":"Set UNC interval to poll for changes on file servers (User)","description":"This policy setting allows you to change the synchronization interval at which OneNote will poll for changes on the server. When OneNote synchronizes a notebook on UNC, also known as SMB or Windows File shares, OneNote will receive notifications from the file server as well as poll the server looking for new updates on the server.\r\n\r\nBy making the interval faster it will make OneNote synchronize faster, but it also might cause performance issues on the server.\r\n\r\nIf you enable this policy setting, you may specify the number of seconds OneNote will poll.\r\n\r\nIf you disable or do not configure this policy setting, OneNote will automatically poll every 30 seconds.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_setuncintervaltopollforchangesonfileservers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_setuncintervaltopollforchangesonfileservers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_setuncintervaltopollforchangesonfileservers_l_setuncintervaltopollforchangesonfileserversspinid","displayName":"Interval to poll the server (seconds) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_sharepointsyncinterval","displayName":"SharePoint sync interval for notebooks stored on SharePoint (User)","description":"Limits the number of times OneNote polls a SharePoint site for changes to a section. Enter the sync interval in seconds.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_sharepointsyncinterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_sharepointsyncinterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_sharepointsyncinterval_l_empty15","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_specifyembeddedfilesizelimit","displayName":"Embedded File Size Limit (User)","description":"This policy setting enables you to specify the maximum embedded file size that users can insert directly into a OneNote notebook on a SharePoint server.\r\n \r\nIf you enable this policy setting, you can increase or decrease the default maximum file size of 50 MB. \r\n\r\nIf you increase this value, users can insert larger files directly into the notebook, but this may reduce server performance. \r\n\r\nIf you decrease this value, users can only insert smaller files directly into the notebook, which may improve server performance if OneNote sync is generating a lot of traffic.\r\n\r\nIf you disable or do not configure this policy setting, users cannot insert a file larger than 50MB inserted into a OneNote notebook. Instead, the file is uploaded to a SharePoint folder and inserted as a hyperlink into the notebook.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_specifyembeddedfilesizelimit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_specifyembeddedfilesizelimit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_specifyembeddedfilesizelimit_l_embeddedfilesizelimit","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_turnoffonenoteautolinkednotetaking","displayName":"Turn off OneNote auto-linked note taking (User)","description":"This policy setting turns off the OneNote auto note taking feature which allows you to take notes on items such as webpages, Word documents, etc. OneNote will automatically record what pages or document you were viewing when you took this note.\r\n\r\nIf you enable this policy setting, OneNote will not automatically link notes when the user tries to turn on this feature.\r\n\r\nIf you disable or do not enable this policy, OneNote will automatically link notes when the user tries to turn on this feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_turnoffonenoteautolinkednotetaking_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_turnoffonenoteautolinkednotetaking_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_disablepasswordprotectedsections","displayName":"Disable password protected sections (User)","description":"Disables the ability to create new password protected sections. You can however still unlock and edit existing sections which had a password set.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_disablepasswordprotectedsections_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_disablepasswordprotectedsections_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_disallowsaddonsaccesstopass","displayName":"Disallows add-ons access to password protected sections (User)","description":"This option disallows extensibility add-ons the ability to access password protected sections if they are unlocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_disallowsaddonsaccesstopass_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_disallowsaddonsaccesstopass_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsafteruserhasntworkedonthemforatime","displayName":"Lock password protected sections after user hasn't worked on them for a time (User)","description":"OneNote supports password protecting sections and they are unlocked once a user types the password and can be locked again by either a timeout period or when you navigate away from the section. This option will lock the section after the user hasn't used the section for the selected amount of time.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsafteruserhasntworkedonthemforatime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsafteruserhasntworkedonthemforatime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsafteruserhasntworkedonthemforatime_l_checktolocksections","displayName":"Check to lock sections (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsafteruserhasntworkedonthemforatime_l_checktolocksections_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsafteruserhasntworkedonthemforatime_l_checktolocksections_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsafteruserhasntworkedonthemforatime_l_timeintervalminutestolockpasswordprotectedsections","displayName":"Time interval (minutes) to lock password protected sections: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsafteruserhasntworkedonthemforatime_l_timeintervalminutestolockpasswordprotectedsections_1","displayName":"1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsafteruserhasntworkedonthemforatime_l_timeintervalminutestolockpasswordprotectedsections_5","displayName":"5","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsafteruserhasntworkedonthemforatime_l_timeintervalminutestolockpasswordprotectedsections_10","displayName":"10","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsafteruserhasntworkedonthemforatime_l_timeintervalminutestolockpasswordprotectedsections_15","displayName":"15","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsafteruserhasntworkedonthemforatime_l_timeintervalminutestolockpasswordprotectedsections_30","displayName":"30","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsafteruserhasntworkedonthemforatime_l_timeintervalminutestolockpasswordprotectedsections_60","displayName":"60","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsafteruserhasntworkedonthemforatime_l_timeintervalminutestolockpasswordprotectedsections_120","displayName":"120","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsafteruserhasntworkedonthemforatime_l_timeintervalminutestolockpasswordprotectedsections_240","displayName":"240","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsafteruserhasntworkedonthemforatime_l_timeintervalminutestolockpasswordprotectedsections_480","displayName":"480","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsafteruserhasntworkedonthemforatime_l_timeintervalminutestolockpasswordprotectedsections_720","displayName":"720","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsafteruserhasntworkedonthemforatime_l_timeintervalminutestolockpasswordprotectedsections_1440","displayName":"1440","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsassoonasinavigateawayfromthem","displayName":"Lock password protected sections as soon as I navigate away from them (User)","description":"OneNote supports password protecting sections and they are unlocked once a user types the password and can be locked again by either a timeout period or when you navigate away from the section. This option will lock the section once you navigate away from the password protected section.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsassoonasinavigateawayfromthem_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_password_l_lockpasswordprotectedsectionsassoonasinavigateawayfromthem_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_pen_l_automaticallyswitchbetweenpenandselectiontool","displayName":"Automatically switch between Pen and Selection Tool (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_pen_l_automaticallyswitchbetweenpenandselectiontool_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_pen_l_automaticallyswitchbetweenpenandselectiontool_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_pen_l_createallnewpageswithrulelines","displayName":"Create all new pages with rule lines (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_pen_l_createallnewpageswithrulelines_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_pen_l_createallnewpageswithrulelines_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_pen_l_disablescratchout","displayName":"Disable scratch out (User)","description":"Disables the scratch out gesture while inking.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_pen_l_disablescratchout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_pen_l_disablescratchout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_pen_l_showtabletpcinputpanelononenotepages","displayName":"Show Tablet PC Input Panel on OneNote pages (User)","description":"Enable this policy to display the Tablet PC Input Panel on OneNote pages.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_pen_l_showtabletpcinputpanelononenotepages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_pen_l_showtabletpcinputpanelononenotepages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_pen_l_usepenpressuresensitivity","displayName":"Use pen pressure sensitivity (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_pen_l_usepenpressuresensitivity_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_pen_l_usepenpressuresensitivity_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_enableabilitytooptimizeonenotefiles","displayName":"Enable ability to optimize OneNote files... (User)","description":"Checks/Unchecks the option ''Optimize sections after OneNote has been inactive for the following number of minutes''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_enableabilitytooptimizeonenotefiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_enableabilitytooptimizeonenotefiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_enableabilitytooptimizeonenotefiles_l_checktoenableabilitytooptimizeonenotefiles","displayName":"Check to enable ability to optimize OneNote files (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_enableabilitytooptimizeonenotefiles_l_checktoenableabilitytooptimizeonenotefiles_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_enableabilitytooptimizeonenotefiles_l_checktoenableabilitytooptimizeonenotefiles_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_enableabilitytooptimizeonenotefiles_l_optimizeonenotefilesatthisintervalmin","displayName":"Optimize OneNote files at this interval (min): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_locationofbackupfolder","displayName":"Location of Backup Folder (User)","description":"Sets the value in the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_locationofbackupfolder_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_locationofbackupfolder_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_locationofbackupfolder_l_backupfolder","displayName":"Backup Folder: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_locationofunfilednotessection","displayName":"Location of unfiled notes section (User)","description":"Location where OneNote stores the unfiled notes section.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_locationofunfilednotessection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_locationofunfilednotessection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_locationofunfilednotessection_l_opensidenotesinthissection","displayName":"Open Side Notes in this section: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_notebookroot","displayName":"Notebook Root (User)","description":"To change to where new notebooks are defaulted, enter a path to a folder relative to your documents.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_notebookroot_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_notebookroot_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_notebookroot_l_empty1","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_percentageofunuseddiskspacetoallowinsections","displayName":"Percentage of unused disk space to allow in sections (User)","description":"Sets the value in the option ''Percentage of unused space to allow in sections without optimizing''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_percentageofunuseddiskspacetoallowinsections_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_percentageofunuseddiskspacetoallowinsections_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_save_l_percentageofunuseddiskspacetoallowinsections_l_enterpercentage","displayName":"Enter Percentage: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_configurecngcipherchainingmode","displayName":"Configure CNG cipher chaining mode (User)","description":"This policy setting allows you to configure the cipher chaining mode used.\r\n\r\nIf you enable this policy setting, the cipher chaining mode specified will be applied.\r\n\r\nIf you disable or do not configure this policy setting, Cipher Block Chaining (CBC) will be the default CNG cipher chaining mode used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_l_configurecngcipherchainingmodedropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_l_configurecngcipherchainingmodedropid_chainingmodecbc","displayName":"Cipher Block Chaining (CBC)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_l_configurecngcipherchainingmodedropid_chainingmodecfb","displayName":"Cipher Feedback (CFB)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_setcngcipheralgorithm","displayName":"Set CNG cipher algorithm (User)","description":"This policy setting allows you to configure the CNG cipher algorithm that is used.\r\n\r\nIf you enable this policy setting, then the cipher provided will be used if it is a supported algorithm.\r\n\r\nIf you disable or do not configure this policy setting, AES will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_setcngcipheralgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_setcngcipheralgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_setcngcipheralgorithm_l_setcngcipheralgorithmid","displayName":"CNG cipher algorithm: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_setcngcipherkeylength","displayName":"Set CNG cipher key length (User)","description":"This policy setting allows you to configure the number of bits to use when creating the cipher key. This number will be rounded down to a multiple of 8.\r\n\r\nIf you enable this policy setting, the key bits specified will be used.\r\n\r\nIf you disable or do not configure this policy setting, the default value will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_setcngcipherkeylength_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_setcngcipherkeylength_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_setcngcipherkeylength_l_setcngcipherkeylengthspinid","displayName":"Cipher key length (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_setcngpasswordspincount","displayName":"Set CNG password spin count (User)","description":"This policy setting allows you to specify the number of times to spin (rehash) the password verifier.\r\n\r\nIf you enable this policy setting, the number specified will be the number of times the password will be rehashed.\r\n\r\nIf you disable or do not configure this policy setting, the default (100000) will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_setcngpasswordspincount_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_setcngpasswordspincount_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_setcngpasswordspincount_l_setcngpasswordspincountspinid","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_setparametersforcngcontext","displayName":"Set parameters for CNG context (User)","description":"This policy setting allows you to specify the encryption parameters that should be used for the CNG context. \r\n\r\nIf you enable this policy setting, the parameters specified will be passed to the CNG context.\r\n\r\nIf you disable or do not configure this policy setting, the default CNG values will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_setparametersforcngcontext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_setparametersforcngcontext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_setparametersforcngcontext_l_setparametersforcngcontextid","displayName":"Parameters (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifycnghashalgorithm","displayName":"Specify CNG hash algorithm (User)","description":"This policy setting allows you to specify the hash algorithm used.\r\n\r\nIf you enable this policy setting, the hashing algorithm selected will be used by CNG.\r\n\r\nIf you disable or do not configure this policy setting, the default CNG hash algorithm will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifycnghashalgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifycnghashalgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha1","displayName":"SHA1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha256","displayName":"SHA256","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha384","displayName":"SHA384","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha512","displayName":"SHA512","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm","displayName":"Specify CNG random number generator algorithm (User)","description":"This policy setting allows you to configure the CNG random number generator to use.\r\n\r\nIf you enable this policy setting, the random number generator specified will be used.\r\n\r\nIf you disable or do not configure this policy setting, the default random number generator will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm_l_specifycngrandomnumbergeneratoralgorithmid","displayName":"Random number generator: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifycngsaltlength","displayName":"Specify CNG salt length (User)","description":"This policy setting allows you to specific the number of bytes of salt that should be used.\r\n\r\nIf you enable this policy setting, the bytes specified will be used.\r\n\r\nIf you disable or do not configure this policy setting, the default length or 16 will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifycngsaltlength_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifycngsaltlength_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifycngsaltlength_l_specifycngsaltlengthspinid","displayName":"Number of bytes (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifyencryptioncompatibility","displayName":"Specify encryption compatibility (User)","description":"This policy setting allows you to specify the encrypted database compatibility.\r\n\r\nIf you enable this policy setting, the compatibility format specified will be applied during encryption for new files\r\n- Use legacy format\r\n- Use next generation format\r\n- All files save with next generation format\r\n\r\nIf you disable or do not configure this policy setting, the default setting, \"Use next generation format,\" will be applied.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifyencryptioncompatibility_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifyencryptioncompatibility_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifyencryptioncompatibility_l_specifyencryptioncompatibilitydropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifyencryptioncompatibility_l_specifyencryptioncompatibilitydropid_0","displayName":"Use legacy format","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifyencryptioncompatibility_l_specifyencryptioncompatibilitydropid_1","displayName":"Use next generation format","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_security~l_cryptography_l_specifyencryptioncompatibility_l_specifyencryptioncompatibilitydropid_2","displayName":"All files save with next generation format","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_sendtoonenote_l_disableoutlooksendemailtoonenoteoption","displayName":"Disable Outlook send email to OneNote option (User)","description":"This policy disables the OneNote ''Send to OneNote'' add-in for Microsoft Outlook. By default OneNote installs an add-in on the Outlook toolbar which allows users to send emails to OneNote. The ''Send to OneNote'' button appears on the main mail module in Outlook as well as when viewing an email message. You may disable this feature with this policy.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_sendtoonenote_l_disableoutlooksendemailtoonenoteoption_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_sendtoonenote_l_disableoutlooksendemailtoonenoteoption_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_spelling_l_onenotespellingoptions","displayName":"OneNote Spelling Options (User)","description":"These options change the \"When correcting spelling in OneNote\" options that appear in the File tab | Option | Proofing dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_spelling_l_onenotespellingoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_spelling_l_onenotespellingoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_spelling_l_onenotespellingoptions_l_empty11","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_spelling_l_onenotespellingoptions_l_empty11_0","displayName":"no spell checking","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_spelling_l_onenotespellingoptions_l_empty11_1","displayName":"check spelling as you type","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_spelling_l_onenotespellingoptions_l_empty11_2","displayName":"hide spelling errors","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_spelling_l_onenotespellingoptions_l_empty11_3","displayName":"check spelling but hide errors","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_daysbacktokeepinversionhistory","displayName":"Days back to keep in version history (User)","description":"This policy setting allows you to set the number of days when all version history items created before this value will be deleted. With a 2016 format notebook, OneNote will automatically store previous versions of the pages in the notebook, and it will also store a recycle bin for all of the deleted pages and sections.\r\n\r\nIf you enable this policy setting, you can set the number of days back to delete version history.\r\n\r\nIf you disable or do not configure this policy setting OneNote will default to keeping previous versions for all days in the past. This is the default value of -1.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_daysbacktokeepinversionhistory_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_daysbacktokeepinversionhistory_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_daysbacktokeepinversionhistory_l_daysbacktokeepinversionhistoryspinid","displayName":"Days back to keep versions (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_daysbacktokeepitemsinrecyclebin","displayName":"Days back to keep items in recycle bin (User)","description":"This policy setting allows you to set the number of days before which all items added to the Recycle Bin before value will be deleted when the version history is pruned. With a 2016 format notebook, OneNote will automatically store previous versions of the pages in the notebook, and it will also store a recycle bin for all of the deleted pages and sections.\r\n\r\nIf you enable this policy setting, you can set the number of days in the past to keep recycle bin items.\r\n\r\nIf you do not configure this policy setting OneNote will use the default value of 60 days in the past.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_daysbacktokeepitemsinrecyclebin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_daysbacktokeepitemsinrecyclebin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_daysbacktokeepitemsinrecyclebin_l_daysbacktokeepitemsinrecyclebinspinid","displayName":"Days back to keep items in recycle bin (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_daysofallversions","displayName":"Days all Version History items are \"safe\" from pruning (User)","description":"This policy setting allows you to specify a period of time during which OneNote maintains comprehensive version history pages. After the time specified, OneNote maintains more basic version history pages, which uses less storage space.\r\n\r\nIf you enable this policy setting, OneNote maintains comprehensive version history pages for the length of time you specify, and then maintains basic version history pages once the time period expires.\r\n\r\nIf you disable or do not configure this policy setting, OneNote maintains comprehensive version history pages for 2 days, and then maintains basic version history pages once the time period expires.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_daysofallversions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_daysofallversions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_daysofallversions_l_daysofallversionsspinid","displayName":"Days back (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_daysofhourlyversionsnottopruneafterdaysback","displayName":"Days of hourly versions not to prune after Days Back (User)","description":"This policy setting allows you to set the number of hourly versions not to prune after Days Back. With a 2016 format notebook, OneNote will automatically store previous versions of the pages in the notebook, and it will also store a recycle bin for all of the deleted pages and sections.\r\n\r\nIf you enable this policy setting, you may specify the number of days to keep hourly versions after the Days Back setting. This value specifies the number of days past \"DaysOfAllVersions\" to keep hourly version history information. Users will keep one version per hour for this number of days after \"DaysOfAllVersions\".\r\n\r\nIf you disable or do not configure this policy setting, OneNote will keep hourly versions for the past 5 days.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_daysofhourlyversionsnottopruneafterdaysback_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_daysofhourlyversionsnottopruneafterdaysback_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_daysofhourlyversionsnottopruneafterdaysback_l_daysofhourlyversionsnottopruneafterdaysbackspinid","displayName":"Days back (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_donotpruneversionsovertime","displayName":"Do not prune versions over time (User)","description":"This policy setting allows you to turn off OneNote's automatic pruning. With a 2016 format notebook, OneNote will automatically store previous versions of the pages in the notebook, and it will also store a recycle bin for all of the deleted pages and sections.\r\n\r\nIf you enable this policy setting, OneNote will not prune previous versions.\r\n\r\nIf you disable or do not configure this policy setting, OneNote will prune previous versions. The default value is to prune versions over time. You should only enable this policy setting if OneNote should not prune previous versions.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_donotpruneversionsovertime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_donotpruneversionsovertime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_maximumnumberofonceperdayversionhistoryitemskept","displayName":"Maximum number of once-per-day version history items kept (User)","description":"This policy setting allows you to set the number of once-per-day history items to be kept for each page. With a 2016 format notebook, OneNote will automatically store previous versions of the pages in the notebook, and it will also store a recycle bin for all of the deleted pages and sections.\r\n\r\nIf you enable this policy setting, you can set the number of versions per day to keep. If you set a value of -1 this will tell OneNote to keep all old once-per-day version history items.\r\n \r\nIf you disable or do not configure this policy setting OneNote will keep a page for the past 10 days every day in the past.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_maximumnumberofonceperdayversionhistoryitemskept_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_maximumnumberofonceperdayversionhistoryitemskept_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_maximumnumberofonceperdayversionhistoryitemskept_l_maximumnumberofonceperdayversionhistoryitemskeptspinid","displayName":"Max number of versions (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_turnoffversionsandnotebookrecyclebininsharednotebooks","displayName":"Turn off Versions and Notebook Recycle Bin in shared notebooks (User)","description":"This policy setting allows you to turn off version history which includes versions and the notebook recycle bin. With a 2016 format notebook, OneNote will automatically store previous versions of the pages in the notebook, and it will also store a recycle bin for all of the deleted pages and sections.\r\n\r\nIf you enable this policy setting, it will turn off version history.\r\n\r\nIf you disable or do not configure this policy setting, OneNote will store previous versions by default.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_turnoffversionsandnotebookrecyclebininsharednotebooks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v2~policy~l_microsoftofficeonenote~l_onenoteoptions~l_versionsandrecylebin_l_turnoffversionsandnotebookrecyclebininsharednotebooks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v3~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_sharepointbackgroundsyncintervalmultiplier","displayName":"Multiplier for background sync interval for notebooks stored on SharePoint (User)","description":"This policy setting allows you to increase the interval between background polls of a SharePoint site for changes to notebooks.\r\n\r\nIf you enable this policy setting, OneNote will poll SharePoint less frequently for changes to whole notebooks. Intervals are multiplied by the entered value, a positive integer value from 1 to 10. Larger intervals will slow notebook sync but reduce server load.\r\n\r\nIf you disable or do not configure this policy setting, OneNote will sync notebooks at the default rate (multiplier value of 1).\r\n\r\nNote: This policy setting only applies to volume licensed versions of Office 2016 that use Windows Installer (MSI), such as Office Professional Plus 2016 and Office Standard 2016.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v3~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_sharepointbackgroundsyncintervalmultiplier_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v3~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_sharepointbackgroundsyncintervalmultiplier_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v3~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_sharepointbackgroundsyncintervalmultiplier_l_empty16","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v3~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_sharepointlivesyncintervalmultiplier","displayName":"Multiplier for foreground sync interval for the currently viewed section stored on SharePoint (User)","description":"This policy setting allows you to increase the interval between foreground polls of a SharePoint site for changes to the currently viewed section.\r\n\r\nIf you enable this policy setting, OneNote will poll SharePoint less frequently for changes to the currently viewed section. Intervals are multiplied by the entered value, a positive integer value from 1 to 10. Larger intervals will slow section sync but reduce server load.\r\n\r\nIf you disable or do not configure this policy setting, OneNote will sync the currently viewed section at the default rate (multiplier value of 1).\r\n\r\nNote: This policy setting only applies to volume licensed versions of Office 2016 that use Windows Installer (MSI), such as Office Professional Plus 2016 and Office Standard 2016.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v3~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_sharepointlivesyncintervalmultiplier_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v3~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_sharepointlivesyncintervalmultiplier_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v3~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_sharepointlivesyncintervalmultiplier_l_empty17","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v3~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_sharepointpresenceintervalmultiplier","displayName":"Multiplier for Presence sync interval for notebooks stored on SharePoint (User)","description":"This policy setting allows you to increase the interval between polls to SharePoint to determine active users of notebooks. OneNote will sync notebooks at a faster rate when other users are interacting with a notebook.\r\n\r\nIf you enable this policy setting, OneNote will poll SharePoint less frequently to determine if there are other users currently interacting with notebooks. Intervals are multiplied by the entered value, a positive integer value from 1 to 10. Larger intervals will slow detection of concurrent users in notebooks but reduce server load.\r\n\r\nIf you disable or do not configure this policy setting, OneNote will poll for active users of notebooks at the default rate (multiplier value of 1).\r\n\r\nNote: This policy setting only applies to volume licensed versions of Office 2016 that use Windows Installer (MSI), such as Office Professional Plus 2016 and Office Standard 2016.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v3~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_sharepointpresenceintervalmultiplier_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v3~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_sharepointpresenceintervalmultiplier_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v3~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_sharepointpresenceintervalmultiplier_l_empty18","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v4~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_disablesupportdiagnostics","displayName":"Turn off support diagnostics in OneNote (User)","description":"This policy setting controls whether OneNote sends client information to support services on failure.\r\n\r\nSending client information to support services on failure can help diagnose the issue, provide resolution steps, or show contextual error messaging to the user.\r\n\r\nIf you enable this policy setting, OneNote won’t send client information to support services on failure.\r\n\r\nIf you disable or don’t configure this policy setting, OneNote will send client information to support services on failure.\r\n\r\nNote: This policy setting only applies to Version 2207 and later of OneNote.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v4~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_disablesupportdiagnostics_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v4~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_disablesupportdiagnostics_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v5~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_onenotetextprediction","displayName":"OneNote text prediction (User)","description":"\r\nThis policy setting controls whether users will see and be able to accept text predictions when writing notes in English in OneNote.\r\n\r\nIf you enable or don't configure this policy setting, users will see and be able to accept predicted text by using the Tab key or right arrow key while writing their notes. Or they can simply keep typing to ignore the predicted text.\r\n\r\nIf you disable this policy setting, users will not be able to see or accept text predictions while writing notes.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v5~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_onenotetextprediction_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v5~policy~l_microsoftofficeonenote~l_onenoteoptions~l_editing_l_onenotetextprediction_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v6.1~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_turnoffnewstickynotesinonenote","displayName":"Disable the new Sticky Notes experience (User)","description":"This policy controls the ability of users to access the new Sticky Notes experiences from OneNote.\r\n\r\nIf you enable this policy setting, users will be unable to access the new Sticky Notes experiences from OneNote.\r\n\r\nIf you disable this policy setting, users can access the new Sticky Notes experiences from OneNote.\r\n\r\nIf you do not set this policy setting, users can access the new Sticky Notes experiences from OneNote.\r\n\r\nNote: This policy does not affect the classic Microsoft Sticky Notes app available on the Microsoft Store. Additionally, disabling or not setting this policy does not guarantee access to the new Sticky Notes experiences from OneNote.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v6.1~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_turnoffnewstickynotesinonenote_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v6.1~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_turnoffnewstickynotesinonenote_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v6~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_turnoffnewstickynotesinonenote","displayName":"Disable the new Sticky Notes experience (User)","description":"This policy controls the ability of users to access the new Sticky Notes experiences from OneNote.\r\n\r\nIf you enable this policy setting, users will be unable to access the new Sticky Notes experiences from OneNote.\r\n\r\nIf you disable this policy setting, users can access the new Sticky Notes experiences from OneNote.\r\n\r\nIf you do not set this policy setting, users can access the new Sticky Notes experiences from OneNote.\r\n\r\nNote: This policy does not affect the classic Microsoft Sticky Notes app available on the Microsoft Store. Additionally, disabling or not setting this policy does not guarantee access to the new Sticky Notes experiences from OneNote.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v6~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_turnoffnewstickynotesinonenote_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v6~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_turnoffnewstickynotesinonenote_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v7~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_onenotesensitivitylabels","displayName":"Enable OneNote Sensitivity Labels (User)","description":"This policy setting controls whether Purview Sensitivity Label capabilities can be enabled for OneNote Sections.\r\n\r\nIf you enable this policy, users can use supported Purview features, such as manual labeling, label removal, or default labels, to apply sensitivity labels to OneNote sections and help protect sensitive information. At this time, mandatory labels, auto labeling, and dynamic watermarking are not supported.\r\n\r\nIf you disable this policy, users won't be able to apply, change or remove Sensitivity Labels in OneNote Sections.\r\n\r\nIf you do not configure this policy setting, users won't be able to apply, change or remove Sensitivity Labels in OneNote Sections.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v7~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_onenotesensitivitylabels_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v7~policy~l_microsoftofficeonenote~l_onenoteoptions~l_other_l_onenotesensitivitylabels_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v8~policy~l_microsoftofficeonenote~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems290","displayName":"Disable commands (User)","description":"This policy setting allows you to disable any command bar button and menu item with a command bar ID, including command bar buttons and menu items that are not in the predefined lists.\r\n\r\nIf you enable this policy setting, you can enter an ID number to disable a specific command bar button or menu item. The ID number needs to be in decimal (not hexadecimal). Multiple values should be separated by commas.\r\n\r\nIf you disable or do not configure this policy setting, all default command bar buttons or menu items are available to users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v8~policy~l_microsoftofficeonenote~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems290_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v8~policy~l_microsoftofficeonenote~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems290_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v8~policy~l_microsoftofficeonenote~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems290_l_enteracommandbaridtodisable","displayName":"Enter a command bar ID to disable (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_onent16v8~policy~l_microsoftofficeonenote~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys291","displayName":"Disable shortcut keys (User)","description":"This policy setting allows you to disable any shortcut key by using its virtual key code ID, including shortcut keys that are not in the predefined lists.\r\n\r\nIf you enable this policy setting, you can enter a virtual key code ID number to disable a specific shortcut key.\r\n\r\nIf you disable or do not configure this policy setting, all default shortcut keys are enabled for users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_onent16v8~policy~l_microsoftofficeonenote~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys291_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_onent16v8~policy~l_microsoftofficeonenote~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys291_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_onent16v8~policy~l_microsoftofficeonenote~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys291_l_enterakeyandmodifiertodisable","displayName":"Enter a key and modifier to disable (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablepreviewplace","displayName":"Disable Preview Place. (User)","description":"\r\n This policy setting determines whether the Preview Place feature is allowed. Enabling this setting will block the Preview Place feature from being available.\r\n Users will no longer be able to preview and provide feedback on upcoming changes in Outlook.\r\n\tNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablepreviewplace_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablepreviewplace_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v10~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_disablecalendarsearchagendaview","displayName":"Do not allow Calendar search agenda view (User)","description":"This policy setting allows you to prevent agenda view for Calendar search.\r\n\r\nIf you enable this policy setting, Calendar search will default to list view.\r\n\r\nIf you disable or do not configure this policy setting, it will default to agenda view.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v10~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_disablecalendarsearchagendaview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v10~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_disablecalendarsearchagendaview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v11~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mail~l_composemessages_l_specifymaxcertlengthallowedtostamp","displayName":"Maximum Size Limit for certificate in Reply to Encrypted Emails cases. (User)","description":"When replying to a digitally signed email using Outlook, Win32 saves the certificate chain of the original sender in Exchange. This allows for encrypted replies without adding the original sender to the contact list. \r\nHowever, there are cases where a sent email may not be delivered or saved in the sent items if the size of the stored certificate on the Exchange server is too large.\r\nTo avoid this issue caused by large certificate sizes of the original email sender in Win32 Outlook, the default upper limit is set at 12921 bytes. However, administrators have the option to configure a higher limit, up to a maximum of 16384 bytes.\t\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v11~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mail~l_composemessages_l_specifymaxcertlengthallowedtostamp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v11~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mail~l_composemessages_l_specifymaxcertlengthallowedtostamp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v11~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mail~l_composemessages_l_specifymaxcertlengthallowedtostamp_l_specifymaxcertlengthallowedtostampspinid","displayName":"In bytes: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v11~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mail~l_composemessages_l_specifywaitonsendtimeoutfordlpevaluation","displayName":"Specify wait time to evaluate sensitive content (User)","description":"This policy setting is used to define the waiting time for evaluating sensitive content in emails before a user can send them. Customize whether immediate email sending is allowed, sending is permitted after a specific wait time, or complete evaluation is required before sending. Regardless of the setting, the service will continue the evaluation in the background and take appropriate action based on the results, such as blocking delivery if necessary.\r\n\r\nIf you disable or do not configure this policy setting, emails will be sent right away without waiting for the final evaluation of the configured policies.\r\n\r\nIf you enable this policy setting, you can set a specific wait time, measured in seconds (in the range of 0-9999), before the \"Send Anyway\" button appears in the waiting dialog. This allows users to send the mail even before the policy evaluation is complete. \r\n\r\nPlease note that setting the wait time above 9999 indicates that users are not allowed to send the mail without evaluation. In such cases, the \"Send Anyway\" button will never be shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v11~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mail~l_composemessages_l_specifywaitonsendtimeoutfordlpevaluation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v11~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mail~l_composemessages_l_specifywaitonsendtimeoutfordlpevaluation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v11~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mail~l_composemessages_l_specifywaitonsendtimeoutfordlpevaluation_l_specifywaitonsendtimeoutfordlpevaluationspinid","displayName":"In seconds: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v11~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_hidenewoutlooktoggle","displayName":"Hide the “Try the new Outlook” toggle in Outlook (User)","description":"This policy setting controls whether the “Try the new Outlook” toggle is displayed in Outlook.\r\n\r\nIf you enable this policy setting, the toggle for “Try the new Outlook” will be hidden and users will not have the ability to switch between the existing and new Outlook experiences.\r\n\r\nIf you disable or do not configure this policy setting, the toggle for “Try the new Outlook” will be displayed.\r\n\r\nNote: This policy only applies to subscription-based Microsoft 365 Apps.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v11~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_hidenewoutlooktoggle_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v11~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_hidenewoutlooktoggle_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v12~policy~l_microsoftofficeoutlook~l_miscellaneous_l_disablesimplemapisendwithoutoutlook","displayName":"Running Outlook for Simple MAPI Mail Sending (User)","description":"This policy setting determines whether users can send mail through Simple MAPI when Outlook is not active.\r\n\r\nIf you enable this policy setting, users are required to have Outlook running to send mail through Simple MAPI. This will force users to open Outlook to send mail, ensuring that Outlook Add-ins run properly before the mail is sent. \r\n\r\nIf you disable this policy setting, users are allowed to send mail through Simple MAPI regardless of Outlook running.\r\n\r\nWhen this policy setting is not configured, it functions as if it has been disabled, allowing users to send mail through Simple MAPI without having Outlook running.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v12~policy~l_microsoftofficeoutlook~l_miscellaneous_l_disablesimplemapisendwithoutoutlook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v12~policy~l_microsoftofficeoutlook~l_miscellaneous_l_disablesimplemapisendwithoutoutlook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v13~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_showoutlookloopcomponentsforsupportedapps","displayName":"Show Outlook Loop components for supported apps. (User)","description":"This policy controls whether Outlook displays Loop components that are supported by installed apps without requiring users to explicitly choose to load them.\r\n\r\nIf you enable this policy setting by selecting \"Always show automatically\" or \"Only show automatically within tenant,\" Outlook will automatically display Loop components in emails. This applies to all messages or specifically to messages that originate within the recipient's local tenant or organization. This might involve contacting servers used by the installed apps to retrieve Loop components.\r\n\r\nIf you do not set this policy setting, Outlook will default to the \"Only show automatically within tenant\" setting. This ensures Loop components are automatically displayed in emails originating from the recipient's local tenant or organization.\r\n\r\nNote: Loop components included in messages located in the Junk Mail folder will not load automatically, regardless of the policy setting specified. Loop components will only be shown for apps that are installed, ensuring security and a tailored experience in Outlook.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v13~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_showoutlookloopcomponentsforsupportedapps_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v13~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_showoutlookloopcomponentsforsupportedapps_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v13~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_showoutlookloopcomponentsforsupportedapps_l_showoutlookloopcomponentsid","displayName":"Show Outlook Loop components for supported apps (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v13~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_showoutlookloopcomponentsforsupportedapps_l_showoutlookloopcomponentsid_1","displayName":"Always show automatically.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v13~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_showoutlookloopcomponentsforsupportedapps_l_showoutlookloopcomponentsid_2","displayName":"Only show automatically within tenant.","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v13~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_showoutlookloopcomponentsforsupportedapps_l_showoutlookloopcomponentsid_3","displayName":"Don’t show automatically.","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v14.1~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_newoutlookautomigrationretryintervals","displayName":"Interval between new Outlook migration attempts (User)","description":"This policy setting controls the interval between new Outlook migration attempts.\r\n\r\nIf you don't set this or set this to 0 (default value), classic Outlook will stop executing \"New Outlook auto migration\" after the user toggles back to classic Outlook for Windows.\r\n\r\nIf you set this to 1, classic Outlook will show a blocking prompt on each app launch, which will attempt to switch the user to the new Outlook app.\r\n\r\nIf you set this to N (2 - 9900) value, \"New Outlook auto migration\" will be re-initiated N days after the user toggles back to classic Outlook.\r\n\r\nNote: This policy only applies to subscription-based Microsoft 365 Apps.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v14.1~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_newoutlookautomigrationretryintervals_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v14.1~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_newoutlookautomigrationretryintervals_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v14.1~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_newoutlookautomigrationretryintervals_l_newoutlookautomigrationretryintervalsid","displayName":"New Outlook Auto Migration Retry Interval: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v14~policy~l_microsoftofficeoutlook~l_miscellaneous_l_disablecomtowebaddinupgrade","displayName":"Disable web add-in installation on migration to new Outlook for Windows (User)","description":"This policy setting allows you to disable installation of web add-in equivalents of COM add-ins on the switch to new Outlook. The add-ins available for migration are listed in https://aka.ms/newoutlooksettings.\r\n\r\nLearn more about Outlook web add-ins at https://learn.microsoft.com/office/dev/add-ins/outlook/outlook-add-ins-overview.\r\n\r\nCOM add-ins do not work in new Outlook for Windows. By default, users in the organization will get the option to install available web add-ins, in place of COM add-ins, when they move from classic Outlook for Windows.\r\n\r\nIf you enable this policy setting, users will not get the option to install web add-ins in place of their COM add-ins. \r\n \r\nIf you disable or do not configure this policy setting, users will get an option to install web add-ins in place of their COM add-ins.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v14~policy~l_microsoftofficeoutlook~l_miscellaneous_l_disablecomtowebaddinupgrade_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v14~policy~l_microsoftofficeoutlook~l_miscellaneous_l_disablecomtowebaddinupgrade_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v14~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_donewoutlookautomigration","displayName":"Admin-Controlled Migration to New Outlook (User)","description":"\r\nThis policy controls the ability of IT admins to initiate the migration of users from classic Outlook to new Outlook.\r\n\r\nIf you enable this policy setting, IT admins will start the process to switch users from classic Outlook to new Outlook.\r\n\r\nIf you disable this policy setting, the migration process to new Outlook will be stopped, keeping users on their current version of Outlook without transitioning to new Outlook.\r\n\r\nIf you do not set this policy setting, the migration process to new Outlook will not start, and users that have not migrated will remain on classic Outlook.\r\n\r\nNote: IT admins can also define intervals for re-initiating the migration process for users who revert to classic Outlook from new Outlook. This is managed through the NewOutlookAutoMigrationRetryIntervals policy, offering a tailored strategy for transitioning users based on organizational requirements and user feedback.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v14~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_donewoutlookautomigration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v14~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_donewoutlookautomigration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v14~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_newoutlookautomigrationretryintervals","displayName":"Interval between new Outlook migration attempts (User)","description":"This policy setting controls the interval between new Outlook migration attempts.\r\n\r\nIf you don't set this or set this to 0 (default value), classic Outlook will stop executing \"New Outlook auto migration\" after the user toggles back to classic Outlook for Windows.\r\n\r\nIf you set this to 1, classic Outlook will show a blocking prompt on each app launch, which will attempt to switch the user to the new Outlook app.\r\n\r\nIf you set this to N (2 - 9900) value, \"New Outlook auto migration\" will be re-initiated N days after the user toggles back to classic Outlook.\r\n\r\nNote: This policy only applies to subscription-based Microsoft 365 Apps.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v14~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_newoutlookautomigrationretryintervals_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v14~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_newoutlookautomigrationretryintervals_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v14~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_newoutlookautomigrationretryintervals_l_newoutlookautomigrationretryintervalsid","displayName":"New Outlook Auto Migration Retry Interval: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v15~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_mailtipsbardisplayoption","displayName":"MailTips bar display options (User)","description":"\r\n This policy setting controls MailTips bar display options. If the \"Disable MailTips\" policy is also enabled, this policy takes precedence.\r\n\r\n If you enable this policy setting, you can choose from three options for determining how the MailTips bar will display:\r\n\r\n - Display automatically when MailTips apply\r\n - Display at all times\r\n - Never Display MailTips\r\n\r\n If you disable or do not configure this policy setting, users can choose how the MailTips bar will display.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v15~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_mailtipsbardisplayoption_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v15~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_mailtipsbardisplayoption_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v15~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_mailtipsbardisplayoption_l_mailtipsbardisplayoptions","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v15~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_mailtipsbardisplayoption_l_mailtipsbardisplayoptions_0","displayName":"Display automatically when MailTips apply","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v15~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_mailtipsbardisplayoption_l_mailtipsbardisplayoptions_1","displayName":"Display at all times","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v15~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_mailtipsbardisplayoption_l_mailtipsbardisplayoptions_2","displayName":"Never display MailTips","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v15~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_smimedisabledataupload","displayName":"Block processing of S/MIME encrypted messages by certain connected experiences (User)","description":"\r\nThis policy controls whether certain connected experiences that analyze your content can process email messages with S/MIME encryption.\r\n\r\nIf you enable this policy setting, certain connected experiences that analyze your content can’t process email messages with S/MIME encryption. This means connected experiences such as the following won’t be available:\r\n\r\n-\tSpelling and grammar check (Editor)\r\n-\tSuggested replies\r\n-\tAutomatically apply or recommend sensitivity labels\r\n-\tMicrosoft Purview Data Loss Prevention policy tips\r\n\r\nFor more information about which connected experiences are affected, see https://go.microsoft.com/fwlink/p/?linkid=2268773.\r\n\r\nIf you disable or don’t configure this policy setting, all connected experiences that analyze your content can process email messages with S/MIME encryption.\r\n\r\nNote: This policy setting only applies to Microsoft 365 Apps for enterprise.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v15~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_smimedisabledataupload_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v15~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_smimedisabledataupload_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v16~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_newoutlookautomigrationusersettingpolicy","displayName":"Manage user setting for new Outlook automatic migration (User)","description":"\r\nThis policy allows you to manage the user setting for enabling or disabling automatic migration to the new Outlook app. Automatic migration could be admin-driven (enabled through 'Admin-Controlled migration to New Outlook' policy), or Microsoft-driven.\r\n\r\nWhen applied, this policy controls whether the user can be switched to the new Outlook app automatically or retains control over the setting.\r\n\r\nIf you set this policy to 1 (Set to 1), the user setting controlling automatic migration is enabled. Automatic migration to the new Outlook app is allowed, and the user cannot change this setting.\r\n\r\nIf you set this policy to 2 (Set to 2), the user setting controlling automatic migration is disabled. Automatic migration to the new Outlook app is not allowed, and the user cannot change this setting.\r\n\r\nIf you set this policy to 0 (Set to 0) or don't configure this policy (default), the user setting for automatic migration is not controlled by the policy, allowing the user to manage it themselves. This user setting for automatic migration is enabled by default.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v16~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_newoutlookautomigrationusersettingpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v16~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_newoutlookautomigrationusersettingpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v16~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_newoutlookautomigrationusersettingpolicy_l_newoutlookautomigrationusersettingpolicyid","displayName":"New Outlook Auto Migration User Setting: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v17~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_newoutlookautomaticsetupusersetting","displayName":"Manage automatic setup of classic Outlook accounts in new Outlook (User)","description":"\r\nThis policy setting allows you to manage whether classic Outlook automatically sets up user accounts and settings in new Outlook.\r\n\r\nIf you enable this policy setting, automatic setup of user accounts and settings in new Outlook is allowed and cannot be changed by the user.\r\n\r\nIf you disable this policy setting, automatic setup of user accounts and settings in new Outlook is not allowed and cannot be changed by the user.\r\n\r\nIf you don't configure this policy setting, users can manage the setting themselves. Automatic setup is enabled by default.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v17~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_newoutlookautomaticsetupusersetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v17~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_newoutlookautomaticsetupusersetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_addpropertiestoattachmentstoenablereplywithchanges","displayName":"Add properties to attachments to enable Reply with Changes (User)","description":"Sets the value for the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_addpropertiestoattachmentstoenablereplywithchanges_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_addpropertiestoattachmentstoenablereplywithchanges_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_addpropertiestoattachmentstoenablereplywithchanges_l_addpropertiestoattachmentstoenablereplywithchanges","displayName":"Add properties to attachments to enable Reply with Changes (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_addpropertiestoattachmentstoenablereplywithchanges_l_addpropertiestoattachmentstoenablereplywithchanges_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_addpropertiestoattachmentstoenablereplywithchanges_l_addpropertiestoattachmentstoenablereplywithchanges_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_allowcommasasaddressseparator","displayName":"Allow commas as address separator (User)","description":"Sets the value for the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_allowcommasasaddressseparator_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_allowcommasasaddressseparator_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_allowcommasasaddressseparator_l_allowcommasasaddressseparator","displayName":"Allow commas as address separator (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_allowcommasasaddressseparator_l_allowcommasasaddressseparator_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_allowcommasasaddressseparator_l_allowcommasasaddressseparator_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_automaticnamechecking","displayName":"Automatic name checking (User)","description":"Sets the value for the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_automaticnamechecking_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_automaticnamechecking_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_automaticnamechecking_l_automaticnamechecking","displayName":"Automatic name checking (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_automaticnamechecking_l_automaticnamechecking_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_automaticnamechecking_l_automaticnamechecking_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_deletemeetingrequestfrominboxwhenresponding","displayName":"Delete meeting request from Inbox when responding (User)","description":"Sets the value for the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_deletemeetingrequestfrominboxwhenresponding_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_deletemeetingrequestfrominboxwhenresponding_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_deletemeetingrequestfrominboxwhenresponding_l_deletemeetingrequestfrominboxwhenresponding","displayName":"Delete meeting request from Inbox when responding (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_deletemeetingrequestfrominboxwhenresponding_l_deletemeetingrequestfrominboxwhenresponding_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_deletemeetingrequestfrominboxwhenresponding_l_deletemeetingrequestfrominboxwhenresponding_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_messagesexpireafterdays","displayName":"Messages expire after (days) (User)","description":"Sets the value for the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_messagesexpireafterdays_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_messagesexpireafterdays_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_messagesexpireafterdays_l_messagesexpireafterdays","displayName":"Messages expire after (days): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_setimportance","displayName":"Set importance (User)","description":"Sets the value for the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_setimportance_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_setimportance_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_setimportance_l_setimportance","displayName":"Set importance: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_setimportance_l_setimportance_2","displayName":"High","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_setimportance_l_setimportance_1","displayName":"Normal","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_setimportance_l_setimportance_0","displayName":"Low","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_setsensitivity","displayName":"Set sensitivity (User)","description":"Sets the value for the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_setsensitivity_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_setsensitivity_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_setsensitivity_l_setsensitivity","displayName":"Set sensitivity: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_setsensitivity_l_setsensitivity_0","displayName":"Normal","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_setsensitivity_l_setsensitivity_1","displayName":"Personal","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_setsensitivity_l_setsensitivity_2","displayName":"Private","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_setsensitivity_l_setsensitivity_3","displayName":"Confidential","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_suggestnameswhilecompletingtoccandbccfields","displayName":"Suggest names while completing To, Cc, and Bcc fields (User)","description":"Sets the value for the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_suggestnameswhilecompletingtoccandbccfields_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_suggestnameswhilecompletingtoccandbccfields_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_suggestnameswhilecompletingtoccandbccfields_l_suggestnameswhilecompletingtoccandbccfields","displayName":"Suggest names while completing To, Cc, and Bcc fields (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_suggestnameswhilecompletingtoccandbccfields_l_suggestnameswhilecompletingtoccandbccfields_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v18~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_whensendingamessagecategory_l_suggestnameswhilecompletingtoccandbccfields_l_suggestnameswhilecompletingtoccandbccfields_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2.updates.4~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_preventcopyingormovingitemsbetweenaccounts","displayName":"Prevent copying or moving items between accounts (User)","description":"This policy setting allows you to prevent items from being copied or moved to other accounts or PSTs.\r\n\r\nIf you enable this policy setting, items will be prevented from being moved or copied to other accounts or PSTs. Enter one of the following details:\r\n\r\n- \"Contoso.com\": prevents copying or moving from the account corresponding to the listed domain\r\n- \"*\": prevents copying from all accounts and PST's\r\n- \"SharePoint\": prevents copies or moves from the SharePoint PST\r\n\r\nIf you disable or do not configure this policy setting, copying or moving items between accounts or PSTs is allowed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2.updates.4~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_preventcopyingormovingitemsbetweenaccounts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2.updates.4~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_preventcopyingormovingitemsbetweenaccounts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2.updates.4~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_preventcopyingormovingitemsbetweenaccounts_l_preventcopyingormovingitemsbetweenaccountsid","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_customizableerrormessages_l_listoferrormessagestocustomize","displayName":"List of error messages to customize (User)","description":"Defines a list of custom error messages to activate.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_customizableerrormessages_l_listoferrormessagestocustomize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_customizableerrormessages_l_listoferrormessagestocustomize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_customizableerrormessages_l_listoferrormessagestocustomize_l_listoferrormessagestocustomize37","displayName":"List of error messages to customize (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_customizableerrormessages_l_listoferrormessagestocustomize_l_listoferrormessagestocustomize37_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_customizableerrormessages_l_listoferrormessagestocustomize_l_listoferrormessagestocustomize37_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_disableitemsinuserinterface~l_custom_l_disablecommandbar38","displayName":"Disable command bar buttons and menu items (User)","description":"This policy setting allows you to disable any command bar button and menu item with a command bar ID, including command bar buttons and menu items that are not in the predefined lists.\r\n\r\nIf you enable this policy setting, you can enter an ID number to disable a specific command bar button or menu item. The ID number needs to be in decimal (not hexadecimal). Multiple values should be separated by commas.\r\n\r\nIf you disable or do not configure this policy setting, all default command bar buttons or menu items are available to users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_disableitemsinuserinterface~l_custom_l_disablecommandbar38_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_disableitemsinuserinterface~l_custom_l_disablecommandbar38_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_disableitemsinuserinterface~l_custom_l_disablecommandbar38_l_enteracommandbaridtodisable","displayName":"Enter a command bar ID to disable (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys39","displayName":"Disable shortcut keys (User)","description":"Specify the virtual key code and modifier for the shortcut key to disable.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys39_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys39_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys39_l_enterakeyandmodifiertodisable","displayName":"Enter a key and modifier to disable (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_disableitemsinuserinterface~l_predefined_l_hidequickstepsgallery","displayName":"Disable Quick Steps Gallery (User)","description":"This policy setting allows you to hide the Quick Steps Gallery in the Ribbon. By default, the Quick Steps Gallery is included in the Home tab of the Outlook explorer Ribbon. \r\n\r\nIf you enable this policy setting, you will hide the Quick Steps Gallery in the Ribbon.\r\n\r\nIf you disable or do not configure this policy setting, the Quick Steps Gallery will be included in the Home tab of the Outlook explorer Ribbon.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_disableitemsinuserinterface~l_predefined_l_hidequickstepsgallery_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_disableitemsinuserinterface~l_predefined_l_hidequickstepsgallery_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_calendarfolderhomepage","displayName":"Calendar Folder Home Page (User)","description":"This policy setting allows you to modify the \"Show home page by default for this folder\" in the Home Page tab of the Calendar Properties dialog box.\r\n\r\nIf you enable this policy setting, you will set the \"Show home page by default for this folder\" check box. You will also be able to enter a URL, which has a maximum limit of 129 characters.\r\n\r\nIf you disable or do not configure this policy setting, the \"Show home page by default for this folder\" check box will not be checked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_calendarfolderhomepage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_calendarfolderhomepage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_calendarfolderhomepage_l_showassociatedwebpage42","displayName":"Show associated web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_calendarfolderhomepage_l_showassociatedwebpage42_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_calendarfolderhomepage_l_showassociatedwebpage42_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_calendarfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage44","displayName":"Turn off Windows Internet Explorer security checks for this web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_calendarfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage44_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_calendarfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage44_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_calendarfolderhomepage_l_urladdressofassociatedwebpage43","displayName":"URL address of associated web page: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_contactsfolderhomepage","displayName":"Contacts Folder Home Page (User)","description":"This policy setting allows you to modify the \"Show home page by default for this folder\" in the Home Page tab of the Contacts Properties dialog box.\r\n\r\nIf you enable this policy setting, you will set the \"Show home page by default for this folder\" check box. You will also be able to enter a URL, which has a maximum limit of 129 characters.\r\n\r\nIf you disable or do not configure this policy setting, the \"Show home page by default for this folder\" check box will not be checked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_contactsfolderhomepage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_contactsfolderhomepage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_contactsfolderhomepage_l_showassociatedwebpage45","displayName":"Show associated web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_contactsfolderhomepage_l_showassociatedwebpage45_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_contactsfolderhomepage_l_showassociatedwebpage45_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_contactsfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage47","displayName":"Turn off Windows Internet Explorer security checks for this web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_contactsfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage47_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_contactsfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage47_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_contactsfolderhomepage_l_urladdressofassociatedwebpage46","displayName":"URL address of associated web page: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_deleteditemsfolderhomepage","displayName":"Deleted Items Folder Home Page (User)","description":"This policy setting allows you to modify the \"Show home page by default for this folder\" in the Home Page tab of the Deleted Items Properties dialog box.\r\n\r\nIf you enable this policy setting, you will set the \"Show home page by default for this folder\" check box. You will also be able to enter a URL, which has a maximum limit of 129 characters.\r\n\r\nIf you disable or do not configure this policy setting, the \"Show home page by default for this folder\" check box will not be checked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_deleteditemsfolderhomepage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_deleteditemsfolderhomepage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_deleteditemsfolderhomepage_l_showassociatedwebpage48","displayName":"Show associated web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_deleteditemsfolderhomepage_l_showassociatedwebpage48_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_deleteditemsfolderhomepage_l_showassociatedwebpage48_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_deleteditemsfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage50","displayName":"Turn off Windows Internet Explorer security checks for this web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_deleteditemsfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage50_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_deleteditemsfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage50_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_deleteditemsfolderhomepage_l_urladdressofassociatedwebpage49","displayName":"URL address of associated web page: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_disablefolderhomepages","displayName":"Do not allow Home Page URL to be set in folder Properties (User)","description":"By default, users can set a URL to be used as the Home Page for a folder by entering the URL on the Home Page tab on the folder's Properties dialog box. By enabling this setting, you can disallow setting Folder Home Pages for all folders.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_disablefolderhomepages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_disablefolderhomepages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_draftsfolderhomepage","displayName":"Drafts Folder Home Page (User)","description":"This policy setting allows you to modify the \"Show home page by default for this folder\" in the Home Page tab of the Drafts Properties dialog box.\r\n\r\nIf you enable this policy setting, you will set the \"Show home page by default for this folder\" check box. You will also be able to enter a URL, which has a maximum limit of 129 characters.\r\n\r\nIf you disable or do not configure this policy setting, the \"Show home page by default for this folder\" check box will not be checked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_draftsfolderhomepage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_draftsfolderhomepage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_draftsfolderhomepage_l_showassociatedwebpage51","displayName":"Show associated web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_draftsfolderhomepage_l_showassociatedwebpage51_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_draftsfolderhomepage_l_showassociatedwebpage51_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_draftsfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage53","displayName":"Turn off Windows Internet Explorer security checks for this web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_draftsfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage53_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_draftsfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage53_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_draftsfolderhomepage_l_urladdressofassociatedwebpage52","displayName":"URL address of associated web page: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_inboxfolderhomepage","displayName":"Inbox Folder Home Page (User)","description":"This policy setting allows you to modify the \"Show home page by default for this folder\" in the Home Page tab of the Inbox Properties dialog box.\r\n\r\nIf you enable this policy setting, you will set the \"Show home page by default for this folder\" check box. You will also be able to enter a URL, which has a maximum limit of 129 characters.\r\n\r\nIf you disable or do not configure this policy setting, the \"Show home page by default for this folder\" check box will not be checked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_inboxfolderhomepage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_inboxfolderhomepage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_inboxfolderhomepage_l_showassociatedwebpage40","displayName":"Show associated web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_inboxfolderhomepage_l_showassociatedwebpage40_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_inboxfolderhomepage_l_showassociatedwebpage40_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_inboxfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage","displayName":"Turn off Windows Internet Explorer security checks for this web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_inboxfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_inboxfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_inboxfolderhomepage_l_urladdressofassociatedwebpage41","displayName":"URL address of associated web page: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_journalfolderhomepage","displayName":"Journal Folder Home Page (User)","description":"This policy setting allows you to modify the \"Show home page by default for this folder\" in the Home Page tab of the Journal Properties dialog box.\r\n\r\nIf you enable this policy setting, you will set the \"Show home page by default for this folder\" check box. You will also be able to enter a URL, which has a maximum limit of 129 characters.\r\n\r\nIf you disable or do not configure this policy setting, the \"Show home page by default for this folder\" check box will not be checked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_journalfolderhomepage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_journalfolderhomepage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_journalfolderhomepage_l_showassociatedwebpage54","displayName":"Show associated web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_journalfolderhomepage_l_showassociatedwebpage54_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_journalfolderhomepage_l_showassociatedwebpage54_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_journalfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage56","displayName":"Turn off Windows Internet Explorer security checks for this web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_journalfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage56_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_journalfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage56_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_journalfolderhomepage_l_urladdressofassociatedwebpage55","displayName":"URL address of associated web page: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_notesfolderhomepage","displayName":"Notes Folder Home Page (User)","description":"This policy setting allows you to modify the \"Show home page by default for this folder\" in the Home Page tab of the Notes Properties dialog box.\r\n\r\nIf you enable this policy setting, you will set the \"Show home page by default for this folder\" check box. You will also be able to enter a URL, which has a maximum limit of 129 characters.\r\n\r\nIf you disable or do not configure this policy setting, the \"Show home page by default for this folder\" check box will not be checked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_notesfolderhomepage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_notesfolderhomepage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_notesfolderhomepage_l_showassociatedwebpage57","displayName":"Show associated web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_notesfolderhomepage_l_showassociatedwebpage57_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_notesfolderhomepage_l_showassociatedwebpage57_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_notesfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage59","displayName":"Turn off Windows Internet Explorer security checks for this web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_notesfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage59_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_notesfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage59_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_notesfolderhomepage_l_urladdressofassociatedwebpage58","displayName":"URL address of associated web page: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_outboxfolderhomepage","displayName":"Outbox Folder Home Page (User)","description":"This policy setting allows you to modify the \"Show home page by default for this folder\" in the Home Page tab of the Outbox Properties dialog box.\r\n\r\nIf you enable this policy setting, you will set the \"Show home page by default for this folder\" check box. You will also be able to enter a URL, which has a maximum limit of 129 characters.\r\n\r\nIf you disable or do not configure this policy setting, the \"Show home page by default for this folder\" check box will not be checked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_outboxfolderhomepage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_outboxfolderhomepage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_outboxfolderhomepage_l_showassociatedwebpage60","displayName":"Show associated web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_outboxfolderhomepage_l_showassociatedwebpage60_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_outboxfolderhomepage_l_showassociatedwebpage60_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_outboxfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage62","displayName":"Turn off Windows Internet Explorer security checks for this web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_outboxfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage62_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_outboxfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage62_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_outboxfolderhomepage_l_urladdressofassociatedwebpage61","displayName":"URL address of associated web page: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_rssfolderhomepage","displayName":"RSS Folder Home Page (User)","description":"This policy setting allows you to modify the \"Show home page by default for this folder\" in the Home Page tab of the RSS Feeds Properties dialog box.\r\n\r\nIf you enable this policy setting, you will set the \"Show home page by default for this folder\" check box. You will also be able to enter a URL, which has a maximum limit of 129 characters.\r\n\r\nIf you disable or do not configure this policy setting, the \"Show home page by default for this folder\" check box will not be checked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_rssfolderhomepage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_rssfolderhomepage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_rssfolderhomepage_l_showassociatedwebpage","displayName":"Show associated web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_rssfolderhomepage_l_showassociatedwebpage_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_rssfolderhomepage_l_showassociatedwebpage_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_rssfolderhomepage_l_turnoffinternetexplorersecuritychecks","displayName":"Turn off Windows Internet Explorer security checks for this web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_rssfolderhomepage_l_turnoffinternetexplorersecuritychecks_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_rssfolderhomepage_l_turnoffinternetexplorersecuritychecks_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_rssfolderhomepage_l_urladdressofassociatedwebpage","displayName":"URL address of associated web page: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_sentitemsfolderhomepage","displayName":"Sent Items Folder Home Page (User)","description":"This policy setting allows you to modify the \"Show home page by default for this folder\" in the Home Page tab of the Sent Items Properties dialog box.\r\n\r\nIf you enable this policy setting, you will set the \"Show home page by default for this folder\" check box. You will also be able to enter a URL, which has a maximum limit of 129 characters.\r\n\r\nIf you disable or do not configure this policy setting, the \"Show home page by default for this folder\" check box will not be checked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_sentitemsfolderhomepage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_sentitemsfolderhomepage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_sentitemsfolderhomepage_l_showassociatedwebpage63","displayName":"Show associated web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_sentitemsfolderhomepage_l_showassociatedwebpage63_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_sentitemsfolderhomepage_l_showassociatedwebpage63_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_sentitemsfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage65","displayName":"Turn off Windows Internet Explorer security checks for this web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_sentitemsfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage65_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_sentitemsfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage65_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_sentitemsfolderhomepage_l_urladdressofassociatedwebpage64","displayName":"URL address of associated web page: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_tasksfolderhomepage","displayName":"Tasks Folder Home Page (User)","description":"This policy setting allows you to modify the \"Show home page by default for this folder\" in the Home Page tab of the Tasks Properties dialog box.\r\n\r\nIf you enable this policy setting, you will set the \"Show home page by default for this folder\" check box. You will also be able to enter a URL, which has a maximum limit of 129 characters.\r\n\r\nIf you disable or do not configure this policy setting, the \"Show home page by default for this folder\" check box will not be checked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_tasksfolderhomepage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_tasksfolderhomepage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_tasksfolderhomepage_l_showassociatedwebpage66","displayName":"Show associated web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_tasksfolderhomepage_l_showassociatedwebpage66_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_tasksfolderhomepage_l_showassociatedwebpage66_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_tasksfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage68","displayName":"Turn off Windows Internet Explorer security checks for this web page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_tasksfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage68_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_tasksfolderhomepage_l_turnoffinternetexplorersecuritychecksforthiswebpage68_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_folderhomepagesforoutlookspecialfolders_l_tasksfolderhomepage_l_urladdressofassociatedwebpage67","displayName":"URL address of associated web page: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_formregionsettings_l_disableformregions","displayName":"Configure form regions permissions (User)","description":"By default, all form region customizations are permitted to run in Outlook. By using this setting, you can disable all form region customizations, or specify that form regions must be registered on a per-computer basis, rather than a per-user basis.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_formregionsettings_l_disableformregions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_formregionsettings_l_disableformregions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_formregionsettings_l_disableformregions_l_disableformregionspart","displayName":"Configure form regions permissions: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_formregionsettings_l_disableformregions_l_disableformregionspart_0","displayName":"All form regions are allowed to run","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_formregionsettings_l_disableformregions_l_disableformregionspart_1","displayName":"Allow only those registered in HKLM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_formregionsettings_l_disableformregions_l_disableformregionspart_2","displayName":"No form regions are allowed to run","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_formregionsettings_l_lockedformregions","displayName":"Locked form regions (User)","description":"This policy setting allows you to configure adjoining form regions to be always expanded.\r\n\r\nIf you enable this policy setting, you may enter the adjoining form region name as the Value name and the Value data as \"1\" (without quotes). This ensures that users see the whole adjoining form region and cannot collapse it. This works for both Explorer and Inspector.\r\n\r\nIf you disable or do not configure this policy setting, adjoining form regions are not expanded.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_formregionsettings_l_lockedformregions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_formregionsettings_l_lockedformregions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_formregionsettings_l_lockedformregions_l_empty76","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_formregionsettings_l_lockedformregions_l_empty76_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_formregionsettings_l_lockedformregions_l_empty76_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_infopathintegration_l_disableinfopathpropertiespromotioninoutlook","displayName":"Do not promote InfoPath forms properties into Outlook properties (User)","description":"By default, InfoPath property promotion is enabled. This setting allows you to disable the ability to promote InfoPath forms properties into Outlook properties. This feature allows InfoPath forms to promote properties from the underlying data into named properties in Outlook. These properties are displayed in views on folders, and users can group, filter, and sort by them.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_infopathintegration_l_disableinfopathpropertiespromotioninoutlook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_infopathintegration_l_disableinfopathpropertiespromotioninoutlook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_meetingworkspace_l_defaultserversanddataformeetingworkspaces","displayName":"Default servers and data for Meeting Workspaces (User)","description":"Using this policy, you can define default servers and server data for Meeting Workspaces. It is recommended that you draft this policy in a text editor and paste it into the text box in the setting. You can add up to five servers by listing them in the \"Default server:\" text box. Each server is defined by a pipe-delimited list, with a total of six pipes per server record. The OrganizerName field is left blank. For example: http://server1 | Friendly name for server1 | templateLCID | templateID | TemplateName | OrganizerName | http://server2 | ... and so on. For more information, see the Office 2016 Resource Kit on TechNet.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_meetingworkspace_l_defaultserversanddataformeetingworkspaces_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_meetingworkspace_l_defaultserversanddataformeetingworkspaces_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_meetingworkspace_l_defaultserversanddataformeetingworkspaces_l_defaultserver","displayName":"Default server: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_meetingworkspace_l_disableuserentriestoserverlist","displayName":"Disable user entries to server list (User)","description":"This policy setting controls whether Outlook users can add entries to the list of SharePoint servers when establishing a meeting workspace. \r\n\r\nIf you enable this policy setting, you can choose between two options to determine whether Outlook users can add entries to the published server list: \r\n\r\n- Publish default, allow others. This option is the default configuration in Outlook. \r\n\r\n- Publish default, disallow others. This option prevents users from adding servers to the default published server list. \r\n\r\nIf you disable or do not configure this policy setting, when users create a meeting workspace, they can choose a server from a default list provided by administrators or manually enter the address of a server that is not listed. This is the equivalent of Enabled -- Publish default, allow others.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_meetingworkspace_l_disableuserentriestoserverlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_meetingworkspace_l_disableuserentriestoserverlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_meetingworkspace_l_disableuserentriestoserverlist_l_checktodisableusersfromaddingentriestoserverlist","displayName":"Check to disable users from adding entries to server list (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_meetingworkspace_l_disableuserentriestoserverlist_l_checktodisableusersfromaddingentriestoserverlist_1","displayName":"Publish default, allow others","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_meetingworkspace_l_disableuserentriestoserverlist_l_checktodisableusersfromaddingentriestoserverlist_2","displayName":"Publish default, disallow others","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changelimitmimebody","displayName":"Change the limit for the number of MIME body parts (User)","description":"By default, the limit is 250 for the number of MIME body parts when an e-mail message is converted from MIME to MAPI. The number can be set to any positive integer. This helps prevent scenarios in which Outlook hangs while attempting conversion.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changelimitmimebody_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changelimitmimebody_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changelimitmimebody_l_empty75","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changelimitrecipients","displayName":"Change the limit for the number of recipients (User)","description":"By default, the limit is 12288 recipients included for an e-mail message when the message is converted from MIME to MAPI. The number can be set to any positive integer. This helps prevent scenarios in which Outlook hangs while attempting conversion.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changelimitrecipients_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changelimitrecipients_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changelimitrecipients_l_empty73","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changethelimitforthenumberof","displayName":"Change the limit for the number of nested embedded messages (User)","description":"By default, the limit is 50 embedded messages when an e-mail message is converted from MIME to MAPI. The number can be set to any positive integer. This helps prevent scenarios in which Outlook hangs while attempting conversion.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changethelimitforthenumberof_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changethelimitforthenumberof_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changethelimitforthenumberof_l_empty71","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changethelimitfriendlyname","displayName":"Change the limit for the number of characters in Friendly Name (User)","description":"By default, the limit is 1000 characters for Friendly Name when an e-mail message is converted from MIME to MAPI. The number can be set to any positive integer. This helps prevent scenarios in which Outlook hangs while attempting conversion.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changethelimitfriendlyname_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changethelimitfriendlyname_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changethelimitfriendlyname_l_empty72","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changethelimitmimeheaders","displayName":"Change the limit for the number of MIME headers (User)","description":"By default, the limit is 20000 for the number of MIME headers when an e-mail message is converted from MIME to MAPI. The number can be set to any positive integer. This helps prevent scenarios in which Outlook hangs while attempting conversion.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changethelimitmimeheaders_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changethelimitmimeheaders_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_mimitomapiconversion_l_changethelimitmimeheaders_l_empty74","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_addnewcategories","displayName":"Add new categories (User)","description":"This policy setting allows you to add (append) new categories to the user's current list of categories.\r\n\r\nIf you enable this policy setting, you may add (append) new categories to the user's current list of categories (the default list of categories or the list of categories the user has created). A category's length should not exceed 255 characters.\r\n\r\nIf you disable or do not configure this policy setting, the user's current list of categories is not modified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_addnewcategories_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_addnewcategories_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_addnewcategories_l_enternewcategoriessemicolondelimited","displayName":"Enter new categories (comma or semicolon delimited) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_allowcryptoautosave","displayName":"Extend Outlook Autosave to include encrypted e-mail messages (User)","description":"By default, Outlook does not automatically save copies of unsent e-mail messages that are encrypted. You can enable this setting so that Outlook autosaves unsent encrypted e-mail messages to the user's Drafts folder.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_allowcryptoautosave_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_allowcryptoautosave_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_blockallunmanagedaddins","displayName":"Block all unmanaged add-ins (User)","description":"This policy setting blocks all add-ins that are not managed by the \"List of managed add-ins\" policy setting.\r\n\r\nIf you enable this policy setting, and the \"List of managed add-ins\" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the \"List of managed add-ins\" policy setting.\r\n\r\nIf you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the \"List of managed add-ins\" policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_blockallunmanagedaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_blockallunmanagedaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_disableaddinlogging","displayName":"Disable Windows event logging for Outlook add-ins (User)","description":"This policy setting governs logging of connected add-ins to the Windows event log.\r\n\r\nIf you enable this policy setting, an inventory of connected Outlook add-ins will not be written to the Windows event log.\r\n\r\nIf you disable or do not configure this policy setting, an inventory of connected Outlook add-ins will be written to the Windows event log.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_disableaddinlogging_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_disableaddinlogging_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_disabledistributionlistexpansion","displayName":"Do not expand Contact Groups (User)","description":"This policy setting controls whether Outlook users can expand Contact Groups when addressing e-mail messages. \r\n\r\nIf you enable this policy setting, Outlook users cannot expand Contact Groups. \r\n\r\nIf you disable or do not configure this policy setting, when Outlook users add a Contact Group to the To, CC, or BCC fields of an e-mail message or other item, they can expand the Contact Group to see the e-mail addresses of everyone in the group.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_disabledistributionlistexpansion_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_disabledistributionlistexpansion_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_disablevlvbrowsingonldapservers","displayName":"Disable VLV Browsing on LDAP servers (User)","description":"When this policy is enabled, Outlook will not use the Virtual List Views (VLV) LDAP extension when querying an LDAP servier. When the policy is not configured or disabled, Outlook will use the Virtual Lst Views (VLV) LDAP extension when querying an LDAP server.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_disablevlvbrowsingonldapservers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_disablevlvbrowsingonldapservers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_disablewindowsfriendlylogonmailquery","displayName":"Do not show unread message count on Windows Welcome screen (User)","description":"By default, Windows queries Outlook for the unread message count for users and displays the result on the Windows Welcome screen. By enabling this setting, you can change this behavior so that Windows does not provide this feature on the Welcome screen.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_disablewindowsfriendlylogonmailquery_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_disablewindowsfriendlylogonmailquery_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_donotdownloadpermissionlicenseforirmemailduring","displayName":"Do not download rights permission license information for IRM e-mail during Exchange folder sync (User)","description":"By default, IRM license information for e-mail messages is downloaded to the user's local cache when Outlook synchronizes with Exchange. By enabling this setting, you can change this behavior so that licence information is not cached locally and users must connect to the network to retreive license information in order to open rights-managed e-mail messages.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_donotdownloadpermissionlicenseforirmemailduring_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_donotdownloadpermissionlicenseforirmemailduring_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_listofmanagedaddins","displayName":"List of managed add-ins (User)","description":"This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the \"Block all unmanaged add-ins\" policy setting.\r\n\r\nTo enable this policy setting, provide the following information for each add-in:\r\n\r\nIn \"Value name,\" specify the programmatic identifier (ProgID) for COM add-ins.\r\n\r\nTo obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Office\\Outlook\\Addins or HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Office\\Outlook\\Addins.\r\n\r\nYou can also obtain the ProgID of an add-in by using Office Telemetry Dashboard.\r\n\r\nIn \"Value,\" specify the value as follows:\r\n\r\nTo specify that an add-in is always disabled (blocked), type 0.\r\n\r\nTo specify that an add-in is always enabled, type 1.\r\n\r\nTo specify that an add-in is configurable by the user and not blocked by the \"Block all unmanaged add-ins\" policy setting when enabled, type 2.\r\n\r\nIf you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the \"Block all unmanaged add-ins\" policy setting is enabled, then all add-ins are blocked.\r\n\r\nAdd-ins that are disabled by this policy will never be disabled by the Outlook add-in disabling feature, which disables add-ins for performance, resiliency, or reliability reasons.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_listofmanagedaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_listofmanagedaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_listofmanagedaddins_l_listofmanagedaddins2","displayName":"List of managed add-ins (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_listofmanagedaddins_l_listofmanagedaddins2_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_listofmanagedaddins_l_listofmanagedaddins2_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_managingcategoriesduringe_mailexchanges","displayName":"Managing Categories during e-mail exchanges (User)","description":"By default, categories on incoming e-mail are removed, and categories are removed when replying to or forwarding an e-mail. This setting allows you to control how categories are shared as users exchange e-mail messages. You can specify that categories are not removed for users' incoming e-mail. You can also specify that e-mail messages that users reply to or forward retain the categories on the original message.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_managingcategoriesduringe_mailexchanges_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_managingcategoriesduringe_mailexchanges_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_managingcategoriesduringe_mailexchanges_l_acceptcategoriesassignedtoincomingmailbythesender","displayName":"Accept Categories assigned to incoming mail by the sender (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_managingcategoriesduringe_mailexchanges_l_acceptcategoriesassignedtoincomingmailbythesender_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_managingcategoriesduringe_mailexchanges_l_acceptcategoriesassignedtoincomingmailbythesender_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_managingcategoriesduringe_mailexchanges_l_whenreplyingtoandforwardingmailincludepersonalcategories","displayName":"When replying to and forwarding mail, include personal categories (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_managingcategoriesduringe_mailexchanges_l_whenreplyingtoandforwardingmailincludepersonalcategories_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_managingcategoriesduringe_mailexchanges_l_whenreplyingtoandforwardingmailincludepersonalcategories_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventmapiservicesfrombeingadded","displayName":"Prevent MAPI services from being added (User)","description":"By default, any MAPI service can be added to a user profile as an Outlook account. This setting allows you to prevent users from adding a specific MAPI services on the list of services. To prevent adding a MAPI service, append the name of the service to the list of services stored in this setting, separated by from a previous name by a semi-colon (;). For example, if you wanted to prevent adding the Outlook Mobile Service and Live Meeting Transport, you would configure this setting \"MSOMS;LiveMeeting\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventmapiservicesfrombeingadded_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventmapiservicesfrombeingadded_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventmapiservicesfrombeingadded_l_preventmapiservicesfrombeingaddedpart","displayName":"Enter MAPI services to disable (semi-colon delimited) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfromaddingemailaccounttypes","displayName":"Prevent users from adding e-mail account types (User)","description":"Disables/Enables the option for adding e-mail account of the associated type in the Server Types page of the E-mail Accounts dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfromaddingemailaccounttypes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfromaddingemailaccounttypes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfromaddingemailaccounttypes_l_preventusersfromaddingeasemailaccounts","displayName":"Prevent users from adding Exchange ActiveSync e-mail accounts (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfromaddingemailaccounttypes_l_preventusersfromaddingeasemailaccounts_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfromaddingemailaccounttypes_l_preventusersfromaddingeasemailaccounts_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfromaddingemailaccounttypes_l_preventusersfromaddingexchangeemailaccounts","displayName":"Prevent users from adding Exchange e-mail accounts (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfromaddingemailaccounttypes_l_preventusersfromaddingexchangeemailaccounts_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfromaddingemailaccounttypes_l_preventusersfromaddingexchangeemailaccounts_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfromaddingemailaccounttypes_l_preventusersfromaddingimapemailaccounts","displayName":"Prevent users from adding IMAP e-mail accounts (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfromaddingemailaccounttypes_l_preventusersfromaddingimapemailaccounts_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfromaddingemailaccounttypes_l_preventusersfromaddingimapemailaccounts_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfromaddingemailaccounttypes_l_preventusersfromaddingothertypesofemailaccounts","displayName":"Prevent users from adding other types of e-mail accounts (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfromaddingemailaccounttypes_l_preventusersfromaddingothertypesofemailaccounts_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfromaddingemailaccounttypes_l_preventusersfromaddingothertypesofemailaccounts_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfromaddingemailaccounttypes_l_preventusersfromaddingpop3emailaccounts","displayName":"Prevent users from adding POP3 e-mail accounts (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfromaddingemailaccounttypes_l_preventusersfromaddingpop3emailaccounts_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfromaddingemailaccounttypes_l_preventusersfromaddingpop3emailaccounts_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfrommakingchangestooutlookprofiles","displayName":"Prevent users from making changes to Outlook profiles (User)","description":"This policy setting allows you to prevent users from accessing profile or account configuration tools through either Account Settings or through the Mail Control Panel Applet.\r\n\r\nIf you enable this policy setting, users will see the error, \"This feature has been disabled by your system administrator\" if they select the Account Settings button under Account Information found by clicking on the File tab. Users will also be unable to access profile configuration the Mail Control Panel Applet.\r\n\r\nIf you disable or do not configure this policy setting, users will be able to access Account Settings and the Mail Control Panel Applet normally.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfrommakingchangestooutlookprofiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_preventusersfrommakingchangestooutlookprofiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_specifydelaybeforesendingpeoplesearchrequest","displayName":"Specify delay before sending people search request (User)","description":"This policy is used to set the delay for sending people search requests from the Find a Contact box in Outlook and the Related People section that appears in the Backstage view (Info tab) of Office applications.\r\n\r\nIf you enable this policy setting, you can specify the delay in milliseconds between when the user stops (or pauses) typing in the search box and when the application sends a search request.\r\n\r\nIf you disable or do not configure this policy setting, the default delay is 200 milliseconds (0.20 seconds).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_specifydelaybeforesendingpeoplesearchrequest_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_specifydelaybeforesendingpeoplesearchrequest_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_specifydelaybeforesendingpeoplesearchrequest_l_specifydelaybeforesendingpeoplesearchrequestspinid","displayName":"in milliseconds (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_specifyoutlookpeoplesearchtimeout","displayName":"Set the time-out interval for Outlook people search (User)","description":"This policy setting controls the time-out interval of Outlook people search. Outlook returns as many people search results as possible before the time-out interval lapses. If the search results are incomplete, Outlook displays a message at the bottom of the results list.\r\n\r\nIf you enable this policy setting, you can specify the time-out interval in milliseconds.\r\n\r\nIf you disable or do not configure this policy setting, the time-out interval is 60,000 milliseconds (60 seconds).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_specifyoutlookpeoplesearchtimeout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_specifyoutlookpeoplesearchtimeout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_specifyoutlookpeoplesearchtimeout_l_specifyoutlookpeoplesearchtimeoutspinid","displayName":"in milliseconds (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_workflowtasksinoutlook","displayName":"Do not display \"Open this task\" button for workflow tasks (User)","description":"As part of E-mail notification of workflow tasks, users can edit a task by clicking the \"Open this task\" button to display the task dialog box for the workflow task. When this setting is enabled, the \"Open this task\" button is not displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_workflowtasksinoutlook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous_l_workflowtasksinoutlook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_defaultlocationforostfiles","displayName":"Default location for OST files (User)","description":"This policy setting allows you to specify a different folder location for Outlook Data File (OST) files on user computers. \r\n\r\nIf you enable this policy setting, you can specify a location for OST files on user computers.\r\n\r\nIf you disable or do not configure this policy setting, OST files are located in: %LOCALAPPDATA%\\Microsoft\\Outlook on user computers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_defaultlocationforostfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_defaultlocationforostfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_defaultlocationforostfiles_l_defaultlocationforostfilespart","displayName":"Default location for OST files (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_defaultlocationforpstfiles","displayName":"Default location for PST files (User)","description":"This policy setting allows you to specify a different folder location for Outlook Data File (PST) files on user computers. \r\n\r\nIf you enable this policy setting, you can specify a location for PST files on user computers.\r\n\r\nIf you disable or do not configure this policy setting, PST files are located in: %USERPROFILE%\\Documents\\Outlook Files\\ on user computers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_defaultlocationforpstfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_defaultlocationforpstfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_defaultlocationforpstfiles_l_defaultlocationforpstfiles79","displayName":"Default location for PST files (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_donotsendmeetingforwardnotifications","displayName":"Do not send meeting forward notifications (User)","description":"This policy setting prevents Outlook from sending meeting forward notifications. This does not affect whether or not Exchange sends meeting forward notifications. \r\n\r\nIf you enable this policy setting, Outlook will not send meeting forward notifications.\r\n\r\nIf you disable or do not configure this policy setting, Outlook will send meeting forward notifications.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_donotsendmeetingforwardnotifications_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_donotsendmeetingforwardnotifications_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_largepstabsolutemaximumsize","displayName":"Large PST: Absolute maximum size (User)","description":"Specifies the maximum allowable size (in megabytes) for an Outlook Data File.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_largepstabsolutemaximumsize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_largepstabsolutemaximumsize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_largepstabsolutemaximumsize_l_enterabsolutemaximumsizeforpstinmegabytes2","displayName":"(0 - 4,294,967,295 MB) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_largepstsizetodisableaddingnewcontent","displayName":"Large PST: Size to disable adding new content (User)","description":"Specifies the size at which Outlook will no longer accept new content into an Outlook Data File.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_largepstsizetodisableaddingnewcontent_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_largepstsizetodisableaddingnewcontent_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_largepstsizetodisableaddingnewcontent_l_entersizetodisableaddingnewcontenttopstinmegabytes2","displayName":"(0 - 4,294,967,295 MB) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_legacypstabsolutemaximumsize","displayName":"Legacy PST: Absolute maximum size (User)","description":"Specifies the maximum allowable size (in bytes) for an Outlook 97-2002 Data File.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_legacypstabsolutemaximumsize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_legacypstabsolutemaximumsize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_legacypstabsolutemaximumsize_l_enterabsolutemaximumsizeforpstinbytes2","displayName":"(0 - 2,075,149,312 bytes) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_legacypstsizetodisableaddingnewcontent","displayName":"Legacy PST: Size to disable adding new content (User)","description":"Specifies the size at which Outlook will no longer accept new content into an Outlook Data File.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_legacypstsizetodisableaddingnewcontent_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_legacypstsizetodisableaddingnewcontent_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_legacypstsizetodisableaddingnewcontent_l_entersizetodisableaddingnewcontenttopstinbytes2","displayName":"(0 - 2,075,149,312 Bytes) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_permanentlyremovealldeleteditems","displayName":"Permanently remove all deleted content from PST and OST files (User)","description":"By default, a small percentage of deleted data is not overwritten in Outlook PST and OST files. By enabling this setting, all deleted data in PST and OST files is overwritten when users exit Outlook.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_permanentlyremovealldeleteditems_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_permanentlyremovealldeleteditems_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_preferredpstmodeunicodeansi","displayName":"Preferred PST Mode (Unicode/ANSI) (User)","description":"Specifies whether new PST files created by the user are to be in Unicode or ANSI format, and whether the user is allowed to choose that format.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_preferredpstmodeunicodeansi_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_preferredpstmodeunicodeansi_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_preferredpstmodeunicodeansi_l_chooseadefaultformatfornewpsts","displayName":"Choose a default format for new PSTs (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_preferredpstmodeunicodeansi_l_chooseadefaultformatfornewpsts_0","displayName":"Prefer Unicode PST","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_preferredpstmodeunicodeansi_l_chooseadefaultformatfornewpsts_1","displayName":"Prefer ANSI PST","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_preferredpstmodeunicodeansi_l_chooseadefaultformatfornewpsts_2","displayName":"Enforce Unicode PST","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_preferredpstmodeunicodeansi_l_chooseadefaultformatfornewpsts_3","displayName":"Enforce ANSI PST","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_preventusersfromaddingnewcontentto","displayName":"Prevent users from adding new content to existing PST files (User)","description":"This setting prevents users from adding any new content to PST files linked to their profiles.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_preventusersfromaddingnewcontentto_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_preventusersfromaddingnewcontentto_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_preventusersfromaddingpsts","displayName":"Prevent users from adding PSTs to Outlook profiles and/or prevent using Sharing-Exclusive PSTs (User)","description":"By default, users can add PSTs to their Outlook profiles and can use Sharing-Exclusive PSTs for storing SharePoint Lists and Internet Calendars. You can use this setting to limit users' ability to store mail in a decentralized fashion. You can block the use of PSTs completely, but be aware that blocking all PSTs disables Outlook features such as SharePoint Lists and Internet Calendar. \r\n\r\nIf instead you allow only Sharing-Exclusive PSTs to be added to user profiles, PST usage is still limited but the Outlook features that rely on special PSTs are not disabled. The setting that allows Sharing-Exclusive PSTs to be added blocks users from creating new folders in the Sharing-Exclusive PST; copying existing mail folders from their default store to the PST; and copying individual mail items to the root of the PST.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_preventusersfromaddingpsts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_preventusersfromaddingpsts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_preventusersfromaddingpsts_l_empty78","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_preventusersfromaddingpsts_l_empty78_0","displayName":"(default) PSTs can be added","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_preventusersfromaddingpsts_l_empty78_1","displayName":"No PSTs can be added","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_preventusersfromaddingpsts_l_empty78_2","displayName":"Only Sharing-Exclusive PSTs can be added","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_pstnullfreeondelete","displayName":"PST Null Data on Delete (User)","description":"This policy setting allows you to force Outlook to fully nullify deleted data in users’ Personal Folder files (.pst) at the time that the data is deleted. \r\n \r\nIf you enable this policy setting, data is immediately nullified in PST files when deleted. \r\n \r\nIf you disable or do not configure this policy setting, data remains in PST files until it is purged or overwritten by the user.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_pstnullfreeondelete_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_pstnullfreeondelete_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_upgradeonlythedefaultstore","displayName":"Upgrade only the default store (User)","description":"This policy setting allows you to specify that only the default data file is upgraded on the first boot of Outlook.\r\n\r\nIf you enable this policy setting, only the data file associated with your delivery mailbox is upgraded.\r\n\r\nIf you disable or do not configure this policy setting, all Outlook Data Files are upgraded.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_upgradeonlythedefaultstore_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_pstsettings_l_upgradeonlythedefaultstore_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_shutdown_l_configurefastshutdownbehavior","displayName":"Configure fast shutdown behavior (User)","description":"This policy setting controls Outlook's \"fast shutdown\" behavior. \r\n\r\nIf you enable this policy setting, you may select one of these options:\r\n\r\n- MAPI provider does not support: Outlook should always use Fast Shutdown unless a MAPI provider explicitly does not support it.\r\n- All MAPI providers support: Outlook only uses Fast Shutdown if all MAPI providers do support it.\r\n- Never: Outlook never uses Fast Shutdown\r\n\r\nIf you disable or do not configure this policy setting, the behavior will be the same as the \"MAPI provider does not support\" option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_shutdown_l_configurefastshutdownbehavior_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_shutdown_l_configurefastshutdownbehavior_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_shutdown_l_configurefastshutdownbehavior_l_configurefastshutdownbehaviordropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_shutdown_l_configurefastshutdownbehavior_l_configurefastshutdownbehaviordropid_0","displayName":"MAPI provider does not support","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_shutdown_l_configurefastshutdownbehavior_l_configurefastshutdownbehaviordropid_1","displayName":"All MAPI providers support","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_shutdown_l_configurefastshutdownbehavior_l_configurefastshutdownbehaviordropid_2","displayName":"Never","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_shutdown_l_configurefastshutdownbehaviorforaddins","displayName":"Configure fast shutdown behavior for add-ins (User)","description":"This policy setting controls Outlook's \"fast shutdown\" behavior for add-ins.\r\n\r\nIf you enable this policy setting, the BeginShutdown and OnDisconnection events should always be called for all add-ins. \r\n\r\nIf you disable or do not configure this policy setting, all Outlook addins should always use the Addin Fast Shutdown behavior and not have the BeginShutdown and OnDisconnection events called.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_shutdown_l_configurefastshutdownbehaviorforaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_shutdown_l_configurefastshutdownbehaviorforaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_shutdown_l_preventshutdownifexternalreferencesexist","displayName":"Prevent shutdown if external references exist (User)","description":"This policy setting controls whether Outlook should ignore external references during shutdown.\r\n\r\nIf you enable this policy setting, shutdown will not occur if external references exist.\r\n\r\nIf you disable or do not configure this policy setting, external references will be ignored during shutdown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_shutdown_l_preventshutdownifexternalreferencesexist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_miscellaneous~l_shutdown_l_preventshutdownifexternalreferencesexist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions_l_internetandnetworkpathsintohyperlinks","displayName":"Internet and network paths into hyperlinks (User)","description":"This policy setting specifies whether Outlook automatically turns text that represents Internet and network paths into hyperlinks. This option can also be configured by selecting the “Internet and network paths with hyperlinks” check box that is available on the Outlook | File | Options | Mail | Editor Options.... | Proofing | AutoCorrect Options… | AutoFormat tab on the user interface (UI).\r\n\r\nIf you enable or do not configure this policy setting, text in Outlook that represents internet and network paths are automatically turned into hyperlinks. This is the default behavior of Outlook.\r\n\r\nIf you disable this policy setting, text in Outlook that represents internet and network paths are not automatically turned into hyperlinks.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions_l_internetandnetworkpathsintohyperlinks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions_l_internetandnetworkpathsintohyperlinks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_delegates_l_cacheothersmail","displayName":"Disable shared mail folder caching (User)","description":"This policy setting allows you to control the caching of shared mail folders.\r\n\r\nIf you enable this policy setting, Outlook will only cache shared non-mail folders.\r\n\r\nIf you disable or do not configure this policy setting, shared mail and non-mail folders you have access to are cached in your .ost file when you add another mailbox to your profile.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_delegates_l_cacheothersmail_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_delegates_l_cacheothersmail_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_delegates_l_locationofitemsdeletedbydelegates","displayName":"Store deleted items in owner's mailbox instead of delegate's mailbox (User)","description":"This policy setting allows you to store deleted items in the owner's mailbox instead of the delegate's mailbox.\r\n\r\nIf you enable this policy setting, deleted items are stored in the owner's Deleted Items folder. For this setting to work correctly, the owner must also give the delegate permission to write to the owner's Deleted Items folder.\r\n\r\nIf you disable or do not configure this policy setting, items deleted by a delegate are stored in the delegate's Deleted Items Folder instead of the owner's Deleted Items folder.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_delegates_l_locationofitemsdeletedbydelegates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_delegates_l_locationofitemsdeletedbydelegates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mail~l_composemessages_l_disablereadingpanecompose","displayName":"Disable Reading Pane Compose (User)","description":"This policy setting allows you to control whether user’s responses to emails are composed inline on the reading pane or in a new window.\r\n\r\nIf you enable this policy setting, responses to emails are composed in new windows.\r\n\r\nIf you disable or do not configure this policy setting, responses to emails are composed inline in the reading pane.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mail~l_composemessages_l_disablereadingpanecompose_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mail~l_composemessages_l_disablereadingpanecompose_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mail~l_composemessages_l_forceselectionofaccountbeforesending","displayName":"Force selection of account before sending (User)","description":"This policy setting enables you to force users to select an e-mail account from which to send outgoing e-mail.\r\n\r\nIf you enable this policy setting, users must choose an e-mail account before they can send an e-mail.\r\n\r\nIf you disable or do not configure this policy setting, e-mail is sent from the default e-mail account if users do not select a specific e-mail account.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mail~l_composemessages_l_forceselectionofaccountbeforesending_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mail~l_composemessages_l_forceselectionofaccountbeforesending_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mail~l_composemessages_l_outlookprotectionrules","displayName":"Outlook Protection Rules (User)","description":"This policy setting controls whether the Outlook Protection Rules add-in is enabled.\r\n\r\nIf you enable or do not configure this policy setting the add-in automatically downloads Outlook Protection Rules from Exchange and processes them when each Exchange mailbox user composes a new e-mail. \r\n\r\nIf you disable this policy setting the add-in does not download or process Outlook Protection Rules.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mail~l_composemessages_l_outlookprotectionrules_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mail~l_composemessages_l_outlookprotectionrules_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat_l_disablesignatures","displayName":"Do not allow signatures for e-mail messages (User)","description":"This policy setting allows you to prevent Outlook users from adding signatures to e-mails they create, reply to, or forward. \r\n\r\nIf you enable this policy setting, Outlook users cannot manually add signatures to e-mails they create, reply to, or forward, nor will they be able to configure automatic signatures.\r\n\r\nIf you disable or do not configure this policy setting, Outlook 2016 users can add signatures to e-mail messages either manually or automatically.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat_l_disablesignatures_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat_l_disablesignatures_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_autoselectencodingforoutgoingmessages","displayName":"Auto-select encoding for outgoing messages (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_autoselectencodingforoutgoingmessages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_autoselectencodingforoutgoingmessages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_disableinternationalizeddomainnamesidninoutlook","displayName":"Disable Internationalized Domain Names (IDN) in Outlook (User)","description":"By default, Outlook supports Internationalized Domain Names (IDN) for SMTP addresses in Outlook if Windows provides the appropriate support for this feature. You can disable IDN support so that Punycode rather than native characters are used for rendering SMTP addresses. \r\n\r\nYou might choose to disable IDN support in Outlook if you do not typically expect non-ASCII characters in SMTP addresses. \r\n\r\nThis setting does not affect the support of IDN in URLs.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_disableinternationalizeddomainnamesidninoutlook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_disableinternationalizeddomainnamesidninoutlook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages","displayName":"Encoding for outgoing messages (User)","description":"Sets the value in the option \"Preferred encoding for outgoing messages\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages","displayName":"Use this encoding for outgoing messages: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_28596","displayName":"Arabic (ISO)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_1256","displayName":"Arabic (Windows)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_28594","displayName":"Baltic (ISO)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_1257","displayName":"Baltic (Windows)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_28592","displayName":"Central European (ISO)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_1250","displayName":"Central European (Windows)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_54936","displayName":"Chinese Simplified (GB18030)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_936","displayName":"Chinese Simplified (GB2312)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_52936","displayName":"Chinese Simplified (HZ)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_950","displayName":"Chinese Traditional (Big5)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_28595","displayName":"Cyrillic (ISO)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_20866","displayName":"Cyrillic (KOI8-R)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_21866","displayName":"Cyrillic (KOI8-U)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_1251","displayName":"Cyrillic (Windows)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_28597","displayName":"Greek (ISO)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_1253","displayName":"Greek (Windows)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_38598","displayName":"Hebrew (ISO-Logical)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_1255","displayName":"Hebrew (Windows)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_51932","displayName":"Japanese (EUC)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_50220","displayName":"Japanese (JIS)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_50221","displayName":"Japanese (JIS-Allow 1 byte Kana)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_932","displayName":"Japanese (Shift-JIS)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_949","displayName":"Korean","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_51949","displayName":"Korean (EUC)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_28593","displayName":"Latin 3 (ISO)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_28605","displayName":"Latin 9(ISO)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_874","displayName":"Thai (Windows)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_28599","displayName":"Turkish (ISO)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_1254","displayName":"Turkish (Windows)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_65000","displayName":"Unicode (UTF-7)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_65001","displayName":"Unicode (UTF-8)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_20127","displayName":"US-ASCII","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_50000","displayName":"User Defined","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_1258","displayName":"Vietnamese (Windows)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_28591","displayName":"Western European (ISO)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_encodingforoutgoingmessages_l_usethisencodingforoutgoingmessages_1252","displayName":"Western European (Windows)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_englishmessageheadersandflags","displayName":"English message headers and flags (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_englishmessageheadersandflags_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_englishmessageheadersandflags_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_englishmessageheadersandflags_l_useenglishformessageflags","displayName":"Use English for message flags (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_englishmessageheadersandflags_l_useenglishformessageflags_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_englishmessageheadersandflags_l_useenglishformessageflags_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_englishmessageheadersandflags_l_useenglishformessageheadersonrepliesorforwards","displayName":"Use English for message headers on replies or forwards (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_englishmessageheadersandflags_l_useenglishformessageheadersonrepliesorforwards_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_englishmessageheadersandflags_l_useenglishformessageheadersonrepliesorforwards_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_euroencodingforoutgoingmessages","displayName":"Euro encoding for outgoing messages (User)","description":"This policy setting allows you to choose whether to ignore the euro character when auto-detecting the encoding of an outgoing message and the preferred encoding does not support euro.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_euroencodingforoutgoingmessages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_euroencodingforoutgoingmessages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_euroencodingforoutgoingmessages_l_whenpreferredencodingdoesnotsupporteuro2","displayName":"Auto-select should: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_euroencodingforoutgoingmessages_l_whenpreferredencodingdoesnotsupporteuro2_0","displayName":"Send messages as UTF 8","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internationaloptions_l_euroencodingforoutgoingmessages_l_whenpreferredencodingdoesnotsupporteuro2_1","displayName":"ignore euro","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting_l_outlookrichtextoptions","displayName":"Outlook Rich Text options (User)","description":"This policy setting controls how Outlook sends Rich Text Format (RTF) messages to Internet recipients.\r\n\r\nIf you enable this policy setting, you may choose from the following for handling RTF messages addressed to recipients on the Internet:\r\n* Convert to Plain Text format - Outlook converts the message to plain text format in the default character set. Any message formatting will be lost.\r\n\r\nIf you disable or do not configure this policy setting, Outlook automatically converts RTF formatted messages that are sent over the Internet to HTML format, so that the message formatting is maintained and attachments are received.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting_l_outlookrichtextoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting_l_outlookrichtextoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting_l_outlookrichtextoptions_l_whensendingoutlookrichtextmessagestointernetrecipients2","displayName":"Use this format: (User)","description":"","helpText":"","infoUrls":[],"options":{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting_l_outlookrichtextoptions_l_whensendingoutlookrichtextmessagestointernetrecipients2_1","displayName":"Convert to Plain Text format","description":null,"helpText":null}},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting_l_plaintextoptions","displayName":"Plain text options (User)","description":"This policy setting allows you to control how plain text messages are formatted when they are sent from Outlook. \r\n\r\nIf you enable this policy setting, text is automatically wrapped in Internet e-mail messages and attachments are encoded in UUENCODE format. \r\n\r\nIf you disable this policy setting, Outlook uses the standard MIME format to encode attachments in plain text Outlook messages. Users will not be able to change this configuration. \r\n\r\nIf you do not configure this policy setting, the behavior is the equivalent of setting the policy to Disabled, but users can modify plain text options in Outlook when required by clicking Tools, clicking Options, clicking the Mail Format tab, clicking Internet Format, and changing the values under \"Plain text options\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting_l_plaintextoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting_l_plaintextoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting_l_plaintextoptions_l_automaticallywraptextatxcharacters","displayName":"Automatically wrap text at characters. (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting_l_plaintextoptions_l_encodeattachmentsinuuencodeformatwhensending1","displayName":"Encode attachments in UUENCODE format (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting_l_plaintextoptions_l_encodeattachmentsinuuencodeformatwhensending1_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting_l_plaintextoptions_l_encodeattachmentsinuuencodeformatwhensending1_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting~l_messageformat_l_messageformateditor","displayName":"Set message format (User)","description":"This policy setting controls the default message format in Outlook. \r\n\r\nIf you do not configure this policy setting, new e-mail messages in Outlook are formatted as HTML. \r\n\r\nIf you enable this policy setting, you can set the default e-mail format in Outlook to HTML, Rich Text, or plain text. Users can choose a format other than the default when composing messages. \r\n\r\nIf you disable this policy setting, Outlook uses HTML as the default e-mail format and users will not be able to change it. \r\n\r\nIf you do not configure this policy setting, Outlook uses HTML as the default e-mail format, but users can choose a format other than the default when composing messages.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting~l_messageformat_l_messageformateditor_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting~l_messageformat_l_messageformateditor_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting~l_messageformat_l_messageformateditor_l_usethefollowingformateditorforemailmessages","displayName":"Use the following format for e-mail messages: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting~l_messageformat_l_messageformateditor_l_usethefollowingformateditorforemailmessages_131072","displayName":"HTML","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting~l_messageformat_l_messageformateditor_l_usethefollowingformateditorforemailmessages_196608","displayName":"Rich Text","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_internetformatting~l_messageformat_l_messageformateditor_l_usethefollowingformateditorforemailmessages_65536","displayName":"Plain Text","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_stationeryandfonts_l_stationeryfonts","displayName":"Stationery Fonts (User)","description":"This policy setting allows you to choose a Stationery font option.\r\n\r\nIf you enable this policy setting, a Stationery font option from the dropdown list will be enforced.\r\n\r\nIf you disable or do not configure this policy setting, the default setting (use theme's font) will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_stationeryandfonts_l_stationeryfonts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_stationeryandfonts_l_stationeryfonts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_stationeryandfonts_l_stationeryfonts_l_stationeryfontoptions","displayName":"Stationery font options: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_stationeryandfonts_l_stationeryfonts_l_stationeryfontoptions_0","displayName":"Use theme's font","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_stationeryandfonts_l_stationeryfonts_l_stationeryfontoptions_1","displayName":"Use user's font on replies and forwards","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailformat~l_stationeryandfonts_l_stationeryfonts_l_stationeryfontoptions_2","displayName":"Always use user's fonts","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailsetup_l_mailaccountoptions","displayName":"Mail account options (User)","description":"Send messages immediately when connected","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailsetup_l_mailaccountoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_mailsetup_l_mailaccountoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_optionscustomizeribbon_l_displaydevelopertab","displayName":"Display Developer tab in the Ribbon (User)","description":"This policy setting controls whether the Developer tab will be displayed in the Ribbon.\r\n\r\nIf you enable this policy setting, the Developer tab will be displayed in the Ribbon.\r\n\r\nIf you disable this policy setting, the Developer tab will not be displayed in the Ribbon.\r\n\r\nIf you do not configure this policy setting, the Developer tab will not be displayed in the Ribbon, but its visibility can be changed via a setting in the application Options dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_optionscustomizeribbon_l_displaydevelopertab_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_optionscustomizeribbon_l_displaydevelopertab_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_allowselectionfloaties","displayName":"Show Mini Toolbar on selection (User)","description":"Disabling this policy setting will result in Mini Toolbar not being displayed on text selection. By default, Mini Toolbar on selection is enabled and its visibility can be changed via a setting in the Editor Options dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_allowselectionfloaties_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_allowselectionfloaties_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disableonlinemodeauthdiagnostics","displayName":"Disable online mode for Get Diagnostics. (User)","description":"\r\n This policy setting determines whether online mode for Get Diagnostics is allowed. Enabling this setting will block Get Diagnostics feature from sending authentication and diagnostics logs to our service.\r\n Users will now go through offline mode. We will collect all the logs and store them in the Downloads folder of the user. This user can contact support and decide if they want to send us the logs. \r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disableonlinemodeauthdiagnostics_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disableonlinemodeauthdiagnostics_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablepreviewplace","displayName":"Disable Preview Place. (User)","description":"\r\n This policy setting determines whether the Preview Place feature is allowed. Enabling this setting will block the Preview Place feature from being available.\r\n Users will no longer be able to preview and provide feedback on upcoming changes in Outlook.\r\n\tNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablepreviewplace_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablepreviewplace_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablereadingpane","displayName":"Do not display the reading pane (User)","description":"By default, the Reading Pane is enabled only in the mail module and located on the right hand side of the window. This setting allows you to disable the reading pane.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablereadingpane_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablereadingpane_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_donotdownloadphotosfromtheactivedirectory","displayName":"Do not download photos from the Active Directory (User)","description":"This policy setting controls whether user photos will be downloaded from the Active Directory (if available). \r\n\r\nIf you enable this policy setting, photos will not be downloaded.\r\n\r\nIf you disable or do not configure this policy setting, photos will be downloaded.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_donotdownloadphotosfromtheactivedirectory_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_donotdownloadphotosfromtheactivedirectory_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_emptydeleteditemsfolder","displayName":"Empty the Deleted Items folder when Outlook closes (User)","description":"By default, the Deleted Items folder is not emptied when users exit Outlook. By enabling this setting, you can change this behavior so that the Deleted Items folder is emptied when Outlook closes.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_emptydeleteditemsfolder_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_emptydeleteditemsfolder_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_hideappsstorebuttoninhometabribbon","displayName":"Hide the Office Store button (User)","description":"The Office Store button allows users to get apps for Outlook from the Home tab in the ribbon.\r\n\r\nIf you enable this policy setting, the Office Store button doesn’t appear on the Home tab in the ribbon.\r\n\r\nIf you disable or don’t configure this policy setting, the Office Store button appears on the Home tab in the ribbon.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_hideappsstorebuttoninhometabribbon_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_hideappsstorebuttoninhometabribbon_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_hidephotolink","displayName":"Hide photo link (User)","description":"This policy setting configures the link to the user's My Site (when detected) where the user's photo can be uploaded. This link is under the File tab. \r\n\r\nIf you enable this policy setting, the link is not visible.\r\n\r\nIf you disable or do not configure this policy setting, the link is visible.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_hidephotolink_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_hidephotolink_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_makeoutlookthedefaultprogramforemailcontactsandcalendar","displayName":"Make Outlook the default program for E-mail, Contacts, and Calendar (User)","description":"This policy setting controls whether Outlook is the default program for e-mail, contacts, and calendar services.\r\n\r\nIf you enable this policy setting, the \"Make Outlook the default program for E-mail, Contacts, and Calendar\" check box on the General tab of the Office Center is selected and users cannot change it.\r\n\r\nIf you disable this policy setting, users cannot make Outlook the default program for these services.\r\n\r\nIf you do not configure this policy setting, Outlook is made the default program for e-mail, contacts, and calendar services when it is installed, although users can designate other programs as the default programs for these services.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_makeoutlookthedefaultprogramforemailcontactsandcalendar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_makeoutlookthedefaultprogramforemailcontactsandcalendar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_readingpane","displayName":"Reading Pane (User)","description":"Checks/Unchecks the option \"Mark items as read when viewed in the Reading Pane\" in the Reading Pane dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_readingpane_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_readingpane_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_readingpane_l_markitemasreadwhenselectionchanges","displayName":"Mark item as read when selection changes (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_readingpane_l_markitemasreadwhenselectionchanges_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_readingpane_l_markitemasreadwhenselectionchanges_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_readingpane_l_markmessagesasreadinreadingwindow","displayName":"Mark messages as read in reading window (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_readingpane_l_markmessagesasreadinreadingwindow_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_readingpane_l_markmessagesasreadinreadingwindow_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_readingpane_l_singlekeyreadingusingspacebar","displayName":"Single key reading using spacebar (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_readingpane_l_singlekeyreadingusingspacebar_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_readingpane_l_singlekeyreadingusingspacebar_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_readingpane_l_waitxxxsecondsbeforemarkingitemsasread","displayName":"Wait xxx seconds before marking items as read: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_sortfoldersalphabetically","displayName":"Sort folders alphabetically (User)","description":"This policy setting controls whether users can rearrange their folders in Outlook.\r\n\r\nIf you enable this policy setting, users cannot rearrange their folders. The folders are displayed alphabetically.\r\n\r\nIf you disable this policy setting, users can rearrange their folders, but are not able to turn automatic alphabetical sorting back on from the Ribbon. \r\n\r\nIf you do not configure this policy setting, users can rearrange their folders, and turn automatic alphabetical sorting back on from the Ribbon.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_sortfoldersalphabetically_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_sortfoldersalphabetically_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_disablefolderhomepagesforfoldersinnondefaultstores","displayName":"Do not allow folders in non-default stores to be set as folder home pages (User)","description":"By default, creating folder home pages for folders in non-default stores is blocked; you cannot define a folder home page for a folder that is in a non-default store. This setting allows you to unblock folder home pages for folders in non-default stores. Note that other settings might still prevent folder home pages from functioning.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_disablefolderhomepagesforfoldersinnondefaultstores_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_disablefolderhomepagesforfoldersinnondefaultstores_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_disableoutlookobjectmodelscripts","displayName":"Do not allow Outlook object model scripts to run for shared folders (User) (Deprecated)","description":"This policy setting controls whether Outlook executes scripts associated with custom forms or folder home pages for shared folders. \r\n\r\nIf you enable this policy setting, Outlook cannot execute any scripts associated with shared folders, overriding any configuration changes on users' computers. \r\n\r\nIf you disable this policy setting, Outlook will automatically run any scripts associated with custom forms or folder home pages for shared folders. \r\n\r\nIf you do not configure this policy setting, the behavior is the equivalent of setting the policy to Enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_disableoutlookobjectmodelscripts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_disableoutlookobjectmodelscripts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_disableoutlookobjectmodelscripts_v2","displayName":"Do not allow Outlook object model scripts to run for shared folders (User)","description":"This policy setting controls whether Outlook executes scripts associated with custom forms or folder home pages for shared folders. \r\n\r\nIf you enable this policy setting, Outlook cannot execute any scripts associated with shared folders, overriding any configuration changes on users' computers. \r\n\r\nIf you disable this policy setting, Outlook will automatically run any scripts associated with custom forms or folder home pages for shared folders. \r\n\r\nIf you do not configure this policy setting, the behavior is the equivalent of setting the policy to Enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_disableoutlookobjectmodelscripts_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_disableoutlookobjectmodelscripts_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_disableoutlookobjectmodelscriptsforpublicfolders","displayName":"Do not allow Outlook object model scripts to run for public folders (User) (Deprecated)","description":"This policy setting controls whether Outlook executes scripts that are associated with custom forms or folder home pages for public folders.\r\n\r\nIf you enable this policy setting, Outlook cannot execute any scripts associated with public folders, overriding any configuration changes on users' computers. \r\n\r\nIf you disable this policy setting, Outlook will automatically run any scripts associated with custom forms or folder home pages for public folders, overriding any configuration changes on users' computers. \r\n\r\nIf you do not configure this policy setting, Outlook will not run any scripts associated with public folders by default. Users can configure the setting in the Trust Center by selecting the “Allow script in public folders” check box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_disableoutlookobjectmodelscriptsforpublicfolders_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_disableoutlookobjectmodelscriptsforpublicfolders_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_disableoutlookobjectmodelscriptsforpublicfolders_v2","displayName":"Do not allow Outlook object model scripts to run for public folders (User)","description":"This policy setting controls whether Outlook executes scripts that are associated with custom forms or folder home pages for public folders.\r\n\r\nIf you enable this policy setting, Outlook cannot execute any scripts associated with public folders, overriding any configuration changes on users' computers. \r\n\r\nIf you disable this policy setting, Outlook will automatically run any scripts associated with custom forms or folder home pages for public folders, overriding any configuration changes on users' computers. \r\n\r\nIf you do not configure this policy setting, Outlook will not run any scripts associated with public folders by default. Users can configure the setting in the Trust Center by selecting the “Allow script in public folders” check box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_disableoutlookobjectmodelscriptsforpublicfolders_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_disableoutlookobjectmodelscriptsforpublicfolders_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_enablemailloggingtroubleshooting","displayName":"Enable mail logging (troubleshooting) (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_enablemailloggingtroubleshooting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_enablemailloggingtroubleshooting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_minimizeoutlooktothesystemtray","displayName":"Minimize Outlook to the system tray (User)","description":"Checks/Unchecks the Outlook system tray icon option \"Hide When Minimized\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_minimizeoutlooktothesystemtray_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_minimizeoutlooktothesystemtray_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_moreoptions","displayName":"Warn before permanently deleting items (User)","description":"By default, a warning message is displayed before Outlook items are permanently deleted. By disabling this setting, you can change this behavior to not display the warning message.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_moreoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_moreoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_msgunicodeformatwhendraggingtofilesystem","displayName":"Use Unicode format when dragging e-mail message to file system (User) (Deprecated)","description":"This policy setting controls whether e-mail messages dragged from Outlook to the file system are saved in Unicode or ANSI format. \r\n\r\nIf you enable or do not configure this policy setting, when users drag an e-mail message from Outlook to the file system, Outlook uses the Unicode character encoding standard to create the message file, which preserves special characters in the message. \r\n\r\nIf you disable this policy setting, when users drag an e-mail message from Outlook to the file system, the message file created is in ANSI format.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_msgunicodeformatwhendraggingtofilesystem_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_msgunicodeformatwhendraggingtofilesystem_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_msgunicodeformatwhendraggingtofilesystem_v2","displayName":"Use Unicode format when dragging e-mail message to file system (User)","description":"This policy setting controls whether e-mail messages dragged from Outlook to the file system are saved in Unicode or ANSI format. \r\n\r\nIf you enable or do not configure this policy setting, when users drag an e-mail message from Outlook to the file system, Outlook uses the Unicode character encoding standard to create the message file, which preserves special characters in the message. \r\n\r\nIf you disable this policy setting, when users drag an e-mail message from Outlook to the file system, the message file created is in ANSI format.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_msgunicodeformatwhendraggingtofilesystem_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_msgunicodeformatwhendraggingtofilesystem_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_preventsavingsyncconflicts","displayName":"Prevent saving sync conflicts (User)","description":"This policy setting allows you to prevent saving of sync conflicts.\r\n\r\nIf you enable this policy setting, Outlook will not save sync conflicts.\r\n\r\nIf you disable or do not configure this policy setting, all conflicts except those related to Calendar and RSS items are saved by default.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_preventsavingsyncconflicts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_preventsavingsyncconflicts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_savecalendarconflicts","displayName":"Save calendar sync conflicts (User)","description":"This policy setting allows you to save calendar sync conflicts.\r\n\r\nIf you enable this policy setting, Outlook will save calendar sync conflicts.\r\n\r\nIf you disable or do not configure this policy setting, calendar sync conflicts are not saved by default.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_savecalendarconflicts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_savecalendarconflicts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_saverssconflicts","displayName":"Save RSS conflicts (User)","description":"This policy setting allows you to save RSS conflicts.\r\n\r\nIf you enable this policy setting, RSS conflicts will be saved. This policy setting takes precedence over the \"Prevent saving sync conflicts\" policy setting.\r\n\r\nIf you disable or do not configure this policy setting, RSS conflicts are not saved.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_saverssconflicts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_saverssconflicts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_turnonloggingforallconflicts","displayName":"Turn on logging for all conflicts (User)","description":"This policy setting allows you to create Modification Resolution logs whenever the Outlook conflict resolver runs. \r\n\r\nIf you enable this policy setting, Outlook will create Modification Resolution logs whenever the Outlook conflict resolver runs. By default, Modification Resolution logs are written into the Sync Issues folder whenever Outlook's conflict resolver cannot resolve a conflict.\r\n\r\nYou may select one of these options:\r\n- No conflicts are logged: No Modification Resolution logs are written into the Sync Issues folder whenever Outlook's conflict resolver runs. \r\n- All conflicts logged: Modification Resolution logs are written into the Sync Issues folder whenever Outlook's conflict resolver runs.\r\n- Unresolved conflicts logged only: Modification Resolution logs are written into the Sync Issues folder in Outlook when the Outlook conflict resolver cannot resolve a conflict.\r\n\r\nThis applies to all item types.\r\n\r\nIf you disable or do not configure this policy setting, no Modification Resolution logs are written when the Outlook conflict resolver runs.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_turnonloggingforallconflicts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_turnonloggingforallconflicts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_turnonloggingforallconflicts_l_turnonloggingforallconflictsdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_turnonloggingforallconflicts_l_turnonloggingforallconflictsdropid_0","displayName":"No conflicts are logged (default)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_turnonloggingforallconflicts_l_turnonloggingforallconflictsdropid_1","displayName":"All conflicts logged","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced_l_turnonloggingforallconflicts_l_turnonloggingforallconflictsdropid_2","displayName":"Unresolved conflicts logged only","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced~l_reminderoptions_l_reminders","displayName":"Reminders (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced~l_reminderoptions_l_reminders_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced~l_reminderoptions_l_reminders_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced~l_reminderoptions_l_reminders_l_displaythereminder","displayName":"Display the reminder (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced~l_reminderoptions_l_reminders_l_displaythereminder_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced~l_reminderoptions_l_reminders_l_displaythereminder_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced~l_reminderoptions_l_reminders_l_playremindersound","displayName":"Play reminder sound (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced~l_reminderoptions_l_reminders_l_playremindersound_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_advanced~l_reminderoptions_l_reminders_l_playremindersound_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_archiveignorelastmodifiedtime","displayName":"Change the criteria that Outlook uses to archive different item types (User)","description":"If you enable this policy setting, Outlook ignores the last modified date and archives items based on a date that is specific for the item type, as follows:\r\n\r\n-Email message: The received date.\r\n-Calendar item: The actual date that an appointment, event, or meeting is scheduled for.\r\n-Task: The completion date. Tasks that are not marked as completed are not archived. Tasks that are assigned to other users are archived only if the status is completed. \r\n-Note: The last modified date and time.\r\n-Journal entry: The date when the journal entry is created.\r\n-Contact: Not archived.\r\n\r\nIf you disable or do not configure this policy setting, Outlook archives different items based on the item type, as follows:\r\n\r\n-Email message: The received date or the last modified date and time, whichever is later. \r\n-Calendar item: The last modified date and time or the actual date that an appointment, event, or meeting is scheduled for, whichever is later. \r\n-Task: The completion date or the last modified date and time, whichever is later. Tasks that are not marked as completed are not archived. Tasks that are assigned to other users are archived only if the status is completed. \r\n-Note: The last modified date and time.\r\n-Journal entry: The date when the journal entry is created or the last modified date and time, whichever is later.\r\n-Contact: Not archived.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_archiveignorelastmodifiedtime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_archiveignorelastmodifiedtime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings","displayName":"AutoArchive Settings (User)","description":"If you enable this policy setting, the options specified in the AutoArchive dialog box are disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_archiveordeleteolditems","displayName":"Archive or delete old items (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_archiveordeleteolditems_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_archiveordeleteolditems_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_cleanoutitemsolderthan","displayName":"Clean out items older than (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_deleteexpireditemsemailfoldersonly","displayName":"Delete expired items (e-mail folders only) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_deleteexpireditemsemailfoldersonly_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_deleteexpireditemsemailfoldersonly_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_empty19","displayName":"\r\nDuring AutoArchive:\r\n","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_empty19_0","displayName":"Months","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_empty19_1","displayName":"Weeks","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_empty19_2","displayName":"Days","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_permanentlydeleteolditems","displayName":"Permanently delete old items (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_permanentlydeleteolditems_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_permanentlydeleteolditems_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_promptbeforeautoarchiveruns","displayName":"Prompt before AutoArchive runs (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_promptbeforeautoarchiveruns_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_promptbeforeautoarchiveruns_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_runautoarchiveeveryxdays","displayName":"Run AutoArchive every days (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_showarchivefolderinfolderlist","displayName":"Show archive folder in folder list (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_showarchivefolderinfolderlist_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_showarchivefolderinfolderlist_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_turnonautoarchive","displayName":"Turn on AutoArchive (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_turnonautoarchive_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_autoarchivesettings_l_turnonautoarchive_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_disablefilearchive","displayName":"Disable File|Archive (User)","description":"This setting allows you to disable File|Archive and prevent users from manually archiving items in their mailbox. You might want to set this if you have deployed other messaging records management policies in order to avoid conflicts. You should also consider disabling AutoArchive in the setting named AutoArchive Settings.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_disablefilearchive_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other~l_autoarchive_l_disablefilearchive_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice","displayName":"Polling Out-of-office Web service (User)","description":"By default, the Out Of Office (OOF) Web service is polled every 15 minutes (900000 milliseconds). This setting allows you to set the maximum number of milliseconds that elapse before Outlook polls the OOF Web service for OOF status.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice_l_empty21","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice_l_empty21_300000","displayName":"5 minutes","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice_l_empty21_600000","displayName":"10 minutes","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice_l_empty21_900000","displayName":"15 minutes (default)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice_l_empty21_1200000","displayName":"20 minutes","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice_l_empty21_1500000","displayName":"25 minutes","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice_l_empty21_1800000","displayName":"30 minutes","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice_l_empty21_2100000","displayName":"35 minutes","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice_l_empty21_2400000","displayName":"40 minutes","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice_l_empty21_2700000","displayName":"45 minutes","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice_l_empty21_3000000","displayName":"50 minutes","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice_l_empty21_3600000","displayName":"1 hour","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice_l_empty21_7200000","displayName":"2 hours","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice_l_empty21_14400000","displayName":"4 hours","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice_l_empty21_28800000","displayName":"8 hours","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_outofofficeassistant_l_pollingoofwebsrvice_l_empty21_86400000","displayName":"24 hours","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_allowattendeestoproposenewtimesformeetingsyouorganize","displayName":"Allow attendees to propose new times for meetings you organize (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_allowattendeestoproposenewtimesformeetingsyouorganize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_allowattendeestoproposenewtimesformeetingsyouorganize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_calendaritemdefaults","displayName":"Calendar item defaults (User)","description":"Sets the value in the option \"Default reminder\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_calendaritemdefaults_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_calendaritemdefaults_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_calendaritemdefaults_l_showremindersxminutesbeforetheeventstarts","displayName":"Show reminders minutes before the event starts: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_calendarweeknumbers","displayName":"Calendar week numbers (User)","description":"By default, week numbers are not shown in the Date Navigator in the Calendar. You can change this behavior to show week numbers in the Date Navigator by enabling this setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_calendarweeknumbers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_calendarweeknumbers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_controlcalendarsharing","displayName":"Control Calendar Sharing (User)","description":"By default, users can share an entire calendar by saving it in the iCalendar format, or share a snapshot of a calendar by using e-mail. This setting allows you to specify the detail level in the shared versions of calendars, or to disable sharing of calendars.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_controlcalendarsharing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_controlcalendarsharing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_controlcalendarsharing_l_controlcalendarsharing5","displayName":"Control Calendar Sharing (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_controlcalendarsharing_l_controlcalendarsharing5_32768","displayName":"Prevent Calendar Sharing","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_controlcalendarsharing_l_controlcalendarsharing5_16384","displayName":"Allow calendar sharing with 'Availability Only' detail level","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_controlcalendarsharing_l_controlcalendarsharing5_8192","displayName":"Allow calendar sharing with 'Availability Only' and 'Limited Details' detail level","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_disablemeetingregeneration","displayName":"Do not regenerate meetings (User)","description":"By default, when a user accepts or tentatively accepts a meeting, Outlook creates a duplicate copy of the meeting with the new response status and a new entry ID. Outlook then deletes the old version of the meeting from the calendar. This setting allows you to roll back to the legacy behavior and prevent meeting regeneration.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_disablemeetingregeneration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_disablemeetingregeneration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_disableweather","displayName":"Disable Weather Bar (User)","description":"This policy setting allows you to turn on or turn off the Weather Bar.\r\n\r\nIf you enable this policy setting, the Weather Bar is turned off.\r\n\r\nIf you disable or do not configure this setting, the Weather Bar is turned on.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_disableweather_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_disableweather_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_enableendearly","displayName":"End appointments and meetings early (User)","description":"\r\n This policy setting allows you to control whether the end time of appointments and meetings are reduced by a specified number of minutes when a user creates an appointment or meeting.\r\n\r\n If you enable this policy setting, the end time of appointments and meetings are reduced by a specified number of minutes when a user creates an appointment or meeting.\r\n\r\n To specify how many minutes to reduce appointments and meetings by, you can use the “Reduce the end time of short appointments and meetings by a specified number of minutes” and “Reduce the end time of long appointments and meetings by a specified number of minutes” policy settings.\r\n\r\n If you don’t enable those policy settings to specify a time in minutes, users will be able to specify a time, in minutes, by going to File > Options > Calendar. If the user hasn’t specified a time, default values of 5 minutes, for short meetings, and 10 minutes, for long meetings, will be used.\r\n\r\n If you disable this policy setting, appointments and meetings can’t be configured to end early and the option will be disabled under File > Options > Calendar and can’t be enabled by the user.\r\n\r\n If you don’t configure this policy setting, appointments and meetings aren’t configured to end early, but the user can enable appointments and meetings to end early by going to File > Options > Calendar.\r\n\r\n Note: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_enableendearly_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_enableendearly_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_enablemeetingdownleveltext","displayName":"Enable down-level meeting text (User)","description":"This policy setting controls whether Outlook automatically displays the meeting time and location in the meeting request body.\r\n\r\nIf you enable this policy setting, Outlook automatically displays the meeting time and location in the meeting request body.\r\n\r\nIf you disable or do not configure this policy setting, Outlook does not automatically display the meeting time and location in the meeting request body.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_enablemeetingdownleveltext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_enablemeetingdownleveltext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_endearlylong","displayName":"Reduce the end time of long appointments and meetings by a specified number of minutes (User)","description":"\r\n This policy setting allows you to specify how many minutes to reduce the end time of a long appointment or meeting by when a user creates an appointment or meeting. A long appointment or meeting is one that lasts for one hour or longer.\r\n\r\n If you enable this policy setting, you specify the number of minutes to reduce the end time of a long appointment or meeting by when a user creates an appointment or meeting. The user won’t be able to change this value by going to File > Options > Calendar.\r\n\r\n Note: You should also enable the “End appointments and meetings early” policy setting\r\n\r\n If you disable or don’t configure this policy setting, the default value of 10 minutes is used or whatever the user specifies by going to File > Options > Calendar.\r\n\r\n Note: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_endearlylong_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_endearlylong_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_endearlylong_l_endearlylongspinid","displayName":"Minutes to reduce meetings by: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_endearlyshort","displayName":"Reduce the end time of short appointments and meetings by a specified number of minutes (User)","description":"\r\n This policy setting allows you to specify how many minutes to reduce the end time of a short appointment or meeting by when a user creates an appointment or meeting. A short appointment or meeting is one that lasts for less than one hour.\r\n\r\n If you enable this policy setting, you specify the number of minutes to reduce the end time of a short appointment or meeting by when a user creates an appointment or meeting. The user can’t change this value by going to File > Options > Calendar.\r\n\r\n Note: You should also enable the “End appointments and meetings early” policy setting.\r\n\r\n If you disable or don’t configure this policy setting, the default value of 5 minutes is used or whatever the user specifies by going to File > Options > Calendar.\r\n\r\n Note: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_endearlyshort_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_endearlyshort_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_endearlyshort_l_endearlyshortspinid","displayName":"Minutes to reduce meetings by: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_firstdayoftheweek","displayName":"First day of the week (User)","description":"Sets the value in the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_firstdayoftheweek_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_firstdayoftheweek_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_firstdayoftheweek_l_choosethefirstdayoftheweek","displayName":"Choose the first day of the week: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_firstdayoftheweek_l_choosethefirstdayoftheweek_0","displayName":"Sunday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_firstdayoftheweek_l_choosethefirstdayoftheweek_1","displayName":"Monday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_firstdayoftheweek_l_choosethefirstdayoftheweek_2","displayName":"Tuesday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_firstdayoftheweek_l_choosethefirstdayoftheweek_3","displayName":"Wednesday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_firstdayoftheweek_l_choosethefirstdayoftheweek_4","displayName":"Thursday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_firstdayoftheweek_l_choosethefirstdayoftheweek_5","displayName":"Friday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_firstdayoftheweek_l_choosethefirstdayoftheweek_6","displayName":"Saturday","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_firstweekofyear","displayName":"First week of year (User)","description":"Sets the value in the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_firstweekofyear_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_firstweekofyear_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_firstweekofyear_l_choosethefirstweekoftheyear","displayName":"Choose the first week of the year: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_firstweekofyear_l_choosethefirstweekoftheyear_0","displayName":"Starts on Jan. 1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_firstweekofyear_l_choosethefirstweekoftheyear_2","displayName":"First full week","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_firstweekofyear_l_choosethefirstweekoftheyear_1","displayName":"First four-day week","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_hideluckydayswhenusingrokuyoujapanesecalendar","displayName":"Hide lucky days when using Rokuyou (Japanese) calendar (User)","description":"Checked: Does not display lucky days when using a Japanese Rokuyou calendar. | Unchecked: Displays lucky days when using a Japanese Rokuyou calendar.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_hideluckydayswhenusingrokuyoujapanesecalendar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_hideluckydayswhenusingrokuyoujapanesecalendar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_hidesendlatestversionbutton","displayName":"Hide Send Latest Version button (User)","description":"This policy setting hides the \"Send Latest Version\" button and prevents it from appearing on out-of-date meeting forward notifications and responses.\r\n\r\nIf you enable this policy setting, the \"Send Latest Version\" button be hidden on out-of-date meeting forward notifications and responses. \r\n\r\nIf you disable or do not configure this policy setting, the \"Send Latest Version\" button will be turned on.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_hidesendlatestversionbutton_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_hidesendlatestversionbutton_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_includeappointmentsonlywithinworkinghours","displayName":"Include appointments only within working hours (User)","description":"By default, all appointments in a calendar are included when that calendar is shared through e-mail or by using the Office.com Sharing Service. This setting allows users to publish only appointments that are within users' working hours.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_includeappointmentsonlywithinworkinghours_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_includeappointmentsonlywithinworkinghours_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_meetingrequestsusingicalendar","displayName":"Send Internet meeting requests using iCalendar format (User)","description":"This policy setting determines whether users' meeting requests sent outside of your organization use the iCalendar format.\r\n\r\nIf you enable or do not configure this policy setting, meeting requests sent outside of your organization use the ICAL format.\r\n\r\nIf you disable this policy setting, meeting requests sent outside your organization use the TNEF format.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_meetingrequestsusingicalendar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_meetingrequestsusingicalendar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_remindersoncalendaritems","displayName":"Do not display reminders on Calendar items by default (User)","description":"By default, when users create Calendar items, the Reminder: check box in the item is set. By disabling this setting, you can change the default behavior so that the Reminder: check box is cleared by default .","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_remindersoncalendaritems_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_remindersoncalendaritems_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_restupdatesforcalendar","displayName":"REST updates for calendars (User)","description":"This policy determines if Outlook can use REST to update calendars.\r\n\r\n If you enable this policy, Outlook will use REST to update supported Office 365 and Outlook.com calendars.\r\n\r\n If you disable this policy, Outlook won't use REST to update any calendars.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_restupdatesforcalendar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_restupdatesforcalendar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_usethisresponsewhenyouproposenewmeetingtimes","displayName":"Use this response when you propose new meeting times (User)","description":"Sets the value in the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_usethisresponsewhenyouproposenewmeetingtimes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_usethisresponsewhenyouproposenewmeetingtimes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_usethisresponsewhenyouproposenewmeetingtimes_l_usethisresponsewhenyouproposenewmeetingtimes6","displayName":"Use this response when you propose new meeting times (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_usethisresponsewhenyouproposenewmeetingtimes_l_usethisresponsewhenyouproposenewmeetingtimes6_2","displayName":"Tentative","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_usethisresponsewhenyouproposenewmeetingtimes_l_usethisresponsewhenyouproposenewmeetingtimes6_3","displayName":"Accept","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_usethisresponsewhenyouproposenewmeetingtimes_l_usethisresponsewhenyouproposenewmeetingtimes6_4","displayName":"Decline","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_weatherserviceurl","displayName":"Weather Service URL (User)","description":"This policy setting allows you to configure the weather service URL for Outlook.\r\n\r\nIf you enable this policy setting, you must enter your desired weather service URL.\r\n\r\nIf you disable or do not configure this policy setting, Outlook uses the default weather service URL.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_weatherserviceurl_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_weatherserviceurl_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_weatherserviceurl_l_empty","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_weatherupdatefrequency","displayName":"Weather Bar Update Frequency (User)","description":"This policy setting allows you to set the update frequency (in minutes) for the Weather Bar. \r\n\r\nIf you enable this policy setting, Outlook sets the update frequency to the specified value. \r\n\r\nIf you disable or do not configure this policy setting, Outlook uses the default value of 120 minutes.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_weatherupdatefrequency_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_weatherupdatefrequency_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_weatherupdatefrequency_l_weatherupdatefrequencyintervalspinid","displayName":"Update frequency (in minutes): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours","displayName":"Working hours (User)","description":"Sets the value in the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime","displayName":"End Time: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_1020","displayName":"5:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_0","displayName":"12:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_30","displayName":"12:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_60","displayName":"1:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_90","displayName":"1:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_120","displayName":"2:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_150","displayName":"2:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_180","displayName":"3:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_210","displayName":"3:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_240","displayName":"4:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_270","displayName":"4:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_300","displayName":"5:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_330","displayName":"5:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_360","displayName":"6:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_390","displayName":"6:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_420","displayName":"7:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_450","displayName":"7:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_480","displayName":"8:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_510","displayName":"8:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_540","displayName":"9:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_570","displayName":"9:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_600","displayName":"10:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_630","displayName":"10:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_660","displayName":"11:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_690","displayName":"11:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_720","displayName":"12:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_750","displayName":"12:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_780","displayName":"1:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_810","displayName":"1:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_840","displayName":"2:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_870","displayName":"2:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_900","displayName":"3:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_930","displayName":"3:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_960","displayName":"4:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_990","displayName":"4:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_1050","displayName":"5:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_1080","displayName":"6:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_1110","displayName":"6:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_1140","displayName":"7:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_1170","displayName":"7:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_1200","displayName":"8:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_1230","displayName":"8:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_1260","displayName":"9:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_1290","displayName":"9:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_1320","displayName":"10:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_1350","displayName":"10:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_1380","displayName":"11:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_endtime_1410","displayName":"11:30 PM","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime","displayName":"Start time: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_480","displayName":"8:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_0","displayName":"12:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_30","displayName":"12:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_60","displayName":"1:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_90","displayName":"1:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_120","displayName":"2:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_150","displayName":"2:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_180","displayName":"3:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_210","displayName":"3:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_240","displayName":"4:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_270","displayName":"4:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_300","displayName":"5:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_330","displayName":"5:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_360","displayName":"6:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_390","displayName":"6:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_420","displayName":"7:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_450","displayName":"7:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_510","displayName":"8:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_540","displayName":"9:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_570","displayName":"9:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_600","displayName":"10:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_630","displayName":"10:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_660","displayName":"11:00 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_690","displayName":"11:30 AM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_720","displayName":"12:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_750","displayName":"12:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_780","displayName":"1:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_810","displayName":"1:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_840","displayName":"2:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_870","displayName":"2:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_900","displayName":"3:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_930","displayName":"3:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_960","displayName":"4:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_990","displayName":"4:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_1020","displayName":"5:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_1050","displayName":"5:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_1080","displayName":"6:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_1110","displayName":"6:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_1140","displayName":"7:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_1170","displayName":"7:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_1200","displayName":"8:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_1230","displayName":"8:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_1260","displayName":"9:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_1290","displayName":"9:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_1320","displayName":"10:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_1350","displayName":"10:30 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_1380","displayName":"11:00 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workinghours_l_starttime_1410","displayName":"11:30 PM","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workweek","displayName":"Work week (User)","description":"Sets the value in the option \"Calendar work week\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workweek_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workweek_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workweek_l_lengthofworkweek","displayName":"Length of work week: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workweek_l_lengthofworkweek_124","displayName":"Monday to Friday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workweek_l_lengthofworkweek_120","displayName":"Monday to Thursday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workweek_l_lengthofworkweek_60","displayName":"Tuesday to Friday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workweek_l_lengthofworkweek_126","displayName":"Monday to Saturday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workweek_l_lengthofworkweek_30","displayName":"Wednesday to Saturday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workweek_l_lengthofworkweek_142","displayName":"Thursday to Sunday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workweek_l_lengthofworkweek_252","displayName":"Sunday to Friday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_workweek_l_lengthofworkweek_254","displayName":"All seven days","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_freebusyoptions_l_internetfreebusyoptions","displayName":"Internet Free/Busy Options (User)","description":"Checks/Unchecks the option \"Publish at my location\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_freebusyoptions_l_internetfreebusyoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_freebusyoptions_l_internetfreebusyoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_freebusyoptions_l_internetfreebusyoptions_l_publishatthisurl","displayName":"Publish at this URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_freebusyoptions_l_internetfreebusyoptions_l_publishfreebusyinformation","displayName":"Publish free/busy information (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_freebusyoptions_l_internetfreebusyoptions_l_publishfreebusyinformation_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_freebusyoptions_l_internetfreebusyoptions_l_publishfreebusyinformation_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_freebusyoptions_l_internetfreebusyoptions_l_searchatthisurl","displayName":"Search at this URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_freebusyoptions_l_options9","displayName":"Options (User)","description":"Sets the value in the option \"Publish [] month(s) of Calendar free/busy information on the server\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_freebusyoptions_l_options9_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_freebusyoptions_l_options9_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_freebusyoptions_l_options9_l_freebusyupdatedontheservereveryxxxseconds","displayName":"Free/Busy updated on the server every xxx seconds: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_freebusyoptions_l_options9_l_monthsoffreebusyinformationpublished","displayName":"Months of Free/Busy information published: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_freebusyoptions_l_options9_l_preventusersfromchangingmonthsoffreebusyinformation1","displayName":"Prevent users from changing Months of Free/Busy information being published (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_freebusyoptions_l_options9_l_preventusersfromchangingmonthsoffreebusyinformation1_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_freebusyoptions_l_options9_l_preventusersfromchangingmonthsoffreebusyinformation1_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_accesstopublishedcalendars","displayName":"Access to published calendars (User)","description":"This policy setting determines what restrictions apply to users who publish their calendars on Office.com or third-party World Wide Web Distributed Authoring and Versioning (WebDAV) servers. \r\n\r\nIf you enable or disable this policy setting, calendars that are published on Office.com must have restricted access (users other than the calendar owner/publisher who wish to view the calendar can only do so if they receive invitations from the calendar owner), and users cannot publish their calendars to third-party DAV servers. \r\n\r\nIf you do not configure this policy setting, users can share their calendars with others by publishing them to the Office.com Calendar Sharing Services and to a server that supports the World Wide Web Distributed Authoring and Versioning (WebDAV) protocol. Office.com allows users to choose whether to restrict access to their calendars to people they invite, or allow unrestricted access to anyone who knows the URL to reach the calendar. DAV access restrictions can only be achieved through server and folder permissions, and might require the assistance of a server administrator to set up and maintain.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_accesstopublishedcalendars_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_accesstopublishedcalendars_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_pathtodavserver","displayName":"Path to DAV server (User)","description":"This setting allows you to define the path to a DAV server that should be used when users publish their calendars via DAV.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_pathtodavserver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_pathtodavserver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_pathtodavserver_l_empty","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_preventpublishingtoadavserver","displayName":"Prevent publishing to a DAV server (User)","description":"This policy setting controls whether Outlook users can publish their calendars to a DAV server. \r\n\r\nIf you enable this policy setting, Outlook users cannot publish their calendars to a DAV server. \r\n\r\nIf you disable or do not configure this policy setting, Outlook users can share their calendars with others by publishing them to a server that supports the World Wide Web Distributed Authoring and Versioning (WebDAV) protocol.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_preventpublishingtoadavserver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_preventpublishingtoadavserver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_preventpublishingtoofficeonline","displayName":"Prevent publishing to Office.com (User)","description":"This policy setting controls whether Outlook users can publish their calendars to the Office.com Calendar Sharing Service. \r\n\r\nIf you enable this policy setting, Outlook users cannot publish their calendars to Office.com. \r\n\r\nIf you disable do not configure this policy setting, Outlook users can share their calendars with selected others by publishing them to the Microsoft Outlook Calendar Sharing Service. Users can control who can view their calendar and at what level of detail.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_preventpublishingtoofficeonline_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_preventpublishingtoofficeonline_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_publishinterval","displayName":"Publish interval (User)","description":"By default, Outlook does not publish calendars to Office.com more often then the publish interval set by Office.com. This setting allows users to publish calendars more often than the Office.com interval specifies.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_publishinterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_publishinterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_restrictlevelofcalendardetails","displayName":"Restrict level of calendar details users can publish (User)","description":"This policy setting controls the level of calendar details that Outlook users can publish to the Microsoft Outlook Calendar Sharing Service. \r\n\r\nIf you enable this policy setting, you can choose from three levels of detail: \r\n\r\n* All options are available - This level of detail is the default configuration. \r\n* Disables 'Full details' \r\n* Disables 'Full details' and 'Limited details' \r\n\r\nIf you disable or do not configure this policy setting, Outlook users can share their calendars with selected others by publishing them to the Microsoft Outlook Calendar Sharing Service. Users can choose from three levels of detail: \r\n\r\n* Availability only - Authorized visitors will see the user's time marked as Free, Busy, Tentative, or Out of Office, but will not be able to see the subjects or details of calendar items. \r\n* Limited details - Authorized visitors can see the user's availability and the subjects of calendar items only. They will not be able to view the details of calendar items. Optionally, users can allow visitors to see the existence of private items. \r\n* Full details - Authorized visitors can see the full details of calendar items. Optionally, users can allow visitors to see the existence of private items.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_restrictlevelofcalendardetails_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_restrictlevelofcalendardetails_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_restrictlevelofcalendardetails_l_empty4","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_restrictlevelofcalendardetails_l_empty4_0","displayName":"All options are available","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_restrictlevelofcalendardetails_l_empty4_8192","displayName":"Disables 'Full details'","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_restrictlevelofcalendardetails_l_empty4_16384","displayName":"Disables 'Full details' and 'Limited details'","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_restrictuploadmethod","displayName":"Restrict upload method (User)","description":"This policy setting controls whether Outlook can automatically upload calendar updates to Office.com. \r\n\r\nIf you enable this policy setting, Outlook enforces the \"Single Upload: Updates will not be uploaded from the Published Calendar Settings dialog\" option, and calendar updates are not uploaded. Users will not be able to change this setting.\r\n\r\nIf you disable this policy setting Outlook automatically publishes calendar updates to Office.com at regular intervals and users will not be able to change this. \r\n\r\nIf you do not configure this policy setting, when users publish their calendar to Office.com using the Microsoft Outlook Calendar Sharing Service, Outlook updates the calendars online at regular intervals unless they click \"Advanced\" and select \"Single Upload: Updates will not be uploaded from the Published Calendar Settings dialog\".","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_restrictuploadmethod_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_microsoftofficeonlinesharing_l_restrictuploadmethod_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_planneroptions_l_meetingplanner","displayName":"Meeting Planner (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_planneroptions_l_meetingplanner_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_planneroptions_l_meetingplanner_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_planneroptions_l_meetingplanner_l_showcalendardetailsinthegrid","displayName":"Show calendar details in the grid (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_planneroptions_l_meetingplanner_l_showcalendardetailsinthegrid_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_planneroptions_l_meetingplanner_l_showcalendardetailsinthegrid_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_planneroptions_l_meetingplanner_l_showpopupcalendardetails","displayName":"Show popup calendar details (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_planneroptions_l_meetingplanner_l_showpopupcalendardetails_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_planneroptions_l_meetingplanner_l_showpopupcalendardetails_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_recurrenceoptions_l_defaultrecurrenceduration","displayName":"Specify total number of days in a recurring meeting or appointment (User)","description":"This policy setting allows you to specify the default number of days after which a recurring meeting or appointment (but not a task) ends.\r\n\r\nIf you enable this policy setting, the “End by” setting is the default setting for recurring meetings and appointments, and the “End by” value is set to the specified number of days after today’s date. For example, if you specify a value of 180 and today's date is May 5, 2011, the “End by” value is November 1, 2011 (180 days after today’s date).\r\n\r\nIf you disable or do not configure this policy setting, the “No end date” option is the default setting for recurring meetings and appointments.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_recurrenceoptions_l_defaultrecurrenceduration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_recurrenceoptions_l_defaultrecurrenceduration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_recurrenceoptions_l_defaultrecurrenceduration_l_defaultrecurrencedurationspinid","displayName":"End recurrence after x days (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_recurrenceoptions_l_disablenoenddate","displayName":"Disable the \"No end date\" option for recurring items (User)","description":"This policy setting allows you to disable the \"No end date\" option for the recurrence range in appointments, meetings, and tasks.\r\n\r\nIf you enable this policy setting, the “No end date” option is disabled, and the “End after” recurrence setting is selected and set to “10 occurrences” by default. You can change this default setting by configuring the “Specify total number of days in a recurring meeting or appointment” policy setting.\r\n\r\nIf you disable or do not configure this policy setting, the “No end date” option is enabled and is the default setting for recurring meetings, appointments, and tasks.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_recurrenceoptions_l_disablenoenddate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_recurrenceoptions_l_disablenoenddate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_donotallowhorizontalcalendarview","displayName":"Do not allow horizontal calendar view (User)","description":"This policy setting allows you to prevent horizontal calendar view.\r\n\r\nIf you enable this policy setting, horizontal calendar view is not allowed.\r\n\r\nIf you disable or do not configure this policy setting, horizontal calendar view is allowed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_donotallowhorizontalcalendarview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_donotallowhorizontalcalendarview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_preventmydepartmentcalendarfromappearing","displayName":"Prevent My Department Calendar from appearing (User)","description":"This policy setting prevents My Department Calendar from appearing in the navigation pane.\r\n\r\nIf you enable this policy setting, My Department Calendar will not appear in the navigation pane.\r\n\r\nIf you disable or do not configure this policy setting, My Department Calendar will appear in the navigation pane.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_preventmydepartmentcalendarfromappearing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_preventmydepartmentcalendarfromappearing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_preventotherdepartmentcalendarfromappearing","displayName":"Prevent Other Department Calendar from appearing (User)","description":"This policy setting prevents Other Department Calendar from appearing in the navigation pane.\r\n\r\nIf you enable this policy setting, Other Department Calendar will not appear in the navigation pane.\r\n\r\nIf you disable or do not configure this policy setting, Other Department Calendar will appear in the navigation pane.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_preventotherdepartmentcalendarfromappearing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_preventotherdepartmentcalendarfromappearing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_preventreportinglinegroupcalendarfromappearing","displayName":"Prevent Reporting Line Group Calendar from appearing (User)","description":"This policy setting prevents Reporting Line Group Calendar from appearing in the navigation pane.\r\n\r\nIf you enable this policy setting, Reporting Line Group Calendar will not appear in the navigation pane.\r\n\r\nIf you disable or do not configure this policy setting, My Reporting Line Group Calendar will appear in the navigation pane.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_preventreportinglinegroupcalendarfromappearing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_preventreportinglinegroupcalendarfromappearing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_turnoffautoswitchingfromhorizontaltovertical","displayName":"Turn off auto-switching from horizontal to vertical layout (User)","description":"This policy setting controls auto switching of calendar layouts from horizontal to vertical. \r\n\r\nIf you enable this policy setting, auto-switching is turned off.\r\n\r\nIf you disable or do not configure this policy setting, auto-switching is turned on.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_turnoffautoswitchingfromhorizontaltovertical_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_turnoffautoswitchingfromhorizontaltovertical_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_turnoffautoswitchingfromverticaltohorizontallayout","displayName":"Turn off auto-switching from vertical to horizontal layout (User)","description":"This policy setting controls auto-switching of calendar layouts from vertical to horizontal.\r\n\r\nIf you enable this policy setting, auto-switching is turned off.\r\n\r\nIf you disable or do not configure this policy setting, auto-switching is turned on.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_turnoffautoswitchingfromverticaltohorizontallayout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_turnoffautoswitchingfromverticaltohorizontallayout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_turnofflegacygroupcalendarmigration","displayName":"Turn off Legacy Group Calendar migration (User)","description":"This policy setting controls the migration of legacy Group Calendar. \r\n\r\nIf you enable this policy setting, migration will be turned off.\r\n\r\nIf you disable or do not configure this policy setting, migration will be turned on.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_turnofflegacygroupcalendarmigration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_turnofflegacygroupcalendarmigration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_turnoffsharingrecommendation","displayName":"Turn off sharing recommendation (User)","description":"This policy setting controls the sharing recommendation feature. \r\n\r\nIf you enable this policy setting, the recommendation will be turned off.\r\n\r\nIf you disable or do not configure this policy setting, the recommendation will be turned on.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_turnoffsharingrecommendation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions~l_scheduleview_l_turnoffsharingrecommendation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_determineorderofsourcesforphotos","displayName":"Determine order of sources for photos (User)","description":"This policy setting controls the order of sources for photos displayed in Outlook. \r\n\r\nIf you enable this policy setting, Outlook will first look at the OAB/AD for the user photo. If this is not available, Outlook will show a Contact photo if the Contact photo is available.\r\n\r\nIf you disable or do not configure this policy setting, Outlook will first look into the Contact Address Books for the user photo. If this is not available, Outlook will look to the OAB/AD if available.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_determineorderofsourcesforphotos_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_determineorderofsourcesforphotos_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts","displayName":"Select the default setting for how to file new contacts (User)","description":"Sets the value in the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_additionalcontactsindex","displayName":"Additional Contacts Index: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_additionalcontactsindex_2","displayName":"Arabic","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_additionalcontactsindex_7","displayName":"Cyrillic","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_additionalcontactsindex_15","displayName":"Greek","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_additionalcontactsindex_16","displayName":"Hebrew","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_additionalcontactsindex_28","displayName":"Thai","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_additionalcontactsindex_30","displayName":"Vietnamese","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_checkforduplicatecontacts","displayName":"Check for duplicate contacts (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_checkforduplicatecontacts_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_checkforduplicatecontacts_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_defaultfileasorder","displayName":"Default File As order: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_defaultfileasorder_32791","displayName":"Last First","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_defaultfileasorder_32823","displayName":"First Last","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_defaultfileasorder_14870","displayName":"Company","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_defaultfileasorder_32793","displayName":"Last, First (Company)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_defaultfileasorder_32792","displayName":"Company (Last, First)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_defaultfullnameorder","displayName":"Default Full Name order: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_defaultfullnameorder_e","displayName":"First (Middle) Last","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_defaultfullnameorder_h","displayName":"Last First","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_defaultfullnameorder_s","displayName":"First Last1 Last2","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_showanadditionalcontactsindex","displayName":"Show an additional Contacts Index (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_showanadditionalcontactsindex_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_selectthedefaultsettingforhowtofilenewcontacts_l_showanadditionalcontactsindex_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_showcontactslinkingcontrolsonallforms","displayName":"Show Contacts linking controls on all Forms (User)","description":"By default, Tasks, Appointments, Journal Entries, and Contacts hide the controls in the Outlook user interface used for linking related contacts. When you enable this setting, the linking controls appear in Outlook. You might choose to enable this setting if your users rely on contact linking - for example, to track partners who attend appointments together or to track ways in which contacts are related to each other.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_showcontactslinkingcontrolsonallforms_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_contactoptions_l_showcontactslinkingcontrolsonallforms_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_changectrlentershortcutbehavior","displayName":"Change CTRL+ENTER shortcut behavior (User)","description":"This policy setting controls whether CTRL+ENTER can be used as a shortcut to send an email message. You can change this behavior so that CTRL+ENTER does not send an email message.\r\n\r\nIf you enable this policy setting, you may select one of these choices:\r\n- CTRL+Enter is not a shortcut for sending a message\r\n- CTRL+Enter is a shortcut for sending a message\r\n- CTRL+Enter displays a prompt\r\n\r\nIf you disable or do not configure this policy setting, users can use CTRL+ENTER to send an e-mail message. By default, users are prompted the first time they use the shortcut to confirm sending the message.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_changectrlentershortcutbehavior_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_changectrlentershortcutbehavior_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_changectrlentershortcutbehavior_l_changectrlentershortcutbehaviorid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_changectrlentershortcutbehavior_l_changectrlentershortcutbehaviorid_0","displayName":"CTRL+Enter is not a shortcut for sending a message","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_changectrlentershortcutbehavior_l_changectrlentershortcutbehaviorid_1","displayName":"CTRL+Enter is a shortcut for sending a message","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_changectrlentershortcutbehavior_l_changectrlentershortcutbehaviorid_2","displayName":"CTRL+Enter displays a prompt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_checkforgottenattachments","displayName":"Attachment Reminder Options (User)","description":"This policy setting governs the enabling or disabling of the Attachment Reminder feature in Outlook.\r\n\r\nIf you enable or do not configure this policy setting, when a user sends an email, Outlook looks for any references to attachments in the email, and if no attachments are found, displays a dialog box to alert the user.\r\n\r\nIf you disable this policy setting, Outlook does not check for any references to attachments, and the Attachment Reminder dialog box does not pop up.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_checkforgottenattachments_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_checkforgottenattachments_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_configurecrossfoldercontentinconversationview","displayName":"Configure Cross Folder Content in conversation view (User)","description":"This policy setting controls how conversation view in Outlook is loaded and whether Cross Folder Content is turned on or off.\r\n\r\nIf you enable this policy setting, you may choose one of these options:\r\n\r\n- On and cross-store (default): Cross Folder Content is on and cross-store. Data will be pulled from all connected data files whether they are cached or online. \r\n- Off: Cross Folder Content is turned off.\r\n- On and current: Cross Folder Content is on, but data is only pulled from the current data file. \r\n- On and local: Cross Folder Content is on, but data is only pulled from the current data file and any other local data files.\r\n\r\nIf you disable or do not configure this policy setting, Cross Folder Content will be turned on and pulled from all connected data files.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_configurecrossfoldercontentinconversationview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_configurecrossfoldercontentinconversationview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_configurecrossfoldercontentinconversationview_l_configurecrossfoldercontentinconversationviewdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_configurecrossfoldercontentinconversationview_l_configurecrossfoldercontentinconversationviewdropid_0","displayName":"On and cross-store (default)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_configurecrossfoldercontentinconversationview_l_configurecrossfoldercontentinconversationviewdropid_1","displayName":"Off","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_configurecrossfoldercontentinconversationview_l_configurecrossfoldercontentinconversationviewdropid_2","displayName":"On and current","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_configurecrossfoldercontentinconversationview_l_configurecrossfoldercontentinconversationviewdropid_3","displayName":"On and local","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_disableattachmentpreviewing","displayName":"Do not allow attachment previewing in Outlook (User)","description":"This policy setting controls whether Outlook users can preview attachments in e-mail messages. \r\n\r\nIf you enable this policy setting, users cannot preview attachments within Outlook. Users must instead use the appropriate application to view attachments, depending on security settings. This configuration can be used to guard against theoretical future zero-day attacks that target specific file types. \r\n\r\nIf you disable or do not configure this policy setting, Outlook users can preview certain types of e-mail attachments within the message window or Reading Pane by clicking the icon that represents the attachment. Users can preview Outlook items, Word documents, PowerPoint presentations, Excel worksheets, Microsoft Visio® drawings, image files, and text files. To help protect users from malicious code, active content embedded in attachments (including scripts, macros, and ActiveX controls) is disabled during a preview.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_disableattachmentpreviewing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_disableattachmentpreviewing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_disablemailtips","displayName":"Disable Mail Tips (User)","description":"This policy setting determines whether users can view Mail Tips.\r\n\t \r\nIf you enable this policy setting, Mail Tips do not appear in Outlook.\r\n\t\t\t\t\t\r\nIf you disable or do not configure this policy, Mail Tips appear in Outlook.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_disablemailtips_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_disablemailtips_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_displaysenderpicture","displayName":"Display Sender Picture (User)","description":"This policy setting controls whether Outlook displays pictures in email headers for senders of email messages and meeting requests. \r\n\t \r\nIf you enable or do not configure this policy setting Outlook displays pictures for senders if they are available. \r\n\r\nIf you disable this policy setting, pictures of senders will not be displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_displaysenderpicture_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_displaysenderpicture_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_donotuseconversationalarrangementinviews","displayName":"Do not use Conversation arrangement in Views (User)","description":"This policy setting allows you to prevent the use of Conversation arrangement in Views.\r\n\r\nIf you enable this policy setting, you will prevent Conversational arrangement in Views.\r\n\r\nIf you disable or do not configure this policy setting, users will be able to use Conversation arrangement in Views.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_donotuseconversationalarrangementinviews_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_donotuseconversationalarrangementinviews_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_messagehandling","displayName":"Message handling (User)","description":"You can use this setting to specify various options for how e-mail messages are handled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_messagehandling_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_messagehandling_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_messagehandling_l_aftermovingordeletinganopenitem0","displayName":"After moving or deleting an open item: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_messagehandling_l_aftermovingordeletinganopenitem0_0","displayName":"Open the next item","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_messagehandling_l_aftermovingordeletinganopenitem0_1","displayName":"Return to the current folder","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_messagehandling_l_aftermovingordeletinganopenitem0_2","displayName":"Open the previous item","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_messagehandling_l_automaticallycleanupplaintextmessages","displayName":"Automatically clean up plain text messages (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_messagehandling_l_automaticallycleanupplaintextmessages_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_messagehandling_l_automaticallycleanupplaintextmessages_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_messagehandling_l_autosaveunsenteveryxxminutes0noautosave","displayName":"Autosave unsent every xx minutes (0=No AutoSave): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_messagehandling_l_closeoriginalmessagewhenreplyorforward","displayName":"Close original message when reply or forward (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_messagehandling_l_closeoriginalmessagewhenreplyorforward_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_messagehandling_l_closeoriginalmessagewhenreplyorforward_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_messagehandling_l_savecopiesofmessagesinsentitemsfolder","displayName":"Save copies of messages in Sent Items folder (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_messagehandling_l_savecopiesofmessagesinsentitemsfolder_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_messagehandling_l_savecopiesofmessagesinsentitemsfolder_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_onrepliesandforwards","displayName":"On replies and forwards (User)","description":"Sets the values in the corresponding UI options.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_onrepliesandforwards_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_onrepliesandforwards_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_onrepliesandforwards_l_allowuserscommentstobemarked","displayName":"Allow user's comments to be marked (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_onrepliesandforwards_l_allowuserscommentstobemarked_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_onrepliesandforwards_l_allowuserscommentstobemarked_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_onrepliesandforwards_l_prefixeachlinewith","displayName":"Prefix each line with: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_onrepliesandforwards_l_whenforwardingamessage","displayName":"When forwarding a message: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_onrepliesandforwards_l_whenforwardingamessage_1","displayName":"Attach orginal message","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_onrepliesandforwards_l_whenforwardingamessage_2","displayName":"Include original message text","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_onrepliesandforwards_l_whenforwardingamessage_3","displayName":"Include and indent org. message text","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_onrepliesandforwards_l_whenforwardingamessage_1000","displayName":"Prefix each line of the org. message","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_onrepliesandforwards_l_whenreplyingtoamessage","displayName":"When replying to a message: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_onrepliesandforwards_l_whenreplyingtoamessage_0","displayName":"Do not include orginal message","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_onrepliesandforwards_l_whenreplyingtoamessage_1","displayName":"Attach orginal message","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_onrepliesandforwards_l_whenreplyingtoamessage_2","displayName":"Include original message text","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_onrepliesandforwards_l_whenreplyingtoamessage_3","displayName":"Include and indent org. message text","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_onrepliesandforwards_l_whenreplyingtoamessage_1000","displayName":"Prefix each line of the org. message","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_reademailasplaintext","displayName":"Read e-mail as plain text (User)","description":"This policy setting determines whether Outlook renders all e-mail messages in plain text format for reading.Outlook can display e-mail messages and other items in three formats: plain text, Rich Text Format (RTF), and HTML. \r\n\r\nIf you enable this policy setting, the \"Read all standard mail in plain text\" check box option is selected in the \"E-mail Security\" section of the Trust Center and users cannot change it. This option only changes the way e-mail messages are displayed; the original message is not converted to plain text format. \r\n\r\nIf you disable or do not configure this policy setting, Outlook displays e-mail messages in whatever format they were received in.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_reademailasplaintext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_reademailasplaintext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_readsignedemailasplaintext","displayName":"Read signed e-mail as plain text (User)","description":"This policy setting determines whether Outlook renders all digitally signed e-mail in plain text format for reading. Outlook can display e-mail messages and other items in three formats: plain text, Rich Text Format (RTF), and HTML. \r\n\r\nIf you enable this policy setting, the \"Read all standard mail in plain text\" check box option is selected in the \"E-mail Security\" section of the Trust Center and users cannot change it. This option only changes the way e-mail messages are displayed; the original message is not converted to plain text format. \r\n\r\nIf you disable or do not configure this policy setting, Outlook displays digitally signed e-mail messages in the format they were received in.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_readsignedemailasplaintext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions_l_readsignedemailasplaintext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_disableautopreview","displayName":"Disable AutoPreview (User)","description":"Enabling this policy permanently disables the item preview. Users cannot turn it back on and the ribbon UI to change it is disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_disableautopreview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_disableautopreview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_moresavemessages","displayName":"More save messages (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_moresavemessages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_moresavemessages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_moresavemessages_l_infoldersotherthantheinboxsavereplieswithoriginalmessage","displayName":"In folders other than the Inbox, save replies with original message (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_moresavemessages_l_infoldersotherthantheinboxsavereplieswithoriginalmessage_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_moresavemessages_l_infoldersotherthantheinboxsavereplieswithoriginalmessage_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_moresavemessages_l_saveforwardedmessages","displayName":"Save forwarded messages (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_moresavemessages_l_saveforwardedmessages_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_moresavemessages_l_saveforwardedmessages_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_savemessages","displayName":"Save Messages (User)","description":"Specifies the folder in which unsent messages are saved.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_savemessages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_savemessages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_savemessages_l_saveunsentitemsinthisfolder","displayName":"Save unsent items in this folder: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_savemessages_l_saveunsentitemsinthisfolder_4","displayName":"Outbox","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_savemessages_l_saveunsentitemsinthisfolder_5","displayName":"Sent Items","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_savemessages_l_saveunsentitemsinthisfolder_6","displayName":"Inbox","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_savemessages_l_saveunsentitemsinthisfolder_16","displayName":"Drafts","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whennewitemsarrive","displayName":"When new items arrive (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whennewitemsarrive_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whennewitemsarrive_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whennewitemsarrive_l_brieflychangethemousecursor","displayName":"Briefly change the mouse cursor (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whennewitemsarrive_l_brieflychangethemousecursor_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whennewitemsarrive_l_brieflychangethemousecursor_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whennewitemsarrive_l_playasound","displayName":"Play a sound (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whennewitemsarrive_l_playasound_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whennewitemsarrive_l_playasound_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whennewitemsarrive_l_showanenvelopeiconinthesystemtray","displayName":"Show an envelope icon in the system tray (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whennewitemsarrive_l_showanenvelopeiconinthesystemtray_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whennewitemsarrive_l_showanenvelopeiconinthesystemtray_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage","displayName":"When sending a message (User)","description":"Sets the values in the corresponding UI options.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_addpropertiestoattachmentstoenablereplywithchanges","displayName":"Add properties to attachments to enable Reply with Changes (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_addpropertiestoattachmentstoenablereplywithchanges_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_addpropertiestoattachmentstoenablereplywithchanges_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_allowcommasasaddressseparator","displayName":"Allow commas as address separator (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_allowcommasasaddressseparator_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_allowcommasasaddressseparator_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_automaticnamechecking","displayName":"Automatic name checking (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_automaticnamechecking_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_automaticnamechecking_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_deletemeetingrequestfrominboxwhenresponding","displayName":"Delete meeting request from Inbox when responding (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_deletemeetingrequestfrominboxwhenresponding_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_deletemeetingrequestfrominboxwhenresponding_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_messagesexpireafterdays","displayName":"Messages expire after (days): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_setimportance","displayName":"Set importance: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_setimportance_2","displayName":"High","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_setimportance_1","displayName":"Normal","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_setimportance_0","displayName":"Low","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_setsensitivity","displayName":"Set sensitivity: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_setsensitivity_0","displayName":"Normal","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_setsensitivity_1","displayName":"Personal","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_setsensitivity_2","displayName":"Private","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_setsensitivity_3","displayName":"Confidential","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_suggestnameswhilecompletingtoccandbccfields","displayName":"Suggest names while completing To, Cc, and Bcc fields (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_suggestnameswhilecompletingtoccandbccfields_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions_l_whensendingamessage_l_suggestnameswhilecompletingtoccandbccfields_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_newmaildesktopalert","displayName":"Do not display New Mail alert for users (User)","description":"By default, users receive an alert message on their desktops when new mail arrives. By enabling this setting, the alert is not displayed for new mail.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_newmaildesktopalert_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_newmaildesktopalert_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydefaultlocationofdesktopalert","displayName":"Specify default location of Desktop Alert (User)","description":"You can change the default location of the Desktop Alert. In the Corner field, select a number corresponding to a quadrant of the user's screen: 0 = upper left, 1 = upper right, 2 = lower left, 3 = lower right (the default). In the XOffset field, enter a number representing the horizontal distance from the corner you've specified (the default is 44). In the YOffset field, enter a number representing the vertical distance from the corner you've specified (the default is 42).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydefaultlocationofdesktopalert_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydefaultlocationofdesktopalert_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydefaultlocationofdesktopalert_l_corner03","displayName":"Corner (0-3) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydefaultlocationofdesktopalert_l_xoffsetdefault44","displayName":"XOffset (default 44): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydefaultlocationofdesktopalert_l_yoffsetdefault42","displayName":"YOffset (default 42): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydurationofdesktopalertbeforefadeinmillisec","displayName":"Specify duration of Desktop Alert before fade (in milliseconds) (User)","description":"Specify duration of Desktop Alert before fade (in milliseconds)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydurationofdesktopalertbeforefadeinmillisec_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydurationofdesktopalertbeforefadeinmillisec_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydurationofdesktopalertbeforefadeinmillisec_l_millisecdefault4000","displayName":"Millisec (Default 4000): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydurationofdesktopalertonmouseoverinmillisec","displayName":"Specify duration of Desktop Alert on mouse over (in milliseconds) (User)","description":"Specify duration of Desktop Alert on mouse over (in milliseconds)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydurationofdesktopalertonmouseoverinmillisec_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydurationofdesktopalertonmouseoverinmillisec_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydurationofdesktopalertonmouseoverinmillisec_l_millisec1","displayName":"Millisec: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydurationoffadeininmillisec","displayName":"Specify duration of fade in (in milliseconds) (User)","description":"Specify duration of fade in (in milliseconds)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydurationoffadeininmillisec_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydurationoffadeininmillisec_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydurationoffadeininmillisec_l_millisec","displayName":"Millisec: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydurationoffadeoutinmillisec","displayName":"Specify duration of fade out (in milliseconds) (User)","description":"Specify duration of fade out (in milliseconds)","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydurationoffadeoutinmillisec_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydurationoffadeoutinmillisec_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifydurationoffadeoutinmillisec_l_millisec2","displayName":"Millisec: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifyopacityatstartoffadein","displayName":"Specify opacity at start of fade in (User)","description":"Specify opacity at start of fade in","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifyopacityatstartoffadein_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifyopacityatstartoffadein_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifyopacityatstartoffadein_l_specifyopacityatstartoffadein3","displayName":"Specify opacity at start of fade in (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifyopacityofdesktopalert","displayName":"Specify opacity of Desktop Alert (User)","description":"Specify opacity of Desktop Alert","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifyopacityofdesktopalert_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifyopacityofdesktopalert_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_advancedemailoptions~l_desktopalert_l_specifyopacityofdesktopalert_l_opacityalphalevel","displayName":"Opacity (Alpha Level): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options","displayName":"Options (User)","description":"You can use these settings to specify how tracking options work for Outlook e-mail messages.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_deleteblankvotingandmeetingresponsesafterprocessing","displayName":"Delete blank voting and meeting responses after processing (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_deleteblankvotingandmeetingresponsesafterprocessing_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_deleteblankvotingandmeetingresponsesafterprocessing_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_processreceiptsonarrival","displayName":"Process receipts on arrival (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_processreceiptsonarrival_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_processreceiptsonarrival_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_processrequestsandresponsesonarrival","displayName":"Process requests and responses on arrival (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_processrequestsandresponsesonarrival_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_processrequestsandresponsesonarrival_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_requestareadreceiptforallmessagesausersends","displayName":"Request a read receipt for all messages a user sends (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_requestareadreceiptforallmessagesausersends_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_requestareadreceiptforallmessagesausersends_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_requestdeliveryrcptforallmsgsausersendsexchangeonly","displayName":"Request delivery rcpt for all msgs a user sends (Exchange only) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_requestdeliveryrcptforallmsgsausersendsexchangeonly_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_requestdeliveryrcptforallmsgsausersendsexchangeonly_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_whenoutlookisaskedtorespondtoareadreceiptrequest","displayName":"When Outlook is asked to respond to a read receipt request: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_whenoutlookisaskedtorespondtoareadreceiptrequest_0","displayName":"Always send a response","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_whenoutlookisaskedtorespondtoareadreceiptrequest_1","displayName":"Never send a response","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_options_l_whenoutlookisaskedtorespondtoareadreceiptrequest_2","displayName":"Ask before sending a response","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_turnoffsendandtrack","displayName":"Turn off Send and Track feature (User)","description":"By default, users can flag an e-mail that they send to help them remember to follow up on it later. The flag is not sent to the recipient. By enabling this setting, this feature is turned off.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_turnoffsendandtrack_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_emailoptions~l_trackingoptions_l_turnoffsendandtrack_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_addpeopleiemailtothesafesenderslist","displayName":"Add e-mail recipients to users' Safe Senders Lists (User)","description":"This policy setting controls whether recipients' e-mail addresses are automatically added to the user's Safe Senders List in Microsoft Outlook. Sometimes users will send e-mail messages to request that they be taken off a mailing list. If the e-mail recipient is then automatically added to the Safe Senders List, future e-mail messages from that address will no longer be sent to the users Junk E-mail folder, even if it would otherwise be considered junk. \r\n\r\nIf you enable this policy setting, all recipients of outgoing messages are automatically added to users' Safe Senders Lists. If users respond to junk e-mail senders while this policy setting is Enabled, all future junk e-mail from the same address will be considered safe. \r\n\r\nIf you disable this policy setting, recipients of outgoing messages are not automatically added to the Safe Senders List. Users must explicitly add addresses to the list. \r\n\r\nIf you do not configure this policy setting, recipients of outgoing messages are not added automatically to individual users' Safe Senders Lists. However, users can change this configuration in the Outlook user interface.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_addpeopleiemailtothesafesenderslist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_addpeopleiemailtothesafesenderslist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_hidejunkmailui","displayName":"Hide Junk Mail UI (User)","description":"This policy setting controls whether the Junk E-mail Filter is enabled in Outlook. The Junk E-mail Filter in Outlook is designed to intercept the most obvious junk e-mail, or spam, and send it to users' Junk E-mail folders. The filter evaluates each incoming message based on several factors, including the time when the message was sent and the content of the message. The filter does not single out any particular sender or message type, but instead analyzes each message based on its content and structure to discover whether or not it is probably spam.\r\n \r\nIf you enable this policy setting, junk e-mail filtering in Outlook is turned off entirely, in addition to hiding the filtering controls from users. In addition, you can use the \"Junk E-mail Protection level\" policy setting to preset a filtering level and prevent users from changing it. Note - This policy setting does not affect the configuration of the Microsoft Exchange Server Intelligent Message Filter (IMF), which provides server-level junk e-mail filtering. \r\n\r\nIf you disable or do not configure this policy setting, the Junk E-mail Filter in Outlook is enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_hidejunkmailui_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_hidejunkmailui_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkmailimportlist","displayName":"Trigger to apply junk email list settings (User)","description":"This policy setting allows you to trigger the activation of other junk e-mail policy settings.\r\n\r\nIf you enable this policy setting, you will trigger the activation of other junk e-mail policy settings. For example, if you configure the \"Specify path to Safe Senders list\" policy setting, the specified Safe Senders list is not imported by Outlook unless you also enable the \"Junk Mail Import List\" policy setting.\r\n\r\nIf you disable or do not configure this policy setting, you will not trigger the activation of other junk e-mail policies.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkmailimportlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkmailimportlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_overwriteorappendjunkmailimportlist","displayName":"Overwrite or Append Junk Mail Import List (User)","description":"By default, when a new Junk E-mail Filter list is deployed, Outlook appends the new Junk Mail Import List to the existing list. Enable this setting to replace the existing list with the new list, instead of appending to the current list.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_overwriteorappendjunkmailimportlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_overwriteorappendjunkmailimportlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_permanentlydeletejunkemail","displayName":"Permanently delete Junk E-mail (User)","description":"This policy setting determines whether suspected junk e-mail is permanently deleted instead of moved to the Junk E-mail folder.\r\n\r\nIf you enable this policy setting, suspected junk e-mail is immediately deleted and not moved into the Deleted Items folder.\r\n\r\nIf you disable or do not configure this policy setting, suspected junk e-mail is moved into the Junk E-mail folder.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_permanentlydeletejunkemail_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_permanentlydeletejunkemail_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_specifypathtoblockedsenderslist","displayName":"Specify path to Blocked Senders list (User)","description":"Specify a text file containing a list of e-mail addresses to append to or overwrite the Blocked Senders list (depending on the policy \"Overwrite or Append Junk Mail Import List\").","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_specifypathtoblockedsenderslist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_specifypathtoblockedsenderslist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_specifypathtoblockedsenderslist_l_specifyfullpathandfilenametoblockedsenderslist","displayName":"Specify full path and filename to Blocked Senders list (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_specifypathtosaferecipientslist","displayName":"Specify path to Safe Recipients list (User)","description":"Specify a text file containing a list of e-mail addresses to append to or overwrite the Safe Recipients list (depending on the policy \"Overwrite or Append Junk Mail Import List\").","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_specifypathtosaferecipientslist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_specifypathtosaferecipientslist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_specifypathtosaferecipientslist_l_specifyfullpathandfilenametosaferecipientslist","displayName":"Specify full path and filename to Safe Recipients list (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_specifypathtosafesenderslist","displayName":"Specify path to Safe Senders list (User)","description":"Specify a text file containing a list of e-mail addresses to append to or overwrite the Safe Senders list (depending on the policy \"Overwrite or Append Junk Mail Import List\").","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_specifypathtosafesenderslist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_specifypathtosafesenderslist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_specifypathtosafesenderslist_l_specifyfullpathandfilenametosafesenderslist","displayName":"Specify full path and filename to Safe Senders list (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_spoofyemails","displayName":"Hide warnings about suspicious domain names in e-mail addresses (User)","description":"By default, users are warned about suspicious domain names in the e-mail addresses. Use this setting to hide warnings about suspicious domain names in e-mail addreses.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_spoofyemails_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_spoofyemails_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_trustemailfromcontacts","displayName":"Trust e-mail from contacts (User)","description":"This policy setting controls whether Outlook analyzes e-mail from users' Contacts when filtering junk e-mail.\r\n\r\nIf you enable this policy setting, the \"Also trust E-mail from my Contacts\" check box is selected in the Safe Senders tab of the Junk E-mail Options dialog and users cannot change it. E-mail addresses in users' Contacts list are treated as safe senders for purposes of filtering junk e-mail.\r\n\r\nIf you disable this policy setting, e-mail addresses in users' Contacts list are not treated as safe senders for purposes of filtering junk email, and users cannot change this configuration.\r\n\r\nIf you do not configure this policy setting, e-mail messages that are received from people who are listed in Contacts are considered safe by the Junk E-mail Filter, but users can change this configuration.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_trustemailfromcontacts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_trustemailfromcontacts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_disablehithighlighting","displayName":"Do not display hit highlights in search results (User)","description":"By default, hit highlights are included in search results. Enable this setting to turn off search hit highlighting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_disablehithighlighting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_disablehithighlighting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_disablehybridsearch","displayName":"Disable Hybrid Searching (User)","description":"This policy setting controls whether searches in Cached Exchange Mode can also be run on the Exchange server. This policy does not affect either Online Mode or non-Exchange accounts. \r\n\r\nIf you enable this policy setting, Outlook runs searches locally in Cached Exchange Mode and “hybrid” (on the Exchange Server also) modes. It should be noted that if the sync slider is enabled and all mail is not locally cached, you may not see all available results.\r\n\r\nIf you disable or do not configure this policy setting, Outlook first runs searches locally, but then allows the user to search on the Exchange server by clicking “More” link at the bottom of searches, or uses the equivalent ribbon button.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_disablehybridsearch_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_disablehybridsearch_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_disableinstallationprompts","displayName":"Prevent installation prompts when Windows Desktop Search component is not present (User)","description":"This policy setting allows you to prevent a dialog box from being shown when the Windows Desktop Search 4.0 or above system component is not present on the user's computer and removes the other links provided in Outlook to allow users to download the component. The new search functionality in Outlook requires Windows Desktop Search 4.0 or above.\r\n\r\nIf you enable this policy setting, the dialog box is not shown.\r\n\r\nIf you disable or do not configure this policy setting, the dialog box is shown when this system component is not present. Users are prompted with a dialog box when Outlook starts that explains how to download the system component to install on their computers. In addition, other links are provided by default in Outlook to allow users to download the system component. \r\n\r\nNote: If the required Windows system component is not available, the buttons in the Outlook Search ribbon tab will be disabled regardless of how this policy setting is configured.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_disableinstallationprompts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_disableinstallationprompts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_donotincludetheonlinearchiveinallmailitemsearch","displayName":"Do not include the Online Archive in All Mail Item search (User)","description":"This policy sets the default action in All Mail Item search to not include search results from the Online Archive.\r\n\r\nIf you enable this policy setting, search results from the Online Archive will not be included in an All Mail Item search in Outlook.\r\n\r\nIf you disable or do not configure this policy setting, search results from the Online Archive will be included in an All Mail Item search in Outlook.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_donotincludetheonlinearchiveinallmailitemsearch_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_donotincludetheonlinearchiveinallmailitemsearch_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor","displayName":"Change color used to highlight search matches (User)","description":"By default, search matches are highlighted in yellow. This setting allows you to change the color used for highlighting matches in search results.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_l_backgroundcolorcolon","displayName":"Background Color: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_l_backgroundcolorcolon_000000","displayName":"Black","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_l_backgroundcolorcolon_12632256","displayName":"Silver","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_l_backgroundcolorcolon_8421504","displayName":"Gray","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_l_backgroundcolorcolon_16777215","displayName":"White","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_l_backgroundcolorcolon_65535","displayName":"Aqua","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_l_backgroundcolorcolon_16711808","displayName":"Fuchsia","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_l_backgroundcolorcolon_8453888","displayName":"Lime","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_l_backgroundcolorcolon_16776960","displayName":"Yellow","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_l_backgroundcolorcolon_8421376","displayName":"Olive","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_l_backgroundcolorcolon_8388736","displayName":"Purple","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_l_backgroundcolorcolon_32768","displayName":"Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_l_backgroundcolorcolon_16711680","displayName":"Red","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_l_backgroundcolorcolon_8388608","displayName":"Maroon","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_l_backgroundcolorcolon_128","displayName":"Navy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_l_backgroundcolorcolon_32896","displayName":"Teal","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_hithighlightingcolor_l_backgroundcolorcolon_255","displayName":"Blue","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_preventclearsignedmessageandattachmentindexing","displayName":"Prevent clear signed message and attachment indexing (User)","description":"This policy setting allows you to turn off the indexing of the body and attachments of clear-text signed messages. The sender, subject line, and date will continue to be indexed and searchable. \r\n\r\nIf you enable this policy setting, indexing of clear-text signed messages will be turned off.\r\n\r\nIf you disable or do not configure this policy setting, clear-text signed messages will be indexed and searchable.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_preventclearsignedmessageandattachmentindexing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_preventclearsignedmessageandattachmentindexing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_setdefaultsearchscope","displayName":"Set default search scope (User)","description":"This policy allows you to specify the default search scope to be used. Users will not be able to change the default once this policy is set, but they can change the scope while running a search.\r\n \r\nIf you enable this policy, you can specify the folders that Outlook searches by default when the user begins a new search.\r\n \r\nIf you disable or do not configure this policy, Outlook searches all folders in the current mailbox when the search is initiated from the Inbox. If the search is initiated from another folder, the search only includes items from that folder. Users can still change the scope when searching.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_setdefaultsearchscope_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_setdefaultsearchscope_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_setdefaultsearchscope_l_setdefaultsearchscopedropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_setdefaultsearchscope_l_setdefaultsearchscopedropid_0","displayName":"Default behavior (see explanation)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_setdefaultsearchscope_l_setdefaultsearchscopedropid_1","displayName":"\"All Mailboxes\" on all folders","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_setdefaultsearchscope_l_setdefaultsearchscopedropid_2","displayName":"\"Current Folder\" on all folders","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_setdefaultsearchscope_l_setdefaultsearchscopedropid_3","displayName":"\"Current Mailbox\" on all folders","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_turnoffautomaticsearchindexreconciliation","displayName":"Turn off automatic search index reconciliation (User)","description":"This policy setting configures the automatic verification of the integrity of Outlook's search index every 72 hours.\r\n\r\nIf you enable this policy setting, automatic reconciliation will be turned off.\r\n\r\nIf you disable or do not configure this policy setting, Outlook will reconcile its index every 72 hours.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_turnoffautomaticsearchindexreconciliation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_turnoffautomaticsearchindexreconciliation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_turnoffwordwheel","displayName":"Do not display search results as the user types (User)","description":"By default, search results are displayed as the user types a search query. This functionality (known as WordWheeling) can be turned off by enabling this setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_turnoffwordwheel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_searchoptions_l_turnoffwordwheel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_righttoleft_l_layoutoptions","displayName":"Layout Options (User)","description":"Sets the value in the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_righttoleft_l_layoutoptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_righttoleft_l_layoutoptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_righttoleft_l_layoutoptions_l_setglobaltextdirection","displayName":"Set global text direction: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_righttoleft_l_layoutoptions_l_setglobaltextdirection_0","displayName":"Context-based","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_righttoleft_l_layoutoptions_l_setglobaltextdirection_1","displayName":"Left to right","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_righttoleft_l_layoutoptions_l_setglobaltextdirection_2","displayName":"Right-to-left","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_righttoleft_l_layoutoptions_l_setlayoutdirection","displayName":"Set layout direction: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_righttoleft_l_layoutoptions_l_setlayoutdirection_0","displayName":"Left to Right","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_righttoleft_l_layoutoptions_l_setlayoutdirection_1","displayName":"Right to Left","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_spelling_l_general","displayName":"General (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_spelling_l_general_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_spelling_l_general_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_spelling_l_general_l_alwayscheckspellingbeforesending","displayName":"Always check spelling before sending (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_spelling_l_general_l_alwayscheckspellingbeforesending_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_spelling_l_general_l_alwayscheckspellingbeforesending_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_spelling_l_general_l_ignoreoriginalmessagetextinreplyorforward","displayName":"Ignore original message text in reply or forward (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_spelling_l_general_l_ignoreoriginalmessagetextinreplyorforward_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlookoptions~l_spelling_l_general_l_ignoreoriginalmessagetextinreplyorforward_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_blockglobaladdresslistsynchronization","displayName":"Block Global Address List synchronization (User)","description":"This policy setting allows you to block the synchronization of contacts between Outlook and the Global Address List (GAL).\r\n\r\nIf you enable this policy setting, GAL contact synchronization is blocked.\r\n\r\nIf you disable or you do not configure this policy setting, GAL contact synchronization is allowed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_blockglobaladdresslistsynchronization_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_blockglobaladdresslistsynchronization_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_blocknetworkactivitysynchronization","displayName":"Block network activity synchronization (User)","description":"This policy setting allows you to block synchronization of status updates between Outlook and social networks.\r\n\r\nIf you enable this policy setting, social network activity synchronization is blocked.\r\n\r\nIf you disable or you do not configure this policy setting, social network activity synchronization is allowed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_blocknetworkactivitysynchronization_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_blocknetworkactivitysynchronization_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_blocksocialnetworkcontactsynchronization","displayName":"Block social network contact synchronization (User)","description":"This policy setting allows you to block synchronization of contacts between Outlook and social networks. \r\n\r\nIf you enable this policy setting, social network contact synchronization is blocked.\r\n\r\nIf you disable or you do not configure this policy setting, social network contact synchronization is allowed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_blocksocialnetworkcontactsynchronization_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_blocksocialnetworkcontactsynchronization_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_blockspecificsocialnetworkproviders","displayName":"Block specific social network providers (User)","description":"This policy setting allows you to specify the list of social network providers that will never be loaded by the Outlook Social Connector. \r\n\r\nIf you enable this policy setting, social network providers added to the list will never be loaded by the Outlook Social Connector. This list needs to be semi-colon delimited. \r\n\r\nIf you disable or you do not configure this policy setting, the Outlook Social Connector can load any provider specified by the user.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_blockspecificsocialnetworkproviders_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_blockspecificsocialnetworkproviders_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_blockspecificsocialnetworkproviders_l_blockspecificsocialnetworkprovidersid","displayName":"Separate ProgIDs with semi-colons (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_donotallowondemandactivitysynchronization","displayName":"Do not allow on-demand activity synchronization (User)","description":"This policy setting allows you to prevent on-demand synchronization of activity information between Outlook and social networks.\r\n\r\nIf you enable this policy setting, on-demand synchronization is blocked. \r\n\r\nIf you disable or you do not configure this policy setting, on-demand synchronization is allowed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_donotallowondemandactivitysynchronization_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_donotallowondemandactivitysynchronization_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_donotdownloadphotosfromactivedirectory","displayName":"Do not download photos from Active Directory (User)","description":"This policy setting controls whether contact photos are downloaded from the Active Directory.\r\n\r\nIf you enable this policy setting, contact photos are not downloaded. \r\n\r\nIf you disable or you do not configure this policy setting, contact photos are downloaded.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_donotdownloadphotosfromactivedirectory_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_donotdownloadphotosfromactivedirectory_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_donotshowsocialnetworkinfobars","displayName":"Do not show social network info-bars (User)","description":"This policy setting controls whether certain info-bar messages that will prompt users to install social network providers are displayed in the social connector. \r\n\r\nIf you enable this policy setting, the info-bars are not shown.\r\n\r\nIf you disable or you do not configure this policy setting, the info-bars are shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_donotshowsocialnetworkinfobars_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_donotshowsocialnetworkinfobars_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_preventsocialnetworkconnectivity","displayName":"Disable Office connections to social networks (User)","description":"This policy setting prevents users from connecting Office to social networks (including SharePoint), and prevents Office from displaying contacts and feeds from their social networks.\r\n\r\nIf you enable this policy setting, users cannot connect Office to social networks.\r\n\r\nIf you disable or you do not configure this policy setting, users can connect Office to social networks.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_preventsocialnetworkconnectivity_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_preventsocialnetworkconnectivity_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_setgalcontactsynchronizationinterval","displayName":"Set GAL contact synchronization interval (User)","description":"This policy setting controls how often contact information is synchronized between Outlook and connected social networks (in minutes). \r\n\r\nIf you enable this policy setting, you may specify the specified interval (in minutes) in which contact information is synchronized.\r\n\r\nIf you disable or you do not configure this policy setting, contact information is synchronized at the default interval (once every 4 days, or 5760 minutes).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_setgalcontactsynchronizationinterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_setgalcontactsynchronizationinterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_setgalcontactsynchronizationinterval_l_setgalcontactsynchronizationintervalspinid","displayName":"Synchronization interval (in minutes): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_specifyactivityfeedsynchronizationinterval","displayName":"Specify activity feed synchronization interval (User)","description":"This policy setting specifies the minimum interval that Office waits before requesting activity feed information from social networks for a given contact.\r\n\r\nIf you enable this policy setting, Office waits for at least the specified interval before requesting a new activity feed for each contact.\r\n\r\nIf you disable or do not configure this policy setting, Office waits for at least the default interval (60 minutes) before requesting a new activity feed for each contact.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_specifyactivityfeedsynchronizationinterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_specifyactivityfeedsynchronizationinterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_specifyactivityfeedsynchronizationinterval_l_specifyactivityfeedsynchronizationintervalspinid","displayName":"Synchronization interval (in minutes): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_specifylistofsocialnetworkproviderstoload","displayName":"Specify list of social network providers to load (User)","description":"This policy setting determines the list of social network providers that are loaded by the Outlook Social Connector.\r\n\r\nIf you enable this policy setting, you may enter a list of provider progIDs of social network providers that will be loaded by the Outlook Social Connector. This list needs to be semi-colon delimited. Note that if you enable this policy setting, only social network providers that are on this list will be loaded by the Outlook Social Connector. No other social network providers will be loaded.\r\n\r\nIf you disable or you do not configure this policy setting, the Outlook Social Connector can load any provider specified by the user.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_specifylistofsocialnetworkproviderstoload_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_specifylistofsocialnetworkproviderstoload_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_specifylistofsocialnetworkproviderstoload_l_specifylistofsocialnetworkproviderstoloadid","displayName":"Separate ProgIDs with semi-colons (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_turnoffoutlooksocialconnector","displayName":"Turn off Outlook Social Connector (User)","description":"This policy setting allows you to turn off the Outlook Social Connector.\r\n\r\nIf you enable this policy setting, the Outlook Social Connector is turned off.\r\n\r\nIf you disable or you do not configure this policy setting, the Outlook Social Connector is turned on.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_turnoffoutlooksocialconnector_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooksocialconnector_l_turnoffoutlooksocialconnector_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooktodaysettings_l_outlooktodayavailability","displayName":"Outlook Today availability (User)","description":"Checked: Displays the customizable Outlook Today page. | Unchecked: Displays a standard folder view in place of Outlook Today.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooktodaysettings_l_outlooktodayavailability_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooktodaysettings_l_outlooktodayavailability_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooktodaysettings_l_urlforcustomoutlooktoday","displayName":"URL for custom Outlook Today (User)","description":"Specifies the URL of a custom web page to be displayed in place of Outlook Today.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooktodaysettings_l_urlforcustomoutlooktoday_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooktodaysettings_l_urlforcustomoutlooktoday_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_outlooktodaysettings_l_urlforcustomoutlooktoday_l_entertheurlofoutlooktodayswebpagemax129chars","displayName":"Enter the URL of Outlook Today's web page (max 129 chars): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_searchfolders_l_keepsearchfoldersinexchangeonline","displayName":"Keep Search Folders in Exchange online (User)","description":"This policy setting allows you to specify the number of days to keep a Search Folder active when running in online mode. After a Search Folder has not been accessed for the specified number of days, it becomes dormant and no longer remains up-to-date with current contents of folders (viewing the Search Folder makes it active again and restarts the timer).\r\n\r\nIf you enable this policy setting, you may specify the number of days to keep a Search Folder active when running in online mode.\r\n\r\nIf you disable or do not configure this policy setting, then Search Folders always remain dormant.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_searchfolders_l_keepsearchfoldersinexchangeonline_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_searchfolders_l_keepsearchfoldersinexchangeonline_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_searchfolders_l_keepsearchfoldersinexchangeonline_l_specifydaystokeepfoldersaliveinexchangeonlinemode","displayName":"Specify days to keep folders alive in Exchange online mode: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_searchfolders_l_keepsearchfoldersoffline","displayName":"Keep Search Folders offline (User)","description":"This policy setting allows you to specify the number of days to keep a Search Folder active when running in offline or cached mode. After a Search Folder has not been accessed for the specified number of days, it becomes dormant and no longer remains up-to-date with current contents of folders (viewing the Search Folder makes it active again and restarts the timer).\r\n\r\nIf you enable this policy setting, you may specify the number of days to keep a Search Folder active when running in offline mode.\r\n\r\nIf you disable or do not configure this policy setting, then Search Folders always remain dormant.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_searchfolders_l_keepsearchfoldersoffline_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_searchfolders_l_keepsearchfoldersoffline_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_searchfolders_l_keepsearchfoldersoffline_l_specifydaystokeepfoldersaliveinofflineorcachedmode","displayName":"Specify days to keep folders alive in offline or cached mode: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_searchfolders_l_maximumnumberofonlinesearchfolderspermailbox","displayName":"Maximum Number of Online Search Folders per mailbox (User)","description":"Specifies the maximum number of Search Folders that run on the Exchange server. The number of Search Folders running on the client computer is not affected.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_searchfolders_l_maximumnumberofonlinesearchfolderspermailbox_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_searchfolders_l_maximumnumberofonlinesearchfolderspermailbox_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_searchfolders_l_maximumnumberofonlinesearchfolderspermailbox_l_specifymaximumnumberofsearchfolders2","displayName":"Maximum number of Search Folders: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_allowactivexoneoffforms","displayName":"Allow Active X One Off Forms (User) (Deprecated)","description":"By default, third-party ActiveX controls are not allowed to run in one-off forms in Outlook. You can change this behavior so that Safe Controls (Microsoft Forms 2.0 controls and the Outlook Recipient and Body controls) are allowed in one-off forms, or so that all ActiveX controls are allowed to run.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_allowactivexoneoffforms_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_allowactivexoneoffforms_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_allowactivexoneoffforms_l_empty29","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_allowactivexoneoffforms_l_empty29_0","displayName":"Load only Outlook Controls","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_allowactivexoneoffforms_l_empty29_1","displayName":"Allows only Safe Controls","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_allowactivexoneoffforms_l_empty29_2","displayName":"Allows all ActiveX Controls","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_allowactivexoneoffforms_v2","displayName":"Allow Active X One Off Forms (User)","description":"By default, third-party ActiveX controls are not allowed to run in one-off forms in Outlook. You can change this behavior so that Safe Controls (Microsoft Forms 2.0 controls and the Outlook Recipient and Body controls) are allowed in one-off forms, or so that all ActiveX controls are allowed to run.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_allowactivexoneoffforms_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_allowactivexoneoffforms_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_allowactivexoneoffforms_v2_l_empty29","displayName":"\r\nSets which ActiveX controls to allow.\r\n","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_allowactivexoneoffforms_v2_l_empty29_0","displayName":"Load only Outlook Controls","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_allowactivexoneoffforms_v2_l_empty29_1","displayName":"Allows only Safe Controls","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_allowactivexoneoffforms_v2_l_empty29_2","displayName":"Allows all ActiveX Controls","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_configureaddintrustlevel","displayName":"Configure Add-In Trust Level (User)","description":"All installed trusted COM addins can be trusted. Exchange Settings for the addins still override if present and this option is selected.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_configureaddintrustlevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_configureaddintrustlevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_configureaddintrustlevel_l_empty28","displayName":"\r\nSelect Add-In Trust Level:\r\n","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_configureaddintrustlevel_l_empty28_0","displayName":"Trust all, or use Exchange settings if present","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_configureaddintrustlevel_l_empty28_1","displayName":"Trust all loaded and installed COM addins","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_configureaddintrustlevel_l_empty28_2","displayName":"Do NOT trust loaded and installed COM addins","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_disablerememberpasswordcheckboxforinternetemailsettingsdialo","displayName":"Disable 'Remember password' for Internet e-mail accounts (User)","description":"Use this option to hide your user's ability to cache passwords locally in the computer's registry. When configured, this policy will hide the 'Remember Password' checkbox and not allow users to have Outlook remember their password. \r\n\r\nNote that POP3, IMAP, and HTTP e-mail accounts are all considered Internet e-mail accounts in Outlook. E-mail account options are listed on the Server Type dialog box when users choose 'New' under Tools | Account Settings.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_disablerememberpasswordcheckboxforinternetemailsettingsdialo_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_disablerememberpasswordcheckboxforinternetemailsettingsdialo_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_donotautomaticallysignreplies","displayName":"Do not automatically sign replies (User)","description":"This policy setting allows you to specify whether replies will be automatically signed.\r\n\r\nIf you enable this policy setting, the option to respond automatically to a signed message with a signed response will be overridden, and an unsigned response will be the default reply to a signed message.\r\n\r\nIf you disable or do not configure this policy setting, a signed response will be the default reply to a signed message.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_donotautomaticallysignreplies_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_donotautomaticallysignreplies_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_preventusersfromcustomizingattachmentsecuritysettings","displayName":"Prevent users from customizing attachment security settings (User) (Deprecated)","description":"This policy setting prevents users from overriding the set of attachments blocked by Outlook.\r\n\r\nIf you enable this policy setting users will be prevented from overriding the set of attachments blocked by Outlook. Outlook also checks the \"Level1Remove\" registry key when this setting is specified. \r\n\r\nIf you disable or do not configure this policy setting, users will be allowed to override the set of attachments blocked by Outlook.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_preventusersfromcustomizingattachmentsecuritysettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_preventusersfromcustomizingattachmentsecuritysettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_preventusersfromcustomizingattachmentsecuritysettings_v2","displayName":"Prevent users from customizing attachment security settings (User)","description":"This policy setting prevents users from overriding the set of attachments blocked by Outlook.\r\n\r\nIf you enable this policy setting users will be prevented from overriding the set of attachments blocked by Outlook. Outlook also checks the \"Level1Remove\" registry key when this setting is specified. \r\n\r\nIf you disable or do not configure this policy setting, users will be allowed to override the set of attachments blocked by Outlook.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_preventusersfromcustomizingattachmentsecuritysettings_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_preventusersfromcustomizingattachmentsecuritysettings_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_promptusertochoosesecuritysettingsifdefaultsettingsfail","displayName":"Prompt user to choose security settings if default settings fail (User)","description":"Check to prompt the user to choose security settings if default settings fail; uncheck to automatically select.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_promptusertochoosesecuritysettingsifdefaultsettingsfail_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_promptusertochoosesecuritysettingsifdefaultsettingsfail_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_turnoffcontactexport","displayName":"Turn off contact export (User)","description":"This policy setting controls the ability of users to export contact information from the address book.\r\n\r\nIf you enable this policy setting, the \"Add to Contacts\" menu is not configurable in the address book.\r\n\r\nIf you disable or do not configure this policy setting, the \"Add to Contacts\" menu is configurable.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_turnoffcontactexport_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_turnoffcontactexport_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_useprotectedviewforattachmentsreceivedfrominternalsenders","displayName":"Use Protected View for attachments received from internal senders (User)","description":"This policy setting allows you to determine if attachments received from senders within your organization open in Protected View. This setting only applies to Outlook accounts setup to use an Exchange server.\r\n\r\nIf you enable this policy setting, attachments received from senders within your organization open in Protected View.\r\n\r\nIf you disable or do not configure this policy setting, attachments received from senders within your organization do not open in Protected View.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_useprotectedviewforattachmentsreceivedfrominternalsenders_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security_l_useprotectedviewforattachmentsreceivedfrominternalsenders_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_blockexternalcontent","displayName":"Display pictures and external content in HTML e-mail (User)","description":"This policy setting setting controls whether Outlook downloads untrusted pictures and external content located in HTML e-mail messages without users explicitly choosing to download them. \r\n\r\nIf you enable this policy setting, Outlook will not automatically download content from external servers unless the sender is included in the Safe Senders list. Recipients can choose to download external content from untrusted senders on a message-by-message basis. \r\n\r\nIf you disable this policy setting, Outlook will display pictures and external content in HTML e-mail automatically.\r\n\r\nIf you do not configure this policy setting, Outlook does not download external content in HTML e-mail and RSS items unless the content is considered safe. Content that Outlook can be configured to consider safe includes: \r\n\r\n- Content in e-mail messages from senders and to recipients defined in the Safe Senders and Safe Recipients lists. \r\n- Content from Web sites in Internet Explorer's Trusted Sites security zone. \r\n- Content in RSS items. \r\n- Content from SharePoint Discussion Boards. Users can control what content is considered safe by changing the options in the \"Automatic Download\" section of the Trust Center. If Outlook's default blocking configuration is overridden, in the Trust Center or by some other method, Outlook will display external content in all HTML e-mail messages, including any that include Web beacons.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_blockexternalcontent_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_blockexternalcontent_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_blockinternet","displayName":"Include Internet in Safe Zones for Automatic Picture Download (User) (Deprecated)","description":"This policy setting controls whether pictures and external content in HTML e-mail messages from untrusted senders on the Internet are downloaded without Outlook users explicitly choosing to do so. \r\n\r\nIf you enable this policy setting, Outlook will automatically download external content in all e-mail messages sent over the Internet and users will not be able to change the setting. \r\n\r\nIf you disable or do not configure this policy setting, Outlook does not consider the Internet a safe zone, which means that Outlook will not automatically download content from external servers unless the sender is included in the Safe Senders list. Recipients can choose to download external content from untrusted senders on a message-by-message basis.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_blockinternet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_blockinternet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_blockinternet_v2","displayName":"Include Internet in Safe Zones for Automatic Picture Download (User)","description":"This policy setting controls whether pictures and external content in HTML e-mail messages from untrusted senders on the Internet are downloaded without Outlook users explicitly choosing to do so. \r\n\r\nIf you enable this policy setting, Outlook will automatically download external content in all e-mail messages sent over the Internet and users will not be able to change the setting. \r\n\r\nIf you disable or do not configure this policy setting, Outlook does not consider the Internet a safe zone, which means that Outlook will not automatically download content from external servers unless the sender is included in the Safe Senders list. Recipients can choose to download external content from untrusted senders on a message-by-message basis.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_blockinternet_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_blockinternet_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_blockintranet","displayName":"Include Intranet in Safe Zones for Automatic Picture Download (User)","description":"This policy setting controls whether pictures and external content in HTML e-mail messages from untrusted senders on the local intranet are downloaded without Outlook users explictly choosing to do so. \r\n\r\nIf you enable this policy setting, Outlook will automatically download external content in all e-mail messages sent over the local intranet and users will not be able to change the setting. \r\n\r\nIf you disable or do not configure this policy setting, Outlook does not consider the local intranet a safe zone, which means that Outlook will not automatically download content from other servers in the Local Intranet zone unless the sender is included in the Safe Senders list. Recipients can choose to download external content from untrusted senders on a message-by-message basis.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_blockintranet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_blockintranet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_blocktrustedzones","displayName":"Block Trusted Zones (User)","description":"This policy setting controls whether pictures from sites in the Trusted Sites security zone are automatically downloaded in Outlook e-mail messages and other items. \r\n\r\nIf you enable this policy setting, Outlook does not automatically download content from Web sites in the Trusted sites zone in Internet Explorer. Recipients can choose to download external content on a message-by-message basis. \r\n\r\nIf you disable or do not configure this policy setting, Outlook automatically downloads content from Web sites in the Trusted sites zone in Internet Explorer.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_blocktrustedzones_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_blocktrustedzones_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_permitdownloadofcontentfromsafesenderandrecipientlists","displayName":"Automatically download content for e-mail from people in Safe Senders and Safe Recipients Lists (User)","description":"This policy setting controls whether Outlook automatically downloads external content in e-mail from senders in the Safe Senders List or Safe Recipients List. \r\n\r\nIf you enable this policy setting, Outlook automatically downloads content for e-mail from people in Safe Senders and Safe Recipients lists. \r\n\r\nIf you disable this policy setting, Outlook will not automatically download content from external servers for messages sent by people listed in users' Safe Senders Lists or Safe Recipients Lists. Recipients can choose to download external content on a message-by-message basis. \r\n\r\nIf you do not configure this policy setting, downloads are permitted when users receive e-mail from people listed in the user's Safe Senders List or Safe Recipients List.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_permitdownloadofcontentfromsafesenderandrecipientlists_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_permitdownloadofcontentfromsafesenderandrecipientlists_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_permitdownloadofcontentfromsafezones","displayName":"Do not permit download of content from safe zones (User)","description":"This policy setting controls whether Outlook automatically downloads content from safe zones when displaying messages. \r\n\r\nIf you enable this policy setting content from safe zones will be downloaded automatically. \r\n\r\nIf you disable this policy Outlook will not automatically download content from safe zones. Recipients can choose to download external content from untrusted senders on a message-by-message basis. \r\n\r\nIf you do not configure this policy setting, Outlook automatically downloads content from sites that are considered \"safe,\" as defined in the Security tab of the Internet Options dialog box in Internet Explorer. \r\n\r\nImportant - Note that this policy setting is \"backward.\" Despite the name, disabling the policy setting prevents the download of content from safe zones and enabling the policy setting allows it.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_permitdownloadofcontentfromsafezones_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_automaticpicturedownloadsettings_l_permitdownloadofcontentfromsafezones_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_disablecontinuebuttononallencryptionwarningdialogs","displayName":"Do not provide Continue option on Encryption warning dialog boxes (User)","description":"This setting controls whether Outlook users are allowed to send e-mail messages after they see an encryption warning. \r\n\r\nIf you enable this policy setting, encryption warning dialog boxes do not contain a Continue button, which means that users must cancel the sending operation entirely. \r\n\r\nIf you disable or do not configure this policy setting, if Outlook users see an encryption-related dialog box when attempting to send a message, they can choose to dismiss the warning and send the message anyway.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_disablecontinuebuttononallencryptionwarningdialogs_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_disablecontinuebuttononallencryptionwarningdialogs_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_disablepublishtogalbutton","displayName":"Do not display 'Publish to GAL' button (User)","description":"This policy setting controls whether Outlook users can publish e-mail certificates to the Global Address List (GAL). \r\n\r\nIf you enable this policy setting, the \"Publish to GAL\" button does not display in the \"E-mail Security\" section of the Trust Center. \r\n\r\nIf you disable or do not configure this policy setting, Outlook users can publish their e-mail certificates to the GAL through the \"E-mail Security\" section of the Trust Center.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_disablepublishtogalbutton_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_disablepublishtogalbutton_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_donotcheckemailaddressagainstaddressofcertificatesbeingusing","displayName":"Do not check e-mail address against address of certificates being used (User)","description":"This policy setting controls whether Outlook verifies the user's e-mail address with the address associated with the certificate used for signing.\r\n\r\nIf you enable this policy setting, users can send messages signed with certificates that do not match their e-mail addresses.\r\n\r\nIf you disable or do not configure this policy setting, Outlook verifies that the user's e-mail address matches the certificate being used for signing.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_donotcheckemailaddressagainstaddressofcertificatesbeingusing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_donotcheckemailaddressagainstaddressofcertificatesbeingusing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_enableaiacertevaluation","displayName":"Enable Retrieval of Remote Certificate Authority Information (User)","description":"This policy setting controls whether Outlook will use remote certificate authority information in a secure email message to validate that its certificate is trusted. \r\n\r\nIf you enable this setting, you’ll allow the operating system to access remote network locations specified in a certificate for validation.\r\n\r\nIf you disable or don’t configure this setting, retrieval of remote Certificate Authority Information won’t be allowed, and only stored certificates will be used for authentication.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_enableaiacertevaluation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_enableaiacertevaluation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_enablecryptographyicons","displayName":"Enable Cryptography Icons (User)","description":"Sets the value for the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_enablecryptographyicons_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_enablecryptographyicons_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_encryptallemailmessages","displayName":"Encrypt all e-mail messages (User)","description":"This policy setting allows you to require that all e-mail messages be encrypted when sent from Outlook.\r\n\r\nIf you enable this policy setting, the Encrypt button is automatically selected on all outgoing e-mail messages, meeting invitations, and other Outlook items. Users must select an appropriate certificate to encrypt the message for the intended recipient.\r\n\r\nIf you disable or do not configure this policy setting, outgoing e-mail messages are not encrypted. If you disable this policy setting, users will not be able to change the configuration.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_encryptallemailmessages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_encryptallemailmessages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_ensureallsmimesignedmessageshavealabel","displayName":"Ensure all S/MIME signed messages have a label (User)","description":"This policy setting controls whether Outlook requires labels on S/MIME signed messages.\r\n\r\nIf you enable this policy setting, labels must be attached to all Outlook S/MIME messages before they are sent. Users can attach labels to messages in the \"Message Options\" dialog box by clicking \"Security Settings,\" ensuring that the \"Add digital signature to this message\" check box is selected, and selecting a label under \"Security Label.\"\r\n\r\nIf you disable all S/MIME signed messages are not required to have a label, and users cannot change this functionality.\r\n\r\nIf you do not configure this policy setting, all S/MIME signed messages are not required to have a label, but users can change this functionality through the \"Message Options\" dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_ensureallsmimesignedmessageshavealabel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_ensureallsmimesignedmessageshavealabel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_fortezzacertificatepolicies","displayName":"Fortezza certificate policies (User)","description":"This policy setting specifies a list of policies allowed in the policies extension of a certificate that indicate the certificate is a Fortezza certificate. Fortezza is a hardware--based encryption standard created by the National Security Agency (NSA), a division of the United States Department of Defense. To be valid for use with Fortezza, a certificate must include an appropriate policy in the certificate's policies extension. \r\n\r\nIf you enable this policy setting, you can enter a list of policies in the supplied text box that can be used to indicate that a certificate is a Fortezza certificate. The list should be separated by semi-colons. For example: policy1;policy2;policy3. \r\n\r\nIf you disable or so nor configure this policy setting, a list of Fortezza certificate policies are not listed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_fortezzacertificatepolicies_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_fortezzacertificatepolicies_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_fortezzacertificatepolicies_l_enterlistofpoliciesthatcanbeinthepoliciesextension2","displayName":"List of policies to indicate that a certificate is a Fortezza certificate (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_messageformats","displayName":"Message Formats (User)","description":"This policy setting controls which message encryption formats Outlook can use. Outlook supports three formats for encrypting and signing messages: S/MIME, Exchange, and Fortezza.\r\n\r\nIf you enable this policy setting, you can specify whether Outlook can use S/MIME (the default), Exchange, or Fortezza encryption, or any combination of any of these options. Users will not be able to change this configuration.\r\n\r\nIf you disable or do not configure this policy setting, Outlook only uses S/MIME to encrypt and sign messages. If you disable this policy setting, users will not be able to change this configuration.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_messageformats_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_messageformats_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_messageformats_l_supportthefollowingmessageformats","displayName":"Support the following message formats: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_messageformats_l_supportthefollowingmessageformats_1","displayName":"S/MIME","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_messageformats_l_supportthefollowingmessageformats_2","displayName":"Exchange","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_messageformats_l_supportthefollowingmessageformats_20","displayName":"Fortezza","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_messageformats_l_supportthefollowingmessageformats_3","displayName":"S/MIME and Exchange","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_messageformats_l_supportthefollowingmessageformats_21","displayName":"S/MIME and Fortezza","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_messageformats_l_supportthefollowingmessageformats_22","displayName":"Exchange and Fortezza","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_messageformats_l_supportthefollowingmessageformats_23","displayName":"S/MIME, Exchange, and Fortezza","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_messagewhenoutlookcannotfindthedigitalidtodecodeamessage","displayName":"Message when Outlook cannot find the digital ID to decode a message (User)","description":"Sets the value for the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_messagewhenoutlookcannotfindthedigitalidtodecodeamessage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_messagewhenoutlookcannotfindthedigitalidtodecodeamessage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_messagewhenoutlookcannotfindthedigitalidtodecodeamessage_l_entererrormessagetextmax255characters","displayName":"Enter error message text (max 255 characters): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_minimumencryptionsettings","displayName":"Minimum encryption settings (User) (Deprecated)","description":"This policy setting allows you to set the minimum key length for an encrypted e-mail message.\r\n\r\nIf you enable this policy setting, you may set the minimum key length for an encrypted e-mail message. Outlook will display a warning dialog if the user tries to send a message using an encryption key that is below the minimum encryption key value set. The user can still choose to ignore the warning and send using the encryption key originally chosen.\r\n\r\nIf you disable or do not configure this policy setting, a dialog warning will be shown to the user if the user attempts to send a message using encryption. The user can still choose to ignore the warning and send using the encryption key originally chosen.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_minimumencryptionsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_minimumencryptionsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_minimumencryptionsettings_l_minimumkeysizeinbits","displayName":"Minimum key size (in bits): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_minimumencryptionsettings_v2","displayName":"Minimum encryption settings (User)","description":"This policy setting allows you to set the minimum key length for an encrypted e-mail message.\r\n\r\nIf you enable this policy setting, you may set the minimum key length for an encrypted e-mail message. Outlook will display a warning dialog if the user tries to send a message using an encryption key that is below the minimum encryption key value set. The user can still choose to ignore the warning and send using the encryption key originally chosen.\r\n\r\nIf you disable or do not configure this policy setting, a dialog warning will be shown to the user if the user attempts to send a message using encryption. The user can still choose to ignore the warning and send using the encryption key originally chosen.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_minimumencryptionsettings_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_minimumencryptionsettings_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_minimumencryptionsettings_v2_l_minimumkeysizeinbits","displayName":"Minimum key size (in bits): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_outlooktnefinsmimemessages","displayName":"Always use TNEF formatting in S/MIME messages (User)","description":"This policy setting allows you to specify the formatting when sending S/MIME messages.\r\n\r\nIf you enable this policy setting, Outlook always uses TNEF formatting when sending S/MIME messages.\r\n\r\nIf you disable or do not configure this policy setting, Outlook uses the format specified by the user when sending e-mail messages, including when sending S/MIME messages.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_outlooktnefinsmimemessages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_outlooktnefinsmimemessages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_repliesorforwardstosignedencryptedmessagesaresignedencrypted","displayName":"Replies or forwards to signed/encrypted messages are signed/encrypted (User)","description":"This policy setting controls whether replies and forwards to signed/encrypted mail should also be signed/encrypted. \r\n\r\nIf you enable this policy setting, signing/encryption will be turned on when replying/forwarding a signed or encrypted message, even if the user is not configured for SMIME.\r\n\r\nIf you disable or do not configure this policy setting, signing/encryption is not enforced.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_repliesorforwardstosignedencryptedmessagesaresignedencrypted_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_repliesorforwardstosignedencryptedmessagesaresignedencrypted_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_requestansmimereceiptforallsmimesignedmessages","displayName":"Request an S/MIME receipt for all S/MIME signed messages (User)","description":"This policy setting controls whether Outlook sends S/MIME receipt requests with S/MIME signed messages.\r\n\r\nIf you enable this policy setting, Outlook requests S/MIME receipts whenever it sends S/MIME signed messages and users cannot change this setting.\r\n\r\nIf you disable or do not configure this policy setting, Outlook does not send S/MIME receipt requests with signed messages, but users can still include receipt requests with individual messages. If you disable this policy setting, users cannot change this functionality, but if you do not configure this policy setting, users can enable the option in the \"E-mail Security\" section of the Trust Center or the \"Security Properties\" dialog for individual messages.\r\n\r\nImportant: When the \"Sign all e-mail messages\" policy setting is enabled, enabling this policy setting can place significant stress on the e-mail infrastructure. Consider your needs and capabilities before enabling both settings.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_requestansmimereceiptforallsmimesignedmessages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_requestansmimereceiptforallsmimesignedmessages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_requiredcertificateauthority","displayName":"Required Certificate Authority (User)","description":"This policy setting enables you to designate a required certificate authority for Outlook to use for encryption and digital signatures.\r\n\r\nIf you enable this policy setting, you can specify a required certificate authority by entering an X.509 distinguished name in the text field that is provided. The name must conform to the X.509 certificate format exactly. For example:\r\n\r\nCN=WoodgroveBankCA, DC=WoodgroveBank, DC=com\r\n\r\nIf you disable or do not configure this policy setting, Outlook trusts any certificate authorities that are represented by certificates in the Trusted Root Certification Authorities store on users' computers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_requiredcertificateauthority_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_requiredcertificateauthority_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_requiredcertificateauthority_l_x509issuednthatrestrictschoiceofcertifyingauthorities","displayName":"X.509 issue DN that restricts choice of certifying authorities: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_requiresuitebalgorithmsforsmimeoperations","displayName":"Require SuiteB algorithms for S/MIME operations (User)","description":"This policy setting determines whether Outlook is required to use NSA Suite B algorithms for S/MIME operations. Outlook implements Suite B, a set of cryptographic algorithms for symmetric encryption, hashing, digital signatures, and key exchange announced in 2005 by the National Security Agency (NSA), a division of the United States Department of Defense. The Suite B protocols can be used to meet U.S. government standards for handling both classified and unclassified information. \r\n\r\nIf you enable this policy setting, Outlook uses only Suite B algorithms for S/MIME operations. The Suite B algorithms are as follows: \r\n\r\n- Symmetric encryption. Advanced Encryption Standard (AES) with key sizes of 128 and 256 bits. \r\n\r\n- Message digest. Secure Hash Algorithm (SHA-256 and SHA-384). \r\n\r\n- Key agreement. Elliptic-Curve Menezes-Qu-Vanstone (ECMQV); Elliptic Curve Diffie-Hellman (ECDH). \r\n\r\n- Digital Signatures. Elliptic-Curve Digital Signature Algorithm (ECDSA). \r\n\r\nIf you disable or do not configure this policy setting, Outlook can use any available algorithm for S/MIME operations, such as encryption, signing, and so on. \r\n\r\nNote - For more information about Suite B, see \"Fact Sheet NSA Suite B Cryptography\" http://www.nsa.gov/ia/industry/crypto_suite_b.cfm.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_requiresuitebalgorithmsforsmimeoperations_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_requiresuitebalgorithmsforsmimeoperations_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_runinfipscompliantmode","displayName":"Run in FIPS compliant mode (User)","description":"This policy setting controls whether Outlook is required to use FIPS-compliant algorithms when signing and encrypting messages. Outlook can run in a mode that complies with Federal Information Processing Standards (FIPS), a set of standards published by the National Institute of Standards and Technology (NIST) for use by non-military United States government agencies and by government contractors.\r\n\r\nIf you enable this policy setting, Outlook runs in a mode that complies with the FIPS 140-1 standard for cryptographic modules. This mode requires the use of the SHA-1 algorithm for signing and 3DES for encryption.\r\n\r\nIf you disable or do not configure this policy setting, Outlook does not run in FIPS-compliant mode. Organizations that do business with the United States government but do not run Outlook in FIPS-compliant mode risk violating the U.S. government's rules regarding the handling of sensitive information.\r\n\r\nFor more information about FIPS, see FIPS - General Information at http://www.itl.nist.gov/fipspubs/geninfo.htm","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_runinfipscompliantmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_runinfipscompliantmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_sendallsignedmessagesasclearsignedmessages","displayName":"Send all signed messages as clear signed messages (User)","description":"This policy setting controls whether Outlook sends signed messages as clear text signed messages.\r\n\r\nIf you enable this policy setting, the \"Send clear text signed message when sending signed messages\" option is selected in the E-mail Security section of the Trust Center.\r\n\r\nIf you disable or do not configure this policy setting, when users sign e-mail messages with their digital signature and send them, Outlook uses the signature's private key to encrypt the digital signature but sends the messages as clear text, unless they are encrypted separately.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_sendallsignedmessagesasclearsignedmessages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_sendallsignedmessagesasclearsignedmessages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_signallemailmessages","displayName":"Sign all e-mail messages (User)","description":"This policy setting controls whether Outlook requires digital signatures on all outgoing e-mail messages.\r\n\r\nIf you enable this policy setting, Outlook requires all outgoing messages to be digitally signed before being sent.\r\n\r\nIf you disable or do not configure this policy setting, Outlook does not require outgoing messages to have digital signatures.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_signallemailmessages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_signallemailmessages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_signaturewarning","displayName":"Signature Warning (User) (Deprecated)","description":"This policy setting controls how Outlook warns users about messages with invalid digital signatures.\r\n\r\nIf you enable this policy setting, you can choose from three options for controlling how Outlook users are warned about invalid signatures:\r\n\r\n- Let user decide if they want to be warned. This option enforces the default configuration.\r\n- Always warn about invalid signatures.\r\n- Never warn about invalid signatures.\r\n\r\nIf you disable or do not configure this policy setting, if users open e-mail messages that include invalid digital signatures, Outlook displays a warning dialog. Users can decide whether they want to be warned about invalid signatures in the future.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_signaturewarning_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_signaturewarning_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_signaturewarning_l_signaturewarning30","displayName":"Signature Warning (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_signaturewarning_l_signaturewarning30_0","displayName":"Let user decide if they want to be warned","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_signaturewarning_l_signaturewarning30_1","displayName":"Always warn about invalid signatures","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_signaturewarning_l_signaturewarning30_2","displayName":"Never warn about invalid signatures","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_signaturewarning_v2","displayName":"Signature Warning (User)","description":"This policy setting controls how Outlook warns users about messages with invalid digital signatures.\r\n\r\nIf you enable this policy setting, you can choose from three options for controlling how Outlook users are warned about invalid signatures:\r\n\r\n- Let user decide if they want to be warned. This option enforces the default configuration.\r\n- Always warn about invalid signatures.\r\n- Never warn about invalid signatures.\r\n\r\nIf you disable or do not configure this policy setting, if users open e-mail messages that include invalid digital signatures, Outlook displays a warning dialog. Users can decide whether they want to be warned about invalid signatures in the future.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_signaturewarning_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_signaturewarning_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_signaturewarning_v2_l_signaturewarning30","displayName":"Signature Warning (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_signaturewarning_v2_l_signaturewarning30_0","displayName":"Let user decide if they want to be warned","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_signaturewarning_v2_l_signaturewarning30_1","displayName":"Always warn about invalid signatures","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_signaturewarning_v2_l_signaturewarning30_2","displayName":"Never warn about invalid signatures","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_smimeinteroperabilitywithexternalclients","displayName":"S/MIME interoperability with external clients: (User)","description":"This policy setting controls whether Outlook decodes encrypted messages itself or passes them to an external program for processing.\r\n\r\nIf you enable this policy setting, you can choose from three options for configuring external S/MIME clients:\r\n\r\n- Handle internally. Outlook decrypts all S/MIME messages itself.\r\n- Handle externally. Outlook hands all S/MIME messages off to the configured external program.\r\n- Handle if possible. Outlook attempts to decrypt all S/MIME messages itself. If it cannot decrypt a message, Outlook hands the message off to the configured external program. This option is the default configuration.\r\n\r\nIf you disable or do not configure this policy setting, the behavior is the equivalent of selecting Enabled – Handle if possible.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_smimeinteroperabilitywithexternalclients_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_smimeinteroperabilitywithexternalclients_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_smimeinteroperabilitywithexternalclients_l_behaviorforhandlingsmimemessages","displayName":"Behavior for handling S/MIME messages: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_smimeinteroperabilitywithexternalclients_l_behaviorforhandlingsmimemessages_0","displayName":"Handle internally","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_smimeinteroperabilitywithexternalclients_l_behaviorforhandlingsmimemessages_1","displayName":"Handle externally","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_smimeinteroperabilitywithexternalclients_l_behaviorforhandlingsmimemessages_2","displayName":"Handle if possible","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_smimereceiptrequests","displayName":"S/MIME receipt requests behavior (User)","description":"This policy setting controls how Outlook handles S/MIME receipt requests.\r\n\r\nIf you enable this policy setting, you can choose from four options for handling S/MIME receipt requests in Outlook:\r\n\r\n- Open message if receipt can't be sent\r\n- Don't open message if receipt can't be sent\r\n- Always prompt before sending receipt\r\n- Never send S/MIME receipts\r\n\r\nIf you disable or do not configure this policy setting, when users open messages with attached receipt requests, Outlook prompts them to decide whether to send a receipt to the sender with information about the identity of the user who opened the message and the time it was opened. If Outlook cannot send the receipt, the user is still allowed to open the message.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_smimereceiptrequests_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_smimereceiptrequests_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_smimereceiptrequests_l_handlemessageswithsmimereceiptrequestsinthefollowingmanner","displayName":"Handle messages with S/MIME receipt requests in the following manner: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_smimereceiptrequests_l_handlemessageswithsmimereceiptrequestsinthefollowingmanner_0","displayName":"Open message if receipt can't be sent","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_smimereceiptrequests_l_handlemessageswithsmimereceiptrequestsinthefollowingmanner_3","displayName":"Don't open message if receipt can't be sent","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_smimereceiptrequests_l_handlemessageswithsmimereceiptrequestsinthefollowingmanner_1","displayName":"Always prompt before sending receipt","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_smimereceiptrequests_l_handlemessageswithsmimereceiptrequestsinthefollowingmanner_2","displayName":"Never send S/MIME receipts","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_smimeuseissuerserialnumber","displayName":"Use UserIssuerSerialNumber (User)","description":"This policy setting determines whether Outlook uses IssuerSerialNumber as the SignerIdentifier, which enables third-party email client software applications to read encrypted Outlook email messages. For more information about Cryptographic Message Syntax, refer to the RFC 5652 specification.\r\n\r\nIf you enable or do not configure this policy setting, Outlook uses the IssuerSerialNumber as the SignerIdentifier.\r\n\r\nIf you disable this policy setting, Outlook uses SubjectKeyIdentifier for the SignerIdentifier, which might prevent third-party email client software applications from reading encrypted Outlook email messages.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_smimeuseissuerserialnumber_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_smimeuseissuerserialnumber_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_urlforsmimecertificates","displayName":"URL for S/MIME certificates (User)","description":"This policy setting provides a URL at which Outlook users can obtain S/MIME certificates. \r\n\r\nIf you enable this policy setting, you can enter a URL from which users can obtain S/MIME certificates. The URL can contain three variables, %1, %2, and %3, which will be replaced by the user's name, e-mail address, and language, respectively. When users click \"Get a Digital ID\", they will be directed to the supplied URL. \r\n\r\nIf you disable or do not configure this policy setting, a URL for S/MIME certificates is not provided.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_urlforsmimecertificates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_urlforsmimecertificates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_urlforsmimecertificates_l_enterurl","displayName":"Enter URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_attachmentsecuretemporaryfolder","displayName":"Attachment Secure Temporary Folder (User)","description":"This policy setting allows you to specify a folder path for the Secure Temporary Files folder rather than using the one that is randomly generated by Outlook. \r\n\r\nIf you enable this policy setting, you can specify a folder path for the Security Temporary Files folder rather than using the one that is randomly generated by Outlook. \r\n\r\nIf you disable or do not configure this policy setting, Outlook will assign the Secure Temporary Files folder a different random name for each user. \r\n\r\nImportant - If you must use a specific folder for Outlook attachments, Microsoft recommends that you use a local directory (for best performance), that you place the folder under the Temporary Internet Files folder (to benefit from the enhanced security on that folder), and that the folder name is unique and difficult to guess.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_attachmentsecuretemporaryfolder_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_attachmentsecuretemporaryfolder_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_attachmentsecuretemporaryfolder_l_enterthesecurefolderpath","displayName":"Enter the Secure Folder path (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_missingcrls","displayName":"Missing CRLs (User)","description":"This policy setting controls whether Outlook considers a missing certificate revocation list (CRL) a warning or an error. Digital certificates contain an attribute that shows where the corresponding CRL is located. CRLs contain lists of digital certificates that have been revoked by their controlling certification authorities (CAs), typically because the certificates were issued improperly or their associated private keys were compromised. If a CRL is missing or unavailable, Outlook cannot determine whether a certificate has been revoked. Therefore, an improperly issued certificate or one that has been compromised might be used to gain access to data. \r\n\r\nIf you enable this policy setting, you can choose between two options that determine how Outlook functions when a CRL is missing: \r\n\r\n- Warning. This option is the default configuration in Outlook and ensures that Outlook displays a warning message when a CRL is missing. \r\n\r\n- Error. This option ensures that Outlook displays an error message when a CRL is missing. \r\n\r\nIf you disable or do not configure this policy setting, Outlook displays a warning message when a CRL is not available.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_missingcrls_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_missingcrls_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_missingcrls_l_indicateamissingcrlasan","displayName":"Indicate a missing CRL as a(n): (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_missingcrls_l_indicateamissingcrlasan_0","displayName":"Warning","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_missingcrls_l_indicateamissingcrlasan_1","displayName":"Error","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_missingrootcertificates","displayName":"Missing root certificates (User)","description":"This policy setting controls how Outlook functions when a root certificate is missing. \r\n\r\nIf you enable this policy setting, you can choose from three options that determine how Outlook functions when a root certificate is missing. \r\n\r\n- Neither Error nor Warning. This option displays neither an error nor a warning, and enforces the default configuration in Outlook.\r\n- Warning. This option ensures that Outlook displays a warning message when a root certificate is missing. \r\n- Error. This option ensures that Outlook displays an error message when a root certificate is missing. \r\n\r\nIf you don't configure this policy setting, users will see an error when a root certificate is missing.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_missingrootcertificates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_missingrootcertificates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_missingrootcertificates_l_indicateamissingrootcertificateasan","displayName":"Indicate a missing root certificate as a(n): (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_missingrootcertificates_l_indicateamissingrootcertificateasan_0","displayName":"Neither error nor warning","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_missingrootcertificates_l_indicateamissingrootcertificateasan_1","displayName":"Warning","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_missingrootcertificates_l_indicateamissingrootcertificateasan_2","displayName":"Error","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_promotingerrorsaswarnings","displayName":"Promote Level 2 errors as errors, not warnings (User)","description":"This policy setting allows you to treat Level 2 errors as warnings instead of errors. Level 2 errors occur when the message signature appears to be valid, but there are other issues with the signature. \r\n\r\nIf you enable this policy setting, Level 2 errors will be treated as warnings.\r\n\r\nIf you disable or do not configure this policy setting, Level 2 errors will be treated as errors\r\n\r\nWhen you specify a value for PromoteErrorsAsWarnings, note that potential Level 2 error conditions include the following:\r\n\r\n- Unknown Signature Algorithm\r\n- No Signing Certification Found\r\n- Bad Attribute Sets\r\n- No Issuer Certificate found\r\n- No CRL Found\r\n- Out-of-date CRL\r\n- Root Trust Problem\r\n- Out-of-date CTL","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_promotingerrorsaswarnings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_promotingerrorsaswarnings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_retrievingcrlscertificaterevocationlists","displayName":"Retrieving CRLs (Certificate Revocation Lists) (User) (Deprecated)","description":"This policy setting controls how Outlook retrieves Certificate Revocation Lists to verify the validity of certificates.Certificate revocation lists (CRLs) are lists of digital certificates that have been revoked by their controlling certificate authorities (CAs), typically because the certificates were issued improperly or their associated private keys were compromised. \r\n\r\nIf you enable this policy setting, you can choose from three options to govern how Outlook uses CRLs: \r\n\r\n- Use system Default. Outlook relies on the CRL download schedule that is configured for the operating system. \r\n- When online always retrieve the CRL. This option is the default configuration in Outlook. \r\n- Never retrieve the CRL. Outlook will not attempt to download the CRL for a certificate, even if it is online. This option can reduce security. \r\n\r\nIf you disable or do not configure this policy setting, when Outlook handles a certificate that includes a URL from which a CRL can be downloaded, Outlook will retrieve the CRL from the provided URL if Outlook is online.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_retrievingcrlscertificaterevocationlists_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_retrievingcrlscertificaterevocationlists_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_retrievingcrlscertificaterevocationlists_l_empty31","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_retrievingcrlscertificaterevocationlists_l_empty31_0","displayName":"Use system Default","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_retrievingcrlscertificaterevocationlists_l_empty31_1","displayName":"When online always retreive the CRL","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_retrievingcrlscertificaterevocationlists_l_empty31_2","displayName":"Never retreive the CRL","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_retrievingcrlscertificaterevocationlists_v2","displayName":"Retrieving CRLs (Certificate Revocation Lists) (User)","description":"This policy setting controls how Outlook retrieves Certificate Revocation Lists to verify the validity of certificates.Certificate revocation lists (CRLs) are lists of digital certificates that have been revoked by their controlling certificate authorities (CAs), typically because the certificates were issued improperly or their associated private keys were compromised. \r\n\r\nIf you enable this policy setting, you can choose from three options to govern how Outlook uses CRLs: \r\n\r\n- Use system Default. Outlook relies on the CRL download schedule that is configured for the operating system. \r\n- When online always retrieve the CRL. This option is the default configuration in Outlook. \r\n- Never retrieve the CRL. Outlook will not attempt to download the CRL for a certificate, even if it is online. This option can reduce security. \r\n\r\nIf you disable or do not configure this policy setting, when Outlook handles a certificate that includes a URL from which a CRL can be downloaded, Outlook will retrieve the CRL from the provided URL if Outlook is online.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_retrievingcrlscertificaterevocationlists_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_retrievingcrlscertificaterevocationlists_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_retrievingcrlscertificaterevocationlists_v2_l_empty31","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_retrievingcrlscertificaterevocationlists_v2_l_empty31_0","displayName":"Use system Default","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_retrievingcrlscertificaterevocationlists_v2_l_empty31_1","displayName":"When online always retreive the CRL","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_cryptography~l_signaturestatusdialog_l_retrievingcrlscertificaterevocationlists_v2_l_empty31_2","displayName":"Never retreive the CRL","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings_l_outlooksecuritymode","displayName":"Outlook Security Mode (User)","description":"This policy setting controls which set of security settings are enforced in Outlook. \r\n\r\nIf you enable this policy setting, you can choose from four options for enforcing Outlook security settings: \r\n\r\n* Outlook Default Security - This option is the default configuration in Outlook. Users can configure security themselves, and Outlook ignores any security-related settings configured in Group Policy. \r\n\r\n* Use Security Form from 'Outlook Security Settings' Public Folder - Outlook uses the settings from the security form published in the designated public folder. \r\n\r\n* Use Security Form from 'Outlook 10 Security Settings' Public Folder - Outlook uses the settings from the security form published in the designated public folder. \r\n\r\n* Use Outlook Security Group Policy - Outlook uses security settings from Group Policy. \r\n\r\nImportant - You must enable this policy setting if you want to apply the other Outlook security policy settings mentioned in this guide. \r\n\r\nIf you disable or do not configure this policy setting, Outlook users can configure security for themselves, and Outlook ignores any security-related settings that are configured in Group Policy. \r\n\r\nNote - In previous versions of Outlook, when security settings were published in a form in Exchange Server public folders, users who needed these settings required the HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Security\\CheckAdminSettings registry key to be set on their computers for the settings to apply. In Outlook, the CheckAdminSettings registry key is no longer used to determine users' security settings. Instead, the Outlook Security Mode setting can be used to determine whether Outlook security should be controlled directly by Group Policy, by the security form from the Outlook Security Settings Public Folder, or by the settings on users' own computers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings_l_outlooksecuritymode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings_l_outlooksecuritymode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings_l_outlooksecuritymode_l_outlooksecuritypolicy","displayName":"Outlook Security Policy: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings_l_outlooksecuritymode_l_outlooksecuritypolicy_0","displayName":"Outlook Default Security","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings_l_outlooksecuritymode_l_outlooksecuritypolicy_1","displayName":"Use Security Form from 'Outlook Security Settings' Public Folder","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings_l_outlooksecuritymode_l_outlooksecuritypolicy_2","displayName":"Use Security Form from 'Outlook 10 Security Settings' Public Folder","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings_l_outlooksecuritymode_l_outlooksecuritypolicy_3","displayName":"Use Outlook Security Group Policy","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_allowuserstolowerattachments","displayName":"Allow users to demote attachments to Level 2 (User) (Deprecated)","description":"This policy setting controls whether Outlook users can demote attachments to Level 2 by using a registry key, which will allow them to save files to disk and open them from that location. Outlook uses two levels of security to restrict access to files attached to e-mail messages or other items. Files with specific extensions can be categorized as Level 1 (users cannot view the file) or Level 2 (users can open the file after saving it to disk). Users can freely open files of types that are not categorized as Level 1 or Level 2. \r\n\r\nIf you enable this policy setting, users can create a list of Level 1 file types to demote to Level 2 by adding the file types to the following registry key: HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\Outlook\\Security\\Level1Remove. \r\n\r\nIf you disable or do not configure this policy setting, users cannot demote level 1 attachments to level 2, and the HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\Outlook\\Security\\Level1Remove registry key has no effect.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_allowuserstolowerattachments_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_allowuserstolowerattachments_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_allowuserstolowerattachments_v2","displayName":"Allow users to demote attachments to Level 2 (User)","description":"This policy setting controls whether Outlook users can demote attachments to Level 2 by using a registry key, which will allow them to save files to disk and open them from that location. Outlook uses two levels of security to restrict access to files attached to e-mail messages or other items. Files with specific extensions can be categorized as Level 1 (users cannot view the file) or Level 2 (users can open the file after saving it to disk). Users can freely open files of types that are not categorized as Level 1 or Level 2. \r\n\r\nIf you enable this policy setting, users can create a list of Level 1 file types to demote to Level 2 by adding the file types to the following registry key: HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\Outlook\\Security\\Level1Remove. \r\n\r\nIf you disable or do not configure this policy setting, users cannot demote level 1 attachments to level 2, and the HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\Outlook\\Security\\Level1Remove registry key has no effect.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_allowuserstolowerattachments_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_allowuserstolowerattachments_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level1addfilepolicy","displayName":"Add file extensions to block as Level 1 (User)","description":"This policy setting controls which types of attachments (determined by file extension) Outlook prevents from being delivered. \r\n\r\nOutlook uses two levels of security to restrict users' access to files attached to e-mail messages or other items. Files with specific extensions can be categorized as Level 1 (users cannot view the file) or Level 2 (users can open the file after saving it to disk). Users can freely open files of types that are not categorized as Level 1 or Level 2. \r\n\r\nIf you enable this policy setting, you can specify additional file type extensions as Level 1--that is, to be blocked from delivery--by entering them in the text field provided separated by semicolons. \r\n\r\nIf you disable or do not configure this policy setting, Outlook classifies a number of potentially harmful file types (such as those with .exe, .reg, and .vbs extensions) as Level 1 and blocks files with those extensions from being delivered. Important: This policy setting only applies if the \"Outlook Security Mode\" policy setting under \"Microsoft Outlook 2016\\Security\\Security Form Settings\" is configured to \"Use Outlook Security Group Policy.\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level1addfilepolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level1addfilepolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level1addfilepolicy_l_additionalextensions","displayName":"Additional Extensions: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level1attachments","displayName":"Display Level 1 attachments (User) (Deprecated)","description":"This policy setting controls whether Outlook blocks potentially dangerous attachments designated Level 1. \r\nOutlook uses two levels of security to restrict users' access to files attached to e-mail messages or other items. Files with specific extensions can be categorized as Level 1 (users cannot view the file) or Level 2 (users can open the file after saving it to disk). Users can freely open files of types that are not categorized as Level 1 or Level 2. \r\n \r\nIf you enable this policy setting, Outlook users can gain access to Level 1 file type attachments by first saving the attachments to disk and then opening them, as with Level 2 attachments. \r\n\r\nIf you disable this policy setting, Level 1 attachments do not display under any circumstances. \r\n\r\nIf you do not configure this policy setting, Outlook completely blocks access to Level 1 files, and requires users to save Level 2 files to disk before opening them.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level1attachments_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level1attachments_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level1attachments_v2","displayName":"Display Level 1 attachments (User)","description":"This policy setting controls whether Outlook blocks potentially dangerous attachments designated Level 1. \r\nOutlook uses two levels of security to restrict users' access to files attached to e-mail messages or other items. Files with specific extensions can be categorized as Level 1 (users cannot view the file) or Level 2 (users can open the file after saving it to disk). Users can freely open files of types that are not categorized as Level 1 or Level 2. \r\n \r\nIf you enable this policy setting, Outlook users can gain access to Level 1 file type attachments by first saving the attachments to disk and then opening them, as with Level 2 attachments. \r\n\r\nIf you disable this policy setting, Level 1 attachments do not display under any circumstances. \r\n\r\nIf you do not configure this policy setting, Outlook completely blocks access to Level 1 files, and requires users to save Level 2 files to disk before opening them.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level1attachments_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level1attachments_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level1removefilepolicy","displayName":"Remove file extensions blocked as Level 1 (User) (Deprecated)","description":"This policy setting controls which types of attachments (determined by file extension) Outlook prevents from being delivered. \r\n\r\nOutlook uses two levels of security to restrict users' access to files attached to e-mail messages or other items. Files with specific extensions can be categorized as Level 1 (users cannot view the file) or Level 2 (users can open the file after saving it to disk). Users can freely open files of types that are not categorized as Level 1 or Level 2. \r\n\r\nIf you enable this policy setting, you can specify the removal of file type extensions as that Outlook classifies as Level 1--that is, to be blocked from delivery--by entering them in the text field provided separated by semicolons. \r\n\r\nIf you disable or do not configure this policy setting, Outlook classifies a number of potentially harmful file types (such as those with .exe, .reg, and .vbs extensions) as Level 1 and blocks files with those extensions from being delivered. \r\nImportant: This policy setting only applies if the \"Outlook Security Mode\" policy setting under \"Microsoft Outlook 2016\\Security\\Security Form Settings\" is configured to \"Use Outlook Security Group Policy.\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level1removefilepolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level1removefilepolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level1removefilepolicy_l_removedextensions","displayName":"Removed Extensions: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level1removefilepolicy_v2","displayName":"Remove file extensions blocked as Level 1 (User)","description":"This policy setting controls which types of attachments (determined by file extension) Outlook prevents from being delivered. \r\n\r\nOutlook uses two levels of security to restrict users' access to files attached to e-mail messages or other items. Files with specific extensions can be categorized as Level 1 (users cannot view the file) or Level 2 (users can open the file after saving it to disk). Users can freely open files of types that are not categorized as Level 1 or Level 2. \r\n\r\nIf you enable this policy setting, you can specify the removal of file type extensions as that Outlook classifies as Level 1--that is, to be blocked from delivery--by entering them in the text field provided separated by semicolons. \r\n\r\nIf you disable or do not configure this policy setting, Outlook classifies a number of potentially harmful file types (such as those with .exe, .reg, and .vbs extensions) as Level 1 and blocks files with those extensions from being delivered. \r\nImportant: This policy setting only applies if the \"Outlook Security Mode\" policy setting under \"Microsoft Outlook 2016\\Security\\Security Form Settings\" is configured to \"Use Outlook Security Group Policy.\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level1removefilepolicy_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level1removefilepolicy_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level1removefilepolicy_v2_l_removedextensions","displayName":"Removed Extensions: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level2addfilepolicy","displayName":"Add file extensions to block as Level 2 (User)","description":"This policy setting controls which types of attachments (determined by file extension) must be saved to disk before users can open them. Files with specific extensions can be categorized as Level 1 (users cannot view the file) or Level 2 (users can open the file after saving it to disk). Users can freely open files of types that are not categorized as Level 1 or Level 2. \r\n\r\nIf you enable this policy setting, you can specify a list of attachment file types to classify as Level 2, which forces users to actively decide to download the attachment to view it. \r\n\r\nIf you disable or do not configure this policy setting, Outlook does not classify any file type extensions as Level 2. \r\n\r\nImportant: This policy setting only applies if the \"Outlook Security Mode\" policy setting under \"Microsoft Outlook 2016\\Security\\Security Form Settings\" is configured to \"Use Outlook Security Group Policy.\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level2addfilepolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level2addfilepolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level2addfilepolicy_l_additionalextensions23","displayName":"Additional Extensions: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level2removefilepolicy","displayName":"Remove file extensions blocked as Level 2 (User) (Deprecated)","description":"This policy setting controls which types of attachments (determined by file extension) must be saved to disk before users can open them. Files with specific extensions can be categorized as Level 1 (users cannot view the file) or Level 2 (users can open the file after saving it to disk). Users can freely open files of types that are not categorized as Level 1 or Level 2. \r\n\r\nIf you enable this policy setting, you can specify a list of attachment file types to classify as Level 2, which forces users to actively decide to download the attachment to view it. \r\n\r\nIf you disable or do not configure this policy setting, Outlook does not classify any file type extensions as Level 2. \r\n\r\nImportant: This policy setting only applies if the \"Outlook Security Mode\" policy setting under \"Microsoft Outlook 2016\\Security\\Security Form Settings\" is configured to \"Use Outlook Security Group Policy.\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level2removefilepolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level2removefilepolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level2removefilepolicy_l_removedextensions25","displayName":"Removed Extensions: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level2removefilepolicy_v2","displayName":"Remove file extensions blocked as Level 2 (User)","description":"This policy setting controls which types of attachments (determined by file extension) must be saved to disk before users can open them. Files with specific extensions can be categorized as Level 1 (users cannot view the file) or Level 2 (users can open the file after saving it to disk). Users can freely open files of types that are not categorized as Level 1 or Level 2. \r\n\r\nIf you enable this policy setting, you can specify a list of attachment file types to classify as Level 2, which forces users to actively decide to download the attachment to view it. \r\n\r\nIf you disable or do not configure this policy setting, Outlook does not classify any file type extensions as Level 2. \r\n\r\nImportant: This policy setting only applies if the \"Outlook Security Mode\" policy setting under \"Microsoft Outlook 2016\\Security\\Security Form Settings\" is configured to \"Use Outlook Security Group Policy.\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level2removefilepolicy_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level2removefilepolicy_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_level2removefilepolicy_v2_l_removedextensions25","displayName":"Removed Extensions: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_nopromptlevel1close","displayName":"Do not prompt about Level 1 attachments when closing an item (User)","description":"This policy setting controls whether Outlook displays a warning before closing an item that contains an unsafe attachment that will be blocked when the item is re-opened.To protect users from viruses and other harmful files, Outlook uses two levels of security, designated Level 1 and Level 2, to restrict users' access to files attached to e-mail messages or other items. Outlook completely blocks access to Level 1 files by default, and requires users to save Level 2 files to disk before opening them. Potentially harmful files can be classified into these two levels by file type extension, with all other file types considered safe. \r\n\r\nIf you enable this policy setting, Outlook will not display a warning when users close items with Level 1 attachments, which could cause data loss. \r\n\r\nIf you disable or do not configure this policy setting, when a user closes an item to which a level 1 file has been attached, Outlook warns the user that the message contains a potentially unsafe attachment and that the user might not be able to access the attachment when opening the item later. (Such a sequence of events might occur when a user closes a draft message that they intend to resume editing at some future time.) \r\n\r\nImportant: This policy setting only applies if the \"Outlook Security Mode\" policy setting under \"Microsoft Outlook 2016\\Security\\Security Form Settings\" is configured to \"Use Outlook Security Group Policy.\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_nopromptlevel1close_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_nopromptlevel1close_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_nopromptlevel1send","displayName":"Do not prompt about Level 1 attachments when sending an item (User)","description":"This policy setting controls whether Outlook displays a warning before sending an item that contains an unsafe attachment that will be blocked when the item is opened by a recipient. To protect users from viruses and other harmful files, Outlook uses two levels of security, designated Level 1 and Level 2, to restrict access to files attached to e-mail messages or other items. Outlook completely blocks access to Level 1 files by default, and requires users to save Level 2 files to disk before opening them. Potentially harmful files can be classified into these two levels by file type extension, with all other file types considered safe. \r\n\r\nIf you enable this policy setting, Outlook will not display a warning when a user sends an item with a Level 1 attachment, which can cause users' data to be at risk.\r\n\r\nIf you disable or do not configure this policy setting, when users attempt to send an item to which a level 1 file has been attached, Outlook warns them that the message contains a potentially unsafe attachment and that the recipient might not be able to access it. \r\n\r\nImportant: This policy setting only applies if the \"Outlook Security Mode\" policy setting under \"Microsoft Outlook 2016\\Security\\Security Form Settings\" is configured to \"Use Outlook Security Group Policy.\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_nopromptlevel1send_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_nopromptlevel1send_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_showolepackageobj","displayName":"Display OLE package objects (User)","description":"By default, OLE package objects are not displayed in e-mail messages. You can change this behavior so that the package appears in the body of the e-mail message as an icon that represents an embedded or linked OLE object. When users double-click the icon representing the package, the program used to create the object either plays the object or opens and displays it. Be aware that the icon for OLE package objects can be easily changed and used to disguise malicious files.\r\n\r\nTo set Exchange Security Form settings by using Group Policy, note that this policy setting only applies if the \"Outlook Security Mode\" policy setting under \"Microsoft Outlook 2016\\Security\\Security Form Settings\" is configured to \"Use Outlook Security Group Policy.\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_showolepackageobj_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_miscattachmentsettings_l_showolepackageobj_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_enablescriptsinoneoffforms","displayName":"Allow scripts in one-off Outlook forms (User) (Deprecated)","description":"This policy setting controls whether scripts can run in Outlook forms in which the script and layout are contained within the message. \r\n\r\nIf you enable this policy setting, scripts can run in one-off Outlook forms. \r\n\r\nIf you disable or do not configure this policy setting, Outlook does not run scripts in forms in which the script and the layout are contained within the message. \r\n\r\nImportant: This policy setting only applies if the \"Outlook Security Mode\" policy setting under \"Microsoft Outlook 2016\\Security\\Security Form Settings\" is configured to \"Use Outlook Security Group Policy.\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_enablescriptsinoneoffforms_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_enablescriptsinoneoffforms_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_enablescriptsinoneoffforms_v2","displayName":"Allow scripts in one-off Outlook forms (User)","description":"This policy setting controls whether scripts can run in Outlook forms in which the script and layout are contained within the message. \r\n\r\nIf you enable this policy setting, scripts can run in one-off Outlook forms. \r\n\r\nIf you disable or do not configure this policy setting, Outlook does not run scripts in forms in which the script and the layout are contained within the message. \r\n\r\nImportant: This policy setting only applies if the \"Outlook Security Mode\" policy setting under \"Microsoft Outlook 2016\\Security\\Security Form Settings\" is configured to \"Use Outlook Security Group Policy.\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_enablescriptsinoneoffforms_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_enablescriptsinoneoffforms_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_onexecutecustomactionoom","displayName":"Set Outlook object model custom actions execution prompt (User) (Deprecated)","description":"This policy setting controls whether Outlook prompts users before executing a custom action. Custom actions add functionality to Outlook that can be triggered as part of a rule. Among other possible features, custom actions can be created that reply to messages in ways that circumvent the Outlook model's programmatic send protections. \r\n\r\nIf you enable this policy setting, you can choose from four options to control how Outlook functions when a custom action is executed that uses the Outlook object model: \r\n\r\n* Prompt User \r\n* Automatically Approve \r\n* Automatically Deny \r\n* Prompt user based on computer security. This option enforces the default configuration in Outlook. \r\n\r\nIf you disable or do not configure this policy setting, when Outlook or another program initiates a custom action using the Outlook object model, users are prompted to allow or reject the action. If this configuration is changed, malicious code can use the Outlook object model to compromise sensitive information or otherwise cause data and computing resources to be at risk. This is the equivalent of choosing Enabled -- Prompt user based on computer security.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_onexecutecustomactionoom_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_onexecutecustomactionoom_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_onexecutecustomactionoom_l_onexecutecustomactionoom_setting","displayName":"When executing a custom action: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_onexecutecustomactionoom_l_onexecutecustomactionoom_setting_1","displayName":"Prompt User","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_onexecutecustomactionoom_l_onexecutecustomactionoom_setting_2","displayName":"Automatically Approve","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_onexecutecustomactionoom_l_onexecutecustomactionoom_setting_0","displayName":"Automatically Deny","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_onexecutecustomactionoom_l_onexecutecustomactionoom_setting_3","displayName":"Prompt user based on computer security","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_onexecutecustomactionoom_v2","displayName":"Set Outlook object model custom actions execution prompt (User)","description":"This policy setting controls whether Outlook prompts users before executing a custom action. Custom actions add functionality to Outlook that can be triggered as part of a rule. Among other possible features, custom actions can be created that reply to messages in ways that circumvent the Outlook model's programmatic send protections. \r\n\r\nIf you enable this policy setting, you can choose from four options to control how Outlook functions when a custom action is executed that uses the Outlook object model: \r\n\r\n* Prompt User \r\n* Automatically Approve \r\n* Automatically Deny \r\n* Prompt user based on computer security. This option enforces the default configuration in Outlook. \r\n\r\nIf you disable or do not configure this policy setting, when Outlook or another program initiates a custom action using the Outlook object model, users are prompted to allow or reject the action. If this configuration is changed, malicious code can use the Outlook object model to compromise sensitive information or otherwise cause data and computing resources to be at risk. This is the equivalent of choosing Enabled -- Prompt user based on computer security.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_onexecutecustomactionoom_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_onexecutecustomactionoom_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_onexecutecustomactionoom_v2_l_onexecutecustomactionoom_setting","displayName":"When executing a custom action: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_onexecutecustomactionoom_v2_l_onexecutecustomactionoom_setting_1","displayName":"Prompt User","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_onexecutecustomactionoom_v2_l_onexecutecustomactionoom_setting_2","displayName":"Automatically Approve","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_onexecutecustomactionoom_v2_l_onexecutecustomactionoom_setting_0","displayName":"Automatically Deny","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_misccustomformsettings_l_onexecutecustomactionoom_v2_l_onexecutecustomactionoom_setting_3","displayName":"Prompt user based on computer security","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressaccess","displayName":"Configure Outlook object model prompt when reading address information (User) (Deprecated)","description":"This policy setting controls what happens when an untrusted program attempts to gain access to a recipient field, such as the ''To:'' field, using the Outlook object model.\r\n\r\nIf you enable this policy setting, you can choose from four different options when an untrusted program attempts to access a recipient field using the Outlook object model:\r\n\r\n- Prompt user. The user will be prompted to approve every access attempt.\r\n- Automatically approve. Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended.\r\n- Automatically deny. Outlook will automatically deny programmatic access requests from any program.\r\n- Prompt user based on computer security. Outlook will only prompt users when antivirus software is out of date or not running. This is the default configuration.\r\n\r\nIf you disable or do not configure this policy setting, when an untrusted application attempts to access recipient fields, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressaccess_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressaccess_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressaccess_l_oomaddressaccess_setting","displayName":"Guard behavior: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressaccess_l_oomaddressaccess_setting_1","displayName":"Prompt User","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressaccess_l_oomaddressaccess_setting_2","displayName":"Automatically Approve","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressaccess_l_oomaddressaccess_setting_0","displayName":"Automatically Deny","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressaccess_l_oomaddressaccess_setting_3","displayName":"Prompt user based on computer security","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressaccess_v2","displayName":"Configure Outlook object model prompt when reading address information (User)","description":"This policy setting controls what happens when an untrusted program attempts to gain access to a recipient field, such as the ''To:'' field, using the Outlook object model.\r\n\r\nIf you enable this policy setting, you can choose from four different options when an untrusted program attempts to access a recipient field using the Outlook object model:\r\n\r\n- Prompt user. The user will be prompted to approve every access attempt.\r\n- Automatically approve. Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended.\r\n- Automatically deny. Outlook will automatically deny programmatic access requests from any program.\r\n- Prompt user based on computer security. Outlook will only prompt users when antivirus software is out of date or not running. This is the default configuration.\r\n\r\nIf you disable or do not configure this policy setting, when an untrusted application attempts to access recipient fields, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressaccess_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressaccess_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressaccess_v2_l_oomaddressaccess_setting","displayName":"Guard behavior: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressaccess_v2_l_oomaddressaccess_setting_1","displayName":"Prompt User","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressaccess_v2_l_oomaddressaccess_setting_2","displayName":"Automatically Approve","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressaccess_v2_l_oomaddressaccess_setting_0","displayName":"Automatically Deny","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressaccess_v2_l_oomaddressaccess_setting_3","displayName":"Prompt user based on computer security","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressbook","displayName":"Configure Outlook object model prompt when accessing an address book (User) (Deprecated)","description":"This policy setting controls what happens when an untrusted program attempts to gain access to an Address Book using the Outlook object model. \r\n\r\nIf you enable this policy setting, you can choose from four different options when an untrusted program attempts to programmatically access an Address Book using the Outlook object model:\r\n\r\n- Prompt user - Users are prompted to approve every access attempt. \r\n- Automatically approve - Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended. \r\n- Automatically deny - Outlook will automatically deny programmatic access requests from any program.\r\n- Prompt user based on computer security - Outlook will rely on the setting in the ''Programmatic Access'' section of the Trust Center. This is the default behavior.\r\n\r\nIf you disable or do not configure this policy setting, when an untrusted application attempts to access the address book programmatically, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center. ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressbook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressbook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressbook_l_oomaddressbook_setting","displayName":"Guard behavior: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressbook_l_oomaddressbook_setting_1","displayName":"Prompt User","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressbook_l_oomaddressbook_setting_2","displayName":"Automatically Approve","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressbook_l_oomaddressbook_setting_0","displayName":"Automatically Deny","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressbook_l_oomaddressbook_setting_3","displayName":"Prompt user based on computer security","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressbook_v2","displayName":"Configure Outlook object model prompt when accessing an address book (User)","description":"This policy setting controls what happens when an untrusted program attempts to gain access to an Address Book using the Outlook object model. \r\n\r\nIf you enable this policy setting, you can choose from four different options when an untrusted program attempts to programmatically access an Address Book using the Outlook object model:\r\n\r\n- Prompt user - Users are prompted to approve every access attempt. \r\n- Automatically approve - Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended. \r\n- Automatically deny - Outlook will automatically deny programmatic access requests from any program.\r\n- Prompt user based on computer security - Outlook will rely on the setting in the ''Programmatic Access'' section of the Trust Center. This is the default behavior.\r\n\r\nIf you disable or do not configure this policy setting, when an untrusted application attempts to access the address book programmatically, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center. ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressbook_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressbook_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressbook_v2_l_oomaddressbook_setting","displayName":"Guard behavior: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressbook_v2_l_oomaddressbook_setting_1","displayName":"Prompt User","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressbook_v2_l_oomaddressbook_setting_2","displayName":"Automatically Approve","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressbook_v2_l_oomaddressbook_setting_0","displayName":"Automatically Deny","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomaddressbook_v2_l_oomaddressbook_setting_3","displayName":"Prompt user based on computer security","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomformula","displayName":"Configure Outlook object model prompt When accessing the Formula property of a UserProperty object (User) (Deprecated)","description":"This policy setting controls what happens when a user designs a custom form in Outlook and attempts to bind an Address Information field to a combination or formula custom field.\r\n\r\nIf you enable this policy setting, you can choose from four different options when an untrusted program attempts to access address information using the UserProperties. Find method of the Outlook object model: \r\n\r\n- Prompt user. The user will be prompted to approve every access attempt. \r\n- Automatically approve. Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended. \r\n- Automatically deny. Outlook will automatically deny programmatic access requests from any program. \r\n- Prompt user based on computer security. Outlook will only prompt users when antivirus software is out of date or not running. \r\n\r\nIf you disable or do not configure this policy setting, when a user tries to bind an address information field to a combination or formula custom field in a custom form, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center. ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomformula_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomformula_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomformula_l_oomformula_setting","displayName":"Guard behavior: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomformula_l_oomformula_setting_1","displayName":"Prompt User","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomformula_l_oomformula_setting_2","displayName":"Automatically Approve","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomformula_l_oomformula_setting_0","displayName":"Automatically Deny","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomformula_l_oomformula_setting_3","displayName":"Prompt user based on computer security","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomformula_v2","displayName":"Configure Outlook object model prompt When accessing the Formula property of a UserProperty object (User)","description":"This policy setting controls what happens when a user designs a custom form in Outlook and attempts to bind an Address Information field to a combination or formula custom field.\r\n\r\nIf you enable this policy setting, you can choose from four different options when an untrusted program attempts to access address information using the UserProperties. Find method of the Outlook object model: \r\n\r\n- Prompt user. The user will be prompted to approve every access attempt. \r\n- Automatically approve. Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended. \r\n- Automatically deny. Outlook will automatically deny programmatic access requests from any program. \r\n- Prompt user based on computer security. Outlook will only prompt users when antivirus software is out of date or not running. \r\n\r\nIf you disable or do not configure this policy setting, when a user tries to bind an address information field to a combination or formula custom field in a custom form, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center. ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomformula_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomformula_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomformula_v2_l_oomformula_setting","displayName":"Guard behavior: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomformula_v2_l_oomformula_setting_1","displayName":"Prompt User","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomformula_v2_l_oomformula_setting_2","displayName":"Automatically Approve","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomformula_v2_l_oomformula_setting_0","displayName":"Automatically Deny","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomformula_v2_l_oomformula_setting_3","displayName":"Prompt user based on computer security","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oommeetingtaskrequest","displayName":"Configure Outlook object model prompt when responding to meeting and task requests (User) (Deprecated)","description":"This policy setting controls what happens when an untrusted program attempts to programmatically send e-mail in Outlook using the Response method of a task or meeting request. \r\n\r\nIf you enable this policy setting, you can choose from four different options when an untrusted program attempts to programmatically send e-mail using the Response method of a task or meeting request:\r\n\r\n- Prompt user. The user will be prompted to approve every access attempt.\r\n- Automatically approve. Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended.\r\n- Automatically deny. Outlook will automatically deny programmatic access requests from any program. \r\n- Prompt user based on computer security. Outlook only prompts users when antivirus software is out of date or not running. This is the default configuration. \r\n\r\nIf you disable or do not configure this policy setting, when an untrusted application attempts to respond to tasks or meeting requests programmatically, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center. ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oommeetingtaskrequest_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oommeetingtaskrequest_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oommeetingtaskrequest_l_oommeetingtaskrequest_setting","displayName":"Guard behavior: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oommeetingtaskrequest_l_oommeetingtaskrequest_setting_1","displayName":"Prompt User","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oommeetingtaskrequest_l_oommeetingtaskrequest_setting_2","displayName":"Automatically Approve","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oommeetingtaskrequest_l_oommeetingtaskrequest_setting_0","displayName":"Automatically Deny","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oommeetingtaskrequest_l_oommeetingtaskrequest_setting_3","displayName":"Prompt user based on computer security","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oommeetingtaskrequest_v2","displayName":"Configure Outlook object model prompt when responding to meeting and task requests (User)","description":"This policy setting controls what happens when an untrusted program attempts to programmatically send e-mail in Outlook using the Response method of a task or meeting request. \r\n\r\nIf you enable this policy setting, you can choose from four different options when an untrusted program attempts to programmatically send e-mail using the Response method of a task or meeting request:\r\n\r\n- Prompt user. The user will be prompted to approve every access attempt.\r\n- Automatically approve. Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended.\r\n- Automatically deny. Outlook will automatically deny programmatic access requests from any program. \r\n- Prompt user based on computer security. Outlook only prompts users when antivirus software is out of date or not running. This is the default configuration. \r\n\r\nIf you disable or do not configure this policy setting, when an untrusted application attempts to respond to tasks or meeting requests programmatically, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center. ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oommeetingtaskrequest_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oommeetingtaskrequest_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oommeetingtaskrequest_v2_l_oommeetingtaskrequest_setting","displayName":"Guard behavior: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oommeetingtaskrequest_v2_l_oommeetingtaskrequest_setting_1","displayName":"Prompt User","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oommeetingtaskrequest_v2_l_oommeetingtaskrequest_setting_2","displayName":"Automatically Approve","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oommeetingtaskrequest_v2_l_oommeetingtaskrequest_setting_0","displayName":"Automatically Deny","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oommeetingtaskrequest_v2_l_oommeetingtaskrequest_setting_3","displayName":"Prompt user based on computer security","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsaveas","displayName":"Configure Outlook object model prompt when executing Save As (User) (Deprecated)","description":"This policy setting controls what happens when an untrusted program attempts to use the Save As command to programmatically save an item. \r\n\r\nIf you enable this policy setting, you can choose from four different options when an untrusted program attempts to use the Save As command to programmatically save an item:\r\n\r\n- Prompt user. The user will be prompted to approve every access attempt. \r\n- Automatically approve. Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended. \r\n- Automatically deny. Outlook will automatically deny programmatic access requests from any program.\r\n- Prompt user based on computer security. Outlook will only prompt users when antivirus software is out of date or not running. This is the default configuration.\r\n\r\nIf you disable or do not configure this policy setting, when an untrusted application attempts to use the Save As command, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsaveas_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsaveas_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsaveas_l_oomsaveas_setting","displayName":"Guard behavior: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsaveas_l_oomsaveas_setting_1","displayName":"Prompt User","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsaveas_l_oomsaveas_setting_2","displayName":"Automatically Approve","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsaveas_l_oomsaveas_setting_0","displayName":"Automatically Deny","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsaveas_l_oomsaveas_setting_3","displayName":"Prompt user based on computer security","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsaveas_v2","displayName":"Configure Outlook object model prompt when executing Save As (User)","description":"This policy setting controls what happens when an untrusted program attempts to use the Save As command to programmatically save an item. \r\n\r\nIf you enable this policy setting, you can choose from four different options when an untrusted program attempts to use the Save As command to programmatically save an item:\r\n\r\n- Prompt user. The user will be prompted to approve every access attempt. \r\n- Automatically approve. Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended. \r\n- Automatically deny. Outlook will automatically deny programmatic access requests from any program.\r\n- Prompt user based on computer security. Outlook will only prompt users when antivirus software is out of date or not running. This is the default configuration.\r\n\r\nIf you disable or do not configure this policy setting, when an untrusted application attempts to use the Save As command, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsaveas_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsaveas_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsaveas_v2_l_oomsaveas_setting","displayName":"Guard behavior: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsaveas_v2_l_oomsaveas_setting_1","displayName":"Prompt User","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsaveas_v2_l_oomsaveas_setting_2","displayName":"Automatically Approve","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsaveas_v2_l_oomsaveas_setting_0","displayName":"Automatically Deny","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsaveas_v2_l_oomsaveas_setting_3","displayName":"Prompt user based on computer security","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsend","displayName":"Configure Outlook object model prompt when sending mail (User) (Deprecated)","description":"This policy setting controls what happens when an untrusted program attempts to send e-mail programmatically using the Outlook object model. \r\n\r\nIf you enable this policy setting, you can choose from four different options when an untrusted program attempts to send e-mail programmatically using the Outlook object model: \r\n\r\n- Prompt user - The user will be prompted to approve every access attempt.\r\n- Automatically approve - Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended. \r\n- Automatically deny - Outlook will automatically deny programmatic access requests from any program. \r\n- Prompt user based on computer security. Outlook will only prompt users when antivirus software is out of date or not running. \r\n\r\nImportant: This policy setting only applies if the ''Outlook Security Mode'' policy setting under ''Microsoft Outlook 2016\\Security\\Security Form Settings'' is configured to ''Use Outlook Security Group Policy.''\r\n\r\nIf you disable or do not configure this policy setting, when an untrusted application attempts to send mail programmatically, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center. ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsend_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsend_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsend_l_oomsend_setting","displayName":"Guard behavior: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsend_l_oomsend_setting_1","displayName":"Prompt User","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsend_l_oomsend_setting_2","displayName":"Automatically Approve","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsend_l_oomsend_setting_0","displayName":"Automatically Deny","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsend_l_oomsend_setting_3","displayName":"Prompt user based on computer security","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsend_v2","displayName":"Configure Outlook object model prompt when sending mail (User)","description":"This policy setting controls what happens when an untrusted program attempts to send e-mail programmatically using the Outlook object model. \r\n\r\nIf you enable this policy setting, you can choose from four different options when an untrusted program attempts to send e-mail programmatically using the Outlook object model: \r\n\r\n- Prompt user - The user will be prompted to approve every access attempt.\r\n- Automatically approve - Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended. \r\n- Automatically deny - Outlook will automatically deny programmatic access requests from any program. \r\n- Prompt user based on computer security. Outlook will only prompt users when antivirus software is out of date or not running. \r\n\r\nImportant: This policy setting only applies if the ''Outlook Security Mode'' policy setting under ''Microsoft Outlook 2016\\Security\\Security Form Settings'' is configured to ''Use Outlook Security Group Policy.''\r\n\r\nIf you disable or do not configure this policy setting, when an untrusted application attempts to send mail programmatically, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center. ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsend_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsend_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsend_v2_l_oomsend_setting","displayName":"Guard behavior: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsend_v2_l_oomsend_setting_1","displayName":"Prompt User","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsend_v2_l_oomsend_setting_2","displayName":"Automatically Approve","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsend_v2_l_oomsend_setting_0","displayName":"Automatically Deny","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_oomsend_v2_l_oomsend_setting_3","displayName":"Prompt user based on computer security","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapinameresolve","displayName":"Configure Simple MAPI name resolution prompt (User)","description":"This policy setting allows you to specify what occurs when a program attempts to gain access to an Address Book, using Simple MAPI.\r\n\r\nIf you enable this policy setting, you can choose whether Outlook always allows access to the Address Book, always disallows access to the Address Book, or prompts the user to specify whether to allow or disallow access to the Address Book.\r\n\r\nIf you disable or do not configure this policy setting, Outlook prompts the user to specify whether to allow or disallow access to the Address Book.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapinameresolve_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapinameresolve_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapinameresolve_l_simplemapi_setting","displayName":"Guard behavior: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapinameresolve_l_simplemapi_setting_1","displayName":"Prompt User","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapinameresolve_l_simplemapi_setting_2","displayName":"Automatically Approve","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapinameresolve_l_simplemapi_setting_0","displayName":"Automatically Deny","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapiopenmessage","displayName":"Configure Simple MAPI message opening prompt (User)","description":"This policy setting allows you to specify what occurs when a program attempts to gain access to a recipient field, such as the “To” field, using Simple MAPI.\r\n\r\nIf you enable this policy setting, you can choose whether Outlook always allows access to the recipient field, always disallows access to the recipient field, or prompt users to specify whether to allow or disallow access to the recipient field.\r\n\r\nIf you disable or do not configure this policy setting, Outlook prompts users to specify whether to allow or disallow access to the Address Book.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapiopenmessage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapiopenmessage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapiopenmessage_l_simplemapi_setting","displayName":"Guard behavior: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapiopenmessage_l_simplemapi_setting_1","displayName":"Prompt User","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapiopenmessage_l_simplemapi_setting_2","displayName":"Automatically Approve","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapiopenmessage_l_simplemapi_setting_0","displayName":"Automatically Deny","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapisend","displayName":"Configure Simple MAPI sending prompt (User)","description":"This policy setting allows you to specify what occurs when a program attempts to send mail programmatically, using Simple MAPI.\r\n\r\nIf you enable this policy setting, you can choose whether Outlook always allows sending mail, always disables sending mail, or prompts users to specify whether to allow or disallow sending mail.\r\n\r\nIf you disable or do not configure this policy setting, Outlook prompts users to specify whether to allow or disallow sending the mail.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapisend_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapisend_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapisend_l_simplemapi_setting","displayName":"Guard behavior: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapisend_l_simplemapi_setting_1","displayName":"Prompt User","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapisend_l_simplemapi_setting_2","displayName":"Automatically Approve","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings_l_simplemapisend_l_simplemapi_setting_0","displayName":"Automatically Deny","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings~l_trustedaddins_l_settrustedaddins","displayName":"Configure trusted add-ins (User)","description":"This policy setting can be used to specify a list of trusted add-ins that can be run without being restricted by the security measures in Outlook.\r\n\r\nIf you enable this policy setting, a list of trusted add-ins and hashes is made available that you can modify by adding and removing entries. The list is empty by default. To create a new entry, enter a DLL file name in the ''Value Name'' column and the hash result in the ''Value'' column. \r\n\r\nIf you disable or do not configure this policy setting, the list of trusted add-ins is empty and unused, so the recommended EC and SSLF settings do not create any usability issues. However, users who rely on add-ins that access the Outlook object model might be repeatedly prompted unless administrators enable this setting and add the add-ins to the list.\r\n\r\nNote - You can also configure Exchange Security Form settings by enabling the ''Outlook Security Mode'' setting in User Configuration\\Administrative Templates\\Microsoft Outlook 2016\\Security\\Security Form Settings\\Microsoft Outlook 2016 Security and selecting ''Use Outlook Security Group Policy'' from the drop-down list.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings~l_trustedaddins_l_settrustedaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings~l_trustedaddins_l_settrustedaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings~l_trustedaddins_l_settrustedaddins_l_listoftrustedaddins","displayName":"List of trusted add-ins and hashes (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings~l_trustedaddins_l_settrustedaddins_l_listoftrustedaddins_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_securityformsettings~l_programmaticsettings~l_trustedaddins_l_settrustedaddins_l_listoftrustedaddins_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_applymacrosecuritysettings","displayName":"Apply macro security settings to macros, add-ins and additional actions (User)","description":"This policy setting controls whether Outlook also applies the macro security settings to installed COM add-ins and additional actions. \r\n\r\nIf you enable this policy setting, the macro security settings will also be applied to add-ins and additional actions. \r\n\r\nIf you disable or do not configure this policy setting, Outlook does not use the macro security settings to determine whether to run macros, installed COM add-ins, and additional actions.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_applymacrosecuritysettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_applymacrosecuritysettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_enablelinksinemailmessages","displayName":"Allow hyperlinks in suspected phishing e-mail messages (User) (Deprecated)","description":"This policy setting controls whether hyperlinks in suspected phishing e-mail messages in Outlook are allowed. \r\n\r\nIf you enable this policy setting, Outlook will allow hyperlinks in suspected phishing messages that are not also classified as junk e-mail. \r\n\r\nIf you disable or do not configure this policy setting, Outlook will not allow hyperlinks in suspected phishing messages, even if they are not classified as junk e-mail.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_enablelinksinemailmessages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_enablelinksinemailmessages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_enablelinksinemailmessages_v2","displayName":"Allow hyperlinks in suspected phishing e-mail messages (User)","description":"This policy setting controls whether hyperlinks in suspected phishing e-mail messages in Outlook are allowed. \r\n\r\nIf you enable this policy setting, Outlook will allow hyperlinks in suspected phishing messages that are not also classified as junk e-mail. \r\n\r\nIf you disable or do not configure this policy setting, Outlook will not allow hyperlinks in suspected phishing messages, even if they are not classified as junk e-mail.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_enablelinksinemailmessages_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_enablelinksinemailmessages_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_onsendaddinsenabled","displayName":"Disable send when web extensions can’t load. (User)","description":"If you enable this policy setting, Outlook won’t allow email and meeting requests to be sent until web add-ins are loaded from Exchange.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_onsendaddinsenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_onsendaddinsenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookactivationalertthreshold","displayName":"Specify activation disabling threshold for web extensions (User)","description":"This policy setting allows you to specify the threshold that Outlook refers to before disabling a web extension during activation. \r\n\r\nIf you enable this policy setting, you can specify a threshold (in milliseconds) for the activation manager retry limit during an Outlook session. If the web extension requires more than the specified threshold for the number of occurrences specified by the activation manager retry limit during an Outlook session, Outlook disables the web extension. \r\n\r\nIf you disable or do not configure this policy setting, Outlook uses the default activation alert threshold of 1000 milliseconds. The maximum activation alert threshold is 10000 milliseconds, and the minimum activation alert threshold is 100 milliseconds.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookactivationalertthreshold_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookactivationalertthreshold_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookactivationalertthreshold_l_outlookactivationalertthresholdspinid","displayName":"(100 - 10000 milliseconds) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookactivationmanagerretrylimit","displayName":"Specify activation manager retry limit for web extensions (User)","description":"This policy setting allows you to specify the retry limit Outlook uses before disabling a web extension during activation.\r\n\r\nIf you enable this policy setting, you can specify the activation manager retry limit. If the web extension requires more than the specified activation alert threshold for the number of occurrences specified by the activation manager retry limit during an Outlook session, Outlook automatically disables the web extension. \r\n\r\nIf you disable or do not configure this policy setting, Outlook uses the default activation manager retry limit of 3 occurrences. The maximum activation manager retry limit is 5 occurrences, and the minimum activation manager retry limit is 1 occurrence.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookactivationmanagerretrylimit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookactivationmanagerretrylimit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookactivationmanagerretrylimit_l_outlookactivationmanagerretrylimitspinid","displayName":"(1 - 5 occurrences) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookalertinterval","displayName":"Specify alert interval for web extensions (User)","description":"This policy setting allows you to specify the alert interval Outlook uses before disabling a web extension during initialization. The alert interval controls how often Office checks on memory and CPU usage for a running web extension. \r\n\r\nIf you enable this policy setting, you can specify the alert interval for web extensions. If the web extension requires more than the specified memory alert threshold when the memory or CPU check occurs, Outlook disables the web extension. \r\n\r\nIf you disable or do not configure this policy setting, Outlook uses the default alert interval of 5 seconds. This alert interval overrides the WEF alert interval. The maximum alert interval is 600 seconds, and the minimum alert interval is 5 seconds.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookalertinterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookalertinterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookalertinterval_l_outlookalertintervalspinid","displayName":"(5 - 600 seconds) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookmemoryalertthreshold","displayName":"Specify Outlook memory alert threshold for web extensions (User)","description":"This policy setting allows you to specify the memory usage limit Outlook uses before disabling a web extension during initialization. The memory alert threshold controls the maximum amount of virtual memory that can be used by a running web extension.\r\n\r\nIf you enable this policy setting, you can specify the memory alert threshold for web extensions. If the web extension requires more than the specified memory alert threshold when a memory or CPU check occurs, Outlook disables the web extension.\r\n\r\nIf you disable or do not configure this policy setting, Outlook uses the default memory usage limit of 1500 MB. This memory alert threshold overrides the WEF memory alert threshold. The maximum memory alert threshold is 1500 MB, and the minimum memory alert threshold is 1 MB.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookmemoryalertthreshold_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookmemoryalertthreshold_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookmemoryalertthreshold_l_outlookmemoryalertthresholdspinid","displayName":"(1 - 1500 MB) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookrestartmanagerretrylimit","displayName":"Specify the number of restarts attempted for a running web extension (User)","description":"This policy setting allows you to specify the number of restarts Outlook attempts for a running web extension.\r\n\r\nIf you enable this policy setting, you can specify the number of restarts Outlook attempts for a running web extension. If the web extension requires more than the specified number of restarts during an Outlook session, Outlook disables the web extension.\r\n\r\nIf you disable or do not configure this policy setting, Outlook uses the default restart limit of 3 occurrences. The maximum restart limit is 10 occurrences, and the minimum restart limit is 1 occurrence.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookrestartmanagerretrylimit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookrestartmanagerretrylimit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_outlookrestartmanagerretrylimit_l_outlookrestartmanagerretrylimitspinid","displayName":"(1 - 10 occurrences) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_securityleveloutlook","displayName":"Security setting for macros (User) (Deprecated)","description":"This policy setting controls the security level for macros in Outlook. \r\n\r\nIf you enable this policy setting, you can choose from four options for handling macros in Outlook: \r\n\r\n- Always warn. This option corresponds to the \"Warnings for all macros\" option in the \"Macro Security\" section of the Outlook Trust Center. Outlook disables all macros that are not opened from a trusted location, even if the macros are signed by a trusted publisher. For each disabled macro, Outlook displays a security alert dialog box with information about the macro and its digital signature (if present), and allows users to enable the macro or leave it disabled. \r\n\r\n- Never warn, disable all. This option corresponds to the \"No warnings and disable all macros\" option in the Trust Center. Outlook disables all macros that are not opened from trusted locations, and does not notify users. \r\n\r\n- Warning for signed, disable unsigned. This option corresponds to the \"Warnings for signed macros; all unsigned macros are disabled\" option in the Trust Center. Outlook handles macros as follows: \r\n\r\n--If a macro is digitally signed by a trusted publisher, the macro can run if the user has already trusted the publisher. \r\n\r\n--If a macro has a valid signature from a publisher that the user has not trusted, the security alert dialog box for the macro lets the user choose whether to enable the macro for the current session, disable the macro for the current session, or to add the publisher to the Trusted Publishers list so that it will run without prompting the user in the future. \r\n\r\n--If a macro does not have a valid signature, Outlook disables it without prompting the user, unless it is opened from a trusted location. \r\n\r\nThis option is the default configuration in Outlook. \r\n\r\n- No security check. This option corresponds to the \"No security check for macros (Not recommended)\" option in the Trust Center. Outlook runs all macros without prompting users. This configuration makes users' computers vulnerable to potentially malicious code and is not recommended. \r\n\r\nIf you disable or do not configure this policy setting, the behavior is the equivalent of Enabled -- Warning for signed, disable unsigned.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_securityleveloutlook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_securityleveloutlook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_securityleveloutlook_l_securitylevel","displayName":"Security Level (User) (Deprecated)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_securityleveloutlook_l_securitylevel_2","displayName":"Always warn","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_securityleveloutlook_l_securitylevel_4","displayName":"Never warn, disable all","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_securityleveloutlook_l_securitylevel_3","displayName":"Warn for signed, disable unsigned","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_securityleveloutlook_l_securitylevel_1","displayName":"No security check","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_securityleveloutlook_v2","displayName":"Security setting for macros (User)","description":"This policy setting controls the security level for macros in Outlook. \r\n\r\nIf you enable this policy setting, you can choose from four options for handling macros in Outlook: \r\n\r\n- Always warn. This option corresponds to the \"Warnings for all macros\" option in the \"Macro Security\" section of the Outlook Trust Center. Outlook disables all macros that are not opened from a trusted location, even if the macros are signed by a trusted publisher. For each disabled macro, Outlook displays a security alert dialog box with information about the macro and its digital signature (if present), and allows users to enable the macro or leave it disabled. \r\n\r\n- Never warn, disable all. This option corresponds to the \"No warnings and disable all macros\" option in the Trust Center. Outlook disables all macros that are not opened from trusted locations, and does not notify users. \r\n\r\n- Warning for signed, disable unsigned. This option corresponds to the \"Warnings for signed macros; all unsigned macros are disabled\" option in the Trust Center. Outlook handles macros as follows: \r\n\r\n--If a macro is digitally signed by a trusted publisher, the macro can run if the user has already trusted the publisher. \r\n\r\n--If a macro has a valid signature from a publisher that the user has not trusted, the security alert dialog box for the macro lets the user choose whether to enable the macro for the current session, disable the macro for the current session, or to add the publisher to the Trusted Publishers list so that it will run without prompting the user in the future. \r\n\r\n--If a macro does not have a valid signature, Outlook disables it without prompting the user, unless it is opened from a trusted location. \r\n\r\nThis option is the default configuration in Outlook. \r\n\r\n- No security check. This option corresponds to the \"No security check for macros (Not recommended)\" option in the Trust Center. Outlook runs all macros without prompting users. This configuration makes users' computers vulnerable to potentially malicious code and is not recommended. \r\n\r\nIf you disable or do not configure this policy setting, the behavior is the equivalent of Enabled -- Warning for signed, disable unsigned.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_securityleveloutlook_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_securityleveloutlook_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_securityleveloutlook_v2_l_securitylevel","displayName":"Security Level (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_securityleveloutlook_v2_l_securitylevel_2","displayName":"Always warn","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_securityleveloutlook_v2_l_securitylevel_4","displayName":"Never warn, disable all","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_securityleveloutlook_v2_l_securitylevel_3","displayName":"Warn for signed, disable unsigned","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_security~l_trustcenter_l_securityleveloutlook_v2_l_securitylevel_1","displayName":"No security check","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_accountsettingsemail_l_preventsavingcredentialsforbasicauthenticationpolicy","displayName":"Prevent saving credentials for Basic Authentication policy (User)","description":"This policy setting allows you to prevent Outlook from saving user credentials using Basic Authentication.\r\n\r\nIf you enable this policy setting, Outlook will not save user credentials using Basic Authentication.\r\n\r\nIf you disable or do not configure this policy setting, Outlook will allow the user to save credentials when using Basic Authentication against a server. These credentials are stored as generic and retrievable by any process running with that user's rights on the machine.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_accountsettingsemail_l_preventsavingcredentialsforbasicauthenticationpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_accountsettingsemail_l_preventsavingcredentialsforbasicauthenticationpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_accountsettingsemail_l_specifyofflineaddressbookpath","displayName":"Specify Offline Address Book path (User)","description":"This policy setting allows you to specify a path to save the Offline Address Book. This policy setting will apply to all Microsoft Exchange accounts.\r\n\r\nIf you enable this policy setting, you may specify a path to save the Offline Address Book.\r\n\r\nIf you disable or do not configure this policy setting, Outlook will save the Offline Address Book in %LOCALAPPDATA%\\Microsoft\\Outlook.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_accountsettingsemail_l_specifyofflineaddressbookpath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_accountsettingsemail_l_specifyofflineaddressbookpath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_accountsettingsemail_l_specifyofflineaddressbookpath_l_specifyofflineaddressbookpathid","displayName":"Offline Address Book path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_eas_l_eassyncfrequency","displayName":"EAS Sync Frequency (User)","description":"This policy setting allows you to specify the number of minutes that Outlook automatically syncs the users' Exchange ActiveSync (EAS) accounts.\r\n\r\nIf you enable this policy setting, you can specify the number of minutes.\r\n\r\nIf you disable or do not configure this policy setting, Outlook automatically syncs the users’ EAS accounts every 59 minutes.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_eas_l_eassyncfrequency_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_eas_l_eassyncfrequency_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_eas_l_eassyncfrequency_l_eassyncfrequencyintervalspinid","displayName":"Synchronization interval (in minutes): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_automaticallyconfigureprofilebasedonactive","displayName":"Automatically configure profile based on Active Directory Primary SMTP address (User)","description":"Automatically configure only the first profile based on Active Directory primary SMTP address\r\n\r\nThis policy setting controls whether users who are joined to a domain in an Active Directory environment can change the primary SMTP address that is used when they set up an account in Outlook.\r\n\r\nIf this policy setting is enabled, users can enter a profile name to create a new profile without using the new account wizard. A user interface does not appear as the profile is created.\r\n\r\nThis key will be ignored after the first profile has been successfully created.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_automaticallyconfigureprofilebasedonactive_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_automaticallyconfigureprofilebasedonactive_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_automaticallyconfigureprofilebasedonactiveonce","displayName":"Automatically configure only the first profile based on Active Directory primary SMTP address (User)","description":"Automatically configure profile based on Active Directory Primary SMTP address once\r\n\r\nThis policy setting controls whether users who are joined to a domain in an Active Directory environment can change the primary SMTP address that is used when they set up accounts in Outlook.\r\n\r\nIf this policy setting is enabled, users can create a new profile by entering a profile name. The profile is created without using the New Account wizard. No user interface appears as the profile is created. \r\n\r\nThis key will be ignored after the first profile has been successfully created.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_automaticallyconfigureprofilebasedonactiveonce_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_automaticallyconfigureprofilebasedonactiveonce_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_cachedexchangelowbandwidththreshold","displayName":"Cached Exchange low bandwidth threshold (User)","description":"Specifies the bit rate threshold value. If the bit rate of the active network connection is below this value, Outlook identifies the network connection as a \"slow\" connection and operates accordingly (for example, downloading headers instead of full messages).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_cachedexchangelowbandwidththreshold_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_cachedexchangelowbandwidththreshold_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_cachedexchangelowbandwidththreshold_l_enterthebitratekbps128k128thresholdtodetectlowbandwidth2","displayName":"(0 - 1,000,000 kbps) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_disablechangingfolderpermissions","displayName":"Do not allow users to change permissions on folders (User)","description":"This policy setting prevents users from changing their mail folder permissions. \r\n\r\nIf you enable this policy setting, Outlook users cannot change permissions on folders; the settings on the Permissions tab are disabled. Enabling this policy setting does not affect existing permissions, and users can still change permissions by sending a sharing message.\r\n\r\nIf you disable or do not configure this policy setting, Outlook users can change the permissions for folders under their control by using the Permissions tab of the Properties dialog box for the folder.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_disablechangingfolderpermissions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_disablechangingfolderpermissions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_disableexchangeconsumeraccounts","displayName":"Prevent personal Microsoft accounts from using MAPI (User)","description":"This policy setting governs whether personal Microsoft accounts can be configured to use MAPI in Outlook.\r\n\r\nA personal Microsoft account is an account hosted on Outlook.com, Hotmail.com, Live.com, Msn.com or any variation on those domains.\r\n\r\nIf you enable this policy, users won’t be able to configure a personal Microsoft account to use MAPI in Outlook.\r\n\r\nThis means that in the Add Account dialog box in Outlook, users must choose “Manual setup or additional server types,” then choose Next, and then choose “POP or IMAP.”\r\n\r\nIf you disable or don’t configure this policy setting, users can configure a personal Microsoft account to use MAPI in Outlook. They can do this by choosing “E-mail” account in the Add Account dialog box.\r\n\r\nNote that personal Microsoft accounts that are configured to use MAPI will be automatically configured to use Cached Exchange Mode, and this can’t be changed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_disableexchangeconsumeraccounts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_disableexchangeconsumeraccounts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_disablerpctransportfallback","displayName":"Disable connection fallback between protocols (User)","description":"This policy setting allows you to control the connection transport fallback behavior in Outlook when it attempts to connect to a Microsoft Exchange Server.\r\n \r\nThis policy setting applies if you are using Outlook Anywhere (RPC over HTTP) to connect to a Microsoft Exchange Server. There are two Outlook profile settings on the Microsoft Exchange Proxy Settings dialog box (accessed through the Control Panel or Account Settings), that configure the default connection transport fallback behavior.\r\n \r\n- On fast networks, connect using HTTP first, then connect using TCP/IP\r\n- On slow networks, connect using HTTP first, then connect using TCP/IP\r\n \r\nFor example, if you are on a fast network and you enable the “On fast networks, connect using HTTP first, then connect using TCP/IP” setting in the Microsoft Exchange Proxy Settings dialog box, Outlook first attempts to connect to the Exchange Server using HTTP. If Outlook is unable to connect using HTTP, then it attempts to connect using TCP/IP.\r\n \r\nIf you enable this policy setting, if Outlook connection attempts with Microsoft Exchange Server fail, Outlook does not fallback to the TCP/IP protocol, regardless of what is specified in the Microsoft Exchange Proxy Settings dialog box. \r\n\r\nIf you disable or do not configure this policy setting, Outlook connection attempts with Microsoft Exchange Server can fallback from either TCP/IP to HTTP, or HTTP to TCP/IP, depending on the settings specified in the Microsoft Exchange Proxy Settings dialog box.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_disablerpctransportfallback_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_disablerpctransportfallback_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_donotcreatenewostonupgrade","displayName":"Do not create new OST file on upgrade (User)","description":"This policy setting controls whether Outlook creates a new OST file when you upgrade to Outlook 2016. The new OST file uses less space on the disk. When a new OST file is created, the contents from the previous version of Outlook are downloaded from the Exchange Server.\r\n\r\nIf you enable this policy setting, Outlook continues to use the existing OST file created by the installed earlier version of Outlook. \r\n\r\nIf you disable or do not configure this policy setting, when you upgrade to Outlook 2016, a new OST file is created, and the contents from the installed earlier version of Outlook are downloaded from the Exchange server.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_donotcreatenewostonupgrade_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_donotcreatenewostonupgrade_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_enableexchangeoverinternetuserinterface","displayName":"Configure Outlook Anywhere user interface options (User)","description":"This policy setting allows you to determine whether users can view and change user interface (UI) options for Outlook Anywhere.\r\n\r\nIf you enable this policy setting, users can view and change UI options for Outlook Anywhere.\r\n\r\nIf you disable or do not configure this policy setting, users will be able to use the Outlook Anywhere feature, but they will not be able to view or change UI options for it.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_enableexchangeoverinternetuserinterface_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_enableexchangeoverinternetuserinterface_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_enableexchangeoverinternetuserinterface_l_chooseuistatewhenoscansupportfeature","displayName":"Choose UI State when OS can support feature: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_enableexchangeoverinternetuserinterface_l_chooseuistatewhenoscansupportfeature_0","displayName":"Hidden","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_enableexchangeoverinternetuserinterface_l_chooseuistatewhenoscansupportfeature_1","displayName":"All config UI enabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_enableexchangeoverinternetuserinterface_l_chooseuistatewhenoscansupportfeature_2","displayName":"Enable only On/Off control but not config UI","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_enableexchangeoverinternetuserinterface_l_chooseuistatewhenoscansupportfeature_3","displayName":"Enable config UI when settings are pre-deployed","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_enableexchangeoverinternetuserinterface_l_chooseuistatewhenoscansupportfeature_4","displayName":"Disable but show all config UI","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_enablerpcencryption","displayName":"Enable RPC encryption (User) (Deprecated)","description":"This policy setting controls whether Outlook uses remote procedure call (RPC) encryption to communicate with Microsoft Exchange servers. \r\n\r\nIf you enable this policy setting, Outlook uses RPC encryption when communicating with an Exchange server. Note - RPC encryption only encrypts the data from the Outlook client computer to the Exchange server. It does not encrypt the messages themselves as they traverse the Internet. \r\n\r\nIf you disable or do not configure this policy setting, RPC encryption is still used by default. This setting allows you to override the corresponding per-profile setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_enablerpcencryption_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_enablerpcencryption_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_enablerpcencryption_v2","displayName":"Enable RPC encryption (User)","description":"This policy setting controls whether Outlook uses remote procedure call (RPC) encryption to communicate with Microsoft Exchange servers. \r\n\r\nIf you enable this policy setting, Outlook uses RPC encryption when communicating with an Exchange server. Note - RPC encryption only encrypts the data from the Outlook client computer to the Exchange server. It does not encrypt the messages themselves as they traverse the Internet. \r\n\r\nIf you disable or do not configure this policy setting, RPC encryption is still used by default. This setting allows you to override the corresponding per-profile setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_enablerpcencryption_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_enablerpcencryption_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_exchangeunicodemodeignoreostformat","displayName":"Exchange Unicode Mode - Ignore OST Format (User)","description":"This policy setting allows you to specify whether existing OST format determines the mailbox mode.\r\n\r\nIf you enable this policy setting, you may choose one of these options:\r\n\r\n* OST Format determines mode: the format of the user's OST file will be used to determine whether to run in Unicode or ANSI mode.\r\n* Create new OST if format doesn't match mode: create a new OST file if needed.\r\n* Prompt to create new OST if format doesn't match mode\r\n\r\nIf you disable or do not configure this policy setting, you will not be able to specify whether existing OST format determines the mailbox mode.\r\n\r\nThis policy is ignored if PreferANSI is not set and the OST is enabled but either does not exist or is a Unicode OST, because it would be impossible for the user to create an ANSI OST.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_exchangeunicodemodeignoreostformat_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_exchangeunicodemodeignoreostformat_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_exchangeunicodemodeignoreostformat_l_choosewhetherexistingostformatdeterminesmailboxmode","displayName":"Choose whether existing OST format determines mailbox mode (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_exchangeunicodemodeignoreostformat_l_choosewhetherexistingostformatdeterminesmailboxmode_0","displayName":"OST Format determines mode","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_exchangeunicodemodeignoreostformat_l_choosewhetherexistingostformatdeterminesmailboxmode_1","displayName":"Create new OST if format doesn't match mode","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_exchangeunicodemodeignoreostformat_l_choosewhetherexistingostformatdeterminesmailboxmode_2","displayName":"Prompt to create new OST if format doesn't match mode","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_exchangeunicodemodesilentostformatchange","displayName":"Exchange Unicode Mode - Silent OST format change (User)","description":"This policy setting allows .OST files to silently update to Unicode format from ANSI.\r\n\r\nIf you enable this policy setting, it will only have meaning if the related policy setting \"Exchange Unicode Mode - Ignore OST format\" is enabled and set to the options listed below.\r\n\r\nThe behavior is as follows -\r\n\r\n\"Ignore OST Format\" policy setting is enabled and set to \"Create new OST if format doesn't match mode\"; \"Silent OST Format Change\" policy setting is enabled:\r\nIf Outlook detects a mode that is different than the current .OST mode, then a new .OST is created without prompting the user.\r\n\r\n\"Ignore OST Format\" policy setting is enabled and set to \"Prompt to create new OST if format doesn't match mode\"; \"Silent OST Format Change\" policy setting is enabled:\r\nIf Outlook detects a mode that is different than the current .OST mode, the user is prompted to allow a delay in the conversion to the mode set by policy. By clicking Ok, a new OST is created without a prompt for a new .OST name.\r\n\r\nIf you disable or do not configure this policy setting, users will be prompted to enter a new name for the updated .OST file.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_exchangeunicodemodesilentostformatchange_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_exchangeunicodemodesilentostformatchange_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_exchangeunicodemodeturnoffansi","displayName":"Exchange Unicode Mode - Turn off ANSI mode (User)","description":"This policy setting controls the creation of ANSI OST files.\r\n\r\nIf you enable or do not configure this policy setting, new ANSI OST files cannot be created.\r\n\r\nIf you disable this policy setting, all new OST files for an Outlook profile are created in ANSI format.\r\n\r\nProfiles with multiple Exchange accounts will always create Unicode OST files, regardless of this policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_exchangeunicodemodeturnoffansi_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_exchangeunicodemodeturnoffansi_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_foldersizedisplay","displayName":"Do not display Folder Size button on folder properties dialog box (User)","description":"Retains/Removes the \"Folder Size\" button in the General tab of the Properties dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_foldersizedisplay_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_foldersizedisplay_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_ostcreation","displayName":"Do not allow an OST file to be created (User)","description":"Prevents offline folder use at startup. This is equivalent to clicking the Disable Offline Use button in the Offline Folder Settings dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_ostcreation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_ostcreation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover","displayName":"Disable AutoDiscover (User)","description":"This policy setting allows you to disable AutoDiscover.\r\n\r\nIf you enable this policy setting, you can select one or more of the following options to disable in the AutoDiscover feature.\r\n\r\n\"Exclude the last known good URL” – Outlook does not use the last known good Autodiscover URL.\r\n\r\n\"Exclude the SCP object lookup\" – Outlook does not perform Active Directory queries for Service Connection Point (SCP) objects with Autodiscover information.\r\n\r\n\"Exclude the root domain query based on your primary SMTP address\" - Outlook does not use the root domain of your primary SMTP address to locate the AutoDiscover service. For example, you select this optionOutlook does not use the following URL: https:///autodiscover/autodiscover.xml.\r\n\r\n\"Exclude the query for the AutoDiscover domain\" - Outlook does not use the Autodiscover domain to locate the Autodiscover service. For example, Outlook does not use the following URL: https://autodiscover./autodiscover/autodiscover.xml\r\n\r\n\"Exclude the HTTP redirect method\" - Outlook does not use the HTTP redirect method in the event it is unable to reach the AutoDiscover service via either of the HTTPS URLs: https:///autodiscover/autodiscover.xml or https://autodiscover./autodiscover/autodiscover.xml.\r\n\r\n\"Exclude the SRV record query in DNS\" - Outlook does not use an SRV record lookup in DNS to locate the AutoDiscover service.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_l_outlookdisableautodiscoverautodiscoversubdomain","displayName":"Exclude the query for the AutoDiscover domain (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_l_outlookdisableautodiscoverautodiscoversubdomain_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_l_outlookdisableautodiscoverautodiscoversubdomain_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_l_outlookdisableautodiscoverhttpredirect","displayName":"Exclude the HTTP redirect method (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_l_outlookdisableautodiscoverhttpredirect_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_l_outlookdisableautodiscoverhttpredirect_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_l_outlookdisableautodiscoverlkgurl","displayName":"Exclude the last known goode URL (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_l_outlookdisableautodiscoverlkgurl_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_l_outlookdisableautodiscoverlkgurl_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_l_outlookdisableautodiscoverrootdomain","displayName":"Exclude the root domain query based on your primary SMTP address (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_l_outlookdisableautodiscoverrootdomain_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_l_outlookdisableautodiscoverrootdomain_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_l_outlookdisableautodiscoverscplookup","displayName":"Exclude the SCP object lookup (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_l_outlookdisableautodiscoverscplookup_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_l_outlookdisableautodiscoverscplookup_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_l_outlookdisableautodiscoversrvrecord","displayName":"Exclude the SRV record query in DNS (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_l_outlookdisableautodiscoversrvrecord_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookdisableautodiscover_l_outlookdisableautodiscoversrvrecord_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_personaldistributionlistsexchangeonly","displayName":"Do not validate personal Contact Groups when sending e-mail messages (User)","description":"Use only the local cache to obtain current user information when expanding a Personal Contact Group while sending e-mail","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_personaldistributionlistsexchangeonly_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_personaldistributionlistsexchangeonly_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_preventcopyingormovingitemsbetweenaccounts","displayName":"Prevent copying or moving items between accounts (User)","description":"This policy setting allows you to prevent items from being copied or moved to other accounts or PSTs.\r\n\r\nIf you enable this policy setting, items will be prevented from being moved or copied to other accounts or PSTs. Enter one of the following details:\r\n\r\n- \"Contoso.com\": prevents copying or moving from the account corresponding to the listed domain\r\n- \"*\": prevents copying from all accounts and PST's\r\n- \"SharePoint\": prevents copies or moves from the SharePoint PST\r\n\r\nIf you disable or do not configure this policy setting, copying or moving items between accounts or PSTs is allowed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_preventcopyingormovingitemsbetweenaccounts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_preventcopyingormovingitemsbetweenaccounts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_preventcopyingormovingitemsbetweenaccounts_l_preventcopyingormovingitemsbetweenaccountsid","displayName":"SMTP address domain (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_preventnondefaultexchangeaccounts","displayName":"Prevent adding non-default Exchange accounts (User)","description":"This policy allows you to prevent users from adding non-default Exchange accounts to existing Outlook profiles.\r\n\r\nIf you enable this policy setting, you will prevent users from adding non-default Exchange accounts via the Add New E-mail Account wizard.\r\n\r\nIf you disable or do not configure this policy setting, users can add non-default Exchange accounts to existing Outlook profiles.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_preventnondefaultexchangeaccounts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_preventnondefaultexchangeaccounts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpchttpconnectionflags","displayName":"RPC/HTTP Connection Flags (User)","description":"This policy setting configures connection options for Outlook Anywhere. \r\n\r\nIf you enable this policy setting, you can configure multiple connection options by selecting the flag in the drop down menu that contains the combination of settings you need. The following flags are available: \r\n\r\nIf you disable or do not configure this policy setting, Outlook uses the settings specified in Autodiscover.\r\n\r\nFlag 1: Enables the 'Connect to Microsoft Exchange using HTTP checkbox' on the Connection tab. \r\n\r\nThe following flags configure options in the Microsoft Exchange Proxy Settings dialog box: \r\n\r\nFlag 2: Enables the 'Connect using SSL only' checkbox \r\nFlag 3: Enables the 'Only connect to proxy servers that have this principal name in their certificate' checkbox \r\nFlag 4: Enables the 'On fast networks, connect using HTTP first, then connect using TCP/IP' checkbox \r\nFlag 5: Enables the 'On slow networks, connect using HTTP first, then connect using TCP/IP' checkbox \r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpchttpconnectionflags_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpchttpconnectionflags_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpchttpconnectionflags_l_selectrpchttpconnectionflags","displayName":"Select a combination of RPC/HTTP connection flags (see Explain tab for details): (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpchttpconnectionflags_l_selectrpchttpconnectionflags_0","displayName":"No Flags","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpchttpconnectionflags_l_selectrpchttpconnectionflags_47","displayName":"Flags: 1 + 2 + 3 + 4 + 5","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpchttpconnectionflags_l_selectrpchttpconnectionflags_39","displayName":"Flags: 1 + 2 + 3 + 5","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpchttpconnectionflags_l_selectrpchttpconnectionflags_43","displayName":"Flags: 1 + 2 + 4 + 5","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpchttpconnectionflags_l_selectrpchttpconnectionflags_35","displayName":"Flags: 1 + 2 + 5","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpchttpconnectionflags_l_selectrpchttpconnectionflags_41","displayName":"Flags: 1 + 4 + 5","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpchttpconnectionflags_l_selectrpchttpconnectionflags_33","displayName":"Flags: 1 + 5","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpcproxyauthenticationsetting","displayName":"RPC Proxy Authentication Setting (User)","description":"This policy setting determines the RPC proxy authentication setting for Outlook Anywhere.\r\n \r\nIf you enable this policy setting, you can specify the proxy authentication setting that Outlook uses, and this overrides any proxy authentication setting specified in Autodiscover.\r\n\r\nIf you do not configure this policy setting Outlook uses the proxy server authentication specified in Autodiscover.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpcproxyauthenticationsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpcproxyauthenticationsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpcproxyauthenticationsetting_l_selectrpcproxyauthentication","displayName":"Authentication used to connect with the proxy server: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpcproxyauthenticationsetting_l_selectrpcproxyauthentication_1","displayName":"Basic","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpcproxyauthenticationsetting_l_selectrpcproxyauthentication_2","displayName":"NTLM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpcproxyauthenticationsetting_l_selectrpcproxyauthentication_16","displayName":"Negotiate","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpcproxyauthenticationsetting_l_selectrpcproxyauthentication_65536","displayName":"Certificate","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpcproxyservername","displayName":"RPC Proxy Server Name (User)","description":"This policy setting determines the RPC proxy server that Outlook Anywhere uses when connecting to Exchange.\r\n \r\nIf you enable this policy setting, Outlook uses only the RPC proxy server that you specify when connecting to Exchange. It ignores the proxy server specified in Autodiscover.\r\n\r\nIf you disable or do not configure this policy setting Outlook uses the RPC proxy server that is specified in Autodiscover.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpcproxyservername_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpcproxyservername_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpcproxyservername_l_rpcproxyservernametextid","displayName":"Specify the proxy server name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpcproxyserverprincipalname","displayName":"Only connect if Proxy Server certificate has this principal name (User)","description":"This policy setting specifies the required certificate principal name for the RPC proxy server for Outlook Anywhere. \r\n\r\nIf you enable this policy setting, you must enter a server principal name. You must precede the server name with \"msstd:\" for this configuration to work. For example, you would enter the following text if the server principal name is mail.fourthcoffee.com: \r\n\r\nmsstd:mail.fourthcoffee.com \r\n\r\nIf you disable or do not configure this setting, Outlook uses the certificate principal name that is specified in Autodiscover.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpcproxyserverprincipalname_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpcproxyserverprincipalname_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_rpcproxyserverprincipalname_l_rpcproxyserverprincipalnametextid","displayName":"Specify the proxy server principal name (see Explain tab for details): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_setmaximumnumberofexchangeaccounts","displayName":"Set maximum number of Exchange accounts per profile (User)","description":"This policy setting allows you to set the maximum number of Exchange accounts allowed per Outlook profile.\r\n\r\nIf you enable this policy setting, you will be able to set the maximum number of Exchange accounts allowed per Outlook profile.\r\n\r\nIf you disable or do not configure this policy setting, the default maximum number of Exchange accounts allowed per Outlook profile is 10.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_setmaximumnumberofexchangeaccounts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_setmaximumnumberofexchangeaccounts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_setmaximumnumberofexchangeaccounts_l_setmaximumnumberofexchangeaccountsspinid","displayName":"Number of Accounts: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_synchronizingdatainsharedfolders","displayName":"Synchronizing data in shared folders (User)","description":"This setting controls the number of days that elapses without a user accessing an Outlook folder before Outlook stops synchronizing the folder with Exchange. For example, say this option is set to 45. User A opens User B's calendar in Outlook, and then does not click on it again for 45 days. Outlook stops synchronizing the data with Exchange and the calendar is no longer up-to-date. The local copy of the data is removed from the OST file. If User A then clicks on the User B calendar 90 days later, Outlook synchronizes the calendar data and starts the clock again for 45 days.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_synchronizingdatainsharedfolders_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_synchronizingdatainsharedfolders_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_synchronizingdatainsharedfolders_l_numberofdays","displayName":"Number of days (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_turnoffhierarchicaladdressbook","displayName":"Turn off Hierarchical Address Book (User)","description":"This policy setting turns off the Hierarchical Address Book (HAB).\r\n\r\nIf you enable this policy setting, the HAB will be turned off. \r\n\r\nIf you disable or do not configure this policy setting, the HAB will be displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_turnoffhierarchicaladdressbook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_turnoffhierarchicaladdressbook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_turnoffhierarchicaladdressbookdepartmentselection","displayName":"Turn off Hierarchical Address Book department selection (User)","description":"This policy setting controls whether departments can be picked as recipients in the Hierarchical Address Book (HAB).\r\n\r\nIf you enable this policy setting, the tree control to pick departments as recipients is turned off in the HAB.\r\n\r\nIf you disable or do not configure this policy setting, the tree control to pick departments as recipients is turned on in the HAB.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_turnoffhierarchicaladdressbookdepartmentselection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_turnoffhierarchicaladdressbookdepartmentselection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_turnoffhierarchicaladdressbooksearch","displayName":"Turn off Hierarchical Address Book search (User)","description":"This policy setting controls entry points to search in the Hierarchical Address Book (HAB).\r\n\r\nIf you enable this policy setting, all entry points to search features in the HAB will be turned off. \r\n\r\nIf you disable or do not configure this policy setting, all entry points to search features in the HAB will be enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_turnoffhierarchicaladdressbooksearch_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_turnoffhierarchicaladdressbooksearch_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_uselegacyoutlookauthenticationdialogs","displayName":"Use legacy Change Password authentication dialog boxes (User)","description":"By default, Outlook displays the Windows authentication dialog box when users are prompted to change their passwords. By enabling this setting, you can change this behavior so that older-style Outlook dialog boxes that include the Change Password button are displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_uselegacyoutlookauthenticationdialogs_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_uselegacyoutlookauthenticationdialogs_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_cachedexchangemodefilecachedexchangemode","displayName":"Cached Exchange Mode (File | Cached Exchange Mode) (User)","description":"Specifies the default Cached Exchange Mode for new profiles and disables the download options in the Cached Exchange Mode command submenu in the File menu.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_cachedexchangemodefilecachedexchangemode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_cachedexchangemodefilecachedexchangemode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_cachedexchangemodefilecachedexchangemode_l_selectcachedexchangemodefornewprofiles","displayName":"Select Cached Exchange Mode for new profiles (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_cachedexchangemodefilecachedexchangemode_l_selectcachedexchangemodefornewprofiles_1","displayName":"Download Headers","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_cachedexchangemodefilecachedexchangemode_l_selectcachedexchangemodefornewprofiles_2","displayName":"Download Full Items","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_cachedexchangemodefilecachedexchangemode_l_selectcachedexchangemodefornewprofiles_3","displayName":"Download Headers and then Full Items","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_configurecachedexchangemode","displayName":"Use Cached Exchange Mode for new and existing Outlook profiles (User)","description":"By default, users can choose to configure Cached Exchange Mode or use Online mode. By enabling this setting, new and existing Outlook profiles are configured to use Cached Exchange Mode. Disabling this setting configures new and existing Outlook profiles to use Online mode.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_configurecachedexchangemode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_configurecachedexchangemode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_disallowdownloadfullitemsfilecachedexchangemode","displayName":"Disallow Download Full Items (User)","description":"This policy setting allows you to turn off the \"Download Full Items\" option.\r\n\r\nIf you enable this policy setting, you will turn off the \"Download Full Items\" option in the Download Preferences menu in the Send/Receive tab.\r\n\r\nIf you disable or do not configure this policy setting, you will allow the \"Download Full Items\" option in the Download Preferences menu in the Send/Receive tab.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_disallowdownloadfullitemsfilecachedexchangemode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_disallowdownloadfullitemsfilecachedexchangemode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_disallowdownloadheadersfilecachedexchangemode","displayName":"Disallow Download Headers (User)","description":"Disables/Enables the option \"Download Headers\" in the Server group of the Send/Receive tab.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_disallowdownloadheadersfilecachedexchangemode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_disallowdownloadheadersfilecachedexchangemode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_disallowdownloadheadersthenfullitemsfilecachedexchangemode","displayName":"Disallow Download Headers then Full Items (User)","description":"This policy setting allows you to turn off the \"Download Headers and then Full Items\" option. Microsoft Exchange Server 2003 or later is required.\r\n\r\nIf you enable this policy setting, you will turn off the \"Download Headers and then Full Items\" option in the Download Preferences menu in the Send/Receive tab.\r\n\r\nIf you disable or do not configure this policy setting, you will allow the \"Download Headers and then Full Items\" option in the Download Preferences menu in the Send/Receive tab.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_disallowdownloadheadersthenfullitemsfilecachedexchangemode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_disallowdownloadheadersthenfullitemsfilecachedexchangemode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_disallowonslowconnectionsonlydownloadheadersfilecachedexchan","displayName":"Disallow On Slow Connections Only Download Headers (User)","description":"This policy setting allows you to turn off the \"On Slow Connections Download Only Headers\" option.\r\n\r\nIf you enable this policy setting, you will turn off the \"On Slow Connections Download Only Headers\" option in the Download Preferences menu in the Send/Receive tab.\r\n\r\nIf you disable or do not configure this policy setting, you will allow the \"On Slow Connections Download Only Headers\" option in the Download Preferences menu in the Send/Receive tab.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_disallowonslowconnectionsonlydownloadheadersfilecachedexchan_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_disallowonslowconnectionsonlydownloadheadersfilecachedexchan_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_downloadpublicfolderfavorites","displayName":"Download Public Folder Favorites (User)","description":"Checked: Checks the \"Download Public Folder Favorites\" option in the Advanced tab of the Microsoft Exchange Server dialog box (More Settings button in the E-mail Accounts dialog box) and enables the option. This enables Public Folder Favorites synchronization in Cached Exchange mode. | Unchecked: Unchecks the \"Download Public Folder Favorites\" option in the Advanced tab of the Microsoft Exchange Server dialog box (More Settings button in the E-mail Accounts dialog box) and disables the option. This disables Public Folder Favorites synchronization in Cached Exchange mode.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_downloadpublicfolderfavorites_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_downloadpublicfolderfavorites_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_downloadshardnonmailfolders","displayName":"Download shared non-mail folders (User)","description":"By default, most shared folders that users access in other mailboxes are automatically downloaded and cached in the users' local OST files when Cached Exchange Mode is enabled. Only shared Mail folders are not cached. You can use this setting to change this behavior so that non-mail folders are not downloaded automatically.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_downloadshardnonmailfolders_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_downloadshardnonmailfolders_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_entermaximumsecondstowaittosyncchanges","displayName":"Enter maximum seconds to wait to sync changes (User)","description":"Specifies maximum number of seconds to wait before synchronizing changes with the Exchange server.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_entermaximumsecondstowaittosyncchanges_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_entermaximumsecondstowaittosyncchanges_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_entermaximumsecondstowaittosyncchanges_l_entersecondstowaitbeforesyncdefault60sec","displayName":"Enter seconds to wait before sync(Default 60 sec.) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_entersecondstowaittodownloadchangesfromserver","displayName":"Enter seconds to wait to download changes from server (User)","description":"Specifies number of seconds to wait before downloading changes from the Exchange server.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_entersecondstowaittodownloadchangesfromserver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_entersecondstowaittodownloadchangesfromserver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_entersecondstowaittodownloadchangesfromserver_l_entersecondstowaitbeforedownloaddefault30sec","displayName":"Enter seconds to wait before download(Default 30 sec.) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_entersecondstowaittouploadchangestoserver","displayName":"Enter seconds to wait to upload changes to server (User)","description":"Specifies number of seconds to wait before uploading changes to the Exchange server.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_entersecondstowaittouploadchangestoserver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_entersecondstowaittouploadchangestoserver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_entersecondstowaittouploadchangestoserver_l_entersecondstowaitbeforeuploaddefault15sec","displayName":"Enter seconds to wait before upload(Default 15 sec.) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_hybridmode","displayName":"Disable Exchange Fast Access (User)","description":"This policy setting allows you to disable Exchange Fast Access, which forces user accounts to access data from a local cache.\r\n\r\nIf you enable this policy setting, Exchange Fast Access is not available to any Exchange Accounts on a computer.\r\n\r\nIf you disable or do not configure this policy setting, Exchange Fast Access is turned on by default for Exchange Accounts in Cached Exchange Mode.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_hybridmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_hybridmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_incachedexchangemakesendreceivef9nulloperation","displayName":"Do not sync in Cached Exchange mode when users click Send/Receive or F9 (User)","description":"By default, when users click Send/Receive or press F9 for Cached Exchange Mode accounts, Outlook synchronizes with the Exchange server. When this setting is enabled, clicking Send/Receive and pressing F9 do not synchronize with Exchange unless only one folder is being synchronized. Users can continue to use shift-F9 to synchronize the current folder.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_incachedexchangemakesendreceivef9nulloperation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_incachedexchangemakesendreceivef9nulloperation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_includeonlinemodegalinanr","displayName":"Use the Online Global Address List for Nickname Resolution (User)","description":"This policy setting allows you to force Outlook to use the Online Global Address List for ambiguous name resolution when composing messages in Outlook, instead of using the Offline Address Book when it is available.\r\n\r\nIf you enable this policy setting, addresses are resolved using the Online Global Address List, which may contain additional information (that the Offline Address Book would not have) that allows an address to be resolved.\r\n\r\nIf you disable or do not configure this policy setting, Outlook resolves addresses using the Offline Address Book when it is available.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_includeonlinemodegalinanr_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_cachedexchangemode_l_includeonlinemodegalinanr_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_offlineaddressbook_l_offlineaddressbookexactaliasmatching","displayName":"Return e-mail alias if it exactly matches the provided e-mail address when searching OAB (User)","description":"By default, when searching the Offline Address Book, Outlook resolves e-mail addresses using Ambiguous Name Resolution. With Ambiguous Name Resolution, Outlook suggests additional possible matches (if they exist) even if there is a name that matches exactly the e-mail alias entered. By enabling this setting, you can change the behavior so that Outlook returns a single e-mail address if it exactly matches an e-mail alias.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_offlineaddressbook_l_offlineaddressbookexactaliasmatching_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_offlineaddressbook_l_offlineaddressbookexactaliasmatching_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_offlineaddressbook_l_offlineaddressbooklimitmanualoabdownloads","displayName":"Offline Address Book: Limit manual OAB downloads (User)","description":"This policy setting allows you to specify the number of manual downloads of the offline address book (OAB) allowed in a 13 hour period.\r\n\r\nIf you enable this policy setting, you may specify the number of manual downloads of the offline address book (OAB) allowed in a 13 hour period. If you set the value to 0, then no manual OAB downloads are allowed. If you set the value to the maximum of 65535, then that will allow an unlimited number of manual downloads of the OAB.\r\n\r\nIf you disable or do not configure this policy setting, an unlimited number of manual downloads of the OAB will be allowed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_offlineaddressbook_l_offlineaddressbooklimitmanualoabdownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_offlineaddressbook_l_offlineaddressbooklimitmanualoabdownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_offlineaddressbook_l_offlineaddressbooklimitmanualoabdownloads_l_allowxxmanualoabdownloadsper13hrperiod","displayName":"Upper limit of number of manual OAB downloads per 13 hour period (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_offlineaddressbook_l_offlineaddressbooklimitnumberofincrementaloabdownloads","displayName":"Offline Address Book: Limit number of incremental OAB downloads (User)","description":"This policy setting allows you to specify the number of incremental download attempts of the offline address book (OAB) allowed in a 13 hour period.\r\n\r\nIf you enable this policy setting, you may specify the number of incremental download attempts of the offline address book (OAB) allowed in a 13 hour period. If you set the value to 0, then no incremental download attempts are allowed. If you set the value to the maximum of 65535, then that will allow an unlimited number of incremental OAB download attempts.\r\n\r\nIf you disable or do not configure this policy setting, an unlimited number of incremental OAB download attempts of the OAB will be allowed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_offlineaddressbook_l_offlineaddressbooklimitnumberofincrementaloabdownloads_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_offlineaddressbook_l_offlineaddressbooklimitnumberofincrementaloabdownloads_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_offlineaddressbook_l_offlineaddressbooklimitnumberofincrementaloabdownloads_l_allowxxincrementaloabdownloadsper13hrperiod","displayName":"Allow xx incremental OAB downloads per 13hr period (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_offlineaddressbook_l_offlineaddressbookpromptbeforedownloadingfulloab","displayName":"Offline Address Book: Prompt before Downloading Full OAB (User)","description":"Specifies that the user is asked for permission before initiating a full download of the offline address book.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_offlineaddressbook_l_offlineaddressbookpromptbeforedownloadingfulloab_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings~l_offlineaddressbook_l_offlineaddressbookpromptbeforedownloadingfulloab_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_imap_l_turnonpurgewhenswitchingfolders","displayName":"Turn on purge when switching folders (User)","description":"When \"purge on switch\" is enabled, IMAP e-mail messages marked for deletion in the current folder will be permanently removed from the server when the user switches to another folder. This setting will allow you to enable the IMAP \"purge on switch\" feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_imap_l_turnonpurgewhenswitchingfolders_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_imap_l_turnonpurgewhenswitchingfolders_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_automaticallydownloadenclosures","displayName":"Automatically download enclosures (User)","description":"This policy setting allows you to control whether Outlook automatically downloads enclosures on RSS items.\r\n\r\nIf you enable this policy setting, Outlook will automatically download enclosures on RSS items.\r\n\r\nIf you disable or do not configure this policy setting, enclosures on RSS items are not downloaded by default.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_automaticallydownloadenclosures_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_automaticallydownloadenclosures_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_defaultrssfeeds","displayName":"Default RSS Feeds (User)","description":"This policy setting allows you to deploy default RSS Feeds by providing a list of URLs that point to content that is syndicated through RSS. Outlook reads the list when it starts, and the corresponding RSS Feeds are added to each of the user's profiles. By default, users are not subscribed to any RSS Feeds.\r\n\r\nIf you enable this policy setting, you may specify the URLs in the format: feed://, where \"feed://\" replaces \"http://\". This ensures that the URL is parsed as an RSS XML file in Outlook.\r\n\r\nIf you disable or do not configure this policy setting, users are not subscribed to any RSS Feeds.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_defaultrssfeeds_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_defaultrssfeeds_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_defaultrssfeeds_l_defaultrsssubscriptionspart","displayName":"List of default RSS Feeds (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_defaultrssfeeds_l_defaultrsssubscriptionspart_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_defaultrssfeeds_l_defaultrsssubscriptionspart_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_disableroamingofrsssubscriptions","displayName":"Do not roam users' RSS Feeds (User)","description":"This policy setting allows you to change the default delivery location of RSS Feeds to a local PST.\r\n\r\nIf you enable this setting, the default delivery location will be changed to a local PST. When RSS Feeds are delivered to a local PST, they will not roam from client to client and will only be available on the computer where the user originally subscribed to the RSS Feed.\r\n\r\nIf you disable or do not configure this policy setting, subscriptions to RSS Feeds are delivered to the user's mailbox and roam from client to client via Exchange. This setting does not affect RSS Feeds that were subscribed before the policy setting was enabled. This setting also does not prevent the user from manually directing an RSS Feed to deliver to the user's mailbox, which allows the RSS Feed to roam from client to client.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_disableroamingofrsssubscriptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_disableroamingofrsssubscriptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_downloadfulltextofarticles","displayName":"Download full text of articles as HTML attachments (User)","description":"This policy setting controls whether Outlook automatically makes an offline copy of the RSS items as HTML attachments.\r\n\r\nIf you enable this policy setting, Outlook automatically makes an offline copy of RSS items as HTML attachments. \r\n\r\nIf you disable or do not configure this policy setting, Outlook will not automatically make an offline copy of RSS items as HTML attachments.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_downloadfulltextofarticles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_downloadfulltextofarticles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_overridepublishedsyncinterval","displayName":"Override published sync interval (User)","description":"This policy setting allows you to ignore the synchronization interval specified by the RSS publisher. By default, Outlook follows the synchronization interval specified by the RSS publisher and RSS Feeds will not be synchronized more often than allowed by the RSS publisher. If Outlook does not follow the RSS publisher's synchronization interval, the RSS publisher may suspend Outlook from synchronizing the RSS Feed.\r\n\r\nIf you enable this policy setting, Outlook will always ignore the synchronization interval specified by the RSS publisher.\r\n\r\nIf you disable or do not configure this policy setting, Outlook will always follow the synchronization interval specified by the RSS publisher.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_overridepublishedsyncinterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_overridepublishedsyncinterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_runrulesonrssitems","displayName":"Run rules on RSS items (User)","description":"By default, rules are not run on RSS items. Use this setting to make rules run on RSS items.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_runrulesonrssitems_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_runrulesonrssitems_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_synchronizeoutlookrssfeedswithcommonfeedlist","displayName":"Synchronize Outlook RSS Feeds with Common Feed List (User)","description":"This policy setting controls whether Outlook subscribes to the Common Feed List, which is made available to multiple RSS clients. The Common Feed List is a hierarchical set of RSS Feeds to which clients such as Outlook, the Feeds list in Internet Explorer 7, and the Feed Headlines Sidebar gadget in Windows Vista can subscribe. \r\n\r\nIf you enable this policy setting, Outlook automatically subscribes to RSS Feeds added in Internet Explorer, and Outlook RSS Feeds are synchronized with the Common Feed List so they are available in Internet Explorer. Be aware that third-party applications besides Internet Explorer can add RSS Feeds to the Common Feed List, and if you enable this setting Outlook automatically subscribes to those RSS Feeds as well. \r\n\r\nIf you disable or do not configure this policy setting, Outlook maintains its own list of RSS Feeds and does not automatically subscribe to RSS Feeds that are added to the Common Feed List.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_synchronizeoutlookrssfeedswithcommonfeedlist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_synchronizeoutlookrssfeedswithcommonfeedlist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_turnoffrssfeature","displayName":"Turn off RSS feature (User)","description":"This policy setting controls whether the RSS aggregation feature in Outlook is enabled. \r\n\r\nIf you enable this policy setting, the RSS aggregation feature in Outlook is disabled. \r\n\r\nIf you disable or do not configure this policy setting, users can subscribe to RSS Feeds from within Outlook and read RSS items like e-mail messages.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_turnoffrssfeature_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_rsssubscriptions_l_turnoffrssfeature_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_defaultsharepointlists","displayName":"Default SharePoint lists (User)","description":"This policy setting allows you to deploy SharePoint lists.\r\n\r\nIf you enable this policy setting, you can provide a list of SharePoint list URLs in the following format:\r\n\r\nValue name: SPsite1\r\nValue: SPsite1 stssync:// URL. See MS-STSSYN for documentation.\r\n\r\nValue name: SPSite2\r\nValue: SPsite2 stssync:// URL. See MS-STSSYN for documentation.\r\n\r\nThe list of URLs provided is read when Outlook starts up, and the corresponding SharePoint lists are added to each of the user's profiles.\r\n\r\nIf you disable or do not configure this policy setting, users will not have any default SharePoint lists.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_defaultsharepointlists_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_defaultsharepointlists_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_defaultsharepointlists_l_empty35","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_defaultsharepointlists_l_empty35_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_defaultsharepointlists_l_empty35_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_definecustomlabelforsharepointstore","displayName":"Define custom label for SharePoint store (User)","description":"You can use this setting to define a custom label for the SharePoint Lists PST and most other places where the term \"SharePoint\" is used in Outlook. (Setting this value replaces the word \"SharePoint\" in Outlook strings with the value you specify.) A custom label might be particularly useful when deploying a third-party server that supports the same Microsoft SharePoint Foundation Web services Outlook uses for synchronization.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_definecustomlabelforsharepointstore_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_definecustomlabelforsharepointstore_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_definecustomlabelforsharepointstore_l_definecustomlabelforsharepointstorepart","displayName":"Enter custom label for SharePoint store: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_disableroamingofsharepointlists","displayName":"Do not roam users' SharePoint lists (User)","description":"By default, links to SharePoint lists are available on each client that the users use to connect to their Microsoft Exchange Server mailboxes. This setting allows you to disable roaming links to SharePoint lists. When roaming is disabled, SharePoint lists are available only on the client that originally linked them.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_disableroamingofsharepointlists_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_disableroamingofsharepointlists_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_disablesharepointintegrationinoutlook","displayName":"Do not allow Sharepoint-Outlook integration (User)","description":"This policy setting allows you to prevent access to Microsoft SharePoint Foundation with Outlook.\r\n\r\nIf you enable this policy setting, user profiles will not be able to upload new items or sync changes to the SharePoint list from the server; however, user profiles that have pre-existing SharePoint lists will retain their local data. In addition, new SharePoint lists cannot be connected when this policy setting is enabled. This can be toggled on and off to restore synchronization to existing lists. Note that users will not receive a message if synchronization has been prevented.\r\n\r\nIf you disable or do not configure this policy setting, Microsoft SharePoint Foundation access will be allowed with Outlook.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_disablesharepointintegrationinoutlook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_disablesharepointintegrationinoutlook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_logsharepointsyncrequestsandresponses","displayName":"Log SharePoint sync requests and responses (User)","description":"This policy setting allows you to control whether sync requests and responses between Outlook and SharePoint are logged. Log files can help diagnose problems with Outlook and SharePoint interactions. Each log file links to one or more XML files (also in the TEMP directory) containing detailed server response and error information. The XML filename is based on the corresponding log file; you can obtain all related diagnostic files by copying all *-wss-*.* files from the TEMP directory.\r\n\r\nIf you enable this policy setting, Outlook logs most sync requests and responses to a log file stored in the user's TEMP directory. One log file is created per session (up to seven total), using the naming convention: 0-wss-sync-log.HTM, 1-wss-sync-log.HTM, etc. \r\n\r\nIf you disable or do not configure this policy setting, sync requests and responses between Outlook and SharePoint are not logged.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_logsharepointsyncrequestsandresponses_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_logsharepointsyncrequestsandresponses_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_modifynumberofchangeditemsincluded","displayName":"Modify number of changed items included in SharePoint client page download (User)","description":"By default, the number of changes an Outlook client downloads from a SharePoint server in a single web service request or \"page\" is 250 changed items. If SharePoint servers have reduced capacity or are overwhelmed by the size of requests coming from Outlook clients, you can change this setting to specify a different number of items to download for a SharePoint page. \r\n\r\nYou should test changes in this setting to determine the impact in your specific environment. A page size below 15 or above 1000 is not recommended.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_modifynumberofchangeditemsincluded_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_modifynumberofchangeditemsincluded_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_modifynumberofchangeditemsincluded_l_empty34","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_overridepublishedsyncinteral36","displayName":"Override published sync interval (User)","description":"This policy setting allows you to prevent users from overriding the sync interval published by managed SharePoint lists.\r\n\r\nIf you enable this policy setting, the \"Update Limit\" checkbox found under File tab | Info | Account Settings | SharePoint List | Change… is disabled, and the user's connected SharePoint lists will only sync as defined by the list's administrator.\r\n\r\nIf you disable this policy setting, then individual users will be able to override the sync interval by unchecking the \"Update Limit\" checkbox in the SharePoint List's Options dialog. Defined sync intervals can range from 1 minute to 1440 minutes (a full day).\r\n\r\nIf you do not configure this policy setting, the user's profile will sync the SharePoint list at a default of 20 minutes or as specified by the administrator of the SharePoint list.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_overridepublishedsyncinteral36_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_sharepointintegration_l_overridepublishedsyncinteral36_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_webcalsubscriptions_l_automaticallydownloadenclosureswebcal","displayName":"Automatically download attachments (User)","description":"This policy setting controls whether Outlook downloads files attached to Internet Calendar appointments. \r\n\r\nIf you enable this policy setting, Outlook automatically downloads all Internet Calendar appointment attachments \r\n\r\nIf you disable or do not configure this policy setting, Outlook does not download attachments when retrieving Internet Calendar appointments.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_webcalsubscriptions_l_automaticallydownloadenclosureswebcal_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_webcalsubscriptions_l_automaticallydownloadenclosureswebcal_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_webcalsubscriptions_l_defaultwebcalsubscriptions","displayName":"Default Internet Calendar subscriptions (User)","description":"This policy setting allows you to deploy Internet Calendar subscriptions.\r\n\r\nIf you enable this policy setting, the URLs listed here will be read and the corresponding Internet Calendar subscriptions will be added to each of the user's profiles. The name you specify here will not be used as the name of the Internet Calendar subscription.\r\n\r\nIf you disable or do not configure this policy setting users will not have any default Internet Calendar subscriptions.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_webcalsubscriptions_l_defaultwebcalsubscriptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_webcalsubscriptions_l_defaultwebcalsubscriptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_webcalsubscriptions_l_defaultwebcalsubscriptions_l_empty32","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_webcalsubscriptions_l_defaultwebcalsubscriptions_l_empty32_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_webcalsubscriptions_l_defaultwebcalsubscriptions_l_empty32_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_webcalsubscriptions_l_disableroamingofinternetcalendars","displayName":"Disable roaming of Internet Calendars (User)","description":"By default, Internet Calendars are available on each client that the users use to connect to their Microsoft Exchange Server mailboxes. This setting allows you to disable roaming Internet Calendars. When roaming is disabled, Internet Calendars are available only on the client that originally linked them.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_webcalsubscriptions_l_disableroamingofinternetcalendars_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_webcalsubscriptions_l_disableroamingofinternetcalendars_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_webcalsubscriptions_l_disablewebcalintegration","displayName":"Do not include Internet Calendar integration in Outlook (User)","description":"This policy setting allows you to determine whether or not you want to include Internet Calendar integration in Outlook. The Internet Calendar feature in Outlook enables users to publish calendars online (using the webcal:// protocol) and subscribe to calendars that others have published. When users subscribe to an Internet calendar, Outlook queries the calendar at regular intervals and downloads any changes as they are posted. \r\n\r\nIf you enable this policy setting, all Internet calendar functionality in Outlook is disabled. \r\n\r\nIf you disable or do not configure this policy setting, Outlook allows users to subscribe to Internet calendars.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_webcalsubscriptions_l_disablewebcalintegration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_webcalsubscriptions_l_disablewebcalintegration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_webcalsubscriptions_l_overridepublishedsyncinteral","displayName":"Override published sync interval (User)","description":"By default, Outlook follows the sync interval specified by the Internet Calendar publisher and Internet Calendar subscriptions will not be sync'd more often than allowed by the Internet Calendar publisher. This setting allows you to prevent users from overriding the sync interval published by Internet Calendar publishers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_webcalsubscriptions_l_overridepublishedsyncinteral_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v2~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_webcalsubscriptions_l_overridepublishedsyncinteral_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v3~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_preferprovidedemailinautodiscoverauthprompts","displayName":"Prefer the provided account email in AutoDiscover auth prompts. (User)","description":"If set, this policy setting governs the displayed email in auth prompts related to AutoDiscover.\r\n\r\n Default (0): Prefers the account UPN, when available.\r\n\r\n If you enable this setting, then AutoDiscover auth prompts will prefer the provided account email (can be either SMTP or UPN depending on which was configured).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v3~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_preferprovidedemailinautodiscoverauthprompts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v3~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_preferprovidedemailinautodiscoverauthprompts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions_l_disableguesssmart","displayName":"Disable GuessSmart in Outlook. (User)","description":"This policy setting determines whether GuessSmart will be used to configure an account.\r\n\r\nIf you enable this policy setting, GuessSmart will not be used to configure an account.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions_l_disableguesssmart_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions_l_disableguesssmart_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions_l_disableroamingsettings","displayName":"Disable roaming settings in Outlook. (User)","description":"This policy setting determines whether roaming settings will be used to store accounts and their settings.\r\n\r\nIf you enable this policy setting, roaming settings will not store Outlook accounts or their settings in the cloud.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions_l_disableroamingsettings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions_l_disableroamingsettings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disableoutlookfeedbackfeatures","displayName":"Disable Outlook features in the Feedback tab under the File menu in Outlook (User)","description":"This policy setting determines whether Outlook features will be displayed in the Feedback tab under the File menu in Outlook.\r\n\r\nIf you enable this policy setting, then Outlook features will not be displayed in the Feedback tab under the File menu in Outlook.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disableoutlookfeedbackfeatures_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disableoutlookfeedbackfeatures_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disableoutlookmobilehyperlink","displayName":"Disable Outlook Mobile Hyperlink (User)","description":"This policy setting determines if the Outlook Mobile Hyperlink is shown in Account Settings.\r\n\r\nIf you enable this policy setting, users will be unable to view the Outlook Mobile Hyperlink in Account Settings.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disableoutlookmobilehyperlink_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disableoutlookmobilehyperlink_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablesupportbackstage","displayName":"Disable the Support tab under the File menu in Outlook (User)","description":"This policy setting determines whether the Support tab will be displayed under the File menu in Outlook.\r\n\r\nIf you enable this policy setting, then the Support tab will not be displayed under the File menu in Outlook.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablesupportbackstage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablesupportbackstage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablesupportdiagnostics","displayName":"Disable support diagnostics in Outlook (User)","description":"This policy setting determines if Outlook can communicate client information on failure to support services with the intent of diagnosing the issue or making the information available to support to help with the diagnosis/resolution of the issue and/or provide contextual error messaging to the user.\r\n\r\nIf you enable this policy setting, then Outlook will not communicate client information on failure to support services.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablesupportdiagnostics_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablesupportdiagnostics_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablesupportticketcreationinoutlook","displayName":"Disable support ticket creation in Outlook (User)","description":"This policy setting determines if an Outlook support ticket can be created in Outlook.\r\n\r\nIf you enable this policy setting, users will be unable to create a support ticket in Outlook.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablesupportticketcreationinoutlook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablesupportticketcreationinoutlook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_accountsettingsemail_disableaccountsettingsdetectionservice","displayName":"Prevent Outlook from interacting with the account settings detection service (User)","description":"This policy setting determines whether Outlook can interact with the account settings detection service to gather information about a user's account settings.\r\n\r\nIf you enable this policy setting, users will need to manually configure their account settings.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_accountsettingsemail_disableaccountsettingsdetectionservice_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_accountsettingsemail_disableaccountsettingsdetectionservice_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_accountsettingsemail_l_disableoffice365simplifiedaccountcreation","displayName":"Prevent Office 365 E-mail accounts from being configured within a simplified Interface (User)","description":"This policy setting determines whether an Office 365 E-mail account when being configured in Outlook, can use a simplified dialog that can greatly accelerate the initial account creation.\r\n\r\nIf you enable this policy setting, users will configure their Office 365 accounts using the Account Wizard, as they do, for all other account types.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_accountsettingsemail_l_disableoffice365simplifiedaccountcreation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_accountsettingsemail_l_disableoffice365simplifiedaccountcreation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_eas_l_enableeasaccountcreation","displayName":"Enable Exchange ActiveSync account creation in the Outlook account setup UI (User)","description":"This policy setting determines whether the Exchange ActiveSync button will be displayed in the account setup UI.\r\n\r\nIf you enable this policy setting, the Exchange ActiveSync button will be displayed in Outlook account setup UI.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_eas_l_enableeasaccountcreation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_eas_l_enableeasaccountcreation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookenableofficeconfigserviceinautodiscover","displayName":"Allow Outlook Autodiscover to interact with Office Config Service (User)","description":"This policy setting determines whether Outlook can interact with the Office Config Service to get Autodiscover V2 service endpoint URL for different sovereigns.\r\n\r\nif you enable this policy setting, Outlook will get the URL for the sovereign Autodiscover v2 service endpoint by default.\r\n\r\nIf you disable this policy setting, Outlook will get the URL for the WW Autodiscover v2 service endpoint by default.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookenableofficeconfigserviceinautodiscover_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v4~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_outlookenableofficeconfigserviceinautodiscover_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v5~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disableadminnotifications","displayName":"Disable Outlook tenant admin notifications (User)","description":"This policy setting determines if tenant admins can receive support notifications in Outlook.\r\n\r\nDefault (0): Tenant admins who are signed in will receive status updates about potential issues and fixes that are impacting their tenant.\r\n\r\nIf you enable this setting, tenant admins who are signed in won't receive status updates about potential issues and fixes that are impacting their tenant.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v5~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disableadminnotifications_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v5~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disableadminnotifications_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v5~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablecrashnotificationonrestart","displayName":"Disable the Outlook crash notification when Outlook restarts. (User)","description":"This policy setting determines if the Outlook crash notification on restart is allowed. Enabling this setting will block Outlook crash notification on restart.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v5~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablecrashnotificationonrestart_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v5~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_disablecrashnotificationonrestart_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v5~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_allowprivatekeycheck","displayName":"Check for the user's private key when the user sends an encrypted email that includes the user as a recipient (User)","description":"This policy setting controls whether Outlook checks for the user's private key when the user sends an encrypted email and the user is included as a recipient of the email. The user can be included as recipient either directly or as a member of a distribution list.\r\n\r\nIf you enable this policy setting, Outlook checks for the user's private key.\r\n\r\nIf you disable this policy setting, Outlook doesn't check for the user's private key.\r\n\r\nIf you don't configure this policy setting, Outlook checks for the user's private key.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v5~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_allowprivatekeycheck_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v5~policy~l_microsoftofficeoutlook~l_security~l_cryptography_l_allowprivatekeycheck_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkemailprotectionlevel","displayName":"Junk E-mail protection level (User) (Deprecated)","description":"This policy setting controls your Junk E-mail protection level. The Junk E-mail Filter in Outlook helps to prevent junk e-mail messages, also known as spam, from cluttering user's Inbox. The filter evaluates each incoming message based on several factors, including the time when the message was sent and the content of the message. The filter does not single out any particular sender or message type, but instead analyzes each message based on its content and structure to discover whether or not it is probably spam.\r\n\r\nIf you enable this policy setting, you can select one of the four listed options available. After you select an option, users will not be able to change it.\r\n\r\nIf you disable this policy setting, Outlook reverts to the user-defined protection level.\r\n\r\nIf you do not configure this policy setting, users can change their junk e-mail filtering options.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkemailprotectionlevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkemailprotectionlevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkemailprotectionlevel_l_selectlevel","displayName":"Select level: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkemailprotectionlevel_l_selectlevel_4294967295","displayName":"No Protection","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkemailprotectionlevel_l_selectlevel_6","displayName":"Low (Default)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkemailprotectionlevel_l_selectlevel_3","displayName":"High","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkemailprotectionlevel_l_selectlevel_2147483648","displayName":"Trusted Lists Only","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkemailprotectionlevel_v2","displayName":"Junk E-mail protection level (User)","description":"This policy setting controls your Junk E-mail protection level. The Junk E-mail Filter in Outlook helps to prevent junk e-mail messages, also known as spam, from cluttering user's Inbox. The filter evaluates each incoming message based on several factors, including the time when the message was sent and the content of the message. The filter does not single out any particular sender or message type, but instead analyzes each message based on its content and structure to discover whether or not it is probably spam.\r\n\r\nIf you enable this policy setting, you can select one of the four listed options available. After you select an option, users will not be able to change it.\r\n\r\nIf you disable this policy setting, Outlook reverts to the user-defined protection level.\r\n\r\nIf you do not configure this policy setting, users can change their junk e-mail filtering options.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkemailprotectionlevel_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkemailprotectionlevel_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkemailprotectionlevel_v2_l_selectlevel","displayName":"Select level: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkemailprotectionlevel_v2_l_selectlevel_4294967295","displayName":"No Protection","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkemailprotectionlevel_v2_l_selectlevel_6","displayName":"Low (Default)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkemailprotectionlevel_v2_l_selectlevel_3","displayName":"High","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_junkemail_l_junkemailprotectionlevel_v2_l_selectlevel_2147483648","displayName":"Trusted Lists Only","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_authenticationwithexchangeserver","displayName":"Authentication with Exchange Server (User) (Deprecated)","description":"This policy setting controls which authentication method Outlook uses to authenticate with Microsoft Exchange Server. Note - Exchange Server supports the Kerberos authentication protocol and NTLM for authentication. The Kerberos protocol is the more secure authentication method and is supported on Windows 2000 Server and later versions. NTLM authentication is supported in pre-Windows 2000 environments.\r\n \r\nIf you enable this policy setting, you can choose from three different options for controlling how Outlook authenticates with Microsoft Exchange Server:\r\n\r\n- Kerberos/NTLM password authentication. Outlook attempts to authenticate using the Kerberos authentication protocol. If this attempt fails, Outlook attempts to authenticate using NTLM. This option is the default configuration.\r\n\r\n- Kerberos password authentication. Outlook attempts to authenticate using the Kerberos protocol only.\r\n\r\n- NTLM password authentication. Outlook attempts to authenticate using NTLM only.\r\n\r\nIf you disable or do not configure this policy setting, Outlook will attempt to authenticate using the Kerberos authentication protocol. If it cannot (because no Windows 2000 or later domain controllers are available), it will authenticate using NTLM.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_authenticationwithexchangeserver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_authenticationwithexchangeserver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_authenticationwithexchangeserver_l_selecttheauthenticationwithexchangeserver","displayName":"Select the authentication with Exchange server. (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_authenticationwithexchangeserver_l_selecttheauthenticationwithexchangeserver_9","displayName":"Kerberos/NTLM Password Authentication","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_authenticationwithexchangeserver_l_selecttheauthenticationwithexchangeserver_16","displayName":"Kerberos Password Authentication","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_authenticationwithexchangeserver_l_selecttheauthenticationwithexchangeserver_10","displayName":"NTLM Password Authentication","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_authenticationwithexchangeserver_l_selecttheauthenticationwithexchangeserver_2147545088","displayName":"Insert a smart card","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_authenticationwithexchangeserver_v2","displayName":"Authentication with Exchange Server (User)","description":"This policy setting controls which authentication method Outlook uses to authenticate with Microsoft Exchange Server. Note - Exchange Server supports the Kerberos authentication protocol and NTLM for authentication. The Kerberos protocol is the more secure authentication method and is supported on Windows 2000 Server and later versions. NTLM authentication is supported in pre-Windows 2000 environments.\r\n \r\nIf you enable this policy setting, you can choose from three different options for controlling how Outlook authenticates with Microsoft Exchange Server:\r\n\r\n- Kerberos/NTLM password authentication. Outlook attempts to authenticate using the Kerberos authentication protocol. If this attempt fails, Outlook attempts to authenticate using NTLM. This option is the default configuration.\r\n\r\n- Kerberos password authentication. Outlook attempts to authenticate using the Kerberos protocol only.\r\n\r\n- NTLM password authentication. Outlook attempts to authenticate using NTLM only.\r\n\r\nIf you disable or do not configure this policy setting, Outlook will attempt to authenticate using the Kerberos authentication protocol. If it cannot (because no Windows 2000 or later domain controllers are available), it will authenticate using NTLM.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_authenticationwithexchangeserver_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_authenticationwithexchangeserver_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_authenticationwithexchangeserver_v2_l_selecttheauthenticationwithexchangeserver","displayName":"Select the authentication with Exchange server. (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_authenticationwithexchangeserver_v2_l_selecttheauthenticationwithexchangeserver_9","displayName":"Kerberos/NTLM Password Authentication","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_authenticationwithexchangeserver_v2_l_selecttheauthenticationwithexchangeserver_16","displayName":"Kerberos Password Authentication","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_authenticationwithexchangeserver_v2_l_selecttheauthenticationwithexchangeserver_10","displayName":"NTLM Password Authentication","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v6~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_authenticationwithexchangeserver_v2_l_selecttheauthenticationwithexchangeserver_2147545088","displayName":"Insert a smart card","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_disableitemsinuserinterface~l_predefined_l_disableeditdefaultuserpermissions","displayName":"Limit which permissions can be assigned to Default, Anonymous, or My Organization on mail folders and calendars (User)","description":"This policy setting allows you to limit which permissions can be assigned to Default, Anonymous, or My Organization on mail folders and calendars.\r\n\r\nIf you enable this policy setting, users can assign only the following permissions to Default, Anonymous, or My Organization.\r\n\r\n- None on mail folders\r\n- None or basic Free/Busy information on calendars\r\n\r\nUsers won't be able to assign any other permissions to Default, Anonymous, or My Organization. All permissions will still be available to assign to other users on mail folders and calendars.\r\n\r\nIf you disable or don't configure this policy setting, users can assign any permissions to Default, Anonymous, or My Organization on mail folders and calendars.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_disableitemsinuserinterface~l_predefined_l_disableeditdefaultuserpermissions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_disableitemsinuserinterface~l_predefined_l_disableeditdefaultuserpermissions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_outlookoptions~l_delegates_l_delegatesentitemsstyle","displayName":"Saving messages sent from a shared mailbox to the Sent Items folder (User)","description":"This policy setting controls whether messages sent from a shared mailbox are saved to the Sent Items folder of the shared mailbox.\r\n\r\nBy default, messages sent from a shared mailbox aren't saved to the Sent Items folder of the shared mailbox.\r\n\r\nIf you enable this policy setting, messages sent from a shared mailbox will be saved to the Sent Items folder of the shared mailbox.\r\n\r\nIf you disable or don’t configure this policy setting, messages sent from a shared mailbox won’t be saved to the Sent Items folder of the shared mailbox.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_outlookoptions~l_delegates_l_delegatesentitemsstyle_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_outlookoptions~l_delegates_l_delegatesentitemsstyle_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_shorteneventstype","displayName":"Shorten appointments and meetings (User)","description":"\r\n This policy setting allows you to shorten the default duration of appointments and meetings by a specified number of minutes. If you enable this policy setting, you can choose between the following options: End Early, Start Late, None.\r\n If you select End Early, meetings and appointments will end early by the specified number of minutes. \r\n If you select Start Late, meetings and appointments will start late by the specified number of minutes. \r\n If you select None, the default meeting duration will not be shortened. \r\n In all cases, the settings for this feature will be disabled in the Outlook Options dialog. \r\n If you don’t configure this policy setting, users can modify these settings by going to File > Options > Calendar.\r\n\r\n Note: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_shorteneventstype_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_shorteneventstype_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_shorteneventstype_l_selecttheshorteneventstype","displayName":"Select the Shorten Events Type (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_shorteneventstype_l_selecttheshorteneventstype_none","displayName":"None","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_shorteneventstype_l_selecttheshorteneventstype_end_early","displayName":"End Early","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_outlookoptions~l_preferences~l_calendaroptions_l_shorteneventstype_l_selecttheshorteneventstype_start_late","displayName":"Start Late","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_alwaysusemsoauthforautodiscover","displayName":"Autodiscover is always capable of using modern authentication (User)","description":"This policy setting controls whether Autodiscover is always capable of using modern authentication, regardless of the authentication methods supported by the primary mailbox connection type.\r\n\r\nBy default, Autodiscover only uses authentication methods that are supported by the primary mailbox connection type. Modern authentication won't always be one of the supported authentication methods for some connection types.\r\n\r\nIf you enable this policy setting, Autodiscover is always capable of using modern authentication, regardless of the authentication methods supported by the primary mailbox connection type. Enabling this policy setting may result in additional prompts for users to provide their password, when modern authentication is used, but not supported for the connection type.\r\n\r\nIf you disable or don’t configure this policy setting, Autodiscover will only use authentication methods supported by the primary mailbox connection type.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_alwaysusemsoauthforautodiscover_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_alwaysusemsoauthforautodiscover_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_autodiscoverredirectservers","displayName":"Don’t show redirect warnings for Autodiscover for the specified HTTPS server names (User)","description":"This policy setting allows you to specify HTTPS server names for which Autodiscover won’t show a warning message when redirecting from HTTP to HTTPS.\r\n\r\nBy default, when an Autodiscover operation redirects from HTTP to HTTPS, you may be shown a warning message about the redirection.\r\n\r\nIf you enable this policy setting, you need to specify HTTPS server names, and for those server names, you won’t be shown a warning message. For example, if you enter contoso.com, you won’t be shown a warning message when Autodiscover redirects to https://contoso.com.\r\n\r\nIf you disable or don’t configure this policy setting, you may be shown a warning message when an Autodiscover operation redirects from HTTP to HTTPS.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_autodiscoverredirectservers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_autodiscoverredirectservers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v7~policy~l_microsoftofficeoutlook~l_toolsaccounts~l_exchangesettings_l_autodiscoverredirectservers_l_autodiscoverredirectserverslist","displayName":"HTTPS server names: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v8~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_recommendoutlookextension","displayName":"Recommend the Microsoft Outlook Extension (User)","description":"This policy setting controls whether Windows 10 users of the Outlook app and the Outlook web app will see a recommendation to install the new Microsoft Outlook extension for Microsoft Edge. If a user chooses to click the recommendation, they will be taken to the Microsoft Outlook extension page where they can choose to install this web-based, productivity add on. Your users can dismiss the recommendation and will only see the recommendation twice. If your users choose to install the extension, they will be able to access their mail, calendar, contacts, and tasks from an icon in Microsoft Edge without requiring that they open another browser tab. The extension is a “mini” version of Outlook on the web which operates as a one-click flyout from the browser header.\r\n\r\nIn the future, Microsoft may release a version of this extension for the Chrome browser. Microsoft will respect this policy for future promotions of a Chrome extension, as well.\r\n\r\nIf you enable or do not configure this policy setting, the recommendation will be presented to the user.\r\n\r\nIf you disable this policy setting, the recommendation will not be presented to the user.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise and Outlook web app.\r\n\r\nFor more information, see https://go.microsoft.com/fwlink/?linkid=2165458","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v8~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_recommendoutlookextension_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v8~policy~l_microsoftofficeoutlook~l_outlookoptions~l_other_l_recommendoutlookextension_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v9~policy~l_microsoftofficeoutlook~l_miscellaneous_l_equivalentcomaddin","displayName":"Deactivate Outlook web add-ins whose equivalent COM or VSTO add-in is installed (User)","description":"This policy setting allows you to deactivate Outlook web add-ins if the associated COM or VSTO add-in is installed.\r\n\r\nIf you enable this policy setting, users will not be able to use Outlook web add-ins where the corresponding COM or VSTO add-in is installed and you have provided the following information for each add-in.\r\n \"Value name\": Specify the Id of the Outlook web add-in, as noted in its manifest. Note: Do not add {} around the Id.\r\n \"Value\": Specify the programmatic ID (ProgID) for the Outlook COM or VSTO add-in.\r\n\r\nIf you disable or don't configure this policy setting, users will continue to be able to use any versions of the add-in that are installed.\r\n\r\nFor more information about when to use this setting, see https://go.microsoft.com/fwlink/p/?linkid=2156690","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v9~policy~l_microsoftofficeoutlook~l_miscellaneous_l_equivalentcomaddin_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v9~policy~l_microsoftofficeoutlook~l_miscellaneous_l_equivalentcomaddin_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v9~policy~l_microsoftofficeoutlook~l_miscellaneous_l_equivalentcomaddin_l_equivalentcomaddin2","displayName":"Outlook web add-ins to deactivate (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v9~policy~l_microsoftofficeoutlook~l_miscellaneous_l_equivalentcomaddin_l_equivalentcomaddin2_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v9~policy~l_microsoftofficeoutlook~l_miscellaneous_l_equivalentcomaddin_l_equivalentcomaddin2_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_outlk16v9~policy~l_microsoftofficeoutlook~l_outlookoptions_l_specifymaxgroupssupported","displayName":"Maximum Groups Supported (User)","description":"This policy setting controls the maximum number of groups that are accessible through the Navigation Pane in Outlook for Windows.\r\n\r\nIf you enable this policy setting, only the number of groups set in the Groups Count will be shown in the Navigation Pane. \r\n\r\nIf you don’t enable this policy setting, the maximum number of groups displayed defaults to 1000.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_outlk16v9~policy~l_microsoftofficeoutlook~l_outlookoptions_l_specifymaxgroupssupported_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_outlk16v9~policy~l_microsoftofficeoutlook~l_outlookoptions_l_specifymaxgroupssupported_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_outlk16v9~policy~l_microsoftofficeoutlook~l_outlookoptions_l_specifymaxgroupssupported_l_specifymaxgroupssupportedid","displayName":"Groups Count: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_collaborationsettings~l_coauthoring_l_disableautosavewhencoauthoring","displayName":"Don’t automatically save changes when working in the same PowerPoint presentation as others (User)","description":"This policy setting controls whether changes are saved automatically when users are working together in the same presentation.\r\n\r\nBy default, when users are working together in the same presentation, changes are automatically saved. This allows users to see the edits made by others in real time. But, some add-ins or solutions might not be compatible with PowerPoint saving so frequently.\r\n\r\nIf you enable this policy setting, changes aren’t saved automatically and users won’t see real-time edits.\r\n\r\nIf you disable or don't configure this policy setting, changes are saved automatically and users will see real-time edits.\r\n\r\nNote: this policy setting doesn’t affect the AutoRecover settings configured under File > Options > Save.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_collaborationsettings~l_coauthoring_l_disableautosavewhencoauthoring_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_collaborationsettings~l_coauthoring_l_disableautosavewhencoauthoring_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_collaborationsettings~l_coauthoring_l_preventcoauthoring","displayName":"Prevent co-authoring (User)","description":"This policy setting controls how PowerPoint opens a file for editing on document management servers that support co-authoring.\r\n\r\nIf you enable this policy setting, PowerPoint will prevent co-authoring by taking an exclusive file lock. \r\n\r\nIf you disable or do not configure this policy setting, PowerPoint will allow co-authoring by taking short-term shared locks. \r\n\r\nNote: When file synchronization via SOAP over HTTP is turned off it will prevent co-authoring.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_collaborationsettings~l_coauthoring_l_preventcoauthoring_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_collaborationsettings~l_coauthoring_l_preventcoauthoring_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_collaborationsettings~l_coauthoring_l_turnoffrevisiontracking","displayName":"Turn off revision tracking (User)","description":"This policy setting allows you to turn off revision tracking in PowerPoint.\r\n\r\nBy default, revision tracking is on in presentations where revision tracking is supported.\r\n\r\nIf you enable this policy setting, revisions made to a presentation aren’t tracked or shown.\r\n\r\nIf you disable or don’t configure this policy setting, revisions made to a presentation are tracked and shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_collaborationsettings~l_coauthoring_l_turnoffrevisiontracking_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_collaborationsettings~l_coauthoring_l_turnoffrevisiontracking_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_customizableerrormessages_l_listoferrormessagestocustomize","displayName":"List of error messages to customize (User)","description":"Specifies the list of error messages to customize.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_customizableerrormessages_l_listoferrormessagestocustomize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_customizableerrormessages_l_listoferrormessagestocustomize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_customizableerrormessages_l_listoferrormessagestocustomize_l_listoferrormessagestocustomize80","displayName":"List of error messages to customize (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_customizableerrormessages_l_listoferrormessagestocustomize_l_listoferrormessagestocustomize80_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_customizableerrormessages_l_listoferrormessagestocustomize_l_listoferrormessagestocustomize80_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems157","displayName":"Disable commands (User)","description":"This policy setting allows you to disable any command bar button and menu item with a command bar ID, including command bar buttons and menu items that are not in the predefined lists.\r\n\r\nIf you enable this policy setting, you can enter an ID number to disable a specific command bar button or menu item. The ID number needs to be in decimal (not hexadecimal). Multiple values should be separated by commas.\r\n\r\nIf you disable or do not configure this policy setting, all default command bar buttons or menu items are available to users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems157_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems157_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems157_l_enteracommandbaridtodisable","displayName":"Enter a command bar ID to disable (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys158","displayName":"Disable shortcut keys (User)","description":"This policy setting allows you to disable any shortcut key by using its virtual key code ID, including shortcut keys that are not in the predefined lists.\r\n\r\nIf you enable this policy setting, you can enter a virtual key code ID number to disable a specific shortcut key.\r\n\r\nIf you disable or do not configure this policy setting, all default shortcut keys are enabled for users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys158_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys158_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys158_l_enterakeyandmodifiertodisable","displayName":"Enter a key and modifier to disable (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_defaultmuteaudioinrecordingpresenterview","displayName":"Turn off microphone recording by default when recording a slide show (User)","description":"This policy setting allows you to set microphone recording off by default when recording a slide show.\r\n\r\nBy default, microphone recording is on the first time a user records a slide show. If the user turns off microphone recording, then microphone recording will be off the next time the slide show recording window is launched, even if PowerPoint is closed and reopened.\r\n\r\nIf you enable this policy setting, microphone recording is turned off by default. A user can turn on microphone recording when recording a slide show. But, the next time the slide show recording window is launched, microphone recording will be off by default.\r\n\r\nIf you disable or don’t configure this policy setting, the default state of microphone recording is determined by the user.\r\n\r\nNote: Enabling this policy setting also turns off camera recording by default when recording a slide show. There is a separate policy setting if you just want to turn off camera recording by default when recording a slide show.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_defaultmuteaudioinrecordingpresenterview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_defaultmuteaudioinrecordingpresenterview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_defaultmuteaudioinscreenrecorder","displayName":"Turn off audio recording for screen recording (User)","description":"This policy setting allows you to control the initial audio recording setting for a screen recording in PowerPoint. By default, audio is recorded during a screen recording.\r\n \r\nIf you enable this policy setting, audio isn’t recorded during a screen recording. But, the user can choose to turn on audio recording manually in the UI.\r\n \r\nIf you disable or don’t configure this policy setting, audio is recorded during a screen recording. The user can choose to turn off audio recording manually in the UI.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_defaultmuteaudioinscreenrecorder_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_defaultmuteaudioinscreenrecorder_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_defaultvideooffinrecordingpresenterview","displayName":"Turn off camera recording by default when recording a slide show (User)","description":"This policy setting allows you to set camera recording off by default when recording a slide show.\r\n\r\nBy default, camera recording is on the first time a user records a slide show. If the user turns off camera recording, then camera recording will be off the next time the slide show recording window is launched, even if PowerPoint is closed and reopened.\r\n\r\nIf you enable this policy setting, camera recording is turned off by default. A user can turn on camera recording when recording a slide show. But, the next time the slide show recording window is launched, camera recording will be off by default.\r\n\r\nIf you disable or don’t configure this policy setting, the default state of camera recording is determined by the user, unless the “Turn off microphone recording by default when recording a slide show” policy setting is enabled. Enabling that policy setting also turns off camera recording by default.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_defaultvideooffinrecordingpresenterview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_defaultvideooffinrecordingpresenterview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems","displayName":"Disable commands (User)","description":"This policy setting allows you to disable specific command bar buttons and menu items in the specified applications. \r\n\r\nIf you enable this policy setting you can disable specific command bar buttons and menu items in the user interface for the selected application. The predefined list of command bar buttons and menu items you can disable becomes available to you when you enable this policy setting. \r\n\r\nIf you disable or do not configure this policy setting, the predefined list of command bar buttons and menu items are enabled for the application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_broadcastslideshow","displayName":"Slide Show tab | Start Slide Show | Broadcast Slide Show (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_broadcastslideshow_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_broadcastslideshow_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filesendtomailrecipient","displayName":"File tab | Share | Send Using E-mail (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filesendtomailrecipient_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filesendtomailrecipient_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filewebpagepreview","displayName":"File tab | Options | Customize Ribbon | All Commands | Web Page Preview (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filewebpagepreview_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filewebpagepreview_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_inserthyperlinkppt","displayName":"Insert tab | Links | Hyperlink (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_inserthyperlinkppt_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_inserthyperlinkppt_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolslanguage","displayName":"Review tab | Language | Language (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolslanguage_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolslanguage_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacromacrosppt","displayName":"Developer tab | Code | Macros (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacromacrosppt_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacromacrosppt_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrosecurity","displayName":"Developer tab | Code | Macro Security (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrosecurity_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrosecurity_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrovisualbasiceditorppt","displayName":"Developer tab | Code | Visual Basic (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrovisualbasiceditorppt_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrovisualbasiceditorppt_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_webaddressppt","displayName":"File tab | Options | Customize Ribbon | All Commands | Address (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_webaddressppt_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_webaddressppt_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys","displayName":"Disable shortcut keys (User)","description":"This policy setting allows you to disable specific shortcut key combinations in the specified applications. \r\n\r\nIf you enable this policy setting you can disable specific shortcut keys for the selected application. The predefined list of shortcut keys you can disable becomes available to you when you enable this policy setting. \r\n\r\nIf you disable or do not configure this policy setting, the predefined list of shortcut keys are enabled for the application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_altf11toolsmacrovisualbasiceditorppt","displayName":"Alt+F11 (Developer | Code | Visual Basic) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_altf11toolsmacrovisualbasiceditorppt_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_altf11toolsmacrovisualbasiceditorppt_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_altf8toolsmacromacros","displayName":"Alt+F8 (Developer | Code | Macros) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_altf8toolsmacromacros_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_altf8toolsmacromacros_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlf5broadcastslideshow","displayName":"Ctrl+F5 (Slide Show | Start Slide Show | Broadcast Slide Show) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlf5broadcastslideshow_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlf5broadcastslideshow_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlffindppt","displayName":"Ctrl+F (Home | Editing | Find) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlffindppt_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlffindppt_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlkinserthyperlinkppt","displayName":"Ctrl+K (Insert | Links | Hyperlink) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlkinserthyperlinkppt_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlkinserthyperlinkppt_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_enablerecordingribbontab","displayName":"Turn on recording ribbon tab (User)","description":"This policy setting allows you to control the initial recording ribbon tab in PowerPoint. By default, the tab is not visible.\r\n\r\nIf you enable this policy setting, recording ribbon tab is visible. But, the user can choose to turn off the feature manually in the UI.\r\n\r\nIf you disable or don’t configure this policy setting, recording ribbon tab is not visible. The user can choose to turn on the feature manually in the UI.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_enablerecordingribbontab_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_enablerecordingribbontab_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_hidebuiltintablestyles","displayName":"Hide built in table styles (User)","description":"Hides the built in table styles for PowerPoint. By default, built-in styles are shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_hidebuiltintablestyles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_disableitemsinuserinterface~l_predefined_l_hidebuiltintablestyles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_backgroundaccessibilitycheckerinformation","displayName":"Check for accessibility issues while editing (User)","description":"This policy setting controls whether accessibility issues are checked for automatically while the user is editing a presentation. By default, accessibility issues aren’t checked for automatically.\r\n\r\nIf you enable this policy setting, accessibility issues are checked for automatically and users won’t be able to turn it off. The status bar will indicate if accessibility recommendations are available to make the presentation more usable by people with disabilities.\r\n\r\nIf you disable or don’t configure this policy setting, accessibility issues won’t be checked for automatically while editing a presentation. Users can turn on automatic checking by going to File > Options > Ease of Access.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_backgroundaccessibilitycheckerinformation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_backgroundaccessibilitycheckerinformation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingalttextaccessibilityinformation","displayName":"Stop checking for alt text accessibility information (User)","description":"This policy setting prevents the Accessibility Checker from verifying that objects such as images and shapes contain alt text.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that objects such as images and shapes contain alt text.\r\n\r\nIf you disable or do not configure this policy setting, objects will be checked for alternative text and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingalttextaccessibilityinformation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingalttextaccessibilityinformation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingforblanktablerowsandcolumns","displayName":"Stop checking for blank table rows and columns (User)","description":"This policy setting prevents the Accessibility Checker from verifying that blank rows and columns have not been inserted into tables.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that blank rows and columns have not been inserted into tables.\r\n\r\nIf you disable or do not configure this policy setting, tables will be checked for blank rows and columns and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingforblanktablerowsandcolumns_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingforblanktablerowsandcolumns_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingformediafilescaptions","displayName":"Stop checking for media files which might need captions (User)","description":"This policy setting prevents the Accessibility Checker from flagging media files that might need caption information.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from flagging media files that might need caption information.\r\n\r\nIf you disable or do not configure this policy setting, presentations will be scanned for media files and the results will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingformediafilescaptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingformediafilescaptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingformergedandsplitcells","displayName":"Stop checking for merged and split cells (User)","description":"This policy setting prevents the Accessibility Checker from verifying that tables do not have merged or split cells.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that tables do not have merged or split cells.\r\n\r\nIf you disable or do not configure this policy setting, tables will be checked for merged and split cells and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingformergedandsplitcells_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingformergedandsplitcells_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingmeaningfulorderofobjectsonslides","displayName":"Stop checking to ensure a meaningful order of objects on slides (User)","description":"This policy setting prevents the Accessibility Checker from checking if a slide has non-placeholder objects which might be read back out of order.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from checking if a slide has non-placeholder objects which might be read back out of order.\r\n\r\nIf you disable or do not configure this policy setting, slides will be checked for objects which might be read back out of order and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingmeaningfulorderofobjectsonslides_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingmeaningfulorderofobjectsonslides_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingpresentationsallowprogrammaticaccess","displayName":"Stop checking to ensure presentations allow programmatic access (User)","description":"This policy setting prevents the Accessibility Checker from checking to ensure that presentations have not blocked programmatic access through DRM.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from checking to ensure that presentations have not blocked programmatic access through DRM.\r\n\r\nIf you disable or do not configure this policy setting, presentations will be checked for programmatic access and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingpresentationsallowprogrammaticaccess_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingpresentationsallowprogrammaticaccess_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingtablealttextaccessibilityinformation","displayName":"Stop checking for table alt text accessibility information (User)","description":"This policy setting prevents the Accessibility Checker from verifying that tables contain alt text.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that tables contain alt text.\r\n\r\nIf you disable or do not configure this policy setting, tables will be checked for alternative text and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingtablealttextaccessibilityinformation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingtablealttextaccessibilityinformation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingtableheaderaccessibilityinformation","displayName":"Stop checking for table header accessibility information (User)","description":"This policy setting prevents the Accessibility Checker from verifying that tables have a header row specified.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that tables have a header row specified.\r\n\r\nIf you disable or do not configure this policy setting, tables will be checked for header rows and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingtableheaderaccessibilityinformation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingtableheaderaccessibilityinformation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingtextcontrast","displayName":"Stop checking for text color contrast (User)","description":"This policy setting prevents the Accessibility Checker from flagging text with low contrast and readability.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from flagging text with low contrast and readability.\r\n\r\nIf you disable or do not configure this policy setting, text will be scanned for color contrast and the results will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingtextcontrast_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingtextcontrast_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingthatslidetitlesexist","displayName":"Stop checking that slide titles exist (User)","description":"This policy setting prevents the Accessibility Checker from verifying that every slide has a title placeholder.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that every slide has a title placeholder.\r\n\r\nIf you disable or do not configure this policy setting, slides will be checked for titles and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingthatslidetitlesexist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingthatslidetitlesexist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingtoensureeachslidehasauniquetitle","displayName":"Stop checking to ensure each slide has a unique title (User)","description":"This policy setting prevents the Accessibility Checker from verifying that every slide has a unique title.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that every slide has a unique title.\r\n\r\nIf you disable or do not configure this policy setting, slide titles will be checked for uniqueness and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingtoensureeachslidehasauniquetitle_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingtoensureeachslidehasauniquetitle_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingtoensurehyperlinktextismeaningful","displayName":"Stop checking to ensure hyperlink text is meaningful (User)","description":"This policy setting prevents the Accessibility Checker from verifying that hyperlinks have meaningful text.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that hyperlinks have meaningful text.\r\n\r\nIf you disable or do not configure this policy setting, hyperlink text will be checked and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingtoensurehyperlinktextismeaningful_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingtoensurehyperlinktextismeaningful_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_blockallunmanagedaddins","displayName":"Block all unmanaged add-ins (User)","description":"This policy setting blocks all add-ins that are not managed by the \"List of managed add-ins\" policy setting.\r\n\r\nIf you enable this policy setting, and the \"List of managed add-ins\" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the \"List of managed add-ins\" policy setting.\r\n\r\nIf you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the \"List of managed add-ins\" policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_blockallunmanagedaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_blockallunmanagedaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_defaultcustomtab","displayName":"Show custom templates tab by default in PowerPoint on the Office Start screen and in File | New (User)","description":"This policy setting controls whether custom templates (when they exist) show as the default tab in PowerPoint on the Office Start screen and in File | New. \r\n\r\nIf you enable this policy setting, users will the see custom templates tab as the default tab in PowerPoint on the Office Start screen and in File | New when templates exist (this can include Custom XML programmed templates, templates in the Workgroup templates path, templates in the Personal templates path, or SharePoint templates).\r\n\r\nIf you disable or do not configure this policy setting, users will see the Featured templates tab as the default tab in PowerPoint on the Office Start screen and in File | New, unless all Office-provided templates have been disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_defaultcustomtab_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_defaultcustomtab_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_disableofficestartpowerpoint","displayName":"Disable the Office Start screen for PowerPoint (User)","description":"This policy setting controls whether the Office Start screen appears on boot for PowerPoint.\r\n\r\nIf you enable this policy setting, users will not see the Office Start screen when they boot PowerPoint.\r\n\r\nIf you disable or do not configure this policy setting, users will see the Office Start screen when they boot PowerPoint.\r\n\r\nNote: This policy setting is overridden by the policy setting \"Microsoft Office 2016 > Miscellaneous > Disable the Office Start screen for all Office applications\" if that policy setting is set.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_disableofficestartpowerpoint_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_disableofficestartpowerpoint_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_disableslideupdate","displayName":"Disable Slide Update (User)","description":"This policy setting controls whether users can link slides in a presentation with their counterparts in a PowerPoint Slide Library.\r\n\r\nIf you enable this policy setting, PowerPoint cannot check the status of a slide in a Slide Library when a presentation with Slide Update data is opened.\r\n\r\nIf you disable or do not configure this policy setting, each time users open a presentation that contains a shared slide, PowerPoint notifies them if the slide has been updated and provides them with the opportunity to ignore the update, append a new slide to the outdated slide, or replace the outdated slide with the updated one.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_disableslideupdate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_disableslideupdate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_listofmanagedaddins","displayName":"List of managed add-ins (User)","description":"This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the \"Block all unmanaged add-ins\" policy setting.\r\n\r\nTo enable this policy setting, provide the following information for each add-in:\r\n\r\nIn \"Value name,\" specify the programmatic identifier (ProgID) for COM add-ins, or specify the file name of PowerPoint add-ins.\r\n\r\nTo obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Office\\PowerPoint\\Addins or HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Office\\PowerPoint\\Addins.\r\n\r\nTo obtain the file name of an add-in, click the File menu in the application where the add-in is installed. Click Options, click Add-ins, and then use the Location column to determine the file name of the add-in.\r\n\r\nYou can also obtain the ProgID or the file name of an add-in by using Office Telemetry Dashboard.\r\n\r\nIn \"Value,\" specify the value as follows:\r\n\r\nTo specify that an add-in is always disabled (blocked), type 0.\r\n\r\nTo specify that an add-in is always enabled, type 1.\r\n\r\nTo specify that an add-in is configurable by the user and not blocked by the \"Block all unmanaged add-ins\" policy setting when enabled, type 2.\r\n\r\nIf you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the \"Block all unmanaged add-ins\" policy setting is enabled, then all add-ins are blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_listofmanagedaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_listofmanagedaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_listofmanagedaddins_l_listofmanagedaddins2","displayName":"List of managed add-ins (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_listofmanagedaddins_l_listofmanagedaddins2_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_listofmanagedaddins_l_listofmanagedaddins2_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_personaltemplatespath","displayName":"Personal templates path for PowerPoint (User)","description":"This policy setting specifies the location of a user's personal templates. \r\n\r\nIf you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. \r\n\r\nIf you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_personaltemplatespath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_personaltemplatespath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160_l_personaltemplatespath_l_personaltemplatespath","displayName":"Personal templates path (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160~l_serversettings_l_turnofffilesynchronizationviasoapoverhttp","displayName":"Turn off file synchronization via SOAP over HTTP (User)","description":"This policy setting controls file synchronization via SOAP over HTTP for PowerPoint.\r\n\r\nIf you enable this policy setting, file synchronization via SOAP over HTTP is turned off for PowerPoint.\r\n\r\nIf you disable or do not configure this policy setting this policy setting, file synchronization via SOAP over HTTP is turned on for PowerPoint.\r\n\r\nNote: Turning off file synchronization via SOAP over HTTP will also prevent co-authoring and adversely affect the behavior of SharePoint Workspaces.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160~l_serversettings_l_turnofffilesynchronizationviasoapoverhttp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_miscellaneous160~l_serversettings_l_turnofffilesynchronizationviasoapoverhttp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_allowautoextendfordesktop","displayName":"Allow PowerPoint to also automatically extend the display when presenting on a desktop (User)","description":"This policy setting specifies whether PowerPoint can also automatically extend the display when users present on a desktop computer.\r\n\r\nIf you enable this policy setting, PowerPoint will automatically extend the display when users present on a desktop computer, if the \"Automatically extend display when presenting on a laptop or tablet\" checkbox on the UI under File | Options | Advanced | Display is checked.\r\n\r\nIf you disable or do not configure this policy setting, PowerPoint does not automatically extend the display when users present on a desktop computer, even if the \"Automatically extend display when presenting on a laptop or tablet\" checkbox on the UI under File | Options | Advanced | Display is checked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_allowautoextendfordesktop_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_allowautoextendfordesktop_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_backgroundprinting","displayName":"Print in background (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_backgroundprinting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_backgroundprinting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_chartreftrackingenabled","displayName":"Allow formatting and labels to track data points (User)","description":"This policy setting governs how custom formatting and data labels react to data changes in a chart.\r\n\r\nIf you enable or do not configure this policy setting, when the user creates a new presentation, custom formatting and data labels follow data points as they move or change in any chart in the workbook.\r\n\r\nIf you disable this policy setting, custom formatting and data labels do not follow data points, but instead follow data point indices.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_chartreftrackingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_chartreftrackingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_disablesettopology","displayName":"Do not allow PowerPoint to automatically extend the display when presenting on a laptop or tablet (User)","description":"This policy setting specifies whether PowerPoint automatically extends the display when users present on a laptop or tablet computer.\r\n\r\nIf you enable this policy setting, PowerPoint does not automatically extend the display when users present on a laptop or tablet computer. In addition, the \"Automatically extend display when presenting on a laptop or tablet\" checkbox on the user interface (UI) under File | Options | Advanced | Display is unchecked.\r\n\r\nIf you disable or do not configure this policy setting, PowerPoint automatically extends the display when users present on a laptop or tablet computer. Users can change this behavior by unchecking the \"Automatically extend display when presenting on a laptop or tablet\" checkbox on the UI under File | Options | Advanced | Display","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_disablesettopology_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_disablesettopology_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_displayenterprisethemes","displayName":"Display enterprise themes (User)","description":"This policy allows you to display enterprise themes in the ribbon galleries. You can also name the category for the themes, and you can hide all the Office in-box and connected gallery themes.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_displayenterprisethemes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_displayenterprisethemes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_displayenterprisethemes_l_displayenterprisethemesdontshowothers","displayName":"Only show enterprise themes (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_displayenterprisethemes_l_displayenterprisethemesdontshowothers_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_displayenterprisethemes_l_displayenterprisethemesdontshowothers_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_displayenterprisethemes_l_displayenterprisethemesgallerytitle","displayName":"Enterprise themes category title (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_donotdisturb","displayName":"Set user availablity to Do not Disturb during Slide Show (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_donotdisturb_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_donotdisturb_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_draganddroptextediting","displayName":"Allow text to be dragged and dropped (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_draganddroptextediting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_draganddroptextediting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_endwithblackslide","displayName":"End with black slide (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_endwithblackslide_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_endwithblackslide_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_maximumnumberofundos","displayName":"Maximum number of undos (User)","description":"Specifies the maximum number of undo levels.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_maximumnumberofundos_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_maximumnumberofundos_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_maximumnumberofundos_l_maximumnumberofundos2","displayName":"Maximum number of undos (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_popupmenuonrightmouseclick","displayName":"Show menu on right mouse click (User)","description":"Checked: Checks the option ''Show menu on right mouse click''. | Unchecked: Unchecks the option ''Show menu on right mouse click''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_popupmenuonrightmouseclick_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_popupmenuonrightmouseclick_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_printinsertedobjectsatprinterresolution","displayName":"Print inserted objects at printer resolution (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_printinsertedobjectsatprinterresolution_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_printinsertedobjectsatprinterresolution_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_printtruetypefontsasgraphics","displayName":"Print TrueType fonts as graphics (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_printtruetypefontsasgraphics_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_printtruetypefontsasgraphics_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_recentlyusedfilelist","displayName":"Number of presentations in the Recent Presentations list (User)","description":"This policy setting specifies the number of entries displayed in the Recent Presentations list that appears when users click Open on the File tab in Backstage view.\r\n\r\nIf you enable this policy setting, you can specify the number of entries to be between 0 and 50. If you set the number to 0, all pinned and unpinned entries are hidden.\r\n\r\nIf you disable or do not configure this policy setting, a maximum of 25 items will be displayed in the Recent Presentations list.\r\n\r\nNote: If you want to prevent items from being added to the Recent Presentations list entirely, you can enable the \"Do not keep history of recently opened documents\" Windows policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_recentlyusedfilelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_recentlyusedfilelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_recentlyusedfilelist_l_sizeofrecentlyusedfilelist","displayName":"Size of recently used file list (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_setnumberofplacesintherecentplaceslist","displayName":"Number of folders in the Recent Folders list (User)","description":"This policy setting specifies the number of unpinned entries displayed in the Recent Folders list that appears when users click Open or Save As on the File tab in Backstage view.\r\n\r\nIf you enable this policy setting, you can specify the number of unpinned entries to be between 0 and 20. If you set the number to 0, all pinned and unpinned entries are hidden.\r\n\r\nIf you disable or do not configure this policy setting, a maximum of 5 unpinned items are displayed in the Recent Folders list.\r\n\r\nNote: If you want to prevent items from being added to the Recent Folders list entirely, you can enable the \"Do not keep history of recently opened documents\" Windows policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_setnumberofplacesintherecentplaceslist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_setnumberofplacesintherecentplaceslist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_setnumberofplacesintherecentplaceslist_l_setnumberofplacesintherecentplaceslistspinid","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_showpopupmenubutton","displayName":"Show popup toolbar (User)","description":"Checked: Checks the option ''Show popup toolbar''. | Unchecked: Unchecks the option ''Show popup toolbar''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_showpopupmenubutton_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_showpopupmenubutton_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_usesmartcutandpaste","displayName":"Use smart cut and paste (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_usesmartcutandpaste_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_usesmartcutandpaste_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_verticalruler","displayName":"Show vertical ruler (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_verticalruler_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_verticalruler_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_whenselectingautomaticallyselectentireword","displayName":"When selecting, automatically select entire word (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_whenselectingautomaticallyselectentireword_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_whenselectingautomaticallyselectentireword_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_windowsintaskbar","displayName":"Show all windows in the Taskbar (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_windowsintaskbar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced_l_windowsintaskbar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced~l_weboptions~l_general_l_resizegraphicstofitbrowserwindow","displayName":"Resize graphics to fit browser window (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced~l_weboptions~l_general_l_resizegraphicstofitbrowserwindow_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced~l_weboptions~l_general_l_resizegraphicstofitbrowserwindow_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced~l_weboptions~l_general_l_showslideanimationwhilebrowsing","displayName":"Show slide animation while browsing (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced~l_weboptions~l_general_l_showslideanimationwhilebrowsing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced~l_weboptions~l_general_l_showslideanimationwhilebrowsing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced~l_weboptions~l_general_l_slidenavigation","displayName":"Slide navigation (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced~l_weboptions~l_general_l_slidenavigation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced~l_weboptions~l_general_l_slidenavigation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced~l_weboptions~l_general_l_slidenavigation_l_addslidenavigationcontrols","displayName":"Add slide navigation controls (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced~l_weboptions~l_general_l_slidenavigation_l_addslidenavigationcontrols_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced~l_weboptions~l_general_l_slidenavigation_l_addslidenavigationcontrols_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced~l_weboptions~l_general_l_slidenavigation_l_colors","displayName":"Colors (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced~l_weboptions~l_general_l_slidenavigation_l_colors_browsercolors","displayName":"Browser colors","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced~l_weboptions~l_general_l_slidenavigation_l_colors_presentationschemetextcolor","displayName":"Presentation colors (text color)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced~l_weboptions~l_general_l_slidenavigation_l_colors_presentationschemeaccentcolor","displayName":"Presentation colors (accent color)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced~l_weboptions~l_general_l_slidenavigation_l_colors_whitetextonblack","displayName":"White text on black","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_advanced~l_weboptions~l_general_l_slidenavigation_l_colors_blacktextonwhite","displayName":"Black text on white","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionscustomizeribbon_l_displaydevelopertab","displayName":"Display Developer tab in the Ribbon (User)","description":"This policy setting controls whether the Developer tab will be displayed in the Ribbon.\r\n\r\nIf you enable this policy setting, the Developer tab will be displayed in the Ribbon.\r\n\r\nIf you disable this policy setting, the Developer tab will not be displayed in the Ribbon.\r\n\r\nIf you do not configure this policy setting, the Developer tab will not be displayed in the Ribbon, but its visibility can be changed via a setting in the application Options dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionscustomizeribbon_l_displaydevelopertab_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionscustomizeribbon_l_displaydevelopertab_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_allowselectionfloaties","displayName":"Show Mini Toolbar on selection (User)","description":"Disabling this policy setting will result in Mini Toolbar not being displayed on text selection. By default, Mini Toolbar on selection is enabled and its visibility can be changed via a setting in the PowerPoint Options dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_allowselectionfloaties_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_allowselectionfloaties_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_disablegallerypreviews","displayName":"Enable Live Preview (User)","description":"Shows or hides the Live Preview that appear when using Galleries that support previews. Live Preview shows how a command would be applied without actually applying it to the document.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_disablegallerypreviews_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_disablegallerypreviews_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_disableincrementaldownload","displayName":"Wait to show users a cloud-based presentation until all content is downloaded (User)","description":"\r\nThis policy setting allows you to control whether PowerPoint waits until all content is downloaded before showing a presentation to the user. This policy setting applies to presentations that are opened from a cloud-based location, such as OneDrive Personal, OneDrive for Business, or SharePoint Online.\r\n\r\nBy default, when the user opens a cloud-based presentation in PowerPoint, the user can view the presentation while other content, such as images or video, continues to download. But, some functionality, such as editing and presenting, is limited or not available until the entire contents of the presentation are downloaded.\r\n\r\nIf you enable this policy setting, PowerPoint will wait, when opening a cloud-based presentation, until the entire contents of the presentation are downloaded before showing the presentation to the user.\r\n\r\nYou may want to enable this policy setting if you have add-ins or automated processes that rely on the entire contents of the presentation being available and fully editable as soon as the presentation is shown.\r\n\r\nIf you disable or don't configure this setting, PowerPoint opens cloud-based files more quickly, so the user can start viewing the presentation while the other content downloads.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_disableincrementaldownload_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_disableincrementaldownload_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_disablelivesubtitles","displayName":"Don’t allow the use of Live Subtitles (User)","description":"\r\nThis policy setting controls whether users can turn on Live Subtitles during a presentation. By default, Live Subtitles are off but can be turned on by users.\r\n\r\nIf you enable this policy setting, users can't turn on Live Subtitles during a presentation.\r\n\r\nIf you disable or don't configure this policy setting, users can turn on Live Subtitles.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_disablelivesubtitles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_disablelivesubtitles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_disablequickstarter","displayName":"Turn off QuickStarter (User)","description":"This policy setting controls whether QuickStarter is available to users. By default, QuickStarter is available to users if they meet the language and region requirements for the feature.\r\n\r\nIf you enable this policy setting, QuickStarter won’t be available to users.\r\n\r\nIf you disable or don’t configure this policy setting, QuickStarter will be available to users if they meet the language and region requirements for the feature.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_disablequickstarter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_disablequickstarter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_disablesummaryslidesectionzoom","displayName":"Don’t allow Summary Zoom, Slide Zoom, and Section Zoom in a PowerPoint presentation (User)","description":"This policy setting controls whether users can insert and playback a Summary Zoom, a Slide Zoom, or a Section Zoom in a PowerPoint presentation. By default, users can use these types of Zoom in a presentation.\r\n\r\nIf you enable this policy setting, users can’t use these types of Zoom in a presentation.\r\n\r\nIf you disable or don’t configure this policy setting, users can use these types of Zoom in a presentation.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_disablesummaryslidesectionzoom_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_disablesummaryslidesectionzoom_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_promptifpowerpointisnotdefault","displayName":"Prompt the user if PowerPoint is not the default application for its file extensions (User)","description":"This policy setting specifies whether PowerPoint prompts users to change their file extension associations for any file types that are no longer associated with PowerPoint.\r\n\r\nIf you enable this policy setting, when users start PowerPoint, they are not prompted to change file extensions for any files that are no longer associated with PowerPoint. In addition, the checkbox on the user interface (UI) under File |Options | General | Start up options | Tell me is unchecked.\r\n\r\nIf you disable or do not configure this policy setting, when users start PowerPoint, they are prompted to change file extensions for any files that are no longer associated with PowerPoint. Users can change this behavior either by selecting the checkbox displayed in the prompt, or by selecting the UI checkbox under File |Options | General | Start up options | Tell me (which is selected by default).\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_promptifpowerpointisnotdefault_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_promptifpowerpointisnotdefault_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_powerpointdesigner_l_powerpointdesigneroptions","displayName":"[Deprecated] PowerPoint Designer Options (User)","description":"Important: This policy setting is no longer supported and will be removed in a future release. Please use the \"PowerPoint Designer Options\" policy setting from the PowerPoint policy set instead.\r\n\r\nThis policy setting allows an administrator to enable or disable PowerPoint Designer","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_powerpointdesigner_l_powerpointdesigneroptions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_powerpointdesigner_l_powerpointdesigneroptions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_powerpointdesigner_l_powerpointdesigneroptions_l_powerpointdesigneroptions","displayName":"PowerPoint Designer options (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_powerpointdesigner_l_powerpointdesigneroptions_l_powerpointdesigneroptions_0","displayName":"Disable PowerPoint Designer","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_powerpointdesigner_l_powerpointdesigneroptions_l_powerpointdesigneroptions_73187","displayName":"Enable PowerPoint Designer","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_proofing_l_checkspellingasyoutype","displayName":"Check spelling as you type (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_proofing_l_checkspellingasyoutype_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_proofing_l_checkspellingasyoutype_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_proofing_l_enablecontextualspellingpolicy","displayName":"Check grammar with spelling (User)","description":"Enabling this policy to turn contextual spelling on by default.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_proofing_l_enablecontextualspellingpolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_proofing_l_enablecontextualspellingpolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_proofing~l_autoformatasyoutype_l_autofitbodytexttoplaceholder","displayName":"AutoFit body text to placeholder (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_proofing~l_autoformatasyoutype_l_autofitbodytexttoplaceholder_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_proofing~l_autoformatasyoutype_l_autofitbodytexttoplaceholder_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_proofing~l_autoformatasyoutype_l_autofittitletexttoplaceholder","displayName":"AutoFit title text to placeholder (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_proofing~l_autoformatasyoutype_l_autofittitletexttoplaceholder_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_proofing~l_autoformatasyoutype_l_autofittitletexttoplaceholder_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_proofing~l_autoformatasyoutype_l_replacestraightquoteswithsmartquotes","displayName":"Replace straight quotes with smart quotes (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_proofing~l_autoformatasyoutype_l_replacestraightquoteswithsmartquotes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_proofing~l_autoformatasyoutype_l_replacestraightquoteswithsmartquotes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_defaultfilelocation","displayName":"Default file location (User)","description":"Specifies the default location for presentation files.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_defaultfilelocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_defaultfilelocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_defaultfilelocation_l_defaultfilelocation0","displayName":"Default file location (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_disablepackageforcd","displayName":"Disable Package For CD (User)","description":"Check to Disable Package for CD; Uncheck to Enable Package for CD. Shows or hides the File tab | Save & Send | Package Presentation for CD command. Package for CD allows the user to package and burn presentations onto CD for portable viewing even when PowerPoint is not installed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_disablepackageforcd_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_disablepackageforcd_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_keeplastautosavedversions","displayName":"Keep the last AutoSaved versions of files for the next session (User)","description":"This policy setting determines whether PowerPoint keeps the last AutoSaved version of a file if a user closes a file without saving it. (Note: AutoSave applies only when AutoRecover is enabled.)\r\n\r\nIf you enable or do not configure this policy setting, PowerPoint keeps the last AutoSaved version of the file and makes it available to the user the next time the file is opened if the user closes a file without saving it.\r\n\r\nIf you disable this policy setting, PowerPoint does not keep the last AutoSaved version of the file if the user closes a file without saving it.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_keeplastautosavedversions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_keeplastautosavedversions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_saveautorecoverinfo","displayName":"Save AutoRecover info (User)","description":"Checked: Checks the option ''Save AutoRecover info''. | Unchecked: Unchecks the option ''Save AutoRecover info''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_saveautorecoverinfo_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_saveautorecoverinfo_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_saveautorecoverinfo_l_autorecoversavefrequencyminutes","displayName":"AutoRecover save frequency (minutes): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_saveautorecoverinfo_l_autorecoversavelocation","displayName":"AutoRecover save location (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_saveautorecoverinfo_l_enablesaveautorecoverinfo","displayName":"Enable save AutoRecover info (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_saveautorecoverinfo_l_enablesaveautorecoverinfo_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_saveautorecoverinfo_l_enablesaveautorecoverinfo_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_savepowerpointfilesas","displayName":"Default file format (User)","description":"This policy setting governs the default format for new presentation files that users create.\r\n \r\nIf you enable this policy setting, when a user creates a new blank presentation, it is in the specified default format. Users may still override the default and specify a specific format when they create a presentation.\r\n\r\nIf you disable or do not configure this policy setting, PowerPoint Presentation is the default option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_savepowerpointfilesas_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_savepowerpointfilesas_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_savepowerpointfilesas_l_savepowerpointfilesas1","displayName":"Save PowerPoint files as (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_savepowerpointfilesas_l_savepowerpointfilesas1_27","displayName":"PowerPoint Presentation (*.pptx)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_savepowerpointfilesas_l_savepowerpointfilesas1_28","displayName":"PowerPoint Macro-Enabled Presentation (*.pptm)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_savepowerpointfilesas_l_savepowerpointfilesas1_0","displayName":"PowerPoint 97-2003 Presentation (*.ppt)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_savepowerpointfilesas_l_savepowerpointfilesas1_52","displayName":"OpenDocument Presentation (*.odp)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_turnofffileformatcompatiblitydialogforodp","displayName":"Suppress file format compatibility dialog box for OpenDocument Presentation format (User)","description":"This policy setting allows you to enable or disable the file format compatibility dialog box when saving a file as an OpenDocument presentation file in Microsoft PowerPoint.\r\n\r\nIf you enable this policy, the file format compatibility dialog is displayed whenever you save as an OpenDocument presentation file in PowerPoint.\r\n\r\nIf you disable this policy, the file format compatibility dialog is not displayed when you save as an OpenDocument presentation file in PowerPoint.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_turnofffileformatcompatiblitydialogforodp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_save_l_turnofffileformatcompatiblitydialogforodp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_determinewhethertoforceencryptedppt","displayName":"Scan encrypted macros in PowerPoint Open XML presentations (User)","description":"This policy setting controls whether encrypted macros in Open XML presentations are required to be scanned with anti-virus software before being opened.\r\n\r\nIf you enable this policy setting, you may choose one of these options:\r\n\r\n- Scan encrypted macros: encrypted macros are disabled unless anti-virus software is installed. Encrypted macros are scanned by your anti-virus software when you attempt to open an encrypted presentation that contains macros.\r\n- Scan if anti-virus software available: if anti-virus software is installed, scan the encrypted macros first before allowing them to load. If anti-virus software is not available, allow encrypted macros to load.\r\n- Load macros without scanning: do not check for anti-virus software and allow macros to be loaded in an encrypted file.\r\n\r\nIf you disable or do not configure this policy setting, the behavior will be similar to the \"Scan encrypted macros\" option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_determinewhethertoforceencryptedppt_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_determinewhethertoforceencryptedppt_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_determinewhethertoforceencryptedppt_l_determinewhethertoforceencryptedpptdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_determinewhethertoforceencryptedppt_l_determinewhethertoforceencryptedpptdropid_0","displayName":"Scan encrypted macros (default)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_determinewhethertoforceencryptedppt_l_determinewhethertoforceencryptedpptdropid_1","displayName":"Scan if anti-virus software available","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_determinewhethertoforceencryptedppt_l_determinewhethertoforceencryptedpptdropid_2","displayName":"Load macros without scanning","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_downloadimages","displayName":"Unblock automatic download of linked images (User)","description":"This policy setting determines whether PowerPoint automatically downloads links from external sources.\r\n\r\nIf you enable this policy setting, PowerPoint will load images saved in remote locations.\r\n\r\nIf you disable or do not configure this policy setting, when PowerPoint opens a presentation it does not display any linked images saved on a different computer unless the presentation itself is saved in a trusted location (as configured in the Trust Center).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_downloadimages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_downloadimages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_makehiddenmarkupvisible","displayName":"Make hidden markup visible (User)","description":"This policy setting controls whether hidden markup is visible when users open PowerPoint files in standard or HTML format.\r\n\r\nIf you enable this policy setting, PowerPoint ignores this flag when opening a file, and always displays any markup present in the file. In addition, when saving a file, PowerPoint sets the flag to display markup when the presentation is next opened.\r\n\r\nIf you disable this policy setting, PowerPoint sets the flag according to the state of the \"Show Markup\" option on the Review tab of the Ribbon when it saves presentations in standard or HTML format. In addition, PowerPoint enables or disables the \"Show Markup\" option according to the way the flag is set when it opens files, which means that a presentation saved with hidden markup is opened with the markup still hidden.\r\n\r\nIf you disable this policy setting, the behavior is the equivalent of Enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_makehiddenmarkupvisible_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_makehiddenmarkupvisible_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_runprograms","displayName":"Run Programs (User)","description":"This policy setting controls the prompting and activation behavior for the \"Run Programs\" option for action buttons in PowerPoint.\r\n\r\nIf you enable this policy setting, you can choose from three options to control how the \"Run Programs\" option functions:\r\n\r\n- Disable (don't run any programs). If users click an action button with the \"Run Programs\" action assigned to it, nothing will happen. This option enforces the default configuration in PowerPoint.\r\n\r\n- Enable (prompt user before running). If users click an action button with the \"Run Programs\" action assigned to it, PowerPoint will prompt them to continue before running the program.\r\n\r\n- Enable all (run without prompting). If users click an action button with the \"Run Programs\" action assigned to it. PowerPoint will run the program automatically, without prompting.\r\n\r\nIf you disable or do not configure this policy setting, if users click an action with the \"Run Programs\" action assigned to it, nothing will happen. This behavior is the same as Enabled -- Disable (don't run any programs).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_runprograms_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_runprograms_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_runprograms_l_empty","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_runprograms_l_empty_0","displayName":"disable (don't run any programs)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_runprograms_l_empty_1","displayName":"enable (prompt user before running)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_runprograms_l_empty_2","displayName":"enable all (run without prompting)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_turnofffilevalidation","displayName":"Turn off file validation (User)","description":"This policy setting allows you turn off the file validation feature.\r\n\r\nIf you enable this policy setting, file validation will be turned off.\r\n\r\nIf you disable or do not configure this policy setting, file validation will be turned on. Office Binary Documents (97-2003) are checked to see if they conform against the file format schema before they are opened.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_turnofffilevalidation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security_l_turnofffilevalidation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_configurecngcipherchainingmode","displayName":"Configure CNG cipher chaining mode (User)","description":"This policy setting allows you to configure the cipher chaining mode used.\r\n\r\nIf you enable this policy setting, the cipher chaining mode specified will be applied.\r\n\r\nIf you disable or do not configure this policy setting, Cipher Block Chaining (CBC) will be the default CNG cipher chaining mode used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_l_configurecngcipherchainingmodedropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_l_configurecngcipherchainingmodedropid_chainingmodecbc","displayName":"Cipher Block Chaining (CBC)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_l_configurecngcipherchainingmodedropid_chainingmodecfb","displayName":"Cipher Feedback (CFB)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_setcngcipheralgorithm","displayName":"Set CNG cipher algorithm (User)","description":"This policy setting allows you to configure the CNG cipher algorithm that is used.\r\n\r\nIf you enable this policy setting, then the cipher provided will be used if it is a supported algorithm.\r\n\r\nIf you disable or do not configure this policy setting, AES will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_setcngcipheralgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_setcngcipheralgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_setcngcipheralgorithm_l_setcngcipheralgorithmid","displayName":"CNG cipher algorithm: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_setcngcipherkeylength","displayName":"Set CNG cipher key length (User)","description":"This policy setting allows you to configure the number of bits to use when creating the cipher key. This number will be rounded down to a multiple of 8.\r\n\r\nIf you enable this policy setting, the key bits specified will be used.\r\n\r\nIf you disable or do not configure this policy setting, the default value will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_setcngcipherkeylength_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_setcngcipherkeylength_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_setcngcipherkeylength_l_setcngcipherkeylengthspinid","displayName":"Cipher key length (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_setcngpasswordspincount","displayName":"Set CNG password spin count (User)","description":"This policy setting allows you to specify the number of times to spin (rehash) the password verifier.\r\n\r\nIf you enable this policy setting, the number specified will be the number of times the password will be rehashed.\r\n\r\nIf you disable or do not configure this policy setting, the default (100000) will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_setcngpasswordspincount_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_setcngpasswordspincount_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_setcngpasswordspincount_l_setcngpasswordspincountspinid","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_setparametersforcngcontext","displayName":"Set parameters for CNG context (User)","description":"This policy setting allows you to specify the encryption parameters that should be used for the CNG context. \r\n\r\nIf you enable this policy setting, the parameters specified will be passed to the CNG context.\r\n\r\nIf you disable or do not configure this policy setting, the default CNG values will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_setparametersforcngcontext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_setparametersforcngcontext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_setparametersforcngcontext_l_setparametersforcngcontextid","displayName":"Parameters (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifycnghashalgorithm","displayName":"Specify CNG hash algorithm (User)","description":"This policy setting allows you to specify the hash algorithm used.\r\n\r\nIf you enable this policy setting, the hashing algorithm selected will be used by CNG.\r\n\r\nIf you disable or do not configure this policy setting, the default CNG hash algorithm will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifycnghashalgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifycnghashalgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha1","displayName":"SHA1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha256","displayName":"SHA256","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha384","displayName":"SHA384","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha512","displayName":"SHA512","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm","displayName":"Specify CNG random number generator algorithm (User)","description":"This policy setting allows you to configure the CNG random number generator to use.\r\n\r\nIf you enable this policy setting, the random number generator specified will be used.\r\n\r\nIf you disable or do not configure this policy setting, the default random number generator will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm_l_specifycngrandomnumbergeneratoralgorithmid","displayName":"Random number generator: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifycngsaltlength","displayName":"Specify CNG salt length (User)","description":"This policy setting allows you to specific the number of bytes of salt that should be used.\r\n\r\nIf you enable this policy setting, the bytes specified will be used.\r\n\r\nIf you disable or do not configure this policy setting, the default length or 16 will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifycngsaltlength_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifycngsaltlength_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifycngsaltlength_l_specifycngsaltlengthspinid","displayName":"Number of bytes (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifyencryptioncompatibility","displayName":"Specify encryption compatibility (User)","description":"This policy setting allows you to specify the encrypted database compatibility.\r\n\r\nIf you enable this policy setting, the compatibility format specified will be applied during encryption for new files\r\n- Use legacy format\r\n- Use next generation format\r\n- All files save with next generation: All files save with the next generation format\r\n\r\nIf you disable or do not configure this policy setting, the default setting, \"Use next generation format,\" will be applied.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifyencryptioncompatibility_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifyencryptioncompatibility_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifyencryptioncompatibility_l_specifyencryptioncompatibilitydropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifyencryptioncompatibility_l_specifyencryptioncompatibilitydropid_0","displayName":"Use legacy format","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifyencryptioncompatibility_l_specifyencryptioncompatibilitydropid_1","displayName":"Use next generation format","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_specifyencryptioncompatibility_l_specifyencryptioncompatibilitydropid_2","displayName":"All files save with next generation","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_usenewkeyonpasswordchange","displayName":"Use new key on password change (User)","description":"This policy setting allows you to specify if a new encryption key is used when the password is changed.\r\n\r\nIf you enable or do not configure this policy setting, a new intermediate key is generated when the password is changed. This causes any extra key encryptors to be removed when the file is saved.\r\n\r\nIf you disable this policy setting, a new intermediate key is not generated when the password is changed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_usenewkeyonpasswordchange_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_cryptography_l_usenewkeyonpasswordchange_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_blockmacroexecutionfrominternet","displayName":"Block macros from running in Office files from the Internet (User)","description":"\r\n This policy setting allows you to block macros from running in Office files that come from the Internet.\r\n\r\n If you enable this policy setting, macros are blocked from running, even if “Enable all macros” is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to “Enable Content,” users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run.\r\n\r\n If you disable or don’t configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_blockmacroexecutionfrominternet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_blockmacroexecutionfrominternet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_disableallapplicationextensions","displayName":"Disable all application add-ins (User)","description":"This policy setting disables all add-ins for the specified Office 2016 applications.\r\n \r\nIf you enable this policy setting, all add-ins for the specified Office 2016 applications are disabled.\r\n\r\nIf you disable or do not configure this policy setting, all add-ins for the specified Office 2016 applications are allowed to run without notifying the users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_disableallapplicationextensions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_disableallapplicationextensions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned","displayName":"Disable Trust Bar Notification for unsigned application add-ins and block them (User) (Deprecated)","description":"This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the \"Require that application add-ins are signed by Trusted Publisher\" policy setting, which prevents users from changing this policy setting.\r\n\r\nIf you enable this policy setting, applications automatically disable unsigned add-ins without informing users.\r\n \r\nIf you disable this policy setting, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.\r\n\r\nIf you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the \"Add-ins\" category of the Trust Center for the application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_v2","displayName":"Disable Trust Bar Notification for unsigned application add-ins and block them (User)","description":"This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the \"Require that application add-ins are signed by Trusted Publisher\" policy setting, which prevents users from changing this policy setting.\r\n\r\nIf you enable this policy setting, applications automatically disable unsigned add-ins without informing users.\r\n \r\nIf you disable this policy setting, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.\r\n\r\nIf you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the \"Add-ins\" category of the Trust Center for the application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_requirethatapplicationextensionsaresigned","displayName":"Require that application add-ins are signed by Trusted Publisher (User)","description":"This policy setting controls whether add-ins for this applications must be digitally signed by a trusted publisher.\r\n \r\nIf you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2016 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Office 2016 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2016, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.\r\n\r\nIf you disable or do not configure this policy setting, this application does not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_requirethatapplicationextensionsaresigned_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_requirethatapplicationextensionsaresigned_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_setmaximumnumberoftrusteddocuments","displayName":"Set maximum number of trusted documents (User)","description":"This policy setting allows you to specify the maximum number of trust records for trusted documents that can be stored in the registry before the purge task runs. The purge task reduces the number of trusted documents stored in the registry to the value set by the \"Set maximum number of trust records to preserve\" policy setting.\r\n\r\nIf you enable this policy setting, you can specify the maximum number of trusted documents to be stored in the registry before the purge task runs, with an upper limit of 20,000 documents. For performance reasons, we do not recommend setting this policy setting to the upper limit.\r\n\r\nIf you disable or do not configure this policy setting, the default value of 500 is used for the maximum number of trusted documents that can be stored in the registry before the purge task runs.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_setmaximumnumberoftrusteddocuments_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_setmaximumnumberoftrusteddocuments_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_setmaximumnumberoftrusteddocuments_l_setmaximumnumberoftrusteddocumentsspinid","displayName":"Maximum number: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_setmaximumnumberoftrustrecordstopreserve","displayName":"Set maximum number of trust records to preserve (User)","description":"This policy setting allows you to specify the maximum number of trust records to preserve when the purge task detects that this application has trusted more than the number of trusted documents set by the \"Set maximum number of trusted documents\" policy setting.\r\n\r\nIf you enable this policy setting, you may specify the maximum number of trust records to preserve, with an upper limit of 20000. Due to performance reasons, it is not recommended to set it to the upper limit.\r\n\r\nIf you disable or you do not configure this policy setting, the default value for of 400 is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_setmaximumnumberoftrustrecordstopreserve_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_setmaximumnumberoftrustrecordstopreserve_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_setmaximumnumberoftrustrecordstopreserve_l_setmaximumnumberoftrustrecordstopreservespinid","displayName":"Maximum to preserve: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_trustaccesstovisualbasicproject","displayName":"Trust access to Visual Basic Project (User)","description":"This policy setting controls whether automation clients such as Microsoft Visual Studio 2005 Tools for Microsoft Office (VSTO) can access the Visual Basic for Applications project system in the specified applications. VSTO projects require access to the Visual Basic for Applications project system in Excel, PowerPoint, and Word, even though the projects do not use Visual Basic for Applications. Design-time support of controls in both Visual Basic and C# projects depends on the Visual Basic for Applications project system in Word and Excel.\r\n\r\nIf you enable this policy setting, VSTO and other automation clients can access the Visual Basic for Applications project system in the specified applications. Users will not be able to change this behavior through the \"Trust access to the VBA project object model\" user interface option under the Macro Settings section of the Trust Center.\r\n\r\nIf you disable this policy setting, VSTO does not have programmatic access to VBA projects. In addition, the \"Trust access to the VBA project object model\" check box is cleared and users cannot change it. Note: Disabling this policy setting prevents VSTO projects from interacting properly with the VBA project system in the selected application.\r\n\r\nIf you do not configure this policy setting, automation clients do not have programmatic access to VBA projects. Users can enable this by selecting the \"Trust access to the VBA project object model\" in the \"Macro Settings\" section of the Trust Center. However, doing so allows macros in any documents the user opens to access the core Visual Basic objects, methods, and properties, which represents a potential security hazard.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_trustaccesstovisualbasicproject_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_trustaccesstovisualbasicproject_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_turnofftrusteddocuments","displayName":"Turn off trusted documents (User)","description":"This policy setting allows you to turn off the trusted documents feature. The trusted documents feature allows users to always enable active content in documents such as macros, ActiveX controls, data connections, etc. so that they are not prompted the next time they open the documents. Trusted documents are exempt from security notifications.\r\n\r\nIf you enable this policy setting, you will turn off the trusted documents feature. Users will receive a security prompt every time a document containing active content is opened.\r\n\r\nIf you disable or do not configure this policy setting, documents will be trusted when users enable content for a document, and users will not receive a security prompt.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_turnofftrusteddocuments_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_turnofftrusteddocuments_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_turnofftrusteddocumentsonthenetwork","displayName":"Turn off Trusted Documents on the network (User)","description":"This policy setting allows you to turn off the trusted documents feature for documents opened from the network.\r\n\r\nIf you enable this policy setting, users will always see security notifications for active content such as macros, ActiveX controls, data connections, etc. for documents opened from the network.\r\n\r\nIf you disable or do not configure this policy setting, the trusted documents feature allows users to always allow active content in documents such as macros, ActiveX controls, data connections, etc. so that users are not prompted the next time they open the documents. Trusted documents are exempt from security notifications.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_turnofftrusteddocumentsonthenetwork_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_turnofftrusteddocumentsonthenetwork_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_vbawarningspolicy","displayName":"VBA Macro Notification Settings (User)","description":"This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.\r\n\r\nIf you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:\r\n \r\n- Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.\r\n \r\n- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.\r\n \r\n- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.\r\n \r\n- Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.\r\n \r\nIf you disable this policy setting, \"Disable all with notification\" will be the default setting.\r\n \r\nIf you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking \"Enable Content\" on the Trust Bar. If the user clicks \"Enable Content\", then the document is added as a trusted document.\r\n \r\nImportant: If \"Disable all except digitally signed macros\" is selected, users will not be able to open unsigned Access databases.\r\n \r\nAlso, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.\r\n \r\nTherefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_vbawarningspolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_vbawarningspolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty3","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty3_2","displayName":"Disable all with notification","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty3_3","displayName":"Disable all except digitally signed macros","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty3_4","displayName":"Disable all without notification","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty3_1","displayName":"Enable all macros (not recommended)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_graphicfilters","displayName":"Graphic Filters (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save PowerPoint files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_graphicfilters_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_graphicfilters_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_graphicfilters_l_graphicfiltersdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_graphicfilters_l_graphicfiltersdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_graphicfilters_l_graphicfiltersdropid_1","displayName":"Save blocked","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforpowerpoint","displayName":"Legacy converters for PowerPoint (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save PowerPoint files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforpowerpoint_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforpowerpoint_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforpowerpoint_l_legacyconvertersforpowerpointdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforpowerpoint_l_legacyconvertersforpowerpointdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforpowerpoint_l_legacyconvertersforpowerpointdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforpowerpoint_l_legacyconvertersforpowerpointdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforpowerpoint_l_legacyconvertersforpowerpointdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforpowerpoint_l_legacyconvertersforpowerpointdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforpowerpoint_l_legacyconvertersforpowerpointdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforpowerpoint","displayName":"Microsoft Office Open XML converters for PowerPoint (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save PowerPoint files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforpowerpoint_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforpowerpoint_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforpowerpoint_l_microsoftofficeopenxmlconvertersforpowerpointdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforpowerpoint_l_microsoftofficeopenxmlconvertersforpowerpointdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforpowerpoint_l_microsoftofficeopenxmlconvertersforpowerpointdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforpowerpoint_l_microsoftofficeopenxmlconvertersforpowerpointdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforpowerpoint_l_microsoftofficeopenxmlconvertersforpowerpointdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforpowerpoint_l_microsoftofficeopenxmlconvertersforpowerpointdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_microsoftofficeopenxmlconvertersforpowerpoint_l_microsoftofficeopenxmlconvertersforpowerpointdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentpresentationfiles","displayName":"OpenDocument Presentation files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save PowerPoint files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentpresentationfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentpresentationfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentpresentationfiles_l_opendocumentpresentationfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentpresentationfiles_l_opendocumentpresentationfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentpresentationfiles_l_opendocumentpresentationfilesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentpresentationfiles_l_opendocumentpresentationfilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentpresentationfiles_l_opendocumentpresentationfilesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentpresentationfiles_l_opendocumentpresentationfilesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumentpresentationfiles_l_opendocumentpresentationfilesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_outlinefiles","displayName":"Outline files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save PowerPoint files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_outlinefiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_outlinefiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_outlinefiles_l_outlinefilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_outlinefiles_l_outlinefilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_outlinefiles_l_outlinefilesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_outlinefiles_l_outlinefilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetaconverters","displayName":"PowerPoint beta converters (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save PowerPoint files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetaconverters_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetaconverters_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetaconverters_l_powerpointbetaconvertersdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetaconverters_l_powerpointbetaconvertersdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetaconverters_l_powerpointbetaconvertersdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetaconverters_l_powerpointbetaconvertersdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetaconverters_l_powerpointbetaconvertersdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetaconverters_l_powerpointbetaconvertersdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetaconverters_l_powerpointbetaconvertersdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetafiles","displayName":"PowerPoint beta files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save PowerPoint files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetafiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetafiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetafiles_l_powerpointbetafilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetafiles_l_powerpointbetafilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetafiles_l_powerpointbetafilesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetafiles_l_powerpointbetafilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetafiles_l_powerpointbetafilesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetafiles_l_powerpointbetafilesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpointbetafiles_l_powerpointbetafilesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior","displayName":"Set default file block behavior (User)","description":"This policy setting allows you to determine if users can open, view, or edit Word files.\r\n\r\nIf you enable this policy setting, you can set one of these options:\r\n- Blocked files are not opened\r\n- Blocked files open in Protected View and can not be edited\r\n- Blocked files open in Protected View and can be edited\r\n\r\nIf you disable or do not configure this policy setting, the behavior is the same as the \"Blocked files are not opened\" setting. Users will not be able to open blocked files.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior_l_setdefaultfileblockbehaviordropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior_l_setdefaultfileblockbehaviordropid_0","displayName":"Blocked files are not opened","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior_l_setdefaultfileblockbehaviordropid_1","displayName":"Blocked files open in Protected View and can not be edited","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior_l_setdefaultfileblockbehaviordropid_2","displayName":"Blocked files open in Protected View and can be edited","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages","displayName":"Web Pages (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save PowerPoint files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages_l_webpagesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages_l_webpagesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages_l_webpagesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages_l_webpagesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages_l_webpagesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages_l_webpagesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages_l_webpagesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_donotopenfilesfromtheinternetzoneinprotectedview","displayName":"Do not open files from the Internet zone in Protected View (User)","description":"This policy setting allows you to determine if files downloaded from the Internet zone open in Protected View.\r\n\r\nIf you enable this policy setting, files downloaded from the Internet zone do not open in Protected View.\r\n\r\nIf you disable or do not configure this policy setting, files downloaded from the Internet zone open in Protected View.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_donotopenfilesfromtheinternetzoneinprotectedview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_donotopenfilesfromtheinternetzoneinprotectedview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_donotopenfilesinunsafelocationsinprotectedview","displayName":"Do not open files in unsafe locations in Protected View (User)","description":"This policy setting lets you determine if files located in unsafe locations will open in Protected View. If you have not specified unsafe locations, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders are considered unsafe locations.\r\n\r\nIf you enable this policy setting, files located in unsafe locations do not open in Protected View.\r\n\r\nIf you disable or do not configure this policy setting, files located in unsafe locations open in Protected View.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_donotopenfilesinunsafelocationsinprotectedview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_donotopenfilesinunsafelocationsinprotectedview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_openfilesonlocalintranetuncinprotectedview","displayName":"Open files on local Intranet UNC in Protected View (User)","description":"This policy setting lets you determine if files on local Intranet UNC file shares open in Protected View.\r\n\r\nIf you enable this policy setting, files on local Intranet UNC file shares open in Protected View if their UNC paths appear to be within the Internet zone.\r\n\r\nIf you disable or do not configure this policy setting, files on Intranet UNC file shares do not open in Protected View if their UNC paths appear to be within the Internet zone.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_openfilesonlocalintranetuncinprotectedview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_openfilesonlocalintranetuncinprotectedview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails","displayName":"Set document behavior if file validation fails (User)","description":"This policy setting controls how Office handles documents when they fail file validation. \r\n\r\nIf you enable this policy setting, you can configure the following options for files that fail file validation:\r\n\r\n- Block files completely. Users cannot open the files.\r\n- Open files in Protected View and disallow edit. Users cannot edit the files. This is also how Office handles the files if you disable this policy setting.\r\n- Open files in Protected View and allow edit. Users can edit the files. This is also how Office handles the files if you do not configure this policy setting.\r\n\r\nIf you disable this policy setting, Office follows the \"Open files in Protected View and disallow edit\" behavior.\r\n\r\nIf you do not configure this policy setting, Office follows the \"Open files in Protected View and allow edit\" behavior.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_l_setdocumentbehavioriffilevalidationfailsdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_l_setdocumentbehavioriffilevalidationfailsdropid_0","displayName":"Block files","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_l_setdocumentbehavioriffilevalidationfailsdropid_1","displayName":"Open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_l_setdocumentbehavioriffilevalidationfailsstr3","displayName":"Checked: Allow edit. Unchecked: Do not allow edit. (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_l_setdocumentbehavioriffilevalidationfailsstr3_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_l_setdocumentbehavioriffilevalidationfailsstr3_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_turnoffprotectedviewforattachmentsopenedfromoutlook","displayName":"Turn off Protected View for attachments opened from Outlook (User)","description":"This policy setting allows you to determine if PowerPoint files in Outlook attachments open in Protected View.\r\n\r\nIf you enable this policy setting, Outlook attachments do not open in Protected View.\r\n\r\nIf you disable or do not configure this policy setting, Outlook attachments open in Protected View.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_turnoffprotectedviewforattachmentsopenedfromoutlook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_protectedview_l_turnoffprotectedviewforattachmentsopenedfromoutlook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_allowtrustedlocationsonthenetwork","displayName":"Allow Trusted Locations on the network (User)","description":"This policy setting controls whether trusted locations on the network can be used.\r\n\r\nIf you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the \"Add new location\" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.\r\n\r\nIf you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. \r\n\r\nIf you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.\r\n\r\nDisabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center. We recommended that you do not enable this policy setting (as the \"Allow Trusted Locations on my network (not recommended)\" check box also states). Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.\r\n\r\nIf you do not enable this policy setting, users can select the \"Allow Trusted Locations on my network (not recommended)\" check box if desired and then specify trusted locations by clicking the \"Add new location\" button.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_allowtrustedlocationsonthenetwork_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_allowtrustedlocationsonthenetwork_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_disabletrustedloc","displayName":"Disable all trusted locations (User)","description":"This policy setting allows administrators to disable all trusted locations in the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data.\r\n \r\nIf you enable this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are ignored, including any trusted locations established by Office 2016 during setup, deployed to users using Group Policy, or added by users themselves. Users will be prompted again when opening files from trusted locations.\r\n\r\nIf you disable or do not configure this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are assumed to be safe.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_disabletrustedloc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_disabletrustedloc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01","displayName":"Trusted Location #1 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_l_allowsubfolders","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_l_allowsubfolders_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_l_allowsubfolders_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_l_datecolon","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_l_descriptioncolon","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_l_pathcolon","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02","displayName":"Trusted Location #2 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_l_allowsubfolders7","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_l_allowsubfolders7_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_l_allowsubfolders7_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_l_datecolon5","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_l_descriptioncolon6","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_l_pathcolon4","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03","displayName":"Trusted Location #3 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_l_allowsubfolders11","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_l_allowsubfolders11_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_l_allowsubfolders11_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_l_datecolon9","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_l_descriptioncolon10","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_l_pathcolon8","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04","displayName":"Trusted Location #4 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_l_allowsubfolders15","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_l_allowsubfolders15_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_l_allowsubfolders15_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_l_datecolon13","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_l_descriptioncolon14","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_l_pathcolon12","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05","displayName":"Trusted Location #5 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_l_allowsubfolders19","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_l_allowsubfolders19_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_l_allowsubfolders19_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_l_datecolon17","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_l_descriptioncolon18","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_l_pathcolon16","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06","displayName":"Trusted Location #6 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_l_allowsubfolders23","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_l_allowsubfolders23_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_l_allowsubfolders23_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_l_datecolon21","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_l_descriptioncolon22","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_l_pathcolon20","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07","displayName":"Trusted Location #7 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_l_allowsubfolders27","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_l_allowsubfolders27_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_l_allowsubfolders27_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_l_datecolon25","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_l_descriptioncolon26","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_l_pathcolon24","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08","displayName":"Trusted Location #8 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_l_allowsubfolders31","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_l_allowsubfolders31_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_l_allowsubfolders31_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_l_datecolon29","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_l_descriptioncolon30","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_l_pathcolon28","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09","displayName":"Trusted Location #9 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_l_allowsubfolders35","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_l_allowsubfolders35_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_l_allowsubfolders35_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_l_datecolon33","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_l_descriptioncolon34","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_l_pathcolon32","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10","displayName":"Trusted Location #10 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_l_allowsubfolders39","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_l_allowsubfolders39_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_l_allowsubfolders39_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_l_datecolon37","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_l_descriptioncolon38","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_l_pathcolon36","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11","displayName":"Trusted Location #11 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_l_allowsubfolders43","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_l_allowsubfolders43_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_l_allowsubfolders43_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_l_datecolon41","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_l_descriptioncolon42","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_l_pathcolon40","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12","displayName":"Trusted Location #12 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_l_allowsubfolders47","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_l_allowsubfolders47_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_l_allowsubfolders47_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_l_datecolon45","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_l_descriptioncolon46","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_l_pathcolon44","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13","displayName":"Trusted Location #13 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_l_allowsubfolders51","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_l_allowsubfolders51_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_l_allowsubfolders51_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_l_datecolon49","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_l_descriptioncolon50","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_l_pathcolon48","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14","displayName":"Trusted Location #14 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_l_allowsubfolders55","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_l_allowsubfolders55_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_l_allowsubfolders55_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_l_datecolon53","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_l_descriptioncolon54","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_l_pathcolon52","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15","displayName":"Trusted Location #15 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_l_allowsubfolders59","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_l_allowsubfolders59_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_l_allowsubfolders59_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_l_datecolon57","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_l_descriptioncolon58","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_l_pathcolon56","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16","displayName":"Trusted Location #16 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_l_allowsubfolders63","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_l_allowsubfolders63_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_l_allowsubfolders63_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_l_datecolon61","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_l_descriptioncolon62","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_l_pathcolon60","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17","displayName":"Trusted Location #17 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_l_allowsubfolders67","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_l_allowsubfolders67_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_l_allowsubfolders67_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_l_datecolon65","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_l_descriptioncolon66","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_l_pathcolon64","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18","displayName":"Trusted Location #18 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_l_allowsubfolders71","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_l_allowsubfolders71_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_l_allowsubfolders71_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_l_datecolon69","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_l_descriptioncolon70","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_l_pathcolon68","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19","displayName":"Trusted Location #19 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_l_allowsubfolders75","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_l_allowsubfolders75_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_l_allowsubfolders75_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_l_datecolon73","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_l_descriptioncolon74","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_l_pathcolon72","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20","displayName":"Trusted Location #20 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_l_allowsubfolders79","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_l_allowsubfolders79_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_l_allowsubfolders79_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_l_datecolon77","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_l_descriptioncolon78","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_l_pathcolon76","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_options~l_security~l_trustcenter~l_fileblocksettings_l_ppt2007andlaterpresentationsshowstemplatesthemesandaddinfiles","displayName":"PowerPoint 2007 and later presentations, shows, templates, themes and add-in files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save PowerPoint files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_options~l_security~l_trustcenter~l_fileblocksettings_l_ppt2007andlaterpresentationsshowstemplatesthemesandaddinfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_options~l_security~l_trustcenter~l_fileblocksettings_l_ppt2007andlaterpresentationsshowstemplatesthemesandaddinfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_options~l_security~l_trustcenter~l_fileblocksettings_l_ppt2007andlaterpresentationsshowstemplatesthemesandaddinfiles_l_powerpoint2007andlaterpresentationsshowstemplatesthemesandaddinfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_options~l_security~l_trustcenter~l_fileblocksettings_l_ppt2007andlaterpresentationsshowstemplatesthemesandaddinfiles_l_powerpoint2007andlaterpresentationsshowstemplatesthemesandaddinfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_options~l_security~l_trustcenter~l_fileblocksettings_l_ppt2007andlaterpresentationsshowstemplatesthemesandaddinfiles_l_powerpoint2007andlaterpresentationsshowstemplatesthemesandaddinfilesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_options~l_security~l_trustcenter~l_fileblocksettings_l_ppt2007andlaterpresentationsshowstemplatesthemesandaddinfiles_l_powerpoint2007andlaterpresentationsshowstemplatesthemesandaddinfilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_options~l_security~l_trustcenter~l_fileblocksettings_l_ppt2007andlaterpresentationsshowstemplatesthemesandaddinfiles_l_powerpoint2007andlaterpresentationsshowstemplatesthemesandaddinfilesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_options~l_security~l_trustcenter~l_fileblocksettings_l_ppt2007andlaterpresentationsshowstemplatesthemesandaddinfiles_l_powerpoint2007andlaterpresentationsshowstemplatesthemesandaddinfilesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_options~l_security~l_trustcenter~l_fileblocksettings_l_ppt2007andlaterpresentationsshowstemplatesthemesandaddinfiles_l_powerpoint2007andlaterpresentationsshowstemplatesthemesandaddinfilesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpoint972003presentationsshowstemplatesandaddinfiles","displayName":"PowerPoint 97-2003 presentations, shows, templates and add-in files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save PowerPoint files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpoint972003presentationsshowstemplatesandaddinfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpoint972003presentationsshowstemplatesandaddinfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpoint972003presentationsshowstemplatesandaddinfiles_l_powerpoint972003presentationsshowstemplatesandaddinfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpoint972003presentationsshowstemplatesandaddinfiles_l_powerpoint972003presentationsshowstemplatesandaddinfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpoint972003presentationsshowstemplatesandaddinfiles_l_powerpoint972003presentationsshowstemplatesandaddinfilesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpoint972003presentationsshowstemplatesandaddinfiles_l_powerpoint972003presentationsshowstemplatesandaddinfilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpoint972003presentationsshowstemplatesandaddinfiles_l_powerpoint972003presentationsshowstemplatesandaddinfilesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpoint972003presentationsshowstemplatesandaddinfiles_l_powerpoint972003presentationsshowstemplatesandaddinfilesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v2~policy~l_ppt~l_powerpointoptions~l_security~l_trustcenter~l_fileblocksettings_l_powerpoint972003presentationsshowstemplatesandaddinfiles_l_powerpoint972003presentationsshowstemplatesandaddinfilesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v3~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingsectionname","displayName":"Stop checking for Section with valid name (User)","description":"This policy setting prevents the Accessibility Checker from flagging section with default/untitled name.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from flagging section with default/untitled name.\r\n\r\nIf you disable or do not configure this policy setting, section will be scanned for valid name and the results will appear in the Accessibility Checker.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v3~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingsectionname_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v3~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckingsectionname_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v3~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckinguniquesectionname","displayName":"Stop checking for section with unique name (User)","description":"This policy setting prevents the Accessibility Checker from verifying that every section has a unique name.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that every section has a unique name.\r\n\r\nIf you disable or do not configure this policy setting, sections will be checked for unique names and any issues will appear in the Accessibility Checker.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v3~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckinguniquesectionname_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v3~policy~l_microsoftofficepowerpoint~l_filetab~l_checkaccessibility_l_stopcheckinguniquesectionname_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_ppt16v4~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_enablemoderncommentscreatenew","displayName":"Use modern comments in PowerPoint (User)","description":"\r\nThis policy setting controls whether modern comments are used in PowerPoint. For more information about modern comments and when to enable this setting, see https://go.microsoft.com/fwlink/p/?linkid=2116065.\r\n\r\nIf you enable this policy setting, when a user adds comments to a new file or a file without comments, the new comments that are added will be modern comments. If users have a version of PowerPoint that doesn’t support modern comments, a notification appears directing them to use PowerPoint for the web to view modern comments in files that have them.\r\n\r\nIf you disable this policy setting, users will continue to see the previous commenting experience for new files and existing files that do not have any modern comments. Users will still be able to read files that already have modern comments in them if they have a version of PowerPoint that supports modern comments.\r\n\r\nFor information about what happens when you don't configure this policy setting, see https://go.microsoft.com/fwlink/p/?linkid=2116065.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_ppt16v4~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_enablemoderncommentscreatenew_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_ppt16v4~policy~l_microsoftofficepowerpoint~l_powerpointoptions~l_optionsgeneral_l_enablemoderncommentscreatenew_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_printers_approvedusbprintdevicesuser","displayName":"List of Approved USB-connected print devices (User)","description":"\r\n\r\n This setting is a component of the Device Control Printing Restrictions. To use this setting, enable Device Control Printing by enabling the \"Enable Device Control Printing Restrictions\" setting.\r\n\r\n When Device Control Printing is enabled, the system uses the specified list of vid/pid values to determine if the current USB connected printer is approved for local printing.\r\n\r\n Type all the approved vid/pid combinations (separated by commas) that correspond to approved USB printer models. When a user tries to print to a USB printer queue the device vid/pid will be compared to the approved list.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-printers#printers-approvedusbprintdevicesuser"],"options":[{"id":"user_vendor_msft_policy_config_printers_approvedusbprintdevicesuser_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_printers_approvedusbprintdevicesuser_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_printers_approvedusbprintdevicesuser_approvedusbprintdevices_list","displayName":"vid/pid (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_printers_enabledevicecontroluser","displayName":"Enable Device Control Printing Restrictions (User)","description":"\r\n Determines whether Device Control Printing Restrictions are enforced for printing on this computer.\r\n\r\n By default, there are no restrictions to printing based on connection type or printer Make/Model.\r\n\r\n If you enable this setting, the computer will restrict printing to printer connections on the corporate network or approved USB-connected printers.\r\n\r\n If you disable this setting or do not configure it, there are no restrictions to printing based on connection type or printer Make/Model.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-printers#printers-enabledevicecontroluser"],"options":[{"id":"user_vendor_msft_policy_config_printers_enabledevicecontroluser_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_printers_enabledevicecontroluser_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_printers_pointandprintrestrictions_user","displayName":"Point and Print Restrictions (User)","description":"This policy setting controls the client Point and Print behavior, including the security prompts for Windows Vista computers. The policy setting applies only to non-Print Administrator clients, and only to computers that are members of a domain.\r\n\r\n If you enable this policy setting:\r\n -Windows XP and later clients will only download print driver components from a list of explicitly named servers. If a compatible print driver is available on the client, a printer connection will be made. If a compatible print driver is not available on the client, no connection will be made.\r\n -You can configure Windows Vista clients so that security warnings and elevated command prompts do not appear when users Point and Print, or when printer connection drivers need to be updated.\r\n\r\n If you do not configure this policy setting:\r\n -Windows Vista client computers can point and print to any server.\r\n -Windows Vista computers will show a warning and an elevated command prompt when users create a printer connection to any server using Point and Print.\r\n -Windows Vista computers will show a warning and an elevated command prompt when an existing printer connection driver needs to be updated.\r\n -Windows Server 2003 and Windows XP client computers can create a printer connection to any server in their forest using Point and Print.\r\n\r\n If you disable this policy setting:\r\n -Windows Vista client computers can create a printer connection to any server using Point and Print.\r\n -Windows Vista computers will not show a warning or an elevated command prompt when users create a printer connection to any server using Point and Print.\r\n -Windows Vista computers will not show a warning or an elevated command prompt when an existing printer connection driver needs to be updated.\r\n -Windows Server 2003 and Windows XP client computers can create a printer connection to any server using Point and Print.\r\n -The \"Users can only point and print to computers in their forest\" setting applies only to Windows Server 2003 and Windows XP SP1 (and later service packs).","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-printers#printers-pointandprintrestrictions-user"],"options":[{"id":"user_vendor_msft_policy_config_printers_pointandprintrestrictions_user_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_printers_pointandprintrestrictions_user_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_printers_pointandprintrestrictions_user_pointandprint_nowarningnoelevationoninstall_enum","displayName":"When installing drivers for a new connection: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_printers_pointandprintrestrictions_user_pointandprint_nowarningnoelevationoninstall_enum_0","displayName":"Show warning and elevation prompt","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_printers_pointandprintrestrictions_user_pointandprint_nowarningnoelevationoninstall_enum_1","displayName":"Show warning only","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_printers_pointandprintrestrictions_user_pointandprint_nowarningnoelevationonupdate_enum","displayName":"When updating drivers for an existing connection: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_printers_pointandprintrestrictions_user_pointandprint_nowarningnoelevationonupdate_enum_0","displayName":"Show warning and elevation prompt","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_printers_pointandprintrestrictions_user_pointandprint_nowarningnoelevationonupdate_enum_1","displayName":"Show warning only","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_printers_pointandprintrestrictions_user_pointandprint_trustedforest_chk","displayName":"Users can only point and print to machines in their forest (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_printers_pointandprintrestrictions_user_pointandprint_trustedforest_chk_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_printers_pointandprintrestrictions_user_pointandprint_trustedforest_chk_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_printers_pointandprintrestrictions_user_pointandprint_trustedservers_chk","displayName":"Users can only point and print to these servers: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_printers_pointandprintrestrictions_user_pointandprint_trustedservers_chk_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_printers_pointandprintrestrictions_user_pointandprint_trustedservers_chk_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_printers_pointandprintrestrictions_user_pointandprint_trustedservers_edit","displayName":"Enter fully qualified server names separated by semicolons (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_privacy_disableprivacyexperience","displayName":"Disable Privacy Experience (User)","description":"Enabling this policy prevents the privacy experience from launching during user logon for new and upgraded users.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Privacy#disableprivacyexperience"],"options":[{"id":"user_vendor_msft_policy_config_privacy_disableprivacyexperience_0","displayName":"Disabled","description":"Allow the 'choose privacy settings for your device' screen for a new user during their first logon or when an existing user logs in for the first time after an upgrade.","helpText":null},{"id":"user_vendor_msft_policy_config_privacy_disableprivacyexperience_1","displayName":"Enabled","description":"Do not allow the 'choose privacy settings for your device' screen when a new user logs in or an existing user logs in for the first time after an upgrade.","helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_blockallunmanagedaddins","displayName":"Block all unmanaged add-ins (User)","description":"This policy setting blocks all add-ins that are not managed by the \"List of managed add-ins\" policy setting.\r\n\r\nIf you enable this policy setting, and the \"List of managed add-ins\" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the \"List of managed add-ins\" policy setting.\r\n\r\nIf you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the \"List of managed add-ins\" policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_blockallunmanagedaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_blockallunmanagedaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_defaultcustomtab","displayName":"Show custom templates tab by default in Project on the Office Start screen and in File | New (User)","description":"This policy setting controls whether custom templates (when they exist) show as the default tab in Project on the Office Start screen and in File | New. \r\n\r\nIf you enable this policy setting, users will the see custom templates tab as the default tab in Project on the Office Start screen and in File | New when templates exist (this can include Custom XML programmed templates, templates in the Workgroup templates path, templates in the Personal templates path, or SharePoint templates).\r\n\r\nIf you disable or do not configure this policy setting, users will see the Featured templates tab as the default tab in Project on the Office Start screen and in File | New, unless all Office-provided templates have been disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_defaultcustomtab_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_defaultcustomtab_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_disableofficestartproject","displayName":"Disable the Office Start screen for Project (User)","description":"This policy setting controls whether the Office Start screen appears on boot for Project.\r\n\r\nIf you enable this policy setting, users will not see the Office Start screen when they boot Project.\r\n\r\nIf you disable or do not configure this policy setting, users will see the Office Start screen when they boot Project.\r\n\r\nNote: This policy setting is overridden by the policy setting \"Microsoft Office 2016 > Miscellaneous > Disable the Office Start screen for all Office applications\" if that policy setting is set.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_disableofficestartproject_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_disableofficestartproject_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_listofmanagedaddins","displayName":"List of managed add-ins (User)","description":"This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the \"Block all unmanaged add-ins\" policy setting.\r\n\r\nTo enable this policy setting, provide the following information for each add-in:\r\n\r\nIn \"Value name,\" specify the programmatic identifier (ProgID) for COM add-ins.\r\n\r\nTo obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Office\\MS Project\\Addins or HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Office\\MS Project\\Addins.\r\n\r\nYou can also obtain the ProgID of an add-in by using Office Telemetry Dashboard.\r\n\r\nIn \"Value,\" specify the value as follows:\r\n\r\nTo specify that an add-in is always disabled (blocked), type 0.\r\n\r\nTo specify that an add-in is always enabled, type 1.\r\n\r\nTo specify that an add-in is configurable by the user and not blocked by the \"Block all unmanaged add-ins\" policy setting when enabled, type 2.\r\n\r\nIf you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the \"Block all unmanaged add-ins\" policy setting is enabled, then all add-ins are blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_listofmanagedaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_listofmanagedaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_listofmanagedaddins_l_listofmanagedaddins2","displayName":"List of managed add-ins (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_listofmanagedaddins_l_listofmanagedaddins2_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_listofmanagedaddins_l_listofmanagedaddins2_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_mrutemplatelistlength","displayName":"Most Recently Used Template List Length (User)","description":"This setting determines the length of the recently used templates list in the New Document task pane (File New...). The maximum value is 9 and the minimum value is 0. This setting applies only applies to Project.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_mrutemplatelistlength_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_mrutemplatelistlength_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_mrutemplatelistlength_l_mrutemplatelistlength39","displayName":"Most Recently Used Template List Length (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_personaltemplatespath","displayName":"Personal templates path for Project (User)","description":"This policy setting specifies the location of a user's personal templates. \r\n\r\nIf you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. \r\n\r\nIf you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_personaltemplatespath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_personaltemplatespath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_miscellaneous_l_personaltemplatespath_l_personaltemplatespath","displayName":"Personal templates path (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_optionscustomizeribbon_l_displaydevelopertab","displayName":"Display Developer tab in the Ribbon (User)","description":"This policy setting controls whether the Developer tab will be displayed in the Ribbon.\r\n\r\nIf you enable this policy setting, the Developer tab will be displayed in the Ribbon.\r\n\r\nIf you disable this policy setting, the Developer tab will not be displayed in the Ribbon.\r\n\r\nIf you do not configure this policy setting, the Developer tab will not be displayed in the Ribbon, but its visibility can be changed via a setting in the application Options dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_optionscustomizeribbon_l_displaydevelopertab_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_optionscustomizeribbon_l_displaydevelopertab_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcproject_l_pjautocalc","displayName":"Automatic Calculation (User)","description":"Specifies that calculations should be done automatically as soon as a change is made.\r\n\r\nIf you enable this setting, calculations will be made after every change to the project.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcproject_l_pjautocalc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcproject_l_pjautocalc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcproject_l_pjcalcall","displayName":"Calculate all open projects (User)","description":"Specifies that Project should recalculate all open projects.\r\n\r\nIf you enable this setting, all open projects will be recalculated anytime Project does a calculation.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcproject_l_pjcalcall_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcproject_l_pjcalcall_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjactualcostscalc","displayName":"Actual costs are always calculated by Microsoft Project (User)","description":"Specifies that Project calculates actual costs automatically, based upon resource rates, per-use resource costs, and fixed task costs.\r\n\r\nIf you enable this setting, Project will automatically calculate actual costs.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjactualcostscalc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjactualcostscalc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjandmovecompleted","displayName":"And move end of completed parts forward to status date (User)","description":"Moves the completed portion of a task forward to finish at the status date.\r\n\r\nIf you enable this setting, the completed portion of the task moves forward to finish at the status date.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjandmovecompleted_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjandmovecompleted_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjandmoveremaining","displayName":"And move start of remaining parts back to status date (User)","description":"Moves the remaining portion of a task back to start at the status date.\r\n\r\nIf you enable this setting, the remaining portion of the task moves back to start at the status date.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjandmoveremaining_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjandmoveremaining_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjcalcmultiplecriticalpaths","displayName":"Calculate multiple critical paths (User)","description":"Specifies that Project should calculate and display a critical path for each independent network of tasks within the project.\r\n\r\nIf you enable this setting, Project will calculate multiple critical paths.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjcalcmultiplecriticalpaths_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjcalcmultiplecriticalpaths_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjcritifless","displayName":"Tasks are critical if slack is less than or equal to (User)","description":"Specifies the number of days of slack Project uses to determine critical tasks.\r\n\r\nIf you enable this setting, tasks are marked as critical if the slack is less than or equal to the value you specified.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjcritifless_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjcritifless_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjcritifless_l_pjcritifless29","displayName":"Tasks are critical if slack is less than or equal to (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjdefaultfixedaccrual","displayName":"Default fixed costs accrual (User)","description":"Specifies how Project sets the fixed cost accrual for new tasks.\r\n\r\nIf you enable this setting, new tasks will accrue fixed cost according to the specification you made.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjdefaultfixedaccrual_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjdefaultfixedaccrual_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjdefaultfixedaccrual_l_pjdefaultfixedaccrual28","displayName":"Default fixed costs accrual (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjdefaultfixedaccrual_l_pjdefaultfixedaccrual28_1","displayName":"Start","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjdefaultfixedaccrual_l_pjdefaultfixedaccrual28_3","displayName":"Prorated","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjdefaultfixedaccrual_l_pjdefaultfixedaccrual28_2","displayName":"End","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjeditstototaltask","displayName":"Edits to total task % complete will be spread to the status date (User)","description":"Distributes the changes to total percent complete evenly across the schedule to the project status date (or to the current date if you haven't specified a project status date).\r\n\r\nIf you enable this setting, edits to total task percent complete are evenly distributed across the schedule up to the status date.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjeditstototaltask_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjeditstototaltask_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjedittototalspread","displayName":"Edits to total actual cost will be spread to the status date (User)","description":"Distributes the changes to total actual cost evenly across the schedule to the status date (or to the current date if you have not specified a project status date).\r\n\r\nIf you enable this setting, Project will distribute edits to actual cost evenly across a task up to the status date.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjedittototalspread_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjedittototalspread_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjinsertedprojects","displayName":"Inserted projects are calculated like summary tasks (User)","description":"Specifies that a single critical path is calculated throughout the master project, by treating inserted projects as summary tasks in the master project.\r\n\r\nIf you enable this setting, the critical path is calculated by treating inserted projects as summary tasks.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjinsertedprojects_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjinsertedprojects_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjmovecompleted","displayName":"Move end of completed parts after status date back to status date (User)","description":"Moves the completed portion of a task back to finish at the status date.\r\n\r\nIf you enable this setting, the completed portion of the task moves back to finish at the status date.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjmovecompleted_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjmovecompleted_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjmoveremaining","displayName":"Move start of remaining parts before status date forward to status date (User)","description":"Moves remaining portions of a task forward to start at the status date.\r\n\r\nIf you enable this setting, the remaining portion of the task moves forward to start at the status date.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjmoveremaining_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjmoveremaining_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjupdatingtask","displayName":"Updating task status updates resource status (User)","description":"Automatically updates resource status, such as actual and remaining work and cost, whenever you update task status, such as percent complete, actual duration, or remaining duration.\r\n\r\nIf you enable this setting, task status updates are automatically applied to resources.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjupdatingtask_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile_l_pjupdatingtask_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevbaseline","displayName":"Baseline for Earned Value calculations (User)","description":"Specifies the baseline that is used to measure project performance using earned value analysis.\r\n\r\nIf you enable this setting, Project will calculate earned value using the baseline you specified.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevbaseline_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevbaseline_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevbaseline_l_pjevbaseline27","displayName":"Baseline for Earned Value calculations (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevbaseline_l_pjevbaseline27_1","displayName":"Baseline","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevbaseline_l_pjevbaseline27_12","displayName":"Baseline 1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevbaseline_l_pjevbaseline27_13","displayName":"Baseline 2","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevbaseline_l_pjevbaseline27_14","displayName":"Baseline 3","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevbaseline_l_pjevbaseline27_15","displayName":"Baseline 4","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevbaseline_l_pjevbaseline27_16","displayName":"Baseline 5","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevbaseline_l_pjevbaseline27_17","displayName":"Baseline 6","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevbaseline_l_pjevbaseline27_18","displayName":"Baseline 7","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevbaseline_l_pjevbaseline27_19","displayName":"Baseline 8","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevbaseline_l_pjevbaseline27_20","displayName":"Baseline 9","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevbaseline_l_pjevbaseline27_21","displayName":"Baseline 10","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevmethod","displayName":"Default task Earned Value method (User)","description":"Specifies the method used for earned value analysis.\r\n\r\nIf you enable this setting, Project will calculate earned value using the method you specified.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevmethod_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevmethod_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevmethod_l_pjevmethod26","displayName":"Default task Earned Value method (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevmethod_l_pjevmethod26_0","displayName":"% Complete","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalculation~l_pjcalcprojectfile~l_pjev_l_pjevmethod_l_pjevmethod26_1","displayName":"Physical % Complete","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjdayspermonth","displayName":"Days per month (User)","description":"Defines the number of days that you want Project to assign to a task when you enter a duration of a month.\r\n\r\nIf you enable this setting, month-long tasks will be assigned the number of days that you specified.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjdayspermonth_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjdayspermonth_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjdayspermonth_l_pjdayspermonth20","displayName":"Days per month (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjdefaultendtime","displayName":"Default end time (User)","description":"Specifies the finish time that Project assigns to tasks by default when you enter a finish date without specifying a time.\r\n\r\nIf you enable this setting, new tasks where the user does not enter an end time will have the end time that you specified.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjdefaultendtime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjdefaultendtime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjdefaultendtime_l_pjdefaultendtime2","displayName":"Default end time (Minutes after 12am * 10) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjdefaultstarttime","displayName":"Default start time (User)","description":"Specifies the start time that Project assigns to tasks by default when you enter a start date without specifying a time.\r\n\r\nIf you enable this setting, new tasks where the user does not enter a start time will use the start time that you specified.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjdefaultstarttime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjdefaultstarttime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjdefaultstarttime_l_pjdefaultstarttime2","displayName":"Default start time (Minutes after 12am * 10) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjfiscalyear","displayName":"Fiscal year starts in (User)","description":"Specifies the month that begins the fiscal year.\r\n\r\nIf you enable this setting, the fiscal year will start on the month you specified.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjfiscalyear_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjfiscalyear_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjfiscalyear_l_pjfiscalyear17","displayName":"Fiscal year starts in (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjfiscalyear_l_pjfiscalyear17_1","displayName":"January","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjfiscalyear_l_pjfiscalyear17_2","displayName":"February","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjfiscalyear_l_pjfiscalyear17_3","displayName":"March","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjfiscalyear_l_pjfiscalyear17_4","displayName":"April","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjfiscalyear_l_pjfiscalyear17_5","displayName":"May","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjfiscalyear_l_pjfiscalyear17_6","displayName":"June","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjfiscalyear_l_pjfiscalyear17_7","displayName":"July","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjfiscalyear_l_pjfiscalyear17_8","displayName":"August","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjfiscalyear_l_pjfiscalyear17_9","displayName":"September","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjfiscalyear_l_pjfiscalyear17_10","displayName":"October","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjfiscalyear_l_pjfiscalyear17_11","displayName":"November","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjfiscalyear_l_pjfiscalyear17_12","displayName":"December","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjhoursperday","displayName":"Hours per day (User)","description":"Defines the number of hours that you want Project to assign to a task when the user enters a duration of one day.\r\n\r\nIf you enable this setting, day-long tasks will be assigned the number of hours that you specified.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjhoursperday_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjhoursperday_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjhoursperday_l_pjhoursperday18","displayName":"Hours per day (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjhoursperweek","displayName":"Hours per week (User)","description":"Specifies the number of hours that you want Project to assign to a task when the user enters a duration of one week.\r\n\r\nIf you enable this setting, week-long tasks will be assigned the number of hours that you specified.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjhoursperweek_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjhoursperweek_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjhoursperweek_l_pjhoursperweek19","displayName":"Hours per week (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjstartingyear","displayName":"Use starting year for FY numbering (User)","description":"Labels the fiscal year using the calendar year in which the fiscal year begins.\r\n\r\nIf you enable this setting, the label for the fiscal year is the calendar year in which the fiscal year begins.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjstartingyear_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjstartingyear_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjweekstarts","displayName":"Week starts on (User)","description":"Specifies the day of the week on which you want the scheduling week to begin.\r\n\r\nIf you enable this setting, weeks will start on the day you specified.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjweekstarts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjweekstarts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjweekstarts_l_pjweekstarts16","displayName":"Week starts on (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjweekstarts_l_pjweekstarts16_6","displayName":"Saturday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjweekstarts_l_pjweekstarts16_0","displayName":"Sunday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjweekstarts_l_pjweekstarts16_1","displayName":"Monday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjweekstarts_l_pjweekstarts16_2","displayName":"Tuesday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjweekstarts_l_pjweekstarts16_3","displayName":"Wednesday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjweekstarts_l_pjweekstarts16_4","displayName":"Thursday","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjcalendar_l_pjweekstarts_l_pjweekstarts16_5","displayName":"Friday","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjeditoptionsproj_l_pjallowcelldragdrop","displayName":"Allow cell drag and drop (User)","description":"Allow fields in sheets to be moved using the mouse.\r\nIf you enable this setting, users can move rows and fields to new locations using the mouse.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjeditoptionsproj_l_pjallowcelldragdrop_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjeditoptionsproj_l_pjallowcelldragdrop_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjeditoptionsproj_l_pjasktoupdate","displayName":"Ask to update automatic links (User)","description":"Prompts the user to update linked objects whenever they open a file containing OLE links, if the source has changed.\r\n \r\nIf you enable this setting, users are prompted to update linked objects whose source has changed whenever they open a file containing OLE links.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjeditoptionsproj_l_pjasktoupdate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjeditoptionsproj_l_pjasktoupdate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjeditoptionsproj_l_pjeditdirectlycell","displayName":"Edit directly in cell (User)","description":"Allows editing directly in the selected cell.\r\n \r\nIf you enable this setting, users can directly edit a cell's value.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjeditoptionsproj_l_pjeditdirectlycell_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjeditoptionsproj_l_pjeditdirectlycell_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjeditoptionsproj_l_pjmoveafterenter","displayName":"Move selection after enter (User)","description":"Automatically selects the field below the current field after the user presses the ENTER key.\r\n \r\nIf you enable this setting, the field below the current field is selected after the user presses the ENTER key.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjeditoptionsproj_l_pjmoveafterenter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjeditoptionsproj_l_pjmoveafterenter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour","displayName":"Followed hyperlink color (User)","description":"Specifies the color of hyperlinks that have already been followed.\r\n\r\nIf you enable this setting, hyperlinks that have been followed are displayed in the color you specified.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_l_pjfollowedlinkcolour15","displayName":"Followed hyperlink color (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_l_pjfollowedlinkcolour15_16","displayName":"Automatic","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_l_pjfollowedlinkcolour15_0","displayName":"Black","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_l_pjfollowedlinkcolour15_1","displayName":"Red","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_l_pjfollowedlinkcolour15_2","displayName":"Yellow","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_l_pjfollowedlinkcolour15_3","displayName":"Lime","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_l_pjfollowedlinkcolour15_4","displayName":"Aqua","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_l_pjfollowedlinkcolour15_5","displayName":"Blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_l_pjfollowedlinkcolour15_6","displayName":"Fuchsia","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_l_pjfollowedlinkcolour15_7","displayName":"White","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_l_pjfollowedlinkcolour15_8","displayName":"Maroon","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_l_pjfollowedlinkcolour15_9","displayName":"Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_l_pjfollowedlinkcolour15_10","displayName":"Olive","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_l_pjfollowedlinkcolour15_11","displayName":"Navy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_l_pjfollowedlinkcolour15_12","displayName":"Purple","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_l_pjfollowedlinkcolour15_13","displayName":"Teal","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_l_pjfollowedlinkcolour15_14","displayName":"Gray","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjfollowedlinkcolour_l_pjfollowedlinkcolour15_15","displayName":"Silver","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour","displayName":"Hyperlink color (User)","description":"Specifies the color of hyperlinks that have not yet been followed.\r\n \r\nIf you enable this setting, hyperlinks that have not been followed are displayed in the color you specified.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_l_pjhyperlinkcolour14","displayName":"Hyperlink color (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_l_pjhyperlinkcolour14_16","displayName":"Automatic","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_l_pjhyperlinkcolour14_0","displayName":"Black","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_l_pjhyperlinkcolour14_1","displayName":"Red","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_l_pjhyperlinkcolour14_2","displayName":"Yellow","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_l_pjhyperlinkcolour14_3","displayName":"Lime","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_l_pjhyperlinkcolour14_4","displayName":"Aqua","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_l_pjhyperlinkcolour14_5","displayName":"Blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_l_pjhyperlinkcolour14_6","displayName":"Fuchsia","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_l_pjhyperlinkcolour14_7","displayName":"White","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_l_pjhyperlinkcolour14_8","displayName":"Maroon","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_l_pjhyperlinkcolour14_9","displayName":"Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_l_pjhyperlinkcolour14_10","displayName":"Olive","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_l_pjhyperlinkcolour14_11","displayName":"Navy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_l_pjhyperlinkcolour14_12","displayName":"Purple","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_l_pjhyperlinkcolour14_13","displayName":"Teal","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_l_pjhyperlinkcolour14_14","displayName":"Gray","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjhyperlinkcolour_l_pjhyperlinkcolour14_15","displayName":"Silver","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjunderlinelinks","displayName":"Underline hyperlinks (User)","description":"Shows hyperlinks with underlined text.\r\n\r\nIf you enable this setting, hyperlinks are underlined.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjunderlinelinks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjhyperlinkappear_l_pjunderlinelinks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjaddspace","displayName":"Add space before label (User)","description":"Adds a space between numbers and time unit labels.\r\n \r\nIf you enable this setting, a space is displayed between numbers and the time unit label.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjaddspace_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjaddspace_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjdays","displayName":"Days (User)","description":"Sets the label for days.\r\n \r\nIf you enable this setting, days are displayed with the specified label.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjdays_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjdays_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjdays_l_pjdays10","displayName":"Days (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjdays_l_pjdays10_0","displayName":"d","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjdays_l_pjdays10_1","displayName":"dy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjdays_l_pjdays10_2","displayName":"day","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjdays_l_pjdays10_3","displayName":"\r\n ","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjdays_l_pjdays10_4","displayName":"\r\n ","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjhours","displayName":"Hours (User)","description":"Sets the label for hours.\r\n \r\nIf you enable this setting, hours are displayed with the specified label.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjhours_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjhours_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjhours_l_pjhours9","displayName":"Hours (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjhours_l_pjhours9_0","displayName":"h","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjhours_l_pjhours9_1","displayName":"hr","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjhours_l_pjhours9_2","displayName":"hour","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjhours_l_pjhours9_3","displayName":"\r\n ","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjhours_l_pjhours9_4","displayName":"\r\n ","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjminutes","displayName":"Minutes (User)","description":"Sets the label for minutes.\r\n\r\nIf you enable this setting, minutes are displayed with the specified label.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjminutes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjminutes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjminutes_l_pjminutes8","displayName":"Minutes (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjminutes_l_pjminutes8_0","displayName":"m","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjminutes_l_pjminutes8_1","displayName":"min","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjminutes_l_pjminutes8_2","displayName":"minute","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjminutes_l_pjminutes8_3","displayName":"\r\n ","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjminutes_l_pjminutes8_4","displayName":"\r\n ","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjmonths","displayName":"Months (User)","description":"Sets the label for months.\r\n \r\nIf you enable this setting, months are displayed with the specified label.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjmonths_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjmonths_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjmonths_l_pjmonths12","displayName":"Months (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjmonths_l_pjmonths12_0","displayName":"mo","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjmonths_l_pjmonths12_1","displayName":"mon","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjmonths_l_pjmonths12_2","displayName":"month","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjmonths_l_pjmonths12_3","displayName":"\r\n ","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjmonths_l_pjmonths12_4","displayName":"\r\n ","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjweeks","displayName":"Weeks (User)","description":"Sets the label for weeks.\r\n\r\nIf you enable this setting, weeks are displayed with the specified label.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjweeks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjweeks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjweeks_l_pjweeks11","displayName":"Weeks (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjweeks_l_pjweeks11_0","displayName":"w","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjweeks_l_pjweeks11_1","displayName":"wk","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjweeks_l_pjweeks11_2","displayName":"week","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjweeks_l_pjweeks11_3","displayName":"\r\n ","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjweeks_l_pjweeks11_4","displayName":"\r\n ","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjyears","displayName":"Years (User)","description":"Sets the label for years.\r\n \r\nIf you enable this setting, years are displayed with the specified label.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjyears_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjyears_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjyears_l_pjyears13","displayName":"Years (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjyears_l_pjyears13_0","displayName":"y","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjyears_l_pjyears13_1","displayName":"yr","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjyears_l_pjyears13_2","displayName":"year","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjyears_l_pjyears13_3","displayName":"\r\n ","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjedit~l_pjviewoptions_l_pjyears_l_pjyears13_4","displayName":"\r\n ","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral_l_undolevels","displayName":"Undo Levels (User)","description":"Limits the number of actions (1-99) that a user can undo. If you enable this setting, you can set a limit on the number of actions (1-99) a user is can undo. If you disable this setting or do not configure it, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral_l_undolevels_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral_l_undolevels_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral_l_undolevels_l_undolevels5","displayName":"Undo Levels (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneraloptions_l_pjautoaddnew","displayName":"Automatically add new resources and tasks (User)","description":"Automatically adds new resources to the resource pool and assigns them default values whenever a new resource name or new resource's initials are added.\r\n \r\nIf you enable this setting, new resources and tasks are automatically inserted into the project.\r\n\r\nIf you disable this setting, users are alerted whenever a new resource or task is created when making a new assignment.\r\n\r\nIf you do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneraloptions_l_pjautoaddnew_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneraloptions_l_pjautoaddnew_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneraloptions_l_pjdefaultotime","displayName":"Default overtime rate (User)","description":"Specifies the overtime pay rate for new resources.\r\n \r\nIf you enable this setting, all new resources will use the specified overtime pay rate\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneraloptions_l_pjdefaultotime_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneraloptions_l_pjdefaultotime_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneraloptions_l_pjdefaultotime_l_pjdefaultotime7","displayName":"Default overtime rate (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneraloptions_l_pjdefaultstdrate","displayName":"Default standard rate (User)","description":"Specifies the standard pay rate for new resources.\r\n \r\nIf you enable this setting, all new resources will use the specified standard pay rate.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneraloptions_l_pjdefaultstdrate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneraloptions_l_pjdefaultstdrate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneraloptions_l_pjdefaultstdrate_l_pjdefaultstdrate6","displayName":"Default standard rate (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneralprojoptions_l_pjopenlast","displayName":"Open last file on startup (User)","description":"Upon starting Project, automatically opens the last used project file.\r\n \r\nIf you enable this setting, the last file that the user had open automatically re-opens when they start Project.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneralprojoptions_l_pjopenlast_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneralprojoptions_l_pjopenlast_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneralprojoptions_l_pjpromptforinfo","displayName":"Prompt for project info for new projects (User)","description":"Opens the Project Information dialog box whenever the user creates a new project.\r\n\r\nIf you enable this setting, the Project Information dialog box is displayed whenever you create a new project.\r\n\r\nIf you disable or do not configure this setting, the users default setting is followed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneralprojoptions_l_pjpromptforinfo_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneralprojoptions_l_pjpromptforinfo_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneralprojoptions_l_pjrecentlyused","displayName":"Number of projects in the Recent Projects list (User)","description":"This policy setting specifies the number of entries displayed in the Recent Projects list that appears when users click Open on the File tab in Backstage view. \r\n\r\nIf you enable this policy setting, you can specify the number of entries to be between 0 and 50. If you set the number to 0, all pinned and unpinned entries are hidden.\r\n\r\nIf you disable or do not configure this policy setting, a maximum of 25 items will be displayed in the Recent Projects list.\r\n\r\nNote: If you want to prevent items from being added to the Recent Projects list entirely, you can enable the \"Do not keep history of recently opened documents\" Windows policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneralprojoptions_l_pjrecentlyused_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneralprojoptions_l_pjrecentlyused_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneralprojoptions_l_pjrecentlyused_l_pjmrut","displayName":"Number of entries: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneralprojoptions_l_pjsetautofilter","displayName":"Set AutoFilter on for new projects (User)","description":"This policy setting turns on AutoFilter automatically when the user creates a new project.\r\n\r\nIf you enable or do not configure this policy setting, AutoFilter is automatically turned on when users create a new project.\r\n\r\nIf you disable this policy setting, AutoFilter is not automatically turned on when users create a new project.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneralprojoptions_l_pjsetautofilter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneralprojoptions_l_pjsetautofilter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneralprojoptions_l_setnumberofplacesintherecentplaceslist","displayName":"Number of folders in the Recent Folders list (User)","description":"This policy setting specifies the number of unpinned entries displayed in the Recent Folders list that appears when users click Open or Save As on the File tab in Backstage view.\r\n\r\nIf you enable this policy setting, you can specify the number of unpinned entries to be between 0 and 20. If you set the number to 0, all pinned and unpinned entries are hidden.\r\n\r\nIf you disable or do not configure this policy setting, a maximum of 5 unpinned items are displayed in the Recent Folders list.\r\n\r\nNote: If you want to prevent items from being added to the Recent Folders list entirely, you can enable the \"Do not keep history of recently opened documents\" Windows policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneralprojoptions_l_setnumberofplacesintherecentplaceslist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneralprojoptions_l_setnumberofplacesintherecentplaceslist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjgeneral~l_pjgeneralprojoptions_l_setnumberofplacesintherecentplaceslist_l_setnumberofplacesintherecentplaceslistspinid","displayName":"Number of folders: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface_l_disableinternalidmatching","displayName":"Disable Internal ID Matching (User)","description":"Prevent internal id matching. If you enable this setting, Project will not use internal identifiers to match different-language or renamed Organizer items between projects. If this setting is disabled or not configured, internal identifiers will be used to match different-language or renamed Organizer items between projects.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface_l_disableinternalidmatching_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface_l_disableinternalidmatching_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjpgsettings_l_pjgbuidisplaytoggle","displayName":"Display Project Guide (User)","description":"Displays the side pane containing the Project Guide.\r\n\r\nIf you enable this setting, the Project Guide will be displayed.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjpgsettings_l_pjgbuidisplaytoggle_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjpgsettings_l_pjgbuidisplaytoggle_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjpgsettingsforproject1_l_pjusedefaultstartpage","displayName":"Project Guide Functionality and Layout page (User)","description":"Choose whether the side pane displays the default Project Guide or a custom Project Guide your organization has developed.\r\n\r\nIf you enable this setting, the Project Guide you specified will be displayed when the Project Guide is opened.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjpgsettingsforproject1_l_pjusedefaultstartpage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjpgsettingsforproject1_l_pjusedefaultstartpage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjpgsettingsforproject1_l_pjusedefaultstartpage_l_pjgbuidefaultpageurl","displayName":"URL: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjpgsettingsforproject1_l_pjusedefaultstartpage_l_pjusedefaultstartpage34","displayName":"Project Guide Functionality and Layout page (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjpgsettingsforproject1_l_pjusedefaultstartpage_l_pjusedefaultstartpage34_1","displayName":"Use Microsoft Project's Default page","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjpgsettingsforproject1_l_pjusedefaultstartpage_l_pjusedefaultstartpage34_0","displayName":"Use a custom page","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjpgsettingsforproject1_l_pjusedefaultxmlschema","displayName":"Project Guide Content (User)","description":"Specifies whether the side pane displays the Project Guide content that comes with Project or custom content that your organization has developed.\r\n\r\nIf you enable this setting, content for the Project Guide is loaded from the specified location.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjpgsettingsforproject1_l_pjusedefaultxmlschema_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjpgsettingsforproject1_l_pjusedefaultxmlschema_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjpgsettingsforproject1_l_pjusedefaultxmlschema_l_pjgbuixmlschemapath","displayName":"XML file for custom content: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjpgsettingsforproject1_l_pjusedefaultxmlschema_l_pjusedefaultxmlschema35","displayName":"Project Guide Content (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjpgsettingsforproject1_l_pjusedefaultxmlschema_l_pjusedefaultxmlschema35_1","displayName":"Use Microsoft Project's default content","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjpgsettingsforproject1_l_pjusedefaultxmlschema_l_pjusedefaultxmlschema35_0","displayName":"Use custom content","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjshowindicators_l_pjchangedurationooui","displayName":"Edits to work, units or duration (User)","description":"Specifies that the feedback triangle should appear in a corner of a Task Name field if you change the task's start date or finish date.\r\n\r\nIf you enable this setting, a feedback triangle is displayed in the corner of the Task Name field if the user changes the task's start or finish date.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjshowindicators_l_pjchangedurationooui_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjshowindicators_l_pjchangedurationooui_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjshowindicators_l_pjdeletenameooui","displayName":"Deletions in the Name column (User)","description":"Specifies that the delete indicator should appear in the Indicators field if you delete text in the Task Name or Resource Names field.\r\n\r\nIf you enable this setting, the delete indicator will appear if the user deletes a Task Name or Resource Names.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjshowindicators_l_pjdeletenameooui_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjshowindicators_l_pjdeletenameooui_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjshowindicators_l_pjenterdateooui","displayName":"Edits to start and finish dates (User)","description":"Specifies that the feedback triangle should appear in a corner of the Duration field or the Task Name field if you change a task's work, units, or duration.\r\n\r\nIf you enable this setting, a feedback triangle is displayed in the corner of the Duration or Task Name field if the user changes the task's work, units, or duration.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjshowindicators_l_pjenterdateooui_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjshowindicators_l_pjenterdateooui_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjshowindicators_l_pjresourceassignooui","displayName":"Resource Assigments (User)","description":"Specifies that the feedback triangle should appear in a corner of a field if the user assigns additional resources to a task that already has resources assigned.\r\n\r\nIf you enable this setting, a feedback triangle is displayed in the corner of a field if users assign additional resources to a task that already has resources assigned.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjshowindicators_l_pjresourceassignooui_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjinterface~l_pjshowindicators_l_pjresourceassignooui_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave_l_pjfiletype","displayName":"Save Microsoft Project files as (User)","description":"Specifies the default file format that should be applied when any Project file is saved.\r\n\r\nIf you enable this setting, project files will be saved with the format you specified.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave_l_pjfiletype_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave_l_pjfiletype_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave_l_pjfiletype_l_pjfiletype30","displayName":"Save Microsoft Project files as (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave_l_pjfiletype_l_pjfiletype30_msproject.mpp.12","displayName":"Project (*.mpp)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave_l_pjfiletype_l_pjfiletype30_msproject.mpt.12","displayName":"Template (*.mpt)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave_l_pjfiletype_l_pjfiletype30_msproject.mpp.9","displayName":"Project 2000-2003 (*.mpp)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjautosave_l_pjautomaticsaveoption","displayName":"Save Active Project only (User)","description":"Saves only the active project at the interval you specify. This setting is only used by Project if Auto Save is turned on.\r\n\r\nIf you enable this setting, Project will only save the active project at specified intervals.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjautosave_l_pjautomaticsaveoption_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjautosave_l_pjautomaticsaveoption_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjautosave_l_pjautomaticsaveprompt","displayName":"Prompt before saving (User)","description":"Specifies whether Project should prompt the user before saving their project as a result of the Auto Save function.\r\n\r\nIf you enable this setting, users will be prompted before their project is automatically saved.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjautosave_l_pjautomaticsaveprompt_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjautosave_l_pjautomaticsaveprompt_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjautosave_l_pjsaveevery","displayName":"Auto Save every (User)","description":"Specifies that you want Project to automatically save your projects periodically.\r\n\r\nIf you enable this setting, Project will save users projects at the specified interval.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjautosave_l_pjsaveevery_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjautosave_l_pjsaveevery_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjautosave_l_pjsaveinterval","displayName":"Save Interval (User)","description":"Specifies how often Project should automatically save your projects. This setting is only used by Project if Auto Save has been turned on.\r\n\r\nIf you enable this setting, Project will save users projects at the specified interval.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjautosave_l_pjsaveinterval_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjautosave_l_pjsaveinterval_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjautosave_l_pjsaveinterval_l_pjsaveinterval33","displayName":"Save Interval (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjcache_l_cachelocation","displayName":"Local Project Cache Location (User)","description":"Sets the location path of the local project cache on the user's computer.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjcache_l_cachelocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjcache_l_cachelocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjcache_l_cachelocation_l_cachelocation37","displayName":"Local Project Cache Location (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjcache_l_cachesizeperprofile","displayName":"Local Project Cache Size Limit in MB (User)","description":"Sets the size limit in MB of the local project cache. This is applied per user profile. If this setting is enabled, the size of the cache will be set to the number specified. If this setting is disabled or not configured, users are able to set the cache size limit.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjcache_l_cachesizeperprofile_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjcache_l_cachesizeperprofile_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjcache_l_cachesizeperprofile_l_cachesizeperprofile38","displayName":"Local Project Cache Size Limit in MB (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjfilelocations_l_pjfilelocprojects","displayName":"Projects (User)","description":"Specifies the default location in the computer system for saving and opening projects.\r\n\r\nIf you enable this policy setting, the location first appears in the Open and Save As dialog box.\r\n\r\nIf you disable or do not configure this policy setting, the users default for this setting is followed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjfilelocations_l_pjfilelocprojects_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjfilelocations_l_pjfilelocprojects_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjfilelocations_l_pjfilelocprojects_l_pjfilelocprojects31","displayName":"Projects (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjfilelocations_l_pjfilelocusertemplates","displayName":"User Templates (User)","description":"Specifies the default location in the computer system for saving and opening workgroup templates.\r\n\r\nIf you enable this policy setting, the location first appears in the Open and Save As dialog box.\r\n\r\nIf you disable or do not configure this policy setting, the users default for this setting is followed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjfilelocations_l_pjfilelocusertemplates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjfilelocations_l_pjfilelocusertemplates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjsave~l_pjfilelocations_l_pjfilelocusertemplates_l_pjfilelocusertemplates32","displayName":"User Templates (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_keeptasksonnearestworkingday","displayName":"Keep tasks on nearest working day (User)","description":"This policy setting will enable a constraint to be applied to tasks when they are toggled from Manually Scheduled Mode to Automatically Scheduled Mode, allowing the task date to be as close to the user-entered date as possible.\r\n\r\nIf you enable this policy setting, the task date will be as close to the user-entered date as possible when tasks are toggled from Manually Scheduled Mode to Automatically Scheduled Mode.\r\n\r\nIf you disable or do not configure this policy setting, the task date will not to be as close to the user-entered date when tasks are toggled from Manually Scheduled Mode to Automatically Scheduled Mode.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_keeptasksonnearestworkingday_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_keeptasksonnearestworkingday_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjautolinktasks","displayName":"Autolink inserted or moved tasks (User)","description":"This policy setting automatically links tasks when you cut, move, or insert them.\r\n\r\nIf you enable this policy setting, tasks will automatically be linked when you cut, move, or insert them.\r\n\r\nIf you disable or do not configure this policy setting, tasks will not automatically be linked when you cut, move, or insert them.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjautolinktasks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjautolinktasks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjdefaulttasktypes","displayName":"Default task type (User)","description":"Specifies the default task type for new tasks.\r\n\r\nIf you enable this setting, new tasks will be set to the type that you specified.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjdefaulttasktypes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjdefaulttasktypes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjdefaulttasktypes_l_pjdefaulttasktypes25","displayName":"Default task type (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjdefaulttasktypes_l_pjdefaulttasktypes25_1","displayName":"Fixed Duration","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjdefaulttasktypes_l_pjdefaulttasktypes25_0","displayName":"Fixed Units","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjdefaulttasktypes_l_pjdefaulttasktypes25_2","displayName":"Fixed Work","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjdurationunits","displayName":"Duration is entered in (User)","description":"Specifies the unit of time (minutes, hours, days, weeks, or months) used by default in the Duration field.\r\n\r\nIf you enable this setting, the unit you specify will be used if the user does not specify a unit of time when entering a duration.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjdurationunits_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjdurationunits_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjdurationunits_l_pjdurationunits23","displayName":"Duration is entered in (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjdurationunits_l_pjdurationunits23_3","displayName":"Minutes","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjdurationunits_l_pjdurationunits23_5","displayName":"Hours","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjdurationunits_l_pjdurationunits23_7","displayName":"Days","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjdurationunits_l_pjdurationunits23_9","displayName":"Weeks","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjdurationunits_l_pjdurationunits23_11","displayName":"Months","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjnewtasks","displayName":"New tasks (User)","description":"Specifies the default start date for new tasks as they are entered in the current project. For projects scheduled from the start date, the options are \"Start on Project Start Date\" and \"Start on Current Date.\" For projects scheduled from the finish date, the options are \"Finish on Project Finish Date\" and \"Start on Current Date.\"\r\n\r\nIf you enable this setting, new tasks will start on the date you specified.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjnewtasks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjnewtasks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjnewtasks_l_pjnewtasks22","displayName":"New tasks (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjnewtasks_l_pjnewtasks22_0","displayName":"Start on Project Start Date","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjnewtasks_l_pjnewtasks22_1","displayName":"Start on Current Date","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjnewtaskseffort","displayName":"New tasks are effort driven (User)","description":"This policy setting specifies that new tasks are scheduled such that the work on the task remains constant as you add or remove assignments.\r\n\r\nIf you enable this policy setting, new tasks will be effort-driven.\r\n\r\nIf you disable or do not configure this policy setting, new tasks will not be effort-driven.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjnewtaskseffort_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjnewtaskseffort_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjnewtasksestdurations","displayName":"New tasks have estimated durations (User)","description":"Specifies that all new tasks have estimated durations.\r\n\r\nIf you enable this setting, all new tasks will require estimated durations.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjnewtasksestdurations_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjnewtasksestdurations_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjshowestimateddurations","displayName":"Show that tasks have estimated durations (User)","description":"Displays a question mark (?) after the duration unit of any task with an estimated duration.\r\n\r\nIf you enable this setting, tasks with estimated durations have a question mark after their duration unit.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjshowestimateddurations_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjshowestimateddurations_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjsplitinprogresstasks","displayName":"Split in-progress tasks (User)","description":"Allows rescheduling of remaining duration and work when a task slips or reports progress ahead of schedule.\r\n\r\nIf you enable this setting, the remaining duration and work will be rescheduled if a task slips or reports progress ahead of schedule.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjsplitinprogresstasks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjsplitinprogresstasks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjtaskshonorconstraints","displayName":"Tasks will always honor their constraint dates (User)","description":"Specifies that Project schedules tasks according to their constraint dates.\r\n\r\nIf you enable this setting, task constraints will always be honored when tasks are scheduled.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjtaskshonorconstraints_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjtaskshonorconstraints_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjworkunits","displayName":"Work is entered in (User)","description":"Specifies the default unit of time (minutes, hours, days, weeks, or months) used in the Work field in the current project.\r\n\r\nIf you enable this setting, whenever Project displays work values, the unit you specified will be used.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjworkunits_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjworkunits_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjworkunits_l_pjworkunits24","displayName":"Work is entered in (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjworkunits_l_pjworkunits24_3","displayName":"Minutes","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjworkunits_l_pjworkunits24_5","displayName":"Hours","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjworkunits_l_pjworkunits24_7","displayName":"Days","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjworkunits_l_pjworkunits24_9","displayName":"Weeks","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_pjworkunits_l_pjworkunits24_11","displayName":"Months","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_setdefaultstartdatefornewtasks","displayName":"Set default start date for new tasks (User)","description":"This policy setting specifies the default start date for new tasks as they are entered in the current project. For projects scheduled from the start date, the options are \"Start on Project Start Date\" and \"Start on Current Date.\" For projects scheduled from the finish date, the options are \"Finish on Project Finish Date\" and \"Start on Current Date.\"\r\n\r\nIf you enable or do not configure this policy setting, new tasks will start on the project start date.\r\n\r\nIf you disable this policy setting, new tasks will not start on the project start date.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_setdefaultstartdatefornewtasks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_setdefaultstartdatefornewtasks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_setnewtaskstobeautomaticallyscheduled","displayName":"Set new tasks to be automatically scheduled (User)","description":"This policy setting will set new tasks to be automatically scheduled.\r\n\r\nIf you enable this policy setting, new tasks will be automatically scheduled.\r\n\r\nIf you disable or do not configure this policy setting, new tasks will be manually scheduled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_setnewtaskstobeautomaticallyscheduled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_setnewtaskstobeautomaticallyscheduled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_showtasksschedulesuggestions","displayName":"Show tasks schedule suggestions (User)","description":"This policy setting will allow the display of green task suggestions to indicate potential optimization.\r\n\r\nIf you enable this policy setting, a green task suggestion will be displayed to indicate potential problems.\r\n\r\nIf you disable or do not configure this policy setting, a green task suggestion will not be displayed to indicate potential problems.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_showtasksschedulesuggestions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_showtasksschedulesuggestions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_showtasksschedulewarnings","displayName":"Show tasks schedule warnings (User)","description":"This policy setting will allow the display of red task warnings to indicate potential problems.\r\n\r\nIf you enable or do not configure this policy setting, a red task warning will be displayed to indicate potential problems.\r\n\r\nIf you disable this policy setting, a red task warning will not be displayed to indicate potential problems.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_showtasksschedulewarnings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_showtasksschedulewarnings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_taskscanbemadeinactive","displayName":"Tasks can be made inactive (User)","description":"This policy setting will allow tasks to be inactivated.\r\n\r\nIf you enable or do not configure this policy setting, users will be able to use the Inactive tasks feature, and tasks are allowed to be inactivated.\r\n\r\nIf you disable this policy setting, tasks cannot be inactivated.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_taskscanbemadeinactive_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_taskscanbemadeinactive_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_updatemanuallyscheduledtaskswheneditinglinks","displayName":"Update manually scheduled tasks when editing links (User)","description":"This policy setting will allow the update of manually scheduled task dates when predecessor links are created or updated.\r\n\r\nIf you enable or do not configure this policy setting, manually scheduled task dates will be updated when predecessor links are created or updated.\r\n\r\nIf you disable this policy setting, manually scheduled task dates will not be updated when predecessor links are created or updated.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_updatemanuallyscheduledtaskswheneditinglinks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjscheddoc_l_updatemanuallyscheduledtaskswheneditinglinks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjschedproj_l_pjassignmentunits","displayName":"Show assignment units as (User)","description":"Shows resource assignments units as a decimal or percentage.\r\n\r\nIf you enable this setting, resource assignment units will be set to the option you choose from the list.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjschedproj_l_pjassignmentunits_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjschedproj_l_pjassignmentunits_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjschedproj_l_pjassignmentunits_l_pjassignmentunits21","displayName":"Show assignment units as (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjschedproj_l_pjassignmentunits_l_pjassignmentunits21_0","displayName":"Percentage","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjschedproj_l_pjassignmentunits_l_pjassignmentunits21_1","displayName":"Decimal","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjschedproj_l_pjshowschedmessage","displayName":"Show scheduling messages (User)","description":"Displays messages about schedule inconsistencies, such as a successor task starting before the finish of the predecessor task.\r\n\r\nIf you enable this setting, users will be alerted about scheduling inconsistencies.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjschedproj_l_pjshowschedmessage_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjschedule~l_pjschedproj_l_pjshowschedmessage_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency","displayName":"Default Project Currency (User)","description":"Allows you to manage whether users can set the default currency type for their new project plans. If you enable this setting, the default currency type is enforced for all new project plans. If this setting is disabled or not configured, users can set the default currency type for new project plans.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4","displayName":"Default Project Currency (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_aed","displayName":"United Arab Emirates, Dirhams","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_afa","displayName":"Afghanistan, Afghanis","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_all","displayName":"Albania, Leke","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_amd","displayName":"Armenia, Drams","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_aoa","displayName":"Angola, Kwanza","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_ars","displayName":"Argentina, Pesos","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_aud","displayName":"Australia, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_awg","displayName":"Aruba, Guilders (also called Florins)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_azm","displayName":"Azerbaijan, Manats","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_bam","displayName":"Bosnia and Herzegovina, Convertible Marka","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_bbd","displayName":"Barbados, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_bdt","displayName":"Bangladesh, Taka","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_bgn","displayName":"Bulgaria, Leva","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_bhd","displayName":"Bahrain, Dinars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_bif","displayName":"Burundi, Francs","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_bmd","displayName":"Bermuda, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_bnd","displayName":"Brunei Darussalam, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_bob","displayName":"Bolivia, Bolivianos","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_brl","displayName":"Brazil, Brazil Real","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_bsd","displayName":"Bahamas, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_btn","displayName":"Bhutan, Ngultrum","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_bwp","displayName":"Botswana, Pulas","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_byr","displayName":"Belarus, Rubles","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_bzd","displayName":"Belize, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_cad","displayName":"Canada, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_cdf","displayName":"Congo (DRC)//Kinshasa, Congolese Francs","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_chf","displayName":"Switzerland, Francs","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_clp","displayName":"Chile, Pesos","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_cny","displayName":"China, Yuan Renminbi","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_cop","displayName":"Colombia, Pesos","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_crc","displayName":"Costa Rica, Colones","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_csd","displayName":"Serbia, Dinars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_cup","displayName":"Cuba, Pesos","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_cve","displayName":"Cabo Verde, Escudos","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_czk","displayName":"Czech Republic, Koruny","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_djf","displayName":"Djibouti, Francs","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_dkk","displayName":"Denmark, Kroner","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_dop","displayName":"Dominican Republic, Pesos","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_dzd","displayName":"Algeria, Algeria Dinars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_egp","displayName":"Egypt, Pounds","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_ern","displayName":"Eritrea, Nakfa","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_etb","displayName":"Ethiopia, Birr","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_eur","displayName":"Euro Member Countries, Euro","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_fjd","displayName":"Fiji, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_fkp","displayName":"Falkland (Malvinas) Islands, Pounds","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_gbp","displayName":"United Kingdom, Pounds","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_gel","displayName":"Georgia, Lari","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_ggp","displayName":"Guernsey, Pounds","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_ghc","displayName":"Ghana, Cedis","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_gip","displayName":"Gibraltar, Pounds","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_gmd","displayName":"Gambia, Dalasi","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_gnf","displayName":"Guinea, Francs","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_gtq","displayName":"Guatemala, Quetzales","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_gyd","displayName":"Guyana, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_hkd","displayName":"Hong Kong, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_hnl","displayName":"Honduras, Lempiras","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_hrk","displayName":"Croatia, Kuna","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_htg","displayName":"Haiti, Gourdes","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_huf","displayName":"Hungary, Forint","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_idr","displayName":"Indonesia, Rupiahs","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_ils","displayName":"Israel, New Shekels","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_imp","displayName":"Isle of Man, Pounds","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_inr","displayName":"India, Rupees","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_iqd","displayName":"Iraq, Dinars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_irr","displayName":"Iran, Rials","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_isk","displayName":"Iceland, Kronur","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_jep","displayName":"Jersey, Pounds","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_jmd","displayName":"Jamaica, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_jod","displayName":"Jordan, Dinars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_jpy","displayName":"Japan, Yen","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_kes","displayName":"Kenya, Shillings","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_kgs","displayName":"Kyrgyzstan, Soms","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_khr","displayName":"Cambodia, Riels","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_kmf","displayName":"Comoros, Francs","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_kpw","displayName":"North Korea, Won","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_krw","displayName":"Korea, Won","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_kwd","displayName":"Kuwait, Dinars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_kyd","displayName":"Cayman Islands, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_kzt","displayName":"Kazakhstan, Tenge","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_lak","displayName":"Laos, Kips","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_lbp","displayName":"Lebanon, Pounds","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_lkr","displayName":"Sri Lanka, Rupees","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_lrd","displayName":"Liberia, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_lsl","displayName":"Lesotho, Maloti","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_ltl","displayName":"Lithuania, Litai","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_lyd","displayName":"Libya, Dinars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_mad","displayName":"Morocco, Dirhams","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_mdl","displayName":"Moldova, Lei","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_mga","displayName":"Madagascar, Ariary","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_mkd","displayName":"Macedonia FYRO, Denars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_mmk","displayName":"Myanmar (Burma), Kyats","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_mnt","displayName":"Mongolia, Tugriks","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_mop","displayName":"Macao, Patacas","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_mro","displayName":"Mauritania, Ouguiyas","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_mur","displayName":"Mauritius, Rupees","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_mvr","displayName":"Maldives (Maldive Islands), Rufiyaa","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_mwk","displayName":"Malawi, Kwachas","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_mxn","displayName":"Mexico, Pesos","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_myr","displayName":"Malaysia, Ringgits","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_mzm","displayName":"Mozambique, Meticais","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_nad","displayName":"Namibia, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_ngn","displayName":"Nigeria, Nairas","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_nio","displayName":"Nicaragua, Cordobas","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_nok","displayName":"Norway, Krone","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_npr","displayName":"Nepal, Nepal Rupees","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_nzd","displayName":"New Zealand, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_omr","displayName":"Oman, Rials","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_pab","displayName":"Panama, Balboa","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_pen","displayName":"Peru, Nuevos Soles","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_pgk","displayName":"Papua New Guinea, Kina","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_php","displayName":"Philippines, Pesos","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_pkr","displayName":"Pakistan, Rupees","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_pln","displayName":"Poland, Zlotych","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_pyg","displayName":"Paraguay, Guarani","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_qar","displayName":"Qatar, Rials","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_ron","displayName":"Romania, New Lei","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_rub","displayName":"Russia, Rubles","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_rwf","displayName":"Rwanda, Rwanda Francs","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_sar","displayName":"Saudi Arabia, Riyals","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_sbd","displayName":"Solomon Islands, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_scr","displayName":"Seychelles, Rupees","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_sdd","displayName":"Sudan, Dinars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_sek","displayName":"Sweden, Kronor","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_sgd","displayName":"Singapore, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_shp","displayName":"Saint Helena, Pounds","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_sll","displayName":"Sierra Leone, Leones","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_sos","displayName":"Somalia, Shillings","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_spl","displayName":"Seborga, Luigini","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_srd","displayName":"Suriname, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_std","displayName":"São Tome and Principe, Dobras","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_svc","displayName":"El Salvador, Colones","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_syp","displayName":"Syria, Pounds","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_szl","displayName":"Swaziland, Emalangeni","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_thb","displayName":"Thailand, Baht","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_tjs","displayName":"Tajikistan, Somoni","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_tmm","displayName":"Turkmenistan, Manats","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_tnd","displayName":"Tunisia, Dinars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_top","displayName":"Tonga, Pa'anga","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_try","displayName":"Turkey, Lira","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_ttd","displayName":"Trinidad and Tobago, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_tvd","displayName":"Tuvalu, Tuvalu Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_twd","displayName":"Taiwan, New Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_tzs","displayName":"Tanzania, Shillings","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_uah","displayName":"Ukraine, Hryvnia","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_ugx","displayName":"Uganda, Shillings","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_usd","displayName":"United States of America, Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_uyu","displayName":"Uruguay, Pesos","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_uzs","displayName":"Uzbekistan, Sums","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_ves","displayName":"Venezuela, Bolívar","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_vnd","displayName":"Vietnam, Dong","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_vuv","displayName":"Vanuatu, Vatu","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_wst","displayName":"Samoa, Tala","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_xaf","displayName":"Communauté Financière Africaine BEAC, Francs","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_xag","displayName":"Silver, Ounces","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_xau","displayName":"Gold, Ounces","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_xcd","displayName":"East Caribbean Dollars","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_xdr","displayName":"International Monetary Fund (IMF) Special Drawing Rights","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_xof","displayName":"Communauté Financière Africaine BCEAO, Francs","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_xpd","displayName":"Palladium Ounces","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_xpf","displayName":"Comptoirs Français du Pacifique Francs","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_xpt","displayName":"Platinum, Ounces","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_yer","displayName":"Yemen, Rials","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_zar","displayName":"South Africa, Rand","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_zmk","displayName":"Zambia, Kwacha","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_defaultprojectcurrency_l_defaultprojectcurrency4_zwd","displayName":"Zimbabwe, Zimbabwe Dollars","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat","displayName":"Date Format (User)","description":"Specifies the format for displaying dates. Some information, such as time formats and the date separator, is set through the Control Panel.\r\n \r\nIf you enable this setting, dates are displayed in the format you set.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3","displayName":"Date Format (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_0","displayName":"1/31/00 12:33 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_1","displayName":"1/31/00","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_20","displayName":"1/31/2000","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_2","displayName":"January 31, 2000 12:33 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_3","displayName":"January 31, 2000","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_4","displayName":"Jan 31 12:33 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_5","displayName":"Jan 31 '00","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_6","displayName":"January 31","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_7","displayName":"Jan 31","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_8","displayName":"Mon 1/31/00 12:33 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_9","displayName":"Mon 1/31/00","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_10","displayName":"Mon Jan 31, '00","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_11","displayName":"Mon 12:33 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_15","displayName":"Mon Jan 31","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_16","displayName":"Mon 1/31","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_17","displayName":"Mon 31","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_12","displayName":"1/31","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_13","displayName":"31","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_14","displayName":"12:33 PM","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_18","displayName":"W1/1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdateformat_l_pjdateformat3_19","displayName":"W1/1/00 12:33 PM","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview","displayName":"Default View (User)","description":"Specifies the view that Project displays at startup.\r\n \r\nIf you enable this setting, you can set the default view that is displayed at startup.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2","displayName":"Default View (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_bar rollup","displayName":"Bar Rollup","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_calendar","displayName":"Calendar","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_descriptive network diagram","displayName":"Descriptive Network Diagram","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_detail gantt","displayName":"Detail Gantt","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_gantt chart","displayName":"Gantt Chart","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_leveling gantt","displayName":"Leveling Gantt","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_milestone date rollup","displayName":"Milestone Date Rollup","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_milestone rollup","displayName":"Milestone Rollup","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_network diagram","displayName":"Network Diagram","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_relationship diagram","displayName":"Relationship Diagram","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_resource allocation","displayName":"Resource Allocation","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_resource form","displayName":"Resource Form","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_resource graph","displayName":"Resource Graph","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_resource name form","displayName":"Resource Names Form","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_resource sheet","displayName":"Resource Sheet","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_resource usage","displayName":"Resource Usage","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_task details form","displayName":"Task Details Form","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_task entry","displayName":"Task Entry","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_task form","displayName":"Task Form","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_task name form","displayName":"Task Name Form","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_task sheet","displayName":"Task Sheet","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_task usage","displayName":"Task Usage","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_pjdefaultview_l_pjdefaultview2_tracking gantt","displayName":"Tracking Gantt","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_projectsummarytask","displayName":"Project Summary Task (User)","description":"Allows you to manage whether the project summary task is displayed. If you enable this setting, the project summary task is displayed. If this setting is disabled or not configured, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_projectsummarytask_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview_l_projectsummarytask_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_calendartype_l_calendartype0","displayName":"Calendar Type (User)","description":"Allows you to set the default calendar type. You need to have the Complex Script and East Asian language packs installed on the operating system in order for this setting to be available. If you enable this setting, you can set the default calendar type. If you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_calendartype_l_calendartype0_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_calendartype_l_calendartype0_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_calendartype_l_calendartype0_l_calendartype1","displayName":"Calendar Type (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_calendartype_l_calendartype0_l_calendartype1_1","displayName":"Gregorian Calendar","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_calendartype_l_calendartype0_l_calendartype1_6","displayName":"Hijri Calendar","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_calendartype_l_calendartype0_l_calendartype1_7","displayName":"Thai Buddhist","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_automaticallyaddnewitemstotheglobalproject","displayName":"Automatically add new items to the global project (User)","description":"This policy setting specifies whether new items (views, tables, filters, and groups) are automatically added to the global project so they are available in all of the projects.\r\n\r\nIf you enable or do not configure this policy setting, new items will be automatically added to the global project.\r\n\r\nIf you disable this policy setting, new items will not be automatically added to the global project.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_automaticallyaddnewitemstotheglobalproject_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_automaticallyaddnewitemstotheglobalproject_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_pjentrybar","displayName":"Entry Bar (User)","description":"Displays the entry bar, in which you can enter or edit field information.\r\nIf you enable this setting, the entry bar is displayed.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_pjentrybar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_pjentrybar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_pjolelinks","displayName":"OLE Link Indicators (User)","description":"Displays the indicator for OLE linked objects in the lower-right corner of the cell that contains the link.\r\nIf you enable this setting, the indicator is displayed for OLE linked objects.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_pjolelinks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_pjolelinks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_pjprojectscreentips","displayName":"Project Screentips (User)","description":"Displays tips for Gantt bars and field headings, including dates for timescale units, and the full cell contents if a cell is too narrow to completely display the text in sheet and Network Diagram views.\r\n\r\nIf you enable this setting, tips are displayed fro Gantt bars and field headings.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_pjprojectscreentips_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_pjprojectscreentips_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_pjscrollbar","displayName":"Scroll Bars (User)","description":"Displays scrollbars for views.\r\n \r\nIf you enable this setting, scrollbars are displayed in the views.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_pjscrollbar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_pjscrollbar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_pjstatusbar","displayName":"Status Bar (User)","description":"Displays the status bar, which shows information about the progress of certain operations in Project.\r\n \r\nIf you enable this setting, the option to display the status bar is selected.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_pjstatusbar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_pjstatusbar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_pjwindowsinstatusbar","displayName":"Windows in Taskbar (User)","description":"Specifies whether separate windows are opened and displayed as separate buttons on the Windows taskbar for every open project.\r\n \r\nIf you enable this setting, a new window is displayed in the taskbar for each open project.\r\n\r\nIf you disable or do not configure this setting, the user's default setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_pjwindowsinstatusbar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_pjview~l_pjshow_l_pjwindowsinstatusbar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security_l_enableuntrustedintranetzoneaccesstoprojectserver","displayName":"Enable untrusted intranet zone access to Project server (User)","description":"Allows users to access Project Server Web sites and Workspaces that have not been added to their trusted internet zones. If you enable this setting, users can access Project Server and Microsoft SharePoint Foundation sites that are not in their trusted internet zones. If this setting is disabled or not configured, users are required to add the Project Server and Microsoft SharePoint Foundation sites to their trusted internet site zones.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security_l_enableuntrustedintranetzoneaccesstoprojectserver_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security_l_enableuntrustedintranetzoneaccesstoprojectserver_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security_l_legacyfileformats","displayName":"Previous-version file formats (User)","description":"Allows you manage whether users can open or save files in Project with file formats from previous versions or file formats that are not default. By default, users can not open or save files with formats from previous versions.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security_l_legacyfileformats_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security_l_legacyfileformats_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security_l_legacyfileformats_l_empty","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security_l_legacyfileformats_l_empty_0","displayName":"Do not open or save","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security_l_legacyfileformats_l_empty_1","displayName":"Prompt when opening and saving","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security_l_legacyfileformats_l_empty_2","displayName":"Allow opening and saving","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_configurecngcipherchainingmode","displayName":"Configure CNG cipher chaining mode (User)","description":"This policy setting allows you to configure the cipher chaining mode used.\r\n\r\nIf you enable this policy setting, the cipher chaining mode specified will be applied.\r\n\r\nIf you disable or do not configure this policy setting, Cipher Block Chaining (CBC) will be the default CNG cipher chaining mode used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_l_configurecngcipherchainingmodedropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_l_configurecngcipherchainingmodedropid_chainingmodecbc","displayName":"Cipher Block Chaining (CBC)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_l_configurecngcipherchainingmodedropid_chainingmodecfb","displayName":"Cipher Feedback (CFB)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_setcngcipheralgorithm","displayName":"Set CNG cipher algorithm (User)","description":"This policy setting allows you to configure the CNG cipher algorithm that is used.\r\n\r\nIf you enable this policy setting, then the cipher provided will be used if it is a supported algorithm.\r\n\r\nIf you disable or do not configure this policy setting, AES will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_setcngcipheralgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_setcngcipheralgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_setcngcipheralgorithm_l_setcngcipheralgorithmid","displayName":"CNG cipher algorithm: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_setcngcipherkeylength","displayName":"Set CNG cipher key length (User)","description":"This policy setting allows you to configure the number of bits to use when creating the cipher key. This number will be rounded down to a multiple of 8.\r\n\r\nIf you enable this policy setting, the key bits specified will be used.\r\n\r\nIf you disable or do not configure this policy setting, the default value will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_setcngcipherkeylength_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_setcngcipherkeylength_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_setcngcipherkeylength_l_setcngcipherkeylengthspinid","displayName":"Cipher key length (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_setcngpasswordspincount","displayName":"Set CNG password spin count (User)","description":"This policy setting allows you to specify the number of times to spin (rehash) the password verifier.\r\n\r\nIf you enable this policy setting, the number specified will be the number of times the password will be rehashed.\r\n\r\nIf you disable or do not configure this policy setting, the default (100000) will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_setcngpasswordspincount_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_setcngpasswordspincount_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_setcngpasswordspincount_l_setcngpasswordspincountspinid","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_setparametersforcngcontext","displayName":"Set parameters for CNG context (User)","description":"This policy setting allows you to specify the encryption parameters that should be used for the CNG context. \r\n\r\nIf you enable this policy setting, the parameters specified will be passed to the CNG context.\r\n\r\nIf you disable or do not configure this policy setting, the default CNG values will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_setparametersforcngcontext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_setparametersforcngcontext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_setparametersforcngcontext_l_setparametersforcngcontextid","displayName":"Parameters (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_specifycnghashalgorithm","displayName":"Specify CNG hash algorithm (User)","description":"This policy setting allows you to specify the hash algorithm used.\r\n\r\nIf you enable this policy setting, the hashing algorithm selected will be used by CNG.\r\n\r\nIf you disable or do not configure this policy setting, the default CNG hash algorithm will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_specifycnghashalgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_specifycnghashalgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha1","displayName":"SHA1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha256","displayName":"SHA256","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha384","displayName":"SHA384","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha512","displayName":"SHA512","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm","displayName":"Specify CNG random number generator algorithm (User)","description":"This policy setting allows you to configure the CNG random number generator to use.\r\n\r\nIf you enable this policy setting, the random number generator specified will be used.\r\n\r\nIf you disable or do not configure this policy setting, the default random number generator will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm_l_specifycngrandomnumbergeneratoralgorithmid","displayName":"Random number generator: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_specifycngsaltlength","displayName":"Specify CNG salt length (User)","description":"This policy setting allows you to specific the number of bytes of salt that should be used.\r\n\r\nIf you enable this policy setting, the bytes specified will be used.\r\n\r\nIf you disable or do not configure this policy setting, the default length or 16 will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_specifycngsaltlength_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_specifycngsaltlength_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_cryptography_l_specifycngsaltlength_l_specifycngsaltlengthspinid","displayName":"Number of bytes (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_pjmacro_l_pjsecuritylevel","displayName":"Security Level (User)","description":"Specifies the level of security used when opening documents.\r\n\r\nIf you enable this policy setting, the security level you specified will be used when user open documents.\r\n\r\nIf you disable or do not configure this policy setting, the users default for this setting is followed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_pjmacro_l_pjsecuritylevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_pjmacro_l_pjsecuritylevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_pjmacro_l_pjsecuritylevel_l_pjsecuritylevel36","displayName":"Security Level (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_pjmacro_l_pjsecuritylevel_l_pjsecuritylevel36_1","displayName":"Low (not recommended)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_pjmacro_l_pjsecuritylevel_l_pjsecuritylevel36_2","displayName":"Medium","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_pjmacro_l_pjsecuritylevel_l_pjsecuritylevel36_3","displayName":"High","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_pjmacro_l_pjsecuritylevel_l_pjsecuritylevel36_4","displayName":"Very High","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_allowtrustedlocationsonthenetwork","displayName":"Allow Trusted Locations on the network (User)","description":"This policy setting controls whether trusted locations on the network can be used.\r\n\r\nIf you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the \"Add new location\" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.\r\n\r\nIf you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. \r\n\r\nIf you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.\r\n\r\nDisabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center. We recommended that you do not enable this policy setting (as the \"Allow Trusted Locations on my network (not recommended)\" check box also states). Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.\r\n\r\nIf you do not enable this policy setting, users can select the \"Allow Trusted Locations on my network (not recommended)\" check box if desired and then specify trusted locations by clicking the \"Add new location\" button.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_allowtrustedlocationsonthenetwork_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_allowtrustedlocationsonthenetwork_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_disableallapplicationextensions","displayName":"Disable all application add-ins (User)","description":"This policy setting disables all add-ins for the specified Office 2016 applications.\r\n \r\nIf you enable this policy setting, all add-ins for the specified Office 2016 applications are disabled.\r\n\r\nIf you disable or do not configure this policy setting, all add-ins for the specified Office 2016 applications are allowed to run without notifying the users, except if application add-ins are required to be signed by Trusted Publishers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_disableallapplicationextensions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_disableallapplicationextensions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned","displayName":"Disable Trust Bar Notification for unsigned application add-ins and block them (User) (Deprecated)","description":"This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the \"Require that application add-ins are signed by Trusted Publisher\" policy setting, which prevents users from changing this policy setting.\r\n\r\nIf you enable this policy setting, applications automatically disable unsigned add-ins without informing users.\r\n \r\nIf you disable this policy setting, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.\r\n\r\nIf you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the \"Add-ins\" category of the Trust Center for the application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_v2","displayName":"Disable Trust Bar Notification for unsigned application add-ins and block them (User)","description":"This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the \"Require that application add-ins are signed by Trusted Publisher\" policy setting, which prevents users from changing this policy setting.\r\n\r\nIf you enable this policy setting, applications automatically disable unsigned add-ins without informing users.\r\n \r\nIf you disable this policy setting, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.\r\n\r\nIf you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the \"Add-ins\" category of the Trust Center for the application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_disabletrustedloc","displayName":"Disable all trusted locations (User)","description":"This policy setting allows administrators to disable all trusted locations in the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data.\r\n\r\nIf you enable this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are ignored, including any trusted locations established by Office 2016 during setup, deployed to users using Group Policy, or added by users themselves. Users will be prompted again when opening files from trusted locations.\r\n\r\nIf you disable or do not configure this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are assumed to be safe.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_disabletrustedloc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_disabletrustedloc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_requirethatapplicationextensionsaresigned","displayName":"Require that application add-ins are signed by Trusted Publisher (User)","description":"This policy setting controls whether add-ins for this applications must be digitally signed by a trusted publisher.\r\n \r\nIf you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2016 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Office 2016 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2016, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.\r\n\r\nIf you disable or do not configure this policy setting, this application does not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_requirethatapplicationextensionsaresigned_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_requirethatapplicationextensionsaresigned_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc01","displayName":"Trusted Location #1 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc01_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc01_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc01_l_allowsubfolders","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc01_l_allowsubfolders_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc01_l_allowsubfolders_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc01_l_datecolon","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc01_l_descriptioncolon","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc01_l_pathcolon","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc02","displayName":"Trusted Location #2 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc02_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc02_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc02_l_allowsubfolders15","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc02_l_allowsubfolders15_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc02_l_allowsubfolders15_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc02_l_datecolon13","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc02_l_descriptioncolon14","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc02_l_pathcolon12","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc03","displayName":"Trusted Location #3 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc03_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc03_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc03_l_allowsubfolders19","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc03_l_allowsubfolders19_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc03_l_allowsubfolders19_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc03_l_datecolon17","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc03_l_descriptioncolon18","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc03_l_pathcolon16","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc04","displayName":"Trusted Location #4 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc04_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc04_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc04_l_allowsubfolders23","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc04_l_allowsubfolders23_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc04_l_allowsubfolders23_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc04_l_datecolon21","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc04_l_descriptioncolon22","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc04_l_pathcolon20","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc05","displayName":"Trusted Location #5 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc05_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc05_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc05_l_allowsubfolders27","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc05_l_allowsubfolders27_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc05_l_allowsubfolders27_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc05_l_datecolon25","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc05_l_descriptioncolon26","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc05_l_pathcolon24","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc06","displayName":"Trusted Location #6 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc06_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc06_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc06_l_allowsubfolders31","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc06_l_allowsubfolders31_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc06_l_allowsubfolders31_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc06_l_datecolon29","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc06_l_descriptioncolon30","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc06_l_pathcolon28","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc07","displayName":"Trusted Location #7 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc07_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc07_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc07_l_allowsubfolders35","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc07_l_allowsubfolders35_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc07_l_allowsubfolders35_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc07_l_datecolon33","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc07_l_descriptioncolon34","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc07_l_pathcolon32","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc08","displayName":"Trusted Location #8 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc08_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc08_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc08_l_allowsubfolders39","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc08_l_allowsubfolders39_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc08_l_allowsubfolders39_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc08_l_datecolon37","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc08_l_descriptioncolon38","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc08_l_pathcolon36","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc09","displayName":"Trusted Location #9 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc09_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc09_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc09_l_allowsubfolders43","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc09_l_allowsubfolders43_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc09_l_allowsubfolders43_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc09_l_datecolon41","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc09_l_descriptioncolon42","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc09_l_pathcolon40","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc10","displayName":"Trusted Location #10 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc10_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc10_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc10_l_allowsubfolders47","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc10_l_allowsubfolders47_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc10_l_allowsubfolders47_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc10_l_datecolon45","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc10_l_descriptioncolon46","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc10_l_pathcolon44","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc11","displayName":"Trusted Location #11 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc11_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc11_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc11_l_allowsubfolders51","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc11_l_allowsubfolders51_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc11_l_allowsubfolders51_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc11_l_datecolon49","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc11_l_descriptioncolon50","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc11_l_pathcolon48","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc12","displayName":"Trusted Location #12 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc12_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc12_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc12_l_allowsubfolders55","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc12_l_allowsubfolders55_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc12_l_allowsubfolders55_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc12_l_datecolon53","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc12_l_descriptioncolon54","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc12_l_pathcolon52","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc13","displayName":"Trusted Location #13 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc13_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc13_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc13_l_allowsubfolders59","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc13_l_allowsubfolders59_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc13_l_allowsubfolders59_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc13_l_datecolon57","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc13_l_descriptioncolon58","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc13_l_pathcolon56","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc14","displayName":"Trusted Location #14 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc14_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc14_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc14_l_allowsubfolders63","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc14_l_allowsubfolders63_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc14_l_allowsubfolders63_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc14_l_datecolon61","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc14_l_descriptioncolon62","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc14_l_pathcolon60","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc15","displayName":"Trusted Location #15 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc15_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc15_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc15_l_allowsubfolders67","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc15_l_allowsubfolders67_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc15_l_allowsubfolders67_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc15_l_datecolon65","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc15_l_descriptioncolon66","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc15_l_pathcolon64","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc16","displayName":"Trusted Location #16 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc16_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc16_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc16_l_allowsubfolders71","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc16_l_allowsubfolders71_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc16_l_allowsubfolders71_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc16_l_datecolon69","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc16_l_descriptioncolon70","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc16_l_pathcolon68","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc17","displayName":"Trusted Location #17 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc17_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc17_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc17_l_allowsubfolders75","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc17_l_allowsubfolders75_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc17_l_allowsubfolders75_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc17_l_datecolon73","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc17_l_descriptioncolon74","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc17_l_pathcolon72","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc18","displayName":"Trusted Location #18 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc18_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc18_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc18_l_allowsubfolders79","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc18_l_allowsubfolders79_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc18_l_allowsubfolders79_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc18_l_datecolon77","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc18_l_descriptioncolon78","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc18_l_pathcolon76","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc19","displayName":"Trusted Location #19 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc19_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc19_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc19_l_allowsubfolders83","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc19_l_allowsubfolders83_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc19_l_allowsubfolders83_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc19_l_datecolon81","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc19_l_descriptioncolon82","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc19_l_pathcolon80","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc20","displayName":"Trusted Location #20 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc20_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc20_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc20_l_allowsubfolders87","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc20_l_allowsubfolders87_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc20_l_allowsubfolders87_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc20_l_datecolon85","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc20_l_descriptioncolon86","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_trustedloc20_l_pathcolon84","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_vbawarningspolicy","displayName":"VBA Macro Notification Settings (User)","description":"This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.\r\n\r\nIf you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:\r\n \r\n- Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.\r\n \r\n- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.\r\n \r\n- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.\r\n \r\n- Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.\r\n \r\nIf you disable this policy setting, \"Disable all with notification\" will be the default setting.\r\n \r\nIf you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking \"Enable Content\" on the Trust Bar. If the user clicks \"Enable Content\", then the document is added as a trusted document.\r\n \r\nImportant: If \"Disable all except digitally signed macros\" is selected, users will not be able to open unsigned Access databases.\r\n \r\nAlso, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.\r\n \r\nTherefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_vbawarningspolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_vbawarningspolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty_2","displayName":"Disable all with notification","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty_3","displayName":"Disable all except digitally signed macros","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty_4","displayName":"Disable all without notification","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v2~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty_1","displayName":"Enable all macros (not recommended)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_proj16v3~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_blockmacroexecutionfrominternet","displayName":"Block macros from running in Office files from the internet (User)","description":"\r\nThis policy setting allows you to block macros from running in Office files that come from the internet.\r\n\r\nIf you enable this policy setting, macros are blocked from running, even if \"Enable all macros\" is selected in the Macro Settings section of the Trust Center. Users will receive a notification that macros are blocked from running.\r\n\r\nThe exceptions when macros will be allowed to run are:\r\n- The Office file is saved to a Trusted Location.\r\n- The Office file was previously trusted by the user.\r\n- Macros are digitally signed and the matching Trusted Publisher certificate is installed on the device.\r\n\r\nIf you disable this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the internet.\r\n\r\nIf you don’t configure this policy setting, macros will be blocked from running. Users will receive a notification telling them of the security risks of macros from the internet along with a link to learn more.\r\n\r\nFor more information, see https://go.microsoft.com/fwlink/p/?linkid=2185771.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_proj16v3~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_blockmacroexecutionfrominternet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_proj16v3~policy~l_proj~l_projectoptions~l_security~l_trustcenter_l_blockmacroexecutionfrominternet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems2","displayName":"Disable commands (User)","description":"This policy setting allows you to disable any command bar button and menu item with a command bar ID, including command bar buttons and menu items that are not in the predefined lists.\r\n\r\nIf you enable this policy setting, you can enter an ID number to disable a specific command bar button or menu item. \r\n\r\nIf you disable or do not configure this policy setting, all default command bar buttons or menu items are available to users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems2_l_enteracommandbaridtodisable","displayName":"Enter a command bar ID to disable (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems","displayName":"Disable commands (User)","description":"This policy setting allows you to disable specific command bar buttons and menu items for Publisher.\r\n\r\nIf you enable this policy setting, you can enter an ID number to disable a specific command bar button or menu item. The ID number needs to be in decimal (not hexadecimal). Multiple values should be separated by commas.\r\n\r\nIf you disable or do not configure this policy setting, the predefined list of command bar buttons and menu items are enabled for Publisher.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filepublishtoweb","displayName":"File tab | Export | Publish HTML (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filepublishtoweb_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filepublishtoweb_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filesendemailemailpreview","displayName":"File tab | Share | E-mail Preview (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filesendemailemailpreview_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filesendemailemailpreview_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filesendemailsendthispage","displayName":"File tab | Share | Email (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filesendemailsendthispage_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filesendemailsendthispage_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filewebpagepreview","displayName":"Web tab | View | Web Page Preview (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filewebpagepreview_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filewebpagepreview_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_puboptions1","displayName":"File tab | Options (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_puboptions1_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_puboptions1_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsaddins","displayName":"Developer tab | Add-Ins | COM Add-Ins (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsaddins_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsaddins_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacro","displayName":"Developer tab (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacro_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacro_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacromacros","displayName":"Developer tab | Code | Macros (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacromacros_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacromacros_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrosecurity","displayName":"Developer tab | Code | Macro Security (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrosecurity_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrosecurity_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrovisualbasiceditor","displayName":"Developer tab | Code | Visual Basic (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrovisualbasiceditor_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrovisualbasiceditor_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_adddoublequotesinhebrewalphabetnumbering","displayName":"Add double quotes in Hebrew alphabet numbering (User)","description":"Checked: Adds double quotation marks ('') to Hebrew numbering. | Unchecked: Does not add double quotation marks ('') to Hebrew numbering.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_adddoublequotesinhebrewalphabetnumbering_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_adddoublequotesinhebrewalphabetnumbering_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_blockallunmanagedaddins","displayName":"Block all unmanaged add-ins (User)","description":"This policy setting blocks all add-ins that are not managed by the \"List of managed add-ins\" policy setting.\r\n\r\nIf you enable this policy setting, and the \"List of managed add-ins\" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the \"List of managed add-ins\" policy setting.\r\n\r\nIf you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the \"List of managed add-ins\" policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_blockallunmanagedaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_blockallunmanagedaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_defaultbuiltintab","displayName":"Default tab to show in Publisher on the Office Start screen and in File | New (User)","description":"This policy setting controls what displays as the default tab in Publisher on the Office Start screen and in File | New. \r\n\r\nIf you enable this policy setting, you can choose one of two options to become the default tab on the Office Start screen and in File | New:\r\n\r\n* Built-in – Users will the see built-in templates tab as the default tab in Publisher on the Office Start screen and in File | New.\r\n\r\n* Custom – Users will the see custom templates tab as the default tab in Publisher on the Office Start screen and in File | New when templates exist (this can include Custom XML programmed templates, templates in the Workgroup templates path, templates in the Personal templates path, or SharePoint templates).\r\n\r\nIf you disable or do not configure this policy setting, users will see the Featured templates tab as the default tab in Publisher on the Office Start screen and in File | New","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_defaultbuiltintab_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_defaultbuiltintab_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_defaultbuiltintab_l_defaultbuiltintab","displayName":"Default tab (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_defaultbuiltintab_l_defaultbuiltintab_0","displayName":"Featured","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_defaultbuiltintab_l_defaultbuiltintab_2","displayName":"Built-in","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_defaultbuiltintab_l_defaultbuiltintab_1","displayName":"Custom","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_disableofficestartpublisher","displayName":"Disable the Office Start screen for Publisher (User)","description":"This policy setting controls whether the Office Start screen appears on boot for Publisher.\r\n\r\nIf you enable this policy setting, users will not see the Office Start screen when they boot Publisher.\r\n\r\nIf you disable or do not configure this policy setting, users will see the Office Start screen when they boot Publisher.\r\n\r\nNote: This policy setting is overridden by the policy setting \"Microsoft Office 2016 > Miscellaneous > Disable the Office Start screen for all Office applications\" if that policy setting is set.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_disableofficestartpublisher_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_disableofficestartpublisher_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_listofmanagedaddins","displayName":"List of managed add-ins (User)","description":"This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the \"Block all unmanaged add-ins\" policy setting.\r\n\r\nTo enable this policy setting, provide the following information for each add-in:\r\n\r\nIn \"Value name,\" specify the programmatic identifier (ProgID) for COM add-ins.\r\n\r\nTo obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Office\\Publisher\\Addins or HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Office\\Publisher\\Addins.\r\n\r\nYou can also obtain the ProgID of an add-in by using Office Telemetry Dashboard.\r\n\r\nIn \"Value,\" specify the value as follows:\r\n\r\nTo specify that an add-in is always disabled (blocked), type 0.\r\n\r\nTo specify that an add-in is always enabled, type 1.\r\n\r\nTo specify that an add-in is configurable by the user and not blocked by the \"Block all unmanaged add-ins\" policy setting when enabled, type 2.\r\n\r\nIf you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the \"Block all unmanaged add-ins\" policy setting is enabled, then all add-ins are blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_listofmanagedaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_listofmanagedaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_listofmanagedaddins_l_listofmanagedaddins2","displayName":"List of managed add-ins (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_listofmanagedaddins_l_listofmanagedaddins2_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_listofmanagedaddins_l_listofmanagedaddins2_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_personaltemplatespath","displayName":"Personal templates path for Publisher (User)","description":"This policy setting specifies the location of a user's personal templates. \r\n\r\nIf you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. \r\n\r\nIf you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_personaltemplatespath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_personaltemplatespath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_personaltemplatespath_l_personaltemplatespath","displayName":"Personal templates path (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_promptusertosetupprinter","displayName":"Prompt user to setup printer (User)","description":"When set, Publisher will show a prompt to the user to start the Printer Setup Wizard when a new printer is found.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_promptusertosetupprinter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_miscellaneous_l_promptusertosetupprinter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_allowtexttobedraggedanddropped","displayName":"Allow text to be dragged and dropped (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_allowtexttobedraggedanddropped_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_allowtexttobedraggedanddropped_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_automaticallyhyphenateinnewtextboxes","displayName":"Automatically hyphenate in new text boxes (User)","description":"Checks/Unchecks the option ''Automatically hyphenate in new text boxes''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_automaticallyhyphenateinnewtextboxes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_automaticallyhyphenateinnewtextboxes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_automaticallysubstitutefontformissingeachars","displayName":"Automatically substitute font for missing East Asian characters (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_automaticallysubstitutefontformissingeachars_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_automaticallysubstitutefontformissingeachars_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_automaticallyswitchkeyboard","displayName":"Automatically switch keyboard to match the language of surrounding text (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_automaticallyswitchkeyboard_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_automaticallyswitchkeyboard_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_enableincrementalpublishtoweb","displayName":"Enable incremental publish to Web (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_enableincrementalpublishtoweb_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_enableincrementalpublishtoweb_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_promptuserwhenreapplyingastyle","displayName":"Prompt user when reapplying a style (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_promptuserwhenreapplyingastyle_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_promptuserwhenreapplyingastyle_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_sendentirepublicationasasingle","displayName":"Send entire publication as a single JPEG image (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_sendentirepublicationasasingle_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_sendentirepublicationasasingle_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_setmaximumnumberofmruitemstodisplay","displayName":"Number of publications in the Recent Publications list (User)","description":"This policy setting specifies the number of entries displayed in the Recent Publications list that appears when users click Open on the File tab in Backstage view. \r\n\r\nIf you enable this policy setting, you can specify the number of entries to be between 0 and 50. If you set the number to 0, all pinned and unpinned entries are hidden.\r\n\r\nIf you disable or do not configure this policy setting, a maximum of 25 items will be displayed in the Recent Publications list.\r\n\r\nNote: If you want to prevent items from being added to the Recent Publications list entirely, you can enable the \"Do not keep history of recently opened documents\" Windows policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_setmaximumnumberofmruitemstodisplay_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_setmaximumnumberofmruitemstodisplay_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_setmaximumnumberofmruitemstodisplay_l_setmaximumnumberofmruitemstodisplayspinid","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_setnumberofplacesintherecentplaceslist","displayName":"Number of folders in the Recent Folders list (User)","description":"This policy setting specifies the number of unpinned entries displayed in the Recent Folders list that appears when users click Open or Save As on the File tab in Backstage view.\r\n\r\nIf you enable this policy setting, you can specify the number of unpinned entries to be between 0 and 20. If you set the number to 0, all pinned and unpinned entries are hidden.\r\n\r\nIf you disable or do not configure this policy setting, a maximum of 5 unpinned items are displayed in the Recent Folders list.\r\n\r\nNote: If you want to prevent items from being added to the Recent Folders list entirely, you can enable the \"Do not keep history of recently opened documents\" Windows policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_setnumberofplacesintherecentplaceslist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_setnumberofplacesintherecentplaceslist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_setnumberofplacesintherecentplaceslist_l_setnumberofplacesintherecentplaceslistspinid","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_showscreentipsonobjects","displayName":"Show ScreenTips on objects (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_showscreentipsonobjects_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_showscreentipsonobjects_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_turnoffdragpreview","displayName":"Turn off drag preview (User)","description":"This policy setting allows you to determine whether Publisher shows a semi-transparent drag preview or a simple outline of the object when the object is dragged.\r\n\r\nIf you enable this policy setting, only the outline of the object is shown while being dragged. This is the recommended setting for older machines because of the resource requirements of this feature.\r\n\r\nIf you disable or do not configure this policy setting, a semi-transparent drag preview of the object is shown while being dragged.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_turnoffdragpreview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_turnoffdragpreview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_usechinesefontsizes","displayName":"Use Chinese font sizes (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_usechinesefontsizes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_usechinesefontsizes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_usexpsenhancedprintpath","displayName":"Use XPS-enhanced print path (User)","description":"This policy setting allows you to use XPS-enhanced print path when available. \r\n\r\nIf you enable or do not configure this policy setting, the XPS print path will be used.\r\n\r\nIf you disable this policy setting, the XPS print path is not used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_usexpsenhancedprintpath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_usexpsenhancedprintpath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_whenformattingautomaticallyformatentireword","displayName":"When formatting, automatically format entire word (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_whenformattingautomaticallyformatentireword_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_whenformattingautomaticallyformatentireword_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_whenselectingautomaticallyselectentireword","displayName":"When selecting, automatically select entire word (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_whenselectingautomaticallyselectentireword_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced_l_whenselectingautomaticallyselectentireword_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced~l_complexscripts_l_defaultpublisherdirection","displayName":"Default Publisher direction (User)","description":"Specifies the default layout orientation.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced~l_complexscripts_l_defaultpublisherdirection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced~l_complexscripts_l_defaultpublisherdirection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced~l_complexscripts_l_defaultpublisherdirection_l_defaultpublisherdirection3","displayName":"Default Publisher direction (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced~l_complexscripts_l_defaultpublisherdirection_l_defaultpublisherdirection3_0","displayName":"Left to right","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced~l_complexscripts_l_defaultpublisherdirection_l_defaultpublisherdirection3_1","displayName":"Right to left","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced~l_complexscripts_l_setdefaulttextflowdirection","displayName":"Set default text flow direction (User)","description":"This policy setting allows you to set the default text flow between Right-to-Left (RTL) and Left-to-Right (LTR). \r\n\r\nIf you enable this policy setting, you may choose whether text will flow RTL or LTR.\r\n\r\nIf you disable or not configure this policy setting, the default text flow setting is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced~l_complexscripts_l_setdefaulttextflowdirection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced~l_complexscripts_l_setdefaulttextflowdirection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced~l_complexscripts_l_setdefaulttextflowdirection_l_setdefaulttextflowdirectiondropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced~l_complexscripts_l_setdefaulttextflowdirection_l_setdefaulttextflowdirectiondropid_1","displayName":"Left-to-Right","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced~l_complexscripts_l_setdefaulttextflowdirection_l_setdefaulttextflowdirectiondropid_256","displayName":"Right-to-Left","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced~l_complexscripts_l_usesequencechecking","displayName":"Use sequence checking (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced~l_complexscripts_l_usesequencechecking_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced~l_complexscripts_l_usesequencechecking_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced~l_complexscripts_l_usetypeandreplace","displayName":"Use type and replace (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced~l_complexscripts_l_usetypeandreplace_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_advanced~l_complexscripts_l_usetypeandreplace_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_general_l_showthenewtemplategallerywhenstartingpublisher","displayName":"Show the New template gallery when starting Publisher (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_general_l_showthenewtemplategallerywhenstartingpublisher_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_general_l_showthenewtemplategallerywhenstartingpublisher_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_optionscustomizeribbon_l_displaydevelopertab","displayName":"Display Developer tab in the Ribbon (User)","description":"This policy setting controls whether the Developer tab will be displayed in the Ribbon.\r\n\r\nIf you enable this policy setting, the Developer tab will be displayed in the Ribbon.\r\n\r\nIf you disable this policy setting, the Developer tab will not be displayed in the Ribbon.\r\n\r\nIf you do not configure this policy setting, the Developer tab will not be displayed in the Ribbon, but its visibility can be changed via a setting in the application Options dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_optionscustomizeribbon_l_displaydevelopertab_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_optionscustomizeribbon_l_displaydevelopertab_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_proofing_l_checkspellingasyoutype","displayName":"Check spelling as you type (User)","description":"This policy setting allows you to configure options for spelling errors.\r\n\r\nIf you enable this policy setting, you may choose one of these options:\r\n- Check spelling as you type: This option is checked.\r\n- Hide spelling errors: This option is checked, but \"Check spelling as you type\" is unchecked.\r\n- Both: \"Check spelling as you type\" and \"Hide spelling errors\" are both checked.\r\n\r\nIf you disable or do not configure this policy setting, the \"Check spelling as you type\" option is checked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_proofing_l_checkspellingasyoutype_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_proofing_l_checkspellingasyoutype_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_proofing_l_checkspellingasyoutype_l_checkspellingasyoutypedropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_proofing_l_checkspellingasyoutype_l_checkspellingasyoutypedropid_1","displayName":"Check spelling as you type","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_proofing_l_checkspellingasyoutype_l_checkspellingasyoutypedropid_2","displayName":"Hide spelling errors","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_proofing_l_checkspellingasyoutype_l_checkspellingasyoutypedropid_3","displayName":"Both","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_save_l_allowbackgroundsaves","displayName":"Allow background saves (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_save_l_allowbackgroundsaves_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_save_l_allowbackgroundsaves_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_save_l_saveautorecoverinfoevery","displayName":"Save AutoRecover info every (minutes) (User)","description":"This policy setting allows you to specify the Save Autorecover interval in minutes.\r\n\r\nIf you enable this policy setting, you may specify the Save Autorecover interval in minutes (valid range: 1-120).\r\n\r\nIf you disable or do not configure this policy setting, the interval specified in the UI will be used.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_save_l_saveautorecoverinfoevery_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_save_l_saveautorecoverinfoevery_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_puboptions~l_save_l_saveautorecoverinfoevery_l_saveautorecoverinfoeveryid","displayName":"Minutes (range 1-120): (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security_l_preventfatallycorruptfilesfromopening","displayName":"Prompt to allow fatally corrupt files to open instead of blocking them (User)","description":"When disabled, fatally corrupt files are prevented from opening. When enabled, the user is warned but may choose to open the file.By default, fatally corrupt files are prevented from opening.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security_l_preventfatallycorruptfilesfromopening_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security_l_preventfatallycorruptfilesfromopening_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security_l_publisherautomationsecuritylevel","displayName":"Publisher Automation Security Level (User)","description":"This policy setting controls whether macros opened programmatically by another application can run in Publisher.\r\n\r\nIf you enable this policy setting, you may choose an option for controlling macro behavior in Publisher when the application is opened programmatically:\r\n\r\n- Low (enabled): Macros can run in the programmatically opened application.\r\n- By UI (prompted): Macro functionality is determined by the setting in the \"Macro Settings\" section of the Trust Center.\r\n- High (disabled): All macros are disabled in the programmatically opened application.\r\n\r\nIf you disable or do not configure this policy setting, Publisher will use the default Macro setting in Trust Center.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security_l_publisherautomationsecuritylevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security_l_publisherautomationsecuritylevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security_l_publisherautomationsecuritylevel_l_empty","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security_l_publisherautomationsecuritylevel_l_empty_1","displayName":"Low (enabled)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security_l_publisherautomationsecuritylevel_l_empty_2","displayName":"By UI (prompted)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security_l_publisherautomationsecuritylevel_l_empty_3","displayName":"High (disabled)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_disableallapplicationextensions","displayName":"Block application add-ins loading (User)","description":"This policy setting disables all add-ins for the specified Office 2016 applications.\r\n \r\nIf you enable this policy setting, all add-ins for the specified Office 2016 applications are disabled.\r\n\r\nIf you disable or do not configure this policy setting, all add-ins for the specified Office 2016 applications are allowed to run without notifying the users, except if application add-ins are required to be signed by Trusted Publishers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_disableallapplicationextensions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_disableallapplicationextensions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned","displayName":"Disable Trust Bar Notification for unsigned application add-ins (User) (Deprecated)","description":"This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the \"Require that application add-ins are signed by Trusted Publisher\" policy setting, which prevents users from changing this policy setting.\r\n\r\nIf you enable this policy setting, applications automatically disable unsigned add-ins without informing users.\r\n \r\nIf you disable this policy setting, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.\r\n\r\nIf you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the \"Add-ins\" category of the Trust Center for the application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_v2","displayName":"Disable Trust Bar Notification for unsigned application add-ins (User)","description":"This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the \"Require that application add-ins are signed by Trusted Publisher\" policy setting, which prevents users from changing this policy setting.\r\n\r\nIf you enable this policy setting, applications automatically disable unsigned add-ins without informing users.\r\n \r\nIf you disable this policy setting, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.\r\n\r\nIf you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the \"Add-ins\" category of the Trust Center for the application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_requirethatapplicationextensionsaresigned","displayName":"Require that application add-ins are signed by Trusted Publisher (User)","description":"This policy setting controls whether add-ins for this applications must be digitally signed by a trusted publisher.\r\n \r\nIf you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2016 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Office 2016 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2016, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.\r\n\r\nIf you disable or do not configure this policy setting, this application does not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_requirethatapplicationextensionsaresigned_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_requirethatapplicationextensionsaresigned_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_vbawarningspolicy","displayName":"VBA Macro Notification Settings (User)","description":"This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.\r\n\r\nIf you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:\r\n \r\n- Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.\r\n \r\n- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.\r\n \r\n- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.\r\n \r\n- Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.\r\n \r\nIf you disable this policy setting, \"Disable all with notification\" will be the default setting.\r\n \r\nIf you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking \"Enable Content\" on the Trust Bar. If the user clicks \"Enable Content\", then the document is added as a trusted document.\r\n \r\nImportant: If \"Disable all except digitally signed macros\" is selected, users will not be able to open unsigned Access databases.\r\n \r\nAlso, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.\r\n \r\nTherefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_vbawarningspolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_vbawarningspolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_vbawarningspolicy_l_empty0","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_vbawarningspolicy_l_empty0_2","displayName":"Disable all with notification","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_vbawarningspolicy_l_empty0_3","displayName":"Disable all except digitally signed macros","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_vbawarningspolicy_l_empty0_4","displayName":"Disable all without notification","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v2~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_vbawarningspolicy_l_empty0_1","displayName":"Enable all macros (not recommended)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_pub16v3~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_blockmacroexecutionfrominternet","displayName":"Block macros from running in Office files from the internet (User)","description":"\r\n This policy setting allows you to block macros from running in Office files that come from the internet.\r\n\r\n If you enable this policy setting, macros are blocked from running, even if \"Enable all macros\" is selected in the Macro Settings section of the Trust Center. Users will receive a notification that macros are blocked from running.\r\n\r\n The exceptions when macros will be allowed to run are:\r\n - The Office file is saved to a Trusted Location.\r\n - The Office file was previously trusted by the user.\r\n - Macros are digitally signed and the matching Trusted Publisher certificate is installed on the device.\r\n\r\n If you disable this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the internet.\r\n\r\n If you don’t configure this policy setting, macros will be blocked from running. Users will receive a notification telling them of the security risks of macros from the internet along with a link to learn more.\r\n\r\n For more information, see https://go.microsoft.com/fwlink/p/?linkid=2185771.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_pub16v3~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_blockmacroexecutionfrominternet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_pub16v3~policy~l_microsoftofficepublisher~l_security~l_trustcenter_l_blockmacroexecutionfrominternet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_remotedesktop_autosubscription","displayName":"Auto-subscription (User)","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-configuration-service-provider"],"options":null},{"id":"user_vendor_msft_policy_config_remotedesktopservices_limitclienttoserverclipboardredirection","displayName":"Restrict clipboard transfer from client to server (User)","description":"This policy setting allows you to restrict clipboard data transfers from client to server.\r\n\r\nIf you enable this policy setting, you must choose from the following behaviors:\r\n\r\n- Disable clipboard transfers from client to server.\r\n\r\n- Allow plain text copying from client to server.\r\n\r\n- Allow plain text and images copying from client to server.\r\n\r\n- Allow plain text, images and Rich Text Format copying from client to server.\r\n\r\n- Allow plain text, images, Rich Text Format and HTML copying from client to server.\r\n\r\nIf you disable or do not configure this policy setting, users can copy arbitrary contents from client to server if clipboard redirection is enabled.\r\n\r\nNote: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the stricter restriction will be used.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-remotedesktopservices#remotedesktopservices-limitclienttoserverclipboardredirection"],"options":[{"id":"user_vendor_msft_policy_config_remotedesktopservices_limitclienttoserverclipboardredirection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_remotedesktopservices_limitclienttoserverclipboardredirection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_remotedesktopservices_limitclienttoserverclipboardredirection_ts_cs_clipboard_restriction_text","displayName":"Restrict clipboard transfer from client to server: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_remotedesktopservices_limitclienttoserverclipboardredirection_ts_cs_clipboard_restriction_text_0","displayName":"Disable clipboard transfers from client to server","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_remotedesktopservices_limitclienttoserverclipboardredirection_ts_cs_clipboard_restriction_text_1","displayName":"Allow plain text","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_remotedesktopservices_limitclienttoserverclipboardredirection_ts_cs_clipboard_restriction_text_2","displayName":"Allow plain text and images","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_remotedesktopservices_limitclienttoserverclipboardredirection_ts_cs_clipboard_restriction_text_3","displayName":"Allow plain text, images and Rich Text Format","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_remotedesktopservices_limitclienttoserverclipboardredirection_ts_cs_clipboard_restriction_text_4","displayName":"Allow plain text, images, Rich Text Format and HTML","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_remotedesktopservices_limitservertoclientclipboardredirection","displayName":"Restrict clipboard transfer from server to client (User)","description":"This policy setting allows you to restrict clipboard data transfers from server to client.\r\n\r\nIf you enable this policy setting, you must choose from the following behaviors:\r\n\r\n- Disable clipboard transfers from server to client.\r\n\r\n- Allow plain text copying from server to client.\r\n\r\n- Allow plain text and images copying from server to client.\r\n\r\n- Allow plain text, images and Rich Text Format copying from server to client.\r\n\r\n- Allow plain text, images, Rich Text Format and HTML copying from server to client.\r\n\r\nIf you disable or do not configure this policy setting, users can copy arbitrary contents from server to client if clipboard redirection is enabled.\r\n\r\nNote: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the stricter restriction will be used.\r\n\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-remotedesktopservices#remotedesktopservices-limitservertoclientclipboardredirection"],"options":[{"id":"user_vendor_msft_policy_config_remotedesktopservices_limitservertoclientclipboardredirection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_remotedesktopservices_limitservertoclientclipboardredirection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_remotedesktopservices_limitservertoclientclipboardredirection_ts_sc_clipboard_restriction_text","displayName":"Restrict clipboard transfer from server to client: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_remotedesktopservices_limitservertoclientclipboardredirection_ts_sc_clipboard_restriction_text_0","displayName":"Disable clipboard transfers from server to client","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_remotedesktopservices_limitservertoclientclipboardredirection_ts_sc_clipboard_restriction_text_1","displayName":"Allow plain text","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_remotedesktopservices_limitservertoclientclipboardredirection_ts_sc_clipboard_restriction_text_2","displayName":"Allow plain text and images","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_remotedesktopservices_limitservertoclientclipboardredirection_ts_sc_clipboard_restriction_text_3","displayName":"Allow plain text, images and Rich Text Format","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_remotedesktopservices_limitservertoclientclipboardredirection_ts_sc_clipboard_restriction_text_4","displayName":"Allow plain text, images, Rich Text Format and HTML","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_security_recoveryenvironmentauthentication","displayName":"Recovery Environment Authentication (User)","description":"This policy controls the requirement of Admin Authentication in RecoveryEnvironment.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Security#recoveryenvironmentauthentication"],"options":[{"id":"user_vendor_msft_policy_config_security_recoveryenvironmentauthentication_0","displayName":"current) behavior","description":"current) behavior","helpText":null},{"id":"user_vendor_msft_policy_config_security_recoveryenvironmentauthentication_1","displayName":"RequireAuthentication: Admin Authentication is always required for components in RecoveryEnvironment","description":"RequireAuthentication: Admin Authentication is always required for components in RecoveryEnvironment","helpText":null},{"id":"user_vendor_msft_policy_config_security_recoveryenvironmentauthentication_2","displayName":"NoRequireAuthentication: Admin Authentication is not required for components in RecoveryEnvironment","description":"NoRequireAuthentication: Admin Authentication is not required for components in RecoveryEnvironment","helpText":null}]},{"id":"user_vendor_msft_policy_config_settings_configuretaskbarcalendar","displayName":"Configure Taskbar Calendar (User)","description":"Allows IT Admins to configure the default setting for showing additional calendars (besides the default calendar for the locale) in the taskbar clock and calendar flyout. In this version of Windows 10, supported additional calendars are: Simplified or Traditional Chinese lunar calendar. Turning on one of these calendars will display Chinese lunar dates below the default calendar for the locale. Select Don't show additional calendars to prevent showing other calendars besides the default calendar for the locale.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Settings#configuretaskbarcalendar"],"options":[{"id":"user_vendor_msft_policy_config_settings_configuretaskbarcalendar_0","displayName":"User will be allowed to configure the setting.","description":"User will be allowed to configure the setting.","helpText":null},{"id":"user_vendor_msft_policy_config_settings_configuretaskbarcalendar_1","displayName":"Don't show additional calendars.","description":"Don't show additional calendars.","helpText":null},{"id":"user_vendor_msft_policy_config_settings_configuretaskbarcalendar_2","displayName":"Simplified Chinese (Lunar).","description":"Simplified Chinese (Lunar).","helpText":null},{"id":"user_vendor_msft_policy_config_settings_configuretaskbarcalendar_3","displayName":"Traditional Chinese (Lunar).","description":"Traditional Chinese (Lunar).","helpText":null}]},{"id":"user_vendor_msft_policy_config_settings_pagevisibilitylist","displayName":"Page Visibility List (User)","description":"Allows IT Admins to either prevent specific pages in the System Settings app from being visible or accessible, or to do so for all pages except those specified. The mode will be specified by the policy string beginning with either the string showonly: or hide:.  Pages are identified by a shortened version of their already published URIs, which is the URI minus the ms-settings: prefix. For example, if the URI for a settings page is ms-settings:bluetooth, the page identifier used in the policy will be just bluetooth. Multiple page identifiers are separated by semicolons. The following example illustrates a policy that would allow access only to the about and bluetooth pages, which have URI ms-settings:about and ms-settings:bluetooth respectively:showonly:about;bluetooth. If the policy is not specified, the behavior will be that no pages are affected. If the policy string is formatted incorrectly, it will be ignored entirely (i. e. treated as not set) to prevent the machine from becoming unserviceable if data corruption occurs. Note that if a page is already hidden for another reason, then it will remain hidden even if it is in a showonly: list. The format of the PageVisibilityList value is as follows: The value is a unicode string up to 10,000 characters long, which will be used without case sensitivity. There are two variants: one that shows only the given pages and one which hides the given pages. The first variant starts with the string showonly: and the second with the string hide:. Following the variant identifier is a semicolon-delimited list of page identifiers, which must not have any extra whitespace. Each page identifier is the ms-settings:xyz URI for the page, minus the ms-settings: prefix, so the identifier for the page with URI ms-settings:network-wifi would be just network-wifi. The default value for this setting is an empty string, which is interpreted as show everything. Example 1, specifies that only the wifi and bluetooth pages should be shown (they have URIs ms-settings:network-wifi and ms-settings:bluetooth). All other pages (and the categories they're in) will be hidden:showonly:network-wifi;bluetooth. Example 2, specifies that the wifi page should not be shown:hide:network-wifi","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Settings#pagevisibilitylist"],"options":null},{"id":"user_vendor_msft_policy_config_start_alwaysshownotificationicon","displayName":"Always Show Notification Icon (User)","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Start#alwaysshownotificationicon"],"options":[{"id":"user_vendor_msft_policy_config_start_alwaysshownotificationicon_0","displayName":"Auto-hide notification bell icon","description":"Auto-hide notification bell icon","helpText":null},{"id":"user_vendor_msft_policy_config_start_alwaysshownotificationicon_1","displayName":"Show notification bell icon","description":"Show notification bell icon","helpText":null}]},{"id":"user_vendor_msft_policy_config_start_configurestartpins","displayName":"Configure Start Pins (User)","description":"Allows admin to override the default items pinned to Start.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Start#configurestartpins"],"options":null},{"id":"user_vendor_msft_policy_config_start_disablecontextmenus","displayName":"Disable Context Menus (User)","description":"Enabling this policy prevents context menus from being invoked in the Start Menu.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Start#disablecontextmenus"],"options":[{"id":"user_vendor_msft_policy_config_start_disablecontextmenus_0","displayName":"Disabled","description":"Do not disable.","helpText":null},{"id":"user_vendor_msft_policy_config_start_disablecontextmenus_1","displayName":"Enabled","description":"Disable.","helpText":null}]},{"id":"user_vendor_msft_policy_config_start_forcestartsize","displayName":"Force Start Size (User)","description":"Forces the start screen size. If there is policy configuration conflict, the latest configuration request is applied to the device.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Start#forcestartsize"],"options":[{"id":"user_vendor_msft_policy_config_start_forcestartsize_0","displayName":"Do not force size of Start.","description":"Do not force size of Start.","helpText":null},{"id":"user_vendor_msft_policy_config_start_forcestartsize_1","displayName":"Force non-fullscreen size of Start.","description":"Force non-fullscreen size of Start.","helpText":null},{"id":"user_vendor_msft_policy_config_start_forcestartsize_2","displayName":"Force a fullscreen size of Start.","description":"Force a fullscreen size of Start.","helpText":null}]},{"id":"user_vendor_msft_policy_config_start_hideapplist","displayName":"Hide App List (User)","description":"Setting the value of this policy to 1 or 2 collapses the app list. Setting the value of this policy to 3 removes the app list entirely. Setting the value of this policy to 2 or 3 disables the corresponding toggle in the Settings app.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Start#hideapplist"],"options":[{"id":"user_vendor_msft_policy_config_start_hideapplist_0","displayName":"None.","description":"None.","helpText":null},{"id":"user_vendor_msft_policy_config_start_hideapplist_1","displayName":"Hide all apps list.","description":"Hide all apps list.","helpText":null},{"id":"user_vendor_msft_policy_config_start_hideapplist_2","displayName":"Hide all apps list, and Disable \"Show app list in Start menu\" in Settings app.","description":"Hide all apps list, and Disable \"Show app list in Start menu\" in Settings app.","helpText":null},{"id":"user_vendor_msft_policy_config_start_hideapplist_3","displayName":"Hide all apps list, remove all apps button, and Disable \"Show app list in Start menu\" in Settings app.","description":"Hide all apps list, remove all apps button, and Disable \"Show app list in Start menu\" in Settings app.","helpText":null}]},{"id":"user_vendor_msft_policy_config_start_hidecategoryview","displayName":"Hide Category View (User)","description":"This policy setting allows you to hide the category view in the Start Menu. If you enable this policy setting, the Start Menu will no longer show the category view as an option and will default to grid view.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Start#hidecategoryview"],"options":[{"id":"user_vendor_msft_policy_config_start_hidecategoryview_0","displayName":"Category view shown.","description":"Category view shown.","helpText":null},{"id":"user_vendor_msft_policy_config_start_hidecategoryview_1","displayName":"Category view hidden.","description":"Category view hidden.","helpText":null}]},{"id":"user_vendor_msft_policy_config_start_hidefrequentlyusedapps","displayName":"Hide Frequently Used Apps (User)","description":"Enabling this policy hides the most used apps from appearing on the start menu and disables the corresponding toggle in the Settings app.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Start#hidefrequentlyusedapps"],"options":[{"id":"user_vendor_msft_policy_config_start_hidefrequentlyusedapps_0","displayName":"Disabled","description":"Do not hide.","helpText":null},{"id":"user_vendor_msft_policy_config_start_hidefrequentlyusedapps_1","displayName":"Enabled","description":"Hide.","helpText":null}]},{"id":"user_vendor_msft_policy_config_start_hidepeoplebar","displayName":"Hide People Bar (User)","description":"Enabling this policy removes the people icon from the taskbar as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Start#hidepeoplebar"],"options":[{"id":"user_vendor_msft_policy_config_start_hidepeoplebar_0","displayName":"Disabled","description":"Do not hide.","helpText":null},{"id":"user_vendor_msft_policy_config_start_hidepeoplebar_1","displayName":"Enabled","description":"Hide.","helpText":null}]},{"id":"user_vendor_msft_policy_config_start_hiderecentjumplists","displayName":"Hide Recent Jumplists (User)","description":"Enabling this policy hides recent jumplists from appearing on the start menu/taskbar and disables the corresponding toggle in the Settings app.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Start#hiderecentjumplists"],"options":[{"id":"user_vendor_msft_policy_config_start_hiderecentjumplists_0","displayName":"Disabled","description":"Do not hide.","helpText":null},{"id":"user_vendor_msft_policy_config_start_hiderecentjumplists_1","displayName":"Enabled","description":"Hide.","helpText":null}]},{"id":"user_vendor_msft_policy_config_start_hiderecentlyaddedapps","displayName":"Hide Recently Added Apps (User)","description":"Enabling this policy hides recently added apps from appearing on the start menu and disables the corresponding toggle in the Settings app.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Start#hiderecentlyaddedapps"],"options":[{"id":"user_vendor_msft_policy_config_start_hiderecentlyaddedapps_0","displayName":"Disabled","description":"Do not hide.","helpText":null},{"id":"user_vendor_msft_policy_config_start_hiderecentlyaddedapps_1","displayName":"Enabled","description":"Hide.","helpText":null}]},{"id":"user_vendor_msft_policy_config_start_startlayout","displayName":"Start Layout (User)","description":"Important For more information, see Policy scope. Allows you to override the default Start layout and prevents the user from changing it. If both user and device policies are set, the user policy will be used. Apps pinned to the taskbar can also be changed with this policyFor further details on how to customize the Start layout, please see Customize and export Start layout and Configure Windows 10 taskbar.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Start#startlayout"],"options":null},{"id":"user_vendor_msft_policy_config_start_turnoffabbreviateddatetimeformat","displayName":"Turn Off Abbreviated Date Time Format (User)","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-Start#turnoffabbreviateddatetimeformat"],"options":[{"id":"user_vendor_msft_policy_config_start_turnoffabbreviateddatetimeformat_0","displayName":"Show abbreviated time and date format","description":"Show abbreviated time and date format","helpText":null},{"id":"user_vendor_msft_policy_config_start_turnoffabbreviateddatetimeformat_1","displayName":"Show classic time and date format","description":"Show classic time and date format","helpText":null}]},{"id":"user_vendor_msft_policy_config_system_allowtelemetry","displayName":"Allow Telemetry (User)","description":"Allow the device to send diagnostic and usage telemetry data, such as Watson. For more information about diagnostic data for Windows, including what is and what is not collected by Windows, see Configure Windows diagnostic data in your organization. Note: This value is only applicable to Windows Enterprise, Windows Education, Windows Mobile Enterprise, Windows IoT Core (IoT Core), Windows Server 2016, and Windows CPC OS. The following tables describe the supported values:Windows 8. 1 Values:0 - Not allowed. 1 - Allowed, except for Secondary Data Requests. 2 (default) - Allowed. Windows 10 Values:0 - Security. Information that is required to help keep Windows or Windows CPC OS more secure, including data about the Connected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender. Note: This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows IoT Core (IoT Core), Windows Server 2016, and Windows CPC OS. Using this setting on other devices is equivalent to setting the value of 1. 1 - Basic. Basic device info, including: quality-related data, app compatibility, app usage data, and data from the Security level. 2 - Enhanced. Additional insights, including: how Windows, Windows Server, System Center, Windows CPC OS, and apps are used, how they perform, advanced reliability data, and data from both the Basic and the Security levels. 3 - Full. All data necessary to identify and help to fix problems, plus data from the Security, Basic, and Enhanced levels. Important lf you are using Windows 8. 1 MDM server and set a value of 0 using the legacy AllowTelemetry policy on a Windows 10 Mobile device, then the value is not respected and the telemetry level is silently set to level 1. Most restricted value is 0.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-System#allowtelemetry"],"options":[{"id":"user_vendor_msft_policy_config_system_allowtelemetry_0","displayName":"Security","description":"Security. Information that is required to help keep Windows more secure, including data about the Connected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.\nNote: This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016. Using this setting on other devices is equivalent to setting the value of 1.","helpText":null},{"id":"user_vendor_msft_policy_config_system_allowtelemetry_1","displayName":"Basic","description":"Basic. Basic device info, including: quality-related data, app compatibility, app usage data, and data from the Security level.","helpText":null},{"id":"user_vendor_msft_policy_config_system_allowtelemetry_3","displayName":"Full","description":"Full. All data necessary to identify and help to fix problems, plus data from the Security, Basic, and Enhanced levels.","helpText":null}]},{"id":"user_vendor_msft_policy_config_teamsv2~policy~l_teams_teams_preventfirstlaunchafterinstall_policy","displayName":"Prevent Microsoft Teams from starting automatically after installation (User)","description":"This policy setting controls whether Microsoft Teams starts automatically when the user logs into a device after Teams is installed.\r\n\r\nIf you enable this policy setting, Teams does not start automatically when the user logs in to the device and the user has not started Teams previously.\r\n\r\nNote: If you enable this policy setting, you must do so before Teams is installed.\r\n\r\nOnce a user starts Teams for the first time, Teams is configured to start automatically the next time the user logs into the device.\r\n\r\nIf you disable or don’t configure this policy setting, Teams automatically starts when a user logs in to the device after Teams is installed.\r\n\r\nNote: The user can configure Teams not to start automatically by configuring user settings within Teams.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_teamsv2~policy~l_teams_teams_preventfirstlaunchafterinstall_policy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_teamsv2~policy~l_teams_teams_preventfirstlaunchafterinstall_policy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_teamsv3~policy~l_teams_string_teams_signinrestriction_policy","displayName":"Restrict sign in to Teams to accounts in specific tenants (User)","description":"This policy setting allows you to control the accounts that can be used in Teams on managed devices running Windows. \r\n\r\nIf you enable this policy setting, users will only be allowed to sign in with accounts from Azure Active Directory (Azure AD) tenants that you specify. You can enter a comma separated list of tenant IDs. \r\n \r\nThe policy setting applies to all ways that the user signs in, including first and additional accounts on versions of Teams that support multiple accounts side by side. \r\n\r\nThe policy setting is also enforced when users sign out and sign back in. \r\n\r\nIf you disable or don't configure this policy setting, Teams will continue to allow users to sign in with work or school accounts, or personal Microsoft accounts. \r\n\r\nImportant: This policy setting only restricts which users can sign in. It does not restrict the ability for users to be invited as a guest in other Azure AD tenants, or switch to tenants they were invited to.\r\n\r\nNote: This policy does not apply to Teams web app.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_teamsv3~policy~l_teams_string_teams_signinrestriction_policy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_teamsv3~policy~l_teams_string_teams_signinrestriction_policy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_teamsv3~policy~l_teams_string_teams_signinrestriction_policy_restrictteamssignintoaccountsfromtenantlist","displayName":"Tenant IDs: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_timelanguagesettings_restrictlanguagepacksandfeaturesinstall","displayName":"Restrict Language Packs And Features Install (User)","description":"This policy setting restricts the install of language packs and language features, such as spell checkers, on a device.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-TimeLanguageSettings#restrictlanguagepacksandfeaturesinstall"],"options":[{"id":"user_vendor_msft_policy_config_timelanguagesettings_restrictlanguagepacksandfeaturesinstall_0","displayName":"Disabled","description":"Not restricted.","helpText":null},{"id":"user_vendor_msft_policy_config_timelanguagesettings_restrictlanguagepacksandfeaturesinstall_1","displayName":"Enabled","description":"Restricted.","helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_customizableerrormessages_l_listoferrormessagestocustomize","displayName":"List of error messages to customize (User)","description":"Defines a list of custom error messages to activate.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_customizableerrormessages_l_listoferrormessagestocustomize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_customizableerrormessages_l_listoferrormessagestocustomize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_customizableerrormessages_l_listoferrormessagestocustomize_l_listoferrormessagestocustomize98","displayName":"List of error messages to customize (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_customizableerrormessages_l_listoferrormessagestocustomize_l_listoferrormessagestocustomize98_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_customizableerrormessages_l_listoferrormessagestocustomize_l_listoferrormessagestocustomize98_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems1","displayName":"Disable commands (User)","description":"This policy setting allows you to disable any command bar button and menu item with a command bar ID, including command bar buttons and menu items that are not in the predefined lists.\r\n\r\nIf you enable this policy setting, you can enter an ID number to disable a specific command bar button or menu item. The ID number needs to be in decimal (not hexadecimal). Multiple values should be separated by commas.\r\n\r\nIf you disable or do not configure this policy setting, all default command bar buttons or menu items are available to users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems1_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems1_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems1_l_enteracommandbaridtodisable","displayName":"Enter a command bar ID to disable (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys100","displayName":"Disable shortcut keys (User)","description":"Specify the virtual key code and modifier for the shortcut key to disable.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys100_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys100_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys100_l_enterakeyandmodifiertodisable","displayName":"Enter a key and modifier to disable (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems","displayName":"Disable commands (User)","description":"Specify command bar buttons and menu items to disable.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filesendtomailrecipient","displayName":"File Tab | Share | Email (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filesendtomailrecipient_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filesendtomailrecipient_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_inserthyperlink","displayName":"Insert tab | Hyperlink (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_inserthyperlink_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_inserthyperlink_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrosmacros","displayName":"Developer tab | Macros (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrosmacros_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrosmacros_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrosvisualbasiceditor","displayName":"Developer tab | Visual Basic (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrosvisualbasiceditor_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrosvisualbasiceditor_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_visiooptions99","displayName":"File tab | Options (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_visiooptions99_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_visiooptions99_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_blockallunmanagedaddins","displayName":"Block all unmanaged add-ins (User)","description":"This policy setting blocks all add-ins that are not managed by the \"List of managed add-ins\" policy setting.\r\n\r\nIf you enable this policy setting, and the \"List of managed add-ins\" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the \"List of managed add-ins\" policy setting.\r\n\r\nIf you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the \"List of managed add-ins\" policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_blockallunmanagedaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_blockallunmanagedaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_defaultbuiltintab","displayName":"Default tab to show in Visio on the Office Start screen and in File | New (User)","description":"This policy setting controls what displays as the default tab in Visio on the Office Start screen and in File | New. \r\n\r\nIf you enable this policy setting, you can choose one of two options to become the default tab on the Office Start screen and in File | New:\r\n\r\n* Built-in – Users will the see built-in templates tab as the default tab in Visio on the Office Start screen and in File | New.\r\n\r\n* Custom – Users will the see custom templates tab as the default tab in Visio on the Office Start screen and in File | New when templates exist (this can include Custom XML programmed templates, templates in the Workgroup templates path, templates in the Personal templates path, or SharePoint templates).\r\n\r\nIf you disable or do not configure this policy setting, users will see the Featured templates tab as the default tab in Visio on the Office Start screen and in File | New","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_defaultbuiltintab_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_defaultbuiltintab_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_defaultbuiltintab_l_defaultbuiltintab","displayName":"Default tab (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_defaultbuiltintab_l_defaultbuiltintab_0","displayName":"Featured","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_defaultbuiltintab_l_defaultbuiltintab_2","displayName":"Built-in","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_defaultbuiltintab_l_defaultbuiltintab_1","displayName":"Custom","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_disableofficestartvisio","displayName":"Disable the Office Start screen for Visio (User)","description":"This policy setting controls whether the Office Start screen appears on boot for Visio.\r\n\r\nIf you enable this policy setting, users will not see the Office Start screen when they boot Visio.\r\n\r\nIf you disable or do not configure this policy setting, users will see the Office Start screen when they boot Visio.\r\n\r\nNote: This policy setting is overridden by the policy setting \"Microsoft Office 2016 > Miscellaneous > Disable the Office Start screen for all Office applications\" if that policy setting is set.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_disableofficestartvisio_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_disableofficestartvisio_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_emailmessageforsendtocommands","displayName":"Email message for 'Send To' commands (User)","description":"Command in the Send To submenu of the File menu.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_emailmessageforsendtocommands_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_emailmessageforsendtocommands_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_emailmessageforsendtocommands_l_emailmessageforsendtocommands101","displayName":"Email message for 'Send To' commands (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_listofmanagedaddins","displayName":"List of managed add-ins (User)","description":"This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the \"Block all unmanaged add-ins\" policy setting.\r\n\r\nTo enable this policy setting, provide the following information for each add-in:\r\n\r\nIn \"Value name,\" specify the programmatic identifier (ProgID) for COM add-ins.\r\n\r\nTo obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Visio\\Addins or HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Visio\\Addins.\r\n\r\nYou can also obtain the ProgID of an add-in by using Office Telemetry Dashboard.\r\n\r\nIn \"Value,\" specify the value as follows:\r\n\r\nTo specify that an add-in is always disabled (blocked), type 0.\r\n\r\nTo specify that an add-in is always enabled, type 1.\r\n\r\nTo specify that an add-in is configurable by the user and not blocked by the \"Block all unmanaged add-ins\" policy setting when enabled, type 2.\r\n\r\nIf you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the \"Block all unmanaged add-ins\" policy setting is enabled, then all add-ins are blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_listofmanagedaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_listofmanagedaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_listofmanagedaddins_l_listofmanagedaddins2","displayName":"List of managed add-ins (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_listofmanagedaddins_l_listofmanagedaddins2_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_listofmanagedaddins_l_listofmanagedaddins2_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_personaltemplatespath","displayName":"Personal templates path for Visio (User)","description":"This policy setting specifies the location of a user's personal templates. \r\n\r\nIf you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. \r\n\r\nIf you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_personaltemplatespath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_personaltemplatespath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_miscellaneous_l_personaltemplatespath_l_personaltemplatespath","displayName":"Personal templates path (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_alwaysoffermetricandusunitsfornewblankdrawings","displayName":"Always offer 'Metric' and 'US units' for new blank drawings and stencils (User)","description":"This policy setting will allow the showing of both US Units and Metric Units when you create a new blank drawing or stencil.\r\n\r\nIf you enable this policy setting, both US Units and Metric Units are shown as a choice before you create a new blank drawing or stencil. These drawings open with the appropriate rulers and page setup and use the appropriate units for the drawing tools. This does not install the templates and stencils in both unit types. This policy setting is always enabled whenever the Developer Tab is turned on.\r\n\r\nIf you disable or do not configure this policy setting, you are not shown a choice between units when creating a blank drawing or stencil if templates and stencils of only one type of unit are installed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_alwaysoffermetricandusunitsfornewblankdrawings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_alwaysoffermetricandusunitsfornewblankdrawings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_angle","displayName":"Angle (User)","description":"Specifies the unit of measure for the angle of rotation.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_angle_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_angle_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_angle_l_angle8","displayName":"Angle (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_angle_l_angle8_81","displayName":"Degrees","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_angle_l_angle8_82","displayName":"Deg-Min-Sec","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_angle_l_angle8_84","displayName":"Min-Sec","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_angle_l_angle8_85","displayName":"Seconds","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_angle_l_angle8_83","displayName":"Radians","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_duration","displayName":"Duration (User)","description":"Specifies the unit of measure for duration, which is elapsed time as compared to a specific date or a given hour.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_duration_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_duration_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_duration_l_duration9","displayName":"Duration (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_duration_l_duration9_43","displayName":"Weeks","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_duration_l_duration9_44","displayName":"Days","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_duration_l_duration9_45","displayName":"Hours","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_duration_l_duration9_46","displayName":"Minutes","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_duration_l_duration9_47","displayName":"Seconds","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_preventshowingnewscreenonlaunch","displayName":"Prevent showing New screen on launch (User)","description":"This policy setting allows you to prevent the New screen to be shown on launch of Visio.\r\n\r\nIf you enable this policy setting, the New screen will not be shown on launch.\r\n\r\nIf you disable or do not configure this policy setting, the New screen, including a catalog of templates, is shown when you open Visio.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_preventshowingnewscreenonlaunch_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_preventshowingnewscreenonlaunch_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_recentlyusedfilelist","displayName":"Number of entries in the Recent Drawings list (User)","description":"This policy setting specifies the number of entries displayed in the Recent Drawings list that appears when users click Open on the File tab in Backstage view. \r\n\r\nIf you enable this policy setting, you can specify the number of entries to be between 0 and 50. If you set the number to 0, all pinned and unpinned entries are hidden.\r\n\r\nIf you disable or do not configure this policy setting, a maximum of 25 items will be displayed in the Recent Drawings list.\r\n\r\nNote: If you want to prevent items from being added to the Recent Drawings list entirely, you can enable the \"Do not keep history of recently opened documents\" Windows policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_recentlyusedfilelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_recentlyusedfilelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_recentlyusedfilelist_l_numberofentries","displayName":"Number of entries: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_setnumberofplacesintherecentplaceslist","displayName":"Number of folders in the Recent Folders list (User)","description":"This policy setting specifies the number of unpinned entries displayed in the Recent Folders list that appears when users click Open or Save As on the File tab in Backstage view.\r\n\r\nIf you enable this policy setting, you can specify the number of unpinned entries to be between 0 and 20. If you set the number to 0, all pinned and unpinned entries are hidden.\r\n\r\nIf you disable or do not configure this policy setting, a maximum of 5 unpinned items are displayed in the Recent Folders list.\r\n\r\nNote: If you want to prevent items from being added to the Recent Folders list entirely, you can enable the \"Do not keep history of recently opened documents\" Windows policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_setnumberofplacesintherecentplaceslist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_setnumberofplacesintherecentplaceslist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_setnumberofplacesintherecentplaceslist_l_setnumberofplacesintherecentplaceslistspinid","displayName":"Number of folders: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_smarttags","displayName":"Actions (User)","description":"Shows additional actions if you hover over them in the drawing.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_smarttags_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_smarttags_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_specifyscreentipstoappear","displayName":"Specify ScreenTips to appear (User)","description":"This policy setting allows you to specify what ScreenTips appear in Visio to help you identify and use various features, including drawing window rulers, control handles, and ShapeSheet cells.\r\n\r\nIf you enable this policy setting, you may specify one or more other ScreenTips that will appear for:\r\n- Drawing\r\n- Dialogs\r\n- Rulers\r\n- ShapeSheet\r\n\r\nIf you disable or do not configure this policy setting, no ScreenTips will appear for the options listed above.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_specifyscreentipstoappear_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_specifyscreentipstoappear_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_specifyscreentipstoappear_l_specifyscreentipstoappearboolid1","displayName":"Drawing (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_specifyscreentipstoappear_l_specifyscreentipstoappearboolid1_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_specifyscreentipstoappear_l_specifyscreentipstoappearboolid1_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_specifyscreentipstoappear_l_specifyscreentipstoappearboolid2","displayName":"Dialogs (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_specifyscreentipstoappear_l_specifyscreentipstoappearboolid2_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_specifyscreentipstoappear_l_specifyscreentipstoappearboolid2_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_specifyscreentipstoappear_l_specifyscreentipstoappearboolid3","displayName":"Rulers (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_specifyscreentipstoappear_l_specifyscreentipstoappearboolid3_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_specifyscreentipstoappear_l_specifyscreentipstoappearboolid3_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_specifyscreentipstoappear_l_specifyscreentipstoappearboolid4","displayName":"Shapesheet (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_specifyscreentipstoappear_l_specifyscreentipstoappearboolid4_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_specifyscreentipstoappear_l_specifyscreentipstoappearboolid4_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_stencilwindowscreentips","displayName":"Stencil window ScreenTips (User)","description":"Specifies whether ScreenTips (ScreenTips: Tips that appear when you pause the pointer over certain elements in the Visio program, including: masters on stencils, toolbar buttons, and the ruler) appear in Visio to help you identify shapes in the stencil window.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_stencilwindowscreentips_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_stencilwindowscreentips_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_text","displayName":"Text (User)","description":"Specifies the unit of measure for indents, line spacing and other text measurements. The default unit for type size is points (1 point = 1/72 in.). You can enter type size in another unit of measure (for example, 1ft or 12 in) but you can't change the default.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_text_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_text_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_text_l_text7","displayName":"Text (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_text_l_text7_51","displayName":"Picas","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_text_l_text7_50","displayName":"Points","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_text_l_text7_54","displayName":"Ciceros","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_display_l_text_l_text7_53","displayName":"Didots","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_centerselectiononzoom","displayName":"Center selection on zoom (User)","description":"Specifies that when you zoom in, whatever shape was selected appears in the center of the window.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_centerselectiononzoom_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_centerselectiononzoom_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_enableautoconnect","displayName":"Enable AutoConnect (User)","description":"Sets the value in the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_enableautoconnect_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_enableautoconnect_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_enablelivedynamics","displayName":"Enable live dynamics (User)","description":"When you resize or rotate a shape, you can see the shape as it is being transformed, instead of just seeing the bounding box until the action is complete","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_enablelivedynamics_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_enablelivedynamics_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_enalbeconnectorsplitting","displayName":"Enable connector splitting (User)","description":"When you place a shape on the line of a connector, it splits and each piece becomes a separate connector glued to the shape. Not all drawing types support connector splitting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_enalbeconnectorsplitting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_enalbeconnectorsplitting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_selectshapespartiallywithinarea","displayName":"Select shapes partially within area (User)","description":"If you select shapes by using a selection net(dragging a box around shapes on the drawing page), you can change the selection settings to also include shapes that are partially within the selection net.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_selectshapespartiallywithinarea_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_selectshapespartiallywithinarea_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_showmorehandles","displayName":"Show more handles on hover (User)","description":"This policy setting allows you to show more shape handles when hovering over a selected shape.\r\n\r\nIf you enable this policy setting, more shape handles will be shown after a brief delay.\r\n\r\nIf you disable or do not configure this policy setting, more shape handles will not be shown.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_showmorehandles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_showmorehandles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_turnoffshapesheetformulaautocomplete","displayName":"Turn off ShapeSheet Formula AutoComplete (User)","description":"This policy setting allows you to configure ShapeSheet Formula AutoComplete.\r\n\r\nIf you enable this policy setting, ShapeSheet Formula AutoComplete is turned off.\r\n\r\nIf you disable or do not configure this policy setting, ShapeSheet Formula AutoComplete is turned on.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_turnoffshapesheetformulaautocomplete_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_turnoffshapesheetformulaautocomplete_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_turnoffsmartdeletebehaviorofconnectorswhendeletingshapes","displayName":"Turn off smart delete behavior of connectors when deleting shapes (User)","description":"This policy setting turns off smart delete behavior of connectors when deleting shapes.\r\n\r\nIf you enable this policy setting, connectors are not deleted when shapes are deleted.\r\n\r\nIf you disable or do not configure this policy setting, connectors are deleted when shapes are deleted.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_turnoffsmartdeletebehaviorofconnectorswhendeletingshapes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_turnoffsmartdeletebehaviorofconnectorswhendeletingshapes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_turnofftransitions","displayName":"Turn off transitions (User)","description":"This policy setting allows you to configure transitions, which are smooth animation effects.\r\n\r\nIf you enable this policy setting, transitions are turned off.\r\n\r\nIf you disable or do not configure this policy setting, transitions are turned on.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_turnofftransitions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_turnofftransitions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_zoomonrollwithintellimouse","displayName":"Zoom on roll with IntelliMouse (User)","description":"If selected, lets you zoom in or out from a drawing by rolling the wheel of the Microsoft Intellimouse","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_zoomonrollwithintellimouse_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_editingoptions_l_zoomonrollwithintellimouse_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_addons","displayName":"Add-ons (User)","description":"Displays the additional location of macros and add-ons.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_addons_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_addons_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_addons_l_addonscolon","displayName":"Add-ons: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_drawings","displayName":"Drawings (User)","description":"Displays the additional location of drawings. When you add a location here, it becomes the default save location.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_drawings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_drawings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_drawings_l_drawingscolon","displayName":"Drawings: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_favoritesstencilname","displayName":"Favorites Stencil Name (User)","description":"Displays the name of the stencil created in the My Shapes folder that contains a user's favorite shapes.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_favoritesstencilname_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_favoritesstencilname_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_favoritesstencilname_l_favoritesstencilnamecolon","displayName":"Favorites Stencil Name: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_help","displayName":"Help (User)","description":"Displays the additional location of Help files.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_help_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_help_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_help_l_helpcolon","displayName":"Help: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_myshapes","displayName":"My Shapes (User)","description":"Displays the path of the My Shapes folder.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_myshapes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_myshapes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_myshapes_l_myshapescolon","displayName":"My Shapes: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_startup","displayName":"Start-up (User)","description":"Displays the additional location for macros and add-ons opened when you start Visio.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_startup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_startup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_startup_l_startupcolon","displayName":"Start-up: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_stencils","displayName":"Stencils (User)","description":"Displays the additional location of stencils. When a location is added here, stencils in this location are listed on the Shapes submenu from the file menu.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_stencils_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_stencils_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_stencils_l_stencilscolon","displayName":"Stencils: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_templates","displayName":"Templates (User)","description":"This policy setting allows you to specify the additional location of templates.\r\n\r\nIf you enable this policy setting, you may specify the additional location of templates. These locations are listed on the New screen of the File tab.\r\n\r\nIf you disable or do not configure this policy setting, no additional location of templates is shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_templates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_templates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_filelocations_l_templates_l_templatescolon","displayName":"Templates: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_generaloptions_l_enableautomationevents","displayName":"Enable Automation events (User)","description":"Enables Visio events to be sent to Visio add-ons and VBA macros. If cleared, disables all Visio events. If you clear this option, some drawing types in Visio that rely on Automation events may not have full functionality.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_generaloptions_l_enableautomationevents_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_generaloptions_l_enableautomationevents_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_generaloptions_l_openeachshapesheetinthesamewindow","displayName":"Open each ShapeSheet in the same window (User)","description":"Opens multiple ShapeSheets in the same window rather than displaying each ShapeSheet in its own window.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_generaloptions_l_openeachshapesheetinthesamewindow_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_generaloptions_l_openeachshapesheetinthesamewindow_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_generaloptions_l_putallsettingsinwindowsregistry","displayName":"Put all settings in Windows registry (User)","description":"Adds all possible application settings into the Windows registry. By default, only certain settings are added (non-default settings and very few others, such as file paths, import and export filters, and last files) to keep the registry settings simple.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_generaloptions_l_putallsettingsinwindowsregistry_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_generaloptions_l_putallsettingsinwindowsregistry_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_saveopen_l_languageforfileconversion4","displayName":"Language for file conversion (User)","description":"This policy setting specifies how Visio determines what language to use when converting to or from an earlier version of Visio. \r\n\r\nIf you enable this policy setting, you may select from one of these options:\r\n\r\n- Let Visio decide language\r\n- Prompt for language\r\n- Use the following language: You must specify the numeric Microsoft Locale ID (LCID) for that language.\r\n\r\nIf you disable or do not configure this policy setting, Visio decides what language to use.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_saveopen_l_languageforfileconversion4_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_saveopen_l_languageforfileconversion4_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_saveopen_l_languageforfileconversion4_l_languageforfileconversion5","displayName":"Language for file conversion (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_saveopen_l_languageforfileconversion4_l_languageforfileconversion5_0","displayName":"Let Visio decide language","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_saveopen_l_languageforfileconversion4_l_languageforfileconversion5_1","displayName":"Prompt for language","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_saveopen_l_languageforfileconversion4_l_languageforfileconversion5_2","displayName":"Use the following language","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_saveopen_l_languageforfileconversion4_l_uselanguage","displayName":"Use language: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_saveopen_l_showfileopenwarnings","displayName":"Show file open warnings (User)","description":"Indicates whether a warning message is displayed when you open files that contain errors such as invalid XML code.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_saveopen_l_showfileopenwarnings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_saveopen_l_showfileopenwarnings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_saveopen_l_showfilesavewarnings","displayName":"Show file save warnings (User)","description":"Indicates whether a warning message is displayed when you save files that contain errors such as invalid XML code.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_saveopen_l_showfilesavewarnings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_saveopen_l_showfilesavewarnings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_shapesearch_l_openresultsnewwindow","displayName":"Open results new window (User)","description":"Indicates whether a new search results stencil is created for every search. If cleared, the results of a search replace the results of any previous search.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_shapesearch_l_openresultsnewwindow_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_shapesearch_l_openresultsnewwindow_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_shapesearch_l_searchfor","displayName":"Search for: (User)","description":"Sets the value in the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_shapesearch_l_searchfor_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_shapesearch_l_searchfor_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_shapesearch_l_searchfor_l_searchfor10","displayName":"Search for: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_shapesearch_l_searchfor_l_searchfor10_1","displayName":"All of the words (AND)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_shapesearch_l_searchfor_l_searchfor10_0","displayName":"Any of the words (OR)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_shapesearch_l_searchresults","displayName":"Search results (User)","description":"Specifies whether results are returned in alphabetical order by shape name or by stencil name (group). Click By Group to help distinguish between shapes that have the same name but appear on different stencils. Selecting this option is also useful if you want to locate the stencil containing the shape.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_shapesearch_l_searchresults_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_shapesearch_l_searchresults_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_shapesearch_l_searchresults_l_searchresults11","displayName":"Search results (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_shapesearch_l_searchresults_l_searchresults11_0","displayName":"Alphabetically","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_shapesearch_l_searchresults_l_searchresults11_1","displayName":"By Group","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_shapesearch_l_showshapesearchpane","displayName":"Show Shape Search pane (User)","description":"Displays the shape search user interface elements of the stencil window.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_shapesearch_l_showshapesearchpane_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_advanced~l_shapesearch_l_showshapesearchpane_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_general~l_userinterfaceoptions_l_donotshowminitoolbaronselectionoftext","displayName":"Do not show Mini Toolbar on selection of text (User)","description":"This policy setting allows you to configure the Mini Toolbar on selection of text.\r\n\r\nIf you enable this policy setting, the Mini Toolbar is not shown on selection.\r\n\r\nIf you disable or do not configure this policy setting, the Mini Toolbar is shown on selection.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_general~l_userinterfaceoptions_l_donotshowminitoolbaronselectionoftext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_general~l_userinterfaceoptions_l_donotshowminitoolbaronselectionoftext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_general~l_userinterfaceoptions_l_turnofflivepreview","displayName":"Turn off Live Preview (User)","description":"This policy setting allows you to configure Live Preview, which shows a preview of how a feature affects the document as you hover over different choices.\r\n\r\nIf you enable this policy setting, Live Preview is turned off.\r\n\r\nIf you disable or do not configure this policy setting, Live Preview is turned on.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_general~l_userinterfaceoptions_l_turnofflivepreview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_general~l_userinterfaceoptions_l_turnofflivepreview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_general~l_userinterfaceoptions_l_turnofflivepreviewintheshapeswindow","displayName":"Turn off Live Preview in the Shapes window (User)","description":"This policy setting turns off the Live Preview in the Shapes window feature, which shows shapes in the Shapes window with the detail and color depth they will have in a drawing, including theme colors and effects.\r\n\r\nIf you enable this policy setting, Live Preview in the Shapes Window is turned off.\r\n\r\nIf you disable or do not configure this policy setting, Live Preview in the Shapes Window is turned on.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_general~l_userinterfaceoptions_l_turnofflivepreviewintheshapeswindow_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_general~l_userinterfaceoptions_l_turnofflivepreviewintheshapeswindow_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_optionscustomizeribbon_l_displaydevelopertab","displayName":"Display Developer tab in the Ribbon (User)","description":"This policy setting controls whether the Developer tab will be displayed in the Ribbon.\r\n\r\nIf you enable this policy setting, the Developer tab will be displayed in the Ribbon.\r\n\r\nIf you disable this policy setting, the Developer tab will not be displayed in the Ribbon.\r\n\r\nIf you do not configure this policy setting, the Developer tab will not be displayed in the Ribbon, but its visibility can be changed via a setting in the application Options dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_optionscustomizeribbon_l_displaydevelopertab_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_optionscustomizeribbon_l_displaydevelopertab_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_proofing~l_autocorrectoptions_l_fractionswithfractioncharacter","displayName":"Fractions with fraction character (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_proofing~l_autocorrectoptions_l_fractionswithfractioncharacter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_proofing~l_autocorrectoptions_l_fractionswithfractioncharacter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_proofing~l_autocorrectoptions_l_hyphenswithdash","displayName":"Hyphens with dash (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_proofing~l_autocorrectoptions_l_hyphenswithdash_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_proofing~l_autocorrectoptions_l_hyphenswithdash_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_proofing~l_autocorrectoptions_l_ordinalswithsuperscript","displayName":"Ordinals with superscript (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_proofing~l_autocorrectoptions_l_ordinalswithsuperscript_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_proofing~l_autocorrectoptions_l_ordinalswithsuperscript_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_proofing~l_autocorrectoptions_l_smileyfacesandarrowswithspecialsymbols","displayName":"Smiley faces and arrows with special symbols (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_proofing~l_autocorrectoptions_l_smileyfacesandarrowswithspecialsymbols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_proofing~l_autocorrectoptions_l_smileyfacesandarrowswithspecialsymbols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_proofing~l_autocorrectoptions_l_straightquoteswithsmartquotes","displayName":"Straight quotes with smart quotes (User)","description":"Checks/Unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_proofing~l_autocorrectoptions_l_straightquoteswithsmartquotes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_proofing~l_autocorrectoptions_l_straightquoteswithsmartquotes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save_l_turnoffcaddwgfunctionality","displayName":"Turn off CAD/DWG functionality (User)","description":"This policy setting allows you to turn off all entry points related to CAD/DWG files.\r\n\r\nIf you enable this policy setting, CAD/DWG functionality will be turned off.\r\n\r\nIf you disable or do not configure this policy setting, CAD/DWG functionality will be turned on.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save_l_turnoffcaddwgfunctionality_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save_l_turnoffcaddwgfunctionality_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save~l_offlineediting_l_savecheckedoutfilesto","displayName":"Save checked-out files to (User)","description":"This policy setting allows you to choose if checked-out files are saved to the server drafts location or the web server. \r\n\r\nIf you enable this policy setting, you can choose where checked-out files are saved:\r\n- Server drafts location: The server drafts location on this computer\r\n- Web server: The web server\r\n\r\nIf you disable or do not configure this policy setting, checked-out files are stored in the server drafts location.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save~l_offlineediting_l_savecheckedoutfilesto_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save~l_offlineediting_l_savecheckedoutfilesto_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save~l_offlineediting_l_savecheckedoutfilesto_l_savecheckedoutfilestodropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save~l_offlineediting_l_savecheckedoutfilesto_l_savecheckedoutfilestodropid_1","displayName":"Server drafts location","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save~l_offlineediting_l_savecheckedoutfilesto_l_savecheckedoutfilestodropid_0","displayName":"Web server","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save~l_savedocuments_l_promptfordocumentpropertiesonfirstsave","displayName":"Prompt for document properties on first save (User)","description":"Indicates whether the properties dialog box opens when a file is saved for the first time. File properties include author name and information such as the status of the file, preview settings and other properties.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save~l_savedocuments_l_promptfordocumentpropertiesonfirstsave_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save~l_savedocuments_l_promptfordocumentpropertiesonfirstsave_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save~l_savedocuments_l_savevisiofilesas","displayName":"Save Visio files as (User)","description":"Identifies the default file format in which Visio files are saved.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save~l_savedocuments_l_savevisiofilesas_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save~l_savedocuments_l_savevisiofilesas_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save~l_savedocuments_l_savevisiofilesas_l_savevisiofilesas6","displayName":"Save Visio files as (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save~l_savedocuments_l_savevisiofilesas_l_savevisiofilesas6_0","displayName":"Visio Document","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save~l_savedocuments_l_savevisiofilesas_l_savevisiofilesas6_3","displayName":"Visio Macro-Enabled Document","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_save~l_savedocuments_l_savevisiofilesas_l_savevisiofilesas6_1","displayName":"Visio 2003-2016 Document","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_macrosecurity_l_enablemicrosoftvisualbasicforapplicationsproject","displayName":"Enable Microsoft Visual Basic for Applications project creation (User)","description":"Enables creations of VBA projects when you open (or create) a document that does not already contain a project. If you clear this check box, you will not be able to create a macro in a document that does not already contain a project.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_macrosecurity_l_enablemicrosoftvisualbasicforapplicationsproject_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_macrosecurity_l_enablemicrosoftvisualbasicforapplicationsproject_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_macrosecurity_l_loadmicrosoftvisualbasicforapplicationsprojectsf","displayName":"Load Microsoft Visual Basic for Applications projects from text (User)","description":"If you want to be able to have your VBA project work in drawings created in other versions of Visio, select this option so that your VBA project is compiled when the file is loaded, but the compiled project is never saved.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_macrosecurity_l_loadmicrosoftvisualbasicforapplicationsprojectsf_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_macrosecurity_l_loadmicrosoftvisualbasicforapplicationsprojectsf_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_allowtrustedlocationsonthenetwork","displayName":"Allow Trusted Locations on the network (User)","description":"This policy setting controls whether trusted locations on the network can be used.\r\n\r\nIf you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the \"Add new location\" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.\r\n\r\nIf you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. \r\n\r\nIf you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.\r\n\r\nDisabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center. We recommended that you do not enable this policy setting (as the \"Allow Trusted Locations on my network (not recommended)\" check box also states). Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.\r\n\r\nIf you do not enable this policy setting, users can select the \"Allow Trusted Locations on my network (not recommended)\" check box if desired and then specify trusted locations by clicking the \"Add new location\" button.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_allowtrustedlocationsonthenetwork_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_allowtrustedlocationsonthenetwork_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_blockmacroexecutionfrominternet","displayName":"Block macros from running in Office files from the Internet (User)","description":"\r\n This policy setting allows you to block macros from running in Office files that come from the Internet.\r\n\r\n If you enable this policy setting, macros are blocked from running, even if “Enable all macros” is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to “Enable Content,” users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run.\r\n\r\n If you disable or don’t configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_blockmacroexecutionfrominternet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_blockmacroexecutionfrominternet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_disableallapplicationextensions","displayName":"Disable all application add-ins (User)","description":"This policy setting disables all add-ins for the specified Office 2016 applications.\r\n \r\nIf you enable this policy setting, all add-ins for the specified Office 2016 applications are disabled.\r\n\r\nIf you disable or do not configure this policy setting, all add-ins for the specified Office 2016 applications are allowed to run without notifying the users, except if application add-ins are required to be signed by Trusted Publishers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_disableallapplicationextensions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_disableallapplicationextensions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned","displayName":"Disable Trust Bar Notification for unsigned application add-ins and block them (User) (Deprecated)","description":"This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the \"Require that application add-ins are signed by Trusted Publisher\" policy setting, which prevents users from changing this policy setting.\r\n\r\nIf you enable this policy setting, applications automatically disable unsigned add-ins without informing users.\r\n \r\nIf you disable this policy setting, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.\r\n\r\nIf you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the \"Add-ins\" category of the Trust Center for the application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_v2","displayName":"Disable Trust Bar Notification for unsigned application add-ins and block them (User)","description":"This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the \"Require that application add-ins are signed by Trusted Publisher\" policy setting, which prevents users from changing this policy setting.\r\n\r\nIf you enable this policy setting, applications automatically disable unsigned add-ins without informing users.\r\n \r\nIf you disable this policy setting, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.\r\n\r\nIf you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the \"Add-ins\" category of the Trust Center for the application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_disabletrustedloc","displayName":"Disable all trusted locations (User)","description":"This policy setting allows administrators to disable all trusted locations in the 2016 versions of the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data.\r\n \r\nIf you enable this policy setting, all trusted locations (those specified in the Trust Center) in the 2016 versions of the specified applications are ignored, including any trusted locations established by Office during setup, deployed to users using Group Policy, or added by users themselves. Users will be prompted again when opening files from trusted locations.\r\n\r\nIf you disable or do not configure this policy setting, all trusted locations (those specified in the Trust Center) in the 2016 versions of the specified applications are assumed to be safe.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_disabletrustedloc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_disabletrustedloc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_requirethatapplicationextensionsaresigned","displayName":"Require that application add-ins are signed by Trusted Publisher (User)","description":"This policy setting controls whether add-ins for this applications must be digitally signed by a trusted publisher.\r\n \r\nIf you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2016 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Office 2016 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2016, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.\r\n\r\nIf you disable or do not configure this policy setting, this application does not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_requirethatapplicationextensionsaresigned_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_requirethatapplicationextensionsaresigned_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_setmaximumnumberoftrusteddocuments","displayName":"Set maximum number of trusted documents (User)","description":"This policy setting allows you to specify the maximum number of trust records for trusted documents that can be stored in the registry before the purge task runs. The purge task reduces the number of trusted documents stored in the registry to the value set by the \"Set maximum number of trust records to preserve\" policy setting.\r\n\r\nIf you enable this policy setting, you can specify the maximum number of trusted documents to be stored in the registry before the purge task runs, with an upper limit of 20,000 documents. For performance reasons, we do not recommend setting this policy setting to the upper limit.\r\n\r\nIf you disable or do not configure this policy setting, the default value of 500 is used for the maximum number of trusted documents that can be stored in the registry before the purge task runs.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_setmaximumnumberoftrusteddocuments_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_setmaximumnumberoftrusteddocuments_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_setmaximumnumberoftrusteddocuments_l_setmaximumnumberoftrusteddocumentsspinid","displayName":"Maximum number: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_setmaximumnumberoftrustrecordstopreserve","displayName":"Set maximum number of trust records to preserve (User)","description":"This policy setting allows you to specify the maximum number of trust records to preserve when the purge task detects that this application has trusted more than the number of trusted documents set by the \"Set maximum number of trusted documents\" policy setting.\r\n\r\nIf you enable this policy setting, you may specify the maximum number of trust records to preserve, with an upper limit of 20000. Due to performance reasons, it is not recommended to set it to the upper limit.\r\n\r\nIf you disable or you do not configure this policy setting, the default value for of 400 is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_setmaximumnumberoftrustrecordstopreserve_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_setmaximumnumberoftrustrecordstopreserve_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_setmaximumnumberoftrustrecordstopreserve_l_setmaximumnumberoftrustrecordstopreservespinid","displayName":"Maximum to preserve: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc01","displayName":"Trusted Location #1 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc01_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc01_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc01_l_allowsubfolders","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc01_l_allowsubfolders_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc01_l_allowsubfolders_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc01_l_datecolon","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc01_l_descriptioncolon","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc01_l_pathcolon","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc02","displayName":"Trusted Location #2 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc02_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc02_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc02_l_allowsubfolders15","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc02_l_allowsubfolders15_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc02_l_allowsubfolders15_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc02_l_datecolon13","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc02_l_descriptioncolon14","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc02_l_pathcolon12","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc03","displayName":"Trusted Location #3 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc03_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc03_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc03_l_allowsubfolders19","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc03_l_allowsubfolders19_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc03_l_allowsubfolders19_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc03_l_datecolon17","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc03_l_descriptioncolon18","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc03_l_pathcolon16","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc04","displayName":"Trusted Location #4 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc04_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc04_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc04_l_allowsubfolders23","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc04_l_allowsubfolders23_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc04_l_allowsubfolders23_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc04_l_datecolon21","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc04_l_descriptioncolon22","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc04_l_pathcolon20","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc05","displayName":"Trusted Location #5 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc05_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc05_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc05_l_allowsubfolders27","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc05_l_allowsubfolders27_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc05_l_allowsubfolders27_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc05_l_datecolon25","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc05_l_descriptioncolon26","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc05_l_pathcolon24","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc06","displayName":"Trusted Location #6 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc06_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc06_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc06_l_allowsubfolders31","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc06_l_allowsubfolders31_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc06_l_allowsubfolders31_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc06_l_datecolon29","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc06_l_descriptioncolon30","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc06_l_pathcolon28","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc07","displayName":"Trusted Location #7 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc07_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc07_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc07_l_allowsubfolders35","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc07_l_allowsubfolders35_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc07_l_allowsubfolders35_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc07_l_datecolon33","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc07_l_descriptioncolon34","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc07_l_pathcolon32","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc08","displayName":"Trusted Location #8 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc08_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc08_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc08_l_allowsubfolders39","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc08_l_allowsubfolders39_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc08_l_allowsubfolders39_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc08_l_datecolon37","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc08_l_descriptioncolon38","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc08_l_pathcolon36","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc09","displayName":"Trusted Location #9 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc09_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc09_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc09_l_allowsubfolders43","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc09_l_allowsubfolders43_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc09_l_allowsubfolders43_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc09_l_datecolon41","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc09_l_descriptioncolon42","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc09_l_pathcolon40","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc10","displayName":"Trusted Location #10 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc10_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc10_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc10_l_allowsubfolders47","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc10_l_allowsubfolders47_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc10_l_allowsubfolders47_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc10_l_datecolon45","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc10_l_descriptioncolon46","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc10_l_pathcolon44","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc11","displayName":"Trusted Location #11 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc11_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc11_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc11_l_allowsubfolders51","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc11_l_allowsubfolders51_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc11_l_allowsubfolders51_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc11_l_datecolon49","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc11_l_descriptioncolon50","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc11_l_pathcolon48","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc12","displayName":"Trusted Location #12 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc12_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc12_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc12_l_allowsubfolders55","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc12_l_allowsubfolders55_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc12_l_allowsubfolders55_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc12_l_datecolon53","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc12_l_descriptioncolon54","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc12_l_pathcolon52","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc13","displayName":"Trusted Location #13 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc13_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc13_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc13_l_allowsubfolders59","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc13_l_allowsubfolders59_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc13_l_allowsubfolders59_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc13_l_datecolon57","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc13_l_descriptioncolon58","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc13_l_pathcolon56","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc14","displayName":"Trusted Location #14 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc14_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc14_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc14_l_allowsubfolders63","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc14_l_allowsubfolders63_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc14_l_allowsubfolders63_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc14_l_datecolon61","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc14_l_descriptioncolon62","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc14_l_pathcolon60","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc15","displayName":"Trusted Location #15 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc15_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc15_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc15_l_allowsubfolders67","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc15_l_allowsubfolders67_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc15_l_allowsubfolders67_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc15_l_datecolon65","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc15_l_descriptioncolon66","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc15_l_pathcolon64","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc16","displayName":"Trusted Location #16 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc16_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc16_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc16_l_allowsubfolders71","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc16_l_allowsubfolders71_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc16_l_allowsubfolders71_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc16_l_datecolon69","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc16_l_descriptioncolon70","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc16_l_pathcolon68","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc17","displayName":"Trusted Location #17 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc17_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc17_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc17_l_allowsubfolders75","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc17_l_allowsubfolders75_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc17_l_allowsubfolders75_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc17_l_datecolon73","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc17_l_descriptioncolon74","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc17_l_pathcolon72","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc18","displayName":"Trusted Location #18 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc18_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc18_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc18_l_allowsubfolders79","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc18_l_allowsubfolders79_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc18_l_allowsubfolders79_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc18_l_datecolon77","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc18_l_descriptioncolon78","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc18_l_pathcolon76","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc19","displayName":"Trusted Location #19 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc19_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc19_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc19_l_allowsubfolders83","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc19_l_allowsubfolders83_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc19_l_allowsubfolders83_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc19_l_datecolon81","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc19_l_descriptioncolon82","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc19_l_pathcolon80","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc20","displayName":"Trusted Location #20 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc20_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc20_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc20_l_allowsubfolders87","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc20_l_allowsubfolders87_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc20_l_allowsubfolders87_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc20_l_datecolon85","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc20_l_descriptioncolon86","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_trustedloc20_l_pathcolon84","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_turnofftrusteddocuments","displayName":"Turn off trusted documents (User)","description":"This policy setting allows you to turn off the trusted documents feature. The trusted documents feature allows users to always enable active content in documents such as macros, ActiveX controls, data connections, etc. so that they are not prompted the next time they open the documents. Trusted documents are exempt from security notifications.\r\n\r\nIf you enable this policy setting, you will turn off the trusted documents feature. Users will receive a security prompt every time a document containing active content is opened.\r\n\r\nIf you disable or do not configure this policy setting, documents will be trusted when users enable content for a document, and users will not receive a security prompt.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_turnofftrusteddocuments_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_turnofftrusteddocuments_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_turnofftrusteddocumentsonthenetwork","displayName":"Turn off Trusted Documents on the network (User)","description":"This policy setting allows you to turn off the trusted documents feature for documents opened from the network.\r\n\r\nIf you enable this policy setting, users will always see security notifications for active content such as macros, ActiveX controls, data connections, etc. for documents opened from the network.\r\n\r\nIf you disable or do not configure this policy setting, the trusted documents feature allows users to always allow active content in documents such as macros, ActiveX controls, data connections, etc. so that users are not prompted the next time they open the documents. Trusted documents are exempt from security notifications.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_turnofftrusteddocumentsonthenetwork_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_turnofftrusteddocumentsonthenetwork_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_vbawarningspolicy","displayName":"VBA Macro Notification Settings (User)","description":"This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.\r\n\r\nIf you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:\r\n \r\n- Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.\r\n \r\n- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.\r\n \r\n- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.\r\n \r\n- Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.\r\n \r\nIf you disable this policy setting, \"Disable all with notification\" will be the default setting.\r\n \r\nIf you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking \"Enable Content\" on the Trust Bar. If the user clicks \"Enable Content\", then the document is added as a trusted document.\r\n \r\nImportant: If \"Disable all except digitally signed macros\" is selected, users will not be able to open unsigned Access databases.\r\n \r\nAlso, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.\r\n \r\nTherefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_vbawarningspolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_vbawarningspolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty_2","displayName":"Disable all with notification","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty_3","displayName":"Disable all except digitally signed macros","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty_4","displayName":"Disable all without notification","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty_1","displayName":"Enable all macros (not recommended)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio2000files","displayName":"Visio 2000-2002 Binary Drawings, Templates and Stencils (User)","description":"This policy setting allows you to determine whether users can open or save Visio files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked: Both opening and saving of the file type will be blocked.\r\n\r\nIf you disable or do not configure this policy setting, the file type will be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio2000files_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio2000files_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio2000files_l_visio2000filesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio2000files_l_visio2000filesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio2000files_l_visio2000filesdropid_2","displayName":"Open/Save blocked","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio2003files","displayName":"Visio 2003-2010 Binary Drawings, Templates and Stencils (User)","description":"This policy setting allows you to determine whether users can open or save Visio files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked: Both opening and saving of the file type will be blocked.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio2003files_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio2003files_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio2003files_l_visio2003filesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio2003files_l_visio2003filesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio2003files_l_visio2003filesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio2003files_l_visio2003filesdropid_2","displayName":"Open/Save blocked","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio50andearlierfiles","displayName":"Visio 5.0 or earlier Binary Drawings, Templates and Stencils (User)","description":"This policy setting allows you to determine whether users can open or save Visio files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked: Both opening and saving of the file type will be blocked.\r\n\r\nIf you disable or do not configure this policy setting, the file type will be blocked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio50andearlierfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio50andearlierfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio50andearlierfiles_l_visio50andearlierfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio50andearlierfiles_l_visio50andearlierfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v2~policy~l_microsoftvisio~l_visiooptions~l_security~l_trustcenter~l_fileblocksettings_l_visio50andearlierfiles_l_visio50andearlierfilesdropid_2","displayName":"Open/Save blocked","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visio16v3~policy~l_microsoftvisio~l_visiooptions~l_proofing_l_disablevisiornrpane","displayName":"Turn off Research and Translation features in Visio (User)","description":"\r\n This policy setting controls whether the Research and Translation features appear in Visio.\r\n\r\n If you enable this policy setting, users won’t see the Research and Translation features in Visio.\r\n\r\n If you disable or don't configure this policy setting, users will see the Research and Translation features in Visio.\r\n\r\n Note: This policy setting only applies to subscription versions of Visio and Visio LTSC 2021.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visio16v3~policy~l_microsoftvisio~l_visiooptions~l_proofing_l_disablevisiornrpane_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visio16v3~policy~l_microsoftvisio~l_visiooptions~l_proofing_l_disablevisiornrpane_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visualstudiov1~policy~visualstudio~feedbacksettings_disablefeedbackdialog","displayName":"Disable the send-a-smile feature (User)","description":"This policy disables the Visual Studio send-a-smile feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visualstudiov1~policy~visualstudio~feedbacksettings_disablefeedbackdialog_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visualstudiov1~policy~visualstudio~feedbacksettings_disablefeedbackdialog_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_visualstudiov1~policy~visualstudio~feedbacksettings_disablescreenshotcapture","displayName":"Disables send-a-smile's screenshot capability (User)","description":"This policy disables the screenshot capability in the send-a-smile feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_visualstudiov1~policy~visualstudio~feedbacksettings_disablescreenshotcapture_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_visualstudiov1~policy~visualstudio~feedbacksettings_disablescreenshotcapture_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_windowsai_allowrecallexport","displayName":"Allow Recall Export (User) (Windows Insiders only)","description":"This policy allows you to determine whether Recall and snapshot information can be exported. Recall and snapshot information may be sensitive, and the files that are exported are unencrypted. Users can export from Settings > Privacy & Security > Recall & Snapshots > Advanced Settings > Export your Recall and snapshot info. Users are warned that the files are unencrypted before exporting. When you set this policy to enabled, users will be able to export Recall and snapshot information. If the policy is set to disabled or not configured, users will not be able to export their Recall and snapshot information.\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-WindowsAI#allowrecallexport"],"options":[{"id":"user_vendor_msft_policy_config_windowsai_allowrecallexport_0","displayName":"Deny export of Recall and snapshots information","description":"Deny export of Recall and snapshots information","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_allowrecallexport_1","displayName":"Allow export of Recall and snapshot information","description":"Allow export of Recall and snapshot information","helpText":null}]},{"id":"user_vendor_msft_policy_config_windowsai_disableaidataanalysis","displayName":"Disable AI Data Analysis (User)","description":"This policy setting allows you to determine whether end users have the option to allow snapshots to be saved on their PCs. If disabled, end users will have a choice to save snapshots of their screen on their PC and then use Recall to find things they've seen. If the policy is enabled, end users will not be able to save snapshots on their PC. If the policy is not configured, end users will not be able to save snapshots on their PC.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-WindowsAI#disableaidataanalysis"],"options":[{"id":"user_vendor_msft_policy_config_windowsai_disableaidataanalysis_0","displayName":"Enable Saving Snapshots for Windows.","description":"Enable Saving Snapshots for Windows.","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_disableaidataanalysis_1","displayName":"Disable Saving Snapshots for Windows.","description":"Disable Saving Snapshots for Windows.","helpText":null}]},{"id":"user_vendor_msft_policy_config_windowsai_disableclicktodo","displayName":"Disable Click To Do (User)","description":"Click to Do lets people take action on content on their screens. When activated, it takes a screenshot of their screen and analyzes it to present actions. Click to Do ends when they exit it, and it can't take screenshots while closed. Screenshot analysis is always performed locally on their device. By default, Click to Do is enabled for users. This policy setting allows you to determine whether Click to Do is available for users on their device. When the policy is enabled, the Click to Do component and entry points will not be available to users. When the policy is disabled, users will have Click to Do available on their device.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-WindowsAI#disableclicktodo"],"options":[{"id":"user_vendor_msft_policy_config_windowsai_disableclicktodo_0","displayName":"Click to Do is enabled","description":"Click to Do is enabled","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_disableclicktodo_1","displayName":"Click to Do is disabled.","description":"Click to Do is disabled.","helpText":null}]},{"id":"user_vendor_msft_policy_config_windowsai_removemicrosoftcopilotapp","displayName":"Remove Microsoft Copilot App (User)","description":"This policy setting allows you to uninstall Microsoft Copilot from devices in a targeted way. It will apply to devices/users that meet the below conditions: Microsoft 365 Copilot and Microsoft Copilot are both installed; the Microsoft Copilot app was not installed by the user; the Microsoft Copilot app was not launched in the last 14 days. If this policy is enabled, the Microsoft Copilot app will be uninstalled. Users can still re-install if they choose to. This setting applies to Enterprise, Professional and Education client SKUs only.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-WindowsAI#removemicrosoftcopilotapp"],"options":[{"id":"user_vendor_msft_policy_config_windowsai_removemicrosoftcopilotapp_0","displayName":"Removal Disabled.","description":"Removal Disabled.","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_removemicrosoftcopilotapp_1","displayName":"Removal Enabled.","description":"Removal Enabled.","helpText":null}]},{"id":"user_vendor_msft_policy_config_windowsai_setcopilothardwarekey","displayName":"Set Copilot Hardware Key (User)","description":"This policy setting determines which app opens when the user presses the Copilot key on their keyboard. If the policy is enabled, the specified app will open when the user presses the Copilot key. Users can change the key assignment in Settings. If the policy is not configured, Copilot will open if it's available in that country or region.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-WindowsAI#setcopilothardwarekey"],"options":null},{"id":"user_vendor_msft_policy_config_windowsai_setdenyapplistforrecall","displayName":"Set Deny App List For Recall (User)","description":"This policy allows you to set a semicolon-separated list of app names which should not be collected in Recall Snapshots\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-WindowsAI#setdenyapplistforrecall"],"options":null},{"id":"user_vendor_msft_policy_config_windowsai_setdenyurilistforrecall","displayName":"Set Deny Uri List For Recall (User)","description":"This policy allows you to set a semicolon-separated list of uris which should not be collected in Recall Snapshots\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-WindowsAI#setdenyurilistforrecall"],"options":null},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragedurationforrecallsnapshots","displayName":"Set Maximum Storage Duration For Recall Snapshots (User)","description":"This policy setting allows you to control the maximum amount of time (in days) that Windows saves snapshots for Recall. The default value for this setting is '0' which doesn't set a time frame to delete snapshots. When the default is used, snapshots aren't deleted until the maximum storage allocation for Recall is reached and the oldest snapshots are deleted first. You can configure the maximum storage duration to be 30, 60, 90, or 180 days.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-WindowsAI#setmaximumstoragedurationforrecallsnapshots"],"options":[{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragedurationforrecallsnapshots_0","displayName":"Let the OS define the maximum amount of time the snapshots will be saved","description":"Let the OS define the maximum amount of time the snapshots will be saved","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragedurationforrecallsnapshots_30","displayName":"30 days","description":"30 days","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragedurationforrecallsnapshots_60","displayName":"60 days","description":"60 days","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragedurationforrecallsnapshots_90","displayName":"90 days","description":"90 days","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragedurationforrecallsnapshots_180","displayName":"180 days","description":"180 days","helpText":null}]},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragespaceforrecallsnapshots","displayName":"[Deprecated] Set Maximum Storage Space For Recall Snapshots (User) (Windows Insiders only)","description":"This policy setting allows you to control the maximum amount of disk space that can be used by Windows to save snapshots for Recall. The default value of '0' will let the OS configure the amount of storage allocated to snapshots. When the default value of '0' is used, the OS configures the storage allocation for snapshots based on the device storage capacity. 25 GB is allocated when the device storage capacity is 256 GB. 75 GB is allocated when the device storage capacity is 512 GB. 150 GB is allocated when the device storage capacity is 1 TB or higher.\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-WindowsAI#setmaximumstoragespaceforrecallsnapshots"],"options":[{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragespaceforrecallsnapshots_0","displayName":"Let the OS define the maximum storage amount based on hard drive storage size","description":"Let the OS define the maximum storage amount based on hard drive storage size","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragespaceforrecallsnapshots_10000","displayName":"10GB","description":"10GB","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragespaceforrecallsnapshots_25000","displayName":"25GB","description":"25GB","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragespaceforrecallsnapshots_50000","displayName":"50GB","description":"50GB","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragespaceforrecallsnapshots_75000","displayName":"75GB","description":"75GB","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragespaceforrecallsnapshots_100000","displayName":"100GB","description":"100GB","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragespaceforrecallsnapshots_150000","displayName":"150GB","description":"150GB","helpText":null}]},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragespaceforrecallsnapshots_v2","displayName":"Set Maximum Storage Space For Recall Snapshots (User)","description":"This policy setting allows you to control the maximum amount of disk space that can be used by Windows to save snapshots for Recall. The default value of '0' will let the OS configure the amount of storage allocated to snapshots. When the default value of '0' is used, the OS configures the storage allocation for snapshots based on the device storage capacity. 25 GB is allocated when the device storage capacity is 256 GB. 75 GB is allocated when the device storage capacity is 512 GB. 150 GB is allocated when the device storage capacity is 1 TB or higher.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-WindowsAI#setmaximumstoragespaceforrecallsnapshots"],"options":[{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragespaceforrecallsnapshots_0","displayName":"Let the OS define the maximum storage amount based on hard drive storage size","description":"Let the OS define the maximum storage amount based on hard drive storage size","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragespaceforrecallsnapshots_10240","displayName":"10GB","description":"10GB","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragespaceforrecallsnapshots_25600","displayName":"25GB","description":"25GB","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragespaceforrecallsnapshots_51200","displayName":"50GB","description":"50GB","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragespaceforrecallsnapshots_76800","displayName":"75GB","description":"75GB","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragespaceforrecallsnapshots_102400","displayName":"100GB","description":"100GB","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_setmaximumstoragespaceforrecallsnapshots_153600","displayName":"150GB","description":"150GB","helpText":null}]},{"id":"user_vendor_msft_policy_config_windowsai_turnoffwindowscopilot","displayName":"Turn Off Copilot in Windows (User)","description":"This policy setting allows you to turn off Windows Copilot. If you enable this policy setting, users will not be able to use Copilot. The Copilot icon will not appear on the taskbar either. If you disable or do not configure this policy setting, users will be able to use Copilot when it's available to them.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-WindowsAI#turnoffwindowscopilot"],"options":[{"id":"user_vendor_msft_policy_config_windowsai_turnoffwindowscopilot_0","displayName":"Enable Copilot","description":"Enable Copilot","helpText":null},{"id":"user_vendor_msft_policy_config_windowsai_turnoffwindowscopilot_1","displayName":"Disable Copilot","description":"Disable Copilot","helpText":null}]},{"id":"user_vendor_msft_policy_config_windowspowershell_turnonpowershellscriptblocklogging","displayName":"Turn on PowerShell Script Block Logging (User)","description":"\r\n This policy setting enables logging of all PowerShell script input to the Microsoft-Windows-PowerShell/Operational event log. If you enable this policy setting,\r\n Windows PowerShell will log the processing of commands, script blocks, functions, and scripts - whether invoked interactively, or through automation.\r\n \r\n If you disable this policy setting, logging of PowerShell script input is disabled.\r\n \r\n If you enable the Script Block Invocation Logging, PowerShell additionally logs events when invocation of a command, script block, function, or script\r\n starts or stops. Enabling Invocation Logging generates a high volume of event logs.\r\n \r\n Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting.\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowspowershell#windowspowershell-turnonpowershellscriptblocklogging"],"options":[{"id":"user_vendor_msft_policy_config_windowspowershell_turnonpowershellscriptblocklogging_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_windowspowershell_turnonpowershellscriptblocklogging_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_windowspowershell_turnonpowershellscriptblocklogging_enablescriptblockinvocationlogging","displayName":"Log script block invocation start / stop events: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_windowspowershell_turnonpowershellscriptblocklogging_enablescriptblockinvocationlogging_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_windowspowershell_turnonpowershellscriptblocklogging_enablescriptblockinvocationlogging_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v10~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_disablemoderncommentsoptoutoption","displayName":"Hide the modern comments opt-out (User)","description":"This policy setting allows you to hide the modern comments opt-out toggle in Word from your users.\r\n\r\nNote: This opt-out toggle is only temporary and will eventually be removed from Word.\r\n\r\nIf you enable this policy setting, the toggle to turn off modern comments will be hidden from your users.\r\n\r\nIf you disable or don't configure this policy setting, your users will be able to temporarily turn off the new modern comments experience from the Options menu in Word. \r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v10~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_disablemoderncommentsoptoutoption_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v10~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_disablemoderncommentsoptoutoption_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v11~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_alternateclplabelcontentmarkanchoringoption","displayName":"Use an alternate method of anchoring content marks from CLP labels (User)","description":"This policy setting switches Word to use a alternate method of anchoring content marks associated with CLP labels, which can improve layout for some content marks.\r\n\r\nIf you enable this policy setting, Word will use the alternate content mark anchoring method.\r\n\r\nIf you disable or don't configure this policy setting, Word will use the original content mark anchoring method.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v11~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_alternateclplabelcontentmarkanchoringoption_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v11~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_alternateclplabelcontentmarkanchoringoption_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v12~policy~l_microsoftofficeword_l_stopreadaloudeyesoffexperience","displayName":"Stop Read Aloud when app goes in background (User)","description":"This policy prevents Read Aloud from reading text when app goes in background.\r\n\r\nIf you enable this policy setting, Read Aloud will be disabled and will stop reading the text when app is sent to background.\r\n\r\nIf you disable or do not configure this policy setting, Read Aloud will continue reading the text when app moves to background and user will be able to control Read Aloud via notification.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v12~policy~l_microsoftofficeword_l_stopreadaloudeyesoffexperience_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v12~policy~l_microsoftofficeword_l_stopreadaloudeyesoffexperience_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v13~policy~l_microsoftofficeword_l_showesignribbon","displayName":"Allow the use of SharePoint eSignature for Microsoft Word (User)","description":"This policy setting allows you to control whether users can request eSignatures directly from Word in tenants that have enabled Microsoft's native eSignature service.\r\n\r\nIf you enable this policy setting, users can request eSignatures from within Word. This policy setting applies only to subscription versions of Word.\r\n\r\nIf you disable this policy setting, users cannot request eSignatures from within Word.\r\n\r\nIf you don't configure this policy setting, users cannot request eSignatures from within Word.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v13~policy~l_microsoftofficeword_l_showesignribbon_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v13~policy~l_microsoftofficeword_l_showesignribbon_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v13~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_startupboostoption","displayName":"Allow Startup Boost feature (User)","description":"This policy setting configures the \"Startup Boost\" checkbox found under File tab | Options | General. Startup Boost improves Word's boot time by prewarming the app on user login.\r\n\r\nIf you enable or do not configure this policy, users will be able to use the Startup Boost feature. The Startup Boost checkbox will be enabled and checked by default.\r\n\r\nIf you disable this policy setting, the Startup Boost feature will not be available. The Startup Boost checkbox will be disabled and unchecked.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v13~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_startupboostoption_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v13~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_startupboostoption_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v14~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_emailoptions_l_advancedtypographyoutlook","displayName":"Allow Advanced Typography features for Outlook (User)","description":"This policy setting sets the “Advanced Typography” options found under Outlook’s File tab | Outlook Options | Mail | Editor Options | Advanced | Advanced Typography.\r\n\r\nIf you enable or do not configure this policy setting, Advanced Typography features will be applied. This is the default behavior.\r\n\r\nIf you disable this policy setting, Advanced Typography features will not be applied.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v14~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_emailoptions_l_advancedtypographyoutlook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v14~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_emailoptions_l_advancedtypographyoutlook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_collaborationsettings~l_coauthoring_l_disablecoauthoringondocmfiles","displayName":"Prevent co-authoring on files with macros for Word (User)","description":"This policy controls whether users will be able to co-author Word documents with macros.\r\n\r\nEnabling this policy setting will turn off the ability to co-author Word documents with macros.\r\n\r\nIf you disable or don't configure this policy setting, the user will be able to co-author Word documents with macros.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_collaborationsettings~l_coauthoring_l_disablecoauthoringondocmfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_collaborationsettings~l_coauthoring_l_disablecoauthoringondocmfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_collaborationsettings~l_coauthoring_l_disablertc","displayName":"Disable Real Time Coauthoring for Word (User)","description":"This policy lets admins disable Real Time Coauthoring. They may want to do so if they have solutions that are not compatible with some elements of real time coauthoring, such as add-ins that would trigger too often due to Real Time Coauthoring causing the frequent saving of user content. \r\n\r\nIf you enable this policy setting, it will prevent Real Time Coauthoring. \r\n\r\nIf you disable or do not configure this policy setting, users will be able to experience Real Time Coauthoring feature.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_collaborationsettings~l_coauthoring_l_disablertc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_collaborationsettings~l_coauthoring_l_disablertc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_collaborationsettings~l_coauthoring_l_donotautomaticallymergeserverandlocaldocument","displayName":"Do not automatically merge server and local document (User)","description":"This policy setting determines if changes made to a server document should be automatically merged with the locally-cached copy of the document on the next save. This policy pertains to the co-authoring experience in Word.\r\n\r\nIf you enable this policy setting, then changes made to a server document will not be automatically merged with the locally-cached copy of the document on the next save. \r\n\r\nIf you disable or do not configure this policy setting, then changes made to a server document will be automatically merged with the locally-cached copy of the document on the next save.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_collaborationsettings~l_coauthoring_l_donotautomaticallymergeserverandlocaldocument_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_collaborationsettings~l_coauthoring_l_donotautomaticallymergeserverandlocaldocument_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_collaborationsettings~l_coauthoring_l_preventcoauthoring","displayName":"Prevent co-authoring (User)","description":"This policy setting controls how Word opens a file for editing on document management servers that support co-authoring.\r\n\r\nIf you enable this policy setting, Word will prevent co-authoring by taking an exclusive file lock. \r\n\r\nIf you disable or do not configure this policy setting, Word will allow co-authoring by taking short-term shared locks. \r\n\r\nNote: When file synchronization via SOAP over HTTP is turned off it will prevent co-authoring.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_collaborationsettings~l_coauthoring_l_preventcoauthoring_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_collaborationsettings~l_coauthoring_l_preventcoauthoring_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_customizableerrormessages_l_listoferrormessagestocustomize","displayName":"List of error messages to customize (User)","description":"Defines a list of custom error messages to activate.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_customizableerrormessages_l_listoferrormessagestocustomize_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_customizableerrormessages_l_listoferrormessagestocustomize_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_customizableerrormessages_l_listoferrormessagestocustomize_l_listoferrormessagestocustomize97","displayName":"List of error messages to customize (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_customizableerrormessages_l_listoferrormessagestocustomize_l_listoferrormessagestocustomize97_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_customizableerrormessages_l_listoferrormessagestocustomize_l_listoferrormessagestocustomize97_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems174","displayName":"Disable commands (User)","description":"This policy setting allows you to disable any command bar button and menu item with a command bar ID, including command bar buttons and menu items that are not in the predefined lists.\r\n\r\nIf you enable this policy setting, you can enter an ID number to disable a specific command bar button or menu item. The ID number needs to be in decimal (not hexadecimal). Multiple values should be separated by commas.\r\n\r\nIf you disable or do not configure this policy setting, all default command bar buttons or menu items are available to users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems174_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems174_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_custom_l_disablecommandbarbuttonsandmenuitems174_l_enteracommandbaridtodisable","displayName":"Enter a command bar ID to disable (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys175","displayName":"Disable shortcut keys (User)","description":"This policy setting allows you to disable any shortcut key by using its virtual key code ID, including shortcut keys that are not in the predefined lists.\r\n\r\nIf you enable this policy setting, you can enter a virtual key code ID number to disable a specific shortcut key.\r\n\r\nIf you disable or do not configure this policy setting, all default shortcut keys are enabled for users.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys175_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys175_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_custom_l_disableshortcutkeys175_l_enterakeyandmodifiertodisable","displayName":"Enter a key and modifier to disable (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems","displayName":"Disable commands (User)","description":"This policy setting allows you to disable some specific commands in Microsoft Word. Commands are buttons, menus, or other items that can be added to the Quick Access Toolbar or to the Ribbon under File tab | Options | Quick Access Toolbar or via File | Options | Customize Ribbon, respectively.\r\n\r\nIf you enable this policy setting then you can specify what commands in the user interface for Word are disabled.\r\n\r\nIf you disable or do not configure this policy setting, the commands in the predefined list are all enabled in Word.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filesendtomailrecipient","displayName":"File tab | Share | Email (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filesendtomailrecipient_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filesendtomailrecipient_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filewebpagepreview","displayName":"File tab | Options | (\"Customize Ribbon\" or \"Quick Access Toolbar\") | All Commands | Web Page Preview (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filewebpagepreview_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_filewebpagepreview_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_inserthyperlinkwd","displayName":"Insert tab | Links | Hyperlink (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_inserthyperlinkwd_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_inserthyperlinkwd_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacromacroswd","displayName":"Developer tab | Code | Macros (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacromacroswd_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacromacroswd_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrorecordnewmacro","displayName":"Developer tab | Code | Record Macro (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrorecordnewmacro_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrorecordnewmacro_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrosecurity","displayName":"Developer tab | Code | Macro Security (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrosecurity_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrosecurity_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrovisualbasiceditorwd","displayName":"Developer tab | Code | Visual Basic (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrovisualbasiceditorwd_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrovisualbasiceditorwd_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrowd","displayName":"View tab | Macros | Macros (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrowd_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsmacrowd_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsprotectdocument","displayName":"File tab | Info | Protect Document (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsprotectdocument_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolsprotectdocument_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolstemplatesandaddins","displayName":"Developer tab | Templates | Document Template (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolstemplatesandaddins_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_toolstemplatesandaddins_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_webaddresswd","displayName":"File tab | Options | (\"Customize Ribbon\" or \"Quick Access Toolbar\") | All Commands | Document Location (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_webaddresswd_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disablecommandbarbuttonsandmenuitems_l_webaddresswd_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys","displayName":"Disable shortcut keys (User)","description":"This policy setting allows you to disable specific shortcut key combinations in the specified applications. \r\n\r\nIf you enable this policy setting you can disable specific shortcut keys for the selected application. The predefined list of shortcut keys you can disable becomes available to you when you enable this policy setting. \r\n\r\nIf you disable or do not configure this policy setting, the predefined list of shortcut keys are enabled for the application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_altf11toolsmacrovisualbasiceditorwd","displayName":"Alt+F11 (Developer | Code | Visual Basic) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_altf11toolsmacrovisualbasiceditorwd_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_altf11toolsmacrovisualbasiceditorwd_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_altf8toolsmacromacros","displayName":"Alt+F8 (Developer | Code | Macros) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_altf8toolsmacromacros_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_altf8toolsmacromacros_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlffindwd","displayName":"Ctrl+F (Home | Editing | Find) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlffindwd_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlffindwd_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlkinserthyperlinkwd","displayName":"Ctrl+K (Insert | Links | Hyperlink) (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlkinserthyperlinkwd_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_disableitemsinuserinterface~l_predefined_l_disableshortcutkeys_l_ctrlkinserthyperlinkwd_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_backgroundaccessibilitycheckerinformation","displayName":"Check for accessibility issues while editing (User)","description":"This policy setting controls whether accessibility issues are checked for automatically while the user is editing a document. By default, accessibility issues aren’t checked for automatically.\r\n\r\nIf you enable this policy setting, accessibility issues are checked for automatically and users won’t be able to turn it off. The status bar will indicate if accessibility recommendations are available to make the document more usable by people with disabilities.\r\n\r\nIf you disable or don’t configure this policy setting, accessibility issues won’t be checked for automatically while editing a document. Users can turn on automatic checking by going to File > Options > Ease of Access.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_backgroundaccessibilitycheckerinformation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_backgroundaccessibilitycheckerinformation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingalttextaccessibilityinformation","displayName":"Stop checking for alt text accessibility information (User)","description":"This policy setting prevents the Accessibility Checker from verifying that objects such as images and shapes contain alt text.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that objects such as images and shapes contain alt text.\r\n\r\nIf you disable or do not configure this policy setting, objects will be checked for alternative text and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingalttextaccessibilityinformation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingalttextaccessibilityinformation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingblankcharactersusedforformatting","displayName":"Stop checking whether blank characters are used for formatting (User)","description":"This policy setting prevents the Accessibility Checker from checking to ensure that multiple consecutive whitespace characters have not been used for formatting.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from checking to ensure that multiple consecutive whitespace characters have not been used for formatting.\r\n\r\nIf you disable or do not configure this policy setting, documents will be checked for consecutive whitespace usage and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingblankcharactersusedforformatting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingblankcharactersusedforformatting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingdocumentsallowprogrammaticaccess","displayName":"Stop checking to ensure documents allow programmatic access (User)","description":"This policy setting prevents the Accessibility Checker from checking to ensure that documents have not blocked programmatic access through DRM.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from checking to ensure that documents have not blocked programmatic access through DRM.\r\n\r\nIf you disable or do not configure this policy setting, documents will be checked for programmatic access and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingdocumentsallowprogrammaticaccess_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingdocumentsallowprogrammaticaccess_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingforblanktablerowsandcolumns","displayName":"Stop checking for blank table rows and columns (User)","description":"This policy setting prevents the Accessibility Checker from verifying that blank rows and columns have not been inserted into tables.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that blank rows and columns have not been inserted into tables.\r\n\r\nIf you disable or do not configure this policy setting, tables will be checked for blank rows and columns and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingforblanktablerowsandcolumns_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingforblanktablerowsandcolumns_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingforimagewatermarks","displayName":"Stop checking for image watermarks (User)","description":"This policy setting prevents the Accessibility Checker from checking if a document has image watermarks.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from checking if a document has image watermarks.\r\n\r\nIf you disable or do not configure this policy setting, documents will be checked for watermarks and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingforimagewatermarks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingforimagewatermarks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingformergedandsplitcells","displayName":"Stop checking for merged and split cells (User)","description":"This policy setting prevents the Accessibility Checker from verifying that tables do not have merged or split cells.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that tables do not have merged or split cells.\r\n\r\nIf you disable or do not configure this policy setting, tables will be checked for merged and split cells and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingformergedandsplitcells_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingformergedandsplitcells_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingfortablesusedforlayout","displayName":"Stop checking for tables used for layout (User)","description":"This policy setting prevents the Accessibility Checker from flagging layout tables (i.e. tables with no style applied).\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from flagging layout tables (i.e. tables with no style applied).\r\n\r\nIf you disable or do not configure this policy setting, tables with no style will be flagged and the violations will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingfortablesusedforlayout_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingfortablesusedforlayout_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingheadingstylesdonotskipstylelevel","displayName":"Stop checking to ensure heading styles do not skip style level (User)","description":"This policy setting prevents the Accessibility Checker from checking to ensure that headings in a document are used in order.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from checking to ensure that headings in a document are used in order.\r\n\r\nIf you disable or do not configure this policy setting, the ordering of headings in a document will be checked and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingheadingstylesdonotskipstylelevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingheadingstylesdonotskipstylelevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckinglongdocumentsusestylesforstructure","displayName":"Stop checking to ensure long documents use styles for structure (User)","description":"This policy setting prevents the Accessibility Checker from checking to ensure that long documents have used styles to define content structure.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from checking to ensure that long documents have used styles to define content structure.\r\n\r\nIf you disable or do not configure this policy setting, documents will be checked for style usage and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckinglongdocumentsusestylesforstructure_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckinglongdocumentsusestylesforstructure_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingstylesusedfrequently","displayName":"Stop checking to ensure styles have been used frequently (User)","description":"This policy setting prevents the Accessibility Checker from checking to ensure that documents using styles have used them frequently enough to accurately represent the document's content structure.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from checking to ensure that documents using styles have used them frequently enough to accurately represent the document's content structure.\r\n\r\nIf you disable or do not configure this policy setting, the frequency of style usage will be checked and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingstylesusedfrequently_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingstylesusedfrequently_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingtableheaderaccessibilityinformation","displayName":"Stop checking for table header accessibility information (User)","description":"This policy setting prevents the Accessibility Checker from verifying that tables have a header row specified.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that tables have a header row specified.\r\n\r\nIf you disable or do not configure this policy setting, tables will be checked for header rows and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingtableheaderaccessibilityinformation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingtableheaderaccessibilityinformation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingtoensureheadingsaresuccinct","displayName":"Stop checking to ensure headings are succinct (User)","description":"This policy setting prevents the Accessibility Checker from checking to ensure that headings in a document are succinct.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from checking to ensure that headings in a document are succinct.\r\n\r\nIf you disable or do not configure this policy setting, document headings will be checked for length and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingtoensureheadingsaresuccinct_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingtoensureheadingsaresuccinct_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingtoensurehyperlinktextismeaningful","displayName":"Stop checking to ensure hyperlink text is meaningful (User)","description":"This policy setting prevents the Accessibility Checker from verifying that hyperlinks have meaningful text.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that hyperlinks have meaningful text.\r\n\r\nIf you disable or do not configure this policy setting, hyperlink text will be checked and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingtoensurehyperlinktextismeaningful_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingtoensurehyperlinktextismeaningful_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingwhetherobjectsarefloating","displayName":"Stop checking whether objects are floating (User)","description":"This policy setting prevents the Accessibility Checker from checking if a document has objects that are floating instead of inline.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from checking if a document has objects that are floating instead of inline.\r\n\r\nIf you disable or do not configure this policy setting, objects will be checked for floating text wrapping properties and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingwhetherobjectsarefloating_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingwhetherobjectsarefloating_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_ignorepunctuationcharacters","displayName":"Ignore punctuation characters (User)","description":"This policy setting allows you to check or uncheck the corresponding UI option in the \"Japanese Find\" dialog. The \"Japanese Find\" dialog may be accessed from the Find dialog, under Home tab | Editing | Find | Go To... | Search Options | Options.... It could also be found under the Navigation Pane, under Home tab | Editing | Find | < down arrow > | Options... | Sounds Like (Japanese) | Options. The \"Sounds like (Japanese)\" checkbox and the \"Options...\" button may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, you will check the corresponding UI option as specified in this policy setting's title.\r\n\r\nIf you disable or do not configure this policy setting, the corresponding UI option will be unchecked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_ignorepunctuationcharacters_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_ignorepunctuationcharacters_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_ignorewhitespacecharacters","displayName":"Ignore whitespace characters (User)","description":"This policy setting allows you to check or uncheck the corresponding UI option in the \"Japanese Find\" dialog. The \"Japanese Find\" dialog may be accessed from the Find dialog, under Home tab | Editing | Find | Go To... | Search Options | Options.... It could also be found under the Navigation Pane, under Home tab | Editing | Find | < down arrow > | Options... | Sounds Like (Japanese) | Options. The \"Sounds like (Japanese)\" checkbox and the \"Options...\" button may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, you will check the corresponding UI option as specified in this policy setting's title.\r\n\r\nIf you disable or do not configure this policy setting, the corresponding UI option will be unchecked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_ignorewhitespacecharacters_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_ignorewhitespacecharacters_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchbavahafa","displayName":"Match ba/va, ha/fa (User)","description":"This policy setting allows you to check or uncheck the corresponding UI option in the \"Japanese Find\" dialog. The \"Japanese Find\" dialog may be accessed from the Find dialog, under Home tab | Editing | Find | Go To... | Search Options | Options.... It could also be found under the Navigation Pane, under Home tab | Editing | Find | < down arrow > | Options... | Sounds Like (Japanese) | Options. The \"Sounds like (Japanese)\" checkbox and the \"Options...\" button may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, you will check the corresponding UI option as specified in this policy setting's title.\r\n\r\nIf you disable or do not configure this policy setting, the corresponding UI option will be unchecked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchbavahafa_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchbavahafa_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchcase","displayName":"Match case (User)","description":"This policy setting allows you to check or uncheck the corresponding UI option in the \"Japanese Find\" dialog. The \"Japanese Find\" dialog may be accessed from the Find dialog, under Home tab | Editing | Find | Go To... | Search Options | Options.... It could also be found under the Navigation Pane, under Home tab | Editing | Find | < down arrow > | Options... | Sounds Like (Japanese) | Options. The \"Sounds like (Japanese)\" checkbox and the \"Options...\" button may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, you will check the corresponding UI option as specified in this policy setting's title.\r\n\r\nIf you disable or do not configure this policy setting, the corresponding UI option will be unchecked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchcase_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchcase_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchchoonusedforvowels","displayName":"Match cho-on used for vowels (User)","description":"This policy setting allows you to check or uncheck the corresponding UI option in the \"Japanese Find\" dialog. The \"Japanese Find\" dialog may be accessed from the Find dialog, under Home tab | Editing | Find | Go To... | Search Options | Options.... It could also be found under the Navigation Pane, under Home tab | Editing | Find | < down arrow > | Options... | Sounds Like (Japanese) | Options. The \"Sounds like (Japanese)\" checkbox and the \"Options...\" button may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, you will check the corresponding UI option as specified in this policy setting's title.\r\n\r\nIf you disable or do not configure this policy setting, the corresponding UI option will be unchecked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchchoonusedforvowels_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchchoonusedforvowels_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchcontractionsyoonsokuon","displayName":"Match contractions (yo-on, sokuon) (User)","description":"This policy setting allows you to check or uncheck the corresponding UI option in the \"Japanese Find\" dialog. The \"Japanese Find\" dialog may be accessed from the Find dialog, under Home tab | Editing | Find | Go To... | Search Options | Options.... It could also be found under the Navigation Pane, under Home tab | Editing | Find | < down arrow > | Options... | Sounds Like (Japanese) | Options. The \"Sounds like (Japanese)\" checkbox and the \"Options...\" button may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, you will check the corresponding UI option as specified in this policy setting's title.\r\n\r\nIf you disable or do not configure this policy setting, the corresponding UI option will be unchecked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchcontractionsyoonsokuon_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchcontractionsyoonsokuon_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchdiziduzu","displayName":"Match di/zi, du/zu (User)","description":"This policy setting allows you to check or uncheck the corresponding UI option in the \"Japanese Find\" dialog. The \"Japanese Find\" dialog may be accessed from the Find dialog, under Home tab | Editing | Find | Go To... | Search Options | Options.... It could also be found under the Navigation Pane, under Home tab | Editing | Find | < down arrow > | Options... | Sounds Like (Japanese) | Options. The \"Sounds like (Japanese)\" checkbox and the \"Options...\" button may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, you will check the corresponding UI option as specified in this policy setting's title.\r\n\r\nIf you disable or do not configure this policy setting, the corresponding UI option will be unchecked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchdiziduzu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchdiziduzu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchfullhalfwidthform","displayName":"Match full/half width form (User)","description":"This policy setting allows you to check or uncheck the corresponding UI option in the \"Japanese Find\" dialog. The \"Japanese Find\" dialog may be accessed from the Find dialog, under Home tab | Editing | Find | Go To... | Search Options | Options.... It could also be found under the Navigation Pane, under Home tab | Editing | Find | < down arrow > | Options... | Sounds Like (Japanese) | Options. The \"Sounds like (Japanese)\" checkbox and the \"Options...\" button may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, you will check the corresponding UI option as specified in this policy setting's title.\r\n\r\nIf you disable or do not configure this policy setting, the corresponding UI option will be unchecked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchfullhalfwidthform_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchfullhalfwidthform_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchhiraganakatakana","displayName":"Match hiragana/katakana (User)","description":"This policy setting allows you to check or uncheck the corresponding UI option in the \"Japanese Find\" dialog. The \"Japanese Find\" dialog may be accessed from the Find dialog, under Home tab | Editing | Find | Go To... | Search Options | Options.... It could also be found under the Navigation Pane, under Home tab | Editing | Find | < down arrow > | Options... | Sounds Like (Japanese) | Options. The \"Sounds like (Japanese)\" checkbox and the \"Options...\" button may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, you will check the corresponding UI option as specified in this policy setting's title.\r\n\r\nIf you disable or do not configure this policy setting, the corresponding UI option will be unchecked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchhiraganakatakana_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchhiraganakatakana_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchhyuiyubyuvyu","displayName":"Match hyu/iyu, byu/vyu (User)","description":"This policy setting allows you to check or uncheck the corresponding UI option in the \"Japanese Find\" dialog. The \"Japanese Find\" dialog may be accessed from the Find dialog, under Home tab | Editing | Find | Go To... | Search Options | Options.... It could also be found under the Navigation Pane, under Home tab | Editing | Find | < down arrow > | Options... | Sounds Like (Japanese) | Options. The \"Sounds like (Japanese)\" checkbox and the \"Options...\" button may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, you will check the corresponding UI option as specified in this policy setting's title.\r\n\r\nIf you disable or do not configure this policy setting, the corresponding UI option will be unchecked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchhyuiyubyuvyu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchhyuiyubyuvyu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchiaiyapianopiyano","displayName":"Match ia/iya (piano/piyano) (User)","description":"This policy setting allows you to check or uncheck the corresponding UI option in the \"Japanese Find\" dialog. The \"Japanese Find\" dialog may be accessed from the Find dialog, under Home tab | Editing | Find | Go To... | Search Options | Options.... It could also be found under the Navigation Pane, under Home tab | Editing | Find | < down arrow > | Options... | Sounds Like (Japanese) | Options. The \"Sounds like (Japanese)\" checkbox and the \"Options...\" button may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, you will check the corresponding UI option as specified in this policy setting's title.\r\n\r\nIf you disable or do not configure this policy setting, the corresponding UI option will be unchecked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchiaiyapianopiyano_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchiaiyapianopiyano_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchkikutekisutotekusuto","displayName":"Match ki/ku (tekisuto/tekusuto) (User)","description":"This policy setting allows you to check or uncheck the corresponding UI option in the \"Japanese Find\" dialog. The \"Japanese Find\" dialog may be accessed from the Find dialog, under Home tab | Editing | Find | Go To... | Search Options | Options.... It could also be found under the Navigation Pane, under Home tab | Editing | Find | < down arrow > | Options... | Sounds Like (Japanese) | Options. The \"Sounds like (Japanese)\" checkbox and the \"Options...\" button may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, you will check the corresponding UI option as specified in this policy setting's title.\r\n\r\nIf you disable or do not configure this policy setting, the corresponding UI option will be unchecked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchkikutekisutotekusuto_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchkikutekisutotekusuto_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchminusdashchoon","displayName":"Match minus/dash/cho-on (User)","description":"This policy setting allows you to check or uncheck the corresponding UI option in the \"Japanese Find\" dialog. The \"Japanese Find\" dialog may be accessed from the Find dialog, under Home tab | Editing | Find | Go To... | Search Options | Options.... It could also be found under the Navigation Pane, under Home tab | Editing | Find | < down arrow > | Options... | Sounds Like (Japanese) | Options. The \"Sounds like (Japanese)\" checkbox and the \"Options...\" button may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, you will check the corresponding UI option as specified in this policy setting's title.\r\n\r\nIf you disable or do not configure this policy setting, the corresponding UI option will be unchecked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchminusdashchoon_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchminusdashchoon_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matcholdkanaforms","displayName":"Match old kana forms (User)","description":"This policy setting allows you to check or uncheck the corresponding UI option in the \"Japanese Find\" dialog. The \"Japanese Find\" dialog may be accessed from the Find dialog, under Home tab | Editing | Find | Go To... | Search Options | Options.... It could also be found under the Navigation Pane, under Home tab | Editing | Find | < down arrow > | Options... | Sounds Like (Japanese) | Options. The \"Sounds like (Japanese)\" checkbox and the \"Options...\" button may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, you will check the corresponding UI option as specified in this policy setting's title.\r\n\r\nIf you disable or do not configure this policy setting, the corresponding UI option will be unchecked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matcholdkanaforms_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matcholdkanaforms_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchrepeatcharactermarks","displayName":"Match 'repeat character' marks (User)","description":"This policy setting allows you to check or uncheck the corresponding UI option in the \"Japanese Find\" dialog. The \"Japanese Find\" dialog may be accessed from the Find dialog, under Home tab | Editing | Find | Go To... | Search Options | Options.... It could also be found under the Navigation Pane, under Home tab | Editing | Find | < down arrow > | Options... | Sounds Like (Japanese) | Options. The \"Sounds like (Japanese)\" checkbox and the \"Options...\" button may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, you will check the corresponding UI option as specified in this policy setting's title.\r\n\r\nIf you disable or do not configure this policy setting, the corresponding UI option will be unchecked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchrepeatcharactermarks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchrepeatcharactermarks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchseshezeje","displayName":"Match se/she, ze/je (User)","description":"This policy setting allows you to check or uncheck the corresponding UI option in the \"Japanese Find\" dialog. The \"Japanese Find\" dialog may be accessed from the Find dialog, under Home tab | Editing | Find | Go To... | Search Options | Options.... It could also be found under the Navigation Pane, under Home tab | Editing | Find | < down arrow > | Options... | Sounds Like (Japanese) | Options. The \"Sounds like (Japanese)\" checkbox and the \"Options...\" button may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, you will check the corresponding UI option as specified in this policy setting's title.\r\n\r\nIf you disable or do not configure this policy setting, the corresponding UI option will be unchecked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchseshezeje_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchseshezeje_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchtsithichidhizi","displayName":"Match tsi/thi/chi, dhi/zi (User)","description":"This policy setting allows you to check or uncheck the corresponding UI option in the \"Japanese Find\" dialog. The \"Japanese Find\" dialog may be accessed from the Find dialog, under Home tab | Editing | Find | Go To... | Search Options | Options.... It could also be found under the Navigation Pane, under Home tab | Editing | Find | < down arrow > | Options... | Sounds Like (Japanese) | Options. The \"Sounds like (Japanese)\" checkbox and the \"Options...\" button may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, you will check the corresponding UI option as specified in this policy setting's title.\r\n\r\nIf you disable or do not configure this policy setting, the corresponding UI option will be unchecked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchtsithichidhizi_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchtsithichidhizi_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchvariantformkanjiitaiji","displayName":"Match variant-form kanji (itaiji) (User)","description":"This policy setting allows you to check or uncheck the corresponding UI option in the \"Japanese Find\" dialog. The \"Japanese Find\" dialog may be accessed from the Find dialog, under Home tab | Editing | Find | Go To... | Search Options | Options.... It could also be found under the Navigation Pane, under Home tab | Editing | Find | < down arrow > | Options... | Sounds Like (Japanese) | Options. The \"Sounds like (Japanese)\" checkbox and the \"Options...\" button may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, you will check the corresponding UI option as specified in this policy setting's title.\r\n\r\nIf you disable or do not configure this policy setting, the corresponding UI option will be unchecked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchvariantformkanjiitaiji_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_japanesefind_l_matchvariantformkanjiitaiji_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_alternaterevisionbarpositioninprinteddocument","displayName":"Alternate revision bar position in printed document (User)","description":"Checked: For a multi-column page, revision bars are printed to the side of the column in which the revision appears. | Unchecked: For a multi-column page, revision bars are printed to the side of the page in which the revision appears.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_alternaterevisionbarpositioninprinteddocument_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_alternaterevisionbarpositioninprinteddocument_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_blockallunmanagedaddins","displayName":"Block all unmanaged add-ins (User)","description":"This policy setting blocks all add-ins that are not managed by the \"List of managed add-ins\" policy setting.\r\n\r\nIf you enable this policy setting, and the \"List of managed add-ins\" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the \"List of managed add-ins\" policy setting.\r\n\r\nIf you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the \"List of managed add-ins\" policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_blockallunmanagedaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_blockallunmanagedaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_defaultcustomtab","displayName":"Show custom templates tab by default in Word on the Office Start screen and in File | New (User)","description":"This policy setting controls whether custom templates (when they exist) show as the default tab in Word on the Office Start screen and in File | New. \r\n\r\nIf you enable this policy setting, users will the see custom templates tab as the default tab in Word on the Office Start screen and in File | New when templates exist (this can include Custom XML programmed templates, templates in the Workgroup templates path, templates in the Personal templates path, or SharePoint templates).\r\n\r\nIf you disable or do not configure this policy setting, users will see the Featured templates tab as the default tab in Word on the Office Start screen and in File | New, unless all Office-provided templates have been disabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_defaultcustomtab_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_defaultcustomtab_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_disablemrulistinfontdropdown","displayName":"Disable MRU list in font dropdown (User)","description":"This policy allows you to hide the list of recently used fonts found under Home tab | Font.\r\n\r\nIf you enable this policy setting, the list of recently used fonts will not be shown.\r\n\r\nIf you disable or do not configure this policy setting, the list of recently used fonts will be shown.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_disablemrulistinfontdropdown_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_disablemrulistinfontdropdown_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_disableofficestartword","displayName":"Disable the Office Start screen for Word (User)","description":"This policy setting controls whether the Office Start screen appears on boot for Word.\r\n\r\nIf you enable this policy setting, users will not see the Office Start screen when they boot Word.\r\n\r\nIf you disable or do not configure this policy setting, users will see the Office Start screen when they boot Word.\r\n\r\nNote: This policy setting is overridden by the policy setting \"Microsoft Office 2016 > Miscellaneous > Disable the Office Start screen for all Office applications\" if that policy setting is set.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_disableofficestartword_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_disableofficestartword_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_donotuseonlinemachinetranslation","displayName":"Do not use online machine translation (User)","description":"This policy setting allows you to prevent online machine translation services from being used for the translation of documents and text through the Research pane.\r\n\r\nIf you enable this policy setting, online machine translation services cannot be used to translate documents and text through the Research pane.\r\n\r\nIf you disable or do not configure this policy setting, online machine translation services can be used to translate text through the Research pane.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_donotuseonlinemachinetranslation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_donotuseonlinemachinetranslation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_donotuseonlinetranslationdictionaries","displayName":"Use online translation dictionaries (User)","description":"This policy setting allows you to prevent online dictionaries from being used for the translation of text through the Research pane.\r\n\r\nIf you enable or do not configure this policy setting, the online dictionaries can be used to translate text through the Research pane.\r\n\r\nIf you disable this policy setting, the online dictionaries cannot be used to translate text through the Research pane.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_donotuseonlinetranslationdictionaries_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_donotuseonlinetranslationdictionaries_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_listofmanagedaddins","displayName":"List of managed add-ins (User)","description":"This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the \"Block all unmanaged add-ins\" policy setting.\r\n\r\nTo enable this policy setting, provide the following information for each add-in:\r\n\r\nIn \"Value name,\" specify the programmatic identifier (ProgID) for COM add-ins, or specify the file name of Word add-ins.\r\n\r\nTo obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Office\\Word\\Addins or HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Office\\Word\\Addins.\r\n\r\nTo obtain the file name of an add-in, click the File menu in the application where the add-in is installed. Click Options, click Add-ins, and then use the Location column to determine the file name of the add-in.\r\n\r\nYou can also obtain the ProgID or the file name of an add-in by using Office Telemetry Dashboard.\r\n\r\nIn \"Value,\" specify the value as follows:\r\n\r\nTo specify that an add-in is always disabled (blocked), type 0.\r\n\r\nTo specify that an add-in is always enabled, type 1.\r\n\r\nTo specify that an add-in is configurable by the user and not blocked by the \"Block all unmanaged add-ins\" policy setting when enabled, type 2.\r\n\r\nIf you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the \"Block all unmanaged add-ins\" policy setting is enabled, then all add-ins are blocked.\r\n\r\nTo specify that a Word add-in is always enabled, in addition to configuring this policy setting, you must also specify a location that is used as a trusted source for open files in Word. To do this, configure the \"Trusted Locations\" policy setting at User Configuration\\Administrative Templates\\Microsoft Word 2016\\Word Options\\Security\\Trust Center, and then move the add-in file into the trusted location.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_listofmanagedaddins_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_listofmanagedaddins_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_listofmanagedaddins_l_listofmanagedaddins2","displayName":"List of managed add-ins (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_listofmanagedaddins_l_listofmanagedaddins2_key","displayName":"Name","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_listofmanagedaddins_l_listofmanagedaddins2_value","displayName":"Value","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_personaltemplatespath","displayName":"Personal templates path for Word (User)","description":"This policy setting specifies the location of a user's personal templates. \r\n\r\nIf you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. \r\n\r\nIf you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_personaltemplatespath_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_personaltemplatespath_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_personaltemplatespath_l_personaltemplatespath","displayName":"Personal templates path (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_showpeople","displayName":"Show pictures in comments (User)","description":"This policy setting determines whether or not comments show pictures.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_showpeople_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_showpeople_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_toolscompareandmergedocumentslegalblackline","displayName":"Tools | Compare and Merge Documents, Legal blackline (User)","description":"If you enable this policy setting, a comparison between two documents automatically generates a new Legal Blackline document, leaving the original documents unchanged.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_toolscompareandmergedocumentslegalblackline_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_toolscompareandmergedocumentslegalblackline_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_volumepreference","displayName":"Volume preference (User)","description":"This policy setting allows you to configure Microsoft Word to retain file path information when you work with files on a network server, either as a mapped drive (Z:\\Folder_Name\\File_Name) or as Universal Naming Convention (UNC) (\\\\Share_Name\\File_Name).\r\n\r\nIf you enable this policy setting, you may select one of these options:\r\n- Use Drive letter or UNC as entered\r\n- Convert Drive letter to UNC\r\n- Convert UNC to Drive letter\r\n\r\nIf you disable or do not configure this policy setting, the default option is \"Use Drive letter or UNC as entered.\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_volumepreference_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_volumepreference_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_volumepreference_l_volumepreference179","displayName":"Volume preference (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_volumepreference_l_volumepreference179_0","displayName":"Use Drive letter or UNC as entered","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_volumepreference_l_volumepreference179_2","displayName":"Convert Drive letter to UNC","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178_l_volumepreference_l_volumepreference179_1","displayName":"Convert UNC to Drive letter","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178~l_serversettings_l_turnofffilesynchronizationviasoapoverhttp","displayName":"Turn off file synchronization via SOAP over HTTP (User)","description":"This policy setting controls file synchronization via SOAP over HTTP for Word.\r\n\r\nIf you enable this policy setting, file synchronization via SOAP over HTTP is turned off for Word.\r\n\r\nIf you disable or do not configure this policy setting this policy setting, file synchronization via SOAP over HTTP is turned on for Word.\r\n\r\nNote: Turning off file synchronization via SOAP over HTTP will also prevent co-authoring and adversely affect the behavior of SharePoint Workspaces.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178~l_serversettings_l_turnofffilesynchronizationviasoapoverhttp_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_miscellaneous178~l_serversettings_l_turnofffilesynchronizationviasoapoverhttp_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_reviewtab~l_reviewchinesetranslation_l_convertcommonterms","displayName":"Convert common terms (User)","description":"Checks/unchecks the corresponding UI option in the \"Chinese Conversion\" dialog, which found under Review tab | Convert with Options button. This may only be visible when Chinese is enabled as an editing language.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_reviewtab~l_reviewchinesetranslation_l_convertcommonterms_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_reviewtab~l_reviewchinesetranslation_l_convertcommonterms_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_reviewtab~l_reviewchinesetranslation_l_translationdirection","displayName":"Translation direction (User)","description":"This policy setting allows you to set the default translation direction for Chinese text.\r\n\r\nIf you enable this policy setting, the selected option will check the corresponding checkbox in the \"Chinese Conversion\" dialog. This dialog is found in the Review tab | \"Convert with Options\" button. This may only be visible when Chinese is enabled as an editing language. \r\n\r\nIf you disable or do not configure this policy setting, either translation direction may be set.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_reviewtab~l_reviewchinesetranslation_l_translationdirection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_reviewtab~l_reviewchinesetranslation_l_translationdirection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_reviewtab~l_reviewchinesetranslation_l_translationdirection_l_translationdirection96","displayName":"Translation direction (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_reviewtab~l_reviewchinesetranslation_l_translationdirection_l_translationdirection96_2052","displayName":"Traditional Chinese to Simplified Chinese","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_reviewtab~l_reviewchinesetranslation_l_translationdirection_l_translationdirection96_1028","displayName":"Simplified Chinese to Traditional Chinese","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_reviewtab~l_reviewchinesetranslation_l_usetaiwanhongkongsarandmacaosarcharactervariants","displayName":"Use Taiwan, Hong Kong SAR and Macao SAR character variants (User)","description":"This policy setting allows you to configure the \"Chinese Conversion\" dialog, which is accessed by the \"Convert with Options\" button in the Review tab. This may only be visible when Chinese is enabled as an editing language.\r\n\r\nIf you enable this policy setting, the option is selected.\r\n\r\nIf you disable or do not configure this policy setting, the option is not selected.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_reviewtab~l_reviewchinesetranslation_l_usetaiwanhongkongsarandmacaosarcharactervariants_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_reviewtab~l_reviewchinesetranslation_l_usetaiwanhongkongsarandmacaosarcharactervariants_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_reviewtab~l_reviewsetlanguage_l_detectlanguageautomatically","displayName":"Detect language automatically (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_reviewtab~l_reviewsetlanguage_l_detectlanguageautomatically_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_reviewtab~l_reviewsetlanguage_l_detectlanguageautomatically_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_addbidirectionalmarkswhensavingtextfiles","displayName":"Add Bi-Directional Marks when saving Text files (User)","description":"Checked: Add Bi-Directional Marks when saving Text files. | Unchecked: Do not add Bi-Directional Marks when saving Text files.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_addbidirectionalmarkswhensavingtextfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_addbidirectionalmarkswhensavingtextfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_addcontrolcharactersincutandcopy","displayName":"Add control characters in Cut and Copy (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_addcontrolcharactersincutandcopy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_addcontrolcharactersincutandcopy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_adddoublequoteforhebrewalphabetnumbering","displayName":"Add double quote for Hebrew alphabet numbering (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_adddoublequoteforhebrewalphabetnumbering_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_adddoublequoteforhebrewalphabetnumbering_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_allowa4letterpaperresizing","displayName":"Scale content for A4 or 8.5'' x 11'' paper sizes (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_allowa4letterpaperresizing_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_allowa4letterpaperresizing_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_allowaccenteduppercaseinfrench","displayName":"Allow accented uppercase in French (User)","description":"Checks/unchecks the option ''Enforce accented uppercase in French''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_allowaccenteduppercaseinfrench_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_allowaccenteduppercaseinfrench_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_allowbackgroundsaves","displayName":"Allow background saves (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_allowbackgroundsaves_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_allowbackgroundsaves_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_alwayscreatebackupcopy","displayName":"Always create backup copy (User)","description":"Checks/unchecks the corresponding UI option found under File tab | Options | Advanced | Save.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_alwayscreatebackupcopy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_alwayscreatebackupcopy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_asianfontsalsoapplytolatintext","displayName":"Asian fonts also apply to Latin text (User)","description":"Checks/unchecks the corresponding UI option. This option may be hidden in Word until certain editing languages are enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_asianfontsalsoapplytolatintext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_asianfontsalsoapplytolatintext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_autokeyboardswitching","displayName":"Auto-Keyboard switching (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_autokeyboardswitching_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_autokeyboardswitching_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_automaticallycreatedrawingcanvaswheninsertingautoshapes","displayName":"Automatically create drawing canvas when inserting AutoShapes (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_automaticallycreatedrawingcanvaswheninsertingautoshapes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_automaticallycreatedrawingcanvaswheninsertingautoshapes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_backgroundprinting","displayName":"Print in background (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_backgroundprinting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_backgroundprinting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_backofthesheet","displayName":"Print on back of the sheet for duplex printing (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_backofthesheet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_backofthesheet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_bookmarks","displayName":"Show bookmarks (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_bookmarks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_bookmarks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_chartreftrackingenabled","displayName":"Allow formatting and labels to track data points (User)","description":"This policy setting governs how custom formatting and data labels react to data changes in a chart.\r\n\r\nIf you enable or do not configure this policy setting, when the user creates a new presentation, custom formatting and data labels follow data points as they move or change in any chart in the workbook.\r\n\r\nIf you disable this policy setting, custom formatting and data labels do not follow data points, but instead follow data point indices.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_chartreftrackingenabled_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_chartreftrackingenabled_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_confirmconversionatopen","displayName":"Confirm file format conversion on open (User)","description":"This policy setting allows you to set the \"Confirm file format conversion on open\" option in Word Options | Advanced | General.\r\n\r\nIf you enable this policy setting, \"Confirm file format conversion on open\" will be set.\r\n\r\nIf you disable or do not configure this policy setting, \"Confirm file format conversion on open\" will not be set.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_confirmconversionatopen_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_confirmconversionatopen_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_controlcharacters","displayName":"Show control characters (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_controlcharacters_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_controlcharacters_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_copyremotelystoredfiles","displayName":"Copy remotely stored files onto your computer, and update the remote file when saving (User)","description":"This policy setting allows you to set the \"Copy remotely stored files onto your computer, and update the remote file when saving\" option in Word Options | Advanced | Save.\r\n\r\nIf you enable this policy setting, \"Copy remotely stored files onto your computer, and update the remote file when saving\" will be set.\r\n\r\nIf you disable or do not configure this policy setting, \"Copy remotely stored files onto your computer, and update the remote file when saving\" will not be set.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_copyremotelystoredfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_copyremotelystoredfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_custommarkupwarning","displayName":"Custom markup warning (User)","description":"This policy setting specifies how Word behaves when opening a document that contains custom XML markup.\r\n\r\nIf you enable this policy setting, you can set the behavior to one of the following: \r\n\r\n- 0: Do not prompt the user and silently remove the custom XML markup. \r\n\r\n- 1: Prompt the user regarding the loss of custom XML markup. This is the default option. \r\n\r\n- 2: Prompt the user regarding the loss of custom XML markup, and do not allow them to suppress this prompt. \r\n\r\n- 3: Prompt the user regarding the loss of custom XML markup, and open the file read-only. \r\n\r\n- 4: Prompt the user regarding the loss of custom XML markup, do not allow them to suppress this prompt, and open the file read-only. \r\n\r\n- 5: Do not prompt the user and silently remove the custom XML markup, but open the file read-only.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_custommarkupwarning_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_custommarkupwarning_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_custommarkupwarning_l_custommarkupwarningdropid","displayName":"Custom markup warning: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_custommarkupwarning_l_custommarkupwarningdropid_0","displayName":"Do not prompt","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_custommarkupwarning_l_custommarkupwarningdropid_1","displayName":"Prompt","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_custommarkupwarning_l_custommarkupwarningdropid_2","displayName":"Always prompt","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_custommarkupwarning_l_custommarkupwarningdropid_3","displayName":"Prompt and open the file read-only","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_custommarkupwarning_l_custommarkupwarningdropid_4","displayName":"Always prompt and open the file read-only","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_custommarkupwarning_l_custommarkupwarningdropid_5","displayName":"Do not prompt and open the file read-only","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_diacritics","displayName":"Diacritics (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_diacritics_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_diacritics_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_differentcolorfordiacritics","displayName":"Use this color for diacritics (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_differentcolorfordiacritics_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_differentcolorfordiacritics_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_documentview","displayName":"Document view (User)","description":"Used for complex scripts. Specifies if documents shall be displayed Right-to-left or Left-to-right.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_documentview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_documentview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_documentview_l_documentview7","displayName":"Document view (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_documentview_l_documentview7_1","displayName":"Right-to-left","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_documentview_l_documentview7_0","displayName":"Left-to-Right","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_draftfont","displayName":"Use draft font in Draft and Outline views (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_draftfont_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_draftfont_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_draftoutput","displayName":"Use draft quality (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_draftoutput_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_draftoutput_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_draganddroptextediting","displayName":"Allow text to be dragged and dropped (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_draganddroptextediting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_draganddroptextediting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_drawings","displayName":"Show drawings and text boxes on screen (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_drawings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_drawings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_enableclickandtype","displayName":"Enable click and type (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_enableclickandtype_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_enableclickandtype_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_englishword6095documents","displayName":"English Word 6.0/95 documents (User)","description":"Sets the option to convert the file correctly.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_englishword6095documents_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_englishword6095documents_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_englishword6095documents_l_englishword6095documents11","displayName":"English Word 6.0/95 documents (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_englishword6095documents_l_englishword6095documents11_0","displayName":"Contain Asian text","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_englishword6095documents_l_englishword6095documents11_1","displayName":"Open normally","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_englishword6095documents_l_englishword6095documents11_2","displayName":"Automatically detect Asian text","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_expandcollapseuimaximumzoomlevel","displayName":"Set the maximum zoom level for expand / collapse on-object UI (User)","description":"This policy setting allows you to specify the maximum zoom level percentage at which point the expand/collapse on-object UI stops rendering. Regardless of the value specified for this policy setting, the expand / collapse feature is still available from the context menu for headings.\r\n\r\nIf you enable this policy setting, you can specify a maximum zoom level percentage from 0-500. If you specify a value of 0, the on-object UI never renders.\r\n\r\nIf you disable or do not configure this policy setting, there will be no maximum.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_expandcollapseuimaximumzoomlevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_expandcollapseuimaximumzoomlevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_expandcollapseuimaximumzoomlevel_l_setexpandcollapseuimaximumzoomlevelspinid","displayName":"Set the maximum zoom level for expand / collapse on-object UI (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_expandcollapseuiminimumzoomlevel","displayName":"Set the minimum zoom level for expand / collapse on-object UI (User)","description":"This policy setting allows you to specify the minimum zoom level percentage at which point the expand/collapse on-object UI stops rendering. Regardless of the value specified for this policy setting, the expand / collapse feature is still available from the context menu for headings.\r\n\r\nIf you enable this policy setting, you can specify a minimum zoom level percentage from 0-500.\r\n\r\nIf you disable or do not configure this policy setting, the minimum zoom level is set to 50%.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_expandcollapseuiminimumzoomlevel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_expandcollapseuiminimumzoomlevel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_expandcollapseuiminimumzoomlevel_l_setexpandcollapseuiminimumzoomlevelspinid","displayName":"Set the minimum zoom level for expand / collapse on-object UI (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_fieldcodes","displayName":"Show field codes instead of their values (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_fieldcodes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_fieldcodes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_fieldshading","displayName":"Field shading (User)","description":"Specifies when field shading is displayed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_fieldshading_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_fieldshading_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_fieldshading_l_fieldshading6","displayName":"Field shading (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_fieldshading_l_fieldshading6_0","displayName":"Never","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_fieldshading_l_fieldshading6_1","displayName":"Always","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_fieldshading_l_fieldshading6_2","displayName":"When selected","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_frontofsheet","displayName":"Print on front of the sheet for duplex printing (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_frontofsheet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_frontofsheet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_horizontalscrollbar","displayName":"Show horizontal scroll bar (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_horizontalscrollbar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_horizontalscrollbar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_imecontrolactive","displayName":"IME Control Active (User)","description":"Checks/unchecks the corresponding UI option. This option only appears if you configure Word to use an IME.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_imecontrolactive_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_imecontrolactive_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_imetrueinline","displayName":"IME TrueInLine (User)","description":"Checks/unchecks the corresponding UI option. This option only appears if you configure Word to use an IME.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_imetrueinline_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_imetrueinline_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_keeptrackofformatting","displayName":"Keep track of formatting (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_keeptrackofformatting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_keeptrackofformatting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_leftscrollbar","displayName":"Left scroll bar (User)","description":"Checks/unchecks the corresponding UI option. This option is only available if support for right-to-left languages is enabled through Microsoft Office Language Preferences. This setting also sets Right ruler (Print view only).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_leftscrollbar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_leftscrollbar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies","displayName":"Mark formatting inconsistencies (User)","description":"Defines color to use for marking formatting inconsistencies.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_checktoenforcesettingonunchecktoenforcesettingoff18","displayName":"Check to enforce setting on; uncheck to enforce setting off (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_checktoenforcesettingonunchecktoenforcesettingoff18_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_checktoenforcesettingonunchecktoenforcesettingoff18_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies","displayName":"Color for marking formatting inconsistencies (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_0","displayName":"Black","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_255","displayName":"Blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_128","displayName":"Dark Blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_3368703","displayName":"Light Blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_52479","displayName":"Sky Blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_10079487","displayName":"Pale Blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_6710937","displayName":"Blue Gray","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_65280","displayName":"Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_32768","displayName":"Dark Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_13056","displayName":"Darker Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_13434828","displayName":"Light Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_3355392","displayName":"Olive Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_3381606","displayName":"Sea Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_16711680","displayName":"Red","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_8388608","displayName":"Dark Red","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_16776960","displayName":"Yellow","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_8421376","displayName":"Dark Yellow","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_16777113","displayName":"Light Yellow","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_16777215","displayName":"White","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_10040064","displayName":"Brown","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_16737792","displayName":"Orange","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_16750848","displayName":"Light Orange","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_65535","displayName":"Cyan","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_32896","displayName":"Dark Cyan","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_13434879","displayName":"Light Cyan","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_16711935","displayName":"Magenta","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_8388736","displayName":"Dark Magenta","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_13158","displayName":"Dark Teal","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_3355545","displayName":"Indigo","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_10079232","displayName":"Lime","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_3394764","displayName":"Aqua","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_16763904","displayName":"Gold","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_10040166","displayName":"Plum","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_16751052","displayName":"Rose","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_16764057","displayName":"Tan","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_13408767","displayName":"Lavender","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_8421504","displayName":"Gray","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_markformattinginconsistencies_l_colorformarkingformattinginconsistencies_12632256","displayName":"Gray 25%","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_measurementunits","displayName":"Show measurements in units of (User)","description":"Selects the default measurement unit for the horizontal ruler and for measurements in dialog boxes.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_measurementunits_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_measurementunits_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_measurementunits_l_selectunits","displayName":"Select units: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_measurementunits_l_selectunits_0","displayName":"Inches","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_measurementunits_l_selectunits_2","displayName":"Centimeters","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_measurementunits_l_selectunits_4","displayName":"Millimeters","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_measurementunits_l_selectunits_1","displayName":"Points","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_measurementunits_l_selectunits_3","displayName":"Picas","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_monthnames","displayName":"Month names (User)","description":"Used for complex scripts. Specifies if month names shall be of calendar type Gregorian Arabic, Gregorian transliterated English, or Gregorian transliterated French.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_monthnames_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_monthnames_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_monthnames_l_monthnames17","displayName":"Month names (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_monthnames_l_monthnames17_0","displayName":"Arabic","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_monthnames_l_monthnames17_1","displayName":"English transliterated","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_monthnames_l_monthnames17_2","displayName":"French transliterated","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_movement","displayName":"Cursor movement (User)","description":"Used for complex scripts. Specifies if logical or visual cursor control shall be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_movement_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_movement_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_movement_l_movement4","displayName":"Cursor movement (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_movement_l_movement4_0","displayName":"Logical","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_movement_l_movement4_1","displayName":"Visual","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_numeral","displayName":"Numeral (User)","description":"Used for complex scripts. Specifies if numerals shall be displayed as Arabic, Hindi, Context, or System numerals. ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_numeral_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_numeral_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_numeral_l_numeral16","displayName":"Numeral (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_numeral_l_numeral16_0","displayName":"Arabic","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_numeral_l_numeral16_1","displayName":"Hindi","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_numeral_l_numeral16_2","displayName":"Context","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_numeral_l_numeral16_3","displayName":"System","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_pictureplaceholders","displayName":"Show picture placeholders (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_pictureplaceholders_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_pictureplaceholders_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_promptbeforesavingnormaltemplate","displayName":"Prompt before saving Normal template (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_promptbeforesavingnormaltemplate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_promptbeforesavingnormaltemplate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_prompttoupdatestyle","displayName":"Prompt to update style (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_prompttoupdatestyle_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_prompttoupdatestyle_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_providefeedbackwithanimation","displayName":"Provide feedback with animation (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_providefeedbackwithanimation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_providefeedbackwithanimation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_recentlyusedfilelist","displayName":"Number of documents in the Recent Documents list (User)","description":"This policy setting specifies the number of entries displayed in the Recent Documents list that appears when users click Open on the File tab in Backstage view.\r\n\r\nIf you enable this policy setting, you can specify the number of entries to be between 0 and 50. If you set the number to 0, all pinned and unpinned entries are hidden.\r\n\r\nIf you disable or do not configure this policy setting, a maximum of 25 items will be displayed in the Recent Documents list.\r\n\r\nNote: If you want to prevent items from being added to the Recent Documents list entirely, you can enable the \"Do not keep history of recently opened documents\" Windows policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_recentlyusedfilelist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_recentlyusedfilelist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_recentlyusedfilelist_l_numberofentries","displayName":"Number of entries: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_reverseprintorder","displayName":"Print pages in reverse order (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_reverseprintorder_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_reverseprintorder_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_setnumberofplacesintherecentplaceslist","displayName":"Number of folders in the Recent Folders list (User)","description":"This policy setting specifies the number of unpinned entries displayed in the Recent Folders list that appears when users click Open or Save As on the File tab in Backstage view.\r\n\r\nIf you enable this policy setting, you can specify the number of unpinned entries to be between 0 and 20. If you set the number to 0, all pinned and unpinned entries are hidden.\r\n\r\nIf you disable or do not configure this policy setting, a maximum of 5 unpinned items are displayed in the Recent Folders list.\r\n\r\nNote: If you want to prevent items from being added to the Recent Folders list entirely, you can enable the \"Do not keep history of recently opened documents\" Windows policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_setnumberofplacesintherecentplaceslist_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_setnumberofplacesintherecentplaceslist_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_setnumberofplacesintherecentplaceslist_l_setnumberofplacesintherecentplaceslistspinid","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_showpixelsforhtmlfeatures","displayName":"Show pixels for HTML features (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_showpixelsforhtmlfeatures_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_showpixelsforhtmlfeatures_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_styleareawidth","displayName":"Style area pane width in Draft and Outline views (User)","description":"This policy setting allows you to set the width of the style area that shows the names of applied styles to the side of document text.\r\n\r\nIf you enable this policy setting, you may specify the width of the style area.\r\n\r\nIf you disable or do not configure this policy setting, the default width is used.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_styleareawidth_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_styleareawidth_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_styleareawidth_l_styleareawidth8","displayName":"Style area pane width in Draft and Outline views (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_styleareawidth_l_styleareawidth8_0","displayName":"0''","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_styleareawidth_l_styleareawidth8_24","displayName":"0.25''","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_styleareawidth_l_styleareawidth8_48","displayName":"0.5''","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_styleareawidth_l_styleareawidth8_72","displayName":"0.75''","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_styleareawidth_l_styleareawidth8_96","displayName":"1''","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_styleareawidth_l_styleareawidth8_120","displayName":"1.25''","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_styleareawidth_l_styleareawidth8_144","displayName":"1.5''","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_styleareawidth_l_styleareawidth8_168","displayName":"1.75''","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_styleareawidth_l_styleareawidth8_192","displayName":"2''","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_styleareawidth_l_styleareawidth8_216","displayName":"2.25''","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_styleareawidth_l_styleareawidth8_240","displayName":"2.5''","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_textboundaries","displayName":"Show text boundaries (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_textboundaries_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_textboundaries_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_typeandreplace","displayName":"Type and replace (User)","description":"This policy setting allows you to check or uncheck the \"Type and Replace\" checkbox found under File tab | Options | Advanced. This checkbox may only be shown when certain South East Asian languages, such as Thai or Vietnamese, are enabled.\r\n\r\nSouth Asian languages follow stringent grammatical rules that dictate which textual character elements are allowed next to one another in the composition of words. To compound the complexity of correctly entering South Asian characters, text includes both simple characters and characters that include one or more markings such as diacritics, tone marks, vowels, and accents— for example, in Thai, leading vowels are normally followed by a consonant that does or does not include vowel markings, but diacritics are located below it.\r\n\r\nTo assist you in correctly entering characters in your document that prescribe to the grammar rules for the enabled South Asian language, Word can automatically check the text for you. Word can also make logical substitutions for you by using Type and Replace, a complementary feature.\r\n\r\nSequence checking can be used by itself or in combination with Type and Replace. When sequence checking only is selected, Word will not allow an invalid character to be typed at the insertion point. If Type and Replace is also selected, Word will insert or replace an existing character to make a valid sequence.\r\n\r\nIf you enable or do not configure this policy setting, the \"Type and Replace\" checkbox is checked.\r\n\r\nIf you disable this policy setting, the \"Type and Replace\" checkbox is unchecked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_typeandreplace_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_typeandreplace_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_typingreplacesselection","displayName":"Typing replaces selected text (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_typingreplacesselection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_typingreplacesselection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_updateautomaticlinksatopen","displayName":"Update automatic links at Open (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_updateautomaticlinksatopen_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_updateautomaticlinksatopen_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_usecharacterunits","displayName":"Show measurements in width of characters (User)","description":"Checks/unchecks the corresponding UI option. This option may be hidden in Word until certain editing languages are enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_usecharacterunits_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_usecharacterunits_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_usectrlclicktofollowhyperlink","displayName":"Use CTRL + Click to follow hyperlink (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_usectrlclicktofollowhyperlink_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_usectrlclicktofollowhyperlink_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_usesequencechecking","displayName":"Use sequence checking (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_usesequencechecking_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_usesequencechecking_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_usesmartparagraphselection","displayName":"Use smart paragraph selection (User)","description":"This policy setting controls the \"Use smart paragraph selection\" option found under File tab | Options | Advanced | Editing options.\r\n\r\nIf you enable or do not configure this policy setting, Word will automatically select the paragraph mark at the end of a selected range of text.\r\n\r\nIf you disable this policy setting, Word will not automatically select the paragraph mark at the end of a selected range of text. However, a user can still select the paragraph mark manually.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_usesmartparagraphselection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_usesmartparagraphselection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_usetheinskeyforpaste","displayName":"Use the Insert key for paste (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_usetheinskeyforpaste_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_usetheinskeyforpaste_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_verticalrulerprintviewonly","displayName":"Show vertical ruler in Print Layout view (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_verticalrulerprintviewonly_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_verticalrulerprintviewonly_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_verticalscrollbar","displayName":"Show vertical scroll bar (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_verticalscrollbar_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_verticalscrollbar_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_visualselection","displayName":"Cursor visual selection (User)","description":"Specifies if Block or Continuous selection shall be used. Block selection parodies the selection behavior within the Windows explorer when files in a folder. You draw a rectangle with the curson, and everything inside the rectangle is selected.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_visualselection_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_visualselection_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_visualselection_l_visualselection5","displayName":"Cursor visual selection (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_visualselection_l_visualselection5_0","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_visualselection_l_visualselection5_1","displayName":"Continuous","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_whenselectingautomaticallyselectentireword","displayName":"When selecting, automatically select entire word (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_whenselectingautomaticallyselectentireword_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_whenselectingautomaticallyselectentireword_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_wraptowindow","displayName":"Show text wrapped within the document window (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_wraptowindow_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced_l_wraptowindow_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_emailoptions_l_relyoncssforfontformatting","displayName":"Rely on CSS for font formatting (User)","description":"This policy setting allows you to configure the \"Use Cascading Style Sheets (CSS) for appearance of messages\" option found under Microsoft Outlook's File tab | Outlook Options | Mail | Message format.\r\n\r\nIf you enable this policy setting, the option is checked.\r\n\r\nIf you disable or do not configure this policy setting, the option is not checked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_emailoptions_l_relyoncssforfontformatting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_emailoptions_l_relyoncssforfontformatting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_autorecoverfiles","displayName":"AutoRecover files (User)","description":"Defines the default path for storing AutoRecover files.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_autorecoverfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_autorecoverfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_autorecoverfiles_l_autorecoverfiles13","displayName":"AutoRecover files (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_clipartpictures","displayName":"Clipart pictures (User)","description":"This policy setting allows you to define the default path to Clipart pictures that is set in Word Options | Advanced | General | \"File Locations...\"\r\n\r\nIf you enable this policy setting, you may specify the default path to Clipart pictures.\r\n\r\nIf you disable or do not configure this policy setting, no path is specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_clipartpictures_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_clipartpictures_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_clipartpictures_l_clipartpictures12","displayName":"Clipart pictures (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_defaultfilelocation","displayName":"Default File Location (User)","description":"Defines the default path to documents.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_defaultfilelocation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_defaultfilelocation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_defaultfilelocation_l_documents","displayName":"Documents (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_startup","displayName":"Startup (User)","description":"Defines the default path to Word's Startup folder.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_startup_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_startup_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_startup_l_startup15","displayName":"Startup (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_tools","displayName":"Tools (User)","description":"Defines the default path to tools.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_tools_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_tools_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_filelocations_l_tools_l_tools14","displayName":"Tools (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_adjustformattingwhenpastingfrommicrosoftexcel","displayName":"Adjust formatting when pasting from Microsoft Excel (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_adjustformattingwhenpastingfrommicrosoftexcel_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_adjustformattingwhenpastingfrommicrosoftexcel_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_adjustparagraphspacingonpaste","displayName":"Adjust paragraph spacing on paste (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_adjustparagraphspacingonpaste_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_adjustparagraphspacingonpaste_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_adjustsentenceandwordspacingautomatically","displayName":"Adjust sentence and word spacing automatically (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_adjustsentenceandwordspacingautomatically_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_adjustsentenceandwordspacingautomatically_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_adjusttableformattingandalignmentonpaste","displayName":"Adjust table formatting and alignment on paste (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_adjusttableformattingandalignmentonpaste_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_adjusttableformattingandalignmentonpaste_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_mergeformattingwhenpastingfrompowerpoint","displayName":"Merge formatting when pasting from PowerPoint (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_mergeformattingwhenpastingfrompowerpoint_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_mergeformattingwhenpastingfrompowerpoint_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_mergepastedlistswithsurroundinglists","displayName":"Merge pasted lists with surrounding lists (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_mergepastedlistswithsurroundinglists_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_mergepastedlistswithsurroundinglists_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_smartstylebehavior","displayName":"Smart style behavior (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_smartstylebehavior_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_smartcutandpaste_l_smartstylebehavior_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_weboptions~l_browser_l_disablefeaturesnotsupportedbyspecifiedbrowsers","displayName":"Disable features not supported by specified browsers (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_weboptions~l_browser_l_disablefeaturesnotsupportedbyspecifiedbrowsers_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_weboptions~l_browser_l_disablefeaturesnotsupportedbyspecifiedbrowsers_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_weboptions~l_files_l_checkifwordisthedefaulteditorforallotherwebpages","displayName":"Check if Word is the default editor for all other Web pages (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_weboptions~l_files_l_checkifwordisthedefaulteditorforallotherwebpages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_weboptions~l_files_l_checkifwordisthedefaulteditorforallotherwebpages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_documentproperties","displayName":"Print document properties (User)","description":"This policy setting allows you to control the \"Print document properties\" setting found under File tab | Options | Display | Printing options.\r\n\r\nIf you enable this policy setting, Word will print an additional page with the printed document's properties, including the document's author, filename, creation date, etc., for every document that is printed.\r\n\r\nIf you disable or do not configure this policy setting, no additional page will be printed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_documentproperties_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_documentproperties_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_drawingobjects","displayName":"Print drawings created in Word (User)","description":"This policy setting allows you to configure the \"Print drawings created in Word\" setting found under File tab | Options | Display | Printing options.\r\n\r\nIf you enable this policy setting, Word will print graphics and floating text boxes. \r\n\r\nIf you disable or do not configure this policy setting, Word will not print graphics or floating text boxes. Instead, Word will print a blank box in the place of each graphic and floating text box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_drawingobjects_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_drawingobjects_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_hiddentext","displayName":"Hidden text (User)","description":"This policy setting controls whether text that is formatted as hidden displays on Word users' monitor screens.\r\n\r\nIf you enable this policy setting, Word displays hidden text at all times. Hidden text on monitor screens displays as underlined with a dotted line.\r\n\r\nIf you disable or do not configure this policy setting, Word does not display text formatted as hidden unless \"Show/Hide ¶\" is selected or Word is configured to show hidden text in the \"Display\" section of the \"Word Options\" dialog.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_hiddentext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_hiddentext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_highlight","displayName":"Show highlighter marks (User)","description":"This policy setting controls highlighter marks.\r\n\r\nIf you enable this policy setting, highlighter marks, both on screen and when printing, will be shown.\r\n\r\nIf you disable or do not configure this policy setting, highlighter marks, both on screen and when printing, will be hidden.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_highlight_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_highlight_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_objectanchors","displayName":"Object anchors (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_objectanchors_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_objectanchors_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_optionalbreaks","displayName":"Optional breaks (User)","description":"Determines whether the symbol used to represent optional breaks is shown on the screen.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_optionalbreaks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_optionalbreaks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_optionalhyphens","displayName":"Optional hyphens (User)","description":"Determines whether the symbol used to represent optional hyphens is shown on the screen.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_optionalhyphens_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_optionalhyphens_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_paragraphmarks","displayName":"Paragraph marks (User)","description":"Determines whether the symbol used to represent the end of paragraphs is shown on the screen.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_paragraphmarks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_paragraphmarks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_screentips","displayName":"Show document tooltips on hover (User)","description":"Determines whether the symbol used to represent Screen Tips are shown in the document.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_screentips_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_screentips_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_spaces","displayName":"Spaces (User)","description":"Determines whether the symbol used to represent spaces is shown on the screen.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_spaces_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_spaces_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_tabcharacters","displayName":"Tab characters (User)","description":"Determines whether the symbol used to represent tabs is shown on the screen.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_tabcharacters_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_tabcharacters_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_updatefields","displayName":"Update fields before printing (User)","description":"This policy setting allows you to configure the \"Update fields before printing\" setting found under File tab | Options | Display | Printing options.\r\n\r\nIf you enable this policy setting, Word will update fields in the document before the document is printed.\r\n\r\nIf you disable or do not configure this policy setting, Word will not update fields in the document before the document is printed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_updatefields_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_updatefields_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_updatelinks","displayName":"Update linked data before printing (User)","description":"This policy setting controls the \"Update linked data before printing\" setting found under File tab | Options | Display | Printing options.\r\n\r\nIf you enable this policy setting, Word will update linked data in the document before the document is printed. One example of linked data in Word is an embedded Excel chart that is linked to an Excel spreadsheet.\r\n\r\nIf you disable or do not configure this policy setting, Word will not update linked data in the document before the document is printed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_updatelinks_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_updatelinks_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_whitespacebetweenpagesprintviewonly","displayName":"Show white space between pages in Print Layout view (User)","description":"Determines whether the symbol used to represent white space between pages in Print view only is shown in the document.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_whitespacebetweenpagesprintviewonly_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_display_l_whitespacebetweenpagesprintviewonly_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionscustomizeribbon_l_displaydevelopertab","displayName":"Display Developer tab in the Ribbon (User)","description":"This policy setting controls whether the Developer tab will be displayed in the Ribbon.\r\n\r\nIf you enable this policy setting, the Developer tab will be displayed in the Ribbon.\r\n\r\nIf you disable this policy setting, the Developer tab will not be displayed in the Ribbon.\r\n\r\nIf you do not configure this policy setting, the Developer tab will not be displayed in the Ribbon, but its visibility can be changed via a setting in the application Options dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionscustomizeribbon_l_displaydevelopertab_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionscustomizeribbon_l_displaydevelopertab_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_alertifnotdefault","displayName":"Prompt the user if Word is not the default application for its file extensions (User)","description":"\r\n This policy setting specifies whether to prompt users to change their file extensions association if any of the file type extensions that were associated with Word, are no longer associated with Word.\r\n\r\n If you enable this policy setting, users will never be prompted on program start whenever any of these file types are associated with other applications. If the policy is Enabled, the checkbox under “File->Options-> General -> Start up options-> Tell me …” is Disabled and Unchecked.\r\n\r\n If you disable or do not configure this policy setting users will be prompted on program start whenever any of these file types are associated with other applications. Users can change the behavior of the feature either by checking the checkbox presented in the prompt or by checking the checkbox under “File->Options-> General -> Start up options-> Tell me …”\r\n If the policy is Not Configured or disabled the checkbox is Enabled and Checked by default.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_alertifnotdefault_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_alertifnotdefault_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_allowselectionfloaties","displayName":"Show Mini Toolbar on selection (User)","description":"Disabling this policy setting will result in Mini Toolbar not being displayed on text selection. By default, Mini Toolbar on selection is enabled and its visibility can be changed via a setting in the Word Options dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_allowselectionfloaties_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_allowselectionfloaties_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_digitalprint","displayName":"Don't show the option to transform a document to a Sway web page (User)","description":"This policy setting controls whether the File menu option to transform a Word document to a Sway web page is shown to the user. By default, this option is shown to the user.\r\n\r\nIf you enable this policy setting, the File menu option to transform a Word document to a Sway web page is hidden from the user. \r\n\r\nIf you disable or don't configure this policy setting, the File menu option to transform a Word document to a Sway web page is shown to the user.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_digitalprint_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_digitalprint_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_enablelivepreview","displayName":"Enable Live Preview (User)","description":"This policy setting configures the \"Enable Live Preview\" checkbox found under File tab | Options | General. Live Preview shows how a command would be applied without actually applying it to the document.\r\n\r\nIf you enable this policy setting, the option is checked, and Live Preview will be shown when using Galleries that support previews\r\n\r\nIf you disable or do not configure this policy setting, the option is unchecked, and Live Preview will be hidden when using Galleries that support previews.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_enablelivepreview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_enablelivepreview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_linkedinresumeassistant","displayName":"Allow LinkedIn Resume Assistant feature (User)","description":"This policy setting controls whether the LinkedIn Resume Assistant appears in Word.\r\n\r\nIf you enable or do not configure this policy, users will be able to use the LinkedIn Resume Assistant.\r\n\r\nIf you disable this policy setting, the LinkedIn Resume Assistant will not be available.\r\n\r\nImportant: This policy setting only applies to Office 365 clients that are installed by using Click-to-Run, including Office 365 ProPlus, Office 365 Business, Visio Pro for Office 365 and Project Pro for Office 365. It doesn't apply to Office products that use Windows Installer (MSI).\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_linkedinresumeassistant_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_linkedinresumeassistant_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_onlinevideos","displayName":"Allow Online Videos to play within Word (User)","description":"This policy setting controls whether online videos can be played within Word.\r\n\r\nIf you enable or do not configure this policy, users will be able to play online videos within Word.\r\n\r\nIf you disable this policy setting, you will not be able to play online videos within Word.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_onlinevideos_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_onlinevideos_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_openattachmentsforfullscreenreading","displayName":"Open e-mail attachments in Reading View (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_openattachmentsforfullscreenreading_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_openattachmentsforfullscreenreading_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_openattachmentsforfullscreenreading_l_checktoallowstartinginreadinglayout","displayName":"Check to allow starting in Reading Layout (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_openattachmentsforfullscreenreading_l_checktoallowstartinginreadinglayout_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_openattachmentsforfullscreenreading_l_checktoallowstartinginreadinglayout_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype","displayName":"Mark grammar errors as you type (User)","description":"Defines color to use for marking grammatical errors.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_checktoenforcesettingonunchecktoenforcesettingoff0","displayName":"Check to enforce setting on; uncheck to enforce setting off (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_checktoenforcesettingonunchecktoenforcesettingoff0_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_checktoenforcesettingonunchecktoenforcesettingoff0_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors","displayName":"Color for marking grammatical errors (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_0","displayName":"Black","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_255","displayName":"Blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_128","displayName":"Dark Blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_3368703","displayName":"Light Blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_52479","displayName":"Sky Blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_10079487","displayName":"Pale Blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_6710937","displayName":"Blue Gray","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_65280","displayName":"Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_32768","displayName":"Dark Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_13056","displayName":"Darker Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_13434828","displayName":"Light Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_3355392","displayName":"Olive Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_3381606","displayName":"Sea Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_16711680","displayName":"Red","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_8388608","displayName":"Dark Red","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_16776960","displayName":"Yellow","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_8421376","displayName":"Dark Yellow","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_16777113","displayName":"Light Yellow","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_16777215","displayName":"White","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_10040064","displayName":"Brown","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_16737792","displayName":"Orange","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_16750848","displayName":"Light Orange","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_65535","displayName":"Cyan","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_32896","displayName":"Dark Cyan","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_13434879","displayName":"Light Cyan","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_16711935","displayName":"Magenta","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_8388736","displayName":"Dark Magenta","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_13158","displayName":"Dark Teal","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_3355545","displayName":"Indigo","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_10079232","displayName":"Lime","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_3394764","displayName":"Aqua","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_16763904","displayName":"Gold","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_10040166","displayName":"Plum","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_16751052","displayName":"Rose","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_16764057","displayName":"Tan","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_13408767","displayName":"Lavender","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_8421504","displayName":"Gray","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarasyoutype_l_colorformarkinggrammaticalerrors_12632256","displayName":"Gray 25%","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarwithspelling","displayName":"Check grammar with spelling (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarwithspelling_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_checkgrammarwithspelling_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_delaybeforestartingbackgroundspellingchecker","displayName":"Delay before starting background spelling checker (User)","description":"This policy setting allows you to configure when the background spell check is started.\r\n\r\nIf you enable this policy setting, you may specify the delay, in milliseconds, before the background spell check is started. This setting only applies when Word is running in a terminal server session.\r\n\r\nIf you disable or do not configure this policy setting, Word will behave normally when in a terminal server session.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_delaybeforestartingbackgroundspellingchecker_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_delaybeforestartingbackgroundspellingchecker_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_delaybeforestartingbackgroundspellingchecker_l_delaybeforestartingbackgroundspellingchecker3","displayName":"Milliseconds (e.g. 5000 milliseconds = 5 seconds) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_delaybeforestartingotherproofingtools","displayName":"Delay before starting other proofing tools (User)","description":"This policy setting allows you to configure when the background grammar check is started.\r\n\r\nIf you enable this policy setting, you may specify the delay, in milliseconds, before the background grammar check is started. This setting only applies when Word is running in a terminal server session.\r\n\r\nIf you disable or do not configure this policy setting, Word will behave normally when in a terminal server session.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_delaybeforestartingotherproofingtools_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_delaybeforestartingotherproofingtools_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_delaybeforestartingotherproofingtools_l_delaybeforestartingbackgroundgrammarchecker3","displayName":"Milliseconds (e.g. 5000 milliseconds = 5 seconds) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_donotenableadditionalactionsintherightclickmenu","displayName":"Do not enable additional actions in the right-click menu (User)","description":"This policy setting allows you to configure the \"Enable additional actions in the right-click menu\" button found under File tab | Options | Proofing | Autocorrect Options... | Actions.\r\n\r\nIf you enable this policy setting, the checkbox will not be checked, and Additional Actions recognition will be turned off.\r\n\r\nIf you disable or do not configure this policy setting, the checkbox will be checked, and Additional Actions recognition will be turned on.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_donotenableadditionalactionsintherightclickmenu_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_donotenableadditionalactionsintherightclickmenu_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_showreadabilitystatistics","displayName":"Show readability statistics (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_showreadabilitystatistics_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_showreadabilitystatistics_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_writingstyle","displayName":"Writing style (User)","description":"Specifies the writing style Word uses when checking the active document.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_writingstyle_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_writingstyle_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_writingstyle_l_writingstyle1","displayName":"Writing style (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_writingstyle_l_writingstyle1_0","displayName":"Grammar & Style","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing_l_writingstyle_l_writingstyle1_1","displayName":"Grammar Only","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autocorrect_l_capitalizefirstletterofsentence","displayName":"Capitalize first letter of sentence (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autocorrect_l_capitalizefirstletterofsentence_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autocorrect_l_capitalizefirstletterofsentence_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autocorrect_l_capitalizenamesofdays","displayName":"Capitalize names of days (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autocorrect_l_capitalizenamesofdays_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autocorrect_l_capitalizenamesofdays_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autocorrect_l_correctaccidentalusageofcapslockkey","displayName":"Correct accidental usage of cAPS LOCK key (User)","description":"This policy setting allows you to set the \"Correct accidental usage of cAPS LOCK key\" option in Word Options | Proofing | \"AutoCorrect Options...\" | AutoCorrect.\r\n\r\nIf you enable this policy setting, \"Correct accidental usage of cAPS LOCK key\" will be set.\r\n\r\nIf you disable or do not configure this policy setting, \"Correct accidental usage of cAPS LOCK key\" will not be set.y","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autocorrect_l_correctaccidentalusageofcapslockkey_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autocorrect_l_correctaccidentalusageofcapslockkey_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autocorrect_l_correctkeyboardsetting","displayName":"Correct keyboard setting (User)","description":"This policy setting allows you to set the \"Correct keyboard setting\" option in Word Options | Proofing | \"AutoCorrect Options...\" | AutoCorrect.\r\n\r\nIf you enable this policy setting, \"Correct keyboard setting\" will be set.\r\n\r\nIf you disable or do not configure this policy setting, \"Correct keyboard setting\" will not be set.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autocorrect_l_correctkeyboardsetting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autocorrect_l_correctkeyboardsetting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autocorrect_l_correcttwoinitialcapitals","displayName":"Correct TWo INitial CApitals (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autocorrect_l_correcttwoinitialcapitals_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autocorrect_l_correcttwoinitialcapitals_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autocorrect_l_replacetextasyoutype","displayName":"Replace text as you type (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autocorrect_l_replacetextasyoutype_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autocorrect_l_replacetextasyoutype_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_automaticbulletedlists","displayName":"Automatic bulleted lists (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_automaticbulletedlists_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_automaticbulletedlists_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_automaticnumberedlists","displayName":"Automatic numbered lists (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_automaticnumberedlists_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_automaticnumberedlists_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_borderlines","displayName":"Border lines (User)","description":"Checks/unchecks the option \"Border Lines.\"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_borderlines_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_borderlines_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_closingstyletoletterclosings","displayName":"Closing style to letter closings (User)","description":"This policy setting allows you to set the \"Closing style to letter closings\" option found in Word Options | Proofing | AutoCorrect Options... | AutoFormat As You Type.\r\n\r\nIf you enable this policy setting, \"Closing style to letter closings\" will be set.\r\n\r\nIf you disable or do not configure this policy setting, \"Closing style to letter closings\" will not be set.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_closingstyletoletterclosings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_closingstyletoletterclosings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_datestyle","displayName":"Date style (User)","description":"Checks/unchecks the option \"Date style.\" This option may be hidden in Word until certain editing languages are enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_datestyle_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_datestyle_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_headings","displayName":"Headings (User)","description":"Checks/unchecks the option ''Built in Heading styles''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_headings_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_headings_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_tables","displayName":"Tables (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_tables_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_applyasyoutype_l_tables_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_autospace","displayName":"Auto space (User)","description":"This policy setting allows you to set the option \"Delete needless spaces between Asian and Western text\" in the group \"Automatically as you type.\" This option may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, \"Delete needless spaces between Asian and Western text\" will be set.\r\n\r\nIf you disable or do not configure this policy setting, \"Delete needless spaces between Asian and Western text\" will not be set.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_autospace_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_autospace_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_definestylesbasedonyourformatting","displayName":"Define styles based on your formatting (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_definestylesbasedonyourformatting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_definestylesbasedonyourformatting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_formatbeginningoflistitemliketheonebeforeit","displayName":"Format beginning of list item like the one before it (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_formatbeginningoflistitemliketheonebeforeit_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_formatbeginningoflistitemliketheonebeforeit_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_insertclosingphrasetomatchjapanesesalutation","displayName":"Insert closing phrase to match Japanese salutation (User)","description":"Checks/unchecks the option \"Insert closing phrase to match Japanese salutation.\" This option may be hidden in Word until certain editing languages are enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_insertclosingphrasetomatchjapanesesalutation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_insertclosingphrasetomatchjapanesesalutation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_insertclosingphrasetomatchmemostyle","displayName":"Insert closing phrase to match memo style (User)","description":"Checks/unchecks the option \"Insert closing phrase to match memo style.\" This option may be hidden in Word until certain editing languages are enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_insertclosingphrasetomatchmemostyle_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_insertclosingphrasetomatchmemostyle_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_matchparentheses","displayName":"Match parentheses (User)","description":"This policy setting allows you to set the option \"Match opening and closing parentheses\" in Word Options | Proofing | AutoCorrect Options... | AutoFormat As You Type | Automatically as you type. This option may be hidden in Word until certain editing languages are enabled.\r\n\r\nIf you enable this policy setting, \"Match opening and closing parentheses\" will be set.\r\n\r\nIf you disable or do not configure this policy setting, \"Match opening and closing parentheses\" will not be set.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_matchparentheses_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_matchparentheses_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_setleftindentontabsandbackspace","displayName":"Set left indent on tabs and backspace (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_setleftindentontabsandbackspace_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_automaticallyasyoutype_l_setleftindentontabsandbackspace_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_boldand_italic_withrealformatting","displayName":"*Bold* and _italic_ with real formatting (User)","description":"This policy setting allows you to set the \"*Bold* and _italic_ with real formatting\" option.\r\n\r\nIf you enable this policy setting, you will set the the \"*Bold* and _italic_ with real formatting\" option in File | Options | Proofing | AutoCorrect Options... | AutoFormat.\r\n\r\nIf you disable or do not configure this policy setting, the option is not set.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_boldand_italic_withrealformatting_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_boldand_italic_withrealformatting_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_dashlikecharacters","displayName":"Dash-like characters (User)","description":"Checks/unchecks the option \"Long vowel sounds with dash.\" This option may be hidden in Word until certain editing languages are enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_dashlikecharacters_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_dashlikecharacters_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_firstlineindent","displayName":"First line indent (User)","description":"Checks/unchecks the option \"Spaces at beginning of paragraph with first-line indent\" in the group \"Replace as you type.\" This option may be hidden in Word until certain editing languages are enabled.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_firstlineindent_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_firstlineindent_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_fractions12withfractioncharacter","displayName":"Fractions (1/2) with fraction character (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_fractions12withfractioncharacter_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_fractions12withfractioncharacter_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_ordinals1stwithsuperscript","displayName":"Ordinals (1st) with superscript (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_ordinals1stwithsuperscript_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_ordinals1stwithsuperscript_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_straightquoteswithsmartquotes","displayName":"Straight quotes with smart quotes (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_straightquoteswithsmartquotes_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_straightquoteswithsmartquotes_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_symbolcharacterswithsymbols","displayName":"Symbol characters (--) with symbols (User)","description":"Checks/unchecks the option ''Hyphens (--) with dash (-)''.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_symbolcharacterswithsymbols_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_proofing~l_autoformatasyoutype~l_replaceasyoutype_l_symbolcharacterswithsymbols_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_compatmodeonsaveas","displayName":"Save As Open XML in Compatibility Mode (User)","description":"This policy setting allows you to hide the \"Maintain compatibility with previous versions of Word\" checkbox. For any file format that is in Compatibility Mode, there will be a \"Maintain compatibility with previous versions of Word\" checkbox in the Save As dialog when saving to any of the Open XML file formats. This checkbox allows users to preserve the fidelity of documents that open in compatibility mode when saving those documents to any of the Open XML file formats. Checking this box will prevent conversion to the version of Word that is saving the file.\r\n\r\nConversion maximizes fidelity with the version of Word that is saving the file, and it is recommended for users who want their Word documents to be compatible with this version of Word. However, conversion may impact the fidelity and compatibility of some features when the file is opened by a previous version of Word.\r\n\r\nIf you enable this policy setting, the \"Maintain compatibility with previous versions of Word\" checkbox will be hidden. The Save As behavior for any of the Open XML file formats will always maintain compatibility with previous versions of Word. The file that is in compatibility mode will be prevented from being converted to the version of Word saving this file. \r\n\r\nIf you disable or do not configure this policy setting, the \"Maintain compatibility with previous versions of Word\" checkbox in the Save As dialog will be shown. Unless checked by the user, an Open XML file will be converted when the document is saved. Users will still, by default, be shown a final dialog when saving to confirm that the user wants to save the file without \"Maintain compatibility with previous versions of Word\" checked.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_compatmodeonsaveas_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_compatmodeonsaveas_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_donotdisplayfileformatcompatiblitydialogforodt","displayName":"Do not display file format compatibility dialog box for OpenDocument text format (User)","description":"This policy setting allows you to configure the file format compatibility dialog box when saving a file as an OpenDocument text file in Word.\r\n \r\nIf you enable this policy setting, the file format compatibility dialog is not displayed whenever you save as an OpenDocument text file in Word.\r\n \r\nIf you disable or do not configure this policy setting, the file format compatibility dialog is displayed when you save as an OpenDocument text file in Word.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_donotdisplayfileformatcompatiblitydialogforodt_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_donotdisplayfileformatcompatiblitydialogforodt_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_keeplastautosavedversions","displayName":"Keep the last AutoSaved versions of files for the next session (User)","description":"This policy setting determines whether Word keeps the last AutoSaved version of a file if a user closes a file without saving it. (Note: AutoSave applies only when AutoRecover is enabled.)\r\n\r\nIf you enable or do not configure this policy setting, Word keeps the last AutoSaved version of the file and makes it available to the user the next time the file is opened if the user closes a file without saving it.\r\n\r\nIf you disable this policy setting, Word does not keep the last AutoSaved version of the file if the user closes a file without saving it.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_keeplastautosavedversions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_keeplastautosavedversions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_saveautorecoverinfo","displayName":"Save AutoRecover info (User)","description":"If you enable this policy setting, you can specify the number of minutes that Word will wait between saving AutoRecover information for the file. To prevent Word from ever saving AutoRecover information for the file, enable this policy and set the value to '0'.\r\n\r\nIf you disable or do not configure this policy setting, this policy will have no effect on the number of minutes that Word will wait between saving AutoRecover information for the file. By default, Word saves AutoRecover information for the file every 10 minutes.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_saveautorecoverinfo_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_saveautorecoverinfo_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_saveautorecoverinfo_l_saveautorecoverinfoeveryminutes","displayName":"Save AutoRecover info every (minutes) (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas","displayName":"Default file format (User)","description":"This policy setting determines the default file format for saving files in Word.\r\n\r\nIf you enable this policy setting, you can set the default file format from among the following options: \r\n\r\n- Word Document (*.docx): This option is the default configuration in Word.\r\n- Single Files Web Page (*.mht)\r\n- Web Page (*.htm; *.html)\r\n- Web Page, Filtered (*.htm, *.html)\r\n- Rich Text Format (*.rtf)\r\n- Plain Text (*.txt)\r\n- Word 6.0/95 (*.doc)\r\n- Word 6.0/95 - Chinese (Simplified) (*.doc)\r\n- Word 6.0/95 - Chinese (Traditional) (*.doc)\r\n- Word 6.0/95 - Japanese (*.doc)\r\n- Word 6.0/95 - Korean (*.doc)\r\n- Word 97-2002 and 6.0/95 - RTF\r\n- Word 5.1 for Macintosh (*.mcw)\r\n- Word 5.0 for Macintosh (*.mcw)\r\n- Word 2.x for Windows (*.doc)\r\n- Works 4.0 for Windows (*.wps)\r\n- WordPerfect 5.x for Windows (*.doc)\r\n- WordPerfect 5.1 for DOS (*.doc)\r\n- Word Macro-Enabled Document (*.docm)\r\n- Word Template (*.dotx)\r\n- Word Macro-Enabled Template (*.dotm)\r\n- Word 97 - 2003 Document (*.doc)\r\n- Word 97 - 2003 Template (*.dot)\r\n- Word XML Document (*.xml)\r\n- Strict Open XML Document (*.docx)\r\n- OpenDocument Text (*.odt)\r\n\r\nUsers can choose to save presentations or documents in a different file format than the default.\r\n\r\nIf you disable or do not configure this policy setting, Word saves new files in the Office Open XML format: Word files have a .docx extension. For users who run recent versions of Word, Microsoft offers the Microsoft Office Compatibility Pack, which enables them to open and save Office Open XML files. If some users in your organization cannot install the Compatibility Pack, or are running versions of Word older than Microsoft Office 2000 with Service Pack 3, they might not be able to access Office Open XML files.\r\n\r\nThis policy setting is often set in combination with the \"Save As Open XML in Compatibility Mode\" policy setting.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3","displayName":"Save Word files as (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_","displayName":"Word Document (*.docx)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_webarchive","displayName":"Single Files Web Page (*.mht)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_html","displayName":"Web Page (*.htm; *.html)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_reducedhtml","displayName":"Web Page, Filtered (*.htm, *.html)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_rtf","displayName":"Rich Text Format (*.rtf)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_text","displayName":"Plain Text (*.txt)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_msword6exp","displayName":"Word 6.0/95 (*.doc)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_msword6scexp","displayName":"Word 6.0/95 - Chinese (Simplified) (*.doc)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_msword6tcexp","displayName":"Word 6.0/95 - Chinese (Traditional) (*.doc)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_msword6jexp","displayName":"Word 6.0/95 - Japanese (*.doc)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_msword95kexp","displayName":"Word 6.0/95 - Korean (*.doc)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_msword6rtfexp","displayName":"Word 97-2002 & 6.0/95 - RTF","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_mswordmac51","displayName":"Word 5.1 for Macintosh (*.mcw)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_mswordmac5","displayName":"Word 5.0 for Macintosh (*.mcw)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_mswordwin2","displayName":"Word 2.x for Windows (*.doc)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_msworkswin4","displayName":"Works 4.0 for Windows (*.wps)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_wrdprfctwin","displayName":"WordPerfect 5.x for Windows (*.doc)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_wrdprfctdos51","displayName":"WordPerfect 5.1 for DOS (*.doc)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_macroenableddocument","displayName":"Word Macro-Enabled Document (*.docm)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_template","displayName":"Word Template (*.dotx)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_macroenabledtemplate","displayName":"Word Macro-Enabled Template (*.dotm)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_doc","displayName":"Word 97 - 2003 Document (*.doc)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_dot","displayName":"Word 97 - 2003 Template (*.dot)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_flatxml","displayName":"Word XML Document (*.xml)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_docxstrict","displayName":"Strict Open XML Document (*.docx)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_savewordfilesas_l_savewordfilesas3_odt","displayName":"OpenDocument Text (*.odt)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_setdefaultcompatibilitymodeonfilecreation","displayName":"Set default compatibility mode on file creation (User)","description":"This policy setting allows you to specify the default compatibility mode when creating new files in Word. There are four modes:\r\n\r\n1. Word 2003: This mode disables features in Word that are not compatible with Word 2003.\r\n2. Word 2007: This mode disables features in Word that are not compatible with Word 2007.\r\n3. Word 2010: This mode disables features in Word that are not compatible with Word 2010.\r\n4. Full functionality mode: This mode ensures that all new features remain enabled. This is the default setting for Word. \r\n\r\nNote: Not all file formats support all four Compatibility Modes. Open XML file formats such as .docx and .dotx, support all four modes.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_setdefaultcompatibilitymodeonfilecreation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_setdefaultcompatibilitymodeonfilecreation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_setdefaultcompatibilitymodeonfilecreation_l_setdefaultcompatibilitymodeonfilecreationdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_setdefaultcompatibilitymodeonfilecreation_l_setdefaultcompatibilitymodeonfilecreationdropid_11","displayName":"Word 2003","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_setdefaultcompatibilitymodeonfilecreation_l_setdefaultcompatibilitymodeonfilecreationdropid_12","displayName":"Word 2007","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_setdefaultcompatibilitymodeonfilecreation_l_setdefaultcompatibilitymodeonfilecreationdropid_14","displayName":"Word 2010","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_save_l_setdefaultcompatibilitymodeonfilecreation_l_setdefaultcompatibilitymodeonfilecreationdropid_15","displayName":"Full functionality mode","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security_l_disableirmonxpsexport","displayName":"Turn off IRM protection on XPS Export for Word (User)","description":"This policy controls the default IRM protection setting when exporting Word documents to XPS files.\r\n\r\nEnabling this policy setting will turn off IRM protection when exporting to XPS, if not explicitly set by users through the Export Options dialog.\r\n\r\nIf you disable or don't configure this policy setting, the default IRM protection setting for XPS export is based on previous IRM export selection. \r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security_l_disableirmonxpsexport_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security_l_disableirmonxpsexport_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security_l_disablewarningonincludefieldsupdate","displayName":"Don’t ask permission before updating IncludePicture and IncludeText fields in Word (User)","description":"This policy setting allows you to control whether Word prompts the user with a security message before updating IncludePicture and IncludeText fields in the document.\r\n\r\nBy default, the user is prompted with a security message before those fields are updated. But, the prompt might effect automated workflows that merge Word documents.\r\n\r\nImportant: Fields that contain IncludePicture and IncludeText references can be used for data exfiltration or phishing exploits. A field containing these references can be modified to point to external websites for content. If credentials are required for accessing the picture or text, the process of updating the field will request a sign-in from the user. While this is a legitimate scenario for trusted sources, it is vulnerable to phishing if the document is not from a trusted source.\r\n\r\nIf you enable this policy setting, the user won’t be prompted with a security message before those fields are updated. Enabling this policy setting is not recommended because of the possible security implications.\r\n\r\nIf you disable or don’t configure this policy setting, the user will be prompted with a security message before those fields are updated.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security_l_disablewarningonincludefieldsupdate_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security_l_disablewarningonincludefieldsupdate_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security_l_makehiddenmarkupvisible","displayName":"Make hidden markup visible (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security_l_makehiddenmarkupvisible_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security_l_makehiddenmarkupvisible_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security_l_storerandomnumbertoimprovemergeaccuracy","displayName":"Store random number to improve merge accuracy (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security_l_storerandomnumbertoimprovemergeaccuracy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security_l_storerandomnumbertoimprovemergeaccuracy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security_l_turnofffilevalidation","displayName":"Turn off file validation (User)","description":"This policy setting allows you turn off the file validation feature.\r\n\r\nIf you enable this policy setting, file validation will be turned off.\r\n\r\nIf you disable or do not configure this policy setting, file validation will be turned on. Office Binary Documents (97-2003) are checked to see if they conform against the file format schema before they are opened.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security_l_turnofffilevalidation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security_l_turnofffilevalidation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security_l_warnbeforeprintingsavingorsendingafilethatcontainstrackedcha","displayName":"Warn before printing, saving or sending a file that contains tracked changes or comments (User)","description":"Checks/unchecks the corresponding UI option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security_l_warnbeforeprintingsavingorsendingafilethatcontainstrackedcha_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security_l_warnbeforeprintingsavingorsendingafilethatcontainstrackedcha_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_configurecngcipherchainingmode","displayName":"Configure CNG cipher chaining mode (User)","description":"This policy setting allows you to configure the cipher chaining mode used.\r\n\r\nIf you enable this policy setting, the cipher chaining mode specified will be applied.\r\n\r\nIf you disable or do not configure this policy setting, Cipher Block Chaining (CBC) will be the default CNG cipher chaining mode used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_l_configurecngcipherchainingmodedropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_l_configurecngcipherchainingmodedropid_chainingmodecbc","displayName":"Cipher Block Chaining (CBC)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_configurecngcipherchainingmode_l_configurecngcipherchainingmodedropid_chainingmodecfb","displayName":"Cipher Feedback (CFB)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_setcngcipheralgorithm","displayName":"Set CNG cipher algorithm (User)","description":"This policy setting allows you to configure the CNG cipher algorithm that is used.\r\n\r\nIf you enable this policy setting, then the cipher provided will be used if it is a supported algorithm.\r\n\r\nIf you disable or do not configure this policy setting, AES will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_setcngcipheralgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_setcngcipheralgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_setcngcipheralgorithm_l_setcngcipheralgorithmid","displayName":"CNG cipher algorithm: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_setcngcipherkeylength","displayName":"Set CNG cipher key length (User)","description":"This policy setting allows you to configure the number of bits to use when creating the cipher key. This number will be rounded down to a multiple of 8.\r\n\r\nIf you enable this policy setting, the key bits specified will be used.\r\n\r\nIf you disable or do not configure this policy setting, the default value will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_setcngcipherkeylength_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_setcngcipherkeylength_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_setcngcipherkeylength_l_setcngcipherkeylengthspinid","displayName":"Cipher key length (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_setcngpasswordspincount","displayName":"Set CNG password spin count (User)","description":"This policy setting allows you to specify the number of times to spin (rehash) the password verifier.\r\n\r\nIf you enable this policy setting, the number specified will be the number of times the password will be rehashed.\r\n\r\nIf you disable or do not configure this policy setting, the default (100000) will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_setcngpasswordspincount_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_setcngpasswordspincount_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_setcngpasswordspincount_l_setcngpasswordspincountspinid","displayName":"","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_setparametersforcngcontext","displayName":"Set parameters for CNG context (User)","description":"This policy setting allows you to specify the encryption parameters that should be used for the CNG context. \r\n\r\nIf you enable this policy setting, the parameters specified will be passed to the CNG context.\r\n\r\nIf you disable or do not configure this policy setting, the default CNG values will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_setparametersforcngcontext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_setparametersforcngcontext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_setparametersforcngcontext_l_setparametersforcngcontextid","displayName":"Parameters (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifycnghashalgorithm","displayName":"Specify CNG hash algorithm (User)","description":"This policy setting allows you to specify the hash algorithm used.\r\n\r\nIf you enable this policy setting, the hashing algorithm selected will be used by CNG.\r\n\r\nIf you disable or do not configure this policy setting, the default CNG hash algorithm will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifycnghashalgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifycnghashalgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha1","displayName":"SHA1","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha256","displayName":"SHA256","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha384","displayName":"SHA384","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifycnghashalgorithm_l_specifycnghashalgorithmdropid_sha512","displayName":"SHA512","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm","displayName":"Specify CNG random number generator algorithm (User)","description":"This policy setting allows you to configure the CNG random number generator to use.\r\n\r\nIf you enable this policy setting, the random number generator specified will be used.\r\n\r\nIf you disable or do not configure this policy setting, the default random number generator will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifycngrandomnumbergeneratoralgorithm_l_specifycngrandomnumbergeneratoralgorithmid","displayName":"Random number generator: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifycngsaltlength","displayName":"Specify CNG salt length (User)","description":"This policy setting allows you to specify the number of bytes of salt that should be used.\r\n\r\nIf you enable this policy setting, the bytes specified will be used.\r\n\r\nIf you disable or do not configure this policy setting, the default length of 16 will be used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifycngsaltlength_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifycngsaltlength_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifycngsaltlength_l_specifycngsaltlengthspinid","displayName":"Number of bytes (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifyencryptioncompatibility","displayName":"Specify encryption compatibility (User)","description":"This policy setting allows you to specify the encrypted database compatibility.\r\n\r\nIf you enable this policy setting, the compatibility format specified will be applied during encryption for new files\r\n- Use legacy format\r\n- Use next generation format\r\n- All files save with next generation format\r\n\r\nIf you disable or do not configure this policy setting, the default setting, \"Use next generation format,\" will be applied.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifyencryptioncompatibility_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifyencryptioncompatibility_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifyencryptioncompatibility_l_specifyencryptioncompatibilitydropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifyencryptioncompatibility_l_specifyencryptioncompatibilitydropid_0","displayName":"Use legacy format","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifyencryptioncompatibility_l_specifyencryptioncompatibilitydropid_1","displayName":"Use next generation format","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_specifyencryptioncompatibility_l_specifyencryptioncompatibilitydropid_2","displayName":"All files save with next generation format","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_usenewkeyonpasswordchange","displayName":"Use new key on password change (User)","description":"This policy setting allows you to specify if a new encryption key is used when the password is changed.\r\n\r\nIf you enable or do not configure this policy setting, a new intermediate key is generated when the password is changed. This causes any extra key encryptors to be removed when the file is saved.\r\n\r\nIf you disable this policy setting, a new intermediate key is not generated when the password is changed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_usenewkeyonpasswordchange_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_cryptography_l_usenewkeyonpasswordchange_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_allowdde","displayName":"Dynamic Data Exchange (User)","description":"This policy setting controls the ability to use Dynamic Data Exchange (DDE) in Word. By default, DDE isn’t allowed in Word. Allowing DDE isn’t recommended because of security concerns.\r\n \r\nIf you enable this policy setting, you can select either of the following options:\r\n \r\n-Limit Dynamic Data Exchange\r\n-Allow Dynamic Data Exchange\r\n \r\nIf you choose “Limit Dynamic Data Exchange,” DDE requests made to an already running program are allowed.  But, DDE requests that require another executable program to be launched aren’t allowed.\r\n \r\nIf you disable or don’t configure this policy setting, DDE isn’t allowed.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_allowdde_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_allowdde_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_allowdde_l_allowddedropid","displayName":"Dynamic Data Exchange setting (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_allowdde_l_allowddedropid_1","displayName":"Limited Dynamic Data Exchange","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_allowdde_l_allowddedropid_2","displayName":"Allow Dynamic Data Exchange","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_allowwordmailloadembeddedfonts","displayName":"Allow embedded TrueType fonts to be sent in messages (User)","description":"\r\n This policy setting controls whether embedded TrueType fonts can be sent in messages.\r\n\r\n By default, embedded TrueType fonts aren't allowed in messages. Allowing embedded TrueType fonts Isn't recommended because of security concerns.\r\n\r\n If you enable this policy setting, embedded TrueType fonts can be sent in messages.\r\n\r\n If you disable or don’t configure this policy setting, embedded TrueType fonts can't be sent in messages.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_allowwordmailloadembeddedfonts_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_allowwordmailloadembeddedfonts_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_blockmacroexecutionfrominternet","displayName":"Block macros from running in Office files from the Internet (User)","description":"\r\n This policy setting allows you to block macros from running in Office files that come from the Internet.\r\n\r\n If you enable this policy setting, macros are blocked from running, even if “Enable all macros” is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to “Enable Content,” users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run.\r\n\r\n If you disable or don’t configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_blockmacroexecutionfrominternet_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_blockmacroexecutionfrominternet_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_determinewhethertoforceencryptedword","displayName":"Scan encrypted macros in Word Open XML documents (User)","description":"This policy setting controls whether encrypted macros in Open XML documents be are required to be scanned with anti-virus software before being opened.\r\n\r\nIf you enable this policy setting, you may choose one of these options:\r\n\r\n- Scan encrypted macros: encrypted macros are disabled unless anti-virus software is installed. Encrypted macros are scanned by your anti-virus software when you attempt to open an encrypted workbook that contains macros.\r\n- Scan if anti-virus software available: if anti-virus software is installed, scan the encrypted macros first before allowing them to load. If anti-virus software is not available, allow encrypted macros to load.\r\n- Load macros without scanning: do not check for anti-virus software and allow macros to be loaded in an encrypted file.\r\n\r\nIf you disable or do not configure this policy setting, the behavior will be similar to the \"Scan encrypted macros\" option.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_determinewhethertoforceencryptedword_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_determinewhethertoforceencryptedword_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_determinewhethertoforceencryptedword_l_determinewhethertoforceencryptedworddropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_determinewhethertoforceencryptedword_l_determinewhethertoforceencryptedworddropid_0","displayName":"Scan encrypted macros (default)","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_determinewhethertoforceencryptedword_l_determinewhethertoforceencryptedworddropid_1","displayName":"Scan if anti-virus software available","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_determinewhethertoforceencryptedword_l_determinewhethertoforceencryptedworddropid_2","displayName":"Load macros without scanning","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_disableallapplicationextensions","displayName":"Disable all application add-ins (User)","description":"This policy setting disables all add-ins for the specified Office 2016 applications.\r\n \r\nIf you enable this policy setting, all add-ins for the specified Office 2016 applications are disabled.\r\n\r\nIf you disable or do not configure this policy setting, all add-ins for the specified Office 2016 applications are allowed to run without notifying the users, except if application add-ins are required to be signed by Trusted Publishers.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_disableallapplicationextensions_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_disableallapplicationextensions_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned","displayName":"Disable Trust Bar Notification for unsigned application add-ins and block them (User) (Deprecated)","description":"This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the \"Require that application add-ins are signed by Trusted Publisher\" policy setting, which prevents users from changing this policy setting.\r\n\r\nIf you enable this policy setting, applications automatically disable unsigned add-ins without informing users.\r\n \r\nIf you disable this policy setting, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.\r\n\r\nIf you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the \"Add-ins\" category of the Trust Center for the application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_v2","displayName":"Disable Trust Bar Notification for unsigned application add-ins and block them (User)","description":"This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the \"Require that application add-ins are signed by Trusted Publisher\" policy setting, which prevents users from changing this policy setting.\r\n\r\nIf you enable this policy setting, applications automatically disable unsigned add-ins without informing users.\r\n \r\nIf you disable this policy setting, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.\r\n\r\nIf you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the \"Add-ins\" category of the Trust Center for the application.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_v2_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_disabletrustbarnotificationforunsigned_v2_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_requirethatapplicationextensionsaresigned","displayName":"Require that application add-ins are signed by Trusted Publisher (User)","description":"This policy setting controls whether add-ins for this applications must be digitally signed by a trusted publisher.\r\n \r\nIf you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2016 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Office 2016 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2016, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.\r\n\r\nIf you disable or do not configure this policy setting, this application does not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_requirethatapplicationextensionsaresigned_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_requirethatapplicationextensionsaresigned_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_setmaximumnumberoftrusteddocuments","displayName":"Set maximum number of trusted documents (User)","description":"This policy setting allows you to specify the maximum number of trust records for trusted documents that can be stored in the registry before the purge task runs. The purge task reduces the number of trusted documents stored in the registry to the value set by the \"Set maximum number of trust records to preserve\" policy setting.\r\n\r\nIf you enable this policy setting, you can specify the maximum number of trusted documents to be stored in the registry before the purge task runs, with an upper limit of 20,000 documents. For performance reasons, we do not recommend setting this policy setting to the upper limit.\r\n\r\nIf you disable or do not configure this policy setting, the default value of 500 is used for the maximum number of trusted documents that can be stored in the registry before the purge task runs.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_setmaximumnumberoftrusteddocuments_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_setmaximumnumberoftrusteddocuments_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_setmaximumnumberoftrusteddocuments_l_setmaximumnumberoftrusteddocumentsspinid","displayName":"Maximum number: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_setmaximumnumberoftrustrecordstopreserve","displayName":"Set maximum number of trust records to preserve (User)","description":"This policy setting allows you to specify the maximum number of trust records to preserve when the purge task detects that this application has trusted more than the number of trusted documents set by the \"Set maximum number of trusted documents\" policy setting.\r\n\r\nIf you enable this policy setting, you may specify the maximum number of trust records to preserve, with an upper limit of 20000. Due to performance reasons, it is not recommended to set it to the upper limit.\r\n\r\nIf you disable or you do not configure this policy setting, the default value for of 400 is used.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_setmaximumnumberoftrustrecordstopreserve_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_setmaximumnumberoftrustrecordstopreserve_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_setmaximumnumberoftrustrecordstopreserve_l_setmaximumnumberoftrustrecordstopreservespinid","displayName":"Maximum to preserve: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_trustaccesstovisualbasicproject","displayName":"Trust access to Visual Basic Project (User)","description":"This policy setting controls whether automation clients such as Microsoft Visual Studio 2005 Tools for Microsoft Office (VSTO) can access the Visual Basic for Applications project system in the specified applications. VSTO projects require access to the Visual Basic for Applications project system in Excel, PowerPoint, and Word, even though the projects do not use Visual Basic for Applications. Design-time support of controls in both Visual Basic and C# projects depends on the Visual Basic for Applications project system in Word and Excel.\r\n\r\nIf you enable this policy setting, VSTO and other automation clients can access the Visual Basic for Applications project system in the specified applications. Users will not be able to change this behavior through the \"Trust access to the VBA project object model\" user interface option under the Macro Settings section of the Trust Center.\r\n\r\nIf you disable this policy setting, VSTO does not have programmatic access to VBA projects. In addition, the \"Trust access to the VBA project object model\" check box is cleared and users cannot change it. Note: Disabling this policy setting prevents VSTO projects from interacting properly with the VBA project system in the selected application.\r\n\r\nIf you do not configure this policy setting, automation clients do not have programmatic access to VBA projects. Users can enable this by selecting the \"Trust access to the VBA project object model\" in the \"Macro Settings\" section of the Trust Center. However, doing so allows macros in any documents the user opens to access the core Visual Basic objects, methods, and properties, which represents a potential security hazard.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_trustaccesstovisualbasicproject_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_trustaccesstovisualbasicproject_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_turnofftrusteddocuments","displayName":"Turn off trusted documents (User)","description":"This policy setting allows you to turn off the trusted documents feature. The trusted documents feature allows users to always enable active content in documents such as macros, ActiveX controls, data connections, etc. so that they are not prompted the next time they open the documents. Trusted documents are exempt from security notifications.\r\n\r\nIf you enable this policy setting, you will turn off the trusted documents feature. Users will receive a security prompt every time a document containing active content is opened.\r\n\r\nIf you disable or do not configure this policy setting, documents will be trusted when users enable content for a document, and users will not receive a security prompt.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_turnofftrusteddocuments_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_turnofftrusteddocuments_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_turnofftrusteddocumentsonthenetwork","displayName":"Turn off Trusted Documents on the network (User)","description":"This policy setting allows you to turn off the trusted documents feature for documents opened from the network.\r\n\r\nIf you enable this policy setting, users will always see security notifications for active content such as macros, ActiveX controls, data connections, etc. for documents opened from the network.\r\n\r\nIf you disable or do not configure this policy setting, the trusted documents feature allows users to always allow active content in documents such as macros, ActiveX controls, data connections, etc. so that users are not prompted the next time they open the documents. Trusted documents are exempt from security notifications.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_turnofftrusteddocumentsonthenetwork_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_turnofftrusteddocumentsonthenetwork_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_vbawarningspolicy","displayName":"VBA Macro Notification Settings (User)","description":"This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.\r\n\r\nIf you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:\r\n \r\n- Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.\r\n \r\n- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.\r\n \r\n- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.\r\n \r\n- Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.\r\n \r\nIf you disable this policy setting, \"Disable all with notification\" will be the default setting.\r\n \r\nIf you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking \"Enable Content\" on the Trust Bar. If the user clicks \"Enable Content\", then the document is added as a trusted document.\r\n \r\nImportant: If \"Disable all except digitally signed macros\" is selected, users will not be able to open unsigned Access databases.\r\n \r\nAlso, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.\r\n \r\nTherefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_vbawarningspolicy_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_vbawarningspolicy_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty19","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty19_2","displayName":"Disable all with notification","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty19_3","displayName":"Disable all except digitally signed macros","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty19_4","displayName":"Disable all without notification","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter_l_vbawarningspolicy_l_empty19_1","displayName":"Enable all macros (not recommended)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforword","displayName":"Legacy converters for Word (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforword_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforword_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforword_l_legacyconvertersforworddropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforword_l_legacyconvertersforworddropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforword_l_legacyconvertersforworddropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforword_l_legacyconvertersforworddropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforword_l_legacyconvertersforworddropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforword_l_legacyconvertersforworddropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_legacyconvertersforword_l_legacyconvertersforworddropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_officeopenxmlconvertersforword","displayName":"Office Open XML converters for Word (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_officeopenxmlconvertersforword_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_officeopenxmlconvertersforword_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_officeopenxmlconvertersforword_l_officeopenxmlconvertersforworddropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_officeopenxmlconvertersforword_l_officeopenxmlconvertersforworddropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_officeopenxmlconvertersforword_l_officeopenxmlconvertersforworddropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_officeopenxmlconvertersforword_l_officeopenxmlconvertersforworddropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_officeopenxmlconvertersforword_l_officeopenxmlconvertersforworddropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_officeopenxmlconvertersforword_l_officeopenxmlconvertersforworddropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_officeopenxmlconvertersforword_l_officeopenxmlconvertersforworddropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumenttextfiles","displayName":"OpenDocument Text files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumenttextfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumenttextfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumenttextfiles_l_opendocumenttextfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumenttextfiles_l_opendocumenttextfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumenttextfiles_l_opendocumenttextfilesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumenttextfiles_l_opendocumenttextfilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumenttextfiles_l_opendocumenttextfilesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumenttextfiles_l_opendocumenttextfilesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_opendocumenttextfiles_l_opendocumenttextfilesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_plaintextfiles","displayName":"Plain text files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_plaintextfiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_plaintextfiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_plaintextfiles_l_plaintextfilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_plaintextfiles_l_plaintextfilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_plaintextfiles_l_plaintextfilesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_plaintextfiles_l_plaintextfilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_rtffiles","displayName":"RTF files (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_rtffiles_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_rtffiles_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_rtffiles_l_rtffilesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_rtffiles_l_rtffilesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_rtffiles_l_rtffilesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_rtffiles_l_rtffilesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_rtffiles_l_rtffilesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_rtffiles_l_rtffilesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_rtffiles_l_rtffilesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior","displayName":"Set default file block behavior (User)","description":"This policy setting allows you to determine if users can open, view, or edit Word files.\r\n\r\nIf you enable this policy setting, you can set one of these options:\r\n- Blocked files are not opened\r\n- Blocked files open in Protected View and can not be edited\r\n- Blocked files open in Protected View and can be edited\r\n\r\nIf you disable or do not configure this policy setting, the behavior is the same as the \"Blocked files are not opened\" setting. Users will not be able to open blocked files.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior_l_setdefaultfileblockbehaviordropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior_l_setdefaultfileblockbehaviordropid_0","displayName":"Blocked files are not opened","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior_l_setdefaultfileblockbehaviordropid_1","displayName":"Blocked files open in Protected View and can not be edited","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_setdefaultfileblockbehavior_l_setdefaultfileblockbehaviordropid_2","displayName":"Blocked files open in Protected View and can be edited","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages","displayName":"Web pages (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages_l_webpagesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages_l_webpagesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages_l_webpagesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages_l_webpagesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages_l_webpagesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages_l_webpagesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_webpages_l_webpagesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2000binarydocumentsandtemplates","displayName":"Word 2000 binary documents and templates (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2000binarydocumentsandtemplates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2000binarydocumentsandtemplates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2000binarydocumentsandtemplates_l_word2000binarydocumentsandtemplatesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2000binarydocumentsandtemplates_l_word2000binarydocumentsandtemplatesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2000binarydocumentsandtemplates_l_word2000binarydocumentsandtemplatesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2000binarydocumentsandtemplates_l_word2000binarydocumentsandtemplatesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2000binarydocumentsandtemplates_l_word2000binarydocumentsandtemplatesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2000binarydocumentsandtemplates_l_word2000binarydocumentsandtemplatesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003andplainxmldocuments","displayName":"Word 2003 and plain XML documents (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003andplainxmldocuments_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003andplainxmldocuments_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003andplainxmldocuments_l_word2003andplainxmldocumentsdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003andplainxmldocuments_l_word2003andplainxmldocumentsdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003andplainxmldocuments_l_word2003andplainxmldocumentsdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003andplainxmldocuments_l_word2003andplainxmldocumentsdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003andplainxmldocuments_l_word2003andplainxmldocumentsdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003andplainxmldocuments_l_word2003andplainxmldocumentsdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003andplainxmldocuments_l_word2003andplainxmldocumentsdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003binarydocumentsandtemplates","displayName":"Word 2003 binary documents and templates (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003binarydocumentsandtemplates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003binarydocumentsandtemplates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003binarydocumentsandtemplates_l_word2003binarydocumentsandtemplatesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003binarydocumentsandtemplates_l_word2003binarydocumentsandtemplatesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003binarydocumentsandtemplates_l_word2003binarydocumentsandtemplatesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003binarydocumentsandtemplates_l_word2003binarydocumentsandtemplatesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003binarydocumentsandtemplates_l_word2003binarydocumentsandtemplatesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2003binarydocumentsandtemplates_l_word2003binarydocumentsandtemplatesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterbinarydocumentsandtemplates","displayName":"Word 2007 and later binary documents and templates (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterbinarydocumentsandtemplates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterbinarydocumentsandtemplates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterbinarydocumentsandtemplates_l_word2007andlaterbinarydocumentsandtemplatesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterbinarydocumentsandtemplates_l_word2007andlaterbinarydocumentsandtemplatesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterbinarydocumentsandtemplates_l_word2007andlaterbinarydocumentsandtemplatesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterbinarydocumentsandtemplates_l_word2007andlaterbinarydocumentsandtemplatesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterbinarydocumentsandtemplates_l_word2007andlaterbinarydocumentsandtemplatesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterbinarydocumentsandtemplates_l_word2007andlaterbinarydocumentsandtemplatesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterbinarydocumentsandtemplates_l_word2007andlaterbinarydocumentsandtemplatesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterdocsandtemplates","displayName":"Word 2007 and later documents and templates (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterdocsandtemplates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterdocsandtemplates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterdocsandtemplates_l_word2007andlaterdocsandtemplatesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterdocsandtemplates_l_word2007andlaterdocsandtemplatesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterdocsandtemplates_l_word2007andlaterdocsandtemplatesdropid_1","displayName":"Save blocked","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterdocsandtemplates_l_word2007andlaterdocsandtemplatesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterdocsandtemplates_l_word2007andlaterdocsandtemplatesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterdocsandtemplates_l_word2007andlaterdocsandtemplatesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2007andlaterdocsandtemplates_l_word2007andlaterdocsandtemplatesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2andearlierbinarydocumentsandtemplates","displayName":"Word 2 and earlier binary documents and templates (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will be blocked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2andearlierbinarydocumentsandtemplates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2andearlierbinarydocumentsandtemplates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2andearlierbinarydocumentsandtemplates_l_word2andearlierbinarydocumentsandtemplatesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2andearlierbinarydocumentsandtemplates_l_word2andearlierbinarydocumentsandtemplatesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2andearlierbinarydocumentsandtemplates_l_word2andearlierbinarydocumentsandtemplatesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2andearlierbinarydocumentsandtemplates_l_word2andearlierbinarydocumentsandtemplatesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2andearlierbinarydocumentsandtemplates_l_word2andearlierbinarydocumentsandtemplatesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word2andearlierbinarydocumentsandtemplates_l_word2andearlierbinarydocumentsandtemplatesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word6pt0binarydocumentsandtemplates","displayName":"Word 6.0 binary documents and templates (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will be blocked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word6pt0binarydocumentsandtemplates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word6pt0binarydocumentsandtemplates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word6pt0binarydocumentsandtemplates_l_word6pt0binarydocumentsandtemplatesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word6pt0binarydocumentsandtemplates_l_word6pt0binarydocumentsandtemplatesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word6pt0binarydocumentsandtemplates_l_word6pt0binarydocumentsandtemplatesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word6pt0binarydocumentsandtemplates_l_word6pt0binarydocumentsandtemplatesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word6pt0binarydocumentsandtemplates_l_word6pt0binarydocumentsandtemplatesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word6pt0binarydocumentsandtemplates_l_word6pt0binarydocumentsandtemplatesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word95binarydocumentsandtemplates","displayName":"Word 95 binary documents and templates (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will be blocked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word95binarydocumentsandtemplates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word95binarydocumentsandtemplates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word95binarydocumentsandtemplates_l_word95binarydocumentsandtemplatesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word95binarydocumentsandtemplates_l_word95binarydocumentsandtemplatesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word95binarydocumentsandtemplates_l_word95binarydocumentsandtemplatesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word95binarydocumentsandtemplates_l_word95binarydocumentsandtemplatesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word95binarydocumentsandtemplates_l_word95binarydocumentsandtemplatesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word95binarydocumentsandtemplates_l_word95binarydocumentsandtemplatesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word97binarydocumentsandtemplates","displayName":"Word 97 binary documents and templates (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word97binarydocumentsandtemplates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word97binarydocumentsandtemplates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word97binarydocumentsandtemplates_l_word97binarydocumentsandtemplatesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word97binarydocumentsandtemplates_l_word97binarydocumentsandtemplatesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word97binarydocumentsandtemplates_l_word97binarydocumentsandtemplatesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word97binarydocumentsandtemplates_l_word97binarydocumentsandtemplatesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word97binarydocumentsandtemplates_l_word97binarydocumentsandtemplatesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_word97binarydocumentsandtemplates_l_word97binarydocumentsandtemplatesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_wordxpbinarydocumentsandtemplates","displayName":"Word XP binary documents and templates (User)","description":"This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting.\r\n\r\nIf you enable this policy setting, you can specify whether users can open, view, edit, or save files.\r\n\r\nThe options that can be selected are below. Note: Not all options may be available for this policy setting.\r\n\r\n- Do not block: The file type will not be blocked.\r\n\r\n- Save blocked: Saving of the file type will be blocked.\r\n\r\n- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the \"default file block behavior\" key.\r\n\r\n- Block: Both opening and saving of the file type will be blocked, and the file will not open.\r\n\r\n- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.\r\n\r\n- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.\r\n\r\nIf you disable or do not configure this policy setting, the file type will not be blocked.\r\n","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_wordxpbinarydocumentsandtemplates_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_wordxpbinarydocumentsandtemplates_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_wordxpbinarydocumentsandtemplates_l_wordxpbinarydocumentsandtemplatesdropid","displayName":"File block setting: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_wordxpbinarydocumentsandtemplates_l_wordxpbinarydocumentsandtemplatesdropid_0","displayName":"Do not block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_wordxpbinarydocumentsandtemplates_l_wordxpbinarydocumentsandtemplatesdropid_2","displayName":"Open/Save blocked, use open policy","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_wordxpbinarydocumentsandtemplates_l_wordxpbinarydocumentsandtemplatesdropid_3","displayName":"Block","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_wordxpbinarydocumentsandtemplates_l_wordxpbinarydocumentsandtemplatesdropid_4","displayName":"Open in Protected View","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_fileblocksettings_l_wordxpbinarydocumentsandtemplates_l_wordxpbinarydocumentsandtemplatesdropid_5","displayName":"Allow editing and open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_donotopenfilesfromtheinternetzoneinprotectedview","displayName":"Do not open files from the Internet zone in Protected View (User)","description":"This policy setting allows you to determine if files downloaded from the Internet zone open in Protected View.\r\n\r\nIf you enable this policy setting, files downloaded from the Internet zone do not open in Protected View.\r\n\r\nIf you disable or do not configure this policy setting, files downloaded from the Internet zone open in Protected View.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_donotopenfilesfromtheinternetzoneinprotectedview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_donotopenfilesfromtheinternetzoneinprotectedview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_donotopenfilesinunsafelocationsinprotectedview","displayName":"Do not open files in unsafe locations in Protected View (User)","description":"This policy setting lets you determine if files located in unsafe locations will open in Protected View. If you have not specified unsafe locations, only the \"Downloaded Program Files\" and \"Temporary Internet Files\" folders are considered unsafe locations.\r\n\r\nIf you enable this policy setting, files located in unsafe locations do not open in Protected View.\r\n\r\nIf you disable or do not configure this policy setting, files located in unsafe locations open in Protected View.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_donotopenfilesinunsafelocationsinprotectedview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_donotopenfilesinunsafelocationsinprotectedview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_openfilesonlocalintranetuncinprotectedview","displayName":"Open files on local Intranet UNC in Protected View (User)","description":"This policy setting lets you determine if files on local Intranet UNC file shares open in Protected View.\r\n\r\nIf you enable this policy setting, files on local Intranet UNC file shares open in Protected View if their UNC paths appear to be within the Internet zone.\r\n\r\nIf you disable or do not configure this policy setting, files on Intranet UNC file shares do not open in Protected View if their UNC paths appear to be within the Internet zone.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_openfilesonlocalintranetuncinprotectedview_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_openfilesonlocalintranetuncinprotectedview_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails","displayName":"Set document behavior if file validation fails (User)","description":"This policy setting controls how Office handles documents when they fail file validation. \r\n\r\nIf you enable this policy setting, you can configure the following options for files that fail file validation:\r\n\r\n- Block files completely. Users cannot open the files.\r\n- Open files in Protected View and disallow edit. Users cannot edit the files. This is also how Office handles the files if you disable this policy setting.\r\n- Open files in Protected View and allow edit. Users can edit the files. This is also how Office handles the files if you do not configure this policy setting.\r\n\r\nIf you disable this policy setting, Office follows the \"Open files in Protected View and disallow edit\" behavior.\r\n\r\nIf you do not configure this policy setting, Office follows the \"Open files in Protected View and allow edit\" behavior.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_l_setdocumentbehavioriffilevalidationfailsdropid","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_l_setdocumentbehavioriffilevalidationfailsdropid_0","displayName":"Block files","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_l_setdocumentbehavioriffilevalidationfailsdropid_1","displayName":"Open in Protected View","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_l_setdocumentbehavioriffilevalidationfailsstr3","displayName":"Checked: Allow edit. Unchecked: Do not allow edit. (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_l_setdocumentbehavioriffilevalidationfailsstr3_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_setdocumentbehavioriffilevalidationfails_l_setdocumentbehavioriffilevalidationfailsstr3_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_turnoffprotectedviewforattachmentsopenedfromoutlook","displayName":"Turn off Protected View for attachments opened from Outlook (User)","description":"This policy setting allows you to determine if Word files in Outlook attachments open in Protected View.\r\n\r\nIf you enable this policy setting, Outlook attachments do not open in Protected View.\r\n\r\nIf you disable or do not configure this policy setting, Outlook attachments open in Protected View.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_turnoffprotectedviewforattachmentsopenedfromoutlook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_protectedview_l_turnoffprotectedviewforattachmentsopenedfromoutlook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_allowtrustedlocationsonthenetwork","displayName":"Allow Trusted Locations on the network (User)","description":"This policy setting controls whether trusted locations on the network can be used.\r\n\r\nIf you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the \"Add new location\" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.\r\n\r\nIf you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. \r\n\r\nIf you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.\r\n\r\nDisabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center. We recommended that you do not enable this policy setting (as the \"Allow Trusted Locations on my network (not recommended)\" check box also states). Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.\r\n\r\nIf you do not enable this policy setting, users can select the \"Allow Trusted Locations on my network (not recommended)\" check box if desired and then specify trusted locations by clicking the \"Add new location\" button.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_allowtrustedlocationsonthenetwork_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_allowtrustedlocationsonthenetwork_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_disabletrustedloc","displayName":"Disable all trusted locations (User)","description":"This policy setting allows administrators to disable all trusted locations in the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data.\r\n \r\nIf you enable this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are ignored, including any trusted locations established by Office 2016 during setup, deployed to users using Group Policy, or added by users themselves. Users will be prompted again when opening files from trusted locations.\r\n\r\nIf you disable or do not configure this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are assumed to be safe.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_disabletrustedloc_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_disabletrustedloc_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01","displayName":"Trusted Location #1 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_l_allowsubfolders","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_l_allowsubfolders_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_l_allowsubfolders_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_l_datecolon","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_l_descriptioncolon","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc01_l_pathcolon","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02","displayName":"Trusted Location #2 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_l_allowsubfolders23","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_l_allowsubfolders23_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_l_allowsubfolders23_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_l_datecolon21","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_l_descriptioncolon22","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc02_l_pathcolon20","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03","displayName":"Trusted Location #3 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_l_allowsubfolders27","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_l_allowsubfolders27_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_l_allowsubfolders27_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_l_datecolon25","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_l_descriptioncolon26","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc03_l_pathcolon24","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04","displayName":"Trusted Location #4 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_l_allowsubfolders31","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_l_allowsubfolders31_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_l_allowsubfolders31_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_l_datecolon29","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_l_descriptioncolon30","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc04_l_pathcolon28","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05","displayName":"Trusted Location #5 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_l_allowsubfolders35","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_l_allowsubfolders35_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_l_allowsubfolders35_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_l_datecolon33","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_l_descriptioncolon34","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc05_l_pathcolon32","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06","displayName":"Trusted Location #6 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_l_allowsubfolders39","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_l_allowsubfolders39_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_l_allowsubfolders39_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_l_datecolon37","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_l_descriptioncolon38","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc06_l_pathcolon36","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07","displayName":"Trusted Location #7 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_l_allowsubfolders43","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_l_allowsubfolders43_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_l_allowsubfolders43_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_l_datecolon41","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_l_descriptioncolon42","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc07_l_pathcolon40","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08","displayName":"Trusted Location #8 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_l_allowsubfolders47","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_l_allowsubfolders47_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_l_allowsubfolders47_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_l_datecolon45","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_l_descriptioncolon46","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc08_l_pathcolon44","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09","displayName":"Trusted Location #9 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_l_allowsubfolders51","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_l_allowsubfolders51_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_l_allowsubfolders51_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_l_datecolon49","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_l_descriptioncolon50","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc09_l_pathcolon48","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10","displayName":"Trusted Location #10 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_l_allowsubfolders55","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_l_allowsubfolders55_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_l_allowsubfolders55_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_l_datecolon53","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_l_descriptioncolon54","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc10_l_pathcolon52","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11","displayName":"Trusted Location #11 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_l_allowsubfolders59","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_l_allowsubfolders59_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_l_allowsubfolders59_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_l_datecolon57","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_l_descriptioncolon58","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc11_l_pathcolon56","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12","displayName":"Trusted Location #12 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_l_allowsubfolders63","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_l_allowsubfolders63_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_l_allowsubfolders63_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_l_datecolon61","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_l_descriptioncolon62","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc12_l_pathcolon60","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13","displayName":"Trusted Location #13 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_l_allowsubfolders67","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_l_allowsubfolders67_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_l_allowsubfolders67_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_l_datecolon65","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_l_descriptioncolon66","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc13_l_pathcolon64","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14","displayName":"Trusted Location #14 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_l_allowsubfolders71","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_l_allowsubfolders71_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_l_allowsubfolders71_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_l_datecolon69","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_l_descriptioncolon70","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc14_l_pathcolon68","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15","displayName":"Trusted Location #15 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_l_allowsubfolders75","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_l_allowsubfolders75_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_l_allowsubfolders75_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_l_datecolon73","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_l_descriptioncolon74","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc15_l_pathcolon72","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16","displayName":"Trusted Location #16 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_l_allowsubfolders79","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_l_allowsubfolders79_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_l_allowsubfolders79_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_l_datecolon77","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_l_descriptioncolon78","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc16_l_pathcolon76","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17","displayName":"Trusted Location #17 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_l_allowsubfolders83","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_l_allowsubfolders83_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_l_allowsubfolders83_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_l_datecolon81","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_l_descriptioncolon82","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc17_l_pathcolon80","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18","displayName":"Trusted Location #18 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_l_allowsubfolders87","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_l_allowsubfolders87_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_l_allowsubfolders87_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_l_datecolon85","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_l_descriptioncolon86","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc18_l_pathcolon84","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19","displayName":"Trusted Location #19 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_l_allowsubfolders91","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_l_allowsubfolders91_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_l_allowsubfolders91_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_l_datecolon89","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_l_descriptioncolon90","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc19_l_pathcolon88","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20","displayName":"Trusted Location #20 (User)","description":"This policy setting allows you to specify a location that is used as a trusted source for opening files in this application. Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.\r\n\r\nIf you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. If you check the \"Allow sub folders\" check box, then all sub-folders in the folder you specify will also be trusted.\r\n\r\nIf you disable or do not configure this policy setting, the trusted location is not specified.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_l_allowsubfolders95","displayName":"Allow sub folders: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_l_allowsubfolders95_0","displayName":"False","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_l_allowsubfolders95_1","displayName":"True","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_l_datecolon93","displayName":"Date: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_l_descriptioncolon94","displayName":"Description: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_security~l_trustcenter~l_trustedlocations_l_trustedloc20_l_pathcolon92","displayName":"Path: (User)","description":"","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_balloons","displayName":"Balloons (User)","description":"Turning balloons off will show revisions inline. This corresponds to the choices in the Review ribbon.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_balloons_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_balloons_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_balloons_l_empty","displayName":"","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_balloons_l_empty_0","displayName":"Balloons on","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_balloons_l_empty_2","displayName":"Comments and formatting only in balloons","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_balloons_l_empty_1","displayName":"Balloons off (revisions inline)","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_compareresultingdocument","displayName":"Compare resulting document (User)","description":"This option determines whether the results of a document compare or combine will appear in a new document or one of the source documents. This corresponds to the option in the Compare dialog box ( Review ribbon | Compare | more options).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_compareresultingdocument_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_compareresultingdocument_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_compareresultingdocument_l_compareresultingdocumentpart","displayName":"Document used for result of compare: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_compareresultingdocument_l_compareresultingdocumentpart_0","displayName":"Original Document","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_compareresultingdocument_l_compareresultingdocumentpart_1","displayName":"Revised Document","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_compareresultingdocument_l_compareresultingdocumentpart_2","displayName":"New document","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor","displayName":"Deletions color (User)","description":"Selects the color for tracked deletions. This corresponds to the choices in the Review ribbon | Track changes | Change tracking options dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart","displayName":"Color for tracking deletions: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart_0","displayName":"By Author","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart_1","displayName":"None","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart_2","displayName":"Black","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart_3","displayName":"Blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart_4","displayName":"Turquoise","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart_5","displayName":"Bright Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart_6","displayName":"Pink","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart_7","displayName":"Red","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart_8","displayName":"Yellow","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart_9","displayName":"White","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart_10","displayName":"Dark Blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart_11","displayName":"Teal","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart_12","displayName":"Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart_13","displayName":"Violet","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart_14","displayName":"Dark Red","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart_15","displayName":"Dark Yellow","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart_16","displayName":"Gray 50%","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_deletionscolor_l_deletionscolorpart_17","displayName":"Gray 25%","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_ignorewhitespace","displayName":"Ignore White Space (User)","description":"This option determines if white space is compared in document compare. This corresponds to the option in the Compare dialog box ( Review ribbon | Compare | more options).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_ignorewhitespace_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_ignorewhitespace_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor","displayName":"Insertions color (User)","description":"Selects the default color for tracked insertions. This corresponds to the choices in the Review ribbon | Track changes | Change tracking options dialog box.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart","displayName":"Color for tracking insertions: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart_0","displayName":"By Author","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart_1","displayName":"None","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart_2","displayName":"Black","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart_3","displayName":"Blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart_4","displayName":"Turquoise","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart_5","displayName":"Bright Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart_6","displayName":"Pink","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart_7","displayName":"Red","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart_8","displayName":"Yellow","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart_9","displayName":"White","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart_10","displayName":"Dark Blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart_11","displayName":"Teal","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart_12","displayName":"Green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart_13","displayName":"Violet","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart_14","displayName":"Dark Red","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart_15","displayName":"Dark Yellow","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart_16","displayName":"Gray 50%","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_insertionscolor_l_insertionscolorpart_17","displayName":"Gray 25%","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors","displayName":"Table compare colors (User)","description":"This option determines the colors used for displaying the results of compared tables. Selecting ''none'' will track the changes, but they will not be colored in the resulting document (they will be listed in the reviewing pane).","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart1","displayName":"Color for inserted cells: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart1_1","displayName":"None","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart1_0","displayName":"By Author","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart1_2","displayName":"Pink","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart1_3","displayName":"Light blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart1_4","displayName":"Light yellow","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart1_5","displayName":"Light purple","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart1_6","displayName":"Light Orange","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart1_7","displayName":"Light green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart1_8","displayName":"Gray","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart2","displayName":"Color for deleted cells: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart2_1","displayName":"None","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart2_0","displayName":"By Author","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart2_2","displayName":"Pink","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart2_3","displayName":"Light blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart2_4","displayName":"Light yellow","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart2_5","displayName":"Light purple","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart2_6","displayName":"Light Orange","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart2_7","displayName":"Light green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart2_8","displayName":"Gray","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart3","displayName":"Color for merged cells: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart3_1","displayName":"None","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart3_0","displayName":"By Author","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart3_2","displayName":"Pink","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart3_3","displayName":"Light blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart3_4","displayName":"Light yellow","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart3_5","displayName":"Light purple","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart3_6","displayName":"Light Orange","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart3_7","displayName":"Light green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart3_8","displayName":"Gray","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart4","displayName":"Color for split cells: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart4_1","displayName":"None","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart4_0","displayName":"By Author","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart4_2","displayName":"Pink","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart4_3","displayName":"Light blue","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart4_4","displayName":"Light yellow","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart4_5","displayName":"Light purple","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart4_6","displayName":"Light Orange","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart4_7","displayName":"Light green","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v2~policy~l_microsoftofficeword~l_wordoptions~l_trackchangesandcompare_l_tablecomparecolors_l_tablecomparecolorspart4_8","displayName":"Gray","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v3~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_acronyms","displayName":"Remove the Acronyms command from the ribbon (User)","description":"This policy setting allows you to remove the Acronyms command from the ribbon. The Acronyms command appears on the References tab.\r\n\r\nIf you enable this policy setting, the Acronyms command is removed from the ribbon. Users won't be able to add the Acronyms command to the ribbon manually. Therefore users won't be able to use the Acronyms feature.\r\n\r\nIf you disable or don't configure this policy setting, the Acronyms command appears on the ribbon.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v3~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_acronyms_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v3~policy~l_microsoftofficeword~l_wordoptions~l_optionsgeneral_l_acronyms_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v4~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_emailoptions_l_defaultcompressionqualityforinlinedimagesinoutlook","displayName":"Specify default quality of compression done on inlined images inserted in Outlook (User)","description":"This policy setting allows you to specify default quality of compression done on inlined images in Outlook.\r\n\r\nIf you enable this policy setting, Outlook would compress the inlined images in the message as per the specified quality.\r\n\r\nIf you disable or don't configure this policy setting, inlined images would be compressed at the default quality (220 dpi).\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v4~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_emailoptions_l_defaultcompressionqualityforinlinedimagesinoutlook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v4~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_emailoptions_l_defaultcompressionqualityforinlinedimagesinoutlook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v4~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_emailoptions_l_defaultcompressionqualityforinlinedimagesinoutlook_l_defaultcompressionqualityforinlinedimagesinoutlookpart","displayName":"Default inline image compression quality for Outlook: (User)","description":"","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v4~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_emailoptions_l_defaultcompressionqualityforinlinedimagesinoutlook_l_defaultcompressionqualityforinlinedimagesinoutlookpart_0","displayName":"High Fidelity","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v4~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_emailoptions_l_defaultcompressionqualityforinlinedimagesinoutlook_l_defaultcompressionqualityforinlinedimagesinoutlookpart_1","displayName":"330 ppi","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v4~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_emailoptions_l_defaultcompressionqualityforinlinedimagesinoutlook_l_defaultcompressionqualityforinlinedimagesinoutlookpart_2","displayName":"220 ppi","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v4~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_emailoptions_l_defaultcompressionqualityforinlinedimagesinoutlook_l_defaultcompressionqualityforinlinedimagesinoutlookpart_3","displayName":"150 ppi","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v4~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_emailoptions_l_defaultcompressionqualityforinlinedimagesinoutlook_l_defaultcompressionqualityforinlinedimagesinoutlookpart_4","displayName":"96 ppi","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v4~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_emailoptions_l_donotcompressinlinedimagesinoutlook","displayName":"Do not compress the inlined images inserted in Outlook (User)","description":"This policy setting allows you to disable compression on inlined images in Outlook.\r\n\r\nIf you enable this policy setting, Outlook won't compress inlined images in the message.\r\n\r\nIf you disable or don't configure this policy setting, inlined images would be compressed.\r\n\r\nNote: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for enterprise.\r\n ","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v4~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_emailoptions_l_donotcompressinlinedimagesinoutlook_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v4~policy~l_microsoftofficeword~l_wordoptions~l_advanced~l_emailoptions_l_donotcompressinlinedimagesinoutlook_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v9~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingtablealttextaccessibilityinformation","displayName":"Stop checking for table alt text accessibility information (User)","description":"This policy setting prevents the Accessibility Checker from verifying that tables contain alt text.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that tables contain alt text.\r\n\r\nIf you disable or do not configure this policy setting, tables will be checked for alternative text and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v9~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingtablealttextaccessibilityinformation_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v9~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingtablealttextaccessibilityinformation_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v9~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingtoensurehyperlinktextismeaningfultext","displayName":"Stop checking to ensure hyperlink text is meaningful (User)","description":"This policy setting prevents the Accessibility Checker from verifying that hyperlinks have meaningful text.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that hyperlinks have meaningful text.\r\n\r\nIf you disable or do not configure this policy setting, hyperlink text will be checked and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v9~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingtoensurehyperlinktextismeaningfultext_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v9~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingtoensurehyperlinktextismeaningfultext_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_policy_config_word16v9~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingtoensurehyperlinktextismeaningfultextextension","displayName":"Stop checking to ensure hyperlink text extension is meaningful if they include extensions (User)","description":"This policy setting prevents the Accessibility Checker from verifying that hyperlinks have meaningful text if they include extensions.\r\n\r\nIf you enable this policy setting, the Accessibility Checker will be prevented from verifying that hyperlinks have meaningful text if they include extensions.\r\n\r\nIf you disable or do not configure this policy setting, hyperlink text that include extensions will be checked and any issues will appear in the Accessibility Checker.","helpText":"","infoUrls":[],"options":[{"id":"user_vendor_msft_policy_config_word16v9~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingtoensurehyperlinktextismeaningfultextextension_0","displayName":"Disabled","description":null,"helpText":null},{"id":"user_vendor_msft_policy_config_word16v9~policy~l_microsoftofficeword~l_filetab~l_checkaccessibility_l_stopcheckingtoensurehyperlinktextismeaningfultextextension_1","displayName":"Enabled","description":null,"helpText":null}]},{"id":"user_vendor_msft_printerprovisioning_upprinterinstalls_{printersharedid}","displayName":"Printer Shared ID (User)","description":"Identifies the Universal Print printer, by its Share ID, you wish to install on the targeted user account. The printer's Share ID can be found in the printer's properties via the Universal Print portal. Note: the targeted user account must have access rights to both the printer and to the Universal Print service.","helpText":"","infoUrls":[],"options":null},{"id":"user_vendor_msft_printerprovisioning_upprinterinstalls_{printersharedid}_clouddeviceid","displayName":"Cloud Device ID (User)","description":"Identifies the Universal Print printer, by its Printer ID, you wish to install on the targeted user account. The printer's Printer ID can be found in the printer's properties via the Universal Print portal. Note: the targeted user account must have access rights to both the printer and to the Universal Print service.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PrinterProvisioning-csp/"],"options":null},{"id":"user_vendor_msft_printerprovisioning_upprinterinstalls_{printersharedid}_errorcode","displayName":"Error code (User)","description":"Univeral Print printer installation error code.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PrinterProvisioning-csp/"],"options":null},{"id":"user_vendor_msft_printerprovisioning_upprinterinstalls_{printersharedid}_install","displayName":"Install (User)","description":"Install Univeral Print printer.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PrinterProvisioning-csp/"],"options":{"id":"user_vendor_msft_printerprovisioning_upprinterinstalls_{printersharedid}_install_true","displayName":"Install","description":"Install this printer","helpText":null}},{"id":"user_vendor_msft_printerprovisioning_upprinterinstalls_{printersharedid}_printersharedid","displayName":"Shared ID (User)","description":"Universal Print printer shared id","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/UPPrinterInstalls-csp/"],"options":null},{"id":"user_vendor_msft_printerprovisioning_upprinterinstalls_{printersharedid}_printersharedname","displayName":"Printer Shared Name (User)","description":"Identifies the Universal Print printer, by its Share Name, you wish to install on the targeted user account. The printer's Share Name can be found in the printer's properties via the Universal Print portal. Note: the targeted user account must have access rights to both the printer and to the Universal Print service.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PrinterProvisioning-csp/"],"options":null},{"id":"user_vendor_msft_printerprovisioning_upprinterinstalls_{printersharedid}_status","displayName":"Status (User)","description":"Univeral Print printer status.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/PrinterProvisioning-csp/"],"options":null},{"id":"vendor_msft_controlledconfiguration_blob","displayName":"Controlled Configuration Blob","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/defender-csp#:~:text=Configuration/TamperProtection"],"options":null},{"id":"vendor_msft_defender_configuration_tamperprotection","displayName":"TamperProtection","description":"Enable tamper protection to prevent Microsoft Defender being disabled.\r\nNot Configured state is default and will have no impact.\r\nEnabled will enable the Tamper Protection restrictions.\r\nDisabled will disable the Tamper Protection restrictions.\r\nWhen the Enabled or Disabled state exists on a client, deploying Not configured will have no impact on the setting. To change the state from currently Enabled/Disabled, you must deploy the opposite setting to have effect.","helpText":null,"infoUrls":[],"options":[{"id":"vendor_msft_defender_configuration_tamperprotection_0","displayName":"Not configured","description":null,"helpText":null},{"id":"vendor_msft_defender_configuration_tamperprotection_1","displayName":"Enabled","description":null,"helpText":null},{"id":"vendor_msft_defender_configuration_tamperprotection_2","displayName":"Disabled","description":null,"helpText":null}]},{"id":"vendor_msft_defender_configuration_tamperprotection_blob","displayName":"Tamper Protection Blob","description":"","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/defender-csp#:~:text=Configuration/TamperProtection"],"options":null},{"id":"vendor_msft_defender_configuration_tamperprotection_options","displayName":"Controlled Configuration (Device)","description":"This setting can be used to turn on controlled configuration or tamper protection to help protect important security features from unwanted changes and interference.\r\n\r\nIf the setting is configured to Tamper Protection (On), this turns on tamper protection to enforce tamper protected settings to their secure defaults. This includes real-time protection, behavior monitoring, and more. Settings are configured with an MDM solution, such as Intune and is available in Windows 10 Enterprise E5 or equivalent subscriptions.\r\n\r\nIf the setting is configured to Controlled Configuration (On), this turns on controlled configuration, which enforces the configuration coming from Intune exclusively and any non-configured settings to their secure defaults. Controlled configuration is applicable to Antivirus and Endpoint detection and response settings.\r\n\r\nIf the setting is configured to OFF, this turns off Controlled Configuration and Tamper Protection.","helpText":null,"infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/defender-csp#:~:text=Configuration/TamperProtection"],"options":[{"id":"vendor_msft_defender_configuration_tamperprotection_options_1","displayName":"Off","description":null,"helpText":null},{"id":"vendor_msft_defender_configuration_tamperprotection_options_0","displayName":"Tamper Protection (On)","description":null,"helpText":null},{"id":"vendor_msft_defender_configuration_tamperprotection_options_2","displayName":"Controlled Configuration (On)","description":null,"helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_domainprofile_allowlocalipsecpolicymerge","displayName":"Allow Local Ipsec Policy Merge","description":"This value is an on/off switch. If this value is false, connection security rules from the local store are ignored and not enforced, regardless of the schema version and connection security rule version. The merge law for this option is to always use the value of the GroupPolicyRSoPStore.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_domainprofile_allowlocalipsecpolicymerge_false","displayName":"False","description":"AllowLocalIpsecPolicyMerge Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_domainprofile_allowlocalipsecpolicymerge_true","displayName":"True","description":"AllowLocalIpsecPolicyMerge On","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_domainprofile_allowlocalpolicymerge","displayName":"Allow Local Policy Merge","description":"This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_domainprofile_allowlocalpolicymerge_false","displayName":"False","description":"AllowLocalPolicyMerge Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_domainprofile_allowlocalpolicymerge_true","displayName":"True","description":"AllowLocalPolicyMerge On","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_domainprofile_authappsallowuserprefmerge","displayName":"Auth Apps Allow User Pref Merge","description":"This value is used as an on/off switch. If this value is false, authorized application firewall rules in the local store are ignored and not enforced. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_domainprofile_authappsallowuserprefmerge_false","displayName":"False","description":"AuthAppsAllowUserPrefMerge Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_domainprofile_authappsallowuserprefmerge_true","displayName":"True","description":"AuthAppsAllowUserPrefMerge On","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_domainprofile_defaultinboundaction","displayName":"Default Inbound Action for Domain Profile","description":"This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. The merge law for this option is to let the value of the GroupPolicyRSoPStore.win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_domainprofile_defaultinboundaction_0","displayName":"Allow","description":"Allow Inbound By Default","helpText":null},{"id":"vendor_msft_firewall_mdmstore_domainprofile_defaultinboundaction_1","displayName":"Block","description":"Block Inbound By Default","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_domainprofile_defaultoutboundaction","displayName":"Default Outbound Action","description":"This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_domainprofile_defaultoutboundaction_0","displayName":"Allow","description":"Allow Outbound By Default","helpText":null},{"id":"vendor_msft_firewall_mdmstore_domainprofile_defaultoutboundaction_1","displayName":"Block","description":"Block Outbound By Default","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_domainprofile_disableinboundnotifications","displayName":"Disable Inbound Notifications","description":"This value is an on/off switch. If this value is false, the firewall MAY display a notification to the user when an application is blocked from listening on a port. If this value is on, the firewall MUST NOT display such a notification. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_domainprofile_disableinboundnotifications_false","displayName":"False","description":"Firewall May Display Notification","helpText":null},{"id":"vendor_msft_firewall_mdmstore_domainprofile_disableinboundnotifications_true","displayName":"True","description":"Firewall Must Not Display Notification","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_domainprofile_disablestealthmode","displayName":"Disable Stealth Mode","description":"This value is an on/off switch. When this option is false, the server operates in stealth mode. The firewall rules used to enforce stealth mode are implementation-specific. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_domainprofile_disablestealthmode_false","displayName":"False","description":"Use Stealth Mode","helpText":null},{"id":"vendor_msft_firewall_mdmstore_domainprofile_disablestealthmode_true","displayName":"True","description":"Disable Stealth Mode","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_domainprofile_disablestealthmodeipsecsecuredpacketexemption","displayName":"Disable Stealth Mode Ipsec Secured Packet Exemption","description":"This value is an on/off switch. This option is ignored if DisableStealthMode is on. Otherwise, when this option is true, the firewall's stealth mode rules MUST NOT prevent the host computer from responding to unsolicited network traffic if that traffic is secured by IPsec. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used. For schema versions 0x0200, 0x0201, and 0x020A, this value is invalid and MUST NOT be used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_domainprofile_disablestealthmodeipsecsecuredpacketexemption_false","displayName":"False","description":"FALSE","helpText":null},{"id":"vendor_msft_firewall_mdmstore_domainprofile_disablestealthmodeipsecsecuredpacketexemption_true","displayName":"True","description":"TRUE","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_domainprofile_disableunicastresponsestomulticastbroadcast","displayName":"Disable Unicast Responses To Multicast Broadcast","description":"This value is used as an on/off switch. If it is true, unicast responses to multicast broadcast traffic is blocked. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_domainprofile_disableunicastresponsestomulticastbroadcast_false","displayName":"False","description":"Unicast Responses Not Blocked","helpText":null},{"id":"vendor_msft_firewall_mdmstore_domainprofile_disableunicastresponsestomulticastbroadcast_true","displayName":"True","description":"Unicast Responses Blocked","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_domainprofile_enablefirewall","displayName":"Enable Domain Network Firewall","description":"This value is an on/off switch for the firewall and advanced security enforcement. If this value is false, the server MUST NOT block any network traffic, regardless of other policy settings. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":" ","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_domainprofile_enablefirewall_false","displayName":"False","description":"Disable Firewall","helpText":null},{"id":"vendor_msft_firewall_mdmstore_domainprofile_enablefirewall_true","displayName":"True","description":"Enable Firewall","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_domainprofile_enablelogdroppedpackets","displayName":"Enable Log Dropped Packets","description":"This value is used as an on/off switch. If this value is on, the firewall logs all the dropped packets. The merge law for this option is to let \"on\" values win.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_domainprofile_enablelogdroppedpackets_false","displayName":"Disable Logging Of Dropped Packets","description":"Disable Logging Of Dropped Packets","helpText":null},{"id":"vendor_msft_firewall_mdmstore_domainprofile_enablelogdroppedpackets_true","displayName":"Enable Logging Of Dropped Packets","description":"Enable Logging Of Dropped Packets","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_domainprofile_enablelogignoredrules","displayName":"Enable Log Ignored Rules","description":"This value is used as an on/off switch. The server MAY use this value in an implementation-specific way to control logging of events if a rule is not enforced for any reason. The merge law for this option is to let \"on\" values win.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_domainprofile_enablelogignoredrules_false","displayName":"Disable Logging Of Ignored Rules","description":"Disable Logging Of Ignored Rules","helpText":null},{"id":"vendor_msft_firewall_mdmstore_domainprofile_enablelogignoredrules_true","displayName":"Enable Logging Of Ignored Rules","description":"Enable Logging Of Ignored Rules","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_domainprofile_enablelogsuccessconnections","displayName":"Enable Log Success Connections","description":"This value is used as an on/off switch. If this value is on, the firewall logs all successful inbound connections. The merge law for this option is to let \"on\" values win.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_domainprofile_enablelogsuccessconnections_false","displayName":"Disable Logging Of Successful Connections","description":"Disable Logging Of Successful Connections","helpText":null},{"id":"vendor_msft_firewall_mdmstore_domainprofile_enablelogsuccessconnections_true","displayName":"Enable Logging Of Successful Connections","description":"Enable Logging Of Successful Connections","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_domainprofile_globalportsallowuserprefmerge","displayName":"Global Ports Allow User Pref Merge","description":"This value is used as an on/off switch. If this value is false, global port firewall rules in the local store are ignored and not enforced. The setting only has meaning if it is set or enumerated in the Group Policy store or if it is enumerated from the GroupPolicyRSoPStore. The merge law for this option is to let the value GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_domainprofile_globalportsallowuserprefmerge_false","displayName":"False","description":"GlobalPortsAllowUserPrefMerge Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_domainprofile_globalportsallowuserprefmerge_true","displayName":"True","description":"GlobalPortsAllowUserPrefMerge On","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_domainprofile_logfilepath","displayName":"Log File Path","description":"This value is a string that represents a file path to the log where the firewall logs dropped packets and successful connections. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured, otherwise the MdmStore value wins if it is configured, otherwise the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_domainprofile_logmaxfilesize","displayName":"Log Max File Size","description":"This value specifies the size, in kilobytes, of the log file where dropped packets and successful connections are logged. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured, otherwise the MdmStore value wins if it is configured, otherwise the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_domainprofile_shielded","displayName":"Shielded","description":"This value is used as an on/off switch. If this value is on and EnableFirewall is on, the server MUST block all incoming traffic regardless of other policy settings. The merge law for this option is to let \"on\" values win.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_domainprofile_shielded_false","displayName":"False","description":"Shielding Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_domainprofile_shielded_true","displayName":"True","description":"Shielding On","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}","displayName":" Firewall Rule Name","description":"Unique alpha numeric identifier for the rule. The rule name must not include a forward slash (/).","helpText":"","infoUrls":[],"options":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_action_type","displayName":"Action","description":"Specifies the action the rule enforces to block or allow network traffic.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_action_type_0","displayName":"Block","description":"Block","helpText":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_action_type_1","displayName":"Allow","description":"Allow","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_app_filepath","displayName":"File Path","description":"The file path of an app is simply its location on the client device. For example, C:\\Windows\\System\\Notepad.exe or %WINDIR%\\Notepad.exe. You can define one application to be used in each Firewall rule. If you specify multiple conditions in a single rule, these will be treated as an AND operation. i.e program=svchost.exe AND service=mpssvc, etc. All of the app related conditions in a single rule work to scope the traffic even further, so they must all correspond to the specific app/service.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_app_packagefamilyname","displayName":"Package Family Name","description":"Package family names can be retrieved by running the Get-AppxPackage command from PowerShell. You can define one application to be used in each Firewall rule. If you specify multiple conditions in a single rule, these will be treated as an AND operation. i.e program=svchost.exe AND service=mpssvc, etc. All of the app related conditions in a single rule work to scope the traffic even further, so they must all correspond to the specific app/service.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_app_servicename","displayName":"Service Name","description":"Windows service short names are used in cases when a service, not an application, is sending or receiving traffic. Service short names can be retrieved by running the Get-Service command from PowerShell. You can define one application to be used in each Firewall rule. If you specify multiple conditions in a single rule, these will be treated as an AND operation. i.e program=svchost.exe AND service=mpssvc, etc. All of the app related conditions in a single rule work to scope the traffic even further, so they must all correspond to the specific app/service.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_description","displayName":"Description","description":"Specifies the description of the rule.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_direction","displayName":"Direction","description":"Comma separated list. The rule is enabled based on the traffic direction as following.\n\nIN - the rule applies to inbound traffic.\nOUT - the rule applies to outbound traffic.\n\nIf not specified the detault is OUT.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_direction_in","displayName":"The rule applies to inbound traffic.","description":"The rule applies to inbound traffic.","helpText":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_direction_out","displayName":"The rule applies to outbound traffic.","description":"The rule applies to outbound traffic.","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_edgetraversal","displayName":"Edge Traversal","description":"Indicates whether edge traversal is enabled or disabled for this rule.\n\nThe EdgeTraversal property indicates that specific inbound traffic is allowed to tunnel through NATs and other edge devices using the Teredo tunneling technology. In order for this setting to work correctly, the application or service with the inbound firewall rule needs to support IPv6. The primary application of this setting allows listeners on the host to be globally addressable through a Teredo IPv6 address.\n\nNew rules have the EdgeTraversal property disabled by default.\n","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_edgetraversal_0","displayName":"Disabled","description":"Disabled","helpText":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_edgetraversal_1","displayName":"Enabled","description":"Enabled","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_enabled","displayName":"Enabled","description":"Indicates whether the rule is enabled or disabled. If not specified - a new rule is enabled by default.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_enabled_0","displayName":"Disabled","description":"Disabled","helpText":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_enabled_1","displayName":"Enabled","description":"Enabled","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_firewallrulename","displayName":null,"description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_icmptypesandcodes","displayName":"ICMP Types And Codes","description":"\n String value. Multiple ICMP type+code pairs can be included in the string by separating each value with a \",\". If more than one ICMP type+code pair is specified, the strings must be separated by a comma.\n To specify all ICMP types and codes, use the \"*\" character. For specific ICMP types and codes, use the \":\" to separate the type and code.\n The following are valid examples: 3:4 or 1:*. The \"*\" character can be used to represent any code. The \"*\" character can't be used to specify any type, examples such as \"*:4\" or \"*:*\" are invalid.\n When setting this field in a firewall rule, the protocol field must also be set, to either 1 (ICMP) or 58 (IPv6-ICMP).","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_interfacetypes","displayName":"Interface Types","description":"String value. Multiple interface types can be included in the string by separating each value with a \",\". Acceptable values are \"RemoteAccess\", \"Wireless\", \"Lan\", and \"All\".\n If more than one interface type is specified, the strings must be separated by a comma.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_interfacetypes_remoteaccess","displayName":"Remote Access","description":"RemoteAccess","helpText":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_interfacetypes_wireless","displayName":"Wireless","description":"Wireless","helpText":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_interfacetypes_lan","displayName":"Lan","description":"Lan","helpText":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_interfacetypes_mobilebroadband","displayName":"[Not Supported] Mobile Broadband","description":"MobileBroadband","helpText":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_interfacetypes_mbb","displayName":"Mobile Broadband","description":"MobileBroadband","helpText":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_interfacetypes_all","displayName":"All","description":"All","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_localaddressranges","displayName":"Local Address Ranges","description":"List of local addresses covered by the rule. Valid tokens include:​\r\n\r\n\"*\" indicates any local address. If present, this must be the only token included.\r\nA subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask nor a network prefix is specified, the subnet mask defaults to 255.255.255.255.​​\r\nA valid IPv6 address.​​\r\nAn IPv4 address range in the format of \"start address - end address\" with no spaces included, where the start address is less than the end address.​​\r\nAn IPv6 address range in the format of \"start address - end address\" with no spaces included, where the start address is less than the end address.\r\n\r\nIf not specified, the default is \"Any address.\"","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_localportranges","displayName":"Local Port Ranges","description":"List of local port ranges. Valid values include:​\r\n\r\nA valid port number between 0 and 65535. For example, 200\r\nA port range in the format of \"start port – end port\" with no spaces included, where the start port is less than the end port. For example, 300-320\r\n\r\nIf not specified, the default is \"All ports.\" When defining multiple local and remote port ranges, the Firewall rule will be evaluated as OR operations within an individual field, and AND operations across rule fields. i.e. (local port A OR local port B) AND (remote port A OR remote port B). When setting this field in a firewall rule, the protocol field must also be set, to either 6 (TCP) or 17 (UDP).","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_localuserauthorizedlist","displayName":"Local User Authorized List","description":"Specifies the list of authorized local users for this rule. A list of authorized users cannot be specified if the rule being authored is targeting a Windows service. If not specified, the default is all users.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_name","displayName":"Name","description":"Specifies the friendly name of the firewall rule.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_policyappid","displayName":"Policy App Id","description":" Specifies one WDAC tag. This is a string that can contain any alphanumeric character and any of the characters \":\", \"/\", \".\", and \"_\". \r\n A PolicyAppId and ServiceName cannot be specified in the same rule.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_profiles","displayName":"Network Types","description":"Specifies the profiles to which the rule belongs: Domain, Private, Public. See FW_PROFILE_TYPE for the bitmasks that are used to identify profile types. If not specified, the default is All.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_profiles_1","displayName":"FW_PROFILE_TYPE_DOMAIN: This value represents the profile for networks that are connected to domains.","description":"FW_PROFILE_TYPE_DOMAIN: This value represents the profile for networks that are connected to domains.","helpText":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_profiles_2","displayName":"FW_PROFILE_TYPE_PRIVATE: This value represents the standard profile for networks. These networks are classified as private by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are behind Network Address Translation (NAT) devices, routers, and other edge devices, and they are in a private location, such as a home or an office. AND FW_PROFILE_TYPE_PRIVATE: This value represents the profile for private networks, which is represented by the same value as that used for FW_PROFILE_TYPE_STANDARD.","description":"FW_PROFILE_TYPE_STANDARD: This value represents the standard profile for networks. These networks are classified as private by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are behind Network Address Translation (NAT) devices, routers, and other edge devices, and they are in a private location, such as a home or an office. AND FW_PROFILE_TYPE_PRIVATE: This value represents the profile for private networks, which is represented by the same value as that used for FW_PROFILE_TYPE_STANDARD.","helpText":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_profiles_4","displayName":"FWPROFILETYPEPUBLIC: This value represents the profile for public networks. These networks are classified as public by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are those at airports, coffee shops, and other public places where the peers in the network or the network administrator are not trusted.","description":"FW_PROFILE_TYPE_PUBLIC: This value represents the profile for public networks. These networks are classified as public by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are those at airports, coffee shops, and other public places where the peers in the network or the network administrator are not trusted.","helpText":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_profiles_2147483647","displayName":"FW_PROFILE_TYPE_ALL: This value represents all these network sets and any future network sets.","description":"FW_PROFILE_TYPE_ALL: This value represents all these network sets and any future network sets.","helpText":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_profiles_-2147483648","displayName":"FW_PROFILE_TYPE_CURRENT: This value represents the current profiles to which the firewall and advanced security components determine the host is connected at the moment of the call. This value can be specified only in method calls, and it cannot be combined with other flags.","description":"FW_PROFILE_TYPE_CURRENT: This value represents the current profiles to which the firewall and advanced security components determine the host is connected at the moment of the call. This value can be specified only in method calls, and it cannot be combined with other flags.","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_protocol","displayName":"Protocol","description":"Select the protocol for this port rule. Transport layer protocols, TCP(6) and UDP(17), allow you to specify ports or port ranges. For custom protocols, enter a number between 0 and 255 representing the IP protocol. If not specified, the default is \"Any.\"","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_remoteaddressdynamickeywords","displayName":"Reusable groups","description":"Comma separated list of Dynamic Keyword Address Ids (GUID strings) specifying the remote addresses covered by the rule.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_remoteaddressranges","displayName":"Remote Address Ranges","description":"List of remote addresses covered by the rule. Tokens are case insensitive. Valid tokens include:​​​\r\n\r\n\"*\" indicates any remote address. If present, this must be the only token included.\r\n\r\n\"Defaultgateway\"\r\n\"DHCP\"\r\n\"DNS\"\r\n\"WINS\"\r\n\"Intranet\" (supported on Windows versions 1809+)\r\n\"RmtIntranet\" (supported on Windows versions 1809+)\r\n\"Internet\" (supported on Windows versions 1809+)\r\n\"Ply2Renders\" ​(supported on Windows versions 1809+)\r\n\"LocalSubnet\" indicates any local address on the local subnet.\r\nA subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask nor a network prefix is specified, the subnet mask defaults to 255.255.255.255.\r\nA valid IPv6 address.\r\nAn IPv4 address range in the format of \"start address - end address\" with no spaces included, where the start address is less than the end address.\r\nAn IPv6 address range in the format of \"start address - end address\" with no spaces included, where the start address is less than the end address.​\r\n\r\nIf not specified, the default is \"Any address.\"","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_firewallrules_{firewallrulename}_remoteportranges","displayName":"Remote Port Ranges","description":"List of remote port ranges. Valid values include:​\r\n\r\nA valid port number between 0 and 65535. For example, 200\r\nA port range in the format of \"start port – end port\" with no spaces included, where the start port is less than the end port. For example, 300-320\r\n\r\nIf not specified, the default is \"All ports.\" When defining multiple local and remote port ranges, the Firewall rule will be evaluated as OR operations within an individual field, and AND operations across rule fields. i.e. (local port A OR local port B) AND (remote port A OR remote port B). When setting this field in a firewall rule, the protocol field must also be set, to either 6 (TCP) or 17 (UDP).","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_global_crlcheck","displayName":"Certificate revocation list verification","description":"This value specifies how certificate revocation list (CRL) verification is enforced. The value MUST be 0, 1, or 2. A value of 0 disables CRL checking. A value of 1 specifies that CRL checking is attempted and that certificate validation fails only if the certificate is revoked. Other failures that are encountered during CRL checking (such as the revocation URL being unreachable) do not cause certificate validation to fail. A value of 2 means that checking is required and that certificate validation fails if any error is encountered during CRL processing. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_global_crlcheck_0","displayName":"None","description":"Disables CRL checking","helpText":null},{"id":"vendor_msft_firewall_mdmstore_global_crlcheck_1","displayName":"Attempt","description":"Specifies that CRL checking is attempted and that certificate validation fails only if the certificate is revoked. Other failures that are encountered during CRL checking (such as the revocation URL being unreachable) do not cause certificate validation to fail.","helpText":null},{"id":"vendor_msft_firewall_mdmstore_global_crlcheck_2","displayName":"Require","description":"Means that checking is required and that certificate validation fails if any error is encountered during CRL processing","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_global_disablestatefulftp","displayName":"Disable Stateful Ftp","description":"This value is an on/off switch. If off, the firewall performs stateful File Transfer Protocol (FTP) filtering to allow secondary connections. FALSE means off; TRUE means on, so the stateful FTP is disabled. The merge law for this option is to let \"on\" values win.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_global_disablestatefulftp_false","displayName":"False","description":"Stateful FTP enabled","helpText":null},{"id":"vendor_msft_firewall_mdmstore_global_disablestatefulftp_true","displayName":"True","description":"Stateful FTP disabled","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_global_enableauditmode","displayName":"Enable Audit Mode","description":"This value specifies if the target machine is in Firewall Audit Mode.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_global_enableauditmode_false","displayName":"Indicates that Audit mode is disabled","description":"Indicates that Audit mode is disabled","helpText":null},{"id":"vendor_msft_firewall_mdmstore_global_enableauditmode_true","displayName":"Indicates that Audit mode is enabled","description":"Indicates that Audit mode is enabled","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_global_enablepacketqueue","displayName":"Enable Packet Queue","description":"This value specifies how scaling for the software on the receive side is enabled for both the encrypted receive and clear text forward path for the IPsec tunnel gateway scenario. Use of this option also ensures that the packet order is preserved. The data type for this option value is a integer and is a combination of flags. A value of 0x00 indicates that all queuing is to be disabled. A value of 0x01 specifies that inbound encrypted packets are to be queued. A value of 0x02 specifies that packets are to be queued after decryption is performed for forwarding.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_global_enablepacketqueue_0","displayName":"Disabled","description":"Indicates that all queuing is to be disabled","helpText":null},{"id":"vendor_msft_firewall_mdmstore_global_enablepacketqueue_1","displayName":"Queue Inbound","description":"Specifies that inbound encrypted packets are to be queued","helpText":null},{"id":"vendor_msft_firewall_mdmstore_global_enablepacketqueue_2","displayName":"Queue Outbound","description":"Specifies that packets are to be queued after decryption is performed for forwarding","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_global_ipsecexempt","displayName":"IPsec Exceptions","description":"This value configures IPsec exceptions and MUST be a combination of the valid flags that are defined in IPSEC_EXEMPT_VALUES; therefore, the maximum value MUST always be IPSEC_EXEMPT_MAX-1 for servers supporting a schema version of 0x0201 and IPSEC_EXEMPT_MAX_V2_0-1 for servers supporting a schema version of 0x0200. If the maximum value is exceeded when the method RRPC_FWSetGlobalConfig (Opnum 4) is called, the method returns ERROR_INVALID_PARAMETER. This error code is returned if no other preceding error is discovered. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_global_ipsecexempt_0","displayName":"FWGLOBALCONFIGIPSECEXEMPTNONE: No IPsec exemptions.","description":"FW_GLOBAL_CONFIG_IPSEC_EXEMPT_NONE: No IPsec exemptions.","helpText":null},{"id":"vendor_msft_firewall_mdmstore_global_ipsecexempt_1","displayName":"Exempt neighbor discover IPv6 ICMP type-codes from IPsec","description":"FW_GLOBAL_CONFIG_IPSEC_EXEMPT_NEIGHBOR_DISC: Exempt neighbor discover IPv6 ICMP type-codes from IPsec.","helpText":null},{"id":"vendor_msft_firewall_mdmstore_global_ipsecexempt_2","displayName":"Exempt ICMP from IPsec","description":"FW_GLOBAL_CONFIG_IPSEC_EXEMPT_ICMP: Exempt ICMP from IPsec.","helpText":null},{"id":"vendor_msft_firewall_mdmstore_global_ipsecexempt_4","displayName":"Exempt router discover IPv6 ICMP type-codes from IPsec","description":"FW_GLOBAL_CONFIG_IPSEC_EXEMPT_ROUTER_DISC: Exempt router discover IPv6 ICMP type-codes from IPsec.","helpText":null},{"id":"vendor_msft_firewall_mdmstore_global_ipsecexempt_8","displayName":"Exempt both IPv4 and IPv6 DHCP traffic from IPsec","description":"FW_GLOBAL_CONFIG_IPSEC_EXEMPT_DHCP: Exempt both IPv4 and IPv6 DHCP traffic from IPsec.","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_global_opportunisticallymatchauthsetperkm","displayName":"Opportunistically Match Auth Set Per KM","description":"This value is used as an on/off switch. When this option is false, keying modules MUST ignore the entire authentication set if they do not support all of the authentication suites specified in the set. When this option is true, keying modules MUST ignore only the authentication suites that they don’t support. For schema versions 0x0200, 0x0201, and 0x020A, this value is invalid and MUST NOT be used.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_global_opportunisticallymatchauthsetperkm_false","displayName":"False","description":"FALSE","helpText":null},{"id":"vendor_msft_firewall_mdmstore_global_opportunisticallymatchauthsetperkm_true","displayName":"True","description":"TRUE","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_global_presharedkeyencoding","displayName":"Preshared Key Encoding","description":"Specifies the preshared key encoding that is used. MUST be a valid value from the PRESHARED_KEY_ENCODING_VALUES enumeration. Default is 1 [UTF-8]. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_global_presharedkeyencoding_0","displayName":"None","description":"FW_GLOBAL_CONFIG_PRESHARED_KEY_ENCODING_NONE: Preshared key is not encoded. Instead, it is kept in its wide-character format. This symbolic constant has a value of 0.","helpText":null},{"id":"vendor_msft_firewall_mdmstore_global_presharedkeyencoding_1","displayName":"UTF8","description":"FW_GLOBAL_CONFIG_PRESHARED_KEY_ENCODING_UTF_8: Encode the preshared key using UTF-8. This symbolic constant has a value of 1.","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_global_saidletime","displayName":"Security association idle time","description":"This value configures the security association idle time, in seconds. Security associations are deleted after network traffic is not seen for this specified period of time. The value MUST be in the range of 300 to 3,600 inclusive. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}","displayName":" Firewall Rule Name","description":"Unique alpha numeric identifier for the rule. The rule name must not include a forward slash (/).","helpText":"","infoUrls":[],"options":null},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_action","displayName":"Action","description":"Specifies the action the rule enforces:\n0 - Block\n1 - Allow","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_action_0","displayName":"Block","description":"Block","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_action_1","displayName":"Allow","description":"Allow","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_direction","displayName":"Direction","description":"The rule is enabled based on the traffic direction as following.\n\nIN - the rule applies to inbound traffic.\nOUT - the rule applies to outbound traffic.\n\nIf not specified the detault is OUT.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_direction_in","displayName":"The rule applies to inbound traffic.","description":"The rule applies to inbound traffic.","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_direction_out","displayName":"The rule applies to outbound traffic.","description":"The rule applies to outbound traffic.","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_enabled","displayName":"Enabled","description":"Indicates whether the rule is enabled or disabled. If not specified - a new rule is enabled by default.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_enabled_0","displayName":"Disabled","description":"Disabled","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_enabled_1","displayName":"Enabled","description":"Enabled","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_firewallrulename","displayName":null,"description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_localaddressranges","displayName":"Local Address Ranges","description":"Consists of one or more comma-delimited tokens specifying the local addresses covered by the rule. \"*\" is the default value.\nValid tokens include:\n\"*\" indicates any local address. If present, this must be the only token included.\n\nA subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to 255.255.255.255.\nA valid IPv6 address.\nAn IPv4 address range in the format of \"start address - end address\" with no spaces included.\nAn IPv6 address range in the format of \"start address - end address\" with no spaces included. If not specified the default is All.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_localportranges","displayName":"Local Port Ranges","description":"Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the default is All.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_name","displayName":"Name","description":"Specifies the friendly name of the Hyper-V Firewall rule.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_priority","displayName":"Priority","description":"This value represents the order of rule enforcement. A lower priority rule is evaluated first. If not specified, block rules are evaluated before allow rules. If priority is configured, it is highly recommended to configure the value for ALL rules to ensure expected evaluation of rules.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_profiles","displayName":"Profiles","description":"Specifies the profiles to which the rule belongs: Domain, Private, Public. See FW_PROFILE_TYPE for the bitmasks that are used to identify profile types. If not specified, the default is All.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_profiles_1","displayName":"FWPROFILETYPEDOMAIN: This value represents the profile for networks that are connected to domains.","description":"FW_PROFILE_TYPE_DOMAIN: This value represents the profile for networks that are connected to domains.","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_profiles_2","displayName":"FWPROFILETYPESTANDARD: This value represents the standard profile for networks. These networks are classified as private by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are behind Network Address Translation (NAT) devices, routers, and other edge devices, and they are in a private location, such as a home or an office. AND FWPROFILETYPEPRIVATE: This value represents the profile for private networks, which is represented by the same value as that used for FWPROFILETYPESTANDARD.","description":"FW_PROFILE_TYPE_STANDARD: This value represents the standard profile for networks. These networks are classified as private by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are behind Network Address Translation (NAT) devices, routers, and other edge devices, and they are in a private location, such as a home or an office. AND FW_PROFILE_TYPE_PRIVATE: This value represents the profile for private networks, which is represented by the same value as that used for FW_PROFILE_TYPE_STANDARD.","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_profiles_4","displayName":"FWPROFILETYPEPUBLIC: This value represents the profile for public networks. These networks are classified as public by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are those at airports, coffee shops, and other public places where the peers in the network or the network administrator are not trusted.","description":"FW_PROFILE_TYPE_PUBLIC: This value represents the profile for public networks. These networks are classified as public by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are those at airports, coffee shops, and other public places where the peers in the network or the network administrator are not trusted.","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_profiles_2147483647","displayName":"FWPROFILETYPEALL: This value represents all these network sets and any future network sets.","description":"FW_PROFILE_TYPE_ALL: This value represents all these network sets and any future network sets.","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_protocol","displayName":"Protocol","description":"0-255 number representing the ip protocol (TCP = 6, UDP = 17). If not specified the default is All.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_remoteaddressranges","displayName":"Remote Address Ranges","description":"Consists of one or more comma-delimited tokens specifying the remote addresses covered by the rule. The default value is \"*\". Valid tokens include:\n\"*\" indicates any remote address. If present, this must be the only token included.\nA subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to 255.255.255.255.\nA valid IPv6 address.\nAn IPv4 address range in the format of \"start address - end address\" with no spaces included.\nAn IPv6 address range in the format of \"start address - end address\" with no spaces included. If not specified the default is All.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_remoteportranges","displayName":"Remote Port Ranges","description":" Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the default is All.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_vmcreatorid","displayName":"Target","description":"This field specifies the VM Creator ID that this rule is applicable to. Not configuring this setting will result in this rule applying to all VM creators.\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":{"id":"vendor_msft_firewall_mdmstore_hypervfirewallrules_{firewallrulename}_vmcreatorid_wsl","displayName":"Windows Subsystem for Linux","description":"Windows Subsystem for Linux","helpText":null}},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}","displayName":"VM Creator Id","description":"VM Creator ID that these settings apply to. Valid format is a GUID","helpText":"","infoUrls":[],"options":null},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_allowhostpolicymerge","displayName":"Allow Host Policy Merge","description":"This value is used as an on/off switch. If this value is true, applicable host firewall rules and settings will be applied to Hyper-V Firewall.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_allowhostpolicymerge_false","displayName":"AllowHostPolicyMerge Off","description":"AllowHostPolicyMerge Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_allowhostpolicymerge_true","displayName":"AllowHostPolicyMerge On","description":"AllowHostPolicyMerge On","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_domainprofile_allowlocalpolicymerge","displayName":"Allow Local Policy Merge","description":"This value is used as an on/off switch. If this value is false, Hyper-V Firewall rules from the local store are ignored and not enforced.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_domainprofile_allowlocalpolicymerge_false","displayName":"AllowLocalPolicyMerge Off","description":"AllowLocalPolicyMerge Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_domainprofile_allowlocalpolicymerge_true","displayName":"AllowLocalPolicyMerge On","description":"AllowLocalPolicyMerge On","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_domainprofile_defaultinboundaction","displayName":"Default Inbound Action","description":"This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_domainprofile_defaultinboundaction_0","displayName":"Allow Inbound By Default","description":"Allow Inbound By Default","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_domainprofile_defaultinboundaction_1","displayName":"Block Inbound By Default","description":"Block Inbound By Default","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_domainprofile_defaultoutboundaction","displayName":"Default Outbound Action","description":"This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_domainprofile_defaultoutboundaction_0","displayName":"Allow Outbound By Default","description":"Allow Outbound By Default","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_domainprofile_defaultoutboundaction_1","displayName":"Block Outbound By Default","description":"Block Outbound By Default","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_domainprofile_enablefirewall","displayName":"Enable Domain Network Firewall","description":"This value is an on/off switch for the Hyper-V Firewall enforcement.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_domainprofile_enablefirewall_false","displayName":"False","description":"Disable Firewall","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_domainprofile_enablefirewall_true","displayName":"True","description":"Enable Firewall","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_enableloopback","displayName":"Enable Loopback","description":"This value is an on/off switch for loopback traffic. This determines if this VM is able to send/receive loopback traffic to other VMs or the host.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_enableloopback_false","displayName":"Disable loopback","description":"Disable loopback","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_enableloopback_true","displayName":"Enable loopback","description":"Enable loopback","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_privateprofile_allowlocalpolicymerge","displayName":"Allow Local Policy Merge","description":"This value is used as an on/off switch. If this value is false, Hyper-V Firewall rules from the local store are ignored and not enforced.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_privateprofile_allowlocalpolicymerge_false","displayName":"AllowLocalPolicyMerge Off","description":"AllowLocalPolicyMerge Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_privateprofile_allowlocalpolicymerge_true","displayName":"AllowLocalPolicyMerge On","description":"AllowLocalPolicyMerge On","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_privateprofile_defaultinboundaction","displayName":"Default Inbound Action","description":"This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_privateprofile_defaultinboundaction_0","displayName":"Allow Inbound By Default","description":"Allow Inbound By Default","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_privateprofile_defaultinboundaction_1","displayName":"Block Inbound By Default","description":"Block Inbound By Default","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_privateprofile_defaultoutboundaction","displayName":"Default Outbound Action","description":"This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_privateprofile_defaultoutboundaction_0","displayName":"Allow Outbound By Default","description":"Allow Outbound By Default","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_privateprofile_defaultoutboundaction_1","displayName":"Block Outbound By Default","description":"Block Outbound By Default","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_privateprofile_enablefirewall","displayName":"Enable Private Network Firewall","description":"This value is an on/off switch for the Hyper-V Firewall enforcement.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_privateprofile_enablefirewall_false","displayName":"False","description":"Disable Firewall","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_privateprofile_enablefirewall_true","displayName":"True","description":"Enable Firewall","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_publicprofile_allowlocalpolicymerge","displayName":"Allow Local Policy Merge","description":"This value is used as an on/off switch. If this value is false, Hyper-V Firewall rules from the local store are ignored and not enforced.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_publicprofile_allowlocalpolicymerge_false","displayName":"AllowLocalPolicyMerge Off","description":"AllowLocalPolicyMerge Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_publicprofile_allowlocalpolicymerge_true","displayName":"AllowLocalPolicyMerge On","description":"AllowLocalPolicyMerge On","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_publicprofile_defaultinboundaction","displayName":"Default Inbound Action","description":"This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_publicprofile_defaultinboundaction_0","displayName":"Allow Inbound By Default","description":"Allow Inbound By Default","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_publicprofile_defaultinboundaction_1","displayName":"Block Inbound By Default","description":"Block Inbound By Default","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_publicprofile_defaultoutboundaction","displayName":"Default Outbound Action","description":"This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_publicprofile_defaultoutboundaction_0","displayName":"Allow Outbound By Default","description":"Allow Outbound By Default","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_publicprofile_defaultoutboundaction_1","displayName":"Block Outbound By Default","description":"Block Outbound By Default","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_publicprofile_enablefirewall","displayName":"Enable Public Network Firewall","description":"This value is an on/off switch for the Hyper-V Firewall enforcement.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_publicprofile_enablefirewall_false","displayName":"False","description":"Disable Hyper-V Firewall","helpText":null},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_publicprofile_enablefirewall_true","displayName":"True","description":"Enable Hyper-V Firewall","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_target","displayName":"Target","description":"Settings for the Windows Firewall for Hyper-V containers. Each setting applies on a per-VM Creator basis","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":{"id":"vendor_msft_firewall_mdmstore_hypervvmsettings_{vmcreatorid}_target_wsl","displayName":"Windows Subsystem for Linux","description":"Windows Subsystem for Linux","helpText":null}},{"id":"vendor_msft_firewall_mdmstore_privateprofile_allowlocalipsecpolicymerge","displayName":"Allow Local Ipsec Policy Merge","description":"This value is an on/off switch. If this value is false, connection security rules from the local store are ignored and not enforced, regardless of the schema version and connection security rule version. The merge law for this option is to always use the value of the GroupPolicyRSoPStore.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_privateprofile_allowlocalipsecpolicymerge_false","displayName":"False","description":"AllowLocalIpsecPolicyMerge Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_privateprofile_allowlocalipsecpolicymerge_true","displayName":"True","description":"AllowLocalIpsecPolicyMerge On","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_privateprofile_allowlocalpolicymerge","displayName":"Allow Local Policy Merge","description":"This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_privateprofile_allowlocalpolicymerge_false","displayName":"False","description":"AllowLocalPolicyMerge Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_privateprofile_allowlocalpolicymerge_true","displayName":"True","description":"AllowLocalPolicyMerge On","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_privateprofile_authappsallowuserprefmerge","displayName":"Auth Apps Allow User Pref Merge","description":"This value is used as an on/off switch. If this value is false, authorized application firewall rules in the local store are ignored and not enforced. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_privateprofile_authappsallowuserprefmerge_false","displayName":"False","description":"AuthAppsAllowUserPrefMerge Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_privateprofile_authappsallowuserprefmerge_true","displayName":"True","description":"AuthAppsAllowUserPrefMerge On","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_privateprofile_defaultinboundaction","displayName":"Default Inbound Action for Private Profile","description":"Specifies how to filter inbound traffic. The acceptable values for this parameter are: NotConfigured, Allow, or Block.","helpText":" ","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_privateprofile_defaultinboundaction_0","displayName":"Allow","description":"Allow Inbound By Default","helpText":null},{"id":"vendor_msft_firewall_mdmstore_privateprofile_defaultinboundaction_1","displayName":"Block","description":"Block Inbound By Default","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_privateprofile_defaultoutboundaction","displayName":"Default Outbound Action","description":"This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_privateprofile_defaultoutboundaction_0","displayName":"Allow","description":"Allow Outbound By Default","helpText":null},{"id":"vendor_msft_firewall_mdmstore_privateprofile_defaultoutboundaction_1","displayName":"Block","description":"Block Outbound By Default","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_privateprofile_disableinboundnotifications","displayName":"Disable Inbound Notifications","description":"This value is an on/off switch. If this value is false, the firewall MAY display a notification to the user when an application is blocked from listening on a port. If this value is on, the firewall MUST NOT display such a notification. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_privateprofile_disableinboundnotifications_false","displayName":"False","description":"Firewall May Display Notification","helpText":null},{"id":"vendor_msft_firewall_mdmstore_privateprofile_disableinboundnotifications_true","displayName":"True","description":"Firewall Must Not Display Notification","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_privateprofile_disablestealthmode","displayName":"Disable Stealth Mode","description":"This value is an on/off switch. When this option is false, the server operates in stealth mode. The firewall rules used to enforce stealth mode are implementation-specific. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_privateprofile_disablestealthmode_false","displayName":"False","description":"Use Stealth Mode","helpText":null},{"id":"vendor_msft_firewall_mdmstore_privateprofile_disablestealthmode_true","displayName":"True","description":"Disable Stealth Mode","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_privateprofile_disablestealthmodeipsecsecuredpacketexemption","displayName":"Disable Stealth Mode Ipsec Secured Packet Exemption","description":"This value is an on/off switch. This option is ignored if DisableStealthMode is on. Otherwise, when this option is true, the firewall's stealth mode rules MUST NOT prevent the host computer from responding to unsolicited network traffic if that traffic is secured by IPsec. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used. For schema versions 0x0200, 0x0201, and 0x020A, this value is invalid and MUST NOT be used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_privateprofile_disablestealthmodeipsecsecuredpacketexemption_false","displayName":"False","description":"FALSE","helpText":null},{"id":"vendor_msft_firewall_mdmstore_privateprofile_disablestealthmodeipsecsecuredpacketexemption_true","displayName":"True","description":"TRUE","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_privateprofile_disableunicastresponsestomulticastbroadcast","displayName":"Disable Unicast Responses To Multicast Broadcast","description":"This value is used as an on/off switch. If it is true, unicast responses to multicast broadcast traffic is blocked. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_privateprofile_disableunicastresponsestomulticastbroadcast_false","displayName":"False","description":"Unicast Responses Not Blocked","helpText":null},{"id":"vendor_msft_firewall_mdmstore_privateprofile_disableunicastresponsestomulticastbroadcast_true","displayName":"True","description":"Unicast Responses Blocked","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_privateprofile_enablefirewall","displayName":"Enable Private Network Firewall","description":"This value is an on/off switch for the firewall and advanced security enforcement. If this value is false, the server MUST NOT block any network traffic, regardless of other policy settings. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":" ","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_privateprofile_enablefirewall_false","displayName":"False","description":"Disable Firewall","helpText":null},{"id":"vendor_msft_firewall_mdmstore_privateprofile_enablefirewall_true","displayName":"True","description":"Enable Firewall","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_privateprofile_enablelogdroppedpackets","displayName":"Enable Log Dropped Packets","description":"This value is used as an on/off switch. If this value is on, the firewall logs all the dropped packets. The merge law for this option is to let \"on\" values win.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_privateprofile_enablelogdroppedpackets_false","displayName":"Disable Logging Of Dropped Packets","description":"Disable Logging Of Dropped Packets","helpText":null},{"id":"vendor_msft_firewall_mdmstore_privateprofile_enablelogdroppedpackets_true","displayName":"Enable Logging Of Dropped Packets","description":"Enable Logging Of Dropped Packets","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_privateprofile_enablelogignoredrules","displayName":"Enable Log Ignored Rules","description":"This value is used as an on/off switch. The server MAY use this value in an implementation-specific way to control logging of events if a rule is not enforced for any reason. The merge law for this option is to let \"on\" values win.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_privateprofile_enablelogignoredrules_false","displayName":"Disable Logging Of Ignored Rules","description":"Disable Logging Of Ignored Rules","helpText":null},{"id":"vendor_msft_firewall_mdmstore_privateprofile_enablelogignoredrules_true","displayName":"Enable Logging Of Ignored Rules","description":"Enable Logging Of Ignored Rules","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_privateprofile_enablelogsuccessconnections","displayName":"Enable Log Success Connections","description":"This value is used as an on/off switch. If this value is on, the firewall logs all successful inbound connections. The merge law for this option is to let \"on\" values win.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_privateprofile_enablelogsuccessconnections_false","displayName":"Disable Logging Of Successful Connections","description":"Disable Logging Of Successful Connections","helpText":null},{"id":"vendor_msft_firewall_mdmstore_privateprofile_enablelogsuccessconnections_true","displayName":"Enable Logging Of Successful Connections","description":"Enable Logging Of Successful Connections","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_privateprofile_globalportsallowuserprefmerge","displayName":"Global Ports Allow User Pref Merge","description":"This value is used as an on/off switch. If this value is false, global port firewall rules in the local store are ignored and not enforced. The setting only has meaning if it is set or enumerated in the Group Policy store or if it is enumerated from the GroupPolicyRSoPStore. The merge law for this option is to let the value GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_privateprofile_globalportsallowuserprefmerge_false","displayName":"False","description":"GlobalPortsAllowUserPrefMerge Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_privateprofile_globalportsallowuserprefmerge_true","displayName":"True","description":"GlobalPortsAllowUserPrefMerge On","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_privateprofile_logfilepath","displayName":"Log File Path","description":"This value is a string that represents a file path to the log where the firewall logs dropped packets and successful connections. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured, otherwise the MdmStore value wins if it is configured, otherwise the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_privateprofile_logmaxfilesize","displayName":"Log Max File Size","description":"This value specifies the size, in kilobytes, of the log file where dropped packets and successful connections are logged. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured, otherwise the MdmStore value wins if it is configured, otherwise the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_privateprofile_shielded","displayName":"Shielded","description":"This value is used as an on/off switch. If this value is on and EnableFirewall is on, the server MUST block all incoming traffic regardless of other policy settings. The merge law for this option is to let \"on\" values win.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_privateprofile_shielded_false","displayName":"False","description":"Shielding Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_privateprofile_shielded_true","displayName":"True","description":"Shielding On","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_publicprofile_allowlocalipsecpolicymerge","displayName":"Allow Local Ipsec Policy Merge","description":"This value is an on/off switch. If this value is false, connection security rules from the local store are ignored and not enforced, regardless of the schema version and connection security rule version. The merge law for this option is to always use the value of the GroupPolicyRSoPStore.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_publicprofile_allowlocalipsecpolicymerge_false","displayName":"False","description":"AllowLocalIpsecPolicyMerge Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_publicprofile_allowlocalipsecpolicymerge_true","displayName":"True","description":"AllowLocalIpsecPolicyMerge On","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_publicprofile_allowlocalpolicymerge","displayName":"Allow Local Policy Merge","description":"This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_publicprofile_allowlocalpolicymerge_false","displayName":"False","description":"AllowLocalPolicyMerge Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_publicprofile_allowlocalpolicymerge_true","displayName":"True","description":"AllowLocalPolicyMerge On","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_publicprofile_authappsallowuserprefmerge","displayName":"Auth Apps Allow User Pref Merge","description":"This value is used as an on/off switch. If this value is false, authorized application firewall rules in the local store are ignored and not enforced. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_publicprofile_authappsallowuserprefmerge_false","displayName":"False","description":"AuthAppsAllowUserPrefMerge Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_publicprofile_authappsallowuserprefmerge_true","displayName":"True","description":"AuthAppsAllowUserPrefMerge On","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_publicprofile_defaultinboundaction","displayName":"Default Inbound Action for Public Profile","description":"Specifies how to filter inbound traffic. The acceptable values for this parameter are: NotConfigured, Allow, or Block.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_publicprofile_defaultinboundaction_0","displayName":"Allow","description":"Allow Inbound By Default","helpText":null},{"id":"vendor_msft_firewall_mdmstore_publicprofile_defaultinboundaction_1","displayName":"Block","description":"Block Inbound By Default","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_publicprofile_defaultoutboundaction","displayName":"Default Outbound Action","description":"This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_publicprofile_defaultoutboundaction_0","displayName":"Allow","description":"Allow Outbound By Default","helpText":null},{"id":"vendor_msft_firewall_mdmstore_publicprofile_defaultoutboundaction_1","displayName":"Block","description":"Block Outbound By Default","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_publicprofile_disableinboundnotifications","displayName":"Disable Inbound Notifications","description":"This value is an on/off switch. If this value is false, the firewall MAY display a notification to the user when an application is blocked from listening on a port. If this value is on, the firewall MUST NOT display such a notification. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_publicprofile_disableinboundnotifications_false","displayName":"False","description":"Firewall May Display Notification","helpText":null},{"id":"vendor_msft_firewall_mdmstore_publicprofile_disableinboundnotifications_true","displayName":"True","description":"Firewall Must Not Display Notification","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_publicprofile_disablestealthmode","displayName":"Disable Stealth Mode","description":"This value is an on/off switch. When this option is false, the server operates in stealth mode. The firewall rules used to enforce stealth mode are implementation-specific. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_publicprofile_disablestealthmode_false","displayName":"False","description":"Use Stealth Mode","helpText":null},{"id":"vendor_msft_firewall_mdmstore_publicprofile_disablestealthmode_true","displayName":"True","description":"Disable Stealth Mode","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_publicprofile_disablestealthmodeipsecsecuredpacketexemption","displayName":"Disable Stealth Mode Ipsec Secured Packet Exemption","description":"This value is an on/off switch. This option is ignored if DisableStealthMode is on. Otherwise, when this option is true, the firewall's stealth mode rules MUST NOT prevent the host computer from responding to unsolicited network traffic if that traffic is secured by IPsec. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used. For schema versions 0x0200, 0x0201, and 0x020A, this value is invalid and MUST NOT be used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_publicprofile_disablestealthmodeipsecsecuredpacketexemption_false","displayName":"False","description":"FALSE","helpText":null},{"id":"vendor_msft_firewall_mdmstore_publicprofile_disablestealthmodeipsecsecuredpacketexemption_true","displayName":"True","description":"TRUE","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_publicprofile_disableunicastresponsestomulticastbroadcast","displayName":"Disable Unicast Responses To Multicast Broadcast","description":"This value is used as an on/off switch. If it is true, unicast responses to multicast broadcast traffic is blocked. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_publicprofile_disableunicastresponsestomulticastbroadcast_false","displayName":"False","description":"Unicast Responses Not Blocked","helpText":null},{"id":"vendor_msft_firewall_mdmstore_publicprofile_disableunicastresponsestomulticastbroadcast_true","displayName":"True","description":"Unicast Responses Blocked","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_publicprofile_enablefirewall","displayName":"Enable Public Network Firewall","description":"This value is an on/off switch for the firewall and advanced security enforcement. If this value is false, the server MUST NOT block any network traffic, regardless of other policy settings. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":" ","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_publicprofile_enablefirewall_false","displayName":"False","description":"Disable Firewall","helpText":null},{"id":"vendor_msft_firewall_mdmstore_publicprofile_enablefirewall_true","displayName":"True","description":"Enable Firewall","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_publicprofile_enablelogdroppedpackets","displayName":"Enable Log Dropped Packets","description":"This value is used as an on/off switch. If this value is on, the firewall logs all the dropped packets. The merge law for this option is to let \"on\" values win.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_publicprofile_enablelogdroppedpackets_false","displayName":"Disable Logging Of Dropped Packets","description":"Disable Logging Of Dropped Packets","helpText":null},{"id":"vendor_msft_firewall_mdmstore_publicprofile_enablelogdroppedpackets_true","displayName":"Enable Logging Of Dropped Packets","description":"Enable Logging Of Dropped Packets","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_publicprofile_enablelogignoredrules","displayName":"Enable Log Ignored Rules","description":"This value is used as an on/off switch. The server MAY use this value in an implementation-specific way to control logging of events if a rule is not enforced for any reason. The merge law for this option is to let \"on\" values win.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_publicprofile_enablelogignoredrules_false","displayName":"Disable Logging Of Ignored Rules","description":"Disable Logging Of Ignored Rules","helpText":null},{"id":"vendor_msft_firewall_mdmstore_publicprofile_enablelogignoredrules_true","displayName":"Enable Logging Of Ignored Rules","description":"Enable Logging Of Ignored Rules","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_publicprofile_enablelogsuccessconnections","displayName":"Enable Log Success Connections","description":"This value is used as an on/off switch. If this value is on, the firewall logs all successful inbound connections. The merge law for this option is to let \"on\" values win.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":[{"id":"vendor_msft_firewall_mdmstore_publicprofile_enablelogsuccessconnections_false","displayName":"Disable Logging Of Successful Connections","description":"Disable Logging Of Successful Connections","helpText":null},{"id":"vendor_msft_firewall_mdmstore_publicprofile_enablelogsuccessconnections_true","displayName":"Enable Logging Of Successful Connections","description":"Enable Logging Of Successful Connections","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_publicprofile_globalportsallowuserprefmerge","displayName":"Global Ports Allow User Pref Merge","description":"This value is used as an on/off switch. If this value is false, global port firewall rules in the local store are ignored and not enforced. The setting only has meaning if it is set or enumerated in the Group Policy store or if it is enumerated from the GroupPolicyRSoPStore. The merge law for this option is to let the value GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_publicprofile_globalportsallowuserprefmerge_false","displayName":"False","description":"GlobalPortsAllowUserPrefMerge Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_publicprofile_globalportsallowuserprefmerge_true","displayName":"True","description":"GlobalPortsAllowUserPrefMerge On","helpText":null}]},{"id":"vendor_msft_firewall_mdmstore_publicprofile_logfilepath","displayName":"Log File Path","description":"This value is a string that represents a file path to the log where the firewall logs dropped packets and successful connections. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured, otherwise the MdmStore value wins if it is configured, otherwise the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_publicprofile_logmaxfilesize","displayName":"Log Max File Size","description":"This value specifies the size, in kilobytes, of the log file where dropped packets and successful connections are logged. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured, otherwise the MdmStore value wins if it is configured, otherwise the local store value is used.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Firewall-csp/"],"options":null},{"id":"vendor_msft_firewall_mdmstore_publicprofile_shielded","displayName":"Shielded","description":"This value is used as an on/off switch. If this value is on and EnableFirewall is on, the server MUST block all incoming traffic regardless of other policy settings. The merge law for this option is to let \"on\" values win.","helpText":"","infoUrls":["https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp"],"options":[{"id":"vendor_msft_firewall_mdmstore_publicprofile_shielded_false","displayName":"False","description":"Shielding Off","helpText":null},{"id":"vendor_msft_firewall_mdmstore_publicprofile_shielded_true","displayName":"True","description":"Shielding On","helpText":null}]},{"id":"vendor_msft_personalization_companylogourl","displayName":"Company Logo Url","description":"A http or https Url to a jpg, jpeg or png image that neeeds to be downloaded and used as the Company Logo or a file Url to a local image on the file system that needs to be used as the Company Logo. This setting is currently available for boot to cloud shared pc mode only.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Personalization-csp/"],"options":null},{"id":"vendor_msft_personalization_companyname","displayName":"Company Name","description":"The name of the company to be displayed on the sign-in screen. This setting is currently available for boot to cloud shared pc mode only.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Personalization-csp/"],"options":null},{"id":"vendor_msft_personalization_desktopimageurl","displayName":"Desktop Image Url","description":"A http or https Url to a jpg, jpeg or png image that needs to be downloaded and used as the Desktop Image or a file Url to a local image on the file system that needs to be used as the Desktop Image.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Personalization-csp/"],"options":null},{"id":"vendor_msft_personalization_lockscreenimageurl","displayName":"Lock Screen Image Url","description":"A http or https Url to a jpg, jpeg or png image that neeeds to be downloaded and used as the Lock Screen Image or a file Url to a local image on the file system that needs to be used as the Lock Screen Image.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/Personalization-csp/"],"options":null},{"id":"vendor_msft_sharedpc_accountmodel","displayName":"Account Model","description":"Configures which type of accounts are allowed to use the PC. Allowed values: 0 (only guest), 1 (domain-joined only), 2 (domain-joined and guest). If used, this value must be set before the action on the EnableSharedPCMode node is taken.","helpText":"","infoUrls":[],"options":[{"id":"vendor_msft_sharedpc_accountmodel_0","displayName":"Guest","description":"Only guest accounts are allowed.","helpText":null},{"id":"vendor_msft_sharedpc_accountmodel_1","displayName":"Domain","description":"Only domain-joined accounts are allowed.","helpText":null},{"id":"vendor_msft_sharedpc_accountmodel_2","displayName":"Guest and Domain","description":"Domain-joined and guest accounts are allowed.","helpText":null}]},{"id":"vendor_msft_sharedpc_deletionpolicy","displayName":"Deletion Policy","description":"Configures when accounts will be deleted. Allowed values: 0 (delete immediately), 1 (delete at disk space threshold), 2 (Delete at disk space threshold and inactive threshold). If used, this value must be set before the action on the EnableSharedPCMode node is taken.","helpText":"","infoUrls":[],"options":[{"id":"vendor_msft_sharedpc_deletionpolicy_0","displayName":"Delete immediately","description":"Delete immediately.","helpText":null},{"id":"vendor_msft_sharedpc_deletionpolicy_1","displayName":"Delete at disk space threshold","description":"Delete at disk space threshold","helpText":null},{"id":"vendor_msft_sharedpc_deletionpolicy_2","displayName":"Delete at disk space threshold and inactive threshold","description":"Delete at disk space threshold and inactive threshold","helpText":null}]},{"id":"vendor_msft_sharedpc_disklevelcaching","displayName":"Disk Level Caching","description":"Stop deleting accounts when available disk space reaches this threshold, given as percent of total disk capacity. If used, this value must be set before the action on the EnableSharedPCMode node is taken.","helpText":"","infoUrls":[],"options":null},{"id":"vendor_msft_sharedpc_diskleveldeletion","displayName":"Disk Level Deletion","description":"Accounts will start being deleted when available disk space falls below this threshold, given as percent of total disk capacity. Accounts that have been inactive the longest will be deleted first. If used, this value must be set before the action on the EnableSharedPCMode node is taken.","helpText":"","infoUrls":[],"options":null},{"id":"vendor_msft_sharedpc_enableaccountmanager","displayName":"Enable Account Manager","description":"Enable the account manager for shared PC mode. If used, this value must be set before the action on the EnableSharedPCMode node is taken.","helpText":"","infoUrls":[],"options":[{"id":"vendor_msft_sharedpc_enableaccountmanager_false","displayName":"false","description":"False","helpText":null},{"id":"vendor_msft_sharedpc_enableaccountmanager_true","displayName":"true","description":"True","helpText":null}]},{"id":"vendor_msft_sharedpc_enablesharedpcmode","displayName":"Enable Shared PC Mode","description":"Setting this node to \"true\" triggers the action to configure a device to Shared PC mode.","helpText":"","infoUrls":[],"options":[{"id":"vendor_msft_sharedpc_enablesharedpcmode_false","displayName":"false","description":"Not configured","helpText":null},{"id":"vendor_msft_sharedpc_enablesharedpcmode_true","displayName":"true","description":"Enabled","helpText":null}]},{"id":"vendor_msft_sharedpc_enablesharedpcmodewithonedrivesync","displayName":"Enable Shared PC Mode With One Drive Sync","description":"Setting this node to “1” triggers the action to configure a device to Shared PC mode with OneDrive sync turned on","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/SharedPC-csp/"],"options":[{"id":"vendor_msft_sharedpc_enablesharedpcmodewithonedrivesync_false","displayName":"Not configured","description":"Not configured","helpText":null},{"id":"vendor_msft_sharedpc_enablesharedpcmodewithonedrivesync_true","displayName":"Enabled","description":"Enabled","helpText":null}]},{"id":"vendor_msft_sharedpc_inactivethreshold","displayName":"Inactive Threshold","description":"Accounts will start being deleted when they have not been logged on during the specified period, given as number of days.","helpText":"","infoUrls":[],"options":null},{"id":"vendor_msft_sharedpc_kioskmodeaumid","displayName":"Kiosk Mode AUMID","description":"Specifies the AUMID of the app to use with assigned access. If used, this value must be set before the action on the EnableSharedPCMode node is taken.","helpText":"","infoUrls":[],"options":null},{"id":"vendor_msft_sharedpc_kioskmodeusertiledisplaytext","displayName":"Kiosk Mode User Tile Display Text","description":"Specifies the display text for the account shown on the sign-in screen which launches the app specified by KioskModeAUMID. If used, this value must be set before the action on the EnableSharedPCMode node is taken.","helpText":"","infoUrls":[],"options":null},{"id":"vendor_msft_sharedpc_maintenancestarttime","displayName":"Maintenance Start Time","description":"Daily start time of maintenance hour. Given in minutes from midnight. Default is 0 (12am). If used, this value must be set before the action on the EnableSharedPCMode node is taken.","helpText":"","infoUrls":[],"options":null},{"id":"vendor_msft_sharedpc_maxpagefilesizemb","displayName":"Max Page File Size MB","description":"Maximum size of the paging file in MB. Applies only to systems with less than 32 GB storage and at least 3 GB of RAM. If used, this value must be set before the action on the EnableSharedPCMode node is taken.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/SharedPC-csp/"],"options":null},{"id":"vendor_msft_sharedpc_restrictlocalstorage","displayName":"Restrict Local Storage","description":"Restricts the user from using local storage. This node is optional. If used, this value must be set before the action on the EnableSharedPCMode node is taken.","helpText":"","infoUrls":[],"options":[{"id":"vendor_msft_sharedpc_restrictlocalstorage_false","displayName":"false","description":"False","helpText":null},{"id":"vendor_msft_sharedpc_restrictlocalstorage_true","displayName":"true","description":"True","helpText":null}]},{"id":"vendor_msft_sharedpc_setedupolicies","displayName":"Set Edu Policies","description":"Set a list of EDU policies.","helpText":"","infoUrls":[],"options":[{"id":"vendor_msft_sharedpc_setedupolicies_false","displayName":"false","description":"Not configured","helpText":null},{"id":"vendor_msft_sharedpc_setedupolicies_true","displayName":"true","description":"Enabled","helpText":null}]},{"id":"vendor_msft_sharedpc_setpowerpolicies","displayName":"Set Power Policies","description":"Set a list of power policies. If used, this value must be set before the action on the EnableSharedPCMode node is taken.","helpText":"","infoUrls":[],"options":[{"id":"vendor_msft_sharedpc_setpowerpolicies_false","displayName":"false","description":"Not configured","helpText":null},{"id":"vendor_msft_sharedpc_setpowerpolicies_true","displayName":"true","description":"Enabled","helpText":null}]},{"id":"vendor_msft_sharedpc_signinonresume","displayName":"Sign In On Resume","description":"Require signing in on waking up from sleep. If used, this value must be set before the action on the EnableSharedPCMode node is taken.","helpText":"","infoUrls":[],"options":[{"id":"vendor_msft_sharedpc_signinonresume_false","displayName":"false","description":"False","helpText":null},{"id":"vendor_msft_sharedpc_signinonresume_true","displayName":"true","description":"True","helpText":null}]},{"id":"vendor_msft_sharedpc_sleeptimeout","displayName":"Sleep Timeout","description":"The amount of time before the PC sleeps, giving in seconds. 0 means the PC never sleeps. Default is 5 minutes. If used, this value must be set before the action on the EnableSharedPCMode node is taken.","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/SharedPC-csp/"],"options":null},{"id":"vendor_msft_tenantlockdown_requirenetworkinoobe","displayName":"Require Network In OOBE (Device)","description":"true - Require network in OOBE, false - no network connection requirement in OOBE","helpText":null,"infoUrls":[],"options":[{"id":"vendor_msft_tenantlockdown_requirenetworkinoobe_true","displayName":"true","description":null,"helpText":null},{"id":"vendor_msft_tenantlockdown_requirenetworkinoobe_false","displayName":"false","description":null,"helpText":null}]},{"id":"vendor_msft_windowslicensing_devicelicensingservice_licensetype","displayName":"License Type","description":"Get/Replace License Type: User Based License = 0, Device Based License = 1\r\n ","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/WindowsLicensing-csp/"],"options":[{"id":"vendor_msft_windowslicensing_devicelicensingservice_licensetype_0","displayName":"User Based License","description":"User Based License","helpText":null},{"id":"vendor_msft_windowslicensing_devicelicensingservice_licensetype_1","displayName":"Device Based License","description":"Device Based License","helpText":null}]},{"id":"vendor_msft_wirelessnetworkpreference_connectionprofiles_{connectionprofileid}","displayName":" Connection Profile ID (Windows Insiders only)","description":"Unique identifier of a network preference policy. Unique ID is auto-generated.\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":[],"options":null},{"id":"vendor_msft_wirelessnetworkpreference_connectionprofiles_{connectionprofileid}_cellular_plmnid","displayName":"PLMNID (Windows Insiders only)","description":"5- or 6-digit string identifying a cellular network. It consists of the combination of Mobile Country Code (MCC) and Mobile Network Code (MNC). \r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/WirelessNetworkPreference-csp/"],"options":null},{"id":"vendor_msft_wirelessnetworkpreference_connectionprofiles_{connectionprofileid}_connectionprofileid","displayName":null,"description":null,"helpText":null,"infoUrls":[],"options":null},{"id":"vendor_msft_wirelessnetworkpreference_connectionprofiles_{connectionprofileid}_priority","displayName":"Priority (Windows Insiders only)","description":"Priority of a policy compared to the others where 1 represents the highest priority. Thus, the smaller this value is, the higher preference this specific network will receive in establishing a data connection. \r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/WirelessNetworkPreference-csp/"],"options":null},{"id":"vendor_msft_wirelessnetworkpreference_connectionprofiles_{connectionprofileid}_stayconnected","displayName":"Stay Connected (Windows Insiders only)","description":"When set to 0: Default network discovery behavior is applied. When set to 1: Once connected, the device will always stay connected to this network. This means the device will not attempt to discover or switch to other higher priority networks until it first loses connectivity to this network.\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/WirelessNetworkPreference-csp/"],"options":[{"id":"vendor_msft_wirelessnetworkpreference_connectionprofiles_{connectionprofileid}_stayconnected_0","displayName":"Default network discovery behavior.","description":"Default network discovery behavior.","helpText":null},{"id":"vendor_msft_wirelessnetworkpreference_connectionprofiles_{connectionprofileid}_stayconnected_1","displayName":"Once connected to this network, try to stay connected.","description":"Once connected to this network, try to stay connected.","helpText":null}]},{"id":"vendor_msft_wirelessnetworkpreference_connectionprofiles_{connectionprofileid}_wirelesstype","displayName":"Wireless Type (Windows Insiders only)","description":"Type of wireless network (either Cellular or Wi-Fi). 0 represents Cellular, and 1 represents Wi-Fi. Currently only cellular is supported.\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/WirelessNetworkPreference-csp/"],"options":[{"id":"vendor_msft_wirelessnetworkpreference_connectionprofiles_{connectionprofileid}_wirelesstype_0","displayName":"Cellular","description":"Cellular","helpText":null},{"id":"vendor_msft_wirelessnetworkpreference_connectionprofiles_{connectionprofileid}_wirelesstype_1","displayName":"Wi- Fi","description":"Wi-Fi","helpText":null}]},{"id":"vendor_msft_wirelessnetworkpreference_isenabled","displayName":"Is Enabled (Windows Insiders only)","description":"It determines whether the wireless connectivity management policy is enabled or not.\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/WirelessNetworkPreference-csp/"],"options":[{"id":"vendor_msft_wirelessnetworkpreference_isenabled_false","displayName":"Disable the wireless management policy.","description":"Disable the wireless management policy.","helpText":null},{"id":"vendor_msft_wirelessnetworkpreference_isenabled_true","displayName":"Enable the wireless management policy.","description":"Enable the wireless management policy.","helpText":null}]},{"id":"vendor_msft_wirelessnetworkpreference_parameters_cellularparameters_maxrescanintervalinseconds","displayName":"Max Rescan Interval In Seconds (Windows Insiders only)","description":"Maximum time (in seconds) from the point that no connection could be established using the permissible eSIM profiles on the device to the start of the next round of network discovery attempts. A smaller interval increases network discovery frequency and can decrease battery life significantly. A value of 0 means that the device is to pick a reasonable interval per its own discretion.\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/WirelessNetworkPreference-csp/"],"options":null},{"id":"vendor_msft_wirelessnetworkpreference_parameters_cellularparameters_networkdiscoveryoption","displayName":"Network Discovery Option (Windows Insiders only)","description":"Configures which approach should be used in the network discovery process. There are two possible values: (0) no network scan will be performed – rather, registration and connection will be attempted with each eSIM profile in descending order of preference; or (1) Network scan will be performed using the current active eSIM profile. This option works for modems that when performing a network scan show the complete list of available networks independently of which eSIM profile is active.\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/WirelessNetworkPreference-csp/"],"options":[{"id":"vendor_msft_wirelessnetworkpreference_parameters_cellularparameters_networkdiscoveryoption_0","displayName":"No network scan will be performed -- rather, registration and connection will be attempted with each eSIM profile in descending order of preference.","description":"No network scan will be performed -- rather, registration and connection will be attempted with each eSIM profile in descending order of preference.","helpText":null},{"id":"vendor_msft_wirelessnetworkpreference_parameters_cellularparameters_networkdiscoveryoption_1","displayName":"Network scan will be performed using the current active eSIM profile.","description":"Network scan will be performed using the current active eSIM profile.","helpText":null}]},{"id":"vendor_msft_wirelessnetworkpreference_parameters_cellularparameters_preferredprofilewakeconnectiontimerinseconds","displayName":"Preferred Profile Wake Connection Timer In Seconds (Windows Insiders only)","description":"When the device is woken from sleep with the most-preferred profile already enabled, this value configures the amount of time (in seconds) before the agent will give up on waiting for connection re-establishment with the most-preferred profile and start network discovery.\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/WirelessNetworkPreference-csp/"],"options":null},{"id":"vendor_msft_wirelessnetworkpreference_parameters_cellularparameters_profileregistrationtimerinseconds","displayName":"Profile Registration Timer In Seconds (Windows Insiders only)","description":"When evaluating eSIM profiles for connectivity, this value configures the amount of time (in seconds) that the agent will wait for network registration before considering this profile unsatisfactory and moving on to the next one.\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/WirelessNetworkPreference-csp/"],"options":null},{"id":"vendor_msft_wirelessnetworkpreference_parameters_cellularparameters_screenoffdurationtotriggernetworkdiscoveryinminutes","displayName":"Screen Off Duration To Trigger Network Discovery In Minutes (Windows Insiders only)","description":"When the device experiences screen off and back on, this value configures the minimum duration (in minutes) of the screen off period that will trigger network discovery.\r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/WirelessNetworkPreference-csp/"],"options":null},{"id":"vendor_msft_wirelessnetworkpreference_prefercellularoverwifi","displayName":"Prefer Cellular Over Wi Fi (Windows Insiders only)","description":"It determines the order of preference between Wi-Fi and cellular networks. When the value is set to “False”, Wi-Fi is preferred over cellular. When the value is set to “True”, cellular is preferred over Wi-Fi. \r\n This setting is only available to Windows Insiders","helpText":"","infoUrls":["https://docs.microsoft.com/windows/client-management/mdm/WirelessNetworkPreference-csp/"],"options":[{"id":"vendor_msft_wirelessnetworkpreference_prefercellularoverwifi_false","displayName":"Prefer Wi-Fi over Cellular.","description":"Prefer Wi-Fi over Cellular.","helpText":null},{"id":"vendor_msft_wirelessnetworkpreference_prefercellularoverwifi_true","displayName":"Prefer Cellular over Wi-Fi.","description":"Prefer Cellular over Wi-Fi.","helpText":null}]}] diff --git a/frontend/src/data/portals.json b/frontend/src/data/portals.json index 57fc5853ee..30709d4b30 100644 --- a/frontend/src/data/portals.json +++ b/frontend/src/data/portals.json @@ -58,7 +58,6 @@ "name": "SharePoint_Admin", "url": "/api/ListSharePointAdminUrl?tenantFilter=defaultDomainName", "variable": "defaultDomainName", - "field": "SharepointAdminUrl", "target": "_blank", "external": true, "icon": "Share" diff --git a/frontend/src/data/standards.json b/frontend/src/data/standards.json index 5dba5122d5..7a7d8e3d10 100644 --- a/frontend/src/data/standards.json +++ b/frontend/src/data/standards.json @@ -14,9 +14,18 @@ "label": "Pin Microsoft 365 Copilot Chat", "name": "standards.CopilotSettings.copilotChatPinning", "options": [ - { "label": "Do not configure", "value": "donotconfigure" }, - { "label": "Enabled", "value": "1" }, - { "label": "Disabled", "value": "0" } + { + "label": "Do not configure", + "value": "donotconfigure" + }, + { + "label": "Enabled", + "value": "1" + }, + { + "label": "Disabled", + "value": "0" + } ] }, { @@ -26,9 +35,18 @@ "label": "Copilot Access to Open Content", "name": "standards.CopilotSettings.blockAccessToOpenFiles", "options": [ - { "label": "Do not configure", "value": "donotconfigure" }, - { "label": "Block open content", "value": "1" }, - { "label": "Allow open content", "value": "0" } + { + "label": "Do not configure", + "value": "donotconfigure" + }, + { + "label": "Block open content", + "value": "1" + }, + { + "label": "Allow open content", + "value": "0" + } ] }, { @@ -38,9 +56,18 @@ "label": "Designer Image Generation", "name": "standards.CopilotSettings.imageGeneration", "options": [ - { "label": "Do not configure", "value": "donotconfigure" }, - { "label": "Disabled", "value": "1" }, - { "label": "Enabled", "value": "0" } + { + "label": "Do not configure", + "value": "donotconfigure" + }, + { + "label": "Disabled", + "value": "1" + }, + { + "label": "Enabled", + "value": "0" + } ] }, { @@ -50,9 +77,18 @@ "label": "Web Search in Copilot", "name": "standards.CopilotSettings.allowWebSearch", "options": [ - { "label": "Do not configure", "value": "donotconfigure" }, - { "label": "Enabled in Microsoft 365 Copilot and Microsoft 365 Copilot Chat", "value": "0" }, - { "label": "Disabled in Microsoft 365 Copilot and Microsoft 365 Copilot Chat", "value": "1" }, + { + "label": "Do not configure", + "value": "donotconfigure" + }, + { + "label": "Enabled in Microsoft 365 Copilot and Microsoft 365 Copilot Chat", + "value": "0" + }, + { + "label": "Disabled in Microsoft 365 Copilot and Microsoft 365 Copilot Chat", + "value": "1" + }, { "label": "Disabled in Microsoft 365 Copilot Work mode, Enabled in Microsoft 365 Copilot Chat", "value": "2" @@ -66,9 +102,18 @@ "label": "Admin Copilot in Microsoft 365 Admin Center", "name": "standards.CopilotSettings.allowInAdminCenters", "options": [ - { "label": "Do not configure", "value": "donotconfigure" }, - { "label": "Enabled", "value": "1" }, - { "label": "Disabled", "value": "0" } + { + "label": "Do not configure", + "value": "donotconfigure" + }, + { + "label": "Enabled", + "value": "1" + }, + { + "label": "Disabled", + "value": "0" + } ] } ], @@ -190,7 +235,9 @@ "impactColour": "info", "addedDate": "2024-03-19", "powershellEquivalent": "New-MailContact", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -222,12 +269,18 @@ } ], "label": "Deploy Mail Contact Template", - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "Low Impact", "impactColour": "info", "addedDate": "2025-05-31", "powershellEquivalent": "New-MailContact", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -239,8 +292,16 @@ { "name": "standards.AuditLog", "cat": "Global Standards", - "tag": ["CIS M365 7.0.0 (3.1.1)", "mip_search_auditlog", "NIST CSF 2.0 (DE.CM-09)"], - "appliesToTest": ["CISAMSEXO171", "CISAMSEXO173", "CIS_3_1_1"], + "tag": [ + "CIS M365 7.0.0 (3.1.1)", + "mip_search_auditlog", + "NIST CSF 2.0 (DE.CM-09)" + ], + "appliesToTest": [ + "CISAMSEXO171", + "CISAMSEXO173", + "CIS_3_1_1" + ], "helpText": "Enables the Unified Audit Log for tracking and auditing activities. Also runs Enable-OrganizationCustomization if necessary.", "executiveText": "Activates comprehensive activity logging across Microsoft 365 services to track user actions, system changes, and security events. This provides essential audit trails for compliance requirements, security investigations, and regulatory reporting.", "addedComponent": [], @@ -249,7 +310,10 @@ "impactColour": "info", "addedDate": "2021-11-16", "powershellEquivalent": "Enable-OrganizationCustomization", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -261,8 +325,12 @@ { "name": "standards.RestrictThirdPartyStorageServices", "cat": "Global Standards", - "tag": ["CIS M365 7.0.0 (1.3.7)"], - "appliesToTest": ["CIS_1_3_7"], + "tag": [ + "CIS M365 7.0.0 (1.3.7)" + ], + "appliesToTest": [ + "CIS_1_3_7" + ], "helpText": "Restricts third-party storage services in Microsoft 365 on the web by managing the Microsoft 365 on the web service principal. This disables integrations with services like Dropbox, Google Drive, Box, and other third-party storage providers.", "docsDescription": "Third-party storage can be enabled for users in Microsoft 365, allowing them to store and share documents using services such as Dropbox, alongside OneDrive and team sites. This standard ensures Microsoft 365 on the web third-party storage services are restricted by creating and disabling the Microsoft 365 on the web service principal (appId: c1f33bc0-bdb4-4248-ba9b-096807ddb43e). By using external storage services an organization may increase the risk of data breaches and unauthorized access to confidential information. Additionally, third-party services may not adhere to the same security standards as the organization, making it difficult to maintain data privacy and security. Impact is highly dependent upon current practices - if users do not use other storage providers, then minimal impact is likely. However, if users regularly utilize providers outside of the tenant this will affect their ability to continue to do so.", "executiveText": "Prevents employees from using external cloud storage services like Dropbox, Google Drive, and Box within Microsoft 365, reducing data security risks and ensuring all company data remains within controlled corporate systems. This helps maintain data governance and prevents potential data leaks to unauthorized platforms.", @@ -272,7 +340,9 @@ "impactColour": "warning", "addedDate": "2025-06-06", "powershellEquivalent": "New-MgServicePrincipal and Update-MgServicePrincipal", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -297,8 +367,14 @@ "label": "Select value", "name": "standards.ProfilePhotos.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] } ], @@ -327,10 +403,20 @@ "impact": "Low Impact", "impactColour": "info", "addedDate": "2024-01-22", - "disabledFeatures": { "report": true, "warn": true, "remediate": false }, + "disabledFeatures": { + "report": true, + "warn": true, + "remediate": false + }, "powershellEquivalent": "Portal only", - "recommendedBy": ["CIPP"], - "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2", "OFFICE_BUSINESS"] + "recommendedBy": [ + "Manage365" + ], + "requiredCapabilities": [ + "AAD_PREMIUM", + "AAD_PREMIUM_P2", + "OFFICE_BUSINESS" + ] }, { "name": "standards.Branding", @@ -362,12 +448,26 @@ "label": "Visual Template", "name": "standards.Branding.layoutTemplateType", "options": [ - { "label": "Full-screen background", "value": "default" }, - { "label": "Partial-screen background", "value": "verticalSplit" } + { + "label": "Full-screen background", + "value": "default" + }, + { + "label": "Partial-screen background", + "value": "verticalSplit" + } ] }, - { "type": "switch", "name": "standards.Branding.isHeaderShown", "label": "Show header" }, - { "type": "switch", "name": "standards.Branding.isFooterShown", "label": "Show footer" } + { + "type": "switch", + "name": "standards.Branding.isHeaderShown", + "label": "Show header" + }, + { + "type": "switch", + "name": "standards.Branding.isFooterShown", + "label": "Show footer" + } ], "label": "Set branding for the tenant", "impact": "Low Impact", @@ -375,13 +475,22 @@ "addedDate": "2024-05-13", "powershellEquivalent": "Portal only", "recommendedBy": [], - "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2", "OFFICE_BUSINESS"] + "requiredCapabilities": [ + "AAD_PREMIUM", + "AAD_PREMIUM_P2", + "OFFICE_BUSINESS" + ] }, { "name": "standards.EnableCustomerLockbox", "cat": "Global Standards", - "tag": ["CIS M365 7.0.0 (1.3.6)", "CustomerLockBoxEnabled"], - "appliesToTest": ["CIS_1_3_6"], + "tag": [ + "CIS M365 7.0.0 (1.3.6)", + "CustomerLockBoxEnabled" + ], + "appliesToTest": [ + "CIS_1_3_6" + ], "helpText": "**Requires CustomerLockbox (E5, E7, A5, Purview Addon for BP, EDU or FL)** Enables Customer Lockbox that offers an approval process for Microsoft support to access organization data", "docsDescription": "**Requires CustomerLockbox (E5, E7, A5, Purview Addon for BP, EDU or FL)** Customer Lockbox ensures that Microsoft can't access your content to do service operations without your explicit approval. Customer Lockbox ensures only authorized requests allow access to your organizations data.", "executiveText": "Requires explicit organizational approval before Microsoft support staff can access company data for service operations. This provides an additional layer of data protection and ensures the organization maintains control over who can access sensitive business information, even during technical support scenarios.", @@ -391,8 +500,12 @@ "impactColour": "info", "addedDate": "2024-01-08", "powershellEquivalent": "Set-OrganizationConfig -CustomerLockBoxEnabled $true", - "recommendedBy": ["CIS"], - "requiredCapabilities": ["CustomerLockbox"] + "recommendedBy": [ + "CIS" + ], + "requiredCapabilities": [ + "CustomerLockbox" + ] }, { "name": "standards.EnablePronouns", @@ -420,7 +533,9 @@ "impact": "Low Impact", "impactColour": "info", "addedDate": "2025-06-06", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "Manage365" + ] }, { "name": "standards.AnonReportDisable", @@ -435,7 +550,9 @@ "impactColour": "info", "addedDate": "2021-11-16", "powershellEquivalent": "Update-MgBetaAdminReportSetting -BodyParameter @{displayConcealedNames = $true}", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "Manage365" + ] }, { "name": "standards.DisableGuestDirectory", @@ -467,13 +584,22 @@ "impactColour": "info", "addedDate": "2022-05-04", "powershellEquivalent": "Set-AzureADMSAuthorizationPolicy -GuestUserRoleId '2af84b1e-32c8-42b7-82bc-daa82404023b'", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "Manage365" + ] }, { "name": "standards.DisableBasicAuthSMTP", "cat": "Global Standards", - "tag": ["CIS M365 7.0.0 (6.5.4)", "NIST CSF 2.0 (PR.IR-01)"], - "appliesToTest": ["CISAMSEXO51", "CIS_6_5_4", "ZTNA21799"], + "tag": [ + "CIS M365 7.0.0 (6.5.4)", + "NIST CSF 2.0 (PR.IR-01)" + ], + "appliesToTest": [ + "CISAMSEXO51", + "CIS_6_5_4", + "ZTNA21799" + ], "helpText": "Disables SMTP AUTH organization-wide, impacting POP and IMAP clients that rely on SMTP for sending emails. Default for new tenants. For more information, see the [Microsoft documentation](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission)", "docsDescription": "Disables tenant-wide SMTP basic authentication, including for all explicitly enabled users, impacting POP and IMAP clients that rely on SMTP for sending emails. For more information, see the [Microsoft documentation](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission).", "executiveText": "Disables outdated email authentication methods that are vulnerable to security attacks, forcing applications and devices to use modern, more secure authentication protocols. This reduces the risk of email-based security breaches and credential theft.", @@ -483,7 +609,10 @@ "impactColour": "warning", "addedDate": "2021-11-16", "powershellEquivalent": "Set-TransportConfig -SmtpClientAuthenticationDisabled $true", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -495,8 +624,17 @@ { "name": "standards.ActivityBasedTimeout", "cat": "Global Standards", - "tag": ["CIS M365 7.0.0 (1.3.2)", "spo_idle_session_timeout", "NIST CSF 2.0 (PR.AA-03)"], - "appliesToTest": ["CIS_1_3_2", "ZTNA21813", "ZTNA21814", "ZTNA21815"], + "tag": [ + "CIS M365 7.0.0 (1.3.2)", + "spo_idle_session_timeout", + "NIST CSF 2.0 (PR.AA-03)" + ], + "appliesToTest": [ + "CIS_1_3_2", + "ZTNA21813", + "ZTNA21814", + "ZTNA21815" + ], "helpText": "Enables and sets Idle session timeout for Microsoft 365 to 1 hour. This policy affects most M365 web apps", "executiveText": "Automatically logs out inactive users from Microsoft 365 applications after a specified time period to prevent unauthorized access to company data on unattended devices. This security measure protects against data breaches when employees leave workstations unlocked.", "addedComponent": [ @@ -507,11 +645,26 @@ "label": "Select value", "name": "standards.ActivityBasedTimeout.timeout", "options": [ - { "label": "1 Hour", "value": "01:00:00" }, - { "label": "3 Hours", "value": "03:00:00" }, - { "label": "6 Hours", "value": "06:00:00" }, - { "label": "12 Hours", "value": "12:00:00" }, - { "label": "24 Hours", "value": "1.00:00:00" } + { + "label": "1 Hour", + "value": "01:00:00" + }, + { + "label": "3 Hours", + "value": "03:00:00" + }, + { + "label": "6 Hours", + "value": "06:00:00" + }, + { + "label": "12 Hours", + "value": "12:00:00" + }, + { + "label": "24 Hours", + "value": "1.00:00:00" + } ] } ], @@ -520,7 +673,9 @@ "impactColour": "warning", "addedDate": "2022-04-13", "powershellEquivalent": "Portal or Graph API", - "recommendedBy": ["CIS"] + "recommendedBy": [ + "CIS" + ] }, { "name": "standards.AuthMethodsSettings", @@ -552,9 +707,18 @@ "name": "standards.AuthMethodsSettings.ReportSuspiciousActivity", "label": "Report Suspicious Activity Settings", "options": [ - { "label": "Microsoft managed", "value": "default" }, - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Microsoft managed", + "value": "default" + }, + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] }, { @@ -565,9 +729,18 @@ "name": "standards.AuthMethodsSettings.SystemCredential", "label": "System Credential Preferences", "options": [ - { "label": "Microsoft managed", "value": "default" }, - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Microsoft managed", + "value": "default" + }, + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] } ], @@ -595,10 +768,20 @@ "label": "Microsoft Authenticator", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } - ] + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } + ], + "defaultValue": false }, { "type": "textField", @@ -629,9 +812,18 @@ "label": "Number Matching", "name": "standards.AuthenticationMethods.MicrosoftAuthenticatorNumberMatching", "options": [ - { "label": "Microsoft managed", "value": "default" }, - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Microsoft managed", + "value": "default" + }, + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ], "condition": { "field": "standards.AuthenticationMethods.MicrosoftAuthenticatorEnabled", @@ -646,9 +838,18 @@ "label": "Show Application Name in Push Notifications", "name": "standards.AuthenticationMethods.MicrosoftAuthenticatorDisplayAppInfo", "options": [ - { "label": "Microsoft managed", "value": "default" }, - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Microsoft managed", + "value": "default" + }, + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ], "condition": { "field": "standards.AuthenticationMethods.MicrosoftAuthenticatorEnabled", @@ -663,9 +864,18 @@ "label": "Show Geographic Location in Push Notifications", "name": "standards.AuthenticationMethods.MicrosoftAuthenticatorDisplayLocation", "options": [ - { "label": "Microsoft managed", "value": "default" }, - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Microsoft managed", + "value": "default" + }, + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ], "condition": { "field": "standards.AuthenticationMethods.MicrosoftAuthenticatorEnabled", @@ -680,9 +890,18 @@ "label": "Companion App (Authenticator Lite)", "name": "standards.AuthenticationMethods.MicrosoftAuthenticatorCompanionApp", "options": [ - { "label": "Microsoft managed", "value": "default" }, - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Microsoft managed", + "value": "default" + }, + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ], "condition": { "field": "standards.AuthenticationMethods.MicrosoftAuthenticatorEnabled", @@ -699,10 +918,20 @@ "label": "FIDO2 Security Keys", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } - ] + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } + ], + "defaultValue": false }, { "type": "textField", @@ -724,10 +953,20 @@ "label": "Temporary Access Pass", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } - ] + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } + ], + "defaultValue": false }, { "type": "textField", @@ -747,8 +986,14 @@ "label": "TAP Usage Mode", "name": "standards.AuthenticationMethods.TAPUsableOnce", "options": [ - { "label": "Only Once", "value": "true" }, - { "label": "Multiple Logons", "value": "false" } + { + "label": "Only Once", + "value": "true" + }, + { + "label": "Multiple Logons", + "value": "false" + } ], "condition": { "field": "standards.AuthenticationMethods.TAPEnabled", @@ -809,10 +1054,20 @@ "label": "Third-Party Software OATH Tokens", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } - ] + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } + ], + "defaultValue": false }, { "type": "textField", @@ -834,10 +1089,20 @@ "label": "Hardware OATH Tokens", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } - ] + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } + ], + "defaultValue": false }, { "type": "textField", @@ -859,17 +1124,27 @@ "label": "SMS", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } - ] - }, - { - "type": "textField", - "name": "standards.AuthenticationMethods.SMSGroup", - "label": "Target Group Name (wildcard supported, blank = All Users)", - "required": false, - "condition": { + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } + ], + "defaultValue": false + }, + { + "type": "textField", + "name": "standards.AuthenticationMethods.SMSGroup", + "label": "Target Group Name (wildcard supported, blank = All Users)", + "required": false, + "condition": { "field": "standards.AuthenticationMethods.SMSEnabled", "compareType": "valueEq", "compareValue": true @@ -884,10 +1159,20 @@ "label": "Voice Call", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } - ] + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } + ], + "defaultValue": false }, { "type": "textField", @@ -909,10 +1194,20 @@ "label": "Email OTP", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } - ] + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } + ], + "defaultValue": false }, { "type": "textField", @@ -934,10 +1229,20 @@ "label": "Certificate-Based Authentication", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } - ] + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } + ], + "defaultValue": false }, { "type": "textField", @@ -959,10 +1264,20 @@ "label": "QR Code Pin", "helperText": "Not Configured or blank leaves the tenant's current setting untouched.", "options": [ - { "label": "Enabled", "value": true }, - { "label": "Disabled", "value": false }, - { "label": "Not Configured", "value": "notConfigured" } - ] + { + "label": "Enabled", + "value": true + }, + { + "label": "Disabled", + "value": false + }, + { + "label": "Not Configured", + "value": "notConfigured" + } + ], + "defaultValue": false }, { "type": "textField", @@ -1003,13 +1318,20 @@ "impactColour": "danger", "addedDate": "2026-05-28", "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "Manage365" + ] }, { "name": "standards.AdminSSPR", "cat": "Entra (AAD) Standards", - "tag": ["EIDSCA.AP01"], - "appliesToTest": ["EIDSCAAP01", "ZTNA21842"], + "tag": [ + "EIDSCA.AP01" + ], + "appliesToTest": [ + "EIDSCAAP01", + "ZTNA21842" + ], "helpText": "Controls whether administrators are allowed to use Self-Service Password Reset through the Microsoft Entra authorization policy.", "docsDescription": "Configures the allowedToUseSSPR property on the Microsoft Entra authorization policy. Microsoft documents this property as controlling whether administrators of the tenant can use Self-Service Password Reset. Use this standard to explicitly enable or disable administrator SSPR based on your security policy.", "executiveText": "Controls whether tenant administrators can reset their own passwords through Self-Service Password Reset. Disabling this capability forces privileged accounts through more controlled recovery processes and reduces the risk of self-service recovery being misused on administrative identities.", @@ -1021,8 +1343,14 @@ "label": "Select value", "name": "standards.AdminSSPR.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] } ], @@ -1031,13 +1359,17 @@ "impactColour": "info", "addedDate": "2026-04-21", "powershellEquivalent": "Update-MgBetaPolicyAuthorizationPolicy", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "Manage365" + ] }, { "name": "standards.AuthMethodsPolicyMigration", "cat": "Entra (AAD) Standards", "tag": [], - "appliesToTest": ["EIDSCAAG01"], + "appliesToTest": [ + "EIDSCAAG01" + ], "helpText": "Completes the migration of authentication methods policy to the new format", "docsDescription": "Sets the authentication methods policy migration state to complete. This is required when migrating from legacy authentication policies to the new unified authentication methods policy.", "executiveText": "Completes the transition from legacy authentication policies to Microsoft's modern unified authentication methods policy, ensuring the organization benefits from the latest security features and management capabilities. This migration enables enhanced security controls and simplified policy management.", @@ -1047,14 +1379,16 @@ "impactColour": "warning", "addedDate": "2025-07-07", "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicy", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "Manage365" + ] }, { "name": "standards.AppDeploy", "cat": "Entra (AAD) Standards", "tag": [], "helpText": "Deploys selected applications to the tenant. Use a comma separated list of application IDs to deploy multiple applications. Permissions will be copied from the source application.", - "docsDescription": "Uses the CIPP functionality that deploys applications across an entire tenant base as a standard.", + "docsDescription": "Uses the Manage365 functionality that deploys applications across an entire tenant base as a standard.", "executiveText": "Automatically deploys approved business applications across all company locations and users, ensuring consistent access to essential tools and maintaining standardized software configurations. This streamlines application management and reduces IT deployment overhead.", "addedComponent": [ { @@ -1064,8 +1398,14 @@ "label": "App Approval Mode", "name": "standards.AppDeploy.mode", "options": [ - { "label": "Template", "value": "template" }, - { "label": "Copy Permissions", "value": "copy" } + { + "label": "Template", + "value": "template" + }, + { + "label": "Copy Permissions", + "value": "copy" + } ] }, { @@ -1079,8 +1419,12 @@ "labelField": "TemplateName", "valueField": "TemplateId", "queryKey": "StdAppApprovalTemplateList", - "addedField": { "AppId": "AppId" }, - "templateView": { "title": "App Approval Template" } + "addedField": { + "AppId": "AppId" + }, + "templateView": { + "title": "App Approval Template" + } }, "condition": { "field": "standards.AppDeploy.mode", @@ -1109,8 +1453,17 @@ { "name": "standards.laps", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (5.1.4.5)", "SMB1001 (2.2)"], - "appliesToTest": ["CIS_5_1_4_5", "SMB1001_2_2", "ZTNA21953", "ZTNA21955", "ZTNA24560"], + "tag": [ + "CIS M365 7.0.0 (5.1.4.5)", + "SMB1001 (2.2)" + ], + "appliesToTest": [ + "CIS_5_1_4_5", + "SMB1001_2_2", + "ZTNA21953", + "ZTNA21955", + "ZTNA24560" + ], "helpText": "Enables the tenant to use LAPS. You must still create a policy for LAPS to be active on all devices. Use the template standards to deploy this by default.", "docsDescription": "Enables the LAPS functionality on the tenant. Prerequisite for using Windows LAPS via Azure AD.", "executiveText": "Enables Local Administrator Password Solution (LAPS) capability, which automatically manages and rotates local administrator passwords on company computers. This significantly improves security by preventing the use of shared or static administrator passwords that could be exploited by attackers.", @@ -1120,7 +1473,9 @@ "impactColour": "info", "addedDate": "2023-04-25", "powershellEquivalent": "Portal or Graph API", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "Manage365" + ] }, { "name": "standards.PWdisplayAppInformationRequiredState", @@ -1154,13 +1509,19 @@ "impactColour": "info", "addedDate": "2021-11-16", "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration", - "recommendedBy": ["CIS"] + "recommendedBy": [ + "CIS" + ] }, { "name": "standards.allowOTPTokens", "cat": "Entra (AAD) Standards", - "tag": ["EIDSCA.AM02"], - "appliesToTest": ["EIDSCAAM02"], + "tag": [ + "EIDSCA.AM02" + ], + "appliesToTest": [ + "EIDSCAAM02" + ], "helpText": "Allows you to use MS authenticator OTP token generator", "docsDescription": "Allows you to use Microsoft Authenticator OTP token generator. Useful for using the NPS extension as MFA on VPN clients.", "executiveText": "Enables one-time password generation through Microsoft Authenticator app, providing an additional secure authentication method for employees. This is particularly useful for secure VPN access and other systems requiring multi-factor authentication.", @@ -1175,8 +1536,14 @@ { "name": "standards.PWcompanionAppAllowedState", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (5.2.3.10)", "EIDSCA.AM01"], - "appliesToTest": ["CIS_5_2_3_10", "EIDSCAAM01"], + "tag": [ + "CIS M365 7.0.0 (5.2.3.10)", + "EIDSCA.AM01" + ], + "appliesToTest": [ + "CIS_5_2_3_10", + "EIDSCAAM01" + ], "helpText": "Sets the state of Authenticator Lite, Authenticator lite is a companion app for passwordless authentication.", "docsDescription": "Sets the Authenticator Lite state to enabled. This allows users to use the Authenticator Lite built into the Outlook app instead of the full Authenticator app.", "executiveText": "Enables a simplified authentication experience by allowing users to authenticate directly through Outlook without requiring a separate authenticator app. This improves user convenience while maintaining security standards for passwordless authentication.", @@ -1188,9 +1555,18 @@ "label": "Select value", "name": "standards.PWcompanionAppAllowedState.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" }, - { "label": "Microsoft managed", "value": "default" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + }, + { + "label": "Microsoft managed", + "value": "default" + } ] } ], @@ -1238,13 +1614,23 @@ "impactColour": "info", "addedDate": "2022-12-08", "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "Manage365" + ] }, { "name": "standards.EnableHardwareOAuth", "cat": "Entra (AAD) Standards", - "tag": ["SMB1001 (2.5)", "SMB1001 (2.6)", "SMB1001 (2.9)"], - "appliesToTest": ["SMB1001_2_5", "SMB1001_2_6", "SMB1001_2_9"], + "tag": [ + "SMB1001 (2.5)", + "SMB1001 (2.6)", + "SMB1001 (2.9)" + ], + "appliesToTest": [ + "SMB1001_2_5", + "SMB1001_2_6", + "SMB1001_2_9" + ], "helpText": "Enables the HardwareOath authenticationMethod for the tenant. This allows you to use hardware tokens for generating 6 digit MFA codes.", "docsDescription": "Enables Hardware OAuth tokens for the tenant. This allows users to use hardware tokens like a Yubikey for authentication.", "executiveText": "Enables physical hardware tokens that generate secure authentication codes, providing an alternative to smartphone-based authentication. This is particularly valuable for employees who cannot use mobile devices or require the highest security standards for accessing sensitive systems.", @@ -1259,8 +1645,14 @@ { "name": "standards.allowOAuthTokens", "cat": "Entra (AAD) Standards", - "tag": ["EIDSCA.AT01", "EIDSCA.AT02"], - "appliesToTest": ["EIDSCAAT01", "EIDSCAAT02"], + "tag": [ + "EIDSCA.AT01", + "EIDSCA.AT02" + ], + "appliesToTest": [ + "EIDSCAAT01", + "EIDSCAAT02" + ], "helpText": "Allows you to use any software OAuth token generator", "docsDescription": "Enables OTP Software OAuth tokens for the tenant. This allows users to use OTP codes generated via software, like a password manager to be used as an authentication method.", "executiveText": "Allows employees to use third-party authentication apps and password managers to generate secure login codes, providing flexibility in authentication methods while maintaining security standards. This accommodates diverse user preferences and existing security tools.", @@ -1275,8 +1667,14 @@ { "name": "standards.FormsPhishingProtection", "cat": "Global Standards", - "tag": ["CIS M365 7.0.0 (1.3.5)", "Security", "PhishingProtection"], - "appliesToTest": ["CIS_1_3_5"], + "tag": [ + "CIS M365 7.0.0 (1.3.5)", + "Security", + "PhishingProtection" + ], + "appliesToTest": [ + "CIS_1_3_5" + ], "helpText": "Enables internal phishing protection for Microsoft Forms to help prevent malicious forms from being created and shared within the organization. This feature scans forms created by internal users for potential phishing content and suspicious patterns.", "docsDescription": "Enables internal phishing protection for Microsoft Forms by setting the isInOrgFormsPhishingScanEnabled property to true. This security feature helps protect organizations from internal phishing attacks through Microsoft Forms by automatically scanning forms created by internal users for potential malicious content, suspicious links, and phishing patterns. When enabled, Forms will analyze form content and block or flag potentially dangerous forms before they can be shared within the organization.", "executiveText": "Automatically scans Microsoft Forms created by employees for malicious content and phishing attempts, preventing the creation and distribution of harmful forms within the organization. This protects against both internal threats and compromised accounts that might be used to distribute malicious content.", @@ -1286,14 +1684,22 @@ "impactColour": "info", "addedDate": "2025-06-06", "powershellEquivalent": "Graph API", - "recommendedBy": ["CIS", "CIPP"] + "recommendedBy": [ + "CIS", + "Manage365" + ] }, { "name": "standards.TAP", "cat": "Entra (AAD) Standards", "tag": [], - "appliesToTest": ["EIDSCAAT01", "EIDSCAAT02", "ZTNA21845", "ZTNA21846"], - "helpText": "Enable TAP with the specified configuration settings.", + "appliesToTest": [ + "EIDSCAAT01", + "EIDSCAAT02", + "ZTNA21845", + "ZTNA21846" + ], + "helpText": "Enables TAP and sets the default TAP lifetime to 1 hour. This configuration also allows you to select if a TAP is single use or multi-logon.", "docsDescription": "Enables Temporary Access Pass generation for the tenant.", "executiveText": "Enables temporary access passes that IT administrators can generate for employees who are locked out or need emergency access to systems. These time-limited passes provide a secure way to restore access without compromising long-term security policies.", "addedComponent": [ @@ -1303,8 +1709,14 @@ "label": "Minimum Lifetime (minutes)", "defaultValue": 60, "validators": { - "min": { "value": 10, "message": "Minimum value is 10" }, - "max": { "value": 43200, "message": "Maximum value is 43200" } + "min": { + "value": 10, + "message": "Minimum value is 10" + }, + "max": { + "value": 43200, + "message": "Maximum value is 43200" + } } }, { @@ -1313,8 +1725,14 @@ "label": "Maximum Lifetime (minutes)", "defaultValue": 480, "validators": { - "min": { "value": 10, "message": "Minimum value is 10" }, - "max": { "value": 43200, "message": "Maximum value is 43200" } + "min": { + "value": 10, + "message": "Minimum value is 10" + }, + "max": { + "value": 43200, + "message": "Maximum value is 43200" + } } }, { @@ -1323,8 +1741,14 @@ "label": "Default Lifetime (minutes)", "defaultValue": 60, "validators": { - "min": { "value": 10, "message": "Minimum value is 10" }, - "max": { "value": 43200, "message": "Maximum value is 43200" } + "min": { + "value": 10, + "message": "Minimum value is 10" + }, + "max": { + "value": 43200, + "message": "Maximum value is 43200" + } } }, { @@ -1333,8 +1757,14 @@ "label": "Length (characters)", "defaultValue": 8, "validators": { - "min": { "value": 8, "message": "Minimum value is 8" }, - "max": { "value": 48, "message": "Maximum value is 48" } + "min": { + "value": 8, + "message": "Minimum value is 8" + }, + "max": { + "value": 48, + "message": "Maximum value is 48" + } } }, { @@ -1344,8 +1774,14 @@ "label": "Number of Times Usable", "name": "standards.TAP.config", "options": [ - { "label": "Only Once", "value": "true" }, - { "label": "Multiple Logons", "value": "false" } + { + "label": "Only Once", + "value": "true" + }, + { + "label": "Multiple Logons", + "value": "false" + } ] } ], @@ -1354,13 +1790,21 @@ "impactColour": "info", "addedDate": "2022-03-15", "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "Manage365" + ] }, { "name": "standards.PasswordExpireDisabled", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (1.3.1)", "PWAgePolicyNew"], - "appliesToTest": ["CIS_1_3_1", "ZTNA21811"], + "tag": [ + "CIS M365 7.0.0 (1.3.1)", + "PWAgePolicyNew" + ], + "appliesToTest": [ + "CIS_1_3_1", + "ZTNA21811" + ], "helpText": "Disables the expiration of passwords for the tenant by setting the password expiration policy to never expire for any user.", "docsDescription": "Sets passwords to never expire for tenant, recommended to use in conjunction with secure password requirements.", "executiveText": "Eliminates mandatory password expiration requirements, allowing employees to keep strong passwords indefinitely rather than forcing frequent changes that often lead to weaker passwords. This modern security approach reduces help desk calls and improves overall password security when combined with multi-factor authentication.", @@ -1370,12 +1814,18 @@ "impactColour": "info", "addedDate": "2021-11-16", "powershellEquivalent": "Update-MgDomain", - "recommendedBy": ["CIS", "CIPP"] + "recommendedBy": [ + "CIS", + "Manage365" + ] }, { "name": "standards.CustomBannedPasswordList", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (5.2.3.2)", "SMB1001 (2.1)"], + "tag": [ + "CIS M365 7.0.0 (5.2.3.2)", + "SMB1001 (2.1)" + ], "appliesToTest": [ "CIS_5_2_3_2", "EIDSCAPR01", @@ -1404,14 +1854,22 @@ "impactColour": "warning", "addedDate": "2025-06-28", "powershellEquivalent": "Get-MgBetaDirectorySetting, New-MgBetaDirectorySetting, Update-MgBetaDirectorySetting", - "recommendedBy": ["CIS"], - "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"] + "recommendedBy": [ + "CIS" + ], + "requiredCapabilities": [ + "AAD_PREMIUM", + "AAD_PREMIUM_P2" + ] }, { "name": "standards.ExternalMFATrusted", "cat": "Entra (AAD) Standards", "tag": [], - "appliesToTest": ["ZTNA21803", "ZTNA21804"], + "appliesToTest": [ + "ZTNA21803", + "ZTNA21804" + ], "helpText": "Sets the state of the Cross-tenant access setting to trust external MFA. This allows guest users to use their home tenant MFA to access your tenant.", "executiveText": "Allows external partners and vendors to use their own organization's multi-factor authentication when accessing company resources, streamlining collaboration while maintaining security standards. This reduces friction for external users while ensuring they still meet authentication requirements.", "addedComponent": [ @@ -1422,8 +1880,14 @@ "label": "Select value", "name": "standards.ExternalMFATrusted.state", "options": [ - { "label": "Enabled", "value": "true" }, - { "label": "Disabled", "value": "false" } + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } ] } ], @@ -1448,8 +1912,14 @@ "label": "Select value", "name": "standards.ExternalComplianceTrusted.state", "options": [ - { "label": "Enabled", "value": "true" }, - { "label": "Disabled", "value": "false" } + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } ] } ], @@ -1463,8 +1933,17 @@ { "name": "standards.DisableTenantCreation", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (5.1.2.3)", "CISA (MS.AAD.6.1v1)", "SMB1001 (2.8)"], - "appliesToTest": ["CIS_5_1_2_3", "SMB1001_2_8", "ZTNA21772", "ZTNA21787"], + "tag": [ + "CIS M365 7.0.0 (5.1.2.3)", + "CISA (MS.AAD.6.1v1)", + "SMB1001 (2.8)" + ], + "appliesToTest": [ + "CIS_5_1_2_3", + "SMB1001_2_8", + "ZTNA21772", + "ZTNA21787" + ], "helpText": "Restricts creation of M365 tenants to the Global Administrator or Tenant Creator roles.", "docsDescription": "Users by default are allowed to create M365 tenants. This disables that so only admins can create new M365 tenants.", "executiveText": "Prevents regular employees from creating new Microsoft 365 organizations, ensuring all new tenants are properly managed and controlled by IT administrators. This prevents unauthorized shadow IT environments and maintains centralized governance over Microsoft 365 resources.", @@ -1474,7 +1953,10 @@ "impactColour": "info", "addedDate": "2022-11-29", "powershellEquivalent": "Update-MgPolicyAuthorizationPolicy", - "recommendedBy": ["CIS", "CIPP"] + "recommendedBy": [ + "CIS", + "Manage365" + ] }, { "name": "standards.EnableAppConsentRequests", @@ -1523,13 +2005,20 @@ "impactColour": "info", "addedDate": "2023-11-27", "powershellEquivalent": "Update-MgPolicyAdminConsentRequestPolicy", - "recommendedBy": ["CIS"] + "recommendedBy": [ + "CIS" + ] }, { "name": "standards.NudgeMFA", "cat": "Entra (AAD) Standards", - "tag": ["SMB1001 (2.5)"], - "appliesToTest": ["SMB1001_2_5", "ZTNA21889"], + "tag": [ + "SMB1001 (2.5)" + ], + "appliesToTest": [ + "SMB1001_2_5", + "ZTNA21889" + ], "helpText": "Sets the state of the registration campaign for the tenant, including the targeted authentication method, snooze settings and include/exclude groups. Leave include/exclude blank to keep the groups currently configured in the tenant, or use 'AllUsers' to target all users.", "docsDescription": "Sets the state of the registration campaign for the tenant. If enabled nudges users to set up the targeted authentication method (Microsoft Authenticator or a Passkey) during sign-in. Supports limiting the number of snoozes, and including or excluding specific groups (by display name).", "executiveText": "Prompts employees to set up multi-factor authentication during login, gradually improving the organization's security posture by encouraging adoption of stronger authentication methods. This helps achieve better security compliance without forcing immediate mandatory changes.", @@ -1541,9 +2030,18 @@ "label": "Registration campaign state", "name": "standards.NudgeMFA.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" }, - { "label": "Microsoft managed", "value": "default" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + }, + { + "label": "Microsoft managed", + "value": "default" + } ] }, { @@ -1554,8 +2052,14 @@ "label": "Authentication method to nudge users to register (default is Microsoft Authenticator)", "name": "standards.NudgeMFA.targetedAuthenticationMethod", "options": [ - { "label": "Microsoft Authenticator", "value": "microsoftAuthenticator" }, - { "label": "Passkey (FIDO2)", "value": "FIDO2" } + { + "label": "Microsoft Authenticator", + "value": "microsoftAuthenticator" + }, + { + "label": "Passkey (FIDO2)", + "value": "FIDO2" + } ], "condition": { "field": "standards.NudgeMFA.state", @@ -1569,8 +2073,14 @@ "label": "Number of days to allow users to skip registering Authenticator (0-14, default is 1)", "defaultValue": 1, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 14, "message": "Maximum value is 14" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 14, + "message": "Maximum value is 14" + } } }, { @@ -1617,8 +2127,14 @@ { "name": "standards.DisableM365GroupUsers", "cat": "Entra (AAD) Standards", - "tag": ["CISA (MS.AAD.21.1v1)", "SMB1001 (2.8)"], - "appliesToTest": ["SMB1001_2_8", "ZTNA21868"], + "tag": [ + "CISA (MS.AAD.21.1v1)", + "SMB1001 (2.8)" + ], + "appliesToTest": [ + "SMB1001_2_8", + "ZTNA21868" + ], "helpText": "Restricts M365 group creation to certain admin roles. This disables the ability to create Teams, SharePoint sites, Planner, etc. Optionally allows members of a specific security group to keep creating groups (GroupCreationAllowedGroupId).", "docsDescription": "Users by default are allowed to create M365 groups. This restricts M365 group creation to certain admin roles. This disables the ability to create Teams, SharePoint sites, Planner, etc. Optionally, a security group can be named whose members remain allowed to create groups; the group is resolved by display name in each tenant and can be created automatically when it does not exist. When no group is named, the existing GroupCreationAllowedGroupId value in the tenant is left untouched.", "executiveText": "Restricts the creation of Microsoft 365 groups, Teams, and SharePoint sites to authorized administrators, preventing uncontrolled proliferation of collaboration spaces. This ensures proper governance, naming conventions, and resource management while maintaining oversight of all collaborative environments. An approved group of designated users can optionally retain the ability to create groups.", @@ -1662,7 +2178,11 @@ "NIST CSF 2.0 (PR.AA-05)", "SMB1001 (2.8)" ], - "appliesToTest": ["CIS_5_1_2_2", "EIDSCAAP10", "SMB1001_2_8"], + "appliesToTest": [ + "CIS_5_1_2_2", + "EIDSCAAP10", + "SMB1001_2_8" + ], "helpText": "Disables the ability for users to create App registrations in the tenant.", "docsDescription": "Disables the ability for users to create applications in Entra. Done to prevent breached accounts from creating an app to maintain access to the tenant, even after the breached account has been secured.", "executiveText": "Prevents regular employees from creating application registrations that could be used to maintain unauthorized access to company systems. This security measure ensures that only authorized IT personnel can create applications, reducing the risk of persistent security breaches through malicious applications.", @@ -1672,13 +2192,21 @@ "impactColour": "info", "addedDate": "2024-03-20", "powershellEquivalent": "Update-MgPolicyAuthorizationPolicy", - "recommendedBy": ["CIS", "CIPP"] + "recommendedBy": [ + "CIS", + "Manage365" + ] }, { "name": "standards.BitLockerKeysForOwnedDevice", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (5.1.4.6)"], - "appliesToTest": ["CIS_5_1_4_6", "ZTNA21954"], + "tag": [ + "CIS M365 7.0.0 (5.1.4.6)" + ], + "appliesToTest": [ + "CIS_5_1_4_6", + "ZTNA21954" + ], "helpText": "Controls whether standard users can recover BitLocker keys for devices they own.", "docsDescription": "Updates the Microsoft Entra authorization policy that controls whether standard users can read BitLocker recovery keys for devices they own. Choose to restrict access for tighter security or allow self-service recovery when operational needs require it.", "executiveText": "Gives administrators centralized control over BitLocker recovery secrets—restrict access to ensure IT-assisted recovery flows, or allow self-service when rapid device unlocks are a priority.", @@ -1690,8 +2218,14 @@ "label": "Select state", "name": "standards.BitLockerKeysForOwnedDevice.state", "options": [ - { "label": "Restrict", "value": "restrict" }, - { "label": "Allow", "value": "allow" } + { + "label": "Restrict", + "value": "restrict" + }, + { + "label": "Allow", + "value": "allow" + } ] } ], @@ -1711,7 +2245,11 @@ "NIST CSF 2.0 (PR.AA-05)", "SMB1001 (2.8)" ], - "appliesToTest": ["CIS_5_1_3_1", "SMB1001_2_8", "ZTNA21868"], + "appliesToTest": [ + "CIS_5_1_3_1", + "SMB1001_2_8", + "ZTNA21868" + ], "helpText": "Completely disables the creation of security groups by users. This also breaks the ability to manage groups themselves, or create Teams", "executiveText": "Restricts the creation of security groups to IT administrators only, preventing employees from creating unauthorized access groups that could bypass security controls. This ensures proper governance of access permissions and maintains centralized control over who can access what resources.", "addedComponent": [], @@ -1739,9 +2277,16 @@ { "name": "standards.DisableSelfServiceLicenses", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (1.3.4)", "SMB1001 (2.8)"], - "appliesToTest": ["CIS_1_3_4", "EIDSCAAP05", "SMB1001_2_8"], - "helpText": "This standard disables all self service licenses and enables all exclusions", + "tag": [ + "CIS M365 7.0.0 (1.3.4)", + "SMB1001 (2.8)" + ], + "appliesToTest": [ + "CIS_1_3_4", + "EIDSCAAP05", + "SMB1001_2_8" + ], + "helpText": "**Requires 'Billing Administrator' GDAP role.** This standard disables all self service licenses and enables all exclusions", "executiveText": "Prevents employees from purchasing Microsoft 365 licenses independently, ensuring all software acquisitions go through proper procurement channels. This maintains budget control, prevents unauthorized spending, and ensures compliance with corporate licensing agreements.", "addedComponent": [ { @@ -1766,8 +2311,13 @@ { "name": "standards.DisableGuests", "cat": "Entra (AAD) Standards", - "tag": ["SMB1001 (2.8)"], - "appliesToTest": ["SMB1001_2_8", "ZTNA21858"], + "tag": [ + "SMB1001 (2.8)" + ], + "appliesToTest": [ + "SMB1001_2_8", + "ZTNA21858" + ], "helpText": "Blocks login for guest users whose most recent sign-in attempt, interactive or non-interactive, is older than the number of days. Optionally soft-deletes already-disabled guests after a configurable grace period past that threshold (0 = never delete). Guests that have never signed in are only included when 'Disable accounts that have not yet signed in' is enabled. Accounts an administrator re-enabled in the last 7 days are left alone. Deleted guests remain recoverable from Deleted Items for about 30 days.", "docsDescription": "Blocks login for guest users whose most recent sign-in attempt, interactive or non-interactive, is older than the number of days. Remediation first disables stale enabled guests, and later soft-deletes guests that are already disabled once they have been inactive for the disable threshold plus the configured grace delta (deletion age = days + deleteGraceDays). The disable-before-delete grace is further guaranteed by never deleting a guest in the same pass it was disabled. Guests that have never signed in are only included when 'Disable accounts that have not yet signed in' is enabled. Accounts an administrator re-enabled in the last 7 days are left alone. Graph user DELETE is a soft-delete (recoverable from Deleted Items for about 30 days), which lets a later re-invite create a clean guest object instead of colliding with a disabled account.", "executiveText": "Automatically disables external guest accounts that haven't been used for a number of days, and can optionally remove already-disabled dormant guests after an additional grace period. This reduces security risks from abandoned external access, keeps the directory clean, and avoids errors when previously disabled guests need to be invited back.", @@ -1785,7 +2335,10 @@ "label": "Grace days after disable before deletion (0 = never delete). Guests are deleted once inactive for the disable threshold plus this many additional days.", "defaultValue": 0, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" } + "min": { + "value": 0, + "message": "Minimum value is 0" + } } }, { @@ -1800,13 +2353,22 @@ "impactColour": "danger", "addedDate": "2022-10-20", "powershellEquivalent": "Graph API", - "recommendedBy": ["CIS", "CIPP"], - "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"] - }, - { - "name": "standards.DisableInactiveUsers", + "recommendedBy": [ + "CIS", + "Manage365" + ], + "requiredCapabilities": [ + "AAD_PREMIUM", + "AAD_PREMIUM_P2" + ] + }, + { + "name": "standards.DisableInactiveUsers", "cat": "Entra (AAD) Standards", - "tag": ["CMMC (IA.L2-3.5.6)", "NIST SP 800-171 (3.5.6)"], + "tag": [ + "CMMC (IA.L2-3.5.6)", + "NIST SP 800-171 (3.5.6)" + ], "helpText": "Blocks login for cloud-only member users that have not signed in for a configurable number of days (minimum 30). Includes accounts that have never signed in when the account is older than the threshold. Hybrid (on-premises synced) users are skipped. Users without sign-in activity data are not disabled.", "docsDescription": "Disables enabled Member user accounts after a defined period of inactivity (minimum 30 days), supporting CMMC IA.L2-3.5.6 / NIST SP 800-171 3.5.6. Inactivity is based on signInActivity.lastSuccessfulSignInDateTime. Accounts that have never signed in (signInActivity present but no successful sign-in) are included when createdDateTime is older than the threshold. Users missing signInActivity entirely are skipped so incomplete Graph data cannot cause accidental disables. Hybrid-synced (onPremisesSyncEnabled) users are skipped because Entra disable often will not stick. Recently re-enabled accounts (last 7 days) are also skipped. Values below 30 days are rejected at runtime.", "executiveText": "Automatically disables unused employee accounts that have not signed in for a configured number of days, reducing risk from dormant accounts and supporting CMMC / NIST inactive-identifier requirements. Hybrid directory-synced accounts are left alone so on-premises identity remains the source of truth for those users.", @@ -1818,7 +2380,10 @@ "defaultValue": 180, "label": "Days of inactivity (minimum 30)", "validators": { - "min": { "value": 30, "message": "Minimum value is 30" } + "min": { + "value": 30, + "message": "Minimum value is 30" + } } } ], @@ -1827,8 +2392,14 @@ "impactColour": "danger", "addedDate": "2026-07-22", "powershellEquivalent": "Get-MgUser -Property SignInActivity & Update-MgUser -AccountEnabled $false", - "recommendedBy": ["CIPP", "CMMC"], - "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"] + "recommendedBy": [ + "Manage365", + "CMMC" + ], + "requiredCapabilities": [ + "AAD_PREMIUM", + "AAD_PREMIUM_P2" + ] }, { "name": "standards.OauthConsent", @@ -1869,12 +2440,17 @@ "impactColour": "warning", "addedDate": "2021-11-16", "powershellEquivalent": "Update-MgPolicyAuthorizationPolicy", - "recommendedBy": ["CIS", "CIPP"] + "recommendedBy": [ + "CIS", + "Manage365" + ] }, { "name": "standards.OauthConsentLowSec", "cat": "Entra (AAD) Standards", - "tag": ["IntegratedApps"], + "tag": [ + "IntegratedApps" + ], "helpText": "Sets the default oauth consent level so users can consent to applications that have low risks. This standard conflicts with the \"Require admin consent for applications\" standard; only one of the two should be assigned per tenant.", "docsDescription": "Allows users to consent to applications with low assigned risk. This standard conflicts with the \"Require admin consent for applications (Prevent OAuth phishing)\" (OauthConsent) standard. Enabling both on the same tenant causes a remediation conflict, so only assign one.", "executiveText": "Allows employees to approve low-risk applications without administrative intervention, balancing security with productivity. This provides a middle ground between complete restriction and open access, enabling business agility while maintaining protection against high-risk applications.", @@ -1888,8 +2464,19 @@ { "name": "standards.GuestInvite", "cat": "Entra (AAD) Standards", - "tag": ["CISA (MS.AAD.18.1v1)", "EIDSCA.AP04", "EIDSCA.AP07", "SMB1001 (2.8)"], - "appliesToTest": ["CIS_5_1_6_3", "EIDSCAAP04", "EIDSCAAP07", "SMB1001_2_8", "ZTNA21791"], + "tag": [ + "CISA (MS.AAD.18.1v1)", + "EIDSCA.AP04", + "EIDSCA.AP07", + "SMB1001 (2.8)" + ], + "appliesToTest": [ + "CIS_5_1_6_3", + "EIDSCAAP04", + "EIDSCAAP07", + "SMB1001_2_8", + "ZTNA21791" + ], "helpText": "This setting controls who can invite guests to your directory to collaborate on resources secured by your company, such as SharePoint sites or Azure resources.", "executiveText": "Controls who within the organization can invite external partners and vendors to access company resources, ensuring proper oversight of external access while enabling necessary business collaboration. This helps maintain security while supporting partnership and vendor relationships.", "addedComponent": [ @@ -1901,13 +2488,22 @@ "label": "Who can send invites?", "name": "standards.GuestInvite.allowInvitesFrom", "options": [ - { "label": "Everyone", "value": "everyone" }, + { + "label": "Everyone", + "value": "everyone" + }, { "label": "Admins, Guest inviters and All Members", "value": "adminsGuestInvitersAndAllMembers" }, - { "label": "Admins and Guest inviters", "value": "adminsAndGuestInviters" }, - { "label": "None", "value": "none" } + { + "label": "Admins and Guest inviters", + "value": "adminsAndGuestInviters" + }, + { + "label": "None", + "value": "none" + } ] } ], @@ -1921,7 +2517,11 @@ { "name": "standards.StaleEntraDevices", "cat": "Entra (AAD) Standards", - "tag": ["Essential 8 (1501)", "NIST CSF 2.0 (ID.AM-08)", "NIST CSF 2.0 (PR.PS-03)"], + "tag": [ + "Essential 8 (1501)", + "NIST CSF 2.0 (ID.AM-08)", + "NIST CSF 2.0 (PR.PS-03)" + ], "helpText": "Cleans up Entra devices that have not connected/signed in for the specified number of days. Remediation first disables stale enabled devices and, on a later run, deletes stale devices that are already disabled. Hybrid-joined, Intune-managed and Autopilot devices are skipped. Deleting a device permanently removes any BitLocker recovery keys stored on it.", "docsDescription": "Cleans up Entra devices that have not connected/signed in for the specified number of days. Remediation first disables stale enabled devices once they pass the disable threshold, and later deletes devices that are already disabled once they have been inactive for the disable threshold plus the configured grace delta (deletion age = disable threshold + grace days). The disable-before-delete grace period is further guaranteed by never deleting a device in the same pass it was disabled. Hybrid-joined (on-premises synced), Intune-managed/compliant, and system-managed Autopilot devices are excluded, in line with the [Microsoft guidance](https://learn.microsoft.com/en-us/entra/identity/devices/manage-stale-devices). **Warning:** deleting a device permanently removes any BitLocker recovery keys stored on that device object.", "executiveText": "Automatically identifies and removes inactive devices that haven't connected to company systems for a specified period, reducing security risks from abandoned or lost devices. This maintains a clean device inventory and prevents potential unauthorized access through dormant device registrations.", @@ -1933,7 +2533,10 @@ "defaultValue": 90, "label": "Days before stale (disables the device after this many days of inactivity, minimum 30)", "validators": { - "min": { "value": 30, "message": "Minimum value is 30" } + "min": { + "value": 30, + "message": "Minimum value is 30" + } } }, { @@ -1942,11 +2545,18 @@ "defaultValue": 0, "label": "Grace days after disable before deletion (0 = never delete). Devices are deleted once inactive for the disable threshold plus this many additional days.", "validators": { - "min": { "value": 0, "message": "Minimum value is 0" } + "min": { + "value": 0, + "message": "Minimum value is 0" + } } } ], - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "label": "Cleanup stale Entra devices", "impact": "High Impact", "impactColour": "danger", @@ -1972,8 +2582,18 @@ { "name": "standards.SecurityDefaults", "cat": "Entra (AAD) Standards", - "tag": ["CISA (MS.AAD.11.1v1)", "SMB1001 (2.5)", "SMB1001 (2.6)", "SMB1001 (2.9)"], - "appliesToTest": ["SMB1001_2_5", "SMB1001_2_6", "SMB1001_2_9", "ZTNA21843"], + "tag": [ + "CISA (MS.AAD.11.1v1)", + "SMB1001 (2.5)", + "SMB1001 (2.6)", + "SMB1001 (2.9)" + ], + "appliesToTest": [ + "SMB1001_2_5", + "SMB1001_2_6", + "SMB1001_2_9", + "ZTNA21843" + ], "helpText": "Enables security defaults for the tenant, for newer tenants this is enabled by default. Do not enable this feature if you use Conditional Access.", "docsDescription": "Enables SD for the tenant, which disables all forms of basic authentication and enforces users to configure MFA. Users are only prompted for MFA when a logon is considered 'suspect' by Microsoft.", "executiveText": "Activates Microsoft's baseline security configuration that requires multi-factor authentication and blocks legacy authentication methods. This provides essential security protection for organizations without complex conditional access policies, significantly improving security posture with minimal configuration.", @@ -2013,7 +2633,9 @@ "impactColour": "danger", "addedDate": "2023-12-18", "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "Manage365" + ] }, { "name": "standards.DisableVoice", @@ -2043,7 +2665,9 @@ "impactColour": "danger", "addedDate": "2023-12-18", "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "Manage365" + ] }, { "name": "standards.DisableEmail", @@ -2055,7 +2679,13 @@ "SMB1001 (2.6)", "SMB1001 (2.9)" ], - "appliesToTest": ["CIS_5_2_3_7", "SMB1001_2_5", "SMB1001_2_5_L4", "SMB1001_2_6", "SMB1001_2_9"], + "appliesToTest": [ + "CIS_5_2_3_7", + "SMB1001_2_5", + "SMB1001_2_5_L4", + "SMB1001_2_6", + "SMB1001_2_9" + ], "helpText": "This blocks users from using email as an MFA method. This disables the email OTP option for guest users, and instead prompts them to create a Microsoft account.", "executiveText": "Disables email-based authentication codes due to security concerns with email interception and account compromise. This forces users to adopt more secure authentication methods, particularly affecting guest users who must use stronger verification methods.", "addedComponent": [], @@ -2086,7 +2716,9 @@ "impactColour": "warning", "addedDate": "2026-06-03", "powershellEquivalent": "Invoke-MgGraphRequest https://graph.microsoft.com/v1.0/policies/homeRealmDiscoveryPolicies/", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "Manage365" + ] }, { "name": "standards.Disablex509Certificate", @@ -2163,7 +2795,11 @@ "creatable": false, "name": "standards.UserPreferredLanguage.preferredLanguage", "label": "Preferred Language", - "api": { "url": "/languageList.json", "labelField": "tag", "valueField": "tag" } + "api": { + "url": "/languageList.json", + "labelField": "tag", + "valueField": "tag" + } } ], "label": "Preferred language for all users", @@ -2248,8 +2884,14 @@ "name": "standards.AppManagementPolicy.passwordCredentialsPasswordAddition", "label": "Disable Password Addition", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] }, { @@ -2260,8 +2902,14 @@ "name": "standards.AppManagementPolicy.passwordCredentialsCustomPasswordAddition", "label": "Disable Custom Password", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] }, { @@ -2287,8 +2935,12 @@ { "name": "standards.OutBoundSpamAlert", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (2.1.6)"], - "appliesToTest": ["CIS_2_1_6"], + "tag": [ + "CIS M365 7.0.0 (2.1.6)" + ], + "appliesToTest": [ + "CIS_2_1_6" + ], "helpText": "Set the Outbound Spam Alert e-mail address", "docsDescription": "Sets the e-mail address to which outbound spam alerts are sent.", "addedComponent": [ @@ -2313,7 +2965,9 @@ "impactColour": "info", "addedDate": "2023-05-03", "powershellEquivalent": "Set-HostedOutboundSpamFilterPolicy", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -2356,9 +3010,18 @@ "label": "Select value", "name": "standards.GlobalQuarantineNotifications.NotificationInterval", "options": [ - { "label": "4 hours", "value": "04:00:00" }, - { "label": "1 day/Daily", "value": "1.00:00:00" }, - { "label": "7 days/Weekly", "value": "7.00:00:00" } + { + "label": "4 hours", + "value": "04:00:00" + }, + { + "label": "1 day/Daily", + "value": "1.00:00:00" + }, + { + "label": "7 days/Weekly", + "value": "7.00:00:00" + } ] } ], @@ -2389,7 +3052,9 @@ "impactColour": "info", "addedDate": "2024-04-26", "powershellEquivalent": "Set-RemoteDomain -Identity 'Default' -TNEFEnabled $false", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -2412,8 +3077,14 @@ "label": "Select value", "name": "standards.FocusedInbox.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] } ], @@ -2445,8 +3116,14 @@ "label": "Select value", "name": "standards.CloudMessageRecall.state", "options": [ - { "label": "Enabled", "value": "true" }, - { "label": "Disabled", "value": "false" } + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } ] } ], @@ -2501,8 +3178,14 @@ "label": "Select value", "name": "standards.TwoClickEmailProtection.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] } ], @@ -2523,8 +3206,14 @@ { "name": "standards.EnableOnlineArchiving", "cat": "Exchange Standards", - "tag": ["Essential 8 (1511)", "NIST CSF 2.0 (PR.DS-11)", "SMB1001 (3.1)"], - "appliesToTest": ["SMB1001_3_1"], + "tag": [ + "Essential 8 (1511)", + "NIST CSF 2.0 (PR.DS-11)", + "SMB1001 (3.1)" + ], + "appliesToTest": [ + "SMB1001_3_1" + ], "helpText": "Enables the In-Place Online Archive for all UserMailboxes with a valid license.", "executiveText": "Automatically enables online email archiving for all licensed employees, providing additional storage for older emails while maintaining easy access. This helps manage mailbox sizes, improves email performance, and supports compliance with data retention requirements.", "addedComponent": [], @@ -2545,8 +3234,12 @@ { "name": "standards.EnableLitigationHold", "cat": "Exchange Standards", - "tag": ["SMB1001 (3.1)"], - "appliesToTest": ["SMB1001_3_1"], + "tag": [ + "SMB1001 (3.1)" + ], + "appliesToTest": [ + "SMB1001_3_1" + ], "helpText": "Enables litigation hold for all UserMailboxes with a valid license.", "executiveText": "Preserves all email content for legal and compliance purposes by preventing permanent deletion of emails, even when users attempt to delete them. This is essential for organizations subject to legal discovery requirements or regulatory compliance mandates.", "addedComponent": [ @@ -2589,17 +3282,50 @@ "label": "Default font name", "helperText": "Font applied to new messages. You can type a font that is not in this list.", "options": [ - { "label": "Aptos", "value": "Aptos" }, - { "label": "Arial", "value": "Arial" }, - { "label": "Calibri", "value": "Calibri" }, - { "label": "Cambria", "value": "Cambria" }, - { "label": "Georgia", "value": "Georgia" }, - { "label": "Helvetica", "value": "Helvetica" }, - { "label": "Segoe UI", "value": "Segoe UI" }, - { "label": "Tahoma", "value": "Tahoma" }, - { "label": "Times New Roman", "value": "Times New Roman" }, - { "label": "Trebuchet MS", "value": "Trebuchet MS" }, - { "label": "Verdana", "value": "Verdana" } + { + "label": "Aptos", + "value": "Aptos" + }, + { + "label": "Arial", + "value": "Arial" + }, + { + "label": "Calibri", + "value": "Calibri" + }, + { + "label": "Cambria", + "value": "Cambria" + }, + { + "label": "Georgia", + "value": "Georgia" + }, + { + "label": "Helvetica", + "value": "Helvetica" + }, + { + "label": "Segoe UI", + "value": "Segoe UI" + }, + { + "label": "Tahoma", + "value": "Tahoma" + }, + { + "label": "Times New Roman", + "value": "Times New Roman" + }, + { + "label": "Trebuchet MS", + "value": "Trebuchet MS" + }, + { + "label": "Verdana", + "value": "Verdana" + } ] }, { @@ -2610,8 +3336,14 @@ "defaultValue": 3, "helperText": "Exchange stores a 1-7 size scale, not a point size. 3 is the Exchange default and corresponds to 12pt; lower is smaller, higher is larger.", "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 7, "message": "Maximum value is 7" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 7, + "message": "Maximum value is 7" + } } }, { @@ -2640,8 +3372,15 @@ { "name": "standards.SpoofWarn", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (6.2.3)"], - "appliesToTest": ["CISAMSEXO71", "CIS_6_2_3", "ORCA111", "ORCA240"], + "tag": [ + "CIS M365 7.0.0 (6.2.3)" + ], + "appliesToTest": [ + "CISAMSEXO71", + "CIS_6_2_3", + "ORCA111", + "ORCA240" + ], "helpText": "Adds or removes indicators to e-mail messages received from external senders in Outlook. Works on all Outlook clients/OWA", "docsDescription": "Adds or removes indicators to e-mail messages received from external senders in Outlook. You can read more about this feature on [Microsoft's Exchange Team Blog.](https://techcommunity.microsoft.com/t5/exchange-team-blog/native-external-sender-callouts-on-email-in-outlook/ba-p/2250098)", "executiveText": "Displays visual warnings in Outlook when emails come from external senders, helping employees identify potentially suspicious messages and reducing the risk of phishing attacks. This security feature makes it easier for staff to distinguish between internal and external communications.", @@ -2652,8 +3391,14 @@ "label": "Select value", "name": "standards.SpoofWarn.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] }, { @@ -2670,7 +3415,10 @@ "impactColour": "info", "addedDate": "2021-11-16", "powershellEquivalent": "Set-ExternalInOutlook –Enabled $true or $false", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -2682,8 +3430,13 @@ { "name": "standards.EnableMailTips", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (6.5.2)", "exo_mailtipsenabled"], - "appliesToTest": ["CIS_6_5_2"], + "tag": [ + "CIS M365 7.0.0 (6.5.2)", + "exo_mailtipsenabled" + ], + "appliesToTest": [ + "CIS_6_5_2" + ], "helpText": "Enables all MailTips in Outlook. MailTips are the notifications Outlook and Outlook on the web shows when an email you create, meets some requirements", "executiveText": "Enables helpful notifications in Outlook that warn users about potential email issues, such as sending to large groups, external recipients, or invalid addresses. This reduces email mistakes and improves communication efficiency by providing real-time guidance to employees.", "addedComponent": [ @@ -2700,7 +3453,10 @@ "impactColour": "info", "addedDate": "2024-01-14", "powershellEquivalent": "Set-OrganizationConfig", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -2723,8 +3479,14 @@ "label": "Select value", "name": "standards.TeamsMeetingsByDefault.state", "options": [ - { "label": "Enabled", "value": "true" }, - { "label": "Disabled", "value": "false" } + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } ] } ], @@ -2746,7 +3508,7 @@ "name": "standards.DisableViva", "cat": "Exchange Standards", "tag": [], - "helpText": "Disables the daily viva reports for all users. This standard requires the CIPP-SAM application to have the Company Administrator (Global Admin) role in the tenant. Enable this using CIPP > Advanced > Super Admin > SAM App Roles. Activate the roles with a CPV refresh.", + "helpText": "Disables the daily viva reports for all users. This standard requires the CIPP-SAM application to have the Company Administrator (Global Admin) role in the tenant. Enable this using Manage365 > Advanced > Super Admin > SAM App Roles. Activate the roles with a CPV refresh.", "docsDescription": "", "executiveText": "Disables daily Microsoft Viva Insights reports that are automatically sent to employees, reducing email volume and allowing organizations to control when and how productivity insights are shared. This can help prevent information overload while maintaining the ability to access insights when needed.", "addedComponent": [], @@ -2760,8 +3522,14 @@ { "name": "standards.RotateDKIM", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (2.1.9)", "SMB1001 (2.12)"], - "appliesToTest": ["CIS_2_1_9", "SMB1001_2_12"], + "tag": [ + "CIS M365 7.0.0 (2.1.9)", + "SMB1001 (2.12)" + ], + "appliesToTest": [ + "CIS_2_1_9", + "SMB1001_2_12" + ], "helpText": "Rotate DKIM keys that are 1024 bit to 2048 bit", "executiveText": "Upgrades email security by replacing older 1024-bit encryption keys with stronger 2048-bit keys for email authentication. This improves the organization's email security posture and helps prevent email spoofing and tampering, maintaining trust with email recipients.", "addedComponent": [], @@ -2770,7 +3538,10 @@ "impactColour": "info", "addedDate": "2023-03-14", "powershellEquivalent": "Rotate-DkimSigningConfig", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -2793,8 +3564,14 @@ "name": "standards.EnableExchangeCloudManagement.state", "label": "Cloud Management State", "options": [ - { "label": "Cloud Management", "value": true }, - { "label": "On-Premises Management", "value": false } + { + "label": "Cloud Management", + "value": true + }, + { + "label": "On-Premises Management", + "value": false + } ] } ], @@ -2803,7 +3580,10 @@ "impactColour": "info", "addedDate": "2026-03-28", "powershellEquivalent": "Set-Mailbox -Identity user@domain.com -IsExchangeCloudManaged $true or $false", - "recommendedBy": ["Microsoft", "CIPP"], + "recommendedBy": [ + "Microsoft", + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -2814,8 +3594,17 @@ { "name": "standards.AddDKIM", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (2.1.9)", "SMB1001 (2.12)"], - "appliesToTest": ["CISAMSEXO31", "CIS_2_1_9", "ORCA108", "ORCA108_1", "SMB1001_2_12"], + "tag": [ + "CIS M365 7.0.0 (2.1.9)", + "SMB1001 (2.12)" + ], + "appliesToTest": [ + "CISAMSEXO31", + "CIS_2_1_9", + "ORCA108", + "ORCA108_1", + "SMB1001_2_12" + ], "helpText": "Enables DKIM for all domains that currently support it", "executiveText": "Enables email authentication technology that digitally signs outgoing emails to verify they actually came from your organization. This prevents email spoofing, improves email deliverability, and protects the company's reputation by ensuring recipients can trust emails from your domains.", "addedComponent": [], @@ -2824,7 +3613,10 @@ "impactColour": "info", "addedDate": "2023-03-14", "powershellEquivalent": "New-DkimSigningConfig and Set-DkimSigningConfig", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -2836,8 +3628,16 @@ { "name": "standards.AddDMARCToMOERA", "cat": "Global Standards", - "tag": ["CIS M365 7.0.0 (2.1.10)", "Security", "PhishingProtection", "SMB1001 (2.12)"], - "appliesToTest": ["CIS_2_1_10", "SMB1001_2_12"], + "tag": [ + "CIS M365 7.0.0 (2.1.10)", + "Security", + "PhishingProtection", + "SMB1001 (2.12)" + ], + "appliesToTest": [ + "CIS_2_1_10", + "SMB1001_2_12" + ], "helpText": "** Remediation is not available ** Note: requires 'Domain Name Administrator' GDAP role. This should be enabled even if the MOERA (onmicrosoft.com) domains is not used for sending. Enabling this prevents email spoofing. The default value is 'v=DMARC1; p=reject;' recommended because the domain is only used within M365 and reporting is not needed. Omitting pct tag default to 100%", "docsDescription": "** Remediation is not available ** Note: requires 'Domain Name Administrator' GDAP role. Adds a DMARC record to MOERA (onmicrosoft.com) domains. This should be enabled even if the MOERA (onmicrosoft.com) domains is not used for sending. Enabling this prevents email spoofing. The default record is 'v=DMARC1; p=reject;' recommended because the domain is only used within M365 and reporting is not needed. Omitting pct tag default to 100%", "executiveText": "Implements advanced email security for Microsoft's default domain names (onmicrosoft.com) to prevent criminals from impersonating your organization. This blocks fraudulent emails that could damage your company's reputation and protects partners and customers from phishing attacks using your domain names.", @@ -2851,7 +3651,10 @@ "label": "Value", "name": "standards.AddDMARCToMOERA.RecordValue", "options": [ - { "label": "v=DMARC1; p=reject; (recommended)", "value": "v=DMARC1; p=reject;" } + { + "label": "v=DMARC1; p=reject; (recommended)", + "value": "v=DMARC1; p=reject;" + } ] } ], @@ -2860,8 +3663,13 @@ "impactColour": "info", "addedDate": "2025-06-16", "powershellEquivalent": "Portal only", - "recommendedBy": ["CIS", "Microsoft"], - "disabledFeatures": { "remediate": true } + "recommendedBy": [ + "CIS", + "Microsoft" + ], + "disabledFeatures": { + "remediate": true + } }, { "name": "standards.EnableMailboxAuditing", @@ -2875,7 +3683,12 @@ "Essential 8 (1683)", "NIST CSF 2.0 (DE.CM-09)" ], - "appliesToTest": ["CISAMSEXO131", "CIS_6_1_1", "CIS_6_1_2", "CIS_6_1_3"], + "appliesToTest": [ + "CISAMSEXO131", + "CIS_6_1_1", + "CIS_6_1_2", + "CIS_6_1_3" + ], "helpText": "Enables Mailbox auditing for all mailboxes and on tenant level. Disables audit bypass on all mailboxes. Unified Audit Log needs to be enabled for this standard to function.", "docsDescription": "Enables mailbox auditing on tenant level and for all mailboxes. Disables audit bypass on all mailboxes. By default Microsoft does not enable mailbox auditing for Resource Mailboxes, Public Folder Mailboxes and DiscoverySearch Mailboxes. Unified Audit Log needs to be enabled for this standard to function.", "executiveText": "Enables comprehensive logging of all email access and modifications across all employee mailboxes, providing detailed audit trails for security investigations and compliance requirements. This helps detect unauthorized access, data breaches, and supports regulatory compliance efforts.", @@ -2885,7 +3698,10 @@ "impactColour": "info", "addedDate": "2024-01-08", "powershellEquivalent": "Set-OrganizationConfig -AuditDisabled $false", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -2898,7 +3714,7 @@ "name": "standards.AutoArchive", "cat": "Exchange Standards", "tag": [], - "helpText": "Configures the auto-archiving threshold percentage for the tenant. When a mailbox exceeds this threshold, the oldest items are automatically moved to the archive mailbox. Archive must be enabled manually or via the CIPP standard 'Enable Online Archive for all users'. More information can be found in [Microsoft's documentation.](https://learn.microsoft.com/en-us/exchange/security-and-compliance/messaging-records-management/auto-archiving)", + "helpText": "Configures the auto-archiving threshold percentage for the tenant. When a mailbox exceeds this threshold, the oldest items are automatically moved to the archive mailbox. Archive must be enabled manually or via the Manage365 standard 'Enable Online Archive for all users'. More information can be found in [Microsoft's documentation.](https://learn.microsoft.com/en-us/exchange/security-and-compliance/messaging-records-management/auto-archiving)", "docsDescription": "Configures the auto-archiving threshold at the organization level. Auto-archiving automatically moves the oldest items from a user's primary mailbox to their archive mailbox when mailbox usage exceeds the configured threshold percentage. This prevents mail flow disruptions caused by full mailboxes. Valid range is 80-100, where 100 disables auto-archiving for the tenant. More information can be found in [Microsoft's documentation.](https://learn.microsoft.com/en-us/exchange/security-and-compliance/messaging-records-management/auto-archiving)", "executiveText": "Configures automatic archiving of mailbox items when storage approaches capacity, preventing email delivery failures due to full mailboxes. This proactive storage management ensures business continuity and reduces helpdesk tickets related to mailbox quota issues.", "addedComponent": [ @@ -2908,8 +3724,14 @@ "label": "Auto-Archiving Threshold Percentage (80-100, default 96, 100 disables)", "defaultValue": 96, "validators": { - "min": { "value": 80, "message": "Minimum value is 80" }, - "max": { "value": 100, "message": "Maximum value is 100" } + "min": { + "value": 80, + "message": "Minimum value is 80" + }, + "max": { + "value": 100, + "message": "Maximum value is 100" + } } } ], @@ -2942,8 +3764,14 @@ "label": "Select value", "name": "standards.AutoArchiveMailbox.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] } ], @@ -2974,8 +3802,14 @@ "label": "Send limit in MB (Default is 35)", "defaultValue": 35, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 150, "message": "Maximum value is 150" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 150, + "message": "Maximum value is 150" + } } }, { @@ -2984,8 +3818,14 @@ "label": "Receive Limit in MB (Default is 36)", "defaultValue": 36, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 150, "message": "Maximum value is 150" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 150, + "message": "Maximum value is 150" + } } } ], @@ -3010,7 +3850,11 @@ "helpText": "Sets the default sharing level for the default calendar, for all users", "docsDescription": "Sets the default sharing level for the default calendar for all users in the tenant. You can read about the different sharing levels [here.](https://learn.microsoft.com/en-us/powershell/module/exchange/set-mailboxfolderpermission?view=exchange-ps#-accessrights)", "executiveText": "Configures how much calendar information employees share by default with colleagues, balancing collaboration needs with privacy. This setting determines whether others can see meeting details, free/busy times, or just availability, helping optimize scheduling while protecting sensitive meeting information.", - "disabledFeatures": { "report": true, "warn": true, "remediate": false }, + "disabledFeatures": { + "report": true, + "warn": true, + "remediate": false + }, "addedComponent": [ { "type": "autoComplete", @@ -3042,7 +3886,10 @@ "label": "Non Editing Author - The user has full read access and create items. Can can delete only own items.", "value": "NonEditingAuthor" }, - { "label": "Reviewer - The user can read all items in the folder.", "value": "Reviewer" }, + { + "label": "Reviewer - The user can read all items in the folder.", + "value": "Reviewer" + }, { "label": "Contributor - The user can create items and folders.", "value": "Contributor" @@ -3055,7 +3902,10 @@ "label": "Limited Details - The user can view free/busy time within the calendar and the subject and location of appointments.", "value": "LimitedDetails" }, - { "label": "None - The user has no permissions on the folder.", "value": "none" } + { + "label": "None - The user has no permissions on the folder.", + "value": "none" + } ] } ], @@ -3076,8 +3926,12 @@ { "name": "standards.EXOOutboundSpamLimits", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (2.1.15)"], - "appliesToTest": ["CIS_2_1_15"], + "tag": [ + "CIS M365 7.0.0 (2.1.15)" + ], + "appliesToTest": [ + "CIS_2_1_15" + ], "helpText": "Configures the outbound spam recipient limits (external per hour, internal per hour, per day) and the action to take when a limit is reached. The 'Set Outbound Spam Alert e-mail' standard is recommended to configure together with this one. ", "docsDescription": "Configures the Exchange Online outbound spam recipient limits for external per hour, internal per hour, and per day, along with the action to take (e.g., BlockUser, Alert) when these limits are exceeded. This helps prevent abuse and manage email flow. Microsoft's recommendations can be found [here.](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365#eop-outbound-spam-policy-settings) The 'Set Outbound Spam Alert e-mail' standard is recommended to configure together with this one.", "executiveText": "Sets limits on how many emails employees can send per hour and per day to prevent spam and protect the organization's email reputation. When limits are exceeded, the system can alert administrators or temporarily block the user, helping detect compromised accounts or prevent abuse.", @@ -3088,8 +3942,14 @@ "label": "External Recipient Limit Per Hour", "defaultValue": 400, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 10000, "message": "Maximum value is 10000" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 10000, + "message": "Maximum value is 10000" + } } }, { @@ -3098,8 +3958,14 @@ "label": "Internal Recipient Limit Per Hour", "defaultValue": 800, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 10000, "message": "Maximum value is 10000" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 10000, + "message": "Maximum value is 10000" + } } }, { @@ -3108,8 +3974,14 @@ "label": "Daily Recipient Limit", "defaultValue": 800, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 10000, "message": "Maximum value is 10000" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 10000, + "message": "Maximum value is 10000" + } } }, { @@ -3119,8 +3991,14 @@ "name": "standards.EXOOutboundSpamLimits.ActionWhenThresholdReached", "label": "Action When Threshold Reached", "options": [ - { "label": "Alert", "value": "Alert" }, - { "label": "Block User", "value": "BlockUser" }, + { + "label": "Alert", + "value": "Alert" + }, + { + "label": "Block User", + "value": "BlockUser" + }, { "label": "Block user from sending mail for the rest of the day", "value": "BlockUserForToday" @@ -3133,7 +4011,10 @@ "impactColour": "info", "addedDate": "2025-05-13", "powershellEquivalent": "Set-HostedOutboundSpamFilterPolicy", - "recommendedBy": ["CIPP", "CIS"], + "recommendedBy": [ + "Manage365", + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -3145,8 +4026,15 @@ { "name": "standards.DisableExternalCalendarSharing", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (1.3.3)", "exo_individualsharing"], - "appliesToTest": ["CISAMSEXO62", "CIS_1_3_3", "ZTNA21803"], + "tag": [ + "CIS M365 7.0.0 (1.3.3)", + "exo_individualsharing" + ], + "appliesToTest": [ + "CISAMSEXO62", + "CIS_1_3_3", + "ZTNA21803" + ], "helpText": "Disables the ability for users to share their calendar with external users. Only for the default policy, so exclusions can be made if needed.", "docsDescription": "Disables external calendar sharing for the entire tenant. This is not a widely used feature, and it's therefore unlikely that this will impact users. Only for the default policy, so exclusions can be made if needed by making a new policy and assigning it to users.", "executiveText": "Prevents employees from sharing their calendars with external parties, protecting sensitive meeting information and internal schedules from unauthorized access. This security measure helps maintain confidentiality of business activities while still allowing internal collaboration.", @@ -3156,7 +4044,9 @@ "impactColour": "info", "addedDate": "2024-01-08", "powershellEquivalent": "Get-SharingPolicy | Set-SharingPolicy -Enabled $False", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -3179,13 +4069,23 @@ "addedDate": "2025-02-07", "powershellEquivalent": "Set-Mailbox -EmailAddresses @{add=$EmailAddress}", "recommendedBy": [], - "disabledFeatures": { "report": false, "warn": true, "remediate": false } + "disabledFeatures": { + "report": false, + "warn": true, + "remediate": false + } }, { "name": "standards.DisableAdditionalStorageProviders", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (6.5.3)", "exo_storageproviderrestricted"], - "appliesToTest": ["CIS_6_5_3", "ZTNA21817"], + "tag": [ + "CIS M365 7.0.0 (6.5.3)", + "exo_storageproviderrestricted" + ], + "appliesToTest": [ + "CIS_6_5_3", + "ZTNA21817" + ], "helpText": "Disables the ability for users to open files in Outlook on the Web, from other providers such as Box, Dropbox, Facebook, Google Drive, OneDrive Personal, etc.", "docsDescription": "Disables additional storage providers in OWA. This is to prevent users from using personal storage providers like Dropbox, Google Drive, etc. Usually this has little user impact.", "executiveText": "Prevents employees from accessing personal cloud storage services like Dropbox or Google Drive through Outlook on the web, reducing data security risks and ensuring company information stays within approved corporate systems. This helps maintain data governance and prevents accidental data leaks.", @@ -3195,7 +4095,9 @@ "impactColour": "info", "addedDate": "2024-01-17", "powershellEquivalent": "Get-OwaMailboxPolicy | Set-OwaMailboxPolicy -AdditionalStorageProvidersEnabled $False", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -3207,8 +4109,12 @@ { "name": "standards.AntiSpamSafeList", "cat": "Defender Standards", - "tag": ["CIS M365 7.0.0 (2.1.13)"], - "appliesToTest": ["CIS_2_1_13"], + "tag": [ + "CIS M365 7.0.0 (2.1.13)" + ], + "appliesToTest": [ + "CIS_2_1_13" + ], "helpText": "Sets the anti-spam connection filter policy option 'safe list' in Defender.", "docsDescription": "Sets [Microsoft's built-in 'safe list'](https://learn.microsoft.com/en-us/powershell/module/exchange/set-hostedconnectionfilterpolicy?view=exchange-ps#-enablesafelist) in the anti-spam connection filter policy, rather than setting a custom safe/block list of IPs.", "executiveText": "Enables Microsoft's pre-approved list of trusted email servers to improve email delivery from legitimate sources while maintaining spam protection. This reduces false positives where legitimate emails might be blocked while still protecting against spam and malicious emails.", @@ -3246,9 +4152,18 @@ "label": "Select value", "name": "standards.ShortenMeetings.ShortenEventScopeDefault", "options": [ - { "label": "Disabled/None", "value": "None" }, - { "label": "End early", "value": "EndEarly" }, - { "label": "Start late", "value": "StartLate" } + { + "label": "Disabled/None", + "value": "None" + }, + { + "label": "End early", + "value": "EndEarly" + }, + { + "label": "Start late", + "value": "StartLate" + } ] }, { @@ -3257,8 +4172,14 @@ "label": "Minutes to reduce short calendar events by (Default is 5)", "defaultValue": 5, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 29, "message": "Maximum value is 29" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 29, + "message": "Maximum value is 29" + } } }, { @@ -3267,8 +4188,14 @@ "label": "Minutes to reduce long calendar events by (Default is 10)", "defaultValue": 10, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 29, "message": "Maximum value is 29" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 29, + "message": "Maximum value is 29" + } } } ], @@ -3289,8 +4216,12 @@ { "name": "standards.Bookings", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (1.3.9)"], - "appliesToTest": ["CIS_1_3_9"], + "tag": [ + "CIS M365 7.0.0 (1.3.9)" + ], + "appliesToTest": [ + "CIS_1_3_9" + ], "helpText": "Sets the state of Bookings on the tenant. Bookings is a scheduling tool that allows users to book appointments with others both internal and external.", "docsDescription": "", "executiveText": "Controls whether employees can use Microsoft Bookings to create online appointment scheduling pages for internal and external clients. This feature can improve customer service and streamline appointment management, but may need to be controlled for security or business process reasons.", @@ -3301,8 +4232,14 @@ "label": "Select value", "name": "standards.Bookings.state", "options": [ - { "label": "Enabled", "value": "true" }, - { "label": "Disabled", "value": "false" } + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } ] } ], @@ -3323,8 +4260,12 @@ { "name": "standards.EXODirectSend", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (6.5.5)"], - "appliesToTest": ["CIS_6_5_5"], + "tag": [ + "CIS M365 7.0.0 (6.5.5)" + ], + "appliesToTest": [ + "CIS_6_5_5" + ], "helpText": "Sets the state of Direct Send in Exchange Online. Direct Send allows applications to send emails directly to Exchange Online mailboxes as the tenants domains, without requiring authentication.", "docsDescription": "Controls whether applications can use Direct Send to send emails directly to Exchange Online mailboxes as the tenants domains, without requiring authentication. A detailed explanation from Microsoft can be found [here.](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365)", "executiveText": "Controls whether business applications and devices (like printers or scanners) can send emails through the company's email system without authentication. While this enables convenient features like scan-to-email, it may pose security risks and should be carefully managed.", @@ -3336,8 +4277,14 @@ "label": "Select value", "name": "standards.EXODirectSend.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] } ], @@ -3357,7 +4304,10 @@ "NIST CSF 2.0 (PR.AA-05)", "NIST CSF 2.0 (PR.PS-05)" ], - "appliesToTest": ["CIS_6_3_1", "ZTNA21817"], + "appliesToTest": [ + "CIS_6_3_1", + "ZTNA21817" + ], "helpText": "Disables the ability for users to install add-ins in Outlook. This is to prevent users from installing malicious add-ins.", "docsDescription": "Disables users from being able to install add-ins in Outlook. Only admins are able to approve add-ins for the users. This is done to reduce the threat surface for data exfiltration.", "executiveText": "Prevents employees from installing third-party add-ins in Outlook without administrative approval, reducing security risks from potentially malicious extensions. This ensures only vetted and approved tools can access company email data while maintaining centralized control over email functionality.", @@ -3367,7 +4317,9 @@ "impactColour": "warning", "addedDate": "2024-02-05", "powershellEquivalent": "Get-ManagementRoleAssignment | Remove-ManagementRoleAssignment", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -3383,13 +4335,19 @@ "helpText": "Loops through all users and removes the Safe Senders list. This is to prevent SPF bypass attacks, as the Safe Senders list is not checked by SPF.", "executiveText": "Removes user-defined safe sender lists to prevent security bypasses where malicious emails could avoid spam filtering. This ensures all emails go through proper security screening, even if users have previously marked senders as 'safe', improving overall email security.", "addedComponent": [], - "disabledFeatures": { "report": true, "warn": true, "remediate": false }, + "disabledFeatures": { + "report": true, + "warn": true, + "remediate": false + }, "label": "Remove Safe Senders to prevent SPF bypass", "impact": "Medium Impact", "impactColour": "warning", "addedDate": "2023-10-26", "powershellEquivalent": "Set-MailboxJunkEmailConfiguration", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -3441,8 +4399,14 @@ "label": "Select value", "name": "standards.SendFromAlias.state", "options": [ - { "label": "Enabled", "value": "true" }, - { "label": "Disabled", "value": "false" } + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } ] } ], @@ -3451,7 +4415,9 @@ "impactColour": "warning", "addedDate": "2022-05-25", "powershellEquivalent": "Set-Mailbox", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -3475,8 +4441,14 @@ "label": "Select value", "name": "standards.DlpViaDcsEnabled.state", "options": [ - { "label": "Enabled", "value": "true" }, - { "label": "Disabled", "value": "false" } + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } ] } ], @@ -3497,8 +4469,12 @@ { "name": "standards.UserSubmissions", "cat": "Exchange Standards", - "tag": ["CIS M365 7.0.0 (8.6.1)"], - "appliesToTest": ["CIS_8_6_1"], + "tag": [ + "CIS M365 7.0.0 (8.6.1)" + ], + "appliesToTest": [ + "CIS_8_6_1" + ], "helpText": "Set the state of the spam submission button in Outlook", "docsDescription": "Set the state of the built-in Report button in Outlook. This gives the users the ability to report emails as spam or phish. When a destination email address is set, the 'Send reported items to' setting controls whether reported messages go to Microsoft and the reporting mailbox, or to the reporting mailbox only (for third-party phishing report services).", "executiveText": "Enables employees to easily report suspicious emails directly from Outlook, helping improve the organization's spam and phishing detection systems. This crowdsourced approach to security allows users to contribute to threat detection while providing valuable feedback to enhance email security filters.", @@ -3509,8 +4485,14 @@ "label": "Select value", "name": "standards.UserSubmissions.state", "options": [ - { "label": "Enabled", "value": "enable" }, - { "label": "Disabled", "value": "disable" } + { + "label": "Enabled", + "value": "enable" + }, + { + "label": "Disabled", + "value": "disable" + } ] }, { @@ -3525,8 +4507,14 @@ "label": "Send reported items to (when a destination email address is set)", "name": "standards.UserSubmissions.reportDestination", "options": [ - { "label": "Microsoft and my reporting mailbox", "value": "Both" }, - { "label": "My reporting mailbox only", "value": "Mailbox" } + { + "label": "Microsoft and my reporting mailbox", + "value": "Both" + }, + { + "label": "My reporting mailbox only", + "value": "Mailbox" + } ] } ], @@ -3553,7 +4541,10 @@ "NIST CSF 2.0 (PR.AA-01)", "SMB1001 (2.3)" ], - "appliesToTest": ["CIS_1_2_2", "SMB1001_2_3"], + "appliesToTest": [ + "CIS_1_2_2", + "SMB1001_2_3" + ], "helpText": "Blocks login for all accounts that are marked as a shared mailbox. This is Microsoft best practice to prevent direct logons to shared mailboxes.", "docsDescription": "Shared mailboxes can be directly logged into if the password is reset, this presents a security risk as do all shared login credentials. Microsoft's recommendation is to disable the user account for shared mailboxes. It would be a good idea to review the sign-in reports to establish potential impact.", "executiveText": "Prevents direct login to shared mailbox accounts (like info@company.com), ensuring they can only be accessed through authorized users' accounts. This security measure eliminates the risk of shared passwords and unauthorized access while maintaining proper access control and audit trails.", @@ -3563,12 +4554,17 @@ "impactColour": "warning", "addedDate": "2021-11-16", "powershellEquivalent": "Get-Mailbox & Update-MgUser", - "recommendedBy": ["CIS", "CIPP"] + "recommendedBy": [ + "CIS", + "Manage365" + ] }, { "name": "standards.TeamsDisableResourceAccounts", "cat": "Teams Standards", - "tag": ["NIST CSF 2.0 (PR.AA-01)"], + "tag": [ + "NIST CSF 2.0 (PR.AA-01)" + ], "helpText": "Blocks sign-in for all Teams resource accounts used by Auto Attendants and Call Queues. Microsoft's guidance is to block sign-in for resource accounts as they do not require an interactive login to function.", "docsDescription": "Teams resource accounts (the accounts backing Auto Attendants and Call Queues) do not require interactive sign-in to function. If sign-in is enabled and the password is reset, the account can be logged into directly, which presents a security risk. Microsoft's guidance is to block sign-in for these accounts. Accounts that are synced from on-premises AD are excluded, as account state is managed in the on-premises AD.", "executiveText": "Prevents direct login to the service accounts that power phone system features like Auto Attendants and Call Queues. These accounts work without anyone signing into them, so blocking sign-in removes an unnecessary attack surface while keeping the phone system fully functional.", @@ -3578,13 +4574,21 @@ "impactColour": "warning", "addedDate": "2026-07-17", "powershellEquivalent": "Get-CsOnlineApplicationInstance & Update-MgUser", - "recommendedBy": ["Microsoft", "CIPP"] + "recommendedBy": [ + "Microsoft", + "Manage365" + ] }, { "name": "standards.DisableResourceMailbox", "cat": "Exchange Standards", - "tag": ["NIST CSF 2.0 (PR.AA-01)", "SMB1001 (2.3)"], - "appliesToTest": ["SMB1001_2_3"], + "tag": [ + "NIST CSF 2.0 (PR.AA-01)", + "SMB1001 (2.3)" + ], + "appliesToTest": [ + "SMB1001_2_3" + ], "helpText": "Blocks login for all accounts that are marked as a resource mailbox and does not have a license assigned. Accounts that are synced from on-premises AD are excluded, as account state is managed in the on-premises AD.", "docsDescription": "Resource mailboxes can be directly logged into if the password is reset, this presents a security risk as do all shared login credentials. Microsoft's recommendation is to disable the user account for resource mailboxes. Accounts that are synced from on-premises AD are excluded, as account state is managed in the on-premises AD.", "executiveText": "Prevents direct login to resource mailbox accounts (like conference rooms or equipment), ensuring they can only be managed through proper administrative channels. This security measure eliminates potential unauthorized access to resource scheduling systems while maintaining proper booking functionality.", @@ -3594,7 +4598,10 @@ "impactColour": "warning", "addedDate": "2025-06-01", "powershellEquivalent": "Get-Mailbox & Update-MgUser", - "recommendedBy": ["Microsoft", "CIPP"], + "recommendedBy": [ + "Microsoft", + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -3613,7 +4620,9 @@ "CISA (MS.EXO.4.1v1)", "NIST CSF 2.0 (PR.DS-02)" ], - "appliesToTest": ["CIS_6_2_1"], + "appliesToTest": [ + "CIS_6_2_1" + ], "helpText": "Disables the ability for users to automatically forward e-mails to external recipients.", "docsDescription": "Disables the ability for users to automatically forward e-mails to external recipients. This is to prevent data exfiltration. Please check if there are any legitimate use cases for this feature before implementing, like forwarding invoices and such.", "executiveText": "Prevents employees from automatically forwarding company emails to external addresses, protecting against data leaks and unauthorized information sharing. This security measure helps maintain control over sensitive business communications while preventing both accidental and intentional data exfiltration.", @@ -3623,7 +4632,10 @@ "impactColour": "danger", "addedDate": "2024-07-26", "powershellEquivalent": "Set-HostedOutboundSpamFilterPolicy -AutoForwardingMode 'Off'", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -3635,8 +4647,12 @@ { "name": "standards.RetentionPolicyTag", "cat": "Exchange Standards", - "tag": ["SMB1001 (3.1)"], - "appliesToTest": ["SMB1001_3_1"], + "tag": [ + "SMB1001 (3.1)" + ], + "appliesToTest": [ + "SMB1001_3_1" + ], "helpText": "Creates a CIPP - Deleted Items retention policy tag that permanently deletes items in the Deleted Items folder after X days.", "docsDescription": "Creates a CIPP - Deleted Items retention policy tag that permanently deletes items in the Deleted Items folder after X days.", "executiveText": "Automatically and permanently removes deleted emails after a specified number of days, helping manage storage costs and ensuring compliance with data retention policies. This prevents accumulation of unnecessary deleted items while maintaining a reasonable recovery window for accidentally deleted emails.", @@ -3666,8 +4682,8 @@ "name": "standards.QuarantineRequestAlert", "cat": "Defender Standards", "tag": [], - "helpText": "Sets a e-mail address to alert when a User requests to release a quarantined message. Set the alert state to Removed to delete the alert rule CIPP created from the tenant.", - "docsDescription": "Sets a e-mail address to alert when a User requests to release a quarantined message. This is useful for monitoring and ensuring that the correct messages are released. Setting the alert state to Removed deletes the alert rule CIPP created from the tenant, for when the alert is no longer wanted.", + "helpText": "Sets a e-mail address to alert when a User requests to release a quarantined message. Set the alert state to Removed to delete the alert rule Manage365 created from the tenant.", + "docsDescription": "Sets a e-mail address to alert when a User requests to release a quarantined message. This is useful for monitoring and ensuring that the correct messages are released. Setting the alert state to Removed deletes the alert rule Manage365 created from the tenant, for when the alert is no longer wanted.", "executiveText": "Notifies IT administrators when employees request to release emails that were quarantined for security reasons, enabling oversight of potentially dangerous messages. This helps ensure that legitimate emails are released while maintaining security controls over suspicious content.", "addedComponent": [ { @@ -3678,8 +4694,14 @@ "label": "Alert state (blank or Enabled creates the alert, Removed deletes it)", "name": "standards.QuarantineRequestAlert.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Removed", "value": "removed" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Removed", + "value": "removed" + } ] }, { @@ -3689,7 +4711,10 @@ "condition": { "field": "standards.QuarantineRequestAlert.state", "compareType": "isNot", - "compareValue": { "label": "Removed", "value": "removed" } + "compareValue": { + "label": "Removed", + "value": "removed" + } } } ], @@ -3742,14 +4767,20 @@ "addedDate": "2025-04-07", "powershellEquivalent": "New-ProtectionAlert and Set-ProtectionAlert", "recommendedBy": [], - "requiredCapabilities": ["RMS_S_PREMIUM2"] + "requiredCapabilities": [ + "RMS_S_PREMIUM2" + ] }, { "name": "standards.SafeLinksTemplatePolicy", "label": "SafeLinks Policy Template", "cat": "Templates", "multiple": false, - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "Medium Impact", "addedDate": "2025-04-29", "helpText": "Deploy and manage SafeLinks policy templates to protect against malicious URLs in emails and Office documents.", @@ -3845,7 +4876,9 @@ "impactColour": "info", "addedDate": "2024-03-25", "powershellEquivalent": "Set-SafeLinksPolicy or New-SafeLinksPolicy", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -3909,8 +4942,14 @@ "name": "standards.AntiPhishPolicy.PhishThresholdLevel", "defaultValue": 1, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 4, "message": "Maximum value is 4" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 4, + "message": "Maximum value is 4" + } } }, { @@ -3943,8 +4982,14 @@ "label": "If the message is detected as spoof by spoof intelligence", "name": "standards.AntiPhishPolicy.AuthenticationFailAction", "options": [ - { "label": "Quarantine the message", "value": "Quarantine" }, - { "label": "Move to Junk Folder", "value": "MoveToJmf" } + { + "label": "Quarantine the message", + "value": "Quarantine" + }, + { + "label": "Move to Junk Folder", + "value": "MoveToJmf" + } ] }, { @@ -3954,8 +4999,14 @@ "label": "Quarantine policy for Spoof", "name": "standards.AntiPhishPolicy.SpoofQuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" @@ -3968,9 +5019,18 @@ "label": "If a message is detected as user impersonation", "name": "standards.AntiPhishPolicy.TargetedUserProtectionAction", "options": [ - { "label": "Move to Junk Folder", "value": "MoveToJmf" }, - { "label": "Delete the message before its delivered", "value": "Delete" }, - { "label": "Quarantine the message", "value": "Quarantine" } + { + "label": "Move to Junk Folder", + "value": "MoveToJmf" + }, + { + "label": "Delete the message before its delivered", + "value": "Delete" + }, + { + "label": "Quarantine the message", + "value": "Quarantine" + } ] }, { @@ -3980,8 +5040,14 @@ "label": "Quarantine policy for user impersonation", "name": "standards.AntiPhishPolicy.TargetedUserQuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" @@ -3994,9 +5060,18 @@ "label": "If a message is detected as domain impersonation", "name": "standards.AntiPhishPolicy.TargetedDomainProtectionAction", "options": [ - { "label": "Move to Junk Folder", "value": "MoveToJmf" }, - { "label": "Delete the message before its delivered", "value": "Delete" }, - { "label": "Quarantine the message", "value": "Quarantine" } + { + "label": "Move to Junk Folder", + "value": "MoveToJmf" + }, + { + "label": "Delete the message before its delivered", + "value": "Delete" + }, + { + "label": "Quarantine the message", + "value": "Quarantine" + } ] }, { @@ -4010,8 +5085,14 @@ "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" }, - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" } + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + } ] }, { @@ -4020,9 +5101,18 @@ "label": "If Mailbox Intelligence detects an impersonated user", "name": "standards.AntiPhishPolicy.MailboxIntelligenceProtectionAction", "options": [ - { "label": "Move to Junk Folder", "value": "MoveToJmf" }, - { "label": "Delete the message before its delivered", "value": "Delete" }, - { "label": "Quarantine the message", "value": "Quarantine" } + { + "label": "Move to Junk Folder", + "value": "MoveToJmf" + }, + { + "label": "Delete the message before its delivered", + "value": "Delete" + }, + { + "label": "Quarantine the message", + "value": "Quarantine" + } ] }, { @@ -4032,8 +5122,14 @@ "label": "Apply quarantine policy", "name": "standards.AntiPhishPolicy.MailboxIntelligenceQuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" @@ -4046,7 +5142,9 @@ "impactColour": "info", "addedDate": "2024-03-25", "powershellEquivalent": "Set-AntiPhishPolicy or New-AntiPhishPolicy", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -4065,7 +5163,12 @@ "mdo_safeattachmentpolicy", "NIST CSF 2.0 (DE.CM-09)" ], - "appliesToTest": ["CIS_2_1_4", "ORCA158", "ORCA189", "ORCA227"], + "appliesToTest": [ + "CIS_2_1_4", + "ORCA158", + "ORCA189", + "ORCA227" + ], "helpText": "This creates a Safe Attachment policy", "addedComponent": [ { @@ -4081,9 +5184,18 @@ "label": "Safe Attachment Action", "name": "standards.SafeAttachmentPolicy.SafeAttachmentAction", "options": [ - { "label": "Allow", "value": "Allow" }, - { "label": "Block", "value": "Block" }, - { "label": "DynamicDelivery", "value": "DynamicDelivery" } + { + "label": "Allow", + "value": "Allow" + }, + { + "label": "Block", + "value": "Block" + }, + { + "label": "DynamicDelivery", + "value": "DynamicDelivery" + } ] }, { @@ -4093,15 +5205,25 @@ "label": "QuarantineTag", "name": "standards.SafeAttachmentPolicy.QuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" } ] }, - { "type": "switch", "label": "Redirect", "name": "standards.SafeAttachmentPolicy.Redirect" }, + { + "type": "switch", + "label": "Redirect", + "name": "standards.SafeAttachmentPolicy.Redirect" + }, { "type": "textField", "name": "standards.SafeAttachmentPolicy.RedirectAddress", @@ -4119,7 +5241,9 @@ "impactColour": "info", "addedDate": "2024-03-25", "powershellEquivalent": "Set-SafeAttachmentPolicy or New-SafeAttachmentPolicy", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -4131,8 +5255,14 @@ { "name": "standards.AtpPolicyForO365", "cat": "Defender Standards", - "tag": ["CIS M365 7.0.0 (2.1.5)", "NIST CSF 2.0 (DE.CM-09)"], - "appliesToTest": ["CIS_2_1_5", "ORCA225"], + "tag": [ + "CIS M365 7.0.0 (2.1.5)", + "NIST CSF 2.0 (DE.CM-09)" + ], + "appliesToTest": [ + "CIS_2_1_5", + "ORCA225" + ], "helpText": "This creates a Atp policy that enables Defender for Office 365 for SharePoint, OneDrive and Microsoft Teams.", "addedComponent": [ { @@ -4148,7 +5278,9 @@ "impactColour": "info", "addedDate": "2024-03-25", "powershellEquivalent": "Set-AtpPolicyForO365", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -4161,8 +5293,14 @@ { "name": "standards.PhishingSimulations", "cat": "Defender Standards", - "tag": ["SMB1001 (1.11)", "SMB1001 (5.1)"], - "appliesToTest": ["SMB1001_1_11", "SMB1001_5_1"], + "tag": [ + "SMB1001 (1.11)", + "SMB1001 (5.1)" + ], + "appliesToTest": [ + "SMB1001_1_11", + "SMB1001_5_1" + ], "helpText": "This creates a phishing simulation policy that enables phishing simulations for the entire tenant.", "addedComponent": [ { @@ -4254,8 +5392,14 @@ "label": "FileTypeAction", "name": "standards.MalwareFilterPolicy.FileTypeAction", "options": [ - { "label": "Reject", "value": "Reject" }, - { "label": "Quarantine the message", "value": "Quarantine" } + { + "label": "Reject", + "value": "Reject" + }, + { + "label": "Quarantine the message", + "value": "Quarantine" + } ] }, { @@ -4271,8 +5415,14 @@ "label": "QuarantineTag", "name": "standards.MalwareFilterPolicy.QuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" @@ -4319,7 +5469,9 @@ "impactColour": "info", "addedDate": "2024-03-25", "powershellEquivalent": "Set-MalwareFilterPolicy or New-MalwareFilterPolicy", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -4409,8 +5561,14 @@ "name": "standards.SpamFilterPolicy.BulkThreshold", "defaultValue": 7, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 9, "message": "Maximum value is 9" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 9, + "message": "Maximum value is 9" + } } }, { @@ -4421,8 +5579,14 @@ "label": "Spam Action", "name": "standards.SpamFilterPolicy.SpamAction", "options": [ - { "label": "Quarantine the message", "value": "Quarantine" }, - { "label": "Move message to Junk Email folder", "value": "MoveToJmf" } + { + "label": "Quarantine the message", + "value": "Quarantine" + }, + { + "label": "Move message to Junk Email folder", + "value": "MoveToJmf" + } ] }, { @@ -4433,8 +5597,14 @@ "label": "Spam Quarantine Tag", "name": "standards.SpamFilterPolicy.SpamQuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" @@ -4449,8 +5619,14 @@ "label": "High Confidence Spam Action", "name": "standards.SpamFilterPolicy.HighConfidenceSpamAction", "options": [ - { "label": "Quarantine the message", "value": "Quarantine" }, - { "label": "Move message to Junk Email folder", "value": "MoveToJmf" } + { + "label": "Quarantine the message", + "value": "Quarantine" + }, + { + "label": "Move message to Junk Email folder", + "value": "MoveToJmf" + } ] }, { @@ -4461,8 +5637,14 @@ "label": "High Confidence Spam Quarantine Tag", "name": "standards.SpamFilterPolicy.HighConfidenceSpamQuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" @@ -4477,8 +5659,14 @@ "label": "Bulk Spam Action", "name": "standards.SpamFilterPolicy.BulkSpamAction", "options": [ - { "label": "Quarantine the message", "value": "Quarantine" }, - { "label": "Move message to Junk Email folder", "value": "MoveToJmf" } + { + "label": "Quarantine the message", + "value": "Quarantine" + }, + { + "label": "Move message to Junk Email folder", + "value": "MoveToJmf" + } ] }, { @@ -4489,8 +5677,14 @@ "label": "Bulk Quarantine Tag", "name": "standards.SpamFilterPolicy.BulkQuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" @@ -4505,8 +5699,14 @@ "label": "Bulk moves enabled (deliver bulk mail below the threshold to the Promotions folder - Preview)", "name": "standards.SpamFilterPolicy.BulkMovesEnabled", "options": [ - { "label": "On", "value": "On" }, - { "label": "Off", "value": "Off" } + { + "label": "On", + "value": "On" + }, + { + "label": "Off", + "value": "Off" + } ] }, { @@ -4517,8 +5717,14 @@ "label": "Phish Spam Action", "name": "standards.SpamFilterPolicy.PhishSpamAction", "options": [ - { "label": "Quarantine the message", "value": "Quarantine" }, - { "label": "Move message to Junk Email folder", "value": "MoveToJmf" } + { + "label": "Quarantine the message", + "value": "Quarantine" + }, + { + "label": "Move message to Junk Email folder", + "value": "MoveToJmf" + } ] }, { @@ -4529,8 +5735,14 @@ "label": "Phish Quarantine Tag", "name": "standards.SpamFilterPolicy.PhishQuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" @@ -4545,8 +5757,14 @@ "label": "High Confidence Phish Quarantine Tag", "name": "standards.SpamFilterPolicy.HighConfidencePhishQuarantineTag", "options": [ - { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" }, - { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }, + { + "label": "AdminOnlyAccessPolicy", + "value": "AdminOnlyAccessPolicy" + }, + { + "label": "DefaultFullAccessPolicy", + "value": "DefaultFullAccessPolicy" + }, { "label": "DefaultFullAccessWithNotificationPolicy", "value": "DefaultFullAccessWithNotificationPolicy" @@ -4661,7 +5879,11 @@ { "name": "standards.QuarantineTemplate", "cat": "Defender Standards", - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "tag": [], "helpText": "This standard creates a Custom Quarantine Policies that can be used in Anti-Spam and all MDO365 policies. Quarantine Policies can be used to specify recipients permissions, enable end-user spam notifications, and specify the release action preference", "executiveText": "Creates standardized quarantine policies that define how employees can interact with quarantined emails, including permissions to release, delete, or preview suspicious messages. This ensures consistent security handling across the organization while providing appropriate user access to manage quarantined content.", @@ -4775,7 +5997,13 @@ "addedDate": "2026-01-27", "powershellEquivalent": "Graph API", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.WindowsBackupRestore", @@ -4792,9 +6020,18 @@ "label": "Select value", "name": "standards.WindowsBackupRestore.state", "options": [ - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" }, - { "label": "Not Configured", "value": "notConfigured" } + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + }, + { + "label": "Not Configured", + "value": "notConfigured" + } ] } ], @@ -4804,7 +6041,13 @@ "addedDate": "2026-02-26", "powershellEquivalent": "Graph API", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.intuneDeviceRetirementDays", @@ -4824,8 +6067,16 @@ "impactColour": "info", "addedDate": "2023-05-19", "powershellEquivalent": "Graph API", - "recommendedBy": ["CIPP"], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "recommendedBy": [ + "Manage365" + ], + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.intuneBrandingProfile", @@ -4900,13 +6151,23 @@ "addedDate": "2024-06-20", "powershellEquivalent": "Graph API", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.IntuneComplianceSettings", "cat": "Intune Standards", - "tag": ["CIS M365 7.0.0 (4.1)"], - "appliesToTest": ["CIS_4_1"], + "tag": [ + "CIS M365 7.0.0 (4.1)" + ], + "appliesToTest": [ + "CIS_4_1" + ], "helpText": "Sets the mark devices with no compliance policy assigned as compliance/non compliant and Compliance status validity period.", "executiveText": "Configures how the system treats devices that don't have specific compliance policies and sets how often devices must check in to maintain their compliance status. This ensures proper security oversight of all corporate devices and maintains current compliance information.", "addedComponent": [ @@ -4918,8 +6179,14 @@ "name": "standards.IntuneComplianceSettings.secureByDefault", "label": "Mark devices with no compliance policy as", "options": [ - { "label": "Compliant", "value": "false" }, - { "label": "Non-Compliant", "value": "true" } + { + "label": "Compliant", + "value": "false" + }, + { + "label": "Non-Compliant", + "value": "true" + } ] }, { @@ -4928,8 +6195,14 @@ "label": "Compliance status validity period (days)", "defaultValue": 120, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 120, "message": "Maximum value is 120" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 120, + "message": "Maximum value is 120" + } } } ], @@ -4939,7 +6212,13 @@ "addedDate": "2024-11-12", "powershellEquivalent": "Graph API", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.MDMScope", @@ -4954,9 +6233,18 @@ "label": "MDM User Scope?", "type": "radio", "options": [ - { "label": "All", "value": "all" }, - { "label": "None", "value": "none" }, - { "label": "Custom Group", "value": "selected" } + { + "label": "All", + "value": "all" + }, + { + "label": "None", + "value": "none" + }, + { + "label": "Custom Group", + "value": "selected" + } ] }, { @@ -4972,13 +6260,24 @@ "addedDate": "2025-02-18", "powershellEquivalent": "Graph API", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.DefaultPlatformRestrictions", "cat": "Intune Standards", - "tag": ["CIS M365 7.0.0 (4.2)", "CISA (MS.AAD.19.1v1)"], - "appliesToTest": ["CIS_4_2"], + "tag": [ + "CIS M365 7.0.0 (4.2)", + "CISA (MS.AAD.19.1v1)" + ], + "appliesToTest": [ + "CIS_4_2" + ], "helpText": "Sets the default platform restrictions for enrolling devices into Intune, including optional minimum and maximum OS version limits per platform (Android Enterprise, Android, iOS/iPadOS and Windows). Note: Do not block personally owned if platform is blocked.", "executiveText": "Controls which types of devices (iOS, Android, Windows, macOS) and ownership models (corporate vs. personal) can be enrolled in the company's device management system. This helps maintain security standards while supporting necessary business device types and usage scenarios.", "addedComponent": [ @@ -5105,7 +6404,13 @@ "addedDate": "2025-04-01", "powershellEquivalent": "Graph API", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.MDMEnrollmentDuringRegistration", @@ -5127,7 +6432,13 @@ "addedDate": "2025-12-15", "powershellEquivalent": "Graph API", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.EnrollmentWindowsHelloForBusinessConfiguration", @@ -5142,9 +6453,18 @@ "label": "Configure Windows Hello for Business", "multiple": false, "options": [ - { "label": "Not configured", "value": "notConfigured" }, - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Not configured", + "value": "notConfigured" + }, + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] }, { @@ -5159,8 +6479,14 @@ "label": "Minimum PIN length (4-127)", "default": 4, "validators": { - "min": { "value": 4, "message": "Minimum value is 4" }, - "max": { "value": 127, "message": "Maximum value is 127" } + "min": { + "value": 4, + "message": "Minimum value is 4" + }, + "max": { + "value": 127, + "message": "Maximum value is 127" + } } }, { @@ -5169,8 +6495,14 @@ "label": "Maximum PIN length (4-127)", "default": 127, "validators": { - "min": { "value": 4, "message": "Minimum value is 4" }, - "max": { "value": 127, "message": "Maximum value is 127" } + "min": { + "value": 4, + "message": "Minimum value is 4" + }, + "max": { + "value": 127, + "message": "Maximum value is 127" + } } }, { @@ -5179,9 +6511,18 @@ "label": "Lowercase letters in PIN", "multiple": false, "options": [ - { "label": "Not allowed", "value": "disallowed" }, - { "label": "Allowed", "value": "allowed" }, - { "label": "Required", "value": "required" } + { + "label": "Not allowed", + "value": "disallowed" + }, + { + "label": "Allowed", + "value": "allowed" + }, + { + "label": "Required", + "value": "required" + } ] }, { @@ -5190,9 +6531,18 @@ "label": "Uppercase letters in PIN", "multiple": false, "options": [ - { "label": "Not allowed", "value": "disallowed" }, - { "label": "Allowed", "value": "allowed" }, - { "label": "Required", "value": "required" } + { + "label": "Not allowed", + "value": "disallowed" + }, + { + "label": "Allowed", + "value": "allowed" + }, + { + "label": "Required", + "value": "required" + } ] }, { @@ -5201,9 +6551,18 @@ "label": "Special characters in PIN", "multiple": false, "options": [ - { "label": "Not allowed", "value": "disallowed" }, - { "label": "Allowed", "value": "allowed" }, - { "label": "Required", "value": "required" } + { + "label": "Not allowed", + "value": "disallowed" + }, + { + "label": "Allowed", + "value": "allowed" + }, + { + "label": "Required", + "value": "required" + } ] }, { @@ -5230,9 +6589,18 @@ "label": "Use enhanced anti-spoofing when available", "multiple": false, "options": [ - { "label": "Not configured", "value": "notConfigured" }, - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Not configured", + "value": "notConfigured" + }, + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] }, { @@ -5247,9 +6615,18 @@ "label": "Enable enhanced sign-in security", "multiple": false, "options": [ - { "label": "Not configured", "value": "0" }, - { "label": "Enabled on capable hardware", "value": "1" }, - { "label": "Disabled on all systems", "value": "2" } + { + "label": "Not configured", + "value": "0" + }, + { + "label": "Enabled on capable hardware", + "value": "1" + }, + { + "label": "Disabled on all systems", + "value": "2" + } ] }, { @@ -5258,9 +6635,18 @@ "label": "Use security keys for sign-in", "multiple": false, "options": [ - { "label": "Not configured", "value": "notConfigured" }, - { "label": "Enabled", "value": "enabled" }, - { "label": "Disabled", "value": "disabled" } + { + "label": "Not configured", + "value": "notConfigured" + }, + { + "label": "Enabled", + "value": "enabled" + }, + { + "label": "Disabled", + "value": "disabled" + } ] } ], @@ -5270,13 +6656,27 @@ "addedDate": "2025-09-25", "powershellEquivalent": "Graph API", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.intuneDeviceReg", "cat": "Intune Standards", - "tag": ["CIS M365 7.0.0 (5.1.4.2)", "CISA (MS.AAD.17.1v1)"], - "appliesToTest": ["CIS_5_1_4_2", "ZTNA21801", "ZTNA21802", "ZTNA21837"], + "tag": [ + "CIS M365 7.0.0 (5.1.4.2)", + "CISA (MS.AAD.17.1v1)" + ], + "appliesToTest": [ + "CIS_5_1_4_2", + "ZTNA21801", + "ZTNA21802", + "ZTNA21837" + ], "helpText": "Sets the maximum number of devices that can be registered by a user. A value of 0 disables device registration by users", "executiveText": "Limits how many devices each employee can register for corporate access, preventing excessive device proliferation while accommodating legitimate business needs. This helps maintain security oversight and prevents potential abuse of device registration privileges.", "addedComponent": [ @@ -5293,13 +6693,27 @@ "addedDate": "2023-03-27", "powershellEquivalent": "Update-MgBetaPolicyDeviceRegistrationPolicy", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.intuneDeviceRegLocalAdmins", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (5.1.4.3)", "CIS M365 7.0.0 (5.1.4.4)", "SMB1001 (2.2)"], - "appliesToTest": ["CIS_5_1_4_3", "CIS_5_1_4_4", "SMB1001_2_2"], + "tag": [ + "CIS M365 7.0.0 (5.1.4.3)", + "CIS M365 7.0.0 (5.1.4.4)", + "SMB1001 (2.2)" + ], + "appliesToTest": [ + "CIS_5_1_4_3", + "CIS_5_1_4_4", + "SMB1001_2_2" + ], "helpText": "Controls whether users who register Microsoft Entra joined devices are granted local administrator rights on those devices and if Global Administrators are added as local admins.", "docsDescription": "Configures the Device Registration Policy local administrator behavior for registering users. When enabled, users who register devices are not granted local administrator rights, you can also configure if Global Administrators are added as local admins.", "executiveText": "Controls whether employees who enroll devices automatically receive local administrator access. Disabling registering-user admin rights follows least-privilege principles and reduces security risk from over-privileged endpoints.", @@ -5350,8 +6764,14 @@ { "name": "standards.intuneRestrictUserDeviceJoin", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (5.1.4.1)", "SMB1001 (2.8)"], - "appliesToTest": ["CIS_5_1_4_1", "SMB1001_2_8"], + "tag": [ + "CIS M365 7.0.0 (5.1.4.1)", + "SMB1001 (2.8)" + ], + "appliesToTest": [ + "CIS_5_1_4_1", + "SMB1001_2_8" + ], "helpText": "Controls whether users can join devices to Entra.", "docsDescription": "Configures whether users can join devices to Entra. When disabled, users are unable to Entra-join devices, which prevents them from creating new Entra-joined (cloud-managed) device identities.", "executiveText": "Controls whether employees can join their devices to the corporate Entra directory. Disabling user device join prevents unauthorized or unmanaged devices from becoming corporate-managed identities, enhancing overall security posture.", @@ -5374,7 +6794,11 @@ "name": "standards.intuneRequireMFA", "cat": "Intune Standards", "tag": [], - "appliesToTest": ["ZTNA21782", "ZTNA21796", "ZTNA21872"], + "appliesToTest": [ + "ZTNA21782", + "ZTNA21796", + "ZTNA21872" + ], "helpText": "Requires MFA for all users to register devices with Intune. This is useful when not using Conditional Access.", "executiveText": "Requires employees to use multi-factor authentication when registering devices for corporate access, adding an extra security layer to prevent unauthorized device enrollment. This helps ensure only legitimate users can connect their devices to company systems.", "label": "Require Multi-factor Authentication to register or join devices with Microsoft Entra", @@ -5387,8 +6811,12 @@ { "name": "standards.DeletedUserRentention", "cat": "SharePoint Standards", - "tag": ["SMB1001 (3.1)"], - "appliesToTest": ["SMB1001_3_1"], + "tag": [ + "SMB1001 (3.1)" + ], + "appliesToTest": [ + "SMB1001_3_1" + ], "helpText": "Sets the retention period for deleted users OneDrive to the specified period of time. The default is 30 days.", "docsDescription": "When a OneDrive user gets deleted, the personal SharePoint site is saved for selected amount of time that data can be retrieved from it.", "executiveText": "Preserves departed employees' OneDrive files for a specified period, allowing time to recover important business documents before permanent deletion. This helps prevent data loss while managing storage costs and maintaining compliance with data retention policies.", @@ -5399,18 +6827,54 @@ "name": "standards.DeletedUserRentention.Days", "label": "Retention time (Default 30 days)", "options": [ - { "label": "30 days", "value": "30" }, - { "label": "90 days", "value": "90" }, - { "label": "1 year", "value": "365" }, - { "label": "2 years", "value": "730" }, - { "label": "3 years", "value": "1095" }, - { "label": "4 years", "value": "1460" }, - { "label": "5 years", "value": "1825" }, - { "label": "6 years", "value": "2190" }, - { "label": "7 years", "value": "2555" }, - { "label": "8 years", "value": "2920" }, - { "label": "9 years", "value": "3285" }, - { "label": "10 years", "value": "3650" } + { + "label": "30 days", + "value": "30" + }, + { + "label": "90 days", + "value": "90" + }, + { + "label": "1 year", + "value": "365" + }, + { + "label": "2 years", + "value": "730" + }, + { + "label": "3 years", + "value": "1095" + }, + { + "label": "4 years", + "value": "1460" + }, + { + "label": "5 years", + "value": "1825" + }, + { + "label": "6 years", + "value": "2190" + }, + { + "label": "7 years", + "value": "2555" + }, + { + "label": "8 years", + "value": "2920" + }, + { + "label": "9 years", + "value": "3285" + }, + { + "label": "10 years", + "value": "3650" + } ] } ], @@ -5477,7 +6941,7 @@ "name": "standards.SPFileRequests", "cat": "SharePoint Standards", "tag": [], - "helpText": "Enables or disables File Requests for SharePoint and OneDrive, allowing users to create secure upload-only links. Optionally sets the maximum number of days for the link to remain active before expiring.", + "helpText": "*Requires 'Sharing Level for OneDrive and SharePoint' to be set to Anyone* Enables or disables File Requests for SharePoint and OneDrive, allowing users to create secure upload-only links. Optionally sets the maximum number of days for the link to remain active before expiring.", "docsDescription": "File Requests allow users to create secure upload-only share links where uploads are hidden from other people using the link. This creates a secure and private way for people to upload files to a folder. This feature is not enabled by default on new tenants and requires PowerShell configuration. This standard enables or disables this feature and optionally configures link expiration settings for both SharePoint and OneDrive.", "executiveText": "Enables secure file upload functionality that allows external users to submit files directly to company folders without seeing other submissions or folder contents. This provides a professional and secure way to collect documents from clients, vendors, and partners while maintaining data privacy and security.", "addedComponent": [ @@ -5492,8 +6956,14 @@ "label": "Link Expiration 1-730 Days (Optional)", "required": false, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 730, "message": "Maximum value is 730" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 730, + "message": "Maximum value is 730" + } } } ], @@ -5502,7 +6972,9 @@ "impactColour": "warning", "addedDate": "2025-07-30", "powershellEquivalent": "Set-SPOTenant -CoreRequestFilesLinkEnabled $true -OneDriveRequestFilesLinkEnabled $true -CoreRequestFilesLinkExpirationInDays 30 -OneDriveRequestFilesLinkExpirationInDays 30", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "Manage365" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5554,8 +7026,14 @@ "label": "Guest People Picker suggestions", "name": "standards.SPGuestPeoplePicker.state", "options": [ - { "label": "Show guests in the People Picker", "value": "true" }, - { "label": "Hide guests in the People Picker", "value": "false" } + { + "label": "Show guests in the People Picker", + "value": "true" + }, + { + "label": "Hide guests in the People Picker", + "value": "false" + } ] } ], @@ -5564,7 +7042,9 @@ "impactColour": "info", "addedDate": "2026-09-03", "powershellEquivalent": "Set-SPOTenant / Set-SPOSite -ShowPeoplePickerSuggestionsForGuestUsers $true or $false", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "Manage365" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5577,8 +7057,12 @@ { "name": "standards.SPAzureB2B", "cat": "SharePoint Standards", - "tag": ["CIS M365 7.0.0 (7.2.2)"], - "appliesToTest": ["CIS_7_2_2"], + "tag": [ + "CIS M365 7.0.0 (7.2.2)" + ], + "appliesToTest": [ + "CIS_7_2_2" + ], "helpText": "Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled", "executiveText": "Enables secure collaboration with external partners through SharePoint and OneDrive by integrating with Azure B2B guest access. This allows controlled sharing with external organizations while maintaining security oversight and proper access management.", "addedComponent": [], @@ -5587,7 +7071,9 @@ "impactColour": "info", "addedDate": "2024-07-09", "powershellEquivalent": "Set-SPOTenant -EnableAzureADB2BIntegration $true", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5600,8 +7086,15 @@ { "name": "standards.SPDisallowInfectedFiles", "cat": "SharePoint Standards", - "tag": ["CIS M365 7.0.0 (7.3.1)", "CISA (MS.SPO.3.1v1)", "NIST CSF 2.0 (DE.CM-09)"], - "appliesToTest": ["CIS_7_3_1", "ZTNA21817"], + "tag": [ + "CIS M365 7.0.0 (7.3.1)", + "CISA (MS.SPO.3.1v1)", + "NIST CSF 2.0 (DE.CM-09)" + ], + "appliesToTest": [ + "CIS_7_3_1", + "ZTNA21817" + ], "helpText": "Ensure Office 365 SharePoint infected files are disallowed for download", "executiveText": "Prevents employees from downloading files that have been identified as containing malware or viruses from SharePoint and OneDrive. This security measure protects against malware distribution through file sharing while maintaining access to clean, safe documents.", "addedComponent": [], @@ -5610,7 +7103,10 @@ "impactColour": "info", "addedDate": "2024-07-09", "powershellEquivalent": "Set-SPOTenant -DisallowInfectedFileDownload $true", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "Manage365" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5655,7 +7151,10 @@ "impactColour": "warning", "addedDate": "2024-07-09", "powershellEquivalent": "Set-SPOTenant -DefaultSharingLinkType Direct", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "Manage365" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5668,8 +7167,16 @@ { "name": "standards.SPExternalUserExpiration", "cat": "SharePoint Standards", - "tag": ["CIS M365 7.0.0 (7.2.9)", "CISA (MS.SPO.1.5v1)"], - "appliesToTest": ["CIS_7_2_9", "ZTNA21803", "ZTNA21804", "ZTNA21858"], + "tag": [ + "CIS M365 7.0.0 (7.2.9)", + "CISA (MS.SPO.1.5v1)" + ], + "appliesToTest": [ + "CIS_7_2_9", + "ZTNA21803", + "ZTNA21804", + "ZTNA21858" + ], "helpText": "Ensure guest access to a site or OneDrive will expire automatically", "executiveText": "Automatically expires external user access to SharePoint sites and OneDrive after a specified period, reducing security risks from forgotten or unnecessary guest accounts. This ensures external access is regularly reviewed and maintained only when actively needed.", "addedComponent": [ @@ -5679,8 +7186,14 @@ "label": "Days until expiration (Default 60)", "defaultValue": 60, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 730, "message": "Maximum value is 730" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 730, + "message": "Maximum value is 730" + } } } ], @@ -5689,7 +7202,9 @@ "impactColour": "warning", "addedDate": "2024-07-09", "powershellEquivalent": "Set-SPOTenant -ExternalUserExpireInDays 30 -ExternalUserExpirationRequired $True", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5702,8 +7217,15 @@ { "name": "standards.SPEmailAttestation", "cat": "SharePoint Standards", - "tag": ["CIS M365 7.0.0 (7.2.10)", "CISA (MS.SPO.1.6v1)"], - "appliesToTest": ["CIS_7_2_10", "ZTNA21803", "ZTNA21804"], + "tag": [ + "CIS M365 7.0.0 (7.2.10)", + "CISA (MS.SPO.1.6v1)" + ], + "appliesToTest": [ + "CIS_7_2_10", + "ZTNA21803", + "ZTNA21804" + ], "helpText": "Ensure re-authentication with verification code is restricted", "executiveText": "Requires external users to periodically re-verify their identity through email verification codes when accessing SharePoint resources, adding an extra security layer for external collaboration. This helps ensure continued legitimacy of external access over time.", "addedComponent": [ @@ -5713,8 +7235,14 @@ "label": "Require re-authentication every X Days (Default 15)", "defaultValue": 15, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 365, "message": "Maximum value is 365" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 365, + "message": "Maximum value is 365" + } } } ], @@ -5723,7 +7251,10 @@ "impactColour": "warning", "addedDate": "2024-07-09", "powershellEquivalent": "Set-SPOTenant -EmailAttestationRequired $true -EmailAttestationReAuthDays 15", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "Manage365" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5736,8 +7267,17 @@ { "name": "standards.DefaultSharingLink", "cat": "SharePoint Standards", - "tag": ["CIS M365 7.0.0 (7.2.7)", "CIS M365 7.0.0 (7.2.11)", "CISA (MS.SPO.1.4v1)"], - "appliesToTest": ["CIS_7_2_11", "CIS_7_2_7", "ZTNA21803", "ZTNA21804"], + "tag": [ + "CIS M365 7.0.0 (7.2.7)", + "CIS M365 7.0.0 (7.2.11)", + "CISA (MS.SPO.1.4v1)" + ], + "appliesToTest": [ + "CIS_7_2_11", + "CIS_7_2_7", + "ZTNA21803", + "ZTNA21804" + ], "helpText": "Configure the SharePoint default sharing link type and permission. This setting controls both the type of sharing link created by default and the permission level assigned to those links.", "docsDescription": "Sets the default sharing link type (Direct or Internal) and permission (View) in SharePoint and OneDrive. Direct sharing means links only work for specific people, while Internal sharing means links work for anyone in the organization. Setting the view permission as the default ensures that users must deliberately select the edit permission when sharing a link, reducing the risk of unintentionally granting edit privileges.", "executiveText": "Configures SharePoint default sharing links to implement the principle of least privilege for document sharing. This security measure reduces the risk of accidental data modification while maintaining collaboration functionality, requiring users to explicitly select Edit permissions when necessary. The sharing type setting controls whether links are restricted to specific recipients or available to the entire organization. This reduces the risk of accidental data exposure through link sharing.", @@ -5750,8 +7290,14 @@ "label": "Default Sharing Link Type", "name": "standards.DefaultSharingLink.SharingLinkType", "options": [ - { "label": "Direct - Only the people the user specifies", "value": "Direct" }, - { "label": "Internal - Only people in your organization", "value": "Internal" } + { + "label": "Direct - Only the people the user specifies", + "value": "Direct" + }, + { + "label": "Internal - Only people in your organization", + "value": "Internal" + } ] } ], @@ -5760,7 +7306,10 @@ "impactColour": "info", "addedDate": "2025-06-13", "powershellEquivalent": "Set-SPOTenant -DefaultSharingLinkType [Direct|Internal] -DefaultLinkPermission View", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "Manage365" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5784,8 +7333,14 @@ "label": "Add Shortcuts To OneDrive button state", "name": "standards.DisableAddShortcutsToOneDrive.state", "options": [ - { "label": "Disabled", "value": "true" }, - { "label": "Enabled", "value": "false" } + { + "label": "Disabled", + "value": "true" + }, + { + "label": "Enabled", + "value": "false" + } ] } ], @@ -5818,8 +7373,14 @@ "label": "SharePoint Sync Button state", "name": "standards.SPSyncButtonState.state", "options": [ - { "label": "Disabled", "value": "true" }, - { "label": "Enabled", "value": "false" } + { + "label": "Disabled", + "value": "true" + }, + { + "label": "Enabled", + "value": "false" + } ] } ], @@ -5847,7 +7408,11 @@ "CISA (MS.AAD.3.1v1)", "NIST CSF 2.0 (PR.IR-01)" ], - "appliesToTest": ["CIS_7_2_1", "ZTNA21776", "ZTNA21797"], + "appliesToTest": [ + "CIS_7_2_1", + "ZTNA21776", + "ZTNA21797" + ], "helpText": "Disables the ability to authenticate with SharePoint using legacy authentication methods. Any applications that use legacy authentication will need to be updated to use modern authentication.", "docsDescription": "Disables the ability for users and applications to access SharePoint via legacy basic authentication. This will likely not have any user impact, but will block systems/applications depending on basic auth or the SharePointOnlineCredentials class.", "executiveText": "Disables outdated authentication methods for SharePoint access, forcing applications and users to use modern, more secure authentication protocols. This significantly improves security by eliminating vulnerable authentication pathways while requiring updates to older applications.", @@ -5857,7 +7422,10 @@ "impactColour": "warning", "addedDate": "2024-02-05", "powershellEquivalent": "Set-SPOTenant -LegacyAuthProtocolsEnabled $false", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "Manage365" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5876,7 +7444,12 @@ "CISA (MS.AAD.14.1v1)", "CISA (MS.SPO.1.1v1)" ], - "appliesToTest": ["CIS_7_2_3", "CIS_7_2_4", "ZTNA21803", "ZTNA21804"], + "appliesToTest": [ + "CIS_7_2_3", + "CIS_7_2_4", + "ZTNA21803", + "ZTNA21804" + ], "helpText": "Sets the default sharing level for OneDrive and SharePoint. This is a tenant wide setting and overrules any settings set on the site level", "executiveText": "Defines the organization's default policy for sharing files and folders in SharePoint and OneDrive, balancing collaboration needs with security requirements. This fundamental setting determines whether employees can share with external users, anonymous links, or only internal colleagues.", "addedComponent": [ @@ -5910,7 +7483,10 @@ "impactColour": "danger", "addedDate": "2022-06-15", "powershellEquivalent": "Update-MgBetaAdminSharePointSetting", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "Manage365" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5923,8 +7499,16 @@ { "name": "standards.DisableReshare", "cat": "SharePoint Standards", - "tag": ["CIS M365 7.0.0 (7.2.5)", "CISA (MS.AAD.14.2v1)", "CISA (MS.SPO.1.2v1)"], - "appliesToTest": ["CIS_7_2_5", "ZTNA21803", "ZTNA21804"], + "tag": [ + "CIS M365 7.0.0 (7.2.5)", + "CISA (MS.AAD.14.2v1)", + "CISA (MS.SPO.1.2v1)" + ], + "appliesToTest": [ + "CIS_7_2_5", + "ZTNA21803", + "ZTNA21804" + ], "helpText": "Disables the ability for external users to share files they don't own. Sharing links can only be made for People with existing access", "docsDescription": "Disables the ability for external users to share files they don't own. Sharing links can only be made for People with existing access. This is a tenant wide setting and overrules any settings set on the site level", "executiveText": "Prevents external users from sharing company documents with additional people, maintaining control over document distribution and preventing unauthorized access expansion. This security measure ensures that external sharing remains within intended boundaries set by internal employees.", @@ -5934,7 +7518,10 @@ "impactColour": "danger", "addedDate": "2022-06-15", "powershellEquivalent": "Update-MgBetaAdminSharePointSetting", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "Manage365" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -5947,8 +7534,12 @@ { "name": "standards.DisableUserSiteCreate", "cat": "SharePoint Standards", - "tag": ["SMB1001 (2.8)"], - "appliesToTest": ["SMB1001_2_8"], + "tag": [ + "SMB1001 (2.8)" + ], + "appliesToTest": [ + "SMB1001_2_8" + ], "helpText": "Disables users from creating new SharePoint sites", "docsDescription": "Disables standard users from creating SharePoint sites, also disables the ability to fully create teams", "executiveText": "Restricts the creation of new SharePoint sites to authorized administrators, preventing uncontrolled proliferation of collaboration spaces and ensuring proper governance. This maintains organized information architecture while requiring approval for new collaborative environments.", @@ -6021,8 +7612,13 @@ { "name": "standards.unmanagedSync", "cat": "SharePoint Standards", - "tag": ["CISA (MS.SPO.2.1v1)", "NIST CSF 2.0 (PR.AA-05)"], - "appliesToTest": ["ZTNA24824"], + "tag": [ + "CISA (MS.SPO.2.1v1)", + "NIST CSF 2.0 (PR.AA-05)" + ], + "appliesToTest": [ + "ZTNA24824" + ], "helpText": "Entra P1 required. Block or limit access to SharePoint and OneDrive content from unmanaged devices (those not hybrid AD joined or compliant in Intune). These controls rely on Microsoft Entra Conditional Access policies and can take up to 24 hours to take effect.", "docsDescription": "Entra P1 required. Block or limit access to SharePoint and OneDrive content from unmanaged devices (those not hybrid AD joined or compliant in Intune). These controls rely on Microsoft Entra Conditional Access policies and can take up to 24 hours to take effect. 0 = Allow Access, 1 = Allow limited, web-only access, 2 = Block access. All information about this can be found in Microsofts documentation [here.](https://learn.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices)", "executiveText": "Restricts access to company files from personal or unmanaged devices, ensuring corporate data can only be accessed from properly secured and monitored devices. This critical security control prevents data leaks while allowing controlled access through web browsers when necessary.", @@ -6034,8 +7630,14 @@ "name": "standards.unmanagedSync.state", "label": "State", "options": [ - { "label": "Allow limited, web-only access", "value": "1" }, - { "label": "Block access", "value": "2" } + { + "label": "Allow limited, web-only access", + "value": "1" + }, + { + "label": "Block access", + "value": "2" + } ], "required": false } @@ -6045,14 +7647,30 @@ "impactColour": "danger", "addedDate": "2025-06-13", "powershellEquivalent": "Set-SPOTenant -ConditionalAccessPolicy AllowFullAccess | AllowLimitedAccess | BlockAccess", - "recommendedBy": ["CIS"], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "recommendedBy": [ + "CIS" + ], + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.sharingDomainRestriction", "cat": "SharePoint Standards", - "tag": ["CIS M365 7.0.0 (7.2.6)", "CISA (MS.AAD.14.3v1)", "CISA (MS.SPO.1.3v1)"], - "appliesToTest": ["CIS_7_2_6", "ZTNA21803", "ZTNA21804"], + "tag": [ + "CIS M365 7.0.0 (7.2.6)", + "CISA (MS.AAD.14.3v1)", + "CISA (MS.SPO.1.3v1)" + ], + "appliesToTest": [ + "CIS_7_2_6", + "ZTNA21803", + "ZTNA21804" + ], "helpText": "Restricts sharing to only users with the specified domain. This is useful for organizations that only want to share with their own domain.", "executiveText": "Controls which external domains employees can share files with, enabling secure collaboration with trusted partners while blocking sharing with unauthorized organizations. This targeted approach maintains necessary business relationships while preventing data exposure to unknown entities.", "addedComponent": [ @@ -6062,9 +7680,18 @@ "name": "standards.sharingDomainRestriction.Mode", "label": "Limit external sharing by domains", "options": [ - { "label": "Off", "value": "none" }, - { "label": "Restrict sharing to specific domains", "value": "allowList" }, - { "label": "Block sharing to specific domains", "value": "blockList" } + { + "label": "Off", + "value": "none" + }, + { + "label": "Restrict sharing to specific domains", + "value": "allowList" + }, + { + "label": "Block sharing to specific domains", + "value": "blockList" + } ] }, { @@ -6125,9 +7752,22 @@ "name": "standards.TeamsGlobalMeetingPolicy.DesignatedPresenterRoleMode", "label": "Default value of the `Who can present?`", "options": [ - { "label": "Everyone", "value": "EveryoneUserOverride" }, - { "label": "People in my organization", "value": "EveryoneInCompanyUserOverride" }, - { "label": "Only organizer", "value": "OrganizerOnlyUserOverride" } + { + "label": "Everyone", + "value": "EveryoneUserOverride" + }, + { + "label": "People in my organization", + "value": "EveryoneInCompanyUserOverride" + }, + { + "label": "Only organizer", + "value": "OrganizerOnlyUserOverride" + }, + { + "label": "People in my organization and trusted organizations", + "value": "EveryoneInSameAndFederatedCompanyUserOverride" + } ] }, { @@ -6149,7 +7789,10 @@ "label": "Who can bypass the lobby?", "helperText": "If left blank, the current value will not be changed.", "options": [ - { "label": "Only organizers and co-organizers", "value": "OrganizerOnly" }, + { + "label": "Only organizers and co-organizers", + "value": "OrganizerOnly" + }, { "label": "People in organization excluding guests", "value": "EveryoneInCompanyExcludingGuests" @@ -6158,8 +7801,14 @@ "label": "People in same or federated organizations", "value": "EveryoneInSameAndFederatedCompany" }, - { "label": "People who were invited", "value": "InvitedUsers" }, - { "label": "Everyone", "value": "Everyone" } + { + "label": "People who were invited", + "value": "InvitedUsers" + }, + { + "label": "Everyone", + "value": "Everyone" + } ] }, { @@ -6175,9 +7824,18 @@ "name": "standards.TeamsGlobalMeetingPolicy.MeetingChatEnabledType", "label": "Meeting chat policy", "options": [ - { "label": "On for everyone", "value": "Enabled" }, - { "label": "On for everyone but anonymous users", "value": "EnabledExceptAnonymous" }, - { "label": "Off for everyone", "value": "Disabled" } + { + "label": "On for everyone", + "value": "Enabled" + }, + { + "label": "On for everyone but anonymous users", + "value": "EnabledExceptAnonymous" + }, + { + "label": "Off for everyone", + "value": "Disabled" + } ] }, { @@ -6199,8 +7857,14 @@ "label": "External meeting chat", "helperText": "CIS 8.5.8 recommends Off. Leave blank to keep the tenant's current value.", "options": [ - { "label": "Off (CIS recommended)", "value": false }, - { "label": "On", "value": true } + { + "label": "Off (CIS recommended)", + "value": false + }, + { + "label": "On", + "value": true + } ] }, { @@ -6212,8 +7876,14 @@ "label": "Meeting cloud recording", "helperText": "CIS 8.5.9 recommends Off. Leave blank to keep the tenant's current value.", "options": [ - { "label": "Off (CIS recommended)", "value": false }, - { "label": "On", "value": true } + { + "label": "Off (CIS recommended)", + "value": false + }, + { + "label": "On", + "value": true + } ] } ], @@ -6222,8 +7892,16 @@ "impactColour": "info", "addedDate": "2024-11-12", "powershellEquivalent": "Set-CsTeamsMeetingPolicy -AllowAnonymousUsersToJoinMeeting $false -AllowAnonymousUsersToStartMeeting $false -AutoAdmittedUsers $AutoAdmittedUsers -AllowPSTNUsersToBypassLobby $false -MeetingChatEnabledType EnabledExceptAnonymous -DesignatedPresenterRoleMode $DesignatedPresenterRoleMode -AllowExternalParticipantGiveRequestControl $false -AllowParticipantGiveRequestControl $false -AllowExternalNonTrustedMeetingChat $false -AllowCloudRecording $false", - "recommendedBy": ["CIS"], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "recommendedBy": [ + "CIS" + ], + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.PlannerBlockTaskDelete", @@ -6284,14 +7962,26 @@ "impactColour": "info", "addedDate": "2025-10-02", "powershellEquivalent": "Set-CsTeamsMessagingConfiguration -FileTypeCheck 'Enabled' -UrlReputationCheck 'Enabled' -ReportIncorrectSecurityDetections 'Enabled'", - "recommendedBy": ["CIPP"], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "recommendedBy": [ + "Manage365" + ], + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsExternalChatWithAnyone", "cat": "Teams Standards", - "tag": ["CIS M365 7.0.0 (8.2.3)"], - "appliesToTest": ["CIS_8_2_3"], + "tag": [ + "CIS M365 7.0.0 (8.2.3)" + ], + "appliesToTest": [ + "CIS_8_2_3" + ], "helpText": "Controls whether users can start Teams chats with any email address, inviting external recipients as guests via email.", "docsDescription": "Manages the Teams messaging policy setting UseB2BInvitesToAddExternalUsers. When enabled, users can start chats with any email address and recipients receive an invitation to join the chat as guests. Disabling the setting prevents these external email chats from being created, keeping conversations limited to internal users and approved guests.", "executiveText": "Allows organizations to decide if employees can launch Microsoft Teams chats with anyone on the internet using just an email address. Disabling the feature keeps conversations inside trusted boundaries and helps prevent accidental data exposure through unexpected external invitations.", @@ -6301,8 +7991,14 @@ "name": "standards.TeamsExternalChatWithAnyone.UseB2BInvitesToAddExternalUsers", "label": "Allow chatting with anyone via email", "options": [ - { "label": "Enabled", "value": "true" }, - { "label": "Disabled", "value": "false" } + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } ], "defaultValue": "Disabled" } @@ -6312,8 +8008,16 @@ "impactColour": "info", "addedDate": "2025-11-03", "powershellEquivalent": "Set-CsTeamsMessagingPolicy -Identity Global -UseB2BInvitesToAddExternalUsers $false/$true", - "recommendedBy": ["CIPP"], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "recommendedBy": [ + "Manage365" + ], + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsEmailIntegration", @@ -6333,10 +8037,22 @@ "impactColour": "info", "addedDate": "2024-07-30", "powershellEquivalent": "Set-CsTeamsClientConfiguration -AllowEmailIntoChannel $false", - "recommendedBy": ["CIS"], - "tag": ["CIS M365 7.0.0 (8.1.2)"], - "appliesToTest": ["CIS_8_1_2"], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "recommendedBy": [ + "CIS" + ], + "tag": [ + "CIS M365 7.0.0 (8.1.2)" + ], + "appliesToTest": [ + "CIS_8_1_2" + ], + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsGuestAccess", @@ -6358,7 +8074,13 @@ "addedDate": "2025-06-03", "powershellEquivalent": "Set-CsTeamsClientConfiguration -AllowGuestUser $true", "recommendedBy": [], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsMeetingVerification", @@ -6375,7 +8097,10 @@ "label": "CAPTCHA Verification Setting", "name": "standards.TeamsMeetingVerification.CaptchaVerificationForMeetingJoin", "options": [ - { "label": "Not Required", "value": "NotRequired" }, + { + "label": "Not Required", + "value": "NotRequired" + }, { "label": "Anonymous Users and Untrusted Organizations", "value": "AnonymousUsersAndUntrustedOrganizations" @@ -6388,14 +8113,26 @@ "impactColour": "info", "addedDate": "2025-06-14", "powershellEquivalent": "Set-CsTeamsMeetingPolicy -CaptchaVerificationForMeetingJoin", - "recommendedBy": ["CIPP"], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "recommendedBy": [ + "Manage365" + ], + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsExternalFileSharing", "cat": "Teams Standards", - "tag": ["CIS M365 7.0.0 (8.1.1)"], - "appliesToTest": ["CIS_8_1_1"], + "tag": [ + "CIS M365 7.0.0 (8.1.1)" + ], + "appliesToTest": [ + "CIS_8_1_1" + ], "helpText": "Ensure external file sharing in Teams is enabled for only approved cloud storage services.", "executiveText": "Controls which external cloud storage services (like Google Drive, Dropbox, Box) employees can access through Teams, ensuring file sharing occurs only through approved and secure platforms. This helps maintain data governance while supporting necessary business integrations.", "addedComponent": [ @@ -6430,8 +8167,16 @@ "impactColour": "info", "addedDate": "2024-07-28", "powershellEquivalent": "Set-CsTeamsClientConfiguration -AllowGoogleDrive $false -AllowShareFile $false -AllowBox $false -AllowDropBox $false -AllowEgnyte $false", - "recommendedBy": ["CIS"], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "recommendedBy": [ + "CIS" + ], + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsEnrollUser", @@ -6449,8 +8194,14 @@ "name": "standards.TeamsEnrollUser.EnrollUserOverride", "label": "Voice and Face Enrollment", "options": [ - { "label": "Disabled", "value": "Disabled" }, - { "label": "Enabled", "value": "Enabled" } + { + "label": "Disabled", + "value": "Disabled" + }, + { + "label": "Enabled", + "value": "Enabled" + } ] } ], @@ -6460,13 +8211,25 @@ "addedDate": "2024-11-12", "powershellEquivalent": "Set-CsTeamsMeetingPolicy -Identity Global -EnrollUserOverride $false", "recommendedBy": [], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsExternalAccessPolicy", "cat": "Teams Standards", - "tag": ["CIS M365 7.0.0 (8.2.1)", "CIS M365 7.0.0 (8.2.2)"], - "appliesToTest": ["CIS_8_2_1", "CIS_8_2_2"], + "tag": [ + "CIS M365 7.0.0 (8.2.1)", + "CIS M365 7.0.0 (8.2.2)" + ], + "appliesToTest": [ + "CIS_8_2_1", + "CIS_8_2_2" + ], "helpText": "Sets the properties of the Global external access policy.", "docsDescription": "Sets the properties of the Global external access policy. External access policies determine whether or not your users can: 1) communicate with users who have Session Initiation Protocol (SIP) accounts with a federated organization; 2) communicate with users who are using custom applications built with Azure Communication Services; 3) access Skype for Business Server over the Internet, without having to log on to your internal network; 4) communicate with users who have SIP accounts with a public instant messaging (IM) provider such as Skype; and, 5) communicate with people who are using Teams with an account that's not managed by an organization.", "executiveText": "Defines the organization's policy for communicating with external users through Teams, including other organizations, Skype users, and unmanaged accounts. This fundamental setting determines the scope of external collaboration while maintaining security boundaries for business communications.", @@ -6498,13 +8261,24 @@ "addedDate": "2024-07-30", "powershellEquivalent": "Set-CsExternalAccessPolicy", "recommendedBy": [], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsFederationConfiguration", "cat": "Teams Standards", - "tag": ["CIS M365 7.0.0 (8.2.1)"], - "appliesToTest": ["CIS_8_2_1", "CIS_8_2_4"], + "tag": [ + "CIS M365 7.0.0 (8.2.1)" + ], + "appliesToTest": [ + "CIS_8_2_1", + "CIS_8_2_4" + ], "helpText": "Sets the properties of the Global federation configuration.", "docsDescription": "Sets the properties of the Global federation configuration. Federation configuration settings determine whether or not your users can communicate with users who have SIP accounts with a federated organization.", "executiveText": "Configures how the organization federates with external organizations for Teams communication, controlling whether employees can communicate with specific external domains or all external organizations. This setting enables secure inter-organizational collaboration while maintaining control over external communications.", @@ -6532,10 +8306,22 @@ "name": "standards.TeamsFederationConfiguration.DomainControl", "label": "Communication Mode", "options": [ - { "label": "Allow all external domains", "value": "AllowAllExternal" }, - { "label": "Block all external domains", "value": "BlockAllExternal" }, - { "label": "Allow specific external domains", "value": "AllowSpecificExternal" }, - { "label": "Block specific external domains", "value": "BlockSpecificExternal" } + { + "label": "Allow all external domains", + "value": "AllowAllExternal" + }, + { + "label": "Block all external domains", + "value": "BlockAllExternal" + }, + { + "label": "Allow specific external domains", + "value": "AllowSpecificExternal" + }, + { + "label": "Block specific external domains", + "value": "BlockSpecificExternal" + } ] }, { @@ -6546,7 +8332,10 @@ "condition": { "field": "standards.TeamsFederationConfiguration.DomainControl.value", "compareType": "isOneOf", - "compareValue": ["AllowSpecificExternal", "BlockSpecificExternal"] + "compareValue": [ + "AllowSpecificExternal", + "BlockSpecificExternal" + ] } } ], @@ -6556,7 +8345,13 @@ "addedDate": "2024-07-31", "powershellEquivalent": "Set-CsTenantFederationConfiguration", "recommendedBy": [], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsMeetingRecordingExpiration", @@ -6573,8 +8368,14 @@ "required": true, "defaultValue": 120, "validators": { - "min": { "value": -1, "message": "Minimum value is -1" }, - "max": { "value": 99999, "message": "Maximum value is 99999" } + "min": { + "value": -1, + "message": "Minimum value is -1" + }, + "max": { + "value": 99999, + "message": "Maximum value is 99999" + } } } ], @@ -6584,13 +8385,23 @@ "addedDate": "2025-04-17", "powershellEquivalent": "Set-CsTeamsMeetingPolicy -Identity Global -MeetingRecordingExpirationDays ", "recommendedBy": [], - "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] }, { "name": "standards.TeamsMessagingPolicy", "cat": "Teams Standards", - "tag": ["CIS M365 7.0.0 (8.6.1)"], - "appliesToTest": ["CIS_8_6_1"], + "tag": [ + "CIS M365 7.0.0 (8.6.1)" + ], + "appliesToTest": [ + "CIS_8_6_1" + ], "helpText": "Sets the properties of the Global messaging policy.", "docsDescription": "Sets the properties of the Global messaging policy. Messaging policies control which chat and channel messaging features are available to users in Teams.", "executiveText": "Defines what messaging capabilities employees have in Teams, including the ability to edit or delete messages, create custom emojis, and report inappropriate content. These policies help maintain professional communication standards while enabling necessary collaboration features.", @@ -6627,9 +8438,18 @@ "name": "standards.TeamsMessagingPolicy.ReadReceiptsEnabledType", "label": "Read Receipts Enabled Type", "options": [ - { "label": "User controlled", "value": "UserPreference" }, - { "label": "Turned on for everyone", "value": "Everyone" }, - { "label": "Turned off for everyone", "value": "None" } + { + "label": "User controlled", + "value": "UserPreference" + }, + { + "label": "Turned on for everyone", + "value": "Everyone" + }, + { + "label": "Turned off for everyone", + "value": "None" + } ] }, { @@ -6655,6 +8475,19 @@ "name": "standards.TeamsMessagingPolicy.AllowCommunicationComplianceEndUserReporting", "label": "Allow reporting message as inappropriate content", "defaultValue": true + }, + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "name": "standards.TeamsMessagingPolicy.AutoShareFilesInExternalChats", + "label": "Automatically share files attached in external chats", + "options": [ + { "label": "Don't change", "value": "donotconfigure" }, + { "label": "Enabled", "value": "Enabled" }, + { "label": "Disabled", "value": "Disabled" } + ], + "defaultValue": "donotconfigure" } ], "label": "Global Messaging Policy for Microsoft Teams", @@ -6663,13 +8496,79 @@ "addedDate": "2025-01-10", "powershellEquivalent": "Set-CsTeamsMessagingPolicy", "recommendedBy": [], + "requiredCapabilities": [ + "MCOSTANDARD", + "MCOEV", + "MCOIMP", + "TEAMS1", + "Teams_Room_Standard" + ] + }, + { + "name": "standards.TeamsFilesPolicy", + "cat": "Teams Standards", + "tag": [], + "helpText": "Sets the properties of the Global Teams files policy, including file sharing in external (federated) chats.", + "docsDescription": "Sets the properties of the Global Teams files policy. File sharing in external chats controls whether users can attach files in 1:1, group and meeting chats with people from other organizations. Native file entry points controls the OneDrive and SharePoint attach options in chats and channels, and SharePoint channel files tab controls the SharePoint Files tab in channels.", + "executiveText": "Controls whether employees can attach files directly in Microsoft Teams chats with people outside the organization. Microsoft is enabling this by default for all tenants, including those that had turned it off, so managing it as a standard keeps the organization's chosen external sharing posture in place.", + "addedComponent": [ + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "name": "standards.TeamsFilesPolicy.FileSharingInChatsWithExternalUsers", + "label": "File sharing in external chats", + "options": [ + { "label": "Don't change", "value": "donotconfigure" }, + { "label": "Enabled", "value": "Enabled" }, + { "label": "Disabled", "value": "Disabled" } + ], + "defaultValue": "Disabled" + }, + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "name": "standards.TeamsFilesPolicy.NativeFileEntryPoints", + "label": "OneDrive and SharePoint file entry points", + "options": [ + { "label": "Don't change", "value": "donotconfigure" }, + { "label": "Enabled", "value": "Enabled" }, + { "label": "Disabled", "value": "Disabled" } + ], + "defaultValue": "donotconfigure" + }, + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "name": "standards.TeamsFilesPolicy.SPChannelFilesTab", + "label": "SharePoint channel files tab", + "options": [ + { "label": "Don't change", "value": "donotconfigure" }, + { "label": "Enabled", "value": "Enabled" }, + { "label": "Disabled", "value": "Disabled" } + ], + "defaultValue": "donotconfigure" + } + ], + "label": "Global Files Policy for Microsoft Teams", + "impact": "Low Impact", + "impactColour": "info", + "addedDate": "2026-09-28", + "powershellEquivalent": "Set-CsTeamsFilesPolicy -Identity Global -FileSharingInChatsWithExternalUsers Disabled", + "recommendedBy": ["CIPP"], "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"] }, { "name": "standards.AutopilotStatusPage", "cat": "Device Management Standards", "tag": [], - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "helpText": "Deploy the Autopilot Status Page, which shows progress during device setup through Autopilot.", "docsDescription": "This standard allows configuration of the Autopilot Status Page, providing users with a visual representation of the progress during device setup. It includes options like timeout, logging, and retry settings.", "executiveText": "Provides employees with a visual progress indicator during automated device setup, improving the user experience when receiving new computers. This reduces IT support calls and helps ensure successful device deployment by guiding users through the setup process.", @@ -6680,8 +8579,14 @@ "label": "Timeout in minutes", "defaultValue": 60, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 1440, "message": "Maximum value is 1440" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 1440, + "message": "Maximum value is 1440" + } } }, { @@ -6738,14 +8643,28 @@ "addedDate": "2023-12-30", "impactColour": "info", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.AutopilotProfile", "cat": "Device Management Standards", - "tag": ["SMB1001 (2.2)"], - "appliesToTest": ["SMB1001_2_2"], - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "tag": [ + "SMB1001 (2.2)" + ], + "appliesToTest": [ + "SMB1001_2_2" + ], + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "helpText": "Assign the appropriate Autopilot profile to streamline device deployment.", "docsDescription": "This standard allows the deployment of Autopilot profiles to devices, including settings such as unique name templates, language options, and local admin privileges.", "addedComponent": [ @@ -6772,7 +8691,11 @@ "required": false, "name": "standards.AutopilotProfile.Languages", "label": "Languages", - "api": { "url": "/languageList.json", "labelField": "languageTag", "valueField": "tag" } + "api": { + "url": "/languageList.json", + "labelField": "languageTag", + "valueField": "tag" + } }, { "type": "switch", @@ -6834,13 +8757,27 @@ "impactColour": "info", "addedDate": "2023-12-30", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.DevicePrepProfile", "cat": "Device Management Standards", - "tag": ["autopilot", "device_prep", "enrollment"], - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "tag": [ + "autopilot", + "device_prep", + "enrollment" + ], + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "helpText": "Creates and manages a Windows Autopilot Device Preparation profile for streamlined device enrollment.", "docsDescription": "Deploys a Windows Autopilot Device Preparation profile through Intune configuration policies. This standard manages deployment mode, join type, account type, timeout, error messages, and optional device security group assignment. Optionally creates a new security group with the Intune Provisioning Client as owner.", "addedComponent": [ @@ -6862,8 +8799,14 @@ "name": "standards.DevicePrepProfile.DeploymentType", "label": "Deployment Type", "options": [ - { "label": "Single user", "value": "0" }, - { "label": "Shared", "value": "1" } + { + "label": "Single user", + "value": "0" + }, + { + "label": "Shared", + "value": "1" + } ] }, { @@ -6872,8 +8815,14 @@ "name": "standards.DevicePrepProfile.JoinType", "label": "Join Type", "options": [ - { "label": "Microsoft Entra join", "value": "0" }, - { "label": "Microsoft Entra hybrid join", "value": "1" } + { + "label": "Microsoft Entra join", + "value": "0" + }, + { + "label": "Microsoft Entra hybrid join", + "value": "1" + } ] }, { @@ -6882,8 +8831,14 @@ "name": "standards.DevicePrepProfile.AccountType", "label": "Account Type", "options": [ - { "label": "Standard user", "value": "1" }, - { "label": "Administrator", "value": "0" } + { + "label": "Standard user", + "value": "1" + }, + { + "label": "Administrator", + "value": "0" + } ] }, { @@ -6927,10 +8882,17 @@ "name": "standards.DevicePrepProfile.AssignTo", "label": "Policy Assignment", "options": [ - { "label": "Do not assign", "value": "none" }, + { + "label": "Do not assign", + "value": "none" + }, { "label": "All users (Device Preparation profiles deploy to the enrolling user, so device targets do not apply)", "value": "AllDevicesAndUsers" + }, + { + "label": "All devices", + "value": "AllDevices" } ] } @@ -6940,13 +8902,27 @@ "impactColour": "danger", "addedDate": "2026-05-25", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.AppleEnrollmentTypeProfile", "cat": "Intune Standards", - "tag": ["enrollment", "apple", "ios"], - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "tag": [ + "enrollment", + "apple", + "ios" + ], + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "helpText": "Creates and manages an Apple user-initiated enrollment type profile (such as iOS/iPadOS web based device enrollment) and keeps it assigned to the configured groups. The tenant needs an Apple MDM push certificate for the enrollment itself to function.", "executiveText": "Ensures every tenant offers the same enrollment experience for Apple devices, such as web based enrollment for personal iPhones and iPads, without engineers configuring each tenant by hand. This keeps device onboarding consistent and makes it possible to report on which tenants are correctly configured.", "docsDescription": "Deploys an Apple user-initiated enrollment type profile through deviceManagement/appleUserInitiatedEnrollmentProfiles. The profile is matched by display name; the enrollment type (web based device enrollment, account driven user enrollment, or device enrollment with Company Portal), description and group assignments are kept in sync, with a wrong assignment repaired in place. Priority is only applied when the profile is first created, because reordering is relative to the other profiles in each tenant.", @@ -6970,9 +8946,18 @@ "name": "standards.AppleEnrollmentTypeProfile.EnrollmentType", "label": "Enrollment Type", "options": [ - { "label": "Web based device enrollment", "value": "webDeviceEnrollment" }, - { "label": "Account driven user enrollment", "value": "accountDrivenUserEnrollment" }, - { "label": "Device enrollment with Company Portal", "value": "device" } + { + "label": "Web based device enrollment", + "value": "webDeviceEnrollment" + }, + { + "label": "Account driven user enrollment", + "value": "accountDrivenUserEnrollment" + }, + { + "label": "Device enrollment with Company Portal", + "value": "device" + } ] }, { @@ -6986,8 +8971,14 @@ "name": "standards.AppleEnrollmentTypeProfile.AssignTo", "label": "Profile Assignment", "options": [ - { "label": "Do not assign", "value": "none" }, - { "label": "Assign to Custom Group", "value": "customGroup" } + { + "label": "Do not assign", + "value": "none" + }, + { + "label": "Assign to Custom Group", + "value": "customGroup" + } ] }, { @@ -7002,14 +8993,24 @@ "impactColour": "warning", "addedDate": "2026-08-18", "recommendedBy": [], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.IntuneTemplate", "cat": "Templates", "label": "Intune Template", "multiple": true, - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "High Impact", "addedDate": "2023-12-30", "tag": [ @@ -7072,7 +9073,11 @@ "labelField": "Displayname", "valueField": "GUID", "showRefresh": true, - "templateView": { "title": "Intune Template", "property": "RAWJson", "type": "intune" } + "templateView": { + "title": "Intune Template", + "property": "RAWJson", + "type": "intune" + } } }, { @@ -7094,11 +9099,26 @@ "label": "Who should this template be assigned to?", "type": "radio", "options": [ - { "label": "Do not assign", "value": "On" }, - { "label": "Assign to all users", "value": "allLicensedUsers" }, - { "label": "Assign to all devices", "value": "AllDevices" }, - { "label": "Assign to all users and devices", "value": "AllDevicesAndUsers" }, - { "label": "Assign to Custom Group", "value": "customGroup" } + { + "label": "Do not assign", + "value": "On" + }, + { + "label": "Assign to all users", + "value": "allLicensedUsers" + }, + { + "label": "Assign to all devices", + "value": "AllDevices" + }, + { + "label": "Assign to all users and devices", + "value": "AllDevicesAndUsers" + }, + { + "label": "Assign to Custom Group", + "value": "customGroup" + } ] }, { @@ -7107,7 +9127,11 @@ "name": "customGroup", "label": "Enter the custom group name if you selected 'Assign to Custom Group'. Wildcards are allowed." }, - { "type": "switch", "name": "verifyAssignments", "label": "Verify policy assignments" }, + { + "type": "switch", + "name": "verifyAssignments", + "label": "Verify policy assignments" + }, { "name": "excludeGroup", "label": "Exclude Groups", @@ -7129,8 +9153,14 @@ "required": false, "helpText": "Choose whether to include or exclude devices matching the filter. Only applies if you specified a filter name above. Defaults to Include if not specified.", "options": [ - { "label": "Include - Assign to devices matching the filter", "value": "include" }, - { "label": "Exclude - Assign to devices NOT matching the filter", "value": "exclude" } + { + "label": "Include - Assign to devices matching the filter", + "value": "include" + }, + { + "label": "Exclude - Assign to devices NOT matching the filter", + "value": "exclude" + } ] }, { @@ -7140,7 +9170,10 @@ "label": "Fuzzy Match Distance (0 = exact name match only, higher values allow replacing policies with similar names based on Levenshtein distance)", "defaultValue": 0, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" } + "min": { + "value": 0, + "message": "Minimum value is 0" + } }, "warningThreshold": 5, "warningMessage": "Warning: values above 5 can match unrelated policies. Use with caution." @@ -7152,7 +9185,11 @@ "cat": "Templates", "label": "Reusable Settings Template", "multiple": true, - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "High Impact", "impactColour": "info", "addedDate": "2026-01-02", @@ -7196,7 +9233,11 @@ "labelField": "displayName", "valueField": "GUID", "showRefresh": true, - "templateView": { "title": "Reusable Settings", "property": "RawJSON", "type": "intune" } + "templateView": { + "title": "Reusable Settings", + "property": "RawJSON", + "type": "intune" + } } } ], @@ -7207,7 +9248,11 @@ "name": "standards.TransportRuleTemplate", "label": "Transport Rule Template", "cat": "Templates", - "disabledFeatures": { "report": true, "warn": true, "remediate": false }, + "disabledFeatures": { + "report": true, + "warn": true, + "remediate": false + }, "impact": "Medium Impact", "addedDate": "2023-12-30", "helpText": "Deploy transport rules to manage email flow.", @@ -7244,7 +9289,11 @@ "label": "Conditional Access Template", "cat": "Templates", "multiple": true, - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "High Impact", "addedDate": "2023-12-30", "tag": [ @@ -7311,7 +9360,9 @@ "valueField": "GUID", "queryKey": "ListCATemplates", "showRefresh": true, - "templateView": { "title": "Conditional Access Policy" } + "templateView": { + "title": "Conditional Access Policy" + } } }, { @@ -7336,10 +9387,22 @@ "label": "What state should we deploy this template in?", "type": "radio", "options": [ - { "value": "donotchange", "label": "Do not change state" }, - { "value": "Enabled", "label": "Set to enabled" }, - { "value": "Disabled", "label": "Set to disabled" }, - { "value": "enabledForReportingButNotEnforced", "label": "Set to report only" } + { + "value": "donotchange", + "label": "Do not change state" + }, + { + "value": "Enabled", + "label": "Set to enabled" + }, + { + "value": "Disabled", + "label": "Set to disabled" + }, + { + "value": "enabledForReportingButNotEnforced", + "label": "Set to report only" + } ] }, { @@ -7347,15 +9410,26 @@ "name": "DisableSD", "label": "Disable Security Defaults when deploying policy" }, - { "type": "switch", "name": "CreateGroups", "label": "Create groups if they do not exist" } + { + "type": "switch", + "name": "CreateGroups", + "label": "Create groups if they do not exist" + } ], - "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"] + "requiredCapabilities": [ + "AAD_PREMIUM", + "AAD_PREMIUM_P2" + ] }, { "name": "standards.ExchangeConnectorTemplate", "label": "Exchange Connector Template", "cat": "Templates", - "disabledFeatures": { "report": true, "warn": true, "remediate": false }, + "disabledFeatures": { + "report": true, + "warn": true, + "remediate": false + }, "impact": "Medium Impact", "addedDate": "2023-12-30", "helpText": "Deploy and manage Exchange connectors.", @@ -7388,7 +9462,11 @@ "cat": "Templates", "tag": [], "appliesToTest": [], - "disabledFeatures": { "report": true, "warn": true, "remediate": false }, + "disabledFeatures": { + "report": true, + "warn": true, + "remediate": false + }, "impact": "Medium Impact", "addedDate": "2023-12-30", "helpText": "Deploy and manage group templates.", @@ -7407,17 +9485,25 @@ } } ], - "requiredCapabilities": ["EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", "EXCHANGE_LITE"] + "requiredCapabilities": [ + "EXCHANGE_S_STANDARD", + "EXCHANGE_S_ENTERPRISE", + "EXCHANGE_LITE" + ] }, { "name": "standards.DlpCompliancePolicyTemplate", "label": "DLP Compliance Policy Template", "multi": true, "cat": "Templates", - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "Medium Impact", "addedDate": "2026-05-10", - "helpText": "Deploy Microsoft Purview DLP compliance policies from CIPP templates.", + "helpText": "Deploy Microsoft Purview DLP compliance policies from Manage365 templates.", "executiveText": "Deploys Data Loss Prevention policies from a standardized template library. Ensures consistent DLP coverage across tenants for sensitive data such as financial, identity, and regulated content.", "addedComponent": [ { @@ -7440,10 +9526,14 @@ "label": "Retention Compliance Policy Template", "multi": true, "cat": "Templates", - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "Medium Impact", "addedDate": "2026-05-10", - "helpText": "Deploy Microsoft Purview retention compliance policies from CIPP templates.", + "helpText": "Deploy Microsoft Purview retention compliance policies from Manage365 templates.", "executiveText": "Deploys retention policies that govern how long content is preserved in Exchange, SharePoint, OneDrive, and Teams. Enforces consistent compliance retention across tenants for regulatory and legal hold needs.", "addedComponent": [ { @@ -7466,10 +9556,14 @@ "label": "Sensitivity Label Template", "multi": true, "cat": "Templates", - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "Medium Impact", "addedDate": "2026-05-10", - "helpText": "Deploy Microsoft Purview sensitivity labels from CIPP templates.", + "helpText": "Deploy Microsoft Purview sensitivity labels from Manage365 templates.", "executiveText": "Deploys sensitivity labels for classification and protection of files, emails, and Microsoft 365 group content. Ensures consistent classification taxonomy and encryption settings across tenants.", "addedComponent": [ { @@ -7493,10 +9587,14 @@ "label": "Sensitive Information Type Template", "multi": true, "cat": "Templates", - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "Low Impact", "addedDate": "2026-05-10", - "helpText": "Deploy custom Microsoft Purview Sensitive Information Types from CIPP templates.", + "helpText": "Deploy custom Microsoft Purview Sensitive Information Types from Manage365 templates.", "executiveText": "Deploys custom Sensitive Information Types so DLP policies can detect organization-specific identifiers — employee IDs, project codenames, internal account numbers — across tenants consistently.", "addedComponent": [ { @@ -7519,7 +9617,11 @@ "label": "Assignment Filter Template", "multi": true, "cat": "Templates", - "disabledFeatures": { "report": true, "warn": true, "remediate": false }, + "disabledFeatures": { + "report": true, + "warn": true, + "remediate": false + }, "impact": "Medium Impact", "addedDate": "2025-10-04", "helpText": "Deploy and manage assignment filter templates.", @@ -7538,13 +9640,23 @@ } } ], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.TenantAllowBlockListTemplate", "label": "Tenant Allow/Block List Template", "cat": "Exchange Standards", - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "impact": "Medium Impact", "addedDate": "2026-04-02", "helpText": "Deploy tenant allow/block list entries from a saved template.", @@ -7587,8 +9699,14 @@ "label": "Recipient Limit", "defaultValue": 500, "validators": { - "min": { "value": 1, "message": "Minimum value is 1" }, - "max": { "value": 1000, "message": "Maximum value is 1000" } + "min": { + "value": 1, + "message": "Minimum value is 1" + }, + "max": { + "value": 1000, + "message": "Maximum value is 1000" + } } } ], @@ -7597,7 +9715,9 @@ "impactColour": "info", "addedDate": "2025-05-28", "powershellEquivalent": "Set-Mailbox -RecipientLimits", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -7609,7 +9729,10 @@ { "name": "standards.DisableExchangeOnlinePowerShell", "cat": "Exchange Standards", - "tag": ["Security", "NIST CSF 2.0 (PR.AA-05)"], + "tag": [ + "Security", + "NIST CSF 2.0 (PR.AA-05)" + ], "helpText": "Disables Exchange Online PowerShell access for non-admin users by setting the RemotePowerShellEnabled property to false for each user. This helps prevent attackers from using PowerShell to run malicious commands, access file systems, registry, and distribute ransomware throughout networks. Users with admin roles are automatically excluded.", "docsDescription": "Disables Exchange Online PowerShell access for non-admin users by setting the RemotePowerShellEnabled property to false for each user. This security measure follows a least privileged access approach, preventing potential attackers from using PowerShell to execute malicious commands, access sensitive systems, or distribute malware. Users with management roles containing 'Admin' are automatically excluded to ensure administrators retain PowerShell access to perform necessary management tasks.", "executiveText": "Restricts PowerShell access to Exchange Online for regular employees while maintaining access for administrators, significantly reducing security risks from compromised accounts. This prevents attackers from using PowerShell to execute malicious commands or distribute ransomware while preserving necessary administrative capabilities.", @@ -7618,7 +9741,10 @@ "impactColour": "warning", "addedDate": "2025-06-19", "powershellEquivalent": "Set-User -Identity $user -RemotePowerShellEnabled $false", - "recommendedBy": ["CIS", "CIPP"], + "recommendedBy": [ + "CIS", + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -7630,7 +9756,10 @@ { "name": "standards.OWAAttachmentRestrictions", "cat": "Exchange Standards", - "tag": ["Security", "NIST CSF 2.0 (PR.AA-05)"], + "tag": [ + "Security", + "NIST CSF 2.0 (PR.AA-05)" + ], "helpText": "Restricts how users on unmanaged devices can interact with email attachments in Outlook on the web and new Outlook for Windows. Prevents downloading attachments or blocks viewing them entirely.", "docsDescription": "This standard configures the OWA mailbox policy to restrict access to email attachments on unmanaged devices. Users can be prevented from downloading attachments (but can view/edit via Office Online) or blocked from seeing attachments entirely. This helps prevent data exfiltration through email attachments on devices not managed by the organization.", "executiveText": "Restricts access to email attachments on personal or unmanaged devices while allowing full functionality on corporate-managed devices. This security measure prevents data theft through email attachments while maintaining productivity for employees using approved company devices.", @@ -7640,7 +9769,10 @@ "name": "standards.OWAAttachmentRestrictions.ConditionalAccessPolicy", "label": "Attachment Restriction Policy", "options": [ - { "label": "Read Only (View/Edit via Office Online, no download)", "value": "ReadOnly" }, + { + "label": "Read Only (View/Edit via Office Online, no download)", + "value": "ReadOnly" + }, { "label": "Read Only Plus Attachments Blocked (Cannot see attachments)", "value": "ReadOnlyPlusAttachmentsBlocked" @@ -7654,7 +9786,10 @@ "impactColour": "warning", "addedDate": "2025-08-22", "powershellEquivalent": "Set-OwaMailboxPolicy -Identity \"OwaMailboxPolicy-Default\" -ConditionalAccessPolicy ReadOnlyPlusAttachmentsBlocked", - "recommendedBy": ["Microsoft Zero Trust", "CIPP"], + "recommendedBy": [ + "Microsoft Zero Trust", + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -7675,14 +9810,16 @@ "impactColour": "info", "addedDate": "2025-08-26", "powershellEquivalent": "None", - "recommendedBy": ["Microsoft"] + "recommendedBy": [ + "Microsoft" + ] }, { "name": "standards.DeployCheckChromeExtension", "cat": "Intune Standards", "tag": [], "helpText": "Deploys the Check by CyberDrain browser extension via a Win32 script app in Intune for both Chrome and Edge browsers with configurable settings. Chrome ID: benimdeioplgkhanklclahllklceahbe, Edge ID: knepjpocdagponkonnbggpcnhnaikajg", - "docsDescription": "Creates an Intune Win32 script application that writes registry keys to install and configure the Check by CyberDrain browser extension on managed devices for both Google Chrome and Microsoft Edge browsers. Uses a PowerShell detection script to enforce configuration drift — when settings change in CIPP the app is automatically redeployed.", + "docsDescription": "Creates an Intune Win32 script application that writes registry keys to install and configure the Check by CyberDrain browser extension on managed devices for both Google Chrome and Microsoft Edge browsers. Uses a PowerShell detection script to enforce configuration drift — when settings change in Manage365 the app is automatically redeployed.", "executiveText": "Automatically deploys the Check by CyberDrain browser extension across all company devices with configurable security and branding settings, ensuring consistent security monitoring and compliance capabilities. This extension provides enhanced security features and monitoring tools that help protect against threats while maintaining user productivity.", "addedComponent": [ { @@ -7712,15 +9849,15 @@ { "type": "switch", "name": "standards.DeployCheckChromeExtension.enableCippReporting", - "label": "Enable CIPP reporting", + "label": "Enable Manage365 reporting", "defaultValue": true }, { "type": "textField", "name": "standards.DeployCheckChromeExtension.customRulesUrl", "label": "Custom Rules URL", - "placeholder": "https://YOUR-CIPP-SERVER-URL/rules.json", - "helperText": "Enter the URL for custom rules if you have them. This should point to a JSON file with the same structure as the rules.json used for CIPP reporting.", + "placeholder": "https://YOUR-MANAGE365-SERVER-URL/rules.json", + "helperText": "Enter the URL for custom rules if you have them. This should point to a JSON file with the same structure as the rules.json used for Manage365 reporting.", "required": false }, { @@ -7835,11 +9972,26 @@ "label": "Who should this app be assigned to?", "type": "radio", "options": [ - { "label": "Do not assign", "value": "On" }, - { "label": "Assign to all users", "value": "allLicensedUsers" }, - { "label": "Assign to all devices", "value": "AllDevices" }, - { "label": "Assign to all users and devices", "value": "AllDevicesAndUsers" }, - { "label": "Assign to Custom Group", "value": "customGroup" } + { + "label": "Do not assign", + "value": "On" + }, + { + "label": "Assign to all users", + "value": "allLicensedUsers" + }, + { + "label": "Assign to all devices", + "value": "AllDevices" + }, + { + "label": "Assign to all users and devices", + "value": "AllDevicesAndUsers" + }, + { + "label": "Assign to Custom Group", + "value": "customGroup" + } ] }, { @@ -7854,13 +10006,23 @@ "impactColour": "info", "addedDate": "2025-09-18", "powershellEquivalent": "Add-CIPPW32ScriptApplication", - "recommendedBy": ["CIPP"], - "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"] + "recommendedBy": [ + "Manage365" + ], + "requiredCapabilities": [ + "INTUNE_A", + "MDM_Services", + "EMS", + "SCCM", + "MICROSOFTINTUNEPLAN1" + ] }, { "name": "standards.SecureScoreRemediation", "cat": "Global Standards", - "tag": ["lowimpact"], + "tag": [ + "lowimpact" + ], "helpText": "Allows bulk updating of Secure Score control profiles across tenants. Select controls and assign them to different states: Default, Ignored, Third-Party, or Reviewed.", "addedComponent": [ { @@ -7870,7 +10032,11 @@ "required": false, "name": "standards.SecureScoreRemediation.Default", "label": "Controls to set to Default", - "api": { "url": "/secureScore.json", "labelField": "title", "valueField": "id" } + "api": { + "url": "/secureScore.json", + "labelField": "title", + "valueField": "id" + } }, { "type": "autoComplete", @@ -7879,7 +10045,11 @@ "required": false, "name": "standards.SecureScoreRemediation.Ignored", "label": "Controls to set to Ignored", - "api": { "url": "/secureScore.json", "labelField": "title", "valueField": "id" } + "api": { + "url": "/secureScore.json", + "labelField": "title", + "valueField": "id" + } }, { "type": "autoComplete", @@ -7888,7 +10058,11 @@ "required": false, "name": "standards.SecureScoreRemediation.ThirdParty", "label": "Controls to set to Third-Party", - "api": { "url": "/secureScore.json", "labelField": "title", "valueField": "id" } + "api": { + "url": "/secureScore.json", + "labelField": "title", + "valueField": "id" + } }, { "type": "autoComplete", @@ -7897,7 +10071,11 @@ "creatable": true, "name": "standards.SecureScoreRemediation.Reviewed", "label": "Controls to set to Reviewed", - "api": { "url": "/secureScore.json", "labelField": "title", "valueField": "id" } + "api": { + "url": "/secureScore.json", + "labelField": "title", + "valueField": "id" + } } ], "label": "Update Secure Score Control Profiles", @@ -7909,7 +10087,11 @@ { "name": "standards.ColleagueImpersonationAlert", "cat": "Exchange Standards", - "tag": ["Exchange", "Security", "Transport Rules"], + "tag": [ + "Exchange", + "Security", + "Transport Rules" + ], "helpText": "Creates/updates 5x Exchange Online transport rules (A-E, F-J, K-O, P-T, U-Z) that prepend an HTML disclaimer banner to inbound emails where the sender display name matches a mailbox in the organisation. Accepted tenant domains are always exempt automatically. Inactive users are removed and enabled users are added. Any manually configured sender or domain exemptions already present on existing rules are preserved.", "docsDescription": "Creates five Exchange Online transport rules grouped by the first letter of user display names (A-E, F-J, K-O, P-T, U-Z). Each rule fires when an external sender's From header matches a display name in that group, prepends a configurable HTML warning banner, and skips emails from accepted organisational domains. Any manually configured sender or domain exemptions on existing rules are preserved when the standard runs. The disclaimer HTML is fully customisable via the standard settings.", "executiveText": "Protects staff from display-name impersonation attacks by injecting a visible warning banner on emails that appear to come from a colleague but originate externally. Rules are maintained automatically across all letter groups and updated whenever the standard runs.", @@ -7954,7 +10136,10 @@ { "name": "standards.DefenderCompliancePolicy", "cat": "Defender Standards", - "tag": ["defender_mde_connector", "defender_intune_compliance"], + "tag": [ + "defender_mde_connector", + "defender_intune_compliance" + ], "helpText": "Configures the Microsoft Defender for Endpoint connector with Intune, enabling compliance evaluation for mobile and desktop platforms (Android, iOS, macOS, Windows). Controls which platforms connect to MDE and whether devices are blocked when partner data is missing.", "docsDescription": "Configures the Microsoft Defender for Endpoint mobile threat defense connector with Intune. This enables compliance evaluation across platforms (Android, iOS/iPadOS, macOS, Windows) and controls settings like blocking unsupported OS versions, requiring partner data for compliance, and enabling mobile application management. The connector must be enabled before platform-specific compliance policies can evaluate device risk from MDE.", "executiveText": "Establishes the critical link between Microsoft Defender for Endpoint and Intune, enabling security risk data from MDE to be used in device compliance policies. This ensures that only devices meeting your organization's security standards can access corporate resources, providing a foundational layer of Zero Trust security across all platforms.", @@ -8142,7 +10327,9 @@ "impactColour": "danger", "addedDate": "2026-04-28", "powershellEquivalent": "Portal only", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "Manage365" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -8165,7 +10352,9 @@ "impactColour": "info", "addedDate": "2026-04-28", "powershellEquivalent": "Set-SPOTenant -DisableSharePointStoreAccess $true", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "Manage365" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -8188,7 +10377,9 @@ "impactColour": "danger", "addedDate": "2026-04-28", "powershellEquivalent": "Set-OrganizationConfig -EwsEnabled $false", - "recommendedBy": ["CIPP"], + "recommendedBy": [ + "Manage365" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -8201,8 +10392,8 @@ "name": "standards.EWSAllowedAppIds", "cat": "Exchange Standards", "tag": [], - "helpText": "Adds the selected applications to the Exchange Online EWS app allow list (EwsAllowedAppIDs) and sets EwsEnabled to true. Apps already on the list are kept, and known-malicious apps are never added. Do not use together with the \"Disable Exchange Web Services\" standard on the same tenant: they set EwsEnabled to opposite values. Once CIPP writes the list, Microsoft stops auto-populating it for that tenant, so include every app the tenant needs (check the EWS usage report in the Microsoft 365 admin center). Changes can take up to 24 hours to apply. Keep \"Include the dedicated Exchange hybrid app\" on for hybrid organisations so Free/Busy and MailTips keep working.", - "docsDescription": "When EWS is enabled, Exchange Online only allows EWS access from the application IDs on the organization's EwsAllowedAppIDs list, and an empty list blocks all EWS. Microsoft populates that list from recent usage only while the admin has never set it, so the list CIPP writes must be complete. This standard reads the current list and adds the selected presets, the custom application IDs (tenant variables are supported, invalid IDs are skipped with a warning) and, optionally, every app that holds the Exchange Online full_access_as_app application permission or a delegated EWS permission, plus the dedicated Exchange hybrid app (ExchangeServerApp-*) that hybrid Free/Busy, MailTips, profile photos and archive moves depend on. IDs already on the list are never removed; the only exception is known-malicious apps (CIPP's curated list), which are removed only when that option is enabled and are reported as drift otherwise. Known-malicious apps are never added. This conflicts with the \"Disable Exchange Web Services\" standard. Changes can take up to 24 hours to take effect. See Microsoft's guidance on the deprecation of EWS in Exchange Online: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-ews-exchange-online", + "helpText": "Adds the selected applications to the Exchange Online EWS app allow list (EwsAllowedAppIDs) and sets EwsEnabled to true. Apps already on the list are kept, and known-malicious apps are never added. Do not use together with the \"Disable Exchange Web Services\" standard on the same tenant: they set EwsEnabled to opposite values. Once Manage365 writes the list, Microsoft stops auto-populating it for that tenant, so include every app the tenant needs (check the EWS usage report in the Microsoft 365 admin center). Changes can take up to 24 hours to apply. Keep \"Include the dedicated Exchange hybrid app\" on for hybrid organisations so Free/Busy and MailTips keep working.", + "docsDescription": "When EWS is enabled, Exchange Online only allows EWS access from the application IDs on the organization's EwsAllowedAppIDs list, and an empty list blocks all EWS. Microsoft populates that list from recent usage only while the admin has never set it, so the list Manage365 writes must be complete. This standard reads the current list and adds the selected presets, the custom application IDs (tenant variables are supported, invalid IDs are skipped with a warning) and, optionally, every app that holds the Exchange Online full_access_as_app application permission or a delegated EWS permission, plus the dedicated Exchange hybrid app (ExchangeServerApp-*) that hybrid Free/Busy, MailTips, profile photos and archive moves depend on. IDs already on the list are never removed; the only exception is known-malicious apps (Manage365's curated list), which are removed only when that option is enabled and are reported as drift otherwise. Known-malicious apps are never added. This conflicts with the \"Disable Exchange Web Services\" standard. Changes can take up to 24 hours to take effect. See Microsoft's guidance on the deprecation of EWS in Exchange Online: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-ews-exchange-online", "executiveText": "Keeps the business applications that still rely on Exchange Web Services working as Microsoft retires unrestricted EWS access, by maintaining the approved-application list for each tenant. Existing approvals are preserved and applications known to be used in attacks are never approved.", "addedComponent": [ { @@ -8524,8 +10715,12 @@ { "name": "standards.EnforcePrivateGroups", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (1.2.1)"], - "appliesToTest": ["CIS_1_2_1"], + "tag": [ + "CIS M365 7.0.0 (1.2.1)" + ], + "appliesToTest": [ + "CIS_1_2_1" + ], "helpText": "Sets all public Microsoft 365 groups to private automatically. Groups can be excluded by display name keyword.", "docsDescription": "Ensures only organisation-managed or approved public groups exist by automatically switching public Microsoft 365 (Unified) groups to private visibility. Groups whose display name matches any of the configured exclusion keywords are left unchanged. This aligns with CIS M365 7.0.0 benchmark control 1.2.1.", "executiveText": "Enforces private visibility on all Microsoft 365 groups to prevent unauthorised external access to group resources such as Teams, SharePoint sites, and Planner boards. Approved public groups can be excluded by name, ensuring governance while retaining flexibility for intentionally public collaboration spaces.", @@ -8544,7 +10739,9 @@ "impactColour": "warning", "addedDate": "2026-05-06", "powershellEquivalent": "Update-MgGroup -GroupId -Visibility Private", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "SHAREPOINTWAC", "SHAREPOINTSTANDARD", @@ -8558,8 +10755,12 @@ { "name": "standards.EmptyFilterIPAllowList", "cat": "Defender Standards", - "tag": ["CIS M365 7.0.0 (2.1.12)"], - "appliesToTest": ["CIS_2_1_12"], + "tag": [ + "CIS M365 7.0.0 (2.1.12)" + ], + "appliesToTest": [ + "CIS_2_1_12" + ], "helpText": "Ensures the connection filter IP allow list is not used. IPs on this list bypass spam, spoof, and authentication checks.", "docsDescription": "IPs on the connection filter allow list bypass spam, spoof, and authentication checks. CIS recommends keeping this list empty to ensure all inbound email is properly scanned. This standard checks that the IPAllowList on the Default hosted connection filter policy is empty and can remediate by clearing it.", "executiveText": "Ensures the Exchange Online connection filter IP allow list is empty, preventing any IP addresses from bypassing spam filtering, spoofing checks, and sender authentication. Keeping this list empty ensures all inbound email undergoes full security scanning, reducing the risk of phishing and malware delivery through trusted-but-compromised sources.", @@ -8569,7 +10770,9 @@ "impactColour": "warning", "addedDate": "2026-05-06", "powershellEquivalent": "Set-HostedConnectionFilterPolicy -Identity Default -IPAllowList @()", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -8581,8 +10784,12 @@ { "name": "standards.TeamsZAP", "cat": "Defender Standards", - "tag": ["CIS M365 7.0.0 (2.4.4)"], - "appliesToTest": ["CIS_2_4_4"], + "tag": [ + "CIS M365 7.0.0 (2.4.4)" + ], + "appliesToTest": [ + "CIS_2_4_4" + ], "helpText": "Ensures Zero-hour auto purge (ZAP) is enabled for Microsoft Teams, automatically removing malicious messages after delivery.", "docsDescription": "Zero-hour auto purge (ZAP) for Microsoft Teams retroactively detects and neutralises malicious messages that have already been delivered in Teams chats. Enabling ZAP ensures that phishing, malware, and high confidence phishing messages are automatically purged even after initial delivery, aligning with CIS M365 7.0.0 benchmark control 2.4.4.", "executiveText": "Enables Zero-hour auto purge for Microsoft Teams to automatically detect and remove malicious messages after delivery. This provides an additional layer of protection against phishing and malware that may bypass initial scanning, ensuring threats are neutralised even after they reach users.", @@ -8592,7 +10799,9 @@ "impactColour": "info", "addedDate": "2026-05-06", "powershellEquivalent": "Set-TeamsProtectionPolicy -Identity 'Teams Protection Policy' -ZapEnabled $true", - "recommendedBy": ["CIS"], + "recommendedBy": [ + "CIS" + ], "requiredCapabilities": [ "EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", @@ -8604,8 +10813,12 @@ { "name": "standards.CollaborationDomainRestriction", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (5.1.6.1)"], - "appliesToTest": ["CIS_5_1_6_1"], + "tag": [ + "CIS M365 7.0.0 (5.1.6.1)" + ], + "appliesToTest": [ + "CIS_5_1_6_1" + ], "helpText": "Restricts B2B collaboration invitations to a specified list of allowed domains. If no domains are provided, the standard will alert and report on whether any domain restrictions are currently configured.", "docsDescription": "By default, Microsoft Entra ID allows collaboration invitations to be sent to any external domain. CIS recommends restricting B2B collaboration invitations to only approved domains to reduce the risk of data exfiltration and unauthorized access. This standard checks the B2B management policy for an allow list of domains and can remediate by setting the allowed domains list.", "executiveText": "Restricts external collaboration invitations to approved domains only, preventing users from sharing data with unapproved external organizations. This reduces the risk of data exfiltration and ensures that collaboration occurs only with trusted business partners.", @@ -8623,14 +10836,16 @@ "impactColour": "warning", "addedDate": "2026-05-06", "powershellEquivalent": "Graph API PATCH https://graph.microsoft.com/beta/policies/b2bManagementPolicies/default", - "recommendedBy": ["CIS"] + "recommendedBy": [ + "CIS" + ] }, { "name": "standards.IntuneAppTemplateDeploy", "cat": "Intune Standards", "tag": [], "helpText": "Deploys selected Intune application templates to the tenant. Supports WinGet/Store apps, Office apps, Chocolatey apps, Win32 script apps, and MSP apps.", - "docsDescription": "Uses CIPP Intune Application Templates to deploy applications across tenants as a standard. Each template can contain multiple applications of different types which will be queued for deployment.", + "docsDescription": "Uses Manage365 Intune Application Templates to deploy applications across tenants as a standard. Each template can contain multiple applications of different types which will be queued for deployment.", "executiveText": "Automatically deploys approved Intune applications across all managed tenants, ensuring consistent software availability and reducing manual deployment overhead. Supports WinGet, Office, Chocolatey, Win32, and MSP application types.", "addedComponent": [ { @@ -8644,7 +10859,9 @@ "labelField": "displayName", "valueField": "GUID", "queryKey": "StdIntuneAppTemplateList", - "templateView": { "title": "Application Template" } + "templateView": { + "title": "Application Template" + } } } ], @@ -8661,7 +10878,11 @@ "tag": [], "beta": true, "deprecated": true, - "disabledFeatures": { "report": false, "warn": false, "remediate": false }, + "disabledFeatures": { + "report": false, + "warn": false, + "remediate": false + }, "helpText": "Deploys a Windows Autopatch group with configurable deployment ring settings for quality updates, feature updates, Edge, and Office.", "docsDescription": "Creates or updates a Windows Autopatch deployment group with Test and Last deployment rings. Configures quality update deferrals, feature update targeting, Edge and Office update channels per ring. Uses the Autopatch API proxy to manage the group configuration.", "executiveText": "Configures Windows Autopatch deployment groups to manage update delivery across devices. Autopatch automates Windows quality updates, feature updates, Edge, and Office updates using deployment rings with configurable deferrals and deadlines.", @@ -8680,8 +10901,14 @@ "label": "Target OS Version", "required": true, "options": [ - { "label": "Windows 11, version 24H2", "value": "Windows 11, version 24H2" }, - { "label": "Windows 11, version 25H2", "value": "Windows 11, version 25H2" } + { + "label": "Windows 11, version 24H2", + "value": "Windows 11, version 24H2" + }, + { + "label": "Windows 11, version 25H2", + "value": "Windows 11, version 25H2" + } ], "defaultValue": "Windows 11, version 25H2" }, @@ -8703,8 +10930,14 @@ "label": "Test Ring - Quality Update Deferral (days)", "defaultValue": 0, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } }, { @@ -8713,8 +10946,14 @@ "label": "Test Ring - Quality Update Deadline (days)", "defaultValue": 1, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } }, { @@ -8723,8 +10962,14 @@ "label": "Test Ring - Quality Update Grace Period (days)", "defaultValue": 1, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 7, "message": "Maximum value is 7" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 7, + "message": "Maximum value is 7" + } } }, { @@ -8733,8 +10978,14 @@ "label": "Test Ring - Feature Update Deferral (days)", "defaultValue": 0, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 365, "message": "Maximum value is 365" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 365, + "message": "Maximum value is 365" + } } }, { @@ -8743,8 +10994,14 @@ "label": "Test Ring - Feature Update Deadline (days)", "defaultValue": 5, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } }, { @@ -8753,9 +11010,18 @@ "name": "standards.AutopatchGroup.TestEdgeChannel", "label": "Test Ring - Edge Update Channel", "options": [ - { "label": "Stable", "value": "Stable" }, - { "label": "Beta", "value": "Beta" }, - { "label": "Dev", "value": "Dev" } + { + "label": "Stable", + "value": "Stable" + }, + { + "label": "Beta", + "value": "Beta" + }, + { + "label": "Dev", + "value": "Dev" + } ], "defaultValue": "Beta" }, @@ -8765,9 +11031,18 @@ "name": "standards.AutopatchGroup.TestOfficeChannel", "label": "Test Ring - Office Update Channel", "options": [ - { "label": "Current", "value": "Current" }, - { "label": "Monthly Enterprise", "value": "MonthlyEnterprise" }, - { "label": "Semi-Annual Enterprise", "value": "SemiAnnual" } + { + "label": "Current", + "value": "Current" + }, + { + "label": "Monthly Enterprise", + "value": "MonthlyEnterprise" + }, + { + "label": "Semi-Annual Enterprise", + "value": "SemiAnnual" + } ], "defaultValue": "MonthlyEnterprise" }, @@ -8777,8 +11052,14 @@ "label": "Test Ring - Driver & Firmware Deferral (days)", "defaultValue": 0, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } }, { @@ -8787,8 +11068,14 @@ "label": "Last Ring - Quality Update Deferral (days)", "defaultValue": 1, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } }, { @@ -8797,8 +11084,14 @@ "label": "Last Ring - Quality Update Deadline (days)", "defaultValue": 2, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } }, { @@ -8807,8 +11100,14 @@ "label": "Last Ring - Quality Update Grace Period (days)", "defaultValue": 2, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 7, "message": "Maximum value is 7" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 7, + "message": "Maximum value is 7" + } } }, { @@ -8817,8 +11116,14 @@ "label": "Last Ring - Feature Update Deferral (days)", "defaultValue": 0, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 365, "message": "Maximum value is 365" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 365, + "message": "Maximum value is 365" + } } }, { @@ -8827,8 +11132,14 @@ "label": "Last Ring - Feature Update Deadline (days)", "defaultValue": 5, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } }, { @@ -8837,9 +11148,18 @@ "name": "standards.AutopatchGroup.LastEdgeChannel", "label": "Last Ring - Edge Update Channel", "options": [ - { "label": "Stable", "value": "Stable" }, - { "label": "Beta", "value": "Beta" }, - { "label": "Dev", "value": "Dev" } + { + "label": "Stable", + "value": "Stable" + }, + { + "label": "Beta", + "value": "Beta" + }, + { + "label": "Dev", + "value": "Dev" + } ], "defaultValue": "Stable" }, @@ -8849,9 +11169,18 @@ "name": "standards.AutopatchGroup.LastOfficeChannel", "label": "Last Ring - Office Update Channel", "options": [ - { "label": "Current", "value": "Current" }, - { "label": "Monthly Enterprise", "value": "MonthlyEnterprise" }, - { "label": "Semi-Annual Enterprise", "value": "SemiAnnual" } + { + "label": "Current", + "value": "Current" + }, + { + "label": "Monthly Enterprise", + "value": "MonthlyEnterprise" + }, + { + "label": "Semi-Annual Enterprise", + "value": "SemiAnnual" + } ], "defaultValue": "MonthlyEnterprise" }, @@ -8861,8 +11190,14 @@ "label": "Last Ring - Office Update Deferral (days)", "defaultValue": 1, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } }, { @@ -8871,8 +11206,14 @@ "label": "Last Ring - Office Update Deadline (days)", "defaultValue": 2, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } }, { @@ -8881,8 +11222,14 @@ "label": "Last Ring - Driver & Firmware Deferral (days)", "defaultValue": 1, "validators": { - "min": { "value": 0, "message": "Minimum value is 0" }, - "max": { "value": 30, "message": "Maximum value is 30" } + "min": { + "value": 0, + "message": "Minimum value is 0" + }, + "max": { + "value": 30, + "message": "Maximum value is 30" + } } } ], @@ -8907,9 +11254,18 @@ "name": "standards.FIDO2PasskeyProfiles.PasskeyTypes", "label": "Allowed Passkey Types", "options": [ - { "label": "Device-bound only", "value": "deviceBound" }, - { "label": "Synced only", "value": "synced" }, - { "label": "Both device-bound and synced", "value": "deviceBound,synced" } + { + "label": "Device-bound only", + "value": "deviceBound" + }, + { + "label": "Synced only", + "value": "synced" + }, + { + "label": "Both device-bound and synced", + "value": "deviceBound,synced" + } ], "required": true }, @@ -8919,8 +11275,14 @@ "name": "standards.FIDO2PasskeyProfiles.AttestationEnforcement", "label": "Attestation Enforcement", "options": [ - { "label": "Disabled (required for synced passkeys)", "value": "disabled" }, - { "label": "Registration only", "value": "registrationOnly" } + { + "label": "Disabled (required for synced passkeys)", + "value": "disabled" + }, + { + "label": "Registration only", + "value": "registrationOnly" + } ], "required": true }, @@ -8935,8 +11297,14 @@ "name": "standards.FIDO2PasskeyProfiles.EnforcementType", "label": "Key Restriction Type", "options": [ - { "label": "Allow listed AAGUIDs only", "value": "allow" }, - { "label": "Block listed AAGUIDs", "value": "block" } + { + "label": "Allow listed AAGUIDs only", + "value": "allow" + }, + { + "label": "Block listed AAGUIDs", + "value": "block" + } ], "required": false }, @@ -8952,13 +11320,21 @@ "impactColour": "warning", "addedDate": "2026-05-25", "powershellEquivalent": "Graph API PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/fido2", - "recommendedBy": ["CIPP"] + "recommendedBy": [ + "Manage365" + ] }, { "name": "standards.SmartLockout", "cat": "Entra (AAD) Standards", - "tag": ["CIS M365 7.0.0 (5.2.3.8)", "CIS M365 7.0.0 (5.2.3.9)"], - "appliesToTest": ["CIS_5_2_3_8", "CIS_5_2_3_9"], + "tag": [ + "CIS M365 7.0.0 (5.2.3.8)", + "CIS M365 7.0.0 (5.2.3.9)" + ], + "appliesToTest": [ + "CIS_5_2_3_8", + "CIS_5_2_3_9" + ], "helpText": "**Requires Entra ID P1.** Configures the Entra ID Smart Lockout settings including lockout duration, lockout threshold, and on-premises integration mode.", "docsDescription": "Configures the Entra ID Smart Lockout policy which protects against brute-force password attacks. Smart Lockout locks out bad actors who try to guess user passwords or use brute-force methods. It recognizes sign-ins from valid users and treats them differently from attackers. Settings include lockout duration (seconds), lockout threshold (failed attempts before lockout), and on-premises password protection mode (Audit or Enforce).", "addedComponent": [ @@ -8986,8 +11362,14 @@ "name": "standards.SmartLockout.BannedPasswordCheckOnPremisesMode", "label": "On-Premises Mode", "options": [ - { "label": "Audit", "value": "Audit" }, - { "label": "Enforce", "value": "Enforce" } + { + "label": "Audit", + "value": "Audit" + }, + { + "label": "Enforce", + "value": "Enforce" + } ] } ], @@ -8996,8 +11378,13 @@ "impactColour": "warning", "addedDate": "2025-05-27", "powershellEquivalent": "Get-MgBetaDirectorySetting, New-MgBetaDirectorySetting, Update-MgBetaDirectorySetting", - "recommendedBy": ["CIS"], - "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"] + "recommendedBy": [ + "CIS" + ], + "requiredCapabilities": [ + "AAD_PREMIUM", + "AAD_PREMIUM_P2" + ] }, { "name": "standards.SPOVersionControl", @@ -9024,8 +11411,14 @@ "label": "Expire Versions After Days (0 = never, otherwise 30-36500, when auto trim is off)", "default": 0, "validators": { - "min": { "value": 0, "message": "Use 0 for never, or 30 or more days" }, - "max": { "value": 36500, "message": "Maximum value is 36500" } + "min": { + "value": 0, + "message": "Use 0 for never, or 30 or more days" + }, + "max": { + "value": 36500, + "message": "Maximum value is 36500" + } } }, { @@ -9060,8 +11453,8 @@ "impactColour": "danger", "addedDate": "2026-08-23", "tag": [], - "helpText": "Deploys a Privileged Identity Management role settings template to the tenant: activation limits, MFA or authentication context, justification, approval, eligibility and active-assignment expiry and notification rules for the roles the template covers. Templates cannot weaken settings below CIPP's secure floor.", - "docsDescription": "Deploys a Privileged Identity Management role settings template to the tenant. The template defines, for a set of roles, the maximum activation duration, whether activation requires MFA or an authentication context, justification, ticket and approval requirements, the maximum lifetime of eligible and active assignments, and additional notification recipients. Templates are validated against CIPP's secure floor (activation within 24 hours with MFA or an authentication context and a justification; eligible and active assignments must expire within a year; active assignments require a justification) and are refused, not adjusted, when they fall below it. Requires Entra ID P2.", + "helpText": "Deploys a Privileged Identity Management role settings template to the tenant: activation limits, MFA or authentication context, justification, approval, eligibility and active-assignment expiry and notification rules for the roles the template covers. Templates cannot weaken settings below Manage365's secure floor.", + "docsDescription": "Deploys a Privileged Identity Management role settings template to the tenant. The template defines, for a set of roles, the maximum activation duration, whether activation requires MFA or an authentication context, justification, ticket and approval requirements, the maximum lifetime of eligible and active assignments, and additional notification recipients. Templates are validated against Manage365's secure floor (activation within 24 hours with MFA or an authentication context and a justification; eligible and active assignments must expire within a year; active assignments require a justification) and are refused, not adjusted, when they fall below it. Requires Entra ID P2.", "executiveText": "Enforces consistent Privileged Identity Management settings so that administrator roles can only be used for a limited time, after strong authentication and with a recorded reason. This keeps standing administrative access to a minimum and makes every use of privilege visible and accountable.", "addedComponent": [ { @@ -9085,10 +11478,331 @@ ], "powershellEquivalent": "Update-MgBetaPolicyRoleManagementPolicyRule", "recommendedBy": [ - "CIPP" + "Manage365" ], "requiredCapabilities": [ "AAD_PREMIUM_P2" ] + }, + { + "name": "standards.AutomaticUserConsent", + "cat": "Entra (AAD) Standards", + "tag": [], + "helpText": "Controls whether users automatically redeem invitations when accessing external organizations or when external users access your resources. When enabled, users don't see a consent prompt for first-time access.", + "docsDescription": "Controls the automatic user consent settings in the cross-tenant access policy defaults. Inbound automatic consent means external users will automatically redeem invitations without a consent prompt. Outbound automatic consent means your users will automatically redeem invitations from other organizations. This is commonly used to streamline B2B collaboration and B2B Direct Connect experiences.", + "executiveText": "Controls automatic invitation redemption for cross-tenant collaboration. Enabling automatic consent provides a smoother experience for B2B collaborators by removing the manual invitation acceptance step, while disabling it ensures users explicitly agree before accessing external resources.", + "addedComponent": [ + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Inbound automatic redemption", + "name": "standards.AutomaticUserConsent.inboundAllowed", + "options": [ + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } + ] + }, + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Outbound automatic redemption", + "name": "standards.AutomaticUserConsent.outboundAllowed", + "options": [ + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } + ] + } + ], + "label": "Sets automatic invitation redemption for cross-tenant access", + "impact": "Low Impact", + "impactColour": "info", + "addedDate": "2026-02-13", + "powershellEquivalent": "Update-MgPolicyCrossTenantAccessPolicyDefault", + "recommendedBy": [] + }, + { + "name": "standards.B2BCollaborationInbound", + "cat": "Entra (AAD) Standards", + "tag": [], + "helpText": "Controls whether external users from other organizations can be invited to access your resources through B2B collaboration (guest access) by default. This applies to all external organizations without a partner-specific configuration.", + "docsDescription": "Controls whether external users from other organizations can be invited to access your resources through B2B collaboration (guest access) by default. When set to blocked, no external users can collaborate unless a partner-specific override is configured.", + "executiveText": "Manages the default inbound B2B collaboration policy, controlling whether external users from partner organizations can access company resources as guests. Restricting this to specific organizations reduces the attack surface while allowing necessary business collaboration.", + "addedComponent": [ + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Default inbound B2B collaboration access", + "name": "standards.B2BCollaborationInbound.accessType", + "options": [ + { + "label": "Allow (all external users)", + "value": "allowed" + }, + { + "label": "Block (no external users)", + "value": "blocked" + } + ] + } + ], + "label": "Sets the default inbound B2B collaboration access policy", + "impact": "Medium Impact", + "impactColour": "warning", + "addedDate": "2026-02-13", + "powershellEquivalent": "Update-MgPolicyCrossTenantAccessPolicyDefault", + "recommendedBy": [] + }, + { + "name": "standards.B2BCollaborationOutbound", + "cat": "Entra (AAD) Standards", + "tag": [], + "helpText": "Controls whether your users can be invited to access resources in other organizations through B2B collaboration by default. This applies to all external organizations without a partner-specific configuration.", + "docsDescription": "Controls whether your users can be invited to access resources in other organizations through B2B collaboration by default. When set to blocked, users cannot collaborate externally unless a partner-specific override is configured.", + "executiveText": "Manages the default outbound B2B collaboration policy, controlling whether company employees can accept invitations to collaborate in external organizations. This helps prevent data leakage by controlling where users can share information.", + "addedComponent": [ + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Default outbound B2B collaboration access", + "name": "standards.B2BCollaborationOutbound.accessType", + "options": [ + { + "label": "Allow (all users)", + "value": "allowed" + }, + { + "label": "Block (no users)", + "value": "blocked" + } + ] + } + ], + "label": "Sets the default outbound B2B collaboration access policy", + "impact": "Medium Impact", + "impactColour": "warning", + "addedDate": "2026-02-13", + "powershellEquivalent": "Update-MgPolicyCrossTenantAccessPolicyDefault", + "recommendedBy": [] + }, + { + "name": "standards.B2BDirectConnectInbound", + "cat": "Entra (AAD) Standards", + "tag": [], + "helpText": "Controls whether external users can access your Teams shared channels through B2B Direct Connect by default. Direct Connect enables seamless collaboration without creating guest accounts.", + "docsDescription": "Controls whether external users can access your Teams shared channels through B2B Direct Connect by default. When blocked, no external users can join shared channels unless a partner-specific override is configured. B2B Direct Connect is commonly used for Teams shared channels.", + "executiveText": "Controls whether external users can seamlessly join Teams shared channels through B2B Direct Connect. Blocking this by default and only allowing specific partner organizations reduces unauthorized access to sensitive team collaboration spaces.", + "addedComponent": [ + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Default inbound B2B Direct Connect access", + "name": "standards.B2BDirectConnectInbound.accessType", + "options": [ + { + "label": "Allow (all external users)", + "value": "allowed" + }, + { + "label": "Block (no external users)", + "value": "blocked" + } + ] + } + ], + "label": "Sets the default inbound B2B Direct Connect access policy", + "impact": "Medium Impact", + "impactColour": "warning", + "addedDate": "2026-02-13", + "powershellEquivalent": "Update-MgPolicyCrossTenantAccessPolicyDefault", + "recommendedBy": [] + }, + { + "name": "standards.B2BDirectConnectOutbound", + "cat": "Entra (AAD) Standards", + "tag": [], + "helpText": "Controls whether your users can access external Teams shared channels through B2B Direct Connect by default. This applies to all external organizations without a partner-specific configuration.", + "docsDescription": "Controls whether your users can access external Teams shared channels through B2B Direct Connect by default. When blocked, users cannot join external shared channels unless a partner-specific override is configured.", + "executiveText": "Controls whether employees can join external Teams shared channels through B2B Direct Connect. Blocking outbound Direct Connect by default and only allowing specific partners prevents uncontrolled data sharing through external collaboration channels.", + "addedComponent": [ + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Default outbound B2B Direct Connect access", + "name": "standards.B2BDirectConnectOutbound.accessType", + "options": [ + { + "label": "Allow (all users)", + "value": "allowed" + }, + { + "label": "Block (no users)", + "value": "blocked" + } + ] + } + ], + "label": "Sets the default outbound B2B Direct Connect access policy", + "impact": "Medium Impact", + "impactColour": "warning", + "addedDate": "2026-02-13", + "powershellEquivalent": "Update-MgPolicyCrossTenantAccessPolicyDefault", + "recommendedBy": [] + }, + { + "name": "standards.BlockMSNSignIn", + "cat": "Entra (AAD) Standards", + "tag": [], + "helpText": "Controls whether personal Microsoft accounts (MSN/Outlook.com/Hotmail) can be used to sign in. Blocking MSN sign-in prevents users from using personal accounts to access organizational resources.", + "docsDescription": "Controls whether personal Microsoft accounts (MSN/Outlook.com/Hotmail) can be used to sign in to the tenant. When enabled, users cannot use personal Microsoft accounts to access organizational resources, improving security by ensuring only managed accounts are used.", + "executiveText": "Prevents users from signing in with personal Microsoft accounts (Outlook.com, Hotmail, etc.), ensuring that only organizational or approved external accounts can access company resources. This reduces shadow IT risks and maintains compliance with identity governance policies.", + "addedComponent": [ + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Block MSN sign-in", + "name": "standards.BlockMSNSignIn.state", + "options": [ + { + "label": "Enabled (block personal accounts)", + "value": "true" + }, + { + "label": "Disabled (allow personal accounts)", + "value": "false" + } + ] + } + ], + "label": "Block personal Microsoft account (MSN) sign-in", + "impact": "Low Impact", + "impactColour": "info", + "addedDate": "2026-02-13", + "powershellEquivalent": "Update-MgPolicyAuthorizationPolicy", + "recommendedBy": [] + }, + { + "name": "standards.CrossTenantTrustCompliant", + "cat": "Entra (AAD) Standards", + "tag": [], + "helpText": "Sets the state of the Cross-tenant access setting to trust compliant devices from external organizations. This allows guest users to satisfy your device compliance Conditional Access policies using their home tenant's Intune compliance status.", + "docsDescription": "Sets the state of the Cross-tenant access setting to trust compliant devices from external organizations. When enabled, your Conditional Access policies that require compliant devices will accept device compliance claims from partner organizations managed through Intune.", + "executiveText": "Enables trusting device compliance status from partner organizations, allowing external collaborators with Intune-managed compliant devices to access company resources without additional device enrollment. This streamlines cross-organization collaboration while maintaining device security requirements.", + "addedComponent": [ + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Trust compliant devices from external tenants", + "name": "standards.CrossTenantTrustCompliant.state", + "options": [ + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } + ] + } + ], + "label": "Sets the Cross-tenant access setting to trust compliant devices", + "impact": "Low Impact", + "impactColour": "info", + "addedDate": "2026-02-13", + "powershellEquivalent": "Update-MgPolicyCrossTenantAccessPolicyDefault", + "recommendedBy": [] + }, + { + "name": "standards.CrossTenantTrustHybridJoin", + "cat": "Entra (AAD) Standards", + "tag": [], + "helpText": "Sets the state of the Cross-tenant access setting to trust Microsoft Entra hybrid joined devices from external organizations. This allows guest users to satisfy your Conditional Access policies that require hybrid joined devices using their home tenant's device status.", + "docsDescription": "Sets the state of the Cross-tenant access setting to trust Microsoft Entra hybrid joined devices from external organizations. When enabled, your Conditional Access policies that require hybrid Azure AD joined devices will accept claims from partner organizations.", + "executiveText": "Enables trusting hybrid Azure AD joined device claims from partner organizations, allowing external collaborators with domain-joined devices to access company resources without additional requirements. This supports cross-organization collaboration for enterprises using hybrid identity.", + "addedComponent": [ + { + "type": "autoComplete", + "multiple": false, + "creatable": false, + "label": "Trust hybrid Azure AD joined devices from external tenants", + "name": "standards.CrossTenantTrustHybridJoin.state", + "options": [ + { + "label": "Enabled", + "value": "true" + }, + { + "label": "Disabled", + "value": "false" + } + ] + } + ], + "label": "Sets the Cross-tenant access setting to trust hybrid Azure AD joined devices", + "impact": "Low Impact", + "impactColour": "info", + "addedDate": "2026-02-13", + "powershellEquivalent": "Update-MgPolicyCrossTenantAccessPolicyDefault", + "recommendedBy": [] + }, + { + "name": "standards.GuestUserRole", + "cat": "Entra (AAD) Standards", + "tag": [ + "\"EIDSCA.AP14\"" + ], + "helpText": "Sets the default access level for guest users in the directory. Choose between member-level access, default guest access, or the most restrictive setting that blocks directory enumeration. This is a more flexible alternative to the DisableGuestDirectory standard.", + "docsDescription": "Controls what permissions guest users have in the directory. The most restrictive option prevents guests from enumerating users and group memberships. The default option limits guest access but allows basic directory browsing. The least restrictive option gives guests the same access as member users.", + "executiveText": "Controls the level of directory access granted to external guest users, balancing collaboration needs with security requirements. Setting appropriate guest permissions prevents unauthorized discovery of organizational structure and employee information.", + "addedComponent": [ + { + "type": "autoComplete", + "required": true, + "multiple": false, + "creatable": false, + "label": "Guest user access level", + "name": "standards.GuestUserRole.guestUserRoleId", + "options": [ + { + "label": "Same access as member users (least restrictive)", + "value": "a0b1b346-4d3e-4e8b-98f8-753987be4970" + }, + { + "label": "Limited access - default guest access", + "value": "10dae51f-b6af-4016-8d66-8c2a99b929b3" + }, + { + "label": "Restricted access - cannot enumerate directory (most restrictive)", + "value": "2af84b1e-32c8-42b7-82bc-daa82404023b" + } + ] + } + ], + "label": "Sets the guest user default access level", + "impact": "Medium Impact", + "impactColour": "warning", + "addedDate": "2026-02-13", + "powershellEquivalent": "Update-MgPolicyAuthorizationPolicy", + "recommendedBy": [] } ] diff --git a/frontend/src/data/tutorials/dashboard-overview.json b/frontend/src/data/tutorials/dashboard-overview.json index df2aeca196..4a02c193a4 100644 --- a/frontend/src/data/tutorials/dashboard-overview.json +++ b/frontend/src/data/tutorials/dashboard-overview.json @@ -1,14 +1,14 @@ { "id": "dashboard-overview", "title": "Dashboard Overview", - "description": "A guided tour of the CIPP Dashboard — learn what each card, chart, and control does.", + "description": "A guided tour of the Manage365 Dashboard — learn what each card, chart, and control does.", "category": "General", "pages": ["/dashboardv2"], "steps": [ { "popover": { "title": "Welcome to the Dashboard 👋", - "description": "This tour will walk you through every section of the CIPP Dashboard so you know exactly where to find the information you need." + "description": "This tour will walk you through every section of the Manage365 Dashboard so you know exactly where to find the information you need." } }, { @@ -104,7 +104,7 @@ { "popover": { "title": "You're all set! 🎉", - "description": "That covers the Dashboard. Explore the other tabs at the top for more views, or check the sidebar for all CIPP modules. You can replay this tour anytime from the Tutorials menu." + "description": "That covers the Dashboard. Explore the other tabs at the top for more views, or check the sidebar for all Manage365 modules. You can replay this tour anytime from the Tutorials menu." } } ] diff --git a/frontend/src/data/tutorials/getting-started.json b/frontend/src/data/tutorials/getting-started.json index 8e2c229135..0e3641339e 100644 --- a/frontend/src/data/tutorials/getting-started.json +++ b/frontend/src/data/tutorials/getting-started.json @@ -1,14 +1,14 @@ { "id": "getting-started", - "title": "Getting Started with CIPP", - "description": "Learn the basics of navigating CIPP and managing your tenants.", + "title": "Getting Started with Manage365", + "description": "Learn the basics of navigating Manage365 and managing your tenants.", "category": "General", "pages": ["/"], "steps": [ { "popover": { - "title": "Welcome to CIPP! 👋", - "description": "This quick tour will show you the key features of the CIPP dashboard. Let's get started!" + "title": "Welcome to Manage365! 👋", + "description": "This quick tour will show you the key features of the Manage365 dashboard. Let's get started!" } }, { @@ -24,7 +24,7 @@ "element": "[data-tutorial='side-nav']", "popover": { "title": "Navigation Menu", - "description": "The sidebar gives you access to all CIPP modules — Identity, Endpoint, Security, Email, Teams & SharePoint, and more.", + "description": "The sidebar gives you access to all Manage365 modules — Identity, Endpoint, Security, Email, Teams & SharePoint, and more.", "side": "right", "align": "start" } @@ -41,7 +41,7 @@ { "popover": { "title": "You're all set! 🎉", - "description": "You now know the basics. Explore the sidebar to discover all the tools CIPP offers. You can replay this tour anytime from the Tutorials menu." + "description": "You now know the basics. Explore the sidebar to discover all the tools Manage365 offers. You can replay this tour anytime from the Tutorials menu." } } ] diff --git a/frontend/src/hooks/use-breakpoint.js b/frontend/src/hooks/use-breakpoint.js index dedf377e95..6fc14199c9 100644 --- a/frontend/src/hooks/use-breakpoint.js +++ b/frontend/src/hooks/use-breakpoint.js @@ -3,7 +3,7 @@ import { useSettings } from "./use-settings"; // Shared breakpoint hooks so the two mobile thresholds sit next to each other. -// Chrome pivots where the side nav gives way to the drawer (layouts/index.js). Everything that +// Chrome pivots where the side nav gives way to the drawer (layouts/index.jsx). Everything that // has to agree with the nav reads this: content gutter, top-nav hamburger, page toolbars. export const useIsMobileLayout = () => useMediaQuery((theme) => theme.breakpoints.down("lg")); diff --git a/frontend/src/hooks/use-login-hint.js b/frontend/src/hooks/use-login-hint.js new file mode 100644 index 0000000000..0ddfd0de9c --- /dev/null +++ b/frontend/src/hooks/use-login-hint.js @@ -0,0 +1,15 @@ +import { useCallback } from "react"; +import { ApiGetCall } from "../api/ApiCall"; +import { useSettings } from "./use-settings"; +import { addLoginHint, getLoginHintUpn } from "../utils/add-login-hint"; + +// Returns a stable `(link) => link` mapper that appends login_hint= to external portal links +// when the user turned the portalLinks.Login_Hint preference on. The signed-in UPN comes from the +// authmecipp query that PrivateRoute and the layout already hold, so this never issues its own +// /api/me request - it only subscribes to the cached result. +export const useLoginHint = () => { + const settings = useSettings(); + const me = ApiGetCall({ url: "/api/me", queryKey: "authmecipp" }); + const upn = getLoginHintUpn(settings, me.data?.clientPrincipal?.userDetails); + return useCallback((link) => addLoginHint(link, upn), [upn]); +}; diff --git a/frontend/src/hooks/use-prefetch.js b/frontend/src/hooks/use-prefetch.js new file mode 100644 index 0000000000..3a85ab7dab --- /dev/null +++ b/frontend/src/hooks/use-prefetch.js @@ -0,0 +1,112 @@ +import { useQueryClient } from "@tanstack/react-query"; +import { useCallback, useEffect } from "react"; +import axios from "axios"; +import { buildVersionedHeaders } from "../utils/cippVersion"; +import { STALE_TIMES } from "../api/ApiCall"; + +/** + * Hook to prefetch data for likely navigation destinations + * Call this on pages where users frequently navigate to predictable next pages + */ +export const usePrefetch = () => { + const queryClient = useQueryClient(); + + const prefetchQuery = useCallback( + async (url, queryKey, data = {}, staleTime = STALE_TIMES.DEFAULT) => { + // Only prefetch if not already cached + const existingData = queryClient.getQueryData([queryKey]); + if (existingData) return; + + try { + await queryClient.prefetchQuery({ + queryKey: [queryKey], + queryFn: async () => { + const response = await axios.get(url, { + params: data, + headers: await buildVersionedHeaders(), + }); + return response.data; + }, + staleTime: staleTime, + }); + } catch (error) { + // Silently fail - prefetch is opportunistic + console.debug(`Prefetch failed for ${queryKey}:`, error.message); + } + }, + [queryClient] + ); + + return { prefetchQuery }; +}; + +/** + * Hook to prefetch common data when dashboard loads + * This preloads data for frequently accessed pages + */ +export const useDashboardPrefetch = (currentTenant) => { + const { prefetchQuery } = usePrefetch(); + + useEffect(() => { + if (!currentTenant || currentTenant === "AllTenants") return; + + // Delay prefetching to not compete with dashboard's own data loading + const timeoutId = setTimeout(() => { + // Prefetch users list (very commonly accessed from dashboard) + prefetchQuery( + "/api/ListGraphRequest", + `${currentTenant}-users-prefetch`, + { + Endpoint: "users", + tenantFilter: currentTenant, + $select: "id,displayName,userPrincipalName,mail,accountEnabled,jobTitle,department", + $top: 100, + $orderby: "displayName", + }, + STALE_TIMES.DEFAULT + ); + + // Prefetch groups list + prefetchQuery( + "/api/ListGroups", + `${currentTenant}-groups-prefetch`, + { tenantFilter: currentTenant }, + STALE_TIMES.DEFAULT + ); + + // Prefetch devices list (if Intune is commonly used) + prefetchQuery( + "/api/ListGraphRequest", + `${currentTenant}-devices-prefetch`, + { + Endpoint: "deviceManagement/managedDevices", + tenantFilter: currentTenant, + $top: 50, + }, + STALE_TIMES.DEFAULT + ); + }, 2000); // Wait 2 seconds after dashboard loads + + return () => clearTimeout(timeoutId); + }, [currentTenant, prefetchQuery]); +}; + +/** + * Hook to prefetch on hover - for menus and navigation + * Usage: onMouseEnter={() => prefetchOnHover('/api/ListUsers', 'users')} + */ +export const usePrefetchOnHover = () => { + const { prefetchQuery } = usePrefetch(); + + const prefetchOnHover = useCallback( + (url, queryKey, data = {}) => { + // Debounce by checking if already prefetching + prefetchQuery(url, queryKey, data); + }, + [prefetchQuery] + ); + + return { prefetchOnHover }; +}; + +export default usePrefetch; diff --git a/frontend/src/hooks/use-push-subscription.js b/frontend/src/hooks/use-push-subscription.js index 8a3829bc36..5dbf2535db 100644 --- a/frontend/src/hooks/use-push-subscription.js +++ b/frontend/src/hooks/use-push-subscription.js @@ -97,7 +97,7 @@ export const usePushSubscription = ({ publicKey, onSubscribed }) => { blockedReason = 'This browser does not support push notifications.' else if (isIos() && !isStandalone()) blockedReason = - 'On iOS, add CIPP to your Home Screen and open it from there to enable notifications.' + 'On iOS, add Manage365 to your Home Screen and open it from there to enable notifications.' else if (getImpersonatedRole()) blockedReason = 'Push devices cannot be registered while impersonating a role.' diff --git a/frontend/src/hooks/use-securescore.js b/frontend/src/hooks/use-securescore.js index 93224f1476..dc8ada3ed9 100644 --- a/frontend/src/hooks/use-securescore.js +++ b/frontend/src/hooks/use-securescore.js @@ -1,28 +1,26 @@ -import { useEffect, useState } from 'react' -import { ApiGetCall } from '../api/ApiCall' -import { useSettings } from './use-settings' -import { getStandards } from '../utils/standards-data' +import { useEffect, useState } from "react"; +import { ApiGetCall } from "../api/ApiCall"; +import { useSettings } from "./use-settings"; +import standards from "../data/standards.json"; export function useSecureScore({ waiting = true } = {}) { - const currentTenant = useSettings().currentTenant - const isAllTenants = currentTenant === 'AllTenants' + const currentTenant = useSettings().currentTenant; + const isAllTenants = currentTenant === "AllTenants"; - const [translatedData, setTranslatedData] = useState([]) - const [isSuccess, setIsSuccess] = useState(false) - const [isFetching, setIsFetching] = useState(false) + const [translatedData, setTranslatedData] = useState([]); + const [isSuccess, setIsSuccess] = useState(false); + const [isFetching, setIsFetching] = useState(false); const controlScore = ApiGetCall({ - url: '/api/ListGraphRequest', + url: "/api/ListGraphRequest", data: { - Endpoint: 'security/secureScoreControlProfiles', + Endpoint: "security/secureScoreControlProfiles", tenantFilter: currentTenant, $count: true, $top: 999, }, queryKey: `controlScore-${currentTenant}`, - // Never fetch under AllTenants: these are live per-tenant Graph reads whose results the - // effects below discard in that mode — the AllTenants view reads the nightly cache instead. - waiting: waiting && !isAllTenants, - }) + waiting: waiting || isAllTenants, + }); // Same key and TTL as the layout's call so react-query serves one shared copy. const featureFlags = ApiGetCall({ @@ -38,45 +36,43 @@ export function useSecureScore({ waiting = true } = {}) { const standardsPath = baselinesEnabled ? '/tenant/baselines' : '/tenant/standards/templates' const secureScore = ApiGetCall({ - url: '/api/ListGraphRequest', + url: "/api/ListGraphRequest", data: { - Endpoint: 'security/secureScores', + Endpoint: "security/secureScores", tenantFilter: currentTenant, $count: true, noPagination: true, $top: 7, }, queryKey: `secureScore-${currentTenant}`, - // Never fetch under AllTenants: these are live per-tenant Graph reads whose results the - // effects below discard in that mode — the AllTenants view reads the nightly cache instead. - waiting: waiting && !isAllTenants, - }) + waiting: waiting || isAllTenants, + }); useEffect(() => { if (isAllTenants) { - setIsFetching(false) - setIsSuccess(false) - setTranslatedData([]) - return + setIsFetching(false); + setIsSuccess(false); + setTranslatedData([]); + return; } if (controlScore.isFetching || secureScore.isFetching) { - setIsFetching(true) + setIsFetching(true); } else { - setIsFetching(false) + setIsFetching(false); } - }, [controlScore.isFetching, secureScore.isFetching, isAllTenants]) + }, [controlScore.isFetching, secureScore.isFetching, isAllTenants]); useEffect(() => { - if (isAllTenants) return + if (isAllTenants) return; if (controlScore.isSuccess && secureScore.isSuccess) { - const secureScoreData = secureScore.data.Results[0] + const secureScoreData = secureScore.data.Results[0]; const updatedControlScores = secureScoreData.controlScores.map((control) => { const translation = controlScore.data.Results?.find( - (controlTranslation) => controlTranslation.id === control.controlName - ) - const remediation = getStandards().find((standard) => - standard.tag?.includes(control.controlName) - ) + (controlTranslation) => controlTranslation.id === control.controlName, + ); + const remediation = standards.find((standard) => + standard.tag?.includes(control.controlName), + ); return { ...control, title: translation?.title, @@ -86,7 +82,7 @@ export function useSecureScore({ waiting = true } = {}) { ? `${standardsPath}?standard=${encodeURIComponent(remediation.name)}` : translation?.actionUrl, remediation: remediation - ? `1. Enable the CIPP Standard: ${remediation.label}` + ? `1. Enable the Manage365 Standard: ${remediation.label}` : translation?.remediation, remediationImpact: translation?.remediationImpact, implementationCost: translation?.implementationCost, @@ -94,26 +90,28 @@ export function useSecureScore({ waiting = true } = {}) { userImpact: translation?.userImpact, vendorInformation: translation?.vendorInformation, controlStateUpdates: translation?.controlStateUpdates //remove each controlStateUpdate that has the state 'default' as it is not relevant. - ? translation.controlStateUpdates.filter((update) => update.state !== 'Default') + ? translation.controlStateUpdates.filter((update) => update.state !== "Default") : [], - } - }) - updatedControlScores.sort((a, b) => b.scoreInPercentage - a.scoreInPercentage) + }; + }); + updatedControlScores.sort((a, b) => b.scoreInPercentage - a.scoreInPercentage); setTranslatedData({ ...secureScoreData, //secureScoreData.currentscore is the current score, secureScoreData.maxscore is the max score. calculate % reached. percentageCurrent: Math.round( - (secureScoreData.currentScore / secureScoreData.maxScore) * 100 + (secureScoreData.currentScore / secureScoreData.maxScore) * 100, ), percentageVsAllTenants: Math.round( - secureScoreData.averageComparativeScores?.[0]?.averageScore + secureScoreData.averageComparativeScores?.[0]?.averageScore, ), percentageVsSimilar: Math.round( - secureScoreData.averageComparativeScores?.[1]?.averageScore + secureScoreData.averageComparativeScores?.[1]?.averageScore, ), controlScores: updatedControlScores, - }) - setIsSuccess(true) + }); + setIsSuccess(true); + } else { + setIsSuccess(false); } }, [ controlScore.isSuccess, @@ -122,7 +120,7 @@ export function useSecureScore({ waiting = true } = {}) { secureScore.data, isAllTenants, standardsPath, - ]) + ]); return { controlScore, @@ -130,5 +128,5 @@ export function useSecureScore({ waiting = true } = {}) { translatedData, isFetching, isSuccess, - } + }; } diff --git a/frontend/src/hooks/use-user-bookmarks.js b/frontend/src/hooks/use-user-bookmarks.js index 4d210b46d0..ae7fb372c3 100644 --- a/frontend/src/hooks/use-user-bookmarks.js +++ b/frontend/src/hooks/use-user-bookmarks.js @@ -2,7 +2,7 @@ import { useCallback, useMemo } from "react"; import { useQueryClient } from "@tanstack/react-query"; import { ApiGetCall, ApiPostCall } from "../api/ApiCall"; -export const MAX_BOOKMARKS = 50; +export const MAX_BOOKMARKS = 20; const sanitizeBookmark = (bookmark) => { if (!bookmark || typeof bookmark !== "object") { @@ -125,27 +125,18 @@ export const useUserBookmarks = () => { [bookmarks] ); - // Bookmarks are keyed on path alone, so adding and removing are the same gesture. Returns the - // action taken so callers can react to hitting the cap instead of silently doing nothing. const toggleBookmark = useCallback( - (bookmark) => { - if (!bookmark?.path) { - return "invalid"; + ({ label, path, category }) => { + if (bookmarks.some((bookmark) => bookmark.path === path)) { + persistBookmarks(bookmarks.filter((bookmark) => bookmark.path !== path)); + return; } - - if (bookmarks.some((existing) => existing.path === bookmark.path)) { - setBookmarks(bookmarks.filter((existing) => existing.path !== bookmark.path)); - return "removed"; - } - if (bookmarks.length >= MAX_BOOKMARKS) { - return "limit"; + return; } - - setBookmarks([...bookmarks, bookmark]); - return "added"; + persistBookmarks([...bookmarks, { label, path, category }]); }, - [bookmarks, setBookmarks] + [bookmarks, persistBookmarks] ); return { diff --git a/frontend/src/layouts/HeaderedTabbedLayout.jsx b/frontend/src/layouts/HeaderedTabbedLayout.jsx index 0e42620c62..4c96020fe2 100644 --- a/frontend/src/layouts/HeaderedTabbedLayout.jsx +++ b/frontend/src/layouts/HeaderedTabbedLayout.jsx @@ -2,6 +2,7 @@ import { useCallback, useMemo } from "react"; import { usePathname } from "next/navigation"; import { useRouter } from "next/router"; import PropTypes from "prop-types"; +import ArrowLeftIcon from "@heroicons/react/24/outline/ArrowLeftIcon"; import { Box, Container, @@ -14,7 +15,8 @@ import { Typography, } from "@mui/material"; import { ActionsMenu } from "../components/actions-menu"; -import { CippIcons, getIconByName } from "../utils/icon-registry" +import { CippCopyToClipBoard } from "../components/CippComponents/CippCopyToClipboard"; +import { getIconByName } from "../utils/icon-registry"; import { useIsMobileLayout } from "../hooks/use-breakpoint"; import { useActionsDispatch } from "../hooks/use-actions-dispatch"; import { TabNavigationContext, useTabNavigationValue } from "./tab-navigation-context"; @@ -38,6 +40,7 @@ export const HeaderedTabbedLayout = (props) => { backUrl, // Optional replacement for the title Typography — same slot, same truncation duties. titleControl, + copyItems, } = props; // The shared hook rather than an inline useMediaQuery: same threshold, but only this one is @@ -121,15 +124,12 @@ export const HeaderedTabbedLayout = (props) => { // title above them. Gap applies to both axes, so the row gap is set separately or the // stacked pairs end up as far apart vertically as they are horizontally. + sx={{ columnGap: 2, rowGap: 0.5, minWidth: 0 }} + > {/* minWidth: 0 down the whole chain, and flexShrink: 0 on the icon. A copy-chip already carries MUI's ellipsis and maxWidth: 100%, but flex items default to min-width: auto, so every ancestor grew to fit instead of letting it truncate — @@ -143,24 +143,19 @@ export const HeaderedTabbedLayout = (props) => { ) : ( + sx={{ minWidth: 0, maxWidth: "100%" }} + > {item.icon} + sx={{ minWidth: 0, "& .MuiChip-root": { maxWidth: "100%" } }} + > {item.text} @@ -186,23 +181,21 @@ export const HeaderedTabbedLayout = (props) => { + > {/* minWidth: 0 so a long tenant/entity name truncates in the space the picker leaves rather than pushing it off the right edge of the row. Scoped to the picker's own breakpoint — above md this is unchanged. */} + justifyContent="space-between" + > {/* A name-shaped skeleton, not the word "Loading...": the header is the entity's identity, and a text placeholder reads as a title. titleControl lets a page swap the text for an interactive control @@ -222,6 +215,16 @@ export const HeaderedTabbedLayout = (props) => {         ) )} + {!isFetching && title && !titleControl && ( + + )} + {!isFetching && + copyItems?.map( + (item, index) => + item.text && ( + + ) + )}         {!isMobile && subtitleBlock}         @@ -315,7 +318,7 @@ HeaderedTabbedLayout.propTypes = { subtitle: PropTypes.arrayOf( PropTypes.shape({ icon: PropTypes.node.isRequired, - // Often a copy-chip (or other node), not plain text — see users/groups headers. + // Often a copy chip or other node, not plain text. text: PropTypes.node.isRequired, }) ), diff --git a/frontend/src/layouts/account-popover.jsx b/frontend/src/layouts/account-popover.jsx index 1d146011f9..33e424b866 100644 --- a/frontend/src/layouts/account-popover.jsx +++ b/frontend/src/layouts/account-popover.jsx @@ -18,6 +18,7 @@ import { useMediaQuery, } from "@mui/material"; import { usePopover } from "../hooks/use-popover"; +import { useSettings } from "../hooks/use-settings"; import { useIsMobileLayout } from "../hooks/use-breakpoint"; import { useDialog } from "../hooks/use-dialog"; import { paths } from "../paths"; @@ -25,9 +26,8 @@ import { ApiGetCall } from "../api/ApiCall"; import { CippApiDialog } from "../components/CippComponents/CippApiDialog"; import { useReleaseNotes } from "../contexts/release-notes-context"; import { useQueryClient } from "@tanstack/react-query"; -import { usePathname } from "next/navigation"; import { Divider } from "@mui/material"; -import { getHelpLinks, clearCippCache } from "../utils/help-links"; +import { clearCippCache } from "../utils/help-links"; export const AccountPopover = (props) => { const { @@ -39,25 +39,29 @@ export const AccountPopover = (props) => { ...other } = props; const router = useRouter(); - const pathname = usePathname(); const mdDown = useMediaQuery((theme) => theme.breakpoints.down("md")); const navCollapsed = useIsMobileLayout(); const popover = usePopover(); const queryClient = useQueryClient(); const { openReleaseNotes } = useReleaseNotes(); + const settings = useSettings(); const orgData = ApiGetCall({ url: "/api/me", queryKey: "authmecipp", }); const userDetails = orgData.data?.clientPrincipal?.userDetails; + + // For the logged-in user's photo, always use their home tenant (from their email domain) + // not the currently selected customer tenant + const userHomeTenant = userDetails?.split("@")?.[1]; // Cache user photo with user-specific key const userPhoto = ApiGetCall({ url: "/api/ListUserPhoto", - data: { UserID: userDetails }, - queryKey: `userPhoto-${userDetails}`, - waiting: !!userDetails, + data: { UserID: userDetails, tenantFilter: userHomeTenant }, + queryKey: `userPhoto-${userHomeTenant || "unknown"}-${userDetails || "unknown"}`, + waiting: !!userDetails && !!userHomeTenant, staleTime: Infinity, responseType: "blob", convertToDataUrl: true, @@ -116,7 +120,7 @@ export const AccountPopover = (props) => { <> {orgData.data?.clientPrincipal?.userDetails?.split("@")?.[1]} @@ -150,7 +154,7 @@ export const AccountPopover = (props) => { type: "POST", data: {}, confirmText: - "Re-check your Entra group membership and refresh your CIPP roles? Use this after activating a role-mapped group through PIM.", + "Re-check your Entra group membership and refresh your Manage365 roles? Use this after activating a role-mapped group through PIM.", relatedQueryKeys: ["authmecipp"], }} /> @@ -229,30 +233,23 @@ export const AccountPopover = (props) => { - {/* Mobile home for the help SpeedDial's destinations — its FAB corner belongs - to page actions there (the SpeedDial hides itself at the same threshold). */} + {/* On a narrow layout the ? button is hidden, so License and Clear Cache live here. */} {navCollapsed && ( <> - {getHelpLinks(pathname ?? "").map((link) => ( - { - popover.handleClose(); - window.open(link.href, "_blank"); - }} - > - - - - - - - - + { + popover.handleClose(); + router.push("/license"); + }} + > + + + - - ))} + + + { popover.handleClose(); diff --git a/frontend/src/layouts/config.jsx b/frontend/src/layouts/config.jsx index da887240e8..9f4213ec08 100644 --- a/frontend/src/layouts/config.jsx +++ b/frontend/src/layouts/config.jsx @@ -10,7 +10,9 @@ export const nativeMenuItems = [ ), - permissions: ['CIPP.Core.*'], + permissions: [ + 'CIPP.Core.*', + ], }, { title: 'Identity Management', @@ -20,79 +22,124 @@ export const nativeMenuItems = [ ), - permissions: ['Identity.*'], + permissions: [ + 'Identity.*', + ], items: [ { title: 'Administration', - permissions: ['Identity.User.*'], + permissions: [ + 'Identity.User.*', + ], items: [ { - title: 'Users', - path: '/identity/administration/users', - permissions: ['Identity.User.*'], - }, - { - title: 'Guest Users', - path: '/identity/administration/guest-users', - permissions: ['Identity.User.*'], - }, - { - title: 'Risky Users', - path: '/identity/administration/risky-users', - permissions: ['Identity.User.*'], - }, - { - title: 'Groups', - path: '/identity/administration/groups', - permissions: ['Identity.Group.*'], - }, - { - title: 'Group Templates', - path: '/identity/administration/group-templates', - permissions: ['Identity.Group.*'], - scope: 'global', + title: "Users", + permissions: [ + "Identity.User.*", + ], + items: [ + { + title: "Users", + path: "/identity/administration/users", + permissions: [ + "Identity.User.*", + ], + }, + { + title: "Guest Users", + path: "/identity/administration/guest-users", + permissions: [ + "Identity.User.*", + ], + }, + { + title: "Risky Users", + path: "/identity/administration/risky-users", + permissions: [ + "Identity.User.*", + ], + }, + { + title: "Offboarding Wizard", + path: "/identity/administration/offboarding-wizard", + permissions: [ + "Identity.User.*", + ], + }, + ], + }, + { + title: "Groups", + permissions: [ + "Identity.Group.*", + ], + items: [ + { + title: "Groups", + path: "/identity/administration/groups", + permissions: [ + "Identity.Group.*", + ], + }, + { + title: "Group Templates", + path: "/identity/administration/group-templates", + permissions: [ + "Identity.Group.*", + ], + scope: "global", + }, + ], }, { title: 'Devices', path: '/identity/administration/devices', - permissions: ['Identity.Device.*'], + permissions: [ + 'Identity.Device.*', + ], }, { title: 'Deleted Items', path: '/identity/administration/deleted-items', - permissions: ['Identity.User.*'], + permissions: [ + 'Identity.User.*', + ], }, { title: 'Roles & PIM', path: '/identity/administration/roles', - permissions: ['Identity.Role.*'], - }, - { - title: 'JIT Admin', - path: '/identity/administration/jit-admin', - permissions: ['Identity.Role.*'], - }, - { - title: 'JIT Admin Templates', - path: '/identity/administration/jit-admin-templates', - permissions: ['Identity.Role.*'], - scope: 'global', - }, - { - title: 'JIT Role Templates', - path: '/identity/administration/jit-role-templates', - permissions: ['Identity.Role.*'], - scope: 'global', + permissions: [ + 'Identity.Role.*', + ], + }, + { + title: "JIT Admin", + permissions: [ + "Identity.Role.*", + ], + items: [ + { + title: "JIT Admin", + path: "/identity/administration/jit-admin", + permissions: [ + "Identity.Role.*", + ], + }, + { + title: "JIT Admin Templates", + path: "/identity/administration/jit-admin-templates", + permissions: [ + "Identity.Role.*", + ], + }, + ], }, { title: 'Vacation Mode', path: '/identity/administration/vacation-mode', - permissions: ['Identity.User.*'], - }, - { - title: 'Offboarding Wizard', - path: '/identity/administration/offboarding-wizard', - permissions: ['Identity.User.*'], + permissions: [ + 'Identity.User.*', + ], }, { title: 'Business Email Compromise', @@ -114,206 +161,47 @@ export const nativeMenuItems = [ { title: 'MFA Report', path: '/identity/reports/mfa-report', - permissions: ['Identity.User.*'], + permissions: [ + 'Identity.User.*', + ], }, { title: 'Inactive Users', path: '/identity/reports/inactive-users-report', - permissions: ['Identity.User.*'], + permissions: [ + 'Identity.User.*', + ], }, { title: 'Sign-in Report', path: '/identity/reports/signin-report', - permissions: ['Identity.User.*'], + permissions: [ + 'Identity.User.*', + ], }, { title: 'Microsoft Entra Connect Report', path: '/identity/reports/azure-ad-connect-report', - permissions: ['Identity.User.*'], + permissions: [ + 'Identity.User.*', + ], }, { title: 'Risk Detections', path: '/identity/reports/risk-detections', - permissions: ['Identity.User.*'], + permissions: [ + 'Identity.User.*', + ], }, { title: 'Group Usage Report', path: '/identity/reports/group-usage', - permissions: ['Identity.Group.*'], - }, - ], - }, - ], - }, - { - title: 'Tenant Administration', - type: 'header', - icon: ( - - - - ), - permissions: [ - 'Tenant.*', - 'Identity.AuditLog.*', - 'CIPP.Backup.*', - 'Scheduler.Billing.*', - ], - items: [ - { - title: 'Administration', - permissions: ['Tenant.Administration.*'], - items: [ - { - title: 'Tenants', - path: '/tenant/administration/tenants', - permissions: ['Tenant.Administration.*'], - scope: 'global', - }, - { - title: 'Alert Configuration', - path: '/tenant/administration/alert-configuration', - permissions: ['Tenant.Alert.*'], - scope: 'global', - }, - { - title: 'Audit Logs', - path: '/tenant/administration/audit-logs', - permissions: ['Identity.AuditLog.*'], - }, - { - title: 'Applications', - path: '/tenant/administration/applications/enterprise-apps', - permissions: ['Tenant.Application.*'], - }, - { - title: 'Secure Score', - path: '/tenant/administration/securescore', - permissions: ['Tenant.Administration.*'], - }, - { - title: 'App Consent Requests', - path: '/tenant/administration/app-consent-requests', - permissions: ['Tenant.Application.*'], - }, - { - title: 'Authentication Methods', - path: '/tenant/administration/authentication-methods', - permissions: ['Tenant.Config.*'], - }, - { - title: 'Partner Relationships', - path: '/tenant/administration/partner-relationships', - permissions: ['Tenant.Relationship.*'], - }, - { - title: 'Domains', - path: '/tenant/administration/domains', - permissions: ['Tenant.Administration.*'], - }, - { - title: "Service Health", - path: "/tenant/administration/service-health", - permissions: ["Tenant.Administration.*"], - // No docs page yet; the help link lands on the section until one is written. - docsPath: "tenant/administration", - }, - ], - }, - { - title: 'GDAP Management', - path: '/tenant/gdap-management', - permissions: ['Tenant.Relationship.*'], - scope: 'global', - }, - // Flag-gated swap: the Baselines feature flag lists this path in its Pages - // (hidden while the flag is off) and the classic Standards/Drift paths in - // HidesPages (hidden while it is on) - the two never show together. - { - title: 'Baselines', - path: '/tenant/baselines', - permissions: ['Tenant.Baselines.*'], - scope: 'global', - }, - { - title: 'Security Simulations', - path: '/tenant/security-simulator', - permissions: ['Tenant.SecuritySimulations.*'], - }, - { - title: 'Domains Analyser', - path: '/tenant/standards/domains-analyser', - permissions: ['Tenant.DomainAnalyser.*'], - scope: 'global', - }, - { - title: 'Standards & Drift', - path: '/tenant/standards/alignment', - permissions: ['Tenant.Standards.*'], - scope: 'global', - }, - { - title: 'Conditional Access', - permissions: ['Tenant.ConditionalAccess.*'], - items: [ - { - title: 'CA Policies', - path: '/tenant/conditional/list-policies', - permissions: ['Tenant.ConditionalAccess.*'], - }, - { - title: 'CA Templates', - path: '/tenant/conditional/list-template', - permissions: ['Tenant.ConditionalAccess.*'], - scope: 'global', - }, - { - title: 'Named Locations', - path: '/tenant/conditional/list-named-locations', - permissions: ['Tenant.ConditionalAccess.*'], - }, - ], - }, - { - title: 'Reports', - permissions: [ - 'Tenant.Administration.*', - 'Scheduler.Billing.*', - 'Tenant.Application.*', - ], - items: [ - { - title: 'Licence Report', - path: '/tenant/reports/list-licenses', - permissions: ['Tenant.Administration.*'], - }, - { - title: 'Sherweb Licence Report', - path: '/tenant/reports/list-csp-licenses', - permissions: ['Tenant.Directory.*'], - }, - { - title: 'Consented Applications', - path: '/tenant/reports/application-consent', - permissions: ['Tenant.Application.*'], - }, - { - title: 'Graph / Office Reports', - path: '/tenant/reports/graph-office-reports', - permissions: ['Tenant.Reports.*'], - }, - { - title: 'Custom Test Report', - path: '/tenant/reports/custom-test-report', - permissions: ['Tenant.Reports.*'], + permissions: [ + 'Identity.Group.*', + ], }, ], }, - { - title: 'Manage Tenant', - path: '/tenant/manage/edit', - permissions: ['Tenant.Administration.*'], - }, ], }, { @@ -337,90 +225,140 @@ export const nativeMenuItems = [ items: [ { title: 'Incidents & Alerts', - permissions: ['Security.Incident.*'], + permissions: [ + 'Security.Incident.*', + ], items: [ { title: 'Incidents', path: '/security/incidents/list-incidents', - permissions: ['Security.Incident.*'], + permissions: [ + 'Security.Incident.*', + ], }, { title: 'Alerts', path: '/security/incidents/list-alerts', - permissions: ['Security.Alert.*'], + permissions: [ + 'Security.Alert.*', + ], }, { title: 'Defender Alerts', path: '/security/incidents/list-mdo-alerts', - permissions: ['Security.Alert.*'], + permissions: [ + 'Security.Alert.*', + ], }, { title: 'Check Alerts', path: '/security/incidents/list-check-alerts', - permissions: ['Security.Alert.*'], + permissions: [ + 'Security.Alert.*', + ], }, ], }, { title: 'Defender', - permissions: ['Security.Alert.*'], + permissions: [ + 'Security.Alert.*', + ], items: [ { title: 'Defender Status', path: '/security/defender/list-defender', - permissions: ['Security.Alert.*'], + permissions: [ + 'Security.Alert.*', + ], }, { title: 'Defender Deployment', path: '/security/defender/deployment', - permissions: ['Security.Alert.*'], + permissions: [ + 'Security.Alert.*', + ], }, { title: 'Vulnerabilities', path: '/security/defender/list-defender-tvm', - permissions: ['Security.Alert.*'], + permissions: [ + 'Security.Alert.*', + ], }, { title: 'CVE Management', path: '/security/defender/defender-cve-exceptions', - permissions: ['Security.Alert.*'], + permissions: [ + 'Security.Alert.*', + ], + }, + ], + }, + { + title: "eDiscovery", + permissions: [ + "Security.Ediscovery.*", + ], + items: [ + { + title: "Cases", + path: "/security/ediscovery/cases", + permissions: [ + "Security.Ediscovery.*", + ], }, ], }, { title: 'Reports', - permissions: ['Tenant.DeviceCompliance.*', 'Security.Defender.*'], + permissions: [ + 'Tenant.DeviceCompliance.*', + 'Security.Defender.*', + ], items: [ { title: 'Device Compliance', path: '/security/reports/list-device-compliance', - permissions: ['Tenant.DeviceCompliance.*'], + permissions: [ + 'Tenant.DeviceCompliance.*', + ], }, { title: 'MDE Onboarding', path: '/security/reports/mde-onboarding', - permissions: ['Security.Defender.*'], + permissions: [ + 'Security.Defender.*', + ], }, { title: 'Vulnerability Report', path: '/security/reports/cve-report', - permissions: ['Security.Defender.*'], + permissions: [ + 'Security.Defender.*', + ], }, ], }, { title: 'Safe Links', - permissions: ['Security.SafeLinksPolicy.*'], + permissions: [ + 'Security.SafeLinksPolicy.*', + ], items: [ { title: 'Safe Links Policies', path: '/security/safelinks/safelinks', - permissions: ['Security.SafeLinksPolicy.*'], + permissions: [ + 'Security.SafeLinksPolicy.*', + ], }, { title: 'Safe Links Templates', path: '/security/safelinks/safelinks-template', - permissions: ['Security.SafeLinksPolicy.*'], + permissions: [ + 'Security.SafeLinksPolicy.*', + ], scope: 'global', }, ], @@ -437,45 +375,61 @@ export const nativeMenuItems = [ { title: 'DLP Policies', path: '/security/compliance/dlp', - permissions: ['Security.DlpCompliancePolicy.*'], + permissions: [ + 'Security.DlpCompliancePolicy.*', + ], }, { title: 'DLP Policy Templates', path: '/security/compliance/dlp-templates', - permissions: ['Security.DlpCompliancePolicy.*'], + permissions: [ + 'Security.DlpCompliancePolicy.*', + ], scope: 'global', }, { title: 'Retention Policies', path: '/security/compliance/retention', - permissions: ['Security.RetentionCompliancePolicy.*'], + permissions: [ + 'Security.RetentionCompliancePolicy.*', + ], }, { title: 'Retention Policy Templates', path: '/security/compliance/retention-templates', - permissions: ['Security.RetentionCompliancePolicy.*'], + permissions: [ + 'Security.RetentionCompliancePolicy.*', + ], scope: 'global', }, { title: 'Sensitivity Labels', path: '/security/compliance/labels', - permissions: ['Security.SensitivityLabel.*'], + permissions: [ + 'Security.SensitivityLabel.*', + ], }, { title: 'Sensitivity Label Templates', path: '/security/compliance/labels-templates', - permissions: ['Security.SensitivityLabel.*'], + permissions: [ + 'Security.SensitivityLabel.*', + ], scope: 'global', }, { title: 'Sensitive Information Types', path: '/security/compliance/sit', - permissions: ['Security.SensitiveInfoType.*'], + permissions: [ + 'Security.SensitiveInfoType.*', + ], }, { title: 'Sensitive Info Type Templates', path: '/security/compliance/sit-templates', - permissions: ['Security.SensitiveInfoType.*'], + permissions: [ + 'Security.SensitiveInfoType.*', + ], scope: 'global', }, ], @@ -554,131 +508,183 @@ export const nativeMenuItems = [ items: [ { title: 'Applications', - permissions: ['Endpoint.Application.*'], + permissions: [ + 'Endpoint.Application.*', + ], items: [ { title: 'Applications', path: '/endpoint/applications/list', - permissions: ['Endpoint.Application.*'], + permissions: [ + 'Endpoint.Application.*', + ], }, { title: 'Application Queue', path: '/endpoint/applications/queue', - permissions: ['Endpoint.Application.*'], + permissions: [ + 'Endpoint.Application.*', + ], }, { title: 'Application Templates', path: '/endpoint/applications/templates', docsPath: 'endpoint/applications/application-templates', - permissions: ['Endpoint.Application.*'], + permissions: [ + 'Endpoint.Application.*', + ], scope: 'global', }, ], }, { title: 'Autopilot & Enrollment', - permissions: ['Endpoint.Autopilot.*'], + permissions: [ + 'Endpoint.Autopilot.*', + ], items: [ { title: 'Autopilot Devices', path: '/endpoint/autopilot/list-devices', - permissions: ['Endpoint.Autopilot.*'], + permissions: [ + 'Endpoint.Autopilot.*', + ], }, { title: 'Add Autopilot Device', path: '/endpoint/autopilot/add-device', - permissions: ['Endpoint.Autopilot.*'], + permissions: [ + 'Endpoint.Autopilot.*', + ], + }, + { + title: 'Profiles', + path: '/endpoint/autopilot/list-profiles', + permissions: [ + 'Endpoint.Autopilot.*', + ], }, { title: 'Enrollment Profiles', path: '/endpoint/autopilot/enrollment-profiles', - permissions: ['Endpoint.Autopilot.*'], + permissions: [ + 'Endpoint.Autopilot.*', + ], }, { title: 'Status Pages', path: '/endpoint/autopilot/list-status-pages', - permissions: ['Endpoint.Autopilot.*'], + permissions: [ + 'Endpoint.Autopilot.*', + ], }, ], }, { title: 'Device Management', - permissions: ['Endpoint.MEM.*', 'Endpoint.Device.*'], + permissions: [ + 'Endpoint.MEM.*', + 'Endpoint.Device.*', + ], items: [ { title: 'Devices', path: '/endpoint/MEM/devices', docsPath: 'endpoint/mem/devices', - permissions: ['Endpoint.Device.*'], + permissions: [ + 'Endpoint.Device.*', + ], }, { title: 'BitLocker Key Search', path: '/endpoint/MEM/bitlocker-search', docsPath: 'endpoint/mem/bitlocker-search', - permissions: ['Endpoint.Device.*'], + permissions: [ + 'Endpoint.Device.*', + ], }, { title: 'Configuration Policies', path: '/endpoint/MEM/list-policies', docsPath: 'endpoint/mem/list-policies', - permissions: ['Endpoint.MEM.*'], + permissions: [ + 'Endpoint.MEM.*', + ], }, { title: 'Compliance Policies', path: '/endpoint/MEM/list-compliance-policies', docsPath: 'endpoint/mem/list-compliance-policies', - permissions: ['Endpoint.MEM.*'], + permissions: [ + 'Endpoint.MEM.*', + ], }, { title: 'App Policies', path: '/endpoint/MEM/list-appprotection-policies', docsPath: 'endpoint/mem/list-appprotection-policies', - permissions: ['Endpoint.MEM.*'], + permissions: [ + 'Endpoint.MEM.*', + ], }, { title: 'Policy Templates', path: '/endpoint/MEM/list-templates', docsPath: 'endpoint/mem/list-templates', - permissions: ['Endpoint.MEM.*'], + permissions: [ + 'Endpoint.MEM.*', + ], scope: 'global', }, { title: 'Reusable Settings', path: '/endpoint/MEM/reusable-settings', docsPath: 'endpoint/mem/reusable-settings', - permissions: ['Endpoint.MEM.*'], + permissions: [ + 'Endpoint.MEM.*', + ], }, { title: 'Reusable Settings Templates', path: '/endpoint/MEM/reusable-settings-templates', docsPath: 'endpoint/mem/reusable-settings-templates', - permissions: ['Endpoint.MEM.*'], + permissions: [ + 'Endpoint.MEM.*', + ], scope: 'global', }, { title: 'Assignment Filters', path: '/endpoint/MEM/assignment-filters', docsPath: 'endpoint/mem/assignment-filters', - permissions: ['Endpoint.MEM.*'], + permissions: [ + 'Endpoint.MEM.*', + ], }, { title: 'Assignment Filter Templates', path: '/endpoint/MEM/assignment-filter-templates', docsPath: 'endpoint/mem/assignment-filter-templates', - permissions: ['Endpoint.MEM.*'], + permissions: [ + 'Endpoint.MEM.*', + ], scope: 'global', }, { title: 'Scripts', path: '/endpoint/MEM/list-scripts', docsPath: 'endpoint/mem/list-scripts', - permissions: ['Endpoint.MEM.*'], + permissions: [ + 'Endpoint.MEM.*', + ], }, { title: 'MAA Requests', path: '/endpoint/MEM/approval-requests', docsPath: 'endpoint/mem/approval-requests', - permissions: ['Endpoint.MEM.*'], + permissions: [ + 'Endpoint.MEM.*', + ], }, ], }, @@ -693,96 +699,30 @@ export const nativeMenuItems = [ { title: 'Analytics Device Score', path: '/endpoint/reports/analyticsdevicescore', - permissions: ['Endpoint.Device.*'], + permissions: [ + 'Endpoint.Device.*', + ], }, { title: 'Work from Anywhere', path: '/endpoint/reports/workfromanywhere', - permissions: ['Endpoint.Device.*'], + permissions: [ + 'Endpoint.Device.*', + ], }, { title: 'Autopilot Deployments', path: '/endpoint/reports/autopilot-deployment', - permissions: ['Endpoint.Autopilot.*'], + permissions: [ + 'Endpoint.Autopilot.*', + ], }, { title: 'Discovered Apps', path: '/endpoint/reports/detected-apps', - permissions: ['Endpoint.MEM.*'], - }, - ], - }, - ], - }, - { - title: 'Teams & SharePoint', - type: 'header', - icon: ( - - - - ), - permissions: [ - 'Sharepoint.Site.*', - 'Sharepoint.Admin.*', - 'Teams.Group.*', - 'Teams.Activity.*', - 'Teams.Voice.*', - ], - items: [ - { - title: 'OneDrive', - path: '/teams-share/onedrive', - permissions: ['Sharepoint.Site.*'], - }, - { - title: 'SharePoint', - path: '/teams-share/sharepoint', - permissions: ['Sharepoint.Admin.*'], - }, - { - title: 'SharePoint Templates', - path: '/teams-share/sharepoint-templates', - permissions: ['Sharepoint.Admin.*'], - }, - { - title: 'Deleted Sites', - path: '/teams-share/deleted-sites', - permissions: ['Sharepoint.Admin.*'], - }, - { - title: 'Sharing Report', - path: '/teams-share/sharing-report', - permissions: ['Sharepoint.Site.*'], - }, - { - title: 'Permissions Report', - path: '/teams-share/permissions-report', - permissions: ['Sharepoint.Site.*'], - }, - { - title: 'External Users', - path: '/teams-share/external-users', - permissions: ['Sharepoint.Site.*'], - }, - { - title: 'Teams', - permissions: ['Teams.Group.*'], - items: [ - { - title: 'Teams', - path: '/teams-share/teams/list-team', - permissions: ['Teams.Group.*'], - }, - { - title: 'Teams Activity', - path: '/teams-share/teams/teams-activity', - permissions: ['Teams.Activity.*'], - }, - { - title: 'Business Voice', - path: '/teams-share/teams/business-voice', - permissions: ['Teams.Voice.*'], + permissions: [ + 'Endpoint.MEM.*', + ], }, ], }, @@ -811,147 +751,312 @@ export const nativeMenuItems = [ ], items: [ { - title: 'Administration', - permissions: ['Exchange.Mailbox.*'], + title: "Troubleshooting", + permissions: [ + "Exchange.Mailbox.*", + ], items: [ { - title: 'Mailboxes', - path: '/email/administration/mailboxes', - permissions: ['Exchange.Mailbox.*'], + title: "Email Troubleshooter", + path: "/email/troubleshooting/email-troubleshooter", + permissions: [ + "Exchange.Mailbox.*", + ], }, { - title: 'HVE Accounts', - path: '/email/administration/hve-accounts', - permissions: ['Exchange.Mailbox.*'], + title: "Quarantine", + path: "/email/administration/quarantine", + permissions: [ + "Exchange.SpamFilter.*", + ], + }, + { + title: "Message Trace", + path: "/email/tools/message-trace", + docsPath: "tools/email-tools/message-trace", + permissions: [ + "Exchange.Mailbox.*", + ], + }, + { + title: "Message Viewer", + path: "/email/troubleshooting/message-viewer", + docsPath: "tools/email-tools/message-viewer", + permissions: [ + "Exchange.Mailbox.*", + ], }, { - title: 'Deleted Mailboxes', - path: '/email/administration/deleted-mailboxes', - permissions: ['Exchange.Mailbox.*'], + title: "Mailbox Restores", + path: "/email/troubleshooting/mailbox-restores", + docsPath: "tools/email-tools/mailbox-restores", + permissions: [ + "Exchange.Mailbox.*", + ], }, + ], + }, + { + title: 'Administration', + permissions: [ + 'Exchange.Mailbox.*', + ], + items: [ { - title: 'Mailbox Rules', - path: '/email/administration/mailbox-rules', - permissions: ['Exchange.Mailbox.*'], + title: "Mailboxes", + permissions: [ + "Exchange.Mailbox.*", + ], + items: [ + { + title: "Mailboxes", + path: "/email/administration/mailboxes", + permissions: [ + "Exchange.Mailbox.*", + ], + }, + { + title: "Deleted Mailboxes", + path: "/email/administration/deleted-mailboxes", + permissions: [ + "Exchange.Mailbox.*", + ], + }, + { + title: "Mailbox Rules", + path: "/email/administration/mailbox-rules", + permissions: [ + "Exchange.Mailbox.*", + ], + }, + ], }, { title: 'Contacts', path: '/email/administration/contacts', - permissions: ['Exchange.Contact.*'], + permissions: [ + 'Exchange.Contact.*', + ], }, { title: 'Contact Templates', path: '/email/administration/contacts-template', - permissions: ['Exchange.Contact.*'], + permissions: [ + 'Exchange.Contact.*', + ], scope: 'global', }, { title: 'Quarantine', path: '/email/administration/quarantine', - permissions: ['Exchange.SpamFilter.*'], + permissions: [ + 'Exchange.SpamFilter.*', + ], }, { title: 'Restricted Users', path: '/email/administration/restricted-users', - permissions: ['Exchange.Mailbox.*'], + permissions: [ + 'Exchange.Mailbox.*', + ], }, { title: 'Tenant Allow/Block Lists', path: '/email/administration/tenant-allow-block-lists', - permissions: ['Exchange.SpamFilter.*'], + permissions: [ + 'Exchange.SpamFilter.*', + ], }, { title: 'Allow/Block List Templates', path: '/email/administration/tenant-allow-block-list-templates', - permissions: ['Exchange.SpamFilter.*'], + permissions: [ + 'Exchange.SpamFilter.*', + ], scope: 'global', }, { - title: 'Retention Policies & Tags', - path: '/email/administration/exchange-retention/policies', - permissions: ['Exchange.RetentionPolicies.*'], - }, + title: 'HVE Accounts', + path: '/email/administration/hve-accounts', + permissions: [ + 'Exchange.Mailbox.*', + ], + }, + { + title: 'Retention Policies & Tags', + path: '/email/administration/exchange-retention/policies', + permissions: [ + 'Exchange.RetentionPolicies.*', + ], + }, ], }, { title: 'Transport', - permissions: ['Exchange.TransportRule.*', 'Exchange.Connector.*'], + permissions: [ + 'Exchange.TransportRule.*', + 'Exchange.Connector.*', + ], items: [ { - title: 'Transport Rules', - path: '/email/transport/list-rules', - permissions: ['Exchange.TransportRule.*'], - }, - { - title: 'Transport Templates', - path: '/email/transport/list-templates', - permissions: ['Exchange.TransportRule.*'], - scope: 'global', - }, - { - title: 'Connectors', - path: '/email/transport/list-connectors', - permissions: ['Exchange.Connector.*'], - }, - { - title: 'Connector Templates', - path: '/email/transport/list-connector-templates', - permissions: ['Exchange.Connector.*'], - scope: 'global', + title: "Transport Rules", + permissions: [ + "Exchange.TransportRule.*", + ], + items: [ + { + title: "Transport Rules", + path: "/email/transport/list-rules", + permissions: [ + "Exchange.TransportRule.*", + ], + }, + { + title: "Transport Templates", + path: "/email/transport/list-templates", + permissions: [ + "Exchange.TransportRule.*", + ], + scope: "global", + }, + ], + }, + { + title: "Connectors", + permissions: [ + "Exchange.Connector.*", + ], + items: [ + { + title: "Connectors", + path: "/email/transport/list-connectors", + permissions: [ + "Exchange.Connector.*", + ], + }, + { + title: "Connector Templates", + path: "/email/transport/list-connector-templates", + permissions: [ + "Exchange.Connector.*", + ], + scope: "global", + }, + ], }, ], }, { - title: 'Spamfilter', - permissions: ['Exchange.SpamFilter.*', 'Exchange.ConnectionFilter.*'], + title: "Spam Filter", + permissions: [ + "Exchange.SpamFilter.*", + "Exchange.ConnectionFilter.*", + ], items: [ { - title: 'Spamfilter', - path: '/email/spamfilter/list-spamfilter', - permissions: ['Exchange.SpamFilter.*'], - }, - { - title: 'Spamfilter Templates', - path: '/email/spamfilter/list-templates', - permissions: ['Exchange.SpamFilter.*'], - scope: 'global', - }, - { - title: 'Connection Filter', - path: '/email/spamfilter/list-connectionfilter', - permissions: ['Exchange.ConnectionFilter.*'], + title: "Spam Filters", + permissions: [ + "Exchange.SpamFilter.*", + ], + items: [ + { + title: "Spam Filter Policies", + path: "/email/spamfilter/list-spamfilter", + permissions: [ + "Exchange.SpamFilter.*", + ], + }, + { + title: "Spam Filter Templates", + path: "/email/spamfilter/list-templates", + permissions: [ + "Exchange.SpamFilter.*", + ], + scope: "global", + }, + ], + }, + { + title: "Connection Filters", + permissions: [ + "Exchange.ConnectionFilter.*", + ], + items: [ + { + title: "Connection Filter", + path: "/email/spamfilter/list-connectionfilter", + permissions: [ + "Exchange.ConnectionFilter.*", + ], + }, + { + title: "Connection Filter Templates", + path: "/email/spamfilter/list-connectionfilter-templates", + permissions: [ + "Exchange.ConnectionFilter.*", + ], + scope: "global", + }, + ], + }, + { + title: "Quarantine Policies", + path: "/email/spamfilter/list-quarantine-policies", + permissions: [ + "Exchange.SpamFilter.*", + ], }, + ], + }, + { + title: "Safe Links", + permissions: [ + "Security.SafeLinksPolicy.*", + ], + items: [ { - title: 'Connection Filter Templates', - path: '/email/spamfilter/list-connectionfilter-templates', - permissions: ['Exchange.ConnectionFilter.*'], - scope: 'global', + title: "Safe Links Policies", + path: "/security/safelinks/safelinks", + permissions: [ + "Security.SafeLinksPolicy.*", + ], }, { - title: 'Quarantine Policies', - path: '/email/spamfilter/list-quarantine-policies', - permissions: ['Exchange.SpamFilter.*'], + title: "Safe Links Templates", + path: "/security/safelinks/safelinks-template", + permissions: [ + "Security.SafeLinksPolicy.*", + ], }, ], }, { title: 'Resource Management', - permissions: ['Exchange.Equipment.*', 'Exchange.Room.*'], + permissions: [ + 'Exchange.Equipment.*', + 'Exchange.Room.*', + ], items: [ { title: 'Equipment', path: '/email/resources/management/equipment', - permissions: ['Exchange.Equipment.*'], + permissions: [ + 'Exchange.Equipment.*', + ], }, { title: 'Rooms', path: '/email/resources/management/list-rooms', - permissions: ['Exchange.Room.*'], + permissions: [ + 'Exchange.Room.*', + ], }, { title: 'Room Lists', path: '/email/resources/management/room-lists', - permissions: ['Exchange.Room.*'], + permissions: [ + 'Exchange.Room.*', + ], }, ], }, @@ -964,71 +1069,681 @@ export const nativeMenuItems = [ 'Exchange.Group.*', ], items: [ + { + title: "Mailbox Reports", + permissions: [ + "Exchange.Mailbox.*", + ], + items: [ + { + title: "Mailbox Statistics", + path: "/email/reports/mailbox-statistics", + permissions: [ + "Exchange.Mailbox.*", + ], + }, + { + title: "Mailbox Activity", + path: "/email/reports/mailbox-activity", + permissions: [ + "Exchange.Mailbox.*", + ], + }, + { + title: "Client Access Settings", + path: "/email/reports/mailbox-cas-settings", + permissions: [ + "Exchange.Mailbox.*", + ], + }, + { + title: "Mailbox Permissions", + path: "/email/reports/mailbox-permissions", + permissions: [ + "Exchange.Mailbox.*", + ], + }, + { + title: "Calendar Permissions", + path: "/email/reports/calendar-permissions", + permissions: [ + "Exchange.Mailbox.*", + ], + }, + { + title: "Mailbox Forwarding", + path: "/email/reports/mailbox-forwarding", + permissions: [ + "Exchange.Mailbox.*", + ], + }, + { + title: "ActiveSync Devices", + path: "/email/reports/activesync-devices", + permissions: [ + "Exchange.Mailbox.*", + ], + }, + ], + }, + { + title: "Security Reports", + permissions: [ + "Exchange.SpamFilter.*", + "Exchange.SafeLinks.*", + ], + items: [ + { + title: "Anti-Phishing Filters", + path: "/email/reports/antiphishing-filters", + permissions: [ + "Exchange.SpamFilter.*", + ], + }, + { + title: "Malware Filters", + path: "/email/reports/malware-filters", + permissions: [ + "Exchange.SpamFilter.*", + ], + }, + { + title: "Safe Attachments Filters", + path: "/email/reports/safeattachments-filters", + permissions: [ + "Exchange.SafeLinks.*", + ], + }, + ], + }, { title: 'Mail Flow Statistics', path: '/email/reports/mail-flow-statistics', - permissions: ['Exchange.Mailbox.*'], + permissions: [ + 'Exchange.Mailbox.*', + ], }, { - title: 'Mailbox Statistics', - path: '/email/reports/mailbox-statistics', - permissions: ['Exchange.Mailbox.*'], + title: 'Shared Mailbox with Enabled Account', + path: '/email/reports/SharedMailboxEnabledAccount', + docsPath: 'email/reports/sharedmailboxenabledaccount', + permissions: [ + 'Exchange.Mailbox.*', + ], }, { - title: 'Mailbox Activity', - path: '/email/reports/mailbox-activity', - permissions: ['Exchange.Mailbox.*'], + title: 'Global Address List', + path: '/email/reports/global-address-list', + permissions: [ + 'Exchange.Group.*', + ], }, + ], + }, + ], + }, + { + title: 'Teams & SharePoint', + type: 'header', + icon: ( + + + + ), + permissions: [ + 'Sharepoint.Site.*', + 'Sharepoint.Admin.*', + 'Teams.Group.*', + 'Teams.Activity.*', + 'Teams.Voice.*', + ], + items: [ + { + title: "OneDrive", + permissions: [ + "Sharepoint.Site.*", + ], + items: [ { - title: 'Mailbox Client Access Settings', - path: '/email/reports/mailbox-cas-settings', - permissions: ['Exchange.Mailbox.*'], + title: "OneDrive Accounts", + path: "/teams-share/onedrive", + permissions: [ + "Sharepoint.Site.*", + ], }, + ], + }, + { + title: "File Management", + permissions: [ + "Sharepoint.Site.*", + ], + items: [ { - title: 'Mailbox Permissions', - path: '/email/reports/mailbox-permissions', - permissions: ['Exchange.Mailbox.*'], + title: "File Search", + path: "/teams-share/onedrive/file-search", + permissions: [ + "Sharepoint.Site.*", + ], }, { - title: 'Calendar Permissions', - path: '/email/reports/calendar-permissions', - permissions: ['Exchange.Mailbox.*'], + title: "File Browser", + path: "/teams-share/onedrive/file-browser", + permissions: [ + "Sharepoint.Site.*", + ], }, { - title: 'Mailbox Forwarding', - path: '/email/reports/mailbox-forwarding', - permissions: ['Exchange.Mailbox.*'], + title: "File Transfer", + path: "/teams-share/onedrive/file-transfer", + permissions: [ + "Sharepoint.Site.ReadWrite", + ], }, { - title: 'Anti-Phishing Filters', - path: '/email/reports/antiphishing-filters', - permissions: ['Exchange.SpamFilter.*'], + title: "Temp File Cleanup", + path: "/teams-share/sharepoint/temp-file-cleanup", + permissions: [ + "Sharepoint.Site.ReadWrite", + ], }, + ], + }, + { + title: "External Access", + permissions: [ + "Sharepoint.Site.*", + ], + items: [ { - title: 'Malware Filters', - path: '/email/reports/malware-filters', - permissions: ['Exchange.SpamFilter.*'], + title: "External Access Wizard", + path: "/teams-share/external-access", + permissions: [ + "Sharepoint.Site.ReadWrite", + ], }, { - title: 'Safe Attachments Filters', - path: '/email/reports/safeattachments-filters', - permissions: ['Exchange.SafeLinks.*'], + title: "Sharing Troubleshooter", + path: "/teams-share/troubleshooting/sharing-troubleshooter", + permissions: [ + "Sharepoint.Site.*", + ], }, + ], + }, + { + title: "SharePoint", + permissions: [ + "Sharepoint.Admin.*", + ], + items: [ { - title: 'Shared Mailbox with Enabled Account', - path: '/email/reports/SharedMailboxEnabledAccount', - docsPath: 'email/reports/sharedmailboxenabledaccount', - permissions: ['Exchange.Mailbox.*'], + title: "Dashboard", + path: "/teams-share/sharepoint/dashboard", + permissions: [ + "Sharepoint.Admin.*", + ], }, { - title: 'ActiveSync Devices', - path: '/email/reports/activesync-devices', - permissions: ['Exchange.Mailbox.*'], + title: "SharePoint Sites", + path: "/teams-share/sharepoint", + permissions: [ + "Sharepoint.Admin.*", + ], }, { - title: 'Global Address List', - path: '/email/reports/global-address-list', - permissions: ['Exchange.Group.*'], + title: "SharePoint Templates", + path: "/teams-share/sharepoint-templates", + permissions: [ + "Sharepoint.Admin.*", + ], + }, + { + title: "Sharing Settings", + path: "/teams-share/sharepoint/sharing-settings", + permissions: [ + "Sharepoint.Admin.*", + ], + }, + { + title: "Sharing Report", + path: "/teams-share/sharing-report", + permissions: [ + "Sharepoint.Site.*", + ], + }, + { + title: "Permissions Report", + path: "/teams-share/permissions-report", + permissions: [ + "Sharepoint.Site.*", + ], + }, + { + title: "External Users", + path: "/teams-share/external-users", + permissions: [ + "Sharepoint.Site.*", + ], + }, + { + title: "Recycle Bin", + path: "/teams-share/sharepoint/recycle-bin", + permissions: [ + "Sharepoint.Site.ReadWrite", + ], + }, + { + title: "Deleted Sites", + path: "/teams-share/deleted-sites", + permissions: [ + "Sharepoint.Admin.*", + ], + }, + { + title: "Image Optimizer", + path: "/teams-share/sharepoint/image-optimizer", + permissions: [ + "Sharepoint.Site.ReadWrite", + ], + }, + ], + }, + { + title: 'Teams', + permissions: [ + 'Teams.Group.*', + ], + items: [ + { + title: 'Teams', + path: '/teams-share/teams/list-team', + permissions: [ + 'Teams.Group.*', + ], + }, + { + title: "Teams Settings", + path: "/teams-share/teams/teams-settings", + permissions: [ + "Teams.Group.*", + ], + }, + { + title: 'Teams Activity', + path: '/teams-share/teams/teams-activity', + permissions: [ + 'Teams.Activity.*', + ], + }, + { + title: "Business Voice", + permissions: [ + "Teams.Voice.*", + ], + items: [ + { + title: "Phone Numbers", + path: "/teams-share/teams/business-voice", + permissions: [ + "Teams.Voice.*", + ], + }, + { + title: "Call Queues", + path: "/teams-share/teams/business-voice/call-queues", + permissions: [ + "Teams.Voice.*", + ], + }, + { + title: "Auto Attendants", + path: "/teams-share/teams/business-voice/auto-attendants", + permissions: [ + "Teams.Voice.*", + ], + }, + { + title: "Dial Plans", + path: "/teams-share/teams/business-voice/dial-plans", + permissions: [ + "Teams.Voice.*", + ], + }, + ], + }, + ], + }, + ], + }, + { + title: "Dynamics 365", + type: "header", + icon: ( + + + + ), + permissions: [ + "Dynamics.Environment.*", + "Dynamics.User.*", + "Dynamics.SecurityRole.*", + "Dynamics.BusinessUnit.*", + "Dynamics.Solution.*", + ], + items: [ + { + title: "Environments", + path: "/dynamics/environments", + permissions: [ + "Dynamics.Environment.*", + ], + }, + { + title: "Administration", + permissions: [ + "Dynamics.User.*", + "Dynamics.SecurityRole.*", + "Dynamics.BusinessUnit.*", + ], + items: [ + { + title: "Users", + path: "/dynamics/administration/users", + permissions: [ + "Dynamics.User.*", + ], + }, + { + title: "Security Roles", + path: "/dynamics/administration/security-roles", + permissions: [ + "Dynamics.SecurityRole.*", + ], + }, + { + title: "Business Units", + path: "/dynamics/administration/business-units", + permissions: [ + "Dynamics.BusinessUnit.*", + ], + }, + { + title: "Solutions", + path: "/dynamics/administration/solutions", + permissions: [ + "Dynamics.Solution.*", + ], + }, + ], + }, + ], + }, + { + title: 'Tenant Administration', + type: 'header', + icon: ( + + + + ), + permissions: [ + 'Tenant.*', + 'Identity.AuditLog.*', + 'CIPP.Backup.*', + 'Scheduler.Billing.*', + ], + items: [ + { + title: 'Administration', + permissions: [ + 'Tenant.Administration.*', + ], + items: [ + { + title: "Tenants", + permissions: [ + "Tenant.Administration.*", + ], + items: [ + { + title: "Tenants", + path: "/tenant/administration/tenants", + permissions: [ + "Tenant.Administration.*", + ], + scope: "global", + }, + { + title: "Manage Tenant", + path: "/tenant/manage/edit", + permissions: [ + "Tenant.Administration.*", + ], + }, + ], + }, + { + title: "Monitoring", + permissions: [ + "Tenant.Alert.*", + "Identity.AuditLog.*", + ], + items: [ + { + title: "Alert Configuration", + path: "/tenant/administration/alert-configuration", + permissions: [ + "Tenant.Alert.*", + ], + scope: "global", + }, + { + title: "Audit Logs", + path: "/tenant/administration/audit-logs", + permissions: [ + "Identity.AuditLog.*", + ], + }, + ], + }, + { + title: "Applications", + permissions: [ + "Tenant.Application.*", + ], + items: [ + { + title: "Applications", + path: "/tenant/administration/applications/enterprise-apps", + permissions: [ + "Tenant.Application.*", + ], + }, + { + title: "App Consent Requests", + path: "/tenant/administration/app-consent-requests", + permissions: [ + "Tenant.Application.*", + ], + }, + ], + }, + { + title: 'Secure Score', + path: '/tenant/administration/securescore', + permissions: [ + 'Tenant.Administration.*', + ], + }, + { + title: 'Authentication Methods', + path: '/tenant/administration/authentication-methods', + permissions: [ + 'Tenant.Config.*', + ], + }, + { + title: 'Partner Relationships', + path: '/tenant/administration/partner-relationships', + permissions: [ + 'Tenant.Relationship.*', + ], + }, + { + title: 'Domains', + path: '/tenant/administration/domains', + permissions: [ + 'Tenant.Administration.*', + ], + }, + { + title: "Service Health", + path: "/tenant/administration/service-health", + permissions: ["Tenant.Administration.*"], + // No docs page yet; the help link lands on the section until one is written. + docsPath: "tenant/administration", + }, + { + title: "Cross-Tenant Access", + path: "/tenant/administration/cross-tenant-access", + // No docs page yet; the help link lands on the section until one is written. + docsPath: "tenant/administration", + permissions: [ + "Tenant.CrossTenant.*", + ], + }, + ], + }, + { + title: 'GDAP Management', + path: '/tenant/gdap-management', + permissions: [ + 'Tenant.Relationship.*', + ], + scope: 'global', + }, + { + title: "Standards & Drift", + permissions: [ + "Tenant.Standards.*", + "Tenant.BestPracticeAnalyser.*", + "Tenant.DomainAnalyser.*", + ], + items: [ + { + title: "Standards Management", + path: "/tenant/standards/alignment", + permissions: [ + "Tenant.Standards.*", + ], + scope: "global", + }, + { + title: "Baselines", + path: "/tenant/baselines", + permissions: [ + "Tenant.Baselines.*", + ], + scope: "global", + }, + { + title: "Best Practice Analyser", + path: "/tenant/standards/bpa-report", + permissions: [ + "Tenant.BestPracticeAnalyser.*", + ], + scope: "global", + }, + { + title: "Domains Analyser", + path: "/tenant/standards/domains-analyser", + permissions: [ + "Tenant.DomainAnalyser.*", + ], + scope: "global", + }, + ], + }, + // The Baselines flag hides /tenant/standards/alignment while it is on, and hides + // /tenant/baselines while it is off. Both entries live in this group. + { + title: 'Security Simulations', + path: '/tenant/security-simulator', + permissions: ['Tenant.SecuritySimulations.*'], + }, + { + title: 'Conditional Access', + permissions: [ + 'Tenant.ConditionalAccess.*', + ], + items: [ + { + title: 'CA Policies', + path: '/tenant/conditional/list-policies', + permissions: [ + 'Tenant.ConditionalAccess.*', + ], + }, + { + title: "CA Vacation Mode", + path: "/tenant/conditional/deploy-vacation", + permissions: [ + "Tenant.ConditionalAccess.*", + ], + }, + { + title: 'CA Templates', + path: '/tenant/conditional/list-template', + permissions: [ + 'Tenant.ConditionalAccess.*', + ], + scope: 'global', + }, + { + title: 'Named Locations', + path: '/tenant/conditional/list-named-locations', + permissions: [ + 'Tenant.ConditionalAccess.*', + ], + }, + ], + }, + { + title: 'Reports', + permissions: [ + 'Tenant.Administration.*', + 'Scheduler.Billing.*', + 'Tenant.Application.*', + ], + items: [ + { + title: 'Licence Report', + path: '/tenant/reports/list-licenses', + permissions: [ + 'Tenant.Administration.*', + ], + }, + { + title: 'Consented Applications', + path: '/tenant/reports/application-consent', + permissions: [ + 'Tenant.Application.*', + ], + }, + { + title: 'Graph / Office Reports', + path: '/tenant/reports/graph-office-reports', + permissions: [ + 'Tenant.Reports.*', + ], + }, + { + title: 'Custom Test Report', + path: '/tenant/reports/custom-test-report', + permissions: [ + 'Tenant.Reports.*', + ], }, ], }, @@ -1054,32 +1769,33 @@ export const nativeMenuItems = [ items: [ { title: 'Tenant Tools', - permissions: ['Tenant.Administration.*'], + permissions: [ + 'Tenant.Administration.*', + ], items: [ { title: 'Graph Explorer', path: '/tenant/tools/graph-explorer', docsPath: 'tools/tenant-tools/graph-explorer', - permissions: ['Tenant.Administration.*'], - }, - { - title: 'Tenant Lookup', - path: '/tenant/tools/tenantlookup', - docsPath: 'tools/tenant-tools/tenantlookup', - permissions: ['Tenant.Administration.*'], - scope: 'global', + permissions: [ + 'Tenant.Administration.*', + ], }, { title: 'Application Approval', path: '/tenant/tools/appapproval', docsPath: 'tools/tenant-tools/appapproval', - permissions: ['Tenant.Application.*'], + permissions: [ + 'Tenant.Application.*', + ], }, { - title: 'Individual Domain Check', - path: '/tenant/tools/individual-domains', - docsPath: 'tools/tenant-tools/individual-domains', - permissions: ['Tenant.DomainAnalyser.*'], + title: 'Tenant Lookup', + path: '/tenant/tools/tenantlookup', + docsPath: 'tools/tenant-tools/tenantlookup', + permissions: [ + 'Tenant.Administration.*', + ], scope: 'global', }, { @@ -1089,47 +1805,77 @@ export const nativeMenuItems = [ permissions: ['CIPP.IPDatabase.*'], scope: 'global', }, + { + title: 'Individual Domain Check', + path: '/tenant/tools/individual-domains', + docsPath: 'tools/tenant-tools/individual-domains', + permissions: [ + 'Tenant.DomainAnalyser.*', + ], + scope: 'global', + }, ], }, { title: 'Email Tools', - permissions: ['Exchange.Mailbox.*'], + permissions: [ + 'Exchange.Mailbox.*', + ], items: [ + { + title: "Mail Test", + path: "/email/tools/mail-test", + permissions: [ + "Exchange.Mailbox.*", + ], + }, { title: 'Message Trace', path: '/email/tools/message-trace', docsPath: 'tools/email-tools/message-trace', - permissions: ['Exchange.Mailbox.*'], + permissions: [ + 'Exchange.Mailbox.*', + ], }, { title: 'Message Viewer', path: '/email/tools/message-viewer', docsPath: 'tools/email-tools/message-viewer', - permissions: ['Exchange.Mailbox.*'], + permissions: [ + 'Exchange.Mailbox.*', + ], }, { title: 'Mailbox Restores', path: '/email/tools/mailbox-restores', docsPath: 'tools/email-tools/mailbox-restores', - permissions: ['Exchange.Mailbox.*'], + permissions: [ + 'Exchange.Mailbox.*', + ], }, { title: 'Message Encryption', path: '/email/tools/message-encryption', docsPath: 'tools/email-tools/message-encryption', - permissions: ['Exchange.Mailbox.*'], + permissions: [ + 'Exchange.Mailbox.*', + ], }, ], }, { title: 'Intune Tools', - permissions: ['Endpoint.MEM.*'], + permissions: [ + 'Endpoint.MEM.*', + ], items: [ { title: 'Compare Policies', path: '/endpoint/MEM/compare-policies', docsPath: 'tools/intune-tools/compare-policies', - permissions: ['Endpoint.MEM.*'], + permissions: [ + 'Endpoint.MEM.*', + ], scope: 'global', }, ], @@ -1154,6 +1900,19 @@ export const nativeMenuItems = [ }, ], }, + { + title: 'Template Library', + path: '/tools/templatelib', + roles: [ + 'editor', + 'admin', + 'superadmin', + ], + permissions: [ + 'CIPP.TemplateLibrary.*', + ], + scope: 'global', + }, { title: 'Report Builder', path: '/tools/report-builder/generated', @@ -1168,13 +1927,6 @@ export const nativeMenuItems = [ permissions: ['CIPP.Tests.*'], scope: 'global', }, - { - title: 'Template Library', - path: '/tools/templatelib', - roles: ['editor', 'admin', 'superadmin'], - permissions: ['CIPP.TemplateLibrary.*'], - scope: 'global', - }, { title: 'Catalog', path: '/tools/community-repos', @@ -1185,21 +1937,34 @@ export const nativeMenuItems = [ { title: 'Template Package Manager', path: '/tools/template-packages', - roles: ['editor', 'admin', 'superadmin'], - permissions: ['Tenant.ConditionalAccess.*', 'Endpoint.MEM.*'], + roles: [ + 'editor', + 'admin', + 'superadmin', + ], + permissions: [ + 'Tenant.ConditionalAccess.*', + 'Endpoint.MEM.*', + ], scope: 'global', }, { title: 'Scheduler', path: '/cipp/scheduler', docsPath: 'tools/scheduler', - roles: ['editor', 'admin', 'superadmin'], - permissions: ['CIPP.Scheduler.*'], + roles: [ + 'editor', + 'admin', + 'superadmin', + ], + permissions: [ + 'CIPP.Scheduler.*', + ], }, ], }, { - title: 'CIPP', + title: 'Manage365', type: 'header', icon: ( @@ -1207,14 +1972,19 @@ export const nativeMenuItems = [ ), permissions: [ - 'CIPP.*', // Pattern matching - matches any CIPP permission + 'CIPP.*', ], items: [ { title: 'Application Settings', path: '/cipp/settings', - roles: ['admin', 'superadmin'], - permissions: ['CIPP.AppSettings.*'], + roles: [ + 'admin', + 'superadmin', + ], + permissions: [ + 'CIPP.AppSettings.*', + ], scope: 'global', }, { @@ -1227,41 +1997,68 @@ export const nativeMenuItems = [ { title: 'Setup Wizard', path: '/onboardingv2', - roles: ['admin', 'superadmin'], - permissions: ['CIPP.AppSettings.*'], + roles: [ + 'admin', + 'superadmin', + ], + permissions: [ + 'CIPP.AppSettings.*', + ], scope: 'global', }, { title: 'Integrations', path: '/cipp/integrations', - roles: ['admin', 'superadmin'], - permissions: ['CIPP.Extension.*'], + roles: [ + 'admin', + 'superadmin', + ], + permissions: [ + 'CIPP.Extension.*', + ], scope: 'global', }, { title: 'Custom Data', path: '/cipp/custom-data/directory-extensions', - roles: ['admin', 'superadmin'], - permissions: ['CIPP.AppSettings.*'], + roles: [ + 'admin', + 'superadmin', + ], + permissions: [ + 'CIPP.AppSettings.*', + ], scope: 'global', }, { title: 'Advanced', - roles: ['superadmin'], - permissions: ['CIPP.SuperAdmin.*'], + roles: [ + 'superadmin', + ], + permissions: [ + 'CIPP.SuperAdmin.*', + ], items: [ { title: 'Super Admin', path: '/cipp/advanced/super-admin/tenant-mode', - roles: ['superadmin'], - permissions: ['CIPP.SuperAdmin.*'], + roles: [ + 'superadmin', + ], + permissions: [ + 'CIPP.SuperAdmin.*', + ], scope: 'global', }, { title: 'Container Management', path: '/cipp/advanced/container-management/status', - roles: ['superadmin'], - permissions: ['CIPP.SuperAdmin.*'], + roles: [ + 'superadmin', + ], + permissions: [ + 'CIPP.SuperAdmin.*', + ], scope: 'global', }, { @@ -1272,43 +2069,67 @@ export const nativeMenuItems = [ // SSO and SAM App pages) on non-NG instances. title: 'Authentication', path: '/cipp/advanced/authentication/cipp-roles', - roles: ['superadmin'], - permissions: ['CIPP.SuperAdmin.*'], + roles: [ + 'superadmin', + ], + permissions: [ + 'CIPP.SuperAdmin.*', + ], scope: 'global', }, { title: 'Exchange Cmdlets', path: '/cipp/advanced/exchange-cmdlets', - roles: ['superadmin'], - permissions: ['CIPP.SuperAdmin.*'], + roles: [ + 'superadmin', + ], + permissions: [ + 'CIPP.SuperAdmin.*', + ], scope: 'global', }, { title: 'Timers', path: '/cipp/advanced/timers', - roles: ['superadmin'], - permissions: ['CIPP.SuperAdmin.*'], + roles: [ + 'superadmin', + ], + permissions: [ + 'CIPP.SuperAdmin.*', + ], scope: 'global', }, { title: 'Table Maintenance', path: '/cipp/advanced/table-maintenance', - roles: ['superadmin'], - permissions: ['CIPP.SuperAdmin.*'], + roles: [ + 'superadmin', + ], + permissions: [ + 'CIPP.SuperAdmin.*', + ], scope: 'global', }, { title: 'CIPPDB Cache', path: '/cipp/advanced/cippdb-cache', - roles: ['superadmin'], - permissions: ['CIPP.SuperAdmin.*'], + roles: [ + 'superadmin', + ], + permissions: [ + 'CIPP.SuperAdmin.*', + ], scope: 'global', }, { title: 'Diagnostics', path: '/cipp/advanced/diagnostics', - roles: ['superadmin'], - permissions: ['CIPP.SuperAdmin.*'], + roles: [ + 'superadmin', + ], + permissions: [ + 'CIPP.SuperAdmin.*', + ], scope: 'global', }, ], diff --git a/frontend/src/layouts/constants.js b/frontend/src/layouts/constants.js index 3a95916763..6582467855 100644 --- a/frontend/src/layouts/constants.js +++ b/frontend/src/layouts/constants.js @@ -1,6 +1,6 @@ // Shared layout chrome dimensions. // -// These used to be redeclared per file and had drifted apart - layouts/index.js padded the content +// These used to be redeclared per file and had drifted apart - layouts/index.jsx padded the content // by 50px against a nav that top-nav.js and side-nav.js both rendered at 64px, so content sat 14px // underneath it. Keep them here so the fixed nav, the side nav, and the content offset can't // disagree again. diff --git a/frontend/src/layouts/footer.jsx b/frontend/src/layouts/footer.jsx index d6bd01193b..33431dc64e 100644 --- a/frontend/src/layouts/footer.jsx +++ b/frontend/src/layouts/footer.jsx @@ -1,8 +1,8 @@ +import { memo } from "react"; import { Container } from "@mui/material"; -export const Footer = () => { +export const Footer = memo(() => { - //randomize the order of the sponsor images return (
        @@ -31,4 +31,6 @@ export const Footer = () => { >
        ); -}; +}); + +Footer.displayName = "Footer"; diff --git a/frontend/src/layouts/index.jsx b/frontend/src/layouts/index.jsx index b1db9cb150..7099f27c2d 100644 --- a/frontend/src/layouts/index.jsx +++ b/frontend/src/layouts/index.jsx @@ -1,6 +1,16 @@ import { useCallback, useEffect, useMemo, useState, useRef } from 'react' import { usePathname, useSearchParams } from 'next/navigation' -import { Box, Container, Divider, Stack } from '@mui/material' +import dynamic from 'next/dynamic' +import { + Alert, + Box, + Button, + Container, + Dialog, + DialogContent, + DialogTitle, + Stack, +} from '@mui/material' import { styled } from '@mui/material/styles' import { useIsMobileLayout } from '../hooks/use-breakpoint' import { useSettings } from '../hooks/use-settings' @@ -13,6 +23,7 @@ import { useDispatch } from 'react-redux' import { showToast } from '../store/toasts' import Grid from '@mui/system/Grid' import { CippImageCard } from '../components/CippCards/CippImageCard' +import { useDialog } from '../hooks/use-dialog' import { nativeMenuItems } from './config' import { CippBreadcrumbNav } from '../components/CippComponents/CippBreadcrumbNav' import { SsoMigrationDialog } from '../components/CippComponents/SsoMigrationDialog' @@ -29,6 +40,11 @@ import { SIDE_NAV_WIDTH, } from './constants' +const OnboardingWizardPage = dynamic( + () => import('../components/CippWizard/OnboardingWizardPage.jsx'), + { ssr: false } +) + const useMobileNav = () => { const pathname = usePathname() const [open, setOpen] = useState(false) @@ -131,7 +147,10 @@ export const Layout = (props) => { return } - // Get hidden pages from feature flags - only filter if we have valid data. + setHideSidebar(false) + + // A DISABLED flag hides its Pages; an ENABLED flag hides its HidesPages + // (Baselines supersedes classic Standards and Drift). Do not force the flag on. const hiddenPages = featureFlags.isSuccess ? getHiddenPages(featureFlags.data) : [] const filteredMenu = filterMenuItems(nativeMenuItems, { @@ -140,10 +159,11 @@ export const Layout = (props) => { }) setMenuItems(filteredMenu) } else if ( - swaStatus.isLoading || - swaStatus.data?.clientPrincipal === null || - swaStatus.data === undefined || - currentRole.isLoading + !currentRole.data?.clientPrincipal?.userRoles && + (swaStatus.isLoading || + swaStatus.data?.clientPrincipal === null || + swaStatus.data === undefined || + currentRole.isLoading) ) { setHideSidebar(true) } @@ -223,8 +243,6 @@ export const Layout = (props) => { keepPreviousData: true, }) - // Hosted maintenance notice, if the instance has one set. Derived from the alerts already - // fetched above rather than a second request. const maintenanceAlert = useMemo( () => alertsAPI.data?.find((alert) => alert.maintenance === true) ?? null, [alertsAPI.data] @@ -242,12 +260,12 @@ export const Layout = (props) => { setFetchingVisible(new Array(alertsAPI.data.length).fill(true)) } }, [alertsAPI.isSuccess, alertsAPI.data, alertsAPI.isFetching]) + const [setupCompleted, setSetupCompleted] = useState(true) + const createDialog = useDialog() const dispatch = useDispatch() useEffect(() => { if (alertsAPI.isSuccess && !alertsAPI.isFetching) { if (alertsAPI.data.length > 0) { - // The maintenance notice renders as its own banner - toasting it too would surface the - // same message three times per page load (banner, snackbar, notification bell). alertsAPI.data .filter((alert) => !alert.maintenance) .forEach((alert) => { @@ -261,6 +279,14 @@ export const Layout = (props) => { }) } } + if (alertsAPI.isSuccess && !alertsAPI.isFetching) { + if (alertsAPI.data.length > 0) { + const setupCompleted = alertsAPI.data.find((alert) => alert.setupCompleted === false) + if (setupCompleted) { + setSetupCompleted(false) + } + } + } }, [alertsAPI.isSuccess]) return ( @@ -297,6 +323,27 @@ export const Layout = (props) => { }} > + + Setup Wizard + + + + + {!setupCompleted && ( + + + + Setup has not been completed. + + + + + )} diff --git a/frontend/src/layouts/mobile-nav.jsx b/frontend/src/layouts/mobile-nav.jsx index 9adb716c2d..e2837431c7 100644 --- a/frontend/src/layouts/mobile-nav.jsx +++ b/frontend/src/layouts/mobile-nav.jsx @@ -5,7 +5,6 @@ import { usePathname } from "next/navigation"; import PropTypes from "prop-types"; import { Box, Divider, InputAdornment, OutlinedInput, Stack, SwipeableDrawer, Typography } from "@mui/material"; import { Logo } from "../components/logo"; -import { CippSponsor } from "../components/CippComponents/CippSponsor"; import { Scrollbar } from "../components/scrollbar"; import { paths } from "../paths"; import { MobileNavItem } from "./mobile-nav-item"; @@ -141,7 +140,7 @@ export const MobileNav = (props) => { // desktop side-nav renders on background.default, keep the drawer on the same surface backgroundColor: "background.default", width: MOBILE_NAV_WIDTH, - // Column layout so the sponsor footer pins to the bottom and the menu scrolls + // Column layout so the menu scrolls inside the drawer. // between it and the sticky header, rather than the footer riding the list. display: "flex", flexDirection: "column", @@ -155,14 +154,18 @@ export const MobileNav = (props) => { component={NextLink} href={paths.index} onClick={onClose} + aria-label="Manage365 V2" sx={{ display: "inline-flex", - height: 24, - width: 24, + alignItems: "center", + height: 40, mb: 1.5, + color: "inherit", + textDecoration: "none", + "&:hover": { textDecoration: "none" }, }} > - +         { - {/* Pinned below the scrolling menu rather than at the end of it, so it stays visible - without the long nav list pushing it off-screen. Compact: the drawer's vertical - space belongs to navigation. */} - - - ); }; diff --git a/frontend/src/layouts/side-nav-item.jsx b/frontend/src/layouts/side-nav-item.jsx index bc02bdd10e..4bdc44886d 100644 --- a/frontend/src/layouts/side-nav-item.jsx +++ b/frontend/src/layouts/side-nav-item.jsx @@ -1,8 +1,14 @@ import { useCallback, useState } from "react"; -import { CippIcons } from "../utils/icon-registry"; import NextLink from "next/link"; import PropTypes from "prop-types"; +import ChevronRightIcon from "@heroicons/react/24/outline/ChevronRightIcon"; +import ChevronDownIcon from "@heroicons/react/24/outline/ChevronDownIcon"; +import ArrowTopRightOnSquareIcon from "@heroicons/react/24/outline/ArrowTopRightOnSquareIcon"; import { Box, ButtonBase, Collapse, SvgIcon, Stack } from "@mui/material"; +import { alpha } from "@mui/material/styles"; +import BookmarkBorderIcon from "@mui/icons-material/BookmarkBorder"; +import BookmarkIcon from "@mui/icons-material/Bookmark"; +import LanguageIcon from "@mui/icons-material/Language"; import { useUserBookmarks } from "../hooks/use-user-bookmarks"; import { useSettings } from "../hooks/use-settings"; @@ -15,31 +21,38 @@ export const SideNavItem = (props) => { depth = 0, external = false, icon, - openImmediately = false, + open = false, + onToggle, path, scope, title, } = props; const isGlobal = scope === "global"; - - const [open, setOpen] = useState(openImmediately); const [hovered, setHovered] = useState(false); - const { isBookmarked: isPathBookmarked, toggleBookmark } = useUserBookmarks(); + const { bookmarks, setBookmarks } = useUserBookmarks(); const settings = useSettings(); const compactNav = settings.compactNav ?? false; - const isBookmarked = isPathBookmarked(path); + const isBookmarked = bookmarks.some((bookmark) => bookmark.path === path); const handleToggle = useCallback(() => { - setOpen((prevOpen) => !prevOpen); - }, []); + if (onToggle) { + onToggle(); + } + }, [onToggle]); const handleBookmarkToggle = useCallback( (event) => { event.stopPropagation(); - toggleBookmark({ label: title, path, category: category || "" }); + setBookmarks( + isBookmarked + ? bookmarks.filter((bookmark) => bookmark.path !== path) + : bookmarks.length >= 50 + ? bookmarks + : [...bookmarks, { label: title, path, category: category || "" }] + ); }, - [toggleBookmark, path, title, category] + [isBookmarked, bookmarks, setBookmarks, path, title, category] ); // Dynamic spacing and font sizing based on depth @@ -52,11 +65,9 @@ export const SideNavItem = (props) => {
      • setHovered(true)} onMouseLeave={() => setHovered(false)} - sx={{ - alignItems: "center" - }} > { textAlign: "left", whiteSpace: "nowrap", width: "100%", + transition: "all 150ms ease-out", + "&:hover": { + backgroundColor: "action.hover", + transform: "translateX(4px)", + }, }} > { }), }} > - {open ? : } + {open ? : } @@ -167,8 +183,16 @@ export const SideNavItem = (props) => { justifyContent: "flex-start", textAlign: "left", whiteSpace: "nowrap", - width: "calc(100% - 20px)", // Adjust the width to leave space for the bookmark icon + width: "calc(100% - 20px)", py: navItemPy, + transition: "all 150ms ease-out", + "&:hover": { + backgroundColor: "action.hover", + transform: "translateX(4px)", + }, + ...(active && { + backgroundColor: (theme) => alpha(theme.palette.primary.main, theme.palette.mode === "dark" ? 0.12 : 0.08), + }), }} {...linkProps} onClick={(e) => e.currentTarget.blur()} @@ -225,7 +249,7 @@ export const SideNavItem = (props) => { }} > - + )} @@ -240,7 +264,7 @@ export const SideNavItem = (props) => { }), }} > - + )} @@ -255,7 +279,7 @@ export const SideNavItem = (props) => { display: hovered ? "block" : "none", }} > - {isBookmarked ? : } + {isBookmarked ? : }
        • @@ -269,7 +293,8 @@ SideNavItem.propTypes = { depth: PropTypes.number, external: PropTypes.bool, icon: PropTypes.any, - openImmediately: PropTypes.bool, + open: PropTypes.bool, + onToggle: PropTypes.func, path: PropTypes.string, scope: PropTypes.string, title: PropTypes.string.isRequired, diff --git a/frontend/src/layouts/side-nav.jsx b/frontend/src/layouts/side-nav.jsx index c9f83a31bd..6e5762de34 100644 --- a/frontend/src/layouts/side-nav.jsx +++ b/frontend/src/layouts/side-nav.jsx @@ -1,11 +1,10 @@ -import { useState, useRef, useEffect } from 'react' +import { useState, useRef, useEffect, useCallback, memo } from 'react' import { usePathname } from 'next/navigation' import PropTypes from 'prop-types' import { Box, Divider, Drawer, Stack } from '@mui/material' import { SideNavItem } from './side-nav-item' import { SideNavBookmarks } from './side-nav-bookmarks' import { ApiGetCall } from '../api/ApiCall.jsx' -import { CippSponsor } from '../components/CippComponents/CippSponsor' import { useSettings } from '../hooks/use-settings' import { @@ -22,46 +21,97 @@ const isPathPrefix = (pathname, itemPath) => { return pathname.startsWith(itemPath + '/') || pathname.startsWith(itemPath + '?') } -const markOpenItems = (items, pathname) => { - return items.map((item) => { - const checkPath = !!(item.path && pathname) - const exactMatch = checkPath ? pathname === item.path : false - const partialMatch = checkPath ? isPathPrefix(pathname, item.path) : false +// Parent menu titles that lead to the active leaf. Used by the controlled accordion. +const findActiveMenuPath = (items, pathname, parentPath = []) => { + if (!items || !pathname) return [] - let openImmediately = exactMatch - let newItems = item.items || [] + for (const item of items) { + const hasChildren = item.items && item.items.length > 0 - if (newItems.length > 0) { - newItems = markOpenItems(newItems, pathname) - const childOpen = newItems.some((child) => child.openImmediately) - openImmediately = openImmediately || childOpen || exactMatch // Ensure parent opens if child is open - } else { - openImmediately = openImmediately || partialMatch // Leaf items open on partial match + if (hasChildren) { + const childResult = findActiveMenuPath(item.items, pathname, [...parentPath, item.title]) + if (childResult.length > 0) { + return childResult + } + } else if (item.path && (pathname === item.path || isPathPrefix(pathname, item.path))) { + return parentPath } + } - return { - ...item, - items: newItems, - openImmediately, - } - }) + return [] } -const renderItems = ({ collapse = false, depth = 0, items, pathname, category = '' }) => +const renderItems = ({ + collapse = false, + depth = 0, + items, + pathname, + category = '', + openMenus, + onMenuToggle, +}) => items.reduce( - (acc, item) => reduceChildRoutes({ acc, collapse, depth, item, pathname, category }), + (acc, item) => + reduceChildRoutes({ + acc, + collapse, + depth, + item, + pathname, + category, + openMenus, + onMenuToggle, + siblings: items, + }), [] ) -const reduceChildRoutes = ({ acc, collapse, depth, item, pathname, category }) => { +const reduceChildRoutes = ({ + acc, + collapse, + depth, + item, + pathname, + category, + openMenus, + onMenuToggle, + siblings = [], +}) => { const checkPath = !!(item.path && pathname) const exactMatch = checkPath && pathname === item.path - const partialMatch = checkPath ? isPathPrefix(pathname, item.path) : false + let partialMatch = checkPath ? isPathPrefix(pathname, item.path) : false const hasChildren = item.items && item.items.length > 0 - const isActive = exactMatch || (partialMatch && !hasChildren) const currentCategory = depth === 0 && item.type === 'header' ? item.title : category + // A longer sibling path wins, so /teams-share/onedrive does not stay active on + // /teams-share/onedrive/file-browser. + if (partialMatch && !exactMatch && !hasChildren) { + const allLeafPaths = [] + const collectLeafPaths = (nodes) => { + for (const sibling of nodes) { + if (sibling.items && sibling.items.length > 0) { + collectLeafPaths(sibling.items) + } else if (sibling.path) { + allLeafPaths.push(sibling.path) + } + } + } + collectLeafPaths(siblings) + const hasMoreSpecificMatch = allLeafPaths.some( + (p) => + p !== item.path && + p.length > item.path.length && + (pathname === p || isPathPrefix(pathname, p)) + ) + if (hasMoreSpecificMatch) { + partialMatch = false + } + } + + const isActive = exactMatch || (partialMatch && !hasChildren) + const isOpen = openMenus.includes(item.title) + if (hasChildren) { acc.push( onMenuToggle(item.title, depth)} path={item.path} scope={item.scope} title={item.title} @@ -93,6 +144,8 @@ const reduceChildRoutes = ({ acc, collapse, depth, item, pathname, category }) = items: item.items, pathname, category: currentCategory, + openMenus, + onMenuToggle, })} @@ -117,7 +170,7 @@ const reduceChildRoutes = ({ acc, collapse, depth, item, pathname, category }) = return acc } -export const SideNav = (props) => { +export const SideNav = memo((props) => { const { items, onPin, pinned = false } = props const pathname = usePathname() const [hovered, setHovered] = useState(false) @@ -126,6 +179,27 @@ export const SideNav = (props) => { const settings = useSettings() const showSidebarBookmarks = settings.bookmarkSidebar !== false const paperRef = useRef(null) + const [openMenus, setOpenMenus] = useState([]) + + useEffect(() => { + setOpenMenus(findActiveMenuPath(items, pathname)) + }, [pathname, items]) + + // Top-level menus accordion; nested menus toggle independently. + const handleMenuToggle = useCallback((title, depth) => { + setOpenMenus((prev) => { + if (depth === 0) { + if (prev.includes(title)) { + return [] + } + return [title] + } + if (prev.includes(title)) { + return prev.filter((t) => t !== title) + } + return [...prev, title] + }) + }, []) // Intercept wheel events on the side nav to fully isolate scroll. // preventDefault stops wheel events from reaching the main content, @@ -191,10 +265,8 @@ export const SideNav = (props) => { el.removeEventListener('wheel', handleWheel) el.removeEventListener('scroll', handleScroll) } - }, []) + }, [profile?.clientPrincipal]) - // Preprocess items to mark which should be open - const processedItems = markOpenItems(items, pathname) return ( <> {profile?.clientPrincipal && profile?.clientPrincipal?.userRoles?.length > 2 && ( @@ -218,7 +290,7 @@ export const SideNav = (props) => { width: collapse ? SIDE_NAV_COLLAPSED_WIDTH : SIDE_NAV_WIDTH, zIndex: (theme) => theme.zIndex.appBar - 100, }, - } + }, }} > { p: 0, }} > - {/* Bookmarks section above Dashboard */} {showSidebarBookmarks && ( <> - {/* mt matches the rail row's mb: 1, so the dividers meet across the seam */} )} - {/* Render all menu items */} {renderItems({ collapse, depth: 0, - items: processedItems, + items, pathname, + openMenus, + onMenuToggle: handleMenuToggle, })} - {' '} - {/* Add this closing tag */} - {profile?.clientPrincipal && ( - - - - )} - {' '} - {/* Closing tag for the parent Box */} + + )} - ); -} + ) +}) + +SideNav.displayName = 'SideNav' SideNav.propTypes = { onPin: PropTypes.func, diff --git a/frontend/src/layouts/top-nav.jsx b/frontend/src/layouts/top-nav.jsx index 7574233105..e400a49360 100644 --- a/frontend/src/layouts/top-nav.jsx +++ b/frontend/src/layouts/top-nav.jsx @@ -39,7 +39,7 @@ export const TopNav = (props) => { const { onNavOpen } = props const settings = useSettings() const { bookmarks, setBookmarks } = useUserBookmarks() - // same gate as the side nav in layouts/index.js, the hamburger below is the drawer's only opener + // same gate as the side nav in layouts/index.jsx, the hamburger below is the drawer's only opener const navCollapsed = useIsMobileLayout() const showPopoverBookmarks = settings.bookmarkPopover === true const reorderMode = settings.bookmarkReorderMode || 'arrows' @@ -231,12 +231,16 @@ export const TopNav = (props) => { } }, [openUniversalSearch]) + const lightBar = effectivePaletteMode === 'light' + return ( { @@ -279,18 +283,23 @@ export const TopNav = (props) => { mr: navCollapsed ? 1 : 0 }}> {/* On phones the logo gives way to the tenant chip — the app's primary scoping - control earns the space a 24px decorative link was using. */} + control earns the space the wordmark was using. */} {!navCollapsed && ( - + )} {!navCollapsed && ( @@ -710,7 +719,7 @@ export const TopNav = (props) => { )} - Universal Search + Manage365 Search {!navCollapsed && ( ( - - - 401 - Not allowed - - - -) +const Page = () => { + const theme = useTheme(); + const router = useRouter(); -export default Page + return ( + <> + + + 401 - Unauthorized + + + + + + {/* Icon */} + + + + + {/* Title */} + + Error 401 + + + {/* Subtitle */} + + Unauthorized Access + + + {/* Description */} + + You don't have permission to access this page. Please check your credentials + or contact your administrator if you believe this is an error. + + + {/* Action Buttons */} + + + + + + + + + + + ); +}; + +export default Page; diff --git a/frontend/src/pages/500.jsx b/frontend/src/pages/500.jsx index 09beb51886..f5b23ff072 100644 --- a/frontend/src/pages/500.jsx +++ b/frontend/src/pages/500.jsx @@ -1,93 +1,205 @@ -import { Box, Button, Container, Stack, Typography } from '@mui/material' -import Head from 'next/head' -import { CippErrorState } from '../components/CippComponents/CippErrorState' -import { Layout as DashboardLayout } from '../layouts/index' -import { clearQueryCacheAndReload } from '../utils/clear-query-cache' -import { useEffect } from 'react' -import { useRouter } from 'next/router.js' -import { ErrorBoundary } from 'react-error-boundary' - -// Minimal fallback if DashboardLayout itself crashes — breaks the infinite loop. -// Deliberately plain: no layout, no shared component, nothing that could be the -// thing that just threw. -const MinimalErrorFallback = ({ error, resetErrorBoundary, outerError }) => ( - - - - Error 500 - Something went wrong - Oh no! It seems something went wrong. - - {outerError?.message || error?.message} - - - - - - - - -) +import { Box, Container, Stack, Typography, Paper, Button, Alert, Collapse, IconButton } from "@mui/material"; +import { Grid } from "@mui/system"; +import Head from "next/head"; +import { Layout as DashboardLayout } from "../layouts/index.jsx"; +import { useEffect, useState } from "react"; +import { useRouter } from "next/router.js"; +import { alpha, useTheme } from "@mui/material/styles"; +import { Error as ErrorIcon, Refresh, ExpandMore, ExpandLess, ContentCopy, Check } from "@mui/icons-material"; const Error500 = (props) => { - //when we browse away from the page we want to reset the error boundary - //this will prevent the error from showing on other pages - const router = useRouter() + const theme = useTheme(); + const router = useRouter(); + const [showDetails, setShowDetails] = useState(false); + const [copied, setCopied] = useState(false); + + // When we browse away from the page we want to reset the error boundary + // This will prevent the error from showing on other pages useEffect(() => { - // The app-level ErrorBoundary keeps showing this fallback across route - // changes until it is reset, so an unmount cleanup never fires — reset when - // navigation completes instead, letting the new route render. Guarded: - // resetErrorBoundary is undefined when /500 is visited as a plain route. - if (!props.resetErrorBoundary) return - const handleRouteChange = () => props.resetErrorBoundary() - router.events.on('routeChangeComplete', handleRouteChange) - return () => router.events.off('routeChangeComplete', handleRouteChange) - // eslint-disable-next-line react-hooks/exhaustive-deps - }, []) + return () => { + props.resetErrorBoundary(); + }; + }, [router]); + + const errorMessage = props.error?.message || "An unexpected error occurred"; + const errorStack = props.error?.stack || ""; + + const handleCopyError = () => { + const errorText = `Error: ${errorMessage}\n\nStack Trace:\n${errorStack}`; + navigator.clipboard.writeText(errorText).then(() => { + setCopied(true); + setTimeout(() => setCopied(false), 2000); + }); + }; return ( - ( - - )} - > - + <> + 500 - Error - + + + + + {/* Error Icon */} + + + + + {/* Title */} + + Error 500 + + + {/* Subtitle */} + + Something went wrong + + + {/* Error Message Box */} + + + {errorMessage} + + + + {/* Help Text */} + + An error occurred while processing your request. You can try again or go back to the previous page. + + + {/* Action Buttons */} + + + + + + {/* Technical Details Toggle */} + {errorStack && ( + + + + + + + {copied ? ( + + ) : ( + + )} + + + {errorStack} + + + + + )} + + + + - - ) -} + + ); +}; -export default Error500 +export default Error500; diff --git a/frontend/src/pages/_app.jsx b/frontend/src/pages/_app.jsx index 2518927246..c52463b4b1 100644 --- a/frontend/src/pages/_app.jsx +++ b/frontend/src/pages/_app.jsx @@ -11,8 +11,6 @@ import { store } from '../store' import { createTheme } from '../theme' import { createEmotionCache } from '../utils/create-emotion-cache' import '../libs/nprogress' -import 'driver.js/dist/driver.css' -import '../styles/tutorial-overrides.css' import { PrivateRoute } from '../components/PrivateRoute' import { QueryClient, QueryClientProvider } from '@tanstack/react-query' import { useSystemPrefersDark } from '../hooks/use-system-prefers-dark' @@ -46,16 +44,11 @@ import { import TimeAgo from 'javascript-time-ago' import en from 'javascript-time-ago/locale/en.json' import CippSpeedDial from '../components/CippComponents/CippSpeedDial' -import { getHelpLinks, clearCippCache } from '../utils/help-links' -import { Chip, SvgIcon } from '@mui/material' -import React, { useEffect, useState, useRef } from 'react' -import { usePathname } from 'next/navigation' +import { clearCippCache } from '../utils/help-links' +import React, { useEffect, useState } from 'react' import { useRouter } from 'next/router' import { persistQueryClient } from '@tanstack/react-query-persist-client' import { createSyncStoragePersister } from '@tanstack/query-sync-storage-persister' -import { TutorialProvider } from '../contexts/tutorial-context' -import CippTutorialDialog from '../components/CippComponents/CippTutorialDialog' -import CippSupportBundleDialog from '../components/CippComponents/CippSupportBundleDialog' const ReactQueryDevtoolsProduction = React.lazy(() => import('@tanstack/react-query-devtools/build/modern/production.js').then((d) => ({ @@ -80,12 +73,8 @@ const App = (props) => { document.getElementById('cipp-color-init')?.remove() }, []) - const pathname = usePathname() const route = useRouter() const [dateLocale, setDateLocale] = useState(enUS) - const [tutorialDialogOpen, setTutorialDialogOpen] = useState(false) - const [supportBundleOpen, setSupportBundleOpen] = useState(false) - const [supportRecording, setSupportRecording] = useState(false) useEffect(() => { if (typeof window === 'undefined') return @@ -192,15 +181,6 @@ const App = (props) => { } }, []) - // Link/cache destinations are shared with AccountPopover's mobile help section — see - // utils/help-links.js. Only the icons and SpeedDial-specific actions live here. - const helpLinkIcons = { - 'bug-report': , - 'feature-request': , - discord: Discord, - documentation: , - } - const speedDialActions = [ { id: 'clearCache', @@ -215,29 +195,12 @@ const App = (props) => { href: '/license', onClick: () => route.push('/license'), }, - { - id: 'supportBundle', - icon: , - name: 'Generate Support File', - onClick: () => setSupportBundleOpen(true), - }, - ...getHelpLinks(pathname).map((link) => ({ - ...link, - icon: helpLinkIcons[link.id], - onClick: () => window.open(link.href, '_blank'), - })), - { - id: 'tutorials', - icon: , - name: 'Tutorials', - onClick: () => setTutorialDialogOpen(true), - }, ] return ( - CIPP + Manage365 @@ -248,7 +211,7 @@ const App = (props) => { {(settings) => { // Create theme even while initializing to avoid blank screen const theme = createTheme({ - colorPreset: 'orange', + colorPreset: 'cerulean', direction: settings.direction || 'ltr', paletteMode: settings.currentTheme?.value !== 'browser' @@ -264,41 +227,11 @@ const App = (props) => { - - - {getLayout()} - - setTutorialDialogOpen(false)} - /> - setSupportBundleOpen(false)} - onRecordingChange={setSupportRecording} - /> - + + {getLayout()} + - {supportRecording && !supportBundleOpen && ( - } - label="Recording — click to stop" - color="error" - onClick={() => setSupportBundleOpen(true)} - sx={{ - position: 'fixed', - bottom: 20, - // Pinned left of the speed dial FAB (46px wide + 12px gap), - // which itself shifts left when devtools is enabled. - right: - (settings.isInitialized && settings?.showDevtools === true - ? 60 - : 12) + 58, - zIndex: (muiTheme) => muiTheme.zIndex.speedDial, - }} - /> - )} } diff --git a/frontend/src/pages/_document.jsx b/frontend/src/pages/_document.jsx index 78b0e64237..6f35aedb47 100644 --- a/frontend/src/pages/_document.jsx +++ b/frontend/src/pages/_document.jsx @@ -20,7 +20,7 @@ class CustomDocument extends Document {